diff --git a/.agents/skills/agent-sandbox-deploy/SKILL.md b/.agents/skills/agent-sandbox-deploy/SKILL.md
index f1533d6a4..1ea774acd 100644
--- a/.agents/skills/agent-sandbox-deploy/SKILL.md
+++ b/.agents/skills/agent-sandbox-deploy/SKILL.md
@@ -108,9 +108,8 @@ test -x "$kindctl"
    "$orka_kind_deploy"
    ```
 
-   The harness-wrapper image must be present for the separate plain-agent model
-   smoke. The model-free direct workspace-adapter smoke bypasses the Task/harness
-   path.
+   The digest-pinned ACP runtime images must be present for the separate plain-agent
+   model smoke. The model-free direct workspace-adapter smoke bypasses the Task-to-RuntimeSession path.
 
 3. **Install agent-sandbox** by driving the canonical script against the kindctl
    kubeconfig. Export `KUBECONFIG` from kindctl so the script's `kubectl` calls
@@ -208,12 +207,132 @@ test -x "$kindctl"
      wget -qO- http://127.0.0.1:1337/readyz
    ```
 
-   If you only need model-free confidence, run the CI parity script from the
-   `Model-free CI parity` section of `references/validate.md`. It validates
-   installation/configuration plus the direct workspace-adapter lifecycle
-   (SandboxClaim readiness, router exec, delete, retained reuse, and claim
-   cleanup);
-   only the full workspace-backed agent Task path remains gated.
+   If you only need model-free confidence, run the CI parity script below. It
+   validates installation/configuration only while workspace-backed agent Tasks
+   remain gated; it is not a claim/readiness/exec/cleanup smoke.
+
+## Validate
+
+> **Current boundary:** this skill validates the upstream agent-sandbox
+> provider directly. Orka ACP RuntimeSessions do not yet map to sandbox claims;
+> execution-workspace-backed agent Tasks remain expected-future evidence. The
+> removed v1 harness-wrapper path must not be reintroduced. Validate plain
+> Codex/Claude ACP Tasks with `scripts/live-acp-runtime-e2e.sh`.
+
+Do **not** use an execution-workspace agent Task as the success criterion yet.
+Validate the two currently wired paths separately:
+
+- **Model path through ACP** (requires the optional `AGENTIC=1` step and
+  vekil ready): run a plain agent Task with no `execution.workspace` and wait
+  for it to succeed.
+
+```bash
+"$kindctl" kubectl -n demo-magic apply -f - <<'YAML'
+apiVersion: core.orka.ai/v1alpha1
+kind: Agent
+metadata:
+  name: sandbox-codex-agent
+  namespace: demo-magic
+spec:
+  runtime:
+    type: codex
+    defaultMaxTurns: 1
+    defaultAllowBash: true
+  model:
+    name: gpt-5.5
+  secretRef:
+    name: sandbox-model-key
+---
+apiVersion: core.orka.ai/v1alpha1
+kind: Task
+metadata:
+  name: orka-live-model-smoke
+  namespace: demo-magic
+spec:
+  type: agent
+  agentRef:
+    name: sandbox-codex-agent
+  agentRuntime:
+    maxTurns: 1
+  timeout: 10m0s
+  prompt: "Reply exactly: ORKA_LIVE_MODEL_OK"
+YAML
+
+"$kindctl" kubectl -n demo-magic \
+  wait --for=jsonpath='{.status.phase}'=Succeeded task/orka-live-model-smoke --timeout=10m
+```
+
+- **Installation/configuration parity**: run the model-free CI parity script
+  below when you want a self-contained cluster bring-up with fake model
+  credentials. It verifies the install/config path, but it does **not** exercise
+  claim → ready → exec → cleanup through the direct adapter.
+
+If you need to demonstrate the intended API shape before RuntimeSession-backed workspace support lands, run it only as an **expected-failure** check and wait for the gate
+instead of `Succeeded`:
+
+```bash
+"$kindctl" kubectl apply -f - <<'YAML'
+apiVersion: core.orka.ai/v1alpha1
+kind: Agent
+metadata:
+  name: sandbox-codex-agent
+  namespace: demo-magic
+spec:
+  runtime:
+    type: codex
+    defaultMaxTurns: 1
+    defaultAllowBash: true
+  model:
+    name: gpt-5.5
+  secretRef:
+    name: sandbox-model-key
+---
+apiVersion: core.orka.ai/v1alpha1
+kind: Task
+metadata:
+  name: orka-live-sandbox-smoke
+  namespace: demo-magic
+spec:
+  type: agent
+  agentRef:
+    name: sandbox-codex-agent
+  agentRuntime:
+    maxTurns: 1
+  timeout: 10m0s
+  execution:
+    workspace:
+      enabled: true
+      templateRef:
+        name: orka-live-template
+      reusePolicy: none
+      cleanupPolicy: delete
+  prompt: "Reply exactly: ORKA_LIVE_SANDBOX_OK"
+YAML
+
+"$kindctl" kubectl -n demo-magic \
+  wait --for=jsonpath='{.status.executionWorkspace.reason}'=WorkspaceValidationFailed \
+  task/orka-live-sandbox-smoke --timeout=2m
+```
+
+Once ACP RuntimeSessions map agent Tasks to execution workspaces, the expected-failure
+check can become the live success smoke. At that point, a successful sandbox
+wrapper log should include the claimed workspace name, e.g. `completed in
+sandbox workspace sandbox-claim-...`. Orka Task status does **not** expose
+sandbox claim/exec/cleanup state — read worker logs and upstream agent-sandbox
+resources for lifecycle detail.
+
+### Model-free CI parity
+
+`scripts/live-agent-sandbox-e2e.sh` (run by the `Live Agent Sandbox E2E`
+workflow) stands up a clean kind cluster with fake model credentials and **no
+model access**. The script exercises the direct workspace adapter (claim, readiness, router exec, delete, retained reuse, and cleanup) but deliberately skips the unsupported full ACP Task-to-workspace path:
+
+```bash
+bash scripts/live-agent-sandbox-e2e.sh
+```
+
+That script owns its own cluster lifecycle; do not run it against a kindctl
+cluster you want to keep.
 
 ## Guardrails
 
diff --git a/.agents/skills/agent-sandbox-deploy/references/validate.md b/.agents/skills/agent-sandbox-deploy/references/validate.md
index 836e1d6c3..b63a55317 100644
--- a/.agents/skills/agent-sandbox-deploy/references/validate.md
+++ b/.agents/skills/agent-sandbox-deploy/references/validate.md
@@ -2,31 +2,14 @@
 
 Validation steps for `$agent-sandbox-deploy`. Read after the standard workflow completes.
 
-> **Known gate (verified live 2026-06): valid enabled provider-based agent
-> workspace requests are rejected during execution planning by the current
-> service-backed harness runtime.** After workspace validation/resolution, the
-> provider-based request documented below fails with
-> `status.executionWorkspace.reason=WorkspaceValidationFailed` and message
-> `execution workspace is not supported by harness runtime yet`. The gate is in
-> `internal/controller/agent_execution_plan.go` (`planAgentExecution`), not a
-> misconfiguration. The agent CLI runtimes now
-> run through the long-lived `agent-harness-wrapper` service, and the
-> Task→sandbox-workspace path for agents is not wired through it yet. A **plain**
-> agent Task (no `execution.workspace`) runs fine through the harness + model
-> proxy, so use that to confirm the model path. The model-free e2e confirms
-> installation/configuration and exercises the direct workspace adapter through
-> SandboxClaim readiness, router exec, delete, retained release/reuse, and final
-> claim cleanup. It skips only the full execution-workspace Task smoke while the
-> harness gate is present. Treat the execution-workspace YAML in the optional
-> expected-failure check as the intended future Task API once the harness wires
-> workspaces.
+> **Known gate:** Orka ACP RuntimeSessions do not yet map to agent-sandbox claims. The direct adapter lifecycle is supported for local validation, but a `Task.spec.execution.workspace` agent Task must still fail closed with `WorkspaceValidationFailed`. Plain Codex/Claude Tasks run through controller-owned ACP RuntimePools and validate the model path separately.
 
 Do **not** use an execution-workspace agent Task as the success criterion yet.
 Validate the three current surfaces separately: installation/configuration,
 direct workspace-adapter lifecycle, and the model path through a plain agent
 Task.
 
-- **Model path through the harness** (requires the optional `AGENTIC=1` step and
+- **Model path through ACP** (requires the optional `AGENTIC=1` step and
   vekil ready): run a plain agent Task with no `execution.workspace` and wait
   for it to succeed.
 
@@ -73,7 +56,7 @@ YAML
   flags and confirms rollout, then exercises claim → ready → router exec →
   delete and retained release/reuse → claim cleanup through
   `AgentSandboxExecutor`. It skips only the full Orka agent Task
-  workspace path while the harness gate is present.
+  workspace path while the ACP workspace-dispatch gate is present.
 
 If you need to demonstrate the intended API shape before harness workspace
 support lands, run it only as an **expected-failure** check and wait for the gate
@@ -123,7 +106,7 @@ YAML
   task/orka-live-sandbox-smoke --timeout=2m
 ```
 
-Once the harness wires agent Tasks to execution workspaces, the expected-failure
+Once ACP RuntimeSessions map agent Tasks to execution workspaces, the expected-failure
 check can become the live success smoke. At that point, a successful sandbox
 wrapper log should include the claimed workspace name, e.g. `completed in
 sandbox workspace sandbox-claim-...`. Orka Task status does **not** expose
@@ -140,7 +123,7 @@ smoke that creates SandboxClaims, waits for readiness, executes through the
 router, deletes one claim, retains and reuses another, and performs final claim
 cleanup. It skips only the full Orka agent Task workspace smoke, so it proves the
 provider-adapter path but not Task-to-workspace controller routing, Task status/
-result wiring, harness execution, or model access:
+result wiring, ACP Task execution, or model access:
 
 ```bash
 bash scripts/live-agent-sandbox-e2e.sh
diff --git a/.agents/skills/agent-substrate-deploy/SKILL.md b/.agents/skills/agent-substrate-deploy/SKILL.md
index 36bd86ee3..01cf70b01 100644
--- a/.agents/skills/agent-substrate-deploy/SKILL.md
+++ b/.agents/skills/agent-substrate-deploy/SKILL.md
@@ -26,8 +26,7 @@ the CI-proven `scripts/agent-substrate-e2e.sh`. **Drive the installer in place;
 do not copy either script into the skill.** They pin the Substrate revision
 (`SUBSTRATE_REF`, default `b80031d260959b1fc5c6f61e3099fe2a6d368af1`) and own the
 heavy lifting: clone Substrate at the pinned ref, create the kind cluster + local
-registry, deploy the `ate-system` control plane, build/push the controller,
-agent-harness-wrapper, workspace-agent, MCP server, and tool-client images;
+registry, deploy the `ate-system` control plane, build/push the controller, workspace-agent, MCP server, and tool-client images;
 publish the Substrate `ateom-gvisor` image; create a `WorkerPool` + gVisor
 `ActorTemplate`, initialize the RustFS snapshot bucket, and deploy Orka
 wired with `--substrate-*`. Re-pin by overriding `SUBSTRATE_REF`, not by editing
@@ -120,17 +119,9 @@ is a larger task; confirm scope before attempting it.
    kind export kubeconfig --name "${cluster}" --kubeconfig "${KUBECONFIG}"
    DEMO_CLUSTER_REUSE=reuse bash hack/demos/cluster/install-substrate.sh
 
-   # The base e2e creates codex-substrate-ci without model env and patches the
-   # service-backed harness wrapper to use a fake Codex CLI. Patch the Agent with
-   # the model Secret from the agentic layer and remove the fake CLI override
-   # before using a plain agent Task as model-validation evidence.
-   kubectl --context "$ctx" -n default patch agent codex-substrate-ci --type=merge \
-     -p "$(jq -cn \
-       --arg ref substrate-model-key \
-       --arg model gpt-5.5 \
-       '{spec:{model:{name:$model},secretRef:{name:$ref}}}')"
-   kubectl --context "$ctx" -n orka-system set env deployment/orka-agent-harness-wrapper CODEX_CLI_PATH-
-   kubectl --context "$ctx" -n orka-system rollout status deployment/orka-agent-harness-wrapper --timeout=5m
+   # This installer validates only the direct Substrate and MCP paths. The
+   # pre-cutover AGENTIC/model layer is retired. Validate Codex or Claude ACP
+   # RuntimePools separately with scripts/live-acp-runtime-e2e.sh.
    ```
 
    > **Login race (verified live 2026-06): disarm vekil's liveness probe before
@@ -180,8 +171,85 @@ is a larger task; confirm scope before attempting it.
    ```
 
    For a model-free validation, stay on `AGENTIC=0` and rely on the built-in
-   smoke exercises documented in `references/validate.md` instead of standing
-   up vekil.
+   smoke exercises (next section) instead of standing up vekil.
+
+## Validate
+
+> **Current boundary:** this skill validates direct Substrate Actor and MCP
+> behavior only. Orka ACP RuntimeSessions do not yet map to Substrate Actors;
+> execution-workspace-backed agent Tasks remain future integration evidence,
+> not a success criterion. The removed v1 harness-wrapper path must not be
+> reintroduced. Validate plain Codex/Claude ACP Tasks with
+> `scripts/live-acp-runtime-e2e.sh` instead.
+
+The installer leaves a fully wired cluster. During standup it smoke-tests direct
+actor create/resume/exec/suspend/delete and Substrate-backed MCP tool lifecycle.
+It does **not** currently smoke-test retained workspace reuse for Orka agent
+Tasks because ACP RuntimeSession-to-Actor dispatch is not yet wired.
+
+If you skipped the kubeconfig export in the workflow above, do it before any
+manual `kubectl` commands — the e2e standup uses an isolated kubeconfig and does
+**not** leave `kind-<KIND_CLUSTER>` in your default one. Keep using the scoped
+`KUBECONFIG` in that shell:
+
+```bash
+cluster="${KIND_CLUSTER:-orka-agent-substrate-e2e}"
+ctx="kind-${cluster}"
+export KUBECONFIG="$(mktemp -t orka-substrate-kubeconfig.XXXXXX)"
+kind export kubeconfig --name "${cluster}" --kubeconfig "${KUBECONFIG}"
+```
+
+To drive an Orka Task yourself (intended shape; currently gated as noted above):
+
+```bash
+cluster="${KIND_CLUSTER:-orka-agent-substrate-e2e}"
+ctx="kind-${cluster}"
+export KUBECONFIG="$(mktemp -t orka-substrate-kubeconfig.XXXXXX)"
+kind export kubeconfig --name "${cluster}" --kubeconfig "${KUBECONFIG}"
+kubectl --context "$ctx" -n default apply -f - <<'YAML'
+apiVersion: core.orka.ai/v1alpha1
+kind: Task
+metadata:
+  name: substrate-smoke
+  namespace: default
+spec:
+  type: agent
+  agentRef:
+    name: codex-substrate-ci
+  prompt: "Run make test and summarize the result."
+  sessionRef:
+    name: substrate-demo
+    create: true
+  execution:
+    workspace:
+      enabled: true
+      provider: substrate
+      templateRef:
+        name: orka-codex-ci
+        namespace: ate-demo
+      reusePolicy: session
+      cleanupPolicy: retain
+YAML
+
+kubectl --context "$ctx" -n default get task substrate-smoke -o yaml
+```
+
+Check the provider-neutral workspace lifecycle in
+`status.executionWorkspace` (`phase`, `placement`, `density`, `resumeLatency`).
+Status is intentionally sanitized — it must not expose actor IDs, snapshot URIs,
+worker pod IPs, daemon URLs, or tokens.
+
+### CI parity
+
+`scripts/agent-substrate-e2e.sh` (the `Agent Substrate E2E` workflow) runs the
+same path end-to-end and is secret-free. Run it directly when you want a clean,
+self-contained validation with its own cluster lifecycle:
+
+```bash
+PATH="$(go env GOPATH)/bin:$PATH" SUBSTRATE_E2E_EXTENDED=1 bash scripts/agent-substrate-e2e.sh
+```
+
+Set `KEEP_CLUSTER=1` to inspect the cluster after a failure.
 
 ## Guardrails
 
diff --git a/.agents/skills/agent-substrate-deploy/references/validate.md b/.agents/skills/agent-substrate-deploy/references/validate.md
index c9e48c6e4..a404efdd9 100644
--- a/.agents/skills/agent-substrate-deploy/references/validate.md
+++ b/.agents/skills/agent-substrate-deploy/references/validate.md
@@ -2,31 +2,12 @@
 
 Validation steps for `$agent-substrate-deploy`. Read after the standard workflow completes.
 
-> **Known gate (verified live 2026-06): valid enabled provider-based agent
-> workspace requests are rejected during execution planning by the current
-> service-backed harness runtime.** After workspace validation/resolution, a
-> `provider: substrate` (or `agent-sandbox`) request fails with
-> `status.executionWorkspace.reason=WorkspaceValidationFailed` and message
-> `execution workspace is not supported by harness runtime yet`. The gate is in
-> `internal/controller/agent_execution_plan.go` (`planAgentExecution`), not a
-> misconfiguration — the agent CLI runtimes now
-> run through the long-lived `agent-harness-wrapper` service, and the
-> Task→workspace path for agents is not wired through it yet. The bundled e2e
-> reflects this: it prints `Skipping agent Task execution-workspace checks:
-> harness-wrapper runtime is service-backed`. The bundled e2e validates the
-> **direct** Substrate path (actor create/resume/router/daemon exec/suspend/delete)
-> plus Substrate-backed MCP tool create/reconcile/cleanup. It does not run a plain
-> agent Task. After clearing the fake `CODEX_CLI_PATH` override in standard
-> workflow step 4 (`Add the model proxy (vekil) — pause for the human`) of
-> `../SKILL.md`, use a **plain** agent Task (no `execution.workspace`) to validate
-> the harness + model proxy separately. Treat the Task YAML below as the intended
-> workspace API once the harness wires workspaces; until then, validate the
-> workspace provider via the e2e's direct-actor exercises.
+> **Known gate:** Orka ACP RuntimeSessions do not yet map to Substrate Actors. The bundled E2E validates direct Actor create/resume/exec/suspend/delete plus Substrate-backed MCP lifecycle; a provider-backed agent Task remains expected-failure evidence. Validate plain Codex/Claude ACP Tasks separately with `scripts/live-acp-runtime-e2e.sh`.
 
 The installer leaves a fully wired cluster. During standup it smoke-tests direct
 actor create/resume/exec/suspend/delete and Substrate-backed MCP tool lifecycle.
 It does **not** currently smoke-test retained workspace reuse for Orka agent
-Tasks because those execution-workspace checks are skipped by the harness gate.
+Tasks because those execution-workspace checks are skipped by the ACP workspace-dispatch gate.
 
 If you skipped standard workflow step 3 (`Export kubeconfig for follow-up
 kubectl commands`) in `../SKILL.md`, do it before any
diff --git a/.dockerignore b/.dockerignore
index dc21294ef..ccf43037f 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -29,9 +29,15 @@
 # Re-include Go module files
 !go.mod
 !go.sum
+!LICENSE
+!NOTICE.md
 
 # Re-include script-local Go helpers used by live E2E Docker builds
 !scripts/
+!scripts/fixtures/
+!scripts/fixtures/security-scan-fake-acp/
+!scripts/fixtures/security-scan-fake-acp/*.go
+scripts/fixtures/security-scan-fake-acp/*_test.go
 
 # Re-include UI source files for frontend build
 !ui/
@@ -55,3 +61,10 @@ ui/tsconfig.tsbuildinfo
 # Re-include pre-built UI assets for embed
 !internal/uiembed/dist/
 !internal/uiembed/dist/**
+
+# Re-include the checksum-pinned Codex ACP source patch used by its image build
+!workers/acp/images/codex/patch-agent-mode.mjs
+
+# Re-include pinned OpenCode runtime policy and notice inputs.
+!workers/acp/images/opencode/AGENTS.md
+!workers/acp/images/opencode/NOTICE.md
diff --git a/.github/actions/free-disk-space/action.yml b/.github/actions/free-disk-space/action.yml
new file mode 100644
index 000000000..cecf48632
--- /dev/null
+++ b/.github/actions/free-disk-space/action.yml
@@ -0,0 +1,28 @@
+name: Free disk space
+description: >-
+  Remove large preinstalled toolchains and prune Docker caches to free disk
+  space for Docker-heavy E2E jobs on GitHub-hosted runners.
+runs:
+  using: composite
+  steps:
+    - name: Free disk space
+      shell: bash
+      run: |
+        set -Eeuxo pipefail
+        echo "Disk usage before cleanup"
+        df -h
+        docker system df || true
+
+        sudo rm -rf /usr/share/dotnet
+        sudo rm -rf /opt/ghc
+        sudo rm -rf /usr/local/share/boost
+        sudo rm -rf /usr/local/lib/android
+        sudo rm -rf /opt/hostedtoolcache/CodeQL
+        sudo rm -rf /usr/share/swift
+
+        docker system prune -af || true
+        docker builder prune -af || true
+
+        echo "Disk usage after cleanup"
+        df -h
+        docker system df || true
diff --git a/.github/actions/setup-kind/action.yml b/.github/actions/setup-kind/action.yml
new file mode 100644
index 000000000..aec47dcd2
--- /dev/null
+++ b/.github/actions/setup-kind/action.yml
@@ -0,0 +1,46 @@
+name: Set up kind
+description: >-
+  Install a pinned kind release for the runner architecture and always verify
+  the download against a pinned per-arch SHA256 before installing it.
+inputs:
+  version:
+    description: kind release tag to install.
+    required: false
+    default: v0.31.0
+  sha256-amd64:
+    description: Pinned SHA256 of kind-linux-amd64 for the requested version.
+    required: false
+    default: eb244cbafcc157dff60cf68693c14c9a75c4e6e6fedaf9cd71c58117cb93e3fa
+  sha256-arm64:
+    description: Pinned SHA256 of kind-linux-arm64 for the requested version.
+    required: false
+    default: 8e1014e87c34901cc422a1445866835d1e666f2a61301c27e722bdeab5a1f7e4
+runs:
+  using: composite
+  steps:
+    - name: Install kind
+      shell: bash
+      env:
+        KIND_VERSION: ${{ inputs.version }}
+        KIND_SHA256_AMD64: ${{ inputs.sha256-amd64 }}
+        KIND_SHA256_ARM64: ${{ inputs.sha256-arm64 }}
+      run: |
+        set -Eeuo pipefail
+        arch="$(uname -m)"
+        case "${arch}" in
+          x86_64|amd64) arch=amd64; expected_sha="${KIND_SHA256_AMD64}" ;;
+          aarch64|arm64) arch=arm64; expected_sha="${KIND_SHA256_ARM64}" ;;
+          *) echo "unsupported runner architecture: ${arch}" >&2; exit 1 ;;
+        esac
+        if [[ -z "${expected_sha}" ]]; then
+          echo "missing pinned kind SHA256 for ${arch}" >&2
+          exit 1
+        fi
+        tmp_dir="$(mktemp -d)"
+        curl -fsSL --retry 3 --retry-delay 2 -o "${tmp_dir}/kind" \
+          "https://kind.sigs.k8s.io/dl/${KIND_VERSION}/kind-linux-${arch}"
+        printf '%s  %s\n' "${expected_sha}" "${tmp_dir}/kind" | sha256sum --check --strict -
+        chmod +x "${tmp_dir}/kind"
+        sudo mv "${tmp_dir}/kind" /usr/local/bin/kind
+        rmdir "${tmp_dir}"
+        kind version
diff --git a/.github/workflows/agent-substrate-e2e.yml b/.github/workflows/agent-substrate-e2e.yml
index 6f6a5d710..596f576e4 100644
--- a/.github/workflows/agent-substrate-e2e.yml
+++ b/.github/workflows/agent-substrate-e2e.yml
@@ -17,6 +17,7 @@ on:
       - "internal/**"
       - "pkg/**"
       - "scripts/agent-substrate-e2e.sh"
+      - "scripts/lib/ensure-static-mode-namespace.sh"
       - "workers/**"
   push:
     paths:
@@ -33,6 +34,7 @@ on:
       - "internal/**"
       - "pkg/**"
       - "scripts/agent-substrate-e2e.sh"
+      - "scripts/lib/ensure-static-mode-namespace.sh"
       - "workers/**"
 
 permissions:
@@ -48,7 +50,6 @@ jobs:
     timeout-minutes: 90
     env:
       KIND_CLUSTER: orka-agent-substrate-e2e
-      KIND_VERSION: v0.31.0
       KO_VERSION: v0.18.1
       SUBSTRATE_REF: b80031d260959b1fc5c6f61e3099fe2a6d368af1
       SUBSTRATE_E2E_EXTENDED: "1"
@@ -57,39 +58,24 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Free disk space for Docker-heavy E2E
-        run: |
-          set -euxo pipefail
-          echo "Disk usage before cleanup"
-          df -h
-          docker system df || true
-
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/ghc
-          sudo rm -rf /usr/local/share/boost
-          sudo rm -rf /usr/local/lib/android
-          sudo rm -rf /opt/hostedtoolcache/CodeQL
-          sudo rm -rf /usr/share/swift
-
-          docker system prune -af || true
-          docker builder prune -af || true
-
-          echo "Disk usage after cleanup"
-          df -h
-          docker system df || true
+        uses: ./.github/actions/free-disk-space
 
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
+          # The upstream Substrate clone's go.mod requires a newer toolchain
+          # than this repository's go directive, and the E2E script runs with
+          # GOTOOLCHAIN=local, so this floor must track Substrate, not go.mod.
           go-version: "1.26.3"
           cache: true
 
+      - name: Install kind
+        uses: ./.github/actions/setup-kind
+
       - name: Install prerequisites
         run: |
           sudo apt-get update
           sudo apt-get install -y jq
-          curl -Lo ./kind "https://kind.sigs.k8s.io/dl/${KIND_VERSION}/kind-linux-amd64"
-          chmod +x ./kind
-          sudo mv ./kind /usr/local/bin/kind
           echo "$(go env GOPATH)/bin" >> "${GITHUB_PATH}"
           go install "github.com/google/ko@${KO_VERSION}"
 
diff --git a/.github/workflows/agentruntime-external-e2e.yml b/.github/workflows/agentruntime-external-e2e.yml
deleted file mode 100644
index 3bc7e4e8b..000000000
--- a/.github/workflows/agentruntime-external-e2e.yml
+++ /dev/null
@@ -1,100 +0,0 @@
-name: AgentRuntime External Endpoint E2E
-
-on:
-  workflow_dispatch:
-  push:
-    paths:
-      - ".dockerignore"
-      - ".github/workflows/agentruntime-external-e2e.yml"
-      - "api/**"
-      - "cmd/**"
-      - "config/**"
-      - "examples/harness/**"
-      - "internal/controller/**"
-      - "internal/harness/**"
-      - "test/e2e/**"
-      - "test/utils/**"
-      - "Makefile"
-      - "go.mod"
-      - "go.sum"
-  pull_request:
-    paths:
-      - ".dockerignore"
-      - ".github/workflows/agentruntime-external-e2e.yml"
-      - "api/**"
-      - "cmd/**"
-      - "config/**"
-      - "examples/harness/**"
-      - "internal/controller/**"
-      - "internal/harness/**"
-      - "test/e2e/**"
-      - "test/utils/**"
-      - "Makefile"
-      - "go.mod"
-      - "go.sum"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: agentruntime-external-e2e-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  agentruntime-external-e2e:
-    name: AgentRuntime external endpoint
-    runs-on: ubuntu-latest
-    env:
-      E2E_AGENTRUNTIME_EXTERNAL: "true"
-      E2E_GO_TEST_TIMEOUT: 25m
-      KIND_CLUSTER: orka-agentruntime-external-e2e
-      KIND_VERSION: v0.31.0
-    steps:
-      - name: Clone the code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Free disk space for Docker-heavy E2E
-        run: |
-          set -euxo pipefail
-          echo "Disk usage before cleanup"
-          df -h
-          docker system df || true
-
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/ghc
-          sudo rm -rf /usr/local/share/boost
-          sudo rm -rf /usr/local/lib/android
-          sudo rm -rf /opt/hostedtoolcache/CodeQL
-          sudo rm -rf /usr/share/swift
-
-          docker system prune -af || true
-          docker builder prune -af || true
-
-          echo "Disk usage after cleanup"
-          df -h
-          docker system df || true
-
-      - name: Setup Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version-file: go.mod
-
-      - name: Install kind
-        run: |
-          curl -fsSL --retry 3 --retry-delay 2 -o ./kind "https://kind.sigs.k8s.io/dl/${KIND_VERSION}/kind-linux-$(go env GOARCH)"
-          chmod +x ./kind
-          sudo mv ./kind /usr/local/bin/kind
-
-      - name: Verify kind installation
-        run: kind version
-
-      - name: Run AgentRuntime external endpoint E2E
-        run: |
-          set -euxo pipefail
-          trap 'kind delete cluster --name "${KIND_CLUSTER}" || true' EXIT
-          make setup-test-e2e KIND_CLUSTER="${KIND_CLUSTER}"
-          go test -tags=e2e ./test/e2e/ \
-            -timeout "${E2E_GO_TEST_TIMEOUT}" \
-            -v \
-            -ginkgo.v \
-            -ginkgo.focus "AgentRuntime external endpoint"
diff --git a/.github/workflows/approval-gate-e2e.yml b/.github/workflows/approval-gate-e2e.yml
index e3d0e0491..eac3046da 100644
--- a/.github/workflows/approval-gate-e2e.yml
+++ b/.github/workflows/approval-gate-e2e.yml
@@ -17,6 +17,8 @@ on:
       - "internal/worker/**"
       - "workers/ai/**"
       - "workers/common/**"
+      - "scripts/lib/e2e-admission-tls.sh"
+      - "scripts/lib/ensure-static-mode-namespace.sh"
       - "test/e2e/**"
       - "test/utils/**"
       - "config/**"
@@ -36,6 +38,8 @@ on:
       - "internal/worker/**"
       - "workers/ai/**"
       - "workers/common/**"
+      - "scripts/lib/e2e-admission-tls.sh"
+      - "scripts/lib/ensure-static-mode-namespace.sh"
       - "test/e2e/**"
       - "test/utils/**"
       - "config/**"
@@ -53,33 +57,15 @@ jobs:
     runs-on: ubuntu-latest
     env:
       KIND_CLUSTER: orka-approval-gate-e2e
-      KIND_VERSION: v0.31.0
-      E2E_GO_TEST_TIMEOUT: 20m
+      E2E_EPHEMERAL_CLUSTER: "true"
+      E2E_GO_TEST_TIMEOUT: 30m
       E2E_GINKGO_FOCUS: Human Approval Gate
     steps:
       - name: Clone the code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Free disk space for Docker-heavy E2E
-        run: |
-          set -euxo pipefail
-          echo "Disk usage before cleanup"
-          df -h
-          docker system df || true
-
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/ghc
-          sudo rm -rf /usr/local/share/boost
-          sudo rm -rf /usr/local/lib/android
-          sudo rm -rf /opt/hostedtoolcache/CodeQL
-          sudo rm -rf /usr/share/swift
-
-          docker system prune -af || true
-          docker builder prune -af || true
-
-          echo "Disk usage after cleanup"
-          df -h
-          docker system df || true
+        uses: ./.github/actions/free-disk-space
 
       - name: Setup Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -87,10 +73,7 @@ jobs:
           go-version-file: go.mod
 
       - name: Install kind
-        run: |
-          curl -fsSL --retry 3 --retry-delay 2 -o ./kind "https://kind.sigs.k8s.io/dl/${KIND_VERSION}/kind-linux-$(go env GOARCH)"
-          chmod +x ./kind
-          sudo mv ./kind /usr/local/bin/kind
+        uses: ./.github/actions/setup-kind
 
       - name: Verify kind installation
         run: kind version
diff --git a/.github/workflows/coexistence-smoke.yml b/.github/workflows/coexistence-smoke.yml
new file mode 100644
index 000000000..d65e88ba8
--- /dev/null
+++ b/.github/workflows/coexistence-smoke.yml
@@ -0,0 +1,129 @@
+name: Static Harness Modes
+
+on:
+  push:
+    paths:
+      - ".github/workflows/coexistence-smoke.yml"
+      - "Makefile"
+      - "api/**"
+      - "cmd/main.go"
+      - "cmd/build/helmify/**"
+      - "cmd/orka-admission/**"
+      - "cmd/orka-agent-harness-wrapper/**"
+      - "config/harness-wrapper/**"
+      - "config/acp-production/**"
+      - "config/acp-workload/**"
+      - "config/orka-admission/**"
+      - "config/orka-admission-webhooks/**"
+      - "go.mod"
+      - "go.sum"
+      - "internal/admission/**"
+      - "internal/controller/agent_execution*"
+      - "internal/controller/acp_upgrade_drain*"
+      - "internal/controller/harness_v1*"
+      - "internal/executionmode/**"
+      - "internal/harness/**"
+      - "internal/store/**"
+      - "pkg/harness/**"
+      # The script jobs syntax-check every script and execute every
+      # scripts/tests/*-test.sh suite, so any script change is relevant.
+      - "scripts/**"
+      - "workers/harness/**"
+  pull_request:
+    paths:
+      - ".github/workflows/coexistence-smoke.yml"
+      - "Makefile"
+      - "api/**"
+      - "cmd/main.go"
+      - "cmd/build/helmify/**"
+      - "cmd/orka-admission/**"
+      - "cmd/orka-agent-harness-wrapper/**"
+      - "config/harness-wrapper/**"
+      - "config/acp-production/**"
+      - "config/acp-workload/**"
+      - "config/orka-admission/**"
+      - "config/orka-admission-webhooks/**"
+      - "go.mod"
+      - "go.sum"
+      - "internal/admission/**"
+      - "internal/controller/agent_execution*"
+      - "internal/controller/acp_upgrade_drain*"
+      - "internal/controller/harness_v1*"
+      - "internal/executionmode/**"
+      - "internal/harness/**"
+      - "internal/store/**"
+      - "pkg/harness/**"
+      # The script jobs syntax-check every script and execute every
+      # scripts/tests/*-test.sh suite, so any script change is relevant.
+      - "scripts/**"
+      - "workers/harness/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: static-harness-modes-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  focused-go:
+    name: Focused Go tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: Create UI embed stub
+        run: make ensure-ui-embed
+
+      - name: Run static-mode focused tests
+        run: |
+          go test \
+            ./api/v1alpha1 \
+            ./internal/admission \
+            ./internal/controller \
+            ./internal/executionmode \
+            ./internal/harness/... \
+            ./internal/store/... \
+            ./workers/harness/... \
+            ./cmd/orka-admission \
+            ./cmd/orka-agent-harness-wrapper \
+            -run '(ExecutionMode|ControllerMode|AgentContract|AgentRuntimeContract|TaskExecutionAuthority|HarnessV1|ACPUpgradeDrain|AgentExecutionSnapshotRetention|RecoverAmbiguousSubmission|RecoverActiveAttempt|DurableAdmission|DurableTurn|Ledger|SessionLineage|ReceiptPersistence|AdmissionClose)' \
+            -count=1
+
+  shell-syntax:
+    name: Static-mode deployment scripts
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Validate scripts
+        run: |
+          set -Eeuo pipefail
+          for script in scripts/*.sh scripts/lib/*.sh scripts/tests/*.sh; do
+            bash -n "${script}"
+          done
+
+      - name: Install kustomize
+        run: make kustomize
+
+      - name: Run script test suites
+        run: |
+          set -Eeuo pipefail
+          for suite in scripts/tests/*-test.sh; do
+            echo "==> ${suite}"
+            KUSTOMIZE="$PWD/bin/kustomize" bash "${suite}"
+          done
diff --git a/.github/workflows/gateway-e2e.yml b/.github/workflows/gateway-e2e.yml
index 0081ff5ec..df2cb59e2 100644
--- a/.github/workflows/gateway-e2e.yml
+++ b/.github/workflows/gateway-e2e.yml
@@ -15,6 +15,8 @@ on:
       - "go.mod"
       - "go.sum"
       - "internal/**"
+      - "scripts/lib/e2e-admission-tls.sh"
+      - "scripts/lib/ensure-static-mode-namespace.sh"
       - "test/e2e/**"
       - "test/utils/**"
       - "ui/**"
@@ -32,6 +34,8 @@ on:
       - "go.mod"
       - "go.sum"
       - "internal/**"
+      - "scripts/lib/e2e-admission-tls.sh"
+      - "scripts/lib/ensure-static-mode-namespace.sh"
       - "test/e2e/**"
       - "test/utils/**"
       - "ui/**"
@@ -50,36 +54,16 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
-      E2E_AGENTRUNTIME_EXTERNAL: "true"
       E2E_EPHEMERAL_CLUSTER: "true"
       E2E_GATEWAY: "true"
       E2E_GO_TEST_TIMEOUT: 30m
       KIND_CLUSTER: orka-gateway-e2e-${{ github.run_id }}-${{ github.run_attempt }}
-      KIND_VERSION: v0.31.0
     steps:
       - name: Clone the code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Free disk space for Docker-heavy E2E
-        run: |
-          set -euxo pipefail
-          echo "Disk usage before cleanup"
-          df -h
-          docker system df || true
-
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/ghc
-          sudo rm -rf /usr/local/share/boost
-          sudo rm -rf /usr/local/lib/android
-          sudo rm -rf /opt/hostedtoolcache/CodeQL
-          sudo rm -rf /usr/share/swift
-
-          docker system prune -af || true
-          docker builder prune -af || true
-
-          echo "Disk usage after cleanup"
-          df -h
-          docker system df || true
+        uses: ./.github/actions/free-disk-space
 
       - name: Setup Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -87,10 +71,7 @@ jobs:
           go-version-file: go.mod
 
       - name: Install kind
-        run: |
-          curl -fsSL --retry 3 --retry-delay 2 -o ./kind "https://kind.sigs.k8s.io/dl/${KIND_VERSION}/kind-linux-$(go env GOARCH)"
-          chmod +x ./kind
-          sudo mv ./kind /usr/local/bin/kind
+        uses: ./.github/actions/setup-kind
 
       - name: Verify kind installation
         run: kind version
diff --git a/.github/workflows/helm-chart.yml b/.github/workflows/helm-chart.yml
index 9dbf89c47..7d4642cb3 100644
--- a/.github/workflows/helm-chart.yml
+++ b/.github/workflows/helm-chart.yml
@@ -8,6 +8,7 @@ on:
     paths:
       - "api/**"
       - "cmd/build/helmify/**"
+      - "cmd/orka-agent-harness-wrapper/**"
       - "config/**"
       - "internal/controller/**"
       - "manifest_staging/**"
@@ -16,12 +17,20 @@ on:
       - "go.mod"
       - "go.sum"
       - "Makefile"
+      - "workers/harness/**"
       - "scripts/apply-helm-crds.sh"
+      - "scripts/tests/release-manifest-test.sh"
+      - "scripts/static-mode-crd-validate.sh"
+      - "scripts/update-release-version.py"
+      - "scripts/validate-release-manifest.sh"
+      - ".github/workflows/release-pr.yml"
+      - ".github/workflows/release.yml"
       - ".github/workflows/helm-chart.yml"
   pull_request:
     paths:
       - "api/**"
       - "cmd/build/helmify/**"
+      - "cmd/orka-agent-harness-wrapper/**"
       - "config/**"
       - "internal/controller/**"
       - "manifest_staging/**"
@@ -30,7 +39,14 @@ on:
       - "go.mod"
       - "go.sum"
       - "Makefile"
+      - "workers/harness/**"
       - "scripts/apply-helm-crds.sh"
+      - "scripts/tests/release-manifest-test.sh"
+      - "scripts/static-mode-crd-validate.sh"
+      - "scripts/update-release-version.py"
+      - "scripts/validate-release-manifest.sh"
+      - ".github/workflows/release-pr.yml"
+      - ".github/workflows/release.yml"
       - ".github/workflows/helm-chart.yml"
   workflow_dispatch:
 
@@ -49,9 +65,9 @@ jobs:
     env:
       KIND_CLUSTER: orka-helm-crd-lifecycle
       KIND_IMAGE: kindest/node:v1.33.7@sha256:d26ef333bdb2cbe9862a0f7c3803ecc7b4303d8cea8e814b481b09949d353040
-      KIND_SHA256: eb244cbafcc157dff60cf68693c14c9a75c4e6e6fedaf9cd71c58117cb93e3fa
-      KIND_VERSION: v0.31.0
       NAMESPACE: orka-helm-crd-lifecycle
+      SNAPSHOT_KEY: snapshot-key
+      SNAPSHOT_SECRET: agent-execution-snapshot-key
       PAUSE_IMAGE_REPOSITORY: registry.k8s.io/pause
       PAUSE_IMAGE_TAG: 3.10.2@sha256:f548e0e8e3dc1896ca956272154dde3314e8cc4fde0a57577ee9fa1c63f5baf4
     steps:
@@ -65,10 +81,19 @@ jobs:
         with:
           go-version-file: go.mod
 
+      - name: Run chart package comparison unit tests
+        run: |
+          set -euo pipefail
+          python3 -m pip install --quiet pytest
+          python3 -m pytest scripts/test_compare_helm_chart_packages.py -q
+
       - name: Verify generated chart and package
         run: |
           set -euo pipefail
 
+          bash -n scripts/static-mode-crd-validate.sh
+          bash -n scripts/validate-release-manifest.sh scripts/tests/release-manifest-test.sh
+          bash scripts/tests/release-manifest-test.sh
           make manifests
           if [[ -n "$(git status --porcelain --untracked-files=all)" ]]; then
             echo "Generated staging manifests are stale." >&2
@@ -76,23 +101,20 @@ jobs:
             exit 1
           fi
 
-          grep -Fq 'get secret harness-wrapper-auth' config/harness-wrapper/README.md
-          grep -Fq 'create secret generic harness-wrapper-auth' config/harness-wrapper/README.md
-          test "$(grep -c 'secretName: harness-wrapper-auth' manifest_staging/deploy/orka.yaml)" -eq 2
-          if awk '
-            /^---$/ { kind = ""; name = "" }
-            /^kind: / { kind = $2 }
-            /^  name: / { name = $2 }
-            kind == "Secret" && name == "harness-wrapper-auth" { found = 1 }
-            END { exit(found ? 0 : 1) }
-          ' manifest_staging/deploy/orka.yaml; then
-            echo "The raw installer must require a pre-created harness-wrapper-auth Secret, not embed one." >&2
+          for secret in acp-artifact-capability workspace-publisher-auth provider-auth-proxy scm-egress-proxy-auth; do
+            grep -Fq "${secret}" config/acp-workload/README.md
+            test "$(grep -c "secretName: ${secret}" manifest_staging/deploy/orka.yaml)" -ge 1
+          done
+          if grep -Fq 'harness-wrapper' manifest_staging/deploy/orka.yaml; then
+            echo "The default ACP Kustomize installer must not enable the opt-in harness v1 wrapper." >&2
+            exit 1
+          fi
+          if grep -q '^kind: Secret$' manifest_staging/deploy/orka.yaml; then
+            echo "The raw installer must require pre-created ACP Secrets, not embed credentials." >&2
             exit 1
           fi
 
           go test ./cmd/build/helmify
-          helm lint cmd/build/helmify/static
-          helm lint manifest_staging/charts/orka
 
           default_render=$(mktemp)
           secondary_render=$(mktemp)
@@ -100,52 +122,97 @@ jobs:
           secondary_serviceaccounts=$(mktemp)
           secondary_gateway_policy=$(mktemp)
           long_render=$(mktemp)
-          long_wrapper_service=$(mktemp)
-          long_wrapper_secret=$(mktemp)
-          trap 'rm -f "${default_render}" "${secondary_render}" "${secondary_rbac}" "${secondary_serviceaccounts}" "${secondary_gateway_policy}" "${long_render}" "${long_wrapper_service}" "${long_wrapper_secret}"' EXIT
-          helm template orka manifest_staging/charts/orka \
-            --namespace "${NAMESPACE}" \
-            --set-string workers.harnessWrapper.auth.token=mock-token \
-            > "${default_render}"
-          helm template secondary manifest_staging/charts/orka \
-            --namespace "${NAMESPACE}" \
-            --set-string workers.harnessWrapper.auth.token=mock-token \
-            > "${secondary_render}"
-          helm template secondary manifest_staging/charts/orka \
-            --namespace "${NAMESPACE}" \
-            --set-string workers.harnessWrapper.auth.token=mock-token \
-            --show-only templates/rbac.yaml \
-            > "${secondary_rbac}"
-          helm template secondary manifest_staging/charts/orka \
-            --namespace "${NAMESPACE}" \
-            --set-string workers.harnessWrapper.auth.token=mock-token \
-            --show-only templates/serviceaccount.yaml \
-            > "${secondary_serviceaccounts}"
-          helm template secondary manifest_staging/charts/orka \
-            --namespace "${NAMESPACE}" \
-            --set-string workers.harnessWrapper.auth.token=mock-token \
-            --show-only templates/gateway-task-admission-policy.yaml \
-            > "${secondary_gateway_policy}"
+          long_publisher_service=$(mktemp)
+          long_publisher_secret=$(mktemp)
+          long_provider_service=$(mktemp)
+          long_provider_secret=$(mktemp)
+          long_scm_service=$(mktemp)
+          long_scm_secret=$(mktemp)
+          harness_v1_render=$(mktemp)
+          harness_v1_deployment=$(mktemp)
+          harness_v1_network_policy=$(mktemp)
+          harness_v1_kustomize=$(mktemp)
+          unsafe_render=$(mktemp)
+          trap 'rm -f "${default_render}" "${secondary_render}" "${secondary_rbac}" "${secondary_serviceaccounts}" "${secondary_gateway_policy}" "${long_render}" "${long_publisher_service}" "${long_publisher_secret}" "${long_provider_service}" "${long_provider_secret}" "${long_scm_service}" "${long_scm_secret}" "${harness_v1_render}" "${harness_v1_deployment}" "${harness_v1_network_policy}" "${harness_v1_kustomize}" "${unsafe_render}"' EXIT
+          controller_digest="sha256:$(printf '0%.0s' {1..64})"
+          snapshot_args=(
+            --set-string controller.mode=harness-v2
+            --set-string "controller.watchNamespace=${NAMESPACE}"
+            --set-string "controller.image.digest=${controller_digest}"
+            --set-string "controller.agentExecutionSnapshot.existingSecret=${SNAPSHOT_SECRET}"
+            --set-string "controller.agentExecutionSnapshot.key=${SNAPSHOT_KEY}"
+            --set-string webhooks.tls.existingSecret=controller-webhook-tls
+            --set-string webhooks.caBundle=Y2E=
+            --set-string "publisher.image.digest=${controller_digest}"
+            --set providerProxy.enabled=true
+          )
+          helm lint cmd/build/helmify/static --namespace "${NAMESPACE}" "${snapshot_args[@]}"
+          helm lint manifest_staging/charts/orka --namespace "${NAMESPACE}" "${snapshot_args[@]}"
+          helm template orka manifest_staging/charts/orka "${snapshot_args[@]}"             --namespace "${NAMESPACE}"             > "${default_render}"
+          helm template secondary manifest_staging/charts/orka "${snapshot_args[@]}"             --namespace "${NAMESPACE}"             > "${secondary_render}"
+          helm template secondary manifest_staging/charts/orka "${snapshot_args[@]}"             --namespace "${NAMESPACE}"             --show-only templates/rbac.yaml             > "${secondary_rbac}"
+          helm template secondary manifest_staging/charts/orka "${snapshot_args[@]}"             --namespace "${NAMESPACE}"             --show-only templates/serviceaccount.yaml             > "${secondary_serviceaccounts}"
+          helm template secondary manifest_staging/charts/orka "${snapshot_args[@]}"             --namespace "${NAMESPACE}"             --show-only templates/gateway-task-admission-policy.yaml             > "${secondary_gateway_policy}"
 
           long_release=$(printf 'r%.0s' {1..53})
-          helm template "${long_release}" manifest_staging/charts/orka \
-            --namespace "${NAMESPACE}" \
-            --set-string workers.harnessWrapper.auth.token=mock-token \
-            > "${long_render}"
-          helm template "${long_release}" manifest_staging/charts/orka \
-            --namespace "${NAMESPACE}" \
-            --set-string workers.harnessWrapper.auth.token=mock-token \
-            --show-only templates/harness-wrapper-service.yaml \
-            > "${long_wrapper_service}"
-          helm template "${long_release}" manifest_staging/charts/orka \
-            --namespace "${NAMESPACE}" \
-            --set-string workers.harnessWrapper.auth.token=mock-token \
-            --show-only templates/harness-wrapper-secret.yaml \
-            > "${long_wrapper_secret}"
+          helm template "${long_release}" manifest_staging/charts/orka "${snapshot_args[@]}"             --namespace "${NAMESPACE}"             > "${long_render}"
+          helm template "${long_release}" manifest_staging/charts/orka "${snapshot_args[@]}" --namespace "${NAMESPACE}" --show-only templates/publisher-service.yaml > "${long_publisher_service}"
+          helm template "${long_release}" manifest_staging/charts/orka "${snapshot_args[@]}" --namespace "${NAMESPACE}" --show-only templates/publisher-secret.yaml > "${long_publisher_secret}"
+          helm template "${long_release}" manifest_staging/charts/orka "${snapshot_args[@]}" --namespace "${NAMESPACE}" --set providerProxy.enabled=true --show-only templates/provider-proxy-service.yaml > "${long_provider_service}"
+          helm template "${long_release}" manifest_staging/charts/orka "${snapshot_args[@]}" --namespace "${NAMESPACE}" --set providerProxy.enabled=true --show-only templates/provider-proxy-secret.yaml > "${long_provider_secret}"
+          helm template "${long_release}" manifest_staging/charts/orka "${snapshot_args[@]}" --namespace "${NAMESPACE}" --show-only templates/scm-egress-proxy-service.yaml > "${long_scm_service}"
+          helm template "${long_release}" manifest_staging/charts/orka "${snapshot_args[@]}" --namespace "${NAMESPACE}" --show-only templates/scm-egress-proxy-secret.yaml > "${long_scm_secret}"
+
+          harness_v1_digest="sha256:$(printf '1%.0s' {1..64})"
+          harness_v1_args=(
+            "${snapshot_args[@]}"
+            --namespace "${NAMESPACE}"
+            --set-string controller.mode=harness-v1
+            --set providerProxy.enabled=false
+            --set-string "harnessV1.image.digest=${harness_v1_digest}"
+            --set-string harnessV1.auth.existingSecret=harness-wrapper-auth
+            --set-string harnessV1.tls.existingSecret=harness-wrapper-tls
+          )
+          helm template harness-v1 manifest_staging/charts/orka "${harness_v1_args[@]}" > "${harness_v1_render}"
+          helm template harness-v1 manifest_staging/charts/orka "${harness_v1_args[@]}" --show-only templates/harness-wrapper-deployment.yaml > "${harness_v1_deployment}"
+          helm template harness-v1 manifest_staging/charts/orka "${harness_v1_args[@]}" --show-only templates/harness-wrapper-networkpolicy.yaml > "${harness_v1_network_policy}"
+          "$(pwd)/bin/kustomize" build config/harness-wrapper > "${harness_v1_kustomize}"
 
           grep -Fq -- "--controller-url=http://orka.${NAMESPACE}.svc:8080" "${default_render}"
           grep -Fq -- "--controller-url=http://secondary-orka.${NAMESPACE}.svc:8080" "${secondary_render}"
           grep -Fq -- "--ai-worker-service-account-name=orka-ai-worker" "${default_render}"
+          if ! grep -Fq -- "namespace: vekil-system" "${default_render}"; then
+            echo "Harness v2 must render the fixed Vekil ingress boundary for its required provider proxy." >&2
+            exit 1
+          fi
+          if grep -Fq -- "agent-harness-wrapper" "${default_render}"; then
+            echo "Default Helm values must keep harness v1 disabled." >&2
+            exit 1
+          fi
+          if helm template unsafe manifest_staging/charts/orka "${harness_v1_args[@]}" --set-string harnessV1.image.digest= >"${unsafe_render}" 2>&1; then
+            echo "Harness v1 must reject an enabled render without an immutable image digest." >&2
+            exit 1
+          fi
+          grep -Fq -- "harnessV1.image.digest must be a sha256 digest when controller.mode=harness-v1" "${unsafe_render}"
+          for kind in Deployment Service ServiceAccount PersistentVolumeClaim NetworkPolicy; do
+            grep -Fq -- "kind: ${kind}" "${harness_v1_render}"
+          done
+          grep -Fq -- "agent-harness-wrapper@${harness_v1_digest}" "${harness_v1_deployment}"
+          grep -Fq -- "type: Recreate" "${harness_v1_deployment}"
+          grep -Fq -- "automountServiceAccountToken: false" "${harness_v1_deployment}"
+          grep -Fq -- "ORKA_HARNESS_WRAPPER_ADMISSION_LEDGER_PATH" "${harness_v1_deployment}"
+          grep -Fq -- "/var/lib/orka/harness-v1/admission-ledger.db" "${harness_v1_deployment}"
+          if grep -Eq -- 'ORKA_SA_TOKEN_PATH|upload-token|GIT_TOKEN|GITHUB_TOKEN|ORKA_WORKSPACE_PUBLISHER|provider-auth' "${harness_v1_deployment}"; then
+            echo "Harness v1 received an ambient Git, publication, or provider credential surface." >&2
+            exit 1
+          fi
+          grep -Fq -- "app.kubernetes.io/component: controller" "${harness_v1_network_policy}"
+          grep -Fq -- "kubernetes.io/metadata.name: kube-system" "${harness_v1_network_policy}"
+          grep -Fq -- "cidr: 0.0.0.0/0" "${harness_v1_network_policy}"
+          grep -Fq -- "port: 443" "${harness_v1_network_policy}"
+          grep -Fq -- "agent-harness-wrapper@sha256:0000000000000000000000000000000000000000000000000000000000000000" "${harness_v1_kustomize}"
+          grep -Fq -- "ORKA_HARNESS_WRAPPER_ADMISSION_LEDGER_PATH" "${harness_v1_kustomize}"
+          grep -Fq -- "kind: NetworkPolicy" "${harness_v1_kustomize}"
           for tier in ai vendor container; do
             account="secondary-orka-${tier}-worker"
             grep -Fq -- "--${tier}-worker-service-account-name=${account}" "${secondary_render}"
@@ -153,26 +220,60 @@ jobs:
             grep -Fq -- "name: ${account}" "${secondary_rbac}"
             grep -Fq -- ":${account}'" "${secondary_gateway_policy}"
           done
-          wrapper_name=$(awk '$1 == "name:" { print $2; exit }' "${long_wrapper_service}")
-          wrapper_secret_name=$(awk '$1 == "name:" { print $2; exit }' "${long_wrapper_secret}")
-          [[ -n "${wrapper_name}" && ${#wrapper_name} -le 63 ]]
-          [[ -n "${wrapper_secret_name}" && ${#wrapper_secret_name} -le 63 ]]
-          grep -Fq -- "http://${wrapper_name}:8080" "${long_render}"
-          grep -Fq -- "serviceAccountName: ${wrapper_name}" "${long_render}"
-          grep -Fq -- "secretName: ${wrapper_secret_name}" "${long_render}"
+          for rendered in "${long_publisher_service}" "${long_publisher_secret}" "${long_provider_service}" "${long_provider_secret}" "${long_scm_service}" "${long_scm_secret}"; do
+            resource_name=$(awk '$1 == "name:" { print $2; exit }' "${rendered}")
+            [[ -n "${resource_name}" && ${#resource_name} -le 63 ]]
+          done
+          publisher_name=$(awk '$1 == "name:" { print $2; exit }' "${long_publisher_service}")
+          scm_name=$(awk '$1 == "name:" { print $2; exit }' "${long_scm_service}")
+          grep -Fq -- "http://${publisher_name}:8080" "${long_render}"
+          grep -Fq -- "@${scm_name}.${NAMESPACE}.svc:8080" "${long_render}"
 
           chart_version=$(awk '$1 == "version:" { print $2; exit }' manifest_staging/charts/orka/Chart.yaml)
           grep -Fq -- "--general-worker-image=ghcr.io/orka-agents/orka/general-worker:${chart_version}" "${secondary_render}"
-          for resource in agentruntimes substrateactorpools; do
+          for resource in agentruntimes branchclaims controllerepochs externaleffects promptattempts publications runtimepools runtimesessioncontrols substrateactorpools; do
             grep -Eq "resources: \\[.*\"${resource}\"" "${secondary_rbac}"
             grep -Eq "resources: \\[.*\"${resource}/status\"" "${secondary_rbac}"
-            grep -Eq "resources: \\[.*\"${resource}/finalizers\"" "${secondary_rbac}"
           done
-          test "$(grep -Fc 'resources: ["serviceaccounts/token"]' manifest_staging/charts/orka/templates/rbac.yaml)" -eq 1
+          if ! ruby -ryaml -e '
+            rendered_rbac, expected_name, expected_namespace = ARGV
+            token_request_grants = []
+            YAML.load_stream(File.read(rendered_rbac)).each do |document|
+              next unless document.is_a?(Hash)
+
+              Array(document["rules"]).each do |rule|
+                api_groups = Array(rule["apiGroups"])
+                resources = Array(rule["resources"])
+                verbs = Array(rule["verbs"])
+                next unless api_groups.include?("") || api_groups.include?("*")
+                next unless resources.include?("serviceaccounts/token") || resources.include?("*")
+                next unless verbs.include?("create") || verbs.include?("*")
+
+                token_request_grants << [document, rule]
+              end
+            end
+            valid = token_request_grants.length == 1 &&
+              token_request_grants[0][0]["kind"] == "Role" &&
+              token_request_grants[0][0].dig("metadata", "name") == expected_name &&
+              token_request_grants[0][0].dig("metadata", "namespace") == expected_namespace &&
+              Array(token_request_grants[0][1]["apiGroups"]) == [""] &&
+              Array(token_request_grants[0][1]["verbs"]) == ["create"]
+            exit(valid ? 0 : 1)
+          ' "${secondary_rbac}" secondary-orka-controller "${NAMESPACE}"; then
+            echo "Harness v2 must render exactly one namespaced, create-only controller TokenRequest rule." >&2
+            exit 1
+          fi
           if grep -Fq 'ai-worker-tokenrequest' manifest_staging/charts/orka/templates/rbac.yaml; then
             echo "AI workers must not receive an unrestricted TokenRequest ClusterRole." >&2
             exit 1
           fi
+          for template in deployment service serviceaccount pvc networkpolicy; do
+            test -f "manifest_staging/charts/orka/templates/harness-wrapper-${template}.yaml"
+          done
+          if test -f "manifest_staging/charts/orka/templates/harness-wrapper-secret.yaml"; then
+            echo "Harness v1 credentials must come from an operator-created Secret, not a chart template." >&2
+            exit 1
+          fi
 
           mkdir -p cr-release-packages
           helm package manifest_staging/charts/orka --destination cr-release-packages
@@ -182,17 +283,10 @@ jobs:
             echo "Expected exactly one packaged Orka chart, found ${#chart_packages[@]}." >&2
             exit 1
           fi
-          test "$(helm show crds "${chart_packages[0]}" | grep -c '^kind: CustomResourceDefinition$')" -eq 19
+          test "$(helm show crds "${chart_packages[0]}" | grep -c '^kind: CustomResourceDefinition$')" -eq 26
 
       - name: Install kind
-        run: |
-          set -euo pipefail
-
-          curl -fsSL --retry 3 --retry-delay 2 -o ./kind \
-            "https://kind.sigs.k8s.io/dl/${KIND_VERSION}/kind-linux-amd64"
-          echo "${KIND_SHA256}  ./kind" | sha256sum --check --strict
-          chmod +x ./kind
-          sudo mv ./kind /usr/local/bin/kind
+        uses: ./.github/actions/setup-kind
 
       - name: Verify install, apply, and uninstall CRD behavior
         run: |
@@ -207,6 +301,7 @@ jobs:
             --name "${KIND_CLUSTER}" \
             --image "${KIND_IMAGE}" \
             --wait 90s
+          kubectl create namespace vekil-system
 
           shopt -s nullglob
           chart_packages=(cr-release-packages/orka-*.tgz)
@@ -216,19 +311,26 @@ jobs:
           expected_crds=$(cat <<'CRDS'
           agentruntimes.core.orka.ai
           agents.core.orka.ai
+          branchclaims.core.orka.ai
+          controllerepochs.core.orka.ai
           executionworkspaceclasses.workspace.orka.ai
           executionworkspacepools.workspace.orka.ai
           executionworkspaceproviders.workspace.orka.ai
           executionworkspaces.workspace.orka.ai
+          externaleffects.core.orka.ai
           fakepoolparameters.fake.workspace.orka.ai
           fakeproviderconfigs.fake.workspace.orka.ai
           gatewaybindings.gateway.orka.ai
           gatewayclasses.gateway.orka.ai
           gateways.gateway.orka.ai
           outboundaccesspolicies.core.orka.ai
+          promptattempts.core.orka.ai
           providers.core.orka.ai
+          publications.core.orka.ai
           repositorymonitors.core.orka.ai
           repositoryscans.core.orka.ai
+          runtimepools.core.orka.ai
+          runtimesessioncontrols.core.orka.ai
           skills.core.orka.ai
           substrateactorpools.core.orka.ai
           tasks.core.orka.ai
@@ -257,21 +359,30 @@ jobs:
             done <<< "${expected_crds}"
           }
 
+          pause_digest=${PAUSE_IMAGE_TAG#*@}
           helm install orka "${chart_package}" \
             --namespace "${NAMESPACE}" \
             --create-namespace \
-            --set controller.replicas=0 \
+            --set-string controller.mode=harness-v2 \
+            --set-string "controller.watchNamespace=${NAMESPACE}" \
+            --set-string "controller.acpRuntime.namespace=${NAMESPACE}-runtimes" \
+            --set-string "controller.agentExecutionSnapshot.existingSecret=${SNAPSHOT_SECRET}" \
+            --set-string "controller.agentExecutionSnapshot.key=${SNAPSHOT_KEY}" \
             --set-string controller.image.repository="${PAUSE_IMAGE_REPOSITORY}" \
             --set-string controller.image.tag="${PAUSE_IMAGE_TAG}" \
+            --set-string controller.image.digest="${pause_digest}" \
             --set controller.image.pullPolicy=IfNotPresent \
+            --set-string webhooks.tls.existingSecret=controller-webhook-tls \
+            --set-string webhooks.caBundle=Y2E= \
             --set-string workers.ai.image.repository="${PAUSE_IMAGE_REPOSITORY}" \
             --set-string workers.ai.image.tag="${PAUSE_IMAGE_TAG}" \
-            --set-string workers.harnessWrapper.image.repository="${PAUSE_IMAGE_REPOSITORY}" \
-            --set-string workers.harnessWrapper.image.tag="${PAUSE_IMAGE_TAG}" \
-            --set workers.harnessWrapper.image.pullPolicy=IfNotPresent \
-            --set-string workers.harnessWrapper.auth.token=mock-token
+            --set-string publisher.image.repository="${PAUSE_IMAGE_REPOSITORY}" \
+            --set-string publisher.image.digest="${pause_digest}" \
+            --set publisher.enabled=true \
+            --set providerProxy.enabled=true
 
           assert_all_orka_crds "after helm install"
+          NAMESPACE="${NAMESPACE}-static" scripts/static-mode-crd-validate.sh
 
           kubectl patch crd tasks.core.orka.ai --type=json -p='[
             {"op":"add","path":"/spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/staleReviewField","value":{"type":"string"}}
diff --git a/.github/workflows/live-acp-release-gate.yml b/.github/workflows/live-acp-release-gate.yml
new file mode 100644
index 000000000..88b895f86
--- /dev/null
+++ b/.github/workflows/live-acp-release-gate.yml
@@ -0,0 +1,150 @@
+name: Live ACP Release Gate
+
+on:
+  workflow_dispatch:
+    inputs:
+      source_repository:
+        description: HTTPS GitHub source repository URL used for the release canary
+        required: true
+        default: https://github.com/orka-agents/orka.git
+        type: string
+      publication_repository:
+        description: HTTPS URL of a distinct GitHub fork used for publication
+        required: true
+        type: string
+      source_ref:
+        description: Full SHA of the dispatched workflow commit; must equal the selected base branch head
+        required: true
+        type: string
+      pr_base:
+        description: Default branch targeted by the temporary canary PR
+        required: true
+        default: main
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: live-acp-release-gate
+  cancel-in-progress: false
+
+jobs:
+  live-acp-release-gate:
+    name: ACP destructive release acceptance
+    runs-on: ubuntu-latest
+    timeout-minutes: 240
+    environment: live-acp-release-gate
+    env:
+      ACP_E2E_OPENCODE_CONTEXT_WINDOW: "32768"
+      ACP_E2E_OPENCODE_MAX_TOKENS: "4096"
+      ACP_E2E_OPENCODE_MODEL: "openai/gpt-5.4"
+      ACP_E2E_KIND_TAG: acp-release-${{ github.run_id }}-${{ github.run_attempt }}
+    steps:
+      - name: Validate trusted dispatch inputs
+        env:
+          CHECKED_OUT_SHA: ${{ github.sha }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          PR_BASE: ${{ inputs.pr_base }}
+          PUBLICATION_REPOSITORY: ${{ inputs.publication_repository }}
+          SOURCE_REF: ${{ inputs.source_ref }}
+          SOURCE_REPOSITORY: ${{ inputs.source_repository }}
+        run: |
+          set -Eeuo pipefail
+          if [[ "${GITHUB_REF}" != "refs/heads/${DEFAULT_BRANCH}" ]]; then
+            echo "Dispatch this workflow from the default branch (${DEFAULT_BRANCH}) only." >&2
+            exit 1
+          fi
+          if [[ "${PR_BASE}" != "${DEFAULT_BRANCH}" ]]; then
+            echo "pr_base must equal the default branch (${DEFAULT_BRANCH})." >&2
+            exit 1
+          fi
+          if [[ ! "${SOURCE_REPOSITORY}" =~ ^https://github\.com/[^/?#]+/[^/?#]+(\.git)?$ ]]; then
+            echo "source_repository must be an HTTPS github.com repository URL." >&2
+            exit 1
+          fi
+          expected_source="https://github.com/${GITHUB_REPOSITORY}"
+          normalized_source="${SOURCE_REPOSITORY%.git}"
+          if [[ "${normalized_source,,}" != "${expected_source,,}" ]]; then
+            echo "source_repository must identify this repository: ${expected_source}.git" >&2
+            exit 1
+          fi
+          if [[ ! "${PUBLICATION_REPOSITORY}" =~ ^https://github\.com/[^/?#]+/[^/?#]+(\.git)?$ ]]; then
+            echo "publication_repository must be an HTTPS github.com repository URL." >&2
+            exit 1
+          fi
+          normalized_publication="${PUBLICATION_REPOSITORY%.git}"
+          if [[ "${normalized_source,,}" == "${normalized_publication,,}" ]]; then
+            echo "publication_repository must be a distinct fork." >&2
+            exit 1
+          fi
+          if [[ ! "${SOURCE_REF}" =~ ^[0-9a-fA-F]{40}$ ]]; then
+            echo "source_ref must be a full 40-character commit SHA." >&2
+            exit 1
+          fi
+          if [[ "${SOURCE_REF,,}" != "${CHECKED_OUT_SHA,,}" ]]; then
+            echo "source_ref must equal the dispatched workflow commit ${CHECKED_OUT_SHA}." >&2
+            exit 1
+          fi
+
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Free disk space for Docker-heavy live E2E
+        uses: ./.github/actions/free-disk-space
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Install kind
+        uses: ./.github/actions/setup-kind
+
+      - name: Verify toolchain
+        run: |
+          set -Eeuo pipefail
+          docker version
+          git --version
+          gh --version
+          jq --version
+          kind version
+          kubectl version --client=true
+
+      - name: Run destructive canonical ACP release gate in Kind
+        env:
+          ACP_E2E_REF: ${{ inputs.source_ref }}
+          ACP_E2E_REPO: ${{ inputs.source_repository }}
+          ACP_E2E_WRITE_CREATE_PR: "1"
+          ACP_E2E_WRITE_CREDENTIAL_TOKEN: ${{ secrets.ACP_E2E_WRITE_CREDENTIAL_TOKEN }}
+          ACP_E2E_WRITE_FORGE_CREDENTIAL_TOKEN: ${{ secrets.ACP_E2E_WRITE_FORGE_CREDENTIAL_TOKEN }}
+          ACP_E2E_WRITE_PR_BASE: ${{ inputs.pr_base }}
+          ACP_E2E_WRITE_PUBLICATION_REPO: ${{ inputs.publication_repository }}
+          ACP_E2E_WRITE_READ_CREDENTIAL_TOKEN: ${{ secrets.ACP_E2E_WRITE_READ_CREDENTIAL_TOKEN }}
+          ACP_E2E_WRITE_SOURCE_REF: ${{ inputs.source_ref }}
+          ACP_E2E_WRITE_SOURCE_REPO: ${{ inputs.source_repository }}
+          ACP_E2E_WRITE_TARGET_READ_CREDENTIAL_TOKEN: ${{ secrets.ACP_E2E_WRITE_TARGET_READ_CREDENTIAL_TOKEN }}
+          COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.ACP_E2E_WRITE_FORGE_CREDENTIAL_TOKEN }}
+          RELEASE_GATE: "1"
+        run: |
+          set -Eeuo pipefail
+
+          required_secrets=(
+            COPILOT_GITHUB_TOKEN
+            ACP_E2E_WRITE_READ_CREDENTIAL_TOKEN
+            ACP_E2E_WRITE_TARGET_READ_CREDENTIAL_TOKEN
+            ACP_E2E_WRITE_CREDENTIAL_TOKEN
+            ACP_E2E_WRITE_FORGE_CREDENTIAL_TOKEN
+          )
+          for name in "${required_secrets[@]}"; do
+            if [[ -z "${!name}" ]]; then
+              echo "${name} must be configured in the live-acp-release-gate environment." >&2
+              exit 1
+            fi
+          done
+
+          bash scripts/live-acp-runtime-kind-e2e.sh
diff --git a/.github/workflows/live-acp-runtime-e2e.yml b/.github/workflows/live-acp-runtime-e2e.yml
new file mode 100644
index 000000000..e8fa09fab
--- /dev/null
+++ b/.github/workflows/live-acp-runtime-e2e.yml
@@ -0,0 +1,102 @@
+name: Live ACP Runtime E2E
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "23 8 * * *"
+  push:
+    branches:
+      - main
+    paths:
+      - ".dockerignore"
+      - ".github/workflows/live-acp-runtime-e2e.yml"
+      - "Dockerfile"
+      - "Makefile"
+      - ".agents/skills/kindctl/**"
+      - ".agents/skills/vekil-reverse-proxy-deploy/**"
+      - "api/**"
+      - "cmd/**"
+      - "config/**"
+      - "go.mod"
+      - "go.sum"
+      - "internal/**"
+      - "pkg/**"
+      - "scripts/apply-acp-production.sh"
+      - "scripts/check-acp-crd-cutover.sh"
+      - "scripts/lib/e2e-admission-tls.sh"
+      - "scripts/lib/ensure-static-mode-namespace.sh"
+      - "scripts/lib/kind-local-registry.sh"
+      - "scripts/lib/live-acp-runtime-kind-bootstrap.sh"
+      - "scripts/live-acp-runtime-e2e.sh"
+      - "scripts/live-acp-runtime-kind-e2e.sh"
+      - "scripts/render-acp-runtime-images.sh"
+      - "scripts/render-worker-images.sh"
+      - "workers/**"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: live-acp-runtime-e2e-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  live-acp-runtime-e2e:
+    name: ACP provider smoke
+    runs-on: ubuntu-latest
+    timeout-minutes: 180
+    environment: live-acp-runtime-smoke
+    env:
+      ACP_E2E_OPENCODE_CONTEXT_WINDOW: "32768"
+      ACP_E2E_OPENCODE_MAX_TOKENS: "4096"
+      ACP_E2E_OPENCODE_MODEL: "openai/gpt-5.4"
+      ACP_E2E_REQUIRE_PARALLEL: "1"
+      ACP_E2E_KIND_TAG: live-acp-${{ github.run_id }}-${{ github.run_attempt }}
+    steps:
+      - name: Validate trusted workflow ref
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          set -Eeuo pipefail
+          if [[ "${GITHUB_REF}" != "refs/heads/${DEFAULT_BRANCH}" ]]; then
+            echo "Run this secret-backed workflow from the default branch (${DEFAULT_BRANCH}) only." >&2
+            exit 1
+          fi
+
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Free disk space for Docker-heavy live E2E
+        uses: ./.github/actions/free-disk-space
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Install kind
+        uses: ./.github/actions/setup-kind
+
+      - name: Verify toolchain
+        run: |
+          set -Eeuo pipefail
+          docker version
+          git --version
+          gh --version
+          jq --version
+          kind version
+          kubectl version --client=true
+
+      - name: Run canonical ACP smoke in Kind
+        env:
+          COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
+        run: |
+          set -Eeuo pipefail
+          if [[ -z "${COPILOT_GITHUB_TOKEN}" ]]; then
+            echo "COPILOT_GITHUB_TOKEN must be configured in the live-acp-runtime-smoke environment." >&2
+            exit 1
+          fi
+          bash scripts/live-acp-runtime-kind-e2e.sh
diff --git a/.github/workflows/live-agent-sandbox-e2e.yml b/.github/workflows/live-agent-sandbox-e2e.yml
index 6c16ea088..4e7a044b7 100644
--- a/.github/workflows/live-agent-sandbox-e2e.yml
+++ b/.github/workflows/live-agent-sandbox-e2e.yml
@@ -25,31 +25,12 @@ jobs:
     timeout-minutes: 90
     env:
       KIND_CLUSTER: orka-live-agent-sandbox-e2e
-      KIND_VERSION: v0.31.0
     steps:
       - name: Clone Orka
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Free disk space for Docker-heavy live E2E
-        run: |
-          set -euxo pipefail
-          echo "Disk usage before cleanup"
-          df -h
-          docker system df || true
-
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/ghc
-          sudo rm -rf /usr/local/share/boost
-          sudo rm -rf /usr/local/lib/android
-          sudo rm -rf /opt/hostedtoolcache/CodeQL
-          sudo rm -rf /usr/share/swift
-
-          docker system prune -af || true
-          docker builder prune -af || true
-
-          echo "Disk usage after cleanup"
-          df -h
-          docker system df || true
+        uses: ./.github/actions/free-disk-space
 
       - name: Setup Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -57,10 +38,7 @@ jobs:
           go-version-file: go.mod
 
       - name: Install kind
-        run: |
-          curl -fsSL -o ./kind "https://kind.sigs.k8s.io/dl/${KIND_VERSION}/kind-linux-$(go env GOARCH)"
-          chmod +x ./kind
-          sudo mv ./kind /usr/local/bin/kind
+        uses: ./.github/actions/setup-kind
 
       - name: Verify kind installation
         run: kind version
diff --git a/.github/workflows/live-copilot-proxy-e2e.yml b/.github/workflows/live-copilot-proxy-e2e.yml
index 3c2f8ddfd..3e78af0eb 100644
--- a/.github/workflows/live-copilot-proxy-e2e.yml
+++ b/.github/workflows/live-copilot-proxy-e2e.yml
@@ -26,7 +26,7 @@ jobs:
     env:
       COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
       KIND_CLUSTER: orka-live-copilot-proxy-e2e
-      COPILOT_PROXY_IMAGE: ghcr.io/sozercan/vekil:v0.14.0@sha256:9e6ab58b9c27888db34d76422c3520b3bf103742a058572439a1fe0aa35a2ade
+      COPILOT_PROXY_IMAGE: ghcr.io/sozercan/vekil:v0.14.1@sha256:2fa0558f6304cc6ed1fb5b0135f62f12f28f1cdd0a8c057c4283414bceac1362
     steps:
       - name: Decide whether live e2e can run
         id: gate
@@ -63,25 +63,7 @@ jobs:
 
       - name: Free disk space for Docker-heavy live E2E
         if: steps.gate.outputs.run == 'true'
-        run: |
-          set -euxo pipefail
-          echo "Disk usage before cleanup"
-          df -h
-          docker system df || true
-
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/ghc
-          sudo rm -rf /usr/local/share/boost
-          sudo rm -rf /usr/local/lib/android
-          sudo rm -rf /opt/hostedtoolcache/CodeQL
-          sudo rm -rf /usr/share/swift
-
-          docker system prune -af || true
-          docker builder prune -af || true
-
-          echo "Disk usage after cleanup"
-          df -h
-          docker system df || true
+        uses: ./.github/actions/free-disk-space
 
       - name: Setup Go
         if: steps.gate.outputs.run == 'true'
@@ -91,10 +73,7 @@ jobs:
 
       - name: Install kind
         if: steps.gate.outputs.run == 'true'
-        run: |
-          curl -fsSL -o ./kind "https://kind.sigs.k8s.io/dl/latest/kind-linux-$(go env GOARCH)"
-          chmod +x ./kind
-          sudo mv ./kind /usr/local/bin/kind
+        uses: ./.github/actions/setup-kind
 
       - name: Verify kind installation
         if: steps.gate.outputs.run == 'true'
diff --git a/.github/workflows/live-github-label-trigger-e2e.yml b/.github/workflows/live-github-label-trigger-e2e.yml
index bd4ce5a38..0b95c0c11 100644
--- a/.github/workflows/live-github-label-trigger-e2e.yml
+++ b/.github/workflows/live-github-label-trigger-e2e.yml
@@ -28,7 +28,6 @@ jobs:
     timeout-minutes: 75
     env:
       KIND_CLUSTER: orka-live-github-label-trigger-e2e
-      KIND_VERSION: v0.31.0
       GITHUB_LABEL_TRIGGER_TARGET_REPO_URL: ${{ inputs.target_repo_url }}
       GITHUB_LABEL_TRIGGER_TARGET_NUMBER: ${{ inputs.target_number }}
     steps:
@@ -51,10 +50,7 @@ jobs:
             -v
 
       - name: Install kind
-        run: |
-          curl -fsSL -o ./kind "https://kind.sigs.k8s.io/dl/${KIND_VERSION}/kind-linux-$(go env GOARCH)"
-          chmod +x ./kind
-          sudo mv ./kind /usr/local/bin/kind
+        uses: ./.github/actions/setup-kind
 
       - name: Verify kind installation
         run: kind version
diff --git a/.github/workflows/live-github-oidc-e2e.yml b/.github/workflows/live-github-oidc-e2e.yml
index 5161f4525..3b8379cdd 100644
--- a/.github/workflows/live-github-oidc-e2e.yml
+++ b/.github/workflows/live-github-oidc-e2e.yml
@@ -24,9 +24,6 @@ jobs:
     env:
       KIND_CLUSTER: orka-live-github-oidc-e2e
       ORKA_GITHUB_OIDC_AUDIENCE: orka-live-github-oidc-e2e
-      KIND_VERSION: v0.31.0
-      KIND_SHA256_AMD64: eb244cbafcc157dff60cf68693c14c9a75c4e6e6fedaf9cd71c58117cb93e3fa
-      KIND_SHA256_ARM64: 8e1014e87c34901cc422a1445866835d1e666f2a61301c27e722bdeab5a1f7e4
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -35,17 +32,7 @@ jobs:
         with:
           go-version-file: go.mod
       - name: Install kind
-        run: |
-          arch="$(go env GOARCH)"
-          case "${arch}" in
-            amd64) expected_sha="${KIND_SHA256_AMD64}" ;;
-            arm64) expected_sha="${KIND_SHA256_ARM64}" ;;
-            *) echo "unsupported runner architecture: ${arch}" >&2; exit 1 ;;
-          esac
-          curl -fsSL -o ./kind "https://kind.sigs.k8s.io/dl/${KIND_VERSION}/kind-linux-${arch}"
-          printf '%s  %s\n' "${expected_sha}" ./kind | sha256sum --check --strict -
-          chmod +x ./kind
-          sudo mv ./kind /usr/local/bin/kind
+        uses: ./.github/actions/setup-kind
       - name: Verify kind installation
         run: kind version
       - run: bash scripts/live-github-oidc-e2e.sh
diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
index 38a9099f8..6178aa3b0 100644
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@@ -98,9 +98,7 @@ jobs:
         run: |
           set -euo pipefail
 
-          helm lint cmd/build/helmify/static
-          helm lint charts/orka
-          test "$(helm show crds charts/orka | grep -c '^kind: CustomResourceDefinition$')" -eq 19
+          make verify-release-manifest NEWVERSION="${NEWVERSION}"
           git diff --check
 
       - name: Create release pull request
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 22babf2b7..0bef9748b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,82 +31,7 @@ jobs:
           persist-credentials: false
 
       - name: Validate tag and promoted chart
-        run: |
-          set -euo pipefail
-
-          tag=${GITHUB_REF_NAME}
-          if [[ ! "${tag}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-(beta|rc)\.[0-9]+)?$ ]]; then
-            echo "Release tag must match vX.Y.Z, vX.Y.Z-beta.N, or vX.Y.Z-rc.N; got ${tag}." >&2
-            exit 1
-          fi
-
-          chart_field() {
-            local field=$1
-            local value
-            value=$(awk -v key="${field}:" '$1 == key { print $2; exit }' charts/orka/Chart.yaml)
-            value=${value#\"}
-            value=${value%\"}
-            value=${value#\'}
-            value=${value%\'}
-            if [[ -z "${value}" ]]; then
-              echo "Could not read ${field} from charts/orka/Chart.yaml." >&2
-              return 1
-            fi
-            printf '%s\n' "${value}"
-          }
-
-          expected_version=${tag#v}
-          chart_version=$(chart_field version)
-          app_version=$(chart_field appVersion)
-          if [[ "${chart_version}" != "${expected_version}" ]]; then
-            echo "Tag ${tag} requires charts/orka version ${expected_version}; found ${chart_version}." >&2
-            exit 1
-          fi
-          if [[ "${app_version}" != "${tag}" ]]; then
-            echo "Tag ${tag} requires charts/orka appVersion ${tag}; found ${app_version}." >&2
-            exit 1
-          fi
-
-          diff --no-dereference --recursive --unified manifest_staging/charts/orka charts/orka
-          diff --no-dereference --recursive --unified manifest_staging/deploy deploy
-          helm lint charts/orka
-          test "$(helm show crds charts/orka | grep -c '^kind: CustomResourceDefinition$')" -eq 19
-
-          rendered_chart=$(mktemp)
-          trap 'rm -f "${rendered_chart}"' EXIT
-          helm template release-validation charts/orka \
-            --namespace orka-system \
-            --set-string workers.harnessWrapper.auth.token=mock-token \
-            > "${rendered_chart}"
-
-          runtime_images=()
-          while IFS= read -r image_line; do
-            image_ref=${image_line#*image: }
-            image_ref=${image_ref#\"}
-            image_ref=${image_ref%\"}
-            runtime_images+=("${image_ref}")
-          done < <(grep -E '^[[:space:]]+image:[[:space:]]+' "${rendered_chart}")
-          if [[ ${#runtime_images[@]} -ne 2 ]]; then
-            echo "Expected two rendered runtime images; found ${#runtime_images[@]}." >&2
-            exit 1
-          fi
-          for image_ref in "${runtime_images[@]}"; do
-            if [[ "${image_ref##*:}" != "${expected_version}" ]]; then
-              echo "Tag ${tag} requires runtime image ${image_ref} to use ${expected_version}." >&2
-              exit 1
-            fi
-          done
-
-          for worker in ai general; do
-            worker_refs=()
-            while IFS= read -r worker_line; do
-              worker_refs+=("${worker_line#*=}")
-            done < <(grep -E "^[[:space:]]+- --${worker}-worker-image=" "${rendered_chart}")
-            if [[ ${#worker_refs[@]} -ne 1 || "${worker_refs[0]##*:}" != "${expected_version}" ]]; then
-              echo "Tag ${tag} requires exactly one rendered ${worker} worker image using ${expected_version}." >&2
-              exit 1
-            fi
-          done
+        run: scripts/validate-release-manifest.sh "${GITHUB_REF_NAME}"
 
       - name: Package promoted chart
         run: |
@@ -121,8 +46,9 @@ jobs:
             echo "Expected exactly one packaged Orka chart, found ${#chart_packages[@]}." >&2
             exit 1
           fi
-          if [[ $(helm show crds "${chart_packages[0]}" | grep -c '^kind: CustomResourceDefinition$') -ne 19 ]]; then
-            echo "Packaged Orka chart must contain exactly 19 CRDs." >&2
+          expected_crds=$(find config/crd/bases -maxdepth 1 -type f -name '*.yaml' | wc -l | tr -d ' ')
+          if [[ $(helm show crds "${chart_packages[0]}" | grep -c '^kind: CustomResourceDefinition$') -ne ${expected_crds} ]]; then
+            echo "Packaged Orka chart CRD count does not match config/crd/bases (${expected_crds})." >&2
             exit 1
           fi
 
@@ -204,6 +130,8 @@ jobs:
       contents: read
       packages: write
     strategy:
+      # Tagged application releases publish the default harness-v2 stack and
+      # the digest-pinned harness-v1 compatibility wrapper.
       matrix:
         include:
           - image: controller
@@ -222,6 +150,26 @@ jobs:
             image_suffix: "/agent-harness-wrapper"
             dockerfile: workers/harness/Dockerfile
             context: .
+          - image: acp-codex-runtime
+            image_suffix: "/acp-codex-runtime"
+            dockerfile: workers/acp/images/codex/Dockerfile
+            context: .
+          - image: acp-claude-runtime
+            image_suffix: "/acp-claude-runtime"
+            dockerfile: workers/acp/images/claude/Dockerfile
+            context: .
+          - image: acp-copilot-runtime
+            image_suffix: "/acp-copilot-runtime"
+            dockerfile: workers/acp/images/copilot/Dockerfile
+            context: .
+          - image: acp-opencode-runtime
+            image_suffix: "/acp-opencode-runtime"
+            dockerfile: workers/acp/images/opencode/Dockerfile
+            context: .
+          - image: workspace-publisher
+            image_suffix: "/workspace-publisher"
+            dockerfile: workers/publisher/Dockerfile
+            context: .
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -344,6 +292,46 @@ jobs:
             image_suffix: "/agent-harness-wrapper"
             platform: linux/arm64
             platform_slug: linux-arm64
+          - image: acp-codex-runtime
+            image_suffix: "/acp-codex-runtime"
+            platform: linux/amd64
+            platform_slug: linux-amd64
+          - image: acp-codex-runtime
+            image_suffix: "/acp-codex-runtime"
+            platform: linux/arm64
+            platform_slug: linux-arm64
+          - image: acp-claude-runtime
+            image_suffix: "/acp-claude-runtime"
+            platform: linux/amd64
+            platform_slug: linux-amd64
+          - image: acp-claude-runtime
+            image_suffix: "/acp-claude-runtime"
+            platform: linux/arm64
+            platform_slug: linux-arm64
+          - image: acp-copilot-runtime
+            image_suffix: "/acp-copilot-runtime"
+            platform: linux/amd64
+            platform_slug: linux-amd64
+          - image: acp-copilot-runtime
+            image_suffix: "/acp-copilot-runtime"
+            platform: linux/arm64
+            platform_slug: linux-arm64
+          - image: acp-opencode-runtime
+            image_suffix: "/acp-opencode-runtime"
+            platform: linux/amd64
+            platform_slug: linux-amd64
+          - image: acp-opencode-runtime
+            image_suffix: "/acp-opencode-runtime"
+            platform: linux/arm64
+            platform_slug: linux-arm64
+          - image: workspace-publisher
+            image_suffix: "/workspace-publisher"
+            platform: linux/amd64
+            platform_slug: linux-amd64
+          - image: workspace-publisher
+            image_suffix: "/workspace-publisher"
+            platform: linux/arm64
+            platform_slug: linux-arm64
     steps:
       - name: Log in to GHCR
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
@@ -402,6 +390,16 @@ jobs:
             image_suffix: "/general-worker"
           - image: agent-harness-wrapper
             image_suffix: "/agent-harness-wrapper"
+          - image: acp-codex-runtime
+            image_suffix: "/acp-codex-runtime"
+          - image: acp-claude-runtime
+            image_suffix: "/acp-claude-runtime"
+          - image: acp-copilot-runtime
+            image_suffix: "/acp-copilot-runtime"
+          - image: acp-opencode-runtime
+            image_suffix: "/acp-opencode-runtime"
+          - image: workspace-publisher
+            image_suffix: "/workspace-publisher"
     steps:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
@@ -520,6 +518,11 @@ jobs:
           promote_image ai-worker "/ai-worker"
           promote_image general-worker "/general-worker"
           promote_image agent-harness-wrapper "/agent-harness-wrapper"
+          promote_image acp-codex-runtime "/acp-codex-runtime"
+          promote_image acp-claude-runtime "/acp-claude-runtime"
+          promote_image acp-copilot-runtime "/acp-copilot-runtime"
+          promote_image acp-opencode-runtime "/acp-opencode-runtime"
+          promote_image workspace-publisher "/workspace-publisher"
 
 
   publish-helm-chart:
diff --git a/.github/workflows/security-scan-e2e.yml b/.github/workflows/security-scan-e2e.yml
index 139eb9f5f..fc0a61a3f 100644
--- a/.github/workflows/security-scan-e2e.yml
+++ b/.github/workflows/security-scan-e2e.yml
@@ -16,7 +16,12 @@ on:
       - "hack/**"
       - "internal/**"
       - "pkg/**"
+      - "scripts/lib/e2e-admission-tls.sh"
+      - "scripts/lib/ensure-static-mode-namespace.sh"
+      - "scripts/lib/kind-local-registry.sh"
+      - "scripts/fixtures/security-scan-fake-acp/**"
       - "scripts/security-scan-e2e.sh"
+      - "scripts/tests/security-scan-e2e-test.sh"
       - "workers/**"
   push:
     paths:
@@ -32,7 +37,12 @@ on:
       - "hack/**"
       - "internal/**"
       - "pkg/**"
+      - "scripts/lib/e2e-admission-tls.sh"
+      - "scripts/lib/ensure-static-mode-namespace.sh"
+      - "scripts/lib/kind-local-registry.sh"
+      - "scripts/fixtures/security-scan-fake-acp/**"
       - "scripts/security-scan-e2e.sh"
+      - "scripts/tests/security-scan-e2e-test.sh"
       - "workers/**"
 
 permissions:
@@ -48,8 +58,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 90
     env:
-      KIND_CLUSTER: orka-security-scan-e2e
-      KIND_VERSION: v0.31.0
+      KIND_CLUSTER: orka-security-scan-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -59,13 +68,13 @@ jobs:
         with:
           go-version-file: go.mod
 
+      - name: Install kind
+        uses: ./.github/actions/setup-kind
+
       - name: Install prerequisites
         run: |
           sudo apt-get update
           sudo apt-get install -y jq
-          curl -fsSL -o ./kind "https://kind.sigs.k8s.io/dl/${KIND_VERSION}/kind-linux-$(go env GOARCH)"
-          chmod +x ./kind
-          sudo mv ./kind /usr/local/bin/kind
 
       - name: Verify toolchain
         run: |
@@ -73,5 +82,10 @@ jobs:
           kubectl version --client=true
           jq --version
 
+      - name: Verify security scan harness-v2 assertions
+        run: |
+          bash -n scripts/security-scan-e2e.sh scripts/tests/security-scan-e2e-test.sh
+          bash scripts/tests/security-scan-e2e-test.sh
+
       - name: Run security scan e2e
         run: bash scripts/security-scan-e2e.sh
diff --git a/.github/workflows/test-e2e.yml b/.github/workflows/test-e2e.yml
index 7d01ebc6d..dadfa0dc7 100644
--- a/.github/workflows/test-e2e.yml
+++ b/.github/workflows/test-e2e.yml
@@ -25,32 +25,13 @@ jobs:
   test-e2e:
     name: Run on Ubuntu
     runs-on: ubuntu-latest
-    env:
-      KIND_VERSION: v0.31.0
+    timeout-minutes: 60
     steps:
       - name: Clone the code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Free disk space for Docker-heavy E2E
-        run: |
-          set -euxo pipefail
-          echo "Disk usage before cleanup"
-          df -h
-          docker system df || true
-
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/ghc
-          sudo rm -rf /usr/local/share/boost
-          sudo rm -rf /usr/local/lib/android
-          sudo rm -rf /opt/hostedtoolcache/CodeQL
-          sudo rm -rf /usr/share/swift
-
-          docker system prune -af || true
-          docker builder prune -af || true
-
-          echo "Disk usage after cleanup"
-          df -h
-          docker system df || true
+        uses: ./.github/actions/free-disk-space
 
       - name: Setup Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -58,10 +39,7 @@ jobs:
           go-version-file: go.mod
 
       - name: Install kind
-        run: |
-          curl -fsSL --retry 3 --retry-delay 2 -o ./kind "https://kind.sigs.k8s.io/dl/${KIND_VERSION}/kind-linux-$(go env GOARCH)"
-          chmod +x ./kind
-          sudo mv ./kind /usr/local/bin/kind
+        uses: ./.github/actions/setup-kind
 
       - name: Verify kind installation
         run: kind version
diff --git a/.golangci.yml b/.golangci.yml
index a8e84c1f3..d93d39b5c 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -40,6 +40,18 @@ linters:
           - dupl
           - lll
         path: internal/*
+      - linters:
+          - lll
+        path: workers/acp/supervisor/*
+      - linters:
+          - lll
+        path: cmd/cli/*
+      - linters:
+          - lll
+        path: cmd/orka-provider-auth-proxy/*
+      - linters:
+          - lll
+        path: cmd/main.go
     paths:
       - third_party$
       - builtin$
diff --git a/AGENTS.md b/AGENTS.md
index a32115828..2980ae712 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -13,94 +13,86 @@ Orka is a Kubernetes-native task execution platform that manages Jobs and Pods f
 
 ## Generated — do not edit
 
-| Path | Regenerate with |
-| --- | --- |
-| `config/crd/bases/*.yaml`, `config/rbac/role.yaml` | `make manifests` |
-| `manifest_staging/deploy/orka.yaml`, `manifest_staging/charts/orka/**` | `make manifests` |
-| `deploy/**`, `charts/orka/**` | `make promote-staging-manifest` (release-preparation flow only) |
-| `**/zz_generated.*.go` | `make generate` |
-| `PROJECT` | kubebuilder CLI |
-| `ui/src/routeTree.gen.ts` | TanStack Router |
+For non-trivial code changes, run `$autoreview` (`.agents/skills/autoreview/SKILL.md`) before final/commit/ship and keep going until there are no accepted/actionable findings, unless the change is trivial/docs-only, equivalent manual review already happened, or the human opts out.
 
-## Gotchas
-
-Execution model:
+- Treat review output as advisory: verify every finding against the real code path before changing code.
+- If review-triggered fixes change code, rerun focused tests and rerun `$autoreview`.
+- Format before review when formatting can move line locations; focused tests and review may run in parallel only after formatting is stable.
 
-- `runtimeRef` AgentRuntime tasks are remote-runtime tasks — there is no Kubernetes Job/Pod per task. Orka stays the governance plane, brokered tools execute through Orka, and remote adapters receive only harness auth plus safe tool schemas, never downstream production tool credentials.
-- Agent CLI runtimes (`codex`, `claude`, `copilot`, `opencode`) run through the `agent-harness-wrapper`. The old per-runtime worker images and entrypoints are gone.
-- Harness-wrapper success maps `TurnCompleted` to `AgentRuntimeCompleted` plus terminal task events. Do not expect a worker `ResultSubmitted` event on harness-backed agent tasks.
-- Harness wrapper `GET /v1/health` and `GET /v1/capabilities` are intentionally unauthenticated; mutating turn endpoints (`POST /v1/turns`, cancel) require the wrapper bearer token.
-- The harness wrapper may emit restricted PodSecurity warnings — it runs as root with limited capabilities for child process/credential setup. Rollout success plus runtime live tests are the source of truth.
-- When changing the harness wrapper, run the canonical [live validation checklist](website/docs/guides/cli-harness-wrapper.md#live-validation-checklist).
+## PR Closeout
 
-Workers:
+After creating or updating an agent-authored PR, use `$pr-closeout` (`.agents/skills/pr-closeout/SKILL.md`) by default, like `$autoreview` is used before landing. Resolve merge conflicts, fix failing CI, address or push back on unresolved review threads, reply on GitHub and resolve addressed comments, push the non-main PR branch, and repeat until current CI is green and no unresolved actionable review threads remain. Skip only when the human opts out, the PR is intentionally draft/WIP, or the remaining blocker is external/human-only. Do not merge or enable auto-merge unless explicitly asked.
 
-- Worker filesystem is read-only except `/tmp`, `/home/worker`, and `/workspace`.
-- AI worker truncates messages on context overflow — keeps system prompt plus newest, drops the middle atomically with structured metadata.
-- Built-in AI worker tools: `web_search`, `code_exec`, `file_read`, `web_fetch`, `file_write`.
+## Build & Test
 
-Memory and coordination:
-
-- Coordination memory tools: `recall_memory`, `remember`, `propose_memory`, `search_transcript`.
-- Memory is governance-first: `remember` and `propose_memory` create review proposals, not durable memories.
-- Reviewing a memory proposal does not apply it. Use the explicit proposal apply endpoint for accepted `memory` proposals when durable memory should be created.
-- Never put secrets, credentials, tokens, raw transcripts, or one-off task status in durable memory.
+```bash
+make manifests          # Regenerate CRDs (after editing *_types.go or markers)
+make generate           # Regenerate Go types
+make build              # Build (includes UI)
+make test               # Run tests
+make lint-fix           # Lint and fix
+make docker-build-all   # Controller, AI/general workers, ACP runtimes, publisher
+make deploy IMG=<repo>@sha256:<digest> ACP_CODEX_RUNTIME_IMG=<repo>@sha256:<digest> ACP_CLAUDE_RUNTIME_IMG=<repo>@sha256:<digest> ACP_COPILOT_RUNTIME_IMG=<repo>@sha256:<digest> ACP_OPENCODE_RUNTIME_IMG=<repo>@sha256:<digest> WORKSPACE_PUBLISHER_IMG=<repo>@sha256:<digest>
+```
 
-Auth and telemetry:
+UI: `cd ui && bun install && bun run dev` (dev server on :5173). See @website/docs/development/development.md for full commands.
 
-- Transaction tokens are accepted via `Txn-Token` by default. `Authorization: Bearer` context-token support is opt-in so ServiceAccount/OIDC auth can coexist.
-- Live GitHub OIDC E2E requires GitHub Actions `id-token: write` or `ORKA_GITHUB_OIDC_TOKEN`. Redact JWTs, TxTokens, and request tokens in logs.
-- OpenTelemetry GenAI constants are hand-rolled in `internal/tracing/genai` because the GenAI conventions are still Development-stage. Telemetry is enabled with `--enable-telemetry`/`--enable-tracing`, workers honor `ORKA_ENABLE_TELEMETRY`, and prompt/completion content capture stays default-off and fail-closed.
+For testing against a local Kubernetes cluster, use the `$kindctl` skill to manage repo/worktree-scoped kind clusters without touching the global kubeconfig.
 
-Build:
+To stand up a reverse proxy for Anthropic/Gemini/OpenAI-compatible clients, use the `$vekil-reverse-proxy-deploy` skill. When it falls back to GitHub Copilot device-code login, surface the login code and URL to the user and wait for their confirmation before continuing — never complete the login on their behalf.
 
-- `make build` requires UI assets — run `make ui-build` first, or `ensure-ui-embed` creates a stub and the embedded UI won't work.
+To stand up an execution-workspace provider on a local kind cluster for evaluation, use the `$agent-sandbox-deploy` skill (kubernetes-sigs agent-sandbox; pairs with `$kindctl` for the cluster and `$orka-kind-deploy` for the controller) or the `$agent-substrate-deploy` skill (Agent Substrate; owns its own gVisor kind cluster, so it is not hosted on a `$kindctl` cluster). Both are local/kind eval only — Orka does not install or manage these providers in production — and both surface the `$vekil-reverse-proxy-deploy` device-code login to the user for confirmation rather than completing it.
 
-Helm manifests and release snapshots:
+## Verification
 
-- Helm generator inputs live under `cmd/build/helmify/`; canonical Kubernetes inputs remain under `config/`.
-- `make manifests` regenerates the committed next-release outputs in `manifest_staging/deploy/orka.yaml` and `manifest_staging/charts/orka/`. Edit the source inputs, not generated staging files, and commit both source and regenerated output.
-- Root `deploy/` and `charts/orka/` are promoted release snapshots. Do not edit them directly; only the release-preparation flow runs `make release-manifest` and `make promote-staging-manifest`. Staging may intentionally be ahead of the root snapshots.
-- A pushed `v*` tag packages and publishes the already-reviewed root snapshot. Tag publication must not regenerate or promote manifests.
-- Chart CRDs are generated from `config/crd/bases/`. Helm does not update them during `helm upgrade`; apply the CRDs from the exact target chart before upgrading the release.
+Run after every change:
 
-## Code style
+```bash
+make manifests generate          # After *_types.go or marker edits
+make lint-fix && make test       # After any *.go edits
+cd ui && bun run lint && bun run test  # After UI edits
+bash -n scripts/*.sh                  # After shell script edits
+go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/<workflow>.yml  # After workflow edits
+```
 
-- Structured logging: `log := log.FromContext(ctx); log.Info("msg", "key", val)`
-- LLM tool args for nested objects arrive as `map[string]any`, not strings — always type-switch.
-- Put model-readable tool constraints in the JSON Schema (`maximum`, `minimum`, `enum`, `default`), not only in description prose, and validate and enforce them at runtime in `Execute`; schema guides the model but is not a runtime trust boundary.
+Single test: `go test ./internal/api/ -run TestHandlerName -v`
 
-## Build and verify
+## Auto-Generated — Do NOT Edit
 
-```bash
-make manifests            # After CRD/RBAC/Kustomize or Helm generator input changes
-make generate             # After generated Go type input changes
-make lint-fix && make test # After any *.go edits
-make build                 # Includes UI; see ui-build gotcha above
-make docker-build-all      # Controller, AI/general workers, harness wrapper
-make deploy IMG=<registry>/orka:tag HARNESS_WRAPPER_IMG=<registry>/agent-harness-wrapper:tag
-```
+- `config/crd/bases/*.yaml`, `config/rbac/role.yaml` — `make manifests`
+- `manifest_staging/deploy/orka.yaml`, `manifest_staging/charts/orka/**` — `make manifests`
+- `deploy/**`, `charts/orka/**` — `make promote-staging-manifest` (release-preparation only)
+- `**/zz_generated.*.go` — `make generate`
+- `PROJECT` — kubebuilder CLI
+- `ui/src/routeTree.gen.ts` — TanStack Router
 
-```bash
-cd ui && bun run lint && bun run test                    # After UI edits
-bash -n scripts/*.sh                                      # After shell script edits
-go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/<workflow>.yml
-```
+Do NOT delete `// +kubebuilder:scaffold:*` comments.
 
-Single Go test: `go test ./internal/api/ -run TestHandlerName -v`.
-UI dev server: `cd ui && bun install && bun run dev` (:5173).
+## Code Style
 
-Full command reference, CI workflow catalog, and OpenTelemetry development notes:
-`website/docs/development/development.md`.
+- Structured logging: `log := log.FromContext(ctx); log.Info("msg", "key", val)`
+- LLM tool args for nested objects arrive as `map[string]any`, not strings — always type-switch
+- Put model-readable tool constraints in JSON Schema (`maximum`, `minimum`, `enum`, `default`), then validate and enforce them again in `Execute`; schema is guidance, not a runtime trust boundary
+- Memory features are governance-first: `remember` and `propose_memory` create review proposals, not durable memories
+- Kontxt integration is fail-closed: never store raw TxTokens in Task specs/status/logs; use owner-referenced Secrets for child tokens, safe metadata/digests for audit, subset checks for child scopes, and fail-closed TTS exchanges for outbound scopes.
 
-## Skills
+## Gotchas
 
-| Skill | Use for |
-| --- | --- |
-| `$autoreview` | Review before commit/land on non-trivial code changes. Repeat until no accepted/actionable findings remain. Skip for trivial/docs-only work, equivalent manual review, or when the human opts out. |
-| `$pr-closeout` | After creating or updating an agent-authored PR, drive it to green. Skip when the human opts out, the PR is intentionally draft/WIP, or the blocker is external/human-only. |
-| `$kindctl` | Repo/worktree-scoped kind clusters, without touching the global kubeconfig. |
-| `$orka-kind-deploy` | Rebuild and redeploy the full local stack into a kind cluster. |
-| `$vekil-reverse-proxy-deploy` | Reverse proxy for Anthropic/Gemini/OpenAI-compatible clients. |
-| `$agent-sandbox-deploy` | kubernetes-sigs agent-sandbox workspace provider (local/kind eval only). |
-| `$agent-substrate-deploy` | Agent Substrate workspace provider (local/kind eval only; owns its own cluster). |
+- Worker filesystem is read-only except `/tmp`, `/home/worker`, and `/workspace`
+- `make build` requires UI assets — run `make ui-build` first (or `ensure-ui-embed` creates a stub)
+- AI worker truncates messages on context overflow — keeps system prompt + newest, drops middle atomically with structured metadata
+- `code_exec` timeout max is 60s — values above are ignored (30s default used)
+- Built-in AI worker tools: `web_search`, `code_exec`, `file_read`, `web_fetch`, `file_write`
+- Built-in agent runtimes (`codex`, `claude`, `copilot`, `opencode`) use only the `orka.harness.v2` ACP RuntimePool path; there is no per-Task Job or legacy fallback.
+- `Task.spec.workspace` is the only agent repository surface. Keep clone/read credentials in `readCredentialRef` and publication/forge credentials in `publicationCredentialRef`; neither enters the ACP process tree.
+- RuntimePools are controller-owned, digest-pinned, scale-to-zero resources. Only `Serving` + `Accepting` admits new RuntimeSessions; drain/finalization must complete before replacement or scale-down.
+- Safe v2 probes are `GET /v2/health` and `GET /v2/capabilities`; status and all mutations require controller authentication plus operation-scoped authorization and exact fences.
+- External `runtimeRef` registrations are v2-only. Registration/conformance exists, but external Task dispatch currently fails closed until its v2 dispatcher is wired.
+- ACP runtime Pods run the supervisor as root with narrowly added process/identity capabilities; ACP children use distinct non-reused UIDs/GIDs, private session trees, and no Git credentials.
+- Coordination memory tools: `recall_memory`, `remember`, `propose_memory`, `search_transcript`
+- Do not store secrets, credentials, tokens, raw transcripts, or one-off task status in durable memory
+- Reviewing a memory proposal does not apply it; use the explicit proposal apply endpoint for accepted `memory` proposals when durable memory should be created
+- Kontxt TxTokens are accepted via `Txn-Token` by default; `Authorization: Bearer` context-token support is opt-in so ServiceAccount/OIDC auth can coexist
+- Live GitHub OIDC/kontxt E2E requires GitHub Actions `id-token: write` or `ORKA_GITHUB_OIDC_TOKEN`; redact JWTs, TxTokens, and request tokens in logs
+- OpenTelemetry GenAI constants are hand-rolled in `internal/tracing/genai`; telemetry is enabled with `--enable-telemetry`/`--enable-tracing`, workers honor `ORKA_ENABLE_TELEMETRY`, and prompt/completion content capture remains default-off/fail-closed
+- ACP real-world validation should include Codex, Claude, and OpenCode through Vekil, Copilot image/profile admission (plus live execution when provider auth is available), workspace clone/read, Session continuation, cancellation/timeout, unsafe workspace rejection, controller restart, pool replacement, clean-room branch publication, PR reconciliation, and cleanup.
diff --git a/Dockerfile b/Dockerfile
index 3a277801a..d1cf8b173 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,7 @@
+# syntax=docker/dockerfile:1.7.1@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
+
 # Build the UI
-FROM oven/bun:1 AS ui-builder
+FROM --platform=$BUILDPLATFORM docker.io/oven/bun:1@sha256:e10577f0db68676a7024391c6e5cb4b879ebd17188ab750cf10024a6d700e5c4 AS ui-builder
 WORKDIR /app
 COPY ui/package.json ui/bun.lock ./
 RUN bun install --frozen-lockfile
@@ -7,7 +9,7 @@ COPY ui/ .
 RUN bun run build
 
 # Build the manager binary
-FROM golang:1.26 AS builder
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26@sha256:3aff6657219a4d9c14e27fb1d8976c49c29fddb70ba835014f477e1c70636647 AS builder
 ARG TARGETOS
 ARG TARGETARCH
 
@@ -30,13 +32,19 @@ COPY --from=ui-builder /app/dist/ internal/uiembed/dist/
 # was called. For example, if we call make docker-build in a local env which has the Apple Silicon M1 SO
 # the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore,
 # by leaving it empty we can ensure that the container and binary shipped on it will have the same platform.
-RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o manager ./cmd/main.go
+RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o manager ./cmd \
+    && CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o orka-admission ./cmd/orka-admission \
+    && CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o provider-auth-proxy ./cmd/orka-provider-auth-proxy \
+    && CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o scm-egress-proxy ./cmd/orka-scm-egress-proxy
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/static:nonroot
+FROM gcr.io/distroless/static:nonroot@sha256:f7f8f729987ad0fdf6b05eeeae94b26e6a0f613bdf46feea7fc40f7bd72953e6
 WORKDIR /
 COPY --from=builder /workspace/manager .
+COPY --from=builder /workspace/orka-admission .
+COPY --from=builder /workspace/provider-auth-proxy .
+COPY --from=builder /workspace/scm-egress-proxy .
 USER 65532:65532
 
 ENTRYPOINT ["/manager"]
diff --git a/Makefile b/Makefile
index c5298fe4f..213d0cb49 100644
--- a/Makefile
+++ b/Makefile
@@ -8,6 +8,19 @@ IMG ?= controller:latest
 AI_WORKER_IMG ?= ghcr.io/orka-agents/orka/ai-worker:latest
 GENERAL_WORKER_IMG ?= ghcr.io/orka-agents/orka/general-worker:latest
 HARNESS_WRAPPER_IMG ?= ghcr.io/orka-agents/orka/agent-harness-wrapper:latest
+ACP_CODEX_RUNTIME_IMG ?= ghcr.io/orka-agents/orka/acp-codex-runtime:latest
+ACP_CLAUDE_RUNTIME_IMG ?= ghcr.io/orka-agents/orka/acp-claude-runtime:latest
+ACP_COPILOT_RUNTIME_IMG ?= ghcr.io/orka-agents/orka/acp-copilot-runtime:latest
+ACP_OPENCODE_RUNTIME_IMG ?= ghcr.io/orka-agents/orka/acp-opencode-runtime:latest
+WORKSPACE_PUBLISHER_IMG ?= ghcr.io/orka-agents/orka/workspace-publisher:latest
+# Providers backing the generated docker-build-acp-<provider>-runtime and
+# docker-push-acp-<provider>-runtime targets.
+ACP_RUNTIME_PROVIDERS = codex claude copilot opencode
+ACP_RUNTIME_IMGS = $(ACP_CODEX_RUNTIME_IMG) $(ACP_CLAUDE_RUNTIME_IMG) $(ACP_COPILOT_RUNTIME_IMG) $(ACP_OPENCODE_RUNTIME_IMG)
+RUN_CONTROLLER_MODE ?= harness-v2
+RUN_WATCH_NAMESPACE ?= orka-system
+RUN_AGENT_EXECUTION_SNAPSHOT_KEY_FILE ?=
+RUN_EXECUTION_MODE_CONTROLLER_USERNAMES ?= $(shell "$(KUBECTL)" auth whoami -o jsonpath='{.status.userInfo.username}' 2>/dev/null)
 
 # Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
 ifeq (,$(shell go env GOBIN))
@@ -64,7 +77,7 @@ manifests: controller-gen kustomize ## Generate canonical and Gatekeeper-style s
 		}; \
 		trap cleanup EXIT; \
 		mkdir -p "$$tmp/deploy" "$$tmp/charts/orka"; \
-		"$(KUSTOMIZE)" build config/default -o "$$tmp/deploy/orka.yaml"; \
+		"$(KUSTOMIZE)" build config/acp-production -o "$$tmp/deploy/orka.yaml"; \
 		"$(KUSTOMIZE)" build \
 			--load-restrictor LoadRestrictionsNone \
 			cmd/build/helmify | go run ./cmd/build/helmify -output-dir "$$tmp/charts/orka"; \
@@ -112,6 +125,33 @@ promote-staging-manifest: ## Promote committed staging manifests into release sn
 		mv "$$stage/charts" charts; installed_charts=1; \
 		trap - EXIT; \
 		rm -rf "$$stage" "$$backup"
+	diff --no-dereference --recursive manifest_staging/deploy deploy
+	diff --no-dereference --recursive manifest_staging/charts/orka charts/orka
+
+.PHONY: verify-release-manifest
+verify-release-manifest: ## Validate promoted release snapshots and the harness-v2 Helm render contract.
+	scripts/validate-release-manifest.sh "$(if $(NEWVERSION),$(NEWVERSION),$(VERSION))"
+
+.PHONY: test-release-manifest
+test-release-manifest: ## Test release versioning, image matrices, and the harness-v2 render policy.
+	bash scripts/tests/release-manifest-test.sh
+
+.PHONY: sync-helm-crds
+sync-helm-crds: ## Synchronize generated CRDs into the promoted Helm chart while preserving non-CRD files.
+	scripts/sync-helm-crds.sh
+
+.PHONY: verify-helm-crds
+verify-helm-crds: ## Verify generated and promoted Helm chart CRDs are identical.
+	scripts/sync-helm-crds.sh --check
+
+.PHONY: test-helm-crd-sync
+test-helm-crd-sync: ## Test Helm CRD synchronization and drift detection.
+	bash scripts/tests/sync-helm-crds-test.sh
+
+.PHONY: test-static-mode-deploy-gate
+test-static-mode-deploy-gate: ## Test the static harness-mode CRD deployment gate.
+	bash scripts/tests/static-mode-deploy-gate-test.sh
+
 
 .PHONY: generate
 generate: controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
@@ -155,7 +195,7 @@ test: manifests generate fmt vet setup-envtest ## Run tests.
 
 # The default e2e setup assumes Kind is pre-installed and builds/loads the Manager Docker image locally.
 KIND_CLUSTER ?= orka-test-e2e
-E2E_GO_TEST_TIMEOUT ?= 30m
+E2E_GO_TEST_TIMEOUT ?= 50m
 E2E_GINKGO_FOCUS ?=
 E2E_GINKGO_FOCUS_ARG = $(if $(E2E_GINKGO_FOCUS),-ginkgo.focus="$(E2E_GINKGO_FOCUS)",)
 
@@ -189,6 +229,8 @@ test-e2e-setup-only: setup-test-e2e docker-build-all ## Set up Kind cluster and
 	$(KIND) load docker-image $(AI_WORKER_IMG) --name $(KIND_CLUSTER)
 	$(KIND) load docker-image $(GENERAL_WORKER_IMG) --name $(KIND_CLUSTER)
 	$(KIND) load docker-image $(HARNESS_WRAPPER_IMG) --name $(KIND_CLUSTER)
+	set -e; for img in $(ACP_RUNTIME_IMGS); do $(KIND) load docker-image $$img --name $(KIND_CLUSTER); done
+	$(KIND) load docker-image $(WORKSPACE_PUBLISHER_IMG) --name $(KIND_CLUSTER)
 
 .PHONY: test-e2e-run-only
 test-e2e-run-only: manifests generate fmt vet ## Run e2e tests without rebuilding images (for fast iteration).
@@ -276,8 +318,13 @@ ui-test-coverage: ## Run UI unit tests with coverage.
 ##@ Build
 
 .PHONY: build
-build: manifests generate fmt vet ui-build ## Build manager binary.
-	go build -o bin/manager cmd/main.go
+build: manifests generate fmt vet ui-build ## Build manager and admission binaries.
+	go build -o bin/manager ./cmd
+	go build -o bin/orka-admission ./cmd/orka-admission
+
+.PHONY: build-admission
+build-admission: ## Build the stateless admission binary.
+	go build -o bin/orka-admission ./cmd/orka-admission
 
 
 .PHONY: docs-cli
@@ -297,7 +344,12 @@ build-all: build build-cli ## Build all binaries.
 
 .PHONY: run
 run: manifests generate fmt vet ## Run a controller from your host.
-	go run ./cmd/main.go
+	POD_NAMESPACE="$(RUN_WATCH_NAMESPACE)" go run ./cmd --leader-elect=true \
+		--controller-mode="$(RUN_CONTROLLER_MODE)" \
+		--watch-namespace="$(RUN_WATCH_NAMESPACE)" \
+		--agent-execution-snapshot-key-file="$(RUN_AGENT_EXECUTION_SNAPSHOT_KEY_FILE)" \
+		--enforce-namespace-isolation=true \
+		--execution-mode-controller-usernames="$(RUN_EXECUTION_MODE_CONTROLLER_USERNAMES)"
 
 # If you wish to build the manager image targeting other platforms you can use the --platform flag.
 # (i.e. docker build --platform linux/arm64). However, you must enable docker buildKit for it.
@@ -314,31 +366,72 @@ docker-push: ## Push docker image with the manager.
 docker-build-ai-worker: ## Build docker image for the AI worker.
 	$(CONTAINER_TOOL) build -t ${AI_WORKER_IMG} -f workers/ai/Dockerfile .
 
-.PHONY: docker-build-harness-wrapper
-docker-build-harness-wrapper: ## Build docker image for the agent harness wrapper.
-	$(CONTAINER_TOOL) build -t ${HARNESS_WRAPPER_IMG} -f workers/harness/Dockerfile .
-
 .PHONY: docker-build-general-worker
 docker-build-general-worker: ## Build docker image for the general worker.
 	$(CONTAINER_TOOL) build -t ${GENERAL_WORKER_IMG} -f workers/general/Dockerfile .
 
+.PHONY: docker-build-harness-wrapper
+docker-build-harness-wrapper: ## Build the opt-in harness v1 compatibility wrapper image.
+	$(CONTAINER_TOOL) build -t ${HARNESS_WRAPPER_IMG} -f workers/harness/Dockerfile .
+
+# Recipes for the docker-build-acp-<provider>-runtime targets are generated
+# from ACP_RUNTIME_PROVIDERS below; these dependency-less rules carry their
+# `make help` entries.
+docker-build-acp-codex-runtime: ## Build the immutable Codex ACP runtime image.
+docker-build-acp-claude-runtime: ## Build the immutable Claude ACP runtime image.
+docker-build-acp-copilot-runtime: ## Build the immutable GitHub Copilot ACP runtime image.
+docker-build-acp-opencode-runtime: ## Build the immutable OpenCode ACP runtime image.
+
+.PHONY: docker-build-workspace-publisher
+docker-build-workspace-publisher: ## Build the clean-room workspace publisher image.
+	$(CONTAINER_TOOL) build -t ${WORKSPACE_PUBLISHER_IMG} -f workers/publisher/Dockerfile .
+
 .PHONY: docker-push-ai-worker
 docker-push-ai-worker: ## Push docker image for the AI worker.
 	$(CONTAINER_TOOL) push ${AI_WORKER_IMG}
 
-.PHONY: docker-push-harness-wrapper
-docker-push-harness-wrapper: ## Push docker image for the agent harness wrapper.
-	$(CONTAINER_TOOL) push ${HARNESS_WRAPPER_IMG}
-
 .PHONY: docker-push-general-worker
 docker-push-general-worker: ## Push docker image for the general worker.
 	$(CONTAINER_TOOL) push ${GENERAL_WORKER_IMG}
 
+.PHONY: docker-push-harness-wrapper
+docker-push-harness-wrapper: ## Push the opt-in harness v1 compatibility wrapper image.
+	$(CONTAINER_TOOL) push ${HARNESS_WRAPPER_IMG}
+
+# Recipes for the docker-push-acp-<provider>-runtime targets are generated
+# from ACP_RUNTIME_PROVIDERS below; these dependency-less rules carry their
+# `make help` entries.
+docker-push-acp-codex-runtime: ## Push the immutable Codex ACP runtime image.
+docker-push-acp-claude-runtime: ## Push the immutable Claude ACP runtime image.
+docker-push-acp-copilot-runtime: ## Push the immutable GitHub Copilot ACP runtime image.
+docker-push-acp-opencode-runtime: ## Push the immutable OpenCode ACP runtime image.
+
+# acp-provider-uc maps an ACP runtime provider word to the uppercase form used
+# in its image variable name (ACP_<PROVIDER>_RUNTIME_IMG).
+acp-provider-uc = $(subst codex,CODEX,$(subst claude,CLAUDE,$(subst copilot,COPILOT,$(subst opencode,OPENCODE,$(1)))))
+
+# acp-runtime-image-targets generates the build/push recipes for one ACP
+# runtime provider word $(1) (target names, Dockerfile directory, and image
+# variable).
+define acp-runtime-image-targets
+.PHONY: docker-build-acp-$(1)-runtime docker-push-acp-$(1)-runtime
+docker-build-acp-$(1)-runtime:
+	$$(CONTAINER_TOOL) build -t $${ACP_$(call acp-provider-uc,$(1))_RUNTIME_IMG} -f workers/acp/images/$(1)/Dockerfile .
+docker-push-acp-$(1)-runtime:
+	$$(CONTAINER_TOOL) push $${ACP_$(call acp-provider-uc,$(1))_RUNTIME_IMG}
+endef
+
+$(foreach provider,$(ACP_RUNTIME_PROVIDERS),$(eval $(call acp-runtime-image-targets,$(provider))))
+
+.PHONY: docker-push-workspace-publisher
+docker-push-workspace-publisher: ## Push the clean-room workspace publisher image.
+	$(CONTAINER_TOOL) push ${WORKSPACE_PUBLISHER_IMG}
+
 .PHONY: docker-build-all
-docker-build-all: docker-build docker-build-ai-worker docker-build-general-worker docker-build-harness-wrapper ## Build all docker images.
+docker-build-all: docker-build docker-build-ai-worker docker-build-general-worker docker-build-harness-wrapper docker-build-acp-codex-runtime docker-build-acp-claude-runtime docker-build-acp-copilot-runtime docker-build-acp-opencode-runtime docker-build-workspace-publisher ## Build all docker images.
 
 .PHONY: docker-push-all
-docker-push-all: docker-push docker-push-ai-worker docker-push-general-worker docker-push-harness-wrapper ## Push all docker images.
+docker-push-all: docker-push docker-push-ai-worker docker-push-general-worker docker-push-harness-wrapper docker-push-acp-codex-runtime docker-push-acp-claude-runtime docker-push-acp-copilot-runtime docker-push-acp-opencode-runtime docker-push-workspace-publisher ## Push all docker images.
 
 ##@ Deployment
 
@@ -356,24 +449,107 @@ uninstall: manifests kustomize ## Uninstall CRDs from the K8s cluster specified
 	@out="$$( "$(KUSTOMIZE)" build config/crd 2>/dev/null || true )"; \
 	if [ -n "$$out" ]; then echo "$$out" | "$(KUBECTL)" delete --ignore-not-found=$(ignore-not-found) -f -; else echo "No CRDs to delete; skipping."; fi
 
+.PHONY: verify-acp-runtime-images
+verify-acp-runtime-images: ## Require digest-pinned ACP runtime images for supported deployments.
+	@for entry in \
+		"IMG=$(IMG)" \
+		"WORKSPACE_PUBLISHER_IMG=$(WORKSPACE_PUBLISHER_IMG)" \
+		"ACP_CODEX_RUNTIME_IMG=$(ACP_CODEX_RUNTIME_IMG)" \
+		"ACP_CLAUDE_RUNTIME_IMG=$(ACP_CLAUDE_RUNTIME_IMG)" \
+		"ACP_COPILOT_RUNTIME_IMG=$(ACP_COPILOT_RUNTIME_IMG)" \
+		"ACP_OPENCODE_RUNTIME_IMG=$(ACP_OPENCODE_RUNTIME_IMG)"; do \
+		name="$${entry%%=*}"; ref="$${entry#*=}"; \
+		if [[ ! "$${ref}" =~ ^.+@sha256:[0-9a-f]{64}$$ ]]; then \
+			echo "$$name must be an immutable image reference ending in @sha256:<64 lowercase hex characters>; got '$$ref'" >&2; \
+			exit 1; \
+		fi; \
+	done
+
+.PHONY: verify-static-mode-crds
+verify-static-mode-crds: ## Refuse workload deployment until the platform-owned shared CRD bundle is ready.
+	@for crd in \
+		agentruntimes.core.orka.ai \
+		agents.core.orka.ai \
+		branchclaims.core.orka.ai \
+		controllerepochs.core.orka.ai \
+		executionworkspaceclasses.workspace.orka.ai \
+		executionworkspacepools.workspace.orka.ai \
+		executionworkspaceproviders.workspace.orka.ai \
+		executionworkspaces.workspace.orka.ai \
+		externaleffects.core.orka.ai \
+		fakepoolparameters.fake.workspace.orka.ai \
+		fakeproviderconfigs.fake.workspace.orka.ai \
+		gatewaybindings.gateway.orka.ai \
+		gatewayclasses.gateway.orka.ai \
+		gateways.gateway.orka.ai \
+		outboundaccesspolicies.core.orka.ai \
+		promptattempts.core.orka.ai \
+		providers.core.orka.ai \
+		publications.core.orka.ai \
+		repositorymonitors.core.orka.ai \
+		repositoryscans.core.orka.ai \
+		runtimepools.core.orka.ai \
+		runtimesessioncontrols.core.orka.ai \
+		skills.core.orka.ai \
+		substrateactorpools.core.orka.ai \
+		tasks.core.orka.ai \
+		tools.core.orka.ai; do \
+		"$(KUBECTL)" get crd "$$crd" >/dev/null || { echo "missing shared CRD: $$crd; apply the platform-owned static-mode CRD wave before workloads" >&2; exit 1; }; \
+		"$(KUBECTL)" wait --for=condition=Established --timeout=60s "crd/$$crd" >/dev/null || { echo "shared CRD is not Established: $$crd" >&2; exit 1; }; \
+	done
+	@for crd in agentexecutioncontrols.core.orka.ai agentexecutionpolicies.core.orka.ai agentexecutionadjudications.core.orka.ai; do \
+		if "$(KUBECTL)" get crd "$$crd" >/dev/null 2>&1; then \
+			echo "unsupported superseded coexistence CRD remains installed: $$crd" >&2; \
+			exit 1; \
+		fi; \
+	done
+	@"$(KUBECTL)" get crd agentruntimes.core.orka.ai -o json | jq -e \
+		'[.spec.versions[] | select(.served == true) | .schema.openAPIV3Schema.properties.spec.properties.contractVersion.enum] as $$enums | ($$enums | length) > 0 and ($$enums | all(sort == ["orka.harness.v1","orka.harness.v2"]))' >/dev/null || \
+		{ echo "AgentRuntime CRD is not the shared orka.harness.v1/orka.harness.v2 schema; apply the platform-owned static-mode CRD wave before workloads" >&2; exit 1; }
+	@"$(KUBECTL)" get crd agents.core.orka.ai -o json | jq -e \
+		'[.spec.versions[] | select(.served == true) | .schema.openAPIV3Schema.properties.spec.properties.runtime as $$runtime | (((($$runtime.properties.contractVersion.enum // []) | sort) == ["orka.harness.v1","orka.harness.v2"]) and ((($$runtime["x-kubernetes-validations"] // []) | map(.message) | index("runtime.contractVersion is immutable once set")) != null))] as $$checks | ($$checks | length) > 0 and ($$checks | all)' >/dev/null || \
+		{ echo "Agent CRD is missing the immutable shared contract selector; apply the platform-owned static-mode CRD wave before workloads" >&2; exit 1; }
+	@"$(KUBECTL)" get crd tasks.core.orka.ai -o json | jq -e \
+		'[.spec.versions[] | select(.served == true) | .schema.openAPIV3Schema as $$schema | $$schema.properties.status as $$status | ((($$status.properties.agentExecutionBinding.type // "") == "object") and ((($$status.properties.agentExecutionBinding.properties.contractVersion.enum // []) | sort) == ["orka.harness.v1","orka.harness.v2"]) and (($$status.properties | has("agentExecutionNoExecution")) | not) and (($$status.properties | has("agentExecutionQuarantine")) | not) and (($$status.properties | has("agentExecutionResolutionRef")) | not) and ((($$status["x-kubernetes-validations"] // []) | map(.message) | index("agentExecutionBinding is write-once and immutable")) != null) and ((($$schema["x-kubernetes-validations"] // []) | map(.message) | index("Task spec is immutable after execution authority is recorded")) != null))] as $$checks | ($$checks | length) > 0 and ($$checks | all)' >/dev/null || \
+		{ echo "Task CRD is missing the static-mode execution-authority schema; apply the platform-owned static-mode CRD wave before workloads" >&2; exit 1; }
+
 .PHONY: deploy
-deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
-	cd config/manager && "$(KUSTOMIZE)" edit set image controller=${IMG}
-	cd config/harness-wrapper && "$(KUSTOMIZE)" edit set image ghcr.io/orka-agents/orka/agent-harness-wrapper=${HARNESS_WRAPPER_IMG}
-	@"$(KUBECTL)" create namespace orka-system --dry-run=client -o yaml | "$(KUBECTL)" apply -f -
-	@if ! "$(KUBECTL)" -n orka-system get secret harness-wrapper-auth >/dev/null 2>&1; then \
+deploy: verify-acp-runtime-images verify-static-mode-crds manifests kustomize ## Deploy the static harness-v2 installation after the shared CRD wave.
+	@bash "$(CURDIR)/scripts/lib/ensure-static-mode-namespace.sh" "$(KUBECTL)" orka-system harness-v2
+	@if ! "$(KUBECTL)" -n orka-system get secret acp-artifact-capability >/dev/null 2>&1; then \
+		secret="$$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d '\n')"; \
+		"$(KUBECTL)" -n orka-system create secret generic acp-artifact-capability --from-literal=capability-secret="$$secret"; \
+	fi
+	@if ! "$(KUBECTL)" -n orka-system get secret workspace-publisher-auth >/dev/null 2>&1; then \
+		bearer="$$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d '\n')"; \
+		capability="$$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d '\n')"; \
+		"$(KUBECTL)" -n orka-system create secret generic workspace-publisher-auth --from-literal=controller-token="$$bearer" --from-literal=operation-capability-secret="$$capability"; \
+	fi
+	@if ! "$(KUBECTL)" -n orka-system get secret provider-auth-proxy >/dev/null 2>&1; then \
 		token="$$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d '\n')"; \
-		"$(KUBECTL)" -n orka-system create secret generic harness-wrapper-auth --from-literal=token="$$token"; \
+		"$(KUBECTL)" -n orka-system create secret generic provider-auth-proxy --from-literal=token="$$token"; \
 	fi
-	"$(KUSTOMIZE)" build config/default | \
-		sed -E \
-			-e 's|^([[:space:]]*- --ai-worker-image=).*$$|\1$(AI_WORKER_IMG)|' \
-			-e 's|^([[:space:]]*- --general-worker-image=).*$$|\1$(GENERAL_WORKER_IMG)|' | \
-		"$(KUBECTL)" apply -f -
+	@if ! "$(KUBECTL)" -n orka-system get secret scm-egress-proxy-auth >/dev/null 2>&1; then \
+		token="$$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | od -An -tx1 | tr -d ' \n')"; \
+		"$(KUBECTL)" -n orka-system create secret generic scm-egress-proxy-auth --from-literal=token="$$token"; \
+	fi
+	@set -eu; tmp="$$(mktemp -d)"; trap 'rm -rf "$$tmp"' EXIT; \
+		cp -R config "$$tmp/config"; \
+		"$(CURDIR)/scripts/render-worker-images.sh" "$$tmp/config/manager/manager.yaml" \
+			"$(AI_WORKER_IMG)" "$(GENERAL_WORKER_IMG)"; \
+		"$(CURDIR)/scripts/render-acp-runtime-images.sh" "$$tmp/config/acp-production" \
+			"${ACP_CODEX_RUNTIME_IMG}" "${ACP_CLAUDE_RUNTIME_IMG}" "${ACP_COPILOT_RUNTIME_IMG}" "${ACP_OPENCODE_RUNTIME_IMG}"; \
+		cd "$$tmp/config/acp-production"; \
+		"$(KUSTOMIZE)" edit set image \
+			controller=${IMG} \
+			ghcr.io/orka-agents/orka=${IMG} \
+			docker.io/sozercan/orka-workspace-publisher=${WORKSPACE_PUBLISHER_IMG}; \
+		"$(CURDIR)/scripts/apply-acp-production.sh" "$$PWD" "$(KUSTOMIZE)" "$(KUBECTL)"
+
 
 .PHONY: undeploy
 undeploy: kustomize ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
-	"$(KUSTOMIZE)" build config/default | "$(KUBECTL)" delete --ignore-not-found=$(ignore-not-found) -f -
+	"$(KUSTOMIZE)" build config/acp-production | "$(KUBECTL)" delete --ignore-not-found=$(ignore-not-found) -f -
 
 ##@ Dependencies
 
diff --git a/NOTICE.md b/NOTICE.md
index 44afa52c8..3ad99591c 100644
--- a/NOTICE.md
+++ b/NOTICE.md
@@ -25,7 +25,7 @@ upstream revision, and Orka modification notes.
 
 ## GitHub Copilot CLI
 
-Orka embeds the GitHub Copilot CLI in the `agent-harness-wrapper` binary using `github.com/github/copilot-sdk/go/cmd/bundler`. The embedded CLI version is resolved at build time by the bundler based on the `github.com/github/copilot-sdk/go` version in `go.mod`.
+The digest-pinned Copilot ACP runtime image redistributes the unmodified official GitHub Copilot CLI executable as one component of Orka's fenced RuntimePool service. The image includes this license at `/usr/share/licenses/github-copilot-cli/LICENSE.md`; the controller and Publisher images do not include Copilot CLI.
 
 GitHub Copilot CLI License
 
@@ -65,7 +65,7 @@ GitHub Copilot CLI License
 
 ## GitHub Copilot SDK for Go
 
-Orka uses `github.com/github/copilot-sdk/go` to integrate with GitHub Copilot CLI.
+The source dependency graph includes `github.com/github/copilot-sdk/go` for compatibility and integration work. The supported built-in ACP runtime profiles are Codex, Claude, Copilot, and OpenCode.
 
 MIT License
 
@@ -89,15 +89,41 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
+## OpenCode
+
+The digest-pinned OpenCode ACP runtime image redistributes the unmodified OpenCode 1.18.9 native binary under the following MIT license.
+
+MIT License
+
+Copyright (c) 2025 opencode
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
 ## Anthropic Claude Code
 
-Orka installs `@anthropic-ai/claude-code` and the corresponding Linux platform package in the agent harness image.
+The digest-pinned Claude ACP runtime image installs `@anthropic-ai/claude-code` and the corresponding Linux platform package. The controller and Publisher images do not include Claude Code.
 
 © Anthropic PBC. All rights reserved. Use is subject to the Legal Agreements outlined here: https://code.claude.com/docs/en/legal-and-compliance.
 
 ## OpenAI Codex CLI
 
-Orka installs `@openai/codex` and the corresponding Linux platform package in the agent harness image. The npm package declares the Apache License 2.0.
+The digest-pinned Codex ACP runtime image installs `@openai/codex` and the corresponding Linux platform package. The controller and Publisher images do not include Codex. The npm package declares the Apache License 2.0.
 
 Apache License
 Version 2.0, January 2004
diff --git a/README.md b/README.md
index 26a3d8127..1de5fdaf2 100644
--- a/README.md
+++ b/README.md
@@ -12,7 +12,7 @@
 
 ---
 
-Orka turns your Kubernetes cluster into an AI-powered task execution platform. Spin up swarms of AI agents that write code, review PRs, research topics, or run containers — each as an isolated Kubernetes Job with full scheduling, retries, and observability. A coordinator agent dynamically decomposes complex tasks, spawns specialist agents to work in parallel, and synthesizes their results — no manual orchestration graphs required.
+Orka turns your Kubernetes cluster into an AI-powered task execution platform. Native AI and container work run as Kubernetes Jobs; ACP coding agents run as fenced RuntimeSessions in controller-owned, scale-to-zero RuntimePools. A coordinator agent dynamically decomposes complex tasks, spawns specialist agents to work in parallel, and synthesizes their results — no manual orchestration graphs required.
 
 One `helm install`, one LLM secret, and you're chatting with an orchestrator that handles the rest.
 
@@ -28,9 +28,9 @@ One `helm install`, one LLM secret, and you're chatting with an orchestrator tha
 
 **Centralized control** — One place to set model policies, rate limits, and allowed providers across every team. Swap models or providers without touching developer configs.
 
-**Every agent action is auditable** — Tasks run as Kubernetes Jobs with full logs, Prometheus metrics, and result storage. Know exactly what every agent did, when, and at what cost.
+**Every agent action is auditable** — Tasks have durable execution events, Prometheus metrics, structured results, and, for ACP agents, fenced attempt/session and delivery receipts. Know exactly what every agent did, when, and at what cost.
 
-**Isolated execution** — Each agent runs in its own Pod with a hardened security context: non-root, read-only rootfs, all capabilities dropped, seccomp enforced. Agents can't escape their sandbox.
+**Hardened execution** — Native workers use hardened per-Task Pods. ACP runtimes use digest-pinned shared Pods with private per-session directories and identities; a RuntimePool is a same-trust-domain boundary, not cross-tenant isolation.
 
 **Scale with your cluster** — Priority scheduling, retry policies, concurrency limits, and cron-based execution — all handled by the Kubernetes control plane you already operate.
 
@@ -51,7 +51,7 @@ One `helm install`, one LLM secret, and you're chatting with an orchestrator tha
 ## Features
 
 - 🤖 **AI Agents** — Anthropic, OpenAI, or Azure OpenAI with tools, skills, and session persistence
-- 🛠️ **Agent Runtimes** — Delegate repo-backed coding tasks to Codex CLI, Claude Code CLI, GitHub Copilot CLI, or OpenCode CLI
+- 🛠️ **ACP Agent Runtimes** — Run Codex, Claude, Copilot, and OpenCode through digest-pinned RuntimePools; external `orka.harness.v2` registration and conformance are available while `runtimeRef` Task dispatch remains fail-closed
 - 🔁 **Autonomous Task Loops** — Coordinators can iterate on long-running goals until complete, canceled, or at an iteration limit
 - 🔀 **Multi-Agent Coordination** — Coordinators delegate to specialists with depth and concurrency controls
 - 💬 **Interactive Chat** — Agentic orchestrator with SSE streaming that creates and manages agents and tasks for you
@@ -59,55 +59,80 @@ One `helm install`, one LLM secret, and you're chatting with an orchestrator tha
 - 🧠 **Durable Memory** — Namespace-scoped recall, transcript search, and reviewable memory proposals that can be applied
 - 🛡️ **Repository Security Scanning** — Scheduled and incremental repository scans with threat models, validated findings, patch generation, and remediation PRs
 - 🔎 **Repository Monitors** — Durable GitHub PR review queues with scheduled and webhook-triggered review runs
-- 🧰 **Agent Sandbox Workspaces** — Experimental durable, reusable coding workspaces through `agent-sandbox`
+- 🧰 **Deferred Workspace Providers** — Evaluate `agent-sandbox` or Substrate separately; neither is a current ACP execution path
 - 🖥️ **Web Dashboard** — Built-in React UI embedded in the controller binary — zero extra deployments
-- 📦 **Declarative CRDs** — Task, Agent, AgentRuntime, Tool, Provider, Skill, RepositoryScan, RepositoryMonitor, and SubstrateActorPool custom resources for GitOps workflows
+- 📦 **Declarative Control** — Workload, gateway, workspace, and Kubernetes-authoritative ACP control CRDs for GitOps workflows
 - ⏰ **Scheduled Tasks** — Cron-based recurring execution with concurrency policies
 - 🔌 **REST & OpenAI-Compatible API** — Full CRUD + `/openai/v1/chat/completions` endpoint for Continue, Cursor, and any OpenAI-compatible client
 - 🔐 **Kubernetes, OIDC & Transaction-Token Auth** — ServiceAccount tokens by default, with optional OIDC and scoped vendor-neutral transaction governance
 - 🔮 **Anthropic-Compatible API** — `/anthropic/v1/messages` endpoint for Claude Code and other Anthropic-native clients
 - 📊 **Observability** — Prometheus metrics, structured logging, health probes, and optional OpenTelemetry traces + GenAI OTLP metrics
-- 🔒 **Hardened by Default** — Non-root containers, read-only rootfs, ServiceAccount token auth
+- 🔒 **Hardened by Default** — Non-root native workers, fenced private ACP child identities, read-only filesystems, and authenticated broker boundaries
+
+The ACP hard cutover keeps control authority in Kubernetes:
+`ControllerEpoch`, `PromptAttempt`, `RuntimeSessionControl`, `BranchClaim`,
+`Publication`, and `ExternalEffect` status plus coordination Leases. SQLite is
+limited to transcript/SessionTurn payloads, deferred outbox projections, and
+artifact payloads (including result bodies). Provider traffic uses the central authenticated proxy;
+prompt tools use prompt-scoped MCP; and source-read, target-read, target-write,
+and forge credentials reach only the clean-room Publisher through the
+credential broker. Artifact access is separately operation-scoped.
 
 ## Quick Start
 
 ### Install
 
 ```bash
+kubectl create -f - <<'EOF'
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: orka-system
+  labels:
+    orka.ai/controller-mode: harness-v2
+EOF
+
 helm install orka charts/orka \
   --namespace orka-system \
-  --create-namespace
+  --set controller.mode=harness-v2 \
+  --set controller.watchNamespace=orka-system \
+  --set controller.image.repository=docker.io/sozercan/orka \
+  --set controller.image.digest=sha256:<controller-digest> \
+  --set publisher.image.repository=docker.io/sozercan/orka-workspace-publisher \
+  --set publisher.image.digest=sha256:<publisher-digest> \
+  --set controller.acpRuntime.codexImage=docker.io/sozercan/orka-acp-codex@sha256:<codex-digest> \
+  --set controller.acpRuntime.claudeImage=docker.io/sozercan/orka-acp-claude@sha256:<claude-digest> \
+  --set controller.acpRuntime.copilotImage=docker.io/sozercan/orka-acp-copilot@sha256:<copilot-digest> \
+  --set controller.acpRuntime.opencodeImage=docker.io/sozercan/orka-acp-opencode@sha256:<opencode-digest>
 ```
 
-A fresh install creates all twelve cluster-scoped Orka CRDs. Use `--skip-crds`
-only when one designated platform or release owner already manages compatible
-Orka CRDs for the cluster.
-
-> [!IMPORTANT]
-> Helm does not create or update files from `crds/` during `helm upgrade`.
-> Apply the CRDs from the exact target chart before
-> **every** upgrade, including an upgrade from the previous chart that installed
-> zero CRDs. Helm retains CRDs
-> on uninstall. See the [Helm CRD lifecycle guide](charts/orka/README.md).
-
-For the promoted raw installer, pre-create the harness-wrapper authentication
-Secret before applying the manifest; the token is intentionally not committed:
+For direct Kustomize deployments, use `config/acp-production`, not
+`config/default`. The production overlay includes the cross-namespace Vekil
+ingress policy that permits model traffic only through Orka's authenticated
+provider proxy:
 
 ```bash
-set -euo pipefail
+kubectl create -f - <<'EOF'
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: orka-system
+  labels:
+    orka.ai/controller-mode: harness-v2
+EOF
+kubectl apply -k config/acp-production
+```
 
-kubectl create namespace orka-system --dry-run=client -o yaml | kubectl apply -f -
-if ! kubectl -n orka-system get secret harness-wrapper-auth >/dev/null 2>&1; then
-  openssl rand -hex 32 | \
-    kubectl -n orka-system create secret generic harness-wrapper-auth \
-      --from-file=token=/dev/stdin
-fi
+Provision the required system Secrets and digest-pinned images before applying
+the overlay; `make deploy` performs those checks and applies the equivalent
+resource set.
 
-kubectl apply -f deploy/orka.yaml
-```
+A fresh Helm install creates the chart CRDs unless `--skip-crds` is used. Helm does not update CRDs during `helm upgrade`, so apply the CRDs from the exact target chart before every controller upgrade. Designate one lifecycle owner for cluster-scoped CRDs and see the [Helm CRD lifecycle guide](charts/orka/README.md).
 
-See [`config/harness-wrapper/README.md`](config/harness-wrapper/README.md) for
-the canonical installer prerequisite.
+Harness v1 and v2 may share a cluster only as separate static-mode releases
+with disjoint namespaces, endpoints, RBAC, Leases, stores, and data planes.
+Tasks and Sessions never migrate between them. See the
+[harness mode operations guide](website/docs/operations/harness-modes.md).
 
 ### Set Up a Provider
 
@@ -129,12 +154,18 @@ spec:
 EOF
 ```
 
+That `Provider` Secret is used by native `type: ai` Tasks and the compatible
+chat APIs. Built-in ACP Agents do **not** reference provider Secrets. Codex,
+Claude, Copilot, and OpenCode RuntimeSessions reach Vekil only through the central authenticated
+provider proxy. Source-read, target-read, target-write, and forge credentials
+are brokered separately to the clean-room Workspace/Publisher.
+
 ### Start Chatting
 
 Use the built-in dashboard, or connect any OpenAI-compatible client:
 
 ```bash
-kubectl port-forward -n orka-system svc/orka-api 8080:8080
+kubectl port-forward -n orka-system svc/orka 8080:8080
 
 # Open the web dashboard
 open http://localhost:8080
@@ -150,9 +181,9 @@ The built-in orchestrator creates agents, runs tasks, monitors progress, and ret
 | [Architecture](website/docs/concepts/architecture.md)                         | System design, components, and data flow              |
 | [Configuration](website/docs/concepts/configuration.md)                       | CRD reference, Helm values, controller flags, metrics |
 | [Observability](website/docs/guides/observability.md)                        | OpenTelemetry traces, GenAI metrics, and task trace guidance |
-| [Agent Runtimes](website/docs/concepts/agent-runtimes.md)                     | Built-in CLI runtimes and bring-your-own remote AgentRuntime backends |
-| [CLI Harness Wrapper](website/docs/guides/cli-harness-wrapper.md)                  | Harness protocol wrapper for Codex, Claude, Copilot, and OpenCode CLI runtimes |
-| [Agent Sandbox](website/docs/concepts/agent-sandbox.md)                       | Experimental upstream `agent-sandbox` workspace execution for agent runtimes |
+| [Agent Runtimes](website/docs/concepts/agent-runtimes.md)                     | ACP v2 RuntimePools, workspace policy, delivery, and external registrations |
+| [AgentRuntime Adapter Contract](website/docs/development/agent-runtime-adapter-contract.md) | Portable `orka.harness.v2` session and fencing contract |
+| [Agent Sandbox](website/docs/concepts/agent-sandbox.md)                       | Deferred execution-workspace integration behind the ACP v2 lifecycle |
 | [Interactive Chat](website/docs/guides/chat.md)                             | Chat endpoint, tools, and SSE streaming               |
 | [Multi-Agent Coordination](website/docs/guides/multi-agent-coordination.md) | Coordinator agents and task delegation                |
 | [Autonomous Tasks](website/docs/guides/autonomous-tasks.md)                 | Long-running coordinator loops with persisted plan state |
@@ -161,6 +192,7 @@ The built-in orchestrator creates agents, runs tasks, monitors progress, and ret
 | [OpenAI Compatibility](website/docs/reference/openai-compat.md)                | OpenAI-compatible chat completions API                |
 | [Anthropic Compatibility](website/docs/reference/anthropic-compat.md)          | Anthropic-compatible Messages API                     |
 | [Gateway API](website/docs/reference/gateway-api.md)                           | Generic Gateway resources, ingress, delivery, and operator APIs |
+| [Harness Modes](website/docs/operations/harness-modes.md)                      | Isolated v1/v2 releases, rollout, rollback, and retirement |
 | [Operating Gateways](website/docs/operations/gateways.md)                      | Gateway readiness, TLS, recovery, upgrades, and operations |
 | [Web Dashboard](website/docs/guides/ui.md)                                  | Frontend architecture and pages                       |
 | [Security](website/docs/concepts/security.md)                                 | Security model and hardening                          |
diff --git a/api/v1alpha1/agent_execution_binding_types.go b/api/v1alpha1/agent_execution_binding_types.go
new file mode 100644
index 000000000..c37a15b79
--- /dev/null
+++ b/api/v1alpha1/agent_execution_binding_types.go
@@ -0,0 +1,142 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+// AgentExecutionBackend identifies the isolated execution dispatcher backend.
+// +kubebuilder:validation:Enum=harness-wrapper;runtime-pool;external-endpoint
+type AgentExecutionBackend string
+
+const (
+	// AgentExecutionBackendHarnessWrapper is the built-in harness v1 wrapper.
+	AgentExecutionBackendHarnessWrapper AgentExecutionBackend = "harness-wrapper"
+	// AgentExecutionBackendRuntimePool is the managed ACP v2 RuntimePool path.
+	AgentExecutionBackendRuntimePool AgentExecutionBackend = "runtime-pool"
+	// AgentExecutionBackendExternalEndpoint is an external AgentRuntime endpoint.
+	AgentExecutionBackendExternalEndpoint AgentExecutionBackend = "external-endpoint"
+)
+
+// AgentExecutionBindingTaskRef pins the bound Task identity.
+type AgentExecutionBindingTaskRef struct {
+	// NamespaceUID is the UID of the Task namespace, preventing same-name
+	// namespace recreation from satisfying old identities.
+	// +kubebuilder:validation:Required
+	NamespaceUID types.UID `json:"namespaceUID"`
+
+	// +kubebuilder:validation:Required
+	UID types.UID `json:"uid"`
+
+	// BoundSpecGeneration is the Task spec generation frozen into the snapshot.
+	// +kubebuilder:validation:Minimum=1
+	BoundSpecGeneration int64 `json:"boundSpecGeneration"`
+}
+
+// AgentExecutionAgentRef pins the exact Agent identity resolved at binding.
+type AgentExecutionAgentRef struct {
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	Namespace string `json:"namespace"`
+
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	Name string `json:"name"`
+
+	// +kubebuilder:validation:Required
+	UID types.UID `json:"uid"`
+
+	// +kubebuilder:validation:Minimum=1
+	Generation int64 `json:"generation"`
+}
+
+// AgentExecutionSnapshotRef links the immutable non-secret execution snapshot.
+type AgentExecutionSnapshotRef struct {
+	// ID is the snapshot identity in the form <task-uid>/sha256:<digest>.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=512
+	ID string `json:"id"`
+
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	Digest string `json:"digest"`
+
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Enum=1
+	SchemaVersion int32 `json:"schemaVersion"`
+}
+
+// AgentExecutionRuntimeRef pins a referenced AgentRuntime identity.
+type AgentExecutionRuntimeRef struct {
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	Name string `json:"name"`
+
+	// +kubebuilder:validation:Required
+	UID types.UID `json:"uid"`
+
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Minimum=1
+	Generation int64 `json:"generation"`
+}
+
+// AgentExecutionBinding is the controller-owned, write-once, immutable
+// execution binding for one executable agent Task. It is authoritative for
+// routing, recovery, cancellation, terminal settlement, and finalization, and
+// is preserved across retries. Dispatchers build requests only from the
+// referenced immutable snapshot.
+// +kubebuilder:validation:XValidation:rule="self.backend != 'harness-wrapper' || self.contractVersion == 'orka.harness.v1'",message="the harness-wrapper backend requires an orka.harness.v1 binding"
+// +kubebuilder:validation:XValidation:rule="self.backend != 'runtime-pool' || self.contractVersion == 'orka.harness.v2'",message="the runtime-pool backend requires an orka.harness.v2 binding"
+type AgentExecutionBinding struct {
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Enum=1
+	SchemaVersion int32 `json:"schemaVersion"`
+
+	// ContractVersion is the frozen execution protocol for the Task lifetime.
+	// +kubebuilder:validation:Required
+	ContractVersion AgentRuntimeContractVersion `json:"contractVersion"`
+
+	// +kubebuilder:validation:Required
+	Backend AgentExecutionBackend `json:"backend"`
+
+	// BindingDigest is the canonical digest of this binding; every durable
+	// demand, attempt, turn, Session lease, publication, and cleanup record
+	// copies it.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	BindingDigest string `json:"bindingDigest"`
+
+	// +kubebuilder:validation:Required
+	Task AgentExecutionBindingTaskRef `json:"task"`
+
+	// +optional
+	Agent *AgentExecutionAgentRef `json:"agent,omitempty"`
+
+	// +kubebuilder:validation:Required
+	Snapshot AgentExecutionSnapshotRef `json:"snapshot"`
+
+	// RuntimeType is the built-in runtime type, empty for runtimeRef bindings.
+	// +optional
+	RuntimeType AgentRuntimeType `json:"runtimeType,omitempty"`
+
+	// +optional
+	RuntimeRef *AgentExecutionRuntimeRef `json:"runtimeRef,omitempty"`
+
+	// +optional
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	RuntimeProfileDigest string `json:"runtimeProfileDigest,omitempty"`
+
+	// +optional
+	// +kubebuilder:validation:Enum=1
+	RuntimeProfileDigestSchemaVersion int32 `json:"runtimeProfileDigestSchemaVersion,omitempty"`
+
+	// +kubebuilder:validation:Required
+	BoundAt metav1.Time `json:"boundAt"`
+}
diff --git a/api/v1alpha1/agent_runtime_crd_types.go b/api/v1alpha1/agent_runtime_crd_types.go
index 7d54c6ec9..ba929e41b 100644
--- a/api/v1alpha1/agent_runtime_crd_types.go
+++ b/api/v1alpha1/agent_runtime_crd_types.go
@@ -6,15 +6,37 @@ MIT License - see LICENSE file for details.
 
 package v1alpha1
 
-import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+import (
+	"fmt"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
 
 // AgentRuntimeContractVersion identifies the Orka-facing runtime contract.
-// +kubebuilder:validation:Enum=orka.harness.v1
+// During harness coexistence both protocol values are schema-valid; omission is
+// never protocol evidence and is tolerated only for stored objects awaiting the
+// one-time bridge classification.
+// +kubebuilder:validation:Enum=orka.harness.v1;orka.harness.v2
 type AgentRuntimeContractVersion string
 
 const (
 	// AgentRuntimeContractHarnessV1 is the frozen harness v1 HTTP+SSE contract.
 	AgentRuntimeContractHarnessV1 AgentRuntimeContractVersion = "orka.harness.v1"
+	// AgentRuntimeContractHarnessV2 is the session-centric HTTP+NDJSON contract.
+	AgentRuntimeContractHarnessV2 AgentRuntimeContractVersion = "orka.harness.v2"
+)
+
+// AgentRuntimeToolExecutionMode describes how a harness v1 runtime executes tools.
+// +kubebuilder:validation:Enum=observed;brokered
+type AgentRuntimeToolExecutionMode string
+
+const (
+	// AgentRuntimeToolExecutionModeObserved marks runtimes that execute tools
+	// themselves; Orka only observes emitted frames.
+	AgentRuntimeToolExecutionModeObserved AgentRuntimeToolExecutionMode = "observed"
+	// AgentRuntimeToolExecutionModeBrokered marks runtimes whose tool calls are
+	// executed by Orka and continued back into the turn.
+	AgentRuntimeToolExecutionModeBrokered AgentRuntimeToolExecutionMode = "brokered"
 )
 
 // AgentRuntimeDeploymentMode selects how the runtime endpoint is provided.
@@ -26,27 +48,14 @@ const (
 	AgentRuntimeDeploymentModeExternalEndpoint AgentRuntimeDeploymentMode = "external-endpoint"
 )
 
-// AgentRuntimeToolExecutionMode declares how custom runtimes interact with tools.
-// +kubebuilder:validation:Enum=observed;brokered
-type AgentRuntimeToolExecutionMode string
-
-const (
-	// AgentRuntimeToolExecutionModeObserved means the runtime owns its internal tools and Orka observes lifecycle only.
-	AgentRuntimeToolExecutionModeObserved AgentRuntimeToolExecutionMode = "observed"
-	// AgentRuntimeToolExecutionModeBrokered means the runtime asks Orka to execute governed Tool CRDs.
-	AgentRuntimeToolExecutionModeBrokered AgentRuntimeToolExecutionMode = "brokered"
-)
-
-// AgentRuntimeBrokeredToolClass declares which classes of Orka-brokered tools a runtime can request.
+// AgentRuntimeBrokeredToolClass classifies Tool CRDs. It is shared by the Tool
+// API and by harness v1 AgentRuntime capability declarations.
 // +kubebuilder:validation:Enum=read;write;coordination
 type AgentRuntimeBrokeredToolClass string
 
 const (
-	// AgentRuntimeBrokeredToolClassRead covers read-only evidence and lookup tools.
-	AgentRuntimeBrokeredToolClassRead AgentRuntimeBrokeredToolClass = "read"
-	// AgentRuntimeBrokeredToolClassWrite covers consequential tools that may require approval and idempotency.
-	AgentRuntimeBrokeredToolClassWrite AgentRuntimeBrokeredToolClass = "write"
-	// AgentRuntimeBrokeredToolClassCoordination covers Orka coordination tools such as delegate_task/wait_for_tasks.
+	AgentRuntimeBrokeredToolClassRead         AgentRuntimeBrokeredToolClass = "read"
+	AgentRuntimeBrokeredToolClassWrite        AgentRuntimeBrokeredToolClass = "write"
 	AgentRuntimeBrokeredToolClassCoordination AgentRuntimeBrokeredToolClass = "coordination"
 )
 
@@ -59,18 +68,20 @@ type AgentRuntimeReference struct {
 
 // AgentRuntimeDeploymentSpec configures where Orka reaches the harness runtime.
 type AgentRuntimeDeploymentSpec struct {
-	// Mode is the deployment mode. The first milestone supports external endpoints only.
+	// Mode is the deployment mode. External AgentRuntime registrations are not
+	// scaled or recycled by Orka.
 	// +kubebuilder:validation:Required
 	Mode AgentRuntimeDeploymentMode `json:"mode"`
 
-	// Endpoint is the base URL for a pre-deployed or external orka.harness.v1 service.
-	// It must not contain credentials; bearer auth is configured via clientAuth.
+	// Endpoint is the base URL for an external harness service. It must not
+	// contain credentials, query parameters, or fragments.
 	// +kubebuilder:validation:Required
 	// +kubebuilder:validation:Pattern=`^https?://[^\s@?#]+$`
 	Endpoint string `json:"endpoint"`
 }
 
-// AgentRuntimeBearerAuthReference identifies the Secret key holding a harness bearer token.
+// AgentRuntimeBearerAuthReference identifies the Secret key holding a harness
+// v1 bearer token. Preserved verbatim from the harness v1 schema.
 type AgentRuntimeBearerAuthReference struct {
 	// Name is the Secret name.
 	// +kubebuilder:validation:Required
@@ -83,132 +94,366 @@ type AgentRuntimeBearerAuthReference struct {
 	Key string `json:"key"`
 }
 
-// AgentRuntimeClientAuth configures Orka's client authentication to the harness endpoint.
-type AgentRuntimeClientAuth struct {
-	// BearerAuthRef points to the bearer token Secret used for mutating harness endpoints.
-	// The referenced Secret must opt in with label orka.ai/agent-runtime-auth=true,
-	// may set orka.ai/agent-runtime-name=<runtime> to restrict use to one AgentRuntime,
-	// and must set annotation orka.ai/agent-runtime-endpoint=<deployment.endpoint> to bind the token to one endpoint.
+// AgentRuntimeSecretKeyReference identifies one Secret key used for v2 control traffic.
+type AgentRuntimeSecretKeyReference struct {
+	// Name is the Secret name in the AgentRuntime namespace.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
+	Name string `json:"name"`
+
+	// Key is the Secret data key.
 	// +kubebuilder:validation:Required
-	BearerAuthRef AgentRuntimeBearerAuthReference `json:"bearerTokenSecretRef"`
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	Key string `json:"key"`
 }
 
-// AgentRuntimeCapabilitiesSpec describes required capabilities for runtime readiness.
-type AgentRuntimeCapabilitiesSpec struct {
-	// ToolExecutionModes lists tool execution modes the runtime must advertise.
-	// +listType=set
+// AgentRuntimeClientAuth configures controller authentication and per-operation
+// authorization. Exactly one contract-specific shape may be present: the legacy
+// v1 bearer reference, or the v2 controller-bearer plus operation-capability pair.
+// +kubebuilder:validation:XValidation:rule="!(has(self.bearerTokenSecretRef) && (has(self.controllerBearerTokenSecretRef) || has(self.operationCapabilitySecretRef)))",message="legacy v1 and v2 client auth shapes are mutually exclusive"
+// +kubebuilder:validation:XValidation:rule="has(self.controllerBearerTokenSecretRef) == has(self.operationCapabilitySecretRef)",message="v2 client auth requires both controllerBearerTokenSecretRef and operationCapabilitySecretRef"
+// +kubebuilder:validation:XValidation:rule="has(self.bearerTokenSecretRef) || has(self.controllerBearerTokenSecretRef)",message="client auth requires either the v1 or the v2 credential shape"
+type AgentRuntimeClientAuth struct {
+	// BearerAuthRef points to the harness v1 bearer token Secret used for
+	// mutating v1 harness endpoints. The referenced Secret must opt in with
+	// label orka.ai/agent-runtime-auth=true, may set
+	// orka.ai/agent-runtime-name=<runtime> to restrict use to one AgentRuntime,
+	// and must set annotation orka.ai/agent-runtime-endpoint=<deployment.endpoint>
+	// to bind the token to one endpoint.
 	// +optional
-	ToolExecutionModes []AgentRuntimeToolExecutionMode `json:"toolExecutionModes,omitempty"`
+	BearerAuthRef *AgentRuntimeBearerAuthReference `json:"bearerTokenSecretRef,omitempty"`
 
-	// BrokeredToolClasses lists brokered tool classes the runtime must advertise when brokered mode is required.
-	// +listType=set
+	// ControllerBearerTokenSecretRef supplies the controller bearer token used by
+	// authenticated v2 status and mutation endpoints.
 	// +optional
-	BrokeredToolClasses []AgentRuntimeBrokeredToolClass `json:"brokeredToolClasses,omitempty"`
+	ControllerBearerTokenSecretRef *AgentRuntimeSecretKeyReference `json:"controllerBearerTokenSecretRef,omitempty"`
 
-	// SupportsCancel requires the runtime to advertise cancellation support when true.
+	// OperationCapabilitySecretRef supplies the HMAC secret used to bind every
+	// v2 mutation to its exact fence, operation identity, request digest, and expiry.
 	// +optional
-	SupportsCancel *bool `json:"supportsCancel,omitempty"`
+	OperationCapabilitySecretRef *AgentRuntimeSecretKeyReference `json:"operationCapabilitySecretRef,omitempty"`
+}
 
-	// SupportsRuntimeSessions requires the runtime to advertise stable runtime sessions when true.
-	// +optional
-	SupportsRuntimeSessions *bool `json:"supportsRuntimeSessions,omitempty"`
+// AgentRuntimeWorkspaceGovernanceMode describes whether Orka may rely on the
+// runtime for strict workspace guarantees.
+// +kubebuilder:validation:Enum=strict-governed;trusted-non-governed
+type AgentRuntimeWorkspaceGovernanceMode string
 
-	// SupportsContinuation requires the runtime to advertise continuation after Orka-brokered tool results when true.
-	// +optional
-	SupportsContinuation *bool `json:"supportsContinuation,omitempty"`
+const (
+	// AgentRuntimeWorkspaceGovernanceStrict is eligible only for the exact
+	// workspace intent pinned in the immutable runtime profile.
+	AgentRuntimeWorkspaceGovernanceStrict AgentRuntimeWorkspaceGovernanceMode = "strict-governed"
+	// AgentRuntimeWorkspaceGovernanceTrusted marks an explicitly trusted runtime
+	// whose tools and workspace behavior are outside Orka governance.
+	AgentRuntimeWorkspaceGovernanceTrusted AgentRuntimeWorkspaceGovernanceMode = "trusted-non-governed"
+)
 
-	// SupportsArtifacts requires the runtime to advertise artifact/result reference support when true.
-	// +optional
-	SupportsArtifacts *bool `json:"supportsArtifacts,omitempty"`
+// AgentRuntimeWorkspaceGovernanceCapabilities are static claims advertised by
+// /v2/capabilities and exercised by the hostile conformance cycle.
+// +kubebuilder:validation:XValidation:rule="self.mode != 'trusted-non-governed' || self.trusted",message="trusted-non-governed runtimes must be explicitly marked trusted"
+// +kubebuilder:validation:XValidation:rule="self.mode != 'strict-governed' || !self.trusted",message="strict-governed runtimes must not use the trusted non-governed escape hatch"
+// +kubebuilder:validation:XValidation:rule="self.mode != 'strict-governed' || (self.orkaOwnedWorkspaceDeltas && self.promptScopedBrokerAuthorization && self.noDirectSCMPublication && self.orkaOwnedCleanRoomPublication && self.exactInstanceFencing && self.duplicateSafeMutations && self.cancellationSettlement)",message="strict-governed runtimes must claim every strict workspace governance guarantee"
+// +kubebuilder:validation:XValidation:rule="self.mode != 'trusted-non-governed' || (!self.orkaOwnedWorkspaceDeltas && !self.promptScopedBrokerAuthorization && !self.noDirectSCMPublication && !self.orkaOwnedCleanRoomPublication && !self.exactInstanceFencing && !self.duplicateSafeMutations && !self.cancellationSettlement)",message="trusted-non-governed runtimes must not claim strict workspace guarantees"
+type AgentRuntimeWorkspaceGovernanceCapabilities struct {
+	// Mode selects strict Orka governance or an explicit trusted escape hatch.
+	// +kubebuilder:validation:Required
+	Mode AgentRuntimeWorkspaceGovernanceMode `json:"mode"`
+
+	// Trusted must be true only for trusted-non-governed runtimes. Such runtimes
+	// are ineligible for Tasks requesting strict read or write guarantees.
+	Trusted bool `json:"trusted"`
+
+	OrkaOwnedWorkspaceDeltas        bool `json:"orkaOwnedWorkspaceDeltas"`
+	PromptScopedBrokerAuthorization bool `json:"promptScopedBrokerAuthorization"`
+	NoDirectSCMPublication          bool `json:"noDirectSCMPublication"`
+	OrkaOwnedCleanRoomPublication   bool `json:"orkaOwnedCleanRoomPublication"`
+	ExactInstanceFencing            bool `json:"exactInstanceFencing"`
+	DuplicateSafeMutations          bool `json:"duplicateSafeMutations"`
+	CancellationSettlement          bool `json:"cancellationSettlement"`
 }
 
-// AgentRuntimeRegistrySpec defines the desired state of a registered Orka harness runtime.
-type AgentRuntimeRegistrySpec struct {
-	// ContractVersion is the Orka harness contract this runtime must implement.
+// Strict reports whether every strict workspace governance guarantee is claimed.
+func (c AgentRuntimeWorkspaceGovernanceCapabilities) Strict() bool {
+	return c.Mode == AgentRuntimeWorkspaceGovernanceStrict && !c.Trusted &&
+		c.OrkaOwnedWorkspaceDeltas && c.PromptScopedBrokerAuthorization &&
+		c.NoDirectSCMPublication && c.OrkaOwnedCleanRoomPublication &&
+		c.ExactInstanceFencing && c.DuplicateSafeMutations && c.CancellationSettlement
+}
+
+// AgentRuntimeProtocolLimits pins the exact bounded v2 limits expected from the runtime.
+type AgentRuntimeProtocolLimits struct {
+	// +kubebuilder:validation:Minimum=1
+	MaxResidentSessions int32 `json:"maxResidentSessions"`
+	// +kubebuilder:validation:Minimum=1
+	MaxConcurrentPrompts int32 `json:"maxConcurrentPrompts"`
+	// +kubebuilder:validation:Minimum=1
+	MaxRequestBytes int32 `json:"maxRequestBytes"`
+	// +kubebuilder:validation:Minimum=1
+	MaxEventLineBytes int32 `json:"maxEventLineBytes"`
+	// +kubebuilder:validation:Minimum=1
+	MaxTerminalResultBytes int32 `json:"maxTerminalResultBytes"`
+	// +kubebuilder:validation:Minimum=1
+	MaxBufferedEvents int32 `json:"maxBufferedEvents"`
+	// +kubebuilder:validation:Minimum=1
+	MaxUpdateEventsPerSecond int32 `json:"maxUpdateEventsPerSecond"`
+	// +kubebuilder:validation:Minimum=1
+	MinPromptLeaseMillis int64 `json:"minPromptLeaseMillis"`
+	// +kubebuilder:validation:Minimum=1
+	MaxPromptLeaseMillis int64 `json:"maxPromptLeaseMillis"`
+	// +kubebuilder:validation:Minimum=1
+	MaxPendingPermissions int32 `json:"maxPendingPermissions"`
+	// +kubebuilder:validation:Minimum=1
+	MaxWorkspaceDeltaBytes int64 `json:"maxWorkspaceDeltaBytes"`
+}
+
+// AgentRuntimeProfileSpec pins one immutable, single-adapter v2 runtime profile.
+type AgentRuntimeProfileSpec struct {
+	// Digest is the canonical orka.harness.v2 runtime-profile digest.
 	// +kubebuilder:validation:Required
-	// +kubebuilder:default=orka.harness.v1
-	ContractVersion AgentRuntimeContractVersion `json:"contractVersion"`
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	Digest string `json:"digest"`
 
-	// Deployment identifies the runtime endpoint provider.
+	// DigestSchemaVersion identifies the canonical profile digest schema.
 	// +kubebuilder:validation:Required
-	Deployment AgentRuntimeDeploymentSpec `json:"deployment"`
+	// +kubebuilder:validation:Enum=1
+	DigestSchemaVersion int32 `json:"digestSchemaVersion"`
 
-	// ClientAuth configures controller-to-runtime authentication.
+	// ACPProfile is the reviewed ACP profile.
 	// +kubebuilder:validation:Required
-	ClientAuth AgentRuntimeClientAuth `json:"clientAuth"`
+	// +kubebuilder:validation:Enum=acp.v1
+	ACPProfile string `json:"acpProfile"`
+
+	// AdapterName identifies the sole adapter contained by this external profile.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=128
+	AdapterName string `json:"adapterName"`
 
-	// Capabilities declares readiness requirements Orka checks against the runtime.
+	// AdapterDigest pins the adapter/CLI artifact set.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	AdapterDigest string `json:"adapterDigest"`
+
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=128
+	ProviderKind string `json:"providerKind"`
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=256
+	Model string `json:"model"`
+
+	// ModelLimits pins optional reviewed model token capacities.
 	// +optional
-	Capabilities *AgentRuntimeCapabilitiesSpec `json:"capabilities,omitempty"`
+	ModelLimits *ModelTokenLimits `json:"modelLimits,omitempty"`
+
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	AgentConfigurationDigest string `json:"agentConfigurationDigest"`
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	ToolPolicyDigest string `json:"toolPolicyDigest"`
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	ApprovalPolicyDigest string `json:"approvalPolicyDigest"`
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	MCPConfigurationDigest string `json:"mcpConfigurationDigest"`
+
+	// WorkspaceIntent is the one immutable strict intent represented by this profile.
+	// +kubebuilder:validation:Required
+	WorkspaceIntent WorkspaceIntent `json:"workspaceIntent"`
+
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=256
+	ProxyCredentialRole string `json:"proxyCredentialRole"`
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	ProxyCredentialScope string `json:"proxyCredentialScope"`
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=128
+	ResourceClass string `json:"resourceClass"`
 }
 
-// AgentRuntimeObservedCapabilities records the sanitized capability data observed by Orka.
-type AgentRuntimeObservedCapabilities struct {
-	// ProtocolVersion is the runtime's advertised Orka protocol version.
+// AgentRuntimeCapabilitiesSpec pins runtime capability claims for both harness
+// contracts. Variant-specific fields are optional in the shared schema; the
+// contract discriminator CEL on the spec enforces the selected variant's shape.
+type AgentRuntimeCapabilitiesSpec struct {
+	// RuntimeInstanceID is the immutable external supervisor instance expected from
+	// authenticated /v2/status and every conformance response. v2 only.
 	// +optional
-	ProtocolVersion string `json:"protocolVersion,omitempty"`
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	RuntimeInstanceID string `json:"runtimeInstanceID,omitempty"`
 
-	// Transport is the runtime transport, normally http+sse.
+	// Profile is the exact immutable profile accepted by v2 session creation.
 	// +optional
-	Transport string `json:"transport,omitempty"`
+	Profile *AgentRuntimeProfileSpec `json:"profile,omitempty"`
 
-	// RuntimeName is the runtime name advertised by /v1/capabilities.
+	// Limits must exactly match /v2/capabilities. v2 only.
 	// +optional
-	RuntimeName string `json:"runtimeName,omitempty"`
+	Limits *AgentRuntimeProtocolLimits `json:"limits,omitempty"`
 
-	// RuntimeVersion is the runtime version advertised by /v1/capabilities.
+	// SupportsDrain must exactly match the static v2 capability claim.
 	// +optional
-	RuntimeVersion string `json:"runtimeVersion,omitempty"`
+	SupportsDrain bool `json:"supportsDrain,omitempty"`
+
+	// SupportsPublicationFinalization must exactly match the static v2 capability claim.
+	// +optional
+	SupportsPublicationFinalization bool `json:"supportsPublicationFinalization,omitempty"`
 
-	// ProviderKind is the provider kind advertised by /v1/capabilities.
+	// WorkspaceGovernance must exactly match the static v2 capability claim.
 	// +optional
-	ProviderKind string `json:"providerKind,omitempty"`
+	WorkspaceGovernance *AgentRuntimeWorkspaceGovernanceCapabilities `json:"workspaceGovernance,omitempty"`
 
-	// ToolExecutionModes are the tool modes advertised by /v1/capabilities.
+	// ToolExecutionModes lists the harness v1 tool execution modes supported by
+	// the runtime. v1 only; historically optional.
 	// +listType=set
 	// +optional
 	ToolExecutionModes []AgentRuntimeToolExecutionMode `json:"toolExecutionModes,omitempty"`
 
-	// BrokeredToolClasses are the brokered tool classes advertised by /v1/capabilities.
+	// BrokeredToolClasses lists the harness v1 brokered tool classes supported
+	// by the runtime. v1 only; historically optional.
 	// +listType=set
 	// +optional
 	BrokeredToolClasses []AgentRuntimeBrokeredToolClass `json:"brokeredToolClasses,omitempty"`
 
-	// SupportsCancel reports whether the runtime advertises cancellation support.
+	// SupportsCancel declares harness v1 turn cancellation support. v1 only.
 	// +optional
-	SupportsCancel bool `json:"supportsCancel,omitempty"`
+	SupportsCancel *bool `json:"supportsCancel,omitempty"`
 
-	// SupportsRuntimeSessions reports whether the runtime advertises runtime-session support.
+	// SupportsRuntimeSessions declares harness v1 runtime session support. v1 only.
 	// +optional
-	SupportsRuntimeSessions bool `json:"supportsRuntimeSessions,omitempty"`
+	SupportsRuntimeSessions *bool `json:"supportsRuntimeSessions,omitempty"`
 
-	// SupportsContinuation reports whether the runtime advertises continuation support.
+	// SupportsContinuation declares harness v1 brokered continuation support. v1 only.
 	// +optional
-	SupportsContinuation bool `json:"supportsContinuation,omitempty"`
+	SupportsContinuation *bool `json:"supportsContinuation,omitempty"`
 
-	// SupportsArtifacts reports whether the runtime advertises artifact/result reference support.
+	// SupportsArtifacts declares harness v1 artifact support. v1 only.
 	// +optional
-	SupportsArtifacts bool `json:"supportsArtifacts,omitempty"`
+	SupportsArtifacts *bool `json:"supportsArtifacts,omitempty"`
+}
 
-	// SupportsSuspend reports whether the runtime advertises suspend support.
-	// +optional
-	SupportsSuspend bool `json:"supportsSuspend,omitempty"`
+// SupportsStrictWorkspaceIntent returns true only for the exact intent pinned
+// by a fully governed v2 profile. Trusted/non-governed and v1 runtimes always
+// return false.
+func (c AgentRuntimeCapabilitiesSpec) SupportsStrictWorkspaceIntent(intent WorkspaceIntent) bool {
+	if c.WorkspaceGovernance == nil || c.Profile == nil {
+		return false
+	}
+	return c.WorkspaceGovernance.Strict() && c.Profile.WorkspaceIntent == intent &&
+		(intent != WorkspaceIntentWrite || c.SupportsPublicationFinalization)
+}
 
-	// SupportsWorkspaceSnapshot reports whether the runtime advertises workspace snapshots.
+// ValidateStrictWorkspaceIntent rejects trusted/non-governed runtimes and exact-profile intent mismatches.
+func (c AgentRuntimeCapabilitiesSpec) ValidateStrictWorkspaceIntent(intent WorkspaceIntent) error {
+	if intent != WorkspaceIntentRead && intent != WorkspaceIntentWrite {
+		return fmt.Errorf("unsupported strict workspace intent %q", intent)
+	}
+	if c.WorkspaceGovernance == nil || c.Profile == nil {
+		return fmt.Errorf("AgentRuntime does not pin the v2 workspace governance capabilities required for strict %q workspace intent", intent)
+	}
+	if c.WorkspaceGovernance.Mode == AgentRuntimeWorkspaceGovernanceTrusted {
+		return fmt.Errorf("trusted-non-governed AgentRuntime cannot satisfy strict %q workspace intent", intent)
+	}
+	if !c.WorkspaceGovernance.Strict() {
+		return fmt.Errorf("AgentRuntime does not provide all strict workspace governance guarantees")
+	}
+	if c.Profile.WorkspaceIntent != intent {
+		return fmt.Errorf("AgentRuntime profile is pinned to workspace intent %q, not %q", c.Profile.WorkspaceIntent, intent)
+	}
+	if intent == WorkspaceIntentWrite && !c.SupportsPublicationFinalization {
+		return fmt.Errorf("AgentRuntime does not support controller-owned RuntimeSession publication finalization required for write workspaces")
+	}
+	return nil
+}
+
+// AgentRuntimeRegistrySpec defines the desired state of a registered Orka harness runtime.
+// The dual schema has no contractVersion default: omission is tolerated only for
+// stored objects awaiting the one-time bridge classification and is never
+// interpreted as either protocol. Fail-closed admission requires an explicit
+// value for new registrations.
+// +kubebuilder:validation:XValidation:rule="!has(oldSelf.contractVersion) || (has(self.contractVersion) && self.contractVersion == oldSelf.contractVersion)",message="contractVersion is immutable once set"
+// +kubebuilder:validation:XValidation:rule="!has(self.contractVersion) || self.contractVersion != 'orka.harness.v1' || (has(self.clientAuth.bearerTokenSecretRef) && !has(self.clientAuth.controllerBearerTokenSecretRef) && !has(self.clientAuth.operationCapabilitySecretRef))",message="orka.harness.v1 requires the legacy bearerTokenSecretRef client auth shape"
+// +kubebuilder:validation:XValidation:rule="!has(self.contractVersion) || self.contractVersion != 'orka.harness.v1' || !has(self.capabilities) || (!has(self.capabilities.runtimeInstanceID) && !has(self.capabilities.profile) && !has(self.capabilities.limits) && !has(self.capabilities.workspaceGovernance) && !has(self.capabilities.supportsDrain) && !has(self.capabilities.supportsPublicationFinalization))",message="orka.harness.v1 capabilities must not carry v2 capability fields"
+// +kubebuilder:validation:XValidation:rule="!has(self.contractVersion) || self.contractVersion != 'orka.harness.v2' || (has(self.clientAuth.controllerBearerTokenSecretRef) && has(self.clientAuth.operationCapabilitySecretRef) && !has(self.clientAuth.bearerTokenSecretRef))",message="orka.harness.v2 requires the v2 controller bearer and operation capability client auth shape"
+// +kubebuilder:validation:XValidation:rule="!has(self.contractVersion) || self.contractVersion != 'orka.harness.v2' || (has(self.capabilities) && has(self.capabilities.runtimeInstanceID) && has(self.capabilities.profile) && has(self.capabilities.limits) && has(self.capabilities.workspaceGovernance))",message="orka.harness.v2 requires pinned instance, profile, limits, and workspace governance capabilities"
+// +kubebuilder:validation:XValidation:rule="!has(self.contractVersion) || self.contractVersion != 'orka.harness.v2' || !has(self.capabilities) || (!has(self.capabilities.toolExecutionModes) && !has(self.capabilities.brokeredToolClasses) && !has(self.capabilities.supportsCancel) && !has(self.capabilities.supportsRuntimeSessions) && !has(self.capabilities.supportsContinuation) && !has(self.capabilities.supportsArtifacts))",message="orka.harness.v2 capabilities must not carry v1 capability fields"
+type AgentRuntimeRegistrySpec struct {
+	// ContractVersion is the Orka harness contract this runtime must implement.
+	// It is immutable once set. Required for new registrations through
+	// fail-closed admission; the bridge schema tolerates omission only on
+	// unchanged stored objects while execution admission is closed.
 	// +optional
-	SupportsWorkspaceSnapshot bool `json:"supportsWorkspaceSnapshot,omitempty"`
+	ContractVersion *AgentRuntimeContractVersion `json:"contractVersion,omitempty"`
+
+	// Deployment identifies the runtime endpoint provider.
+	// +kubebuilder:validation:Required
+	Deployment AgentRuntimeDeploymentSpec `json:"deployment"`
+
+	// ClientAuth configures controller authentication and mutation authorization.
+	// +kubebuilder:validation:Required
+	ClientAuth AgentRuntimeClientAuth `json:"clientAuth"`
 
-	// MaxConcurrentTurns is the advertised concurrency ceiling.
+	// Capabilities pins the runtime capability claims. Required with the exact
+	// instance/profile/limits/governance shape for orka.harness.v2; historically
+	// optional for orka.harness.v1.
 	// +optional
-	MaxConcurrentTurns int `json:"maxConcurrentTurns,omitempty"`
+	Capabilities *AgentRuntimeCapabilitiesSpec `json:"capabilities,omitempty"`
+}
 
-	// MaxTurnSeconds is the advertised per-turn duration ceiling.
+// AgentRuntimeObservedCapabilities records sanitized conformance data for both
+// contracts. Variant-specific observed fields are written only by the matching
+// probe implementation.
+type AgentRuntimeObservedCapabilities struct {
+	ProtocolVersion            string `json:"protocolVersion,omitempty"`
+	Transport                  string `json:"transport,omitempty"`
+	ACPVersion                 string `json:"acpVersion,omitempty"`
+	RuntimeInstanceID          string `json:"runtimeInstanceID,omitempty"`
+	SupervisorBootID           string `json:"supervisorBootID,omitempty"`
+	ControllerEpoch            int64  `json:"controllerEpoch,omitempty"`
+	RuntimePoolUID             string `json:"runtimePoolUID,omitempty"`
+	RuntimePoolGeneration      int64  `json:"runtimePoolGeneration,omitempty"`
+	RuntimeProfileDigest       string `json:"runtimeProfileDigest,omitempty"`
+	ProfileDigestSchemaVersion int32  `json:"profileDigestSchemaVersion,omitempty"`
+	AdapterName                string `json:"adapterName,omitempty"`
+	AdapterDigest              string `json:"adapterDigest,omitempty"`
+	ProviderKind               string `json:"providerKind,omitempty"`
+	Model                      string `json:"model,omitempty"`
+	// Limits records the v2 protocol bounds. It is absent for harness v1.
+	// +optional
+	Limits                          *AgentRuntimeProtocolLimits `json:"limits,omitempty"`
+	SupportsDrain                   bool                        `json:"supportsDrain,omitempty"`
+	SupportsPublicationFinalization bool                        `json:"supportsPublicationFinalization,omitempty"`
+	// WorkspaceGovernance records the v2 workspace guarantees. It is absent for harness v1.
 	// +optional
-	MaxTurnSeconds int `json:"maxTurnSeconds,omitempty"`
+	WorkspaceGovernance *AgentRuntimeWorkspaceGovernanceCapabilities `json:"workspaceGovernance,omitempty"`
+	Lifecycle           string                                       `json:"lifecycle,omitempty"`
+
+	// Harness v1 observed fields, written only by the v1 conformance probe.
 
-	// MaxOutputBytes is the advertised maximum output payload size.
+	RuntimeName    string `json:"runtimeName,omitempty"`
+	RuntimeVersion string `json:"runtimeVersion,omitempty"`
+
+	// +listType=set
 	// +optional
-	MaxOutputBytes int64 `json:"maxOutputBytes,omitempty"`
+	ToolExecutionModes []AgentRuntimeToolExecutionMode `json:"toolExecutionModes,omitempty"`
+	// +listType=set
+	// +optional
+	BrokeredToolClasses []AgentRuntimeBrokeredToolClass `json:"brokeredToolClasses,omitempty"`
+
+	SupportsCancel            bool  `json:"supportsCancel,omitempty"`
+	SupportsRuntimeSessions   bool  `json:"supportsRuntimeSessions,omitempty"`
+	SupportsContinuation      bool  `json:"supportsContinuation,omitempty"`
+	SupportsArtifacts         bool  `json:"supportsArtifacts,omitempty"`
+	SupportsSuspend           bool  `json:"supportsSuspend,omitempty"`
+	SupportsWorkspaceSnapshot bool  `json:"supportsWorkspaceSnapshot,omitempty"`
+	MaxConcurrentTurns        int   `json:"maxConcurrentTurns,omitempty"`
+	MaxTurnSeconds            int   `json:"maxTurnSeconds,omitempty"`
+	MaxOutputBytes            int64 `json:"maxOutputBytes,omitempty"`
 }
 
 // AgentRuntimeStatus defines the observed state of an AgentRuntime.
@@ -229,9 +474,20 @@ type AgentRuntimeStatus struct {
 	// +optional
 	LastValidated *metav1.Time `json:"lastValidated,omitempty"`
 
-	// ObservedAuthRefResourceVersion is the resourceVersion of the bearer auth Secret
-	// used for the last readiness probe. It is non-secret metadata used to decide
-	// when token rotation requires a fresh authenticated conformance turn.
+	// ObservedControllerAuthRefResourceVersion is the bearer Secret version used
+	// by the last successful or failed authenticated conformance probe.
+	// +optional
+	ObservedControllerAuthRefResourceVersion string `json:"observedControllerAuthRefResourceVersion,omitempty"`
+
+	// ObservedOperationCapabilityRefResourceVersion is the HMAC Secret version used
+	// by the last mutation conformance probe.
+	// +optional
+	ObservedOperationCapabilityRefResourceVersion string `json:"observedOperationCapabilityRefResourceVersion,omitempty"`
+
+	// ObservedAuthRefResourceVersion is the resourceVersion of the harness v1
+	// bearer auth Secret used for the last v1 readiness probe. It is non-secret
+	// metadata used to decide when token rotation requires a fresh authenticated
+	// conformance turn. v2 probes use the two v2 auth resource-version fields.
 	// +optional
 	ObservedAuthRefResourceVersion string `json:"observedAuthRefResourceVersion,omitempty"`
 
@@ -252,10 +508,10 @@ type AgentRuntimeStatus struct {
 // +kubebuilder:printcolumn:name="Ready",type=boolean,JSONPath=`.status.ready`
 // +kubebuilder:printcolumn:name="Contract",type=string,JSONPath=`.spec.contractVersion`
 // +kubebuilder:printcolumn:name="Mode",type=string,JSONPath=`.spec.deployment.mode`
-// +kubebuilder:printcolumn:name="Runtime",type=string,JSONPath=`.status.observedCapabilities.runtimeName`
+// +kubebuilder:printcolumn:name="Instance",type=string,JSONPath=`.status.observedCapabilities.runtimeInstanceID`
 // +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
 
-// AgentRuntime is the Schema for registered Orka harness runtimes.
+// AgentRuntime is the Schema for registered external Orka harness runtimes.
 type AgentRuntime struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
@@ -264,6 +520,16 @@ type AgentRuntime struct {
 	Status AgentRuntimeStatus       `json:"status,omitempty"`
 }
 
+// RegisteredContractVersion returns the explicit contract selector, or empty
+// when the registration is still unclassified. Callers must treat empty as
+// neither protocol and fail closed.
+func (in *AgentRuntime) RegisteredContractVersion() AgentRuntimeContractVersion {
+	if in == nil || in.Spec.ContractVersion == nil {
+		return ""
+	}
+	return *in.Spec.ContractVersion
+}
+
 // +kubebuilder:object:root=true
 
 // AgentRuntimeList contains a list of AgentRuntime.
diff --git a/api/v1alpha1/agent_runtime_types_test.go b/api/v1alpha1/agent_runtime_types_test.go
index 7e6b0ea18..85dd0fb4f 100644
--- a/api/v1alpha1/agent_runtime_types_test.go
+++ b/api/v1alpha1/agent_runtime_types_test.go
@@ -7,6 +7,11 @@ MIT License - see LICENSE file for details.
 package v1alpha1
 
 import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	goruntime "runtime"
+	"strings"
 	"testing"
 
 	corev1 "k8s.io/api/core/v1"
@@ -16,6 +21,10 @@ const (
 	testExecutionRuntimeClassGVisor = "gvisor"
 	testExecutionRuntimeClassKata   = "kata-qemu"
 	testExecutionNodeLabelKey       = "sandbox-runtime"
+	testAgentRuntimeControllerKey   = "controller-token"
+	testAgentRuntimeCapabilityKey   = "capability-secret"
+	testAgentRuntimeInstanceID      = "runtime-instance-1"
+	testAgentRuntimeAuthSecretName  = "runtime-auth"
 )
 
 func TestTaskTypeAgentConstant(t *testing.T) {
@@ -63,6 +72,41 @@ func TestAgentRuntimeTypeConstants(t *testing.T) {
 	}
 }
 
+func readTaskTypesSource(t *testing.T) []byte {
+	t.Helper()
+	_, testFile, _, ok := goruntime.Caller(0)
+	if !ok {
+		t.Fatal("resolve test source path")
+	}
+	paths := []string{filepath.Join(filepath.Dir(testFile), "task_types.go"), "task_types.go"}
+	var lastErr error
+	for _, path := range paths {
+		source, err := os.ReadFile(path)
+		if err == nil {
+			return source
+		}
+		lastErr = err
+	}
+	t.Fatalf("read task_types.go: %v", lastErr)
+	return nil
+}
+
+func TestAgentRuntimeTypeKubebuilderEnumIncludesSupportedBuiltIns(t *testing.T) {
+	source := readTaskTypesSource(t)
+	const marker = "// +kubebuilder:validation:Enum=claude;codex;copilot"
+	if !strings.Contains(string(source), marker) {
+		t.Fatalf("AgentRuntimeType marker does not include all supported built-ins: want %q", marker)
+	}
+}
+
+func TestAgentPromptImmutabilityMarkerHandlesOmittedPrompt(t *testing.T) {
+	source := readTaskTypesSource(t)
+	const marker = "has(self.prompt) == has(oldSelf.prompt)"
+	if !strings.Contains(string(source), marker) {
+		t.Fatalf("agent prompt immutability marker is not presence-aware: want %q", marker)
+	}
+}
+
 func TestAgentRuntimeSpecFields(t *testing.T) {
 	maxTurns := int32(10)
 	allowBash := true
@@ -71,10 +115,6 @@ func TestAgentRuntimeSpecFields(t *testing.T) {
 		AllowedTools:    []string{"read", "write"},
 		DisallowedTools: []string{"delete"},
 		AllowBash:       &allowBash,
-		Workspace: &WorkspaceConfig{
-			GitRepo: "https://github.com/example/repo",
-			Branch:  "main",
-		},
 	}
 
 	if *spec.MaxTurns != 10 {
@@ -92,12 +132,6 @@ func TestAgentRuntimeSpecFields(t *testing.T) {
 	if *spec.AllowBash != true {
 		t.Errorf("AllowBash = %v, want true", *spec.AllowBash)
 	}
-	if spec.Workspace == nil {
-		t.Fatal("Workspace should not be nil")
-	}
-	if spec.Workspace.GitRepo != "https://github.com/example/repo" {
-		t.Errorf("Workspace.GitRepo = %q, want %q", spec.Workspace.GitRepo, "https://github.com/example/repo")
-	}
 }
 
 func TestAgentRuntimeSpecDefaults(t *testing.T) {
@@ -115,19 +149,19 @@ func TestAgentRuntimeSpecDefaults(t *testing.T) {
 	if spec.AllowBash != nil {
 		t.Errorf("AllowBash should be nil by default, got %v", spec.AllowBash)
 	}
-	if spec.Workspace != nil {
-		t.Errorf("Workspace should be nil by default, got %v", spec.Workspace)
-	}
 }
 
 func TestWorkspaceConfigFields(t *testing.T) {
-	secretRef := &corev1.LocalObjectReference{Name: "git-secret"}
+	readRef := &WorkspaceCredentialReference{Name: "git-read"}
+	publicationRef := &WorkspaceCredentialReference{Name: "git-publish"}
 	ws := WorkspaceConfig{
-		GitRepo:      "https://github.com/example/repo",
-		Branch:       "develop",
-		Ref:          "abc123",
-		GitSecretRef: secretRef,
-		SubPath:      "src/app",
+		GitRepo:                  "https://github.com/example/repo",
+		Branch:                   "develop",
+		Ref:                      "abc123",
+		ReadCredentialRef:        readRef,
+		PublicationGitRepo:       "https://github.com/example/repo-fork",
+		PublicationCredentialRef: publicationRef,
+		SubPath:                  "src/app",
 	}
 
 	if ws.GitRepo != "https://github.com/example/repo" {
@@ -139,8 +173,14 @@ func TestWorkspaceConfigFields(t *testing.T) {
 	if ws.Ref != "abc123" {
 		t.Errorf("Ref = %q, want %q", ws.Ref, "abc123")
 	}
-	if ws.GitSecretRef == nil || ws.GitSecretRef.Name != "git-secret" {
-		t.Errorf("GitSecretRef.Name = %v, want %q", ws.GitSecretRef, "git-secret")
+	if ws.ReadCredentialRef == nil || ws.ReadCredentialRef.Name != "git-read" {
+		t.Errorf("ReadCredentialRef.Name = %v, want %q", ws.ReadCredentialRef, "git-read")
+	}
+	if ws.PublicationCredentialRef == nil || ws.PublicationCredentialRef.Name != "git-publish" {
+		t.Errorf("PublicationCredentialRef.Name = %v, want %q", ws.PublicationCredentialRef, "git-publish")
+	}
+	if ws.PublicationGitRepo != "https://github.com/example/repo-fork" {
+		t.Errorf("PublicationGitRepo = %q, want %q", ws.PublicationGitRepo, "https://github.com/example/repo-fork")
 	}
 	if ws.SubPath != "src/app" {
 		t.Errorf("SubPath = %q, want %q", ws.SubPath, "src/app")
@@ -159,8 +199,11 @@ func TestWorkspaceConfigDefaults(t *testing.T) {
 	if ws.Ref != "" {
 		t.Errorf("Ref should be empty by default, got %q", ws.Ref)
 	}
-	if ws.GitSecretRef != nil {
-		t.Errorf("GitSecretRef should be nil by default, got %v", ws.GitSecretRef)
+	if ws.ReadCredentialRef != nil {
+		t.Errorf("ReadCredentialRef should be nil by default, got %v", ws.ReadCredentialRef)
+	}
+	if ws.PublicationCredentialRef != nil {
+		t.Errorf("PublicationCredentialRef should be nil by default, got %v", ws.PublicationCredentialRef)
 	}
 	if ws.SubPath != "" {
 		t.Errorf("SubPath should be empty by default, got %q", ws.SubPath)
@@ -195,6 +238,38 @@ func TestAgentCLIRuntimeFields(t *testing.T) {
 	}
 }
 
+func TestAgentCLIRuntimeJSONPreservesExplicitEmptyAllowedTools(t *testing.T) {
+	omitted, err := json.Marshal(AgentCLIRuntime{Type: AgentRuntimeOpencode})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(string(omitted), `"defaultAllowedTools"`) {
+		t.Fatalf("omitted runtime JSON = %s, want no defaultAllowedTools field", omitted)
+	}
+
+	explicit, err := json.Marshal(AgentCLIRuntime{
+		Type:                   AgentRuntimeOpencode,
+		DefaultAllowedTools:    []string{},
+		DefaultReasoningEffort: "high",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(explicit), `"defaultAllowedTools":[]`) {
+		t.Fatalf("explicit empty runtime JSON = %s, want defaultAllowedTools:[]", explicit)
+	}
+	var roundTrip AgentCLIRuntime
+	if err := json.Unmarshal(explicit, &roundTrip); err != nil {
+		t.Fatal(err)
+	}
+	if roundTrip.DefaultAllowedTools == nil || len(roundTrip.DefaultAllowedTools) != 0 {
+		t.Fatalf("round-trip defaultAllowedTools = %#v, want explicit empty slice", roundTrip.DefaultAllowedTools)
+	}
+	if roundTrip.DefaultReasoningEffort != "high" {
+		t.Fatalf("round-trip defaultReasoningEffort = %q, want high", roundTrip.DefaultReasoningEffort)
+	}
+}
+
 func TestAgentCLIRuntimeOnAgentSpec(t *testing.T) {
 	maxTurns := int32(25)
 	allowBash := false
@@ -231,10 +306,10 @@ func TestTaskSpecAgentRuntimeField(t *testing.T) {
 		AgentRuntime: &AgentRuntimeSpec{
 			MaxTurns:     &maxTurns,
 			AllowedTools: []string{"bash", "read"},
-			Workspace: &WorkspaceConfig{
-				GitRepo: "https://github.com/example/repo",
-				Branch:  "main",
-			},
+		},
+		Workspace: &WorkspaceConfig{
+			GitRepo: "https://github.com/example/repo",
+			Branch:  "main",
 		},
 	}
 
@@ -247,11 +322,11 @@ func TestTaskSpecAgentRuntimeField(t *testing.T) {
 	if *task.AgentRuntime.MaxTurns != 15 {
 		t.Errorf("AgentRuntime.MaxTurns = %d, want 15", *task.AgentRuntime.MaxTurns)
 	}
-	if task.AgentRuntime.Workspace == nil {
-		t.Fatal("AgentRuntime.Workspace should not be nil")
+	if task.Workspace == nil {
+		t.Fatal("Task.Workspace should not be nil")
 	}
-	if task.AgentRuntime.Workspace.Branch != "main" {
-		t.Errorf("Workspace.Branch = %q, want %q", task.AgentRuntime.Workspace.Branch, "main")
+	if task.Workspace.Branch != "main" {
+		t.Errorf("Workspace.Branch = %q, want %q", task.Workspace.Branch, "main")
 	}
 }
 
@@ -378,40 +453,197 @@ func TestAgentRuntimeReferenceOnAgentCLI(t *testing.T) {
 }
 
 func TestAgentRuntimeCRDSpecFields(t *testing.T) {
-	supportsCancel := true
-	supportsContinuation := true
+	strict := AgentRuntimeWorkspaceGovernanceCapabilities{
+		Mode:                            AgentRuntimeWorkspaceGovernanceStrict,
+		OrkaOwnedWorkspaceDeltas:        true,
+		PromptScopedBrokerAuthorization: true,
+		NoDirectSCMPublication:          true,
+		OrkaOwnedCleanRoomPublication:   true,
+		ExactInstanceFencing:            true,
+		DuplicateSafeMutations:          true,
+		CancellationSettlement:          true,
+	}
 	runtime := AgentRuntime{
 		Spec: AgentRuntimeRegistrySpec{
-			ContractVersion: AgentRuntimeContractHarnessV1,
+			ContractVersion: new(AgentRuntimeContractHarnessV2),
 			Deployment: AgentRuntimeDeploymentSpec{
 				Mode:     AgentRuntimeDeploymentModeExternalEndpoint,
-				Endpoint: "http://fibey-agentkit.default.svc.cluster.local:8080",
+				Endpoint: "https://runtime.example.com",
+			},
+			ClientAuth: AgentRuntimeClientAuth{
+				ControllerBearerTokenSecretRef: &AgentRuntimeSecretKeyReference{Name: testAgentRuntimeAuthSecretName, Key: testAgentRuntimeControllerKey},
+				OperationCapabilitySecretRef:   &AgentRuntimeSecretKeyReference{Name: testAgentRuntimeAuthSecretName, Key: testAgentRuntimeCapabilityKey},
 			},
-			ClientAuth: AgentRuntimeClientAuth{BearerAuthRef: AgentRuntimeBearerAuthReference{
-				Name: "fibey-agentkit-harness-token",
-				Key:  "token",
-			}},
 			Capabilities: &AgentRuntimeCapabilitiesSpec{
-				ToolExecutionModes:   []AgentRuntimeToolExecutionMode{AgentRuntimeToolExecutionModeObserved, AgentRuntimeToolExecutionModeBrokered},
-				BrokeredToolClasses:  []AgentRuntimeBrokeredToolClass{AgentRuntimeBrokeredToolClassRead},
-				SupportsCancel:       &supportsCancel,
-				SupportsContinuation: &supportsContinuation,
+				RuntimeInstanceID: testAgentRuntimeInstanceID,
+				Profile: &AgentRuntimeProfileSpec{
+					Digest: "sha256:" + strings.Repeat("a", 64), DigestSchemaVersion: 1,
+					ACPProfile: "acp.v1", AdapterName: "codex", AdapterDigest: "sha256:" + strings.Repeat("b", 64),
+					ProviderKind: "codex", Model: "gpt-test",
+					AgentConfigurationDigest: "sha256:" + strings.Repeat("c", 64),
+					ToolPolicyDigest:         "sha256:" + strings.Repeat("d", 64), ApprovalPolicyDigest: "sha256:" + strings.Repeat("e", 64),
+					MCPConfigurationDigest: "sha256:" + strings.Repeat("f", 64), WorkspaceIntent: WorkspaceIntentRead,
+					ProxyCredentialRole: "provider-proxy", ProxyCredentialScope: "session-and-prompt", ResourceClass: "standard",
+				},
+				Limits: &AgentRuntimeProtocolLimits{
+					MaxResidentSessions: 10, MaxConcurrentPrompts: 4, MaxRequestBytes: 1 << 20,
+					MaxEventLineBytes: 1 << 20, MaxTerminalResultBytes: 1 << 20, MaxBufferedEvents: 256,
+					MaxUpdateEventsPerSecond: 100, MinPromptLeaseMillis: 5000, MaxPromptLeaseMillis: 120000,
+					MaxPendingPermissions: 32, MaxWorkspaceDeltaBytes: 512 << 20,
+				},
+				SupportsDrain:       true,
+				WorkspaceGovernance: &strict,
 			},
 		},
 	}
-	if runtime.Spec.ContractVersion != AgentRuntimeContractHarnessV1 {
-		t.Fatalf("ContractVersion = %q", runtime.Spec.ContractVersion)
+	if runtime.RegisteredContractVersion() != AgentRuntimeContractHarnessV2 {
+		t.Fatalf("ContractVersion = %q", runtime.RegisteredContractVersion())
+	}
+	if runtime.Spec.ClientAuth.ControllerBearerTokenSecretRef.Key != testAgentRuntimeControllerKey ||
+		runtime.Spec.ClientAuth.OperationCapabilitySecretRef.Key != testAgentRuntimeCapabilityKey {
+		t.Fatalf("ClientAuth = %#v", runtime.Spec.ClientAuth)
+	}
+	if !runtime.Spec.Capabilities.SupportsStrictWorkspaceIntent(WorkspaceIntentRead) {
+		t.Fatal("strict read profile was not eligible for strict read intent")
+	}
+	if runtime.Spec.Capabilities.SupportsStrictWorkspaceIntent(WorkspaceIntentWrite) {
+		t.Fatal("exact read profile was incorrectly eligible for strict write intent")
+	}
+}
+
+func TestAgentRuntimeWriteIntentRequiresPublicationFinalization(t *testing.T) {
+	capabilities := AgentRuntimeCapabilitiesSpec{
+		Profile: &AgentRuntimeProfileSpec{WorkspaceIntent: WorkspaceIntentWrite},
+		WorkspaceGovernance: &AgentRuntimeWorkspaceGovernanceCapabilities{
+			Mode: AgentRuntimeWorkspaceGovernanceStrict, OrkaOwnedWorkspaceDeltas: true, PromptScopedBrokerAuthorization: true,
+			NoDirectSCMPublication: true, OrkaOwnedCleanRoomPublication: true, ExactInstanceFencing: true,
+			DuplicateSafeMutations: true, CancellationSettlement: true,
+		},
+	}
+	if capabilities.SupportsStrictWorkspaceIntent(WorkspaceIntentWrite) {
+		t.Fatal("write runtime without publication finalization was strict-write eligible")
+	}
+	if err := capabilities.ValidateStrictWorkspaceIntent(WorkspaceIntentWrite); err == nil || !strings.Contains(err.Error(), "publication finalization") {
+		t.Fatalf("ValidateStrictWorkspaceIntent(write) = %v, want publication-finalization rejection", err)
+	}
+	capabilities.SupportsPublicationFinalization = true
+	if !capabilities.SupportsStrictWorkspaceIntent(WorkspaceIntentWrite) {
+		t.Fatal("write runtime with publication finalization was not strict-write eligible")
+	}
+	if err := capabilities.ValidateStrictWorkspaceIntent(WorkspaceIntentWrite); err != nil {
+		t.Fatalf("ValidateStrictWorkspaceIntent(write) = %v", err)
+	}
+}
+
+func TestAgentRuntimeTrustedNonGovernedIsNeverStrictEligible(t *testing.T) {
+	capabilities := AgentRuntimeCapabilitiesSpec{
+		Profile: &AgentRuntimeProfileSpec{WorkspaceIntent: WorkspaceIntentRead},
+		WorkspaceGovernance: &AgentRuntimeWorkspaceGovernanceCapabilities{
+			Mode:    AgentRuntimeWorkspaceGovernanceTrusted,
+			Trusted: true,
+		},
+	}
+	if capabilities.SupportsStrictWorkspaceIntent(WorkspaceIntentRead) || capabilities.SupportsStrictWorkspaceIntent(WorkspaceIntentWrite) {
+		t.Fatal("trusted non-governed runtime was eligible for strict workspace intent")
+	}
+	for _, intent := range []WorkspaceIntent{WorkspaceIntentRead, WorkspaceIntentWrite} {
+		if err := capabilities.ValidateStrictWorkspaceIntent(intent); err == nil || !strings.Contains(err.Error(), "trusted-non-governed") {
+			t.Fatalf("ValidateStrictWorkspaceIntent(%q) = %v, want explicit trusted rejection", intent, err)
+		}
 	}
-	if runtime.Spec.Deployment.Mode != AgentRuntimeDeploymentModeExternalEndpoint {
-		t.Fatalf("Deployment.Mode = %q", runtime.Spec.Deployment.Mode)
+}
+
+func TestAgentRuntimeV1CapabilityFieldsAreAbsentFromSerializedCRDSurface(t *testing.T) {
+	digest := func(char string) string { return "sha256:" + strings.Repeat(char, 64) }
+	profile := AgentRuntimeProfileSpec{
+		Digest: digest("a"), DigestSchemaVersion: 1, ACPProfile: "acp.v1", AdapterName: "codex", AdapterDigest: digest("b"),
+		ProviderKind: "codex", Model: "gpt-test", AgentConfigurationDigest: digest("c"), ToolPolicyDigest: digest("d"),
+		ApprovalPolicyDigest: digest("e"), MCPConfigurationDigest: digest("f"), WorkspaceIntent: WorkspaceIntentRead,
+		ProxyCredentialRole: "provider-proxy", ProxyCredentialScope: "model:gpt-test", ResourceClass: "standard",
+	}
+	claims := AgentRuntimeWorkspaceGovernanceCapabilities{
+		Mode: AgentRuntimeWorkspaceGovernanceStrict, OrkaOwnedWorkspaceDeltas: true, PromptScopedBrokerAuthorization: true,
+		NoDirectSCMPublication: true, OrkaOwnedCleanRoomPublication: true, ExactInstanceFencing: true,
+		DuplicateSafeMutations: true, CancellationSettlement: true,
+	}
+	limits := AgentRuntimeProtocolLimits{
+		MaxResidentSessions: 10, MaxConcurrentPrompts: 4, MaxRequestBytes: 1 << 20, MaxEventLineBytes: 1 << 20,
+		MaxTerminalResultBytes: 1 << 20, MaxBufferedEvents: 256, MaxUpdateEventsPerSecond: 100,
+		MinPromptLeaseMillis: 5000, MaxPromptLeaseMillis: 120000, MaxPendingPermissions: 32, MaxWorkspaceDeltaBytes: 100 << 20,
+	}
+	spec := AgentRuntimeRegistrySpec{
+		ContractVersion: new(AgentRuntimeContractHarnessV2),
+		ClientAuth: AgentRuntimeClientAuth{
+			ControllerBearerTokenSecretRef: &AgentRuntimeSecretKeyReference{Name: testAgentRuntimeAuthSecretName, Key: testAgentRuntimeControllerKey},
+			OperationCapabilitySecretRef:   &AgentRuntimeSecretKeyReference{Name: testAgentRuntimeAuthSecretName, Key: testAgentRuntimeCapabilityKey},
+		},
+		Capabilities: &AgentRuntimeCapabilitiesSpec{RuntimeInstanceID: testAgentRuntimeInstanceID, Profile: &profile, Limits: &limits, SupportsDrain: true, WorkspaceGovernance: &claims},
 	}
-	if runtime.Spec.ClientAuth.BearerAuthRef.Name != "fibey-agentkit-harness-token" {
-		t.Fatalf("BearerAuthRef.Name = %q", runtime.Spec.ClientAuth.BearerAuthRef.Name)
+	encoded, err := json.Marshal(spec)
+	if err != nil {
+		t.Fatal(err)
 	}
-	if len(runtime.Spec.Capabilities.BrokeredToolClasses) != 1 || runtime.Spec.Capabilities.BrokeredToolClasses[0] != AgentRuntimeBrokeredToolClassRead {
-		t.Fatalf("BrokeredToolClasses = %#v", runtime.Spec.Capabilities.BrokeredToolClasses)
+	serialized := string(encoded)
+	for _, forbidden := range []string{"orka.harness.v1", "bearerTokenSecretRef", "toolExecutionModes", "brokeredToolClasses", "supportsContinuation", "supportsRuntimeSessions", "supportsArtifacts"} {
+		if strings.Contains(serialized, forbidden) {
+			t.Fatalf("serialized AgentRuntime still contains v1-only field %q: %s", forbidden, serialized)
+		}
+	}
+	for _, required := range []string{"orka.harness.v2", "controllerBearerTokenSecretRef", "operationCapabilitySecretRef", "runtimeInstanceID", "workspaceGovernance"} {
+		if !strings.Contains(serialized, required) {
+			t.Fatalf("serialized AgentRuntime is missing v2 field %q: %s", required, serialized)
+		}
+	}
+}
+
+func TestAgentRuntimeSpecJSONPreservesExplicitEmptyAllowedTools(t *testing.T) {
+	omitted, err := json.Marshal(AgentRuntimeSpec{})
+	if err != nil {
+		t.Fatal(err)
 	}
-	if runtime.Spec.Capabilities.SupportsContinuation == nil || !*runtime.Spec.Capabilities.SupportsContinuation {
-		t.Fatalf("SupportsContinuation = %#v, want true", runtime.Spec.Capabilities.SupportsContinuation)
+	if strings.Contains(string(omitted), `"allowedTools"`) {
+		t.Fatalf("omitted runtime JSON = %s, want no allowedTools field", omitted)
+	}
+
+	explicit, err := json.Marshal(AgentRuntimeSpec{AllowedTools: []string{}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(explicit), `"allowedTools":[]`) {
+		t.Fatalf("explicit empty runtime JSON = %s, want allowedTools:[]", explicit)
+	}
+	var roundTrip AgentRuntimeSpec
+	if err := json.Unmarshal(explicit, &roundTrip); err != nil {
+		t.Fatal(err)
+	}
+	if roundTrip.AllowedTools == nil || len(roundTrip.AllowedTools) != 0 {
+		t.Fatalf("round-trip allowedTools = %#v, want explicit empty slice", roundTrip.AllowedTools)
+	}
+}
+
+func TestModelConfigTokenLimitsJSONRoundTrip(t *testing.T) {
+	contextWindow := int32(32768)
+	maxTokens := int32(4096)
+	original := ModelConfig{
+		Name:          "openai/gpt-test",
+		ContextWindow: &contextWindow,
+		MaxTokens:     &maxTokens,
+	}
+	encoded, err := json.Marshal(original)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var decoded ModelConfig
+	if err := json.Unmarshal(encoded, &decoded); err != nil {
+		t.Fatal(err)
+	}
+	if decoded.ContextWindow == nil || *decoded.ContextWindow != contextWindow ||
+		decoded.MaxTokens == nil || *decoded.MaxTokens != maxTokens {
+		t.Fatalf("round-trip model limits = %#v", decoded)
+	}
+	copy := original.DeepCopy()
+	*copy.ContextWindow++
+	if *original.ContextWindow != contextWindow {
+		t.Fatal("ModelConfig.DeepCopy shared contextWindow storage")
 	}
 }
diff --git a/api/v1alpha1/agent_types.go b/api/v1alpha1/agent_types.go
index 15a5697ca..bfbf84269 100644
--- a/api/v1alpha1/agent_types.go
+++ b/api/v1alpha1/agent_types.go
@@ -7,12 +7,15 @@ MIT License - see LICENSE file for details.
 package v1alpha1
 
 import (
+	"encoding/json"
+
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
 // AgentSpec defines the desired state of Agent
 // +kubebuilder:validation:XValidation:rule="!has(self.execution) || !has(self.execution.workspace) || !has(self.execution.workspace.classRef)",message="execution.workspace.classRef is only supported on Task specs"
+// +kubebuilder:validation:XValidation:rule="!(has(self.runtime) && has(self.runtime.type) && self.runtime.type == 'opencode' && has(self.runtime.contractVersion) && self.runtime.contractVersion == 'orka.harness.v2' && has(self.systemPrompt) && ((has(self.systemPrompt.inline) && self.systemPrompt.inline.size() > 0) || has(self.systemPrompt.configMapRef)))",message="opencode orka.harness.v2 runtime does not support spec.systemPrompt"
 type AgentSpec struct {
 	// ProviderRef references a Provider CRD for LLM configuration
 	// If set, model.provider is optional (inherited from Provider)
@@ -74,11 +77,21 @@ type AgentSpec struct {
 
 // AgentCLIRuntime defines agent CLI runtime configuration for an Agent.
 // +kubebuilder:validation:XValidation:rule="has(self.type) != has(self.runtimeRef)",message="exactly one of type or runtimeRef is required"
+// +kubebuilder:validation:XValidation:rule="!has(oldSelf.contractVersion) || (has(self.contractVersion) && self.contractVersion == oldSelf.contractVersion)",message="runtime.contractVersion is immutable once set"
+// +kubebuilder:validation:XValidation:rule="!has(self.contractVersion) || has(self.type)",message="runtime.contractVersion applies only to built-in runtime types; runtimeRef derives the protocol from the referenced AgentRuntime"
 type AgentCLIRuntime struct {
 	// Type specifies which built-in CLI runtime to use. Use runtimeRef for admin-registered custom runtimes.
 	// +optional
 	Type AgentRuntimeType `json:"type,omitempty"`
 
+	// ContractVersion is the immutable harness protocol selector for built-in
+	// runtime types. There is no default: a missing selector is never
+	// interpreted as either protocol, and fail-closed admission requires an
+	// explicit value on new built-in Agents. runtime.type alone (including
+	// opencode, which exists in both protocols) is never protocol evidence.
+	// +optional
+	ContractVersion *AgentRuntimeContractVersion `json:"contractVersion,omitempty"`
+
 	// RuntimeRef selects an admin-governed AgentRuntime for custom/BYO harness runtimes.
 	// +optional
 	RuntimeRef *AgentRuntimeReference `json:"runtimeRef,omitempty"`
@@ -106,6 +119,46 @@ type AgentCLIRuntime struct {
 	DefaultReasoningEffort string `json:"defaultReasoningEffort,omitempty"`
 }
 
+// MarshalJSON preserves the distinction between an omitted tool allowlist and
+// an explicitly empty deny-all allowlist. The standard omitempty handling for
+// slices would otherwise serialize both states as omission.
+func (in AgentCLIRuntime) MarshalJSON() ([]byte, error) {
+	type agentCLIRuntimeJSON struct {
+		Type                   AgentRuntimeType             `json:"type,omitempty"`
+		ContractVersion        *AgentRuntimeContractVersion `json:"contractVersion,omitempty"`
+		RuntimeRef             *AgentRuntimeReference       `json:"runtimeRef,omitempty"`
+		DefaultMaxTurns        *int32                       `json:"defaultMaxTurns,omitempty"`
+		DefaultAllowedTools    *[]string                    `json:"defaultAllowedTools,omitempty"`
+		DefaultAllowBash       *bool                        `json:"defaultAllowBash,omitempty"`
+		DefaultReasoningEffort string                       `json:"defaultReasoningEffort,omitempty"`
+	}
+	var defaultAllowedTools *[]string
+	if in.DefaultAllowedTools != nil {
+		tools := append([]string{}, in.DefaultAllowedTools...)
+		defaultAllowedTools = &tools
+	}
+	return json.Marshal(agentCLIRuntimeJSON{
+		Type:                   in.Type,
+		ContractVersion:        in.ContractVersion,
+		RuntimeRef:             in.RuntimeRef,
+		DefaultMaxTurns:        in.DefaultMaxTurns,
+		DefaultAllowedTools:    defaultAllowedTools,
+		DefaultAllowBash:       in.DefaultAllowBash,
+		DefaultReasoningEffort: in.DefaultReasoningEffort,
+	})
+}
+
+// BuiltInContractVersion returns the Agent's explicit built-in harness
+// protocol selector, or empty when unclassified. Callers must treat empty as
+// neither protocol and fail closed; runtime.type alone is never protocol
+// evidence.
+func (in *Agent) BuiltInContractVersion() AgentRuntimeContractVersion {
+	if in == nil || in.Spec.Runtime == nil || in.Spec.Runtime.ContractVersion == nil {
+		return ""
+	}
+	return *in.Spec.Runtime.ContractVersion
+}
+
 // ModelFallback defines a fallback provider configuration
 type ModelFallback struct {
 	// ProviderRef is the name of a Provider CRD to fall back to
@@ -133,11 +186,18 @@ type ModelConfig struct {
 	// Temperature controls randomness in generation
 	// +kubebuilder:validation:Minimum=0
 	// +kubebuilder:validation:Maximum=2
-	// +kubebuilder:default=0.7
 	// +optional
 	Temperature *float64 `json:"temperature,omitempty"`
 
-	// MaxTokens limits the response length
+	// ContextWindow is the reviewed model context capacity in tokens. Built-in
+	// runtimes that manage their own compaction require this value explicitly.
+	// +kubebuilder:validation:Minimum=1
+	// +optional
+	ContextWindow *int32 `json:"contextWindow,omitempty"`
+
+	// MaxTokens limits the response length. OpenCode validates positive reviewed
+	// limits at its runtime-specific admission boundary; existing Agent objects
+	// may retain the legacy zero value.
 	// +optional
 	MaxTokens *int32 `json:"maxTokens,omitempty"`
 
@@ -148,6 +208,7 @@ type ModelConfig struct {
 }
 
 // PromptSource defines where to get a prompt from
+// +kubebuilder:validation:XValidation:rule="!(has(self.inline) && self.inline.size() > 0 && has(self.configMapRef))",message="system prompt must use only one of inline or configMapRef"
 type PromptSource struct {
 	// Inline is the inline prompt text
 	// +optional
diff --git a/api/v1alpha1/branch_claim_types.go b/api/v1alpha1/branch_claim_types.go
new file mode 100644
index 000000000..0a2d282b2
--- /dev/null
+++ b/api/v1alpha1/branch_claim_types.go
@@ -0,0 +1,101 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package v1alpha1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// BranchClaimOwnerKind identifies the durable owner of an Orka-managed branch.
+// +kubebuilder:validation:Enum=Task;Session
+type BranchClaimOwnerKind string
+
+// BranchClaimAvailability gates further branch mutation.
+// +kubebuilder:validation:Enum=Available;ReconciliationBlocked
+type BranchClaimAvailability string
+
+// BranchClaimSpec is the immutable repository/ref ownership identity.
+// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="branch claim spec is immutable"
+type BranchClaimSpec struct {
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	ID string `json:"id"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	RepositoryID string `json:"repositoryId"`
+
+	// +kubebuilder:validation:Pattern=`^refs/heads/.+$`
+	// +kubebuilder:validation:MaxLength=1024
+	Ref string `json:"ref"`
+
+	OwnerKind BranchClaimOwnerKind `json:"ownerKind"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	OwnerUID string `json:"ownerUid"`
+
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	RequestDigest string `json:"requestDigest"`
+}
+
+// BranchClaimStatus is the exact generation, baseline, and availability CAS.
+// +kubebuilder:validation:XValidation:rule="!has(self.availability) || self.availability != 'Available' || ((!has(self.blockedReason) || size(self.blockedReason) == 0) && (!has(self.relatedPublicationId) || size(self.relatedPublicationId) == 0))",message="available branch claims must clear block metadata"
+// +kubebuilder:validation:XValidation:rule="!has(self.availability) || self.availability != 'ReconciliationBlocked' || (has(self.blockedReason) && size(self.blockedReason) > 0)",message="reconciliation-blocked branch claims require a reason"
+type BranchClaimStatus struct {
+	// +optional
+	// +kubebuilder:validation:Minimum=1
+	Generation int64 `json:"generation,omitempty"`
+
+	// LastVerified is the independently observed exact target ref.
+	// +optional
+	LastVerified *ControlRemoteRefState `json:"lastVerified,omitempty"`
+
+	// +optional
+	Availability BranchClaimAvailability `json:"availability,omitempty"`
+
+	// +optional
+	// +kubebuilder:validation:MaxLength=16384
+	BlockedReason string `json:"blockedReason,omitempty"`
+
+	// +optional
+	// +kubebuilder:validation:MaxLength=1024
+	RelatedPublicationID string `json:"relatedPublicationId,omitempty"`
+
+	ControlRecordMutationStatus `json:",inline"`
+}
+
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:resource:scope=Cluster,shortName=bclaim
+// +kubebuilder:printcolumn:name="Repository",type=string,JSONPath=`.spec.repositoryId`
+// +kubebuilder:printcolumn:name="Ref",type=string,JSONPath=`.spec.ref`
+// +kubebuilder:printcolumn:name="Owner",type=string,JSONPath=`.spec.ownerKind`
+// +kubebuilder:printcolumn:name="Generation",type=integer,JSONPath=`.status.generation`
+// +kubebuilder:printcolumn:name="Availability",type=string,JSONPath=`.status.availability`
+// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
+
+// BranchClaim is the cluster-wide Kubernetes-authoritative ownership and exact
+// baseline record for one canonical repository branch.
+type BranchClaim struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   BranchClaimSpec   `json:"spec"`
+	Status BranchClaimStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// BranchClaimList contains a list of BranchClaim.
+type BranchClaimList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []BranchClaim `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&BranchClaim{}, &BranchClaimList{})
+}
diff --git a/api/v1alpha1/coexistence_bridge_test.go b/api/v1alpha1/coexistence_bridge_test.go
new file mode 100644
index 000000000..f9a872abd
--- /dev/null
+++ b/api/v1alpha1/coexistence_bridge_test.go
@@ -0,0 +1,275 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package v1alpha1
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+// The bridge schema must decode and round-trip stored objects from BOTH
+// pre-coexistence baselines without pruning: the harness v1 baseline
+// (origin/main) and the v2-only ACP cutover baseline. These fixtures mirror
+// the exact historical JSON shapes.
+
+const storedV1AgentRuntimeJSON = `{
+  "contractVersion": "orka.harness.v1",
+  "deployment": {"mode": "external-endpoint", "endpoint": "https://harness.example.com"},
+  "clientAuth": {"bearerTokenSecretRef": {"name": "harness-auth", "key": "token"}},
+  "capabilities": {
+    "toolExecutionModes": ["observed", "brokered"],
+    "brokeredToolClasses": ["read", "coordination"],
+    "supportsCancel": true,
+    "supportsRuntimeSessions": true,
+    "supportsContinuation": false,
+    "supportsArtifacts": true
+  }
+}`
+
+const storedV1AgentRuntimeStatusJSON = `{
+  "ready": true,
+  "observedGeneration": 3,
+  "observedAuthRefResourceVersion": "12345",
+  "observedCapabilities": {
+    "protocolVersion": "orka.harness.v1",
+    "transport": "http+sse",
+    "runtimeName": "agentkit",
+    "runtimeVersion": "1.4.2",
+    "providerKind": "generic",
+    "toolExecutionModes": ["observed"],
+    "supportsCancel": true,
+    "maxConcurrentTurns": 4,
+    "maxTurnSeconds": 1800,
+    "maxOutputBytes": 1048576
+  }
+}`
+
+func TestBridgeStoredV1AgentRuntimeRoundTrips(t *testing.T) {
+	var spec AgentRuntimeRegistrySpec
+	if err := json.Unmarshal([]byte(storedV1AgentRuntimeJSON), &spec); err != nil {
+		t.Fatalf("decode stored v1 AgentRuntime spec: %v", err)
+	}
+	if spec.ContractVersion == nil || *spec.ContractVersion != AgentRuntimeContractHarnessV1 {
+		t.Fatalf("contractVersion = %v", spec.ContractVersion)
+	}
+	if spec.ClientAuth.BearerAuthRef == nil || spec.ClientAuth.BearerAuthRef.Name != "harness-auth" || spec.ClientAuth.BearerAuthRef.Key != "token" {
+		t.Fatalf("bearer auth ref = %+v", spec.ClientAuth.BearerAuthRef)
+	}
+	if spec.ClientAuth.ControllerBearerTokenSecretRef != nil || spec.ClientAuth.OperationCapabilitySecretRef != nil {
+		t.Fatal("v1 auth decode must not synthesize v2 auth fields")
+	}
+	if spec.Capabilities == nil || len(spec.Capabilities.ToolExecutionModes) != 2 ||
+		spec.Capabilities.SupportsCancel == nil || !*spec.Capabilities.SupportsCancel ||
+		spec.Capabilities.SupportsContinuation == nil || *spec.Capabilities.SupportsContinuation {
+		t.Fatalf("v1 capabilities = %+v", spec.Capabilities)
+	}
+	if spec.Capabilities.Profile != nil || spec.Capabilities.Limits != nil || spec.Capabilities.WorkspaceGovernance != nil {
+		t.Fatal("v1 capabilities decode must not synthesize v2 capability fields")
+	}
+
+	reencoded, err := json.Marshal(spec)
+	if err != nil {
+		t.Fatalf("re-encode stored v1 AgentRuntime spec: %v", err)
+	}
+	serialized := string(reencoded)
+	for _, required := range []string{`"orka.harness.v1"`, `"bearerTokenSecretRef"`, `"toolExecutionModes"`, `"brokeredToolClasses"`, `"supportsCancel"`} {
+		if !strings.Contains(serialized, required) {
+			t.Fatalf("re-encoded v1 spec lost %s: %s", required, serialized)
+		}
+	}
+	for _, forbidden := range []string{"controllerBearerTokenSecretRef", "operationCapabilitySecretRef", "workspaceGovernance", `"profile"`} {
+		if strings.Contains(serialized, forbidden) {
+			t.Fatalf("re-encoded v1 spec gained v2 field %s: %s", forbidden, serialized)
+		}
+	}
+
+}
+
+func TestBridgeStoredV1AgentRuntimeStatusRoundTrips(t *testing.T) {
+	var status AgentRuntimeStatus
+	if err := json.Unmarshal([]byte(storedV1AgentRuntimeStatusJSON), &status); err != nil {
+		t.Fatalf("decode stored v1 AgentRuntime status: %v", err)
+	}
+	if status.ObservedAuthRefResourceVersion != "12345" {
+		t.Fatalf("observedAuthRefResourceVersion = %q; the v1 status surface must serialize", status.ObservedAuthRefResourceVersion)
+	}
+	if status.ObservedCapabilities == nil || status.ObservedCapabilities.RuntimeName != "agentkit" ||
+		status.ObservedCapabilities.MaxConcurrentTurns != 4 || status.ObservedCapabilities.MaxOutputBytes != 1048576 {
+		t.Fatalf("v1 observed capabilities = %+v", status.ObservedCapabilities)
+	}
+	if status.ObservedCapabilities.Limits != nil || status.ObservedCapabilities.WorkspaceGovernance != nil {
+		t.Fatalf("v1 observed capabilities gained v2-only fields: %+v", status.ObservedCapabilities)
+	}
+	statusJSON, err := json.Marshal(status)
+	if err != nil {
+		t.Fatalf("re-encode v1 status: %v", err)
+	}
+	serialized := string(statusJSON)
+	if !strings.Contains(serialized, `"observedAuthRefResourceVersion":"12345"`) {
+		t.Fatalf("v1 status round trip lost observedAuthRefResourceVersion: %s", statusJSON)
+	}
+	for _, forbidden := range []string{`"limits"`, `"workspaceGovernance"`} {
+		if strings.Contains(serialized, forbidden) {
+			t.Fatalf("v1 status serialized schema-invalid v2 field %s: %s", forbidden, statusJSON)
+		}
+	}
+}
+
+const storedV1TaskSpecFragmentJSON = `{
+  "type": "agent",
+  "prompt": "fix the bug",
+  "agentRef": {"name": "coder"},
+  "agentRuntime": {
+    "workspace": {
+      "gitRepo": "https://github.com/org/repo.git",
+      "branch": "main",
+      "ref": "abc123",
+      "gitSecretRef": {"name": "git-credentials"},
+      "subPath": "services/api",
+      "forkRepo": "https://github.com/bot/repo.git",
+      "prBaseBranch": "main",
+      "pushBranch": "agent/fix-1"
+    },
+    "maxTurns": 25,
+    "allowedTools": []
+  }
+}`
+
+const storedV1TaskStatusFragmentJSON = `{
+  "phase": "Running",
+  "harnessRuntime": {
+    "runtimeRefName": "external-harness",
+    "runtimeName": "agentkit",
+    "contractVersion": "orka.harness.v1",
+    "endpoint": "https://harness.example.com",
+    "runtimeGeneration": 7,
+    "authRefName": "harness-auth",
+    "authRefField": "token",
+    "authRefResourceVersion": "999"
+  }
+}`
+
+func TestBridgeStoredV1TaskRoundTrips(t *testing.T) {
+	var spec TaskSpec
+	if err := json.Unmarshal([]byte(storedV1TaskSpecFragmentJSON), &spec); err != nil {
+		t.Fatalf("decode stored v1 Task spec: %v", err)
+	}
+	workspace := spec.AgentRuntime.Workspace
+	if workspace == nil || workspace.GitRepo != "https://github.com/org/repo.git" ||
+		workspace.GitSecretRef == nil || workspace.GitSecretRef.Name != "git-credentials" ||
+		workspace.ForkRepo != "https://github.com/bot/repo.git" || workspace.PushBranch != "agent/fix-1" {
+		t.Fatalf("legacy workspace = %+v", workspace)
+	}
+	// The explicit-empty allowlist must survive alongside the legacy workspace.
+	if spec.AgentRuntime.AllowedTools == nil || len(spec.AgentRuntime.AllowedTools) != 0 {
+		t.Fatalf("explicit empty allowedTools was not preserved: %#v", spec.AgentRuntime.AllowedTools)
+	}
+
+	reencoded, err := json.Marshal(spec.AgentRuntime)
+	if err != nil {
+		t.Fatalf("re-encode legacy agentRuntime: %v", err)
+	}
+	serialized := string(reencoded)
+	for _, required := range []string{`"gitSecretRef"`, `"forkRepo"`, `"pushBranch"`, `"allowedTools":[]`} {
+		if !strings.Contains(serialized, required) {
+			t.Fatalf("legacy agentRuntime round trip lost %s: %s", required, serialized)
+		}
+	}
+
+	var status TaskStatus
+	if err := json.Unmarshal([]byte(storedV1TaskStatusFragmentJSON), &status); err != nil {
+		t.Fatalf("decode stored v1 Task status: %v", err)
+	}
+	if status.HarnessRuntime == nil || status.HarnessRuntime.ContractVersion != "orka.harness.v1" ||
+		status.HarnessRuntime.RuntimeGeneration != 7 || status.HarnessRuntime.AuthRefResourceVersion != "999" {
+		t.Fatalf("harnessRuntime status = %+v", status.HarnessRuntime)
+	}
+	statusJSON, err := json.Marshal(status)
+	if err != nil {
+		t.Fatalf("re-encode v1 Task status: %v", err)
+	}
+	if !strings.Contains(string(statusJSON), `"harnessRuntime"`) {
+		t.Fatalf("v1 Task status round trip lost harnessRuntime: %s", statusJSON)
+	}
+}
+
+const storedV1OpenCodeAgentJSON = `{
+  "runtime": {"type": "opencode", "contractVersion": "orka.harness.v1", "defaultMaxTurns": 50},
+  "model": {"name": "gpt-5.2", "maxTokens": 8192},
+  "systemPrompt": {"inline": "You are a careful engineer."},
+  "secretRef": {"name": "opencode-credentials"}
+}`
+
+func TestBridgeStoredV1OpenCodeAgentPreserved(t *testing.T) {
+	var spec AgentSpec
+	if err := json.Unmarshal([]byte(storedV1OpenCodeAgentJSON), &spec); err != nil {
+		t.Fatalf("decode stored v1 OpenCode Agent: %v", err)
+	}
+	agent := &Agent{Spec: spec}
+	if agent.BuiltInContractVersion() != AgentRuntimeContractHarnessV1 {
+		t.Fatalf("contract = %q", agent.BuiltInContractVersion())
+	}
+	// Historical v1 OpenCode shape: legacy model ID without provider prefix,
+	// Agent-level system prompt, and provider Secret all round-trip.
+	if spec.Model == nil || spec.Model.Name != "gpt-5.2" || spec.SystemPrompt == nil ||
+		spec.SystemPrompt.Inline == "" || spec.SecretRef == nil || spec.SecretRef.Name != "opencode-credentials" {
+		t.Fatalf("v1 OpenCode fields = %+v", spec)
+	}
+	reencoded, err := json.Marshal(spec)
+	if err != nil {
+		t.Fatalf("re-encode v1 OpenCode Agent: %v", err)
+	}
+	for _, required := range []string{`"orka.harness.v1"`, `"gpt-5.2"`, `"systemPrompt"`, `"opencode-credentials"`} {
+		if !strings.Contains(string(reencoded), required) {
+			t.Fatalf("v1 OpenCode Agent round trip lost %s: %s", required, reencoded)
+		}
+	}
+}
+
+func TestAgentCLIRuntimeContractVersionSerialization(t *testing.T) {
+	v2 := AgentRuntimeContractHarnessV2
+	runtime := AgentCLIRuntime{Type: AgentRuntimeCodex, ContractVersion: &v2}
+	encoded, err := json.Marshal(runtime)
+	if err != nil {
+		t.Fatalf("marshal runtime: %v", err)
+	}
+	if !strings.Contains(string(encoded), `"contractVersion":"orka.harness.v2"`) {
+		t.Fatalf("contractVersion missing from custom marshal output: %s", encoded)
+	}
+
+	// The omitted-versus-explicit-empty allowlist distinction survives the
+	// selector addition.
+	runtime.DefaultAllowedTools = []string{}
+	encoded, err = json.Marshal(runtime)
+	if err != nil {
+		t.Fatalf("marshal runtime with empty allowlist: %v", err)
+	}
+	if !strings.Contains(string(encoded), `"defaultAllowedTools":[]`) {
+		t.Fatalf("explicit empty allowlist was dropped: %s", encoded)
+	}
+	runtime.DefaultAllowedTools = nil
+	encoded, err = json.Marshal(runtime)
+	if err != nil {
+		t.Fatalf("marshal runtime with omitted allowlist: %v", err)
+	}
+	if strings.Contains(string(encoded), "defaultAllowedTools") {
+		t.Fatalf("omitted allowlist serialized: %s", encoded)
+	}
+
+	unclassified := AgentCLIRuntime{Type: AgentRuntimeOpencode}
+	encoded, err = json.Marshal(unclassified)
+	if err != nil {
+		t.Fatalf("marshal unclassified runtime: %v", err)
+	}
+	if strings.Contains(string(encoded), "contractVersion") {
+		t.Fatalf("unclassified runtime must omit contractVersion: %s", encoded)
+	}
+	if (&Agent{Spec: AgentSpec{Runtime: &unclassified}}).BuiltInContractVersion() != "" {
+		t.Fatal("unclassified agent must report empty contract")
+	}
+}
diff --git a/api/v1alpha1/control_record_types.go b/api/v1alpha1/control_record_types.go
new file mode 100644
index 000000000..d9cf61ed9
--- /dev/null
+++ b/api/v1alpha1/control_record_types.go
@@ -0,0 +1,117 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package v1alpha1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+const (
+	// ControlRecordArtifactRetentionFinalizer prevents deletion while a control
+	// record can still retain or reconcile a content-addressed artifact.
+	ControlRecordArtifactRetentionFinalizer = "core.orka.ai/artifact-retention"
+	// ControlRecordLeaseProtectionFinalizer prevents deletion of a control record
+	// while a Kubernetes Lease still fences mutations for that record.
+	ControlRecordLeaseProtectionFinalizer = "core.orka.ai/lease-protection"
+
+	// ControlRecordIDHashLabel stores a DNS-safe digest of the immutable logical
+	// record ID so namespaced records can be found without trusting mutable data.
+	ControlRecordIDHashLabel = "core.orka.ai/control-record-id-hash"
+	// ControlRecordTaskUIDLabel associates a controller-owned record with the
+	// immutable UID of the Task that caused it to be created.
+	ControlRecordTaskUIDLabel = "core.orka.ai/task-uid"
+)
+
+// ControlRecordMutationStatus is the common fenced mutation metadata embedded
+// in Kubernetes-authoritative ACP control records. Kubernetes resourceVersion
+// provides the storage CAS; Version is the monotonic domain version expected by
+// DurableControlStore callers.
+type ControlRecordMutationStatus struct {
+	// ControllerEpochName identifies the controller epoch domain checked before
+	// the mutation.
+	// +optional
+	// +kubebuilder:validation:MaxLength=253
+	ControllerEpochName string `json:"controllerEpochName,omitempty"`
+
+	// ControllerEpoch is the exact epoch that performed the last mutation.
+	// +optional
+	// +kubebuilder:validation:Minimum=1
+	ControllerEpoch int64 `json:"controllerEpoch,omitempty"`
+
+	// ControllerEpochLeaseResourceVersion is the resourceVersion of the
+	// authoritative controller-epoch Lease observed by the mutation.
+	// +optional
+	// +kubebuilder:validation:MaxLength=64
+	ControllerEpochLeaseResourceVersion string `json:"controllerEpochLeaseResourceVersion,omitempty"`
+
+	// LastOperationID is the last idempotent mutation identity applied.
+	// +optional
+	// +kubebuilder:validation:MaxLength=1024
+	LastOperationID string `json:"lastOperationId,omitempty"`
+
+	// LastOperationDigest binds LastOperationID to exact canonical input.
+	// +optional
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	LastOperationDigest string `json:"lastOperationDigest,omitempty"`
+
+	// Version is the monotonic domain CAS version. It advances once for each
+	// successfully persisted logical mutation.
+	// +optional
+	// +kubebuilder:validation:Minimum=1
+	Version int64 `json:"version,omitempty"`
+
+	// CreatedAt is the normalized logical creation time.
+	// +optional
+	CreatedAt *metav1.Time `json:"createdAt,omitempty"`
+
+	// UpdatedAt is the normalized logical mutation time.
+	// +optional
+	UpdatedAt *metav1.Time `json:"updatedAt,omitempty"`
+}
+
+// ControlRemoteRefState is an exact remote-ref observation. Absent and SHA are
+// mutually exclusive. The all-zero value is reserved for an explicitly unknown
+// observation in PublicationOutcomeUnknown receipts.
+// +kubebuilder:validation:XValidation:rule="!(self.absent && has(self.sha) && size(self.sha) > 0)",message="absent and sha are mutually exclusive"
+type ControlRemoteRefState struct {
+	Absent bool `json:"absent"`
+
+	// +optional
+	// +kubebuilder:validation:Pattern=`^([a-f0-9]{40}|[a-f0-9]{64})$`
+	SHA string `json:"sha,omitempty"`
+}
+
+// ControlVerifiedBranchBaseline is an independently verified branch baseline.
+type ControlVerifiedBranchBaseline struct {
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	RepositoryID string `json:"repositoryId"`
+
+	// +kubebuilder:validation:Pattern=`^refs/heads/.+$`
+	// +kubebuilder:validation:MaxLength=1024
+	Ref string `json:"ref"`
+
+	// +kubebuilder:validation:Pattern=`^([a-f0-9]{40}|[a-f0-9]{64})$`
+	SHA string `json:"sha"`
+}
+
+// ControlRecordOwner identifies an immutable namespaced owner when the
+// Kubernetes object name is not part of the DurableControlStore interface.
+type ControlRecordOwner struct {
+	// +kubebuilder:validation:Enum=Task;Session;RuntimePool;PromptAttempt
+	Kind string `json:"kind"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	UID string `json:"uid"`
+}
+
+// RBAC for the Kubernetes-authoritative ACP control-record store. These
+// markers intentionally live with the API surface so generation does not
+// require wiring the store into cmd/main.go.
+// +kubebuilder:rbac:groups=core.orka.ai,resources=promptattempts;runtimesessioncontrols;branchclaims;publications;externaleffects;controllerepochs,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=core.orka.ai,resources=promptattempts/status;runtimesessioncontrols/status;branchclaims/status;publications/status;externaleffects/status;controllerepochs/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=core.orka.ai,resources=promptattempts/finalizers;runtimesessioncontrols/finalizers;branchclaims/finalizers;publications/finalizers;externaleffects/finalizers;controllerepochs/finalizers,verbs=update
+// +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;watch;create;update;patch;delete
diff --git a/api/v1alpha1/controller_epoch_types.go b/api/v1alpha1/controller_epoch_types.go
new file mode 100644
index 000000000..5c968748f
--- /dev/null
+++ b/api/v1alpha1/controller_epoch_types.go
@@ -0,0 +1,83 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package v1alpha1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// ControllerEpochSpec is the immutable epoch-domain identity. The associated
+// coordination.k8s.io Lease is the CAS authority for holder and epoch changes.
+// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="controller epoch spec is immutable"
+type ControllerEpochSpec struct {
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	Name string `json:"name"`
+}
+
+// ControllerEpochStatus mirrors the authoritative Lease state for inspection
+// and recovery. LeaseResourceVersion identifies the exact Lease revision.
+type ControllerEpochStatus struct {
+	// +optional
+	// +kubebuilder:validation:Minimum=1
+	Epoch int64 `json:"epoch,omitempty"`
+
+	// +optional
+	// +kubebuilder:validation:MaxLength=1024
+	HolderID string `json:"holderId,omitempty"`
+
+	// +optional
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	RequestDigest string `json:"requestDigest,omitempty"`
+
+	// +optional
+	// +kubebuilder:validation:Minimum=1
+	Version int64 `json:"version,omitempty"`
+
+	// +optional
+	AcquiredAt *metav1.Time `json:"acquiredAt,omitempty"`
+
+	// +optional
+	UpdatedAt *metav1.Time `json:"updatedAt,omitempty"`
+
+	// +optional
+	// +kubebuilder:validation:MaxLength=253
+	LeaseName string `json:"leaseName,omitempty"`
+
+	// +optional
+	// +kubebuilder:validation:MaxLength=64
+	LeaseResourceVersion string `json:"leaseResourceVersion,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:resource:path=controllerepochs,scope=Namespaced,shortName=cepoch
+// +kubebuilder:printcolumn:name="Epoch",type=integer,JSONPath=`.status.epoch`
+// +kubebuilder:printcolumn:name="Holder",type=string,JSONPath=`.status.holderId`
+// +kubebuilder:printcolumn:name="Version",type=integer,JSONPath=`.status.version`
+// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
+
+// ControllerEpoch is the human-visible Kubernetes control record paired with
+// an authoritative namespaced Lease.
+type ControllerEpoch struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   ControllerEpochSpec   `json:"spec"`
+	Status ControllerEpochStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// ControllerEpochList contains a list of ControllerEpoch.
+type ControllerEpochList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []ControllerEpoch `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&ControllerEpoch{}, &ControllerEpochList{})
+}
diff --git a/api/v1alpha1/execution_types.go b/api/v1alpha1/execution_types.go
index 0a1baba1b..9f2064dda 100644
--- a/api/v1alpha1/execution_types.go
+++ b/api/v1alpha1/execution_types.go
@@ -26,10 +26,10 @@ type ExecutionSpec struct {
 	// +optional
 	Affinity *corev1.Affinity `json:"affinity,omitempty"`
 
-	// Workspace requests an upstream agent-sandbox execution workspace for agent Tasks.
-	// When enabled, the Task controller validates the request and propagates the
-	// resolved sandbox settings to the agent worker Job. The worker wrapper then
-	// claims the sandbox workspace and runs the configured agent runtime inside it.
+	// Workspace requests an execution workspace for worker-backed Task types.
+	// ACP core agent Tasks reject this field because their ephemeral workspace is
+	// owned by RuntimeSession lifecycle and clean-room publication. Actor-backed
+	// RuntimeSession support is a future integration behind the v2 lifecycle seam.
 	// +optional
 	Workspace *ExecutionWorkspaceSpec `json:"workspace,omitempty"`
 }
diff --git a/api/v1alpha1/external_effect_types.go b/api/v1alpha1/external_effect_types.go
new file mode 100644
index 000000000..88812c619
--- /dev/null
+++ b/api/v1alpha1/external_effect_types.go
@@ -0,0 +1,189 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package v1alpha1
+
+import (
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+// ExternalEffectControlState is the durable state of one idempotent operation
+// performed outside the controller's SQLite transaction boundary.
+// +kubebuilder:validation:Enum=Pending;InFlight;Succeeded;Failed;OutcomeUnknown
+type ExternalEffectControlState string
+
+// ExternalEffectSpec is the immutable canonical identity and request binding.
+// The identity namespace intentionally duplicates metadata.namespace so a
+// serialized record remains self-describing and can be checked fail-closed.
+// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="external effect spec is immutable"
+type ExternalEffectSpec struct {
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	ID string `json:"id"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	Kind string `json:"kind"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	IdentityNamespace string `json:"identityNamespace"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	AggregateID string `json:"aggregateId"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	OperationID string `json:"operationId"`
+
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	RequestDigest string `json:"requestDigest"`
+}
+
+// ExternalEffectStatus contains the mutable state, response, lease, and epoch
+// fence for one canonical external effect.
+// +kubebuilder:validation:XValidation:rule="!has(self.state) || self.state != 'InFlight' || (has(self.leaseOwner) && size(self.leaseOwner) > 0 && has(self.leaseExpiresAt))",message="in-flight external effects require a lease owner and expiry"
+// +kubebuilder:validation:XValidation:rule="!has(self.state) || self.state == 'InFlight' || ((!has(self.leaseOwner) || size(self.leaseOwner) == 0) && !has(self.leaseExpiresAt))",message="non-in-flight external effects must clear lease fields"
+type ExternalEffectStatus struct {
+	// +optional
+	State ExternalEffectControlState `json:"state,omitempty"`
+
+	// +optional
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	ResponseDigest string `json:"responseDigest,omitempty"`
+
+	// Response stores a bounded JSON response for idempotent replay. Large
+	// response bodies should remain in the artifact store and be referenced by
+	// a compact receipt instead.
+	// +optional
+	Response *apiextensionsv1.JSON `json:"response,omitempty"`
+
+	// +optional
+	// +kubebuilder:validation:MaxLength=1024
+	LeaseOwner string `json:"leaseOwner,omitempty"`
+
+	// +optional
+	LeaseExpiresAt *metav1.Time `json:"leaseExpiresAt,omitempty"`
+
+	// +optional
+	// +kubebuilder:validation:Minimum=0
+	Attempts int64 `json:"attempts,omitempty"`
+
+	ControlRecordMutationStatus `json:",inline"`
+}
+
+// +kubebuilder:object:root=true
+// +kubebuilder:object:generate=false
+// +k8s:deepcopy-gen=false
+// +kubebuilder:subresource:status
+// +kubebuilder:resource:scope=Namespaced,shortName=eeffect
+// +kubebuilder:printcolumn:name="State",type=string,JSONPath=`.status.state`
+// +kubebuilder:printcolumn:name="Kind",type=string,JSONPath=`.spec.kind`
+// +kubebuilder:printcolumn:name="Attempts",type=integer,JSONPath=`.status.attempts`
+// +kubebuilder:printcolumn:name="Version",type=integer,JSONPath=`.status.version`
+// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
+
+// ExternalEffect is the Kubernetes-authoritative canonical idempotency record
+// for an operation outside SQLite.
+type ExternalEffect struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   ExternalEffectSpec   `json:"spec"`
+	Status ExternalEffectStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+// +kubebuilder:object:generate=false
+// +k8s:deepcopy-gen=false
+
+// ExternalEffectList contains a list of ExternalEffect.
+type ExternalEffectList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []ExternalEffect `json:"items"`
+}
+
+// DeepCopyInto is hand-written so this new root type is usable before the
+// repository owner regenerates zz_generated.deepcopy.go.
+func (in *ExternalEffect) DeepCopyInto(out *ExternalEffect) {
+	*out = *in
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	if in.Status.Response != nil {
+		out.Status.Response = &apiextensionsv1.JSON{}
+		if in.Status.Response.Raw != nil {
+			out.Status.Response.Raw = append([]byte(nil), in.Status.Response.Raw...)
+		}
+	}
+	if in.Status.LeaseExpiresAt != nil {
+		out.Status.LeaseExpiresAt = in.Status.LeaseExpiresAt.DeepCopy()
+	}
+	deepCopyControlRecordMutationStatus(&in.Status.ControlRecordMutationStatus, &out.Status.ControlRecordMutationStatus)
+}
+
+// DeepCopy creates an independent copy.
+func (in *ExternalEffect) DeepCopy() *ExternalEffect {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalEffect)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject implements runtime.Object.
+func (in *ExternalEffect) DeepCopyObject() runtime.Object {
+	if copy := in.DeepCopy(); copy != nil {
+		return copy
+	}
+	return nil
+}
+
+// DeepCopyInto copies a list and all of its items.
+func (in *ExternalEffectList) DeepCopyInto(out *ExternalEffectList) {
+	*out = *in
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		out.Items = make([]ExternalEffect, len(in.Items))
+		for i := range in.Items {
+			in.Items[i].DeepCopyInto(&out.Items[i])
+		}
+	}
+}
+
+// DeepCopy creates an independent list copy.
+func (in *ExternalEffectList) DeepCopy() *ExternalEffectList {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalEffectList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject implements runtime.Object.
+func (in *ExternalEffectList) DeepCopyObject() runtime.Object {
+	if copy := in.DeepCopy(); copy != nil {
+		return copy
+	}
+	return nil
+}
+
+func deepCopyControlRecordMutationStatus(in, out *ControlRecordMutationStatus) {
+	if in.CreatedAt != nil {
+		out.CreatedAt = in.CreatedAt.DeepCopy()
+	}
+	if in.UpdatedAt != nil {
+		out.UpdatedAt = in.UpdatedAt.DeepCopy()
+	}
+}
+
+func init() {
+	SchemeBuilder.Register(&ExternalEffect{}, &ExternalEffectList{})
+}
diff --git a/api/v1alpha1/external_effect_types_test.go b/api/v1alpha1/external_effect_types_test.go
new file mode 100644
index 000000000..1333b99da
--- /dev/null
+++ b/api/v1alpha1/external_effect_types_test.go
@@ -0,0 +1,55 @@
+package v1alpha1
+
+import (
+	"testing"
+	"time"
+
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func TestExternalEffectDeepCopyIsIndependentAndRegistered(t *testing.T) {
+	expires := metav1.NewTime(time.Date(2026, time.July, 25, 6, 0, 0, 0, time.UTC))
+	created := expires.DeepCopy()
+	updated := expires.DeepCopy()
+	original := &ExternalEffect{
+		ObjectMeta: metav1.ObjectMeta{Name: "effect", Namespace: "tenant-a", Labels: map[string]string{"a": "b"}},
+		Spec:       ExternalEffectSpec{ID: "effect-1", Kind: "PullRequest", IdentityNamespace: "tenant-a", AggregateID: "publication-1", OperationID: "op-1", RequestDigest: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"},
+		Status: ExternalEffectStatus{
+			State:          "InFlight",
+			Response:       &apiextensionsv1.JSON{Raw: []byte(`{"ok":true}`)},
+			LeaseExpiresAt: &expires,
+			ControlRecordMutationStatus: ControlRecordMutationStatus{
+				CreatedAt: created,
+				UpdatedAt: updated,
+			},
+		},
+	}
+	copy := original.DeepCopy()
+	copy.Labels["a"] = "changed"
+	copy.Status.Response.Raw[2] = 'X'
+	copy.Status.LeaseExpiresAt.Time = copy.Status.LeaseExpiresAt.Add(time.Hour)
+	copy.Status.CreatedAt.Time = copy.Status.CreatedAt.Add(time.Hour)
+
+	if original.Labels["a"] != "b" {
+		t.Fatalf("labels were aliased: %#v", original.Labels)
+	}
+	if string(original.Status.Response.Raw) != `{"ok":true}` {
+		t.Fatalf("response bytes were aliased: %s", original.Status.Response.Raw)
+	}
+	if !original.Status.LeaseExpiresAt.Equal(&expires) {
+		t.Fatalf("lease expiry was aliased: %s", original.Status.LeaseExpiresAt)
+	}
+	if !original.Status.CreatedAt.Equal(created) {
+		t.Fatalf("mutation timestamp was aliased: %s", original.Status.CreatedAt)
+	}
+
+	scheme := runtime.NewScheme()
+	if err := AddToScheme(scheme); err != nil {
+		t.Fatalf("AddToScheme: %v", err)
+	}
+	if _, err := scheme.New(GroupVersion.WithKind("ExternalEffect")); err != nil {
+		t.Fatalf("ExternalEffect is not registered: %v", err)
+	}
+}
diff --git a/api/v1alpha1/prompt_attempt_types.go b/api/v1alpha1/prompt_attempt_types.go
new file mode 100644
index 000000000..93cc48169
--- /dev/null
+++ b/api/v1alpha1/prompt_attempt_types.go
@@ -0,0 +1,161 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package v1alpha1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// PromptAttemptExecutionState is the durable prompt execution state.
+// +kubebuilder:validation:Enum=Queued;Reserved;SessionStarting;Planned;Submitting;SubmittedUnknown;Accepted;Running;Settling;Succeeded;Failed;Cancelled;OutcomeUnknown
+type PromptAttemptExecutionState string
+
+// PromptAttemptDeliveryState is the durable delivery state for one prompt.
+// +kubebuilder:validation:Enum=NotRequested;Validating;Preparing;Prepared;Publishing;Verifying;VerifiedExact;DeliveredSuperseded;ReadValidated;NoChange;CancelledBeforePublish;ReadOnlyWorkspaceModified;DeliveryConflict;CredentialBlocked;PublicationOutcomeUnknown
+type PromptAttemptDeliveryState string
+
+// PromptCredentialBinding freezes one role-specific Secret identity without
+// storing credential material.
+type PromptCredentialBinding struct {
+	// +kubebuilder:validation:Enum=SourceRead;TargetRead;TargetWrite;Forge
+	Role string `json:"role"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	Namespace string `json:"namespace"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	SecretName string `json:"secretName"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	SecretKey string `json:"secretKey"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	SecretUID string `json:"secretUid"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	ResourceVersion string `json:"resourceVersion"`
+}
+
+// PromptAttemptSpec is the immutable identity and request binding for one
+// Task prompt attempt.
+// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="prompt attempt spec is immutable"
+// +kubebuilder:validation:XValidation:rule="has(self.bindingDigest) == has(self.snapshotDigest)",message="bindingDigest and snapshotDigest must be recorded together"
+type PromptAttemptSpec struct {
+	// ID is the canonical DurableControlStore prompt-attempt ID.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	ID string `json:"id"`
+
+	// TaskUID is the immutable Kubernetes UID of the Task.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	TaskUID string `json:"taskUid"`
+
+	// Attempt is the one-based Task attempt number.
+	// +kubebuilder:validation:Minimum=1
+	Attempt int64 `json:"attempt"`
+
+	// PromptID is the immutable prompt identity within the attempt.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	PromptID string `json:"promptId"`
+
+	// RequestDigest binds the prompt identity to exact canonical input.
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	RequestDigest string `json:"requestDigest"`
+
+	// BindingDigest identifies the immutable Task-lifetime v2 execution
+	// binding. It is optional only so pre-coexistence records remain readable;
+	// all PromptAttempts newly created through DurableControlStore require it.
+	// +optional
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	BindingDigest string `json:"bindingDigest,omitempty"`
+
+	// SnapshotDigest identifies the immutable encrypted execution snapshot.
+	// It is optional only so pre-coexistence records remain readable; all
+	// PromptAttempts newly created through DurableControlStore require it.
+	// +optional
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	SnapshotDigest string `json:"snapshotDigest,omitempty"`
+
+	// CredentialBindings is the immutable, role-separated Secret identity set.
+	// +optional
+	// +listType=map
+	// +listMapKey=role
+	// +kubebuilder:validation:MaxItems=4
+	CredentialBindings []PromptCredentialBinding `json:"credentialBindings,omitempty"`
+}
+
+// PromptAttemptStatus holds the exact execution and delivery state machines.
+// +kubebuilder:validation:XValidation:rule="!has(self.executionState) || self.executionState != 'OutcomeUnknown' || (has(self.outcomeMarker) && size(self.outcomeMarker) > 0)",message="OutcomeUnknown requires an explicit outcome marker"
+type PromptAttemptStatus struct {
+	// SessionUID is immutable after first binding.
+	// +optional
+	// +kubebuilder:validation:MaxLength=1024
+	SessionUID string `json:"sessionUid,omitempty"`
+
+	// SessionLeaseGeneration is immutable after first binding.
+	// +optional
+	// +kubebuilder:validation:Minimum=1
+	SessionLeaseGeneration int64 `json:"sessionLeaseGeneration,omitempty"`
+
+	// RuntimeInstanceID is immutable after first binding.
+	// +optional
+	// +kubebuilder:validation:MaxLength=1024
+	RuntimeInstanceID string `json:"runtimeInstanceId,omitempty"`
+
+	// +optional
+	ExecutionState PromptAttemptExecutionState `json:"executionState,omitempty"`
+
+	// +optional
+	DeliveryState PromptAttemptDeliveryState `json:"deliveryState,omitempty"`
+
+	// +optional
+	// +kubebuilder:validation:MaxLength=16384
+	TerminalReason string `json:"terminalReason,omitempty"`
+
+	// +optional
+	// +kubebuilder:validation:MaxLength=16384
+	OutcomeMarker string `json:"outcomeMarker,omitempty"`
+
+	ControlRecordMutationStatus `json:",inline"`
+}
+
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:resource:scope=Namespaced,shortName=pattempt
+// +kubebuilder:printcolumn:name="Execution",type=string,JSONPath=`.status.executionState`
+// +kubebuilder:printcolumn:name="Delivery",type=string,JSONPath=`.status.deliveryState`
+// +kubebuilder:printcolumn:name="Attempt",type=integer,JSONPath=`.spec.attempt`
+// +kubebuilder:printcolumn:name="Version",type=integer,JSONPath=`.status.version`
+// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
+
+// PromptAttempt is the Kubernetes-authoritative prompt execution and delivery
+// control record.
+type PromptAttempt struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   PromptAttemptSpec   `json:"spec"`
+	Status PromptAttemptStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// PromptAttemptList contains a list of PromptAttempt.
+type PromptAttemptList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []PromptAttempt `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&PromptAttempt{}, &PromptAttemptList{})
+}
diff --git a/api/v1alpha1/publication_types.go b/api/v1alpha1/publication_types.go
new file mode 100644
index 000000000..1256dbc26
--- /dev/null
+++ b/api/v1alpha1/publication_types.go
@@ -0,0 +1,313 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package v1alpha1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// PublicationControlState is the clean-room publication state machine.
+// +kubebuilder:validation:Enum=Preparing;Prepared;Publishing;Verifying;VerifiedExact;DeliveredSuperseded;CancelledBeforePublish;DeliveryConflict;CredentialBlocked;PreparationFailed;PublicationOutcomeUnknown
+type PublicationControlState string
+
+// PublicationSpec is the immutable clean-room publication identity and input.
+// Mutable receipts and forge intent live only in status.
+// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="publication spec is immutable"
+type PublicationSpec struct {
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	ID string `json:"id"`
+
+	// +kubebuilder:validation:Minimum=1
+	Generation int64 `json:"generation"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	TaskUID string `json:"taskUid"`
+
+	// +kubebuilder:validation:Minimum=1
+	Attempt int64 `json:"attempt"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	PromptID string `json:"promptId"`
+
+	// +optional
+	// +kubebuilder:validation:MaxLength=1024
+	SessionUID string `json:"sessionUid,omitempty"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	BranchClaimID string `json:"branchClaimId"`
+
+	// +kubebuilder:validation:Minimum=1
+	BranchClaimGeneration int64 `json:"branchClaimGeneration"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	SourceRepositoryID string `json:"sourceRepositoryId"`
+
+	// SourceRef is the exact immutable source ref or revision selector.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	SourceRef string `json:"sourceRef"`
+
+	// +kubebuilder:validation:Pattern=`^([a-f0-9]{40}|[a-f0-9]{64})$`
+	SourceBaselineSHA string `json:"sourceBaselineSha"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	TargetRepositoryID string `json:"targetRepositoryId"`
+
+	// +kubebuilder:validation:Pattern=`^refs/heads/.+$`
+	// +kubebuilder:validation:MaxLength=1024
+	TargetRef string `json:"targetRef"`
+
+	Baseline ControlRemoteRefState `json:"baseline"`
+
+	// ArtifactID identifies the durable content-addressed change artifact.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	ArtifactID string `json:"artifactId"`
+
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	ArtifactDigest string `json:"artifactDigest"`
+
+	// +kubebuilder:validation:Minimum=1
+	ArtifactSizeBytes int64 `json:"artifactSizeBytes"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=255
+	ArtifactMediaType string `json:"artifactMediaType"`
+
+	// PublicationCredentialRef identifies an operation-scoped Secret reference;
+	// it never contains credential material.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	PublicationCredentialRef string `json:"publicationCredentialRef"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	CommitIdentity string `json:"commitIdentity"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=16384
+	CommitMessage string `json:"commitMessage"`
+
+	CommitTimestamp metav1.Time `json:"commitTimestamp"`
+
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	RequestDigest string `json:"requestDigest"`
+}
+
+// PublicationPullRequestIntent is the exact forge tuple persisted before the
+// first forge API call.
+type PublicationPullRequestIntent struct {
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	BaseRepositoryID string `json:"baseRepositoryId"`
+
+	// +kubebuilder:validation:Pattern=`^refs/heads/.+$`
+	// +kubebuilder:validation:MaxLength=1024
+	BaseRef string `json:"baseRef"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	HeadRepositoryID string `json:"headRepositoryId"`
+
+	// +kubebuilder:validation:Pattern=`^refs/heads/.+$`
+	// +kubebuilder:validation:MaxLength=1024
+	HeadRef string `json:"headRef"`
+
+	// +kubebuilder:validation:Minimum=1
+	PublicationGeneration int64 `json:"publicationGeneration"`
+
+	// +kubebuilder:validation:Pattern=`^([a-f0-9]{40}|[a-f0-9]{64})$`
+	ExpectedHeadSHA string `json:"expectedHeadSha"`
+}
+
+// PreparedPublicationControlReceipt records deterministic commit preparation.
+type PreparedPublicationControlReceipt struct {
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	OperationID string `json:"operationId"`
+
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	RequestDigest string `json:"requestDigest"`
+
+	// +kubebuilder:validation:Pattern=`^([a-f0-9]{40}|[a-f0-9]{64})$`
+	TreeSHA string `json:"treeSha"`
+
+	// +kubebuilder:validation:Pattern=`^([a-f0-9]{40}|[a-f0-9]{64})$`
+	CommitSHA string `json:"commitSha"`
+
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	ManifestDigest string `json:"manifestDigest"`
+
+	// RelativeRoot is the canonical repository-relative workspace root applied
+	// to every path in the immutable delta artifact.
+	// +optional
+	// +kubebuilder:validation:MaxLength=1024
+	RelativeRoot string `json:"relativeRoot,omitempty"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	BundleArtifactID string `json:"bundleArtifactId"`
+
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	BundleDigest string `json:"bundleDigest"`
+
+	// +kubebuilder:validation:Minimum=1
+	BundleSizeBytes int64 `json:"bundleSizeBytes"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=255
+	BundleMediaType string `json:"bundleMediaType"`
+
+	// +kubebuilder:validation:Pattern=`^refs/orka/publications/[a-f0-9]{64}$`
+	BundleRef string `json:"bundleRef"`
+
+	PreparedAt metav1.Time `json:"preparedAt"`
+}
+
+// PublishOperationControlReceipt records the exact server-enforced ref CAS.
+type PublishOperationControlReceipt struct {
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	OperationID string `json:"operationId"`
+
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	RequestDigest string `json:"requestDigest"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	TargetRepositoryID string `json:"targetRepositoryId"`
+
+	// +kubebuilder:validation:Pattern=`^refs/heads/.+$`
+	// +kubebuilder:validation:MaxLength=1024
+	TargetRef string `json:"targetRef"`
+
+	RemoteBefore ControlRemoteRefState `json:"remoteBefore"`
+
+	// +kubebuilder:validation:Pattern=`^([a-f0-9]{40}|[a-f0-9]{64})$`
+	ExpectedCommitSHA string `json:"expectedCommitSha"`
+
+	AcknowledgementUnknown bool `json:"acknowledgementUnknown"`
+
+	PublishedAt metav1.Time `json:"publishedAt"`
+}
+
+// PublicationVerificationControlReceipt is an independent remote observation.
+type PublicationVerificationControlReceipt struct {
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	OperationID string `json:"operationId"`
+
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	RequestDigest string `json:"requestDigest"`
+
+	Outcome PublicationControlState `json:"outcome"`
+
+	// +kubebuilder:validation:Pattern=`^([a-f0-9]{40}|[a-f0-9]{64})$`
+	ExpectedCommitSHA string `json:"expectedCommitSha"`
+
+	ObservedRemote ControlRemoteRefState `json:"observedRemote"`
+
+	// +optional
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	DescendantProofDigest string `json:"descendantProofDigest,omitempty"`
+
+	VerifiedAt metav1.Time `json:"verifiedAt"`
+}
+
+// PullRequestOperationControlReceipt snapshots exact forge reconciliation.
+type PullRequestOperationControlReceipt struct {
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	OperationID string `json:"operationId"`
+
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	RequestDigest string `json:"requestDigest"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	IntentKey string `json:"intentKey"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	ForgeID string `json:"forgeId"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=2048
+	URL string `json:"url"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=128
+	State string `json:"state"`
+
+	// +kubebuilder:validation:Pattern=`^([a-f0-9]{40}|[a-f0-9]{64})$`
+	HeadSHA string `json:"headSha"`
+
+	ReconciledAt metav1.Time `json:"reconciledAt"`
+}
+
+// PublicationStatus contains mutable state, exact receipts, and epoch fencing.
+// +kubebuilder:validation:XValidation:rule="!has(self.state) || !(self.state in ['DeliveryConflict', 'CredentialBlocked', 'PreparationFailed', 'PublicationOutcomeUnknown']) || (has(self.terminalReason) && size(self.terminalReason) > 0)",message="failure and unknown publication states require a terminal reason"
+type PublicationStatus struct {
+	// +optional
+	State PublicationControlState `json:"state,omitempty"`
+
+	// +optional
+	PRIntent *PublicationPullRequestIntent `json:"prIntent,omitempty"`
+
+	// +optional
+	PreparedReceipt *PreparedPublicationControlReceipt `json:"preparedReceipt,omitempty"`
+
+	// +optional
+	PublishReceipt *PublishOperationControlReceipt `json:"publishReceipt,omitempty"`
+
+	// +optional
+	VerificationReceipt *PublicationVerificationControlReceipt `json:"verificationReceipt,omitempty"`
+
+	// +optional
+	PullRequestReceipt *PullRequestOperationControlReceipt `json:"pullRequestReceipt,omitempty"`
+
+	// +optional
+	// +kubebuilder:validation:MaxLength=16384
+	TerminalReason string `json:"terminalReason,omitempty"`
+
+	ControlRecordMutationStatus `json:",inline"`
+}
+
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:resource:scope=Namespaced,shortName=pubctl
+// +kubebuilder:printcolumn:name="State",type=string,JSONPath=`.status.state`
+// +kubebuilder:printcolumn:name="Generation",type=integer,JSONPath=`.spec.generation`
+// +kubebuilder:printcolumn:name="Target",type=string,JSONPath=`.spec.targetRef`
+// +kubebuilder:printcolumn:name="Version",type=integer,JSONPath=`.status.version`
+// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
+
+// Publication is the Kubernetes-authoritative clean-room publication record.
+type Publication struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   PublicationSpec   `json:"spec"`
+	Status PublicationStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// PublicationList contains a list of Publication.
+type PublicationList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []Publication `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&Publication{}, &PublicationList{})
+}
diff --git a/api/v1alpha1/repositorymonitor_types.go b/api/v1alpha1/repositorymonitor_types.go
index c9793fad7..e7e048934 100644
--- a/api/v1alpha1/repositorymonitor_types.go
+++ b/api/v1alpha1/repositorymonitor_types.go
@@ -38,10 +38,36 @@ type RepositoryMonitorSpec struct {
 	// +optional
 	Branch string `json:"branch,omitempty"`
 
-	// GitSecretRef references GitHub credentials for repository monitor operations.
+	// GitSecretRef is the backward-compatible source-read credential reference.
+	// ReadCredentialRef takes precedence when both are set. GitSecretRef is never
+	// used for publication writes or forge mutations.
 	// +optional
 	GitSecretRef *corev1.LocalObjectReference `json:"gitSecretRef,omitempty"`
 
+	// ReadCredentialRef references the source-repository clone/read credential.
+	// It is resolved only by the clean-room workspace boundary. When omitted,
+	// GitSecretRef remains the backward-compatible read-only fallback.
+	// +optional
+	ReadCredentialRef *corev1.LocalObjectReference `json:"readCredentialRef,omitempty"`
+
+	// PublicationReadCredentialRef references the target-repository read
+	// credential used only for publication preflight and independent verification.
+	// Write workflows require this explicit reference.
+	// +optional
+	PublicationReadCredentialRef *corev1.LocalObjectReference `json:"publicationReadCredentialRef,omitempty"`
+
+	// PublicationCredentialRef references the target-repository write credential
+	// used only for exact compare-and-swap publication. Write workflows require
+	// this explicit reference.
+	// +optional
+	PublicationCredentialRef *corev1.LocalObjectReference `json:"publicationCredentialRef,omitempty"`
+
+	// ForgeCredentialRef references the GitHub API credential used only for
+	// controller-owned forge reads and mutations. Write workflows and GitHub label
+	// triggers require this explicit reference.
+	// +optional
+	ForgeCredentialRef *corev1.LocalObjectReference `json:"forgeCredentialRef,omitempty"`
+
 	// Schedule is the cron expression for background monitor runs.
 	// +optional
 	Schedule string `json:"schedule,omitempty"`
diff --git a/api/v1alpha1/repositoryscan_types.go b/api/v1alpha1/repositoryscan_types.go
index a9ced3df4..9f944e9a8 100644
--- a/api/v1alpha1/repositoryscan_types.go
+++ b/api/v1alpha1/repositoryscan_types.go
@@ -54,10 +54,36 @@ type RepositoryScanSpec struct {
 	// +optional
 	SubPath string `json:"subPath,omitempty"`
 
-	// GitSecretRef references git credentials for private repositories.
+	// GitSecretRef is the backward-compatible source-read credential reference.
+	// ReadCredentialRef takes precedence when both are set. GitSecretRef is never
+	// used for publication writes or forge mutations.
 	// +optional
 	GitSecretRef *corev1.LocalObjectReference `json:"gitSecretRef,omitempty"`
 
+	// ReadCredentialRef references the source-repository clone/read credential.
+	// It is resolved only by the clean-room workspace boundary. When omitted,
+	// GitSecretRef remains the backward-compatible read-only fallback.
+	// +optional
+	ReadCredentialRef *corev1.LocalObjectReference `json:"readCredentialRef,omitempty"`
+
+	// PublicationReadCredentialRef references the target-repository read
+	// credential used only for publication preflight and independent verification.
+	// Patch workflows require this explicit reference.
+	// +optional
+	PublicationReadCredentialRef *corev1.LocalObjectReference `json:"publicationReadCredentialRef,omitempty"`
+
+	// PublicationCredentialRef references the target-repository write credential
+	// used only for exact compare-and-swap publication. Patch workflows require
+	// this explicit reference.
+	// +optional
+	PublicationCredentialRef *corev1.LocalObjectReference `json:"publicationCredentialRef,omitempty"`
+
+	// ForgeCredentialRef references the GitHub API credential used only for
+	// controller-owned pull request reconciliation. Patch workflows require this
+	// explicit reference.
+	// +optional
+	ForgeCredentialRef *corev1.LocalObjectReference `json:"forgeCredentialRef,omitempty"`
+
 	// ForkRepo is the writable fork repository URL used for patch proposals.
 	// +optional
 	ForkRepo string `json:"forkRepo,omitempty"`
diff --git a/api/v1alpha1/runtime_pool_types.go b/api/v1alpha1/runtime_pool_types.go
new file mode 100644
index 000000000..e320ab98c
--- /dev/null
+++ b/api/v1alpha1/runtime_pool_types.go
@@ -0,0 +1,556 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package v1alpha1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+const (
+	// DefaultRuntimePoolDesiredReplicas keeps an idle pool scaled to zero until
+	// durable demand is present.
+	DefaultRuntimePoolDesiredReplicas int32 = 0
+	// DefaultRuntimePoolMaxResidentSessions is the first-release per-pool
+	// resident-session limit.
+	DefaultRuntimePoolMaxResidentSessions int32 = 10
+	// DefaultRuntimePoolMaxRunningPrompts is the first-release per-pool prompt
+	// concurrency limit.
+	DefaultRuntimePoolMaxRunningPrompts int32 = 4
+	// DefaultRuntimePoolColdStartTimeoutSeconds bounds a 0 -> 1 pool startup.
+	DefaultRuntimePoolColdStartTimeoutSeconds int32 = 120
+	// MaxRuntimePoolCapacityReservations bounds the durable reservation list in
+	// RuntimePool status. RuntimePool capacity is itself limited to 1000.
+	MaxRuntimePoolCapacityReservations = 1000
+)
+
+// RuntimePoolProtocolVersion is the controller-to-supervisor protocol profile.
+// +kubebuilder:validation:Enum=orka.harness.v2
+type RuntimePoolProtocolVersion string
+
+const (
+	// RuntimePoolProtocolHarnessV2 is the ACP session-centric harness contract.
+	RuntimePoolProtocolHarnessV2 RuntimePoolProtocolVersion = "orka.harness.v2"
+)
+
+// RuntimePoolLifecycle is the controller-observed lifecycle of a logical pool.
+// Only Serving may admit new RuntimeSessions.
+// +kubebuilder:validation:Enum=Stopped;Starting;Serving;Draining;Quiescent;Stopping;Degraded;Ambiguous
+type RuntimePoolLifecycle string
+
+const (
+	RuntimePoolLifecycleStopped   RuntimePoolLifecycle = "Stopped"
+	RuntimePoolLifecycleStarting  RuntimePoolLifecycle = "Starting"
+	RuntimePoolLifecycleServing   RuntimePoolLifecycle = "Serving"
+	RuntimePoolLifecycleDraining  RuntimePoolLifecycle = "Draining"
+	RuntimePoolLifecycleQuiescent RuntimePoolLifecycle = "Quiescent"
+	RuntimePoolLifecycleStopping  RuntimePoolLifecycle = "Stopping"
+	RuntimePoolLifecycleDegraded  RuntimePoolLifecycle = "Degraded"
+	RuntimePoolLifecycleAmbiguous RuntimePoolLifecycle = "Ambiguous"
+)
+
+// RuntimePoolAdmissionState is the authoritative admission gate for new
+// RuntimeSessions. Existing session control traffic may continue while draining.
+// +kubebuilder:validation:Enum=Closed;Accepting;Draining;Ambiguous
+type RuntimePoolAdmissionState string
+
+const (
+	RuntimePoolAdmissionClosed    RuntimePoolAdmissionState = "Closed"
+	RuntimePoolAdmissionAccepting RuntimePoolAdmissionState = "Accepting"
+	RuntimePoolAdmissionDraining  RuntimePoolAdmissionState = "Draining"
+	RuntimePoolAdmissionAmbiguous RuntimePoolAdmissionState = "Ambiguous"
+)
+
+const (
+	// RuntimePoolConditionAdmissionReady reports whether new RuntimeSessions may
+	// be admitted without violating lifecycle, fencing, or capacity rules.
+	RuntimePoolConditionAdmissionReady = "AdmissionReady"
+	// RuntimePoolConditionPodSecurityReady reports whether the runtime Pod passes
+	// the selected namespace's Pod Security admission requirements.
+	RuntimePoolConditionPodSecurityReady = "PodSecurityReady"
+	// RuntimePoolConditionQuotaReady reports whether quota permits the pool's
+	// controller-owned resources.
+	RuntimePoolConditionQuotaReady = "QuotaReady"
+	// RuntimePoolConditionSchedulingReady reports whether the selected runtime
+	// Pod can be scheduled.
+	RuntimePoolConditionSchedulingReady = "SchedulingReady"
+	// RuntimePoolConditionRolloutReady reports whether the immutable runtime
+	// profile has been installed without version skew.
+	RuntimePoolConditionRolloutReady = "RolloutReady"
+)
+
+const (
+	RuntimePoolReasonAdmissionClosed     = "AdmissionClosed"
+	RuntimePoolReasonAtCapacity          = "AtCapacity"
+	RuntimePoolReasonPodSecurityRejected = "PodSecurityRejected"
+	RuntimePoolReasonQuotaRejected       = "QuotaRejected"
+	RuntimePoolReasonSchedulingFailed    = "SchedulingFailed"
+	RuntimePoolReasonRolloutFailed       = "RolloutFailed"
+	RuntimePoolReasonRuntimeAmbiguous    = "RuntimeAmbiguous"
+)
+
+// RuntimePoolTrustDomain identifies the logical same-trust-domain boundary
+// served by one pool. It is not a tenant-isolation claim.
+type RuntimePoolTrustDomain struct {
+	// Namespace is the Task namespace represented by this trust domain.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=63
+	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`
+	Namespace string `json:"namespace"`
+
+	// Identity is the controller-defined, canonical trust-domain identity. It
+	// must remain stable across physical runtime namespace or Pod replacement.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	Identity string `json:"identity"`
+}
+
+// ModelTokenLimits pins the reviewed token capacities used by a
+// runtime's local context-management policy.
+// +kubebuilder:validation:XValidation:rule="self.context > self.output",message="model context limit must exceed output limit"
+type ModelTokenLimits struct {
+	// Context is the maximum model context capacity in tokens.
+	// +kubebuilder:validation:Minimum=1
+	Context int64 `json:"context"`
+
+	// Output is the maximum generated output in tokens.
+	// +kubebuilder:validation:Minimum=1
+	Output int64 `json:"output"`
+}
+
+// RuntimePoolProfileSpec pins the immutable runtime behavior selected for a
+// pool. The digest covers the adapter and CLI builds, ACP profile, provider and
+// model limits, agent configuration, tool and approval policy, MCP
+// configuration, workspace intent, proxy credential scope, and resource class.
+// +kubebuilder:validation:XValidation:rule="self.providerKind != 'opencode' || has(self.modelLimits)",message="OpenCode runtime profiles require modelLimits"
+type RuntimePoolProfileSpec struct {
+	// ProtocolVersion is the controller-to-supervisor protocol profile.
+	// +kubebuilder:default=orka.harness.v2
+	// +optional
+	ProtocolVersion RuntimePoolProtocolVersion `json:"protocolVersion,omitempty"`
+
+	// Digest is the canonical immutable runtime-profile digest.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	Digest string `json:"digest"`
+
+	// DigestSchemaVersion identifies the canonicalization schema used to compute Digest.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=64
+	// +kubebuilder:validation:Pattern=`^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$`
+	DigestSchemaVersion string `json:"digestSchemaVersion"`
+
+	// ACPProfile is the reviewed ACP wire/profile identifier.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Enum=acp.v1
+	ACPProfile string `json:"acpProfile"`
+
+	// AdapterDigests pins every adapter and provider CLI artifact used by the pool.
+	// +kubebuilder:validation:MinProperties=1
+	// +kubebuilder:validation:MaxProperties=32
+	AdapterDigests map[string]string `json:"adapterDigests"`
+
+	// ProviderKind selects the one provider adapter present in the immutable image.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Enum=codex;claude;copilot;opencode
+	ProviderKind string `json:"providerKind"`
+
+	// Model is the exact reviewed model identifier.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=256
+	Model string `json:"model"`
+
+	// ModelLimits pins the reviewed context and output capacities used by the
+	// runtime's local compaction policy.
+	// +optional
+	ModelLimits *ModelTokenLimits `json:"modelLimits,omitempty"`
+
+	// AgentConfigurationDigest freezes non-secret Agent/runtime configuration.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	AgentConfigurationDigest string `json:"agentConfigurationDigest"`
+
+	// ToolPolicyDigest freezes the effective tool allow/deny policy.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	ToolPolicyDigest string `json:"toolPolicyDigest"`
+
+	// ApprovalPolicyDigest freezes the effective approval policy.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	ApprovalPolicyDigest string `json:"approvalPolicyDigest"`
+
+	// MCPConfigurationDigest freezes prompt-scoped broker/MCP configuration.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	MCPConfigurationDigest string `json:"mcpConfigurationDigest"`
+
+	// WorkspaceIntent is part of the immutable runtime profile.
+	// +kubebuilder:validation:Required
+	WorkspaceIntent WorkspaceIntent `json:"workspaceIntent"`
+
+	// ProxyCredentialRole identifies the provider-proxy client role, never a secret value.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=256
+	ProxyCredentialRole string `json:"proxyCredentialRole"`
+
+	// ProxyCredentialScope is the bounded model/session capability scope.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	ProxyCredentialScope string `json:"proxyCredentialScope"`
+
+	// ResourceClass is the controller-supported pool resource class included in Digest.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=63
+	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9.]*[a-z0-9])?$`
+	ResourceClass string `json:"resourceClass"`
+}
+
+// RuntimePoolRuntimeSpec selects the immutable supervisor image and profile.
+type RuntimePoolRuntimeSpec struct {
+	// Image is a digest-pinned OCI image. Mutable tags are intentionally rejected.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MaxLength=2048
+	// +kubebuilder:validation:Pattern=`^[^\s@]+@sha256:[a-f0-9]{64}$`
+	Image string `json:"image"`
+
+	// Profile is the immutable runtime profile enforced for every active instance.
+	// +kubebuilder:validation:Required
+	Profile RuntimePoolProfileSpec `json:"profile"`
+}
+
+// RuntimePoolCapacitySpec defines hard logical pool concurrency limits.
+// +kubebuilder:validation:XValidation:rule="self.maxRunningPrompts <= self.maxResidentSessions",message="maxRunningPrompts cannot exceed maxResidentSessions"
+type RuntimePoolCapacitySpec struct {
+	// MaxResidentSessions is the maximum number of resident RuntimeSessions.
+	// +kubebuilder:validation:Minimum=1
+	// +kubebuilder:validation:Maximum=1000
+	// +kubebuilder:default=10
+	// +optional
+	MaxResidentSessions int32 `json:"maxResidentSessions,omitempty"`
+
+	// MaxRunningPrompts is the maximum number of concurrently running prompts.
+	// +kubebuilder:validation:Minimum=1
+	// +kubebuilder:validation:Maximum=1000
+	// +kubebuilder:default=4
+	// +optional
+	MaxRunningPrompts int32 `json:"maxRunningPrompts,omitempty"`
+}
+
+// RuntimePoolSpec defines the desired state of a controller-owned logical pool.
+// Trust-domain placement and the runtime image/profile are immutable; rollout
+// uses drain-and-replace rather than changing an in-memory instance in place.
+// +kubebuilder:validation:XValidation:rule="self.trustDomain == oldSelf.trustDomain",message="trustDomain is immutable"
+// +kubebuilder:validation:XValidation:rule="has(self.runtimeNamespace) == has(oldSelf.runtimeNamespace) && (!has(self.runtimeNamespace) || self.runtimeNamespace == oldSelf.runtimeNamespace)",message="runtimeNamespace is immutable"
+// +kubebuilder:validation:XValidation:rule="self.runtime == oldSelf.runtime",message="runtime image and profile are immutable"
+type RuntimePoolSpec struct {
+	// TrustDomain is the logical namespace/identity boundary served by this pool.
+	// +kubebuilder:validation:Required
+	TrustDomain RuntimePoolTrustDomain `json:"trustDomain"`
+
+	// RuntimeNamespace is the physical namespace for controller-owned runtime
+	// resources. When omitted, the controller selects its configured runtime namespace.
+	// +kubebuilder:validation:MaxLength=63
+	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`
+	// +optional
+	RuntimeNamespace string `json:"runtimeNamespace,omitempty"`
+
+	// Runtime pins the immutable supervisor image and behavior profile.
+	// +kubebuilder:validation:Required
+	Runtime RuntimePoolRuntimeSpec `json:"runtime"`
+
+	// DesiredReplicas is zero or one. More than one runtime Pod would make
+	// stateful exact-instance routing ambiguous.
+	// +kubebuilder:validation:Minimum=0
+	// +kubebuilder:validation:Maximum=1
+	// +kubebuilder:default=0
+	// +optional
+	DesiredReplicas int32 `json:"desiredReplicas,omitempty"`
+
+	// Capacity sets resident-session and running-prompt limits.
+	// +kubebuilder:default={maxResidentSessions:10,maxRunningPrompts:4}
+	// +optional
+	Capacity *RuntimePoolCapacitySpec `json:"capacity,omitempty"`
+
+	// ColdStartTimeoutSeconds bounds a 0 -> 1 startup before the pool is marked degraded.
+	// +kubebuilder:validation:Minimum=1
+	// +kubebuilder:validation:Maximum=3600
+	// +kubebuilder:default=120
+	// +optional
+	ColdStartTimeoutSeconds int32 `json:"coldStartTimeoutSeconds,omitempty"`
+}
+
+// RuntimePoolActiveInstanceStatus is the exact selected runtime Pod and
+// supervisor boot. Every stateful request is fenced to this identity.
+type RuntimePoolActiveInstanceStatus struct {
+	// PodNamespace is the namespace containing the selected runtime Pod.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=63
+	PodNamespace string `json:"podNamespace"`
+
+	// PodName is the exact selected runtime Pod name.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	PodName string `json:"podName"`
+
+	// PodAddress is the exact Pod address used for stateful routing, not a
+	// load-balanced Service endpoint.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	PodAddress string `json:"podAddress"`
+
+	// PodUID is the Kubernetes UID of the selected Pod.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=128
+	PodUID string `json:"podUID"`
+
+	// BootID is the immutable supervisor boot identifier inside the selected Pod.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=128
+	BootID string `json:"bootID"`
+
+	// RuntimeInstanceID is the portable v2 instance fence derived from PodUID and BootID.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	RuntimeInstanceID string `json:"runtimeInstanceID"`
+
+	// ControllerEpoch is the durable controller epoch to which this instance is bound.
+	// +kubebuilder:validation:Minimum=1
+	ControllerEpoch int64 `json:"controllerEpoch"`
+
+	// ProtocolVersion is the supervisor protocol actually advertised by this instance.
+	// +kubebuilder:validation:Required
+	ProtocolVersion RuntimePoolProtocolVersion `json:"protocolVersion"`
+
+	// ProfileDigest is the immutable runtime-profile digest advertised by this instance.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	ProfileDigest string `json:"profileDigest"`
+
+	// ProfileDigestSchemaVersion is the digest schema advertised by this instance.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=64
+	ProfileDigestSchemaVersion string `json:"profileDigestSchemaVersion"`
+
+	// ProviderTokenGeneration is a non-secret digest generation for the exact
+	// provider capability mounted into this runtime Pod. It lets the controller
+	// prove that a selected instance converged on the intended proxy credential
+	// without exposing the bearer token.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Pattern=`^[a-f0-9]{16}$`
+	ProviderTokenGeneration string `json:"providerTokenGeneration"`
+
+	// LastObservedTime is the last authenticated status observation for this instance.
+	// +optional
+	LastObservedTime *metav1.Time `json:"lastObservedTime,omitempty"`
+}
+
+// RuntimePoolCapacityReservationStatus is one durable, exact-instance capacity
+// claim. The composite key is the pool UID, Task UID, attempt, and controller
+// epoch. A reservation claims resident-session and prompt admission slots until
+// the supervisor accepts the corresponding work or the reservation expires.
+// +kubebuilder:validation:XValidation:rule="self.residentSlots + self.promptSlots > 0",message="a capacity reservation must claim at least one slot"
+type RuntimePoolCapacityReservationStatus struct {
+	// PoolUID fences the claim to the exact RuntimePool object.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=128
+	PoolUID string `json:"poolUID"`
+
+	// TaskUID is the immutable Task identity that owns the claim.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=128
+	TaskUID string `json:"taskUID"`
+
+	// Attempt is the Task attempt that owns the claim.
+	// +kubebuilder:validation:Minimum=1
+	Attempt int32 `json:"attempt"`
+
+	// ControllerEpoch fences the claim to one controller leadership epoch.
+	// +kubebuilder:validation:Minimum=1
+	ControllerEpoch int64 `json:"controllerEpoch"`
+
+	// RuntimeInstanceID binds admission to the exact selected Pod/boot pair.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	RuntimeInstanceID string `json:"runtimeInstanceID"`
+
+	// ResidentSlots is zero after a RuntimeSession is admitted and one while a
+	// new resident-session slot is still reserved.
+	// +kubebuilder:validation:Minimum=0
+	// +kubebuilder:validation:Maximum=1
+	ResidentSlots int32 `json:"residentSlots"`
+
+	// PromptSlots is one until the prompt is accepted by the supervisor.
+	// +kubebuilder:validation:Minimum=0
+	// +kubebuilder:validation:Maximum=1
+	PromptSlots int32 `json:"promptSlots"`
+
+	// ReservedAt is the first successful resource-version CAS for this claim.
+	// +kubebuilder:validation:Required
+	ReservedAt metav1.Time `json:"reservedAt"`
+
+	// ExpiresAt is renewed while pre-admission work is active. A later
+	// dispatcher may reclaim the claim after this time.
+	// +kubebuilder:validation:Required
+	ExpiresAt metav1.Time `json:"expiresAt"`
+}
+
+// RuntimePoolCapacityStatus reports controller and authenticated-supervisor
+// capacity counters. These counters are advisory unless fenced by the current
+// ActiveInstance and controller epoch. Reservation records are authoritative for
+// coordinator-owned pre-admission capacity.
+type RuntimePoolCapacityStatus struct {
+	// MaxResidentSessions is the effective configured resident-session limit.
+	// +kubebuilder:validation:Minimum=0
+	MaxResidentSessions int32 `json:"maxResidentSessions,omitempty"`
+
+	// MaxRunningPrompts is the effective configured running-prompt limit.
+	// +kubebuilder:validation:Minimum=0
+	MaxRunningPrompts int32 `json:"maxRunningPrompts,omitempty"`
+
+	// ResidentSessions is the authenticated supervisor count of resident sessions.
+	// +kubebuilder:validation:Minimum=0
+	ResidentSessions int32 `json:"residentSessions,omitempty"`
+
+	// RunningPrompts is the authenticated supervisor count of active prompts.
+	// +kubebuilder:validation:Minimum=0
+	RunningPrompts int32 `json:"runningPrompts,omitempty"`
+
+	// QueuedTasks is durable unsatisfied demand assigned to this pool.
+	// +kubebuilder:validation:Minimum=0
+	QueuedTasks int32 `json:"queuedTasks,omitempty"`
+
+	// ReservedSessions is the sum of resident slots in Reservations.
+	// +kubebuilder:validation:Minimum=0
+	ReservedSessions int32 `json:"reservedSessions,omitempty"`
+
+	// ReservedPrompts is the sum of prompt slots in Reservations.
+	// +kubebuilder:validation:Minimum=0
+	ReservedPrompts int32 `json:"reservedPrompts,omitempty"`
+
+	// Reservations is the bounded authoritative set of coordinator-owned
+	// pre-admission capacity claims.
+	// +listType=map
+	// +listMapKey=poolUID
+	// +listMapKey=taskUID
+	// +listMapKey=attempt
+	// +listMapKey=controllerEpoch
+	// +kubebuilder:validation:MaxItems=1000
+	// +optional
+	Reservations []RuntimePoolCapacityReservationStatus `json:"reservations,omitempty"`
+
+	// PendingPermissions is the authenticated count of unresolved prompt permissions.
+	// +kubebuilder:validation:Minimum=0
+	PendingPermissions int32 `json:"pendingPermissions,omitempty"`
+
+	// FinalizingSessions is the count reserved for validation, publication, or finalization.
+	// +kubebuilder:validation:Minimum=0
+	FinalizingSessions int32 `json:"finalizingSessions,omitempty"`
+
+	// LiveDescendants is the authenticated count of tracked runtime descendants.
+	// +kubebuilder:validation:Minimum=0
+	LiveDescendants int32 `json:"liveDescendants,omitempty"`
+}
+
+// RuntimePoolStatus defines the observed state of a controller-owned pool.
+type RuntimePoolStatus struct {
+	// ObservedGeneration is the latest RuntimePool generation reconciled by the controller.
+	// +optional
+	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
+
+	// ControllerEpoch is the durable epoch required for authoritative pool writes.
+	// +kubebuilder:validation:Minimum=0
+	// +optional
+	ControllerEpoch int64 `json:"controllerEpoch,omitempty"`
+
+	// DesiredReplicas is the desired replica count observed by the controller.
+	// +kubebuilder:validation:Minimum=0
+	// +kubebuilder:validation:Maximum=1
+	// +optional
+	DesiredReplicas int32 `json:"desiredReplicas,omitempty"`
+
+	// CurrentReplicas is the number of non-terminated runtime Pods owned by the pool.
+	// +kubebuilder:validation:Minimum=0
+	// +optional
+	CurrentReplicas int32 `json:"currentReplicas,omitempty"`
+
+	// Lifecycle is the explicit pool lifecycle.
+	// +optional
+	Lifecycle RuntimePoolLifecycle `json:"lifecycle,omitempty"`
+
+	// AdmissionState is the authoritative admission gate for new RuntimeSessions.
+	// +optional
+	AdmissionState RuntimePoolAdmissionState `json:"admissionState,omitempty"`
+
+	// ActiveInstance is the exact selected Pod and supervisor boot. It is empty
+	// unless one instance has been authoritatively selected.
+	// +optional
+	ActiveInstance *RuntimePoolActiveInstanceStatus `json:"activeInstance,omitempty"`
+
+	// Capacity reports effective limits, use, and queued demand.
+	// +optional
+	Capacity RuntimePoolCapacityStatus `json:"capacity,omitempty"`
+
+	// Message contains bounded, sanitized reconciliation context.
+	// +kubebuilder:validation:MaxLength=1024
+	// +optional
+	Message string `json:"message,omitempty"`
+
+	// Conditions report admission, Pod Security, quota, scheduling, rollout, and
+	// other controller-observed failures.
+	// +listType=map
+	// +listMapKey=type
+	// +optional
+	Conditions []metav1.Condition `json:"conditions,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:resource:scope=Namespaced,shortName=rtpool
+// +kubebuilder:printcolumn:name="Lifecycle",type=string,JSONPath=`.status.lifecycle`
+// +kubebuilder:printcolumn:name="Admission",type=string,JSONPath=`.status.admissionState`
+// +kubebuilder:printcolumn:name="Desired",type=integer,JSONPath=`.status.desiredReplicas`
+// +kubebuilder:printcolumn:name="Current",type=integer,JSONPath=`.status.currentReplicas`
+// +kubebuilder:printcolumn:name="Sessions",type=integer,JSONPath=`.status.capacity.residentSessions`
+// +kubebuilder:printcolumn:name="Prompts",type=integer,JSONPath=`.status.capacity.runningPrompts`
+// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
+
+// RuntimePool is the Schema for controller-owned ACP runtime pools.
+type RuntimePool struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   RuntimePoolSpec   `json:"spec,omitempty"`
+	Status RuntimePoolStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// RuntimePoolList contains a list of RuntimePool.
+type RuntimePoolList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []RuntimePool `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&RuntimePool{}, &RuntimePoolList{})
+}
diff --git a/api/v1alpha1/runtime_pool_types_test.go b/api/v1alpha1/runtime_pool_types_test.go
new file mode 100644
index 000000000..12eac9252
--- /dev/null
+++ b/api/v1alpha1/runtime_pool_types_test.go
@@ -0,0 +1,183 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package v1alpha1
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func TestRuntimePoolDefaultConstants(t *testing.T) {
+	if DefaultRuntimePoolDesiredReplicas != 0 {
+		t.Fatalf("DefaultRuntimePoolDesiredReplicas = %d, want 0", DefaultRuntimePoolDesiredReplicas)
+	}
+	if DefaultRuntimePoolMaxResidentSessions != 10 {
+		t.Fatalf("DefaultRuntimePoolMaxResidentSessions = %d, want 10", DefaultRuntimePoolMaxResidentSessions)
+	}
+	if DefaultRuntimePoolMaxRunningPrompts != 4 {
+		t.Fatalf("DefaultRuntimePoolMaxRunningPrompts = %d, want 4", DefaultRuntimePoolMaxRunningPrompts)
+	}
+	if DefaultRuntimePoolColdStartTimeoutSeconds != 120 {
+		t.Fatalf("DefaultRuntimePoolColdStartTimeoutSeconds = %d, want 120", DefaultRuntimePoolColdStartTimeoutSeconds)
+	}
+}
+
+func TestRuntimePoolLifecycleConstants(t *testing.T) {
+	tests := []struct {
+		got  RuntimePoolLifecycle
+		want string
+	}{
+		{RuntimePoolLifecycleStopped, "Stopped"},
+		{RuntimePoolLifecycleStarting, "Starting"},
+		{RuntimePoolLifecycleServing, "Serving"},
+		{RuntimePoolLifecycleDraining, "Draining"},
+		{RuntimePoolLifecycleQuiescent, "Quiescent"},
+		{RuntimePoolLifecycleStopping, "Stopping"},
+		{RuntimePoolLifecycleDegraded, "Degraded"},
+		{RuntimePoolLifecycleAmbiguous, "Ambiguous"},
+	}
+	for _, tt := range tests {
+		if string(tt.got) != tt.want {
+			t.Errorf("RuntimePoolLifecycle = %q, want %q", tt.got, tt.want)
+		}
+	}
+}
+
+func TestRuntimePoolFieldsRoundTrip(t *testing.T) {
+	digest := "sha256:" + strings.Repeat("a", 64)
+	pool := RuntimePool{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: GroupVersion.String(),
+			Kind:       "RuntimePool",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "codex-default",
+			Namespace: "tenant-a",
+		},
+		Spec: RuntimePoolSpec{
+			TrustDomain: RuntimePoolTrustDomain{
+				Namespace: "tenant-a",
+				Identity:  "tenant-a/default",
+			},
+			RuntimeNamespace: "orka-runtimes",
+			Runtime: RuntimePoolRuntimeSpec{
+				Image: "docker.io/example/acp-runtime@" + digest,
+				Profile: RuntimePoolProfileSpec{
+					ProtocolVersion:     RuntimePoolProtocolHarnessV2,
+					Digest:              digest,
+					DigestSchemaVersion: "v1",
+					ResourceClass:       "standard",
+				},
+			},
+			DesiredReplicas: 1,
+			Capacity: &RuntimePoolCapacitySpec{
+				MaxResidentSessions: 10,
+				MaxRunningPrompts:   4,
+			},
+			ColdStartTimeoutSeconds: 120,
+		},
+		Status: RuntimePoolStatus{
+			ObservedGeneration: 3,
+			ControllerEpoch:    9,
+			DesiredReplicas:    1,
+			CurrentReplicas:    1,
+			Lifecycle:          RuntimePoolLifecycleServing,
+			AdmissionState:     RuntimePoolAdmissionAccepting,
+			ActiveInstance: &RuntimePoolActiveInstanceStatus{
+				PodNamespace:               "orka-runtimes",
+				PodName:                    "codex-default-0",
+				PodAddress:                 "10.0.0.42",
+				PodUID:                     "11111111-2222-3333-4444-555555555555",
+				BootID:                     "boot-1",
+				RuntimeInstanceID:          "runtime-instance-1",
+				ControllerEpoch:            9,
+				ProtocolVersion:            RuntimePoolProtocolHarnessV2,
+				ProfileDigest:              digest,
+				ProfileDigestSchemaVersion: "v1",
+			},
+			Capacity: RuntimePoolCapacityStatus{
+				MaxResidentSessions: 10,
+				MaxRunningPrompts:   4,
+				ResidentSessions:    3,
+				RunningPrompts:      2,
+				QueuedTasks:         5,
+				ReservedSessions:    1,
+				ReservedPrompts:     1,
+				Reservations: []RuntimePoolCapacityReservationStatus{{
+					PoolUID: "pool-uid", TaskUID: "task-uid", Attempt: 1, ControllerEpoch: 9,
+					RuntimeInstanceID: "runtime-instance-1", ResidentSlots: 1, PromptSlots: 1,
+					ReservedAt: metav1.NewTime(time.Date(2026, 7, 25, 12, 0, 0, 0, time.UTC)),
+					ExpiresAt:  metav1.NewTime(time.Date(2026, 7, 25, 12, 2, 0, 0, time.UTC)),
+				}},
+			},
+			Conditions: []metav1.Condition{{
+				Type:   RuntimePoolConditionAdmissionReady,
+				Status: "True",
+				Reason: "Serving",
+			}},
+		},
+	}
+
+	encoded, err := json.Marshal(&pool)
+	if err != nil {
+		t.Fatalf("json.Marshal(RuntimePool): %v", err)
+	}
+	var decoded RuntimePool
+	if err := json.Unmarshal(encoded, &decoded); err != nil {
+		t.Fatalf("json.Unmarshal(RuntimePool): %v", err)
+	}
+
+	if decoded.Spec.TrustDomain.Identity != pool.Spec.TrustDomain.Identity {
+		t.Errorf("trust domain identity = %q, want %q", decoded.Spec.TrustDomain.Identity, pool.Spec.TrustDomain.Identity)
+	}
+	if decoded.Status.ActiveInstance == nil {
+		t.Fatal("active instance was lost during JSON round trip")
+	}
+	if decoded.Status.ActiveInstance.RuntimeInstanceID != "runtime-instance-1" {
+		t.Errorf("runtime instance ID = %q, want runtime-instance-1", decoded.Status.ActiveInstance.RuntimeInstanceID)
+	}
+	if decoded.Status.Capacity.QueuedTasks != 5 {
+		t.Errorf("queued tasks = %d, want 5", decoded.Status.Capacity.QueuedTasks)
+	}
+	if len(decoded.Status.Capacity.Reservations) != 1 || decoded.Status.Capacity.Reservations[0].TaskUID != "task-uid" || decoded.Status.Capacity.ReservedPrompts != 1 {
+		t.Fatalf("capacity reservations = %#v", decoded.Status.Capacity)
+	}
+}
+
+func TestRuntimePoolReservationDeepCopy(t *testing.T) {
+	pool := &RuntimePool{Status: RuntimePoolStatus{Capacity: RuntimePoolCapacityStatus{
+		Reservations: []RuntimePoolCapacityReservationStatus{{
+			PoolUID: "pool-uid", TaskUID: "task-uid", Attempt: 1, ControllerEpoch: 1, RuntimeInstanceID: "instance",
+			ResidentSlots: 1, PromptSlots: 1, ReservedAt: metav1.Now(), ExpiresAt: metav1.Now(),
+		}},
+	}}}
+	copy := pool.DeepCopy()
+	copy.Status.Capacity.Reservations[0].TaskUID = "changed"
+	if pool.Status.Capacity.Reservations[0].TaskUID != "task-uid" {
+		t.Fatal("RuntimePool DeepCopy aliased capacity reservations")
+	}
+}
+
+func TestRuntimePoolRegisteredWithScheme(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := AddToScheme(scheme); err != nil {
+		t.Fatalf("AddToScheme: %v", err)
+	}
+
+	obj, err := scheme.New(GroupVersion.WithKind("RuntimePool"))
+	if err != nil {
+		t.Fatalf("scheme.New(RuntimePool): %v", err)
+	}
+	if _, ok := obj.(*RuntimePool); !ok {
+		t.Fatalf("scheme.New(RuntimePool) returned %T", obj)
+	}
+}
diff --git a/api/v1alpha1/runtime_session_control_types.go b/api/v1alpha1/runtime_session_control_types.go
new file mode 100644
index 000000000..f967260a2
--- /dev/null
+++ b/api/v1alpha1/runtime_session_control_types.go
@@ -0,0 +1,213 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+// RuntimeSessionControlLifecycle is the durable RuntimeSession lifecycle.
+// +kubebuilder:validation:Enum=Creating;Idle;PromptRunning;Validating;PreparingPublication;PublicationPrepared;Publishing;Verifying;Finalizing;Cancelling;Poisoned;Deleting;Deleted
+type RuntimeSessionControlLifecycle string
+
+// RuntimeSessionControlAvailability gates the Session mutation lease.
+// +kubebuilder:validation:Enum=Available;ReconciliationBlocked
+type RuntimeSessionControlAvailability string
+
+// RuntimeSessionLineageStatus is the Kubernetes-authoritative, append-once
+// protocol/runtime identity for one conversation Session. Generation is
+// independent from mutation-lease and ACP RuntimeSession generations.
+type RuntimeSessionLineageStatus struct {
+	// NamespaceUID prevents a same-name recreated namespace from attaching to
+	// durable state owned by the previous namespace identity.
+	NamespaceUID types.UID `json:"namespaceUID"`
+
+	// SessionUID repeats the immutable control identity at the lineage fence.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	SessionUID string `json:"sessionUid"`
+
+	ContractVersion AgentRuntimeContractVersion `json:"contractVersion"`
+
+	// +kubebuilder:validation:Minimum=1
+	Generation int64 `json:"generation"`
+
+	// RuntimeIdentity is the built-in runtime type or AgentRuntime UID.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	RuntimeIdentity string `json:"runtimeIdentity"`
+
+	// ConfigDigest freezes the configuration/execution-snapshot identity used
+	// when the lineage was established.
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	ConfigDigest string `json:"configDigest"`
+
+	EstablishedAt metav1.Time `json:"establishedAt"`
+}
+
+// RuntimeSessionControlSpec contains immutable session identity, ownership, and
+// profile bindings. Profile changes create a new session generation in status;
+// they do not mutate this immutable record identity.
+// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="runtime session control spec is immutable"
+type RuntimeSessionControlSpec struct {
+	// SessionName is the immutable user-visible Session key within the object
+	// namespace. The Kubernetes object name is a digest-derived storage key and
+	// must not be treated as the Session name.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	SessionName string `json:"sessionName"`
+
+	// SessionUID is the immutable Orka Session identity.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	SessionUID string `json:"sessionUid"`
+
+	// RequestDigest binds creation to exact canonical input.
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	RequestDigest string `json:"requestDigest"`
+
+	// Owner identifies the immutable Task or durable Session owner.
+	Owner ControlRecordOwner `json:"owner"`
+
+	// RuntimePoolRef is the controller-owned logical pool name when known.
+	// +optional
+	// +kubebuilder:validation:MaxLength=253
+	RuntimePoolRef string `json:"runtimePoolRef,omitempty"`
+
+	// RuntimePoolUID fences the pool object across delete/recreate.
+	// +optional
+	// +kubebuilder:validation:MaxLength=1024
+	RuntimePoolUID string `json:"runtimePoolUid,omitempty"`
+
+	// RuntimeProfileDigest binds the session to immutable runtime behavior.
+	// +optional
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	RuntimeProfileDigest string `json:"runtimeProfileDigest,omitempty"`
+
+	// ProfileDigestSchemaVersion identifies how RuntimeProfileDigest was built.
+	// +optional
+	// +kubebuilder:validation:MaxLength=64
+	ProfileDigestSchemaVersion string `json:"profileDigestSchemaVersion,omitempty"`
+}
+
+// RuntimeSessionMutationLeaseStatus mirrors the namespaced Kubernetes Lease
+// that serializes mutation for one immutable SessionUID.
+type RuntimeSessionMutationLeaseStatus struct {
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	LeaseName string `json:"leaseName"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=64
+	LeaseResourceVersion string `json:"leaseResourceVersion"`
+
+	// +kubebuilder:validation:Minimum=1
+	Generation int64 `json:"generation"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	TaskUID string `json:"taskUid"`
+
+	// +kubebuilder:validation:Minimum=1
+	Attempt int64 `json:"attempt"`
+
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	PromptID string `json:"promptId"`
+
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	RequestDigest string `json:"requestDigest"`
+
+	AcquiredAt metav1.Time `json:"acquiredAt"`
+
+	// +optional
+	ExpiresAt *metav1.Time `json:"expiresAt,omitempty"`
+}
+
+// RuntimeSessionControlStatus contains the lifecycle, generation, mutation
+// Lease, and independently verified recovery baseline.
+// +kubebuilder:validation:XValidation:rule="!has(self.availability) || self.availability != 'Available' || ((!has(self.blockedReason) || size(self.blockedReason) == 0) && (!has(self.relatedPromptAttemptId) || size(self.relatedPromptAttemptId) == 0) && (!has(self.relatedPublicationId) || size(self.relatedPublicationId) == 0))",message="available sessions must clear reconciliation block metadata"
+// +kubebuilder:validation:XValidation:rule="!has(self.availability) || self.availability != 'ReconciliationBlocked' || (has(self.blockedReason) && size(self.blockedReason) > 0)",message="reconciliation-blocked sessions require a reason"
+// +kubebuilder:validation:XValidation:rule="!has(oldSelf.lineage) || (has(self.lineage) && self.lineage == oldSelf.lineage)",message="runtime Session lineage is append-once and immutable"
+type RuntimeSessionControlStatus struct {
+	// Generation is the monotonic ACP RuntimeSession generation.
+	// +optional
+	// +kubebuilder:validation:Minimum=1
+	Generation int64 `json:"generation,omitempty"`
+
+	// +optional
+	Lifecycle RuntimeSessionControlLifecycle `json:"lifecycle,omitempty"`
+
+	// +optional
+	Availability RuntimeSessionControlAvailability `json:"availability,omitempty"`
+
+	// MutationLeaseGeneration is monotonic and never reused for SessionUID.
+	// +optional
+	// +kubebuilder:validation:Minimum=0
+	MutationLeaseGeneration int64 `json:"mutationLeaseGeneration,omitempty"`
+
+	// +optional
+	MutationLease *RuntimeSessionMutationLeaseStatus `json:"mutationLease,omitempty"`
+
+	// +optional
+	// +kubebuilder:validation:MaxLength=16384
+	BlockedReason string `json:"blockedReason,omitempty"`
+
+	// +optional
+	// +kubebuilder:validation:MaxLength=1024
+	RelatedPromptAttemptID string `json:"relatedPromptAttemptId,omitempty"`
+
+	// +optional
+	// +kubebuilder:validation:MaxLength=1024
+	RelatedPublicationID string `json:"relatedPublicationId,omitempty"`
+
+	// +optional
+	VerifiedBaseline *ControlVerifiedBranchBaseline `json:"verifiedBaseline,omitempty"`
+
+	// Lineage is established or verified in the same RuntimeSessionControl
+	// status CAS that mirrors the authoritative mutation Lease.
+	// +optional
+	Lineage *RuntimeSessionLineageStatus `json:"lineage,omitempty"`
+
+	ControlRecordMutationStatus `json:",inline"`
+}
+
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:resource:scope=Namespaced,shortName=rsctrl
+// +kubebuilder:printcolumn:name="Lifecycle",type=string,JSONPath=`.status.lifecycle`
+// +kubebuilder:printcolumn:name="Availability",type=string,JSONPath=`.status.availability`
+// +kubebuilder:printcolumn:name="Generation",type=integer,JSONPath=`.status.generation`
+// +kubebuilder:printcolumn:name="Lease",type=integer,JSONPath=`.status.mutationLeaseGeneration`
+// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
+// +kubebuilder:validation:XValidation:rule="!has(self.status) || !has(self.status.lineage) || self.status.lineage.sessionUid == self.spec.sessionUid",message="runtime Session lineage UID must match the immutable control Session UID"
+
+// RuntimeSessionControl is the Kubernetes-authoritative RuntimeSession control
+// record. SessionTurn/transcript/deferred-outbox data remains in one durable
+// SQLite transaction; the Kubernetes store completes the authoritative
+// SessionControl/BranchClaim CAS before activating the terminal projection.
+type RuntimeSessionControl struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   RuntimeSessionControlSpec   `json:"spec"`
+	Status RuntimeSessionControlStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// RuntimeSessionControlList contains a list of RuntimeSessionControl.
+type RuntimeSessionControlList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []RuntimeSessionControl `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&RuntimeSessionControl{}, &RuntimeSessionControlList{})
+}
diff --git a/api/v1alpha1/task_runtime_types.go b/api/v1alpha1/task_runtime_types.go
new file mode 100644
index 000000000..bde4676ca
--- /dev/null
+++ b/api/v1alpha1/task_runtime_types.go
@@ -0,0 +1,432 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package v1alpha1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// WorkspaceIntent declares whether an agent workspace is immutable read-only
+// input or may produce a validated publication artifact. Agent Tasks that omit
+// intent are interpreted as read by controller logic; container Task behavior
+// is unchanged when intent is omitted.
+// +kubebuilder:validation:Enum=read;write
+type WorkspaceIntent string
+
+const (
+	WorkspaceIntentRead  WorkspaceIntent = "read"
+	WorkspaceIntentWrite WorkspaceIntent = "write"
+)
+
+// WorkspaceCredentialReference references a Secret in the Task namespace. The
+// controller freezes the Secret resourceVersion when it reserves an attempt;
+// Secret contents are never copied to Task status.
+type WorkspaceCredentialReference struct {
+	// Name is the name of the Secret in the Task namespace.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
+	Name string `json:"name"`
+
+	// Key is the Secret data key containing one bearer token or one complete
+	// Authorization header. It defaults to "token" when omitted.
+	// +optional
+	// +kubebuilder:default=token
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	// +kubebuilder:validation:Pattern=`^[A-Za-z0-9._-]+$`
+	Key string `json:"key,omitempty"`
+}
+
+// RepositoryIdentity is the canonical identity derived from a credential-free
+// repository URL. It is used for ownership, BranchClaim, and publication
+// reconciliation decisions without persisting credentials.
+type RepositoryIdentity struct {
+	// Provider identifies the source-control provider or forge.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=63
+	// +kubebuilder:validation:Pattern=`^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$`
+	Provider string `json:"provider"`
+
+	// ID is the canonical credential-free URL identity and must match the
+	// corresponding repository URL after normalization. For GitHub, use
+	// "github.com/owner/repo"; GitHub GraphQL node IDs are not accepted.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=512
+	ID string `json:"id"`
+}
+
+// TaskExecutionState is the durable execution state of one Task attempt.
+// +kubebuilder:validation:Enum=Queued;Reserved;SessionStarting;Planned;Submitting;SubmittedUnknown;Accepted;Running;Settling;Succeeded;Failed;Cancelled;OutcomeUnknown
+type TaskExecutionState string
+
+const (
+	TaskExecutionStateQueued           TaskExecutionState = "Queued"
+	TaskExecutionStateReserved         TaskExecutionState = "Reserved"
+	TaskExecutionStateSessionStarting  TaskExecutionState = "SessionStarting"
+	TaskExecutionStatePlanned          TaskExecutionState = "Planned"
+	TaskExecutionStateSubmitting       TaskExecutionState = "Submitting"
+	TaskExecutionStateSubmittedUnknown TaskExecutionState = "SubmittedUnknown"
+	TaskExecutionStateAccepted         TaskExecutionState = "Accepted"
+	TaskExecutionStateRunning          TaskExecutionState = "Running"
+	TaskExecutionStateSettling         TaskExecutionState = "Settling"
+	TaskExecutionStateSucceeded        TaskExecutionState = "Succeeded"
+	TaskExecutionStateFailed           TaskExecutionState = "Failed"
+	TaskExecutionStateCancelled        TaskExecutionState = "Cancelled"
+	TaskExecutionStateOutcomeUnknown   TaskExecutionState = "OutcomeUnknown"
+)
+
+// TaskExecutionOutcome is the terminal classification of one Task attempt.
+// OutcomeUnknown is terminal and must never be treated as generic retryable
+// failure by controller logic.
+// +kubebuilder:validation:Enum=Succeeded;Failed;Cancelled;OutcomeUnknown
+type TaskExecutionOutcome string
+
+const (
+	TaskExecutionOutcomeSucceeded      TaskExecutionOutcome = "Succeeded"
+	TaskExecutionOutcomeFailed         TaskExecutionOutcome = "Failed"
+	TaskExecutionOutcomeCancelled      TaskExecutionOutcome = "Cancelled"
+	TaskExecutionOutcomeOutcomeUnknown TaskExecutionOutcome = "OutcomeUnknown"
+)
+
+// TaskExecutionReason is a bounded machine-readable execution reason.
+// +kubebuilder:validation:MaxLength=128
+// +kubebuilder:validation:Pattern=`^[A-Za-z][A-Za-z0-9._-]{0,127}$`
+type TaskExecutionReason string
+
+const (
+	// TaskExecutionReasonAtCapacity is a scheduling reason, not a terminal Task phase.
+	TaskExecutionReasonAtCapacity TaskExecutionReason = "AtCapacity"
+	// TaskExecutionReasonRuntimeLost classifies accepted or running work lost with
+	// an unprovable terminal result; its outcome must be OutcomeUnknown.
+	TaskExecutionReasonRuntimeLost TaskExecutionReason = "RuntimeLost"
+)
+
+// TaskExecutionStatus is the structured execution lifecycle for the current
+// Task attempt. The existing top-level Task phase remains the compatibility
+// projection and is not replaced by this status.
+// +kubebuilder:validation:XValidation:rule="!has(self.outcome) || (has(self.state) && self.state == self.outcome)",message="execution outcome requires the matching terminal state"
+// +kubebuilder:validation:XValidation:rule="!has(self.state) || !(self.state in ['Succeeded', 'Failed', 'Cancelled', 'OutcomeUnknown']) || has(self.outcome)",message="terminal execution state requires an outcome"
+type TaskExecutionStatus struct {
+	// State is the current durable execution state.
+	// +optional
+	State TaskExecutionState `json:"state,omitempty"`
+
+	// Outcome is set only after execution reaches a terminal classification.
+	// +optional
+	Outcome TaskExecutionOutcome `json:"outcome,omitempty"`
+
+	// Reason is a stable machine-readable explanation for State or Outcome.
+	// +optional
+	Reason TaskExecutionReason `json:"reason,omitempty"`
+
+	// Attempt is the one-based Task execution attempt represented by this status.
+	// +kubebuilder:validation:Minimum=1
+	// +optional
+	Attempt int32 `json:"attempt,omitempty"`
+
+	// PromptID is the durable prompt identity used for submission and settlement.
+	// +kubebuilder:validation:MaxLength=253
+	// +optional
+	PromptID string `json:"promptID,omitempty"`
+
+	// RuntimePoolName is the namespaced logical pool selected for this attempt.
+	// +kubebuilder:validation:MaxLength=253
+	// +optional
+	RuntimePoolName string `json:"runtimePoolName,omitempty"`
+
+	// RuntimePoolUID is the immutable pool UID fenced into runtime requests.
+	// +kubebuilder:validation:MaxLength=253
+	// +optional
+	RuntimePoolUID string `json:"runtimePoolUID,omitempty"`
+
+	// AgentRuntimeName is the namespaced external orka.harness.v2 registration
+	// selected for this attempt. It is mutually exclusive with RuntimePoolName.
+	// +kubebuilder:validation:MaxLength=253
+	// +optional
+	AgentRuntimeName string `json:"agentRuntimeName,omitempty"`
+
+	// AgentRuntimeUID is the immutable external AgentRuntime UID fenced into the
+	// attempt selection.
+	// +kubebuilder:validation:MaxLength=253
+	// +optional
+	AgentRuntimeUID string `json:"agentRuntimeUID,omitempty"`
+
+	// RuntimeInstanceID is the exact selected supervisor Pod UID plus boot identity.
+	// +kubebuilder:validation:MaxLength=512
+	// +optional
+	RuntimeInstanceID string `json:"runtimeInstanceID,omitempty"`
+
+	// RuntimeSessionUID is the stable controller-owned Session execution identity.
+	// +kubebuilder:validation:MaxLength=253
+	// +optional
+	RuntimeSessionUID string `json:"runtimeSessionUID,omitempty"`
+
+	// RuntimeSessionGeneration is the monotonic profile/session generation.
+	// +kubebuilder:validation:Minimum=0
+	// +optional
+	RuntimeSessionGeneration int64 `json:"runtimeSessionGeneration,omitempty"`
+
+	// RuntimeSessionSupervisorBootID freezes the supervisor boot that owns a
+	// pending or reusable Session generation.
+	// +kubebuilder:validation:MaxLength=512
+	// +optional
+	RuntimeSessionSupervisorBootID string `json:"runtimeSessionSupervisorBootID,omitempty"`
+
+	// RuntimeSessionProfileDigest freezes the immutable runtime behavior bound to
+	// a pending or reusable Session generation.
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	// +optional
+	RuntimeSessionProfileDigest string `json:"runtimeSessionProfileDigest,omitempty"`
+
+	// RuntimeSessionMCPDigest binds the complete non-secret effective MCP policy
+	// and descriptor configuration to a pending or reusable Session generation.
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	// +optional
+	RuntimeSessionMCPDigest string `json:"runtimeSessionMCPDigest,omitempty"`
+
+	// RuntimeSessionWorkspaceDigest binds a reusable Session generation to the
+	// exact repository, source ref, verified baseline, intent, and relative root.
+	// It contains no credential material.
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	// +optional
+	RuntimeSessionWorkspaceDigest string `json:"runtimeSessionWorkspaceDigest,omitempty"`
+
+	// RuntimeSessionRecreationPending records that the exact generation is being
+	// created or replaced and must be reconciled before a different request may
+	// reuse that identity.
+	// +optional
+	RuntimeSessionRecreationPending bool `json:"runtimeSessionRecreationPending,omitempty"`
+
+	// RuntimeSessionCleanupDigest is the controller-owned proof that the exact
+	// RuntimeSession requiring retirement was deleted or its immutable runtime
+	// instance was replaced. Users may read but cannot mutate the Task status subresource.
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	// +optional
+	RuntimeSessionCleanupDigest string `json:"runtimeSessionCleanupDigest,omitempty"`
+
+	// RequestDigest is the canonical immutable prompt request digest.
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	// +optional
+	RequestDigest string `json:"requestDigest,omitempty"`
+
+	// ControllerEpoch is the durable controller epoch fencing this attempt.
+	// +kubebuilder:validation:Minimum=0
+	// +optional
+	ControllerEpoch int64 `json:"controllerEpoch,omitempty"`
+
+	// ReadCredentialResourceVersion freezes the read credential Secret version
+	// selected at reservation without exposing credential material.
+	// +optional
+	// +kubebuilder:validation:MaxLength=253
+	ReadCredentialResourceVersion string `json:"readCredentialResourceVersion,omitempty"`
+
+	// PublicationReadCredentialResourceVersion freezes the target-read Secret
+	// version used for preflight and independent verification.
+	// +optional
+	// +kubebuilder:validation:MaxLength=253
+	PublicationReadCredentialResourceVersion string `json:"publicationReadCredentialResourceVersion,omitempty"`
+
+	// PublicationCredentialResourceVersion freezes the target-write Secret
+	// version selected at reservation without exposing credential material.
+	// +optional
+	// +kubebuilder:validation:MaxLength=253
+	PublicationCredentialResourceVersion string `json:"publicationCredentialResourceVersion,omitempty"`
+
+	// ForgeCredentialResourceVersion freezes the forge-only Secret version used
+	// for pull request reconciliation.
+	// +optional
+	// +kubebuilder:validation:MaxLength=253
+	ForgeCredentialResourceVersion string `json:"forgeCredentialResourceVersion,omitempty"`
+
+	// Message contains bounded, sanitized execution context.
+	// +kubebuilder:validation:MaxLength=1024
+	// +optional
+	Message string `json:"message,omitempty"`
+
+	// LastTransitionTime is the last durable execution-state transition time.
+	// +optional
+	LastTransitionTime *metav1.Time `json:"lastTransitionTime,omitempty"`
+}
+
+// TaskDeliveryState is the durable validation and publication lifecycle.
+// +kubebuilder:validation:Enum=NotRequested;Validating;Preparing;Prepared;Publishing;Verifying;VerifiedExact;DeliveredSuperseded;ReadValidated;NoChange;CancelledBeforePublish;ReadOnlyWorkspaceModified;DeliveryConflict;CredentialBlocked;PublicationOutcomeUnknown
+type TaskDeliveryState string
+
+const (
+	TaskDeliveryStateNotRequested              TaskDeliveryState = "NotRequested"
+	TaskDeliveryStateValidating                TaskDeliveryState = "Validating"
+	TaskDeliveryStatePreparing                 TaskDeliveryState = "Preparing"
+	TaskDeliveryStatePrepared                  TaskDeliveryState = "Prepared"
+	TaskDeliveryStatePublishing                TaskDeliveryState = "Publishing"
+	TaskDeliveryStateVerifying                 TaskDeliveryState = "Verifying"
+	TaskDeliveryStateVerifiedExact             TaskDeliveryState = "VerifiedExact"
+	TaskDeliveryStateDeliveredSuperseded       TaskDeliveryState = "DeliveredSuperseded"
+	TaskDeliveryStateReadValidated             TaskDeliveryState = "ReadValidated"
+	TaskDeliveryStateNoChange                  TaskDeliveryState = "NoChange"
+	TaskDeliveryStateCancelledBeforePublish    TaskDeliveryState = "CancelledBeforePublish"
+	TaskDeliveryStateReadOnlyWorkspaceModified TaskDeliveryState = "ReadOnlyWorkspaceModified"
+	TaskDeliveryStateDeliveryConflict          TaskDeliveryState = "DeliveryConflict"
+	TaskDeliveryStateCredentialBlocked         TaskDeliveryState = "CredentialBlocked"
+	TaskDeliveryStatePublicationOutcomeUnknown TaskDeliveryState = "PublicationOutcomeUnknown"
+)
+
+// TaskDeliveryOutcome is the terminal delivery classification.
+// +kubebuilder:validation:Enum=NotRequested;VerifiedExact;DeliveredSuperseded;ReadValidated;NoChange;CancelledBeforePublish;ReadOnlyWorkspaceModified;DeliveryConflict;CredentialBlocked;PublicationOutcomeUnknown
+type TaskDeliveryOutcome string
+
+const (
+	TaskDeliveryOutcomeNotRequested              TaskDeliveryOutcome = "NotRequested"
+	TaskDeliveryOutcomeVerifiedExact             TaskDeliveryOutcome = "VerifiedExact"
+	TaskDeliveryOutcomeDeliveredSuperseded       TaskDeliveryOutcome = "DeliveredSuperseded"
+	TaskDeliveryOutcomeReadValidated             TaskDeliveryOutcome = "ReadValidated"
+	TaskDeliveryOutcomeNoChange                  TaskDeliveryOutcome = "NoChange"
+	TaskDeliveryOutcomeCancelledBeforePublish    TaskDeliveryOutcome = "CancelledBeforePublish"
+	TaskDeliveryOutcomeReadOnlyWorkspaceModified TaskDeliveryOutcome = "ReadOnlyWorkspaceModified"
+	TaskDeliveryOutcomeDeliveryConflict          TaskDeliveryOutcome = "DeliveryConflict"
+	TaskDeliveryOutcomeCredentialBlocked         TaskDeliveryOutcome = "CredentialBlocked"
+	TaskDeliveryOutcomePublicationOutcomeUnknown TaskDeliveryOutcome = "PublicationOutcomeUnknown"
+)
+
+// TaskDeliveryReason is a bounded machine-readable delivery reason.
+// +kubebuilder:validation:MaxLength=128
+// +kubebuilder:validation:Pattern=`^[A-Za-z][A-Za-z0-9._-]{0,127}$`
+type TaskDeliveryReason string
+
+const (
+	// TaskDeliveryReasonCancellationRequestedAfterPublish records that publication
+	// won the durable CAS and must continue reconciliation despite cancellation.
+	TaskDeliveryReasonCancellationRequestedAfterPublish TaskDeliveryReason = "CancellationRequestedAfterPublish"
+)
+
+// TaskPullRequestReceipt is the bounded, non-secret receipt for an explicitly
+// requested pull request reconciliation.
+type TaskPullRequestReceipt struct {
+	// ID is the provider's durable pull request identifier.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=512
+	ID string `json:"id"`
+
+	// Number is the provider's numeric pull request number when available.
+	// +kubebuilder:validation:Minimum=1
+	// +optional
+	Number int64 `json:"number,omitempty"`
+
+	// URL is the canonical user-facing pull request URL. It must not contain credentials.
+	// +kubebuilder:validation:MaxLength=2048
+	// +optional
+	URL string `json:"url,omitempty"`
+
+	// State is the provider-observed pull request state.
+	// +kubebuilder:validation:MaxLength=64
+	// +optional
+	State string `json:"state,omitempty"`
+
+	// BaseBranch is the reconciled pull request base branch.
+	// +kubebuilder:validation:MaxLength=255
+	// +optional
+	BaseBranch string `json:"baseBranch,omitempty"`
+
+	// HeadBranch is the reconciled pull request head branch.
+	// +kubebuilder:validation:MaxLength=255
+	// +optional
+	HeadBranch string `json:"headBranch,omitempty"`
+
+	// HeadSHA is the exact observed pull request head commit.
+	// +kubebuilder:validation:Pattern=`^([a-f0-9]{40}|[a-f0-9]{64})$`
+	// +optional
+	HeadSHA string `json:"headSHA,omitempty"`
+}
+
+// TaskDeliveryStatus is the structured validation/publication status and its
+// durable, non-secret receipt.
+// +kubebuilder:validation:XValidation:rule="!has(self.outcome) || (has(self.state) && self.state == self.outcome)",message="delivery outcome requires the matching terminal state"
+// +kubebuilder:validation:XValidation:rule="!has(self.state) || !(self.state in ['NotRequested', 'VerifiedExact', 'DeliveredSuperseded', 'ReadValidated', 'NoChange', 'CancelledBeforePublish', 'ReadOnlyWorkspaceModified', 'DeliveryConflict', 'CredentialBlocked', 'PublicationOutcomeUnknown']) || has(self.outcome)",message="terminal delivery state requires an outcome"
+type TaskDeliveryStatus struct {
+	// State is the current durable delivery state.
+	// +optional
+	State TaskDeliveryState `json:"state,omitempty"`
+
+	// Outcome is set only after delivery reaches a terminal classification.
+	// +optional
+	Outcome TaskDeliveryOutcome `json:"outcome,omitempty"`
+
+	// Reason is a stable machine-readable explanation for State or Outcome.
+	// +optional
+	Reason TaskDeliveryReason `json:"reason,omitempty"`
+
+	// PublicationID is the durable identity reused for reconciliation of the same artifact.
+	// +kubebuilder:validation:MaxLength=253
+	// +kubebuilder:validation:Pattern=`^[A-Za-z0-9][A-Za-z0-9._:-]{0,252}$`
+	// +optional
+	PublicationID string `json:"publicationID,omitempty"`
+
+	// SourceRepository is the canonical repository from which the workspace baseline was created.
+	// +optional
+	SourceRepository *RepositoryIdentity `json:"sourceRepository,omitempty"`
+
+	// PublicationRepository is the canonical repository whose branch was reconciled.
+	// +optional
+	PublicationRepository *RepositoryIdentity `json:"publicationRepository,omitempty"`
+
+	// Branch is the publication branch without a refs/heads/ prefix.
+	// +kubebuilder:validation:MaxLength=255
+	// +optional
+	Branch string `json:"branch,omitempty"`
+
+	// StartingSHA is the verified source baseline before prompt execution.
+	// +kubebuilder:validation:Pattern=`^([a-f0-9]{40}|[a-f0-9]{64})$`
+	// +optional
+	StartingSHA string `json:"startingSHA,omitempty"`
+
+	// RemoteBeforeSHA is the exact publication ref observed before the CAS push.
+	// Nil means not yet observed; a pointer to the empty string records explicit
+	// absence; a non-empty value records the observed object ID.
+	// +kubebuilder:validation:Pattern=`^(|[a-f0-9]{40}|[a-f0-9]{64})$`
+	// +optional
+	RemoteBeforeSHA *string `json:"remoteBeforeSHA,omitempty"`
+
+	// TreeSHA is the deterministic clean-room tree written by the publisher.
+	// +kubebuilder:validation:Pattern=`^([a-f0-9]{40}|[a-f0-9]{64})$`
+	// +optional
+	TreeSHA string `json:"treeSHA,omitempty"`
+
+	// ExpectedCommitSHA is the exact Orka-owned commit prepared for publication.
+	// +kubebuilder:validation:Pattern=`^([a-f0-9]{40}|[a-f0-9]{64})$`
+	// +optional
+	ExpectedCommitSHA string `json:"expectedCommitSHA,omitempty"`
+
+	// VerifiedRemoteSHA is the independently observed remote branch head.
+	// +kubebuilder:validation:Pattern=`^([a-f0-9]{40}|[a-f0-9]{64})$`
+	// +optional
+	VerifiedRemoteSHA string `json:"verifiedRemoteSHA,omitempty"`
+
+	// SupersedingRemoteSHA is the verified descendant that superseded ExpectedCommitSHA.
+	// +kubebuilder:validation:Pattern=`^([a-f0-9]{40}|[a-f0-9]{64})$`
+	// +optional
+	SupersedingRemoteSHA string `json:"supersedingRemoteSHA,omitempty"`
+
+	// ArtifactDigest is the durable content-addressed workspace delta digest.
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	// +optional
+	ArtifactDigest string `json:"artifactDigest,omitempty"`
+
+	// PRReceipt is present only when createPR was explicitly requested and reconciled.
+	// +optional
+	PRReceipt *TaskPullRequestReceipt `json:"prReceipt,omitempty"`
+
+	// Message contains bounded, sanitized delivery context.
+	// +kubebuilder:validation:MaxLength=1024
+	// +optional
+	Message string `json:"message,omitempty"`
+
+	// LastTransitionTime is the last durable delivery-state transition time.
+	// +optional
+	LastTransitionTime *metav1.Time `json:"lastTransitionTime,omitempty"`
+}
diff --git a/api/v1alpha1/task_runtime_types_test.go b/api/v1alpha1/task_runtime_types_test.go
new file mode 100644
index 000000000..acc1ed946
--- /dev/null
+++ b/api/v1alpha1/task_runtime_types_test.go
@@ -0,0 +1,187 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package v1alpha1
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+func TestTaskWorkspaceSchemaFields(t *testing.T) {
+	workspace := WorkspaceConfig{
+		Intent:  WorkspaceIntentWrite,
+		GitRepo: "https://github.com/example/source.git",
+		SourceRepository: &RepositoryIdentity{
+			Provider: "github",
+			ID:       "github.com/example/source",
+		},
+		Branch: "main",
+		Ref:    "0123456789abcdef0123456789abcdef01234567",
+		ReadCredentialRef: &WorkspaceCredentialReference{
+			Name: "source-read",
+		},
+		PublicationGitRepo: "https://github.com/example/fork.git",
+		PublicationRepository: &RepositoryIdentity{
+			Provider: "github",
+			ID:       "github.com/example/fork",
+		},
+		PublicationReadCredentialRef: &WorkspaceCredentialReference{Name: "publication-read"},
+		PublicationCredentialRef: &WorkspaceCredentialReference{
+			Name: "publication-write",
+		},
+		ForgeCredentialRef: &WorkspaceCredentialReference{Name: "forge-token"},
+		SubPath:            "src/app",
+		PRBaseBranch:       "main",
+		PushBranch:         "orka/task-full-uid",
+		CreatePR:           true,
+	}
+	task := TaskSpec{Type: TaskTypeAgent, Workspace: &workspace}
+
+	encoded, err := json.Marshal(task)
+	if err != nil {
+		t.Fatalf("json.Marshal(TaskSpec): %v", err)
+	}
+	var fields map[string]any
+	if err := json.Unmarshal(encoded, &fields); err != nil {
+		t.Fatalf("json.Unmarshal(TaskSpec): %v", err)
+	}
+	workspaceJSON, ok := fields["workspace"].(map[string]any)
+	if !ok {
+		t.Fatalf("workspace JSON = %#v, want object", fields["workspace"])
+	}
+	for _, field := range []string{
+		"intent",
+		"gitRepo",
+		"sourceRepository",
+		"readCredentialRef",
+		"publicationGitRepo",
+		"publicationRepository",
+		"publicationReadCredentialRef",
+		"publicationCredentialRef",
+		"forgeCredentialRef",
+		"createPR",
+	} {
+		if _, ok := workspaceJSON[field]; !ok {
+			t.Errorf("workspace JSON missing %q: %s", field, encoded)
+		}
+	}
+	if _, ok := fields["agentRuntime"]; ok {
+		t.Fatalf("new top-level workspace unexpectedly serialized agentRuntime: %s", encoded)
+	}
+}
+
+func TestTaskStructuredExecutionAndDeliveryStatus(t *testing.T) {
+	sha := strings.Repeat("a", 40)
+	remoteBeforeSHA := sha
+	digest := "sha256:" + strings.Repeat("b", 64)
+	status := TaskStatus{
+		Phase: TaskPhaseSucceeded,
+		Execution: &TaskExecutionStatus{
+			State:           TaskExecutionStateSucceeded,
+			Outcome:         TaskExecutionOutcomeSucceeded,
+			Attempt:         1,
+			PromptID:        "prompt-1",
+			ControllerEpoch: 7,
+		},
+		Delivery: &TaskDeliveryStatus{
+			State:         TaskDeliveryStateVerifiedExact,
+			Outcome:       TaskDeliveryOutcomeVerifiedExact,
+			PublicationID: "publication-1",
+			SourceRepository: &RepositoryIdentity{
+				Provider: "github",
+				ID:       "github.com/example/source",
+			},
+			PublicationRepository: &RepositoryIdentity{
+				Provider: "github",
+				ID:       "github.com/example/fork",
+			},
+			Branch:            "orka/task-full-uid",
+			StartingSHA:       sha,
+			RemoteBeforeSHA:   &remoteBeforeSHA,
+			TreeSHA:           sha,
+			ExpectedCommitSHA: sha,
+			VerifiedRemoteSHA: sha,
+			ArtifactDigest:    digest,
+			PRReceipt: &TaskPullRequestReceipt{
+				ID:         "PR_1",
+				Number:     42,
+				URL:        "https://github.com/example/source/pull/42",
+				State:      "open",
+				BaseBranch: "main",
+				HeadBranch: "orka/task-full-uid",
+				HeadSHA:    sha,
+			},
+		},
+	}
+
+	encoded, err := json.Marshal(status)
+	if err != nil {
+		t.Fatalf("json.Marshal(TaskStatus): %v", err)
+	}
+	var decoded TaskStatus
+	if err := json.Unmarshal(encoded, &decoded); err != nil {
+		t.Fatalf("json.Unmarshal(TaskStatus): %v", err)
+	}
+	if decoded.Execution == nil || decoded.Execution.Outcome != TaskExecutionOutcomeSucceeded {
+		t.Fatalf("execution status round trip = %#v", decoded.Execution)
+	}
+	if decoded.Delivery == nil || decoded.Delivery.Outcome != TaskDeliveryOutcomeVerifiedExact {
+		t.Fatalf("delivery status round trip = %#v", decoded.Delivery)
+	}
+	if decoded.Delivery.PRReceipt == nil || decoded.Delivery.PRReceipt.Number != 42 {
+		t.Fatalf("PR receipt round trip = %#v", decoded.Delivery.PRReceipt)
+	}
+}
+
+func TestTaskExecutionAndDeliveryOutcomeConstants(t *testing.T) {
+	execution := map[TaskExecutionOutcome]string{
+		TaskExecutionOutcomeSucceeded:      "Succeeded",
+		TaskExecutionOutcomeFailed:         "Failed",
+		TaskExecutionOutcomeCancelled:      "Cancelled",
+		TaskExecutionOutcomeOutcomeUnknown: "OutcomeUnknown",
+	}
+	for got, want := range execution {
+		if string(got) != want {
+			t.Errorf("execution outcome = %q, want %q", got, want)
+		}
+	}
+
+	delivery := map[TaskDeliveryOutcome]string{
+		TaskDeliveryOutcomeNotRequested:              "NotRequested",
+		TaskDeliveryOutcomeVerifiedExact:             "VerifiedExact",
+		TaskDeliveryOutcomeDeliveredSuperseded:       "DeliveredSuperseded",
+		TaskDeliveryOutcomeReadValidated:             "ReadValidated",
+		TaskDeliveryOutcomeNoChange:                  "NoChange",
+		TaskDeliveryOutcomeCancelledBeforePublish:    "CancelledBeforePublish",
+		TaskDeliveryOutcomeReadOnlyWorkspaceModified: "ReadOnlyWorkspaceModified",
+		TaskDeliveryOutcomeDeliveryConflict:          "DeliveryConflict",
+		TaskDeliveryOutcomeCredentialBlocked:         "CredentialBlocked",
+		TaskDeliveryOutcomePublicationOutcomeUnknown: "PublicationOutcomeUnknown",
+	}
+	for got, want := range delivery {
+		if string(got) != want {
+			t.Errorf("delivery outcome = %q, want %q", got, want)
+		}
+	}
+}
+
+func TestTaskWorkspaceHasNoLegacyCredentialOrForkFields(t *testing.T) {
+	workspace := WorkspaceConfig{
+		GitRepo:                  "https://github.com/example/source.git",
+		ReadCredentialRef:        &WorkspaceCredentialReference{Name: "source-read"},
+		PublicationGitRepo:       "https://github.com/example/fork.git",
+		PublicationCredentialRef: &WorkspaceCredentialReference{Name: "fork-write"},
+	}
+	encoded, err := json.Marshal(workspace)
+	if err != nil {
+		t.Fatalf("json.Marshal(WorkspaceConfig): %v", err)
+	}
+	if strings.Contains(string(encoded), "gitSecretRef") || strings.Contains(string(encoded), "forkRepo") {
+		t.Fatalf("workspace serialized legacy fields: %s", encoded)
+	}
+}
diff --git a/api/v1alpha1/task_session_ref_validation_test.go b/api/v1alpha1/task_session_ref_validation_test.go
new file mode 100644
index 000000000..a969a54f7
--- /dev/null
+++ b/api/v1alpha1/task_session_ref_validation_test.go
@@ -0,0 +1,178 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package v1alpha1
+
+import (
+	"context"
+	"maps"
+	"strings"
+	"testing"
+
+	"k8s.io/apiextensions-apiserver/pkg/apis/apiextensions"
+	structuralschema "k8s.io/apiextensions-apiserver/pkg/apiserver/schema"
+	"k8s.io/apiextensions-apiserver/pkg/apiserver/schema/cel"
+	celconfig "k8s.io/apiserver/pkg/apis/cel"
+)
+
+const (
+	agentSessionRefImmutabilityRule   = "self.type != 'agent' || (has(self.sessionRef) == has(oldSelf.sessionRef) && (!has(self.sessionRef) || self.sessionRef == oldSelf.sessionRef))"
+	agentSessionRefImmutabilityMarker = "// +kubebuilder:validation:XValidation:rule=\"" + agentSessionRefImmutabilityRule + "\",message=\"sessionRef is immutable for agent Tasks\""
+)
+
+func TestAgentSessionRefImmutabilityMarkerAdmission(t *testing.T) {
+	if source := string(readTaskTypesSource(t)); !strings.Contains(source, agentSessionRefImmutabilityMarker) {
+		t.Fatalf("TaskSpec is missing the complete agent sessionRef immutability marker: want %q", agentSessionRefImmutabilityMarker)
+	}
+
+	schema := apiextensions.JSONSchemaProps{
+		Type: "object",
+		Properties: map[string]apiextensions.JSONSchemaProps{
+			"type": {Type: "string"},
+			"sessionRef": {
+				Type: "object",
+				Properties: map[string]apiextensions.JSONSchemaProps{
+					"name":             {Type: "string"},
+					"create":           {Type: "boolean"},
+					"append":           {Type: "boolean"},
+					"maxMessages":      {Type: "integer", Format: "int32"},
+					"throughMessageId": {Type: "string"},
+					"promptIncluded":   {Type: "boolean"},
+				},
+			},
+		},
+		XValidations: apiextensions.ValidationRules{{
+			Rule:    agentSessionRefImmutabilityRule,
+			Message: "sessionRef is immutable for agent Tasks",
+		}},
+	}
+	structural, err := structuralschema.NewStructural(&schema)
+	if err != nil {
+		t.Fatalf("build structural TaskSpec schema: %v", err)
+	}
+	validator := cel.NewValidator(structural, false, celconfig.PerCallLimit)
+	if validator == nil {
+		t.Fatal("compile agent sessionRef immutability admission rule: validator is nil")
+	}
+
+	fullSessionRef := map[string]any{
+		"name":             "session-a",
+		"create":           true,
+		"append":           true,
+		"maxMessages":      int64(50),
+		"throughMessageId": "message-42",
+		"promptIncluded":   true,
+	}
+	oldAgent := taskSpecForSessionRefAdmission("agent", fullSessionRef)
+
+	tests := []struct {
+		name    string
+		oldSpec map[string]any
+		newSpec map[string]any
+		wantErr bool
+	}{
+		{
+			name:    "unchanged complete reference",
+			oldSpec: oldAgent,
+			newSpec: taskSpecForSessionRefAdmission("agent", fullSessionRef),
+		},
+		{
+			name:    "add reference",
+			oldSpec: taskSpecForSessionRefAdmission("agent", nil),
+			newSpec: taskSpecForSessionRefAdmission("agent", fullSessionRef),
+			wantErr: true,
+		},
+		{
+			name:    "remove reference",
+			oldSpec: oldAgent,
+			newSpec: taskSpecForSessionRefAdmission("agent", nil),
+			wantErr: true,
+		},
+		{
+			name:    "change name",
+			oldSpec: oldAgent,
+			newSpec: taskSpecForSessionRefAdmission("agent", changedSessionRef(fullSessionRef, "name", "session-b")),
+			wantErr: true,
+		},
+		{
+			name:    "change create",
+			oldSpec: oldAgent,
+			newSpec: taskSpecForSessionRefAdmission("agent", changedSessionRef(fullSessionRef, "create", false)),
+			wantErr: true,
+		},
+		{
+			name:    "change append",
+			oldSpec: oldAgent,
+			newSpec: taskSpecForSessionRefAdmission("agent", changedSessionRef(fullSessionRef, "append", false)),
+			wantErr: true,
+		},
+		{
+			name:    "change max messages",
+			oldSpec: oldAgent,
+			newSpec: taskSpecForSessionRefAdmission("agent", changedSessionRef(fullSessionRef, "maxMessages", int64(10))),
+			wantErr: true,
+		},
+		{
+			name:    "change transcript cutoff",
+			oldSpec: oldAgent,
+			newSpec: taskSpecForSessionRefAdmission("agent", changedSessionRef(fullSessionRef, "throughMessageId", "message-41")),
+			wantErr: true,
+		},
+		{
+			name:    "change prompt included",
+			oldSpec: oldAgent,
+			newSpec: taskSpecForSessionRefAdmission("agent", changedSessionRef(fullSessionRef, "promptIncluded", false)),
+			wantErr: true,
+		},
+		{
+			name:    "container reference remains mutable",
+			oldSpec: taskSpecForSessionRefAdmission("container", fullSessionRef),
+			newSpec: taskSpecForSessionRefAdmission("container", changedSessionRef(fullSessionRef, "name", "session-b")),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			errs, _ := validator.Validate(
+				context.Background(),
+				nil,
+				structural,
+				tt.newSpec,
+				tt.oldSpec,
+				celconfig.RuntimeCELCostBudget,
+			)
+			if tt.wantErr {
+				if len(errs) == 0 {
+					t.Fatal("agent sessionRef mutation unexpectedly passed admission")
+				}
+				if got := errs.ToAggregate().Error(); !strings.Contains(got, "sessionRef is immutable for agent Tasks") {
+					t.Fatalf("admission error = %q, want sessionRef immutability message", got)
+				}
+				return
+			}
+			if len(errs) != 0 {
+				t.Fatalf("admission unexpectedly rejected update: %v", errs.ToAggregate())
+			}
+		})
+	}
+}
+
+func taskSpecForSessionRefAdmission(taskType string, sessionRef map[string]any) map[string]any {
+	spec := map[string]any{"type": taskType}
+	if sessionRef != nil {
+		spec["sessionRef"] = changedSessionRef(sessionRef, "", nil)
+	}
+	return spec
+}
+
+func changedSessionRef(sessionRef map[string]any, field string, value any) map[string]any {
+	changed := make(map[string]any, len(sessionRef))
+	maps.Copy(changed, sessionRef)
+	if field != "" {
+		changed[field] = value
+	}
+	return changed
+}
diff --git a/api/v1alpha1/task_types.go b/api/v1alpha1/task_types.go
index 06fd7f2e9..f9c94215e 100644
--- a/api/v1alpha1/task_types.go
+++ b/api/v1alpha1/task_types.go
@@ -7,6 +7,8 @@ MIT License - see LICENSE file for details.
 package v1alpha1
 
 import (
+	"encoding/json"
+
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
@@ -126,7 +128,19 @@ type TaskTransaction struct {
 // TaskSpec defines the desired state of Task
 // +kubebuilder:validation:XValidation:rule="has(self.requestedBy) == has(oldSelf.requestedBy) && (!has(self.requestedBy) || self.requestedBy == oldSelf.requestedBy)",message="requestedBy is immutable"
 // +kubebuilder:validation:XValidation:rule="has(self.transaction) == has(oldSelf.transaction) && (!has(self.transaction) || self.transaction == oldSelf.transaction)",message="transaction is immutable"
+// +kubebuilder:validation:XValidation:rule="self.type == oldSelf.type",message="type is immutable"
+// +kubebuilder:validation:XValidation:rule="(has(self.workspace) && has(self.workspace.intent) ? self.workspace.intent : (self.type == 'agent' ? 'read' : self.type)) == (has(oldSelf.workspace) && has(oldSelf.workspace.intent) ? oldSelf.workspace.intent : (oldSelf.type == 'agent' ? 'read' : oldSelf.type))",message="effective workspace intent is immutable"
+// +kubebuilder:validation:XValidation:rule="self.type != 'agent' || (has(self.prompt) == has(oldSelf.prompt) && (!has(self.prompt) || self.prompt == oldSelf.prompt))",message="agent prompt is immutable"
+// +kubebuilder:validation:XValidation:rule="self.type != 'agent' || (has(self.agentRef) == has(oldSelf.agentRef) && (!has(self.agentRef) || self.agentRef == oldSelf.agentRef))",message="agentRef is immutable for agent Tasks"
+// +kubebuilder:validation:XValidation:rule="self.type != 'agent' || (has(self.agentRuntime) == has(oldSelf.agentRuntime) && (!has(self.agentRuntime) || self.agentRuntime == oldSelf.agentRuntime))",message="agentRuntime is immutable for agent Tasks"
+// +kubebuilder:validation:XValidation:rule="self.type != 'agent' || (has(self.sessionRef) == has(oldSelf.sessionRef) && (!has(self.sessionRef) || self.sessionRef == oldSelf.sessionRef))",message="sessionRef is immutable for agent Tasks"
+// +kubebuilder:validation:XValidation:rule="self.type != 'agent' || (has(self.workspace) == has(oldSelf.workspace) && (!has(self.workspace) || self.workspace == oldSelf.workspace))",message="workspace is immutable for agent Tasks"
+// +kubebuilder:validation:XValidation:rule="self.type != 'agent' || (has(self.timeout) == has(oldSelf.timeout) && (!has(self.timeout) || self.timeout == oldSelf.timeout))",message="timeout is immutable for agent Tasks"
 // +kubebuilder:validation:XValidation:rule="!has(self.execution) || !has(self.execution.workspace) || self.execution.workspace.reusePolicy != 'session' || has(self.sessionRef)",message="session workspace reuse requires spec.sessionRef"
+// +kubebuilder:validation:XValidation:rule="self.type != 'container' || !has(self.workspace) || !has(self.workspace.expectedRemoteSHA)",message="container Tasks do not support workspace.expectedRemoteSHA"
+// +kubebuilder:validation:XValidation:rule="self.type != 'container' || !has(self.workspace) || (!has(self.workspace.createPR) || !self.workspace.createPR)",message="container Tasks do not support workspace.createPR"
+// +kubebuilder:validation:XValidation:rule="self.type != 'container' || !has(self.workspace) || (!has(self.workspace.maxChangedFiles) && (!has(self.workspace.allowedPaths) || self.workspace.allowedPaths.size() == 0) && (!has(self.workspace.denyRepositoryControlPaths) || !self.workspace.denyRepositoryControlPaths) && (!has(self.workspace.rejectBinaryFiles) || !self.workspace.rejectBinaryFiles) && (!has(self.workspace.rejectSecretLikeContent) || !self.workspace.rejectSecretLikeContent))",message="container Tasks do not support clean-room workspace publication policies"
+// +kubebuilder:validation:XValidation:rule="self.type != 'container' || !has(self.workspace) || !has(self.workspace.pushBranch) || self.workspace.pushBranch.size() == 0 || !has(self.image) || self.image.size() == 0",message="custom-image container Tasks do not support workspace.pushBranch publication"
 type TaskSpec struct {
 	// Type specifies the task type: "container" or "ai"
 	// +kubebuilder:validation:Required
@@ -237,9 +251,9 @@ type TaskSpec struct {
 	// +optional
 	AgentRuntime *AgentRuntimeSpec `json:"agentRuntime,omitempty"`
 
-	// Workspace defines repository checkout and push settings for tasks that need
-	// a git workspace. Agent tasks can continue to use agentRuntime.workspace for
-	// compatibility; this top-level field is used by container tasks as well.
+	// Workspace defines the canonical repository workspace, intent, credentials,
+	// and publication request. Agent Tasks that omit intent are interpreted as
+	// read by controller logic; an omitted intent preserves existing container behavior.
 	// +optional
 	Workspace *WorkspaceConfig `json:"workspace,omitempty"`
 
@@ -412,6 +426,9 @@ type SkillReference struct {
 
 // TaskStatus defines the observed state of Task
 // +kubebuilder:validation:XValidation:rule="!has(oldSelf.executionOutcome) || self.executionOutcome == oldSelf.executionOutcome",message="executionOutcome is immutable once recorded"
+// +kubebuilder:validation:XValidation:rule="!has(oldSelf.agentExecutionBinding) || (has(self.agentExecutionBinding) && self.agentExecutionBinding == oldSelf.agentExecutionBinding)",message="agentExecutionBinding is write-once and immutable"
+// +kubebuilder:validation:XValidation:rule="!has(self.agentExecutionBinding) || self.agentExecutionBinding.contractVersion != 'orka.harness.v1' || ((!has(self.execution) || (has(oldSelf.execution) && self.execution == oldSelf.execution)) && (!has(self.delivery) || (has(oldSelf.delivery) && self.delivery == oldSelf.delivery)))",message="a v1-bound Task cannot acquire new v2 execution or delivery state"
+// +kubebuilder:validation:XValidation:rule="!has(self.agentExecutionBinding) || self.agentExecutionBinding.contractVersion != 'orka.harness.v2' || !has(self.harnessRuntime) || (has(oldSelf.harnessRuntime) && self.harnessRuntime == oldSelf.harnessRuntime)",message="a v2-bound Task cannot acquire new v1 harness state"
 type TaskStatus struct {
 	// Phase is the current phase of the task
 	// +optional
@@ -442,10 +459,31 @@ type TaskStatus struct {
 	// +optional
 	ResultRef *ResultReference `json:"resultRef,omitempty"`
 
-	// ExecutionOutcome is the immutable outcome recorded when workload execution ends. Workspace
-	// attachment revocation and cleanup continue independently while the Task is Finalizing.
+	// Execution reports the durable execution state and terminal outcome for the
+	// current attempt. Phase remains the compatibility projection.
+	// +optional
+	Execution *TaskExecutionStatus `json:"execution,omitempty"`
+
+	// Delivery reports trusted workspace validation and publication reconciliation.
 	// +optional
-	ExecutionOutcome *TaskExecutionOutcome `json:"executionOutcome,omitempty"`
+	Delivery *TaskDeliveryStatus `json:"delivery,omitempty"`
+
+	// HarnessRuntime records the controller-resolved harness v1 runtime target
+	// for an in-flight agent turn. It intentionally stores only non-secret
+	// routing metadata and Secret references, never bearer values. Compatibility
+	// surface for harness v1 bindings.
+	// +optional
+	HarnessRuntime *HarnessRuntimeStatus `json:"harnessRuntime,omitempty"`
+
+	// AgentExecutionBinding is the authoritative, write-once, immutable
+	// execution route for this agent Task.
+	// +optional
+	AgentExecutionBinding *AgentExecutionBinding `json:"agentExecutionBinding,omitempty"`
+
+	// ExecutionOutcome records the immutable outcome of a non-ACP workload before
+	// provider-neutral execution-workspace finalization completes.
+	// +optional
+	ExecutionOutcome *TaskWorkloadExecutionOutcome `json:"executionOutcome,omitempty"`
 
 	// ExecutionWorkspace reports the provider-neutral lifecycle state for a
 	// requested execution workspace. Provider-native identifiers and credentials
@@ -453,12 +491,6 @@ type TaskStatus struct {
 	// +optional
 	ExecutionWorkspace *ExecutionWorkspaceStatus `json:"executionWorkspace,omitempty"`
 
-	// HarnessRuntime records the controller-resolved harness runtime target for an
-	// in-flight agent turn. It intentionally stores only non-secret routing metadata
-	// and Secret references, never bearer values.
-	// +optional
-	HarnessRuntime *HarnessRuntimeStatus `json:"harnessRuntime,omitempty"`
-
 	// WebhookDelivered indicates whether the webhook was successfully called
 	// +optional
 	WebhookDelivered bool `json:"webhookDelivered,omitempty"`
@@ -486,43 +518,11 @@ type TaskStatus struct {
 	NextScheduleTime *metav1.Time `json:"nextScheduleTime,omitempty"`
 }
 
-// HarnessRuntimeStatus records the resolved harness runtime selected by the controller.
-type HarnessRuntimeStatus struct {
-	// RuntimeRefName is the AgentRuntime name for custom runtimeRef turns. Empty means built-in CLI wrapper.
-	// +optional
-	RuntimeRefName string `json:"runtimeRefName,omitempty"`
-
-	// RuntimeName is the runtime name advertised by the harness capabilities and sent in turn metadata.
-	// +optional
-	RuntimeName string `json:"runtimeName,omitempty"`
-
-	// ContractVersion is the Orka harness contract version used for the turn.
-	// +optional
-	ContractVersion string `json:"contractVersion,omitempty"`
-
-	// Endpoint is the non-secret harness base URL selected when the turn started.
-	// +optional
-	Endpoint string `json:"endpoint,omitempty"`
-
-	// RuntimeGeneration is the AgentRuntime generation selected when the turn started.
-	// +optional
-	RuntimeGeneration int64 `json:"runtimeGeneration,omitempty"`
-
-	// AuthRefName is the Secret name selected when the turn started.
-	// +optional
-	AuthRefName string `json:"authRefName,omitempty"`
-
-	// AuthRefField is the Secret data field selected when the turn started.
-	// +optional
-	AuthRefField string `json:"authRefField,omitempty"`
-
-	// AuthRefResourceVersion is the auth Secret resourceVersion validated before starting the turn.
-	// +optional
-	AuthRefResourceVersion string `json:"authRefResourceVersion,omitempty"`
-}
-
-// TaskExecutionOutcome records the immutable result of workload execution before workspace finalization.
-type TaskExecutionOutcome struct {
+// TaskWorkloadExecutionOutcome records the immutable result of non-ACP workload
+// execution before provider-neutral workspace finalization. ACP agent attempts use
+// TaskStatus.Execution, whose stronger fencing and OutcomeUnknown semantics are
+// defined in task_runtime_types.go.
+type TaskWorkloadExecutionOutcome struct {
 	// Phase is the terminal workload execution phase.
 	// +kubebuilder:validation:Enum=Succeeded;Failed;Cancelled
 	Phase TaskPhase `json:"phase"`
@@ -693,6 +693,7 @@ type ChildTaskStatus struct {
 // +kubebuilder:printcolumn:name="Phase",type=string,JSONPath=`.status.phase`
 // +kubebuilder:printcolumn:name="Priority",type=integer,JSONPath=`.spec.priority`
 // +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
+// +kubebuilder:validation:XValidation:rule="!has(oldSelf.status) || (!has(oldSelf.status.agentExecutionBinding) || self.spec == oldSelf.spec)",message="Task spec is immutable after execution authority is recorded"
 
 // Task is the Schema for the tasks API
 type Task struct {
@@ -713,26 +714,30 @@ type TaskList struct {
 }
 
 // AgentRuntimeType defines the agent runtime to use
-// +kubebuilder:validation:Enum=copilot;claude;codex;opencode
+// +kubebuilder:validation:Enum=claude;codex;copilot;opencode
 type AgentRuntimeType string
 
 const (
-	// AgentRuntimeCopilot uses GitHub Copilot CLI as the agent runtime
+	// AgentRuntimeCopilot uses GitHub Copilot CLI as the agent runtime.
 	AgentRuntimeCopilot AgentRuntimeType = "copilot"
 	// AgentRuntimeClaude uses Claude Code CLI as the agent runtime
 	AgentRuntimeClaude AgentRuntimeType = "claude"
 	// AgentRuntimeCodex uses OpenAI Codex CLI as the agent runtime
 	AgentRuntimeCodex AgentRuntimeType = "codex"
-	// AgentRuntimeOpencode uses OpenCode CLI as the agent runtime
+	// AgentRuntimeOpencode uses OpenCode CLI's native ACP server as the agent runtime.
 	AgentRuntimeOpencode AgentRuntimeType = "opencode"
 )
 
 // AgentRuntimeSpec defines task-level overrides for agent runtime configuration.
 // Runtime type and credentials come from the referenced Agent CRD.
+// +kubebuilder:validation:XValidation:rule="!has(self.workspace) || (oldSelf.hasValue() && has(oldSelf.value().workspace) && self.workspace == oldSelf.value().workspace)",optionalOldSelf=true,message="legacy agentRuntime.workspace is a preserved harness v1 compatibility surface; new Tasks must use spec.workspace"
 type AgentRuntimeSpec struct {
-	// Workspace defines the working directory configuration
+	// Workspace is the legacy harness v1 agent workspace configuration at its
+	// historical JSON path. It is a preserved compatibility read surface for
+	// stored v1 Tasks only: it can never be introduced or changed, and it is
+	// not an authority surface for new work.
 	// +optional
-	Workspace *WorkspaceConfig `json:"workspace,omitempty"`
+	Workspace *LegacyAgentWorkspaceConfig `json:"workspace,omitempty"`
 
 	// MaxTurns limits the number of agent loop iterations
 	// +kubebuilder:validation:Minimum=1
@@ -753,40 +758,304 @@ type AgentRuntimeSpec struct {
 	AllowBash *bool `json:"allowBash,omitempty"`
 }
 
-// WorkspaceConfig defines workspace setup for agent tasks
-type WorkspaceConfig struct {
-	// GitRepo is the repository URL to clone
+// MarshalJSON preserves the distinction between an omitted task tool override
+// and an explicitly empty deny-all override.
+func (in AgentRuntimeSpec) MarshalJSON() ([]byte, error) {
+	type agentRuntimeSpecJSON struct {
+		Workspace       *LegacyAgentWorkspaceConfig `json:"workspace,omitempty"`
+		MaxTurns        *int32                      `json:"maxTurns,omitempty"`
+		AllowedTools    *[]string                   `json:"allowedTools,omitempty"`
+		DisallowedTools []string                    `json:"disallowedTools,omitempty"`
+		AllowBash       *bool                       `json:"allowBash,omitempty"`
+	}
+	var allowedTools *[]string
+	if in.AllowedTools != nil {
+		tools := append([]string{}, in.AllowedTools...)
+		allowedTools = &tools
+	}
+	return json.Marshal(agentRuntimeSpecJSON{
+		Workspace:       in.Workspace,
+		MaxTurns:        in.MaxTurns,
+		AllowedTools:    allowedTools,
+		DisallowedTools: in.DisallowedTools,
+		AllowBash:       in.AllowBash,
+	})
+}
+
+// LegacyAgentWorkspaceConfig is the harness v1 agent workspace shape preserved
+// at the historical spec.agentRuntime.workspace JSON path. Historically valid
+// stored values round-trip unchanged and are intentionally not subject to the
+// v2 WorkspaceConfig URL and credential CEL policy; the shared schema keeps
+// only protocol-neutral validation, and protocol-specific rules are enforced
+// at binding resolution. These fields never enter new bindings: new v1
+// workspaces are credential-free and public-read-only by policy.
+type LegacyAgentWorkspaceConfig struct {
+	// GitRepo is the repository URL to clone.
 	// +optional
 	GitRepo string `json:"gitRepo,omitempty"`
 
-	// Branch is the git branch to checkout
+	// Branch is the git branch to checkout.
 	// +optional
 	Branch string `json:"branch,omitempty"`
 
-	// Ref is a specific git ref (commit SHA, tag) to checkout
+	// Ref is a specific git ref (commit SHA, tag) to checkout.
 	// +optional
 	Ref string `json:"ref,omitempty"`
 
-	// GitSecretRef references a Secret containing git credentials
+	// GitSecretRef references a Secret containing git credentials. Adopted
+	// legacy bindings freeze the exact Secret identity; new bindings reject it.
 	// +optional
 	GitSecretRef *corev1.LocalObjectReference `json:"gitSecretRef,omitempty"`
 
-	// SubPath is a subdirectory within the repo to use as workspace root
+	// SubPath is a subdirectory within the repo to use as workspace root.
 	// +optional
 	SubPath string `json:"subPath,omitempty"`
 
-	// ForkRepo is the writable fork repository URL for pushing changes
+	// ForkRepo is the writable fork repository URL for pushing changes.
 	// +optional
 	ForkRepo string `json:"forkRepo,omitempty"`
 
-	// PRBaseBranch is the upstream branch to target for pull requests
+	// PRBaseBranch is the upstream branch to target for pull requests.
+	// +optional
+	PRBaseBranch string `json:"prBaseBranch,omitempty"`
+
+	// PushBranch is the remote branch name to push changes to after the agent
+	// completes.
+	// +optional
+	PushBranch string `json:"pushBranch,omitempty"`
+}
+
+// HarnessRuntimeStatus records the resolved harness v1 runtime and its durable
+// attempt projection. Harness v1 cannot write the v2-only execution/delivery
+// surfaces, so terminal ambiguity is represented here without weakening route
+// exclusivity.
+// +kubebuilder:validation:XValidation:rule="!has(self.state) || !(self.state in ['Succeeded', 'Failed', 'Cancelled', 'OutcomeUnknown']) || has(self.outcome)",message="terminal harness state requires an outcome"
+// +kubebuilder:validation:XValidation:rule="!has(self.outcome) || (has(self.state) && self.state in ['Succeeded', 'Failed', 'Cancelled', 'OutcomeUnknown'])",message="harness outcome requires a terminal state"
+// +kubebuilder:validation:XValidation:rule="!has(self.state) || self.state != 'OutcomeUnknown' || (has(self.outcome) && self.outcome == 'OutcomeUnknown')",message="OutcomeUnknown harness state requires OutcomeUnknown outcome"
+type HarnessRuntimeStatus struct {
+	// RuntimeRefName is the AgentRuntime name for custom runtimeRef turns.
+	// Empty means built-in CLI wrapper.
+	// +optional
+	RuntimeRefName string `json:"runtimeRefName,omitempty"`
+
+	// RuntimeName is the runtime name advertised by the harness capabilities
+	// and sent in turn metadata.
+	// +optional
+	RuntimeName string `json:"runtimeName,omitempty"`
+
+	// ContractVersion is the Orka harness contract version used for the turn.
+	// +optional
+	ContractVersion string `json:"contractVersion,omitempty"`
+
+	// Endpoint is the non-secret harness base URL selected when the turn started.
+	// +optional
+	Endpoint string `json:"endpoint,omitempty"`
+
+	// RuntimeGeneration is the AgentRuntime generation selected when the turn started.
+	// +optional
+	RuntimeGeneration int64 `json:"runtimeGeneration,omitempty"`
+
+	// AuthRefName is the Secret name selected when the turn started.
+	// +optional
+	AuthRefName string `json:"authRefName,omitempty"`
+
+	// AuthRefField is the Secret data field selected when the turn started.
+	// +optional
+	AuthRefField string `json:"authRefField,omitempty"`
+
+	// AuthRefResourceVersion is the auth Secret resourceVersion validated
+	// before starting the turn.
+	// +optional
+	AuthRefResourceVersion string `json:"authRefResourceVersion,omitempty"`
+
+	// Attempt is the durable harness v1 attempt number.
+	// +kubebuilder:validation:Minimum=1
+	// +optional
+	Attempt int32 `json:"attempt,omitempty"`
+
+	// TurnID is the deterministic, non-secret harness turn identity.
+	// +optional
+	TurnID string `json:"turnID,omitempty"`
+
+	// RuntimeSessionID is the deterministic, non-secret v1 runtime-session identity.
+	// +optional
+	RuntimeSessionID string `json:"runtimeSessionID,omitempty"`
+
+	// State is the durable harness v1 attempt state projected for operators.
+	// +optional
+	State TaskExecutionState `json:"state,omitempty"`
+
+	// Outcome is set only for a terminal harness v1 attempt.
+	// +optional
+	Outcome TaskExecutionOutcome `json:"outcome,omitempty"`
+
+	// Reason is a bounded machine-readable terminal reason code.
+	// +kubebuilder:validation:MaxLength=256
+	// +optional
+	Reason string `json:"reason,omitempty"`
+
+	// TerminalReceiptDigest identifies the authoritative terminal or unknown receipt.
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	// +optional
+	TerminalReceiptDigest string `json:"terminalReceiptDigest,omitempty"`
+
+	// RequestDigest binds the canonical StartTurn request admitted by the
+	// durable wrapper ledger.
+	// +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
+	// +optional
+	RequestDigest string `json:"requestDigest,omitempty"`
+
+	// ControllerEpoch records the fenced controller epoch driving the attempt.
+	// +kubebuilder:validation:Minimum=0
+	// +optional
+	ControllerEpoch int64 `json:"controllerEpoch,omitempty"`
+
+	// LastEventSeq is the highest durably mapped harness frame sequence.
+	// +kubebuilder:validation:Minimum=0
+	// +optional
+	LastEventSeq int64 `json:"lastEventSeq,omitempty"`
+
+	// CancelRequestedAt records a durable cancellation request. Cancellation
+	// remains nonterminal until a terminal frame or ledger receipt is observed.
+	// +optional
+	CancelRequestedAt *metav1.Time `json:"cancelRequestedAt,omitempty"`
+
+	// Message is bounded, sanitized execution context.
+	// +kubebuilder:validation:MaxLength=1024
+	// +optional
+	Message string `json:"message,omitempty"`
+
+	// LastTransitionTime is the last durable v1 attempt transition projected to
+	// the Task.
+	// +optional
+	LastTransitionTime *metav1.Time `json:"lastTransitionTime,omitempty"`
+}
+
+// WorkspaceConfig defines repository workspace, validation, and publication intent.
+// +kubebuilder:validation:XValidation:rule="!self.createPR || self.intent == 'write'",message="createPR requires write workspace intent"
+// +kubebuilder:validation:XValidation:rule="!has(self.gitRepo) || (!self.gitRepo.matches('(?i)^[A-Za-z][A-Za-z0-9+.-]*://[^/]*@') && !self.gitRepo.contains('?') && !self.gitRepo.contains('#'))",message="gitRepo must not contain embedded credentials, query parameters, or fragments"
+// +kubebuilder:validation:XValidation:rule="!has(self.publicationGitRepo) || (!self.publicationGitRepo.matches('(?i)^[A-Za-z][A-Za-z0-9+.-]*://[^/]*@') && !self.publicationGitRepo.contains('?') && !self.publicationGitRepo.contains('#'))",message="publicationGitRepo must not contain embedded credentials, query parameters, or fragments"
+type WorkspaceConfig struct {
+	// Intent declares whether the verified workspace must remain unchanged or may
+	// produce a publication artifact. It is immutable for the lifetime of the Task.
+	// Agent Tasks that omit intent are interpreted as read by controller logic;
+	// omitted intent preserves the existing behavior of container Tasks.
+	// +optional
+	Intent WorkspaceIntent `json:"intent,omitempty"`
+
+	// GitRepo is the source repository URL cloned by the clean-room workspace boundary.
+	// Credentials must not be embedded in the URL.
+	// +kubebuilder:validation:MaxLength=2048
+	// +optional
+	GitRepo string `json:"gitRepo,omitempty"`
+
+	// SourceRepository is the optional URL-derived identity for GitRepo. When set,
+	// it must match the normalized credential-free URL; for GitHub, use provider
+	// "github" and ID "github.com/owner/repo".
+	// +optional
+	SourceRepository *RepositoryIdentity `json:"sourceRepository,omitempty"`
+
+	// Branch is the source branch to check out.
+	// +kubebuilder:validation:MaxLength=255
+	// +optional
+	Branch string `json:"branch,omitempty"`
+
+	// Ref is a specific source git ref, commit SHA, or tag to check out.
+	// +kubebuilder:validation:MaxLength=512
+	// +optional
+	Ref string `json:"ref,omitempty"`
+
+	// ReadCredentialRef references the one-operation clone/read credential Secret.
+	// The Secret is resolved only by the clean-room workspace boundary.
+	// +optional
+	ReadCredentialRef *WorkspaceCredentialReference `json:"readCredentialRef,omitempty"`
+
+	// PublicationGitRepo is the repository URL whose branch receives an exact CAS publication.
+	// Credentials must not be embedded in the URL.
+	// +kubebuilder:validation:MaxLength=2048
+	// +optional
+	PublicationGitRepo string `json:"publicationGitRepo,omitempty"`
+
+	// PublicationRepository is the optional URL-derived identity for
+	// PublicationGitRepo. When set, it must match the normalized credential-free
+	// URL; for GitHub, use provider "github" and ID "github.com/owner/repo".
+	// +optional
+	PublicationRepository *RepositoryIdentity `json:"publicationRepository,omitempty"`
+
+	// PublicationReadCredentialRef references the target-repository read
+	// credential used only for preflight and independent post-push verification.
+	// +optional
+	PublicationReadCredentialRef *WorkspaceCredentialReference `json:"publicationReadCredentialRef,omitempty"`
+
+	// PublicationCredentialRef references the target-repository write credential
+	// used only for the exact CAS push. It is never used to clone the source.
+	// +optional
+	PublicationCredentialRef *WorkspaceCredentialReference `json:"publicationCredentialRef,omitempty"`
+
+	// ForgeCredentialRef references the forge API credential used only for pull
+	// request reconciliation when createPR=true.
+	// +optional
+	ForgeCredentialRef *WorkspaceCredentialReference `json:"forgeCredentialRef,omitempty"`
+
+	// SubPath is a subdirectory within the source repository used as workspace root.
+	// +kubebuilder:validation:MaxLength=1024
+	// +optional
+	SubPath string `json:"subPath,omitempty"`
+
+	// PRBaseBranch is the upstream branch targeted when CreatePR is true.
+	// +kubebuilder:validation:MaxLength=255
 	// +optional
 	PRBaseBranch string `json:"prBaseBranch,omitempty"`
 
-	// PushBranch is the remote branch name to push changes to after the agent completes.
-	// When set, FinalizeResult will commit and push changes to this branch.
+	// PushBranch is the publication branch. For write Tasks the controller derives
+	// a full-entropy Task- or Session-owned branch when this is omitted.
+	// +kubebuilder:validation:MaxLength=255
 	// +optional
 	PushBranch string `json:"pushBranch,omitempty"`
+
+	// ExpectedRemoteSHA requires the publication branch to exist at this exact
+	// commit before publication. Empty means the branch must be absent. It is
+	// supported only for agent Tasks using the trusted ACP publisher boundary.
+	// +kubebuilder:validation:Pattern=`^([a-f0-9]{40}|[a-f0-9]{64})$`
+	// +optional
+	ExpectedRemoteSHA string `json:"expectedRemoteSHA,omitempty"`
+
+	// MaxChangedFiles bounds the total changed, deleted, and symlink paths accepted
+	// from the trusted supervisor before publication. Zero uses the runtime limit.
+	// It is not supported for container Tasks.
+	// +kubebuilder:validation:Minimum=1
+	// +optional
+	MaxChangedFiles *int32 `json:"maxChangedFiles,omitempty"`
+
+	// AllowedPaths restricts publishable workspace changes to these path globs or
+	// directory prefixes ending in /**. Empty allows every otherwise-safe path.
+	// It is not supported for container Tasks.
+	// +kubebuilder:validation:MaxItems=256
+	// +optional
+	AllowedPaths []string `json:"allowedPaths,omitempty"`
+
+	// DenyRepositoryControlPaths rejects workflow, RBAC, and chart-secret paths
+	// before publication even when AllowedPaths is empty or otherwise matches.
+	// It is not supported for container Tasks.
+	// +optional
+	DenyRepositoryControlPaths bool `json:"denyRepositoryControlPaths,omitempty"`
+
+	// RejectBinaryFiles rejects changed file content that is not valid text. It is
+	// not supported for container Tasks.
+	// +optional
+	RejectBinaryFiles bool `json:"rejectBinaryFiles,omitempty"`
+
+	// RejectSecretLikeContent applies Orka's generic secret detector to changed
+	// paths and file contents before publication. It is not supported for container Tasks.
+	// +optional
+	RejectSecretLikeContent bool `json:"rejectSecretLikeContent,omitempty"`
+
+	// CreatePR explicitly requests pull request reconciliation after branch publication.
+	// Branch push remains the minimum durable delivery when false. It is supported only
+	// for agent Tasks using the trusted ACP publisher boundary.
+	// +kubebuilder:default=false
+	// +optional
+	CreatePR bool `json:"createPR,omitempty"`
 }
 
 func init() {
diff --git a/api/v1alpha1/tool_types.go b/api/v1alpha1/tool_types.go
index f86106916..22ee236b8 100644
--- a/api/v1alpha1/tool_types.go
+++ b/api/v1alpha1/tool_types.go
@@ -58,6 +58,11 @@ type HTTPExecution struct {
 	Headers map[string]string `json:"headers,omitempty"`
 
 	// Timeout is the request timeout (default: 30s)
+	// Consequential (non-read) tools brokered to ACP runtimes execute under a
+	// fixed external-effect ledger lease; their timeout must stay at or below
+	// the controller's brokered call bound (currently four minutes). Longer
+	// timeouts are rejected when the tool is exposed to an ACP prompt, and
+	// brokered calls are always clamped to that bound at execution time.
 	// +optional
 	Timeout *metav1.Duration `json:"timeout,omitempty"`
 
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
index 2ec71a30b..accf02e5d 100644
--- a/api/v1alpha1/zz_generated.deepcopy.go
+++ b/api/v1alpha1/zz_generated.deepcopy.go
@@ -89,6 +89,11 @@ func (in *Agent) DeepCopyObject() runtime.Object {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *AgentCLIRuntime) DeepCopyInto(out *AgentCLIRuntime) {
 	*out = *in
+	if in.ContractVersion != nil {
+		in, out := &in.ContractVersion, &out.ContractVersion
+		*out = new(AgentRuntimeContractVersion)
+		**out = **in
+	}
 	if in.RuntimeRef != nil {
 		in, out := &in.RuntimeRef, &out.RuntimeRef
 		*out = new(AgentRuntimeReference)
@@ -121,6 +126,94 @@ func (in *AgentCLIRuntime) DeepCopy() *AgentCLIRuntime {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AgentExecutionAgentRef) DeepCopyInto(out *AgentExecutionAgentRef) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AgentExecutionAgentRef.
+func (in *AgentExecutionAgentRef) DeepCopy() *AgentExecutionAgentRef {
+	if in == nil {
+		return nil
+	}
+	out := new(AgentExecutionAgentRef)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AgentExecutionBinding) DeepCopyInto(out *AgentExecutionBinding) {
+	*out = *in
+	out.Task = in.Task
+	if in.Agent != nil {
+		in, out := &in.Agent, &out.Agent
+		*out = new(AgentExecutionAgentRef)
+		**out = **in
+	}
+	out.Snapshot = in.Snapshot
+	if in.RuntimeRef != nil {
+		in, out := &in.RuntimeRef, &out.RuntimeRef
+		*out = new(AgentExecutionRuntimeRef)
+		**out = **in
+	}
+	in.BoundAt.DeepCopyInto(&out.BoundAt)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AgentExecutionBinding.
+func (in *AgentExecutionBinding) DeepCopy() *AgentExecutionBinding {
+	if in == nil {
+		return nil
+	}
+	out := new(AgentExecutionBinding)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AgentExecutionBindingTaskRef) DeepCopyInto(out *AgentExecutionBindingTaskRef) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AgentExecutionBindingTaskRef.
+func (in *AgentExecutionBindingTaskRef) DeepCopy() *AgentExecutionBindingTaskRef {
+	if in == nil {
+		return nil
+	}
+	out := new(AgentExecutionBindingTaskRef)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AgentExecutionRuntimeRef) DeepCopyInto(out *AgentExecutionRuntimeRef) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AgentExecutionRuntimeRef.
+func (in *AgentExecutionRuntimeRef) DeepCopy() *AgentExecutionRuntimeRef {
+	if in == nil {
+		return nil
+	}
+	out := new(AgentExecutionRuntimeRef)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AgentExecutionSnapshotRef) DeepCopyInto(out *AgentExecutionSnapshotRef) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AgentExecutionSnapshotRef.
+func (in *AgentExecutionSnapshotRef) DeepCopy() *AgentExecutionSnapshotRef {
+	if in == nil {
+		return nil
+	}
+	out := new(AgentExecutionSnapshotRef)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *AgentList) DeepCopyInto(out *AgentList) {
 	*out = *in
@@ -213,6 +306,21 @@ func (in *AgentRuntimeBearerAuthReference) DeepCopy() *AgentRuntimeBearerAuthRef
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *AgentRuntimeCapabilitiesSpec) DeepCopyInto(out *AgentRuntimeCapabilitiesSpec) {
 	*out = *in
+	if in.Profile != nil {
+		in, out := &in.Profile, &out.Profile
+		*out = new(AgentRuntimeProfileSpec)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Limits != nil {
+		in, out := &in.Limits, &out.Limits
+		*out = new(AgentRuntimeProtocolLimits)
+		**out = **in
+	}
+	if in.WorkspaceGovernance != nil {
+		in, out := &in.WorkspaceGovernance, &out.WorkspaceGovernance
+		*out = new(AgentRuntimeWorkspaceGovernanceCapabilities)
+		**out = **in
+	}
 	if in.ToolExecutionModes != nil {
 		in, out := &in.ToolExecutionModes, &out.ToolExecutionModes
 		*out = make([]AgentRuntimeToolExecutionMode, len(*in))
@@ -258,7 +366,21 @@ func (in *AgentRuntimeCapabilitiesSpec) DeepCopy() *AgentRuntimeCapabilitiesSpec
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *AgentRuntimeClientAuth) DeepCopyInto(out *AgentRuntimeClientAuth) {
 	*out = *in
-	out.BearerAuthRef = in.BearerAuthRef
+	if in.BearerAuthRef != nil {
+		in, out := &in.BearerAuthRef, &out.BearerAuthRef
+		*out = new(AgentRuntimeBearerAuthReference)
+		**out = **in
+	}
+	if in.ControllerBearerTokenSecretRef != nil {
+		in, out := &in.ControllerBearerTokenSecretRef, &out.ControllerBearerTokenSecretRef
+		*out = new(AgentRuntimeSecretKeyReference)
+		**out = **in
+	}
+	if in.OperationCapabilitySecretRef != nil {
+		in, out := &in.OperationCapabilitySecretRef, &out.OperationCapabilitySecretRef
+		*out = new(AgentRuntimeSecretKeyReference)
+		**out = **in
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AgentRuntimeClientAuth.
@@ -321,6 +443,16 @@ func (in *AgentRuntimeList) DeepCopyObject() runtime.Object {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *AgentRuntimeObservedCapabilities) DeepCopyInto(out *AgentRuntimeObservedCapabilities) {
 	*out = *in
+	if in.Limits != nil {
+		in, out := &in.Limits, &out.Limits
+		*out = new(AgentRuntimeProtocolLimits)
+		**out = **in
+	}
+	if in.WorkspaceGovernance != nil {
+		in, out := &in.WorkspaceGovernance, &out.WorkspaceGovernance
+		*out = new(AgentRuntimeWorkspaceGovernanceCapabilities)
+		**out = **in
+	}
 	if in.ToolExecutionModes != nil {
 		in, out := &in.ToolExecutionModes, &out.ToolExecutionModes
 		*out = make([]AgentRuntimeToolExecutionMode, len(*in))
@@ -343,6 +475,41 @@ func (in *AgentRuntimeObservedCapabilities) DeepCopy() *AgentRuntimeObservedCapa
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AgentRuntimeProfileSpec) DeepCopyInto(out *AgentRuntimeProfileSpec) {
+	*out = *in
+	if in.ModelLimits != nil {
+		in, out := &in.ModelLimits, &out.ModelLimits
+		*out = new(ModelTokenLimits)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AgentRuntimeProfileSpec.
+func (in *AgentRuntimeProfileSpec) DeepCopy() *AgentRuntimeProfileSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(AgentRuntimeProfileSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AgentRuntimeProtocolLimits) DeepCopyInto(out *AgentRuntimeProtocolLimits) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AgentRuntimeProtocolLimits.
+func (in *AgentRuntimeProtocolLimits) DeepCopy() *AgentRuntimeProtocolLimits {
+	if in == nil {
+		return nil
+	}
+	out := new(AgentRuntimeProtocolLimits)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *AgentRuntimeReference) DeepCopyInto(out *AgentRuntimeReference) {
 	*out = *in
@@ -361,8 +528,13 @@ func (in *AgentRuntimeReference) DeepCopy() *AgentRuntimeReference {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *AgentRuntimeRegistrySpec) DeepCopyInto(out *AgentRuntimeRegistrySpec) {
 	*out = *in
+	if in.ContractVersion != nil {
+		in, out := &in.ContractVersion, &out.ContractVersion
+		*out = new(AgentRuntimeContractVersion)
+		**out = **in
+	}
 	out.Deployment = in.Deployment
-	out.ClientAuth = in.ClientAuth
+	in.ClientAuth.DeepCopyInto(&out.ClientAuth)
 	if in.Capabilities != nil {
 		in, out := &in.Capabilities, &out.Capabilities
 		*out = new(AgentRuntimeCapabilitiesSpec)
@@ -380,12 +552,27 @@ func (in *AgentRuntimeRegistrySpec) DeepCopy() *AgentRuntimeRegistrySpec {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AgentRuntimeSecretKeyReference) DeepCopyInto(out *AgentRuntimeSecretKeyReference) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AgentRuntimeSecretKeyReference.
+func (in *AgentRuntimeSecretKeyReference) DeepCopy() *AgentRuntimeSecretKeyReference {
+	if in == nil {
+		return nil
+	}
+	out := new(AgentRuntimeSecretKeyReference)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *AgentRuntimeSpec) DeepCopyInto(out *AgentRuntimeSpec) {
 	*out = *in
 	if in.Workspace != nil {
 		in, out := &in.Workspace, &out.Workspace
-		*out = new(WorkspaceConfig)
+		*out = new(LegacyAgentWorkspaceConfig)
 		(*in).DeepCopyInto(*out)
 	}
 	if in.MaxTurns != nil {
@@ -451,6 +638,21 @@ func (in *AgentRuntimeStatus) DeepCopy() *AgentRuntimeStatus {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AgentRuntimeWorkspaceGovernanceCapabilities) DeepCopyInto(out *AgentRuntimeWorkspaceGovernanceCapabilities) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AgentRuntimeWorkspaceGovernanceCapabilities.
+func (in *AgentRuntimeWorkspaceGovernanceCapabilities) DeepCopy() *AgentRuntimeWorkspaceGovernanceCapabilities {
+	if in == nil {
+		return nil
+	}
+	out := new(AgentRuntimeWorkspaceGovernanceCapabilities)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *AgentSpec) DeepCopyInto(out *AgentSpec) {
 	*out = *in
@@ -588,160 +790,420 @@ func (in *AzureConfig) DeepCopy() *AzureConfig {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ChildTaskStatus) DeepCopyInto(out *ChildTaskStatus) {
+func (in *BranchClaim) DeepCopyInto(out *BranchClaim) {
 	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Spec = in.Spec
+	in.Status.DeepCopyInto(&out.Status)
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ChildTaskStatus.
-func (in *ChildTaskStatus) DeepCopy() *ChildTaskStatus {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BranchClaim.
+func (in *BranchClaim) DeepCopy() *BranchClaim {
 	if in == nil {
 		return nil
 	}
-	out := new(ChildTaskStatus)
+	out := new(BranchClaim)
 	in.DeepCopyInto(out)
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *BranchClaim) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigMapKeySelector) DeepCopyInto(out *ConfigMapKeySelector) {
+func (in *BranchClaimList) DeepCopyInto(out *BranchClaimList) {
 	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]BranchClaim, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigMapKeySelector.
-func (in *ConfigMapKeySelector) DeepCopy() *ConfigMapKeySelector {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BranchClaimList.
+func (in *BranchClaimList) DeepCopy() *BranchClaimList {
 	if in == nil {
 		return nil
 	}
-	out := new(ConfigMapKeySelector)
+	out := new(BranchClaimList)
 	in.DeepCopyInto(out)
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *BranchClaimList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CoordinationConfig) DeepCopyInto(out *CoordinationConfig) {
+func (in *BranchClaimSpec) DeepCopyInto(out *BranchClaimSpec) {
 	*out = *in
-	if in.AllowedAgents != nil {
-		in, out := &in.AllowedAgents, &out.AllowedAgents
-		*out = make([]AllowedAgent, len(*in))
-		copy(*out, *in)
-	}
-	if in.ApprovalRequiredTools != nil {
-		in, out := &in.ApprovalRequiredTools, &out.ApprovalRequiredTools
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CoordinationConfig.
-func (in *CoordinationConfig) DeepCopy() *CoordinationConfig {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BranchClaimSpec.
+func (in *BranchClaimSpec) DeepCopy() *BranchClaimSpec {
 	if in == nil {
 		return nil
 	}
-	out := new(CoordinationConfig)
+	out := new(BranchClaimSpec)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *DirectOutboundAccess) DeepCopyInto(out *DirectOutboundAccess) {
+func (in *BranchClaimStatus) DeepCopyInto(out *BranchClaimStatus) {
 	*out = *in
-	in.TokenEndpoint.DeepCopyInto(&out.TokenEndpoint)
-	in.Subject.DeepCopyInto(&out.Subject)
-	if in.Actor != nil {
-		in, out := &in.Actor, &out.Actor
-		*out = new(OutboundTokenSource)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.Audiences != nil {
-		in, out := &in.Audiences, &out.Audiences
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.Scopes != nil {
-		in, out := &in.Scopes, &out.Scopes
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.Resources != nil {
-		in, out := &in.Resources, &out.Resources
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.AdditionalParameters != nil {
-		in, out := &in.AdditionalParameters, &out.AdditionalParameters
-		*out = make(map[string]string, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-	if in.ClientAuthentication != nil {
-		in, out := &in.ClientAuthentication, &out.ClientAuthentication
-		*out = new(OutboundClientAuthentication)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.Output != nil {
-		in, out := &in.Output, &out.Output
-		*out = new(OutboundCredentialOutput)
-		(*in).DeepCopyInto(*out)
+	if in.LastVerified != nil {
+		in, out := &in.LastVerified, &out.LastVerified
+		*out = new(ControlRemoteRefState)
+		**out = **in
 	}
+	in.ControlRecordMutationStatus.DeepCopyInto(&out.ControlRecordMutationStatus)
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DirectOutboundAccess.
-func (in *DirectOutboundAccess) DeepCopy() *DirectOutboundAccess {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BranchClaimStatus.
+func (in *BranchClaimStatus) DeepCopy() *BranchClaimStatus {
 	if in == nil {
 		return nil
 	}
-	out := new(DirectOutboundAccess)
+	out := new(BranchClaimStatus)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ExecutionSpec) DeepCopyInto(out *ExecutionSpec) {
+func (in *ChildTaskStatus) DeepCopyInto(out *ChildTaskStatus) {
 	*out = *in
-	if in.NodeSelector != nil {
-		in, out := &in.NodeSelector, &out.NodeSelector
-		*out = make(map[string]string, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-	if in.Tolerations != nil {
-		in, out := &in.Tolerations, &out.Tolerations
-		*out = make([]corev1.Toleration, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	if in.Affinity != nil {
-		in, out := &in.Affinity, &out.Affinity
-		*out = new(corev1.Affinity)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.Workspace != nil {
-		in, out := &in.Workspace, &out.Workspace
-		*out = new(ExecutionWorkspaceSpec)
-		(*in).DeepCopyInto(*out)
-	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExecutionSpec.
-func (in *ExecutionSpec) DeepCopy() *ExecutionSpec {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ChildTaskStatus.
+func (in *ChildTaskStatus) DeepCopy() *ChildTaskStatus {
 	if in == nil {
 		return nil
 	}
-	out := new(ExecutionSpec)
+	out := new(ChildTaskStatus)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ExecutionWorkspaceDensityStatus) DeepCopyInto(out *ExecutionWorkspaceDensityStatus) {
+func (in *ConfigMapKeySelector) DeepCopyInto(out *ConfigMapKeySelector) {
 	*out = *in
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExecutionWorkspaceDensityStatus.
-func (in *ExecutionWorkspaceDensityStatus) DeepCopy() *ExecutionWorkspaceDensityStatus {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigMapKeySelector.
+func (in *ConfigMapKeySelector) DeepCopy() *ConfigMapKeySelector {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigMapKeySelector)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ControlRecordMutationStatus) DeepCopyInto(out *ControlRecordMutationStatus) {
+	*out = *in
+	if in.CreatedAt != nil {
+		in, out := &in.CreatedAt, &out.CreatedAt
+		*out = (*in).DeepCopy()
+	}
+	if in.UpdatedAt != nil {
+		in, out := &in.UpdatedAt, &out.UpdatedAt
+		*out = (*in).DeepCopy()
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ControlRecordMutationStatus.
+func (in *ControlRecordMutationStatus) DeepCopy() *ControlRecordMutationStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(ControlRecordMutationStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ControlRecordOwner) DeepCopyInto(out *ControlRecordOwner) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ControlRecordOwner.
+func (in *ControlRecordOwner) DeepCopy() *ControlRecordOwner {
+	if in == nil {
+		return nil
+	}
+	out := new(ControlRecordOwner)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ControlRemoteRefState) DeepCopyInto(out *ControlRemoteRefState) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ControlRemoteRefState.
+func (in *ControlRemoteRefState) DeepCopy() *ControlRemoteRefState {
+	if in == nil {
+		return nil
+	}
+	out := new(ControlRemoteRefState)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ControlVerifiedBranchBaseline) DeepCopyInto(out *ControlVerifiedBranchBaseline) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ControlVerifiedBranchBaseline.
+func (in *ControlVerifiedBranchBaseline) DeepCopy() *ControlVerifiedBranchBaseline {
+	if in == nil {
+		return nil
+	}
+	out := new(ControlVerifiedBranchBaseline)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ControllerEpoch) DeepCopyInto(out *ControllerEpoch) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Spec = in.Spec
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ControllerEpoch.
+func (in *ControllerEpoch) DeepCopy() *ControllerEpoch {
+	if in == nil {
+		return nil
+	}
+	out := new(ControllerEpoch)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ControllerEpoch) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ControllerEpochList) DeepCopyInto(out *ControllerEpochList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]ControllerEpoch, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ControllerEpochList.
+func (in *ControllerEpochList) DeepCopy() *ControllerEpochList {
+	if in == nil {
+		return nil
+	}
+	out := new(ControllerEpochList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ControllerEpochList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ControllerEpochSpec) DeepCopyInto(out *ControllerEpochSpec) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ControllerEpochSpec.
+func (in *ControllerEpochSpec) DeepCopy() *ControllerEpochSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ControllerEpochSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ControllerEpochStatus) DeepCopyInto(out *ControllerEpochStatus) {
+	*out = *in
+	if in.AcquiredAt != nil {
+		in, out := &in.AcquiredAt, &out.AcquiredAt
+		*out = (*in).DeepCopy()
+	}
+	if in.UpdatedAt != nil {
+		in, out := &in.UpdatedAt, &out.UpdatedAt
+		*out = (*in).DeepCopy()
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ControllerEpochStatus.
+func (in *ControllerEpochStatus) DeepCopy() *ControllerEpochStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(ControllerEpochStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CoordinationConfig) DeepCopyInto(out *CoordinationConfig) {
+	*out = *in
+	if in.AllowedAgents != nil {
+		in, out := &in.AllowedAgents, &out.AllowedAgents
+		*out = make([]AllowedAgent, len(*in))
+		copy(*out, *in)
+	}
+	if in.ApprovalRequiredTools != nil {
+		in, out := &in.ApprovalRequiredTools, &out.ApprovalRequiredTools
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CoordinationConfig.
+func (in *CoordinationConfig) DeepCopy() *CoordinationConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(CoordinationConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DirectOutboundAccess) DeepCopyInto(out *DirectOutboundAccess) {
+	*out = *in
+	in.TokenEndpoint.DeepCopyInto(&out.TokenEndpoint)
+	in.Subject.DeepCopyInto(&out.Subject)
+	if in.Actor != nil {
+		in, out := &in.Actor, &out.Actor
+		*out = new(OutboundTokenSource)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Audiences != nil {
+		in, out := &in.Audiences, &out.Audiences
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Scopes != nil {
+		in, out := &in.Scopes, &out.Scopes
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Resources != nil {
+		in, out := &in.Resources, &out.Resources
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.AdditionalParameters != nil {
+		in, out := &in.AdditionalParameters, &out.AdditionalParameters
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.ClientAuthentication != nil {
+		in, out := &in.ClientAuthentication, &out.ClientAuthentication
+		*out = new(OutboundClientAuthentication)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Output != nil {
+		in, out := &in.Output, &out.Output
+		*out = new(OutboundCredentialOutput)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DirectOutboundAccess.
+func (in *DirectOutboundAccess) DeepCopy() *DirectOutboundAccess {
+	if in == nil {
+		return nil
+	}
+	out := new(DirectOutboundAccess)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExecutionSpec) DeepCopyInto(out *ExecutionSpec) {
+	*out = *in
+	if in.NodeSelector != nil {
+		in, out := &in.NodeSelector, &out.NodeSelector
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Tolerations != nil {
+		in, out := &in.Tolerations, &out.Tolerations
+		*out = make([]corev1.Toleration, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Affinity != nil {
+		in, out := &in.Affinity, &out.Affinity
+		*out = new(corev1.Affinity)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Workspace != nil {
+		in, out := &in.Workspace, &out.Workspace
+		*out = new(ExecutionWorkspaceSpec)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExecutionSpec.
+func (in *ExecutionSpec) DeepCopy() *ExecutionSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ExecutionSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExecutionWorkspaceDensityStatus) DeepCopyInto(out *ExecutionWorkspaceDensityStatus) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExecutionWorkspaceDensityStatus.
+func (in *ExecutionWorkspaceDensityStatus) DeepCopy() *ExecutionWorkspaceDensityStatus {
 	if in == nil {
 		return nil
 	}
@@ -892,11 +1354,51 @@ func (in *ExecutionWorkspaceStatus) DeepCopy() *ExecutionWorkspaceStatus {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *FindingCountsStatus) DeepCopyInto(out *FindingCountsStatus) {
+func (in *ExternalEffectSpec) DeepCopyInto(out *ExternalEffectSpec) {
 	*out = *in
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FindingCountsStatus.
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalEffectSpec.
+func (in *ExternalEffectSpec) DeepCopy() *ExternalEffectSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalEffectSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExternalEffectStatus) DeepCopyInto(out *ExternalEffectStatus) {
+	*out = *in
+	if in.Response != nil {
+		in, out := &in.Response, &out.Response
+		*out = new(apiextensionsv1.JSON)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.LeaseExpiresAt != nil {
+		in, out := &in.LeaseExpiresAt, &out.LeaseExpiresAt
+		*out = (*in).DeepCopy()
+	}
+	in.ControlRecordMutationStatus.DeepCopyInto(&out.ControlRecordMutationStatus)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalEffectStatus.
+func (in *ExternalEffectStatus) DeepCopy() *ExternalEffectStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalEffectStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *FindingCountsStatus) DeepCopyInto(out *FindingCountsStatus) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FindingCountsStatus.
 func (in *FindingCountsStatus) DeepCopy() *FindingCountsStatus {
 	if in == nil {
 		return nil
@@ -967,6 +1469,14 @@ func (in *HTTPExecution) DeepCopy() *HTTPExecution {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *HarnessRuntimeStatus) DeepCopyInto(out *HarnessRuntimeStatus) {
 	*out = *in
+	if in.CancelRequestedAt != nil {
+		in, out := &in.CancelRequestedAt, &out.CancelRequestedAt
+		*out = (*in).DeepCopy()
+	}
+	if in.LastTransitionTime != nil {
+		in, out := &in.LastTransitionTime, &out.LastTransitionTime
+		*out = (*in).DeepCopy()
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HarnessRuntimeStatus.
@@ -979,6 +1489,26 @@ func (in *HarnessRuntimeStatus) DeepCopy() *HarnessRuntimeStatus {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *LegacyAgentWorkspaceConfig) DeepCopyInto(out *LegacyAgentWorkspaceConfig) {
+	*out = *in
+	if in.GitSecretRef != nil {
+		in, out := &in.GitSecretRef, &out.GitSecretRef
+		*out = new(corev1.LocalObjectReference)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LegacyAgentWorkspaceConfig.
+func (in *LegacyAgentWorkspaceConfig) DeepCopy() *LegacyAgentWorkspaceConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(LegacyAgentWorkspaceConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *LocalObjectReference) DeepCopyInto(out *LocalObjectReference) {
 	*out = *in
@@ -1043,6 +1573,11 @@ func (in *ModelConfig) DeepCopyInto(out *ModelConfig) {
 		*out = new(float64)
 		**out = **in
 	}
+	if in.ContextWindow != nil {
+		in, out := &in.ContextWindow, &out.ContextWindow
+		*out = new(int32)
+		**out = **in
+	}
 	if in.MaxTokens != nil {
 		in, out := &in.MaxTokens, &out.MaxTokens
 		*out = new(int32)
@@ -1080,6 +1615,21 @@ func (in *ModelFallback) DeepCopy() *ModelFallback {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ModelTokenLimits) DeepCopyInto(out *ModelTokenLimits) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ModelTokenLimits.
+func (in *ModelTokenLimits) DeepCopy() *ModelTokenLimits {
+	if in == nil {
+		return nil
+	}
+	out := new(ModelTokenLimits)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *NamespacedSecretKeySelector) DeepCopyInto(out *NamespacedSecretKeySelector) {
 	*out = *in
@@ -1371,6 +1921,22 @@ func (in *PolicyConfigMapKeyRef) DeepCopy() *PolicyConfigMapKeyRef {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PreparedPublicationControlReceipt) DeepCopyInto(out *PreparedPublicationControlReceipt) {
+	*out = *in
+	in.PreparedAt.DeepCopyInto(&out.PreparedAt)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PreparedPublicationControlReceipt.
+func (in *PreparedPublicationControlReceipt) DeepCopy() *PreparedPublicationControlReceipt {
+	if in == nil {
+		return nil
+	}
+	out := new(PreparedPublicationControlReceipt)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *PriorTaskReference) DeepCopyInto(out *PriorTaskReference) {
 	*out = *in
@@ -1386,6 +1952,116 @@ func (in *PriorTaskReference) DeepCopy() *PriorTaskReference {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PromptAttempt) DeepCopyInto(out *PromptAttempt) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PromptAttempt.
+func (in *PromptAttempt) DeepCopy() *PromptAttempt {
+	if in == nil {
+		return nil
+	}
+	out := new(PromptAttempt)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PromptAttempt) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PromptAttemptList) DeepCopyInto(out *PromptAttemptList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]PromptAttempt, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PromptAttemptList.
+func (in *PromptAttemptList) DeepCopy() *PromptAttemptList {
+	if in == nil {
+		return nil
+	}
+	out := new(PromptAttemptList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PromptAttemptList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PromptAttemptSpec) DeepCopyInto(out *PromptAttemptSpec) {
+	*out = *in
+	if in.CredentialBindings != nil {
+		in, out := &in.CredentialBindings, &out.CredentialBindings
+		*out = make([]PromptCredentialBinding, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PromptAttemptSpec.
+func (in *PromptAttemptSpec) DeepCopy() *PromptAttemptSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(PromptAttemptSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PromptAttemptStatus) DeepCopyInto(out *PromptAttemptStatus) {
+	*out = *in
+	in.ControlRecordMutationStatus.DeepCopyInto(&out.ControlRecordMutationStatus)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PromptAttemptStatus.
+func (in *PromptAttemptStatus) DeepCopy() *PromptAttemptStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(PromptAttemptStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PromptCredentialBinding) DeepCopyInto(out *PromptCredentialBinding) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PromptCredentialBinding.
+func (in *PromptCredentialBinding) DeepCopy() *PromptCredentialBinding {
+	if in == nil {
+		return nil
+	}
+	out := new(PromptCredentialBinding)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *PromptSource) DeepCopyInto(out *PromptSource) {
 	*out = *in
@@ -1573,51 +2249,58 @@ func (in *ProviderStatus) DeepCopy() *ProviderStatus {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RateLimitConfig) DeepCopyInto(out *RateLimitConfig) {
+func (in *Publication) DeepCopyInto(out *Publication) {
 	*out = *in
-	if in.RequestsPerMinute != nil {
-		in, out := &in.RequestsPerMinute, &out.RequestsPerMinute
-		*out = new(int32)
-		**out = **in
-	}
-	if in.TokensPerMinute != nil {
-		in, out := &in.TokensPerMinute, &out.TokensPerMinute
-		*out = new(int64)
-		**out = **in
-	}
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitConfig.
-func (in *RateLimitConfig) DeepCopy() *RateLimitConfig {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Publication.
+func (in *Publication) DeepCopy() *Publication {
 	if in == nil {
 		return nil
 	}
-	out := new(RateLimitConfig)
+	out := new(Publication)
 	in.DeepCopyInto(out)
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Publication) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RepositoryMonitor) DeepCopyInto(out *RepositoryMonitor) {
+func (in *PublicationList) DeepCopyInto(out *PublicationList) {
 	*out = *in
 	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Publication, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryMonitor.
-func (in *RepositoryMonitor) DeepCopy() *RepositoryMonitor {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PublicationList.
+func (in *PublicationList) DeepCopy() *PublicationList {
 	if in == nil {
 		return nil
 	}
-	out := new(RepositoryMonitor)
+	out := new(PublicationList)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *RepositoryMonitor) DeepCopyObject() runtime.Object {
+func (in *PublicationList) DeepCopyObject() runtime.Object {
 	if c := in.DeepCopy(); c != nil {
 		return c
 	}
@@ -1625,91 +2308,281 @@ func (in *RepositoryMonitor) DeepCopyObject() runtime.Object {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RepositoryMonitorAdvisoryLabels) DeepCopyInto(out *RepositoryMonitorAdvisoryLabels) {
+func (in *PublicationPullRequestIntent) DeepCopyInto(out *PublicationPullRequestIntent) {
 	*out = *in
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryMonitorAdvisoryLabels.
-func (in *RepositoryMonitorAdvisoryLabels) DeepCopy() *RepositoryMonitorAdvisoryLabels {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PublicationPullRequestIntent.
+func (in *PublicationPullRequestIntent) DeepCopy() *PublicationPullRequestIntent {
 	if in == nil {
 		return nil
 	}
-	out := new(RepositoryMonitorAdvisoryLabels)
+	out := new(PublicationPullRequestIntent)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RepositoryMonitorAgents) DeepCopyInto(out *RepositoryMonitorAgents) {
+func (in *PublicationSpec) DeepCopyInto(out *PublicationSpec) {
 	*out = *in
-	if in.Reviewer != nil {
-		in, out := &in.Reviewer, &out.Reviewer
-		*out = new(AgentReference)
-		**out = **in
-	}
-	if in.Triager != nil {
-		in, out := &in.Triager, &out.Triager
-		*out = new(AgentReference)
-		**out = **in
-	}
-	if in.Researcher != nil {
-		in, out := &in.Researcher, &out.Researcher
-		*out = new(AgentReference)
-		**out = **in
-	}
-	if in.Planner != nil {
-		in, out := &in.Planner, &out.Planner
-		*out = new(AgentReference)
-		**out = **in
-	}
-	if in.Repairer != nil {
-		in, out := &in.Repairer, &out.Repairer
-		*out = new(AgentReference)
-		**out = **in
-	}
-	if in.Implementer != nil {
-		in, out := &in.Implementer, &out.Implementer
-		*out = new(AgentReference)
-		**out = **in
-	}
+	out.Baseline = in.Baseline
+	in.CommitTimestamp.DeepCopyInto(&out.CommitTimestamp)
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryMonitorAgents.
-func (in *RepositoryMonitorAgents) DeepCopy() *RepositoryMonitorAgents {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PublicationSpec.
+func (in *PublicationSpec) DeepCopy() *PublicationSpec {
 	if in == nil {
 		return nil
 	}
-	out := new(RepositoryMonitorAgents)
+	out := new(PublicationSpec)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RepositoryMonitorAutomergeSpec) DeepCopyInto(out *RepositoryMonitorAutomergeSpec) {
+func (in *PublicationStatus) DeepCopyInto(out *PublicationStatus) {
 	*out = *in
-	if in.RequireMaintainerOptIn != nil {
-		in, out := &in.RequireMaintainerOptIn, &out.RequireMaintainerOptIn
-		*out = new(bool)
+	if in.PRIntent != nil {
+		in, out := &in.PRIntent, &out.PRIntent
+		*out = new(PublicationPullRequestIntent)
 		**out = **in
 	}
-	if in.RequireGlobalMergeGate != nil {
-		in, out := &in.RequireGlobalMergeGate, &out.RequireGlobalMergeGate
-		*out = new(bool)
-		**out = **in
+	if in.PreparedReceipt != nil {
+		in, out := &in.PreparedReceipt, &out.PreparedReceipt
+		*out = new(PreparedPublicationControlReceipt)
+		(*in).DeepCopyInto(*out)
 	}
-	if in.AllowedMergeMethods != nil {
-		in, out := &in.AllowedMergeMethods, &out.AllowedMergeMethods
-		*out = make([]string, len(*in))
-		copy(*out, *in)
+	if in.PublishReceipt != nil {
+		in, out := &in.PublishReceipt, &out.PublishReceipt
+		*out = new(PublishOperationControlReceipt)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.VerificationReceipt != nil {
+		in, out := &in.VerificationReceipt, &out.VerificationReceipt
+		*out = new(PublicationVerificationControlReceipt)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.PullRequestReceipt != nil {
+		in, out := &in.PullRequestReceipt, &out.PullRequestReceipt
+		*out = new(PullRequestOperationControlReceipt)
+		(*in).DeepCopyInto(*out)
 	}
+	in.ControlRecordMutationStatus.DeepCopyInto(&out.ControlRecordMutationStatus)
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryMonitorAutomergeSpec.
-func (in *RepositoryMonitorAutomergeSpec) DeepCopy() *RepositoryMonitorAutomergeSpec {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PublicationStatus.
+func (in *PublicationStatus) DeepCopy() *PublicationStatus {
 	if in == nil {
 		return nil
 	}
-	out := new(RepositoryMonitorAutomergeSpec)
+	out := new(PublicationStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PublicationVerificationControlReceipt) DeepCopyInto(out *PublicationVerificationControlReceipt) {
+	*out = *in
+	out.ObservedRemote = in.ObservedRemote
+	in.VerifiedAt.DeepCopyInto(&out.VerifiedAt)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PublicationVerificationControlReceipt.
+func (in *PublicationVerificationControlReceipt) DeepCopy() *PublicationVerificationControlReceipt {
+	if in == nil {
+		return nil
+	}
+	out := new(PublicationVerificationControlReceipt)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PublishOperationControlReceipt) DeepCopyInto(out *PublishOperationControlReceipt) {
+	*out = *in
+	out.RemoteBefore = in.RemoteBefore
+	in.PublishedAt.DeepCopyInto(&out.PublishedAt)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PublishOperationControlReceipt.
+func (in *PublishOperationControlReceipt) DeepCopy() *PublishOperationControlReceipt {
+	if in == nil {
+		return nil
+	}
+	out := new(PublishOperationControlReceipt)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PullRequestOperationControlReceipt) DeepCopyInto(out *PullRequestOperationControlReceipt) {
+	*out = *in
+	in.ReconciledAt.DeepCopyInto(&out.ReconciledAt)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PullRequestOperationControlReceipt.
+func (in *PullRequestOperationControlReceipt) DeepCopy() *PullRequestOperationControlReceipt {
+	if in == nil {
+		return nil
+	}
+	out := new(PullRequestOperationControlReceipt)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RateLimitConfig) DeepCopyInto(out *RateLimitConfig) {
+	*out = *in
+	if in.RequestsPerMinute != nil {
+		in, out := &in.RequestsPerMinute, &out.RequestsPerMinute
+		*out = new(int32)
+		**out = **in
+	}
+	if in.TokensPerMinute != nil {
+		in, out := &in.TokensPerMinute, &out.TokensPerMinute
+		*out = new(int64)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitConfig.
+func (in *RateLimitConfig) DeepCopy() *RateLimitConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(RateLimitConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositoryIdentity) DeepCopyInto(out *RepositoryIdentity) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryIdentity.
+func (in *RepositoryIdentity) DeepCopy() *RepositoryIdentity {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryIdentity)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositoryMonitor) DeepCopyInto(out *RepositoryMonitor) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryMonitor.
+func (in *RepositoryMonitor) DeepCopy() *RepositoryMonitor {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryMonitor)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *RepositoryMonitor) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositoryMonitorAdvisoryLabels) DeepCopyInto(out *RepositoryMonitorAdvisoryLabels) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryMonitorAdvisoryLabels.
+func (in *RepositoryMonitorAdvisoryLabels) DeepCopy() *RepositoryMonitorAdvisoryLabels {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryMonitorAdvisoryLabels)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositoryMonitorAgents) DeepCopyInto(out *RepositoryMonitorAgents) {
+	*out = *in
+	if in.Reviewer != nil {
+		in, out := &in.Reviewer, &out.Reviewer
+		*out = new(AgentReference)
+		**out = **in
+	}
+	if in.Triager != nil {
+		in, out := &in.Triager, &out.Triager
+		*out = new(AgentReference)
+		**out = **in
+	}
+	if in.Researcher != nil {
+		in, out := &in.Researcher, &out.Researcher
+		*out = new(AgentReference)
+		**out = **in
+	}
+	if in.Planner != nil {
+		in, out := &in.Planner, &out.Planner
+		*out = new(AgentReference)
+		**out = **in
+	}
+	if in.Repairer != nil {
+		in, out := &in.Repairer, &out.Repairer
+		*out = new(AgentReference)
+		**out = **in
+	}
+	if in.Implementer != nil {
+		in, out := &in.Implementer, &out.Implementer
+		*out = new(AgentReference)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryMonitorAgents.
+func (in *RepositoryMonitorAgents) DeepCopy() *RepositoryMonitorAgents {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryMonitorAgents)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositoryMonitorAutomergeSpec) DeepCopyInto(out *RepositoryMonitorAutomergeSpec) {
+	*out = *in
+	if in.RequireMaintainerOptIn != nil {
+		in, out := &in.RequireMaintainerOptIn, &out.RequireMaintainerOptIn
+		*out = new(bool)
+		**out = **in
+	}
+	if in.RequireGlobalMergeGate != nil {
+		in, out := &in.RequireGlobalMergeGate, &out.RequireGlobalMergeGate
+		*out = new(bool)
+		**out = **in
+	}
+	if in.AllowedMergeMethods != nil {
+		in, out := &in.AllowedMergeMethods, &out.AllowedMergeMethods
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryMonitorAutomergeSpec.
+func (in *RepositoryMonitorAutomergeSpec) DeepCopy() *RepositoryMonitorAutomergeSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryMonitorAutomergeSpec)
 	in.DeepCopyInto(out)
 	return out
 }
@@ -2165,6 +3038,26 @@ func (in *RepositoryMonitorSpec) DeepCopyInto(out *RepositoryMonitorSpec) {
 		*out = new(corev1.LocalObjectReference)
 		**out = **in
 	}
+	if in.ReadCredentialRef != nil {
+		in, out := &in.ReadCredentialRef, &out.ReadCredentialRef
+		*out = new(corev1.LocalObjectReference)
+		**out = **in
+	}
+	if in.PublicationReadCredentialRef != nil {
+		in, out := &in.PublicationReadCredentialRef, &out.PublicationReadCredentialRef
+		*out = new(corev1.LocalObjectReference)
+		**out = **in
+	}
+	if in.PublicationCredentialRef != nil {
+		in, out := &in.PublicationCredentialRef, &out.PublicationCredentialRef
+		*out = new(corev1.LocalObjectReference)
+		**out = **in
+	}
+	if in.ForgeCredentialRef != nil {
+		in, out := &in.ForgeCredentialRef, &out.ForgeCredentialRef
+		*out = new(corev1.LocalObjectReference)
+		**out = **in
+	}
 	if in.TimeZone != nil {
 		in, out := &in.TimeZone, &out.TimeZone
 		*out = new(string)
@@ -2234,73 +3127,544 @@ func (in *RepositoryMonitorTargets) DeepCopyInto(out *RepositoryMonitorTargets)
 	in.Commits.DeepCopyInto(&out.Commits)
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryMonitorTargets.
-func (in *RepositoryMonitorTargets) DeepCopy() *RepositoryMonitorTargets {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryMonitorTargets.
+func (in *RepositoryMonitorTargets) DeepCopy() *RepositoryMonitorTargets {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryMonitorTargets)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositoryMonitorTriggers) DeepCopyInto(out *RepositoryMonitorTriggers) {
+	*out = *in
+	out.GitHub = in.GitHub
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryMonitorTriggers.
+func (in *RepositoryMonitorTriggers) DeepCopy() *RepositoryMonitorTriggers {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryMonitorTriggers)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositoryMonitorValidationSpec) DeepCopyInto(out *RepositoryMonitorValidationSpec) {
+	*out = *in
+	if in.Commands != nil {
+		in, out := &in.Commands, &out.Commands
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryMonitorValidationSpec.
+func (in *RepositoryMonitorValidationSpec) DeepCopy() *RepositoryMonitorValidationSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryMonitorValidationSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositoryScan) DeepCopyInto(out *RepositoryScan) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryScan.
+func (in *RepositoryScan) DeepCopy() *RepositoryScan {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryScan)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *RepositoryScan) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositoryScanList) DeepCopyInto(out *RepositoryScanList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]RepositoryScan, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryScanList.
+func (in *RepositoryScanList) DeepCopy() *RepositoryScanList {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryScanList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *RepositoryScanList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositoryScanSpec) DeepCopyInto(out *RepositoryScanSpec) {
+	*out = *in
+	if in.GitSecretRef != nil {
+		in, out := &in.GitSecretRef, &out.GitSecretRef
+		*out = new(corev1.LocalObjectReference)
+		**out = **in
+	}
+	if in.ReadCredentialRef != nil {
+		in, out := &in.ReadCredentialRef, &out.ReadCredentialRef
+		*out = new(corev1.LocalObjectReference)
+		**out = **in
+	}
+	if in.PublicationReadCredentialRef != nil {
+		in, out := &in.PublicationReadCredentialRef, &out.PublicationReadCredentialRef
+		*out = new(corev1.LocalObjectReference)
+		**out = **in
+	}
+	if in.PublicationCredentialRef != nil {
+		in, out := &in.PublicationCredentialRef, &out.PublicationCredentialRef
+		*out = new(corev1.LocalObjectReference)
+		**out = **in
+	}
+	if in.ForgeCredentialRef != nil {
+		in, out := &in.ForgeCredentialRef, &out.ForgeCredentialRef
+		*out = new(corev1.LocalObjectReference)
+		**out = **in
+	}
+	if in.TimeZone != nil {
+		in, out := &in.TimeZone, &out.TimeZone
+		*out = new(string)
+		**out = **in
+	}
+	if in.HistoryDays != nil {
+		in, out := &in.HistoryDays, &out.HistoryDays
+		*out = new(int32)
+		**out = **in
+	}
+	if in.ValidationMaxFindingsPerRun != nil {
+		in, out := &in.ValidationMaxFindingsPerRun, &out.ValidationMaxFindingsPerRun
+		*out = new(int32)
+		**out = **in
+	}
+	if in.CustomScanInstructionsRef != nil {
+		in, out := &in.CustomScanInstructionsRef, &out.CustomScanInstructionsRef
+		*out = new(PolicyConfigMapKeyRef)
+		**out = **in
+	}
+	if in.FalsePositivePolicyRef != nil {
+		in, out := &in.FalsePositivePolicyRef, &out.FalsePositivePolicyRef
+		*out = new(PolicyConfigMapKeyRef)
+		**out = **in
+	}
+	out.AnalysisAgentRef = in.AnalysisAgentRef
+	if in.PatchAgentRef != nil {
+		in, out := &in.PatchAgentRef, &out.PatchAgentRef
+		*out = new(AgentReference)
+		**out = **in
+	}
+	if in.MaxFindingsPerRun != nil {
+		in, out := &in.MaxFindingsPerRun, &out.MaxFindingsPerRun
+		*out = new(int32)
+		**out = **in
+	}
+	if in.Suspend != nil {
+		in, out := &in.Suspend, &out.Suspend
+		*out = new(bool)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryScanSpec.
+func (in *RepositoryScanSpec) DeepCopy() *RepositoryScanSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryScanSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositoryScanStatus) DeepCopyInto(out *RepositoryScanStatus) {
+	*out = *in
+	if in.LastScanAt != nil {
+		in, out := &in.LastScanAt, &out.LastScanAt
+		*out = (*in).DeepCopy()
+	}
+	if in.LastSuccessfulScanAt != nil {
+		in, out := &in.LastSuccessfulScanAt, &out.LastSuccessfulScanAt
+		*out = (*in).DeepCopy()
+	}
+	out.FindingCounts = in.FindingCounts
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]v1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryScanStatus.
+func (in *RepositoryScanStatus) DeepCopy() *RepositoryScanStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryScanStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RequestedBy) DeepCopyInto(out *RequestedBy) {
+	*out = *in
+	if in.Groups != nil {
+		in, out := &in.Groups, &out.Groups
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Roles != nil {
+		in, out := &in.Roles, &out.Roles
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RequestedBy.
+func (in *RequestedBy) DeepCopy() *RequestedBy {
+	if in == nil {
+		return nil
+	}
+	out := new(RequestedBy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ResultReference) DeepCopyInto(out *ResultReference) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResultReference.
+func (in *ResultReference) DeepCopy() *ResultReference {
+	if in == nil {
+		return nil
+	}
+	out := new(ResultReference)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RetryPolicy) DeepCopyInto(out *RetryPolicy) {
+	*out = *in
+	if in.InitialDelay != nil {
+		in, out := &in.InitialDelay, &out.InitialDelay
+		*out = new(v1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RetryPolicy.
+func (in *RetryPolicy) DeepCopy() *RetryPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(RetryPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RuntimePool) DeepCopyInto(out *RuntimePool) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RuntimePool.
+func (in *RuntimePool) DeepCopy() *RuntimePool {
+	if in == nil {
+		return nil
+	}
+	out := new(RuntimePool)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *RuntimePool) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RuntimePoolActiveInstanceStatus) DeepCopyInto(out *RuntimePoolActiveInstanceStatus) {
+	*out = *in
+	if in.LastObservedTime != nil {
+		in, out := &in.LastObservedTime, &out.LastObservedTime
+		*out = (*in).DeepCopy()
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RuntimePoolActiveInstanceStatus.
+func (in *RuntimePoolActiveInstanceStatus) DeepCopy() *RuntimePoolActiveInstanceStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(RuntimePoolActiveInstanceStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RuntimePoolCapacityReservationStatus) DeepCopyInto(out *RuntimePoolCapacityReservationStatus) {
+	*out = *in
+	in.ReservedAt.DeepCopyInto(&out.ReservedAt)
+	in.ExpiresAt.DeepCopyInto(&out.ExpiresAt)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RuntimePoolCapacityReservationStatus.
+func (in *RuntimePoolCapacityReservationStatus) DeepCopy() *RuntimePoolCapacityReservationStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(RuntimePoolCapacityReservationStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RuntimePoolCapacitySpec) DeepCopyInto(out *RuntimePoolCapacitySpec) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RuntimePoolCapacitySpec.
+func (in *RuntimePoolCapacitySpec) DeepCopy() *RuntimePoolCapacitySpec {
+	if in == nil {
+		return nil
+	}
+	out := new(RuntimePoolCapacitySpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RuntimePoolCapacityStatus) DeepCopyInto(out *RuntimePoolCapacityStatus) {
+	*out = *in
+	if in.Reservations != nil {
+		in, out := &in.Reservations, &out.Reservations
+		*out = make([]RuntimePoolCapacityReservationStatus, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RuntimePoolCapacityStatus.
+func (in *RuntimePoolCapacityStatus) DeepCopy() *RuntimePoolCapacityStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(RuntimePoolCapacityStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RuntimePoolList) DeepCopyInto(out *RuntimePoolList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]RuntimePool, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RuntimePoolList.
+func (in *RuntimePoolList) DeepCopy() *RuntimePoolList {
+	if in == nil {
+		return nil
+	}
+	out := new(RuntimePoolList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *RuntimePoolList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RuntimePoolProfileSpec) DeepCopyInto(out *RuntimePoolProfileSpec) {
+	*out = *in
+	if in.AdapterDigests != nil {
+		in, out := &in.AdapterDigests, &out.AdapterDigests
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.ModelLimits != nil {
+		in, out := &in.ModelLimits, &out.ModelLimits
+		*out = new(ModelTokenLimits)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RuntimePoolProfileSpec.
+func (in *RuntimePoolProfileSpec) DeepCopy() *RuntimePoolProfileSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(RuntimePoolProfileSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RuntimePoolRuntimeSpec) DeepCopyInto(out *RuntimePoolRuntimeSpec) {
+	*out = *in
+	in.Profile.DeepCopyInto(&out.Profile)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RuntimePoolRuntimeSpec.
+func (in *RuntimePoolRuntimeSpec) DeepCopy() *RuntimePoolRuntimeSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(RuntimePoolRuntimeSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RuntimePoolSpec) DeepCopyInto(out *RuntimePoolSpec) {
+	*out = *in
+	out.TrustDomain = in.TrustDomain
+	in.Runtime.DeepCopyInto(&out.Runtime)
+	if in.Capacity != nil {
+		in, out := &in.Capacity, &out.Capacity
+		*out = new(RuntimePoolCapacitySpec)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RuntimePoolSpec.
+func (in *RuntimePoolSpec) DeepCopy() *RuntimePoolSpec {
 	if in == nil {
 		return nil
 	}
-	out := new(RepositoryMonitorTargets)
+	out := new(RuntimePoolSpec)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RepositoryMonitorTriggers) DeepCopyInto(out *RepositoryMonitorTriggers) {
+func (in *RuntimePoolStatus) DeepCopyInto(out *RuntimePoolStatus) {
 	*out = *in
-	out.GitHub = in.GitHub
+	if in.ActiveInstance != nil {
+		in, out := &in.ActiveInstance, &out.ActiveInstance
+		*out = new(RuntimePoolActiveInstanceStatus)
+		(*in).DeepCopyInto(*out)
+	}
+	in.Capacity.DeepCopyInto(&out.Capacity)
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]v1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryMonitorTriggers.
-func (in *RepositoryMonitorTriggers) DeepCopy() *RepositoryMonitorTriggers {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RuntimePoolStatus.
+func (in *RuntimePoolStatus) DeepCopy() *RuntimePoolStatus {
 	if in == nil {
 		return nil
 	}
-	out := new(RepositoryMonitorTriggers)
+	out := new(RuntimePoolStatus)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RepositoryMonitorValidationSpec) DeepCopyInto(out *RepositoryMonitorValidationSpec) {
+func (in *RuntimePoolTrustDomain) DeepCopyInto(out *RuntimePoolTrustDomain) {
 	*out = *in
-	if in.Commands != nil {
-		in, out := &in.Commands, &out.Commands
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryMonitorValidationSpec.
-func (in *RepositoryMonitorValidationSpec) DeepCopy() *RepositoryMonitorValidationSpec {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RuntimePoolTrustDomain.
+func (in *RuntimePoolTrustDomain) DeepCopy() *RuntimePoolTrustDomain {
 	if in == nil {
 		return nil
 	}
-	out := new(RepositoryMonitorValidationSpec)
+	out := new(RuntimePoolTrustDomain)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RepositoryScan) DeepCopyInto(out *RepositoryScan) {
+func (in *RuntimeSessionControl) DeepCopyInto(out *RuntimeSessionControl) {
 	*out = *in
 	out.TypeMeta = in.TypeMeta
 	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
+	out.Spec = in.Spec
 	in.Status.DeepCopyInto(&out.Status)
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryScan.
-func (in *RepositoryScan) DeepCopy() *RepositoryScan {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RuntimeSessionControl.
+func (in *RuntimeSessionControl) DeepCopy() *RuntimeSessionControl {
 	if in == nil {
 		return nil
 	}
-	out := new(RepositoryScan)
+	out := new(RuntimeSessionControl)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *RepositoryScan) DeepCopyObject() runtime.Object {
+func (in *RuntimeSessionControl) DeepCopyObject() runtime.Object {
 	if c := in.DeepCopy(); c != nil {
 		return c
 	}
@@ -2308,31 +3672,31 @@ func (in *RepositoryScan) DeepCopyObject() runtime.Object {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RepositoryScanList) DeepCopyInto(out *RepositoryScanList) {
+func (in *RuntimeSessionControlList) DeepCopyInto(out *RuntimeSessionControlList) {
 	*out = *in
 	out.TypeMeta = in.TypeMeta
 	in.ListMeta.DeepCopyInto(&out.ListMeta)
 	if in.Items != nil {
 		in, out := &in.Items, &out.Items
-		*out = make([]RepositoryScan, len(*in))
+		*out = make([]RuntimeSessionControl, len(*in))
 		for i := range *in {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryScanList.
-func (in *RepositoryScanList) DeepCopy() *RepositoryScanList {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RuntimeSessionControlList.
+func (in *RuntimeSessionControlList) DeepCopy() *RuntimeSessionControlList {
 	if in == nil {
 		return nil
 	}
-	out := new(RepositoryScanList)
+	out := new(RuntimeSessionControlList)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *RepositoryScanList) DeepCopyObject() runtime.Object {
+func (in *RuntimeSessionControlList) DeepCopyObject() runtime.Object {
 	if c := in.DeepCopy(); c != nil {
 		return c
 	}
@@ -2340,153 +3704,84 @@ func (in *RepositoryScanList) DeepCopyObject() runtime.Object {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RepositoryScanSpec) DeepCopyInto(out *RepositoryScanSpec) {
+func (in *RuntimeSessionControlSpec) DeepCopyInto(out *RuntimeSessionControlSpec) {
 	*out = *in
-	if in.GitSecretRef != nil {
-		in, out := &in.GitSecretRef, &out.GitSecretRef
-		*out = new(corev1.LocalObjectReference)
-		**out = **in
-	}
-	if in.TimeZone != nil {
-		in, out := &in.TimeZone, &out.TimeZone
-		*out = new(string)
-		**out = **in
-	}
-	if in.HistoryDays != nil {
-		in, out := &in.HistoryDays, &out.HistoryDays
-		*out = new(int32)
-		**out = **in
-	}
-	if in.ValidationMaxFindingsPerRun != nil {
-		in, out := &in.ValidationMaxFindingsPerRun, &out.ValidationMaxFindingsPerRun
-		*out = new(int32)
-		**out = **in
-	}
-	if in.CustomScanInstructionsRef != nil {
-		in, out := &in.CustomScanInstructionsRef, &out.CustomScanInstructionsRef
-		*out = new(PolicyConfigMapKeyRef)
-		**out = **in
-	}
-	if in.FalsePositivePolicyRef != nil {
-		in, out := &in.FalsePositivePolicyRef, &out.FalsePositivePolicyRef
-		*out = new(PolicyConfigMapKeyRef)
-		**out = **in
-	}
-	out.AnalysisAgentRef = in.AnalysisAgentRef
-	if in.PatchAgentRef != nil {
-		in, out := &in.PatchAgentRef, &out.PatchAgentRef
-		*out = new(AgentReference)
-		**out = **in
-	}
-	if in.MaxFindingsPerRun != nil {
-		in, out := &in.MaxFindingsPerRun, &out.MaxFindingsPerRun
-		*out = new(int32)
-		**out = **in
-	}
-	if in.Suspend != nil {
-		in, out := &in.Suspend, &out.Suspend
-		*out = new(bool)
-		**out = **in
-	}
+	out.Owner = in.Owner
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryScanSpec.
-func (in *RepositoryScanSpec) DeepCopy() *RepositoryScanSpec {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RuntimeSessionControlSpec.
+func (in *RuntimeSessionControlSpec) DeepCopy() *RuntimeSessionControlSpec {
 	if in == nil {
 		return nil
 	}
-	out := new(RepositoryScanSpec)
+	out := new(RuntimeSessionControlSpec)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RepositoryScanStatus) DeepCopyInto(out *RepositoryScanStatus) {
+func (in *RuntimeSessionControlStatus) DeepCopyInto(out *RuntimeSessionControlStatus) {
 	*out = *in
-	if in.LastScanAt != nil {
-		in, out := &in.LastScanAt, &out.LastScanAt
-		*out = (*in).DeepCopy()
-	}
-	if in.LastSuccessfulScanAt != nil {
-		in, out := &in.LastSuccessfulScanAt, &out.LastSuccessfulScanAt
-		*out = (*in).DeepCopy()
-	}
-	out.FindingCounts = in.FindingCounts
-	if in.Conditions != nil {
-		in, out := &in.Conditions, &out.Conditions
-		*out = make([]v1.Condition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryScanStatus.
-func (in *RepositoryScanStatus) DeepCopy() *RepositoryScanStatus {
-	if in == nil {
-		return nil
+	if in.MutationLease != nil {
+		in, out := &in.MutationLease, &out.MutationLease
+		*out = new(RuntimeSessionMutationLeaseStatus)
+		(*in).DeepCopyInto(*out)
 	}
-	out := new(RepositoryScanStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RequestedBy) DeepCopyInto(out *RequestedBy) {
-	*out = *in
-	if in.Groups != nil {
-		in, out := &in.Groups, &out.Groups
-		*out = make([]string, len(*in))
-		copy(*out, *in)
+	if in.VerifiedBaseline != nil {
+		in, out := &in.VerifiedBaseline, &out.VerifiedBaseline
+		*out = new(ControlVerifiedBranchBaseline)
+		**out = **in
 	}
-	if in.Roles != nil {
-		in, out := &in.Roles, &out.Roles
-		*out = make([]string, len(*in))
-		copy(*out, *in)
+	if in.Lineage != nil {
+		in, out := &in.Lineage, &out.Lineage
+		*out = new(RuntimeSessionLineageStatus)
+		(*in).DeepCopyInto(*out)
 	}
+	in.ControlRecordMutationStatus.DeepCopyInto(&out.ControlRecordMutationStatus)
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RequestedBy.
-func (in *RequestedBy) DeepCopy() *RequestedBy {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RuntimeSessionControlStatus.
+func (in *RuntimeSessionControlStatus) DeepCopy() *RuntimeSessionControlStatus {
 	if in == nil {
 		return nil
 	}
-	out := new(RequestedBy)
+	out := new(RuntimeSessionControlStatus)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ResultReference) DeepCopyInto(out *ResultReference) {
+func (in *RuntimeSessionLineageStatus) DeepCopyInto(out *RuntimeSessionLineageStatus) {
 	*out = *in
+	in.EstablishedAt.DeepCopyInto(&out.EstablishedAt)
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResultReference.
-func (in *ResultReference) DeepCopy() *ResultReference {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RuntimeSessionLineageStatus.
+func (in *RuntimeSessionLineageStatus) DeepCopy() *RuntimeSessionLineageStatus {
 	if in == nil {
 		return nil
 	}
-	out := new(ResultReference)
+	out := new(RuntimeSessionLineageStatus)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RetryPolicy) DeepCopyInto(out *RetryPolicy) {
+func (in *RuntimeSessionMutationLeaseStatus) DeepCopyInto(out *RuntimeSessionMutationLeaseStatus) {
 	*out = *in
-	if in.InitialDelay != nil {
-		in, out := &in.InitialDelay, &out.InitialDelay
-		*out = new(v1.Duration)
-		**out = **in
+	in.AcquiredAt.DeepCopyInto(&out.AcquiredAt)
+	if in.ExpiresAt != nil {
+		in, out := &in.ExpiresAt, &out.ExpiresAt
+		*out = (*in).DeepCopy()
 	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RetryPolicy.
-func (in *RetryPolicy) DeepCopy() *RetryPolicy {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RuntimeSessionMutationLeaseStatus.
+func (in *RuntimeSessionMutationLeaseStatus) DeepCopy() *RuntimeSessionMutationLeaseStatus {
 	if in == nil {
 		return nil
 	}
-	out := new(RetryPolicy)
+	out := new(RuntimeSessionMutationLeaseStatus)
 	in.DeepCopyInto(out)
 	return out
 }
@@ -2886,22 +4181,59 @@ func (in *Task) DeepCopyObject() runtime.Object {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *TaskExecutionOutcome) DeepCopyInto(out *TaskExecutionOutcome) {
+func (in *TaskDeliveryStatus) DeepCopyInto(out *TaskDeliveryStatus) {
 	*out = *in
-	if in.ResultRef != nil {
-		in, out := &in.ResultRef, &out.ResultRef
-		*out = new(ResultReference)
+	if in.SourceRepository != nil {
+		in, out := &in.SourceRepository, &out.SourceRepository
+		*out = new(RepositoryIdentity)
 		**out = **in
 	}
-	in.RecordedAt.DeepCopyInto(&out.RecordedAt)
+	if in.PublicationRepository != nil {
+		in, out := &in.PublicationRepository, &out.PublicationRepository
+		*out = new(RepositoryIdentity)
+		**out = **in
+	}
+	if in.RemoteBeforeSHA != nil {
+		in, out := &in.RemoteBeforeSHA, &out.RemoteBeforeSHA
+		*out = new(string)
+		**out = **in
+	}
+	if in.PRReceipt != nil {
+		in, out := &in.PRReceipt, &out.PRReceipt
+		*out = new(TaskPullRequestReceipt)
+		**out = **in
+	}
+	if in.LastTransitionTime != nil {
+		in, out := &in.LastTransitionTime, &out.LastTransitionTime
+		*out = (*in).DeepCopy()
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TaskDeliveryStatus.
+func (in *TaskDeliveryStatus) DeepCopy() *TaskDeliveryStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(TaskDeliveryStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TaskExecutionStatus) DeepCopyInto(out *TaskExecutionStatus) {
+	*out = *in
+	if in.LastTransitionTime != nil {
+		in, out := &in.LastTransitionTime, &out.LastTransitionTime
+		*out = (*in).DeepCopy()
+	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TaskExecutionOutcome.
-func (in *TaskExecutionOutcome) DeepCopy() *TaskExecutionOutcome {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TaskExecutionStatus.
+func (in *TaskExecutionStatus) DeepCopy() *TaskExecutionStatus {
 	if in == nil {
 		return nil
 	}
-	out := new(TaskExecutionOutcome)
+	out := new(TaskExecutionStatus)
 	in.DeepCopyInto(out)
 	return out
 }
@@ -2938,6 +4270,21 @@ func (in *TaskList) DeepCopyObject() runtime.Object {
 	return nil
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TaskPullRequestReceipt) DeepCopyInto(out *TaskPullRequestReceipt) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TaskPullRequestReceipt.
+func (in *TaskPullRequestReceipt) DeepCopy() *TaskPullRequestReceipt {
+	if in == nil {
+		return nil
+	}
+	out := new(TaskPullRequestReceipt)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *TaskSpec) DeepCopyInto(out *TaskSpec) {
 	*out = *in
@@ -3077,9 +4424,29 @@ func (in *TaskStatus) DeepCopyInto(out *TaskStatus) {
 		*out = new(ResultReference)
 		**out = **in
 	}
+	if in.Execution != nil {
+		in, out := &in.Execution, &out.Execution
+		*out = new(TaskExecutionStatus)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Delivery != nil {
+		in, out := &in.Delivery, &out.Delivery
+		*out = new(TaskDeliveryStatus)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.HarnessRuntime != nil {
+		in, out := &in.HarnessRuntime, &out.HarnessRuntime
+		*out = new(HarnessRuntimeStatus)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.AgentExecutionBinding != nil {
+		in, out := &in.AgentExecutionBinding, &out.AgentExecutionBinding
+		*out = new(AgentExecutionBinding)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.ExecutionOutcome != nil {
 		in, out := &in.ExecutionOutcome, &out.ExecutionOutcome
-		*out = new(TaskExecutionOutcome)
+		*out = new(TaskWorkloadExecutionOutcome)
 		(*in).DeepCopyInto(*out)
 	}
 	if in.ExecutionWorkspace != nil {
@@ -3087,11 +4454,6 @@ func (in *TaskStatus) DeepCopyInto(out *TaskStatus) {
 		*out = new(ExecutionWorkspaceStatus)
 		(*in).DeepCopyInto(*out)
 	}
-	if in.HarnessRuntime != nil {
-		in, out := &in.HarnessRuntime, &out.HarnessRuntime
-		*out = new(HarnessRuntimeStatus)
-		**out = **in
-	}
 	if in.ChildTasks != nil {
 		in, out := &in.ChildTasks, &out.ChildTasks
 		*out = make([]ChildTaskStatus, len(*in))
@@ -3156,6 +4518,27 @@ func (in *TaskTransaction) DeepCopy() *TaskTransaction {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TaskWorkloadExecutionOutcome) DeepCopyInto(out *TaskWorkloadExecutionOutcome) {
+	*out = *in
+	if in.ResultRef != nil {
+		in, out := &in.ResultRef, &out.ResultRef
+		*out = new(ResultReference)
+		**out = **in
+	}
+	in.RecordedAt.DeepCopyInto(&out.RecordedAt)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TaskWorkloadExecutionOutcome.
+func (in *TaskWorkloadExecutionOutcome) DeepCopy() *TaskWorkloadExecutionOutcome {
+	if in == nil {
+		return nil
+	}
+	out := new(TaskWorkloadExecutionOutcome)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Tool) DeepCopyInto(out *Tool) {
 	*out = *in
@@ -3372,11 +4755,46 @@ func (in *WorkspaceClassReference) DeepCopy() *WorkspaceClassReference {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *WorkspaceConfig) DeepCopyInto(out *WorkspaceConfig) {
 	*out = *in
-	if in.GitSecretRef != nil {
-		in, out := &in.GitSecretRef, &out.GitSecretRef
-		*out = new(corev1.LocalObjectReference)
+	if in.SourceRepository != nil {
+		in, out := &in.SourceRepository, &out.SourceRepository
+		*out = new(RepositoryIdentity)
+		**out = **in
+	}
+	if in.ReadCredentialRef != nil {
+		in, out := &in.ReadCredentialRef, &out.ReadCredentialRef
+		*out = new(WorkspaceCredentialReference)
+		**out = **in
+	}
+	if in.PublicationRepository != nil {
+		in, out := &in.PublicationRepository, &out.PublicationRepository
+		*out = new(RepositoryIdentity)
+		**out = **in
+	}
+	if in.PublicationReadCredentialRef != nil {
+		in, out := &in.PublicationReadCredentialRef, &out.PublicationReadCredentialRef
+		*out = new(WorkspaceCredentialReference)
+		**out = **in
+	}
+	if in.PublicationCredentialRef != nil {
+		in, out := &in.PublicationCredentialRef, &out.PublicationCredentialRef
+		*out = new(WorkspaceCredentialReference)
+		**out = **in
+	}
+	if in.ForgeCredentialRef != nil {
+		in, out := &in.ForgeCredentialRef, &out.ForgeCredentialRef
+		*out = new(WorkspaceCredentialReference)
+		**out = **in
+	}
+	if in.MaxChangedFiles != nil {
+		in, out := &in.MaxChangedFiles, &out.MaxChangedFiles
+		*out = new(int32)
 		**out = **in
 	}
+	if in.AllowedPaths != nil {
+		in, out := &in.AllowedPaths, &out.AllowedPaths
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkspaceConfig.
@@ -3389,6 +4807,21 @@ func (in *WorkspaceConfig) DeepCopy() *WorkspaceConfig {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkspaceCredentialReference) DeepCopyInto(out *WorkspaceCredentialReference) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkspaceCredentialReference.
+func (in *WorkspaceCredentialReference) DeepCopy() *WorkspaceCredentialReference {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkspaceCredentialReference)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *WorkspaceObjectReference) DeepCopyInto(out *WorkspaceObjectReference) {
 	*out = *in
diff --git a/cmd/build/helmify/README.md b/cmd/build/helmify/README.md
index 51acfca81..5aa8cd06f 100644
--- a/cmd/build/helmify/README.md
+++ b/cmd/build/helmify/README.md
@@ -6,11 +6,12 @@ This directory is derived from Gatekeeper's `cmd/build/helmify` flow at
 `make manifests` performs the same staged generation pattern used by Gatekeeper:
 
 1. `controller-gen` refreshes the canonical CRDs under `config/crd/bases`.
-2. Kustomize renders `config/default`.
-3. This generator copies the static chart inputs and writes every rendered CRD
-   under `manifest_staging/charts/orka/crds`.
-4. Kustomize also writes the next-release installer to
-   `manifest_staging/deploy/orka.yaml`.
+2. Kustomize renders `config/acp-production` as the next-release raw installer.
+3. The Helmify Kustomize input renders `config/default`; this generator copies
+   the static chart inputs and writes every rendered CRD under
+   `manifest_staging/charts/orka/crds`.
+4. The raw installer is written to `manifest_staging/deploy/orka.yaml` with
+   fail-closed digest placeholders and without CRDs.
 
 Only CRDs are generated from the Kustomize stream in this adaptation. Orka's
 existing non-CRD Helm templates remain static inputs under `static/templates`;
diff --git a/cmd/build/helmify/admission_networkpolicy_test.go b/cmd/build/helmify/admission_networkpolicy_test.go
new file mode 100644
index 000000000..d630b49d6
--- /dev/null
+++ b/cmd/build/helmify/admission_networkpolicy_test.go
@@ -0,0 +1,51 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	corev1 "k8s.io/api/core/v1"
+	networkingv1 "k8s.io/api/networking/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+	"sigs.k8s.io/yaml"
+)
+
+func TestSharedAdmissionNetworkPolicyAllowsKubernetesAPIServiceAndBackendPorts(t *testing.T) {
+	manifestPath := filepath.Join("..", "..", "..", "config", "orka-admission", "networkpolicy.yaml")
+	manifest, err := os.ReadFile(manifestPath)
+	if err != nil {
+		t.Fatalf("read admission NetworkPolicy: %v", err)
+	}
+	assertKubernetesAPIEgressPorts(t, manifest)
+}
+
+func assertKubernetesAPIEgressPorts(t *testing.T, manifest []byte) {
+	t.Helper()
+
+	var policy networkingv1.NetworkPolicy
+	if err := yaml.Unmarshal(manifest, &policy); err != nil {
+		t.Fatalf("decode admission NetworkPolicy: %v", err)
+	}
+	if policy.Kind != "NetworkPolicy" {
+		t.Fatalf("kind = %q, want NetworkPolicy", policy.Kind)
+	}
+
+	ports := make(map[int32]bool)
+	for _, rule := range policy.Spec.Egress {
+		for _, port := range rule.Ports {
+			if port.Port == nil || port.Port.Type != intstr.Int {
+				continue
+			}
+			if port.Protocol != nil && *port.Protocol != corev1.ProtocolTCP {
+				continue
+			}
+			ports[port.Port.IntVal] = true
+		}
+	}
+	for _, required := range []int32{443, 6443} {
+		if !ports[required] {
+			t.Errorf("admission NetworkPolicy TCP egress ports = %v, missing %d", ports, required)
+		}
+	}
+}
diff --git a/cmd/build/helmify/admission_validating_webhook_test.go b/cmd/build/helmify/admission_validating_webhook_test.go
new file mode 100644
index 000000000..f9f7dbd1c
--- /dev/null
+++ b/cmd/build/helmify/admission_validating_webhook_test.go
@@ -0,0 +1,401 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"reflect"
+	"slices"
+	"strings"
+	"testing"
+
+	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	policyv1 "k8s.io/api/policy/v1"
+	"sigs.k8s.io/yaml"
+)
+
+const (
+	canonicalProductionControllerUsername = "system:serviceaccount:orka-system:orka-controller-manager"
+	staticChartTestNamespace              = "orka-test"
+	webhookPortName                       = "webhook"
+)
+
+func TestControllerWebhooksAreReleaseLocalAndModeScoped(t *testing.T) {
+	digest := "sha256:" + strings.Repeat("3", 64)
+	for _, mode := range []string{"harness-v1", "harness-v2"} {
+		t.Run(mode, func(t *testing.T) {
+			args := []string{
+				"--set-string", "controller.mode=" + mode,
+				"--show-only", "templates/controller-validating-webhook.yaml",
+			}
+			if mode == "harness-v1" {
+				args = append(args,
+					"--set-string", "harnessV1.image.digest="+digest,
+					"--set-string", "harnessV1.auth.existingSecret=harness-wrapper-auth",
+					"--set-string", "harnessV1.tls.existingSecret=harness-wrapper-tls",
+				)
+			}
+
+			rendered := requireHelmRender(t, args...)
+			configuration := admissionregistrationv1.ValidatingWebhookConfiguration{}
+			if err := yaml.Unmarshal([]byte(rendered), &configuration); err != nil {
+				t.Fatalf("decode controller validating webhook configuration: %v", err)
+			}
+			if configuration.Name != "test-orka-controller" {
+				t.Fatalf("controller webhook name = %q, want test-orka-controller", configuration.Name)
+			}
+
+			webhooks := make(map[string]admissionregistrationv1.ValidatingWebhook, len(configuration.Webhooks))
+			for _, webhook := range configuration.Webhooks {
+				webhooks[webhook.Name] = webhook
+				if !strings.HasSuffix(webhook.Name, "."+mode+".orka.ai") {
+					t.Errorf("webhook name %q is not scoped to mode %q", webhook.Name, mode)
+				}
+				if webhook.FailurePolicy == nil || *webhook.FailurePolicy != admissionregistrationv1.Fail {
+					t.Errorf("%s failurePolicy = %v, want Fail", webhook.Name, webhook.FailurePolicy)
+				}
+				service := webhook.ClientConfig.Service
+				if service == nil || service.Name != "test-orka-webhook" || service.Namespace != staticChartTestNamespace ||
+					service.Port == nil || *service.Port != 443 {
+					t.Errorf("%s service = %#v, want test-orka-webhook:443 in orka-test", webhook.Name, service)
+				}
+				selector := webhook.NamespaceSelector
+				if strings.HasPrefix(webhook.Name, "namespace-mode.") {
+					selector = webhook.ObjectSelector
+				}
+				if selector == nil || selector.MatchLabels["orka.ai/controller-mode"] != mode {
+					t.Errorf("%s execution-mode selector = %#v, want %q", webhook.Name, selector, mode)
+				}
+				if selector == nil || selector.MatchLabels["kubernetes.io/metadata.name"] != staticChartTestNamespace {
+					t.Errorf("%s namespace selector = %#v, want orka-test", webhook.Name, selector)
+				}
+			}
+
+			_, hasTaskWorkspace := webhooks["task-workspace-class."+mode+".orka.ai"]
+			_, hasToolWorkspace := webhooks["tool-workspace-class."+mode+".orka.ai"]
+			wantWorkspace := mode == "harness-v2"
+			if hasTaskWorkspace != wantWorkspace || hasToolWorkspace != wantWorkspace {
+				t.Fatalf("workspace webhooks present = task:%t tool:%t, want %t", hasTaskWorkspace, hasToolWorkspace, wantWorkspace)
+			}
+		})
+	}
+}
+
+func TestControllerWebhooksDoNotOverlapSameModeReleasesInDifferentNamespaces(t *testing.T) {
+	const mode = "harness-v2"
+	selectorsByNamespace := make(map[string]map[string]map[string]string)
+	for _, namespace := range []string{"orka-one", "orka-two"} {
+		output := requireHelmRender(t,
+			"--namespace", namespace,
+			"--set-string", "controller.mode="+mode,
+			"--set-string", "controller.watchNamespace="+namespace,
+			"--show-only", "templates/controller-validating-webhook.yaml",
+		)
+
+		configuration := admissionregistrationv1.ValidatingWebhookConfiguration{}
+		if err := yaml.Unmarshal([]byte(output), &configuration); err != nil {
+			t.Fatalf("decode controller validating webhook configuration in namespace %q: %v", namespace, err)
+		}
+		selectorsByNamespace[namespace] = make(map[string]map[string]string, len(configuration.Webhooks))
+		for _, webhook := range configuration.Webhooks {
+			selector := webhook.NamespaceSelector
+			if strings.HasPrefix(webhook.Name, "namespace-mode.") {
+				selector = webhook.ObjectSelector
+			}
+			if selector == nil {
+				t.Fatalf("%s selector in namespace %q is nil", webhook.Name, namespace)
+			}
+			selectorsByNamespace[namespace][webhook.Name] = selector.MatchLabels
+			if selector.MatchLabels["orka.ai/controller-mode"] != mode ||
+				selector.MatchLabels["kubernetes.io/metadata.name"] != namespace {
+				t.Fatalf("%s selector in namespace %q = %#v", webhook.Name, namespace, selector.MatchLabels)
+			}
+		}
+	}
+
+	for webhookName, first := range selectorsByNamespace["orka-one"] {
+		second := selectorsByNamespace["orka-two"][webhookName]
+		if reflect.DeepEqual(first, second) {
+			t.Errorf("%s has overlapping selectors across namespaces: %#v", webhookName, selectorsByNamespace)
+		}
+	}
+}
+
+func TestControllerWebhookServiceIsIsolatedFromExternalService(t *testing.T) {
+	rendered := requireHelmRender(t,
+		"--set", "service.type=LoadBalancer",
+		"--show-only", "templates/service.yaml",
+	)
+	controllerService := corev1.Service{}
+	if err := yaml.Unmarshal([]byte(rendered), &controllerService); err != nil {
+		t.Fatalf("decode controller Service: %v", err)
+	}
+	if controllerService.Spec.Type != corev1.ServiceTypeLoadBalancer {
+		t.Fatalf("controller Service type = %q, want LoadBalancer", controllerService.Spec.Type)
+	}
+	for _, port := range controllerService.Spec.Ports {
+		if port.Name == webhookPortName || port.TargetPort.String() == webhookPortName || port.Port == 443 {
+			t.Fatalf("external controller Service exposes webhook port: %#v", port)
+		}
+	}
+
+	rendered = requireHelmRender(t,
+		"--set", "service.type=LoadBalancer",
+		"--show-only", "templates/controller-webhook-service.yaml",
+	)
+	webhookService := corev1.Service{}
+	if err := yaml.Unmarshal([]byte(rendered), &webhookService); err != nil {
+		t.Fatalf("decode controller webhook Service: %v", err)
+	}
+	if webhookService.Name != "test-orka-webhook" {
+		t.Fatalf("controller webhook Service name = %q, want test-orka-webhook", webhookService.Name)
+	}
+	if webhookService.Spec.Type != corev1.ServiceTypeClusterIP {
+		t.Fatalf("controller webhook Service type = %q, want ClusterIP", webhookService.Spec.Type)
+	}
+	if len(webhookService.Spec.Ports) != 1 {
+		t.Fatalf("controller webhook Service ports = %#v, want one", webhookService.Spec.Ports)
+	}
+	port := webhookService.Spec.Ports[0]
+	if port.Name != webhookPortName || port.Port != 443 || port.TargetPort.String() != webhookPortName {
+		t.Fatalf("controller webhook Service port = %#v, want webhook 443 -> webhook", port)
+	}
+
+	rendered = requireHelmRender(t,
+		"--set", "service.type=LoadBalancer",
+		"--show-only", "templates/controller-validating-webhook.yaml",
+	)
+	configuration := admissionregistrationv1.ValidatingWebhookConfiguration{}
+	if err := yaml.Unmarshal([]byte(rendered), &configuration); err != nil {
+		t.Fatalf("decode controller validating webhook configuration: %v", err)
+	}
+	for _, webhook := range configuration.Webhooks {
+		service := webhook.ClientConfig.Service
+		if service == nil || service.Name != webhookService.Name || service.Namespace != staticChartTestNamespace {
+			t.Errorf("%s service = %#v, want %s in orka-test", webhook.Name, service, webhookService.Name)
+		}
+	}
+}
+
+func TestControllerDeploymentEnablesReleaseLocalAdmission(t *testing.T) {
+	rendered := requireHelmRender(t, "--show-only", "templates/deployment.yaml")
+	deployment := appsv1.Deployment{}
+	if err := yaml.Unmarshal([]byte(rendered), &deployment); err != nil {
+		t.Fatalf("decode controller Deployment: %v", err)
+	}
+
+	var args []string
+	for _, container := range deployment.Spec.Template.Spec.Containers {
+		if container.Name == "controller" {
+			args = container.Args
+			break
+		}
+	}
+	for _, want := range []string{
+		"--task-provenance-admission-enabled=true",
+		"--workspace-class-use-admission-enabled=true",
+		"--webhook-cert-path=/var/run/orka/webhook/tls",
+	} {
+		if !containsString(args, want) {
+			t.Errorf("controller args do not contain %q: %#v", want, args)
+		}
+	}
+}
+
+func TestSharedAdmissionAuthorizesCanonicalProductionController(t *testing.T) {
+	path := filepath.Join("..", "..", "..", "config", "orka-admission", "deployment.yaml")
+	manifest, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read standalone admission Deployment: %v", err)
+	}
+	deployment := appsv1.Deployment{}
+	if err := yaml.Unmarshal(manifest, &deployment); err != nil {
+		t.Fatalf("decode standalone admission Deployment: %v", err)
+	}
+
+	var args []string
+	var lifecycle *corev1.Lifecycle
+	for _, container := range deployment.Spec.Template.Spec.Containers {
+		if container.Name == "admission" {
+			args = container.Args
+			lifecycle = container.Lifecycle
+			break
+		}
+	}
+	if lifecycle == nil || lifecycle.PreStop == nil || lifecycle.PreStop.Exec == nil ||
+		!slices.Equal(lifecycle.PreStop.Exec.Command, []string{"/orka-admission", "--pre-stop-delay=5s"}) {
+		t.Fatalf("admission preStop lifecycle = %#v, want bounded endpoint-removal delay", lifecycle)
+	}
+	for _, prefix := range []string{"--controller-usernames=", "--task-provenance-trusted-users="} {
+		if !commaListArgumentContains(args, prefix, canonicalProductionControllerUsername) {
+			t.Errorf("admission args do not authorize %q in %s: %#v",
+				canonicalProductionControllerUsername, prefix, args)
+		}
+	}
+	for _, serviceAccount := range []string{"orka-ai-worker", "orka-vendor-worker"} {
+		if !commaListArgumentContains(args, "--task-provenance-trusted-service-accounts=", serviceAccount) {
+			t.Errorf("admission args do not authorize canonical worker %q: %#v", serviceAccount, args)
+		}
+	}
+}
+
+//nolint:gocyclo // This contract intentionally validates the complete multi-resource HA rollout shape.
+func TestSharedAdmissionRolloutPreservesReadyEndpoints(t *testing.T) {
+	deploymentPath := filepath.Join("..", "..", "..", "config", "orka-admission", "deployment.yaml")
+	manifest, err := os.ReadFile(deploymentPath)
+	if err != nil {
+		t.Fatalf("read standalone admission Deployment: %v", err)
+	}
+	deployment := appsv1.Deployment{}
+	if err := yaml.Unmarshal(manifest, &deployment); err != nil {
+		t.Fatalf("decode standalone admission Deployment: %v", err)
+	}
+	if deployment.Spec.Replicas == nil || *deployment.Spec.Replicas < 2 {
+		t.Fatalf("admission replicas = %v, want at least two", deployment.Spec.Replicas)
+	}
+	rollingUpdate := deployment.Spec.Strategy.RollingUpdate
+	if deployment.Spec.Strategy.Type != appsv1.RollingUpdateDeploymentStrategyType || rollingUpdate == nil ||
+		rollingUpdate.MaxUnavailable == nil || rollingUpdate.MaxUnavailable.IntValue() != 0 ||
+		rollingUpdate.MaxSurge == nil || rollingUpdate.MaxSurge.IntValue() < 1 {
+		t.Fatalf(
+			"admission rollout strategy = %#v, want zero-unavailable rolling update with surge",
+			deployment.Spec.Strategy,
+		)
+	}
+	if deployment.Spec.Template.Spec.TerminationGracePeriodSeconds == nil ||
+		*deployment.Spec.Template.Spec.TerminationGracePeriodSeconds <= 5 {
+		t.Fatalf("admission termination grace = %v, want longer than endpoint-removal delay",
+			deployment.Spec.Template.Spec.TerminationGracePeriodSeconds)
+	}
+
+	var admissionContainer *corev1.Container
+	for i := range deployment.Spec.Template.Spec.Containers {
+		container := &deployment.Spec.Template.Spec.Containers[i]
+		if container.Name == "admission" {
+			admissionContainer = container
+			break
+		}
+	}
+	if admissionContainer == nil {
+		t.Fatal("standalone admission container is missing")
+	}
+	if admissionContainer.ReadinessProbe == nil || admissionContainer.ReadinessProbe.HTTPGet == nil ||
+		admissionContainer.ReadinessProbe.HTTPGet.Path != "/readyz" {
+		t.Fatalf("admission readiness probe = %#v, want /readyz", admissionContainer.ReadinessProbe)
+	}
+	if admissionContainer.Lifecycle == nil || admissionContainer.Lifecycle.PreStop == nil ||
+		admissionContainer.Lifecycle.PreStop.Exec == nil ||
+		!slices.Equal(admissionContainer.Lifecycle.PreStop.Exec.Command, []string{"/orka-admission", "--pre-stop-delay=5s"}) {
+		t.Fatalf("admission preStop lifecycle = %#v, want bounded endpoint-removal delay", admissionContainer.Lifecycle)
+	}
+
+	servicePath := filepath.Join("..", "..", "..", "config", "orka-admission", "service.yaml")
+	manifest, err = os.ReadFile(servicePath)
+	if err != nil {
+		t.Fatalf("read standalone admission Service: %v", err)
+	}
+	service := corev1.Service{}
+	if err := yaml.Unmarshal(manifest, &service); err != nil {
+		t.Fatalf("decode standalone admission Service: %v", err)
+	}
+	if service.Spec.PublishNotReadyAddresses {
+		t.Fatal("admission Service publishes unready addresses; terminating Pods could remain routable")
+	}
+	if !reflect.DeepEqual(service.Spec.Selector, deployment.Spec.Selector.MatchLabels) {
+		t.Fatalf("admission Service selector = %#v, want Deployment selector %#v",
+			service.Spec.Selector, deployment.Spec.Selector.MatchLabels)
+	}
+
+	pdbPath := filepath.Join("..", "..", "..", "config", "orka-admission", "poddisruptionbudget.yaml")
+	manifest, err = os.ReadFile(pdbPath)
+	if err != nil {
+		t.Fatalf("read standalone admission PodDisruptionBudget: %v", err)
+	}
+	pdb := policyv1.PodDisruptionBudget{}
+	if err := yaml.Unmarshal(manifest, &pdb); err != nil {
+		t.Fatalf("decode standalone admission PodDisruptionBudget: %v", err)
+	}
+	if pdb.Spec.MinAvailable == nil || pdb.Spec.MinAvailable.IntValue() < 1 || pdb.Spec.Selector == nil ||
+		!reflect.DeepEqual(pdb.Spec.Selector.MatchLabels, deployment.Spec.Selector.MatchLabels) {
+		t.Fatalf("admission disruption budget = %#v, want at least one matching Pod available", pdb.Spec)
+	}
+}
+
+func TestSharedTaskWebhooksBypassExactControllerCleanup(t *testing.T) {
+	path := filepath.Join("..", "..", "..", "config", "orka-admission-webhooks", "validating_webhook.yaml")
+	manifest, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read standalone admission webhooks: %v", err)
+	}
+	assertTaskWebhooksBypassExactControllerCleanup(t, manifest)
+}
+
+func assertTaskWebhooksBypassExactControllerCleanup(t *testing.T, manifest []byte) {
+	t.Helper()
+
+	configuration := admissionregistrationv1.ValidatingWebhookConfiguration{}
+	if err := yaml.Unmarshal(manifest, &configuration); err != nil {
+		t.Fatalf("decode validating webhook configuration: %v", err)
+	}
+	webhooks := make(map[string]admissionregistrationv1.ValidatingWebhook, len(configuration.Webhooks))
+	for _, webhook := range configuration.Webhooks {
+		webhooks[webhook.Name] = webhook
+	}
+
+	authority, ok := webhooks["taskexecutionauthority.core.orka.ai"]
+	if !ok {
+		t.Fatal("task execution authority webhook is missing")
+	}
+	if len(authority.MatchConditions) != 1 ||
+		authority.MatchConditions[0].Name != "route-unless-controller-cleanup-safe" {
+		t.Fatalf("task execution authority cleanup-safe condition = %#v", authority.MatchConditions)
+	}
+	condition := authority.MatchConditions[0]
+	for _, marker := range []string{
+		"request.userInfo.username == '" + canonicalProductionControllerUsername + "'",
+		"request.operation == 'UPDATE'",
+		"has(oldObject.metadata.deletionTimestamp)",
+		"oldObject.metadata.?finalizers.orValue([]).exists(f, f == 'orka.ai/cleanup')",
+		"oldObject.metadata.?finalizers.orValue([]).filter(f, f != 'orka.ai/cleanup')",
+		"object.spec == oldObject.spec",
+		"object.?status.orValue({}) == oldObject.?status.orValue({})",
+	} {
+		if !strings.Contains(condition.Expression, marker) {
+			t.Fatalf("cleanup-safe condition is missing %q:\n%s", marker, condition.Expression)
+		}
+	}
+
+	for _, name := range []string{
+		"taskprovenance.core.orka.ai",
+		"taskworkspaceclassuse.core.orka.ai",
+	} {
+		webhook, ok := webhooks[name]
+		if !ok {
+			t.Fatalf("%s webhook is missing", name)
+		}
+		if webhook.FailurePolicy == nil || *webhook.FailurePolicy != admissionregistrationv1.Fail {
+			t.Fatalf("%s failurePolicy = %v, want Fail", name, webhook.FailurePolicy)
+		}
+		if !reflect.DeepEqual(webhook.MatchConditions, authority.MatchConditions) {
+			t.Fatalf("%s cleanup-safe conditions = %#v, want %#v", name, webhook.MatchConditions, authority.MatchConditions)
+		}
+	}
+}
+
+func containsString(values []string, want string) bool {
+	return slices.Contains(values, want)
+}
+
+func commaListArgumentContains(args []string, prefix, want string) bool {
+	for _, arg := range args {
+		value, ok := strings.CutPrefix(arg, prefix)
+		if !ok {
+			continue
+		}
+		if slices.Contains(strings.Split(value, ","), want) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/cmd/build/helmify/agent_sandbox_mode_test.go b/cmd/build/helmify/agent_sandbox_mode_test.go
new file mode 100644
index 000000000..41ab96877
--- /dev/null
+++ b/cmd/build/helmify/agent_sandbox_mode_test.go
@@ -0,0 +1,36 @@
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestStaticChartValidatesAgentSandboxControllerMode(t *testing.T) {
+	t.Run("rejects harness v1", func(t *testing.T) {
+		digest := "sha256:" + strings.Repeat("1", 64)
+		output, err := helmTemplateStaticChart(t,
+			"--set-string", "controller.mode=harness-v1",
+			"--set", "controller.agentSandbox.enabled=true",
+			"--set-string", "harnessV1.image.digest="+digest,
+			"--set-string", "harnessV1.auth.existingSecret=harness-wrapper-auth",
+			"--set-string", "harnessV1.tls.existingSecret=harness-wrapper-tls",
+		)
+		const want = "controller.agentSandbox.enabled is unsupported when controller.mode=harness-v1"
+		if err == nil || !strings.Contains(output, want) {
+			t.Fatalf("helm render error = %v, want %q:\n%s", err, want, output)
+		}
+	})
+
+	t.Run("allows harness v2", func(t *testing.T) {
+		output, err := helmTemplateStaticChart(t,
+			"--set", "controller.agentSandbox.enabled=true",
+			"--show-only", "templates/deployment.yaml",
+		)
+		if err != nil {
+			t.Fatalf("helm template rejected harness-v2 agent sandbox: %v\n%s", err, output)
+		}
+		if !strings.Contains(output, "--agent-sandbox-enabled=true") {
+			t.Fatalf("harness-v2 render is missing the agent sandbox flag:\n%s", output)
+		}
+	})
+}
diff --git a/cmd/build/helmify/coexistence_admission_policy_test.go b/cmd/build/helmify/coexistence_admission_policy_test.go
new file mode 100644
index 000000000..8fad4954e
--- /dev/null
+++ b/cmd/build/helmify/coexistence_admission_policy_test.go
@@ -0,0 +1,4 @@
+package main
+
+// The former coexistence policy render tests were retired with the dynamic
+// bridge. Static controller modes are covered by main_test.go.
diff --git a/cmd/build/helmify/main_test.go b/cmd/build/helmify/main_test.go
index 792b28861..2b8184b15 100644
--- a/cmd/build/helmify/main_test.go
+++ b/cmd/build/helmify/main_test.go
@@ -2,7 +2,10 @@ package main
 
 import (
 	"os"
+	"os/exec"
 	"path/filepath"
+	"regexp"
+	"strconv"
 	"strings"
 	"testing"
 )
@@ -81,3 +84,1555 @@ func TestObjectSetRejectsDuplicateCRDFilenames(t *testing.T) {
 		t.Fatalf("write() error = %v, want duplicate filename error", err)
 	}
 }
+
+func helmTemplateStaticChart(t *testing.T, args ...string) (string, error) {
+	return helmTemplateStaticChartForRelease(t, "test", "orka-test", args...)
+}
+
+func helmTemplateStaticChartForRelease(
+	t *testing.T,
+	releaseName string,
+	namespace string,
+	args ...string,
+) (string, error) {
+	t.Helper()
+	helm, err := exec.LookPath("helm")
+	if err != nil {
+		t.Skip("helm is required for static chart render tests")
+	}
+
+	commandArgs := []string{"template", releaseName, "static", "--namespace", namespace}
+	commandArgs = append(commandArgs, staticChartDefaultArgs()...)
+	commandArgs = append(commandArgs, "--set-string", "controller.watchNamespace="+namespace)
+	commandArgs = append(commandArgs, args...)
+	output, err := exec.Command(helm, commandArgs...).CombinedOutput()
+	return string(output), err
+}
+
+func staticChartDefaultArgs() []string {
+	digest := "sha256:" + strings.Repeat("0", 64)
+	return []string{
+		"--set-string", "controller.mode=harness-v2",
+		"--set-string", "controller.watchNamespace=orka-test",
+		"--set-string", "controller.image.digest=" + digest,
+		"--set-string", "controller.agentExecutionSnapshot.existingSecret=snapshot-key",
+		"--set-string", "controller.agentExecutionSnapshot.key=encryption-key",
+		"--set-string", "webhooks.tls.existingSecret=controller-webhook-tls",
+		"--set-string", "webhooks.caBundle=Y2E=",
+		"--set-string", "publisher.image.digest=" + digest,
+		"--set", "providerProxy.enabled=true",
+	}
+}
+
+func forceStaticChartNamespaceMode(t *testing.T, chartDir, mode string) {
+	t.Helper()
+	helpersPath := filepath.Join(chartDir, "templates", "_helpers.tpl")
+	helpers, err := os.ReadFile(helpersPath)
+	if err != nil {
+		t.Fatalf("read static chart helpers: %v", err)
+	}
+	namespaceLookup := `{{- $existingNamespace := lookup "v1" "Namespace" "" .Release.Namespace -}}`
+	forcedNamespaceLookup := `{{- $existingNamespace := dict "metadata" (dict "labels" ` +
+		`(dict "orka.ai/controller-mode" ` + strconv.Quote(mode) + `)) -}}`
+	forced := strings.Replace(string(helpers), namespaceLookup, forcedNamespaceLookup, 1)
+	if forced == string(helpers) {
+		t.Fatalf("controller mode validation is not gated by the exact existing Namespace lookup")
+	}
+	if err := os.WriteFile(helpersPath, []byte(forced), 0o600); err != nil {
+		t.Fatalf("force existing namespace lookup in copied chart: %v", err)
+	}
+}
+
+func helmTemplateStaticChartWithExistingController(
+	t *testing.T,
+	existingControllerArgs []string,
+	args ...string,
+) (string, error) {
+	t.Helper()
+	return helmTemplateStaticChartWithExistingControllerSnapshot(
+		t,
+		existingControllerArgs,
+		"snapshot-key",
+		"encryption-key",
+		args...,
+	)
+}
+
+func helmTemplateStaticChartWithExistingControllerSnapshot(
+	t *testing.T,
+	existingControllerArgs []string,
+	existingSnapshotSecret string,
+	existingSnapshotKey string,
+	args ...string,
+) (string, error) {
+	t.Helper()
+	helm, err := exec.LookPath("helm")
+	if err != nil {
+		t.Skip("helm is required for static chart render tests")
+	}
+
+	chartDir := filepath.Join(t.TempDir(), "static")
+	if err := os.CopyFS(chartDir, os.DirFS("static")); err != nil {
+		t.Fatalf("copy static chart: %v", err)
+	}
+	forceStaticChartNamespaceMode(t, chartDir, "harness-v2")
+	helpersPath := filepath.Join(chartDir, "templates", "_helpers.tpl")
+	helpers, err := os.ReadFile(helpersPath)
+	if err != nil {
+		t.Fatalf("read static chart helpers: %v", err)
+	}
+	lookup := `{{- $existingControllerList := lookup "apps/v1" "Deployment" .Release.Namespace "" -}}`
+	forcedLookup := `{{- $existingControllerList := dict "items" (list) -}}`
+	if existingControllerArgs != nil {
+		quotedControllerArgs := make([]string, 0, len(existingControllerArgs))
+		for _, arg := range existingControllerArgs {
+			quotedControllerArgs = append(quotedControllerArgs, strconv.Quote(arg))
+		}
+		forcedLookup = `{{- $existingControllerList := dict "items" (list (dict ` +
+			`"metadata" (dict "name" "test-orka-controller" "labels" (dict ` +
+			`"app.kubernetes.io/instance" "test" "app.kubernetes.io/component" "controller" ` +
+			`"app.kubernetes.io/managed-by" "Helm")) ` +
+			`"spec" (dict "template" (dict "spec" (dict ` +
+			`"containers" (list (dict "name" "controller" "args" (list ` +
+			strings.Join(quotedControllerArgs, " ") + `))) ` +
+			`"volumes" (list (dict "name" "agent-execution-snapshot-key" "secret" (dict ` +
+			`"secretName" ` + strconv.Quote(existingSnapshotSecret) + ` "items" (list (dict ` +
+			`"key" ` + strconv.Quote(existingSnapshotKey) + ` "path" "key")))))))))) -}}`
+	}
+	withController := strings.Replace(string(helpers), lookup, forcedLookup, 1)
+	if withController == string(helpers) {
+		t.Fatalf("controller mode validation is not gated by the release-owned Deployment list lookup")
+	}
+	if err := os.WriteFile(helpersPath, []byte(withController), 0o600); err != nil {
+		t.Fatalf("force existing controller lookup in copied chart: %v", err)
+	}
+
+	commandArgs := []string{"template", "test", chartDir, "--namespace", "orka-test", "--is-upgrade"}
+	commandArgs = append(commandArgs, staticChartDefaultArgs()...)
+	commandArgs = append(commandArgs, args...)
+	output, err := exec.Command(helm, commandArgs...).CombinedOutput()
+	return string(output), err
+}
+
+func requireHelmRender(t *testing.T, args ...string) string {
+	t.Helper()
+	output, err := helmTemplateStaticChart(t, args...)
+	if err != nil {
+		t.Fatalf("helm template failed: %v\n%s", err, output)
+	}
+	return output
+}
+
+func requireHarnessV1UpgradeDrainHookRender(t *testing.T, matchesDesiredGeneration bool, args ...string) string {
+	t.Helper()
+	output, err := helmTemplateHarnessV1UpgradeDrainHook(t, harnessV1UpgradeState{
+		matchesDesiredGeneration: matchesDesiredGeneration,
+		authSecret:               "harness-wrapper-auth",
+		authKey:                  "token",
+		tlsSecret:                "harness-wrapper-tls",
+	}, args...)
+	if err != nil {
+		t.Fatalf("helm template forced wrapper upgrade hook failed: %v\n%s", err, output)
+	}
+	return output
+}
+
+type harnessV1UpgradeState struct {
+	matchesDesiredGeneration bool
+	wrapperMissing           bool
+	controllerState          string
+	authSecret               string
+	authKey                  string
+	tlsSecret                string
+}
+
+func helmTemplateHarnessV1UpgradeDrainHook(
+	t *testing.T,
+	state harnessV1UpgradeState,
+	args ...string,
+) (string, error) {
+	t.Helper()
+	helm, err := exec.LookPath("helm")
+	if err != nil {
+		t.Skip("helm is required for static chart render tests")
+	}
+
+	chartDir := filepath.Join(t.TempDir(), "static")
+	if err := os.CopyFS(chartDir, os.DirFS("static")); err != nil {
+		t.Fatalf("copy static chart: %v", err)
+	}
+	forceStaticChartNamespaceMode(t, chartDir, "harness-v1")
+	hookPath := filepath.Join(chartDir, "templates", "harness-wrapper-drain-hook.yaml")
+	hook, err := os.ReadFile(hookPath)
+	if err != nil {
+		t.Fatalf("read wrapper drain hook: %v", err)
+	}
+	lookup := `{{- $existingWrapper := lookup "apps/v1" "Deployment" .Release.Namespace $wrapperName }}`
+	existingGeneration := `"current-generation"`
+	if state.matchesDesiredGeneration {
+		existingGeneration = `$desiredGeneration`
+	}
+	currentImage := "registry.example/current-wrapper@sha256:" + strings.Repeat("2", 64)
+	tlsSecret := state.tlsSecret
+	if tlsSecret == "" {
+		tlsSecret = "harness-wrapper-tls"
+	}
+	forcedLookup := `{{- $existingWrapper := dict }}`
+	if !state.wrapperMissing {
+		forcedLookup = strings.Join([]string{
+			`{{- $existingWrapper := dict`,
+			`"metadata" (dict "name" $wrapperName)`,
+			`"spec" (dict "template" (dict "spec" (dict`,
+			`"containers" (list (dict "name" "wrapper"`,
+			`"image" "` + currentImage + `" "imagePullPolicy" "Always"`,
+			`"env" (list (dict "name" "ORKA_HARNESS_WRAPPER_LEDGER_GENERATION"`,
+			`"value" ` + existingGeneration + `))))`,
+			`"volumes" (list (dict "name" "auth" "secret"`,
+			`(dict "secretName" "` + state.authSecret + `" "items"`,
+			`(list (dict "key" "` + state.authKey + `" "path" "token"))))`,
+			`(dict "name" "tls" "secret" (dict "secretName" "` + tlsSecret + `")))))) }}`,
+		}, " ")
+	}
+	forced := strings.Replace(string(hook), lookup, forcedLookup, 1)
+	if forced == string(hook) {
+		t.Fatalf("wrapper drain hook is not gated by the exact existing Deployment lookup")
+	}
+	if state.controllerState != "" {
+		var controllerArgs []string
+		switch state.controllerState {
+		case "enabled":
+			controllerArgs = []string{
+				`"--controller-mode=harness-v1"`,
+				`"--harness-v1-auth-secret-name=` + state.authSecret + `"`,
+				`"--harness-v1-auth-secret-key=` + state.authKey + `"`,
+			}
+		default:
+			t.Fatalf("unsupported forced controller state %q", state.controllerState)
+		}
+		controllerLookup := `{{- $existingController := lookup "apps/v1" "Deployment" .Release.Namespace $controllerName }}`
+		forcedControllerLookup := `{{- $existingController := dict "spec" (dict "template" (dict "spec" ` +
+			`(dict "containers" (list (dict "name" "controller" "args" (list ` +
+			strings.Join(controllerArgs, " ") + `)))))) }}`
+		withController := strings.Replace(forced, controllerLookup, forcedControllerLookup, 1)
+		if withController == forced {
+			t.Fatalf("wrapper drain hook is not gated by the exact existing controller Deployment lookup")
+		}
+		forced = withController
+	}
+	if err := os.WriteFile(hookPath, []byte(forced), 0o600); err != nil {
+		t.Fatalf("force existing wrapper lookup in copied chart: %v", err)
+	}
+
+	commandArgs := []string{"template", "test", chartDir, "--namespace", "orka-test", "--is-upgrade"}
+	commandArgs = append(commandArgs, staticChartDefaultArgs()...)
+	commandArgs = append(commandArgs, args...)
+	output, err := exec.Command(helm, commandArgs...).CombinedOutput()
+	return string(output), err
+}
+
+var harnessV1GenerationPattern = regexp.MustCompile(
+	`(?m)name: ORKA_HARNESS_WRAPPER_LEDGER_GENERATION\n\s+value: "([a-f0-9]{64})"`,
+)
+
+func harnessV1RenderedGeneration(t *testing.T, rendered string) string {
+	t.Helper()
+	match := harnessV1GenerationPattern.FindStringSubmatch(rendered)
+	if len(match) != 2 {
+		t.Fatalf("rendered harness v1 Deployment is missing a canonical generation:\n%s", rendered)
+	}
+	return match[1]
+}
+
+func requireRenderedDocument(t *testing.T, rendered string, markers ...string) string {
+	t.Helper()
+	for document := range strings.SplitSeq(rendered, "\n---\n") {
+		matched := true
+		for _, marker := range markers {
+			if !strings.Contains(document, marker) {
+				matched = false
+				break
+			}
+		}
+		if matched {
+			return document
+		}
+	}
+	t.Fatalf("rendered chart has no document containing %q:\n%s", markers, rendered)
+	return ""
+}
+
+func renderedResourceName(t *testing.T, rendered string, markers ...string) string {
+	t.Helper()
+	document := requireRenderedDocument(t, rendered, markers...)
+	match := regexp.MustCompile(`(?m)^metadata:\n  name: ([^\n]+)$`).FindStringSubmatch(document)
+	if len(match) != 2 {
+		t.Fatalf("rendered resource has no metadata.name:\n%s", document)
+	}
+	return strings.Trim(match[1], `"`)
+}
+
+func TestStaticChartLongReleaseNamesKeepClusterScopedResourcesDistinct(t *testing.T) {
+	prefix := strings.Repeat("a", 52)
+	fullNamePrefix := strings.Repeat("b", 62)
+	renderedA, err := helmTemplateStaticChartForRelease(
+		t, prefix+"x", "orka-test", "--set-string", "fullnameOverride="+fullNamePrefix+"x",
+	)
+	if err != nil {
+		t.Fatalf("helm template first long release failed: %v\n%s", err, renderedA)
+	}
+	renderedB, err := helmTemplateStaticChartForRelease(
+		t, prefix+"y", "orka-test", "--set-string", "fullnameOverride="+fullNamePrefix+"y",
+	)
+	if err != nil {
+		t.Fatalf("helm template second long release failed: %v\n%s", err, renderedB)
+	}
+
+	resources := []struct {
+		name      string
+		maxLength int
+		markers   []string
+	}{
+		{
+			name:      "validating webhook",
+			maxLength: 63,
+			markers:   []string{"kind: ValidatingWebhookConfiguration"},
+		},
+		{
+			name:      "controller cluster role",
+			maxLength: 253,
+			markers:   []string{"kind: ClusterRole", `resources: ["tokenreviews"]`},
+		},
+	}
+	for _, resource := range resources {
+		t.Run(resource.name, func(t *testing.T) {
+			nameA := renderedResourceName(t, renderedA, resource.markers...)
+			nameB := renderedResourceName(t, renderedB, resource.markers...)
+			if nameA == nameB {
+				t.Fatalf("long release names collapsed to cluster-scoped name %q", nameA)
+			}
+			if len(nameA) > resource.maxLength || len(nameB) > resource.maxLength {
+				t.Fatalf("cluster-scoped names exceed %d characters: %q, %q", resource.maxLength, nameA, nameB)
+			}
+		})
+	}
+
+	clusterRoleA := renderedResourceName(t, renderedA, "kind: ClusterRole", `resources: ["tokenreviews"]`)
+	bindingA := requireRenderedDocument(
+		t,
+		renderedA,
+		"kind: ClusterRoleBinding",
+		"kind: ClusterRole\n  name: "+clusterRoleA,
+	)
+	if bindingName := renderedResourceName(t, bindingA, "kind: ClusterRoleBinding"); bindingName != clusterRoleA {
+		t.Fatalf("controller ClusterRoleBinding name %q does not match ClusterRole %q", bindingName, clusterRoleA)
+	}
+
+	shortRender := requireHelmRender(t)
+	webhookName := renderedResourceName(t, shortRender, "kind: ValidatingWebhookConfiguration")
+	if webhookName != "test-orka-controller" {
+		t.Fatalf("short validating webhook name changed to %q", webhookName)
+	}
+	clusterRoleName := renderedResourceName(t, shortRender, "kind: ClusterRole", `resources: ["tokenreviews"]`)
+	if clusterRoleName != "test-orka-controller-cluster" {
+		t.Fatalf("short controller ClusterRole name changed to %q", clusterRoleName)
+	}
+
+	otherNamespaceRender, err := helmTemplateStaticChartForRelease(
+		t, prefix+"x", "orka-other", "--set-string", "fullnameOverride="+fullNamePrefix+"x",
+	)
+	if err != nil {
+		t.Fatalf("helm template other namespace failed: %v\n%s", err, otherNamespaceRender)
+	}
+	otherNamespaceWebhook := renderedResourceName(t, otherNamespaceRender, "kind: ValidatingWebhookConfiguration")
+	webhookA := renderedResourceName(t, renderedA, "kind: ValidatingWebhookConfiguration")
+	if webhookA == otherNamespaceWebhook {
+		t.Fatalf("namespaces collapsed to cluster-scoped validating webhook name %q", webhookA)
+	}
+}
+
+func TestStaticChartUsesServicePortForInClusterControllerURLs(t *testing.T) {
+	rendered := requireHelmRender(t,
+		"--set", "service.port=18080",
+		"--set", "controller.apiPort=8080",
+	)
+
+	if got := strings.Count(rendered, "--controller-url="); got != 1 {
+		t.Fatalf("controller URL argument count = %d, want 1", got)
+	}
+	if !strings.Contains(rendered, "--controller-url=http://test-orka.orka-test.svc:18080") {
+		t.Fatalf("controller URL does not use service.port:\n%s", rendered)
+	}
+	for _, variable := range []string{
+		"ORKA_PUBLISHER_ARTIFACT_AUTHORIZATION_BROKER_URL",
+		"ORKA_PUBLISHER_ARTIFACT_API_URL",
+		"ORKA_PUBLISHER_CREDENTIAL_BROKER_URL",
+	} {
+		marker := "name: " + variable + "\n              value: http://test-orka:18080"
+		if !strings.Contains(rendered, marker) {
+			t.Fatalf("%s does not use service.port", variable)
+		}
+	}
+
+	service := requireHelmRender(t,
+		"--set", "service.port=18080",
+		"--set", "controller.apiPort=8080",
+		"--show-only", "templates/service.yaml",
+	)
+	if !strings.Contains(service, "port: 18080") || !strings.Contains(service, "targetPort: api") {
+		t.Fatalf("controller Service does not preserve service port to named API target:\n%s", service)
+	}
+}
+
+func TestStaticChartProviderProxyConfigurationIsFixedToSupportedBoundary(t *testing.T) {
+	digest := "sha256:" + strings.Repeat("0", 64)
+	args := []string{
+		"--set", "providerProxy.enabled=true",
+		"--set", "controller.acpRuntime.enabled=true",
+		"--set", "store.persistence.enabled=true",
+		"--set-string", "controller.image.digest=" + digest,
+		"--set-string", "publisher.image.digest=" + digest,
+		"--set-string", "controller.agentExecutionSnapshot.existingSecret=snapshot-key",
+		"--set-string", "controller.agentExecutionSnapshot.key=encryption-key",
+		"--set-string", "controller.acpRuntime.providerProxyNamespace=orka-test",
+		"--set-string", "providerProxy.upstreamBaseURL=http://vekil.vekil-system.svc:1337/",
+	}
+	rendered := requireHelmRender(t, args...)
+
+	for _, marker := range []string{
+		"--acp-provider-proxy-base-url=http://test-orka-provider-auth-proxy.orka-test.svc:8080",
+		"--acp-provider-proxy-namespace=orka-test",
+		"--upstream-base-url=http://vekil.vekil-system.svc:1337",
+	} {
+		if !strings.Contains(rendered, marker) {
+			t.Fatalf("rendered provider proxy configuration is missing %q", marker)
+		}
+	}
+	if strings.Contains(rendered, "--upstream-base-url=http://vekil.vekil-system.svc:1337/") {
+		t.Fatalf("provider upstream trailing slash was not normalized")
+	}
+
+	providerPolicy := requireHelmRender(t,
+		"--set", "providerProxy.enabled=true",
+		"--show-only", "templates/provider-proxy-networkpolicy.yaml",
+	)
+	for _, marker := range []string{
+		"kubernetes.io/metadata.name: vekil-system",
+		"app.kubernetes.io/name: vekil",
+		"ports: [{protocol: TCP, port: 1337}]",
+	} {
+		if !strings.Contains(providerPolicy, marker) {
+			t.Fatalf("provider proxy NetworkPolicy lost fixed Vekil boundary %q:\n%s", marker, providerPolicy)
+		}
+	}
+
+	vekilPolicy := requireHelmRender(t,
+		"--set", "providerProxy.enabled=true",
+		"--show-only", "templates/vekil-ingress-networkpolicy.yaml",
+	)
+	for _, marker := range []string{
+		"namespace: vekil-system",
+		"kubernetes.io/metadata.name: orka-test",
+		"ports: [{protocol: TCP, port: 1337}]",
+	} {
+		if !strings.Contains(vekilPolicy, marker) {
+			t.Fatalf("Vekil ingress NetworkPolicy lost fixed boundary %q:\n%s", marker, vekilPolicy)
+		}
+	}
+}
+
+func TestStaticChartEnforcesSQLiteControllerSafety(t *testing.T) {
+	tests := []struct {
+		name      string
+		args      []string
+		wantError string
+	}{
+		{
+			name:      "zero replicas",
+			args:      []string{"--set", "controller.replicas=0"},
+			wantError: "controller.replicas must be exactly 1 when using the SQLite store backend",
+		},
+		{
+			name:      "multiple replicas",
+			args:      []string{"--set", "controller.replicas=2"},
+			wantError: "controller.replicas must be exactly 1 when using the SQLite store backend",
+		},
+		{
+			name:      "leader election disabled",
+			args:      []string{"--set", "controller.leaderElect=false"},
+			wantError: "controller.leaderElect must be true for an isolated controller installation",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			output, err := helmTemplateStaticChart(t, tt.args...)
+			if err == nil {
+				t.Fatalf("helm template unexpectedly accepted unsafe SQLite controller configuration:\n%s", output)
+			}
+			if !strings.Contains(output, tt.wantError) {
+				t.Fatalf("helm template error does not contain %q:\n%s", tt.wantError, output)
+			}
+		})
+	}
+
+	rendered := requireHelmRender(t, "--show-only", "templates/deployment.yaml")
+	for _, marker := range []string{
+		"replicas: 1",
+		"strategy:\n    type: Recreate",
+		"--leader-elect=true",
+	} {
+		if !strings.Contains(rendered, marker) {
+			t.Fatalf("controller deployment is missing SQLite safety marker %q:\n%s", marker, rendered)
+		}
+	}
+}
+
+func TestStaticChartRequiresAgentExecutionSnapshotSecret(t *testing.T) {
+	tests := []struct {
+		name      string
+		args      []string
+		wantError string
+	}{
+		{
+			name: "missing Secret name",
+			args: []string{
+				"--set-string", "controller.agentExecutionSnapshot.existingSecret=",
+			},
+			wantError: "controller.agentExecutionSnapshot.existingSecret is required when agent execution is enabled",
+		},
+		{
+			name: "missing Secret key",
+			args: []string{
+				"--set-string", "controller.agentExecutionSnapshot.key=",
+			},
+			wantError: "controller.agentExecutionSnapshot.key is required when agent execution is enabled",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			output, err := helmTemplateStaticChart(t, tt.args...)
+			if err == nil {
+				t.Fatalf("helm template unexpectedly accepted incomplete snapshot key configuration:\n%s", output)
+			}
+			if !strings.Contains(output, tt.wantError) {
+				t.Fatalf("helm template error does not contain %q:\n%s", tt.wantError, output)
+			}
+		})
+	}
+}
+
+func TestStaticChartMountsAgentExecutionSnapshotKey(t *testing.T) {
+	args := []string{
+		"--set-string", "controller.agentExecutionSnapshot.existingSecret=snapshot-key",
+		"--set-string", "controller.agentExecutionSnapshot.key=encryption-key",
+		"--show-only", "templates/deployment.yaml",
+	}
+	rendered := requireHelmRender(t, args...)
+
+	for _, marker := range []string{
+		"--agent-execution-snapshot-key-file=/var/run/orka/agent-execution-snapshot/key",
+		"mountPath: /var/run/orka/agent-execution-snapshot",
+		"readOnly: true",
+		"secretName: \"snapshot-key\"",
+		"key: \"encryption-key\"",
+		"path: key",
+	} {
+		if !strings.Contains(rendered, marker) {
+			t.Fatalf("controller deployment is missing snapshot key marker %q:\n%s", marker, rendered)
+		}
+	}
+}
+
+func TestStaticChartRendersOneStaticHarnessMode(t *testing.T) {
+	v2 := requireHelmRender(t)
+	for _, marker := range []string{
+		"--controller-mode=harness-v2",
+		"app.kubernetes.io/component: acp-runtime",
+		"app.kubernetes.io/component: provider-auth-proxy",
+	} {
+		if !strings.Contains(v2, marker) {
+			t.Fatalf("harness-v2 render is missing %q:\n%s", marker, v2)
+		}
+	}
+	if strings.Contains(v2, "app.kubernetes.io/component: agent-harness-wrapper") {
+		t.Fatalf("harness-v2 render contains the harness-v1 data plane:\n%s", v2)
+	}
+
+	digest := "sha256:" + strings.Repeat("1", 64)
+	v1 := requireHelmRender(t,
+		"--set-string", "controller.mode=harness-v1",
+		"--set-string", "harnessV1.image.digest="+digest,
+		"--set-string", "harnessV1.auth.existingSecret=harness-wrapper-auth",
+		"--set-string", "harnessV1.tls.existingSecret=harness-wrapper-tls",
+	)
+	for _, marker := range []string{
+		"--controller-mode=harness-v1",
+		"app.kubernetes.io/component: agent-harness-wrapper",
+		"--harness-v1-endpoint=https://test-orka-agent-harness-wrapper.orka-test.svc:8080",
+	} {
+		if !strings.Contains(v1, marker) {
+			t.Fatalf("harness-v1 render is missing %q:\n%s", marker, v1)
+		}
+	}
+	for _, forbidden := range []string{
+		"app.kubernetes.io/component: acp-runtime",
+		"app.kubernetes.io/component: provider-auth-proxy",
+		"app.kubernetes.io/component: workspace-publisher",
+	} {
+		if strings.Contains(v1, forbidden) {
+			t.Fatalf("harness-v1 render contains harness-v2 component %q:\n%s", forbidden, v1)
+		}
+	}
+}
+
+func TestStaticChartRejectsNonStaticControllerModes(t *testing.T) {
+	for _, mode := range []string{"", "dual", "auto", "harness-v1-drain", "unknown"} {
+		t.Run(mode, func(t *testing.T) {
+			output, err := helmTemplateStaticChart(t, "--set-string", "controller.mode="+mode)
+			if err == nil || !strings.Contains(output, "controller.mode must be harness-v1 or harness-v2") {
+				t.Fatalf("helm render error = %v, want static-mode rejection:\n%s", err, output)
+			}
+		})
+	}
+}
+
+func TestStaticChartRejectsControllerWatchScopeChangesOnUpgrade(t *testing.T) {
+	const watchScopeError = `controller.watchNamespace is immutable; ` +
+		`the existing controller must already watch namespace "orka-test"`
+	tests := []struct {
+		name                   string
+		existingControllerArgs []string
+		wantError              string
+	}{
+		{
+			name:                   "legacy cluster-wide controller",
+			existingControllerArgs: []string{"--acp-runtime-enabled=true"},
+			wantError:              watchScopeError,
+		},
+		{
+			name: "legacy controller in another namespace",
+			existingControllerArgs: []string{
+				"--watch-namespace=other-namespace",
+				"--acp-runtime-enabled=true",
+			},
+			wantError: watchScopeError,
+		},
+		{
+			name: "legacy controller in the release namespace",
+			existingControllerArgs: []string{
+				"--watch-namespace=orka-test",
+				"--acp-runtime-enabled=true",
+			},
+			wantError: "implicit or legacy harness-v2 installations cannot upgrade in place",
+		},
+		{
+			name: "static harness v2 controller in the release namespace",
+			existingControllerArgs: []string{
+				"--controller-mode=harness-v2",
+				"--watch-namespace=orka-test",
+				"--controller-url=http://test-orka.orka-test.svc:8080",
+				"--acp-runtime-namespace=orka-runtimes",
+			},
+		},
+		{
+			name:                   "static harness v2 namespace with a deleted controller",
+			existingControllerArgs: nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			output, err := helmTemplateStaticChartWithExistingController(t, tt.existingControllerArgs)
+			if tt.wantError == "" {
+				if err != nil {
+					t.Fatalf("same-mode static controller upgrade failed: %v\n%s", err, output)
+				}
+				return
+			}
+			if err == nil || !strings.Contains(output, tt.wantError) {
+				t.Fatalf("helm render error = %v, want watch-scope rejection:\n%s", err, output)
+			}
+		})
+	}
+}
+
+func TestStaticChartRejectsHarnessV2IdentityChangesOnUpgrade(t *testing.T) {
+	staticControllerArgs := []string{
+		"--controller-mode=harness-v2",
+		"--watch-namespace=orka-test",
+		"--controller-url=http://test-orka.orka-test.svc:8080",
+		"--acp-runtime-namespace=orka-runtimes",
+	}
+	tests := []struct {
+		name      string
+		args      []string
+		wantError string
+	}{
+		{
+			name:      "fullname override",
+			args:      []string{"--set-string", "fullnameOverride=renamed"},
+			wantError: "the effective chart fullname is immutable for harness-v2 upgrades",
+		},
+		{
+			name:      "effective name override",
+			args:      []string{"--set-string", "nameOverride=renamed"},
+			wantError: "the effective chart fullname is immutable for harness-v2 upgrades",
+		},
+		{
+			name:      "ACP runtime namespace",
+			args:      []string{"--set-string", "controller.acpRuntime.namespace=other-runtimes"},
+			wantError: "controller.acpRuntime.namespace is immutable",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			output, err := helmTemplateStaticChartWithExistingController(t, staticControllerArgs, tt.args...)
+			if err == nil || !strings.Contains(output, tt.wantError) {
+				t.Fatalf("helm render error = %v, want immutable identity rejection %q:\n%s", err, tt.wantError, output)
+			}
+		})
+	}
+}
+
+func TestStaticChartRejectsAgentExecutionSnapshotIdentityChangesOnUpgrade(t *testing.T) {
+	staticControllerArgs := []string{
+		"--controller-mode=harness-v2",
+		"--watch-namespace=orka-test",
+		"--controller-url=http://test-orka.orka-test.svc:8080",
+		"--acp-runtime-namespace=orka-runtimes",
+	}
+	tests := []struct {
+		name           string
+		existingSecret string
+		existingKey    string
+		args           []string
+		wantError      string
+	}{
+		{
+			name:           "Secret name changed",
+			existingSecret: "old-snapshot-key",
+			existingKey:    "encryption-key",
+			args:           []string{"--set-string", "controller.agentExecutionSnapshot.existingSecret=new-snapshot-key"},
+			wantError:      "controller.agentExecutionSnapshot.existingSecret is immutable for in-place upgrades",
+		},
+		{
+			name:           "Secret item key changed",
+			existingSecret: "snapshot-key",
+			existingKey:    "old-encryption-key",
+			args:           []string{"--set-string", "controller.agentExecutionSnapshot.key=new-encryption-key"},
+			wantError:      "controller.agentExecutionSnapshot.key is immutable for in-place upgrades",
+		},
+		{
+			name:           "live Secret name missing",
+			existingSecret: "",
+			existingKey:    "encryption-key",
+			wantError:      "cannot determine the existing agent execution snapshot Secret name",
+		},
+		{
+			name:           "live Secret item key missing",
+			existingSecret: "snapshot-key",
+			existingKey:    "",
+			wantError:      "cannot determine the existing agent execution snapshot Secret key",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			output, err := helmTemplateStaticChartWithExistingControllerSnapshot(
+				t,
+				staticControllerArgs,
+				tt.existingSecret,
+				tt.existingKey,
+				tt.args...,
+			)
+			if err == nil || !strings.Contains(output, tt.wantError) {
+				t.Fatalf("helm render error = %v, want snapshot identity rejection %q:\n%s", err, tt.wantError, output)
+			}
+		})
+	}
+}
+
+func TestStaticChartRejectsUpgradeWithoutStaticNamespaceIdentity(t *testing.T) {
+	output, err := helmTemplateStaticChart(t, "--is-upgrade")
+	if err == nil || !strings.Contains(output, "controller mode identity is missing or incompatible") {
+		t.Fatalf("helm render error = %v, want missing static namespace identity rejection:\n%s", err, output)
+	}
+}
+
+//nolint:gocyclo // One render matrix verifies the coupled rollout, rollback, and uninstall invariants.
+func TestStaticChartHarnessV1UpgradeDrainHookIsExistingDeploymentGated(t *testing.T) {
+	digest := "sha256:" + strings.Repeat("1", 64)
+	args := []string{
+		"--set-string", "controller.mode=harness-v1",
+		"--set", "store.persistence.enabled=true",
+		"--set-string", "harnessV1.image.digest=" + digest,
+		"--set-string", "harnessV1.auth.existingSecret=harness-wrapper-auth",
+		"--set-string", "harnessV1.tls.existingSecret=harness-wrapper-tls",
+		"--set-string", "harnessV1.upgradeDrain.timeout=9m",
+		"--set-string", "harnessV1.upgradeDrain.pollInterval=3s",
+		"--set-string", "controller.agentExecutionSnapshot.existingSecret=snapshot-key",
+		"--set-string", "controller.agentExecutionSnapshot.key=encryption-key",
+	}
+	// A fresh installation has no live Deployment and must not emit a drain
+	// hook. The enabled revision must still persist its post-rollback abort hook because
+	// Helm executes hooks recorded in the historical rollback target.
+	fresh := requireHelmRender(t, args...)
+	if strings.Contains(fresh, "app.kubernetes.io/component: agent-harness-wrapper-drain") ||
+		strings.Contains(fresh, "helm.sh/hook: pre-upgrade") {
+		t.Fatalf("fresh harness v1 render unexpectedly contains an upgrade drain hook:\n%s", fresh)
+	}
+	for _, marker := range []string{
+		"app.kubernetes.io/component: agent-harness-wrapper-rollover-abort",
+		"helm.sh/hook: post-rollback",
+		"- abort-rollover",
+		`image: "ghcr.io/orka-agents/orka/agent-harness-wrapper@sha256:` + strings.Repeat("1", 64) + `"`,
+		`secretName: "harness-wrapper-auth"`,
+		`key: "token"`,
+	} {
+		if !strings.Contains(fresh, marker) {
+			t.Fatalf("fresh enabled revision rollback hook is missing %q:\n%s", marker, fresh)
+		}
+	}
+	if got := strings.Count(fresh, "helm.sh/hook: post-rollback"); got != 3 {
+		t.Fatalf("fresh enabled rollback hook annotation count = %d, want 3:\n%s", got, fresh)
+	}
+
+	unknown, err := helmTemplateStaticChart(t, append(append([]string{}, args...), "--is-upgrade")...)
+	if err == nil {
+		t.Fatalf("upgrade without live controller or wrapper state rendered successfully:\n%s", unknown)
+	}
+	if !strings.Contains(unknown, "cannot determine the previously deployed harness v1 state during upgrade") {
+		t.Fatalf("unknown-state upgrade did not fail closed:\n%s", unknown)
+	}
+
+	// Render the unchanged hook body from a copied chart with only lookup's
+	// result replaced, so the existing-Deployment branch remains Helm-validated.
+	hook := requireHarnessV1UpgradeDrainHookRender(t, false, args...)
+	for _, marker := range []string{
+		"kind: NetworkPolicy",
+		"kind: Job",
+		"app.kubernetes.io/component: agent-harness-wrapper-rollover-drain",
+		"app.kubernetes.io/component: agent-harness-wrapper-delete-drain",
+		"helm.sh/hook: pre-upgrade,pre-rollback",
+		"helm.sh/hook: pre-delete",
+		`helm.sh/hook-weight: "-20"`,
+		`helm.sh/hook-weight: "-10"`,
+		"helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded",
+		"backoffLimit: 0",
+		"serviceAccountName: test-orka-agent-harness-wrapper",
+		"automountServiceAccountToken: false",
+		"runAsNonRoot: true",
+		"readOnlyRootFilesystem: true",
+		"drop: [ALL]",
+		`image: "registry.example/current-wrapper@sha256:` + strings.Repeat("2", 64) + `"`,
+		"imagePullPolicy: Always",
+		`command: ["/orka-agent-harness-wrapper"]`,
+		"- drain",
+		`- "--endpoint=https://test-orka-agent-harness-wrapper.orka-test.svc:8080"`,
+		"- --bearer-token-file=/var/run/orka/harness-wrapper-auth/token",
+		"- --ca-file=/var/run/orka/harness-wrapper-tls/ca.crt",
+		`- "--timeout=9m"`,
+		`- "--poll-interval=3s"`,
+		`secretName: "harness-wrapper-auth"`,
+		`key: "token"`,
+		"defaultMode: 0440",
+	} {
+		if !strings.Contains(hook, marker) {
+			t.Fatalf("harness v1 drain hook is missing %q:\n%s", marker, hook)
+		}
+	}
+	if got := strings.Count(hook, "helm.sh/hook: pre-upgrade,pre-rollback"); got != 3 {
+		t.Fatalf("rollover hook annotation count = %d, want 3:\n%s", got, hook)
+	}
+	if got := strings.Count(hook, "helm.sh/hook: pre-delete"); got != 3 {
+		t.Fatalf("pre-delete hook annotation count = %d, want 3:\n%s", got, hook)
+	}
+	if !regexp.MustCompile(`--next-generation=[a-f0-9]{64}`).MatchString(hook) {
+		t.Fatalf("rollover hook is missing its canonical replacement generation:\n%s", hook)
+	}
+	rolloverJob := requireRenderedDocument(t, hook,
+		"kind: Job",
+		"app.kubernetes.io/component: agent-harness-wrapper-rollover-drain",
+	)
+	if strings.Contains(rolloverJob, "--controller-endpoint=") ||
+		strings.Contains(rolloverJob, "--controller-token-file=") ||
+		strings.Contains(rolloverJob, "serviceAccountToken:") {
+		t.Fatalf("ordinary wrapper rollover unexpectedly retired controller-side v1 admission:\n%s", rolloverJob)
+	}
+	deleteJob := requireRenderedDocument(t, hook,
+		"kind: Job",
+		"app.kubernetes.io/component: agent-harness-wrapper-delete-drain",
+	)
+	if strings.Contains(deleteJob, "--controller-endpoint=") ||
+		strings.Contains(deleteJob, "--controller-token-file=") ||
+		strings.Contains(deleteJob, "serviceAccountToken:") {
+		t.Fatalf("uninstall drain unexpectedly coordinates a cross-mode controller retirement:\n%s", deleteJob)
+	}
+	for _, marker := range []string{
+		"app.kubernetes.io/component: agent-harness-wrapper-rollover-abort",
+		"helm.sh/hook: post-rollback",
+		"- abort-rollover",
+		`image: "ghcr.io/orka-agents/orka/agent-harness-wrapper@sha256:` + strings.Repeat("1", 64) + `"`,
+		`secretName: "harness-wrapper-auth"`,
+		`key: "token"`,
+	} {
+		if !strings.Contains(hook, marker) {
+			t.Fatalf("changed-generation rollback hook is missing %q:\n%s", marker, hook)
+		}
+	}
+	if strings.Contains(hook, "/usr/local/bin/node") {
+		t.Fatalf("delete drain hook assumes an unavailable Node runtime:\n%s", hook)
+	}
+	if strings.Contains(hook, strings.Repeat("x", 32)) {
+		t.Fatalf("harness v1 drain hook rendered a raw bearer token:\n%s", hook)
+	}
+
+	unchanged := requireHarnessV1UpgradeDrainHookRender(t, true, args...)
+	if strings.Contains(unchanged, "helm.sh/hook: pre-upgrade,pre-rollback") ||
+		strings.Contains(unchanged, "agent-harness-wrapper-rollover-drain") {
+		t.Fatalf("unchanged wrapper Pod template unexpectedly triggered a rollover drain:\n%s", unchanged)
+	}
+	for _, marker := range []string{
+		"app.kubernetes.io/component: agent-harness-wrapper-rollover-abort",
+		"helm.sh/hook: post-rollback",
+		"- abort-rollover",
+		`- "--endpoint=https://test-orka-agent-harness-wrapper.orka-test.svc:8080"`,
+		"- --bearer-token-file=/var/run/orka/harness-wrapper-auth/token",
+		"- --ca-file=/var/run/orka/harness-wrapper-tls/ca.crt",
+		`secretName: "harness-wrapper-auth"`,
+		`secretName: "harness-wrapper-tls"`,
+		`key: "token"`,
+	} {
+		if !strings.Contains(unchanged, marker) {
+			t.Fatalf("same-generation rollback hook is missing %q:\n%s", marker, unchanged)
+		}
+	}
+	if got := strings.Count(unchanged, "helm.sh/hook: post-rollback"); got != 3 {
+		t.Fatalf("rollback abort hook annotation count = %d, want 3:\n%s", got, unchanged)
+	}
+	if !regexp.MustCompile(`--expected-generation=[a-f0-9]{64}`).MatchString(unchanged) {
+		t.Fatalf("rollback abort hook is missing its exact live generation:\n%s", unchanged)
+	}
+	if !strings.Contains(unchanged, "helm.sh/hook: pre-delete") {
+		t.Fatalf("enabled release lost its uninstall drain hook:\n%s", unchanged)
+	}
+}
+
+func TestStaticChartHarnessV1RejectsLiveAuthRotation(t *testing.T) {
+	digest := "sha256:" + strings.Repeat("1", 64)
+	baseArgs := []string{
+		"--set-string", "controller.mode=harness-v1",
+		"--set", "store.persistence.enabled=true",
+		"--set-string", "harnessV1.image.digest=" + digest,
+		"--set-string", "harnessV1.auth.existingSecret=harness-wrapper-auth",
+		"--set-string", "harnessV1.tls.existingSecret=harness-wrapper-tls",
+		"--set-string", "controller.agentExecutionSnapshot.existingSecret=snapshot-key",
+		"--set-string", "controller.agentExecutionSnapshot.key=encryption-key",
+	}
+	tests := []struct {
+		name      string
+		state     harnessV1UpgradeState
+		args      []string
+		wantError string
+	}{
+		{
+			name: "Secret source",
+			state: harnessV1UpgradeState{
+				authSecret: "current-wrapper-auth",
+				authKey:    "token",
+			},
+			args: []string{
+				"--set-string", "harnessV1.auth.existingSecret=next-wrapper-auth",
+			},
+			wantError: "harnessV1.auth.existingSecret cannot change while the previously deployed " +
+				"harness v1 route remains enabled",
+		},
+		{
+			name: "Secret key",
+			state: harnessV1UpgradeState{
+				authSecret: "harness-wrapper-auth",
+				authKey:    "current-token",
+			},
+			args: []string{
+				"--set-string", "harnessV1.auth.existingSecret=harness-wrapper-auth",
+				"--set-string", "harnessV1.auth.tokenKey=next-token",
+			},
+			wantError: "harnessV1.auth.tokenKey cannot change while the previously deployed harness v1 route remains enabled",
+		},
+		{
+			name: "missing wrapper Secret source",
+			state: harnessV1UpgradeState{
+				wrapperMissing:  true,
+				controllerState: "enabled",
+				authSecret:      "current-wrapper-auth",
+				authKey:         "token",
+			},
+			args: []string{
+				"--set-string", "harnessV1.auth.existingSecret=next-wrapper-auth",
+			},
+			wantError: "harnessV1.auth.existingSecret cannot change while the previously deployed " +
+				"harness v1 route remains enabled",
+		},
+		{
+			name: "missing wrapper Secret key",
+			state: harnessV1UpgradeState{
+				wrapperMissing:  true,
+				controllerState: "enabled",
+				authSecret:      "harness-wrapper-auth",
+				authKey:         "current-token",
+			},
+			args: []string{
+				"--set-string", "harnessV1.auth.existingSecret=harness-wrapper-auth",
+				"--set-string", "harnessV1.auth.tokenKey=next-token",
+			},
+			wantError: "harnessV1.auth.tokenKey cannot change while the previously deployed harness v1 route remains enabled",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			args := append(append([]string{}, baseArgs...), tt.args...)
+			output, err := helmTemplateHarnessV1UpgradeDrainHook(t, tt.state, args...)
+			if err == nil {
+				t.Fatalf("unsafe live auth rotation rendered successfully:\n%s", output)
+			}
+			if !strings.Contains(output, tt.wantError) {
+				t.Fatalf("helm template error is missing %q:\n%s", tt.wantError, output)
+			}
+		})
+	}
+}
+
+func TestStaticChartHarnessV1TLSRotationUsesDrainedRollover(t *testing.T) {
+	digest := "sha256:" + strings.Repeat("1", 64)
+	args := []string{
+		"--set-string", "controller.mode=harness-v1",
+		"--set", "store.persistence.enabled=true",
+		"--set-string", "harnessV1.image.digest=" + digest,
+		"--set-string", "harnessV1.auth.existingSecret=harness-wrapper-auth",
+		"--set-string", "harnessV1.tls.existingSecret=next-wrapper-tls",
+		"--set-string", "controller.agentExecutionSnapshot.existingSecret=snapshot-key",
+		"--set-string", "controller.agentExecutionSnapshot.key=encryption-key",
+	}
+	rendered, err := helmTemplateHarnessV1UpgradeDrainHook(t, harnessV1UpgradeState{
+		authSecret: "harness-wrapper-auth",
+		authKey:    "token",
+		tlsSecret:  "current-wrapper-tls",
+	}, args...)
+	if err != nil {
+		t.Fatalf("TLS Secret rotation failed to render drained rollover: %v\n%s", err, rendered)
+	}
+	rollover := requireRenderedDocument(t, rendered,
+		"kind: Job",
+		"app.kubernetes.io/component: agent-harness-wrapper-rollover-drain",
+	)
+	if !strings.Contains(rollover, `secretName: "current-wrapper-tls"`) ||
+		strings.Contains(rollover, `secretName: "next-wrapper-tls"`) {
+		t.Fatalf("rollover drain did not retain the live wrapper TLS authority:\n%s", rollover)
+	}
+	abort := requireRenderedDocument(t, rendered,
+		"kind: Job",
+		"app.kubernetes.io/component: agent-harness-wrapper-rollover-abort",
+	)
+	if !strings.Contains(abort, `secretName: "next-wrapper-tls"`) {
+		t.Fatalf("rollback abort did not use the target revision TLS authority:\n%s", abort)
+	}
+}
+
+func TestStaticChartHarnessV1GenerationTracksOnlyPodTemplate(t *testing.T) {
+	digest := "sha256:" + strings.Repeat("3", 64)
+	args := []string{
+		"--set-string", "controller.mode=harness-v1",
+		"--set", "store.persistence.enabled=true",
+		"--set-string", "harnessV1.image.digest=" + digest,
+		"--set-string", "harnessV1.auth.existingSecret=harness-wrapper-auth",
+		"--set-string", "harnessV1.tls.existingSecret=harness-wrapper-tls",
+		"--set-string", "controller.agentExecutionSnapshot.existingSecret=snapshot-key",
+		"--set-string", "controller.agentExecutionSnapshot.key=encryption-key",
+		"--show-only", "templates/harness-wrapper-deployment.yaml",
+	}
+	first := requireHelmRender(t, append(append([]string{}, args...), "--set", "controller.apiPort=8080")...)
+	second := requireHelmRender(t, append(append([]string{}, args...), "--set", "controller.apiPort=9090")...)
+	firstGeneration := harnessV1RenderedGeneration(t, first)
+	if secondGeneration := harnessV1RenderedGeneration(t, second); secondGeneration != firstGeneration {
+		t.Fatalf("unrelated controller value changed wrapper generation: %s != %s", secondGeneration, firstGeneration)
+	}
+	changedArgs := append(append([]string{}, args...), "--set", "harnessV1.codexSandboxMode=read-only")
+	changed := requireHelmRender(t, changedArgs...)
+	if changedGeneration := harnessV1RenderedGeneration(t, changed); changedGeneration == firstGeneration {
+		t.Fatalf("wrapper Pod-template change preserved generation %s", changedGeneration)
+	}
+	rotated := requireHelmRender(t, append(append([]string{}, args...),
+		"--set-string", "harnessV1.tls.rolloutNonce=certificate-2")...)
+	if rotatedGeneration := harnessV1RenderedGeneration(t, rotated); rotatedGeneration == firstGeneration {
+		t.Fatalf("TLS rollout nonce preserved wrapper generation %s", rotatedGeneration)
+	}
+}
+
+func TestStaticChartHarnessV1UsesOnlyExistingSecretReferences(t *testing.T) {
+	digest := "sha256:" + strings.Repeat("4", 64)
+	args := []string{
+		"--set-string", "controller.mode=harness-v1",
+		"--set", "store.persistence.enabled=true",
+		"--set-string", "harnessV1.image.digest=" + digest,
+		"--set-string", "harnessV1.auth.existingSecret=harness-wrapper-auth",
+		"--set-string", "harnessV1.tls.existingSecret=harness-wrapper-tls",
+		"--set-string", "controller.agentExecutionSnapshot.existingSecret=snapshot-key",
+		"--set-string", "controller.agentExecutionSnapshot.key=encryption-key",
+	}
+	rendered := requireHelmRender(t, args...)
+	if !strings.Contains(rendered, "secretName: \"harness-wrapper-auth\"") {
+		t.Fatalf("wrapper did not mount the configured existing Secret:\n%s", rendered)
+	}
+	if strings.Contains(rendered, "# Source: orka/templates/harness-wrapper-secret.yaml") {
+		t.Fatalf("chart rendered a managed harness wrapper Secret:\n%s", rendered)
+	}
+}
+
+func TestStaticChartRejectsUnsafeHarnessV1Values(t *testing.T) {
+	digest := "sha256:" + strings.Repeat("1", 64)
+	tests := []struct {
+		name      string
+		args      []string
+		wantError string
+	}{
+		{
+			name: "missing digest",
+			args: []string{
+				"--set-string", "controller.mode=harness-v1",
+			},
+			wantError: "harnessV1.image.digest must be a sha256 digest when controller.mode=harness-v1",
+		},
+		{
+			name: "mutable tag-shaped digest",
+			args: []string{
+				"--set-string", "controller.mode=harness-v1",
+				"--set-string", "harnessV1.image.digest=latest",
+			},
+			wantError: "harnessV1.image.digest must be a sha256 digest when controller.mode=harness-v1",
+		},
+		{
+			name: "Substrate workspace provider",
+			args: []string{
+				"--set-string", "controller.mode=harness-v1",
+				"--set", "controller.substrate.enabled=true",
+			},
+			wantError: "controller.substrate.enabled is unsupported when controller.mode=harness-v1",
+		},
+		{
+			name: "inline bearer token",
+			args: []string{
+				"--set-string", "controller.mode=harness-v1",
+				"--set-string", "harnessV1.image.digest=" + digest,
+				"--set-string", "harnessV1.auth.existingSecret=harness-wrapper-auth",
+				"--set-string", "harnessV1.auth.token=" + strings.Repeat("x", 32),
+			},
+			wantError: "harnessV1.auth.token is unsupported",
+		},
+		{
+			name: "short bearer token",
+			args: []string{
+				"--set-string", "controller.mode=harness-v1",
+				"--set-string", "harnessV1.image.digest=" + digest,
+				"--set-string", "harnessV1.auth.token=too-short",
+			},
+			wantError: "harnessV1.auth.token is unsupported",
+		},
+		{
+			name: "missing existing auth Secret",
+			args: []string{
+				"--set-string", "controller.mode=harness-v1",
+				"--set-string", "harnessV1.image.digest=" + digest,
+			},
+			wantError: "harnessV1.auth.existingSecret is required when controller.mode=harness-v1",
+		},
+		{
+			name: "missing existing TLS Secret",
+			args: []string{
+				"--set-string", "controller.mode=harness-v1",
+				"--set-string", "harnessV1.image.digest=" + digest,
+				"--set-string", "harnessV1.auth.existingSecret=harness-wrapper-auth",
+			},
+			wantError: "harnessV1.tls.existingSecret is required when controller.mode=harness-v1",
+		},
+		{
+			name: "shared auth and TLS Secret",
+			args: []string{
+				"--set-string", "controller.mode=harness-v1",
+				"--set-string", "harnessV1.image.digest=" + digest,
+				"--set-string", "harnessV1.auth.existingSecret=harness-wrapper-auth",
+				"--set-string", "harnessV1.tls.existingSecret=harness-wrapper-auth",
+			},
+			wantError: "harnessV1.tls.existingSecret must differ from harnessV1.auth.existingSecret",
+		},
+		{
+			name: "missing ledger capacity",
+			args: []string{
+				"--set-string", "controller.mode=harness-v1",
+				"--set-string", "harnessV1.image.digest=" + digest,
+				"--set-string", "harnessV1.auth.existingSecret=harness-wrapper-auth",
+				"--set-string", "harnessV1.tls.existingSecret=harness-wrapper-tls",
+				"--set-string", "harnessV1.ledger.size=",
+			},
+			wantError: "harnessV1.ledger.size is required when controller.mode=harness-v1",
+		},
+		{
+			name: "missing ledger retention",
+			args: []string{
+				"--set-string", "controller.mode=harness-v1",
+				"--set-string", "harnessV1.image.digest=" + digest,
+				"--set-string", "harnessV1.auth.existingSecret=harness-wrapper-auth",
+				"--set-string", "harnessV1.tls.existingSecret=harness-wrapper-tls",
+				"--set-string", "harnessV1.ledger.retention=",
+			},
+			wantError: "harnessV1.ledger.retention is required when controller.mode=harness-v1",
+		},
+		{
+			name: "zero ledger retention",
+			args: []string{
+				"--set-string", "controller.mode=harness-v1",
+				"--set-string", "harnessV1.image.digest=" + digest,
+				"--set-string", "harnessV1.auth.existingSecret=harness-wrapper-auth",
+				"--set-string", "harnessV1.tls.existingSecret=harness-wrapper-tls",
+				"--set-string", "harnessV1.ledger.retention=0s",
+			},
+			wantError: "harnessV1.ledger.retention must be a positive Go duration",
+		},
+		{
+			name: "malformed ledger retention",
+			args: []string{
+				"--set-string", "controller.mode=harness-v1",
+				"--set-string", "harnessV1.image.digest=" + digest,
+				"--set-string", "harnessV1.auth.existingSecret=harness-wrapper-auth",
+				"--set-string", "harnessV1.tls.existingSecret=harness-wrapper-tls",
+				"--set-string", "harnessV1.ledger.retention=immediate",
+			},
+			wantError: "harnessV1.ledger.retention must be a positive Go duration",
+		},
+		{
+			name: "negative ledger retention",
+			args: []string{
+				"--set-string", "controller.mode=harness-v1",
+				"--set-string", "harnessV1.image.digest=" + digest,
+				"--set-string", "harnessV1.auth.existingSecret=harness-wrapper-auth",
+				"--set-string", "harnessV1.tls.existingSecret=harness-wrapper-tls",
+				"--set-string", "harnessV1.ledger.retention=-1h",
+			},
+			wantError: "harnessV1.ledger.retention must be a positive Go duration",
+		},
+		{
+			name: "parallel dispatch workers",
+			args: []string{
+				"--set-string", "controller.mode=harness-v1",
+				"--set-string", "harnessV1.image.digest=" + digest,
+				"--set-string", "harnessV1.auth.existingSecret=harness-wrapper-auth",
+				"--set-string", "harnessV1.tls.existingSecret=harness-wrapper-tls",
+				"--set", "harnessV1.dispatch.workers=2",
+			},
+			wantError: "harnessV1.dispatch.workers must be exactly 1 when controller.mode=harness-v1",
+		},
+		{
+			name: "unsupported Codex sandbox",
+			args: []string{
+				"--set-string", "controller.mode=harness-v1",
+				"--set-string", "harnessV1.image.digest=" + digest,
+				"--set-string", "harnessV1.auth.existingSecret=harness-wrapper-auth",
+				"--set-string", "harnessV1.tls.existingSecret=harness-wrapper-tls",
+				"--set-string", "harnessV1.codexSandboxMode=unrestricted",
+			},
+			wantError: "harnessV1.codexSandboxMode must be read-only, workspace-write, or danger-full-access",
+		},
+		{
+			name: "invalid upgrade drain timeout",
+			args: []string{
+				"--set-string", "controller.mode=harness-v1",
+				"--set-string", "harnessV1.image.digest=" + digest,
+				"--set-string", "harnessV1.auth.existingSecret=harness-wrapper-auth",
+				"--set-string", "harnessV1.tls.existingSecret=harness-wrapper-tls",
+				"--set-string", "harnessV1.upgradeDrain.timeout=0s",
+			},
+			wantError: "harnessV1.upgradeDrain.timeout must be a positive Go duration",
+		},
+		{
+			name: "invalid upgrade drain poll interval",
+			args: []string{
+				"--set-string", "controller.mode=harness-v1",
+				"--set-string", "harnessV1.image.digest=" + digest,
+				"--set-string", "harnessV1.auth.existingSecret=harness-wrapper-auth",
+				"--set-string", "harnessV1.tls.existingSecret=harness-wrapper-tls",
+				"--set-string", "harnessV1.upgradeDrain.pollInterval=immediate",
+			},
+			wantError: "harnessV1.upgradeDrain.pollInterval must be a positive Go duration",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			output, err := helmTemplateStaticChart(t, tt.args...)
+			if err == nil {
+				t.Fatalf("helm template unexpectedly accepted unsafe harness v1 values")
+			}
+			if !strings.Contains(output, tt.wantError) {
+				t.Fatalf("helm template error does not contain %q:\n%s", tt.wantError, output)
+			}
+		})
+	}
+}
+
+func TestStaticChartHarnessV1EnabledRenderIsIsolatedAndDurable(t *testing.T) {
+	digest := "sha256:" + strings.Repeat("1", 64)
+	args := []string{
+		"--set-string", "controller.mode=harness-v1",
+		"--set-string", "harnessV1.image.digest=" + digest,
+		"--set-string", "harnessV1.auth.existingSecret=harness-wrapper-auth",
+		"--set-string", "harnessV1.tls.existingSecret=harness-wrapper-tls",
+		"--set-string", "harnessV1.tls.rolloutNonce=certificate-1",
+		"--set-string", "harnessV1.ledger.retention=168h",
+		"--set-string", "service.port=18080",
+		"--set-string", "controller.apiPort=18081",
+		"--set-string", "controller.agentExecutionSnapshot.existingSecret=snapshot-key",
+		"--set-string", "controller.agentExecutionSnapshot.key=encryption-key",
+	}
+	controllerDeployment := requireHelmRender(t, append(args, "--show-only", "templates/deployment.yaml")...)
+	for _, marker := range []string{
+		"--harness-v1-dispatch-workers=1",
+		"--harness-v1-endpoint=https://test-orka-agent-harness-wrapper.orka-test.svc:8080",
+		"--harness-v1-ca-file=/var/run/orka/harness-v1-tls/ca.crt",
+		"mountPath: /var/run/orka/harness-v1-tls",
+		`secretName: "harness-wrapper-tls"`,
+		"key: ca.crt",
+		`orka.ai/harness-v1-tls-rollout-nonce: "certificate-1"`,
+	} {
+		if !strings.Contains(controllerDeployment, marker) {
+			t.Fatalf("controller Deployment is missing harness v1 TLS marker %q:\n%s", marker, controllerDeployment)
+		}
+	}
+
+	deployment := requireHelmRender(t, append(args, "--show-only", "templates/harness-wrapper-deployment.yaml")...)
+	for _, marker := range []string{
+		"replicas: 1",
+		"strategy:\n    type: Recreate",
+		`image: "ghcr.io/orka-agents/orka/agent-harness-wrapper@` + digest + `"`,
+		"serviceAccountName: test-orka-agent-harness-wrapper",
+		"automountServiceAccountToken: false",
+		"name: https",
+		"name: ORKA_CONTROLLER_URL",
+		"value: http://test-orka.orka-test.svc:18080",
+		"name: ORKA_HARNESS_WRAPPER_BEARER_TOKEN_FILE",
+		"value: /var/run/orka/harness-wrapper-auth/token",
+		"name: ORKA_HARNESS_WRAPPER_TLS_CERT_FILE",
+		"value: /var/run/orka/harness-wrapper-tls/tls.crt",
+		"name: ORKA_HARNESS_WRAPPER_TLS_KEY_FILE",
+		"value: /var/run/orka/harness-wrapper-tls/tls.key",
+		"scheme: HTTPS",
+		"name: ORKA_HARNESS_WRAPPER_ADMISSION_LEDGER_PATH",
+		"value: /var/lib/orka/harness-v1/admission-ledger.db",
+		"name: ORKA_HARNESS_WRAPPER_LEDGER_GENERATION",
+		"name: ORKA_HARNESS_WRAPPER_LEDGER_RETENTION",
+		`value: "168h"`,
+		"mountPath: /var/lib/orka/harness-v1",
+		"claimName: test-orka-harness-v1-ledger",
+		`secretName: "harness-wrapper-auth"`,
+		`secretName: "harness-wrapper-tls"`,
+		"name: controller-api-token",
+		"mountPath: /var/run/secrets/kubernetes.io/serviceaccount",
+		"projected:",
+		"defaultMode: 0400",
+		"serviceAccountToken:",
+		"path: token",
+		"expirationSeconds: 3600",
+		`orka.ai/harness-v1-tls-rollout-nonce: "certificate-1"`,
+		"key: tls.crt",
+		"key: tls.key",
+		"key: ca.crt",
+	} {
+		if !strings.Contains(deployment, marker) {
+			t.Fatalf("harness v1 Deployment is missing %q:\n%s", marker, deployment)
+		}
+	}
+	for _, forbidden := range []string{
+		"ORKA_SA_TOKEN_PATH",
+		"upload-token",
+		"GIT_TOKEN",
+		"GITHUB_TOKEN",
+		"ORKA_WORKSPACE_PUBLISHER",
+		"provider-auth",
+	} {
+		if strings.Contains(deployment, forbidden) {
+			t.Fatalf("harness v1 Deployment contains forbidden ambient credential surface %q:\n%s", forbidden, deployment)
+		}
+	}
+
+	for template, markers := range map[string][]string{
+		"templates/harness-wrapper-service.yaml": {
+			"kind: Service",
+			"name: test-orka-agent-harness-wrapper",
+			"name: https",
+			"port: 8080",
+			"targetPort: https",
+		},
+		"templates/harness-wrapper-serviceaccount.yaml": {
+			"kind: ServiceAccount",
+			"automountServiceAccountToken: false",
+		},
+		"templates/harness-wrapper-pvc.yaml": {
+			"kind: PersistentVolumeClaim",
+			"name: test-orka-harness-v1-ledger",
+			"helm.sh/resource-policy: keep",
+			"storage: 1Gi",
+		},
+		"templates/harness-wrapper-networkpolicy.yaml": {
+			"kind: NetworkPolicy",
+			"policyTypes: [Ingress, Egress]",
+			"egress:\n" +
+				"    - to:\n" +
+				"        - podSelector:\n" +
+				"            matchLabels:\n" +
+				"              app.kubernetes.io/name: orka\n" +
+				"              app.kubernetes.io/instance: test\n" +
+				"              app.kubernetes.io/component: controller\n" +
+				"      ports:\n" +
+				"        - protocol: TCP\n" +
+				"          port: 18081",
+			"kubernetes.io/metadata.name: kube-system",
+			"cidr: 0.0.0.0/0",
+			"cidr: ::/0",
+			"port: 443",
+		},
+	} {
+		rendered := requireHelmRender(t, append(args, "--show-only", template)...)
+		for _, marker := range markers {
+			if !strings.Contains(rendered, marker) {
+				t.Fatalf("%s is missing %q:\n%s", template, marker, rendered)
+			}
+		}
+	}
+	harnessV1RenderedGeneration(t, deployment)
+}
+
+func TestStaticChartRejectsUnsupportedProviderProxyOverrides(t *testing.T) {
+	tests := []struct {
+		name      string
+		args      []string
+		wantError string
+	}{
+		{
+			name: "different namespace",
+			args: []string{
+				"--set", "providerProxy.enabled=true",
+				"--set-string", "controller.acpRuntime.providerProxyNamespace=other-system",
+			},
+			wantError: "controller.acpRuntime.providerProxyNamespace must be empty or match the Helm release namespace",
+		},
+		{
+			name: "different upstream host",
+			args: []string{
+				"--set", "providerProxy.enabled=true",
+				"--set-string", "providerProxy.upstreamBaseURL=http://other.vekil-system.svc:1337",
+			},
+			wantError: "providerProxy.upstreamBaseURL must be http://vekil.vekil-system.svc:1337",
+		},
+		{
+			name: "different upstream port",
+			args: []string{
+				"--set", "providerProxy.enabled=true",
+				"--set-string", "providerProxy.upstreamBaseURL=http://vekil.vekil-system.svc:8080",
+			},
+			wantError: "providerProxy.upstreamBaseURL must be http://vekil.vekil-system.svc:1337",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			output, err := helmTemplateStaticChart(t, tt.args...)
+			if err == nil {
+				t.Fatalf("helm template unexpectedly accepted unsupported provider proxy override:\n%s", output)
+			}
+			if !strings.Contains(output, tt.wantError) {
+				t.Fatalf("helm template error does not contain %q:\n%s", tt.wantError, output)
+			}
+		})
+	}
+}
+
+func TestStaticChartUsesRegisteredContextTokenTTSEndpointFlag(t *testing.T) {
+	rendered := requireHelmRender(t,
+		"--set-string", "controller.contextToken.tts.endpoint=https://tts.example.test/oauth/token",
+		"--show-only", "templates/deployment.yaml",
+	)
+
+	if !strings.Contains(rendered, "--context-token-tts-endpoint=https://tts.example.test/oauth/token") {
+		t.Fatalf("controller deployment is missing the registered TTS endpoint flag:\n%s", rendered)
+	}
+	if strings.Contains(rendered, "--context-token-tts-url=") {
+		t.Fatalf("controller deployment rendered the unregistered TTS URL flag:\n%s", rendered)
+	}
+}
+
+func TestStaticChartRendersByteLimitsAsDecimalIntegers(t *testing.T) {
+	publisher := requireHelmRender(t, "--show-only", "templates/publisher-deployment.yaml")
+	scmProxy := requireHelmRender(t, "--show-only", "templates/scm-egress-proxy-deployment.yaml")
+
+	if !strings.Contains(publisher, `value: "4194304"`) {
+		t.Fatalf("publisher deployment did not render max response bytes as a decimal integer:\n%s", publisher)
+	}
+	for _, want := range []string{
+		`--max-request-header-bytes=32768`,
+		`--max-response-header-bytes=65536`,
+		`--max-request-bytes=4194304`,
+		`--max-response-bytes=8388608`,
+		`--max-tunnel-bytes=1073741824`,
+	} {
+		if !strings.Contains(scmProxy, want) {
+			t.Fatalf("SCM proxy deployment is missing decimal byte limit %q:\n%s", want, scmProxy)
+		}
+	}
+	if strings.Contains(publisher, "e+") || strings.Contains(scmProxy, "e+") {
+		t.Fatalf("byte limit render used scientific notation:\npublisher:\n%s\nSCM proxy:\n%s", publisher, scmProxy)
+	}
+}
+
+func TestStaticChartAuthRolloutNoncesTargetOnlyCredentialConsumers(t *testing.T) {
+	args := []string{
+		"--set-string", "publisher.auth.rolloutNonce=publisher-v2",
+		"--set-string", "scmEgressProxy.auth.rolloutNonce=scm-v3",
+		"--set-string", "publisher.auth.controllerToken=publisher-secret-material",
+		"--set-string", "scmEgressProxy.auth.token=scm-secret-material-0123456789abcd",
+	}
+
+	controller := requireHelmRender(t, append(args, "--show-only", "templates/deployment.yaml")...)
+	publisher := requireHelmRender(t, append(args, "--show-only", "templates/publisher-deployment.yaml")...)
+	scmProxy := requireHelmRender(t, append(args, "--show-only", "templates/scm-egress-proxy-deployment.yaml")...)
+	providerProxy := requireHelmRender(t,
+		"--set", "providerProxy.enabled=true",
+		"--set-string", "publisher.auth.rolloutNonce=publisher-v2",
+		"--set-string", "scmEgressProxy.auth.rolloutNonce=scm-v3",
+		"--show-only", "templates/provider-proxy-deployment.yaml",
+	)
+
+	publisherNonce := `orka.ai/publisher-auth-rollout-nonce: "publisher-v2"`
+	scmNonce := `orka.ai/scm-egress-proxy-auth-rollout-nonce: "scm-v3"`
+	if !strings.Contains(controller, publisherNonce) || strings.Contains(controller, scmNonce) {
+		t.Fatalf("controller rollout annotations are incorrect:\n%s", controller)
+	}
+	if !strings.Contains(publisher, publisherNonce) || !strings.Contains(publisher, scmNonce) {
+		t.Fatalf("publisher rollout annotations are incorrect:\n%s", publisher)
+	}
+	if strings.Contains(scmProxy, publisherNonce) || !strings.Contains(scmProxy, scmNonce) {
+		t.Fatalf("SCM proxy rollout annotations are incorrect:\n%s", scmProxy)
+	}
+	if strings.Contains(providerProxy, publisherNonce) || strings.Contains(providerProxy, scmNonce) {
+		t.Fatalf("provider proxy received unrelated auth rollout annotations:\n%s", providerProxy)
+	}
+	for name, rendered := range map[string]string{
+		"controller": controller,
+		"publisher":  publisher,
+		"SCM proxy":  scmProxy,
+	} {
+		if strings.Contains(rendered, "secret-material") {
+			t.Fatalf("%s Pod template annotation render exposed Secret material", name)
+		}
+	}
+}
diff --git a/cmd/build/helmify/scm_egress_proxy_security_test.go b/cmd/build/helmify/scm_egress_proxy_security_test.go
new file mode 100644
index 000000000..db38a4db9
--- /dev/null
+++ b/cmd/build/helmify/scm_egress_proxy_security_test.go
@@ -0,0 +1,152 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	networkingv1 "k8s.io/api/networking/v1"
+	"sigs.k8s.io/yaml"
+)
+
+const serviceAccountAutomountDisabledMarker = "automountServiceAccountToken: false"
+
+func TestSCMEgressProxyStandaloneWorkloadHasNoKubernetesCredential(t *testing.T) {
+	root := filepath.Join("..", "..", "..", "config", "scm-egress-proxy")
+	deploymentManifest, err := os.ReadFile(filepath.Join(root, "deployment.yaml"))
+	if err != nil {
+		t.Fatalf("read SCM proxy Deployment: %v", err)
+	}
+	serviceAccountManifest, err := os.ReadFile(filepath.Join(root, "serviceaccount.yaml"))
+	if err != nil {
+		t.Fatalf("read SCM proxy ServiceAccount: %v", err)
+	}
+
+	var deployment appsv1.Deployment
+	if err := yaml.Unmarshal(deploymentManifest, &deployment); err != nil {
+		t.Fatalf("decode SCM proxy Deployment: %v", err)
+	}
+	assertSCMProxyPodCredentialIsolation(t, deployment.Spec.Template.Spec)
+	assertSCMProxyPodSecurityContext(t, deployment.Spec.Template.Spec)
+
+	var serviceAccount corev1.ServiceAccount
+	if err := yaml.Unmarshal(serviceAccountManifest, &serviceAccount); err != nil {
+		t.Fatalf("decode SCM proxy ServiceAccount: %v", err)
+	}
+	if serviceAccount.AutomountServiceAccountToken == nil || *serviceAccount.AutomountServiceAccountToken {
+		t.Fatal("SCM proxy ServiceAccount must disable token mounting")
+	}
+}
+
+func assertSCMProxyPodCredentialIsolation(t *testing.T, pod corev1.PodSpec) {
+	t.Helper()
+	if pod.AutomountServiceAccountToken == nil || *pod.AutomountServiceAccountToken {
+		t.Fatal("SCM proxy Pod must disable service-account token mounting")
+	}
+	if pod.EnableServiceLinks == nil || *pod.EnableServiceLinks {
+		t.Fatal("SCM proxy Pod must disable unnecessary service links")
+	}
+	for _, volume := range pod.Volumes {
+		if volume.Projected == nil {
+			continue
+		}
+		for _, source := range volume.Projected.Sources {
+			if source.ServiceAccountToken != nil {
+				t.Fatalf("SCM proxy Pod contains a projected Kubernetes credential volume %q", volume.Name)
+			}
+		}
+	}
+}
+
+func assertSCMProxyPodSecurityContext(t *testing.T, pod corev1.PodSpec) {
+	t.Helper()
+	if pod.SecurityContext == nil || pod.SecurityContext.RunAsNonRoot == nil ||
+		!*pod.SecurityContext.RunAsNonRoot || pod.SecurityContext.RunAsUser == nil ||
+		*pod.SecurityContext.RunAsUser != 65532 || pod.SecurityContext.SeccompProfile == nil ||
+		pod.SecurityContext.SeccompProfile.Type != corev1.SeccompProfileTypeRuntimeDefault {
+		t.Fatal("SCM proxy Pod must run as the non-root distroless user with runtime-default seccomp")
+	}
+	if len(pod.Containers) != 1 {
+		t.Fatalf("SCM proxy container count = %d, want 1", len(pod.Containers))
+	}
+	container := pod.Containers[0]
+	if container.SecurityContext == nil ||
+		container.SecurityContext.AllowPrivilegeEscalation == nil ||
+		*container.SecurityContext.AllowPrivilegeEscalation ||
+		container.SecurityContext.ReadOnlyRootFilesystem == nil ||
+		!*container.SecurityContext.ReadOnlyRootFilesystem {
+		t.Fatal("SCM proxy container must forbid privilege escalation and use a read-only root filesystem")
+	}
+	if container.SecurityContext.Capabilities == nil ||
+		len(container.SecurityContext.Capabilities.Drop) != 1 ||
+		container.SecurityContext.Capabilities.Drop[0] != corev1.Capability("ALL") {
+		t.Fatalf("SCM proxy dropped capabilities = %v, want [ALL]", container.SecurityContext.Capabilities)
+	}
+}
+
+func TestSCMEgressProxyStandaloneNetworkPolicyRetainsDirectPrivateAddressDefense(t *testing.T) {
+	manifestPath := filepath.Join("..", "..", "..", "config", "scm-egress-proxy", "networkpolicy.yaml")
+	manifest, err := os.ReadFile(manifestPath)
+	if err != nil {
+		t.Fatalf("read SCM proxy NetworkPolicy: %v", err)
+	}
+	var policy networkingv1.NetworkPolicy
+	if err := yaml.Unmarshal(manifest, &policy); err != nil {
+		t.Fatalf("decode SCM proxy NetworkPolicy: %v", err)
+	}
+
+	for _, rule := range policy.Spec.Egress {
+		for _, peer := range rule.To {
+			if peer.IPBlock == nil || peer.IPBlock.CIDR != "0.0.0.0/0" {
+				continue
+			}
+			exclusions := make(map[string]bool, len(peer.IPBlock.Except))
+			for _, exclusion := range peer.IPBlock.Except {
+				exclusions[exclusion] = true
+			}
+			for _, required := range []string{
+				"10.0.0.0/8",
+				"127.0.0.0/8",
+				"169.254.0.0/16",
+				"172.16.0.0/12",
+				"192.168.0.0/16",
+			} {
+				if !exclusions[required] {
+					t.Errorf("SCM proxy IPv4 egress exclusions are missing %s", required)
+				}
+			}
+			return
+		}
+	}
+	t.Fatal("SCM proxy NetworkPolicy is missing its public IPv4 egress block")
+}
+
+func TestStaticChartSCMEgressProxyWorkloadHasNoKubernetesCredential(t *testing.T) {
+	rendered := requireHelmRender(t, "--show-only", "templates/scm-egress-proxy-deployment.yaml")
+	for _, required := range []string{
+		serviceAccountAutomountDisabledMarker,
+		"enableServiceLinks: false",
+		"runAsNonRoot: true",
+		"readOnlyRootFilesystem: true",
+		"capabilities: {drop: [ALL]}",
+	} {
+		if !strings.Contains(rendered, required) {
+			t.Fatalf("SCM proxy Deployment is missing hardening marker %q:\n%s", required, rendered)
+		}
+	}
+	for _, forbidden := range []string{
+		"serviceAccountToken:",
+		"/var/run/secrets/kubernetes.io/serviceaccount",
+	} {
+		if strings.Contains(rendered, forbidden) {
+			t.Fatalf("SCM proxy Deployment contains Kubernetes credential surface %q:\n%s", forbidden, rendered)
+		}
+	}
+	serviceAccount := requireHelmRender(t, "--show-only", "templates/scm-egress-proxy-serviceaccount.yaml")
+	if !strings.Contains(serviceAccount, serviceAccountAutomountDisabledMarker) {
+		t.Fatalf("SCM proxy ServiceAccount permits token mounting:\n%s", serviceAccount)
+	}
+}
diff --git a/cmd/build/helmify/static/README.md b/cmd/build/helmify/static/README.md
index ef3c5a383..270dc54fd 100644
--- a/cmd/build/helmify/static/README.md
+++ b/cmd/build/helmify/static/README.md
@@ -2,33 +2,171 @@
 
 This chart is generated from `cmd/build/helmify`; edit the generator inputs and
 run `make manifests` rather than editing generated chart copies directly. It
-packages all thirteen canonical Orka CRDs under `crds/`.
+packages all 26 canonical Orka CRDs under `crds/`.
 
 ## Fresh install
 
-A normal install creates the CRDs before the templated release resources:
+A normal `harness-v2` install requires Vekil to be running in `vekil-system`,
+immutable controller and Publisher image digests, and two operator-managed
+Secrets. Prepare:
+
+- a snapshot key file containing exactly 32 random bytes;
+- a webhook serving certificate and private key whose certificate is valid for
+  `orka-webhook.orka-system.svc`, plus its PEM CA certificate; and
+- `CONTROLLER_DIGEST` and `PUBLISHER_DIGEST` values in
+  `sha256:<64 lowercase hexadecimal characters>` form.
+
+The following creates the namespace and required Secrets without putting key
+material in Helm values or command-line arguments, then installs the CRDs and
+release resources. Replace the file paths and digest placeholders first:
 
 ```bash
+set -euo pipefail
+
+: "${SNAPSHOT_KEY_FILE:?set SNAPSHOT_KEY_FILE to the 32-byte key file}"
+: "${WEBHOOK_CERT_FILE:?set WEBHOOK_CERT_FILE to the serving certificate}"
+: "${WEBHOOK_PRIVATE_KEY_FILE:?set WEBHOOK_PRIVATE_KEY_FILE to the private key}"
+: "${WEBHOOK_CA_FILE:?set WEBHOOK_CA_FILE to the CA certificate}"
+: "${CONTROLLER_DIGEST:?set CONTROLLER_DIGEST to sha256:<64 lowercase hex>}"
+: "${PUBLISHER_DIGEST:?set PUBLISHER_DIGEST to sha256:<64 lowercase hex>}"
+
+kubectl create -f - <<'EOF'
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: orka-system
+  labels:
+    orka.ai/controller-mode: harness-v2
+EOF
+kubectl -n orka-system create secret generic agent-execution-snapshot-key \
+  --from-file=snapshot-key="${SNAPSHOT_KEY_FILE}"
+kubectl -n orka-system create secret generic orka-webhook-tls \
+  --type=kubernetes.io/tls \
+  --from-file=tls.crt="${WEBHOOK_CERT_FILE}" \
+  --from-file=tls.key="${WEBHOOK_PRIVATE_KEY_FILE}" \
+  --from-file=ca.crt="${WEBHOOK_CA_FILE}"
+
+WEBHOOK_CA_BUNDLE="$(kubectl -n orka-system get secret orka-webhook-tls \
+  -o jsonpath='{.data.ca\.crt}')"
+
 helm install orka charts/orka \
   --namespace orka-system \
-  --create-namespace \
+  --set controller.mode=harness-v2 \
+  --set controller.watchNamespace=orka-system \
+  --set-string controller.image.digest="${CONTROLLER_DIGEST}" \
+  --set-string publisher.image.digest="${PUBLISHER_DIGEST}" \
+  --set-string controller.agentExecutionSnapshot.existingSecret=agent-execution-snapshot-key \
+  --set-string controller.agentExecutionSnapshot.key=snapshot-key \
+  --set-string webhooks.tls.existingSecret=orka-webhook-tls \
+  --set-string webhooks.caBundle="${WEBHOOK_CA_BUNDLE}" \
+  --set providerProxy.enabled=true \
   --wait
 ```
 
+The chart installs the exact cross-namespace ingress policy for Vekil. The
+chart-managed provider proxy itself always runs in the Helm release namespace. Leave
+`controller.acpRuntime.providerProxyNamespace` empty or set it to that release
+namespace. The only supported upstream is
+`http://vekil.vekil-system.svc:1337` (an optional trailing slash is normalized);
+alternate hosts, namespaces, and ports are rejected because the chart does not
+create matching NetworkPolicies.
+
+`service.port` is the controller Service port used by controller and Publisher Service URLs. `controller.apiPort` is only the controller container listener and Service target port.
+
+### SCM proxy NetworkPolicy portability boundary
+
+The SCM proxy NetworkPolicy excludes RFC 1918 and reserved address ranges, but
+Kubernetes does not define whether Service destination NAT runs before or
+after `ipBlock` evaluation. Some CNI and cloud combinations can therefore
+reach the `kubernetes.default` transport through its ClusterIP despite those
+exclusions. This does not grant API authorization: the SCM proxy Pod and
+ServiceAccount do not mount a service-account token, service links are disabled,
+Orka grants that identity no API RBAC, and the proxy refuses to start if the
+conventional Kubernetes service-account token path exists. The proxy itself
+accepts only exact configured SCM hostnames and rejects non-public DNS answers
+and connected peers. Clusters requiring TCP-level API denial must add and
+validate a CNI- or cloud-native pre-DNAT or Service-aware egress control;
+standard NetworkPolicy cannot guarantee this portably.
+
+### Coordinated authentication Secret rotation
+
+The Publisher and SCM egress proxy read their authentication material at process startup. Rotate each Secret and its non-secret rollout marker in the same Helm upgrade:
+
+- When rotating `publisher.auth.existingSecret` (or the chart-managed publisher auth values), bump `publisher.auth.rolloutNonce`. The marker is added only to the controller and Publisher Pod templates so both restart onto the same credential generation.
+- When rotating `scmEgressProxy.auth.existingSecret` (or the chart-managed SCM proxy token), bump `scmEgressProxy.auth.rolloutNonce`. The marker is added only to the Publisher and SCM proxy Pod templates.
+
+The nonce is a revision label, not a credential. Never put Secret content in it. A coordinated upgrade may briefly fail closed while Pods roll, but it avoids an indefinite split generation.
+
+The harness-v1 wrapper likewise keeps execution authority and transport
+material separate. `harnessV1.auth.existingSecret` contains only the bearer
+token and is immutable while v1 work exists. `harnessV1.tls.existingSecret`
+contains `tls.crt`, `tls.key`, and `ca.crt`. A TLS Secret name change is a
+wrapper Pod-template change and automatically uses the existing drained
+rollover. For same-name certificate renewal, update the TLS Secret and bump
+`harnessV1.tls.rolloutNonce` in the Helm upgrade; the hook drains the live
+wrapper before both wrapper and controller restart. Keep the updated `ca.crt`
+able to verify the certificate currently being served during that drain, or
+rotate to a versioned TLS Secret so the hook can mount the prior CA.
+
 CRDs are cluster-scoped and shared by every Orka release. Use `--skip-crds`
 only when a designated platform or GitOps workflow already manages compatible
 Orka CRDs for the cluster.
 
+## Static harness mode
+
+Every release selects exactly one controller mode: `harness-v1` or
+`harness-v2`. `dual`, `auto`, and `harness-v1-drain` are rejected. Each release
+also requires a distinct, non-empty `controller.watchNamespace` labeled with
+the matching mode:
+
+```bash
+kubectl create -f - <<'EOF'
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: orka-v2-system
+  labels:
+    orka.ai/controller-mode: harness-v2
+EOF
+
+helm install orka-v2 charts/orka \
+  --namespace orka-v2-system \
+  --set controller.mode=harness-v2 \
+  --set controller.watchNamespace=orka-v2-system
+```
+
+The mode is an installation identity, not an upgrade toggle. Never change a
+release from v1 to v2 in place or reuse its PVC, SQLite store, ledger, Session,
+or Task identities under the other mode.
+
+A v1 and v2 release may share a cluster only when their release/watch
+namespaces, Services, ServiceAccounts/RBAC, Leases, stores, Secrets, and
+data-plane resources are disjoint. The chart intentionally requires
+`controller.watchNamespace` to equal the Helm release namespace. The v2
+release must also have its own runtime namespace. Install the shared compatible
+CRDs and common admission resources through one designated owner; install the
+second release with `--skip-crds`.
+
 Controller Services, worker ServiceAccounts, and worker RBAC are scoped to the
 Helm release name. Run only one Orka controller release per namespace. If a
 cluster has multiple releases, every release (including the first) must use a
 cluster-unique release name or `fullnameOverride`, a separate controller
-namespace, and a distinct, non-empty `controller.watchNamespace`. Do not mix a
-cluster-wide watcher with namespace-scoped releases: gateway admission policies
-would overlap. All releases share the same cluster-scoped CRDs.
+namespace, and a distinct, non-empty `controller.watchNamespace`. Cluster-wide
+watchers are rejected. All releases share the same cluster-scoped CRDs, and
+cluster-scoped gateway/workspace ownership belongs only to the v2 release.
 
 ## Upgrade
 
+An in-place controller upgrade is supported only when the release namespace
+already carries the same static mode claim and any live controller declares
+that mode and watch namespace. A deleted controller can be recreated only
+under that retained same-mode namespace claim. A pre-static controller that
+implicitly enabled ACP is not a supported `harness-v2` upgrade source because
+its accepted attempts may lack the immutable execution authority required for
+recovery. Settle or retire that installation and install static `harness-v2`
+as a new release and namespace. The chart rejects missing, opposite-mode, and
+legacy identity before rendering upgrade resources.
+
 Helm installs files from `crds/` only during installation. It does not create or
 update them during `helm upgrade`, including when upgrading from an older Orka
 chart that installed no CRDs.
@@ -76,7 +214,7 @@ A matching Orka source checkout provides the same guarded flow as
 competing CRD apply workflows for the same cluster.
 
 If another system owns the CRDs, perform the CRD-first step through that system,
-wait for all thirteen CRDs to become `Established`, and then upgrade Orka.
+wait for all 26 CRDs to become `Established`, and then upgrade Orka.
 
 If a previous release was uninstalled, update its retained CRDs first and install
 the replacement release with `--skip-crds`.
diff --git a/cmd/build/helmify/static/templates/NOTES.txt b/cmd/build/helmify/static/templates/NOTES.txt
index 46f8b71ee..8bb052154 100644
--- a/cmd/build/helmify/static/templates/NOTES.txt
+++ b/cmd/build/helmify/static/templates/NOTES.txt
@@ -1,10 +1,10 @@
 Orka has been installed.
 
-Controller: {{ include "orka.fullname" . }}-controller
+Controller: {{ include "orka.controllerName" . }}
 Namespace:  {{ .Release.Namespace }}
 
 CRD lifecycle:
-  - A fresh install creates Orka's thirteen cluster-scoped CRDs unless --skip-crds is used.
+  - A fresh install creates Orka's 26 cluster-scoped CRDs unless --skip-crds is used.
   - Helm does not update CRDs during helm upgrade. Apply the CRDs from the exact
     target chart before upgrading the release.
   - helm uninstall retains the CRDs and all Orka custom resources.
@@ -15,7 +15,7 @@ Upgrade guidance: helm show readme <the same chart reference or archive>
 
 ⚠️  STORAGE WARNING: SQLite store is using ephemeral storage (emptyDir).
    Task results and session data will be LOST on pod restart.
-{{- if .Values.controller.gateway.enabled }}
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.controller.gateway.enabled }}
    Gateway acknowledgements, deduplication, and queued deliveries are also NOT durable.
 {{- end }}
    For production use, enable persistent storage:
@@ -25,7 +25,7 @@ Upgrade guidance: helm show readme <the same chart reference or archive>
 
 {{- else }}
 
-✅ SQLite store is using persistent storage (PVC: {{ include "orka.fullname" . }}-store).
+✅ SQLite store is using persistent storage (PVC: {{ include "orka.storeName" . }}).
    Data will survive pod restarts.
 
 {{- end }}
diff --git a/cmd/build/helmify/static/templates/_helpers.tpl b/cmd/build/helmify/static/templates/_helpers.tpl
index 7764f35bf..361e20266 100644
--- a/cmd/build/helmify/static/templates/_helpers.tpl
+++ b/cmd/build/helmify/static/templates/_helpers.tpl
@@ -79,30 +79,793 @@ suffix so long release names cannot collapse all trust tiers to one name.
 {{- end }}
 
 {{/*
-Create release-scoped harness-wrapper names while reserving room for suffixes
-that must remain valid DNS labels (notably the Service name).
+Create release-scoped harness v1 wrapper names while reserving room for the
+longest suffix so names remain valid DNS labels for long Helm release names.
 */}}
-{{- define "orka.harnessWrapperName" -}}
+{{- define "orka.harnessV1Name" -}}
 {{- printf "%s-agent-harness-wrapper" (include "orka.fullname" . | trunc 41 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
-{{- define "orka.harnessWrapperAuthSecretName" -}}
-{{- printf "%s-harness-wrapper-auth" (include "orka.fullname" . | trunc 42 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- define "orka.harnessV1LedgerName" -}}
+{{- printf "%s-harness-v1-ledger" (include "orka.fullname" . | trunc 45 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
+{{- define "orka.harnessV1DrainName" -}}
+{{- printf "%s-drain" (include "orka.harnessV1Name" . | trunc 57 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.harnessV1DrainEgressName" -}}
+{{- printf "%s-egress" (include "orka.harnessV1DrainName" . | trunc 56 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.harnessV1AbortName" -}}
+{{- printf "%s-abort" (include "orka.harnessV1Name" . | trunc 57 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.harnessV1AbortEgressName" -}}
+{{- printf "%s-egress" (include "orka.harnessV1AbortName" . | trunc 56 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.harnessV1DeleteDrainName" -}}
+{{- printf "%s-delete" (include "orka.harnessV1Name" . | trunc 56 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.harnessV1DeleteDrainEgressName" -}}
+{{- printf "%s-egress" (include "orka.harnessV1DeleteDrainName" . | trunc 56 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Render the complete harness v1 Pod template from one canonical helper. The
+ledger generation hashes this structure with a fixed sentinel in place of the
+generation itself, so only a real Pod-template change advances the generation.
+*/}}
+{{- define "orka.harnessV1PodTemplate" -}}
+{{- $root := .root -}}
+{{- $generation := .generation -}}
+metadata:
+  labels:
+    {{- include "orka.labels" $root | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper
+    orka.ai/network-role: harness-v1
+  {{- with $root.Values.harnessV1.tls.rolloutNonce }}
+  annotations:
+    orka.ai/harness-v1-tls-rollout-nonce: {{ . | quote }}
+  {{- end }}
+spec:
+  serviceAccountName: {{ include "orka.harnessV1Name" $root }}
+  automountServiceAccountToken: false
+  securityContext:
+    runAsUser: 0
+    runAsGroup: 0
+    seccompProfile:
+      type: RuntimeDefault
+  containers:
+    - name: wrapper
+      image: {{ include "orka.imageRef" $root.Values.harnessV1.image | quote }}
+      imagePullPolicy: {{ $root.Values.harnessV1.image.pullPolicy }}
+      ports:
+        - name: https
+          containerPort: 8080
+          protocol: TCP
+      env:
+        - name: ORKA_HARNESS_WRAPPER_RUNTIME
+          value: multi
+        - name: ORKA_HARNESS_WRAPPER_LISTEN_ADDR
+          value: :8080
+        - name: ORKA_CONTROLLER_URL
+          value: http://{{ include "orka.fullname" $root }}.{{ $root.Release.Namespace }}.svc:{{ $root.Values.service.port }}
+        - name: ORKA_HARNESS_WRAPPER_BEARER_TOKEN_FILE
+          value: /var/run/orka/harness-wrapper-auth/token
+        - name: ORKA_HARNESS_WRAPPER_TLS_CERT_FILE
+          value: /var/run/orka/harness-wrapper-tls/tls.crt
+        - name: ORKA_HARNESS_WRAPPER_TLS_KEY_FILE
+          value: /var/run/orka/harness-wrapper-tls/tls.key
+        - name: ORKA_HARNESS_WRAPPER_ADMISSION_LEDGER_PATH
+          value: /var/lib/orka/harness-v1/admission-ledger.db
+        - name: ORKA_HARNESS_WRAPPER_LEDGER_GENERATION
+          value: {{ $generation | quote }}
+        - name: ORKA_HARNESS_WRAPPER_LEDGER_RETENTION
+          value: {{ $root.Values.harnessV1.ledger.retention | quote }}
+        - name: ORKA_ALLOW_BASH
+          value: "true"
+        - name: ORKA_HARNESS_WRAPPER_CHILD_UID
+          value: "1000"
+        - name: ORKA_HARNESS_WRAPPER_CHILD_GID
+          value: "1000"
+        - name: ORKA_CODEX_SANDBOX_MODE
+          value: {{ $root.Values.harnessV1.codexSandboxMode | quote }}
+      volumeMounts:
+        - name: auth
+          mountPath: /var/run/orka/harness-wrapper-auth
+          readOnly: true
+        - name: tls
+          mountPath: /var/run/orka/harness-wrapper-tls
+          readOnly: true
+        - name: controller-api-token
+          mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+          readOnly: true
+        - name: ledger
+          mountPath: /var/lib/orka/harness-v1
+        - name: tmp
+          mountPath: /tmp
+      securityContext:
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+        runAsUser: 0
+        runAsGroup: 0
+        capabilities:
+          drop:
+            - ALL
+          add:
+            - SETUID
+            - SETGID
+            - CHOWN
+            - KILL
+            - FOWNER
+      livenessProbe:
+        httpGet:
+          path: /v1/health
+          port: https
+          scheme: HTTPS
+        initialDelaySeconds: 10
+        periodSeconds: 20
+      readinessProbe:
+        httpGet:
+          path: /v1/ready
+          port: https
+          scheme: HTTPS
+        initialDelaySeconds: 5
+        periodSeconds: 10
+      {{- with $root.Values.harnessV1.resources }}
+      resources:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+  volumes:
+    - name: auth
+      secret:
+        secretName: {{ $root.Values.harnessV1.auth.existingSecret | quote }}
+        defaultMode: 0400
+        items:
+          - key: {{ $root.Values.harnessV1.auth.tokenKey | quote }}
+            path: token
+    - name: tls
+      secret:
+        secretName: {{ $root.Values.harnessV1.tls.existingSecret | quote }}
+        defaultMode: 0400
+        items:
+          - key: tls.crt
+            path: tls.crt
+          - key: tls.key
+            path: tls.key
+          - key: ca.crt
+            path: ca.crt
+    - name: controller-api-token
+      projected:
+        defaultMode: 0400
+        sources:
+          - serviceAccountToken:
+              path: token
+              expirationSeconds: 3600
+    - name: ledger
+      persistentVolumeClaim:
+        claimName: {{ include "orka.harnessV1LedgerName" $root }}
+    - name: tmp
+      emptyDir: {}
+{{- end }}
+
+{{- define "orka.harnessV1PodTemplateGeneration" -}}
+{{- $template := include "orka.harnessV1PodTemplate" (dict "root" . "generation" "ORKA_HARNESS_V1_TEMPLATE_GENERATION") | fromYaml -}}
+{{- toJson $template | sha256sum -}}
+{{- end }}
+
+{{/* Read the live wrapper inputs used by rollover hooks. */}}
+{{- define "orka.harnessV1ExistingImage" -}}
+{{- $image := "" -}}
+{{- range (dig "spec" "template" "spec" "containers" (list) .) -}}
+{{- if eq (default "" .name) "wrapper" -}}
+{{- $image = default "" .image -}}
+{{- end -}}
+{{- end -}}
+{{- required "existing harness v1 wrapper Deployment is missing the wrapper image" $image -}}
+{{- end }}
+
+{{- define "orka.harnessV1ExistingImagePullPolicy" -}}
+{{- $pullPolicy := "IfNotPresent" -}}
+{{- range (dig "spec" "template" "spec" "containers" (list) .) -}}
+{{- if eq (default "" .name) "wrapper" -}}
+{{- $pullPolicy = default "IfNotPresent" .imagePullPolicy -}}
+{{- end -}}
+{{- end -}}
+{{- $pullPolicy -}}
+{{- end }}
+
+{{- define "orka.harnessV1ExistingGeneration" -}}
+{{- $generation := "" -}}
+{{- range (dig "spec" "template" "spec" "containers" (list) .) -}}
+{{- if eq (default "" .name) "wrapper" -}}
+{{- range (default (list) .env) -}}
+{{- if eq (default "" .name) "ORKA_HARNESS_WRAPPER_LEDGER_GENERATION" -}}
+{{- $generation = default "" .value -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- $generation -}}
+{{- end }}
+
+{{- define "orka.harnessV1ExistingAuthSecretName" -}}
+{{- $secretName := "" -}}
+{{- range (dig "spec" "template" "spec" "volumes" (list) .) -}}
+{{- if eq (default "" .name) "auth" -}}
+{{- $secretName = dig "secret" "secretName" "" . -}}
+{{- end -}}
+{{- end -}}
+{{- required "existing harness v1 wrapper Deployment is missing the auth Secret name" $secretName -}}
+{{- end }}
+
+{{- define "orka.harnessV1ExistingAuthSecretKey" -}}
+{{- $secretKey := "" -}}
+{{- range (dig "spec" "template" "spec" "volumes" (list) .) -}}
+{{- if eq (default "" .name) "auth" -}}
+{{- range (dig "secret" "items" (list) .) -}}
+{{- if eq (default "" .path) "token" -}}
+{{- $secretKey = default "" .key -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- required "existing harness v1 wrapper Deployment is missing the auth Secret token key" $secretKey -}}
+{{- end }}
+
+{{- define "orka.harnessV1ExistingTLSSecretName" -}}
+{{- $secretName := "" -}}
+{{- $legacyAuthSecretName := "" -}}
+{{- range (dig "spec" "template" "spec" "volumes" (list) .) -}}
+{{- if eq (default "" .name) "tls" -}}
+{{- $secretName = dig "secret" "secretName" "" . -}}
+{{- else if eq (default "" .name) "auth" -}}
+{{- $legacyAuthSecretName = dig "secret" "secretName" "" . -}}
+{{- end -}}
+{{- end -}}
+{{- if not $secretName -}}
+{{- $secretName = $legacyAuthSecretName -}}
+{{- end -}}
+{{- required "existing harness v1 wrapper Deployment is missing the TLS Secret name" $secretName -}}
+{{- end }}
+
+{{/* Read the live controller's exact namespace watch scope. */}}
+{{- define "orka.existingControllerWatchNamespace" -}}
+{{- $watchNamespaces := list -}}
+{{- range (dig "spec" "template" "spec" "containers" (list) .) -}}
+{{- if eq (default "" .name) "controller" -}}
+{{- range (default (list) .args) -}}
+{{- $arg := toString . -}}
+{{- if hasPrefix "--watch-namespace=" $arg -}}
+{{- $watchNamespaces = append $watchNamespaces (trimPrefix "--watch-namespace=" $arg) -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- if eq (len $watchNamespaces) 1 -}}
+{{- index $watchNamespaces 0 -}}
+{{- end -}}
+{{- end }}
+
+{{/* Read the exact chart fullname from the live controller's in-cluster URL. */}}
+{{- define "orka.existingControllerFullname" -}}
+{{- $fullnames := list -}}
+{{- $namespaceSuffix := printf ".%s.svc" .namespace -}}
+{{- range (dig "spec" "template" "spec" "containers" (list) .controller) -}}
+{{- if eq (default "" .name) "controller" -}}
+{{- range (default (list) .args) -}}
+{{- $arg := toString . -}}
+{{- if hasPrefix "--controller-url=http://" $arg -}}
+{{- $endpoint := trimPrefix "--controller-url=http://" $arg -}}
+{{- $hostPort := first (splitList "/" $endpoint) -}}
+{{- $host := first (splitList ":" $hostPort) -}}
+{{- if hasSuffix $namespaceSuffix $host -}}
+{{- $fullname := trimSuffix $namespaceSuffix $host -}}
+{{- if and $fullname (not (contains "." $fullname)) -}}
+{{- $fullnames = append $fullnames $fullname -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- if eq (len $fullnames) 1 -}}
+{{- index $fullnames 0 -}}
+{{- end -}}
+{{- end }}
+
+{{/* Read the live controller's exact ACP runtime namespace. */}}
+{{- define "orka.existingControllerACPRuntimeNamespace" -}}
+{{- $runtimeNamespaces := list -}}
+{{- range (dig "spec" "template" "spec" "containers" (list) .) -}}
+{{- if eq (default "" .name) "controller" -}}
+{{- range (default (list) .args) -}}
+{{- $arg := toString . -}}
+{{- if hasPrefix "--acp-runtime-namespace=" $arg -}}
+{{- $runtimeNamespaces = append $runtimeNamespaces (trimPrefix "--acp-runtime-namespace=" $arg) -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- if eq (len $runtimeNamespaces) 1 -}}
+{{- index $runtimeNamespaces 0 -}}
+{{- end -}}
+{{- end }}
+
+{{/* Read the live controller's exact static mode. Legacy controllers return empty. */}}
+{{- define "orka.existingControllerMode" -}}
+{{- $modes := list -}}
+{{- range (dig "spec" "template" "spec" "containers" (list) .) -}}
+{{- if eq (default "" .name) "controller" -}}
+{{- range (default (list) .args) -}}
+{{- $arg := toString . -}}
+{{- if hasPrefix "--controller-mode=" $arg -}}
+{{- $modes = append $modes (trimPrefix "--controller-mode=" $arg) -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- if eq (len $modes) 1 -}}
+{{- $mode := index $modes 0 -}}
+{{- if has $mode (list "harness-v1" "harness-v2") -}}
+{{- $mode -}}
+{{- end -}}
+{{- end -}}
+{{- end }}
+
+{{/* Read the live controller's exact agent-execution snapshot Secret name. */}}
+{{- define "orka.existingControllerAgentExecutionSnapshotSecretName" -}}
+{{- $volumes := list -}}
+{{- range (dig "spec" "template" "spec" "volumes" (list) .) -}}
+{{- if eq (default "" .name) "agent-execution-snapshot-key" -}}
+{{- $volumes = append $volumes . -}}
+{{- end -}}
+{{- end -}}
+{{- if eq (len $volumes) 1 -}}
+{{- dig "secret" "secretName" "" (index $volumes 0) -}}
+{{- end -}}
+{{- end }}
+
+{{/* Read the live controller's exact snapshot Secret item mounted as key. */}}
+{{- define "orka.existingControllerAgentExecutionSnapshotSecretKey" -}}
+{{- $volumes := list -}}
+{{- range (dig "spec" "template" "spec" "volumes" (list) .) -}}
+{{- if eq (default "" .name) "agent-execution-snapshot-key" -}}
+{{- $volumes = append $volumes . -}}
+{{- end -}}
+{{- end -}}
+{{- if eq (len $volumes) 1 -}}
+{{- $keys := list -}}
+{{- range (dig "secret" "items" (list) (index $volumes 0)) -}}
+{{- if eq (default "" .path) "key" -}}
+{{- $keys = append $keys (default "" .key) -}}
+{{- end -}}
+{{- end -}}
+{{- if eq (len $keys) 1 -}}
+{{- index $keys 0 -}}
+{{- end -}}
+{{- end -}}
+{{- end }}
+
+{{/* Read the live controller inputs used when the wrapper Deployment is absent. */}}
+{{- define "orka.harnessV1ExistingControllerState" -}}
+{{- $state := "" -}}
+{{- $mode := "" -}}
+{{- $harnessMarker := false -}}
+{{- $harnessEnabled := false -}}
+{{- $harnessDisabled := false -}}
+{{- $acpEnabled := false -}}
+{{- $acpDisabled := false -}}
+{{- $dualMarker := false -}}
+{{- range (dig "spec" "template" "spec" "containers" (list) .) -}}
+{{- if eq (default "" .name) "controller" -}}
+{{- range (default (list) .args) -}}
+{{- $arg := toString . -}}
+{{- if hasPrefix "--controller-mode=" $arg -}}
+{{- $mode = trimPrefix "--controller-mode=" $arg -}}
+{{- end -}}
+{{- if hasPrefix "--harness-v1-enabled=" $arg -}}
+{{- $harnessMarker = true -}}
+{{- end -}}
+{{- if eq $arg "--harness-v1-enabled=true" -}}
+{{- $harnessEnabled = true -}}
+{{- else if eq $arg "--harness-v1-enabled=false" -}}
+{{- $harnessDisabled = true -}}
+{{- else if eq $arg "--acp-runtime-enabled=true" -}}
+{{- $acpEnabled = true -}}
+{{- else if eq $arg "--acp-runtime-enabled=false" -}}
+{{- $acpDisabled = true -}}
+{{- else if hasPrefix "--agent-execution-" $arg -}}
+{{- $dualMarker = true -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- if eq $mode "harness-v1" -}}
+{{- $state = "enabled" -}}
+{{- else if eq $mode "harness-v2" -}}
+{{- $state = "disabled" -}}
+{{- else if and $harnessEnabled (not $harnessDisabled) -}}
+{{- $state = "enabled" -}}
+{{- else if and $harnessDisabled (not $harnessEnabled) -}}
+{{- $state = "disabled" -}}
+{{- else if and (not $harnessMarker) (not $dualMarker) (ne $acpEnabled $acpDisabled) -}}
+{{- $state = "legacy-v2-disabled" -}}
+{{- end -}}
+{{- $state -}}
+{{- end }}
+
+{{- define "orka.harnessV1ExistingControllerAuthSecretName" -}}
+{{- $secretName := "" -}}
+{{- $prefix := "--harness-v1-auth-secret-name=" -}}
+{{- range (dig "spec" "template" "spec" "containers" (list) .) -}}
+{{- if eq (default "" .name) "controller" -}}
+{{- range (default (list) .args) -}}
+{{- $arg := toString . -}}
+{{- if hasPrefix $prefix $arg -}}
+{{- $secretName = trimPrefix $prefix $arg -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- required "existing harness v1 controller Deployment is missing the auth Secret name" $secretName -}}
+{{- end }}
+
+{{- define "orka.harnessV1ExistingControllerAuthSecretKey" -}}
+{{- $secretKey := "" -}}
+{{- $prefix := "--harness-v1-auth-secret-key=" -}}
+{{- range (dig "spec" "template" "spec" "containers" (list) .) -}}
+{{- if eq (default "" .name) "controller" -}}
+{{- range (default (list) .args) -}}
+{{- $arg := toString . -}}
+{{- if hasPrefix $prefix $arg -}}
+{{- $secretKey = trimPrefix $prefix $arg -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- required "existing harness v1 controller Deployment is missing the auth Secret token key" $secretKey -}}
+{{- end }}
+
+{{- define "orka.controllerName" -}}
+{{- printf "%s-controller" (include "orka.fullname" . | trunc 52 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.controllerWebhookServiceName" -}}
+{{- printf "%s-webhook" (include "orka.fullname" . | trunc 55 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/* Keep legacy short names, but hash any identity controllerName truncates. */}}
+{{- define "orka.controllerWebhookName" -}}
+{{- $fullname := include "orka.fullname" . -}}
+{{- if le (len $fullname) 52 -}}
+{{- include "orka.controllerName" . -}}
+{{- else -}}
+{{- $identity := printf "%s/%s/%s/%s/%s" .Release.Namespace .Release.Name (default "" .Values.fullnameOverride) (default "" .Values.nameOverride) .Chart.Name -}}
+{{- printf "%s-controller-%s" ($fullname | trunc 39 | trimSuffix "-") (sha256sum $identity | trunc 12) | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end }}
+
+{{- define "orka.controllerClusterRoleName" -}}
+{{- printf "%s-cluster" (include "orka.controllerWebhookName" .) -}}
+{{- end }}
+
+{{- define "orka.controllerUsername" -}}
+{{- printf "system:serviceaccount:%s:%s" .Release.Namespace (include "orka.serviceAccountName" .) -}}
+{{- end }}
+
+{{- define "orka.publisherName" -}}
+{{- printf "%s-workspace-publisher" (include "orka.fullname" . | trunc 43 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.publisherAuthSecretName" -}}
+{{- printf "%s-workspace-publisher-auth" (include "orka.fullname" . | trunc 38 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.acpArtifactSecretName" -}}
+{{- printf "%s-acp-artifact-capability" (include "orka.fullname" . | trunc 39 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.providerProxyName" -}}
+{{- printf "%s-provider-auth-proxy" (include "orka.fullname" . | trunc 43 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.scmEgressProxyName" -}}
+{{- printf "%s-scm-egress-proxy" (include "orka.fullname" . | trunc 46 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.scmEgressProxyAuthSecretName" -}}
+{{- printf "%s-scm-egress-proxy-auth" (include "orka.fullname" . | trunc 41 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.storeName" -}}
+{{- printf "%s-store" (include "orka.fullname" . | trunc 57 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.vekilIngressPolicyName" -}}
+{{- printf "%s-vekil-ingress" (include "orka.fullname" . | trunc 49 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create the name of the workspace publisher ServiceAccount to use.
+*/}}
+{{- define "orka.publisherServiceAccountName" -}}
+{{- if .Values.publisher.serviceAccount.create }}
+{{- default (include "orka.publisherName" .) .Values.publisher.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.publisher.serviceAccount.name }}
+{{- end }}
+{{- end }}
 
 {{/*
-Create the namespace for the chart-managed client ServiceAccount.
-When namespace isolation is enforced and the controller watches one namespace,
-place the default client in that namespace so its token remains usable.
+Reject mutable ACP runtime image references when a provider image is configured.
+An empty provider image leaves that provider unavailable; Tasks still fail closed
+because the ACP runtime remains enabled and has no legacy fallback.
+*/}}
+{{- define "orka.validateACPRuntimeImage" -}}
+{{- $name := .name -}}
+{{- $ref := default "" .ref -}}
+{{- if and $ref (not (regexMatch "^.+@sha256:[0-9a-f]{64}$" $ref)) -}}
+{{- fail (printf "%s must be an immutable image reference ending in @sha256:<64 lowercase hex characters>; got %q" $name $ref) -}}
+{{- end -}}
+{{- end }}
+
+{{/*
+The chart-managed provider proxy is release-namespaced and its NetworkPolicies
+are intentionally pinned to the chart-supported Vekil Service.
+*/}}
+{{- define "orka.validateProviderProxyConfig" -}}
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.providerProxy.enabled -}}
+{{- $configuredNamespace := trim (default "" .Values.controller.acpRuntime.providerProxyNamespace) -}}
+{{- if and $configuredNamespace (ne $configuredNamespace .Release.Namespace) -}}
+{{- fail (printf "controller.acpRuntime.providerProxyNamespace must be empty or match the Helm release namespace %q when providerProxy.enabled=true" .Release.Namespace) -}}
+{{- end -}}
+{{- $upstream := trimSuffix "/" (trim (default "" .Values.providerProxy.upstreamBaseURL)) -}}
+{{- if ne $upstream "http://vekil.vekil-system.svc:1337" -}}
+{{- fail "providerProxy.upstreamBaseURL must be http://vekil.vekil-system.svc:1337 (an optional trailing slash is accepted)" -}}
+{{- end -}}
+{{- end -}}
+{{- end }}
+
+{{/*
+The controller uses a process-local SQLite store, so production deployments
+must have exactly one elected writer and must not overlap Pods during rollout.
+*/}}
+{{- define "orka.validateSQLiteController" -}}
+{{- if ne (int .Values.controller.replicas) 1 -}}
+{{- fail "controller.replicas must be exactly 1 when using the SQLite store backend" -}}
+{{- end -}}
+{{- if not .Values.controller.leaderElect -}}
+{{- fail "controller.leaderElect must be true when using the SQLite store backend" -}}
+{{- end -}}
+{{- end }}
+
+{{/*
+Every release owns exactly one immutable execution contract and one tenant
+namespace. There is no dual, automatic, or drain controller mode.
+*/}}
+{{- define "orka.validateControllerMode" -}}
+{{- if not (has .Values.controller.mode (list "harness-v1" "harness-v2")) -}}
+{{- fail "controller.mode must be harness-v1 or harness-v2" -}}
+{{- end -}}
+{{- if not (trim (default "" .Values.controller.watchNamespace)) -}}
+{{- fail "controller.watchNamespace is required for an isolated controller installation" -}}
+{{- end -}}
+{{- if ne .Values.controller.watchNamespace .Release.Namespace -}}
+{{- fail (printf "controller.watchNamespace must equal the Helm release namespace %q" .Release.Namespace) -}}
+{{- end -}}
+{{- if not .Values.controller.leaderElect -}}
+{{- fail "controller.leaderElect must be true for an isolated controller installation" -}}
+{{- end -}}
+{{- if .Release.IsUpgrade -}}
+{{- $existingNamespace := lookup "v1" "Namespace" "" .Release.Namespace -}}
+{{- $existingNamespaceMode := "" -}}
+{{- if $existingNamespace -}}
+{{- $existingNamespaceMode = dig "metadata" "labels" "orka.ai/controller-mode" "" $existingNamespace -}}
+{{- end -}}
+{{- if ne $existingNamespaceMode .Values.controller.mode -}}
+{{- fail (printf "controller mode identity is missing or incompatible; namespace %q must already claim orka.ai/controller-mode=%s before this release can be upgraded" .Release.Namespace .Values.controller.mode) -}}
+{{- end -}}
+{{- $root := . -}}
+{{- $existingControllerList := lookup "apps/v1" "Deployment" .Release.Namespace "" -}}
+{{- $existingControllers := list -}}
+{{- range (dig "items" (list) (default (dict) $existingControllerList)) -}}
+{{- $labels := dig "metadata" "labels" (dict) . -}}
+{{- if and (eq (get $labels "app.kubernetes.io/instance") $root.Release.Name) (eq (get $labels "app.kubernetes.io/component") "controller") (eq (get $labels "app.kubernetes.io/managed-by") $root.Release.Service) -}}
+{{- $existingControllers = append $existingControllers . -}}
+{{- end -}}
+{{- end -}}
+{{- if gt (len $existingControllers) 1 -}}
+{{- fail (printf "multiple controller Deployments are owned by Helm release %q in namespace %q; restore a single controller before upgrading" .Release.Name .Release.Namespace) -}}
+{{- end -}}
+{{- $existingController := dict -}}
+{{- if eq (len $existingControllers) 1 -}}
+{{- $existingController = index $existingControllers 0 -}}
+{{- end -}}
+{{- if $existingController -}}
+{{- $existingWatchNamespace := include "orka.existingControllerWatchNamespace" $existingController | trim -}}
+{{- if ne $existingWatchNamespace .Values.controller.watchNamespace -}}
+{{- fail (printf "controller.watchNamespace is immutable; the existing controller must already watch namespace %q; install cluster-wide or differently scoped controllers as a new release and namespace" .Values.controller.watchNamespace) -}}
+{{- end -}}
+{{- $existingMode := include "orka.existingControllerMode" $existingController | trim -}}
+{{- $existingState := include "orka.harnessV1ExistingControllerState" $existingController | trim -}}
+{{- if $existingMode -}}
+{{- if ne $existingMode .Values.controller.mode -}}
+{{- fail (printf "controller.mode is immutable; install %s as a new release and namespace" .Values.controller.mode) -}}
+{{- end -}}
+{{- else if eq .Values.controller.mode "harness-v2" -}}
+{{- fail "implicit or legacy harness-v2 installations cannot upgrade in place; settle or retire the existing installation and install harness-v2 as a new release and namespace" -}}
+{{- else if ne $existingState "enabled" -}}
+{{- fail "controller.mode is immutable; install harness-v1 as a new release and namespace" -}}
+{{- end -}}
+{{- $existingSnapshotSecret := include "orka.existingControllerAgentExecutionSnapshotSecretName" $existingController | trim -}}
+{{- if not $existingSnapshotSecret -}}
+{{- fail "cannot determine the existing agent execution snapshot Secret name from the live controller; restore its exact agent-execution-snapshot-key volume before upgrading" -}}
+{{- end -}}
+{{- $desiredSnapshotSecret := trim (default "" .Values.controller.agentExecutionSnapshot.existingSecret) -}}
+{{- if ne $existingSnapshotSecret $desiredSnapshotSecret -}}
+{{- fail (printf "controller.agentExecutionSnapshot.existingSecret is immutable for in-place upgrades; preserve %q so retained encrypted execution snapshots remain decryptable" $existingSnapshotSecret) -}}
+{{- end -}}
+{{- $existingSnapshotKey := include "orka.existingControllerAgentExecutionSnapshotSecretKey" $existingController | trim -}}
+{{- if not $existingSnapshotKey -}}
+{{- fail "cannot determine the existing agent execution snapshot Secret key from the live controller; restore its exact item mounted at path key before upgrading" -}}
+{{- end -}}
+{{- $desiredSnapshotKey := trim (default "" .Values.controller.agentExecutionSnapshot.key) -}}
+{{- if ne $existingSnapshotKey $desiredSnapshotKey -}}
+{{- fail (printf "controller.agentExecutionSnapshot.key is immutable for in-place upgrades; preserve %q so retained encrypted execution snapshots remain decryptable" $existingSnapshotKey) -}}
+{{- end -}}
+{{- if eq .Values.controller.mode "harness-v2" -}}
+{{- $existingFullname := include "orka.existingControllerFullname" (dict "controller" $existingController "namespace" .Release.Namespace) | trim -}}
+{{- if not $existingFullname -}}
+{{- fail "cannot determine the existing harness-v2 chart fullname from the live controller; restore its exact --controller-url argument before upgrading" -}}
+{{- end -}}
+{{- $desiredFullname := include "orka.fullname" . -}}
+{{- if ne $existingFullname $desiredFullname -}}
+{{- fail (printf "the effective chart fullname is immutable for harness-v2 upgrades; the existing controller uses %q, but this upgrade would use %q" $existingFullname $desiredFullname) -}}
+{{- end -}}
+{{- $existingRuntimeNamespace := include "orka.existingControllerACPRuntimeNamespace" $existingController | trim -}}
+{{- if not $existingRuntimeNamespace -}}
+{{- fail "cannot determine the existing harness-v2 ACP runtime namespace; restore its exact --acp-runtime-namespace argument before upgrading" -}}
+{{- end -}}
+{{- if ne $existingRuntimeNamespace .Values.controller.acpRuntime.namespace -}}
+{{- fail (printf "controller.acpRuntime.namespace is immutable; the existing controller uses namespace %q" $existingRuntimeNamespace) -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- $clientNamespace := trim (default "" .Values.client.namespace) -}}
+{{- if and $clientNamespace (ne $clientNamespace .Values.controller.watchNamespace) -}}
+{{- fail "client.namespace must be empty or match controller.watchNamespace" -}}
+{{- end -}}
+{{- if eq .Values.controller.mode "harness-v2" -}}
+{{- if not (trim (default "" .Values.controller.acpRuntime.namespace)) -}}
+{{- fail "controller.acpRuntime.namespace is required when controller.mode=harness-v2" -}}
+{{- end -}}
+{{- if eq .Values.controller.acpRuntime.namespace .Release.Namespace -}}
+{{- fail "controller.acpRuntime.namespace must differ from the release namespace" -}}
+{{- end -}}
+{{- end -}}
+{{- end }}
+
+{{/*
+Agent execution snapshots contain sensitive resolved inputs. When either
+agent protocol is enabled, require an operator-managed Secret for their
+encryption key rather than generating or storing the key in Helm values.
+*/}}
+{{- define "orka.validateAgentExecutionSnapshot" -}}
+{{- if not (trim (default "" .Values.controller.agentExecutionSnapshot.existingSecret)) -}}
+{{- fail "controller.agentExecutionSnapshot.existingSecret is required when agent execution is enabled" -}}
+{{- end -}}
+{{- if not (trim (default "" .Values.controller.agentExecutionSnapshot.key)) -}}
+{{- fail "controller.agentExecutionSnapshot.key is required when agent execution is enabled" -}}
+{{- end -}}
+{{- end }}
+
+{{/*
+The release-local controller serves its own fail-closed webhooks. Its
+certificate and CA trust are always operator-managed.
+*/}}
+{{- define "orka.validateWebhooks" -}}
+{{- if not (trim (default "" .Values.webhooks.tls.existingSecret)) -}}
+{{- fail "webhooks.tls.existingSecret is required" -}}
+{{- end -}}
+{{- if not (trim (default "" .Values.webhooks.tls.certKey)) -}}
+{{- fail "webhooks.tls.certKey is required" -}}
+{{- end -}}
+{{- if not (trim (default "" .Values.webhooks.tls.privateKeyKey)) -}}
+{{- fail "webhooks.tls.privateKeyKey is required" -}}
+{{- end -}}
+{{- if and (not (trim (default "" .Values.webhooks.caBundle))) (empty .Values.webhooks.caInjectionAnnotations) -}}
+{{- fail "webhooks requires a nonempty caBundle or caInjectionAnnotations" -}}
+{{- end -}}
+{{- if or (lt (int .Values.webhooks.timeoutSeconds) 1) (gt (int .Values.webhooks.timeoutSeconds) 30) -}}
+{{- fail "webhooks.timeoutSeconds must be between 1 and 30" -}}
+{{- end -}}
+{{- end }}
+
+{{/*
+Harness v1 is an explicitly selected compatibility data plane. Its image must
+be immutable, its admission ledger durable, and its bearer credential must
+remain outside rendered Helm manifests.
+*/}}
+{{- define "orka.validateHarnessV1" -}}
+{{- if eq .Values.controller.mode "harness-v1" -}}
+{{- if .Values.controller.agentSandbox.enabled -}}
+{{- fail "controller.agentSandbox.enabled is unsupported when controller.mode=harness-v1; Agent Sandbox requires harness-v2" -}}
+{{- end -}}
+{{- if .Values.controller.substrate.enabled -}}
+{{- fail "controller.substrate.enabled is unsupported when controller.mode=harness-v1; Substrate requires harness-v2" -}}
+{{- end -}}
+{{- if not (trim (default "" .Values.harnessV1.image.repository)) -}}
+{{- fail "harnessV1.image.repository is required when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if not (regexMatch "^sha256:[0-9a-f]{64}$" (.Values.harnessV1.image.digest | default "")) -}}
+{{- fail "harnessV1.image.digest must be a sha256 digest when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if trim (default "" .Values.harnessV1.auth.token) -}}
+{{- fail "harnessV1.auth.token is unsupported; create a Kubernetes Secret and set harnessV1.auth.existingSecret" -}}
+{{- end -}}
+{{- if not (trim (default "" .Values.harnessV1.auth.existingSecret)) -}}
+{{- fail "harnessV1.auth.existingSecret is required when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if not (trim (default "" .Values.harnessV1.auth.tokenKey)) -}}
+{{- fail "harnessV1.auth.tokenKey is required when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if not (trim (default "" .Values.harnessV1.tls.existingSecret)) -}}
+{{- fail "harnessV1.tls.existingSecret is required when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if eq (trim .Values.harnessV1.auth.existingSecret) (trim .Values.harnessV1.tls.existingSecret) -}}
+{{- fail "harnessV1.tls.existingSecret must differ from harnessV1.auth.existingSecret" -}}
+{{- end -}}
+{{- if not (trim (default "" .Values.harnessV1.ledger.size)) -}}
+{{- fail "harnessV1.ledger.size is required when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if not (trim (default "" .Values.harnessV1.ledger.retention)) -}}
+{{- fail "harnessV1.ledger.retention is required when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if not (regexMatch "^([1-9][0-9]*(ns|us|µs|ms|s|m|h))+$" (trim (default "" .Values.harnessV1.ledger.retention))) -}}
+{{- fail "harnessV1.ledger.retention must be a positive Go duration when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if not .Values.store.persistence.enabled -}}
+{{- fail "store.persistence.enabled must be true when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if not (trim (default "" .Values.harnessV1.dispatch.interval)) -}}
+{{- fail "harnessV1.dispatch.interval is required when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if ne (int .Values.harnessV1.dispatch.workers) 1 -}}
+{{- fail "harnessV1.dispatch.workers must be exactly 1 when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if not (regexMatch "^([1-9][0-9]*(ns|us|µs|ms|s|m|h))+$" (trim (default "" .Values.harnessV1.upgradeDrain.timeout))) -}}
+{{- fail "harnessV1.upgradeDrain.timeout must be a positive Go duration when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if not (regexMatch "^([1-9][0-9]*(ns|us|µs|ms|s|m|h))+$" (trim (default "" .Values.harnessV1.upgradeDrain.pollInterval))) -}}
+{{- fail "harnessV1.upgradeDrain.pollInterval must be a positive Go duration when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- $sandboxMode := trim (default "" .Values.harnessV1.codexSandboxMode) -}}
+{{- if and $sandboxMode (not (has $sandboxMode (list "read-only" "workspace-write" "danger-full-access"))) -}}
+{{- fail "harnessV1.codexSandboxMode must be read-only, workspace-write, or danger-full-access" -}}
+{{- end -}}
+{{- end -}}
+{{- end }}
+
+{{- define "orka.providerProxyUpstreamBaseURL" -}}
+{{- trimSuffix "/" (trim (default "" .Values.providerProxy.upstreamBaseURL)) -}}
+{{- end }}
+
+
+{{/*
+Create the namespace for the chart-managed client ServiceAccount. Static
+installations always place the client in the watched namespace.
 */}}
 {{- define "orka.clientNamespace" -}}
 {{- if .Values.client.namespace }}
 {{- .Values.client.namespace }}
-{{- else if and .Values.controller.enforceNamespaceIsolation .Values.controller.watchNamespace }}
-{{- .Values.controller.watchNamespace }}
 {{- else }}
-{{- .Release.Namespace }}
+{{- .Values.controller.watchNamespace }}
 {{- end }}
 {{- end }}
 
@@ -122,16 +885,25 @@ Create release-scoped worker ClusterRole names.
 {{- end }}
 
 {{/*
-Create release-scoped static worker ClusterRoleBinding names.
+Create release-scoped static worker RoleBinding names.
 */}}
-{{- define "orka.aiWorkerClusterRoleBindingName" -}}
+{{- define "orka.aiWorkerRoleBindingName" -}}
 {{- printf "%s-ai-worker-rolebinding" (include "orka.fullname" .) | trunc 253 | trimSuffix "-" }}
 {{- end }}
 
-{{- define "orka.vendorWorkerClusterRoleBindingName" -}}
+{{- define "orka.vendorWorkerRoleBindingName" -}}
 {{- printf "%s-vendor-worker-rolebinding" (include "orka.fullname" .) | trunc 253 | trimSuffix "-" }}
 {{- end }}
 
-{{- define "orka.containerWorkerClusterRoleBindingName" -}}
+{{- define "orka.containerWorkerRoleBindingName" -}}
 {{- printf "%s-container-worker-rolebinding" (include "orka.fullname" .) | trunc 253 | trimSuffix "-" }}
 {{- end }}
+
+{{/* Render repository@digest when an immutable digest is configured. */}}
+{{- define "orka.imageRef" -}}
+{{- if .digest -}}
+{{ printf "%s@%s" .repository .digest }}
+{{- else -}}
+{{ printf "%s:%s" .repository .tag }}
+{{- end -}}
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/acp-artifact-secret.yaml b/cmd/build/helmify/static/templates/acp-artifact-secret.yaml
new file mode 100644
index 000000000..49343eb1a
--- /dev/null
+++ b/cmd/build/helmify/static/templates/acp-artifact-secret.yaml
@@ -0,0 +1,19 @@
+{{- if and (eq .Values.controller.mode "harness-v2") (not .Values.controller.acpArtifact.existingSecret) }}
+{{- $secretName := include "orka.acpArtifactSecretName" . }}
+{{- $secretKey := .Values.controller.acpArtifact.secretKey | default "capability-secret" }}
+{{- $existing := lookup "v1" "Secret" .Release.Namespace $secretName }}
+{{- $existingValue := "" }}
+{{- if and $existing (hasKey $existing.data $secretKey) }}
+{{- $existingValue = (index $existing.data $secretKey | b64dec) }}
+{{- end }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $secretName }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: acp-artifact-api
+type: Opaque
+stringData:
+  {{ $secretKey }}: {{ default (default (randAlphaNum 64) $existingValue) .Values.controller.acpArtifact.secret | quote }}
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/admission-deployment.yaml b/cmd/build/helmify/static/templates/admission-deployment.yaml
new file mode 100644
index 000000000..1d81ba4fd
--- /dev/null
+++ b/cmd/build/helmify/static/templates/admission-deployment.yaml
@@ -0,0 +1,4 @@
+{{/*
+The dedicated chart deployment was retired. Static releases serve their
+mode-scoped validation endpoints from the release-local controller.
+*/}}
diff --git a/cmd/build/helmify/static/templates/controller-validating-webhook.yaml b/cmd/build/helmify/static/templates/controller-validating-webhook.yaml
new file mode 100644
index 000000000..13472d206
--- /dev/null
+++ b/cmd/build/helmify/static/templates/controller-validating-webhook.yaml
@@ -0,0 +1,191 @@
+{{- include "orka.validateControllerMode" . }}
+{{- include "orka.validateWebhooks" . }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: {{ include "orka.controllerWebhookName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: controller
+  {{- with .Values.webhooks.caInjectionAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+webhooks:
+  - name: namespace-mode.{{ .Values.controller.mode }}.orka.ai
+    admissionReviewVersions: [v1]
+    sideEffects: None
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    timeoutSeconds: {{ .Values.webhooks.timeoutSeconds }}
+    clientConfig:
+      service:
+        name: {{ include "orka.controllerWebhookServiceName" . }}
+        namespace: {{ .Release.Namespace }}
+        path: /validate-v1-namespace-execution-mode
+        port: 443
+      {{- with .Values.webhooks.caBundle }}
+      caBundle: {{ . | quote }}
+      {{- end }}
+    rules:
+      - operations: [CREATE, UPDATE]
+        apiGroups: [""]
+        apiVersions: [v1]
+        resources: [namespaces]
+        scope: Cluster
+    objectSelector:
+      matchLabels:
+        orka.ai/controller-mode: {{ .Values.controller.mode | quote }}
+        kubernetes.io/metadata.name: {{ .Release.Namespace | quote }}
+  - name: task-provenance.{{ .Values.controller.mode }}.orka.ai
+    admissionReviewVersions: [v1]
+    sideEffects: None
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    timeoutSeconds: {{ .Values.webhooks.timeoutSeconds }}
+    clientConfig:
+      service:
+        name: {{ include "orka.controllerWebhookServiceName" . }}
+        namespace: {{ .Release.Namespace }}
+        path: /validate-core-orka-ai-v1alpha1-task-provenance
+        port: 443
+      {{- with .Values.webhooks.caBundle }}
+      caBundle: {{ . | quote }}
+      {{- end }}
+    rules:
+      - operations: [CREATE, UPDATE]
+        apiGroups: [core.orka.ai]
+        apiVersions: [v1alpha1]
+        resources: [tasks]
+        scope: Namespaced
+    namespaceSelector:
+      matchLabels:
+        orka.ai/controller-mode: {{ .Values.controller.mode | quote }}
+        kubernetes.io/metadata.name: {{ .Release.Namespace | quote }}
+  {{- if eq .Values.controller.mode "harness-v2" }}
+  - name: task-workspace-class.{{ .Values.controller.mode }}.orka.ai
+    admissionReviewVersions: [v1]
+    sideEffects: None
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    timeoutSeconds: {{ .Values.webhooks.timeoutSeconds }}
+    clientConfig:
+      service:
+        name: {{ include "orka.controllerWebhookServiceName" . }}
+        namespace: {{ .Release.Namespace }}
+        path: /validate-core-orka-ai-v1alpha1-task-workspace-class-use
+        port: 443
+      {{- with .Values.webhooks.caBundle }}
+      caBundle: {{ . | quote }}
+      {{- end }}
+    rules:
+      - operations: [CREATE, UPDATE]
+        apiGroups: [core.orka.ai]
+        apiVersions: [v1alpha1]
+        resources: [tasks]
+        scope: Namespaced
+    namespaceSelector:
+      matchLabels:
+        orka.ai/controller-mode: {{ .Values.controller.mode | quote }}
+        kubernetes.io/metadata.name: {{ .Release.Namespace | quote }}
+  - name: tool-workspace-class.{{ .Values.controller.mode }}.orka.ai
+    admissionReviewVersions: [v1]
+    sideEffects: None
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    timeoutSeconds: {{ .Values.webhooks.timeoutSeconds }}
+    clientConfig:
+      service:
+        name: {{ include "orka.controllerWebhookServiceName" . }}
+        namespace: {{ .Release.Namespace }}
+        path: /validate-core-orka-ai-v1alpha1-tool-workspace-class-use
+        port: 443
+      {{- with .Values.webhooks.caBundle }}
+      caBundle: {{ . | quote }}
+      {{- end }}
+    rules:
+      - operations: [CREATE, UPDATE]
+        apiGroups: [core.orka.ai]
+        apiVersions: [v1alpha1]
+        resources: [tools]
+        scope: Namespaced
+    namespaceSelector:
+      matchLabels:
+        orka.ai/controller-mode: {{ .Values.controller.mode | quote }}
+        kubernetes.io/metadata.name: {{ .Release.Namespace | quote }}
+  {{- end }}
+  - name: agent-contract.{{ .Values.controller.mode }}.orka.ai
+    admissionReviewVersions: [v1]
+    sideEffects: None
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    timeoutSeconds: {{ .Values.webhooks.timeoutSeconds }}
+    clientConfig:
+      service:
+        name: {{ include "orka.controllerWebhookServiceName" . }}
+        namespace: {{ .Release.Namespace }}
+        path: /validate-core-orka-ai-v1alpha1-agent-contract
+        port: 443
+      {{- with .Values.webhooks.caBundle }}
+      caBundle: {{ . | quote }}
+      {{- end }}
+    rules:
+      - operations: [CREATE, UPDATE]
+        apiGroups: [core.orka.ai]
+        apiVersions: [v1alpha1]
+        resources: [agents]
+        scope: Namespaced
+    namespaceSelector:
+      matchLabels:
+        orka.ai/controller-mode: {{ .Values.controller.mode | quote }}
+        kubernetes.io/metadata.name: {{ .Release.Namespace | quote }}
+  - name: agentruntime-contract.{{ .Values.controller.mode }}.orka.ai
+    admissionReviewVersions: [v1]
+    sideEffects: None
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    timeoutSeconds: {{ .Values.webhooks.timeoutSeconds }}
+    clientConfig:
+      service:
+        name: {{ include "orka.controllerWebhookServiceName" . }}
+        namespace: {{ .Release.Namespace }}
+        path: /validate-core-orka-ai-v1alpha1-agentruntime-contract
+        port: 443
+      {{- with .Values.webhooks.caBundle }}
+      caBundle: {{ . | quote }}
+      {{- end }}
+    rules:
+      - operations: [CREATE, UPDATE]
+        apiGroups: [core.orka.ai]
+        apiVersions: [v1alpha1]
+        resources: [agentruntimes]
+        scope: Namespaced
+    namespaceSelector:
+      matchLabels:
+        orka.ai/controller-mode: {{ .Values.controller.mode | quote }}
+        kubernetes.io/metadata.name: {{ .Release.Namespace | quote }}
+  - name: task-execution-authority.{{ .Values.controller.mode }}.orka.ai
+    admissionReviewVersions: [v1]
+    sideEffects: None
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    timeoutSeconds: {{ .Values.webhooks.timeoutSeconds }}
+    clientConfig:
+      service:
+        name: {{ include "orka.controllerWebhookServiceName" . }}
+        namespace: {{ .Release.Namespace }}
+        path: /validate-core-orka-ai-v1alpha1-task-execution-authority
+        port: 443
+      {{- with .Values.webhooks.caBundle }}
+      caBundle: {{ . | quote }}
+      {{- end }}
+    rules:
+      - operations: [CREATE, UPDATE]
+        apiGroups: [core.orka.ai]
+        apiVersions: [v1alpha1]
+        resources: [tasks, tasks/status]
+        scope: Namespaced
+    namespaceSelector:
+      matchLabels:
+        orka.ai/controller-mode: {{ .Values.controller.mode | quote }}
+        kubernetes.io/metadata.name: {{ .Release.Namespace | quote }}
diff --git a/cmd/build/helmify/static/templates/controller-webhook-service.yaml b/cmd/build/helmify/static/templates/controller-webhook-service.yaml
new file mode 100644
index 000000000..19f96695e
--- /dev/null
+++ b/cmd/build/helmify/static/templates/controller-webhook-service.yaml
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "orka.controllerWebhookServiceName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: controller
+spec:
+  type: ClusterIP
+  ports:
+    - port: 443
+      targetPort: webhook
+      protocol: TCP
+      name: webhook
+  selector:
+    {{- include "orka.selectorLabels" . | nindent 4 }}
+    app.kubernetes.io/component: controller
diff --git a/cmd/build/helmify/static/templates/deployment.yaml b/cmd/build/helmify/static/templates/deployment.yaml
index 31ef45c6e..c535e6021 100644
--- a/cmd/build/helmify/static/templates/deployment.yaml
+++ b/cmd/build/helmify/static/templates/deployment.yaml
@@ -1,15 +1,33 @@
-{{- if and .Values.controller.workspaceProvider.fakeProviderEnabled (not .Values.controller.workspaceProvider.apiEnabled) -}}
-{{- fail "controller.workspaceProvider.fakeProviderEnabled requires controller.workspaceProvider.apiEnabled" -}}
-{{- end -}}
-{{- if and .Values.controller.workspaceProvider.apiEnabled (not .Values.controller.workspaceProvider.classUseAdmission.enabled) -}}
-{{- fail "controller.workspaceProvider.apiEnabled requires controller.workspaceProvider.classUseAdmission.enabled" -}}
-{{- end -}}
-{{- if .Values.controller.workspaceProvider.classUseAdmission.enabled -}}
-{{- $workspaceWebhookSecret := required "controller.workspaceProvider.classUseAdmission.existingSecret is required when class-use admission is enabled" .Values.controller.workspaceProvider.classUseAdmission.existingSecret -}}
-{{- $workspaceWebhookCA := required "controller.workspaceProvider.classUseAdmission.caBundle is required when class-use admission is enabled" .Values.controller.workspaceProvider.classUseAdmission.caBundle -}}
-{{- end -}}
+{{- $harnessV1 := eq .Values.controller.mode "harness-v1" -}}
+{{- $harnessV2 := eq .Values.controller.mode "harness-v2" -}}
+{{- include "orka.validateControllerMode" . }}
+{{- include "orka.validateProviderProxyConfig" . }}
+{{- include "orka.validateSQLiteController" . }}
+{{- include "orka.validateAgentExecutionSnapshot" . }}
+{{- include "orka.validateWebhooks" . }}
+{{- if not (regexMatch "^sha256:[0-9a-f]{64}$" (.Values.controller.image.digest | default "")) }}
+{{- fail "controller.image.digest must be a sha256 digest" }}
+{{- end }}
+{{- if $harnessV2 }}
+{{- if not (regexMatch "^sha256:[0-9a-f]{64}$" (.Values.controller.image.digest | default "")) }}
+{{- fail "controller.image.digest must be a sha256 digest when controller.mode=harness-v2" }}
+{{- end }}
+{{- if or (not .Values.publisher.enabled) (not (regexMatch "^sha256:[0-9a-f]{64}$" (.Values.publisher.image.digest | default ""))) }}
+{{- fail "publisher must be enabled with publisher.image.digest set when controller.mode=harness-v2" }}
+{{- end }}
+{{- if not .Values.store.persistence.enabled }}
+{{- fail "store.persistence.enabled must be true when controller.mode=harness-v2" }}
+{{- end }}
+{{- include "orka.validateACPRuntimeImage" (dict "name" "controller.acpRuntime.codexImage" "ref" .Values.controller.acpRuntime.codexImage) }}
+{{- include "orka.validateACPRuntimeImage" (dict "name" "controller.acpRuntime.claudeImage" "ref" .Values.controller.acpRuntime.claudeImage) }}
+{{- include "orka.validateACPRuntimeImage" (dict "name" "controller.acpRuntime.copilotImage" "ref" .Values.controller.acpRuntime.copilotImage) }}
+{{- include "orka.validateACPRuntimeImage" (dict "name" "controller.acpRuntime.opencodeImage" "ref" .Values.controller.acpRuntime.opencodeImage) }}
+{{- if not .Values.providerProxy.enabled }}
+{{- fail "providerProxy.enabled must be true when controller.mode=harness-v2" }}
+{{- end }}
+{{- end }}
 {{- $gatewayCRDsReady := false -}}
-{{- if and .Values.controller.gateway.enabled (not .Values.controller.gateway.crdsReadyOverride) -}}
+{{- if and $harnessV2 .Values.controller.gateway.enabled (not .Values.controller.gateway.crdsReadyOverride) -}}
 {{- $gatewayClassCRD := lookup "apiextensions.k8s.io/v1" "CustomResourceDefinition" "" "gatewayclasses.gateway.orka.ai" -}}
 {{- $gatewayCRD := lookup "apiextensions.k8s.io/v1" "CustomResourceDefinition" "" "gateways.gateway.orka.ai" -}}
 {{- $gatewayBindingCRD := lookup "apiextensions.k8s.io/v1" "CustomResourceDefinition" "" "gatewaybindings.gateway.orka.ai" -}}
@@ -20,23 +38,21 @@
 {{- end -}}
 {{- $gatewayCRDsReady = and (not (empty $gatewayClassCRD)) (not (empty $gatewayCRD)) (not (empty $gatewayBindingCRD)) $taskSchemaReady -}}
 {{- end -}}
-{{- $gatewayRuntimeEnabled := and .Values.controller.gateway.enabled (or .Values.controller.gateway.crdsReadyOverride $gatewayCRDsReady) -}}
+{{- $gatewayRuntimeEnabled := and $harnessV2 .Values.controller.gateway.enabled (or .Values.controller.gateway.crdsReadyOverride $gatewayCRDsReady) -}}
 {{- if and $gatewayRuntimeEnabled (not .Values.store.persistence.enabled) (not .Values.controller.gateway.allowEphemeralStore) -}}
 {{- fail "controller.gateway.enabled requires store.persistence.enabled=true; set controller.gateway.allowEphemeralStore=true only for disposable development" -}}
 {{- end -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "orka.fullname" . }}-controller
+  name: {{ include "orka.controllerName" . }}
   labels:
     {{- include "orka.labels" . | nindent 4 }}
     app.kubernetes.io/component: controller
 spec:
   replicas: {{ .Values.controller.replicas }}
-  {{- if .Values.store.persistence.enabled }}
   strategy:
     type: Recreate
-  {{- end }}
   selector:
     matchLabels:
       {{- include "orka.selectorLabels" . | nindent 6 }}
@@ -46,9 +62,18 @@ spec:
       labels:
         {{- include "orka.selectorLabels" . | nindent 8 }}
         app.kubernetes.io/component: controller
-      {{- with .Values.annotations }}
+        orka.ai/network-role: controller
+      {{- if or .Values.annotations (and $harnessV2 .Values.publisher.auth.rolloutNonce) (and $harnessV1 .Values.harnessV1.tls.rolloutNonce) }}
       annotations:
+        {{- with .Values.annotations }}
         {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.publisher.auth.rolloutNonce }}
+        orka.ai/publisher-auth-rollout-nonce: {{ . | quote }}
+        {{- end }}
+        {{- with .Values.harnessV1.tls.rolloutNonce }}
+        orka.ai/harness-v1-tls-rollout-nonce: {{ . | quote }}
+        {{- end }}
       {{- end }}
     spec:
       serviceAccountName: {{ include "orka.serviceAccountName" . }}
@@ -56,9 +81,12 @@ spec:
       securityContext:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $harnessV2 .Values.controller.acpRuntime.upgradeDrain.enabled }}
+      terminationGracePeriodSeconds: {{ .Values.controller.acpRuntime.upgradeDrain.terminationGracePeriodSeconds }}
+      {{- end }}
       containers:
         - name: controller
-          image: "{{ .Values.controller.image.repository }}:{{ .Values.controller.image.tag }}"
+          image: {{ include "orka.imageRef" .Values.controller.image | quote }}
           imagePullPolicy: {{ .Values.controller.image.pullPolicy }}
           args:
             - --api-port={{ .Values.controller.apiPort }}
@@ -66,10 +94,56 @@ spec:
             - --metrics-bind-address=:{{ .Values.controller.metricsPort }}
             - --health-probe-bind-address=:{{ .Values.controller.healthPort }}
             - --metrics-secure=false
-            {{- if .Values.controller.watchNamespace }}
             - --watch-namespace={{ .Values.controller.watchNamespace }}
-            {{- end }}
             - --leader-elect={{ .Values.controller.leaderElect }}
+            - --controller-mode={{ .Values.controller.mode }}
+            - {{ printf "--execution-mode-controller-usernames=%s" (include "orka.controllerUsername" .) | quote }}
+            - --webhook-cert-path=/var/run/orka/webhook/tls
+            - {{ printf "--webhook-cert-name=%s" .Values.webhooks.tls.certKey | quote }}
+            - {{ printf "--webhook-cert-key=%s" .Values.webhooks.tls.privateKeyKey | quote }}
+            - --task-provenance-admission-enabled=true
+            - {{ printf "--task-provenance-admission-trusted-users=%s" (include "orka.controllerUsername" .) | quote }}
+            - --workspace-class-use-admission-enabled={{ $harnessV2 }}
+            {{- if $harnessV1 }}
+            - --harness-v1-endpoint=https://{{ include "orka.harnessV1Name" . }}.{{ .Release.Namespace }}.svc:8080
+            - --harness-v1-ca-file=/var/run/orka/harness-v1-tls/ca.crt
+            - --harness-v1-auth-secret-namespace={{ .Release.Namespace }}
+            - --harness-v1-auth-secret-name={{ .Values.harnessV1.auth.existingSecret }}
+            - --harness-v1-auth-secret-key={{ .Values.harnessV1.auth.tokenKey }}
+            - --harness-v1-dispatch-interval={{ .Values.harnessV1.dispatch.interval }}
+            - --harness-v1-dispatch-workers={{ .Values.harnessV1.dispatch.workers }}
+            {{- end }}
+            - --agent-execution-snapshot-key-file=/var/run/orka/agent-execution-snapshot/key
+            - --agent-execution-snapshot-retention={{ .Values.controller.agentExecutionSnapshot.retention }}
+            - --agent-execution-snapshot-retention-interval={{ .Values.controller.agentExecutionSnapshot.retentionInterval }}
+            {{- if $harnessV2 }}
+            - --acp-runtime-namespace={{ .Values.controller.acpRuntime.namespace }}
+            {{- end }}
+            {{- if and $harnessV2 .Values.controller.acpRuntime.upgradeDrain.enabled }}
+            - --acp-upgrade-drain-bind-address=127.0.0.1:{{ .Values.controller.acpRuntime.upgradeDrain.port }}
+            - --acp-upgrade-drain-timeout={{ .Values.controller.acpRuntime.upgradeDrain.timeout }}
+            - --acp-upgrade-drain-poll-interval={{ .Values.controller.acpRuntime.upgradeDrain.pollInterval }}
+            - --acp-upgrade-drain-trigger-timeout={{ .Values.controller.acpRuntime.upgradeDrain.triggerTimeout }}
+            - --acp-upgrade-drain-marker-namespace={{ .Release.Namespace }}
+            {{- end }}
+            {{- if and $harnessV2 .Values.providerProxy.enabled }}
+            - --acp-provider-proxy-base-url=http://{{ include "orka.providerProxyName" . }}.{{ .Release.Namespace }}.svc:8080
+            - --acp-provider-proxy-namespace={{ .Release.Namespace }}
+            - --acp-provider-proxy-pod-labels=orka.ai/network-role=provider-auth-proxy
+            - --acp-provider-proxy-token-file=/var/run/orka/provider-auth/token
+            {{- end }}
+            {{- if .Values.controller.acpRuntime.codexImage }}
+            - {{ printf "--acp-codex-runtime-image=%s" .Values.controller.acpRuntime.codexImage | quote }}
+            {{- end }}
+            {{- if .Values.controller.acpRuntime.claudeImage }}
+            - {{ printf "--acp-claude-runtime-image=%s" .Values.controller.acpRuntime.claudeImage | quote }}
+            {{- end }}
+            {{- if .Values.controller.acpRuntime.copilotImage }}
+            - {{ printf "--acp-copilot-runtime-image=%s" .Values.controller.acpRuntime.copilotImage | quote }}
+            {{- end }}
+            {{- if .Values.controller.acpRuntime.opencodeImage }}
+            - {{ printf "--acp-opencode-runtime-image=%s" .Values.controller.acpRuntime.opencodeImage | quote }}
+            {{- end }}
             - --zap-log-level={{ .Values.controller.logLevel }}
             - --gateway-enabled={{ $gatewayRuntimeEnabled }}
             - --gateway-pending-per-session={{ .Values.controller.gateway.pendingPerSession }}
@@ -243,25 +317,11 @@ spec:
             - --ai-worker-cluster-role-name={{ include "orka.aiWorkerClusterRoleName" . }}
             - --vendor-worker-cluster-role-name={{ include "orka.vendorWorkerClusterRoleName" . }}
             - --container-worker-cluster-role-name={{ include "orka.containerWorkerClusterRoleName" . }}
-            - --worker-cluster-role-binding-prefix={{ include "orka.fullname" . }}
-            {{- if .Values.controller.enforceNamespaceIsolation }}
+            - --worker-role-binding-prefix={{ include "orka.fullname" . }}
             - --enforce-namespace-isolation=true
-            {{- end }}
             {{- if gt (int .Values.controller.maxTasksPerNamespace) 0 }}
             - --max-tasks-per-namespace={{ .Values.controller.maxTasksPerNamespace }}
             {{- end }}
-            {{- with .Values.controller.workspaceProvider }}
-            {{- if .apiEnabled }}
-            - --enable-workspace-provider-api=true
-            {{- end }}
-            {{- if .fakeProviderEnabled }}
-            - --enable-fake-workspace-provider=true
-            {{- end }}
-            {{- if .classUseAdmission.enabled }}
-            - --workspace-class-use-admission-enabled=true
-            - --webhook-cert-path=/var/run/orka/workspace-webhook
-            {{- end }}
-            {{- end }}
             {{- with .Values.controller.executionWorkspace }}
             - --execution-workspace-default-provider={{ .defaultProvider | default "agent-sandbox" }}
             {{- end }}
@@ -315,12 +375,22 @@ spec:
               value: {{ include "orka.vendorWorkerClusterRoleName" . | quote }}
             - name: ORKA_CONTAINER_WORKER_CLUSTER_ROLE_NAME
               value: {{ include "orka.containerWorkerClusterRoleName" . | quote }}
-            - name: ORKA_HARNESS_WRAPPER_ENDPOINT
-              value: http://{{ include "orka.harnessWrapperName" . }}:8080
-            - name: ORKA_HARNESS_WRAPPER_BEARER_TOKEN_FILE
-              value: /var/run/orka/harness-wrapper/token
-            - name: ORKA_HARNESS_WRAPPER_SERVICE_ACCOUNT_NAME
-              value: {{ include "orka.harnessWrapperName" . | quote }}
+            {{- if $harnessV2 }}
+            - name: ORKA_ACP_ARTIFACT_CAPABILITY_SECRET_FILE
+              value: /var/run/orka/acp-artifacts/capability-secret
+            - name: ORKA_ACP_ARTIFACT_ROOT
+              value: /data/acp-artifacts
+            - name: ORKA_ACP_ARTIFACT_MAX_BYTES
+              value: {{ .Values.controller.acpArtifact.maxBytes | quote }}
+            {{- end }}
+            {{- if and $harnessV2 .Values.publisher.enabled }}
+            - name: ORKA_WORKSPACE_PUBLISHER_URL
+              value: http://{{ include "orka.publisherName" . }}:8080
+            - name: ORKA_WORKSPACE_PUBLISHER_CONTROLLER_TOKEN_FILE
+              value: /var/run/orka/publisher-auth/controller-token
+            - name: ORKA_WORKSPACE_PUBLISHER_CAPABILITY_SECRET_FILE
+              value: /var/run/orka/publisher-auth/operation-capability-secret
+            {{- end }}
             {{- if .Values.github.webhook.secretName }}
             - name: ORKA_GITHUB_WEBHOOK_SECRET
               valueFrom:
@@ -368,11 +438,18 @@ spec:
             - name: health
               containerPort: {{ .Values.controller.healthPort }}
               protocol: TCP
-            {{- if .Values.controller.workspaceProvider.classUseAdmission.enabled }}
-            - name: webhook-server
+            - name: webhook
               containerPort: 9443
               protocol: TCP
-            {{- end }}
+          {{- if and $harnessV2 .Values.controller.acpRuntime.upgradeDrain.enabled }}
+          lifecycle:
+            preStop:
+              exec:
+                command:
+                  - /manager
+                  - {{ printf "--acp-upgrade-drain-trigger-url=http://127.0.0.1:%v%s" .Values.controller.acpRuntime.upgradeDrain.port "/acp/upgrade-drain" | quote }}
+                  - {{ printf "--acp-upgrade-drain-trigger-timeout=%s" .Values.controller.acpRuntime.upgradeDrain.triggerTimeout | quote }}
+          {{- end }}
           livenessProbe:
             httpGet:
               path: /healthz
@@ -398,41 +475,96 @@ spec:
               mountPath: /tmp
             - name: store
               mountPath: /data
-            - name: harness-wrapper-auth
-              mountPath: /var/run/orka/harness-wrapper
+            {{- if $harnessV2 }}
+            - name: acp-artifact-capability
+              mountPath: /var/run/orka/acp-artifacts
+              readOnly: true
+            {{- end }}
+            {{- if and $harnessV2 .Values.publisher.enabled }}
+            - name: workspace-publisher-auth
+              mountPath: /var/run/orka/publisher-auth
+              readOnly: true
+            {{- end }}
+            {{- if and $harnessV2 .Values.providerProxy.enabled }}
+            - name: provider-auth-proxy
+              mountPath: /var/run/orka/provider-auth
+              readOnly: true
+            {{- end }}
+            - name: agent-execution-snapshot-key
+              mountPath: /var/run/orka/agent-execution-snapshot
               readOnly: true
-            {{- if .Values.controller.workspaceProvider.classUseAdmission.enabled }}
-            - name: workspace-webhook-certs
-              mountPath: /var/run/orka/workspace-webhook
+            - name: webhook-tls
+              mountPath: /var/run/orka/webhook/tls
+              readOnly: true
+            {{- if $harnessV1 }}
+            - name: harness-v1-tls
+              mountPath: /var/run/orka/harness-v1-tls
               readOnly: true
             {{- end }}
       volumes:
         - name: tmp
           emptyDir: {}
-        - name: harness-wrapper-auth
-          secret:
-            secretName: {{ .Values.workers.harnessWrapper.auth.existingSecret | default (include "orka.harnessWrapperAuthSecretName" .) }}
-            items:
-              - key: {{ .Values.workers.harnessWrapper.auth.tokenKey | default "token" }}
-                path: token
-        {{- if .Values.controller.workspaceProvider.classUseAdmission.enabled }}
-        - name: workspace-webhook-certs
+        {{- if $harnessV2 }}
+        - name: acp-artifact-capability
           secret:
-            secretName: {{ .Values.controller.workspaceProvider.classUseAdmission.existingSecret | quote }}
+            secretName: {{ .Values.controller.acpArtifact.existingSecret | default (include "orka.acpArtifactSecretName" .) }}
             defaultMode: 0400
             items:
-              - key: tls.crt
-                path: tls.crt
-              - key: tls.key
-                path: tls.key
+              - key: {{ .Values.controller.acpArtifact.secretKey | default "capability-secret" }}
+                path: capability-secret
         {{- end }}
         - name: store
           {{- if .Values.store.persistence.enabled }}
           persistentVolumeClaim:
-            claimName: {{ include "orka.fullname" . }}-store
+            claimName: {{ include "orka.storeName" . }}
           {{- else }}
           emptyDir: {}
           {{- end }}
+        {{- if and $harnessV2 .Values.publisher.enabled }}
+        - name: workspace-publisher-auth
+          secret:
+            secretName: {{ .Values.publisher.auth.existingSecret | default (include "orka.publisherAuthSecretName" .) }}
+            defaultMode: 0400
+            items:
+              - key: {{ .Values.publisher.auth.controllerTokenKey | default "controller-token" }}
+                path: controller-token
+              - key: {{ .Values.publisher.auth.capabilitySecretKey | default "operation-capability-secret" }}
+                path: operation-capability-secret
+        {{- end }}
+        {{- if and $harnessV2 .Values.providerProxy.enabled }}
+        - name: provider-auth-proxy
+          secret:
+            secretName: {{ .Values.providerProxy.auth.existingSecret | default (include "orka.providerProxyName" .) }}
+            defaultMode: 0400
+            items:
+              - key: {{ .Values.providerProxy.auth.tokenKey | default "token" }}
+                path: token
+        {{- end }}
+        - name: agent-execution-snapshot-key
+          secret:
+            secretName: {{ .Values.controller.agentExecutionSnapshot.existingSecret | quote }}
+            defaultMode: 0400
+            items:
+              - key: {{ .Values.controller.agentExecutionSnapshot.key | quote }}
+                path: key
+        - name: webhook-tls
+          secret:
+            secretName: {{ .Values.webhooks.tls.existingSecret | quote }}
+            defaultMode: 0400
+            items:
+              - key: {{ .Values.webhooks.tls.certKey | quote }}
+                path: {{ .Values.webhooks.tls.certKey | quote }}
+              - key: {{ .Values.webhooks.tls.privateKeyKey | quote }}
+                path: {{ .Values.webhooks.tls.privateKeyKey | quote }}
+        {{- if $harnessV1 }}
+        - name: harness-v1-tls
+          secret:
+            secretName: {{ .Values.harnessV1.tls.existingSecret | quote }}
+            defaultMode: 0400
+            items:
+              - key: ca.crt
+                path: ca.crt
+        {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
diff --git a/cmd/build/helmify/static/templates/gateway-task-admission-policy.yaml b/cmd/build/helmify/static/templates/gateway-task-admission-policy.yaml
index 12a1b1976..940409346 100644
--- a/cmd/build/helmify/static/templates/gateway-task-admission-policy.yaml
+++ b/cmd/build/helmify/static/templates/gateway-task-admission-policy.yaml
@@ -1,3 +1,4 @@
+{{- if eq .Values.controller.mode "harness-v2" }}
 {{- $issuerPrefix := "gateway.orka.ai/" -}}
 {{- if .Values.controller.watchNamespace -}}
 {{- $issuerPrefix = printf "gateway.orka.ai/%s/" .Values.controller.watchNamespace -}}
@@ -43,3 +44,4 @@ metadata:
 spec:
   policyName: {{ include "orka.fullname" . }}-gateway-task-protection
   validationActions: [Deny]
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/harness-wrapper-deployment.yaml b/cmd/build/helmify/static/templates/harness-wrapper-deployment.yaml
index 7d42a6b64..ce943f73c 100644
--- a/cmd/build/helmify/static/templates/harness-wrapper-deployment.yaml
+++ b/cmd/build/helmify/static/templates/harness-wrapper-deployment.yaml
@@ -1,7 +1,9 @@
+{{- include "orka.validateHarnessV1" . }}
+{{- if eq .Values.controller.mode "harness-v1" }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "orka.harnessWrapperName" . }}
+  name: {{ include "orka.harnessV1Name" . }}
   labels:
     {{- include "orka.labels" . | nindent 4 }}
     app.kubernetes.io/component: agent-harness-wrapper
@@ -14,97 +16,5 @@ spec:
       {{- include "orka.selectorLabels" . | nindent 6 }}
       app.kubernetes.io/component: agent-harness-wrapper
   template:
-    metadata:
-      labels:
-        {{- include "orka.selectorLabels" . | nindent 8 }}
-        app.kubernetes.io/component: agent-harness-wrapper
-    spec:
-      serviceAccountName: {{ include "orka.harnessWrapperName" . }}
-      automountServiceAccountToken: false
-      securityContext:
-        runAsUser: 0
-        runAsGroup: 0
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: wrapper
-          image: {{ .Values.workers.harnessWrapper.image.repository }}:{{ .Values.workers.harnessWrapper.image.tag }}
-          imagePullPolicy: {{ .Values.workers.harnessWrapper.image.pullPolicy }}
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          env:
-            - name: ORKA_HARNESS_WRAPPER_RUNTIME
-              value: multi
-            - name: ORKA_HARNESS_WRAPPER_LISTEN_ADDR
-              value: :8080
-            - name: ORKA_HARNESS_WRAPPER_BEARER_TOKEN_FILE
-              value: /var/run/orka/harness-wrapper/token
-            - name: ORKA_ALLOW_BASH
-              value: "true"
-            - name: ORKA_HARNESS_WRAPPER_CHILD_UID
-              value: "1000"
-            - name: ORKA_HARNESS_WRAPPER_CHILD_GID
-              value: "1000"
-            {{- if .Values.workers.harnessWrapper.codexSandboxMode }}
-            - name: ORKA_CODEX_SANDBOX_MODE
-              value: {{ .Values.workers.harnessWrapper.codexSandboxMode | quote }}
-            {{- end }}
-            - name: ORKA_SA_TOKEN_PATH
-              value: /var/run/orka/upload-token/token
-          volumeMounts:
-            - name: auth
-              mountPath: /var/run/orka/harness-wrapper
-              readOnly: true
-            - name: upload-token
-              mountPath: /var/run/orka/upload-token
-              readOnly: true
-            - name: tmp
-              mountPath: /tmp
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsUser: 0
-            runAsGroup: 0
-            capabilities:
-              drop:
-                - ALL
-              add:
-                - SETUID
-                - SETGID
-                - CHOWN
-                - KILL
-                - FOWNER
-          livenessProbe:
-            httpGet:
-              path: /v1/health
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 20
-          readinessProbe:
-            httpGet:
-              path: /v1/health
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          {{- with .Values.workers.harnessWrapper.resources }}
-          resources:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-      volumes:
-        - name: upload-token
-          projected:
-            defaultMode: 0400
-            sources:
-              - serviceAccountToken:
-                  path: token
-        - name: auth
-          secret:
-            secretName: {{ .Values.workers.harnessWrapper.auth.existingSecret | default (include "orka.harnessWrapperAuthSecretName" .) }}
-            defaultMode: 0400
-            items:
-              - key: {{ .Values.workers.harnessWrapper.auth.tokenKey | default "token" }}
-                path: token
-        - name: tmp
-          emptyDir: {}
+    {{- include "orka.harnessV1PodTemplate" (dict "root" . "generation" (include "orka.harnessV1PodTemplateGeneration" .)) | nindent 4 }}
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/harness-wrapper-drain-hook.yaml b/cmd/build/helmify/static/templates/harness-wrapper-drain-hook.yaml
new file mode 100644
index 000000000..f43747028
--- /dev/null
+++ b/cmd/build/helmify/static/templates/harness-wrapper-drain-hook.yaml
@@ -0,0 +1,490 @@
+{{- $harnessV1 := eq .Values.controller.mode "harness-v1" -}}
+{{- if $harnessV1 }}
+{{- include "orka.validateHarnessV1" . }}
+{{- $wrapperName := include "orka.harnessV1Name" . }}
+{{- $desiredGeneration := include "orka.harnessV1PodTemplateGeneration" . }}
+{{- $rolloverGeneration := $desiredGeneration }}
+{{- $existingWrapper := lookup "apps/v1" "Deployment" .Release.Namespace $wrapperName }}
+{{- $controllerName := include "orka.controllerName" . }}
+{{- $existingController := lookup "apps/v1" "Deployment" .Release.Namespace $controllerName }}
+{{- $existingControllerState := "" }}
+{{- if $existingController }}
+{{- $existingControllerState = include "orka.harnessV1ExistingControllerState" $existingController | trim }}
+{{- end }}
+{{- if and .Release.IsUpgrade (not $existingWrapper) (empty $existingControllerState) }}
+{{- fail "cannot determine the previously deployed harness v1 state during upgrade; restore the release controller or wrapper Deployment before upgrading" }}
+{{- end }}
+{{- $needsRollover := false }}
+{{- $existingRouteEnabled := false }}
+{{- $existingImage := "" }}
+{{- $existingPullPolicy := "" }}
+{{- $existingAuthSecret := "" }}
+{{- $existingAuthKey := "" }}
+{{- $existingTLSSecret := "" }}
+{{- $desiredAuthSecret := .Values.harnessV1.auth.existingSecret }}
+{{- $desiredAuthKey := .Values.harnessV1.auth.tokenKey }}
+{{- if $existingWrapper }}
+{{- $existingRouteEnabled = true }}
+{{- $existingGeneration := include "orka.harnessV1ExistingGeneration" $existingWrapper | trim }}
+{{- $needsRollover = ne $existingGeneration $desiredGeneration }}
+{{- $existingImage = include "orka.harnessV1ExistingImage" $existingWrapper }}
+{{- $existingPullPolicy = include "orka.harnessV1ExistingImagePullPolicy" $existingWrapper }}
+{{- $existingAuthSecret = include "orka.harnessV1ExistingAuthSecretName" $existingWrapper }}
+{{- $existingAuthKey = include "orka.harnessV1ExistingAuthSecretKey" $existingWrapper }}
+{{- $existingTLSSecret = include "orka.harnessV1ExistingTLSSecretName" $existingWrapper }}
+{{- else if eq $existingControllerState "enabled" }}
+{{- $existingRouteEnabled = true }}
+{{- $existingAuthSecret = include "orka.harnessV1ExistingControllerAuthSecretName" $existingController }}
+{{- $existingAuthKey = include "orka.harnessV1ExistingControllerAuthSecretKey" $existingController }}
+{{- end }}
+{{- if $existingRouteEnabled }}
+{{- if ne $existingAuthSecret $desiredAuthSecret }}
+{{- fail "harnessV1.auth.existingSecret cannot change while the previously deployed harness v1 route remains enabled; retire harness v1 before rotating wrapper auth" }}
+{{- end }}
+{{- if ne $existingAuthKey $desiredAuthKey }}
+{{- fail "harnessV1.auth.tokenKey cannot change while the previously deployed harness v1 route remains enabled; retire harness v1 before rotating wrapper auth" }}
+{{- end }}
+{{- end }}
+{{- if $needsRollover }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "orka.harnessV1DrainName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper-rollover-drain
+  annotations:
+    helm.sh/hook: pre-upgrade,pre-rollback
+    helm.sh/hook-weight: "-20"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: agent-harness-wrapper
+  policyTypes: [Ingress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: agent-harness-wrapper-rollover-drain
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "orka.harnessV1DrainEgressName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper-rollover-drain
+  annotations:
+    helm.sh/hook: pre-upgrade,pre-rollback
+    helm.sh/hook-weight: "-20"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: agent-harness-wrapper-rollover-drain
+  policyTypes: [Egress]
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - {protocol: UDP, port: 53}
+        - {protocol: TCP, port: 53}
+    - to:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: agent-harness-wrapper
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "orka.harnessV1DrainName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper-rollover-drain
+  annotations:
+    helm.sh/hook: pre-upgrade,pre-rollback
+    helm.sh/hook-weight: "-10"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  backoffLimit: 0
+  template:
+    metadata:
+      labels:
+        {{- include "orka.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: agent-harness-wrapper-rollover-drain
+    spec:
+      serviceAccountName: {{ include "orka.harnessV1Name" . }}
+      automountServiceAccountToken: false
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: drain
+          image: {{ $existingImage | quote }}
+          imagePullPolicy: {{ $existingPullPolicy }}
+          command: ["/orka-agent-harness-wrapper"]
+          args:
+            - drain
+            - {{ printf "--endpoint=https://%s.%s.svc:8080" $wrapperName .Release.Namespace | quote }}
+            - --bearer-token-file=/var/run/orka/harness-wrapper-auth/token
+            - --ca-file=/var/run/orka/harness-wrapper-tls/ca.crt
+            - {{ printf "--timeout=%s" .Values.harnessV1.upgradeDrain.timeout | quote }}
+            - {{ printf "--poll-interval=%s" .Values.harnessV1.upgradeDrain.pollInterval | quote }}
+            - {{ printf "--next-generation=%s" $rolloverGeneration | quote }}
+          volumeMounts:
+            - name: auth
+              mountPath: /var/run/orka/harness-wrapper-auth
+              readOnly: true
+            - name: tls
+              mountPath: /var/run/orka/harness-wrapper-tls
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 1000
+            runAsGroup: 1000
+            capabilities:
+              drop: [ALL]
+          {{- with .Values.harnessV1.upgradeDrain.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      volumes:
+        - name: auth
+          secret:
+            secretName: {{ $existingAuthSecret | quote }}
+            defaultMode: 0440
+            items:
+              - key: {{ $existingAuthKey | quote }}
+                path: token
+        - name: tls
+          secret:
+            secretName: {{ $existingTLSSecret | quote }}
+            defaultMode: 0440
+            items:
+              - key: ca.crt
+                path: ca.crt
+        - name: tmp
+          emptyDir: {}
+{{- end }}
+{{- if $harnessV1 }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "orka.harnessV1AbortName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper-rollover-abort
+  annotations:
+    helm.sh/hook: post-rollback
+    helm.sh/hook-weight: "-20"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: agent-harness-wrapper
+  policyTypes: [Ingress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: agent-harness-wrapper-rollover-abort
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "orka.harnessV1AbortEgressName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper-rollover-abort
+  annotations:
+    helm.sh/hook: post-rollback
+    helm.sh/hook-weight: "-20"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: agent-harness-wrapper-rollover-abort
+  policyTypes: [Egress]
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - {protocol: UDP, port: 53}
+        - {protocol: TCP, port: 53}
+    - to:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: agent-harness-wrapper
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "orka.harnessV1AbortName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper-rollover-abort
+  annotations:
+    helm.sh/hook: post-rollback
+    helm.sh/hook-weight: "-10"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  backoffLimit: 0
+  template:
+    metadata:
+      labels:
+        {{- include "orka.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: agent-harness-wrapper-rollover-abort
+    spec:
+      serviceAccountName: {{ include "orka.harnessV1Name" . }}
+      automountServiceAccountToken: false
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: abort-rollover
+          image: {{ include "orka.imageRef" .Values.harnessV1.image | quote }}
+          imagePullPolicy: {{ .Values.harnessV1.image.pullPolicy }}
+          command: ["/orka-agent-harness-wrapper"]
+          args:
+            - abort-rollover
+            - {{ printf "--endpoint=https://%s.%s.svc:8080" $wrapperName .Release.Namespace | quote }}
+            - --bearer-token-file=/var/run/orka/harness-wrapper-auth/token
+            - --ca-file=/var/run/orka/harness-wrapper-tls/ca.crt
+            - {{ printf "--expected-generation=%s" $desiredGeneration | quote }}
+            - {{ printf "--timeout=%s" .Values.harnessV1.upgradeDrain.timeout | quote }}
+          volumeMounts:
+            - name: auth
+              mountPath: /var/run/orka/harness-wrapper-auth
+              readOnly: true
+            - name: tls
+              mountPath: /var/run/orka/harness-wrapper-tls
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 1000
+            runAsGroup: 1000
+            capabilities:
+              drop: [ALL]
+          {{- with .Values.harnessV1.upgradeDrain.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      volumes:
+        - name: auth
+          secret:
+            secretName: {{ .Values.harnessV1.auth.existingSecret | quote }}
+            defaultMode: 0440
+            items:
+              - key: {{ .Values.harnessV1.auth.tokenKey | quote }}
+                path: token
+        - name: tls
+          secret:
+            secretName: {{ .Values.harnessV1.tls.existingSecret | quote }}
+            defaultMode: 0440
+            items:
+              - key: ca.crt
+                path: ca.crt
+        - name: tmp
+          emptyDir: {}
+{{- end }}
+{{- if $harnessV1 }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "orka.harnessV1DeleteDrainName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper-delete-drain
+  annotations:
+    helm.sh/hook: pre-delete
+    helm.sh/hook-weight: "-20"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: agent-harness-wrapper
+  policyTypes: [Ingress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: agent-harness-wrapper-delete-drain
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "orka.harnessV1DeleteDrainEgressName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper-delete-drain
+  annotations:
+    helm.sh/hook: pre-delete
+    helm.sh/hook-weight: "-20"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: agent-harness-wrapper-delete-drain
+  policyTypes: [Egress]
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - {protocol: UDP, port: 53}
+        - {protocol: TCP, port: 53}
+    - to:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: agent-harness-wrapper
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "orka.harnessV1DeleteDrainName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper-delete-drain
+  annotations:
+    helm.sh/hook: pre-delete
+    helm.sh/hook-weight: "-10"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  backoffLimit: 0
+  template:
+    metadata:
+      labels:
+        {{- include "orka.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: agent-harness-wrapper-delete-drain
+    spec:
+      serviceAccountName: {{ include "orka.harnessV1Name" . }}
+      automountServiceAccountToken: false
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: drain
+          image: {{ include "orka.imageRef" .Values.harnessV1.image | quote }}
+          imagePullPolicy: {{ .Values.harnessV1.image.pullPolicy }}
+          command: ["/orka-agent-harness-wrapper"]
+          args:
+            - drain
+            - {{ printf "--endpoint=https://%s.%s.svc:8080" $wrapperName .Release.Namespace | quote }}
+            - --bearer-token-file=/var/run/orka/harness-wrapper-auth/token
+            - --ca-file=/var/run/orka/harness-wrapper-tls/ca.crt
+            - {{ printf "--timeout=%s" .Values.harnessV1.upgradeDrain.timeout | quote }}
+            - {{ printf "--poll-interval=%s" .Values.harnessV1.upgradeDrain.pollInterval | quote }}
+            - {{ printf "--next-generation=retired:%s" $desiredGeneration | quote }}
+          volumeMounts:
+            - name: auth
+              mountPath: /var/run/orka/harness-wrapper-auth
+              readOnly: true
+            - name: tls
+              mountPath: /var/run/orka/harness-wrapper-tls
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 1000
+            runAsGroup: 1000
+            capabilities:
+              drop: [ALL]
+          {{- with .Values.harnessV1.upgradeDrain.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      volumes:
+        - name: auth
+          secret:
+            secretName: {{ .Values.harnessV1.auth.existingSecret | quote }}
+            defaultMode: 0440
+            items:
+              - key: {{ .Values.harnessV1.auth.tokenKey | quote }}
+                path: token
+        - name: tls
+          secret:
+            secretName: {{ .Values.harnessV1.tls.existingSecret | quote }}
+            defaultMode: 0440
+            items:
+              - key: ca.crt
+                path: ca.crt
+        - name: tmp
+          emptyDir: {}
+{{- end }}
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/harness-wrapper-networkpolicy.yaml b/cmd/build/helmify/static/templates/harness-wrapper-networkpolicy.yaml
new file mode 100644
index 000000000..d07344804
--- /dev/null
+++ b/cmd/build/helmify/static/templates/harness-wrapper-networkpolicy.yaml
@@ -0,0 +1,87 @@
+{{- include "orka.validateHarnessV1" . }}
+{{- if eq .Values.controller.mode "harness-v1" }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "orka.harnessV1Name" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: agent-harness-wrapper
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: controller
+      ports:
+        - protocol: TCP
+          port: 8080
+  # V1 compatibility workloads may reach their release-local controller plus
+  # public HTTPS provider and read-only SCM endpoints. Private, local,
+  # link-local, multicast, and documentation networks remain denied, and no
+  # in-cluster publisher/proxy egress is granted.
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: controller
+      ports:
+        - protocol: TCP
+          port: {{ .Values.controller.apiPort }}
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - {protocol: UDP, port: 53}
+        - {protocol: TCP, port: 53}
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 0.0.0.0/8
+              - 10.0.0.0/8
+              - 100.64.0.0/10
+              - 127.0.0.0/8
+              - 169.254.0.0/16
+              - 172.16.0.0/12
+              - 192.0.0.0/24
+              - 192.0.2.0/24
+              - 192.168.0.0/16
+              - 198.18.0.0/15
+              - 198.51.100.0/24
+              - 203.0.113.0/24
+              - 224.0.0.0/4
+              - 240.0.0.0/4
+      ports:
+        - protocol: TCP
+          port: 443
+    - to:
+        - ipBlock:
+            cidr: ::/0
+            except:
+              - ::/128
+              - ::1/128
+              - 64:ff9b::/96
+              - 64:ff9b:1::/48
+              - 100::/64
+              - 2001::/32
+              - 2001:db8::/32
+              - 2002::/16
+              - fc00::/7
+              - fe80::/10
+              - ff00::/8
+      ports:
+        - protocol: TCP
+          port: 443
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/harness-wrapper-pvc.yaml b/cmd/build/helmify/static/templates/harness-wrapper-pvc.yaml
new file mode 100644
index 000000000..70f413323
--- /dev/null
+++ b/cmd/build/helmify/static/templates/harness-wrapper-pvc.yaml
@@ -0,0 +1,21 @@
+{{- include "orka.validateHarnessV1" . }}
+{{- if eq .Values.controller.mode "harness-v1" }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "orka.harnessV1LedgerName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.harnessV1.ledger.size }}
+  {{- with .Values.harnessV1.ledger.storageClass }}
+  storageClassName: {{ . | quote }}
+  {{- end }}
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/harness-wrapper-secret.yaml b/cmd/build/helmify/static/templates/harness-wrapper-secret.yaml
deleted file mode 100644
index 4a3a5c968..000000000
--- a/cmd/build/helmify/static/templates/harness-wrapper-secret.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-{{- if not .Values.workers.harnessWrapper.auth.existingSecret }}
-{{- $secretName := include "orka.harnessWrapperAuthSecretName" . }}
-{{- $tokenKey := .Values.workers.harnessWrapper.auth.tokenKey | default "token" }}
-{{- $existing := lookup "v1" "Secret" .Release.Namespace $secretName }}
-{{- $existingToken := "" }}
-{{- if and $existing (hasKey $existing.data $tokenKey) }}
-{{- $existingToken = (index $existing.data $tokenKey | b64dec) }}
-{{- end }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ $secretName }}
-  labels:
-    {{- include "orka.labels" . | nindent 4 }}
-    app.kubernetes.io/component: agent-harness-wrapper
-type: Opaque
-stringData:
-  {{ $tokenKey }}: {{ default (default (randAlphaNum 32) $existingToken) .Values.workers.harnessWrapper.auth.token | quote }}
-{{- end }}
diff --git a/cmd/build/helmify/static/templates/harness-wrapper-service.yaml b/cmd/build/helmify/static/templates/harness-wrapper-service.yaml
index e6d5ddf10..cbbdbd3d3 100644
--- a/cmd/build/helmify/static/templates/harness-wrapper-service.yaml
+++ b/cmd/build/helmify/static/templates/harness-wrapper-service.yaml
@@ -1,7 +1,9 @@
+{{- include "orka.validateHarnessV1" . }}
+{{- if eq .Values.controller.mode "harness-v1" }}
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "orka.harnessWrapperName" . }}
+  name: {{ include "orka.harnessV1Name" . }}
   labels:
     {{- include "orka.labels" . | nindent 4 }}
     app.kubernetes.io/component: agent-harness-wrapper
@@ -10,7 +12,8 @@ spec:
     {{- include "orka.selectorLabels" . | nindent 4 }}
     app.kubernetes.io/component: agent-harness-wrapper
   ports:
-    - name: http
+    - name: https
       port: 8080
-      targetPort: http
+      targetPort: https
       protocol: TCP
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/harness-wrapper-serviceaccount.yaml b/cmd/build/helmify/static/templates/harness-wrapper-serviceaccount.yaml
new file mode 100644
index 000000000..24a7b8014
--- /dev/null
+++ b/cmd/build/helmify/static/templates/harness-wrapper-serviceaccount.yaml
@@ -0,0 +1,11 @@
+{{- include "orka.validateHarnessV1" . }}
+{{- if eq .Values.controller.mode "harness-v1" }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "orka.harnessV1Name" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper
+automountServiceAccountToken: false
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/provider-proxy-deployment.yaml b/cmd/build/helmify/static/templates/provider-proxy-deployment.yaml
new file mode 100644
index 000000000..cba838b6a
--- /dev/null
+++ b/cmd/build/helmify/static/templates/provider-proxy-deployment.yaml
@@ -0,0 +1,82 @@
+{{- include "orka.validateProviderProxyConfig" . }}
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.providerProxy.enabled }}
+{{- $secretName := .Values.providerProxy.auth.existingSecret | default (include "orka.providerProxyName" .) }}
+{{- $currentKey := .Values.providerProxy.auth.tokenKey | default "token" }}
+{{- $previousKey := .Values.providerProxy.auth.previousTokenKey | default "previous-token" }}
+{{- $previousValidUntilKey := .Values.providerProxy.auth.previousTokenValidUntilKey | default "previous-token-valid-until" }}
+{{- if or (eq $currentKey $previousKey) (eq $currentKey $previousValidUntilKey) (eq $previousKey $previousValidUntilKey) }}
+{{- fail "providerProxy auth token keys must differ" }}
+{{- end }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "orka.providerProxyName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: provider-auth-proxy
+spec:
+  replicas: 1
+  strategy: {type: Recreate}
+  selector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: provider-auth-proxy
+  template:
+    metadata:
+      {{- with .Values.providerProxy.rolloutNonce }}
+      annotations:
+        orka.ai/provider-auth-rollout-nonce: {{ . | quote }}
+      {{- end }}
+      labels:
+        {{- include "orka.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: provider-auth-proxy
+        orka.ai/network-role: provider-auth-proxy
+    spec:
+      serviceAccountName: {{ include "orka.providerProxyName" . }}
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile: {type: RuntimeDefault}
+      containers:
+        - name: proxy
+          image: {{ include "orka.imageRef" .Values.controller.image | quote }}
+          imagePullPolicy: {{ .Values.controller.image.pullPolicy }}
+          command: [/provider-auth-proxy]
+          args:
+            - --listen-address=:8080
+            - {{ printf "--upstream-base-url=%s" (include "orka.providerProxyUpstreamBaseURL" .) | quote }}
+            - --token-file=/var/run/secrets/orka/provider-auth/token
+            - --previous-token-file=/var/run/secrets/orka/provider-auth/previous-token
+            - --previous-token-valid-until-file=/var/run/secrets/orka/provider-auth/previous-token-valid-until
+            - {{ printf "--token-reload-interval=%s" (.Values.providerProxy.tokenReloadInterval | default "5s") | quote }}
+            - {{ printf "--previous-token-overlap=%s" (.Values.providerProxy.previousTokenOverlap | default "10m") | quote }}
+          ports: [{name: http, containerPort: 8080}]
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities: {drop: [ALL]}
+          resources:
+            {{- toYaml .Values.providerProxy.resources | nindent 12 }}
+          readinessProbe: {httpGet: {path: /readyz, port: http}}
+          livenessProbe: {httpGet: {path: /healthz, port: http}}
+          volumeMounts:
+            - {name: provider-auth, mountPath: /var/run/secrets/orka/provider-auth, readOnly: true}
+      volumes:
+        - name: provider-auth
+          projected:
+            defaultMode: 0440
+            sources:
+              - secret:
+                  name: {{ $secretName }}
+                  optional: true
+                  items:
+                    - key: {{ $currentKey }}
+                      path: token
+                    - key: {{ $previousKey }}
+                      path: previous-token
+                    - key: {{ $previousValidUntilKey }}
+                      path: previous-token-valid-until
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/provider-proxy-networkpolicy.yaml b/cmd/build/helmify/static/templates/provider-proxy-networkpolicy.yaml
new file mode 100644
index 000000000..3e7d953f9
--- /dev/null
+++ b/cmd/build/helmify/static/templates/provider-proxy-networkpolicy.yaml
@@ -0,0 +1,36 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.providerProxy.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "orka.providerProxyName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: provider-auth-proxy
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ .Values.controller.acpRuntime.namespace }}
+          podSelector:
+            matchLabels:
+              orka.ai/network-role: provider-client
+      ports: [{protocol: TCP, port: 8080}]
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels: {kubernetes.io/metadata.name: kube-system}
+          podSelector:
+            matchLabels: {k8s-app: kube-dns}
+      ports: [{protocol: UDP, port: 53}, {protocol: TCP, port: 53}]
+    - to:
+        - namespaceSelector:
+            matchLabels: {kubernetes.io/metadata.name: vekil-system}
+          podSelector:
+            matchLabels: {app.kubernetes.io/name: vekil}
+      ports: [{protocol: TCP, port: 1337}]
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/provider-proxy-secret.yaml b/cmd/build/helmify/static/templates/provider-proxy-secret.yaml
new file mode 100644
index 000000000..4c49d9ce9
--- /dev/null
+++ b/cmd/build/helmify/static/templates/provider-proxy-secret.yaml
@@ -0,0 +1,31 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.providerProxy.enabled (not .Values.providerProxy.auth.existingSecret) }}
+{{- $name := include "orka.providerProxyName" . }}
+{{- $key := .Values.providerProxy.auth.tokenKey | default "token" }}
+{{- $previousKey := .Values.providerProxy.auth.previousTokenKey | default "previous-token" }}
+{{- $previousValidUntilKey := .Values.providerProxy.auth.previousTokenValidUntilKey | default "previous-token-valid-until" }}
+{{- $previousToken := .Values.providerProxy.auth.previousToken | default "" }}
+{{- $previousValidUntil := .Values.providerProxy.auth.previousTokenValidUntil | default "" }}
+{{- if or (eq $key $previousKey) (eq $key $previousValidUntilKey) (eq $previousKey $previousValidUntilKey) }}
+{{- fail "providerProxy auth token keys must differ" }}
+{{- end }}
+{{- if ne (empty $previousToken) (empty $previousValidUntil) }}
+{{- fail "providerProxy.auth.previousToken and previousTokenValidUntil must be set together" }}
+{{- end }}
+{{- $existing := lookup "v1" "Secret" .Release.Namespace $name }}
+{{- $existingValue := "" }}
+{{- if and $existing (hasKey $existing.data $key) }}{{- $existingValue = (index $existing.data $key | b64dec) }}{{- end }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $name }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: provider-auth-proxy
+type: Opaque
+data:
+  {{ $key }}: {{ default (default (randAlphaNum 64) $existingValue) .Values.providerProxy.auth.token | toString | b64enc | quote }}
+  {{- if $previousToken }}
+  {{ $previousKey }}: {{ $previousToken | toString | b64enc | quote }}
+  {{ $previousValidUntilKey }}: {{ $previousValidUntil | toString | b64enc | quote }}
+  {{- end }}
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/provider-proxy-service.yaml b/cmd/build/helmify/static/templates/provider-proxy-service.yaml
new file mode 100644
index 000000000..ac79d3248
--- /dev/null
+++ b/cmd/build/helmify/static/templates/provider-proxy-service.yaml
@@ -0,0 +1,15 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.providerProxy.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "orka.providerProxyName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: provider-auth-proxy
+spec:
+  selector:
+    {{- include "orka.selectorLabels" . | nindent 4 }}
+    app.kubernetes.io/component: provider-auth-proxy
+  ports:
+    - {name: http, port: 8080, targetPort: http}
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/provider-proxy-serviceaccount.yaml b/cmd/build/helmify/static/templates/provider-proxy-serviceaccount.yaml
new file mode 100644
index 000000000..c1785784f
--- /dev/null
+++ b/cmd/build/helmify/static/templates/provider-proxy-serviceaccount.yaml
@@ -0,0 +1,10 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.providerProxy.enabled }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "orka.providerProxyName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: provider-auth-proxy
+automountServiceAccountToken: false
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/publisher-deployment.yaml b/cmd/build/helmify/static/templates/publisher-deployment.yaml
new file mode 100644
index 000000000..e28838faa
--- /dev/null
+++ b/cmd/build/helmify/static/templates/publisher-deployment.yaml
@@ -0,0 +1,113 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled (not .Values.scmEgressProxy.enabled) }}
+{{- fail "publisher.enabled requires scmEgressProxy.enabled so public HTTPS egress remains proxy-only" }}
+{{- end }}
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled }}
+{{- $scmProxySecretName := .Values.scmEgressProxy.auth.existingSecret | default (include "orka.scmEgressProxyAuthSecretName" .) }}
+{{- $scmProxyTokenKey := .Values.scmEgressProxy.auth.tokenKey | default "token" }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "orka.publisherName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: workspace-publisher
+spec:
+  replicas: 1
+  strategy: {type: Recreate}
+  selector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: workspace-publisher
+  template:
+    metadata:
+      {{- if or .Values.publisher.auth.rolloutNonce .Values.scmEgressProxy.auth.rolloutNonce }}
+      annotations:
+        {{- with .Values.publisher.auth.rolloutNonce }}
+        orka.ai/publisher-auth-rollout-nonce: {{ . | quote }}
+        {{- end }}
+        {{- with .Values.scmEgressProxy.auth.rolloutNonce }}
+        orka.ai/scm-egress-proxy-auth-rollout-nonce: {{ . | quote }}
+        {{- end }}
+      {{- end }}
+      labels:
+        {{- include "orka.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: workspace-publisher
+        orka.ai/network-role: workspace-publisher
+    spec:
+      serviceAccountName: {{ include "orka.publisherServiceAccountName" . }}
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile: {type: RuntimeDefault}
+      containers:
+        - name: publisher
+          image: {{ include "orka.imageRef" .Values.publisher.image | quote }}
+          imagePullPolicy: {{ .Values.publisher.image.pullPolicy }}
+          ports:
+            - {name: http, containerPort: 8080}
+          env:
+            - name: ORKA_SCM_EGRESS_PROXY_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $scmProxySecretName }}
+                  key: {{ $scmProxyTokenKey }}
+            - name: HTTPS_PROXY
+              value: {{ printf "http://orka-publisher:$(ORKA_SCM_EGRESS_PROXY_TOKEN)@%s.%s.svc:%v" (include "orka.scmEgressProxyName" .) .Release.Namespace 8080 | quote }}
+            - name: https_proxy
+              value: {{ printf "http://orka-publisher:$(ORKA_SCM_EGRESS_PROXY_TOKEN)@%s.%s.svc:%v" (include "orka.scmEgressProxyName" .) .Release.Namespace 8080 | quote }}
+            - {name: NO_PROXY, value: {{ .Values.scmEgressProxy.noProxy | quote }}}
+            - {name: no_proxy, value: {{ .Values.scmEgressProxy.noProxy | quote }}}
+            - {name: ORKA_PUBLISHER_SCM_EGRESS_PROXY_REQUIRED, value: "true"}
+            - {name: ORKA_PUBLISHER_LISTEN_ADDRESS, value: ":8080"}
+            - {name: ORKA_PUBLISHER_TEMP_ROOT, value: /tmp/orka-workspace-publisher/runtime}
+            - {name: ORKA_PUBLISHER_CONTROLLER_TOKEN_FILE, value: /var/run/orka/publisher-auth/controller-token}
+            - {name: ORKA_PUBLISHER_OPERATION_CAPABILITY_SECRET_FILE, value: /var/run/orka/publisher-auth/operation-capability-secret}
+            - name: ORKA_PUBLISHER_ARTIFACT_AUTHORIZATION_BROKER_URL
+              value: http://{{ include "orka.fullname" . }}:{{ .Values.service.port }}
+            - name: ORKA_PUBLISHER_ARTIFACT_API_URL
+              value: http://{{ include "orka.fullname" . }}:{{ .Values.service.port }}
+            - name: ORKA_PUBLISHER_CREDENTIAL_BROKER_URL
+              value: http://{{ include "orka.fullname" . }}:{{ .Values.service.port }}
+            - {name: ORKA_PUBLISHER_ALLOWED_SCM_HOSTS, value: {{ .Values.publisher.allowedSCMHosts | quote }}}
+            - {name: ORKA_PUBLISHER_GITHUB_PR_ENABLED, value: {{ .Values.publisher.githubPR.enabled | quote }}}
+            {{- if .Values.publisher.githubPR.enabled }}
+            - {name: ORKA_PUBLISHER_GITHUB_API_BASE_URL, value: {{ .Values.publisher.githubPR.apiBaseURL | quote }}}
+            - {name: ORKA_PUBLISHER_GITHUB_REQUEST_TIMEOUT, value: {{ .Values.publisher.githubPR.requestTimeout | quote }}}
+            - {name: ORKA_PUBLISHER_GITHUB_MAX_RESPONSE_BYTES, value: {{ printf "%d" (int64 .Values.publisher.githubPR.maxResponseBytes) | quote }}}
+            {{- end }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities: {drop: [ALL]}
+          resources:
+            {{- toYaml .Values.publisher.resources | nindent 12 }}
+          volumeMounts:
+            - {name: data, mountPath: /data}
+            - {name: tmp, mountPath: /tmp/orka-workspace-publisher}
+            - {name: publisher-auth, mountPath: /var/run/orka/publisher-auth/controller-token, subPath: controller-token, readOnly: true}
+            - {name: publisher-auth, mountPath: /var/run/orka/publisher-auth/operation-capability-secret, subPath: operation-capability-secret, readOnly: true}
+          readinessProbe:
+            httpGet: {path: /v1/health, port: http}
+          livenessProbe:
+            httpGet: {path: /v1/health, port: http}
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ include "orka.publisherName" . }}
+        - name: tmp
+          emptyDir: {sizeLimit: 1Gi}
+        - name: publisher-auth
+          secret:
+            secretName: {{ .Values.publisher.auth.existingSecret | default (include "orka.publisherAuthSecretName" .) }}
+            # subPath bind mounts expose regular files to the fail-closed
+            # publisher loader; fsGroup grants only the Pod group read access.
+            defaultMode: 0440
+            items:
+              - key: {{ .Values.publisher.auth.controllerTokenKey | default "controller-token" }}
+                path: controller-token
+              - key: {{ .Values.publisher.auth.capabilitySecretKey | default "operation-capability-secret" }}
+                path: operation-capability-secret
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/publisher-networkpolicy.yaml b/cmd/build/helmify/static/templates/publisher-networkpolicy.yaml
new file mode 100644
index 000000000..7833f4c23
--- /dev/null
+++ b/cmd/build/helmify/static/templates/publisher-networkpolicy.yaml
@@ -0,0 +1,40 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "orka.publisherName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: workspace-publisher
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: controller
+      ports: [{protocol: TCP, port: 8080}]
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels: {kubernetes.io/metadata.name: kube-system}
+          podSelector:
+            matchLabels: {k8s-app: kube-dns}
+      ports: [{protocol: UDP, port: 53}, {protocol: TCP, port: 53}]
+    - to:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: controller
+      ports: [{protocol: TCP, port: {{ .Values.controller.apiPort }}}]
+    - to:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: scm-egress-proxy
+      ports: [{protocol: TCP, port: 8080}]
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/publisher-pvc.yaml b/cmd/build/helmify/static/templates/publisher-pvc.yaml
new file mode 100644
index 000000000..4f503ec33
--- /dev/null
+++ b/cmd/build/helmify/static/templates/publisher-pvc.yaml
@@ -0,0 +1,17 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "orka.publisherName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: workspace-publisher
+spec:
+  accessModes: [ReadWriteOnce]
+  {{- if .Values.publisher.persistence.storageClass }}
+  storageClassName: {{ .Values.publisher.persistence.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.publisher.persistence.size }}
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/publisher-secret.yaml b/cmd/build/helmify/static/templates/publisher-secret.yaml
new file mode 100644
index 000000000..1b36da859
--- /dev/null
+++ b/cmd/build/helmify/static/templates/publisher-secret.yaml
@@ -0,0 +1,23 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled (not .Values.publisher.auth.existingSecret) }}
+{{- $name := include "orka.publisherAuthSecretName" . }}
+{{- $existing := lookup "v1" "Secret" .Release.Namespace $name }}
+{{- $controllerKey := .Values.publisher.auth.controllerTokenKey | default "controller-token" }}
+{{- $capabilityKey := .Values.publisher.auth.capabilitySecretKey | default "operation-capability-secret" }}
+{{- $existingController := "" }}
+{{- $existingCapability := "" }}
+{{- if $existing }}
+{{- if hasKey $existing.data $controllerKey }}{{- $existingController = (index $existing.data $controllerKey | b64dec) }}{{- end }}
+{{- if hasKey $existing.data $capabilityKey }}{{- $existingCapability = (index $existing.data $capabilityKey | b64dec) }}{{- end }}
+{{- end }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $name }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: workspace-publisher
+type: Opaque
+stringData:
+  {{ $controllerKey }}: {{ default (default (randAlphaNum 64) $existingController) .Values.publisher.auth.controllerToken | quote }}
+  {{ $capabilityKey }}: {{ default (default (randAlphaNum 64) $existingCapability) .Values.publisher.auth.capabilitySecret | quote }}
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/publisher-service.yaml b/cmd/build/helmify/static/templates/publisher-service.yaml
new file mode 100644
index 000000000..9b561dbfc
--- /dev/null
+++ b/cmd/build/helmify/static/templates/publisher-service.yaml
@@ -0,0 +1,17 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "orka.publisherName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: workspace-publisher
+spec:
+  selector:
+    {{- include "orka.selectorLabels" . | nindent 4 }}
+    app.kubernetes.io/component: workspace-publisher
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/rbac.yaml b/cmd/build/helmify/static/templates/rbac.yaml
index be674d840..c4ffe2fa8 100644
--- a/cmd/build/helmify/static/templates/rbac.yaml
+++ b/cmd/build/helmify/static/templates/rbac.yaml
@@ -1,198 +1,263 @@
 {{- if .Values.rbac.create -}}
-# Controller ClusterRole
+{{- $harnessV2 := eq .Values.controller.mode "harness-v2" -}}
+# Controller tenant Role. The release namespace is also the immutable watch namespace.
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
+kind: Role
 metadata:
-  name: {{ include "orka.fullname" . }}-controller
+  name: {{ include "orka.controllerName" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "orka.labels" . | nindent 4 }}
 rules:
-  # Custom Resource permissions
   - apiGroups: ["core.orka.ai"]
-    resources: ["tasks", "tools", "agents", "agentruntimes", "providers", "skills", "repositorymonitors", "repositoryscans", "substrateactorpools", "outboundaccesspolicies"]
+    resources: ["tasks", "tools", "agents", "agentruntimes", "runtimepools", "promptattempts", "runtimesessioncontrols", "publications", "controllerepochs", "externaleffects", "providers", "skills", "repositorymonitors", "repositoryscans", "substrateactorpools", "outboundaccesspolicies"]
     verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
   - apiGroups: ["core.orka.ai"]
-    resources: ["tasks/status", "tools/status", "agents/status", "agentruntimes/status", "providers/status", "skills/status", "repositorymonitors/status", "repositoryscans/status", "substrateactorpools/status", "outboundaccesspolicies/status"]
+    resources: ["tasks/status", "tools/status", "agents/status", "agentruntimes/status", "runtimepools/status", "promptattempts/status", "runtimesessioncontrols/status", "publications/status", "controllerepochs/status", "externaleffects/status", "providers/status", "skills/status", "repositorymonitors/status", "repositoryscans/status", "substrateactorpools/status", "outboundaccesspolicies/status"]
     verbs: ["get", "update", "patch"]
   - apiGroups: ["core.orka.ai"]
-    resources: ["tasks/finalizers", "tools/finalizers", "agents/finalizers", "agentruntimes/finalizers", "providers/finalizers", "skills/finalizers", "repositorymonitors/finalizers", "repositoryscans/finalizers", "substrateactorpools/finalizers", "outboundaccesspolicies/finalizers"]
+    resources: ["tasks/finalizers", "tools/finalizers", "agents/finalizers", "agentruntimes/finalizers", "runtimepools/finalizers", "promptattempts/finalizers", "runtimesessioncontrols/finalizers", "publications/finalizers", "controllerepochs/finalizers", "externaleffects/finalizers", "providers/finalizers", "skills/finalizers", "repositorymonitors/finalizers", "repositoryscans/finalizers", "substrateactorpools/finalizers", "outboundaccesspolicies/finalizers"]
     verbs: ["update"]
+  {{- if $harnessV2 }}
   - apiGroups: ["gateway.orka.ai"]
-    resources: ["gatewayclasses", "gateways", "gatewaybindings"]
+    resources: ["gateways", "gatewaybindings"]
     verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
   - apiGroups: ["gateway.orka.ai"]
-    resources: ["gatewayclasses/status", "gateways/status", "gatewaybindings/status"]
+    resources: ["gateways/status", "gatewaybindings/status"]
     verbs: ["get", "update", "patch"]
   - apiGroups: ["gateway.orka.ai"]
-    resources: ["gatewayclasses/finalizers", "gateways/finalizers", "gatewaybindings/finalizers"]
+    resources: ["gateways/finalizers", "gatewaybindings/finalizers"]
     verbs: ["update"]
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    resourceNames: ["tasks.core.orka.ai", "gatewayclasses.gateway.orka.ai", "gateways.gateway.orka.ai", "gatewaybindings.gateway.orka.ai"]
-    verbs: ["get"]
-
-  # Provider-neutral Execution Workspace control plane
   - apiGroups: ["workspace.orka.ai"]
-    resources: ["executionworkspaceclasses"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete", "use"]
+    resources: ["executionworkspaces", "executionworkspaceclasses", "executionworkspacepools"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  # The workspace admission policies gate spec.coreAdmission writes on the
+  # "admit" verb and class-backed Task/Tool creation on the "use" verb, so the
+  # controller needs both or fail-closed admission rejects its own writes.
   - apiGroups: ["workspace.orka.ai"]
     resources: ["executionworkspaces"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete", "admit"]
-  - apiGroups: ["workspace.orka.ai"]
-    resources: ["executionworkspacepools"]
-    verbs: ["get", "list", "watch"]
+    verbs: ["admit"]
   - apiGroups: ["workspace.orka.ai"]
-    resources: ["executionworkspaceproviders"]
-    verbs: ["get", "list", "watch", "update", "patch"]
+    resources: ["executionworkspaceclasses"]
+    verbs: ["use"]
   - apiGroups: ["workspace.orka.ai"]
-    resources: ["executionworkspaceproviders/status", "executionworkspaceclasses/status", "executionworkspacepools/status", "executionworkspaces/status"]
+    resources: ["executionworkspaces/status", "executionworkspaceclasses/status", "executionworkspacepools/status"]
     verbs: ["get", "update", "patch"]
   - apiGroups: ["workspace.orka.ai"]
-    resources: ["executionworkspaceproviders/finalizers", "executionworkspaceclasses/finalizers", "executionworkspaces/finalizers"]
+    resources: ["executionworkspaces/finalizers", "executionworkspaceclasses/finalizers"]
     verbs: ["update"]
-
-  # Job permissions
+  - apiGroups: ["extensions.agents.x-k8s.io"]
+    resources: ["sandboxclaims"]
+    verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
+  - apiGroups: ["extensions.agents.x-k8s.io"]
+    resources: ["sandboxtemplates", "sandboxwarmpools"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["agents.x-k8s.io"]
+    resources: ["sandboxes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["ate.dev"]
+    resources: ["actortemplates"]
+    verbs: ["get", "list", "watch"]
+  {{- end }}
   - apiGroups: ["batch"]
     resources: ["jobs"]
     verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
   - apiGroups: ["batch"]
     resources: ["cronjobs"]
     verbs: ["get", "list", "watch"]
-
-  # Core resource permissions
   - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: [""]
-    resources: ["secrets"]
+    resources: ["configmaps", "secrets", "pods", "services"]
     verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "list", "watch"]
   - apiGroups: [""]
     resources: ["pods/log"]
     verbs: ["get"]
   - apiGroups: [""]
-    resources: ["pods/status"]
+    resources: ["pods/status", "endpoints", "persistentvolumeclaims", "replicationcontrollers"]
     verbs: ["get", "list", "watch"]
   - apiGroups: [""]
     resources: ["serviceaccounts"]
     verbs: ["get", "list", "watch", "create", "update"]
   - apiGroups: [""]
-    resources: ["serviceaccounts/token"]
+    resources: ["serviceaccounts/token", "pods/portforward"]
     verbs: ["create"]
-  - apiGroups: [""]
-    resources: ["namespaces"]
-    verbs: ["get", "list", "watch"]
   - apiGroups: [""]
     resources: ["events"]
     verbs: ["get", "list", "watch", "create", "patch"]
-  - apiGroups: [""]
-    resources: ["nodes", "services", "endpoints"]
-    verbs: ["get", "list", "watch"]
   - apiGroups: ["discovery.k8s.io"]
     resources: ["endpointslices"]
     verbs: ["get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["persistentvolumes", "persistentvolumeclaims", "replicationcontrollers"]
-    verbs: ["get", "list", "watch"]
-
-  # Workload resource permissions (read-only, for chat K8s tools)
   - apiGroups: ["apps"]
-    resources: ["deployments", "replicasets", "statefulsets", "daemonsets"]
+    resources: ["deployments", "replicasets"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["apps"]
+    resources: ["statefulsets", "daemonsets"]
     verbs: ["get", "list", "watch"]
   - apiGroups: ["networking.k8s.io"]
     resources: ["ingresses"]
     verbs: ["get", "list", "watch"]
   - apiGroups: ["networking.k8s.io"]
     resources: ["networkpolicies"]
-    verbs: ["get", "list", "watch", "create", "delete"]
-  # Agent sandbox workspace backend: create/reattach/delete claims and connect to sandbox pods
-  - apiGroups: ["extensions.agents.x-k8s.io"]
-    resources: ["sandboxclaims"]
-    verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
-  - apiGroups: ["extensions.agents.x-k8s.io"]
-    resources: ["sandboxtemplates", "sandboxwarmpools"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["agents.x-k8s.io"]
-    resources: ["sandboxes"]
-    verbs: ["get", "list", "watch"]
-  # Substrate workspace backend: validate approved ActorTemplates before job creation
-  - apiGroups: ["ate.dev"]
-    resources: ["actortemplates"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["pods/portforward"]
-    verbs: ["create"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
   - apiGroups: ["autoscaling"]
     resources: ["horizontalpodautoscalers"]
     verbs: ["get", "list", "watch"]
   - apiGroups: ["policy"]
     resources: ["poddisruptionbudgets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["storage.k8s.io"]
-    resources: ["storageclasses"]
-    verbs: ["get", "list", "watch"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
   - apiGroups: ["events.k8s.io"]
     resources: ["events"]
     verbs: ["get", "list"]
   - apiGroups: ["metrics.k8s.io"]
-    resources: ["pods", "nodes"]
+    resources: ["pods"]
     verbs: ["get", "list"]
-
-  # RBAC permissions (for chat K8s tools and managed worker bindings)
-  - apiGroups: ["rbac.authorization.k8s.io"]
-    resources: ["clusterroles", "roles", "rolebindings"]
-    verbs: ["get", "list", "watch"]
   - apiGroups: ["rbac.authorization.k8s.io"]
     resources: ["roles", "rolebindings"]
-    verbs: ["create", "update", "delete"]
-  - apiGroups: ["rbac.authorization.k8s.io"]
-    resources: ["clusterrolebindings"]
     verbs: ["get", "list", "watch", "create", "update", "delete"]
-  - apiGroups: ["rbac.authorization.k8s.io"]
-    resources: ["clusterroles"]
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "orka.controllerName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "orka.controllerName" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "orka.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- if $harnessV2 }}
+---
+# Runtime child resources are confined to the v2 installation's runtime namespace.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "orka.controllerName" . }}-runtime
+  namespace: {{ .Values.controller.acpRuntime.namespace }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+rules:
+  - apiGroups: ["apps"]
+    resources: ["deployments", "replicasets"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["pods", "services", "secrets"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["networkpolicies"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["policy"]
+    resources: ["poddisruptionbudgets"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "orka.controllerName" . }}-runtime
+  namespace: {{ .Values.controller.acpRuntime.namespace }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "orka.controllerName" . }}-runtime
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "orka.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}
+---
+# Minimal cluster-scoped controller authority. Namespaced workload access is never bound here.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "orka.controllerClusterRoleName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources: ["namespaces"]
     resourceNames:
-      - {{ include "orka.aiWorkerClusterRoleName" . }}
-      - {{ include "orka.vendorWorkerClusterRoleName" . }}
-      - {{ include "orka.containerWorkerClusterRoleName" . }}
-    verbs: ["bind"]
-
-  # TokenReview authenticates caller tokens; SubjectAccessReview authorizes Kubernetes callers
+      - {{ .Release.Namespace }}
+      {{- if $harnessV2 }}
+      - {{ .Values.controller.acpRuntime.namespace }}
+      {{- end }}
+    verbs: ["get"]
   - apiGroups: ["authentication.k8s.io"]
     resources: ["tokenreviews"]
     verbs: ["create"]
   - apiGroups: ["authorization.k8s.io"]
     resources: ["subjectaccessreviews"]
     verbs: ["create"]
-
-  # Leader election
-  - apiGroups: ["coordination.k8s.io"]
-    resources: ["leases"]
+  - apiGroups: ["rbac.authorization.k8s.io"]
+    resources: ["clusterroles"]
+    resourceNames:
+      - {{ include "orka.aiWorkerClusterRoleName" . }}
+      - {{ include "orka.vendorWorkerClusterRoleName" . }}
+      - {{ include "orka.containerWorkerClusterRoleName" . }}
+    verbs: ["bind"]
+  {{- if $harnessV2 }}
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    resourceNames: ["tasks.core.orka.ai", "gatewayclasses.gateway.orka.ai", "gateways.gateway.orka.ai", "gatewaybindings.gateway.orka.ai"]
+    verbs: ["get"]
+  - apiGroups: ["core.orka.ai"]
+    resources: ["branchclaims"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["core.orka.ai"]
+    resources: ["branchclaims/status"]
+    verbs: ["get", "update", "patch"]
+  - apiGroups: ["core.orka.ai"]
+    resources: ["branchclaims/finalizers"]
+    verbs: ["update"]
+  - apiGroups: ["gateway.orka.ai"]
+    resources: ["gatewayclasses"]
     verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["gateway.orka.ai"]
+    resources: ["gatewayclasses/status"]
+    verbs: ["get", "update", "patch"]
+  - apiGroups: ["gateway.orka.ai"]
+    resources: ["gatewayclasses/finalizers"]
+    verbs: ["update"]
+  - apiGroups: ["workspace.orka.ai"]
+    resources: ["executionworkspaceproviders"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: ["workspace.orka.ai"]
+    resources: ["executionworkspaceproviders/status"]
+    verbs: ["get", "update", "patch"]
+  - apiGroups: ["workspace.orka.ai"]
+    resources: ["executionworkspaceproviders/finalizers"]
+    verbs: ["update"]
+  {{- end }}
 ---
-# Controller ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ include "orka.fullname" . }}-controller
+  name: {{ include "orka.controllerClusterRoleName" . }}
   labels:
     {{- include "orka.labels" . | nindent 4 }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: {{ include "orka.fullname" . }}-controller
+  name: {{ include "orka.controllerClusterRoleName" . }}
 subjects:
   - kind: ServiceAccount
     name: {{ include "orka.serviceAccountName" . }}
     namespace: {{ .Release.Namespace }}
 ---
-# Client ClusterRole (for API access)
+# Client Role (for API access in this installation's namespace)
 {{- if .Values.client.create }}
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
+kind: Role
 metadata:
   name: {{ include "orka.fullname" . }}-client
+  namespace: {{ include "orka.clientNamespace" . }}
   labels:
     {{- include "orka.labels" . | nindent 4 }}
 rules:
@@ -227,10 +292,12 @@ rules:
     resources: ["skills"]
     verbs: ["get", "list", "watch"]
 
+  {{- if $harnessV2 }}
   # Generic gateway resource permissions (read-only; durable ledgers use the Orka REST API).
   - apiGroups: ["gateway.orka.ai"]
     resources: ["gateways", "gatewaybindings"]
     verbs: ["get", "list", "watch"]
+  {{- end }}
 
   # ConfigMap permissions (for results and sessions)
   - apiGroups: [""]
@@ -238,28 +305,21 @@ rules:
     verbs: ["get", "list", "watch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-{{- if .Values.controller.enforceNamespaceIsolation }}
 kind: RoleBinding
 metadata:
   name: {{ include "orka.fullname" . }}-client
   namespace: {{ include "orka.clientNamespace" . }}
   labels:
     {{- include "orka.labels" . | nindent 4 }}
-{{- else }}
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "orka.fullname" . }}-client
-  labels:
-    {{- include "orka.labels" . | nindent 4 }}
-{{- end }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
+  kind: Role
   name: {{ include "orka.fullname" . }}-client
 subjects:
   - kind: ServiceAccount
     name: {{ .Values.client.name }}
     namespace: {{ include "orka.clientNamespace" . }}
+{{- if $harnessV2 }}
 ---
 # GatewayClass is cluster-scoped, so isolated clients need a separate ClusterRoleBinding for read access.
 apiVersion: rbac.authorization.k8s.io/v1
@@ -288,6 +348,7 @@ subjects:
     name: {{ .Values.client.name }}
     namespace: {{ include "orka.clientNamespace" . }}
 {{- end }}
+{{- end }}
 ---
 # AI Worker Role (trusted worker with Kubernetes tool and code_exec permissions)
 apiVersion: rbac.authorization.k8s.io/v1
@@ -304,7 +365,7 @@ rules:
     resources: ["secrets"]
     verbs: ["get", "create", "update", "delete"]
   - apiGroups: ["core.orka.ai"]
-    resources: ["tools", "outboundaccesspolicies"]
+    resources: ["tools"]
     verbs: ["get", "list"]
   - apiGroups: ["core.orka.ai"]
     resources: ["agents"]
@@ -372,20 +433,12 @@ rules:
     verbs: ["get", "list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-{{- if .Values.controller.enforceNamespaceIsolation }}
 kind: RoleBinding
 metadata:
-  name: {{ include "orka.aiWorkerClusterRoleBindingName" . }}
+  name: {{ include "orka.aiWorkerRoleBindingName" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "orka.labels" . | nindent 4 }}
-{{- else }}
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "orka.aiWorkerClusterRoleBindingName" . }}
-  labels:
-    {{- include "orka.labels" . | nindent 4 }}
-{{- end }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -407,7 +460,7 @@ rules:
     resources: ["configmaps"]
     verbs: ["get", "list", "watch"]
   - apiGroups: ["core.orka.ai"]
-    resources: ["tools", "outboundaccesspolicies"]
+    resources: ["tools"]
     verbs: ["get", "list"]
   - apiGroups: ["core.orka.ai"]
     resources: ["agents"]
@@ -466,20 +519,12 @@ rules:
     verbs: ["get", "list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-{{- if .Values.controller.enforceNamespaceIsolation }}
 kind: RoleBinding
 metadata:
-  name: {{ include "orka.vendorWorkerClusterRoleBindingName" . }}
+  name: {{ include "orka.vendorWorkerRoleBindingName" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "orka.labels" . | nindent 4 }}
-{{- else }}
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "orka.vendorWorkerClusterRoleBindingName" . }}
-  labels:
-    {{- include "orka.labels" . | nindent 4 }}
-{{- end }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -506,20 +551,12 @@ rules:
     verbs: ["get"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-{{- if .Values.controller.enforceNamespaceIsolation }}
 kind: RoleBinding
 metadata:
-  name: {{ include "orka.containerWorkerClusterRoleBindingName" . }}
+  name: {{ include "orka.containerWorkerRoleBindingName" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "orka.labels" . | nindent 4 }}
-{{- else }}
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "orka.containerWorkerClusterRoleBindingName" . }}
-  labels:
-    {{- include "orka.labels" . | nindent 4 }}
-{{- end }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -528,48 +565,4 @@ subjects:
   - kind: ServiceAccount
     name: {{ include "orka.containerWorkerServiceAccountName" . }}
     namespace: {{ .Release.Namespace }}
-
----
-# Adapter charts aggregate read-only access to their provider-specific parameter CRDs here.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "orka.fullname" . }}-workspace-parameter-reader
-  labels:
-    {{- include "orka.labels" . | nindent 4 }}
-aggregationRule:
-  clusterRoleSelectors:
-    - matchLabels:
-        workspace.orka.ai/aggregate-to-parameter-reader: "true"
-rules: []
-{{- if .Values.controller.workspaceProvider.fakeProviderEnabled }}
----
-# Development-only fake provider parameters contribute to the aggregate reader.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "orka.fullname" . }}-fake-workspace-parameter-reader
-  labels:
-    {{- include "orka.labels" . | nindent 4 }}
-    workspace.orka.ai/aggregate-to-parameter-reader: "true"
-rules:
-  - apiGroups: ["fake.workspace.orka.ai"]
-    resources: ["fakeproviderconfigs", "fakepoolparameters"]
-    verbs: ["get", "list", "watch"]
-{{- end }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "orka.fullname" . }}-workspace-parameter-reader
-  labels:
-    {{- include "orka.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ include "orka.fullname" . }}-workspace-parameter-reader
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "orka.serviceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
 {{- end }}
diff --git a/cmd/build/helmify/static/templates/runtime-namespace.yaml b/cmd/build/helmify/static/templates/runtime-namespace.yaml
new file mode 100644
index 000000000..94295f497
--- /dev/null
+++ b/cmd/build/helmify/static/templates/runtime-namespace.yaml
@@ -0,0 +1,13 @@
+{{- if eq .Values.controller.mode "harness-v2" }}
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .Values.controller.acpRuntime.namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "orka.name" . }}
+    app.kubernetes.io/component: acp-runtime
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/warn: restricted
+    pod-security.kubernetes.io/audit: restricted
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/scm-egress-proxy-deployment.yaml b/cmd/build/helmify/static/templates/scm-egress-proxy-deployment.yaml
new file mode 100644
index 000000000..434969dc6
--- /dev/null
+++ b/cmd/build/helmify/static/templates/scm-egress-proxy-deployment.yaml
@@ -0,0 +1,86 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled .Values.scmEgressProxy.enabled }}
+{{- $secretName := .Values.scmEgressProxy.auth.existingSecret | default (include "orka.scmEgressProxyAuthSecretName" .) }}
+{{- $tokenKey := .Values.scmEgressProxy.auth.tokenKey | default "token" }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "orka.scmEgressProxyName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: scm-egress-proxy
+spec:
+  replicas: 1
+  strategy: {type: Recreate}
+  selector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: scm-egress-proxy
+  template:
+    metadata:
+      {{- with .Values.scmEgressProxy.auth.rolloutNonce }}
+      annotations:
+        orka.ai/scm-egress-proxy-auth-rollout-nonce: {{ . | quote }}
+      {{- end }}
+      labels:
+        {{- include "orka.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: scm-egress-proxy
+        orka.ai/network-role: scm-egress-proxy
+    spec:
+      serviceAccountName: {{ include "orka.scmEgressProxyName" . }}
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile: {type: RuntimeDefault}
+      containers:
+        - name: proxy
+          image: {{ include "orka.imageRef" .Values.controller.image | quote }}
+          imagePullPolicy: {{ .Values.controller.image.pullPolicy }}
+          command: [/scm-egress-proxy]
+          args:
+            - --listen-address=:8080
+            - {{ printf "--allowed-hosts=%s" .Values.publisher.allowedSCMHosts | quote }}
+            {{- if .Values.publisher.githubPR.enabled }}
+            - {{ printf "--forge-api-base-url=%s" .Values.publisher.githubPR.apiBaseURL | quote }}
+            {{- else }}
+            - --forge-api-base-url=
+            {{- end }}
+            - --token-file=/var/run/secrets/orka/scm-egress/token
+            - {{ printf "--max-request-header-bytes=%d" (int64 .Values.scmEgressProxy.maxRequestHeaderBytes) | quote }}
+            - {{ printf "--max-response-header-bytes=%d" (int64 .Values.scmEgressProxy.maxResponseHeaderBytes) | quote }}
+            - {{ printf "--max-request-bytes=%d" (int64 .Values.scmEgressProxy.maxRequestBytes) | quote }}
+            - {{ printf "--max-response-bytes=%d" (int64 .Values.scmEgressProxy.maxResponseBytes) | quote }}
+            - {{ printf "--max-tunnel-bytes=%d" (int64 .Values.scmEgressProxy.maxTunnelBytes) | quote }}
+            - {{ printf "--max-concurrent=%v" .Values.scmEgressProxy.maxConcurrent | quote }}
+            - {{ printf "--resolution-timeout=%s" .Values.scmEgressProxy.resolutionTimeout | quote }}
+            - {{ printf "--connect-timeout=%s" .Values.scmEgressProxy.connectTimeout | quote }}
+            - {{ printf "--response-header-timeout=%s" .Values.scmEgressProxy.responseHeaderTimeout | quote }}
+            - {{ printf "--forward-timeout=%s" .Values.scmEgressProxy.forwardTimeout | quote }}
+            - {{ printf "--idle-timeout=%s" .Values.scmEgressProxy.idleTimeout | quote }}
+            - {{ printf "--tunnel-timeout=%s" .Values.scmEgressProxy.tunnelTimeout | quote }}
+          ports:
+            - {name: http-proxy, containerPort: 8080}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities: {drop: [ALL]}
+          resources:
+            {{- toYaml .Values.scmEgressProxy.resources | nindent 12 }}
+          readinessProbe:
+            httpGet: {path: /readyz, port: http-proxy}
+          livenessProbe:
+            httpGet: {path: /healthz, port: http-proxy}
+          volumeMounts:
+            - {name: auth, mountPath: /var/run/secrets/orka/scm-egress/token, subPath: token, readOnly: true}
+      volumes:
+        - name: auth
+          secret:
+            secretName: {{ $secretName }}
+            defaultMode: 0440
+            items:
+              - key: {{ $tokenKey }}
+                path: token
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/scm-egress-proxy-networkpolicy.yaml b/cmd/build/helmify/static/templates/scm-egress-proxy-networkpolicy.yaml
new file mode 100644
index 000000000..0687aa907
--- /dev/null
+++ b/cmd/build/helmify/static/templates/scm-egress-proxy-networkpolicy.yaml
@@ -0,0 +1,63 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled .Values.scmEgressProxy.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "orka.scmEgressProxyName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: scm-egress-proxy
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: workspace-publisher
+      ports: [{protocol: TCP, port: 8080}]
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels: {kubernetes.io/metadata.name: kube-system}
+          podSelector:
+            matchLabels: {k8s-app: kube-dns}
+      ports: [{protocol: UDP, port: 53}, {protocol: TCP, port: 53}]
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 0.0.0.0/8
+              - 10.0.0.0/8
+              - 100.64.0.0/10
+              - 127.0.0.0/8
+              - 169.254.0.0/16
+              - 172.16.0.0/12
+              - 192.0.0.0/24
+              - 192.0.2.0/24
+              - 192.168.0.0/16
+              - 198.18.0.0/15
+              - 198.51.100.0/24
+              - 203.0.113.0/24
+              - 224.0.0.0/4
+              - 240.0.0.0/4
+      ports: [{protocol: TCP, port: 443}]
+    - to:
+        - ipBlock:
+            cidr: ::/0
+            except:
+              - ::/128
+              - ::1/128
+              - 64:ff9b::/96
+              - 64:ff9b:1::/48
+              - 100::/64
+              - 2001::/32
+              - 2001:db8::/32
+              - 2002::/16
+              - fc00::/7
+              - fe80::/10
+              - ff00::/8
+      ports: [{protocol: TCP, port: 443}]
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/scm-egress-proxy-secret.yaml b/cmd/build/helmify/static/templates/scm-egress-proxy-secret.yaml
new file mode 100644
index 000000000..609dd6cf9
--- /dev/null
+++ b/cmd/build/helmify/static/templates/scm-egress-proxy-secret.yaml
@@ -0,0 +1,21 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled .Values.scmEgressProxy.enabled (not .Values.scmEgressProxy.auth.existingSecret) }}
+{{- $name := include "orka.scmEgressProxyAuthSecretName" . }}
+{{- $key := .Values.scmEgressProxy.auth.tokenKey | default "token" }}
+{{- $explicit := .Values.scmEgressProxy.auth.token | default "" | toString }}
+{{- if and $explicit (not (regexMatch "^[A-Za-z0-9._~-]{32,256}$" $explicit)) }}
+{{- fail "scmEgressProxy.auth.token must contain 32-256 RFC 3986 unreserved characters" }}
+{{- end }}
+{{- $existing := lookup "v1" "Secret" .Release.Namespace $name }}
+{{- $existingValue := "" }}
+{{- if and $existing (hasKey $existing.data $key) }}{{- $existingValue = (index $existing.data $key | b64dec) }}{{- end }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $name }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: scm-egress-proxy
+type: Opaque
+stringData:
+  {{ $key }}: {{ default (default (randAlphaNum 64) $existingValue) $explicit | quote }}
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/scm-egress-proxy-service.yaml b/cmd/build/helmify/static/templates/scm-egress-proxy-service.yaml
new file mode 100644
index 000000000..f57291c70
--- /dev/null
+++ b/cmd/build/helmify/static/templates/scm-egress-proxy-service.yaml
@@ -0,0 +1,15 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled .Values.scmEgressProxy.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "orka.scmEgressProxyName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: scm-egress-proxy
+spec:
+  selector:
+    {{- include "orka.selectorLabels" . | nindent 4 }}
+    app.kubernetes.io/component: scm-egress-proxy
+  ports:
+    - {name: http-proxy, port: 8080, targetPort: http-proxy}
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/scm-egress-proxy-serviceaccount.yaml b/cmd/build/helmify/static/templates/scm-egress-proxy-serviceaccount.yaml
new file mode 100644
index 000000000..11fc06334
--- /dev/null
+++ b/cmd/build/helmify/static/templates/scm-egress-proxy-serviceaccount.yaml
@@ -0,0 +1,10 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled .Values.scmEgressProxy.enabled }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "orka.scmEgressProxyName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: scm-egress-proxy
+automountServiceAccountToken: false
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/serviceaccount.yaml b/cmd/build/helmify/static/templates/serviceaccount.yaml
index e7c65e6b9..0bea13d7d 100644
--- a/cmd/build/helmify/static/templates/serviceaccount.yaml
+++ b/cmd/build/helmify/static/templates/serviceaccount.yaml
@@ -11,6 +11,21 @@ metadata:
   {{- end }}
 {{- end }}
 ---
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled .Values.publisher.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "orka.publisherServiceAccountName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: workspace-publisher
+  {{- with .Values.publisher.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: false
+{{- end }}
+---
 {{- if .Values.client.create }}
 apiVersion: v1
 kind: ServiceAccount
@@ -48,11 +63,3 @@ metadata:
     {{- include "orka.labels" . | nindent 4 }}
     orka.ai/worker: "true"
     orka.ai/worker-trust: "container"
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "orka.harnessWrapperName" . }}
-  labels:
-    {{- include "orka.labels" . | nindent 4 }}
-    app.kubernetes.io/component: agent-harness-wrapper
diff --git a/cmd/build/helmify/static/templates/store-pvc.yaml b/cmd/build/helmify/static/templates/store-pvc.yaml
index b13ba6e81..9463d9224 100644
--- a/cmd/build/helmify/static/templates/store-pvc.yaml
+++ b/cmd/build/helmify/static/templates/store-pvc.yaml
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: {{ include "orka.fullname" . }}-store
+  name: {{ include "orka.storeName" . }}
   labels:
     {{- include "orka.labels" . | nindent 4 }}
     app.kubernetes.io/component: store
diff --git a/cmd/build/helmify/static/templates/vekil-ingress-networkpolicy.yaml b/cmd/build/helmify/static/templates/vekil-ingress-networkpolicy.yaml
new file mode 100644
index 000000000..b5549c1e9
--- /dev/null
+++ b/cmd/build/helmify/static/templates/vekil-ingress-networkpolicy.yaml
@@ -0,0 +1,24 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.providerProxy.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "orka.vekilIngressPolicyName" . }}
+  namespace: vekil-system
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: provider-auth-proxy
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: vekil
+  policyTypes: [Ingress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ .Release.Namespace }}
+          podSelector:
+            matchLabels:
+              orka.ai/network-role: provider-auth-proxy
+      ports: [{protocol: TCP, port: 1337}]
+{{- end }}
diff --git a/cmd/build/helmify/static/templates/workspace-class-use-webhook.yaml b/cmd/build/helmify/static/templates/workspace-class-use-webhook.yaml
deleted file mode 100644
index 216d9678f..000000000
--- a/cmd/build/helmify/static/templates/workspace-class-use-webhook.yaml
+++ /dev/null
@@ -1,66 +0,0 @@
-{{- $workspaceProvider := .Values.controller.workspaceProvider | default dict -}}
-{{- $classUseAdmission := $workspaceProvider.classUseAdmission | default dict -}}
-{{- if $classUseAdmission.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "orka.fullname" . }}-workspace-webhook
-  labels:
-    {{- include "orka.labels" . | nindent 4 }}
-    app.kubernetes.io/component: controller
-spec:
-  ports:
-    - name: https
-      port: 443
-      targetPort: webhook-server
-      protocol: TCP
-  selector:
-    {{- include "orka.selectorLabels" . | nindent 4 }}
-    app.kubernetes.io/component: controller
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: {{ include "orka.fullname" . }}-workspace-class-use
-  labels:
-    {{- include "orka.labels" . | nindent 4 }}
-webhooks:
-  - name: taskworkspaceclassuse.core.orka.ai
-    admissionReviewVersions: ["v1"]
-    sideEffects: None
-    failurePolicy: Fail
-    matchPolicy: Equivalent
-    timeoutSeconds: 10
-    clientConfig:
-      service:
-        name: {{ include "orka.fullname" . }}-workspace-webhook
-        namespace: {{ .Release.Namespace }}
-        path: /validate-core-orka-ai-v1alpha1-task-workspace-class-use
-        port: 443
-      caBundle: {{ $classUseAdmission.caBundle | quote }}
-    rules:
-      - operations: ["CREATE", "UPDATE"]
-        apiGroups: ["core.orka.ai"]
-        apiVersions: ["v1alpha1"]
-        resources: ["tasks"]
-        scope: Namespaced
-  - name: toolworkspaceclassuse.core.orka.ai
-    admissionReviewVersions: ["v1"]
-    sideEffects: None
-    failurePolicy: Fail
-    matchPolicy: Equivalent
-    timeoutSeconds: 10
-    clientConfig:
-      service:
-        name: {{ include "orka.fullname" . }}-workspace-webhook
-        namespace: {{ .Release.Namespace }}
-        path: /validate-core-orka-ai-v1alpha1-tool-workspace-class-use
-        port: 443
-      caBundle: {{ $classUseAdmission.caBundle | quote }}
-    rules:
-      - operations: ["CREATE", "UPDATE"]
-        apiGroups: ["core.orka.ai"]
-        apiVersions: ["v1alpha1"]
-        resources: ["tools"]
-        scope: Namespaced
-{{- end }}
diff --git a/cmd/build/helmify/static/templates/workspace-crd-upgrade-guard.yaml b/cmd/build/helmify/static/templates/workspace-crd-upgrade-guard.yaml
deleted file mode 100644
index 561ba7849..000000000
--- a/cmd/build/helmify/static/templates/workspace-crd-upgrade-guard.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-{{- $workspaceProvider := .Values.controller.workspaceProvider | default dict -}}
-{{- if $workspaceProvider.apiEnabled -}}
-{{- $workspaceCRD := lookup "apiextensions.k8s.io/v1" "CustomResourceDefinition" "" "executionworkspaces.workspace.orka.ai" -}}
-{{- $schemaReady := false -}}
-{{- if $workspaceCRD -}}
-  {{- range $version := $workspaceCRD.spec.versions -}}
-    {{- if eq $version.name "v1alpha1" -}}
-      {{- $properties := $version.schema.openAPIV3Schema.properties.spec.properties -}}
-      {{- if hasKey $properties "coreAdmission" -}}
-        {{- $schemaReady = true -}}
-      {{- end -}}
-    {{- end -}}
-  {{- end -}}
-{{- end -}}
-{{- $schemaCheckOverridden := $workspaceProvider.crdUpgradeSchemaVerified | default false -}}
-{{- if and (or .Release.IsUpgrade $workspaceCRD) (not $schemaReady) (not $schemaCheckOverridden) -}}
-  {{- fail "controller.workspaceProvider.apiEnabled requires the current workspace CRDs; apply them with `helm show crds <chart> | kubectl apply --server-side -f -`, or set controller.workspaceProvider.crdUpgradeSchemaVerified=true only for offline rendering after independent verification" -}}
-{{- end -}}
-{{- end -}}
diff --git a/cmd/build/helmify/static/values.yaml b/cmd/build/helmify/static/values.yaml
index b3aa75189..2b470dba3 100644
--- a/cmd/build/helmify/static/values.yaml
+++ b/cmd/build/helmify/static/values.yaml
@@ -2,6 +2,10 @@
 
 # Controller configuration
 controller:
+  # Required immutable execution contract for this installation. Install v1
+  # and v2 as separate releases; one release never serves both contracts.
+  mode: ""
+
   # Number of controller replicas
   replicas: 1
 
@@ -9,6 +13,7 @@ controller:
   image:
     repository: ghcr.io/orka-agents/orka
     tag: "0.1.1"
+    digest: ""
     pullPolicy: IfNotPresent
 
   # Resource limits
@@ -20,7 +25,8 @@ controller:
       cpu: 100m
       memory: 256Mi
 
-  # Watch namespace (empty for cluster-scoped)
+  # Required exclusive tenant namespace. Label it with
+  # orka.ai/controller-mode matching controller.mode before startup.
   watchNamespace: ""
 
   # API server port
@@ -32,37 +38,60 @@ controller:
   # Health probe port
   healthPort: 8082
 
-  # Enable leader election for HA
+  # Leader election is mandatory for the singleton SQLite controller.
   leaderElect: true
 
   # Log level (debug, info, warn, error)
   logLevel: info
 
-  # Enforce namespace isolation (restrict users to their SA namespace)
-  enforceNamespaceIsolation: true
-
   # Max active tasks per namespace (0 = unlimited)
   maxTasksPerNamespace: 0
 
-  # Provider-neutral workspace.orka.ai control plane (disabled by default during rollout).
-  # Before enabling it during a Helm upgrade, apply the current chart CRDs explicitly;
-  # Helm does not upgrade CRDs from the crds/ directory and the chart fails closed otherwise.
-  workspaceProvider:
-    # Enable generic provider/class/pool/workspace coordination controllers.
-    apiEnabled: false
-    # Offline helm template --is-upgrade cannot use lookup. Set this only after
-    # independently verifying/applying the current workspace CRD schema.
-    crdUpgradeSchemaVerified: false
-    # Enable the development-only fake provider adapter.
-    fakeProviderEnabled: false
-    # Fail-closed Kubernetes admission required whenever apiEnabled is true.
-    classUseAdmission:
-      enabled: false
-      # Existing TLS Secret with tls.crt and tls.key for the webhook Service DNS name.
-      existingSecret: ""
-      # Base64-encoded PEM CA bundle trusted by the API server.
-      caBundle: ""
-
+  # Operation-scoped ACP artifact transport stored on the controller PVC.
+  acpArtifact:
+    existingSecret: ""
+    secretKey: capability-secret
+    secret: ""
+    maxBytes: 536870912
+
+  # Encryption key for immutable agent execution snapshots. When either agent
+  # execution protocol is enabled, both fields must reference an existing
+  # Secret. The selected value must contain exactly 32 raw bytes or its base64
+  # encoding. The Secret name, item key, and selected key material must remain
+  # unchanged for the lifetime of the release so retained snapshots stay
+  # decryptable.
+  agentExecutionSnapshot:
+    existingSecret: ""
+    key: ""
+    # A snapshot must remain unreferenced for this full period before GC.
+    retention: 720h
+    # Reference-aware GC scan cadence.
+    retentionInterval: 1h
+
+  # Managed ACP core RuntimePools for built-in agent Tasks.
+  acpRuntime:
+    # Used only when controller.mode is harness-v2; there is no v1 fallback.
+    namespace: orka-runtimes
+    # The chart-managed provider proxy always runs in the Helm release namespace.
+    # Leave empty or set exactly to .Release.Namespace; other values are rejected.
+    providerProxyNamespace: ""
+    # Configure each provider that should be available with an immutable
+    # repository@sha256:<digest> reference. Empty providers remain unavailable
+    # and Tasks selecting them fail closed.
+    codexImage: ""
+    claudeImage: ""
+    copilotImage: ""
+    opencodeImage: ""
+    # Planned controller upgrades use a same-binary preStop child to call a
+    # loopback-only coordinator. Keep terminationGracePeriodSeconds greater
+    # than timeout and triggerTimeout so SIGTERM shutdown still has headroom.
+    upgradeDrain:
+      enabled: true
+      port: 8083
+      timeout: 5m
+      pollInterval: 1s
+      triggerTimeout: 5m15s
+      terminationGracePeriodSeconds: 360
   # Provider-neutral external gateway plane.
   gateway:
     enabled: true
@@ -199,6 +228,206 @@ controller:
     # Exact namespace/name:port tuples trusted for cross-namespace token endpoint refs.
     trustedTokenEndpointServices: []
 
+# Fail-closed admission served by this release's internal webhook Service. The
+# certificate must authenticate <release>-orka-webhook.<namespace>.svc.
+webhooks:
+  tls:
+    # Required. The chart never generates webhook certificates.
+    existingSecret: ""
+    certKey: tls.crt
+    privateKeyKey: tls.key
+  # Base64-encoded PEM CA bundle. Leave empty when an injector annotation is
+  # configured below.
+  caBundle: ""
+  # For example: cert-manager.io/inject-ca-from-secret: orka-v2/orka-webhook-tls
+  caInjectionAnnotations: {}
+  timeoutSeconds: 10
+
+# Clean-room Workspace/Publisher service.
+publisher:
+  enabled: true
+  image:
+    repository: ghcr.io/orka-agents/orka/workspace-publisher
+    tag: "0.1.1"
+    digest: ""
+    pullPolicy: IfNotPresent
+  allowedSCMHosts: github.com
+  githubPR:
+    enabled: true
+    apiBaseURL: https://api.github.com
+    requestTimeout: 15s
+    maxResponseBytes: 4194304
+  auth:
+    existingSecret: ""
+    controllerTokenKey: controller-token
+    capabilitySecretKey: operation-capability-secret
+    controllerToken: ""
+    capabilitySecret: ""
+    # Non-secret revision marker. When rotating the publisher auth Secret, bump
+    # this value in the same Helm upgrade to restart controller and publisher.
+    rolloutNonce: ""
+  serviceAccount:
+    create: true
+    name: ""
+    annotations: {}
+  persistence:
+    size: 2Gi
+    storageClass: ""
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+      ephemeral-storage: 512Mi
+    limits:
+      cpu: "2"
+      memory: 2Gi
+      ephemeral-storage: 2Gi
+
+# Authenticated, exact-host HTTPS egress boundary for the Workspace/Publisher.
+# The Publisher has no direct public 443 egress; Git and forge API traffic must
+# use this proxy, which re-resolves and validates every outbound connection.
+scmEgressProxy:
+  enabled: true
+  noProxy: localhost,127.0.0.1,::1,.svc,.cluster.local
+  maxRequestHeaderBytes: 32768
+  maxResponseHeaderBytes: 65536
+  maxRequestBytes: 4194304
+  maxResponseBytes: 8388608
+  maxTunnelBytes: 1073741824
+  maxConcurrent: 8
+  resolutionTimeout: 5s
+  connectTimeout: 10s
+  responseHeaderTimeout: 30s
+  forwardTimeout: 2m
+  idleTimeout: 30s
+  tunnelTimeout: 10m
+  auth:
+    existingSecret: ""
+    tokenKey: token
+    # Existing Secret tokens must use only RFC 3986 unreserved characters and
+    # be 32-256 bytes so they can be carried in authenticated proxy userinfo.
+    token: ""
+    # Non-secret revision marker. When rotating the SCM proxy auth Secret, bump
+    # this value in the same Helm upgrade to restart publisher and SCM proxy.
+    rolloutNonce: ""
+  resources:
+    requests:
+      cpu: 25m
+      memory: 32Mi
+      ephemeral-storage: 32Mi
+    limits:
+      cpu: 500m
+      memory: 256Mi
+      ephemeral-storage: 128Mi
+
+# Authenticated boundary in front of the otherwise unauthenticated Vekil
+# service. ACP RuntimePods can reach only this Service, never Vekil directly.
+providerProxy:
+  enabled: false
+  # Only this chart-supported Vekil Service endpoint is accepted. One trailing
+  # slash is normalized; alternate hosts, namespaces, and ports are rejected.
+  upstreamBaseURL: http://vekil.vekil-system.svc:1337
+  # Mounted Secret files are reloaded atomically; no proxy Pod restart is
+  # required for token changes. Reload failures make readiness fail and disable
+  # all authenticated forwarding until both files are valid again.
+  tokenReloadInterval: 5s
+  # Maximum remaining lifetime accepted from the overlap token's absolute
+  # deadline. Periodic reloads and Pod restarts cannot extend it. Maximum: 24h.
+  previousTokenOverlap: 10m
+  # Optional operator-controlled restart input for binary/flag changes or
+  # recovery. Change it to force only the provider-auth-proxy Pod to roll.
+  rolloutNonce: ""
+  auth:
+    existingSecret: ""
+    tokenKey: token
+    token: ""
+    # Optional overlap key/value. Existing single-token Secrets remain valid
+    # when this key is absent. For proxy-first rotation, publish new as current
+    # and old here, wait for proxy reload, then roll controller/runtime pools.
+    # For controller-first use, first pre-stage new here while current remains
+    # old and verify it through the proxy; only then publish new as current and
+    # old here and roll controller/runtime pools. The pre-staged token covers a
+    # controller request that arrives before the proxy observes the role swap.
+    # Remove the old token after all workloads advertise the new generation.
+    # previousTokenValidUntil must be an absolute RFC3339/RFC3339Nano time no
+    # later than previousTokenOverlap from when the proxy loads it.
+    previousTokenKey: previous-token
+    previousToken: ""
+    previousTokenValidUntilKey: previous-token-valid-until
+    previousTokenValidUntil: ""
+  resources:
+    requests:
+      cpu: 25m
+      memory: 32Mi
+      ephemeral-storage: 32Mi
+    limits:
+      cpu: 250m
+      memory: 128Mi
+      ephemeral-storage: 128Mi
+
+# orka.harness.v1 data plane configuration. It is rendered only when
+# controller.mode is harness-v1 and is never an ACP fallback.
+harnessV1:
+  dispatch:
+    interval: 1s
+    workers: 1
+  upgradeDrain:
+    # Before an upgrade, rollback, or deletion mutates an existing wrapper, a
+    # Helm hook durably closes admission and proves that no unsettled turns
+    # remain. Keep this below Helm's default five-minute operation timeout.
+    timeout: 4m
+    pollInterval: 2s
+    resources:
+      requests:
+        cpu: 10m
+        memory: 32Mi
+        ephemeral-storage: 16Mi
+      limits:
+        cpu: 100m
+        memory: 64Mi
+        ephemeral-storage: 64Mi
+  image:
+    repository: ghcr.io/orka-agents/orka/agent-harness-wrapper
+    tag: "0.1.1"
+    # Required when controller.mode is harness-v1. Tags are never accepted for
+    # a running wrapper.
+    digest: ""
+    pullPolicy: IfNotPresent
+  auth:
+    # Use a dedicated operator-created Secret. Bearer credentials are never
+    # accepted through Helm values or emitted into rendered release manifests.
+    # The Secret source and key are immutable while a harness-v1 wrapper
+    # Deployment exists because controller attempts pin its resourceVersion.
+    existingSecret: ""
+    tokenKey: token
+  tls:
+    # Use a different operator-created Secret containing tls.crt, tls.key, and
+    # ca.crt. Its serving certificate must authenticate the release-scoped
+    # Service DNS name: <release>-orka-agent-harness-wrapper.<namespace>.svc.
+    existingSecret: ""
+    # Bump this non-secret revision whenever certificate data changes without
+    # changing existingSecret. The chart drains the live wrapper before it
+    # restarts both the wrapper and controller onto the new TLS generation.
+    rolloutNonce: ""
+  ledger:
+    # The admission ledger is always PVC-backed when harness v1 is enabled.
+    size: 1Gi
+    storageClass: ""
+    # Controller-acknowledged terminal records remain replay-safe for this
+    # audit/backup window before bounded wrapper GC may reclaim them.
+    retention: 720h
+  # Codex defaults to workspace-write. Broader modes require explicit policy.
+  codexSandboxMode: workspace-write
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+      ephemeral-storage: 512Mi
+    limits:
+      cpu: "2"
+      memory: 2Gi
+      ephemeral-storage: 2Gi
+
 # Worker configuration
 workers:
   ai:
@@ -212,21 +441,6 @@ workers:
       repository: ghcr.io/orka-agents/orka/general-worker
       tag: "0.1.1"
 
-  harnessWrapper:
-    image:
-      repository: ghcr.io/orka-agents/orka/agent-harness-wrapper
-      tag: "0.1.1"
-      pullPolicy: IfNotPresent
-    auth:
-      # Existing Secret containing the shared wrapper bearer token.
-      # When existingSecret and token are both empty, Helm generates a release-local token.
-      existingSecret: ""
-      tokenKey: token
-      token: ""
-    # Optional Codex CLI sandbox mode for the Codex adapter.
-    codexSandboxMode: ""
-    resources: {}
-
 # GitHub webhook and label-trigger configuration.
 # Configure a repository webhook to POST to /webhooks/github with the secret below.
 github:
@@ -307,7 +521,7 @@ annotations: {}
 store:
   path: /data/orka.db
   persistence:
-    enabled: true        # durable gateway inbox/outbox and Session history require a PVC
+    enabled: true        # ACP control records, gateway history, and Session state require durable RWO storage
     size: 1Gi
     storageClass: ""     # use cluster default
     accessMode: ReadWriteOnce
@@ -318,6 +532,7 @@ client:
   create: true
   # Name of the client service account
   name: orka-client
-  # Namespace for the client service account. Empty defaults to controller.watchNamespace
-  # when namespace isolation is enforced and watchNamespace is set, otherwise the release namespace.
+  # Namespace for the client service account. Empty defaults to
+  # controller.watchNamespace. A different namespace is not supported by an
+  # isolated installation.
   namespace: ""
diff --git a/cmd/cli/helpers_test.go b/cmd/cli/helpers_test.go
index 4971b9035..3bf903a96 100644
--- a/cmd/cli/helpers_test.go
+++ b/cmd/cli/helpers_test.go
@@ -611,7 +611,7 @@ func TestRootCmdIncludesCoverageCommands(t *testing.T) {
 	cmd := newRootCmd()
 	want := []string{
 		"provider", "tool", "session", "secret", "security", "monitor",
-		"memory", "auth", "models", "workspace", "substrate",
+		"memory", "auth", "models", "workspace", "runtime-pool", "agent-runtime", "substrate",
 	}
 	seen := map[string]bool{}
 	for _, sub := range cmd.Commands() {
diff --git a/cmd/cli/main.go b/cmd/cli/main.go
index 36a4c902e..28ea28813 100644
--- a/cmd/cli/main.go
+++ b/cmd/cli/main.go
@@ -74,6 +74,8 @@ func newRootCmd() *cobra.Command {
 	cmd.AddCommand(newAuthCmd())
 	cmd.AddCommand(newModelsCmd())
 	cmd.AddCommand(newWorkspaceCmd())
+	cmd.AddCommand(newRuntimePoolCmd())
+	cmd.AddCommand(newAgentRuntimeCmd())
 	cmd.AddCommand(newSubstrateCmd())
 	cmd.AddCommand(newGatewayCmd())
 
diff --git a/cmd/cli/misc_commands.go b/cmd/cli/misc_commands.go
index 1656b95a1..d3ae7581f 100644
--- a/cmd/cli/misc_commands.go
+++ b/cmd/cli/misc_commands.go
@@ -91,36 +91,34 @@ func safeWorkspaceStatus(task client.TaskDetail) map[string]any {
 		"task":      client.StringField(task, "metadata", "name"),
 		"namespace": client.StringField(task, "metadata", "namespace"),
 	}
-	status, _ := task["status"].(map[string]any)
-	if status == nil {
-		return out
-	}
+	status := nestedMap(task, "status")
 	out["phase"] = status["phase"]
-	if ew, ok := status["executionWorkspace"].(map[string]any); ok {
-		safe := map[string]any{}
-		for _, key := range []string{
-			"phase",
-			"provider",
-			"reason",
-			"message",
-			"url",
-			"lastTransitionTime",
-			"observedGeneration",
-		} {
-			if v, ok := ew[key]; ok {
-				safe[key] = v
-			}
-		}
-		out["executionWorkspace"] = safe
-	}
-	if ws, ok := status["workspace"].(map[string]any); ok {
-		safe := map[string]any{}
-		for _, key := range []string{"phase", "provider", "reason", "message", "url", "lastTransitionTime"} {
-			if v, ok := ws[key]; ok {
-				safe[key] = v
-			}
-		}
+
+	spec := nestedMap(task, "spec")
+	workspace := nestedMap(spec, "workspace")
+	if len(workspace) > 0 {
+		safe := copyKeys(workspace,
+			"intent", "gitRepo", "sourceRepository", "branch", "ref", "subPath",
+			"publicationGitRepo", "publicationRepository", "pushBranch", "prBaseBranch", "createPR")
+		safe["readCredentialConfigured"] = len(nestedMap(workspace, "readCredentialRef")) > 0
+		safe["publicationReadCredentialConfigured"] = len(nestedMap(workspace, "publicationReadCredentialRef")) > 0
+		publicationWriteConfigured := len(nestedMap(workspace, "publicationCredentialRef")) > 0
+		// Preserve the existing summary field while making the write-only role explicit.
+		safe["publicationCredentialConfigured"] = publicationWriteConfigured
+		safe["publicationWriteCredentialConfigured"] = publicationWriteConfigured
+		safe["forgeCredentialConfigured"] = len(nestedMap(workspace, "forgeCredentialRef")) > 0
 		out["workspace"] = safe
 	}
+	if executionWorkspace := nestedMap(status, "executionWorkspace"); len(executionWorkspace) > 0 {
+		out["executionWorkspace"] = copyKeys(executionWorkspace,
+			"phase", "provider", "reason", "message", "reusePolicy", "cleanupPolicy", "reused",
+			"placement", "density", "resumeLatency", "lastUpdateTime")
+	}
+	if delivery := nestedMap(status, "delivery"); len(delivery) > 0 {
+		out["delivery"] = copyKeys(delivery,
+			"state", "outcome", "reason", "publicationID", "sourceRepository", "publicationRepository",
+			"branch", "expectedCommitSHA", "verifiedRemoteSHA", "supersedingRemoteSHA", "artifactDigest",
+			"prReceipt", "message", "lastTransitionTime")
+	}
 	return out
 }
diff --git a/cmd/cli/resource_commands.go b/cmd/cli/resource_commands.go
index 560b2ffe9..9771918e4 100644
--- a/cmd/cli/resource_commands.go
+++ b/cmd/cli/resource_commands.go
@@ -11,17 +11,18 @@ import (
 )
 
 type crudResourceSpec struct {
-	Use       string
-	Short     string
-	BasePath  string
-	Name      string
-	ReadOnly  bool
-	NoGet     bool
-	NoCreate  bool
-	NoUpdate  bool
-	NoDelete  bool
-	ListFlags func(*cobra.Command)
-	ListQuery func(*cobra.Command) map[string]string
+	Use          string
+	Short        string
+	BasePath     string
+	Name         string
+	ReadOnly     bool
+	NoGet        bool
+	NoCreate     bool
+	NoUpdate     bool
+	NoDelete     bool
+	ListFlags    func(*cobra.Command)
+	ListQuery    func(*cobra.Command) map[string]string
+	TablePrinter func(*cobra.Command, any) error
 }
 
 func newCRUDResourceCmd(spec crudResourceSpec) *cobra.Command {
@@ -69,6 +70,13 @@ func newCRUDListCmd(spec crudResourceSpec) *cobra.Command {
 			if err != nil {
 				return err
 			}
+			format, err := outputFormat(cmd)
+			if err != nil {
+				return err
+			}
+			if format == outputTable && spec.TablePrinter != nil {
+				return spec.TablePrinter(cmd, result)
+			}
 			return printStructured(cmd, result)
 		},
 	}
@@ -93,6 +101,13 @@ func newCRUDGetCmd(spec crudResourceSpec) *cobra.Command {
 			if err != nil {
 				return err
 			}
+			format, err := outputFormat(cmd)
+			if err != nil {
+				return err
+			}
+			if format == outputTable && spec.TablePrinter != nil {
+				return spec.TablePrinter(cmd, result)
+			}
 			return printStructured(cmd, result)
 		},
 	}
diff --git a/cmd/cli/runtime.go b/cmd/cli/runtime.go
new file mode 100644
index 000000000..bb5585ffc
--- /dev/null
+++ b/cmd/cli/runtime.go
@@ -0,0 +1,132 @@
+package main
+
+import (
+	"fmt"
+	"text/tabwriter"
+
+	"github.com/spf13/cobra"
+)
+
+func newRuntimePoolCmd() *cobra.Command {
+	return newCRUDResourceCmd(crudResourceSpec{
+		Use:          "runtime-pool",
+		Short:        "Manage controller-owned ACP runtime pools",
+		BasePath:     "/api/v1/runtime-pools",
+		Name:         "runtime pool",
+		ReadOnly:     true,
+		TablePrinter: printRuntimePoolTable,
+	})
+}
+
+func newAgentRuntimeCmd() *cobra.Command {
+	return newCRUDResourceCmd(crudResourceSpec{
+		Use:          "agent-runtime",
+		Short:        "Manage external orka.harness.v2 AgentRuntime registrations",
+		BasePath:     "/api/v1/agent-runtimes",
+		Name:         "agent runtime",
+		TablePrinter: printAgentRuntimeTable,
+	})
+}
+
+func printRuntimePoolTable(cmd *cobra.Command, value any) error {
+	items := listItems(value)
+	if len(items) == 0 {
+		fmt.Fprintln(cmd.OutOrStdout(), "No runtime pools found.") //nolint:errcheck
+		return nil
+	}
+	w := tabwriter.NewWriter(cmd.OutOrStdout(), 0, 4, 2, ' ', 0)
+	fmt.Fprintln(w, "NAME\tNAMESPACE\tLIFECYCLE\tADMISSION\tPODS\tSESSIONS\tPROMPTS\tQUEUED\tAGE") //nolint:errcheck
+	for _, item := range items {
+		status := nestedMap(item, "status")
+		capacity := nestedMap(status, "capacity")
+		pods := fmt.Sprintf("%s/%s", dash(anyString(status["currentReplicas"])), dash(anyString(status["desiredReplicas"])))
+		sessions := fmt.Sprintf("%s/%s", dash(anyString(capacity["residentSessions"])), dash(anyString(capacity["maxResidentSessions"])))
+		prompts := fmt.Sprintf("%s/%s", dash(anyString(capacity["runningPrompts"])), dash(anyString(capacity["maxRunningPrompts"])))
+		fmt.Fprintf( //nolint:errcheck
+			w,
+			"%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n",
+			dash(nestedString(item, "metadata", "name")),
+			dash(nestedString(item, "metadata", "namespace")),
+			dash(anyString(status["lifecycle"])),
+			dash(anyString(status["admissionState"])),
+			pods,
+			sessions,
+			prompts,
+			dash(anyString(capacity["queuedTasks"])),
+			dash(formatAge(nestedString(item, "metadata", "creationTimestamp"))),
+		) //nolint:errcheck
+	}
+	return w.Flush()
+}
+
+func printAgentRuntimeTable(cmd *cobra.Command, value any) error {
+	items := listItems(value)
+	if len(items) == 0 {
+		fmt.Fprintln(cmd.OutOrStdout(), "No agent runtimes found.") //nolint:errcheck
+		return nil
+	}
+	w := tabwriter.NewWriter(cmd.OutOrStdout(), 0, 4, 2, ' ', 0)
+	fmt.Fprintln(w, "NAME\tNAMESPACE\tREADY\tCONTRACT\tINTENT\tPROVIDER/MODEL\tINSTANCE\tAGE") //nolint:errcheck
+	for _, item := range items {
+		spec := nestedMap(item, "spec")
+		status := nestedMap(item, "status")
+		capabilities := nestedMap(spec, "capabilities")
+		profile := nestedMap(capabilities, "profile")
+		observed := nestedMap(status, "observedCapabilities")
+		provider := firstString(observed, "providerKind")
+		if provider == "" {
+			provider = firstString(profile, "providerKind")
+		}
+		model := firstString(observed, "model")
+		if model == "" {
+			model = firstString(profile, "model")
+		}
+		instance := firstString(observed, "runtimeInstanceID")
+		if instance == "" {
+			instance = firstString(capabilities, "runtimeInstanceID")
+		}
+		fmt.Fprintf( //nolint:errcheck
+			w,
+			"%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n",
+			dash(nestedString(item, "metadata", "name")),
+			dash(nestedString(item, "metadata", "namespace")),
+			dash(anyString(status["ready"])),
+			dash(anyString(spec["contractVersion"])),
+			dash(anyString(profile["workspaceIntent"])),
+			dash(joinNonEmpty(provider, model, "/")),
+			dash(compactCLIValue(instance)),
+			dash(formatAge(nestedString(item, "metadata", "creationTimestamp"))),
+		) //nolint:errcheck
+	}
+	return w.Flush()
+}
+
+func nestedMap(m map[string]any, keys ...string) map[string]any {
+	current := m
+	for _, key := range keys {
+		next, ok := current[key].(map[string]any)
+		if !ok {
+			return map[string]any{}
+		}
+		current = next
+	}
+	return current
+}
+
+func joinNonEmpty(left, right, separator string) string {
+	if left == "" {
+		return right
+	}
+	if right == "" {
+		return left
+	}
+	return left + separator + right
+}
+
+func compactCLIValue(value string) string {
+	const max = 30
+	if len(value) <= max {
+		return value
+	}
+	return value[:17] + "…" + value[len(value)-8:]
+}
diff --git a/cmd/cli/runtime_test.go b/cmd/cli/runtime_test.go
new file mode 100644
index 000000000..7a7b5928e
--- /dev/null
+++ b/cmd/cli/runtime_test.go
@@ -0,0 +1,91 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestRuntimePoolListRendersCapacityAndAdmission(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v1/runtime-pools" {
+			t.Fatalf("path = %s", r.URL.Path)
+		}
+		json.NewEncoder(w).Encode(map[string]any{ //nolint:errcheck
+			"items": []map[string]any{{
+				"metadata": map[string]any{"name": "codex-read", "namespace": "default"},
+				"status": map[string]any{
+					"lifecycle": "Serving", "admissionState": "Accepting", "currentReplicas": 1, "desiredReplicas": 1,
+					"capacity": map[string]any{"residentSessions": 3, "maxResidentSessions": 10, "runningPrompts": 2, "maxRunningPrompts": 4, "queuedTasks": 1},
+				},
+			}},
+		})
+	}))
+	defer server.Close()
+
+	var out bytes.Buffer
+	root := newRootCmd()
+	root.SetOut(&out)
+	root.SetErr(&out)
+	root.SetArgs([]string{"--server", server.URL, "--token", "test-token", "runtime-pool", "list"})
+	if err := root.Execute(); err != nil {
+		t.Fatal(err)
+	}
+	for _, want := range []string{"codex-read", "Serving", "Accepting", "3/10", "2/4"} {
+		if !strings.Contains(out.String(), want) {
+			t.Fatalf("output missing %q:\n%s", want, out.String())
+		}
+	}
+}
+
+func TestAgentRuntimeListRendersOnlyV2Identity(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		json.NewEncoder(w).Encode(map[string]any{ //nolint:errcheck
+			"items": []map[string]any{{
+				"metadata": map[string]any{"name": "external-codex", "namespace": "default"},
+				"spec": map[string]any{
+					"contractVersion": "orka.harness.v2",
+					"capabilities": map[string]any{
+						"runtimeInstanceID": "external-instance-1",
+						"profile":           map[string]any{"workspaceIntent": "read", "providerKind": "openai", "model": "gpt-5"},
+					},
+				},
+				"status": map[string]any{"ready": true},
+			}},
+		})
+	}))
+	defer server.Close()
+
+	var out bytes.Buffer
+	root := newRootCmd()
+	root.SetOut(&out)
+	root.SetErr(&out)
+	root.SetArgs([]string{"--server", server.URL, "--token", "test-token", "agent-runtime", "list"})
+	if err := root.Execute(); err != nil {
+		t.Fatal(err)
+	}
+	for _, want := range []string{"external-codex", "true", "orka.harness.v2", "read", "openai/gpt-5"} {
+		if !strings.Contains(out.String(), want) {
+			t.Fatalf("output missing %q:\n%s", want, out.String())
+		}
+	}
+	for _, legacy := range []string{"supportsContinuation", "toolExecutionModes", "brokeredToolClasses"} {
+		if strings.Contains(out.String(), legacy) {
+			t.Fatalf("output contains legacy field %q: %s", legacy, out.String())
+		}
+	}
+}
+
+func TestRuntimePoolCommandIsReadOnly(t *testing.T) {
+	cmd := newRuntimePoolCmd()
+	for _, child := range cmd.Commands() {
+		switch child.Name() {
+		case "list", "get":
+		default:
+			t.Fatalf("unexpected mutating RuntimePool command %q", child.Name())
+		}
+	}
+}
diff --git a/cmd/cli/task.go b/cmd/cli/task.go
index 4a3edbb78..f350f62e9 100644
--- a/cmd/cli/task.go
+++ b/cmd/cli/task.go
@@ -39,6 +39,7 @@ func newTaskCmd() *cobra.Command {
 	cmd.AddCommand(newTaskCreateCmd())
 	cmd.AddCommand(newTaskListCmd())
 	cmd.AddCommand(newTaskGetCmd())
+	cmd.AddCommand(newTaskRuntimeStatusCmd())
 	cmd.AddCommand(newTaskLogsCmd())
 	cmd.AddCommand(newTaskEventsCmd())
 	cmd.AddCommand(newTaskFollowCmd())
@@ -62,6 +63,7 @@ func newTaskCreateCmd() *cobra.Command {
 	var commandVals, argVals, envVals []string
 	var priority int32
 	var suspend bool
+	var workspaceOptions taskWorkspaceCreateOptions
 
 	cmd := &cobra.Command{
 		Use:   "create <prompt>",
@@ -155,7 +157,26 @@ func newTaskCreateCmd() *cobra.Command {
 				}
 			}
 
-			result, err := c.CreateTask(context.Background(), req)
+			workspace, err := workspaceOptions.build(cmd, taskType)
+			if err != nil {
+				return err
+			}
+			body, err := json.Marshal(req)
+			if err != nil {
+				return fmt.Errorf("marshal task request: %w", err)
+			}
+			if workspace != nil {
+				var payload map[string]any
+				if err := json.Unmarshal(body, &payload); err != nil {
+					return fmt.Errorf("prepare task workspace request: %w", err)
+				}
+				payload["workspace"] = workspace
+				body, err = json.Marshal(payload)
+				if err != nil {
+					return fmt.Errorf("marshal task workspace request: %w", err)
+				}
+			}
+			result, err := c.CreateTaskRaw(context.Background(), body)
 			if err != nil {
 				return err
 			}
@@ -186,6 +207,7 @@ func newTaskCreateCmd() *cobra.Command {
 	cmd.Flags().StringVar(&schedule, "schedule", "", "Cron schedule for recurring tasks")
 	cmd.Flags().StringVar(&timezone, "timezone", "", "IANA time zone for scheduled tasks")
 	cmd.Flags().BoolVar(&suspend, "suspend", false, "Suspend scheduled task runs")
+	workspaceOptions.bindFlags(cmd)
 
 	return cmd
 }
diff --git a/cmd/cli/task_test.go b/cmd/cli/task_test.go
index 7afe36cf7..b50ca2b08 100644
--- a/cmd/cli/task_test.go
+++ b/cmd/cli/task_test.go
@@ -62,7 +62,7 @@ func TestNewTaskCmd(t *testing.T) {
 	for _, sub := range cmd.Commands() {
 		subNames[sub.Use] = true
 	}
-	for _, want := range []string{"create <prompt>", "list", "get <name>", "logs <name>", "delete <name>"} {
+	for _, want := range []string{"create <prompt>", "list", "get <name>", "status <name>", "logs <name>", "delete <name>"} {
 		if !subNames[want] {
 			t.Errorf("missing subcommand %q", want)
 		}
@@ -73,7 +73,13 @@ func TestNewTaskCreateCmdFlags(t *testing.T) {
 	cmd := newTaskCreateCmd()
 
 	// Verify flags
-	for _, flagName := range []string{"type", "agent", "provider", "timeout"} {
+	for _, flagName := range []string{
+		"type", "agent", "provider", "timeout", "workspace-intent", "git-repo",
+		"read-credential", "read-credential-key", "publication-git-repo",
+		"publication-read-credential", "publication-read-credential-key",
+		"publication-credential", "publication-credential-key", "forge-credential", "forge-credential-key",
+		"push-branch", "create-pr",
+	} {
 		if cmd.Flags().Lookup(flagName) == nil {
 			t.Errorf("missing flag %q", flagName)
 		}
diff --git a/cmd/cli/task_workspace.go b/cmd/cli/task_workspace.go
new file mode 100644
index 000000000..3145794af
--- /dev/null
+++ b/cmd/cli/task_workspace.go
@@ -0,0 +1,269 @@
+package main
+
+import (
+	"fmt"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/spf13/cobra"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/cli/client"
+)
+
+type taskWorkspaceCreateOptions struct {
+	intent                        string
+	gitRepo                       string
+	sourceRepositoryProvider      string
+	sourceRepositoryID            string
+	branch                        string
+	ref                           string
+	subPath                       string
+	readCredential                string
+	readCredentialKey             string
+	publicationGitRepo            string
+	publicationRepositoryProvider string
+	publicationRepositoryID       string
+	publicationReadCredential     string
+	publicationReadCredentialKey  string
+	publicationCredential         string
+	publicationCredentialKey      string
+	forgeCredential               string
+	forgeCredentialKey            string
+	pushBranch                    string
+	prBaseBranch                  string
+	createPR                      bool
+}
+
+func (o *taskWorkspaceCreateOptions) bindFlags(cmd *cobra.Command) {
+	cmd.Flags().StringVar(&o.intent, "workspace-intent", "read", "Agent workspace intent: read or write")
+	cmd.Flags().StringVar(&o.gitRepo, "git-repo", "", "Source repository URL (credentials must not be embedded)")
+	cmd.Flags().StringVar(&o.sourceRepositoryProvider, "source-repository-provider", "", "Canonical source repository provider")
+	cmd.Flags().StringVar(&o.sourceRepositoryID, "source-repository-id", "", "Canonical source repository ID")
+	cmd.Flags().StringVar(&o.branch, "branch", "", "Source branch")
+	cmd.Flags().StringVar(&o.ref, "ref", "", "Source commit, tag, or ref")
+	cmd.Flags().StringVar(&o.subPath, "sub-path", "", "Subdirectory within the source repository")
+	cmd.Flags().StringVar(&o.readCredential, "read-credential", "", "Secret name for source clone/read credentials")
+	cmd.Flags().StringVar(&o.readCredentialKey, "read-credential-key", "", "Secret key for source clone/read credentials (default: token)")
+	cmd.Flags().StringVar(&o.publicationGitRepo, "publication-git-repo", "", "Publication repository URL")
+	cmd.Flags().StringVar(&o.publicationRepositoryProvider, "publication-repository-provider", "", "Canonical publication repository provider")
+	cmd.Flags().StringVar(&o.publicationRepositoryID, "publication-repository-id", "", "Canonical publication repository ID")
+	cmd.Flags().StringVar(&o.publicationReadCredential, "publication-read-credential", "", "Secret name for publication preflight and verification credentials")
+	cmd.Flags().StringVar(&o.publicationReadCredentialKey, "publication-read-credential-key", "", "Secret key for publication preflight and verification credentials (default: token)")
+	cmd.Flags().StringVar(&o.publicationCredential, "publication-credential", "", "Secret name for publication write credentials")
+	cmd.Flags().StringVar(&o.publicationCredentialKey, "publication-credential-key", "", "Secret key for publication write credentials (default: token)")
+	cmd.Flags().StringVar(&o.forgeCredential, "forge-credential", "", "Secret name for forge API credentials used to reconcile pull requests")
+	cmd.Flags().StringVar(&o.forgeCredentialKey, "forge-credential-key", "", "Secret key for forge API credentials (default: token)")
+	cmd.Flags().StringVar(&o.pushBranch, "push-branch", "", "Publication branch (default: controller-derived full-entropy branch)")
+	cmd.Flags().StringVar(&o.prBaseBranch, "pr-base-branch", "", "Pull request base branch")
+	cmd.Flags().BoolVar(&o.createPR, "create-pr", false, "Reconcile a pull request after verified publication")
+}
+
+func (o taskWorkspaceCreateOptions) build(cmd *cobra.Command, taskType string) (map[string]any, error) {
+	intent := strings.ToLower(strings.TrimSpace(o.intent))
+	if intent != string(corev1alpha1.WorkspaceIntentRead) && intent != string(corev1alpha1.WorkspaceIntentWrite) {
+		return nil, fmt.Errorf("--workspace-intent must be read or write")
+	}
+	workspaceFlagsUsed := false
+	for _, name := range []string{
+		"workspace-intent", "git-repo", "source-repository-provider", "source-repository-id", "branch", "ref",
+		"sub-path", "read-credential", "read-credential-key", "publication-git-repo", "publication-repository-provider",
+		"publication-repository-id", "publication-read-credential", "publication-read-credential-key",
+		"publication-credential", "publication-credential-key", "forge-credential", "forge-credential-key",
+		"push-branch", "pr-base-branch", "create-pr",
+	} {
+		workspaceFlagsUsed = workspaceFlagsUsed || cmd.Flags().Changed(name)
+	}
+	if taskType != cliTaskTypeAgent {
+		if workspaceFlagsUsed {
+			return nil, fmt.Errorf("workspace flags are supported only for agent tasks")
+		}
+		return nil, nil
+	}
+	if (strings.TrimSpace(o.sourceRepositoryProvider) == "") != (strings.TrimSpace(o.sourceRepositoryID) == "") {
+		return nil, fmt.Errorf("--source-repository-provider and --source-repository-id must be set together")
+	}
+	if (strings.TrimSpace(o.publicationRepositoryProvider) == "") != (strings.TrimSpace(o.publicationRepositoryID) == "") {
+		return nil, fmt.Errorf("--publication-repository-provider and --publication-repository-id must be set together")
+	}
+	for _, credential := range []struct {
+		nameFlag string
+		name     string
+		keyFlag  string
+		key      string
+	}{
+		{nameFlag: "--read-credential", name: o.readCredential, keyFlag: "--read-credential-key", key: o.readCredentialKey},
+		{nameFlag: "--publication-read-credential", name: o.publicationReadCredential, keyFlag: "--publication-read-credential-key", key: o.publicationReadCredentialKey},
+		{nameFlag: "--publication-credential", name: o.publicationCredential, keyFlag: "--publication-credential-key", key: o.publicationCredentialKey},
+		{nameFlag: "--forge-credential", name: o.forgeCredential, keyFlag: "--forge-credential-key", key: o.forgeCredentialKey},
+	} {
+		if strings.TrimSpace(credential.key) != "" && strings.TrimSpace(credential.name) == "" {
+			return nil, fmt.Errorf("%s requires %s", credential.keyFlag, credential.nameFlag)
+		}
+	}
+	publicationRequested := o.createPR || strings.TrimSpace(o.publicationGitRepo) != "" ||
+		strings.TrimSpace(o.publicationRepositoryProvider) != "" || strings.TrimSpace(o.publicationReadCredential) != "" ||
+		strings.TrimSpace(o.publicationReadCredentialKey) != "" || strings.TrimSpace(o.publicationCredential) != "" ||
+		strings.TrimSpace(o.publicationCredentialKey) != "" || strings.TrimSpace(o.forgeCredential) != "" ||
+		strings.TrimSpace(o.forgeCredentialKey) != "" || strings.TrimSpace(o.pushBranch) != "" || strings.TrimSpace(o.prBaseBranch) != ""
+	if err := o.validatePublicationOptions(intent, publicationRequested); err != nil {
+		return nil, err
+	}
+
+	workspace := map[string]any{"intent": intent}
+	addTrimmed(workspace, "gitRepo", o.gitRepo)
+	addRepositoryIdentity(workspace, "sourceRepository", o.sourceRepositoryProvider, o.sourceRepositoryID)
+	addTrimmed(workspace, "branch", o.branch)
+	addTrimmed(workspace, "ref", o.ref)
+	addTrimmed(workspace, "subPath", o.subPath)
+	addCredentialRef(workspace, "readCredentialRef", o.readCredential, o.readCredentialKey)
+	if intent == string(corev1alpha1.WorkspaceIntentWrite) {
+		addTrimmed(workspace, "publicationGitRepo", o.publicationGitRepo)
+		addRepositoryIdentity(workspace, "publicationRepository", o.publicationRepositoryProvider, o.publicationRepositoryID)
+		addCredentialRef(workspace, "publicationReadCredentialRef", o.publicationReadCredential, o.publicationReadCredentialKey)
+		addCredentialRef(workspace, "publicationCredentialRef", o.publicationCredential, o.publicationCredentialKey)
+		addCredentialRef(workspace, "forgeCredentialRef", o.forgeCredential, o.forgeCredentialKey)
+		addTrimmed(workspace, "pushBranch", o.pushBranch)
+		addTrimmed(workspace, "prBaseBranch", o.prBaseBranch)
+		if o.createPR {
+			workspace["createPR"] = true
+		}
+	}
+	return workspace, nil
+}
+
+func (o taskWorkspaceCreateOptions) validatePublicationOptions(intent string, publicationRequested bool) error {
+	if intent != string(corev1alpha1.WorkspaceIntentWrite) {
+		if publicationRequested {
+			return fmt.Errorf("publication flags require --workspace-intent write")
+		}
+		return nil
+	}
+	if strings.TrimSpace(o.gitRepo) == "" {
+		return fmt.Errorf("--workspace-intent write requires --git-repo")
+	}
+	if strings.TrimSpace(o.publicationCredential) == "" {
+		return fmt.Errorf("--workspace-intent write requires --publication-credential")
+	}
+	if o.createPR && strings.TrimSpace(o.prBaseBranch) == "" {
+		return fmt.Errorf("--create-pr requires --pr-base-branch")
+	}
+	if o.createPR && strings.TrimSpace(o.forgeCredential) == "" {
+		return fmt.Errorf("--create-pr requires --forge-credential")
+	}
+	return nil
+}
+
+func addTrimmed(target map[string]any, key, value string) {
+	if value = strings.TrimSpace(value); value != "" {
+		target[key] = value
+	}
+}
+
+func addRepositoryIdentity(target map[string]any, key, provider, id string) {
+	provider = strings.TrimSpace(provider)
+	id = strings.TrimSpace(id)
+	if provider != "" && id != "" {
+		target[key] = map[string]any{"provider": provider, "id": id}
+	}
+}
+
+func addCredentialRef(target map[string]any, field, name, secretKey string) {
+	name = strings.TrimSpace(name)
+	if name == "" {
+		return
+	}
+	ref := map[string]any{"name": name}
+	if secretKey = strings.TrimSpace(secretKey); secretKey != "" {
+		ref["key"] = secretKey
+	}
+	target[field] = ref
+}
+
+func newTaskRuntimeStatusCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "status <name>",
+		Short: "Show durable execution, delivery, and runtime-pool status",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c := newClientFromCmd(cmd)
+			detail, err := c.GetTask(cmd.Context(), args[0], client.GetOptions{Namespace: c.Namespace})
+			if err != nil {
+				return err
+			}
+			status := safeTaskRuntimeStatus(*detail)
+			format, err := outputFormat(cmd)
+			if err != nil {
+				return err
+			}
+			if format != outputTable {
+				return printStructured(cmd, status)
+			}
+			return printTaskRuntimeStatusTable(cmd, status)
+		},
+	}
+	addOutputFlag(cmd, outputTable)
+	return cmd
+}
+
+func safeTaskRuntimeStatus(task client.TaskDetail) map[string]any {
+	out := map[string]any{
+		"task":      client.StringField(task, "metadata", "name"),
+		"namespace": client.StringField(task, "metadata", "namespace"),
+	}
+	status := nestedMap(task, "status")
+	out["phase"] = status["phase"]
+	if execution := nestedMap(status, "execution"); len(execution) > 0 {
+		out["execution"] = copyKeys(execution,
+			"state", "outcome", "reason", "attempt", "promptID", "runtimePoolName", "runtimePoolUID",
+			"runtimeInstanceID", "runtimeSessionUID", "runtimeSessionGeneration", "requestDigest", "controllerEpoch",
+			"message", "lastTransitionTime")
+	}
+	if delivery := nestedMap(status, "delivery"); len(delivery) > 0 {
+		out["delivery"] = copyKeys(delivery,
+			"state", "outcome", "reason", "publicationID", "sourceRepository", "publicationRepository", "branch",
+			"startingSHA", "remoteBeforeSHA", "treeSHA", "expectedCommitSHA", "verifiedRemoteSHA", "supersedingRemoteSHA",
+			"artifactDigest", "prReceipt", "message", "lastTransitionTime")
+	}
+	return out
+}
+
+func printTaskRuntimeStatusTable(cmd *cobra.Command, status map[string]any) error {
+	execution := nestedMap(status, "execution")
+	delivery := nestedMap(status, "delivery")
+	w := tabwriter.NewWriter(cmd.OutOrStdout(), 0, 4, 2, ' ', 0)
+	fmt.Fprintln(w, "FIELD\tVALUE") //nolint:errcheck
+	rows := [][2]string{
+		{"Task", anyString(status["task"])},
+		{"Namespace", anyString(status["namespace"])},
+		{"Phase", anyString(status["phase"])},
+		{"Execution", anyString(execution["state"])},
+		{"Execution outcome", anyString(execution["outcome"])},
+		{"Execution reason", anyString(execution["reason"])},
+		{"Attempt", anyString(execution["attempt"])},
+		{"RuntimePool", anyString(execution["runtimePoolName"])},
+		{"Runtime instance", compactCLIValue(anyString(execution["runtimeInstanceID"]))},
+		{"Runtime session generation", anyString(execution["runtimeSessionGeneration"])},
+		{"Delivery", anyString(delivery["state"])},
+		{"Delivery outcome", anyString(delivery["outcome"])},
+		{"Publication branch", anyString(delivery["branch"])},
+		{"Verified remote", compactCLIValue(anyString(delivery["verifiedRemoteSHA"]))},
+	}
+	for _, row := range rows {
+		fmt.Fprintf(w, "%s\t%s\n", row[0], dash(row[1])) //nolint:errcheck
+	}
+	if execution["state"] == "OutcomeUnknown" || execution["outcome"] == "OutcomeUnknown" {
+		fmt.Fprintln(w, "Replay policy\tTerminal; create a new Task explicitly. No automatic replay.") //nolint:errcheck
+	}
+	return w.Flush()
+}
+
+func copyKeys(source map[string]any, keys ...string) map[string]any {
+	out := map[string]any{}
+	for _, key := range keys {
+		if value, ok := source[key]; ok {
+			out[key] = value
+		}
+	}
+	return out
+}
diff --git a/cmd/cli/task_workspace_test.go b/cmd/cli/task_workspace_test.go
new file mode 100644
index 000000000..69b140587
--- /dev/null
+++ b/cmd/cli/task_workspace_test.go
@@ -0,0 +1,249 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestTaskCreateWritesCanonicalWorkspaceCredentialRoles(t *testing.T) {
+	var body map[string]any
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+			t.Fatal(err)
+		}
+		w.WriteHeader(http.StatusCreated)
+		json.NewEncoder(w).Encode(map[string]any{"metadata": map[string]any{"name": "write-task"}}) //nolint:errcheck
+	}))
+	defer server.Close()
+
+	root := newRootCmd()
+	root.SetArgs([]string{
+		"--server", server.URL, "--token", "test-token", "--namespace", "default",
+		"task", "create", "Update the repository", "--type", "agent", "--agent", "codex-agent", "--name", "write-task",
+		"--workspace-intent", "write", "--git-repo", "https://github.com/source/repo",
+		"--source-repository-provider", "github", "--source-repository-id", "source-id",
+		"--read-credential", "repo-read", "--read-credential-key", "source-token",
+		"--publication-git-repo", "https://github.com/publish/repo", "--publication-repository-provider", "github",
+		"--publication-repository-id", "publish-id",
+		"--publication-read-credential", "repo-verify", "--publication-read-credential-key", "verify-token",
+		"--publication-credential", "repo-write", "--publication-credential-key", "write-token",
+		"--forge-credential", "repo-forge", "--forge-credential-key", "forge-token",
+		"--push-branch", "orka/change", "--pr-base-branch", "main", "--create-pr",
+	})
+	if err := root.Execute(); err != nil {
+		t.Fatal(err)
+	}
+	workspace := nestedMap(body, "workspace")
+	if got := anyString(workspace["intent"]); got != "write" {
+		t.Fatalf("intent = %q", got)
+	}
+	for _, want := range []struct {
+		field string
+		name  string
+		key   string
+	}{
+		{field: "readCredentialRef", name: "repo-read", key: "source-token"},
+		{field: "publicationReadCredentialRef", name: "repo-verify", key: "verify-token"},
+		{field: "publicationCredentialRef", name: "repo-write", key: "write-token"},
+		{field: "forgeCredentialRef", name: "repo-forge", key: "forge-token"},
+	} {
+		if got := nestedString(workspace, want.field, "name"); got != want.name {
+			t.Errorf("%s name = %q, want %q", want.field, got, want.name)
+		}
+		if got := nestedString(workspace, want.field, "key"); got != want.key {
+			t.Errorf("%s key = %q, want %q", want.field, got, want.key)
+		}
+	}
+	if got := anyString(workspace["createPR"]); got != "true" {
+		t.Fatalf("createPR = %q", got)
+	}
+	if _, legacy := nestedMap(body, "agentRuntime")["workspace"]; legacy {
+		t.Fatal("request contains deprecated agentRuntime.workspace")
+	}
+	if _, legacy := workspace["gitSecretRef"]; legacy {
+		t.Fatal("request contains deprecated gitSecretRef")
+	}
+}
+
+func TestTaskCreateLeavesCredentialKeyOmittedForAPIDefault(t *testing.T) {
+	var body map[string]any
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+			t.Fatal(err)
+		}
+		w.WriteHeader(http.StatusCreated)
+		json.NewEncoder(w).Encode(map[string]any{"metadata": map[string]any{"name": "read-task"}}) //nolint:errcheck
+	}))
+	defer server.Close()
+
+	root := newRootCmd()
+	root.SetArgs([]string{
+		"--server", server.URL, "--token", "test-token",
+		"task", "create", "Inspect", "--type", "agent", "--agent", "a", "--read-credential", "repo-read",
+	})
+	if err := root.Execute(); err != nil {
+		t.Fatal(err)
+	}
+	ref := nestedMap(nestedMap(body, "workspace"), "readCredentialRef")
+	if ref["name"] != "repo-read" {
+		t.Fatalf("readCredentialRef = %#v", ref)
+	}
+	if _, ok := ref["key"]; ok {
+		t.Fatalf("readCredentialRef key should be omitted for the API token default: %#v", ref)
+	}
+}
+
+func TestTaskCreateRejectsPublicationForReadIntent(t *testing.T) {
+	root := newRootCmd()
+	root.SetArgs([]string{"task", "create", "Inspect", "--type", "agent", "--agent", "a", "--publication-credential", "repo-write"})
+	err := root.Execute()
+	if err == nil || !strings.Contains(err.Error(), "publication flags require --workspace-intent write") {
+		t.Fatalf("error = %v", err)
+	}
+}
+
+func TestTaskCreateRejectsIncompleteWriteWorkspace(t *testing.T) {
+	tests := []struct {
+		name string
+		args []string
+		want string
+	}{
+		{
+			name: "source repository",
+			args: []string{"--publication-credential", "repo-write"},
+			want: "--workspace-intent write requires --git-repo",
+		},
+		{
+			name: "publication credential",
+			args: []string{"--git-repo", "https://github.com/source/repo"},
+			want: "--workspace-intent write requires --publication-credential",
+		},
+		{
+			name: "pull request base branch",
+			args: []string{
+				"--git-repo", "https://github.com/source/repo", "--publication-credential", "repo-write",
+				"--forge-credential", "repo-forge", "--create-pr",
+			},
+			want: "--create-pr requires --pr-base-branch",
+		},
+		{
+			name: "forge credential",
+			args: []string{
+				"--git-repo", "https://github.com/source/repo", "--publication-credential", "repo-write",
+				"--pr-base-branch", "main", "--create-pr",
+			},
+			want: "--create-pr requires --forge-credential",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			root := newRootCmd()
+			args := []string{
+				"task", "create", "Publish", "--type", "agent", "--agent", "a", "--workspace-intent", "write",
+			}
+			root.SetArgs(append(args, tt.args...))
+			err := root.Execute()
+			if err == nil || !strings.Contains(err.Error(), tt.want) {
+				t.Fatalf("error = %v, want %q", err, tt.want)
+			}
+		})
+	}
+}
+
+func TestTaskCreateRejectsCredentialKeyWithoutSecretName(t *testing.T) {
+	root := newRootCmd()
+	root.SetArgs([]string{
+		"task", "create", "Inspect", "--type", "agent", "--agent", "a", "--read-credential-key", "custom-token",
+	})
+	err := root.Execute()
+	if err == nil || !strings.Contains(err.Error(), "--read-credential-key requires --read-credential") {
+		t.Fatalf("error = %v", err)
+	}
+}
+
+func TestSafeWorkspaceStatusDoesNotTreatWriteCredentialAsForgeCredential(t *testing.T) {
+	status := safeWorkspaceStatus(map[string]any{
+		"spec": map[string]any{"workspace": map[string]any{
+			"intent": "write", "createPR": true,
+			"publicationCredentialRef": map[string]any{"name": "legacy-combined-credential"},
+		}},
+	})
+	workspace := nestedMap(status, "workspace")
+	if workspace["publicationCredentialConfigured"] != true || workspace["publicationWriteCredentialConfigured"] != true {
+		t.Fatalf("write credential summary = %#v", workspace)
+	}
+	if workspace["forgeCredentialConfigured"] != false {
+		t.Fatalf("write credential was silently treated as a forge credential: %#v", workspace)
+	}
+}
+
+func TestTaskStatusRendersPoolDeliveryAndUnknownReplayPolicy(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		json.NewEncoder(w).Encode(map[string]any{ //nolint:errcheck
+			"metadata": map[string]any{"name": "uncertain", "namespace": "default"},
+			"spec":     map[string]any{"type": "agent", "workspace": map[string]any{"intent": "write"}},
+			"status": map[string]any{
+				"phase":     "Failed",
+				"execution": map[string]any{"state": "OutcomeUnknown", "outcome": "OutcomeUnknown", "runtimePoolName": "codex-write", "runtimeInstanceID": "pod:boot", "runtimeSessionGeneration": 2},
+				"delivery":  map[string]any{"state": "PublicationOutcomeUnknown", "branch": "orka/change"},
+			},
+		})
+	}))
+	defer server.Close()
+
+	var out bytes.Buffer
+	root := newRootCmd()
+	root.SetOut(&out)
+	root.SetErr(&out)
+	root.SetArgs([]string{"--server", server.URL, "--token", "test-token", "task", "status", "uncertain"})
+	if err := root.Execute(); err != nil {
+		t.Fatal(err)
+	}
+	for _, want := range []string{"OutcomeUnknown", "codex-write", "PublicationOutcomeUnknown", "No automatic replay"} {
+		if !strings.Contains(out.String(), want) {
+			t.Fatalf("output missing %q:\n%s", want, out.String())
+		}
+	}
+}
+
+func TestSafeWorkspaceStatusUsesCanonicalSpecAndDelivery(t *testing.T) {
+	const secretValue = "must-never-render"
+	status := safeWorkspaceStatus(map[string]any{
+		"metadata": map[string]any{"name": "write", "namespace": "default"},
+		"spec": map[string]any{"workspace": map[string]any{
+			"intent": "write", "gitRepo": "https://github.com/source/repo", "createPR": true,
+			"readCredentialRef":            map[string]any{"name": "repo-read", "key": "source-token", "value": secretValue},
+			"publicationReadCredentialRef": map[string]any{"name": "repo-verify", "key": "verify-token", "value": secretValue},
+			"publicationCredentialRef":     map[string]any{"name": "repo-write", "key": "write-token", "value": secretValue},
+			"forgeCredentialRef":           map[string]any{"name": "repo-forge", "key": "forge-token", "value": secretValue},
+		}},
+		"status": map[string]any{"phase": "Running", "delivery": map[string]any{"state": "Publishing"}},
+	})
+	workspace := nestedMap(status, "workspace")
+	for _, field := range []string{
+		"readCredentialConfigured", "publicationReadCredentialConfigured", "publicationCredentialConfigured",
+		"publicationWriteCredentialConfigured", "forgeCredentialConfigured",
+	} {
+		if workspace[field] != true {
+			t.Errorf("%s = %#v, want true", field, workspace[field])
+		}
+	}
+	for _, field := range []string{
+		"readCredentialRef", "publicationReadCredentialRef", "publicationCredentialRef", "forgeCredentialRef",
+	} {
+		if _, leaked := workspace[field]; leaked {
+			t.Errorf("safe workspace status leaked %s", field)
+		}
+	}
+	if strings.Contains(fmt.Sprint(status), secretValue) {
+		t.Fatal("safe workspace status leaked a Secret value")
+	}
+	if got := nestedString(status, "delivery", "state"); got != "Publishing" {
+		t.Fatalf("delivery state = %q", got)
+	}
+}
diff --git a/cmd/harness_v1_tls.go b/cmd/harness_v1_tls.go
new file mode 100644
index 000000000..83db7070b
--- /dev/null
+++ b/cmd/harness_v1_tls.go
@@ -0,0 +1,41 @@
+package main
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+)
+
+func validateHarnessV1TLSEndpoint(endpoint string) error {
+	parsed, err := url.Parse(strings.TrimSpace(endpoint))
+	if err != nil || parsed.Scheme != "https" || parsed.Host == "" || parsed.User != nil {
+		return fmt.Errorf("harness v1 endpoint must be an HTTPS URL without user info")
+	}
+	return nil
+}
+
+func newHarnessV1TLSHTTPClient(caFile string) (*http.Client, error) {
+	caFile = strings.TrimSpace(caFile)
+	if caFile == "" {
+		return nil, fmt.Errorf("harness v1 CA file is required")
+	}
+	caPEM, err := os.ReadFile(caFile)
+	if err != nil {
+		return nil, fmt.Errorf("read harness v1 CA file: %w", err)
+	}
+	roots, err := x509.SystemCertPool()
+	if err != nil {
+		roots = x509.NewCertPool()
+	}
+	if !roots.AppendCertsFromPEM(caPEM) {
+		return nil, fmt.Errorf("harness v1 CA file contains no valid certificates")
+	}
+	transport := http.DefaultTransport.(*http.Transport).Clone()
+	transport.Proxy = nil
+	transport.TLSClientConfig = &tls.Config{MinVersion: tls.VersionTLS12, RootCAs: roots}
+	return &http.Client{Transport: transport}, nil
+}
diff --git a/cmd/harness_v1_tls_test.go b/cmd/harness_v1_tls_test.go
new file mode 100644
index 000000000..7926b4179
--- /dev/null
+++ b/cmd/harness_v1_tls_test.go
@@ -0,0 +1,53 @@
+package main
+
+import (
+	"encoding/pem"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestHarnessV1TLSHTTPClientAuthenticatesConfiguredCA(t *testing.T) {
+	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	defer server.Close()
+
+	caFile := filepath.Join(t.TempDir(), "ca.crt")
+	caPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: server.Certificate().Raw})
+	if err := os.WriteFile(caFile, caPEM, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	client, err := newHarnessV1TLSHTTPClient(caFile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	response, err := client.Get(server.URL)
+	if err != nil {
+		t.Fatalf("GET with configured harness v1 CA: %v", err)
+	}
+	_ = response.Body.Close()
+	if response.StatusCode != http.StatusNoContent {
+		t.Fatalf("status = %d, want %d", response.StatusCode, http.StatusNoContent)
+	}
+}
+
+func TestValidateHarnessV1TLSEndpointRejectsPlaintext(t *testing.T) {
+	if err := validateHarnessV1TLSEndpoint("http://wrapper.default.svc:8080"); err == nil {
+		t.Fatal("plaintext harness v1 endpoint was accepted")
+	}
+}
+
+func TestValidateHarnessV1DispatchOptionsRejectsParallelWorkers(t *testing.T) {
+	if err := validateHarnessV1DispatchOptions(time.Second, 1); err != nil {
+		t.Fatalf("default dispatch options: %v", err)
+	}
+	if err := validateHarnessV1DispatchOptions(time.Second, 2); err == nil ||
+		!strings.Contains(err.Error(), "harness v1 dispatch workers must be exactly 1") {
+		t.Fatalf("parallel dispatch options error = %v, want exact-one rejection", err)
+	}
+}
diff --git a/cmd/main.go b/cmd/main.go
index 1b6233a00..159f7f03b 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -7,21 +7,35 @@ MIT License - see LICENSE file for details.
 package main
 
 import (
+	"bytes"
 	"context"
 	"crypto/tls"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
 	"flag"
 	"fmt"
+	"math"
+	"net/http"
 	"os"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
 
+	"github.com/google/uuid"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	networkingv1 "k8s.io/api/networking/v1"
+	policyv1 "k8s.io/api/policy/v1"
+
 	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
 	// to ensure that exec-entrypoint and run can make use of them.
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
 
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
@@ -29,6 +43,7 @@ import (
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/cache"
+	crclient "sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 	"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
@@ -43,13 +58,22 @@ import (
 	workspacev1alpha1 "github.com/orka-agents/orka/api/workspace/v1alpha1"
 	orkaadmission "github.com/orka-agents/orka/internal/admission"
 	"github.com/orka-agents/orka/internal/api"
+	"github.com/orka-agents/orka/internal/artifactcap"
 	"github.com/orka-agents/orka/internal/contexttoken"
 	"github.com/orka-agents/orka/internal/controller"
+	"github.com/orka-agents/orka/internal/executionmode"
 	gatewayruntime "github.com/orka-agents/orka/internal/gateway"
+	"github.com/orka-agents/orka/internal/harness"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/labels"
 	_ "github.com/orka-agents/orka/internal/llm/anthropic"
 	_ "github.com/orka-agents/orka/internal/llm/openai"
 	_ "github.com/orka-agents/orka/internal/metrics"
 	"github.com/orka-agents/orka/internal/outboundaccess"
+	publisherservice "github.com/orka-agents/orka/internal/publisher/service"
+	"github.com/orka-agents/orka/internal/store"
+	storekube "github.com/orka-agents/orka/internal/store/kube"
+
 	"github.com/orka-agents/orka/internal/store/sqlite"
 	"github.com/orka-agents/orka/internal/tokenexchange"
 	"github.com/orka-agents/orka/internal/tools"
@@ -59,9 +83,16 @@ import (
 	// +kubebuilder:scaffold:imports
 )
 
+const (
+	taskResourceKind            = "Task"
+	serviceAccountNamespaceFile = "/var/run/secrets/kubernetes.io/serviceaccount/namespace"
+	controllerLeaderElectionID  = "03b49a10.orka.ai"
+)
+
 var (
-	scheme   = runtime.NewScheme()
-	setupLog = ctrl.Log.WithName("setup")
+	scheme                       = runtime.NewScheme()
+	setupLog                     = ctrl.Log.WithName("setup")
+	controllerProcessIncarnation = uuid.NewString()
 )
 
 func init() {
@@ -98,6 +129,25 @@ func validateWorkspaceProviderSecurityConfig(apiEnabled, classUseAdmissionEnable
 	return nil
 }
 
+func validateStaticTrustedServiceReferences(
+	watchNamespace string,
+	trust outboundaccess.TrustConfig,
+) error {
+	watchNamespace = strings.TrimSpace(watchNamespace)
+	for _, ref := range append(trust.Gateways.References(), trust.TokenEndpoints.References()...) {
+		if ref.Namespace != watchNamespace {
+			return fmt.Errorf(
+				"trusted Service %s/%s:%d must be in controller watch namespace %q",
+				ref.Namespace,
+				ref.Name,
+				ref.Port,
+				watchNamespace,
+			)
+		}
+	}
+	return nil
+}
+
 func workspaceCleanupAPIsInstalled(mapper meta.RESTMapper) (bool, error) {
 	for _, gvk := range []schema.GroupVersionKind{
 		workspacev1alpha1.GroupVersion.WithKind("ExecutionWorkspaceProvider"),
@@ -115,8 +165,13 @@ func workspaceCleanupAPIsInstalled(mapper meta.RESTMapper) (bool, error) {
 	return true, nil
 }
 
+func managerWebhookAdmissionEnabled(taskProvenanceEnabled, workspaceClassUseEnabled bool) bool {
+	return taskProvenanceEnabled || workspaceClassUseEnabled
+}
+
 // nolint:gocyclo
 func main() {
+	acpUpgradeDrainOptions := controller.DefaultACPUpgradeDrainOptions()
 	var metricsAddr string
 	var metricsCertPath, metricsCertName, metricsCertKey string
 	var webhookCertPath, webhookCertName, webhookCertKey string
@@ -137,7 +192,7 @@ func main() {
 	var aiWorkerClusterRoleName string
 	var vendorWorkerClusterRoleName string
 	var containerWorkerClusterRoleName string
-	var workerClusterRoleBindingNamePrefix string
+	var workerRoleBindingNamePrefix string
 	var chatEnabled bool
 	var chatProvider string
 	var chatModel string
@@ -162,9 +217,31 @@ func main() {
 	var aiWorkerImage string
 	var storeBackend string
 	var storePath string
+	var agentExecutionSnapshotKeyFile string
+	var agentExecutionSnapshotRetention time.Duration
+	var agentExecutionSnapshotRetentionInterval time.Duration
 	var controllerURL string
 	var enforceNamespaceIsolation bool
 	var maxTasksPerNamespace int
+	var controllerModeValue string
+	var executionModeControllerUsernames string
+	var harnessV1Endpoint string
+	var harnessV1CAFile string
+	var harnessV1AuthSecretNamespace string
+	var harnessV1AuthSecretName string
+	var harnessV1AuthSecretKey string
+	var harnessV1DispatchInterval time.Duration
+	var harnessV1DispatchWorkers int
+	var acpIdlePoolTTL time.Duration
+	var acpCodexRuntimeImage string
+	var acpClaudeRuntimeImage string
+	var acpCopilotRuntimeImage string
+	var acpOpencodeRuntimeImage string
+	var acpRuntimeNamespace string
+	var acpProviderProxyNamespace string
+	var acpProviderProxyBaseURL string
+	var acpProviderProxyPodLabels string
+	var acpProviderProxyTokenFile string
 	var agentSandboxEnabled bool
 	var agentSandboxCleanupPolicy string
 	var oidcIssuer string
@@ -235,6 +312,11 @@ func main() {
 	flag.BoolVar(&enableLeaderElection, "leader-elect", false,
 		"Enable leader election for controller manager. "+
 			"Enabling this will ensure there is only one active controller manager.")
+	flag.StringVar(&controllerModeValue, "controller-mode", os.Getenv("ORKA_CONTROLLER_MODE"),
+		"Required controller mode: harness-v1 or harness-v2. An installation never serves both modes.")
+	flag.StringVar(&executionModeControllerUsernames, "execution-mode-controller-usernames",
+		os.Getenv("ORKA_EXECUTION_MODE_CONTROLLER_USERNAMES"),
+		"Comma-separated exact Kubernetes usernames authorized to write controller-owned Task execution authority.")
 	flag.BoolVar(&secureMetrics, "metrics-secure", true,
 		"If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.")
 	flag.StringVar(&webhookCertPath, "webhook-cert-path", "", "The directory that contains the webhook certificate.")
@@ -260,7 +342,7 @@ func main() {
 	flag.BoolVar(&enableHTTP2, "enable-http2", false,
 		"If set, HTTP/2 will be enabled for the metrics and webhook servers")
 	flag.IntVar(&apiPort, "api-port", 8080, "The port the REST API server binds to.")
-	flag.StringVar(&watchNamespace, "watch-namespace", "", "Namespace to watch for resources. Empty for all namespaces.")
+	flag.StringVar(&watchNamespace, "watch-namespace", "", "Required single namespace to watch for resources.")
 	flag.BoolVar(&workspaceProviderAPIEnabled, "enable-workspace-provider-api",
 		envBool("ORKA_ENABLE_WORKSPACE_PROVIDER_API"),
 		"Enable workspace.orka.ai provider/class/pool/workspace coordination controllers.")
@@ -286,9 +368,9 @@ func main() {
 		controller.DefaultVendorWorkerClusterRoleName, "ClusterRole name for vendor worker tasks.")
 	flag.StringVar(&containerWorkerClusterRoleName, "container-worker-cluster-role-name",
 		controller.DefaultContainerWorkerClusterRoleName, "ClusterRole name for container worker tasks.")
-	flag.StringVar(&workerClusterRoleBindingNamePrefix, "worker-cluster-role-binding-prefix",
-		os.Getenv("ORKA_WORKER_CLUSTER_ROLE_BINDING_PREFIX"),
-		"Prefix for per-namespace worker ClusterRoleBinding names. Empty uses the legacy 'orka' prefix.")
+	flag.StringVar(&workerRoleBindingNamePrefix, "worker-role-binding-prefix",
+		os.Getenv("ORKA_WORKER_ROLE_BINDING_PREFIX"),
+		"Prefix for per-namespace worker RoleBinding names. Empty uses the 'orka' prefix.")
 	flag.BoolVar(&chatEnabled, "chat-enabled", true, "Enable the chat endpoint.")
 	flag.StringVar(&chatProvider, "chat-provider", "", "Default Provider CRD name for chat.")
 	flag.StringVar(&chatModel, "chat-model", "", "Default model for chat.")
@@ -326,12 +408,60 @@ func main() {
 		"Maximum gateway events and deliveries processed per iteration.")
 	flag.StringVar(&storeBackend, "store-backend", "sqlite", "Storage backend (sqlite)")
 	flag.StringVar(&storePath, "store-path", "/data/orka.db", "Path to SQLite database file")
+	flag.StringVar(&agentExecutionSnapshotKeyFile, "agent-execution-snapshot-key-file", "",
+		"Path to the 32-byte (raw or base64) AES-256 key encrypting immutable agent execution snapshots. "+
+			"When set, executable agent Tasks freeze a write-once binding and encrypted snapshot before dispatch.")
+	flag.DurationVar(&agentExecutionSnapshotRetention, "agent-execution-snapshot-retention",
+		envDurationDefault("ORKA_AGENT_EXECUTION_SNAPSHOT_RETENTION", controller.DefaultAgentExecutionSnapshotRetention),
+		"Minimum audit/backup retention period for encrypted execution snapshots after all references disappear.")
+	flag.DurationVar(&agentExecutionSnapshotRetentionInterval, "agent-execution-snapshot-retention-interval",
+		envDurationDefault("ORKA_AGENT_EXECUTION_SNAPSHOT_RETENTION_INTERVAL", controller.DefaultAgentExecutionSnapshotRetentionInterval),
+		"Interval between reference-aware encrypted execution snapshot retention scans.")
 	flag.StringVar(&controllerURL, "controller-url", "",
 		"Base URL for the controller API, used by workers. E.g. http://orka-controller.orka-system.svc:8080")
 	flag.BoolVar(&enforceNamespaceIsolation, "enforce-namespace-isolation", false,
 		"When true, restrict users to their ServiceAccount's namespace for all operations.")
 	flag.IntVar(&maxTasksPerNamespace, "max-tasks-per-namespace", 0,
 		"Maximum active tasks per namespace (0 = unlimited).")
+	flag.StringVar(&harnessV1Endpoint, "harness-v1-endpoint", os.Getenv("ORKA_HARNESS_V1_ENDPOINT"),
+		"Base URL of the built-in harness v1 wrapper Service.")
+	flag.StringVar(&harnessV1CAFile, "harness-v1-ca-file", os.Getenv("ORKA_HARNESS_V1_CA_FILE"),
+		"CA bundle used to authenticate built-in and registered harness v1 Services.")
+	flag.StringVar(&harnessV1AuthSecretNamespace, "harness-v1-auth-secret-namespace",
+		os.Getenv("ORKA_HARNESS_V1_AUTH_SECRET_NAMESPACE"),
+		"Namespace of the dedicated harness v1 wrapper bearer-token Secret.")
+	flag.StringVar(&harnessV1AuthSecretName, "harness-v1-auth-secret-name",
+		os.Getenv("ORKA_HARNESS_V1_AUTH_SECRET_NAME"),
+		"Name of the dedicated harness v1 wrapper bearer-token Secret.")
+	flag.StringVar(&harnessV1AuthSecretKey, "harness-v1-auth-secret-key",
+		envStringDefault("ORKA_HARNESS_V1_AUTH_SECRET_KEY", "token"),
+		"Key in the dedicated harness v1 wrapper bearer-token Secret.")
+	flag.DurationVar(&harnessV1DispatchInterval, "harness-v1-dispatch-interval",
+		envDurationDefault("ORKA_HARNESS_V1_DISPATCH_INTERVAL", controller.DefaultHarnessV1DispatchInterval),
+		"Interval between durable harness v1 attempt recovery scans.")
+	flag.IntVar(&harnessV1DispatchWorkers, "harness-v1-dispatch-workers",
+		controller.DefaultHarnessV1DispatchWorkers,
+		"Maximum concurrent harness v1 attempt workers.")
+	flag.DurationVar(&acpIdlePoolTTL, "acp-idle-pool-ttl", envDurationDefault("ORKA_ACP_IDLE_POOL_TTL", controller.DefaultACPIdlePoolTTL),
+		"Scale an idle ACP RuntimePool to zero after this duration.")
+	flag.StringVar(&acpCodexRuntimeImage, "acp-codex-runtime-image", os.Getenv("ORKA_ACP_CODEX_RUNTIME_IMAGE"),
+		"Digest-pinned Codex ACP runtime image.")
+	flag.StringVar(&acpClaudeRuntimeImage, "acp-claude-runtime-image", os.Getenv("ORKA_ACP_CLAUDE_RUNTIME_IMAGE"),
+		"Digest-pinned Claude ACP runtime image.")
+	flag.StringVar(&acpCopilotRuntimeImage, "acp-copilot-runtime-image", os.Getenv("ORKA_ACP_COPILOT_RUNTIME_IMAGE"),
+		"Digest-pinned Copilot ACP runtime image.")
+	flag.StringVar(&acpOpencodeRuntimeImage, "acp-opencode-runtime-image", os.Getenv("ORKA_ACP_OPENCODE_RUNTIME_IMAGE"),
+		"Digest-pinned OpenCode ACP runtime image.")
+	flag.StringVar(&acpRuntimeNamespace, "acp-runtime-namespace", envStringDefault("ORKA_ACP_RUNTIME_NAMESPACE", "orka-runtimes"),
+		"Physical namespace for managed ACP runtime Pods.")
+	flag.StringVar(&acpProviderProxyNamespace, "acp-provider-proxy-namespace", envStringDefault("ORKA_ACP_PROVIDER_PROXY_NAMESPACE", "vekil-system"),
+		"Namespace containing the approved credential-injecting provider proxy.")
+	flag.StringVar(&acpProviderProxyBaseURL, "acp-provider-proxy-base-url", os.Getenv("ORKA_ACP_PROVIDER_PROXY_BASE_URL"),
+		"Cluster-local base URL of the authenticated provider proxy boundary.")
+	flag.StringVar(&acpProviderProxyPodLabels, "acp-provider-proxy-pod-labels", envStringDefault("ORKA_ACP_PROVIDER_PROXY_POD_LABELS", "orka.ai/network-role=provider-auth-proxy"),
+		"Comma-separated exact Pod labels selected by RuntimePool provider-proxy egress policy.")
+	flag.StringVar(&acpProviderProxyTokenFile, "acp-provider-proxy-token-file", os.Getenv("ORKA_ACP_PROVIDER_PROXY_TOKEN_FILE"),
+		"Mounted file containing the authenticated provider proxy bearer token.")
 	flag.StringVar(&executionWorkspaceDefaultProviderFlag, "execution-workspace-default-provider",
 		executionWorkspaceDefaultProviderFlag,
 		"Default execution workspace provider when Task execution.workspace.provider is omitted (agent-sandbox, substrate).")
@@ -550,7 +680,84 @@ func main() {
 		Development: true,
 	}
 	opts.BindFlags(flag.CommandLine)
+	acpUpgradeDrainOptions.BindFlags(flag.CommandLine)
 	flag.Parse()
+	if handled, err := controller.RunACPUpgradeDrainTriggerMode(context.Background(), acpUpgradeDrainOptions); handled {
+		if err != nil {
+			fmt.Fprintln(os.Stderr, "ACP planned-upgrade drain trigger failed")
+			os.Exit(1)
+		}
+		return
+	}
+	mode, err := executionmode.Parse(controllerModeValue)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+	watchNamespace = strings.TrimSpace(watchNamespace)
+	if watchNamespace == "" {
+		fmt.Fprintln(os.Stderr, "--watch-namespace is required; controller modes cannot use a cluster-wide watch")
+		os.Exit(1)
+	}
+	acpUpgradeDrainOptions.WatchNamespace = watchNamespace
+	if !enforceNamespaceIsolation {
+		fmt.Fprintln(os.Stderr, "--enforce-namespace-isolation=true is required for a static controller installation")
+		os.Exit(1)
+	}
+	harnessV1Enabled := mode == executionmode.HarnessV1
+	acpRuntimeEnabled := mode == executionmode.HarnessV2
+	if harnessV1Enabled {
+		// Cluster-scoped gateway/workspace infrastructure is owned only by the
+		// harness-v2 installation. A v1 installation must remain namespaced.
+		gatewayEnabled = false
+		workspaceProviderAPIEnabled = false
+		workspaceClassUseAdmissionEnabled = false
+		fakeWorkspaceProviderEnabled = false
+	}
+	if !enableLeaderElection {
+		fmt.Fprintln(os.Stderr, "--leader-elect=true is required for an isolated controller installation")
+		os.Exit(1)
+	}
+	if len(splitCommaList(executionModeControllerUsernames)) == 0 {
+		fmt.Fprintln(os.Stderr, "--execution-mode-controller-usernames must contain at least one exact username")
+		os.Exit(1)
+	}
+	if err := validateAgentExecutionSnapshotOptions(
+		mode,
+		agentExecutionSnapshotKeyFile,
+		agentExecutionSnapshotRetention,
+		agentExecutionSnapshotRetentionInterval,
+	); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+	if harnessV1Enabled {
+		missing := make([]string, 0, 5)
+		for name, value := range map[string]string{
+			"--harness-v1-endpoint":              harnessV1Endpoint,
+			"--harness-v1-ca-file":               harnessV1CAFile,
+			"--harness-v1-auth-secret-namespace": harnessV1AuthSecretNamespace,
+			"--harness-v1-auth-secret-name":      harnessV1AuthSecretName,
+			"--harness-v1-auth-secret-key":       harnessV1AuthSecretKey,
+		} {
+			if strings.TrimSpace(value) == "" {
+				missing = append(missing, name)
+			}
+		}
+		if len(missing) != 0 {
+			slices.Sort(missing)
+			fmt.Fprintf(os.Stderr, "harness v1 requires %s\n", strings.Join(missing, ", "))
+			os.Exit(1)
+		}
+		if err := validateHarnessV1TLSEndpoint(harnessV1Endpoint); err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+		if err := validateHarnessV1DispatchOptions(harnessV1DispatchInterval, harnessV1DispatchWorkers); err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+	}
 
 	// Empty worker ServiceAccount flags retain the package defaults for callers that
 	// explicitly clear a flag, matching the zero-value fallback in the controller.
@@ -574,6 +781,7 @@ func main() {
 	}
 
 	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
+	setupLog.Info("configured isolated controller mode", "mode", mode, "namespace", watchNamespace)
 
 	executionWorkspaceDefaultProvider = corev1alpha1.WorkspaceProvider(executionWorkspaceDefaultProviderFlag)
 	if !controller.WorkspaceProviderSupported(executionWorkspaceDefaultProvider) {
@@ -673,6 +881,10 @@ func main() {
 		os.Exit(1)
 	}
 	outboundAccessTrust := outboundaccess.TrustConfig{Gateways: trustedGateways, TokenEndpoints: trustedTokenEndpoints}
+	if err := validateStaticTrustedServiceReferences(watchNamespace, outboundAccessTrust); err != nil {
+		setupLog.Error(err, "invalid static-controller outbound trust configuration")
+		os.Exit(1)
+	}
 
 	if err := validateWorkspaceProviderSecurityConfig(
 		workspaceProviderAPIEnabled,
@@ -681,6 +893,10 @@ func main() {
 		setupLog.Error(err, "invalid workspace provider security configuration")
 		os.Exit(1)
 	}
+	managerAdmissionEnabled := managerWebhookAdmissionEnabled(
+		taskProvenanceAdmissionEnabled,
+		workspaceClassUseAdmissionEnabled,
+	)
 
 	// Initialize OpenTelemetry tracing (noop when disabled)
 	tracingShutdown, err := tracing.Init("orka-controller", enableTracing)
@@ -748,27 +964,53 @@ func main() {
 		metricsServerOptions.KeyName = metricsCertKey
 	}
 
+	processCtx, stopProcess := context.WithCancel(ctrl.SetupSignalHandler())
+	defer stopProcess()
+	restConfig := ctrl.GetConfigOrDie()
 	mgrOptions := ctrl.Options{
-		Scheme:                 scheme,
-		Metrics:                metricsServerOptions,
-		WebhookServer:          webhookServer,
-		HealthProbeBindAddress: probeAddr,
-		LeaderElection:         enableLeaderElection,
-		LeaderElectionID:       "03b49a10.orka.ai",
+		Scheme:                        scheme,
+		Metrics:                       metricsServerOptions,
+		WebhookServer:                 webhookServer,
+		HealthProbeBindAddress:        probeAddr,
+		LeaderElection:                enableLeaderElection,
+		LeaderElectionID:              controllerLeaderElectionID,
+		LeaderElectionNamespace:       watchNamespace,
+		LeaderElectionReleaseOnCancel: true,
 	}
 
-	// Set namespace scope if specified
-	if watchNamespace != "" {
-		mgrOptions.Cache.DefaultNamespaces = map[string]cache.Config{
-			watchNamespace: {},
-		}
-	}
+	// Tenant resources are always namespace-scoped. Only harness v2 may also
+	// cache RuntimePool child kinds from its separately owned runtime namespace.
+	runtimeCacheNamespace := ""
+	if acpRuntimeEnabled {
+		runtimeCacheNamespace = acpRuntimeNamespace
+	}
+	mgrOptions.Cache = managerCacheOptions(
+		watchNamespace,
+		runtimeCacheNamespace,
+	)
 
-	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), mgrOptions)
+	mgr, err := ctrl.NewManager(restConfig, mgrOptions)
 	if err != nil {
 		setupLog.Error(err, "unable to start manager")
 		os.Exit(1)
 	}
+	kubeClient, err := kubernetes.NewForConfig(restConfig)
+	if err != nil {
+		setupLog.Error(err, "unable to create Kubernetes clientset")
+		os.Exit(1)
+	}
+	modeNamespace, err := kubeClient.CoreV1().Namespaces().Get(
+		context.Background(), watchNamespace, metav1.GetOptions{},
+	)
+	if err != nil {
+		setupLog.Error(err, "unable to read controller-mode namespace", "namespace", watchNamespace)
+		os.Exit(1)
+	}
+	if err := executionmode.ValidateNamespace(modeNamespace, mode); err != nil {
+		setupLog.Error(err, "controller-mode namespace claim failed")
+		os.Exit(1)
+	}
+	controllerHolderID := currentControllerHolderID()
 	if gatewayEnabled {
 		checkCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 		err := gatewayruntime.WaitForGatewayPrerequisites(checkCtx, mgr.GetAPIReader(), 500*time.Millisecond)
@@ -805,13 +1047,19 @@ func main() {
 			"trustedServiceAccounts", strings.Join(admissionConfig.TrustedServiceAccountNames, ","),
 		)
 	}
-
-	// Create Kubernetes clientset for pod log reading
-	kubeClient, err := kubernetes.NewForConfig(mgr.GetConfig())
-	if err != nil {
-		setupLog.Error(err, "unable to create kubernetes clientset")
-		os.Exit(1)
+	if managerAdmissionEnabled {
+		orkaadmission.RegisterExecutionModeWebhooks(
+			mgr.GetWebhookServer(),
+			mgr.GetScheme(),
+			mgr.GetAPIReader(),
+			orkaadmission.ExecutionModeConfig{
+				ControllerUsernames: splitCommaList(executionModeControllerUsernames),
+			},
+		)
+		setupLog.Info("registered immutable namespace mode and execution-authority admission")
 	}
+
+	// The clientset is reused for pod log and broker operations.
 	outboundAccessResolver := &outboundaccess.KubernetesResolver{
 		Reader:     mgr.GetAPIReader(),
 		KubeClient: kubeClient,
@@ -819,12 +1067,14 @@ func main() {
 		Exchanger:  tokenexchange.NewClient(tokenexchange.ClientOptions{}),
 	}
 	var brokeredTransactionExchange *worker.TransactionExchangeConfig
+	var brokeredTTSExchanger contexttoken.Exchanger
 	if contextTokenTTSConfig.Enabled() {
 		sharedTTSClient, clientErr := contexttoken.NewTTSClient(contextTokenTTSConfig)
 		if clientErr != nil {
 			setupLog.Error(clientErr, "unable to create brokered transaction-token exchanger")
 			os.Exit(1)
 		}
+		brokeredTTSExchanger = sharedTTSClient
 		brokeredTransactionExchange = &worker.TransactionExchangeConfig{
 			TTS:              contextTokenTTSConfig,
 			Exchanger:        sharedTTSClient,
@@ -832,6 +1082,28 @@ func main() {
 			OutboundScope:    contextTokenOutboundScope,
 		}
 	}
+	var acpMCPRegistry *tools.Registry
+	if acpRuntimeEnabled {
+		acpMCPRegistry = tools.NewRegistry()
+		if err := tools.RegisterBrokeredCoordinationTools(acpMCPRegistry, mgr.GetClient()); err != nil {
+			setupLog.Error(err, "unable to register ACP MCP broker coordination tools")
+			os.Exit(1)
+		}
+		if err := tools.RegisterBrokeredDelegateTaskTool(
+			acpMCPRegistry,
+			mgr.GetClient(),
+			tools.BrokeredDelegateTaskTransactionExchangeConfig{
+				TTS:                 contextTokenTTSConfig,
+				Exchanger:           brokeredTTSExchanger,
+				SubjectTokenType:    contextTokenSubjectTokenType,
+				ChildScope:          contextTokenChildScope,
+				ResolveSubjectToken: newBrokeredDelegateTaskSubjectTokenResolver(mgr.GetAPIReader(), workerenv.ServiceAccountTokenFile),
+			},
+		); err != nil {
+			setupLog.Error(err, "unable to register configured ACP delegate_task broker")
+			os.Exit(1)
+		}
+	}
 
 	// Create SQLite store
 	if storeBackend != "sqlite" {
@@ -839,20 +1111,137 @@ func main() {
 		os.Exit(1)
 	}
 
-	db, err := sqlite.NewDB(storePath)
+	sqliteStore, err := sqlite.OpenLockedStore(storePath)
 	if err != nil {
-		setupLog.Error(err, "unable to create SQLite database", "path", storePath)
+		setupLog.Error(err, "unable to acquire the exclusive SQLite store and run migrations", "path", storePath)
 		os.Exit(1)
 	}
-
-	sqliteStore := sqlite.NewStore(db, storePath)
 	if err := mgr.Add(sqliteStore); err != nil {
 		setupLog.Error(err, "unable to add SQLite store as runnable")
 		os.Exit(1)
 	}
+	snapshotCipher, cipherErr := loadAgentExecutionSnapshotCipher(agentExecutionSnapshotKeyFile)
+	if cipherErr != nil {
+		setupLog.Error(cipherErr, "unable to load agent execution snapshot key; snapshot encryption fails closed",
+			"path", agentExecutionSnapshotKeyFile)
+		os.Exit(1)
+	}
+	if cipherErr := sqliteStore.SetAgentExecutionSnapshotCipher(snapshotCipher); cipherErr != nil {
+		setupLog.Error(cipherErr, "unable to activate agent execution snapshot key; snapshot encryption fails closed",
+			"path", agentExecutionSnapshotKeyFile)
+		os.Exit(1)
+	}
+	agentExecutionSnapshotStore := sqliteStore
+	setupLog.Info("agent execution binding stage enabled: executable agent Tasks freeze an immutable encrypted snapshot and write-once binding before dispatch")
+	snapshotRetentionManager := &controller.AgentExecutionSnapshotRetentionManager{
+		APIReader: mgr.GetAPIReader(),
+		Store:     sqliteStore,
+		Namespace: watchNamespace,
+		Retention: agentExecutionSnapshotRetention,
+		Interval:  agentExecutionSnapshotRetentionInterval,
+	}
+	if err := mgr.Add(snapshotRetentionManager); err != nil {
+		setupLog.Error(err, "unable to add agent execution snapshot retention manager")
+		os.Exit(1)
+	}
+	controlNamespace, err := acpControlNamespace(acpRuntimeEnabled || harnessV1Enabled, currentPodNamespace())
+	if err != nil {
+		setupLog.Error(err, "unable to configure Kubernetes ACP control store")
+		os.Exit(1)
+	}
 
-	// Create helper components
+	// Create helper components. Kubernetes ACP admission is feature-gated, but
+	// the control store, epoch manager, and cleanup recovery remain available in
+	// a controller Pod after admission is disabled so pre-existing durable ACP
+	// Sessions can still be reclaimed safely.
+	acpAdmissionGate := controller.NewACPAdmissionGate()
 	sessionManager := controller.NewSessionManager(sqliteStore)
+	var taskCleanupControlStore store.DurableControlStore
+	var durableControlStore store.DurableControlStore
+	var controllerEpochManager *controller.ControllerEpochManager
+	var acpSessionContinuity *controller.ACPSessionContinuity
+	var kubeControlStore *storekube.Store
+	if controlNamespace != "" {
+		controlStoreOptions := []storekube.Option{
+			storekube.WithAPIReader(mgr.GetAPIReader()),
+			storekube.WithWatchNamespace(watchNamespace),
+		}
+		if harnessV1Enabled {
+			controlStoreOptions = append(controlStoreOptions, storekube.WithoutClusterScopedBranchClaims())
+		}
+		kubeControlStore, err = storekube.NewComposite(
+			mgr.GetClient(), controlNamespace, sqliteStore, controlStoreOptions...,
+		)
+		if err != nil {
+			setupLog.Error(err, "unable to configure Kubernetes ACP control store")
+			os.Exit(1)
+		}
+		controllerEpochManager = controller.NewControllerEpochManager(kubeControlStore, controllerHolderID).
+			WithMirror(sqliteStore)
+		sessionManager.SetACPSessionCleanup(kubeControlStore, controllerEpochManager)
+		if err := mgr.Add(controllerEpochManager); err != nil {
+			setupLog.Error(err, "unable to add controller epoch manager")
+			os.Exit(1)
+		}
+		sessionCleanupRecovery := controller.NewSessionCleanupRecoveryManager(kubeControlStore, controllerEpochManager)
+		if err := mgr.Add(sessionCleanupRecovery); err != nil {
+			setupLog.Error(err, "unable to add Session cleanup recovery manager")
+			os.Exit(1)
+		}
+	}
+	controlStoreWiring, err := newACPControlStoreWiring(acpRuntimeEnabled, kubeControlStore)
+	if err != nil {
+		setupLog.Error(err, "unable to configure ACP control-store wiring")
+		os.Exit(1)
+	}
+	taskCleanupControlStore = controlStoreWiring.taskCleanup
+	durableControlStore = controlStoreWiring.runtime
+	if acpRuntimeEnabled || harnessV1Enabled {
+		if kubeControlStore == nil {
+			setupLog.Error(errors.New("kubernetes session control store is unavailable"),
+				"unable to create shared agent Session continuity manager")
+			os.Exit(1)
+		}
+		if harnessV1Enabled {
+			acpSessionContinuity, err = controller.NewHarnessV1SessionContinuity(controller.HarnessV1SessionContinuityConfig{
+				SessionControls: kubeControlStore, Transcripts: sqliteStore, Lineages: sqliteStore,
+			})
+		} else {
+			acpSessionContinuity, err = controller.NewACPSessionContinuity(controller.ACPSessionContinuityConfig{
+				SessionControls: kubeControlStore, Transcripts: sqliteStore, Publications: kubeControlStore, BranchClaims: kubeControlStore,
+				Lineages: sqliteStore,
+			})
+		}
+		if err != nil {
+			setupLog.Error(err, "unable to create shared agent Session continuity manager")
+			os.Exit(1)
+		}
+	}
+
+	var artifactRetentionWiring acpArtifactRetentionWiring
+	var publisherClient *publisherservice.Client
+	var artifactCapabilitySecret []byte
+	publisherWorkspaceArtifactMaxBytes := artifactcap.DefaultWorkspaceArtifactMaxBytes
+	if acpRuntimeEnabled {
+		artifactRoot := strings.TrimSpace(os.Getenv("ORKA_ACP_ARTIFACT_ROOT"))
+		if artifactRoot == "" {
+			artifactRoot = artifactcap.DefaultRoot
+		}
+		artifactRetentionWiring, err = newACPArtifactRetentionWiring(true, artifactRoot)
+		if err != nil {
+			setupLog.Error(err, "unable to configure ACP artifact retention")
+			os.Exit(1)
+		}
+		if err := mgr.Add(artifactRetentionWiring.collector); err != nil {
+			setupLog.Error(err, "unable to add ACP artifact retention")
+			os.Exit(1)
+		}
+		publisherClient, artifactCapabilitySecret, publisherWorkspaceArtifactMaxBytes, err = workspacePublisherClientFromEnv()
+		if err != nil {
+			setupLog.Error(err, "unable to configure Workspace/Publisher client")
+			os.Exit(1)
+		}
+	}
 	sessionManager.SetGatewayEventStore(sqliteStore)
 	maxTasksPerNamespaceValue := int32(maxTasksPerNamespace) //nolint:gosec // flag default is non-negative
 	gatewayConfig := gatewayruntime.Config{
@@ -872,10 +1261,12 @@ func main() {
 			setupLog.Error(err, "unable to add gateway service")
 			os.Exit(1)
 		}
+
 	}
 	webhookNotifier := controller.NewWebhookNotifier()
 	webhookNotifier.SetKubeClient(mgr.GetClient())
 	jobBuilder := controller.NewJobBuilder(mgr.GetClient())
+	jobBuilder.ControllerMode = mode
 	jobBuilder.AIWorkerImage = aiWorkerImage
 	jobBuilder.GeneralWorkerImage = generalWorkerImage
 	jobBuilder.AIWorkerServiceAccountName = aiWorkerServiceAccountName
@@ -930,46 +1321,191 @@ func main() {
 		agentSandboxConfig.ControllerNamespace = currentPodNamespace()
 	}
 
-	// Setup Task controller with helper components
-	if err := (&controller.TaskReconciler{
-		Client:                             mgr.GetClient(),
-		Scheme:                             mgr.GetScheme(),
-		JobBuilder:                         jobBuilder,
-		SessionManager:                     sessionManager,
-		WebhookNotifier:                    webhookNotifier,
-		KubeClient:                         kubeClient,
-		OutboundAccessResolver:             outboundAccessResolver,
-		BrokeredTransactionExchange:        brokeredTransactionExchange,
-		ResultStore:                        sqliteStore,
-		PlanStore:                          sqliteStore,
-		MessageStore:                       sqliteStore,
-		ArtifactStore:                      sqliteStore,
-		ExecutionEventStore:                sqliteStore,
-		EnforceNamespaceIsolation:          enforceNamespaceIsolation,
-		MaxTasksPerNamespace:               maxTasksPerNamespaceValue,
-		ExecutionWorkspaceDefaultProvider:  executionWorkspaceDefaultProvider,
-		WorkspaceProviderAPIEnabled:        workspaceProviderAPIEnabled,
-		AgentSandboxEnabled:                agentSandboxEnabled,
-		AgentSandboxConfig:                 agentSandboxConfig,
-		SubstrateEnabled:                   substrateEnabled,
-		SubstrateConfig:                    substrateConfig,
-		AIWorkerServiceAccountName:         aiWorkerServiceAccountName,
-		VendorWorkerServiceAccountName:     vendorWorkerServiceAccountName,
-		ContainerWorkerServiceAccountName:  containerWorkerServiceAccountName,
-		AIWorkerClusterRoleName:            aiWorkerClusterRoleName,
-		VendorWorkerClusterRoleName:        vendorWorkerClusterRoleName,
-		ContainerWorkerClusterRoleName:     containerWorkerClusterRoleName,
-		WorkerClusterRoleBindingNamePrefix: workerClusterRoleBindingNamePrefix,
-		EnforceTransactionCredentialAuth:   contextTokenAuthzConfig.Mode == api.ContextTokenAuthorizationModeEnforce,
+	if acpRuntimeEnabled {
+		runtimePoolReconciler := &controller.RuntimePoolReconciler{
+			Client:           mgr.GetClient(),
+			APIReader:        mgr.GetAPIReader(),
+			Scheme:           mgr.GetScheme(),
+			RuntimeNamespace: acpRuntimeNamespace,
+		}
+		providerProxyLabels, err := parseExactLabels(acpProviderProxyPodLabels)
+		if err != nil {
+			setupLog.Error(err, "unable to configure authenticated ACP provider proxy labels")
+			os.Exit(1)
+		}
+		runtimePoolReconciler.ControllerNamespace = controlNamespace
+		runtimePoolReconciler.ControllerAPIURL = jobBuilder.ControllerURL
+		runtimePoolReconciler.ControllerAPIPort = int32(apiPort)
+		runtimePoolReconciler.WorkspaceArtifactMaxBytes = publisherWorkspaceArtifactMaxBytes
+		runtimePoolReconciler.ProviderProxy = controller.RuntimePoolProviderProxyConfig{
+			BaseURL:         acpProviderProxyBaseURL,
+			Namespace:       acpProviderProxyNamespace,
+			PodLabels:       providerProxyLabels,
+			BearerTokenFile: acpProviderProxyTokenFile,
+		}
+		runtimePoolReconciler.Epochs = controllerEpochManager
+		runtimePoolReconciler.EnablePDB = true
+		runtimePoolReconciler.AllowedImages = controller.ACPRuntimeImages{
+			Codex: acpCodexRuntimeImage, Claude: acpClaudeRuntimeImage, Copilot: acpCopilotRuntimeImage,
+			Opencode: acpOpencodeRuntimeImage,
+		}
+		if err := runtimePoolReconciler.SetupWithManager(mgr); err != nil {
+			setupLog.Error(err, "unable to create controller", "controller", "RuntimePool")
+			os.Exit(1)
+		}
+	}
+
+	// Setup Task controller with helper components.
+	taskReconciler := &controller.TaskReconciler{
+		Client:                       mgr.GetClient(),
+		APIReader:                    mgr.GetAPIReader(),
+		Scheme:                       mgr.GetScheme(),
+		JobBuilder:                   jobBuilder,
+		SessionManager:               sessionManager,
+		WebhookNotifier:              webhookNotifier,
+		KubeClient:                   kubeClient,
+		ResultStore:                  sqliteStore,
+		PlanStore:                    sqliteStore,
+		MessageStore:                 sqliteStore,
+		ArtifactStore:                sqliteStore,
+		ExecutionEventStore:          sqliteStore,
+		DurableControlStore:          taskCleanupControlStore,
+		AgentExecutionSnapshots:      agentExecutionSnapshotStore,
+		MCPRegistry:                  acpMCPRegistry,
+		HarnessV1Enabled:             harnessV1Enabled,
+		HarnessV1Endpoint:            harnessV1Endpoint,
+		HarnessV1AuthSecretNamespace: harnessV1AuthSecretNamespace,
+		HarnessV1AuthSecretName:      harnessV1AuthSecretName,
+		HarnessV1AuthSecretKey:       harnessV1AuthSecretKey,
+		HarnessV1Attempts:            sqliteStore,
+		ACPArtifactRetirer:           artifactRetentionWiring.taskCleanup,
+		ACPPublicationReclaimer:      publisherClient,
+		ControllerEpochManager:       controllerEpochManager,
+		ACPAdmissionGate:             acpAdmissionGate,
+		ACPRuntimeEnabled:            acpRuntimeEnabled,
+		ACPRuntimeImages: controller.ACPRuntimeImages{
+			Codex: acpCodexRuntimeImage, Claude: acpClaudeRuntimeImage, Copilot: acpCopilotRuntimeImage,
+			Opencode: acpOpencodeRuntimeImage,
+		},
+		ACPRuntimeNamespace:         acpRuntimeNamespace,
+		OutboundAccessResolver:      outboundAccessResolver,
+		BrokeredTransactionExchange: brokeredTransactionExchange,
+
+		EnforceNamespaceIsolation:         enforceNamespaceIsolation,
+		MaxTasksPerNamespace:              maxTasksPerNamespaceValue,
+		ExecutionWorkspaceDefaultProvider: executionWorkspaceDefaultProvider,
+		WorkspaceProviderAPIEnabled:       workspaceProviderAPIEnabled,
+		AgentSandboxEnabled:               agentSandboxEnabled,
+		AgentSandboxConfig:                agentSandboxConfig,
+		SubstrateEnabled:                  substrateEnabled,
+		SubstrateConfig:                   substrateConfig,
+		AIWorkerServiceAccountName:        aiWorkerServiceAccountName,
+		VendorWorkerServiceAccountName:    vendorWorkerServiceAccountName,
+		ContainerWorkerServiceAccountName: containerWorkerServiceAccountName,
+		AIWorkerClusterRoleName:           aiWorkerClusterRoleName,
+		VendorWorkerClusterRoleName:       vendorWorkerClusterRoleName,
+		ContainerWorkerClusterRoleName:    containerWorkerClusterRoleName,
+		WorkerRoleBindingNamePrefix:       workerRoleBindingNamePrefix,
+		EnforceTransactionCredentialAuth:  contextTokenAuthzConfig.Mode == api.ContextTokenAuthorizationModeEnforce,
 		TransactionCredentialReadScopes: append(
 			[]string(nil),
 			contextTokenAuthzConfig.SecretCredentialReadScopes()...,
 		),
 		OutboundAccessTrust: outboundAccessTrust,
-	}).SetupWithManager(mgr); err != nil {
+	}
+	if err := taskReconciler.SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "Task")
 		os.Exit(1)
 	}
+	var harnessV1HTTPClient *http.Client
+	if harnessV1Enabled {
+		if controllerEpochManager == nil || agentExecutionSnapshotStore == nil {
+			setupLog.Error(errors.New("harness v1 requires controller epoch and encrypted snapshot stores"),
+				"unable to add harness v1 dispatcher")
+			os.Exit(1)
+		}
+		var clientErr error
+		harnessV1HTTPClient, clientErr = newHarnessV1TLSHTTPClient(harnessV1CAFile)
+		if clientErr != nil {
+			setupLog.Error(clientErr, "unable to configure harness v1 TLS client")
+			os.Exit(1)
+		}
+		harnessV1Dispatcher := &controller.HarnessV1Dispatcher{
+			Client:          mgr.GetClient(),
+			APIReader:       mgr.GetAPIReader(),
+			Attempts:        sqliteStore,
+			Snapshots:       agentExecutionSnapshotStore,
+			ResultStore:     sqliteStore,
+			EventStore:      sqliteStore,
+			ExternalEffects: kubeControlStore,
+			BrokeredToolExecutor: controller.HarnessV1BrokeredToolExecutorFunc(func(
+				ctx context.Context,
+				namespace string,
+				tool *corev1alpha1.Tool,
+				request harness.ToolCallRequest,
+			) (json.RawMessage, error) {
+				executor := worker.NewToolExecutorForNamespace(namespace, kubeClient, nil, outboundAccessResolver)
+				executor.SetTransactionExchangeConfig(brokeredTransactionExchange)
+				execCtx := worker.WithToolCallID(ctx, request.ToolCallID)
+				execCtx = worker.WithToolIdempotencyKey(execCtx, request.IdempotencyKey)
+				result, executeErr := executor.Execute(execCtx, tool, request.Input)
+				return json.RawMessage(result), executeErr
+			}),
+			Sessions:      acpSessionContinuity,
+			Epochs:        controllerEpochManager,
+			Interval:      harnessV1DispatchInterval,
+			MaxConcurrent: harnessV1DispatchWorkers,
+			HTTPClient:    harnessV1HTTPClient,
+		}
+		taskReconciler.HarnessV1SettlementAcknowledger = harnessV1Dispatcher
+		if err := mgr.Add(harnessV1Dispatcher); err != nil {
+			setupLog.Error(err, "unable to add harness v1 dispatcher")
+			os.Exit(1)
+		}
+	}
+	if harnessV1Enabled || acpRuntimeEnabled {
+		// Session settlement in both harness planes commits terminal Task status
+		// through the shared Kubernetes outbox.
+		agentOutboxProjector := &controller.ACPOutboxProjector{
+			Client: mgr.GetClient(), Store: kubeControlStore, Epochs: controllerEpochManager, WorkerID: controllerHolderID + "-outbox",
+		}
+		if err := mgr.Add(agentOutboxProjector); err != nil {
+			setupLog.Error(err, "unable to add agent outbox projector")
+			os.Exit(1)
+		}
+	}
+	if acpRuntimeEnabled {
+		acpDispatcher := &controller.ACPDispatcher{
+			Client: mgr.GetClient(), APIReader: mgr.GetAPIReader(), Store: durableControlStore, ResultStore: sqliteStore,
+			Snapshots: agentExecutionSnapshotStore,
+			Epochs:    controllerEpochManager, Sessions: acpSessionContinuity,
+			Publisher: publisherClient, ArtifactCapabilitySecret: artifactCapabilitySecret,
+			ArtifactReservations: artifactRetentionWiring.collector,
+			AdmissionGate:        acpAdmissionGate,
+			IdlePoolTTL:          acpIdlePoolTTL,
+			MCPRegistry:          acpMCPRegistry,
+		}
+		if err := mgr.Add(acpDispatcher); err != nil {
+			setupLog.Error(err, "unable to add ACP dispatcher")
+			os.Exit(1)
+		}
+		if strings.TrimSpace(acpUpgradeDrainOptions.MarkerNamespace) == "" {
+			acpUpgradeDrainOptions.MarkerNamespace = controlNamespace
+		}
+		upgradeDrain := controller.NewACPUpgradeDrainCoordinator(
+			mgr.GetClient(), mgr.GetAPIReader(), controllerEpochManager, durableControlStore,
+			&controller.KubernetesACPUpgradeDrainBarrierObserver{Reader: mgr.GetAPIReader(), Outbox: sqliteStore},
+			acpAdmissionGate, acpUpgradeDrainOptions,
+		)
+		if err := mgr.Add(upgradeDrain); err != nil {
+			setupLog.Error(err, "unable to add ACP planned-upgrade drain coordinator")
+			os.Exit(1)
+		}
+		if err := mgr.AddReadyzCheck("acp-upgrade-drain", upgradeDrain.ReadyzChecker()); err != nil {
+			setupLog.Error(err, "unable to add ACP planned-upgrade readiness check")
+			os.Exit(1)
+		}
+	}
 
 	if err := (&controller.OutboundAccessPolicyReconciler{
 		Client:                     mgr.GetClient(),
@@ -1012,8 +1548,8 @@ func main() {
 		)
 		os.Exit(1)
 	}
-	registerWorkspaceCoreControllers := workspaceProviderAPIEnabled
-	if !workspaceProviderAPIEnabled {
+	registerWorkspaceCoreControllers := acpRuntimeEnabled && workspaceProviderAPIEnabled
+	if acpRuntimeEnabled && !workspaceProviderAPIEnabled {
 		workspaceAPIsInstalled, err := workspaceCleanupAPIsInstalled(mgr.GetRESTMapper())
 		if err != nil {
 			setupLog.Error(err, "unable to discover workspace cleanup APIs")
@@ -1088,8 +1624,10 @@ func main() {
 	}
 
 	if err := (&controller.AgentRuntimeReconciler{
-		Client: mgr.GetClient(),
-		Scheme: mgr.GetScheme(),
+		Client:              mgr.GetClient(),
+		APIReader:           mgr.GetAPIReader(),
+		Scheme:              mgr.GetScheme(),
+		HarnessV1HTTPClient: harnessV1HTTPClient,
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "AgentRuntime")
 		os.Exit(1)
@@ -1133,11 +1671,12 @@ func main() {
 	}
 
 	if err := (&controller.RepositoryScanReconciler{
-		Client:        mgr.GetClient(),
-		Scheme:        mgr.GetScheme(),
-		SecurityStore: sqliteStore,
-		ArtifactStore: sqliteStore,
-		ResultStore:   sqliteStore,
+		Client:           mgr.GetClient(),
+		Scheme:           mgr.GetScheme(),
+		SecurityStore:    sqliteStore,
+		ArtifactStore:    sqliteStore,
+		ResultStore:      sqliteStore,
+		PublicationStore: sqliteStore,
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "RepositoryScan")
 		os.Exit(1)
@@ -1164,7 +1703,12 @@ func main() {
 		setupLog.Error(err, "unable to set up ready check")
 		os.Exit(1)
 	}
-
+	if managerAdmissionEnabled {
+		if err := mgr.AddReadyzCheck("webhook", mgr.GetWebhookServer().StartedChecker()); err != nil {
+			setupLog.Error(err, "unable to set up webhook ready check")
+			os.Exit(1)
+		}
+	}
 	// Register coordination tools the Anthropic/OpenAI proxy advertises but that
 	// RegisterChatToolsDefault does not provide. Without these the proxy lists the
 	// tool in coordinatorProxyTools but ToLLMTools silently drops it, leaving the
@@ -1176,6 +1720,7 @@ func main() {
 	apiServer := api.NewServer(mgr.GetClient(), sessionManager, api.ServerConfig{
 		Port:                      apiPort,
 		WatchNamespace:            watchNamespace,
+		ExecutionMode:             mode,
 		EnforceNamespaceIsolation: enforceNamespaceIsolation,
 		OIDC: api.OIDCConfig{
 			Issuer:          oidcIssuer,
@@ -1191,6 +1736,7 @@ func main() {
 		PlanStore:                 sqliteStore,
 		MessageStore:              sqliteStore,
 		ArtifactStore:             sqliteStore,
+		ArtifactReservations:      artifactRetentionWiring.runtimeReservations,
 		MemoryStore:               sqliteStore,
 		MemoryProposalStore:       sqliteStore,
 		SecurityStore:             sqliteStore,
@@ -1213,8 +1759,46 @@ func main() {
 			MaxTasksPerTurn:        chatMaxTasksPerTurn,
 			MaxSessionSize:         chatMaxSessionSize,
 			MaxPrematureEndRetries: chatMaxPrematureEndRetries,
+			RuntimeAvailability: api.ACPRuntimeAvailability{
+				Codex:    acpRuntimeEnabled && controller.ACPRuntimeImageAvailable(acpCodexRuntimeImage),
+				Claude:   acpRuntimeEnabled && controller.ACPRuntimeImageAvailable(acpClaudeRuntimeImage),
+				Copilot:  acpRuntimeEnabled && controller.ACPRuntimeImageAvailable(acpCopilotRuntimeImage),
+				OpenCode: acpRuntimeEnabled && controller.ACPRuntimeImageAvailable(acpOpencodeRuntimeImage),
+			},
 		},
 	})
+	if acpRuntimeEnabled {
+		mcpBroker, err := controller.NewProductionACPMCPBroker(controller.ACPMCPBrokerDependencies{
+			Reader: mgr.GetAPIReader(), Epochs: controllerEpochManager, ControlStore: durableControlStore,
+			KubeClient: kubeClient, Registry: acpMCPRegistry,
+			OutboundAccess: outboundAccessResolver, TransactionExchange: brokeredTransactionExchange,
+			EnforceTransactionCredentialAuth: contextTokenAuthzConfig.Mode == api.ContextTokenAuthorizationModeEnforce,
+			TransactionCredentialReadScopes:  contextTokenAuthzConfig.SecretCredentialReadScopes(),
+			ContextFactory: func(ctx context.Context, request harnessv2.MCPBrokerCallRequest) (*tools.ToolContext, error) {
+				task, ok := controller.ACPMCPAuthenticatedTaskFromContext(ctx)
+				if !ok || task.Namespace != request.Namespace || task.UID != string(request.Metadata.TaskUID) {
+					return nil, fmt.Errorf("authenticated ACP MCP task context is unavailable")
+				}
+				return &tools.ToolContext{
+					Client: mgr.GetClient(), KubeClient: kubeClient, Namespace: request.Namespace,
+					SessionID: string(request.Authorization.RuntimeSessionUID), TaskID: task.Name,
+					TaskUID: task.UID, ParentTaskID: task.ParentTaskID, AgentName: task.AgentName,
+					Tenant: request.Namespace, WatchNamespace: watchNamespace,
+					EnforceNamespaceIsolation: enforceNamespaceIsolation, Brokered: true,
+					ResultStore: sqliteStore, MessageStore: sqliteStore, SessionDeleter: sessionManager,
+					MemoryReader: sqliteStore, MemoryProposalWriter: sqliteStore, TranscriptSearcher: sqliteStore,
+				}, nil
+			},
+		})
+		if err != nil {
+			setupLog.Error(err, "unable to construct ACP MCP broker")
+			os.Exit(1)
+		}
+		if err := apiServer.RegisterACPMCPBroker(mcpBroker); err != nil {
+			setupLog.Error(err, "unable to register ACP MCP broker")
+			os.Exit(1)
+		}
+	}
 
 	// Add API server as a runnable
 	if err := mgr.Add(apiServer); err != nil {
@@ -1223,12 +1807,186 @@ func main() {
 	}
 
 	setupLog.Info("starting manager")
-	if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil {
+	if err := mgr.Start(processCtx); err != nil {
+		stopProcess()
 		setupLog.Error(err, "problem running manager")
 		os.Exit(1)
 	}
 }
 
+func newBrokeredDelegateTaskSubjectTokenResolver(
+	reader crclient.Reader,
+	serviceAccountTokenFile string,
+) tools.DelegateTaskSubjectTokenResolver {
+	return func(ctx context.Context, parentTask *corev1alpha1.Task, tokenSource string) (string, error) {
+		switch tokenSource {
+		case contexttoken.TTSTokenSourceServiceAccount:
+			return workerenv.ReadTokenFile(serviceAccountTokenFile, "controller service account token")
+		case contexttoken.TTSTokenSourceIncoming:
+			if reader == nil {
+				return "", fmt.Errorf("kubernetes reader is required for incoming brokered transaction tokens")
+			}
+			if parentTask == nil || parentTask.UID == "" {
+				return "", fmt.Errorf("authenticated parent Task identity is required for incoming brokered transaction tokens")
+			}
+			secretName := strings.TrimSpace(parentTask.Annotations[labels.AnnotationTransactionTokenSecret])
+			if secretName == "" {
+				return "", fmt.Errorf("authenticated parent Task does not reference an incoming transaction-token Secret")
+			}
+			secret := &corev1.Secret{}
+			if err := reader.Get(ctx, crclient.ObjectKey{Name: secretName, Namespace: parentTask.Namespace}, secret); err != nil {
+				return "", fmt.Errorf("read authenticated parent transaction-token Secret: %w", err)
+			}
+			if !secretOwnedByTask(secret, parentTask) {
+				return "", fmt.Errorf("authenticated parent transaction-token Secret is not owned by the parent Task")
+			}
+			token := strings.TrimSpace(string(secret.Data["token"]))
+			if token == "" {
+				return "", fmt.Errorf("authenticated parent transaction-token Secret token is missing or empty")
+			}
+			return token, nil
+		case contexttoken.TTSTokenSourceNone:
+			return "", fmt.Errorf("context token TTS token source %q does not provide a subject token", tokenSource)
+		default:
+			return "", fmt.Errorf("unsupported context token TTS token source %q", tokenSource)
+		}
+	}
+}
+
+func secretOwnedByTask(secret *corev1.Secret, task *corev1alpha1.Task) bool {
+	if secret == nil || task == nil || task.UID == "" || secret.Namespace != task.Namespace {
+		return false
+	}
+	for _, owner := range secret.OwnerReferences {
+		if owner.APIVersion == corev1alpha1.GroupVersion.String() && owner.Kind == taskResourceKind &&
+			owner.Name == task.Name && owner.UID == task.UID {
+			return true
+		}
+	}
+	return false
+}
+
+func workspacePublisherClientFromEnv() (*publisherservice.Client, []byte, int64, error) {
+	artifactSecretPath := strings.TrimSpace(os.Getenv("ORKA_ACP_ARTIFACT_CAPABILITY_SECRET_FILE"))
+	var artifactSecret []byte
+	if artifactSecretPath != "" {
+		value, err := os.ReadFile(artifactSecretPath)
+		if err != nil {
+			return nil, nil, 0, fmt.Errorf("read ACP artifact capability secret: %w", err)
+		}
+		artifactSecret = []byte(strings.TrimSpace(string(value)))
+	}
+	baseURL := strings.TrimSpace(os.Getenv("ORKA_WORKSPACE_PUBLISHER_URL"))
+	if baseURL == "" {
+		return nil, artifactSecret, artifactcap.DefaultWorkspaceArtifactMaxBytes, nil
+	}
+	bearerPath := strings.TrimSpace(os.Getenv("ORKA_WORKSPACE_PUBLISHER_CONTROLLER_TOKEN_FILE"))
+	capabilityPath := strings.TrimSpace(os.Getenv("ORKA_WORKSPACE_PUBLISHER_CAPABILITY_SECRET_FILE"))
+	if bearerPath == "" || capabilityPath == "" {
+		return nil, nil, 0, fmt.Errorf("Workspace/Publisher auth file paths are required")
+	}
+	bearer, err := os.ReadFile(bearerPath)
+	if err != nil {
+		return nil, nil, 0, fmt.Errorf("read Workspace/Publisher controller token: %w", err)
+	}
+	capability, err := os.ReadFile(capabilityPath)
+	if err != nil {
+		return nil, nil, 0, fmt.Errorf("read Workspace/Publisher capability secret: %w", err)
+	}
+	client, err := publisherservice.NewClient(publisherservice.ClientConfig{
+		BaseURL: baseURL, BearerToken: []byte(strings.TrimSpace(string(bearer))),
+		CapabilitySecret: []byte(strings.TrimSpace(string(capability))),
+	})
+	if err != nil {
+		return nil, nil, 0, err
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	capabilities, err := client.Capabilities(ctx)
+	if err != nil {
+		return nil, nil, 0, fmt.Errorf("read Workspace/Publisher capabilities: %w", err)
+	}
+	if capabilities.Protocol != publisherservice.ProtocolVersion {
+		return nil, nil, 0, fmt.Errorf("Workspace/Publisher protocol %q is incompatible", capabilities.Protocol)
+	}
+	maxArtifactBytes := capabilities.Limits.MaxWorkspaceArtifactBytes
+	if maxArtifactBytes <= 0 || maxArtifactBytes == math.MaxInt64 {
+		return nil, nil, 0, fmt.Errorf("Workspace/Publisher max workspace artifact bytes must be positive and less than %d", int64(math.MaxInt64))
+	}
+	return client, artifactSecret, maxArtifactBytes, nil
+}
+
+func envStringDefault(name, fallback string) string {
+	if value := strings.TrimSpace(os.Getenv(name)); value != "" {
+		return value
+	}
+	return fallback
+}
+
+func envDurationDefault(name string, fallback time.Duration) time.Duration {
+	value := strings.TrimSpace(os.Getenv(name))
+	if value == "" {
+		return fallback
+	}
+	parsed, err := time.ParseDuration(value)
+	if err != nil || parsed <= 0 {
+		return fallback
+	}
+	return parsed
+}
+
+func parseExactLabels(raw string) (map[string]string, error) {
+	result := map[string]string{}
+	for entry := range strings.SplitSeq(raw, ",") {
+		entry = strings.TrimSpace(entry)
+		if entry == "" {
+			continue
+		}
+		key, value, ok := strings.Cut(entry, "=")
+		key, value = strings.TrimSpace(key), strings.TrimSpace(value)
+		if !ok || key == "" || value == "" {
+			return nil, fmt.Errorf("provider proxy Pod label %q must be key=value", entry)
+		}
+		if _, exists := result[key]; exists {
+			return nil, fmt.Errorf("provider proxy Pod label %q is duplicated", key)
+		}
+		result[key] = value
+	}
+	if len(result) == 0 {
+		return nil, fmt.Errorf("at least one provider proxy Pod label is required")
+	}
+	return result, nil
+}
+
+func managerCacheOptions(watchNamespace, acpRuntimeNamespace string) cache.Options {
+	watchNamespace = strings.TrimSpace(watchNamespace)
+	if watchNamespace == "" {
+		return cache.Options{}
+	}
+
+	options := cache.Options{
+		DefaultNamespaces: map[string]cache.Config{watchNamespace: {}},
+	}
+	runtimeNamespace := strings.TrimSpace(acpRuntimeNamespace)
+	if runtimeNamespace == "" {
+		return options
+	}
+
+	runtimeChildNamespaces := map[string]cache.Config{
+		watchNamespace:   {},
+		runtimeNamespace: {},
+	}
+	options.ByObject = make(map[crclient.Object]cache.ByObject)
+	options.ByObject[&appsv1.Deployment{}] = cache.ByObject{Namespaces: runtimeChildNamespaces}
+	options.ByObject[&appsv1.ReplicaSet{}] = cache.ByObject{Namespaces: runtimeChildNamespaces}
+	options.ByObject[&corev1.Pod{}] = cache.ByObject{Namespaces: runtimeChildNamespaces}
+	options.ByObject[&corev1.Service{}] = cache.ByObject{Namespaces: runtimeChildNamespaces}
+	options.ByObject[&corev1.Secret{}] = cache.ByObject{Namespaces: runtimeChildNamespaces}
+	options.ByObject[&networkingv1.NetworkPolicy{}] = cache.ByObject{Namespaces: runtimeChildNamespaces}
+	options.ByObject[&policyv1.PodDisruptionBudget{}] = cache.ByObject{Namespaces: runtimeChildNamespaces}
+	return options
+}
+
 func envBool(name string) bool {
 	value := strings.TrimSpace(os.Getenv(name))
 	if value == "" {
@@ -1242,13 +2000,123 @@ func envBool(name string) bool {
 	return parsed
 }
 
+func acpControlNamespace(runtimeEnabled bool, controllerNamespace string) (string, error) {
+	controllerNamespace = strings.TrimSpace(controllerNamespace)
+	if controllerNamespace == "" {
+		if !runtimeEnabled {
+			return "", nil
+		}
+		return "", fmt.Errorf("controller namespace is unavailable")
+	}
+	return controllerNamespace, nil
+}
+
+type acpArtifactRetentionWiring struct {
+	collector           *artifactcap.Collector
+	taskCleanup         artifactcap.IdentityRetirer
+	runtimeReservations artifactcap.CapabilityReservationRecorder
+}
+
+func newACPArtifactRetentionWiring(runtimeEnabled bool, root string) (acpArtifactRetentionWiring, error) {
+	if !runtimeEnabled {
+		return acpArtifactRetentionWiring{}, nil
+	}
+	collector, err := artifactcap.NewCollector(artifactcap.CollectorConfig{Root: root})
+	if err != nil {
+		return acpArtifactRetentionWiring{}, err
+	}
+	wiring := acpArtifactRetentionWiring{
+		collector:           collector,
+		taskCleanup:         collector,
+		runtimeReservations: collector,
+	}
+	return wiring, nil
+}
+
+type acpControlStoreWiring struct {
+	taskCleanup store.DurableControlStore
+	runtime     store.DurableControlStore
+}
+
+func newACPControlStoreWiring(runtimeEnabled bool, kubeControlStore *storekube.Store) (acpControlStoreWiring, error) {
+	var wiring acpControlStoreWiring
+	if !runtimeEnabled {
+		return wiring, nil
+	}
+	if kubeControlStore == nil {
+		return acpControlStoreWiring{}, fmt.Errorf("kubernetes ACP control store is unavailable")
+	}
+	wiring.taskCleanup = kubeControlStore
+	wiring.runtime = kubeControlStore
+	return wiring, nil
+}
+
+func currentControllerHolderID() string {
+	if holder := strings.TrimSpace(os.Getenv("ORKA_CONTROLLER_HOLDER_ID")); holder != "" {
+		return holder
+	}
+	hostname, err := os.Hostname()
+	if err != nil {
+		hostname = ""
+	}
+	return controllerHolderIDForIncarnation(hostname, controllerProcessIncarnation)
+}
+
+func controllerHolderIDForIncarnation(hostname, incarnation string) string {
+	hostname = strings.TrimSpace(hostname)
+	if hostname == "" {
+		hostname = "controller"
+	}
+	return hostname + "-" + strings.TrimSpace(incarnation)
+}
+
 func currentPodNamespace() string {
 	if namespace := strings.TrimSpace(os.Getenv(workerenv.PodNamespace)); namespace != "" {
 		return namespace
 	}
-	data, err := os.ReadFile("/var/run/secrets/kubernetes.io/serviceaccount/namespace")
+	data, err := os.ReadFile(serviceAccountNamespaceFile)
 	if err != nil {
 		return ""
 	}
 	return strings.TrimSpace(string(data))
 }
+
+// loadAgentExecutionSnapshotCipher reads the AES-256 snapshot key from a file
+// holding either exactly 32 raw bytes or whitespace-padded base64 text.
+func loadAgentExecutionSnapshotCipher(path string) (*sqlite.AgentExecutionSnapshotCipher, error) {
+	raw, err := os.ReadFile(path) // #nosec G304 -- operator-supplied key path.
+	if err != nil {
+		return nil, err
+	}
+	key := raw
+	if len(key) != sqlite.AgentExecutionSnapshotKeyBytes {
+		decoded, decodeErr := base64.StdEncoding.DecodeString(string(bytes.TrimSpace(raw)))
+		if decodeErr != nil || len(decoded) != sqlite.AgentExecutionSnapshotKeyBytes {
+			return nil, fmt.Errorf("snapshot key must be %d raw bytes or their base64 encoding", sqlite.AgentExecutionSnapshotKeyBytes)
+		}
+		key = decoded
+	}
+	return sqlite.NewAgentExecutionSnapshotCipher(key)
+}
+
+func validateAgentExecutionSnapshotOptions(
+	mode executionmode.Mode,
+	keyFile string,
+	retention time.Duration,
+	interval time.Duration,
+) error {
+	if strings.TrimSpace(keyFile) == "" {
+		return fmt.Errorf("%s requires --agent-execution-snapshot-key-file", mode)
+	}
+	if retention <= 0 || interval <= 0 {
+		return errors.New("agent execution snapshot retention and retention interval must be positive")
+	}
+	return nil
+}
+
+func validateHarnessV1DispatchOptions(interval time.Duration, workers int) error {
+	if interval <= 0 {
+		return errors.New("harness v1 dispatch interval must be positive")
+	}
+	return controller.ValidateHarnessV1DispatchWorkers(workers)
+}
diff --git a/cmd/main_test.go b/cmd/main_test.go
index b0e4b8e03..d8b70fd61 100644
--- a/cmd/main_test.go
+++ b/cmd/main_test.go
@@ -1,14 +1,523 @@
 package main
 
 import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"reflect"
+	"slices"
+	"strings"
 	"testing"
+	"time"
 
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	networkingv1 "k8s.io/api/networking/v1"
+	policyv1 "k8s.io/api/policy/v1"
 	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/cache"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
 	workspacev1alpha1 "github.com/orka-agents/orka/api/workspace/v1alpha1"
+	"github.com/orka-agents/orka/internal/artifactcap"
+	"github.com/orka-agents/orka/internal/contexttoken"
+	"github.com/orka-agents/orka/internal/executionmode"
+	"github.com/orka-agents/orka/internal/labels"
+	"github.com/orka-agents/orka/internal/outboundaccess"
+	publisherservice "github.com/orka-agents/orka/internal/publisher/service"
+	storekube "github.com/orka-agents/orka/internal/store/kube"
 )
 
+func TestBrokeredDelegateTaskSubjectTokenResolverUsesOwnedIncomingSecret(t *testing.T) {
+	parent := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{
+		Name: "parent", Namespace: "team-a", UID: types.UID("parent-uid"),
+		Annotations: map[string]string{labels.AnnotationTransactionTokenSecret: "parent-token"},
+	}}
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "parent-token", Namespace: parent.Namespace,
+			OwnerReferences: []metav1.OwnerReference{{
+				APIVersion: corev1alpha1.GroupVersion.String(), Kind: taskResourceKind, Name: parent.Name, UID: parent.UID,
+			}},
+		},
+		Data: map[string][]byte{"token": []byte(" request-scoped-token ")},
+	}
+	reader := fake.NewClientBuilder().WithScheme(scheme).WithObjects(secret).Build()
+	resolver := newBrokeredDelegateTaskSubjectTokenResolver(reader, "")
+
+	token, err := resolver(context.Background(), parent, contexttoken.TTSTokenSourceIncoming)
+	if err != nil {
+		t.Fatalf("resolve incoming subject token: %v", err)
+	}
+	if token != "request-scoped-token" {
+		t.Fatalf("resolved token = %q, want request-scoped token", token)
+	}
+}
+
+func TestControllerHolderIDIsProcessIncarnationUnique(t *testing.T) {
+	first := controllerHolderIDForIncarnation("workstation", "first-process")
+	second := controllerHolderIDForIncarnation("workstation", "second-process")
+	if first == second {
+		t.Fatalf("holder IDs for distinct process incarnations match: %q", first)
+	}
+	if first == "workstation" || second == "workstation" {
+		t.Fatal("holder ID omitted its process incarnation")
+	}
+}
+
+func TestValidateStaticTrustedServiceReferences(t *testing.T) {
+	sameNamespace, err := outboundaccess.ParseTrustedServiceReferences("team-a/gateway:8443")
+	if err != nil {
+		t.Fatal(err)
+	}
+	crossNamespace, err := outboundaccess.ParseTrustedServiceReferences("shared/gateway:8443")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := validateStaticTrustedServiceReferences("team-a", outboundaccess.TrustConfig{
+		Gateways: sameNamespace,
+	}); err != nil {
+		t.Fatalf("same-namespace trust rejected: %v", err)
+	}
+	if err := validateStaticTrustedServiceReferences("team-a", outboundaccess.TrustConfig{
+		TokenEndpoints: crossNamespace,
+	}); err == nil || !strings.Contains(err.Error(), `must be in controller watch namespace "team-a"`) {
+		t.Fatalf("cross-namespace trust error = %v", err)
+	}
+}
+
+func TestCurrentControllerHolderIDPreservesExplicitOverride(t *testing.T) {
+	t.Setenv("ORKA_CONTROLLER_HOLDER_ID", " explicit-controller ")
+	if got := currentControllerHolderID(); got != "explicit-controller" {
+		t.Fatalf("currentControllerHolderID() = %q, want explicit-controller", got)
+	}
+}
+
+func TestBrokeredDelegateTaskSubjectTokenResolverRejectsUnownedIncomingSecret(t *testing.T) {
+	parent := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{
+		Name: "parent", Namespace: "team-a", UID: types.UID("parent-uid"),
+		Annotations: map[string]string{labels.AnnotationTransactionTokenSecret: "other-token"},
+	}}
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "other-token", Namespace: parent.Namespace,
+			OwnerReferences: []metav1.OwnerReference{{
+				APIVersion: corev1alpha1.GroupVersion.String(), Kind: taskResourceKind, Name: "other", UID: types.UID("other-uid"),
+			}},
+		},
+		Data: map[string][]byte{"token": []byte("must-not-be-used")},
+	}
+	reader := fake.NewClientBuilder().WithScheme(scheme).WithObjects(secret).Build()
+	resolver := newBrokeredDelegateTaskSubjectTokenResolver(reader, "")
+
+	_, err := resolver(context.Background(), parent, contexttoken.TTSTokenSourceIncoming)
+	if err == nil || !strings.Contains(err.Error(), "not owned by the parent Task") {
+		t.Fatalf("resolve incoming subject token error = %v, want owner rejection", err)
+	}
+}
+
+func TestBrokeredDelegateTaskSubjectTokenResolverReadsControllerServiceAccountPerRequest(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "service-account-token")
+	if err := os.WriteFile(path, []byte(" controller-service-account-token "), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	resolver := newBrokeredDelegateTaskSubjectTokenResolver(nil, path)
+
+	token, err := resolver(context.Background(), &corev1alpha1.Task{}, contexttoken.TTSTokenSourceServiceAccount)
+	if err != nil {
+		t.Fatalf("resolve service account subject token: %v", err)
+	}
+	if token != "controller-service-account-token" {
+		t.Fatalf("resolved service account token = %q", token)
+	}
+}
+
+func TestWorkspacePublisherClientFromEnvUsesBoundedFallbackWithoutPublisher(t *testing.T) {
+	t.Setenv("ORKA_WORKSPACE_PUBLISHER_URL", "")
+	t.Setenv("ORKA_ACP_ARTIFACT_CAPABILITY_SECRET_FILE", "")
+
+	publisherClient, artifactSecret, gotLimit, err := workspacePublisherClientFromEnv()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if publisherClient != nil {
+		t.Fatal("Workspace/Publisher client is non-nil")
+	}
+	if len(artifactSecret) != 0 {
+		t.Fatalf("artifact capability secret length = %d, want 0", len(artifactSecret))
+	}
+	if gotLimit != artifactcap.DefaultWorkspaceArtifactMaxBytes {
+		t.Fatalf("workspace artifact fallback = %d, want %d", gotLimit, artifactcap.DefaultWorkspaceArtifactMaxBytes)
+	}
+}
+
+func TestWorkspacePublisherClientFromEnvNegotiatesWorkspaceArtifactLimit(t *testing.T) {
+	const wantLimit = int64(192 << 20)
+	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		if request.URL.Path != publisherservice.CapabilitiesPath {
+			http.NotFound(writer, request)
+			return
+		}
+		writer.Header().Set("Content-Type", "application/json")
+		if err := json.NewEncoder(writer).Encode(publisherservice.CapabilitiesResponse{
+			Protocol: publisherservice.ProtocolVersion,
+			Limits: publisherservice.CapabilityLimits{
+				MaxWorkspaceArtifactBytes: wantLimit,
+			},
+		}); err != nil {
+			t.Errorf("encode capabilities: %v", err)
+		}
+	}))
+	defer server.Close()
+
+	dir := t.TempDir()
+	bearerPath := filepath.Join(dir, "controller-token")
+	capabilityPath := filepath.Join(dir, "capability-secret")
+	if err := os.WriteFile(bearerPath, []byte("controller-token-0123456789abcdef"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(capabilityPath, []byte("capability-secret-0123456789abcdef"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("ORKA_WORKSPACE_PUBLISHER_URL", server.URL)
+	t.Setenv("ORKA_WORKSPACE_PUBLISHER_CONTROLLER_TOKEN_FILE", bearerPath)
+	t.Setenv("ORKA_WORKSPACE_PUBLISHER_CAPABILITY_SECRET_FILE", capabilityPath)
+	t.Setenv("ORKA_ACP_ARTIFACT_CAPABILITY_SECRET_FILE", "")
+
+	publisherClient, artifactSecret, gotLimit, err := workspacePublisherClientFromEnv()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if publisherClient == nil {
+		t.Fatal("Workspace/Publisher client is nil")
+	}
+	if len(artifactSecret) != 0 {
+		t.Fatalf("artifact capability secret length = %d, want 0", len(artifactSecret))
+	}
+	if gotLimit != wantLimit {
+		t.Fatalf("workspace artifact limit = %d, want %d", gotLimit, wantLimit)
+	}
+}
+
+func TestWorkspacePublisherClientFromEnvRejectsInvalidArtifactCapability(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, _ *http.Request) {
+		writer.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(writer).Encode(publisherservice.CapabilitiesResponse{
+			Protocol: publisherservice.ProtocolVersion,
+		})
+	}))
+	defer server.Close()
+
+	dir := t.TempDir()
+	bearerPath := filepath.Join(dir, "controller-token")
+	capabilityPath := filepath.Join(dir, "capability-secret")
+	if err := os.WriteFile(bearerPath, []byte("controller-token-0123456789abcdef"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(capabilityPath, []byte("capability-secret-0123456789abcdef"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("ORKA_WORKSPACE_PUBLISHER_URL", server.URL)
+	t.Setenv("ORKA_WORKSPACE_PUBLISHER_CONTROLLER_TOKEN_FILE", bearerPath)
+	t.Setenv("ORKA_WORKSPACE_PUBLISHER_CAPABILITY_SECRET_FILE", capabilityPath)
+	t.Setenv("ORKA_ACP_ARTIFACT_CAPABILITY_SECRET_FILE", "")
+
+	if _, _, _, err := workspacePublisherClientFromEnv(); err == nil {
+		t.Fatal("workspacePublisherClientFromEnv() error = nil, want invalid Publisher limit")
+	}
+}
+
+func TestACPControlNamespace(t *testing.T) {
+	tests := []struct {
+		name                string
+		runtimeEnabled      bool
+		controllerNamespace string
+		want                string
+		wantErr             bool
+	}{
+		{
+			name: "disabled runtime does not require controller namespace",
+		},
+		{
+			name:                "disabled runtime keeps discovered controller namespace for cleanup",
+			controllerNamespace: "orka-system",
+			want:                "orka-system",
+		},
+		{
+			name:           "enabled runtime fails closed without controller namespace",
+			runtimeEnabled: true,
+			wantErr:        true,
+		},
+		{
+			name:                "enabled runtime rejects blank controller namespace",
+			runtimeEnabled:      true,
+			controllerNamespace: "  ",
+			wantErr:             true,
+		},
+		{
+			name:                "enabled runtime uses controller namespace",
+			runtimeEnabled:      true,
+			controllerNamespace: " orka-system ",
+			want:                "orka-system",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := acpControlNamespace(tt.runtimeEnabled, tt.controllerNamespace)
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("acpControlNamespace() error = %v, wantErr %t", err, tt.wantErr)
+			}
+			if got != tt.want {
+				t.Fatalf("acpControlNamespace() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestACPArtifactRetentionWiring(t *testing.T) {
+	tests := []struct {
+		name                    string
+		runtimeEnabled          bool
+		wantCollector           bool
+		wantRuntimeReservations bool
+	}{
+		{
+			name: "harness v1 has no ACP artifact wiring",
+		},
+		{
+			name:                    "enabled runtime exposes reservation recorder",
+			runtimeEnabled:          true,
+			wantCollector:           true,
+			wantRuntimeReservations: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			wiring, err := newACPArtifactRetentionWiring(
+				tt.runtimeEnabled,
+				filepath.Join(t.TempDir(), "artifacts"),
+			)
+			if err != nil {
+				t.Fatalf("newACPArtifactRetentionWiring() error = %v", err)
+			}
+			if got := wiring.collector != nil; got != tt.wantCollector {
+				t.Fatalf("collector present = %t, want %t", got, tt.wantCollector)
+			}
+			if wiring.collector == nil {
+				if wiring.taskCleanup != nil || wiring.runtimeReservations != nil {
+					t.Fatal("disabled ACP artifact wiring retained active components")
+				}
+				return
+			}
+			if wiring.taskCleanup != wiring.collector {
+				t.Fatal("Task cleanup retirer does not preserve the collector")
+			}
+			if got := wiring.runtimeReservations != nil; got != tt.wantRuntimeReservations {
+				t.Fatalf("runtime reservation recorder present = %t, want %t", got, tt.wantRuntimeReservations)
+			}
+			if wiring.runtimeReservations != nil && wiring.runtimeReservations != wiring.collector {
+				t.Fatal("runtime reservation recorder does not preserve the collector")
+			}
+			if !wiring.collector.NeedLeaderElection() {
+				t.Fatal("collector must remain a leader-elected cleanup runnable")
+			}
+		})
+	}
+}
+
+func TestACPArtifactRetentionWiringFailsClosedForUnsafeV2Root(t *testing.T) {
+	if _, err := newACPArtifactRetentionWiring(true, "relative/artifacts"); err == nil {
+		t.Fatal("newACPArtifactRetentionWiring() error = nil, want unsafe-root error")
+	}
+}
+
+func TestACPControlStoreWiring(t *testing.T) {
+	tests := []struct {
+		name            string
+		runtimeEnabled  bool
+		withStore       bool
+		wantTaskCleanup bool
+		wantRuntime     bool
+		wantErr         bool
+	}{
+		{
+			name: "disabled runtime without controller namespace has no control store",
+		},
+		{
+			name:      "harness v1 does not receive ACP cleanup wiring",
+			withStore: true,
+		},
+		{
+			name:            "enabled runtime shares store with Task cleanup",
+			runtimeEnabled:  true,
+			withStore:       true,
+			wantTaskCleanup: true,
+			wantRuntime:     true,
+		},
+		{
+			name:           "enabled runtime fails closed without control store",
+			runtimeEnabled: true,
+			wantErr:        true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var kubeControlStore *storekube.Store
+			if tt.withStore {
+				kubeControlStore = &storekube.Store{}
+			}
+
+			wiring, err := newACPControlStoreWiring(tt.runtimeEnabled, kubeControlStore)
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("newACPControlStoreWiring() error = %v, wantErr %t", err, tt.wantErr)
+			}
+			if tt.wantErr {
+				return
+			}
+			if got := wiring.taskCleanup; (got != nil) != tt.wantTaskCleanup {
+				t.Fatalf("task cleanup store present = %t, want %t", got != nil, tt.wantTaskCleanup)
+			} else if got != nil && got != kubeControlStore {
+				t.Fatal("task cleanup store does not preserve the Kubernetes store")
+			}
+			if got := wiring.runtime; (got != nil) != tt.wantRuntime {
+				t.Fatalf("runtime store present = %t, want %t", got != nil, tt.wantRuntime)
+			} else if got != nil && got != kubeControlStore {
+				t.Fatal("runtime store does not preserve the Kubernetes store")
+			}
+		})
+	}
+}
+
+func TestManagerCacheOptions(t *testing.T) {
+	childTypes := []client.Object{
+		&appsv1.Deployment{},
+		&appsv1.ReplicaSet{},
+		&corev1.Pod{},
+		&corev1.Service{},
+		&corev1.Secret{},
+		&networkingv1.NetworkPolicy{},
+		&policyv1.PodDisruptionBudget{},
+	}
+	tests := []struct {
+		name               string
+		watchNamespace     string
+		runtimeNamespace   string
+		wantDefault        []string
+		wantRuntimeChild   []string
+		wantChildOverrides bool
+	}{
+		{
+			name:             "cluster-wide watch is unrestricted",
+			runtimeNamespace: "orka-runtimes",
+		},
+		{
+			name:               "tenant defaults and distinct runtime child namespace",
+			watchNamespace:     "tenant-a",
+			runtimeNamespace:   "orka-runtimes",
+			wantDefault:        []string{"tenant-a"},
+			wantRuntimeChild:   []string{"orka-runtimes", "tenant-a"},
+			wantChildOverrides: true,
+		},
+		{
+			name:               "identical tenant and runtime namespaces are deduplicated",
+			watchNamespace:     "tenant-a",
+			runtimeNamespace:   "tenant-a",
+			wantDefault:        []string{"tenant-a"},
+			wantRuntimeChild:   []string{"tenant-a"},
+			wantChildOverrides: true,
+		},
+		{
+			name:               "v2 runtime children use the isolated runtime namespace",
+			watchNamespace:     "tenant-a",
+			runtimeNamespace:   "orka-runtimes",
+			wantDefault:        []string{"tenant-a"},
+			wantRuntimeChild:   []string{"orka-runtimes", "tenant-a"},
+			wantChildOverrides: true,
+		},
+		{
+			name:             "blank runtime namespace keeps tenant defaults",
+			watchNamespace:   "tenant-a",
+			runtimeNamespace: " ",
+			wantDefault:      []string{"tenant-a"},
+			wantRuntimeChild: []string{"tenant-a"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			options := managerCacheOptions(tt.watchNamespace, tt.runtimeNamespace)
+			assertCacheNamespaces(t, options.DefaultNamespaces, tt.wantDefault)
+
+			for _, object := range []client.Object{
+				&corev1alpha1.Task{},
+				&corev1alpha1.Agent{},
+				&corev1.ConfigMap{},
+			} {
+				if _, ok := cacheByObjectForType(options, object); ok {
+					t.Fatalf("default-cached object %T unexpectedly has a ByObject override", object)
+				}
+				assertCacheNamespaces(t, effectiveCacheNamespaces(options, object), tt.wantDefault)
+			}
+
+			wantOverrides := 0
+			if tt.wantChildOverrides {
+				wantOverrides += len(childTypes)
+			}
+			if got := len(options.ByObject); got != wantOverrides {
+				t.Fatalf("ByObject override count = %d, want %d", got, wantOverrides)
+			}
+			for _, object := range childTypes {
+				_, overridden := cacheByObjectForType(options, object)
+				if overridden != tt.wantChildOverrides {
+					t.Fatalf("ByObject override for %T = %t, want %t", object, overridden, tt.wantChildOverrides)
+				}
+				assertCacheNamespaces(t, effectiveCacheNamespaces(options, object), tt.wantRuntimeChild)
+			}
+		})
+	}
+}
+
+func effectiveCacheNamespaces(options cache.Options, object client.Object) map[string]cache.Config {
+	if byObject, ok := cacheByObjectForType(options, object); ok {
+		return byObject.Namespaces
+	}
+	return options.DefaultNamespaces
+}
+
+func cacheByObjectForType(options cache.Options, object client.Object) (cache.ByObject, bool) {
+	objectType := reflect.TypeOf(object)
+	for candidate, byObject := range options.ByObject {
+		if reflect.TypeOf(candidate) == objectType {
+			return byObject, true
+		}
+	}
+	return cache.ByObject{}, false
+}
+
+func assertCacheNamespaces(t *testing.T, namespaces map[string]cache.Config, want []string) {
+	t.Helper()
+	got := make([]string, 0, len(namespaces))
+	for namespace := range namespaces {
+		got = append(got, namespace)
+	}
+	slices.Sort(got)
+	if !slices.Equal(got, want) {
+		t.Fatalf("cache namespaces = %v, want %v", got, want)
+	}
+}
+
 func TestWorkspaceCleanupAPIsInstalled(t *testing.T) {
 	mapper := meta.NewDefaultRESTMapper([]schema.GroupVersion{workspacev1alpha1.GroupVersion})
 	mapper.Add(
@@ -53,6 +562,29 @@ func TestWorkspaceCleanupAPIsInstalled(t *testing.T) {
 	}
 }
 
+func TestManagerWebhookAdmissionEnabled(t *testing.T) {
+	tests := []struct {
+		name              string
+		taskProvenance    bool
+		workspaceClassUse bool
+		want              bool
+	}{
+		{name: "separate admission runtime", want: false},
+		{name: "task provenance", taskProvenance: true, want: true},
+		{name: "workspace class use", workspaceClassUse: true, want: true},
+		{name: "all manager admission", taskProvenance: true, workspaceClassUse: true, want: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := managerWebhookAdmissionEnabled(tt.taskProvenance, tt.workspaceClassUse); got != tt.want {
+				t.Fatalf("managerWebhookAdmissionEnabled(%t, %t) = %t, want %t",
+					tt.taskProvenance, tt.workspaceClassUse, got, tt.want)
+			}
+		})
+	}
+}
+
 func TestValidateWorkspaceProviderSecurityConfig(t *testing.T) {
 	if err := validateWorkspaceProviderSecurityConfig(false, false); err != nil {
 		t.Fatalf("disabled API validation: %v", err)
@@ -64,3 +596,92 @@ func TestValidateWorkspaceProviderSecurityConfig(t *testing.T) {
 		t.Fatal("workspace API enabled without class-use admission")
 	}
 }
+
+func TestValidateAgentExecutionSnapshotOptions(t *testing.T) {
+	tests := []struct {
+		name      string
+		mode      executionmode.Mode
+		keyFile   string
+		retention time.Duration
+		interval  time.Duration
+		wantError bool
+	}{
+		{
+			name: "harness v1 requires key", mode: executionmode.HarnessV1,
+			retention: time.Hour, interval: time.Minute, wantError: true,
+		},
+		{
+			name: "harness v2 requires key", mode: executionmode.HarnessV2,
+			retention: time.Hour, interval: time.Minute, wantError: true,
+		},
+		{
+			name: "harness v1 enabled", mode: executionmode.HarnessV1,
+			keyFile: "/var/run/orka/snapshot/key", retention: 30 * 24 * time.Hour, interval: time.Hour,
+		},
+		{
+			name: "harness v2 enabled", mode: executionmode.HarnessV2,
+			keyFile: "/var/run/orka/snapshot/key", retention: 30 * 24 * time.Hour, interval: time.Hour,
+		},
+		{
+			name: "zero retention", mode: executionmode.HarnessV2,
+			keyFile: "/var/run/orka/snapshot/key", retention: 0, interval: time.Hour, wantError: true,
+		},
+		{
+			name: "negative retention", mode: executionmode.HarnessV2, keyFile: "/var/run/orka/snapshot/key",
+			retention: -time.Hour, interval: time.Hour, wantError: true,
+		},
+		{
+			name: "zero interval", mode: executionmode.HarnessV2,
+			keyFile: "/var/run/orka/snapshot/key", retention: time.Hour, interval: 0, wantError: true,
+		},
+		{
+			name: "negative interval", mode: executionmode.HarnessV2, keyFile: "/var/run/orka/snapshot/key",
+			retention: time.Hour, interval: -time.Minute, wantError: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateAgentExecutionSnapshotOptions(tt.mode, tt.keyFile, tt.retention, tt.interval)
+			if (err != nil) != tt.wantError {
+				t.Fatalf("validation error = %v, wantError = %t", err, tt.wantError)
+			}
+		})
+	}
+}
+
+func TestLoadAgentExecutionSnapshotCipherAcceptsDeploymentKeyFormats(t *testing.T) {
+	raw := []byte(strings.Repeat("k", 32))
+	rawWithWhitespaceEdges := append([]byte{' '}, []byte(strings.Repeat("r", 30))...)
+	rawWithWhitespaceEdges = append(rawWithWhitespaceEdges, '\n')
+	encoded := base64.StdEncoding.EncodeToString(raw)
+
+	tests := []struct {
+		name      string
+		contents  []byte
+		wantError bool
+	}{
+		{name: "exact raw bytes", contents: raw},
+		{name: "exact raw bytes with whitespace edges", contents: rawWithWhitespaceEdges},
+		{name: "base64", contents: []byte(encoded)},
+		{name: "base64 with normal trailing newline", contents: []byte(encoded + "\n")},
+		{name: "base64 with surrounding whitespace", contents: []byte(" \t" + encoded + "\r\n")},
+		{
+			name:     "trimmed raw bytes are not silently accepted",
+			contents: []byte(" " + strings.Repeat("x", 31) + " "), wantError: true,
+		},
+		{name: "malformed", contents: []byte("not-a-snapshot-key"), wantError: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "snapshot-key")
+			if err := os.WriteFile(path, tt.contents, 0o600); err != nil {
+				t.Fatal(err)
+			}
+			_, err := loadAgentExecutionSnapshotCipher(path)
+			if (err != nil) != tt.wantError {
+				t.Fatalf("loadAgentExecutionSnapshotCipher() error = %v, wantError = %t", err, tt.wantError)
+			}
+		})
+	}
+}
diff --git a/cmd/orka-acp-exec-helper/main.go b/cmd/orka-acp-exec-helper/main.go
new file mode 100644
index 000000000..2a2044a4b
--- /dev/null
+++ b/cmd/orka-acp-exec-helper/main.go
@@ -0,0 +1,15 @@
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/orka-agents/orka/internal/acp"
+)
+
+func main() {
+	if err := acp.RunExecHelper(os.Args[1:], os.Environ()); err != nil {
+		_, _ = fmt.Fprintf(os.Stderr, "ACP exec helper failed: %v\n", err)
+		os.Exit(126)
+	}
+}
diff --git a/cmd/orka-acp-runtime/main.go b/cmd/orka-acp-runtime/main.go
new file mode 100644
index 000000000..f756189bb
--- /dev/null
+++ b/cmd/orka-acp-runtime/main.go
@@ -0,0 +1,80 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"net/http"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"github.com/orka-agents/orka/internal/acp"
+	"github.com/orka-agents/orka/workers/acp/supervisor"
+)
+
+func main() {
+	logger := slog.New(slog.NewJSONHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelInfo}))
+	slog.SetDefault(logger)
+	if _, err := acp.HardenSupervisorProcess(); err != nil {
+		logger.Error("failed to harden ACP supervisor", "error", err)
+		os.Exit(1)
+	}
+	cfg, err := supervisor.LoadConfigFromEnv()
+	if err != nil {
+		logger.Error("invalid ACP supervisor configuration", "error", err)
+		os.Exit(1)
+	}
+	runtimeServer, err := supervisor.New(cfg)
+	cfg.ProviderProxy.UpstreamBearerToken = ""
+	if err != nil {
+		logger.Error("create ACP supervisor", "error", err)
+		os.Exit(1)
+	}
+	httpServer := &http.Server{
+		Addr:              cfg.ListenAddress,
+		Handler:           runtimeServer.Handler(),
+		ReadHeaderTimeout: 10 * time.Second,
+		IdleTimeout:       2 * time.Minute,
+		MaxHeaderBytes:    32 << 10,
+	}
+
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
+	defer stop()
+	shutdownResult := make(chan error, 1)
+	go func() {
+		<-ctx.Done()
+		runtimeServer.BeginDrain("process_shutdown")
+		shutdownCtx, cancel := context.WithTimeout(context.Background(), 45*time.Second)
+		defer cancel()
+		shutdownErr := httpServer.Shutdown(shutdownCtx)
+		if shutdownErr != nil {
+			shutdownErr = errors.Join(shutdownErr, httpServer.Close())
+		}
+		shutdownResult <- shutdownErr
+	}()
+
+	logger.Info(
+		"ACP supervisor listening", "address", cfg.ListenAddress, "provider", cfg.Provider.Kind,
+		"runtimeInstanceID", cfg.Fence.RuntimeInstanceID,
+	)
+	serveErr := httpServer.ListenAndServe()
+	if errors.Is(serveErr, http.ErrServerClosed) {
+		serveErr = nil
+	}
+	var shutdownErr error
+	if ctx.Err() != nil {
+		shutdownErr = <-shutdownResult
+	} else if serveErr != nil {
+		runtimeServer.BeginDrain("http_serve_failed")
+		shutdownErr = httpServer.Close()
+	}
+	cleanupCtx, cancel := context.WithTimeout(context.Background(), 45*time.Second)
+	defer cancel()
+	cleanupErr := runtimeServer.Close(cleanupCtx)
+	if err := errors.Join(serveErr, shutdownErr, cleanupErr); err != nil {
+		logger.Error("ACP supervisor stopped with incomplete cleanup", "error", err)
+		os.Exit(1)
+	}
+}
diff --git a/cmd/orka-admission/main.go b/cmd/orka-admission/main.go
new file mode 100644
index 000000000..0eed986c6
--- /dev/null
+++ b/cmd/orka-admission/main.go
@@ -0,0 +1,284 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+// orka-admission serves the stateless, fail-closed admission boundary shared
+// by isolated harness-v1 and harness-v2 installations. It owns no controllers,
+// dispatch state, runtime credentials, SQLite database, or leader-election
+// lease.
+package main
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"flag"
+	"fmt"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	_ "k8s.io/client-go/plugin/pkg/client/auth"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/healthz"
+	"sigs.k8s.io/controller-runtime/pkg/log/zap"
+	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	orkaadmission "github.com/orka-agents/orka/internal/admission"
+	"github.com/orka-agents/orka/internal/controller"
+)
+
+var admissionScheme = runtime.NewScheme()
+
+func init() {
+	utilruntime.Must(clientgoscheme.AddToScheme(admissionScheme))
+	utilruntime.Must(corev1alpha1.AddToScheme(admissionScheme))
+}
+
+type options struct {
+	healthProbeBindAddress     string
+	preStopDelay               time.Duration
+	webhookCertPath            string
+	webhookCertName            string
+	webhookCertKey             string
+	webhookServiceDNSName      string
+	webhookPort                int
+	enableHTTP2                bool
+	controllerUsernames        string
+	taskProvenanceTrustedUsers string
+	taskProvenanceTrustedSAs   string
+}
+
+func (o *options) bind(fs *flag.FlagSet) {
+	fs.StringVar(&o.healthProbeBindAddress, "health-probe-bind-address", ":8081",
+		"The address on which to serve liveness and readiness probes.")
+	fs.DurationVar(&o.preStopDelay, "pre-stop-delay", 0,
+		"If nonzero, wait for endpoint removal and exit without starting the admission service.")
+	fs.StringVar(&o.webhookCertPath, "webhook-cert-path", "",
+		"The directory containing the webhook serving certificate and private key.")
+	fs.StringVar(&o.webhookCertName, "webhook-cert-name", "tls.crt",
+		"The webhook serving certificate filename.")
+	fs.StringVar(&o.webhookCertKey, "webhook-cert-key", "tls.key",
+		"The webhook serving private-key filename.")
+	fs.StringVar(&o.webhookServiceDNSName, "webhook-service-dns-name", "",
+		"The Kubernetes Service DNS name that the webhook serving certificate must cover.")
+	fs.IntVar(&o.webhookPort, "webhook-port", 9443, "The HTTPS webhook listener port.")
+	fs.BoolVar(&o.enableHTTP2, "enable-http2", false,
+		"Enable HTTP/2 on the webhook listener. HTTP/2 is disabled by default.")
+	fs.StringVar(&o.controllerUsernames, "controller-usernames", os.Getenv("ORKA_ADMISSION_CONTROLLER_USERNAMES"),
+		"Comma-separated exact Kubernetes usernames authorized for controller-owned Task execution writes.")
+	fs.StringVar(&o.taskProvenanceTrustedUsers, "task-provenance-trusted-users",
+		os.Getenv("ORKA_ADMISSION_TASK_PROVENANCE_TRUSTED_USERS"),
+		"Comma-separated exact Kubernetes usernames authorized to write controller-managed Task provenance; "+
+			"defaults to controller-usernames.")
+	fs.StringVar(&o.taskProvenanceTrustedSAs, "task-provenance-trusted-service-accounts",
+		os.Getenv("ORKA_ADMISSION_TASK_PROVENANCE_TRUSTED_SERVICE_ACCOUNTS"),
+		"Comma-separated ServiceAccount names trusted in each Task namespace to write managed provenance.")
+}
+
+func (o options) validate() error {
+	if strings.TrimSpace(o.webhookCertPath) == "" {
+		return errors.New("--webhook-cert-path is required")
+	}
+	if err := validateFilename("--webhook-cert-name", o.webhookCertName); err != nil {
+		return err
+	}
+	if err := validateFilename("--webhook-cert-key", o.webhookCertKey); err != nil {
+		return err
+	}
+	if strings.TrimSpace(o.webhookServiceDNSName) == "" {
+		return errors.New("--webhook-service-dns-name is required")
+	}
+	if o.webhookPort < 1 || o.webhookPort > 65535 {
+		return errors.New("--webhook-port must be between 1 and 65535")
+	}
+	if len(splitCommaList(o.controllerUsernames)) == 0 {
+		return errors.New("--controller-usernames must contain at least one exact username")
+	}
+	return nil
+}
+
+func validateFilename(flagName, value string) error {
+	trimmed := strings.TrimSpace(value)
+	if trimmed == "" || trimmed == "." || trimmed != filepath.Base(trimmed) {
+		return fmt.Errorf("%s must be a nonempty filename without path components", flagName)
+	}
+	return nil
+}
+
+func splitCommaList(raw string) []string {
+	parts := strings.Split(raw, ",")
+	values := make([]string, 0, len(parts))
+	for _, part := range parts {
+		if value := strings.TrimSpace(part); value != "" {
+			values = append(values, value)
+		}
+	}
+	return values
+}
+
+func main() {
+	var opts options
+	opts.bind(flag.CommandLine)
+	zapOptions := zap.Options{Development: false}
+	zapOptions.BindFlags(flag.CommandLine)
+	flag.Parse()
+
+	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&zapOptions)))
+	setupLog := ctrl.Log.WithName("setup")
+	if opts.preStopDelay != 0 {
+		if err := runPreStopDelay(opts.preStopDelay, time.Sleep); err != nil {
+			setupLog.Error(err, "invalid admission pre-stop delay")
+			os.Exit(2)
+		}
+		return
+	}
+	if err := opts.validate(); err != nil {
+		setupLog.Error(err, "invalid admission configuration")
+		os.Exit(2)
+	}
+
+	tlsOptions := make([]func(*tls.Config), 0, 1)
+	if !opts.enableHTTP2 {
+		tlsOptions = append(tlsOptions, func(config *tls.Config) {
+			config.NextProtos = []string{"http/1.1"}
+		})
+	}
+	webhookServer := webhook.NewServer(webhook.Options{
+		Port:     opts.webhookPort,
+		CertDir:  opts.webhookCertPath,
+		CertName: opts.webhookCertName,
+		KeyName:  opts.webhookCertKey,
+		TLSOpts:  tlsOptions,
+	})
+
+	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
+		Scheme:                 admissionScheme,
+		Metrics:                metricsserver.Options{BindAddress: "0"},
+		HealthProbeBindAddress: opts.healthProbeBindAddress,
+		LeaderElection:         false,
+		WebhookServer:          webhookServer,
+	})
+	if err != nil {
+		setupLog.Error(err, "unable to create admission manager")
+		os.Exit(1)
+	}
+	// GetWebhookServer lazily adds the configured server to the manager's
+	// runnable set. Registering only on the pre-manager value would not start it.
+	webhookServer = mgr.GetWebhookServer()
+
+	controllerUsernames := splitCommaList(opts.controllerUsernames)
+	provenanceUsers := strings.TrimSpace(opts.taskProvenanceTrustedUsers)
+	if provenanceUsers == "" {
+		provenanceUsers = strings.Join(controllerUsernames, ",")
+	}
+	orkaadmission.RegisterTaskProvenanceWebhook(
+		webhookServer,
+		admissionScheme,
+		orkaadmission.NewTaskProvenanceConfig(true, provenanceUsers, opts.taskProvenanceTrustedSAs, ""),
+	)
+	orkaadmission.RegisterWorkspaceClassUseWebhooks(
+		webhookServer,
+		admissionScheme,
+		controller.WorkspaceClassAuthorizer{Client: mgr.GetClient()},
+	)
+	orkaadmission.RegisterExecutionModeWebhooks(
+		webhookServer,
+		admissionScheme,
+		mgr.GetAPIReader(),
+		orkaadmission.ExecutionModeConfig{ControllerUsernames: controllerUsernames},
+	)
+
+	if err := mgr.AddHealthzCheck("ping", healthz.Ping); err != nil {
+		setupLog.Error(err, "unable to register liveness check")
+		os.Exit(1)
+	}
+	if err := mgr.AddReadyzCheck("webhook-certificates", servingCertificateFilesChecker(
+		opts.webhookCertPath, opts.webhookCertName, opts.webhookCertKey, opts.webhookServiceDNSName,
+	)); err != nil {
+		setupLog.Error(err, "unable to register webhook certificate readiness check")
+		os.Exit(1)
+	}
+	if err := mgr.AddReadyzCheck("webhook", webhookServer.StartedChecker()); err != nil {
+		setupLog.Error(err, "unable to register readiness check")
+		os.Exit(1)
+	}
+
+	setupLog.Info("starting stateless execution-mode admission service",
+		"webhookPort", opts.webhookPort,
+		"controllerUsernames", strings.Join(controllerUsernames, ","),
+	)
+	if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil {
+		setupLog.Error(err, "admission service stopped with an error")
+		os.Exit(1)
+	}
+}
+
+func runPreStopDelay(delay time.Duration, sleep func(time.Duration)) error {
+	const maxDelay = 20 * time.Second
+	if delay <= 0 || delay > maxDelay {
+		return fmt.Errorf("--pre-stop-delay must be greater than zero and no more than %s", maxDelay)
+	}
+	if sleep == nil {
+		return errors.New("pre-stop delay requires a sleep function")
+	}
+	sleep(delay)
+	return nil
+}
+
+func servingCertificateFilesChecker(directory, certificateName, keyName, serviceDNSName string) healthz.Checker {
+	return func(_ *http.Request) error {
+		for _, name := range []string{certificateName, keyName} {
+			path := filepath.Join(directory, name)
+			info, err := os.Stat(path)
+			if err != nil {
+				return fmt.Errorf("webhook serving certificate file %s is unavailable: %w", name, err)
+			}
+			if !info.Mode().IsRegular() || info.Size() == 0 {
+				return fmt.Errorf("webhook serving certificate file %s is not a nonempty regular file", name)
+			}
+		}
+
+		pair, err := tls.LoadX509KeyPair(
+			filepath.Join(directory, certificateName),
+			filepath.Join(directory, keyName),
+		)
+		if err != nil {
+			return fmt.Errorf("load webhook serving certificate and private key: %w", err)
+		}
+		if len(pair.Certificate) == 0 {
+			return errors.New("webhook serving certificate chain is empty")
+		}
+
+		now := time.Now()
+		for index, rawCertificate := range pair.Certificate {
+			certificate, err := x509.ParseCertificate(rawCertificate)
+			if err != nil {
+				return fmt.Errorf("parse webhook serving certificate chain entry %d: %w", index, err)
+			}
+			if now.Before(certificate.NotBefore) {
+				return fmt.Errorf("webhook serving certificate chain entry %d is not valid before %s",
+					index, certificate.NotBefore.UTC().Format(time.RFC3339))
+			}
+			if !now.Before(certificate.NotAfter) {
+				return fmt.Errorf("webhook serving certificate chain entry %d expired at %s",
+					index, certificate.NotAfter.UTC().Format(time.RFC3339))
+			}
+			if index == 0 {
+				if err := certificate.VerifyHostname(strings.TrimSpace(serviceDNSName)); err != nil {
+					return fmt.Errorf("webhook serving certificate is not valid for %s: %w", serviceDNSName, err)
+				}
+			}
+		}
+		return nil
+	}
+}
diff --git a/cmd/orka-admission/main_test.go b/cmd/orka-admission/main_test.go
new file mode 100644
index 000000000..d1595f389
--- /dev/null
+++ b/cmd/orka-admission/main_test.go
@@ -0,0 +1,219 @@
+package main
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestOptionsValidate(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name    string
+		mutate  func(*options)
+		wantErr bool
+	}{
+		{name: "valid"},
+		{name: "certificate directory required", mutate: func(o *options) { o.webhookCertPath = "" }, wantErr: true},
+		{name: "service DNS name required", mutate: func(o *options) { o.webhookServiceDNSName = "" }, wantErr: true},
+		{name: "controller identity required", mutate: func(o *options) { o.controllerUsernames = " , " }, wantErr: true},
+		{
+			name:   "multiple controller identities",
+			mutate: func(o *options) { o.controllerUsernames = "controller-v1,controller-v2" },
+		},
+		{name: "certificate filename only", mutate: func(o *options) { o.webhookCertName = "../tls.crt" }, wantErr: true},
+		{name: "key filename only", mutate: func(o *options) { o.webhookCertKey = "/tls.key" }, wantErr: true},
+		{name: "port lower bound", mutate: func(o *options) { o.webhookPort = 0 }, wantErr: true},
+		{name: "port upper bound", mutate: func(o *options) { o.webhookPort = 65536 }, wantErr: true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			opts := options{
+				webhookCertPath:       "/certs",
+				webhookCertName:       "tls.crt",
+				webhookCertKey:        "tls.key",
+				webhookServiceDNSName: "orka-admission.orka-system.svc",
+				webhookPort:           9443,
+				controllerUsernames:   "system:serviceaccount:orka-system:orka-controller-manager",
+			}
+			if tt.mutate != nil {
+				tt.mutate(&opts)
+			}
+			if err := opts.validate(); (err != nil) != tt.wantErr {
+				t.Fatalf("validate() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestRunPreStopDelay(t *testing.T) {
+	t.Parallel()
+
+	var slept time.Duration
+	if err := runPreStopDelay(5*time.Second, func(delay time.Duration) { slept = delay }); err != nil {
+		t.Fatalf("runPreStopDelay() error = %v", err)
+	}
+	if slept != 5*time.Second {
+		t.Fatalf("sleep delay = %s, want 5s", slept)
+	}
+	for _, delay := range []time.Duration{-time.Second, 21 * time.Second} {
+		if err := runPreStopDelay(delay, func(time.Duration) {}); err == nil {
+			t.Errorf("runPreStopDelay(%s) error = nil, want validation failure", delay)
+		}
+	}
+	if err := runPreStopDelay(time.Second, nil); err == nil {
+		t.Fatal("runPreStopDelay() with nil sleep error = nil")
+	}
+}
+
+func TestServingCertificateFilesChecker(t *testing.T) {
+	t.Parallel()
+	now := time.Now()
+	valid := newServingCertificateFixture(t, now.Add(-time.Hour), now.Add(time.Hour))
+	other := newServingCertificateFixture(t, now.Add(-time.Hour), now.Add(time.Hour))
+	future := newServingCertificateFixture(t, now.Add(time.Hour), now.Add(2*time.Hour))
+	expired := newServingCertificateFixture(t, now.Add(-2*time.Hour), now.Add(-time.Hour))
+	wrongDNS := newServingCertificateFixture(t, now.Add(-time.Hour), now.Add(time.Hour), "other.orka-system.svc")
+
+	tests := []struct {
+		name            string
+		certificatePEM  []byte
+		keyPEM          []byte
+		wantErrContains string
+	}{
+		{name: "missing files", wantErrContains: "unavailable"},
+		{name: "certificate only", certificatePEM: valid.certificatePEM, wantErrContains: "tls.key is unavailable"},
+		{
+			name:            "empty certificate",
+			certificatePEM:  []byte{},
+			keyPEM:          valid.keyPEM,
+			wantErrContains: "not a nonempty regular file",
+		},
+		{
+			name:            "malformed certificate",
+			certificatePEM:  []byte("certificate"),
+			keyPEM:          valid.keyPEM,
+			wantErrContains: "load webhook serving certificate",
+		},
+		{
+			name:            "mismatched private key",
+			certificatePEM:  valid.certificatePEM,
+			keyPEM:          other.keyPEM,
+			wantErrContains: "private key does not match",
+		},
+		{
+			name:            "not yet valid",
+			certificatePEM:  future.certificatePEM,
+			keyPEM:          future.keyPEM,
+			wantErrContains: "is not valid before",
+		},
+		{name: "expired", certificatePEM: expired.certificatePEM, keyPEM: expired.keyPEM, wantErrContains: "expired at"},
+		{
+			name:            "wrong service DNS name",
+			certificatePEM:  wrongDNS.certificatePEM,
+			keyPEM:          wrongDNS.keyPEM,
+			wantErrContains: "is not valid for orka-admission.orka-system.svc",
+		},
+		{
+			name:            "expired chain certificate",
+			certificatePEM:  append(append([]byte{}, valid.certificatePEM...), expired.certificatePEM...),
+			keyPEM:          valid.keyPEM,
+			wantErrContains: "chain entry 1 expired at",
+		},
+		{name: "valid", certificatePEM: valid.certificatePEM, keyPEM: valid.keyPEM},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			directory := t.TempDir()
+			if tt.certificatePEM != nil {
+				if err := os.WriteFile(filepath.Join(directory, "tls.crt"), tt.certificatePEM, 0o600); err != nil {
+					t.Fatal(err)
+				}
+			}
+			if tt.keyPEM != nil {
+				if err := os.WriteFile(filepath.Join(directory, "tls.key"), tt.keyPEM, 0o600); err != nil {
+					t.Fatal(err)
+				}
+			}
+
+			checker := servingCertificateFilesChecker(
+				directory, "tls.crt", "tls.key", "orka-admission.orka-system.svc",
+			)
+			err := checker(httptest.NewRequest("GET", "/readyz", nil))
+			if tt.wantErrContains == "" {
+				if err != nil {
+					t.Fatalf("certificate readiness failed: %v", err)
+				}
+				return
+			}
+			if err == nil || !strings.Contains(err.Error(), tt.wantErrContains) {
+				t.Fatalf("certificate readiness error = %v, want error containing %q", err, tt.wantErrContains)
+			}
+		})
+	}
+}
+
+type servingCertificateFixture struct {
+	certificatePEM []byte
+	keyPEM         []byte
+}
+
+func newServingCertificateFixture(
+	t *testing.T,
+	notBefore, notAfter time.Time,
+	dnsNames ...string,
+) servingCertificateFixture {
+	t.Helper()
+	dnsName := "orka-admission.orka-system.svc"
+	if len(dnsNames) > 0 {
+		dnsName = dnsNames[0]
+	}
+	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatal(err)
+	}
+	template := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: dnsName},
+		DNSNames:     []string{dnsName},
+		NotBefore:    notBefore,
+		NotAfter:     notAfter,
+		KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+	}
+	certificateDER, err := x509.CreateCertificate(rand.Reader, template, template, &privateKey.PublicKey, privateKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return servingCertificateFixture{
+		certificatePEM: pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certificateDER}),
+		keyPEM: pem.EncodeToMemory(&pem.Block{
+			Type:  "RSA PRIVATE KEY",
+			Bytes: x509.MarshalPKCS1PrivateKey(privateKey),
+		}),
+	}
+}
+
+func TestSplitCommaList(t *testing.T) {
+	t.Parallel()
+	got := splitCommaList(" one, ,two , three")
+	want := []string{"one", "two", "three"}
+	if len(got) != len(want) {
+		t.Fatalf("splitCommaList() = %#v, want %#v", got, want)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("splitCommaList() = %#v, want %#v", got, want)
+		}
+	}
+}
diff --git a/cmd/orka-agent-harness-wrapper/.gitignore b/cmd/orka-agent-harness-wrapper/.gitignore
deleted file mode 100644
index 5ec983e30..000000000
--- a/cmd/orka-agent-harness-wrapper/.gitignore
+++ /dev/null
@@ -1,4 +0,0 @@
-# Bundled Copilot CLI artifacts generated by github.com/github/copilot-sdk/go/cmd/bundler.
-*.zst
-*.license
-zcopilot_*.go
diff --git a/cmd/orka-agent-harness-wrapper/abort_rollover.go b/cmd/orka-agent-harness-wrapper/abort_rollover.go
new file mode 100644
index 000000000..cd735a2e5
--- /dev/null
+++ b/cmd/orka-agent-harness-wrapper/abort_rollover.go
@@ -0,0 +1,72 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/orka-agents/orka/internal/harness"
+)
+
+const defaultAbortRolloverTimeout = time.Minute
+
+func runAbortRollover(args []string) error {
+	fs := flag.NewFlagSet("abort-rollover", flag.ContinueOnError)
+	fs.SetOutput(io.Discard)
+	var (
+		endpoint           string
+		bearerTokenFile    string
+		caFile             string
+		expectedGeneration string
+		timeout            time.Duration
+	)
+	fs.StringVar(&endpoint, "endpoint", "", "wrapper HTTPS endpoint")
+	fs.StringVar(&bearerTokenFile, "bearer-token-file", "", "file containing the wrapper control bearer")
+	fs.StringVar(&caFile, "ca-file", "", "CA bundle used to authenticate the wrapper")
+	fs.StringVar(&expectedGeneration, "expected-generation", "", "exact live ledger generation to reopen")
+	fs.DurationVar(&timeout, "timeout", defaultAbortRolloverTimeout, "maximum rollover abort duration")
+	if err := fs.Parse(args); err != nil {
+		return fmt.Errorf("parse abort-rollover command: %w", err)
+	}
+	endpoint = strings.TrimSpace(endpoint)
+	bearerTokenFile = strings.TrimSpace(bearerTokenFile)
+	caFile = strings.TrimSpace(caFile)
+	expectedGeneration = strings.TrimSpace(expectedGeneration)
+	if endpoint == "" || bearerTokenFile == "" || caFile == "" || expectedGeneration == "" {
+		return fmt.Errorf("abort-rollover endpoint, bearer token file, CA file, and expected generation are required")
+	}
+	if timeout <= 0 {
+		return fmt.Errorf("abort-rollover timeout must be positive")
+	}
+	tokenBytes, err := os.ReadFile(bearerTokenFile)
+	if err != nil {
+		return fmt.Errorf("read wrapper abort-rollover bearer token file: %w", err)
+	}
+	bearer := strings.TrimSpace(string(tokenBytes))
+	if bearer == "" {
+		return fmt.Errorf("wrapper abort-rollover bearer token file is empty")
+	}
+	httpClient, err := newWrapperTLSHTTPClient(endpoint, caFile)
+	if err != nil {
+		return fmt.Errorf("configure wrapper abort-rollover TLS: %w", err)
+	}
+	client, err := harness.NewClient(
+		endpoint,
+		harness.WithBearerToken(bearer),
+		harness.WithControlTimeout(min(10*time.Second, timeout)),
+		harness.WithHTTPClient(httpClient),
+	)
+	if err != nil {
+		return fmt.Errorf("configure wrapper abort-rollover client: %w", err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	if _, err := client.AbortDurableRollover(ctx, expectedGeneration); err != nil {
+		return fmt.Errorf("abort wrapper ledger rollover: %w", err)
+	}
+	return nil
+}
diff --git a/cmd/orka-agent-harness-wrapper/abort_rollover_test.go b/cmd/orka-agent-harness-wrapper/abort_rollover_test.go
new file mode 100644
index 000000000..e84dca260
--- /dev/null
+++ b/cmd/orka-agent-harness-wrapper/abort_rollover_test.go
@@ -0,0 +1,87 @@
+package main
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"testing"
+
+	"github.com/orka-agents/orka/internal/harness"
+)
+
+func TestRunAbortRolloverAuthenticatesAndRequiresExactGeneration(t *testing.T) {
+	const token = "abort-rollover-controller-token-value"
+	var calls atomic.Int32
+	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		calls.Add(1)
+		if r.URL.Path != harness.AdminAbortRolloverPath || r.Method != http.MethodPost {
+			harness.WriteError(w, http.StatusNotFound, "not found")
+			return
+		}
+		if r.Header.Get("Authorization") != "Bearer "+token {
+			harness.WriteError(w, http.StatusUnauthorized, "unauthorized")
+			return
+		}
+		var request harness.DurableRolloverAbortRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil || request.ExpectedGeneration != "generation-41" {
+			harness.WriteError(w, http.StatusBadRequest, "invalid abort")
+			return
+		}
+		harness.WriteJSON(w, http.StatusOK, harness.DurableRolloverAbortResponse{
+			CurrentGeneration: request.ExpectedGeneration,
+			AdmissionReopened: true,
+		})
+	}))
+	defer server.Close()
+	caFile := writeTLSServerCA(t, server)
+	tokenFile := filepath.Join(t.TempDir(), "token")
+	if err := os.WriteFile(tokenFile, []byte(token), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := runAbortRollover([]string{
+		"--endpoint=" + server.URL,
+		"--bearer-token-file=" + tokenFile,
+		"--ca-file=" + caFile,
+		"--expected-generation=generation-41",
+		"--timeout=2s",
+	}); err != nil {
+		t.Fatalf("runAbortRollover: %v", err)
+	}
+	if calls.Load() != 1 {
+		t.Fatalf("abort calls = %d, want 1", calls.Load())
+	}
+}
+
+func TestRunAbortRolloverRejectsInvalidResponseWithoutLeakingBearer(t *testing.T) {
+	const token = "abort-rollover-secret-token-value"
+	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		harness.WriteJSON(w, http.StatusOK, harness.DurableRolloverAbortResponse{
+			CurrentGeneration: "different-generation",
+			AdmissionReopened: true,
+		})
+	}))
+	defer server.Close()
+	caFile := writeTLSServerCA(t, server)
+	tokenFile := filepath.Join(t.TempDir(), "token")
+	if err := os.WriteFile(tokenFile, []byte(token), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	err := runAbortRollover([]string{
+		"--endpoint=" + server.URL,
+		"--bearer-token-file=" + tokenFile,
+		"--ca-file=" + caFile,
+		"--expected-generation=generation-41",
+	})
+	if err == nil || !strings.Contains(err.Error(), "invalid rollover abort") {
+		t.Fatalf("runAbortRollover error = %v, want invalid-response rejection", err)
+	}
+	if strings.Contains(err.Error(), token) {
+		t.Fatalf("runAbortRollover error leaked bearer: %v", err)
+	}
+}
diff --git a/cmd/orka-agent-harness-wrapper/drain.go b/cmd/orka-agent-harness-wrapper/drain.go
new file mode 100644
index 000000000..b0939d2ec
--- /dev/null
+++ b/cmd/orka-agent-harness-wrapper/drain.go
@@ -0,0 +1,105 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/orka-agents/orka/internal/harness"
+)
+
+const (
+	defaultDrainTimeout      = 30 * time.Minute
+	defaultDrainPollInterval = time.Second
+)
+
+func runDrain(args []string) error {
+	fs := flag.NewFlagSet("drain", flag.ContinueOnError)
+	fs.SetOutput(io.Discard)
+	var (
+		endpoint        string
+		bearerTokenFile string
+		caFile          string
+		nextGeneration  string
+		timeout         time.Duration
+		pollInterval    time.Duration
+	)
+	fs.StringVar(&endpoint, "endpoint", "", "wrapper HTTPS endpoint")
+	fs.StringVar(&bearerTokenFile, "bearer-token-file", "", "file containing the wrapper control bearer")
+	fs.StringVar(&caFile, "ca-file", "", "CA bundle used to authenticate the wrapper")
+	fs.StringVar(&nextGeneration, "next-generation", "", "optional exact replacement ledger generation")
+	fs.DurationVar(&timeout, "timeout", defaultDrainTimeout, "maximum close-and-drain duration")
+	fs.DurationVar(&pollInterval, "poll-interval", defaultDrainPollInterval, "drain status poll interval")
+	if err := fs.Parse(args); err != nil {
+		return fmt.Errorf("parse drain command: %w", err)
+	}
+	endpoint = strings.TrimSpace(endpoint)
+	bearerTokenFile = strings.TrimSpace(bearerTokenFile)
+	caFile = strings.TrimSpace(caFile)
+	nextGeneration = strings.TrimSpace(nextGeneration)
+	if endpoint == "" || bearerTokenFile == "" || caFile == "" {
+		return fmt.Errorf("drain endpoint, bearer token file, and CA file are required")
+	}
+	if timeout <= 0 || pollInterval <= 0 || pollInterval > timeout {
+		return fmt.Errorf("drain timeout and poll interval must be positive, with poll interval no greater than timeout")
+	}
+	tokenBytes, err := os.ReadFile(bearerTokenFile)
+	if err != nil {
+		return fmt.Errorf("read wrapper drain bearer token file: %w", err)
+	}
+	bearer := strings.TrimSpace(string(tokenBytes))
+	if bearer == "" {
+		return fmt.Errorf("wrapper drain bearer token file is empty")
+	}
+	controlTimeout := min(10*time.Second, timeout)
+	httpClient, err := newWrapperTLSHTTPClient(endpoint, caFile)
+	if err != nil {
+		return fmt.Errorf("configure wrapper drain TLS: %w", err)
+	}
+	client, err := harness.NewClient(
+		endpoint,
+		harness.WithBearerToken(bearer),
+		harness.WithControlTimeout(controlTimeout),
+		harness.WithHTTPClient(httpClient),
+	)
+	if err != nil {
+		return fmt.Errorf("configure wrapper drain client: %w", err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	if _, err := client.CloseDurableAdmission(ctx); err != nil {
+		return fmt.Errorf("close wrapper admission: %w", err)
+	}
+
+	ticker := time.NewTicker(pollInterval)
+	defer ticker.Stop()
+	for {
+		status, err := client.DurableDrainStatus(ctx)
+		if err != nil {
+			if ctx.Err() != nil {
+				return fmt.Errorf("wrapper drain timed out: %w", ctx.Err())
+			}
+			return fmt.Errorf("read wrapper drain status: %w", err)
+		}
+		if !status.AdmissionClosed {
+			return fmt.Errorf("wrapper did not retain its durable admission close")
+		}
+		if status.Completed {
+			if nextGeneration != "" {
+				if _, err := client.PrepareDurableRollover(ctx, nextGeneration); err != nil {
+					return fmt.Errorf("prepare wrapper ledger rollover: %w", err)
+				}
+			}
+			return nil
+		}
+		select {
+		case <-ctx.Done():
+			return fmt.Errorf("wrapper drain timed out: %w", ctx.Err())
+		case <-ticker.C:
+		}
+	}
+}
diff --git a/cmd/orka-agent-harness-wrapper/drain_test.go b/cmd/orka-agent-harness-wrapper/drain_test.go
new file mode 100644
index 000000000..3e23d0e0d
--- /dev/null
+++ b/cmd/orka-agent-harness-wrapper/drain_test.go
@@ -0,0 +1,153 @@
+package main
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"testing"
+
+	"github.com/orka-agents/orka/internal/harness"
+)
+
+func TestRunDrainClosesWaitsAndPreparesExactGeneration(t *testing.T) {
+	const token = "drain-controller-token-value"
+	var (
+		drainCalls    atomic.Int32
+		rolloverCalls atomic.Int32
+	)
+	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("Authorization") != "Bearer "+token {
+			harness.WriteError(w, http.StatusUnauthorized, "unauthorized")
+			return
+		}
+		switch r.URL.Path {
+		case harness.AdminClosePath:
+			harness.WriteJSON(w, http.StatusOK, harness.DurableAdmissionCloseResponse{AdmissionClosed: true})
+		case harness.AdminDrainPath:
+			completed := drainCalls.Add(1) >= 2
+			harness.WriteJSON(w, http.StatusOK, harness.DurableDrainStatus{
+				AdmissionClosed: true,
+				Completed:       completed,
+			})
+		case harness.AdminRolloverPath:
+			rolloverCalls.Add(1)
+			var request harness.DurableRolloverPrepareRequest
+			if err := json.NewDecoder(r.Body).Decode(&request); err != nil || request.NextGeneration != "42" {
+				harness.WriteError(w, http.StatusBadRequest, "invalid rollover")
+				return
+			}
+			harness.WriteJSON(w, http.StatusOK, harness.DurableRolloverPrepareResponse{
+				CurrentGeneration: "41",
+				NextGeneration:    request.NextGeneration,
+				Prepared:          true,
+			})
+		default:
+			harness.WriteError(w, http.StatusNotFound, "not found")
+		}
+	}))
+	defer server.Close()
+	caFile := writeTLSServerCA(t, server)
+	tokenFile := filepath.Join(t.TempDir(), "token")
+	if err := os.WriteFile(tokenFile, []byte(token), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := runDrain([]string{
+		"--endpoint=" + server.URL,
+		"--bearer-token-file=" + tokenFile,
+		"--ca-file=" + caFile,
+		"--next-generation=42",
+		"--timeout=2s",
+		"--poll-interval=1ms",
+	}); err != nil {
+		t.Fatalf("runDrain: %v", err)
+	}
+	if drainCalls.Load() < 2 || rolloverCalls.Load() != 1 {
+		t.Fatalf("calls: drain=%d rollover=%d, want >=2/1", drainCalls.Load(), rolloverCalls.Load())
+	}
+}
+
+func TestRunDrainTimesOutWithoutPreparingRolloverOrLeakingBearer(t *testing.T) {
+	const token = "timeout-drain-token-value"
+	var rolloverCalls atomic.Int32
+	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case harness.AdminClosePath:
+			harness.WriteJSON(w, http.StatusOK, harness.DurableAdmissionCloseResponse{AdmissionClosed: true})
+		case harness.AdminDrainPath:
+			harness.WriteJSON(w, http.StatusOK, harness.DurableDrainStatus{AdmissionClosed: true})
+		case harness.AdminRolloverPath:
+			rolloverCalls.Add(1)
+			harness.WriteError(w, http.StatusInternalServerError, "unexpected")
+		}
+	}))
+	defer server.Close()
+	caFile := writeTLSServerCA(t, server)
+	tokenFile := filepath.Join(t.TempDir(), "token")
+	if err := os.WriteFile(tokenFile, []byte(token), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	err := runDrain([]string{
+		"--endpoint=" + server.URL,
+		"--bearer-token-file=" + tokenFile,
+		"--ca-file=" + caFile,
+		"--next-generation=2",
+		"--timeout=30ms",
+		"--poll-interval=5ms",
+	})
+	if err == nil || !strings.Contains(err.Error(), "timed out") {
+		t.Fatalf("runDrain timeout error = %v", err)
+	}
+	if strings.Contains(err.Error(), token) {
+		t.Fatalf("runDrain error leaked bearer: %v", err)
+	}
+	if rolloverCalls.Load() != 0 {
+		t.Fatalf("rollover calls = %d, want 0", rolloverCalls.Load())
+	}
+}
+
+func TestRunDrainWithoutReplacementGenerationClosesAndDrainsOnly(t *testing.T) {
+	const token = "shutdown-drain-token-value"
+	var rolloverCalls atomic.Int32
+	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("Authorization") != "Bearer "+token {
+			harness.WriteError(w, http.StatusUnauthorized, "unauthorized")
+			return
+		}
+		switch r.URL.Path {
+		case harness.AdminClosePath:
+			harness.WriteJSON(w, http.StatusOK, harness.DurableAdmissionCloseResponse{AdmissionClosed: true})
+		case harness.AdminDrainPath:
+			harness.WriteJSON(w, http.StatusOK, harness.DurableDrainStatus{AdmissionClosed: true, Completed: true})
+		case harness.AdminRolloverPath:
+			rolloverCalls.Add(1)
+			harness.WriteError(w, http.StatusInternalServerError, "unexpected")
+		default:
+			harness.WriteError(w, http.StatusNotFound, "not found")
+		}
+	}))
+	defer server.Close()
+	caFile := writeTLSServerCA(t, server)
+	tokenFile := filepath.Join(t.TempDir(), "token")
+	if err := os.WriteFile(tokenFile, []byte(token), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := runDrain([]string{
+		"--endpoint=" + server.URL,
+		"--bearer-token-file=" + tokenFile,
+		"--ca-file=" + caFile,
+		"--timeout=2s",
+		"--poll-interval=1ms",
+	}); err != nil {
+		t.Fatalf("runDrain: %v", err)
+	}
+	if rolloverCalls.Load() != 0 {
+		t.Fatalf("rollover calls = %d, want 0", rolloverCalls.Load())
+	}
+}
diff --git a/cmd/orka-agent-harness-wrapper/main.go b/cmd/orka-agent-harness-wrapper/main.go
index b676d775c..9d9ca290a 100644
--- a/cmd/orka-agent-harness-wrapper/main.go
+++ b/cmd/orka-agent-harness-wrapper/main.go
@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"crypto/tls"
 	"flag"
 	"fmt"
 	"net/http"
@@ -16,6 +17,11 @@ import (
 	"github.com/orka-agents/orka/workers/harness/cliwrapper"
 )
 
+const (
+	envHarnessWrapperTLSCertFile = "ORKA_HARNESS_WRAPPER_TLS_CERT_FILE"
+	envHarnessWrapperTLSKeyFile  = "ORKA_HARNESS_WRAPPER_TLS_KEY_FILE"
+)
+
 type repeatedString []string
 
 func (r *repeatedString) String() string { return strings.Join(*r, ",") }
@@ -32,21 +38,30 @@ func main() {
 }
 
 func run(args []string) error {
-	if len(args) > 0 && args[0] == "copilot-turn" {
-		return cliwrapper.RunCopilotTurnCLI(context.Background(), os.Stdin, os.Stdout)
+	if len(args) > 0 {
+		switch args[0] {
+		case "copilot-turn":
+			return cliwrapper.RunCopilotTurnCLI(context.Background(), os.Stdin, os.Stdout)
+		case "drain":
+			return runDrain(args[1:])
+		case "abort-rollover":
+			return runAbortRollover(args[1:])
+		}
 	}
 	cfg, err := cliwrapper.LoadConfigFromEnvUnvalidated()
 	if err != nil {
 		return err
 	}
 	_ = os.Unsetenv(cliwrapper.EnvAuthValue)
-	authValueFromEnv := cfg.AuthValue
-	cfg.AuthValue = ""
 	var extraArgs repeatedString
 	var extraEnv repeatedString
+	tlsCertFile := strings.TrimSpace(os.Getenv(envHarnessWrapperTLSCertFile))
+	tlsKeyFile := strings.TrimSpace(os.Getenv(envHarnessWrapperTLSKeyFile))
 	fs := flag.NewFlagSet("orka-agent-harness-wrapper", flag.ContinueOnError)
 	fs.SetOutput(os.Stderr)
-	fs.StringVar(&cfg.ListenAddr, "listen-addr", cfg.ListenAddr, "HTTP listen address")
+	fs.StringVar(&cfg.ListenAddr, "listen-addr", cfg.ListenAddr, "HTTPS listen address")
+	fs.StringVar(&tlsCertFile, "tls-cert-file", tlsCertFile, "server TLS certificate file")
+	fs.StringVar(&tlsKeyFile, "tls-key-file", tlsKeyFile, "server TLS private key file")
 	fs.StringVar(&cfg.Runtime, "runtime", cfg.Runtime, "runtime adapter: generic, codex, claude, copilot, opencode, multi")
 	fs.StringVar(&cfg.WorkDir, "workdir", cfg.WorkDir, "default command working directory")
 	fs.StringVar(&cfg.Generic.Command, "command", cfg.Generic.Command, "generic adapter command path")
@@ -61,6 +76,24 @@ func run(args []string) error {
 	fs.Int64Var(&cfg.StderrLimitBytes, "stderr-limit-bytes", cfg.StderrLimitBytes, "stderr capture limit")
 	fs.DurationVar(&cfg.CancelGrace, "cancel-grace-period", cfg.CancelGrace, "SIGTERM to SIGKILL grace period")
 	fs.DurationVar(&cfg.TurnRetention, "turn-retention", cfg.TurnRetention, "completed turn in-memory retention TTL")
+	fs.StringVar(
+		&cfg.AdmissionLedgerPath,
+		"admission-ledger-path",
+		cfg.AdmissionLedgerPath,
+		"durable wrapper admission ledger path",
+	)
+	fs.StringVar(
+		&cfg.LedgerGeneration,
+		"ledger-generation",
+		cfg.LedgerGeneration,
+		"durable wrapper admission ledger generation",
+	)
+	fs.DurationVar(
+		&cfg.LedgerRetention,
+		"ledger-retention",
+		cfg.LedgerRetention,
+		"minimum retention for controller-settled wrapper ledger records",
+	)
 	fs.StringVar(&cfg.Copilot.Path, "copilot-cli-path", cfg.Copilot.Path, "Copilot CLI path for the copilot adapter")
 	fs.StringVar(
 		&cfg.Copilot.HelperPath,
@@ -68,7 +101,6 @@ func run(args []string) error {
 		cfg.Copilot.HelperPath,
 		"helper executable path for the copilot adapter",
 	)
-	fs.StringVar(&cfg.AuthValue, "bearer-token", cfg.AuthValue, "required bearer token for turn/event/cancel endpoints")
 	fs.BoolVar(
 		&cfg.AllowUnauthenticated,
 		"allow-unauthenticated",
@@ -78,12 +110,14 @@ func run(args []string) error {
 	if err := fs.Parse(args); err != nil {
 		return err
 	}
+	tlsCertFile = strings.TrimSpace(tlsCertFile)
+	tlsKeyFile = strings.TrimSpace(tlsKeyFile)
+	if tlsCertFile == "" || tlsKeyFile == "" {
+		return fmt.Errorf("TLS certificate and private key files are required")
+	}
 	if len(extraArgs) > 0 {
 		cfg.Generic.Args = append(cfg.Generic.Args, extraArgs...)
 	}
-	if cfg.AuthValue == "" {
-		cfg.AuthValue = authValueFromEnv
-	}
 	if len(extraEnv) > 0 {
 		cfg.Generic.Env = append(cfg.Generic.Env, extraEnv...)
 		cfg.CommandEnv = append(cfg.CommandEnv, extraEnv...)
@@ -116,11 +150,24 @@ func run(args []string) error {
 	if err != nil {
 		return err
 	}
-	httpServer := &http.Server{Addr: cfg.ListenAddr, Handler: server.Handler()}
+	defer func() {
+		if closeErr := server.Close(); closeErr != nil {
+			fmt.Fprintf(os.Stderr, "warning: failed to close wrapper admission ledger: %v\n", closeErr)
+		}
+	}()
+	httpServer := &http.Server{
+		Addr: cfg.ListenAddr, Handler: server.Handler(),
+		TLSConfig: &tls.Config{MinVersion: tls.VersionTLS12},
+	}
 	errCh := make(chan error, 1)
 	go func() {
-		fmt.Fprintf(os.Stderr, "orka agent harness wrapper listening on %s (runtime=%s)\n", cfg.ListenAddr, adapter.Name())
-		if err := httpServer.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+		fmt.Fprintf(
+			os.Stderr,
+			"orka agent harness wrapper listening with TLS on %s (runtime=%s)\n",
+			cfg.ListenAddr,
+			adapter.Name(),
+		)
+		if err := httpServer.ListenAndServeTLS(tlsCertFile, tlsKeyFile); err != nil && err != http.ErrServerClosed {
 			errCh <- err
 			return
 		}
diff --git a/cmd/orka-agent-harness-wrapper/main_test.go b/cmd/orka-agent-harness-wrapper/main_test.go
new file mode 100644
index 000000000..57713a41d
--- /dev/null
+++ b/cmd/orka-agent-harness-wrapper/main_test.go
@@ -0,0 +1,17 @@
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestRunRejectsRawBearerTokenFlagWithoutEchoingValue(t *testing.T) {
+	const token = "raw-wrapper-bearer-must-not-reach-argv"
+	err := run([]string{"--bearer-token=" + token})
+	if err == nil || !strings.Contains(err.Error(), "flag provided but not defined") {
+		t.Fatalf("run() error = %v, want unknown bearer-token flag", err)
+	}
+	if strings.Contains(err.Error(), token) {
+		t.Fatal("run() error exposed rejected bearer token")
+	}
+}
diff --git a/cmd/orka-agent-harness-wrapper/tls.go b/cmd/orka-agent-harness-wrapper/tls.go
new file mode 100644
index 000000000..fdf1557ae
--- /dev/null
+++ b/cmd/orka-agent-harness-wrapper/tls.go
@@ -0,0 +1,34 @@
+package main
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+)
+
+func newWrapperTLSHTTPClient(endpoint, caFile string) (*http.Client, error) {
+	parsed, err := url.Parse(strings.TrimSpace(endpoint))
+	if err != nil || parsed.Scheme != "https" || parsed.Host == "" || parsed.User != nil {
+		return nil, fmt.Errorf("wrapper endpoint must be an HTTPS URL without user info")
+	}
+	caFile = strings.TrimSpace(caFile)
+	if caFile == "" {
+		return nil, fmt.Errorf("wrapper CA file is required")
+	}
+	caPEM, err := os.ReadFile(caFile)
+	if err != nil {
+		return nil, fmt.Errorf("read wrapper CA file: %w", err)
+	}
+	roots := x509.NewCertPool()
+	if !roots.AppendCertsFromPEM(caPEM) {
+		return nil, fmt.Errorf("wrapper CA file contains no valid certificates")
+	}
+	transport := http.DefaultTransport.(*http.Transport).Clone()
+	transport.Proxy = nil
+	transport.TLSClientConfig = &tls.Config{MinVersion: tls.VersionTLS12, RootCAs: roots}
+	return &http.Client{Transport: transport}, nil
+}
diff --git a/cmd/orka-agent-harness-wrapper/tls_test.go b/cmd/orka-agent-harness-wrapper/tls_test.go
new file mode 100644
index 000000000..10ca30223
--- /dev/null
+++ b/cmd/orka-agent-harness-wrapper/tls_test.go
@@ -0,0 +1,25 @@
+package main
+
+import (
+	"encoding/pem"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func writeTLSServerCA(t *testing.T, server *httptest.Server) string {
+	t.Helper()
+	caFile := filepath.Join(t.TempDir(), "ca.crt")
+	caPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: server.Certificate().Raw})
+	if err := os.WriteFile(caFile, caPEM, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	return caFile
+}
+
+func TestNewWrapperTLSHTTPClientRejectsPlaintextEndpoint(t *testing.T) {
+	if _, err := newWrapperTLSHTTPClient("http://wrapper.default.svc:8080", "unused"); err == nil {
+		t.Fatal("plaintext wrapper endpoint was accepted")
+	}
+}
diff --git a/cmd/orka-image-ref-validator/main.go b/cmd/orka-image-ref-validator/main.go
new file mode 100644
index 000000000..5de986c4f
--- /dev/null
+++ b/cmd/orka-image-ref-validator/main.go
@@ -0,0 +1,83 @@
+package main
+
+import (
+	_ "crypto/sha256"
+	"fmt"
+	"net"
+	"os"
+	"strconv"
+	"strings"
+
+	distributionref "github.com/distribution/reference"
+)
+
+func main() {
+	if len(os.Args) < 2 {
+		fmt.Fprintln(os.Stderr, "at least one container image reference is required")
+		os.Exit(2)
+	}
+	for _, value := range os.Args[1:] {
+		if err := validateImageReference(value); err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+	}
+}
+
+func validateImageReference(value string) error {
+	if strings.ContainsAny(value, "\r\n") {
+		return fmt.Errorf("container image reference contains a newline")
+	}
+	named, err := distributionref.ParseNormalizedNamed(value)
+	if err != nil {
+		return fmt.Errorf("invalid container image reference %q: %w", value, err)
+	}
+	if err := validateRegistryTransport(distributionref.Domain(named)); err != nil {
+		return fmt.Errorf("invalid container image reference %q: %w", value, err)
+	}
+	digested, ok := named.(distributionref.Digested)
+	if !ok {
+		return fmt.Errorf("container image reference %q is not digest pinned", value)
+	}
+	digest := digested.Digest().String()
+	if len(digest) != len("sha256:")+64 || !strings.HasPrefix(digest, "sha256:") {
+		return fmt.Errorf("container image reference %q must use a sha256 digest", value)
+	}
+	return nil
+}
+
+func validateRegistryTransport(domain string) error {
+	port := ""
+	if after, ok := strings.CutPrefix(domain, "["); ok {
+		var host string
+		if strings.Contains(domain, "]:") {
+			var err error
+			host, port, err = net.SplitHostPort(domain)
+			if err != nil {
+				return fmt.Errorf("invalid bracketed registry host: %w", err)
+			}
+		} else {
+			if !strings.HasSuffix(domain, "]") {
+				return fmt.Errorf("invalid bracketed registry host")
+			}
+			host = strings.TrimSuffix(after, "]")
+		}
+		ip := net.ParseIP(host)
+		if ip == nil || !strings.Contains(host, ":") {
+			return fmt.Errorf("bracketed registry host is not a valid IPv6 address")
+		}
+	} else if strings.Contains(domain, ":") {
+		var err error
+		_, port, err = net.SplitHostPort(domain)
+		if err != nil {
+			return fmt.Errorf("invalid registry host or port: %w", err)
+		}
+	}
+	if port != "" {
+		value, err := strconv.ParseUint(port, 10, 16)
+		if err != nil || value == 0 {
+			return fmt.Errorf("registry port must be between 1 and 65535")
+		}
+	}
+	return nil
+}
diff --git a/cmd/orka-image-ref-validator/main_test.go b/cmd/orka-image-ref-validator/main_test.go
new file mode 100644
index 000000000..cc5257755
--- /dev/null
+++ b/cmd/orka-image-ref-validator/main_test.go
@@ -0,0 +1,37 @@
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestValidateImageReference(t *testing.T) {
+	digest := "sha256:" + strings.Repeat("a", 64)
+	for _, value := range []string{
+		"docker.io/example/acp@" + digest,
+		"registry--prod.example.com:5000/team/acp:release@" + digest,
+		"[2001:db8::1]:5000/team/acp@" + digest,
+		"acp@" + digest,
+	} {
+		if err := validateImageReference(value); err != nil {
+			t.Errorf("validateImageReference(%q) error = %v", value, err)
+		}
+	}
+
+	longPath := "docker.io/" + strings.Repeat("a", 256) + "@" + digest
+	for _, value := range []string{
+		"not-digest-pinned",
+		"https://registry.example.com/team/acp@" + digest,
+		"registry.example.com:notaport/team/acp@" + digest,
+		"registry.example.com:70000/team/acp@" + digest,
+		"[127.0.0.1]/team/acp@" + digest,
+		"[:::]/team/acp@" + digest,
+		"docker.io/team/@" + digest,
+		"docker.io/example/acp\n#@" + digest,
+		longPath,
+	} {
+		if err := validateImageReference(value); err == nil {
+			t.Errorf("validateImageReference(%q) error = nil, want rejection", value)
+		}
+	}
+}
diff --git a/cmd/orka-provider-auth-proxy/credentials.go b/cmd/orka-provider-auth-proxy/credentials.go
new file mode 100644
index 000000000..2e9b81e55
--- /dev/null
+++ b/cmd/orka-provider-auth-proxy/credentials.go
@@ -0,0 +1,436 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package main
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"crypto/subtle"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+const (
+	defaultTokenReloadInterval  = 5 * time.Second
+	defaultPreviousTokenOverlap = 10 * time.Minute
+	maxPreviousTokenOverlap     = 24 * time.Hour
+	tokenFileReadAttempts       = 3
+	tokenFileReadRetryDelay     = 2 * time.Millisecond
+	maxBearerTokenBytes         = 4096
+	maxTokenDeadlineBytes       = 128
+)
+
+var errTokenReload = errors.New("provider auth token reload failed")
+
+type bearerTokenSnapshot struct {
+	currentDigest      [sha256.Size]byte
+	previousDigest     [sha256.Size]byte
+	previousValidUntil time.Time
+	hasPrevious        bool
+	ready              bool
+}
+
+type bearerTokenStore struct {
+	now      func() time.Time
+	snapshot atomic.Pointer[bearerTokenSnapshot]
+}
+
+func newBearerTokenStore(now func() time.Time) *bearerTokenStore {
+	if now == nil {
+		now = time.Now
+	}
+	store := &bearerTokenStore{now: now}
+	store.disable()
+	return store
+}
+
+func newStaticBearerTokenStore(token []byte) (*bearerTokenStore, error) {
+	if err := validateBearerToken(token); err != nil {
+		return nil, err
+	}
+	store := newBearerTokenStore(time.Now)
+	store.activate(token, nil, time.Time{})
+	return store, nil
+}
+
+func (s *bearerTokenStore) activate(current, previous []byte, previousValidUntil time.Time) {
+	next := &bearerTokenSnapshot{
+		currentDigest: sha256.Sum256(current),
+		ready:         true,
+	}
+	if len(previous) != 0 {
+		next.previousDigest = sha256.Sum256(previous)
+		next.previousValidUntil = previousValidUntil
+		next.hasPrevious = true
+	}
+	s.snapshot.Store(next)
+}
+
+func (s *bearerTokenStore) disable() {
+	s.snapshot.Store(&bearerTokenSnapshot{})
+}
+
+func (s *bearerTokenStore) isReady() bool {
+	return s.snapshot.Load().ready
+}
+
+func (s *bearerTokenStore) authorized(values []string) bool {
+	if len(values) != 1 {
+		return false
+	}
+	scheme, credential, ok := strings.Cut(values[0], " ")
+	if !ok || !strings.EqualFold(scheme, "Bearer") || credential == "" || strings.ContainsAny(credential, " \t\r\n") {
+		return false
+	}
+	active := s.snapshot.Load()
+	if !active.ready {
+		return false
+	}
+	provided := sha256.Sum256([]byte(credential))
+	currentMatch := subtle.ConstantTimeCompare(provided[:], active.currentDigest[:])
+	previousMatch := 0
+	if active.hasPrevious && s.now().Before(active.previousValidUntil) {
+		previousMatch = subtle.ConstantTimeCompare(provided[:], active.previousDigest[:])
+	}
+	return currentMatch|previousMatch == 1
+}
+
+type tokenFileReloaderConfig struct {
+	CurrentTokenFile            string
+	PreviousTokenFile           string
+	PreviousTokenValidUntilFile string
+	ReloadInterval              time.Duration
+	PreviousTokenOverlap        time.Duration
+}
+
+type tokenFileReloader struct {
+	config tokenFileReloaderConfig
+	store  *bearerTokenStore
+	now    func() time.Time
+	mu     sync.Mutex
+}
+
+func newTokenFileReloader(config tokenFileReloaderConfig, store *bearerTokenStore) (*tokenFileReloader, error) {
+	config.CurrentTokenFile = strings.TrimSpace(config.CurrentTokenFile)
+	config.PreviousTokenFile = strings.TrimSpace(config.PreviousTokenFile)
+	config.PreviousTokenValidUntilFile = strings.TrimSpace(config.PreviousTokenValidUntilFile)
+	if config.CurrentTokenFile == "" {
+		return nil, fmt.Errorf("current provider auth token file is required")
+	}
+	if (config.PreviousTokenFile == "") != (config.PreviousTokenValidUntilFile == "") {
+		return nil, fmt.Errorf("previous provider auth token and validity files must be configured together")
+	}
+	if pathsOverlap(config.CurrentTokenFile, config.PreviousTokenFile, config.PreviousTokenValidUntilFile) {
+		return nil, fmt.Errorf("provider auth token file paths must differ")
+	}
+	if config.ReloadInterval <= 0 {
+		return nil, fmt.Errorf("provider auth token reload interval must be positive")
+	}
+	if config.PreviousTokenOverlap <= 0 || config.PreviousTokenOverlap > maxPreviousTokenOverlap {
+		return nil, fmt.Errorf("provider auth previous token overlap must be positive and at most %s", maxPreviousTokenOverlap)
+	}
+	if store == nil {
+		return nil, fmt.Errorf("provider auth token store is required")
+	}
+	return &tokenFileReloader{
+		config: config,
+		store:  store,
+		now:    store.now,
+	}, nil
+}
+
+func pathsOverlap(paths ...string) bool {
+	seen := make(map[string]struct{}, len(paths))
+	for _, path := range paths {
+		if path == "" {
+			continue
+		}
+		if _, ok := seen[path]; ok {
+			return true
+		}
+		seen[path] = struct{}{}
+	}
+	return false
+}
+
+func (r *tokenFileReloader) reload() error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	current, previous, validUntilFile, err := readStableTokenFiles(
+		r.config.CurrentTokenFile,
+		r.config.PreviousTokenFile,
+		r.config.PreviousTokenValidUntilFile,
+	)
+	if err != nil {
+		r.store.disable()
+		return errTokenReload
+	}
+	defer clear(current.contents)
+	defer clear(previous.contents)
+	defer clear(validUntilFile.contents)
+	normalizeMountedToken(&current)
+	normalizeMountedToken(&previous)
+
+	previousValidUntil, err := r.validateTokenFiles(current, previous, validUntilFile)
+	if err != nil {
+		r.store.disable()
+		return errTokenReload
+	}
+	r.store.activate(current.contents, previous.contents, previousValidUntil)
+	return nil
+}
+
+func normalizeMountedToken(snapshot *tokenFileSnapshot) {
+	if snapshot == nil || len(snapshot.contents) == 0 {
+		return
+	}
+	trimmed := bytes.TrimSpace(snapshot.contents)
+	copy(snapshot.contents, trimmed)
+	clear(snapshot.contents[len(trimmed):])
+	snapshot.contents = snapshot.contents[:len(trimmed)]
+}
+
+func (r *tokenFileReloader) validateTokenFiles(
+	current tokenFileSnapshot,
+	previous tokenFileSnapshot,
+	validUntilFile tokenFileSnapshot,
+) (time.Time, error) {
+	if err := validateBearerToken(current.contents); err != nil {
+		return time.Time{}, errTokenReload
+	}
+	if previous.present != validUntilFile.present {
+		return time.Time{}, errTokenReload
+	}
+	if !previous.present {
+		return time.Time{}, nil
+	}
+	if err := validateBearerToken(previous.contents); err != nil {
+		return time.Time{}, errTokenReload
+	}
+	currentDigest := sha256.Sum256(current.contents)
+	previousDigest := sha256.Sum256(previous.contents)
+	if subtle.ConstantTimeCompare(currentDigest[:], previousDigest[:]) == 1 {
+		return time.Time{}, errTokenReload
+	}
+	validUntil, err := parseTokenDeadline(validUntilFile.contents)
+	if err != nil || validUntil.After(r.now().Add(r.config.PreviousTokenOverlap)) {
+		return time.Time{}, errTokenReload
+	}
+	return validUntil, nil
+}
+
+func (r *tokenFileReloader) run(ctx context.Context, logMessage func(string)) {
+	ticker := time.NewTicker(r.config.ReloadInterval)
+	defer ticker.Stop()
+	failed := false
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			if err := r.reload(); err != nil {
+				if !failed && logMessage != nil {
+					logMessage("provider auth proxy token reload failed; authentication is disabled until a valid reload")
+				}
+				failed = true
+				continue
+			}
+			if failed && logMessage != nil {
+				logMessage("provider auth proxy token reload recovered")
+			}
+			failed = false
+		}
+	}
+}
+
+func parseTokenDeadline(contents []byte) (time.Time, error) {
+	if len(contents) == 0 || len(contents) > maxTokenDeadlineBytes {
+		return time.Time{}, errTokenReload
+	}
+	value := strings.TrimSpace(string(contents))
+	if value == "" || strings.ContainsAny(value, "\r\n\t ") {
+		return time.Time{}, errTokenReload
+	}
+	parsed, err := time.Parse(time.RFC3339Nano, value)
+	if err != nil {
+		return time.Time{}, errTokenReload
+	}
+	return parsed, nil
+}
+
+type tokenFileSnapshot struct {
+	contents []byte
+	info     os.FileInfo
+	present  bool
+}
+
+func readStableTokenFiles(
+	currentPath string,
+	previousPath string,
+	validUntilPath string,
+) (tokenFileSnapshot, tokenFileSnapshot, tokenFileSnapshot, error) {
+	return readStableTokenFilesWithWait(currentPath, previousPath, validUntilPath, waitForNextTokenFileRead)
+}
+
+func readStableTokenFilesWithWait(
+	currentPath string,
+	previousPath string,
+	validUntilPath string,
+	wait func(int),
+) (tokenFileSnapshot, tokenFileSnapshot, tokenFileSnapshot, error) {
+	configuredPaths := [3]string{currentPath, previousPath, validUntilPath}
+	for attempt := range tokenFileReadAttempts {
+		readPaths, generation, projected, err := credentialReadPaths(configuredPaths)
+		if err != nil {
+			wait(attempt)
+			continue
+		}
+		current, err := readTokenFile(readPaths[0], false, maxBearerTokenBytes)
+		if err != nil {
+			if projected {
+				wait(attempt)
+				continue
+			}
+			return tokenFileSnapshot{}, tokenFileSnapshot{}, tokenFileSnapshot{}, err
+		}
+		previous, err := readTokenFile(readPaths[1], true, maxBearerTokenBytes)
+		if err != nil {
+			clear(current.contents)
+			if projected {
+				wait(attempt)
+				continue
+			}
+			return tokenFileSnapshot{}, tokenFileSnapshot{}, tokenFileSnapshot{}, err
+		}
+		validUntil, err := readTokenFile(readPaths[2], true, maxTokenDeadlineBytes)
+		if err != nil {
+			clear(current.contents)
+			clear(previous.contents)
+			if projected {
+				wait(attempt)
+				continue
+			}
+			return tokenFileSnapshot{}, tokenFileSnapshot{}, tokenFileSnapshot{}, err
+		}
+		if credentialReadUnchanged(configuredPaths, readPaths, generation, projected, current, previous, validUntil) {
+			return current, previous, validUntil, nil
+		}
+		clear(current.contents)
+		clear(previous.contents)
+		clear(validUntil.contents)
+		wait(attempt)
+	}
+	return tokenFileSnapshot{}, tokenFileSnapshot{}, tokenFileSnapshot{}, errTokenReload
+}
+
+func waitForNextTokenFileRead(attempt int) {
+	if attempt+1 < tokenFileReadAttempts {
+		time.Sleep(tokenFileReadRetryDelay)
+	}
+}
+
+func credentialReadPaths(configured [3]string) ([3]string, string, bool, error) {
+	if configured[1] == "" || configured[2] == "" {
+		return configured, "", false, nil
+	}
+	directory := filepath.Dir(configured[0])
+	if filepath.Dir(configured[1]) != directory || filepath.Dir(configured[2]) != directory {
+		return configured, "", false, nil
+	}
+	generationLink := filepath.Join(directory, "..data")
+	generation, err := os.Readlink(generationLink)
+	if errors.Is(err, os.ErrNotExist) {
+		return configured, "", false, nil
+	}
+	if err != nil {
+		return [3]string{}, "", false, err
+	}
+	generationDirectory := generation
+	if !filepath.IsAbs(generationDirectory) {
+		generationDirectory = filepath.Join(directory, generationDirectory)
+	}
+	generationDirectory = filepath.Clean(generationDirectory)
+	relative, err := filepath.Rel(directory, generationDirectory)
+	if err != nil || relative == ".." || strings.HasPrefix(relative, ".."+string(filepath.Separator)) {
+		return [3]string{}, "", false, errTokenReload
+	}
+	info, err := os.Stat(generationDirectory)
+	if err != nil || !info.IsDir() {
+		return [3]string{}, "", false, errTokenReload
+	}
+	return [3]string{
+		filepath.Join(generationDirectory, filepath.Base(configured[0])),
+		filepath.Join(generationDirectory, filepath.Base(configured[1])),
+		filepath.Join(generationDirectory, filepath.Base(configured[2])),
+	}, generationDirectory, true, nil
+}
+
+func credentialReadUnchanged(
+	configured [3]string,
+	readPaths [3]string,
+	generation string,
+	projected bool,
+	current tokenFileSnapshot,
+	previous tokenFileSnapshot,
+	validUntil tokenFileSnapshot,
+) bool {
+	if projected {
+		nextPaths, nextGeneration, nextProjected, err := credentialReadPaths(configured)
+		if err != nil || !nextProjected || nextGeneration != generation || nextPaths != readPaths {
+			return false
+		}
+	}
+	return tokenFileUnchanged(readPaths[0], current) && tokenFileUnchanged(readPaths[1], previous) &&
+		tokenFileUnchanged(readPaths[2], validUntil)
+}
+
+func readTokenFile(path string, optional bool, maxBytes int64) (tokenFileSnapshot, error) {
+	if path == "" {
+		return tokenFileSnapshot{}, nil
+	}
+	file, err := os.Open(path)
+	if err != nil {
+		if optional && errors.Is(err, os.ErrNotExist) {
+			return tokenFileSnapshot{}, nil
+		}
+		return tokenFileSnapshot{}, err
+	}
+	defer file.Close() //nolint:errcheck
+
+	contents, err := io.ReadAll(io.LimitReader(file, maxBytes+1))
+	if err != nil {
+		clear(contents)
+		return tokenFileSnapshot{}, err
+	}
+	info, err := file.Stat()
+	if err != nil || !info.Mode().IsRegular() {
+		clear(contents)
+		return tokenFileSnapshot{}, errTokenReload
+	}
+	return tokenFileSnapshot{contents: contents, info: info, present: true}, nil
+}
+
+func tokenFileUnchanged(path string, snapshot tokenFileSnapshot) bool {
+	if path == "" {
+		return !snapshot.present
+	}
+	info, err := os.Stat(path)
+	if !snapshot.present {
+		return errors.Is(err, os.ErrNotExist)
+	}
+	return err == nil && os.SameFile(snapshot.info, info) && snapshot.info.Size() == info.Size() &&
+		snapshot.info.ModTime().Equal(info.ModTime())
+}
diff --git a/cmd/orka-provider-auth-proxy/credentials_test.go b/cmd/orka-provider-auth-proxy/credentials_test.go
new file mode 100644
index 000000000..a7d16fb65
--- /dev/null
+++ b/cmd/orka-provider-auth-proxy/credentials_test.go
@@ -0,0 +1,552 @@
+package main
+
+import (
+	"context"
+	"crypto/sha256"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+const (
+	testProviderTokenOld  = "0123456789abcdef0123456789abcdef"
+	testProviderTokenNext = "11111111111111111111111111111111"
+	testProviderTokenNew  = "22222222222222222222222222222222"
+)
+
+func TestTokenFileReloaderSupportsLegacySingleTokenFile(t *testing.T) {
+	now := time.Now().UTC()
+	directory := t.TempDir()
+	currentPath := filepath.Join(directory, "token")
+	previousPath := filepath.Join(directory, "previous-token")
+	validUntilPath := filepath.Join(directory, "previous-token-valid-until")
+	writeTokenFile(t, currentPath, testProviderTokenOld)
+
+	store, reloader := newTestTokenFileReloader(t, &now, currentPath, previousPath, validUntilPath, time.Minute)
+	if err := reloader.reload(); err != nil {
+		t.Fatalf("reload legacy token file: %v", err)
+	}
+	if !store.isReady() || !tokenAuthorized(store, testProviderTokenOld) {
+		t.Fatal("legacy single-token file was not accepted")
+	}
+	if tokenAuthorized(store, testProviderTokenNext) {
+		t.Fatal("unconfigured token was accepted")
+	}
+}
+
+func TestTokenFileReloaderTrimsMountedCurrentAndPreviousTokens(t *testing.T) {
+	now := time.Now().UTC()
+	directory := t.TempDir()
+	currentPath := filepath.Join(directory, "token")
+	previousPath := filepath.Join(directory, "previous-token")
+	validUntilPath := filepath.Join(directory, "previous-token-valid-until")
+	writeTokenFile(t, currentPath, "\n"+testProviderTokenNew+"\r\n")
+	writeTokenFile(t, previousPath, "\t"+testProviderTokenOld+"\n")
+	writeTokenDeadline(t, validUntilPath, now.Add(time.Minute))
+
+	store, reloader := newTestTokenFileReloader(t, &now, currentPath, previousPath, validUntilPath, time.Minute)
+	if err := reloader.reload(); err != nil {
+		t.Fatalf("reload newline-terminated mounted tokens: %v", err)
+	}
+	if !tokenAuthorized(store, testProviderTokenNew) || !tokenAuthorized(store, testProviderTokenOld) {
+		t.Fatal("trimmed current and previous mounted tokens were not accepted")
+	}
+	if tokenAuthorized(store, "\n"+testProviderTokenNew) || tokenAuthorized(store, testProviderTokenOld+"\n") {
+		t.Fatal("authorization accepted whitespace as part of a bearer token")
+	}
+}
+
+func TestTokenFileReloaderFailsClosedWhenCurrentFileDisappears(t *testing.T) {
+	now := time.Now().UTC()
+	directory := t.TempDir()
+	currentPath := filepath.Join(directory, "token")
+	previousPath := filepath.Join(directory, "previous-token")
+	validUntilPath := filepath.Join(directory, "previous-token-valid-until")
+	writeTokenFile(t, currentPath, testProviderTokenOld)
+
+	store, reloader := newTestTokenFileReloader(t, &now, currentPath, previousPath, validUntilPath, time.Minute)
+	if err := reloader.reload(); err != nil {
+		t.Fatalf("initial reload: %v", err)
+	}
+	if err := os.Remove(currentPath); err != nil {
+		t.Fatalf("remove current token file: %v", err)
+	}
+	if err := reloader.reload(); err == nil {
+		t.Fatal("reload succeeded after current token file disappeared")
+	}
+	if store.isReady() || tokenAuthorized(store, testProviderTokenOld) {
+		t.Fatal("missing current token file did not disable authentication")
+	}
+}
+
+func TestTokenFileReloaderFailsClosedAndRecovers(t *testing.T) {
+	now := time.Now().UTC()
+	directory := t.TempDir()
+	currentPath := filepath.Join(directory, "token")
+	previousPath := filepath.Join(directory, "previous-token")
+	validUntilPath := filepath.Join(directory, "previous-token-valid-until")
+	writeTokenFile(t, currentPath, testProviderTokenOld)
+
+	store, reloader := newTestTokenFileReloader(t, &now, currentPath, previousPath, validUntilPath, time.Minute)
+	if err := reloader.reload(); err != nil {
+		t.Fatalf("initial reload: %v", err)
+	}
+	writeTokenFile(t, previousPath, "malformed token material that must never be logged")
+	writeTokenDeadline(t, validUntilPath, now.Add(time.Minute))
+	if err := reloader.reload(); err == nil {
+		t.Fatal("malformed reload succeeded")
+	}
+	if store.isReady() || tokenAuthorized(store, testProviderTokenOld) {
+		t.Fatal("last-known token remained active after malformed reload")
+	}
+
+	proxy, err := newProviderAuthProxyWithTokenStore(proxyConfig{UpstreamBaseURL: "http://upstream.example"}, store)
+	if err != nil {
+		t.Fatalf("new proxy: %v", err)
+	}
+	assertProxyStatus(t, proxy, readinessPath, "", http.StatusServiceUnavailable)
+	assertProxyStatus(t, proxy, healthPath, "", http.StatusOK)
+	assertProxyStatus(t, proxy, "/v1/models", testProviderTokenOld, http.StatusUnauthorized)
+
+	now = now.Add(time.Second)
+	writeTokenFile(t, previousPath, testProviderTokenNext)
+	writeTokenDeadline(t, validUntilPath, now.Add(time.Minute))
+	if err := reloader.reload(); err != nil {
+		t.Fatalf("recovery reload: %v", err)
+	}
+	if !store.isReady() || !tokenAuthorized(store, testProviderTokenOld) || !tokenAuthorized(store, testProviderTokenNext) {
+		t.Fatal("valid credentials did not recover authentication")
+	}
+
+	if err := os.Remove(validUntilPath); err != nil {
+		t.Fatalf("remove validity file: %v", err)
+	}
+	if err := reloader.reload(); err == nil {
+		t.Fatal("previous token without an absolute validity file succeeded")
+	}
+	if store.isReady() {
+		t.Fatal("incomplete previous-token pair did not fail closed")
+	}
+}
+
+func TestPreviousTokenOverlapExpiresWithoutExtensionAcrossRestart(t *testing.T) {
+	now := time.Now().UTC()
+	directory := t.TempDir()
+	currentPath := filepath.Join(directory, "token")
+	previousPath := filepath.Join(directory, "previous-token")
+	validUntilPath := filepath.Join(directory, "previous-token-valid-until")
+	writeTokenFile(t, currentPath, testProviderTokenNew)
+	writeTokenFile(t, previousPath, testProviderTokenOld)
+
+	overlap := 2 * time.Minute
+	validUntil := now.Add(overlap)
+	writeTokenDeadline(t, validUntilPath, validUntil)
+	store, reloader := newTestTokenFileReloader(t, &now, currentPath, previousPath, validUntilPath, overlap)
+	if err := reloader.reload(); err != nil {
+		t.Fatalf("initial reload: %v", err)
+	}
+	if !tokenAuthorized(store, testProviderTokenOld) || !tokenAuthorized(store, testProviderTokenNew) {
+		t.Fatal("current and previous tokens were not both accepted during overlap")
+	}
+
+	now = validUntil.Add(time.Nanosecond)
+	if tokenAuthorized(store, testProviderTokenOld) {
+		t.Fatal("previous token remained accepted after absolute deadline")
+	}
+	if err := reloader.reload(); err != nil {
+		t.Fatalf("unchanged reload: %v", err)
+	}
+	if tokenAuthorized(store, testProviderTokenOld) {
+		t.Fatal("periodic reload extended an unchanged previous token")
+	}
+	if !tokenAuthorized(store, testProviderTokenNew) {
+		t.Fatal("current token expired with previous token")
+	}
+
+	// Recreate every mounted file to model a fresh Pod/projected-volume
+	// materialization while preserving the same absolute expiry metadata.
+	writeTokenFile(t, currentPath, testProviderTokenNew)
+	writeTokenFile(t, previousPath, testProviderTokenOld)
+	writeTokenDeadline(t, validUntilPath, validUntil)
+	restartedStore, restartedReloader := newTestTokenFileReloader(
+		t,
+		&now,
+		currentPath,
+		previousPath,
+		validUntilPath,
+		overlap,
+	)
+	if err := restartedReloader.reload(); err != nil {
+		t.Fatalf("restart reload: %v", err)
+	}
+	if tokenAuthorized(restartedStore, testProviderTokenOld) {
+		t.Fatal("process restart extended an expired previous token")
+	}
+}
+
+func TestPreviousTokenDeadlineCannotExceedConfiguredOverlap(t *testing.T) {
+	now := time.Now().UTC()
+	directory := t.TempDir()
+	currentPath := filepath.Join(directory, "token")
+	previousPath := filepath.Join(directory, "previous-token")
+	validUntilPath := filepath.Join(directory, "previous-token-valid-until")
+	writeTokenFile(t, currentPath, testProviderTokenNew)
+	writeTokenFile(t, previousPath, testProviderTokenOld)
+	writeTokenDeadline(t, validUntilPath, now.Add(time.Minute+time.Second))
+
+	store, reloader := newTestTokenFileReloader(t, &now, currentPath, previousPath, validUntilPath, time.Minute)
+	if err := reloader.reload(); err == nil {
+		t.Fatal("overlong previous-token deadline succeeded")
+	}
+	if store.isReady() {
+		t.Fatal("overlong previous-token deadline did not fail closed")
+	}
+}
+
+func TestTokenFileReloaderReadsOneProjectedSecretGeneration(t *testing.T) {
+	now := time.Now().UTC()
+	directory := t.TempDir()
+	currentPath := filepath.Join(directory, "token")
+	previousPath := filepath.Join(directory, "previous-token")
+	validUntilPath := filepath.Join(directory, "previous-token-valid-until")
+	overlap := 5 * time.Minute
+
+	firstGeneration := filepath.Join(directory, "..2026_07_25_01")
+	if err := os.Mkdir(firstGeneration, 0o700); err != nil {
+		t.Fatalf("create first projected generation: %v", err)
+	}
+	writeTokenFile(t, filepath.Join(firstGeneration, "token"), testProviderTokenOld)
+	switchProjectedGeneration(t, directory, filepath.Base(firstGeneration))
+	if err := os.Symlink(filepath.Join("..data", "token"), currentPath); err != nil {
+		t.Fatalf("create visible current-token symlink: %v", err)
+	}
+
+	store, reloader := newTestTokenFileReloader(t, &now, currentPath, previousPath, validUntilPath, overlap)
+	if err := reloader.reload(); err != nil {
+		t.Fatalf("initial projected reload: %v", err)
+	}
+
+	secondGeneration := filepath.Join(directory, "..2026_07_25_02")
+	if err := os.Mkdir(secondGeneration, 0o700); err != nil {
+		t.Fatalf("create second projected generation: %v", err)
+	}
+	writeTokenFile(t, filepath.Join(secondGeneration, "token"), testProviderTokenNew)
+	writeTokenFile(t, filepath.Join(secondGeneration, "previous-token"), testProviderTokenOld)
+	writeTokenDeadline(t, filepath.Join(secondGeneration, "previous-token-valid-until"), now.Add(overlap))
+	switchProjectedGeneration(t, directory, filepath.Base(secondGeneration))
+
+	// Kubernetes publishes ..data before creating visible symlinks for newly
+	// added keys. Reload must still read the complete selected generation.
+	if _, err := os.Lstat(previousPath); !os.IsNotExist(err) {
+		t.Fatalf("previous-token visible path unexpectedly exists: %v", err)
+	}
+	if err := reloader.reload(); err != nil {
+		t.Fatalf("rotated projected reload: %v", err)
+	}
+	if !tokenAuthorized(store, testProviderTokenNew) || !tokenAuthorized(store, testProviderTokenOld) {
+		t.Fatal("projected generation was not published as one credential pair")
+	}
+}
+
+func TestReadStableTokenFilesRetriesProjectedGenerationResolution(t *testing.T) {
+	directory := t.TempDir()
+	currentPath := filepath.Join(directory, "token")
+	previousPath := filepath.Join(directory, "previous-token")
+	validUntilPath := filepath.Join(directory, "previous-token-valid-until")
+	if err := os.Symlink("..missing-generation", filepath.Join(directory, "..data")); err != nil {
+		t.Fatalf("create dangling projected generation: %v", err)
+	}
+	generation := filepath.Join(directory, "..2026_07_25_retry")
+	if err := os.Mkdir(generation, 0o700); err != nil {
+		t.Fatalf("create replacement projected generation: %v", err)
+	}
+	writeTokenFile(t, filepath.Join(generation, "token"), testProviderTokenNew)
+
+	waits := 0
+	current, previous, validUntil, err := readStableTokenFilesWithWait(
+		currentPath,
+		previousPath,
+		validUntilPath,
+		func(int) {
+			waits++
+			if waits == 1 {
+				switchProjectedGeneration(t, directory, filepath.Base(generation))
+			}
+		},
+	)
+	if err != nil {
+		t.Fatalf("read replacement projected generation: %v", err)
+	}
+	defer clear(current.contents)
+	defer clear(previous.contents)
+	defer clear(validUntil.contents)
+	if waits != 1 {
+		t.Fatalf("retry waits = %d, want 1", waits)
+	}
+	if string(current.contents) != testProviderTokenNew || previous.present || validUntil.present {
+		t.Fatal("retry did not return the complete replacement generation")
+	}
+}
+
+func TestTokenRotationProxyFirst(t *testing.T) {
+	now := time.Now().UTC()
+	directory := t.TempDir()
+	currentPath := filepath.Join(directory, "token")
+	previousPath := filepath.Join(directory, "previous-token")
+	validUntilPath := filepath.Join(directory, "previous-token-valid-until")
+	writeTokenFile(t, currentPath, testProviderTokenOld)
+
+	overlap := 5 * time.Minute
+	store, reloader := newTestTokenFileReloader(t, &now, currentPath, previousPath, validUntilPath, overlap)
+	if err := reloader.reload(); err != nil {
+		t.Fatalf("initial reload: %v", err)
+	}
+
+	now = now.Add(time.Minute)
+	validUntil := now.Add(overlap)
+	writeTokenFile(t, currentPath, testProviderTokenNew)
+	writeTokenFile(t, previousPath, testProviderTokenOld)
+	writeTokenDeadline(t, validUntilPath, validUntil)
+	if err := reloader.reload(); err != nil {
+		t.Fatalf("proxy-first reload: %v", err)
+	}
+	if !tokenAuthorized(store, testProviderTokenOld) {
+		t.Fatal("old controller token was rejected after proxy-first rotation")
+	}
+	if !tokenAuthorized(store, testProviderTokenNew) {
+		t.Fatal("new controller token was rejected after proxy-first rotation")
+	}
+
+	now = validUntil.Add(time.Nanosecond)
+	if tokenAuthorized(store, testProviderTokenOld) {
+		t.Fatal("old token remained accepted after proxy-first overlap")
+	}
+}
+
+func TestTokenRotationControllerFirstWithPreloadedOverlapToken(t *testing.T) {
+	now := time.Now().UTC()
+	directory := t.TempDir()
+	currentPath := filepath.Join(directory, "token")
+	previousPath := filepath.Join(directory, "previous-token")
+	validUntilPath := filepath.Join(directory, "previous-token-valid-until")
+	writeTokenFile(t, currentPath, testProviderTokenOld)
+
+	overlap := 5 * time.Minute
+	store, reloader := newTestTokenFileReloader(t, &now, currentPath, previousPath, validUntilPath, overlap)
+	if err := reloader.reload(); err != nil {
+		t.Fatalf("initial reload: %v", err)
+	}
+	if tokenAuthorized(store, testProviderTokenNext) {
+		t.Fatal("unstaged next token was accepted")
+	}
+
+	// Pre-stage the next controller token in the overlap slot, then switch the
+	// controller before changing which token is designated current by the proxy.
+	now = now.Add(time.Minute)
+	writeTokenFile(t, previousPath, testProviderTokenNext)
+	writeTokenDeadline(t, validUntilPath, now.Add(overlap))
+	if err := reloader.reload(); err != nil {
+		t.Fatalf("pre-stage next token: %v", err)
+	}
+	if !tokenAuthorized(store, testProviderTokenOld) || !tokenAuthorized(store, testProviderTokenNext) {
+		t.Fatal("pre-staged controller-first tokens were not both accepted")
+	}
+
+	now = now.Add(time.Minute)
+	validUntil := now.Add(overlap)
+	writeTokenFile(t, currentPath, testProviderTokenNext)
+	writeTokenFile(t, previousPath, testProviderTokenOld)
+	writeTokenDeadline(t, validUntilPath, validUntil)
+	if !tokenAuthorized(store, testProviderTokenNext) {
+		t.Fatal("controller-first request failed before the proxy observed the role swap")
+	}
+	if err := reloader.reload(); err != nil {
+		t.Fatalf("normalize controller-first token roles: %v", err)
+	}
+	if !tokenAuthorized(store, testProviderTokenNext) || !tokenAuthorized(store, testProviderTokenOld) {
+		t.Fatal("normalized controller-first tokens were not both accepted")
+	}
+
+	now = validUntil.Add(time.Nanosecond)
+	if tokenAuthorized(store, testProviderTokenOld) {
+		t.Fatal("old token remained accepted after controller-first overlap")
+	}
+}
+
+func TestBearerTokenStorePublishesCredentialPairsAtomically(t *testing.T) {
+	now := time.Now().UTC()
+	store := newBearerTokenStore(func() time.Time { return now })
+	validUntil := now.Add(time.Hour)
+	store.activate([]byte(testProviderTokenOld), []byte(testProviderTokenNext), validUntil)
+
+	oldDigest := sha256.Sum256([]byte(testProviderTokenOld))
+	nextDigest := sha256.Sum256([]byte(testProviderTokenNext))
+	newDigest := sha256.Sum256([]byte(testProviderTokenNew))
+	var invalid atomic.Bool
+	var readers sync.WaitGroup
+	for range 8 {
+		readers.Go(func() {
+			for range 10_000 {
+				active := store.snapshot.Load()
+				oldPair := active.currentDigest == oldDigest && active.previousDigest == nextDigest
+				newPair := active.currentDigest == newDigest && active.previousDigest == oldDigest
+				if !active.ready || !active.hasPrevious || (!oldPair && !newPair) {
+					invalid.Store(true)
+					return
+				}
+			}
+		})
+	}
+	for range 10_000 {
+		store.activate([]byte(testProviderTokenNew), []byte(testProviderTokenOld), validUntil)
+		store.activate([]byte(testProviderTokenOld), []byte(testProviderTokenNext), validUntil)
+	}
+	readers.Wait()
+	if invalid.Load() {
+		t.Fatal("reader observed a partially published credential pair")
+	}
+}
+
+func TestPeriodicTokenReloadDoesNotLogTokenMaterial(t *testing.T) {
+	directory := t.TempDir()
+	currentPath := filepath.Join(directory, "token")
+	previousPath := filepath.Join(directory, "previous-token")
+	validUntilPath := filepath.Join(directory, "previous-token-valid-until")
+	writeTokenFile(t, currentPath, testProviderTokenOld)
+
+	store := newBearerTokenStore(time.Now)
+	reloader, err := newTokenFileReloader(tokenFileReloaderConfig{
+		CurrentTokenFile:            currentPath,
+		PreviousTokenFile:           previousPath,
+		PreviousTokenValidUntilFile: validUntilPath,
+		ReloadInterval:              5 * time.Millisecond,
+		PreviousTokenOverlap:        time.Minute,
+	}, store)
+	if err != nil {
+		t.Fatalf("new reloader: %v", err)
+	}
+	if err := reloader.reload(); err != nil {
+		t.Fatalf("initial reload: %v", err)
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	var messagesMu sync.Mutex
+	var messages []string
+	go reloader.run(ctx, func(message string) {
+		messagesMu.Lock()
+		defer messagesMu.Unlock()
+		messages = append(messages, message)
+	})
+
+	malformed := "malformed token material that must never be logged"
+	writeTokenFile(t, currentPath, malformed)
+	eventually(t, time.Second, func() bool { return !store.isReady() })
+	if tokenAuthorized(store, testProviderTokenOld) {
+		t.Fatal("old token remained accepted after periodic malformed reload")
+	}
+
+	writeTokenFile(t, currentPath, testProviderTokenNew)
+	eventually(t, time.Second, func() bool {
+		return store.isReady() && tokenAuthorized(store, testProviderTokenNew)
+	})
+
+	eventually(t, time.Second, func() bool {
+		messagesMu.Lock()
+		defer messagesMu.Unlock()
+		joined := strings.Join(messages, "\n")
+		return strings.Contains(joined, "reload failed") && strings.Contains(joined, "reload recovered")
+	})
+	cancel()
+	messagesMu.Lock()
+	joined := strings.Join(messages, "\n")
+	messagesMu.Unlock()
+	for _, secret := range []string{malformed, testProviderTokenOld, testProviderTokenNew} {
+		if strings.Contains(joined, secret) {
+			t.Fatalf("token material appeared in reload logs: %q", joined)
+		}
+	}
+}
+
+func newTestTokenFileReloader(
+	t *testing.T,
+	now *time.Time,
+	currentPath string,
+	previousPath string,
+	validUntilPath string,
+	overlap time.Duration,
+) (*bearerTokenStore, *tokenFileReloader) {
+	t.Helper()
+	store := newBearerTokenStore(func() time.Time { return *now })
+	reloader, err := newTokenFileReloader(tokenFileReloaderConfig{
+		CurrentTokenFile:            currentPath,
+		PreviousTokenFile:           previousPath,
+		PreviousTokenValidUntilFile: validUntilPath,
+		ReloadInterval:              time.Second,
+		PreviousTokenOverlap:        overlap,
+	}, store)
+	if err != nil {
+		t.Fatalf("new token file reloader: %v", err)
+	}
+	return store, reloader
+}
+
+func writeTokenFile(t *testing.T, path, token string) {
+	t.Helper()
+	if err := os.WriteFile(path, []byte(token), 0o600); err != nil {
+		t.Fatalf("write token file: %v", err)
+	}
+}
+
+func writeTokenDeadline(t *testing.T, path string, deadline time.Time) {
+	t.Helper()
+	if err := os.WriteFile(path, []byte(deadline.UTC().Format(time.RFC3339Nano)), 0o600); err != nil {
+		t.Fatalf("write token deadline: %v", err)
+	}
+}
+
+func switchProjectedGeneration(t *testing.T, directory, generation string) {
+	t.Helper()
+	temporaryLink := filepath.Join(directory, "..data_tmp")
+	if err := os.Symlink(generation, temporaryLink); err != nil {
+		t.Fatalf("create projected generation link: %v", err)
+	}
+	if err := os.Rename(temporaryLink, filepath.Join(directory, "..data")); err != nil {
+		t.Fatalf("publish projected generation: %v", err)
+	}
+}
+
+func tokenAuthorized(store *bearerTokenStore, token string) bool {
+	return store.authorized([]string{"Bearer " + token})
+}
+
+func assertProxyStatus(t *testing.T, proxy *providerAuthProxy, path, token string, expected int) {
+	t.Helper()
+	request := httptest.NewRequest(http.MethodGet, "http://proxy"+path, nil)
+	if token != "" {
+		request.Header.Set(authorizationHeader, "Bearer "+token)
+	}
+	response := httptest.NewRecorder()
+	proxy.ServeHTTP(response, request)
+	if response.Code != expected {
+		t.Fatalf("%s status = %d, want %d", path, response.Code, expected)
+	}
+}
+
+func eventually(t *testing.T, timeout time.Duration, condition func() bool) {
+	t.Helper()
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		if condition() {
+			return
+		}
+		time.Sleep(time.Millisecond)
+	}
+	t.Fatal("condition was not satisfied before timeout")
+}
diff --git a/cmd/orka-provider-auth-proxy/main.go b/cmd/orka-provider-auth-proxy/main.go
new file mode 100644
index 000000000..633d63f87
--- /dev/null
+++ b/cmd/orka-provider-auth-proxy/main.go
@@ -0,0 +1,136 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package main
+
+import (
+	"context"
+	"flag"
+	"log"
+	"net"
+	"net/http"
+	"os"
+	"os/signal"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+)
+
+func main() {
+	listenAddress := flag.String("listen-address", envDefault("ORKA_PROVIDER_AUTH_PROXY_LISTEN_ADDRESS", ":8080"), "HTTP listen address")
+	upstreamBaseURL := flag.String("upstream-base-url", os.Getenv("ORKA_PROVIDER_AUTH_PROXY_UPSTREAM_BASE_URL"), "Unauthenticated Vekil upstream base URL")
+	tokenFile := flag.String("token-file", envDefault("ORKA_PROVIDER_AUTH_PROXY_TOKEN_FILE", "/var/run/secrets/orka/provider-auth/token"), "Mounted current bearer token file")
+	previousTokenFile := flag.String("previous-token-file", os.Getenv("ORKA_PROVIDER_AUTH_PROXY_PREVIOUS_TOKEN_FILE"), "Optional mounted previous/overlap bearer token file")
+	previousTokenValidUntilFile := flag.String("previous-token-valid-until-file", os.Getenv("ORKA_PROVIDER_AUTH_PROXY_PREVIOUS_TOKEN_VALID_UNTIL_FILE"), "Optional mounted RFC3339 expiry file for the previous/overlap token")
+	tokenReloadInterval := flag.Duration("token-reload-interval", envDurationDefault("ORKA_PROVIDER_AUTH_PROXY_TOKEN_RELOAD_INTERVAL", defaultTokenReloadInterval), "Bearer token file reload interval")
+	previousTokenOverlap := flag.Duration("previous-token-overlap", envDurationDefault("ORKA_PROVIDER_AUTH_PROXY_PREVIOUS_TOKEN_OVERLAP", defaultPreviousTokenOverlap), "Maximum previous/overlap token acceptance window")
+	maxRequestBytes := flag.Int64("max-request-bytes", envInt64Default("ORKA_PROVIDER_AUTH_PROXY_MAX_REQUEST_BYTES", defaultMaxRequestBytes), "Maximum streamed request body size")
+	maxResponseBytes := flag.Int64("max-response-bytes", envInt64Default("ORKA_PROVIDER_AUTH_PROXY_MAX_RESPONSE_BYTES", defaultMaxResponseBytes), "Maximum streamed response body size")
+	responseHeaderTimeout := flag.Duration("response-header-timeout", envDurationDefault("ORKA_PROVIDER_AUTH_PROXY_RESPONSE_HEADER_TIMEOUT", defaultResponseHeaderTimeout), "Upstream response header timeout")
+	maxConcurrentRequests := flag.Int("max-concurrent-requests", envIntDefault("ORKA_PROVIDER_AUTH_PROXY_MAX_CONCURRENT_REQUESTS", defaultMaxConcurrentRequests), "Maximum concurrent upstream requests")
+	flag.Parse()
+
+	tokens := newBearerTokenStore(time.Now)
+	reloader, err := newTokenFileReloader(tokenFileReloaderConfig{
+		CurrentTokenFile:            *tokenFile,
+		PreviousTokenFile:           *previousTokenFile,
+		PreviousTokenValidUntilFile: *previousTokenValidUntilFile,
+		ReloadInterval:              *tokenReloadInterval,
+		PreviousTokenOverlap:        *previousTokenOverlap,
+	}, tokens)
+	if err != nil {
+		log.Fatalf("invalid provider auth proxy token reload configuration: %v", err)
+	}
+	if err := reloader.reload(); err != nil {
+		log.Fatal("provider auth proxy token files are unavailable or invalid")
+	}
+	proxy, err := newProviderAuthProxyWithTokenStore(proxyConfig{
+		UpstreamBaseURL:       *upstreamBaseURL,
+		MaxRequestBytes:       *maxRequestBytes,
+		MaxResponseBytes:      *maxResponseBytes,
+		ResponseHeaderTimeout: *responseHeaderTimeout,
+		MaxConcurrentRequests: *maxConcurrentRequests,
+	}, tokens)
+	if err != nil {
+		log.Fatalf("invalid provider auth proxy configuration: %v", err)
+	}
+	listener, err := net.Listen("tcp", strings.TrimSpace(*listenAddress))
+	if err != nil {
+		log.Fatalf("listen: %v", err)
+	}
+	server := newProxyHTTPServer(strings.TrimSpace(*listenAddress), proxy)
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+	go reloader.run(ctx, func(message string) { log.Print(message) })
+	serveErr := make(chan error, 1)
+	go func() {
+		serveErr <- server.Serve(listener)
+	}()
+	log.Printf("provider auth proxy listening on %s", listener.Addr())
+	select {
+	case err := <-serveErr:
+		if err != nil && !errorsIsServerClosed(err) {
+			log.Fatalf("serve provider auth proxy: %v", err)
+		}
+	case <-ctx.Done():
+		shutdownCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
+		if err := server.Shutdown(shutdownCtx); err != nil {
+			log.Printf("provider auth proxy shutdown failed")
+		}
+		if err := <-serveErr; err != nil && !errorsIsServerClosed(err) {
+			log.Printf("provider auth proxy stopped unexpectedly")
+		}
+	}
+}
+
+func errorsIsServerClosed(err error) bool {
+	return err == http.ErrServerClosed
+}
+
+func envDefault(name, fallback string) string {
+	if value := strings.TrimSpace(os.Getenv(name)); value != "" {
+		return value
+	}
+	return fallback
+}
+
+func envInt64Default(name string, fallback int64) int64 {
+	value := strings.TrimSpace(os.Getenv(name))
+	if value == "" {
+		return fallback
+	}
+	parsed, err := strconv.ParseInt(value, 10, 64)
+	if err != nil {
+		log.Fatalf("invalid %s", name)
+	}
+	return parsed
+}
+
+func envIntDefault(name string, fallback int) int {
+	value := strings.TrimSpace(os.Getenv(name))
+	if value == "" {
+		return fallback
+	}
+	parsed, err := strconv.Atoi(value)
+	if err != nil {
+		log.Fatalf("invalid %s", name)
+	}
+	return parsed
+}
+
+func envDurationDefault(name string, fallback time.Duration) time.Duration {
+	value := strings.TrimSpace(os.Getenv(name))
+	if value == "" {
+		return fallback
+	}
+	parsed, err := time.ParseDuration(value)
+	if err != nil {
+		log.Fatalf("invalid %s", name)
+	}
+	return parsed
+}
diff --git a/cmd/orka-provider-auth-proxy/proxy.go b/cmd/orka-provider-auth-proxy/proxy.go
new file mode 100644
index 000000000..7c9e95782
--- /dev/null
+++ b/cmd/orka-provider-auth-proxy/proxy.go
@@ -0,0 +1,269 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/orka-agents/orka/internal/providerproxy"
+)
+
+const (
+	healthPath                   = "/healthz"
+	readinessPath                = "/readyz"
+	defaultMaxRequestBytes       = 32 << 20
+	defaultMaxResponseBytes      = 64 << 20
+	defaultResponseHeaderTimeout = 30 * time.Second
+	defaultReadHeaderTimeout     = 5 * time.Second
+	defaultIdleTimeout           = 30 * time.Second
+	defaultMaxConcurrentRequests = 32
+	authorizationHeader          = "Authorization"
+)
+
+var errRequestBodyTooLarge = errors.New("provider request body exceeds limit")
+
+type proxyConfig struct {
+	UpstreamBaseURL       string
+	MaxRequestBytes       int64
+	MaxResponseBytes      int64
+	ResponseHeaderTimeout time.Duration
+	MaxConcurrentRequests int
+}
+
+type providerAuthProxy struct {
+	upstreamBase     *url.URL
+	tokens           *bearerTokenStore
+	maxRequestBytes  int64
+	maxResponseBytes int64
+	client           *http.Client
+	requestSlots     chan struct{}
+}
+
+func newProviderAuthProxy(cfg proxyConfig, bearerToken []byte) (*providerAuthProxy, error) {
+	tokens, err := newStaticBearerTokenStore(bearerToken)
+	if err != nil {
+		return nil, err
+	}
+	return newProviderAuthProxyWithTokenStore(cfg, tokens)
+}
+
+func newProviderAuthProxyWithTokenStore(cfg proxyConfig, tokens *bearerTokenStore) (*providerAuthProxy, error) {
+	normalized, upstream, err := normalizeProxyConfig(cfg)
+	if err != nil {
+		return nil, err
+	}
+	if tokens == nil {
+		return nil, fmt.Errorf("provider auth token store is required")
+	}
+	transport := &http.Transport{
+		Proxy:                  nil,
+		DialContext:            (&net.Dialer{Timeout: 10 * time.Second, KeepAlive: 30 * time.Second}).DialContext,
+		ForceAttemptHTTP2:      false,
+		DisableKeepAlives:      false,
+		MaxIdleConns:           normalized.MaxConcurrentRequests,
+		MaxIdleConnsPerHost:    normalized.MaxConcurrentRequests,
+		IdleConnTimeout:        90 * time.Second,
+		TLSHandshakeTimeout:    10 * time.Second,
+		ResponseHeaderTimeout:  normalized.ResponseHeaderTimeout,
+		ExpectContinueTimeout:  time.Second,
+		MaxResponseHeaderBytes: 64 << 10,
+		DisableCompression:     true,
+	}
+	return &providerAuthProxy{
+		upstreamBase:     upstream,
+		tokens:           tokens,
+		maxRequestBytes:  normalized.MaxRequestBytes,
+		maxResponseBytes: normalized.MaxResponseBytes,
+		client: &http.Client{
+			Transport: transport,
+			CheckRedirect: func(*http.Request, []*http.Request) error {
+				return http.ErrUseLastResponse
+			},
+		},
+		requestSlots: make(chan struct{}, normalized.MaxConcurrentRequests),
+	}, nil
+}
+
+func normalizeProxyConfig(cfg proxyConfig) (proxyConfig, *url.URL, error) {
+	parsed, err := url.Parse(strings.TrimSpace(cfg.UpstreamBaseURL))
+	if err != nil || parsed.Host == "" || parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" ||
+		(parsed.Scheme != "http" && parsed.Scheme != "https") {
+		return proxyConfig{}, nil, fmt.Errorf("provider upstream base URL is invalid")
+	}
+	if parsed.Path == "" {
+		parsed.Path = "/"
+	}
+	if providerproxy.HasUnsafePathSegment(parsed.Path) {
+		return proxyConfig{}, nil, fmt.Errorf("provider upstream base URL is invalid")
+	}
+	if cfg.MaxRequestBytes <= 0 {
+		cfg.MaxRequestBytes = defaultMaxRequestBytes
+	}
+	if cfg.MaxResponseBytes <= 0 {
+		cfg.MaxResponseBytes = defaultMaxResponseBytes
+	}
+	if cfg.ResponseHeaderTimeout <= 0 {
+		cfg.ResponseHeaderTimeout = defaultResponseHeaderTimeout
+	}
+	if cfg.MaxConcurrentRequests <= 0 {
+		cfg.MaxConcurrentRequests = defaultMaxConcurrentRequests
+	}
+	cfg.UpstreamBaseURL = parsed.String()
+	return cfg, parsed, nil
+}
+
+func validateBearerToken(token []byte) error {
+	if len(token) < 32 || len(token) > maxBearerTokenBytes {
+		return fmt.Errorf("provider auth bearer token is invalid")
+	}
+	for _, value := range token {
+		if value <= ' ' || value == 0x7f {
+			return fmt.Errorf("provider auth bearer token is invalid")
+		}
+	}
+	return nil
+}
+
+func (p *providerAuthProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if r.URL.Path == healthPath {
+		serveHealth(w, r)
+		return
+	}
+	if r.URL.Path == readinessPath {
+		if !p.tokens.isReady() {
+			providerproxy.WriteError(w, http.StatusServiceUnavailable, "provider proxy authentication is unavailable")
+			return
+		}
+		serveHealth(w, r)
+		return
+	}
+	if !p.authorized(r.Header.Values(authorizationHeader)) {
+		w.Header().Set("WWW-Authenticate", `Bearer realm="orka-provider-auth-proxy"`)
+		providerproxy.WriteError(w, http.StatusUnauthorized, "provider proxy authentication required")
+		return
+	}
+	if !providerproxy.TryAcquireSlot(p.requestSlots) {
+		providerproxy.WriteError(w, http.StatusTooManyRequests, "provider proxy request capacity is exhausted")
+		return
+	}
+	defer providerproxy.ReleaseSlot(p.requestSlots)
+	if r.Method == http.MethodConnect || r.Method == http.MethodTrace {
+		providerproxy.WriteError(w, http.StatusMethodNotAllowed, "provider request method is not allowed")
+		return
+	}
+	if providerproxy.HasUnsafePathSegment(r.URL.Path) {
+		providerproxy.WriteError(w, http.StatusBadRequest, "provider request path is invalid")
+		return
+	}
+	if providerproxy.HasDisallowedContentEncoding(r.Header) {
+		providerproxy.WriteError(w, http.StatusUnsupportedMediaType, "compressed provider requests are forbidden")
+		return
+	}
+	if r.ContentLength > p.maxRequestBytes {
+		providerproxy.WriteError(w, http.StatusRequestEntityTooLarge, "provider request body exceeds limit")
+		return
+	}
+
+	target := providerproxy.Target(p.upstreamBase, r.URL.Path, r.URL.RawQuery)
+	body := &boundedReadCloser{ReadCloser: r.Body, remaining: p.maxRequestBytes}
+	upstreamRequest, err := http.NewRequestWithContext(r.Context(), r.Method, target.String(), body)
+	if err != nil {
+		providerproxy.WriteError(w, http.StatusBadGateway, "provider request could not be prepared")
+		return
+	}
+	upstreamRequest.ContentLength = r.ContentLength
+	providerproxy.CopyRequestHeaders(upstreamRequest.Header, r.Header)
+	upstreamRequest.Header.Set("Accept-Encoding", "identity")
+
+	response, err := p.client.Do(upstreamRequest)
+	if err != nil {
+		if errors.Is(err, errRequestBodyTooLarge) {
+			providerproxy.WriteError(w, http.StatusRequestEntityTooLarge, "provider request body exceeds limit")
+			return
+		}
+		providerproxy.WriteError(w, http.StatusBadGateway, "provider upstream request failed")
+		return
+	}
+	defer response.Body.Close() //nolint:errcheck
+	if response.StatusCode >= http.StatusMultipleChoices && response.StatusCode < http.StatusBadRequest {
+		providerproxy.WriteError(w, http.StatusBadGateway, "provider upstream redirects are forbidden")
+		return
+	}
+	if providerproxy.HasDisallowedContentEncoding(response.Header) {
+		providerproxy.WriteError(w, http.StatusBadGateway, "compressed provider responses are forbidden")
+		return
+	}
+	if response.ContentLength > p.maxResponseBytes {
+		providerproxy.WriteError(w, http.StatusBadGateway, "provider upstream response exceeds limit")
+		return
+	}
+	providerproxy.CopyResponseHeaders(w.Header(), response.Header)
+	w.WriteHeader(response.StatusCode)
+	// The nil flusher keeps this proxy's original buffered write behavior.
+	if err := providerproxy.StreamBoundedResponse(w, response.Body, p.maxResponseBytes, nil); err != nil {
+		panic(http.ErrAbortHandler)
+	}
+}
+
+func (p *providerAuthProxy) authorized(values []string) bool {
+	return p.tokens.authorized(values)
+}
+
+func serveHealth(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet && r.Method != http.MethodHead {
+		w.Header().Set("Allow", "GET, HEAD")
+		providerproxy.WriteError(w, http.StatusMethodNotAllowed, "health probe method is not allowed")
+		return
+	}
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	w.Header().Set("Cache-Control", "no-store")
+	w.WriteHeader(http.StatusOK)
+	if r.Method != http.MethodHead {
+		_, _ = io.WriteString(w, "ok\n")
+	}
+}
+
+type boundedReadCloser struct {
+	io.ReadCloser
+	remaining int64
+}
+
+func (r *boundedReadCloser) Read(buffer []byte) (int, error) {
+	if r.remaining < 0 {
+		return 0, errRequestBodyTooLarge
+	}
+	maxRead := min(int64(len(buffer)), r.remaining+1)
+	n, err := r.ReadCloser.Read(buffer[:maxRead])
+	if int64(n) > r.remaining {
+		allowed := int(r.remaining)
+		r.remaining = -1
+		return allowed, errRequestBodyTooLarge
+	}
+	r.remaining -= int64(n)
+	return n, err
+}
+
+func newProxyHTTPServer(address string, handler http.Handler) *http.Server {
+	return &http.Server{
+		Addr:              address,
+		Handler:           handler,
+		ReadHeaderTimeout: defaultReadHeaderTimeout,
+		IdleTimeout:       defaultIdleTimeout,
+		MaxHeaderBytes:    32 << 10,
+		BaseContext: func(net.Listener) context.Context {
+			return context.Background()
+		},
+	}
+}
diff --git a/cmd/orka-provider-auth-proxy/proxy_test.go b/cmd/orka-provider-auth-proxy/proxy_test.go
new file mode 100644
index 000000000..5d127b431
--- /dev/null
+++ b/cmd/orka-provider-auth-proxy/proxy_test.go
@@ -0,0 +1,159 @@
+package main
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+const testSharedProviderToken = "0123456789abcdef0123456789abcdef"
+
+func TestProviderAuthProxyRejectsMissingAndWrongBearerTokens(t *testing.T) {
+	upstreamCalls := 0
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		upstreamCalls++
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	t.Cleanup(upstream.Close)
+	proxy := newTestProxy(t, upstream.URL, testSharedProviderToken)
+
+	for name, authorization := range map[string]string{
+		"missing": "",
+		"wrong":   "Bearer 0123456789abcdef0123456789abcdeg",
+		"basic":   "Basic " + testSharedProviderToken,
+	} {
+		t.Run(name, func(t *testing.T) {
+			request := httptest.NewRequest(http.MethodPost, "http://proxy/v1/responses", strings.NewReader(`{"model":"test"}`))
+			if authorization != "" {
+				request.Header.Set(authorizationHeader, authorization)
+			}
+			response := httptest.NewRecorder()
+			proxy.ServeHTTP(response, request)
+			if response.Code != http.StatusUnauthorized {
+				t.Fatalf("status = %d, want %d", response.Code, http.StatusUnauthorized)
+			}
+		})
+	}
+	if upstreamCalls != 0 {
+		t.Fatalf("upstream calls = %d, want 0", upstreamCalls)
+	}
+}
+
+func TestProviderAuthProxyForwardsAuthorizedRequestWithoutSensitiveHeaders(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/base/v1/responses" || r.URL.RawQuery != "stream=true" {
+			t.Fatalf("upstream URL = %s, want /base/v1/responses?stream=true", r.URL.String())
+		}
+		for _, name := range []string{authorizationHeader, "X-Api-Key", "Cookie", "Txn-Token", "X-Orka-Internal"} {
+			if value := r.Header.Get(name); value != "" {
+				t.Fatalf("upstream received sensitive header %s", name)
+			}
+		}
+		if got := r.Header.Get("Accept-Encoding"); got != "identity" {
+			t.Fatalf("Accept-Encoding = %q, want identity", got)
+		}
+		if got := r.Header.Get("Content-Type"); got != "application/json" {
+			t.Fatalf("Content-Type = %q", got)
+		}
+		body, err := io.ReadAll(r.Body)
+		if err != nil {
+			t.Fatalf("read upstream request: %v", err)
+		}
+		if string(body) != `{"model":"test"}` {
+			t.Fatalf("upstream body = %q", body)
+		}
+		w.Header().Set("Content-Type", "application/json")
+		w.Header().Set("Set-Cookie", "secret=value")
+		_, _ = io.WriteString(w, `{"ok":true}`)
+	}))
+	t.Cleanup(upstream.Close)
+	proxy := newTestProxy(t, upstream.URL+"/base", testSharedProviderToken)
+	request := httptest.NewRequest(http.MethodPost, "http://proxy/v1/responses?stream=true", strings.NewReader(`{"model":"test"}`))
+	request.Header.Set(authorizationHeader, "Bearer "+testSharedProviderToken)
+	request.Header.Set("X-Api-Key", "child-key")
+	request.Header.Set("Cookie", "child=cookie")
+	request.Header.Set("Txn-Token", "transaction")
+	request.Header.Set("X-Orka-Internal", "internal")
+	request.Header.Set("Content-Type", "application/json")
+	response := httptest.NewRecorder()
+	proxy.ServeHTTP(response, request)
+	if response.Code != http.StatusOK || response.Body.String() != `{"ok":true}` {
+		t.Fatalf("response = %d %q", response.Code, response.Body.String())
+	}
+	if value := response.Header().Get("Set-Cookie"); value != "" {
+		t.Fatalf("sensitive response header leaked: %q", value)
+	}
+}
+
+func TestProviderAuthProxyHealthDoesNotRequireAuthentication(t *testing.T) {
+	proxy := newTestProxy(t, "http://upstream.example", testSharedProviderToken)
+	for _, path := range []string{healthPath, readinessPath} {
+		request := httptest.NewRequest(http.MethodGet, "http://proxy"+path, nil)
+		response := httptest.NewRecorder()
+		proxy.ServeHTTP(response, request)
+		if response.Code != http.StatusOK || response.Body.String() != "ok\n" {
+			t.Fatalf("%s response = %d %q", path, response.Code, response.Body.String())
+		}
+	}
+}
+
+func TestProviderAuthProxyRejectsRedirectsAndCompressedResponses(t *testing.T) {
+	for name, handler := range map[string]http.HandlerFunc{
+		"redirect": func(w http.ResponseWriter, _ *http.Request) {
+			w.Header().Set("Location", "http://elsewhere.example")
+			w.WriteHeader(http.StatusTemporaryRedirect)
+		},
+		"compressed": func(w http.ResponseWriter, _ *http.Request) {
+			w.Header().Set("Content-Encoding", "gzip")
+			_, _ = io.WriteString(w, "compressed")
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			upstream := httptest.NewServer(handler)
+			t.Cleanup(upstream.Close)
+			proxy := newTestProxy(t, upstream.URL, testSharedProviderToken)
+			request := httptest.NewRequest(http.MethodGet, "http://proxy/v1/models", nil)
+			request.Header.Set(authorizationHeader, "Bearer "+testSharedProviderToken)
+			response := httptest.NewRecorder()
+			proxy.ServeHTTP(response, request)
+			if response.Code != http.StatusBadGateway {
+				t.Fatalf("status = %d, want %d", response.Code, http.StatusBadGateway)
+			}
+		})
+	}
+}
+
+func TestProviderAuthProxyRejectsOversizeKnownRequest(t *testing.T) {
+	upstreamCalls := 0
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		upstreamCalls++
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	t.Cleanup(upstream.Close)
+	proxy, err := newProviderAuthProxy(proxyConfig{UpstreamBaseURL: upstream.URL, MaxRequestBytes: 4}, []byte(testSharedProviderToken))
+	if err != nil {
+		t.Fatalf("new proxy: %v", err)
+	}
+	request := httptest.NewRequest(http.MethodPost, "http://proxy/v1/responses", strings.NewReader("12345"))
+	request.Header.Set(authorizationHeader, "Bearer "+testSharedProviderToken)
+	response := httptest.NewRecorder()
+	proxy.ServeHTTP(response, request)
+	if response.Code != http.StatusRequestEntityTooLarge {
+		t.Fatalf("status = %d, want %d", response.Code, http.StatusRequestEntityTooLarge)
+	}
+	if upstreamCalls != 0 {
+		t.Fatalf("upstream calls = %d, want 0", upstreamCalls)
+	}
+}
+
+//nolint:unparam // The stable parameter keeps call sites explicit across related test cases.
+func newTestProxy(t *testing.T, upstreamURL, token string) *providerAuthProxy {
+	t.Helper()
+	proxy, err := newProviderAuthProxy(proxyConfig{UpstreamBaseURL: upstreamURL}, []byte(token))
+	if err != nil {
+		t.Fatalf("new provider auth proxy: %v", err)
+	}
+	return proxy
+}
diff --git a/cmd/orka-scm-egress-proxy/auth.go b/cmd/orka-scm-egress-proxy/auth.go
new file mode 100644
index 000000000..7a5aca3d6
--- /dev/null
+++ b/cmd/orka-scm-egress-proxy/auth.go
@@ -0,0 +1,101 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package main
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/base64"
+	"fmt"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+type proxyAuthenticator struct {
+	tokenDigest [sha256.Size]byte
+}
+
+func loadProxyAuthenticator(path string) (*proxyAuthenticator, error) {
+	if !filepath.IsAbs(path) || filepath.Clean(path) != path {
+		return nil, fmt.Errorf("proxy token path must be absolute and clean")
+	}
+	info, err := os.Lstat(path)
+	if err != nil || info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() || info.Mode().Perm()&0o027 != 0 ||
+		info.Size() < minProxyTokenBytes || info.Size() > maxProxyTokenBytes+2 {
+		return nil, fmt.Errorf("proxy token file is missing or unsafe")
+	}
+	value, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("read proxy token file: %w", err)
+	}
+	value = bytes.TrimSuffix(value, []byte("\r\n"))
+	value = bytes.TrimSuffix(value, []byte("\n"))
+	return newProxyAuthenticator(value)
+}
+
+func ensureKubernetesServiceAccountTokenAbsent(path string) error {
+	if !filepath.IsAbs(path) || filepath.Clean(path) != path {
+		return fmt.Errorf("kubernetes service-account token path must be absolute and clean")
+	}
+	if _, err := os.Lstat(path); err == nil {
+		return fmt.Errorf("kubernetes service-account token is mounted")
+	} else if !os.IsNotExist(err) {
+		return fmt.Errorf("inspect Kubernetes service-account token path: %w", err)
+	}
+	return nil
+}
+
+func newProxyAuthenticator(token []byte) (*proxyAuthenticator, error) {
+	if err := validateProxyToken(token); err != nil {
+		return nil, err
+	}
+	return &proxyAuthenticator{tokenDigest: sha256.Sum256(token)}, nil
+}
+
+func validateProxyToken(token []byte) error {
+	if len(token) < minProxyTokenBytes || len(token) > maxProxyTokenBytes {
+		return fmt.Errorf("proxy token length is invalid")
+	}
+	for _, current := range token {
+		if !isProxyTokenCharacter(current) {
+			return fmt.Errorf("proxy token contains an unsupported character")
+		}
+	}
+	return nil
+}
+
+func isProxyTokenCharacter(value byte) bool {
+	return value >= 'a' && value <= 'z' || value >= 'A' && value <= 'Z' ||
+		value >= '0' && value <= '9' || strings.ContainsRune("-._~", rune(value))
+}
+
+func (a *proxyAuthenticator) authorized(request *http.Request) bool {
+	if a == nil {
+		return false
+	}
+	values := request.Header.Values("Proxy-Authorization")
+	if len(values) != 1 {
+		return false
+	}
+	const prefix = "Basic "
+	if !strings.HasPrefix(values[0], prefix) || len(values[0]) > 1024 {
+		return false
+	}
+	decoded, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(values[0], prefix))
+	if err != nil || bytes.ContainsAny(decoded, "\r\n\x00") {
+		return false
+	}
+	username, token, found := bytes.Cut(decoded, []byte{':'})
+	if !found || string(username) != proxyUsername {
+		return false
+	}
+	digest := sha256.Sum256(token)
+	return subtle.ConstantTimeCompare(digest[:], a.tokenDigest[:]) == 1
+}
diff --git a/cmd/orka-scm-egress-proxy/config.go b/cmd/orka-scm-egress-proxy/config.go
new file mode 100644
index 000000000..f923ef505
--- /dev/null
+++ b/cmd/orka-scm-egress-proxy/config.go
@@ -0,0 +1,236 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/netip"
+	"net/url"
+	"sort"
+	"strings"
+	"time"
+)
+
+const (
+	defaultListenAddress         = ":8080"
+	defaultAllowedHosts          = "github.com"
+	defaultForgeAPIBaseURL       = "https://api.github.com"
+	defaultTokenFile             = "/var/run/secrets/orka/scm-egress/token"
+	defaultKubernetesTokenFile   = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+	defaultMaxRequestHeaderBytes = int64(32 << 10)
+	defaultMaxResponseHeader     = int64(64 << 10)
+	defaultMaxRequestBytes       = int64(4 << 20)
+	defaultMaxResponseBytes      = int64(8 << 20)
+	defaultMaxTunnelBytes        = int64(1 << 30)
+	defaultMaxConcurrent         = 8
+	defaultResolutionTimeout     = 5 * time.Second
+	defaultConnectTimeout        = 10 * time.Second
+	defaultResponseHeaderTimeout = 30 * time.Second
+	defaultForwardTimeout        = 2 * time.Minute
+	defaultIdleTimeout           = 30 * time.Second
+	defaultTunnelTimeout         = 10 * time.Minute
+	defaultShutdownTimeout       = 15 * time.Second
+	proxyUsername                = "orka-publisher"
+	maxProxyTokenBytes           = 256
+	minProxyTokenBytes           = 32
+	maxResolvedAddresses         = 32
+)
+
+var (
+	errHostDenied       = errors.New("target host is not allowed")
+	errAddressDenied    = errors.New("target address is not public")
+	errResolutionFailed = errors.New("target resolution failed")
+)
+
+type resolver interface {
+	LookupNetIP(ctx context.Context, network, host string) ([]netip.Addr, error)
+}
+
+type contextDialer interface {
+	DialContext(ctx context.Context, network, address string) (net.Conn, error)
+}
+
+type proxyConfig struct {
+	AllowedHosts          map[string]struct{}
+	MaxRequestHeaderBytes int64
+	MaxResponseHeader     int64
+	MaxRequestBytes       int64
+	MaxResponseBytes      int64
+	MaxTunnelBytes        int64
+	MaxConcurrent         int
+	ResolutionTimeout     time.Duration
+	ConnectTimeout        time.Duration
+	ResponseHeaderTimeout time.Duration
+	ForwardTimeout        time.Duration
+	IdleTimeout           time.Duration
+	TunnelTimeout         time.Duration
+	Resolver              resolver
+	Dialer                contextDialer
+}
+
+func normalizeProxyConfig(config proxyConfig) (proxyConfig, error) {
+	if len(config.AllowedHosts) == 0 {
+		return proxyConfig{}, fmt.Errorf("at least one allowed host is required")
+	}
+	for host := range config.AllowedHosts {
+		if err := validateHostname(host); err != nil {
+			return proxyConfig{}, fmt.Errorf("allowed host is invalid: %w", err)
+		}
+	}
+	applyProxyConfigDefaults(&config)
+	if err := validateProxyConfigBounds(config); err != nil {
+		return proxyConfig{}, err
+	}
+	if config.Resolver == nil {
+		config.Resolver = net.DefaultResolver
+	}
+	if config.Dialer == nil {
+		config.Dialer = &net.Dialer{Timeout: config.ConnectTimeout, KeepAlive: -1}
+	}
+	return config, nil
+}
+
+func applyProxyConfigDefaults(config *proxyConfig) {
+	if config.MaxRequestHeaderBytes == 0 {
+		config.MaxRequestHeaderBytes = defaultMaxRequestHeaderBytes
+	}
+	if config.MaxResponseHeader == 0 {
+		config.MaxResponseHeader = defaultMaxResponseHeader
+	}
+	if config.MaxRequestBytes == 0 {
+		config.MaxRequestBytes = defaultMaxRequestBytes
+	}
+	if config.MaxResponseBytes == 0 {
+		config.MaxResponseBytes = defaultMaxResponseBytes
+	}
+	if config.MaxTunnelBytes == 0 {
+		config.MaxTunnelBytes = defaultMaxTunnelBytes
+	}
+	if config.MaxConcurrent == 0 {
+		config.MaxConcurrent = defaultMaxConcurrent
+	}
+	if config.ResolutionTimeout == 0 {
+		config.ResolutionTimeout = defaultResolutionTimeout
+	}
+	if config.ConnectTimeout == 0 {
+		config.ConnectTimeout = defaultConnectTimeout
+	}
+	if config.ResponseHeaderTimeout == 0 {
+		config.ResponseHeaderTimeout = defaultResponseHeaderTimeout
+	}
+	if config.ForwardTimeout == 0 {
+		config.ForwardTimeout = defaultForwardTimeout
+	}
+	if config.IdleTimeout == 0 {
+		config.IdleTimeout = defaultIdleTimeout
+	}
+	if config.TunnelTimeout == 0 {
+		config.TunnelTimeout = defaultTunnelTimeout
+	}
+}
+
+func validateProxyConfigBounds(config proxyConfig) error {
+	if config.MaxRequestHeaderBytes < 1024 || config.MaxRequestHeaderBytes > 1<<20 ||
+		config.MaxResponseHeader < 1024 || config.MaxResponseHeader > 1<<20 ||
+		config.MaxRequestBytes < 1 || config.MaxRequestBytes > 1<<30 ||
+		config.MaxResponseBytes < 1 || config.MaxResponseBytes > 1<<30 ||
+		config.MaxTunnelBytes < 1 || config.MaxTunnelBytes > 16<<30 ||
+		config.MaxConcurrent < 1 || config.MaxConcurrent > 1024 ||
+		config.ResolutionTimeout <= 0 || config.ResolutionTimeout > time.Minute ||
+		config.ConnectTimeout <= 0 || config.ConnectTimeout > time.Minute ||
+		config.ResponseHeaderTimeout <= 0 || config.ResponseHeaderTimeout > 5*time.Minute ||
+		config.ForwardTimeout <= 0 || config.ForwardTimeout > 30*time.Minute ||
+		config.IdleTimeout <= 0 || config.IdleTimeout > 5*time.Minute ||
+		config.TunnelTimeout <= 0 || config.TunnelTimeout > time.Hour {
+		return fmt.Errorf("proxy limits are invalid")
+	}
+	return nil
+}
+
+func allowedHosts(rawHosts, rawForgeAPI string) (map[string]struct{}, error) {
+	hosts := make(map[string]struct{})
+	for raw := range strings.SplitSeq(rawHosts, ",") {
+		host := strings.TrimSpace(raw)
+		if host == "" {
+			continue
+		}
+		if err := validateHostname(host); err != nil {
+			return nil, fmt.Errorf("allowed host is invalid: %w", err)
+		}
+		hosts[host] = struct{}{}
+	}
+	if strings.TrimSpace(rawForgeAPI) != "" {
+		forgeHost, err := forgeAPIHostname(rawForgeAPI)
+		if err != nil {
+			return nil, err
+		}
+		hosts[forgeHost] = struct{}{}
+	}
+	if len(hosts) == 0 {
+		return nil, fmt.Errorf("at least one allowed host is required")
+	}
+	return hosts, nil
+}
+
+func forgeAPIHostname(raw string) (string, error) {
+	if strings.TrimSpace(raw) != raw || len(raw) > 2048 {
+		return "", fmt.Errorf("forge API base URL is invalid")
+	}
+	parsed, err := url.Parse(raw)
+	if err != nil || parsed.Scheme != "https" || parsed.Host == "" || parsed.User != nil ||
+		parsed.RawQuery != "" || parsed.Fragment != "" || parsed.Opaque != "" {
+		return "", fmt.Errorf("forge API base URL is invalid")
+	}
+	if parsed.Port() != "" && parsed.Port() != "443" {
+		return "", fmt.Errorf("forge API base URL must use port 443")
+	}
+	host := parsed.Hostname()
+	if err := validateHostname(host); err != nil {
+		return "", fmt.Errorf("forge API base URL host is invalid: %w", err)
+	}
+	return host, nil
+}
+
+func validateHostname(host string) error {
+	if host == "" || len(host) > 253 || host != strings.ToLower(host) || strings.HasSuffix(host, ".") ||
+		net.ParseIP(host) != nil {
+		return fmt.Errorf("hostname must be an exact lower-case DNS name")
+	}
+	labels := strings.Split(host, ".")
+	if len(labels) < 2 {
+		return fmt.Errorf("hostname must contain at least two labels")
+	}
+	for _, label := range labels {
+		if err := validateHostnameLabel(label); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validateHostnameLabel(label string) error {
+	if label == "" || len(label) > 63 || label[0] == '-' || label[len(label)-1] == '-' {
+		return fmt.Errorf("hostname label is invalid")
+	}
+	for _, current := range label {
+		if (current < 'a' || current > 'z') && (current < '0' || current > '9') && current != '-' {
+			return fmt.Errorf("hostname label contains an unsupported character")
+		}
+	}
+	return nil
+}
+
+func sortedAddresses(addresses []netip.Addr) []netip.Addr {
+	result := append([]netip.Addr(nil), addresses...)
+	sort.Slice(result, func(left, right int) bool {
+		return result[left].Compare(result[right]) < 0
+	})
+	return result
+}
diff --git a/cmd/orka-scm-egress-proxy/main.go b/cmd/orka-scm-egress-proxy/main.go
new file mode 100644
index 000000000..7158255a3
--- /dev/null
+++ b/cmd/orka-scm-egress-proxy/main.go
@@ -0,0 +1,204 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package main
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"log"
+	"net"
+	"net/http"
+	"os"
+	"os/signal"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+)
+
+func main() {
+	listenAddress := flag.String(
+		"listen-address",
+		envDefault("ORKA_SCM_EGRESS_PROXY_LISTEN_ADDRESS", defaultListenAddress),
+		"HTTP proxy listen address",
+	)
+	allowedHostsValue := flag.String(
+		"allowed-hosts",
+		envDefault("ORKA_SCM_EGRESS_PROXY_ALLOWED_HOSTS", defaultAllowedHosts),
+		"Comma-separated exact lower-case SCM hostnames",
+	)
+	forgeAPIBaseURL := flag.String(
+		"forge-api-base-url",
+		envDefault("ORKA_SCM_EGRESS_PROXY_FORGE_API_BASE_URL", defaultForgeAPIBaseURL),
+		"Optional HTTPS forge API base URL whose exact hostname is allowed",
+	)
+	tokenFile := flag.String(
+		"token-file",
+		envDefault("ORKA_SCM_EGRESS_PROXY_TOKEN_FILE", defaultTokenFile),
+		"Publisher proxy-auth token file",
+	)
+	maxRequestHeaderBytes := flag.Int64(
+		"max-request-header-bytes",
+		envInt64Default("ORKA_SCM_EGRESS_PROXY_MAX_REQUEST_HEADER_BYTES", defaultMaxRequestHeaderBytes),
+		"Maximum request header bytes",
+	)
+	maxResponseHeaderBytes := flag.Int64(
+		"max-response-header-bytes",
+		envInt64Default("ORKA_SCM_EGRESS_PROXY_MAX_RESPONSE_HEADER_BYTES", defaultMaxResponseHeader),
+		"Maximum forward response header bytes",
+	)
+	maxRequestBytes := flag.Int64(
+		"max-request-bytes",
+		envInt64Default("ORKA_SCM_EGRESS_PROXY_MAX_REQUEST_BYTES", defaultMaxRequestBytes),
+		"Maximum forward request body bytes",
+	)
+	maxResponseBytes := flag.Int64(
+		"max-response-bytes",
+		envInt64Default("ORKA_SCM_EGRESS_PROXY_MAX_RESPONSE_BYTES", defaultMaxResponseBytes),
+		"Maximum forward response body bytes",
+	)
+	maxTunnelBytes := flag.Int64(
+		"max-tunnel-bytes",
+		envInt64Default("ORKA_SCM_EGRESS_PROXY_MAX_TUNNEL_BYTES", defaultMaxTunnelBytes),
+		"Maximum bytes in each CONNECT tunnel direction",
+	)
+	maxConcurrent := flag.Int(
+		"max-concurrent",
+		envIntDefault("ORKA_SCM_EGRESS_PROXY_MAX_CONCURRENT", defaultMaxConcurrent),
+		"Maximum concurrent requests and tunnels",
+	)
+	resolutionTimeout := flag.Duration(
+		"resolution-timeout",
+		envDurationDefault("ORKA_SCM_EGRESS_PROXY_RESOLUTION_TIMEOUT", defaultResolutionTimeout),
+		"Per-request DNS resolution timeout",
+	)
+	connectTimeout := flag.Duration(
+		"connect-timeout",
+		envDurationDefault("ORKA_SCM_EGRESS_PROXY_CONNECT_TIMEOUT", defaultConnectTimeout),
+		"Per-address TCP connection timeout",
+	)
+	responseHeaderTimeout := flag.Duration(
+		"response-header-timeout",
+		envDurationDefault("ORKA_SCM_EGRESS_PROXY_RESPONSE_HEADER_TIMEOUT", defaultResponseHeaderTimeout),
+		"Forward response header timeout",
+	)
+	forwardTimeout := flag.Duration(
+		"forward-timeout",
+		envDurationDefault("ORKA_SCM_EGRESS_PROXY_FORWARD_TIMEOUT", defaultForwardTimeout),
+		"Maximum complete forward request lifetime",
+	)
+	idleTimeout := flag.Duration(
+		"idle-timeout",
+		envDurationDefault("ORKA_SCM_EGRESS_PROXY_IDLE_TIMEOUT", defaultIdleTimeout),
+		"Connection and tunnel idle timeout",
+	)
+	tunnelTimeout := flag.Duration(
+		"tunnel-timeout",
+		envDurationDefault("ORKA_SCM_EGRESS_PROXY_TUNNEL_TIMEOUT", defaultTunnelTimeout),
+		"Maximum CONNECT tunnel lifetime",
+	)
+	shutdownTimeout := flag.Duration(
+		"shutdown-timeout",
+		envDurationDefault("ORKA_SCM_EGRESS_PROXY_SHUTDOWN_TIMEOUT", defaultShutdownTimeout),
+		"Graceful shutdown timeout",
+	)
+	flag.Parse()
+
+	if err := ensureKubernetesServiceAccountTokenAbsent(defaultKubernetesTokenFile); err != nil {
+		log.Fatal("SCM egress proxy must not have Kubernetes API credentials")
+	}
+	hosts, err := allowedHosts(*allowedHostsValue, *forgeAPIBaseURL)
+	if err != nil {
+		log.Fatal("invalid SCM egress host policy")
+	}
+	authenticator, err := loadProxyAuthenticator(strings.TrimSpace(*tokenFile))
+	if err != nil {
+		log.Fatal("SCM egress proxy authentication is unavailable")
+	}
+	proxy, err := newSCMEgressProxy(proxyConfig{
+		AllowedHosts: hosts, MaxRequestHeaderBytes: *maxRequestHeaderBytes,
+		MaxResponseHeader: *maxResponseHeaderBytes, MaxRequestBytes: *maxRequestBytes,
+		MaxResponseBytes: *maxResponseBytes, MaxTunnelBytes: *maxTunnelBytes,
+		MaxConcurrent: *maxConcurrent, ResolutionTimeout: *resolutionTimeout,
+		ConnectTimeout: *connectTimeout, ResponseHeaderTimeout: *responseHeaderTimeout,
+		ForwardTimeout: *forwardTimeout, IdleTimeout: *idleTimeout, TunnelTimeout: *tunnelTimeout,
+	}, authenticator)
+	if err != nil {
+		log.Fatal("invalid SCM egress proxy configuration")
+	}
+	listener, err := net.Listen("tcp", strings.TrimSpace(*listenAddress))
+	if err != nil {
+		log.Fatal("SCM egress proxy listener is unavailable")
+	}
+	server := &http.Server{
+		Addr: strings.TrimSpace(*listenAddress), Handler: proxy,
+		ReadHeaderTimeout: min(*idleTimeout, 10*time.Second), ReadTimeout: *idleTimeout,
+		WriteTimeout: *responseHeaderTimeout, IdleTimeout: *idleTimeout,
+		MaxHeaderBytes: int(*maxRequestHeaderBytes),
+	}
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+	serveResult := make(chan error, 1)
+	go func() { serveResult <- server.Serve(listener) }()
+	log.Printf("SCM egress proxy listening on %s", listener.Addr())
+	select {
+	case err := <-serveResult:
+		if err != nil && !errors.Is(err, http.ErrServerClosed) {
+			log.Fatal("SCM egress proxy stopped unexpectedly")
+		}
+	case <-ctx.Done():
+		shutdownContext, cancel := context.WithTimeout(context.Background(), *shutdownTimeout)
+		defer cancel()
+		if err := server.Shutdown(shutdownContext); err != nil {
+			log.Print("SCM egress proxy shutdown timed out")
+		}
+	}
+}
+
+func envDefault(name, fallback string) string {
+	if value := strings.TrimSpace(os.Getenv(name)); value != "" {
+		return value
+	}
+	return fallback
+}
+
+func envInt64Default(name string, fallback int64) int64 {
+	value := strings.TrimSpace(os.Getenv(name))
+	if value == "" {
+		return fallback
+	}
+	parsed, err := strconv.ParseInt(value, 10, 64)
+	if err != nil || strconv.FormatInt(parsed, 10) != value {
+		log.Fatalf("invalid %s", name)
+	}
+	return parsed
+}
+
+func envIntDefault(name string, fallback int) int {
+	raw := strings.TrimSpace(os.Getenv(name))
+	if raw == "" {
+		return fallback
+	}
+	value, err := strconv.Atoi(raw)
+	if err != nil || value < 1 || strconv.Itoa(value) != raw {
+		log.Fatalf("invalid %s", name)
+	}
+	return value
+}
+
+func envDurationDefault(name string, fallback time.Duration) time.Duration {
+	value := strings.TrimSpace(os.Getenv(name))
+	if value == "" {
+		return fallback
+	}
+	parsed, err := time.ParseDuration(value)
+	if err != nil {
+		log.Fatalf("invalid %s", name)
+	}
+	return parsed
+}
diff --git a/cmd/orka-scm-egress-proxy/network.go b/cmd/orka-scm-egress-proxy/network.go
new file mode 100644
index 000000000..72ed0e4ec
--- /dev/null
+++ b/cmd/orka-scm-egress-proxy/network.go
@@ -0,0 +1,162 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/netip"
+	"strconv"
+)
+
+var deniedAddressPrefixes = mustPrefixes(
+	"0.0.0.0/8",
+	"10.0.0.0/8",
+	"100.64.0.0/10",
+	"127.0.0.0/8",
+	"169.254.0.0/16",
+	"172.16.0.0/12",
+	"192.0.0.0/24",
+	"192.0.2.0/24",
+	"192.168.0.0/16",
+	"198.18.0.0/15",
+	"198.51.100.0/24",
+	"203.0.113.0/24",
+	"224.0.0.0/4",
+	"240.0.0.0/4",
+	"::/128",
+	"::1/128",
+	"64:ff9b::/96",
+	"64:ff9b:1::/48",
+	"100::/64",
+	"2001::/32",
+	"2001:db8::/32",
+	"2002::/16",
+	"fc00::/7",
+	"fe80::/10",
+	"ff00::/8",
+)
+
+func mustPrefixes(values ...string) []netip.Prefix {
+	result := make([]netip.Prefix, 0, len(values))
+	for _, value := range values {
+		result = append(result, netip.MustParsePrefix(value))
+	}
+	return result
+}
+
+func (p *scmEgressProxy) dialAllowedHost(ctx context.Context, network, address string) (net.Conn, error) {
+	host, port, err := splitTarget(address)
+	if err != nil {
+		return nil, err
+	}
+	if !p.hostAllowed(host) {
+		return nil, errHostDenied
+	}
+	resolutionContext, cancel := context.WithTimeout(ctx, p.config.ResolutionTimeout)
+	addresses, lookupErr := p.config.Resolver.LookupNetIP(resolutionContext, "ip", host)
+	cancel()
+	if lookupErr != nil || len(addresses) == 0 {
+		return nil, errResolutionFailed
+	}
+	addresses = sortedAddresses(addresses)
+	if len(addresses) > maxResolvedAddresses {
+		return nil, errResolutionFailed
+	}
+	if err := validateResolvedAddresses(addresses); err != nil {
+		return nil, err
+	}
+	connectionContext, cancel := context.WithTimeout(ctx, p.config.ConnectTimeout)
+	defer cancel()
+	return p.connectResolved(connectionContext, network, port, addresses)
+}
+
+func splitTarget(address string) (string, string, error) {
+	host, port, err := net.SplitHostPort(address)
+	if err != nil || port != "443" {
+		return "", "", errHostDenied
+	}
+	if err := validateHostname(host); err != nil {
+		return "", "", errHostDenied
+	}
+	return host, port, nil
+}
+
+func validateResolvedAddresses(addresses []netip.Addr) error {
+	for _, address := range addresses {
+		if !publicAddress(address) {
+			return errAddressDenied
+		}
+	}
+	return nil
+}
+
+func publicAddress(address netip.Addr) bool {
+	if !address.IsValid() {
+		return false
+	}
+	address = address.Unmap()
+	if !address.IsGlobalUnicast() || address.IsPrivate() || address.IsLoopback() ||
+		address.IsLinkLocalUnicast() || address.IsLinkLocalMulticast() || address.IsMulticast() ||
+		address.IsUnspecified() {
+		return false
+	}
+	for _, prefix := range deniedAddressPrefixes {
+		if prefix.Contains(address) {
+			return false
+		}
+	}
+	return true
+}
+
+func (p *scmEgressProxy) connectResolved(
+	ctx context.Context,
+	network string,
+	port string,
+	addresses []netip.Addr,
+) (net.Conn, error) {
+	var failures []error
+	for _, address := range addresses {
+		connection, err := p.config.Dialer.DialContext(
+			ctx,
+			network,
+			net.JoinHostPort(address.String(), port),
+		)
+		if err != nil {
+			failures = append(failures, err)
+			continue
+		}
+		if err := validateConnectedPeer(connection, address); err != nil {
+			_ = connection.Close()
+			return nil, err
+		}
+		return connection, nil
+	}
+	return nil, fmt.Errorf("connect to allowed target: %w", errors.Join(failures...))
+}
+
+func validateConnectedPeer(connection net.Conn, expected netip.Addr) error {
+	host, _, err := net.SplitHostPort(connection.RemoteAddr().String())
+	if err != nil {
+		return errAddressDenied
+	}
+	actual, err := netip.ParseAddr(host)
+	if err != nil {
+		return errAddressDenied
+	}
+	actual = actual.Unmap()
+	if !publicAddress(actual) || actual != expected.Unmap() {
+		return errAddressDenied
+	}
+	return nil
+}
+
+func targetAddress(host string) string {
+	return net.JoinHostPort(host, strconv.Itoa(443))
+}
diff --git a/cmd/orka-scm-egress-proxy/proxy.go b/cmd/orka-scm-egress-proxy/proxy.go
new file mode 100644
index 000000000..0b913963a
--- /dev/null
+++ b/cmd/orka-scm-egress-proxy/proxy.go
@@ -0,0 +1,505 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package main
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/textproto"
+	"net/url"
+	"strings"
+	"sync/atomic"
+	"time"
+)
+
+const (
+	healthPath    = "/healthz"
+	readinessPath = "/readyz"
+)
+
+var (
+	errRedirectDenied  = errors.New("upstream redirects are denied")
+	errTunnelLimit     = errors.New("tunnel byte limit exceeded")
+	errRequestTooLarge = errors.New("request body limit exceeded")
+)
+
+type scmEgressProxy struct {
+	config        proxyConfig
+	authenticator *proxyAuthenticator
+	client        *http.Client
+	requestSlots  chan struct{}
+}
+
+func newSCMEgressProxy(config proxyConfig, authenticator *proxyAuthenticator) (*scmEgressProxy, error) {
+	normalized, err := normalizeProxyConfig(config)
+	if err != nil {
+		return nil, err
+	}
+	if authenticator == nil {
+		return nil, fmt.Errorf("proxy authenticator is required")
+	}
+	proxy := &scmEgressProxy{
+		config: normalized, authenticator: authenticator,
+		requestSlots: make(chan struct{}, normalized.MaxConcurrent),
+	}
+	proxy.client = proxy.newForwardClient(nil)
+	return proxy, nil
+}
+
+func (p *scmEgressProxy) newForwardClient(tlsConfig *tls.Config) *http.Client {
+	transport := &http.Transport{
+		Proxy:                  nil,
+		DialContext:            p.dialAllowedHost,
+		ForceAttemptHTTP2:      false,
+		DisableKeepAlives:      true,
+		DisableCompression:     true,
+		TLSClientConfig:        tlsConfig,
+		TLSHandshakeTimeout:    p.config.ConnectTimeout,
+		ResponseHeaderTimeout:  p.config.ResponseHeaderTimeout,
+		ExpectContinueTimeout:  time.Second,
+		MaxResponseHeaderBytes: p.config.MaxResponseHeader,
+	}
+	return &http.Client{
+		Transport: transport,
+		Timeout:   p.config.ForwardTimeout,
+		CheckRedirect: func(*http.Request, []*http.Request) error {
+			return errRedirectDenied
+		},
+	}
+}
+
+func (p *scmEgressProxy) hostAllowed(host string) bool {
+	_, allowed := p.config.AllowedHosts[host]
+	return allowed
+}
+
+func (p *scmEgressProxy) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
+	if p.serveProbe(writer, request) {
+		return
+	}
+	if !p.authenticator.authorized(request) {
+		writer.Header().Set("Proxy-Authenticate", `Basic realm="orka-scm-egress"`)
+		writeProxyError(writer, http.StatusProxyAuthRequired, "proxy authentication required")
+		return
+	}
+	if requestHeaderBytes(request) > p.config.MaxRequestHeaderBytes {
+		writeProxyError(writer, http.StatusRequestHeaderFieldsTooLarge, "request headers exceed proxy limit")
+		return
+	}
+	if !tryAcquire(p.requestSlots) {
+		writeProxyError(writer, http.StatusTooManyRequests, "proxy capacity is exhausted")
+		return
+	}
+	defer releaseSlot(p.requestSlots)
+	if request.Method == http.MethodConnect {
+		p.handleConnect(writer, request)
+		return
+	}
+	p.handleForward(writer, request)
+}
+
+func (p *scmEgressProxy) serveProbe(writer http.ResponseWriter, request *http.Request) bool {
+	if request.Method != http.MethodGet || request.URL.IsAbs() {
+		return false
+	}
+	if request.URL.Path != healthPath && request.URL.Path != readinessPath {
+		return false
+	}
+	writer.Header().Set("Cache-Control", "no-store")
+	writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	writer.Header().Set("X-Content-Type-Options", "nosniff")
+	writer.WriteHeader(http.StatusOK)
+	_, _ = io.WriteString(writer, "ok\n")
+	return true
+}
+
+func (p *scmEgressProxy) handleConnect(writer http.ResponseWriter, request *http.Request) {
+	if request.ContentLength > 0 || request.TransferEncoding != nil {
+		writeProxyError(writer, http.StatusBadRequest, "CONNECT request body is forbidden")
+		return
+	}
+	host, port, err := splitTarget(request.Host)
+	if err != nil || !p.hostAllowed(host) {
+		writeProxyError(writer, http.StatusForbidden, "target is not allowed")
+		return
+	}
+	upstream, err := p.dialAllowedHost(request.Context(), "tcp", net.JoinHostPort(host, port))
+	if err != nil {
+		writeDialError(writer, err)
+		return
+	}
+	hijacker, ok := writer.(http.Hijacker)
+	if !ok {
+		_ = upstream.Close()
+		writeProxyError(writer, http.StatusInternalServerError, "CONNECT is unavailable")
+		return
+	}
+	client, buffered, err := hijacker.Hijack()
+	if err != nil {
+		_ = upstream.Close()
+		return
+	}
+	if err := client.SetDeadline(time.Time{}); err != nil {
+		_ = client.Close()
+		_ = upstream.Close()
+		return
+	}
+	if err := upstream.SetDeadline(time.Time{}); err != nil {
+		_ = client.Close()
+		_ = upstream.Close()
+		return
+	}
+	p.runTunnel(client, upstream, buffered)
+}
+
+func (p *scmEgressProxy) runTunnel(client, upstream net.Conn, buffered *bufio.ReadWriter) {
+	defer func() { _ = client.Close() }()
+	defer func() { _ = upstream.Close() }()
+	if _, err := buffered.WriteString("HTTP/1.1 200 Connection Established\r\n\r\n"); err != nil {
+		return
+	}
+	if err := buffered.Flush(); err != nil {
+		return
+	}
+	activity := newTunnelActivity()
+	clientBudget := p.config.MaxTunnelBytes
+	if buffered.Reader.Buffered() > 0 {
+		count, err := copyBuffered(upstream, buffered.Reader, clientBudget, p.config.IdleTimeout, activity)
+		if err != nil {
+			return
+		}
+		clientBudget -= count
+	}
+	p.copyTunnel(client, upstream, clientBudget, activity)
+}
+
+func copyBuffered(
+	destination net.Conn,
+	reader *bufio.Reader,
+	limit int64,
+	idleTimeout time.Duration,
+	activity *tunnelActivity,
+) (int64, error) {
+	buffered := reader.Buffered()
+	if int64(buffered) > limit {
+		return 0, errTunnelLimit
+	}
+	data := make([]byte, buffered)
+	if _, err := io.ReadFull(reader, data); err != nil {
+		return 0, err
+	}
+	deadline := &deadlineConn{Conn: destination, idleTimeout: idleTimeout, activity: activity}
+	written, err := io.CopyBuffer(deadline, bytes.NewReader(data), make([]byte, 32<<10))
+	return written, err
+}
+
+func (p *scmEgressProxy) copyTunnel(client, upstream net.Conn, clientBudget int64, activity *tunnelActivity) {
+	results := make(chan error, 2)
+	go func() {
+		err := boundedTunnelCopy(
+			&deadlineConn{Conn: upstream, idleTimeout: p.config.IdleTimeout, activity: activity},
+			&deadlineConn{Conn: client, idleTimeout: p.config.IdleTimeout, activity: activity},
+			clientBudget,
+		)
+		if err == nil {
+			// The client finished sending cleanly; propagate the half-close so
+			// the upstream response direction can keep streaming.
+			closeWriteSide(upstream)
+		}
+		results <- err
+	}()
+	go func() {
+		err := boundedTunnelCopy(
+			&deadlineConn{Conn: client, idleTimeout: p.config.IdleTimeout, activity: activity},
+			&deadlineConn{Conn: upstream, idleTimeout: p.config.IdleTimeout, activity: activity},
+			p.config.MaxTunnelBytes,
+		)
+		if err == nil {
+			closeWriteSide(client)
+		}
+		results <- err
+	}()
+	timer := time.NewTimer(p.config.TunnelTimeout)
+	defer timer.Stop()
+	// A clean EOF in one direction must not tear down an active transfer in
+	// the other, so wait for both directions unless one fails or the overall
+	// tunnel budget expires.
+	for range 2 {
+		select {
+		case err := <-results:
+			if err != nil {
+				return
+			}
+		case <-timer.C:
+			return
+		}
+	}
+}
+
+func boundedTunnelCopy(destination io.Writer, source io.Reader, limit int64) error {
+	written, err := io.CopyBuffer(destination, io.LimitReader(source, limit+1), make([]byte, 32<<10))
+	if written > limit {
+		return errTunnelLimit
+	}
+	return err
+}
+
+// tunnelActivity tracks the last byte movement across both tunnel directions
+// so idle enforcement applies to the tunnel as a whole: a quiet request
+// direction must not time out an active response direction.
+type tunnelActivity struct {
+	lastNanos atomic.Int64
+}
+
+func newTunnelActivity() *tunnelActivity {
+	activity := &tunnelActivity{}
+	activity.touch()
+	return activity
+}
+
+func (a *tunnelActivity) touch() {
+	a.lastNanos.Store(time.Now().UnixNano())
+}
+
+func (a *tunnelActivity) idleFor(idle time.Duration) bool {
+	return time.Since(time.Unix(0, a.lastNanos.Load())) >= idle
+}
+
+type writeCloser interface {
+	CloseWrite() error
+}
+
+func closeWriteSide(conn net.Conn) {
+	if half, ok := conn.(writeCloser); ok {
+		_ = half.CloseWrite()
+	}
+}
+
+type deadlineConn struct {
+	net.Conn
+	idleTimeout time.Duration
+	activity    *tunnelActivity
+}
+
+func (c *deadlineConn) Read(value []byte) (int, error) {
+	for {
+		if err := c.SetReadDeadline(time.Now().Add(c.idleTimeout)); err != nil {
+			return 0, err
+		}
+		read, err := c.Conn.Read(value)
+		if read > 0 {
+			c.activity.touch()
+		}
+		if read == 0 && isTimeoutError(err) && !c.activity.idleFor(c.idleTimeout) {
+			continue
+		}
+		return read, err
+	}
+}
+
+func (c *deadlineConn) Write(value []byte) (int, error) {
+	written := 0
+	for {
+		if err := c.SetWriteDeadline(time.Now().Add(c.idleTimeout)); err != nil {
+			return written, err
+		}
+		count, err := c.Conn.Write(value[written:])
+		written += count
+		if count > 0 {
+			c.activity.touch()
+		}
+		if written < len(value) && isTimeoutError(err) && !c.activity.idleFor(c.idleTimeout) {
+			continue
+		}
+		return written, err
+	}
+}
+
+func isTimeoutError(err error) bool {
+	var netErr net.Error
+	return errors.As(err, &netErr) && netErr.Timeout()
+}
+
+func (p *scmEgressProxy) handleForward(writer http.ResponseWriter, request *http.Request) {
+	target, err := forwardTarget(request)
+	if err != nil || !p.hostAllowed(target.Hostname()) {
+		writeProxyError(writer, http.StatusForbidden, "target is not allowed")
+		return
+	}
+	body, err := readRequestBody(request, p.config.MaxRequestBytes)
+	if err != nil {
+		status := http.StatusBadRequest
+		if errors.Is(err, errRequestTooLarge) {
+			status = http.StatusRequestEntityTooLarge
+		}
+		writeProxyError(writer, status, "request body is invalid or exceeds proxy limit")
+		return
+	}
+	outbound := outboundRequest(request, target, body)
+	response, err := p.client.Do(outbound)
+	if err != nil {
+		writeForwardError(writer, err)
+		return
+	}
+	defer func() { _ = response.Body.Close() }()
+	if response.StatusCode >= http.StatusMultipleChoices && response.StatusCode < http.StatusBadRequest {
+		writeProxyError(writer, http.StatusBadGateway, "upstream redirect is forbidden")
+		return
+	}
+	if responseHeaderBytes(response.Header) > p.config.MaxResponseHeader {
+		writeProxyError(writer, http.StatusBadGateway, "upstream response headers exceed proxy limit")
+		return
+	}
+	responseBody, err := readBounded(response.Body, p.config.MaxResponseBytes)
+	if err != nil {
+		writeProxyError(writer, http.StatusBadGateway, "upstream response exceeds proxy limit")
+		return
+	}
+	copyResponseHeaders(writer.Header(), response.Header)
+	writer.WriteHeader(response.StatusCode)
+	_, _ = writer.Write(responseBody)
+}
+
+func forwardTarget(request *http.Request) (*url.URL, error) {
+	if request.Method == http.MethodTrace || !request.URL.IsAbs() || request.URL.Scheme != "https" ||
+		request.URL.User != nil || request.URL.Fragment != "" || request.URL.Opaque != "" {
+		return nil, errHostDenied
+	}
+	if request.URL.Port() != "" && request.URL.Port() != "443" {
+		return nil, errHostDenied
+	}
+	if err := validateHostname(request.URL.Hostname()); err != nil {
+		return nil, errHostDenied
+	}
+	target := *request.URL
+	target.Host = targetAddress(target.Hostname())
+	return &target, nil
+}
+
+func readRequestBody(request *http.Request, limit int64) ([]byte, error) {
+	if request.ContentLength > limit {
+		return nil, errRequestTooLarge
+	}
+	if request.Body == nil {
+		return nil, nil
+	}
+	defer func() { _ = request.Body.Close() }()
+	return readBounded(request.Body, limit)
+}
+
+func readBounded(reader io.Reader, limit int64) ([]byte, error) {
+	data, err := io.ReadAll(io.LimitReader(reader, limit+1))
+	if err != nil {
+		return nil, err
+	}
+	if int64(len(data)) > limit {
+		return nil, errRequestTooLarge
+	}
+	return data, nil
+}
+
+func outboundRequest(request *http.Request, target *url.URL, body []byte) *http.Request {
+	outbound := request.Clone(request.Context())
+	outbound.URL = target
+	outbound.RequestURI = ""
+	outbound.Host = target.Hostname()
+	outbound.Header = request.Header.Clone()
+	stripHopByHopHeaders(outbound.Header)
+	outbound.Header.Del("Proxy-Authorization")
+	outbound.Header.Del("Content-Length")
+	outbound.Body = io.NopCloser(bytes.NewReader(body))
+	outbound.ContentLength = int64(len(body))
+	outbound.TransferEncoding = nil
+	outbound.Trailer = nil
+	return outbound
+}
+
+func stripHopByHopHeaders(header http.Header) {
+	for _, value := range header.Values("Connection") {
+		for token := range strings.SplitSeq(value, ",") {
+			header.Del(textproto.CanonicalMIMEHeaderKey(strings.TrimSpace(token)))
+		}
+	}
+	for _, name := range []string{
+		"Connection", "Keep-Alive", "Proxy-Authenticate", "Proxy-Authorization", "Proxy-Connection", "Te", "Trailer",
+		"Transfer-Encoding", "Upgrade",
+	} {
+		header.Del(name)
+	}
+}
+
+func copyResponseHeaders(destination, source http.Header) {
+	cloned := source.Clone()
+	stripHopByHopHeaders(cloned)
+	for name, values := range cloned {
+		for _, value := range values {
+			destination.Add(name, value)
+		}
+	}
+}
+
+func requestHeaderBytes(request *http.Request) int64 {
+	return int64(len(request.Method) + len(request.Host) + len(request.URL.String()) + 4 + headerBytes(request.Header))
+}
+
+func responseHeaderBytes(header http.Header) int64 { return int64(headerBytes(header)) }
+
+func headerBytes(header http.Header) int {
+	total := 0
+	for name, values := range header {
+		for _, value := range values {
+			total += len(name) + len(value) + 4
+		}
+	}
+	return total
+}
+
+func writeDialError(writer http.ResponseWriter, err error) {
+	if errors.Is(err, errHostDenied) || errors.Is(err, errAddressDenied) {
+		writeProxyError(writer, http.StatusForbidden, "target is not allowed")
+		return
+	}
+	if errors.Is(err, context.DeadlineExceeded) {
+		writeProxyError(writer, http.StatusGatewayTimeout, "target connection timed out")
+		return
+	}
+	writeProxyError(writer, http.StatusBadGateway, "target connection failed")
+}
+
+func writeForwardError(writer http.ResponseWriter, err error) {
+	if errors.Is(err, errRedirectDenied) {
+		writeProxyError(writer, http.StatusBadGateway, "upstream redirect is forbidden")
+		return
+	}
+	writeDialError(writer, err)
+}
+
+func writeProxyError(writer http.ResponseWriter, status int, message string) {
+	writer.Header().Set("Cache-Control", "no-store")
+	writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	writer.Header().Set("X-Content-Type-Options", "nosniff")
+	writer.WriteHeader(status)
+	_, _ = io.WriteString(writer, message+"\n")
+}
+
+func tryAcquire(slots chan struct{}) bool {
+	select {
+	case slots <- struct{}{}:
+		return true
+	default:
+		return false
+	}
+}
+
+func releaseSlot(slots chan struct{}) { <-slots }
diff --git a/cmd/orka-scm-egress-proxy/proxy_test.go b/cmd/orka-scm-egress-proxy/proxy_test.go
new file mode 100644
index 000000000..29aa6af1a
--- /dev/null
+++ b/cmd/orka-scm-egress-proxy/proxy_test.go
@@ -0,0 +1,585 @@
+package main
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"crypto/tls"
+	"encoding/base64"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+const testProxyToken = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_"
+
+func TestSCMEgressProxyRejectsUnlistedProviderHost(t *testing.T) {
+	var lookups atomic.Int32
+	proxy := newTestSCMProxy(t, proxyConfig{
+		AllowedHosts: map[string]struct{}{"github.com": {}},
+		Resolver: resolverFunc(func(context.Context, string, string) ([]netip.Addr, error) {
+			lookups.Add(1)
+			return []netip.Addr{netip.MustParseAddr("1.1.1.1")}, nil
+		}),
+	})
+	request := connectRequest("api.openai.com:443")
+	response := httptest.NewRecorder()
+	proxy.ServeHTTP(response, request)
+	if response.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want %d", response.Code, http.StatusForbidden)
+	}
+	if lookups.Load() != 0 {
+		t.Fatalf("DNS lookups = %d, want 0", lookups.Load())
+	}
+}
+
+func TestSCMEgressProxyRejectsPrivateAndRebindingAnswers(t *testing.T) {
+	for name, addresses := range map[string][]netip.Addr{
+		"kubernetes-service": {
+			netip.MustParseAddr("10.0.0.1"),
+		},
+		"private": {
+			netip.MustParseAddr("10.0.0.8"),
+		},
+		"loopback": {
+			netip.MustParseAddr("127.0.0.1"),
+		},
+		"metadata": {
+			netip.MustParseAddr("169.254.169.254"),
+		},
+		"mixed-public-private": {
+			netip.MustParseAddr("1.1.1.1"),
+			netip.MustParseAddr("192.168.1.7"),
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			var dials atomic.Int32
+			proxy := newTestSCMProxy(t, proxyConfig{
+				AllowedHosts: map[string]struct{}{"github.com": {}},
+				Resolver: resolverFunc(func(context.Context, string, string) ([]netip.Addr, error) {
+					return addresses, nil
+				}),
+				Dialer: dialerFunc(func(context.Context, string, string) (net.Conn, error) {
+					dials.Add(1)
+					return nil, fmt.Errorf("unexpected dial")
+				}),
+			})
+			response := httptest.NewRecorder()
+			proxy.ServeHTTP(response, connectRequest("github.com:443"))
+			if response.Code != http.StatusForbidden {
+				t.Fatalf("status = %d, want %d", response.Code, http.StatusForbidden)
+			}
+			if dials.Load() != 0 {
+				t.Fatalf("dials = %d, want 0", dials.Load())
+			}
+		})
+	}
+}
+
+func TestSCMEgressProxyAllowsAuthenticatedGitHubCONNECT(t *testing.T) {
+	upstream, upstreamAddress := startEchoServer(t)
+	defer func() { _ = upstream.Close() }()
+	publicAddress := netip.MustParseAddr("1.1.1.1")
+	proxy := newTestSCMProxy(t, proxyConfig{
+		AllowedHosts: map[string]struct{}{"github.com": {}},
+		Resolver: resolverFunc(func(_ context.Context, network, host string) ([]netip.Addr, error) {
+			if network != "ip" || host != "github.com" {
+				t.Fatalf("lookup = %s %s", network, host)
+			}
+			return []netip.Addr{publicAddress}, nil
+		}),
+		Dialer: localTestDialer(t, upstreamAddress, publicAddress),
+	})
+	server := httptest.NewServer(proxy)
+	defer server.Close()
+
+	connection, err := net.DialTimeout("tcp", strings.TrimPrefix(server.URL, "http://"), time.Second)
+	if err != nil {
+		t.Fatalf("dial proxy: %v", err)
+	}
+	defer func() { _ = connection.Close() }()
+	if _, err := fmt.Fprintf(
+		connection,
+		"CONNECT github.com:443 HTTP/1.1\r\nHost: github.com:443\r\nProxy-Authorization: %s\r\n\r\n",
+		proxyAuthorization(),
+	); err != nil {
+		t.Fatalf("write CONNECT: %v", err)
+	}
+	reader := bufio.NewReader(connection)
+	status, err := reader.ReadString('\n')
+	if err != nil {
+		t.Fatalf("read CONNECT status: %v", err)
+	}
+	if status != "HTTP/1.1 200 Connection Established\r\n" {
+		t.Fatalf("CONNECT status = %q", status)
+	}
+	for {
+		line, readErr := reader.ReadString('\n')
+		if readErr != nil {
+			t.Fatalf("read CONNECT header: %v", readErr)
+		}
+		if line == "\r\n" {
+			break
+		}
+	}
+	if _, err := connection.Write([]byte("github-connect-ok")); err != nil {
+		t.Fatalf("write tunnel payload: %v", err)
+	}
+	payload := make([]byte, len("github-connect-ok"))
+	if _, err := io.ReadFull(reader, payload); err != nil {
+		t.Fatalf("read tunnel payload: %v", err)
+	}
+	if string(payload) != "github-connect-ok" {
+		t.Fatalf("tunnel payload = %q", payload)
+	}
+}
+
+func TestSCMEgressProxyCONNECTSurvivesQuietRequestDirection(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen upstream: %v", err)
+	}
+	defer func() { _ = listener.Close() }()
+	const (
+		chunkCount = 12
+		chunkGap   = 100 * time.Millisecond
+	)
+	chunk := bytes.Repeat([]byte("x"), 1024)
+	go func() {
+		connection, acceptErr := listener.Accept()
+		if acceptErr != nil {
+			return
+		}
+		defer func() { _ = connection.Close() }()
+		request := make([]byte, 4)
+		if _, readErr := io.ReadFull(connection, request); readErr != nil {
+			return
+		}
+		for range chunkCount {
+			if _, writeErr := connection.Write(chunk); writeErr != nil {
+				return
+			}
+			time.Sleep(chunkGap)
+		}
+	}()
+	publicAddress := netip.MustParseAddr("1.1.1.1")
+	proxy := newTestSCMProxy(t, proxyConfig{
+		AllowedHosts: map[string]struct{}{"github.com": {}},
+		// The response stream outlives the idle timeout, so the quiet request
+		// direction hits its read deadline repeatedly while the response
+		// direction is still moving bytes.
+		IdleTimeout: 500 * time.Millisecond,
+		Resolver: resolverFunc(func(context.Context, string, string) ([]netip.Addr, error) {
+			return []netip.Addr{publicAddress}, nil
+		}),
+		Dialer: localTestDialer(t, listener.Addr().String(), publicAddress),
+	})
+	server := httptest.NewServer(proxy)
+	defer server.Close()
+
+	connection, reader := openTestCONNECTTunnel(t, server.URL)
+	if err := connection.SetReadDeadline(time.Now().Add(30 * time.Second)); err != nil {
+		t.Fatalf("set read deadline: %v", err)
+	}
+	if _, err := connection.Write([]byte("ping")); err != nil {
+		t.Fatalf("write tunnel payload: %v", err)
+	}
+	payload := make([]byte, chunkCount*len(chunk))
+	if _, err := io.ReadFull(reader, payload); err != nil {
+		t.Fatalf("read streamed payload: %v", err)
+	}
+}
+
+func TestSCMEgressProxyCONNECTHalfCloseKeepsResponseStreaming(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen upstream: %v", err)
+	}
+	defer func() { _ = listener.Close() }()
+	payload := bytes.Repeat([]byte("y"), 64<<10)
+	go func() {
+		connection, acceptErr := listener.Accept()
+		if acceptErr != nil {
+			return
+		}
+		defer func() { _ = connection.Close() }()
+		// The upstream only responds after the request direction is fully
+		// drained to EOF, which requires the proxy to propagate the client
+		// half-close instead of tearing the tunnel down.
+		if _, copyErr := io.Copy(io.Discard, connection); copyErr != nil {
+			return
+		}
+		_, _ = connection.Write(payload)
+	}()
+	publicAddress := netip.MustParseAddr("1.1.1.1")
+	proxy := newTestSCMProxy(t, proxyConfig{
+		AllowedHosts: map[string]struct{}{"github.com": {}},
+		IdleTimeout:  2 * time.Second,
+		Resolver: resolverFunc(func(context.Context, string, string) ([]netip.Addr, error) {
+			return []netip.Addr{publicAddress}, nil
+		}),
+		Dialer: localTestDialer(t, listener.Addr().String(), publicAddress),
+	})
+	server := httptest.NewServer(proxy)
+	defer server.Close()
+
+	connection, reader := openTestCONNECTTunnel(t, server.URL)
+	if err := connection.SetReadDeadline(time.Now().Add(30 * time.Second)); err != nil {
+		t.Fatalf("set read deadline: %v", err)
+	}
+	if _, err := connection.Write([]byte("ping")); err != nil {
+		t.Fatalf("write tunnel payload: %v", err)
+	}
+	tcpConnection, ok := connection.(*net.TCPConn)
+	if !ok {
+		t.Fatalf("connection type = %T, want *net.TCPConn", connection)
+	}
+	if err := tcpConnection.CloseWrite(); err != nil {
+		t.Fatalf("half-close tunnel: %v", err)
+	}
+	received := make([]byte, len(payload))
+	if _, err := io.ReadFull(reader, received); err != nil {
+		t.Fatalf("read payload after half-close: %v", err)
+	}
+	if !bytes.Equal(received, payload) {
+		t.Fatal("payload mismatch after half-close")
+	}
+}
+
+func openTestCONNECTTunnel(t *testing.T, proxyURL string) (net.Conn, *bufio.Reader) {
+	t.Helper()
+	connection, err := net.DialTimeout("tcp", strings.TrimPrefix(proxyURL, "http://"), time.Second)
+	if err != nil {
+		t.Fatalf("dial proxy: %v", err)
+	}
+	t.Cleanup(func() { _ = connection.Close() })
+	if _, err := fmt.Fprintf(
+		connection,
+		"CONNECT github.com:443 HTTP/1.1\r\nHost: github.com:443\r\nProxy-Authorization: %s\r\n\r\n",
+		proxyAuthorization(),
+	); err != nil {
+		t.Fatalf("write CONNECT: %v", err)
+	}
+	reader := bufio.NewReader(connection)
+	status, err := reader.ReadString('\n')
+	if err != nil {
+		t.Fatalf("read CONNECT status: %v", err)
+	}
+	if status != "HTTP/1.1 200 Connection Established\r\n" {
+		t.Fatalf("CONNECT status = %q", status)
+	}
+	for {
+		line, readErr := reader.ReadString('\n')
+		if readErr != nil {
+			t.Fatalf("read CONNECT header: %v", readErr)
+		}
+		if line == "\r\n" {
+			break
+		}
+	}
+	return connection, reader
+}
+
+func TestSCMEgressProxyRejectsRedirect(t *testing.T) {
+	upstream := httptest.NewTLSServer(http.HandlerFunc(func(writer http.ResponseWriter, _ *http.Request) {
+		writer.Header().Set("Location", "https://github.com/redirected")
+		writer.WriteHeader(http.StatusFound)
+	}))
+	defer upstream.Close()
+	proxy := testForwardProxy(t, upstream, 1024, 1024)
+	request := httptest.NewRequest(http.MethodGet, "https://github.com/start", nil)
+	request.Header.Set("Proxy-Authorization", proxyAuthorization())
+	response := httptest.NewRecorder()
+	proxy.ServeHTTP(response, request)
+	if response.Code != http.StatusBadGateway {
+		t.Fatalf("status = %d, want %d", response.Code, http.StatusBadGateway)
+	}
+}
+
+func TestSCMEgressProxyRejectsOversizedHeaders(t *testing.T) {
+	proxy := newTestSCMProxy(t, proxyConfig{
+		AllowedHosts:          map[string]struct{}{"github.com": {}},
+		MaxRequestHeaderBytes: 1024,
+	})
+	request := connectRequest("github.com:443")
+	request.Header.Set("X-Oversized", strings.Repeat("x", 2048))
+	response := httptest.NewRecorder()
+	proxy.ServeHTTP(response, request)
+	if response.Code != http.StatusRequestHeaderFieldsTooLarge {
+		t.Fatalf("status = %d, want %d", response.Code, http.StatusRequestHeaderFieldsTooLarge)
+	}
+}
+
+func TestSCMEgressProxyRejectsOversizedRequestsAndResponses(t *testing.T) {
+	t.Run("known request", func(t *testing.T) {
+		var lookups atomic.Int32
+		proxy := newTestSCMProxy(t, proxyConfig{
+			AllowedHosts:    map[string]struct{}{"github.com": {}},
+			MaxRequestBytes: 4,
+			Resolver: resolverFunc(func(context.Context, string, string) ([]netip.Addr, error) {
+				lookups.Add(1)
+				return []netip.Addr{netip.MustParseAddr("1.1.1.1")}, nil
+			}),
+		})
+		request := httptest.NewRequest(http.MethodPost, "https://github.com/upload", strings.NewReader("12345"))
+		request.Header.Set("Proxy-Authorization", proxyAuthorization())
+		response := httptest.NewRecorder()
+		proxy.ServeHTTP(response, request)
+		if response.Code != http.StatusRequestEntityTooLarge {
+			t.Fatalf("status = %d, want %d", response.Code, http.StatusRequestEntityTooLarge)
+		}
+		if lookups.Load() != 0 {
+			t.Fatalf("DNS lookups = %d, want 0", lookups.Load())
+		}
+	})
+
+	t.Run("streamed request", func(t *testing.T) {
+		proxy := newTestSCMProxy(t, proxyConfig{
+			AllowedHosts:    map[string]struct{}{"github.com": {}},
+			MaxRequestBytes: 4,
+		})
+		request := httptest.NewRequest(http.MethodPost, "https://github.com/upload", strings.NewReader("12345"))
+		request.ContentLength = -1
+		request.Header.Set("Proxy-Authorization", proxyAuthorization())
+		response := httptest.NewRecorder()
+		proxy.ServeHTTP(response, request)
+		if response.Code != http.StatusRequestEntityTooLarge {
+			t.Fatalf("status = %d, want %d", response.Code, http.StatusRequestEntityTooLarge)
+		}
+	})
+
+	t.Run("response", func(t *testing.T) {
+		upstream := httptest.NewTLSServer(http.HandlerFunc(func(writer http.ResponseWriter, _ *http.Request) {
+			_, _ = io.WriteString(writer, "12345")
+		}))
+		defer upstream.Close()
+		proxy := testForwardProxy(t, upstream, 1024, 4)
+		request := httptest.NewRequest(http.MethodGet, "https://github.com/download", nil)
+		request.Header.Set("Proxy-Authorization", proxyAuthorization())
+		response := httptest.NewRecorder()
+		proxy.ServeHTTP(response, request)
+		if response.Code != http.StatusBadGateway {
+			t.Fatalf("status = %d, want %d", response.Code, http.StatusBadGateway)
+		}
+	})
+}
+
+func TestSCMEgressProxyRejectsPlainHTTPAndNon443Targets(t *testing.T) {
+	proxy := newTestSCMProxy(t, proxyConfig{AllowedHosts: map[string]struct{}{"github.com": {}}})
+
+	plainRequest := httptest.NewRequest(http.MethodGet, "http://github.com/repository", nil)
+	plainRequest.Header.Set("Proxy-Authorization", proxyAuthorization())
+	plainResponse := httptest.NewRecorder()
+	proxy.ServeHTTP(plainResponse, plainRequest)
+	if plainResponse.Code != http.StatusForbidden {
+		t.Fatalf("plain HTTP status = %d, want %d", plainResponse.Code, http.StatusForbidden)
+	}
+
+	connectResponse := httptest.NewRecorder()
+	proxy.ServeHTTP(connectResponse, connectRequest("github.com:8443"))
+	if connectResponse.Code != http.StatusForbidden {
+		t.Fatalf("non-443 CONNECT status = %d, want %d", connectResponse.Code, http.StatusForbidden)
+	}
+}
+
+func TestSCMEgressProxyRejectsConnectedPeerMismatch(t *testing.T) {
+	listener, localAddress := startEchoServer(t)
+	defer func() { _ = listener.Close() }()
+	resolved := netip.MustParseAddr("1.1.1.1")
+	mismatched := netip.MustParseAddr("8.8.8.8")
+	proxy := newTestSCMProxy(t, proxyConfig{
+		AllowedHosts: map[string]struct{}{"github.com": {}},
+		Resolver: resolverFunc(func(context.Context, string, string) ([]netip.Addr, error) {
+			return []netip.Addr{resolved}, nil
+		}),
+		Dialer: dialerFunc(func(ctx context.Context, network, address string) (net.Conn, error) {
+			if network != "tcp" || address != net.JoinHostPort(resolved.String(), "443") {
+				t.Fatalf("dial = %s %s", network, address)
+			}
+			dialer := net.Dialer{}
+			connection, err := dialer.DialContext(ctx, "tcp", localAddress)
+			if err != nil {
+				return nil, err
+			}
+			return &remoteAddressConn{
+				Conn: connection,
+				remote: &net.TCPAddr{
+					IP: net.ParseIP(mismatched.String()), Port: 443,
+				},
+			}, nil
+		}),
+	})
+	response := httptest.NewRecorder()
+	proxy.ServeHTTP(response, connectRequest("github.com:443"))
+	if response.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want %d", response.Code, http.StatusForbidden)
+	}
+}
+
+func TestSCMEgressProxyRequiresAuthentication(t *testing.T) {
+	proxy := newTestSCMProxy(t, proxyConfig{AllowedHosts: map[string]struct{}{"github.com": {}}})
+	request := connectRequest("github.com:443")
+	request.Header.Del("Proxy-Authorization")
+	response := httptest.NewRecorder()
+	proxy.ServeHTTP(response, request)
+	if response.Code != http.StatusProxyAuthRequired {
+		t.Fatalf("status = %d, want %d", response.Code, http.StatusProxyAuthRequired)
+	}
+}
+
+func TestSCMEgressProxyRejectsMountedKubernetesServiceAccountToken(t *testing.T) {
+	missing := filepath.Join(t.TempDir(), "missing-token")
+	if err := ensureKubernetesServiceAccountTokenAbsent(missing); err != nil {
+		t.Fatalf("missing Kubernetes token rejected: %v", err)
+	}
+
+	mounted := filepath.Join(t.TempDir(), "token")
+	if err := os.WriteFile(mounted, []byte("not-a-real-token"), 0o600); err != nil {
+		t.Fatalf("write mounted Kubernetes token fixture: %v", err)
+	}
+	if err := ensureKubernetesServiceAccountTokenAbsent(mounted); err == nil {
+		t.Fatal("mounted Kubernetes service-account token was accepted")
+	}
+}
+
+func TestAllowedHostsRequireExactLowercaseDNSNames(t *testing.T) {
+	for _, value := range []string{"GitHub.com", "github.com.", "127.0.0.1", "*.github.com", "github"} {
+		t.Run(value, func(t *testing.T) {
+			if _, err := allowedHosts(value, ""); err == nil {
+				t.Fatal("allowedHosts accepted unsafe host")
+			}
+		})
+	}
+	hosts, err := allowedHosts("github.com", "https://api.github.com")
+	if err != nil {
+		t.Fatalf("allowedHosts: %v", err)
+	}
+	for _, host := range []string{"github.com", "api.github.com"} {
+		if _, ok := hosts[host]; !ok {
+			t.Fatalf("host %q was not allowed", host)
+		}
+	}
+}
+
+func newTestSCMProxy(t *testing.T, config proxyConfig) *scmEgressProxy {
+	t.Helper()
+	authenticator, err := newProxyAuthenticator([]byte(testProxyToken))
+	if err != nil {
+		t.Fatalf("new authenticator: %v", err)
+	}
+	proxy, err := newSCMEgressProxy(config, authenticator)
+	if err != nil {
+		t.Fatalf("new proxy: %v", err)
+	}
+	return proxy
+}
+
+func connectRequest(target string) *http.Request {
+	request := httptest.NewRequest(http.MethodConnect, "http://proxy.invalid", nil)
+	request.Host = target
+	request.Header.Set("Proxy-Authorization", proxyAuthorization())
+	return request
+}
+
+func proxyAuthorization() string {
+	return "Basic " + base64.StdEncoding.EncodeToString([]byte(proxyUsername+":"+testProxyToken))
+}
+
+type resolverFunc func(context.Context, string, string) ([]netip.Addr, error)
+
+func (function resolverFunc) LookupNetIP(
+	ctx context.Context,
+	network string,
+	host string,
+) ([]netip.Addr, error) {
+	return function(ctx, network, host)
+}
+
+type dialerFunc func(context.Context, string, string) (net.Conn, error)
+
+func (function dialerFunc) DialContext(ctx context.Context, network, address string) (net.Conn, error) {
+	return function(ctx, network, address)
+}
+
+type remoteAddressConn struct {
+	net.Conn
+	remote net.Addr
+}
+
+func (connection *remoteAddressConn) RemoteAddr() net.Addr { return connection.remote }
+
+func (connection *remoteAddressConn) CloseWrite() error {
+	if half, ok := connection.Conn.(writeCloser); ok {
+		return half.CloseWrite()
+	}
+	return nil
+}
+
+func localTestDialer(t *testing.T, localAddress string, publicAddress netip.Addr) dialerFunc {
+	t.Helper()
+	return func(ctx context.Context, network, address string) (net.Conn, error) {
+		if network != "tcp" || address != net.JoinHostPort(publicAddress.String(), "443") {
+			t.Fatalf("dial = %s %s", network, address)
+		}
+		dialer := net.Dialer{}
+		connection, err := dialer.DialContext(ctx, "tcp", localAddress)
+		if err != nil {
+			return nil, err
+		}
+		return &remoteAddressConn{
+			Conn: connection,
+			remote: &net.TCPAddr{
+				IP:   net.ParseIP(publicAddress.String()),
+				Port: 443,
+			},
+		}, nil
+	}
+}
+
+func testForwardProxy(
+	t *testing.T,
+	upstream *httptest.Server,
+	maxRequestBytes int64,
+	maxResponseBytes int64,
+) *scmEgressProxy {
+	t.Helper()
+	upstreamAddress := strings.TrimPrefix(upstream.URL, "https://")
+	publicAddress := netip.MustParseAddr("1.1.1.1")
+	proxy := newTestSCMProxy(t, proxyConfig{
+		AllowedHosts:     map[string]struct{}{"github.com": {}},
+		MaxRequestBytes:  maxRequestBytes,
+		MaxResponseBytes: maxResponseBytes,
+		Resolver: resolverFunc(func(context.Context, string, string) ([]netip.Addr, error) {
+			return []netip.Addr{publicAddress}, nil
+		}),
+		Dialer: localTestDialer(t, upstreamAddress, publicAddress),
+	})
+	proxy.client = proxy.newForwardClient(&tls.Config{InsecureSkipVerify: true}) //nolint:gosec // test-only TLS server
+	return proxy
+}
+
+func startEchoServer(t *testing.T) (net.Listener, string) {
+	t.Helper()
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen upstream: %v", err)
+	}
+	go func() {
+		connection, acceptErr := listener.Accept()
+		if acceptErr != nil {
+			return
+		}
+		defer func() { _ = connection.Close() }()
+		_, _ = io.Copy(connection, connection)
+	}()
+	return listener, listener.Addr().String()
+}
diff --git a/cmd/orka-workspace-agent/main_test.go b/cmd/orka-workspace-agent/main_test.go
index fccee07e0..0cd00b9f4 100644
--- a/cmd/orka-workspace-agent/main_test.go
+++ b/cmd/orka-workspace-agent/main_test.go
@@ -1880,7 +1880,22 @@ func TestWorkspaceAgentBoundsRetainedOperationResults(t *testing.T) {
 	); !errors.Is(err, errOperationResultExpired) {
 		t.Fatalf("expired operation retry error = %v, want %v", err, errOperationResultExpired)
 	}
-	newRequest := execRequest{OperationID: "after-result-expiry", Command: []string{"true"}}
+	releasePath := filepath.Join(t.TempDir(), "release-after-tombstone-eviction")
+	t.Cleanup(func() {
+		_ = os.WriteFile(releasePath, nil, 0o600)
+		server.mu.Lock()
+		cancel := server.executionCancels["after-result-expiry"]
+		server.mu.Unlock()
+		if cancel != nil {
+			cancel()
+		}
+	})
+	newRequest := execRequest{
+		OperationID: "after-result-expiry",
+		Command: []string{
+			"sh", "-c", `while [ ! -e "$1" ]; do sleep 0.01; done`, "sh", releasePath,
+		},
+	}
 	if _, err := server.startExecution(newRequest, normalized, 1); err != nil {
 		t.Fatalf("new operation rejected by tombstones: %v", err)
 	}
@@ -1893,6 +1908,29 @@ func TestWorkspaceAgentBoundsRetainedOperationResults(t *testing.T) {
 	if remainingTombstones != 0 {
 		t.Fatalf("expired tombstones retained = %d", remainingTombstones)
 	}
+	if err := os.WriteFile(releasePath, nil, 0o600); err != nil {
+		t.Fatalf("release operation after tombstone eviction: %v", err)
+	}
+	deadline := time.Now().Add(3 * time.Second)
+	for {
+		result, found, conflict, expired := server.loadExecution(newRequest.OperationID, 1)
+		if conflict || expired || !found {
+			t.Fatalf(
+				"released operation unavailable: found=%t conflict=%t expired=%t",
+				found, conflict, expired,
+			)
+		}
+		if !result.Running {
+			if result.State != workspaceagent.OperationStateSucceeded {
+				t.Fatalf("released operation state = %q, want %q", result.State, workspaceagent.OperationStateSucceeded)
+			}
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("released operation did not complete")
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
 	if _, err := server.startExecution(request, normalized, 1); !errors.Is(err, errOperationResultExpired) {
 		t.Fatalf("operation ownership expired within active epoch: %v", err)
 	}
diff --git a/cmd/orka-workspace-publisher/main.go b/cmd/orka-workspace-publisher/main.go
new file mode 100644
index 000000000..7eb8bb94c
--- /dev/null
+++ b/cmd/orka-workspace-publisher/main.go
@@ -0,0 +1,49 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"net/http"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	publisherservice "github.com/orka-agents/orka/internal/publisher/service"
+)
+
+func main() {
+	logger := slog.New(slog.NewJSONHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelInfo}))
+	setPrivateUmask()
+	config, err := publisherservice.LoadConfigFromEnv()
+	if err != nil {
+		logger.Error("invalid workspace publisher configuration", "error", err)
+		os.Exit(1)
+	}
+	server, err := publisherservice.New(config)
+	if err != nil {
+		logger.Error("create workspace publisher", "error", err)
+		os.Exit(1)
+	}
+	httpServer := &http.Server{
+		Addr: config.ListenAddress, Handler: server.Handler(),
+		ReadHeaderTimeout: 10 * time.Second, ReadTimeout: 3 * time.Minute,
+		WriteTimeout: 3 * time.Minute, IdleTimeout: 2 * time.Minute, MaxHeaderBytes: 32 << 10,
+	}
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
+	defer stop()
+	go func() {
+		<-ctx.Done()
+		shutdownCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+		defer cancel()
+		if err := httpServer.Shutdown(shutdownCtx); err != nil {
+			logger.Error("workspace publisher shutdown failed", "error", err)
+		}
+	}()
+	server.LogStartup(logger)
+	if err := httpServer.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
+		logger.Error("workspace publisher failed", "error", err)
+		os.Exit(1)
+	}
+}
diff --git a/cmd/orka-workspace-publisher/umask_other.go b/cmd/orka-workspace-publisher/umask_other.go
new file mode 100644
index 000000000..af1ae8d66
--- /dev/null
+++ b/cmd/orka-workspace-publisher/umask_other.go
@@ -0,0 +1,5 @@
+//go:build !unix
+
+package main
+
+func setPrivateUmask() {}
diff --git a/cmd/orka-workspace-publisher/umask_unix.go b/cmd/orka-workspace-publisher/umask_unix.go
new file mode 100644
index 000000000..51259812c
--- /dev/null
+++ b/cmd/orka-workspace-publisher/umask_unix.go
@@ -0,0 +1,9 @@
+//go:build unix
+
+package main
+
+import "syscall"
+
+func setPrivateUmask() {
+	_ = syscall.Umask(0o077)
+}
diff --git a/config/acp-production/README.md b/config/acp-production/README.md
new file mode 100644
index 000000000..3ee3330d2
--- /dev/null
+++ b/config/acp-production/README.md
@@ -0,0 +1,46 @@
+# ACP harness-v2 production overlay
+
+This is the canonical direct-Kustomize deployment surface for one static
+`harness-v2` Orka installation. It includes the cross-namespace Vekil ingress
+policy and renders controller, provider proxy, SCM proxy, and
+Workspace/Publisher images by immutable digest. It never deploys the harness
+v1 wrapper and cannot adopt or continue work from a v1 installation.
+
+The checked-in all-zero digests are intentional fail-closed placeholders. Use
+`make deploy` with digest-pinned `IMG`, `WORKSPACE_PUBLISHER_IMG`,
+`ACP_CODEX_RUNTIME_IMG`, `ACP_CLAUDE_RUNTIME_IMG`,
+`ACP_COPILOT_RUNTIME_IMG`, and `ACP_OPENCODE_RUNTIME_IMG`, or replace all four
+runtime entries in `runtime-images.env` before applying. Never deploy a rendered
+all-zero placeholder.
+
+The production overlay intentionally excludes CRDs. Apply the reviewed shared
+v1/v2-compatible CRD bundle through one designated cluster-level owner before
+the workload wave; fresh clusters may use `make install`. Every other Orka
+release on the cluster must leave CRD ownership with that owner. `make deploy`
+verifies the required live schema before applying only workload resources.
+
+The controller requires a non-empty watched namespace labeled
+`orka.ai/controller-mode: harness-v2`. Its leader-election Lease, SQLite store,
+ServiceAccount, API Service, Secrets, and runtime namespace belong only to this
+installation. Do not point it at a namespace watched by a `harness-v1`
+controller, reuse a v1 PVC, or change the namespace label in place.
+
+This overlay is also not an adoption path for a pre-static controller that
+implicitly enabled ACP. `scripts/apply-acp-production.sh` inspects the live
+namespace and any existing controller before its first write. An existing
+namespace must already claim static `harness-v2`; any live controller must also
+declare that mode and the `orka-system` watch namespace. A missing controller
+is recoverable only under that retained namespace claim. Settle or retire older
+installations and deploy this overlay as a fresh installation and namespace.
+
+This overlay deploys the replicated `orka-admission` runtime but not the
+cluster-scoped `ValidatingWebhookConfiguration`. Provision
+`orka-system/orka-admission-tls` first, wait for both admission endpoints, and
+smoke-test every retained handler before the designated cluster admission
+owner applies `config/orka-admission-webhooks`. A shared admission owner must
+configure every isolated controller ServiceAccount as an exact trusted
+username; individual releases must not race to own the webhook configuration.
+
+For same-cluster v1/v2 operation, deploy v1 as a separate release with a
+different release namespace, watched namespace, endpoint, RBAC, storage, and
+data plane. See `docs/harness-v1-v2-coexistence-plan.md`.
diff --git a/config/acp-production/kustomization.yaml b/config/acp-production/kustomization.yaml
new file mode 100644
index 000000000..3c845c98b
--- /dev/null
+++ b/config/acp-production/kustomization.yaml
@@ -0,0 +1,31 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+# Canonical production ACP overlay. The nested ACP workload base applies the
+# orka-system namespace, while the Vekil ingress policy deliberately retains
+# its explicit vekil-system namespace.
+resources:
+  - ../acp-workload
+  # Runtime resources only. The fail-closed webhook base is applied after TLS,
+  # endpoint, and handler-smoke checks.
+  - ../orka-admission
+  - ../vekil-ingress
+configMapGenerator:
+  - name: acp-runtime-images
+    namespace: orka-system
+    envs:
+      - runtime-images.env
+generatorOptions:
+  labels:
+    orka.ai/acp-runtime-images: "true"
+# Fail-closed placeholders: direct rendering is immutable but not runnable
+# until an operator replaces all four runtime digests (make deploy does this atomically).
+images:
+  - name: controller
+    newName: docker.io/sozercan/orka
+    digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+  - name: ghcr.io/orka-agents/orka
+    newName: docker.io/sozercan/orka
+    digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+  - name: docker.io/sozercan/orka-workspace-publisher
+    newName: docker.io/sozercan/orka-workspace-publisher
+    digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
diff --git a/config/acp-production/runtime-images.env b/config/acp-production/runtime-images.env
new file mode 100644
index 000000000..873bacd63
--- /dev/null
+++ b/config/acp-production/runtime-images.env
@@ -0,0 +1,7 @@
+# Fail-closed placeholders. `make deploy` renders a temporary overlay with
+# immutable runtime references; Kustomize hashes this ConfigMap generation and
+# rewrites the controller's configMapKeyRef so every change rolls the Pod.
+ORKA_ACP_CODEX_RUNTIME_IMAGE=docker.io/sozercan/orka-acp-codex@sha256:0000000000000000000000000000000000000000000000000000000000000000
+ORKA_ACP_CLAUDE_RUNTIME_IMAGE=docker.io/sozercan/orka-acp-claude@sha256:0000000000000000000000000000000000000000000000000000000000000000
+ORKA_ACP_COPILOT_RUNTIME_IMAGE=docker.io/sozercan/orka-acp-copilot@sha256:0000000000000000000000000000000000000000000000000000000000000000
+ORKA_ACP_OPENCODE_RUNTIME_IMAGE=docker.io/sozercan/orka-acp-opencode@sha256:0000000000000000000000000000000000000000000000000000000000000000
diff --git a/config/acp-workload/README.md b/config/acp-workload/README.md
new file mode 100644
index 000000000..266b1e73e
--- /dev/null
+++ b/config/acp-workload/README.md
@@ -0,0 +1,33 @@
+# ACP harness-v2 workload base
+
+This Kustomize base deploys one static `harness-v2` Orka controller, worker
+RBAC, ACP runtime broker proxies, and the clean-room workspace publisher
+without installing CRDs. It does not contain the harness v1 wrapper or a
+cross-protocol fallback.
+
+Before applying it directly, create the required Secrets in `orka-system`:
+
+- `acp-artifact-capability` with `capability-secret`
+- `agent-execution-snapshot-key` with `snapshot-key` containing exactly 32 raw
+  bytes or their base64 encoding
+- `workspace-publisher-auth` with `controller-token` and `operation-capability-secret`
+- `provider-auth-proxy` with `token`
+- `scm-egress-proxy-auth` with `token`
+
+The base claims `orka-system` with `orka.ai/controller-mode: harness-v2` and
+starts the controller with `--controller-mode=harness-v2` and
+`--watch-namespace=orka-system`. An overlay that chooses a different namespace
+must patch the namespace claim and watch argument together before the first
+installation. Never retarget an existing installation or change its mode
+claim in place. Use a dedicated controller namespace, ServiceAccount, Lease,
+store, and runtime namespace for this installation.
+
+Use `config/acp-production` or `make deploy` for the supported digest-pinned
+production flow. That path creates missing Secrets without printing their values,
+renders immutable controller, runtime, and publisher image references, and
+applies the namespace and generated runtime-image ConfigMap before dependent
+workloads.
+
+CRDs are shared across every Orka release on a cluster. Apply the compatible
+CRD bundle through one designated owner; this workload base must not compete
+with another release for CRD or cluster-scoped admission ownership.
diff --git a/config/acp-workload/api_service.yaml b/config/acp-workload/api_service.yaml
new file mode 100644
index 000000000..e6cb85bd9
--- /dev/null
+++ b/config/acp-workload/api_service.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    control-plane: controller-manager
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/managed-by: kustomize
+  name: api
+  namespace: system
+spec:
+  ports:
+  - name: http
+    port: 8080
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    control-plane: controller-manager
+    app.kubernetes.io/name: orka
diff --git a/config/acp-workload/kustomization.yaml b/config/acp-workload/kustomization.yaml
new file mode 100644
index 000000000..56a44d490
--- /dev/null
+++ b/config/acp-workload/kustomization.yaml
@@ -0,0 +1,174 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namePrefix: orka-
+configurations:
+  - kustomizeconfig.yaml
+resources:
+  - ../rbac
+  - ../manager
+  - ../publisher
+  - ../provider-proxy
+  - ../scm-egress-proxy
+  - ../admission
+  - ../policy
+  - runtime_namespace.yaml
+  - runtime_rbac.yaml
+  - v2_controller_cluster_role.yaml
+  - metrics_service.yaml
+  - api_service.yaml
+patches:
+  - path: manager_metrics_patch.yaml
+    target:
+      kind: Deployment
+      name: controller-manager
+  - path: namespace_name_patch.yaml
+    target:
+      kind: Namespace
+      name: system
+replacements:
+- source:
+    group: ""
+    version: v1
+    kind: Namespace
+    name: system
+    fieldPath: metadata.name
+  targets:
+  - select:
+      group: ""
+      version: v1
+      kind: ServiceAccount
+      namespace: system
+    fieldPaths:
+    - metadata.namespace
+  - select:
+      group: rbac.authorization.k8s.io
+      version: v1
+      kind: Role
+      namespace: system
+    fieldPaths:
+    - metadata.namespace
+  - select:
+      group: rbac.authorization.k8s.io
+      version: v1
+      kind: RoleBinding
+      namespace: system
+    fieldPaths:
+    - metadata.namespace
+  - select:
+      group: apps
+      version: v1
+      kind: Deployment
+      namespace: system
+    fieldPaths:
+    - metadata.namespace
+  - select:
+      group: networking.k8s.io
+      version: v1
+      kind: NetworkPolicy
+      namespace: system
+    fieldPaths:
+    - metadata.namespace
+  - select:
+      group: ""
+      version: v1
+      kind: PersistentVolumeClaim
+      namespace: system
+    fieldPaths:
+    - metadata.namespace
+  - select:
+      group: ""
+      version: v1
+      kind: Service
+      namespace: system
+    fieldPaths:
+    - metadata.namespace
+  - select:
+      group: rbac.authorization.k8s.io
+      version: v1
+      kind: RoleBinding
+    fieldPaths:
+    - subjects.0.namespace
+  - select:
+      group: rbac.authorization.k8s.io
+      version: v1
+      kind: ClusterRoleBinding
+    fieldPaths:
+    - subjects.0.namespace
+  - select:
+      group: admissionregistration.k8s.io
+      version: v1
+      kind: ValidatingAdmissionPolicy
+      name: gateway-task-protection
+    fieldPaths:
+    - spec.variables.[name=controllerNamespace].expression
+    options:
+      delimiter: "'"
+      index: 1
+- source:
+    group: ""
+    version: v1
+    kind: ServiceAccount
+    name: controller-manager
+    fieldPath: metadata.name
+  targets:
+  - select:
+      group: admissionregistration.k8s.io
+      version: v1
+      kind: ValidatingAdmissionPolicy
+      name: gateway-task-protection
+    fieldPaths:
+    - spec.variables.[name=controllerServiceAccount].expression
+    options:
+      delimiter: "'"
+      index: 1
+- source:
+    group: ""
+    version: v1
+    kind: ServiceAccount
+    name: ai-worker
+    fieldPath: metadata.name
+  targets:
+  - select:
+      group: admissionregistration.k8s.io
+      version: v1
+      kind: ValidatingAdmissionPolicy
+      name: gateway-task-protection
+    fieldPaths:
+    - spec.variables.[name=aiWorkerServiceAccount].expression
+    options:
+      delimiter: "'"
+      index: 1
+- source:
+    group: ""
+    version: v1
+    kind: ServiceAccount
+    name: vendor-worker
+    fieldPath: metadata.name
+  targets:
+  - select:
+      group: admissionregistration.k8s.io
+      version: v1
+      kind: ValidatingAdmissionPolicy
+      name: gateway-task-protection
+    fieldPaths:
+    - spec.variables.[name=vendorWorkerServiceAccount].expression
+    options:
+      delimiter: "'"
+      index: 1
+- source:
+    group: ""
+    version: v1
+    kind: ServiceAccount
+    name: container-worker
+    fieldPath: metadata.name
+  targets:
+  - select:
+      group: admissionregistration.k8s.io
+      version: v1
+      kind: ValidatingAdmissionPolicy
+      name: gateway-task-protection
+    fieldPaths:
+    - spec.variables.[name=containerWorkerServiceAccount].expression
+    options:
+      delimiter: "'"
+      index: 1
diff --git a/config/acp-workload/kustomizeconfig.yaml b/config/acp-workload/kustomizeconfig.yaml
new file mode 100644
index 000000000..a4cf625bf
--- /dev/null
+++ b/config/acp-workload/kustomizeconfig.yaml
@@ -0,0 +1,27 @@
+nameReference:
+- kind: ServiceAccount
+  version: v1
+  fieldSpecs:
+  - kind: RoleBinding
+    group: rbac.authorization.k8s.io
+    version: v1
+    path: subjects/name
+  - kind: ClusterRoleBinding
+    group: rbac.authorization.k8s.io
+    version: v1
+    path: subjects/name
+- kind: ClusterRole
+  group: rbac.authorization.k8s.io
+  version: v1
+  fieldSpecs:
+  - kind: ClusterRole
+    group: rbac.authorization.k8s.io
+    version: v1
+    path: rules/resourceNames
+- kind: Namespace
+  version: v1
+  fieldSpecs:
+  - kind: ClusterRole
+    group: rbac.authorization.k8s.io
+    version: v1
+    path: rules/resourceNames
diff --git a/config/acp-workload/manager_metrics_patch.yaml b/config/acp-workload/manager_metrics_patch.yaml
new file mode 100644
index 000000000..2aaef6536
--- /dev/null
+++ b/config/acp-workload/manager_metrics_patch.yaml
@@ -0,0 +1,4 @@
+# This patch adds the args to allow exposing the metrics endpoint using HTTPS
+- op: add
+  path: /spec/template/spec/containers/0/args/0
+  value: --metrics-bind-address=:8443
diff --git a/config/acp-workload/metrics_service.yaml b/config/acp-workload/metrics_service.yaml
new file mode 100644
index 000000000..dfb4408f6
--- /dev/null
+++ b/config/acp-workload/metrics_service.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    control-plane: controller-manager
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/managed-by: kustomize
+  name: controller-manager-metrics-service
+  namespace: system
+spec:
+  ports:
+  - name: https
+    port: 8443
+    protocol: TCP
+    targetPort: 8443
+  selector:
+    control-plane: controller-manager
+    app.kubernetes.io/name: orka
diff --git a/config/acp-workload/namespace_name_patch.yaml b/config/acp-workload/namespace_name_patch.yaml
new file mode 100644
index 000000000..be6d5ca30
--- /dev/null
+++ b/config/acp-workload/namespace_name_patch.yaml
@@ -0,0 +1,3 @@
+- op: replace
+  path: /metadata/name
+  value: orka-system
diff --git a/config/acp-workload/remove_admission_policy_binding_namespace.yaml b/config/acp-workload/remove_admission_policy_binding_namespace.yaml
new file mode 100644
index 000000000..c5c2ab765
--- /dev/null
+++ b/config/acp-workload/remove_admission_policy_binding_namespace.yaml
@@ -0,0 +1,12 @@
+apiVersion: builtin
+kind: PatchTransformer
+metadata:
+  name: remove-admission-policy-binding-namespace
+patch: |-
+  - op: remove
+    path: /metadata/namespace
+target:
+  group: admissionregistration.k8s.io
+  version: v1
+  kind: ValidatingAdmissionPolicyBinding
+  name: gateway-task-protection
diff --git a/config/acp-workload/remove_admission_policy_namespace.yaml b/config/acp-workload/remove_admission_policy_namespace.yaml
new file mode 100644
index 000000000..a510dab5a
--- /dev/null
+++ b/config/acp-workload/remove_admission_policy_namespace.yaml
@@ -0,0 +1,12 @@
+apiVersion: builtin
+kind: PatchTransformer
+metadata:
+  name: remove-admission-policy-namespace
+patch: |-
+  - op: remove
+    path: /metadata/namespace
+target:
+  group: admissionregistration.k8s.io
+  version: v1
+  kind: ValidatingAdmissionPolicy
+  name: gateway-task-protection
diff --git a/config/acp-workload/runtime_namespace.yaml b/config/acp-workload/runtime_namespace.yaml
new file mode 100644
index 000000000..286ad378c
--- /dev/null
+++ b/config/acp-workload/runtime_namespace.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: orka-runtimes
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: acp-runtime
+    app.kubernetes.io/managed-by: kustomize
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/warn: restricted
+    pod-security.kubernetes.io/audit: restricted
diff --git a/config/acp-workload/runtime_rbac.yaml b/config/acp-workload/runtime_rbac.yaml
new file mode 100644
index 000000000..f6886770d
--- /dev/null
+++ b/config/acp-workload/runtime_rbac.yaml
@@ -0,0 +1,77 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/managed-by: kustomize
+  name: runtime-controller-role
+  namespace: orka-runtimes
+rules:
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - replicasets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - secrets
+  - services
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - networkpolicies
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - policy
+  resources:
+  - poddisruptionbudgets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/managed-by: kustomize
+  name: runtime-controller-rolebinding
+  namespace: orka-runtimes
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: runtime-controller-role
+subjects:
+- kind: ServiceAccount
+  name: controller-manager
+  namespace: system
diff --git a/config/acp-workload/v2_controller_cluster_role.yaml b/config/acp-workload/v2_controller_cluster_role.yaml
new file mode 100644
index 000000000..edb1668e0
--- /dev/null
+++ b/config/acp-workload/v2_controller_cluster_role.yaml
@@ -0,0 +1,119 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/managed-by: kustomize
+  name: v2-controller-cluster-role
+rules:
+- apiGroups:
+  - ""
+  resourceNames:
+  - orka-runtimes
+  resources:
+  - namespaces
+  verbs:
+  - get
+- apiGroups:
+  - apiextensions.k8s.io
+  resourceNames:
+  - tasks.core.orka.ai
+  - gatewayclasses.gateway.orka.ai
+  - gateways.gateway.orka.ai
+  - gatewaybindings.gateway.orka.ai
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+- apiGroups:
+  - core.orka.ai
+  resources:
+  - branchclaims
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - core.orka.ai
+  resources:
+  - branchclaims/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - core.orka.ai
+  resources:
+  - branchclaims/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - gateway.orka.ai
+  resources:
+  - gatewayclasses
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - gateway.orka.ai
+  resources:
+  - gatewayclasses/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - gateway.orka.ai
+  resources:
+  - gatewayclasses/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - workspace.orka.ai
+  resources:
+  - executionworkspaceproviders
+  verbs:
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - workspace.orka.ai
+  resources:
+  - executionworkspaceproviders/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - workspace.orka.ai
+  resources:
+  - executionworkspaceproviders/finalizers
+  verbs:
+  - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/managed-by: kustomize
+  name: v2-controller-cluster-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: v2-controller-cluster-role
+subjects:
+- kind: ServiceAccount
+  name: controller-manager
+  namespace: system
diff --git a/config/crd/bases/core.orka.ai_agentruntimes.yaml b/config/crd/bases/core.orka.ai_agentruntimes.yaml
index e9623b7ae..707f8640a 100644
--- a/config/crd/bases/core.orka.ai_agentruntimes.yaml
+++ b/config/crd/bases/core.orka.ai_agentruntimes.yaml
@@ -24,8 +24,8 @@ spec:
     - jsonPath: .spec.deployment.mode
       name: Mode
       type: string
-    - jsonPath: .status.observedCapabilities.runtimeName
-      name: Runtime
+    - jsonPath: .status.observedCapabilities.runtimeInstanceID
+      name: Instance
       type: string
     - jsonPath: .metadata.creationTimestamp
       name: Age
@@ -33,7 +33,8 @@ spec:
     name: v1alpha1
     schema:
       openAPIV3Schema:
-        description: AgentRuntime is the Schema for registered Orka harness runtimes.
+        description: AgentRuntime is the Schema for registered external Orka harness
+          runtimes.
         properties:
           apiVersion:
             description: |-
@@ -53,19 +54,27 @@ spec:
           metadata:
             type: object
           spec:
-            description: AgentRuntimeRegistrySpec defines the desired state of a registered
-              Orka harness runtime.
+            description: |-
+              AgentRuntimeRegistrySpec defines the desired state of a registered Orka harness runtime.
+              The dual schema has no contractVersion default: omission is tolerated only for
+              stored objects awaiting the one-time bridge classification and is never
+              interpreted as either protocol. Fail-closed admission requires an explicit
+              value for new registrations.
             properties:
               capabilities:
-                description: Capabilities declares readiness requirements Orka checks
-                  against the runtime.
+                description: |-
+                  Capabilities pins the runtime capability claims. Required with the exact
+                  instance/profile/limits/governance shape for orka.harness.v2; historically
+                  optional for orka.harness.v1.
                 properties:
                   brokeredToolClasses:
-                    description: BrokeredToolClasses lists brokered tool classes the
-                      runtime must advertise when brokered mode is required.
+                    description: |-
+                      BrokeredToolClasses lists the harness v1 brokered tool classes supported
+                      by the runtime. v1 only; historically optional.
                     items:
-                      description: AgentRuntimeBrokeredToolClass declares which classes
-                        of Orka-brokered tools a runtime can request.
+                      description: |-
+                        AgentRuntimeBrokeredToolClass classifies Tool CRDs. It is shared by the Tool
+                        API and by harness v1 AgentRuntime capability declarations.
                       enum:
                       - read
                       - write
@@ -73,44 +82,293 @@ spec:
                       type: string
                     type: array
                     x-kubernetes-list-type: set
+                  limits:
+                    description: Limits must exactly match /v2/capabilities. v2 only.
+                    properties:
+                      maxBufferedEvents:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxConcurrentPrompts:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxEventLineBytes:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxPendingPermissions:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxPromptLeaseMillis:
+                        format: int64
+                        minimum: 1
+                        type: integer
+                      maxRequestBytes:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxResidentSessions:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxTerminalResultBytes:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxUpdateEventsPerSecond:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxWorkspaceDeltaBytes:
+                        format: int64
+                        minimum: 1
+                        type: integer
+                      minPromptLeaseMillis:
+                        format: int64
+                        minimum: 1
+                        type: integer
+                    required:
+                    - maxBufferedEvents
+                    - maxConcurrentPrompts
+                    - maxEventLineBytes
+                    - maxPendingPermissions
+                    - maxPromptLeaseMillis
+                    - maxRequestBytes
+                    - maxResidentSessions
+                    - maxTerminalResultBytes
+                    - maxUpdateEventsPerSecond
+                    - maxWorkspaceDeltaBytes
+                    - minPromptLeaseMillis
+                    type: object
+                  profile:
+                    description: Profile is the exact immutable profile accepted by
+                      v2 session creation.
+                    properties:
+                      acpProfile:
+                        description: ACPProfile is the reviewed ACP profile.
+                        enum:
+                        - acp.v1
+                        type: string
+                      adapterDigest:
+                        description: AdapterDigest pins the adapter/CLI artifact set.
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      adapterName:
+                        description: AdapterName identifies the sole adapter contained
+                          by this external profile.
+                        maxLength: 128
+                        minLength: 1
+                        type: string
+                      agentConfigurationDigest:
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      approvalPolicyDigest:
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      digest:
+                        description: Digest is the canonical orka.harness.v2 runtime-profile
+                          digest.
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      digestSchemaVersion:
+                        description: DigestSchemaVersion identifies the canonical
+                          profile digest schema.
+                        enum:
+                        - 1
+                        format: int32
+                        type: integer
+                      mcpConfigurationDigest:
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      model:
+                        maxLength: 256
+                        minLength: 1
+                        type: string
+                      modelLimits:
+                        description: ModelLimits pins optional reviewed model token
+                          capacities.
+                        properties:
+                          context:
+                            description: Context is the maximum model context capacity
+                              in tokens.
+                            format: int64
+                            minimum: 1
+                            type: integer
+                          output:
+                            description: Output is the maximum generated output in
+                              tokens.
+                            format: int64
+                            minimum: 1
+                            type: integer
+                        required:
+                        - context
+                        - output
+                        type: object
+                        x-kubernetes-validations:
+                        - message: model context limit must exceed output limit
+                          rule: self.context > self.output
+                      providerKind:
+                        maxLength: 128
+                        minLength: 1
+                        type: string
+                      proxyCredentialRole:
+                        maxLength: 256
+                        minLength: 1
+                        type: string
+                      proxyCredentialScope:
+                        maxLength: 1024
+                        minLength: 1
+                        type: string
+                      resourceClass:
+                        maxLength: 128
+                        minLength: 1
+                        type: string
+                      toolPolicyDigest:
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      workspaceIntent:
+                        description: WorkspaceIntent is the one immutable strict intent
+                          represented by this profile.
+                        enum:
+                        - read
+                        - write
+                        type: string
+                    required:
+                    - acpProfile
+                    - adapterDigest
+                    - adapterName
+                    - agentConfigurationDigest
+                    - approvalPolicyDigest
+                    - digest
+                    - digestSchemaVersion
+                    - mcpConfigurationDigest
+                    - model
+                    - providerKind
+                    - proxyCredentialRole
+                    - proxyCredentialScope
+                    - resourceClass
+                    - toolPolicyDigest
+                    - workspaceIntent
+                    type: object
+                  runtimeInstanceID:
+                    description: |-
+                      RuntimeInstanceID is the immutable external supervisor instance expected from
+                      authenticated /v2/status and every conformance response. v2 only.
+                    maxLength: 253
+                    minLength: 1
+                    type: string
                   supportsArtifacts:
-                    description: SupportsArtifacts requires the runtime to advertise
-                      artifact/result reference support when true.
+                    description: SupportsArtifacts declares harness v1 artifact support.
+                      v1 only.
                     type: boolean
                   supportsCancel:
-                    description: SupportsCancel requires the runtime to advertise
-                      cancellation support when true.
+                    description: SupportsCancel declares harness v1 turn cancellation
+                      support. v1 only.
                     type: boolean
                   supportsContinuation:
-                    description: SupportsContinuation requires the runtime to advertise
-                      continuation after Orka-brokered tool results when true.
+                    description: SupportsContinuation declares harness v1 brokered
+                      continuation support. v1 only.
+                    type: boolean
+                  supportsDrain:
+                    description: SupportsDrain must exactly match the static v2 capability
+                      claim.
+                    type: boolean
+                  supportsPublicationFinalization:
+                    description: SupportsPublicationFinalization must exactly match
+                      the static v2 capability claim.
                     type: boolean
                   supportsRuntimeSessions:
-                    description: SupportsRuntimeSessions requires the runtime to advertise
-                      stable runtime sessions when true.
+                    description: SupportsRuntimeSessions declares harness v1 runtime
+                      session support. v1 only.
                     type: boolean
                   toolExecutionModes:
-                    description: ToolExecutionModes lists tool execution modes the
-                      runtime must advertise.
+                    description: |-
+                      ToolExecutionModes lists the harness v1 tool execution modes supported by
+                      the runtime. v1 only; historically optional.
                     items:
-                      description: AgentRuntimeToolExecutionMode declares how custom
-                        runtimes interact with tools.
+                      description: AgentRuntimeToolExecutionMode describes how a harness
+                        v1 runtime executes tools.
                       enum:
                       - observed
                       - brokered
                       type: string
                     type: array
                     x-kubernetes-list-type: set
+                  workspaceGovernance:
+                    description: WorkspaceGovernance must exactly match the static
+                      v2 capability claim.
+                    properties:
+                      cancellationSettlement:
+                        type: boolean
+                      duplicateSafeMutations:
+                        type: boolean
+                      exactInstanceFencing:
+                        type: boolean
+                      mode:
+                        description: Mode selects strict Orka governance or an explicit
+                          trusted escape hatch.
+                        enum:
+                        - strict-governed
+                        - trusted-non-governed
+                        type: string
+                      noDirectSCMPublication:
+                        type: boolean
+                      orkaOwnedCleanRoomPublication:
+                        type: boolean
+                      orkaOwnedWorkspaceDeltas:
+                        type: boolean
+                      promptScopedBrokerAuthorization:
+                        type: boolean
+                      trusted:
+                        description: |-
+                          Trusted must be true only for trusted-non-governed runtimes. Such runtimes
+                          are ineligible for Tasks requesting strict read or write guarantees.
+                        type: boolean
+                    required:
+                    - cancellationSettlement
+                    - duplicateSafeMutations
+                    - exactInstanceFencing
+                    - mode
+                    - noDirectSCMPublication
+                    - orkaOwnedCleanRoomPublication
+                    - orkaOwnedWorkspaceDeltas
+                    - promptScopedBrokerAuthorization
+                    - trusted
+                    type: object
+                    x-kubernetes-validations:
+                    - message: trusted-non-governed runtimes must be explicitly marked
+                        trusted
+                      rule: self.mode != 'trusted-non-governed' || self.trusted
+                    - message: strict-governed runtimes must not use the trusted non-governed
+                        escape hatch
+                      rule: self.mode != 'strict-governed' || !self.trusted
+                    - message: strict-governed runtimes must claim every strict workspace
+                        governance guarantee
+                      rule: self.mode != 'strict-governed' || (self.orkaOwnedWorkspaceDeltas
+                        && self.promptScopedBrokerAuthorization && self.noDirectSCMPublication
+                        && self.orkaOwnedCleanRoomPublication && self.exactInstanceFencing
+                        && self.duplicateSafeMutations && self.cancellationSettlement)
+                    - message: trusted-non-governed runtimes must not claim strict
+                        workspace guarantees
+                      rule: self.mode != 'trusted-non-governed' || (!self.orkaOwnedWorkspaceDeltas
+                        && !self.promptScopedBrokerAuthorization && !self.noDirectSCMPublication
+                        && !self.orkaOwnedCleanRoomPublication && !self.exactInstanceFencing
+                        && !self.duplicateSafeMutations && !self.cancellationSettlement)
                 type: object
               clientAuth:
-                description: ClientAuth configures controller-to-runtime authentication.
+                description: ClientAuth configures controller authentication and mutation
+                  authorization.
                 properties:
                   bearerTokenSecretRef:
                     description: |-
-                      BearerAuthRef points to the bearer token Secret used for mutating harness endpoints.
-                      The referenced Secret must opt in with label orka.ai/agent-runtime-auth=true,
-                      may set orka.ai/agent-runtime-name=<runtime> to restrict use to one AgentRuntime,
-                      and must set annotation orka.ai/agent-runtime-endpoint=<deployment.endpoint> to bind the token to one endpoint.
+                      BearerAuthRef points to the harness v1 bearer token Secret used for
+                      mutating v1 harness endpoints. The referenced Secret must opt in with
+                      label orka.ai/agent-runtime-auth=true, may set
+                      orka.ai/agent-runtime-name=<runtime> to restrict use to one AgentRuntime,
+                      and must set annotation orka.ai/agent-runtime-endpoint=<deployment.endpoint>
+                      to bind the token to one endpoint.
                     properties:
                       key:
                         description: Key is the Secret data key containing the bearer
@@ -125,28 +383,80 @@ spec:
                     - key
                     - name
                     type: object
-                required:
-                - bearerTokenSecretRef
+                  controllerBearerTokenSecretRef:
+                    description: |-
+                      ControllerBearerTokenSecretRef supplies the controller bearer token used by
+                      authenticated v2 status and mutation endpoints.
+                    properties:
+                      key:
+                        description: Key is the Secret data key.
+                        maxLength: 253
+                        minLength: 1
+                        type: string
+                      name:
+                        description: Name is the Secret name in the AgentRuntime namespace.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                    required:
+                    - key
+                    - name
+                    type: object
+                  operationCapabilitySecretRef:
+                    description: |-
+                      OperationCapabilitySecretRef supplies the HMAC secret used to bind every
+                      v2 mutation to its exact fence, operation identity, request digest, and expiry.
+                    properties:
+                      key:
+                        description: Key is the Secret data key.
+                        maxLength: 253
+                        minLength: 1
+                        type: string
+                      name:
+                        description: Name is the Secret name in the AgentRuntime namespace.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                    required:
+                    - key
+                    - name
+                    type: object
                 type: object
+                x-kubernetes-validations:
+                - message: legacy v1 and v2 client auth shapes are mutually exclusive
+                  rule: '!(has(self.bearerTokenSecretRef) && (has(self.controllerBearerTokenSecretRef)
+                    || has(self.operationCapabilitySecretRef)))'
+                - message: v2 client auth requires both controllerBearerTokenSecretRef
+                    and operationCapabilitySecretRef
+                  rule: has(self.controllerBearerTokenSecretRef) == has(self.operationCapabilitySecretRef)
+                - message: client auth requires either the v1 or the v2 credential
+                    shape
+                  rule: has(self.bearerTokenSecretRef) || has(self.controllerBearerTokenSecretRef)
               contractVersion:
-                default: orka.harness.v1
-                description: ContractVersion is the Orka harness contract this runtime
-                  must implement.
+                description: |-
+                  ContractVersion is the Orka harness contract this runtime must implement.
+                  It is immutable once set. Required for new registrations through
+                  fail-closed admission; the bridge schema tolerates omission only on
+                  unchanged stored objects while execution admission is closed.
                 enum:
                 - orka.harness.v1
+                - orka.harness.v2
                 type: string
               deployment:
                 description: Deployment identifies the runtime endpoint provider.
                 properties:
                   endpoint:
                     description: |-
-                      Endpoint is the base URL for a pre-deployed or external orka.harness.v1 service.
-                      It must not contain credentials; bearer auth is configured via clientAuth.
+                      Endpoint is the base URL for an external harness service. It must not
+                      contain credentials, query parameters, or fragments.
                     pattern: ^https?://[^\s@?#]+$
                     type: string
                   mode:
-                    description: Mode is the deployment mode. The first milestone
-                      supports external endpoints only.
+                    description: |-
+                      Mode is the deployment mode. External AgentRuntime registrations are not
+                      scaled or recycled by Orka.
                     enum:
                     - external-endpoint
                     type: string
@@ -156,9 +466,40 @@ spec:
                 type: object
             required:
             - clientAuth
-            - contractVersion
             - deployment
             type: object
+            x-kubernetes-validations:
+            - message: contractVersion is immutable once set
+              rule: '!has(oldSelf.contractVersion) || (has(self.contractVersion) &&
+                self.contractVersion == oldSelf.contractVersion)'
+            - message: orka.harness.v1 requires the legacy bearerTokenSecretRef client
+                auth shape
+              rule: '!has(self.contractVersion) || self.contractVersion != ''orka.harness.v1''
+                || (has(self.clientAuth.bearerTokenSecretRef) && !has(self.clientAuth.controllerBearerTokenSecretRef)
+                && !has(self.clientAuth.operationCapabilitySecretRef))'
+            - message: orka.harness.v1 capabilities must not carry v2 capability fields
+              rule: '!has(self.contractVersion) || self.contractVersion != ''orka.harness.v1''
+                || !has(self.capabilities) || (!has(self.capabilities.runtimeInstanceID)
+                && !has(self.capabilities.profile) && !has(self.capabilities.limits)
+                && !has(self.capabilities.workspaceGovernance) && !has(self.capabilities.supportsDrain)
+                && !has(self.capabilities.supportsPublicationFinalization))'
+            - message: orka.harness.v2 requires the v2 controller bearer and operation
+                capability client auth shape
+              rule: '!has(self.contractVersion) || self.contractVersion != ''orka.harness.v2''
+                || (has(self.clientAuth.controllerBearerTokenSecretRef) && has(self.clientAuth.operationCapabilitySecretRef)
+                && !has(self.clientAuth.bearerTokenSecretRef))'
+            - message: orka.harness.v2 requires pinned instance, profile, limits,
+                and workspace governance capabilities
+              rule: '!has(self.contractVersion) || self.contractVersion != ''orka.harness.v2''
+                || (has(self.capabilities) && has(self.capabilities.runtimeInstanceID)
+                && has(self.capabilities.profile) && has(self.capabilities.limits)
+                && has(self.capabilities.workspaceGovernance))'
+            - message: orka.harness.v2 capabilities must not carry v1 capability fields
+              rule: '!has(self.contractVersion) || self.contractVersion != ''orka.harness.v2''
+                || !has(self.capabilities) || (!has(self.capabilities.toolExecutionModes)
+                && !has(self.capabilities.brokeredToolClasses) && !has(self.capabilities.supportsCancel)
+                && !has(self.capabilities.supportsRuntimeSessions) && !has(self.capabilities.supportsContinuation)
+                && !has(self.capabilities.supportsArtifacts))'
           status:
             description: AgentRuntimeStatus defines the observed state of an AgentRuntime.
             properties:
@@ -232,20 +573,26 @@ spec:
                 type: string
               observedAuthRefResourceVersion:
                 description: |-
-                  ObservedAuthRefResourceVersion is the resourceVersion of the bearer auth Secret
-                  used for the last readiness probe. It is non-secret metadata used to decide
-                  when token rotation requires a fresh authenticated conformance turn.
+                  ObservedAuthRefResourceVersion is the resourceVersion of the harness v1
+                  bearer auth Secret used for the last v1 readiness probe. It is non-secret
+                  metadata used to decide when token rotation requires a fresh authenticated
+                  conformance turn. v2 probes use the two v2 auth resource-version fields.
                 type: string
               observedCapabilities:
                 description: ObservedCapabilities contains sanitized capabilities
                   from the last probe.
                 properties:
+                  acpVersion:
+                    type: string
+                  adapterDigest:
+                    type: string
+                  adapterName:
+                    type: string
                   brokeredToolClasses:
-                    description: BrokeredToolClasses are the brokered tool classes
-                      advertised by /v1/capabilities.
                     items:
-                      description: AgentRuntimeBrokeredToolClass declares which classes
-                        of Orka-brokered tools a runtime can request.
+                      description: |-
+                        AgentRuntimeBrokeredToolClass classifies Tool CRDs. It is shared by the Tool
+                        API and by harness v1 AgentRuntime capability declarations.
                       enum:
                       - read
                       - write
@@ -253,63 +600,123 @@ spec:
                       type: string
                     type: array
                     x-kubernetes-list-type: set
+                  controllerEpoch:
+                    format: int64
+                    type: integer
+                  lifecycle:
+                    type: string
+                  limits:
+                    description: Limits records the v2 protocol bounds. It is absent
+                      for harness v1.
+                    properties:
+                      maxBufferedEvents:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxConcurrentPrompts:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxEventLineBytes:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxPendingPermissions:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxPromptLeaseMillis:
+                        format: int64
+                        minimum: 1
+                        type: integer
+                      maxRequestBytes:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxResidentSessions:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxTerminalResultBytes:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxUpdateEventsPerSecond:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxWorkspaceDeltaBytes:
+                        format: int64
+                        minimum: 1
+                        type: integer
+                      minPromptLeaseMillis:
+                        format: int64
+                        minimum: 1
+                        type: integer
+                    required:
+                    - maxBufferedEvents
+                    - maxConcurrentPrompts
+                    - maxEventLineBytes
+                    - maxPendingPermissions
+                    - maxPromptLeaseMillis
+                    - maxRequestBytes
+                    - maxResidentSessions
+                    - maxTerminalResultBytes
+                    - maxUpdateEventsPerSecond
+                    - maxWorkspaceDeltaBytes
+                    - minPromptLeaseMillis
+                    type: object
                   maxConcurrentTurns:
-                    description: MaxConcurrentTurns is the advertised concurrency
-                      ceiling.
                     type: integer
                   maxOutputBytes:
-                    description: MaxOutputBytes is the advertised maximum output payload
-                      size.
                     format: int64
                     type: integer
                   maxTurnSeconds:
-                    description: MaxTurnSeconds is the advertised per-turn duration
-                      ceiling.
+                    type: integer
+                  model:
+                    type: string
+                  profileDigestSchemaVersion:
+                    format: int32
                     type: integer
                   protocolVersion:
-                    description: ProtocolVersion is the runtime's advertised Orka
-                      protocol version.
                     type: string
                   providerKind:
-                    description: ProviderKind is the provider kind advertised by /v1/capabilities.
+                    type: string
+                  runtimeInstanceID:
                     type: string
                   runtimeName:
-                    description: RuntimeName is the runtime name advertised by /v1/capabilities.
+                    type: string
+                  runtimePoolGeneration:
+                    format: int64
+                    type: integer
+                  runtimePoolUID:
+                    type: string
+                  runtimeProfileDigest:
                     type: string
                   runtimeVersion:
-                    description: RuntimeVersion is the runtime version advertised
-                      by /v1/capabilities.
+                    type: string
+                  supervisorBootID:
                     type: string
                   supportsArtifacts:
-                    description: SupportsArtifacts reports whether the runtime advertises
-                      artifact/result reference support.
                     type: boolean
                   supportsCancel:
-                    description: SupportsCancel reports whether the runtime advertises
-                      cancellation support.
                     type: boolean
                   supportsContinuation:
-                    description: SupportsContinuation reports whether the runtime
-                      advertises continuation support.
+                    type: boolean
+                  supportsDrain:
+                    type: boolean
+                  supportsPublicationFinalization:
                     type: boolean
                   supportsRuntimeSessions:
-                    description: SupportsRuntimeSessions reports whether the runtime
-                      advertises runtime-session support.
                     type: boolean
                   supportsSuspend:
-                    description: SupportsSuspend reports whether the runtime advertises
-                      suspend support.
                     type: boolean
                   supportsWorkspaceSnapshot:
-                    description: SupportsWorkspaceSnapshot reports whether the runtime
-                      advertises workspace snapshots.
                     type: boolean
                   toolExecutionModes:
-                    description: ToolExecutionModes are the tool modes advertised
-                      by /v1/capabilities.
                     items:
-                      description: AgentRuntimeToolExecutionMode declares how custom
-                        runtimes interact with tools.
+                      description: AgentRuntimeToolExecutionMode describes how a harness
+                        v1 runtime executes tools.
                       enum:
                       - observed
                       - brokered
@@ -317,14 +724,83 @@ spec:
                     type: array
                     x-kubernetes-list-type: set
                   transport:
-                    description: Transport is the runtime transport, normally http+sse.
                     type: string
+                  workspaceGovernance:
+                    description: WorkspaceGovernance records the v2 workspace guarantees.
+                      It is absent for harness v1.
+                    properties:
+                      cancellationSettlement:
+                        type: boolean
+                      duplicateSafeMutations:
+                        type: boolean
+                      exactInstanceFencing:
+                        type: boolean
+                      mode:
+                        description: Mode selects strict Orka governance or an explicit
+                          trusted escape hatch.
+                        enum:
+                        - strict-governed
+                        - trusted-non-governed
+                        type: string
+                      noDirectSCMPublication:
+                        type: boolean
+                      orkaOwnedCleanRoomPublication:
+                        type: boolean
+                      orkaOwnedWorkspaceDeltas:
+                        type: boolean
+                      promptScopedBrokerAuthorization:
+                        type: boolean
+                      trusted:
+                        description: |-
+                          Trusted must be true only for trusted-non-governed runtimes. Such runtimes
+                          are ineligible for Tasks requesting strict read or write guarantees.
+                        type: boolean
+                    required:
+                    - cancellationSettlement
+                    - duplicateSafeMutations
+                    - exactInstanceFencing
+                    - mode
+                    - noDirectSCMPublication
+                    - orkaOwnedCleanRoomPublication
+                    - orkaOwnedWorkspaceDeltas
+                    - promptScopedBrokerAuthorization
+                    - trusted
+                    type: object
+                    x-kubernetes-validations:
+                    - message: trusted-non-governed runtimes must be explicitly marked
+                        trusted
+                      rule: self.mode != 'trusted-non-governed' || self.trusted
+                    - message: strict-governed runtimes must not use the trusted non-governed
+                        escape hatch
+                      rule: self.mode != 'strict-governed' || !self.trusted
+                    - message: strict-governed runtimes must claim every strict workspace
+                        governance guarantee
+                      rule: self.mode != 'strict-governed' || (self.orkaOwnedWorkspaceDeltas
+                        && self.promptScopedBrokerAuthorization && self.noDirectSCMPublication
+                        && self.orkaOwnedCleanRoomPublication && self.exactInstanceFencing
+                        && self.duplicateSafeMutations && self.cancellationSettlement)
+                    - message: trusted-non-governed runtimes must not claim strict
+                        workspace guarantees
+                      rule: self.mode != 'trusted-non-governed' || (!self.orkaOwnedWorkspaceDeltas
+                        && !self.promptScopedBrokerAuthorization && !self.noDirectSCMPublication
+                        && !self.orkaOwnedCleanRoomPublication && !self.exactInstanceFencing
+                        && !self.duplicateSafeMutations && !self.cancellationSettlement)
                 type: object
+              observedControllerAuthRefResourceVersion:
+                description: |-
+                  ObservedControllerAuthRefResourceVersion is the bearer Secret version used
+                  by the last successful or failed authenticated conformance probe.
+                type: string
               observedGeneration:
                 description: ObservedGeneration is the latest generation reconciled
                   into this status.
                 format: int64
                 type: integer
+              observedOperationCapabilityRefResourceVersion:
+                description: |-
+                  ObservedOperationCapabilityRefResourceVersion is the HMAC Secret version used
+                  by the last mutation conformance probe.
+                type: string
               ready:
                 description: Ready indicates the runtime passed the configured Orka
                   readiness checks.
diff --git a/config/crd/bases/core.orka.ai_agents.yaml b/config/crd/bases/core.orka.ai_agents.yaml
index 6bcb07722..76f7d04c9 100644
--- a/config/crd/bases/core.orka.ai_agents.yaml
+++ b/config/crd/bases/core.orka.ai_agents.yaml
@@ -1094,10 +1094,10 @@ spec:
                     type: array
                   workspace:
                     description: |-
-                      Workspace requests an upstream agent-sandbox execution workspace for agent Tasks.
-                      When enabled, the Task controller validates the request and propagates the
-                      resolved sandbox settings to the agent worker Job. The worker wrapper then
-                      claims the sandbox workspace and runs the configured agent runtime inside it.
+                      Workspace requests an execution workspace for worker-backed Task types.
+                      ACP core agent Tasks reject this field because their ephemeral workspace is
+                      owned by RuntimeSession lifecycle and clean-room publication. Actor-backed
+                      RuntimeSession support is a future integration behind the v2 lifecycle seam.
                     properties:
                       boot:
                         description: |-
@@ -1247,6 +1247,13 @@ spec:
                   Model defines the LLM model configuration
                   Provider field is optional if providerRef is set
                 properties:
+                  contextWindow:
+                    description: |-
+                      ContextWindow is the reviewed model context capacity in tokens. Built-in
+                      runtimes that manage their own compaction require this value explicitly.
+                    format: int32
+                    minimum: 1
+                    type: integer
                   fallbacks:
                     description: |-
                       Fallbacks defines alternative providers to try when the primary fails.
@@ -1267,7 +1274,10 @@ spec:
                       type: object
                     type: array
                   maxTokens:
-                    description: MaxTokens limits the response length
+                    description: |-
+                      MaxTokens limits the response length. OpenCode validates positive reviewed
+                      limits at its runtime-specific admission boundary; existing Agent objects
+                      may retain the legacy zero value.
                     format: int32
                     type: integer
                   name:
@@ -1284,7 +1294,6 @@ spec:
                     - openai
                     type: string
                   temperature:
-                    default: 0.7
                     description: Temperature controls randomness in generation
                     maximum: 2
                     minimum: 0
@@ -1382,6 +1391,17 @@ spec:
                   Runtime configures this Agent for external CLI runtimes (type: agent tasks).
                   When set, this Agent is for type: agent tasks only (mutually exclusive with providerRef).
                 properties:
+                  contractVersion:
+                    description: |-
+                      ContractVersion is the immutable harness protocol selector for built-in
+                      runtime types. There is no default: a missing selector is never
+                      interpreted as either protocol, and fail-closed admission requires an
+                      explicit value on new built-in Agents. runtime.type alone (including
+                      opencode, which exists in both protocols) is never protocol evidence.
+                    enum:
+                    - orka.harness.v1
+                    - orka.harness.v2
+                    type: string
                   defaultAllowBash:
                     description: |-
                       DefaultAllowBash controls whether bash is allowed by default for tasks using this Agent.
@@ -1428,15 +1448,21 @@ spec:
                     description: Type specifies which built-in CLI runtime to use.
                       Use runtimeRef for admin-registered custom runtimes.
                     enum:
-                    - copilot
                     - claude
                     - codex
+                    - copilot
                     - opencode
                     type: string
                 type: object
                 x-kubernetes-validations:
                 - message: exactly one of type or runtimeRef is required
                   rule: has(self.type) != has(self.runtimeRef)
+                - message: runtime.contractVersion is immutable once set
+                  rule: '!has(oldSelf.contractVersion) || (has(self.contractVersion)
+                    && self.contractVersion == oldSelf.contractVersion)'
+                - message: runtime.contractVersion applies only to built-in runtime
+                    types; runtimeRef derives the protocol from the referenced AgentRuntime
+                  rule: '!has(self.contractVersion) || has(self.type)'
               secretRef:
                 description: SecretRef references a Secret containing LLM API keys
                 properties:
@@ -1520,6 +1546,9 @@ spec:
                     description: Inline is the inline prompt text
                     type: string
                 type: object
+                x-kubernetes-validations:
+                - message: system prompt must use only one of inline or configMapRef
+                  rule: '!(has(self.inline) && self.inline.size() > 0 && has(self.configMapRef))'
               tools:
                 description: Tools lists the default tools available to this agent
                 items:
@@ -1547,6 +1576,11 @@ spec:
             x-kubernetes-validations:
             - message: execution.workspace.classRef is only supported on Task specs
               rule: '!has(self.execution) || !has(self.execution.workspace) || !has(self.execution.workspace.classRef)'
+            - message: opencode orka.harness.v2 runtime does not support spec.systemPrompt
+              rule: '!(has(self.runtime) && has(self.runtime.type) && self.runtime.type
+                == ''opencode'' && has(self.runtime.contractVersion) && self.runtime.contractVersion
+                == ''orka.harness.v2'' && has(self.systemPrompt) && ((has(self.systemPrompt.inline)
+                && self.systemPrompt.inline.size() > 0) || has(self.systemPrompt.configMapRef)))'
           status:
             description: AgentStatus defines the observed state of Agent
             properties:
diff --git a/config/crd/bases/core.orka.ai_branchclaims.yaml b/config/crd/bases/core.orka.ai_branchclaims.yaml
new file mode 100644
index 000000000..1328a8fe0
--- /dev/null
+++ b/config/crd/bases/core.orka.ai_branchclaims.yaml
@@ -0,0 +1,197 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: branchclaims.core.orka.ai
+spec:
+  group: core.orka.ai
+  names:
+    kind: BranchClaim
+    listKind: BranchClaimList
+    plural: branchclaims
+    shortNames:
+    - bclaim
+    singular: branchclaim
+  scope: Cluster
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .spec.repositoryId
+      name: Repository
+      type: string
+    - jsonPath: .spec.ref
+      name: Ref
+      type: string
+    - jsonPath: .spec.ownerKind
+      name: Owner
+      type: string
+    - jsonPath: .status.generation
+      name: Generation
+      type: integer
+    - jsonPath: .status.availability
+      name: Availability
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: |-
+          BranchClaim is the cluster-wide Kubernetes-authoritative ownership and exact
+          baseline record for one canonical repository branch.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: BranchClaimSpec is the immutable repository/ref ownership
+              identity.
+            properties:
+              id:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              ownerKind:
+                description: BranchClaimOwnerKind identifies the durable owner of
+                  an Orka-managed branch.
+                enum:
+                - Task
+                - Session
+                type: string
+              ownerUid:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              ref:
+                maxLength: 1024
+                pattern: ^refs/heads/.+$
+                type: string
+              repositoryId:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              requestDigest:
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+            required:
+            - id
+            - ownerKind
+            - ownerUid
+            - ref
+            - repositoryId
+            - requestDigest
+            type: object
+            x-kubernetes-validations:
+            - message: branch claim spec is immutable
+              rule: self == oldSelf
+          status:
+            description: BranchClaimStatus is the exact generation, baseline, and
+              availability CAS.
+            properties:
+              availability:
+                description: BranchClaimAvailability gates further branch mutation.
+                enum:
+                - Available
+                - ReconciliationBlocked
+                type: string
+              blockedReason:
+                maxLength: 16384
+                type: string
+              controllerEpoch:
+                description: ControllerEpoch is the exact epoch that performed the
+                  last mutation.
+                format: int64
+                minimum: 1
+                type: integer
+              controllerEpochLeaseResourceVersion:
+                description: |-
+                  ControllerEpochLeaseResourceVersion is the resourceVersion of the
+                  authoritative controller-epoch Lease observed by the mutation.
+                maxLength: 64
+                type: string
+              controllerEpochName:
+                description: |-
+                  ControllerEpochName identifies the controller epoch domain checked before
+                  the mutation.
+                maxLength: 253
+                type: string
+              createdAt:
+                description: CreatedAt is the normalized logical creation time.
+                format: date-time
+                type: string
+              generation:
+                format: int64
+                minimum: 1
+                type: integer
+              lastOperationDigest:
+                description: LastOperationDigest binds LastOperationID to exact canonical
+                  input.
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              lastOperationId:
+                description: LastOperationID is the last idempotent mutation identity
+                  applied.
+                maxLength: 1024
+                type: string
+              lastVerified:
+                description: LastVerified is the independently observed exact target
+                  ref.
+                properties:
+                  absent:
+                    type: boolean
+                  sha:
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                required:
+                - absent
+                type: object
+                x-kubernetes-validations:
+                - message: absent and sha are mutually exclusive
+                  rule: '!(self.absent && has(self.sha) && size(self.sha) > 0)'
+              relatedPublicationId:
+                maxLength: 1024
+                type: string
+              updatedAt:
+                description: UpdatedAt is the normalized logical mutation time.
+                format: date-time
+                type: string
+              version:
+                description: |-
+                  Version is the monotonic domain CAS version. It advances once for each
+                  successfully persisted logical mutation.
+                format: int64
+                minimum: 1
+                type: integer
+            type: object
+            x-kubernetes-validations:
+            - message: available branch claims must clear block metadata
+              rule: '!has(self.availability) || self.availability != ''Available''
+                || ((!has(self.blockedReason) || size(self.blockedReason) == 0) &&
+                (!has(self.relatedPublicationId) || size(self.relatedPublicationId)
+                == 0))'
+            - message: reconciliation-blocked branch claims require a reason
+              rule: '!has(self.availability) || self.availability != ''ReconciliationBlocked''
+                || (has(self.blockedReason) && size(self.blockedReason) > 0)'
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/config/crd/bases/core.orka.ai_controllerepochs.yaml b/config/crd/bases/core.orka.ai_controllerepochs.yaml
new file mode 100644
index 000000000..9d1c486f2
--- /dev/null
+++ b/config/crd/bases/core.orka.ai_controllerepochs.yaml
@@ -0,0 +1,109 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: controllerepochs.core.orka.ai
+spec:
+  group: core.orka.ai
+  names:
+    kind: ControllerEpoch
+    listKind: ControllerEpochList
+    plural: controllerepochs
+    shortNames:
+    - cepoch
+    singular: controllerepoch
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.epoch
+      name: Epoch
+      type: integer
+    - jsonPath: .status.holderId
+      name: Holder
+      type: string
+    - jsonPath: .status.version
+      name: Version
+      type: integer
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: |-
+          ControllerEpoch is the human-visible Kubernetes control record paired with
+          an authoritative namespaced Lease.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: |-
+              ControllerEpochSpec is the immutable epoch-domain identity. The associated
+              coordination.k8s.io Lease is the CAS authority for holder and epoch changes.
+            properties:
+              name:
+                maxLength: 253
+                minLength: 1
+                type: string
+            required:
+            - name
+            type: object
+            x-kubernetes-validations:
+            - message: controller epoch spec is immutable
+              rule: self == oldSelf
+          status:
+            description: |-
+              ControllerEpochStatus mirrors the authoritative Lease state for inspection
+              and recovery. LeaseResourceVersion identifies the exact Lease revision.
+            properties:
+              acquiredAt:
+                format: date-time
+                type: string
+              epoch:
+                format: int64
+                minimum: 1
+                type: integer
+              holderId:
+                maxLength: 1024
+                type: string
+              leaseName:
+                maxLength: 253
+                type: string
+              leaseResourceVersion:
+                maxLength: 64
+                type: string
+              requestDigest:
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              updatedAt:
+                format: date-time
+                type: string
+              version:
+                format: int64
+                minimum: 1
+                type: integer
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/config/crd/bases/core.orka.ai_externaleffects.yaml b/config/crd/bases/core.orka.ai_externaleffects.yaml
new file mode 100644
index 000000000..e17b0a44f
--- /dev/null
+++ b/config/crd/bases/core.orka.ai_externaleffects.yaml
@@ -0,0 +1,191 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: externaleffects.core.orka.ai
+spec:
+  group: core.orka.ai
+  names:
+    kind: ExternalEffect
+    listKind: ExternalEffectList
+    plural: externaleffects
+    shortNames:
+    - eeffect
+    singular: externaleffect
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.state
+      name: State
+      type: string
+    - jsonPath: .spec.kind
+      name: Kind
+      type: string
+    - jsonPath: .status.attempts
+      name: Attempts
+      type: integer
+    - jsonPath: .status.version
+      name: Version
+      type: integer
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: |-
+          ExternalEffect is the Kubernetes-authoritative canonical idempotency record
+          for an operation outside SQLite.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: |-
+              ExternalEffectSpec is the immutable canonical identity and request binding.
+              The identity namespace intentionally duplicates metadata.namespace so a
+              serialized record remains self-describing and can be checked fail-closed.
+            properties:
+              aggregateId:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              id:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              identityNamespace:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              kind:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              operationId:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              requestDigest:
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+            required:
+            - aggregateId
+            - id
+            - identityNamespace
+            - kind
+            - operationId
+            - requestDigest
+            type: object
+            x-kubernetes-validations:
+            - message: external effect spec is immutable
+              rule: self == oldSelf
+          status:
+            description: |-
+              ExternalEffectStatus contains the mutable state, response, lease, and epoch
+              fence for one canonical external effect.
+            properties:
+              attempts:
+                format: int64
+                minimum: 0
+                type: integer
+              controllerEpoch:
+                description: ControllerEpoch is the exact epoch that performed the
+                  last mutation.
+                format: int64
+                minimum: 1
+                type: integer
+              controllerEpochLeaseResourceVersion:
+                description: |-
+                  ControllerEpochLeaseResourceVersion is the resourceVersion of the
+                  authoritative controller-epoch Lease observed by the mutation.
+                maxLength: 64
+                type: string
+              controllerEpochName:
+                description: |-
+                  ControllerEpochName identifies the controller epoch domain checked before
+                  the mutation.
+                maxLength: 253
+                type: string
+              createdAt:
+                description: CreatedAt is the normalized logical creation time.
+                format: date-time
+                type: string
+              lastOperationDigest:
+                description: LastOperationDigest binds LastOperationID to exact canonical
+                  input.
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              lastOperationId:
+                description: LastOperationID is the last idempotent mutation identity
+                  applied.
+                maxLength: 1024
+                type: string
+              leaseExpiresAt:
+                format: date-time
+                type: string
+              leaseOwner:
+                maxLength: 1024
+                type: string
+              response:
+                description: |-
+                  Response stores a bounded JSON response for idempotent replay. Large
+                  response bodies should remain in the artifact store and be referenced by
+                  a compact receipt instead.
+                x-kubernetes-preserve-unknown-fields: true
+              responseDigest:
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              state:
+                description: |-
+                  ExternalEffectControlState is the durable state of one idempotent operation
+                  performed outside the controller's SQLite transaction boundary.
+                enum:
+                - Pending
+                - InFlight
+                - Succeeded
+                - Failed
+                - OutcomeUnknown
+                type: string
+              updatedAt:
+                description: UpdatedAt is the normalized logical mutation time.
+                format: date-time
+                type: string
+              version:
+                description: |-
+                  Version is the monotonic domain CAS version. It advances once for each
+                  successfully persisted logical mutation.
+                format: int64
+                minimum: 1
+                type: integer
+            type: object
+            x-kubernetes-validations:
+            - message: in-flight external effects require a lease owner and expiry
+              rule: '!has(self.state) || self.state != ''InFlight'' || (has(self.leaseOwner)
+                && size(self.leaseOwner) > 0 && has(self.leaseExpiresAt))'
+            - message: non-in-flight external effects must clear lease fields
+              rule: '!has(self.state) || self.state == ''InFlight'' || ((!has(self.leaseOwner)
+                || size(self.leaseOwner) == 0) && !has(self.leaseExpiresAt))'
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/config/crd/bases/core.orka.ai_promptattempts.yaml b/config/crd/bases/core.orka.ai_promptattempts.yaml
new file mode 100644
index 000000000..e2781f0cc
--- /dev/null
+++ b/config/crd/bases/core.orka.ai_promptattempts.yaml
@@ -0,0 +1,280 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: promptattempts.core.orka.ai
+spec:
+  group: core.orka.ai
+  names:
+    kind: PromptAttempt
+    listKind: PromptAttemptList
+    plural: promptattempts
+    shortNames:
+    - pattempt
+    singular: promptattempt
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.executionState
+      name: Execution
+      type: string
+    - jsonPath: .status.deliveryState
+      name: Delivery
+      type: string
+    - jsonPath: .spec.attempt
+      name: Attempt
+      type: integer
+    - jsonPath: .status.version
+      name: Version
+      type: integer
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: |-
+          PromptAttempt is the Kubernetes-authoritative prompt execution and delivery
+          control record.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: |-
+              PromptAttemptSpec is the immutable identity and request binding for one
+              Task prompt attempt.
+            properties:
+              attempt:
+                description: Attempt is the one-based Task attempt number.
+                format: int64
+                minimum: 1
+                type: integer
+              bindingDigest:
+                description: |-
+                  BindingDigest identifies the immutable Task-lifetime v2 execution
+                  binding. It is optional only so pre-coexistence records remain readable;
+                  all PromptAttempts newly created through DurableControlStore require it.
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              credentialBindings:
+                description: CredentialBindings is the immutable, role-separated Secret
+                  identity set.
+                items:
+                  description: |-
+                    PromptCredentialBinding freezes one role-specific Secret identity without
+                    storing credential material.
+                  properties:
+                    namespace:
+                      maxLength: 253
+                      minLength: 1
+                      type: string
+                    resourceVersion:
+                      maxLength: 253
+                      minLength: 1
+                      type: string
+                    role:
+                      enum:
+                      - SourceRead
+                      - TargetRead
+                      - TargetWrite
+                      - Forge
+                      type: string
+                    secretKey:
+                      maxLength: 253
+                      minLength: 1
+                      type: string
+                    secretName:
+                      maxLength: 253
+                      minLength: 1
+                      type: string
+                    secretUid:
+                      maxLength: 253
+                      minLength: 1
+                      type: string
+                  required:
+                  - namespace
+                  - resourceVersion
+                  - role
+                  - secretKey
+                  - secretName
+                  - secretUid
+                  type: object
+                maxItems: 4
+                type: array
+                x-kubernetes-list-map-keys:
+                - role
+                x-kubernetes-list-type: map
+              id:
+                description: ID is the canonical DurableControlStore prompt-attempt
+                  ID.
+                maxLength: 1024
+                minLength: 1
+                type: string
+              promptId:
+                description: PromptID is the immutable prompt identity within the
+                  attempt.
+                maxLength: 1024
+                minLength: 1
+                type: string
+              requestDigest:
+                description: RequestDigest binds the prompt identity to exact canonical
+                  input.
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              snapshotDigest:
+                description: |-
+                  SnapshotDigest identifies the immutable encrypted execution snapshot.
+                  It is optional only so pre-coexistence records remain readable; all
+                  PromptAttempts newly created through DurableControlStore require it.
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              taskUid:
+                description: TaskUID is the immutable Kubernetes UID of the Task.
+                maxLength: 1024
+                minLength: 1
+                type: string
+            required:
+            - attempt
+            - id
+            - promptId
+            - requestDigest
+            - taskUid
+            type: object
+            x-kubernetes-validations:
+            - message: prompt attempt spec is immutable
+              rule: self == oldSelf
+            - message: bindingDigest and snapshotDigest must be recorded together
+              rule: has(self.bindingDigest) == has(self.snapshotDigest)
+          status:
+            description: PromptAttemptStatus holds the exact execution and delivery
+              state machines.
+            properties:
+              controllerEpoch:
+                description: ControllerEpoch is the exact epoch that performed the
+                  last mutation.
+                format: int64
+                minimum: 1
+                type: integer
+              controllerEpochLeaseResourceVersion:
+                description: |-
+                  ControllerEpochLeaseResourceVersion is the resourceVersion of the
+                  authoritative controller-epoch Lease observed by the mutation.
+                maxLength: 64
+                type: string
+              controllerEpochName:
+                description: |-
+                  ControllerEpochName identifies the controller epoch domain checked before
+                  the mutation.
+                maxLength: 253
+                type: string
+              createdAt:
+                description: CreatedAt is the normalized logical creation time.
+                format: date-time
+                type: string
+              deliveryState:
+                description: PromptAttemptDeliveryState is the durable delivery state
+                  for one prompt.
+                enum:
+                - NotRequested
+                - Validating
+                - Preparing
+                - Prepared
+                - Publishing
+                - Verifying
+                - VerifiedExact
+                - DeliveredSuperseded
+                - ReadValidated
+                - NoChange
+                - CancelledBeforePublish
+                - ReadOnlyWorkspaceModified
+                - DeliveryConflict
+                - CredentialBlocked
+                - PublicationOutcomeUnknown
+                type: string
+              executionState:
+                description: PromptAttemptExecutionState is the durable prompt execution
+                  state.
+                enum:
+                - Queued
+                - Reserved
+                - SessionStarting
+                - Planned
+                - Submitting
+                - SubmittedUnknown
+                - Accepted
+                - Running
+                - Settling
+                - Succeeded
+                - Failed
+                - Cancelled
+                - OutcomeUnknown
+                type: string
+              lastOperationDigest:
+                description: LastOperationDigest binds LastOperationID to exact canonical
+                  input.
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              lastOperationId:
+                description: LastOperationID is the last idempotent mutation identity
+                  applied.
+                maxLength: 1024
+                type: string
+              outcomeMarker:
+                maxLength: 16384
+                type: string
+              runtimeInstanceId:
+                description: RuntimeInstanceID is immutable after first binding.
+                maxLength: 1024
+                type: string
+              sessionLeaseGeneration:
+                description: SessionLeaseGeneration is immutable after first binding.
+                format: int64
+                minimum: 1
+                type: integer
+              sessionUid:
+                description: SessionUID is immutable after first binding.
+                maxLength: 1024
+                type: string
+              terminalReason:
+                maxLength: 16384
+                type: string
+              updatedAt:
+                description: UpdatedAt is the normalized logical mutation time.
+                format: date-time
+                type: string
+              version:
+                description: |-
+                  Version is the monotonic domain CAS version. It advances once for each
+                  successfully persisted logical mutation.
+                format: int64
+                minimum: 1
+                type: integer
+            type: object
+            x-kubernetes-validations:
+            - message: OutcomeUnknown requires an explicit outcome marker
+              rule: '!has(self.executionState) || self.executionState != ''OutcomeUnknown''
+                || (has(self.outcomeMarker) && size(self.outcomeMarker) > 0)'
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/config/crd/bases/core.orka.ai_publications.yaml b/config/crd/bases/core.orka.ai_publications.yaml
new file mode 100644
index 000000000..0b921bca9
--- /dev/null
+++ b/config/crd/bases/core.orka.ai_publications.yaml
@@ -0,0 +1,529 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: publications.core.orka.ai
+spec:
+  group: core.orka.ai
+  names:
+    kind: Publication
+    listKind: PublicationList
+    plural: publications
+    shortNames:
+    - pubctl
+    singular: publication
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.state
+      name: State
+      type: string
+    - jsonPath: .spec.generation
+      name: Generation
+      type: integer
+    - jsonPath: .spec.targetRef
+      name: Target
+      type: string
+    - jsonPath: .status.version
+      name: Version
+      type: integer
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: Publication is the Kubernetes-authoritative clean-room publication
+          record.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: |-
+              PublicationSpec is the immutable clean-room publication identity and input.
+              Mutable receipts and forge intent live only in status.
+            properties:
+              artifactDigest:
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              artifactId:
+                description: ArtifactID identifies the durable content-addressed change
+                  artifact.
+                maxLength: 1024
+                minLength: 1
+                type: string
+              artifactMediaType:
+                maxLength: 255
+                minLength: 1
+                type: string
+              artifactSizeBytes:
+                format: int64
+                minimum: 1
+                type: integer
+              attempt:
+                format: int64
+                minimum: 1
+                type: integer
+              baseline:
+                description: |-
+                  ControlRemoteRefState is an exact remote-ref observation. Absent and SHA are
+                  mutually exclusive. The all-zero value is reserved for an explicitly unknown
+                  observation in PublicationOutcomeUnknown receipts.
+                properties:
+                  absent:
+                    type: boolean
+                  sha:
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                required:
+                - absent
+                type: object
+                x-kubernetes-validations:
+                - message: absent and sha are mutually exclusive
+                  rule: '!(self.absent && has(self.sha) && size(self.sha) > 0)'
+              branchClaimGeneration:
+                format: int64
+                minimum: 1
+                type: integer
+              branchClaimId:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              commitIdentity:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              commitMessage:
+                maxLength: 16384
+                minLength: 1
+                type: string
+              commitTimestamp:
+                format: date-time
+                type: string
+              generation:
+                format: int64
+                minimum: 1
+                type: integer
+              id:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              promptId:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              publicationCredentialRef:
+                description: |-
+                  PublicationCredentialRef identifies an operation-scoped Secret reference;
+                  it never contains credential material.
+                maxLength: 1024
+                minLength: 1
+                type: string
+              requestDigest:
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              sessionUid:
+                maxLength: 1024
+                type: string
+              sourceBaselineSha:
+                pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                type: string
+              sourceRef:
+                description: SourceRef is the exact immutable source ref or revision
+                  selector.
+                maxLength: 1024
+                minLength: 1
+                type: string
+              sourceRepositoryId:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              targetRef:
+                maxLength: 1024
+                pattern: ^refs/heads/.+$
+                type: string
+              targetRepositoryId:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              taskUid:
+                maxLength: 1024
+                minLength: 1
+                type: string
+            required:
+            - artifactDigest
+            - artifactId
+            - artifactMediaType
+            - artifactSizeBytes
+            - attempt
+            - baseline
+            - branchClaimGeneration
+            - branchClaimId
+            - commitIdentity
+            - commitMessage
+            - commitTimestamp
+            - generation
+            - id
+            - promptId
+            - publicationCredentialRef
+            - requestDigest
+            - sourceBaselineSha
+            - sourceRef
+            - sourceRepositoryId
+            - targetRef
+            - targetRepositoryId
+            - taskUid
+            type: object
+            x-kubernetes-validations:
+            - message: publication spec is immutable
+              rule: self == oldSelf
+          status:
+            description: PublicationStatus contains mutable state, exact receipts,
+              and epoch fencing.
+            properties:
+              controllerEpoch:
+                description: ControllerEpoch is the exact epoch that performed the
+                  last mutation.
+                format: int64
+                minimum: 1
+                type: integer
+              controllerEpochLeaseResourceVersion:
+                description: |-
+                  ControllerEpochLeaseResourceVersion is the resourceVersion of the
+                  authoritative controller-epoch Lease observed by the mutation.
+                maxLength: 64
+                type: string
+              controllerEpochName:
+                description: |-
+                  ControllerEpochName identifies the controller epoch domain checked before
+                  the mutation.
+                maxLength: 253
+                type: string
+              createdAt:
+                description: CreatedAt is the normalized logical creation time.
+                format: date-time
+                type: string
+              lastOperationDigest:
+                description: LastOperationDigest binds LastOperationID to exact canonical
+                  input.
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              lastOperationId:
+                description: LastOperationID is the last idempotent mutation identity
+                  applied.
+                maxLength: 1024
+                type: string
+              prIntent:
+                description: |-
+                  PublicationPullRequestIntent is the exact forge tuple persisted before the
+                  first forge API call.
+                properties:
+                  baseRef:
+                    maxLength: 1024
+                    pattern: ^refs/heads/.+$
+                    type: string
+                  baseRepositoryId:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  expectedHeadSha:
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                  headRef:
+                    maxLength: 1024
+                    pattern: ^refs/heads/.+$
+                    type: string
+                  headRepositoryId:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  publicationGeneration:
+                    format: int64
+                    minimum: 1
+                    type: integer
+                required:
+                - baseRef
+                - baseRepositoryId
+                - expectedHeadSha
+                - headRef
+                - headRepositoryId
+                - publicationGeneration
+                type: object
+              preparedReceipt:
+                description: PreparedPublicationControlReceipt records deterministic
+                  commit preparation.
+                properties:
+                  bundleArtifactId:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  bundleDigest:
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  bundleMediaType:
+                    maxLength: 255
+                    minLength: 1
+                    type: string
+                  bundleRef:
+                    pattern: ^refs/orka/publications/[a-f0-9]{64}$
+                    type: string
+                  bundleSizeBytes:
+                    format: int64
+                    minimum: 1
+                    type: integer
+                  commitSha:
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                  manifestDigest:
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  operationId:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  preparedAt:
+                    format: date-time
+                    type: string
+                  relativeRoot:
+                    description: |-
+                      RelativeRoot is the canonical repository-relative workspace root applied
+                      to every path in the immutable delta artifact.
+                    maxLength: 1024
+                    type: string
+                  requestDigest:
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  treeSha:
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                required:
+                - bundleArtifactId
+                - bundleDigest
+                - bundleMediaType
+                - bundleRef
+                - bundleSizeBytes
+                - commitSha
+                - manifestDigest
+                - operationId
+                - preparedAt
+                - requestDigest
+                - treeSha
+                type: object
+              publishReceipt:
+                description: PublishOperationControlReceipt records the exact server-enforced
+                  ref CAS.
+                properties:
+                  acknowledgementUnknown:
+                    type: boolean
+                  expectedCommitSha:
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                  operationId:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  publishedAt:
+                    format: date-time
+                    type: string
+                  remoteBefore:
+                    description: |-
+                      ControlRemoteRefState is an exact remote-ref observation. Absent and SHA are
+                      mutually exclusive. The all-zero value is reserved for an explicitly unknown
+                      observation in PublicationOutcomeUnknown receipts.
+                    properties:
+                      absent:
+                        type: boolean
+                      sha:
+                        pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                        type: string
+                    required:
+                    - absent
+                    type: object
+                    x-kubernetes-validations:
+                    - message: absent and sha are mutually exclusive
+                      rule: '!(self.absent && has(self.sha) && size(self.sha) > 0)'
+                  requestDigest:
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  targetRef:
+                    maxLength: 1024
+                    pattern: ^refs/heads/.+$
+                    type: string
+                  targetRepositoryId:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                required:
+                - acknowledgementUnknown
+                - expectedCommitSha
+                - operationId
+                - publishedAt
+                - remoteBefore
+                - requestDigest
+                - targetRef
+                - targetRepositoryId
+                type: object
+              pullRequestReceipt:
+                description: PullRequestOperationControlReceipt snapshots exact forge
+                  reconciliation.
+                properties:
+                  forgeId:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  headSha:
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                  intentKey:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  operationId:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  reconciledAt:
+                    format: date-time
+                    type: string
+                  requestDigest:
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  state:
+                    maxLength: 128
+                    minLength: 1
+                    type: string
+                  url:
+                    maxLength: 2048
+                    minLength: 1
+                    type: string
+                required:
+                - forgeId
+                - headSha
+                - intentKey
+                - operationId
+                - reconciledAt
+                - requestDigest
+                - state
+                - url
+                type: object
+              state:
+                description: PublicationControlState is the clean-room publication
+                  state machine.
+                enum:
+                - Preparing
+                - Prepared
+                - Publishing
+                - Verifying
+                - VerifiedExact
+                - DeliveredSuperseded
+                - CancelledBeforePublish
+                - DeliveryConflict
+                - CredentialBlocked
+                - PreparationFailed
+                - PublicationOutcomeUnknown
+                type: string
+              terminalReason:
+                maxLength: 16384
+                type: string
+              updatedAt:
+                description: UpdatedAt is the normalized logical mutation time.
+                format: date-time
+                type: string
+              verificationReceipt:
+                description: PublicationVerificationControlReceipt is an independent
+                  remote observation.
+                properties:
+                  descendantProofDigest:
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  expectedCommitSha:
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                  observedRemote:
+                    description: |-
+                      ControlRemoteRefState is an exact remote-ref observation. Absent and SHA are
+                      mutually exclusive. The all-zero value is reserved for an explicitly unknown
+                      observation in PublicationOutcomeUnknown receipts.
+                    properties:
+                      absent:
+                        type: boolean
+                      sha:
+                        pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                        type: string
+                    required:
+                    - absent
+                    type: object
+                    x-kubernetes-validations:
+                    - message: absent and sha are mutually exclusive
+                      rule: '!(self.absent && has(self.sha) && size(self.sha) > 0)'
+                  operationId:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  outcome:
+                    description: PublicationControlState is the clean-room publication
+                      state machine.
+                    enum:
+                    - Preparing
+                    - Prepared
+                    - Publishing
+                    - Verifying
+                    - VerifiedExact
+                    - DeliveredSuperseded
+                    - CancelledBeforePublish
+                    - DeliveryConflict
+                    - CredentialBlocked
+                    - PreparationFailed
+                    - PublicationOutcomeUnknown
+                    type: string
+                  requestDigest:
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  verifiedAt:
+                    format: date-time
+                    type: string
+                required:
+                - expectedCommitSha
+                - observedRemote
+                - operationId
+                - outcome
+                - requestDigest
+                - verifiedAt
+                type: object
+              version:
+                description: |-
+                  Version is the monotonic domain CAS version. It advances once for each
+                  successfully persisted logical mutation.
+                format: int64
+                minimum: 1
+                type: integer
+            type: object
+            x-kubernetes-validations:
+            - message: failure and unknown publication states require a terminal reason
+              rule: '!has(self.state) || !(self.state in [''DeliveryConflict'', ''CredentialBlocked'',
+                ''PreparationFailed'', ''PublicationOutcomeUnknown'']) || (has(self.terminalReason)
+                && size(self.terminalReason) > 0)'
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/config/crd/bases/core.orka.ai_repositorymonitors.yaml b/config/crd/bases/core.orka.ai_repositorymonitors.yaml
index 9e2d52ca6..8dabeb7e0 100644
--- a/config/crd/bases/core.orka.ai_repositorymonitors.yaml
+++ b/config/crd/bases/core.orka.ai_repositorymonitors.yaml
@@ -176,9 +176,28 @@ spec:
                 description: Branch is the default base branch for repository-wide
                   monitoring decisions.
                 type: string
+              forgeCredentialRef:
+                description: |-
+                  ForgeCredentialRef references the GitHub API credential used only for
+                  controller-owned forge reads and mutations. Write workflows and GitHub label
+                  triggers require this explicit reference.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
               gitSecretRef:
-                description: GitSecretRef references GitHub credentials for repository
-                  monitor operations.
+                description: |-
+                  GitSecretRef is the backward-compatible source-read credential reference.
+                  ReadCredentialRef takes precedence when both are set. GitSecretRef is never
+                  used for publication writes or forge mutations.
                 properties:
                   name:
                     default: ""
@@ -329,6 +348,57 @@ spec:
                 enum:
                 - github
                 type: string
+              publicationCredentialRef:
+                description: |-
+                  PublicationCredentialRef references the target-repository write credential
+                  used only for exact compare-and-swap publication. Write workflows require
+                  this explicit reference.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
+              publicationReadCredentialRef:
+                description: |-
+                  PublicationReadCredentialRef references the target-repository read
+                  credential used only for publication preflight and independent verification.
+                  Write workflows require this explicit reference.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
+              readCredentialRef:
+                description: |-
+                  ReadCredentialRef references the source-repository clone/read credential.
+                  It is resolved only by the clean-room workspace boundary. When omitted,
+                  GitSecretRef remains the backward-compatible read-only fallback.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
               repair:
                 description: Repair controls bounded repair behavior.
                 properties:
diff --git a/config/crd/bases/core.orka.ai_repositoryscans.yaml b/config/crd/bases/core.orka.ai_repositoryscans.yaml
index 776b58b50..d66b61335 100644
--- a/config/crd/bases/core.orka.ai_repositoryscans.yaml
+++ b/config/crd/bases/core.orka.ai_repositoryscans.yaml
@@ -103,12 +103,32 @@ spec:
                 required:
                 - name
                 type: object
+              forgeCredentialRef:
+                description: |-
+                  ForgeCredentialRef references the GitHub API credential used only for
+                  controller-owned pull request reconciliation. Patch workflows require this
+                  explicit reference.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
               forkRepo:
                 description: ForkRepo is the writable fork repository URL used for
                   patch proposals.
                 type: string
               gitSecretRef:
-                description: GitSecretRef references git credentials for private repositories.
+                description: |-
+                  GitSecretRef is the backward-compatible source-read credential reference.
+                  ReadCredentialRef takes precedence when both are set. GitSecretRef is never
+                  used for publication writes or forge mutations.
                 properties:
                   name:
                     default: ""
@@ -156,6 +176,57 @@ spec:
                 enum:
                 - github
                 type: string
+              publicationCredentialRef:
+                description: |-
+                  PublicationCredentialRef references the target-repository write credential
+                  used only for exact compare-and-swap publication. Patch workflows require
+                  this explicit reference.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
+              publicationReadCredentialRef:
+                description: |-
+                  PublicationReadCredentialRef references the target-repository read
+                  credential used only for publication preflight and independent verification.
+                  Patch workflows require this explicit reference.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
+              readCredentialRef:
+                description: |-
+                  ReadCredentialRef references the source-repository clone/read credential.
+                  It is resolved only by the clean-room workspace boundary. When omitted,
+                  GitSecretRef remains the backward-compatible read-only fallback.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
               ref:
                 description: Ref is a specific git ref, tag, or commit SHA to checkout
                   for scan tasks.
diff --git a/config/crd/bases/core.orka.ai_runtimepools.yaml b/config/crd/bases/core.orka.ai_runtimepools.yaml
new file mode 100644
index 000000000..60b385f92
--- /dev/null
+++ b/config/crd/bases/core.orka.ai_runtimepools.yaml
@@ -0,0 +1,666 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: runtimepools.core.orka.ai
+spec:
+  group: core.orka.ai
+  names:
+    kind: RuntimePool
+    listKind: RuntimePoolList
+    plural: runtimepools
+    shortNames:
+    - rtpool
+    singular: runtimepool
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.lifecycle
+      name: Lifecycle
+      type: string
+    - jsonPath: .status.admissionState
+      name: Admission
+      type: string
+    - jsonPath: .status.desiredReplicas
+      name: Desired
+      type: integer
+    - jsonPath: .status.currentReplicas
+      name: Current
+      type: integer
+    - jsonPath: .status.capacity.residentSessions
+      name: Sessions
+      type: integer
+    - jsonPath: .status.capacity.runningPrompts
+      name: Prompts
+      type: integer
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: RuntimePool is the Schema for controller-owned ACP runtime pools.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: |-
+              RuntimePoolSpec defines the desired state of a controller-owned logical pool.
+              Trust-domain placement and the runtime image/profile are immutable; rollout
+              uses drain-and-replace rather than changing an in-memory instance in place.
+            properties:
+              capacity:
+                default:
+                  maxResidentSessions: 10
+                  maxRunningPrompts: 4
+                description: Capacity sets resident-session and running-prompt limits.
+                properties:
+                  maxResidentSessions:
+                    default: 10
+                    description: MaxResidentSessions is the maximum number of resident
+                      RuntimeSessions.
+                    format: int32
+                    maximum: 1000
+                    minimum: 1
+                    type: integer
+                  maxRunningPrompts:
+                    default: 4
+                    description: MaxRunningPrompts is the maximum number of concurrently
+                      running prompts.
+                    format: int32
+                    maximum: 1000
+                    minimum: 1
+                    type: integer
+                type: object
+                x-kubernetes-validations:
+                - message: maxRunningPrompts cannot exceed maxResidentSessions
+                  rule: self.maxRunningPrompts <= self.maxResidentSessions
+              coldStartTimeoutSeconds:
+                default: 120
+                description: ColdStartTimeoutSeconds bounds a 0 -> 1 startup before
+                  the pool is marked degraded.
+                format: int32
+                maximum: 3600
+                minimum: 1
+                type: integer
+              desiredReplicas:
+                default: 0
+                description: |-
+                  DesiredReplicas is zero or one. More than one runtime Pod would make
+                  stateful exact-instance routing ambiguous.
+                format: int32
+                maximum: 1
+                minimum: 0
+                type: integer
+              runtime:
+                description: Runtime pins the immutable supervisor image and behavior
+                  profile.
+                properties:
+                  image:
+                    description: Image is a digest-pinned OCI image. Mutable tags
+                      are intentionally rejected.
+                    maxLength: 2048
+                    pattern: ^[^\s@]+@sha256:[a-f0-9]{64}$
+                    type: string
+                  profile:
+                    description: Profile is the immutable runtime profile enforced
+                      for every active instance.
+                    properties:
+                      acpProfile:
+                        description: ACPProfile is the reviewed ACP wire/profile identifier.
+                        enum:
+                        - acp.v1
+                        type: string
+                      adapterDigests:
+                        additionalProperties:
+                          type: string
+                        description: AdapterDigests pins every adapter and provider
+                          CLI artifact used by the pool.
+                        maxProperties: 32
+                        minProperties: 1
+                        type: object
+                      agentConfigurationDigest:
+                        description: AgentConfigurationDigest freezes non-secret Agent/runtime
+                          configuration.
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      approvalPolicyDigest:
+                        description: ApprovalPolicyDigest freezes the effective approval
+                          policy.
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      digest:
+                        description: Digest is the canonical immutable runtime-profile
+                          digest.
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      digestSchemaVersion:
+                        description: DigestSchemaVersion identifies the canonicalization
+                          schema used to compute Digest.
+                        maxLength: 64
+                        minLength: 1
+                        pattern: ^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$
+                        type: string
+                      mcpConfigurationDigest:
+                        description: MCPConfigurationDigest freezes prompt-scoped
+                          broker/MCP configuration.
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      model:
+                        description: Model is the exact reviewed model identifier.
+                        maxLength: 256
+                        minLength: 1
+                        type: string
+                      modelLimits:
+                        description: |-
+                          ModelLimits pins the reviewed context and output capacities used by the
+                          runtime's local compaction policy.
+                        properties:
+                          context:
+                            description: Context is the maximum model context capacity
+                              in tokens.
+                            format: int64
+                            minimum: 1
+                            type: integer
+                          output:
+                            description: Output is the maximum generated output in
+                              tokens.
+                            format: int64
+                            minimum: 1
+                            type: integer
+                        required:
+                        - context
+                        - output
+                        type: object
+                        x-kubernetes-validations:
+                        - message: model context limit must exceed output limit
+                          rule: self.context > self.output
+                      protocolVersion:
+                        default: orka.harness.v2
+                        description: ProtocolVersion is the controller-to-supervisor
+                          protocol profile.
+                        enum:
+                        - orka.harness.v2
+                        type: string
+                      providerKind:
+                        description: ProviderKind selects the one provider adapter
+                          present in the immutable image.
+                        enum:
+                        - codex
+                        - claude
+                        - copilot
+                        - opencode
+                        type: string
+                      proxyCredentialRole:
+                        description: ProxyCredentialRole identifies the provider-proxy
+                          client role, never a secret value.
+                        maxLength: 256
+                        minLength: 1
+                        type: string
+                      proxyCredentialScope:
+                        description: ProxyCredentialScope is the bounded model/session
+                          capability scope.
+                        maxLength: 1024
+                        minLength: 1
+                        type: string
+                      resourceClass:
+                        description: ResourceClass is the controller-supported pool
+                          resource class included in Digest.
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9.]*[a-z0-9])?$
+                        type: string
+                      toolPolicyDigest:
+                        description: ToolPolicyDigest freezes the effective tool allow/deny
+                          policy.
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      workspaceIntent:
+                        description: WorkspaceIntent is part of the immutable runtime
+                          profile.
+                        enum:
+                        - read
+                        - write
+                        type: string
+                    required:
+                    - acpProfile
+                    - adapterDigests
+                    - agentConfigurationDigest
+                    - approvalPolicyDigest
+                    - digest
+                    - digestSchemaVersion
+                    - mcpConfigurationDigest
+                    - model
+                    - providerKind
+                    - proxyCredentialRole
+                    - proxyCredentialScope
+                    - resourceClass
+                    - toolPolicyDigest
+                    - workspaceIntent
+                    type: object
+                    x-kubernetes-validations:
+                    - message: OpenCode runtime profiles require modelLimits
+                      rule: self.providerKind != 'opencode' || has(self.modelLimits)
+                required:
+                - image
+                - profile
+                type: object
+              runtimeNamespace:
+                description: |-
+                  RuntimeNamespace is the physical namespace for controller-owned runtime
+                  resources. When omitted, the controller selects its configured runtime namespace.
+                maxLength: 63
+                pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                type: string
+              trustDomain:
+                description: TrustDomain is the logical namespace/identity boundary
+                  served by this pool.
+                properties:
+                  identity:
+                    description: |-
+                      Identity is the controller-defined, canonical trust-domain identity. It
+                      must remain stable across physical runtime namespace or Pod replacement.
+                    maxLength: 253
+                    minLength: 1
+                    type: string
+                  namespace:
+                    description: Namespace is the Task namespace represented by this
+                      trust domain.
+                    maxLength: 63
+                    minLength: 1
+                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                    type: string
+                required:
+                - identity
+                - namespace
+                type: object
+            required:
+            - runtime
+            - trustDomain
+            type: object
+            x-kubernetes-validations:
+            - message: trustDomain is immutable
+              rule: self.trustDomain == oldSelf.trustDomain
+            - message: runtimeNamespace is immutable
+              rule: has(self.runtimeNamespace) == has(oldSelf.runtimeNamespace) &&
+                (!has(self.runtimeNamespace) || self.runtimeNamespace == oldSelf.runtimeNamespace)
+            - message: runtime image and profile are immutable
+              rule: self.runtime == oldSelf.runtime
+          status:
+            description: RuntimePoolStatus defines the observed state of a controller-owned
+              pool.
+            properties:
+              activeInstance:
+                description: |-
+                  ActiveInstance is the exact selected Pod and supervisor boot. It is empty
+                  unless one instance has been authoritatively selected.
+                properties:
+                  bootID:
+                    description: BootID is the immutable supervisor boot identifier
+                      inside the selected Pod.
+                    maxLength: 128
+                    minLength: 1
+                    type: string
+                  controllerEpoch:
+                    description: ControllerEpoch is the durable controller epoch to
+                      which this instance is bound.
+                    format: int64
+                    minimum: 1
+                    type: integer
+                  lastObservedTime:
+                    description: LastObservedTime is the last authenticated status
+                      observation for this instance.
+                    format: date-time
+                    type: string
+                  podAddress:
+                    description: |-
+                      PodAddress is the exact Pod address used for stateful routing, not a
+                      load-balanced Service endpoint.
+                    maxLength: 253
+                    minLength: 1
+                    type: string
+                  podName:
+                    description: PodName is the exact selected runtime Pod name.
+                    maxLength: 253
+                    minLength: 1
+                    type: string
+                  podNamespace:
+                    description: PodNamespace is the namespace containing the selected
+                      runtime Pod.
+                    maxLength: 63
+                    minLength: 1
+                    type: string
+                  podUID:
+                    description: PodUID is the Kubernetes UID of the selected Pod.
+                    maxLength: 128
+                    minLength: 1
+                    type: string
+                  profileDigest:
+                    description: ProfileDigest is the immutable runtime-profile digest
+                      advertised by this instance.
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  profileDigestSchemaVersion:
+                    description: ProfileDigestSchemaVersion is the digest schema advertised
+                      by this instance.
+                    maxLength: 64
+                    minLength: 1
+                    type: string
+                  protocolVersion:
+                    description: ProtocolVersion is the supervisor protocol actually
+                      advertised by this instance.
+                    enum:
+                    - orka.harness.v2
+                    type: string
+                  providerTokenGeneration:
+                    description: |-
+                      ProviderTokenGeneration is a non-secret digest generation for the exact
+                      provider capability mounted into this runtime Pod. It lets the controller
+                      prove that a selected instance converged on the intended proxy credential
+                      without exposing the bearer token.
+                    pattern: ^[a-f0-9]{16}$
+                    type: string
+                  runtimeInstanceID:
+                    description: RuntimeInstanceID is the portable v2 instance fence
+                      derived from PodUID and BootID.
+                    maxLength: 253
+                    minLength: 1
+                    type: string
+                required:
+                - bootID
+                - controllerEpoch
+                - podAddress
+                - podName
+                - podNamespace
+                - podUID
+                - profileDigest
+                - profileDigestSchemaVersion
+                - protocolVersion
+                - providerTokenGeneration
+                - runtimeInstanceID
+                type: object
+              admissionState:
+                description: AdmissionState is the authoritative admission gate for
+                  new RuntimeSessions.
+                enum:
+                - Closed
+                - Accepting
+                - Draining
+                - Ambiguous
+                type: string
+              capacity:
+                description: Capacity reports effective limits, use, and queued demand.
+                properties:
+                  finalizingSessions:
+                    description: FinalizingSessions is the count reserved for validation,
+                      publication, or finalization.
+                    format: int32
+                    minimum: 0
+                    type: integer
+                  liveDescendants:
+                    description: LiveDescendants is the authenticated count of tracked
+                      runtime descendants.
+                    format: int32
+                    minimum: 0
+                    type: integer
+                  maxResidentSessions:
+                    description: MaxResidentSessions is the effective configured resident-session
+                      limit.
+                    format: int32
+                    minimum: 0
+                    type: integer
+                  maxRunningPrompts:
+                    description: MaxRunningPrompts is the effective configured running-prompt
+                      limit.
+                    format: int32
+                    minimum: 0
+                    type: integer
+                  pendingPermissions:
+                    description: PendingPermissions is the authenticated count of
+                      unresolved prompt permissions.
+                    format: int32
+                    minimum: 0
+                    type: integer
+                  queuedTasks:
+                    description: QueuedTasks is durable unsatisfied demand assigned
+                      to this pool.
+                    format: int32
+                    minimum: 0
+                    type: integer
+                  reservations:
+                    description: |-
+                      Reservations is the bounded authoritative set of coordinator-owned
+                      pre-admission capacity claims.
+                    items:
+                      description: |-
+                        RuntimePoolCapacityReservationStatus is one durable, exact-instance capacity
+                        claim. The composite key is the pool UID, Task UID, attempt, and controller
+                        epoch. A reservation claims resident-session and prompt admission slots until
+                        the supervisor accepts the corresponding work or the reservation expires.
+                      properties:
+                        attempt:
+                          description: Attempt is the Task attempt that owns the claim.
+                          format: int32
+                          minimum: 1
+                          type: integer
+                        controllerEpoch:
+                          description: ControllerEpoch fences the claim to one controller
+                            leadership epoch.
+                          format: int64
+                          minimum: 1
+                          type: integer
+                        expiresAt:
+                          description: |-
+                            ExpiresAt is renewed while pre-admission work is active. A later
+                            dispatcher may reclaim the claim after this time.
+                          format: date-time
+                          type: string
+                        poolUID:
+                          description: PoolUID fences the claim to the exact RuntimePool
+                            object.
+                          maxLength: 128
+                          minLength: 1
+                          type: string
+                        promptSlots:
+                          description: PromptSlots is one until the prompt is accepted
+                            by the supervisor.
+                          format: int32
+                          maximum: 1
+                          minimum: 0
+                          type: integer
+                        reservedAt:
+                          description: ReservedAt is the first successful resource-version
+                            CAS for this claim.
+                          format: date-time
+                          type: string
+                        residentSlots:
+                          description: |-
+                            ResidentSlots is zero after a RuntimeSession is admitted and one while a
+                            new resident-session slot is still reserved.
+                          format: int32
+                          maximum: 1
+                          minimum: 0
+                          type: integer
+                        runtimeInstanceID:
+                          description: RuntimeInstanceID binds admission to the exact
+                            selected Pod/boot pair.
+                          maxLength: 253
+                          minLength: 1
+                          type: string
+                        taskUID:
+                          description: TaskUID is the immutable Task identity that
+                            owns the claim.
+                          maxLength: 128
+                          minLength: 1
+                          type: string
+                      required:
+                      - attempt
+                      - controllerEpoch
+                      - expiresAt
+                      - poolUID
+                      - promptSlots
+                      - reservedAt
+                      - residentSlots
+                      - runtimeInstanceID
+                      - taskUID
+                      type: object
+                      x-kubernetes-validations:
+                      - message: a capacity reservation must claim at least one slot
+                        rule: self.residentSlots + self.promptSlots > 0
+                    maxItems: 1000
+                    type: array
+                    x-kubernetes-list-map-keys:
+                    - poolUID
+                    - taskUID
+                    - attempt
+                    - controllerEpoch
+                    x-kubernetes-list-type: map
+                  reservedPrompts:
+                    description: ReservedPrompts is the sum of prompt slots in Reservations.
+                    format: int32
+                    minimum: 0
+                    type: integer
+                  reservedSessions:
+                    description: ReservedSessions is the sum of resident slots in
+                      Reservations.
+                    format: int32
+                    minimum: 0
+                    type: integer
+                  residentSessions:
+                    description: ResidentSessions is the authenticated supervisor
+                      count of resident sessions.
+                    format: int32
+                    minimum: 0
+                    type: integer
+                  runningPrompts:
+                    description: RunningPrompts is the authenticated supervisor count
+                      of active prompts.
+                    format: int32
+                    minimum: 0
+                    type: integer
+                type: object
+              conditions:
+                description: |-
+                  Conditions report admission, Pod Security, quota, scheduling, rollout, and
+                  other controller-observed failures.
+                items:
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              controllerEpoch:
+                description: ControllerEpoch is the durable epoch required for authoritative
+                  pool writes.
+                format: int64
+                minimum: 0
+                type: integer
+              currentReplicas:
+                description: CurrentReplicas is the number of non-terminated runtime
+                  Pods owned by the pool.
+                format: int32
+                minimum: 0
+                type: integer
+              desiredReplicas:
+                description: DesiredReplicas is the desired replica count observed
+                  by the controller.
+                format: int32
+                maximum: 1
+                minimum: 0
+                type: integer
+              lifecycle:
+                description: Lifecycle is the explicit pool lifecycle.
+                enum:
+                - Stopped
+                - Starting
+                - Serving
+                - Draining
+                - Quiescent
+                - Stopping
+                - Degraded
+                - Ambiguous
+                type: string
+              message:
+                description: Message contains bounded, sanitized reconciliation context.
+                maxLength: 1024
+                type: string
+              observedGeneration:
+                description: ObservedGeneration is the latest RuntimePool generation
+                  reconciled by the controller.
+                format: int64
+                type: integer
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/config/crd/bases/core.orka.ai_runtimesessioncontrols.yaml b/config/crd/bases/core.orka.ai_runtimesessioncontrols.yaml
new file mode 100644
index 000000000..eeac33fe3
--- /dev/null
+++ b/config/crd/bases/core.orka.ai_runtimesessioncontrols.yaml
@@ -0,0 +1,371 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: runtimesessioncontrols.core.orka.ai
+spec:
+  group: core.orka.ai
+  names:
+    kind: RuntimeSessionControl
+    listKind: RuntimeSessionControlList
+    plural: runtimesessioncontrols
+    shortNames:
+    - rsctrl
+    singular: runtimesessioncontrol
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.lifecycle
+      name: Lifecycle
+      type: string
+    - jsonPath: .status.availability
+      name: Availability
+      type: string
+    - jsonPath: .status.generation
+      name: Generation
+      type: integer
+    - jsonPath: .status.mutationLeaseGeneration
+      name: Lease
+      type: integer
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: |-
+          RuntimeSessionControl is the Kubernetes-authoritative RuntimeSession control
+          record. SessionTurn/transcript/deferred-outbox data remains in one durable
+          SQLite transaction; the Kubernetes store completes the authoritative
+          SessionControl/BranchClaim CAS before activating the terminal projection.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: |-
+              RuntimeSessionControlSpec contains immutable session identity, ownership, and
+              profile bindings. Profile changes create a new session generation in status;
+              they do not mutate this immutable record identity.
+            properties:
+              owner:
+                description: Owner identifies the immutable Task or durable Session
+                  owner.
+                properties:
+                  kind:
+                    enum:
+                    - Task
+                    - Session
+                    - RuntimePool
+                    - PromptAttempt
+                    type: string
+                  uid:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                required:
+                - kind
+                - uid
+                type: object
+              profileDigestSchemaVersion:
+                description: ProfileDigestSchemaVersion identifies how RuntimeProfileDigest
+                  was built.
+                maxLength: 64
+                type: string
+              requestDigest:
+                description: RequestDigest binds creation to exact canonical input.
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              runtimePoolRef:
+                description: RuntimePoolRef is the controller-owned logical pool name
+                  when known.
+                maxLength: 253
+                type: string
+              runtimePoolUid:
+                description: RuntimePoolUID fences the pool object across delete/recreate.
+                maxLength: 1024
+                type: string
+              runtimeProfileDigest:
+                description: RuntimeProfileDigest binds the session to immutable runtime
+                  behavior.
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              sessionName:
+                description: |-
+                  SessionName is the immutable user-visible Session key within the object
+                  namespace. The Kubernetes object name is a digest-derived storage key and
+                  must not be treated as the Session name.
+                maxLength: 1024
+                minLength: 1
+                type: string
+              sessionUid:
+                description: SessionUID is the immutable Orka Session identity.
+                maxLength: 1024
+                minLength: 1
+                type: string
+            required:
+            - owner
+            - requestDigest
+            - sessionName
+            - sessionUid
+            type: object
+            x-kubernetes-validations:
+            - message: runtime session control spec is immutable
+              rule: self == oldSelf
+          status:
+            description: |-
+              RuntimeSessionControlStatus contains the lifecycle, generation, mutation
+              Lease, and independently verified recovery baseline.
+            properties:
+              availability:
+                description: RuntimeSessionControlAvailability gates the Session mutation
+                  lease.
+                enum:
+                - Available
+                - ReconciliationBlocked
+                type: string
+              blockedReason:
+                maxLength: 16384
+                type: string
+              controllerEpoch:
+                description: ControllerEpoch is the exact epoch that performed the
+                  last mutation.
+                format: int64
+                minimum: 1
+                type: integer
+              controllerEpochLeaseResourceVersion:
+                description: |-
+                  ControllerEpochLeaseResourceVersion is the resourceVersion of the
+                  authoritative controller-epoch Lease observed by the mutation.
+                maxLength: 64
+                type: string
+              controllerEpochName:
+                description: |-
+                  ControllerEpochName identifies the controller epoch domain checked before
+                  the mutation.
+                maxLength: 253
+                type: string
+              createdAt:
+                description: CreatedAt is the normalized logical creation time.
+                format: date-time
+                type: string
+              generation:
+                description: Generation is the monotonic ACP RuntimeSession generation.
+                format: int64
+                minimum: 1
+                type: integer
+              lastOperationDigest:
+                description: LastOperationDigest binds LastOperationID to exact canonical
+                  input.
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              lastOperationId:
+                description: LastOperationID is the last idempotent mutation identity
+                  applied.
+                maxLength: 1024
+                type: string
+              lifecycle:
+                description: RuntimeSessionControlLifecycle is the durable RuntimeSession
+                  lifecycle.
+                enum:
+                - Creating
+                - Idle
+                - PromptRunning
+                - Validating
+                - PreparingPublication
+                - PublicationPrepared
+                - Publishing
+                - Verifying
+                - Finalizing
+                - Cancelling
+                - Poisoned
+                - Deleting
+                - Deleted
+                type: string
+              lineage:
+                description: |-
+                  Lineage is established or verified in the same RuntimeSessionControl
+                  status CAS that mirrors the authoritative mutation Lease.
+                properties:
+                  configDigest:
+                    description: |-
+                      ConfigDigest freezes the configuration/execution-snapshot identity used
+                      when the lineage was established.
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  contractVersion:
+                    description: |-
+                      AgentRuntimeContractVersion identifies the Orka-facing runtime contract.
+                      During harness coexistence both protocol values are schema-valid; omission is
+                      never protocol evidence and is tolerated only for stored objects awaiting the
+                      one-time bridge classification.
+                    enum:
+                    - orka.harness.v1
+                    - orka.harness.v2
+                    type: string
+                  establishedAt:
+                    format: date-time
+                    type: string
+                  generation:
+                    format: int64
+                    minimum: 1
+                    type: integer
+                  namespaceUID:
+                    description: |-
+                      NamespaceUID prevents a same-name recreated namespace from attaching to
+                      durable state owned by the previous namespace identity.
+                    type: string
+                  runtimeIdentity:
+                    description: RuntimeIdentity is the built-in runtime type or AgentRuntime
+                      UID.
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  sessionUid:
+                    description: SessionUID repeats the immutable control identity
+                      at the lineage fence.
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                required:
+                - configDigest
+                - contractVersion
+                - establishedAt
+                - generation
+                - namespaceUID
+                - runtimeIdentity
+                - sessionUid
+                type: object
+              mutationLease:
+                description: |-
+                  RuntimeSessionMutationLeaseStatus mirrors the namespaced Kubernetes Lease
+                  that serializes mutation for one immutable SessionUID.
+                properties:
+                  acquiredAt:
+                    format: date-time
+                    type: string
+                  attempt:
+                    format: int64
+                    minimum: 1
+                    type: integer
+                  expiresAt:
+                    format: date-time
+                    type: string
+                  generation:
+                    format: int64
+                    minimum: 1
+                    type: integer
+                  leaseName:
+                    maxLength: 253
+                    minLength: 1
+                    type: string
+                  leaseResourceVersion:
+                    maxLength: 64
+                    minLength: 1
+                    type: string
+                  promptId:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  requestDigest:
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  taskUid:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                required:
+                - acquiredAt
+                - attempt
+                - generation
+                - leaseName
+                - leaseResourceVersion
+                - promptId
+                - requestDigest
+                - taskUid
+                type: object
+              mutationLeaseGeneration:
+                description: MutationLeaseGeneration is monotonic and never reused
+                  for SessionUID.
+                format: int64
+                minimum: 0
+                type: integer
+              relatedPromptAttemptId:
+                maxLength: 1024
+                type: string
+              relatedPublicationId:
+                maxLength: 1024
+                type: string
+              updatedAt:
+                description: UpdatedAt is the normalized logical mutation time.
+                format: date-time
+                type: string
+              verifiedBaseline:
+                description: ControlVerifiedBranchBaseline is an independently verified
+                  branch baseline.
+                properties:
+                  ref:
+                    maxLength: 1024
+                    pattern: ^refs/heads/.+$
+                    type: string
+                  repositoryId:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  sha:
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                required:
+                - ref
+                - repositoryId
+                - sha
+                type: object
+              version:
+                description: |-
+                  Version is the monotonic domain CAS version. It advances once for each
+                  successfully persisted logical mutation.
+                format: int64
+                minimum: 1
+                type: integer
+            type: object
+            x-kubernetes-validations:
+            - message: available sessions must clear reconciliation block metadata
+              rule: '!has(self.availability) || self.availability != ''Available''
+                || ((!has(self.blockedReason) || size(self.blockedReason) == 0) &&
+                (!has(self.relatedPromptAttemptId) || size(self.relatedPromptAttemptId)
+                == 0) && (!has(self.relatedPublicationId) || size(self.relatedPublicationId)
+                == 0))'
+            - message: reconciliation-blocked sessions require a reason
+              rule: '!has(self.availability) || self.availability != ''ReconciliationBlocked''
+                || (has(self.blockedReason) && size(self.blockedReason) > 0)'
+            - message: runtime Session lineage is append-once and immutable
+              rule: '!has(oldSelf.lineage) || (has(self.lineage) && self.lineage ==
+                oldSelf.lineage)'
+        required:
+        - spec
+        type: object
+        x-kubernetes-validations:
+        - message: runtime Session lineage UID must match the immutable control Session
+            UID
+          rule: '!has(self.status) || !has(self.status.lineage) || self.status.lineage.sessionUid
+            == self.spec.sessionUid'
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/config/crd/bases/core.orka.ai_tasks.yaml b/config/crd/bases/core.orka.ai_tasks.yaml
index 704b92442..ece87c000 100644
--- a/config/crd/bases/core.orka.ai_tasks.yaml
+++ b/config/crd/bases/core.orka.ai_tasks.yaml
@@ -93,21 +93,26 @@ spec:
                     minimum: 1
                     type: integer
                   workspace:
-                    description: Workspace defines the working directory configuration
+                    description: |-
+                      Workspace is the legacy harness v1 agent workspace configuration at its
+                      historical JSON path. It is a preserved compatibility read surface for
+                      stored v1 Tasks only: it can never be introduced or changed, and it is
+                      not an authority surface for new work.
                     properties:
                       branch:
-                        description: Branch is the git branch to checkout
+                        description: Branch is the git branch to checkout.
                         type: string
                       forkRepo:
                         description: ForkRepo is the writable fork repository URL
-                          for pushing changes
+                          for pushing changes.
                         type: string
                       gitRepo:
-                        description: GitRepo is the repository URL to clone
+                        description: GitRepo is the repository URL to clone.
                         type: string
                       gitSecretRef:
-                        description: GitSecretRef references a Secret containing git
-                          credentials
+                        description: |-
+                          GitSecretRef references a Secret containing git credentials. Adopted
+                          legacy bindings freeze the exact Secret identity; new bindings reject it.
                         properties:
                           name:
                             default: ""
@@ -122,23 +127,29 @@ spec:
                         x-kubernetes-map-type: atomic
                       prBaseBranch:
                         description: PRBaseBranch is the upstream branch to target
-                          for pull requests
+                          for pull requests.
                         type: string
                       pushBranch:
                         description: |-
-                          PushBranch is the remote branch name to push changes to after the agent completes.
-                          When set, FinalizeResult will commit and push changes to this branch.
+                          PushBranch is the remote branch name to push changes to after the agent
+                          completes.
                         type: string
                       ref:
                         description: Ref is a specific git ref (commit SHA, tag) to
-                          checkout
+                          checkout.
                         type: string
                       subPath:
                         description: SubPath is a subdirectory within the repo to
-                          use as workspace root
+                          use as workspace root.
                         type: string
                     type: object
                 type: object
+                x-kubernetes-validations:
+                - message: legacy agentRuntime.workspace is a preserved harness v1
+                    compatibility surface; new Tasks must use spec.workspace
+                  optionalOldSelf: true
+                  rule: '!has(self.workspace) || (oldSelf.hasValue() && has(oldSelf.value().workspace)
+                    && self.workspace == oldSelf.value().workspace)'
               ai:
                 description: AI contains AI-specific configuration (when type is "ai")
                 properties:
@@ -1367,10 +1378,10 @@ spec:
                     type: array
                   workspace:
                     description: |-
-                      Workspace requests an upstream agent-sandbox execution workspace for agent Tasks.
-                      When enabled, the Task controller validates the request and propagates the
-                      resolved sandbox settings to the agent worker Job. The worker wrapper then
-                      claims the sandbox workspace and runs the configured agent runtime inside it.
+                      Workspace requests an execution workspace for worker-backed Task types.
+                      ACP core agent Tasks reject this field because their ephemeral workspace is
+                      owned by RuntimeSession lifecycle and clean-room publication. Actor-backed
+                      RuntimeSession support is a future integration behind the v2 lifecycle seam.
                     properties:
                       boot:
                         description: |-
@@ -1803,51 +1814,258 @@ spec:
                 type: string
               workspace:
                 description: |-
-                  Workspace defines repository checkout and push settings for tasks that need
-                  a git workspace. Agent tasks can continue to use agentRuntime.workspace for
-                  compatibility; this top-level field is used by container tasks as well.
+                  Workspace defines the canonical repository workspace, intent, credentials,
+                  and publication request. Agent Tasks that omit intent are interpreted as
+                  read by controller logic; an omitted intent preserves existing container behavior.
                 properties:
+                  allowedPaths:
+                    description: |-
+                      AllowedPaths restricts publishable workspace changes to these path globs or
+                      directory prefixes ending in /**. Empty allows every otherwise-safe path.
+                      It is not supported for container Tasks.
+                    items:
+                      type: string
+                    maxItems: 256
+                    type: array
                   branch:
-                    description: Branch is the git branch to checkout
+                    description: Branch is the source branch to check out.
+                    maxLength: 255
                     type: string
-                  forkRepo:
-                    description: ForkRepo is the writable fork repository URL for
-                      pushing changes
+                  createPR:
+                    default: false
+                    description: |-
+                      CreatePR explicitly requests pull request reconciliation after branch publication.
+                      Branch push remains the minimum durable delivery when false. It is supported only
+                      for agent Tasks using the trusted ACP publisher boundary.
+                    type: boolean
+                  denyRepositoryControlPaths:
+                    description: |-
+                      DenyRepositoryControlPaths rejects workflow, RBAC, and chart-secret paths
+                      before publication even when AllowedPaths is empty or otherwise matches.
+                      It is not supported for container Tasks.
+                    type: boolean
+                  expectedRemoteSHA:
+                    description: |-
+                      ExpectedRemoteSHA requires the publication branch to exist at this exact
+                      commit before publication. Empty means the branch must be absent. It is
+                      supported only for agent Tasks using the trusted ACP publisher boundary.
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
                     type: string
+                  forgeCredentialRef:
+                    description: |-
+                      ForgeCredentialRef references the forge API credential used only for pull
+                      request reconciliation when createPR=true.
+                    properties:
+                      key:
+                        default: token
+                        description: |-
+                          Key is the Secret data key containing one bearer token or one complete
+                          Authorization header. It defaults to "token" when omitted.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[A-Za-z0-9._-]+$
+                        type: string
+                      name:
+                        description: Name is the name of the Secret in the Task namespace.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                    required:
+                    - name
+                    type: object
                   gitRepo:
-                    description: GitRepo is the repository URL to clone
+                    description: |-
+                      GitRepo is the source repository URL cloned by the clean-room workspace boundary.
+                      Credentials must not be embedded in the URL.
+                    maxLength: 2048
                     type: string
-                  gitSecretRef:
-                    description: GitSecretRef references a Secret containing git credentials
+                  intent:
+                    description: |-
+                      Intent declares whether the verified workspace must remain unchanged or may
+                      produce a publication artifact. It is immutable for the lifetime of the Task.
+                      Agent Tasks that omit intent are interpreted as read by controller logic;
+                      omitted intent preserves the existing behavior of container Tasks.
+                    enum:
+                    - read
+                    - write
+                    type: string
+                  maxChangedFiles:
+                    description: |-
+                      MaxChangedFiles bounds the total changed, deleted, and symlink paths accepted
+                      from the trusted supervisor before publication. Zero uses the runtime limit.
+                      It is not supported for container Tasks.
+                    format: int32
+                    minimum: 1
+                    type: integer
+                  prBaseBranch:
+                    description: PRBaseBranch is the upstream branch targeted when
+                      CreatePR is true.
+                    maxLength: 255
+                    type: string
+                  publicationCredentialRef:
+                    description: |-
+                      PublicationCredentialRef references the target-repository write credential
+                      used only for the exact CAS push. It is never used to clone the source.
                     properties:
-                      name:
-                        default: ""
+                      key:
+                        default: token
                         description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          Key is the Secret data key containing one bearer token or one complete
+                          Authorization header. It defaults to "token" when omitted.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[A-Za-z0-9._-]+$
+                        type: string
+                      name:
+                        description: Name is the name of the Secret in the Task namespace.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
+                    required:
+                    - name
                     type: object
-                    x-kubernetes-map-type: atomic
-                  prBaseBranch:
-                    description: PRBaseBranch is the upstream branch to target for
-                      pull requests
+                  publicationGitRepo:
+                    description: |-
+                      PublicationGitRepo is the repository URL whose branch receives an exact CAS publication.
+                      Credentials must not be embedded in the URL.
+                    maxLength: 2048
                     type: string
+                  publicationReadCredentialRef:
+                    description: |-
+                      PublicationReadCredentialRef references the target-repository read
+                      credential used only for preflight and independent post-push verification.
+                    properties:
+                      key:
+                        default: token
+                        description: |-
+                          Key is the Secret data key containing one bearer token or one complete
+                          Authorization header. It defaults to "token" when omitted.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[A-Za-z0-9._-]+$
+                        type: string
+                      name:
+                        description: Name is the name of the Secret in the Task namespace.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                    required:
+                    - name
+                    type: object
+                  publicationRepository:
+                    description: |-
+                      PublicationRepository is the optional URL-derived identity for
+                      PublicationGitRepo. When set, it must match the normalized credential-free
+                      URL; for GitHub, use provider "github" and ID "github.com/owner/repo".
+                    properties:
+                      id:
+                        description: |-
+                          ID is the canonical credential-free URL identity and must match the
+                          corresponding repository URL after normalization. For GitHub, use
+                          "github.com/owner/repo"; GitHub GraphQL node IDs are not accepted.
+                        maxLength: 512
+                        minLength: 1
+                        type: string
+                      provider:
+                        description: Provider identifies the source-control provider
+                          or forge.
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$
+                        type: string
+                    required:
+                    - id
+                    - provider
+                    type: object
                   pushBranch:
                     description: |-
-                      PushBranch is the remote branch name to push changes to after the agent completes.
-                      When set, FinalizeResult will commit and push changes to this branch.
+                      PushBranch is the publication branch. For write Tasks the controller derives
+                      a full-entropy Task- or Session-owned branch when this is omitted.
+                    maxLength: 255
                     type: string
+                  readCredentialRef:
+                    description: |-
+                      ReadCredentialRef references the one-operation clone/read credential Secret.
+                      The Secret is resolved only by the clean-room workspace boundary.
+                    properties:
+                      key:
+                        default: token
+                        description: |-
+                          Key is the Secret data key containing one bearer token or one complete
+                          Authorization header. It defaults to "token" when omitted.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[A-Za-z0-9._-]+$
+                        type: string
+                      name:
+                        description: Name is the name of the Secret in the Task namespace.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                    required:
+                    - name
+                    type: object
                   ref:
-                    description: Ref is a specific git ref (commit SHA, tag) to checkout
+                    description: Ref is a specific source git ref, commit SHA, or
+                      tag to check out.
+                    maxLength: 512
                     type: string
+                  rejectBinaryFiles:
+                    description: |-
+                      RejectBinaryFiles rejects changed file content that is not valid text. It is
+                      not supported for container Tasks.
+                    type: boolean
+                  rejectSecretLikeContent:
+                    description: |-
+                      RejectSecretLikeContent applies Orka's generic secret detector to changed
+                      paths and file contents before publication. It is not supported for container Tasks.
+                    type: boolean
+                  sourceRepository:
+                    description: |-
+                      SourceRepository is the optional URL-derived identity for GitRepo. When set,
+                      it must match the normalized credential-free URL; for GitHub, use provider
+                      "github" and ID "github.com/owner/repo".
+                    properties:
+                      id:
+                        description: |-
+                          ID is the canonical credential-free URL identity and must match the
+                          corresponding repository URL after normalization. For GitHub, use
+                          "github.com/owner/repo"; GitHub GraphQL node IDs are not accepted.
+                        maxLength: 512
+                        minLength: 1
+                        type: string
+                      provider:
+                        description: Provider identifies the source-control provider
+                          or forge.
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$
+                        type: string
+                    required:
+                    - id
+                    - provider
+                    type: object
                   subPath:
-                    description: SubPath is a subdirectory within the repo to use
-                      as workspace root
+                    description: SubPath is a subdirectory within the source repository
+                      used as workspace root.
+                    maxLength: 1024
                     type: string
                 type: object
+                x-kubernetes-validations:
+                - message: createPR requires write workspace intent
+                  rule: '!self.createPR || self.intent == ''write'''
+                - message: gitRepo must not contain embedded credentials, query parameters,
+                    or fragments
+                  rule: '!has(self.gitRepo) || (!self.gitRepo.matches(''(?i)^[A-Za-z][A-Za-z0-9+.-]*://[^/]*@'')
+                    && !self.gitRepo.contains(''?'') && !self.gitRepo.contains(''#''))'
+                - message: publicationGitRepo must not contain embedded credentials,
+                    query parameters, or fragments
+                  rule: '!has(self.publicationGitRepo) || (!self.publicationGitRepo.matches(''(?i)^[A-Za-z][A-Za-z0-9+.-]*://[^/]*@'')
+                    && !self.publicationGitRepo.contains(''?'') && !self.publicationGitRepo.contains(''#''))'
             required:
             - type
             type: object
@@ -1858,12 +2076,219 @@ spec:
             - message: transaction is immutable
               rule: has(self.transaction) == has(oldSelf.transaction) && (!has(self.transaction)
                 || self.transaction == oldSelf.transaction)
+            - message: type is immutable
+              rule: self.type == oldSelf.type
+            - message: effective workspace intent is immutable
+              rule: '(has(self.workspace) && has(self.workspace.intent) ? self.workspace.intent
+                : (self.type == ''agent'' ? ''read'' : self.type)) == (has(oldSelf.workspace)
+                && has(oldSelf.workspace.intent) ? oldSelf.workspace.intent : (oldSelf.type
+                == ''agent'' ? ''read'' : oldSelf.type))'
+            - message: agent prompt is immutable
+              rule: self.type != 'agent' || (has(self.prompt) == has(oldSelf.prompt)
+                && (!has(self.prompt) || self.prompt == oldSelf.prompt))
+            - message: agentRef is immutable for agent Tasks
+              rule: self.type != 'agent' || (has(self.agentRef) == has(oldSelf.agentRef)
+                && (!has(self.agentRef) || self.agentRef == oldSelf.agentRef))
+            - message: agentRuntime is immutable for agent Tasks
+              rule: self.type != 'agent' || (has(self.agentRuntime) == has(oldSelf.agentRuntime)
+                && (!has(self.agentRuntime) || self.agentRuntime == oldSelf.agentRuntime))
+            - message: sessionRef is immutable for agent Tasks
+              rule: self.type != 'agent' || (has(self.sessionRef) == has(oldSelf.sessionRef)
+                && (!has(self.sessionRef) || self.sessionRef == oldSelf.sessionRef))
+            - message: workspace is immutable for agent Tasks
+              rule: self.type != 'agent' || (has(self.workspace) == has(oldSelf.workspace)
+                && (!has(self.workspace) || self.workspace == oldSelf.workspace))
+            - message: timeout is immutable for agent Tasks
+              rule: self.type != 'agent' || (has(self.timeout) == has(oldSelf.timeout)
+                && (!has(self.timeout) || self.timeout == oldSelf.timeout))
             - message: session workspace reuse requires spec.sessionRef
               rule: '!has(self.execution) || !has(self.execution.workspace) || self.execution.workspace.reusePolicy
                 != ''session'' || has(self.sessionRef)'
+            - message: container Tasks do not support workspace.expectedRemoteSHA
+              rule: self.type != 'container' || !has(self.workspace) || !has(self.workspace.expectedRemoteSHA)
+            - message: container Tasks do not support workspace.createPR
+              rule: self.type != 'container' || !has(self.workspace) || (!has(self.workspace.createPR)
+                || !self.workspace.createPR)
+            - message: container Tasks do not support clean-room workspace publication
+                policies
+              rule: self.type != 'container' || !has(self.workspace) || (!has(self.workspace.maxChangedFiles)
+                && (!has(self.workspace.allowedPaths) || self.workspace.allowedPaths.size()
+                == 0) && (!has(self.workspace.denyRepositoryControlPaths) || !self.workspace.denyRepositoryControlPaths)
+                && (!has(self.workspace.rejectBinaryFiles) || !self.workspace.rejectBinaryFiles)
+                && (!has(self.workspace.rejectSecretLikeContent) || !self.workspace.rejectSecretLikeContent))
+            - message: custom-image container Tasks do not support workspace.pushBranch
+                publication
+              rule: self.type != 'container' || !has(self.workspace) || !has(self.workspace.pushBranch)
+                || self.workspace.pushBranch.size() == 0 || !has(self.image) || self.image.size()
+                == 0
           status:
             description: TaskStatus defines the observed state of Task
             properties:
+              agentExecutionBinding:
+                description: |-
+                  AgentExecutionBinding is the authoritative, write-once, immutable
+                  execution route for this agent Task.
+                properties:
+                  agent:
+                    description: AgentExecutionAgentRef pins the exact Agent identity
+                      resolved at binding.
+                    properties:
+                      generation:
+                        format: int64
+                        minimum: 1
+                        type: integer
+                      name:
+                        minLength: 1
+                        type: string
+                      namespace:
+                        minLength: 1
+                        type: string
+                      uid:
+                        description: |-
+                          UID is a type that holds unique ID values, including UUIDs.  Because we
+                          don't ONLY use UUIDs, this is an alias to string.  Being a type captures
+                          intent and helps make sure that UIDs and names do not get conflated.
+                        type: string
+                    required:
+                    - generation
+                    - name
+                    - namespace
+                    - uid
+                    type: object
+                  backend:
+                    description: AgentExecutionBackend identifies the isolated execution
+                      dispatcher backend.
+                    enum:
+                    - harness-wrapper
+                    - runtime-pool
+                    - external-endpoint
+                    type: string
+                  bindingDigest:
+                    description: |-
+                      BindingDigest is the canonical digest of this binding; every durable
+                      demand, attempt, turn, Session lease, publication, and cleanup record
+                      copies it.
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  boundAt:
+                    format: date-time
+                    type: string
+                  contractVersion:
+                    description: ContractVersion is the frozen execution protocol
+                      for the Task lifetime.
+                    enum:
+                    - orka.harness.v1
+                    - orka.harness.v2
+                    type: string
+                  runtimeProfileDigest:
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  runtimeProfileDigestSchemaVersion:
+                    enum:
+                    - 1
+                    format: int32
+                    type: integer
+                  runtimeRef:
+                    description: AgentExecutionRuntimeRef pins a referenced AgentRuntime
+                      identity.
+                    properties:
+                      generation:
+                        format: int64
+                        minimum: 1
+                        type: integer
+                      name:
+                        minLength: 1
+                        type: string
+                      uid:
+                        description: |-
+                          UID is a type that holds unique ID values, including UUIDs.  Because we
+                          don't ONLY use UUIDs, this is an alias to string.  Being a type captures
+                          intent and helps make sure that UIDs and names do not get conflated.
+                        type: string
+                    required:
+                    - generation
+                    - name
+                    - uid
+                    type: object
+                  runtimeType:
+                    description: RuntimeType is the built-in runtime type, empty for
+                      runtimeRef bindings.
+                    enum:
+                    - claude
+                    - codex
+                    - copilot
+                    - opencode
+                    type: string
+                  schemaVersion:
+                    enum:
+                    - 1
+                    format: int32
+                    type: integer
+                  snapshot:
+                    description: AgentExecutionSnapshotRef links the immutable non-secret
+                      execution snapshot.
+                    properties:
+                      digest:
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      id:
+                        description: ID is the snapshot identity in the form <task-uid>/sha256:<digest>.
+                        maxLength: 512
+                        minLength: 1
+                        type: string
+                      schemaVersion:
+                        enum:
+                        - 1
+                        format: int32
+                        type: integer
+                    required:
+                    - digest
+                    - id
+                    - schemaVersion
+                    type: object
+                  task:
+                    description: AgentExecutionBindingTaskRef pins the bound Task
+                      identity.
+                    properties:
+                      boundSpecGeneration:
+                        description: BoundSpecGeneration is the Task spec generation
+                          frozen into the snapshot.
+                        format: int64
+                        minimum: 1
+                        type: integer
+                      namespaceUID:
+                        description: |-
+                          NamespaceUID is the UID of the Task namespace, preventing same-name
+                          namespace recreation from satisfying old identities.
+                        type: string
+                      uid:
+                        description: |-
+                          UID is a type that holds unique ID values, including UUIDs.  Because we
+                          don't ONLY use UUIDs, this is an alias to string.  Being a type captures
+                          intent and helps make sure that UIDs and names do not get conflated.
+                        type: string
+                    required:
+                    - boundSpecGeneration
+                    - namespaceUID
+                    - uid
+                    type: object
+                required:
+                - backend
+                - bindingDigest
+                - boundAt
+                - contractVersion
+                - schemaVersion
+                - snapshot
+                - task
+                type: object
+                x-kubernetes-validations:
+                - message: the harness-wrapper backend requires an orka.harness.v1
+                    binding
+                  rule: self.backend != 'harness-wrapper' || self.contractVersion
+                    == 'orka.harness.v1'
+                - message: the runtime-pool backend requires an orka.harness.v2 binding
+                  rule: self.backend != 'runtime-pool' || self.contractVersion ==
+                    'orka.harness.v2'
               attempts:
                 description: Attempts is the number of attempts made
                 format: int32
@@ -1965,10 +2390,383 @@ spec:
                 x-kubernetes-list-map-keys:
                 - type
                 x-kubernetes-list-type: map
+              delivery:
+                description: Delivery reports trusted workspace validation and publication
+                  reconciliation.
+                properties:
+                  artifactDigest:
+                    description: ArtifactDigest is the durable content-addressed workspace
+                      delta digest.
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  branch:
+                    description: Branch is the publication branch without a refs/heads/
+                      prefix.
+                    maxLength: 255
+                    type: string
+                  expectedCommitSHA:
+                    description: ExpectedCommitSHA is the exact Orka-owned commit
+                      prepared for publication.
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                  lastTransitionTime:
+                    description: LastTransitionTime is the last durable delivery-state
+                      transition time.
+                    format: date-time
+                    type: string
+                  message:
+                    description: Message contains bounded, sanitized delivery context.
+                    maxLength: 1024
+                    type: string
+                  outcome:
+                    description: Outcome is set only after delivery reaches a terminal
+                      classification.
+                    enum:
+                    - NotRequested
+                    - VerifiedExact
+                    - DeliveredSuperseded
+                    - ReadValidated
+                    - NoChange
+                    - CancelledBeforePublish
+                    - ReadOnlyWorkspaceModified
+                    - DeliveryConflict
+                    - CredentialBlocked
+                    - PublicationOutcomeUnknown
+                    type: string
+                  prReceipt:
+                    description: PRReceipt is present only when createPR was explicitly
+                      requested and reconciled.
+                    properties:
+                      baseBranch:
+                        description: BaseBranch is the reconciled pull request base
+                          branch.
+                        maxLength: 255
+                        type: string
+                      headBranch:
+                        description: HeadBranch is the reconciled pull request head
+                          branch.
+                        maxLength: 255
+                        type: string
+                      headSHA:
+                        description: HeadSHA is the exact observed pull request head
+                          commit.
+                        pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                        type: string
+                      id:
+                        description: ID is the provider's durable pull request identifier.
+                        maxLength: 512
+                        minLength: 1
+                        type: string
+                      number:
+                        description: Number is the provider's numeric pull request
+                          number when available.
+                        format: int64
+                        minimum: 1
+                        type: integer
+                      state:
+                        description: State is the provider-observed pull request state.
+                        maxLength: 64
+                        type: string
+                      url:
+                        description: URL is the canonical user-facing pull request
+                          URL. It must not contain credentials.
+                        maxLength: 2048
+                        type: string
+                    required:
+                    - id
+                    type: object
+                  publicationID:
+                    description: PublicationID is the durable identity reused for
+                      reconciliation of the same artifact.
+                    maxLength: 253
+                    pattern: ^[A-Za-z0-9][A-Za-z0-9._:-]{0,252}$
+                    type: string
+                  publicationRepository:
+                    description: PublicationRepository is the canonical repository
+                      whose branch was reconciled.
+                    properties:
+                      id:
+                        description: |-
+                          ID is the canonical credential-free URL identity and must match the
+                          corresponding repository URL after normalization. For GitHub, use
+                          "github.com/owner/repo"; GitHub GraphQL node IDs are not accepted.
+                        maxLength: 512
+                        minLength: 1
+                        type: string
+                      provider:
+                        description: Provider identifies the source-control provider
+                          or forge.
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$
+                        type: string
+                    required:
+                    - id
+                    - provider
+                    type: object
+                  reason:
+                    description: Reason is a stable machine-readable explanation for
+                      State or Outcome.
+                    maxLength: 128
+                    pattern: ^[A-Za-z][A-Za-z0-9._-]{0,127}$
+                    type: string
+                  remoteBeforeSHA:
+                    description: |-
+                      RemoteBeforeSHA is the exact publication ref observed before the CAS push.
+                      Nil means not yet observed; a pointer to the empty string records explicit
+                      absence; a non-empty value records the observed object ID.
+                    pattern: ^(|[a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                  sourceRepository:
+                    description: SourceRepository is the canonical repository from
+                      which the workspace baseline was created.
+                    properties:
+                      id:
+                        description: |-
+                          ID is the canonical credential-free URL identity and must match the
+                          corresponding repository URL after normalization. For GitHub, use
+                          "github.com/owner/repo"; GitHub GraphQL node IDs are not accepted.
+                        maxLength: 512
+                        minLength: 1
+                        type: string
+                      provider:
+                        description: Provider identifies the source-control provider
+                          or forge.
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$
+                        type: string
+                    required:
+                    - id
+                    - provider
+                    type: object
+                  startingSHA:
+                    description: StartingSHA is the verified source baseline before
+                      prompt execution.
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                  state:
+                    description: State is the current durable delivery state.
+                    enum:
+                    - NotRequested
+                    - Validating
+                    - Preparing
+                    - Prepared
+                    - Publishing
+                    - Verifying
+                    - VerifiedExact
+                    - DeliveredSuperseded
+                    - ReadValidated
+                    - NoChange
+                    - CancelledBeforePublish
+                    - ReadOnlyWorkspaceModified
+                    - DeliveryConflict
+                    - CredentialBlocked
+                    - PublicationOutcomeUnknown
+                    type: string
+                  supersedingRemoteSHA:
+                    description: SupersedingRemoteSHA is the verified descendant that
+                      superseded ExpectedCommitSHA.
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                  treeSHA:
+                    description: TreeSHA is the deterministic clean-room tree written
+                      by the publisher.
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                  verifiedRemoteSHA:
+                    description: VerifiedRemoteSHA is the independently observed remote
+                      branch head.
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                type: object
+                x-kubernetes-validations:
+                - message: delivery outcome requires the matching terminal state
+                  rule: '!has(self.outcome) || (has(self.state) && self.state == self.outcome)'
+                - message: terminal delivery state requires an outcome
+                  rule: '!has(self.state) || !(self.state in [''NotRequested'', ''VerifiedExact'',
+                    ''DeliveredSuperseded'', ''ReadValidated'', ''NoChange'', ''CancelledBeforePublish'',
+                    ''ReadOnlyWorkspaceModified'', ''DeliveryConflict'', ''CredentialBlocked'',
+                    ''PublicationOutcomeUnknown'']) || has(self.outcome)'
+              execution:
+                description: |-
+                  Execution reports the durable execution state and terminal outcome for the
+                  current attempt. Phase remains the compatibility projection.
+                properties:
+                  agentRuntimeName:
+                    description: |-
+                      AgentRuntimeName is the namespaced external orka.harness.v2 registration
+                      selected for this attempt. It is mutually exclusive with RuntimePoolName.
+                    maxLength: 253
+                    type: string
+                  agentRuntimeUID:
+                    description: |-
+                      AgentRuntimeUID is the immutable external AgentRuntime UID fenced into the
+                      attempt selection.
+                    maxLength: 253
+                    type: string
+                  attempt:
+                    description: Attempt is the one-based Task execution attempt represented
+                      by this status.
+                    format: int32
+                    minimum: 1
+                    type: integer
+                  controllerEpoch:
+                    description: ControllerEpoch is the durable controller epoch fencing
+                      this attempt.
+                    format: int64
+                    minimum: 0
+                    type: integer
+                  forgeCredentialResourceVersion:
+                    description: |-
+                      ForgeCredentialResourceVersion freezes the forge-only Secret version used
+                      for pull request reconciliation.
+                    maxLength: 253
+                    type: string
+                  lastTransitionTime:
+                    description: LastTransitionTime is the last durable execution-state
+                      transition time.
+                    format: date-time
+                    type: string
+                  message:
+                    description: Message contains bounded, sanitized execution context.
+                    maxLength: 1024
+                    type: string
+                  outcome:
+                    description: Outcome is set only after execution reaches a terminal
+                      classification.
+                    enum:
+                    - Succeeded
+                    - Failed
+                    - Cancelled
+                    - OutcomeUnknown
+                    type: string
+                  promptID:
+                    description: PromptID is the durable prompt identity used for
+                      submission and settlement.
+                    maxLength: 253
+                    type: string
+                  publicationCredentialResourceVersion:
+                    description: |-
+                      PublicationCredentialResourceVersion freezes the target-write Secret
+                      version selected at reservation without exposing credential material.
+                    maxLength: 253
+                    type: string
+                  publicationReadCredentialResourceVersion:
+                    description: |-
+                      PublicationReadCredentialResourceVersion freezes the target-read Secret
+                      version used for preflight and independent verification.
+                    maxLength: 253
+                    type: string
+                  readCredentialResourceVersion:
+                    description: |-
+                      ReadCredentialResourceVersion freezes the read credential Secret version
+                      selected at reservation without exposing credential material.
+                    maxLength: 253
+                    type: string
+                  reason:
+                    description: Reason is a stable machine-readable explanation for
+                      State or Outcome.
+                    maxLength: 128
+                    pattern: ^[A-Za-z][A-Za-z0-9._-]{0,127}$
+                    type: string
+                  requestDigest:
+                    description: RequestDigest is the canonical immutable prompt request
+                      digest.
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  runtimeInstanceID:
+                    description: RuntimeInstanceID is the exact selected supervisor
+                      Pod UID plus boot identity.
+                    maxLength: 512
+                    type: string
+                  runtimePoolName:
+                    description: RuntimePoolName is the namespaced logical pool selected
+                      for this attempt.
+                    maxLength: 253
+                    type: string
+                  runtimePoolUID:
+                    description: RuntimePoolUID is the immutable pool UID fenced into
+                      runtime requests.
+                    maxLength: 253
+                    type: string
+                  runtimeSessionCleanupDigest:
+                    description: |-
+                      RuntimeSessionCleanupDigest is the controller-owned proof that the exact
+                      RuntimeSession requiring retirement was deleted or its immutable runtime
+                      instance was replaced. Users may read but cannot mutate the Task status subresource.
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  runtimeSessionGeneration:
+                    description: RuntimeSessionGeneration is the monotonic profile/session
+                      generation.
+                    format: int64
+                    minimum: 0
+                    type: integer
+                  runtimeSessionMCPDigest:
+                    description: |-
+                      RuntimeSessionMCPDigest binds the complete non-secret effective MCP policy
+                      and descriptor configuration to a pending or reusable Session generation.
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  runtimeSessionProfileDigest:
+                    description: |-
+                      RuntimeSessionProfileDigest freezes the immutable runtime behavior bound to
+                      a pending or reusable Session generation.
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  runtimeSessionRecreationPending:
+                    description: |-
+                      RuntimeSessionRecreationPending records that the exact generation is being
+                      created or replaced and must be reconciled before a different request may
+                      reuse that identity.
+                    type: boolean
+                  runtimeSessionSupervisorBootID:
+                    description: |-
+                      RuntimeSessionSupervisorBootID freezes the supervisor boot that owns a
+                      pending or reusable Session generation.
+                    maxLength: 512
+                    type: string
+                  runtimeSessionUID:
+                    description: RuntimeSessionUID is the stable controller-owned
+                      Session execution identity.
+                    maxLength: 253
+                    type: string
+                  runtimeSessionWorkspaceDigest:
+                    description: |-
+                      RuntimeSessionWorkspaceDigest binds a reusable Session generation to the
+                      exact repository, source ref, verified baseline, intent, and relative root.
+                      It contains no credential material.
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  state:
+                    description: State is the current durable execution state.
+                    enum:
+                    - Queued
+                    - Reserved
+                    - SessionStarting
+                    - Planned
+                    - Submitting
+                    - SubmittedUnknown
+                    - Accepted
+                    - Running
+                    - Settling
+                    - Succeeded
+                    - Failed
+                    - Cancelled
+                    - OutcomeUnknown
+                    type: string
+                type: object
+                x-kubernetes-validations:
+                - message: execution outcome requires the matching terminal state
+                  rule: '!has(self.outcome) || (has(self.state) && self.state == self.outcome)'
+                - message: terminal execution state requires an outcome
+                  rule: '!has(self.state) || !(self.state in [''Succeeded'', ''Failed'',
+                    ''Cancelled'', ''OutcomeUnknown'']) || has(self.outcome)'
               executionOutcome:
                 description: |-
-                  ExecutionOutcome is the immutable outcome recorded when workload execution ends. Workspace
-                  attachment revocation and cleanup continue independently while the Task is Finalizing.
+                  ExecutionOutcome records the immutable outcome of a non-ACP workload before
+                  provider-neutral execution-workspace finalization completes.
                 properties:
                   attempt:
                     description: Attempt is the Task attempt that produced this outcome.
@@ -2240,10 +3038,16 @@ spec:
                 type: object
               harnessRuntime:
                 description: |-
-                  HarnessRuntime records the controller-resolved harness runtime target for an
-                  in-flight agent turn. It intentionally stores only non-secret routing metadata
-                  and Secret references, never bearer values.
+                  HarnessRuntime records the controller-resolved harness v1 runtime target
+                  for an in-flight agent turn. It intentionally stores only non-secret
+                  routing metadata and Secret references, never bearer values. Compatibility
+                  surface for harness v1 bindings.
                 properties:
+                  attempt:
+                    description: Attempt is the durable harness v1 attempt number.
+                    format: int32
+                    minimum: 1
+                    type: integer
                   authRefField:
                     description: AuthRefField is the Secret data field selected when
                       the turn started.
@@ -2253,31 +3057,122 @@ spec:
                       turn started.
                     type: string
                   authRefResourceVersion:
-                    description: AuthRefResourceVersion is the auth Secret resourceVersion
-                      validated before starting the turn.
+                    description: |-
+                      AuthRefResourceVersion is the auth Secret resourceVersion validated
+                      before starting the turn.
+                    type: string
+                  cancelRequestedAt:
+                    description: |-
+                      CancelRequestedAt records a durable cancellation request. Cancellation
+                      remains nonterminal until a terminal frame or ledger receipt is observed.
+                    format: date-time
                     type: string
                   contractVersion:
                     description: ContractVersion is the Orka harness contract version
                       used for the turn.
                     type: string
+                  controllerEpoch:
+                    description: ControllerEpoch records the fenced controller epoch
+                      driving the attempt.
+                    format: int64
+                    minimum: 0
+                    type: integer
                   endpoint:
                     description: Endpoint is the non-secret harness base URL selected
                       when the turn started.
                     type: string
+                  lastEventSeq:
+                    description: LastEventSeq is the highest durably mapped harness
+                      frame sequence.
+                    format: int64
+                    minimum: 0
+                    type: integer
+                  lastTransitionTime:
+                    description: |-
+                      LastTransitionTime is the last durable v1 attempt transition projected to
+                      the Task.
+                    format: date-time
+                    type: string
+                  message:
+                    description: Message is bounded, sanitized execution context.
+                    maxLength: 1024
+                    type: string
+                  outcome:
+                    description: Outcome is set only for a terminal harness v1 attempt.
+                    enum:
+                    - Succeeded
+                    - Failed
+                    - Cancelled
+                    - OutcomeUnknown
+                    type: string
+                  reason:
+                    description: Reason is a bounded machine-readable terminal reason
+                      code.
+                    maxLength: 256
+                    type: string
+                  requestDigest:
+                    description: |-
+                      RequestDigest binds the canonical StartTurn request admitted by the
+                      durable wrapper ledger.
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
                   runtimeGeneration:
                     description: RuntimeGeneration is the AgentRuntime generation
                       selected when the turn started.
                     format: int64
                     type: integer
                   runtimeName:
-                    description: RuntimeName is the runtime name advertised by the
-                      harness capabilities and sent in turn metadata.
+                    description: |-
+                      RuntimeName is the runtime name advertised by the harness capabilities
+                      and sent in turn metadata.
                     type: string
                   runtimeRefName:
-                    description: RuntimeRefName is the AgentRuntime name for custom
-                      runtimeRef turns. Empty means built-in CLI wrapper.
+                    description: |-
+                      RuntimeRefName is the AgentRuntime name for custom runtimeRef turns.
+                      Empty means built-in CLI wrapper.
+                    type: string
+                  runtimeSessionID:
+                    description: RuntimeSessionID is the deterministic, non-secret
+                      v1 runtime-session identity.
+                    type: string
+                  state:
+                    description: State is the durable harness v1 attempt state projected
+                      for operators.
+                    enum:
+                    - Queued
+                    - Reserved
+                    - SessionStarting
+                    - Planned
+                    - Submitting
+                    - SubmittedUnknown
+                    - Accepted
+                    - Running
+                    - Settling
+                    - Succeeded
+                    - Failed
+                    - Cancelled
+                    - OutcomeUnknown
+                    type: string
+                  terminalReceiptDigest:
+                    description: TerminalReceiptDigest identifies the authoritative
+                      terminal or unknown receipt.
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  turnID:
+                    description: TurnID is the deterministic, non-secret harness turn
+                      identity.
                     type: string
                 type: object
+                x-kubernetes-validations:
+                - message: terminal harness state requires an outcome
+                  rule: '!has(self.state) || !(self.state in [''Succeeded'', ''Failed'',
+                    ''Cancelled'', ''OutcomeUnknown'']) || has(self.outcome)'
+                - message: harness outcome requires a terminal state
+                  rule: '!has(self.outcome) || (has(self.state) && self.state in [''Succeeded'',
+                    ''Failed'', ''Cancelled'', ''OutcomeUnknown''])'
+                - message: OutcomeUnknown harness state requires OutcomeUnknown outcome
+                  rule: '!has(self.state) || self.state != ''OutcomeUnknown'' || (has(self.outcome)
+                    && self.outcome == ''OutcomeUnknown'')'
               iteration:
                 description: |-
                   Iteration is the current autonomous loop iteration (0-based).
@@ -2334,7 +3229,24 @@ spec:
             x-kubernetes-validations:
             - message: executionOutcome is immutable once recorded
               rule: '!has(oldSelf.executionOutcome) || self.executionOutcome == oldSelf.executionOutcome'
+            - message: agentExecutionBinding is write-once and immutable
+              rule: '!has(oldSelf.agentExecutionBinding) || (has(self.agentExecutionBinding)
+                && self.agentExecutionBinding == oldSelf.agentExecutionBinding)'
+            - message: a v1-bound Task cannot acquire new v2 execution or delivery
+                state
+              rule: '!has(self.agentExecutionBinding) || self.agentExecutionBinding.contractVersion
+                != ''orka.harness.v1'' || ((!has(self.execution) || (has(oldSelf.execution)
+                && self.execution == oldSelf.execution)) && (!has(self.delivery) ||
+                (has(oldSelf.delivery) && self.delivery == oldSelf.delivery)))'
+            - message: a v2-bound Task cannot acquire new v1 harness state
+              rule: '!has(self.agentExecutionBinding) || self.agentExecutionBinding.contractVersion
+                != ''orka.harness.v2'' || !has(self.harnessRuntime) || (has(oldSelf.harnessRuntime)
+                && self.harnessRuntime == oldSelf.harnessRuntime)'
         type: object
+        x-kubernetes-validations:
+        - message: Task spec is immutable after execution authority is recorded
+          rule: '!has(oldSelf.status) || (!has(oldSelf.status.agentExecutionBinding)
+            || self.spec == oldSelf.spec)'
     served: true
     storage: true
     subresources:
diff --git a/config/crd/bases/core.orka.ai_tools.yaml b/config/crd/bases/core.orka.ai_tools.yaml
index 76a2338a2..32981b5cb 100644
--- a/config/crd/bases/core.orka.ai_tools.yaml
+++ b/config/crd/bases/core.orka.ai_tools.yaml
@@ -125,7 +125,13 @@ spec:
                     - name
                     type: object
                   timeout:
-                    description: 'Timeout is the request timeout (default: 30s)'
+                    description: |-
+                      Timeout is the request timeout (default: 30s)
+                      Consequential (non-read) tools brokered to ACP runtimes execute under a
+                      fixed external-effect ledger lease; their timeout must stay at or below
+                      the controller's brokered call bound (currently four minutes). Longer
+                      timeouts are rejected when the tool is exposed to an ACP prompt, and
+                      brokered calls are always clamped to that bound at execution time.
                     type: string
                   url:
                     description: |-
diff --git a/config/crd/kustomization.yaml b/config/crd/kustomization.yaml
index 51452729c..aba9d7ef4 100644
--- a/config/crd/kustomization.yaml
+++ b/config/crd/kustomization.yaml
@@ -6,6 +6,13 @@ resources:
 - bases/core.orka.ai_tools.yaml
 - bases/core.orka.ai_agents.yaml
 - bases/core.orka.ai_agentruntimes.yaml
+- bases/core.orka.ai_runtimepools.yaml
+- bases/core.orka.ai_promptattempts.yaml
+- bases/core.orka.ai_runtimesessioncontrols.yaml
+- bases/core.orka.ai_branchclaims.yaml
+- bases/core.orka.ai_publications.yaml
+- bases/core.orka.ai_controllerepochs.yaml
+- bases/core.orka.ai_externaleffects.yaml
 - bases/core.orka.ai_providers.yaml
 - bases/core.orka.ai_skills.yaml
 - bases/core.orka.ai_repositoryscans.yaml
diff --git a/config/default/kustomization.yaml b/config/default/kustomization.yaml
index a989c4553..7aab6e57f 100644
--- a/config/default/kustomization.yaml
+++ b/config/default/kustomization.yaml
@@ -1,144 +1,14 @@
-# Adds namespace to all resources.
-namespace: orka-system
-
-# Value of this field is prepended to the
-# names of all resources, e.g. a deployment named
-# "wordpress" becomes "alices-wordpress".
-# Note that it should also match with the prefix (text before '-') of the namespace
-# field above.
-namePrefix: orka-
-
-# Labels to add to all resources and selectors.
-#labels:
-#- includeSelectors: true
-#  pairs:
-#    someName: someValue
-
-configurations:
-- kustomizeconfig.yaml
-
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
 resources:
 - ../crd
-- ../rbac
-- ../manager
-- ../harness-wrapper
-- ../admission
-- ../policy
-# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
-# crd/kustomization.yaml
-#- ../webhook
-# [METRICS] Expose the controller manager metrics service.
-- metrics_service.yaml
-# [API] Expose the controller manager API service for worker result submission.
-- api_service.yaml
-# Uncomment the patches line if you enable Metrics
-patches:
-# [METRICS] The following patch will enable the metrics endpoint using HTTPS and the port :8443.
-# More info: https://book.kubebuilder.io/reference/metrics
-- path: manager_metrics_patch.yaml
-  target:
-    kind: Deployment
-    name: controller-manager
+- ../acp-workload
 
 # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
 # crd/kustomization.yaml
-#- path: manager_webhook_patch.yaml
-#  target:
-#    kind: Deployment
-#    name: controller-manager
+#- ../webhook
 
 # Webhook CA injection replacements are intentionally not configured here.
 # Future webhook CA bundle injection should be wired into the manager runtime.
 # +kubebuilder:scaffold:crdkustomizecainjectionns
 # +kubebuilder:scaffold:crdkustomizecainjectionname
-
-replacements:
-- source:
-    group: ""
-    version: v1
-    kind: Namespace
-    name: system
-    fieldPath: metadata.name
-  targets:
-  - select:
-      group: admissionregistration.k8s.io
-      version: v1
-      kind: ValidatingAdmissionPolicy
-      name: gateway-task-protection
-    fieldPaths:
-    - spec.variables.[name=controllerNamespace].expression
-    options:
-      delimiter: "'"
-      index: 1
-- source:
-    group: ""
-    version: v1
-    kind: ServiceAccount
-    name: controller-manager
-    fieldPath: metadata.name
-  targets:
-  - select:
-      group: admissionregistration.k8s.io
-      version: v1
-      kind: ValidatingAdmissionPolicy
-      name: gateway-task-protection
-    fieldPaths:
-    - spec.variables.[name=controllerServiceAccount].expression
-    options:
-      delimiter: "'"
-      index: 1
-- source:
-    group: ""
-    version: v1
-    kind: ServiceAccount
-    name: ai-worker
-    fieldPath: metadata.name
-  targets:
-  - select:
-      group: admissionregistration.k8s.io
-      version: v1
-      kind: ValidatingAdmissionPolicy
-      name: gateway-task-protection
-    fieldPaths:
-    - spec.variables.[name=aiWorkerServiceAccount].expression
-    options:
-      delimiter: "'"
-      index: 1
-- source:
-    group: ""
-    version: v1
-    kind: ServiceAccount
-    name: vendor-worker
-    fieldPath: metadata.name
-  targets:
-  - select:
-      group: admissionregistration.k8s.io
-      version: v1
-      kind: ValidatingAdmissionPolicy
-      name: gateway-task-protection
-    fieldPaths:
-    - spec.variables.[name=vendorWorkerServiceAccount].expression
-    options:
-      delimiter: "'"
-      index: 1
-- source:
-    group: ""
-    version: v1
-    kind: ServiceAccount
-    name: container-worker
-    fieldPath: metadata.name
-  targets:
-  - select:
-      group: admissionregistration.k8s.io
-      version: v1
-      kind: ValidatingAdmissionPolicy
-      name: gateway-task-protection
-    fieldPaths:
-    - spec.variables.[name=containerWorkerServiceAccount].expression
-    options:
-      delimiter: "'"
-      index: 1
-
-transformers:
-- remove_admission_policy_namespace.yaml
-- remove_admission_policy_binding_namespace.yaml
diff --git a/config/harness-wrapper/README.md b/config/harness-wrapper/README.md
index 1bc05c13f..5442268f9 100644
--- a/config/harness-wrapper/README.md
+++ b/config/harness-wrapper/README.md
@@ -1,22 +1,90 @@
-# Harness wrapper authentication Secret
+# Harness v1 wrapper
 
-The canonical Kustomize installer intentionally does **not** commit or generate
-the shared bearer token. Before applying `deploy/orka.yaml` directly, create the
-required Secret in `orka-system` without printing the token:
+This Kustomize base is the data plane for a static `harness-v1` installation.
+It is intentionally absent from `config/default` and
+`config/acp-production`. Deploy it only with a v1 controller whose non-empty
+watch namespace is labeled `orka.ai/controller-mode: harness-v1` and whose
+startup mode is `--controller-mode=harness-v1`.
 
-```bash
-set -euo pipefail
+The v1 installation has its own controller namespace, watched namespace,
+ServiceAccount, Lease, API endpoint, SQLite store, Secrets, and wrapper ledger.
+It must not share those resources with a `harness-v2` installation. The wrapper
+is never a fallback for failed ACP work, and its Tasks and Sessions cannot be
+continued by v2.
+
+Before applying the base:
+
+1. Replace the all-zero wrapper image digest through an operator-controlled
+   overlay with the exact reviewed `repository@sha256:<digest>` reference.
+2. Create distinct bearer and TLS Secrets in `orka-system` without printing
+   the bearer value. The serving certificate must authenticate
+   `agent-harness-wrapper.orka-system.svc`:
+
+   ```bash
+   kubectl create namespace orka-system --dry-run=client -o yaml | kubectl apply -f -
+   if ! kubectl -n orka-system get secret harness-wrapper-auth >/dev/null 2>&1; then
+     openssl rand -hex 32 | \
+       kubectl -n orka-system create secret generic harness-wrapper-auth \
+         --from-file=token=/dev/stdin
+   fi
+   if ! kubectl -n orka-system get secret harness-wrapper-tls >/dev/null 2>&1; then
+     kubectl -n orka-system create secret generic harness-wrapper-tls \
+         --from-file=tls.crt=/path/to/tls.crt \
+         --from-file=tls.key=/path/to/tls.key \
+         --from-file=ca.crt=/path/to/ca.crt
+   fi
+   ```
+
+The wrapper has a dedicated ServiceAccount with broad token automount disabled,
+a short-lived projected token used only to authenticate artifact uploads to its
+controller, a PVC-backed admission ledger, controller-only ingress, and egress
+limited to that controller, DNS, and public HTTPS provider/read-only SCM
+endpoints. Do not mount Git, forge, publisher, provider-proxy, or other
+publication credentials into this Pod.
+Terminal and rejected ledger rows become reclaimable only after the controller
+acknowledges their exact durable settlement. The shipped 720-hour retention
+window preserves duplicate-suppression and audit/backup evidence before bounded
+garbage collection; configure a longer window when policy requires it.
 
-kubectl create namespace orka-system --dry-run=client -o yaml | kubectl apply -f -
-if ! kubectl -n orka-system get secret harness-wrapper-auth >/dev/null 2>&1; then
-  openssl rand -hex 32 | \
-    kubectl -n orka-system create secret generic harness-wrapper-auth \
-      --from-file=token=/dev/stdin
-fi
+Before changing any wrapper Pod-template field, run the authenticated wrapper
+drain client from the currently deployed wrapper image and wait for it to
+succeed:
 
-kubectl apply -f deploy/orka.yaml
+```bash
+/orka-agent-harness-wrapper drain \
+  --endpoint=https://agent-harness-wrapper.orka-system.svc:8080 \
+  --bearer-token-file=/var/run/orka/harness-wrapper-auth/token \
+  --ca-file=/var/run/orka/harness-wrapper-tls/ca.crt \
+  --timeout=15m \
+  --poll-interval=2s \
+  --next-generation=2
 ```
 
-`make deploy` performs the same preflight and creates the Secret only when it is
-absent. Helm installs use the chart-managed Secret or
-`workers.harnessWrapper.auth.existingSecret` instead.
+Run the command from a narrowly isolated Pod labeled
+`app.kubernetes.io/name=orka,app.kubernetes.io/component=agent-harness-wrapper-drain`
+that can read only the dedicated wrapper auth Secret and the current wrapper
+TLS Secret, and reach only the wrapper Service. Never place the bearer token on
+the command line or in logs. A timeout aborts the rollout: do not mutate the
+Deployment. After a successful drain, update
+`ORKA_HARNESS_WRAPPER_LEDGER_GENERATION` in the overlay to the same
+`--next-generation` value and apply the Deployment change. Increment the value
+exactly once for every later wrapper Pod-template replacement; ordinary Pod
+restart with an unchanged template keeps the current generation.
+
+Certificate renewal changes only `harness-wrapper-tls`; never add TLS material
+to or update `harness-wrapper-auth`, because accepted attempts pin that Secret's
+UID and resourceVersion as execution authority. Treat renewal as a drained Pod
+template replacement: preferably create a versioned TLS Secret, drain with the
+old Secret's CA, then patch the Deployment and controller CA mount to the new
+Secret while advancing the ledger generation. For same-name renewal, retain a
+CA bundle that trusts the currently served certificate until the drained
+replacement is running.
+
+This wrapper drain protects v1 turn state during a Pod-template replacement. It
+is not a controller mode and does not transfer work to v2.
+
+For permanent shutdown or uninstall, first stop every v1 producer and revoke
+new Task creation. Then omit `--next-generation`; this leaves wrapper admission
+closed and never authorizes a replacement wrapper to reopen it. Retain the
+ledger PVC until all v1 execution and cleanup work is settled and the reviewed
+backup/retention procedure has completed.
diff --git a/config/harness-wrapper/deployment.yaml b/config/harness-wrapper/deployment.yaml
index 0e29a2250..a1a274ea3 100644
--- a/config/harness-wrapper/deployment.yaml
+++ b/config/harness-wrapper/deployment.yaml
@@ -19,92 +19,133 @@ spec:
       labels:
         app.kubernetes.io/name: orka
         app.kubernetes.io/component: agent-harness-wrapper
+        orka.ai/network-role: harness-v1
     spec:
       serviceAccountName: agent-harness-wrapper
       automountServiceAccountToken: false
       securityContext:
-        # The wrapper process runs as root only so it can read 0400 controller
-        # token volumes and set child credentials. Runtime commands are launched
-        # through commandSysProcAttr with ORKA_HARNESS_WRAPPER_CHILD_UID/GID.
+        # The wrapper starts as root only to isolate each runtime subprocess
+        # under the dedicated unprivileged child UID/GID.
         runAsUser: 0
         runAsGroup: 0
         seccompProfile:
           type: RuntimeDefault
       containers:
-      - name: wrapper
-        image: ghcr.io/orka-agents/orka/agent-harness-wrapper:0.1.1
-        imagePullPolicy: IfNotPresent
-        ports:
-        - name: http
-          containerPort: 8080
-        env:
-        - name: ORKA_HARNESS_WRAPPER_RUNTIME
-          value: multi
-        - name: ORKA_HARNESS_WRAPPER_LISTEN_ADDR
-          value: :8080
-        - name: ORKA_HARNESS_WRAPPER_BEARER_TOKEN_FILE
-          value: /var/run/orka/harness-wrapper/token
-        - name: ORKA_ALLOW_BASH
-          value: "true"
-        # All turn subprocesses run under this unprivileged identity.
-        - name: ORKA_HARNESS_WRAPPER_CHILD_UID
-          value: "1000"
-        - name: ORKA_HARNESS_WRAPPER_CHILD_GID
-          value: "1000"
-        - name: ORKA_CODEX_SANDBOX_MODE
-          value: danger-full-access
-        - name: ORKA_SA_TOKEN_PATH
-          value: /var/run/orka/upload-token/token
-        volumeMounts:
+        - name: wrapper
+          # Fail-closed placeholder. An operator overlay must replace this with
+          # the reviewed wrapper image digest before enabling harness v1.
+          image: ghcr.io/orka-agents/orka/agent-harness-wrapper@sha256:0000000000000000000000000000000000000000000000000000000000000000
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: https
+              containerPort: 8080
+              protocol: TCP
+          env:
+            - name: ORKA_HARNESS_WRAPPER_RUNTIME
+              value: multi
+            - name: ORKA_HARNESS_WRAPPER_LISTEN_ADDR
+              value: :8080
+            - name: ORKA_CONTROLLER_URL
+              value: http://orka-api.orka-system.svc:8080
+            - name: ORKA_HARNESS_WRAPPER_BEARER_TOKEN_FILE
+              value: /var/run/orka/harness-wrapper-auth/token
+            - name: ORKA_HARNESS_WRAPPER_TLS_CERT_FILE
+              value: /var/run/orka/harness-wrapper-tls/tls.crt
+            - name: ORKA_HARNESS_WRAPPER_TLS_KEY_FILE
+              value: /var/run/orka/harness-wrapper-tls/tls.key
+            - name: ORKA_HARNESS_WRAPPER_ADMISSION_LEDGER_PATH
+              value: /var/lib/orka/harness-v1/admission-ledger.db
+            - name: ORKA_HARNESS_WRAPPER_LEDGER_GENERATION
+              value: "1"
+            - name: ORKA_HARNESS_WRAPPER_LEDGER_RETENTION
+              value: 720h
+            - name: ORKA_ALLOW_BASH
+              value: "true"
+            - name: ORKA_HARNESS_WRAPPER_CHILD_UID
+              value: "1000"
+            - name: ORKA_HARNESS_WRAPPER_CHILD_GID
+              value: "1000"
+            - name: ORKA_CODEX_SANDBOX_MODE
+              value: workspace-write
+          volumeMounts:
+            - name: auth
+              mountPath: /var/run/orka/harness-wrapper-auth
+              readOnly: true
+            - name: tls
+              mountPath: /var/run/orka/harness-wrapper-tls
+              readOnly: true
+            - name: controller-api-token
+              mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+              readOnly: true
+            - name: ledger
+              mountPath: /var/lib/orka/harness-v1
+            - name: tmp
+              mountPath: /tmp
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsUser: 0
+            runAsGroup: 0
+            capabilities:
+              drop:
+                - ALL
+              add:
+                - SETUID
+                - SETGID
+                - CHOWN
+                - KILL
+                - FOWNER
+          livenessProbe:
+            httpGet:
+              path: /v1/health
+              port: https
+              scheme: HTTPS
+            initialDelaySeconds: 10
+            periodSeconds: 20
+          readinessProbe:
+            httpGet:
+              path: /v1/ready
+              port: https
+              scheme: HTTPS
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+              ephemeral-storage: 512Mi
+            limits:
+              cpu: "2"
+              memory: 2Gi
+              ephemeral-storage: 2Gi
+      volumes:
         - name: auth
-          mountPath: /var/run/orka/harness-wrapper
-          readOnly: true
-        - name: upload-token
-          mountPath: /var/run/orka/upload-token
-          readOnly: true
+          secret:
+            secretName: harness-wrapper-auth
+            defaultMode: 0400
+            items:
+              - key: token
+                path: token
+        - name: tls
+          secret:
+            secretName: harness-wrapper-tls
+            defaultMode: 0400
+            items:
+              - key: tls.crt
+                path: tls.crt
+              - key: tls.key
+                path: tls.key
+              - key: ca.crt
+                path: ca.crt
+        - name: controller-api-token
+          projected:
+            defaultMode: 0400
+            sources:
+              - serviceAccountToken:
+                  path: token
+                  expirationSeconds: 3600
+        - name: ledger
+          persistentVolumeClaim:
+            claimName: harness-wrapper-ledger
         - name: tmp
-          mountPath: /tmp
-        securityContext:
-          allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: true
-          capabilities:
-            drop:
-            - ALL
-            add:
-            - SETUID
-            - SETGID
-            - CHOWN
-            - KILL
-            - FOWNER
-        livenessProbe:
-          httpGet:
-            path: /v1/health
-            port: http
-          initialDelaySeconds: 10
-          periodSeconds: 20
-        readinessProbe:
-          httpGet:
-            path: /v1/health
-            port: http
-          initialDelaySeconds: 5
-          periodSeconds: 10
-        resources:
-          requests:
-            cpu: 100m
-            memory: 256Mi
-          limits:
-            cpu: "2"
-            memory: 2Gi
-      volumes:
-      - name: upload-token
-        projected:
-          defaultMode: 0400
-          sources:
-          - serviceAccountToken:
-              path: token
-      - name: auth
-        secret:
-          secretName: harness-wrapper-auth
-          defaultMode: 0400
-      - name: tmp
-        emptyDir: {}
+          emptyDir: {}
diff --git a/config/harness-wrapper/kustomization.yaml b/config/harness-wrapper/kustomization.yaml
index 23ca489e6..3d59e8a6a 100644
--- a/config/harness-wrapper/kustomization.yaml
+++ b/config/harness-wrapper/kustomization.yaml
@@ -1,10 +1,16 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-# `harness-wrapper-auth` must be pre-created; see README.md.
-resources:
-- serviceaccount.yaml
-- deployment.yaml
-- service.yaml
 
-patches:
-- path: volume-mode-patch.yaml
+# This compatibility data plane is intentionally not referenced by
+# config/default or config/acp-production. Apply it only after explicitly
+# selecting a dedicated harness-v1 controller installation.
+namespace: orka-system
+
+# The distinct harness-wrapper-auth and harness-wrapper-tls Secrets must be
+# pre-created; see README.md.
+resources:
+  - serviceaccount.yaml
+  - deployment.yaml
+  - service.yaml
+  - pvc.yaml
+  - networkpolicy.yaml
diff --git a/config/harness-wrapper/networkpolicy.yaml b/config/harness-wrapper/networkpolicy.yaml
new file mode 100644
index 000000000..90718213f
--- /dev/null
+++ b/config/harness-wrapper/networkpolicy.yaml
@@ -0,0 +1,90 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: agent-harness-wrapper
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: agent-harness-wrapper
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: orka
+      app.kubernetes.io/component: agent-harness-wrapper
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: orka
+              control-plane: controller-manager
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: orka
+              app.kubernetes.io/component: agent-harness-wrapper-drain
+      ports:
+        - protocol: TCP
+          port: 8080
+  # Permit only the dedicated controller, DNS, and public HTTPS for provider
+  # APIs and credential-free, read-only SCM access. Private and local
+  # destination ranges remain denied.
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: orka
+              control-plane: controller-manager
+      ports:
+        - protocol: TCP
+          port: 8080
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - {protocol: UDP, port: 53}
+        - {protocol: TCP, port: 53}
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 0.0.0.0/8
+              - 10.0.0.0/8
+              - 100.64.0.0/10
+              - 127.0.0.0/8
+              - 169.254.0.0/16
+              - 172.16.0.0/12
+              - 192.0.0.0/24
+              - 192.0.2.0/24
+              - 192.168.0.0/16
+              - 198.18.0.0/15
+              - 198.51.100.0/24
+              - 203.0.113.0/24
+              - 224.0.0.0/4
+              - 240.0.0.0/4
+      ports:
+        - protocol: TCP
+          port: 443
+    - to:
+        - ipBlock:
+            cidr: ::/0
+            except:
+              - ::/128
+              - ::1/128
+              - 64:ff9b::/96
+              - 64:ff9b:1::/48
+              - 100::/64
+              - 2001::/32
+              - 2001:db8::/32
+              - 2002::/16
+              - fc00::/7
+              - fe80::/10
+              - ff00::/8
+      ports:
+        - protocol: TCP
+          port: 443
diff --git a/config/harness-wrapper/pvc.yaml b/config/harness-wrapper/pvc.yaml
new file mode 100644
index 000000000..f36d990cc
--- /dev/null
+++ b/config/harness-wrapper/pvc.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: harness-wrapper-ledger
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: agent-harness-wrapper
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
diff --git a/config/harness-wrapper/service.yaml b/config/harness-wrapper/service.yaml
index d79491e77..fb2073e20 100644
--- a/config/harness-wrapper/service.yaml
+++ b/config/harness-wrapper/service.yaml
@@ -11,6 +11,7 @@ spec:
     app.kubernetes.io/name: orka
     app.kubernetes.io/component: agent-harness-wrapper
   ports:
-  - name: http
-    port: 8080
-    targetPort: http
+    - name: https
+      port: 8080
+      targetPort: https
+      protocol: TCP
diff --git a/config/harness-wrapper/serviceaccount.yaml b/config/harness-wrapper/serviceaccount.yaml
index 3f00a64b8..5c3ba980e 100644
--- a/config/harness-wrapper/serviceaccount.yaml
+++ b/config/harness-wrapper/serviceaccount.yaml
@@ -6,3 +6,4 @@ metadata:
     app.kubernetes.io/name: orka
     app.kubernetes.io/component: agent-harness-wrapper
     app.kubernetes.io/managed-by: kustomize
+automountServiceAccountToken: false
diff --git a/config/harness-wrapper/volume-mode-patch.yaml b/config/harness-wrapper/volume-mode-patch.yaml
deleted file mode 100644
index bcc862efa..000000000
--- a/config/harness-wrapper/volume-mode-patch.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: agent-harness-wrapper
-spec:
-  template:
-    spec:
-      volumes:
-      - name: upload-token
-        projected:
-          defaultMode: 0400
-      - name: auth
-        secret:
-          defaultMode: 0400
diff --git a/config/manager/kustomization.yaml b/config/manager/kustomization.yaml
index 1b48346e4..c06226ce2 100644
--- a/config/manager/kustomization.yaml
+++ b/config/manager/kustomization.yaml
@@ -1,8 +1,10 @@
 resources:
 - manager.yaml
 - store-pvc.yaml
+
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: system
 images:
 - newName: ghcr.io/orka-agents/orka
   newTag: 0.1.1
diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml
index c429eec25..ddc390a44 100644
--- a/config/manager/manager.yaml
+++ b/config/manager/manager.yaml
@@ -8,6 +8,7 @@ metadata:
     pod-security.kubernetes.io/enforce: baseline
     pod-security.kubernetes.io/warn: restricted
     pod-security.kubernetes.io/audit: restricted
+    orka.ai/controller-mode: harness-v2
   name: system
 ---
 apiVersion: apps/v1
@@ -34,6 +35,7 @@ spec:
       labels:
         control-plane: controller-manager
         app.kubernetes.io/name: orka
+        orka.ai/network-role: controller
     spec:
       # TODO(user): Uncomment the following code to configure the nodeAffinity expression
       # according to the platforms which are supported by your solution.
@@ -71,7 +73,23 @@ spec:
           - --health-probe-bind-address=:8081
           - --store-backend=sqlite
           - --store-path=/data/orka.db
+          - --agent-execution-snapshot-key-file=/var/run/orka/agent-execution-snapshot/key
+          - --agent-execution-snapshot-retention=720h
+          - --agent-execution-snapshot-retention-interval=1h
           - --controller-url=http://orka-api.orka-system.svc:8080
+          - --controller-mode=harness-v2
+          - --watch-namespace=orka-system
+          - --enforce-namespace-isolation=true
+          - --execution-mode-controller-usernames=system:serviceaccount:orka-system:orka-controller-manager
+          - --acp-upgrade-drain-bind-address=127.0.0.1:8083
+          - --acp-upgrade-drain-timeout=5m
+          - --acp-upgrade-drain-poll-interval=1s
+          - --acp-upgrade-drain-trigger-timeout=5m15s
+          - --acp-upgrade-drain-marker-namespace=orka-system
+          - --acp-provider-proxy-base-url=http://orka-provider-auth-proxy.orka-system.svc:8080
+          - --acp-provider-proxy-namespace=orka-system
+          - --acp-provider-proxy-pod-labels=orka.ai/network-role=provider-auth-proxy
+          - --acp-provider-proxy-token-file=/var/run/orka/provider-auth/token
           - --ai-worker-image=ghcr.io/orka-agents/orka/ai-worker:0.1.1
           - --general-worker-image=ghcr.io/orka-agents/orka/general-worker:0.1.1
           - --gateway-enabled=true
@@ -82,6 +100,7 @@ spec:
           - --gateway-terminal-retention=720h
           - --gateway-delivery-timeout=15s
           - --gateway-delivery-max-attempts=10
+
           - --execution-workspace-default-provider=agent-sandbox
           - --agent-sandbox-enabled=false
           - --agent-sandbox-warm-pool-policy=disabled
@@ -100,12 +119,36 @@ spec:
         imagePullPolicy: IfNotPresent
         name: manager
         env:
-          - name: ORKA_HARNESS_WRAPPER_ENDPOINT
-            value: http://orka-agent-harness-wrapper:8080
-          - name: ORKA_HARNESS_WRAPPER_BEARER_TOKEN_FILE
-            value: /var/run/orka/harness-wrapper/token
-          - name: ORKA_HARNESS_WRAPPER_SERVICE_ACCOUNT_NAME
-            value: orka-agent-harness-wrapper
+          - name: ORKA_ACP_ARTIFACT_CAPABILITY_SECRET_FILE
+            value: /var/run/orka/acp-artifacts/capability-secret
+          - name: ORKA_ACP_ARTIFACT_ROOT
+            value: /data/acp-artifacts
+          - name: ORKA_ACP_CODEX_RUNTIME_IMAGE
+            valueFrom:
+              configMapKeyRef:
+                name: acp-runtime-images
+                key: ORKA_ACP_CODEX_RUNTIME_IMAGE
+          - name: ORKA_ACP_CLAUDE_RUNTIME_IMAGE
+            valueFrom:
+              configMapKeyRef:
+                name: acp-runtime-images
+                key: ORKA_ACP_CLAUDE_RUNTIME_IMAGE
+          - name: ORKA_ACP_COPILOT_RUNTIME_IMAGE
+            valueFrom:
+              configMapKeyRef:
+                name: acp-runtime-images
+                key: ORKA_ACP_COPILOT_RUNTIME_IMAGE
+          - name: ORKA_ACP_OPENCODE_RUNTIME_IMAGE
+            valueFrom:
+              configMapKeyRef:
+                name: acp-runtime-images
+                key: ORKA_ACP_OPENCODE_RUNTIME_IMAGE
+          - name: ORKA_WORKSPACE_PUBLISHER_URL
+            value: http://orka-workspace-publisher.orka-system.svc:8080
+          - name: ORKA_WORKSPACE_PUBLISHER_CONTROLLER_TOKEN_FILE
+            value: /var/run/orka/publisher-auth/controller-token
+          - name: ORKA_WORKSPACE_PUBLISHER_CAPABILITY_SECRET_FILE
+            value: /var/run/orka/publisher-auth/operation-capability-secret
         ports: []
         securityContext:
           readOnlyRootFilesystem: true
@@ -113,6 +156,13 @@ spec:
           capabilities:
             drop:
             - "ALL"
+        lifecycle:
+          preStop:
+            exec:
+              command:
+                - /manager
+                - --acp-upgrade-drain-trigger-url=http://127.0.0.1:8083/acp/upgrade-drain
+                - --acp-upgrade-drain-trigger-timeout=5m15s
         livenessProbe:
           httpGet:
             path: /healthz
@@ -139,8 +189,17 @@ spec:
             mountPath: /data
           - name: tmp
             mountPath: /tmp
-          - name: harness-wrapper-auth
-            mountPath: /var/run/orka/harness-wrapper
+          - name: acp-artifact-capability
+            mountPath: /var/run/orka/acp-artifacts
+            readOnly: true
+          - name: workspace-publisher-auth
+            mountPath: /var/run/orka/publisher-auth
+            readOnly: true
+          - name: provider-auth-proxy
+            mountPath: /var/run/orka/provider-auth
+            readOnly: true
+          - name: agent-execution-snapshot-key
+            mountPath: /var/run/orka/agent-execution-snapshot
             readOnly: true
       volumes:
         - name: store
@@ -148,8 +207,30 @@ spec:
             claimName: controller-manager-store
         - name: tmp
           emptyDir: {}
-        - name: harness-wrapper-auth
+        - name: acp-artifact-capability
+          secret:
+            secretName: acp-artifact-capability
+            defaultMode: 0400
+            items:
+              - key: capability-secret
+                path: capability-secret
+        - name: workspace-publisher-auth
+          secret:
+            secretName: workspace-publisher-auth
+            defaultMode: 0400
+        - name: provider-auth-proxy
+          secret:
+            secretName: provider-auth-proxy
+            defaultMode: 0400
+            items:
+              - key: token
+                path: token
+        - name: agent-execution-snapshot-key
           secret:
-            secretName: harness-wrapper-auth
+            secretName: agent-execution-snapshot-key
+            defaultMode: 0400
+            items:
+              - key: snapshot-key
+                path: key
       serviceAccountName: controller-manager
-      terminationGracePeriodSeconds: 10
+      terminationGracePeriodSeconds: 360
diff --git a/config/orka-admission-webhooks/README.md b/config/orka-admission-webhooks/README.md
new file mode 100644
index 000000000..806443d9c
--- /dev/null
+++ b/config/orka-admission-webhooks/README.md
@@ -0,0 +1,34 @@
+# Orka fail-closed admission webhooks
+
+This is the second admission installation wave for the immutable namespace
+mode, Agent and AgentRuntime contracts, Task execution authority,
+Task-provenance, and workspace-class authorization boundaries. Apply it only
+after:
+
+- `../orka-admission` has at least two ready Service endpoints;
+- `orka-admission-tls` contains a valid serving certificate for
+  `orka-admission.orka-system.svc` and a `ca.crt` bundle;
+- the Secret is annotated `cert-manager.io/allow-direct-injection: "true"`;
+- an AdmissionReview smoke test has reached every enabled handler.
+
+Trusted identities embedded in `validating_webhook.yaml` must exactly match the
+corresponding admission-runtime arguments. The checked-in example authorizes
+the canonical direct-Kustomize controller in `orka-system`, plus the exact
+controller identities for Helm releases `orka-v1` in `orka-v1-system` and
+`orka-v2` in `orka-v2-system`. If any identity differs, patch the shared runtime
+and all three `route-unless-controller-cleanup-safe` conditions as one reviewed
+platform change before enabling the webhooks.
+
+The namespace webhook permits a Namespace to be created with one valid
+`orka.ai/controller-mode` claim and then makes that claim immutable. It rejects
+adding a claim to an existing unlabeled Namespace. The resource webhooks require
+contracts and new Task bindings to match that claim. The static harness
+architecture does not install admission policies for dynamic backend modes,
+cross-protocol binding, migration classification, or adjudication. Each
+controller accepts one startup mode and one labeled watch namespace; the two
+releases do not share a Task population.
+
+All retained webhook entries use `failurePolicy: Fail`. Delete their
+configurations before removing the last admission endpoint or its TLS Secret.
+The platform owner installs this `ValidatingWebhookConfiguration` exactly
+once; neither controller release owns a second copy.
diff --git a/config/orka-admission-webhooks/kustomization.yaml b/config/orka-admission-webhooks/kustomization.yaml
new file mode 100644
index 000000000..2929e57f9
--- /dev/null
+++ b/config/orka-admission-webhooks/kustomization.yaml
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - validating_webhook.yaml
diff --git a/config/orka-admission-webhooks/validating_webhook.yaml b/config/orka-admission-webhooks/validating_webhook.yaml
new file mode 100644
index 000000000..e9dab1b3d
--- /dev/null
+++ b/config/orka-admission-webhooks/validating_webhook.yaml
@@ -0,0 +1,183 @@
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: orka-admission
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: admission
+    app.kubernetes.io/managed-by: kustomize
+  annotations:
+    cert-manager.io/inject-ca-from-secret: orka-system/orka-admission-tls
+# The controller identities in matchConditions must remain identical to the
+# corresponding orka-admission command argument. Patch the platform-owned
+# runtime and webhook configuration atomically when using noncanonical release
+# namespaces or ServiceAccount names.
+webhooks:
+  - name: namespaceexecutionmode.core.orka.ai
+    admissionReviewVersions: [v1]
+    sideEffects: None
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    timeoutSeconds: 10
+    clientConfig:
+      service: {name: orka-admission, namespace: orka-system, path: /validate-v1-namespace-execution-mode, port: 443}
+    rules:
+      - {operations: [CREATE, UPDATE], apiGroups: [""], apiVersions: [v1], resources: [namespaces], scope: Cluster}
+    matchConditions:
+      - name: execution-mode-claim-present
+        expression: >-
+          object.metadata.?labels.orValue({}).exists(k, k == 'orka.ai/controller-mode') ||
+          oldObject.?metadata.?labels.orValue({}).exists(k, k == 'orka.ai/controller-mode')
+  - name: taskprovenance.core.orka.ai
+    admissionReviewVersions: [v1]
+    sideEffects: None
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    timeoutSeconds: 10
+    clientConfig:
+      service: {name: orka-admission, namespace: orka-system, path: /validate-core-orka-ai-v1alpha1-task-provenance, port: 443}
+    rules:
+      - {operations: [CREATE, UPDATE], apiGroups: [core.orka.ai], apiVersions: [v1alpha1], resources: [tasks], scope: Namespaced}
+    matchConditions:
+      - name: route-unless-controller-cleanup-safe
+        expression: >-
+          !((request.userInfo.username == 'system:serviceaccount:orka-system:orka-controller-manager' ||
+          request.userInfo.username == 'system:serviceaccount:orka-v1-system:orka-v1' ||
+          request.userInfo.username == 'system:serviceaccount:orka-v2-system:orka-v2') &&
+          request.operation == 'UPDATE' &&
+          has(oldObject.metadata.deletionTimestamp) &&
+          has(object.metadata.deletionTimestamp) &&
+          object.metadata.deletionTimestamp == oldObject.metadata.deletionTimestamp &&
+          oldObject.metadata.?finalizers.orValue([]).exists(f, f == 'orka.ai/cleanup') &&
+          !object.metadata.?finalizers.orValue([]).exists(f, f == 'orka.ai/cleanup') &&
+          object.metadata.?finalizers.orValue([]) ==
+          oldObject.metadata.?finalizers.orValue([]).filter(f, f != 'orka.ai/cleanup') &&
+          object.apiVersion == oldObject.apiVersion &&
+          object.kind == oldObject.kind &&
+          object.spec == oldObject.spec &&
+          object.?status.orValue({}) == oldObject.?status.orValue({}) &&
+          object.metadata.name == oldObject.metadata.name &&
+          object.metadata.?generateName.orValue('') == oldObject.metadata.?generateName.orValue('') &&
+          object.metadata.namespace == oldObject.metadata.namespace &&
+          object.metadata.uid == oldObject.metadata.uid &&
+          object.metadata.resourceVersion == oldObject.metadata.resourceVersion &&
+          object.metadata.generation == oldObject.metadata.generation &&
+          object.metadata.creationTimestamp == oldObject.metadata.creationTimestamp &&
+          object.metadata.?deletionGracePeriodSeconds.orValue(0) ==
+          oldObject.metadata.?deletionGracePeriodSeconds.orValue(0) &&
+          object.metadata.?labels.orValue({}) == oldObject.metadata.?labels.orValue({}) &&
+          object.metadata.?annotations.orValue({}) == oldObject.metadata.?annotations.orValue({}) &&
+          object.metadata.?ownerReferences.orValue([]) == oldObject.metadata.?ownerReferences.orValue([]) &&
+          object.metadata.?managedFields.orValue([]) == oldObject.metadata.?managedFields.orValue([]))
+  - name: taskworkspaceclassuse.core.orka.ai
+    admissionReviewVersions: [v1]
+    sideEffects: None
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    timeoutSeconds: 10
+    clientConfig:
+      service: {name: orka-admission, namespace: orka-system, path: /validate-core-orka-ai-v1alpha1-task-workspace-class-use, port: 443}
+    rules:
+      - {operations: [CREATE, UPDATE], apiGroups: [core.orka.ai], apiVersions: [v1alpha1], resources: [tasks], scope: Namespaced}
+    matchConditions:
+      - name: route-unless-controller-cleanup-safe
+        expression: >-
+          !((request.userInfo.username == 'system:serviceaccount:orka-system:orka-controller-manager' ||
+          request.userInfo.username == 'system:serviceaccount:orka-v1-system:orka-v1' ||
+          request.userInfo.username == 'system:serviceaccount:orka-v2-system:orka-v2') &&
+          request.operation == 'UPDATE' &&
+          has(oldObject.metadata.deletionTimestamp) &&
+          has(object.metadata.deletionTimestamp) &&
+          object.metadata.deletionTimestamp == oldObject.metadata.deletionTimestamp &&
+          oldObject.metadata.?finalizers.orValue([]).exists(f, f == 'orka.ai/cleanup') &&
+          !object.metadata.?finalizers.orValue([]).exists(f, f == 'orka.ai/cleanup') &&
+          object.metadata.?finalizers.orValue([]) ==
+          oldObject.metadata.?finalizers.orValue([]).filter(f, f != 'orka.ai/cleanup') &&
+          object.apiVersion == oldObject.apiVersion &&
+          object.kind == oldObject.kind &&
+          object.spec == oldObject.spec &&
+          object.?status.orValue({}) == oldObject.?status.orValue({}) &&
+          object.metadata.name == oldObject.metadata.name &&
+          object.metadata.?generateName.orValue('') == oldObject.metadata.?generateName.orValue('') &&
+          object.metadata.namespace == oldObject.metadata.namespace &&
+          object.metadata.uid == oldObject.metadata.uid &&
+          object.metadata.resourceVersion == oldObject.metadata.resourceVersion &&
+          object.metadata.generation == oldObject.metadata.generation &&
+          object.metadata.creationTimestamp == oldObject.metadata.creationTimestamp &&
+          object.metadata.?deletionGracePeriodSeconds.orValue(0) ==
+          oldObject.metadata.?deletionGracePeriodSeconds.orValue(0) &&
+          object.metadata.?labels.orValue({}) == oldObject.metadata.?labels.orValue({}) &&
+          object.metadata.?annotations.orValue({}) == oldObject.metadata.?annotations.orValue({}) &&
+          object.metadata.?ownerReferences.orValue([]) == oldObject.metadata.?ownerReferences.orValue([]) &&
+          object.metadata.?managedFields.orValue([]) == oldObject.metadata.?managedFields.orValue([]))
+  - name: toolworkspaceclassuse.core.orka.ai
+    admissionReviewVersions: [v1]
+    sideEffects: None
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    timeoutSeconds: 10
+    clientConfig:
+      service: {name: orka-admission, namespace: orka-system, path: /validate-core-orka-ai-v1alpha1-tool-workspace-class-use, port: 443}
+    rules:
+      - {operations: [CREATE, UPDATE], apiGroups: [core.orka.ai], apiVersions: [v1alpha1], resources: [tools], scope: Namespaced}
+  - name: agentcontract.core.orka.ai
+    admissionReviewVersions: [v1]
+    sideEffects: None
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    timeoutSeconds: 10
+    clientConfig:
+      service: {name: orka-admission, namespace: orka-system, path: /validate-core-orka-ai-v1alpha1-agent-contract, port: 443}
+    rules:
+      - {operations: [CREATE, UPDATE], apiGroups: [core.orka.ai], apiVersions: [v1alpha1], resources: [agents], scope: Namespaced}
+  - name: agentruntimecontract.core.orka.ai
+    admissionReviewVersions: [v1]
+    sideEffects: None
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    timeoutSeconds: 10
+    clientConfig:
+      service: {name: orka-admission, namespace: orka-system, path: /validate-core-orka-ai-v1alpha1-agentruntime-contract, port: 443}
+    rules:
+      - {operations: [CREATE, UPDATE], apiGroups: [core.orka.ai], apiVersions: [v1alpha1], resources: [agentruntimes], scope: Namespaced}
+  - name: taskexecutionauthority.core.orka.ai
+    admissionReviewVersions: [v1]
+    sideEffects: None
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    timeoutSeconds: 10
+    clientConfig:
+      service: {name: orka-admission, namespace: orka-system, path: /validate-core-orka-ai-v1alpha1-task-execution-authority, port: 443}
+    rules:
+      - {operations: [CREATE, UPDATE], apiGroups: [core.orka.ai], apiVersions: [v1alpha1], resources: [tasks, tasks/status], scope: Namespaced}
+    matchConditions:
+      - name: route-unless-controller-cleanup-safe
+        expression: >-
+          !((request.userInfo.username == 'system:serviceaccount:orka-system:orka-controller-manager' ||
+          request.userInfo.username == 'system:serviceaccount:orka-v1-system:orka-v1' ||
+          request.userInfo.username == 'system:serviceaccount:orka-v2-system:orka-v2') &&
+          request.operation == 'UPDATE' &&
+          has(oldObject.metadata.deletionTimestamp) &&
+          has(object.metadata.deletionTimestamp) &&
+          object.metadata.deletionTimestamp == oldObject.metadata.deletionTimestamp &&
+          oldObject.metadata.?finalizers.orValue([]).exists(f, f == 'orka.ai/cleanup') &&
+          !object.metadata.?finalizers.orValue([]).exists(f, f == 'orka.ai/cleanup') &&
+          object.metadata.?finalizers.orValue([]) ==
+          oldObject.metadata.?finalizers.orValue([]).filter(f, f != 'orka.ai/cleanup') &&
+          object.apiVersion == oldObject.apiVersion &&
+          object.kind == oldObject.kind &&
+          object.spec == oldObject.spec &&
+          object.?status.orValue({}) == oldObject.?status.orValue({}) &&
+          object.metadata.name == oldObject.metadata.name &&
+          object.metadata.?generateName.orValue('') == oldObject.metadata.?generateName.orValue('') &&
+          object.metadata.namespace == oldObject.metadata.namespace &&
+          object.metadata.uid == oldObject.metadata.uid &&
+          object.metadata.resourceVersion == oldObject.metadata.resourceVersion &&
+          object.metadata.generation == oldObject.metadata.generation &&
+          object.metadata.creationTimestamp == oldObject.metadata.creationTimestamp &&
+          object.metadata.?deletionGracePeriodSeconds.orValue(0) ==
+          oldObject.metadata.?deletionGracePeriodSeconds.orValue(0) &&
+          object.metadata.?labels.orValue({}) == oldObject.metadata.?labels.orValue({}) &&
+          object.metadata.?annotations.orValue({}) == oldObject.metadata.?annotations.orValue({}) &&
+          object.metadata.?ownerReferences.orValue([]) == oldObject.metadata.?ownerReferences.orValue([]) &&
+          object.metadata.?managedFields.orValue([]) == oldObject.metadata.?managedFields.orValue([]))
diff --git a/config/orka-admission/README.md b/config/orka-admission/README.md
new file mode 100644
index 000000000..399292f2e
--- /dev/null
+++ b/config/orka-admission/README.md
@@ -0,0 +1,37 @@
+# Orka admission runtime
+
+This opt-in production base deploys the stateless `orka-admission` process
+independently from the controller. It intentionally does not install the
+fail-closed webhook configuration; apply `../orka-admission-webhooks` only
+after both replicas are ready and an AdmissionReview smoke test succeeds.
+
+Before applying this base:
+
+1. Replace `controller:latest` with the exact digest-pinned Orka controller
+   image that contains `/orka-admission`.
+2. Create `orka-admission-tls` in `orka-system` with `tls.crt`, `tls.key`, and
+   `ca.crt`. When using cert-manager direct CA injection, annotate the Secret
+   with `cert-manager.io/allow-direct-injection: "true"`.
+3. Patch any trusted controller or worker identities used by the execution
+   authority and provenance handlers. The checked-in example matches the
+   canonical direct-Kustomize controller in `orka-system`, plus Helm releases
+   `orka-v1` in `orka-v1-system` and `orka-v2` in `orka-v2-system`. If any
+   release namespace, release name, or ServiceAccount name differs,
+   patch `--controller-usernames`, `--task-provenance-trusted-users`, and
+   `--task-provenance-trusted-service-accounts`. Patch the exact same
+   controller usernames in every `route-unless-controller-cleanup-safe`
+   condition in `../orka-admission-webhooks/validating_webhook.yaml`.
+
+The dedicated ServiceAccount can read namespace mode claims and create
+SubjectAccessReviews for workspace-class authorization. It has no Orka CRD,
+Lease, SQLite, runtime-credential, dispatcher, or controller reconciliation
+access. Static harness mode and namespace ownership are controller startup
+contracts; this service does not provide dynamic backend-mode,
+classification, or adjudication APIs.
+
+Install this base once in the platform-owned `orka-system` namespace. Neither
+the v1 nor v2 release owns these cluster-scoped RBAC objects or the shared
+`ValidatingWebhookConfiguration`.
+
+Uninstall in reverse order: delete the webhook configuration first, then the
+runtime base after API server propagation is complete.
diff --git a/config/orka-admission/deployment.yaml b/config/orka-admission/deployment.yaml
new file mode 100644
index 000000000..841a356d4
--- /dev/null
+++ b/config/orka-admission/deployment.yaml
@@ -0,0 +1,116 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: orka-admission
+  namespace: orka-system
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: admission
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: orka
+      app.kubernetes.io/component: admission
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: orka
+        app.kubernetes.io/component: admission
+        orka.ai/network-role: admission
+    spec:
+      serviceAccountName: orka-admission
+      automountServiceAccountToken: true
+      terminationGracePeriodSeconds: 30
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                topologyKey: kubernetes.io/hostname
+                labelSelector:
+                  matchLabels:
+                    app.kubernetes.io/name: orka
+                    app.kubernetes.io/component: admission
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: admission
+          # Production overlays must replace this with the digest-pinned
+          # controller image containing /orka-admission.
+          image: controller:latest
+          imagePullPolicy: IfNotPresent
+          command: [/orka-admission]
+          args:
+            - --health-probe-bind-address=:8081
+            - --webhook-cert-path=/var/run/orka/admission/tls
+            - --webhook-cert-name=tls.crt
+            - --webhook-cert-key=tls.key
+            - --webhook-service-dns-name=orka-admission.orka-system.svc
+            - --controller-usernames=system:serviceaccount:orka-system:orka-controller-manager,system:serviceaccount:orka-v1-system:orka-v1,system:serviceaccount:orka-v2-system:orka-v2
+            - --task-provenance-trusted-users=system:serviceaccount:orka-system:orka-controller-manager,system:serviceaccount:orka-v1-system:orka-v1,system:serviceaccount:orka-v2-system:orka-v2
+            - --task-provenance-trusted-service-accounts=orka-ai-worker,orka-vendor-worker,orka-v1-ai-worker,orka-v1-vendor-worker,orka-v2-ai-worker,orka-v2-vendor-worker
+          ports:
+            - name: webhook
+              containerPort: 9443
+              protocol: TCP
+            - name: health
+              containerPort: 8081
+              protocol: TCP
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 65532
+            capabilities:
+              drop: [ALL]
+          lifecycle:
+            preStop:
+              exec:
+                command: [/orka-admission, --pre-stop-delay=5s]
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: health
+            periodSeconds: 5
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: health
+            periodSeconds: 10
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+              ephemeral-storage: 32Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+              ephemeral-storage: 128Mi
+          volumeMounts:
+            - name: tls
+              mountPath: /var/run/orka/admission/tls
+              readOnly: true
+      volumes:
+        - name: tls
+          secret:
+            secretName: orka-admission-tls
+            optional: false
+            items:
+              - key: tls.crt
+                path: tls.crt
+              - key: tls.key
+                path: tls.key
diff --git a/config/orka-admission/kustomization.yaml b/config/orka-admission/kustomization.yaml
new file mode 100644
index 000000000..70068d6e9
--- /dev/null
+++ b/config/orka-admission/kustomization.yaml
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: orka-system
+resources:
+  - serviceaccount.yaml
+  - rbac.yaml
+  - deployment.yaml
+  - service.yaml
+  - poddisruptionbudget.yaml
+  - networkpolicy.yaml
diff --git a/config/orka-admission/networkpolicy.yaml b/config/orka-admission/networkpolicy.yaml
new file mode 100644
index 000000000..3cfea418a
--- /dev/null
+++ b/config/orka-admission/networkpolicy.yaml
@@ -0,0 +1,27 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: orka-admission
+  namespace: orka-system
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: admission
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: orka
+      app.kubernetes.io/component: admission
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - ports:
+        - protocol: TCP
+          port: 9443
+        - protocol: TCP
+          port: 8081
+  egress:
+    - ports:
+        - protocol: TCP
+          port: 443
+        - protocol: TCP
+          port: 6443
diff --git a/config/orka-admission/poddisruptionbudget.yaml b/config/orka-admission/poddisruptionbudget.yaml
new file mode 100644
index 000000000..2db3c32cf
--- /dev/null
+++ b/config/orka-admission/poddisruptionbudget.yaml
@@ -0,0 +1,15 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: orka-admission
+  namespace: orka-system
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: admission
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: orka
+      app.kubernetes.io/component: admission
diff --git a/config/orka-admission/rbac.yaml b/config/orka-admission/rbac.yaml
new file mode 100644
index 000000000..938f196be
--- /dev/null
+++ b/config/orka-admission/rbac.yaml
@@ -0,0 +1,32 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: orka-admission
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: admission
+    app.kubernetes.io/managed-by: kustomize
+rules:
+  - apiGroups: [authorization.k8s.io]
+    resources: [subjectaccessreviews]
+    verbs: [create]
+  - apiGroups: [""]
+    resources: [namespaces]
+    verbs: [get]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: orka-admission
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: admission
+    app.kubernetes.io/managed-by: kustomize
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: orka-admission
+subjects:
+  - kind: ServiceAccount
+    name: orka-admission
+    namespace: orka-system
diff --git a/config/orka-admission/service.yaml b/config/orka-admission/service.yaml
new file mode 100644
index 000000000..f893b8c96
--- /dev/null
+++ b/config/orka-admission/service.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: orka-admission
+  namespace: orka-system
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: admission
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  selector:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: admission
+  ports:
+    - name: https
+      port: 443
+      targetPort: webhook
+      protocol: TCP
diff --git a/config/orka-admission/serviceaccount.yaml b/config/orka-admission/serviceaccount.yaml
new file mode 100644
index 000000000..add75a342
--- /dev/null
+++ b/config/orka-admission/serviceaccount.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: orka-admission
+  namespace: orka-system
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: admission
+    app.kubernetes.io/managed-by: kustomize
+automountServiceAccountToken: true
diff --git a/config/provider-proxy/deployment.yaml b/config/provider-proxy/deployment.yaml
new file mode 100644
index 000000000..ab14a6616
--- /dev/null
+++ b/config/provider-proxy/deployment.yaml
@@ -0,0 +1,99 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: provider-auth-proxy
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: provider-auth-proxy
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: orka
+      app.kubernetes.io/component: provider-auth-proxy
+  template:
+    metadata:
+      # Token Secret updates are reloaded in-process. Change this nonce only to
+      # force a Pod rollout for binary/flag changes or operator recovery.
+      annotations:
+        orka.ai/provider-auth-rollout-nonce: "0"
+      labels:
+        app.kubernetes.io/name: orka
+        app.kubernetes.io/component: provider-auth-proxy
+        orka.ai/network-role: provider-auth-proxy
+    spec:
+      serviceAccountName: provider-auth-proxy
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: proxy
+          image: controller:latest
+          command: [/provider-auth-proxy]
+          args:
+            - --listen-address=:8080
+            - --upstream-base-url=http://vekil.vekil-system.svc:1337
+            - --token-file=/var/run/secrets/orka/provider-auth/token
+            - --previous-token-file=/var/run/secrets/orka/provider-auth/previous-token
+            - --previous-token-valid-until-file=/var/run/secrets/orka/provider-auth/previous-token-valid-until
+            - --token-reload-interval=5s
+            - --previous-token-overlap=10m
+          ports:
+            - name: http
+              containerPort: 8080
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: [ALL]
+          resources:
+            requests:
+              cpu: 25m
+              memory: 32Mi
+              ephemeral-storage: 32Mi
+            limits:
+              cpu: 250m
+              memory: 128Mi
+              ephemeral-storage: 128Mi
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: http
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+          volumeMounts:
+            - name: provider-auth
+              mountPath: /var/run/secrets/orka/provider-auth
+              readOnly: true
+      volumes:
+        - name: provider-auth
+          projected:
+            # The source is optional so key/Secret removal becomes an empty
+            # projection that the process detects and rejects, rather than
+            # leaving a stale last-known token mounted. fsGroup + 0440 grants
+            # only this non-root Pod group read access.
+            defaultMode: 0440
+            sources:
+              - secret:
+                  name: provider-auth-proxy
+                  optional: true
+                  items:
+                    - key: token
+                      path: token
+                    # Optional for backward compatibility with existing
+                    # single-token Secrets. During rotation, add both keys. The
+                    # absolute RFC3339 deadline prevents Pod restarts from
+                    # extending the configured overlap window.
+                    - key: previous-token
+                      path: previous-token
+                    - key: previous-token-valid-until
+                      path: previous-token-valid-until
diff --git a/config/provider-proxy/kustomization.yaml b/config/provider-proxy/kustomization.yaml
new file mode 100644
index 000000000..7bc7ce24b
--- /dev/null
+++ b/config/provider-proxy/kustomization.yaml
@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: system
+resources:
+  - serviceaccount.yaml
+  - service.yaml
+  - deployment.yaml
+  - networkpolicy.yaml
+images:
+  - name: controller
+    newName: ghcr.io/orka-agents/orka
+    newTag: latest
diff --git a/config/provider-proxy/networkpolicy.yaml b/config/provider-proxy/networkpolicy.yaml
new file mode 100644
index 000000000..6b7f5f9d1
--- /dev/null
+++ b/config/provider-proxy/networkpolicy.yaml
@@ -0,0 +1,44 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: provider-auth-proxy
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: provider-auth-proxy
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: orka
+      app.kubernetes.io/component: provider-auth-proxy
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: orka-runtimes
+          podSelector:
+            matchLabels:
+              orka.ai/network-role: provider-client
+      ports:
+        - protocol: TCP
+          port: 8080
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - {protocol: UDP, port: 53}
+        - {protocol: TCP, port: 53}
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: vekil-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: vekil
+      ports:
+        - {protocol: TCP, port: 1337}
diff --git a/config/provider-proxy/service.yaml b/config/provider-proxy/service.yaml
new file mode 100644
index 000000000..5049006df
--- /dev/null
+++ b/config/provider-proxy/service.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: provider-auth-proxy
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: provider-auth-proxy
+spec:
+  selector:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: provider-auth-proxy
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
diff --git a/config/provider-proxy/serviceaccount.yaml b/config/provider-proxy/serviceaccount.yaml
new file mode 100644
index 000000000..2583872e0
--- /dev/null
+++ b/config/provider-proxy/serviceaccount.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: provider-auth-proxy
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: provider-auth-proxy
+automountServiceAccountToken: false
diff --git a/config/publisher/deployment.yaml b/config/publisher/deployment.yaml
new file mode 100644
index 000000000..3920d27c0
--- /dev/null
+++ b/config/publisher/deployment.yaml
@@ -0,0 +1,133 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: workspace-publisher
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: workspace-publisher
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: orka
+      app.kubernetes.io/component: workspace-publisher
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: orka
+        app.kubernetes.io/component: workspace-publisher
+        orka.ai/network-role: workspace-publisher
+    spec:
+      serviceAccountName: workspace-publisher
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: publisher
+          image: docker.io/sozercan/orka-workspace-publisher:latest
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8080
+          env:
+            - name: ORKA_SCM_EGRESS_PROXY_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: scm-egress-proxy-auth
+                  key: token
+            - name: HTTPS_PROXY
+              value: http://orka-publisher:$(ORKA_SCM_EGRESS_PROXY_TOKEN)@orka-scm-egress-proxy.orka-system.svc:8080
+            - name: https_proxy
+              value: http://orka-publisher:$(ORKA_SCM_EGRESS_PROXY_TOKEN)@orka-scm-egress-proxy.orka-system.svc:8080
+            - name: NO_PROXY
+              value: localhost,127.0.0.1,::1,.svc,.cluster.local
+            - name: no_proxy
+              value: localhost,127.0.0.1,::1,.svc,.cluster.local
+            - name: ORKA_PUBLISHER_SCM_EGRESS_PROXY_REQUIRED
+              value: "true"
+            - name: ORKA_PUBLISHER_LISTEN_ADDRESS
+              value: :8080
+            - name: ORKA_PUBLISHER_TEMP_ROOT
+              value: /tmp/orka-workspace-publisher/runtime
+            - name: ORKA_PUBLISHER_CONTROLLER_TOKEN_FILE
+              value: /var/run/orka/publisher-auth/controller-token
+            - name: ORKA_PUBLISHER_OPERATION_CAPABILITY_SECRET_FILE
+              value: /var/run/orka/publisher-auth/operation-capability-secret
+            - name: ORKA_PUBLISHER_ARTIFACT_AUTHORIZATION_BROKER_URL
+              value: http://orka-api.orka-system.svc:8080
+            - name: ORKA_PUBLISHER_ARTIFACT_API_URL
+              value: http://orka-api.orka-system.svc:8080
+            - name: ORKA_PUBLISHER_CREDENTIAL_BROKER_URL
+              value: http://orka-api.orka-system.svc:8080
+            - name: ORKA_PUBLISHER_ALLOWED_SCM_HOSTS
+              value: github.com
+            - name: ORKA_PUBLISHER_GITHUB_PR_ENABLED
+              value: "true"
+            - name: ORKA_PUBLISHER_GITHUB_API_BASE_URL
+              value: https://api.github.com
+            - name: ORKA_PUBLISHER_GITHUB_REQUEST_TIMEOUT
+              value: 15s
+            - name: ORKA_PUBLISHER_GITHUB_MAX_RESPONSE_BYTES
+              value: "4194304"
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+              ephemeral-storage: 512Mi
+            limits:
+              cpu: "2"
+              memory: 2Gi
+              ephemeral-storage: 2Gi
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: tmp
+              mountPath: /tmp/orka-workspace-publisher
+            - name: publisher-auth
+              mountPath: /var/run/orka/publisher-auth/controller-token
+              subPath: controller-token
+              readOnly: true
+            - name: publisher-auth
+              mountPath: /var/run/orka/publisher-auth/operation-capability-secret
+              subPath: operation-capability-secret
+              readOnly: true
+          readinessProbe:
+            httpGet:
+              path: /v1/health
+              port: http
+            periodSeconds: 5
+          livenessProbe:
+            httpGet:
+              path: /v1/health
+              port: http
+            periodSeconds: 10
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: workspace-publisher
+        - name: tmp
+          emptyDir:
+            sizeLimit: 1Gi
+        - name: publisher-auth
+          secret:
+            secretName: workspace-publisher-auth
+            # subPath bind mounts expose regular files to the fail-closed
+            # publisher loader; fsGroup grants only the Pod group read access.
+            defaultMode: 0440
+            items:
+              - key: controller-token
+                path: controller-token
+              - key: operation-capability-secret
+                path: operation-capability-secret
diff --git a/config/publisher/kustomization.yaml b/config/publisher/kustomization.yaml
new file mode 100644
index 000000000..b00ad5bc9
--- /dev/null
+++ b/config/publisher/kustomization.yaml
@@ -0,0 +1,11 @@
+namespace: system
+resources:
+  - serviceaccount.yaml
+  - service.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - networkpolicy.yaml
+images:
+  - name: docker.io/sozercan/orka-workspace-publisher
+    newName: docker.io/sozercan/orka-workspace-publisher
+    newTag: latest
diff --git a/config/publisher/networkpolicy.yaml b/config/publisher/networkpolicy.yaml
new file mode 100644
index 000000000..bf246b9b8
--- /dev/null
+++ b/config/publisher/networkpolicy.yaml
@@ -0,0 +1,46 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: workspace-publisher
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: orka
+      app.kubernetes.io/component: workspace-publisher
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: orka
+              control-plane: controller-manager
+      ports:
+        - protocol: TCP
+          port: 8080
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - {protocol: UDP, port: 53}
+        - {protocol: TCP, port: 53}
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: orka
+              control-plane: controller-manager
+      ports:
+        - protocol: TCP
+          port: 8080
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: orka
+              app.kubernetes.io/component: scm-egress-proxy
+      ports:
+        - protocol: TCP
+          port: 8080
diff --git a/config/publisher/pvc.yaml b/config/publisher/pvc.yaml
new file mode 100644
index 000000000..b5f2b7c6f
--- /dev/null
+++ b/config/publisher/pvc.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: workspace-publisher
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: workspace-publisher
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
diff --git a/config/publisher/service.yaml b/config/publisher/service.yaml
new file mode 100644
index 000000000..b1ad8e204
--- /dev/null
+++ b/config/publisher/service.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: workspace-publisher
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: workspace-publisher
+spec:
+  selector:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: workspace-publisher
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
diff --git a/config/publisher/serviceaccount.yaml b/config/publisher/serviceaccount.yaml
new file mode 100644
index 000000000..d8edf9db8
--- /dev/null
+++ b/config/publisher/serviceaccount.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: workspace-publisher
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: workspace-publisher
+automountServiceAccountToken: false
diff --git a/config/rbac/kustomization.yaml b/config/rbac/kustomization.yaml
index 9b9a72cd7..55f8f364c 100644
--- a/config/rbac/kustomization.yaml
+++ b/config/rbac/kustomization.yaml
@@ -7,6 +7,7 @@ resources:
 - service_account.yaml
 - role.yaml
 - role_binding.yaml
+- static_controller_cluster_role.yaml
 - workspace_parameter_reader_role.yaml
 - workspace_parameter_reader_role_binding.yaml
 - leader_election_role.yaml
diff --git a/config/rbac/leader_election_role.yaml b/config/rbac/leader_election_role.yaml
index 00054d230..f69212ce7 100644
--- a/config/rbac/leader_election_role.yaml
+++ b/config/rbac/leader_election_role.yaml
@@ -6,6 +6,7 @@ metadata:
     app.kubernetes.io/name: orka
     app.kubernetes.io/managed-by: kustomize
   name: leader-election-role
+  namespace: system
 rules:
 - apiGroups:
   - ""
diff --git a/config/rbac/leader_election_role_binding.yaml b/config/rbac/leader_election_role_binding.yaml
index 043347846..aea998a25 100644
--- a/config/rbac/leader_election_role_binding.yaml
+++ b/config/rbac/leader_election_role_binding.yaml
@@ -5,6 +5,7 @@ metadata:
     app.kubernetes.io/name: orka
     app.kubernetes.io/managed-by: kustomize
   name: leader-election-rolebinding
+  namespace: system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
index 654f1c85f..d8649106b 100644
--- a/config/rbac/role.yaml
+++ b/config/rbac/role.yaml
@@ -8,7 +8,10 @@ rules:
   - ""
   resources:
   - configmaps
+  - namespaces
+  - pods
   - secrets
+  - services
   verbs:
   - create
   - delete
@@ -21,14 +24,11 @@ rules:
   - ""
   resources:
   - endpoints
-  - namespaces
   - nodes
   - persistentvolumeclaims
   - persistentvolumes
-  - pods
   - pods/status
   - replicationcontrollers
-  - services
   verbs:
   - get
   - list
@@ -89,12 +89,23 @@ rules:
   - apps
   resources:
   - daemonsets
+  - statefulsets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apps
+  resources:
   - deployments
   - replicasets
-  - statefulsets
   verbs:
+  - create
+  - delete
   - get
   - list
+  - patch
+  - update
   - watch
 - apiGroups:
   - ate.dev
@@ -155,9 +166,16 @@ rules:
   resources:
   - agentruntimes
   - agents
+  - branchclaims
+  - controllerepochs
+  - externaleffects
+  - promptattempts
   - providers
+  - publications
   - repositorymonitors
   - repositoryscans
+  - runtimepools
+  - runtimesessioncontrols
   - skills
   - substrateactorpools
   - tasks
@@ -175,10 +193,17 @@ rules:
   resources:
   - agentruntimes/finalizers
   - agents/finalizers
+  - branchclaims/finalizers
+  - controllerepochs/finalizers
+  - externaleffects/finalizers
   - outboundaccesspolicies/finalizers
+  - promptattempts/finalizers
   - providers/finalizers
+  - publications/finalizers
   - repositorymonitors/finalizers
   - repositoryscans/finalizers
+  - runtimepools/finalizers
+  - runtimesessioncontrols/finalizers
   - skills/finalizers
   - substrateactorpools/finalizers
   - tasks/finalizers
@@ -190,10 +215,17 @@ rules:
   resources:
   - agentruntimes/status
   - agents/status
+  - branchclaims/status
+  - controllerepochs/status
+  - externaleffects/status
   - outboundaccesspolicies/status
+  - promptattempts/status
   - providers/status
+  - publications/status
   - repositorymonitors/status
   - repositoryscans/status
+  - runtimepools/status
+  - runtimesessioncontrols/status
   - skills/status
   - substrateactorpools/status
   - tasks/status
@@ -303,26 +335,19 @@ rules:
   - delete
   - get
   - list
+  - patch
+  - update
   - watch
 - apiGroups:
   - policy
   resources:
   - poddisruptionbudgets
   verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterrolebindings
-  - rolebindings
-  - roles
-  verbs:
   - create
   - delete
   - get
   - list
+  - patch
   - update
   - watch
 - apiGroups:
@@ -343,6 +368,18 @@ rules:
   - clusterroles
   verbs:
   - bind
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - rolebindings
+  - roles
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - update
+  - watch
 - apiGroups:
   - storage.k8s.io
   resources:
diff --git a/config/rbac/role_binding.yaml b/config/rbac/role_binding.yaml
index 9840b45c7..f4ff5197e 100644
--- a/config/rbac/role_binding.yaml
+++ b/config/rbac/role_binding.yaml
@@ -1,10 +1,11 @@
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
+kind: RoleBinding
 metadata:
   labels:
     app.kubernetes.io/name: orka
     app.kubernetes.io/managed-by: kustomize
   name: manager-rolebinding
+  namespace: system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
diff --git a/config/rbac/static_controller_cluster_role.yaml b/config/rbac/static_controller_cluster_role.yaml
new file mode 100644
index 000000000..a8ed8a946
--- /dev/null
+++ b/config/rbac/static_controller_cluster_role.yaml
@@ -0,0 +1,46 @@
+# Static controllers need only two common cluster-scoped capabilities:
+# reading namespace mode claims and binding the exact release worker roles into
+# the selected workload namespace. Mode-specific cluster APIs are granted by
+# the corresponding workload overlay, never by this common role.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/managed-by: kustomize
+  name: static-controller-cluster-role
+rules:
+- apiGroups:
+  - ""
+  resourceNames:
+  - system
+  resources:
+  - namespaces
+  verbs:
+  - get
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resourceNames:
+  - ai-worker-role
+  - vendor-worker-role
+  - container-worker-role
+  resources:
+  - clusterroles
+  verbs:
+  - bind
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/managed-by: kustomize
+  name: static-controller-cluster-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: static-controller-cluster-role
+subjects:
+- kind: ServiceAccount
+  name: controller-manager
+  namespace: system
diff --git a/config/rbac/worker_role.yaml b/config/rbac/worker_role.yaml
index d3484d307..432d2c131 100644
--- a/config/rbac/worker_role.yaml
+++ b/config/rbac/worker_role.yaml
@@ -107,9 +107,9 @@ rules:
   - pods/log
   verbs:
   - get
-# code_exec Kubernetes backend: per-job ServiceAccounts. This ClusterRole is
-# bound through a ClusterRoleBinding, so these create/delete permissions are
-# cluster-wide and reserved for the AI worker trust tier.
+# code_exec Kubernetes backend: per-job ServiceAccounts. Static installations
+# bind this ClusterRole through a RoleBinding, so these create/delete
+# permissions remain inside the selected workload namespace.
 - apiGroups:
   - ""
   resources:
@@ -464,9 +464,10 @@ rules:
   - get
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
+kind: RoleBinding
 metadata:
   name: ai-worker-rolebinding
+  namespace: system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -477,9 +478,10 @@ subjects:
   namespace: system
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
+kind: RoleBinding
 metadata:
   name: vendor-worker-rolebinding
+  namespace: system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -490,9 +492,10 @@ subjects:
   namespace: system
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
+kind: RoleBinding
 metadata:
   name: container-worker-rolebinding
+  namespace: system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
diff --git a/config/rbac/workspace_parameter_reader_role_binding.yaml b/config/rbac/workspace_parameter_reader_role_binding.yaml
index fc9b0c347..9caffc2c7 100644
--- a/config/rbac/workspace_parameter_reader_role_binding.yaml
+++ b/config/rbac/workspace_parameter_reader_role_binding.yaml
@@ -1,10 +1,11 @@
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
+kind: RoleBinding
 metadata:
   labels:
     app.kubernetes.io/name: orka
     app.kubernetes.io/managed-by: kustomize
   name: workspace-parameter-reader-rolebinding
+  namespace: system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
diff --git a/config/samples/core_v1alpha1_agent.yaml b/config/samples/core_v1alpha1_agent.yaml
index a147c394b..2a6d8cc18 100644
--- a/config/samples/core_v1alpha1_agent.yaml
+++ b/config/samples/core_v1alpha1_agent.yaml
@@ -1,9 +1,20 @@
+# This Agent shows the future namespace-local external v2 selector shape from
+# core_v1alpha1_agentruntime.yaml. Registration and conformance are available,
+# but runtimeRef Task dispatch remains fail-closed until the external v2
+# dispatcher support boundary is enabled. Built-in Codex, Claude, Copilot, and
+# OpenCode Agents use runtime.type instead.
 apiVersion: core.orka.ai/v1alpha1
 kind: Agent
 metadata:
   labels:
     app.kubernetes.io/name: orka
     app.kubernetes.io/managed-by: kustomize
-  name: agent-sample
+  name: external-v2-agent
 spec:
-  # TODO(user): Add fields here
+  model:
+    name: operator-reviewed-model
+  systemPrompt:
+    inline: "You are an operator-reviewed external coding assistant."
+  runtime:
+    runtimeRef:
+      name: sample-external-v2-runtime
diff --git a/config/samples/core_v1alpha1_agent_claude.yaml b/config/samples/core_v1alpha1_agent_claude.yaml
index 520c7129e..2da2bdc70 100644
--- a/config/samples/core_v1alpha1_agent_claude.yaml
+++ b/config/samples/core_v1alpha1_agent_claude.yaml
@@ -12,13 +12,15 @@ spec:
   # systemPrompt is injected via --system-prompt; can also use configMapRef
   systemPrompt:
     inline: "You are a helpful coding assistant."
-  # secretRef references a Secret containing ANTHROPIC_API_KEY
-  secretRef:
-    name: claude-api-key
-  # runtime marks this Agent for type: agent tasks using Claude Code CLI
-  # (mutually exclusive with providerRef, which is for type: ai tasks)
+  # Provider credentials are injected only by the central authenticated proxy;
+  # no provider Secret is referenced by an ACP Agent or delivered to its runtime.
+  # runtime.type selects the built-in Claude ACP profile backed exclusively by
+  # a controller-owned, digest-pinned orka.harness.v2 RuntimePool. There is no
+  # per-Task Job/image or legacy harness fallback. It is mutually exclusive
+  # with providerRef, which is for native type: ai tasks.
   runtime:
-    # type selects the CLI runtime: "claude", "copilot", "codex", or "opencode"
+    contractVersion: orka.harness.v2
+    # type selects a supported ACP runtime profile.
     type: claude
     # defaultMaxTurns is the default max agent loop iterations per task
     defaultMaxTurns: 50
@@ -32,13 +34,3 @@ spec:
       - Bash
       - Glob
       - Grep
-  # execution sets default runtime isolation and placement for worker pods
-  # execution:
-  #   runtimeClassName: gvisor
-  #   nodeSelector:
-  #     sandbox-runtime: gvisor
-  #   tolerations:
-  #     - key: sandbox-runtime
-  #       operator: Equal
-  #       value: gvisor
-  #       effect: NoSchedule
diff --git a/config/samples/core_v1alpha1_agent_codex.yaml b/config/samples/core_v1alpha1_agent_codex.yaml
index 3f4a36490..acad3fd9a 100644
--- a/config/samples/core_v1alpha1_agent_codex.yaml
+++ b/config/samples/core_v1alpha1_agent_codex.yaml
@@ -10,9 +10,13 @@ spec:
     name: "gpt-5.4"
   systemPrompt:
     inline: "You are a helpful coding assistant."
-  secretRef:
-    name: codex-api-key
+  # Provider credentials are injected only by the central authenticated proxy;
+  # no provider Secret is referenced by an ACP Agent or delivered to its runtime.
+  # runtime.type selects the built-in Codex ACP profile backed exclusively by
+  # a controller-owned, digest-pinned orka.harness.v2 RuntimePool. There is no
+  # per-Task Job/image or legacy harness fallback.
   runtime:
+    contractVersion: orka.harness.v2
     type: codex
     defaultMaxTurns: 50
     defaultAllowBash: true
diff --git a/config/samples/core_v1alpha1_agent_opencode.yaml b/config/samples/core_v1alpha1_agent_opencode.yaml
index 4bd0ef25e..fb51c72b1 100644
--- a/config/samples/core_v1alpha1_agent_opencode.yaml
+++ b/config/samples/core_v1alpha1_agent_opencode.yaml
@@ -6,14 +6,26 @@ metadata:
     app.kubernetes.io/name: orka
     app.kubernetes.io/managed-by: kustomize
 spec:
+  # OpenCode model IDs use provider/model form.
   model:
-    name: "kimi-k2"
-  systemPrompt:
-    inline: "You are a helpful coding assistant."
-  # The Secret must contain OPENAI_BASE_URL. Add OPENAI_API_KEY when authentication is required.
-  secretRef:
-    name: opencode-credentials
+    name: "openai/gpt-5.4"
+    # Reviewed operational ceilings; set these from the selected model's contract.
+    contextWindow: 32768
+    maxTokens: 4096
+  # Provider credentials are injected only by the central authenticated proxy;
+  # no provider Secret is referenced by an ACP Agent or delivered to its runtime.
+  # runtime.type selects the built-in OpenCode ACP profile backed exclusively by
+  # a controller-owned, digest-pinned orka.harness.v2 RuntimePool. There is no
+  # per-Task Job/image or legacy harness fallback.
   runtime:
+    contractVersion: orka.harness.v2
     type: opencode
     defaultMaxTurns: 50
     defaultAllowBash: true
+    defaultAllowedTools:
+      - read
+      - write
+      - edit
+      - bash
+      - glob
+      - grep
diff --git a/config/samples/core_v1alpha1_agentruntime.yaml b/config/samples/core_v1alpha1_agentruntime.yaml
index a0b4fd885..0e8a52783 100644
--- a/config/samples/core_v1alpha1_agentruntime.yaml
+++ b/config/samples/core_v1alpha1_agentruntime.yaml
@@ -1,26 +1,75 @@
+# External runtimes are operator-owned orka.harness.v2 services. Registration
+# and strict workspace-governance conformance are available, but runtimeRef Task
+# dispatch remains fail-closed until the external v2 dispatcher boundary is
+# enabled. Prefer controller-owned RuntimePools for built-in Codex, Claude,
+# Copilot, and OpenCode profiles.
+#
+# Before applying this object, create both referenced Secrets in this namespace.
+# Each Secret must contain at least 32 bytes, set
+#   orka.ai/agent-runtime-auth: "true"
+# and bind itself to this runtime and endpoint with
+#   orka.ai/agent-runtime-name: sample-external-v2-runtime
+#   orka.ai/agent-runtime-endpoint: http://sample-external-v2-runtime.default.svc.cluster.local:8080
+# The capability/profile values below are illustrative. They must exactly match
+# the runtime's public /v2/capabilities and authenticated /v2/status responses.
 apiVersion: core.orka.ai/v1alpha1
 kind: AgentRuntime
 metadata:
   labels:
     app.kubernetes.io/name: orka
     app.kubernetes.io/managed-by: kustomize
-  name: sample-http-runtime
+  name: sample-external-v2-runtime
 spec:
-  # Namespace-local AgentRuntime facade for a remote execution backend.
-  # The endpoint may point at a generic HTTP runtime, AgentKit Serve adapter,
-  # Foundry adapter, or another backend implementing orka.harness.v1.
-  # The bearer token authenticates Orka to the runtime endpoint; it is not a
-  # downstream production tool credential.
-  contractVersion: orka.harness.v1
+  contractVersion: orka.harness.v2
   deployment:
     mode: external-endpoint
-    endpoint: http://sample-http-runtime.default.svc.cluster.local:8080
+    endpoint: http://sample-external-v2-runtime.default.svc.cluster.local:8080
   clientAuth:
-    bearerTokenSecretRef:
-      name: sample-http-runtime-token
+    controllerBearerTokenSecretRef:
+      name: sample-external-v2-runtime-controller-auth
       key: token
+    operationCapabilitySecretRef:
+      name: sample-external-v2-runtime-operation-auth
+      key: capability-secret
   capabilities:
-    toolExecutionModes:
-    - observed
-    supportsCancel: true
-    supportsRuntimeSessions: true
+    runtimeInstanceID: sample-external-v2-runtime-01
+    profile:
+      digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+      digestSchemaVersion: 1
+      acpProfile: acp.v1
+      adapterName: operator-reviewed-adapter
+      adapterDigest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+      providerKind: operator-managed
+      model: operator-reviewed-model
+      agentConfigurationDigest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+      toolPolicyDigest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+      approvalPolicyDigest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+      mcpConfigurationDigest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+      workspaceIntent: read
+      proxyCredentialRole: operator-managed
+      proxyCredentialScope: external-runtime
+      resourceClass: external
+    limits:
+      maxResidentSessions: 10
+      maxConcurrentPrompts: 4
+      maxRequestBytes: 1048576
+      maxEventLineBytes: 262144
+      maxTerminalResultBytes: 1048576
+      maxBufferedEvents: 4096
+      maxUpdateEventsPerSecond: 100
+      minPromptLeaseMillis: 5000
+      maxPromptLeaseMillis: 120000
+      maxPendingPermissions: 32
+      maxWorkspaceDeltaBytes: 104857600
+    supportsDrain: false
+    supportsPublicationFinalization: false
+    workspaceGovernance:
+      mode: strict-governed
+      trusted: false
+      orkaOwnedWorkspaceDeltas: true
+      promptScopedBrokerAuthorization: true
+      noDirectSCMPublication: true
+      orkaOwnedCleanRoomPublication: true
+      exactInstanceFencing: true
+      duplicateSafeMutations: true
+      cancellationSettlement: true
diff --git a/config/samples/core_v1alpha1_agentruntime_agentkit.yaml b/config/samples/core_v1alpha1_agentruntime_agentkit.yaml
deleted file mode 100644
index 7ffc602c6..000000000
--- a/config/samples/core_v1alpha1_agentruntime_agentkit.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-apiVersion: core.orka.ai/v1alpha1
-kind: AgentRuntime
-metadata:
-  labels:
-    app.kubernetes.io/name: orka
-    app.kubernetes.io/managed-by: kustomize
-  name: sample-agentkit-runtime
-spec:
-  # Namespace-local facade for an operator-deployed AgentKit Serve adapter.
-  # Current AgentKit Serve Orka support is observed mode only; do not add brokered
-  # classes or supportsContinuation until AgentKit passes those conformance profiles.
-  # Adapter/runtime credentials live in the adapter deployment, not in Orka Tool
-  # credentials or the remote workload.
-  contractVersion: orka.harness.v1
-  deployment:
-    mode: external-endpoint
-    endpoint: http://sample-agentkit-runtime.default.svc.cluster.local:8080
-  clientAuth:
-    bearerTokenSecretRef:
-      name: sample-agentkit-runtime-token
-      key: token
-  capabilities:
-    toolExecutionModes:
-    - observed
-    supportsCancel: true
-    supportsRuntimeSessions: true
diff --git a/config/samples/core_v1alpha1_agentruntime_foundry.yaml b/config/samples/core_v1alpha1_agentruntime_foundry.yaml
deleted file mode 100644
index f98f1fe32..000000000
--- a/config/samples/core_v1alpha1_agentruntime_foundry.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-apiVersion: core.orka.ai/v1alpha1
-kind: AgentRuntime
-metadata:
-  labels:
-    app.kubernetes.io/name: orka
-    app.kubernetes.io/managed-by: kustomize
-  name: sample-foundry-runtime
-spec:
-  # Namespace-local facade for the separately deployed orka-agents/agent-runtime-foundry
-  # Hosted Agents Responses adapter. Azure authentication belongs to the adapter deployment
-  # (for example, Workload Identity). Orka Tool credentials remain Orka-governed.
-  contractVersion: orka.harness.v1
-  deployment:
-    mode: external-endpoint
-    endpoint: http://sample-foundry-runtime.default.svc.cluster.local:8080
-  clientAuth:
-    bearerTokenSecretRef:
-      name: sample-foundry-runtime-token
-      key: token
-  capabilities:
-    # The adapter is observed-only by default. Advertise brokered classes only after
-    # enabling ORKA_FOUNDRY_BROKERED_TOOL_CLASSES and passing matching conformance probes.
-    toolExecutionModes:
-    - observed
-    supportsCancel: true
-    supportsRuntimeSessions: true
diff --git a/config/samples/core_v1alpha1_task_agent.yaml b/config/samples/core_v1alpha1_task_agent.yaml
index 11d93db23..78894fdfa 100644
--- a/config/samples/core_v1alpha1_task_agent.yaml
+++ b/config/samples/core_v1alpha1_task_agent.yaml
@@ -6,35 +6,23 @@ metadata:
     app.kubernetes.io/name: orka
     app.kubernetes.io/managed-by: kustomize
 spec:
-  # type: agent delegates work to an external CLI runtime (e.g., Claude Code CLI or Codex CLI)
+  # type: agent uses a fenced ACP v2 RuntimeSession in a controller-owned pool.
+  # Provider authentication comes only through the central provider proxy;
+  # neither this Task nor the Agent references a provider credential Secret.
   type: agent
-  # agentRef references an Agent CRD that defines runtime type and credentials
   agentRef:
     name: claude-agent
-  # execution optionally overrides runtime isolation and placement for this task
-  # execution:
-  #   runtimeClassName: gvisor
-  #   nodeSelector:
-  #     sandbox-runtime: gvisor
-  #   tolerations:
-  #     - key: sandbox-runtime
-  #       operator: Equal
-  #       value: gvisor
-  #       effect: NoSchedule
-  # prompt is the instruction sent to the agent CLI
-  prompt: "Refactor the main.go file to use structured logging"
-  # agentRuntime allows task-level overrides of the Agent's runtime defaults
+  prompt: "Review main.go for structured logging opportunities. Do not modify files."
+  workspace:
+    intent: read
+    gitRepo: "https://github.com/example/my-project.git"
+    branch: "main"
+    # Optional for private repositories; used only by the clean-room clone path.
+    # readCredentialRef:
+    #   name: my-project-read
+  # agentRuntime contains only task-level overrides of Agent runtime defaults.
   agentRuntime:
-    workspace:
-      # gitRepo is the repository URL to clone into the agent's workspace
-      gitRepo: "https://github.com/example/my-project.git"
-      # branch to checkout
-      branch: "main"
-    # maxTurns limits agent loop iterations (overrides Agent's defaultMaxTurns)
     maxTurns: 100
-    # allowBash enables bash command execution (overrides Agent's defaultAllowBash)
     allowBash: true
-  # timeout is the maximum duration before the task is terminated
   timeout: "30m"
-  # priority controls queue ordering (0-1000, higher = more urgent)
   priority: 500
diff --git a/config/samples/core_v1alpha1_task_agent_copilot.yaml b/config/samples/core_v1alpha1_task_agent_copilot.yaml
deleted file mode 100644
index a7750f50b..000000000
--- a/config/samples/core_v1alpha1_task_agent_copilot.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-apiVersion: core.orka.ai/v1alpha1
-kind: Task
-metadata:
-  name: agent-task-copilot-example
-  labels:
-    app.kubernetes.io/name: orka
-    app.kubernetes.io/managed-by: kustomize
-spec:
-  # type: agent delegates work to an external CLI runtime
-  type: agent
-  # Reference an Agent configured with runtime.type: copilot
-  agentRef:
-    name: copilot-agent
-  # Prompt sent to the Copilot CLI agent
-  prompt: "Add unit tests for the authentication middleware"
-  # Task-level runtime overrides (optional)
-  agentRuntime:
-    maxTurns: 30
-  # Maximum time before the task is terminated
-  timeout: "20m"
-  priority: 500
diff --git a/config/samples/core_v1alpha1_task_agent_workspace.yaml b/config/samples/core_v1alpha1_task_agent_workspace.yaml
index c523f027b..76aa27070 100644
--- a/config/samples/core_v1alpha1_task_agent_workspace.yaml
+++ b/config/samples/core_v1alpha1_task_agent_workspace.yaml
@@ -6,30 +6,42 @@ metadata:
     app.kubernetes.io/name: orka
     app.kubernetes.io/managed-by: kustomize
 spec:
-  # type: agent delegates work to an external CLI runtime
+  # type: agent uses the ACP v2 RuntimePool selected from the referenced Agent.
   type: agent
-  # Reference an Agent with runtime configured (e.g., claude-agent)
   agentRef:
     name: claude-agent
-  # Prompt for the agent to execute in the cloned workspace
   prompt: "Fix the failing CI tests in the api/ directory"
-  # Agent runtime overrides with workspace git clone configuration
+  # Repository input and delivery policy live at top-level spec.workspace.
+  workspace:
+    intent: write
+    # The clean-room workspace boundary clones this credential-free source URL.
+    gitRepo: "https://github.com/example/my-project.git"
+    branch: "main"
+    # Use ref instead of branch to pin a commit or tag.
+    # ref: "0123456789abcdef0123456789abcdef01234567"
+    readCredentialRef:
+      name: my-project-source-read
+    # Publication is a separate repository/credential role. The credential is
+    # resolved only by the Workspace/Publisher and never enters the ACP runtime.
+    publicationGitRepo: "https://github.com/example/my-project.git"
+    publicationReadCredentialRef:
+      name: my-project-publication-read
+      key: token
+    publicationCredentialRef:
+      name: my-project-publication-write
+      key: token
+    forgeCredentialRef:
+      name: my-project-forge
+      key: token
+    pushBranch: "orka/fix-api-tests"
+    prBaseBranch: "main"
+    createPR: true
+    # subPath restricts the workspace root to a repository subdirectory.
+    # subPath: "services/api"
+  # agentRuntime contains only per-Task runtime overrides.
   agentRuntime:
-    workspace:
-      # gitRepo is the repository URL to clone into the workspace
-      gitRepo: "https://github.com/example/my-project.git"
-      # branch to checkout (optional, defaults to repo default branch)
-      branch: "feature/fix-tests"
-      # ref can be a specific commit SHA or tag (optional, mutually exclusive with branch)
-      # ref: "abc123"
-      # gitSecretRef references a Secret with git credentials for private repos
-      gitSecretRef:
-        name: git-credentials
-      # subPath restricts the workspace root to a subdirectory of the repo
-      # subPath: "services/api"
     maxTurns: 100
     allowBash: true
-    # allowedTools overrides the Agent's defaultAllowedTools for this task
     allowedTools:
       - Read
       - Write
diff --git a/config/samples/kustomization.yaml b/config/samples/kustomization.yaml
index 1a35ce3a4..d45c9ec8b 100644
--- a/config/samples/kustomization.yaml
+++ b/config/samples/kustomization.yaml
@@ -2,16 +2,14 @@
 resources:
 - core_v1alpha1_task.yaml
 - core_v1alpha1_task_agent.yaml
-- core_v1alpha1_task_agent_copilot.yaml
 - core_v1alpha1_task_agent_workspace.yaml
 - core_v1alpha1_tool.yaml
 - core_v1alpha1_agent.yaml
 - core_v1alpha1_agentruntime.yaml
-- core_v1alpha1_agentruntime_agentkit.yaml
-- core_v1alpha1_agentruntime_foundry.yaml
 - core_v1alpha1_agent_claude.yaml
 - core_v1alpha1_agent_codex.yaml
 - core_v1alpha1_agent_opencode.yaml
+- core_v1alpha1_outboundaccesspolicy.yaml
 - gateway_v1alpha1_gatewayclass.yaml
 - gateway_v1alpha1_gateway.yaml
 - gateway_v1alpha1_gatewaybinding.yaml
@@ -21,4 +19,5 @@ resources:
 - workspace_v1alpha1_executionworkspace.yaml
 - fake.workspace_v1alpha1_fakeproviderconfig.yaml
 - fake.workspace_v1alpha1_fakepoolparameters.yaml
+
 # +kubebuilder:scaffold:manifestskustomizesamples
diff --git a/config/scm-egress-proxy/README.md b/config/scm-egress-proxy/README.md
new file mode 100644
index 000000000..08a1bc571
--- /dev/null
+++ b/config/scm-egress-proxy/README.md
@@ -0,0 +1,21 @@
+# SCM egress proxy
+
+This package is included by `config/default`. Before applying it, create the
+shared Publisher/proxy authentication Secret in `orka-system`:
+
+```bash
+token="$(openssl rand -hex 32)"
+kubectl -n orka-system create secret generic scm-egress-proxy-auth \
+  --from-literal=token="$token"
+unset token
+```
+
+The token must contain 32-256 RFC 3986 unreserved characters (`A-Z`, `a-z`,
+`0-9`, `-`, `.`, `_`, or `~`). It authenticates the Publisher to the proxy; it
+is not an SCM credential.
+
+`deployment.yaml` allows only `github.com` plus `api.github.com`. Patch
+`--allowed-hosts` and `--forge-api-base-url` together with the Publisher's
+`ORKA_PUBLISHER_ALLOWED_SCM_HOSTS` and forge API URL when using GitHub
+Enterprise or another reviewed forge endpoint. Hostnames are exact and
+lower-case; wildcards and IP literals are rejected.
diff --git a/config/scm-egress-proxy/deployment.yaml b/config/scm-egress-proxy/deployment.yaml
new file mode 100644
index 000000000..60f61afe5
--- /dev/null
+++ b/config/scm-egress-proxy/deployment.yaml
@@ -0,0 +1,92 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: scm-egress-proxy
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: scm-egress-proxy
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: orka
+      app.kubernetes.io/component: scm-egress-proxy
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: orka
+        app.kubernetes.io/component: scm-egress-proxy
+        orka.ai/network-role: scm-egress-proxy
+    spec:
+      serviceAccountName: scm-egress-proxy
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: proxy
+          image: controller:latest
+          imagePullPolicy: IfNotPresent
+          command: [/scm-egress-proxy]
+          args:
+            - --listen-address=:8080
+            - --allowed-hosts=github.com
+            - --forge-api-base-url=https://api.github.com
+            - --token-file=/var/run/secrets/orka/scm-egress/token
+            - --max-request-header-bytes=32768
+            - --max-response-header-bytes=65536
+            - --max-request-bytes=4194304
+            - --max-response-bytes=8388608
+            - --max-tunnel-bytes=1073741824
+            - --max-concurrent=8
+            - --resolution-timeout=5s
+            - --connect-timeout=10s
+            - --response-header-timeout=30s
+            - --forward-timeout=2m
+            - --idle-timeout=30s
+            - --tunnel-timeout=10m
+          ports:
+            - name: http-proxy
+              containerPort: 8080
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          resources:
+            requests:
+              cpu: 25m
+              memory: 32Mi
+              ephemeral-storage: 32Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+              ephemeral-storage: 128Mi
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: http-proxy
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http-proxy
+          volumeMounts:
+            - name: auth
+              mountPath: /var/run/secrets/orka/scm-egress/token
+              subPath: token
+              readOnly: true
+      volumes:
+        - name: auth
+          secret:
+            secretName: scm-egress-proxy-auth
+            defaultMode: 0440
+            items:
+              - key: token
+                path: token
diff --git a/config/scm-egress-proxy/kustomization.yaml b/config/scm-egress-proxy/kustomization.yaml
new file mode 100644
index 000000000..7bc7ce24b
--- /dev/null
+++ b/config/scm-egress-proxy/kustomization.yaml
@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: system
+resources:
+  - serviceaccount.yaml
+  - service.yaml
+  - deployment.yaml
+  - networkpolicy.yaml
+images:
+  - name: controller
+    newName: ghcr.io/orka-agents/orka
+    newTag: latest
diff --git a/config/scm-egress-proxy/networkpolicy.yaml b/config/scm-egress-proxy/networkpolicy.yaml
new file mode 100644
index 000000000..8a0ae6671
--- /dev/null
+++ b/config/scm-egress-proxy/networkpolicy.yaml
@@ -0,0 +1,70 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: scm-egress-proxy
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: scm-egress-proxy
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: orka
+      app.kubernetes.io/component: scm-egress-proxy
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: orka
+              app.kubernetes.io/component: workspace-publisher
+      ports:
+        - protocol: TCP
+          port: 8080
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - {protocol: UDP, port: 53}
+        - {protocol: TCP, port: 53}
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 0.0.0.0/8
+              - 10.0.0.0/8
+              - 100.64.0.0/10
+              - 127.0.0.0/8
+              - 169.254.0.0/16
+              - 172.16.0.0/12
+              - 192.0.0.0/24
+              - 192.0.2.0/24
+              - 192.168.0.0/16
+              - 198.18.0.0/15
+              - 198.51.100.0/24
+              - 203.0.113.0/24
+              - 224.0.0.0/4
+              - 240.0.0.0/4
+      ports:
+        - {protocol: TCP, port: 443}
+    - to:
+        - ipBlock:
+            cidr: ::/0
+            except:
+              - ::/128
+              - ::1/128
+              - 64:ff9b::/96
+              - 64:ff9b:1::/48
+              - 100::/64
+              - 2001::/32
+              - 2001:db8::/32
+              - 2002::/16
+              - fc00::/7
+              - fe80::/10
+              - ff00::/8
+      ports:
+        - {protocol: TCP, port: 443}
diff --git a/config/scm-egress-proxy/service.yaml b/config/scm-egress-proxy/service.yaml
new file mode 100644
index 000000000..e794bb329
--- /dev/null
+++ b/config/scm-egress-proxy/service.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: scm-egress-proxy
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: scm-egress-proxy
+spec:
+  selector:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: scm-egress-proxy
+  ports:
+    - name: http-proxy
+      port: 8080
+      targetPort: http-proxy
diff --git a/config/scm-egress-proxy/serviceaccount.yaml b/config/scm-egress-proxy/serviceaccount.yaml
new file mode 100644
index 000000000..744c2bafc
--- /dev/null
+++ b/config/scm-egress-proxy/serviceaccount.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: scm-egress-proxy
+  labels:
+    app.kubernetes.io/name: orka
+    app.kubernetes.io/component: scm-egress-proxy
+automountServiceAccountToken: false
diff --git a/config/vekil-ingress/kustomization.yaml b/config/vekil-ingress/kustomization.yaml
new file mode 100644
index 000000000..b90ff79ed
--- /dev/null
+++ b/config/vekil-ingress/kustomization.yaml
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - networkpolicy.yaml
diff --git a/config/vekil-ingress/networkpolicy.yaml b/config/vekil-ingress/networkpolicy.yaml
new file mode 100644
index 000000000..b77cf4896
--- /dev/null
+++ b/config/vekil-ingress/networkpolicy.yaml
@@ -0,0 +1,23 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: orka-provider-auth-proxy-only
+  namespace: vekil-system
+  labels:
+    app.kubernetes.io/managed-by: orka
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: vekil
+  policyTypes: [Ingress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: orka-system
+          podSelector:
+            matchLabels:
+              orka.ai/network-role: provider-auth-proxy
+      ports:
+        - protocol: TCP
+          port: 1337
diff --git a/docs/adr/0001-execution-workspace-default-provider.md b/docs/adr/0001-execution-workspace-default-provider.md
index 41d60d268..db10e919a 100644
--- a/docs/adr/0001-execution-workspace-default-provider.md
+++ b/docs/adr/0001-execution-workspace-default-provider.md
@@ -1,5 +1,9 @@
-# Use an explicit default provider for Execution Workspaces
+# ADR 0001: Use an explicit default provider for Execution Workspaces
 
-When a Task requests an Execution Workspace without setting `spec.execution.workspace.provider`, Orka resolves the provider from an operator-configured Default Workspace Provider and falls back to `agent-sandbox` for compatibility. Orka does not infer the provider from installed cluster components because ambient detection is ambiguous when multiple providers are installed, stale CRDs remain, or RBAC hides provider resources.
+## Status
 
-Standard Worker Execution is not a provider. Tasks that do not request an Execution Workspace keep the existing direct Kubernetes worker Job path.
+Superseded by the ACP core RuntimePool cutover.
+
+The earlier API allowed a Task to select an execution-workspace provider through `spec.execution.workspace.provider`. The current built-in agent path rejects `Task.spec.execution.workspace` and never auto-detects or defaults an upstream provider.
+
+Current agent repository input and publication policy belongs at top-level `Task.spec.workspace`. Future agent-sandbox or Substrate integration must be explicit, operator-configured, and implemented behind the `orka.harness.v2` RuntimeSession lifecycle; ambient provider discovery remains disallowed.
diff --git a/docs/adr/0002-provider-neutral-execution-workspace-status.md b/docs/adr/0002-provider-neutral-execution-workspace-status.md
index 2fa5f0e84..7e4b3f6ff 100644
--- a/docs/adr/0002-provider-neutral-execution-workspace-status.md
+++ b/docs/adr/0002-provider-neutral-execution-workspace-status.md
@@ -1,5 +1,13 @@
-# Report provider-neutral Execution Workspace status
+# ADR 0002: Report provider-neutral Execution Workspace status
 
-Tasks that use an Execution Workspace should report a safe, provider-neutral lifecycle summary instead of exposing provider-native objects such as Substrate Actor snapshots or daemon URLs. Workers should emit workspace lifecycle updates through a small authenticated internal Task status endpoint because workers own provider lifecycle operations in the wrapper-first model. The controller records validation and lock failures directly, but it should not poll provider-native resources for normal workspace progress.
+## Status
 
-Intermediate workspace status updates are best effort. The Task result path remains the source of command completion, while requested cleanup state must still be reached for a workspace-backed Task to succeed.
+Superseded for built-in agent Tasks by ACP v2 execution and delivery status.
+
+The earlier prototype reported worker-owned upstream workspace lifecycle. Current ACP agent Tasks expose provider-neutral control state through:
+
+- `Task.status.execution` for the fenced attempt, RuntimePool, RuntimeSession, prompt, and outcome;
+- `Task.status.delivery` for workspace validation, clean-room publication, verification, and PR receipts;
+- `RuntimePool.status` for lifecycle, admission, exact instance, capacity, and pressure.
+
+Future execution-workspace providers must project into these Orka-owned surfaces and must not expose provider-native snapshot URIs, daemon URLs, credentials, or mutable child-controlled Git state.
diff --git a/docs/adr/0003-use-provider-route-for-workspace-daemon.md b/docs/adr/0003-use-provider-route-for-workspace-daemon.md
index bf8346ede..3920f701d 100644
--- a/docs/adr/0003-use-provider-route-for-workspace-daemon.md
+++ b/docs/adr/0003-use-provider-route-for-workspace-daemon.md
@@ -1,3 +1,9 @@
-# Use the provider route for Workspace Daemon calls
+# ADR 0003: Use the provider route for Workspace Daemon calls
 
-For Substrate-backed Execution Workspaces, Orka workers should call the Workspace Daemon through Substrate's router and actor DNS route instead of calling provider-native worker pod IPs directly. This keeps Orka coupled to the provider's stable routing abstraction rather than transient actor placement details.
+## Status
+
+Deferred with the Substrate ACP integration.
+
+The earlier worker-based Substrate prototype used the provider router and Actor DNS route instead of transient worker Pod IPs. The current ACP RuntimePool path does not call a Substrate workspace daemon.
+
+If an Actor-backed `orka.harness.v2` supervisor is implemented, it should still use the provider's stable authenticated route rather than provider-native Pod placement details. That routing choice must not weaken exact runtime-instance fencing or expose Git/provider credentials to the wrong process tree.
diff --git a/docs/adr/0004-use-minimal-substrate-control-client.md b/docs/adr/0004-use-minimal-substrate-control-client.md
index 5637de7a2..2fecda954 100644
--- a/docs/adr/0004-use-minimal-substrate-control-client.md
+++ b/docs/adr/0004-use-minimal-substrate-control-client.md
@@ -1,3 +1,7 @@
-# Use a minimal Substrate control API client
+# ADR 0004: Use a minimal Substrate control API client
 
-Orka should generate or vendor only the small Substrate API surface needed for actor lifecycle operations instead of importing the full `github.com/agent-substrate/substrate` Go module. Orka needs narrow gRPC clients for the public control API and, when implementing checkpoint/restore features, the specific Ateom/AteomHerder checkpoint services. Avoiding the full module reduces Kubernetes dependency churn and cloud-provider transitive dependencies while still keeping capability-specific proto clients available inside `internal/substratepb`.
+## Status
+
+Deferred with the Substrate ACP integration.
+
+A future Actor-backed RuntimeSession provider should continue to generate or vendor only the narrow Substrate lifecycle API surface it needs, rather than importing the full Substrate module. Any checkpoint/restore client must remain capability-specific and must not imply ACP prompt replay, provider-session restore, or publication from an Actor-controlled workspace.
diff --git a/docs/adr/0005-require-explicit-substrate-api-trust.md b/docs/adr/0005-require-explicit-substrate-api-trust.md
index 91b3d371d..cbc5c701a 100644
--- a/docs/adr/0005-require-explicit-substrate-api-trust.md
+++ b/docs/adr/0005-require-explicit-substrate-api-trust.md
@@ -1,5 +1,9 @@
-# Require explicit trust for the Substrate control API
+# ADR 0005: Require explicit trust for the Substrate control API
 
-Orka should connect to the Substrate control API with explicit TLS trust configuration instead of normalizing insecure TLS verification. Local kind setups may opt into insecure mode for development, but production configuration should provide a CA or equivalent trust material for lifecycle calls that create, resume, suspend, and delete Substrate Actors.
+## Status
 
-The Substrate API trust setting belongs to provider installation/configuration, not to individual Tasks. Tasks select a Workspace Provider and Template; they do not choose whether provider control-plane TLS is trusted.
+Accepted as a requirement for any future Substrate ACP provider; not active in the current Kubernetes RuntimePool path.
+
+A future integration must connect to Substrate with explicit TLS trust material. Local kind evaluation may opt into insecure verification, but production configuration must provide a reviewed CA or equivalent trust anchor for Actor lifecycle calls.
+
+Trust configuration belongs to the operator-managed provider/runtime profile, never an individual Task. Tasks do not choose whether control-plane TLS is trusted.
diff --git a/docs/adr/0006-use-wrapper-first-execution-workspace-providers.md b/docs/adr/0006-use-wrapper-first-execution-workspace-providers.md
index 7db4d5d0c..8e493bbb2 100644
--- a/docs/adr/0006-use-wrapper-first-execution-workspace-providers.md
+++ b/docs/adr/0006-use-wrapper-first-execution-workspace-providers.md
@@ -1,11 +1,17 @@
-# Use wrapper-first Execution Workspace providers
+# ADR 0006: Use wrapper-first Execution Workspace providers
 
 Date: 2026-05-21
 
 ## Status
 
-Superseded as the target architecture by ADR 0012 and ADR 0014. Retained as historical and transitional context for the legacy direct-provider path.
+Superseded by the ACP core RuntimePool cutover.
 
-Orka should add new Execution Workspace providers behind the existing worker-wrapper path before moving provider lifecycle ownership into the controller. The controller validates, locks, and creates the normal worker Job; the outer worker claims the selected provider, stages the inner worker, runs it inside the workspace, reports provider-neutral status, and applies cleanup. This preserves Orka's existing worker auth, result submission, artifact upload, and agent runtime behavior while isolating provider-specific lifecycle code behind `WorkspaceExecutor`.
+## Original decision
 
-Controller-direct execution can be reconsidered after Substrate is stable enough to justify tighter lifecycle orchestration and stronger controller-owned observability.
+The original execution-workspace prototype placed provider ownership in a per-Task worker path: the controller created a worker Job, the worker claimed an upstream workspace, staged another worker process, and handled result submission and cleanup.
+
+## Superseding decision
+
+Built-in `type: agent` Tasks now use only `orka.harness.v2` RuntimePools and private RuntimeSessions. There is no per-Task agent Job or worker-based fallback. Top-level `Task.spec.workspace` defines verified repository input and clean-room publication policy; `Task.spec.execution.workspace` is rejected by the ACP core runtime.
+
+Future agent-sandbox or Substrate support must host one RuntimeSession behind the same v2 lifecycle. Orka remains authoritative for attempt/session fences, prompt leases, cancellation, transcript/finalization, workspace deltas, publication, and delivery receipts. Source-read, target-read, target-write, and forge credentials remain outside the ACP process tree.
diff --git a/docs/adr/0007-substrate-actor-pool-oversubscription.md b/docs/adr/0007-substrate-actor-pool-oversubscription.md
index cf7618b1f..b5dcd7f07 100644
--- a/docs/adr/0007-substrate-actor-pool-oversubscription.md
+++ b/docs/adr/0007-substrate-actor-pool-oversubscription.md
@@ -1,9 +1,11 @@
-# Model Substrate oversubscription as controller-owned actor pools
+# ADR 0007: Model Substrate oversubscription as controller-owned actor pools
 
-Substrate oversubscription should be exposed through an Orka-owned actor pool abstraction rather than by overloading per-Task workspace fields. A pool represents a bounded Substrate WorkerPool plus a target actor density, such as 250 stateful actors across 8 workers, and the controller reconciles pool membership, queued claims, and cleanup pressure against that budget. Tasks still select an Execution Workspace provider and template; they may reference a pool, but they should not choose individual workers or actor pods.
+## Status
 
-The pool controller should own scheduling and juggling decisions. It can pre-create or retain suspended actors, resume actors when workers have capacity, suspend idle actors to free workers, and use Substrate `ListActors` and `ListWorkers` to publish density and placement health. Workers continue to own command execution through the wrapper-first path, so result submission, artifact upload, token handling, and provider-neutral Task status stay unchanged.
+Deferred and superseded in part by the ACP RuntimePool model.
 
-The first implementation slice should keep Task status provider-neutral: surface density, placement, and latency, but do not expose raw Substrate snapshot URIs, daemon URLs, or tokens. Later snapshot restore work can reuse the vendored checkpoint/restore clients, but restoring arbitrary snapshots should be a pool/controller action with explicit template compatibility checks instead of a worker-side shortcut.
+The current first-release pool is a controller-owned logical ACP `RuntimePool` with one active Kubernetes Pod, bounded resident RuntimeSessions, bounded concurrent prompts, drain, and scale-to-zero behavior. Tasks do not choose individual workers or Pods.
 
-This keeps oversubscription an operator-controlled capacity feature, avoids encoding provider-native pod choices into user Tasks, and leaves room for MCP tool-actors to reuse the same pool machinery when Orka adds durable tool-hosting actors.
+A future Substrate implementation may map that logical pool to a bounded WorkerPool and Actor density, but each Actor must host one fenced `orka.harness.v2` RuntimeSession. Orka remains authoritative for queueing, admission, prompt leases, outcome classification, validation, publication reservations, and cleanup. Actor suspension or juggling must not occur while prompt, validation, publication, finalization, or Session lease work is active.
+
+Provider-native density and placement may be summarized safely in pool status. Raw snapshot URIs, daemon URLs, tokens, and arbitrary restore controls must not appear in Task status.
diff --git a/docs/adr/0008-runtime-session-internal-store-first.md b/docs/adr/0008-runtime-session-internal-store-first.md
index f5e518a7d..ddded1be8 100644
--- a/docs/adr/0008-runtime-session-internal-store-first.md
+++ b/docs/adr/0008-runtime-session-internal-store-first.md
@@ -4,25 +4,41 @@ Date: 2026-06-11
 
 ## Status
 
-Accepted for the first frontier implementation wave.
+Superseded for ACP control authority by the Kubernetes hard cutover. Retained as
+the historical record for why RuntimeSession was not initially exposed as a
+public process-management CRD.
 
 ## Context
 
-The remaining frontier introduces backend-neutral runtime sessions that can be claimed, reused, released, retained, suspended, and deleted. The lifecycle must support non-Substrate providers first while keeping Agent Substrate optional. Runtime sessions require strict namespace ownership and cleanup semantics, but the first provider still needs to prove the turn protocol and conformance suite before operators need a public CRD surface.
+The remaining frontier introduces backend-neutral runtime sessions that can be claimed, reused, released, retained, suspended, and deleted. The lifecycle must support non-Substrate providers first while keeping Agent Substrate optional. Runtime sessions require strict namespace ownership, exact instance fencing, and cleanup semantics. The Kubernetes RuntimePool provider and v2 conformance suite now supply the first implementation seam without requiring a public RuntimeSession CRD.
 
 ## Decision
 
-Start with an internal RuntimeSession state model and persistence boundary, then add a CRD only after the non-Substrate provider and cleanup loop have stable status requirements.
+The original decision was to start with an internal RuntimeSession state model
+and persistence boundary, then add a CRD only after the non-Substrate provider
+and cleanup loop had stable status requirements.
 
-The frozen state machine lives in `internal/harness` so the controller/provider implementation can share validation. Public API/CLI visibility can read from the internal store initially and later migrate to a CRD-backed implementation without changing the turn protocol.
+The frozen state machine still lives in `internal/harness/v2` so the controller
+and supervisor share validation. The hard cutover now makes
+`RuntimeSessionControl` and the other ACP control CRDs authoritative through
+status `resourceVersion` CAS, with coordination Leases for controller epoch and
+session mutation ownership. SQLite remains the payload store for transcripts,
+SessionTurns, deferred outbox projections, and artifacts.
 
 ## Consequences
 
-- Provider integration can ship behind feature gates without expanding the Kubernetes API surface prematurely.
-- Namespace ownership, cleanup policies, and transition validation are testable before persistence is introduced.
-- Operator visibility is initially API/CLI-driven rather than `kubectl get runtimesessions`.
-- A future CRD migration must preserve IDs, owner metadata, cleanup policy, active task, provider, phase, idle timeout, and max lifetime.
+- Provider-private process details remain inside the runtime; the public control
+  record stores only Orka-owned lifecycle, fences, leases, and safe receipts.
+- Namespace ownership, cleanup policy, and transition validation are enforced
+  by Kubernetes-authoritative records rather than SQLite control rows.
+- Operator visibility is available through Task/RuntimePool status, the API/CLI,
+  and the ACP control CRDs.
+- Cross-store finalization must preserve session UID/generation,
+  pool/runtime/controller fences, the active attempt/prompt, publication state,
+  transcript continuity, and the exact deferred outbox projection.
 
 ## Revisit
 
-Revisit once the non-Substrate provider passes conformance and the cleanup controller needs watch/reconcile semantics that are awkward for an internal store.
+Any future public process-detail API must remain a projection of this authority.
+It must not introduce prompt replay, split authority between SQLite and
+Kubernetes, or weaken v2 duplicate/fencing rules.
diff --git a/docs/adr/0009-agentkit-byoa-harness-runtime-boundary.md b/docs/adr/0009-agentkit-byoa-harness-runtime-boundary.md
deleted file mode 100644
index 610a7ce40..000000000
--- a/docs/adr/0009-agentkit-byoa-harness-runtime-boundary.md
+++ /dev/null
@@ -1,51 +0,0 @@
-# ADR 0009: Register bring-your-own agent runtimes through AgentRuntime
-
-Date: 2026-06-26
-
-## Status
-
-Accepted for the first bring-your-own agent runtime implementation slice.
-
-## Context
-
-Orka routes `type: agent` tasks through `AgentRuntime`, an Orka-facing runtime contract backed by `orka.harness.v1`. The remote execution backend may be a generic self-hosted HTTP runtime, AgentKit Serve, Azure AI Foundry hosted agents, or a future backend. Orka should not parse backend authoring formats or accept arbitrary per-Agent images and commands.
-
-Backend-specific protocol skins are adapter-owned and live outside the Orka source tree. Orka keeps only the provider-neutral protocol, public Go aliases, conformance checks, reference fixtures, and facade samples. Orka needs a stable Kubernetes-native boundary: the `AgentRuntime` registry, readiness/conformance, runtime routing, task provenance, capability tiers, and brokered-governance hooks.
-
-## Decision
-
-Orka consumes only the `orka.harness.v1` endpoint for bring-your-own agent runtimes.
-
-For the first milestone, Orka supports `AgentRuntime.spec.deployment.mode: external-endpoint`. The runtime is pre-deployed outside the `AgentRuntime` controller, and Orka validates the endpoint before any `Task` may route to it. Managed adapter Deployments are explicitly deferred until the protocol seam is proven.
-
-`AgentRuntime` is **namespaced in this first slice**. Issue #160 describes the long-term cluster-scoped, admin-owned registry, but the external-endpoint milestone intentionally mirrors the existing namespaced `Provider` governance pattern so namespace owners can validate the protocol seam without introducing cluster-wide admission or runtime allowlists in the same PR. Admin governance is still required for Secret use: harness bearer-token Secrets must explicitly opt in with `orka.ai/agent-runtime-auth: "true"`, may scope themselves to a single runtime with `orka.ai/agent-runtime-name`, and must bind themselves to the intended endpoint with `orka.ai/agent-runtime-endpoint`. A future follow-up can add a cluster-scoped registry or namespace allowlist once managed/dedicated-image runtimes and the BYO trust tier are designed.
-
-Agents select remote execution backends with `spec.runtime.runtimeRef`. Built-in CLI runtimes continue to use `spec.runtime.type: codex|claude|copilot` and the shared harness-wrapper endpoint. An Agent must set exactly one of `type` or `runtimeRef`.
-
-Tool execution has capability tiers:
-
-- **Observed mode:** the remote execution backend may use its own internal tools; Orka records lifecycle, output, and terminal result from harness frames, but cannot govern backend-internal side effects.
-- **Brokered mode:** brokered governance is the target model. Remote backends request Orka Tool execution, and Orka owns authorization, approval, idempotency-key injection, credential resolution, execution/brokering, events, lineage, and audit. Remote backends must not receive production Orka Tool credentials.
-
-Fibey remains one acceptance scenario, but the demo should show the same Orka API and approval UX across generic HTTP, AgentKit Serve, and Foundry-backed `AgentRuntime` facades. Foundry and AgentKit are backend options, not the architecture.
-
-## Consequences
-
-- Orka has a first-class `AgentRuntime` registry and readiness condition without exposing arbitrary Agent image/command fields.
-- `AgentRuntime` status carries sanitized observed capabilities and `observedGeneration`, which lets task routing fail closed on non-ready or stale runtime definitions.
-- Harness bearer token Secrets must opt in with `orka.ai/agent-runtime-auth: "true"`, may scope themselves to one runtime with `orka.ai/agent-runtime-name`, and must bind to the intended endpoint with `orka.ai/agent-runtime-endpoint`, preventing AgentRuntime authors from using the controller as a generic Secret exfiltration path.
-- Built-in CLI runtime behavior remains backward compatible.
-- External runtimes can prove the cross-repo contract without placing provider-specific implementations in the Orka repository or making Orka own Deployment, ServiceAccount, NetworkPolicy, image policy, or secret-delivery hardening.
-- Brokered Orka Tool execution is opt-in by capability and policy; observed mode must not be marketed as full brokered governance.
-
-## External adapter references
-
-- Microsoft Foundry Hosted Agents (Responses API): [`orka-agents/agent-runtime-foundry`](https://github.com/orka-agents/agent-runtime-foundry)
-- Microsoft Foundry Agent Service classic (Threads/Runs API): [`orka-agents/agent-runtime-foundry-classic`](https://github.com/orka-agents/agent-runtime-foundry-classic)
-
-## References
-
-- `docs/development/harness-protocol-mvp.md`
-- `docs/development/harness-conformance.md`
-- `internal/harness/`
-- Planned issue direction: bring-your-own agent runtimes as governed `AgentRuntime` entries rather than free-form per-Agent images.
diff --git a/docs/adr/0009-defer-runtime-session-ui-until-public-api.md b/docs/adr/0009-defer-runtime-session-ui-until-public-api.md
index 21562a7f4..955748e96 100644
--- a/docs/adr/0009-defer-runtime-session-ui-until-public-api.md
+++ b/docs/adr/0009-defer-runtime-session-ui-until-public-api.md
@@ -4,7 +4,7 @@ Date: 2026-06-13
 
 ## Status
 
-Accepted.
+Accepted; updated for the ACP v2 cutover.
 
 ## Context
 
@@ -13,13 +13,13 @@ fork) is shipping in the web UI. Its final phase asks whether the UI should also
 surface RuntimeSession lifecycle (claim, reuse, release, retain, suspend,
 delete).
 
-Per ADR 0008, RuntimeSession persistence starts as an internal `internal/harness`
-state model with **no public CRD or HTTP API**. A scan of the server routes
-(`internal/api/server.go`) confirms there is currently no
-`runtimesession`/`runtime-session` endpoint — `RuntimeSession*` types exist only
-in `internal/harness` as the turn-protocol contract. The only session-scoped HTTP
-surfaces are the conversation-session endpoints (`/api/v1/sessions/...`), which
-are unrelated to runtime sessions.
+The ACP hard cutover now stores RuntimeSession control, ownership, lifecycle,
+and mutation-lease state in Kubernetes-authoritative
+`RuntimeSessionControl` records and coordination Leases. The public HTTP surface
+still exposes Task execution/delivery projections and read-only RuntimePool
+endpoints rather than direct RuntimeSession mutation. Conversation session
+endpoints (`/api/v1/sessions/...`) remain a separate canonical-transcript
+surface backed by SQLite payload storage.
 
 The UI follow-up plan is explicit that the UI must not invent backend behavior or
 call endpoints that do not exist.
@@ -31,13 +31,14 @@ public runtime-session API exists. No runtime-session API client, hook, route, o
 component ships in this follow-up. This ADR is the documented follow-up that the
 plan requires.
 
-When a public API does land (reading from the internal store first, then a
-CRD-backed implementation per ADR 0008), add a feature-gated runtime-session view
-that surfaces, per session:
+When a public read API does land, it must project the Kubernetes-authoritative
+control record rather than create a second SQLite authority. Add a
+feature-gated runtime-session view that surfaces, per session:
 
 - runtime session id
 - namespace
-- provider
+- RuntimePool and exact runtime instance identity
+- provider/model profile
 - state / phase
 - active task (linkable to task detail)
 - idle age (and idle timeout)
@@ -54,14 +55,13 @@ execution-event surfaces already use.
 
 - No UI depends on unimplemented runtime-session backend behavior; nothing calls a
   nonexistent endpoint.
-- The field list above is fixed up front, matching the migration-preserving fields
-  in ADR 0008, so a future implementation has a clear target.
+- The field list above is fixed up front and must remain a safe projection of
+  `RuntimeSessionControl`, RuntimePool identity, and non-secret transcript data.
 - When the API ships, this is additive UI work behind a capability check rather
   than a redesign.
 
 ## Revisit
 
-Revisit when the non-Substrate provider passes conformance and a public
-runtime-session read API (internal-store-backed or CRD-backed) is exposed under
-`/api/v1`. At that point, implement the feature-gated view described above and
-update the UI guide (`website/docs/guides/ui.md`).
+Revisit when a public RuntimeSession read API is exposed under `/api/v1`. At
+that point, implement the feature-gated view described above and update the UI
+guide (`website/docs/guides/ui.md`).
diff --git a/docs/adr/0016-harness-migration-strategy.md b/docs/adr/0016-harness-migration-strategy.md
new file mode 100644
index 000000000..40e3ad4fc
--- /dev/null
+++ b/docs/adr/0016-harness-migration-strategy.md
@@ -0,0 +1,80 @@
+# ADR 0016: Select full active coexistence for the harness v1/v2 migration
+
+Date: 2026-08-05
+
+## Status
+
+Superseded by ADR 0018 on 2026-08-07. This record is retained as the historical
+full-active-coexistence decision; it is no longer an implementation or release
+contract.
+
+Previously accepted (engineering). Product and operations countersign are recorded in the
+release tracker before the first dual release ships; implementation may proceed
+on this record, but canary admission (Phase 7 of the plan) must not open without
+the countersign.
+
+## Context
+
+The `acp` line is an intentional v2-only hard cutover: the turn-oriented
+harness-wrapper path (`workers/harness`, `cmd/orka-agent-harness-wrapper`,
+`internal/controller/harness_wrapper.go`) exists only on `origin/main`
+(`21f8ef15`), while the ACP v2 RuntimePool path exists only on `acp`
+(`77bdc4db`). The two controllers cannot run concurrently against one Task
+population, the v2 CRD prunes v1-only fields, `runtime.type: opencode` exists in
+both baselines with incompatible configuration contracts, and the wrapper keeps
+active turns in process memory. Installations with in-flight v1 work therefore
+have no safe upgrade to v2 today.
+
+`docs/harness-v1-v2-coexistence-plan.md` (Revision 4) evaluates three
+strategies and specifies the full-coexistence design. Its Phase 0 gate requires
+one strategy to be selected before implementation.
+
+## Decision
+
+Select **full active coexistence** (plan §2.3 option 3) over blue/green
+replacement (option 1) and the zero-active-state in-place bridge (option 2).
+
+Decision drivers, recorded per the plan's quantitative gate:
+
+- **Continuity:** in-flight v1 Tasks, wrapper turns, and v1 Sessions must be
+  preserved and remain continuable; Session continuity is mandatory for the
+  primary installation, which is sufficient under the plan's "one high-value
+  installation" rule. Blue/green abandons in-flight runtime state; the
+  zero-active bridge requires a full drain window.
+- **Canaries:** v2 must be provable with same-cluster canaries under the same
+  controller ownership scope before v1 admission closes.
+- **Downtime:** near-zero; no maintenance window long enough for a full drain
+  is available on the primary installation.
+- **External usage:** external v1 `runtimeRef` runtimes and legacy v1 OpenCode
+  Agents are assumed present (fail-closed assumption); both are preserved
+  during the window under the compatibility policy.
+- **Rollback:** consequential external effects (publication, PRs) require the
+  checkpointed in-place rollback and coordinated restore procedures of plan
+  §14; Helm rollback alone is insufficient in every option.
+- **Cost:** full coexistence carries the highest build and retirement cost;
+  that cost is accepted and time-bounded below.
+- **Operator-supplied at rollout:** affected cluster/customer counts and
+  active-turn volume are installation-specific and are captured in the
+  pre-upgrade inventory report (plan §15) rather than in this record.
+
+Compatibility window: the owner is the repository owner (sozercan). Target
+retirement: v1 admission moves to `drain-only` by default two minor releases
+after the first dual release and the v1 data plane is removed one release
+later, with a maximum window of six months from the first dual release unless
+this ADR is superseded.
+
+Blue/green replacement and the zero-active-state bridge are rejected for this
+line, and their reduced plans are not produced. Per plan §2.3 this selection
+scopes all later phases to the full-coexistence design.
+
+## Consequences
+
+- The remainder of `docs/harness-v1-v2-coexistence-plan.md` is the implementation
+  contract; ADR 0017 records its architecture.
+- The v1 execution plane is restored and maintained for the bounded window,
+  including build, scanning, and CI lanes for both image families.
+- Until the compatibility release and its preflight tooling exist, simultaneous
+  v1 and v2 operation still requires separate clusters or non-overlapping
+  control planes.
+- Retirement is a gated, staged operation (plan §12 Phase 8, §15), not a
+  side effect of the window expiring.
diff --git a/docs/adr/0017-harness-coexistence-architecture.md b/docs/adr/0017-harness-coexistence-architecture.md
new file mode 100644
index 000000000..e7089b62d
--- /dev/null
+++ b/docs/adr/0017-harness-coexistence-architecture.md
@@ -0,0 +1,113 @@
+# ADR 0017: Harness v1/v2 coexistence architecture and ownership contracts
+
+Date: 2026-08-05
+
+## Status
+
+Superseded by ADR 0018 on 2026-08-07. This record is retained as the historical
+architecture for the rejected shared-population design; it is no longer an
+implementation or release contract.
+
+Previously accepted. Implements the strategy selected in ADR 0016; the normative
+specification is `docs/harness-v1-v2-coexistence-plan.md` (Revision 4). Where
+this record and the plan disagree, the plan governs.
+
+## Context
+
+One compatibility release must run harness v1 (turn-oriented wrapper and
+external v1 endpoints) and harness v2 (ACP RuntimePools) against the same Task
+population without inference, fallback, cross-dispatch, or protocol mutation,
+and must retire v1 as a separately gated operation.
+
+## Decision
+
+**Ownership.** One controller binary and exactly one controller ownership
+scope reconcile agent Tasks. Leader election is mandatory. The global Lease is
+`orka-system/orka-agent-execution` and never varies by release or namespace.
+Every legacy `03b49a10.orka.ai` Lease is enumerated, acquired in deterministic
+order, and continuously renewed as a migration fence recorded in
+`AgentExecutionControl.status.ownership`; loss of any fence closes readiness
+and stops every mutating runnable. While SQLite is the payload store the
+controller runs exactly one Pod, `Recreate` rollout, and a process-lifetime
+exclusive filesystem lock; every mutating SQLite-backed endpoint and background
+writer is leader-gated. Kubernetes control CRDs and Leases are authoritative
+for lifecycle, fences, and CAS; SQLite persists payloads, ledgers, outbox
+projections, and artifacts only (extends ADR 0008).
+
+**API surface.** `core.orka.ai/v1alpha1` remains the only Kubernetes API
+version; harness v1/v2 are protocol values. A bridge CRD wave installs the
+full v1+v2 field superset with variant fields as optional pointers, no
+protocol defaults, and discriminator CEL; enforcement admission then ratchets:
+new built-in Agents require an immutable `spec.runtime.contractVersion`
+(`orka.harness.v1|orka.harness.v2`), `AgentRuntime.spec.contractVersion`
+accepts both values and is immutable, and unchanged historical v1 objects
+(including legacy Task `spec.agentRuntime.workspace` fields and
+`status.harnessRuntime`) round-trip without pruning. A missing selector is
+never interpreted as either protocol; `runtime.type: opencode` is never
+protocol evidence.
+
+**Binding.** Every executable agent Task gets, before any executor side
+effect, a write-once, immutable, uncached compare-if-absent
+`status.agentExecutionBinding` that freezes protocol, backend, mode revision,
+policy identity, Agent/runtime UIDs, and a content-addressed immutable
+execution snapshot of every non-secret executable input. Dispatchers build
+requests only from the snapshot. Snapshot bodies are encrypted at rest,
+reference-retained, and exported only through a privileged audited operation.
+Adoption of pre-existing Tasks consults v2 authoritative stores first, then
+durable v1 evidence, and quarantines ambiguity immutably
+(`agentExecutionQuarantine`); proven no-route-state deletion records immutable
+`UnboundNoExecution`. There is no fallback in either direction, ever.
+
+**Dispatch.** Two isolated leader-gated dispatchers consume durable demand
+carrying the binding digest: `HarnessV1Dispatcher` (durable attempt state
+machine, wrapper admission ledger closing only pre-first-frame ambiguity,
+`SubmittedUnknown`/`OutcomeUnknown` without replay) and the existing
+`ACPDispatcher` (unchanged v2 fencing, publication, external-effect, and
+`OutcomeUnknown` semantics; RuntimePool side effects only after binding).
+External v2 `runtimeRef` dispatch stays fail-closed.
+
+**Sessions.** Every agent Session durably records lineage (namespace UID,
+Session UID, contract version, lineage generation, runtime identity, snapshot
+digest, provenance) claimed atomically with the Session lease. Implicit
+cross-protocol continuation is rejected; migration is an explicit
+transcript-bootstrap creating a new Session UID. Terminal settlement is one
+atomic order: validate Kubernetes authority → commit SQLite payload plus
+inactive outbox → CAS Kubernetes control and release the lease → activate the
+projection. Ambiguity settles the Session `ReconciliationBlocked`, never
+`Available`.
+
+**Modes and admission.** Backend admission modes (`enabled → closing →
+drain-only → disabled`) live in the singleton `AgentExecutionControl` with
+UID/generation/modeRevision CAS and durable binding reservations; the
+controller-serialized closing barrier is the linearization point. New v1
+admission additionally requires an admin-owned `AgentExecutionPolicy` bound by
+UID/generation/digest. Fail-closed admission (parameterized
+ValidatingAdmissionPolicy plus `failurePolicy: Fail` webhooks) is served by a
+separate stateless replicated `orka-admission` Deployment, never by the
+singleton controller Pod; narrowly scoped API-server match conditions exempt
+only cleanup-safe controller writes. Quarantine and blocked Sessions exit only
+through automatic receipt-based recovery or an immutable, fenced, admin-only
+`AgentExecutionAdjudication`; original evidence is never rewritten.
+
+**OpenCode.** Legacy v1 OpenCode Agents are preserved for the window
+(sealed-inventory adoption only; no new v1 OpenCode bindings); new OpenCode is
+v2-only through the managed digest-pinned RuntimePool profile with
+provider-qualified model IDs and reviewed limits. v1→v2 OpenCode migration
+creates a new Agent UID and new Session lineage; nothing is patched in place.
+Omitted versus explicit-empty tool allowlists remain distinct security states
+everywhere.
+
+## Consequences
+
+- Protocol choice is always an explicit, durable, immutable fact; every
+  executor record carries the binding digest, and cross-dispatch is
+  structurally impossible rather than merely avoided.
+- The plan's schemas (§6.2–§6.5, §7.7, §9.3), verification matrix (§13),
+  rollback checkpoints (§14), and retirement proofs (§15) are binding release
+  gates; `scripts/upgrade-orka-crds.sh` remains the v2-only hard-cutover tool
+  and is not the coexistence migration path.
+- V1 is a compatibility trust tier: no strict-governance claims, no new direct
+  publication, credential-free public-read-only new workloads, warning
+  events/metrics on every admitted v1 Task.
+- The wrapper Pod template is never mutated while active turns exist without a
+  completed durable drain.
diff --git a/docs/adr/0018-static-harness-modes-and-namespace-isolation.md b/docs/adr/0018-static-harness-modes-and-namespace-isolation.md
new file mode 100644
index 000000000..47ac5887c
--- /dev/null
+++ b/docs/adr/0018-static-harness-modes-and-namespace-isolation.md
@@ -0,0 +1,114 @@
+# ADR 0018: Use static harness modes and namespace-isolated control planes
+
+Date: 2026-08-07
+
+## Status
+
+Accepted. Supersedes ADR 0016 and ADR 0017. The normative rollout and
+verification contract is `docs/harness-v1-v2-coexistence-plan.md` Revision 8.
+
+## Context
+
+ADR 0016 selected full active coexistence, and ADR 0017 placed harness v1 and
+harness v2 behind one controller ownership scope and one Task population. That
+design safely preserved ambiguous in-flight state, but required three new CRDs,
+dynamic backend modes, immutable route bindings and snapshots, legacy
+classification, quarantine and adjudication, binding reservations, and a
+cluster-global ownership fence.
+
+The actual product requirement is narrower: keep a legacy v1 installation
+available while a new v2 installation is proven on the same Kubernetes
+cluster. Existing work does not need to change protocols, and a Session does
+not need to continue across protocols. Kubernetes namespaces can provide the
+ownership boundary if controller caches, RBAC, storage, Leases, endpoints, and
+data planes are isolated with them.
+
+CRDs remain cluster-scoped. Separate releases therefore cannot independently
+evolve incompatible CRD schemas, even when every custom resource is
+namespaced.
+
+## Decision
+
+Run harness v1 and harness v2 as two independent Orka installations. Every
+controller requires exactly one static startup mode:
+
+- `harness-v1` enables the legacy wrapper path and does not enable ACP agent
+  execution;
+- `harness-v2` enables ACP RuntimePool/RuntimeSession execution and does not
+  enable the legacy wrapper path.
+
+`dual`, `auto`, and `harness-v1-drain` are not modes. Mode is not a runtime
+setting and cannot be changed in place.
+
+Every controller requires a non-empty `--watch-namespace`. That namespace must
+carry `orka.ai/controller-mode` with the exact controller mode. A missing or
+mismatched claim fails startup. Leader election remains mandatory, but its
+Lease is scoped to the watched namespace rather than a cluster-global harness
+ownership namespace.
+
+Same-cluster coexistence requires different:
+
+- release names and controller namespaces;
+- watched workload namespaces;
+- API Services and producer endpoints;
+- ServiceAccounts and namespace-enforcing RBAC;
+- leader-election Leases;
+- SQLite stores, PVCs, backups, and Secrets;
+- wrapper, worker, publisher, proxy, and runtime data-plane resources.
+
+The v2 installation is the sole owner of cluster-scoped gateway and
+workspace-provider reconcilers. Cluster-scoped CRDs and common admission
+resources have one designated platform owner and are not independently owned by
+both Helm releases.
+
+One shared CRD bundle preserves the supported v1 and v2 object shapes. Contract
+selectors may remain where needed to discriminate that schema, but a selector
+must match controller mode and cannot route a Task to another protocol.
+`runtime.type: opencode` is not a protocol selector.
+
+There is no supported migration between protocols:
+
+- no Task, Agent, or AgentRuntime changes its execution protocol;
+- no Session or transcript continues under the other protocol;
+- no controller cancels, settles, finalizes, publishes, or cleans up work from
+  the other installation;
+- no controller database, PVC, ledger, or runtime store is reused under the
+  other mode.
+
+Creating an object in the other installation creates new work with a new
+namespace, UID, Session lineage, attempt history, and external-effect history.
+
+The architecture does not include `AgentExecutionControl`,
+`AgentExecutionPolicy`, or `AgentExecutionAdjudication`. It also does not
+include shared-population binding, classification, quarantine, adjudication,
+or dynamic backend-mode machinery.
+
+V1 draining is operational: stop its ingress and producers, revoke create
+permission, inventory and settle existing v1 work, then remove the v1 release.
+The controller does not acquire a third drain mode.
+
+## Consequences
+
+- V1 and v2 can be canaried on one cluster without sharing execution ownership
+  or state.
+- The three coexistence CRDs and most shared-population coordination machinery
+  are unnecessary.
+- Protocol selection is obvious from the installation endpoint, watched
+  namespace, and static mode.
+- Mode changes require a new namespace and installation. This deliberately
+  trades in-place migration for a smaller safety surface.
+- Pre-static implicit-v2 installations likewise require a fresh static-v2
+  release because their in-flight attempts lack the new execution authority;
+  supported upgrades begin only after a release declares its static mode.
+- Operators temporarily manage two endpoints, stores, data planes, and backup
+  sets.
+- Existing v1 Tasks and Sessions remain on v1 until they finish or are
+  canceled. They cannot be resumed on v2.
+- Rollback redirects future submissions; it does not convert accepted v2 work
+  into v1 work.
+- A designated platform owner must coordinate every CRD upgrade and preserve
+  both shapes for the full compatibility window.
+- Namespace-scoped caches without namespace-enforcing RBAC are insufficient;
+  isolation tests must prove cross-plane reads and writes are forbidden.
+- Historical v1 objects may outlive the v1 data plane and keep the shared
+  schema broad until retention and archival requirements are complete.
diff --git a/docs/development/acp-crd-hard-cutover.md b/docs/development/acp-crd-hard-cutover.md
new file mode 100644
index 000000000..13d486bad
--- /dev/null
+++ b/docs/development/acp-crd-hard-cutover.md
@@ -0,0 +1,218 @@
+# ACP v2 CRD hard cutover
+
+`scripts/upgrade-orka-crds.sh` is the only supported helper for replacing a
+cluster that may still contain `orka.harness.v1` AgentRuntime state. It is a
+fail-closed gate, not a migration tool. It never migrates or deletes
+AgentRuntime, Agent, or GatewayBinding objects.
+
+Do not store backups, verification markers, or copied SQLite data in the
+repository. They may contain sensitive operational data.
+
+## 1. Create and verify both backups
+
+Create a consistent backup of the controller SQLite/PVC state. A CSI snapshot,
+offline PVC archive, raw SQLite backup, or provider snapshot receipt is
+acceptable as the `--sqlite-backup` file, but the underlying backup must be
+restore-tested or independently inspected before its marker is written. A
+snapshot receipt file must identify the immutable snapshot that was tested.
+
+Export the pre-cutover CR inventory as one Kubernetes JSON List before deleting
+or migrating legacy objects:
+
+```bash
+set -Eeuo pipefail
+umask 077
+
+context=sertac-aks
+backup_dir=/absolute/secure/path/orka-acp-cutover
+install -d -m 0700 "$backup_dir"
+chmod 0700 "$backup_dir"
+
+cluster_uid="$(
+  kubectl --context "$context" get namespace kube-system \
+    -o jsonpath='{.metadata.uid}'
+)"
+api_server_identity_sha256="$(
+  kubectl --context "$context" config view --minify --flatten -o json \
+    | jq -c '
+        .clusters
+        | if length == 1 then
+            .[0].cluster
+            | {
+                server: (.server // null),
+                certificateAuthorityData: (.["certificate-authority-data"] // null),
+                insecureSkipTLSVerify: (.["insecure-skip-tls-verify"] // null),
+                tlsServerName: (.["tls-server-name"] // null),
+                proxyURL: (.["proxy-url"] // null),
+                disableCompression: (.["disable-compression"] // null)
+              }
+          else
+            error("expected exactly one target cluster")
+          end
+      ' \
+    | shasum -a 256 \
+    | awk '{print tolower($1)}'
+)"
+
+cr_tmp="$(mktemp "$backup_dir/.orka-crs.XXXXXX")"
+cleanup_cr_tmp() {
+  rm -f "$cr_tmp"
+}
+trap cleanup_cr_tmp EXIT
+
+if ! kubectl --context "$context" get \
+  agentruntimes.core.orka.ai,agents.core.orka.ai,gatewaybindings.gateway.orka.ai \
+  --all-namespaces -o json >"$cr_tmp"; then
+  echo "CR inventory capture failed; refusing to create a backup" >&2
+  exit 1
+fi
+if ! jq -e '.kind == "List" and (.items | type == "array")' \
+  "$cr_tmp" >/dev/null; then
+  echo "CR inventory validation failed; refusing to create a backup" >&2
+  exit 1
+fi
+chmod 0600 "$cr_tmp"
+mv "$cr_tmp" "$backup_dir/orka-crs.json"
+trap - EXIT
+```
+
+After verifying each backup, create a digest-bound operator attestation. Use
+`kind=sqlite-pvc` for the SQLite/PVC artifact and `kind=orka-crs` for the CR
+inventory:
+
+```bash
+write_verified_marker() {
+  kind="$1"
+  backup="$2"
+  marker="$3"
+  digest="$(shasum -a 256 "$backup" | awk '{print tolower($1)}')"
+  verified_at="$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
+  cat >"$marker" <<MARKER
+format=orka-backup-verification-v1
+kind=$kind
+context=$context
+cluster_uid=$cluster_uid
+api_server_identity_sha256=$api_server_identity_sha256
+sha256=$digest
+verified=true
+verified_at=$verified_at
+MARKER
+  chmod 0600 "$backup" "$marker"
+}
+
+# Run these only after the corresponding restore/inspection check succeeds.
+write_verified_marker sqlite-pvc \
+  "$backup_dir/controller-manager-store.snapshot-receipt.json" \
+  "$backup_dir/controller-manager-store.snapshot-receipt.json.verified"
+write_verified_marker orka-crs \
+  "$backup_dir/orka-crs.json" \
+  "$backup_dir/orka-crs.json.verified"
+```
+
+The upgrade script rejects relative paths, symbolic links, empty files,
+context or cluster-identity mismatches, malformed markers, and digest
+mismatches. The `cluster_uid` binds the backup to the target cluster rather than
+to a mutable kubeconfig alias. `api_server_identity_sha256` also binds the
+canonical API server and TLS settings. The script recomputes both cluster
+identities and both backup digests again immediately before the mutating CRD
+apply.
+
+## 2. Pause every affected Gateway workload
+
+The CR backup is used to preserve the historical chain:
+
+```text
+orka.harness.v1 AgentRuntime <- Agent.runtime.runtimeRef <- GatewayBinding
+```
+
+For every Gateway reached by that chain, scale the actual adapter Deployment or
+StatefulSet to zero and wait until its controller reports the current generation
+and zero replicas. Keep the workload at zero throughout the cutover.
+
+```bash
+kubectl --context "$context" -n orka-gateway-telegram \
+  scale deployment/orka-gateway-telegram --replicas=0
+kubectl --context "$context" -n orka-gateway-telegram \
+  rollout status deployment/orka-gateway-telegram
+```
+
+Pass an explicit mapping for every affected Gateway. The mapping binds the
+namespaced Gateway object to the workload that was paused:
+
+```text
+--gateway-workload GATEWAY_NAMESPACE/GATEWAY_NAME=deployment/WORKLOAD_NAMESPACE/WORKLOAD_NAME
+```
+
+The workload must be in the Gateway namespace. Each mapped Deployment or
+StatefulSet must exist with `spec.replicas=0`, zero reported replicas, and an
+`observedGeneration` at least as new as `metadata.generation`. Missing, stale,
+or partially terminated workloads block the upgrade.
+
+## 3. Remove or migrate legacy references
+
+Run the script once after the Gateways are paused. It reports every remaining
+blocker and exits without applying CRDs:
+
+```bash
+scripts/upgrade-orka-crds.sh \
+  --context "$context" \
+  --sqlite-backup "$backup_dir/controller-manager-store.snapshot-receipt.json" \
+  --sqlite-backup-marker "$backup_dir/controller-manager-store.snapshot-receipt.json.verified" \
+  --cr-backup "$backup_dir/orka-crs.json" \
+  --cr-backup-marker "$backup_dir/orka-crs.json.verified" \
+  --gateway-workload \
+    orka-gateway-telegram/telegram=deployment/orka-gateway-telegram/orka-gateway-telegram
+```
+
+Migrate or delete the reported live objects in dependency order:
+
+1. GatewayBindings that reference affected Agents.
+2. Agents that reference v1 AgentRuntimes.
+3. `orka.harness.v1` AgentRuntimes.
+
+Every live Agent with `spec.runtime.type: opencode` is also a pre-cutover
+blocker. The pre-cutover Agent CRD cannot retain `spec.model.contextWindow` and
+does not admit the new built-in OpenCode shape, so do not try to patch such an
+Agent in place. Export it after taking the verified CR backup, quiesce any
+callers, and delete it before rerunning the gate. After the new CRD is applied,
+recreate it with a provider-qualified `spec.model.name`, reviewed positive
+`contextWindow` and `maxTokens`, and no `providerRef`, provider Secret, or
+Agent-level system prompt. Alternatively, migrate the live Agent to
+`claude`, `codex`, `copilot`, or an admin-registered `runtimeRef` before the
+cutover.
+
+Do not resume Gateway workloads during this process.
+
+Legacy harness-wrapper Deployments, Services, and Secrets are also blockers.
+Without an explicit flag, the script prints exact cleanup commands and does not
+delete anything. To let the script delete only the reported wrapper
+Deployment/Service/Secret resources, rerun with:
+
+```text
+--delete-legacy-wrapper
+```
+
+That flag does not delete ServiceAccounts, AgentRuntimes, Agents,
+GatewayBindings, or any other resource.
+
+## 4. Apply only after the gate is clean
+
+Rerun the same command with the same verified backup files and Gateway mappings.
+The script:
+
+1. validates the backup markers and CR inventory;
+2. discovers live v1 resources and the historical reference chain;
+3. verifies every affected Gateway workload is fully at zero;
+4. rejects any remaining wrapper Deployment, Service, or Secret;
+5. performs a server-side dry run of the new CRDs;
+6. repeats all backup and live-state checks;
+7. revalidates the backup digests and immutable cluster identity immediately
+   before mutation; and
+8. only then performs the server-side CRD apply.
+
+Any failed read, discovery call, marker check, workload check, deletion, or
+dry-run aborts the process. The focused shell fixture suite is:
+
+```bash
+/bin/bash scripts/tests/upgrade-orka-crds-test.sh
+```
diff --git a/docs/development/execution-events-wave-0.md b/docs/development/execution-events-wave-0.md
index 98e96b028..4d8119c77 100644
--- a/docs/development/execution-events-wave-0.md
+++ b/docs/development/execution-events-wave-0.md
@@ -1,6 +1,6 @@
 # Execution Event Contract Dependency Notes
 
-Wave 0 defines the required P0 execution event contract for later implementation lanes. It does not require Agent Substrate, resident actors, fork/checkpoint support, full trace graphs, approvals workflows, harness protocol work, remote harnesses, or session stream endpoints.
+Wave 0 defines the required P0 execution event contract for later implementation lanes. It does not require Agent Substrate, resident actors, fork/checkpoint support, full trace graphs, approvals workflows, ACP v2 runtime work, external runtime adapters, or session stream endpoints.
 
 ## Stable contracts from Wave 0
 
diff --git a/docs/development/execution-events-wave-4.md b/docs/development/execution-events-wave-4.md
index e01446631..b47def809 100644
--- a/docs/development/execution-events-wave-4.md
+++ b/docs/development/execution-events-wave-4.md
@@ -102,7 +102,7 @@ Minimum P0 producers:
 
 - Controller lifecycle: `TaskJobCreated`, `TaskStarted`, and terminal `TaskSucceeded`/`TaskFailed`/`TaskCancelled`.
 - AI worker: `WorkerStarted`, model request started/completed or failed, tool call started/completed or failed when used, `ResultSubmitted`, and worker completed/failed.
-- Agent CLI runtime: `WorkerStarted`, workspace preparation started/completed or failed, `AgentRuntimeStarted`, `AgentRuntimeCommandStarted`, runtime completed/failed, `ResultSubmitted`, and worker completed/failed.
+- ACP runtime path: queue/reservation/session-start/submit/accepted/running/settling events, bounded prompt diagnostics, workspace validation/publication transitions, and terminal execution/delivery projection. Runtime diagnostics are not canonical Task authority.
 
 ## Retention and deletion behavior
 
diff --git a/docs/development/execution-workspace-provider-implementation-plan.md b/docs/development/execution-workspace-provider-implementation-plan.md
index b904e140d..28a487e19 100644
--- a/docs/development/execution-workspace-provider-implementation-plan.md
+++ b/docs/development/execution-workspace-provider-implementation-plan.md
@@ -1,6 +1,6 @@
 # Execution Workspace Provider, Pool, and Hosted Tool Implementation Plan
 
-**Date:** July 16, 2026  
+**Date:** July 16, 2026
 **Target repository:** `github.com/orka-agents/orka`
 
 ## Summary
diff --git a/docs/development/harness-conformance.md b/docs/development/harness-conformance.md
deleted file mode 100644
index 620ed1c12..000000000
--- a/docs/development/harness-conformance.md
+++ /dev/null
@@ -1,90 +0,0 @@
-# Harness conformance suite
-
-`internal/harness/conformance` is the controller implementation of the reusable `orka.harness.v1` conformance library. Its public facade at `pkg/harness/conformance` makes the same checks available to external Go adapters. Both return condition-ready results: pass/fail, sanitized messages, and observed capabilities.
-
-`internal/harness/harnesstest` remains the Go test fixture layer. It supplies fake harness behaviors and wraps the reusable checks for provider tests.
-
-## How providers plug in
-
-A provider test can continue to supply a factory:
-
-```go
-harnesstest.RunHarnessConformance(t, func(t *testing.T, behavior harnesstest.FakeBehavior) (string, func()) {
-    server := startProviderHarnessForBehavior(t, behavior)
-    return server.BaseURL, server.Close
-})
-```
-
-Controller or CLI code should use the reusable runner directly:
-
-```go
-result := conformance.CheckReadiness(ctx, conformance.Target{
-    BaseURL:     endpoint,
-    BearerToken: token,
-})
-if !result.Passed {
-    // publish result.Message into a Ready=False condition
-}
-```
-
-## Required endpoint contract
-
-The suite expects an HTTP+SSE harness endpoint implementing:
-
-- `GET /v1/health` (unauthenticated)
-- `GET /v1/capabilities` (unauthenticated)
-- `POST /v1/turns` (bearer-authenticated)
-- `GET /v1/turns/{turnID}/events?afterSeq=N` (bearer-authenticated)
-- `POST /v1/turns/{turnID}/continue` for brokered profiles (bearer-authenticated)
-- `POST /v1/turns/{turnID}/cancel` when `supportsCancel=true` (bearer-authenticated)
-
-Orka's `internal/harness/protocol.go` is the source of truth for `orka.harness.v1`. External Go adapters can consume the alias-only public surface in `pkg/harness`; adapters implemented independently must keep their wire DTOs compatible with it. External runtimes — including generic HTTP adapters, AgentKit Serve, and Foundry adapters — must match these DTOs rather than expecting Orka to accept backend-specific compatibility JSON.
-
-Required wire fields include:
-
-- Health: `version`, `status`, `ready`, `checkedAt`.
-- Capabilities: `version`, `protocolVersion`, `transport`, `runtimeName`, `providerKind`, and at least one `toolExecutionModes` entry. Brokered capability profiles also advertise `brokeredToolClasses`, `supportsContinuation`, and artifact/limit fields when supported.
-- Observed runtimeRef execution requires observed-mode turn conformance. Brokered-only runtimes are accepted when they advertise brokered classes, support continuation, and pass the advertised brokered profile probes. Brokered read/write/coordination probes validate `brokeredToolClasses`, `supportsContinuation`, tool-call frames, `/continue`, tool-result acknowledgement, and terminal completion.
-- Start turn response: `version`, `accepted: true`, `runtimeSessionID`, `turnID`, `correlationID` when supplied, and `eventStreamPath`.
-- Frames: `version`, known `type`, `runtimeSessionID`, `turnID`, `correlationID`, and positive `seq`.
-- Terminal frames: exactly one of `TurnCompleted`, `TurnFailed`, or `TurnCancelled`; `TurnCompleted` must include `completed`, and `TurnFailed` must include `failed`.
-- Auth: health/capabilities remain open; start, events, and cancel reject unauthenticated requests when auth is required.
-
-## Covered behavior
-
-- health and capabilities responses validate DTO versioning;
-- readiness results expose observed capabilities for Kubernetes status;
-- successful turns emit exactly one terminal frame;
-- failed turns map to safe `AgentRuntimeFailed` events;
-- brokered read, write, and coordination profile probes start brokered turns, require a `ToolCallRequested` frame, send a synthetic Orka `ToolCallResult` through `/continue`, and require a matching `ToolResultReceived` plus terminal completion;
-- cancellation invokes the cancel endpoint and emits `TurnCancelled` in fixture tests;
-- the reusable readiness/conformance runner rejects unknown frame types; the legacy `harnesstest` mapper fixture still verifies unknown frames become warning diagnostics instead of panics at the event-mapping layer;
-- secret-looking output is redacted before event persistence;
-- client timeouts surface as sanitized typed client errors;
-- broken fixtures such as unsupported protocol versions and omitted terminal frames fail with actionable messages.
-
-The generic HTTP fixture in `examples/harness/echo` is the reference runtime for observed and brokered read/write conformance. Task start requests include safe `input.tools` schemas for allowed brokered tools; these schemas omit execution URLs and credentials. Providers that cannot exercise every fake behavior directly should adapt the factory with a local fixture harness and run provider-specific smoke tests for the unavailable behavior.
-
-## AgentKit Serve observed conformance
-
-Current AgentKit Serve Orka support is observed mode by default; brokered read/write/coordination are available only behind AgentKit's conformance gates. To prove the Orka
-protocol skin against Orka's reusable conformance runner without model
-credentials, run the path-gated AgentKit source fixture test from an Orka
-checkout that can also see an AgentKit Serve checkout:
-
-```bash
-AGENTKIT_SERVE_ROOT=/path/to/agentkit.serve \
-  go test ./internal/harness/conformance -run 'TestExternalAgentKitServe(Observed|BrokeredRead|BrokeredWrite|BrokeredCoordination)Conformance' -count=1 -v
-```
-
-The observed test starts `agentkit_serve_common.orka.create_orka_app` with an
-offline echo `RuntimeSession`, requires bearer auth on turn endpoints, starts a
-native Orka `StartTurnRequest`, verifies duplicate-start behavior both while the
-turn is active and after terminal completion, streams Orka `HarnessEventFrame` values, and asserts AgentKit's default capabilities remain
-observed only. The brokered-read, brokered-write, and brokered-coordination tests start the same
-AgentKit Orka skin with the corresponding conformance gate enabled and run Orka
-`ProbeBrokeredRead`, `ProbeBrokeredWrite`, or `ProbeBrokeredCoordination`, proving
-`ToolCallRequested`, `/continue`, `ToolResultReceived`, and terminal completion.
-These tests are skipped by default so ordinary Orka-only CI does not need a
-sibling AgentKit checkout. Coordination policy, quotas, lineage, and namespace
-checks remain Orka-owned.
diff --git a/docs/development/harness-protocol-mvp.md b/docs/development/harness-protocol-mvp.md
deleted file mode 100644
index 72a591a4b..000000000
--- a/docs/development/harness-protocol-mvp.md
+++ /dev/null
@@ -1,157 +0,0 @@
-# Harness protocol MVP preparation
-
-The harness protocol should build on the event model after task/session traces have burn-in. It must not require Agent Substrate.
-
-## Requirements from current event streams
-
-| Responsibility | Owner |
-| --- | --- |
-| Task CR creation, phase transitions, Job creation, terminal task status | Controller |
-| Worker process start/complete/fail | Worker/harness |
-| Model request lifecycle and model messages | Runtime harness |
-| Tool call lifecycle | Runtime harness or tool executor |
-| Workspace preparation lifecycle | Controller/worker boundary, depending on provider |
-| Result submission and artifact upload | Worker/harness |
-| Cancellation observed and turn completion | Controller plus harness |
-
-## Protocol sketch
-
-Messages:
-
-- `StartTurn`: task/session metadata, safe prompt/context references, cancellation token, event append target.
-- `StreamEvent`: one sanitized execution event payload matching the existing event DTO.
-- `CancelTurn`: request cancellation for a running turn.
-- `EndTurn`: terminal result metadata and final event sequence observed by the harness.
-- `Health`: readiness/liveness and runtime capability surface.
-
-Transport candidates:
-
-- HTTP + SSE for lowest implementation cost and compatibility with current APIs;
-- gRPC for typed bidirectional streaming once the contract stabilizes;
-- stdin/stdout wrapper for local CLI runtimes.
-
-Auth and namespace rules:
-
-- Harnesses receive namespace-scoped, least-privilege credentials.
-- TxTokens and provider credentials must never be placed in event payloads.
-- Outbound scope exchanges remain fail-closed.
-
-## Boring MVP
-
-Use a non-Substrate backend first:
-
-1. Wrap one existing agent CLI runtime with a local harness adapter.
-2. Adapter emits `StreamEvent` messages to the existing internal event append API.
-3. Controller still owns Task/Job lifecycle events.
-4. Trace API validates model/tool/result grouping without a resident actor.
-5. Only after this is stable should a resident/Substrate provider implement the same protocol.
-
-Deferred:
-
-- resident actor sessions;
-- workspace snapshot-aware fork;
-- remote harness-backed Agent CRDs;
-- full graph layout UI.
-
----
-
-## Frozen MVP contract (`orka.harness.v1`)
-
-The implementation contract is now represented by `internal/harness` and is frozen for the first backend-neutral provider. The MVP transport is **HTTP control endpoints plus an SSE frame stream**:
-
-| Route | Method | Purpose |
-| --- | --- | --- |
-| `/v1/health` | `GET` | Return `HealthResponse`. |
-| `/v1/capabilities` | `GET` | Return `CapabilitiesResponse`. |
-| `/v1/turns` | `POST` | Accept `StartTurnRequest` and return `StartTurnResponse`. |
-| `/v1/turns/{turnID}/events?afterSeq=N` | `GET` | Stream `HarnessEventFrame` values as SSE `data:` records. |
-| `/v1/turns/{turnID}/continue` | `POST` | Accept `ContinueTurnRequest` carrying Orka-brokered tool results and return `ContinueTurnResponse` when the continuation profile is advertised. |
-| `/v1/turns/{turnID}/cancel` | `POST` | Accept `CancelTurnRequest` and return `CancelTurnResponse`. |
-
-Every DTO carries `version: "orka.harness.v1"`. A missing or unsupported version is a deterministic validation error. Provider-specific fields, including Agent Substrate actor identifiers, are excluded from base request DTOs and belong only in provider capability metadata/status.
-
-### Required turn fields
-
-`StartTurnRequest` requires namespace, task name, session name, runtime session id, turn id, correlation id, deadline, and a verified auth identity subject or username. Tool and approval policies are safe object references. Raw TxTokens are not valid DTO fields. Resolved literal credentials destined for a controller-managed local runtime subprocess (provider API keys, git tokens already read from a Secret by the controller) ARE permitted in `input.env` (`TurnEnvVar`): that request body is equivalent to mounting a Secret into the wrapper pod. Remote execution backends must not receive production Orka Tool credentials; governed tool access is through brokered Orka calls. When brokered tools are allowed, `input.tools` carries only safe schema metadata: tool name, description, brokered class, and JSON parameters. It intentionally omits downstream URLs, headers, Secret refs, and credentials.
-
-```json
-{
-  "version": "orka.harness.v1",
-  "namespace": "default",
-  "taskName": "task-a",
-  "sessionName": "session-a",
-  "runtimeSessionID": "runtime-a",
-  "turnID": "turn-a",
-  "correlationID": "corr-a",
-  "deadline": "2026-06-11T12:00:00Z",
-  "authIdentity": {"subject": "user:test"},
-  "toolPolicyRef": {"name": "default-tools"},
-  "approvalPolicyRef": {"name": "default-approvals"},
-  "eventCursor": 7,
-  "toolExecutionMode": "brokered",
-  "input": {
-    "prompt": "summarize this incident",
-    "tools": [{
-      "name": "support-ticket-lookup",
-      "description": "Look up sanitized support evidence",
-      "brokeredClass": "read",
-      "parameters": {"type": "object"}
-    }]
-  }
-}
-```
-
-### Frame-to-event mapping
-
-Harness frames are mapped to existing Orka execution event types so task/session streams and trace read models remain the source of history:
-
-| Harness frame | Execution event type | Notes |
-| --- | --- | --- |
-| `TurnStarted` | `AgentRuntimeStarted` | Turn/session ids appear in event content metadata. |
-| `RuntimeOutput` | `ModelMessage` | Runtime output is sanitized before persistence. |
-| `ToolCallRequested` | `ToolCallStarted` | `toolName` and `toolCallID` are preserved. |
-| `ToolResultReceived` | `ToolCallCompleted` | Failed tool results can carry safe error content. |
-| `ApprovalRequested` | `AgentRuntimeCommandStarted` | Runtime-originated approval frames are diagnostics only; Orka creates canonical `ApprovalRequested` events when broker policy requires approval. |
-| `TurnCompleted` | `AgentRuntimeCompleted` | Terminal turn metadata is included in content. |
-| `TurnFailed` | `AgentRuntimeFailed` | Severity is forced to `error`. |
-| `TurnCancelled` | `AgentRuntimeCancelled` | Cancellation is terminal for the harness turn, but not controller-owned task cancellation. |
-| `RuntimeLog` | `AgentRuntimeCommandStarted` | Used as a safe diagnostic/log event. |
-| Unknown frame | `AgentRuntimeCommandStarted` warning | Does not panic; produces a safe diagnostic event. |
-
-Redaction/truncation runs in the harness mapper and again at the event store boundary. Secret-looking fake frames in conformance tests must persist only redacted values.
-
-### Tool execution modes
-
-- `observed`: the remote execution backend may use its own internal tools; Orka records lifecycle, output, and terminal results but cannot govern backend-internal side effects.
-- `brokered`: the backend requests Orka Tool execution through Orka. Orka owns authorization, approval, idempotency, credential resolution, execution/brokering, and audit. The idempotency key is `runtimeSessionID:turnID:toolCallID`; duplicate requests must return the same result or a deterministic conflict. Approval-required brokered calls emit approval events and do not execute until approved.
-
-Capabilities use a small mandatory core plus optional profiles. `toolExecutionModes` advertises `observed` and/or `brokered`. Brokered runtimes may additionally advertise `brokeredToolClasses` (`read`, `write`, `coordination`), `supportsContinuation`, `supportsArtifacts`, `maxTurnSeconds`, and `maxOutputBytes`. Foundry-, AgentKit-, or backend-native identifiers belong in adapter-owned metadata, not in the Orka-facing contract.
-
-Structured task results may use the `workers/common.StructuredResult` JSON envelope. In addition to summary/verdict/diff metadata, the envelope supports a generic `data` object for machine-readable payloads and `artifacts` references for larger outputs. `wait_for_tasks` preserves `data` when it fits the inline bound and propagates artifact references; oversized data is replaced with an explicit truncation marker so large payloads can move to artifacts instead of task summaries.
-
-Brokered coordination tools follow the same governance path as Tool CRDs. `delegate_task` supports explicit `agentNamespace` and `taskNamespace` fields: child tasks stay in the parent/task namespace by default, while the target Agent may live in a namespace-local facade or an allowed catalog namespace. The legacy `namespace` field remains a compatibility shortcut for callers that intentionally want both lookup and child task creation in the same namespace.
-
-### RuntimeSession lifecycle
-
-`internal/harness` defines the backend-neutral state machine:
-
-```text
-Pending -> Booting -> Ready -> TurnRunning -> Idle -> Releasing -> Deleted
-                                      |          |            +-> Retained
-                                      |          |            +-> Suspended
-                                      |          +-> Deleting -> Deleted
-                                      +-> Failed/Unhealthy -> Deleting
-```
-
-Supported states are `Pending`, `Booting`, `Ready`, `TurnRunning`, `Idle`, `Releasing`, `Retained`, `Suspended`, `Deleting`, `Deleted`, `Failed`, and `Unhealthy`. Runtime sessions require namespace, session name, provider, cleanup policy, and owner metadata. Cleanup policies are `delete`, `retain`, and provider-capability-gated `suspend`.
-
-### Security requirements
-
-- Harness control calls are namespace-scoped and authenticated by Orka; per-turn credentials must be short-lived and scoped to the task/session.
-- Raw secrets, raw TxTokens, environment dumps, cookies, API keys, and JWTs must not appear in **persisted or observable** surfaces: Task status, persisted annotations, execution events/frames, logs, or trace output. Resolved literal credentials MAY be carried in the in-memory `StartTurnRequest.input.env` solely as the controller-to-wrapper delivery channel (see "Required turn fields"); the wrapper must not log the request and should drop `input.env` from retained turn state once child env is materialized. Raw TxTokens are disallowed even on the delivery channel — use owner-referenced child Secrets and fail-closed TTS exchanges. Confidentiality of the delivery channel in transit (TLS/mTLS) is a deployment-posture concern.
-- Cross-namespace runtime reuse is denied by ownership validation.
-- Lifecycle transitions and cleanup failures must be evented with safe metadata only.
-
-### Conformance contract
-
-The reusable conformance suite in `internal/harness/harnesstest` verifies health, capabilities, successful turns, failed turns, cancellation, invalid/unknown frames, redaction, and client timeout behavior against any provider factory. The fake harness server covers success, failure, delayed output, long-running turns, cancellation, invalid frames, and secret-looking output.
diff --git a/docs/development/post-p0-evented-runtime-checklist.md b/docs/development/post-p0-evented-runtime-checklist.md
index f05291471..962b5f32d 100644
--- a/docs/development/post-p0-evented-runtime-checklist.md
+++ b/docs/development/post-p0-evented-runtime-checklist.md
@@ -16,7 +16,7 @@ This checklist maps the P0 wave plans in `~/Downloads/orka-p0-wave-plans/` and t
 | Public task SSE stream | Implemented + tested | Replay, live polling, heartbeat, terminal `stream_complete`, and reconnect tests. |
 | Controller lifecycle producers | Implemented + tested | Task controller emits lifecycle events; focused controller event tests exist, envtest full suite requires envtest binaries. |
 | AI worker producers | Implemented + tested | `workers/ai` event tests cover model/tool/result/context events and redaction. |
-| Agent CLI producers | Implemented + tested | agent runtime event tests cover command/runtime lifecycle. |
+| ACP runtime producers | Foundation implemented + tested | Dispatcher, RuntimePool, v2 supervisor, and delivery state tests cover the session-centric path; full live/restart/publication acceptance remains required. |
 | Container/general worker producer | Implemented + tested | worker/common and general worker event/result tests cover basic lifecycle. |
 | Redaction/truncation | Implemented + tested | Worker-side and store-side redaction tests cover bearer/JWT/API key/cookie/GitHub/Anthropic/OpenAI/Txn token patterns. |
 | No Agent Substrate dependency | Implemented | Event store, APIs, trace, session aggregation, fork, and approvals use normal Task/Job event streams. |
@@ -47,7 +47,7 @@ This checklist maps the P0 wave plans in `~/Downloads/orka-p0-wave-plans/` and t
 | F4 | Integrate one high-risk action | Deferred integration | First target is PR creation/merge; API/read model is ready for worker/tool integration. |
 | F5 | CLI approvals | Implemented | `orka task approvals/approve/decline`. |
 | G1-G2 | Event metrics/SLO hooks | Implemented baseline | Metric names and safe labels are documented; append-time idempotent pair derivation can be expanded as producers stabilize. |
-| H | Harness protocol prep | Documented | See `docs/development/harness-protocol-mvp.md`. |
+| H | ACP runtime protocol | Superseded by v2 | The turn-oriented prototype was removed. The current contract is `orka.harness.v2`; see `website/docs/development/agent-runtime-adapter-contract.md`. |
 
 ## Release notes draft
 
diff --git a/docs/development/remaining-frontier-readiness.md b/docs/development/remaining-frontier-readiness.md
index ba12dadb6..e2b598b75 100644
--- a/docs/development/remaining-frontier-readiness.md
+++ b/docs/development/remaining-frontier-readiness.md
@@ -1,6 +1,6 @@
 # Remaining frontier readiness checklist
 
-Date: 2026-06-11
+Date: 2026-07-25
 
 This checklist gates implementation of the backend-neutral resident runtime frontier on top of the post-P0 evented runtime worktree.
 
@@ -11,24 +11,26 @@ This checklist gates implementation of the backend-neutral resident runtime fron
 | Fork/checkpoint MVP | Ready | Event-sequence fork API and CLI are present; physical snapshot fork remains deferred. |
 | Durable approvals MVP | Ready for API/read model | Approval event read model and decision endpoints exist; first high-risk tool integration is still deferred. |
 | Event metrics | Ready baseline | Append/list/stream/redaction metrics exist with low-cardinality labels. |
-| Harness protocol DTOs | Ready | `internal/harness` defines `orka.harness.v1` DTOs and validation. |
-| Event mapping | Ready for conformance | `internal/harness.MapFrameToExecutionEvent` maps frames to existing execution events. |
-| Runtime lifecycle state machine | Ready foundation | `internal/harness` validates RuntimeSession states and transitions. |
-| Tool execution modes | Ready contract | Observed and brokered modes plus brokered idempotency key are defined. |
-| Security requirements | Ready contract | Protocol docs and mapper enforce no raw secrets in persisted events. |
-| Conformance fixture | Ready foundation | `internal/harness/harnesstest` fake server and suite cover MVP provider behavior. |
-| Non-Substrate provider | Not implemented | The first Kubernetes Service/sidecar provider should be built after the conformance suite is adopted by controller integration. |
-| RuntimeSession persistence/API | Deferred | ADR 0008 selects internal-store-first; persistent implementation follows provider integration. |
-| Resident daemon/process | Deferred | Requires runtime session claim/release and provider implementation. |
-| Substrate provider | Deferred optional | Must remain provider-scoped and pass the same conformance suite. |
+| ACP v2 DTOs | Ready foundation | `internal/harness/v2` defines the session-centric `orka.harness.v2` request, event, lifecycle, duplicate, capability, and fencing contracts. |
+| Event mapping | Ready foundation | ACP v2 prompt events are bounded and mapped into Orka-owned execution/result state; runtime diagnostics are not canonical Task authority. |
+| Runtime lifecycle state machine | Ready foundation | `internal/harness/v2` validates RuntimeSession states from `creating` through validation/publication/finalization and deletion. |
+| Prompt-scoped broker authority | Implemented foundation | Each RuntimeSession exposes a credential-protected loopback MCP endpoint. The controller revalidates Task, attempt, prompt lease, exact runtime fences, tool policy, approval evidence, and consequential-effect identity for every call. |
+| Security requirements | Implemented foundation | V2 fences, operation capabilities, bounded diagnostics, private session identities, the central provider proxy, clean-room Git credential separation, and artifact/credential brokers are modeled and tested. |
+| Conformance fixture | Ready foundation | `internal/harness/v2/conformance` and `conformancetest` cover v2 identity, endpoints, duplicates, fencing, cancellation, and governance claims. |
+| Kubernetes RuntimePool provider | Implemented foundation | Controller-owned RuntimePools, exact-Pod routing, atomic status reservations, bounded-wait queue promotion, drain, scale-to-zero, and Codex/Claude/Copilot ACP images exist; full live acceptance remains required. |
+| Kubernetes control authority | Implemented foundation | `ControllerEpoch`, `PromptAttempt`, `RuntimeSessionControl`, `BranchClaim`, `Publication`, and `ExternalEffect` status plus coordination Leases are authoritative. SQLite retains transcript/SessionTurn, deferred outbox, and artifact payloads rather than ACP control authority. |
+| RuntimeSession persistence/API | Implemented foundation | Kubernetes control records and Leases fence restart/takeover recovery; SQLite persists transcript/session-turn payloads behind those fences. Full live restart/takeover acceptance remains required. |
+| External v2 runtime dispatch | Deferred | Registration, probing, and conformance are available, but `runtimeRef` Task planning remains fail-closed until the external v2 dispatcher support boundary is enabled. |
+| Resident supervisor/process | Implemented foundation | The ACP supervisor hosts multiple private RuntimeSessions with bounded prompt concurrency and cleanup rules. |
+| Substrate provider | Deferred | Must host one RuntimeSession per Actor behind the same v2 lifecycle and pass the same conformance, crash, credential, and publication gates. |
 | Snapshot-aware fork | Deferred | Logical fork remains available; physical clone/snapshot capability contract follows provider support. |
 
-No missing required contract blocks Wave 1 conformance/client/fake-harness work. Wave 2+ implementation should start by wiring a non-Substrate provider to the frozen DTOs and conformance suite.
+The v2 contract and Kubernetes RuntimePool foundation have replaced the earlier turn-oriented frontier. The remaining release gate is the required live acceptance matrix: digest verification, Codex then Claude execution, continuation, active-prompt cancellation/timeout, restart and replacement recovery, clean-room publication/PR reconciliation, drain/scale-to-zero, and cleanup.
 
 Focused verification for the readiness layer:
 
 ```bash
-go test ./internal/harness/... -run 'DTO|Protocol|RuntimeSession|MapFrame|FakeHarness|Conformance' -v
+go test ./internal/harness/v2/... ./internal/acp/... -run 'Protocol|RuntimeSession|Conformance|Fence|Duplicate|Cancel' -v
 go test ./internal/api -run 'Task.*Trace|Session.*Event|Fork|Approval|Event' -v
 go test ./internal/store/sqlite -run ExecutionEvent -v
 ```
diff --git a/docs/development/repository-security-scanning-implementation-plan.md b/docs/development/repository-security-scanning-implementation-plan.md
index 1dae86c89..54bd516a8 100644
--- a/docs/development/repository-security-scanning-implementation-plan.md
+++ b/docs/development/repository-security-scanning-implementation-plan.md
@@ -10,7 +10,7 @@ This plan keeps Orka's existing architecture:
 - Scan, validation, and patch work continue to run as Kubernetes-backed `Task` resources.
 - Dynamic security data remains in SQLite.
 - Detailed outputs continue to flow through task artifacts.
-- Credentials, transaction metadata, and authorization remain governed by existing Orka worker, Secret, RBAC, OIDC, and context-token controls.
+- Credentials, transaction metadata, and authorization remain governed by Orka Secret roles, ACP operation fences, RBAC, OIDC, and context-token controls.
 
 ## Target Outcomes
 
@@ -39,7 +39,7 @@ Orka already has:
 - SQLite-backed scan runs, threat models, findings, and patch proposals.
 - Artifact contracts for threat models, findings, validation output, and patch diffs.
 - Human-in-the-loop patch generation and PR creation.
-- Worker isolation through non-root pods, read-only root filesystem, dropped capabilities, seccomp, optional runtime class, and writable `/tmp`, `/home/worker`, and `/workspace`.
+- Native mapper/container isolation plus ACP RuntimePools with private RuntimeSessions, digest-pinned profiles, no Git credentials, and separate clean-room publication.
 
 Key gaps to close:
 
diff --git a/docs/harness-v1-v2-coexistence-plan.md b/docs/harness-v1-v2-coexistence-plan.md
new file mode 100644
index 000000000..cbd07f780
--- /dev/null
+++ b/docs/harness-v1-v2-coexistence-plan.md
@@ -0,0 +1,469 @@
+# Orka Harness v1/v2 Isolated Coexistence Plan
+
+**Status:** Accepted — Revision 8
+**Prepared:** August 7, 2026
+**Supersedes:** Revision 7
+
+## 1. Decision
+
+Harness v1 and harness v2 may run on the same Kubernetes cluster only as two
+independent Orka installations with disjoint namespace ownership. Each
+controller starts in exactly one static mode:
+
+- `harness-v1` serves the legacy turn-oriented wrapper contract;
+- `harness-v2` serves the ACP RuntimePool and RuntimeSession contract.
+
+There is no `dual`, `auto`, or `harness-v1-drain` mode. A running installation
+does not switch modes. Tasks, Agents, AgentRuntimes, and Sessions do not migrate
+between modes, and neither controller falls back to the other protocol.
+
+```text
+one Kubernetes cluster
+
+  v1 release                         v2 release
+  -----------------------------      -----------------------------
+  release/watch namespace:           release/watch namespace:
+    orka-v1-system                      orka-v2-system
+  mode: harness-v1                   mode: harness-v2
+  own Lease/PVC/Secrets/Service      own Lease/PVC/Secrets/Service
+  harness wrapper                    ACP RuntimePools/runtime namespace
+
+                 shared, platform-owned CRD schemas
+```
+
+The shared Kubernetes API server, cluster nodes, and centrally managed CRD
+schemas are infrastructure coupling. They are not execution-plane coupling.
+
+## 2. Why this replaces active coexistence
+
+The previous plan put both protocols behind one controller and one Task
+population. Making that safe required dynamic backend modes, route bindings,
+classification, binding reservations, quarantine, adjudication, global Lease
+fencing, and cross-protocol retirement state.
+
+Namespace isolation removes the ambiguous ownership that those mechanisms
+addressed. Protocol choice is a property of an installation and its namespace,
+not a per-Task routing decision. Consequently, this plan does not introduce:
+
+- `AgentExecutionControl`;
+- `AgentExecutionPolicy`;
+- `AgentExecutionAdjudication`;
+- dynamic `enabled`, `closing`, `drain-only`, or `disabled` backend modes;
+- cross-protocol Task binding, classification, quarantine, or adjudication;
+- transcript-bootstrap migration or cross-protocol Session lineage.
+
+Harness-specific safety remains within each path. In particular, ACP v2 keeps
+its RuntimeSession fencing, prompt-attempt, publication, external-effect, and
+`OutcomeUnknown` rules. Harness v1 must not replay an ambiguously accepted
+turn.
+
+## 3. Required invariants
+
+### 3.1 Static controller identity
+
+Every controller process requires:
+
+```text
+--controller-mode=harness-v1|harness-v2
+--watch-namespace=<one non-empty namespace>
+--leader-elect=true
+```
+
+`ORKA_CONTROLLER_MODE` is the environment equivalent of
+`--controller-mode`. Invalid or omitted modes fail startup. Cluster-wide watch
+scope fails startup.
+
+The watched namespace must carry the matching administrative claim:
+
+```yaml
+metadata:
+  labels:
+    orka.ai/controller-mode: harness-v1 # or harness-v2
+```
+
+A missing or mismatched label fails startup. The label is an installation
+identity, not a runtime switch. Changing it in place is unsupported; create a
+new namespace and installation instead.
+
+Namespace bootstrap is fail-closed and write-once with respect to that claim:
+
+- if the namespace is absent, create it with `orka.ai/controller-mode` in the
+  same Kubernetes API write, before creating Secrets or workloads;
+- if it already exists, proceed only when its exact name and mode claim match;
+  same-mode reuse preserves the claim and any unrelated labels;
+- never adopt or relabel an existing unlabeled or opposite-mode namespace;
+- if another installer wins the create race, reread the namespace and proceed
+  only when the resulting identity is an exact same-mode match.
+
+Canonical script-based installs enforce this contract through
+`scripts/lib/ensure-static-mode-namespace.sh`. Additional namespace metadata
+may converge only after an atomic test confirms that the mode claim is still
+unchanged.
+
+The ordinary leader-election ID may be the same in both installations because
+each Lease lives in its controller's distinct watched namespace. There is no
+cluster-global harness ownership Lease and no legacy-Lease acquisition bridge.
+
+### 3.2 Disjoint ownership
+
+The two releases must have:
+
+- different Helm release names;
+- different controller release namespaces;
+- different, non-empty watched namespaces;
+- different controller Services and API endpoints;
+- different ServiceAccounts, Secrets, RBAC bindings, and leader-election
+  Leases;
+- different SQLite databases and PVCs;
+- different worker and harness data-plane resources;
+- for v2, a runtime namespace not used by another Orka installation;
+- NetworkPolicies that do not admit traffic from the other execution plane.
+
+The packaged Helm and Kustomize installations use the controller release
+namespace as the watched namespace. This keeps the controller, workload
+objects, namespaced RBAC, Lease, and data plane inside one ownership boundary.
+The v2 runtime namespace remains separate. Custom packaging must preserve the
+same isolation if it separates the controller and watched namespaces.
+
+Neither controller may list, watch, mutate, finalize, or clean up namespaced
+objects in the other controller's watch namespace. RBAC is the enforcement
+boundary; cache configuration alone is insufficient.
+
+Cluster-scoped CRDs and admission resources have one designated platform
+owner. Cluster-scoped reconcilers, including gateway and workspace-provider
+infrastructure, are owned by the `harness-v2` installation and are not started
+by `harness-v1`. Common admission protections are installed once. No two Helm
+releases independently own the same cluster-scoped admission object.
+
+### 3.3 One protocol per installation
+
+In `harness-v1` mode:
+
+- agent Tasks may use only the v1 contract;
+- the legacy dispatcher and wrapper client are enabled;
+- ACP RuntimePool dispatch, runtime reconciliation, and ACP cleanup are not
+  execution alternatives;
+- cluster-scoped gateway/workspace controllers are disabled.
+
+In `harness-v2` mode:
+
+- agent Tasks may use only the v2 contract;
+- the ACP dispatcher and RuntimePool/RuntimeSession controllers are enabled;
+- the v1 dispatcher and wrapper path are not started;
+- missing ACP capacity or configuration fails closed without v1 fallback.
+
+Native AI and container Task paths remain governed by their existing
+namespace-scoped contracts. They do not authorize cross-namespace access.
+
+An Agent or AgentRuntime contract selector, where retained to discriminate the
+shared CRD schema, must match the controller mode. It does not override the
+mode or select a second dispatcher. `runtime.type: opencode` is never protocol
+evidence.
+
+### 3.4 No migration or shared continuation
+
+The following operations are unsupported:
+
+- changing an installation from `harness-v1` to `harness-v2` in place, or the
+  reverse;
+- reusing a controller database, PVC, runtime store, or wrapper ledger under
+  the other mode;
+- changing a Task, Agent, or AgentRuntime protocol to make existing work run
+  through the other installation;
+- continuing a v1 Session in v2 or a v2 Session in v1;
+- importing a transcript as continuation of the original Session lineage;
+- allowing one controller to cancel, finalize, publish, or clean up work owned
+  by the other.
+
+An operator may create a new object in the other installation, but it is new
+work with a new namespace, UID, Session lineage, attempt identity, and external
+effect history. Copying prompts or non-secret configuration does not preserve
+execution identity.
+
+The static `harness-v2` release also does not adopt a pre-static, implicit-v2
+controller installation in place. Those installations can have accepted ACP
+attempts without the immutable execution authority required by this design.
+Settle or retire that installation, preserve its state under its existing
+owner, and install static `harness-v2` as a new release and namespace.
+
+### 3.5 Harness v1 recovery boundaries
+
+The v1 compatibility installation keeps request execution authority separate
+from terminal-settlement authority:
+
+- submitting, replaying, or recovering terminal output requires the frozen
+  provider `CredentialRefs` used by the original request;
+- acknowledging an already durable settlement reconstructs only the frozen
+  wrapper endpoint/authentication client and the stored turn, request-digest,
+  and terminal-receipt fences; it does not reread provider credentials;
+- wrapper authentication rotation still fails closed against the frozen
+  Secret UID, resourceVersion, and key.
+
+Frame polling is bounded by the immutable request deadline. Persisted or
+wrapper-ledger terminal evidence always wins first. Once the deadline passes,
+the controller durably enters `CancelRequested`, retries `CancelTurn`, and
+drains brokered tool-call reservations without starting new effects. If no
+authoritative terminal evidence appears within the bounded cancellation
+settlement window, the attempt becomes `OutcomeUnknown`; it is never replayed.
+
+Deterministic frame identity, sequence, approval, continuation, frozen-tool,
+and input-authority violations become `ProtocolViolation`/`OutcomeUnknown`.
+Transport, event-journal, Kubernetes-read, and external-effect-store errors
+remain retryable because they do not prove a permanent protocol violation.
+
+The built-in wrapper advertises and enforces `MaxConcurrentTurns=1`. Controller
+startup and Helm validation therefore require exactly one harness v1 dispatcher
+worker; parallel dispatch is rejected as an unsupported configuration.
+
+## 4. Shared API and CRD contract
+
+CRDs are cluster-scoped even when their custom resources are namespaced. One
+platform owner therefore installs and upgrades a schema bundle that can store
+both the supported v1 and v2 object shapes without pruning either.
+
+Requirements:
+
+- keep one Kubernetes API version unless an independently justified API
+  migration introduces conversion;
+- preserve all v1 and v2 fields needed during the compatibility window;
+- use structural schema and contract-specific validation where the two shapes
+  differ;
+- do not default an omitted protocol based on runtime type or observed state;
+- verify stored v1 and v2 fixtures round-trip through spec and status updates;
+- apply CRD upgrades once, before either release that requires them;
+- install every additional Orka release with `--skip-crds` or the equivalent
+  GitOps ownership rule.
+
+The shared schema is not permission for mixed execution. Controller mode,
+namespace claim, and RBAC determine which installation may act on an object.
+
+The three `AgentExecution*` CRDs from the superseded design are not part of
+this architecture. Test clusters that already installed unreleased versions of
+those CRDs must remove their instances before deleting the definitions; CRD
+deletion is cluster-wide and destructive to instances of that kind.
+
+## 5. Deployment topology
+
+### 5.1 Platform-owned wave
+
+Before installing either controller:
+
+1. back up existing CRDs and custom resources;
+2. apply the reviewed v1/v2-compatible CRD bundle through the designated
+   platform owner;
+3. wait for every CRD to become `Established`;
+4. verify maximum-shape v1 and v2 fixtures and status updates on a real
+   supported Kubernetes version;
+5. install shared admission resources once, after their serving endpoints are
+   ready.
+
+Helm does not update files from `crds/` during `helm upgrade`. Every upgrade
+that changes schemas requires the explicit CRD-first wave.
+
+### 5.2 Harness v1 release
+
+The v1 release is an isolated compatibility installation. It requires:
+
+- `controller.mode: harness-v1` (rendering
+  `--controller-mode=harness-v1`);
+- a dedicated, labeled, non-empty watch namespace;
+- the reviewed digest-pinned wrapper image and its private Service;
+- separate wrapper bearer-auth and rotatable TLS Secrets, plus a dedicated
+  durable ledger;
+- its own controller store, backups, ServiceAccount, and API endpoint;
+- no ACP RuntimePool data plane.
+
+Wrapper upgrades still require a successful wrapper drain before changing its
+Pod template. That drain protects v1 turn state; it is not a third controller
+mode and does not open migration to v2.
+
+The bearer Secret is immutable while v1 work exists because bindings freeze
+its UID and resourceVersion. Certificate renewal changes only the separate TLS
+Secret and follows the same drained Pod-template rollover; it must never mutate
+the bearer authority as a side effect.
+
+### 5.3 Harness v2 release
+
+The v2 release is a fresh installation. It requires:
+
+- `controller.mode: harness-v2` (rendering
+  `--controller-mode=harness-v2`);
+- a dedicated, labeled, non-empty watch namespace;
+- its own controller and runtime namespaces;
+- digest-pinned ACP runtime images;
+- the authenticated provider proxy, SCM proxy, and clean-room Publisher where
+  the selected workflow requires them;
+- its own controller store, backups, ServiceAccount, and API endpoint;
+- no harness v1 wrapper data plane.
+
+New producers select the v2 endpoint and namespace explicitly. Existing v1
+objects are not copied or adopted.
+
+An older controller that implicitly enabled ACP but did not declare
+`--controller-mode=harness-v2` is not an upgrade source. Helm and the canonical
+direct-Kustomize deployment preflight reject that in-place transition before
+mutating workloads. Once a release already declares the exact static mode and
+watch namespace, ordinary same-mode upgrades remain supported.
+
+### 5.4 Cross-plane references
+
+User-authored Task, Agent, AgentRuntime, Provider, Session, Tool, Skill, and
+credential references stay within the installation's owned namespace unless a
+separate API contract explicitly defines a platform-owned reference. A
+reference into the other execution plane is rejected, not proxied.
+
+V2 controller-owned RuntimePool resources may live in its configured runtime
+namespace. That is an internal v2 relationship and does not give v1 any access
+to the runtime namespace.
+
+## 6. Rollout
+
+1. Inventory the current v1 installation, including active wrapper turns,
+   Tasks, Sessions, producers, stores, Secrets, and backups.
+2. Atomically establish a dedicated v1 watch namespace with the `harness-v1`
+   claim; reject any preexisting namespace without that exact identity.
+3. Upgrade the v1 installation to the static-mode compatibility release
+   without changing its protocol or object identities. Follow the v1 wrapper
+   drain procedure for any wrapper Pod-template change.
+4. Apply the shared CRD bundle through the single platform owner.
+5. Atomically create a distinct v2 watch namespace with the `harness-v2` claim
+   and create a distinct v2 runtime namespace; never adopt or relabel an
+   existing unlabeled or opposite-mode watch namespace.
+6. Install the v2 release with a unique name, endpoint, RBAC, storage, and
+   `harness-v2` mode.
+7. Prove with RBAC and runtime tests that neither controller can observe or
+   mutate the other's namespace.
+8. Run v2 canaries as newly created v2 Agents, Tasks, and Sessions.
+9. Route new producers to the v2 endpoint. Leave existing v1 work on v1.
+
+At no point does rollout patch v1 objects into v2 objects or run both modes in
+one controller.
+
+## 7. V1 drain and retirement
+
+There is no dynamic drain mode. Draining is an operational procedure:
+
+1. stop v1 API ingress and every internal and external v1 Task producer;
+2. revoke or suspend permissions that can create new v1 agent Tasks;
+3. record a cutoff time and inventory all active, queued, finalizing, and
+   cleanup-relevant v1 work;
+4. allow proven v1 work to finish on the v1 installation;
+5. cancel work only through v1 and preserve `OutcomeUnknown` where acceptance
+   cannot be disproved;
+6. repeat uncached inventory until no active turn, Task, Session settlement,
+   finalizer, or wrapper-ledger cleanup remains;
+7. back up retained v1 history and stores;
+8. uninstall v1 workloads and revoke v1 credentials;
+9. remove v1 PVCs or historical fields only under a separate reviewed
+   retention and data-destruction decision.
+
+The v2 release continues independently throughout v1 retirement.
+
+## 8. Rollback and recovery
+
+Rollback changes where future work is submitted; it does not move existing
+work.
+
+If a v2 rollout must stop:
+
+- stop new submissions to the v2 endpoint;
+- let accepted v2 work settle, cancel it through v2, or retain its existing
+  unknown-outcome classification;
+- submit any replacement work as new v1 work only if the v1 installation is
+  still intentionally open;
+- retain the shared superset CRDs while either object shape exists.
+
+Each installation has its own coordinated recovery point. A recovery must pair
+that installation's Kubernetes identities with its controller database, PVCs,
+ledgers, artifacts, and Secrets. Never restore a v1 data set into v2 or a v2
+data set into v1. Plain YAML export does not preserve UIDs and is not sufficient
+to resume UID-bound execution.
+
+## 9. Verification and release gates
+
+### 9.1 Configuration
+
+- missing, empty, `dual`, `auto`, `harness-v1-drain`, and unknown modes fail;
+- an empty watch namespace fails;
+- a missing or mismatched namespace mode label fails;
+- fresh bootstrap creates the namespace and mode claim in one write before any
+  Secret or workload write;
+- exact same-mode namespace reuse is idempotent and does not rewrite the mode
+  claim;
+- unlabeled and opposite-mode namespaces are rejected without mutation;
+- a namespace create race succeeds only after rereading an exact same-mode
+  identity;
+- leader election is required and its Lease is in the watched namespace;
+- mode-incompatible wrapper or ACP configuration fails rendering or startup;
+- implicit or legacy v2 controllers are rejected as in-place static-v2 upgrade
+  sources;
+- changing the namespace claim does not cause a running installation to adopt
+  opposite-mode work.
+
+### 9.2 Isolation
+
+- v1 and v2 releases use different namespaces, SAs, Leases, PVCs, Services,
+  Secrets, and endpoints;
+- each controller receives `Forbidden` when attempting reads or writes in the
+  other watch namespace;
+- v1 does not start ACP or cluster-scoped gateway/workspace reconcilers;
+- v2 does not start the v1 dispatcher;
+- each controller restart, upgrade, and uninstall leaves the other healthy;
+- no cluster-scoped admission resource is multiply owned.
+
+### 9.3 API compatibility
+
+- stored v1 and v2 Agent, AgentRuntime, Task, and Session fixtures survive the
+  shared CRD apply and status update;
+- contract-specific invalid combinations are rejected;
+- a contract that conflicts with controller mode fails closed;
+- no `AgentExecutionControl`, `AgentExecutionPolicy`, or
+  `AgentExecutionAdjudication` CRD is installed;
+- deleting one Helm release does not delete shared CRDs or the other release's
+  objects.
+
+### 9.4 Runtime behavior
+
+- a v1 Task executes only through the wrapper;
+- a v2 Task executes only through ACP RuntimePools;
+- unavailable v2 capacity never falls back to v1;
+- the shipped v1 controller and wrapper both enforce a single concurrent turn;
+- a same-name object in the other namespace is unrelated and cannot continue
+  the original Task or Session;
+- cross-plane cancellation, cleanup, publication, and Session continuation are
+  rejected;
+- v1 wrapper and v2 controller restart tests preserve their own protocol's
+  duplicate and unknown-outcome invariants.
+- v1 settlement acknowledgement survives provider-credential removal while
+  wrapper-auth rotation remains fail-closed;
+- v1 request deadlines durably request cancellation, stop new brokered effects,
+  and reach `OutcomeUnknown` only after the bounded settlement window;
+- deterministic v1 frame-authority violations terminalize as protocol
+  violations while transport and durable-store failures remain retryable.
+
+### 9.5 Retirement
+
+- v1 producers and create permissions are closed before the drain inventory;
+- repeated inventory proves zero active and cleanup-relevant v1 state;
+- removing v1 workloads and credentials does not change v2 readiness or work;
+- retained historical v1 objects remain readable under the shared schema.
+
+## 10. Definition of done
+
+This replacement plan is complete when:
+
+1. the controller accepts exactly the two static modes, requires a matching
+   non-empty namespace claim, and deployment paths establish that claim
+   atomically without adopting or relabeling an existing namespace;
+2. v1 and v2 run in disjoint namespaces with enforced RBAC, storage, Lease,
+   Service, Secret, and network boundaries;
+3. mode-specific controller registration makes cross-dispatch impossible;
+4. the shared CRD bundle round-trips supported v1 and v2 shapes without the
+   three `AgentExecution*` CRDs;
+5. Helm and Kustomize deployment paths document one CRD owner and distinct
+   release/watch/runtime namespaces;
+6. no supported workflow migrates or continues a Task, AgentRuntime, or
+   Session across protocols;
+7. the two-release, rollback, and v1-retirement verification gates pass on a
+   real cluster;
+8. ADR 0018 and operator documentation describe the shipped behavior.
diff --git a/docs/pr-monitor-clawsweeper-parity-plan.md b/docs/pr-monitor-clawsweeper-parity-plan.md
index 471b4d89d..860215e3c 100644
--- a/docs/pr-monitor-clawsweeper-parity-plan.md
+++ b/docs/pr-monitor-clawsweeper-parity-plan.md
@@ -1,5 +1,10 @@
 # PR Monitor to ClawSweeper Parity Plan
 
+> Historical scope note: this plan describes repository-monitor application
+> state. Its SQLite source-of-truth statements do not apply to ACP runtime
+> control records. The ACP hard cutover makes control CRD status and Kubernetes
+> Leases authoritative while retaining monitor history in SQLite.
+
 This document describes how to evolve Orka's current PR monitor into an
 Orka-native maintainer automation system with capabilities comparable to
 ClawSweeper.
@@ -618,8 +623,9 @@ Input:
 - branch write mode
 - constraints on files, tools, and allowed mutation
 
-The repair task may use an agent runtime workspace. It should not directly
-merge or close a PR.
+The repair Task may use top-level `spec.workspace` with `intent: write`, separate
+read/publication credentials, and an Orka-owned publication branch. The ACP child
+must not push, merge, or close a PR directly.
 
 ### Repair Task Output
 
diff --git a/examples/bring-your-own-agent-runtime-demo/README.md b/examples/bring-your-own-agent-runtime-demo/README.md
deleted file mode 100644
index c8cc52b75..000000000
--- a/examples/bring-your-own-agent-runtime-demo/README.md
+++ /dev/null
@@ -1,105 +0,0 @@
-# Bring-your-own AgentRuntime demo
-
-This package is the canonical entry point for the provider-neutral remote-runtime demo. It points at the runnable manifests used by the current repo-owned implementation and keeps the story independent of any one backend.
-
-```text
-Orka API + governance plane
-  -> namespace-local AgentRuntime facade
-    -> remote execution backend adapter/runtime
-      -> Orka-brokered Tool CRDs
-```
-
-## What is runnable from this repository
-
-| Scenario | Path | Credentials | Brokered tools |
-| --- | --- | --- | --- |
-| Fibey observed + backend switch facades | `../fibey-custom-agent-demo` | Harness bearer token only for generic HTTP; adapter credentials for optional backends | Optional; default observed |
-| Support escalation brokered read | `../support-escalation-runtime-demo` | Harness bearer token only | `support-ticket-lookup` read tool |
-
-AgentKit Serve adapter changes are intentionally not in this repository. The Foundry facade targets the separately maintained Microsoft Foundry Hosted Agents Responses adapter [`orka-agents/agent-runtime-foundry`](https://github.com/orka-agents/agent-runtime-foundry); Foundry and AgentKit samples remain namespace-local facades that point at operator-provided adapter Services.
-
-## Run the generic HTTP demo
-
-Build and load the reference generic HTTP harness fixture:
-
-```bash
-docker build -t ghcr.io/orka-agents/orka/example-echo-harness:latest -f examples/harness/echo/Dockerfile .
-kind load docker-image ghcr.io/orka-agents/orka/example-echo-harness:latest --name <kind-cluster>
-```
-
-Create the runtime bearer Secret out of band; do not commit real values. The Secret must contain a data key named `token`, must be labeled `orka.ai/agent-runtime-auth=true`, and must be annotated with the exact runtime endpoint:
-
-```yaml
-apiVersion: v1
-kind: Secret
-metadata:
-  name: support-http-runtime-token
-  labels:
-    orka.ai/agent-runtime-auth: "true"
-    orka.ai/agent-runtime-name: support-http-runtime
-  annotations:
-    orka.ai/agent-runtime-endpoint: http://support-http-runtime.default.svc.cluster.local:8080
-stringData:
-  token: <generated-placeholder>
-```
-
-Apply and run:
-
-```bash
-kubectl apply -k examples/support-escalation-runtime-demo
-kubectl wait --for=condition=Ready agentruntime/support-http-runtime --timeout=60s
-kubectl get task support-escalation-demo -o yaml
-```
-
-Expected flow:
-
-1. `AgentRuntime/support-http-runtime` probes `/v1/health`, `/v1/capabilities`, observed turn conformance, and the advertised brokered read profile.
-2. `Task/support-escalation-demo` starts a remote turn through the namespace-local facade.
-3. The runtime emits `ToolCallRequested` for `support-ticket-lookup`.
-4. Orka validates `Task.spec.agentRuntime.allowedTools`, loads the same-namespace `Tool`, resolves any downstream credentials inside Orka, executes it, records brokered events, and returns a `ToolCallResult` via `/v1/turns/{turnID}/continue`.
-5. The runtime completes and Orka stores the result.
-
-## Approval-gated write variant
-
-To exercise a write tool, add a `Tool` with `spec.brokeredToolClass: write`, include it in `Task.spec.agentRuntime.allowedTools`, and run the generic fixture with:
-
-```yaml
-env:
-- name: ORKA_REMOTE_HTTP_RUNTIME_BEHAVIOR
-  value: approval-tool
-- name: ORKA_REMOTE_HTTP_RUNTIME_WRITE_TOOL_NAME
-  value: <write-tool-name>
-```
-
-The expected UX is unchanged across backends:
-
-```bash
-orka task approvals <task>
-orka task approve <task> <approval-id>
-orka task result <task>
-```
-
-Orka, not the remote runtime, creates the canonical `ApprovalRequested` event and executes the approved tool exactly once unless a prior execution ledger entry has an unknown outcome, in which case it fails closed instead of replaying a consequential side effect.
-
-## Backend switching
-
-Use `../fibey-custom-agent-demo/switch-backend.sh` to patch only `Task.spec.agentRef.name` between namespace-local facades:
-
-```bash
-examples/fibey-custom-agent-demo/switch-backend.sh http
-examples/fibey-custom-agent-demo/switch-backend.sh foundry
-```
-
-The workflow, Tool CRDs, approval UX, and task/result APIs remain Orka-owned. Remote backends receive safe tool schemas and scoped turn metadata only; they do not receive downstream Tool credentials.
-
-## Troubleshooting
-
-| Symptom | Likely cause | Fix |
-| --- | --- | --- |
-| `AgentRuntime` Ready=False mentioning `orka.ai/agent-runtime-auth` | bearer Secret missing opt-in label | add `orka.ai/agent-runtime-auth: "true"` |
-| Ready=False endpoint binding error | Secret annotation does not match `spec.deployment.endpoint` | update `orka.ai/agent-runtime-endpoint` |
-| Ready=False brokered class missing | runtime did not advertise a required `brokeredToolClasses` value | fix adapter capabilities or narrow `spec.capabilities` |
-| Task fails `tool not allowed` | remote requested a tool not in `Task.spec.agentRuntime.allowedTools` | add the intended tool or reject the backend behavior |
-| Task waits for approval | write tool requested and no human decision exists | use `orka task approvals` then approve/decline |
-| Outcome unknown for write tool | controller saw a pre-execution ledger entry without terminal result | inspect downstream idempotency target; do not blindly replay |
-| Result data truncated in parent summary | structured data exceeded `wait_for_tasks` bounds | store large payloads as artifacts and pass references |
diff --git a/examples/bring-your-own-agent-runtime-demo/SECURITY.md b/examples/bring-your-own-agent-runtime-demo/SECURITY.md
deleted file mode 100644
index e0dd52830..000000000
--- a/examples/bring-your-own-agent-runtime-demo/SECURITY.md
+++ /dev/null
@@ -1,29 +0,0 @@
-# Security model for bring-your-own AgentRuntime demos
-
-Remote execution backends are workload substrates, not governance authorities.
-
-> Remote agents may ask; Orka decides and executes.
-
-## Invariants
-
-- `AgentRuntime.spec.deployment.endpoint` must not contain credentials.
-- Runtime bearer tokens live in Kubernetes Secrets and must opt in with `orka.ai/agent-runtime-auth=true`.
-- Runtime auth Secrets are bound to the expected `AgentRuntime` name and endpoint.
-- Remote runtimes receive safe tool schemas only: name, description, brokered class, and JSON parameters.
-- Remote runtimes never receive Tool CRD execution URLs, auth Secret refs, headers, bearer tokens, kubeconfigs, or approval bypass credentials.
-- Orka validates allowed tools/classes before every brokered call.
-- Orka creates canonical approval events for write tools and verifies exact argument/spec digests before execution.
-- Brokered write execution records a pre-execution ledger entry; unresolved prior executions fail closed instead of duplicating consequential side effects.
-
-## Demo-only controls
-
-The checked-in generic HTTP fixture uses bearer-token authentication and allows `http://` cluster-local service URLs for kind/local demos. Production adapters should run behind TLS or private networking and may add mTLS or signed short-lived turn credentials.
-
-## Do not commit
-
-- runtime bearer token values;
-- Foundry credentials;
-- AgentKit credentials;
-- downstream tool API keys;
-- raw transcripts or auth headers;
-- kubeconfigs or service-account tokens.
diff --git a/examples/fibey-custom-agent-demo/README.md b/examples/fibey-custom-agent-demo/README.md
deleted file mode 100644
index 1e2b41a94..000000000
--- a/examples/fibey-custom-agent-demo/README.md
+++ /dev/null
@@ -1,133 +0,0 @@
-# Fibey bring-your-own agent runtime demo
-
-This demo exercises the first bring-your-own agent runtime slice: Orka registers a namespace-local `AgentRuntime` facade for a remote execution backend, then an `Agent` routes `type: agent` work to it with `spec.runtime.runtimeRef`.
-
-The checked-in backend is a deterministic generic HTTP harness fixture. It advertises `runtimeName: fibey-http-runtime`, supports `orka.harness.v1`, and runs in `observed` tool mode by default. AgentKit Serve and Foundry should plug in by swapping only the backend Service/adapter endpoint and `AgentRuntime` facade, not the Orka workflow.
-
-## Backend facades
-
-| Facade | Backend | Credentials |
-| --- | --- | --- |
-| `fibey-http-runtime` | Generic mock/self-hosted HTTP runtime | Harness bearer token only |
-| `fibey-agentkit-runtime` | AgentKit Serve adapter | Adapter/runtime config only |
-| `fibey-foundry-runtime` | [`orka-agents/agent-runtime-foundry`](https://github.com/orka-agents/agent-runtime-foundry) | Harness bearer Secret plus adapter Azure identity; no Orka Tool production credentials |
-
-`fibey-agentkit-runtime` is intentionally observed-only in the checked-in demo: it should show `toolExecutionModes: [observed]`, `supportsCancel: true`, and `supportsRuntimeSessions: true`, with no `brokeredToolClasses` or `supportsContinuation`. AgentKit brokered read/write/coordination exist only for deployments that explicitly enable those conformance-gated profiles.
-
-`fibey-foundry-runtime` is also observed-only by default. It targets a deployed Microsoft Foundry Hosted Agent through the dedicated Responses endpoint derived from `ORKA_FOUNDRY_PROJECT_ENDPOINT` and `ORKA_FOUNDRY_AGENT_NAME`. The adapter uses `DefaultAzureCredential`; Foundry access tokens and downstream Orka Tool credentials are never stored in the `AgentRuntime`. Brokered read/write are opt-in through `ORKA_FOUNDRY_BROKERED_TOOL_CLASSES` and must match the facade's advertised capabilities.
-
-All facades are namespace-local `AgentRuntime` objects. Remote execution backends do **not** receive production Orka Tool credentials. In brokered mode, remote backends request tools and Orka owns authorization, approvals, idempotency, credential resolution, execution/brokering, events, lineage, and audit.
-
-## Build/load the generic HTTP fixture image for kind
-
-```bash
-docker build -t ghcr.io/orka-agents/orka/example-echo-harness:latest -f examples/harness/echo/Dockerfile .
-kind load docker-image ghcr.io/orka-agents/orka/example-echo-harness:latest --name <your-kind-cluster>
-```
-
-The fixture can run scripted behaviors through `ORKA_REMOTE_HTTP_RUNTIME_BEHAVIOR`:
-
-- `success` — return a final result;
-- `read-tool` — emit a brokered read-only tool request and observed result frame;
-- `approval-tool` — emit an approval-pending frame and resume on `/v1/turns/{turnID}/continue`;
-- `failure` — fail deterministically;
-- `timeout` — emit a retryable timeout failure;
-- `cancellation` — wait until the turn is cancelled.
-
-The default demo uses `success`/observed mode so it can run without external credentials or brokered-tool infrastructure.
-
-## Apply the demo
-
-```bash
-kubectl apply -k examples/fibey-custom-agent-demo
-kubectl wait --for=condition=Ready agentruntime/fibey-http-runtime --timeout=60s
-kubectl get task fibey-quincy-north-alert -o yaml
-```
-
-Expected flow:
-
-1. `AgentRuntime/fibey-http-runtime` reads only a harness token Secret labeled `orka.ai/agent-runtime-auth: "true"`, scoped with `orka.ai/agent-runtime-name`, and endpoint-bound with `orka.ai/agent-runtime-endpoint` before probing `/v1/health` and `/v1/capabilities` and becoming Ready.
-2. `Agent/fibey-remote-http` selects the runtime by `runtimeRef`.
-3. `Task/fibey-quincy-north-alert` starts a harness turn against the generic HTTP runtime endpoint.
-4. The task timeline shows `TurnStarted`, `RuntimeOutput`, and `TurnCompleted` frames mapped into native Orka execution events.
-
-A successful Task should include `status.harnessRuntime.runtimeRefName: fibey-http-runtime`, proving the resolved runtime target was frozen for the accepted turn.
-
-## Swapping backends
-
-To test AgentKit Serve or Foundry, keep the Orka workflow and tool policy the same. Replace only:
-
-- the backend Deployment/Service or external endpoint;
-- the harness bearer-token Secret binding;
-- the namespace-local `AgentRuntime` facade used by `Agent.spec.runtime.runtimeRef`.
-
-Optional facade manifests are checked in but not included in the default `kustomization.yaml` because they require separately deployed adapters:
-
-For a local/kind AgentKit observed-mode demo with no model credentials, build and
-load an AgentKit test-agent image from the AgentKit Serve checkout, then deploy
-the offline echo fixture Service used only for readiness/conformance demos. The
-AgentKitfile used for this image must declare the Orka per-turn env names that the
-controller sends, because AgentKit rejects undeclared `input.env` values. Add
-these entries to the test AgentKitfile before building:
-
-```yaml
-env:
-  - name: ORKA_CONTROLLER_URL
-  - name: ORKA_RESULT_ENDPOINT
-  - name: ORKA_PARENT_TASK
-  - name: ORKA_PRIOR_TASK
-  - name: ORKA_PRIOR_TASK_NAMESPACE
-  - name: ORKA_COORDINATION_DEPTH
-```
-
-Then build/load/apply:
-
-```bash
-# From /path/to/agentkit.serve:
-make build-agentkit build-serve build-test-agent AGENT_IMAGE=hello-agent:test
-kind load docker-image hello-agent:test --name <your-kind-cluster>
-
-# From this Orka checkout:
-kubectl apply -f examples/fibey-custom-agent-demo/secret-agentkit.yaml
-kubectl apply -f examples/fibey-custom-agent-demo/agentkit-runtime-offline.example.yaml
-kubectl apply -f examples/fibey-custom-agent-demo/agentruntime-agentkit.yaml
-kubectl apply -f examples/fibey-custom-agent-demo/agent-agentkit.yaml
-kubectl wait --for=condition=Ready agentruntime/fibey-agentkit-runtime --timeout=60s
-```
-
-The example deployment sets `AGENTKIT_PROTOCOL=orka`, reads
-`AGENTKIT_AUTH_TOKEN` from the Orka client-auth Secret, and sets
-`AGENTKIT_ORKA_OFFLINE_ECHO=1` so the AgentRuntime readiness probe and demo task
-complete without live provider credentials. Remove `AGENTKIT_ORKA_OFFLINE_ECHO`
-and provide normal model/runtime credentials for production AgentKit services.
-
-```bash
-# AgentKit Serve observed-mode facade; requires a Service named fibey-agentkit-runtime.
-kubectl apply -f examples/fibey-custom-agent-demo/secret-agentkit.yaml
-kubectl apply -f examples/fibey-custom-agent-demo/agentruntime-agentkit.yaml
-kubectl apply -f examples/fibey-custom-agent-demo/agent-agentkit.yaml
-kubectl wait --for=condition=Ready agentruntime/fibey-agentkit-runtime --timeout=60s
-
-# Foundry Hosted Agents facade; requires a Service named fibey-foundry-runtime.
-# Build/deploy github.com/orka-agents/agent-runtime-foundry with a Foundry project endpoint,
-# Hosted Agent name, adapter bearer token, and an Azure SDK identity such as Workload Identity.
-# The checked-in facade is observed-only. Enable ORKA_FOUNDRY_BROKERED_TOOL_CLASSES
-# and update the facade only after the Hosted Agent passes matching conformance probes.
-kubectl apply -f examples/fibey-custom-agent-demo/secret-foundry.yaml
-kubectl apply -f examples/fibey-custom-agent-demo/agentruntime-foundry.yaml
-kubectl apply -f examples/fibey-custom-agent-demo/agent-foundry.yaml
-kubectl wait --for=condition=Ready agentruntime/fibey-foundry-runtime --timeout=60s
-```
-
-Run the same task against another backend by changing only `spec.agentRef.name`, for example:
-
-```bash
-examples/fibey-custom-agent-demo/switch-backend.sh agentkit
-examples/fibey-custom-agent-demo/switch-backend.sh foundry
-examples/fibey-custom-agent-demo/switch-backend.sh http
-```
-
-The script validates the selected `AgentRuntime` and `Agent`, then patches only
-the Task's `spec.agentRef.name`.
-
-Brokered mode is used only when the selected runtime advertises brokered capabilities and the task/agent exposes allowed tools. Current AgentKit Serve facades do not advertise brokered mode, so AgentKit-owned tools remain internal to AgentKit and Orka observes only lifecycle/output frames. Orka-owned side-effect tools stay behind Orka brokered governance; production tool credentials are not handed to the remote backend.
diff --git a/examples/fibey-custom-agent-demo/agent-agentkit.yaml b/examples/fibey-custom-agent-demo/agent-agentkit.yaml
deleted file mode 100644
index e15741a76..000000000
--- a/examples/fibey-custom-agent-demo/agent-agentkit.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-# Optional Agent that selects the AgentKit Serve backend facade.
-apiVersion: core.orka.ai/v1alpha1
-kind: Agent
-metadata:
-  name: fibey-remote-agentkit
-spec:
-  runtime:
-    runtimeRef:
-      name: fibey-agentkit-runtime
-  systemPrompt:
-    inline: |
-      You are Fibey's AgentKit-backed incident scout. Produce a concise dossier and request Orka-brokered tools for evidence or consequential actions.
diff --git a/examples/fibey-custom-agent-demo/agent-foundry.yaml b/examples/fibey-custom-agent-demo/agent-foundry.yaml
deleted file mode 100644
index c921ab367..000000000
--- a/examples/fibey-custom-agent-demo/agent-foundry.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-# Optional Agent that selects the Microsoft Foundry Hosted Agents Responses facade.
-apiVersion: core.orka.ai/v1alpha1
-kind: Agent
-metadata:
-  name: fibey-remote-foundry
-spec:
-  runtime:
-    runtimeRef:
-      name: fibey-foundry-runtime
-  systemPrompt:
-    inline: |
-      You are Fibey's Foundry Hosted Agent incident scout. Produce a concise dossier. Request Orka-brokered tools only when the selected runtime advertises them.
diff --git a/examples/fibey-custom-agent-demo/agent.yaml b/examples/fibey-custom-agent-demo/agent.yaml
deleted file mode 100644
index 4ce44ec4f..000000000
--- a/examples/fibey-custom-agent-demo/agent.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: core.orka.ai/v1alpha1
-kind: Agent
-metadata:
-  name: fibey-remote-http
-spec:
-  runtime:
-    runtimeRef:
-      name: fibey-http-runtime
-  systemPrompt:
-    inline: |
-      You are Fibey's custom incident scout. Produce a concise dossier and propose any side-effecting work order instead of executing it directly.
diff --git a/examples/fibey-custom-agent-demo/agentkit-runtime-offline.example.yaml b/examples/fibey-custom-agent-demo/agentkit-runtime-offline.example.yaml
deleted file mode 100644
index 137908ada..000000000
--- a/examples/fibey-custom-agent-demo/agentkit-runtime-offline.example.yaml
+++ /dev/null
@@ -1,50 +0,0 @@
-# Optional local/kind AgentKit Serve deployment for the Fibey AgentKit facade.
-# Build and load an AgentKit test-agent image named hello-agent:test, then apply
-# this manifest with secret-agentkit.yaml, agentruntime-agentkit.yaml, and
-# agent-agentkit.yaml. The offline echo fixture is for conformance/demo only; do
-# not use AGENTKIT_ORKA_OFFLINE_ECHO in production AgentKit deployments.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: fibey-agentkit-runtime
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: fibey-agentkit-runtime
-  template:
-    metadata:
-      labels:
-        app: fibey-agentkit-runtime
-    spec:
-      containers:
-      - name: agentkit
-        image: hello-agent:test
-        imagePullPolicy: IfNotPresent
-        env:
-        - name: AGENTKIT_PROTOCOL
-          value: orka
-        - name: AGENTKIT_BIND
-          value: 0.0.0.0
-        - name: AGENTKIT_ORKA_OFFLINE_ECHO
-          value: "1"
-        - name: AGENTKIT_AUTH_TOKEN
-          valueFrom:
-            secretKeyRef:
-              name: fibey-agentkit-runtime-token
-              key: token
-        ports:
-        - name: http
-          containerPort: 8080
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: fibey-agentkit-runtime
-spec:
-  selector:
-    app: fibey-agentkit-runtime
-  ports:
-  - name: http
-    port: 8080
-    targetPort: http
diff --git a/examples/fibey-custom-agent-demo/agentruntime-agentkit.yaml b/examples/fibey-custom-agent-demo/agentruntime-agentkit.yaml
deleted file mode 100644
index 8178fc79b..000000000
--- a/examples/fibey-custom-agent-demo/agentruntime-agentkit.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# Optional namespace-local facade for an AgentKit Serve adapter implementing orka.harness.v1.
-# Current AgentKit Serve Orka support is observed mode only; brokered tool classes
-# stay unadvertised until AgentKit passes the corresponding conformance profiles.
-# Apply this with secret-agentkit.yaml and point an Agent runtimeRef at fibey-agentkit-runtime
-# after deploying the adapter Service named fibey-agentkit-runtime.
-apiVersion: core.orka.ai/v1alpha1
-kind: AgentRuntime
-metadata:
-  name: fibey-agentkit-runtime
-spec:
-  contractVersion: orka.harness.v1
-  deployment:
-    mode: external-endpoint
-    endpoint: http://fibey-agentkit-runtime.default.svc.cluster.local:8080
-  clientAuth:
-    bearerTokenSecretRef:
-      name: fibey-agentkit-runtime-token
-      key: token
-  capabilities:
-    toolExecutionModes:
-    - observed
-    supportsCancel: true
-    supportsRuntimeSessions: true
diff --git a/examples/fibey-custom-agent-demo/agentruntime-foundry.yaml b/examples/fibey-custom-agent-demo/agentruntime-foundry.yaml
deleted file mode 100644
index 7cc76fe1f..000000000
--- a/examples/fibey-custom-agent-demo/agentruntime-foundry.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Optional namespace-local facade for github.com/orka-agents/agent-runtime-foundry.
-# The checked-in facade matches the Hosted Agents adapter's observed-only default.
-# Apply this with secret-foundry.yaml and point an Agent runtimeRef at fibey-foundry-runtime
-# after deploying the adapter Service named fibey-foundry-runtime.
-apiVersion: core.orka.ai/v1alpha1
-kind: AgentRuntime
-metadata:
-  name: fibey-foundry-runtime
-spec:
-  contractVersion: orka.harness.v1
-  deployment:
-    mode: external-endpoint
-    endpoint: http://fibey-foundry-runtime.default.svc.cluster.local:8080
-  clientAuth:
-    bearerTokenSecretRef:
-      name: fibey-foundry-runtime-token
-      key: token
-  capabilities:
-    toolExecutionModes:
-    - observed
-    supportsCancel: true
-    supportsRuntimeSessions: true
diff --git a/examples/fibey-custom-agent-demo/agentruntime.yaml b/examples/fibey-custom-agent-demo/agentruntime.yaml
deleted file mode 100644
index 1cd83083c..000000000
--- a/examples/fibey-custom-agent-demo/agentruntime.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-apiVersion: core.orka.ai/v1alpha1
-kind: AgentRuntime
-metadata:
-  name: fibey-http-runtime
-spec:
-  contractVersion: orka.harness.v1
-  deployment:
-    mode: external-endpoint
-    endpoint: http://fibey-http-runtime.default.svc.cluster.local:8080
-  clientAuth:
-    bearerTokenSecretRef:
-      name: fibey-http-runtime-token
-      key: token
-  capabilities:
-    toolExecutionModes:
-    - observed
-    supportsCancel: true
-    supportsRuntimeSessions: true
diff --git a/examples/fibey-custom-agent-demo/kustomization.yaml b/examples/fibey-custom-agent-demo/kustomization.yaml
deleted file mode 100644
index 6bae51397..000000000
--- a/examples/fibey-custom-agent-demo/kustomization.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-resources:
-- secret.yaml
-- mock-http-runtime-service.yaml
-- agentruntime.yaml
-- agent.yaml
-- task.yaml
diff --git a/examples/fibey-custom-agent-demo/mock-http-runtime-service.yaml b/examples/fibey-custom-agent-demo/mock-http-runtime-service.yaml
deleted file mode 100644
index a8f166d43..000000000
--- a/examples/fibey-custom-agent-demo/mock-http-runtime-service.yaml
+++ /dev/null
@@ -1,50 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: fibey-http-runtime
-  labels:
-    app.kubernetes.io/name: fibey-http-runtime
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: fibey-http-runtime
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: fibey-http-runtime
-    spec:
-      containers:
-      - name: harness
-        image: ghcr.io/orka-agents/orka/example-echo-harness:latest
-        imagePullPolicy: IfNotPresent
-        env:
-        - name: ORKA_REMOTE_HTTP_RUNTIME_ADDR
-          value: :8080
-        - name: ORKA_REMOTE_HTTP_RUNTIME_NAME
-          value: fibey-http-runtime
-        - name: ORKA_REMOTE_HTTP_RUNTIME_BEARER_TOKEN
-          valueFrom:
-            secretKeyRef:
-              name: fibey-http-runtime-token
-              key: token
-        ports:
-        - name: http
-          containerPort: 8080
-        readinessProbe:
-          httpGet:
-            path: /v1/health
-            port: http
-          periodSeconds: 3
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: fibey-http-runtime
-spec:
-  selector:
-    app.kubernetes.io/name: fibey-http-runtime
-  ports:
-  - name: http
-    port: 8080
-    targetPort: http
diff --git a/examples/fibey-custom-agent-demo/secret-agentkit.yaml b/examples/fibey-custom-agent-demo/secret-agentkit.yaml
deleted file mode 100644
index eb3e38386..000000000
--- a/examples/fibey-custom-agent-demo/secret-agentkit.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# Optional harness bearer token for the AgentKit Serve adapter facade.
-# This authenticates Orka to the adapter endpoint; it is not a downstream production tool credential.
-apiVersion: v1
-kind: Secret
-metadata:
-  name: fibey-agentkit-runtime-token
-  annotations:
-    orka.ai/agent-runtime-endpoint: http://fibey-agentkit-runtime.default.svc.cluster.local:8080
-  labels:
-    orka.ai/agent-runtime-auth: "true"
-    orka.ai/agent-runtime-name: fibey-agentkit-runtime
-stringData:
-  token: mock-token
diff --git a/examples/fibey-custom-agent-demo/secret-foundry.yaml b/examples/fibey-custom-agent-demo/secret-foundry.yaml
deleted file mode 100644
index 1664eb501..000000000
--- a/examples/fibey-custom-agent-demo/secret-foundry.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# Optional harness bearer token for the Foundry adapter facade.
-# This authenticates Orka to the adapter endpoint; Foundry authentication uses the adapter deployment's Azure identity.
-apiVersion: v1
-kind: Secret
-metadata:
-  name: fibey-foundry-runtime-token
-  annotations:
-    orka.ai/agent-runtime-endpoint: http://fibey-foundry-runtime.default.svc.cluster.local:8080
-  labels:
-    orka.ai/agent-runtime-auth: "true"
-    orka.ai/agent-runtime-name: fibey-foundry-runtime
-stringData:
-  token: mock-token
diff --git a/examples/fibey-custom-agent-demo/secret.yaml b/examples/fibey-custom-agent-demo/secret.yaml
deleted file mode 100644
index 4d235db17..000000000
--- a/examples/fibey-custom-agent-demo/secret.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: fibey-http-runtime-token
-  annotations:
-    orka.ai/agent-runtime-endpoint: http://fibey-http-runtime.default.svc.cluster.local:8080
-  labels:
-    orka.ai/agent-runtime-auth: "true"
-    orka.ai/agent-runtime-name: fibey-http-runtime
-stringData:
-  token: mock-token
diff --git a/examples/fibey-custom-agent-demo/switch-backend.sh b/examples/fibey-custom-agent-demo/switch-backend.sh
deleted file mode 100755
index fcfb41345..000000000
--- a/examples/fibey-custom-agent-demo/switch-backend.sh
+++ /dev/null
@@ -1,48 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-usage() {
-  cat >&2 <<'USAGE'
-Usage: switch-backend.sh <http|agentkit|foundry> [task-name] [namespace]
-
-Patches the Fibey demo Task to use the Agent bound to the selected namespace-local
-AgentRuntime facade. The selected AgentRuntime/Agent manifests must already be
-applied. This changes only the Orka Agent reference; workflow input and Tool
-policy remain Orka-owned.
-USAGE
-}
-
-backend="${1:-}"
-task_name="${2:-fibey-quincy-north-alert}"
-namespace="${3:-default}"
-
-case "${backend}" in
-  http)
-    agent="fibey-remote-http"
-    runtime="fibey-http-runtime"
-    ;;
-  agentkit)
-    agent="fibey-remote-agentkit"
-    runtime="fibey-agentkit-runtime"
-    ;;
-  foundry)
-    agent="fibey-remote-foundry"
-    runtime="fibey-foundry-runtime"
-    ;;
-  -h|--help|help|"")
-    usage
-    exit 0
-    ;;
-  *)
-    echo "unknown backend: ${backend}" >&2
-    usage
-    exit 2
-    ;;
-esac
-
-kubectl -n "${namespace}" get agentruntime "${runtime}" >/dev/null
-kubectl -n "${namespace}" get agent "${agent}" >/dev/null
-kubectl -n "${namespace}" patch task "${task_name}" --type merge \
-  -p "{\"spec\":{\"agentRef\":{\"name\":\"${agent}\"}}}"
-
-echo "${task_name} now targets ${agent} (${runtime}) in namespace ${namespace}"
diff --git a/examples/fibey-custom-agent-demo/task.yaml b/examples/fibey-custom-agent-demo/task.yaml
deleted file mode 100644
index 787f755d8..000000000
--- a/examples/fibey-custom-agent-demo/task.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: core.orka.ai/v1alpha1
-kind: Task
-metadata:
-  name: fibey-quincy-north-alert
-spec:
-  type: agent
-  agentRef:
-    name: fibey-remote-http
-  prompt: |
-    Quincy North alert: pump telemetry is anomalous after overnight maintenance.
-    Investigate likely cause, summarize evidence, and propose the safest next action.
diff --git a/examples/github-cicd/README.md b/examples/github-cicd/README.md
index 3118638cc..aeb2ce0c5 100644
--- a/examples/github-cicd/README.md
+++ b/examples/github-cicd/README.md
@@ -1,61 +1,66 @@
 # GitHub CI/CD Integration
 
-This maintained example shows how to use Orka's multi-agent coordination to automate a GitHub PR workflow:
+This example shows how to use Orka's multi-agent coordination with the ACP v2 workspace boundary:
 
-1. An AI coordinator delegates code changes to a Claude Code runtime agent.
-2. The runtime agent pushes a feature branch.
-3. The coordinator opens a PR with Orka's built-in `create_pull_request` tool.
-4. The coordinator waits for CI and merges with `auto_merge_pull_request`.
-5. If CI fails, the coordinator loops back with fix feedback on the same branch.
+1. An AI coordinator delegates a write-intent Task to a Claude ACP runtime.
+2. The runtime edits the verified workspace but never receives Git credentials or publishes directly.
+3. Orka's separate Workspace/Publisher prepares and verifies the branch update.
+4. The coordinator opens a PR with `create_pull_request`, waits for CI, and merges with `auto_merge_pull_request`.
+5. If CI fails, the coordinator delegates a focused repair against the same claimed branch.
 
-## How It Works
+## Credential roles
 
-1. A **coordinator agent** (AI type with coordination enabled) receives a task
-2. It delegates work to a **Claude Code agent** via `delegate_task`, including workspace details for clone, push, and PR creation
-3. It uses built-in GitHub coordination tools to create the PR and auto-merge when checks pass
-4. On CI failure, it can delegate a follow-up fix using `prior_task`
+The example uses three independent credential roles:
+
+- `claude-credentials` — provider/proxy access for the Claude ACP runtime;
+- `repository-read` — clone/read credential used only by the clean-room workspace boundary;
+- `repository-publish` — branch/forge credential used only by the Workspace/Publisher and GitHub coordination tools.
+
+Neither Git Secret is delivered to the ACP process tree.
 
 ## Files
 
 | File | Description |
-|------|-------------|
-| `agents.yaml` | Coordinator and Claude Code agent definitions |
-| `secret.yaml` | Example `git-credentials` Secret for clone/push/PR auth |
-| `task.yaml` | Sample task to trigger the workflow |
-| `github-actions-webhook.yaml` | Optional GitHub Actions workflow that triggers a branch-fix agent task on CI failure |
+| --- | --- |
+| `agents.yaml` | Coordinator and Claude Agent definitions with ACP-safe prompts |
+| `secret.yaml` | Example read and publication credential Secrets |
+| `task.yaml` | Sample coordinator Task |
+| `github-actions-webhook.yaml` | Optional workflow that creates a direct ACP write Task after CI failure |
 
 ## Setup
 
 ```bash
-# Update `spec.providerRef.name` in agents.yaml to match your Provider CRD.
-# Edit secret.yaml and replace the token value.
+# Update spec.providerRef.name in agents.yaml to match your Provider CRD.
+# Replace the placeholder values in secret.yaml before applying it.
 kubectl apply -f examples/github-cicd/secret.yaml
 
-# Create Claude runtime credentials if you do not already have them
+# Create the Claude provider/proxy credential separately.
 kubectl create secret generic claude-credentials \
   --from-literal=ANTHROPIC_API_KEY=sk-ant-your-key
 
-# Deploy the example
 kubectl apply -k examples/github-cicd
-
-# Submit a task
 kubectl apply -f examples/github-cicd/task.yaml
 ```
 
-Before running the task, edit `task.yaml` and replace the placeholder repository details:
+Before running the Task, edit `task.yaml` and replace:
 
-- `gitRepo`
-- `branch`
-- `gitSecretRef`
-- `pushBranch`
+- `gitRepo` and `publicationGitRepo`;
+- `branch` and `pushBranch`;
+- `readCredentialRef` and `publicationCredentialRef`.
 
-## Optional GitHub Actions Integration
+A branch update is successful only when the child Task has a terminal verified `status.delivery` receipt. The ACP child reporting that it changed files is not proof of publication.
 
-The `github-actions-webhook.yaml` file is a workflow you can copy into `.github/workflows/` in a repository. When a CI job fails, it creates a direct `type: agent` task for `claude-coder` to investigate and push a fix to the same branch.
+## Optional GitHub Actions integration
+
+Copy `github-actions-webhook.yaml` into `.github/workflows/` in a repository. On CI failure it creates a direct `type: agent` Task with top-level `workspace.intent: write`. The runtime edits the checkout; the Workspace/Publisher owns the exact-ref push.
 
 Configure these repository secrets:
 
-- `ORKA_API_URL`
-- `ORKA_TOKEN`
+- `ORKA_API_URL`;
+- `ORKA_TOKEN`.
+
+The Orka Task namespace must contain the `repository-read` and `repository-publish` Secrets referenced by the payload.
 
-And make sure the Orka namespace already has a `git-credentials` Secret that matches the name used in the workflow payload.
+:::caution Current write-path limitation
+This worktree still fails non-empty workspace deltas closed until dispatcher-to-publisher delivery is fully wired. Treat this example as the ACP v2 manifest shape, and require a verified delivery receipt in live testing.
+:::
diff --git a/examples/github-cicd/agents.yaml b/examples/github-cicd/agents.yaml
index 1fab09c16..2bca80e46 100644
--- a/examples/github-cicd/agents.yaml
+++ b/examples/github-cicd/agents.yaml
@@ -1,4 +1,5 @@
-# Claude Code agent that writes code and pushes a feature branch.
+# Claude ACP agent. It edits the materialized workspace but never commits,
+# pushes, or creates pull requests; the Workspace/Publisher owns delivery.
 apiVersion: core.orka.ai/v1alpha1
 kind: Agent
 metadata:
@@ -17,20 +18,16 @@ spec:
       - Grep
   systemPrompt:
     inline: |
-      You are a software developer. When given a task:
-      1. Work in the repository and branch provided through workspace config.
-      2. Implement the requested changes cleanly.
-      3. Run relevant tests if they exist.
-      4. Commit with a descriptive message.
-      5. Push to the configured pushBranch.
-      6. Report what changed and any test results.
-
-      Do not create or merge pull requests yourself.
-      The coordinator handles GitHub workflow steps with Orka's built-in tools.
+      You are a software developer. Work only in the workspace supplied by Orka.
+      Implement the requested changes and run focused tests when available.
+      Do not commit, change Git remotes/configuration, push, or create a pull request.
+      Orka validates the final tree and publishes it through a separate clean-room service.
+      Report changed files and test results.
   secretRef:
     name: claude-credentials
 ---
-# Coordinator agent that orchestrates the full CI/CD flow with built-in PR tools.
+# Coordinator agent that delegates implementation and uses Orka's GitHub tools
+# only after the child Task has a verified branch-delivery receipt.
 apiVersion: core.orka.ai/v1alpha1
 kind: Agent
 metadata:
@@ -42,26 +39,25 @@ spec:
     name: claude-sonnet-4-20250514
   systemPrompt:
     inline: |
-      You are a CI/CD coordinator. You manage the full lifecycle of code changes:
+      You are a CI/CD coordinator.
 
-      1. Read the repository details from the task prompt:
-         - gitRepo
-         - branch
-         - gitSecretRef
-         - pushBranch
-      2. Delegate the implementation to the claude-coder agent with that workspace config.
-      3. Wait for the coder to finish.
-      4. Create a pull request with create_pull_request.
-         Remember the PR number after the first PR is opened.
+      1. Read these values from the task prompt:
+         - gitRepo and branch
+         - readCredentialRef
+         - publicationGitRepo and publicationCredentialRef
+         - pushBranch and prBaseBranch
+      2. Delegate implementation to claude-coder with workspace.intent = write and
+         every workspace field above. The coder edits files only; Orka publishes.
+      3. Wait for the child Task. Continue only when its delivery status proves the
+         branch was independently verified.
+      4. Create the pull request with create_pull_request, using the child task name,
+         pushBranch, and prBaseBranch.
       5. Call auto_merge_pull_request to wait for CI and merge automatically.
-      6. If auto_merge_pull_request reports ci_failed or timeout:
-         - Summarize the failure for the coder.
-         - Delegate a fix to claude-coder using prior_task and the same pushBranch.
-         - Wait for the fix to finish.
-         - Reuse the existing PR and call auto_merge_pull_request again.
-      7. Report the final PR URL and merge outcome.
+      6. If CI fails or times out, summarize the failure and delegate a focused repair
+         against the same claimed publication branch, then wait and verify delivery again.
+      7. Report the final PR URL, verified branch SHA, and merge outcome.
 
-      Use Orka's built-in PR tools rather than shelling out to GitHub CLI.
+      Never ask the ACP runtime to commit, push, run gh, or create the PR itself.
   coordination:
     enabled: true
     maxConcurrentChildren: 3
diff --git a/examples/github-cicd/github-actions-webhook.yaml b/examples/github-cicd/github-actions-webhook.yaml
index 7124f222c..090bac798 100644
--- a/examples/github-cicd/github-actions-webhook.yaml
+++ b/examples/github-cicd/github-actions-webhook.yaml
@@ -1,11 +1,12 @@
 # .github/workflows/ci-feedback.yml
-# Copy this to your repository to trigger Orka auto-fix on CI failure
+# Copy this to your repository to trigger an Orka ACP repair Task on CI failure.
 #
-# Required secrets:
-#   ORKA_API_URL: URL of your Orka API (e.g., https://orka.example.com)
-#   ORKA_TOKEN: ServiceAccount token for Orka API auth
-# Cluster prerequisite:
-#   - git-credentials Secret exists in the task namespace and contains a GitHub token
+# Required repository secrets:
+#   ORKA_API_URL: URL of your Orka API (for example, https://orka.example.com)
+#   ORKA_TOKEN: ServiceAccount/OIDC token for Orka API authentication
+# Cluster prerequisites:
+#   - repository-read Secret exists in the Task namespace
+#   - repository-publish Secret exists in the Task namespace
 name: CI Feedback to Orka
 on:
   workflow_run:
@@ -17,32 +18,32 @@ jobs:
     if: ${{ github.event.workflow_run.conclusion == 'failure' }}
     runs-on: ubuntu-latest
     steps:
-      - name: Get failure logs
+      - name: Get failure context
         id: logs
         run: |
-          echo "run_id=${{ github.event.workflow_run.id }}" >> $GITHUB_OUTPUT
-          echo "branch=${{ github.event.workflow_run.head_branch }}" >> $GITHUB_OUTPUT
-          echo "sha=${{ github.event.workflow_run.head_sha }}" >> $GITHUB_OUTPUT
-          echo "repo=${{ github.repository }}" >> $GITHUB_OUTPUT
+          echo "branch=${{ github.event.workflow_run.head_branch }}" >> "$GITHUB_OUTPUT"
+          echo "sha=${{ github.event.workflow_run.head_sha }}" >> "$GITHUB_OUTPUT"
+          echo "repo=${{ github.repository }}" >> "$GITHUB_OUTPUT"
 
-      - name: Trigger Orka fix agent
+      - name: Trigger Orka repair agent
         run: |
-          curl -s -X POST "${{ secrets.ORKA_API_URL }}/api/v1/tasks" \
+          curl -sS -X POST "${{ secrets.ORKA_API_URL }}/api/v1/tasks" \
             -H "Authorization: Bearer ${{ secrets.ORKA_TOKEN }}" \
             -H "Content-Type: application/json" \
             -d '{
               "type": "agent",
               "agentRef": {"name": "claude-coder"},
-              "prompt": "CI failed on branch ${{ steps.logs.outputs.branch }} (commit ${{ steps.logs.outputs.sha }}). Check the CI failures, fix the code, and push to the same branch.",
-              "agentRuntime": {
-                "workspace": {
-                  "gitRepo": "https://github.com/${{ steps.logs.outputs.repo }}.git",
-                  "branch": "${{ steps.logs.outputs.branch }}",
-                  "gitSecretRef": {
-                    "name": "git-credentials"
-                  }
-                }
+              "prompt": "CI failed on branch ${{ steps.logs.outputs.branch }} at ${{ steps.logs.outputs.sha }}. Fix only the CI failure. Do not commit or push; Orka owns publication.",
+              "workspace": {
+                "intent": "write",
+                "gitRepo": "https://github.com/${{ steps.logs.outputs.repo }}.git",
+                "branch": "${{ steps.logs.outputs.branch }}",
+                "readCredentialRef": {"name": "repository-read"},
+                "publicationGitRepo": "https://github.com/${{ steps.logs.outputs.repo }}.git",
+                "publicationCredentialRef": {"name": "repository-publish"},
+                "pushBranch": "${{ steps.logs.outputs.branch }}"
               },
-              "timeout": "15m",
+              "agentRuntime": {"maxTurns": 40},
+              "timeout": "20m",
               "priority": 900
             }'
diff --git a/examples/github-cicd/secret.yaml b/examples/github-cicd/secret.yaml
index bad4f2a0b..643c42b6b 100644
--- a/examples/github-cicd/secret.yaml
+++ b/examples/github-cicd/secret.yaml
@@ -1,7 +1,18 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: git-credentials
+  name: repository-read
 type: Opaque
 stringData:
-  token: "ghp_YOUR_TOKEN_HERE"  # needs repo, pull_request, and workflow scopes
+  # Use a read-only, repository-scoped token.
+  token: "github_pat_READ_ONLY_PLACEHOLDER"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: repository-publish
+type: Opaque
+stringData:
+  # Use a separately scoped token permitted to update the publication branch
+  # and create/reconcile pull requests.
+  token: "github_pat_PUBLICATION_PLACEHOLDER"
diff --git a/examples/github-cicd/task.yaml b/examples/github-cicd/task.yaml
index dc18e2e68..d43faa313 100644
--- a/examples/github-cicd/task.yaml
+++ b/examples/github-cicd/task.yaml
@@ -10,15 +10,19 @@ spec:
   prompt: |
     Implement unit tests for the authentication module.
 
-    Repository details:
+    Repository details for the delegated ACP write Task:
     - gitRepo: https://github.com/myorg/myrepo.git
     - branch: main
-    - gitSecretRef: git-credentials
+    - readCredentialRef: repository-read
+    - publicationGitRepo: https://github.com/myorg/myrepo.git
+    - publicationCredentialRef: repository-publish
     - pushBranch: chore/add-auth-tests
+    - prBaseBranch: main
 
     Requirements:
     - Cover the authentication module's happy path and failure path.
     - Run the relevant test suite before handing work back.
+    - Require a verified branch-delivery receipt before opening the PR.
     - Open a PR and auto-merge it once CI passes.
   timeout: 45m
   priority: 800
diff --git a/examples/github-label-trigger/README.md b/examples/github-label-trigger/README.md
index 465f39bea..3d9b9aaea 100644
--- a/examples/github-label-trigger/README.md
+++ b/examples/github-label-trigger/README.md
@@ -1,9 +1,9 @@
 # GitHub Label Trigger Example
 
-This example wires GitHub labels to Orka runtime-agent Tasks.
+This example wires GitHub labels to Orka ACP `type: agent` Tasks.
 
 1. Deploy an Agent that can work in a git workspace.
-2. Configure the controller with a webhook secret, default Agent, and git credentials Secret.
+2. Configure the controller with a webhook secret, default Agent, and the label-trigger compatibility Git Secret.
 3. Add labels such as `agent:implement`, `agent:update-branch`, `agent:review`, or `agent:to-issues` to issues/PRs.
 
 ## Secrets
@@ -15,10 +15,10 @@ kubectl create secret generic github-webhook-secret \
   --from-literal=secret='<github-webhook-secret>'
 
 kubectl create secret generic git-credentials \
-  --from-literal=token='<github-token>'
+  --from-literal=token='<repository-scoped-github-token>'
 ```
 
-The GitHub token should have only the repository permissions required by the actions you allow. Runtime agents should leave workspace changes uncommitted; Orka finalization commits and pushes configured branches.
+The compatibility setting maps this Secret to the Task read role and, for write labels, the publication role. The ACP runtime never receives it. Runtime agents must leave changes uncommitted; the separate Workspace/Publisher prepares, publishes, and verifies configured branches. For strict least privilege with different read and publication Secrets, create Tasks through an API/workflow that sets both top-level references explicitly.
 
 ## Controller env
 
diff --git a/examples/harness/echo/Dockerfile b/examples/harness/echo/Dockerfile
deleted file mode 100644
index ae5b0354e..000000000
--- a/examples/harness/echo/Dockerfile
+++ /dev/null
@@ -1,13 +0,0 @@
-# syntax=docker/dockerfile:1
-FROM golang:1.26-alpine AS build
-WORKDIR /src
-COPY go.mod go.sum ./
-RUN go mod download
-COPY . .
-RUN CGO_ENABLED=0 GOOS=linux go build -o /out/orka-example-echo-harness ./examples/harness/echo
-
-FROM gcr.io/distroless/static:nonroot
-COPY --from=build /out/orka-example-echo-harness /orka-example-echo-harness
-USER 65532:65532
-EXPOSE 8090
-ENTRYPOINT ["/orka-example-echo-harness"]
diff --git a/examples/harness/echo/main.go b/examples/harness/echo/main.go
deleted file mode 100644
index 5bdc12572..000000000
--- a/examples/harness/echo/main.go
+++ /dev/null
@@ -1,638 +0,0 @@
-package main
-
-import (
-	"crypto/subtle"
-	"encoding/json"
-	"fmt"
-	"log"
-	"net/http"
-	"os"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/orka-agents/orka/internal/harness"
-)
-
-const (
-	behaviorSuccess              = "success"
-	behaviorReadTool             = "read-tool"
-	behaviorApprovalTool         = "approval-tool"
-	behaviorFailure              = "failure"
-	behaviorTimeout              = "timeout"
-	behaviorCancellation         = "cancellation"
-	remoteRuntimeNameEnv         = "ORKA_REMOTE_HTTP_RUNTIME_NAME"
-	remoteRuntimeBearerEnv       = "ORKA_REMOTE_HTTP_RUNTIME_BEARER_TOKEN"
-	remoteRuntimeAddrEnv         = "ORKA_REMOTE_HTTP_RUNTIME_ADDR"
-	remoteRuntimeScriptEnv       = "ORKA_REMOTE_HTTP_RUNTIME_BEHAVIOR"
-	remoteRuntimeReadToolEnv     = "ORKA_REMOTE_HTTP_RUNTIME_READ_TOOL_NAME"
-	remoteRuntimeWriteToolEnv    = "ORKA_REMOTE_HTTP_RUNTIME_WRITE_TOOL_NAME"
-	remoteRuntimeBrokeredOnlyEnv = "ORKA_REMOTE_HTTP_RUNTIME_BROKERED_ONLY"
-	brokeredReadCallID           = "tool-read-1"
-	brokeredWriteCallID          = "tool-write-1"
-)
-
-type server struct {
-	runtimeName    string
-	bearerValue    string
-	behavior       string
-	mu             sync.Mutex
-	turns          map[harness.HarnessTurnID]*turnState
-	completedTurns map[harness.HarnessTurnID]struct{}
-}
-
-type turnState struct {
-	request    harness.StartTurnRequest
-	cancelled  chan struct{}
-	continued  chan struct{}
-	onceCancel sync.Once
-	onceCont   sync.Once
-	results    []harness.ToolCallResult
-}
-
-func main() {
-	addr := firstNonBlank(os.Getenv(remoteRuntimeAddrEnv), os.Getenv("ORKA_EXAMPLE_HARNESS_ADDR"), ":8090")
-	runtimeName := firstNonBlank(
-		os.Getenv(remoteRuntimeNameEnv),
-		os.Getenv("ORKA_EXAMPLE_HARNESS_RUNTIME_NAME"),
-		"orka-generic-http-runtime",
-	)
-	behavior := normalizeBehavior(firstNonBlank(
-		os.Getenv(remoteRuntimeScriptEnv),
-		os.Getenv("ORKA_EXAMPLE_HARNESS_BEHAVIOR"),
-		behaviorSuccess,
-	))
-	s := &server{
-		runtimeName: runtimeName,
-		bearerValue: strings.TrimSpace(firstNonBlank(
-			os.Getenv(remoteRuntimeBearerEnv),
-			os.Getenv("ORKA_EXAMPLE_HARNESS_BEARER_TOKEN"),
-		)),
-		behavior:       behavior,
-		turns:          map[harness.HarnessTurnID]*turnState{},
-		completedTurns: map[harness.HarnessTurnID]struct{}{},
-	}
-	mux := http.NewServeMux()
-	mux.HandleFunc(harness.HealthPath, s.health)
-	mux.HandleFunc(harness.CapabilitiesPath, s.capabilities)
-	mux.HandleFunc(harness.TurnsPath, s.startTurn)
-	mux.HandleFunc(harness.TurnsPath+"/", s.turn)
-	mux.HandleFunc("/lookup", s.supportLookup)
-	log.Printf("generic HTTP AgentRuntime fixture listening on %s (runtime=%s behavior=%s)", addr, runtimeName, behavior)
-	log.Fatal(http.ListenAndServe(addr, mux))
-}
-
-func (s *server) supportLookup(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		harness.WriteError(w, http.StatusMethodNotAllowed, "method not allowed")
-		return
-	}
-	var body map[string]any
-	_ = json.NewDecoder(r.Body).Decode(&body)
-	incident, _ := body["incident"].(string)
-	if strings.TrimSpace(incident) == "" {
-		incident = "unknown"
-	}
-	harness.WriteJSON(w, http.StatusOK, map[string]any{
-		"success": true,
-		"data": map[string]any{
-			"incident": incident,
-			"status":   "investigating",
-			"source":   "mock-support-tool",
-		},
-	})
-}
-
-func firstNonBlank(values ...string) string {
-	for _, value := range values {
-		if strings.TrimSpace(value) != "" {
-			return strings.TrimSpace(value)
-		}
-	}
-	return ""
-}
-
-func envBool(name string) bool {
-	switch strings.ToLower(strings.TrimSpace(os.Getenv(name))) {
-	case "1", "true", "yes", "on":
-		return true
-	default:
-		return false
-	}
-}
-
-func normalizeBehavior(value string) string {
-	switch strings.TrimSpace(value) {
-	case behaviorReadTool, behaviorApprovalTool, behaviorFailure, behaviorTimeout, behaviorCancellation:
-		return strings.TrimSpace(value)
-	default:
-		return behaviorSuccess
-	}
-}
-
-func (s *server) health(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		harness.WriteError(w, http.StatusMethodNotAllowed, "method not allowed")
-		return
-	}
-	harness.WriteJSON(w, http.StatusOK, harness.HealthResponse{
-		Version:   harness.ProtocolVersion,
-		Status:    harness.HealthStatusOK,
-		Ready:     true,
-		CheckedAt: time.Now().UTC(),
-		Metadata: map[string]string{
-			"runtime": s.runtimeName,
-			"backend": "generic-http",
-		},
-	})
-}
-
-func (s *server) capabilities(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		harness.WriteError(w, http.StatusMethodNotAllowed, "method not allowed")
-		return
-	}
-	modes := []harness.ToolExecutionMode{harness.ToolExecutionModeObserved}
-	classes := []harness.BrokeredToolClass(nil)
-	brokeredOnly := envBool(remoteRuntimeBrokeredOnlyEnv)
-	if brokeredOnly {
-		modes = nil
-	}
-	if s.behavior == behaviorReadTool {
-		modes = append(modes, harness.ToolExecutionModeBrokered)
-		classes = append(classes, harness.BrokeredToolClassRead)
-	}
-	if s.behavior == behaviorApprovalTool {
-		modes = append(modes, harness.ToolExecutionModeBrokered)
-		classes = append(classes, harness.BrokeredToolClassWrite)
-	}
-	harness.WriteJSON(w, http.StatusOK, harness.CapabilitiesResponse{
-		Version:                 harness.ProtocolVersion,
-		ProtocolVersion:         harness.ProtocolVersion,
-		Transport:               harness.HTTPTransport,
-		RuntimeName:             s.runtimeName,
-		RuntimeVersion:          "generic-http-fixture",
-		ProviderKind:            harness.ProviderKindRemote,
-		ToolExecutionModes:      modes,
-		BrokeredToolClasses:     classes,
-		SupportsCancel:          true,
-		SupportsRuntimeSessions: true,
-		SupportsContinuation:    s.behavior == behaviorReadTool || s.behavior == behaviorApprovalTool,
-		SupportsArtifacts:       true,
-		MaxConcurrentTurns:      1,
-		MaxTurnSeconds:          600,
-		MaxOutputBytes:          1 << 20,
-		Metadata: map[string]string{
-			"backend":  "generic-http",
-			"behavior": s.behavior,
-		},
-	})
-}
-
-func (s *server) authorized(w http.ResponseWriter, r *http.Request) bool {
-	if strings.TrimSpace(s.bearerValue) == "" {
-		return true
-	}
-	got := strings.TrimSpace(strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer "))
-	if got == "" || subtle.ConstantTimeCompare([]byte(got), []byte(s.bearerValue)) != 1 {
-		harness.WriteError(w, http.StatusUnauthorized, "unauthorized")
-		return false
-	}
-	return true
-}
-
-func (s *server) startTurn(w http.ResponseWriter, r *http.Request) {
-	if !s.authorized(w, r) {
-		return
-	}
-	if r.Method != http.MethodPost {
-		harness.WriteError(w, http.StatusMethodNotAllowed, "method not allowed")
-		return
-	}
-	var request harness.StartTurnRequest
-	if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
-		harness.WriteError(w, http.StatusBadRequest, "invalid JSON request")
-		return
-	}
-	if err := request.Validate(); err != nil {
-		harness.WriteError(w, http.StatusBadRequest, err.Error())
-		return
-	}
-	eventStreamPath, err := harness.EventStreamPath(request.TurnID)
-	if err != nil {
-		harness.WriteError(w, http.StatusBadRequest, err.Error())
-		return
-	}
-	turn := &turnState{request: request, cancelled: make(chan struct{}), continued: make(chan struct{})}
-	s.mu.Lock()
-	if _, completed := s.completedTurns[request.TurnID]; completed {
-		s.mu.Unlock()
-		harness.WriteError(w, http.StatusConflict, "turn already completed")
-		return
-	}
-	if _, exists := s.turns[request.TurnID]; exists {
-		s.mu.Unlock()
-		harness.WriteError(w, http.StatusConflict, "turn already exists")
-		return
-	}
-	s.turns[request.TurnID] = turn
-	s.mu.Unlock()
-	harness.WriteJSON(w, http.StatusAccepted, harness.StartTurnResponse{
-		Version:          harness.ProtocolVersion,
-		Accepted:         true,
-		RuntimeSessionID: request.RuntimeSessionID,
-		TurnID:           request.TurnID,
-		CorrelationID:    request.CorrelationID,
-		EventStreamPath:  eventStreamPath,
-	})
-}
-
-func (s *server) turn(w http.ResponseWriter, r *http.Request) {
-	if !s.authorized(w, r) {
-		return
-	}
-	turnID, resource, err := harness.ParseTurnResourcePath(r.URL.EscapedPath())
-	if err != nil {
-		harness.WriteError(w, http.StatusNotFound, "not found")
-		return
-	}
-	s.mu.Lock()
-	turn := s.turns[turnID]
-	s.mu.Unlock()
-	if turn == nil {
-		harness.WriteError(w, http.StatusNotFound, "turn not found")
-		return
-	}
-	switch resource {
-	case harness.TurnResourceEvents:
-		if r.Method != http.MethodGet {
-			harness.WriteError(w, http.StatusMethodNotAllowed, "method not allowed")
-			return
-		}
-		s.streamEvents(w, r, turn)
-	case harness.TurnResourceContinue:
-		if r.Method != http.MethodPost {
-			harness.WriteError(w, http.StatusMethodNotAllowed, "method not allowed")
-			return
-		}
-		s.continueTurn(w, r, turn)
-	case harness.TurnResourceCancel:
-		s.cancelTurn(w, r, turn)
-	default:
-		harness.WriteError(w, http.StatusNotFound, "not found")
-	}
-}
-
-func (s *server) streamEvents(w http.ResponseWriter, r *http.Request, turn *turnState) {
-	afterSeq := int64(0)
-	if raw := strings.TrimSpace(r.URL.Query().Get("afterSeq")); raw != "" {
-		_, _ = fmt.Sscanf(raw, "%d", &afterSeq)
-	}
-	w.Header().Set("Content-Type", "text/event-stream")
-	w.Header().Set("Cache-Control", "no-cache")
-	write := func(frame harness.HarnessEventFrame) bool {
-		if frame.Seq <= afterSeq {
-			return true
-		}
-		return harness.WriteSSEFrame(w, frame) == nil
-	}
-	frames := s.initialFrames(turn)
-	if framesHaveTerminal(frames) {
-		s.markCompleted(turn.request.TurnID)
-	}
-	for _, frame := range frames {
-		if !write(frame) {
-			return
-		}
-	}
-	if turn.request.ToolExecutionMode != harness.ToolExecutionModeBrokered &&
-		(s.behavior == behaviorReadTool || s.behavior == behaviorApprovalTool) {
-		_ = harness.WriteSSEDone(w)
-		return
-	}
-	switch s.behavior {
-	case behaviorReadTool:
-		if afterSeq >= 5 {
-			_ = harness.WriteSSEDone(w)
-			return
-		}
-		select {
-		case <-turn.continued:
-			continuedFrames := s.continuedReadFrames(turn)
-			if framesHaveTerminal(continuedFrames) {
-				s.markCompleted(turn.request.TurnID)
-			}
-			for _, frame := range continuedFrames {
-				if !write(frame) {
-					return
-				}
-			}
-			_ = harness.WriteSSEDone(w)
-		case <-turn.cancelled:
-			s.markCompleted(turn.request.TurnID)
-			_ = write(frame(turn.request, 4, harness.FrameTurnCancelled, "turn cancelled", nil))
-			_ = harness.WriteSSEDone(w)
-		case <-r.Context().Done():
-			return
-		}
-	case behaviorApprovalTool:
-		if afterSeq >= 6 {
-			_ = harness.WriteSSEDone(w)
-			return
-		}
-		select {
-		case <-turn.continued:
-			continuedFrames := s.continuedFrames(turn)
-			if framesHaveTerminal(continuedFrames) {
-				s.markCompleted(turn.request.TurnID)
-			}
-			for _, frame := range continuedFrames {
-				if !write(frame) {
-					return
-				}
-			}
-			_ = harness.WriteSSEDone(w)
-		case <-turn.cancelled:
-			s.markCompleted(turn.request.TurnID)
-			_ = write(frame(turn.request, 5, harness.FrameTurnCancelled, "turn cancelled", nil))
-			_ = harness.WriteSSEDone(w)
-		case <-r.Context().Done():
-			return
-		}
-	case behaviorCancellation:
-		select {
-		case <-turn.cancelled:
-			s.markCompleted(turn.request.TurnID)
-			_ = write(frame(turn.request, 2, harness.FrameTurnCancelled, "turn cancelled", nil))
-			_ = harness.WriteSSEDone(w)
-		case <-r.Context().Done():
-			return
-		}
-	default:
-		_ = harness.WriteSSEDone(w)
-	}
-}
-
-func (s *server) markCompleted(turnID harness.HarnessTurnID) {
-	s.mu.Lock()
-	s.completedTurns[turnID] = struct{}{}
-	s.mu.Unlock()
-}
-
-func framesHaveTerminal(frames []harness.HarnessEventFrame) bool {
-	for _, frame := range frames {
-		switch frame.Type {
-		case harness.FrameTurnCompleted, harness.FrameTurnFailed, harness.FrameTurnCancelled:
-			return true
-		}
-	}
-	return false
-}
-
-func (s *server) initialFrames(turn *turnState) []harness.HarnessEventFrame {
-	request := turn.request
-	start := frame(request, 1, harness.FrameTurnStarted, "turn started", nil)
-	switch s.behavior {
-	case behaviorFailure:
-		failed := frame(request, 2, harness.FrameTurnFailed, "turn failed", nil)
-		failed.Failed = &harness.TurnFailed{Reason: "simulated_failure", Message: "generic HTTP runtime simulated failure"}
-		failed.Error = &harness.ErrorInfo{Code: "simulated_failure", Message: "generic HTTP runtime simulated failure"}
-		return []harness.HarnessEventFrame{start, failed}
-	case behaviorTimeout:
-		failed := frame(request, 2, harness.FrameTurnFailed, "turn timeout", nil)
-		failed.Failed = &harness.TurnFailed{
-			Reason:    "timeout",
-			Message:   "generic HTTP runtime simulated timeout",
-			Retryable: true,
-		}
-		failed.Error = &harness.ErrorInfo{Code: "timeout", Message: "generic HTTP runtime simulated timeout", Retryable: true}
-		return []harness.HarnessEventFrame{start, failed}
-	case behaviorCancellation:
-		return []harness.HarnessEventFrame{start}
-	case behaviorReadTool:
-		if request.ToolExecutionMode != harness.ToolExecutionModeBrokered {
-			return observedSuccessFrames(request, start)
-		}
-		output := runtimeOutput(request, 2, "generic HTTP runtime requesting read-only tool")
-		toolName := brokeredToolNameForRequest(request, defaultReadToolName())
-		if !requestIncludesBrokeredToolSchema(request, toolName) {
-			failed := missingToolSchemaFrame(request, 3)
-			return []harness.HarnessEventFrame{start, output, failed}
-		}
-		tool := toolRequested(request, 3, toolName, brokeredReadCallID, `{"incident":"quincy-north"}`)
-		return []harness.HarnessEventFrame{start, output, tool}
-	case behaviorApprovalTool:
-		if request.ToolExecutionMode != harness.ToolExecutionModeBrokered {
-			return observedSuccessFrames(request, start)
-		}
-		output := runtimeOutput(request, 2, "generic HTTP runtime requesting approval-gated tool")
-		toolName := brokeredToolNameForRequest(request, defaultWriteToolName())
-		if !requestIncludesBrokeredToolSchema(request, toolName) {
-			failed := missingToolSchemaFrame(request, 3)
-			return []harness.HarnessEventFrame{start, output, failed}
-		}
-
-		tool := toolRequested(
-			request,
-			3,
-			toolName,
-			brokeredWriteCallID,
-			`{"incident":"quincy-north","action":"dispatch technician"}`,
-		)
-		waiting := frame(request, 4, harness.FrameRuntimeLog, "waiting for Orka brokered approval", nil)
-		waiting.Content = json.RawMessage(fmt.Sprintf(`{"status":"waiting_for_orka_approval","targetTool":%q}`, toolName))
-		return []harness.HarnessEventFrame{start, output, tool, waiting}
-	default:
-		return observedSuccessFrames(request, start)
-	}
-}
-
-func missingToolSchemaFrame(request harness.StartTurnRequest, seq int64) harness.HarnessEventFrame {
-	const message = "brokered tool schema was not supplied by Orka"
-	failed := frame(request, seq, harness.FrameTurnFailed, "brokered tool schema missing", nil)
-	failed.Failed = &harness.TurnFailed{Reason: "missing_tool_schema", Message: message}
-	failed.Error = &harness.ErrorInfo{Code: "missing_tool_schema", Message: message}
-	return failed
-}
-
-func requestIncludesBrokeredToolSchema(request harness.StartTurnRequest, name string) bool {
-	name = strings.TrimSpace(name)
-	for _, definition := range request.Input.Tools {
-		if strings.TrimSpace(definition.Name) == name && definition.BrokeredClass != "" {
-			return true
-		}
-	}
-	return false
-}
-
-func brokeredToolNameForRequest(request harness.StartTurnRequest, fallback string) string {
-	if class := strings.TrimSpace(request.Metadata["brokeredToolClass"]); class != "" {
-		return "conformance_" + class
-	}
-	return fallback
-}
-
-func defaultReadToolName() string {
-	return firstNonBlank(os.Getenv(remoteRuntimeReadToolEnv), "read_incident")
-}
-
-func defaultWriteToolName() string {
-	return firstNonBlank(os.Getenv(remoteRuntimeWriteToolEnv), "dispatch_work_order")
-}
-
-func observedSuccessFrames(
-	request harness.StartTurnRequest,
-	start harness.HarnessEventFrame,
-) []harness.HarnessEventFrame {
-	output := runtimeOutput(request, 2, "echo: "+request.Input.Prompt)
-	completed := frame(request, 3, harness.FrameTurnCompleted, "turn completed", &harness.TurnCompleted{
-		Result:        "ok",
-		FinalEventSeq: 3,
-	})
-	return []harness.HarnessEventFrame{start, output, completed}
-}
-
-func (s *server) continuedReadFrames(turn *turnState) []harness.HarnessEventFrame {
-	request := turn.request
-	result := frame(request, 4, harness.FrameToolResultReceived, "brokered read-only tool result received", nil)
-	result.ToolName = brokeredToolNameForRequest(request, defaultReadToolName())
-	result.ToolCallID = brokeredReadCallID
-	if len(turn.results) > 0 {
-		if turn.results[0].Error != nil {
-			result.Error = turn.results[0].Error
-			encoded, _ := json.Marshal(map[string]any{"error": turn.results[0].Error})
-			result.Content = encoded
-		} else {
-			result.Content = turn.results[0].Output
-		}
-	}
-	completed := frame(request, 5, harness.FrameTurnCompleted, "turn completed", &harness.TurnCompleted{
-		Result:        "read-only investigation complete",
-		FinalEventSeq: 5,
-	})
-	return []harness.HarnessEventFrame{result, completed}
-}
-
-func (s *server) continuedFrames(turn *turnState) []harness.HarnessEventFrame {
-	request := turn.request
-	result := frame(request, 5, harness.FrameToolResultReceived, "brokered approval-gated tool result received", nil)
-	result.ToolName = brokeredToolNameForRequest(request, defaultWriteToolName())
-	result.ToolCallID = brokeredWriteCallID
-	if len(turn.results) > 0 {
-		if turn.results[0].Error != nil {
-			result.Error = turn.results[0].Error
-			encoded, _ := json.Marshal(map[string]any{"error": turn.results[0].Error})
-			result.Content = encoded
-		} else {
-			result.Content = turn.results[0].Output
-		}
-	} else {
-		result.Error = &harness.ErrorInfo{Code: "missing_tool_result", Message: "continue request had no tool result"}
-		result.Content = json.RawMessage(`{"error":{"code":"missing_tool_result"}}`)
-	}
-	completed := frame(request, 6, harness.FrameTurnCompleted, "turn completed", &harness.TurnCompleted{
-		Result:        "approval-gated action completed",
-		FinalEventSeq: 6,
-	})
-	return []harness.HarnessEventFrame{result, completed}
-}
-
-func runtimeOutput(request harness.StartTurnRequest, seq int64, text string) harness.HarnessEventFrame {
-	output := frame(request, seq, harness.FrameRuntimeOutput, "runtime output", nil)
-	output.ContentText = text
-	output.Content = json.RawMessage(fmt.Sprintf(`{"message":%q}`, text))
-	return output
-}
-
-func toolRequested(
-	request harness.StartTurnRequest,
-	seq int64,
-	name string,
-	toolCallID string,
-	args string,
-) harness.HarnessEventFrame {
-	tool := frame(request, seq, harness.FrameToolCallRequested, "brokered tool requested", nil)
-	tool.ToolName = name
-	tool.ToolCallID = toolCallID
-	tool.Content = json.RawMessage(args)
-	return tool
-}
-
-func (s *server) continueTurn(w http.ResponseWriter, r *http.Request, turn *turnState) {
-	var request harness.ContinueTurnRequest
-	if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
-		harness.WriteError(w, http.StatusBadRequest, "invalid JSON request")
-		return
-	}
-	if err := request.Validate(); err != nil {
-		harness.WriteError(w, http.StatusBadRequest, err.Error())
-		return
-	}
-	if request.RuntimeSessionID != turn.request.RuntimeSessionID ||
-		request.TurnID != turn.request.TurnID ||
-		request.CorrelationID != turn.request.CorrelationID {
-		harness.WriteError(w, http.StatusBadRequest, "continue request does not match started turn")
-		return
-	}
-	turn.results = append([]harness.ToolCallResult(nil), request.ToolResults...)
-	turn.onceCont.Do(func() { close(turn.continued) })
-	harness.WriteJSON(w, http.StatusAccepted, harness.ContinueTurnResponse{
-		Version:          harness.ProtocolVersion,
-		Accepted:         true,
-		RuntimeSessionID: request.RuntimeSessionID,
-		TurnID:           request.TurnID,
-		CorrelationID:    request.CorrelationID,
-		Message:          "continue accepted",
-	})
-}
-
-func (s *server) cancelTurn(w http.ResponseWriter, r *http.Request, turn *turnState) {
-	if r.Method != http.MethodPost {
-		harness.WriteError(w, http.StatusMethodNotAllowed, "method not allowed")
-		return
-	}
-	var request harness.CancelTurnRequest
-	if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
-		harness.WriteError(w, http.StatusBadRequest, "invalid JSON request")
-		return
-	}
-	if err := request.Validate(); err != nil {
-		harness.WriteError(w, http.StatusBadRequest, err.Error())
-		return
-	}
-	if request.RuntimeSessionID != turn.request.RuntimeSessionID || request.TurnID != turn.request.TurnID {
-		harness.WriteError(w, http.StatusBadRequest, "cancel request does not match started turn")
-		return
-	}
-	turn.onceCancel.Do(func() { close(turn.cancelled) })
-	harness.WriteJSON(w, http.StatusAccepted, harness.CancelTurnResponse{
-		Version:          harness.ProtocolVersion,
-		Accepted:         true,
-		RuntimeSessionID: request.RuntimeSessionID,
-		TurnID:           request.TurnID,
-		CorrelationID:    request.CorrelationID,
-		Message:          "cancel accepted",
-	})
-}
-
-func frame(
-	request harness.StartTurnRequest,
-	seq int64,
-	typ harness.FrameType,
-	summary string,
-	completed *harness.TurnCompleted,
-) harness.HarnessEventFrame {
-	metadata := map[string]string{"backend": "generic-http"}
-	return harness.HarnessEventFrame{
-		Version:          harness.ProtocolVersion,
-		Type:             typ,
-		RuntimeSessionID: request.RuntimeSessionID,
-		TurnID:           request.TurnID,
-		CorrelationID:    request.CorrelationID,
-		Seq:              seq,
-		CreatedAt:        time.Now().UTC(),
-		Summary:          summary,
-		Completed:        completed,
-		Metadata:         metadata,
-	}
-}
diff --git a/examples/harness/echo/main_test.go b/examples/harness/echo/main_test.go
deleted file mode 100644
index d4a03d277..000000000
--- a/examples/harness/echo/main_test.go
+++ /dev/null
@@ -1,250 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/orka-agents/orka/internal/harness"
-	"github.com/orka-agents/orka/internal/harness/conformance"
-)
-
-func TestEchoHarnessCancelEndpointMatchesCapabilities(t *testing.T) {
-	s := newTestServer(behaviorSuccess)
-	srv := httptest.NewServer(s.handler())
-	defer srv.Close()
-	client, err := harness.NewClient(srv.URL)
-	if err != nil {
-		t.Fatalf("NewClient() error = %v", err)
-	}
-	ctx := context.Background()
-	caps, err := client.Capabilities(ctx)
-	if err != nil {
-		t.Fatalf("Capabilities() error = %v", err)
-	}
-	if !caps.SupportsCancel {
-		t.Fatal("generic HTTP runtime should advertise cancellation")
-	}
-	request := validStartTurnRequest()
-	if _, err := client.StartTurn(ctx, request); err != nil {
-		t.Fatalf("StartTurn() error = %v", err)
-	}
-	cancelled, err := client.CancelTurn(ctx, harness.CancelTurnRequest{
-		Version:          harness.ProtocolVersion,
-		Namespace:        request.Namespace,
-		TaskName:         request.TaskName,
-		SessionName:      request.SessionName,
-		RuntimeSessionID: request.RuntimeSessionID,
-		TurnID:           request.TurnID,
-		CorrelationID:    request.CorrelationID,
-		Reason:           "test",
-	})
-	if err != nil {
-		t.Fatalf("CancelTurn() error = %v", err)
-	}
-	if !cancelled.Accepted ||
-		cancelled.TurnID != request.TurnID ||
-		cancelled.RuntimeSessionID != request.RuntimeSessionID {
-		t.Fatalf("CancelTurn() = %#v", cancelled)
-	}
-}
-
-func TestEchoHarnessRejectsDuplicateStartTurn(t *testing.T) {
-	s := newTestServer(behaviorSuccess)
-	srv := httptest.NewServer(s.handler())
-	defer srv.Close()
-	client, err := harness.NewClient(srv.URL)
-	if err != nil {
-		t.Fatalf("NewClient() error = %v", err)
-	}
-	request := validStartTurnRequest()
-	if _, err := client.StartTurn(context.Background(), request); err != nil {
-		t.Fatalf("first StartTurn() error = %v", err)
-	}
-	_, err = client.StartTurn(context.Background(), request)
-	if err == nil || !strings.Contains(err.Error(), "turn already exists") {
-		t.Fatalf("second StartTurn() error = %v, want duplicate rejection", err)
-	}
-}
-
-func TestEchoHarnessRejectsCompletedStartTurn(t *testing.T) {
-	s := newTestServer(behaviorSuccess)
-	srv := httptest.NewServer(s.handler())
-	defer srv.Close()
-	client, err := harness.NewClient(srv.URL)
-	if err != nil {
-		t.Fatalf("NewClient() error = %v", err)
-	}
-	request := validStartTurnRequest()
-	if _, err := client.StartTurn(context.Background(), request); err != nil {
-		t.Fatalf("StartTurn() error = %v", err)
-	}
-	if err := client.StreamFrames(
-		context.Background(),
-		request.TurnID,
-		0,
-		func(harness.HarnessEventFrame) error { return nil },
-	); err != nil {
-		t.Fatalf("StreamFrames() error = %v", err)
-	}
-	_, err = client.StartTurn(context.Background(), request)
-	if err == nil || !strings.Contains(err.Error(), "turn already completed") {
-		t.Fatalf("completed StartTurn() error = %v, want tombstone rejection", err)
-	}
-}
-
-func TestSupportLookupEndpoint(t *testing.T) {
-	s := newTestServer(behaviorSuccess)
-	srv := httptest.NewServer(s.handler())
-	defer srv.Close()
-	resp, err := http.Post(srv.URL+"/lookup", "application/json", bytes.NewBufferString(`{"incident":"case-1"}`))
-	if err != nil {
-		t.Fatalf("POST /lookup: %v", err)
-	}
-	defer resp.Body.Close() //nolint:errcheck
-	if resp.StatusCode != http.StatusOK {
-		t.Fatalf("status = %d, want 200", resp.StatusCode)
-	}
-	var body map[string]any
-	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
-		t.Fatalf("decode body: %v", err)
-	}
-	if body["success"] != true {
-		t.Fatalf("body = %#v", body)
-	}
-}
-
-func TestGenericHTTPRuntimeApprovalContinuation(t *testing.T) {
-	s := newTestServer(behaviorApprovalTool)
-	srv := httptest.NewServer(s.handler())
-	defer srv.Close()
-	client, err := harness.NewClient(srv.URL)
-	if err != nil {
-		t.Fatalf("NewClient() error = %v", err)
-	}
-	request := validStartTurnRequest()
-	request.ToolExecutionMode = harness.ToolExecutionModeBrokered
-	request.Input.Tools = []harness.ToolDefinition{{
-		Name:          defaultWriteToolName(),
-		BrokeredClass: harness.BrokeredToolClassWrite,
-		Parameters:    json.RawMessage(`{"type":"object"}`),
-	}}
-	if _, err := client.StartTurn(context.Background(), request); err != nil {
-		t.Fatalf("StartTurn() error = %v", err)
-	}
-	firstCtx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
-	defer cancel()
-	var firstFrames []harness.HarnessEventFrame
-	_ = client.StreamFrames(firstCtx, request.TurnID, 0, func(frame harness.HarnessEventFrame) error {
-		firstFrames = append(firstFrames, frame)
-		return nil
-	})
-	if len(firstFrames) != 4 ||
-		firstFrames[2].Type != harness.FrameToolCallRequested ||
-		firstFrames[len(firstFrames)-1].Type != harness.FrameRuntimeLog {
-		t.Fatalf("first frames = %#v, want tool request followed by waiting diagnostic", firstFrames)
-	}
-	continued, err := client.ContinueTurn(context.Background(), harness.ContinueTurnRequest{
-		Version:          harness.ProtocolVersion,
-		Namespace:        request.Namespace,
-		TaskName:         request.TaskName,
-		SessionName:      request.SessionName,
-		RuntimeSessionID: request.RuntimeSessionID,
-		TurnID:           request.TurnID,
-		CorrelationID:    request.CorrelationID,
-		ToolResults: []harness.ToolCallResult{{
-			Version:          harness.ProtocolVersion,
-			RuntimeSessionID: request.RuntimeSessionID,
-			TurnID:           request.TurnID,
-			ToolCallID:       "tool-write-1",
-			IdempotencyKey:   harness.ToolRequestIdempotencyKey(request.RuntimeSessionID, request.TurnID, "tool-write-1"),
-			Approved:         true,
-			Output:           json.RawMessage(`{"success":true,"data":{"dispatched":true}}`),
-		}},
-	})
-	if err != nil {
-		t.Fatalf("ContinueTurn() error = %v", err)
-	}
-	if !continued.Accepted {
-		t.Fatalf("ContinueTurn() = %#v, want accepted", continued)
-	}
-	var finalFrames []harness.HarnessEventFrame
-	if err := client.StreamFrames(context.Background(), request.TurnID, 4, func(frame harness.HarnessEventFrame) error {
-		finalFrames = append(finalFrames, frame)
-		return nil
-	}); err != nil {
-		t.Fatalf("StreamFrames(after continue) error = %v", err)
-	}
-	if len(finalFrames) != 2 ||
-		finalFrames[0].Type != harness.FrameToolResultReceived ||
-		finalFrames[1].Type != harness.FrameTurnCompleted {
-		t.Fatalf("final frames = %#v, want tool result then completion", finalFrames)
-	}
-}
-
-func TestGenericHTTPRuntimePassesBrokeredReadConformance(t *testing.T) {
-	s := newTestServer(behaviorReadTool)
-	srv := httptest.NewServer(s.handler())
-	defer srv.Close()
-	observed := conformance.Check(context.Background(), conformance.Target{BaseURL: srv.URL, ProbeTurn: true})
-	if !observed.Passed {
-		t.Fatalf("observed conformance failed: %v", observed.Failures)
-	}
-	result := conformance.Check(context.Background(), conformance.Target{BaseURL: srv.URL, ProbeBrokeredRead: true})
-	if !result.Passed {
-		t.Fatalf("conformance failed: %v", result.Failures)
-	}
-}
-
-func TestGenericHTTPRuntimePassesBrokeredWriteConformance(t *testing.T) {
-	s := newTestServer(behaviorApprovalTool)
-	srv := httptest.NewServer(s.handler())
-	defer srv.Close()
-	observed := conformance.Check(context.Background(), conformance.Target{BaseURL: srv.URL, ProbeTurn: true})
-	if !observed.Passed {
-		t.Fatalf("observed conformance failed: %v", observed.Failures)
-	}
-	result := conformance.Check(context.Background(), conformance.Target{BaseURL: srv.URL, ProbeBrokeredWrite: true})
-	if !result.Passed {
-		t.Fatalf("conformance failed: %v", result.Failures)
-	}
-}
-
-func newTestServer(behavior string) *server {
-	return &server{
-		runtimeName:    "orka-generic-http-runtime",
-		behavior:       normalizeBehavior(behavior),
-		turns:          map[harness.HarnessTurnID]*turnState{},
-		completedTurns: map[harness.HarnessTurnID]struct{}{},
-	}
-}
-
-func (s *server) handler() http.Handler {
-	mux := http.NewServeMux()
-	mux.HandleFunc(harness.HealthPath, s.health)
-	mux.HandleFunc(harness.CapabilitiesPath, s.capabilities)
-	mux.HandleFunc(harness.TurnsPath, s.startTurn)
-	mux.HandleFunc(harness.TurnsPath+"/", s.turn)
-	mux.HandleFunc("/lookup", s.supportLookup)
-	return mux
-}
-
-func validStartTurnRequest() harness.StartTurnRequest {
-	return harness.StartTurnRequest{
-		Version:          harness.ProtocolVersion,
-		Namespace:        "default",
-		TaskName:         "task",
-		SessionName:      "session",
-		RuntimeSessionID: "runtime",
-		TurnID:           "turn",
-		CorrelationID:    "corr",
-		Deadline:         time.Now().UTC().Add(time.Minute),
-		AuthIdentity:     harness.AuthIdentity{Subject: "user:test"},
-		Input:            harness.TurnInput{Prompt: "hello"},
-	}
-}
diff --git a/examples/iterative-review/coder-agent.yaml b/examples/iterative-review/coder-agent.yaml
index 7d52465a3..8d77f376a 100644
--- a/examples/iterative-review/coder-agent.yaml
+++ b/examples/iterative-review/coder-agent.yaml
@@ -20,5 +20,7 @@ spec:
     inline: |
       You are a coding agent. Write clean, well-tested code.
       If you receive FEEDBACK FROM REVIEW, address all feedback items.
+      Do not commit, change Git configuration/remotes, push, or create a pull request.
+      Orka validates and publishes the final tree through a separate clean-room service.
   secretRef:
     name: claude-credentials
diff --git a/examples/iterative-review/coordinator-agent.yaml b/examples/iterative-review/coordinator-agent.yaml
index 34d707399..5c92fec6c 100644
--- a/examples/iterative-review/coordinator-agent.yaml
+++ b/examples/iterative-review/coordinator-agent.yaml
@@ -11,26 +11,30 @@ spec:
     inline: |
       You are a coordinator agent. Follow this protocol:
       1. READ the repository details from the task prompt:
-         - gitRepo
-         - branch
-         - gitSecretRef
-         - pushBranch
-      2. DELEGATE implementation to the coder agent with that workspace config.
-         The coder must work on the requested pushBranch.
+         - gitRepo and branch
+         - readCredentialRef
+         - publicationGitRepo and publicationCredentialRef
+         - pushBranch and prBaseBranch
+      2. DELEGATE implementation to the coder agent with workspace.intent = write
+         and the complete source/publication configuration. The coder edits files;
+         Orka's clean-room publisher owns commit creation and branch delivery.
       3. WAIT for the coder's result.
       4. DELEGATE review to the reviewer agent with prior_task = the coder task name.
       5. WAIT for the reviewer's verdict.
       6. IF verdict == "CHANGES_NEEDED" AND iteration < 3:
          DELEGATE fix to the coder agent with prior_task + feedback.
-         Reuse the same workspace details and pushBranch.
+         Reuse the same workspace details and claimed pushBranch.
+         Require a verified delivery receipt before continuing.
          Go to step 3.
-      7. IF verdict == "APPROVED":
+      7. IF verdict == "APPROVED" and the latest coder delivery is verified:
          Call create_pull_request with:
          - task_name = the coder task name
          - head_branch = pushBranch from the task prompt
          - base_branch = branch from the task prompt
          - title/body that summarize the completed work
-      8. REPORT the final result with the PR URL.
+      8. REPORT the final result with the PR URL and verified branch SHA.
+
+      Never ask an ACP runtime to commit, push, run gh, or create the PR itself.
   coordination:
     enabled: true
     maxDepth: 3
diff --git a/examples/iterative-review/iterative-task.yaml b/examples/iterative-review/iterative-task.yaml
index 08bdd64b8..539f7b00c 100644
--- a/examples/iterative-review/iterative-task.yaml
+++ b/examples/iterative-review/iterative-task.yaml
@@ -12,8 +12,11 @@ spec:
     Repository details for delegated agent tasks:
     - gitRepo: https://github.com/example/api.git
     - branch: main
-    - gitSecretRef: git-credentials
+    - readCredentialRef: repository-read
+    - publicationGitRepo: https://github.com/example/api.git
+    - publicationCredentialRef: repository-publish
     - pushBranch: feature/jwt-auth
+    - prBaseBranch: main
 
     Requirements:
     - Login endpoint with username/password
diff --git a/examples/iterative-review/reviewer-agent.yaml b/examples/iterative-review/reviewer-agent.yaml
index 9d14373b0..5f22e88bf 100644
--- a/examples/iterative-review/reviewer-agent.yaml
+++ b/examples/iterative-review/reviewer-agent.yaml
@@ -16,7 +16,7 @@ spec:
     name: claude-sonnet-4-20250514
   systemPrompt:
     inline: |
-      You are a code reviewer. Review the code changes in the workspace.
+      You are a code reviewer. Review the workspace supplied by Orka without modifying it.
       Respond with a clear verdict:
       - "APPROVED" if the code is ready
       - "CHANGES_NEEDED" with specific feedback if changes are required
diff --git a/examples/support-escalation-runtime-demo/README.md b/examples/support-escalation-runtime-demo/README.md
deleted file mode 100644
index 89474fdcd..000000000
--- a/examples/support-escalation-runtime-demo/README.md
+++ /dev/null
@@ -1,45 +0,0 @@
-# Support escalation bring-your-own AgentRuntime demo
-
-This non-Fibey scenario validates the generic bring-your-own agent runtime story in a support escalation domain.
-
-The workflow is intentionally the same shape as the Fibey demo:
-
-```text
-Task/support-escalation-demo
-  -> Agent/support-remote-investigator
-    -> AgentRuntime/support-http-runtime
-      -> generic HTTP remote execution backend
-        -> Orka-brokered Tool/support-ticket-lookup
-```
-
-Security invariant: the remote runtime does not receive support-system credentials. It can request `support-ticket-lookup`; Orka validates policy, executes the Tool CRD, records events, and returns only the brokered result.
-
-## Run
-
-Build/load the generic HTTP fixture image first:
-
-```bash
-docker build -t ghcr.io/orka-agents/orka/example-echo-harness:latest -f examples/harness/echo/Dockerfile .
-kind load docker-image ghcr.io/orka-agents/orka/example-echo-harness:latest --name <your-kind-cluster>
-```
-
-Apply the demo:
-
-1. Create a per-cluster runtime bearer Secret named `support-http-runtime-token`
-   with data key `token`, label `orka.ai/agent-runtime-auth: "true"`, label
-   `orka.ai/agent-runtime-name: support-http-runtime`, and annotation
-   `orka.ai/agent-runtime-endpoint: http://support-http-runtime.default.svc.cluster.local:8080`.
-   Generate the bearer value outside the repository; do not commit it.
-2. Apply the demo:
-
-   ```bash
-   kubectl apply -k examples/support-escalation-runtime-demo
-   kubectl wait --for=condition=Ready agentruntime/support-http-runtime --timeout=60s
-   kubectl get task support-escalation-demo -o yaml
-   ```
-
-The checked-in `Tool/support-ticket-lookup` points at the included mock `support-tool` service. Replace that service with a real read-only support lookup service for a live demo. The AgentRuntime and Orka task flow remain unchanged when swapping backends or domains.
-
-## Brokered write variant
-
-To exercise approval-gated writes in this domain, add a write-class Tool such as `support-escalate-case`, include it in `Task.spec.agentRuntime.allowedTools`, and set the fixture behavior to `approval-tool`. Orka will emit `ApprovalRequested`, execute the write Tool only after approval, and continue the remote runtime with the approved/declined result.
diff --git a/examples/support-escalation-runtime-demo/agent.yaml b/examples/support-escalation-runtime-demo/agent.yaml
deleted file mode 100644
index 6f21fe144..000000000
--- a/examples/support-escalation-runtime-demo/agent.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: core.orka.ai/v1alpha1
-kind: Agent
-metadata:
-  name: support-remote-investigator
-spec:
-  runtime:
-    runtimeRef:
-      name: support-http-runtime
-  systemPrompt:
-    inline: |
-      You are a support escalation investigator. Use Orka-brokered tools for evidence gathering and summarize the customer's likely issue and next safe action.
diff --git a/examples/support-escalation-runtime-demo/agentruntime.yaml b/examples/support-escalation-runtime-demo/agentruntime.yaml
deleted file mode 100644
index b87257682..000000000
--- a/examples/support-escalation-runtime-demo/agentruntime.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-apiVersion: core.orka.ai/v1alpha1
-kind: AgentRuntime
-metadata:
-  name: support-http-runtime
-spec:
-  contractVersion: orka.harness.v1
-  deployment:
-    mode: external-endpoint
-    endpoint: http://support-http-runtime.default.svc.cluster.local:8080
-  clientAuth:
-    bearerTokenSecretRef:
-      name: support-http-runtime-token
-      key: token
-  capabilities:
-    toolExecutionModes:
-    - observed
-    - brokered
-    brokeredToolClasses:
-    - read
-    supportsCancel: true
-    supportsRuntimeSessions: true
-    supportsContinuation: true
diff --git a/examples/support-escalation-runtime-demo/kustomization.yaml b/examples/support-escalation-runtime-demo/kustomization.yaml
deleted file mode 100644
index 0888f4dc7..000000000
--- a/examples/support-escalation-runtime-demo/kustomization.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-resources:
-- mock-http-runtime-service.yaml
-- mock-support-tool-service.yaml
-- tools.yaml
-- agentruntime.yaml
-- agent.yaml
-- task.yaml
diff --git a/examples/support-escalation-runtime-demo/mock-http-runtime-service.yaml b/examples/support-escalation-runtime-demo/mock-http-runtime-service.yaml
deleted file mode 100644
index a93010ad1..000000000
--- a/examples/support-escalation-runtime-demo/mock-http-runtime-service.yaml
+++ /dev/null
@@ -1,55 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: support-http-runtime
-  labels:
-    app.kubernetes.io/name: support-http-runtime
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: support-http-runtime
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: support-http-runtime
-    spec:
-      containers:
-      - name: harness
-        image: ghcr.io/orka-agents/orka/example-echo-harness:latest
-        imagePullPolicy: IfNotPresent
-        env:
-        - name: ORKA_REMOTE_HTTP_RUNTIME_ADDR
-          value: :8080
-        - name: ORKA_REMOTE_HTTP_RUNTIME_NAME
-          value: support-http-runtime
-        # Switch to read-tool or approval-tool to exercise brokered read/write protocol paths.
-        - name: ORKA_REMOTE_HTTP_RUNTIME_BEHAVIOR
-          value: read-tool
-        - name: ORKA_REMOTE_HTTP_RUNTIME_READ_TOOL_NAME
-          value: support-ticket-lookup
-        - name: ORKA_REMOTE_HTTP_RUNTIME_BEARER_TOKEN
-          valueFrom:
-            secretKeyRef:
-              name: support-http-runtime-token
-              key: token
-        ports:
-        - name: http
-          containerPort: 8080
-        readinessProbe:
-          httpGet:
-            path: /v1/health
-            port: http
-          periodSeconds: 3
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: support-http-runtime
-spec:
-  selector:
-    app.kubernetes.io/name: support-http-runtime
-  ports:
-  - name: http
-    port: 8080
-    targetPort: http
diff --git a/examples/support-escalation-runtime-demo/mock-support-tool-service.yaml b/examples/support-escalation-runtime-demo/mock-support-tool-service.yaml
deleted file mode 100644
index bf04552f0..000000000
--- a/examples/support-escalation-runtime-demo/mock-support-tool-service.yaml
+++ /dev/null
@@ -1,45 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: support-tool
-  labels:
-    app.kubernetes.io/name: support-tool
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: support-tool
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: support-tool
-    spec:
-      containers:
-      - name: support-tool
-        image: ghcr.io/orka-agents/orka/example-echo-harness:latest
-        imagePullPolicy: IfNotPresent
-        env:
-        - name: ORKA_REMOTE_HTTP_RUNTIME_ADDR
-          value: :8080
-        - name: ORKA_REMOTE_HTTP_RUNTIME_NAME
-          value: support-tool
-        ports:
-        - name: http
-          containerPort: 8080
-        readinessProbe:
-          httpGet:
-            path: /v1/health
-            port: http
-          periodSeconds: 3
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: support-tool
-spec:
-  selector:
-    app.kubernetes.io/name: support-tool
-  ports:
-  - name: http
-    port: 8080
-    targetPort: http
diff --git a/examples/support-escalation-runtime-demo/task.yaml b/examples/support-escalation-runtime-demo/task.yaml
deleted file mode 100644
index 789f6b015..000000000
--- a/examples/support-escalation-runtime-demo/task.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
-apiVersion: core.orka.ai/v1alpha1
-kind: Task
-metadata:
-  name: support-escalation-demo
-spec:
-  type: agent
-  agentRef:
-    name: support-remote-investigator
-  agentRuntime:
-    allowedTools:
-    - support-ticket-lookup
-  prompt: |
-    Customer ACME-42 reports intermittent checkout failures after a payment gateway migration.
-    Gather evidence through brokered support tools and recommend the safest next action.
diff --git a/examples/support-escalation-runtime-demo/tools.yaml b/examples/support-escalation-runtime-demo/tools.yaml
deleted file mode 100644
index fae8053bb..000000000
--- a/examples/support-escalation-runtime-demo/tools.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-# Example brokered read Tool CRD. Replace the URL with a real support/ticket lookup service.
-# Remote runtimes only request this tool; Orka owns execution and any downstream credentials.
-apiVersion: core.orka.ai/v1alpha1
-kind: Tool
-metadata:
-  name: support-ticket-lookup
-spec:
-  description: Look up sanitized support ticket and service health evidence for a customer escalation.
-  brokeredToolClass: read
-  parameters:
-    type: object
-    properties:
-      incident:
-        type: string
-        description: Support incident or customer identifier.
-    required:
-    - incident
-  http:
-    url: http://support-tool.default.svc.cluster.local:8080/lookup
-    method: POST
diff --git a/go.mod b/go.mod
index e8df108d1..ac925c399 100644
--- a/go.mod
+++ b/go.mod
@@ -6,6 +6,7 @@ require (
 	github.com/anthropics/anthropic-sdk-go v1.61.0
 	github.com/charmbracelet/glamour v1.0.0
 	github.com/charmbracelet/lipgloss v1.1.1-0.20250404203927-76690c660834
+	github.com/distribution/reference v0.6.0
 	github.com/github/copilot-sdk/go v0.1.25
 	github.com/go-logr/logr v1.4.4
 	github.com/gofiber/fiber/v3 v3.4.0
@@ -31,6 +32,7 @@ require (
 	go.opentelemetry.io/otel/sdk/metric v1.45.0
 	go.opentelemetry.io/otel/trace v1.45.0
 	go.yaml.in/yaml/v3 v3.0.4
+	golang.org/x/sync v0.22.0
 	golang.org/x/sys v0.47.0
 	golang.org/x/time v0.15.0
 	google.golang.org/grpc v1.83.0
@@ -39,7 +41,9 @@ require (
 	k8s.io/api v0.36.3
 	k8s.io/apiextensions-apiserver v0.36.3
 	k8s.io/apimachinery v0.36.3
+	k8s.io/apiserver v0.36.3
 	k8s.io/client-go v0.36.3
+	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2
 	modernc.org/sqlite v1.55.0
 	sigs.k8s.io/agent-sandbox v0.5.4
 	sigs.k8s.io/controller-runtime v0.24.1
@@ -125,6 +129,7 @@ require (
 	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/pb33f/ordered-map/v2 v2.3.1 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
@@ -159,7 +164,6 @@ require (
 	golang.org/x/mod v0.37.0 // indirect
 	golang.org/x/net v0.57.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
 	golang.org/x/term v0.45.0 // indirect
 	golang.org/x/text v0.40.0 // indirect
 	golang.org/x/tools v0.47.0 // indirect
@@ -169,12 +173,10 @@ require (
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	k8s.io/apiserver v0.36.3 // indirect
 	k8s.io/component-base v0.36.3 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect
 	k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
 	k8s.io/streaming v0.36.3 // indirect
-	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect
 	modernc.org/libc v1.74.1 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
diff --git a/go.sum b/go.sum
index 09d49d68a..b0be7872d 100644
--- a/go.sum
+++ b/go.sum
@@ -65,6 +65,8 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 h1:5RVFMOWjMyRy8cARdy79nAmgYw3hK/4HUq48LQ6Wwqo=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1/go.mod h1:ZXNYxsqcloTdSy/rNShjYzMhyjf0LaoftYK0p+A3h40=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZQ=
 github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
@@ -236,6 +238,8 @@ github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
 github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
 github.com/openai/openai-go/v3 v3.50.0 h1:CXn+C8a10oQiI5CMyMbCiykhITVhVxhdHX8j3CfLa2U=
 github.com/openai/openai-go/v3 v3.50.0/go.mod h1:Ogjo0gDct+Jm7yCqaCjLGQGygeV8xNfNHV1/yKvCji0=
+github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
+github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/pb33f/ordered-map/v2 v2.3.1 h1:5319HDO0aw4DA4gzi+zv4FXU9UlSs3xGZ40wcP1nBjY=
 github.com/pb33f/ordered-map/v2 v2.3.1/go.mod h1:qxFQgd0PkVUtOMCkTapqotNgzRhMPL7VvaHKbd1HnmQ=
 github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
diff --git a/hack/agent-substrate/README.md b/hack/agent-substrate/README.md
new file mode 100644
index 000000000..0bd1d2bc0
--- /dev/null
+++ b/hack/agent-substrate/README.md
@@ -0,0 +1,107 @@
+# Agent Substrate evaluation patches
+
+Orka pins Agent Substrate at
+`b80031d260959b1fc5c6f61e3099fe2a6d368af1` for local/CI evaluation. The
+installer clones that immutable revision and applies the reviewed patches in
+this directory before building Substrate. These are evaluation-only
+compatibility and hardening patches; Orka does not install or manage Agent
+Substrate in production. Patch-set changes are not rolled through a live worker
+fleet: the retained-cluster marker binds the exact patch blobs and requires a
+full cluster recreate, so mixed-version snapshot readers and rollback migration
+are intentionally outside this local/CI evaluation contract.
+
+Each patch is fail-closed:
+
+- `scripts/agent-substrate-e2e.sh` verifies the exact upstream Git blob for
+  every existing source file the patch changes.
+- The patch must apply with `--whitespace=error-all` and reverse-apply cleanly.
+- The parsed patch path set must exactly match its declared scope.
+- Focused upstream package tests run before the Kind cluster is created.
+- A different `SUBSTRATE_REF` is rejected unless the blobs and patches are
+  explicitly reviewed and updated together.
+
+## Patch set
+
+### `atelet-root-supervisor-capabilities.patch`
+
+Scopes `CAP_SETUID` and `CAP_SETGID` to the Orka workspace-agent supervisor and
+keeps its extracted root filesystem traversable after the supervisor drops task
+commands to UID/GID 1000.
+
+### `atenet-router-authorization-redaction.patch`
+
+Makes `atenet-router` request logging allowlist-only. Request metadata retains
+only method, sanitized path, host/authority, and request ID; every other header
+is discarded before its normal or `RawValue` content is read. Request-target
+parsing keeps only the escaped path, including for legal absolute-form proxy
+requests. Host/authority values are parsed independently and reject userinfo,
+paths, queries, and fragments, so query credentials and absolute-URI userinfo
+cannot reach logs or the status recorder. Upstream tests cover
+`Authorization`, `Proxy-Authorization`, `Txn-Token`, `Cookie`, `X-API-Key`,
+unknown `RawValue` headers, and query credentials. The patch also lowers Envoy's
+`ext_proc`, router, and upstream component logging from debug to info in both
+the static install manifest and the programmatic runner so the sidecar cannot
+log raw request header tuples before the application-level allowlist boundary.
+
+### `ateom-runsc-delete-recovery.patch`
+
+Hardens the pinned `ateom-gvisor` checkpoint cleanup path:
+
+- prepares a durable recovery directory and points the ordinary checkpoint path
+  at it before `runsc checkpoint` writes any bytes;
+- pins `flate-best-speed` so the stopped sandbox produces exactly one statefile,
+  then validates that file with runsc's own `statefile` reader before cleanup;
+- keeps committed recovery in its original one-file format, then materializes a
+  separate upload view with a hard link to `checkpoint.img` plus explicitly
+  marked `pages.img`/`pages_meta.img` compatibility files. Restore removes only
+  those exact markers (including a surviving half of an interrupted cleanup)
+  while preserving native multi-file snapshots even when pages are empty;
+- reconciles an interrupted commit by checking the pause-container state: a
+  valid statefile plus `stopped` is committed in place, while absent/partial
+  bytes may be discarded only when the sandbox is still `created` or `running`;
+- trusts checkpoint bytes only after atomically writing a deterministic commit
+  inventory covering the statefile mode, size, and SHA-256 digest;
+- stages the atomic commit temporary beside (not inside) the inventoried
+  recovery directory, so a crash cannot turn its orphan into an extra artifact;
+- runs every direct `runsc list` under the PID-1 child-reaper read lock and
+  parses `runsc state` JSON from stdout separately from stderr diagnostics;
+- restores the worker Pod network before fallible `runsc` state/delete cleanup
+  and treats an already-restored interface as an idempotent retry state;
+- converges across partial container deletion by reusing the durable checkpoint
+  instead of checkpointing the stopped sandbox again;
+- retries a failed `runsc delete --force` a bounded four times;
+- after every failed delete, runs `runsc list --quiet` and accepts only an exact,
+  verified absence of the target container;
+- fails closed if checkpoint/container/network state cannot be verified;
+- includes deterministic fake-`runsc` tests for crash-after-checkpoint recovery,
+  two-call cleanup after retry exhaustion, exit-128-after-removal, transient
+  retry success, persistent failure, and verification failure.
+
+With `SUBSTRATE_E2E_EXTENDED=1`, the live E2E deletes an assigned worker and
+verifies store/Deployment replacement, then installs a temporary fail-once
+`runsc` delegator on a live replacement worker. The Actor must suspend through
+the reviewed retry path, the original binary must be restored, and a subsequent
+direct Actor lifecycle must route, execute, suspend, and delete without leaving
+any Actor in `STATUS_SUSPENDING`.
+
+## Validation
+
+Fast repository checks:
+
+```bash
+bash scripts/tests/agent-substrate-patches-test.sh
+bash -n scripts/agent-substrate-e2e.sh hack/demos/cluster/install-substrate.sh
+```
+
+The complete Linux/Kind validation is destructive to a same-named Kind cluster:
+
+```bash
+PATH="$(go env GOPATH)/bin:$PATH" \
+SUBSTRATE_E2E_EXTENDED=1 \
+KEEP_CLUSTER=1 \
+bash scripts/agent-substrate-e2e.sh
+```
+
+Review and update the source blob constants in `scripts/agent-substrate-e2e.sh`
+only after inspecting the replacement upstream source and regenerating the
+corresponding patch.
diff --git a/hack/agent-substrate/atenet-router-authorization-redaction.patch b/hack/agent-substrate/atenet-router-authorization-redaction.patch
new file mode 100644
index 000000000..d222e5825
--- /dev/null
+++ b/hack/agent-substrate/atenet-router-authorization-redaction.patch
@@ -0,0 +1,311 @@
+diff --git a/cmd/servers/atenet/app/router/envoyrunner.go b/cmd/servers/atenet/app/router/envoyrunner.go
+index 8d38be29..593f4a9e 100644
+--- a/cmd/servers/atenet/app/router/envoyrunner.go
++++ b/cmd/servers/atenet/app/router/envoyrunner.go
+@@ -170,7 +170,7 @@ func (r *envoyrunner) reconcileEnvoyDeployment(ctx context.Context) error {
+ 								"-c",
+ 								"/etc/envoy/envoy.yaml",
+ 								"--component-log-level",
+-								"upstream:debug,router:debug,ext_proc:debug",
++								"upstream:info,router:info,ext_proc:info",
+ 							},
+ 							Ports: []corev1.ContainerPort{
+ 								{
+diff --git a/cmd/servers/atenet/app/router/extproc_in.go b/cmd/servers/atenet/app/router/extproc_in.go
+index 31751184..7271d8cf 100644
+--- a/cmd/servers/atenet/app/router/extproc_in.go
++++ b/cmd/servers/atenet/app/router/extproc_in.go
+@@ -17,20 +17,77 @@ package router
+ import (
+ 	"fmt"
+ 	"net"
++	"net/url"
+ 	"strings"
+ 
+ 	"github.com/agent-substrate/substrate/internal/resources"
+ 	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+ )
+ 
++const (
++	invalidRequestPath      = "[invalid]"
++	invalidRequestAuthority = "[invalid]"
++)
++
+ type requestMetadata struct {
+ 	headers map[string]string
+ 	path    string
+ 	host    string
+ }
+ 
++func isSafeRequestMetadataHeader(key string) bool {
++	switch key {
++	case ":method", ":path", ":authority", "host", "x-request-id":
++		return true
++	default:
++		return false
++	}
++}
++
++func sanitizeRequestPath(value string) string {
++	if value == "*" {
++		return value
++	}
++	requestURI, err := url.ParseRequestURI(value)
++	if err != nil {
++		return invalidRequestPath
++	}
++	if requestURI.Opaque != "" {
++		// ParseRequestURI intentionally stores an absolute-form request target in
++		// Opaque. Parse it as a URL only to recover the escaped path; userinfo,
++		// authority, query, and fragment values remain excluded from metadata.
++		requestURI, err = url.Parse(value)
++		if err != nil || requestURI.Scheme == "" || requestURI.Host == "" {
++			return invalidRequestPath
++		}
++	}
++	path := requestURI.EscapedPath()
++	if path == "" {
++		return "/"
++	}
++	return path
++}
++
++func sanitizeRequestAuthority(value string) string {
++	if value == "" {
++		return ""
++	}
++	authority, err := url.Parse("//" + value)
++	if err != nil || authority.Host == "" || authority.User != nil || authority.Path != "" ||
++		authority.RawPath != "" || authority.RawQuery != "" || authority.Fragment != "" {
++		return invalidRequestAuthority
++	}
++	return authority.Host
++}
++
+ func (m *requestMetadata) String() string {
+-	return fmt.Sprintf("%+v", *m)
++	return fmt.Sprintf(
++		"method=%q path=%q host=%q request_id=%q",
++		m.headers[":method"],
++		m.path,
++		m.host,
++		m.headers["x-request-id"],
++	)
+ }
+ 
+ func newRequestMetadata(headers []*corev3.HeaderValue) *requestMetadata {
+@@ -40,18 +97,24 @@ func newRequestMetadata(headers []*corev3.HeaderValue) *requestMetadata {
+ 
+ 	for _, h := range headers {
+ 		k := strings.ToLower(h.Key)
++		if !isSafeRequestMetadataHeader(k) {
++			continue
++		}
++
+ 		val := h.Value
+ 		if val == "" && len(h.RawValue) > 0 {
+ 			val = string(h.RawValue)
+ 		}
+-
+-		headersMap[k] = val
+ 		if k == ":path" {
++			val = sanitizeRequestPath(val)
+ 			path = val
+ 		}
+ 		if k == ":authority" || k == "host" {
++			val = sanitizeRequestAuthority(val)
+ 			host = val
+ 		}
++
++		headersMap[k] = val
+ 	}
+ 
+ 	return &requestMetadata{
+diff --git a/cmd/servers/atenet/app/router/extproc_in_test.go b/cmd/servers/atenet/app/router/extproc_in_test.go
+index 09bb9a4c..e6d2e1e1 100644
+--- a/cmd/servers/atenet/app/router/extproc_in_test.go
++++ b/cmd/servers/atenet/app/router/extproc_in_test.go
+@@ -15,14 +15,15 @@
+ package router
+ 
+ import (
+-	"fmt"
+ 	"reflect"
++	"strings"
+ 	"testing"
+ 
+ 	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+ )
+ 
+ func TestExtractMetadata(t *testing.T) {
++	absoluteFormTarget := "https://example.com/api/v1/a%2Fb?sample=placeholder"
+ 	tests := []struct {
+ 		name        string
+ 		headers     []*corev3.HeaderValue
+@@ -31,13 +32,15 @@ func TestExtractMetadata(t *testing.T) {
+ 		wantHost    string
+ 	}{
+ 		{
+-			name: "basic path and authority",
++			name: "basic safe routing metadata",
+ 			headers: []*corev3.HeaderValue{
++				{Key: ":method", Value: "GET"},
+ 				{Key: ":path", Value: "/api/v1/test"},
+ 				{Key: ":authority", Value: "example.com"},
+ 				{Key: "X-Request-ID", Value: "req-123"},
+ 			},
+ 			wantHeaders: map[string]string{
++				":method":      "GET",
+ 				":path":        "/api/v1/test",
+ 				":authority":   "example.com",
+ 				"x-request-id": "req-123",
+@@ -76,29 +79,62 @@ func TestExtractMetadata(t *testing.T) {
+ 			wantHost: "authority.com",
+ 		},
+ 		{
+-			name: "no authority or host headers",
++			name: "arbitrary headers are omitted",
+ 			headers: []*corev3.HeaderValue{
+ 				{Key: ":path", Value: "/api/v1/test"},
+ 				{Key: "x-something-else", Value: "custom-value"},
++				{Key: "X-Request-ID", RawValue: []byte("req-from-raw-value")},
+ 			},
+ 			wantHeaders: map[string]string{
+-				":path":            "/api/v1/test",
+-				"x-something-else": "custom-value",
++				":path":        "/api/v1/test",
++				"x-request-id": "req-from-raw-value",
+ 			},
+ 			wantPath: "/api/v1/test",
+ 			wantHost: "",
+ 		},
+ 		{
+-			name: "headers are lowercased",
++			name: "credential headers and query values are omitted",
+ 			headers: []*corev3.HeaderValue{
+-				{Key: "UPPER-KEY", Value: "UPPER-VALUE"},
+-				{Key: "camelCaseKey", Value: "camelValue"},
++				{Key: ":method", Value: "POST"},
++				{Key: ":path", RawValue: []byte("/api/v1/test?token=test-token-placeholder")},
++				{Key: ":authority", Value: "example.com"},
++				{Key: "X-Request-ID", Value: "req-credential-test"},
++				{Key: "Authorization", Value: "Bearer test-auth-token"},
++				{Key: "Proxy-Authorization", RawValue: []byte("Basic dummy")},
++				{Key: "Txn-Token", Value: "gateway-token"},
++				{Key: "Cookie", RawValue: []byte("session=sample")},
++				{Key: "X-API-Key", Value: "fake"},
++				{Key: "X-Unrecognized-Raw", RawValue: []byte("not-a-real")},
+ 			},
+ 			wantHeaders: map[string]string{
+-				"upper-key":    "UPPER-VALUE",
+-				"camelcasekey": "camelValue",
++				":method":      "POST",
++				":path":        "/api/v1/test",
++				":authority":   "example.com",
++				"x-request-id": "req-credential-test",
+ 			},
+-			wantPath: "",
++			wantPath: "/api/v1/test",
++			wantHost: "example.com",
++		},
++		{
++			name: "absolute-form request target preserves only escaped path",
++			headers: []*corev3.HeaderValue{
++				{Key: ":path", Value: absoluteFormTarget},
++			},
++			wantHeaders: map[string]string{
++				":path": "/api/v1/a%2Fb",
++			},
++			wantPath: "/api/v1/a%2Fb",
++			wantHost: "",
++		},
++		{
++			name: "invalid request target fails closed",
++			headers: []*corev3.HeaderValue{
++				{Key: ":path", Value: "not a valid request URI"},
++			},
++			wantHeaders: map[string]string{
++				":path": invalidRequestPath,
++			},
++			wantPath: invalidRequestPath,
+ 			wantHost: "",
+ 		},
+ 	}
+@@ -120,18 +156,56 @@ func TestExtractMetadata(t *testing.T) {
+ 	}
+ }
+ 
+-func TestRequestMetadata_String(t *testing.T) {
++func TestSanitizeRequestAuthority(t *testing.T) {
++	userinfoFixture := string([]byte{0x73, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x2d, 0x75, 0x73, 0x65, 0x72, 0x3a, 0x73, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x2d, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x40, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d})
++	for _, test := range []struct {
++		name  string
++		value string
++		want  string
++	}{
++		{name: "host", value: "example.com", want: "example.com"},
++		{name: "host with port", value: "example.com:8443", want: "example.com:8443"},
++		{name: "userinfo", value: userinfoFixture, want: invalidRequestAuthority},
++		{name: "query", value: "example.com?sample=placeholder", want: invalidRequestAuthority},
++	} {
++		t.Run(test.name, func(t *testing.T) {
++			if got := sanitizeRequestAuthority(test.value); got != test.want {
++				t.Fatalf("sanitizeRequestAuthority() = %q, want %q", got, test.want)
++			}
++		})
++	}
++}
++
++func TestRequestMetadataStringOnlyIncludesSafeRoutingMetadata(t *testing.T) {
+ 	headers := []*corev3.HeaderValue{
+-		{Key: ":path", Value: "/api/v1/test"},
++		{Key: ":method", Value: "POST"},
++		{Key: ":path", RawValue: []byte("/api/v1/test")},
+ 		{Key: ":authority", Value: "example.com"},
++		{Key: "X-Request-ID", RawValue: []byte("req-123")},
++		{Key: "Authorization", Value: "Bearer secret-token"},
++		{Key: "Proxy-Authorization", RawValue: []byte("Basic decoy-token")},
++		{Key: "Txn-Token", Value: "matrix_qa_e2ee_cli_gateway"},
++		{Key: "Cookie", RawValue: []byte("session=changeme")},
++		{Key: "X-API-Key", Value: "redacted"},
++		{Key: "X-Unrecognized-Raw", RawValue: []byte("token-oversized")},
+ 	}
+-	m := newRequestMetadata(headers)
+-	str := m.String()
+-	if str == "" {
+-		t.Errorf("expected non-empty string from String()")
++	metadata := newRequestMetadata(headers)
++	got := metadata.String()
++	want := `method="POST" path="/api/v1/test" host="example.com" request_id="req-123"`
++	if got != want {
++		t.Fatalf("String() = %q, want %q", got, want)
+ 	}
+-	if !reflect.DeepEqual(str, fmt.Sprintf("%+v", *m)) {
+-		t.Errorf("String() = %q, want %q", str, fmt.Sprintf("%+v", *m))
++	for _, sensitive := range []string{
++		"secret-token",
++		"decoy-token",
++		"matrix_qa_e2ee_cli_gateway",
++		"changeme",
++		"redacted",
++		"token-oversized",
++	} {
++		if strings.Contains(got, sensitive) {
++			t.Fatalf("String() leaked sensitive value %q: %q", sensitive, got)
++		}
+ 	}
+ }
+ 
+diff --git a/manifests/ate-install/atenet-router.yaml b/manifests/ate-install/atenet-router.yaml
+index e309cad0..74486a9b 100644
+--- a/manifests/ate-install/atenet-router.yaml
++++ b/manifests/ate-install/atenet-router.yaml
+@@ -146,7 +146,7 @@ spec:
+         - "-c"
+         - "/etc/envoy/envoy.yaml"
+         - "--component-log-level"
+-        - "upstream:debug,router:debug,ext_proc:debug"
++        - "upstream:info,router:info,ext_proc:info"
+         ports:
+         - name: http
+           containerPort: 8080
diff --git a/hack/agent-substrate/ateom-runsc-delete-recovery.patch b/hack/agent-substrate/ateom-runsc-delete-recovery.patch
new file mode 100644
index 000000000..6f8fa6ada
--- /dev/null
+++ b/hack/agent-substrate/ateom-runsc-delete-recovery.patch
@@ -0,0 +1,2018 @@
+diff --git a/cmd/servers/ateom-gvisor/ateom-gvisor.go b/cmd/servers/ateom-gvisor/ateom-gvisor.go
+index 7d79dd0a..65b719ed 100644
+--- a/cmd/servers/ateom-gvisor/ateom-gvisor.go
++++ b/cmd/servers/ateom-gvisor/ateom-gvisor.go
+@@ -16,12 +16,19 @@ package main
+ 
+ import (
+ 	"context"
++	"crypto/sha256"
++	"encoding/json"
++	"errors"
+ 	"flag"
+ 	"fmt"
++	"io"
+ 	"log/slog"
+ 	"net"
+ 	"os"
++	"path/filepath"
+ 	"runtime"
++	"sort"
++	"strings"
+ 	"sync"
+ 	"time"
+ 
+@@ -270,58 +277,833 @@ func (s *AteomService) CheckpointWorkload(ctx context.Context, req *ateompb.Chec
+ 	if err := os.MkdirAll(checkpointPath, 0o700); err != nil {
+ 		return nil, fmt.Errorf("while creating checkpoint directory: %w", err)
+ 	}
++	recoveryPath := filepath.Join(
++		ateompath.PIDFileDir(req.GetActorTemplateNamespace(), req.GetActorTemplateName(), req.GetActorId()),
++		checkpointRecoveryDirName,
++	)
++	applicationContainers := make([]string, 0, len(req.GetSpec().GetContainers()))
++	for _, ctr := range req.GetSpec().GetContainers() {
++		applicationContainers = append(applicationContainers, ctr.GetName())
++	}
++
++	if err := checkpointAndCleanup(
++		ctx,
++		rcmd,
++		applicationContainers,
++		checkpointPath,
++		recoveryPath,
++		s.restorePodNetwork,
++	); err != nil {
++		return nil, err
++	}
++
++	s.actorLogger.EmitLifecycleLog("Actor checkpointed", req.GetActorId(), req.GetActorTemplateName(), req.GetActorTemplateNamespace())
++
++	return nil, nil
++}
++
++const (
++	checkpointRecoveryDirName                  = ".checkpoint-delete-recovery-v1"
++	checkpointRecoveryManifestName             = ".checkpoint-delete-recovery-containers"
++	checkpointRecoveryCommitName               = ".checkpoint-delete-recovery-committed"
++	checkpointRecoveryPreparePrefix            = ".checkpoint-delete-recovery-prepare-"
++	checkpointRecoveryCommitPrefix             = ".checkpoint-delete-recovery-commit-"
++	checkpointPagesCompatibilityMarker         = "orka-compressed-pages-placeholder-v1\n"
++	checkpointPagesMetadataCompatibilityMarker = "orka-compressed-pages-metadata-placeholder-v1\n"
++)
++
++type checkpointRuntime interface {
++	cmdCheckpoint(context.Context, string, string) error
++	cmdValidateCheckpoint(context.Context, string) error
++	containerStatus(context.Context, string) (string, error)
++	cmdState(context.Context, string) error
++	cmdDelete(context.Context, string) error
++	containerNames(context.Context) (map[string]struct{}, error)
++}
++
++type podNetworkOps struct {
++	podEth0Present        func(context.Context) (bool, error)
++	interiorEth0Present   func(context.Context) (bool, error)
++	moveInteriorEth0ToPod func(context.Context) error
++}
++
++func checkpointAndCleanup(
++	ctx context.Context,
++	rcmd checkpointRuntime,
++	applicationContainers []string,
++	checkpointPath string,
++	recoveryPath string,
++	restoreNetwork func(context.Context) error,
++) error {
++	orderedContainers, expectedContainers, err := expectedCheckpointContainers(applicationContainers)
++	if err != nil {
++		return fmt.Errorf("invalid checkpoint container set: %w", err)
++	}
++
++	presentContainers, err := rcmd.containerNames(ctx)
++	if err != nil {
++		return fmt.Errorf("failed closed while listing containers before checkpoint cleanup: %w", err)
++	}
++	if err := validatePresentContainers(presentContainers, expectedContainers); err != nil {
++		return err
++	}
++
++	recoveryState, err := inspectCheckpointRecovery(recoveryPath, expectedContainers)
++	if err != nil {
++		return fmt.Errorf("failed closed while validating checkpoint recovery: %w", err)
++	}
++	switch recoveryState {
++	case checkpointRecoveryCommitted:
++		if err := restoreCheckpointRecovery(checkpointPath, recoveryPath, expectedContainers); err != nil {
++			return fmt.Errorf("failed closed while restoring checkpoint recovery: %w", err)
++		}
++	case checkpointRecoveryPrepared:
++		// A prepared recovery has no atomic commit record. Reconcile it against
++		// runsc itself before deciding whether bytes are canonical:
++		//   * a parseable single-file checkpoint plus a stopped sandbox is a
++		//     completed checkpoint whose commit record was interrupted;
++		//   * a running/created sandbox is still safe to checkpoint again, so
++		//     discard any absent or partial bytes;
++		//   * an invalid checkpoint paired with a stopped sandbox is uncertain
++		//     and must fail closed without deleting containers.
++		checkpointErr := rcmd.cmdValidateCheckpoint(ctx, recoveryPath)
++		status, statusErr := rcmd.containerStatus(ctx, "pause")
++		if statusErr != nil {
++			return fmt.Errorf("failed closed while reconciling prepared checkpoint state: %w", statusErr)
++		}
++		switch status {
++		case "stopped":
++			if checkpointErr != nil {
++				return fmt.Errorf("failed closed: stopped sandbox has an invalid uncommitted checkpoint: %w", checkpointErr)
++			}
++			if err := commitCheckpointRecovery(recoveryPath, expectedContainers); err != nil {
++				return fmt.Errorf("failed closed while committing recovered checkpoint: %w", err)
++			}
++			if err := restoreCheckpointRecovery(checkpointPath, recoveryPath, expectedContainers); err != nil {
++				return fmt.Errorf("failed closed while restoring recovered checkpoint: %w", err)
++			}
++		case "created", "running":
++			if !sameContainerSet(presentContainers, expectedContainers) {
++				return fmt.Errorf(
++					"failed closed: partial container state with an uncommitted checkpoint (present=%s expected=%s)",
++					formatContainerSet(presentContainers),
++					formatContainerSet(expectedContainers),
++				)
++			}
++			if err := resetPreparedCheckpointRecovery(checkpointPath, recoveryPath, expectedContainers); err != nil {
++				return fmt.Errorf("failed closed while resetting uncommitted checkpoint recovery: %w", err)
++			}
++			if err := checkpointFreshSandbox(ctx, rcmd, checkpointPath, recoveryPath, expectedContainers); err != nil {
++				return err
++			}
++		default:
++			return fmt.Errorf("failed closed: unsupported pause container state %q while reconciling checkpoint", status)
++		}
++	case checkpointRecoveryAbsent:
++		if !sameContainerSet(presentContainers, expectedContainers) {
++			return fmt.Errorf(
++				"failed closed: partial container state without complete checkpoint recovery (present=%s expected=%s)",
++				formatContainerSet(presentContainers),
++				formatContainerSet(expectedContainers),
++			)
++		}
++		if err := checkpointFreshSandbox(ctx, rcmd, checkpointPath, recoveryPath, expectedContainers); err != nil {
++			return err
++		}
++	default:
++		return fmt.Errorf("failed closed: unknown checkpoint recovery state %d", recoveryState)
++	}
++
++	// Restore the worker Pod network before fallible runsc cleanup. The operation
++	// is state-aware so a retry accepts eth0 only when it is already in the Pod
++	// namespace and absent from the interior namespace.
++	if err := restoreNetwork(ctx); err != nil {
++		return fmt.Errorf("while restoring worker Pod network: %w", err)
++	}
+ 
+-	// Checkpoint pause container (root of the sandbox)
++	presentContainers, err = rcmd.containerNames(ctx)
++	if err != nil {
++		return fmt.Errorf("failed closed while listing containers before state inspection: %w", err)
++	}
++	if err := validatePresentContainers(presentContainers, expectedContainers); err != nil {
++		return err
++	}
++
++	// Check state only for containers that remain. A previous cleanup attempt may
++	// already have removed an application container or the pause container.
++	for _, containerName := range orderedContainers {
++		if _, present := presentContainers[containerName]; !present {
++			continue
++		}
++		if err := rcmd.cmdState(ctx, containerName); err != nil {
++			return fmt.Errorf("while checking state of %q container: %w", containerName, err)
++		}
++	}
++
++	// Delete all application containers that remain.
++	for _, containerName := range orderedContainers[1:] {
++		if _, present := presentContainers[containerName]; !present {
++			continue
++		}
++		if err := rcmd.cmdDelete(ctx, containerName); err != nil {
++			return fmt.Errorf("while deleting %q application container: %w", containerName, err)
++		}
++	}
++
++	// Delete the pause container last when it remains.
++	if _, present := presentContainers["pause"]; present {
++		if err := rcmd.cmdDelete(ctx, "pause"); err != nil {
++			return fmt.Errorf("while deleting pause container: %w", err)
++		}
++	}
++
++	presentContainers, err = rcmd.containerNames(ctx)
++	if err != nil {
++		return fmt.Errorf("failed closed while verifying checkpoint cleanup: %w", err)
++	}
++	if err := validatePresentContainers(presentContainers, expectedContainers); err != nil {
++		return err
++	}
++	if len(presentContainers) != 0 {
++		return fmt.Errorf("failed closed: containers remain after checkpoint cleanup: %s", formatContainerSet(presentContainers))
++	}
++	if err := materializeCheckpointTransport(checkpointPath, recoveryPath); err != nil {
++		return fmt.Errorf("failed closed while materializing checkpoint transport: %w", err)
++	}
++
++	// Keep the recovery copy until atelet uploads the snapshot and resets the
++	// actor directories. This also makes a retry after an upload failure safe.
++	return nil
++}
++
++func checkpointFreshSandbox(
++	ctx context.Context,
++	rcmd checkpointRuntime,
++	checkpointPath string,
++	recoveryPath string,
++	expectedContainers map[string]struct{},
++) error {
++	// Compression is pinned in cmdCheckpoint so runsc produces one statefile
++	// that its own statefile command can validate before the stopped sandbox is
++	// treated as canonical.
++	if err := prepareCheckpointRecovery(checkpointPath, recoveryPath, expectedContainers); err != nil {
++		return fmt.Errorf("failed closed while preparing durable checkpoint recovery: %w", err)
++	}
+ 	if err := rcmd.cmdCheckpoint(ctx, "pause", checkpointPath); err != nil {
+-		return nil, fmt.Errorf("while checkpointing pause: %w", err)
++		return fmt.Errorf("while checkpointing pause into durable recovery: %w", err)
+ 	}
++	if err := rcmd.cmdValidateCheckpoint(ctx, recoveryPath); err != nil {
++		return fmt.Errorf("failed closed while validating runsc checkpoint: %w", err)
++	}
++	status, err := rcmd.containerStatus(ctx, "pause")
++	if err != nil {
++		return fmt.Errorf("failed closed while verifying checkpointed sandbox state: %w", err)
++	}
++	if status != "stopped" {
++		return fmt.Errorf("failed closed: checkpointed pause container state is %q, want stopped", status)
++	}
++	if err := commitCheckpointRecovery(recoveryPath, expectedContainers); err != nil {
++		return fmt.Errorf("failed closed while committing durable checkpoint recovery: %w", err)
++	}
++	return nil
++}
+ 
+-	// Check state of all containers to mimic containerd.
+-	//
+-	// Without this, `runsc delete` occasionally throws an error.
+-	if err := rcmd.cmdState(ctx, "pause"); err != nil {
+-		return nil, fmt.Errorf("while checking state of pause container: %w", err)
++func expectedCheckpointContainers(applicationContainers []string) ([]string, map[string]struct{}, error) {
++	ordered := make([]string, 0, len(applicationContainers)+1)
++	ordered = append(ordered, "pause")
++	expected := map[string]struct{}{"pause": {}}
++	for _, containerName := range applicationContainers {
++		if containerName == "" {
++			return nil, nil, fmt.Errorf("application container name is empty")
++		}
++		if containerName == "pause" {
++			return nil, nil, fmt.Errorf("application container uses reserved name %q", containerName)
++		}
++		if _, duplicate := expected[containerName]; duplicate {
++			return nil, nil, fmt.Errorf("duplicate application container name %q", containerName)
++		}
++		expected[containerName] = struct{}{}
++		ordered = append(ordered, containerName)
+ 	}
+-	for _, ctr := range req.GetSpec().GetContainers() {
+-		if err := rcmd.cmdState(ctx, ctr.GetName()); err != nil {
+-			return nil, fmt.Errorf("while deleting %q application container: %w", ctr.GetName(), err)
++	return ordered, expected, nil
++}
++
++func validatePresentContainers(present, expected map[string]struct{}) error {
++	for containerName := range present {
++		if _, ok := expected[containerName]; !ok {
++			return fmt.Errorf("failed closed: unexpected runsc container %q is present", containerName)
+ 		}
+ 	}
++	return nil
++}
+ 
+-	// Delete all application containers
+-	for _, ctr := range req.GetSpec().GetContainers() {
+-		if err := rcmd.cmdDelete(ctx, ctr.GetName()); err != nil {
+-			return nil, fmt.Errorf("while deleting %q application container: %w", ctr.GetName(), err)
++func sameContainerSet(left, right map[string]struct{}) bool {
++	if len(left) != len(right) {
++		return false
++	}
++	for name := range left {
++		if _, ok := right[name]; !ok {
++			return false
+ 		}
+ 	}
++	return true
++}
++
++func formatContainerSet(containers map[string]struct{}) string {
++	names := make([]string, 0, len(containers))
++	for name := range containers {
++		names = append(names, name)
++	}
++	sort.Strings(names)
++	return strings.Join(names, ",")
++}
++
++func checkpointRecoveryManifest(expected map[string]struct{}) []byte {
++	return []byte(formatContainerSet(expected) + "\n")
++}
++
++type checkpointRecoveryState int
++
++const (
++	checkpointRecoveryAbsent checkpointRecoveryState = iota
++	checkpointRecoveryPrepared
++	checkpointRecoveryCommitted
++)
++
++func inspectCheckpointRecovery(recoveryPath string, expected map[string]struct{}) (checkpointRecoveryState, error) {
++	info, err := os.Lstat(recoveryPath)
++	if errors.Is(err, os.ErrNotExist) {
++		return checkpointRecoveryAbsent, nil
++	}
++	if err != nil {
++		return checkpointRecoveryAbsent, fmt.Errorf("while stating recovery directory: %w", err)
++	}
++	if !info.IsDir() {
++		return checkpointRecoveryAbsent, fmt.Errorf("recovery path %q is not a directory", recoveryPath)
++	}
+ 
+-	// Delete pause container
+-	if err := rcmd.cmdDelete(ctx, "pause"); err != nil {
+-		return nil, fmt.Errorf("while deleting pause container: %w", err)
++	manifestPath := filepath.Join(recoveryPath, checkpointRecoveryManifestName)
++	manifestInfo, err := os.Lstat(manifestPath)
++	if err != nil {
++		return checkpointRecoveryAbsent, fmt.Errorf("while stating recovery manifest: %w", err)
++	}
++	if !manifestInfo.Mode().IsRegular() {
++		return checkpointRecoveryAbsent, fmt.Errorf("recovery manifest is not a regular file")
++	}
++	manifest, err := os.ReadFile(manifestPath)
++	if err != nil {
++		return checkpointRecoveryAbsent, fmt.Errorf("while reading recovery manifest: %w", err)
++	}
++	if string(manifest) != string(checkpointRecoveryManifest(expected)) {
++		return checkpointRecoveryAbsent, fmt.Errorf("recovery manifest does not match requested containers")
+ 	}
+ 
+-	// Yoink eth0 back to the pod netns.
+-	podNetNS, err := netns.Get()
++	commitPath := filepath.Join(recoveryPath, checkpointRecoveryCommitName)
++	commitInfo, err := os.Lstat(commitPath)
++	if errors.Is(err, os.ErrNotExist) {
++		return checkpointRecoveryPrepared, nil
++	}
+ 	if err != nil {
+-		return nil, fmt.Errorf("while getting pod netns: %w", err)
++		return checkpointRecoveryAbsent, fmt.Errorf("while stating recovery commit: %w", err)
+ 	}
+-	err = netNSDo(ctx, s.interiorNetNS, func(ctx context.Context) error {
+-		eth0Link, err := netlink.LinkByName("eth0")
++	if !commitInfo.Mode().IsRegular() {
++		return checkpointRecoveryAbsent, fmt.Errorf("recovery commit is not a regular file")
++	}
++	commit, err := os.ReadFile(commitPath)
++	if err != nil {
++		return checkpointRecoveryAbsent, fmt.Errorf("while reading recovery commit: %w", err)
++	}
++	currentCommit, err := checkpointRecoveryCommit(recoveryPath)
++	if err != nil {
++		return checkpointRecoveryAbsent, err
++	}
++	if string(commit) != string(currentCommit) {
++		return checkpointRecoveryAbsent, fmt.Errorf("recovery checkpoint integrity does not match its commit record")
++	}
++	return checkpointRecoveryCommitted, nil
++}
++
++func validateCheckpointRecovery(recoveryPath string, expected map[string]struct{}) (bool, error) {
++	state, err := inspectCheckpointRecovery(recoveryPath, expected)
++	if err != nil {
++		return false, err
++	}
++	return state == checkpointRecoveryCommitted, nil
++}
++
++type checkpointRecoveryArtifact struct {
++	Path   string `json:"path"`
++	Type   string `json:"type"`
++	Mode   uint32 `json:"mode"`
++	Size   int64  `json:"size,omitempty"`
++	SHA256 string `json:"sha256,omitempty"`
++}
++
++type checkpointRecoveryCommitRecord struct {
++	Version   int                          `json:"version"`
++	Artifacts []checkpointRecoveryArtifact `json:"artifacts"`
++}
++
++func checkpointRecoveryCommit(recoveryPath string) ([]byte, error) {
++	artifacts := make([]checkpointRecoveryArtifact, 0)
++	directories := []string{recoveryPath}
++	checkpointPaths := make([]string, 0, 1)
++	err := filepath.WalkDir(recoveryPath, func(path string, entry os.DirEntry, walkErr error) error {
++		if walkErr != nil {
++			return walkErr
++		}
++		relative, err := filepath.Rel(recoveryPath, path)
+ 		if err != nil {
+-			return fmt.Errorf("while acquiring eth0 in interior netns: %w", err)
++			return fmt.Errorf("while resolving recovery artifact path: %w", err)
++		}
++		if relative == "." {
++			return nil
+ 		}
+-		if err := netlink.LinkSetNsFd(eth0Link, int(podNetNS)); err != nil {
+-			return fmt.Errorf("while sending eth0 back to pod netns: %w", err)
++		relative = filepath.ToSlash(relative)
++		if relative == checkpointRecoveryCommitName {
++			return nil
++		}
++
++		info, err := entry.Info()
++		if err != nil {
++			return fmt.Errorf("while stating recovery artifact %q: %w", relative, err)
++		}
++		mode := info.Mode()
++		if mode&os.ModeSymlink != 0 {
++			return fmt.Errorf("recovery artifact %q is a symlink", relative)
++		}
++		if mode.IsDir() {
++			directories = append(directories, path)
++			artifacts = append(artifacts, checkpointRecoveryArtifact{
++				Path: relative,
++				Type: "directory",
++				Mode: uint32(mode.Perm()),
++			})
++			return nil
++		}
++		if !mode.IsRegular() {
++			return fmt.Errorf("recovery artifact %q is not a regular file or directory", relative)
++		}
++
++		file, err := os.Open(path)
++		if err != nil {
++			return fmt.Errorf("while opening recovery artifact %q: %w", relative, err)
++		}
++		if err := file.Sync(); err != nil {
++			_ = file.Close()
++			return fmt.Errorf("while syncing recovery artifact %q: %w", relative, err)
++		}
++		digest := sha256.New()
++		size, err := io.Copy(digest, file)
++		if err != nil {
++			_ = file.Close()
++			return fmt.Errorf("while hashing recovery artifact %q: %w", relative, err)
++		}
++		if err := file.Close(); err != nil {
++			return fmt.Errorf("while closing recovery artifact %q: %w", relative, err)
++		}
++		artifacts = append(artifacts, checkpointRecoveryArtifact{
++			Path:   relative,
++			Type:   "file",
++			Mode:   uint32(mode.Perm()),
++			Size:   size,
++			SHA256: fmt.Sprintf("%x", digest.Sum(nil)),
++		})
++		if relative != checkpointRecoveryManifestName {
++			checkpointPaths = append(checkpointPaths, relative)
+ 		}
+ 		return nil
+ 	})
+ 	if err != nil {
+-		return nil, fmt.Errorf("while restoring eth0 in interior netns: %w", err)
++		return nil, fmt.Errorf("while inventorying recovery artifacts: %w", err)
++	}
++	sort.Strings(checkpointPaths)
++	if len(checkpointPaths) != 1 || checkpointPaths[0] != "checkpoint.img" {
++		return nil, fmt.Errorf(
++			"recovery checkpoint artifact set is %v, want exactly [checkpoint.img]",
++			checkpointPaths,
++		)
+ 	}
+ 
+-	s.actorLogger.EmitLifecycleLog("Actor checkpointed", req.GetActorId(), req.GetActorTemplateName(), req.GetActorTemplateNamespace())
++	// Sync directory entries from the leaves up before publishing the commit
++	// record. A matching record therefore covers every regular file and directory
++	// that runsc returned, not only checkpoint.img.
++	sort.Slice(directories, func(i, j int) bool {
++		leftDepth := strings.Count(filepath.Clean(directories[i]), string(filepath.Separator))
++		rightDepth := strings.Count(filepath.Clean(directories[j]), string(filepath.Separator))
++		if leftDepth == rightDepth {
++			return directories[i] < directories[j]
++		}
++		return leftDepth > rightDepth
++	})
++	for _, directory := range directories {
++		handle, err := os.Open(directory)
++		if err != nil {
++			return nil, fmt.Errorf("while opening recovery directory for sync: %w", err)
++		}
++		if err := handle.Sync(); err != nil {
++			_ = handle.Close()
++			return nil, fmt.Errorf("while syncing recovery directory: %w", err)
++		}
++		if err := handle.Close(); err != nil {
++			return nil, fmt.Errorf("while closing recovery directory: %w", err)
++		}
++	}
+ 
+-	return nil, nil
++	sort.Slice(artifacts, func(i, j int) bool {
++		return artifacts[i].Path < artifacts[j].Path
++	})
++	commit, err := json.Marshal(checkpointRecoveryCommitRecord{
++		Version:   1,
++		Artifacts: artifacts,
++	})
++	if err != nil {
++		return nil, fmt.Errorf("while encoding recovery commit: %w", err)
++	}
++	return append(commit, '\n'), nil
++}
++
++func writeAtomicRecoveryFile(directory, temporaryDirectory, name, prefix string, data []byte) (retErr error) {
++	temporary, err := os.CreateTemp(temporaryDirectory, prefix)
++	if err != nil {
++		return fmt.Errorf("while creating temporary recovery file: %w", err)
++	}
++	temporaryPath := temporary.Name()
++	defer func() {
++		_ = temporary.Close()
++		if retErr != nil {
++			_ = os.Remove(temporaryPath)
++		}
++	}()
++	if err := temporary.Chmod(0o600); err != nil {
++		return fmt.Errorf("while setting temporary recovery file permissions: %w", err)
++	}
++	if _, err := temporary.Write(data); err != nil {
++		return fmt.Errorf("while writing temporary recovery file: %w", err)
++	}
++	if err := temporary.Sync(); err != nil {
++		return fmt.Errorf("while syncing temporary recovery file: %w", err)
++	}
++	if err := temporary.Close(); err != nil {
++		return fmt.Errorf("while closing temporary recovery file: %w", err)
++	}
++	if err := os.Rename(temporaryPath, filepath.Join(directory, name)); err != nil {
++		return fmt.Errorf("while committing recovery file: %w", err)
++	}
++	if err := syncDirectory(directory); err != nil {
++		return err
++	}
++	if filepath.Clean(temporaryDirectory) != filepath.Clean(directory) {
++		if err := syncDirectory(temporaryDirectory); err != nil {
++			return err
++		}
++	}
++	return nil
++}
++
++func syncDirectory(directory string) error {
++	handle, err := os.Open(directory)
++	if err != nil {
++		return fmt.Errorf("while opening recovery directory for sync: %w", err)
++	}
++	defer handle.Close()
++	if err := handle.Sync(); err != nil {
++		return fmt.Errorf("while syncing recovery directory: %w", err)
++	}
++	return nil
++}
++
++func prepareCheckpointRecovery(checkpointPath, recoveryPath string, expected map[string]struct{}) (retErr error) {
++	if _, err := os.Lstat(recoveryPath); err == nil {
++		return fmt.Errorf("refusing to replace existing recovery path %q", recoveryPath)
++	} else if !errors.Is(err, os.ErrNotExist) {
++		return fmt.Errorf("while checking recovery path: %w", err)
++	}
++	parent := filepath.Dir(recoveryPath)
++	if err := os.MkdirAll(parent, 0o700); err != nil {
++		return fmt.Errorf("while creating recovery parent directory: %w", err)
++	}
++	stagingPath, err := os.MkdirTemp(parent, checkpointRecoveryPreparePrefix)
++	if err != nil {
++		return fmt.Errorf("while creating recovery staging directory: %w", err)
++	}
++	published := false
++	defer func() {
++		if !published || retErr != nil {
++			_ = os.RemoveAll(stagingPath)
++			_ = os.RemoveAll(recoveryPath)
++		}
++	}()
++	if err := writeAtomicRecoveryFile(
++		stagingPath,
++		stagingPath,
++		checkpointRecoveryManifestName,
++		checkpointRecoveryPreparePrefix,
++		checkpointRecoveryManifest(expected),
++	); err != nil {
++		return fmt.Errorf("while writing recovery manifest: %w", err)
++	}
++	if err := os.Rename(stagingPath, recoveryPath); err != nil {
++		return fmt.Errorf("while publishing prepared recovery directory: %w", err)
++	}
++	published = true
++	parentHandle, err := os.Open(parent)
++	if err != nil {
++		return fmt.Errorf("while opening recovery parent for sync: %w", err)
++	}
++	if err := parentHandle.Sync(); err != nil {
++		_ = parentHandle.Close()
++		return fmt.Errorf("while syncing recovery parent: %w", err)
++	}
++	if err := parentHandle.Close(); err != nil {
++		return fmt.Errorf("while closing recovery parent: %w", err)
++	}
++	if err := os.RemoveAll(checkpointPath); err != nil {
++		return fmt.Errorf("while clearing checkpoint path: %w", err)
++	}
++	if err := os.Symlink(recoveryPath, checkpointPath); err != nil {
++		return fmt.Errorf("while linking checkpoint path to recovery: %w", err)
++	}
++	return nil
++}
++
++func commitCheckpointRecovery(recoveryPath string, expected map[string]struct{}) error {
++	state, err := inspectCheckpointRecovery(recoveryPath, expected)
++	if err != nil {
++		return err
++	}
++	if state != checkpointRecoveryPrepared {
++		return fmt.Errorf("recovery state is %d, want prepared", state)
++	}
++	commit, err := checkpointRecoveryCommit(recoveryPath)
++	if err != nil {
++		return err
++	}
++	if err := writeAtomicRecoveryFile(
++		recoveryPath,
++		filepath.Dir(recoveryPath),
++		checkpointRecoveryCommitName,
++		checkpointRecoveryCommitPrefix,
++		commit,
++	); err != nil {
++		return err
++	}
++	state, err = inspectCheckpointRecovery(recoveryPath, expected)
++	if err != nil {
++		return err
++	}
++	if state != checkpointRecoveryCommitted {
++		return fmt.Errorf("recovery state is %d after commit, want committed", state)
++	}
++	return nil
++}
++
++func resetPreparedCheckpointRecovery(checkpointPath, recoveryPath string, expected map[string]struct{}) error {
++	state, err := inspectCheckpointRecovery(recoveryPath, expected)
++	if err != nil {
++		return err
++	}
++	if state != checkpointRecoveryPrepared {
++		return fmt.Errorf("recovery state is %d, want prepared", state)
++	}
++	if err := os.RemoveAll(checkpointPath); err != nil {
++		return fmt.Errorf("while clearing ordinary checkpoint path: %w", err)
++	}
++	if err := os.RemoveAll(recoveryPath); err != nil {
++		return fmt.Errorf("while clearing prepared recovery path: %w", err)
++	}
++	return nil
++}
++
++func restoreCheckpointRecovery(checkpointPath, recoveryPath string, expected map[string]struct{}) error {
++	valid, err := validateCheckpointRecovery(recoveryPath, expected)
++	if err != nil {
++		return err
++	}
++	if !valid {
++		return fmt.Errorf("checkpoint recovery is not committed")
++	}
++	return materializeCheckpointTransport(checkpointPath, recoveryPath)
++}
++
++func materializeCheckpointTransport(checkpointPath, recoveryPath string) error {
++	if err := os.RemoveAll(checkpointPath); err != nil {
++		return fmt.Errorf("while clearing checkpoint transport path: %w", err)
++	}
++	if err := os.MkdirAll(checkpointPath, 0o700); err != nil {
++		return fmt.Errorf("while creating checkpoint transport path: %w", err)
++	}
++	if err := os.Link(
++		filepath.Join(recoveryPath, "checkpoint.img"),
++		filepath.Join(checkpointPath, "checkpoint.img"),
++	); err != nil {
++		return fmt.Errorf("while linking committed checkpoint into transport view: %w", err)
++	}
++	compatibilityArtifacts := map[string]string{
++		"pages.img":      checkpointPagesCompatibilityMarker,
++		"pages_meta.img": checkpointPagesMetadataCompatibilityMarker,
++	}
++	for artifact, marker := range compatibilityArtifacts {
++		if err := writeAtomicRecoveryFile(
++			checkpointPath,
++			checkpointPath,
++			artifact,
++			".checkpoint-transport-",
++			[]byte(marker),
++		); err != nil {
++			return fmt.Errorf("while creating checkpoint transport artifact %s: %w", artifact, err)
++		}
++	}
++	return nil
++}
++
++func (s *AteomService) restorePodNetwork(ctx context.Context) error {
++	ops := podNetworkOps{
++		podEth0Present: func(context.Context) (bool, error) {
++			return linkPresent("eth0")
++		},
++		interiorEth0Present: func(ctx context.Context) (bool, error) {
++			var present bool
++			err := netNSDo(ctx, s.interiorNetNS, func(context.Context) error {
++				var err error
++				present, err = linkPresent("eth0")
++				return err
++			})
++			return present, err
++		},
++		moveInteriorEth0ToPod: func(ctx context.Context) error {
++			podNetNS, err := netns.Get()
++			if err != nil {
++				return fmt.Errorf("while getting pod netns: %w", err)
++			}
++			defer podNetNS.Close()
++			return netNSDo(ctx, s.interiorNetNS, func(context.Context) error {
++				eth0Link, err := netlink.LinkByName("eth0")
++				if err != nil {
++					return fmt.Errorf("while acquiring eth0 in interior netns: %w", err)
++				}
++				if err := netlink.LinkSetNsFd(eth0Link, int(podNetNS)); err != nil {
++					return fmt.Errorf("while sending eth0 back to pod netns: %w", err)
++				}
++				return nil
++			})
++		},
++	}
++	return ensurePodNetwork(ctx, ops)
++}
++
++func ensurePodNetwork(ctx context.Context, ops podNetworkOps) error {
++	podPresent, interiorPresent, err := readPodNetworkState(ctx, ops)
++	if err != nil {
++		return err
++	}
++	switch {
++	case podPresent && !interiorPresent:
++		return nil
++	case !podPresent && interiorPresent:
++		if err := ops.moveInteriorEth0ToPod(ctx); err != nil {
++			return fmt.Errorf("while moving eth0 from interior to pod netns: %w", err)
++		}
++		podPresent, interiorPresent, err = readPodNetworkState(ctx, ops)
++		if err != nil {
++			return fmt.Errorf("failed closed while verifying restored eth0 location: %w", err)
++		}
++		if !podPresent || interiorPresent {
++			return fmt.Errorf(
++				"failed closed: restored eth0 location is uncertain (pod=%t interior=%t)",
++				podPresent,
++				interiorPresent,
++			)
++		}
++		return nil
++	default:
++		return fmt.Errorf(
++			"failed closed: eth0 location is uncertain (pod=%t interior=%t)",
++			podPresent,
++			interiorPresent,
++		)
++	}
++}
++
++func readPodNetworkState(ctx context.Context, ops podNetworkOps) (bool, bool, error) {
++	podPresent, err := ops.podEth0Present(ctx)
++	if err != nil {
++		return false, false, fmt.Errorf("while checking eth0 in pod netns: %w", err)
++	}
++	interiorPresent, err := ops.interiorEth0Present(ctx)
++	if err != nil {
++		return false, false, fmt.Errorf("while checking eth0 in interior netns: %w", err)
++	}
++	return podPresent, interiorPresent, nil
++}
++
++func linkPresent(name string) (bool, error) {
++	_, err := netlink.LinkByName(name)
++	if err == nil {
++		return true, nil
++	}
++	var notFound netlink.LinkNotFoundError
++	if errors.As(err, &notFound) {
++		return false, nil
++	}
++	return false, err
++}
++
++func prepareCheckpointRestore(checkpointDir string) error {
++	type compatibilityArtifact struct {
++		name   string
++		marker string
++	}
++	artifacts := []compatibilityArtifact{
++		{name: "pages.img", marker: checkpointPagesCompatibilityMarker},
++		{name: "pages_meta.img", marker: checkpointPagesMetadataCompatibilityMarker},
++	}
++	present := make([]bool, len(artifacts))
++	compatibility := make([]bool, len(artifacts))
++	for index, artifact := range artifacts {
++		path := filepath.Join(checkpointDir, artifact.name)
++		info, err := os.Lstat(path)
++		if errors.Is(err, os.ErrNotExist) {
++			continue
++		}
++		if err != nil {
++			return fmt.Errorf("while stating %s: %w", artifact.name, err)
++		}
++		if !info.Mode().IsRegular() {
++			return fmt.Errorf("checkpoint artifact %s must be a regular file", artifact.name)
++		}
++		present[index] = true
++		if info.Size() == int64(len(artifact.marker)) {
++			content, err := os.ReadFile(path)
++			if err != nil {
++				return fmt.Errorf("while reading %s: %w", artifact.name, err)
++			}
++			compatibility[index] = string(content) == artifact.marker
++		}
++	}
++
++	anyCompatibility := compatibility[0] || compatibility[1]
++	if anyCompatibility {
++		for index, artifact := range artifacts {
++			if present[index] && !compatibility[index] {
++				return fmt.Errorf("checkpoint mixes compatibility and native page artifacts")
++			}
++			if !present[index] {
++				continue
++			}
++			if err := os.Remove(filepath.Join(checkpointDir, artifact.name)); err != nil {
++				return fmt.Errorf("while removing %s compatibility file: %w", artifact.name, err)
++			}
++		}
++		return nil
++	}
++
++	if present[0] != present[1] {
++		return fmt.Errorf("native checkpoint has only one of pages.img/pages_meta.img")
++	}
++	// Both absent is a native compressed snapshot. Both present is a native
++	// uncompressed snapshot, even when one file is legitimately empty.
++	return nil
+ }
+ 
+ func (s *AteomService) RestoreWorkload(ctx context.Context, req *ateompb.RestoreWorkloadRequest) (*ateompb.RestoreWorkloadResponse, error) {
+@@ -336,6 +1118,11 @@ func (s *AteomService) RestoreWorkload(ctx context.Context, req *ateompb.Restore
+ 	//   * All OCI bundles are set up, including for "pause" container.
+ 	//   * Checkpoint downloaded and placed on disk
+ 
++	checkpointDir := ateompath.CheckpointDir(req.GetActorTemplateNamespace(), req.GetActorTemplateName(), req.GetActorId())
++	if err := prepareCheckpointRestore(checkpointDir); err != nil {
++		return nil, fmt.Errorf("while preparing checkpoint files for restore: %w", err)
++	}
++
+ 	// Move pod eth0 into interior netns
+ 	eth0Link, err := netlink.LinkByName("eth0")
+ 	if err != nil {
+@@ -384,8 +1171,6 @@ func (s *AteomService) RestoreWorkload(ctx context.Context, req *ateompb.Restore
+ 		actorID:                req.GetActorId(),
+ 	}
+ 
+-	checkpointDir := ateompath.CheckpointDir(req.GetActorTemplateNamespace(), req.GetActorTemplateName(), req.GetActorId())
+-
+ 	// Create and restore pause container
+ 	if err := rcmd.cmdCreate(ctx, os.Stdout, "pause"); err != nil {
+ 		return nil, fmt.Errorf("while creating pause container: %w", err)
+diff --git a/cmd/servers/ateom-gvisor/runsc.go b/cmd/servers/ateom-gvisor/runsc.go
+index 6db499a5..00763bfc 100644
+--- a/cmd/servers/ateom-gvisor/runsc.go
++++ b/cmd/servers/ateom-gvisor/runsc.go
+@@ -15,12 +15,18 @@
+ package main
+ 
+ import (
++	"bufio"
++	"bytes"
+ 	"context"
++	"encoding/json"
+ 	"fmt"
+ 	"io"
+ 	"log/slog"
+ 	"os"
+ 	"os/exec"
++	"path/filepath"
++	"strings"
++	"time"
+ 
+ 	"github.com/agent-substrate/substrate/internal/ateompath"
+ )
+@@ -116,6 +122,7 @@ func (r *runsc) cmdCheckpoint(ctx context.Context, containerName, checkpointPath
+ 		"-root", ateompath.RunSCStateDir(r.actorTemplateNamespace, r.actorTemplateName, r.actorID),
+ 		"checkpoint",
+ 		"-image-path", checkpointPath,
++		"-compression=flate-best-speed",
+ 		containerName, // Name of the container
+ 	)
+ 	cmd.Stdout = os.Stdout
+@@ -127,6 +134,64 @@ func (r *runsc) cmdCheckpoint(ctx context.Context, containerName, checkpointPath
+ 	return nil
+ }
+ 
++func (r *runsc) cmdValidateCheckpoint(ctx context.Context, checkpointPath string) error {
++	reapLock.RLock()
++	defer reapLock.RUnlock()
++
++	slog.InfoContext(ctx, "About to validate runsc checkpoint")
++	cmd := exec.CommandContext(
++		ctx,
++		r.path,
++		"-log-format", "json",
++		"--alsologtostderr",
++		"-root", ateompath.RunSCStateDir(r.actorTemplateNamespace, r.actorTemplateName, r.actorID),
++		"statefile",
++		filepath.Join(checkpointPath, "checkpoint.img"),
++	)
++	cmd.Stdout = io.Discard
++	cmd.Stderr = io.Discard
++	if err := cmd.Run(); err != nil {
++		return fmt.Errorf("while validating runsc checkpoint statefile: %w", err)
++	}
++	return nil
++}
++
++func (r *runsc) containerStatus(ctx context.Context, containerName string) (string, error) {
++	reapLock.RLock()
++	defer reapLock.RUnlock()
++
++	var stdout bytes.Buffer
++	var stderr bytes.Buffer
++	cmd := exec.CommandContext(
++		ctx,
++		r.path,
++		"-log-format", "json",
++		"--alsologtostderr",
++		"-root", ateompath.RunSCStateDir(r.actorTemplateNamespace, r.actorTemplateName, r.actorID),
++		"state",
++		containerName,
++	)
++	cmd.Stdout = &stdout
++	cmd.Stderr = &stderr
++	if err := cmd.Run(); err != nil {
++		detail := strings.TrimSpace(stderr.String())
++		if detail != "" {
++			return "", fmt.Errorf("while reading runsc container state: %w: %s", err, detail)
++		}
++		return "", fmt.Errorf("while reading runsc container state: %w", err)
++	}
++	var state struct {
++		Status string `json:"status"`
++	}
++	if err := json.Unmarshal(stdout.Bytes(), &state); err != nil {
++		return "", fmt.Errorf("while parsing runsc container state: %w", err)
++	}
++	if state.Status == "" {
++		return "", fmt.Errorf("runsc container state omitted status")
++	}
++	return strings.ToLower(state.Status), nil
++}
++
+ // We take a checkpoint only of the root container of the sandbox, but we need
+ // to call restore on each container, using the same checkpoint.
+ func (r *runsc) cmdRestore(ctx context.Context, out io.Writer, containerName, checkpointPath string) error {
+@@ -163,33 +228,140 @@ func (r *runsc) cmdRestore(ctx context.Context, out io.Writer, containerName, ch
+ 	return nil
+ }
+ 
++const (
++	runscDeleteAttempts   = 4
++	runscDeleteRetryDelay = 100 * time.Millisecond
++)
++
+ func (r *runsc) cmdDelete(ctx context.Context, containerName string) error {
+ 	reapLock.RLock()
+ 	defer reapLock.RUnlock()
+ 
+-	// token := rand.Text()
+-	// logFile := "/tmp/runsc.delete." + token + ".log"
++	var lastErr error
++	for attempt := 1; attempt <= runscDeleteAttempts; attempt++ {
++		var output bytes.Buffer
++		cmd := exec.CommandContext(
++			ctx,
++			r.path,
++			"-log-format", "json",
++			"--alsologtostderr",
++			// "-debug",
++			"-root", ateompath.RunSCStateDir(r.actorTemplateNamespace, r.actorTemplateName, r.actorID),
++			"delete",
++			"-force",
++			containerName,
++		)
++		cmd.Stdout = &output
++		cmd.Stderr = &output
++
++		runErr := cmd.Run()
++		if runErr != nil {
++			lastErr = fmt.Errorf("while running `runsc delete`: %w", runErr)
++			if detail := strings.TrimSpace(output.String()); detail != "" {
++				lastErr = fmt.Errorf("%w: %s", lastErr, detail)
++			}
++		} else {
++			lastErr = nil
++		}
++
++		present, err := r.containerPresentLocked(ctx, containerName)
++		if err != nil {
++			outcome := "runsc delete exited successfully"
++			if lastErr != nil {
++				outcome = lastErr.Error()
++			}
++			return fmt.Errorf("%s; failed closed while verifying container absence: %w", outcome, err)
++		}
++		if !present {
++			if lastErr != nil {
++				slog.WarnContext(ctx, "runsc delete returned an error after removing the container; accepting verified absence",
++					slog.String("container", containerName),
++					slog.Int("attempt", attempt),
++					slog.Any("err", lastErr))
++			}
++			return nil
++		}
++		if lastErr == nil {
++			lastErr = fmt.Errorf("runsc delete exited successfully but container remains present")
++		}
++		if attempt == runscDeleteAttempts {
++			break
++		}
++
++		slog.WarnContext(ctx, "runsc delete did not remove the container; retrying",
++			slog.String("container", containerName),
++			slog.Int("attempt", attempt),
++			slog.Any("err", lastErr))
++		timer := time.NewTimer(runscDeleteRetryDelay * time.Duration(attempt))
++		select {
++		case <-ctx.Done():
++			if !timer.Stop() {
++				select {
++				case <-timer.C:
++				default:
++				}
++			}
++			return fmt.Errorf("%w; delete retry canceled: %v", lastErr, ctx.Err())
++		case <-timer.C:
++		}
++	}
++
++	return fmt.Errorf("%w after %d attempts; container is still present", lastErr, runscDeleteAttempts)
++}
++
++func (r *runsc) containerPresentLocked(ctx context.Context, containerName string) (bool, error) {
++	containers, err := r.containerNamesLocked(ctx)
++	if err != nil {
++		return false, err
++	}
++	_, present := containers[containerName]
++	return present, nil
++}
+ 
++func (r *runsc) containerNames(ctx context.Context) (map[string]struct{}, error) {
++	reapLock.RLock()
++	defer reapLock.RUnlock()
++	return r.containerNamesLocked(ctx)
++}
++
++func (r *runsc) containerNamesLocked(ctx context.Context) (map[string]struct{}, error) {
++	var stdout bytes.Buffer
++	var stderr bytes.Buffer
+ 	cmd := exec.CommandContext(
+ 		ctx,
+ 		r.path,
+ 		"-log-format", "json",
+ 		"--alsologtostderr",
+-		// "-debug",
+ 		"-root", ateompath.RunSCStateDir(r.actorTemplateNamespace, r.actorTemplateName, r.actorID),
+-		"delete",
+-		"-force",
+-		containerName,
++		"list",
++		"--quiet",
+ 	)
+-	cmd.Stdout = os.Stdout
+-	cmd.Stderr = os.Stderr
+-
+-	err := cmd.Run()
+-	if err != nil {
+-		return fmt.Errorf("while running `runsc delete`: %w", err)
++	cmd.Stdout = &stdout
++	cmd.Stderr = &stderr
++	if err := cmd.Run(); err != nil {
++		detail := strings.TrimSpace(stderr.String())
++		if detail != "" {
++			return nil, fmt.Errorf("while running `runsc list --quiet`: %w: %s", err, detail)
++		}
++		return nil, fmt.Errorf("while running `runsc list --quiet`: %w", err)
+ 	}
+ 
+-	return nil
++	containers := make(map[string]struct{})
++	scanner := bufio.NewScanner(&stdout)
++	for scanner.Scan() {
++		containerName := strings.TrimSpace(scanner.Text())
++		if containerName == "" {
++			continue
++		}
++		if _, duplicate := containers[containerName]; duplicate {
++			return nil, fmt.Errorf("duplicate container %q in `runsc list --quiet` output", containerName)
++		}
++		containers[containerName] = struct{}{}
++	}
++	if err := scanner.Err(); err != nil {
++		return nil, fmt.Errorf("while reading `runsc list --quiet` output: %w", err)
++	}
++	return containers, nil
+ }
+ 
+ func (r *runsc) cmdState(ctx context.Context, containerName string) error {
+diff --git a/cmd/servers/ateom-gvisor/runsc_test.go b/cmd/servers/ateom-gvisor/runsc_test.go
+new file mode 100644
+index 00000000..187aee4f
+--- /dev/null
++++ b/cmd/servers/ateom-gvisor/runsc_test.go
+@@ -0,0 +1,855 @@
++// Copyright 2026 Google LLC
++//
++// Licensed under the Apache License, Version 2.0 (the "License");
++// you may not use this file except in compliance with the License.
++// You may obtain a copy of the License at
++//
++//     http://www.apache.org/licenses/LICENSE-2.0
++//
++// Unless required by applicable law or agreed to in writing, software
++// distributed under the License is distributed on an "AS IS" BASIS,
++// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++// See the License for the specific language governing permissions and
++// limitations under the License.
++
++package main
++
++import (
++	"context"
++	"errors"
++	"os"
++	"path/filepath"
++	"slices"
++	"strconv"
++	"strings"
++	"testing"
++	"time"
++)
++
++func writeFakeRunsc(t *testing.T, mode string, presentContainers ...string) (string, string) {
++	t.Helper()
++
++	stateDir := t.TempDir()
++	if err := os.WriteFile(filepath.Join(stateDir, "mode"), []byte(mode), 0o600); err != nil {
++		t.Fatalf("write mode: %v", err)
++	}
++	if len(presentContainers) > 0 {
++		present := strings.Join(presentContainers, "\n") + "\n"
++		if err := os.WriteFile(filepath.Join(stateDir, "present"), []byte(present), 0o600); err != nil {
++			t.Fatalf("write present state: %v", err)
++		}
++	}
++	if err := os.WriteFile(filepath.Join(stateDir, "status"), []byte("running\n"), 0o600); err != nil {
++		t.Fatalf("write status: %v", err)
++	}
++
++	script := filepath.Join(stateDir, "runsc")
++	const body = `#!/bin/sh
++set -eu
++state_dir="${RUNSC_FAKE_STATE:?}"
++mode="$(cat "$state_dir/mode")"
++command=""
++image_path=""
++previous=""
++last=""
++for arg in "$@"; do
++  if [ "$previous" = "-image-path" ]; then
++    image_path="$arg"
++  fi
++  case "$arg" in
++    checkpoint|delete|list|state|statefile)
++      command="$arg"
++      ;;
++  esac
++  previous="$arg"
++  last="$arg"
++done
++container="$last"
++
++container_present() {
++  [ -f "$state_dir/present" ] && grep -Fxq "$1" "$state_dir/present"
++}
++
++remove_container() {
++  temporary="$state_dir/present.tmp"
++  if [ -f "$state_dir/present" ]; then
++    grep -Fxv "$1" "$state_dir/present" > "$temporary" || true
++    mv "$temporary" "$state_dir/present"
++  fi
++}
++
++increment_counter() {
++  counter_file="$state_dir/$1"
++  count=0
++  if [ -f "$counter_file" ]; then
++    count="$(cat "$counter_file")"
++  fi
++  count=$((count + 1))
++  printf '%s' "$count" > "$counter_file"
++  printf '%s' "$count"
++}
++
++case "$command" in
++  checkpoint)
++    count="$(increment_counter checkpoint-count)"
++    printf '%s\n' "$@" > "$state_dir/checkpoint-args"
++    mkdir -p "$image_path"
++    if [ "$mode" = "checkpoint-partial-once" ] && [ "$count" -eq 1 ]; then
++      printf 'partial-snapshot\n' > "$image_path/checkpoint.img"
++      printf 'running\n' > "$state_dir/status"
++      printf 'simulated interrupted checkpoint\n' >&2
++      exit 74
++    fi
++    printf 'snapshot-%s\n' "$count" > "$image_path/checkpoint.img"
++    printf 'stopped\n' > "$state_dir/status"
++    ;;
++  delete)
++    count="$(increment_counter delete-count-$container)"
++    case "$mode" in
++      absent-after-error)
++        remove_container "$container"
++        printf 'simulated delete exit 128\n' >&2
++        exit 128
++        ;;
++      retry-then-success)
++        if [ "$count" -eq 1 ]; then
++          printf 'simulated transient delete exit 128\n' >&2
++          exit 128
++        fi
++        remove_container "$container"
++        ;;
++      persistent-error|list-error)
++        printf 'simulated persistent delete exit 128\n' >&2
++        exit 128
++        ;;
++      two-call-recovery)
++        if [ "$container" = "app-b" ] && [ "$count" -le 4 ]; then
++          printf 'simulated persistent app-b delete exit 128\n' >&2
++          exit 128
++        fi
++        remove_container "$container"
++        ;;
++      success|checkpoint-partial-once|state-warning)
++        remove_container "$container"
++        ;;
++      success-but-present)
++        ;;
++      *)
++        printf 'unexpected fake runsc mode %s\n' "$mode" >&2
++        exit 65
++        ;;
++    esac
++    ;;
++  list)
++    if [ "$mode" = "list-error" ]; then
++      printf 'simulated list failure\n' >&2
++      exit 2
++    fi
++    if [ -f "$state_dir/present" ]; then
++      cat "$state_dir/present"
++    fi
++    ;;
++  state)
++    if ! container_present "$container"; then
++      printf 'container %s is absent\n' "$container" >&2
++      exit 3
++    fi
++    if [ "$mode" = "state-warning" ]; then
++      printf 'simulated runsc state warning\n' >&2
++    fi
++    status="$(cat "$state_dir/status")"
++    printf '{"id":"%s","status":"%s"}\n' "$container" "$status"
++    ;;
++  statefile)
++    if ! grep -Eq '^snapshot-[0-9]+$' "$container"; then
++      printf 'simulated invalid statefile\n' >&2
++      exit 75
++    fi
++    printf 'valid statefile\n'
++    ;;
++  *)
++    printf 'unexpected fake runsc command\n' >&2
++    exit 64
++    ;;
++esac
++`
++	if err := os.WriteFile(script, []byte(body), 0o700); err != nil {
++		t.Fatalf("write fake runsc: %v", err)
++	}
++	t.Setenv("RUNSC_FAKE_STATE", stateDir)
++	return script, stateDir
++}
++
++func testRunsc(path string) *runsc {
++	return &runsc{
++		path:                   path,
++		actorTemplateNamespace: "test-namespace",
++		actorTemplateName:      "test-template",
++		actorID:                "test-actor",
++	}
++}
++
++func counterValue(t *testing.T, stateDir, name string) int {
++	t.Helper()
++	data, err := os.ReadFile(filepath.Join(stateDir, name))
++	if os.IsNotExist(err) {
++		return 0
++	}
++	if err != nil {
++		t.Fatalf("read counter %s: %v", name, err)
++	}
++	count, err := strconv.Atoi(string(data))
++	if err != nil {
++		t.Fatalf("parse counter %s: %v", name, err)
++	}
++	return count
++}
++
++func presentContainerSet(t *testing.T, stateDir string) map[string]struct{} {
++	t.Helper()
++	data, err := os.ReadFile(filepath.Join(stateDir, "present"))
++	if os.IsNotExist(err) {
++		return map[string]struct{}{}
++	}
++	if err != nil {
++		t.Fatalf("read present containers: %v", err)
++	}
++	containers := make(map[string]struct{})
++	for _, name := range strings.Fields(string(data)) {
++		containers[name] = struct{}{}
++	}
++	return containers
++}
++
++func TestCmdDeleteAcceptsVerifiedAbsenceAfterError(t *testing.T) {
++	path, stateDir := writeFakeRunsc(t, "absent-after-error", "workspace")
++	if err := testRunsc(path).cmdDelete(context.Background(), "workspace"); err != nil {
++		t.Fatalf("cmdDelete() error = %v, want verified absence success", err)
++	}
++	if got := counterValue(t, stateDir, "delete-count-workspace"); got != 1 {
++		t.Fatalf("delete attempts = %d, want 1", got)
++	}
++}
++
++func TestCmdDeleteRetriesWhileContainerRemains(t *testing.T) {
++	path, stateDir := writeFakeRunsc(t, "retry-then-success", "workspace")
++	if err := testRunsc(path).cmdDelete(context.Background(), "workspace"); err != nil {
++		t.Fatalf("cmdDelete() error = %v, want retry success", err)
++	}
++	if got := counterValue(t, stateDir, "delete-count-workspace"); got != 2 {
++		t.Fatalf("delete attempts = %d, want 2", got)
++	}
++}
++
++func TestCmdDeleteFailsClosedWhenContainerRemains(t *testing.T) {
++	path, stateDir := writeFakeRunsc(t, "persistent-error", "workspace")
++	err := testRunsc(path).cmdDelete(context.Background(), "workspace")
++	if err == nil {
++		t.Fatal("cmdDelete() error = nil, want persistent failure")
++	}
++	if !strings.Contains(err.Error(), "container is still present") {
++		t.Fatalf("cmdDelete() error = %q, want presence postcondition", err)
++	}
++	if got := counterValue(t, stateDir, "delete-count-workspace"); got != runscDeleteAttempts {
++		t.Fatalf("delete attempts = %d, want %d", got, runscDeleteAttempts)
++	}
++}
++
++func TestCmdDeleteFailsClosedWhenSuccessLeavesContainerPresent(t *testing.T) {
++	path, stateDir := writeFakeRunsc(t, "success-but-present", "workspace")
++	err := testRunsc(path).cmdDelete(context.Background(), "workspace")
++	if err == nil {
++		t.Fatal("cmdDelete() error = nil, want verified-presence failure")
++	}
++	if !strings.Contains(err.Error(), "exited successfully but container remains present") {
++		t.Fatalf("cmdDelete() error = %q, want successful-exit presence failure", err)
++	}
++	if got := counterValue(t, stateDir, "delete-count-workspace"); got != runscDeleteAttempts {
++		t.Fatalf("delete attempts = %d, want %d", got, runscDeleteAttempts)
++	}
++}
++
++func TestCmdDeleteFailsClosedWhenAbsenceCannotBeVerified(t *testing.T) {
++	path, stateDir := writeFakeRunsc(t, "list-error", "workspace")
++	err := testRunsc(path).cmdDelete(context.Background(), "workspace")
++	if err == nil {
++		t.Fatal("cmdDelete() error = nil, want verification failure")
++	}
++	if !strings.Contains(err.Error(), "failed closed while verifying container absence") {
++		t.Fatalf("cmdDelete() error = %q, want verification failure context", err)
++	}
++	if got := counterValue(t, stateDir, "delete-count-workspace"); got != 1 {
++		t.Fatalf("delete attempts = %d, want 1", got)
++	}
++}
++
++func TestContainerNamesWaitsForReaperReadLock(t *testing.T) {
++	path, _ := writeFakeRunsc(t, "success", "pause")
++	rcmd := testRunsc(path)
++	reapLock.Lock()
++	locked := true
++	defer func() {
++		if locked {
++			reapLock.Unlock()
++		}
++	}()
++	result := make(chan error, 1)
++	go func() {
++		_, err := rcmd.containerNames(context.Background())
++		result <- err
++	}()
++	select {
++	case err := <-result:
++		t.Fatalf("containerNames() returned before reaper lock release: %v", err)
++	case <-time.After(50 * time.Millisecond):
++	}
++	reapLock.Unlock()
++	locked = false
++	select {
++	case err := <-result:
++		if err != nil {
++			t.Fatalf("containerNames() error = %v", err)
++		}
++	case <-time.After(2 * time.Second):
++		t.Fatal("containerNames() remained blocked after reaper lock release")
++	}
++}
++
++func TestContainerStatusIgnoresStderrDiagnostics(t *testing.T) {
++	path, _ := writeFakeRunsc(t, "state-warning", "pause")
++	status, err := testRunsc(path).containerStatus(context.Background(), "pause")
++	if err != nil {
++		t.Fatalf("containerStatus() error = %v", err)
++	}
++	if status != "running" {
++		t.Fatalf("containerStatus() = %q, want running", status)
++	}
++}
++
++func TestCmdCheckpointUsesStoppedSingleFileProtocol(t *testing.T) {
++	path, stateDir := writeFakeRunsc(t, "success", "pause")
++	rcmd := testRunsc(path)
++	checkpointPath := filepath.Join(t.TempDir(), "checkpoint")
++	if err := rcmd.cmdCheckpoint(context.Background(), "pause", checkpointPath); err != nil {
++		t.Fatalf("cmdCheckpoint() error = %v", err)
++	}
++	args, err := os.ReadFile(filepath.Join(stateDir, "checkpoint-args"))
++	if err != nil {
++		t.Fatalf("read checkpoint args: %v", err)
++	}
++	fields := strings.Fields(string(args))
++	if !slices.Contains(fields, "-compression=flate-best-speed") {
++		t.Fatalf("checkpoint args = %q, want pinned single-file compression", string(args))
++	}
++	if slices.Contains(fields, "-leave-running") {
++		t.Fatalf("checkpoint args = %q, must keep the sandbox stopped", string(args))
++	}
++	status, err := rcmd.containerStatus(context.Background(), "pause")
++	if err != nil {
++		t.Fatalf("containerStatus() error = %v", err)
++	}
++	if status != "stopped" {
++		t.Fatalf("checkpointed status = %q, want stopped", status)
++	}
++	if err := rcmd.cmdValidateCheckpoint(context.Background(), checkpointPath); err != nil {
++		t.Fatalf("cmdValidateCheckpoint() error = %v", err)
++	}
++}
++
++func TestCheckpointRecoveryRejectsUnexpectedOrCorruptArtifacts(t *testing.T) {
++	path, _ := writeFakeRunsc(t, "success", "pause", "app")
++	rcmd := testRunsc(path)
++	checkpointPath := filepath.Join(t.TempDir(), "checkpoint")
++	recoveryPath := filepath.Join(t.TempDir(), checkpointRecoveryDirName)
++	if err := os.MkdirAll(checkpointPath, 0o700); err != nil {
++		t.Fatalf("create checkpoint directory: %v", err)
++	}
++	_, expected, err := expectedCheckpointContainers([]string{"app"})
++	if err != nil {
++		t.Fatalf("expectedCheckpointContainers() error = %v", err)
++	}
++	if err := prepareCheckpointRecovery(checkpointPath, recoveryPath, expected); err != nil {
++		t.Fatalf("prepareCheckpointRecovery() error = %v", err)
++	}
++	if err := rcmd.cmdCheckpoint(context.Background(), "pause", checkpointPath); err != nil {
++		t.Fatalf("cmdCheckpoint() error = %v", err)
++	}
++	if err := rcmd.cmdValidateCheckpoint(context.Background(), recoveryPath); err != nil {
++		t.Fatalf("cmdValidateCheckpoint() error = %v", err)
++	}
++
++	extraPath := filepath.Join(recoveryPath, "unexpected.img")
++	if err := os.WriteFile(extraPath, []byte("unexpected\n"), 0o600); err != nil {
++		t.Fatalf("write unexpected checkpoint artifact: %v", err)
++	}
++	if err := commitCheckpointRecovery(recoveryPath, expected); err == nil ||
++		!strings.Contains(err.Error(), "want exactly [checkpoint.img]") {
++		t.Fatalf("commit with unexpected artifact error = %v, want single-file recovery rejection", err)
++	}
++	if err := os.Remove(extraPath); err != nil {
++		t.Fatalf("remove unexpected checkpoint artifact: %v", err)
++	}
++	if err := commitCheckpointRecovery(recoveryPath, expected); err != nil {
++		t.Fatalf("commitCheckpointRecovery() error = %v", err)
++	}
++	if valid, err := validateCheckpointRecovery(recoveryPath, expected); err != nil || !valid {
++		t.Fatalf("committed recovery = valid:%t error:%v, want valid", valid, err)
++	}
++	if err := materializeCheckpointTransport(checkpointPath, recoveryPath); err != nil {
++		t.Fatalf("materializeCheckpointTransport() error = %v", err)
++	}
++	recoveryInfo, err := os.Stat(filepath.Join(recoveryPath, "checkpoint.img"))
++	if err != nil {
++		t.Fatalf("stat recovery checkpoint: %v", err)
++	}
++	transportInfo, err := os.Stat(filepath.Join(checkpointPath, "checkpoint.img"))
++	if err != nil {
++		t.Fatalf("stat transport checkpoint: %v", err)
++	}
++	if !os.SameFile(recoveryInfo, transportInfo) {
++		t.Fatal("transport checkpoint is not linked to committed recovery")
++	}
++	expectedMarkers := map[string]string{
++		"pages.img":      checkpointPagesCompatibilityMarker,
++		"pages_meta.img": checkpointPagesMetadataCompatibilityMarker,
++	}
++	for artifact, marker := range expectedMarkers {
++		content, err := os.ReadFile(filepath.Join(checkpointPath, artifact))
++		if err != nil {
++			t.Fatalf("read transport artifact %s: %v", artifact, err)
++		}
++		if string(content) != marker {
++			t.Fatalf("transport artifact %s = %q, want compatibility marker", artifact, content)
++		}
++		if _, err := os.Stat(filepath.Join(recoveryPath, artifact)); !errors.Is(err, os.ErrNotExist) {
++			t.Fatalf("recovery unexpectedly contains transport artifact %s: %v", artifact, err)
++		}
++	}
++
++	checkpointPath = filepath.Join(recoveryPath, "checkpoint.img")
++	if err := os.WriteFile(checkpointPath, []byte("truncated\n"), 0o600); err != nil {
++		t.Fatalf("corrupt checkpoint statefile: %v", err)
++	}
++	if valid, err := validateCheckpointRecovery(recoveryPath, expected); err == nil || valid ||
++		!strings.Contains(err.Error(), "integrity") {
++		t.Fatalf("corrupted recovery = valid:%t error:%v, want integrity failure", valid, err)
++	}
++}
++
++func TestCheckpointRecoveryReconcilesPreparationBeforeCheckpoint(t *testing.T) {
++	path, stateDir := writeFakeRunsc(t, "success", "pause", "app")
++	rcmd := testRunsc(path)
++	checkpointPath := filepath.Join(t.TempDir(), "checkpoint")
++	recoveryPath := filepath.Join(t.TempDir(), checkpointRecoveryDirName)
++	if err := os.MkdirAll(checkpointPath, 0o700); err != nil {
++		t.Fatalf("create checkpoint directory: %v", err)
++	}
++	_, expected, err := expectedCheckpointContainers([]string{"app"})
++	if err != nil {
++		t.Fatalf("expectedCheckpointContainers() error = %v", err)
++	}
++	if err := prepareCheckpointRecovery(checkpointPath, recoveryPath, expected); err != nil {
++		t.Fatalf("prepareCheckpointRecovery() error = %v", err)
++	}
++
++	// Simulate a crash after durable preparation but before runsc starts, then
++	// atelet clearing and recreating only the ordinary checkpoint path.
++	if err := os.RemoveAll(checkpointPath); err != nil {
++		t.Fatalf("clear ordinary checkpoint path: %v", err)
++	}
++	if err := os.MkdirAll(checkpointPath, 0o700); err != nil {
++		t.Fatalf("recreate ordinary checkpoint path: %v", err)
++	}
++	if err := checkpointAndCleanup(
++		context.Background(),
++		rcmd,
++		[]string{"app"},
++		checkpointPath,
++		recoveryPath,
++		func(context.Context) error { return nil },
++	); err != nil {
++		t.Fatalf("checkpointAndCleanup() preparation recovery error = %v", err)
++	}
++	if got := counterValue(t, stateDir, "checkpoint-count"); got != 1 {
++		t.Fatalf("checkpoint attempts = %d, want one fresh checkpoint after preparation recovery", got)
++	}
++	if valid, err := validateCheckpointRecovery(recoveryPath, expected); err != nil || !valid {
++		t.Fatalf("checkpoint recovery after preparation retry = valid:%t error:%v, want committed", valid, err)
++	}
++}
++
++func TestCheckpointRecoveryReconcilesUncommittedSuccessfulCheckpoint(t *testing.T) {
++	path, stateDir := writeFakeRunsc(t, "success", "pause", "app")
++	rcmd := testRunsc(path)
++	checkpointPath := filepath.Join(t.TempDir(), "checkpoint")
++	recoveryPath := filepath.Join(t.TempDir(), checkpointRecoveryDirName)
++	if err := os.MkdirAll(checkpointPath, 0o700); err != nil {
++		t.Fatalf("create checkpoint directory: %v", err)
++	}
++	_, expected, err := expectedCheckpointContainers([]string{"app"})
++	if err != nil {
++		t.Fatalf("expectedCheckpointContainers() error = %v", err)
++	}
++
++	// Simulate a crash after runsc returned success but before the service could
++	// atomically write the digest-backed commit record. The sandbox is stopped,
++	// so the retry must validate the runsc statefile and commit the existing
++	// snapshot rather than attempting an unsafe second checkpoint.
++	if err := prepareCheckpointRecovery(checkpointPath, recoveryPath, expected); err != nil {
++		t.Fatalf("prepareCheckpointRecovery() error = %v", err)
++	}
++	if err := rcmd.cmdCheckpoint(context.Background(), "pause", checkpointPath); err != nil {
++		t.Fatalf("cmdCheckpoint() error = %v", err)
++	}
++	if state, err := inspectCheckpointRecovery(recoveryPath, expected); err != nil || state != checkpointRecoveryPrepared {
++		t.Fatalf("recovery before commit = state:%d error:%v, want prepared", state, err)
++	}
++	if err := os.RemoveAll(checkpointPath); err != nil {
++		t.Fatalf("clear ordinary checkpoint path: %v", err)
++	}
++	if err := os.MkdirAll(checkpointPath, 0o700); err != nil {
++		t.Fatalf("recreate ordinary checkpoint path: %v", err)
++	}
++	if err := checkpointAndCleanup(
++		context.Background(),
++		rcmd,
++		[]string{"app"},
++		checkpointPath,
++		recoveryPath,
++		func(context.Context) error { return nil },
++	); err != nil {
++		t.Fatalf("checkpointAndCleanup() uncommitted recovery error = %v", err)
++	}
++	if got := counterValue(t, stateDir, "checkpoint-count"); got != 1 {
++		t.Fatalf("checkpoint attempts = %d, want validated uncommitted snapshot reuse", got)
++	}
++	checkpoint, err := os.ReadFile(filepath.Join(checkpointPath, "checkpoint.img"))
++	if err != nil {
++		t.Fatalf("read recovered checkpoint: %v", err)
++	}
++	if got, want := string(checkpoint), "snapshot-1\n"; got != want {
++		t.Fatalf("recovered checkpoint = %q, want %q", got, want)
++	}
++	if valid, err := validateCheckpointRecovery(recoveryPath, expected); err != nil || !valid {
++		t.Fatalf("checkpoint recovery after uncommitted retry = valid:%t error:%v, want committed", valid, err)
++	}
++}
++
++func TestCheckpointRecoveryReconcilesInterruptedWrite(t *testing.T) {
++	path, stateDir := writeFakeRunsc(t, "checkpoint-partial-once", "pause", "app")
++	rcmd := testRunsc(path)
++	checkpointPath := filepath.Join(t.TempDir(), "checkpoint")
++	recoveryPath := filepath.Join(t.TempDir(), checkpointRecoveryDirName)
++	if err := os.MkdirAll(checkpointPath, 0o700); err != nil {
++		t.Fatalf("create checkpoint directory: %v", err)
++	}
++	networkRestores := 0
++	restoreNetwork := func(context.Context) error {
++		networkRestores++
++		return nil
++	}
++
++	err := checkpointAndCleanup(
++		context.Background(),
++		rcmd,
++		[]string{"app"},
++		checkpointPath,
++		recoveryPath,
++		restoreNetwork,
++	)
++	if err == nil || !strings.Contains(err.Error(), "exit status 74") {
++		t.Fatalf("first checkpointAndCleanup() error = %v, want interrupted checkpoint exit", err)
++	}
++	if networkRestores != 0 {
++		t.Fatalf("network restores after interrupted checkpoint = %d, want 0", networkRestores)
++	}
++	if got, want := formatContainerSet(presentContainerSet(t, stateDir)), "app,pause"; got != want {
++		t.Fatalf("present containers after interrupted checkpoint = %q, want %q", got, want)
++	}
++	_, expected, err := expectedCheckpointContainers([]string{"app"})
++	if err != nil {
++		t.Fatalf("expectedCheckpointContainers() error = %v", err)
++	}
++	if state, err := inspectCheckpointRecovery(recoveryPath, expected); err != nil || state != checkpointRecoveryPrepared {
++		t.Fatalf("interrupted recovery = state:%d error:%v, want prepared", state, err)
++	}
++
++	if err := os.RemoveAll(checkpointPath); err != nil {
++		t.Fatalf("clear ordinary checkpoint path: %v", err)
++	}
++	if err := os.MkdirAll(checkpointPath, 0o700); err != nil {
++		t.Fatalf("recreate ordinary checkpoint path: %v", err)
++	}
++	if err := checkpointAndCleanup(
++		context.Background(),
++		rcmd,
++		[]string{"app"},
++		checkpointPath,
++		recoveryPath,
++		restoreNetwork,
++	); err != nil {
++		t.Fatalf("second checkpointAndCleanup() error = %v, want fresh checkpoint success", err)
++	}
++	if got := counterValue(t, stateDir, "checkpoint-count"); got != 2 {
++		t.Fatalf("checkpoint attempts = %d, want retry after discarding partial bytes", got)
++	}
++	if networkRestores != 1 {
++		t.Fatalf("network restores after retry = %d, want 1", networkRestores)
++	}
++	checkpoint, err := os.ReadFile(filepath.Join(checkpointPath, "checkpoint.img"))
++	if err != nil {
++		t.Fatalf("read recovered checkpoint: %v", err)
++	}
++	if got, want := string(checkpoint), "snapshot-2\n"; got != want {
++		t.Fatalf("recovered checkpoint = %q, want %q", got, want)
++	}
++	if valid, err := validateCheckpointRecovery(recoveryPath, expected); err != nil || !valid {
++		t.Fatalf("checkpoint recovery after interrupted write = valid:%t error:%v, want committed", valid, err)
++	}
++}
++
++func TestCheckpointCleanupConvergesAfterDeleteRetryExhaustion(t *testing.T) {
++	path, stateDir := writeFakeRunsc(t, "two-call-recovery", "pause", "app-a", "app-b")
++	rcmd := testRunsc(path)
++	checkpointPath := filepath.Join(t.TempDir(), "checkpoint")
++	recoveryPath := filepath.Join(t.TempDir(), checkpointRecoveryDirName)
++	if err := os.MkdirAll(checkpointPath, 0o700); err != nil {
++		t.Fatalf("create checkpoint directory: %v", err)
++	}
++
++	podHasEth0 := false
++	interiorHasEth0 := true
++	networkMoves := 0
++	restoreNetwork := func(ctx context.Context) error {
++		return ensurePodNetwork(ctx, podNetworkOps{
++			podEth0Present: func(context.Context) (bool, error) {
++				return podHasEth0, nil
++			},
++			interiorEth0Present: func(context.Context) (bool, error) {
++				return interiorHasEth0, nil
++			},
++			moveInteriorEth0ToPod: func(context.Context) error {
++				networkMoves++
++				podHasEth0 = true
++				interiorHasEth0 = false
++				return nil
++			},
++		})
++	}
++
++	err := checkpointAndCleanup(
++		context.Background(),
++		rcmd,
++		[]string{"app-a", "app-b"},
++		checkpointPath,
++		recoveryPath,
++		restoreNetwork,
++	)
++	if err == nil {
++		t.Fatal("first checkpointAndCleanup() error = nil, want exhausted delete retries")
++	}
++	if !strings.Contains(err.Error(), "container is still present") {
++		t.Fatalf("first checkpointAndCleanup() error = %q, want exhausted presence postcondition", err)
++	}
++	if got := counterValue(t, stateDir, "delete-count-app-b"); got != runscDeleteAttempts {
++		t.Fatalf("first-call app-b delete attempts = %d, want %d", got, runscDeleteAttempts)
++	}
++	if got, want := formatContainerSet(presentContainerSet(t, stateDir)), "app-b,pause"; got != want {
++		t.Fatalf("present containers after first call = %q, want %q", got, want)
++	}
++	if networkMoves != 1 || !podHasEth0 || interiorHasEth0 {
++		t.Fatalf("network after first call = moves:%d pod:%t interior:%t, want 1,true,false", networkMoves, podHasEth0, interiorHasEth0)
++	}
++	if got := counterValue(t, stateDir, "checkpoint-count"); got != 1 {
++		t.Fatalf("checkpoint attempts after first call = %d, want 1", got)
++	}
++
++	// Atelet removes and recreates the normal checkpoint directory before every
++	// RPC retry. The second call must repopulate it from recovery rather than
++	// checkpointing a workload whose app-a container is already absent.
++	if err := os.RemoveAll(checkpointPath); err != nil {
++		t.Fatalf("clear checkpoint directory: %v", err)
++	}
++	if err := os.MkdirAll(checkpointPath, 0o700); err != nil {
++		t.Fatalf("recreate checkpoint directory: %v", err)
++	}
++
++	if err := checkpointAndCleanup(
++		context.Background(),
++		rcmd,
++		[]string{"app-a", "app-b"},
++		checkpointPath,
++		recoveryPath,
++		restoreNetwork,
++	); err != nil {
++		t.Fatalf("second checkpointAndCleanup() error = %v, want recovery success", err)
++	}
++	if got := counterValue(t, stateDir, "checkpoint-count"); got != 1 {
++		t.Fatalf("checkpoint attempts after second call = %d, want preserved first checkpoint", got)
++	}
++	if got := counterValue(t, stateDir, "delete-count-app-b"); got != runscDeleteAttempts+1 {
++		t.Fatalf("total app-b delete attempts = %d, want %d", got, runscDeleteAttempts+1)
++	}
++	if got := len(presentContainerSet(t, stateDir)); got != 0 {
++		t.Fatalf("present container count after recovery = %d, want 0", got)
++	}
++	if networkMoves != 1 {
++		t.Fatalf("network moves after second call = %d, want already-restored no-op", networkMoves)
++	}
++	checkpoint, err := os.ReadFile(filepath.Join(checkpointPath, "checkpoint.img"))
++	if err != nil {
++		t.Fatalf("read restored checkpoint: %v", err)
++	}
++	if got, want := string(checkpoint), "snapshot-1\n"; got != want {
++		t.Fatalf("restored checkpoint = %q, want %q", got, want)
++	}
++	if valid, err := validateCheckpointRecovery(recoveryPath, map[string]struct{}{
++		"pause": {},
++		"app-a": {},
++		"app-b": {},
++	}); err != nil || !valid {
++		t.Fatalf("checkpoint recovery after success = valid:%t error:%v, want retained valid copy", valid, err)
++	}
++}
++
++func TestCheckpointCleanupFailsClosedOnPartialStateWithoutRecovery(t *testing.T) {
++	path, stateDir := writeFakeRunsc(t, "success", "pause", "app-b")
++	checkpointPath := filepath.Join(t.TempDir(), "checkpoint")
++	recoveryPath := filepath.Join(t.TempDir(), checkpointRecoveryDirName)
++	if err := os.MkdirAll(checkpointPath, 0o700); err != nil {
++		t.Fatalf("create checkpoint directory: %v", err)
++	}
++	networkCalled := false
++	err := checkpointAndCleanup(
++		context.Background(),
++		testRunsc(path),
++		[]string{"app-a", "app-b"},
++		checkpointPath,
++		recoveryPath,
++		func(context.Context) error {
++			networkCalled = true
++			return nil
++		},
++	)
++	if err == nil {
++		t.Fatal("checkpointAndCleanup() error = nil, want partial-state failure")
++	}
++	if !strings.Contains(err.Error(), "partial container state without complete checkpoint recovery") {
++		t.Fatalf("checkpointAndCleanup() error = %q, want fail-closed partial-state context", err)
++	}
++	if got := counterValue(t, stateDir, "checkpoint-count"); got != 0 {
++		t.Fatalf("checkpoint attempts = %d, want 0 before uncertain state is rejected", got)
++	}
++	if networkCalled {
++		t.Fatal("network restoration ran for uncertain partial state")
++	}
++}
++
++func TestEnsurePodNetworkFailsClosedOnUncertainLocation(t *testing.T) {
++	for _, test := range []struct {
++		name     string
++		pod      bool
++		interior bool
++	}{
++		{name: "missing from both namespaces", pod: false, interior: false},
++		{name: "present in both namespaces", pod: true, interior: true},
++	} {
++		t.Run(test.name, func(t *testing.T) {
++			moved := false
++			err := ensurePodNetwork(context.Background(), podNetworkOps{
++				podEth0Present: func(context.Context) (bool, error) {
++					return test.pod, nil
++				},
++				interiorEth0Present: func(context.Context) (bool, error) {
++					return test.interior, nil
++				},
++				moveInteriorEth0ToPod: func(context.Context) error {
++					moved = true
++					return nil
++				},
++			})
++			if err == nil || !strings.Contains(err.Error(), "failed closed") {
++				t.Fatalf("ensurePodNetwork() error = %v, want fail-closed uncertainty", err)
++			}
++			if moved {
++				t.Fatal("ensurePodNetwork() moved eth0 from an uncertain state")
++			}
++		})
++	}
++}
++
++func TestPrepareCheckpointRestoreRemovesMarkedCompatibilityFiles(t *testing.T) {
++	dir := t.TempDir()
++	if err := os.WriteFile(filepath.Join(dir, "checkpoint.img"), []byte("checkpoint\n"), 0o600); err != nil {
++		t.Fatalf("write checkpoint: %v", err)
++	}
++	compatibility := map[string]string{
++		"pages.img":      checkpointPagesCompatibilityMarker,
++		"pages_meta.img": checkpointPagesMetadataCompatibilityMarker,
++	}
++	for name, marker := range compatibility {
++		if err := os.WriteFile(filepath.Join(dir, name), []byte(marker), 0o600); err != nil {
++			t.Fatalf("write %s: %v", name, err)
++		}
++	}
++	if err := prepareCheckpointRestore(dir); err != nil {
++		t.Fatalf("prepareCheckpointRestore() error = %v", err)
++	}
++	for name := range compatibility {
++		if _, err := os.Stat(filepath.Join(dir, name)); !errors.Is(err, os.ErrNotExist) {
++			t.Fatalf("compatibility file %s still exists: %v", name, err)
++		}
++	}
++}
++
++func TestPrepareCheckpointRestoreRecoversPartialCompatibilityCleanup(t *testing.T) {
++	dir := t.TempDir()
++	if err := os.WriteFile(
++		filepath.Join(dir, "pages_meta.img"),
++		[]byte(checkpointPagesMetadataCompatibilityMarker),
++		0o600,
++	); err != nil {
++		t.Fatalf("write surviving compatibility marker: %v", err)
++	}
++	if err := prepareCheckpointRestore(dir); err != nil {
++		t.Fatalf("prepareCheckpointRestore() partial cleanup error = %v", err)
++	}
++	if _, err := os.Stat(filepath.Join(dir, "pages_meta.img")); !errors.Is(err, os.ErrNotExist) {
++		t.Fatalf("surviving compatibility file still exists: %v", err)
++	}
++}
++
++func TestPrepareCheckpointRestorePreservesNativeMultiFileSnapshot(t *testing.T) {
++	dir := t.TempDir()
++	for _, file := range []struct {
++		name string
++		data string
++	}{
++		{name: "checkpoint.img", data: "checkpoint\n"},
++		{name: "pages.img", data: ""},
++		{name: "pages_meta.img", data: "metadata\n"},
++	} {
++		if err := os.WriteFile(filepath.Join(dir, file.name), []byte(file.data), 0o600); err != nil {
++			t.Fatalf("write %s: %v", file.name, err)
++		}
++	}
++	if err := prepareCheckpointRestore(dir); err != nil {
++		t.Fatalf("prepareCheckpointRestore() error = %v", err)
++	}
++	if info, err := os.Stat(filepath.Join(dir, "pages.img")); err != nil || info.Size() != 0 {
++		t.Fatalf("native empty pages.img = info:%v error:%v, want preserved empty file", info, err)
++	}
++	if info, err := os.Stat(filepath.Join(dir, "pages_meta.img")); err != nil || info.Size() == 0 {
++		t.Fatalf("native pages_meta.img = info:%v error:%v, want preserved nonempty file", info, err)
++	}
++}
++
++func TestPrepareCheckpointRestoreRejectsPartialNativeState(t *testing.T) {
++	dir := t.TempDir()
++	if err := os.WriteFile(filepath.Join(dir, "pages.img"), []byte("native-pages\n"), 0o600); err != nil {
++		t.Fatalf("write pages.img: %v", err)
++	}
++	if err := prepareCheckpointRestore(dir); err == nil {
++		t.Fatal("prepareCheckpointRestore() error = nil, want missing native metadata failure")
++	}
++}
diff --git a/hack/demos/README.md b/hack/demos/README.md
index dcc8047e6..c690b5831 100644
--- a/hack/demos/README.md
+++ b/hack/demos/README.md
@@ -6,8 +6,9 @@ This directory contains a small `demo-magic` kit for showing Orka in six ways:
 - `20-manual-workflow.sh`: explicit coordinator Task CR for a focused Vekil metrics first-PR workflow
 - `30-cron-workflow.sh`: scheduled runtime task with recurring child runs
 - `40-security-scanning.sh`: repository scan -> findings -> patch -> PR
-- `60-agent-sandbox.sh`: three turns share a single SandboxClaim via `sessionRef` (scout -> builder -> CI fixup, same workspace)
-- `70-agent-substrate.sh`: a real gpt-5.5 codex agent in a gVisor Actor (Agent Substrate) clones a repo, edits it, and opens a PR; a second task reuses the warm workspace with no cold start
+- `50-kontxt.sh`: workload SA token -> in-cluster TTS -> request-scoped TxToken -> Orka API call (one identity, two outcomes)
+- `60-agent-sandbox.sh`: archived execution-workspace prototype; not a current ACP v2 path
+- `70-agent-substrate.sh`: archived Substrate prototype; requires an Actor-backed v2 supervisor before it is supported again
 
 There is also:
 
@@ -21,7 +22,7 @@ There is also:
 - Optional: an upstream `demo-magic.sh` if you want to override the vendored fallback
 - A demo namespace that is not the controller namespace
 - A Provider CRD and runtime credential Secret in that demo namespace
-- A git credential Secret in that demo namespace for clone, push, and PR creation
+- Separate read/clone and publication/forge credential Secrets for any ACP workspace demo. The archived 60/70 scripts still assume one broad Git Secret and must be migrated before use.
 
 The demo scripts include a lightweight `demo-magic.sh` fallback at `hack/demos/lib/demo-magic.sh`, so no separate checkout is required. If you prefer the upstream `demo-magic` behavior, set `DEMO_MAGIC_PATH` to your local checkout. If `DEMO_MAGIC_PATH` points at a missing file, the scripts ignore it and use the vendored fallback.
 
@@ -119,7 +120,7 @@ spec:
 YAML
 ```
 
-Create the runtime credential Secret for the Agent runtime. Codex accepts `OPENAI_API_KEY` or `CODEX_API_KEY`; Copilot accepts `GITHUB_TOKEN`; Claude accepts `ANTHROPIC_API_KEY`.
+Create the provider/proxy credential Secret for the ACP runtime. Keep this role separate from both Git read and publication credentials. Codex accepts `OPENAI_API_KEY` or `CODEX_API_KEY`; Copilot accepts `GITHUB_TOKEN`; Claude accepts `ANTHROPIC_API_KEY`.
 
 ```bash
 # Codex example:
@@ -133,12 +134,15 @@ kubectl -n "$DEMO_NAMESPACE" create secret generic "$DEMO_RUNTIME_SECRET_REF" \
 #   --dry-run=client -o yaml | kubectl apply -f -
 ```
 
-Create the git credential Secret used for clone, push, and PR creation:
+For current ACP manifests, create separate repository credentials. The clean-room workspace boundary uses the read Secret; the Workspace/Publisher alone uses the publication Secret:
 
 ```bash
-kubectl -n "$DEMO_NAMESPACE" create secret generic "$DEMO_GIT_SECRET_REF" \
-  --from-literal=username='<git-username-or-oauth2>' \
-  --from-literal=password='<git-token>' \
+kubectl -n "$DEMO_NAMESPACE" create secret generic repository-read \
+  --from-literal=token='<read-only-repository-token>' \
+  --dry-run=client -o yaml | kubectl apply -f -
+
+kubectl -n "$DEMO_NAMESPACE" create secret generic repository-publish \
+  --from-literal=token='<branch-and-pr-publication-token>' \
   --dry-run=client -o yaml | kubectl apply -f -
 ```
 
@@ -283,11 +287,10 @@ source hack/demos/cluster/demo-env.sh
 make demo-cluster-up-all-down     # tear it all down
 ```
 
-Notes: `install-agent-sandbox.sh` runs **last** in the bootstrap because it sets
-the controller's default workspace provider to `agent-sandbox` (Demo 60 relies
-on that default). Demo 70 sets `provider: substrate` explicitly, while the
-model-backed demos continue to use their normal ServiceAccount authentication,
-so the scenarios coexist safely.
+Notes: the agent-sandbox/Substrate bootstrap and demos are retained only for
+prototype archaeology. Current ACP v2 validation must not set a default execution
+workspace provider or rely on a per-Task worker path. kontxt's `enforce` mode only
+gates requests carrying a `Txn-Token`, so the other demos remain independent.
 
 Known flake (Demo 70): the warm-reuse Task occasionally fails during workspace
 release with a gVisor `RestoreWorkload: ... eth0: Link not found` daemon error
diff --git a/hack/demos/RECORDING.md b/hack/demos/RECORDING.md
index 7a39470a9..e8cadf679 100644
--- a/hack/demos/RECORDING.md
+++ b/hack/demos/RECORDING.md
@@ -1,5 +1,7 @@
 # Demo recording design
 
+> **ACP v2 cutover:** the Demo 60/70 storyboards below capture a retired execution-workspace prototype. Current built-in agent Tasks use RuntimePools, top-level `spec.workspace`, and the separate Workspace/Publisher. Keep these storyboards archived until the scripts and manifests are rebuilt around an ACP v2 supervisor; they are not release evidence.
+
 This is the design doc for turning `hack/demos/` from a presenter rehearsal kit
 into a small, tasteful library of recorded terminal demos. The goal is to
 publish a handful of artifacts that hold up on the README, in the docs, and on
@@ -69,8 +71,9 @@ Six demos total. Four exist; two are new.
 | 20 | YAML workflow | `20-manual-workflow.sh` | exists, needs polish | Same payload, declarative `Task` CR — GitOps-friendly |
 | 30 | Scheduled workflow | `30-cron-workflow.sh` | exists, needs polish | Cron-scheduled stale-PR triage report |
 | 40 | Security remediation | `40-security-scanning.sh` | exists, needs polish | Finding → patch proposal → reviewable PR |
-| 60 | **Agent sandbox workspaces** | `60-agent-sandbox.sh` | **new** | One session, two agents, three turns — Scout, Builder, and a CI fixup share one warm sandbox |
-| 70 | **Agent Substrate workspaces** | `70-agent-substrate.sh` | **new** | Real gpt-5.5 agent in a gVisor Actor clones + edits + opens a PR; warm reuse with no cold start |
+| 50 | **Kontxt transaction tokens** | `50-kontxt.sh` | **new** | Caller Pod proves identity → kontxt mints TxToken → Orka stamps immutable provenance |
+| 60 | **Agent sandbox workspaces** | `60-agent-sandbox.sh` | archived prototype | Requires a future sandbox-backed ACP v2 supervisor |
+| 70 | **Agent Substrate workspaces** | `70-agent-substrate.sh` | archived prototype | Requires a future Actor-backed ACP v2 supervisor and clean-room publication |
 
 Demos 50 and 60 are designed in [§7](#7-new-scenario-storyboards).
 
@@ -568,7 +571,7 @@ the successful Task and renders:
 ╰─────────────────────────────────────────────────────────────╯
 ```
 
-### Demo 60 — Agent sandbox workspaces (`60-agent-sandbox.sh`)
+### Demo 60 — Agent sandbox workspaces (`60-agent-sandbox.sh`, archived prototype)
 
 **Why this matters.** The other demos all show one-shot work. Demo 60 shows
 *continuity*: a coding session's repo, dependency cache, and built artifacts
@@ -687,7 +690,7 @@ by an order of magnitude.
 
 ---
 
-### Demo 70 — Agent Substrate workspaces (`70-agent-substrate.sh`)
+### Demo 70 — Agent Substrate workspaces (`70-agent-substrate.sh`, archived prototype)
 
 **Why this matters.** Orka's execution workspace is provider-neutral. Demo 60
 shows agent-sandbox; Demo 70 shows the *same Orka agent Task API* backed by a
@@ -716,8 +719,7 @@ demo-magic cluster. Stand it up with `make demo-substrate-up`
 `scripts/agent-substrate-e2e.sh` standup (`KEEP_CLUSTER=1`) — Substrate control
 plane in `ate-system`, a `WorkerPool` + gVisor `ActorTemplate` (`orka-codex-ci`
 in `ate-demo`), Orka wired with `--substrate-*` flags; (2) builds a
-**codex-capable Actor image** (the production `agent-harness-wrapper` — daemon +
-codex CLI + git) and points the ActorTemplate at it; (3) deploys the **vekil**
+**prototype codex-capable Actor image** (workspace daemon + Codex CLI + git; not a supported ACP v2 runtime image) and points the ActorTemplate at it; (3) deploys the **vekil**
 model proxy (one-time GitHub **device-code** login — the operator completes it
 from the pod logs, since a plain `gho_` gh token has no Copilot entitlement);
 (4) creates the model Secret (endpoint → vekil) and the git Secret. Requires
@@ -729,15 +731,14 @@ comes from `GIT_TOKEN`/`GITHUB_TOKEN` or the local `gh` CLI.
 
 | # | Beat | What the audience sees |
 |---|------|------------------------|
-| 1 | Cold | A Task with `provider: substrate` + `reusePolicy: session` + `sessionRef.create: true`. A fresh gVisor Actor; a real `gpt-5.5` agent clones the repo, edits a file, stops. Orka pushes the branch; the demo opens a real PR. `status.executionWorkspace.provider == substrate`. |
-| 2 | PR | The demo opens the pull request via `gh` (the agent edited only — clean exit; Orka pushed). The real PR URL appears. |
-| 3 | Warm | A second Task, same `sessionRef` (`create: false`). Reattaches the retained workspace: `status.executionWorkspace.reused == true` — repo already cloned, no cold start. A follow-up commit lands on the same PR. |
+| 1 | Cold | Archived prototype: a fresh gVisor Actor hosted the agent. A revived ACP v2 version must start from a sanitized source artifact and leave publication to the Workspace/Publisher. |
+| 2 | PR | Future v2 version requires an independently verified publisher receipt and Orka-owned PR reconciliation. |
+| 3 | Warm | Future v2 version must resume one fenced RuntimeSession without replaying a prompt or bypassing validation/publication barriers. |
 
-**Clean-exit contract (load-bearing).** The agent **edits files only** and
-stops; Orka's `pushBranch` pushes the branch; the **demo script** opens/updates
-the PR via `gh`. If the agent runs post-edit commands itself (git status, a PR
-curl), a nonzero one makes the codex CLI exit 1 even though the work succeeded —
-so the prompt forbids it.
+**Clean-exit contract (load-bearing).** The ACP child edits files only. A
+revived demo must freeze and validate the RuntimeSession, upload a durable delta,
+and require the separate Workspace/Publisher to prepare, publish, verify, and
+reconcile the PR. Runtime-local Git state is never publication authority.
 
 **gVisor contract (load-bearing).** The Task sets
 `ORKA_CODEX_DISABLE_SANDBOX=true`. Codex's inner bubblewrap sandbox cannot nest
@@ -870,18 +871,18 @@ spec:
     - name: file_write
     - name: code_exec
   systemPrompt: |
-    You implement changes proposed by the scout. You read
-    /workspace/scout-report.md, apply the changes, run tests via
-    code_exec, and use the in-workspace git CLI (cloned and authenticated
-    by the agent runtime) to push branches and open pull requests
-    against sozercan/vekil.
+    You implement changes proposed by the scout. Read the supplied report,
+    edit the verified workspace, and run focused tests. Do not commit, alter
+    Git configuration/remotes, push, or create a pull request; Orka owns
+    clean-room publication.
 ```
 
 **Tool-name caveat.** Built-in Orka tools verified against
 `internal/tools/common_constants.go` and `workers/ai/main_test.go`:
 `file_read`, `file_write`, `code_exec`, `web_search`, `web_fetch` are
-real. There is *no* `open_pr` built-in tool — PR creation is done by the
-agent runtime using `git` + `gh` (or the GitHub HTTP API) from inside the
+real. There is *no* `open_pr` built-in tool. Under ACP v2, PR creation is an
+Orka-owned Workspace/Publisher or governed GitHub-tool operation, never a
+runtime-local `git`/forge action inside the
 sandbox workspace. The scout/builder split is enforced by `file_write` +
 `code_exec` *presence on builder, absence on scout*, not by an `open_pr`
 tool.
@@ -924,15 +925,11 @@ Prompt files in `hack/demos/prompts/`:
   issue #77 (Prometheus metrics gap). Profile what's missing. Write your
   proposal to `/workspace/scout-report.md` with: counter names, where they
   go, test outline. Do not modify any vekil source."*
-- `sandbox-turn-2-builder.txt` — *"Read `/workspace/scout-report.md`.
-  Implement the counters and tests in the vekil checkout under
-  `/workspace/vekil`. Push the branch with `git` and open a pull request
-  against sozercan/vekil (using `gh pr create`) with title 'Add Prometheus
-  /metrics endpoint (closes #77)'."*
-- `sandbox-turn-3-fixup.txt` — *"CI on the open PR flagged that
-  `metrics_handler_test.go` is missing a test for the `error_total`
-  counter. Add it. Push as a fixup commit on the same branch. Do not
-  open a new PR."*
+- `sandbox-turn-2-builder.txt` — must be rewritten to edit and test only.
+  A future ACP v2 demo supplies a verified workspace artifact and asks the
+  Workspace/Publisher to prepare, publish, verify, and reconcile the PR.
+- `sandbox-turn-3-fixup.txt` — must be rewritten as another fenced write Task
+  against the claimed branch baseline; the ACP child must not commit or publish.
 
 ### Substrate manifests (Demo 70)
 
@@ -946,12 +943,13 @@ demo only applies the Orka `Agent` + two `Task`s and opens the PR. All carry
   `codex`, model `gpt-5.5`. A real model run: `secretRef` (NOT `providerRef` —
   mutually exclusive with `runtime`) points at a Secret carrying
   `OPENAI_BASE_URL` (→ the in-cluster vekil proxy) + a placeholder
-  `OPENAI_API_KEY`. The system prompt tells the agent to edit files only and
-  stop (Orka pushes; the demo opens the PR).
+  `OPENAI_API_KEY`. The system prompt tells the agent to edit files only and stop. A revived v2
+  demo requires the Workspace/Publisher to prepare, publish, verify, and reconcile the PR.
 - **Task** (`render_substrate_task <name> <none|session> <create> <prompt>`) —
   agent Task whose `execution.workspace` selects `provider: substrate` with
-  `templateRef` → `ate-demo/orka-codex-ci`, plus `agentRuntime.workspace`
-  (`gitRepo`, `branch`, `pushBranch`, `gitSecretRef`) and
+  `templateRef` → `ate-demo/orka-codex-ci`, plus top-level `spec.workspace`
+  (`intent`, `gitRepo`, `branch`, `readCredentialRef`, `publicationGitRepo`,
+  `publicationCredentialRef`, and `pushBranch`) and
   `env: ORKA_CODEX_DISABLE_SANDBOX=true` (gVisor is the sandbox). `reusePolicy`
   defaults to `session`; `cleanupPolicy` is `retain` for session tasks so the
   workspace stays warm. The 3rd arg sets `sessionRef.create`.
@@ -1175,8 +1173,9 @@ and by the payoff cards):
 | 20 | "GitOps workflow" | "Same workflow from YAML. The agent isn't magic — it's a CR." |
 | 30 | "Scheduled work" | "Recurring AI triage queue — same auditable Task model, just add a `schedule:`." |
 | 40 | "Security remediation" | "Finding → patch proposal → reviewable PR. No human triage required." |
-| 60 | "Warm agent sandboxes" | "One session, two agents, three turns. Scout, Builder, CI fixup — one warm workspace." |
-| 70 | "Agent Substrate workspaces" | "A real agent clones, edits, and opens a PR from inside a gVisor sandbox — then reuses the warm workspace with no cold start." |
+| 50 | "Kontxt transaction tokens" | "Zero-secret caller, one-shot transaction token, sealed Kubernetes provenance." |
+| 60 | "Warm agent sandboxes" | "Archived until agent-sandbox hosts an ACP v2 RuntimeSession without weakening workspace governance." |
+| 70 | "Agent Substrate workspaces" | "Archived until an Actor-backed ACP v2 supervisor and clean-room publication path are implemented." |
 
 ---
 
@@ -1230,12 +1229,10 @@ writing the relevant render functions:
   as a placeholder. The implementer must inspect what `00-preflight.sh`
   applies (or what `cluster/cluster-up.sh` installs) and use that exact
   name in the scout/builder Agent specs.
-- **`gh` is preinstalled in the sandbox image.** The builder prompt
-  assumes `gh pr create` works inside the sandbox. Phase 1's
-  `cluster/templates/orka-live-template.yaml` is the implementer's
-  source of truth — make sure the template's image bundles `git` + `gh`
-  + a writable workspace. If not, either add them to the template image
-  or swap the builder prompt to use the GitHub REST API (`curl + jq`).
+- **SCM publication is outside the sandbox.** A future template must not
+  depend on Git publication tools or credentials inside the ACP process tree.
+  The Workspace/Publisher owns clone credentials, deterministic commit creation,
+  exact-ref publication, independent verification, and PR reconciliation.
 - **Sandbox claim name shape.** §7.5's `payoff_card_sandbox` extracts the
   claim name from `completed in sandbox workspace <name>` — that line is
   verified, but the literal claim *name* (`orka-vekil-metrics-77` in the
@@ -1265,8 +1262,8 @@ writing the relevant render functions:
      are needed.
    - `install-agent-sandbox.sh` — installs the upstream `agent-sandbox`
      operator via its published manifests, then applies
-     `cluster/templates/orka-live-template.yaml` (a `SandboxTemplate`
-     containing the agent CLI runtime image + git/gh + workspace dirs).
+     `cluster/templates/orka-live-template.yaml` (an archived `SandboxTemplate`;
+     replace it with an ACP v2 supervisor image before reviving the demo).
    - `cluster-down.sh` — `kind delete cluster --name orka-demo`.
 - [ ] Makefile — add `demo-record-%`, `demo-record-hero`, `demo-record-all`,
       `demo-diff`, `demo-images`, **`demo-cluster-up`**, **`demo-cluster-down`**
diff --git a/hack/demos/cluster/cluster-down.sh b/hack/demos/cluster/cluster-down.sh
index 46918985c..7e133c4a5 100755
--- a/hack/demos/cluster/cluster-down.sh
+++ b/hack/demos/cluster/cluster-down.sh
@@ -4,6 +4,10 @@
 set -Eeuo pipefail
 
 cluster_name="${ORKA_DEMO_CLUSTER:-orka-demo}"
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repo_root="$(cd "${script_dir}/../../.." && pwd)"
+# shellcheck source=scripts/lib/kind-local-registry.sh
+. "${repo_root}/scripts/lib/kind-local-registry.sh"
 
 if kind get clusters | grep -qx "${cluster_name}"; then
   printf '==> Deleting kind cluster %s\n' "${cluster_name}" >&2
@@ -11,3 +15,5 @@ if kind get clusters | grep -qx "${cluster_name}"; then
 else
   printf '==> kind cluster %s not found; nothing to do\n' "${cluster_name}" >&2
 fi
+
+orka_kind_registry_stop "${cluster_name}"
diff --git a/hack/demos/cluster/cluster-up.sh b/hack/demos/cluster/cluster-up.sh
index 826727373..619baf500 100755
--- a/hack/demos/cluster/cluster-up.sh
+++ b/hack/demos/cluster/cluster-up.sh
@@ -9,11 +9,14 @@ set -Eeuo pipefail
 
 cluster_name="${ORKA_DEMO_CLUSTER:-orka-demo}"
 img="${ORKA_DEMO_IMAGE:-orka-demo:dev}"
+publisher_img="${ORKA_DEMO_PUBLISHER_IMAGE:-orka-workspace-publisher:demo}"
 namespace="${ORKA_NAMESPACE:-orka-system}"
 demo_namespace="${DEMO_NAMESPACE:-demo-magic}"
 
 script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 repo_root="$(cd "${script_dir}/../../.." && pwd)"
+# shellcheck source=scripts/lib/kind-local-registry.sh
+. "${repo_root}/scripts/lib/kind-local-registry.sh"
 
 log() { printf '==> %s\n' "$*" >&2; }
 die() { printf 'error: %s\n' "$*" >&2; exit 1; }
@@ -21,6 +24,9 @@ die() { printf 'error: %s\n' "$*" >&2; exit 1; }
 command -v kind    >/dev/null 2>&1 || die "missing required command: kind"
 command -v docker  >/dev/null 2>&1 || die "missing required command: docker"
 command -v kubectl >/dev/null 2>&1 || die "missing required command: kubectl"
+command -v curl    >/dev/null 2>&1 || die "missing required command: curl"
+command -v jq      >/dev/null 2>&1 || die "missing required command: jq"
+[[ "${namespace}" == "orka-system" ]] || die "demo cluster currently requires ORKA_NAMESPACE=orka-system"
 
 if kind get clusters | grep -qx "${cluster_name}"; then
   log "kind cluster ${cluster_name} already exists; reusing"
@@ -32,30 +38,35 @@ fi
 log "Selecting kubectl context kind-${cluster_name}"
 kubectl config use-context "kind-${cluster_name}" >/dev/null
 
+orka_kind_registry_start "${cluster_name}"
+
 log "Building controller image ${img}"
 (cd "${repo_root}" && make docker-build IMG="${img}")
+log "Building workspace publisher image ${publisher_img}"
+(cd "${repo_root}" && make docker-build-workspace-publisher WORKSPACE_PUBLISHER_IMG="${publisher_img}")
 
 log "Loading ${img} into kind/${cluster_name}"
 kind load docker-image "${img}" --name "${cluster_name}"
+manager_ref="$(orka_kind_registry_push "${img}" "orka/controller")"
+publisher_ref="$(orka_kind_registry_push "${publisher_img}" "orka/workspace-publisher")"
 
-log "Ensuring namespace ${namespace} and ${demo_namespace}"
+log "Ensuring namespaces ${namespace}, ${demo_namespace}, and vekil-system"
 kubectl create namespace "${namespace}"      --dry-run=client -o yaml | kubectl apply -f -
 kubectl create namespace "${demo_namespace}" --dry-run=client -o yaml | kubectl apply -f -
+kubectl create namespace vekil-system         --dry-run=client -o yaml | kubectl apply -f -
 
-log "Deploying Orka (namespace ${namespace}, image ${img})"
-if [[ "${namespace}" == "orka-system" ]]; then
-  (cd "${repo_root}" && make deploy IMG="${img}")
-else
-  (cd "${repo_root}" && make manifests kustomize)
-  tmp_config="$(mktemp -d)"
-  cp -R "${repo_root}/config" "${tmp_config}/config"
-  (cd "${tmp_config}/config/manager" && "${repo_root}/bin/kustomize" edit set image controller="${img}")
-  perl -0pi -e "s#--controller-url=http://orka-api\.orka-system\.svc:8080#--controller-url=http://orka-api.${namespace}.svc:8080#g" \
-    "${tmp_config}/config/manager/manager.yaml"
-  (cd "${tmp_config}/config/default" && "${repo_root}/bin/kustomize" edit set namespace "${namespace}")
-  "${repo_root}/bin/kustomize" build "${tmp_config}/config/default" | kubectl apply -f -
-  rm -rf "${tmp_config}"
-fi
+log "Installing ACP v2 CRDs"
+(cd "${repo_root}" && make install)
+
+log "Deploying Orka (namespace ${namespace}, image ${manager_ref})"
+placeholder_digest="sha256:$(printf '0%.0s' {1..64})"
+(cd "${repo_root}" && make deploy \
+  IMG="${manager_ref}" \
+  WORKSPACE_PUBLISHER_IMG="${publisher_ref}" \
+  ACP_CODEX_RUNTIME_IMG="example.invalid/orka/acp-codex@${placeholder_digest}" \
+  ACP_CLAUDE_RUNTIME_IMG="example.invalid/orka/acp-claude@${placeholder_digest}" \
+  ACP_COPILOT_RUNTIME_IMG="example.invalid/orka/acp-copilot@${placeholder_digest}" \
+  ACP_OPENCODE_RUNTIME_IMG="example.invalid/orka/acp-opencode@${placeholder_digest}")
 
 log "Waiting for orka-controller-manager rollout"
 kubectl -n "${namespace}" rollout status deployment/orka-controller-manager --timeout=300s
diff --git a/hack/demos/cluster/install-demo-model.sh b/hack/demos/cluster/install-demo-model.sh
index 9464f346a..b8f294af2 100755
--- a/hack/demos/cluster/install-demo-model.sh
+++ b/hack/demos/cluster/install-demo-model.sh
@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 # Provision the model Provider + secrets the model-backed demos (10/20/30/40)
-# need, pointing them at the in-cluster vekil proxy. The workspace demos
-# (50/60/70) bring their own model wiring; this script covers the SDLC demos.
+# need, pointing them at the in-cluster vekil proxy. This script covers the
+# active SDLC demos only; archived execution-workspace demos 60/70 are not
+# configured here.
 #
 # What it creates in the demo namespace (DEMO_NAMESPACE, default demo-magic):
 #   - a Provider CR (DEMO_PROVIDER_REF) used by the type: ai coordinator in
@@ -9,8 +10,8 @@
 #     (demo 10 requires Opus). The provider api-key is a placeholder; vekil
 #     holds the real Copilot session.
 #   - the provider api-key Secret (DEMO_PROVIDER_SECRET_REF).
-#   - the runtime Secret (DEMO_RUNTIME_SECRET_REF) for the CLI agents:
-#     OPENAI_BASE_URL -> vekil /v1 + placeholder OPENAI_API_KEY (=> codex).
+#   - the ACP provider credential Secret (DEMO_RUNTIME_SECRET_REF):
+#     OPENAI_BASE_URL -> vekil /v1 + placeholder OPENAI_API_KEY (=> Codex).
 #   - a git Secret (DEMO_GIT_SECRET_REF) with username/password (PR demos) AND
 #     a token key (demo 30 reads GH_TOKEN from the 'token' key). Token from
 #     GIT_TOKEN/GITHUB_TOKEN or the local gh CLI; never printed.
@@ -39,8 +40,6 @@ command -v jq      >/dev/null 2>&1 || die "missing required command: jq"
 
 orka_namespace="${ORKA_NAMESPACE:-orka-system}"
 controller_deployment="${ORKA_CONTROLLER_DEPLOYMENT:-orka-controller-manager}"
-harness_wrapper_deployment="${ORKA_HARNESS_WRAPPER_DEPLOYMENT:-orka-agent-harness-wrapper}"
-codex_image="${DEMO_HARNESS_WRAPPER_IMAGE:-localhost:${KIND_REGISTRY_PORT:-5001}/orka/agent-harness-wrapper:demo}"
 ai_image="${DEMO_AI_WORKER_IMAGE:-localhost:${KIND_REGISTRY_PORT:-5001}/orka/ai-worker:demo}"
 general_image="${DEMO_GENERAL_WORKER_IMAGE:-localhost:${KIND_REGISTRY_PORT:-5001}/orka/general-worker:demo}"
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
@@ -56,7 +55,6 @@ require_image_source() {
     die "${label} build is disabled but ${image_var} is not set to an existing image"
   fi
 }
-require_image_source "harness wrapper" "${DEMO_BUILD_CODEX_IMAGE:-1}" DEMO_HARNESS_WRAPPER_IMAGE
 require_image_source "AI worker" "${DEMO_BUILD_AI_IMAGE:-1}" DEMO_AI_WORKER_IMAGE
 require_image_source "general worker" "${DEMO_BUILD_GENERAL_IMAGE:-1}" DEMO_GENERAL_WORKER_IMAGE
 if [[ "${needs_docker}" == "1" ]]; then
@@ -110,8 +108,8 @@ spec:
   defaultModel: ${provider_model}
 YAML
 
-# --- Runtime Secret (CLI agents: codex via vekil /v1) -----------------------
-log "Creating runtime Secret ${demo_namespace}/${runtime_secret} (endpoint -> vekil)"
+# --- ACP provider credential Secret (Codex via vekil /v1) ------------------
+log "Creating ACP provider credential Secret ${demo_namespace}/${runtime_secret} (endpoint -> vekil)"
 kubectl -n "${demo_namespace}" create secret generic "${runtime_secret}" \
   --from-literal=OPENAI_BASE_URL="${vekil_url}" \
   --from-literal=OPENAI_API_KEY=proxy-placeholder \
@@ -135,20 +133,14 @@ else
   log "  kubectl -n ${demo_namespace} create secret generic ${git_secret} --from-literal=username=oauth2 --from-literal=password=<token> --from-literal=token=<token>"
 fi
 
-# --- Git-capable codex worker image -----------------------------------------
-# The model-backed demos (10/20/30/40) run the agent directly in the worker pod
-# (no sandbox/substrate workspace), so the worker image itself must contain git
-# to clone the repo. The Substrate e2e deploys Orka with the STRIPPED codex
-# image (workers/harness/Dockerfile = distroless, NO git),
-# which fails these demos with "git: executable not found". Build the PRODUCTION
-# codex image (workers/harness/Dockerfile has git + codex) and repoint the
-# harness wrapper deployment at it.
+# Built-in coding-agent runtimes are controller-owned, digest-pinned ACP
+# RuntimePools. This demo helper intentionally does not build, repoint, or set
+# process-wide sandbox environment on those runtimes. Install Orka with the
+# desired immutable Codex/Claude/Copilot runtime images before running agent demos.
+
 # build_and_repoint_worker <controller-flag> <dockerfile> <image> <build?> <label>
-# Builds a worker image for the cluster node arch, pushes it to the local
-# registry, and points the controller's <controller-flag> at it — ADDING the
-# flag when the Substrate e2e deployment omits it (it only ever sets
-# harness wrapper image). Used for the AI + general workers, which the e2e never
-# wires, so the controller otherwise falls back to unreachable ghcr defaults.
+# Builds a non-agent worker image for the cluster node architecture, publishes
+# it to the selected cluster, and updates the controller flag that selects it.
 build_and_repoint_worker() {
   local flag="$1" dockerfile="$2" image="$3" do_build="$4" label="$5"
   if command -v docker >/dev/null 2>&1 && [[ "${do_build}" == "1" ]]; then
@@ -179,24 +171,10 @@ build_and_repoint_worker() {
     kubectl -n "${orka_namespace}" rollout status "deployment/${controller_deployment}" --timeout=300s
   fi
 }
-if command -v docker >/dev/null 2>&1 && [[ "${DEMO_BUILD_CODEX_IMAGE:-1}" == "1" ]]; then
-  node_arch="$(kubectl get nodes -o jsonpath='{.items[0].status.nodeInfo.architecture}' 2>/dev/null || echo amd64)"
-  log "Building harness wrapper image ${codex_image} (arch ${node_arch})"
-	docker build --platform "linux/${node_arch}" -t "${codex_image}" \
-	  -f "${repo_root}/workers/harness/Dockerfile" "${repo_root}"
-	publish_worker_image "${codex_image}"
-fi
-
-  if kubectl -n "${orka_namespace}" get deployment "${harness_wrapper_deployment}" >/dev/null 2>&1; then
-    log "Repointing ${harness_wrapper_deployment} image -> ${codex_image}"
-    kubectl -n "${orka_namespace}" set image "deployment/${harness_wrapper_deployment}" "wrapper=${codex_image}"
-    kubectl -n "${orka_namespace}" set env "deployment/${harness_wrapper_deployment}" "ORKA_CODEX_SANDBOX_MODE=${DEMO_CODEX_SANDBOX_MODE:-danger-full-access}"
-    kubectl -n "${orka_namespace}" rollout status "deployment/${harness_wrapper_deployment}" --timeout=300s
-  fi
 
 # --- AI worker image (type: ai coordinator in demos 10/20) ------------------
 # The manual/chat PR coordinators run as a `type: ai` Task, which uses the AI
-# worker image (workers/ai/Dockerfile), NOT the codex worker. The Substrate e2e
+# worker image (workers/ai/Dockerfile), not an ACP agent runtime. The Substrate e2e
 # never builds or wires this image, so the controller falls back to the code
 # default ghcr.io/orka-agents/orka/ai-worker:latest, which the kind cluster cannot
 # pull -> ImagePullBackOff and the coordinator never starts.
@@ -212,19 +190,6 @@ build_and_repoint_worker "ai-worker-image" "workers/ai/Dockerfile" \
 build_and_repoint_worker "general-worker-image" "workers/general/Dockerfile" \
   "${general_image}" "${DEMO_BUILD_GENERAL_IMAGE:-1}" "general worker"
 
-# --- Codex sandbox mode (gVisor cluster contract) ---------------------------
-# This unified cluster runs gVisor (runsc) nodes. Codex's default sandbox
-# (workspace-write -> inner bubblewrap) cannot create a user namespace under
-# runsc, and even its no-sandbox retry trips the kernel-capability check
-# ("codex without sandbox after kernel capability check: exit status 1"). The
-# workspace demos (60/70) bypass this by setting ORKA_CODEX_DISABLE_SANDBOX=true
-# in their Task manifests, but the type: ai coordinators in demos 10/20 create
-# codex child Tasks at runtime via the create_agent/create_task tool path, which
-# carry no such env. Setting the controller's --codex-sandbox-mode injects
-# ORKA_CODEX_SANDBOX_MODE into EVERY codex agent Task (coordinator-created
-# included), so codex runs `--sandbox <mode>` directly and skips bwrap +
-# kernel-cap probing. danger-full-access is appropriate inside the gVisor jail.
-codex_sandbox_mode="${DEMO_CODEX_SANDBOX_MODE:-danger-full-access}"
-
-log "Demo model stack ready: Provider ${provider_ref} + runtime/provider/git secrets in ${demo_namespace}."
+log "Demo model stack ready: Provider ${provider_ref} + ACP/provider/git secrets in ${demo_namespace}."
+log "Built-in agent runtimes are managed separately as digest-pinned ACP RuntimePools."
 log "Run demos 10/20/30/40 with: source hack/demos/cluster/demo-env.sh"
diff --git a/hack/demos/cluster/install-substrate.sh b/hack/demos/cluster/install-substrate.sh
index 1d98f93bf..a6e386cea 100755
--- a/hack/demos/cluster/install-substrate.sh
+++ b/hack/demos/cluster/install-substrate.sh
@@ -1,36 +1,28 @@
 #!/usr/bin/env bash
-# Install Agent Substrate + an Orka-compatible workspace template into a
-# dedicated kind cluster for Demo 70.
+# Install the archived Agent Substrate infrastructure in a dedicated kind
+# cluster for direct workspace/MCP evaluation.
 #
-# Substrate's standup is heavy (clone Substrate at a pinned ref, create a kind
-# cluster + local registry, deploy the ate-system control plane, build/push the
-# controller + codex-worker + workspace-agent images via docker + ko, create a
-# WorkerPool + gVisor ActorTemplate, deploy Orka wired with --substrate-* flags,
-# and a local RustFS snapshot bucket). That exact sequence is already proven in
-# CI by scripts/agent-substrate-e2e.sh.
+# This is intentionally not an agent-runtime installer. The ACP v2 hard cutover
+# removed the legacy turn-wrapper path, and RuntimeSession-to-Substrate Actor
+# dispatch remains deferred until an Actor-backed orka.harness.v2 supervisor
+# exists. Current built-in Codex, Claude, and Copilot validation uses controller-owned
+# RuntimePools via scripts/live-acp-runtime-e2e.sh.
 #
-# Rather than duplicate ~600 lines (and drift from CI), this installer is a thin
-# wrapper over that script with KEEP_CLUSTER=1, so it leaves behind a fully
-# wired cluster Demo 70 can drive. The e2e's own task exercises run as a
-# built-in smoke test (a few seconds each) before it hands the cluster back.
+# The underlying scripts/agent-substrate-e2e.sh flow clones the pinned
+# Substrate revision, verifies and applies the reviewed evaluation patches in
+# hack/agent-substrate, creates its dedicated kind cluster and registry,
+# deploys the control plane, and validates direct Substrate plus Orka-brokered
+# MCP workspace paths. KEEP_CLUSTER=1 leaves that infrastructure available for
+# inspection after the smoke checks finish.
 #
-# Unlike install-agent-sandbox.sh (which attach to the
-# shared demo-magic kind cluster), Substrate needs its OWN cluster: it uses
-# Substrate's create-kind-cluster.sh (custom registry + gVisor node config),
-# so it cannot bolt onto an existing cluster.
+# Unlike install-kontxt.sh / install-agent-sandbox.sh (which attach to the
+# shared demo-magic kind cluster), Substrate needs its own cluster because its
+# bootstrap installs custom registry and gVisor node configuration.
 #
-# Requires: kind, ko, docker, go, git, jq, kubectl, curl (and gh for the git
-# token convenience). The cluster is named by KIND_CLUSTER (default
-# orka-agent-substrate-e2e); its context is kind-<KIND_CLUSTER>. Tear down with:
+# Requires: kind, ko, docker, go, git, jq, kubectl, and curl. The cluster is
+# named by KIND_CLUSTER (default orka-agent-substrate-e2e); its context is
+# kind-<KIND_CLUSTER>. Tear down with:
 # kind delete cluster --name <KIND_CLUSTER>
-#
-# The base Substrate standup is secret-free. The agentic layer (AGENTIC=1,
-# default) additionally: builds a codex-capable Actor image and points the
-# ActorTemplate at it; deploys the vekil model proxy (one-time GitHub
-# device-code login — the operator completes it from the pod logs); and creates
-# the model + git Secrets. Set AGENTIC=0 to skip the agentic layer. The git
-# token comes from GIT_TOKEN/GITHUB_TOKEN or the local gh CLI; the model proxy
-# needs a Copilot-enabled GitHub account for the device-code login.
 
 set -Eeuo pipefail
 
@@ -40,36 +32,40 @@ repo_root="$(cd "${script_dir}/../../.." && pwd)"
 log() { printf '==> %s\n' "$*" >&2; }
 die() { printf 'error: %s\n' "$*" >&2; exit 1; }
 
+if [[ "${AGENTIC:-0}" != "0" ]]; then
+  die "AGENTIC mode was removed with the ACP v2 hard cutover; use scripts/live-acp-runtime-e2e.sh for built-in agent runtime validation"
+fi
+
 # Pin to the same Substrate revision CI uses, unless overridden.
 SUBSTRATE_REF="${SUBSTRATE_REF:-b80031d260959b1fc5c6f61e3099fe2a6d368af1}"
+if [[ ! "${SUBSTRATE_REF}" =~ ^[[:xdigit:]]{40}$ ]]; then
+  die "SUBSTRATE_REF must be an immutable full 40-hex commit SHA; branches and movable tags cannot identify a reusable cluster"
+fi
+SUBSTRATE_REF="$(printf '%s' "${SUBSTRATE_REF}" | tr '[:upper:]' '[:lower:]')"
 KIND_CLUSTER="${KIND_CLUSTER:-orka-agent-substrate-e2e}"
+SUBSTRATE_KUBECONFIG="${SUBSTRATE_KUBECONFIG:-${HOME}/.kube/orka-substrate-${KIND_CLUSTER}.config}"
+DIRECT_EVAL_MARKER_NAMESPACE="orka-system"
+DIRECT_EVAL_MARKER_NAME="orka-substrate-direct-evaluation-v2"
+DIRECT_EVAL_MARKER_SCHEMA_VERSION="4"
+DIRECT_EVAL_PATCH_SET_VERSION="2026-08-01.2"
+DIRECT_EVAL_HARDENING="atenet-routing-metadata-allowlist+envoy-info,atelet-root-supervisor-capabilities,ateom-runsc-delete-recovery"
+DIRECT_EVAL_PATCH_FILES=(
+  "hack/agent-substrate/atelet-root-supervisor-capabilities.patch"
+  "hack/agent-substrate/atenet-router-authorization-redaction.patch"
+  "hack/agent-substrate/ateom-runsc-delete-recovery.patch"
+)
 # Reuse-or-recreate behavior when the kind cluster already exists. The Substrate
 # standup (scripts/agent-substrate-e2e.sh -> hack/create-kind-cluster.sh) does
 # `kind delete cluster` then recreate, so re-running this bootstrap on a live
-# cluster would DESTROY it (and any completed vekil device-code login, which is
-# cached in an emptyDir). When a cluster already exists we prompt the operator
-# reuse / recreate / cancel. Set DEMO_CLUSTER_REUSE=reuse|recreate|cancel to skip
-# the prompt (required for non-interactive runs that should not just recreate).
+# cluster would DESTROY it and its direct-evaluation state. When a cluster
+# already exists we prompt the operator to reuse, recreate, or cancel. Set
+# DEMO_CLUSTER_REUSE=reuse|recreate|cancel to skip the prompt (required for
+# non-interactive runs that should not just recreate).
 DEMO_CLUSTER_REUSE="${DEMO_CLUSTER_REUSE:-}"
-# Exercise the retained-workspace path during standup so the warm-reuse beat is
-# smoke-tested before Demo 70 runs. Override to 0 to skip.
+# Exercise the extended direct workspace and MCP checks during standup.
+# Override to 0 to run only the base smoke checks.
 SUBSTRATE_E2E_EXTENDED="${SUBSTRATE_E2E_EXTENDED:-1}"
 
-# Agentic Demo 70 add-ons (set AGENTIC=0 to stop after the base standup and
-# leave the demo model-free). The agentic layer makes Demo 70 a REAL model run
-# that opens a PR, so it needs a model proxy + a codex-capable Actor image.
-AGENTIC="${AGENTIC:-1}"
-SUBSTRATE_NS="${DEMO_SUBSTRATE_NAMESPACE:-default}"
-SUBSTRATE_TEMPLATE_NS="${DEMO_SUBSTRATE_TEMPLATE_NAMESPACE:-ate-demo}"
-SUBSTRATE_TEMPLATE_NAME="${DEMO_SUBSTRATE_TEMPLATE_NAME:-orka-codex-ci}"
-SUBSTRATE_MODEL_SECRET="${DEMO_SUBSTRATE_MODEL_SECRET:-substrate-model-key}"
-SUBSTRATE_GIT_SECRET="${DEMO_SUBSTRATE_GIT_SECRET:-github-credentials}"
-SUBSTRATE_MODEL="${DEMO_SUBSTRATE_RUNTIME_MODEL:-gpt-5.5}"
-VEKIL_NS="${VEKIL_NAMESPACE:-vekil-system}"
-KIND_REGISTRY_NAME="${KIND_REGISTRY_NAME:-kind-registry}"
-KIND_REGISTRY_PORT="${KIND_REGISTRY_PORT:-5001}"
-CODEX_ACTOR_TAG="${CODEX_ACTOR_TAG:-demo}"
-
 # Put the Go bin dir on PATH so a `go install`ed ko is found.
 if command -v go >/dev/null 2>&1; then
   PATH="$(go env GOPATH)/bin:${PATH}"
@@ -90,12 +86,61 @@ docker info >/dev/null 2>&1 || die "docker daemon is not reachable — start Doc
 e2e_script="${repo_root}/scripts/agent-substrate-e2e.sh"
 [[ -f "${e2e_script}" ]] || die "expected ${e2e_script} to exist"
 
+reviewed_patch_set_manifest() {
+  local relative_path patch_path patch_blob
+  for relative_path in "${DIRECT_EVAL_PATCH_FILES[@]}"; do
+    patch_path="${repo_root}/${relative_path}"
+    [[ -f "${patch_path}" ]] || die "expected reviewed patch ${patch_path} to exist"
+    patch_blob="$(git hash-object "${patch_path}")"
+    [[ -n "${patch_blob}" ]] || die "could not fingerprint reviewed patch ${patch_path}"
+    printf '%s git-blob:%s\n' "${relative_path}" "${patch_blob}"
+  done
+}
+
+# The marker stores this exact, ordered manifest in addition to its schema and
+# human-reviewed version. Any patch-byte change therefore invalidates reuse even
+# if a developer forgets to bump DIRECT_EVAL_PATCH_SET_VERSION.
+DIRECT_EVAL_REVIEWED_PATCH_SET="$(reviewed_patch_set_manifest)"
+
 # cluster_exists: true when a kind cluster named ${KIND_CLUSTER} is present.
 cluster_exists() {
   command -v kind >/dev/null 2>&1 || return 1
   kind get clusters 2>/dev/null | grep -qx "${KIND_CLUSTER}"
 }
 
+activate_scoped_kubeconfig() {
+  mkdir -p "$(dirname "${SUBSTRATE_KUBECONFIG}")"
+  kind export kubeconfig --name "${KIND_CLUSTER}" --kubeconfig "${SUBSTRATE_KUBECONFIG}" >/dev/null
+  chmod 0600 "${SUBSTRATE_KUBECONFIG}"
+  export KUBECONFIG="${SUBSTRATE_KUBECONFIG}"
+  log "Using retained scoped kubeconfig ${SUBSTRATE_KUBECONFIG}"
+}
+
+direct_evaluation_marker_exists() {
+  kubectl --context "kind-${KIND_CLUSTER}" -n "${DIRECT_EVAL_MARKER_NAMESPACE}" \
+    get configmap "${DIRECT_EVAL_MARKER_NAME}" >/dev/null 2>&1
+}
+
+direct_evaluation_hardening_matches() {
+  local marker_json
+  marker_json="$(kubectl --context "kind-${KIND_CLUSTER}" -n "${DIRECT_EVAL_MARKER_NAMESPACE}" \
+    get configmap "${DIRECT_EVAL_MARKER_NAME}" -o json 2>/dev/null)" || return 1
+
+  jq -e \
+    --arg marker_schema "${DIRECT_EVAL_MARKER_SCHEMA_VERSION}" \
+    --arg substrate_commit "${SUBSTRATE_REF}" \
+    --arg patch_set_version "${DIRECT_EVAL_PATCH_SET_VERSION}" \
+    --arg reviewed_patch_set "${DIRECT_EVAL_REVIEWED_PATCH_SET}" \
+    --arg hardening "${DIRECT_EVAL_HARDENING}" \
+    '(
+      .data["marker-schema-version"] == $marker_schema and
+      .data["substrate-commit"] == $substrate_commit and
+      .data["reviewed-patch-set-version"] == $patch_set_version and
+      .data["reviewed-patch-set"] == $reviewed_patch_set and
+      .data["pinned-hardening"] == $hardening
+    )' <<<"${marker_json}" >/dev/null
+}
+
 # cluster_health: prints a one-line health summary to stdout and returns 0 when
 # the existing cluster looks healthy enough to reuse (node Ready + Orka
 # controller 1/1 + at least one Running ate-system pod), 1 otherwise. Minimal by
@@ -137,12 +182,12 @@ prompt_cluster_action() {
     printf '\n'
     printf 'A kind cluster named %q already exists.\n' "${KIND_CLUSTER}"
     if [[ "${healthy_flag}" == 1 ]]; then
-      printf 'It looks healthy. Reusing keeps it (and any vekil login) intact.\n'
+      printf 'It looks healthy. Reusing keeps its direct-evaluation state intact.\n'
     else
       printf 'WARNING: it does NOT look healthy — reusing may carry that breakage forward.\n'
     fi
-    printf '  [r] reuse    — keep the cluster; reconcile add-ons only (non-destructive)\n'
-    printf '  [c] recreate — DELETE and rebuild from scratch (destroys vekil login + state)\n'
+    printf '  [r] reuse    — keep the cluster unchanged (non-destructive)\n'
+    printf '  [c] recreate — DELETE and rebuild from scratch (destroys cluster state)\n'
     printf '  [x] cancel   — exit without changes\n'
     printf 'Choose r/c/x [default: %s]: ' "${default_hint}"
   } >/dev/tty
@@ -158,13 +203,20 @@ prompt_cluster_action() {
 
 run_e2e=1
 if cluster_exists; then
+  activate_scoped_kubeconfig
   health_summary="$(cluster_health)" && health_flag=1 || health_flag=0
   log "Existing cluster kind-${KIND_CLUSTER} detected (${health_summary})"
   action="$(prompt_cluster_action "${health_flag}")"
   case "${action}" in
     reuse)
-      log "Reusing existing cluster — skipping the Substrate standup (kind delete + rebuild)."
-      log "Reconciling the agentic add-ons idempotently below."
+      if ! direct_evaluation_marker_exists; then
+        die "existing cluster has no ACP v2 direct-evaluation marker and may retain retired agentic add-ons; choose DEMO_CLUSTER_REUSE=recreate or cancel"
+      fi
+      if ! direct_evaluation_hardening_matches; then
+        die "existing cluster does not match marker schema ${DIRECT_EVAL_MARKER_SCHEMA_VERSION}, Substrate commit ${SUBSTRATE_REF}, and reviewed patch set ${DIRECT_EVAL_PATCH_SET_VERSION}; choose DEMO_CLUSTER_REUSE=recreate or cancel"
+      fi
+      log "Reusing existing marked cluster — skipping the Substrate standup (kind delete + rebuild)."
+      log "Leaving the existing direct Substrate/MCP evaluation cluster unchanged."
       run_e2e=0
       ;;
     recreate)
@@ -192,114 +244,25 @@ if [[ "${run_e2e}" == 1 ]]; then
     bash "${e2e_script}"
 fi
 
-if [[ "${AGENTIC}" == "1" ]]; then
-  ctx="kind-${KIND_CLUSTER}"
-  log "Ensuring substrate demo namespace ${SUBSTRATE_NS}"
-  kubectl --context "${ctx}" create namespace "${SUBSTRATE_NS}" --dry-run=client -o yaml \
-    | kubectl --context "${ctx}" apply -f -
-
-  # ---- 1. Codex-capable Actor image -------------------------------------
-  # The agentic run executes a real codex CLI INSIDE the gVisor Actor, so the
-  # Actor image must carry codex + git (the e2e's stripped workspace-agent-root
-  # does not). The production agent-harness-wrapper image has the daemon + codex +
-  # git. Build it LOCALLY (the kind registry is on localhost; a remote builder
-  # cannot push there) for the kind node arch, push to the registry, and point
-  # the ActorTemplate at it.
-  node_arch="$(kubectl --context "${ctx}" get nodes \
-    -o jsonpath='{.items[0].status.nodeInfo.architecture}' 2>/dev/null || echo amd64)"
-  reg_ip="$(docker inspect -f '{{with index .NetworkSettings.Networks "kind"}}{{.IPAddress}}{{end}}' "${KIND_REGISTRY_NAME}" 2>/dev/null || true)"
-  [[ -n "${reg_ip}" ]] || die "could not determine ${KIND_REGISTRY_NAME} kind-network IP"
-  push_image="localhost:${KIND_REGISTRY_PORT}/orka/agent-harness-wrapper:${CODEX_ACTOR_TAG}"
-  actor_image="${reg_ip}:5000/orka/agent-harness-wrapper:${CODEX_ACTOR_TAG}"
-
-  log "Building codex Actor image ${push_image} (arch ${node_arch})"
-  docker build --platform "linux/${node_arch}" -t "${push_image}" \
-    -f "${repo_root}/workers/harness/Dockerfile" "${repo_root}"
-  docker push "${push_image}"
-
-  log "Pointing ActorTemplate ${SUBSTRATE_TEMPLATE_NS}/${SUBSTRATE_TEMPLATE_NAME} at the codex image"
-  kubectl --context "${ctx}" -n "${SUBSTRATE_TEMPLATE_NS}" patch actortemplate "${SUBSTRATE_TEMPLATE_NAME}" \
-    --type=json -p "[{\"op\":\"replace\",\"path\":\"/spec/containers/0/image\",\"value\":\"${actor_image}\"}]"
-  log "Waiting for the ActorTemplate to rebuild its golden snapshot on the new image"
-  for _ in $(seq 1 72); do
-    ph="$(kubectl --context "${ctx}" -n "${SUBSTRATE_TEMPLATE_NS}" get actortemplate "${SUBSTRATE_TEMPLATE_NAME}" -o jsonpath='{.status.phase}' 2>/dev/null || true)"
-    [[ "${ph}" == "Ready" ]] && break
-    sleep 5
-  done
-  ph="$(kubectl --context "${ctx}" -n "${SUBSTRATE_TEMPLATE_NS}" get actortemplate "${SUBSTRATE_TEMPLATE_NAME}" -o jsonpath='{.status.phase}' 2>/dev/null || true)"
-  [[ "${ph}" == "Ready" ]] || die "ActorTemplate ${SUBSTRATE_TEMPLATE_NS}/${SUBSTRATE_TEMPLATE_NAME} did not become Ready (phase=${ph:-unknown})"
+# The CI-parity E2E deliberately uses an isolated temporary kubeconfig. Export
+# the fresh or reused cluster into a stable, scoped file before follow-up
+# marker and health operations. Never merge into ~/.kube/config.
+activate_scoped_kubeconfig
 
-  # ---- 2. In-cluster model proxy (vekil) --------------------------------
-  # Zero-config Copilot upstream via device-code login (a gho_ gh token has no
-  # Copilot entitlement). The deploy script prints a github.com/login/device
-  # code in the pod logs; the operator completes it once, and vekil caches the
-  # session. We do NOT pass a token secret here.
-  vekil_script=""
-  for candidate in \
-    "${repo_root}/.agents/skills/vekil-reverse-proxy-deploy/scripts/deploy_vekil_reverse_proxy.sh" \
-    "${repo_root}/.claude/skills/vekil-reverse-proxy-deploy/scripts/deploy_vekil_reverse_proxy.sh"; do
-    if [[ -x "${candidate}" ]]; then
-      vekil_script="${candidate}"
-      break
-    fi
-  done
-  if kubectl --context "${ctx}" -n "${VEKIL_NS}" get deploy vekil >/dev/null 2>&1; then
-    log "vekil already deployed in ${VEKIL_NS} — leaving it (re-run device-code login if /readyz is down)"
-  elif [[ -x "${vekil_script}" ]]; then
-    log "Deploying vekil model proxy to ${VEKIL_NS} (device-code login)"
-    bash "${vekil_script}" --context "${ctx}" --namespace "${VEKIL_NS}" --skip-wait
-    log "ACTION REQUIRED: complete the GitHub device-code login printed in vekil's logs:"
-    log "  kubectl --context ${ctx} -n ${VEKIL_NS} logs deploy/vekil | grep 'login/device'"
-    log "  (visit the URL, enter the code; then /readyz returns 200)"
-  else
-    die "vekil deploy script not found under .agents/skills or .claude/skills; install the skill or deploy an in-cluster OpenAI-compatible proxy before Demo 70"
-  fi
-  vekil_url="http://vekil.${VEKIL_NS}.svc.cluster.local:1337/v1"
-
-  # ---- 3. Model Secret + git Secret -------------------------------------
-  # The codex Agent's secretRef carries the model endpoint as env (EnvFrom).
-  # The api-key is a placeholder — vekil holds the real Copilot session.
-  log "Creating model Secret ${SUBSTRATE_NS}/${SUBSTRATE_MODEL_SECRET} (endpoint -> vekil)"
-  kubectl --context "${ctx}" -n "${SUBSTRATE_NS}" create secret generic "${SUBSTRATE_MODEL_SECRET}" \
-    --from-literal=OPENAI_BASE_URL="${vekil_url}" \
-    --from-literal=OPENAI_API_KEY=proxy-placeholder \
-    --dry-run=client -o yaml | kubectl --context "${ctx}" apply -f -
-
-  # Git credentials for push + PR. Prefer an explicit GIT_TOKEN/GITHUB_TOKEN
-  # env; otherwise fall back to the local gh CLI token (never printed).
-  git_token="${GIT_TOKEN:-${GITHUB_TOKEN:-}}"
-  if [[ -z "${git_token}" ]] && command -v gh >/dev/null 2>&1; then
-    git_token="$(gh auth token 2>/dev/null || true)"
-  fi
-  if [[ -n "${git_token}" ]]; then
-    log "Creating git Secret ${SUBSTRATE_NS}/${SUBSTRATE_GIT_SECRET} (token not printed)"
-    kubectl --context "${ctx}" -n "${SUBSTRATE_NS}" create secret generic "${SUBSTRATE_GIT_SECRET}" \
-      --from-literal=username=oauth2 \
-      --from-literal=password="${git_token}" \
-      --dry-run=client -o yaml | kubectl --context "${ctx}" apply -f -
-    unset git_token
-  else
-    log "No git token found (set GIT_TOKEN, GITHUB_TOKEN, or 'gh auth login')."
-    log "Create it before running Demo 70:"
-    log "  kubectl -n ${SUBSTRATE_NS} create secret generic ${SUBSTRATE_GIT_SECRET} --from-literal=username=oauth2 --from-literal=password=<token>"
-  fi
-
-  # The demos authenticate to the Orka API with a token minted for this SA
-  # (prepare_api_env -> kubectl create token orka-client). The API validates
-  # any SA token via TokenReview, so the SA just needs to exist. cluster-up.sh
-  # provides it on the shared cluster; this e2e-built cluster needs it created.
-  orka_client_sa="${ORKA_TOKEN_SERVICE_ACCOUNT:-orka-client}"
-  orka_client_ns="${ORKA_TOKEN_NAMESPACE:-${SUBSTRATE_NS}}"
-  log "Ensuring Orka API client ServiceAccount ${orka_client_ns}/${orka_client_sa}"
-  kubectl --context "${ctx}" create namespace "${orka_client_ns}" --dry-run=client -o yaml \
-    | kubectl --context "${ctx}" apply -f -
-  kubectl --context "${ctx}" create serviceaccount "${orka_client_sa}" -n "${orka_client_ns}" \
-    --dry-run=client -o yaml | kubectl --context "${ctx}" apply -f -
-
-  log "Agentic add-ons ready (model ${SUBSTRATE_MODEL} via vekil; codex Actor image; git secret; API client SA)."
-fi
+log "Recording ACP v2 direct-evaluation marker ${DIRECT_EVAL_MARKER_NAMESPACE}/${DIRECT_EVAL_MARKER_NAME}"
+kubectl --context "kind-${KIND_CLUSTER}" -n "${DIRECT_EVAL_MARKER_NAMESPACE}" \
+  create configmap "${DIRECT_EVAL_MARKER_NAME}" \
+  --from-literal=mode=direct-workspace-mcp \
+  --from-literal=runtime-dispatch=deferred \
+  --from-literal="marker-schema-version=${DIRECT_EVAL_MARKER_SCHEMA_VERSION}" \
+  --from-literal="substrate-commit=${SUBSTRATE_REF}" \
+  --from-literal="reviewed-patch-set-version=${DIRECT_EVAL_PATCH_SET_VERSION}" \
+  --from-literal="reviewed-patch-set=${DIRECT_EVAL_REVIEWED_PATCH_SET}" \
+  --from-literal="pinned-hardening=${DIRECT_EVAL_HARDENING}" \
+  --dry-run=client -o yaml \
+  | kubectl --context "kind-${KIND_CLUSTER}" apply -f - >/dev/null
 
-log "Agent Substrate installed. Demo 70 can run against context kind-${KIND_CLUSTER}:"
-log "  kubectl config use-context kind-${KIND_CLUSTER}"
-log "  DEMO_SUBSTRATE_NAMESPACE=default ./hack/demos/70-agent-substrate.sh"
+log "Agent Substrate direct-evaluation cluster is available at context kind-${KIND_CLUSTER}."
+log "This cluster does not provide an ACP agent runtime; Demo 70 remains archived."
+log "Use scripts/live-acp-runtime-e2e.sh for live Codex, Claude, and Copilot RuntimePool validation."
 log "Tear down with: kind delete cluster --name ${KIND_CLUSTER}"
diff --git a/hack/demos/cluster/templates/orka-live-template.yaml b/hack/demos/cluster/templates/orka-live-template.yaml
index 2498c3c65..e69476fc3 100644
--- a/hack/demos/cluster/templates/orka-live-template.yaml
+++ b/hack/demos/cluster/templates/orka-live-template.yaml
@@ -1,11 +1,11 @@
-# SandboxTemplate used by Demo 60.
+# Archived SandboxTemplate from the pre-ACP execution-workspace prototype.
 #
-# Mirrors the template from scripts/live-agent-sandbox-e2e.sh, but with a
-# runtime image that bundles git + gh + a writable /workspace so the builder
-# agent can `git push` and `gh pr create` from inside the sandbox.
+# The current ACP v2 path does not consume this template and rejects
+# Task.spec.execution.workspace. A future sandbox-backed v2 supervisor must
+# receive only sanitized workspace artifacts; Git read/publication credentials
+# and direct SCM publication must remain in the separate Workspace/Publisher.
 #
-# Override the runtime image with ORKA_SANDBOX_RUNTIME_IMAGE before
-# applying if you maintain your own:
+# For prototype archaeology only, override the image before applying:
 #
 #   sed "s|REPLACE_RUNTIME_IMAGE|${ORKA_SANDBOX_RUNTIME_IMAGE}|" \
 #     hack/demos/cluster/templates/orka-live-template.yaml | kubectl apply -f -
diff --git a/hack/demos/images/sandbox-runtime/Dockerfile b/hack/demos/images/sandbox-runtime/Dockerfile
index 51b107672..ccac1ac7a 100644
--- a/hack/demos/images/sandbox-runtime/Dockerfile
+++ b/hack/demos/images/sandbox-runtime/Dockerfile
@@ -2,11 +2,8 @@ FROM --platform=$BUILDPLATFORM golang:1.26 AS builder
 
 ARG TARGETARCH
 
-WORKDIR /workspace
-COPY go.mod go.sum ./
-RUN go mod download
-COPY . .
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH:-amd64} go build -a -o /out/worker ./cmd/orka-agent-harness-wrapper
+# Standalone execution-workspace fixture only. The ACP v2 hard cutover removed
+# the legacy agent worker from this image; built-in agents run in RuntimePools.
 
 RUN cat >/tmp/sandbox-runtime.go <<'GO'
 package main
@@ -240,7 +237,7 @@ GO
 
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH:-amd64} go build -o /out/sandbox-runtime /tmp/sandbox-runtime.go
 
-FROM --platform=$TARGETPLATFORM golang:1.26 AS go-runtime
+FROM golang:1.26 AS go-runtime
 
 FROM debian:bookworm-slim
 
@@ -284,13 +281,12 @@ RUN set -eux \
  && install -m 0755 "/tmp/gh_${GH_VERSION}_linux_${gh_arch}/bin/gh" /usr/local/bin/gh \
  && rm -rf /tmp/gh.tgz "/tmp/gh_${GH_VERSION}_linux_${gh_arch}"
 
-COPY --from=builder /out/worker /worker
 COPY --from=builder /out/sandbox-runtime /usr/local/bin/sandbox-runtime
 COPY --from=go-runtime /usr/local/go /usr/local/go
 
 RUN ln -sf /usr/local/go/bin/go /usr/local/bin/go \
     && ln -sf /usr/local/go/bin/gofmt /usr/local/bin/gofmt \
-    && chmod 0755 /worker /usr/local/bin/sandbox-runtime
+    && chmod 0755 /usr/local/bin/sandbox-runtime
 
 ENV GOROOT=/usr/local/go
 ENV PATH="/usr/local/go/bin:${PATH}"
@@ -302,4 +298,4 @@ RUN groupadd -g 1000 worker \
 
 USER 1000:1000
 ENV HOME=/home/worker
-ENTRYPOINT ["/worker"]
+ENTRYPOINT ["/usr/local/bin/sandbox-runtime"]
diff --git a/hack/demos/lib/manifests.sh b/hack/demos/lib/manifests.sh
index 3fa124104..15e10f918 100755
--- a/hack/demos/lib/manifests.sh
+++ b/hack/demos/lib/manifests.sh
@@ -16,11 +16,12 @@ pr_repo_details_block() {
 Repository details for delegated agent tasks:
 - gitRepo: ${DEMO_GIT_REPO}
 - branch: ${DEMO_GIT_BRANCH}
-- gitSecretRef: ${DEMO_GIT_SECRET_REF}
+- readCredentialRef: ${DEMO_GIT_SECRET_REF}
+- publicationCredentialRef: ${DEMO_GIT_SECRET_REF}
 - pushBranch: ${push_branch}
 EOF
   if [[ -n "${DEMO_GIT_FORK_REPO:-}" ]]; then
-    printf '%s\n' "- forkRepo: ${DEMO_GIT_FORK_REPO}"
+    printf '%s\n' "- publicationGitRepo: ${DEMO_GIT_FORK_REPO}"
   fi
   if [[ -n "${DEMO_PR_BASE_BRANCH:-}" ]]; then
     printf '%s\n' "- prBaseBranch: ${DEMO_PR_BASE_BRANCH}"
@@ -39,6 +40,7 @@ metadata:
     demo.orka.ai/scenario: pr-workflow
 spec:
   runtime:
+    contractVersion: orka.harness.v2
     type: ${DEMO_RUNTIME_TYPE}
     defaultMaxTurns: 100
     defaultAllowBash: true
@@ -82,6 +84,7 @@ metadata:
     demo.orka.ai/scenario: pr-workflow
 spec:
   runtime:
+    contractVersion: orka.harness.v2
     type: ${DEMO_RUNTIME_TYPE}
     defaultMaxTurns: 60
     defaultAllowBash: true
@@ -132,6 +135,7 @@ metadata:
     demo.orka.ai/scenario: pr-workflow
 spec:
   runtime:
+    contractVersion: orka.harness.v2
     type: ${DEMO_RUNTIME_TYPE}
     defaultMaxTurns: 60
     defaultAllowBash: true
@@ -193,10 +197,10 @@ spec:
       2. Delegate implementation to ${DEMO_CODER_AGENT_NAME} with that workspace, a pushBranch, timeout "40m", and maxTurns 60. Tell the coder to edit files only and let Orka push the final diff automatically.
       3. Wait for the coder to finish.
       If the coder task fails or times out, do not create a pull request, and report the failure clearly.
-      4. Validate the pushed change with create_container_task before review. First determine the validation environment from repository evidence, not from demo defaults. Every discovery and validation container task that inspects repository files MUST set workspace.gitRepo, workspace.gitSecretRef, and either workspace.ref=headSHA or workspace.branch=pushBranch. Do not run repo validation without workspace. Prefer immutable validation: if the latest coder result includes headSHA, set workspace.ref = headSHA; otherwise set workspace.branch = pushBranch. Do not set workspace.pushBranch for validation. If the environment is not already clear, create a read-only discovery container task with the default worker image and that workspace to inspect project files such as .github/workflows, go.mod, package.json, pyproject.toml, Cargo.toml, Makefile, Dockerfile, and .devcontainer. Choose and report the validation image, command, workspace ref/branch, and evidence. For Go repositories, prefer the go.mod toolchain directive when present, otherwise the go directive, choose a matching golang:<major.minor> image, and prepend: export PATH=/usr/local/go/bin:\$PATH; export GOCACHE=/tmp/go-cache; export GOMODCACHE=/tmp/go-mod-cache; export CGO_ENABLED=0; Use command ["sh", "-lc"] and args [the selected validation command]. If validation fails because the repo is missing, go is not on PATH, or caches are unwritable, retry validation with corrected configuration or report VALIDATION_CONFIG_BLOCKED rather than treating it as a code failure. If the validation environment cannot be determined confidently, report VALIDATION_CONFIG_BLOCKED and do not create a pull request. Wait for the validation task. If validation fails, summarize its result and delegate a focused repair task to ${DEMO_CODER_AGENT_NAME} with workspace.gitRepo, workspace.gitSecretRef, workspace.branch = pushBranch, workspace.pushBranch = pushBranch, timeout "40m", and maxTurns 60. Tell the coder to fix only validation failures. Repeat validation. Use at most ${DEMO_VALIDATION_REPAIR_LIMIT} validation repair tasks; if validation still fails, report VALIDATION_BLOCKED and do not create a pull request.
-      5. Delegate parallel review to ${DEMO_SECURITY_REVIEWER_NAME} and ${DEMO_QUALITY_REVIEWER_NAME} without prior_task. For review tasks, set workspace.gitRepo, workspace.gitSecretRef, workspace.branch = pushBranch, timeout "20m", and maxTurns 40. NEVER include workspace.pushBranch on review tasks. Include the latest validation task name and validation summary in each review prompt. In each review prompt, explicitly tell reviewers the workspace is already checked out for them, so they must not clone again. Tell them to fetch origin, run git diff --name-only origin/<base-branch>...HEAD, inspect only that diff with git diff origin/<base-branch>...HEAD, ignore unchanged repository files outside that diff, avoid blocking on concerns without diff evidence, and cite only changed files/lines in feedback. Explicitly include the original change request acceptance criteria in each review prompt. Reviewers must judge the change against the original request and acceptance criteria, not hidden demo expectations. They may require bounded labels, clear documentation/warnings, and no user/key/prompt label values when those criteria apply. If the coder result includes a files list, include an "Expected changed files" section in the review prompt and tell reviewers their final answer must not mention files outside that list or outside git diff --name-only origin/<base-branch>...HEAD. Reviewers should inspect the current branch diff against the base branch from the prompt; they do not need prior_task.
+      4. Validate the pushed change with create_container_task before review. First determine the validation environment from repository evidence, not from demo defaults. Every discovery and validation container task that inspects repository files MUST set workspace.gitRepo, workspace.readCredentialRef, and either workspace.ref=headSHA or workspace.branch=pushBranch. Do not run repo validation without workspace. Prefer immutable validation: if the latest coder result includes headSHA, set workspace.ref = headSHA; otherwise set workspace.branch = pushBranch. Do not set workspace.pushBranch for validation. If the environment is not already clear, create a read-only discovery container task with the default worker image and that workspace to inspect project files such as .github/workflows, go.mod, package.json, pyproject.toml, Cargo.toml, Makefile, Dockerfile, and .devcontainer. Choose and report the validation image, command, workspace ref/branch, and evidence. For Go repositories, prefer the go.mod toolchain directive when present, otherwise the go directive, choose a matching golang:<major.minor> image, and prepend: export PATH=/usr/local/go/bin:\$PATH; export GOCACHE=/tmp/go-cache; export GOMODCACHE=/tmp/go-mod-cache; export CGO_ENABLED=0; Use command ["sh", "-lc"] and args [the selected validation command]. If validation fails because the repo is missing, go is not on PATH, or caches are unwritable, retry validation with corrected configuration or report VALIDATION_CONFIG_BLOCKED rather than treating it as a code failure. If the validation environment cannot be determined confidently, report VALIDATION_CONFIG_BLOCKED and do not create a pull request. Wait for the validation task. If validation fails, summarize its result and delegate a focused repair task to ${DEMO_CODER_AGENT_NAME} with workspace.gitRepo, workspace.readCredentialRef, workspace.branch = pushBranch, workspace.pushBranch = pushBranch, timeout "40m", and maxTurns 60. Tell the coder to fix only validation failures. Repeat validation. Use at most ${DEMO_VALIDATION_REPAIR_LIMIT} validation repair tasks; if validation still fails, report VALIDATION_BLOCKED and do not create a pull request.
+      5. Delegate parallel review to ${DEMO_SECURITY_REVIEWER_NAME} and ${DEMO_QUALITY_REVIEWER_NAME} without prior_task. For review tasks, set workspace.gitRepo, workspace.readCredentialRef, workspace.branch = pushBranch, timeout "20m", and maxTurns 40. NEVER include workspace.pushBranch on review tasks. Include the latest validation task name and validation summary in each review prompt. In each review prompt, explicitly tell reviewers the workspace is already checked out for them, so they must not clone again. Tell them to fetch origin, run git diff --name-only origin/<base-branch>...HEAD, inspect only that diff with git diff origin/<base-branch>...HEAD, ignore unchanged repository files outside that diff, avoid blocking on concerns without diff evidence, and cite only changed files/lines in feedback. Explicitly include the original change request acceptance criteria in each review prompt. Reviewers must judge the change against the original request and acceptance criteria, not hidden demo expectations. They may require bounded labels, clear documentation/warnings, and no user/key/prompt label values when those criteria apply. If the coder result includes a files list, include an "Expected changed files" section in the review prompt and tell reviewers their final answer must not mention files outside that list or outside git diff --name-only origin/<base-branch>...HEAD. Reviewers should inspect the current branch diff against the base branch from the prompt; they do not need prior_task.
       6. Wait for both reviewers.
-      7. If either reviewer returns CHANGES_NEEDED, summarize all review feedback and delegate a focused repair task to ${DEMO_CODER_AGENT_NAME}. For repair tasks, set workspace.gitRepo, workspace.gitSecretRef, workspace.branch = pushBranch, workspace.pushBranch = pushBranch, timeout "40m", and maxTurns 60. Tell the coder to preserve the original request and fix only the review issues. Prefer additional focused repair iterations over stopping early when reviewers identify concrete diff-backed security, correctness, or acceptance-criteria issues. Then repeat validation and review. Use at most ${DEMO_REVIEW_REPAIR_LIMIT} review repair tasks; if reviewers still request changes, report REVIEW_BLOCKED and do not create a pull request.
+      7. If either reviewer returns CHANGES_NEEDED, summarize all review feedback and delegate a focused repair task to ${DEMO_CODER_AGENT_NAME}. For repair tasks, set workspace.gitRepo, workspace.readCredentialRef, workspace.branch = pushBranch, workspace.pushBranch = pushBranch, timeout "40m", and maxTurns 60. Tell the coder to preserve the original request and fix only the review issues. Prefer additional focused repair iterations over stopping early when reviewers identify concrete diff-backed security, correctness, or acceptance-criteria issues. Then repeat validation and review. Use at most ${DEMO_REVIEW_REPAIR_LIMIT} review repair tasks; if reviewers still request changes, report REVIEW_BLOCKED and do not create a pull request.
       8. When validation passes and both reviewers approve, create a pull request with create_pull_request using the latest successful coder task name, the pushed branch, and the base branch from the prompt.
       9. After the pull request exists, call check_pull_request_ci with the latest coder task and PR number. If CI is pending, keep checking for up to 30 minutes. If CI fails, summarize the failed check details and delegate a focused CI repair task to ${DEMO_CODER_AGENT_NAME} with workspace.branch = pushBranch and workspace.pushBranch = pushBranch. Tell the coder to fix only build, lint, formatting, dependency, or test failures. After each CI repair, repeat validation and review before checking CI again. Use at most ${DEMO_CI_REPAIR_LIMIT} CI repair tasks; if CI still fails, report CI_BLOCKED.
       10. Report the pull request URL, final validation status, final review status, CI status, child-task count, and a brief summary. Do not report the PR as ready unless validation passes, reviewers approve, and CI passes.
@@ -219,7 +223,8 @@ Demo workspace contract:
 - namespace: ${DEMO_NAMESPACE}
 - gitRepo: ${DEMO_GIT_REPO}
 - baseBranch: ${DEMO_GIT_BRANCH}
-- gitSecretRef: ${DEMO_GIT_SECRET_REF}
+- readCredentialRef: ${DEMO_GIT_SECRET_REF}
+- publicationCredentialRef: ${DEMO_GIT_SECRET_REF}
 - pushBranch: ${DEMO_CHAT_PUSH_BRANCH}
 - create_agent roles to use: coder, security-reviewer, quality-reviewer
 
@@ -366,6 +371,7 @@ metadata:
     demo.orka.ai/scenario: cron-workflow
 spec:
   runtime:
+    contractVersion: orka.harness.v2
     type: ${DEMO_RUNTIME_TYPE}
     defaultMaxTurns: 40
     defaultAllowBash: true
@@ -438,20 +444,20 @@ EOF
   emit_block "    " "${DEMO_CRON_REQUEST}"
   printf '\n'
   cat <<EOF
-  agentRuntime:
-    workspace:
-      gitRepo: ${DEMO_GIT_REPO}
-      branch: ${DEMO_GIT_BRANCH}
+  workspace:
+    intent: read
+    gitRepo: ${DEMO_GIT_REPO}
+    branch: ${DEMO_GIT_BRANCH}
 EOF
   if [[ -n "${DEMO_GIT_SECRET_REF:-}" ]]; then
     cat <<EOF
-      gitSecretRef:
-        name: ${DEMO_GIT_SECRET_REF}
+    readCredentialRef:
+      name: ${DEMO_GIT_SECRET_REF}
 EOF
   fi
   if [[ -n "${DEMO_GIT_SUB_PATH:-}" ]]; then
     cat <<EOF
-      subPath: ${DEMO_GIT_SUB_PATH}
+    subPath: ${DEMO_GIT_SUB_PATH}
 EOF
   fi
 }
@@ -468,6 +474,7 @@ metadata:
     demo.orka.ai/scenario: security
 spec:
   runtime:
+    contractVersion: orka.harness.v2
     type: ${DEMO_RUNTIME_TYPE}
     defaultMaxTurns: 120
     defaultAllowBash: true
@@ -506,6 +513,7 @@ metadata:
     demo.orka.ai/scenario: security
 spec:
   runtime:
+    contractVersion: orka.harness.v2
     type: ${DEMO_RUNTIME_TYPE}
     defaultMaxTurns: 120
     defaultAllowBash: true
@@ -610,6 +618,7 @@ metadata:
     demo.orka.ai/scenario: sandbox
 spec:
   runtime:
+    contractVersion: orka.harness.v2
     type: ${DEMO_RUNTIME_TYPE}
     defaultMaxTurns: 30
     # Codex CLI always requires shell execution; setting false makes the
@@ -655,6 +664,7 @@ metadata:
     demo.orka.ai/scenario: sandbox
 spec:
   runtime:
+    contractVersion: orka.harness.v2
     type: ${DEMO_RUNTIME_TYPE}
     defaultMaxTurns: 80
     defaultAllowBash: true
@@ -733,15 +743,15 @@ EOF
   emit_block "    " "${prompt_body}"
   printf '\n'
   cat <<EOF
-  agentRuntime:
-    workspace:
-      gitRepo: ${DEMO_GIT_REPO}
-      branch: ${DEMO_GIT_BRANCH}
+  workspace:
+    intent: read
+    gitRepo: ${DEMO_GIT_REPO}
+    branch: ${DEMO_GIT_BRANCH}
 EOF
   if [[ -n "${DEMO_GIT_SECRET_REF:-}" ]]; then
     cat <<EOF
-      gitSecretRef:
-        name: ${DEMO_GIT_SECRET_REF}
+    readCredentialRef:
+      name: ${DEMO_GIT_SECRET_REF}
 EOF
   fi
   cat <<EOF
@@ -842,6 +852,7 @@ metadata:
     demo.orka.ai/scenario: substrate
 spec:
   runtime:
+    contractVersion: orka.harness.v2
     type: ${DEMO_SUBSTRATE_RUNTIME_TYPE}
     defaultMaxTurns: 30
     defaultAllowBash: true
@@ -904,12 +915,16 @@ ${session_block}
   agentRuntime:
     maxTurns: 30
     allowBash: true
-    workspace:
-      gitRepo: ${DEMO_SUBSTRATE_GIT_REPO}
-      branch: ${DEMO_SUBSTRATE_GIT_BASE_BRANCH}
-      pushBranch: ${DEMO_SUBSTRATE_PUSH_BRANCH}
-      gitSecretRef:
-        name: ${DEMO_SUBSTRATE_GIT_SECRET}
+  workspace:
+    intent: write
+    gitRepo: ${DEMO_SUBSTRATE_GIT_REPO}
+    branch: ${DEMO_SUBSTRATE_GIT_BASE_BRANCH}
+    publicationGitRepo: ${DEMO_SUBSTRATE_GIT_REPO}
+    pushBranch: ${DEMO_SUBSTRATE_PUSH_BRANCH}
+    readCredentialRef:
+      name: ${DEMO_SUBSTRATE_GIT_SECRET}
+    publicationCredentialRef:
+      name: ${DEMO_SUBSTRATE_GIT_SECRET}
   execution:
     workspace:
       enabled: true
diff --git a/internal/acp/adapter_digests.go b/internal/acp/adapter_digests.go
new file mode 100644
index 000000000..e52d7386b
--- /dev/null
+++ b/internal/acp/adapter_digests.go
@@ -0,0 +1,44 @@
+package acp
+
+// BuiltInRuntimeAdapterDigests returns the reviewed adapter artifact digests
+// advertised by the built-in ACP runtime for the given provider kind
+// ("codex", "claude", "copilot", or "opencode"). It is the single source of
+// truth shared by controller runtime planning and the runtime supervisor.
+// Unknown providers return nil. Every call returns a fresh map.
+func BuiltInRuntimeAdapterDigests(provider string) map[string]string {
+	schema := "sha256:" + ACPSchemaSHA256
+	switch provider {
+	case "codex":
+		return map[string]string{
+			"codex-acp":             "sha256:" + CodexACPTarSHA256,
+			"codex-acp-orka-patch":  "sha256:" + CodexACPOrkaPatchSHA256,
+			"codex-acp-orka-dist":   "sha256:" + CodexACPOrkaDistSHA256,
+			"codex-cli-linux-amd64": "sha256:" + CodexCLILinuxX64SHA256,
+			"codex-cli-linux-arm64": "sha256:" + CodexCLILinuxARM64SHA256,
+			"acp-schema":            schema,
+		}
+	case "claude":
+		return map[string]string{
+			"claude-agent-acp":        "sha256:" + ClaudeACPTarSHA256,
+			"claude-code-linux-amd64": "sha256:" + ClaudeSDKLinuxX64SHA256,
+			"claude-code-linux-arm64": "sha256:" + ClaudeSDKLinuxARM64SHA256,
+			"acp-schema":              schema,
+		}
+	case "copilot":
+		return map[string]string{
+			"copilot-cli-linux-amd64": "sha256:" + CopilotCLILinuxX64SHA256,
+			"copilot-cli-linux-arm64": "sha256:" + CopilotCLILinuxARM64SHA256,
+			"acp-schema":              schema,
+		}
+	case "opencode":
+		return map[string]string{
+			"opencode-cli-linux-amd64":     "sha256:" + OpenCodeLinuxX64BinarySHA256,
+			"opencode-cli-linux-arm64":     "sha256:" + OpenCodeLinuxARM64BinarySHA256,
+			"opencode-ripgrep-linux-amd64": "sha256:" + OpenCodeRipgrepLinuxX64BinarySHA256,
+			"opencode-ripgrep-linux-arm64": "sha256:" + OpenCodeRipgrepLinuxARM64BinarySHA256,
+			"acp-schema":                   schema,
+		}
+	default:
+		return nil
+	}
+}
diff --git a/internal/acp/client.go b/internal/acp/client.go
new file mode 100644
index 000000000..d22b2f07f
--- /dev/null
+++ b/internal/acp/client.go
@@ -0,0 +1,422 @@
+package acp
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"strconv"
+	"sync"
+	"sync/atomic"
+)
+
+const DefaultMaxMessageBytes = 8 << 20
+
+var ErrClosed = errors.New("ACP connection closed")
+
+type RPCError struct {
+	Code    int             `json:"code"`
+	Message string          `json:"message"`
+	Data    json.RawMessage `json:"data,omitempty"`
+}
+
+func (e *RPCError) Error() string {
+	if e == nil {
+		return ""
+	}
+	return fmt.Sprintf("ACP JSON-RPC error %d: %s", e.Code, e.Message)
+}
+
+type IncomingRequest struct {
+	ID     json.RawMessage
+	Method string
+	Params json.RawMessage
+}
+
+type IncomingNotification struct {
+	Method string
+	Params json.RawMessage
+}
+
+type RequestHandler func(context.Context, IncomingRequest) (any, *RPCError)
+type NotificationHandler func(context.Context, IncomingNotification)
+
+type Options struct {
+	MaxMessageBytes     int
+	RequestHandler      RequestHandler
+	NotificationHandler NotificationHandler
+}
+
+type Client struct {
+	reader *bufio.Reader
+	writer io.Writer
+	opts   Options
+
+	writeMu sync.Mutex
+	nextID  atomic.Int64
+
+	pendingMu sync.Mutex
+	pending   map[string]chan rpcResponse
+
+	closeOnce sync.Once
+	closed    chan struct{}
+	done      chan struct{}
+	errMu     sync.Mutex
+	err       error
+}
+
+type rpcMessage struct {
+	JSONRPC string          `json:"jsonrpc"`
+	ID      json.RawMessage `json:"id,omitempty"`
+	Method  string          `json:"method,omitempty"`
+	Params  json.RawMessage `json:"params,omitempty"`
+	Result  json.RawMessage `json:"result,omitempty"`
+	Error   *RPCError       `json:"error,omitempty"`
+}
+
+type rpcResponse struct {
+	result json.RawMessage
+	err    error
+}
+
+func NewClient(reader io.Reader, writer io.Writer, opts Options) *Client {
+	if opts.MaxMessageBytes <= 0 {
+		opts.MaxMessageBytes = DefaultMaxMessageBytes
+	}
+	client := &Client{
+		reader:  bufio.NewReaderSize(reader, min(opts.MaxMessageBytes, 64<<10)),
+		writer:  writer,
+		opts:    opts,
+		pending: make(map[string]chan rpcResponse),
+		closed:  make(chan struct{}),
+		done:    make(chan struct{}),
+	}
+	client.nextID.Store(0)
+	go client.readLoop()
+	return client
+}
+
+func (c *Client) Done() <-chan struct{} { return c.done }
+
+func (c *Client) Err() error {
+	c.errMu.Lock()
+	defer c.errMu.Unlock()
+	return c.err
+}
+
+func (c *Client) Close() error {
+	c.fail(ErrClosed)
+	return nil
+}
+
+func (c *Client) Call(ctx context.Context, method string, params, result any) error {
+	return c.call(ctx, method, params, result, nil)
+}
+
+// CallWithWritten is Call with a non-blocking callback invoked after the complete
+// JSON-RPC request has been written to the adapter transport. The callback is the
+// caller's durable ambiguity boundary: after it fires, loss of the response must
+// not be treated as proof that the operation was never accepted.
+func (c *Client) CallWithWritten(ctx context.Context, method string, params, result any, onWritten func()) error {
+	return c.call(ctx, method, params, result, onWritten)
+}
+
+func (c *Client) call(ctx context.Context, method string, params, result any, onWritten func()) error {
+	if method == "" {
+		return fmt.Errorf("ACP method is required")
+	}
+	id := c.nextID.Add(1)
+	idRaw := json.RawMessage(strconv.FormatInt(id, 10))
+	paramsRaw, err := marshalOptional(params)
+	if err != nil {
+		return fmt.Errorf("marshal ACP %s request: %w", method, err)
+	}
+	responseCh := make(chan rpcResponse, 1)
+	key := string(idRaw)
+	c.pendingMu.Lock()
+	select {
+	case <-c.closed:
+		c.pendingMu.Unlock()
+		return c.closedError()
+	default:
+	}
+	c.pending[key] = responseCh
+	c.pendingMu.Unlock()
+
+	request := rpcMessage{JSONRPC: "2.0", ID: idRaw, Method: method, Params: paramsRaw}
+	if err := c.writeMessage(request); err != nil {
+		c.removePending(key)
+		return err
+	}
+	if onWritten != nil {
+		onWritten()
+	}
+
+	select {
+	case response := <-responseCh:
+		if response.err != nil {
+			return response.err
+		}
+		if result == nil || len(response.result) == 0 || bytes.Equal(response.result, []byte("null")) {
+			return nil
+		}
+		if err := json.Unmarshal(response.result, result); err != nil {
+			return fmt.Errorf("decode ACP %s response: %w", method, err)
+		}
+		return nil
+	case <-ctx.Done():
+		c.removePending(key)
+		_ = c.Notify(context.Background(), MethodCancelRequest, CancelRequestNotification{RequestID: idRaw})
+		return ctx.Err()
+	case <-c.closed:
+		c.removePending(key)
+		return c.closedError()
+	}
+}
+
+func (c *Client) Notify(ctx context.Context, method string, params any) error {
+	if method == "" {
+		return fmt.Errorf("ACP method is required")
+	}
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	default:
+	}
+	paramsRaw, err := marshalOptional(params)
+	if err != nil {
+		return fmt.Errorf("marshal ACP %s notification: %w", method, err)
+	}
+	return c.writeMessage(rpcMessage{JSONRPC: "2.0", Method: method, Params: paramsRaw})
+}
+
+func (c *Client) Initialize(ctx context.Context, request InitializeRequest) (InitializeResponse, error) {
+	if request.ProtocolVersion == 0 {
+		request.ProtocolVersion = ProtocolVersion
+	}
+	var response InitializeResponse
+	if err := c.Call(ctx, MethodInitialize, request, &response); err != nil {
+		return InitializeResponse{}, err
+	}
+	if response.ProtocolVersion != ProtocolVersion {
+		return InitializeResponse{}, fmt.Errorf("ACP protocol version %d is unsupported; require %d", response.ProtocolVersion, ProtocolVersion)
+	}
+	return response, nil
+}
+
+func (c *Client) Authenticate(ctx context.Context, methodID string) error {
+	if methodID == "" {
+		return fmt.Errorf("ACP authentication method ID is required")
+	}
+	var response AuthenticateResponse
+	return c.Call(ctx, MethodAuthenticate, AuthenticateRequest{MethodID: methodID}, &response)
+}
+
+func (c *Client) NewSession(ctx context.Context, request NewSessionRequest) (NewSessionResponse, error) {
+	var response NewSessionResponse
+	if err := c.Call(ctx, MethodSessionNew, request, &response); err != nil {
+		return NewSessionResponse{}, err
+	}
+	if response.SessionID == "" {
+		return NewSessionResponse{}, fmt.Errorf("ACP session/new response omitted sessionId")
+	}
+	return response, nil
+}
+
+func (c *Client) Prompt(ctx context.Context, request PromptRequest) (PromptResponse, error) {
+	return c.PromptWithWritten(ctx, request, nil)
+}
+
+func (c *Client) PromptWithWritten(ctx context.Context, request PromptRequest, onWritten func()) (PromptResponse, error) {
+	var response PromptResponse
+	if err := c.CallWithWritten(ctx, MethodSessionPrompt, request, &response, onWritten); err != nil {
+		return PromptResponse{}, err
+	}
+	if err := response.StopReason.Validate(); err != nil {
+		return PromptResponse{}, err
+	}
+	return response, nil
+}
+
+func (c *Client) Cancel(ctx context.Context, sessionID string) error {
+	if sessionID == "" {
+		return fmt.Errorf("ACP session ID is required")
+	}
+	return c.Notify(ctx, MethodSessionCancel, CancelNotification{SessionID: sessionID})
+}
+
+func (c *Client) readLoop() {
+	defer close(c.done)
+	for {
+		line, err := readLineLimited(c.reader, c.opts.MaxMessageBytes)
+		if err != nil {
+			if errors.Is(err, io.EOF) && len(line) == 0 {
+				c.fail(io.EOF)
+			} else {
+				c.fail(fmt.Errorf("read ACP message: %w", err))
+			}
+			return
+		}
+		if len(bytes.TrimSpace(line)) == 0 {
+			continue
+		}
+		var message rpcMessage
+		if err := json.Unmarshal(line, &message); err != nil {
+			c.fail(fmt.Errorf("decode ACP JSON-RPC message: %w", err))
+			return
+		}
+		if message.JSONRPC != "2.0" {
+			c.fail(fmt.Errorf("unsupported ACP JSON-RPC version %q", message.JSONRPC))
+			return
+		}
+		switch {
+		case len(message.ID) > 0 && message.Method == "":
+			c.deliverResponse(message)
+		case len(message.ID) > 0 && message.Method != "":
+			go c.handleRequest(message)
+		case message.Method != "":
+			if handler := c.opts.NotificationHandler; handler != nil {
+				handler(context.Background(), IncomingNotification{Method: message.Method, Params: cloneRaw(message.Params)})
+			}
+		default:
+			c.fail(fmt.Errorf("invalid ACP JSON-RPC envelope"))
+			return
+		}
+	}
+}
+
+func (c *Client) deliverResponse(message rpcMessage) {
+	key := canonicalID(message.ID)
+	c.pendingMu.Lock()
+	responseCh, ok := c.pending[key]
+	if ok {
+		delete(c.pending, key)
+	}
+	c.pendingMu.Unlock()
+	if !ok {
+		return
+	}
+	if message.Error != nil {
+		responseCh <- rpcResponse{err: message.Error}
+		return
+	}
+	responseCh <- rpcResponse{result: cloneRaw(message.Result)}
+}
+
+func (c *Client) handleRequest(message rpcMessage) {
+	request := IncomingRequest{ID: cloneRaw(message.ID), Method: message.Method, Params: cloneRaw(message.Params)}
+	var result any
+	var rpcErr *RPCError
+	if handler := c.opts.RequestHandler; handler != nil {
+		result, rpcErr = handler(context.Background(), request)
+	} else {
+		rpcErr = &RPCError{Code: -32601, Message: "method not supported"}
+	}
+	response := rpcMessage{JSONRPC: "2.0", ID: cloneRaw(message.ID), Error: rpcErr}
+	if rpcErr == nil {
+		raw, err := marshalOptional(result)
+		if err != nil {
+			response.Error = &RPCError{Code: -32603, Message: "failed to encode client response"}
+		} else {
+			response.Result = raw
+		}
+	}
+	if err := c.writeMessage(response); err != nil {
+		c.fail(err)
+	}
+}
+
+func (c *Client) writeMessage(message rpcMessage) error {
+	select {
+	case <-c.closed:
+		return c.closedError()
+	default:
+	}
+	data, err := json.Marshal(message)
+	if err != nil {
+		return fmt.Errorf("encode ACP JSON-RPC message: %w", err)
+	}
+	if len(data) > c.opts.MaxMessageBytes {
+		return fmt.Errorf("ACP message exceeds %d-byte limit", c.opts.MaxMessageBytes)
+	}
+	data = append(data, '\n')
+	c.writeMu.Lock()
+	defer c.writeMu.Unlock()
+	if _, err := c.writer.Write(data); err != nil {
+		c.fail(fmt.Errorf("write ACP message: %w", err))
+		return c.closedError()
+	}
+	return nil
+}
+
+func (c *Client) fail(err error) {
+	if err == nil {
+		err = ErrClosed
+	}
+	c.closeOnce.Do(func() {
+		c.errMu.Lock()
+		c.err = err
+		c.errMu.Unlock()
+		close(c.closed)
+
+		c.pendingMu.Lock()
+		pending := c.pending
+		c.pending = make(map[string]chan rpcResponse)
+		c.pendingMu.Unlock()
+		for _, responseCh := range pending {
+			responseCh <- rpcResponse{err: err}
+		}
+	})
+}
+
+func (c *Client) closedError() error {
+	if err := c.Err(); err != nil {
+		return err
+	}
+	return ErrClosed
+}
+
+func (c *Client) removePending(key string) {
+	c.pendingMu.Lock()
+	delete(c.pending, key)
+	c.pendingMu.Unlock()
+}
+
+func marshalOptional(value any) (json.RawMessage, error) {
+	if value == nil {
+		return nil, nil
+	}
+	data, err := json.Marshal(value)
+	if err != nil {
+		return nil, err
+	}
+	return data, nil
+}
+
+func cloneRaw(raw json.RawMessage) json.RawMessage {
+	return append(json.RawMessage(nil), raw...)
+}
+
+func canonicalID(raw json.RawMessage) string {
+	return string(bytes.TrimSpace(raw))
+}
+
+func readLineLimited(reader *bufio.Reader, max int) ([]byte, error) {
+	var line []byte
+	for {
+		fragment, more, err := reader.ReadLine()
+		if len(line)+len(fragment) > max {
+			return nil, fmt.Errorf("ACP message exceeds %d-byte limit", max)
+		}
+		line = append(line, fragment...)
+		if err != nil {
+			return line, err
+		}
+		if !more {
+			return line, nil
+		}
+	}
+}
diff --git a/internal/acp/client_test.go b/internal/acp/client_test.go
new file mode 100644
index 000000000..92130dca8
--- /dev/null
+++ b/internal/acp/client_test.go
@@ -0,0 +1,290 @@
+package acp
+
+import (
+	"bufio"
+	"context"
+	"encoding/json"
+	"errors"
+	"net"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestClientInitializeNewSessionPrompt(t *testing.T) {
+	clientConn, agentConn := net.Pipe()
+	t.Cleanup(func() {
+		_ = clientConn.Close()
+		_ = agentConn.Close()
+	})
+
+	client := NewClient(clientConn, clientConn, Options{
+		NotificationHandler: func(_ context.Context, notification IncomingNotification) {
+			if notification.Method != MethodSessionUpdate {
+				t.Errorf("notification method = %q, want %q", notification.Method, MethodSessionUpdate)
+			}
+		},
+	})
+
+	agentDone := make(chan error, 1)
+	go func() {
+		reader := bufio.NewReader(agentConn)
+		initialize, err := readTestMessage(reader)
+		if err != nil {
+			agentDone <- err
+			return
+		}
+		if initialize.Method != MethodInitialize {
+			agentDone <- errors.New("first request was not initialize")
+			return
+		}
+		if err := writeTestMessage(agentConn, map[string]any{
+			"jsonrpc": "2.0",
+			"id":      initialize.ID,
+			"result": map[string]any{
+				"protocolVersion": ProtocolVersion,
+				"agentInfo":       map[string]any{"name": "fake", "version": "1.0.0"},
+			},
+		}); err != nil {
+			agentDone <- err
+			return
+		}
+
+		newSession, err := readTestMessage(reader)
+		if err != nil {
+			agentDone <- err
+			return
+		}
+		if newSession.Method != MethodSessionNew {
+			agentDone <- errors.New("second request was not session/new")
+			return
+		}
+		if err := writeTestMessage(agentConn, map[string]any{
+			"jsonrpc": "2.0", "id": newSession.ID, "result": map[string]any{"sessionId": "provider-session"},
+		}); err != nil {
+			agentDone <- err
+			return
+		}
+
+		prompt, err := readTestMessage(reader)
+		if err != nil {
+			agentDone <- err
+			return
+		}
+		if prompt.Method != MethodSessionPrompt {
+			agentDone <- errors.New("third request was not session/prompt")
+			return
+		}
+		if err := writeTestMessage(agentConn, map[string]any{
+			"jsonrpc": "2.0",
+			"method":  MethodSessionUpdate,
+			"params": map[string]any{
+				"sessionId": "provider-session",
+				"update": map[string]any{
+					"sessionUpdate": "agent_message_chunk",
+					"content":       map[string]any{"type": "text", "text": "hello"},
+				},
+			},
+		}); err != nil {
+			agentDone <- err
+			return
+		}
+		if err := writeTestMessage(agentConn, map[string]any{
+			"jsonrpc": "2.0", "id": prompt.ID, "result": map[string]any{"stopReason": StopReasonEndTurn},
+		}); err != nil {
+			agentDone <- err
+			return
+		}
+		agentDone <- nil
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	initialized, err := client.Initialize(ctx, InitializeRequest{
+		ProtocolVersion: ProtocolVersion,
+		ClientInfo:      &Implementation{Name: "orka", Version: "test"},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if initialized.AgentInfo == nil || initialized.AgentInfo.Name != "fake" {
+		t.Fatalf("unexpected agent info: %#v", initialized.AgentInfo)
+	}
+	session, err := client.NewSession(ctx, NewSessionRequest{CWD: "/workspace", MCPServers: []MCPServer{}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	response, err := client.Prompt(ctx, PromptRequest{SessionID: session.SessionID, Prompt: []ContentBlock{Text("work")}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !response.StopReason.Successful() {
+		t.Fatalf("stop reason = %q", response.StopReason)
+	}
+	if err := <-agentDone; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestClientHandlesPermissionRequest(t *testing.T) {
+	clientConn, agentConn := net.Pipe()
+	t.Cleanup(func() {
+		_ = clientConn.Close()
+		_ = agentConn.Close()
+	})
+
+	client := NewClient(clientConn, clientConn, Options{
+		RequestHandler: func(_ context.Context, request IncomingRequest) (any, *RPCError) {
+			if request.Method != MethodRequestPermission {
+				return nil, &RPCError{Code: -32601, Message: "unexpected method"}
+			}
+			var permission RequestPermissionRequest
+			if err := json.Unmarshal(request.Params, &permission); err != nil {
+				return nil, &RPCError{Code: -32602, Message: "invalid permission request"}
+			}
+			return RequestPermissionResponse{Outcome: SelectedPermissionOutcome(permission.Options[0].OptionID)}, nil
+		},
+	})
+	_ = client
+
+	if err := writeTestMessage(agentConn, map[string]any{
+		"jsonrpc": "2.0",
+		"id":      99,
+		"method":  MethodRequestPermission,
+		"params": map[string]any{
+			"sessionId": "s1",
+			"toolCall":  map[string]any{"toolCallId": "tc1", "title": "run"},
+			"options":   []map[string]any{{"optionId": "allow", "name": "Allow", "kind": "allow_once"}},
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	message, err := readTestMessage(bufio.NewReader(agentConn))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(message.ID) != "99" || message.Error != nil {
+		t.Fatalf("unexpected response: %#v", message)
+	}
+	var response RequestPermissionResponse
+	if err := json.Unmarshal(message.Result, &response); err != nil {
+		t.Fatal(err)
+	}
+	if response.Outcome.Outcome != "selected" || response.Outcome.OptionID != "allow" {
+		t.Fatalf("unexpected permission outcome: %#v", response.Outcome)
+	}
+}
+
+func TestClientRejectsProtocolVersionMismatch(t *testing.T) {
+	clientConn, agentConn := net.Pipe()
+	t.Cleanup(func() {
+		_ = clientConn.Close()
+		_ = agentConn.Close()
+	})
+	client := NewClient(clientConn, clientConn, Options{})
+	go func() {
+		request, err := readTestMessage(bufio.NewReader(agentConn))
+		if err == nil {
+			_ = writeTestMessage(agentConn, map[string]any{
+				"jsonrpc": "2.0", "id": request.ID, "result": map[string]any{"protocolVersion": 2},
+			})
+		}
+	}()
+	_, err := client.Initialize(context.Background(), InitializeRequest{ProtocolVersion: ProtocolVersion})
+	if err == nil || !strings.Contains(err.Error(), "unsupported") {
+		t.Fatalf("Initialize error = %v, want unsupported version", err)
+	}
+}
+
+func TestClientBoundsInboundMessage(t *testing.T) {
+	clientConn, agentConn := net.Pipe()
+	t.Cleanup(func() {
+		_ = clientConn.Close()
+		_ = agentConn.Close()
+	})
+	client := NewClient(clientConn, clientConn, Options{MaxMessageBytes: 64})
+	go func() {
+		_, _ = agentConn.Write([]byte(`{"jsonrpc":"2.0","method":"session/update","params":{"blob":"` + strings.Repeat("x", 200) + `"}}` + "\n"))
+	}()
+	select {
+	case <-client.Done():
+		if err := client.Err(); err == nil || !strings.Contains(err.Error(), "exceeds 64-byte limit") {
+			t.Fatalf("client error = %v", err)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("client did not fail oversized message")
+	}
+}
+
+func TestClientContextCancellationSendsCancelRequest(t *testing.T) {
+	clientConn, agentConn := net.Pipe()
+	t.Cleanup(func() {
+		_ = clientConn.Close()
+		_ = agentConn.Close()
+	})
+	client := NewClient(clientConn, clientConn, Options{})
+
+	gotCancel := make(chan rpcMessage, 1)
+	go func() {
+		reader := bufio.NewReader(agentConn)
+		_, _ = readTestMessage(reader)
+		message, err := readTestMessage(reader)
+		if err == nil {
+			gotCancel <- message
+		}
+	}()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	err := client.Call(ctx, "slow", map[string]any{"x": 1}, nil)
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("Call error = %v, want context canceled", err)
+	}
+	select {
+	case message := <-gotCancel:
+		if message.Method != MethodCancelRequest {
+			t.Fatalf("method = %q, want %q", message.Method, MethodCancelRequest)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("cancel request was not sent")
+	}
+}
+
+func TestDecodeSessionUpdateAndStopReasons(t *testing.T) {
+	update, err := DecodeSessionUpdate(json.RawMessage(`{"sessionUpdate":"agent_message_chunk","content":{"type":"text","text":"hi"}}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if update.Type != "agent_message_chunk" || len(update.Raw) == 0 {
+		t.Fatalf("unexpected update: %#v", update)
+	}
+	if err := StopReason("new_reason").Validate(); err == nil {
+		t.Fatal("unknown stop reason unexpectedly accepted")
+	}
+	if StopReasonCancelled.Successful() {
+		t.Fatal("cancelled stop reason must not be successful")
+	}
+}
+
+func readTestMessage(reader *bufio.Reader) (rpcMessage, error) {
+	line, err := reader.ReadBytes('\n')
+	if err != nil {
+		return rpcMessage{}, err
+	}
+	var message rpcMessage
+	if err := json.Unmarshal(line, &message); err != nil {
+		return rpcMessage{}, err
+	}
+	return message, nil
+}
+
+func writeTestMessage(conn net.Conn, value any) error {
+	data, err := json.Marshal(value)
+	if err != nil {
+		return err
+	}
+	data = append(data, '\n')
+	_, err = conn.Write(data)
+	return err
+}
diff --git a/internal/acp/pins.go b/internal/acp/pins.go
new file mode 100644
index 000000000..1f1a2b10d
--- /dev/null
+++ b/internal/acp/pins.go
@@ -0,0 +1,49 @@
+package acp
+
+// Reviewed ACP/profile pins. Artifact versions are supply-chain versions; ACP
+// wire compatibility remains protocolVersion=1 during initialize.
+const (
+	ACPSchemaArtifactVersion = "schema-v1.20.0"
+	ACPSchemaSourceCommit    = "5e89c71497fe07dd4ae633c181a17224f4a8956d"
+	ACPSchemaSHA256          = "92c1dfcda10dd47e99127500a3763da2b471f9ac61e12b9bf0430c32cf953796"
+	ACPMetaSHA256            = "e0bf36f8123b2544b499174197fdc371ec49a1b4572a35114513d56492741599"
+
+	CodexACPVersion          = "1.1.7"
+	CodexACPSourceCommit     = "307d81018f7cc0c3141ddf71c7532d38310e2cfb"
+	CodexACPTarSHA256        = "642920240baa0b6b1951fb2c56b9ff11689648019499615f941000d95d127301"
+	CodexACPOrkaPatchSHA256  = "4b1fc39dc7ac0d6aa404030a3433f46c8b9c67e8e8223efca490a6ab8bf4287a"
+	CodexACPOrkaDistSHA256   = "bcfb6a2772a7de2d027e977d9bc9db5fa210a462de1af7ab061361be4410cc75"
+	CodexCLIVersion          = "0.145.0"
+	CodexCLISourceCommit     = "25af12f7e61572b0bc18ddb1008be543b91519b0"
+	CodexCLILinuxX64SHA256   = "11239480f8e3efd1430f23bbe91c1a397856b8bbe6185ccbaee2382d25e03df2"
+	CodexCLILinuxARM64SHA256 = "b78c57e172b2f18e5969ae26183253cd3cdd9abb3b424a8f7334f4b5530c2b27"
+
+	ClaudeACPVersion          = "0.61.0"
+	ClaudeACPSourceCommit     = "c19bddcf7914259d6c15103a2d1580c7371e1d16"
+	ClaudeACPTarSHA256        = "bb410d53e2d13591da5ebcaf09ae055d166ffefb27b7172988650cd62ef4ebd3"
+	ClaudeAgentSDKVersion     = "0.3.217"
+	ClaudeCodeVersion         = "2.1.217"
+	ClaudeSDKLinuxX64SHA256   = "8d2ccffbdf63aef1436a30b0fd32ef0eac663c3465318b181138471a68f02b92"
+	ClaudeSDKLinuxARM64SHA256 = "51080502df2942d2092c4a5b7122eda518041fbe954027a1e128ede3cb337563"
+
+	CopilotCLIVersion          = "1.0.77"
+	CopilotCLISourceCommit     = "aee1edd29ef0f2058425bf399bcc9e5002a2b8f2"
+	CopilotCLILinuxX64SHA256   = "c6414f99c5b29b049a3b0929ba824f0ff0ae88b85eb52559be45631b96b00f4c"
+	CopilotCLILinuxARM64SHA256 = "5bcf01b30bd74ce415cc93acb404885e0bc396cde037ca68efe2b8ec84f91e5a"
+
+	OpenCodeVersion                       = "1.18.9"
+	OpenCodeSourceCommit                  = "4da7bb44c84e013fa53e9c5d02ac753d1435c81a"
+	OpenCodeSourceTarSHA256               = "bbc3363c6886c63865a60b75d456fff3fbe6b87d8a86f44b2439900695b35de3"
+	OpenCodeLinuxX64BaselineTarSHA256     = "59bf22db1f20c6c9836c926800a8e6416228330c2b518ade3d431d315cd76366"
+	OpenCodeLinuxARM64TarSHA256           = "4846a7e470797950f209126442a291cc06574fd44ddbb96c89d730017f60aae7"
+	OpenCodeLinuxX64BinarySHA256          = "7c4d91c84d2bfdeabb59257e3490c5e5acb08f2aacb3e42f3ddc296a1c3f1aca"
+	OpenCodeLinuxARM64BinarySHA256        = "ae8a9b7c591d3c763463f16bfb5f45230c4c741f039e8967218662836449ecdf"
+	OpenCodeRipgrepVersion                = "15.2.0"
+	OpenCodeRipgrepDebianVersion          = "15.2.0-1"
+	OpenCodeRipgrepLinuxX64DebSHA256      = "d9d86586969e925b8627936ec4387d10cc65baf7d42195258743a49e711b6157"
+	OpenCodeRipgrepLinuxARM64DebSHA256    = "8f18379cd499dd890d27190a359fe194d0bce92d7efad8e47b0f636e64bf4b46"
+	OpenCodeRipgrepLinuxX64BinarySHA256   = "af751db9b06d308fd5078aa973880cc8c75678289386bf1a6ee5faa614aa6f2d"
+	OpenCodeRipgrepLinuxARM64BinarySHA256 = "d3febe5d02e2a15da0909200caeb5af0be65e58736331c2ab88b7086d62e942b"
+	OpenCodeRootInstructionSHA256         = "b8e691e210a9502c9689ba20705806dfb1b5b10b5ca1062f73f9a85b1043a812"
+	OpenCodeImageNoticeSHA256             = "93167c1d7505d3e38efce8bf019c2af4e10ef56529465b87c34e4b3401508a98"
+)
diff --git a/internal/acp/process.go b/internal/acp/process.go
new file mode 100644
index 000000000..2ef034ee0
--- /dev/null
+++ b/internal/acp/process.go
@@ -0,0 +1,440 @@
+package acp
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+)
+
+const (
+	DefaultStderrLimit       = 256 << 10
+	DefaultStopGrace         = 10 * time.Second
+	DefaultExecHelperCommand = "/usr/local/bin/orka-acp-exec-helper"
+
+	cleanupProofObservationInterval = 25 * time.Millisecond
+	cleanupPollInterval             = 10 * time.Millisecond
+	cleanupKillSettleTimeout        = time.Second
+	sessionProcessPollInterval      = 10 * time.Millisecond
+	sessionThawVerificationTimeout  = time.Second
+)
+
+type ProcessConfig struct {
+	Command           string
+	Args              []string
+	Environment       []string
+	Paths             SessionPaths
+	UID               int
+	GID               int
+	StderrLimit       int
+	ClientOptions     Options
+	ExecHelperCommand string
+}
+
+type Process struct {
+	cmd    *exec.Cmd
+	client *Client
+	stderr *boundedBuffer
+	uid    int
+
+	done     chan struct{}
+	waitMu   sync.Mutex
+	waitErr  error
+	stopOnce sync.Once
+}
+
+type CleanupStatus struct {
+	Proven        bool
+	RemainingPIDs []int
+}
+
+func StartProcess(cfg ProcessConfig) (*Process, error) {
+	cfg.Command = strings.TrimSpace(cfg.Command)
+	if cfg.Command == "" || !filepath.IsAbs(cfg.Command) {
+		return nil, fmt.Errorf("ACP adapter command must be an absolute path")
+	}
+	if cfg.Paths.Workspace == "" || !filepath.IsAbs(cfg.Paths.Workspace) {
+		return nil, fmt.Errorf("ACP adapter workspace must be absolute")
+	}
+	if cfg.UID <= 0 || cfg.GID <= 0 {
+		return nil, fmt.Errorf("ACP adapter requires a non-root UID and GID")
+	}
+	if os.Geteuid() != 0 && (cfg.UID != os.Getuid() || cfg.GID != os.Getgid()) {
+		return nil, fmt.Errorf("non-root supervisor can only launch the adapter as its own identity")
+	}
+	if cfg.StderrLimit <= 0 {
+		cfg.StderrLimit = DefaultStderrLimit
+	}
+	cmd, err := newChildCommand(cfg)
+	if err != nil {
+		return nil, err
+	}
+	cmd.Dir = cfg.Paths.Workspace
+	cmd.Env = append([]string(nil), cfg.Environment...)
+
+	stdin, err := cmd.StdinPipe()
+	if err != nil {
+		return nil, fmt.Errorf("create ACP adapter stdin: %w", err)
+	}
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return nil, fmt.Errorf("create ACP adapter stdout: %w", err)
+	}
+	stderr := newBoundedBuffer(cfg.StderrLimit)
+	cmd.Stderr = stderr
+	if err := cmd.Start(); err != nil {
+		_ = stdin.Close()
+		_ = stdout.Close()
+		return nil, fmt.Errorf("start ACP adapter: %w", err)
+	}
+	process := &Process{
+		cmd:    cmd,
+		client: NewClient(stdout, stdin, cfg.ClientOptions),
+		stderr: stderr,
+		uid:    cfg.UID,
+		done:   make(chan struct{}),
+	}
+	go func() {
+		err := cmd.Wait()
+		process.waitMu.Lock()
+		process.waitErr = err
+		process.waitMu.Unlock()
+		_ = stdin.Close()
+		close(process.done)
+	}()
+	return process, nil
+}
+
+func (p *Process) Client() *Client {
+	if p == nil {
+		return nil
+	}
+	return p.client
+}
+
+func (p *Process) PID() int {
+	if p == nil || p.cmd == nil || p.cmd.Process == nil {
+		return 0
+	}
+	return p.cmd.Process.Pid
+}
+
+func (p *Process) Done() <-chan struct{} {
+	if p == nil {
+		closed := make(chan struct{})
+		close(closed)
+		return closed
+	}
+	return p.done
+}
+
+func (p *Process) Wait(ctx context.Context) error {
+	if p == nil {
+		return fmt.Errorf("ACP adapter process is required")
+	}
+	select {
+	case <-p.done:
+		p.waitMu.Lock()
+		defer p.waitMu.Unlock()
+		return p.waitErr
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}
+
+func (p *Process) Stop(ctx context.Context, grace time.Duration) (CleanupStatus, error) {
+	if p == nil || p.cmd == nil || p.cmd.Process == nil {
+		return CleanupStatus{Proven: true}, nil
+	}
+	if grace <= 0 {
+		grace = DefaultStopGrace
+	}
+	p.stopOnce.Do(func() { p.signalForStop(terminateSignal()) })
+
+	status, complete, err := p.waitForCleanup(ctx, grace)
+	if err != nil {
+		p.signalForStop(killSignal())
+		return status, err
+	}
+	if complete {
+		return status, nil
+	}
+
+	p.signalForStop(killSignal())
+	status, complete, err = p.waitForCleanup(ctx, cleanupKillSettleTimeout)
+	if err != nil {
+		return status, err
+	}
+	if !complete {
+		return status, fmt.Errorf("ACP adapter descendant cleanup could not be proven")
+	}
+	return status, nil
+}
+
+func (p *Process) waitForCleanup(ctx context.Context, timeout time.Duration) (CleanupStatus, bool, error) {
+	timer := time.NewTimer(timeout)
+	defer timer.Stop()
+	ticker := time.NewTicker(cleanupPollInterval)
+	defer ticker.Stop()
+
+	done := p.done
+	leaderExited := false
+	select {
+	case <-done:
+		leaderExited = true
+		done = nil
+	default:
+	}
+	status := CleanupStatus{Proven: false}
+	for {
+		if leaderExited {
+			status = p.cleanupStatus()
+			if status.Proven {
+				return status, true, nil
+			}
+		}
+		select {
+		case <-ctx.Done():
+			return status, false, ctx.Err()
+		case <-timer.C:
+			return status, false, nil
+		case <-done:
+			leaderExited = true
+			done = nil
+		case <-ticker.C:
+		}
+	}
+}
+
+func (p *Process) signalForStop(signal os.Signal) {
+	// Production supervisors run as root and assign a non-reused UID to each
+	// RuntimeSession. UID-scoped signaling cannot hit a recycled process-group
+	// ID and reaches descendants that detached from the adapter's group.
+	if p.usesUIDProcessScope() {
+		_, _ = signalProcessesForUID(p.uid, signal)
+		return
+	}
+	select {
+	case <-p.done:
+		return
+	default:
+		_ = signalProcessGroup(p.cmd.Process.Pid, signal)
+	}
+}
+
+func (p *Process) cleanupStatus() CleanupStatus {
+	return proveProcessCleanup(
+		p.uid,
+		reapExitedProcessesForUID,
+		processesForUID,
+		func() { time.Sleep(cleanupProofObservationInterval) },
+	)
+}
+
+func proveProcessCleanup(
+	uid int,
+	reap func(int),
+	inventory func(int) ([]int, bool),
+	betweenObservations func(),
+) CleanupStatus {
+	reap(uid)
+	remaining, supported := inventory(uid)
+	if !supported {
+		return CleanupStatus{Proven: false}
+	}
+	if len(remaining) != 0 {
+		return CleanupStatus{Proven: false, RemainingPIDs: append([]int(nil), remaining...)}
+	}
+
+	betweenObservations()
+	reap(uid)
+	remaining, supported = inventory(uid)
+	if !supported {
+		return CleanupStatus{Proven: false}
+	}
+	return CleanupStatus{
+		Proven:        len(remaining) == 0,
+		RemainingPIDs: append([]int(nil), remaining...),
+	}
+}
+
+func (p *Process) Diagnostics() string {
+	if p == nil || p.stderr == nil {
+		return ""
+	}
+	return p.stderr.String()
+}
+
+type boundedBuffer struct {
+	mu        sync.Mutex
+	data      []byte
+	limit     int
+	truncated bool
+}
+
+func newBoundedBuffer(limit int) *boundedBuffer {
+	return &boundedBuffer{limit: limit}
+}
+
+func (b *boundedBuffer) Write(data []byte) (int, error) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	original := len(data)
+	if b.limit <= 0 {
+		b.truncated = b.truncated || original > 0
+		return original, nil
+	}
+	if len(data) >= b.limit {
+		b.data = append(b.data[:0], data[len(data)-b.limit:]...)
+		b.truncated = true
+		return original, nil
+	}
+	if overflow := len(b.data) + len(data) - b.limit; overflow > 0 {
+		copy(b.data, b.data[overflow:])
+		b.data = b.data[:len(b.data)-overflow]
+		b.truncated = true
+	}
+	b.data = append(b.data, data...)
+	return original, nil
+}
+
+func (b *boundedBuffer) String() string {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if !b.truncated {
+		return string(b.data)
+	}
+	return "[truncated]\n" + string(b.data)
+}
+
+func (b *boundedBuffer) ReadFrom(reader io.Reader) (int64, error) {
+	buffer := make([]byte, 32<<10)
+	var total int64
+	for {
+		n, err := reader.Read(buffer)
+		if n > 0 {
+			_, _ = b.Write(buffer[:n])
+			total += int64(n)
+		}
+		if err != nil {
+			if errors.Is(err, io.EOF) {
+				return total, nil
+			}
+			return total, err
+		}
+	}
+}
+
+func (p *Process) Freeze(ctx context.Context) error {
+	if p == nil || p.PID() <= 0 {
+		return fmt.Errorf("ACP adapter process is not running")
+	}
+	select {
+	case <-p.done:
+		return fmt.Errorf("ACP adapter exited while freezing")
+	default:
+	}
+	ticker := time.NewTicker(sessionProcessPollInterval)
+	defer ticker.Stop()
+	for {
+		if err := p.signalSessionProcesses(stopSignal()); err != nil {
+			return fmt.Errorf("stop ACP session processes: %w", err)
+		}
+		reapExitedProcessesForUIDExcept(p.uid, p.PID())
+		stopped, supported, err := processesStoppedForUID(p.uid, p.PID())
+		if err != nil {
+			return err
+		}
+		if !supported {
+			return fmt.Errorf("process-freeze verification is unsupported on this platform")
+		}
+		if stopped {
+			select {
+			case <-p.done:
+				return fmt.Errorf("ACP adapter exited while freezing")
+			default:
+				return nil
+			}
+		}
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case <-p.done:
+			return fmt.Errorf("ACP adapter exited while freezing")
+		case <-ticker.C:
+		}
+	}
+}
+
+func (p *Process) Thaw() error {
+	if p == nil || p.PID() <= 0 {
+		return fmt.Errorf("ACP adapter process is not running")
+	}
+	select {
+	case <-p.done:
+		return fmt.Errorf("ACP adapter exited while thawing")
+	default:
+	}
+	if err := p.signalSessionProcesses(continueSignal()); err != nil {
+		return fmt.Errorf("continue ACP session processes: %w", err)
+	}
+	uidScoped := p.usesUIDProcessScope()
+	ticker := time.NewTicker(sessionProcessPollInterval)
+	defer ticker.Stop()
+	timer := time.NewTimer(sessionThawVerificationTimeout)
+	defer timer.Stop()
+	for {
+		resumed, supported, err := processesResumedForUID(p.uid, p.PID())
+		if err != nil {
+			return err
+		}
+		if !supported {
+			if uidScoped {
+				return fmt.Errorf("process-thaw verification is unsupported on this platform")
+			}
+			return nil
+		}
+		if resumed {
+			select {
+			case <-p.done:
+				return fmt.Errorf("ACP adapter exited while thawing")
+			default:
+				return nil
+			}
+		}
+		select {
+		case <-p.done:
+			return fmt.Errorf("ACP adapter exited while thawing")
+		case <-timer.C:
+			return fmt.Errorf("ACP session process thaw could not be proven")
+		case <-ticker.C:
+			if err := p.signalSessionProcesses(continueSignal()); err != nil {
+				return fmt.Errorf("continue ACP session processes: %w", err)
+			}
+		}
+	}
+}
+
+func (p *Process) usesUIDProcessScope() bool {
+	return os.Geteuid() == 0 && p.uid != os.Getuid()
+}
+
+func (p *Process) signalSessionProcesses(signal os.Signal) error {
+	if p.usesUIDProcessScope() {
+		supported, err := signalProcessesForUID(p.uid, signal)
+		if err != nil {
+			return err
+		}
+		if !supported {
+			return fmt.Errorf("UID-scoped process signaling is unsupported on this platform")
+		}
+		return nil
+	}
+	return signalProcessGroup(p.PID(), signal)
+}
diff --git a/internal/acp/process_linux.go b/internal/acp/process_linux.go
new file mode 100644
index 000000000..faacc8142
--- /dev/null
+++ b/internal/acp/process_linux.go
@@ -0,0 +1,380 @@
+//go:build linux
+
+package acp
+
+import (
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+const execHelperProtocolVersion = "orka-acp-exec-v1"
+
+func newChildCommand(cfg ProcessConfig) (*exec.Cmd, error) {
+	helperCommand := strings.TrimSpace(cfg.ExecHelperCommand)
+	if helperCommand == "" {
+		helperCommand = DefaultExecHelperCommand
+	}
+	if !filepath.IsAbs(helperCommand) {
+		return nil, fmt.Errorf("ACP exec helper command must be an absolute path")
+	}
+	helperArgs := []string{
+		execHelperProtocolVersion,
+		strconv.Itoa(os.Getpid()),
+		strconv.Itoa(cfg.UID),
+		strconv.Itoa(cfg.GID),
+		cfg.Command,
+	}
+	helperArgs = append(helperArgs, cfg.Args...)
+	cmd := exec.Command(helperCommand, helperArgs...)
+	cmd.SysProcAttr = childSysProcAttr(cfg.UID, cfg.GID)
+	return cmd, nil
+}
+
+// RunExecHelper validates the trusted launch envelope, applies hard resource
+// limits to the current process, and only then replaces it with the adapter.
+// It is exported solely for cmd/orka-acp-exec-helper.
+func RunExecHelper(args, environment []string) error {
+	invocation, err := parseExecHelperInvocation(args)
+	if err != nil {
+		return err
+	}
+	if err := verifyExecHelperEnvelope(invocation); err != nil {
+		return err
+	}
+	if err := applyCurrentProcessLimits(); err != nil {
+		return fmt.Errorf("apply child resource limits: %w", err)
+	}
+	argv := append([]string{invocation.command}, invocation.args...)
+	return unix.Exec(invocation.command, argv, environment)
+}
+
+type execHelperInvocation struct {
+	parentPID int
+	uid       int
+	gid       int
+	command   string
+	args      []string
+}
+
+func parseExecHelperInvocation(args []string) (execHelperInvocation, error) {
+	if len(args) < 5 || args[0] != execHelperProtocolVersion {
+		return execHelperInvocation{}, fmt.Errorf("invalid ACP exec helper invocation")
+	}
+	parentPID, err := strconv.Atoi(args[1])
+	if err != nil || parentPID <= 0 {
+		return execHelperInvocation{}, fmt.Errorf("invalid ACP exec helper parent PID")
+	}
+	uid, err := strconv.Atoi(args[2])
+	if err != nil || uid <= 0 {
+		return execHelperInvocation{}, fmt.Errorf("invalid ACP exec helper UID")
+	}
+	gid, err := strconv.Atoi(args[3])
+	if err != nil || gid <= 0 {
+		return execHelperInvocation{}, fmt.Errorf("invalid ACP exec helper GID")
+	}
+	command := strings.TrimSpace(args[4])
+	if command == "" || !filepath.IsAbs(command) {
+		return execHelperInvocation{}, fmt.Errorf("invalid ACP exec helper adapter command")
+	}
+	return execHelperInvocation{
+		parentPID: parentPID,
+		uid:       uid,
+		gid:       gid,
+		command:   command,
+		args:      append([]string(nil), args[5:]...),
+	}, nil
+}
+
+func verifyExecHelperEnvelope(invocation execHelperInvocation) error {
+	if os.Getuid() != invocation.uid || os.Geteuid() != invocation.uid {
+		return fmt.Errorf("ACP exec helper UID fence mismatch")
+	}
+	if os.Getgid() != invocation.gid || os.Getegid() != invocation.gid {
+		return fmt.Errorf("ACP exec helper GID fence mismatch")
+	}
+	groups, err := os.Getgroups()
+	if err != nil {
+		return fmt.Errorf("inspect ACP exec helper supplementary groups: %w", err)
+	}
+	if len(groups) != 0 {
+		return fmt.Errorf("ACP exec helper supplementary-group fence mismatch")
+	}
+	if unix.Getpgrp() != os.Getpid() {
+		return fmt.Errorf("ACP exec helper process-group fence mismatch")
+	}
+	if os.Getppid() != invocation.parentPID {
+		return fmt.Errorf("ACP exec helper parent fence mismatch")
+	}
+	if err := unix.Prctl(unix.PR_SET_PDEATHSIG, uintptr(unix.SIGKILL), 0, 0, 0); err != nil {
+		return fmt.Errorf("set ACP adapter parent-death signal: %w", err)
+	}
+	if os.Getppid() != invocation.parentPID {
+		return fmt.Errorf("ACP exec helper parent exited during launch")
+	}
+	return nil
+}
+
+type childResourceLimit struct {
+	resource int
+	maximum  uint64
+}
+
+func childResourceLimits() []childResourceLimit {
+	return []childResourceLimit{
+		{resource: unix.RLIMIT_NPROC, maximum: 256},
+		{resource: unix.RLIMIT_NOFILE, maximum: 4096},
+		{resource: unix.RLIMIT_FSIZE, maximum: 1 << 30},
+	}
+}
+
+func applyCurrentProcessLimits() error {
+	for _, configured := range childResourceLimits() {
+		var inherited unix.Rlimit
+		if err := unix.Getrlimit(configured.resource, &inherited); err != nil {
+			return err
+		}
+		target := min(configured.maximum, inherited.Cur, inherited.Max)
+		limit := &unix.Rlimit{Cur: target, Max: target}
+		if err := unix.Setrlimit(configured.resource, limit); err != nil {
+			return err
+		}
+		var applied unix.Rlimit
+		if err := unix.Getrlimit(configured.resource, &applied); err != nil {
+			return err
+		}
+		if applied.Cur != target || applied.Max != target {
+			return fmt.Errorf("resource limit verification failed")
+		}
+	}
+	return nil
+}
+
+func childSysProcAttr(uid, gid int) *syscall.SysProcAttr {
+	attr := &syscall.SysProcAttr{Setpgid: true, Pdeathsig: syscall.SIGKILL}
+	if os.Geteuid() == 0 {
+		attr.Credential = &syscall.Credential{Uid: uint32(uid), Gid: uint32(gid), Groups: []uint32{}}
+	}
+	return attr
+}
+
+func signalProcessGroup(pid int, signal os.Signal) error {
+	sig, ok := signal.(syscall.Signal)
+	if !ok {
+		return syscall.EINVAL
+	}
+	return syscall.Kill(-pid, sig)
+}
+
+func terminateSignal() os.Signal { return syscall.SIGTERM }
+func killSignal() os.Signal      { return syscall.SIGKILL }
+func stopSignal() os.Signal      { return syscall.SIGSTOP }
+func continueSignal() os.Signal  { return syscall.SIGCONT }
+
+type procProcess struct {
+	pid     int
+	realUID uint64
+	state   byte
+}
+
+func processesForUID(uid int) ([]int, bool) {
+	processes, supported := inspectProcessesForUIDAt("/proc", uid, os.Getpid())
+	if !supported {
+		return nil, false
+	}
+	pids := make([]int, 0, len(processes))
+	for _, process := range processes {
+		pids = append(pids, process.pid)
+	}
+	return pids, true
+}
+
+func inspectProcessesForUIDAt(procRoot string, uid, selfPID int) ([]procProcess, bool) {
+	entries, err := os.ReadDir(procRoot)
+	if err != nil {
+		return nil, false
+	}
+	var processes []procProcess
+	for _, entry := range entries {
+		name := entry.Name()
+		if !isDecimalPIDName(name) {
+			continue
+		}
+		pid, err := strconv.Atoi(name)
+		if err != nil || pid <= 0 || strconv.Itoa(pid) != name {
+			return nil, false
+		}
+		if pid == selfPID {
+			continue
+		}
+		data, err := os.ReadFile(filepath.Join(procRoot, entry.Name(), "status"))
+		if errors.Is(err, fs.ErrNotExist) {
+			// A numeric /proc entry may disappear between ReadDir and ReadFile.
+			continue
+		}
+		if err != nil {
+			return nil, false
+		}
+		process, err := parseProcStatus(pid, data)
+		if err != nil {
+			return nil, false
+		}
+		if process.realUID == uint64(uid) {
+			processes = append(processes, process)
+		}
+	}
+	sort.Slice(processes, func(i, j int) bool { return processes[i].pid < processes[j].pid })
+	return processes, true
+}
+
+func isDecimalPIDName(name string) bool {
+	if name == "" {
+		return false
+	}
+	for _, character := range name {
+		if character < '0' || character > '9' {
+			return false
+		}
+	}
+	return true
+}
+
+func parseProcStatus(pid int, data []byte) (procProcess, error) {
+	process := procProcess{pid: pid}
+	var foundUID, foundState bool
+	for line := range strings.SplitSeq(string(data), "\n") {
+		fields := strings.Fields(line)
+		if len(fields) == 0 {
+			continue
+		}
+		switch fields[0] {
+		case "Uid:":
+			if foundUID || len(fields) < 5 {
+				return procProcess{}, fmt.Errorf("malformed process UID status")
+			}
+			for index, field := range fields[1:5] {
+				value, err := strconv.ParseUint(field, 10, 32)
+				if err != nil {
+					return procProcess{}, fmt.Errorf("malformed process UID status")
+				}
+				if index == 0 {
+					process.realUID = value
+				}
+			}
+			foundUID = true
+		case "State:":
+			if foundState || len(fields) < 2 || len(fields[1]) != 1 {
+				return procProcess{}, fmt.Errorf("malformed process state status")
+			}
+			process.state = fields[1][0]
+			foundState = true
+		}
+	}
+	if !foundUID || !foundState {
+		return procProcess{}, fmt.Errorf("incomplete process status")
+	}
+	return process, nil
+}
+
+func reapExitedProcessesForUID(uid int) {
+	reapExitedProcessesForUIDExcept(uid, 0)
+}
+
+func reapExitedProcessesForUIDExcept(uid, excludedPID int) {
+	processes, supported := inspectProcessesForUIDAt("/proc", uid, os.Getpid())
+	if !supported {
+		return
+	}
+	for _, process := range processes {
+		if process.pid == excludedPID || process.state != 'Z' {
+			continue
+		}
+		var status unix.WaitStatus
+		_, _ = unix.Wait4(process.pid, &status, unix.WNOHANG, nil)
+	}
+}
+
+func processesStoppedForUID(uid, leaderPID int) (bool, bool, error) {
+	processes, supported := inspectProcessesForUIDAt("/proc", uid, os.Getpid())
+	if !supported {
+		return false, false, fmt.Errorf("inspect processes for UID %d", uid)
+	}
+	return sessionProcessesStopped(processes, leaderPID), true, nil
+}
+
+func processesResumedForUID(uid, leaderPID int) (bool, bool, error) {
+	processes, supported := inspectProcessesForUIDAt("/proc", uid, os.Getpid())
+	if !supported {
+		return false, false, fmt.Errorf("inspect processes for UID %d", uid)
+	}
+	return sessionProcessesResumed(processes, leaderPID), true, nil
+}
+
+func sessionProcessesStopped(processes []procProcess, leaderPID int) bool {
+	leaderStopped := false
+	for _, process := range processes {
+		switch process.state {
+		case 'Z':
+			continue
+		case 'T', 't':
+			if process.pid == leaderPID {
+				leaderStopped = true
+			}
+		default:
+			return false
+		}
+	}
+	return leaderStopped
+}
+
+func sessionProcessesResumed(processes []procProcess, leaderPID int) bool {
+	leaderResumed := false
+	for _, process := range processes {
+		switch process.state {
+		case 'Z', 'X', 'x':
+			continue
+		case 'T', 't':
+			return false
+		case 'R', 'S', 'D', 'I', 'K', 'P', 'W':
+			if process.pid == leaderPID {
+				leaderResumed = true
+			}
+		default:
+			return false
+		}
+	}
+	return leaderResumed
+}
+
+func signalProcessesForUID(uid int, signal os.Signal) (bool, error) {
+	if os.Geteuid() != 0 || uid == os.Getuid() {
+		return false, nil
+	}
+	sig, ok := signal.(syscall.Signal)
+	if !ok {
+		return true, syscall.EINVAL
+	}
+	processes, supported := inspectProcessesForUIDAt("/proc", uid, os.Getpid())
+	if !supported {
+		return false, nil
+	}
+	var first error
+	for _, process := range processes {
+		if process.state == 'Z' {
+			continue
+		}
+		if err := syscall.Kill(process.pid, sig); err != nil && err != syscall.ESRCH && first == nil {
+			first = err
+		}
+	}
+	return true, first
+}
diff --git a/internal/acp/process_linux_test.go b/internal/acp/process_linux_test.go
new file mode 100644
index 000000000..9feb16315
--- /dev/null
+++ b/internal/acp/process_linux_test.go
@@ -0,0 +1,746 @@
+//go:build linux
+
+package acp
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"os/signal"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"strings"
+	"sync"
+	"syscall"
+	"testing"
+	"time"
+
+	"golang.org/x/sys/unix"
+)
+
+var testExecHelperState struct {
+	once sync.Once
+	dir  string
+	path string
+	err  error
+}
+
+func testExecHelperCommand(t *testing.T) string {
+	t.Helper()
+	if os.Geteuid() != 0 {
+		groups, err := os.Getgroups()
+		if err != nil {
+			t.Fatal(err)
+		}
+		if len(groups) != 0 {
+			t.Skipf("non-root test environment cannot clear supplementary groups %v without weakening the production fence", groups)
+		}
+	}
+	testExecHelperState.once.Do(func() {
+		testExecHelperState.dir, testExecHelperState.err = os.MkdirTemp("", "orka-acp-exec-helper-test-")
+		if testExecHelperState.err != nil {
+			return
+		}
+		if testExecHelperState.err = os.Chmod(testExecHelperState.dir, 0o755); testExecHelperState.err != nil {
+			return
+		}
+		testExecHelperState.path = filepath.Join(testExecHelperState.dir, "orka-acp-exec-helper")
+		_, sourceFile, _, ok := runtime.Caller(0)
+		if !ok {
+			testExecHelperState.err = fmt.Errorf("resolve process test source path")
+			return
+		}
+		repositoryRoot := filepath.Clean(filepath.Join(filepath.Dir(sourceFile), "..", ".."))
+		command := exec.Command("go", "build", "-buildvcs=false", "-trimpath", "-o", testExecHelperState.path, "./cmd/orka-acp-exec-helper")
+		command.Dir = repositoryRoot
+		command.Env = append(os.Environ(), "CGO_ENABLED=0")
+		output, err := command.CombinedOutput()
+		if err != nil {
+			testExecHelperState.err = fmt.Errorf("build ACP exec helper: %w: %s", err, strings.TrimSpace(string(output)))
+			return
+		}
+		testExecHelperState.err = os.Chmod(testExecHelperState.path, 0o755)
+	})
+	if testExecHelperState.err != nil {
+		t.Fatal(testExecHelperState.err)
+	}
+	return testExecHelperState.path
+}
+
+func cleanupTestExecHelper() {
+	if testExecHelperState.dir != "" {
+		_ = os.RemoveAll(testExecHelperState.dir)
+	}
+}
+
+func TestStartProcessAppliesLimitsBeforeAdapterExecutes(t *testing.T) {
+	adapter := copyTestExecutableForChild(t)
+	uid, gid := os.Getuid(), os.Getgid()
+	if uid == 0 {
+		uid, gid = 65534, 65534
+	}
+	process, err := StartProcess(ProcessConfig{
+		Command: adapter,
+		Args: []string{
+			"-test.run=^TestACPProcessLimitReporter$",
+		},
+		Environment: []string{
+			"GO_WANT_ACP_LIMIT_REPORTER=1",
+			"ACP_EXPECT_UID=" + strconv.Itoa(uid),
+			"ACP_EXPECT_GID=" + strconv.Itoa(gid),
+		},
+		Paths:             SessionPaths{Workspace: "/tmp"},
+		UID:               uid,
+		GID:               gid,
+		ExecHelperCommand: testExecHelperCommand(t),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	if err := process.Wait(ctx); err != nil {
+		t.Fatalf("adapter wait: %v; diagnostics: %s", err, process.Diagnostics())
+	}
+	if !strings.Contains(process.Diagnostics(), "limits-applied-before-adapter") {
+		t.Fatalf("missing pre-exec limit marker in diagnostics: %q", process.Diagnostics())
+	}
+}
+
+func TestACPProcessLimitReporter(t *testing.T) {
+	if os.Getenv("GO_WANT_ACP_LIMIT_REPORTER") != "1" {
+		return
+	}
+	wantUID, err := strconv.Atoi(os.Getenv("ACP_EXPECT_UID"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	wantGID, err := strconv.Atoi(os.Getenv("ACP_EXPECT_GID"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if os.Getuid() != wantUID || os.Geteuid() != wantUID {
+		t.Fatalf("adapter UID = %d/%d, want %d", os.Getuid(), os.Geteuid(), wantUID)
+	}
+	if os.Getgid() != wantGID || os.Getegid() != wantGID {
+		t.Fatalf("adapter GID = %d/%d, want %d", os.Getgid(), os.Getegid(), wantGID)
+	}
+	groups, err := os.Getgroups()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(groups) != 0 {
+		t.Fatalf("adapter supplementary groups = %v, want none", groups)
+	}
+	if unix.Getpgrp() != os.Getpid() {
+		t.Fatalf("adapter process group = %d, want PID %d", unix.Getpgrp(), os.Getpid())
+	}
+	for _, configured := range childResourceLimits() {
+		var limit unix.Rlimit
+		if err := unix.Getrlimit(configured.resource, &limit); err != nil {
+			t.Fatal(err)
+		}
+		if limit.Cur > configured.maximum || limit.Max > configured.maximum || limit.Cur != limit.Max {
+			t.Fatalf("resource %d limit = %#v, maximum %d", configured.resource, limit, configured.maximum)
+		}
+	}
+	fmt.Fprintln(os.Stderr, "limits-applied-before-adapter")
+}
+
+func TestParseExecHelperInvocationAllowsPIDOneParent(t *testing.T) {
+	invocation, err := parseExecHelperInvocation([]string{
+		execHelperProtocolVersion, "1", "1000", "1000", "/bin/true", "argument",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if invocation.parentPID != 1 || invocation.command != "/bin/true" || len(invocation.args) != 1 {
+		t.Fatalf("invocation = %#v", invocation)
+	}
+}
+
+func TestParseExecHelperInvocationRejectsBypasses(t *testing.T) {
+	valid := []string{execHelperProtocolVersion, "100", "1000", "1000", "/bin/true"}
+	tests := []struct {
+		name string
+		args []string
+	}{
+		{name: "wrong protocol", args: append([]string{"other"}, valid[1:]...)},
+		{name: "missing parent", args: valid[:1]},
+		{name: "root uid", args: []string{execHelperProtocolVersion, "100", "0", "1000", "/bin/true"}},
+		{name: "root gid", args: []string{execHelperProtocolVersion, "100", "1000", "0", "/bin/true"}},
+		{name: "relative command", args: []string{execHelperProtocolVersion, "100", "1000", "1000", "bin/true"}},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if _, err := parseExecHelperInvocation(test.args); err == nil {
+				t.Fatal("invalid helper invocation unexpectedly accepted")
+			}
+		})
+	}
+}
+
+func TestInspectProcessesForUIDFailsClosedOnStatusErrors(t *testing.T) {
+	tests := []struct {
+		name    string
+		prepare func(*testing.T, string)
+	}{
+		{
+			name: "read error",
+			prepare: func(t *testing.T, root string) {
+				t.Helper()
+				path := filepath.Join(root, "101", "status")
+				if err := os.MkdirAll(path, 0o755); err != nil {
+					t.Fatal(err)
+				}
+			},
+		},
+		{
+			name: "numeric pid overflow",
+			prepare: func(t *testing.T, root string) {
+				t.Helper()
+				if err := os.Mkdir(filepath.Join(root, "999999999999999999999999999999"), 0o755); err != nil {
+					t.Fatal(err)
+				}
+			},
+		},
+		{
+			name: "malformed uid",
+			prepare: func(t *testing.T, root string) {
+				t.Helper()
+				writeFakeProcStatus(t, root, 101, "State:\tS (sleeping)\nUid:\tnot-a-uid 1000 1000 1000\n")
+			},
+		},
+		{
+			name: "missing uid",
+			prepare: func(t *testing.T, root string) {
+				t.Helper()
+				writeFakeProcStatus(t, root, 101, "State:\tS (sleeping)\n")
+			},
+		},
+		{
+			name: "malformed state",
+			prepare: func(t *testing.T, root string) {
+				t.Helper()
+				writeFakeProcStatus(t, root, 101, "State:\trunning\nUid:\t1000 1000 1000 1000\n")
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			root := t.TempDir()
+			test.prepare(t, root)
+			if processes, supported := inspectProcessesForUIDAt(root, 1000, -1); supported {
+				t.Fatalf("inventory unexpectedly proven: %#v", processes)
+			}
+		})
+	}
+}
+
+func TestInspectProcessesForUIDAllowsOnlyConfirmedENOENTRaces(t *testing.T) {
+	root := t.TempDir()
+	if err := os.Mkdir(filepath.Join(root, "101"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	writeFakeProcStatus(t, root, 300, "State:\tS (sleeping)\nUid:\t2000 2000 2000 2000\n")
+	writeFakeProcStatus(t, root, 200, "State:\tR (running)\nUid:\t1000 1000 1000 1000\n")
+	writeFakeProcStatus(t, root, 150, "State:\tT (stopped)\nUid:\t1000 1000 1000 1000\n")
+
+	processes, supported := inspectProcessesForUIDAt(root, 1000, -1)
+	if !supported {
+		t.Fatal("inventory unexpectedly unproven")
+	}
+	if len(processes) != 2 || processes[0].pid != 150 || processes[1].pid != 200 {
+		t.Fatalf("processes = %#v", processes)
+	}
+}
+
+func TestSessionProcessStateProofRequiresLiveLeader(t *testing.T) {
+	const leaderPID = 10
+	tests := []struct {
+		name        string
+		processes   []procProcess
+		wantStopped bool
+		wantResumed bool
+	}{
+		{name: "empty"},
+		{name: "only zombie leader", processes: []procProcess{{pid: leaderPID, state: 'Z'}}},
+		{name: "dead leader", processes: []procProcess{{pid: leaderPID, state: 'X'}}},
+		{name: "lowercase dead leader", processes: []procProcess{{pid: leaderPID, state: 'x'}}},
+		{name: "unknown leader state", processes: []procProcess{{pid: leaderPID, state: '?'}}},
+		{name: "stopped leader", processes: []procProcess{{pid: leaderPID, state: 'T'}}, wantStopped: true},
+		{name: "traced stopped leader", processes: []procProcess{{pid: leaderPID, state: 't'}}, wantStopped: true},
+		{name: "sleeping leader", processes: []procProcess{{pid: leaderPID, state: 'S'}}, wantResumed: true},
+		{name: "running leader", processes: []procProcess{{pid: leaderPID, state: 'R'}}, wantResumed: true},
+		{name: "stopped leader with zombie", processes: []procProcess{{pid: leaderPID, state: 'T'}, {pid: 20, state: 'Z'}}, wantStopped: true},
+		{name: "resumed leader with zombie", processes: []procProcess{{pid: leaderPID, state: 'S'}, {pid: 20, state: 'Z'}}, wantResumed: true},
+		{name: "resumed leader with dead descendant", processes: []procProcess{{pid: leaderPID, state: 'S'}, {pid: 20, state: 'X'}}, wantResumed: true},
+		{name: "resumed leader with unknown descendant", processes: []procProcess{{pid: leaderPID, state: 'S'}, {pid: 20, state: '?'}}},
+		{name: "stopped descendant without leader", processes: []procProcess{{pid: 20, state: 'T'}}},
+		{name: "resumed descendant without leader", processes: []procProcess{{pid: 20, state: 'S'}}},
+		{name: "stopped leader with running descendant", processes: []procProcess{{pid: leaderPID, state: 'T'}, {pid: 20, state: 'S'}}},
+		{name: "resumed leader with stopped descendant", processes: []procProcess{{pid: leaderPID, state: 'S'}, {pid: 20, state: 'T'}}},
+		{name: "zombie leader with stopped descendant", processes: []procProcess{{pid: leaderPID, state: 'Z'}, {pid: 20, state: 'T'}}},
+		{name: "zombie leader with resumed descendant", processes: []procProcess{{pid: leaderPID, state: 'Z'}, {pid: 20, state: 'S'}}},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if got := sessionProcessesStopped(test.processes, leaderPID); got != test.wantStopped {
+				t.Fatalf("sessionProcessesStopped(%#v, %d) = %v, want %v", test.processes, leaderPID, got, test.wantStopped)
+			}
+			if got := sessionProcessesResumed(test.processes, leaderPID); got != test.wantResumed {
+				t.Fatalf("sessionProcessesResumed(%#v, %d) = %v, want %v", test.processes, leaderPID, got, test.wantResumed)
+			}
+		})
+	}
+}
+
+func TestStopEscalatesDetachedDescendantAfterLeaderExit(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("requires the production root supervisor identity boundary")
+	}
+	if err := unix.Prctl(unix.PR_SET_CHILD_SUBREAPER, 1, 0, 0, 0); err != nil {
+		t.Fatal(err)
+	}
+	uid, gid := 65534, 65534
+	workspace, err := os.MkdirTemp("", "orka-acp-detached-test-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = os.RemoveAll(workspace) })
+	if err := os.Chown(workspace, uid, gid); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chmod(workspace, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	markerPath := filepath.Join(workspace, "descendant.pid")
+	process, err := StartProcess(ProcessConfig{
+		Command: testAdapterCommand(t),
+		Args:    []string{"-test.run=^TestACPDetachedDescendantProcess$"},
+		Environment: []string{
+			"GO_WANT_ACP_DETACHED_DESCENDANT=leader",
+			"ACP_DETACHED_DESCENDANT_MARKER=" + markerPath,
+		},
+		Paths:             SessionPaths{Workspace: workspace},
+		UID:               uid,
+		GID:               gid,
+		ExecHelperCommand: testExecHelperCommand(t),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	waitCtx, waitCancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer waitCancel()
+	if err := process.Wait(waitCtx); err != nil {
+		t.Fatalf("adapter leader wait: %v; diagnostics: %s", err, process.Diagnostics())
+	}
+	descendantPID := readPIDMarker(t, markerPath)
+	if err := syscall.Kill(descendantPID, 0); err != nil {
+		t.Fatalf("detached descendant was not alive before Stop: %v", err)
+	}
+	stopCtx, stopCancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer stopCancel()
+	status, err := process.Stop(stopCtx, 100*time.Millisecond)
+	if err != nil {
+		t.Fatalf("Stop: %#v, %v", status, err)
+	}
+	if !status.Proven || len(status.RemainingPIDs) != 0 {
+		t.Fatalf("cleanup status = %#v", status)
+	}
+	if err := syscall.Kill(descendantPID, 0); err == nil || err != syscall.ESRCH {
+		t.Fatalf("detached descendant still exists: %v", err)
+	}
+}
+
+//nolint:gocyclo // This test intentionally exercises the full freeze/thaw lifecycle and proof checks.
+func TestFreezeAndThawIncludeDetachedDescendant(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("requires the production root supervisor identity boundary")
+	}
+	if err := unix.Prctl(unix.PR_SET_CHILD_SUBREAPER, 1, 0, 0, 0); err != nil {
+		t.Fatal(err)
+	}
+	uid, gid := 65534, 65534
+	workspace, err := os.MkdirTemp("", "orka-acp-freeze-test-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = os.RemoveAll(workspace) })
+	if err := os.Chown(workspace, uid, gid); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chmod(workspace, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	markerPath := filepath.Join(workspace, "descendant.pid")
+	process, err := StartProcess(ProcessConfig{
+		Command: testAdapterCommand(t),
+		Args:    []string{"-test.run=^TestACPDetachedDescendantProcess$"},
+		Environment: []string{
+			"GO_WANT_ACP_DETACHED_DESCENDANT=leader-wait",
+			"ACP_DETACHED_DESCENDANT_MARKER=" + markerPath,
+		},
+		Paths:             SessionPaths{Workspace: workspace},
+		UID:               uid,
+		GID:               gid,
+		ExecHelperCommand: testExecHelperCommand(t),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_ = process.Thaw()
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		_, _ = process.Stop(ctx, 100*time.Millisecond)
+	})
+	deadline := time.Now().Add(5 * time.Second)
+	for {
+		if _, err := os.Stat(markerPath); err == nil {
+			break
+		} else if !os.IsNotExist(err) {
+			t.Fatal(err)
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("detached descendant did not become ready")
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	descendantPID := readPIDMarker(t, markerPath)
+	freezeCtx, freezeCancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer freezeCancel()
+	if err := process.Freeze(freezeCtx); err != nil {
+		t.Fatalf("Freeze: %v", err)
+	}
+	if stopped, supported, err := processesStoppedForUID(uid, process.PID()); err != nil || !supported || !stopped {
+		t.Fatalf("UID-scoped freeze proof = stopped:%v supported:%v err:%v", stopped, supported, err)
+	}
+	if err := process.Thaw(); err != nil {
+		t.Fatalf("Thaw: %v", err)
+	}
+	deadline = time.Now().Add(5 * time.Second)
+	for {
+		processes, supported := inspectProcessesForUIDAt("/proc", uid, os.Getpid())
+		resumed := supported && sessionProcessesResumed(processes, process.PID())
+		descendantResumed := false
+		for _, candidate := range processes {
+			if candidate.pid == descendantPID && candidate.state != 'Z' && candidate.state != 'T' && candidate.state != 't' {
+				descendantResumed = true
+				break
+			}
+		}
+		if resumed && descendantResumed {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("session UID processes did not resume: %#v", processes)
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	stopCtx, stopCancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer stopCancel()
+	status, err := process.Stop(stopCtx, 100*time.Millisecond)
+	if err != nil || !status.Proven || len(status.RemainingPIDs) != 0 {
+		t.Fatalf("Stop after thaw: status=%#v err=%v", status, err)
+	}
+	if err := syscall.Kill(descendantPID, 0); err == nil || err != syscall.ESRCH {
+		t.Fatalf("detached descendant still exists: %v", err)
+	}
+}
+
+func TestFreezeFailsAfterLeaderExitWithDetachedDescendant(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("requires the production root supervisor identity boundary")
+	}
+	if err := unix.Prctl(unix.PR_SET_CHILD_SUBREAPER, 1, 0, 0, 0); err != nil {
+		t.Fatal(err)
+	}
+	uid, gid := 65534, 65534
+	workspace, err := os.MkdirTemp("", "orka-acp-freeze-exit-test-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = os.RemoveAll(workspace) })
+	if err := os.Chown(workspace, uid, gid); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chmod(workspace, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	markerPath := filepath.Join(workspace, "descendant.pid")
+	process, err := StartProcess(ProcessConfig{
+		Command: testAdapterCommand(t),
+		Args:    []string{"-test.run=^TestACPDetachedDescendantProcess$"},
+		Environment: []string{
+			"GO_WANT_ACP_DETACHED_DESCENDANT=leader",
+			"ACP_DETACHED_DESCENDANT_MARKER=" + markerPath,
+		},
+		Paths:             SessionPaths{Workspace: workspace},
+		UID:               uid,
+		GID:               gid,
+		ExecHelperCommand: testExecHelperCommand(t),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		status, stopErr := process.Stop(ctx, 100*time.Millisecond)
+		if stopErr != nil || !status.Proven || len(status.RemainingPIDs) != 0 {
+			t.Errorf("cleanup after leader exit: status=%#v err=%v", status, stopErr)
+		}
+	})
+
+	select {
+	case <-process.Done():
+	case <-time.After(5 * time.Second):
+		t.Fatal("adapter leader did not exit")
+	}
+	descendantPID := readPIDMarker(t, markerPath)
+	if err := syscall.Kill(descendantPID, 0); err != nil {
+		t.Fatalf("detached descendant is not live: %v", err)
+	}
+	freezeCtx, freezeCancel := context.WithTimeout(context.Background(), time.Second)
+	defer freezeCancel()
+	if err := process.Freeze(freezeCtx); err == nil || !strings.Contains(err.Error(), "exited while freezing") {
+		t.Fatalf("Freeze after leader exit = %v, want exited error", err)
+	}
+}
+
+//nolint:gocyclo // This test intentionally keeps the hostile descendant lifecycle in one auditable flow.
+func TestThawRejectsStoppedDetachedDescendantWithoutUIDScope(t *testing.T) {
+	if os.Geteuid() == 0 {
+		t.Skip("requires the supported non-root supervisor path")
+	}
+	if os.Getuid() <= 0 || os.Getgid() <= 0 {
+		t.Skip("requires a non-root UID and GID")
+	}
+	if err := unix.Prctl(unix.PR_SET_CHILD_SUBREAPER, 1, 0, 0, 0); err != nil {
+		t.Fatal(err)
+	}
+	uid, gid := os.Getuid(), os.Getgid()
+	existing, supported := inspectProcessesForUIDAt("/proc", uid, os.Getpid())
+	if !supported {
+		t.Fatal("process inventory unexpectedly unsupported")
+	}
+	if len(existing) != 0 {
+		t.Skipf("requires an isolated non-root UID namespace; found processes: %#v", existing)
+	}
+	workspace := t.TempDir()
+	if err := os.Chmod(workspace, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	markerPath := filepath.Join(workspace, "descendant.pid")
+	process, err := StartProcess(ProcessConfig{
+		Command: testAdapterCommand(t),
+		Args:    []string{"-test.run=^TestACPDetachedDescendantProcess$"},
+		Environment: []string{
+			"GO_WANT_ACP_DETACHED_DESCENDANT=leader-wait",
+			"ACP_DETACHED_DESCENDANT_MARKER=" + markerPath,
+			"ACP_DETACHED_DESCENDANT_SELF_STOP=1",
+		},
+		Paths:             SessionPaths{Workspace: workspace},
+		UID:               uid,
+		GID:               gid,
+		ExecHelperCommand: testExecHelperCommand(t),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	descendantPID := 0
+	t.Cleanup(func() {
+		if descendantPID > 0 {
+			_ = syscall.Kill(descendantPID, syscall.SIGCONT)
+			_ = syscall.Kill(descendantPID, syscall.SIGKILL)
+		}
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		status, stopErr := process.Stop(ctx, 100*time.Millisecond)
+		if stopErr != nil || !status.Proven || len(status.RemainingPIDs) != 0 {
+			t.Errorf("cleanup after rejected thaw: status=%#v err=%v", status, stopErr)
+		}
+	})
+
+	deadline := time.Now().Add(5 * time.Second)
+	for {
+		if _, err := os.Stat(markerPath); err == nil {
+			break
+		} else if !os.IsNotExist(err) {
+			t.Fatal(err)
+		}
+		select {
+		case <-process.Done():
+			t.Fatalf("adapter exited before detached descendant became ready: %s", process.Diagnostics())
+		default:
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("detached descendant did not become ready")
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	descendantPID = readPIDMarker(t, markerPath)
+	deadline = time.Now().Add(5 * time.Second)
+	for {
+		processes, supported := inspectProcessesForUIDAt("/proc", uid, os.Getpid())
+		stopped := false
+		for _, candidate := range processes {
+			if candidate.pid == descendantPID && (candidate.state == 'T' || candidate.state == 't') {
+				stopped = true
+				break
+			}
+		}
+		if supported && stopped {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("detached descendant did not stop: %#v", processes)
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+
+	freezeCtx, freezeCancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer freezeCancel()
+	if err := process.Freeze(freezeCtx); err != nil {
+		t.Fatalf("Freeze: %v", err)
+	}
+	if err := process.Thaw(); err == nil || !strings.Contains(err.Error(), "thaw could not be proven") {
+		t.Fatalf("Thaw with stopped detached descendant = %v, want proof error", err)
+	}
+	processes, supported := inspectProcessesForUIDAt("/proc", uid, os.Getpid())
+	if !supported {
+		t.Fatal("process inventory unexpectedly unsupported")
+	}
+	descendantFound := false
+	for _, candidate := range processes {
+		if candidate.pid != descendantPID {
+			continue
+		}
+		descendantFound = true
+		if candidate.state != 'T' && candidate.state != 't' {
+			t.Fatalf("detached descendant unexpectedly resumed: %#v", candidate)
+		}
+	}
+	if !descendantFound {
+		t.Fatalf("detached descendant disappeared after rejected thaw: %#v", processes)
+	}
+}
+
+func TestACPDetachedDescendantProcess(t *testing.T) {
+	mode := os.Getenv("GO_WANT_ACP_DETACHED_DESCENDANT")
+	if mode == "" {
+		return
+	}
+	markerPath := os.Getenv("ACP_DETACHED_DESCENDANT_MARKER")
+	if markerPath == "" {
+		t.Fatal("descendant marker path is required")
+	}
+	if mode == "child" {
+		signal.Ignore(syscall.SIGTERM)
+		if err := os.WriteFile(markerPath, []byte(strconv.Itoa(os.Getpid())), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		if os.Getenv("ACP_DETACHED_DESCENDANT_SELF_STOP") == "1" {
+			if err := syscall.Kill(os.Getpid(), syscall.SIGSTOP); err != nil {
+				t.Fatal(err)
+			}
+		}
+		for {
+			time.Sleep(time.Second)
+		}
+	}
+	command := exec.Command(os.Args[0], "-test.run=^TestACPDetachedDescendantProcess$")
+	command.Env = append(os.Environ(), "GO_WANT_ACP_DETACHED_DESCENDANT=child")
+	command.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
+	if err := command.Start(); err != nil {
+		t.Fatal(err)
+	}
+	deadline := time.Now().Add(5 * time.Second)
+	for {
+		if _, err := os.Stat(markerPath); err == nil {
+			if mode == "leader-wait" {
+				for {
+					time.Sleep(time.Second)
+				}
+			}
+			return
+		} else if !os.IsNotExist(err) {
+			t.Fatal(err)
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("detached descendant did not become ready")
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+}
+
+func readPIDMarker(t *testing.T, path string) int {
+	t.Helper()
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	pid, err := strconv.Atoi(strings.TrimSpace(string(data)))
+	if err != nil || pid <= 0 {
+		t.Fatalf("invalid PID marker %q: %v", data, err)
+	}
+	return pid
+}
+
+func testAdapterCommand(t *testing.T) string {
+	t.Helper()
+	return copyTestExecutableForChild(t)
+}
+
+func copyTestExecutableForChild(t *testing.T) string {
+	t.Helper()
+	source, err := os.Executable()
+	if err != nil {
+		t.Fatal(err)
+	}
+	directory, err := os.MkdirTemp("", "orka-acp-adapter-test-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = os.RemoveAll(directory) })
+	if err := os.Chmod(directory, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	target := filepath.Join(directory, "acp-process-test")
+	input, err := os.Open(source)
+	if err != nil {
+		t.Fatal(err)
+	}
+	output, err := os.OpenFile(target, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o755)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := io.Copy(output, input); err != nil {
+		_ = input.Close()
+		_ = output.Close()
+		t.Fatal(err)
+	}
+	if err := input.Close(); err != nil {
+		_ = output.Close()
+		t.Fatal(err)
+	}
+	if err := output.Close(); err != nil {
+		t.Fatal(err)
+	}
+	return target
+}
+
+func writeFakeProcStatus(t *testing.T, root string, pid int, contents string) {
+	t.Helper()
+	directory := filepath.Join(root, strconv.Itoa(pid))
+	if err := os.MkdirAll(directory, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(directory, "status"), []byte(contents), 0o644); err != nil {
+		t.Fatal(err)
+	}
+}
diff --git a/internal/acp/process_test.go b/internal/acp/process_test.go
new file mode 100644
index 000000000..c434c9659
--- /dev/null
+++ b/internal/acp/process_test.go
@@ -0,0 +1,132 @@
+package acp
+
+import (
+	"context"
+	"os"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func TestMain(m *testing.M) {
+	code := m.Run()
+	cleanupTestExecHelper()
+	os.Exit(code)
+}
+
+func TestBoundedBufferKeepsTail(t *testing.T) {
+	buffer := newBoundedBuffer(5)
+	if _, err := buffer.Write([]byte("abc")); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := buffer.Write([]byte("defg")); err != nil {
+		t.Fatal(err)
+	}
+	if got := buffer.String(); got != "[truncated]\ncdefg" {
+		t.Fatalf("buffer = %q", got)
+	}
+}
+
+func TestStartProcessRequiresStrictIdentityAndPaths(t *testing.T) {
+	_, err := StartProcess(ProcessConfig{Command: "relative", UID: 1000, GID: 1000})
+	if err == nil || !strings.Contains(err.Error(), "absolute path") {
+		t.Fatalf("error = %v", err)
+	}
+	_, err = StartProcess(ProcessConfig{Command: "/bin/true", Paths: SessionPaths{Workspace: "/tmp"}, UID: 0, GID: 0})
+	if err == nil || !strings.Contains(err.Error(), "non-root") {
+		t.Fatalf("error = %v", err)
+	}
+}
+
+func TestProcessNilWaitAndStop(t *testing.T) {
+	var process *Process
+	if err := process.Wait(context.Background()); err == nil {
+		t.Fatal("nil process Wait unexpectedly succeeded")
+	}
+	status, err := process.Stop(context.Background(), time.Second)
+	if err != nil || !status.Proven {
+		t.Fatalf("nil process Stop = %#v, %v", status, err)
+	}
+}
+
+func TestProveProcessCleanupRequiresTwoZeroObservations(t *testing.T) {
+	var inventories atomic.Int32
+	var reaps atomic.Int32
+	status := proveProcessCleanup(
+		1234,
+		func(uid int) {
+			if uid != 1234 {
+				t.Errorf("reap UID = %d", uid)
+			}
+			reaps.Add(1)
+		},
+		func(uid int) ([]int, bool) {
+			if uid != 1234 {
+				t.Errorf("inventory UID = %d", uid)
+			}
+			inventories.Add(1)
+			return nil, true
+		},
+		func() {},
+	)
+	if !status.Proven || len(status.RemainingPIDs) != 0 {
+		t.Fatalf("cleanup status = %#v", status)
+	}
+	if got := inventories.Load(); got != 2 {
+		t.Fatalf("inventory observations = %d, want 2", got)
+	}
+	if got := reaps.Load(); got != 2 {
+		t.Fatalf("reap attempts = %d, want 2", got)
+	}
+}
+
+func TestProveProcessCleanupRejectsProcessAppearingBetweenObservations(t *testing.T) {
+	allowAppearance := make(chan struct{})
+	appeared := make(chan struct{})
+	var processPresent atomic.Bool
+	go func() {
+		<-allowAppearance
+		processPresent.Store(true)
+		close(appeared)
+	}()
+
+	status := proveProcessCleanup(
+		1234,
+		func(int) {},
+		func(int) ([]int, bool) {
+			if processPresent.Load() {
+				return []int{4321}, true
+			}
+			return nil, true
+		},
+		func() {
+			close(allowAppearance)
+			<-appeared
+		},
+	)
+	if status.Proven {
+		t.Fatalf("cleanup unexpectedly proven: %#v", status)
+	}
+	if len(status.RemainingPIDs) != 1 || status.RemainingPIDs[0] != 4321 {
+		t.Fatalf("remaining PIDs = %v", status.RemainingPIDs)
+	}
+}
+
+func TestProveProcessCleanupRejectsUnprovenSecondObservation(t *testing.T) {
+	var observations atomic.Int32
+	status := proveProcessCleanup(
+		1234,
+		func(int) {},
+		func(int) ([]int, bool) {
+			if observations.Add(1) == 1 {
+				return nil, true
+			}
+			return nil, false
+		},
+		func() {},
+	)
+	if status.Proven {
+		t.Fatalf("cleanup unexpectedly proven: %#v", status)
+	}
+}
diff --git a/internal/acp/process_test_support_other_test.go b/internal/acp/process_test_support_other_test.go
new file mode 100644
index 000000000..11027aa2e
--- /dev/null
+++ b/internal/acp/process_test_support_other_test.go
@@ -0,0 +1,21 @@
+//go:build !linux
+
+package acp
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func testExecHelperCommand(_ *testing.T) string { return "" }
+func cleanupTestExecHelper()                    {}
+
+func testAdapterCommand(t *testing.T) string {
+	t.Helper()
+	command, err := filepath.Abs(os.Args[0])
+	if err != nil {
+		t.Fatal(err)
+	}
+	return command
+}
diff --git a/internal/acp/process_unix.go b/internal/acp/process_unix.go
new file mode 100644
index 000000000..0e0017895
--- /dev/null
+++ b/internal/acp/process_unix.go
@@ -0,0 +1,51 @@
+//go:build unix && !linux
+
+package acp
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"syscall"
+)
+
+func newChildCommand(cfg ProcessConfig) (*exec.Cmd, error) {
+	cmd := exec.Command(cfg.Command, cfg.Args...)
+	cmd.SysProcAttr = childSysProcAttr(cfg.UID, cfg.GID)
+	return cmd, nil
+}
+
+func RunExecHelper(_, _ []string) error {
+	return fmt.Errorf("ACP exec helper is only supported on Linux")
+}
+
+func childSysProcAttr(uid, gid int) *syscall.SysProcAttr {
+	attr := &syscall.SysProcAttr{Setpgid: true}
+	if os.Geteuid() == 0 {
+		attr.Credential = &syscall.Credential{Uid: uint32(uid), Gid: uint32(gid)}
+	}
+	return attr
+}
+
+func signalProcessGroup(pid int, signal os.Signal) error {
+	sig, ok := signal.(syscall.Signal)
+	if !ok {
+		return syscall.EINVAL
+	}
+	return syscall.Kill(-pid, sig)
+}
+
+func terminateSignal() os.Signal { return syscall.SIGTERM }
+func killSignal() os.Signal      { return syscall.SIGKILL }
+func stopSignal() os.Signal      { return syscall.SIGSTOP }
+func continueSignal() os.Signal  { return syscall.SIGCONT }
+
+func processesForUID(_ int) ([]int, bool) { return nil, false }
+
+func reapExitedProcessesForUID(_ int)          {}
+func reapExitedProcessesForUIDExcept(_, _ int) {}
+
+func processesStoppedForUID(_, _ int) (bool, bool, error) { return false, false, nil }
+func processesResumedForUID(_, _ int) (bool, bool, error) { return false, false, nil }
+
+func signalProcessesForUID(_ int, _ os.Signal) (bool, error) { return false, nil }
diff --git a/internal/acp/process_windows.go b/internal/acp/process_windows.go
new file mode 100644
index 000000000..2c3d59079
--- /dev/null
+++ b/internal/acp/process_windows.go
@@ -0,0 +1,35 @@
+//go:build windows
+
+package acp
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"syscall"
+)
+
+func newChildCommand(cfg ProcessConfig) (*exec.Cmd, error) {
+	cmd := exec.Command(cfg.Command, cfg.Args...)
+	cmd.SysProcAttr = childSysProcAttr(cfg.UID, cfg.GID)
+	return cmd, nil
+}
+
+func RunExecHelper(_, _ []string) error {
+	return fmt.Errorf("ACP exec helper is only supported on Linux")
+}
+
+func childSysProcAttr(_, _ int) *syscall.SysProcAttr { return &syscall.SysProcAttr{} }
+func signalProcessGroup(_ int, _ os.Signal) error    { return syscall.EWINDOWS }
+func terminateSignal() os.Signal                     { return os.Interrupt }
+func killSignal() os.Signal                          { return os.Kill }
+func stopSignal() os.Signal                          { return os.Interrupt }
+func continueSignal() os.Signal                      { return os.Interrupt }
+func processesForUID(_ int) ([]int, bool)            { return nil, false }
+func reapExitedProcessesForUID(_ int)                {}
+func reapExitedProcessesForUIDExcept(_, _ int)       {}
+
+func processesStoppedForUID(_, _ int) (bool, bool, error) { return false, false, nil }
+func processesResumedForUID(_, _ int) (bool, bool, error) { return false, false, nil }
+
+func signalProcessesForUID(_ int, _ os.Signal) (bool, error) { return false, nil }
diff --git a/internal/acp/protocol.go b/internal/acp/protocol.go
new file mode 100644
index 000000000..d68796f43
--- /dev/null
+++ b/internal/acp/protocol.go
@@ -0,0 +1,276 @@
+package acp
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+)
+
+const (
+	// ProtocolVersion is the stable ACP wire protocol negotiated during initialize.
+	ProtocolVersion = 1
+
+	MethodInitialize        = "initialize"
+	MethodAuthenticate      = "authenticate"
+	MethodSessionNew        = "session/new"
+	MethodSessionPrompt     = "session/prompt"
+	MethodSessionCancel     = "session/cancel"
+	MethodSessionUpdate     = "session/update"
+	MethodRequestPermission = "session/request_permission"
+	MethodCancelRequest     = "$/cancel_request"
+)
+
+type Meta map[string]any
+
+const (
+	protectedSessionMetaPrefix      = "orka."
+	sessionMetaRuntimeSessionID     = protectedSessionMetaPrefix + "runtimeSessionID"
+	sessionMetaGeneration           = protectedSessionMetaPrefix + "generation"
+	sessionMetaRuntimeProfileDigest = protectedSessionMetaPrefix + "profileDigest"
+)
+
+// MergeNewSessionMeta combines provider-specific session metadata with
+// Orka-owned runtime identity metadata. Provider metadata must never be able to
+// replace or shadow the Orka fence, including through case variants.
+func MergeNewSessionMeta(provider, protected Meta) (Meta, error) {
+	merged := make(Meta, len(provider)+len(protected))
+	for key, value := range provider {
+		if strings.TrimSpace(key) == "" {
+			return nil, fmt.Errorf("provider session metadata key is required")
+		}
+		if strings.HasPrefix(strings.ToLower(key), protectedSessionMetaPrefix) {
+			return nil, fmt.Errorf("provider session metadata key %q uses protected Orka namespace", key)
+		}
+		merged[key] = value
+	}
+	for key, value := range protected {
+		if strings.TrimSpace(key) == "" {
+			return nil, fmt.Errorf("protected session metadata key is required")
+		}
+		if _, exists := merged[key]; exists {
+			return nil, fmt.Errorf("provider session metadata key %q collides with protected metadata", key)
+		}
+		merged[key] = value
+	}
+	return merged, nil
+}
+
+type Implementation struct {
+	Name    string `json:"name"`
+	Title   string `json:"title,omitempty"`
+	Version string `json:"version"`
+}
+
+type FileSystemCapabilities struct {
+	ReadTextFile  bool `json:"readTextFile"`
+	WriteTextFile bool `json:"writeTextFile"`
+}
+
+type ClientCapabilities struct {
+	FS       FileSystemCapabilities `json:"fs"`
+	Terminal bool                   `json:"terminal"`
+	Session  map[string]any         `json:"session,omitempty"`
+	Meta     Meta                   `json:"_meta,omitempty"`
+}
+
+type PromptCapabilities struct {
+	Image           bool `json:"image"`
+	Audio           bool `json:"audio"`
+	EmbeddedContext bool `json:"embeddedContext"`
+}
+
+type AgentCapabilities struct {
+	LoadSession         bool               `json:"loadSession"`
+	PromptCapabilities  PromptCapabilities `json:"promptCapabilities"`
+	MCPCapabilities     map[string]any     `json:"mcpCapabilities"`
+	SessionCapabilities map[string]any     `json:"sessionCapabilities"`
+	Auth                map[string]any     `json:"auth"`
+	Meta                Meta               `json:"_meta,omitempty"`
+}
+
+type AuthMethod struct {
+	ID          string `json:"id"`
+	Name        string `json:"name"`
+	Description string `json:"description,omitempty"`
+	Meta        Meta   `json:"_meta,omitempty"`
+}
+
+type InitializeRequest struct {
+	ProtocolVersion    int                `json:"protocolVersion"`
+	ClientCapabilities ClientCapabilities `json:"clientCapabilities"`
+	ClientInfo         *Implementation    `json:"clientInfo,omitempty"`
+	Meta               Meta               `json:"_meta,omitempty"`
+}
+
+type AuthenticateRequest struct {
+	MethodID string `json:"methodId"`
+	Meta     Meta   `json:"_meta,omitempty"`
+}
+
+type AuthenticateResponse struct {
+	Meta Meta `json:"_meta,omitempty"`
+}
+
+type InitializeResponse struct {
+	ProtocolVersion   int               `json:"protocolVersion"`
+	AgentCapabilities AgentCapabilities `json:"agentCapabilities"`
+	AgentInfo         *Implementation   `json:"agentInfo,omitempty"`
+	AuthMethods       []AuthMethod      `json:"authMethods,omitempty"`
+	Meta              Meta              `json:"_meta,omitempty"`
+}
+
+type EnvVariable struct {
+	Name  string `json:"name"`
+	Value string `json:"value"`
+	Meta  Meta   `json:"_meta,omitempty"`
+}
+
+type HTTPHeader struct {
+	Name  string `json:"name"`
+	Value string `json:"value"`
+	Meta  Meta   `json:"_meta,omitempty"`
+}
+
+type MCPServer struct {
+	Type    string        `json:"type,omitempty"`
+	Name    string        `json:"name"`
+	Command string        `json:"command,omitempty"`
+	Args    []string      `json:"args,omitempty"`
+	Env     []EnvVariable `json:"env,omitempty"`
+	URL     string        `json:"url,omitempty"`
+	Headers []HTTPHeader  `json:"headers,omitempty"`
+	Meta    Meta          `json:"_meta,omitempty"`
+}
+
+type NewSessionRequest struct {
+	CWD                   string      `json:"cwd"`
+	AdditionalDirectories []string    `json:"additionalDirectories,omitempty"`
+	MCPServers            []MCPServer `json:"mcpServers"`
+	Meta                  Meta        `json:"_meta,omitempty"`
+}
+
+type NewSessionResponse struct {
+	SessionID     string            `json:"sessionId"`
+	Modes         json.RawMessage   `json:"modes,omitempty"`
+	ConfigOptions []json.RawMessage `json:"configOptions,omitempty"`
+	Meta          Meta              `json:"_meta,omitempty"`
+}
+
+type ContentBlock struct {
+	Type     string          `json:"type"`
+	Text     string          `json:"text,omitempty"`
+	Data     string          `json:"data,omitempty"`
+	MIMEType string          `json:"mimeType,omitempty"`
+	URI      string          `json:"uri,omitempty"`
+	Name     string          `json:"name,omitempty"`
+	Resource json.RawMessage `json:"resource,omitempty"`
+	Meta     Meta            `json:"_meta,omitempty"`
+}
+
+func Text(text string) ContentBlock {
+	return ContentBlock{Type: "text", Text: text}
+}
+
+type PromptRequest struct {
+	SessionID string         `json:"sessionId"`
+	Prompt    []ContentBlock `json:"prompt"`
+	Meta      Meta           `json:"_meta,omitempty"`
+}
+
+type StopReason string
+
+const (
+	StopReasonEndTurn         StopReason = "end_turn"
+	StopReasonMaxTokens       StopReason = "max_tokens"
+	StopReasonMaxTurnRequests StopReason = "max_turn_requests"
+	StopReasonRefusal         StopReason = "refusal"
+	StopReasonCancelled       StopReason = "cancelled"
+)
+
+func (r StopReason) Validate() error {
+	switch r {
+	case StopReasonEndTurn, StopReasonMaxTokens, StopReasonMaxTurnRequests, StopReasonRefusal, StopReasonCancelled:
+		return nil
+	default:
+		return fmt.Errorf("unsupported ACP stop reason %q", r)
+	}
+}
+
+func (r StopReason) Successful() bool { return r == StopReasonEndTurn }
+
+type PromptResponse struct {
+	StopReason StopReason `json:"stopReason"`
+	Meta       Meta       `json:"_meta,omitempty"`
+}
+
+type CancelNotification struct {
+	SessionID string `json:"sessionId"`
+	Meta      Meta   `json:"_meta,omitempty"`
+}
+
+type SessionNotification struct {
+	SessionID string          `json:"sessionId"`
+	Update    json.RawMessage `json:"update"`
+	Meta      Meta            `json:"_meta,omitempty"`
+}
+
+type SessionUpdate struct {
+	Type    string          `json:"sessionUpdate"`
+	Content json.RawMessage `json:"content,omitempty"`
+	Raw     json.RawMessage `json:"-"`
+}
+
+func DecodeSessionUpdate(raw json.RawMessage) (SessionUpdate, error) {
+	var update SessionUpdate
+	if err := json.Unmarshal(raw, &update); err != nil {
+		return SessionUpdate{}, fmt.Errorf("decode ACP session update: %w", err)
+	}
+	update.Type = strings.TrimSpace(update.Type)
+	if update.Type == "" {
+		return SessionUpdate{}, fmt.Errorf("ACP session update type is required")
+	}
+	update.Raw = append(json.RawMessage(nil), raw...)
+	return update, nil
+}
+
+type PermissionOption struct {
+	OptionID string `json:"optionId"`
+	Name     string `json:"name"`
+	Kind     string `json:"kind"`
+	Meta     Meta   `json:"_meta,omitempty"`
+}
+
+type RequestPermissionRequest struct {
+	SessionID string             `json:"sessionId"`
+	ToolCall  json.RawMessage    `json:"toolCall"`
+	Options   []PermissionOption `json:"options"`
+	Meta      Meta               `json:"_meta,omitempty"`
+}
+
+type RequestPermissionOutcome struct {
+	Outcome  string `json:"outcome"`
+	OptionID string `json:"optionId,omitempty"`
+	Meta     Meta   `json:"_meta,omitempty"`
+}
+
+const (
+	permissionOutcomeCancelled = "cancelled"
+	permissionOutcomeSelected  = "selected"
+)
+
+func CancelledPermissionOutcome() RequestPermissionOutcome {
+	return RequestPermissionOutcome{Outcome: permissionOutcomeCancelled}
+}
+
+func SelectedPermissionOutcome(optionID string) RequestPermissionOutcome {
+	return RequestPermissionOutcome{Outcome: permissionOutcomeSelected, OptionID: optionID}
+}
+
+type RequestPermissionResponse struct {
+	Outcome RequestPermissionOutcome `json:"outcome"`
+	Meta    Meta                     `json:"_meta,omitempty"`
+}
+
+type CancelRequestNotification struct {
+	RequestID json.RawMessage `json:"requestId"`
+}
diff --git a/internal/acp/runtime_defaults.go b/internal/acp/runtime_defaults.go
new file mode 100644
index 000000000..2a44e6d3e
--- /dev/null
+++ b/internal/acp/runtime_defaults.go
@@ -0,0 +1,230 @@
+package acp
+
+import (
+	"slices"
+	"sort"
+	"strings"
+)
+
+const openCodeToolRead = "read"
+
+var openCodeDefaultAllowedTools = [...]string{"Read", "Write", "Edit", "Bash", "Glob", "Grep"}
+
+var builtInRuntimeNativeTools = map[string][]string{
+	"codex":    {"Read", "Write", "Edit", "Bash", "Glob", "Grep", "WebSearch", "WebFetch"},
+	"claude":   {"Read", "Write", "Edit", "Bash", "Glob", "Grep", "WebSearch", "WebFetch"},
+	"copilot":  {"Read", "Write", "Edit", "Bash", "Glob", "Grep", "WebSearch", "WebFetch"},
+	"opencode": {"Read", "Write", "Edit", "apply_patch", "Bash", "Glob", "Grep"},
+}
+
+// BuiltInRuntimeNativeToolNames returns the provider-native tool names owned by
+// one built-in ACP runtime. Callers receive a copy so policy tables remain
+// immutable.
+func BuiltInRuntimeNativeToolNames(provider string) []string {
+	return append([]string(nil), builtInRuntimeNativeTools[strings.ToLower(strings.TrimSpace(provider))]...)
+}
+
+// IsBuiltInRuntimeNativeTool reports whether name is provider-native for the
+// selected built-in runtime. Brokered and custom tool names return false.
+func IsBuiltInRuntimeNativeTool(provider, name string) bool {
+	name = strings.TrimSpace(name)
+	if name == "" {
+		return false
+	}
+	for _, native := range builtInRuntimeNativeTools[strings.ToLower(strings.TrimSpace(provider))] {
+		if strings.EqualFold(native, name) {
+			return true
+		}
+	}
+	return false
+}
+
+// NormalizeBuiltInRuntimeToolPolicy expands an implicit provider-native tool
+// surface only when deny-only metadata or the Bash gate narrows it. Explicit
+// allowlists, including an explicit empty deny-all list, remain authoritative.
+func NormalizeBuiltInRuntimeToolPolicy(
+	provider string,
+	allowed, disallowed []string,
+	allowBash bool,
+) ([]string, []string, bool) {
+	if allowed != nil || (len(disallowed) == 0 && allowBash) {
+		return allowed, disallowed, allowBash
+	}
+	native := BuiltInRuntimeNativeToolNames(provider)
+	if len(native) == 0 {
+		return allowed, disallowed, allowBash
+	}
+	denied := make(map[string]struct{}, len(disallowed)+1)
+	for _, name := range disallowed {
+		if name = strings.ToLower(strings.TrimSpace(name)); name != "" {
+			denied[name] = struct{}{}
+		}
+	}
+	if !allowBash {
+		denied["bash"] = struct{}{}
+	}
+	normalizedAllowed := make([]string, 0, len(native))
+	for _, name := range native {
+		if _, blocked := denied[strings.ToLower(name)]; blocked {
+			continue
+		}
+		normalizedAllowed = append(normalizedAllowed, name)
+	}
+	sort.Strings(normalizedAllowed)
+	return normalizedAllowed, disallowed, allowBash
+}
+
+// BuiltInRuntimeEffectiveAllowedTools returns the tools that a normalized
+// non-OpenCode policy can execute after deny metadata and the Bash gate apply.
+// A nil allowlist remains nil so callers can preserve the unrestricted sentinel.
+func BuiltInRuntimeEffectiveAllowedTools(allowed, disallowed []string, allowBash bool) []string {
+	if allowed == nil {
+		return nil
+	}
+	result := make([]string, 0, len(allowed))
+	for _, name := range allowed {
+		name = strings.TrimSpace(name)
+		if name == "" || (!allowBash && strings.EqualFold(builtInRuntimeToolBaseName(name), "bash")) {
+			continue
+		}
+		blocked := false
+		for _, denied := range disallowed {
+			denied = strings.TrimSpace(denied)
+			if denied == name || (strings.EqualFold(denied, "bash") && strings.EqualFold(builtInRuntimeToolBaseName(name), "bash")) {
+				blocked = true
+				break
+			}
+		}
+		if !blocked {
+			result = append(result, name)
+		}
+	}
+	return sortedUniqueToolNames(result)
+}
+
+// BuiltInRuntimeEffectiveAllowBash projects the effective Bash capability into
+// the separate gate used by authorization subset checks.
+func BuiltInRuntimeEffectiveAllowBash(allowed, disallowed []string, allowBash bool) bool {
+	if !allowBash {
+		return false
+	}
+	for _, denied := range disallowed {
+		if strings.EqualFold(strings.TrimSpace(denied), "bash") {
+			return false
+		}
+	}
+	if allowed == nil {
+		return true
+	}
+	return slices.ContainsFunc(allowed, func(name string) bool {
+		return strings.EqualFold(builtInRuntimeToolBaseName(name), "bash")
+	})
+}
+
+func builtInRuntimeToolBaseName(value string) string {
+	value = strings.TrimSpace(value)
+	if index := strings.IndexByte(value, '('); index >= 0 {
+		value = strings.TrimSpace(value[:index])
+	}
+	return value
+}
+
+// OpenCodeDefaultAllowedTools returns the governed provider-native tool defaults
+// used when an OpenCode Agent omits runtime.defaultAllowedTools.
+func OpenCodeDefaultAllowedTools() []string {
+	return append([]string(nil), openCodeDefaultAllowedTools[:]...)
+}
+
+// NormalizeOpenCodeToolPolicy canonicalizes OpenCode-native tool names and
+// applies the fail-closed read-intent restrictions used by the runtime.
+func NormalizeOpenCodeToolPolicy(
+	readIntent bool,
+	allowed, disallowed []string,
+	allowBash bool,
+) ([]string, []string, bool) {
+	allowed = normalizeOpenCodeToolNames(allowed)
+	disallowed = normalizeOpenCodeToolNames(disallowed)
+	if !readIntent {
+		return allowed, disallowed, allowBash
+	}
+	// OpenCode's Grep permission cannot carry the path-specific secret-file
+	// exclusions applied to Read, so read-intent sessions disable it entirely.
+	blocked := map[string]struct{}{
+		"apply_patch": {}, "bash": {}, "edit": {}, "grep": {}, "write": {},
+	}
+	filtered := allowed[:0]
+	for _, name := range allowed {
+		if _, denied := blocked[name]; !denied {
+			filtered = append(filtered, name)
+		}
+	}
+	disallowed = append(disallowed, "apply_patch", "bash", "edit", "grep", "write")
+	return sortedUniqueToolNames(filtered), sortedUniqueToolNames(disallowed), false
+}
+
+// OpenCodeEffectiveAllowedTools returns the tools that the normalized policy
+// can actually execute after disallowed names and the Bash gate are applied.
+func OpenCodeEffectiveAllowedTools(allowed, disallowed []string, allowBash bool) []string {
+	denied := make(map[string]struct{}, len(disallowed))
+	for _, name := range disallowed {
+		denied[name] = struct{}{}
+	}
+	result := make([]string, 0, len(allowed))
+	for _, name := range allowed {
+		if _, blocked := denied[name]; blocked || (name == "bash" && !allowBash) {
+			continue
+		}
+		result = append(result, name)
+	}
+	return sortedUniqueToolNames(result)
+}
+
+// NormalizeOpenCodeAuthorizationTools canonicalizes user-facing OpenCode tool
+// grants so token and transaction allowlists can be compared with runtime
+// policy names without exposing internal alias details to issuers.
+func NormalizeOpenCodeAuthorizationTools(values []string) []string {
+	allowed, _, _ := NormalizeOpenCodeToolPolicy(false, values, nil, true)
+	return allowed
+}
+
+// normalizeOpenCodeToolNames canonicalizes OpenCode-native permissions while
+// preserving brokered/custom tool identifiers. OpenCode selects apply_patch for
+// GPT-family models and edit/write for others, so those aliases are one governed
+// mutation capability.
+func normalizeOpenCodeToolNames(values []string) []string {
+	mutation := false
+	result := make([]string, 0, len(values)+2)
+	for _, value := range values {
+		trimmed := strings.TrimSpace(value)
+		switch normalized := strings.ToLower(trimmed); normalized {
+		case "apply_patch", "edit", "write":
+			mutation = true
+		case "bash", "glob", "grep", openCodeToolRead:
+			result = append(result, normalized)
+		default:
+			result = append(result, trimmed)
+		}
+	}
+	if mutation {
+		result = append(result, "apply_patch", "edit", "write")
+	}
+	return sortedUniqueToolNames(result)
+}
+
+func sortedUniqueToolNames(values []string) []string {
+	seen := make(map[string]struct{}, len(values))
+	result := make([]string, 0, len(values))
+	for _, value := range values {
+		value = strings.TrimSpace(value)
+		if value == "" {
+			continue
+		}
+		if _, ok := seen[value]; ok {
+			continue
+		}
+		seen[value] = struct{}{}
+		result = append(result, value)
+	}
+	sort.Strings(result)
+	return result
+}
diff --git a/internal/acp/runtime_defaults_test.go b/internal/acp/runtime_defaults_test.go
new file mode 100644
index 000000000..aa7f1985b
--- /dev/null
+++ b/internal/acp/runtime_defaults_test.go
@@ -0,0 +1,128 @@
+package acp
+
+import (
+	"slices"
+	"testing"
+)
+
+func TestOpenCodeDefaultAllowedToolsReturnsCopy(t *testing.T) {
+	want := []string{"Read", "Write", "Edit", "Bash", "Glob", "Grep"}
+	first := OpenCodeDefaultAllowedTools()
+	if !slices.Equal(first, want) {
+		t.Fatalf("defaults = %#v, want %#v", first, want)
+	}
+	first[0] = "changed"
+	if got := OpenCodeDefaultAllowedTools(); !slices.Equal(got, want) {
+		t.Fatalf("defaults shared mutable storage: %#v", got)
+	}
+}
+
+func TestNormalizeOpenCodeToolPolicy(t *testing.T) {
+	allowed, disallowed, allowBash := NormalizeOpenCodeToolPolicy(
+		true,
+		OpenCodeDefaultAllowedTools(),
+		nil,
+		true,
+	)
+	if want := []string{"glob", "read"}; !slices.Equal(allowed, want) {
+		t.Fatalf("read-intent allowed = %#v, want %#v", allowed, want)
+	}
+	if want := []string{"apply_patch", "bash", "edit", "grep", "write"}; !slices.Equal(disallowed, want) {
+		t.Fatalf("read-intent disallowed = %#v, want %#v", disallowed, want)
+	}
+	if allowBash {
+		t.Fatal("read-intent policy retained bash")
+	}
+
+	allowed, _, allowBash = NormalizeOpenCodeToolPolicy(false, []string{"Edit"}, nil, false)
+	if want := []string{"apply_patch", "edit", "write"}; !slices.Equal(allowed, want) {
+		t.Fatalf("mutation aliases = %#v, want %#v", allowed, want)
+	}
+	if allowBash {
+		t.Fatal("write-intent policy changed explicit bash denial")
+	}
+	if got := OpenCodeEffectiveAllowedTools([]string{"bash", "read", "write"}, []string{"write"}, false); !slices.Equal(got, []string{"read"}) {
+		t.Fatalf("effective tools = %#v, want read only", got)
+	}
+	if got := NormalizeOpenCodeAuthorizationTools([]string{"Read", "Edit", "Bash"}); !slices.Equal(got, []string{"apply_patch", "bash", "edit", "read", "write"}) {
+		t.Fatalf("authorization tools = %#v, want public names normalized with mutation aliases", got)
+	}
+
+	explicitEmpty := []string{}
+	allowed, _, _ = NormalizeOpenCodeToolPolicy(false, explicitEmpty, nil, false)
+	if allowed == nil || len(allowed) != 0 {
+		t.Fatalf("explicit empty policy = %#v, want non-nil empty", allowed)
+	}
+}
+
+func TestBuiltInRuntimeNativeToolPolicy(t *testing.T) {
+	for _, provider := range []string{"codex", "claude", "copilot"} {
+		if !IsBuiltInRuntimeNativeTool(provider, "WebSearch") || !IsBuiltInRuntimeNativeTool(provider, "bash") {
+			t.Fatalf("%s native tool policy omitted a reviewed tool", provider)
+		}
+		if IsBuiltInRuntimeNativeTool(provider, "custom_tool") {
+			t.Fatalf("%s native tool policy accepted a custom tool", provider)
+		}
+	}
+	if !IsBuiltInRuntimeNativeTool("opencode", "apply_patch") || IsBuiltInRuntimeNativeTool("opencode", "WebSearch") {
+		t.Fatal("OpenCode native tool policy does not match the reviewed runtime surface")
+	}
+
+	tools := BuiltInRuntimeNativeToolNames("opencode")
+	if len(tools) == 0 {
+		t.Fatal("OpenCode native tool policy is empty")
+	}
+	tools[0] = "changed"
+	if IsBuiltInRuntimeNativeTool("opencode", "changed") {
+		t.Fatal("BuiltInRuntimeNativeToolNames returned mutable policy storage")
+	}
+}
+
+func TestNormalizeBuiltInRuntimeToolPolicy(t *testing.T) {
+	allowed, disallowed, allowBash := NormalizeBuiltInRuntimeToolPolicy("claude", nil, []string{"Write"}, true)
+	if !slices.Equal(allowed, []string{"Bash", "Edit", "Glob", "Grep", "Read", "WebFetch", "WebSearch"}) {
+		t.Fatalf("deny-only allowed tools = %#v", allowed)
+	}
+	if !slices.Equal(disallowed, []string{"Write"}) || !allowBash {
+		t.Fatalf("deny-only metadata changed: disallowed=%#v allowBash=%v", disallowed, allowBash)
+	}
+
+	allowed, _, allowBash = NormalizeBuiltInRuntimeToolPolicy("claude", nil, nil, false)
+	if !slices.Equal(allowed, []string{"Edit", "Glob", "Grep", "Read", "WebFetch", "WebSearch", "Write"}) || allowBash {
+		t.Fatalf("bash-disabled policy = %#v allowBash=%v", allowed, allowBash)
+	}
+
+	explicitEmpty := []string{}
+	allowed, _, _ = NormalizeBuiltInRuntimeToolPolicy("claude", explicitEmpty, nil, true)
+	if allowed == nil || len(allowed) != 0 {
+		t.Fatalf("explicit empty allowlist = %#v, want explicit deny-all", allowed)
+	}
+
+	if got := BuiltInRuntimeEffectiveAllowedTools([]string{"Read", "Write", "Bash"}, []string{"Write"}, false); !slices.Equal(got, []string{"Read"}) {
+		t.Fatalf("effective narrowed tools = %#v, want Read only", got)
+	}
+	if got := BuiltInRuntimeEffectiveAllowedTools(nil, []string{"Write"}, true); got != nil {
+		t.Fatalf("unrestricted effective tools = %#v, want nil sentinel", got)
+	}
+	if BuiltInRuntimeEffectiveAllowBash(nil, []string{"bAsH"}, true) {
+		t.Fatal("case-insensitive Bash deny did not close the effective Bash gate")
+	}
+	if !BuiltInRuntimeEffectiveAllowBash(nil, []string{"Write"}, true) {
+		t.Fatal("non-Bash deny unexpectedly closed the effective Bash gate")
+	}
+	if BuiltInRuntimeEffectiveAllowBash([]string{"Read"}, nil, true) {
+		t.Fatal("explicit allowlist without Bash unexpectedly kept the Bash gate open")
+	}
+	if !BuiltInRuntimeEffectiveAllowBash([]string{"Read", "bAsH"}, nil, true) {
+		t.Fatal("explicit allowlist containing Bash did not keep the Bash gate open")
+	}
+	if !BuiltInRuntimeEffectiveAllowBash([]string{"Bash(git status:*)"}, nil, true) {
+		t.Fatal("scoped Bash allowlist rule did not keep the Bash gate open")
+	}
+	if got := BuiltInRuntimeEffectiveAllowedTools([]string{"Read", "Bash(git status:*)"}, nil, false); !slices.Equal(got, []string{"Read"}) {
+		t.Fatalf("allowBash=false effective tools = %#v, want scoped Bash removed", got)
+	}
+	if got := BuiltInRuntimeEffectiveAllowedTools([]string{"Read", "Bash(git status:*)"}, []string{"Bash"}, true); !slices.Equal(got, []string{"Read"}) {
+		t.Fatalf("bare Bash deny effective tools = %#v, want scoped Bash removed", got)
+	}
+}
diff --git a/internal/acp/runtime_env.go b/internal/acp/runtime_env.go
new file mode 100644
index 000000000..28bcc9abe
--- /dev/null
+++ b/internal/acp/runtime_env.go
@@ -0,0 +1,394 @@
+package acp
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+)
+
+const (
+	DefaultChildPath = "/usr/local/bin:/usr/bin:/bin"
+
+	// Linux process credentials are uint32 values, with all-bits-one reserved
+	// as the no-change sentinel by ownership syscalls.
+	maxRuntimeCredentialID int64 = (1 << 32) - 2
+)
+
+var (
+	ErrUIDRangeExhausted = errors.New("runtime session UID range exhausted")
+	ErrUIDReserveReached = errors.New("runtime session UID reserve reached")
+)
+
+var (
+	sessionPathComponentRE = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$`)
+	environmentNameRE      = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_]*$`)
+)
+
+type SessionPaths struct {
+	Root      string
+	Home      string
+	Temp      string
+	Workspace string
+	Config    string
+	Cache     string
+	Data      string
+	State     string
+}
+
+func PrepareSessionPaths(baseDir, sessionID string) (SessionPaths, error) {
+	baseDir = filepath.Clean(strings.TrimSpace(baseDir))
+	if baseDir == "." || !filepath.IsAbs(baseDir) {
+		return SessionPaths{}, fmt.Errorf("session base directory must be absolute")
+	}
+	if !sessionPathComponentRE.MatchString(sessionID) {
+		return SessionPaths{}, fmt.Errorf("invalid session path component %q", sessionID)
+	}
+	if err := ensureRealDirectory(baseDir, 0o711); err != nil {
+		return SessionPaths{}, err
+	}
+	root, err := os.MkdirTemp(baseDir, sessionID+"-")
+	if err != nil {
+		return SessionPaths{}, fmt.Errorf("create session root: %w", err)
+	}
+	cleanup := true
+	defer func() {
+		if cleanup {
+			_ = os.RemoveAll(root)
+		}
+	}()
+	paths := SessionPaths{
+		Root:      root,
+		Home:      filepath.Join(root, "home"),
+		Temp:      filepath.Join(root, "tmp"),
+		Workspace: filepath.Join(root, "workspace"),
+		Config:    filepath.Join(root, "xdg", "config"),
+		Cache:     filepath.Join(root, "xdg", "cache"),
+		Data:      filepath.Join(root, "xdg", "data"),
+		State:     filepath.Join(root, "xdg", "state"),
+	}
+	for _, path := range []string{paths.Root, paths.Home, paths.Temp, paths.Workspace, paths.Config, paths.Cache, paths.Data, paths.State} {
+		if err := os.MkdirAll(path, 0o700); err != nil {
+			return SessionPaths{}, fmt.Errorf("create private session directory: %w", err)
+		}
+		if err := os.Chmod(path, 0o700); err != nil {
+			return SessionPaths{}, fmt.Errorf("chmod private session directory: %w", err)
+		}
+	}
+	cleanup = false
+	return paths, nil
+}
+
+func ensureRealDirectory(path string, mode os.FileMode) error {
+	info, err := os.Lstat(path)
+	if os.IsNotExist(err) {
+		if err := os.MkdirAll(path, mode); err != nil {
+			return fmt.Errorf("create session base directory: %w", err)
+		}
+		info, err = os.Lstat(path)
+	}
+	if err != nil {
+		return fmt.Errorf("inspect session base directory: %w", err)
+	}
+	if info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
+		return fmt.Errorf("session base directory must be a real directory")
+	}
+	return nil
+}
+
+type EnvironmentConfig struct {
+	PATH       string
+	Values     map[string]string
+	UnsetNames []string
+}
+
+func BuildChildEnvironment(paths SessionPaths, cfg EnvironmentConfig) ([]string, error) {
+	for name, value := range map[string]string{
+		"HOME":            paths.Home,
+		"TMPDIR":          paths.Temp,
+		"XDG_CONFIG_HOME": paths.Config,
+		"XDG_CACHE_HOME":  paths.Cache,
+		"XDG_DATA_HOME":   paths.Data,
+		"XDG_STATE_HOME":  paths.State,
+		"ORKA_WORKSPACE":  paths.Workspace,
+		"PWD":             paths.Workspace,
+	} {
+		if strings.TrimSpace(value) == "" || !filepath.IsAbs(value) {
+			return nil, fmt.Errorf("%s must be an absolute session path", name)
+		}
+	}
+	pathValue := strings.TrimSpace(cfg.PATH)
+	if pathValue == "" {
+		pathValue = DefaultChildPath
+	}
+	values := map[string]string{
+		"HOME":            paths.Home,
+		"TMPDIR":          paths.Temp,
+		"XDG_CONFIG_HOME": paths.Config,
+		"XDG_CACHE_HOME":  paths.Cache,
+		"XDG_DATA_HOME":   paths.Data,
+		"XDG_STATE_HOME":  paths.State,
+		"ORKA_WORKSPACE":  paths.Workspace,
+		"PWD":             paths.Workspace,
+		"PATH":            pathValue,
+	}
+	for name, value := range cfg.Values {
+		name = strings.TrimSpace(name)
+		if !environmentNameRE.MatchString(name) {
+			return nil, fmt.Errorf("invalid child environment name %q", name)
+		}
+		if strings.IndexByte(value, 0) >= 0 {
+			return nil, fmt.Errorf("child environment %s contains NUL", name)
+		}
+		values[name] = value
+	}
+	for _, name := range cfg.UnsetNames {
+		delete(values, strings.TrimSpace(name))
+	}
+	names := make([]string, 0, len(values))
+	for name := range values {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	env := make([]string, 0, len(names))
+	for _, name := range names {
+		env = append(env, name+"="+values[name])
+	}
+	return env, nil
+}
+
+type UIDAllocator struct {
+	mu        sync.Mutex
+	firstUID  int
+	firstGID  int
+	allocated int
+	capacity  int
+	persist   func(int) error
+}
+
+// NewUIDAllocator creates a never-reusing paired UID/GID allocator. firstGID
+// is the first primary GID in a range with the same capacity as the UID range.
+func NewUIDAllocator(firstUID, lastUID, firstGID int) (*UIDAllocator, error) {
+	if firstUID <= 0 || lastUID < firstUID || firstGID <= 0 {
+		return nil, fmt.Errorf("invalid UID allocator range %d-%d gid %d", firstUID, lastUID, firstGID)
+	}
+	capacity := int64(lastUID) - int64(firstUID) + 1
+	maxAllocatorID := maxRuntimeCredentialID
+	if maxInt := int64(^uint(0) >> 1); maxInt < maxAllocatorID {
+		maxAllocatorID = maxInt
+	}
+	if int64(lastUID) > maxAllocatorID ||
+		int64(firstGID) > maxAllocatorID-(capacity-1) {
+		return nil, fmt.Errorf("invalid UID allocator range %d-%d gid %d", firstUID, lastUID, firstGID)
+	}
+	return &UIDAllocator{
+		firstUID: firstUID,
+		firstGID: firstGID,
+		capacity: int(capacity),
+	}, nil
+}
+
+func (a *UIDAllocator) Allocate() (uid, gid int, err error) {
+	return a.AllocateAboveReserve(0)
+}
+
+// AllocateAboveReserve returns the next never-reused UID/GID pair only when
+// doing so leaves at least reserve pairs unused. The check and allocation use a
+// single shared offset in one critical section, so UID and primary GID cannot be
+// reused or paired with different sessions under concurrent creation.
+func (a *UIDAllocator) AllocateAboveReserve(reserve int) (uid, gid int, err error) {
+	if a == nil {
+		return 0, 0, fmt.Errorf("UID allocator is required")
+	}
+	if reserve < 0 {
+		return 0, 0, fmt.Errorf("UID allocator reserve must be non-negative")
+	}
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	remaining := a.capacity - a.allocated
+	if remaining == 0 {
+		return 0, 0, ErrUIDRangeExhausted
+	}
+	if remaining <= reserve {
+		return 0, 0, ErrUIDReserveReached
+	}
+	offset := a.allocated
+	nextAllocated := a.allocated + 1
+	if a.persist != nil {
+		if err := a.persist(nextAllocated); err != nil {
+			return 0, 0, fmt.Errorf("persist runtime session identity high-water mark: %w", err)
+		}
+	}
+	a.allocated = nextAllocated
+	return a.firstUID + offset, a.firstGID + offset, nil
+}
+
+// ConfigurePersistence restores a previously committed allocation count and
+// installs the fail-closed callback that must durably commit each future count
+// before an identity is returned to a session.
+func (a *UIDAllocator) ConfigurePersistence(allocated int, persist func(int) error) error {
+	if a == nil {
+		return fmt.Errorf("UID allocator is required")
+	}
+	if persist == nil {
+		return fmt.Errorf("UID allocator persistence callback is required")
+	}
+	if allocated < 0 || allocated > a.capacity {
+		return fmt.Errorf("invalid persisted UID allocation count %d", allocated)
+	}
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if a.allocated != 0 || a.persist != nil {
+		return fmt.Errorf("UID allocator persistence can only be configured once on a fresh allocator")
+	}
+	a.allocated = allocated
+	a.persist = persist
+	return nil
+}
+
+func (a *UIDAllocator) Capacity() int {
+	if a == nil {
+		return 0
+	}
+	return a.capacity
+}
+
+// Range returns the immutable paired UID/GID range represented by the
+// allocator. Callers use it to bind durable high-water state to one exact
+// identity configuration.
+func (a *UIDAllocator) Range() (firstUID, lastUID, firstGID, lastGID int) {
+	if a == nil {
+		return 0, 0, 0, 0
+	}
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	return a.firstUID, a.firstUID + a.capacity - 1, a.firstGID, a.firstGID + a.capacity - 1
+}
+
+func (a *UIDAllocator) Remaining() int {
+	if a == nil {
+		return 0
+	}
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	return a.capacity - a.allocated
+}
+
+func EnvironmentMap(env []string) map[string]string {
+	result := make(map[string]string, len(env))
+	for _, entry := range env {
+		name, value, ok := strings.Cut(entry, "=")
+		if ok {
+			result[name] = value
+		}
+	}
+	return result
+}
+
+func SessionIdentityLabel(uid, generation int64) string {
+	return "uid-" + strconv.FormatInt(uid, 10) + "-g" + strconv.FormatInt(generation, 10)
+}
+
+// FinalizeSessionOwnership assigns the prepared session tree to its unique child
+// identity without following symlinks. It must run before the provider process is
+// started and after the trusted workspace artifact has been materialized.
+func FinalizeSessionOwnership(root string, uid, gid int) error {
+	root = filepath.Clean(strings.TrimSpace(root))
+	if root == "." || !filepath.IsAbs(root) || uid <= 0 || gid <= 0 {
+		return fmt.Errorf("absolute session root and non-root UID/GID are required")
+	}
+	if os.Geteuid() != 0 {
+		if uid == os.Getuid() && gid == os.Getgid() {
+			return nil
+		}
+		return fmt.Errorf("non-root supervisor cannot assign session ownership")
+	}
+	entries, err := sessionOwnershipEntries(root)
+	if err != nil {
+		return err
+	}
+	return assignSessionOwnership(entries, uid, gid, os.Chmod, os.Lchown)
+}
+
+// ReclaimSessionOwnership returns a frozen session tree to the supervisor so it
+// can validate workspace state without requiring DAC_OVERRIDE. Parent
+// directories are reclaimed before WalkDir descends into their children.
+func ReclaimSessionOwnership(root string) error {
+	root = filepath.Clean(strings.TrimSpace(root))
+	if root == "." || !filepath.IsAbs(root) {
+		return fmt.Errorf("absolute session root is required")
+	}
+	if os.Geteuid() != 0 {
+		return nil
+	}
+	return reclaimSessionOwnership(root, os.Geteuid(), os.Getegid(), os.Lchown, os.Chmod)
+}
+
+func reclaimSessionOwnership(
+	root string,
+	uid, gid int,
+	lchown func(string, int, int) error,
+	chmod func(string, os.FileMode) error,
+) error {
+	return filepath.WalkDir(root, func(path string, entry os.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if err := lchown(path, uid, gid); err != nil {
+			return fmt.Errorf("reclaim session path: %w", err)
+		}
+		if entry.IsDir() {
+			if err := chmod(path, 0o700); err != nil {
+				return fmt.Errorf("chmod reclaimed session directory: %w", err)
+			}
+		}
+		return nil
+	})
+}
+
+type sessionOwnershipEntry struct {
+	path      string
+	directory bool
+}
+
+func sessionOwnershipEntries(root string) ([]sessionOwnershipEntry, error) {
+	entries := make([]sessionOwnershipEntry, 0, 16)
+	err := filepath.WalkDir(root, func(path string, entry os.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		entries = append(entries, sessionOwnershipEntry{path: path, directory: entry.IsDir()})
+		return nil
+	})
+	if err != nil {
+		return nil, fmt.Errorf("inspect session tree: %w", err)
+	}
+	for left, right := 0, len(entries)-1; left < right; left, right = left+1, right-1 {
+		entries[left], entries[right] = entries[right], entries[left]
+	}
+	return entries, nil
+}
+
+func assignSessionOwnership(
+	entries []sessionOwnershipEntry,
+	uid, gid int,
+	chmod func(string, os.FileMode) error,
+	lchown func(string, int, int) error,
+) error {
+	for _, entry := range entries {
+		if entry.directory {
+			if err := chmod(entry.path, 0o700); err != nil {
+				return fmt.Errorf("chmod session directory: %w", err)
+			}
+		}
+		if err := lchown(entry.path, uid, gid); err != nil {
+			return fmt.Errorf("chown session path: %w", err)
+		}
+	}
+	return nil
+}
diff --git a/internal/acp/runtime_env_test.go b/internal/acp/runtime_env_test.go
new file mode 100644
index 000000000..e780f6511
--- /dev/null
+++ b/internal/acp/runtime_env_test.go
@@ -0,0 +1,345 @@
+package acp
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+)
+
+func TestPrepareSessionPathsPrivateAndUnique(t *testing.T) {
+	base := filepath.Join(t.TempDir(), "sessions")
+	first, err := PrepareSessionPaths(base, "session-1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := PrepareSessionPaths(base, "session-1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if first.Root == second.Root {
+		t.Fatal("session roots were reused")
+	}
+	for _, path := range []string{first.Root, first.Home, first.Temp, first.Workspace, first.Config, first.Cache, first.Data, first.State} {
+		info, err := os.Stat(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got := info.Mode().Perm(); got != 0o700 {
+			t.Fatalf("%s mode = %o, want 700", path, got)
+		}
+		if !strings.HasPrefix(path, first.Root) {
+			t.Fatalf("path %s escaped root %s", path, first.Root)
+		}
+	}
+}
+
+func TestPrepareSessionPathsRemainSupervisorWritableUntilFinalization(t *testing.T) {
+	paths, err := PrepareSessionPaths(filepath.Join(t.TempDir(), "sessions"), "session-writable")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, path := range []string{paths.Root, paths.Home, paths.Temp, paths.Workspace, paths.Config, paths.Cache, paths.Data, paths.State} {
+		probe := filepath.Join(path, "supervisor-write-probe")
+		if err := os.WriteFile(probe, []byte("prepared"), 0o600); err != nil {
+			t.Fatalf("session path %s was not writable before ownership finalization: %v", path, err)
+		}
+	}
+}
+
+func TestPrepareSessionPathsRejectsUnsafeInputs(t *testing.T) {
+	for _, sessionID := range []string{"", "../escape", "nested/path", ".hidden", strings.Repeat("x", 129)} {
+		if _, err := PrepareSessionPaths(t.TempDir(), sessionID); err == nil {
+			t.Fatalf("session ID %q unexpectedly accepted", sessionID)
+		}
+	}
+	symlink := filepath.Join(t.TempDir(), "link")
+	if err := os.Symlink(t.TempDir(), symlink); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := PrepareSessionPaths(symlink, "session"); err == nil {
+		t.Fatal("symlink base unexpectedly accepted")
+	}
+}
+
+func TestBuildChildEnvironmentStartsFromEmptyAllowlist(t *testing.T) {
+	paths := SessionPaths{
+		Home: "/sessions/a/home", Temp: "/sessions/a/tmp", Workspace: "/sessions/a/workspace",
+		Config: "/sessions/a/config", Cache: "/sessions/a/cache", Data: "/sessions/a/data", State: "/sessions/a/state",
+	}
+	t.Setenv("SUPERVISOR_SECRET", "do-not-copy")
+	env, err := BuildChildEnvironment(paths, EnvironmentConfig{Values: map[string]string{"CODEX_API_KEY": "test"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	values := EnvironmentMap(env)
+	if _, ok := values["SUPERVISOR_SECRET"]; ok {
+		t.Fatal("ambient supervisor environment leaked")
+	}
+	if values["CODEX_API_KEY"] != "test" || values["HOME"] != paths.Home || values["PWD"] != paths.Workspace {
+		t.Fatalf("unexpected environment: %#v", values)
+	}
+	if len(values) != len(env) {
+		t.Fatalf("duplicate environment names: %v", env)
+	}
+}
+
+func TestBuildChildEnvironmentDeterministicAndValidated(t *testing.T) {
+	paths := SessionPaths{
+		Home: "/h", Temp: "/t", Workspace: "/w", Config: "/c", Cache: "/cache", Data: "/d", State: "/s",
+	}
+	cfg := EnvironmentConfig{Values: map[string]string{"B": "2", "A": "1"}, UnsetNames: []string{"B"}}
+	first, err := BuildChildEnvironment(paths, cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := BuildChildEnvironment(paths, cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(first, second) {
+		t.Fatalf("environment is not deterministic:\n%v\n%v", first, second)
+	}
+	if _, err := BuildChildEnvironment(paths, EnvironmentConfig{Values: map[string]string{"BAD-NAME": "x"}}); err == nil {
+		t.Fatal("invalid environment name unexpectedly accepted")
+	}
+}
+
+func TestUIDAllocatorAllocatesDistinctPairsAndExhausts(t *testing.T) {
+	allocator, err := NewUIDAllocator(20000, 20002, 30000)
+	if err != nil {
+		t.Fatal(err)
+	}
+	seenUIDs := make(map[int]struct{}, allocator.Capacity())
+	seenGIDs := make(map[int]struct{}, allocator.Capacity())
+	for offset := range allocator.Capacity() {
+		uid, gid, err := allocator.Allocate()
+		if err != nil {
+			t.Fatal(err)
+		}
+		wantUID, wantGID := 20000+offset, 30000+offset
+		if uid != wantUID || gid != wantGID {
+			t.Fatalf("allocation = %d:%d, want %d:%d", uid, gid, wantUID, wantGID)
+		}
+		if _, exists := seenUIDs[uid]; exists {
+			t.Fatalf("UID %d was reused", uid)
+		}
+		if _, exists := seenGIDs[gid]; exists {
+			t.Fatalf("GID %d was reused", gid)
+		}
+		seenUIDs[uid] = struct{}{}
+		seenGIDs[gid] = struct{}{}
+	}
+	if allocator.Remaining() != 0 {
+		t.Fatalf("remaining = %d, want 0", allocator.Remaining())
+	}
+	for range 2 {
+		uid, gid, err := allocator.Allocate()
+		if !errors.Is(err, ErrUIDRangeExhausted) {
+			t.Fatalf("exhausted allocation error = %v, want ErrUIDRangeExhausted", err)
+		}
+		if uid != 0 || gid != 0 {
+			t.Fatalf("exhausted allocation = %d:%d, want 0:0", uid, gid)
+		}
+	}
+}
+
+func TestUIDAllocatorPreservesConfiguredReserve(t *testing.T) {
+	allocator, err := NewUIDAllocator(20000, 20002, 30000)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if allocator.Capacity() != 3 {
+		t.Fatalf("capacity = %d, want 3", allocator.Capacity())
+	}
+	for offset := range 2 {
+		uid, gid, err := allocator.AllocateAboveReserve(1)
+		if err != nil {
+			t.Fatal(err)
+		}
+		wantUID, wantGID := 20000+offset, 30000+offset
+		if uid != wantUID || gid != wantGID {
+			t.Fatalf("allocation = %d:%d, want %d:%d", uid, gid, wantUID, wantGID)
+		}
+	}
+	if _, _, err := allocator.AllocateAboveReserve(1); !errors.Is(err, ErrUIDReserveReached) {
+		t.Fatalf("reserved allocation error = %v, want ErrUIDReserveReached", err)
+	}
+	if allocator.Remaining() != 1 {
+		t.Fatalf("remaining = %d, want protected reserve of 1", allocator.Remaining())
+	}
+}
+
+func TestUIDAllocatorRejectsGIDRangeThatCannotRemainDistinct(t *testing.T) {
+	if _, err := NewUIDAllocator(20000, 20001, int(^uint(0)>>1)); err == nil {
+		t.Fatal("allocator unexpectedly accepted a GID range that cannot represent every pair")
+	}
+}
+
+func TestUIDAllocatorPersistsHighWaterBeforeReturningIdentity(t *testing.T) {
+	allocator, err := NewUIDAllocator(20000, 20002, 30000)
+	if err != nil {
+		t.Fatal(err)
+	}
+	persisted := 0
+	if err := allocator.ConfigurePersistence(1, func(next int) error {
+		persisted = next
+		return nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	uid, gid, err := allocator.Allocate()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if uid != 20001 || gid != 30001 || persisted != 2 {
+		t.Fatalf("allocation/persistence = %d:%d/%d, want 20001:30001/2", uid, gid, persisted)
+	}
+
+	failing, err := NewUIDAllocator(40000, 40001, 50000)
+	if err != nil {
+		t.Fatal(err)
+	}
+	persistErr := errors.New("persist failed")
+	if err := failing.ConfigurePersistence(0, func(int) error { return persistErr }); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := failing.Allocate(); !errors.Is(err, persistErr) {
+		t.Fatalf("allocation error = %v, want persistence failure", err)
+	}
+	if failing.Remaining() != failing.Capacity() {
+		t.Fatalf("failed persistence consumed capacity: remaining=%d capacity=%d", failing.Remaining(), failing.Capacity())
+	}
+}
+
+func TestSessionIdentityLabel(t *testing.T) {
+	if got := SessionIdentityLabel(42, 7); got != "uid-42-g7" {
+		t.Fatalf("label = %q", got)
+	}
+}
+
+func TestFinalizeSessionOwnershipNonRootOwnIdentity(t *testing.T) {
+	root := t.TempDir()
+	if err := os.WriteFile(filepath.Join(root, "file"), []byte("x"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	uid, gid := os.Getuid(), os.Getgid()
+	if uid == 0 {
+		t.Skip("non-root behavior")
+	}
+	if err := FinalizeSessionOwnership(root, uid, gid); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestSessionOwnershipFinalizationOrdersChildrenAndChmodBeforeChown(t *testing.T) {
+	root := t.TempDir()
+	child := filepath.Join(root, "child")
+	grandchild := filepath.Join(child, "grandchild")
+	if err := os.MkdirAll(grandchild, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	file := filepath.Join(grandchild, "file")
+	if err := os.WriteFile(file, []byte("x"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	entries, err := sessionOwnershipEntries(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	indexes := make(map[string]int, len(entries))
+	for index, entry := range entries {
+		indexes[entry.path] = index
+	}
+	for _, path := range []string{child, grandchild, file} {
+		parent := filepath.Dir(path)
+		if indexes[path] >= indexes[parent] {
+			t.Fatalf("ownership order processes %s at %d after parent %s at %d", path, indexes[path], parent, indexes[parent])
+		}
+	}
+
+	events := make([]string, 0, len(entries)*2)
+	err = assignSessionOwnership(entries, 20000, 20000,
+		func(path string, mode os.FileMode) error {
+			if mode != 0o700 {
+				t.Fatalf("chmod mode for %s = %o, want 700", path, mode)
+			}
+			events = append(events, "chmod:"+path)
+			return nil
+		},
+		func(path string, uid, gid int) error {
+			if uid != 20000 || gid != 20000 {
+				t.Fatalf("ownership for %s = %d:%d, want 20000:20000", path, uid, gid)
+			}
+			events = append(events, "chown:"+path)
+			return nil
+		},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	eventIndex := make(map[string]int, len(events))
+	for index, event := range events {
+		eventIndex[event] = index
+	}
+	for _, entry := range entries {
+		if !entry.directory {
+			continue
+		}
+		chmodIndex, chmodOK := eventIndex["chmod:"+entry.path]
+		chownIndex, chownOK := eventIndex["chown:"+entry.path]
+		if !chmodOK || !chownOK || chmodIndex >= chownIndex {
+			t.Fatalf("directory finalization order for %s = %v", entry.path, events)
+		}
+	}
+}
+
+func TestSessionOwnershipReclaimOrdersParentsAndChownBeforeChmod(t *testing.T) {
+	root := t.TempDir()
+	child := filepath.Join(root, "child")
+	grandchild := filepath.Join(child, "grandchild")
+	if err := os.MkdirAll(grandchild, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	file := filepath.Join(grandchild, "file")
+	if err := os.WriteFile(file, []byte("x"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	events := make([]string, 0, 8)
+	err := reclaimSessionOwnership(root, 0, 0,
+		func(path string, uid, gid int) error {
+			if uid != 0 || gid != 0 {
+				t.Fatalf("reclaim identity for %s = %d:%d, want 0:0", path, uid, gid)
+			}
+			events = append(events, "chown:"+path)
+			return nil
+		},
+		func(path string, mode os.FileMode) error {
+			if mode != 0o700 {
+				t.Fatalf("reclaim chmod mode for %s = %o, want 700", path, mode)
+			}
+			events = append(events, "chmod:"+path)
+			return nil
+		},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	eventIndex := make(map[string]int, len(events))
+	for index, event := range events {
+		eventIndex[event] = index
+	}
+	for _, path := range []string{child, grandchild, file} {
+		parent := filepath.Dir(path)
+		if eventIndex["chown:"+parent] >= eventIndex["chown:"+path] {
+			t.Fatalf("reclaim order processes child %s before parent %s: %v", path, parent, events)
+		}
+	}
+	for _, path := range []string{root, child, grandchild} {
+		if eventIndex["chown:"+path] >= eventIndex["chmod:"+path] {
+			t.Fatalf("reclaim order chmods %s before chown: %v", path, events)
+		}
+	}
+}
diff --git a/internal/acp/session.go b/internal/acp/session.go
new file mode 100644
index 000000000..25c568149
--- /dev/null
+++ b/internal/acp/session.go
@@ -0,0 +1,677 @@
+package acp
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+)
+
+const (
+	DefaultPromptLease       = 2 * time.Minute
+	DefaultPermissionTimeout = 5 * time.Minute
+	DefaultBufferedEvents    = 256
+	DefaultInitializeTimeout = 60 * time.Second
+)
+
+type RuntimeSessionConfig struct {
+	ID             string
+	Generation     int64
+	ProfileDigest  string
+	Process        ProcessConfig
+	MCPServers     []MCPServer
+	NewSessionMeta Meta
+	AuthMethodID   string
+	ClientInfo     Implementation
+
+	InitializeTimeout time.Duration
+	PromptLease       time.Duration
+	PermissionTimeout time.Duration
+	CancelGrace       time.Duration
+	MaxBufferedEvents int
+}
+
+type RuntimeSession struct {
+	id                string
+	generation        int64
+	profileDigest     string
+	providerSessionID string
+	process           *Process
+	config            RuntimeSessionConfig
+
+	mu           sync.Mutex
+	active       *activePrompt
+	tombstones   map[string]PromptTombstone
+	deleted      bool
+	deleteDone   chan struct{}
+	deleteStatus CleanupStatus
+	deleteErr    error
+}
+
+type PromptEventType string
+
+const (
+	PromptEventAccepted            PromptEventType = "accepted"
+	PromptEventUpdate              PromptEventType = "update"
+	PromptEventPermissionRequested PromptEventType = "permission_requested"
+)
+
+type PromptEvent struct {
+	Type       PromptEventType
+	Sequence   int64
+	Timestamp  time.Time
+	Update     *SessionNotification
+	Permission *PermissionRequestEvent
+}
+
+type PermissionRequestEvent struct {
+	RequestID string
+	Request   RequestPermissionRequest
+}
+
+type PromptOutcome string
+
+const (
+	PromptOutcomeCompleted      PromptOutcome = "completed"
+	PromptOutcomeCancelled      PromptOutcome = "cancelled"
+	PromptOutcomeFailed         PromptOutcome = "failed"
+	PromptOutcomeOutcomeUnknown PromptOutcome = "outcome_unknown"
+)
+
+type PromptResult struct {
+	Outcome    PromptOutcome
+	StopReason StopReason
+	Err        error
+	Accepted   bool
+	SettledAt  time.Time
+}
+
+type PromptRun struct {
+	Events <-chan PromptEvent
+	Result <-chan PromptResult
+}
+
+type PromptTombstone struct {
+	PromptID      string
+	RequestDigest string
+	Result        PromptResult
+}
+
+type DuplicatePromptError struct {
+	PromptID string
+	Active   bool
+	Result   *PromptResult
+}
+
+func (e *DuplicatePromptError) Error() string {
+	if e.Active {
+		return fmt.Sprintf("ACP prompt %s was already accepted and remains active", e.PromptID)
+	}
+	return fmt.Sprintf("ACP prompt %s already settled", e.PromptID)
+}
+
+type DigestConflictError struct{ PromptID string }
+
+func (e *DigestConflictError) Error() string {
+	return fmt.Sprintf("ACP prompt %s identity was reused with a different request digest", e.PromptID)
+}
+
+type StalePromptError struct{ PromptID string }
+
+func (e *StalePromptError) Error() string {
+	return fmt.Sprintf("ACP prompt %s is no longer active", e.PromptID)
+}
+
+type activePrompt struct {
+	id              string
+	requestDigest   string
+	request         PromptRequest
+	events          chan PromptEvent
+	result          chan PromptResult
+	done            chan struct{}
+	seq             int64
+	accepted        bool
+	settled         bool
+	overflowed      bool
+	cancelRequested bool
+	lease           *time.Timer
+	permissions     map[string]*pendingPermission
+	preAccepted     []PromptEvent
+}
+
+type pendingPermission struct {
+	options map[string]struct{}
+	result  chan RequestPermissionOutcome
+}
+
+func NewRuntimeSession(ctx context.Context, cfg RuntimeSessionConfig) (*RuntimeSession, error) {
+	cfg.ID = strings.TrimSpace(cfg.ID)
+	cfg.ProfileDigest = strings.TrimSpace(cfg.ProfileDigest)
+	if cfg.ID == "" || cfg.Generation <= 0 || cfg.ProfileDigest == "" {
+		return nil, fmt.Errorf("runtime session ID, positive generation, and profile digest are required")
+	}
+	newSessionMeta, err := MergeNewSessionMeta(cfg.NewSessionMeta, Meta{
+		sessionMetaRuntimeSessionID:     cfg.ID,
+		sessionMetaGeneration:           cfg.Generation,
+		sessionMetaRuntimeProfileDigest: cfg.ProfileDigest,
+	})
+	if err != nil {
+		return nil, err
+	}
+	if cfg.InitializeTimeout <= 0 {
+		cfg.InitializeTimeout = DefaultInitializeTimeout
+	}
+	if cfg.PromptLease <= 0 {
+		cfg.PromptLease = DefaultPromptLease
+	}
+	if cfg.PermissionTimeout <= 0 {
+		cfg.PermissionTimeout = DefaultPermissionTimeout
+	}
+	if cfg.CancelGrace <= 0 {
+		cfg.CancelGrace = DefaultStopGrace
+	}
+	if cfg.MaxBufferedEvents <= 0 {
+		cfg.MaxBufferedEvents = DefaultBufferedEvents
+	}
+	session := &RuntimeSession{
+		id:            cfg.ID,
+		generation:    cfg.Generation,
+		profileDigest: cfg.ProfileDigest,
+		config:        cfg,
+		tombstones:    make(map[string]PromptTombstone),
+	}
+	cfg.Process.ClientOptions.RequestHandler = session.handleRequest
+	cfg.Process.ClientOptions.NotificationHandler = session.handleNotification
+	process, err := StartProcess(cfg.Process)
+	if err != nil {
+		return nil, err
+	}
+	session.process = process
+
+	initCtx, cancel := context.WithTimeout(ctx, cfg.InitializeTimeout)
+	defer cancel()
+	clientInfo := cfg.ClientInfo
+	if clientInfo.Name == "" {
+		clientInfo = Implementation{Name: "orka-acp-runtime", Version: "development"}
+	}
+	initialized, err := process.Client().Initialize(initCtx, InitializeRequest{
+		ProtocolVersion: ProtocolVersion,
+		ClientInfo:      &clientInfo,
+		ClientCapabilities: ClientCapabilities{
+			FS:       FileSystemCapabilities{},
+			Terminal: false,
+		},
+	})
+	if err != nil {
+		_ = stopProcessBestEffort(process, cfg.CancelGrace)
+		return nil, fmt.Errorf("initialize ACP adapter: %w", err)
+	}
+	if len(cfg.MCPServers) > 0 && !acpMCPCapabilityEnabled(initialized.AgentCapabilities.MCPCapabilities, "http") {
+		_ = stopProcessBestEffort(process, cfg.CancelGrace)
+		return nil, fmt.Errorf("ACP adapter did not advertise HTTP MCP server support")
+	}
+	if cfg.AuthMethodID != "" {
+		if !containsAuthMethod(initialized.AuthMethods, cfg.AuthMethodID) {
+			_ = stopProcessBestEffort(process, cfg.CancelGrace)
+			return nil, fmt.Errorf("ACP adapter did not advertise authentication method %q", cfg.AuthMethodID)
+		}
+		if err := process.Client().Authenticate(initCtx, cfg.AuthMethodID); err != nil {
+			_ = stopProcessBestEffort(process, cfg.CancelGrace)
+			return nil, fmt.Errorf("authenticate ACP adapter: %w", err)
+		}
+	}
+	newSession, err := process.Client().NewSession(initCtx, NewSessionRequest{
+		CWD:        cfg.Process.Paths.Workspace,
+		MCPServers: append([]MCPServer{}, cfg.MCPServers...),
+		Meta:       newSessionMeta,
+	})
+	if err != nil {
+		_ = stopProcessBestEffort(process, cfg.CancelGrace)
+		return nil, fmt.Errorf("create ACP provider session: %w", err)
+	}
+	session.providerSessionID = newSession.SessionID
+	return session, nil
+}
+
+func (s *RuntimeSession) ID() string                { return s.id }
+func (s *RuntimeSession) Generation() int64         { return s.generation }
+func (s *RuntimeSession) ProviderSessionID() string { return s.providerSessionID }
+func (s *RuntimeSession) Process() *Process         { return s.process }
+
+func (s *RuntimeSession) StartPrompt(ctx context.Context, promptID, requestDigest string, prompt []ContentBlock) (PromptRun, error) {
+	return s.StartPromptWithLease(ctx, promptID, requestDigest, prompt, s.config.PromptLease)
+}
+
+func (s *RuntimeSession) StartPromptWithLease(ctx context.Context, promptID, requestDigest string, prompt []ContentBlock, leaseDuration time.Duration) (PromptRun, error) {
+	promptID = strings.TrimSpace(promptID)
+	requestDigest = strings.TrimSpace(requestDigest)
+	if promptID == "" || requestDigest == "" || len(prompt) == 0 {
+		return PromptRun{}, fmt.Errorf("prompt ID, request digest, and content are required")
+	}
+	if leaseDuration <= 0 {
+		return PromptRun{}, fmt.Errorf("prompt lease duration must be positive")
+	}
+	s.mu.Lock()
+	if s.deleted {
+		s.mu.Unlock()
+		return PromptRun{}, fmt.Errorf("runtime session is deleted")
+	}
+	if active := s.active; active != nil {
+		if active.id != promptID {
+			s.mu.Unlock()
+			return PromptRun{}, fmt.Errorf("runtime session already has active prompt %s", active.id)
+		}
+		if active.requestDigest != requestDigest {
+			s.mu.Unlock()
+			return PromptRun{}, &DigestConflictError{PromptID: promptID}
+		}
+		s.mu.Unlock()
+		return PromptRun{}, &DuplicatePromptError{PromptID: promptID, Active: true}
+	}
+	if tombstone, ok := s.tombstones[promptID]; ok {
+		if tombstone.RequestDigest != requestDigest {
+			s.mu.Unlock()
+			return PromptRun{}, &DigestConflictError{PromptID: promptID}
+		}
+		result := tombstone.Result
+		s.mu.Unlock()
+		return PromptRun{}, &DuplicatePromptError{PromptID: promptID, Result: &result}
+	}
+	active := &activePrompt{
+		id:            promptID,
+		requestDigest: requestDigest,
+		request:       PromptRequest{SessionID: s.providerSessionID, Prompt: append([]ContentBlock(nil), prompt...)},
+		events:        make(chan PromptEvent, s.config.MaxBufferedEvents),
+		result:        make(chan PromptResult, 1),
+		done:          make(chan struct{}),
+		permissions:   make(map[string]*pendingPermission),
+	}
+	active.lease = time.AfterFunc(leaseDuration, func() { s.expirePrompt(promptID) })
+	s.active = active
+	s.mu.Unlock()
+
+	go s.runPrompt(active)
+	go func() {
+		select {
+		case <-ctx.Done():
+			cancelCtx, cancel := context.WithTimeout(context.Background(), s.config.CancelGrace*2)
+			defer cancel()
+			_, _ = s.CancelPrompt(cancelCtx, promptID)
+		case <-active.done:
+		}
+	}()
+	return PromptRun{Events: active.events, Result: active.result}, nil
+}
+
+func (s *RuntimeSession) RenewPromptLease(promptID string) error {
+	return s.RenewPromptLeaseFor(promptID, s.config.PromptLease)
+}
+
+func (s *RuntimeSession) RenewPromptLeaseFor(promptID string, leaseDuration time.Duration) error {
+	if leaseDuration <= 0 {
+		return fmt.Errorf("prompt lease duration must be positive")
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.active == nil || s.active.id != promptID || s.active.settled {
+		return &StalePromptError{PromptID: promptID}
+	}
+	if !s.active.lease.Stop() {
+		return &StalePromptError{PromptID: promptID}
+	}
+	s.active.lease.Reset(leaseDuration)
+	return nil
+}
+
+func (s *RuntimeSession) ResolvePermission(promptID, requestID string, outcome RequestPermissionOutcome) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.active == nil || s.active.id != promptID || s.active.settled {
+		return &StalePromptError{PromptID: promptID}
+	}
+	pending, ok := s.active.permissions[requestID]
+	if !ok {
+		return fmt.Errorf("permission request %s is not pending", requestID)
+	}
+	if outcome.Outcome == permissionOutcomeSelected {
+		if _, ok := pending.options[outcome.OptionID]; !ok {
+			return fmt.Errorf("permission option %q was not offered", outcome.OptionID)
+		}
+	} else if outcome.Outcome != permissionOutcomeCancelled {
+		return fmt.Errorf("unsupported permission outcome %q", outcome.Outcome)
+	}
+	delete(s.active.permissions, requestID)
+	pending.result <- outcome
+	return nil
+}
+
+func (s *RuntimeSession) CancelPrompt(ctx context.Context, promptID string) (PromptResult, error) {
+	s.mu.Lock()
+	active := s.active
+	if active == nil || active.id != promptID || active.settled {
+		tombstone, settled := s.tombstones[promptID]
+		s.mu.Unlock()
+		if settled {
+			return tombstone.Result, nil
+		}
+		return PromptResult{}, &StalePromptError{PromptID: promptID}
+	}
+	active.cancelRequested = true
+	cancelPendingPermissions(active)
+	done := active.done
+	s.mu.Unlock()
+
+	if err := s.process.Client().Cancel(ctx, s.providerSessionID); err != nil && !errors.Is(err, ErrClosed) {
+		return PromptResult{}, err
+	}
+	timer := time.NewTimer(s.config.CancelGrace)
+	defer timer.Stop()
+	select {
+	case <-done:
+		return s.tombstoneResult(promptID)
+	case <-timer.C:
+		_, _ = s.process.Stop(ctx, s.config.CancelGrace)
+		select {
+		case <-done:
+			return s.tombstoneResult(promptID)
+		case <-ctx.Done():
+			return PromptResult{}, ctx.Err()
+		}
+	case <-ctx.Done():
+		return PromptResult{}, ctx.Err()
+	}
+}
+
+func (s *RuntimeSession) Delete(ctx context.Context) (CleanupStatus, error) {
+	s.mu.Lock()
+	if s.deleteDone != nil {
+		done := s.deleteDone
+		s.mu.Unlock()
+		select {
+		case <-done:
+			s.mu.Lock()
+			status, err := s.deleteStatus, s.deleteErr
+			s.mu.Unlock()
+			return status, err
+		case <-ctx.Done():
+			return CleanupStatus{}, ctx.Err()
+		}
+	}
+	s.deleted = true
+	s.deleteDone = make(chan struct{})
+	active := s.active
+	if active != nil && !active.settled {
+		active.cancelRequested = true
+		cancelPendingPermissions(active)
+	}
+	s.mu.Unlock()
+	if active != nil {
+		_ = s.process.Client().Cancel(context.Background(), s.providerSessionID)
+	}
+	status, err := s.process.Stop(ctx, s.config.CancelGrace)
+	s.mu.Lock()
+	s.deleteStatus = status
+	s.deleteErr = err
+	close(s.deleteDone)
+	s.mu.Unlock()
+	return status, err
+}
+
+func (s *RuntimeSession) Tombstone(promptID string) (PromptTombstone, bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	value, ok := s.tombstones[promptID]
+	return value, ok
+}
+
+func (s *RuntimeSession) runPrompt(active *activePrompt) {
+	var written bool
+	response, err := s.process.Client().PromptWithWritten(context.Background(), active.request, func() {
+		s.mu.Lock()
+		written = true
+		active.accepted = true
+		s.emitLocked(active, PromptEvent{Type: PromptEventAccepted})
+		queued := append([]PromptEvent(nil), active.preAccepted...)
+		active.preAccepted = nil
+		for _, event := range queued {
+			s.emitLocked(active, event)
+		}
+		s.mu.Unlock()
+	})
+	result := PromptResult{Accepted: written, SettledAt: time.Now().UTC()}
+	switch {
+	case err != nil:
+		result.Outcome = classifyPromptErrorOutcome(err, written)
+		result.Err = err
+	case response.StopReason == StopReasonEndTurn:
+		result.Outcome = PromptOutcomeCompleted
+		result.StopReason = response.StopReason
+	case response.StopReason == StopReasonCancelled:
+		result.Outcome = PromptOutcomeCancelled
+		result.StopReason = response.StopReason
+	default:
+		result.Outcome = PromptOutcomeFailed
+		result.StopReason = response.StopReason
+	}
+	s.finishPrompt(active, result)
+}
+
+func classifyPromptErrorOutcome(err error, written bool) PromptOutcome {
+	if !written {
+		return PromptOutcomeFailed
+	}
+	var rpcErr *RPCError
+	if errors.As(err, &rpcErr) {
+		// A structured JSON-RPC error proves that the adapter received and
+		// conclusively rejected or failed the prompt. Only loss of the response
+		// after the request write leaves the outcome ambiguous.
+		return PromptOutcomeFailed
+	}
+	return PromptOutcomeOutcomeUnknown
+}
+
+func (s *RuntimeSession) finishPrompt(active *activePrompt, result PromptResult) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if active.settled {
+		return
+	}
+	active.settled = true
+	if active.lease != nil {
+		active.lease.Stop()
+	}
+	cancelPendingPermissions(active)
+	if active.overflowed && result.Outcome != PromptOutcomeOutcomeUnknown {
+		result.Outcome = PromptOutcomeFailed
+		result.Err = fmt.Errorf("ACP prompt event buffer overflowed")
+	}
+	s.tombstones[active.id] = PromptTombstone{PromptID: active.id, RequestDigest: active.requestDigest, Result: result}
+	if s.active == active {
+		s.active = nil
+	}
+	active.result <- result
+	close(active.result)
+	close(active.events)
+	close(active.done)
+}
+
+func (s *RuntimeSession) handleNotification(_ context.Context, notification IncomingNotification) {
+	if notification.Method != MethodSessionUpdate {
+		return
+	}
+	var update SessionNotification
+	if err := json.Unmarshal(notification.Params, &update); err != nil {
+		return
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	active := s.active
+	if active == nil || active.settled || update.SessionID != s.providerSessionID {
+		return
+	}
+	s.emitLocked(active, PromptEvent{Type: PromptEventUpdate, Update: &update})
+}
+
+func (s *RuntimeSession) handleRequest(ctx context.Context, request IncomingRequest) (any, *RPCError) {
+	if request.Method != MethodRequestPermission {
+		return nil, &RPCError{Code: -32601, Message: "client method is not supported"}
+	}
+	var permission RequestPermissionRequest
+	if err := json.Unmarshal(request.Params, &permission); err != nil {
+		return nil, &RPCError{Code: -32602, Message: "invalid permission request"}
+	}
+	requestID := canonicalID(request.ID)
+	s.mu.Lock()
+	active := s.active
+	if active == nil || active.settled || permission.SessionID != s.providerSessionID {
+		s.mu.Unlock()
+		return RequestPermissionResponse{Outcome: CancelledPermissionOutcome()}, nil
+	}
+	if _, exists := active.permissions[requestID]; exists {
+		s.mu.Unlock()
+		return nil, &RPCError{Code: -32600, Message: "duplicate permission request"}
+	}
+	pending := &pendingPermission{options: make(map[string]struct{}), result: make(chan RequestPermissionOutcome, 1)}
+	for _, option := range permission.Options {
+		pending.options[option.OptionID] = struct{}{}
+	}
+	active.permissions[requestID] = pending
+	s.emitLocked(active, PromptEvent{Type: PromptEventPermissionRequested, Permission: &PermissionRequestEvent{RequestID: requestID, Request: permission}})
+	done := active.done
+	s.mu.Unlock()
+
+	timer := time.NewTimer(s.config.PermissionTimeout)
+	defer timer.Stop()
+	select {
+	case outcome := <-pending.result:
+		return RequestPermissionResponse{Outcome: outcome}, nil
+	case <-done:
+		return RequestPermissionResponse{Outcome: CancelledPermissionOutcome()}, nil
+	case <-timer.C:
+		s.removePermission(requestID, pending)
+		return RequestPermissionResponse{Outcome: CancelledPermissionOutcome()}, nil
+	case <-ctx.Done():
+		s.removePermission(requestID, pending)
+		return RequestPermissionResponse{Outcome: CancelledPermissionOutcome()}, nil
+	}
+}
+
+func (s *RuntimeSession) emitLocked(active *activePrompt, event PromptEvent) {
+	if !active.accepted && event.Type != PromptEventAccepted {
+		if len(active.preAccepted) >= s.config.MaxBufferedEvents {
+			active.overflowed = true
+			return
+		}
+		active.preAccepted = append(active.preAccepted, event)
+		return
+	}
+	active.seq++
+	event.Sequence = active.seq
+	event.Timestamp = time.Now().UTC()
+	select {
+	case active.events <- event:
+	default:
+		if !active.overflowed {
+			active.overflowed = true
+			go func(promptID string) {
+				ctx, cancel := context.WithTimeout(context.Background(), s.config.CancelGrace*2)
+				defer cancel()
+				_, _ = s.CancelPrompt(ctx, promptID)
+			}(active.id)
+		}
+	}
+}
+
+func (s *RuntimeSession) expirePrompt(promptID string) {
+	ctx, cancel := context.WithTimeout(context.Background(), s.config.CancelGrace*2)
+	defer cancel()
+	_, _ = s.CancelPrompt(ctx, promptID)
+}
+
+func (s *RuntimeSession) removePermission(requestID string, pending *pendingPermission) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.active != nil && s.active.permissions[requestID] == pending {
+		delete(s.active.permissions, requestID)
+	}
+}
+
+func (s *RuntimeSession) tombstoneResult(promptID string) (PromptResult, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	tombstone, ok := s.tombstones[promptID]
+	if !ok {
+		return PromptResult{}, fmt.Errorf("prompt %s settled without tombstone", promptID)
+	}
+	return tombstone.Result, nil
+}
+
+func cancelPendingPermissions(active *activePrompt) {
+	for id, pending := range active.permissions {
+		delete(active.permissions, id)
+		select {
+		case pending.result <- CancelledPermissionOutcome():
+		default:
+		}
+	}
+}
+
+func acpMCPCapabilityEnabled(capabilities map[string]any, name string) bool {
+	value, ok := capabilities[name]
+	if !ok {
+		return false
+	}
+	enabled, ok := value.(bool)
+	return ok && enabled
+}
+
+func containsAuthMethod(methods []AuthMethod, id string) bool {
+	for _, method := range methods {
+		if method.ID == id {
+			return true
+		}
+	}
+	return false
+}
+
+func stopProcessBestEffort(process *Process, grace time.Duration) error {
+	ctx, cancel := context.WithTimeout(context.Background(), grace*2)
+	defer cancel()
+	_, err := process.Stop(ctx, grace)
+	return err
+}
+
+func (s *RuntimeSession) Freeze(ctx context.Context) error {
+	s.mu.Lock()
+	if s.deleted || s.active != nil {
+		s.mu.Unlock()
+		return fmt.Errorf("runtime session must be idle before workspace freeze")
+	}
+	process := s.process
+	s.mu.Unlock()
+	return process.Freeze(ctx)
+}
+
+// ChildIdentity returns the immutable UID/GID assigned to the provider process.
+func (s *RuntimeSession) ChildIdentity() (int, int) {
+	if s == nil {
+		return 0, 0
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.config.Process.UID, s.config.Process.GID
+}
+
+func (s *RuntimeSession) Thaw() error {
+	s.mu.Lock()
+	if s.deleted || s.active != nil {
+		s.mu.Unlock()
+		return fmt.Errorf("runtime session cannot thaw while deleted or prompt-active")
+	}
+	process := s.process
+	s.mu.Unlock()
+	return process.Thaw()
+}
diff --git a/internal/acp/session_test.go b/internal/acp/session_test.go
new file mode 100644
index 000000000..91a6a4317
--- /dev/null
+++ b/internal/acp/session_test.go
@@ -0,0 +1,448 @@
+package acp
+
+import (
+	"bufio"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strconv"
+	"testing"
+	"time"
+)
+
+const testOptionsMetaKey = "options"
+
+func TestRuntimeSessionPromptPermissionAndTombstone(t *testing.T) {
+	session := newTestRuntimeSession(t, "permission")
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	run, err := session.StartPrompt(ctx, "prompt-1", "sha256:one", []ContentBlock{Text("hello")})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var sawAccepted, sawUpdate, sawPermission bool
+	for event := range run.Events {
+		switch event.Type {
+		case PromptEventAccepted:
+			sawAccepted = true
+		case PromptEventUpdate:
+			sawUpdate = true
+		case PromptEventPermissionRequested:
+			sawPermission = true
+			if event.Permission == nil || event.Permission.RequestID != "50" {
+				t.Fatalf("unexpected permission event: %#v", event.Permission)
+			}
+			if err := session.ResolvePermission("prompt-1", event.Permission.RequestID, SelectedPermissionOutcome("allow")); err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
+	result := <-run.Result
+	if !sawAccepted || !sawUpdate || !sawPermission {
+		t.Fatalf("events accepted=%v update=%v permission=%v", sawAccepted, sawUpdate, sawPermission)
+	}
+	if result.Outcome != PromptOutcomeCompleted || result.StopReason != StopReasonEndTurn || !result.Accepted {
+		t.Fatalf("unexpected result: %#v", result)
+	}
+	if _, err := session.StartPrompt(ctx, "prompt-1", "sha256:one", []ContentBlock{Text("again")}); err == nil {
+		t.Fatal("settled prompt duplicate unexpectedly started")
+	} else if duplicate, ok := err.(*DuplicatePromptError); !ok || duplicate.Active || duplicate.Result == nil {
+		t.Fatalf("duplicate error = %#v", err)
+	}
+	if _, err := session.StartPrompt(ctx, "prompt-1", "sha256:different", []ContentBlock{Text("again")}); err == nil {
+		t.Fatal("digest conflict unexpectedly started")
+	} else if _, ok := err.(*DigestConflictError); !ok {
+		t.Fatalf("conflict error = %#v", err)
+	}
+}
+
+func TestRuntimeSessionCancelBarrier(t *testing.T) {
+	session := newTestRuntimeSession(t, "wait")
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	run, err := session.StartPrompt(ctx, "prompt-cancel", "sha256:cancel", []ContentBlock{Text("wait")})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for event := range run.Events {
+		if event.Type == PromptEventAccepted {
+			break
+		}
+	}
+	result, err := session.CancelPrompt(ctx, "prompt-cancel")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.Outcome != PromptOutcomeCancelled || result.StopReason != StopReasonCancelled {
+		t.Fatalf("cancel result = %#v", result)
+	}
+	for range run.Events {
+	}
+	<-run.Result
+	if err := session.ResolvePermission("prompt-cancel", "50", CancelledPermissionOutcome()); err == nil {
+		t.Fatal("late permission unexpectedly accepted")
+	} else if _, ok := err.(*StalePromptError); !ok {
+		t.Fatalf("late permission error = %#v", err)
+	}
+}
+
+func TestRuntimeSessionLeaseRenewalRejectsSettledPrompt(t *testing.T) {
+	session := newTestRuntimeSession(t, "immediate")
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	run, err := session.StartPrompt(ctx, "prompt-done", "sha256:done", []ContentBlock{Text("done")})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for range run.Events {
+	}
+	<-run.Result
+	if err := session.RenewPromptLease("prompt-done"); err == nil {
+		t.Fatal("settled prompt lease unexpectedly renewed")
+	}
+}
+
+func TestRuntimeSessionCancelReturnsSettledPromptResult(t *testing.T) {
+	session := newTestRuntimeSession(t, "immediate")
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	run, err := session.StartPrompt(ctx, "prompt-done", "sha256:done", []ContentBlock{Text("done")})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for range run.Events {
+	}
+	want := <-run.Result
+	got, err := session.CancelPrompt(ctx, "prompt-done")
+	if err != nil {
+		t.Fatalf("cancel settled prompt: %v", err)
+	}
+	if got.Outcome != want.Outcome || got.StopReason != want.StopReason || got.Accepted != want.Accepted {
+		t.Fatalf("settled result = %#v, want %#v", got, want)
+	}
+}
+
+func TestRuntimeSessionExplicitRPCErrorAfterAcceptanceIsFailed(t *testing.T) {
+	session := newTestRuntimeSession(t, "rpc-error")
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	run, err := session.StartPrompt(ctx, "prompt-rpc-error", "sha256:rpc-error", []ContentBlock{Text("fail")})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var sawAccepted bool
+	for event := range run.Events {
+		sawAccepted = sawAccepted || event.Type == PromptEventAccepted
+	}
+	result := <-run.Result
+	if !sawAccepted || !result.Accepted {
+		t.Fatalf("prompt was not accepted: event=%v result=%#v", sawAccepted, result)
+	}
+	if result.Outcome != PromptOutcomeFailed {
+		t.Fatalf("explicit RPC error outcome = %q, want %q", result.Outcome, PromptOutcomeFailed)
+	}
+	var rpcErr *RPCError
+	if !errors.As(result.Err, &rpcErr) || rpcErr.Code != -32603 {
+		t.Fatalf("result error = %#v, want RPC error -32603", result.Err)
+	}
+}
+
+func TestRuntimeSessionTransportClosureAfterAcceptanceIsOutcomeUnknown(t *testing.T) {
+	session := newTestRuntimeSession(t, "transport-close")
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	run, err := session.StartPrompt(ctx, "prompt-transport-close", "sha256:transport-close", []ContentBlock{Text("disconnect")})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var sawAccepted bool
+	for event := range run.Events {
+		sawAccepted = sawAccepted || event.Type == PromptEventAccepted
+	}
+	result := <-run.Result
+	if !sawAccepted || !result.Accepted {
+		t.Fatalf("prompt was not accepted: event=%v result=%#v", sawAccepted, result)
+	}
+	if result.Outcome != PromptOutcomeOutcomeUnknown {
+		t.Fatalf("transport closure outcome = %q, want %q", result.Outcome, PromptOutcomeOutcomeUnknown)
+	}
+	if !errors.Is(result.Err, io.EOF) {
+		t.Fatalf("result error = %#v, want EOF", result.Err)
+	}
+}
+
+func TestClassifyPromptErrorOutcome(t *testing.T) {
+	tests := []struct {
+		name    string
+		err     error
+		written bool
+		want    PromptOutcome
+	}{
+		{
+			name:    "explicit RPC error after write",
+			err:     &RPCError{Code: -32603, Message: "adapter failed"},
+			written: true,
+			want:    PromptOutcomeFailed,
+		},
+		{
+			name:    "wrapped explicit RPC error after write",
+			err:     fmt.Errorf("prompt failed: %w", &RPCError{Code: -32603, Message: "adapter failed"}),
+			written: true,
+			want:    PromptOutcomeFailed,
+		},
+		{
+			name:    "transport closure after write",
+			err:     io.EOF,
+			written: true,
+			want:    PromptOutcomeOutcomeUnknown,
+		},
+		{
+			name:    "deadline after write",
+			err:     context.DeadlineExceeded,
+			written: true,
+			want:    PromptOutcomeOutcomeUnknown,
+		},
+		{
+			name:    "failure before write",
+			err:     context.DeadlineExceeded,
+			written: false,
+			want:    PromptOutcomeFailed,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := classifyPromptErrorOutcome(tt.err, tt.written); got != tt.want {
+				t.Fatalf("classifyPromptErrorOutcome(%v, %v) = %q, want %q", tt.err, tt.written, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestRuntimeSessionConcurrentDeleteSharesCleanupResult(t *testing.T) {
+	session := newTestRuntimeSession(t, "wait")
+	type deleteResult struct {
+		status CleanupStatus
+		err    error
+	}
+	start := make(chan struct{})
+	results := make(chan deleteResult, 2)
+	for range 2 {
+		go func() {
+			<-start
+			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			defer cancel()
+			status, err := session.Delete(ctx)
+			results <- deleteResult{status: status, err: err}
+		}()
+	}
+	close(start)
+	first, second := <-results, <-results
+	if first.status.Proven != second.status.Proven || !reflect.DeepEqual(first.status.RemainingPIDs, second.status.RemainingPIDs) {
+		t.Fatalf("concurrent delete statuses differ: %#v vs %#v", first.status, second.status)
+	}
+	if fmt.Sprint(first.err) != fmt.Sprint(second.err) {
+		t.Fatalf("concurrent delete errors differ: %v vs %v", first.err, second.err)
+	}
+}
+
+func TestRuntimeSessionProjectsProtectedNewSessionMetadata(t *testing.T) {
+	session := newTestRuntimeSessionWithMeta(t, "metadata", Meta{
+		"systemPrompt": "trusted instructions",
+		"claudeCode": map[string]any{
+			testOptionsMetaKey: map[string]any{"maxTurns": 7},
+		},
+	})
+	if session.ProviderSessionID() != "provider-test-session" {
+		t.Fatalf("provider session ID = %q", session.ProviderSessionID())
+	}
+}
+
+func TestMergeNewSessionMetaRejectsProtectedNamespace(t *testing.T) {
+	protected := Meta{sessionMetaRuntimeSessionID: "session"}
+	for _, provider := range []Meta{
+		{sessionMetaRuntimeSessionID: "replacement"},
+		{"OrKa.shadow": true},
+		{" ": true},
+	} {
+		if _, err := MergeNewSessionMeta(provider, protected); err == nil {
+			t.Fatalf("provider metadata %#v unexpectedly accepted", provider)
+		}
+	}
+	merged, err := MergeNewSessionMeta(Meta{"claudeCode": map[string]any{testOptionsMetaKey: map[string]any{"effort": "high"}}}, protected)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if merged[sessionMetaRuntimeSessionID] != "session" || merged["claudeCode"] == nil {
+		t.Fatalf("merged metadata = %#v", merged)
+	}
+}
+
+func newTestRuntimeSession(t *testing.T, mode string) *RuntimeSession {
+	return newTestRuntimeSessionWithMeta(t, mode, nil)
+}
+
+func newTestRuntimeSessionWithMeta(t *testing.T, mode string, newSessionMeta Meta) *RuntimeSession {
+	t.Helper()
+	uid, gid := os.Getuid(), os.Getgid()
+	if uid == 0 {
+		uid, gid = 65534, 65534
+	}
+	testRoot, err := os.MkdirTemp("", "orka-acp-session-test-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = os.RemoveAll(testRoot) })
+	if err := os.Chmod(testRoot, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	paths, err := PrepareSessionPaths(filepath.Join(testRoot, "sessions"), "test-session")
+	if err != nil {
+		t.Fatal(err)
+	}
+	env, err := BuildChildEnvironment(paths, EnvironmentConfig{Values: map[string]string{
+		"GO_WANT_ACP_HELPER": "1",
+		"ACP_HELPER_MODE":    mode,
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	command := testAdapterCommand(t)
+	session, err := NewRuntimeSession(context.Background(), RuntimeSessionConfig{
+		ID:            "test-session",
+		Generation:    1,
+		ProfileDigest: "sha256:profile",
+		Process: ProcessConfig{
+			Command:           command,
+			Args:              []string{"-test.run=TestACPHelperProcess"},
+			Environment:       env,
+			Paths:             paths,
+			UID:               uid,
+			GID:               gid,
+			ExecHelperCommand: testExecHelperCommand(t),
+		},
+		NewSessionMeta:    newSessionMeta,
+		PromptLease:       5 * time.Second,
+		PermissionTimeout: 5 * time.Second,
+		CancelGrace:       2 * time.Second,
+		MaxBufferedEvents: 16,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+		defer cancel()
+		_, _ = session.Delete(ctx)
+	})
+	return session
+}
+
+func TestACPHelperProcess(t *testing.T) {
+	if os.Getenv("GO_WANT_ACP_HELPER") != "1" {
+		return
+	}
+	reader := bufio.NewReader(os.Stdin)
+	writer := bufio.NewWriter(os.Stdout)
+	defer func() { _ = writer.Flush() }()
+	mode := os.Getenv("ACP_HELPER_MODE")
+	var promptID json.RawMessage
+	var providerSession = "provider-test-session"
+	for {
+		line, err := reader.ReadBytes('\n')
+		if err != nil {
+			os.Exit(0)
+		}
+		var message rpcMessage
+		if err := json.Unmarshal(line, &message); err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(2)
+		}
+		switch message.Method {
+		case MethodInitialize:
+			writeACPHelper(writer, map[string]any{
+				"jsonrpc": "2.0", "id": rawIDValue(message.ID),
+				"result": map[string]any{"protocolVersion": ProtocolVersion, "agentInfo": map[string]any{"name": "fake", "version": "1"}},
+			})
+		case MethodSessionNew:
+			if mode == "metadata" {
+				var request NewSessionRequest
+				if err := json.Unmarshal(message.Params, &request); err != nil || !validTestNewSessionMetadata(request.Meta) {
+					writeACPHelper(writer, map[string]any{
+						"jsonrpc": "2.0", "id": rawIDValue(message.ID),
+						"error": map[string]any{"code": -32602, "message": "unexpected session metadata"},
+					})
+					continue
+				}
+			}
+			writeACPHelper(writer, map[string]any{"jsonrpc": "2.0", "id": rawIDValue(message.ID), "result": map[string]any{"sessionId": providerSession}})
+		case MethodSessionPrompt:
+			promptID = append(promptID[:0], message.ID...)
+			writeACPHelper(writer, map[string]any{
+				"jsonrpc": "2.0", "method": MethodSessionUpdate,
+				"params": map[string]any{"sessionId": providerSession, "update": map[string]any{"sessionUpdate": "agent_message_chunk", "content": map[string]any{"type": "text", "text": "working"}}},
+			})
+			switch mode {
+			case "permission":
+				writeACPHelper(writer, map[string]any{
+					"jsonrpc": "2.0", "id": 50, "method": MethodRequestPermission,
+					"params": map[string]any{"sessionId": providerSession, "toolCall": map[string]any{"toolCallId": "tool-1", "title": "test"}, "options": []map[string]any{{"optionId": "allow", "name": "Allow", "kind": "allow_once"}}},
+				})
+			case "immediate":
+				writeACPHelper(writer, map[string]any{"jsonrpc": "2.0", "id": rawIDValue(promptID), "result": map[string]any{"stopReason": StopReasonEndTurn}})
+			case "rpc-error":
+				writeACPHelper(writer, map[string]any{
+					"jsonrpc": "2.0", "id": rawIDValue(promptID),
+					"error": map[string]any{"code": -32603, "message": "adapter failed"},
+				})
+			case "transport-close":
+				os.Exit(0)
+			}
+		case MethodSessionCancel:
+			if len(promptID) > 0 {
+				writeACPHelper(writer, map[string]any{"jsonrpc": "2.0", "id": rawIDValue(promptID), "result": map[string]any{"stopReason": StopReasonCancelled}})
+				promptID = nil
+			}
+		default:
+			if len(message.ID) > 0 && message.Method == "" && string(message.ID) == "50" && len(promptID) > 0 {
+				writeACPHelper(writer, map[string]any{"jsonrpc": "2.0", "id": rawIDValue(promptID), "result": map[string]any{"stopReason": StopReasonEndTurn}})
+				promptID = nil
+			}
+		}
+	}
+}
+
+func validTestNewSessionMetadata(meta Meta) bool {
+	if meta["systemPrompt"] != "trusted instructions" || meta[sessionMetaRuntimeSessionID] != "test-session" ||
+		meta[sessionMetaGeneration] != float64(1) || meta[sessionMetaRuntimeProfileDigest] != "sha256:profile" {
+		return false
+	}
+	claudeCode, ok := meta["claudeCode"].(map[string]any)
+	if !ok {
+		return false
+	}
+	options, ok := claudeCode[testOptionsMetaKey].(map[string]any)
+	return ok && options["maxTurns"] == float64(7)
+}
+
+func writeACPHelper(writer *bufio.Writer, value any) {
+	data, _ := json.Marshal(value)
+	_, _ = writer.Write(append(data, '\n'))
+	_ = writer.Flush()
+}
+
+func rawIDValue(raw json.RawMessage) any {
+	if value, err := strconv.ParseInt(string(raw), 10, 64); err == nil {
+		return value
+	}
+	var value any
+	_ = json.Unmarshal(raw, &value)
+	return value
+}
diff --git a/internal/acp/supervisor_hardening.go b/internal/acp/supervisor_hardening.go
new file mode 100644
index 000000000..5e1e23f6a
--- /dev/null
+++ b/internal/acp/supervisor_hardening.go
@@ -0,0 +1,17 @@
+package acp
+
+import "fmt"
+
+type HardeningStatus struct {
+	Subreaper         bool
+	CoreDumpsDisabled bool
+	PrivateUmask      bool
+}
+
+func HardenSupervisorProcess() (HardeningStatus, error) {
+	status, err := hardenSupervisorPlatform()
+	if err != nil {
+		return HardeningStatus{}, fmt.Errorf("harden ACP supervisor process: %w", err)
+	}
+	return status, nil
+}
diff --git a/internal/acp/supervisor_hardening_linux.go b/internal/acp/supervisor_hardening_linux.go
new file mode 100644
index 000000000..33ad37b26
--- /dev/null
+++ b/internal/acp/supervisor_hardening_linux.go
@@ -0,0 +1,16 @@
+//go:build linux
+
+package acp
+
+import "golang.org/x/sys/unix"
+
+func hardenSupervisorPlatform() (HardeningStatus, error) {
+	if err := unix.Prctl(unix.PR_SET_CHILD_SUBREAPER, 1, 0, 0, 0); err != nil {
+		return HardeningStatus{}, err
+	}
+	if err := unix.Setrlimit(unix.RLIMIT_CORE, &unix.Rlimit{Cur: 0, Max: 0}); err != nil {
+		return HardeningStatus{}, err
+	}
+	unix.Umask(0o077)
+	return HardeningStatus{Subreaper: true, CoreDumpsDisabled: true, PrivateUmask: true}, nil
+}
diff --git a/internal/acp/supervisor_hardening_nonunix.go b/internal/acp/supervisor_hardening_nonunix.go
new file mode 100644
index 000000000..90d8021fd
--- /dev/null
+++ b/internal/acp/supervisor_hardening_nonunix.go
@@ -0,0 +1,9 @@
+//go:build !unix
+
+package acp
+
+func hardenSupervisorPlatform() (HardeningStatus, error) {
+	// Non-Unix platforms do not expose the process-wide umask or RLIMIT_CORE
+	// controls used by the production Linux supervisor.
+	return HardeningStatus{}, nil
+}
diff --git a/internal/acp/supervisor_hardening_unix.go b/internal/acp/supervisor_hardening_unix.go
new file mode 100644
index 000000000..2dc0da202
--- /dev/null
+++ b/internal/acp/supervisor_hardening_unix.go
@@ -0,0 +1,13 @@
+//go:build unix && !linux
+
+package acp
+
+import "golang.org/x/sys/unix"
+
+func hardenSupervisorPlatform() (HardeningStatus, error) {
+	if err := unix.Setrlimit(unix.RLIMIT_CORE, &unix.Rlimit{Cur: 0, Max: 0}); err != nil {
+		return HardeningStatus{}, err
+	}
+	unix.Umask(0o077)
+	return HardeningStatus{Subreaper: false, CoreDumpsDisabled: true, PrivateUmask: true}, nil
+}
diff --git a/internal/admission/execution_mode.go b/internal/admission/execution_mode.go
new file mode 100644
index 000000000..2034ea83b
--- /dev/null
+++ b/internal/admission/execution_mode.go
@@ -0,0 +1,349 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package admission
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"reflect"
+	"slices"
+	"strings"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/executionmode"
+	"github.com/orka-agents/orka/internal/labels"
+	admissionv1 "k8s.io/api/admission/v1"
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+	ctrladmission "sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+)
+
+const (
+	statusSubresource = "status"
+
+	NamespaceExecutionModeWebhookPath = "/validate-v1-namespace-execution-mode"
+	AgentContractWebhookPath          = "/validate-core-orka-ai-v1alpha1-agent-contract"
+	AgentRuntimeContractWebhookPath   = "/validate-core-orka-ai-v1alpha1-agentruntime-contract"
+	TaskExecutionAuthorityWebhookPath = "/validate-core-orka-ai-v1alpha1-task-execution-authority"
+)
+
+// ExecutionModeConfig identifies exact controller writers. Namespace-scoped
+// RBAC remains the primary authorization boundary; these usernames are a
+// second fail-closed identity fence for controller-owned Task status.
+type ExecutionModeConfig struct {
+	ControllerUsernames []string
+}
+
+func (c ExecutionModeConfig) normalized() ExecutionModeConfig {
+	values := make([]string, 0, len(c.ControllerUsernames))
+	for _, value := range c.ControllerUsernames {
+		value = strings.TrimSpace(value)
+		if value != "" && !slices.Contains(values, value) {
+			values = append(values, value)
+		}
+	}
+	c.ControllerUsernames = values
+	return c
+}
+
+func (c ExecutionModeConfig) controller(username string) bool {
+	return slices.Contains(c.ControllerUsernames, strings.TrimSpace(username))
+}
+
+// RegisterExecutionModeWebhooks registers the static namespace-mode boundary.
+func RegisterExecutionModeWebhooks(
+	server webhook.Server,
+	scheme *runtime.Scheme,
+	reader client.Reader,
+	config ExecutionModeConfig,
+) {
+	config = config.normalized()
+	decoder := ctrladmission.NewDecoder(scheme)
+	server.Register(NamespaceExecutionModeWebhookPath, &ctrladmission.Webhook{Handler: &NamespaceExecutionModeValidator{
+		decoder: decoder,
+	}})
+	server.Register(AgentContractWebhookPath, &ctrladmission.Webhook{Handler: &AgentContractValidator{
+		decoder: decoder, reader: reader,
+	}})
+	server.Register(AgentRuntimeContractWebhookPath, &ctrladmission.Webhook{Handler: &AgentRuntimeContractValidator{
+		decoder: decoder, reader: reader,
+	}})
+	server.Register(TaskExecutionAuthorityWebhookPath, &ctrladmission.Webhook{Handler: &TaskExecutionAuthorityValidator{
+		decoder: decoder, reader: reader, config: config,
+	}})
+}
+
+// NamespaceExecutionModeValidator permits a namespace to be created with one
+// valid execution-mode label and then makes that claim immutable.
+type NamespaceExecutionModeValidator struct {
+	decoder ctrladmission.Decoder
+}
+
+func (v *NamespaceExecutionModeValidator) Handle(_ context.Context, req ctrladmission.Request) ctrladmission.Response {
+	if req.Operation != admissionv1.Create && req.Operation != admissionv1.Update {
+		return ctrladmission.Allowed("not a namespace execution-mode write")
+	}
+	object := &corev1.Namespace{}
+	if err := v.decoder.Decode(req, object); err != nil {
+		return ctrladmission.Errored(http.StatusBadRequest, fmt.Errorf("decode namespace: %w", err))
+	}
+	newValue := strings.TrimSpace(object.Labels[executionmode.NamespaceLabel])
+	if req.Operation == admissionv1.Create {
+		if newValue == "" {
+			return ctrladmission.Allowed("namespace has no Orka execution-mode claim")
+		}
+		if _, err := executionmode.Parse(newValue); err != nil {
+			return ctrladmission.Denied(err.Error())
+		}
+		return ctrladmission.Allowed("namespace acquired an immutable execution-mode claim")
+	}
+
+	oldObject := &corev1.Namespace{}
+	if err := v.decoder.DecodeRaw(req.OldObject, oldObject); err != nil {
+		return ctrladmission.Errored(http.StatusBadRequest, fmt.Errorf("decode old namespace: %w", err))
+	}
+	oldValue := strings.TrimSpace(oldObject.Labels[executionmode.NamespaceLabel])
+	if oldValue == "" {
+		if newValue == "" {
+			return ctrladmission.Allowed("namespace has no Orka execution-mode claim")
+		}
+		return ctrladmission.Denied("an existing namespace cannot acquire an execution-mode claim; create a new namespace for the installation")
+	}
+	if newValue != oldValue {
+		return ctrladmission.Denied("namespace execution-mode claim is immutable; recreate the installation in a different namespace")
+	}
+	if _, err := executionmode.Parse(newValue); err != nil {
+		return ctrladmission.Denied(err.Error())
+	}
+	return ctrladmission.Allowed("namespace execution-mode claim is unchanged")
+}
+
+type AgentContractValidator struct {
+	decoder ctrladmission.Decoder
+	reader  client.Reader
+}
+
+func (v *AgentContractValidator) Handle(ctx context.Context, req ctrladmission.Request) ctrladmission.Response {
+	if req.SubResource == statusSubresource || (req.Operation != admissionv1.Create && req.Operation != admissionv1.Update) {
+		return ctrladmission.Allowed("not an Agent contract write")
+	}
+	object := &corev1alpha1.Agent{}
+	if err := v.decoder.Decode(req, object); err != nil {
+		return ctrladmission.Errored(http.StatusBadRequest, fmt.Errorf("decode Agent: %w", err))
+	}
+	mode, response := namespaceExecutionMode(ctx, v.reader, object.Namespace)
+	if !response.Allowed {
+		return response
+	}
+
+	var oldObject *corev1alpha1.Agent
+	if req.Operation == admissionv1.Update {
+		oldObject = &corev1alpha1.Agent{}
+		if err := v.decoder.DecodeRaw(req.OldObject, oldObject); err != nil {
+			return ctrladmission.Errored(http.StatusBadRequest, fmt.Errorf("decode old Agent: %w", err))
+		}
+		if agentUsesBuiltInRuntime(oldObject) && !agentUsesBuiltInRuntime(object) {
+			return ctrladmission.Denied("a built-in Agent cannot switch execution route or remove its runtime configuration")
+		}
+		if !agentUsesBuiltInRuntime(oldObject) && agentUsesBuiltInRuntime(object) {
+			return ctrladmission.Denied("an external Agent cannot be reclassified as a built-in runtime")
+		}
+	}
+	if !agentUsesBuiltInRuntime(object) {
+		return ctrladmission.Allowed("Agent derives its contract from AgentRuntime")
+	}
+	if object.Spec.Runtime.ContractVersion == nil {
+		return ctrladmission.Denied("built-in Agent runtime requires an explicit contractVersion")
+	}
+	if *object.Spec.Runtime.ContractVersion != mode.ContractVersion() {
+		return ctrladmission.Denied(fmt.Sprintf("Agent contractVersion must match namespace execution mode %q", mode))
+	}
+	if oldObject != nil {
+		if oldObject.Spec.Runtime == nil || oldObject.Spec.Runtime.ContractVersion == nil {
+			return ctrladmission.Denied("stored unclassified Agent cannot be adopted; recreate it in the mode namespace")
+		}
+		if *oldObject.Spec.Runtime.ContractVersion != *object.Spec.Runtime.ContractVersion {
+			return ctrladmission.Denied("Agent contractVersion is immutable")
+		}
+	}
+	return ctrladmission.Allowed("Agent contract matches the immutable namespace mode")
+}
+
+type AgentRuntimeContractValidator struct {
+	decoder ctrladmission.Decoder
+	reader  client.Reader
+}
+
+func (v *AgentRuntimeContractValidator) Handle(ctx context.Context, req ctrladmission.Request) ctrladmission.Response {
+	if req.SubResource == statusSubresource || (req.Operation != admissionv1.Create && req.Operation != admissionv1.Update) {
+		return ctrladmission.Allowed("not an AgentRuntime contract write")
+	}
+	object := &corev1alpha1.AgentRuntime{}
+	if err := v.decoder.Decode(req, object); err != nil {
+		return ctrladmission.Errored(http.StatusBadRequest, fmt.Errorf("decode AgentRuntime: %w", err))
+	}
+	mode, response := namespaceExecutionMode(ctx, v.reader, object.Namespace)
+	if !response.Allowed {
+		return response
+	}
+	if object.Spec.ContractVersion == nil {
+		return ctrladmission.Denied("AgentRuntime requires an explicit contractVersion")
+	}
+	if *object.Spec.ContractVersion != mode.ContractVersion() {
+		return ctrladmission.Denied(fmt.Sprintf("AgentRuntime contractVersion must match namespace execution mode %q", mode))
+	}
+	if req.Operation == admissionv1.Update {
+		oldObject := &corev1alpha1.AgentRuntime{}
+		if err := v.decoder.DecodeRaw(req.OldObject, oldObject); err != nil {
+			return ctrladmission.Errored(http.StatusBadRequest, fmt.Errorf("decode old AgentRuntime: %w", err))
+		}
+		if oldObject.Spec.ContractVersion == nil {
+			return ctrladmission.Denied("stored unclassified AgentRuntime cannot be adopted; recreate it in the mode namespace")
+		}
+		if *oldObject.Spec.ContractVersion != *object.Spec.ContractVersion {
+			return ctrladmission.Denied("AgentRuntime contractVersion is immutable")
+		}
+	}
+	return ctrladmission.Allowed("AgentRuntime contract matches the immutable namespace mode")
+}
+
+type TaskExecutionAuthorityValidator struct {
+	decoder ctrladmission.Decoder
+	reader  client.Reader
+	config  ExecutionModeConfig
+}
+
+func (v *TaskExecutionAuthorityValidator) Handle(ctx context.Context, req ctrladmission.Request) ctrladmission.Response {
+	if req.Operation != admissionv1.Create && req.Operation != admissionv1.Update {
+		return ctrladmission.Allowed("not a Task execution-authority write")
+	}
+	object := &corev1alpha1.Task{}
+	if err := v.decoder.Decode(req, object); err != nil {
+		return ctrladmission.Errored(http.StatusBadRequest, fmt.Errorf("decode Task execution authority: %w", err))
+	}
+	if req.Operation == admissionv1.Create {
+		if taskHasExecutionAuthority(object) {
+			return ctrladmission.Denied("Task creation cannot pre-populate controller-owned execution authority")
+		}
+		return ctrladmission.Allowed("Task has no controller-owned execution authority")
+	}
+	oldObject := &corev1alpha1.Task{}
+	if err := v.decoder.DecodeRaw(req.OldObject, oldObject); err != nil {
+		return ctrladmission.Errored(http.StatusBadRequest, fmt.Errorf("decode old Task execution authority: %w", err))
+	}
+	if taskHasExecutionAuthority(oldObject) && !reflect.DeepEqual(oldObject.Spec, object.Spec) {
+		return ctrladmission.Denied("Task spec is immutable after execution authority is recorded")
+	}
+	if taskHasExecutionAuthority(oldObject) && slices.Contains(oldObject.Finalizers, labels.TaskFinalizer) &&
+		!slices.Contains(object.Finalizers, labels.TaskFinalizer) {
+		if !v.config.controller(req.UserInfo.Username) || oldObject.DeletionTimestamp.IsZero() || object.DeletionTimestamp.IsZero() {
+			return ctrladmission.Denied("only an authorized controller may remove the Task cleanup finalizer while completing deletion")
+		}
+	}
+
+	oldBinding, newBinding := oldObject.Status.AgentExecutionBinding, object.Status.AgentExecutionBinding
+	if response, handled := taskStatusWriteResponse(v.config, req.UserInfo.Username, oldObject, object); handled {
+		return response
+	}
+	if oldBinding != nil || newBinding == nil {
+		return ctrladmission.Denied("Task execution binding is write-once and cannot be removed or replaced")
+	}
+	if !v.config.controller(req.UserInfo.Username) {
+		return ctrladmission.Denied("only an authorized controller identity may create an execution binding")
+	}
+	if !object.DeletionTimestamp.IsZero() {
+		return ctrladmission.Denied("a deleting Task cannot acquire an execution binding")
+	}
+	if newBinding.Task.UID != object.UID || newBinding.Task.BoundSpecGeneration != object.Generation {
+		return ctrladmission.Denied("execution binding does not match the immutable Task UID and generation")
+	}
+	mode, response := namespaceExecutionMode(ctx, v.reader, object.Namespace)
+	if !response.Allowed {
+		return response
+	}
+	namespace := &corev1.Namespace{}
+	if err := v.reader.Get(ctx, client.ObjectKey{Name: object.Namespace}, namespace); err != nil {
+		return admissionReadError("read Task namespace identity", err)
+	}
+	if newBinding.Task.NamespaceUID != namespace.UID {
+		return ctrladmission.Denied("execution binding namespace UID does not match the live namespace")
+	}
+	if newBinding.ContractVersion != mode.ContractVersion() {
+		return ctrladmission.Denied(fmt.Sprintf("execution binding contractVersion must match namespace execution mode %q", mode))
+	}
+	if !bindingBackendMatchesMode(newBinding, mode) {
+		return ctrladmission.Denied(fmt.Sprintf("execution binding backend does not belong to namespace execution mode %q", mode))
+	}
+	if newBinding.Agent != nil && newBinding.Agent.Namespace != object.Namespace {
+		return ctrladmission.Denied("execution binding Agent identity must be in the Task namespace")
+	}
+	return ctrladmission.Allowed("Task binding matches the immutable namespace mode")
+}
+
+func taskStatusWriteResponse(
+	config ExecutionModeConfig,
+	username string,
+	oldObject, object *corev1alpha1.Task,
+) (ctrladmission.Response, bool) {
+	if !reflect.DeepEqual(oldObject.Status, object.Status) && !config.controller(username) {
+		return ctrladmission.Denied("only an authorized controller identity may update Task status"), true
+	}
+	if reflect.DeepEqual(oldObject.Status.AgentExecutionBinding, object.Status.AgentExecutionBinding) {
+		return ctrladmission.Allowed("Task execution binding is unchanged"), true
+	}
+	return ctrladmission.Response{}, false
+}
+
+func namespaceExecutionMode(ctx context.Context, reader client.Reader, namespaceName string) (executionmode.Mode, ctrladmission.Response) {
+	if reader == nil {
+		return "", ctrladmission.Errored(http.StatusInternalServerError, fmt.Errorf("live admission reader is unavailable"))
+	}
+	namespace := &corev1.Namespace{}
+	if err := reader.Get(ctx, client.ObjectKey{Name: namespaceName}, namespace); err != nil {
+		return "", admissionReadError("read namespace execution mode", err)
+	}
+	mode, err := executionmode.FromNamespace(namespace)
+	if err != nil {
+		return "", ctrladmission.Denied(err.Error())
+	}
+	return mode, ctrladmission.Allowed("namespace execution mode is valid")
+}
+
+func bindingBackendMatchesMode(binding *corev1alpha1.AgentExecutionBinding, mode executionmode.Mode) bool {
+	if binding == nil {
+		return false
+	}
+	switch mode {
+	case executionmode.HarnessV1:
+		return binding.Backend == corev1alpha1.AgentExecutionBackendHarnessWrapper ||
+			binding.Backend == corev1alpha1.AgentExecutionBackendExternalEndpoint
+	case executionmode.HarnessV2:
+		return binding.Backend == corev1alpha1.AgentExecutionBackendRuntimePool ||
+			binding.Backend == corev1alpha1.AgentExecutionBackendExternalEndpoint
+	default:
+		return false
+	}
+}
+
+func agentUsesBuiltInRuntime(agent *corev1alpha1.Agent) bool {
+	return agent != nil && agent.Spec.Runtime != nil && agent.Spec.Runtime.Type != ""
+}
+
+func taskHasExecutionAuthority(task *corev1alpha1.Task) bool {
+	return task != nil && task.Status.AgentExecutionBinding != nil
+}
+
+func admissionReadError(operation string, err error) ctrladmission.Response {
+	if apierrors.IsNotFound(err) {
+		return ctrladmission.Denied(operation + ": referenced object does not exist")
+	}
+	return ctrladmission.Errored(http.StatusInternalServerError, fmt.Errorf("%s: %w", operation, err))
+}
diff --git a/internal/admission/execution_mode_test.go b/internal/admission/execution_mode_test.go
new file mode 100644
index 000000000..926d526d4
--- /dev/null
+++ b/internal/admission/execution_mode_test.go
@@ -0,0 +1,234 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package admission
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	admissionv1 "k8s.io/api/admission/v1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	ctrladmission "sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/executionmode"
+)
+
+func TestNamespaceExecutionModeValidatorOnlyAcquiresClaimOnCreate(t *testing.T) {
+	validator := newTestNamespaceExecutionModeValidator(t)
+
+	tests := []struct {
+		name        string
+		operation   admissionv1.Operation
+		oldMode     string
+		newMode     string
+		allowed     bool
+		messagePart string
+	}{
+		{
+			name:      "create claimed namespace",
+			operation: admissionv1.Create,
+			newMode:   string(executionmode.HarnessV1),
+			allowed:   true,
+		},
+		{
+			name:      "preserve absent claim",
+			operation: admissionv1.Update,
+			allowed:   true,
+		},
+		{
+			name:        "reject claim on existing namespace",
+			operation:   admissionv1.Update,
+			newMode:     string(executionmode.HarnessV2),
+			messagePart: "existing namespace cannot acquire",
+		},
+		{
+			name:      "preserve existing claim",
+			operation: admissionv1.Update,
+			oldMode:   string(executionmode.HarnessV1),
+			newMode:   string(executionmode.HarnessV1),
+			allowed:   true,
+		},
+		{
+			name:        "reject changed claim",
+			operation:   admissionv1.Update,
+			oldMode:     string(executionmode.HarnessV1),
+			newMode:     string(executionmode.HarnessV2),
+			messagePart: "claim is immutable",
+		},
+		{
+			name:        "reject removed claim",
+			operation:   admissionv1.Update,
+			oldMode:     string(executionmode.HarnessV1),
+			messagePart: "claim is immutable",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			object := admissionNamespace(tt.newMode)
+			var oldObject *corev1.Namespace
+			if tt.operation == admissionv1.Update {
+				oldObject = admissionNamespace(tt.oldMode)
+			}
+			response := validator.Handle(context.Background(), namespaceAdmissionRequest(
+				t, tt.operation, object, oldObject,
+			))
+			require.Equal(t, tt.allowed, response.Allowed, response.Result.Message)
+			if tt.messagePart != "" {
+				require.Contains(t, response.Result.Message, tt.messagePart)
+			}
+		})
+	}
+}
+
+func TestTaskExecutionAuthorityValidatorRestrictsStatusWriters(t *testing.T) {
+	validator := newTestTaskExecutionAuthorityValidator(t)
+
+	tests := []struct {
+		name   string
+		mutate func(*corev1alpha1.Task)
+	}{
+		{
+			name: "phase",
+			mutate: func(task *corev1alpha1.Task) {
+				task.Status.Phase = corev1alpha1.TaskPhaseRunning
+			},
+		},
+		{
+			name: "harness runtime",
+			mutate: func(task *corev1alpha1.Task) {
+				task.Status.HarnessRuntime = &corev1alpha1.HarnessRuntimeStatus{
+					ContractVersion: "orka.harness.v1",
+				}
+			},
+		},
+		{
+			name: "execution",
+			mutate: func(task *corev1alpha1.Task) {
+				task.Status.Execution = &corev1alpha1.TaskExecutionStatus{
+					State: corev1alpha1.TaskExecutionStateRunning,
+				}
+			},
+		},
+		{
+			name: "delivery",
+			mutate: func(task *corev1alpha1.Task) {
+				task.Status.Delivery = &corev1alpha1.TaskDeliveryStatus{
+					State: corev1alpha1.TaskDeliveryStatePreparing,
+				}
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			oldTask := newAdmissionTestTask()
+			oldTask.Status.AgentExecutionBinding = &corev1alpha1.AgentExecutionBinding{}
+			statusUpdate := oldTask.DeepCopy()
+			tt.mutate(statusUpdate)
+
+			response := validator.Handle(context.Background(), admissionRequest(
+				t, admissionv1.Update, untrustedUsername, statusUpdate, oldTask, statusSubresource,
+			))
+			require.False(t, response.Allowed)
+			require.Contains(t, response.Result.Message, "only an authorized controller identity may update Task status")
+		})
+	}
+}
+
+func TestTaskExecutionAuthorityValidatorAllowsControllerStatusUpdate(t *testing.T) {
+	validator := newTestTaskExecutionAuthorityValidator(t)
+	oldTask := newAdmissionTestTask()
+	oldTask.Status.AgentExecutionBinding = &corev1alpha1.AgentExecutionBinding{}
+	statusUpdate := oldTask.DeepCopy()
+	statusUpdate.Status.Phase = corev1alpha1.TaskPhaseRunning
+
+	response := validator.Handle(context.Background(), admissionRequest(
+		t, admissionv1.Update, trustedControllerUser, statusUpdate, oldTask, statusSubresource,
+	))
+	require.True(t, response.Allowed, response.Result.Message)
+}
+
+func TestTaskExecutionAuthorityValidatorAllowsUnchangedStatus(t *testing.T) {
+	validator := newTestTaskExecutionAuthorityValidator(t)
+	oldTask := newAdmissionTestTask()
+
+	t.Run("spec update", func(t *testing.T) {
+		specUpdate := withImage(oldTask.DeepCopy(), "alpine")
+		response := validator.Handle(context.Background(), admissionRequest(
+			t, admissionv1.Update, untrustedUsername, specUpdate, oldTask, "",
+		))
+		require.True(t, response.Allowed, response.Result.Message)
+	})
+
+	t.Run("no-op status update", func(t *testing.T) {
+		response := validator.Handle(context.Background(), admissionRequest(
+			t, admissionv1.Update, untrustedUsername, oldTask.DeepCopy(), oldTask, statusSubresource,
+		))
+		require.True(t, response.Allowed, response.Result.Message)
+	})
+}
+
+func newTestTaskExecutionAuthorityValidator(t *testing.T) *TaskExecutionAuthorityValidator {
+	t.Helper()
+	scheme := runtime.NewScheme()
+	require.NoError(t, corev1alpha1.AddToScheme(scheme))
+	return &TaskExecutionAuthorityValidator{
+		decoder: ctrladmission.NewDecoder(scheme),
+		config:  ExecutionModeConfig{ControllerUsernames: []string{trustedControllerUser}}.normalized(),
+	}
+}
+
+func newTestNamespaceExecutionModeValidator(t *testing.T) *NamespaceExecutionModeValidator {
+	t.Helper()
+	scheme := runtime.NewScheme()
+	require.NoError(t, corev1.AddToScheme(scheme))
+	return &NamespaceExecutionModeValidator{decoder: ctrladmission.NewDecoder(scheme)}
+}
+
+func admissionNamespace(mode string) *corev1.Namespace {
+	labels := map[string]string{}
+	if mode != "" {
+		labels[executionmode.NamespaceLabel] = mode
+	}
+	return &corev1.Namespace{
+		TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Namespace"},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:   "orka-test",
+			Labels: labels,
+		},
+	}
+}
+
+func namespaceAdmissionRequest(
+	t *testing.T,
+	operation admissionv1.Operation,
+	object *corev1.Namespace,
+	oldObject *corev1.Namespace,
+) ctrladmission.Request {
+	t.Helper()
+	request := ctrladmission.Request{AdmissionRequest: admissionv1.AdmissionRequest{
+		Operation: operation,
+		Object:    runtime.RawExtension{Raw: mustMarshalNamespace(t, object)},
+	}}
+	if oldObject != nil {
+		request.OldObject = runtime.RawExtension{Raw: mustMarshalNamespace(t, oldObject)}
+	}
+	return request
+}
+
+func mustMarshalNamespace(t *testing.T, namespace *corev1.Namespace) []byte {
+	t.Helper()
+	data, err := json.Marshal(namespace)
+	require.NoError(t, err)
+	return data
+}
diff --git a/internal/api/acp_artifact_authorization.go b/internal/api/acp_artifact_authorization.go
new file mode 100644
index 000000000..f10bbe1c2
--- /dev/null
+++ b/internal/api/acp_artifact_authorization.go
@@ -0,0 +1,392 @@
+package api
+
+import (
+	"context"
+	"crypto/subtle"
+	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/gofiber/fiber/v3"
+	corev1 "k8s.io/api/core/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/artifactcap"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	publisherservice "github.com/orka-agents/orka/internal/publisher/service"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+const acpArtifactAuthorizationPath = "/internal/v2/acp/artifact-authorizations"
+
+type acpArtifactAuthorizationRequest struct {
+	Namespace string                      `json:"namespace"`
+	Metadata  harnessv2.MutationMetadata  `json:"metadata"`
+	Artifact  harnessv2.ArtifactReference `json:"artifact"`
+}
+
+type acpArtifactAuthorizationResponse struct {
+	Capability    string `json:"capability"`
+	RequestDigest string `json:"requestDigest"`
+}
+
+func (s *Server) installACPArtifactAuthorizationBroker() {
+	s.app.Post(acpArtifactAuthorizationPath, s.issueACPArtifactAuthorization)
+	s.app.Post(publisherservice.ArtifactAuthorizationBrokerPath, s.issuePublisherArtifactAuthorization)
+	s.app.Post(publisherservice.CredentialBrokerPath, s.issuePublisherCredential)
+}
+
+func (s *Server) issueACPArtifactAuthorization(c fiber.Ctx) error {
+	var request acpArtifactAuthorizationRequest
+	if err := json.Unmarshal(c.Body(), &request); err != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid_request"})
+	}
+	now := time.Now().UTC()
+	if request.Namespace == "" || request.Metadata.PromptID == "" || request.Metadata.TaskUID == "" ||
+		request.Artifact.MediaType != artifactcap.MediaTypeWorkspaceDelta || request.Artifact.Validate() != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid_request"})
+	}
+	if got, err := harnessv2.CanonicalRequestDigest(request); err != nil || got != request.Metadata.RequestDigest {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid_request"})
+	}
+	pool, secret, err := s.resolveArtifactRuntimePool(c.Context(), request)
+	if err != nil {
+		return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "authorization_failed"})
+	}
+	bearer := strings.TrimSpace(strings.TrimPrefix(string(c.Request().Header.Peek("Authorization")), "Bearer "))
+	expectedBearer := strings.TrimSpace(string(secret.Data[runtimePoolControllerTokenKeyAPI]))
+	if !constantAPIStringEqual(bearer, expectedBearer) {
+		return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "authorization_failed"})
+	}
+	capabilitySecret := secret.Data[runtimePoolCapabilitySecretKeyAPI]
+	if err := harnessv2.VerifyOperationCapability(capabilitySecret, string(c.Request().Header.Peek(harnessv2.OperationCapabilityHeader)), request.Metadata, true, now); err != nil {
+		return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "authorization_failed"})
+	}
+	if pool.Status.ActiveInstance == nil || pool.Status.ActiveInstance.RuntimeInstanceID != string(request.Metadata.Fence.RuntimeInstanceID) {
+		return c.Status(fiber.StatusGone).JSON(fiber.Map{"error": "stale_runtime"})
+	}
+	task, err := findTaskByUIDWithReader(c.Context(), s.authorizationReader(), request.Namespace, string(request.Metadata.TaskUID))
+	if err != nil || task.Status.Execution == nil || task.Status.Execution.PromptID != string(request.Metadata.PromptID) ||
+		task.Status.Execution.RuntimeSessionUID != string(request.Metadata.Fence.RuntimeSessionUID) ||
+		task.Status.Execution.RuntimeInstanceID != string(request.Metadata.Fence.RuntimeInstanceID) ||
+		(task.Status.Execution.State != corev1alpha1.TaskExecutionStateRunning && task.Status.Execution.State != corev1alpha1.TaskExecutionStateSettling) {
+		return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "authorization_failed"})
+	}
+	artifactSecret, err := readACPArtifactCapabilitySecret()
+	if err != nil {
+		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "artifact_transport_unavailable"})
+	}
+	binding := artifactcap.OperationRequest{
+		Operation: artifactcap.OperationUpload, ObjectDigest: request.Artifact.Digest,
+		Identity:      artifactcap.Identity{Namespace: request.Namespace, TaskID: string(request.Metadata.TaskUID)},
+		ContentLength: request.Artifact.SizeBytes, MediaType: request.Artifact.MediaType,
+		OperationID: "runtime-delta-upload-" + string(request.Metadata.OperationID),
+	}
+	const capabilityTTL = 2 * time.Minute
+	authorization, err := artifactcap.Issue(artifactSecret, binding, now, capabilityTTL)
+	if err != nil {
+		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "artifact_transport_unavailable"})
+	}
+	if s.config.ArtifactReservations == nil {
+		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "artifact_transport_unavailable"})
+	}
+	if err := s.config.ArtifactReservations.Reserve(c.Context(), binding, now.Add(capabilityTTL+artifactcap.MaxClockSkew)); err != nil {
+		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "artifact_transport_unavailable"})
+	}
+	return c.JSON(acpArtifactAuthorizationResponse{Capability: authorization.Capability, RequestDigest: authorization.RequestDigest})
+}
+
+const (
+	runtimePoolControllerTokenKeyAPI  = "controller-token"
+	runtimePoolCapabilitySecretKeyAPI = "capability-secret"
+)
+
+func (s *Server) authorizationReader() client.Reader {
+	if s.config.APIReader != nil {
+		return s.config.APIReader
+	}
+	return s.client
+}
+
+func (s *Server) resolveArtifactRuntimePool(ctx context.Context, request acpArtifactAuthorizationRequest) (*corev1alpha1.RuntimePool, *corev1.Secret, error) {
+	reader := s.authorizationReader()
+	var pools corev1alpha1.RuntimePoolList
+	if err := reader.List(ctx, &pools, client.InNamespace(request.Namespace)); err != nil {
+		return nil, nil, err
+	}
+	var pool *corev1alpha1.RuntimePool
+	for i := range pools.Items {
+		candidate := &pools.Items[i]
+		if string(candidate.UID) == string(request.Metadata.Fence.RuntimePoolUID) {
+			pool = candidate.DeepCopy()
+			break
+		}
+	}
+	if pool == nil || pool.Status.ActiveInstance == nil {
+		return nil, nil, fmt.Errorf("runtime pool not found")
+	}
+	var secrets corev1.SecretList
+	if err := reader.List(ctx, &secrets, client.InNamespace(pool.Status.ActiveInstance.PodNamespace), client.MatchingLabels{
+		"orka.ai/runtime-pool-auth": "true", "orka.ai/runtime-pool-uid": string(pool.UID),
+	}); err != nil {
+		return nil, nil, err
+	}
+	if len(secrets.Items) != 1 {
+		return nil, nil, fmt.Errorf("runtime pool auth secret is ambiguous")
+	}
+	return pool, secrets.Items[0].DeepCopy(), nil
+}
+
+func (s *Server) findTaskByUID(ctx context.Context, namespace, uid string) (*corev1alpha1.Task, error) {
+	return findTaskByUIDWithReader(ctx, s.authorizationReader(), namespace, uid)
+}
+
+func findTaskByUIDWithReader(ctx context.Context, reader client.Reader, namespace, uid string) (*corev1alpha1.Task, error) {
+	var tasks corev1alpha1.TaskList
+	if err := reader.List(ctx, &tasks, client.InNamespace(namespace)); err != nil {
+		return nil, err
+	}
+	for i := range tasks.Items {
+		if string(tasks.Items[i].UID) == uid {
+			return tasks.Items[i].DeepCopy(), nil
+		}
+	}
+	return nil, fmt.Errorf("task not found")
+}
+
+func readACPArtifactCapabilitySecret() ([]byte, error) {
+	path := strings.TrimSpace(os.Getenv(envACPArtifactSecretFile))
+	if path == "" {
+		return nil, fmt.Errorf("artifact capability secret is not configured")
+	}
+	return readACPArtifactCapabilitySecretFile(path)
+}
+
+func readACPArtifactCapabilitySecretFile(path string) ([]byte, error) {
+	value, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("artifact capability secret is unavailable")
+	}
+	value = []byte(strings.TrimSpace(string(value)))
+	if len(value) < artifactcap.MinSecretBytes {
+		return nil, fmt.Errorf("artifact capability secret is unavailable")
+	}
+	return value, nil
+}
+
+func constantAPIStringEqual(left, right string) bool {
+	if len(left) != len(right) || left == "" {
+		return false
+	}
+	return subtle.ConstantTimeCompare([]byte(left), []byte(right)) == 1
+}
+
+const envWorkspacePublisherControllerTokenFile = "ORKA_WORKSPACE_PUBLISHER_CONTROLLER_TOKEN_FILE"
+
+func (s *Server) issuePublisherArtifactAuthorization(c fiber.Ctx) error {
+	var request publisherservice.ArtifactAuthorizationRequest
+	decoder := json.NewDecoder(strings.NewReader(string(c.Body())))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&request); err != nil || decoder.Decode(&struct{}{}) == nil || request.Validate() != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid_request"})
+	}
+	expectedBearer, err := readSecretAtEnvPath(envWorkspacePublisherControllerTokenFile, 16)
+	if err != nil {
+		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "artifact_authorization_unavailable"})
+	}
+	bearer := strings.TrimSpace(strings.TrimPrefix(string(c.Request().Header.Peek("Authorization")), "Bearer "))
+	if !constantAPIStringEqual(bearer, string(expectedBearer)) {
+		return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "authorization_failed"})
+	}
+	if err := s.authorizePublisherArtifactRequest(c.Context(), request); err != nil {
+		return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "authorization_failed"})
+	}
+	if err := s.authorizePublisherParentEffect(c.Context(), request.ParentOperation, request.Metadata); err != nil {
+		return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "authorization_failed"})
+	}
+	artifactSecret, err := readACPArtifactCapabilitySecret()
+	if err != nil {
+		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "artifact_transport_unavailable"})
+	}
+	binding, err := publisherservice.ArtifactBinding(request)
+	if err != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid_request"})
+	}
+	now := time.Now().UTC()
+	const capabilityTTL = 2 * time.Minute
+	authorization, err := artifactcap.Issue(artifactSecret, binding, now, capabilityTTL)
+	if err != nil {
+		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "artifact_transport_unavailable"})
+	}
+	if s.config.ArtifactReservations == nil {
+		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "artifact_transport_unavailable"})
+	}
+	if err := s.config.ArtifactReservations.Reserve(c.Context(), binding, now.Add(capabilityTTL+artifactcap.MaxClockSkew)); err != nil {
+		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "artifact_transport_unavailable"})
+	}
+	return c.JSON(publisherservice.ArtifactAuthorizationResponse{
+		Capability: authorization.Capability, RequestDigest: authorization.RequestDigest,
+	})
+}
+
+func (s *Server) authorizePublisherArtifactRequest(ctx context.Context, request publisherservice.ArtifactAuthorizationRequest) error {
+	switch request.ParentOperation {
+	case publisherservice.OperationWorkspacePrepare:
+		return s.authorizePublisherWorkspaceUpload(ctx, request)
+	case publisherservice.OperationPublicationPrepare:
+		if request.ArtifactOperation == artifactcap.OperationUpload {
+			return s.authorizePublisherBundleUpload(ctx, request)
+		}
+		return s.authorizePublisherDeltaDownload(ctx, request)
+	case publisherservice.OperationPublicationPublish, publisherservice.OperationPublicationVerify:
+		return s.authorizePublisherBundleDownload(ctx, request)
+	default:
+		return fmt.Errorf("unsupported publisher artifact operation")
+	}
+}
+
+func (s *Server) authorizePublisherWorkspaceUpload(ctx context.Context, request publisherservice.ArtifactAuthorizationRequest) error {
+	if request.ArtifactOperation != artifactcap.OperationUpload || request.Metadata.TaskID == "" || request.Metadata.PublicationID != "" {
+		return fmt.Errorf("workspace artifact identity is invalid")
+	}
+	task, err := s.findTaskByUID(ctx, request.Metadata.Namespace, request.Metadata.TaskID)
+	if err != nil || task.Status.Execution == nil {
+		return fmt.Errorf("workspace Task is unavailable")
+	}
+	execution := task.Status.Execution
+	if execution.State != corev1alpha1.TaskExecutionStatePlanned || execution.PromptID == "" ||
+		request.Metadata.OperationID != "workspace-prepare-"+execution.PromptID {
+		return fmt.Errorf("workspace Task is not in the exact preparation state")
+	}
+	return nil
+}
+
+func (s *Server) authorizePublisherDeltaDownload(ctx context.Context, request publisherservice.ArtifactAuthorizationRequest) error {
+	if request.ArtifactOperation != artifactcap.OperationDownload || request.Metadata.PublicationID == "" || request.Metadata.TaskID != "" {
+		return fmt.Errorf("publication artifact identity is invalid")
+	}
+	publication, err := s.findPublicationByID(ctx, request.Metadata.Namespace, request.Metadata.PublicationID)
+	if err != nil || string(publication.Status.State) != string(store.PublicationPreparing) {
+		return fmt.Errorf("publication is not preparing")
+	}
+	if publication.Spec.ArtifactID != string(request.Artifact.ArtifactID) ||
+		publication.Spec.ArtifactDigest != request.Artifact.Digest ||
+		publication.Spec.ArtifactSizeBytes != request.Artifact.SizeBytes ||
+		publication.Spec.ArtifactMediaType != request.Artifact.MediaType {
+		return fmt.Errorf("publication artifact identity drifted")
+	}
+	return nil
+}
+
+func (s *Server) authorizePublisherBundleUpload(ctx context.Context, request publisherservice.ArtifactAuthorizationRequest) error {
+	if request.ArtifactOperation != artifactcap.OperationUpload || request.Artifact.MediaType != artifactcap.MediaTypeGitBundle ||
+		request.Metadata.PublicationID == "" || request.Metadata.TaskID != "" {
+		return fmt.Errorf("prepared bundle upload identity is invalid")
+	}
+	publication, err := s.findPublicationByID(ctx, request.Metadata.Namespace, request.Metadata.PublicationID)
+	if err != nil || string(publication.Status.State) != string(store.PublicationPreparing) || publication.Status.PreparedReceipt != nil {
+		return fmt.Errorf("publication is not accepting a prepared bundle")
+	}
+	return nil
+}
+
+func (s *Server) authorizePublisherBundleDownload(ctx context.Context, request publisherservice.ArtifactAuthorizationRequest) error {
+	if request.ArtifactOperation != artifactcap.OperationDownload || request.Artifact.MediaType != artifactcap.MediaTypeGitBundle ||
+		request.Metadata.PublicationID == "" || request.Metadata.TaskID != "" {
+		return fmt.Errorf("prepared bundle download identity is invalid")
+	}
+	publication, err := s.findPublicationByID(ctx, request.Metadata.Namespace, request.Metadata.PublicationID)
+	if err != nil || publication.Status.PreparedReceipt == nil {
+		return fmt.Errorf("publication prepared receipt is unavailable")
+	}
+	expectedState := store.PublicationPublishing
+	if request.ParentOperation == publisherservice.OperationPublicationVerify {
+		expectedState = store.PublicationVerifying
+	}
+	receipt := publication.Status.PreparedReceipt
+	if string(publication.Status.State) != string(expectedState) || receipt.BundleArtifactID != string(request.Artifact.ArtifactID) ||
+		receipt.BundleDigest != request.Artifact.Digest || receipt.BundleSizeBytes != request.Artifact.SizeBytes ||
+		receipt.BundleMediaType != request.Artifact.MediaType {
+		return fmt.Errorf("publication prepared bundle identity drifted")
+	}
+	return nil
+}
+
+func (s *Server) findPublicationByID(ctx context.Context, namespace, id string) (*corev1alpha1.Publication, error) {
+	var publications corev1alpha1.PublicationList
+	if err := s.authorizationReader().List(ctx, &publications, client.InNamespace(namespace)); err != nil {
+		return nil, err
+	}
+	for i := range publications.Items {
+		if publications.Items[i].Spec.ID == id {
+			return publications.Items[i].DeepCopy(), nil
+		}
+	}
+	return nil, fmt.Errorf("publication not found")
+}
+
+func readSecretAtEnvPath(name string, minimum int) ([]byte, error) {
+	path := strings.TrimSpace(os.Getenv(name))
+	if path == "" {
+		return nil, fmt.Errorf("%s is not configured", name)
+	}
+	value, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+	value = []byte(strings.TrimSpace(string(value)))
+	if len(value) < minimum {
+		return nil, fmt.Errorf("%s is unavailable", name)
+	}
+	return value, nil
+}
+
+func (s *Server) authorizePublisherParentEffect(
+	ctx context.Context,
+	operation publisherservice.Operation,
+	metadata publisherservice.OperationMetadata,
+) error {
+	kind := ""
+	aggregateID := metadata.PublicationID
+	switch operation {
+	case publisherservice.OperationWorkspaceResolve:
+		kind, aggregateID = "workspace.resolve", metadata.TaskID
+	case publisherservice.OperationWorkspacePrepare:
+		kind, aggregateID = "workspace.prepare", metadata.TaskID
+	case publisherservice.OperationPublicationPreflight:
+		kind = "publisher.preflight"
+	case publisherservice.OperationPublicationPrepare:
+		kind = "publisher.prepare"
+	case publisherservice.OperationPublicationPublish:
+		kind = "publisher.publish"
+	case publisherservice.OperationPublicationVerify:
+		kind = "publisher.verify"
+	case publisherservice.OperationPullRequestReconcile:
+		kind = "publisher.pull-request"
+	default:
+		return fmt.Errorf("unsupported Publisher parent operation")
+	}
+	if aggregateID == "" || metadata.OperationID == "" {
+		return fmt.Errorf("publisher parent effect identity is incomplete")
+	}
+	var effects corev1alpha1.ExternalEffectList
+	if err := s.authorizationReader().List(ctx, &effects, client.InNamespace(metadata.Namespace)); err != nil {
+		return err
+	}
+	matches := 0
+	for i := range effects.Items {
+		effect := &effects.Items[i]
+		if effect.Spec.Kind == kind && effect.Spec.IdentityNamespace == metadata.Namespace &&
+			effect.Spec.AggregateID == aggregateID && effect.Spec.OperationID == metadata.OperationID &&
+			effect.Status.State == corev1alpha1.ExternalEffectControlState(store.ExternalEffectInFlight) {
+			matches++
+		}
+	}
+	if matches != 1 {
+		return fmt.Errorf("publisher parent effect is not uniquely in flight")
+	}
+	return nil
+}
diff --git a/internal/api/acp_artifact_authorization_test.go b/internal/api/acp_artifact_authorization_test.go
new file mode 100644
index 000000000..537414760
--- /dev/null
+++ b/internal/api/acp_artifact_authorization_test.go
@@ -0,0 +1,636 @@
+package api
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gofiber/fiber/v3"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	types "k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/artifactcap"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	publisherservice "github.com/orka-agents/orka/internal/publisher/service"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+func TestACPArtifactAuthorizationBrokerIssuesExactUploadCapability(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	poolUID := types.UID("pool-uid")
+	pool := &corev1alpha1.RuntimePool{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "pool", UID: poolUID, Generation: 1},
+		Status:     corev1alpha1.RuntimePoolStatus{ActiveInstance: &corev1alpha1.RuntimePoolActiveInstanceStatus{PodNamespace: "orka-runtimes", RuntimeInstanceID: "runtime-1"}},
+	}
+	controllerToken := strings.Repeat("t", 32)
+	operationSecret := []byte(strings.Repeat("s", 32))
+	secret := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Namespace: "orka-runtimes", Name: "auth", Labels: map[string]string{"orka.ai/runtime-pool-auth": "true", "orka.ai/runtime-pool-uid": string(poolUID)}}, Data: map[string][]byte{runtimePoolControllerTokenKeyAPI: []byte(controllerToken), runtimePoolCapabilitySecretKeyAPI: operationSecret}}
+	taskUID := types.UID("task-uid")
+	task := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "task", UID: taskUID}, Status: corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{State: corev1alpha1.TaskExecutionStateSettling, PromptID: "prompt-1", RuntimeSessionUID: "session-1", RuntimeInstanceID: "runtime-1"}}}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(pool, secret, task).Build()
+	artifactSecret := []byte(strings.Repeat("a", 32))
+	secretFile := filepath.Join(t.TempDir(), "artifact-secret")
+	if err := os.WriteFile(secretFile, artifactSecret, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv(envACPArtifactSecretFile, secretFile)
+
+	artifactData := []byte("delta")
+	digest := artifactcap.DigestBytes(artifactData)
+	artifactID, _ := artifactcap.ArtifactIDForDigest(digest)
+	metadata := harnessv2.MutationMetadata{
+		Fence:   harnessv2.Fence{RuntimeInstanceID: "runtime-1", SupervisorBootID: "boot", ControllerEpoch: 1, RuntimePoolUID: harnessv2.RuntimePoolUID(poolUID), RuntimePoolGeneration: 1, RuntimeSessionUID: "session-1", RuntimeSessionGeneration: 1, RuntimeProfileDigest: harnessv2.ProfileDigest("sha256:" + strings.Repeat("b", 64)), ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion},
+		TaskUID: harnessv2.TaskUID(taskUID), TaskAttempt: 1, PromptID: "prompt-1", OperationID: "authorize-delta-1", RequestDigestSchemaVersion: 1, ExpiresAt: time.Now().UTC().Add(time.Minute),
+	}
+	request := acpArtifactAuthorizationRequest{Namespace: "default", Metadata: metadata, Artifact: harnessv2.ArtifactReference{ArtifactID: harnessv2.ArtifactID(artifactID), Digest: digest, SizeBytes: int64(len(artifactData)), MediaType: artifactcap.MediaTypeWorkspaceDelta}}
+	requestDigest, err := harnessv2.CanonicalRequestDigest(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request.Metadata.RequestDigest = requestDigest
+	capability, err := harnessv2.SignOperationCapability(operationSecret, harnessv2.ClaimsForMutation(request.Metadata))
+	if err != nil {
+		t.Fatal(err)
+	}
+	body, _ := json.Marshal(request)
+	app := fiber.New()
+	reservations := &recordingCapabilityReservations{}
+	server := &Server{app: app, client: kubeClient, config: ServerConfig{ArtifactReservations: reservations}}
+	server.installACPArtifactAuthorizationBroker()
+	httpRequest := httptest.NewRequest(http.MethodPost, acpArtifactAuthorizationPath, bytes.NewReader(body))
+	httpRequest.Header.Set("Content-Type", "application/json")
+	httpRequest.Header.Set("Authorization", "Bearer "+controllerToken)
+	httpRequest.Header.Set(harnessv2.OperationCapabilityHeader, capability)
+	reservationStart := time.Now().UTC()
+	response, err := app.Test(httpRequest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if response.StatusCode != http.StatusOK {
+		t.Fatalf("status=%d", response.StatusCode)
+	}
+	var issued acpArtifactAuthorizationResponse
+	if err := json.NewDecoder(response.Body).Decode(&issued); err != nil {
+		t.Fatal(err)
+	}
+	presented := artifactcap.PresentedRequest{Method: http.MethodPut, Path: mustArtifactPath(t, digest), ObjectDigest: digest, ContentLength: int64(len(artifactData)), MediaType: artifactcap.MediaTypeWorkspaceDelta, RequestDigest: issued.RequestDigest}
+	if _, err := artifactcap.Verify(artifactSecret, issued.Capability, presented, time.Now().UTC()); err != nil {
+		t.Fatal(err)
+	}
+	if len(reservations.requests) != 1 || reservations.requests[0] != (artifactcap.OperationRequest{
+		Operation: artifactcap.OperationUpload, ObjectDigest: digest,
+		Identity:      artifactcap.Identity{Namespace: "default", TaskID: string(taskUID)},
+		ContentLength: int64(len(artifactData)), MediaType: artifactcap.MediaTypeWorkspaceDelta,
+		OperationID: "runtime-delta-upload-authorize-delta-1",
+	}) {
+		t.Fatalf("capability reservations = %#v, want exact upload binding", reservations.requests)
+	}
+	minimumExpiry := reservationStart.Add(2*time.Minute + artifactcap.MaxClockSkew)
+	if reservations.expiresAt[0].Before(minimumExpiry) {
+		t.Fatalf("capability reservation expiry = %s, want at least %s", reservations.expiresAt[0], minimumExpiry)
+	}
+}
+
+type recordingCapabilityReservations struct {
+	requests  []artifactcap.OperationRequest
+	expiresAt []time.Time
+	err       error
+}
+
+func (r *recordingCapabilityReservations) Reserve(_ context.Context, request artifactcap.OperationRequest, expiresAt time.Time) error {
+	if r.err != nil {
+		return r.err
+	}
+	r.requests = append(r.requests, request)
+	r.expiresAt = append(r.expiresAt, expiresAt)
+	return nil
+}
+
+func TestACPArtifactAuthorizationBrokerRejectsStaleCachedRevocationState(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+
+	poolUID := types.UID("pool-uid")
+	pool := &corev1alpha1.RuntimePool{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "pool", UID: poolUID, Generation: 1},
+		Status: corev1alpha1.RuntimePoolStatus{ActiveInstance: &corev1alpha1.RuntimePoolActiveInstanceStatus{
+			PodNamespace: "orka-runtimes", RuntimeInstanceID: "runtime-1",
+		}},
+	}
+	controllerToken := strings.Repeat("t", 32)
+	operationSecret := []byte(strings.Repeat("s", 32))
+	authSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "orka-runtimes", Name: "auth", UID: "old-secret-uid",
+			Labels: map[string]string{"orka.ai/runtime-pool-auth": "true", "orka.ai/runtime-pool-uid": string(poolUID)},
+		},
+		Data: map[string][]byte{
+			runtimePoolControllerTokenKeyAPI:  []byte(controllerToken),
+			runtimePoolCapabilitySecretKeyAPI: operationSecret,
+		},
+	}
+	taskUID := types.UID("task-uid")
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "task", UID: taskUID},
+		Status: corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateSettling, PromptID: "prompt-1",
+			RuntimeSessionUID: "session-1", RuntimeInstanceID: "runtime-1",
+		}},
+	}
+	cachedClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(pool, authSecret, task).Build()
+
+	artifactSecret := []byte(strings.Repeat("a", 32))
+	writeAPISecretFile(t, envACPArtifactSecretFile, "artifact", artifactSecret)
+	artifactData := []byte("delta")
+	digest := artifactcap.DigestBytes(artifactData)
+	artifactID, err := artifactcap.ArtifactIDForDigest(digest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	metadata := harnessv2.MutationMetadata{
+		Fence: harnessv2.Fence{
+			RuntimeInstanceID: "runtime-1", SupervisorBootID: "boot", ControllerEpoch: 1,
+			RuntimePoolUID: harnessv2.RuntimePoolUID(poolUID), RuntimePoolGeneration: 1,
+			RuntimeSessionUID: "session-1", RuntimeSessionGeneration: 1,
+			RuntimeProfileDigest: harnessv2.ProfileDigest("sha256:" + strings.Repeat("b", 64)), ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+		},
+		TaskUID: harnessv2.TaskUID(taskUID), TaskAttempt: 1, PromptID: "prompt-1", OperationID: "authorize-delta-1",
+		RequestDigestSchemaVersion: 1, ExpiresAt: time.Now().UTC().Add(time.Minute),
+	}
+	request := acpArtifactAuthorizationRequest{
+		Namespace: "default", Metadata: metadata,
+		Artifact: harnessv2.ArtifactReference{
+			ArtifactID: harnessv2.ArtifactID(artifactID), Digest: digest,
+			SizeBytes: int64(len(artifactData)), MediaType: artifactcap.MediaTypeWorkspaceDelta,
+		},
+	}
+	requestDigest, err := harnessv2.CanonicalRequestDigest(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request.Metadata.RequestDigest = requestDigest
+	capability, err := harnessv2.SignOperationCapability(operationSecret, harnessv2.ClaimsForMutation(request.Metadata))
+	if err != nil {
+		t.Fatal(err)
+	}
+	body, err := json.Marshal(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	tests := []struct {
+		name           string
+		currentObjects func() []client.Object
+	}{
+		{
+			name: "runtime pool replacement",
+			currentObjects: func() []client.Object {
+				replacementPool := pool.DeepCopy()
+				replacementPool.UID = "replacement-pool-uid"
+				replacementSecret := authSecret.DeepCopy()
+				replacementSecret.UID = "replacement-secret-uid"
+				replacementSecret.Labels["orka.ai/runtime-pool-uid"] = string(replacementPool.UID)
+				return []client.Object{replacementPool, replacementSecret, task.DeepCopy()}
+			},
+		},
+		{
+			name: "runtime pool auth Secret replacement",
+			currentObjects: func() []client.Object {
+				replacementSecret := authSecret.DeepCopy()
+				replacementSecret.UID = "replacement-secret-uid"
+				replacementSecret.Data = map[string][]byte{
+					runtimePoolControllerTokenKeyAPI:  []byte(strings.Repeat("r", 32)),
+					runtimePoolCapabilitySecretKeyAPI: []byte(strings.Repeat("n", 32)),
+				}
+				return []client.Object{pool.DeepCopy(), replacementSecret, task.DeepCopy()}
+			},
+		},
+		{
+			name: "Task cancellation",
+			currentObjects: func() []client.Object {
+				cancelledTask := task.DeepCopy()
+				cancelledTask.Status.Execution.State = corev1alpha1.TaskExecutionStateCancelled
+				return []client.Object{pool.DeepCopy(), authSecret.DeepCopy(), cancelledTask}
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			apiReader := fake.NewClientBuilder().WithScheme(scheme).WithObjects(test.currentObjects()...).Build()
+			app := fiber.New()
+			server := &Server{app: app, client: cachedClient, config: ServerConfig{APIReader: apiReader}}
+			server.installACPArtifactAuthorizationBroker()
+			httpRequest := httptest.NewRequest(http.MethodPost, acpArtifactAuthorizationPath, bytes.NewReader(body))
+			httpRequest.Header.Set("Content-Type", "application/json")
+			httpRequest.Header.Set("Authorization", "Bearer "+controllerToken)
+			httpRequest.Header.Set(harnessv2.OperationCapabilityHeader, capability)
+			response, err := app.Test(httpRequest)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if response.StatusCode != http.StatusForbidden {
+				t.Fatalf("status=%d, want %d", response.StatusCode, http.StatusForbidden)
+			}
+		})
+	}
+}
+
+func mustArtifactPath(t *testing.T, digest string) string {
+	t.Helper()
+	value, err := artifactcap.ObjectPath(digest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return value
+}
+
+func TestPublisherArtifactAuthorizationBrokerBindsTaskAndPublicationState(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	taskUID := types.UID("publisher-task-uid")
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "publisher-task", UID: taskUID},
+		Status: corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStatePlanned, PromptID: "prompt-publisher",
+		}},
+	}
+	delta := []byte("publisher delta")
+	deltaDigest := artifactcap.DigestBytes(delta)
+	deltaID, err := artifactcap.ArtifactIDForDigest(deltaDigest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	bundle := []byte("prepared git bundle")
+	bundleDigest := artifactcap.DigestBytes(bundle)
+	bundleID, err := artifactcap.ArtifactIDForDigest(bundleDigest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	publication := &corev1alpha1.Publication{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "publication-control"},
+		Spec: corev1alpha1.PublicationSpec{
+			ID: "publication-id", Generation: 1, TaskUID: string(taskUID), Attempt: 1, PromptID: "prompt-publisher",
+			BranchClaimID: "branch-claim", BranchClaimGeneration: 1, SourceRepositoryID: "github.com/o/r",
+			SourceRef: "refs/heads/main", SourceBaselineSHA: strings.Repeat("1", 40), TargetRepositoryID: "github.com/o/r",
+			TargetRef: "refs/heads/change", ArtifactID: deltaID, ArtifactDigest: deltaDigest,
+			ArtifactSizeBytes: int64(len(delta)), ArtifactMediaType: artifactcap.MediaTypeWorkspaceDelta,
+			PublicationCredentialRef: "credential", CommitIdentity: "task", CommitMessage: "change",
+			CommitTimestamp: metav1.NewTime(time.Now().UTC()), RequestDigest: "sha256:" + strings.Repeat("2", 64),
+		},
+		Status: corev1alpha1.PublicationStatus{State: corev1alpha1.PublicationControlState(store.PublicationPreparing)},
+	}
+	readyPublication := publication.DeepCopy()
+	readyPublication.Name = "publication-ready"
+	readyPublication.Spec.ID = "publication-ready-id"
+	readyPublication.Status = corev1alpha1.PublicationStatus{
+		State: corev1alpha1.PublicationControlState(store.PublicationVerifying),
+		PreparedReceipt: &corev1alpha1.PreparedPublicationControlReceipt{
+			OperationID: "prepare-ready", RequestDigest: "sha256:" + strings.Repeat("3", 64),
+			TreeSHA: strings.Repeat("4", 40), CommitSHA: strings.Repeat("5", 40), ManifestDigest: "sha256:" + strings.Repeat("6", 64),
+			BundleArtifactID: bundleID, BundleDigest: bundleDigest, BundleSizeBytes: int64(len(bundle)),
+			BundleMediaType: artifactcap.MediaTypeGitBundle, BundleRef: "refs/orka/publications/" + strings.Repeat("7", 64),
+			PreparedAt: metav1.NewTime(time.Now().UTC()),
+		},
+	}
+	effects := []client.Object{
+		publisherEffectForTest("workspace-effect", "workspace.prepare", string(taskUID), "workspace-prepare-prompt-publisher"),
+		publisherEffectForTest("prepare-effect", "publisher.prepare", publication.Spec.ID, "prepare-operation"),
+		publisherEffectForTest("verify-effect", "publisher.verify", readyPublication.Spec.ID, "verify-operation"),
+	}
+	objects := []client.Object{task, publication, readyPublication}
+	objects = append(objects, effects...)
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(objects...).Build()
+	artifactSecret := []byte(strings.Repeat("a", 32))
+	publisherToken := strings.Repeat("p", 32)
+	writeAPISecretFile(t, envACPArtifactSecretFile, "artifact", artifactSecret)
+	writeAPISecretFile(t, envWorkspacePublisherControllerTokenFile, "publisher", []byte(publisherToken))
+
+	workspace := []byte("workspace tar")
+	workspaceDigest := artifactcap.DigestBytes(workspace)
+	workspaceID, err := artifactcap.ArtifactIDForDigest(workspaceDigest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	tests := []struct {
+		name    string
+		request publisherservice.ArtifactAuthorizationRequest
+	}{
+		{
+			name: "workspace upload",
+			request: publisherservice.ArtifactAuthorizationRequest{
+				ParentOperation:   publisherservice.OperationWorkspacePrepare,
+				Metadata:          publisherservice.OperationMetadata{Namespace: "default", TaskID: string(taskUID), OperationID: "workspace-prepare-prompt-publisher"},
+				ArtifactOperation: artifactcap.OperationUpload,
+				Artifact:          harnessv2.ArtifactReference{ArtifactID: harnessv2.ArtifactID(workspaceID), Digest: workspaceDigest, SizeBytes: int64(len(workspace)), MediaType: artifactcap.MediaTypeWorkspaceTar},
+				Attempt:           1,
+			},
+		},
+		{
+			name: "publication delta download",
+			request: publisherservice.ArtifactAuthorizationRequest{
+				ParentOperation:   publisherservice.OperationPublicationPrepare,
+				Metadata:          publisherservice.OperationMetadata{Namespace: "default", PublicationID: publication.Spec.ID, OperationID: "prepare-operation"},
+				ArtifactOperation: artifactcap.OperationDownload,
+				Artifact:          harnessv2.ArtifactReference{ArtifactID: harnessv2.ArtifactID(deltaID), Digest: deltaDigest, SizeBytes: int64(len(delta)), MediaType: artifactcap.MediaTypeWorkspaceDelta},
+				Attempt:           1,
+			},
+		},
+		{
+			name: "prepared bundle upload",
+			request: publisherservice.ArtifactAuthorizationRequest{
+				ParentOperation:   publisherservice.OperationPublicationPrepare,
+				Metadata:          publisherservice.OperationMetadata{Namespace: "default", PublicationID: publication.Spec.ID, OperationID: "prepare-operation"},
+				ArtifactOperation: artifactcap.OperationUpload,
+				Artifact:          harnessv2.ArtifactReference{ArtifactID: harnessv2.ArtifactID(bundleID), Digest: bundleDigest, SizeBytes: int64(len(bundle)), MediaType: artifactcap.MediaTypeGitBundle},
+				Attempt:           1,
+			},
+		},
+		{
+			name: "prepared bundle verification download",
+			request: publisherservice.ArtifactAuthorizationRequest{
+				ParentOperation:   publisherservice.OperationPublicationVerify,
+				Metadata:          publisherservice.OperationMetadata{Namespace: "default", PublicationID: readyPublication.Spec.ID, OperationID: "verify-operation"},
+				ArtifactOperation: artifactcap.OperationDownload,
+				Artifact:          harnessv2.ArtifactReference{ArtifactID: harnessv2.ArtifactID(bundleID), Digest: bundleDigest, SizeBytes: int64(len(bundle)), MediaType: artifactcap.MediaTypeGitBundle},
+				Attempt:           1,
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			app := fiber.New()
+			server := &Server{app: app, client: kubeClient, config: ServerConfig{ArtifactReservations: &recordingCapabilityReservations{}}}
+			server.installACPArtifactAuthorizationBroker()
+			body, err := json.Marshal(test.request)
+			if err != nil {
+				t.Fatal(err)
+			}
+			httpRequest := httptest.NewRequest(http.MethodPost, publisherservice.ArtifactAuthorizationBrokerPath, bytes.NewReader(body))
+			httpRequest.Header.Set("Content-Type", "application/json")
+			httpRequest.Header.Set("Authorization", "Bearer "+publisherToken)
+			response, err := app.Test(httpRequest)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if response.StatusCode != http.StatusOK {
+				t.Fatalf("status=%d", response.StatusCode)
+			}
+			var issued publisherservice.ArtifactAuthorizationResponse
+			if err := json.NewDecoder(response.Body).Decode(&issued); err != nil {
+				t.Fatal(err)
+			}
+			binding, err := publisherservice.ArtifactBinding(test.request)
+			if err != nil {
+				t.Fatal(err)
+			}
+			path, err := artifactcap.ObjectPath(binding.ObjectDigest)
+			if err != nil {
+				t.Fatal(err)
+			}
+			presented := artifactcap.PresentedRequest{
+				Method: binding.Method(), Path: path, ObjectDigest: binding.ObjectDigest,
+				ContentLength: binding.ContentLength, MediaType: binding.MediaType, RequestDigest: issued.RequestDigest,
+			}
+			if _, err := artifactcap.Verify(artifactSecret, issued.Capability, presented, time.Now().UTC()); err != nil {
+				t.Fatal(err)
+			}
+		})
+	}
+}
+
+func TestPublisherArtifactAuthorizationBrokerUsesFreshTaskState(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	taskUID := types.UID("fresh-publisher-task-uid")
+	freshTask := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "publisher-task", UID: taskUID},
+		Status: corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStatePlanned, PromptID: "fresh-prompt",
+		}},
+	}
+	staleTask := freshTask.DeepCopy()
+	staleTask.Status.Execution.State = corev1alpha1.TaskExecutionStateRunning
+
+	workspace := []byte("fresh workspace tar")
+	workspaceDigest := artifactcap.DigestBytes(workspace)
+	workspaceID, err := artifactcap.ArtifactIDForDigest(workspaceDigest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := publisherservice.ArtifactAuthorizationRequest{
+		ParentOperation: publisherservice.OperationWorkspacePrepare,
+		Metadata: publisherservice.OperationMetadata{
+			Namespace: "default", TaskID: string(taskUID), OperationID: "workspace-prepare-fresh-prompt",
+		},
+		ArtifactOperation: artifactcap.OperationUpload,
+		Artifact: harnessv2.ArtifactReference{
+			ArtifactID: harnessv2.ArtifactID(workspaceID), Digest: workspaceDigest,
+			SizeBytes: int64(len(workspace)), MediaType: artifactcap.MediaTypeWorkspaceTar,
+		},
+		Attempt: 1,
+	}
+	effect := publisherEffectForTest(
+		"fresh-workspace-effect", "workspace.prepare", string(taskUID), request.Metadata.OperationID,
+	)
+	cachedClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(staleTask, effect.DeepCopy()).Build()
+	apiReader := fake.NewClientBuilder().WithScheme(scheme).WithObjects(freshTask, effect).Build()
+
+	artifactSecret := []byte(strings.Repeat("a", 32))
+	publisherToken := strings.Repeat("p", 32)
+	writeAPISecretFile(t, envACPArtifactSecretFile, "artifact", artifactSecret)
+	writeAPISecretFile(t, envWorkspacePublisherControllerTokenFile, "publisher", []byte(publisherToken))
+
+	app := fiber.New()
+	server := &Server{
+		app: app, client: cachedClient,
+		config: ServerConfig{APIReader: apiReader, ArtifactReservations: &recordingCapabilityReservations{}},
+	}
+	server.installACPArtifactAuthorizationBroker()
+	body, err := json.Marshal(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	httpRequest := httptest.NewRequest(http.MethodPost, publisherservice.ArtifactAuthorizationBrokerPath, bytes.NewReader(body))
+	httpRequest.Header.Set("Content-Type", "application/json")
+	httpRequest.Header.Set("Authorization", "Bearer "+publisherToken)
+	response, err := app.Test(httpRequest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if response.StatusCode != http.StatusOK {
+		t.Fatalf("status=%d, want %d", response.StatusCode, http.StatusOK)
+	}
+}
+
+func TestPublisherArtifactAuthorizationBrokerUsesFreshPublicationState(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+
+	delta := []byte("fresh publication delta")
+	deltaDigest := artifactcap.DigestBytes(delta)
+	deltaID, err := artifactcap.ArtifactIDForDigest(deltaDigest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	freshPublication := &corev1alpha1.Publication{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "fresh-publication"},
+		Spec: corev1alpha1.PublicationSpec{
+			ID: "fresh-publication-id", ArtifactID: deltaID, ArtifactDigest: deltaDigest,
+			ArtifactSizeBytes: int64(len(delta)), ArtifactMediaType: artifactcap.MediaTypeWorkspaceDelta,
+		},
+		Status: corev1alpha1.PublicationStatus{State: corev1alpha1.PublicationControlState(store.PublicationPreparing)},
+	}
+	stalePublication := freshPublication.DeepCopy()
+	stalePublication.Status.State = corev1alpha1.PublicationControlState(store.PublicationPublishing)
+	request := publisherservice.ArtifactAuthorizationRequest{
+		ParentOperation: publisherservice.OperationPublicationPrepare,
+		Metadata: publisherservice.OperationMetadata{
+			Namespace: "default", PublicationID: freshPublication.Spec.ID, OperationID: "prepare-fresh-publication",
+		},
+		ArtifactOperation: artifactcap.OperationDownload,
+		Artifact: harnessv2.ArtifactReference{
+			ArtifactID: harnessv2.ArtifactID(deltaID), Digest: deltaDigest,
+			SizeBytes: int64(len(delta)), MediaType: artifactcap.MediaTypeWorkspaceDelta,
+		},
+		Attempt: 1,
+	}
+	effect := publisherEffectForTest(
+		"fresh-publication-effect", "publisher.prepare", freshPublication.Spec.ID, request.Metadata.OperationID,
+	)
+	cachedClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(stalePublication).Build()
+	apiReader := fake.NewClientBuilder().WithScheme(scheme).WithObjects(freshPublication, effect).Build()
+
+	artifactSecret := []byte(strings.Repeat("a", 32))
+	publisherToken := strings.Repeat("p", 32)
+	writeAPISecretFile(t, envACPArtifactSecretFile, "artifact", artifactSecret)
+	writeAPISecretFile(t, envWorkspacePublisherControllerTokenFile, "publisher", []byte(publisherToken))
+
+	app := fiber.New()
+	server := &Server{
+		app: app, client: cachedClient,
+		config: ServerConfig{APIReader: apiReader, ArtifactReservations: &recordingCapabilityReservations{}},
+	}
+	server.installACPArtifactAuthorizationBroker()
+	body, err := json.Marshal(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	httpRequest := httptest.NewRequest(http.MethodPost, publisherservice.ArtifactAuthorizationBrokerPath, bytes.NewReader(body))
+	httpRequest.Header.Set("Content-Type", "application/json")
+	httpRequest.Header.Set("Authorization", "Bearer "+publisherToken)
+	response, err := app.Test(httpRequest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if response.StatusCode != http.StatusOK {
+		t.Fatalf("status=%d, want %d", response.StatusCode, http.StatusOK)
+	}
+}
+
+func TestAuthorizePublisherParentEffectUsesFreshReaderWithFallback(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	metadata := publisherservice.OperationMetadata{
+		Namespace: "default", TaskID: "task-uid", OperationID: "workspace-prepare-prompt",
+	}
+	inFlightEffect := publisherEffectForTest(
+		"workspace-effect", "workspace.prepare", metadata.TaskID, metadata.OperationID,
+	)
+	settledEffect := inFlightEffect.DeepCopy()
+	settledEffect.Status.State = corev1alpha1.ExternalEffectControlState(store.ExternalEffectSucceeded)
+
+	tests := []struct {
+		name          string
+		cachedObjects []client.Object
+		freshObjects  []client.Object
+		useAPIReader  bool
+		wantErr       bool
+	}{
+		{
+			name:         "fresh reader observes newly created in-flight effect",
+			freshObjects: []client.Object{inFlightEffect.DeepCopy()},
+			useAPIReader: true,
+		},
+		{
+			name:          "fresh reader rejects effect settled behind stale cache",
+			cachedObjects: []client.Object{inFlightEffect.DeepCopy()},
+			freshObjects:  []client.Object{settledEffect},
+			useAPIReader:  true,
+			wantErr:       true,
+		},
+		{
+			name:          "cached client remains fallback when API reader is unset",
+			cachedObjects: []client.Object{inFlightEffect.DeepCopy()},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			cachedClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(test.cachedObjects...).Build()
+			server := &Server{client: cachedClient}
+			if test.useAPIReader {
+				server.config.APIReader = fake.NewClientBuilder().WithScheme(scheme).WithObjects(test.freshObjects...).Build()
+			}
+
+			err := server.authorizePublisherParentEffect(
+				context.Background(), publisherservice.OperationWorkspacePrepare, metadata,
+			)
+			if test.wantErr && err == nil {
+				t.Fatal("expected authorization to fail")
+			}
+			if !test.wantErr && err != nil {
+				t.Fatalf("expected authorization to succeed: %v", err)
+			}
+		})
+	}
+}
+
+func publisherEffectForTest(name, kind, aggregateID, operationID string) *corev1alpha1.ExternalEffect {
+	return &corev1alpha1.ExternalEffect{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: name},
+		Spec: corev1alpha1.ExternalEffectSpec{
+			ID: name, Kind: kind, IdentityNamespace: "default", AggregateID: aggregateID,
+			OperationID: operationID, RequestDigest: "sha256:" + strings.Repeat("9", 64),
+		},
+		Status: corev1alpha1.ExternalEffectStatus{State: corev1alpha1.ExternalEffectControlState(store.ExternalEffectInFlight)},
+	}
+}
+
+func writeAPISecretFile(t *testing.T, env, name string, value []byte) {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), name)
+	if err := os.WriteFile(path, value, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv(env, path)
+}
diff --git a/internal/api/acp_artifact_handlers.go b/internal/api/acp_artifact_handlers.go
new file mode 100644
index 000000000..bb51487ef
--- /dev/null
+++ b/internal/api/acp_artifact_handlers.go
@@ -0,0 +1,198 @@
+package api
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"github.com/gofiber/fiber/v3"
+
+	"github.com/orka-agents/orka/internal/artifactcap"
+)
+
+const (
+	defaultAPIRequestBodyLimit = 15 << 20
+	defaultACPArtifactMaxBytes = 512 << 20
+	defaultACPArtifactRoot     = "/data/acp-artifacts"
+
+	envACPArtifactRoot       = "ORKA_ACP_ARTIFACT_ROOT"
+	envACPArtifactSecretFile = "ORKA_ACP_ARTIFACT_CAPABILITY_SECRET_FILE"
+	envACPArtifactMaxBytes   = "ORKA_ACP_ARTIFACT_MAX_BYTES"
+
+	acpArtifactRoutePrefix = "/internal/v2/acp/artifacts"
+)
+
+type ACPArtifactHandlers struct {
+	service *artifactcap.Service
+}
+
+func NewACPArtifactHandlers(service *artifactcap.Service) (*ACPArtifactHandlers, error) {
+	if service == nil {
+		return nil, fmt.Errorf("artifact service is required")
+	}
+	return &ACPArtifactHandlers{service: service}, nil
+}
+
+func (h *ACPArtifactHandlers) Upload(c fiber.Ctx) error {
+	presented, token, err := artifactPresentedRequest(c, artifactcap.OperationUpload)
+	if err != nil {
+		return writeACPArtifactError(c, err)
+	}
+	actualLength := int64(c.Request().Header.ContentLength())
+	if actualLength < 0 {
+		return writeACPArtifactError(c, fmt.Errorf("%w: content-length is required", artifactcap.ErrInvalidRequest))
+	}
+	if actualLength != presented.ContentLength {
+		return writeACPArtifactError(c, fmt.Errorf("%w: content length does not match request binding", artifactcap.ErrInvalidRequest))
+	}
+	if contentType := string(c.Request().Header.ContentType()); contentType != presented.MediaType {
+		return writeACPArtifactError(c, fmt.Errorf("%w: content type does not match request binding", artifactcap.ErrInvalidRequest))
+	}
+	artifact, err := h.service.Upload(c.Context(), token, presented, c.Request().BodyStream())
+	if err != nil {
+		return writeACPArtifactError(c, err)
+	}
+	return c.Status(fiber.StatusCreated).JSON(artifact)
+}
+
+func (h *ACPArtifactHandlers) Download(c fiber.Ctx) error {
+	presented, token, err := artifactPresentedRequest(c, artifactcap.OperationDownload)
+	if err != nil {
+		return writeACPArtifactError(c, err)
+	}
+	download, err := h.service.OpenDownload(c.Context(), token, presented)
+	if err != nil {
+		return writeACPArtifactError(c, err)
+	}
+	c.Set(fiber.HeaderContentType, download.Artifact.MediaType)
+	c.Set(fiber.HeaderContentLength, strconv.FormatInt(download.Artifact.SizeBytes, 10))
+	c.Set(artifactcap.ObjectDigestHeader, download.Artifact.Digest)
+	c.Set(fiber.HeaderETag, `"`+download.Artifact.Digest+`"`)
+	c.Status(fiber.StatusOK)
+	return c.SendStream(download, int(download.Artifact.SizeBytes))
+}
+
+func artifactPresentedRequest(c fiber.Ctx, operation artifactcap.Operation) (artifactcap.PresentedRequest, string, error) {
+	hexDigest := c.Params("digest")
+	if len(hexDigest) != 64 || strings.ToLower(hexDigest) != hexDigest {
+		return artifactcap.PresentedRequest{}, "", artifactcap.ErrInvalidRequest
+	}
+	objectDigest := "sha256:" + hexDigest
+	canonicalPath, err := artifactcap.ObjectPath(objectDigest)
+	if err != nil || c.Path() != canonicalPath {
+		return artifactcap.PresentedRequest{}, "", artifactcap.ErrInvalidRequest
+	}
+	lengthValue := string(c.Request().Header.Peek(artifactcap.ContentLengthHeader))
+	contentLength, err := strconv.ParseInt(lengthValue, 10, 64)
+	if err != nil || strconv.FormatInt(contentLength, 10) != lengthValue || contentLength < 0 {
+		return artifactcap.PresentedRequest{}, "", artifactcap.ErrInvalidRequest
+	}
+	mediaType := string(c.Request().Header.Peek(artifactcap.MediaTypeHeader))
+	presented := artifactcap.PresentedRequest{
+		Method:        operation.Method(),
+		Path:          canonicalPath,
+		ObjectDigest:  objectDigest,
+		ContentLength: contentLength,
+		MediaType:     mediaType,
+		RequestDigest: string(c.Request().Header.Peek(artifactcap.RequestDigestHeader)),
+	}
+	if err := presented.Validate(); err != nil {
+		return artifactcap.PresentedRequest{}, "", err
+	}
+	token := string(c.Request().Header.Peek(artifactcap.CapabilityHeader))
+	if token == "" {
+		return artifactcap.PresentedRequest{}, "", artifactcap.ErrUnauthorized
+	}
+	return presented, token, nil
+}
+
+func writeACPArtifactError(c fiber.Ctx, err error) error {
+	status := fiber.StatusInternalServerError
+	code := "artifact_io_failure"
+	switch {
+	case errors.Is(err, artifactcap.ErrExpired), errors.Is(err, artifactcap.ErrUnauthorized):
+		status, code = fiber.StatusForbidden, "artifact_authorization_failed"
+	case errors.Is(err, artifactcap.ErrReplay):
+		status, code = fiber.StatusConflict, "artifact_operation_replayed"
+	case errors.Is(err, artifactcap.ErrOperationConflict):
+		status, code = fiber.StatusConflict, "artifact_operation_conflict"
+	case errors.Is(err, artifactcap.ErrTooLarge):
+		status, code = fiber.StatusRequestEntityTooLarge, "artifact_too_large"
+	case errors.Is(err, artifactcap.ErrNotFound):
+		status, code = fiber.StatusNotFound, "artifact_not_found"
+	case errors.Is(err, artifactcap.ErrPartialUpload):
+		status, code = fiber.StatusBadRequest, "artifact_upload_incomplete"
+	case errors.Is(err, artifactcap.ErrDigestMismatch):
+		status, code = fiber.StatusUnprocessableEntity, "artifact_digest_mismatch"
+	case errors.Is(err, artifactcap.ErrInvalidRequest):
+		status, code = fiber.StatusBadRequest, "artifact_request_invalid"
+	case errors.Is(err, artifactcap.ErrUnsafePath), errors.Is(err, artifactcap.ErrCorrupt):
+		status, code = fiber.StatusInternalServerError, "artifact_storage_unavailable"
+	}
+	return c.Status(status).JSON(fiber.Map{"error": code})
+}
+
+func (s *Server) installACPArtifactTransport() {
+	s.app.Use(acpArtifactStreamingGuard)
+	handlers, err := loadACPArtifactHandlersFromEnvironment()
+	group := s.app.Group(acpArtifactRoutePrefix)
+	if err != nil {
+		unavailable := func(c fiber.Ctx) error {
+			return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "artifact_transport_unavailable"})
+		}
+		group.Put("/sha256/:digest", unavailable)
+		group.Get("/sha256/:digest", unavailable)
+		return
+	}
+	group.Put("/sha256/:digest", handlers.Upload)
+	group.Get("/sha256/:digest", handlers.Download)
+}
+
+func loadACPArtifactHandlersFromEnvironment() (*ACPArtifactHandlers, error) {
+	secretFile := strings.TrimSpace(os.Getenv(envACPArtifactSecretFile))
+	if secretFile == "" || !filepath.IsAbs(secretFile) {
+		return nil, fmt.Errorf("artifact capability secret file is not configured")
+	}
+	secret, err := readACPArtifactCapabilitySecretFile(secretFile)
+	if err != nil {
+		return nil, err
+	}
+	root := strings.TrimSpace(os.Getenv(envACPArtifactRoot))
+	if root == "" {
+		root = defaultACPArtifactRoot
+	}
+	maxBytes := int64(defaultACPArtifactMaxBytes)
+	if raw := strings.TrimSpace(os.Getenv(envACPArtifactMaxBytes)); raw != "" {
+		parsed, parseErr := strconv.ParseInt(raw, 10, 64)
+		if parseErr != nil || parsed <= 0 {
+			return nil, fmt.Errorf("artifact maximum size is invalid")
+		}
+		maxBytes = parsed
+	}
+	service, err := artifactcap.NewService(artifactcap.ServiceConfig{Root: root, Secret: secret, MaxObjectBytes: maxBytes})
+	if err != nil {
+		return nil, err
+	}
+	return NewACPArtifactHandlers(service)
+}
+
+func acpArtifactStreamingGuard(c fiber.Ctx) error {
+	if strings.HasPrefix(c.Path(), acpArtifactRoutePrefix+"/") {
+		return c.Next()
+	}
+	method := c.Method()
+	if method != fiber.MethodPost && method != fiber.MethodPut && method != fiber.MethodPatch {
+		return c.Next()
+	}
+	contentLength := c.Request().Header.ContentLength()
+	if contentLength == -1 {
+		return c.Status(fiber.StatusLengthRequired).JSON(fiber.Map{"error": "content_length_required"})
+	}
+	if contentLength > defaultAPIRequestBodyLimit {
+		return c.Status(fiber.StatusRequestEntityTooLarge).JSON(fiber.Map{"error": "request_body_too_large"})
+	}
+	return c.Next()
+}
diff --git a/internal/api/acp_artifact_handlers_test.go b/internal/api/acp_artifact_handlers_test.go
new file mode 100644
index 000000000..8fdb9f21d
--- /dev/null
+++ b/internal/api/acp_artifact_handlers_test.go
@@ -0,0 +1,298 @@
+package api
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gofiber/fiber/v3"
+
+	"github.com/orka-agents/orka/internal/artifactcap"
+)
+
+func TestACPArtifactHandlersUploadDownloadAndReplay(t *testing.T) {
+	t.Parallel()
+	secret := []byte(strings.Repeat("a", artifactcap.MinSecretBytes))
+	now := time.Date(2026, 7, 24, 12, 0, 0, 0, time.UTC)
+	service, err := artifactcap.NewService(artifactcap.ServiceConfig{
+		Root: t.TempDir(), Secret: secret, MaxObjectBytes: 1 << 20, Now: func() time.Time { return now },
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	handlers, err := NewACPArtifactHandlers(service)
+	if err != nil {
+		t.Fatal(err)
+	}
+	app := fiber.New(fiber.Config{BodyLimit: 1 << 20, StreamRequestBody: true})
+	app.Put(acpArtifactRoutePrefix+"/sha256/:digest", handlers.Upload)
+	app.Get(acpArtifactRoutePrefix+"/sha256/:digest", handlers.Download)
+
+	data := []byte("streamed durable artifact")
+	upload := apiOperationRequest(artifactcap.OperationUpload, data, "api-upload")
+	uploadAuthorization, err := artifactcap.Issue(secret, upload, now, time.Minute)
+	if err != nil {
+		t.Fatal(err)
+	}
+	uploadResponse := performArtifactRequest(t, app, upload, uploadAuthorization, bytes.NewReader(data))
+	defer uploadResponse.Body.Close() //nolint:errcheck
+	if uploadResponse.StatusCode != http.StatusCreated {
+		body, _ := io.ReadAll(uploadResponse.Body)
+		t.Fatalf("upload status=%d body=%s", uploadResponse.StatusCode, body)
+	}
+	var stored artifactcap.Artifact
+	if err := json.NewDecoder(uploadResponse.Body).Decode(&stored); err != nil {
+		t.Fatal(err)
+	}
+	if stored.Digest != upload.ObjectDigest || stored.SizeBytes != int64(len(data)) {
+		t.Fatalf("stored artifact = %#v", stored)
+	}
+
+	replayResponse := performArtifactRequest(t, app, upload, uploadAuthorization, bytes.NewReader(data))
+	defer replayResponse.Body.Close() //nolint:errcheck
+	if replayResponse.StatusCode != http.StatusConflict {
+		t.Fatalf("replay status=%d, want 409", replayResponse.StatusCode)
+	}
+
+	download := upload
+	download.Operation = artifactcap.OperationDownload
+	download.OperationID = "api-download"
+	downloadAuthorization, err := artifactcap.Issue(secret, download, now, time.Minute)
+	if err != nil {
+		t.Fatal(err)
+	}
+	downloadResponse := performArtifactRequest(t, app, download, downloadAuthorization, nil)
+	defer downloadResponse.Body.Close() //nolint:errcheck
+	if downloadResponse.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(downloadResponse.Body)
+		t.Fatalf("download status=%d body=%s", downloadResponse.StatusCode, body)
+	}
+	got, err := io.ReadAll(downloadResponse.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(got, data) {
+		t.Fatalf("download = %q, want %q", got, data)
+	}
+	if downloadResponse.Header.Get(artifactcap.ObjectDigestHeader) != download.ObjectDigest ||
+		downloadResponse.Header.Get("Content-Type") != download.MediaType ||
+		downloadResponse.ContentLength != int64(len(data)) {
+		t.Fatalf("download headers = %#v", downloadResponse.Header)
+	}
+}
+
+func TestServerInstallsACPArtifactRoutesFromEnvironment(t *testing.T) {
+	secret := []byte(strings.Repeat("e", artifactcap.MinSecretBytes))
+	secretFile := filepath.Join(t.TempDir(), "artifact-secret")
+	if err := os.WriteFile(secretFile, secret, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	root := filepath.Join(t.TempDir(), "artifacts")
+	t.Setenv(envACPArtifactSecretFile, secretFile)
+	t.Setenv(envACPArtifactRoot, root)
+	t.Setenv(envACPArtifactMaxBytes, strconv.Itoa(1<<20))
+
+	server := &Server{app: fiber.New(fiber.Config{BodyLimit: 1024, StreamRequestBody: true})}
+	server.installACPArtifactTransport()
+	data := []byte("route integration")
+	request := apiOperationRequest(artifactcap.OperationUpload, data, "route-install-upload")
+	authorization, err := artifactcap.Issue(secret, request, time.Now().UTC(), time.Minute)
+	if err != nil {
+		t.Fatal(err)
+	}
+	response := performArtifactRequest(t, server.app, request, authorization, bytes.NewReader(data))
+	defer response.Body.Close() //nolint:errcheck
+	if response.StatusCode != http.StatusCreated {
+		body, _ := io.ReadAll(response.Body)
+		t.Fatalf("registered route status=%d body=%s", response.StatusCode, body)
+	}
+}
+
+func TestServerInstallsACPArtifactRoutesWithTrailingNewlineSecret(t *testing.T) {
+	secret := []byte(strings.Repeat("n", artifactcap.MinSecretBytes))
+	secretFile := filepath.Join(t.TempDir(), "artifact-secret")
+	secretWithNewline := append(append([]byte(nil), secret...), '\n')
+	if err := os.WriteFile(secretFile, secretWithNewline, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv(envACPArtifactSecretFile, secretFile)
+	t.Setenv(envACPArtifactRoot, filepath.Join(t.TempDir(), "artifacts"))
+	t.Setenv(envACPArtifactMaxBytes, strconv.Itoa(1<<20))
+
+	server := &Server{app: fiber.New(fiber.Config{BodyLimit: 1024, StreamRequestBody: true})}
+	server.installACPArtifactTransport()
+	data := []byte("normalized route secret")
+	request := apiOperationRequest(artifactcap.OperationUpload, data, "route-install-normalized-secret")
+	authorization, err := artifactcap.Issue(secret, request, time.Now().UTC(), time.Minute)
+	if err != nil {
+		t.Fatal(err)
+	}
+	response := performArtifactRequest(t, server.app, request, authorization, bytes.NewReader(data))
+	defer response.Body.Close() //nolint:errcheck
+	if response.StatusCode != http.StatusCreated {
+		body, _ := io.ReadAll(response.Body)
+		t.Fatalf("registered route status=%d body=%s", response.StatusCode, body)
+	}
+}
+
+func TestLoadACPArtifactHandlersRejectsShortNormalizedSecret(t *testing.T) {
+	secretFile := filepath.Join(t.TempDir(), "artifact-secret")
+	rawSecret := append(bytes.Repeat([]byte("s"), artifactcap.MinSecretBytes-1), '\n')
+	if err := os.WriteFile(secretFile, rawSecret, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv(envACPArtifactSecretFile, secretFile)
+	t.Setenv(envACPArtifactRoot, filepath.Join(t.TempDir(), "artifacts"))
+	t.Setenv(envACPArtifactMaxBytes, strconv.Itoa(1<<20))
+
+	if _, err := loadACPArtifactHandlersFromEnvironment(); err == nil {
+		t.Fatal("expected normalized secret below minimum length to fail closed")
+	}
+}
+
+func TestACPArtifactHandlerStreamsPastFiberBodyThreshold(t *testing.T) {
+	t.Parallel()
+	secret := []byte(strings.Repeat("m", artifactcap.MinSecretBytes))
+	now := time.Now().UTC()
+	service, err := artifactcap.NewService(artifactcap.ServiceConfig{
+		Root: t.TempDir(), Secret: secret, MaxObjectBytes: 1 << 20, Now: func() time.Time { return now },
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	handlers, err := NewACPArtifactHandlers(service)
+	if err != nil {
+		t.Fatal(err)
+	}
+	app := fiber.New(fiber.Config{BodyLimit: 1024, StreamRequestBody: true})
+	app.Put(acpArtifactRoutePrefix+"/sha256/:digest", handlers.Upload)
+	listener, err := net.Listen("tcp4", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	serveErrors := make(chan error, 1)
+	go func() { serveErrors <- app.Listener(listener, fiber.ListenConfig{DisableStartupMessage: true}) }()
+	t.Cleanup(func() {
+		_ = app.Shutdown()
+		<-serveErrors
+	})
+
+	data := bytes.Repeat([]byte("stream-me"), 8192)
+	request := apiOperationRequest(artifactcap.OperationUpload, data, "streaming-upload")
+	authorization, err := artifactcap.Issue(secret, request, now, time.Minute)
+	if err != nil {
+		t.Fatal(err)
+	}
+	httpRequest, err := http.NewRequest(http.MethodPut, "http://"+listener.Addr().String()+request.Path(), bytes.NewReader(data))
+	if err != nil {
+		t.Fatal(err)
+	}
+	httpRequest.ContentLength = int64(len(data))
+	httpRequest.Header.Set("Content-Type", request.MediaType)
+	httpRequest.Header.Set(artifactcap.CapabilityHeader, authorization.Capability)
+	httpRequest.Header.Set(artifactcap.RequestDigestHeader, authorization.RequestDigest)
+	httpRequest.Header.Set(artifactcap.ContentLengthHeader, strconv.FormatInt(request.ContentLength, 10))
+	httpRequest.Header.Set(artifactcap.MediaTypeHeader, request.MediaType)
+	response, err := http.DefaultClient.Do(httpRequest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer response.Body.Close() //nolint:errcheck
+	if response.StatusCode != http.StatusCreated {
+		body, _ := io.ReadAll(response.Body)
+		t.Fatalf("streamed upload status=%d body=%s", response.StatusCode, body)
+	}
+}
+
+func TestACPArtifactHandlersHostileRequestsAreBoundedAndRedacted(t *testing.T) {
+	t.Parallel()
+	secretText := strings.Repeat("handler-secret-", 3)
+	secret := []byte(secretText)
+	now := time.Now().UTC()
+	service, err := artifactcap.NewService(artifactcap.ServiceConfig{
+		Root: t.TempDir(), Secret: secret, MaxObjectBytes: 4, Now: func() time.Time { return now },
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	handlers, err := NewACPArtifactHandlers(service)
+	if err != nil {
+		t.Fatal(err)
+	}
+	app := fiber.New(fiber.Config{StreamRequestBody: true, BodyLimit: 1 << 20})
+	app.Put(acpArtifactRoutePrefix+"/sha256/:digest", handlers.Upload)
+
+	data := []byte("12345")
+	request := apiOperationRequest(artifactcap.OperationUpload, data, "api-oversized")
+	authorization, err := artifactcap.Issue(secret, request, now, time.Minute)
+	if err != nil {
+		t.Fatal(err)
+	}
+	response := performArtifactRequest(t, app, request, authorization, bytes.NewReader(data))
+	defer response.Body.Close() //nolint:errcheck
+	body, _ := io.ReadAll(response.Body)
+	if response.StatusCode != http.StatusRequestEntityTooLarge {
+		t.Fatalf("oversized status=%d body=%s", response.StatusCode, body)
+	}
+	if bytes.Contains(body, []byte(authorization.Capability)) || bytes.Contains(body, []byte(secretText)) {
+		t.Fatalf("response disclosed capability or secret: %s", body)
+	}
+
+	expired, err := artifactcap.Issue(secret, request, now.Add(-2*time.Minute), time.Minute)
+	if err != nil {
+		t.Fatal(err)
+	}
+	expiredResponse := performArtifactRequest(t, app, request, expired, bytes.NewReader(data))
+	defer expiredResponse.Body.Close() //nolint:errcheck
+	if expiredResponse.StatusCode != http.StatusForbidden {
+		t.Fatalf("expired status=%d, want 403", expiredResponse.StatusCode)
+	}
+	expiredBody, _ := io.ReadAll(expiredResponse.Body)
+	if bytes.Contains(expiredBody, []byte(expired.Capability)) || bytes.Contains(expiredBody, []byte(secretText)) {
+		t.Fatalf("expired response disclosed capability or secret: %s", expiredBody)
+	}
+}
+
+//nolint:unparam // The stable parameter keeps call sites explicit across related test cases.
+func apiOperationRequest(operation artifactcap.Operation, data []byte, operationID string) artifactcap.OperationRequest {
+	return artifactcap.OperationRequest{
+		Operation: operation, ObjectDigest: artifactcap.DigestBytes(data),
+		Identity:      artifactcap.Identity{Namespace: "default", TaskID: "task-uid-api"},
+		ContentLength: int64(len(data)), MediaType: "application/octet-stream", OperationID: operationID,
+	}
+}
+
+func performArtifactRequest(
+	t *testing.T,
+	app *fiber.App,
+	request artifactcap.OperationRequest,
+	authorization artifactcap.Authorization,
+	body io.Reader,
+) *http.Response {
+	t.Helper()
+	method := request.Method()
+	endpoint := "http://example.invalid" + request.Path()
+	httpRequest := httptest.NewRequest(method, endpoint, body)
+	httpRequest.Header.Set(artifactcap.CapabilityHeader, authorization.Capability)
+	httpRequest.Header.Set(artifactcap.RequestDigestHeader, authorization.RequestDigest)
+	httpRequest.Header.Set(artifactcap.ContentLengthHeader, strconv.FormatInt(request.ContentLength, 10))
+	httpRequest.Header.Set(artifactcap.MediaTypeHeader, request.MediaType)
+	if method == http.MethodPut {
+		httpRequest.Header.Set("Content-Type", request.MediaType)
+		httpRequest.ContentLength = request.ContentLength
+	}
+	response, err := app.Test(httpRequest, fiber.TestConfig{Timeout: 5 * time.Second})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return response
+}
diff --git a/internal/api/acp_credential_broker.go b/internal/api/acp_credential_broker.go
new file mode 100644
index 000000000..de0307fba
--- /dev/null
+++ b/internal/api/acp_credential_broker.go
@@ -0,0 +1,322 @@
+package api
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"github.com/gofiber/fiber/v3"
+	corev1 "k8s.io/api/core/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/controller"
+	publisherservice "github.com/orka-agents/orka/internal/publisher/service"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+const (
+	defaultWorkspaceCredentialKey = "token"
+	maxBrokeredCredentialBytes    = 32 << 10
+)
+
+func (s *Server) issuePublisherCredential(c fiber.Ctx) error {
+	var request publisherservice.CredentialMaterialRequest
+	decoder := json.NewDecoder(strings.NewReader(string(c.Body())))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&request); err != nil || decoder.Decode(&struct{}{}) == nil || request.Validate() != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid_request"})
+	}
+	expectedBearer, err := readSecretAtEnvPath(envWorkspacePublisherControllerTokenFile, 16)
+	if err != nil {
+		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "credential_broker_unavailable"})
+	}
+	bearer := strings.TrimSpace(strings.TrimPrefix(string(c.Request().Header.Peek("Authorization")), "Bearer "))
+	if !constantAPIStringEqual(bearer, string(expectedBearer)) {
+		return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "authorization_failed"})
+	}
+	task, reference, frozenResourceVersion, credentialRole, err := s.authorizePublisherCredentialRequest(c.Context(), request)
+	if err != nil {
+		return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "authorization_failed"})
+	}
+	if err := s.authorizePublisherParentEffect(c.Context(), request.ParentOperation, request.Metadata); err != nil {
+		return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "authorization_failed"})
+	}
+	binding, err := s.frozenPromptCredentialBinding(c.Context(), task, credentialRole)
+	if err != nil || binding.SecretName != reference.Name || binding.SecretKey != effectiveWorkspaceCredentialKey(reference) ||
+		binding.ResourceVersion != frozenResourceVersion {
+		return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "authorization_failed"})
+	}
+	secretReader := client.Reader(s.client)
+	if s.config.APIReader != nil {
+		secretReader = s.config.APIReader
+	}
+	secret := &corev1.Secret{}
+	if err := secretReader.Get(c.Context(), client.ObjectKey{Namespace: task.Namespace, Name: reference.Name}, secret); err != nil ||
+		secret.ResourceVersion == "" || secret.ResourceVersion != frozenResourceVersion || string(secret.UID) != binding.SecretUID {
+		return c.Status(fiber.StatusGone).JSON(fiber.Map{"error": "credential_version_changed"})
+	}
+	key := effectiveWorkspaceCredentialKey(reference)
+	value := bytes.TrimSpace(secret.Data[key])
+	if len(value) == 0 || len(value) > maxBrokeredCredentialBytes || bytes.ContainsAny(value, "\r\n\x00") {
+		return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "credential_material_invalid"})
+	}
+	material, err := formatPublisherCredential(request.Reference.Kind, value)
+	if err != nil {
+		return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "credential_material_invalid"})
+	}
+	return c.JSON(publisherservice.CredentialMaterialResponse{Material: material, ResourceVersion: secret.ResourceVersion})
+}
+
+func (s *Server) authorizePublisherCredentialRequest(
+	ctx context.Context,
+	request publisherservice.CredentialMaterialRequest,
+) (*corev1alpha1.Task, *corev1alpha1.WorkspaceCredentialReference, string, string, error) {
+	if request.ParentOperation == publisherservice.OperationWorkspaceResolve || request.ParentOperation == publisherservice.OperationWorkspacePrepare {
+		return s.authorizeWorkspaceReadCredential(ctx, request)
+	}
+	task, reference, frozenResourceVersion, credentialRole, err := s.authorizePublicationCredential(ctx, request)
+	return task, reference, frozenResourceVersion, credentialRole, err
+}
+
+func (s *Server) authorizeWorkspaceReadCredential(
+	ctx context.Context,
+	request publisherservice.CredentialMaterialRequest,
+) (*corev1alpha1.Task, *corev1alpha1.WorkspaceCredentialReference, string, string, error) {
+	task, err := s.findTaskByUID(ctx, request.Metadata.Namespace, request.Metadata.TaskID)
+	if err != nil || task.Status.Execution == nil || task.Spec.Workspace == nil {
+		return nil, nil, "", "", fmt.Errorf("workspace read credential is unavailable")
+	}
+	execution := task.Status.Execution
+	operationPrefix := "workspace-resolve-"
+	if request.ParentOperation == publisherservice.OperationWorkspacePrepare {
+		operationPrefix = "workspace-prepare-"
+	}
+	if execution.State != corev1alpha1.TaskExecutionStatePlanned || request.Metadata.PublicationID != "" ||
+		request.Metadata.OperationID != operationPrefix+execution.PromptID || request.Reference.Kind != publisherservice.CredentialHTTPExtraHeader {
+		return nil, nil, "", "", fmt.Errorf("workspace read credential request is not bound to the planned task")
+	}
+	workspace := task.Spec.Workspace
+	var reference *corev1alpha1.WorkspaceCredentialReference
+	var frozenResourceVersion string
+	switch request.Reference.Role {
+	case "", publisherservice.CredentialRoleSourceRead:
+		reference = workspace.ReadCredentialRef
+		frozenResourceVersion = execution.ReadCredentialResourceVersion
+	case publisherservice.CredentialRoleTargetRead:
+		reference = workspace.PublicationReadCredentialRef
+		frozenResourceVersion = execution.PublicationReadCredentialResourceVersion
+	default:
+		return nil, nil, "", "", fmt.Errorf("workspace read credential role is invalid")
+	}
+	if reference == nil || request.Reference.Name != reference.Name || frozenResourceVersion == "" {
+		return nil, nil, "", "", fmt.Errorf("workspace read credential request is not bound to the planned task")
+	}
+	role := request.Reference.Role
+	if role == "" {
+		role = publisherservice.CredentialRoleSourceRead
+	}
+	return task, reference, frozenResourceVersion, string(role), nil
+}
+
+func (s *Server) authorizePublicationCredential(
+	ctx context.Context,
+	request publisherservice.CredentialMaterialRequest,
+) (*corev1alpha1.Task, *corev1alpha1.WorkspaceCredentialReference, string, string, error) {
+	task, publication, err := s.taskAndPublicationForCredential(ctx, request)
+	if err != nil || task.Status.Execution == nil || task.Spec.Workspace == nil {
+		return nil, nil, "", "", fmt.Errorf("publication credential is unavailable")
+	}
+	execution := task.Status.Execution
+	if execution.State != corev1alpha1.TaskExecutionStateSucceeded {
+		return nil, nil, "", "", fmt.Errorf("publication credential request is not bound to the settled task")
+	}
+	kind, expectedState, expectedCredentialKind := publicationCredentialOperation(request.ParentOperation)
+	credentialRole := request.Reference.Role
+	if credentialRole == "" {
+		credentialRole = publisherservice.CredentialRole(promptCredentialRoleForOperation(request.ParentOperation))
+	}
+	if request.ParentOperation == publisherservice.OperationPublicationPrepare {
+		if credentialRole != publisherservice.CredentialRoleSourceRead && credentialRole != publisherservice.CredentialRoleTargetRead {
+			return nil, nil, "", "", fmt.Errorf("publication credential role is invalid for the requested operation")
+		}
+	} else if credentialRole != publisherservice.CredentialRole(promptCredentialRoleForOperation(request.ParentOperation)) {
+		return nil, nil, "", "", fmt.Errorf("publication credential role is invalid for the requested operation")
+	}
+	reference, frozenVersion := publicationCredentialBinding(task, request.ParentOperation, credentialRole)
+	if kind == "" || reference == nil || frozenVersion == "" || request.Reference.Kind != expectedCredentialKind ||
+		request.Reference.Name != reference.Name || request.Metadata.OperationID != controller.ACPPublicationOperationID(kind, task) {
+		return nil, nil, "", "", fmt.Errorf("publication credential operation identity is invalid")
+	}
+	if publication != nil && string(publication.Status.State) != string(expectedState) {
+		return nil, nil, "", "", fmt.Errorf("publication credential state is invalid")
+	}
+	return task, reference, frozenVersion, string(credentialRole), nil
+}
+
+func publicationCredentialBinding(
+	task *corev1alpha1.Task,
+	operation publisherservice.Operation,
+	role publisherservice.CredentialRole,
+) (*corev1alpha1.WorkspaceCredentialReference, string) {
+	if task == nil || task.Status.Execution == nil || task.Spec.Workspace == nil {
+		return nil, ""
+	}
+	workspace := task.Spec.Workspace
+	execution := task.Status.Execution
+	switch operation {
+	case publisherservice.OperationPublicationPreflight, publisherservice.OperationPublicationVerify:
+		return workspace.PublicationReadCredentialRef, execution.PublicationReadCredentialResourceVersion
+	case publisherservice.OperationPublicationPrepare:
+		if role == publisherservice.CredentialRoleTargetRead {
+			return workspace.PublicationReadCredentialRef, execution.PublicationReadCredentialResourceVersion
+		}
+		return workspace.ReadCredentialRef, execution.ReadCredentialResourceVersion
+	case publisherservice.OperationPublicationPublish:
+		return workspace.PublicationCredentialRef, execution.PublicationCredentialResourceVersion
+	case publisherservice.OperationPullRequestReconcile:
+		return workspace.ForgeCredentialRef, execution.ForgeCredentialResourceVersion
+	default:
+		return nil, ""
+	}
+}
+
+func (s *Server) taskAndPublicationForCredential(
+	ctx context.Context,
+	request publisherservice.CredentialMaterialRequest,
+) (*corev1alpha1.Task, *corev1alpha1.Publication, error) {
+	if request.ParentOperation == publisherservice.OperationPublicationPreflight {
+		var tasks corev1alpha1.TaskList
+		if err := s.authorizationReader().List(ctx, &tasks, client.InNamespace(request.Metadata.Namespace)); err != nil {
+			return nil, nil, err
+		}
+		for i := range tasks.Items {
+			candidate := &tasks.Items[i]
+			if candidate.Status.Execution != nil && controller.ACPPublicationIDForTask(candidate) == request.Metadata.PublicationID {
+				return candidate.DeepCopy(), nil, nil
+			}
+		}
+		return nil, nil, fmt.Errorf("publication Task not found")
+	}
+	publication, err := s.findPublicationByID(ctx, request.Metadata.Namespace, request.Metadata.PublicationID)
+	if err != nil {
+		return nil, nil, err
+	}
+	task, err := s.findTaskByUID(ctx, request.Metadata.Namespace, publication.Spec.TaskUID)
+	return task, publication, err
+}
+
+func publicationCredentialOperation(operation publisherservice.Operation) (string, store.PublicationState, publisherservice.CredentialKind) {
+	switch operation {
+	case publisherservice.OperationPublicationPreflight:
+		return "preflight", "", publisherservice.CredentialHTTPExtraHeader
+	case publisherservice.OperationPublicationPrepare:
+		return "prepare", store.PublicationPreparing, publisherservice.CredentialHTTPExtraHeader
+	case publisherservice.OperationPublicationPublish:
+		return "publish", store.PublicationPublishing, publisherservice.CredentialHTTPExtraHeader
+	case publisherservice.OperationPublicationVerify:
+		return "verify", store.PublicationVerifying, publisherservice.CredentialHTTPExtraHeader
+	case publisherservice.OperationPullRequestReconcile:
+		return "pr-reconcile", store.PublicationVerifying, publisherservice.CredentialForgeToken
+	default:
+		return "", "", ""
+	}
+}
+
+func promptCredentialRoleForOperation(operation publisherservice.Operation) string {
+	switch operation {
+	case publisherservice.OperationWorkspaceResolve, publisherservice.OperationWorkspacePrepare, publisherservice.OperationPublicationPrepare:
+		return string(store.PromptCredentialSourceRead)
+	case publisherservice.OperationPublicationPreflight, publisherservice.OperationPublicationVerify:
+		return string(store.PromptCredentialTargetRead)
+	case publisherservice.OperationPublicationPublish:
+		return string(store.PromptCredentialTargetWrite)
+	case publisherservice.OperationPullRequestReconcile:
+		return string(store.PromptCredentialForge)
+	default:
+		return ""
+	}
+}
+
+func (s *Server) frozenPromptCredentialBinding(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	role string,
+) (*corev1alpha1.PromptCredentialBinding, error) {
+	if task == nil || task.Status.Execution == nil || role == "" {
+		return nil, fmt.Errorf("prompt credential binding identity is incomplete")
+	}
+	var attempts corev1alpha1.PromptAttemptList
+	if err := s.authorizationReader().List(ctx, &attempts, client.InNamespace(task.Namespace)); err != nil {
+		return nil, err
+	}
+	var match *corev1alpha1.PromptCredentialBinding
+	for i := range attempts.Items {
+		attempt := &attempts.Items[i]
+		if attempt.Spec.TaskUID != string(task.UID) || attempt.Spec.Attempt != int64(task.Status.Execution.Attempt) ||
+			attempt.Spec.PromptID != task.Status.Execution.PromptID {
+			continue
+		}
+		for j := range attempt.Spec.CredentialBindings {
+			binding := &attempt.Spec.CredentialBindings[j]
+			if binding.Role != role {
+				continue
+			}
+			if match != nil {
+				return nil, fmt.Errorf("prompt credential role is ambiguous")
+			}
+			copy := *binding
+			match = &copy
+		}
+	}
+	if match == nil {
+		return nil, fmt.Errorf("prompt credential binding was not found")
+	}
+	return match, nil
+}
+
+func effectiveWorkspaceCredentialKey(reference *corev1alpha1.WorkspaceCredentialReference) string {
+	if reference == nil || strings.TrimSpace(reference.Key) == "" {
+		return defaultWorkspaceCredentialKey
+	}
+	return strings.TrimSpace(reference.Key)
+}
+
+func formatPublisherCredential(kind publisherservice.CredentialKind, value []byte) (string, error) {
+	trimmed := strings.TrimSpace(string(value))
+	if trimmed == "" {
+		return "", fmt.Errorf("credential is empty")
+	}
+	if strings.HasPrefix(strings.ToLower(trimmed), "authorization:") {
+		parts := strings.Fields(strings.TrimSpace(trimmed[len("Authorization:"):]))
+		if len(parts) != 2 || parts[1] == "" {
+			return "", fmt.Errorf("authorization credential is invalid")
+		}
+		if kind == publisherservice.CredentialForgeToken {
+			if !strings.EqualFold(parts[0], "bearer") {
+				return "", fmt.Errorf("forge authorization credential must use Bearer")
+			}
+			return parts[1], nil
+		}
+		switch {
+		case strings.EqualFold(parts[0], "bearer"):
+			return "Authorization: Bearer " + parts[1], nil
+		case strings.EqualFold(parts[0], "basic"):
+			decoded, err := base64.StdEncoding.DecodeString(parts[1])
+			if err != nil || !bytes.Contains(decoded, []byte(":")) {
+				return "", fmt.Errorf("basic authorization credential is invalid")
+			}
+			return "Authorization: Basic " + parts[1], nil
+		default:
+			return "", fmt.Errorf("authorization credential scheme is unsupported")
+		}
+	}
+	if kind == publisherservice.CredentialForgeToken {
+		return trimmed, nil
+	}
+	encoded := base64.StdEncoding.EncodeToString([]byte("x-access-token:" + trimmed))
+	return "Authorization: Basic " + encoded, nil
+}
diff --git a/internal/api/acp_credential_broker_continuation_test.go b/internal/api/acp_credential_broker_continuation_test.go
new file mode 100644
index 000000000..dce343818
--- /dev/null
+++ b/internal/api/acp_credential_broker_continuation_test.go
@@ -0,0 +1,202 @@
+package api
+
+import (
+	"bytes"
+	"encoding/base64"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gofiber/fiber/v3"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	types "k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/controller"
+	publisherservice "github.com/orka-agents/orka/internal/publisher/service"
+)
+
+func TestPublisherCredentialBrokerUsesTargetReadBindingForContinuation(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	publisherBearer := strings.Repeat("p", 32)
+	writeAPISecretFile(t, envWorkspacePublisherControllerTokenFile, "publisher-broker-auth", []byte(publisherBearer))
+	taskUID := types.UID("continuation-credential-task-uid")
+	plannedTask := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "continuation", UID: taskUID},
+		Spec: corev1alpha1.TaskSpec{Workspace: &corev1alpha1.WorkspaceConfig{
+			ReadCredentialRef:            &corev1alpha1.WorkspaceCredentialReference{Name: "source-read"},
+			PublicationReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "target-read"},
+		}},
+		Status: corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStatePlanned, Attempt: 1, PromptID: "prompt",
+			ReadCredentialResourceVersion: "7", PublicationReadCredentialResourceVersion: "9",
+		}},
+	}
+	const targetMaterial = "target-test-value"
+	targetK8sObject := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "target-read", UID: "target-object-uid", ResourceVersion: "9"},
+		Data:       map[string][]byte{defaultWorkspaceCredentialKey: []byte(targetMaterial)},
+	}
+	attempt := &corev1alpha1.PromptAttempt{ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "attempt"}, Spec: corev1alpha1.PromptAttemptSpec{
+		TaskUID: string(taskUID), Attempt: 1, PromptID: "prompt",
+		CredentialBindings: []corev1alpha1.PromptCredentialBinding{
+			{Role: "SourceRead", Namespace: "default", SecretName: "source-read", SecretKey: defaultWorkspaceCredentialKey, SecretUID: "source-object-uid", ResourceVersion: "7"},
+			{Role: "TargetRead", Namespace: "default", SecretName: "target-read", SecretKey: defaultWorkspaceCredentialKey, SecretUID: "target-object-uid", ResourceVersion: "9"},
+		},
+	}}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(
+		plannedTask, targetK8sObject, attempt,
+		publisherEffectForTest("workspace-continuation-credential-effect", "workspace.prepare", string(taskUID), "workspace-prepare-prompt"),
+	).Build()
+	request := publisherservice.CredentialMaterialRequest{
+		ParentOperation: publisherservice.OperationWorkspacePrepare,
+		Metadata:        publisherservice.OperationMetadata{Namespace: "default", TaskID: string(taskUID), OperationID: "workspace-prepare-prompt"},
+		Reference: publisherservice.CredentialReference{
+			Name: "target-read", Kind: publisherservice.CredentialHTTPExtraHeader, Role: publisherservice.CredentialRoleTargetRead,
+		},
+	}
+	response := callPublisherCredentialBroker(t, kubeClient, publisherBearer, request)
+	expected := "Authorization: Basic " + base64.StdEncoding.EncodeToString([]byte("x-access-token:"+targetMaterial))
+	if response.Material != expected || response.ResourceVersion != "9" {
+		t.Fatalf("credential response = %#v", response)
+	}
+}
+
+func TestPublisherCredentialBrokerUsesTargetReadForContinuationPublicationPrepare(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	publisherBearer := strings.Repeat("p", 32)
+	writeAPISecretFile(t, envWorkspacePublisherControllerTokenFile, "publisher-broker-auth", []byte(publisherBearer))
+	taskUID := types.UID("continuation-publication-task-uid")
+	plannedTask := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "continuation-publication", UID: taskUID},
+		Spec: corev1alpha1.TaskSpec{Workspace: &corev1alpha1.WorkspaceConfig{
+			ReadCredentialRef:            &corev1alpha1.WorkspaceCredentialReference{Name: "source-read"},
+			PublicationReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "target-read"},
+		}},
+		Status: corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateSucceeded, Attempt: 1, PromptID: "prompt",
+			ReadCredentialResourceVersion: "7", PublicationReadCredentialResourceVersion: "9",
+		}},
+	}
+	publicationID := controller.ACPPublicationIDForTask(plannedTask)
+	publication := &corev1alpha1.Publication{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "continuation-publication-record"},
+		Spec:       corev1alpha1.PublicationSpec{ID: publicationID, TaskUID: string(taskUID)},
+		Status:     corev1alpha1.PublicationStatus{State: corev1alpha1.PublicationControlState("Preparing")},
+	}
+	const targetMaterial = "target-test-value"
+	targetK8sObject := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "target-read", UID: "target-object-uid", ResourceVersion: "9"},
+		Data:       map[string][]byte{defaultWorkspaceCredentialKey: []byte(targetMaterial)},
+	}
+	attempt := &corev1alpha1.PromptAttempt{ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "publication-attempt"}, Spec: corev1alpha1.PromptAttemptSpec{
+		TaskUID: string(taskUID), Attempt: 1, PromptID: "prompt",
+		CredentialBindings: []corev1alpha1.PromptCredentialBinding{
+			{Role: "SourceRead", Namespace: "default", SecretName: "source-read", SecretKey: defaultWorkspaceCredentialKey, SecretUID: "source-object-uid", ResourceVersion: "7"},
+			{Role: "TargetRead", Namespace: "default", SecretName: "target-read", SecretKey: defaultWorkspaceCredentialKey, SecretUID: "target-object-uid", ResourceVersion: "9"},
+		},
+	}}
+	operationID := controller.ACPPublicationOperationID("prepare", plannedTask)
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(
+		plannedTask, publication, targetK8sObject, attempt,
+		publisherEffectForTest("publication-continuation-credential-effect", "publisher.prepare", publicationID, operationID),
+	).Build()
+	request := publisherservice.CredentialMaterialRequest{
+		ParentOperation: publisherservice.OperationPublicationPrepare,
+		Metadata:        publisherservice.OperationMetadata{Namespace: "default", PublicationID: publicationID, OperationID: operationID},
+		Reference: publisherservice.CredentialReference{
+			Name: "target-read", Kind: publisherservice.CredentialHTTPExtraHeader, Role: publisherservice.CredentialRoleTargetRead,
+		},
+	}
+	response := callPublisherCredentialBroker(t, kubeClient, publisherBearer, request)
+	expected := "Authorization: Basic " + base64.StdEncoding.EncodeToString([]byte("x-access-token:"+targetMaterial))
+	if response.Material != expected || response.ResourceVersion != "9" {
+		t.Fatalf("credential response = %#v", response)
+	}
+}
+
+func TestPublisherCredentialBrokerUsesUncachedReaderForCredentialVersion(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	publisherBearer := strings.Repeat("p", 32)
+	writeAPISecretFile(t, envWorkspacePublisherControllerTokenFile, "publisher-broker-auth", []byte(publisherBearer))
+	taskUID := types.UID("rotated-credential-task-uid")
+	plannedTask := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "rotated", UID: taskUID},
+		Spec: corev1alpha1.TaskSpec{Workspace: &corev1alpha1.WorkspaceConfig{
+			ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "workspace-read"},
+		}},
+		Status: corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStatePlanned, Attempt: 1, PromptID: "prompt", ReadCredentialResourceVersion: "7",
+		}},
+	}
+	staleK8sObject := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "workspace-read", UID: "workspace-object-uid", ResourceVersion: "7"},
+		Data:       map[string][]byte{defaultWorkspaceCredentialKey: []byte("stale-test-value")},
+	}
+	rotatedK8sObject := staleK8sObject.DeepCopy()
+	rotatedK8sObject.ResourceVersion = "8"
+	rotatedK8sObject.Data[defaultWorkspaceCredentialKey] = []byte("rotated-test-value")
+	attempt := &corev1alpha1.PromptAttempt{ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "rotated-attempt"}, Spec: corev1alpha1.PromptAttemptSpec{
+		TaskUID: string(taskUID), Attempt: 1, PromptID: "prompt",
+		CredentialBindings: []corev1alpha1.PromptCredentialBinding{
+			{Role: "SourceRead", Namespace: "default", SecretName: "workspace-read", SecretKey: defaultWorkspaceCredentialKey, SecretUID: "workspace-object-uid", ResourceVersion: "7"},
+		},
+	}}
+	effect := publisherEffectForTest(
+		"workspace-rotated-credential-effect", "workspace.prepare", string(taskUID), "workspace-prepare-prompt",
+	)
+	cachedClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(
+		plannedTask, staleK8sObject, attempt, effect,
+	).Build()
+	uncachedReader := fake.NewClientBuilder().WithScheme(scheme).WithObjects(
+		plannedTask.DeepCopy(), rotatedK8sObject, attempt.DeepCopy(), effect.DeepCopy(),
+	).Build()
+	request := publisherservice.CredentialMaterialRequest{
+		ParentOperation: publisherservice.OperationWorkspacePrepare,
+		Metadata:        publisherservice.OperationMetadata{Namespace: "default", TaskID: string(taskUID), OperationID: "workspace-prepare-prompt"},
+		Reference: publisherservice.CredentialReference{
+			Name: "workspace-read", Kind: publisherservice.CredentialHTTPExtraHeader, Role: publisherservice.CredentialRoleSourceRead,
+		},
+	}
+
+	app := fiber.New()
+	server := &Server{app: app, client: cachedClient, config: ServerConfig{APIReader: uncachedReader}}
+	server.installACPArtifactAuthorizationBroker()
+	body, err := json.Marshal(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	httpRequest := httptest.NewRequest(http.MethodPost, publisherservice.CredentialBrokerPath, bytes.NewReader(body))
+	httpRequest.Header.Set("Content-Type", "application/json")
+	httpRequest.Header.Set("Authorization", "Bearer "+publisherBearer)
+	httpResponse, err := app.Test(httpRequest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if httpResponse.StatusCode != http.StatusGone {
+		t.Fatalf("status = %d, want %d", httpResponse.StatusCode, http.StatusGone)
+	}
+}
diff --git a/internal/api/acp_credential_broker_test.go b/internal/api/acp_credential_broker_test.go
new file mode 100644
index 000000000..d1dc25270
--- /dev/null
+++ b/internal/api/acp_credential_broker_test.go
@@ -0,0 +1,270 @@
+package api
+
+import (
+	"bytes"
+	"encoding/base64"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gofiber/fiber/v3"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	types "k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/controller"
+	publisherservice "github.com/orka-agents/orka/internal/publisher/service"
+)
+
+func TestPublisherCredentialBrokerReturnsOnlyFrozenOperationCredential(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	publisherToken := strings.Repeat("p", 32)
+	writeAPISecretFile(t, envWorkspacePublisherControllerTokenFile, "publisher-token", []byte(publisherToken))
+	taskUID := types.UID("credential-task-uid")
+	workspace := &corev1alpha1.WorkspaceConfig{
+		Intent:                   corev1alpha1.WorkspaceIntentWrite,
+		ReadCredentialRef:        &corev1alpha1.WorkspaceCredentialReference{Name: "git-read", Key: "token"},
+		PublicationCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "git-publish", Key: "token"},
+	}
+	plannedTask := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "planned", UID: taskUID},
+		Spec:       corev1alpha1.TaskSpec{Workspace: workspace},
+		Status: corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStatePlanned, Attempt: 1, PromptID: "prompt", ReadCredentialResourceVersion: "7",
+		}},
+	}
+	readSecret := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "git-read", UID: "read-secret-uid", ResourceVersion: "7"}, Data: map[string][]byte{"token": []byte("read-canary-token")}}
+	attempt := &corev1alpha1.PromptAttempt{ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "attempt"}, Spec: corev1alpha1.PromptAttemptSpec{
+		TaskUID: string(taskUID), Attempt: 1, PromptID: "prompt",
+		CredentialBindings: []corev1alpha1.PromptCredentialBinding{{Role: "SourceRead", Namespace: "default", SecretName: "git-read", SecretKey: "token", SecretUID: "read-secret-uid", ResourceVersion: "7"}},
+	}}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(
+		plannedTask, readSecret, attempt,
+		publisherEffectForTest("workspace-credential-effect", "workspace.prepare", string(taskUID), "workspace-prepare-prompt"),
+	).Build()
+	request := publisherservice.CredentialMaterialRequest{
+		ParentOperation: publisherservice.OperationWorkspacePrepare,
+		Metadata:        publisherservice.OperationMetadata{Namespace: "default", TaskID: string(taskUID), OperationID: "workspace-prepare-prompt"},
+		Reference:       publisherservice.CredentialReference{Name: "git-read", Kind: publisherservice.CredentialHTTPExtraHeader},
+	}
+	response := callPublisherCredentialBroker(t, kubeClient, publisherToken, request)
+	expected := "Authorization: Basic " + base64.StdEncoding.EncodeToString([]byte("x-access-token:read-canary-token"))
+	if response.Material != expected || response.ResourceVersion != "7" {
+		t.Fatalf("credential response = %#v", response)
+	}
+}
+
+func TestPublisherCredentialBrokerBindsPublicationAndForgePurpose(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	publisherToken := strings.Repeat("p", 32)
+	writeAPISecretFile(t, envWorkspacePublisherControllerTokenFile, "publisher-token", []byte(publisherToken))
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "settled", UID: types.UID("settled-task-uid")},
+		Spec: corev1alpha1.TaskSpec{Workspace: &corev1alpha1.WorkspaceConfig{
+			Intent:                   corev1alpha1.WorkspaceIntentWrite,
+			PublicationCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "git-publish"},
+			ForgeCredentialRef:       &corev1alpha1.WorkspaceCredentialReference{Name: "git-publish"},
+		}},
+		Status: corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateSucceeded, Outcome: corev1alpha1.TaskExecutionOutcomeSucceeded,
+			Attempt: 1, PromptID: "prompt", PublicationCredentialResourceVersion: "11", ForgeCredentialResourceVersion: "11",
+		}},
+	}
+	publicationID := controller.ACPPublicationIDForTask(task)
+	publication := &corev1alpha1.Publication{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "publication"},
+		Spec:       corev1alpha1.PublicationSpec{ID: publicationID, TaskUID: string(task.UID)},
+		Status:     corev1alpha1.PublicationStatus{State: corev1alpha1.PublicationControlState("Verifying")},
+	}
+	publishSecret := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "git-publish", UID: "publish-secret-uid", ResourceVersion: "11"}, Data: map[string][]byte{"token": []byte("forge-canary-token")}}
+	attempt := &corev1alpha1.PromptAttempt{ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "attempt"}, Spec: corev1alpha1.PromptAttemptSpec{
+		TaskUID: string(task.UID), Attempt: 1, PromptID: "prompt",
+		CredentialBindings: []corev1alpha1.PromptCredentialBinding{{Role: "Forge", Namespace: "default", SecretName: "git-publish", SecretKey: "token", SecretUID: "publish-secret-uid", ResourceVersion: "11"}},
+	}}
+	prOperation := controller.ACPPublicationOperationID("pr-reconcile", task)
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(
+		task, publication, publishSecret, attempt,
+		publisherEffectForTest("forge-credential-effect", "publisher.pull-request", publicationID, prOperation),
+	).Build()
+	request := publisherservice.CredentialMaterialRequest{
+		ParentOperation: publisherservice.OperationPullRequestReconcile,
+		Metadata:        publisherservice.OperationMetadata{Namespace: "default", PublicationID: publicationID, OperationID: prOperation},
+		Reference:       publisherservice.CredentialReference{Name: "git-publish", Kind: publisherservice.CredentialForgeToken},
+	}
+	response := callPublisherCredentialBroker(t, kubeClient, publisherToken, request)
+	if response.Material != "forge-canary-token" || response.ResourceVersion != "11" {
+		t.Fatalf("credential response = %#v", response)
+	}
+}
+
+func TestPublisherCredentialBrokerUsesFreshSucceededTaskAndPromptAttemptState(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	publisherBearer := strings.Repeat("p", 32)
+	writeAPISecretFile(t, envWorkspacePublisherControllerTokenFile, "publisher-broker-auth", []byte(publisherBearer))
+
+	taskUID := types.UID("fresh-credential-task-uid")
+	freshTask := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "publisher-task", UID: taskUID},
+		Spec: corev1alpha1.TaskSpec{Workspace: &corev1alpha1.WorkspaceConfig{
+			PublicationReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "git-publish-read"},
+		}},
+		Status: corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateSucceeded, Outcome: corev1alpha1.TaskExecutionOutcomeSucceeded,
+			Attempt: 1, PromptID: "fresh-prompt", PublicationReadCredentialResourceVersion: "13",
+		}},
+	}
+	staleTask := freshTask.DeepCopy()
+	staleTask.Status.Execution.State = corev1alpha1.TaskExecutionStateRunning
+
+	credentialValue := "fixture-value"
+	publicationID := controller.ACPPublicationIDForTask(freshTask)
+	operationID := controller.ACPPublicationOperationID("preflight", freshTask)
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "default", Name: "git-publish-read", UID: "credential-object-uid", ResourceVersion: "13",
+		},
+		Data: map[string][]byte{"token": []byte(credentialValue)},
+	}
+	attempt := &corev1alpha1.PromptAttempt{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "fresh-attempt"},
+		Spec: corev1alpha1.PromptAttemptSpec{
+			TaskUID: string(taskUID), Attempt: 1, PromptID: "fresh-prompt",
+			CredentialBindings: []corev1alpha1.PromptCredentialBinding{{
+				Role: "TargetRead", Namespace: "default", SecretName: "git-publish-read", SecretKey: "token",
+				SecretUID: "credential-object-uid", ResourceVersion: "13",
+			}},
+		},
+	}
+	effect := publisherEffectForTest(
+		"fresh-preflight-credential-effect", "publisher.preflight", publicationID, operationID,
+	)
+	cachedClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(
+		staleTask, secret.DeepCopy(), effect.DeepCopy(),
+	).Build()
+	apiReader := fake.NewClientBuilder().WithScheme(scheme).WithObjects(
+		freshTask, secret, attempt, effect,
+	).Build()
+	request := publisherservice.CredentialMaterialRequest{
+		ParentOperation: publisherservice.OperationPublicationPreflight,
+		Metadata: publisherservice.OperationMetadata{
+			Namespace: "default", PublicationID: publicationID, OperationID: operationID,
+		},
+		Reference: publisherservice.CredentialReference{
+			Name: "git-publish-read", Kind: publisherservice.CredentialHTTPExtraHeader,
+		},
+	}
+
+	app := fiber.New()
+	server := &Server{app: app, client: cachedClient, config: ServerConfig{APIReader: apiReader}}
+	server.installACPArtifactAuthorizationBroker()
+	body, err := json.Marshal(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	httpRequest := httptest.NewRequest(http.MethodPost, publisherservice.CredentialBrokerPath, bytes.NewReader(body))
+	httpRequest.Header.Set("Content-Type", "application/json")
+	httpRequest.Header.Set("Authorization", "Bearer "+publisherBearer)
+	httpResponse, err := app.Test(httpRequest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if httpResponse.StatusCode != http.StatusOK {
+		t.Fatalf("status = %d, want %d", httpResponse.StatusCode, http.StatusOK)
+	}
+	var response publisherservice.CredentialMaterialResponse
+	if err := json.NewDecoder(httpResponse.Body).Decode(&response); err != nil {
+		t.Fatal(err)
+	}
+	expected := "Authorization: Basic " + base64.StdEncoding.EncodeToString([]byte("x-access-token:"+credentialValue))
+	if response.Material != expected || response.ResourceVersion != "13" {
+		t.Fatalf("credential response = %#v", response)
+	}
+}
+
+func callPublisherCredentialBroker(
+	t *testing.T,
+	kubeClient client.Client,
+	publisherToken string,
+	request publisherservice.CredentialMaterialRequest,
+) publisherservice.CredentialMaterialResponse {
+	t.Helper()
+	app := fiber.New()
+	server := &Server{app: app, client: kubeClient}
+	server.installACPArtifactAuthorizationBroker()
+	body, err := json.Marshal(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	httpRequest := httptest.NewRequest(http.MethodPost, publisherservice.CredentialBrokerPath, bytes.NewReader(body))
+	httpRequest.Header.Set("Content-Type", "application/json")
+	httpRequest.Header.Set("Authorization", "Bearer "+publisherToken)
+	httpResponse, err := app.Test(httpRequest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if httpResponse.StatusCode != http.StatusOK {
+		t.Fatalf("status = %d", httpResponse.StatusCode)
+	}
+	var response publisherservice.CredentialMaterialResponse
+	if err := json.NewDecoder(httpResponse.Body).Decode(&response); err != nil {
+		t.Fatal(err)
+	}
+	return response
+}
+
+func TestFormatPublisherCredentialForGitAndForge(t *testing.T) {
+	basicValue := base64.StdEncoding.EncodeToString([]byte("custom-user:custom-token"))
+	tests := []struct {
+		name    string
+		kind    publisherservice.CredentialKind
+		value   string
+		want    string
+		wantErr bool
+	}{
+		{name: "raw git token uses x-access-token basic auth", kind: publisherservice.CredentialHTTPExtraHeader, value: "raw-token", want: "Authorization: Basic " + base64.StdEncoding.EncodeToString([]byte("x-access-token:raw-token"))},
+		{name: "explicit bearer header is preserved", kind: publisherservice.CredentialHTTPExtraHeader, value: "Authorization: Bearer explicit-token", want: "Authorization: Bearer explicit-token"},
+		{name: "explicit basic header is preserved", kind: publisherservice.CredentialHTTPExtraHeader, value: "Authorization: Basic " + basicValue, want: "Authorization: Basic " + basicValue},
+		{name: "raw forge token stays raw", kind: publisherservice.CredentialForgeToken, value: "forge-token", want: "forge-token"},
+		{name: "bearer forge header is unwrapped", kind: publisherservice.CredentialForgeToken, value: "Authorization: Bearer forge-token", want: "forge-token"},
+		{name: "basic forge header is rejected", kind: publisherservice.CredentialForgeToken, value: "Authorization: Basic " + basicValue, wantErr: true},
+		{name: "malformed basic header is rejected", kind: publisherservice.CredentialHTTPExtraHeader, value: "Authorization: Basic not-base64", wantErr: true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := formatPublisherCredential(tt.kind, []byte(tt.value))
+			if tt.wantErr {
+				if err == nil {
+					t.Fatalf("formatPublisherCredential() = %q, want error", got)
+				}
+				return
+			}
+			if err != nil || got != tt.want {
+				t.Fatalf("formatPublisherCredential() = %q, %v, want %q, nil", got, err, tt.want)
+			}
+		})
+	}
+}
diff --git a/internal/api/acp_mcp_broker_registration.go b/internal/api/acp_mcp_broker_registration.go
new file mode 100644
index 000000000..ae9792a7b
--- /dev/null
+++ b/internal/api/acp_mcp_broker_registration.go
@@ -0,0 +1,34 @@
+package api
+
+import (
+	"fmt"
+
+	"github.com/gofiber/fiber/v3"
+	"github.com/gofiber/fiber/v3/middleware/adaptor"
+
+	"github.com/orka-agents/orka/internal/controller"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+// RegisterACPMCPBroker installs the controller-side prompt MCP broker without
+// coupling broker construction to Server or cmd/main.go. Callers construct the
+// broker with the current durable stores and controller clients, then register
+// it before starting the Fiber app.
+func RegisterACPMCPBroker(app *fiber.App, broker *controller.ACPMCPBroker) error {
+	if app == nil {
+		return fmt.Errorf("fiber app is required")
+	}
+	if err := broker.Validate(); err != nil {
+		return err
+	}
+	app.Post(harnessv2.MCPBrokerCallPath, adaptor.HTTPHandler(broker))
+	return nil
+}
+
+// RegisterACPMCPBroker installs the prompt-scoped broker on this API server.
+func (s *Server) RegisterACPMCPBroker(broker *controller.ACPMCPBroker) error {
+	if s == nil {
+		return fmt.Errorf("api server is required")
+	}
+	return RegisterACPMCPBroker(s.app, broker)
+}
diff --git a/internal/api/acp_mcp_broker_registration_test.go b/internal/api/acp_mcp_broker_registration_test.go
new file mode 100644
index 000000000..03b0fd6c8
--- /dev/null
+++ b/internal/api/acp_mcp_broker_registration_test.go
@@ -0,0 +1,58 @@
+package api
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/gofiber/fiber/v3"
+
+	"github.com/orka-agents/orka/internal/controller"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+func TestRegisterACPMCPBrokerValidatesDependenciesAndInstallsRoute(t *testing.T) {
+	app := fiber.New()
+	if err := RegisterACPMCPBroker(app, &controller.ACPMCPBroker{}); err == nil {
+		t.Fatal("invalid broker registration unexpectedly succeeded")
+	}
+	broker := &controller.ACPMCPBroker{
+		Credentials: controller.ACPMCPBrokerCredentialResolverFunc(func(context.Context, harnessv2.MCPBrokerCallRequest) (controller.ACPMCPBrokerCredentials, error) {
+			return controller.ACPMCPBrokerCredentials{}, store.ErrNotFound
+		}),
+		Prompts: controller.ACPMCPPromptAuthorizerFunc(func(context.Context, harnessv2.MCPBrokerCallRequest) error { return nil }),
+		Executor: controller.ACPMCPToolExecutorFunc(func(context.Context, harnessv2.MCPBrokerCallRequest, harnessv2.MCPToolDescriptor) (json.RawMessage, error) {
+			return json.RawMessage(`{"ok":true}`), nil
+		}),
+		Effects: inertExternalEffectStore{},
+	}
+	if err := RegisterACPMCPBroker(app, broker); err != nil {
+		t.Fatal(err)
+	}
+	request, err := http.NewRequest(http.MethodPost, harnessv2.MCPBrokerCallPath, strings.NewReader(`{}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	response, err := app.Test(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if response.StatusCode == http.StatusNotFound {
+		t.Fatal("registered MCP broker route returned 404")
+	}
+}
+
+type inertExternalEffectStore struct{}
+
+func (inertExternalEffectStore) ReserveExternalEffect(context.Context, store.ReserveExternalEffectRequest) (*store.ExternalEffect, error) {
+	return nil, store.ErrNotFound
+}
+func (inertExternalEffectStore) GetExternalEffect(context.Context, string) (*store.ExternalEffect, error) {
+	return nil, store.ErrNotFound
+}
+func (inertExternalEffectStore) TransitionExternalEffect(context.Context, store.ExternalEffectTransition) (*store.ExternalEffect, error) {
+	return nil, store.ErrNotFound
+}
diff --git a/internal/api/anthropic_tool_loop.go b/internal/api/anthropic_tool_loop.go
index 36ae23d87..ea35ff90f 100644
--- a/internal/api/anthropic_tool_loop.go
+++ b/internal/api/anthropic_tool_loop.go
@@ -284,23 +284,33 @@ CREATE_AGENT INVARIANTS (a rejected Agent config wastes a child task and is
 your bug — read this section before calling create_agent):
 - runtime.type and model.provider are MUTUALLY EXCLUSIVE on the same Agent.
   - For coders/reviewers that need a workspace (git, shell): set
-    runtime.type=codex|claude|copilot|opencode, set runtime.secretRef, OMIT model.provider.
-    OpenCode requires model.name to be the endpoint-specific model ID.
+    runtime.type=codex|claude|copilot|opencode and OMIT model.provider.
+    OpenCode is a built-in ACP RuntimePool profile. It requires model.name in literal
+    provider/model form (for example openai/gpt-5.4) plus positive, reviewed
+    model.contextWindow and model.maxTokens limits, with contextWindow greater than
+    maxTokens. OMIT systemPrompt and runtime.secretRef/secretRef because OpenCode
+    instructions belong in initialPrompt or Task prompts and credentials come from
+    the controller proxy.
+    For credential-backed compatibility runtimes, set runtime.secretRef when required.
     For codex, claude, and copilot, model.name is optional because the runtime can select a default.
   - For pure LLM analysis personas (no git, no shell): set model.provider
     + model.name, OMIT runtime.
-- Coder/reviewer Agents you create in chat MUST set resources so the worker pod
-  is large enough for real test suites:
+- Built-in ACP RuntimePool Agents (runtime.type=codex|claude|copilot|opencode)
+  MUST OMIT custom Agent resources. Their resource classes are controller-owned;
+  Agent-level requests/limits are rejected until a reviewed RuntimePool resource
+  class is selected.
+- For non-ACP execution paths that support custom Agent resources, size the worker
+  for the workload. A useful starting point for memory-heavy work is:
     resources.requests.memory: "512Mi"
     resources.limits.memory:   "2Gi"   (4Gi for medium repos, 8Gi for large)
-  Without this, "go test ./..." / "npm test" / "pytest" routinely OOMKill the
-  worker and the Task fails with "container OOMKilled".
-- runtime.secretRef naming convention (use list_agents first to see what the
-  cluster actually has; create your own only if none exist):
+  Increase those non-ACP limits when "go test ./..." / "npm test" / "pytest"
+  OOMKills the worker.
+- runtime.secretRef naming convention for credential-backed compatibility runtimes
+  (OpenCode must omit it; use list_agents first to see what the cluster actually has):
     codex   → codex-runtime-{copilot|openai}
     claude  → claude-agent-credentials
     copilot → copilot-runtime
-- gitSecretRef is OPTIONAL on create_agent_task — omit it to trigger
+- readCredentialRef is OPTIONAL on create_agent_task — omit it to trigger
   auto-discovery (Orka looks for git-credentials, github-credentials,
   copilot-token, github-token, git-token in that order).
 
@@ -318,15 +328,15 @@ WORKFLOW:
 4. WAIT: Call wait_for_task repeatedly until the task completes, then fetch_task_output.
 5. VALIDATE: Determine the validation image and command from repository evidence, then run validation with create_container_task before review. Prefer immutable validation: if the implementation result includes headSHA, set workspace.ref to it; otherwise set workspace.branch to the push branch. Set workspace.gitRepo and git credentials, and do not set workspace.pushBranch for read-only validation. If the validation environment is not clear, first run a read-only discovery container task with the default worker image to inspect CI workflows, language/toolchain files, Dockerfiles/devcontainers, Makefiles, and docs. For Go repositories: BEFORE picking a Go image, run ONE discovery container task with image="alpine/git" command=["sh","-c"] args=["cd /workspace && head -10 go.mod"] to read the toolchain/go directive verbatim; then choose golang:<exact toolchain major.minor>. NEVER guess the Go version — picking golang:1.23 when go.mod says toolchain go1.25 wastes the entire validation iteration ('go.mod requires go >= 1.25'). The worker filesystem is read-only outside /tmp, /home/worker, /workspace, so the default Go module cache (/go/pkg/mod) and build cache (/root/.cache/go-build) are NOT writable — every go command must use writable GOCACHE and GOMODCACHE under /tmp. Wrap the WHOLE command chain with 'export GOCACHE=/tmp/gocache GOMODCACHE=/tmp/gomodcache && ...' (or repeat the inline prefix on EVERY chained go subcommand). The pattern 'GOCACHE=/tmp/gocache go test ./... && go build ./...' is WRONG — inline env vars apply only to the first command, and 'go build' reverts to /go/pkg and crashes with 'could not create module cache: mkdir /go/pkg: read-only file system'. For ALL container tasks: command MUST be ["sh","-c"] (or the image's actual entrypoint) — NEVER ["bash","-lc"]. Login shells reset PATH from /etc/profile and break the golang:*, node:*, python:* official images that put their tool on PATH via Dockerfile ENV ('bash: line 1: go: command not found'). Report the selected image, command, and evidence. If validation config cannot be determined confidently, report VALIDATION_CONFIG_BLOCKED. If validation fails, delegate a focused repair to the coder and repeat validation before review. Use at most 6 validation repair tasks; if validation still fails, report VALIDATION_BLOCKED.
 6. REVIEW: Create one or more SEPARATE reviewer tasks via create_agent_task (NEVER
-   create_ai_task — code review requires git access to fetch the branch, run 'git diff',
-   and run the project's tests; the ai worker has no git workspace and may have no
+   create_ai_task — code review requires a materialized repository workspace and the
+   project's tests; the ai worker has no repository workspace and may have no
    upstream LLM credentials in this cluster, so create_ai_task reviewers fail with
    'API key for ... not found' even when the Agent shape is otherwise valid). The
    reviewer Agent MUST be runtime-backed (runtime.type=codex|claude|copilot|opencode), NOT an
    LLM-only analysis Agent. Use the REVIEW PROMPT template below.
    CRITICAL: Set workspace.branch to the implementation push branch. OMIT workspace.pushBranch
-   entirely — reviewers are READ-ONLY. The Codex/Claude/Copilot/OpenCode worker stages and pushes any
-   uncommitted diff after the agent finishes; reviewers write no code, so a set pushBranch
+   entirely — reviewers are READ-ONLY. Orka's clean-room Publisher stages and pushes only
+   independently verified workspace deltas; reviewers write no code, so a set pushBranch
    triggers 'failed to finalize result: ORKA_PUSH_BRANCH=... but no workspace diff was produced'
    and the review Task fails even when the review itself was correct.
 7. WAIT + EVALUATE: wait_for_task for all reviewers, then fetch_task_output.
@@ -511,7 +521,7 @@ CRITICAL RULES:
 - Delegate deliberately — do enough research to scope the task, then let agents do the deep dive
 - ALWAYS validate and review after implementation — never skip either step
 - When a child Task fails, ALWAYS fetch_task_output AND check Status.Message for these signals:
-  - "OOMKilled" or "memory limit ... exceeded" → recreate the Agent: call create_agent again (a fresh name) with resources.limits.memory doubled, then use the returned name on a NEW task. Do NOT retry the same Agent; the new Task will OOM the same way.
+  - "OOMKilled" or "memory limit ... exceeded" → first identify the execution path. For a built-in ACP RuntimePool Agent, DO NOT add custom Agent resources; resource classes are controller-owned. Reuse an Agent backed by a suitable reviewed RuntimePool resource class, or report the blocker if none is available. For a non-ACP path that supports custom Agent resources, recreate the Agent with a fresh name and doubled resources.limits.memory, then use the returned name on a NEW task. Do NOT retry the same undersized Agent.
   - "failed to get agent" / "Agent.core.orka.ai ... not found" → the agentRef you passed is not an existing Agent. See AGENT_REF SOURCING. Call create_agent (name + correct shape) and use the returned name on a NEW create_agent_task / create_ai_task. Do NOT retry the failed Task — the missing-Agent error is permanent for that Task object.
   - "container exited with code" → fetch_task_output for the actual error. If fetch_task_output returns a real error string, fix it in the next coder Task (build/test failure) or recreate the Agent (runtime config wrong). If fetch_task_output returns EMPTY / "task has no result yet" while Status.Message says "container exited with code 1", the worker pod crashed BEFORE writing its result configmap — most commonly because git push was rejected (the pushBranch already exists on the remote and the coder's fresh main-based checkout cannot fast-forward). Recovery: create a NEW create_agent_task with a DIFFERENT, suffixed pushBranch (e.g. append "-retry-<short-suffix>" or generate a fresh "orka/<topic>-<8-hex>"). Do NOT declare VALIDATION_BLOCKED on the first occurrence — empty output from a runtime container is much more often a workspace/git problem than a credentials problem; runtime credentials, when broken, produce auth-specific error strings via fetch_task_output, not silent crashes.
   - "failed to push some refs" / "[rejected] (fetch first)" / "non-fast-forward" → the pushBranch you chose already exists on the remote with commits the coder didn't see. Generate a FRESH unique pushBranch (NEW 8-char hex suffix per the WORKSPACE BRANCH RULES — placeholder shape "orka/<topic>-<NEWLY-GENERATED-hex>", do NOT reuse the suffix from the rejected branch or any suffix you've seen in this prompt) and retry the task. Do NOT retry the same branch name — it will reject the same way.
@@ -522,8 +532,8 @@ CRITICAL RULES:
   - "go: command not found" with a golang:* image → you used ["bash","-lc"] which resets PATH. Re-issue the container task with command=["sh","-c"] (the official images put go on PATH via Dockerfile ENV, which a non-login sh -c preserves).
   - "go.mod requires go >= X.Y" → your validation image's Go is too old. Re-issue the container task with image="golang:<X.Y or newer>". For future tasks against the same repo, always read go.mod first (one-line discovery container task) and pick the image from the toolchain directive.
   - "could not create module cache" / "mkdir /go/pkg: read-only file system" / "mkdir /root/.cache: read-only file system" → the worker FS is read-only outside /tmp, /home/worker, /workspace. Default Go caches (/go/pkg/mod, /root/.cache/go-build) are NOT writable. Re-issue the container task wrapping the WHOLE chain: 'export GOCACHE=/tmp/gocache GOMODCACHE=/tmp/gomodcache && go test ./... && go build ./... && go vet ./...'. Inline 'GOCACHE=/tmp/gocache GOMODCACHE=/tmp/gomodcache go test && go build' does NOT propagate the env to chained subcommands — the prefix only applies to 'go test', then 'go build' reverts to /go/pkg and crashes the same way. Same pattern for any language with default caches outside writable paths (e.g. npm: 'export npm_config_cache=/tmp/npm-cache'; pip: 'export PIP_CACHE_DIR=/tmp/pip-cache').
-  - "API key for ... not found" / "anthropic api key" / "openai api key" on an ai task → the ai worker tried to call the upstream provider SDK directly but the worker pod has no upstream credentials. This cluster routes through Orka providers; ai workers may have no direct API keys for upstream providers. Recovery: switch the task from create_ai_task to create_agent_task with a runtime-backed Agent (codex/claude/copilot/opencode — the runtime carries its own credentials). For reviewer/QA personas this is ALWAYS the right shape; the runtime workspace also gives the reviewer the git access it needs to fetch the branch. Do NOT retry the same ai task with a different LLM-only Agent — the credential gap is in the worker pod, not the Agent shape.
-  - "git secret ... not found" → omit gitSecretRef on create_agent_task so Orka auto-discovers from the candidate list.
+  - "API key for ... not found" / "anthropic api key" / "openai api key" on an ai task → the ai worker tried to call the upstream provider SDK directly but the worker pod has no upstream credentials. This cluster routes through Orka providers; ai workers may have no direct API keys for upstream providers. Recovery: switch the task from create_ai_task to create_agent_task with a runtime-backed Agent (codex/claude/copilot/opencode — built-in profiles use the controller provider proxy). For reviewer/QA personas this is ALWAYS the right shape; the runtime receives the materialized repository workspace while Git credentials remain outside the ACP process. Do NOT retry the same ai task with a different LLM-only Agent — the credential gap is in the worker pod, not the Agent shape.
+  - "git secret ... not found" → omit readCredentialRef on create_agent_task so Orka auto-discovers from the candidate list.
 - A failed Agent shape is YOUR bug — fix the Agent before retrying. The same broken Agent will fail every Task you assign to it.
 - Validation/review→fix cycle continues until validation passes and every reviewer says LGTM or APPROVED, with MAX 6 validation repair tasks and MAX 8 review repair tasks. If still failing after the relevant repair limit, report VALIDATION_BLOCKED or REVIEW_BLOCKED with remaining issues and stop
 - If wait_for_task says still running, call wait_for_task again immediately
diff --git a/internal/api/anthropic_tool_loop_test.go b/internal/api/anthropic_tool_loop_test.go
index bd43380e6..a2c7cc179 100644
--- a/internal/api/anthropic_tool_loop_test.go
+++ b/internal/api/anthropic_tool_loop_test.go
@@ -40,7 +40,19 @@ func TestCoordinatorSystemPrompt_CreateAgentInvariants(t *testing.T) {
 		"CREATE_AGENT INVARIANTS",
 		"MUTUALLY EXCLUSIVE",
 		"runtime.type=codex|claude|copilot|opencode",
-		"OpenCode requires model.name",
+		"OpenCode is a built-in ACP RuntimePool profile",
+		"model.name in literal",
+		"provider/model form",
+		"positive, reviewed",
+		"model.contextWindow and model.maxTokens limits",
+		"contextWindow greater than",
+		"OMIT systemPrompt and runtime.secretRef/secretRef",
+		"instructions belong in initialPrompt or Task prompts",
+		"Built-in ACP RuntimePool Agents",
+		"MUST OMIT custom Agent resources",
+		"resource classes are controller-owned",
+		"Agent-level requests/limits are rejected",
+		"For non-ACP execution paths that support custom Agent resources",
 		"runtime-backed Agent (codex/claude/copilot/opencode",
 		"resources.limits.memory:   \"2Gi\"",
 		"auto-discovery",
@@ -49,6 +61,14 @@ func TestCoordinatorSystemPrompt_CreateAgentInvariants(t *testing.T) {
 			t.Fatalf("coordinator prompt missing create-agent invariant %q", want)
 		}
 	}
+
+	for _, banned := range []string{
+		"Coder/reviewer Agents you create in chat MUST set resources",
+	} {
+		if strings.Contains(prompt, banned) {
+			t.Fatalf("coordinator prompt still contains contradictory ACP resource instruction %q", banned)
+		}
+	}
 }
 
 func TestCoordinatorSystemPrompt_GoalState(t *testing.T) {
@@ -75,6 +95,9 @@ func TestCoordinatorSystemPrompt_FailureSignalHandling(t *testing.T) {
 
 	for _, want := range []string{
 		"\"OOMKilled\" or \"memory limit ... exceeded\"",
+		"For a built-in ACP RuntimePool Agent, DO NOT add custom Agent resources",
+		"resource classes are controller-owned",
+		"For a non-ACP path that supports custom Agent resources",
 		"\"container exited with code\"",
 		"\"agent ... has both runtime and model.provider set\"",
 		"\"git secret ... not found\"",
@@ -114,7 +137,7 @@ func TestCoordinatorSystemPrompt_AgentRefSourcing(t *testing.T) {
 	}
 }
 
-// The Codex/Claude/Copilot/OpenCode worker stages, commits, and pushes the agent's
+// The clean-room Publisher stages, commits, and pushes the agent's
 // uncommitted changes to ORKA_PUSH_BRANCH after PHASE 4. If the IMPLEMENTATION
 // PROMPT tells the agent to push itself, the agent runs `git push origin HEAD`,
 // the commit lands on whatever branch is checked out (often main), and the
@@ -388,13 +411,13 @@ func TestCoordinatorSystemPrompt_Demo10ContainerCacheAndReviewerTypeGuardrails(t
 		"Inline 'GOCACHE=/tmp/gocache GOMODCACHE=/tmp/gomodcache go test && go build' does NOT propagate the env to chained subcommands",
 		// (b) WORKFLOW step 6 — reviewers use create_agent_task not create_ai_task
 		"Create one or more SEPARATE reviewer tasks via create_agent_task (NEVER\n   create_ai_task",
-		"code review requires git access to fetch the branch",
+		"code review requires a materialized repository workspace",
 		"create_ai_task reviewers fail with\n   'API key for ... not found'",
 		"The\n   reviewer Agent MUST be runtime-backed",
 		// (b) failure-signal handler for ai worker missing credentials
 		`"API key for ... not found"`,
 		"switch the task from create_ai_task to create_agent_task",
-		"the runtime workspace also gives the reviewer the git access it needs",
+		"Git credentials remain outside the ACP process",
 	} {
 		if !strings.Contains(prompt, want) {
 			t.Fatalf("coordinator prompt missing demo-10 container-cache/reviewer-type guardrail %q", want)
diff --git a/internal/api/artifact_handlers_test.go b/internal/api/artifact_handlers_test.go
index 487eefde4..aa1a282b0 100644
--- a/internal/api/artifact_handlers_test.go
+++ b/internal/api/artifact_handlers_test.go
@@ -15,7 +15,6 @@ import (
 	"net/http/httptest"
 	"strings"
 	"testing"
-	"time"
 
 	"github.com/gofiber/fiber/v3"
 	"github.com/stretchr/testify/require"
@@ -87,267 +86,6 @@ func TestUploadArtifact(t *testing.T) {
 	})
 }
 
-func TestUploadArtifactAllowsHarnessWrapperControlPlaneUpload(t *testing.T) {
-	t.Setenv("POD_NAMESPACE", "orka-system")
-	t.Setenv(harnessWrapperServiceAccountEnv, "agent-harness-wrapper")
-	task := &corev1alpha1.Task{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "wrapped-task",
-			Namespace: "default",
-			Annotations: map[string]string{
-				harnessWrapperStartedAnnotation: "true",
-				harnessWrapperTurnIDAnnotation:  "turn-1",
-				harnessWrapperRuntimeAnnotation: "runtime-1",
-			},
-		},
-		Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent},
-	}
-	scheme := runtime.NewScheme()
-	require.NoError(t, corev1alpha1.AddToScheme(scheme))
-	require.NoError(t, corev1.AddToScheme(scheme))
-	fakeClient := fake.NewClientBuilder().WithScheme(scheme).WithRuntimeObjects(task).Build()
-	db, err := sqlite.NewDB(":memory:")
-	require.NoError(t, err)
-	ss := sqlite.NewStore(db, ":memory:")
-	h := NewInternalHandlers(ss, ss, ss, ss, ss, InternalHandlersConfig{Client: fakeClient})
-	userInfo := &UserInfo{
-		AuthType:  AuthTypeTokenReview,
-		Namespace: "orka-system",
-		Username:  "system:serviceaccount:orka-system:agent-harness-wrapper",
-	}
-	require.NoError(t, h.internalCallerAuthorizer().verifyHarnessWrapperArtifactUpload(context.Background(), userInfo, "default", "wrapped-task"))
-	app := fiber.New()
-	app.Use(func(c fiber.Ctx) error {
-		c.Locals(UserInfoContextKey, userInfo)
-		return c.Next()
-	})
-	app.Post("/internal/v1/artifacts/:namespace/:taskName/:filename", h.UploadArtifact)
-
-	body := []byte("# threat model\n")
-	req := httptest.NewRequest(http.MethodPost,
-		"/internal/v1/artifacts/default/wrapped-task/security-threat-model.md",
-		bytes.NewReader(body))
-	req.Header.Set("Content-Type", "text/markdown")
-	resp, err := app.Test(req)
-	require.NoError(t, err)
-	require.Equal(t, http.StatusCreated, resp.StatusCode)
-
-	data, ct, err := ss.GetArtifact(context.Background(), "default", "wrapped-task", "security-threat-model.md")
-	require.NoError(t, err)
-	require.Equal(t, body, data)
-	require.Equal(t, "text/markdown", ct)
-}
-
-func TestUploadArtifactAllowsPlannedHarnessWrapperControlPlaneUpload(t *testing.T) {
-	t.Setenv("POD_NAMESPACE", "orka-system")
-	t.Setenv(harnessWrapperServiceAccountEnv, "agent-harness-wrapper")
-	task := &corev1alpha1.Task{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "planned-task",
-			Namespace: "default",
-			Annotations: map[string]string{
-				harnessWrapperTurnIDAnnotation:  "turn-1",
-				harnessWrapperRuntimeAnnotation: "runtime-1",
-				harnessWrapperPlannedAtAnno:     time.Now().UTC().Format(time.RFC3339Nano),
-			},
-		},
-		Spec:   corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent},
-		Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhasePending},
-	}
-	scheme := runtime.NewScheme()
-	require.NoError(t, corev1alpha1.AddToScheme(scheme))
-	require.NoError(t, corev1.AddToScheme(scheme))
-	fakeClient := fake.NewClientBuilder().WithScheme(scheme).WithRuntimeObjects(task).Build()
-	db, err := sqlite.NewDB(":memory:")
-	require.NoError(t, err)
-	ss := sqlite.NewStore(db, ":memory:")
-	h := NewInternalHandlers(ss, ss, ss, ss, ss, InternalHandlersConfig{Client: fakeClient})
-	app := fiber.New()
-	app.Use(func(c fiber.Ctx) error {
-		c.Locals(UserInfoContextKey, &UserInfo{
-			AuthType:  AuthTypeTokenReview,
-			Namespace: "orka-system",
-			Username:  "system:serviceaccount:orka-system:agent-harness-wrapper",
-		})
-		return c.Next()
-	})
-	app.Post("/internal/v1/artifacts/:namespace/:taskName/:filename", h.UploadArtifact)
-
-	req := httptest.NewRequest(http.MethodPost,
-		"/internal/v1/artifacts/default/planned-task/output.txt",
-		bytes.NewReader([]byte("artifact")))
-	req.Header.Set("Content-Type", "text/plain")
-	resp, err := app.Test(req)
-	require.NoError(t, err)
-	require.Equal(t, http.StatusCreated, resp.StatusCode)
-}
-
-func TestUploadArtifactRejectsCompletedHarnessWrapperUpload(t *testing.T) {
-	t.Setenv("POD_NAMESPACE", "orka-system")
-	t.Setenv(harnessWrapperServiceAccountEnv, "agent-harness-wrapper")
-	task := &corev1alpha1.Task{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "completed-wrapper-task",
-			Namespace: "default",
-			Annotations: map[string]string{
-				harnessWrapperStartedAnnotation: "true",
-				harnessWrapperTurnIDAnnotation:  "turn-1",
-				harnessWrapperRuntimeAnnotation: "runtime-1",
-			},
-		},
-		Spec:   corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent},
-		Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhaseSucceeded},
-	}
-	scheme := runtime.NewScheme()
-	require.NoError(t, corev1alpha1.AddToScheme(scheme))
-	require.NoError(t, corev1.AddToScheme(scheme))
-	fakeClient := fake.NewClientBuilder().WithScheme(scheme).WithRuntimeObjects(task).Build()
-	db, err := sqlite.NewDB(":memory:")
-	require.NoError(t, err)
-	ss := sqlite.NewStore(db, ":memory:")
-	h := NewInternalHandlers(ss, ss, ss, ss, ss, InternalHandlersConfig{Client: fakeClient})
-	app := fiber.New()
-	app.Use(func(c fiber.Ctx) error {
-		c.Locals(UserInfoContextKey, &UserInfo{
-			AuthType:  AuthTypeTokenReview,
-			Namespace: "orka-system",
-			Username:  "system:serviceaccount:orka-system:agent-harness-wrapper",
-		})
-		return c.Next()
-	})
-	app.Post("/internal/v1/artifacts/:namespace/:taskName/:filename", h.UploadArtifact)
-
-	req := httptest.NewRequest(http.MethodPost,
-		"/internal/v1/artifacts/default/completed-wrapper-task/output.txt",
-		bytes.NewReader([]byte("artifact")))
-	req.Header.Set("Content-Type", "text/plain")
-	resp, err := app.Test(req)
-	require.NoError(t, err)
-	require.Equal(t, http.StatusForbidden, resp.StatusCode)
-}
-
-func TestUploadArtifactRejectsCrossNamespaceNonWrapperTask(t *testing.T) {
-	t.Setenv("POD_NAMESPACE", "orka-system")
-	t.Setenv(harnessWrapperServiceAccountEnv, "agent-harness-wrapper")
-	task := &corev1alpha1.Task{
-		ObjectMeta: metav1.ObjectMeta{Name: "job-task", Namespace: "default"},
-		Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent},
-		Status:     corev1alpha1.TaskStatus{JobName: "job-task-worker"},
-	}
-	scheme := runtime.NewScheme()
-	require.NoError(t, corev1alpha1.AddToScheme(scheme))
-	require.NoError(t, corev1.AddToScheme(scheme))
-	fakeClient := fake.NewClientBuilder().WithScheme(scheme).WithRuntimeObjects(task).Build()
-	db, err := sqlite.NewDB(":memory:")
-	require.NoError(t, err)
-	ss := sqlite.NewStore(db, ":memory:")
-	h := NewInternalHandlers(ss, ss, ss, ss, ss, InternalHandlersConfig{Client: fakeClient})
-	app := fiber.New()
-	app.Use(func(c fiber.Ctx) error {
-		c.Locals(UserInfoContextKey, &UserInfo{
-			AuthType:  AuthTypeTokenReview,
-			Namespace: "orka-system",
-			Username:  "system:serviceaccount:orka-system:agent-harness-wrapper",
-		})
-		return c.Next()
-	})
-	app.Post("/internal/v1/artifacts/:namespace/:taskName/:filename", h.UploadArtifact)
-
-	req := httptest.NewRequest(http.MethodPost,
-		"/internal/v1/artifacts/default/job-task/output.txt",
-		bytes.NewReader([]byte("artifact")))
-	req.Header.Set("Content-Type", "text/plain")
-	resp, err := app.Test(req)
-	require.NoError(t, err)
-	require.Equal(t, http.StatusForbidden, resp.StatusCode)
-}
-
-func TestUploadArtifactRejectsWrongControlPlaneServiceAccount(t *testing.T) {
-	t.Setenv("POD_NAMESPACE", "orka-system")
-	t.Setenv(harnessWrapperServiceAccountEnv, "agent-harness-wrapper")
-	task := &corev1alpha1.Task{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "wrapped-task",
-			Namespace: "default",
-			Annotations: map[string]string{
-				harnessWrapperStartedAnnotation: "true",
-				harnessWrapperTurnIDAnnotation:  "turn-1",
-				harnessWrapperRuntimeAnnotation: "runtime-1",
-			},
-		},
-		Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent},
-	}
-	scheme := runtime.NewScheme()
-	require.NoError(t, corev1alpha1.AddToScheme(scheme))
-	require.NoError(t, corev1.AddToScheme(scheme))
-	fakeClient := fake.NewClientBuilder().WithScheme(scheme).WithRuntimeObjects(task).Build()
-	db, err := sqlite.NewDB(":memory:")
-	require.NoError(t, err)
-	ss := sqlite.NewStore(db, ":memory:")
-	h := NewInternalHandlers(ss, ss, ss, ss, ss, InternalHandlersConfig{Client: fakeClient})
-	app := fiber.New()
-	app.Use(func(c fiber.Ctx) error {
-		c.Locals(UserInfoContextKey, &UserInfo{
-			AuthType:  AuthTypeTokenReview,
-			Namespace: "orka-system",
-			Username:  "system:serviceaccount:orka-system:default",
-		})
-		return c.Next()
-	})
-	app.Post("/internal/v1/artifacts/:namespace/:taskName/:filename", h.UploadArtifact)
-
-	req := httptest.NewRequest(http.MethodPost,
-		"/internal/v1/artifacts/default/wrapped-task/output.txt",
-		bytes.NewReader([]byte("artifact")))
-	req.Header.Set("Content-Type", "text/plain")
-	resp, err := app.Test(req)
-	require.NoError(t, err)
-	require.Equal(t, http.StatusForbidden, resp.StatusCode)
-}
-
-func TestUploadArtifactRejectsFuturePlannedHarnessWrapperUpload(t *testing.T) {
-	t.Setenv("POD_NAMESPACE", "orka-system")
-	t.Setenv(harnessWrapperServiceAccountEnv, "agent-harness-wrapper")
-	task := &corev1alpha1.Task{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "future-planned-task",
-			Namespace: "default",
-			Annotations: map[string]string{
-				harnessWrapperTurnIDAnnotation:  "turn-1",
-				harnessWrapperRuntimeAnnotation: "runtime-1",
-				harnessWrapperPlannedAtAnno:     time.Now().Add(time.Hour).UTC().Format(time.RFC3339Nano),
-			},
-		},
-		Spec:   corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent},
-		Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhasePending},
-	}
-	scheme := runtime.NewScheme()
-	require.NoError(t, corev1alpha1.AddToScheme(scheme))
-	require.NoError(t, corev1.AddToScheme(scheme))
-	fakeClient := fake.NewClientBuilder().WithScheme(scheme).WithRuntimeObjects(task).Build()
-	db, err := sqlite.NewDB(":memory:")
-	require.NoError(t, err)
-	ss := sqlite.NewStore(db, ":memory:")
-	h := NewInternalHandlers(ss, ss, ss, ss, ss, InternalHandlersConfig{Client: fakeClient})
-	app := fiber.New()
-	app.Use(func(c fiber.Ctx) error {
-		c.Locals(UserInfoContextKey, &UserInfo{
-			AuthType:  AuthTypeTokenReview,
-			Namespace: "orka-system",
-			Username:  "system:serviceaccount:orka-system:agent-harness-wrapper",
-		})
-		return c.Next()
-	})
-	app.Post("/internal/v1/artifacts/:namespace/:taskName/:filename", h.UploadArtifact)
-	req := httptest.NewRequest(http.MethodPost,
-		"/internal/v1/artifacts/default/future-planned-task/output.txt",
-		bytes.NewReader([]byte("artifact")))
-	req.Header.Set("Content-Type", "text/plain")
-	resp, err := app.Test(req)
-	require.NoError(t, err)
-	require.Equal(t, http.StatusForbidden, resp.StatusCode)
-}
-
 func TestUploadArtifactTooLarge(t *testing.T) {
 	h, _, _ := setupTestInternalHandlers()
 	// Use a custom app with a large enough body limit so the handler's own
diff --git a/internal/api/auth.go b/internal/api/auth.go
index ed78d89a9..3fd287927 100644
--- a/internal/api/auth.go
+++ b/internal/api/auth.go
@@ -12,6 +12,7 @@ import (
 	"encoding/hex"
 	"errors"
 	"fmt"
+	"slices"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -111,6 +112,12 @@ type AuthConfig struct {
 	OIDC          OIDCConfig
 	ContextTokens ContextTokenConfig
 
+	// TokenReviewAudiences scopes Kubernetes ServiceAccount authentication to
+	// the exact audiences requested by this listener. The cache key includes
+	// the normalized audience set so a token authenticated on an unscoped
+	// listener cannot be replayed against an audience-bound listener.
+	TokenReviewAudiences []string
+
 	// TokenSources optionally overrides the ordered request headers used to
 	// extract authentication tokens. When empty, Authorization: Bearer is used
 	// first and x-api-key remains the fallback.
@@ -190,7 +197,7 @@ func NewAuthMiddleware(c client.Client, configs ...AuthConfig) fiber.Handler {
 
 func authenticateToken(ctx context.Context, c client.Client, token string, cfg AuthConfig) (*UserInfo, error) {
 	if !cfg.OIDC.Enabled() {
-		return validateToken(ctx, c, token)
+		return validateToken(ctx, c, token, cfg.TokenReviewAudiences...)
 	}
 
 	parsedOIDC, oidcErr := parseOIDCTokenCandidate(token, cfg.OIDC)
@@ -207,7 +214,7 @@ func authenticateToken(ctx context.Context, c client.Client, token string, cfg A
 		return nil, oidcErr
 	}
 
-	userInfo, tokenReviewErr := validateToken(ctx, c, token)
+	userInfo, tokenReviewErr := validateToken(ctx, c, token, cfg.TokenReviewAudiences...)
 	if tokenReviewErr == nil {
 		return userInfo, nil
 	}
@@ -225,9 +232,10 @@ func authenticateContextToken(ctx context.Context, token string, profile Context
 	return contextTokenToUserInfo(contextToken), nil
 }
 
-// validateToken validates a ServiceAccount token using TokenReview with caching
-func validateToken(ctx context.Context, c client.Client, token string) (*UserInfo, error) {
-	hash := getTokenHash(token)
+// validateToken validates a ServiceAccount token using TokenReview with caching.
+func validateToken(ctx context.Context, c client.Client, token string, audiences ...string) (*UserInfo, error) {
+	audiences = normalizedTokenReviewAudiences(audiences)
+	hash := tokenReviewCacheKey(token, audiences)
 
 	// Check cache
 	if entry, ok := tokenCache.Load(hash); ok {
@@ -243,7 +251,8 @@ func validateToken(ctx context.Context, c client.Client, token string) (*UserInf
 			Name: "orka-token-review",
 		},
 		Spec: authenticationv1.TokenReviewSpec{
-			Token: token,
+			Token:     token,
+			Audiences: slices.Clone(audiences),
 		},
 	}
 
@@ -257,6 +266,12 @@ func validateToken(ctx context.Context, c client.Client, token string) (*UserInf
 		tokenCache.Delete(hash)
 		return nil, fiber.NewError(fiber.StatusUnauthorized, "token not authenticated")
 	}
+	for _, audience := range audiences {
+		if !slices.Contains(review.Status.Audiences, audience) {
+			tokenCache.Delete(hash)
+			return nil, fiber.NewError(fiber.StatusUnauthorized, "token audience not authenticated")
+		}
+	}
 
 	userInfo := &UserInfo{
 		Username:  review.Status.User.Username,
@@ -279,6 +294,24 @@ func validateToken(ctx context.Context, c client.Client, token string) (*UserInf
 	return userInfo, nil
 }
 
+func normalizedTokenReviewAudiences(audiences []string) []string {
+	normalized := make([]string, 0, len(audiences))
+	for _, audience := range audiences {
+		if audience = strings.TrimSpace(audience); audience != "" && !slices.Contains(normalized, audience) {
+			normalized = append(normalized, audience)
+		}
+	}
+	slices.Sort(normalized)
+	return normalized
+}
+
+func tokenReviewCacheKey(token string, audiences []string) string {
+	if len(audiences) == 0 {
+		return getTokenHash(token)
+	}
+	return getTokenHash(token + "\x00" + strings.Join(audiences, "\x00"))
+}
+
 // GetUserInfo retrieves user info from the context
 func GetUserInfo(ctx fiber.Ctx) *UserInfo {
 	userInfo, ok := ctx.Locals(UserInfoContextKey).(*UserInfo)
diff --git a/internal/api/auth_test.go b/internal/api/auth_test.go
index 95e71098d..803afc38d 100644
--- a/internal/api/auth_test.go
+++ b/internal/api/auth_test.go
@@ -13,6 +13,7 @@ import (
 	"errors"
 	"net/http"
 	"net/http/httptest"
+	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -390,6 +391,50 @@ func TestValidateToken_CacheHit(t *testing.T) {
 	}
 }
 
+func TestValidateToken_AudienceScopedCacheAndResponse(t *testing.T) {
+	tokenCache.Range(func(key, _ any) bool {
+		tokenCache.Delete(key)
+		return true
+	})
+
+	scheme := runtime.NewScheme()
+	_ = authenticationv1.AddToScheme(scheme)
+
+	callCount := 0
+	fakeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithInterceptorFuncs(interceptor.Funcs{
+			Create: func(ctx context.Context, c client.WithWatch, obj client.Object, opts ...client.CreateOption) error {
+				callCount++
+				if tr, ok := obj.(*authenticationv1.TokenReview); ok {
+					tr.Status.Authenticated = true
+					tr.Status.User = authenticationv1.UserInfo{
+						Username: "system:serviceaccount:ns:retirement-hook",
+						UID:      "uid-audience",
+					}
+					if slices.Equal(tr.Spec.Audiences, []string{"retirement"}) {
+						tr.Status.Audiences = []string{"retirement"}
+					}
+				}
+				return nil
+			},
+		}).
+		Build()
+
+	if _, err := validateToken(context.Background(), fakeClient, "shared-token"); err != nil {
+		t.Fatalf("unscoped validateToken failed: %v", err)
+	}
+	if _, err := validateToken(context.Background(), fakeClient, "shared-token", "retirement"); err != nil {
+		t.Fatalf("audience-scoped validateToken failed: %v", err)
+	}
+	if callCount != 2 {
+		t.Fatalf("TokenReview calls = %d, want 2 for isolated unscoped and scoped cache entries", callCount)
+	}
+	if _, err := validateToken(context.Background(), fakeClient, "shared-token", "wrong-audience"); err == nil {
+		t.Fatal("validateToken accepted a TokenReview response without the requested audience")
+	}
+}
+
 func TestValidateToken_NotAuthenticated(t *testing.T) {
 	tokenCache.Range(func(key, _ any) bool {
 		tokenCache.Delete(key)
diff --git a/internal/api/chat.go b/internal/api/chat.go
index 6fb925c43..0f2525d4d 100644
--- a/internal/api/chat.go
+++ b/internal/api/chat.go
@@ -17,6 +17,7 @@ import (
 	"fmt"
 	"regexp"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/gofiber/fiber/v3"
@@ -32,6 +33,7 @@ import (
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
 	"github.com/orka-agents/orka/internal/controller"
+	"github.com/orka-agents/orka/internal/executionmode"
 	"github.com/orka-agents/orka/internal/labels"
 	"github.com/orka-agents/orka/internal/llm"
 	"github.com/orka-agents/orka/internal/store"
@@ -56,6 +58,17 @@ type ChatConfig struct {
 	MaxTasksPerTurn        int
 	MaxSessionSize         int // bytes
 	MaxPrematureEndRetries int // re-prompts when the model emits text without the GOAL_STATE sentinel
+	RuntimeAvailability    ACPRuntimeAvailability
+	ExecutionMode          executionmode.Mode
+}
+
+// ACPRuntimeAvailability identifies built-in profiles backed by configured,
+// digest-pinned RuntimePool images.
+type ACPRuntimeAvailability struct {
+	Codex    bool
+	Claude   bool
+	Copilot  bool
+	OpenCode bool
 }
 
 // ChatRequest is the request body for POST /api/v1/chat.
@@ -105,6 +118,35 @@ type SSEEvent struct {
 	Usage     any    `json:"usage,omitempty"`
 }
 
+type activeChatRequest struct {
+	cancel          context.CancelFunc
+	done            chan struct{}
+	deleteRequested bool
+	deleteWaiters   int
+}
+
+type activeChatHandle struct {
+	cancelContext context.Context
+	finish        func()
+	ownerName     string
+	ownerUID      string
+}
+
+type activeChatReservation struct {
+	cancelContext context.Context
+	cancel        context.CancelFunc
+	request       *activeChatRequest
+	key           string
+	once          sync.Once
+}
+
+type chatSessionLockContextKey struct{}
+
+type chatSessionLockIdentity struct {
+	ownerName string
+	ownerUID  string
+}
+
 // ChatHandler implements the orchestrator chat endpoints.
 type ChatHandler struct {
 	client                    client.Client
@@ -119,6 +161,8 @@ type ChatHandler struct {
 	contextTokenAuthorization ContextTokenAuthorizationConfig
 	cooldownTracker           *llm.CooldownTracker
 	resolver                  *ProviderResolver
+	activeChatsMu             sync.Mutex
+	activeChats               map[string]*activeChatRequest
 }
 
 // NewChatHandler creates a new ChatHandler.
@@ -140,6 +184,7 @@ func NewChatHandler(c client.Client, sm *controller.SessionManager, config ChatC
 		resultStore:               rs,
 		cooldownTracker:           llm.NewCooldownTracker(),
 		resolver:                  resolver,
+		activeChats:               make(map[string]*activeChatRequest),
 	}
 }
 
@@ -150,6 +195,8 @@ var blockedNamespaces = map[string]bool{
 }
 
 // HandleChat handles POST /api/v1/chat.
+//
+//nolint:gocyclo // Auth, provider setup, JSON/SSE streaming, cancellation, and Session fencing share one request boundary.
 func (ch *ChatHandler) HandleChat(c fiber.Ctx) error {
 	var req ChatRequest
 	if err := c.Bind().JSON(&req); err != nil {
@@ -201,10 +248,22 @@ func (ch *ChatHandler) HandleChat(c fiber.Ctx) error {
 	}
 
 	// Resolve or create session ID
-	sessionID := req.SessionID
-	if sessionID == "" {
-		sessionID = fmt.Sprintf("chat-%s", generateChatID())
+	sessionID := resolveChatSessionID(req.SessionID)
+	reservation, err := ch.reserveActiveChat(namespace, sessionID)
+	if err != nil {
+		return chatSessionLockError(err)
 	}
+	var activeChat *activeChatHandle
+	chatLockHandedOff := false
+	stopRequestCancellation := context.AfterFunc(reservation.cancelContext, cancel)
+	defer stopRequestCancellation()
+	defer func() {
+		if activeChat == nil {
+			ch.finishActiveChatReservation(reservation, nil)
+		} else if !chatLockHandedOff {
+			activeChat.finish()
+		}
+	}()
 
 	// Resolve LLM provider
 	provider, model, providerInfo, err := ch.resolver.ResolveWithInfo(ctx, ResolveOpts{
@@ -248,12 +307,20 @@ func (ch *ChatHandler) HandleChat(c fiber.Ctx) error {
 	}()
 
 	// Build system prompt
-	promptBuilder := NewSystemPromptBuilder(ch.client, namespace)
+	promptBuilder := NewSystemPromptBuilder(ch.client, namespace, ch.config.RuntimeAvailability)
 	systemPrompt, err := promptBuilder.BuildSystemPrompt(ctx, req.SystemPrompt, PromptModeFull)
 	if err != nil {
 		chatLog.Error(err, "failed to build system prompt")
 		return fiber.NewError(fiber.StatusInternalServerError, "failed to build system prompt")
 	}
+	activeChat, err = ch.activateReservedChat(ctx, reservation, namespace, sessionID)
+	if err != nil {
+		return chatSessionLockError(err)
+	}
+	ctx = context.WithValue(ctx, chatSessionLockContextKey{}, chatSessionLockIdentity{
+		ownerName: activeChat.ownerName,
+		ownerUID:  activeChat.ownerUID,
+	})
 
 	// Load session history
 	messages, err := ch.loadChatSession(ctx, namespace, sessionID)
@@ -307,6 +374,7 @@ func (ch *ChatHandler) HandleChat(c fiber.Ctx) error {
 
 	// Create tool executor (also creates the chat registry)
 	executor := NewToolExecutor(ch.client, ch.sessionManager, namespace, sessionID, ch.watchNamespace, ch.enforceNamespaceIsolation, ch.config.MaxTasksPerTurn, ch.config.ToolTimeout, ch.resultStore, ch.kubeClient)
+	executor.SetExecutionMode(ch.config.ExecutionMode)
 	executor.provider = providerInfo.Name
 	executor.providerType = providerInfo.Type
 	executor.SetTaskCreateAuthorizer(func(ctx context.Context, task *corev1alpha1.Task) error {
@@ -357,7 +425,6 @@ func (ch *ChatHandler) HandleChat(c fiber.Ctx) error {
 			span.SetStatus(codes.Error, err.Error())
 			return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("chat error: %v", err))
 		}
-
 		return c.JSON(ChatResponse{
 			SessionID: sessionID,
 			Message:   content,
@@ -379,20 +446,35 @@ func (ch *ChatHandler) HandleChat(c fiber.Ctx) error {
 	sseSystemPrompt := systemPrompt
 	sseTools := tools
 	sseExecutor := executor
+	chatDeadline, hasChatDeadline := ctx.Deadline()
 	sseParentCtx := baggage.ContextWithBaggage(
 		trace.ContextWithSpanContext(context.Background(), span.SpanContext()),
 		baggage.FromContext(ctx),
 	)
+	sseParentCtx = context.WithValue(sseParentCtx, chatSessionLockContextKey{}, chatSessionLockIdentity{
+		ownerName: activeChat.ownerName,
+		ownerUID:  activeChat.ownerUID,
+	})
 
 	sseMode = true
-	return c.SendStreamWriter(func(w *bufio.Writer) {
+	chatLockHandedOff = true
+	streamErr := c.SendStreamWriter(func(w *bufio.Writer) {
 		defer span.End()
 		defer func() { <-ch.semaphore }()
+		defer activeChat.finish()
 		// SendStreamWriter outlives the handler, so use a background context
 		// seeded with the originating chat span context rather than Fiber's
 		// recycled request context.
-		sseCtx, sseCancel := context.WithTimeout(sseParentCtx, ch.config.MaxDuration)
+		var sseCtx context.Context
+		var sseCancel context.CancelFunc
+		if hasChatDeadline {
+			sseCtx, sseCancel = context.WithDeadline(sseParentCtx, chatDeadline)
+		} else {
+			sseCtx, sseCancel = context.WithTimeout(sseParentCtx, ch.config.MaxDuration)
+		}
 		defer sseCancel()
+		stopSSECancellation := context.AfterFunc(activeChat.cancelContext, sseCancel)
+		defer stopSSECancellation()
 
 		emitSSE := func(event, data string) {
 			_ = writeSSE(w, event, data)
@@ -418,6 +500,171 @@ func (ch *ChatHandler) HandleChat(c fiber.Ctx) error {
 		doneData, _ := json.Marshal(map[string]any{"usage": usage})
 		emitSSE("done", string(doneData))
 	})
+	if streamErr != nil {
+		sseMode = false
+		chatLockHandedOff = false
+	}
+	return streamErr
+}
+
+func resolveChatSessionID(requested string) string {
+	if requested != "" {
+		return requested
+	}
+	return fmt.Sprintf("chat-%s", generateChatID())
+}
+
+func chatSessionLockError(err error) error {
+	switch {
+	case errors.Is(err, store.ErrGatewayOwnedSession), errors.Is(err, store.ErrNotFound):
+		return fiber.NewError(fiber.StatusNotFound, "chat session not found")
+	case errors.Is(err, store.ErrConflict):
+		return fiber.NewError(fiber.StatusConflict, "chat session is active or its deleted name is reserved")
+	default:
+		return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to lock chat session: %v", err))
+	}
+}
+
+func (ch *ChatHandler) reserveActiveChat(namespace, sessionID string) (*activeChatReservation, error) {
+	cancelContext, cancel := context.WithCancel(context.Background())
+	request := &activeChatRequest{cancel: cancel, done: make(chan struct{})}
+	reservation := &activeChatReservation{
+		cancelContext: cancelContext,
+		cancel:        cancel,
+		request:       request,
+		key:           activeChatKey(namespace, sessionID),
+	}
+	ch.activeChatsMu.Lock()
+	if ch.activeChats == nil {
+		ch.activeChats = make(map[string]*activeChatRequest)
+	}
+	if _, exists := ch.activeChats[reservation.key]; exists {
+		ch.activeChatsMu.Unlock()
+		cancel()
+		return nil, fmt.Errorf("%w: chat session %s/%s already has an active request", store.ErrConflict, namespace, sessionID)
+	}
+	ch.activeChats[reservation.key] = request
+	ch.activeChatsMu.Unlock()
+	return reservation, nil
+}
+
+func (ch *ChatHandler) finishActiveChatReservation(reservation *activeChatReservation, release func()) {
+	if reservation == nil {
+		return
+	}
+	reservation.once.Do(func() {
+		reservation.cancel()
+		if release != nil {
+			release()
+		}
+		ch.activeChatsMu.Lock()
+		if ch.activeChats[reservation.key] == reservation.request && reservation.request.deleteWaiters == 0 {
+			delete(ch.activeChats, reservation.key)
+		}
+		close(reservation.request.done)
+		ch.activeChatsMu.Unlock()
+	})
+}
+
+func (ch *ChatHandler) activateReservedChat(
+	ctx context.Context,
+	reservation *activeChatReservation,
+	namespace, sessionID string,
+) (*activeChatHandle, error) {
+	acquireCtx, acquireCancel := context.WithCancel(ctx)
+	stopAcquireCancellation := context.AfterFunc(reservation.cancelContext, acquireCancel)
+	release, _, lockID, err := ch.acquireChatSession(acquireCtx, namespace, sessionID)
+	stopAcquireCancellation()
+	acquireCancel()
+	if err != nil {
+		return nil, err
+	}
+	return &activeChatHandle{
+		cancelContext: reservation.cancelContext,
+		finish:        func() { ch.finishActiveChatReservation(reservation, release) },
+		ownerName:     lockID,
+		ownerUID:      lockID,
+	}, nil
+}
+
+func (ch *ChatHandler) acquireChatSession(ctx context.Context, namespace, sessionID string) (func(), bool, string, error) {
+	if ch.sessionStore == nil {
+		return nil, false, "", fmt.Errorf("chat Session store is not configured")
+	}
+	created := false
+	sessionType, err := transcriptSessionType(ctx, ch.sessionStore, namespace, sessionID)
+	if errors.Is(err, store.ErrNotFound) {
+		now := time.Now().UTC()
+		createErr := ch.sessionStore.CreateSession(ctx, &store.SessionRecord{
+			Namespace: namespace, Name: sessionID, SessionType: "chat", CreatedAt: now, UpdatedAt: now,
+		})
+		if createErr != nil {
+			sessionType, err = transcriptSessionType(ctx, ch.sessionStore, namespace, sessionID)
+			if err != nil {
+				return nil, false, "", createErr
+			}
+		} else {
+			created = true
+			sessionType = "chat"
+			err = nil
+		}
+	}
+	if err != nil {
+		return nil, created, "", err
+	}
+	if sessionType == store.SessionTypeGateway {
+		return nil, created, "", store.ErrGatewayOwnedSession
+	}
+	lockID := "chat-request-" + generateChatID()
+	var lockErr error
+	if expiring, ok := ch.sessionStore.(store.ExpiringSessionLockStore); ok {
+		lockExpiresAt := time.Now().UTC().Add(ch.config.MaxDuration + time.Minute)
+		if deadline, hasDeadline := ctx.Deadline(); hasDeadline {
+			lockExpiresAt = deadline.UTC().Add(time.Minute)
+		}
+		lockErr = expiring.AcquireLockUntil(ctx, namespace, sessionID, lockID, lockID, lockExpiresAt)
+	} else {
+		lockErr = ch.sessionStore.AcquireLock(ctx, namespace, sessionID, lockID, lockID)
+	}
+	if lockErr != nil {
+		return nil, created, "", lockErr
+	}
+	var once sync.Once
+	return func() {
+		once.Do(func() {
+			releaseCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			defer cancel()
+			if err := ch.sessionStore.ReleaseLock(releaseCtx, namespace, sessionID, lockID, lockID); err != nil && !errors.Is(err, store.ErrNotFound) {
+				chatLog.Error(err, "failed to release chat Session lock", "namespace", namespace, "sessionId", sessionID)
+			}
+		})
+	}, created, lockID, nil
+}
+
+func activeChatKey(namespace, sessionID string) string {
+	return namespace + "\x00" + sessionID
+}
+
+func (ch *ChatHandler) cancelActiveChat(namespace, sessionID string) (*activeChatRequest, bool) {
+	key := activeChatKey(namespace, sessionID)
+	ch.activeChatsMu.Lock()
+	request := ch.activeChats[key]
+	if request == nil {
+		ch.activeChatsMu.Unlock()
+		return nil, false
+	}
+	request.deleteRequested = true
+	request.deleteWaiters++
+	ch.activeChatsMu.Unlock()
+	request.cancel()
+	return request, true
+}
+
+func (ch *ChatHandler) deleteChatSession(ctx context.Context, namespace, sessionID string) error {
+	if ch.sessionManager != nil {
+		return ch.sessionManager.DeleteSession(ctx, namespace, sessionID)
+	}
+	return ch.sessionStore.DeleteSession(ctx, namespace, sessionID)
 }
 
 // runToolLoop executes the agentic tool loop until the LLM produces a final text response.
@@ -568,7 +815,7 @@ func (ch *ChatHandler) handleIterationLimit(
 	usage.Duration = time.Since(start).Round(time.Millisecond).String()
 	usage.TasksCreated = executor.tasksCreated
 	_ = ch.saveChatSession(ctx, namespace, sessionID, finalMessages, persistedCount, *usage)
-	if err := ch.sessionStore.UpdateTokenCounts(ctx, namespace, sessionID, usage.InputTokens, usage.OutputTokens); err != nil {
+	if err := ch.updateChatTokenCounts(ctx, namespace, sessionID, usage.InputTokens, usage.OutputTokens); err != nil {
 		chatLog.Error(err, "failed to update token counts")
 	}
 
@@ -717,7 +964,7 @@ func (ch *ChatHandler) handleFinalResponse(
 	usage.Duration = time.Since(start).Round(time.Millisecond).String()
 	usage.TasksCreated = executor.tasksCreated
 	_ = ch.saveChatSession(ctx, namespace, sessionID, finalMessages, persistedCount, *usage)
-	if err := ch.sessionStore.UpdateTokenCounts(ctx, namespace, sessionID, usage.InputTokens, usage.OutputTokens); err != nil {
+	if err := ch.updateChatTokenCounts(ctx, namespace, sessionID, usage.InputTokens, usage.OutputTokens); err != nil {
 		chatLog.Error(err, "failed to update token counts")
 	}
 
@@ -775,24 +1022,10 @@ func (ch *ChatHandler) loadChatSession(ctx context.Context, namespace, sessionID
 
 // saveChatSession saves chat session messages to the session store.
 func (ch *ChatHandler) saveChatSession(ctx context.Context, namespace, sessionID string, messages []llm.Message, persistedCount int, _ ChatUsage) error {
-	// Check if session exists
-	_, err := ch.sessionStore.GetSession(ctx, namespace, sessionID)
-	if err != nil {
-		if !errors.Is(err, store.ErrNotFound) {
-			return fmt.Errorf("failed to get session: %w", err)
-		}
-		// Create new session
-		now := time.Now()
-		session := &store.SessionRecord{
-			Namespace:   namespace,
-			Name:        sessionID,
-			SessionType: "chat",
-			CreatedAt:   now,
-			UpdatedAt:   now,
-		}
-		if err := ch.sessionStore.CreateSession(ctx, session); err != nil {
-			return fmt.Errorf("failed to create session: %w", err)
-		}
+	// HandleChat creates and locks the Session before provider work begins. A
+	// missing record here is a deletion race and must never recreate history.
+	if _, err := ch.sessionStore.GetSession(ctx, namespace, sessionID); err != nil {
+		return fmt.Errorf("failed to get locked chat session: %w", err)
 	}
 
 	// Only append messages that haven't been persisted yet
@@ -818,9 +1051,35 @@ func (ch *ChatHandler) saveChatSession(ctx context.Context, namespace, sessionID
 		storeMessages = append(storeMessages, sm)
 	}
 
+	if identity, ok := chatSessionLockFromContext(ctx); ok {
+		if fenced, fencedOK := ch.sessionStore.(store.FencedSessionWriteStore); fencedOK {
+			return fenced.AppendMessagesWithLock(
+				ctx, namespace, sessionID, identity.ownerName, identity.ownerUID, storeMessages,
+			)
+		}
+	}
 	return ch.sessionStore.AppendMessages(ctx, namespace, sessionID, storeMessages)
 }
 
+func (ch *ChatHandler) updateChatTokenCounts(ctx context.Context, namespace, sessionID string, inputTokens, outputTokens int) error {
+	if identity, ok := chatSessionLockFromContext(ctx); ok {
+		if fenced, fencedOK := ch.sessionStore.(store.FencedSessionWriteStore); fencedOK {
+			return fenced.UpdateTokenCountsWithLock(
+				ctx, namespace, sessionID, identity.ownerName, identity.ownerUID, inputTokens, outputTokens,
+			)
+		}
+	}
+	return ch.sessionStore.UpdateTokenCounts(ctx, namespace, sessionID, inputTokens, outputTokens)
+}
+
+func chatSessionLockFromContext(ctx context.Context) (chatSessionLockIdentity, bool) {
+	if ctx == nil {
+		return chatSessionLockIdentity{}, false
+	}
+	identity, ok := ctx.Value(chatSessionLockContextKey{}).(chatSessionLockIdentity)
+	return identity, ok && identity.ownerName != "" && identity.ownerUID != ""
+}
+
 // HandleChatConfig handles GET /api/v1/chat/config.
 func (ch *ChatHandler) HandleChatConfig(c fiber.Ctx) error {
 	toolNames := chattools.ChatToolNames()
@@ -853,9 +1112,22 @@ func (ch *ChatHandler) HandleCancelChat(c fiber.Ctx) error {
 	}
 
 	ctx := c.Context()
+	activeCancelled, err := ch.cancelAndWaitForActiveChat(ctx, namespace, sessionID)
+	if err != nil {
+		if errors.Is(err, store.ErrNotReady) {
+			return fiber.NewError(fiber.StatusConflict, "chat cancellation is still in progress")
+		}
+		return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to cancel active chat: %v", err))
+	}
+	if activeCancelled {
+		defer ch.clearChatDeletionGate(namespace, sessionID)
+	}
 	sessionType, err := transcriptSessionType(ctx, ch.sessionStore, namespace, sessionID)
 	if err != nil {
 		if errors.Is(err, store.ErrNotFound) {
+			if activeCancelled {
+				return c.SendStatus(fiber.StatusNoContent)
+			}
 			return fiber.NewError(fiber.StatusNotFound, "chat session not found")
 		}
 		return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to get session type: %v", err))
@@ -864,17 +1136,75 @@ func (ch *ChatHandler) HandleCancelChat(c fiber.Ctx) error {
 		return fiber.NewError(fiber.StatusNotFound, "chat session not found")
 	}
 
-	// Delete the session to cancel it
-	if err := ch.sessionStore.DeleteSession(ctx, namespace, sessionID); err != nil {
+	// Delete the session to cancel it. ACP-enabled servers route through the
+	// fenced cross-store cleanup coordinator.
+	if err := ch.deleteChatSession(ctx, namespace, sessionID); err != nil {
+		if errors.Is(err, store.ErrNotFound) {
+			return c.SendStatus(fiber.StatusNoContent)
+		}
 		if errors.Is(err, store.ErrGatewayOwnedSession) {
 			return fiber.NewError(fiber.StatusNotFound, "chat session not found")
 		}
+		if errors.Is(err, store.ErrConflict) {
+			return fiber.NewError(fiber.StatusConflict, "chat session has active or unsettled work")
+		}
 		return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to cancel session: %v", err))
 	}
 
 	return c.SendStatus(fiber.StatusNoContent)
 }
 
+func (ch *ChatHandler) cancelAndWaitForActiveChat(ctx context.Context, namespace, sessionID string) (bool, error) {
+	request, active := ch.cancelActiveChat(namespace, sessionID)
+	if !active {
+		return false, nil
+	}
+	timer := time.NewTimer(5 * time.Second)
+	defer timer.Stop()
+	select {
+	case <-request.done:
+		return true, nil
+	case <-timer.C:
+		ch.abandonChatDeletionWaiter(namespace, sessionID, request)
+		return true, fmt.Errorf("%w: active chat did not stop before cancellation deadline", store.ErrNotReady)
+	case <-ctx.Done():
+		ch.abandonChatDeletionWaiter(namespace, sessionID, request)
+		return true, ctx.Err()
+	}
+}
+
+func (ch *ChatHandler) clearChatDeletionGate(namespace, sessionID string) {
+	key := activeChatKey(namespace, sessionID)
+	ch.activeChatsMu.Lock()
+	if request := ch.activeChats[key]; request != nil && request.deleteWaiters > 0 {
+		request.deleteWaiters--
+		if request.deleteWaiters == 0 {
+			request.deleteRequested = false
+			delete(ch.activeChats, key)
+		}
+	}
+	ch.activeChatsMu.Unlock()
+}
+
+func (ch *ChatHandler) abandonChatDeletionWaiter(namespace, sessionID string, request *activeChatRequest) {
+	key := activeChatKey(namespace, sessionID)
+	ch.activeChatsMu.Lock()
+	defer ch.activeChatsMu.Unlock()
+	if ch.activeChats[key] != request || request.deleteWaiters == 0 {
+		return
+	}
+	request.deleteWaiters--
+	if request.deleteWaiters != 0 {
+		return
+	}
+	request.deleteRequested = false
+	select {
+	case <-request.done:
+		delete(ch.activeChats, key)
+	default:
+	}
+}
+
 // wrapWithRetryAndFallback wraps a provider with retry logic and adds fallback
 // providers if the agent has them configured.
 func (ch *ChatHandler) wrapWithRetryAndFallback(ctx context.Context, c fiber.Ctx, provider llm.Provider, req ChatRequest, namespace string) (llm.Provider, error) {
diff --git a/internal/api/chat_system_prompt.go b/internal/api/chat_system_prompt.go
index d7b04a26c..e80fc5a0f 100644
--- a/internal/api/chat_system_prompt.go
+++ b/internal/api/chat_system_prompt.go
@@ -12,10 +12,7 @@ import (
 	"fmt"
 	"strings"
 
-	corev1 "k8s.io/api/core/v1"
-
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
-	chattools "github.com/orka-agents/orka/internal/tools"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
@@ -28,8 +25,9 @@ type ConversationMessage struct {
 // SystemPromptBuilder constructs the orchestrator system prompt with
 // dynamic context from the cluster (agents, tools).
 type SystemPromptBuilder struct {
-	client    client.Client
-	namespace string
+	client              client.Client
+	namespace           string
+	runtimeAvailability ACPRuntimeAvailability
 
 	// Cache fields
 	cachedPrompt string
@@ -37,10 +35,15 @@ type SystemPromptBuilder struct {
 }
 
 // NewSystemPromptBuilder creates a new SystemPromptBuilder.
-func NewSystemPromptBuilder(c client.Client, namespace string) *SystemPromptBuilder {
+func NewSystemPromptBuilder(c client.Client, namespace string, availability ...ACPRuntimeAvailability) *SystemPromptBuilder {
+	configured := ACPRuntimeAvailability{}
+	if len(availability) > 0 {
+		configured = availability[0]
+	}
 	return &SystemPromptBuilder{
-		client:    c,
-		namespace: namespace,
+		client:              c,
+		namespace:           namespace,
+		runtimeAvailability: configured,
 	}
 }
 
@@ -200,6 +203,10 @@ func buildTaskTypesSection(mode PromptMode) string {
   workspace config so credentials are automatically mounted:
     create_agent_task(agent: "coder", prompt: "...", gitRepo: "https://github.com/org/repo", timeout: "15m")
   When creating new agents for coding tasks, check the agent_runtimes in the Runtime line above.
+  OpenCode is supported there as a built-in ACP RuntimePool profile when its image is configured. It requires
+  model.name plus reviewed model.contextWindow and model.maxTokens ceilings, uses the controller provider proxy,
+  and does not use runtime.secretRef. When omitted, OpenCode defaults defaultAllowedTools to Read, Write, Edit, Bash, Glob,
+  and Grep, with defaultAllowBash=true; only override these when the user asks.
   Use whichever runtime is available. If multiple runtimes are available, prefer codex, then copilot.
   If no agent runtimes are available, use create_ai_task with agentRef/providerRef for existing non-runtime agents, or create_ai_task directly for LLM-only work.
   Agent tasks need more time than AI tasks. Set timeout to at least 15m.
@@ -214,7 +221,7 @@ func buildTaskTypesSection(mode PromptMode) string {
 func buildValidationSection() string {
 	return `<validation>
 When validating code changes, determine the validation environment from repository evidence rather than demo- or scenario-specific defaults.
-Every validation or discovery container task that inspects repository files MUST include a workspace with workspace.gitRepo, workspace.gitSecretRef when credentials are needed, and the exact branch/ref under test. Prefer workspace.ref = the implementation headSHA; otherwise use workspace.branch = the pushed branch. Do not validate repo changes from an empty container filesystem.
+Every validation or discovery container task that inspects repository files MUST include a workspace with workspace.gitRepo, workspace.readCredentialRef when clone credentials are needed, and the exact branch/ref under test. Prefer workspace.ref = the implementation headSHA; otherwise use workspace.branch = the pushed branch. Do not validate repo changes from an empty container filesystem.
 Before running full validation, inspect the workspace or run a read-only discovery container task with that workspace when needed. Prefer evidence in this order: CI workflow files, language/toolchain files (go.mod, package.json, pyproject.toml, Cargo.toml, etc.), Dockerfile/devcontainer files, Makefile targets, and project documentation.
 For Go repositories, read go.mod and prefer a toolchain directive when present; otherwise use the go directive. Choose a matching golang:<major.minor> image. With golang:<major.minor>, commands MUST export:
   export PATH=/usr/local/go/bin:$PATH
@@ -446,22 +453,18 @@ func (b *SystemPromptBuilder) buildDynamicContext(ctx context.Context) (agentsSe
 		providerNames = append(providerNames, providerList.Items[i].Name)
 	}
 
-	// Detect available agent runtimes by checking for well-known secrets
 	var availableRuntimes []string
-	var secretList corev1.SecretList
-	if err := b.client.List(ctx, &secretList, client.InNamespace(b.namespace)); err == nil {
-		if chattools.FirstUsableRuntimeSecretName(secretList.Items, corev1alpha1.AgentRuntimeCodex) != "" {
-			availableRuntimes = append(availableRuntimes, "codex")
-		}
-		if chattools.FirstUsableRuntimeSecretName(secretList.Items, corev1alpha1.AgentRuntimeCopilot) != "" {
-			availableRuntimes = append(availableRuntimes, "copilot")
-		}
-		if chattools.FirstUsableRuntimeSecretName(secretList.Items, corev1alpha1.AgentRuntimeClaude) != "" {
-			availableRuntimes = append(availableRuntimes, "claude")
-		}
-		if chattools.FirstUsableRuntimeSecretName(secretList.Items, corev1alpha1.AgentRuntimeOpencode) != "" {
-			availableRuntimes = append(availableRuntimes, "opencode")
-		}
+	if b.runtimeAvailability.Codex {
+		availableRuntimes = append(availableRuntimes, "codex")
+	}
+	if b.runtimeAvailability.Copilot {
+		availableRuntimes = append(availableRuntimes, "copilot")
+	}
+	if b.runtimeAvailability.Claude {
+		availableRuntimes = append(availableRuntimes, "claude")
+	}
+	if b.runtimeAvailability.OpenCode {
+		availableRuntimes = append(availableRuntimes, "opencode")
 	}
 
 	runtimeInfo := "none"
diff --git a/internal/api/chat_system_prompt_test.go b/internal/api/chat_system_prompt_test.go
index 2a0811416..796c5ce1c 100644
--- a/internal/api/chat_system_prompt_test.go
+++ b/internal/api/chat_system_prompt_test.go
@@ -20,7 +20,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
-	"github.com/orka-agents/orka/internal/workerenv"
 )
 
 func TestNewSystemPromptBuilder(t *testing.T) {
@@ -135,6 +134,10 @@ func TestBuildTaskTypesSection(t *testing.T) {
 				"Use create_agent_task only for Agents that have runtime listed",
 				"use create_ai_task with agentRef and providerRef instead",
 				"Do NOT use create_agent_task for non-runtime agents",
+				"OpenCode is supported there as a built-in ACP RuntimePool profile when its image is configured",
+				"does not use runtime.secretRef",
+				"defaults defaultAllowedTools to Read, Write, Edit, Bash, Glob",
+				"defaultAllowBash=true",
 			} {
 				if !strings.Contains(s, want) {
 					t.Errorf("missing %q", want)
@@ -492,6 +495,7 @@ func TestComputeHash(t *testing.T) {
 	})
 }
 
+//nolint:gocyclo // Table-driven subtests cover the complete dynamic prompt inventory.
 func TestBuildDynamicContext(t *testing.T) {
 	scheme := runtime.NewScheme()
 	_ = corev1alpha1.AddToScheme(scheme)
@@ -581,93 +585,64 @@ func TestBuildDynamicContext(t *testing.T) {
 		}
 	})
 
-	t.Run("copilot runtime detected from copilot-token secret", func(t *testing.T) {
-		secret := &corev1.Secret{
-			ObjectMeta: metav1.ObjectMeta{Name: "copilot-token", Namespace: "default"},
-		}
-		c := fake.NewClientBuilder().WithScheme(scheme).WithObjects(secret).Build()
-		b := NewSystemPromptBuilder(c, "default")
-
-		_, _, providers, _, err := b.buildDynamicContext(context.Background())
-		if err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		if !strings.Contains(providers, "copilot") {
-			t.Errorf("providers = %q, expected copilot runtime", providers)
-		}
-	})
-
-	t.Run("claude runtime detected from claude-credentials secret", func(t *testing.T) {
-		secret := &corev1.Secret{
-			ObjectMeta: metav1.ObjectMeta{Name: "claude-credentials", Namespace: "default"},
-		}
-		c := fake.NewClientBuilder().WithScheme(scheme).WithObjects(secret).Build()
-		b := NewSystemPromptBuilder(c, "default")
+	t.Run("configured built-in runtime images are advertised without Agent secrets", func(t *testing.T) {
+		c := fake.NewClientBuilder().WithScheme(scheme).Build()
+		b := NewSystemPromptBuilder(c, "default", ACPRuntimeAvailability{
+			Codex: true, Claude: true, Copilot: true, OpenCode: true,
+		})
 
 		_, _, providers, _, err := b.buildDynamicContext(context.Background())
 		if err != nil {
 			t.Fatalf("unexpected error: %v", err)
 		}
-		if !strings.Contains(providers, "claude") {
-			t.Errorf("providers = %q, expected claude runtime", providers)
+		if !strings.Contains(providers, "agent_runtimes=[codex, copilot, claude, opencode]") {
+			t.Errorf("providers = %q, expected all configured built-in runtimes", providers)
 		}
 	})
 
-	t.Run("codex runtime detected from codex-proxy-token secret", func(t *testing.T) {
-		secret := &corev1.Secret{
-			ObjectMeta: metav1.ObjectMeta{Name: "codex-proxy-token", Namespace: "default"},
-		}
-		c := fake.NewClientBuilder().WithScheme(scheme).WithObjects(secret).Build()
-		b := NewSystemPromptBuilder(c, "default")
+	t.Run("configured opencode runtime is advertised as built-in ACP without a secret", func(t *testing.T) {
+		c := fake.NewClientBuilder().WithScheme(scheme).Build()
+		b := NewSystemPromptBuilder(c, "default", ACPRuntimeAvailability{OpenCode: true})
 
 		_, _, providers, _, err := b.buildDynamicContext(context.Background())
 		if err != nil {
 			t.Fatalf("unexpected error: %v", err)
 		}
-		if !strings.Contains(providers, "codex") {
-			t.Errorf("providers = %q, expected codex runtime", providers)
+		if !strings.Contains(providers, "agent_runtimes=[opencode]") {
+			t.Errorf("providers = %q, expected built-in OpenCode ACP runtime", providers)
 		}
 	})
 
-	t.Run("opencode runtime detected from opencode-credentials secret", func(t *testing.T) {
+	t.Run("legacy opencode secret does not gate or duplicate built-in runtime", func(t *testing.T) {
 		secret := &corev1.Secret{
-			ObjectMeta: metav1.ObjectMeta{Name: "opencode-credentials", Namespace: "default"},
-			Data: map[string][]byte{
-				workerenv.OpenAIBaseURL: []byte("https://models.example.invalid/v1"),
-			},
+			ObjectMeta: metav1.ObjectMeta{Name: "opencode-api-key", Namespace: "default"},
 		}
 		c := fake.NewClientBuilder().WithScheme(scheme).WithObjects(secret).Build()
-		b := NewSystemPromptBuilder(c, "default")
+		b := NewSystemPromptBuilder(c, "default", ACPRuntimeAvailability{OpenCode: true})
 
 		_, _, providers, _, err := b.buildDynamicContext(context.Background())
 		if err != nil {
 			t.Fatalf("unexpected error: %v", err)
 		}
-		if !strings.Contains(providers, "opencode") {
-			t.Errorf("providers = %q, expected opencode runtime", providers)
+		if got := strings.Count(providers, "opencode"); got != 1 {
+			t.Errorf("providers = %q, expected one built-in OpenCode entry, got %d", providers, got)
 		}
 	})
 
-	t.Run("incomplete opencode secret is not advertised", func(t *testing.T) {
-		secret := &corev1.Secret{
-			ObjectMeta: metav1.ObjectMeta{Name: "opencode-api-key", Namespace: "default"},
-			Data: map[string][]byte{
-				workerenv.OpenAIAPIKey: []byte("credential"),
-			},
-		}
-		c := fake.NewClientBuilder().WithScheme(scheme).WithObjects(secret).Build()
-		b := NewSystemPromptBuilder(c, "default")
+	t.Run("configured opencode does not require credential-backed runtime secrets", func(t *testing.T) {
+		c := fake.NewClientBuilder().WithScheme(scheme).Build()
+		b := NewSystemPromptBuilder(c, "default", ACPRuntimeAvailability{OpenCode: true})
 
 		_, _, providers, _, err := b.buildDynamicContext(context.Background())
 		if err != nil {
 			t.Fatalf("unexpected error: %v", err)
 		}
-		if strings.Contains(providers, "opencode") {
-			t.Errorf("providers = %q, did not expect incomplete opencode runtime", providers)
+		if !strings.Contains(providers, "agent_runtimes=[opencode]") {
+			t.Errorf("providers = %q, expected only built-in OpenCode ACP runtime", providers)
 		}
 	})
 
-	t.Run("no runtime secrets means agent_runtimes=none", func(t *testing.T) {
+	t.Run("unconfigured opencode runtime is omitted", func(t *testing.T) {
 		c := fake.NewClientBuilder().WithScheme(scheme).Build()
 		b := NewSystemPromptBuilder(c, "default")
 
@@ -675,8 +650,8 @@ func TestBuildDynamicContext(t *testing.T) {
 		if err != nil {
 			t.Fatalf("unexpected error: %v", err)
 		}
-		if !strings.Contains(providers, "agent_runtimes=[none]") {
-			t.Errorf("providers = %q, expected agent_runtimes=[none]", providers)
+		if strings.Contains(providers, "opencode") {
+			t.Fatalf("providers = %q, did not expect unavailable OpenCode runtime", providers)
 		}
 	})
 
diff --git a/internal/api/chat_test.go b/internal/api/chat_test.go
index 0c8ffb496..4b8bd60c1 100644
--- a/internal/api/chat_test.go
+++ b/internal/api/chat_test.go
@@ -16,6 +16,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
@@ -347,6 +348,22 @@ func TestHandleCancelChat(t *testing.T) {
 		_, err = ss.GetSession(ctx, "default", "test-session")
 		assert.True(t, errors.Is(err, store.ErrNotFound))
 	})
+
+	t.Run("active session is cancelled before deletion", func(t *testing.T) {
+		active, err := beginTestActiveChat(ch, context.Background(), "active-session")
+		require.NoError(t, err)
+		go func() {
+			<-active.cancelContext.Done()
+			active.finish()
+		}()
+
+		req := httptest.NewRequest(http.MethodDelete, "/api/v1/chat/active-session", nil)
+		resp, err := app.Test(req, fiber.TestConfig{Timeout: 10 * time.Second})
+		require.NoError(t, err)
+		assert.Equal(t, http.StatusNoContent, resp.StatusCode)
+		_, err = ss.GetSession(context.Background(), "default", "active-session")
+		assert.ErrorIs(t, err, store.ErrNotFound)
+	})
 }
 
 // --- loadChatSession ---
@@ -422,23 +439,16 @@ func TestSaveChatSession(t *testing.T) {
 	ch := newTestChatHandler(t, fakeClient, ss, rs, cfg)
 	ctx := context.Background()
 
-	t.Run("creates session if not exists and appends messages", func(t *testing.T) {
+	t.Run("rejects a missing locked session instead of recreating it", func(t *testing.T) {
 		messages := []llm.Message{
 			{Role: "user", Content: "hello"},
 			{Role: "assistant", Content: "hi"},
 		}
 		err := ch.saveChatSession(ctx, "default", "new-session", messages, 0, ChatUsage{})
-		require.NoError(t, err)
-
-		// Verify session was created
-		sess, err := ss.GetSession(ctx, "default", "new-session")
-		require.NoError(t, err)
-		assert.Equal(t, "chat", sess.SessionType)
-
-		// Verify messages were stored
-		stored, err := ss.LoadTranscript(ctx, "default", "new-session", 0)
-		require.NoError(t, err)
-		assert.Len(t, stored, 2)
+		require.Error(t, err)
+		assert.ErrorIs(t, err, store.ErrNotFound)
+		_, getErr := ss.GetSession(ctx, "default", "new-session")
+		assert.ErrorIs(t, getErr, store.ErrNotFound)
 	})
 
 	t.Run("only appends new messages (skips persisted)", func(t *testing.T) {
@@ -472,6 +482,10 @@ func TestSaveChatSession(t *testing.T) {
 	})
 
 	t.Run("no new messages is a no-op", func(t *testing.T) {
+		now := time.Now()
+		require.NoError(t, ss.CreateSession(ctx, &store.SessionRecord{
+			Namespace: "default", Name: "noop-session", SessionType: "chat", CreatedAt: now, UpdatedAt: now,
+		}))
 		messages := []llm.Message{
 			{Role: "user", Content: "already saved"},
 		}
@@ -480,6 +494,66 @@ func TestSaveChatSession(t *testing.T) {
 	})
 }
 
+func TestAcquireChatSessionFencesDeletionUntilRelease(t *testing.T) {
+	ss := newTestSessionStore(t)
+	ch := &ChatHandler{sessionStore: ss}
+	ctx := context.Background()
+	release, created, lockID, err := ch.acquireChatSession(ctx, "default", "locked-chat")
+	require.NoError(t, err)
+	if !created {
+		t.Fatal("acquireChatSession() did not create the missing chat Session")
+	}
+	if lockID == "" {
+		t.Fatal("acquireChatSession() returned an empty lock identity")
+	}
+	if err := ss.DeleteSession(ctx, "default", "locked-chat"); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("DeleteSession(locked chat) error = %v, want ErrConflict", err)
+	}
+	release()
+	release() // idempotent close for overlapping handler/stream cleanup paths.
+	require.NoError(t, ss.DeleteSession(ctx, "default", "locked-chat"))
+	if _, err := ss.GetSession(ctx, "default", "locked-chat"); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("GetSession() error = %v, want ErrNotFound", err)
+	}
+}
+
+func TestBeginActiveChatRejectsConcurrentRequestAndRetainsEmptySession(t *testing.T) {
+	ss := newTestSessionStore(t)
+	ch := &ChatHandler{sessionStore: ss, config: DefaultChatConfig(), activeChats: make(map[string]*activeChatRequest)}
+	ctx := context.Background()
+	active, err := beginTestActiveChat(ch, ctx, "concurrent-chat")
+	require.NoError(t, err)
+	if _, err := beginTestActiveChat(ch, ctx, "concurrent-chat"); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("beginActiveChat(concurrent) error = %v, want ErrConflict", err)
+	}
+	active.finish()
+	if _, err := ss.GetSession(ctx, "default", "concurrent-chat"); err != nil {
+		t.Fatalf("GetSession(empty failed chat) error = %v, want retained Session", err)
+	}
+	require.NoError(t, ss.DeleteSession(ctx, "default", "concurrent-chat"))
+}
+
+func TestChatCancellationGateBlocksReplacementUntilDeletionCompletes(t *testing.T) {
+	ss := newTestSessionStore(t)
+	ch := &ChatHandler{sessionStore: ss, config: DefaultChatConfig(), activeChats: make(map[string]*activeChatRequest)}
+	ctx := context.Background()
+	active, err := beginTestActiveChat(ch, ctx, "cancel-gated-chat")
+	require.NoError(t, err)
+	request, found := ch.cancelActiveChat("default", "cancel-gated-chat")
+	if !found {
+		t.Fatal("cancelActiveChat() did not find active request")
+	}
+	active.finish()
+	<-request.done
+	if _, err := beginTestActiveChat(ch, ctx, "cancel-gated-chat"); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("beginActiveChat(during deletion handoff) error = %v, want ErrConflict", err)
+	}
+	ch.clearChatDeletionGate("default", "cancel-gated-chat")
+	replacement, err := beginTestActiveChat(ch, ctx, "cancel-gated-chat")
+	require.NoError(t, err)
+	replacement.finish()
+}
+
 // --- lookupProvider ---
 
 func TestLookupProvider(t *testing.T) {
@@ -1473,3 +1547,74 @@ func TestChatHandler_ContextTokenAuthorizationRejectsMissingAgentRefWhenTokenReq
 	require.NoError(t, err)
 	assert.Equal(t, http.StatusForbidden, resp.StatusCode)
 }
+
+func TestPreAcquisitionCancellationPreservesDeletionGate(t *testing.T) {
+	base := newTestSessionStore(t)
+	blocking := &cancelableCreateSessionStore{SessionStore: base, started: make(chan struct{})}
+	ch := &ChatHandler{sessionStore: blocking, config: DefaultChatConfig(), activeChats: make(map[string]*activeChatRequest)}
+	ctx := context.Background()
+	result := make(chan error, 1)
+	go func() {
+		_, err := beginTestActiveChat(ch, ctx, "pre-acquire-cancel")
+		result <- err
+	}()
+	select {
+	case <-blocking.started:
+	case <-time.After(5 * time.Second):
+		t.Fatal("chat acquisition did not reach CreateSession")
+	}
+	active, err := ch.cancelAndWaitForActiveChat(ctx, "default", "pre-acquire-cancel")
+	require.NoError(t, err)
+	if !active {
+		t.Fatal("cancelAndWaitForActiveChat() did not observe reserved acquisition gate")
+	}
+	if err := <-result; err == nil {
+		t.Fatal("beginActiveChat() unexpectedly succeeded after cancellation")
+	}
+	if _, err := beginTestActiveChat(ch, ctx, "pre-acquire-cancel"); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("beginActiveChat(before DELETE completion) error = %v, want ErrConflict", err)
+	}
+	ch.clearChatDeletionGate("default", "pre-acquire-cancel")
+}
+
+type cancelableCreateSessionStore struct {
+	store.SessionStore
+	started chan struct{}
+	once    sync.Once
+}
+
+func (s *cancelableCreateSessionStore) CreateSession(ctx context.Context, _ *store.SessionRecord) error {
+	s.once.Do(func() { close(s.started) })
+	<-ctx.Done()
+	return ctx.Err()
+}
+
+func TestAbandonedCancellationWaiterDoesNotLeakGate(t *testing.T) {
+	ss := newTestSessionStore(t)
+	ch := &ChatHandler{sessionStore: ss, config: DefaultChatConfig(), activeChats: make(map[string]*activeChatRequest)}
+	active, err := beginTestActiveChat(ch, context.Background(), "abandoned-cancel")
+	require.NoError(t, err)
+	cancelCtx, cancel := context.WithCancel(context.Background())
+	cancel()
+	found, err := ch.cancelAndWaitForActiveChat(cancelCtx, "default", "abandoned-cancel")
+	if !found || !errors.Is(err, context.Canceled) {
+		t.Fatalf("cancelAndWaitForActiveChat() = found:%t err:%v, want true,context.Canceled", found, err)
+	}
+	active.finish()
+	replacement, err := beginTestActiveChat(ch, context.Background(), "abandoned-cancel")
+	require.NoError(t, err)
+	replacement.finish()
+}
+
+func beginTestActiveChat(ch *ChatHandler, ctx context.Context, sessionID string) (*activeChatHandle, error) {
+	reservation, err := ch.reserveActiveChat(defaultNamespace, sessionID)
+	if err != nil {
+		return nil, err
+	}
+	active, err := ch.activateReservedChat(ctx, reservation, defaultNamespace, sessionID)
+	if err != nil {
+		ch.finishActiveChatReservation(reservation, nil)
+		return nil, err
+	}
+	return active, nil
+}
diff --git a/internal/api/chat_tool_executor.go b/internal/api/chat_tool_executor.go
index dcfe70c40..a2107ee41 100644
--- a/internal/api/chat_tool_executor.go
+++ b/internal/api/chat_tool_executor.go
@@ -22,6 +22,7 @@ import (
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
 	"github.com/orka-agents/orka/internal/controller"
+	"github.com/orka-agents/orka/internal/executionmode"
 	"github.com/orka-agents/orka/internal/labels"
 	"github.com/orka-agents/orka/internal/llm"
 	"github.com/orka-agents/orka/internal/store"
@@ -39,6 +40,7 @@ type ToolExecutor struct {
 	namespace                 string
 	provider                  string
 	providerType              string
+	executionMode             executionmode.Mode
 	sessionID                 string
 	taskSeq                   atomic.Int32
 	tasksCreated              int
@@ -57,6 +59,12 @@ type ToolExecutor struct {
 	authorizeSecretRead       func(context.Context, string, string) error
 }
 
+// SetExecutionMode supplies the immutable installation mode used by trusted
+// Agent-producing chat tools.
+func (e *ToolExecutor) SetExecutionMode(mode executionmode.Mode) {
+	e.executionMode = mode
+}
+
 // NewToolExecutor creates a new ToolExecutor.
 func NewToolExecutor(c client.Client, sm *controller.SessionManager, namespace, sessionID, watchNamespace string, enforceNS bool, maxTasks int, toolTimeout time.Duration, rs store.ResultStore, kubeClientOpt ...kubernetes.Interface) *ToolExecutor {
 	var kubeClient kubernetes.Interface
@@ -166,6 +174,7 @@ func (e *ToolExecutor) Execute(ctx context.Context, toolCall llm.ToolCall) (stri
 		Tenant:                    e.namespace,
 		Provider:                  e.provider,
 		ProviderType:              e.providerType,
+		ExecutionMode:             e.executionMode,
 		WatchNamespace:            e.watchNamespace,
 		EnforceNamespaceIsolation: e.enforceNamespaceIsolation,
 		ResultStore:               e.resultStore,
diff --git a/internal/api/chat_tool_executor_test.go b/internal/api/chat_tool_executor_test.go
index 65e7d5a3a..1e10b926a 100644
--- a/internal/api/chat_tool_executor_test.go
+++ b/internal/api/chat_tool_executor_test.go
@@ -25,6 +25,7 @@ import (
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
 	"github.com/orka-agents/orka/internal/controller"
+	"github.com/orka-agents/orka/internal/executionmode"
 	"github.com/orka-agents/orka/internal/labels"
 	"github.com/orka-agents/orka/internal/llm"
 	"github.com/orka-agents/orka/internal/store"
@@ -66,6 +67,7 @@ func (e *ToolExecutor) executeTool(ctx context.Context, name string, args map[st
 	tc := &tools.ToolContext{
 		Client:                    e.client,
 		Namespace:                 e.namespace,
+		ExecutionMode:             e.executionMode,
 		WatchNamespace:            e.watchNamespace,
 		EnforceNamespaceIsolation: e.enforceNamespaceIsolation,
 		ResultStore:               e.resultStore,
@@ -189,7 +191,9 @@ func newTestExecutor(objs ...runtime.Object) *ToolExecutor {
 	}
 	c := cb.Build()
 	sm := controller.NewSessionManager(&fakeSessionStore{})
-	return NewToolExecutor(c, sm, testDefaultNamespace, "sess-12345678", "", false, 5, 30*time.Second, &fakeResultStore{})
+	executor := NewToolExecutor(c, sm, testDefaultNamespace, "sess-12345678", "", false, 5, 30*time.Second, &fakeResultStore{})
+	executor.SetExecutionMode(executionmode.HarnessV2)
+	return executor
 }
 
 // fakeResultStore implements store.ResultStore for testing.
@@ -993,10 +997,11 @@ func TestExecuteCreateAgentTask_WithWorkspace(t *testing.T) {
 		"prompt":   "work on repo",
 		"agentRef": "my-agent",
 		"workspace": map[string]any{
-			"gitRepo":    "https://github.com/org/repo",
-			"branch":     "main",
-			"subPath":    "src",
-			"pushBranch": "feature-1",
+			"gitRepo":                  "https://github.com/org/repo",
+			"branch":                   "main",
+			"subPath":                  "src",
+			"pushBranch":               "feature-1",
+			"publicationCredentialRef": "github-publication-credentials",
 		},
 		"maxTurns": float64(10),
 	}
@@ -1009,14 +1014,14 @@ func TestExecuteCreateAgentTask_WithWorkspace(t *testing.T) {
 	if err := e.client.Get(context.Background(), apitypes.NamespacedName{Name: data["name"].(string), Namespace: "default"}, task); err != nil {
 		t.Fatalf("failed to get created task: %v", err)
 	}
-	if task.Spec.AgentRuntime == nil || task.Spec.AgentRuntime.Workspace == nil {
+	if task.Spec.AgentRuntime == nil || task.Spec.Workspace == nil {
 		t.Fatal("expected workspace to be set")
 	}
-	if task.Spec.AgentRuntime.Workspace.GitSecretRef == nil {
-		t.Fatal("expected gitSecretRef to be auto-discovered")
+	if task.Spec.Workspace.ReadCredentialRef == nil {
+		t.Fatal("expected readCredentialRef to be auto-discovered")
 	}
-	if task.Spec.AgentRuntime.Workspace.GitSecretRef.Name != "github-credentials" {
-		t.Fatalf("gitSecretRef = %q, want %q", task.Spec.AgentRuntime.Workspace.GitSecretRef.Name, "github-credentials")
+	if task.Spec.Workspace.ReadCredentialRef.Name != "github-credentials" {
+		t.Fatalf("readCredentialRef = %q, want %q", task.Spec.Workspace.ReadCredentialRef.Name, "github-credentials")
 	}
 }
 
@@ -1026,8 +1031,8 @@ func TestExecuteCreateAgentTask_WithExplicitGitSecret(t *testing.T) {
 		"prompt":   "work on repo",
 		"agentRef": "my-agent",
 		"workspace": map[string]any{
-			"gitRepo":      "https://github.com/org/repo",
-			"gitSecretRef": "my-secret",
+			"gitRepo":           "https://github.com/org/repo",
+			"readCredentialRef": "my-secret",
 		},
 	}
 	r := e.executeTool(context.Background(), "create_agent_task", args)
@@ -1039,11 +1044,11 @@ func TestExecuteCreateAgentTask_WithExplicitGitSecret(t *testing.T) {
 	if err := e.client.Get(context.Background(), apitypes.NamespacedName{Name: data["name"].(string), Namespace: "default"}, task); err != nil {
 		t.Fatalf("failed to get created task: %v", err)
 	}
-	if task.Spec.AgentRuntime == nil || task.Spec.AgentRuntime.Workspace == nil || task.Spec.AgentRuntime.Workspace.GitSecretRef == nil {
-		t.Fatal("expected explicit gitSecretRef to be preserved")
+	if task.Spec.Workspace == nil || task.Spec.Workspace.ReadCredentialRef == nil {
+		t.Fatal("expected explicit readCredentialRef to be preserved")
 	}
-	if task.Spec.AgentRuntime.Workspace.GitSecretRef.Name != "my-secret" {
-		t.Errorf("gitSecretRef = %q, want %q", task.Spec.AgentRuntime.Workspace.GitSecretRef.Name, "my-secret")
+	if task.Spec.Workspace.ReadCredentialRef.Name != "my-secret" {
+		t.Errorf("readCredentialRef = %q, want %q", task.Spec.Workspace.ReadCredentialRef.Name, "my-secret")
 	}
 }
 
diff --git a/internal/api/context_token_authorization.go b/internal/api/context_token_authorization.go
index af0864c33..f31305b5d 100644
--- a/internal/api/context_token_authorization.go
+++ b/internal/api/context_token_authorization.go
@@ -16,6 +16,7 @@ import (
 	"github.com/gofiber/fiber/v3"
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/acp"
 	"github.com/orka-agents/orka/internal/labels"
 	"github.com/orka-agents/orka/internal/llm"
 	"github.com/orka-agents/orka/internal/metrics"
@@ -1075,8 +1076,7 @@ func resolveContextTokenAgentSpecAuthorizationContext(ctx context.Context, c cli
 	authzCtx.EffectiveProvider, authzCtx.EffectiveModel = contextTokenTaskCreateEffectiveProviderModel(CreateTaskRequest{}, agent, provider)
 	authzCtx.Fallbacks = contextTokenTaskCreateFallbackProviderModels(ctx, c, agent.Namespace, agent)
 	authzCtx.EffectiveAITools = contextTokenTaskCreateEffectiveAITools(CreateTaskRequest{}, agent)
-	authzCtx.RuntimeAllowedTools = contextTokenTaskCreateEffectiveRuntimeAllowedTools(CreateTaskRequest{}, agent)
-	authzCtx.RuntimeAllowBash = contextTokenTaskCreateEffectiveRuntimeAllowBash(CreateTaskRequest{}, agent)
+	authzCtx.RuntimeAllowedTools, authzCtx.RuntimeAllowBash = contextTokenAgentRuntimeAuthorizationPolicy(agent)
 	return authzCtx, nil
 }
 
@@ -1085,12 +1085,16 @@ func contextTokenAgentSpecToolFailures(token *ContextToken, authzCtx contextToke
 	if !ok {
 		return nil
 	}
+	if authzCtx.Agent != nil && authzCtx.Agent.Spec.Runtime != nil && authzCtx.Agent.Spec.Runtime.Type == corev1alpha1.AgentRuntimeOpencode {
+		allowed = acp.NormalizeOpenCodeAuthorizationTools(allowed)
+	}
 	failures := []string{}
-	if authzCtx.Agent != nil && authzCtx.Agent.Spec.Runtime != nil && !hasNonEmptyToolNames(authzCtx.RuntimeAllowedTools) {
+	if authzCtx.Agent != nil && authzCtx.Agent.Spec.Runtime != nil && contextTokenRuntimeToolsUnrestricted(authzCtx.RuntimeAllowedTools) {
 		failures = append(failures, "agent runtime default tools are unrestricted while token context restricts allowedTools")
 	}
 	runtimeTools := append([]string{}, authzCtx.RuntimeAllowedTools...)
-	if authzCtx.Agent != nil && authzCtx.Agent.Spec.Runtime != nil && authzCtx.RuntimeAllowBash {
+	if authzCtx.Agent != nil && authzCtx.Agent.Spec.Runtime != nil &&
+		authzCtx.Agent.Spec.Runtime.Type != corev1alpha1.AgentRuntimeOpencode && authzCtx.RuntimeAllowBash {
 		runtimeTools = append(runtimeTools, "Bash")
 	}
 	for _, tool := range append(append([]string{}, authzCtx.EffectiveAITools...), runtimeTools...) {
@@ -1158,8 +1162,7 @@ func resolveContextTokenTaskCreateAuthorizationContext(ctx context.Context, c cl
 	authzCtx.EffectiveProvider, authzCtx.EffectiveModel = contextTokenTaskCreateEffectiveProviderModel(req, authzCtx.Agent, authzCtx.Provider)
 	authzCtx.Fallbacks = contextTokenTaskCreateFallbackProviderModels(ctx, c, namespace, authzCtx.Agent)
 	authzCtx.EffectiveAITools = contextTokenTaskCreateEffectiveAITools(req, authzCtx.Agent)
-	authzCtx.RuntimeAllowedTools = contextTokenTaskCreateEffectiveRuntimeAllowedTools(req, authzCtx.Agent)
-	authzCtx.RuntimeAllowBash = contextTokenTaskCreateEffectiveRuntimeAllowBash(req, authzCtx.Agent)
+	authzCtx.RuntimeAllowedTools, authzCtx.RuntimeAllowBash = contextTokenTaskCreateEffectiveRuntimePolicy(req, authzCtx.Agent)
 
 	return authzCtx, nil
 }
@@ -1190,6 +1193,9 @@ func contextTokenTaskCreateFallbackProviderModels(ctx context.Context, c client.
 }
 
 func contextTokenTaskCreateProviderRef(req CreateTaskRequest, agent *corev1alpha1.Agent) *corev1alpha1.ProviderReference {
+	if contextTokenOpenCodeAgentTask(req, agent) {
+		return nil
+	}
 	if req.AI != nil && req.AI.ProviderRef != nil {
 		return req.AI.ProviderRef
 	}
@@ -1202,14 +1208,18 @@ func contextTokenTaskCreateProviderRef(req CreateTaskRequest, agent *corev1alpha
 func contextTokenTaskCreateEffectiveProviderModel(req CreateTaskRequest, agent *corev1alpha1.Agent, provider *corev1alpha1.Provider) (ProviderResolutionInfo, string) {
 	providerInfo := ProviderResolutionInfo{}
 	model := ""
+	openCodeAgent := contextTokenOpenCodeAgent(agent)
+	openCodeAgentTask := contextTokenOpenCodeAgentTask(req, agent)
 
-	if provider != nil {
+	if provider != nil && !openCodeAgent {
 		providerInfo = providerResolutionInfo(provider)
 		model = provider.Spec.DefaultModel
 	}
 
 	if agent != nil && agent.Spec.Model != nil {
-		if strings.TrimSpace(agent.Spec.Model.Provider) != "" {
+		if openCodeAgent {
+			providerInfo = ProviderResolutionInfo{Type: contextTokenOpenCodeModelProvider(agent)}
+		} else if strings.TrimSpace(agent.Spec.Model.Provider) != "" {
 			providerInfo = ProviderResolutionInfo{Type: agent.Spec.Model.Provider}
 		}
 		if strings.TrimSpace(agent.Spec.Model.Name) != "" {
@@ -1217,7 +1227,10 @@ func contextTokenTaskCreateEffectiveProviderModel(req CreateTaskRequest, agent *
 		}
 	}
 
-	if req.AI != nil {
+	// Built-in OpenCode executes the immutable Agent model identity. Task AI
+	// fields are not part of that runtime profile and must not authorize a
+	// different provider/model than the one that will execute.
+	if req.AI != nil && !openCodeAgentTask {
 		if strings.TrimSpace(req.AI.Provider) != "" {
 			providerInfo = ProviderResolutionInfo{Type: req.AI.Provider}
 		}
@@ -1226,15 +1239,34 @@ func contextTokenTaskCreateEffectiveProviderModel(req CreateTaskRequest, agent *
 		}
 	}
 
-	// Provider CRD type is authoritative when a ProviderRef resolves; direct provider
-	// strings on the task or agent must not override the loaded Provider type.
-	if provider != nil {
+	// Provider CRD type is authoritative for provider-backed execution. OpenCode
+	// instead derives its immutable provider identity from the qualified model ID.
+	if provider != nil && !openCodeAgent {
 		providerInfo = providerResolutionInfo(provider)
 	}
 
 	return providerInfo, model
 }
 
+func contextTokenOpenCodeAgentTask(req CreateTaskRequest, agent *corev1alpha1.Agent) bool {
+	return req.Type == corev1alpha1.TaskTypeAgent && contextTokenOpenCodeAgent(agent)
+}
+
+func contextTokenOpenCodeAgent(agent *corev1alpha1.Agent) bool {
+	return agent != nil && agent.Spec.Runtime != nil && agent.Spec.Runtime.Type == corev1alpha1.AgentRuntimeOpencode
+}
+
+func contextTokenOpenCodeModelProvider(agent *corev1alpha1.Agent) string {
+	if !contextTokenOpenCodeAgent(agent) || agent.Spec.Model == nil {
+		return ""
+	}
+	provider, model, ok := strings.Cut(strings.TrimSpace(agent.Spec.Model.Name), "/")
+	if !ok || strings.TrimSpace(model) == "" {
+		return ""
+	}
+	return strings.TrimSpace(provider)
+}
+
 func contextTokenTaskCreateEffectiveAITools(req CreateTaskRequest, agent *corev1alpha1.Agent) []string {
 	tools := []string{}
 	if agent != nil {
@@ -1291,25 +1323,82 @@ func coordinationToolNames() []string {
 	}
 }
 
-func contextTokenTaskCreateEffectiveRuntimeAllowedTools(req CreateTaskRequest, agent *corev1alpha1.Agent) []string {
-	if req.AgentRuntime != nil && len(req.AgentRuntime.AllowedTools) > 0 {
-		return append([]string{}, req.AgentRuntime.AllowedTools...)
+func contextTokenAgentRuntimeAllowedTools(agent *corev1alpha1.Agent) []string {
+	if agent == nil || agent.Spec.Runtime == nil {
+		return nil
+	}
+	runtime := agent.Spec.Runtime
+	if runtime.Type == corev1alpha1.AgentRuntimeOpencode && runtime.DefaultAllowedTools == nil {
+		return acp.OpenCodeDefaultAllowedTools()
 	}
-	if agent != nil && agent.Spec.Runtime != nil && len(agent.Spec.Runtime.DefaultAllowedTools) > 0 {
-		return append([]string{}, agent.Spec.Runtime.DefaultAllowedTools...)
+	if runtime.DefaultAllowedTools != nil {
+		return append([]string{}, runtime.DefaultAllowedTools...)
 	}
 	return nil
 }
 
-func contextTokenTaskCreateEffectiveRuntimeAllowBash(req CreateTaskRequest, agent *corev1alpha1.Agent) bool {
+func contextTokenAgentRuntimeAllowBash(agent *corev1alpha1.Agent) bool {
 	allowBash := true
 	if agent != nil && agent.Spec.Runtime != nil && agent.Spec.Runtime.DefaultAllowBash != nil {
 		allowBash = *agent.Spec.Runtime.DefaultAllowBash
 	}
+	return allowBash
+}
+
+func contextTokenAgentRuntimeAuthorizationPolicy(agent *corev1alpha1.Agent) ([]string, bool) {
+	allowedTools := contextTokenAgentRuntimeAllowedTools(agent)
+	allowBash := contextTokenAgentRuntimeAllowBash(agent)
+	if agent == nil || agent.Spec.Runtime == nil {
+		return allowedTools, allowBash
+	}
+	if agent.Spec.Runtime.Type != corev1alpha1.AgentRuntimeOpencode {
+		if len(allowedTools) > 0 && !hasNonEmptyToolNames(allowedTools) {
+			return allowedTools, allowBash
+		}
+		allowedTools, _, allowBash = acp.NormalizeBuiltInRuntimeToolPolicy(
+			string(agent.Spec.Runtime.Type), allowedTools, nil, allowBash,
+		)
+		allowedTools = acp.BuiltInRuntimeEffectiveAllowedTools(allowedTools, nil, allowBash)
+		allowBash = acp.BuiltInRuntimeEffectiveAllowBash(allowedTools, nil, allowBash)
+		return allowedTools, allowBash
+	}
+	allowedTools, disallowedTools, allowBash := acp.NormalizeOpenCodeToolPolicy(false, allowedTools, nil, allowBash)
+	allowedTools = acp.OpenCodeEffectiveAllowedTools(allowedTools, disallowedTools, allowBash)
+	return allowedTools, allowBash && slices.Contains(allowedTools, "bash")
+}
+
+func contextTokenTaskCreateEffectiveRuntimePolicy(req CreateTaskRequest, agent *corev1alpha1.Agent) ([]string, bool) {
+	allowedTools := contextTokenAgentRuntimeAllowedTools(agent)
+	if req.AgentRuntime != nil && req.AgentRuntime.AllowedTools != nil {
+		allowedTools = append([]string{}, req.AgentRuntime.AllowedTools...)
+	}
+	allowBash := contextTokenAgentRuntimeAllowBash(agent)
+	disallowedTools := []string(nil)
 	if req.AgentRuntime != nil && req.AgentRuntime.AllowBash != nil {
 		allowBash = *req.AgentRuntime.AllowBash
 	}
-	return allowBash
+	if req.AgentRuntime != nil {
+		disallowedTools = append(disallowedTools, req.AgentRuntime.DisallowedTools...)
+	}
+	if agent == nil || agent.Spec.Runtime == nil {
+		return allowedTools, allowBash
+	}
+	if agent.Spec.Runtime.Type != corev1alpha1.AgentRuntimeOpencode {
+		if len(allowedTools) > 0 && !hasNonEmptyToolNames(allowedTools) {
+			return allowedTools, allowBash
+		}
+		allowedTools, disallowedTools, allowBash = acp.NormalizeBuiltInRuntimeToolPolicy(
+			string(agent.Spec.Runtime.Type), allowedTools, disallowedTools, allowBash,
+		)
+		allowedTools = acp.BuiltInRuntimeEffectiveAllowedTools(allowedTools, disallowedTools, allowBash)
+		allowBash = acp.BuiltInRuntimeEffectiveAllowBash(allowedTools, disallowedTools, allowBash)
+		return allowedTools, allowBash
+	}
+	workspace := taskRequestWorkspace(req)
+	readIntent := workspace == nil || workspace.Intent == "" || workspace.Intent == corev1alpha1.WorkspaceIntentRead
+	allowedTools, disallowedTools, allowBash = acp.NormalizeOpenCodeToolPolicy(readIntent, allowedTools, disallowedTools, allowBash)
+	allowedTools = acp.OpenCodeEffectiveAllowedTools(allowedTools, disallowedTools, allowBash)
+	return allowedTools, allowBash && slices.Contains(allowedTools, "bash")
 }
 
 func contextTokenTaskToolCredentialFailures(
@@ -1490,27 +1579,47 @@ func contextTokenWorkspaceCredentialFailures(token *ContextToken, cfg ContextTok
 	if workspace == nil {
 		return nil
 	}
-	requiredScopes := cfg.SecretCredentialReadScopes()
-	if len(requiredScopes) == 0 {
+	credentials := []struct {
+		role string
+		ref  *corev1alpha1.WorkspaceCredentialReference
+	}{
+		{role: "source-read", ref: workspace.ReadCredentialRef},
+		{role: "target-read", ref: workspace.PublicationReadCredentialRef},
+		{role: "target-write", ref: workspace.PublicationCredentialRef},
+		{role: "forge", ref: workspace.ForgeCredentialRef},
+	}
+	hasCredential := false
+	for _, credential := range credentials {
+		if credential.ref != nil && strings.TrimSpace(credential.ref.Name) != "" {
+			hasCredential = true
+			break
+		}
+	}
+	if !hasCredential {
 		return nil
 	}
-	if workspace.GitSecretRef == nil || strings.TrimSpace(workspace.GitSecretRef.Name) == "" {
+	requiredScopes := cfg.SecretCredentialReadScopes()
+	if len(requiredScopes) == 0 {
 		return nil
 	}
 	failures := []string{}
 	if !hasAnyScope(token.Scopes, requiredScopes) {
 		failures = append(failures, fmt.Sprintf(
-			"workspace git credentials require one of scopes %q",
+			"workspace credentials require one of scopes %q",
 			strings.Join(requiredScopes, ","),
 		))
 	}
-	if want, ok := contextString(token.TransactionContext, "secret"); ok && workspace.GitSecretRef.Name != want {
-		failures = append(failures, fmt.Sprintf("git secret %q does not match token context %q", workspace.GitSecretRef.Name, want))
-	}
-	if len(failures) > 0 {
-		return failures
+	if want, ok := contextString(token.TransactionContext, "secret"); ok {
+		for _, credential := range credentials {
+			if credential.ref == nil || strings.TrimSpace(credential.ref.Name) == "" {
+				continue
+			}
+			if credential.ref.Name != want {
+				failures = append(failures, fmt.Sprintf("workspace %s credential %q does not match token context %q", credential.role, credential.ref.Name, want))
+			}
+		}
 	}
-	return nil
+	return failures
 }
 
 func contextTokenTaskContextFailures(token *ContextToken, authzCtx contextTokenTaskCreateAuthorizationContext, includeTaskIdentity bool) []string {
@@ -1595,8 +1704,11 @@ func contextTokenTaskToolFailures(token *ContextToken, authzCtx contextTokenTask
 	if !ok {
 		return nil
 	}
+	if authzCtx.Agent != nil && authzCtx.Agent.Spec.Runtime != nil && authzCtx.Agent.Spec.Runtime.Type == corev1alpha1.AgentRuntimeOpencode {
+		allowed = acp.NormalizeOpenCodeAuthorizationTools(allowed)
+	}
 	failures := []string{}
-	if authzCtx.Request.Type == corev1alpha1.TaskTypeAgent && !hasNonEmptyToolNames(authzCtx.RuntimeAllowedTools) {
+	if authzCtx.Request.Type == corev1alpha1.TaskTypeAgent && contextTokenRuntimeToolsUnrestricted(authzCtx.RuntimeAllowedTools) {
 		failures = append(failures, "agent runtime tools are unrestricted by task or agent while token context restricts allowedTools")
 	}
 	runtimeTools := contextTokenRuntimeToolConstraints(authzCtx)
@@ -1650,7 +1762,7 @@ func contextTokenNativeRuntimeToolName(authzCtx contextTokenTaskCreateAuthorizat
 		return true
 	}
 	if runtime != nil && runtime.Type != "" {
-		return true
+		return contextTokenBuiltInRuntimeNativeToolName(runtime.Type, base)
 	}
 	if slices.Contains(toolspkg.CoordinationToolNames(), base) {
 		return true
@@ -1663,8 +1775,16 @@ func contextTokenNativeRuntimeToolName(authzCtx contextTokenTaskCreateAuthorizat
 	}
 }
 
+// Use the shared built-in runtime policy so credential authorization and MCP projection cannot drift.
+func contextTokenBuiltInRuntimeNativeToolName(runtimeType corev1alpha1.AgentRuntimeType, name string) bool {
+	return acp.IsBuiltInRuntimeNativeTool(string(runtimeType), name)
+}
+
 func contextTokenRuntimeToolConstraints(authzCtx contextTokenTaskCreateAuthorizationContext) []string {
 	runtimeTools := append([]string{}, authzCtx.RuntimeAllowedTools...)
+	if authzCtx.Agent != nil && authzCtx.Agent.Spec.Runtime != nil && authzCtx.Agent.Spec.Runtime.Type == corev1alpha1.AgentRuntimeOpencode {
+		return runtimeTools
+	}
 	if authzCtx.Request.Type == corev1alpha1.TaskTypeAgent && authzCtx.RuntimeAllowBash {
 		runtimeTools = append(runtimeTools, "Bash")
 	}
@@ -1677,6 +1797,10 @@ func hasNonEmptyToolNames(tools []string) bool {
 	})
 }
 
+func contextTokenRuntimeToolsUnrestricted(tools []string) bool {
+	return tools == nil || (len(tools) > 0 && !hasNonEmptyToolNames(tools))
+}
+
 func contextTokenTaskCreateNamespaceFailures(authzCtx contextTokenTaskCreateAuthorizationContext, tokenNamespace string) []string {
 	failures := []string{}
 	if authzCtx.Namespace != tokenNamespace {
@@ -1991,13 +2115,7 @@ func contextValueStringSlice(value any) ([]string, bool) {
 }
 
 func taskRequestWorkspace(req CreateTaskRequest) *corev1alpha1.WorkspaceConfig {
-	if req.Workspace != nil {
-		return req.Workspace
-	}
-	if req.AgentRuntime == nil {
-		return nil
-	}
-	return req.AgentRuntime.Workspace
+	return req.Workspace
 }
 
 func workspaceGitRepo(workspace *corev1alpha1.WorkspaceConfig) string {
diff --git a/internal/api/context_token_authorization_test.go b/internal/api/context_token_authorization_test.go
index 2da39c17a..988ca3f3e 100644
--- a/internal/api/context_token_authorization_test.go
+++ b/internal/api/context_token_authorization_test.go
@@ -2,6 +2,7 @@ package api
 
 import (
 	"context"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -59,7 +60,7 @@ func TestContextTokenTaskCreateFailures(t *testing.T) {
 			},
 		}
 		authzCtx := testTaskCreateAuthorizationContext()
-		authzCtx.Request.AgentRuntime.Workspace.Branch = ""
+		authzCtx.Request.Workspace.Branch = ""
 
 		failures := contextTokenTaskCreateFailures(token, cfg, authzCtx)
 		require.Empty(t, failures)
@@ -144,6 +145,46 @@ func TestContextTokenTaskCreateFailures(t *testing.T) {
 	})
 }
 
+func TestContextTokenWorkspaceCredentialFailuresAuthorizeAllRoles(t *testing.T) {
+	firstName := "workspace-a"
+	secondName := "workspace-b"
+	cfg := enforceContextTokenAuthorizationConfig()
+	cfg.SecretCredentialReadScopeList = []string{ContextTokenScopeSecretsCredentialsRead}
+
+	tests := []struct {
+		name string
+		role string
+		set  func(*corev1alpha1.WorkspaceConfig)
+	}{
+		{name: "source read", role: "source-read", set: func(workspace *corev1alpha1.WorkspaceConfig) {
+			workspace.ReadCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: secondName}
+		}},
+		{name: "target read", role: "target-read", set: func(workspace *corev1alpha1.WorkspaceConfig) {
+			workspace.PublicationReadCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: secondName}
+		}},
+		{name: "target write", role: "target-write", set: func(workspace *corev1alpha1.WorkspaceConfig) {
+			workspace.PublicationCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: secondName}
+		}},
+		{name: "forge", role: "forge", set: func(workspace *corev1alpha1.WorkspaceConfig) {
+			workspace.ForgeCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: secondName}
+		}},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			workspace := &corev1alpha1.WorkspaceConfig{}
+			test.set(workspace)
+			token := &ContextToken{
+				Scopes:             []string{ContextTokenScopeTaskCreate},
+				TransactionContext: map[string]any{"secret": firstName},
+			}
+
+			failures := strings.Join(contextTokenWorkspaceCredentialFailures(token, cfg, workspace), "\n")
+			require.Contains(t, failures, `workspace credentials require one of scopes "orka:secrets:credentials:read"`)
+			require.Contains(t, failures, fmt.Sprintf(`workspace %s credential %q does not match token context %q`, test.role, secondName, firstName))
+		})
+	}
+}
+
 func TestAuthorizeContextTokenToolAgentCreateRejectsSpecOutsideTokenConstraints(t *testing.T) {
 	cfg := enforceContextTokenAuthorizationConfig()
 	token := &ContextToken{
@@ -181,7 +222,7 @@ func TestAuthorizeContextTokenToolAgentCreateRejectsSpecOutsideTokenConstraints(
 	require.Contains(t, joined, `agent provider "anthropic" is not allowed by token context`)
 	require.Contains(t, joined, `agent model "claude-3-5-sonnet" is not allowed by token context`)
 	require.Contains(t, joined, `agent tool "web_search" is not allowed by token context`)
-	require.Contains(t, joined, `agent tool "Bash" is not allowed by token context`)
+	require.NotContains(t, joined, `agent tool "Bash" is not allowed by token context`)
 }
 
 func TestContextTokenAgentSpecFailuresRejectsCrossNamespaceProviderRef(t *testing.T) {
@@ -202,6 +243,79 @@ func TestContextTokenAgentSpecFailuresRejectsCrossNamespaceProviderRef(t *testin
 	require.Contains(t, strings.Join(failures, "\n"), `agent provider namespace "team-b" does not match token context "team-a"`)
 }
 
+func TestContextTokenAgentSpecFailuresDerivesOpenCodeProviderFromModelName(t *testing.T) {
+	token := &ContextToken{TransactionContext: map[string]any{
+		"allowedProviders": []any{"openai"},
+		"allowedModels":    []any{"openai/gpt-5.4"},
+	}}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "coder", Namespace: "team-a"},
+		Spec: corev1alpha1.AgentSpec{
+			Model:   &corev1alpha1.ModelConfig{Name: "openai/gpt-5.4"},
+			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeOpencode},
+		},
+	}
+
+	failures, err := contextTokenAgentSpecFailures(context.Background(), nil, token, agent)
+	require.NoError(t, err)
+	require.Empty(t, failures)
+}
+
+func TestContextTokenTaskCreateAuthorizationDerivesOpenCodeProviderFromModelName(t *testing.T) {
+	scheme := runtime.NewScheme()
+	require.NoError(t, corev1alpha1.AddToScheme(scheme))
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "coder", Namespace: "team-a"},
+		Spec: corev1alpha1.AgentSpec{
+			Model:   &corev1alpha1.ModelConfig{Name: "openai/gpt-5.4"},
+			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeOpencode},
+		},
+	}
+	overrideProvider := &corev1alpha1.Provider{
+		ObjectMeta: metav1.ObjectMeta{Name: "override-provider", Namespace: "team-a"},
+		Spec: corev1alpha1.ProviderSpec{
+			Type:         corev1alpha1.ProviderTypeAnthropic,
+			SecretRef:    corev1alpha1.ProviderSecretRef{Name: "override-secret"},
+			DefaultModel: "claude-sonnet-4",
+		},
+	}
+	agent.Spec.Model.Provider = string(corev1alpha1.ProviderTypeAnthropic)
+	agent.Spec.ProviderRef = &corev1alpha1.ProviderReference{Name: overrideProvider.Name}
+	client := fake.NewClientBuilder().WithScheme(scheme).WithObjects(agent, overrideProvider).Build()
+	authzCtx, err := resolveContextTokenTaskCreateAuthorizationContext(context.Background(), client, CreateTaskRequest{
+		Type:     corev1alpha1.TaskTypeAgent,
+		AgentRef: &corev1alpha1.AgentReference{Name: "coder"},
+		AI: &corev1alpha1.AISpec{
+			ProviderRef: &corev1alpha1.ProviderReference{Name: "override-provider"},
+			Provider:    string(corev1alpha1.ProviderTypeAnthropic),
+			Model:       "claude-sonnet-4",
+		},
+	}, "team-a")
+	require.NoError(t, err)
+	require.Empty(t, authzCtx.ProviderRef)
+	require.Nil(t, authzCtx.Provider)
+	require.Equal(t, ProviderResolutionInfo{Type: "openai"}, authzCtx.EffectiveProvider)
+	require.Equal(t, "openai/gpt-5.4", authzCtx.EffectiveModel)
+
+	token := &ContextToken{TransactionContext: map[string]any{
+		"allowedProviders": []any{"openai"},
+		"allowedModels":    []any{"openai/gpt-5.4"},
+	}}
+	failures := contextTokenProviderModelConstraintFailures(
+		token, authzCtx.EffectiveProvider, authzCtx.EffectiveModel, "", false, "",
+	)
+	require.Empty(t, failures)
+
+	overrideOnlyToken := &ContextToken{TransactionContext: map[string]any{
+		"allowedProviders": []any{string(corev1alpha1.ProviderTypeAnthropic)},
+		"allowedModels":    []any{"claude-sonnet-4"},
+	}}
+	failures = contextTokenProviderModelConstraintFailures(
+		overrideOnlyToken, authzCtx.EffectiveProvider, authzCtx.EffectiveModel, "", false, "",
+	)
+	require.NotEmpty(t, failures)
+}
+
 func TestContextTokenTaskReadFailures(t *testing.T) {
 	cfg := enforceContextTokenAuthorizationConfig()
 
@@ -550,13 +664,11 @@ func testTaskCreateAuthorizationContext() contextTokenTaskCreateAuthorizationCon
 				Model:    "gpt-4o",
 				Tools:    []string{"search"},
 			},
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: "https://github.com/example/repo",
-					Branch:  "main",
-					Ref:     "abc123",
-				},
-				AllowedTools: []string{"Bash"},
+			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"Bash"}},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: "https://github.com/example/repo",
+				Branch:  "main",
+				Ref:     "abc123",
 			},
 		},
 		Namespace:           "team-a",
@@ -624,6 +736,182 @@ func TestRedactedContextTokenAuthorizationFailuresRedactsRepositoryCredentials(t
 	}
 }
 
+func TestContextTokenTaskCreateEffectiveRuntimePolicyNormalizesOpenCode(t *testing.T) {
+	allowBash := false
+	allowBashTrue := true
+	tests := []struct {
+		name         string
+		runtime      *corev1alpha1.AgentCLIRuntime
+		workspace    *corev1alpha1.WorkspaceConfig
+		agentRuntime *corev1alpha1.AgentRuntimeSpec
+		wantTools    []string
+		wantBash     bool
+		wantNonNil   bool
+	}{
+		{
+			name:       "default read intent",
+			runtime:    &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeOpencode},
+			wantTools:  []string{"glob", "read"},
+			wantNonNil: true,
+		},
+		{
+			name: "write intent expands mutation aliases",
+			runtime: &corev1alpha1.AgentCLIRuntime{
+				Type: corev1alpha1.AgentRuntimeOpencode, DefaultAllowedTools: []string{"Edit"}, DefaultAllowBash: &allowBash,
+			},
+			workspace:  &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentWrite},
+			wantTools:  []string{"apply_patch", "edit", "write"},
+			wantNonNil: true,
+		},
+		{
+			name: "explicit empty remains deny all",
+			runtime: &corev1alpha1.AgentCLIRuntime{
+				Type: corev1alpha1.AgentRuntimeOpencode, DefaultAllowedTools: []string{}, DefaultAllowBash: &allowBash,
+			},
+			workspace:  &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentWrite},
+			wantTools:  []string{},
+			wantNonNil: true,
+		},
+		{
+			name:         "explicit empty task override remains deny all",
+			runtime:      &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeOpencode},
+			workspace:    &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentWrite},
+			agentRuntime: &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{}},
+			wantTools:    []string{},
+			wantNonNil:   true,
+		},
+		{
+			name: "disallowed mutation alias closes the group",
+			runtime: &corev1alpha1.AgentCLIRuntime{
+				Type: corev1alpha1.AgentRuntimeOpencode, DefaultAllowedTools: []string{"Edit"}, DefaultAllowBash: &allowBash,
+			},
+			workspace:  &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentWrite},
+			wantTools:  []string{},
+			wantNonNil: true,
+		},
+		{
+			name: "bash remains canonical without duplicate authority",
+			runtime: &corev1alpha1.AgentCLIRuntime{
+				Type: corev1alpha1.AgentRuntimeOpencode, DefaultAllowedTools: []string{"Bash"}, DefaultAllowBash: &allowBashTrue,
+			},
+			workspace:  &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentWrite},
+			wantTools:  []string{"bash"},
+			wantBash:   true,
+			wantNonNil: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: tt.runtime}}
+			req := CreateTaskRequest{Workspace: tt.workspace, AgentRuntime: tt.agentRuntime}
+			if tt.name == "disallowed mutation alias closes the group" {
+				req.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{DisallowedTools: []string{"write"}}
+			}
+			gotTools, gotBash := contextTokenTaskCreateEffectiveRuntimePolicy(req, agent)
+			require.Equal(t, tt.wantTools, gotTools)
+			require.Equal(t, tt.wantBash, gotBash)
+			if tt.wantNonNil {
+				require.NotNil(t, gotTools)
+			}
+		})
+	}
+}
+
+func TestContextTokenRuntimeAuthorizationPolicyExpandsGenericNarrowing(t *testing.T) {
+	allowBash := false
+	agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+		Type: corev1alpha1.AgentRuntimeClaude, DefaultAllowBash: &allowBash,
+	}}}
+
+	gotTools, gotBash := contextTokenAgentRuntimeAuthorizationPolicy(agent)
+	require.Equal(t, []string{"Edit", "Glob", "Grep", "Read", "WebFetch", "WebSearch", "Write"}, gotTools)
+	require.False(t, gotBash)
+
+	gotTools, gotBash = contextTokenTaskCreateEffectiveRuntimePolicy(CreateTaskRequest{
+		AgentRuntime: &corev1alpha1.AgentRuntimeSpec{DisallowedTools: []string{"Write"}},
+	}, &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+		Type: corev1alpha1.AgentRuntimeClaude,
+	}}})
+	require.Equal(t, []string{"Bash", "Edit", "Glob", "Grep", "Read", "WebFetch", "WebSearch"}, gotTools)
+	require.True(t, gotBash)
+	require.Empty(t, contextTokenTaskToolFailures(&ContextToken{TransactionContext: map[string]any{
+		"allowedTools": []any{"Bash", "Edit", "Glob", "Grep", "Read", "WebFetch", "WebSearch"},
+	}}, contextTokenTaskCreateAuthorizationContext{
+		Request: CreateTaskRequest{Type: corev1alpha1.TaskTypeAgent},
+		Agent: &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+			Type: corev1alpha1.AgentRuntimeClaude,
+		}}},
+		RuntimeAllowedTools: gotTools,
+		RuntimeAllowBash:    gotBash,
+	}))
+
+	allowBash = false
+	gotTools, gotBash = contextTokenAgentRuntimeAuthorizationPolicy(&corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{
+		Runtime: &corev1alpha1.AgentCLIRuntime{
+			Type: corev1alpha1.AgentRuntimeClaude, DefaultAllowedTools: []string{"Read", "Bash"}, DefaultAllowBash: &allowBash,
+		},
+	}})
+	require.Equal(t, []string{"Read"}, gotTools)
+	require.False(t, gotBash)
+
+	gotTools, gotBash = contextTokenTaskCreateEffectiveRuntimePolicy(CreateTaskRequest{
+		AgentRuntime: &corev1alpha1.AgentRuntimeSpec{DisallowedTools: []string{"Write"}},
+	}, &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+		Type: corev1alpha1.AgentRuntimeClaude, DefaultAllowedTools: []string{"Read", "Write"},
+	}}})
+	require.Equal(t, []string{"Read"}, gotTools)
+	require.False(t, gotBash)
+
+	gotTools, gotBash = contextTokenAgentRuntimeAuthorizationPolicy(&corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{
+		Runtime: &corev1alpha1.AgentCLIRuntime{
+			Type: corev1alpha1.AgentRuntimeClaude, DefaultAllowedTools: []string{"Read"},
+		},
+	}})
+	require.Equal(t, []string{"Read"}, gotTools)
+	require.False(t, gotBash)
+
+	gotTools, gotBash = contextTokenAgentRuntimeAuthorizationPolicy(&corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{
+		Runtime: &corev1alpha1.AgentCLIRuntime{
+			Type: corev1alpha1.AgentRuntimeClaude, DefaultAllowedTools: []string{" "},
+		},
+	}})
+	require.Equal(t, []string{" "}, gotTools)
+	require.True(t, gotBash)
+
+	gotTools, gotBash = contextTokenTaskCreateEffectiveRuntimePolicy(CreateTaskRequest{
+		AgentRuntime: &corev1alpha1.AgentRuntimeSpec{DisallowedTools: []string{"bAsH"}},
+	}, &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+		Type: corev1alpha1.AgentRuntimeClaude,
+	}}})
+	require.Equal(t, []string{"Edit", "Glob", "Grep", "Read", "WebFetch", "WebSearch", "Write"}, gotTools)
+	require.False(t, gotBash)
+}
+
+func TestContextTokenRuntimeToolConstraintsDoesNotDuplicateOpenCodeBash(t *testing.T) {
+	agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+		Type: corev1alpha1.AgentRuntimeOpencode,
+	}}}
+	got := contextTokenRuntimeToolConstraints(contextTokenTaskCreateAuthorizationContext{
+		Request: CreateTaskRequest{Type: corev1alpha1.TaskTypeAgent}, Agent: agent,
+		RuntimeAllowedTools: []string{"bash"}, RuntimeAllowBash: true,
+	})
+	require.Equal(t, []string{"bash"}, got)
+}
+
+func TestContextTokenTaskToolFailuresAcceptsOpenCodeDenyAll(t *testing.T) {
+	allowBash := false
+	agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+		Type: corev1alpha1.AgentRuntimeOpencode, DefaultAllowedTools: []string{}, DefaultAllowBash: &allowBash,
+	}}}
+	failures := contextTokenTaskToolFailures(&ContextToken{TransactionContext: map[string]any{
+		"allowedTools": []any{},
+	}}, contextTokenTaskCreateAuthorizationContext{
+		Request: CreateTaskRequest{Type: corev1alpha1.TaskTypeAgent}, Agent: agent,
+		RuntimeAllowedTools: []string{}, RuntimeAllowBash: false,
+	})
+	require.Empty(t, failures)
+}
+
 func TestContextTokenTaskToolCredentialFailuresForOutboundAccessPolicy(t *testing.T) {
 	scheme := runtime.NewScheme()
 	require.NoError(t, corev1alpha1.AddToScheme(scheme))
@@ -665,6 +953,105 @@ func TestContextTokenTaskToolCredentialFailuresForOutboundAccessPolicy(t *testin
 	require.Contains(t, failures[0], "resource-assertion")
 }
 
+func TestContextTokenTaskToolCredentialFailuresResolvesBuiltInRuntimeCustomTools(t *testing.T) {
+	cfg := enforceContextTokenAuthorizationConfig()
+	cfg.SecretCredentialReadScopeList = []string{ContextTokenScopeSecretsCredentialsRead}
+
+	tests := []struct {
+		name             string
+		runtimeType      corev1alpha1.AgentRuntimeType
+		tool             *corev1alpha1.Tool
+		policy           *corev1alpha1.OutboundAccessPolicy
+		credentialSecret string
+	}{
+		{
+			name:        "OpenCode AuthSecretRef",
+			runtimeType: corev1alpha1.AgentRuntimeOpencode,
+			tool: &corev1alpha1.Tool{
+				ObjectMeta: metav1.ObjectMeta{Name: "incident-search", Namespace: "team-a"},
+				Spec: corev1alpha1.ToolSpec{
+					BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassRead,
+					HTTP: &corev1alpha1.HTTPExecution{
+						URL: "https://tools.example.test/incidents",
+						AuthSecretRef: &corev1alpha1.SecretKeySelector{
+							Name: "opencode-tool-auth", Key: "token",
+						},
+					},
+				},
+			},
+			credentialSecret: "opencode-tool-auth",
+		},
+		{
+			name:        "Codex OutboundAccessPolicy",
+			runtimeType: corev1alpha1.AgentRuntimeCodex,
+			tool: &corev1alpha1.Tool{
+				ObjectMeta: metav1.ObjectMeta{Name: "deploy-status", Namespace: "team-a"},
+				Spec: corev1alpha1.ToolSpec{
+					BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassRead,
+					HTTP: &corev1alpha1.HTTPExecution{
+						URL: "https://tools.example.test/deployments",
+						OutboundAccessPolicyRef: &corev1alpha1.LocalObjectReference{
+							Name: "resource-api",
+						},
+					},
+				},
+			},
+			policy: readyContextTokenOutboundPolicy(corev1alpha1.OutboundAccessPolicySpec{
+				Direct: &corev1alpha1.DirectOutboundAccess{
+					Subject: corev1alpha1.OutboundTokenSource{
+						Source: corev1alpha1.OutboundTokenSourceSecretRef,
+						SecretRef: &corev1alpha1.NamespacedSecretKeySelector{
+							Name: "codex-resource-assertion", Key: "token",
+						},
+					},
+				},
+			}),
+			credentialSecret: "codex-resource-assertion",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			scheme := runtime.NewScheme()
+			require.NoError(t, corev1alpha1.AddToScheme(scheme))
+			builder := fake.NewClientBuilder().WithScheme(scheme).WithObjects(tt.tool)
+			if tt.policy != nil {
+				builder = builder.WithObjects(tt.policy)
+			}
+			client := builder.Build()
+			agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type: tt.runtimeType,
+			}}}
+			authzCtx := contextTokenTaskCreateAuthorizationContext{
+				Namespace: "team-a",
+				Request:   CreateTaskRequest{Type: corev1alpha1.TaskTypeAgent},
+				Agent:     agent,
+				RuntimeAllowedTools: []string{
+					tt.tool.Name,
+				},
+			}
+			token := &ContextToken{Scopes: []string{ContextTokenScopeTaskCreate}}
+
+			failures, err := contextTokenTaskToolCredentialFailures(context.Background(), client, token, cfg, authzCtx)
+			require.NoError(t, err)
+			require.Len(t, failures, 1)
+			require.Contains(t, failures[0], ContextTokenScopeSecretsCredentialsRead)
+
+			token.Scopes = append(token.Scopes, ContextTokenScopeSecretsCredentialsRead)
+			token.TransactionContext = map[string]any{"secret": "different-secret"}
+			failures, err = contextTokenTaskToolCredentialFailures(context.Background(), client, token, cfg, authzCtx)
+			require.NoError(t, err)
+			require.Len(t, failures, 1)
+			require.Contains(t, failures[0], tt.credentialSecret)
+
+			token.TransactionContext = map[string]any{"secret": tt.credentialSecret}
+			failures, err = contextTokenTaskToolCredentialFailures(context.Background(), client, token, cfg, authzCtx)
+			require.NoError(t, err)
+			require.Empty(t, failures)
+		})
+	}
+}
+
 func TestContextTokenTaskToolCredentialFailuresForTLSCASecrets(t *testing.T) {
 	tests := []struct {
 		name string
@@ -1014,3 +1401,59 @@ func TestContextTokenTaskToolCredentialFailuresAllowsLowercaseBrokeredBashWithSy
 	require.NoError(t, err)
 	require.Empty(t, failures)
 }
+
+func TestContextTokenAgentSpecToolFailuresAcceptsNormalizedOpenCodeBash(t *testing.T) {
+	allowBash := true
+	agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+		Type: corev1alpha1.AgentRuntimeOpencode, DefaultAllowedTools: []string{"Bash"}, DefaultAllowBash: &allowBash,
+	}}}
+	authzCtx, err := resolveContextTokenAgentSpecAuthorizationContext(context.Background(), nil, agent)
+	require.NoError(t, err)
+	require.Equal(t, []string{"bash"}, authzCtx.RuntimeAllowedTools)
+	require.True(t, authzCtx.RuntimeAllowBash)
+
+	failures := contextTokenAgentSpecToolFailures(&ContextToken{TransactionContext: map[string]any{
+		"allowedTools": []any{"bash"},
+	}}, authzCtx)
+	require.Empty(t, failures)
+}
+
+func TestContextTokenTaskToolFailuresNormalizesOpenCodePublicAllowlist(t *testing.T) {
+	agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+		Type: corev1alpha1.AgentRuntimeOpencode,
+	}}}
+	failures := contextTokenTaskToolFailures(&ContextToken{TransactionContext: map[string]any{
+		"allowedTools": []any{"Read", "Edit", "Bash"},
+	}}, contextTokenTaskCreateAuthorizationContext{
+		Request: CreateTaskRequest{Type: corev1alpha1.TaskTypeAgent}, Agent: agent,
+		RuntimeAllowedTools: []string{"apply_patch", "bash", "edit", "read", "write"}, RuntimeAllowBash: true,
+	})
+	require.Empty(t, failures)
+}
+
+func TestContextTokenAgentSpecToolFailuresNormalizesOpenCodePublicAllowlist(t *testing.T) {
+	authzCtx := contextTokenAgentSpecAuthorizationContext{
+		Agent: &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+			Type: corev1alpha1.AgentRuntimeOpencode,
+		}}},
+		RuntimeAllowedTools: []string{"apply_patch", "bash", "edit", "read", "write"},
+		RuntimeAllowBash:    true,
+	}
+	failures := contextTokenAgentSpecToolFailures(&ContextToken{TransactionContext: map[string]any{
+		"allowedTools": []any{"Read", "Edit", "Bash"},
+	}}, authzCtx)
+	require.Empty(t, failures)
+}
+
+func TestContextTokenTaskToolFailuresAcceptsGenericDenyAll(t *testing.T) {
+	agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+		Type: corev1alpha1.AgentRuntimeCodex, DefaultAllowedTools: []string{},
+	}}}
+	failures := contextTokenTaskToolFailures(&ContextToken{TransactionContext: map[string]any{
+		"allowedTools": []any{},
+	}}, contextTokenTaskCreateAuthorizationContext{
+		Request: CreateTaskRequest{Type: corev1alpha1.TaskTypeAgent}, Agent: agent,
+		RuntimeAllowedTools: []string{}, RuntimeAllowBash: false,
+	})
+	require.Empty(t, failures)
+}
diff --git a/internal/api/github_label_webhook.go b/internal/api/github_label_webhook.go
index e823bb8dc..ffdb84c22 100644
--- a/internal/api/github_label_webhook.go
+++ b/internal/api/github_label_webhook.go
@@ -738,38 +738,19 @@ func buildGitHubLabelTask(namespace, agentName, action, replayKey, delivery, eve
 				Name: agentName,
 			},
 			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				MaxTurns:  githubMaxTurns(),
-				Workspace: workspace,
-			},
-			Timeout: githubTimeout(),
-			Env: []corev1.EnvVar{
-				{Name: "ORKA_GITHUB_EVENT", Value: event},
-				{Name: "ORKA_GITHUB_DELIVERY", Value: delivery},
-				{Name: "ORKA_GITHUB_LABEL", Value: payload.Label.Name},
-				{Name: "ORKA_GITHUB_ACTION", Value: action},
-				{Name: "ORKA_GITHUB_REPOSITORY", Value: payload.Repository.FullName},
-				{Name: "ORKA_GITHUB_TARGET_URL", Value: target.HTMLURL},
+				MaxTurns: githubMaxTurns(),
 			},
+			Workspace: workspace,
+			Timeout:   githubTimeout(),
 		},
 	}
-	if action == githubActionReview && workspace != nil && workspace.GitSecretRef != nil {
+	if action == githubActionReview && workspace != nil && workspace.ReadCredentialRef != nil {
 		task.Annotations[labels.AnnotationWorkspaceInitContainer] = queryTrue
 	}
 	if target.Number > 0 {
 		task.Labels[labels.LabelGitHubNumber] = labels.SelectorValue(strconv.Itoa(target.Number))
 		task.Annotations[labels.AnnotationGitHubNumber] = strconv.Itoa(target.Number)
 	}
-	if target.IsPR {
-		if baseRepo := repoURL(target.BaseRepo); baseRepo != "" {
-			task.Spec.Env = append(task.Spec.Env, corev1.EnvVar{Name: workerenv.PRBaseRepo, Value: baseRepo})
-		}
-		if target.BaseSHA != "" {
-			task.Spec.Env = append(task.Spec.Env, corev1.EnvVar{Name: workerenv.PRBaseSHA, Value: target.BaseSHA})
-		}
-	}
-	if action == githubActionUpdateBranch {
-		task.Spec.Env = append(task.Spec.Env, corev1.EnvVar{Name: workerenv.AllowEmptyPushBranch, Value: "true"})
-	}
 	return task
 }
 
@@ -807,6 +788,7 @@ func githubWorkspace(action string, target githubLabelTarget, replayKey string)
 		repo = target.HeadRepo
 	}
 	ws := &corev1alpha1.WorkspaceConfig{
+		Intent:  corev1alpha1.WorkspaceIntentRead,
 		GitRepo: repoURL(repo),
 	}
 
@@ -838,9 +820,19 @@ func githubWorkspace(action string, target githubLabelTarget, replayKey string)
 	}
 
 	if gitSecret != "" {
-		ws.GitSecretRef = &corev1.LocalObjectReference{Name: gitSecret}
+		ws.ReadCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: gitSecret}
+	}
+	if ws.PushBranch != "" {
+		ws.Intent = corev1alpha1.WorkspaceIntentWrite
+		ws.PublicationGitRepo = ws.GitRepo
+		if gitSecret != "" {
+			ws.PublicationReadCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: gitSecret}
+			ws.PublicationCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: gitSecret}
+		}
 	}
-	if target.IsPR && target.BaseBranch != "" {
+	// prBaseBranch is a publication field: the ACP workspace preflight rejects it
+	// on non-write intents, and read flows carry base-branch context in the prompt.
+	if target.IsPR && target.BaseBranch != "" && ws.Intent == corev1alpha1.WorkspaceIntentWrite {
 		ws.PRBaseBranch = target.BaseBranch
 	}
 	return ws
diff --git a/internal/api/github_label_webhook_test.go b/internal/api/github_label_webhook_test.go
index ed94a2613..782c9d707 100644
--- a/internal/api/github_label_webhook_test.go
+++ b/internal/api/github_label_webhook_test.go
@@ -32,7 +32,6 @@ import (
 	"github.com/orka-agents/orka/internal/labels"
 	"github.com/orka-agents/orka/internal/store"
 	"github.com/orka-agents/orka/internal/store/sqlite"
-	"github.com/orka-agents/orka/internal/workerenv"
 )
 
 const (
@@ -76,10 +75,10 @@ func TestGitHubWebhook_IssueImplementLabelCreatesAgentTask(t *testing.T) {
 	if task.Spec.AgentRef == nil || task.Spec.AgentRef.Name != "codex-agent" {
 		t.Fatalf("agentRef = %#v, want codex-agent", task.Spec.AgentRef)
 	}
-	if task.Spec.AgentRuntime == nil || task.Spec.AgentRuntime.Workspace == nil {
+	if task.Spec.AgentRuntime == nil || task.Spec.Workspace == nil {
 		t.Fatal("agent runtime workspace missing")
 	}
-	ws := task.Spec.AgentRuntime.Workspace
+	ws := task.Spec.Workspace
 	if ws.GitRepo != githubWebhookTestVekilCloneURL {
 		t.Errorf("gitRepo = %q", ws.GitRepo)
 	}
@@ -90,8 +89,11 @@ func TestGitHubWebhook_IssueImplementLabelCreatesAgentTask(t *testing.T) {
 	if ws.PushBranch != wantPushBranch {
 		t.Errorf("pushBranch = %q, want %q", ws.PushBranch, wantPushBranch)
 	}
-	if ws.GitSecretRef == nil || ws.GitSecretRef.Name != githubWebhookTestGitSecret {
-		t.Fatalf("gitSecretRef = %#v, want %s", ws.GitSecretRef, githubWebhookTestGitSecret)
+	if ws.ReadCredentialRef == nil || ws.ReadCredentialRef.Name != githubWebhookTestGitSecret {
+		t.Fatalf("readCredentialRef = %#v, want %s", ws.ReadCredentialRef, githubWebhookTestGitSecret)
+	}
+	if ws.PublicationReadCredentialRef == nil || ws.PublicationReadCredentialRef.Name != githubWebhookTestGitSecret {
+		t.Fatalf("publicationReadCredentialRef = %#v, want %s", ws.PublicationReadCredentialRef, githubWebhookTestGitSecret)
 	}
 	if task.Labels[labels.LabelCreatedBy] != githubWebhookCreatedBy {
 		t.Errorf("created-by label = %q", task.Labels[labels.LabelCreatedBy])
@@ -163,7 +165,7 @@ func TestGitHubWebhook_PullRequestUpdateBranchUsesHeadBranch(t *testing.T) {
 	if err := fc.Get(t.Context(), types.NamespacedName{Name: githubWebhookTaskNameForBody(githubActionUpdateBranch, 34, body), Namespace: "default"}, &task); err != nil {
 		t.Fatalf("created task not found: %v", err)
 	}
-	ws := task.Spec.AgentRuntime.Workspace
+	ws := task.Spec.Workspace
 	if ws.Branch != "feature/x" {
 		t.Errorf("branch = %q, want feature/x", ws.Branch)
 	}
@@ -173,20 +175,17 @@ func TestGitHubWebhook_PullRequestUpdateBranchUsesHeadBranch(t *testing.T) {
 	if ws.PushBranch != "feature/x" {
 		t.Errorf("pushBranch = %q, want feature/x", ws.PushBranch)
 	}
-	if ws.GitSecretRef == nil || ws.GitSecretRef.Name != githubWebhookTestGitSecret {
-		t.Fatalf("gitSecretRef = %#v, want %s for same-repo PR", ws.GitSecretRef, githubWebhookTestGitSecret)
+	if ws.ReadCredentialRef == nil || ws.ReadCredentialRef.Name != githubWebhookTestGitSecret {
+		t.Fatalf("readCredentialRef = %#v, want %s for same-repo PR", ws.ReadCredentialRef, githubWebhookTestGitSecret)
+	}
+	if ws.PublicationReadCredentialRef == nil || ws.PublicationReadCredentialRef.Name != githubWebhookTestGitSecret {
+		t.Fatalf("publicationReadCredentialRef = %#v, want %s for same-repo PR", ws.PublicationReadCredentialRef, githubWebhookTestGitSecret)
 	}
 	if ws.PRBaseBranch != githubWebhookTestDefaultBranch {
 		t.Errorf("prBaseBranch = %q, want main", ws.PRBaseBranch)
 	}
-	if got := githubWebhookTaskEnvValue(task.Spec.Env, workerenv.AllowEmptyPushBranch); got != "true" {
-		t.Errorf("%s = %q, want true", workerenv.AllowEmptyPushBranch, got)
-	}
-	if got := githubWebhookTaskEnvValue(task.Spec.Env, workerenv.PRBaseRepo); got != githubWebhookTestVekilCloneURL {
-		t.Errorf("%s = %q, want base repo clone URL", workerenv.PRBaseRepo, got)
-	}
-	if got := githubWebhookTaskEnvValue(task.Spec.Env, workerenv.PRBaseSHA); got != "base-sha" {
-		t.Errorf("%s = %q, want base-sha", workerenv.PRBaseSHA, got)
+	if len(task.Spec.Env) != 0 {
+		t.Errorf("task env = %#v, want empty because agent tasks reject arbitrary task env", task.Spec.Env)
 	}
 	if !strings.Contains(task.Spec.Prompt, "Update the pull request branch") {
 		t.Errorf("prompt = %s", task.Spec.Prompt)
@@ -226,7 +225,7 @@ func TestGitHubWebhook_PullRequestImplementUsesForkHeadRepo(t *testing.T) {
 	if err := fc.Get(t.Context(), types.NamespacedName{Name: githubWebhookTaskNameForBody(githubActionImplement, 35, body), Namespace: "default"}, &task); err != nil {
 		t.Fatalf("created task not found: %v", err)
 	}
-	ws := task.Spec.AgentRuntime.Workspace
+	ws := task.Spec.Workspace
 	if ws.GitRepo != "https://github.com/contributor/orka.git" {
 		t.Errorf("gitRepo = %q, want fork head repo", ws.GitRepo)
 	}
@@ -239,11 +238,11 @@ func TestGitHubWebhook_PullRequestImplementUsesForkHeadRepo(t *testing.T) {
 	if ws.PushBranch != "" {
 		t.Errorf("pushBranch = %q, want empty for fork PR without safe git credentials", ws.PushBranch)
 	}
-	if ws.GitSecretRef != nil {
-		t.Fatalf("gitSecretRef = %#v, want nil for fork PR", ws.GitSecretRef)
+	if ws.ReadCredentialRef != nil {
+		t.Fatalf("readCredentialRef = %#v, want nil for fork PR", ws.ReadCredentialRef)
 	}
-	if ws.PRBaseBranch != githubWebhookTestDefaultBranch {
-		t.Errorf("prBaseBranch = %q, want main", ws.PRBaseBranch)
+	if ws.PRBaseBranch != "" {
+		t.Errorf("prBaseBranch = %q, want empty because prBaseBranch requires write workspace intent", ws.PRBaseBranch)
 	}
 	if !strings.Contains(task.Spec.Prompt, "Orka will not push them automatically") {
 		t.Errorf("prompt missing no-push guidance: %s", task.Spec.Prompt)
@@ -283,7 +282,7 @@ func TestGitHubWebhook_PullRequestMissingHeadRepoFailsClosedForGitSecret(t *test
 	if err := fc.Get(t.Context(), types.NamespacedName{Name: githubWebhookTaskNameForBody(githubActionImplement, 36, body), Namespace: "default"}, &task); err != nil {
 		t.Fatalf("created task not found: %v", err)
 	}
-	ws := task.Spec.AgentRuntime.Workspace
+	ws := task.Spec.Workspace
 	if ws.GitRepo != "https://github.com/orka-agents/orka.git" {
 		t.Errorf("gitRepo = %q, want base repository fallback", ws.GitRepo)
 	}
@@ -293,8 +292,8 @@ func TestGitHubWebhook_PullRequestMissingHeadRepoFailsClosedForGitSecret(t *test
 	if ws.PushBranch != "" {
 		t.Errorf("pushBranch = %q, want empty for PR without verified head repository", ws.PushBranch)
 	}
-	if ws.GitSecretRef != nil {
-		t.Fatalf("gitSecretRef = %#v, want nil for PR without verified head repository", ws.GitSecretRef)
+	if ws.ReadCredentialRef != nil {
+		t.Fatalf("readCredentialRef = %#v, want nil for PR without verified head repository", ws.ReadCredentialRef)
 	}
 	if !strings.Contains(task.Spec.Prompt, "Orka will not push them automatically") {
 		t.Errorf("prompt missing no-push guidance: %s", task.Spec.Prompt)
@@ -333,21 +332,21 @@ func TestGitHubWebhook_PullRequestReviewUsesInitOnlyGitSecret(t *testing.T) {
 	if err := fc.Get(t.Context(), types.NamespacedName{Name: githubWebhookTaskNameForBody(githubActionReview, 37, body), Namespace: "default"}, &task); err != nil {
 		t.Fatalf("created task not found: %v", err)
 	}
-	ws := task.Spec.AgentRuntime.Workspace
+	ws := task.Spec.Workspace
 	if ws.PushBranch != "" {
 		t.Errorf("pushBranch = %q, want empty for review action", ws.PushBranch)
 	}
-	if ws.GitSecretRef == nil || ws.GitSecretRef.Name != githubWebhookTestGitSecret {
-		t.Fatalf("gitSecretRef = %#v, want %s for init-only clone", ws.GitSecretRef, githubWebhookTestGitSecret)
+	if ws.ReadCredentialRef == nil || ws.ReadCredentialRef.Name != githubWebhookTestGitSecret {
+		t.Fatalf("readCredentialRef = %#v, want %s for init-only clone", ws.ReadCredentialRef, githubWebhookTestGitSecret)
 	}
 	if task.Annotations[labels.AnnotationWorkspaceInitContainer] != queryTrue {
 		t.Fatalf("workspace init annotation = %q, want true", task.Annotations[labels.AnnotationWorkspaceInitContainer])
 	}
-	if got := githubWebhookTaskEnvValue(task.Spec.Env, workerenv.PRBaseRepo); got != githubWebhookTestVekilCloneURL {
-		t.Errorf("%s = %q, want base repo clone URL", workerenv.PRBaseRepo, got)
+	if ws.PRBaseBranch != "" {
+		t.Errorf("prBaseBranch = %q, want empty because prBaseBranch requires write workspace intent", ws.PRBaseBranch)
 	}
-	if got := githubWebhookTaskEnvValue(task.Spec.Env, workerenv.PRBaseSHA); got != "base-sha" {
-		t.Errorf("%s = %q, want base-sha", workerenv.PRBaseSHA, got)
+	if len(task.Spec.Env) != 0 {
+		t.Errorf("task env = %#v, want empty because agent tasks reject arbitrary task env", task.Spec.Env)
 	}
 }
 
@@ -376,12 +375,12 @@ func TestGitHubWebhook_ToIssuesMountsGitSecretWithoutPushBranch(t *testing.T) {
 	if err := fc.Get(t.Context(), types.NamespacedName{Name: githubWebhookTaskNameForBody(githubActionToIssues, 38, body), Namespace: "default"}, &task); err != nil {
 		t.Fatalf("created task not found: %v", err)
 	}
-	ws := task.Spec.AgentRuntime.Workspace
+	ws := task.Spec.Workspace
 	if ws.PushBranch != "" {
 		t.Errorf("pushBranch = %q, want empty for to-issues action", ws.PushBranch)
 	}
-	if ws.GitSecretRef == nil || ws.GitSecretRef.Name != githubWebhookTestGitSecret {
-		t.Fatalf("gitSecretRef = %#v, want %s", ws.GitSecretRef, githubWebhookTestGitSecret)
+	if ws.ReadCredentialRef == nil || ws.ReadCredentialRef.Name != githubWebhookTestGitSecret {
+		t.Fatalf("readCredentialRef = %#v, want %s", ws.ReadCredentialRef, githubWebhookTestGitSecret)
 	}
 }
 
@@ -1163,15 +1162,6 @@ func readRespBody(t *testing.T, resp *http.Response) string {
 	return buf.String()
 }
 
-func githubWebhookTaskEnvValue(envVars []corev1.EnvVar, name string) string {
-	for _, envVar := range envVars {
-		if envVar.Name == name {
-			return envVar.Value
-		}
-	}
-	return ""
-}
-
 func assertNoTasks(t *testing.T, c client.Client) {
 	t.Helper()
 	var tasks corev1alpha1.TaskList
@@ -1199,7 +1189,7 @@ func TestGitHubWebhook_OrkaIssueLabelCreatesDurableCommandAndIssueRun(t *testing
 	secret := configureGitHubWebhookTest(t, map[string]string{githubAPIBaseURLEnv: permissionServer.URL})
 	pullRequestsEnabled := false
 	monitor := githubWebhookRepositoryMonitor("issue-loop", false)
-	monitor.Spec.GitSecretRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
+	monitor.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
 	monitor.Spec.Targets.PullRequests.Enabled = &pullRequestsEnabled
 	monitor.Spec.Targets.Issues.Enabled = true
 	monitor.Spec.Triggers.GitHub.Labels.Enabled = true
@@ -1286,7 +1276,7 @@ func TestGitHubWebhook_CustomOrkaPRLabelDoesNotAlsoQueueExactEventRun(t *testing
 	t.Cleanup(permissionServer.Close)
 	secret := configureGitHubWebhookTest(t, map[string]string{githubAPIBaseURLEnv: permissionServer.URL})
 	monitor := githubWebhookRepositoryMonitor("custom-pr-command", true)
-	monitor.Spec.GitSecretRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
+	monitor.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
 	monitor.Spec.Triggers.GitHub.Labels.Enabled = true
 	monitor.Spec.Triggers.GitHub.Labels.PullRequests.Review = "bot:review"
 	fc := newGitHubWebhookFakeClient(t, monitor, githubWebhookGitSecret())
@@ -1322,7 +1312,7 @@ func TestGitHubWebhook_OrkaGuardLabelBlocksCommandWithoutRun(t *testing.T) {
 	secret := configureGitHubWebhookTest(t, map[string]string{githubAPIBaseURLEnv: permissionServer.URL})
 	pullRequestsEnabled := false
 	monitor := githubWebhookRepositoryMonitor("guarded-issue-loop", false)
-	monitor.Spec.GitSecretRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
+	monitor.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
 	monitor.Spec.Targets.PullRequests.Enabled = &pullRequestsEnabled
 	monitor.Spec.Targets.Issues.Enabled = true
 	monitor.Spec.Triggers.GitHub.Labels.Enabled = true
@@ -1368,7 +1358,7 @@ func TestGitHubWebhook_OrkaEquivalentCommandsCoalesceActiveWorkAction(t *testing
 	secret := configureGitHubWebhookTest(t, map[string]string{githubAPIBaseURLEnv: permissionServer.URL})
 	pullRequestsEnabled := false
 	monitor := githubWebhookRepositoryMonitor("coalesce-issue-loop", false)
-	monitor.Spec.GitSecretRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
+	monitor.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
 	monitor.Spec.Targets.PullRequests.Enabled = &pullRequestsEnabled
 	monitor.Spec.Targets.Issues.Enabled = true
 	monitor.Spec.Triggers.GitHub.Labels.Enabled = true
@@ -1425,7 +1415,7 @@ func TestGitHubWebhook_OrkaResumeDoesNotBypassGuardLabel(t *testing.T) {
 	secret := configureGitHubWebhookTest(t, map[string]string{githubAPIBaseURLEnv: permissionServer.URL})
 	pullRequestsEnabled := false
 	monitor := githubWebhookRepositoryMonitor("guarded-resume", false)
-	monitor.Spec.GitSecretRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
+	monitor.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
 	monitor.Spec.Targets.PullRequests.Enabled = &pullRequestsEnabled
 	monitor.Spec.Targets.Issues.Enabled = true
 	monitor.Spec.Triggers.GitHub.Labels.Enabled = true
@@ -1490,7 +1480,7 @@ func TestGitHubWebhook_DuplicateAcceptedCommandEnsuresMissingRun(t *testing.T) {
 	secret := configureGitHubWebhookTest(t, map[string]string{githubAPIBaseURLEnv: permissionServer.URL})
 	pullRequestsEnabled := false
 	monitor := githubWebhookRepositoryMonitor("dedupe-run", false)
-	monitor.Spec.GitSecretRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
+	monitor.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
 	monitor.Spec.Targets.PullRequests.Enabled = &pullRequestsEnabled
 	monitor.Spec.Targets.Issues.Enabled = true
 	monitor.Spec.Triggers.GitHub.Labels.Enabled = true
@@ -1558,7 +1548,7 @@ func TestGitHubWebhook_DuplicateAcceptedCommandRetriesFailedRunSignal(t *testing
 	secret := configureGitHubWebhookTest(t, map[string]string{githubAPIBaseURLEnv: permissionServer.URL})
 	pullRequestsEnabled := false
 	monitor := githubWebhookRepositoryMonitor("dedupe-failed-run", false)
-	monitor.Spec.GitSecretRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
+	monitor.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
 	monitor.Spec.Targets.PullRequests.Enabled = &pullRequestsEnabled
 	monitor.Spec.Targets.Issues.Enabled = true
 	monitor.Spec.Triggers.GitHub.Labels.Enabled = true
diff --git a/internal/api/github_monitor_commands.go b/internal/api/github_monitor_commands.go
index 50231b4de..48b24315f 100644
--- a/internal/api/github_monitor_commands.go
+++ b/internal/api/github_monitor_commands.go
@@ -514,22 +514,23 @@ func githubBuiltInRepositoryPermission(permission string) bool {
 }
 
 func (h *Handlers) repositoryMonitorGitHubToken(ctx context.Context, monitor *corev1alpha1.RepositoryMonitor) (string, error) {
-	if monitor.Spec.GitSecretRef == nil || strings.TrimSpace(monitor.Spec.GitSecretRef.Name) == "" {
-		return "", fmt.Errorf("spec.gitSecretRef is required for GitHub actor permission checks")
+	if monitor.Spec.ForgeCredentialRef == nil || strings.TrimSpace(monitor.Spec.ForgeCredentialRef.Name) == "" {
+		return "", fmt.Errorf("spec.forgeCredentialRef is required for controller-owned GitHub operations")
 	}
+	secretName := strings.TrimSpace(monitor.Spec.ForgeCredentialRef.Name)
 	var secret corev1.Secret
-	if err := h.client.Get(ctx, types.NamespacedName{Name: monitor.Spec.GitSecretRef.Name, Namespace: monitor.Namespace}, &secret); err != nil {
+	if err := h.client.Get(ctx, types.NamespacedName{Name: secretName, Namespace: monitor.Namespace}, &secret); err != nil {
 		if apierrors.IsNotFound(err) {
-			return "", fmt.Errorf("spec.gitSecretRef %q not found in namespace %q", monitor.Spec.GitSecretRef.Name, monitor.Namespace)
+			return "", fmt.Errorf("spec.forgeCredentialRef %q not found in namespace %q", secretName, monitor.Namespace)
 		}
-		return "", fmt.Errorf("failed to get spec.gitSecretRef %q: %w", monitor.Spec.GitSecretRef.Name, err)
+		return "", fmt.Errorf("failed to get spec.forgeCredentialRef %q: %w", secretName, err)
 	}
 	for _, key := range []string{"token", "password", workerenv.GitHubToken} {
 		if value := strings.TrimSpace(string(secret.Data[key])); value != "" {
 			return value, nil
 		}
 	}
-	return "", fmt.Errorf("spec.gitSecretRef %q must contain a token, password, or %s key", monitor.Spec.GitSecretRef.Name, workerenv.GitHubToken)
+	return "", fmt.Errorf("spec.forgeCredentialRef %q must contain a token, password, or %s key", secretName, workerenv.GitHubToken)
 }
 
 func repositoryMonitorPermissionAllowedForIntent(monitor *corev1alpha1.RepositoryMonitor, permission, intent string) bool {
diff --git a/internal/api/github_monitor_commands_test.go b/internal/api/github_monitor_commands_test.go
index 79a06d7d6..4b377a58a 100644
--- a/internal/api/github_monitor_commands_test.go
+++ b/internal/api/github_monitor_commands_test.go
@@ -32,7 +32,7 @@ func TestGitHubWebhook_CommandLabelIsConsumedAfterDurableQueue(t *testing.T) {
 	monitorStore := setupGitHubWebhookMonitorStore(t)
 	pullRequestsEnabled := false
 	monitor := githubWebhookRepositoryMonitor("consume-after-queue", false)
-	monitor.Spec.GitSecretRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
+	monitor.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
 	monitor.Spec.Targets.PullRequests.Enabled = &pullRequestsEnabled
 	monitor.Spec.Targets.Issues.Enabled = true
 	monitor.Spec.Triggers.GitHub.Labels.Enabled = true
@@ -98,7 +98,7 @@ func TestGitHubWebhook_DuplicateCommandQueuesBeforeLabelCleanup(t *testing.T) {
 	monitorStore := setupGitHubWebhookMonitorStore(t)
 	pullRequestsEnabled := false
 	monitor := githubWebhookRepositoryMonitor("duplicate-queue-before-consume", false)
-	monitor.Spec.GitSecretRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
+	monitor.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
 	monitor.Spec.Targets.PullRequests.Enabled = &pullRequestsEnabled
 	monitor.Spec.Targets.Issues.Enabled = true
 	monitor.Spec.Triggers.GitHub.Labels.Enabled = true
@@ -165,7 +165,7 @@ func TestGitHubWebhook_ProcessedDuplicateRetriesLabelCleanupWithoutErasingReason
 	monitorStore := setupGitHubWebhookMonitorStore(t)
 	pullRequestsEnabled := false
 	monitor := githubWebhookRepositoryMonitor("processed-cleanup-retry", false)
-	monitor.Spec.GitSecretRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
+	monitor.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
 	monitor.Spec.Targets.PullRequests.Enabled = &pullRequestsEnabled
 	monitor.Spec.Targets.Issues.Enabled = true
 	monitor.Spec.Triggers.GitHub.Labels.Enabled = true
@@ -277,7 +277,7 @@ func TestGitHubWebhook_CompletedDuplicateStillConsumesCommandLabel(t *testing.T)
 	monitorStore := setupGitHubWebhookMonitorStore(t)
 	pullRequestsEnabled := false
 	monitor := githubWebhookRepositoryMonitor("consume-completed-duplicate", false)
-	monitor.Spec.GitSecretRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
+	monitor.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
 	monitor.Spec.Targets.PullRequests.Enabled = &pullRequestsEnabled
 	monitor.Spec.Targets.Issues.Enabled = true
 	monitor.Spec.Triggers.GitHub.Labels.Enabled = true
@@ -377,7 +377,7 @@ func TestGitHubWebhook_RunCreateFailureLeavesRecoverableWorkAction(t *testing.T)
 	secret := configureGitHubWebhookTest(t, map[string]string{githubAPIBaseURLEnv: permissionServer.URL})
 	pullRequestsEnabled := false
 	monitor := githubWebhookRepositoryMonitor("run-create-failure", false)
-	monitor.Spec.GitSecretRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
+	monitor.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: githubWebhookTestGitSecret}
 	monitor.Spec.Targets.PullRequests.Enabled = &pullRequestsEnabled
 	monitor.Spec.Targets.Issues.Enabled = true
 	monitor.Spec.Triggers.GitHub.Labels.Enabled = true
diff --git a/internal/api/handlers.go b/internal/api/handlers.go
index f950e742e..b4857f835 100644
--- a/internal/api/handlers.go
+++ b/internal/api/handlers.go
@@ -26,9 +26,12 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/controller"
+	"github.com/orka-agents/orka/internal/executionmode"
 	gatewayruntime "github.com/orka-agents/orka/internal/gateway"
 	"github.com/orka-agents/orka/internal/labels"
 	"github.com/orka-agents/orka/internal/store"
+	storekube "github.com/orka-agents/orka/internal/store/kube"
 	"github.com/orka-agents/orka/internal/tools"
 	"github.com/orka-agents/orka/internal/tracing"
 )
@@ -85,10 +88,12 @@ type Handlers struct {
 	apiReader                 client.Reader
 	clientset                 kubernetes.Interface
 	watchNamespace            string
+	executionMode             executionmode.Mode
 	enforceNamespaceIsolation bool
 	contextTokenAuthorization ContextTokenAuthorizationConfig
 	resultStore               store.ResultStore
 	sessionStore              store.SessionStore
+	sessionManager            *controller.SessionManager
 	planStore                 store.PlanStore
 	healthChecker             store.HealthChecker
 	artifactStore             store.ArtifactStore
@@ -110,10 +115,12 @@ type HandlersConfig struct {
 	Client                    client.Client
 	APIReader                 client.Reader
 	WatchNamespace            string
+	ExecutionMode             executionmode.Mode
 	EnforceNamespaceIsolation bool
 	ContextTokenAuthorization ContextTokenAuthorizationConfig
 	ResultStore               store.ResultStore
 	SessionStore              store.SessionStore
+	SessionManager            *controller.SessionManager
 	PlanStore                 store.PlanStore
 	KubeClient                kubernetes.Interface
 	HealthChecker             store.HealthChecker
@@ -135,10 +142,12 @@ func NewHandlers(cfg HandlersConfig) *Handlers {
 		apiReader:                 cfg.APIReader,
 		clientset:                 cfg.KubeClient,
 		watchNamespace:            cfg.WatchNamespace,
+		executionMode:             cfg.ExecutionMode,
 		enforceNamespaceIsolation: cfg.EnforceNamespaceIsolation,
 		contextTokenAuthorization: cfg.ContextTokenAuthorization,
 		resultStore:               cfg.ResultStore,
 		sessionStore:              cfg.SessionStore,
+		sessionManager:            cfg.SessionManager,
 		planStore:                 cfg.PlanStore,
 		healthChecker:             cfg.HealthChecker,
 		artifactStore:             cfg.ArtifactStore,
@@ -369,10 +378,21 @@ func (h *Handlers) Readyz(c fiber.Ctx) error {
 		checks["store"] = "ok"
 	}
 
-	// Verify Kubernetes API connectivity
-	if h.client != nil {
-		var ns corev1.NamespaceList
-		if err := h.client.List(ctx, &ns, client.Limit(1)); err != nil {
+	// Verify Kubernetes API connectivity without starting a cache informer. In
+	// namespace-isolated mode, use the exact read covered by the controller's
+	// narrow Namespace RBAC grant.
+	reader := h.apiReader
+	if reader == nil {
+		reader = h.client
+	}
+	if reader != nil {
+		var err error
+		if h.watchNamespace != "" {
+			err = reader.Get(ctx, client.ObjectKey{Name: h.watchNamespace}, &corev1.Namespace{})
+		} else {
+			err = reader.List(ctx, &corev1.NamespaceList{}, client.Limit(1))
+		}
+		if err != nil {
 			checks["kubernetes"] = "unhealthy"
 			return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{
 				"status": "not ready",
@@ -436,6 +456,15 @@ func rejectReservedTaskAnnotations(annotations map[string]string) error {
 	return nil
 }
 
+func rejectReservedTaskLabels(taskLabels map[string]string) error {
+	for key := range taskLabels {
+		if strings.HasPrefix(key, "orka.ai/") {
+			return fiber.NewError(fiber.StatusBadRequest, fmt.Sprintf("label %q is reserved", key))
+		}
+	}
+	return nil
+}
+
 // CreateTask creates a new task
 func (h *Handlers) CreateTask(c fiber.Ctx) error {
 	if err := rejectRequestedByTampering(c.Body()); err != nil {
@@ -462,6 +491,9 @@ func (h *Handlers) CreateTask(c fiber.Ctx) error {
 	if err := rejectReservedTaskAnnotations(annotations); err != nil {
 		return err
 	}
+	if err := rejectReservedTaskLabels(req.Metadata.Labels); err != nil {
+		return err
+	}
 
 	explicitNamespace := req.Namespace
 	if explicitNamespace == "" {
@@ -916,6 +948,11 @@ func (h *Handlers) GetSession(c fiber.Ctx) error {
 		return fiber.NewError(fiber.StatusNotFound, "session not found")
 	}
 
+	executionControl, err := h.getSessionExecutionControl(ctx, namespace, id)
+	if err != nil {
+		return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to get session execution control: %v", err))
+	}
+
 	// Build JSONL transcript from messages for backward compatibility
 	var transcript string
 	if len(session.Messages) > 0 {
@@ -930,7 +967,7 @@ func (h *Handlers) GetSession(c fiber.Ctx) error {
 		transcript = strings.Join(lines, "\n")
 	}
 
-	return c.JSON(fiber.Map{
+	response := fiber.Map{
 		"name":         id,
 		"namespace":    namespace,
 		"transcript":   transcript,
@@ -940,7 +977,70 @@ func (h *Handlers) GetSession(c fiber.Ctx) error {
 		"activeTask":   session.ActiveTask,
 		"createdAt":    session.CreatedAt.Format(time.RFC3339),
 		"updatedAt":    session.UpdatedAt.Format(time.RFC3339),
-	})
+	}
+	if executionControl != nil {
+		response["executionControl"] = executionControl
+	}
+
+	return c.JSON(response)
+}
+
+// getSessionExecutionControl projects Kubernetes-authoritative Session state
+// into the public read API. The projection intentionally excludes mutation
+// Lease contents, controller epoch tokens, and other internal fencing data.
+func (h *Handlers) getSessionExecutionControl(
+	ctx context.Context,
+	namespace, sessionName string,
+) (fiber.Map, error) {
+	reader := h.apiReader
+	if reader == nil {
+		reader = h.client
+	}
+	if reader == nil {
+		return nil, nil
+	}
+
+	control := &corev1alpha1.RuntimeSessionControl{}
+	key := client.ObjectKey{
+		Namespace: namespace,
+		Name:      storekube.RuntimeSessionControlObjectName(sessionName),
+	}
+	if err := reader.Get(ctx, key, control); err != nil {
+		if apierrors.IsNotFound(err) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	if control.Spec.SessionName != sessionName {
+		return nil, fmt.Errorf("control record %s/%s has a mismatched immutable Session name", namespace, control.Name)
+	}
+
+	projection := fiber.Map{
+		"resourceVersion":         control.ResourceVersion,
+		"sessionUID":              control.Spec.SessionUID,
+		"runtimePoolRef":          control.Spec.RuntimePoolRef,
+		"runtimeProfileDigest":    control.Spec.RuntimeProfileDigest,
+		"generation":              control.Status.Generation,
+		"lifecycle":               control.Status.Lifecycle,
+		"availability":            control.Status.Availability,
+		"mutationLeaseGeneration": control.Status.MutationLeaseGeneration,
+		"blockedReason":           control.Status.BlockedReason,
+		"relatedPromptAttemptID":  control.Status.RelatedPromptAttemptID,
+		"relatedPublicationID":    control.Status.RelatedPublicationID,
+	}
+	if control.Status.Lineage != nil {
+		projection["lineage"] = fiber.Map{
+			"namespaceUID":    control.Status.Lineage.NamespaceUID,
+			"sessionUID":      control.Status.Lineage.SessionUID,
+			"contractVersion": control.Status.Lineage.ContractVersion,
+			"generation":      control.Status.Lineage.Generation,
+			"runtimeIdentity": control.Status.Lineage.RuntimeIdentity,
+			"configDigest":    control.Status.Lineage.ConfigDigest,
+			"establishedAt":   control.Status.Lineage.EstablishedAt,
+		}
+	}
+
+	return projection, nil
 }
 
 // DeleteSession deletes a session
@@ -955,12 +1055,16 @@ func (h *Handlers) DeleteSession(c fiber.Ctx) error {
 	}
 
 	ctx := c.Context()
-	if err := h.sessionStore.DeleteSession(ctx, namespace, id); err != nil {
+	deleteSession := h.sessionStore.DeleteSession
+	if h.sessionManager != nil {
+		deleteSession = h.sessionManager.DeleteSession
+	}
+	if err := deleteSession(ctx, namespace, id); err != nil {
 		if errors.Is(err, store.ErrNotFound) || errors.Is(err, store.ErrGatewayOwnedSession) {
 			return fiber.NewError(fiber.StatusNotFound, "session not found")
 		}
 		if errors.Is(err, store.ErrConflict) {
-			return fiber.NewError(fiber.StatusConflict, "session has pending gateway events")
+			return fiber.NewError(fiber.StatusConflict, "session has active or unsettled work")
 		}
 		return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to delete session: %v", err))
 	}
@@ -997,7 +1101,7 @@ func (h *Handlers) ListTools(c fiber.Ctx) error {
 	}
 
 	// Add built-in tools to the response
-	toolItems := make([]fiber.Map, 0, len(toolList.Items)+len(builtinToolsList))
+	toolItems := make([]fiber.Map, 0)
 	for _, tool := range builtinToolsList {
 		name, _ := tool["name"].(string)
 		allowed, err := contextTokenAllowsToolMetadata(c, h.contextTokenAuthorization, "listTools", name)
@@ -1185,6 +1289,9 @@ func (h *Handlers) CreateAgent(c fiber.Ctx) error {
 		ObjectMeta: objectMetaFromRequest(name, namespace, req.Metadata),
 		Spec:       req.Spec,
 	}
+	if err := executionmode.DefaultBuiltInAgentContract(agent, h.executionMode); err != nil {
+		return fiber.NewError(fiber.StatusBadRequest, err.Error())
+	}
 	if err := authorizeContextTokenAgentContext(c, h.contextTokenAuthorization, "createAgent", agent.Namespace, agent.Name); err != nil {
 		return err
 	}
diff --git a/internal/api/handlers_test.go b/internal/api/handlers_test.go
index be8d88de3..70c4a663c 100644
--- a/internal/api/handlers_test.go
+++ b/internal/api/handlers_test.go
@@ -17,6 +17,7 @@ import (
 	"net/http/httptest"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/gofiber/fiber/v3"
 	"github.com/stretchr/testify/require"
@@ -35,8 +36,10 @@ import (
 
 	gatewayv1alpha1 "github.com/orka-agents/orka/api/gateway/v1alpha1"
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/executionmode"
 	"github.com/orka-agents/orka/internal/labels"
 	"github.com/orka-agents/orka/internal/store"
+	storekube "github.com/orka-agents/orka/internal/store/kube"
 	"github.com/orka-agents/orka/internal/store/sqlite"
 )
 
@@ -253,6 +256,83 @@ func TestHandlers_Readyz(t *testing.T) {
 	}
 }
 
+func TestHandlers_Readyz_UsesUncachedNamedNamespaceRead(t *testing.T) {
+	tests := []struct {
+		name       string
+		apiObjects []client.Object
+		wantStatus int
+	}{
+		{
+			name: "namespace exists",
+			apiObjects: []client.Object{&corev1.Namespace{
+				ObjectMeta: metav1.ObjectMeta{Name: testWatchNamespace},
+			}},
+			wantStatus: http.StatusOK,
+		},
+		{
+			name:       "namespace read fails",
+			wantStatus: http.StatusServiceUnavailable,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			scheme := runtime.NewScheme()
+			require.NoError(t, corev1.AddToScheme(scheme))
+
+			cachedReads := 0
+			cachedClient := fake.NewClientBuilder().
+				WithScheme(scheme).
+				WithObjects(&corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: testWatchNamespace}}).
+				WithInterceptorFuncs(interceptor.Funcs{
+					Get: func(ctx context.Context, c client.WithWatch, key client.ObjectKey, obj client.Object, opts ...client.GetOption) error {
+						cachedReads++
+						return c.Get(ctx, key, obj, opts...)
+					},
+					List: func(ctx context.Context, c client.WithWatch, list client.ObjectList, opts ...client.ListOption) error {
+						cachedReads++
+						return c.List(ctx, list, opts...)
+					},
+				}).
+				Build()
+
+			apiGets := 0
+			apiLists := 0
+			apiReader := fake.NewClientBuilder().
+				WithScheme(scheme).
+				WithObjects(tt.apiObjects...).
+				WithInterceptorFuncs(interceptor.Funcs{
+					Get: func(ctx context.Context, c client.WithWatch, key client.ObjectKey, obj client.Object, opts ...client.GetOption) error {
+						apiGets++
+						require.Equal(t, client.ObjectKey{Name: testWatchNamespace}, key)
+						require.IsType(t, &corev1.Namespace{}, obj)
+						return c.Get(ctx, key, obj, opts...)
+					},
+					List: func(ctx context.Context, c client.WithWatch, list client.ObjectList, opts ...client.ListOption) error {
+						apiLists++
+						return c.List(ctx, list, opts...)
+					},
+				}).
+				Build()
+
+			handlers := NewHandlers(HandlersConfig{
+				Client:         cachedClient,
+				APIReader:      apiReader,
+				WatchNamespace: testWatchNamespace,
+			})
+			app := fiber.New()
+			app.Get("/readyz", handlers.Readyz)
+
+			resp, err := app.Test(httptest.NewRequest(http.MethodGet, "/readyz", nil))
+			require.NoError(t, err)
+			require.Equal(t, tt.wantStatus, resp.StatusCode)
+			require.Zero(t, cachedReads)
+			require.Equal(t, 1, apiGets)
+			require.Zero(t, apiLists)
+		})
+	}
+}
+
 func TestHandlers_CreateTask_Valid(t *testing.T) {
 	handlers, app := setupTestHandlers()
 	app.Post("/tasks", handlers.CreateTask)
@@ -510,16 +590,14 @@ func TestHandlers_CreateTask_ContextTokenAuthorizationEnforceAllowsMatchingToken
 		},
 	})
 	body := CreateTaskRequest{
-		Name:      "authorized-context-token-task",
-		Namespace: "default",
-		Type:      corev1alpha1.TaskTypeAgent,
-		AgentRef:  &corev1alpha1.AgentReference{Name: "reviewer"},
-		AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-			Workspace: &corev1alpha1.WorkspaceConfig{
-				GitRepo: "https://github.com/orka-agents/orka.git",
-				Branch:  "feature-branch",
-			},
-			AllowedTools: []string{"file_read"},
+		Name:         "authorized-context-token-task",
+		Namespace:    "default",
+		Type:         corev1alpha1.TaskTypeAgent,
+		AgentRef:     &corev1alpha1.AgentReference{Name: "reviewer"},
+		AgentRuntime: &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"file_read"}},
+		Workspace: &corev1alpha1.WorkspaceConfig{
+			GitRepo: "https://github.com/orka-agents/orka.git",
+			Branch:  "feature-branch",
 		},
 	}
 	bodyBytes, _ := json.Marshal(body)
@@ -674,6 +752,41 @@ func TestHandlers_CreateTask_ContextTokenAuthorizationRejectsProviderModelResolv
 	require.Equal(t, http.StatusForbidden, resp.StatusCode)
 }
 
+func TestHandlers_CreateTask_ContextTokenAuthorizationUsesOpenCodeAgentIdentityOverAIOverrides(t *testing.T) {
+	provider := newTestOIDCProvider(t)
+	ctxTokenConfig := testContextTokenConfig(t, provider, "")
+	agent := testAgentFromJSON(t, `{
+		"metadata": {"name": "opencode-agent", "namespace": "default"},
+		"spec": {
+			"model": {"name": "openai/gpt-5.4", "contextWindow": 32768, "maxTokens": 4096},
+			"runtime": {"type": "opencode"}
+		}
+	}`)
+	app := setupTestHandlersWithAuthz(t, ctxTokenConfig, ContextTokenAuthorizationModeEnforce, agent)
+	token := issueTestContextToken(t, provider, nil, map[string]any{
+		"scope": ContextTokenScopeTaskCreate,
+		"tctx": map[string]any{
+			"namespace":        "default",
+			"allowedProviders": []string{string(corev1alpha1.ProviderTypeAnthropic)},
+			"allowedModels":    []string{"claude-sonnet-4"},
+		},
+	})
+
+	resp := postCreateTaskWithContextToken(t, app, token, CreateTaskRequest{
+		Name:      "opencode-ai-override-denied",
+		Namespace: "default",
+		Type:      corev1alpha1.TaskTypeAgent,
+		AgentRef:  &corev1alpha1.AgentReference{Name: "opencode-agent"},
+		Prompt:    "review this change",
+		AI: &corev1alpha1.AISpec{
+			Provider: string(corev1alpha1.ProviderTypeAnthropic),
+			Model:    "claude-sonnet-4",
+		},
+	})
+
+	require.Equal(t, http.StatusForbidden, resp.StatusCode)
+}
+
 func TestHandlers_CreateTask_ContextTokenAuthorizationRejectsCrossNamespaceProviderRefMatches(t *testing.T) {
 	provider := newTestOIDCProvider(t)
 	ctxTokenConfig := testContextTokenConfig(t, provider, "")
@@ -1085,10 +1198,8 @@ func TestHandlers_GetTask_ContextTokenAuthorizationEnforcesLoadedTaskRepoContext
 		Spec: corev1alpha1.TaskSpec{
 			Type:     corev1alpha1.TaskTypeAgent,
 			AgentRef: &corev1alpha1.AgentReference{Name: "reviewer"},
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: "https://github.com/acme/allowed.git",
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: "https://github.com/acme/allowed.git",
 			},
 		},
 	}
@@ -1116,10 +1227,8 @@ func TestHandlers_ListTasks_ContextTokenAuthorizationFiltersLoadedTaskContext(t
 		Spec: corev1alpha1.TaskSpec{
 			Type:     corev1alpha1.TaskTypeAgent,
 			AgentRef: &corev1alpha1.AgentReference{Name: "reviewer"},
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: "https://github.com/acme/allowed.git",
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: "https://github.com/acme/allowed.git",
 			},
 		},
 	}
@@ -1128,10 +1237,8 @@ func TestHandlers_ListTasks_ContextTokenAuthorizationFiltersLoadedTaskContext(t
 		Spec: corev1alpha1.TaskSpec{
 			Type:     corev1alpha1.TaskTypeAgent,
 			AgentRef: &corev1alpha1.AgentReference{Name: "reviewer"},
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: "https://github.com/acme/other.git",
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: "https://github.com/acme/other.git",
 			},
 		},
 	}
@@ -1168,10 +1275,8 @@ func TestHandlers_GetTaskChildren_ContextTokenAuthorizationFiltersLoadedTaskCont
 		Spec: corev1alpha1.TaskSpec{
 			Type:     corev1alpha1.TaskTypeAgent,
 			AgentRef: &corev1alpha1.AgentReference{Name: "reviewer"},
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: "https://github.com/acme/allowed.git",
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: "https://github.com/acme/allowed.git",
 			},
 		},
 	}
@@ -1186,10 +1291,8 @@ func TestHandlers_GetTaskChildren_ContextTokenAuthorizationFiltersLoadedTaskCont
 		Spec: corev1alpha1.TaskSpec{
 			Type:     corev1alpha1.TaskTypeAgent,
 			AgentRef: &corev1alpha1.AgentReference{Name: "reviewer"},
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: "https://github.com/acme/allowed.git",
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: "https://github.com/acme/allowed.git",
 			},
 		},
 	}
@@ -1204,10 +1307,8 @@ func TestHandlers_GetTaskChildren_ContextTokenAuthorizationFiltersLoadedTaskCont
 		Spec: corev1alpha1.TaskSpec{
 			Type:     corev1alpha1.TaskTypeAgent,
 			AgentRef: &corev1alpha1.AgentReference{Name: "reviewer"},
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: "https://github.com/acme/other.git",
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: "https://github.com/acme/other.git",
 			},
 		},
 	}
@@ -1246,10 +1347,8 @@ func TestHandlers_DeleteTask_ContextTokenAuthorizationEnforcesLoadedTaskRepoCont
 		Spec: corev1alpha1.TaskSpec{
 			Type:     corev1alpha1.TaskTypeAgent,
 			AgentRef: &corev1alpha1.AgentReference{Name: "reviewer"},
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: "https://github.com/acme/allowed.git",
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: "https://github.com/acme/allowed.git",
 			},
 		},
 	}
@@ -1744,6 +1843,35 @@ func TestHandlers_CreateTask_RejectsClientSuppliedTransaction(t *testing.T) {
 	}
 }
 
+func TestHandlers_CreateTask_RejectsReservedLabels(t *testing.T) {
+	for _, labelName := range []string{labels.LabelParentTask, labels.LabelCoordinator} {
+		t.Run(labelName, func(t *testing.T) {
+			handlers, app := setupTestHandlers()
+			app.Post("/tasks", handlers.CreateTask)
+
+			body := CreateTaskRequest{
+				Name:      "reserved-label-task",
+				Namespace: "default",
+				Metadata: MetadataRequest{Labels: map[string]string{
+					labelName: "reserved-value",
+				}},
+				Type:  corev1alpha1.TaskTypeContainer,
+				Image: "busybox",
+			}
+			bodyBytes, _ := json.Marshal(body)
+			req := httptest.NewRequest(http.MethodPost, "/tasks", bytes.NewReader(bodyBytes))
+			req.Header.Set("Content-Type", "application/json")
+			resp, err := app.Test(req)
+			if err != nil {
+				t.Fatalf("Test request failed: %v", err)
+			}
+			if resp.StatusCode != http.StatusBadRequest {
+				t.Fatalf("StatusCode = %d, want %d", resp.StatusCode, http.StatusBadRequest)
+			}
+		})
+	}
+}
+
 func TestHandlers_CreateTask_RejectsReservedAnnotations(t *testing.T) {
 	tests := []struct {
 		name       string
@@ -2603,6 +2731,71 @@ func TestHandlers_GetSession_Success(t *testing.T) {
 	}
 }
 
+func TestHandlers_GetSessionProjectsSafeExecutionControl(t *testing.T) {
+	scheme := runtime.NewScheme()
+	require.NoError(t, corev1alpha1.AddToScheme(scheme))
+	require.NoError(t, corev1.AddToScheme(scheme))
+
+	const sessionName = "lineage-session"
+	control := &corev1alpha1.RuntimeSessionControl{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:            storekube.RuntimeSessionControlObjectName(sessionName),
+			Namespace:       "default",
+			ResourceVersion: "42",
+		},
+		Spec: corev1alpha1.RuntimeSessionControlSpec{
+			SessionName:          sessionName,
+			SessionUID:           "session-uid",
+			RuntimePoolRef:       "opencode-read",
+			RuntimeProfileDigest: "sha256:" + strings.Repeat("a", 64),
+		},
+		Status: corev1alpha1.RuntimeSessionControlStatus{
+			Generation:              3,
+			Lifecycle:               corev1alpha1.RuntimeSessionControlLifecycle("Finalizing"),
+			Availability:            corev1alpha1.RuntimeSessionControlAvailability("ReconciliationBlocked"),
+			MutationLeaseGeneration: 8,
+			BlockedReason:           "publication outcome unknown",
+			RelatedPublicationID:    "publication-1",
+			Lineage: &corev1alpha1.RuntimeSessionLineageStatus{
+				NamespaceUID:    "namespace-uid",
+				SessionUID:      "session-uid",
+				ContractVersion: corev1alpha1.AgentRuntimeContractHarnessV2,
+				Generation:      1,
+				RuntimeIdentity: "opencode",
+				ConfigDigest:    "sha256:" + strings.Repeat("b", 64),
+				EstablishedAt:   metav1.NewTime(time.Date(2026, time.August, 6, 0, 0, 0, 0, time.UTC)),
+			},
+		},
+	}
+	fakeClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(control).Build()
+	db, err := sqlite.NewDB(":memory:")
+	require.NoError(t, err)
+	ss := sqlite.NewStore(db, ":memory:")
+	t.Cleanup(func() { require.NoError(t, db.Close()) })
+	require.NoError(t, ss.CreateSession(context.Background(), &store.SessionRecord{
+		Namespace: "default", Name: sessionName, SessionType: "task",
+	}))
+
+	handlers := NewHandlers(HandlersConfig{Client: fakeClient, APIReader: fakeClient, SessionStore: ss})
+	app := fiber.New()
+	app.Get("/sessions/:id", handlers.GetSession)
+	resp, err := app.Test(httptest.NewRequest(http.MethodGet, "/sessions/"+sessionName, nil))
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+
+	var result map[string]any
+	require.NoError(t, json.NewDecoder(resp.Body).Decode(&result))
+	projected := result["executionControl"].(map[string]any)
+	require.Equal(t, "session-uid", projected["sessionUID"])
+	require.Equal(t, "ReconciliationBlocked", projected["availability"])
+	require.Equal(t, "publication outcome unknown", projected["blockedReason"])
+	lineage := projected["lineage"].(map[string]any)
+	require.Equal(t, "orka.harness.v2", lineage["contractVersion"])
+	require.Equal(t, "opencode", lineage["runtimeIdentity"])
+	require.NotContains(t, projected, "mutationLease")
+	require.NotContains(t, projected, "controllerEpoch")
+}
+
 func TestHandlers_GetSession_HidesGatewaySession(t *testing.T) {
 	handlers, app, ss := setupTestHandlersWithSessionManager()
 	ctx := context.Background()
@@ -3377,6 +3570,76 @@ func TestHandlers_CreateAgent_Success(t *testing.T) {
 	require.Equal(t, http.StatusCreated, resp.StatusCode)
 }
 
+func TestHandlers_CreateAgent_DefaultsBuiltInContractFromExecutionMode(t *testing.T) {
+	tests := []struct {
+		name       string
+		mode       executionmode.Mode
+		explicit   corev1alpha1.AgentRuntimeContractVersion
+		want       corev1alpha1.AgentRuntimeContractVersion
+		wantStatus int
+	}{
+		{
+			name:       "harness v1",
+			mode:       executionmode.HarnessV1,
+			want:       corev1alpha1.AgentRuntimeContractHarnessV1,
+			wantStatus: http.StatusCreated,
+		},
+		{
+			name:       "harness v2",
+			mode:       executionmode.HarnessV2,
+			want:       corev1alpha1.AgentRuntimeContractHarnessV2,
+			wantStatus: http.StatusCreated,
+		},
+		{
+			name:       "opposite explicit contract",
+			mode:       executionmode.HarnessV1,
+			explicit:   corev1alpha1.AgentRuntimeContractHarnessV2,
+			wantStatus: http.StatusBadRequest,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			scheme := runtime.NewScheme()
+			require.NoError(t, corev1alpha1.AddToScheme(scheme))
+			fakeClient := fake.NewClientBuilder().WithScheme(scheme).Build()
+			handlers := NewHandlers(HandlersConfig{Client: fakeClient, ExecutionMode: test.mode})
+			app := fiber.New()
+			app.Post("/agents", handlers.CreateAgent)
+
+			var explicit *corev1alpha1.AgentRuntimeContractVersion
+			if test.explicit != "" {
+				value := test.explicit
+				explicit = &value
+			}
+			bodyBytes, err := json.Marshal(CreateAgentRequest{
+				Name:      "runtime-agent",
+				Namespace: "default",
+				Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+					Type:            corev1alpha1.AgentRuntimeCodex,
+					ContractVersion: explicit,
+				}},
+			})
+			require.NoError(t, err)
+
+			req := httptest.NewRequest(http.MethodPost, "/agents", bytes.NewReader(bodyBytes))
+			req.Header.Set("Content-Type", "application/json")
+			resp, err := app.Test(req)
+			require.NoError(t, err)
+			require.Equal(t, test.wantStatus, resp.StatusCode)
+
+			created := &corev1alpha1.Agent{}
+			err = fakeClient.Get(context.Background(), types.NamespacedName{Name: "runtime-agent", Namespace: "default"}, created)
+			if test.wantStatus != http.StatusCreated {
+				require.True(t, apierrors.IsNotFound(err), "rejected Agent should not be created")
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, test.want, created.BuiltInContractVersion())
+		})
+	}
+}
+
 func TestHandlers_CreateAgent_MetadataStyle(t *testing.T) {
 	handlers, app := setupTestHandlers()
 	app.Post("/agents", handlers.CreateAgent)
diff --git a/internal/api/internal_caller_authorization.go b/internal/api/internal_caller_authorization.go
index 1fba6c36e..4701db37f 100644
--- a/internal/api/internal_caller_authorization.go
+++ b/internal/api/internal_caller_authorization.go
@@ -8,11 +8,8 @@ package api
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"os"
 	"strings"
-	"time"
 
 	"github.com/gofiber/fiber/v3"
 	batchv1 "k8s.io/api/batch/v1"
@@ -62,80 +59,35 @@ func (a internalCallerAuthorizer) verifyNamespace(c fiber.Ctx, namespace string)
 	// ServiceAccount usernames follow the format:
 	// system:serviceaccount:<namespace>:<name>.
 	parts := strings.Split(userInfo.Username, ":")
-	if len(parts) == 4 && parts[0] == "system" && parts[1] == "serviceaccount" { //nolint:goconst // "system" here is K8s SA prefix, not chat role
-		if parts[2] != namespace {
-			log.Info("cross-namespace access denied",
-				"callerNamespace", parts[2],
-				"targetNamespace", namespace,
-				"username", userInfo.Username,
-				"ip", c.IP(),
-			)
-			return fiber.NewError(fiber.StatusForbidden, "cross-namespace access denied")
-		}
+	isServiceAccount := len(parts) == 4 && parts[0] == "system" && parts[1] == "serviceaccount" //nolint:goconst // "system" here is K8s SA prefix, not chat role
+	if isServiceAccount && parts[2] != namespace {
+		log.Info("cross-namespace access denied",
+			"callerNamespace", parts[2],
+			"targetNamespace", namespace,
+			"username", userInfo.Username,
+			"ip", c.IP(),
+		)
+		return fiber.NewError(fiber.StatusForbidden, "cross-namespace access denied")
 	}
 
-	return nil
-}
-
-func (a internalCallerAuthorizer) verifyArtifactUploadCaller(c fiber.Ctx, namespace, taskName string) error {
-	userInfo := GetUserInfo(c)
-	if err := a.verifyNamespace(c, namespace); err != nil {
-		var fiberErr *fiber.Error
-		if !errors.As(err, &fiberErr) || fiberErr.Code != fiber.StatusForbidden {
-			return err
-		}
-		if allowErr := a.verifyHarnessWrapperArtifactUpload(c.Context(), userInfo, namespace, taskName); allowErr == nil {
-			return nil
-		}
-		return err
-	}
-	if userInfo != nil && serviceAccountNameFromUsername(userInfo.Username) == expectedHarnessWrapperServiceAccountName() {
-		return a.verifyHarnessWrapperArtifactUpload(c.Context(), userInfo, namespace, taskName)
+	// Fail closed: namespace-scoped internal endpoints require a verifiable
+	// caller namespace. Principals without one (for example non-ServiceAccount
+	// TokenReview identities) must not pass for arbitrary namespaces.
+	if userInfo.Namespace == "" && !isServiceAccount {
+		log.Info("internal access denied for caller without namespace identity",
+			"targetNamespace", namespace,
+			"username", userInfo.Username,
+			"ip", c.IP(),
+		)
+		return fiber.NewError(fiber.StatusForbidden, "caller namespace identity required")
 	}
+
 	return nil
 }
 
-func (a internalCallerAuthorizer) verifyHarnessWrapperArtifactUpload(
-	ctx context.Context,
-	userInfo *UserInfo,
-	namespace string,
-	taskName string,
-) error {
-	if a.k8sReader == nil || userInfo == nil {
-		return fiber.NewError(fiber.StatusForbidden, "cross-namespace access denied")
-	}
-	if userInfo.AuthType != AuthTypeTokenReview {
-		return fiber.NewError(fiber.StatusForbidden, "caller pod token required")
-	}
-	controlNamespace := currentPodNamespace()
-	if controlNamespace == "" {
-		return fiber.NewError(fiber.StatusForbidden, "controller namespace unavailable")
-	}
-	callerNamespace := strings.TrimSpace(userInfo.Namespace)
-	if callerNamespace == "" {
-		callerNamespace = parseServiceAccountNamespace(userInfo.Username)
-	}
-	if callerNamespace != controlNamespace {
-		return fiber.NewError(fiber.StatusForbidden, "caller is not a control-plane service account")
-	}
-	if serviceAccountNameFromUsername(userInfo.Username) != expectedHarnessWrapperServiceAccountName() {
-		return fiber.NewError(fiber.StatusForbidden, "caller is not the harness wrapper service account")
-	}
+func (a internalCallerAuthorizer) verifyArtifactUploadCaller(c fiber.Ctx, namespace, _ string) error {
+	return a.verifyNamespace(c, namespace)
 
-	task := &corev1alpha1.Task{}
-	if err := a.k8sReader.Get(ctx, types.NamespacedName{Namespace: namespace, Name: taskName}, task); err != nil {
-		return fiber.NewError(fiber.StatusForbidden, "target task not found")
-	}
-	if task.Spec.Type != corev1alpha1.TaskTypeAgent {
-		return fiber.NewError(fiber.StatusForbidden, "target task is not an agent task")
-	}
-	if strings.TrimSpace(task.Status.JobName) != "" {
-		return fiber.NewError(fiber.StatusForbidden, "target task has a worker job")
-	}
-	if !harnessWrapperArtifactUploadAuthorized(task) {
-		return fiber.NewError(fiber.StatusForbidden, "target task is not running through harness wrapper")
-	}
-	return nil
 }
 
 func (a internalCallerAuthorizer) verifyExecutionEventStreamWriter(
@@ -214,55 +166,6 @@ func (a internalCallerAuthorizer) verifyTaskWorker(ctx context.Context, userInfo
 	return fiber.NewError(fiber.StatusForbidden, "caller is not the current worker for this task")
 }
 
-func harnessWrapperArtifactUploadAuthorized(task *corev1alpha1.Task) bool {
-	if task == nil || task.Annotations == nil ||
-		strings.TrimSpace(task.Annotations[harnessWrapperTurnIDAnnotation]) == "" ||
-		strings.TrimSpace(task.Annotations[harnessWrapperRuntimeAnnotation]) == "" {
-		return false
-	}
-	if task.Status.Phase != "" && task.Status.Phase != corev1alpha1.TaskPhasePending && task.Status.Phase != corev1alpha1.TaskPhaseRunning {
-		return false
-	}
-	if strings.EqualFold(strings.TrimSpace(task.Annotations[harnessWrapperStartedAnnotation]), "true") {
-		return true
-	}
-	plannedAt, err := time.Parse(time.RFC3339Nano, strings.TrimSpace(task.Annotations[harnessWrapperPlannedAtAnno]))
-	if err != nil {
-		return false
-	}
-	now := time.Now()
-	if plannedAt.After(now.Add(time.Minute)) {
-		return false
-	}
-	return now.Sub(plannedAt) <= harnessWrapperPlannedTurnTTL
-}
-
-func currentPodNamespace() string {
-	if namespace := strings.TrimSpace(os.Getenv("POD_NAMESPACE")); namespace != "" {
-		return namespace
-	}
-	data, err := os.ReadFile("/var/run/secrets/kubernetes.io/serviceaccount/namespace")
-	if err != nil {
-		return ""
-	}
-	return strings.TrimSpace(string(data))
-}
-
-func expectedHarnessWrapperServiceAccountName() string {
-	if name := strings.TrimSpace(os.Getenv(harnessWrapperServiceAccountEnv)); name != "" {
-		return name
-	}
-	return "agent-harness-wrapper"
-}
-
-func serviceAccountNameFromUsername(username string) string {
-	parts := strings.Split(strings.TrimSpace(username), ":")
-	if len(parts) == 4 && parts[0] == "system" && parts[1] == "serviceaccount" {
-		return parts[3]
-	}
-	return ""
-}
-
 func firstUserExtra(userInfo *UserInfo, key string) string {
 	if userInfo == nil || len(userInfo.Extra) == 0 {
 		return ""
diff --git a/internal/api/internal_caller_authorization_test.go b/internal/api/internal_caller_authorization_test.go
index d9f346d46..64efdd05c 100644
--- a/internal/api/internal_caller_authorization_test.go
+++ b/internal/api/internal_caller_authorization_test.go
@@ -39,7 +39,10 @@ func TestInternalCallerAuthorizerVerifyNamespace(t *testing.T) {
 		{name: "explicit namespace mismatch", userInfo: &UserInfo{Namespace: "other", Username: "system:serviceaccount:other:worker"}, wantStatus: http.StatusForbidden},
 		{name: "service account username mismatch", userInfo: &UserInfo{Username: "system:serviceaccount:other:worker"}, wantStatus: http.StatusForbidden},
 		{name: "service account namespace match", userInfo: &UserInfo{Username: "system:serviceaccount:default:worker"}, wantStatus: http.StatusNoContent},
-		{name: "non service account without namespace remains allowed", userInfo: &UserInfo{Username: "admin"}, wantStatus: http.StatusNoContent},
+		// Fail closed: a caller without a verifiable namespace identity must
+		// not pass for arbitrary namespaces.
+		{name: "non service account without namespace is denied", userInfo: &UserInfo{Username: "admin"}, wantStatus: http.StatusForbidden},
+		{name: "explicit namespace match without service account username", userInfo: &UserInfo{Username: "admin", Namespace: "default"}, wantStatus: http.StatusNoContent},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
diff --git a/internal/api/internal_handlers.go b/internal/api/internal_handlers.go
index c608b432a..51c6d3eb2 100644
--- a/internal/api/internal_handlers.go
+++ b/internal/api/internal_handlers.go
@@ -15,7 +15,6 @@ import (
 	"net/url"
 	"strconv"
 	"strings"
-	"time"
 
 	"github.com/gofiber/fiber/v3"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
@@ -30,15 +29,6 @@ import (
 
 const maxResultSize = 10 << 20 // 10MB
 
-const (
-	harnessWrapperStartedAnnotation = "orka.ai/harness-wrapper-started"
-	harnessWrapperTurnIDAnnotation  = "orka.ai/harness-wrapper-turn-id"
-	harnessWrapperRuntimeAnnotation = "orka.ai/harness-wrapper-runtime-session-id"
-	harnessWrapperPlannedAtAnno     = "orka.ai/harness-wrapper-planned-at"
-	harnessWrapperServiceAccountEnv = "ORKA_HARNESS_WRAPPER_SERVICE_ACCOUNT_NAME"
-	harnessWrapperPlannedTurnTTL    = 5 * time.Minute
-)
-
 // InternalHandlers contains handlers for internal worker endpoints.
 type InternalHandlers struct {
 	k8sClient           client.Client
diff --git a/internal/api/internal_handlers_test.go b/internal/api/internal_handlers_test.go
index 745570202..ce4efa07d 100644
--- a/internal/api/internal_handlers_test.go
+++ b/internal/api/internal_handlers_test.go
@@ -922,7 +922,7 @@ func TestVerifyCallerNamespace(t *testing.T) {
 		require.Equal(t, http.StatusUnauthorized, resp.StatusCode)
 	})
 
-	t.Run("non-SA user passes through", func(t *testing.T) {
+	t.Run("non-SA user without namespace identity is denied", func(t *testing.T) {
 		app := fiber.New()
 		app.Use(func(c fiber.Ctx) error {
 			c.Locals(UserInfoContextKey, &UserInfo{Username: "admin"})
@@ -934,6 +934,26 @@ func TestVerifyCallerNamespace(t *testing.T) {
 			bytes.NewReader([]byte(`{"output":"done"}`)))
 		req.Header.Set("Content-Type", "application/json")
 
+		// Fail closed: internal endpoints are namespace-scoped, and a caller
+		// without a verifiable namespace identity must not pass for arbitrary
+		// namespaces.
+		resp, err := app.Test(req)
+		require.NoError(t, err)
+		require.Equal(t, http.StatusForbidden, resp.StatusCode)
+	})
+
+	t.Run("namespace-scoped principal matching target is allowed", func(t *testing.T) {
+		app := fiber.New()
+		app.Use(func(c fiber.Ctx) error {
+			c.Locals(UserInfoContextKey, &UserInfo{Username: "admin", Namespace: "default"})
+			return c.Next()
+		})
+		app.Post("/internal/v1/results/:namespace/:taskName", h.SubmitResult)
+
+		req := httptest.NewRequest(http.MethodPost, "/internal/v1/results/default/my-task",
+			bytes.NewReader([]byte(`{"output":"done"}`)))
+		req.Header.Set("Content-Type", "application/json")
+
 		resp, err := app.Test(req)
 		require.NoError(t, err)
 		require.Equal(t, http.StatusNoContent, resp.StatusCode)
diff --git a/internal/api/monitor_handlers.go b/internal/api/monitor_handlers.go
index f27531043..8fdd61ca9 100644
--- a/internal/api/monitor_handlers.go
+++ b/internal/api/monitor_handlers.go
@@ -15,6 +15,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/controller"
 	"github.com/orka-agents/orka/internal/metrics"
 	"github.com/orka-agents/orka/internal/security"
 	"github.com/orka-agents/orka/internal/store"
@@ -54,6 +55,7 @@ const (
 	repositoryMonitorRunPhaseRunning       = "running"
 	repositoryMonitorRunPhaseFailed        = "failed"
 	repositoryMonitorIntentAutomerge       = "automerge"
+	repositoryMonitorDefaultBranch         = "main"
 )
 
 func (h *Handlers) ensureRepositoryMonitorStore() error {
@@ -68,7 +70,7 @@ func (h *Handlers) normalizeRepositoryMonitorSpec(spec *corev1alpha1.RepositoryM
 		spec.Provider = sourceProviderGitHub
 	}
 	if spec.Branch == "" {
-		spec.Branch = "main"
+		spec.Branch = repositoryMonitorDefaultBranch
 	}
 	if owner, repo, err := parseRepositoryMonitorGitHubURL(spec.RepoURL); err == nil {
 		spec.Owner = owner
@@ -120,8 +122,8 @@ func validateRepositoryMonitorSpec(spec corev1alpha1.RepositoryMonitorSpec) erro
 	if repositoryMonitorPullRequestsEnabled(spec) && (spec.Agents.Reviewer == nil || strings.TrimSpace(spec.Agents.Reviewer.Name) == "") {
 		return fiber.NewError(fiber.StatusBadRequest, "spec.agents.reviewer.name is required when pull request monitoring is enabled")
 	}
-	if spec.Triggers.GitHub.Labels.Enabled && (spec.GitSecretRef == nil || strings.TrimSpace(spec.GitSecretRef.Name) == "") {
-		return fiber.NewError(fiber.StatusBadRequest, "spec.gitSecretRef is required when GitHub label triggers are enabled")
+	if spec.Triggers.GitHub.Labels.Enabled && (spec.ForgeCredentialRef == nil || strings.TrimSpace(spec.ForgeCredentialRef.Name) == "") {
+		return fiber.NewError(fiber.StatusBadRequest, "spec.forgeCredentialRef is required when GitHub label triggers are enabled")
 	}
 	return nil
 }
@@ -203,19 +205,8 @@ func (h *Handlers) validateRepositoryMonitorImplementerAgent(c fiber.Ctx, namesp
 	}
 	switch agent.Spec.Runtime.Type {
 	case corev1alpha1.AgentRuntimeCodex, corev1alpha1.AgentRuntimeClaude:
-		if agent.Spec.SecretRef == nil || strings.TrimSpace(agent.Spec.SecretRef.Name) == "" {
-			return fiber.NewError(fiber.StatusBadRequest, fmt.Sprintf("spec.agents.implementer %q must reference a runtime credential Secret", ref.Name))
-		}
-		secretName := strings.TrimSpace(agent.Spec.SecretRef.Name)
-		var secret corev1.Secret
-		if err := h.client.Get(c.Context(), types.NamespacedName{Name: secretName, Namespace: namespace}, &secret); err != nil {
-			if apierrors.IsNotFound(err) {
-				return fiber.NewError(fiber.StatusBadRequest, fmt.Sprintf("spec.agents.implementer %q credential Secret %q not found in monitor namespace %q", ref.Name, secretName, namespace))
-			}
-			return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to get implementer credential Secret %q: %v", secretName, err))
-		}
-		if !repositoryMonitorImplementerSecretHasCredential(&secret, agent.Spec.Runtime.Type) {
-			return fiber.NewError(fiber.StatusBadRequest, fmt.Sprintf("spec.agents.implementer %q credential Secret %q has no supported key for runtime %q", ref.Name, secretName, agent.Spec.Runtime.Type))
+		if agent.Spec.SecretRef != nil && strings.TrimSpace(agent.Spec.SecretRef.Name) != "" {
+			return fiber.NewError(fiber.StatusBadRequest, fmt.Sprintf("spec.agents.implementer %q must omit spec.secretRef; provider credentials are supplied by the controller-managed runtime proxy", ref.Name))
 		}
 		return nil
 	case corev1alpha1.AgentRuntimeCopilot:
@@ -279,88 +270,118 @@ func (h *Handlers) validateRepositoryMonitorReadOnlyAgent(c fiber.Ctx, namespace
 		}
 		return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to get %s agent %q: %v", role, ref.Name, err))
 	}
+	allowedRuntimes := "claude or opencode"
+	if role == "reviewer" {
+		allowedRuntimes = "claude, codex, or opencode"
+	}
 	if agent.Spec.Runtime == nil {
-		return fiber.NewError(fiber.StatusBadRequest, fmt.Sprintf("%s %q must use the claude runtime for read-only repository monitor tasks", field, ref.Name))
+		return fiber.NewError(fiber.StatusBadRequest, fmt.Sprintf("%s %q must use a built-in %s runtime for read-only repository monitor tasks", field, ref.Name, allowedRuntimes))
 	}
 	if agent.Spec.Runtime.RuntimeRef != nil && strings.TrimSpace(agent.Spec.Runtime.RuntimeRef.Name) != "" {
-		return fiber.NewError(fiber.StatusBadRequest, fmt.Sprintf("%s %q cannot use runtimeRef because external runtimes cannot enforce read-only credential and tool isolation; use built-in claude", field, ref.Name))
-	}
-	if agent.Spec.Runtime.Type != corev1alpha1.AgentRuntimeClaude {
-		return fiber.NewError(fiber.StatusBadRequest, fmt.Sprintf("%s %q runtime %q is not supported for read-only repository monitor tasks; use claude", field, ref.Name, agent.Spec.Runtime.Type))
-	}
-	if agent.Spec.SecretRef == nil || strings.TrimSpace(agent.Spec.SecretRef.Name) == "" {
-		return fiber.NewError(fiber.StatusBadRequest, fmt.Sprintf("%s %q must reference a Secret with Claude credentials for read-only repository monitor tasks", field, ref.Name))
+		return fiber.NewError(fiber.StatusBadRequest, fmt.Sprintf("%s %q cannot use runtimeRef because external runtimes cannot enforce read-only credential and tool isolation; use built-in %s", field, ref.Name, allowedRuntimes))
 	}
-	secretName := strings.TrimSpace(agent.Spec.SecretRef.Name)
-	var secret corev1.Secret
-	if err := h.client.Get(c.Context(), types.NamespacedName{Name: secretName, Namespace: namespace}, &secret); err != nil {
-		if apierrors.IsNotFound(err) {
-			return fiber.NewError(fiber.StatusBadRequest, fmt.Sprintf("%s %q credential Secret %q not found in monitor namespace %q", field, ref.Name, secretName, namespace))
+	switch agent.Spec.Runtime.Type {
+	case corev1alpha1.AgentRuntimeOpencode:
+		if err := controller.ValidateOpenCodeAgentSpec(&agent); err != nil {
+			return fiber.NewError(fiber.StatusBadRequest, fmt.Sprintf("%s %q has an invalid OpenCode configuration: %v", field, ref.Name, err))
 		}
-		return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to get %s %q credential Secret %q: %v", field, ref.Name, secretName, err))
-	}
-	if !repositoryMonitorClaudeSecretHasCredential(&secret) {
-		return fiber.NewError(fiber.StatusBadRequest, fmt.Sprintf("%s %q credential Secret %q must contain a supported Claude auth key", field, ref.Name, secretName))
-	}
-	return nil
-}
-
-func repositoryMonitorImplementerSecretHasCredential(secret *corev1.Secret, runtimeType corev1alpha1.AgentRuntimeType) bool {
-	if secret == nil {
-		return false
-	}
-	var keys []string
-	switch runtimeType {
-	case corev1alpha1.AgentRuntimeCodex:
-		keys = []string{workerenv.OpenAIAPIKey, workerenv.CodexAPIKey}
 	case corev1alpha1.AgentRuntimeClaude:
-		keys = []string{workerenv.AnthropicAPIKey, "ANTHROPIC_FOUNDRY_API_KEY"}
+	case corev1alpha1.AgentRuntimeCodex:
+		// Codex reviewers run inside the RuntimeSession boundary with
+		// controller-rejected elevation requests and read-intent workspace
+		// delta classification failing any modifying turn.
+		if role != "reviewer" {
+			return fiber.NewError(fiber.StatusBadRequest, fmt.Sprintf("%s %q runtime %q is not supported for read-only repository monitor tasks; use %s", field, ref.Name, agent.Spec.Runtime.Type, allowedRuntimes))
+		}
 	default:
-		return false
+		return fiber.NewError(fiber.StatusBadRequest, fmt.Sprintf("%s %q runtime %q is not supported for read-only repository monitor tasks; use %s", field, ref.Name, agent.Spec.Runtime.Type, allowedRuntimes))
 	}
-	for _, key := range keys {
-		if strings.TrimSpace(string(secret.Data[key])) != "" {
-			return true
-		}
+	if agent.Spec.SecretRef != nil && strings.TrimSpace(agent.Spec.SecretRef.Name) != "" {
+		return fiber.NewError(fiber.StatusBadRequest, fmt.Sprintf("%s %q must omit spec.secretRef; provider credentials are supplied by the controller-managed runtime proxy", field, ref.Name))
 	}
-	return false
+	return nil
 }
 
-func (h *Handlers) validateRepositoryMonitorGitSecret(c fiber.Ctx, namespace string, spec corev1alpha1.RepositoryMonitorSpec) error {
-	if spec.GitSecretRef == nil || strings.TrimSpace(spec.GitSecretRef.Name) == "" {
+func validateRepositoryMonitorCredentialRoleRefs(spec corev1alpha1.RepositoryMonitorSpec) error {
+	implementationEnabled := spec.Targets.Issues.Enabled &&
+		(spec.IssueWorkflow.Implementation.Enabled == nil || *spec.IssueWorkflow.Implementation.Enabled) &&
+		spec.Agents.Implementer != nil && strings.TrimSpace(spec.Agents.Implementer.Name) != ""
+	repairEnabled := spec.Repair.Enabled && spec.Agents.Repairer != nil && strings.TrimSpace(spec.Agents.Repairer.Name) != ""
+	if !implementationEnabled && !repairEnabled {
 		return nil
 	}
-	secretName := strings.TrimSpace(spec.GitSecretRef.Name)
-	var secret corev1.Secret
-	if err := h.client.Get(c.Context(), types.NamespacedName{Name: secretName, Namespace: namespace}, &secret); err != nil {
-		if apierrors.IsNotFound(err) {
-			return fiber.NewError(fiber.StatusBadRequest, fmt.Sprintf("spec.gitSecretRef %q not found in namespace %q", secretName, namespace))
+	refs := []struct {
+		field string
+		ref   *corev1.LocalObjectReference
+	}{
+		{field: "spec.readCredentialRef", ref: spec.ReadCredentialRef},
+		{field: "spec.publicationReadCredentialRef", ref: spec.PublicationReadCredentialRef},
+		{field: "spec.publicationCredentialRef", ref: spec.PublicationCredentialRef},
+		{field: "spec.forgeCredentialRef", ref: spec.ForgeCredentialRef},
+	}
+	seen := make(map[string]string, len(refs))
+	for _, credential := range refs {
+		name := repositoryMonitorCredentialRefName(credential.ref)
+		if name == "" {
+			return fiber.NewError(fiber.StatusBadRequest, credential.field+" is required for repository monitor write workflows")
 		}
-		return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to get spec.gitSecretRef %q: %v", secretName, err))
-	}
-	if !repositoryMonitorGitSecretHasToken(&secret) {
-		return fiber.NewError(fiber.StatusBadRequest, fmt.Sprintf("spec.gitSecretRef %q must contain a non-empty token, password, or %s key", secretName, workerenv.GitHubToken))
+		if previous := seen[name]; previous != "" {
+			return fiber.NewError(fiber.StatusBadRequest, fmt.Sprintf("%s and %s must reference distinct Secrets", previous, credential.field))
+		}
+		seen[name] = credential.field
 	}
 	return nil
 }
 
-func repositoryMonitorGitSecretHasToken(secret *corev1.Secret) bool {
-	if secret == nil {
-		return false
+func repositoryMonitorCredentialRefName(ref *corev1.LocalObjectReference) string {
+	if ref == nil {
+		return ""
 	}
-	for _, key := range []string{"token", "password", workerenv.GitHubToken} {
-		if value := strings.TrimSpace(string(secret.Data[key])); value != "" {
-			return true
+	return strings.TrimSpace(ref.Name)
+}
+
+func repositoryMonitorEffectiveReadCredential(spec corev1alpha1.RepositoryMonitorSpec) (string, *corev1.LocalObjectReference) {
+	if repositoryMonitorCredentialRefName(spec.ReadCredentialRef) != "" {
+		return "spec.readCredentialRef", spec.ReadCredentialRef
+	}
+	return "spec.gitSecretRef", spec.GitSecretRef
+}
+
+func (h *Handlers) validateRepositoryMonitorCredentialSecrets(c fiber.Ctx, namespace string, spec corev1alpha1.RepositoryMonitorSpec) error {
+	readField, readRef := repositoryMonitorEffectiveReadCredential(spec)
+	refs := []struct {
+		field string
+		ref   *corev1.LocalObjectReference
+	}{
+		{field: readField, ref: readRef},
+		{field: "spec.publicationReadCredentialRef", ref: spec.PublicationReadCredentialRef},
+		{field: "spec.publicationCredentialRef", ref: spec.PublicationCredentialRef},
+		{field: "spec.forgeCredentialRef", ref: spec.ForgeCredentialRef},
+	}
+	for _, credential := range refs {
+		secretName := repositoryMonitorCredentialRefName(credential.ref)
+		if secretName == "" {
+			continue
+		}
+		var secret corev1.Secret
+		if err := h.client.Get(c.Context(), types.NamespacedName{Name: secretName, Namespace: namespace}, &secret); err != nil {
+			if apierrors.IsNotFound(err) {
+				return fiber.NewError(fiber.StatusBadRequest, fmt.Sprintf("%s %q not found in namespace %q", credential.field, secretName, namespace))
+			}
+			return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to get %s %q: %v", credential.field, secretName, err))
+		}
+		if !repositoryMonitorGitSecretHasToken(&secret) {
+			return fiber.NewError(fiber.StatusBadRequest, fmt.Sprintf("%s %q must contain a non-empty token, password, or %s key", credential.field, secretName, workerenv.GitHubToken))
 		}
 	}
-	return false
+	return nil
 }
 
-func repositoryMonitorClaudeSecretHasCredential(secret *corev1.Secret) bool {
+func repositoryMonitorGitSecretHasToken(secret *corev1.Secret) bool {
 	if secret == nil {
 		return false
 	}
-	for _, key := range []string{workerenv.AnthropicAPIKey, "ANTHROPIC_FOUNDRY_API_KEY"} {
+	for _, key := range []string{"token", "password", workerenv.GitHubToken} {
 		if value := strings.TrimSpace(string(secret.Data[key])); value != "" {
 			return true
 		}
@@ -525,6 +546,30 @@ func (h *Handlers) authorizeContextTokenRepositoryMonitor(c fiber.Ctx, action st
 	return h.handleContextTokenAuthorizationFailures(ui.ContextToken, action, failures)
 }
 
+func (h *Handlers) authorizeContextTokenRepositoryMonitorCredentialSecrets(c fiber.Ctx, action, namespace string, spec corev1alpha1.RepositoryMonitorSpec) error {
+	readField, readRef := repositoryMonitorEffectiveReadCredential(spec)
+	refs := []struct {
+		role  string
+		field string
+		ref   *corev1.LocalObjectReference
+	}{
+		{role: "sourceRead", field: readField, ref: readRef},
+		{role: "publicationRead", field: "spec.publicationReadCredentialRef", ref: spec.PublicationReadCredentialRef},
+		{role: "publication", field: "spec.publicationCredentialRef", ref: spec.PublicationCredentialRef},
+		{role: "forge", field: "spec.forgeCredentialRef", ref: spec.ForgeCredentialRef},
+	}
+	for _, credential := range refs {
+		name := repositoryMonitorCredentialRefName(credential.ref)
+		if name == "" {
+			continue
+		}
+		if err := h.authorizeContextTokenGitCredentialSecretName(c, action+credential.role+"Credential", namespace, name); err != nil {
+			return fiber.NewError(fiber.StatusForbidden, fmt.Sprintf("%s is not authorized: %v", credential.field, err))
+		}
+	}
+	return nil
+}
+
 // CreateRepositoryMonitor creates a new durable repository monitor.
 func (h *Handlers) CreateRepositoryMonitor(c fiber.Ctx) error {
 	var req CreateRepositoryMonitorRequest
@@ -561,10 +606,16 @@ func (h *Handlers) CreateRepositoryMonitor(c fiber.Ctx) error {
 	if err := h.authorizeContextTokenRepositoryMonitor(c, "createRepositoryMonitor", monitor); err != nil {
 		return err
 	}
+	if err := h.authorizeContextTokenRepositoryMonitorCredentialSecrets(c, "createRepositoryMonitor", namespace, req.Spec); err != nil {
+		return err
+	}
 	if err := h.validateRepositoryMonitorReadOnlyAgents(c, namespace, req.Spec); err != nil {
 		return err
 	}
-	if err := h.validateRepositoryMonitorGitSecret(c, namespace, req.Spec); err != nil {
+	if err := validateRepositoryMonitorCredentialRoleRefs(req.Spec); err != nil {
+		return err
+	}
+	if err := h.validateRepositoryMonitorCredentialSecrets(c, namespace, req.Spec); err != nil {
 		return err
 	}
 	if err := h.client.Create(c.Context(), monitor); err != nil {
@@ -670,10 +721,16 @@ func (h *Handlers) UpdateRepositoryMonitor(c fiber.Ctx) error {
 	if err := h.authorizeContextTokenRepositoryMonitor(c, "updateRepositoryMonitor", updated); err != nil {
 		return err
 	}
+	if err := h.authorizeContextTokenRepositoryMonitorCredentialSecrets(c, "updateRepositoryMonitor", namespace, req.Spec); err != nil {
+		return err
+	}
 	if err := h.validateRepositoryMonitorReadOnlyAgents(c, namespace, req.Spec); err != nil {
 		return err
 	}
-	if err := h.validateRepositoryMonitorGitSecret(c, namespace, req.Spec); err != nil {
+	if err := validateRepositoryMonitorCredentialRoleRefs(req.Spec); err != nil {
+		return err
+	}
+	if err := h.validateRepositoryMonitorCredentialSecrets(c, namespace, req.Spec); err != nil {
 		return err
 	}
 	if err := h.client.Update(c.Context(), updated); err != nil {
@@ -764,7 +821,7 @@ func (h *Handlers) CreateRepositoryMonitorRun(c fiber.Ctx) error {
 
 func (h *Handlers) markRepositoryMonitorRunSignalFailed(c fiber.Ctx, run *store.MonitorRun, signalErr error) error {
 	completedAt := time.Now()
-	run.Phase = "failed"
+	run.Phase = repositoryMonitorRunPhaseFailed
 	run.CompletedAt = &completedAt
 	run.Error = signalErr.Error()
 	return h.repositoryMonitorStore.UpdateMonitorRun(c.Context(), run)
diff --git a/internal/api/monitor_handlers_test.go b/internal/api/monitor_handlers_test.go
index 94198c1bf..84164dd84 100644
--- a/internal/api/monitor_handlers_test.go
+++ b/internal/api/monitor_handlers_test.go
@@ -14,17 +14,16 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/utils/ptr"
 	crclient "sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
 	"github.com/orka-agents/orka/internal/store"
 	"github.com/orka-agents/orka/internal/store/sqlite"
-	"github.com/orka-agents/orka/internal/workerenv"
 )
 
 const monitorTestRepoURL = "https://github.com/orka-agents/orka"
-const monitorTestReviewerObjectName = "reviewer-auth-ref"
 
 func setupRepositoryMonitorHandlers(t *testing.T, ctxTokenConfig ContextTokenConfig, mode string, objects ...crclient.Object) (*fiber.App, *Handlers) {
 	t.Helper()
@@ -34,7 +33,6 @@ func setupRepositoryMonitorHandlers(t *testing.T, ctxTokenConfig ContextTokenCon
 	require.NoError(t, corev1.AddToScheme(scheme))
 	objects = append([]crclient.Object{
 		repositoryMonitorHandlerTestAgent("reviewer", corev1alpha1.AgentRuntimeClaude),
-		repositoryMonitorHandlerTestReviewerSecret(),
 	}, objects...)
 	fakeClient := fake.NewClientBuilder().
 		WithScheme(scheme).
@@ -82,17 +80,26 @@ func repositoryMonitorHandlerTestAgent(name string, runtimeType corev1alpha1.Age
 	return &corev1alpha1.Agent{
 		ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: "demo"},
 		Spec: corev1alpha1.AgentSpec{
-			Runtime:   &corev1alpha1.AgentCLIRuntime{Type: runtimeType},
-			SecretRef: &corev1.LocalObjectReference{Name: monitorTestReviewerObjectName},
+			Runtime: &corev1alpha1.AgentCLIRuntime{Type: runtimeType},
 		},
 	}
 }
 
-func repositoryMonitorHandlerTestReviewerSecret() *corev1.Secret {
-	return &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: monitorTestReviewerObjectName, Namespace: "demo"},
-		Data: map[string][]byte{
-			workerenv.AnthropicAPIKey: []byte("anthropic-key"),
+func repositoryMonitorHandlerTestOpenCodeAgent(name string) *corev1alpha1.Agent {
+	contextWindow := int32(32768)
+	maxTokens := int32(4096)
+	return &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: "demo"},
+		Spec: corev1alpha1.AgentSpec{
+			Model: &corev1alpha1.ModelConfig{
+				Name:          "openai/gpt-test",
+				ContextWindow: &contextWindow,
+				MaxTokens:     &maxTokens,
+			},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeOpencode,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
 		},
 	}
 }
@@ -355,13 +362,7 @@ func TestCreateRepositoryMonitor_RejectsUnsupportedReviewerAgent(t *testing.T) {
 			name:     "missing runtime",
 			agent:    &corev1alpha1.Agent{ObjectMeta: metav1.ObjectMeta{Name: "no-runtime", Namespace: "demo"}},
 			reviewer: "no-runtime",
-			want:     "must use the claude runtime",
-		},
-		{
-			name:     "codex runtime",
-			agent:    repositoryMonitorHandlerTestAgent("codex-reviewer", corev1alpha1.AgentRuntimeCodex),
-			reviewer: "codex-reviewer",
-			want:     "is not supported",
+			want:     "must use a built-in claude, codex, or opencode runtime",
 		},
 		{
 			name:     "copilot runtime",
@@ -397,68 +398,125 @@ func TestCreateRepositoryMonitor_RejectsUnsupportedReviewerAgent(t *testing.T) {
 	}
 }
 
-func TestCreateRepositoryMonitor_RejectsReviewerWithoutClaudeCredentials(t *testing.T) {
+func TestCreateRepositoryMonitor_AllowsCodexReviewer(t *testing.T) {
+	reviewer := repositoryMonitorHandlerTestAgent("codex-reviewer", corev1alpha1.AgentRuntimeCodex)
+	app, _ := setupRepositoryMonitorHandlers(t, ContextTokenConfig{}, ContextTokenAuthorizationModeOff, reviewer)
+	body := fmt.Sprintf(`{
+		"name":"repo-monitor",
+		"namespace":"demo",
+		"spec":{
+			"repoURL":%q,
+			"agents":{"reviewer":{"name":"codex-reviewer"}}
+		}
+	}`, monitorTestRepoURL)
+
+	req := httptest.NewRequest(http.MethodPost, "/monitors/repositories", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := app.Test(req)
+	require.NoError(t, err)
+	// Codex reviewers run in the native read-only agent mode, so admission
+	// accepts them for the reviewer role.
+	require.Equal(t, http.StatusCreated, resp.StatusCode)
+}
+
+func TestCreateRepositoryMonitor_AllowsOpenCodeReadOnlyAgents(t *testing.T) {
 	tests := []struct {
-		name     string
-		objects  []crclient.Object
-		reviewer string
-		want     string
+		role                string
+		pullRequestsEnabled bool
+		issuesEnabled       bool
 	}{
-		{
-			name: "missing secretRef",
-			objects: []crclient.Object{
-				&corev1alpha1.Agent{
-					ObjectMeta: metav1.ObjectMeta{Name: "no-secret", Namespace: "demo"},
-					Spec: corev1alpha1.AgentSpec{
-						Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeClaude},
-					},
-				},
-			},
-			reviewer: "no-secret",
-			want:     "must reference a Secret",
-		},
-		{
-			name: "secret without auth key",
-			objects: []crclient.Object{
-				&corev1alpha1.Agent{
-					ObjectMeta: metav1.ObjectMeta{Name: "bad-secret-reviewer", Namespace: "demo"},
-					Spec: corev1alpha1.AgentSpec{
-						Runtime:   &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeClaude},
-						SecretRef: &corev1.LocalObjectReference{Name: "bad-reviewer-secret"},
-					},
-				},
-				&corev1.Secret{
-					ObjectMeta: metav1.ObjectMeta{Name: "bad-reviewer-secret", Namespace: "demo"},
-					Data:       map[string][]byte{workerenv.AnthropicBaseURL: []byte("https://anthropic.example")},
-				},
-			},
-			reviewer: "bad-secret-reviewer",
-			want:     "must contain a supported Claude auth key",
-		},
+		{role: "reviewer", pullRequestsEnabled: true},
+		{role: "triager", issuesEnabled: true},
+		{role: "researcher", issuesEnabled: true},
+		{role: "planner", issuesEnabled: true},
 	}
 
 	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			app, _ := setupRepositoryMonitorHandlers(t, ContextTokenConfig{}, ContextTokenAuthorizationModeOff, tt.objects...)
+		t.Run(tt.role, func(t *testing.T) {
+			agentName := "opencode-" + tt.role
+			app, _ := setupRepositoryMonitorHandlers(t, ContextTokenConfig{}, ContextTokenAuthorizationModeOff, repositoryMonitorHandlerTestOpenCodeAgent(agentName))
 			body := fmt.Sprintf(`{
 				"name":"repo-monitor",
 				"namespace":"demo",
 				"spec":{
 					"repoURL":%q,
-					"agents":{"reviewer":{"name":%q}}
+					"targets":{"pullRequests":{"enabled":%t},"issues":{"enabled":%t}},
+					"agents":{%q:{"name":%q}}
 				}
-			}`, monitorTestRepoURL, tt.reviewer)
+			}`, monitorTestRepoURL, tt.pullRequestsEnabled, tt.issuesEnabled, tt.role, agentName)
 
 			req := httptest.NewRequest(http.MethodPost, "/monitors/repositories", strings.NewReader(body))
 			req.Header.Set("Content-Type", "application/json")
 			resp, err := app.Test(req)
 			require.NoError(t, err)
-			require.Equal(t, http.StatusBadRequest, resp.StatusCode)
-			require.Contains(t, readRespBody(t, resp), tt.want)
+			require.Equal(t, http.StatusCreated, resp.StatusCode, readRespBody(t, resp))
 		})
 	}
 }
 
+func TestCreateRepositoryMonitor_RejectsInvalidOpenCodeReadOnlyAgent(t *testing.T) {
+	reviewer := repositoryMonitorHandlerTestOpenCodeAgent("invalid-opencode-reviewer")
+	reviewer.Spec.Model.Name = "openai/"
+	app, _ := setupRepositoryMonitorHandlers(t, ContextTokenConfig{}, ContextTokenAuthorizationModeOff, reviewer)
+	body := fmt.Sprintf(`{
+		"name":"repo-monitor",
+		"namespace":"demo",
+		"spec":{
+			"repoURL":%q,
+			"agents":{"reviewer":{"name":"invalid-opencode-reviewer"}}
+		}
+	}`, monitorTestRepoURL)
+
+	req := httptest.NewRequest(http.MethodPost, "/monitors/repositories", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := app.Test(req)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusBadRequest, resp.StatusCode)
+	require.Contains(t, readRespBody(t, resp), "invalid OpenCode configuration")
+}
+
+func TestCreateRepositoryMonitor_RejectsCodexIssueReadOnlyAgent(t *testing.T) {
+	triager := repositoryMonitorHandlerTestAgent("codex-triager", corev1alpha1.AgentRuntimeCodex)
+	app, _ := setupRepositoryMonitorHandlers(t, ContextTokenConfig{}, ContextTokenAuthorizationModeOff, triager)
+	body := fmt.Sprintf(`{
+		"name":"repo-monitor",
+		"namespace":"demo",
+		"spec":{
+			"repoURL":%q,
+			"targets":{"pullRequests":{"enabled":false},"issues":{"enabled":true}},
+			"agents":{"triager":{"name":"codex-triager"}}
+		}
+	}`, monitorTestRepoURL)
+
+	req := httptest.NewRequest(http.MethodPost, "/monitors/repositories", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := app.Test(req)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusBadRequest, resp.StatusCode)
+	require.Contains(t, readRespBody(t, resp), "is not supported")
+}
+
+func TestCreateRepositoryMonitor_RejectsBuiltInReviewerSecretRef(t *testing.T) {
+	reviewer := repositoryMonitorHandlerTestAgent("secret-reviewer", corev1alpha1.AgentRuntimeClaude)
+	reviewer.Spec.SecretRef = &corev1.LocalObjectReference{Name: "provider-credential"}
+	app, _ := setupRepositoryMonitorHandlers(t, ContextTokenConfig{}, ContextTokenAuthorizationModeOff, reviewer)
+	body := fmt.Sprintf(`{
+		"name":"repo-monitor",
+		"namespace":"demo",
+		"spec":{
+			"repoURL":%q,
+			"agents":{"reviewer":{"name":"secret-reviewer"}}
+		}
+	}`, monitorTestRepoURL)
+
+	req := httptest.NewRequest(http.MethodPost, "/monitors/repositories", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := app.Test(req)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusBadRequest, resp.StatusCode)
+	require.Contains(t, readRespBody(t, resp), "must omit spec.secretRef")
+}
+
 func createRepositoryMonitorForHandlerTest(t *testing.T, app *fiber.App, name, namespace string) {
 	t.Helper()
 	body := fmt.Sprintf(`{
diff --git a/internal/api/resource_handlers.go b/internal/api/resource_handlers.go
index 97259d236..16a36b6cd 100644
--- a/internal/api/resource_handlers.go
+++ b/internal/api/resource_handlers.go
@@ -1,11 +1,13 @@
 package api
 
 import (
+	"errors"
 	"fmt"
 	neturl "net/url"
 	"strings"
 
 	"github.com/gofiber/fiber/v3"
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/util/retry"
@@ -421,16 +423,10 @@ func (h *Handlers) UpdateTool(c fiber.Ctx) error {
 	if _, builtin := builtinToolsMap[name]; builtin {
 		return fiber.NewError(fiber.StatusConflict, "built-in tools cannot be updated")
 	}
-	tool, err := h.fetchToolCRD(c, name)
+	namespace, err := h.resolveNamespace(c, c.Query("namespace", ""))
 	if err != nil {
 		return err
 	}
-	if toolSpecHasProtectedAuth(tool.Spec) {
-		return fiber.NewError(
-			fiber.StatusBadRequest,
-			"tools with protected HTTP auth configuration must be updated with Kubernetes RBAC",
-		)
-	}
 	var req UpdateToolRequest
 	if err := c.Bind().JSON(&req); err != nil {
 		return fiber.NewError(fiber.StatusBadRequest, "invalid request body")
@@ -438,11 +434,64 @@ func (h *Handlers) UpdateTool(c fiber.Ctx) error {
 	if err := validateToolRESTMutation(req.Spec); err != nil {
 		return err
 	}
-	tool.Spec = req.Spec
-	if err := authorizeToolWorkspaceClassUse(c.Context(), h.clientset, GetUserInfo(c), tool); err != nil {
-		return err
+
+	reader := h.apiReader
+	if reader == nil {
+		reader = h.client
 	}
-	if err := h.client.Update(c.Context(), tool); err != nil {
+	ctx := c.Context()
+	key := types.NamespacedName{Name: name, Namespace: namespace}
+	var (
+		tool              *corev1alpha1.Tool
+		initialGeneration int64
+		initialSpec       *corev1alpha1.ToolSpec
+		initialUID        types.UID
+	)
+	errToolSpecChanged := errors.New("tool spec changed concurrently")
+	err = retry.RetryOnConflict(retry.DefaultBackoff, func() error {
+		current := &corev1alpha1.Tool{}
+		if err := reader.Get(ctx, key, current); err != nil {
+			return err
+		}
+		if initialSpec == nil {
+			initialGeneration = current.Generation
+			initialSpec = current.Spec.DeepCopy()
+			initialUID = current.UID
+		} else if current.UID != initialUID ||
+			current.Generation != initialGeneration ||
+			!apiequality.Semantic.DeepEqual(current.Spec, *initialSpec) {
+			return errToolSpecChanged
+		}
+		if toolSpecHasProtectedAuth(current.Spec) {
+			return fiber.NewError(
+				fiber.StatusBadRequest,
+				"tools with protected HTTP auth configuration must be updated with Kubernetes RBAC",
+			)
+		}
+		current.Spec = req.Spec
+		if err := authorizeToolWorkspaceClassUse(ctx, h.clientset, GetUserInfo(c), current); err != nil {
+			return err
+		}
+		if err := h.client.Update(ctx, current); err != nil {
+			return err
+		}
+		tool = current
+		return nil
+	})
+	if err != nil {
+		if errors.Is(err, errToolSpecChanged) {
+			return fiber.NewError(fiber.StatusConflict, "tool spec was modified concurrently")
+		}
+		var fiberErr *fiber.Error
+		if errors.As(err, &fiberErr) {
+			return err
+		}
+		if apierrors.IsNotFound(err) {
+			return fiber.NewError(fiber.StatusNotFound, "tool not found")
+		}
+		if apierrors.IsConflict(err) {
+			return fiber.NewError(fiber.StatusConflict, "tool was modified concurrently")
+		}
 		return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to update tool: %v", err))
 	}
 	return c.JSON(tool)
diff --git a/internal/api/resource_handlers_test.go b/internal/api/resource_handlers_test.go
index 95402d0a6..2ce0df31c 100644
--- a/internal/api/resource_handlers_test.go
+++ b/internal/api/resource_handlers_test.go
@@ -2,18 +2,46 @@ package api
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 
 	"github.com/gofiber/fiber/v3"
 	"github.com/stretchr/testify/require"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
 )
 
+type recordingToolReader struct {
+	client.Reader
+	getCalls         int
+	resourceVersions []string
+}
+
+func (r *recordingToolReader) Get(
+	ctx context.Context,
+	key client.ObjectKey,
+	obj client.Object,
+	opts ...client.GetOption,
+) error {
+	r.getCalls++
+	if err := r.Reader.Get(ctx, key, obj, opts...); err != nil {
+		return err
+	}
+	r.resourceVersions = append(r.resourceVersions, obj.GetResourceVersion())
+	return nil
+}
+
 func TestHandlers_ProviderCRUD(t *testing.T) {
 	handlers, app := setupTestHandlers()
 	app.Get("/providers", handlers.ListProviders)
@@ -142,6 +170,142 @@ func TestHandlers_ToolWriteRejectsBuiltInAndCRUD(t *testing.T) {
 	require.Equal(t, http.StatusNoContent, resp.StatusCode)
 }
 
+func TestHandlers_UpdateToolRetriesStatusOnlyConflictWithFreshRead(t *testing.T) {
+	scheme := runtime.NewScheme()
+	require.NoError(t, corev1alpha1.AddToScheme(scheme))
+
+	tool := &corev1alpha1.Tool{
+		ObjectMeta: metav1.ObjectMeta{Name: "http-tool", Namespace: "default"},
+		Spec: corev1alpha1.ToolSpec{
+			Description: "original",
+			HTTP: &corev1alpha1.HTTPExecution{
+				URL:    "https://example.com/original",
+				Method: http.MethodPost,
+			},
+		},
+	}
+	updateCalls := 0
+	var updateVersions []string
+	kubeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithStatusSubresource(&corev1alpha1.Tool{}).
+		WithObjects(tool).
+		WithInterceptorFuncs(interceptor.Funcs{
+			Update: func(ctx context.Context, c client.WithWatch, obj client.Object, opts ...client.UpdateOption) error {
+				updateCalls++
+				updateVersions = append(updateVersions, obj.GetResourceVersion())
+				if updateCalls == 1 {
+					current := &corev1alpha1.Tool{}
+					if err := c.Get(ctx, client.ObjectKeyFromObject(obj), current); err != nil {
+						return err
+					}
+					current.Status.Available = true
+					current.Status.Error = "health check completed"
+					if err := c.Status().Update(ctx, current); err != nil {
+						return err
+					}
+					return apierrors.NewConflict(
+						schema.GroupResource{Group: corev1alpha1.GroupVersion.Group, Resource: "tools"},
+						obj.GetName(),
+						errors.New("status update advanced resource version"),
+					)
+				}
+				return c.Update(ctx, obj, opts...)
+			},
+		}).
+		Build()
+	reader := &recordingToolReader{Reader: kubeClient}
+	handlers := NewHandlers(HandlersConfig{Client: kubeClient, APIReader: reader})
+	app := fiber.New()
+	app.Put("/tools/:name", handlers.UpdateTool)
+
+	resp := testJSONRequest(t, app, http.MethodPut, "/tools/http-tool", map[string]any{
+		"spec": map[string]any{
+			"description": "updated",
+			"http": map[string]any{
+				"url":    "https://example.com/updated",
+				"method": http.MethodPost,
+			},
+		},
+	})
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	require.Equal(t, 2, updateCalls)
+	require.Equal(t, 2, reader.getCalls)
+	require.Len(t, reader.resourceVersions, 2)
+	require.NotEqual(t, reader.resourceVersions[0], reader.resourceVersions[1])
+	require.Equal(t, reader.resourceVersions, updateVersions)
+
+	updated := &corev1alpha1.Tool{}
+	require.NoError(t, kubeClient.Get(context.Background(), client.ObjectKeyFromObject(tool), updated))
+	require.Equal(t, "updated", updated.Spec.Description)
+	require.Equal(t, "https://example.com/updated", updated.Spec.HTTP.URL)
+	require.True(t, updated.Status.Available)
+	require.Equal(t, "health check completed", updated.Status.Error)
+}
+
+func TestHandlers_UpdateToolRejectsConcurrentSpecEdit(t *testing.T) {
+	scheme := runtime.NewScheme()
+	require.NoError(t, corev1alpha1.AddToScheme(scheme))
+
+	tool := &corev1alpha1.Tool{
+		ObjectMeta: metav1.ObjectMeta{Name: "http-tool", Namespace: "default", Generation: 1},
+		Spec: corev1alpha1.ToolSpec{
+			Description: "original",
+			HTTP:        &corev1alpha1.HTTPExecution{URL: "https://example.com/original"},
+		},
+	}
+	updateCalls := 0
+	kubeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithObjects(tool).
+		WithInterceptorFuncs(interceptor.Funcs{
+			Update: func(ctx context.Context, c client.WithWatch, obj client.Object, opts ...client.UpdateOption) error {
+				updateCalls++
+				if updateCalls == 1 {
+					current := &corev1alpha1.Tool{}
+					if err := c.Get(ctx, client.ObjectKeyFromObject(obj), current); err != nil {
+						return err
+					}
+					current.Generation++
+					current.Spec.Description = "concurrent edit"
+					current.Spec.HTTP.URL = "https://example.com/concurrent"
+					if err := c.Update(ctx, current, opts...); err != nil {
+						return err
+					}
+					return apierrors.NewConflict(
+						schema.GroupResource{Group: corev1alpha1.GroupVersion.Group, Resource: "tools"},
+						obj.GetName(),
+						errors.New("spec update advanced resource version"),
+					)
+				}
+				return c.Update(ctx, obj, opts...)
+			},
+		}).
+		Build()
+	reader := &recordingToolReader{Reader: kubeClient}
+	handlers := NewHandlers(HandlersConfig{Client: kubeClient, APIReader: reader})
+	app := fiber.New()
+	app.Put("/tools/:name", handlers.UpdateTool)
+
+	resp := testJSONRequest(t, app, http.MethodPut, "/tools/http-tool", map[string]any{
+		"spec": map[string]any{
+			"description": "requested update",
+			"http":        map[string]any{"url": "https://example.com/requested"},
+		},
+	})
+	require.Equal(t, http.StatusConflict, resp.StatusCode)
+	require.Equal(t, 1, updateCalls)
+	require.Equal(t, 2, reader.getCalls)
+	require.Len(t, reader.resourceVersions, 2)
+	require.NotEqual(t, reader.resourceVersions[0], reader.resourceVersions[1])
+
+	updated := &corev1alpha1.Tool{}
+	require.NoError(t, kubeClient.Get(context.Background(), client.ObjectKeyFromObject(tool), updated))
+	require.Equal(t, int64(2), updated.Generation)
+	require.Equal(t, "concurrent edit", updated.Spec.Description)
+	require.Equal(t, "https://example.com/concurrent", updated.Spec.HTTP.URL)
+}
+
 func TestHandlers_SubstrateActorPoolCRUD(t *testing.T) {
 	handlers, app := setupTestHandlers()
 	app.Get("/substrate-actor-pools", handlers.ListSubstrateActorPools)
diff --git a/internal/api/runtime_resource_handlers.go b/internal/api/runtime_resource_handlers.go
new file mode 100644
index 000000000..b76a7daee
--- /dev/null
+++ b/internal/api/runtime_resource_handlers.go
@@ -0,0 +1,243 @@
+package api
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/gofiber/fiber/v3"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+)
+
+func (h *Handlers) ListRuntimePools(c fiber.Ctx) error {
+	namespace, err := h.resolveNamespace(c, c.Query("namespace", ""))
+	if err != nil {
+		return err
+	}
+	if err := h.authorizeContextTokenAction(c, "listRuntimePools", h.contextTokenAuthorization.AgentReadScopes); err != nil {
+		return err
+	}
+	pagination, err := ParsePagination(c.Query("limit", "100"), c.Query("continue", ""))
+	if err != nil {
+		return fiber.NewError(fiber.StatusBadRequest, err.Error())
+	}
+	list := &corev1alpha1.RuntimePoolList{}
+	if err := h.client.List(c.Context(), list, &client.ListOptions{
+		Namespace: namespace,
+		Limit:     pagination.Limit,
+		Continue:  pagination.Continue,
+	}); err != nil {
+		return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to list runtime pools: %v", err))
+	}
+	return c.JSON(list)
+}
+
+func (h *Handlers) GetRuntimePool(c fiber.Ctx) error {
+	if err := h.authorizeContextTokenAction(c, "getRuntimePool", h.contextTokenAuthorization.AgentReadScopes); err != nil {
+		return err
+	}
+	pool, err := h.fetchRuntimePool(c, c.Params("name"))
+	if err != nil {
+		return err
+	}
+	return c.JSON(pool)
+}
+
+func (h *Handlers) CreateRuntimePool(c fiber.Ctx) error {
+	if err := rejectContextTokenResourceMutation(c, "runtime pool"); err != nil {
+		return err
+	}
+	var pool corev1alpha1.RuntimePool
+	if err := c.Bind().JSON(&pool); err != nil {
+		return fiber.NewError(fiber.StatusBadRequest, "invalid runtime pool manifest")
+	}
+	name := strings.TrimSpace(pool.Name)
+	if name == "" {
+		return fiber.NewError(fiber.StatusBadRequest, "metadata.name is required")
+	}
+	namespace, err := h.resolveNamespace(c, pool.Namespace)
+	if err != nil {
+		return err
+	}
+	pool.TypeMeta = metav1.TypeMeta{APIVersion: corev1alpha1.GroupVersion.String(), Kind: "RuntimePool"}
+	pool.Namespace = namespace
+	pool.ResourceVersion = ""
+	pool.UID = ""
+	pool.Status = corev1alpha1.RuntimePoolStatus{}
+	if err := h.client.Create(c.Context(), &pool); err != nil {
+		if apierrors.IsAlreadyExists(err) {
+			return fiber.NewError(fiber.StatusConflict, "runtime pool already exists")
+		}
+		return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to create runtime pool: %v", err))
+	}
+	return c.Status(fiber.StatusCreated).JSON(&pool)
+}
+
+func (h *Handlers) UpdateRuntimePool(c fiber.Ctx) error {
+	if err := rejectContextTokenResourceMutation(c, "runtime pool"); err != nil {
+		return err
+	}
+	existing, err := h.fetchRuntimePool(c, c.Params("name"))
+	if err != nil {
+		return err
+	}
+	var desired corev1alpha1.RuntimePool
+	if err := c.Bind().JSON(&desired); err != nil {
+		return fiber.NewError(fiber.StatusBadRequest, "invalid runtime pool manifest")
+	}
+	existing.Spec = desired.Spec
+	if err := h.client.Update(c.Context(), existing); err != nil {
+		if apierrors.IsConflict(err) {
+			return fiber.NewError(fiber.StatusConflict, "runtime pool was updated concurrently")
+		}
+		return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to update runtime pool: %v", err))
+	}
+	return c.JSON(existing)
+}
+
+func (h *Handlers) DeleteRuntimePool(c fiber.Ctx) error {
+	if err := rejectContextTokenResourceMutation(c, "runtime pool"); err != nil {
+		return err
+	}
+	pool, err := h.fetchRuntimePool(c, c.Params("name"))
+	if err != nil {
+		return err
+	}
+	if err := h.client.Delete(c.Context(), pool); err != nil && !apierrors.IsNotFound(err) {
+		return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to delete runtime pool: %v", err))
+	}
+	return c.SendStatus(fiber.StatusNoContent)
+}
+
+func (h *Handlers) fetchRuntimePool(c fiber.Ctx, name string) (*corev1alpha1.RuntimePool, error) {
+	namespace, err := h.resolveNamespace(c, c.Query("namespace", ""))
+	if err != nil {
+		return nil, err
+	}
+	pool := &corev1alpha1.RuntimePool{}
+	if err := h.client.Get(c.Context(), types.NamespacedName{Namespace: namespace, Name: name}, pool); err != nil {
+		if apierrors.IsNotFound(err) {
+			return nil, fiber.NewError(fiber.StatusNotFound, "runtime pool not found")
+		}
+		return nil, fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to get runtime pool: %v", err))
+	}
+	return pool, nil
+}
+
+func (h *Handlers) ListAgentRuntimes(c fiber.Ctx) error {
+	namespace, err := h.resolveNamespace(c, c.Query("namespace", ""))
+	if err != nil {
+		return err
+	}
+	if err := h.authorizeContextTokenAction(c, "listAgentRuntimes", h.contextTokenAuthorization.AgentReadScopes); err != nil {
+		return err
+	}
+	pagination, err := ParsePagination(c.Query("limit", "100"), c.Query("continue", ""))
+	if err != nil {
+		return fiber.NewError(fiber.StatusBadRequest, err.Error())
+	}
+	list := &corev1alpha1.AgentRuntimeList{}
+	if err := h.client.List(c.Context(), list, &client.ListOptions{
+		Namespace: namespace,
+		Limit:     pagination.Limit,
+		Continue:  pagination.Continue,
+	}); err != nil {
+		return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to list agent runtimes: %v", err))
+	}
+	return c.JSON(list)
+}
+
+func (h *Handlers) GetAgentRuntime(c fiber.Ctx) error {
+	if err := h.authorizeContextTokenAction(c, "getAgentRuntime", h.contextTokenAuthorization.AgentReadScopes); err != nil {
+		return err
+	}
+	runtime, err := h.fetchAgentRuntime(c, c.Params("name"))
+	if err != nil {
+		return err
+	}
+	return c.JSON(runtime)
+}
+
+func (h *Handlers) CreateAgentRuntime(c fiber.Ctx) error {
+	if err := rejectContextTokenResourceMutation(c, "agent runtime"); err != nil {
+		return err
+	}
+	var runtime corev1alpha1.AgentRuntime
+	if err := c.Bind().JSON(&runtime); err != nil {
+		return fiber.NewError(fiber.StatusBadRequest, "invalid agent runtime manifest")
+	}
+	if strings.TrimSpace(runtime.Name) == "" {
+		return fiber.NewError(fiber.StatusBadRequest, "metadata.name is required")
+	}
+	namespace, err := h.resolveNamespace(c, runtime.Namespace)
+	if err != nil {
+		return err
+	}
+	runtime.TypeMeta = metav1.TypeMeta{APIVersion: corev1alpha1.GroupVersion.String(), Kind: "AgentRuntime"}
+	runtime.Namespace = namespace
+	runtime.ResourceVersion = ""
+	runtime.UID = ""
+	runtime.Status = corev1alpha1.AgentRuntimeStatus{}
+	if err := h.client.Create(c.Context(), &runtime); err != nil {
+		if apierrors.IsAlreadyExists(err) {
+			return fiber.NewError(fiber.StatusConflict, "agent runtime already exists")
+		}
+		return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to create agent runtime: %v", err))
+	}
+	return c.Status(fiber.StatusCreated).JSON(&runtime)
+}
+
+func (h *Handlers) UpdateAgentRuntime(c fiber.Ctx) error {
+	if err := rejectContextTokenResourceMutation(c, "agent runtime"); err != nil {
+		return err
+	}
+	existing, err := h.fetchAgentRuntime(c, c.Params("name"))
+	if err != nil {
+		return err
+	}
+	var desired corev1alpha1.AgentRuntime
+	if err := c.Bind().JSON(&desired); err != nil {
+		return fiber.NewError(fiber.StatusBadRequest, "invalid agent runtime manifest")
+	}
+	existing.Spec = desired.Spec
+	if err := h.client.Update(c.Context(), existing); err != nil {
+		if apierrors.IsConflict(err) {
+			return fiber.NewError(fiber.StatusConflict, "agent runtime was updated concurrently")
+		}
+		return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to update agent runtime: %v", err))
+	}
+	return c.JSON(existing)
+}
+
+func (h *Handlers) DeleteAgentRuntime(c fiber.Ctx) error {
+	if err := rejectContextTokenResourceMutation(c, "agent runtime"); err != nil {
+		return err
+	}
+	runtime, err := h.fetchAgentRuntime(c, c.Params("name"))
+	if err != nil {
+		return err
+	}
+	if err := h.client.Delete(c.Context(), runtime); err != nil && !apierrors.IsNotFound(err) {
+		return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to delete agent runtime: %v", err))
+	}
+	return c.SendStatus(fiber.StatusNoContent)
+}
+
+func (h *Handlers) fetchAgentRuntime(c fiber.Ctx, name string) (*corev1alpha1.AgentRuntime, error) {
+	namespace, err := h.resolveNamespace(c, c.Query("namespace", ""))
+	if err != nil {
+		return nil, err
+	}
+	runtime := &corev1alpha1.AgentRuntime{}
+	if err := h.client.Get(c.Context(), types.NamespacedName{Namespace: namespace, Name: name}, runtime); err != nil {
+		if apierrors.IsNotFound(err) {
+			return nil, fiber.NewError(fiber.StatusNotFound, "agent runtime not found")
+		}
+		return nil, fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to get agent runtime: %v", err))
+	}
+	return runtime, nil
+}
diff --git a/internal/api/runtime_resource_handlers_test.go b/internal/api/runtime_resource_handlers_test.go
new file mode 100644
index 000000000..af1adee2e
--- /dev/null
+++ b/internal/api/runtime_resource_handlers_test.go
@@ -0,0 +1,189 @@
+package api
+
+import (
+	"k8s.io/utils/ptr"
+
+	"bytes"
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gofiber/fiber/v3"
+	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+)
+
+type runtimeListRecordingClient struct {
+	client.Client
+	limit        int64
+	continuation string
+}
+
+func (c *runtimeListRecordingClient) List(ctx context.Context, list client.ObjectList, opts ...client.ListOption) error {
+	listOptions := &client.ListOptions{}
+	for _, opt := range opts {
+		opt.ApplyToList(listOptions)
+	}
+	c.limit = listOptions.Limit
+	c.continuation = listOptions.Continue
+	return c.Client.List(ctx, list, client.InNamespace(listOptions.Namespace))
+}
+
+func TestRuntimeFabricResourceHandlers(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.RuntimePool{}, &corev1alpha1.AgentRuntime{}).Build()
+	handlers := NewHandlers(HandlersConfig{Client: kubeClient})
+	app := fiber.New()
+	app.Get("/runtime-pools", handlers.ListRuntimePools)
+	app.Get("/runtime-pools/:name", handlers.GetRuntimePool)
+	app.Post("/agent-runtimes", handlers.CreateAgentRuntime)
+	app.Get("/agent-runtimes", handlers.ListAgentRuntimes)
+
+	pool := corev1alpha1.RuntimePool{
+		ObjectMeta: objectMetaFromRequest("pool", "default", MetadataRequest{}),
+		Spec: corev1alpha1.RuntimePoolSpec{
+			TrustDomain: corev1alpha1.RuntimePoolTrustDomain{Namespace: "default", Identity: "namespace:default"},
+			Runtime: corev1alpha1.RuntimePoolRuntimeSpec{
+				Image:   "docker.io/example/acp@sha256:" + strings.Repeat("a", 64),
+				Profile: corev1alpha1.RuntimePoolProfileSpec{Digest: "sha256:" + strings.Repeat("b", 64), DigestSchemaVersion: "1", ACPProfile: "acp.v1", AdapterDigests: map[string]string{"adapter": "sha256:" + strings.Repeat("c", 64)}, ProviderKind: "codex", Model: "gpt", AgentConfigurationDigest: "sha256:" + strings.Repeat("d", 64), ToolPolicyDigest: "sha256:" + strings.Repeat("e", 64), ApprovalPolicyDigest: "sha256:" + strings.Repeat("f", 64), MCPConfigurationDigest: "sha256:" + strings.Repeat("1", 64), WorkspaceIntent: corev1alpha1.WorkspaceIntentRead, ProxyCredentialRole: "provider", ProxyCredentialScope: "model:gpt", ResourceClass: "standard"},
+			},
+		},
+	}
+	if err := kubeClient.Create(t.Context(), &pool); err != nil {
+		t.Fatal(err)
+	}
+	resp, err := app.Test(httptest.NewRequest(http.MethodGet, "/runtime-pools?namespace=default", nil))
+	if err != nil || resp.StatusCode != http.StatusOK {
+		t.Fatalf("list pools status=%v err=%v", resp.StatusCode, err)
+	}
+	var listed corev1alpha1.RuntimePoolList
+	if err := json.NewDecoder(resp.Body).Decode(&listed); err != nil || len(listed.Items) != 1 {
+		t.Fatalf("listed pools=%#v err=%v", listed.Items, err)
+	}
+	digest := func(char string) string { return "sha256:" + strings.Repeat(char, 64) }
+	profile := corev1alpha1.AgentRuntimeProfileSpec{Digest: digest("a"), DigestSchemaVersion: 1, ACPProfile: "acp.v1", AdapterName: "codex", AdapterDigest: digest("b"), ProviderKind: "codex", Model: "gpt", AgentConfigurationDigest: digest("c"), ToolPolicyDigest: digest("d"), ApprovalPolicyDigest: digest("e"), MCPConfigurationDigest: digest("f"), WorkspaceIntent: corev1alpha1.WorkspaceIntentRead, ProxyCredentialRole: "provider", ProxyCredentialScope: "model:gpt", ResourceClass: "standard"}
+	claims := corev1alpha1.AgentRuntimeWorkspaceGovernanceCapabilities{Mode: corev1alpha1.AgentRuntimeWorkspaceGovernanceStrict, OrkaOwnedWorkspaceDeltas: true, PromptScopedBrokerAuthorization: true, NoDirectSCMPublication: true, OrkaOwnedCleanRoomPublication: true, ExactInstanceFencing: true, DuplicateSafeMutations: true, CancellationSettlement: true}
+	limits := corev1alpha1.AgentRuntimeProtocolLimits{MaxResidentSessions: 10, MaxConcurrentPrompts: 4, MaxRequestBytes: 1 << 20, MaxEventLineBytes: 1 << 20, MaxTerminalResultBytes: 1 << 20, MaxBufferedEvents: 64, MaxUpdateEventsPerSecond: 100, MinPromptLeaseMillis: 5000, MaxPromptLeaseMillis: 120000, MaxPendingPermissions: 16, MaxWorkspaceDeltaBytes: 100 << 20}
+	runtimeObject := corev1alpha1.AgentRuntime{
+		ObjectMeta: objectMetaFromRequest("external", "default", MetadataRequest{}),
+		Spec: corev1alpha1.AgentRuntimeRegistrySpec{
+			ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			Deployment:      corev1alpha1.AgentRuntimeDeploymentSpec{Mode: corev1alpha1.AgentRuntimeDeploymentModeExternalEndpoint, Endpoint: "https://runtime.example.com"},
+			ClientAuth:      corev1alpha1.AgentRuntimeClientAuth{ControllerBearerTokenSecretRef: &corev1alpha1.AgentRuntimeSecretKeyReference{Name: "auth", Key: "controller"}, OperationCapabilitySecretRef: &corev1alpha1.AgentRuntimeSecretKeyReference{Name: "auth", Key: "capability"}},
+			Capabilities:    &corev1alpha1.AgentRuntimeCapabilitiesSpec{RuntimeInstanceID: "runtime-1", Profile: &profile, Limits: &limits, SupportsDrain: true, WorkspaceGovernance: &claims},
+		},
+	}
+	body, _ := json.Marshal(runtimeObject)
+	resp, err = app.Test(httptest.NewRequest(http.MethodPost, "/agent-runtimes", bytes.NewReader(body)))
+	if err != nil || resp.StatusCode != http.StatusCreated {
+		t.Fatalf("create agent runtime status=%v err=%v", resp.StatusCode, err)
+	}
+	resp, _ = app.Test(httptest.NewRequest(http.MethodGet, "/agent-runtimes?namespace=default", nil))
+	var runtimes corev1alpha1.AgentRuntimeList
+	if err := json.NewDecoder(resp.Body).Decode(&runtimes); err != nil || len(runtimes.Items) != 1 {
+		t.Fatalf("listed runtimes=%#v err=%v", runtimes.Items, err)
+	}
+}
+
+func TestRuntimeFabricReadsRequireAgentReadScopeForContextTokens(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	pool := &corev1alpha1.RuntimePool{ObjectMeta: objectMetaFromRequest("pool", "default", MetadataRequest{})}
+	agentRuntime := &corev1alpha1.AgentRuntime{ObjectMeta: objectMetaFromRequest("external", "default", MetadataRequest{})}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(pool, agentRuntime).Build()
+	authz, err := NewContextTokenAuthorizationConfig(ContextTokenAuthorizationConfigOptions{Mode: ContextTokenAuthorizationModeEnforce})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	tests := []struct {
+		name    string
+		route   string
+		path    string
+		handler func(*Handlers) fiber.Handler
+	}{
+		{name: "list runtime pools", route: "/runtime-pools", path: "/runtime-pools?namespace=default", handler: func(h *Handlers) fiber.Handler { return h.ListRuntimePools }},
+		{name: "get runtime pool", route: "/runtime-pools/:name", path: "/runtime-pools/pool?namespace=default", handler: func(h *Handlers) fiber.Handler { return h.GetRuntimePool }},
+		{name: "list agent runtimes", route: "/agent-runtimes", path: "/agent-runtimes?namespace=default", handler: func(h *Handlers) fiber.Handler { return h.ListAgentRuntimes }},
+		{name: "get agent runtime", route: "/agent-runtimes/:name", path: "/agent-runtimes/external?namespace=default", handler: func(h *Handlers) fiber.Handler { return h.GetAgentRuntime }},
+	}
+	for _, test := range tests {
+		for _, authorization := range []struct {
+			name       string
+			scopes     []string
+			wantStatus int
+		}{
+			{name: "denies unrelated scope", scopes: []string{ContextTokenScopeTaskCreate}, wantStatus: http.StatusForbidden},
+			{name: "allows agent read scope", scopes: []string{ContextTokenScopeAgentsRead}, wantStatus: http.StatusOK},
+		} {
+			t.Run(test.name+"/"+authorization.name, func(t *testing.T) {
+				handlers := NewHandlers(HandlersConfig{Client: kubeClient, ContextTokenAuthorization: authz})
+				app := fiber.New()
+				app.Use(func(c fiber.Ctx) error {
+					ctxToken := &ContextToken{Scopes: authorization.scopes}
+					c.Locals(UserInfoContextKey, &UserInfo{
+						AuthType:     AuthTypeContextToken,
+						ContextToken: ctxToken,
+					})
+					return c.Next()
+				})
+				app.Get(test.route, test.handler(handlers))
+
+				response, err := app.Test(httptest.NewRequest(http.MethodGet, test.path, nil))
+				if err != nil {
+					t.Fatal(err)
+				}
+				if response.StatusCode != authorization.wantStatus {
+					t.Fatalf("status=%d, want %d", response.StatusCode, authorization.wantStatus)
+				}
+			})
+		}
+	}
+}
+
+func TestRuntimeFabricListsHonorContinuationTokens(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+
+	tests := []struct {
+		name    string
+		path    string
+		handler func(*Handlers) fiber.Handler
+	}{
+		{name: "runtime pools", path: "/runtime-pools?namespace=default&limit=17&continue=next-page", handler: func(h *Handlers) fiber.Handler { return h.ListRuntimePools }},
+		{name: "agent runtimes", path: "/agent-runtimes?namespace=default&limit=17&continue=next-page", handler: func(h *Handlers) fiber.Handler { return h.ListAgentRuntimes }},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			baseClient := fake.NewClientBuilder().WithScheme(scheme).Build()
+			recordingClient := &runtimeListRecordingClient{Client: baseClient}
+			handlers := NewHandlers(HandlersConfig{Client: recordingClient})
+			app := fiber.New()
+			app.Get(strings.Split(test.path, "?")[0], test.handler(handlers))
+
+			response, err := app.Test(httptest.NewRequest(http.MethodGet, test.path, nil))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if response.StatusCode != http.StatusOK {
+				t.Fatalf("status=%d, want %d", response.StatusCode, http.StatusOK)
+			}
+			if recordingClient.limit != 17 || recordingClient.continuation != "next-page" {
+				t.Fatalf("list options = limit %d continue %q, want 17 and next-page", recordingClient.limit, recordingClient.continuation)
+			}
+		})
+	}
+}
diff --git a/internal/api/security_handlers.go b/internal/api/security_handlers.go
index 01ce9ba1f..75b963f67 100644
--- a/internal/api/security_handlers.go
+++ b/internal/api/security_handlers.go
@@ -9,7 +9,6 @@ import (
 	"time"
 
 	"github.com/gofiber/fiber/v3"
-	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -21,8 +20,6 @@ import (
 	"github.com/orka-agents/orka/internal/metrics"
 	"github.com/orka-agents/orka/internal/security"
 	"github.com/orka-agents/orka/internal/store"
-	"github.com/orka-agents/orka/internal/tools"
-	"github.com/orka-agents/orka/internal/workerenv"
 )
 
 type CreateRepositoryScanRequest struct {
@@ -164,6 +161,59 @@ func authorizeContextTokenRepositoryScanPolicyRefsForUser(
 	return nil
 }
 
+func (h *Handlers) authorizeContextTokenRepositoryScanCredentialRefs(
+	c fiber.Ctx,
+	action string,
+	namespace string,
+	refs []repositoryScanCredentialRef,
+) error {
+	seen := map[string]struct{}{}
+	for _, credential := range refs {
+		name := ""
+		if credential.ref != nil {
+			name = strings.TrimSpace(credential.ref.Name)
+		}
+		if name == "" {
+			continue
+		}
+		if _, ok := seen[name]; ok {
+			continue
+		}
+		seen[name] = struct{}{}
+		if err := h.authorizeContextTokenGitCredentialSecretName(c, action+":"+credential.field, namespace, name); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func authorizeContextTokenRepositoryScanCredentialRefsForUser(
+	ui *UserInfo,
+	cfg ContextTokenAuthorizationConfig,
+	action string,
+	namespace string,
+	refs []repositoryScanCredentialRef,
+) error {
+	seen := map[string]struct{}{}
+	for _, credential := range refs {
+		name := ""
+		if credential.ref != nil {
+			name = strings.TrimSpace(credential.ref.Name)
+		}
+		if name == "" {
+			continue
+		}
+		if _, ok := seen[name]; ok {
+			continue
+		}
+		seen[name] = struct{}{}
+		if err := authorizeContextTokenGitCredentialSecretForUser(ui, cfg, action+":"+credential.field, namespace, name); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 func (h *Handlers) createSecurityScanRun(ctx context.Context, ui *UserInfo, scan *corev1alpha1.RepositoryScan, mode, baseCommit, headCommit string) (*store.ScanRun, error) {
 	if err := h.ensureSecurityStore(); err != nil {
 		return nil, err
@@ -188,6 +238,11 @@ func (h *Handlers) createSecurityScanRun(ctx context.Context, ui *UserInfo, scan
 	idempotencyKey := security.ScanRunIdempotencyKey(scan.Namespace, scan.Name, mode, baseCommit, headCommit, scan.Spec.SubPath, policy.Digest)
 	timeout := metav1.Duration{Duration: 2 * time.Hour}
 	priority := int32(700)
+	resultBinding := security.AgentResultBinding{
+		RepositoryScan: scan.Name,
+		ScanID:         scanID,
+		PolicyDigest:   policy.Digest,
+	}
 
 	task := &corev1alpha1.Task{
 		ObjectMeta: metav1.ObjectMeta{
@@ -204,43 +259,26 @@ func (h *Handlers) createSecurityScanRun(ctx context.Context, ui *UserInfo, scan
 			OwnerReferences: []metav1.OwnerReference{h.ownerRefForRepositoryScan(scan)},
 		},
 		Spec: corev1alpha1.TaskSpec{
-			Type:     corev1alpha1.TaskTypeAgent,
-			AgentRef: &scan.Spec.AnalysisAgentRef,
-			Prompt:   security.BuildThreatModelPrompt(scan, mode, baseCommit, headCommit, threatModel, policy.PromptPolicy()),
-			Timeout:  &timeout,
-			Priority: &priority,
-			Env: []corev1.EnvVar{
-				{Name: security.EnvRepositoryScanName, Value: scan.Name},
-				{Name: security.EnvStage, Value: security.StageThreatModel},
-				{Name: security.EnvScanID, Value: scanID},
-				{Name: security.EnvScannerPolicyVersion, Value: security.ScannerPolicyVersion},
-				{Name: security.EnvPolicyDigest, Value: policy.Digest},
-				{Name: security.EnvPolicyProvenance, Value: security.PolicyProvenanceEnv(policy)},
-			},
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      scan.Spec.RepoURL,
-					Branch:       security.EffectiveWorkspaceBranch(scan),
-					Ref:          security.EffectiveRef(scan),
-					GitSecretRef: scan.Spec.GitSecretRef,
-					SubPath:      scan.Spec.SubPath,
-					ForkRepo:     scan.Spec.ForkRepo,
-					PRBaseBranch: scan.Spec.PRBaseBranch,
-				},
-			},
+			Type:      corev1alpha1.TaskTypeAgent,
+			AgentRef:  &scan.Spec.AnalysisAgentRef,
+			Prompt:    security.BuildThreatModelResultPrompt(scan, mode, baseCommit, headCommit, threatModel, resultBinding, policy.PromptPolicy()),
+			Timeout:   &timeout,
+			Priority:  &priority,
+			Workspace: repositoryScanTaskWorkspace(scan, corev1alpha1.WorkspaceIntentRead),
 		},
 	}
-	if scan.Spec.GitSecretRef != nil {
-		if err := authorizeContextTokenGitCredentialSecretForUser(ui, h.contextTokenAuthorization, "createSecurityScanTaskGitSecret", scan.Namespace, scan.Spec.GitSecretRef.Name); err != nil {
-			return nil, err
-		}
+	if err := authorizeContextTokenRepositoryScanCredentialRefsForUser(
+		ui,
+		h.contextTokenAuthorization,
+		"createSecurityScanTaskCredential",
+		scan.Namespace,
+		[]repositoryScanCredentialRef{{field: "source-read", ref: repositoryScanReadCredentialRef(scan)}},
+	); err != nil {
+		return nil, err
 	}
 	if err := authorizeAndStampTaskContext(ctx, h.client, h.clientset, contextTokenFromUserInfo(ui), h.contextTokenAuthorization, "createSecurityScanTask", ui, task); err != nil {
 		return nil, err
 	}
-	if err := h.client.Create(ctx, task); err != nil {
-		return nil, fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to create scan task: %v", err))
-	}
 
 	run := &store.ScanRun{
 		ID:                   scanID,
@@ -254,11 +292,27 @@ func (h *Handlers) createSecurityScanRun(ctx context.Context, ui *UserInfo, scan
 		ScannerPolicyVersion: security.ScannerPolicyVersion,
 		PolicyDigest:         policy.Digest,
 		IdempotencyKey:       idempotencyKey,
-		StartedAt:            time.Now(),
+		StartedAt:            time.Now().UTC(),
 	}
 	if err := h.securityStore.CreateScanRun(ctx, run); err != nil {
+		if errors.Is(err, store.ErrConflict) {
+			return nil, fiber.NewError(fiber.StatusConflict, "a security scan is already running for this repository")
+		}
 		return nil, fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to create scan run: %v", err))
 	}
+	if err := h.client.Create(ctx, task); err != nil {
+		now := time.Now()
+		run.Phase = "failed"
+		run.CompletedAt = &now
+		run.ErrorMessage = "scan task creation failed"
+		if releaseErr := h.securityStore.UpdateScanRun(ctx, run); releaseErr != nil {
+			return nil, fiber.NewError(fiber.StatusInternalServerError, "failed to create scan task and release scan admission")
+		}
+		if apierrors.IsAlreadyExists(err) {
+			return nil, fiber.NewError(fiber.StatusConflict, "a security scan is already running for this repository")
+		}
+		return nil, fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to create scan task: %v", err))
+	}
 	if err := h.updateRepositoryScanRunStatus(ctx, scan, scanID, taskName); err != nil {
 		return nil, fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to update repository scan status: %v", err))
 	}
@@ -285,6 +339,11 @@ func (h *Handlers) createSecurityValidationTask(ctx context.Context, ui *UserInf
 	timeout := metav1.Duration{Duration: 90 * time.Minute}
 	priority := int32(725)
 	taskName := security.ScanStageTaskName(scan.Name, "validation", security.StageValidation, finding.ID)
+	resultBinding := security.AgentResultBinding{
+		RepositoryScan: scan.Name,
+		ScanID:         finding.ScanRunID,
+		PolicyDigest:   policy.Digest,
+	}
 
 	task := &corev1alpha1.Task{
 		ObjectMeta: metav1.ObjectMeta{
@@ -302,36 +361,22 @@ func (h *Handlers) createSecurityValidationTask(ctx context.Context, ui *UserInf
 			OwnerReferences: []metav1.OwnerReference{h.ownerRefForRepositoryScan(scan)},
 		},
 		Spec: corev1alpha1.TaskSpec{
-			Type:     corev1alpha1.TaskTypeAgent,
-			AgentRef: &scan.Spec.AnalysisAgentRef,
-			Prompt:   security.BuildValidationPrompt(scan, finding, policy.PromptPolicy()),
-			Timeout:  &timeout,
-			Priority: &priority,
-			Env: []corev1.EnvVar{
-				{Name: security.EnvRepositoryScanName, Value: scan.Name},
-				{Name: security.EnvStage, Value: security.StageValidation},
-				{Name: security.EnvScanID, Value: finding.ScanRunID},
-				{Name: security.EnvPolicyDigest, Value: policy.Digest},
-				{Name: security.EnvPolicyProvenance, Value: security.PolicyProvenanceEnv(policy)},
-				{Name: security.EnvFindingID, Value: finding.ID},
-			},
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      scan.Spec.RepoURL,
-					Branch:       security.EffectiveWorkspaceBranch(scan),
-					Ref:          security.EffectiveRef(scan),
-					GitSecretRef: scan.Spec.GitSecretRef,
-					SubPath:      scan.Spec.SubPath,
-					ForkRepo:     scan.Spec.ForkRepo,
-					PRBaseBranch: scan.Spec.PRBaseBranch,
-				},
-			},
+			Type:      corev1alpha1.TaskTypeAgent,
+			AgentRef:  &scan.Spec.AnalysisAgentRef,
+			Prompt:    security.BuildValidationResultPrompt(scan, finding, resultBinding, policy.PromptPolicy()),
+			Timeout:   &timeout,
+			Priority:  &priority,
+			Workspace: repositoryScanTaskWorkspace(scan, corev1alpha1.WorkspaceIntentRead),
 		},
 	}
-	if scan.Spec.GitSecretRef != nil {
-		if err := authorizeContextTokenGitCredentialSecretForUser(ui, h.contextTokenAuthorization, "createSecurityValidationTaskGitSecret", scan.Namespace, scan.Spec.GitSecretRef.Name); err != nil {
-			return err
-		}
+	if err := authorizeContextTokenRepositoryScanCredentialRefsForUser(
+		ui,
+		h.contextTokenAuthorization,
+		"createSecurityValidationTaskCredential",
+		scan.Namespace,
+		[]repositoryScanCredentialRef{{field: "source-read", ref: repositoryScanReadCredentialRef(scan)}},
+	); err != nil {
+		return err
 	}
 	if err := authorizeAndStampTaskContext(ctx, h.client, h.clientset, contextTokenFromUserInfo(ui), h.contextTokenAuthorization, "createSecurityValidationTask", ui, task); err != nil {
 		return err
@@ -358,6 +403,10 @@ func (h *Handlers) createSecurityPatchTask(ctx context.Context, ui *UserInfo, sc
 	if err := h.ensureSecurityStore(); err != nil {
 		return nil, err
 	}
+	credentialRefs, err := repositoryScanPatchCredentialRefs(scan)
+	if err != nil {
+		return nil, fiber.NewError(fiber.StatusBadRequest, err.Error())
+	}
 
 	agentRef := securityPatchAgentRef(scan)
 
@@ -383,37 +432,22 @@ func (h *Handlers) createSecurityPatchTask(ctx context.Context, ui *UserInfo, sc
 			OwnerReferences: []metav1.OwnerReference{h.ownerRefForRepositoryScan(scan)},
 		},
 		Spec: corev1alpha1.TaskSpec{
-			Type:     corev1alpha1.TaskTypeAgent,
-			AgentRef: &agentRef,
-			Prompt:   security.BuildPatchPrompt(scan, finding, branch),
-			Timeout:  &timeout,
-			Priority: &priority,
-			Env: []corev1.EnvVar{
-				{Name: workerenv.RequirePushBranch, Value: "true"},
-				{Name: security.EnvRepositoryScanName, Value: scan.Name},
-				{Name: security.EnvStage, Value: security.StagePatch},
-				{Name: security.EnvScanID, Value: proposalID},
-				{Name: security.EnvFindingID, Value: finding.ID},
-				{Name: security.EnvPatchBranch, Value: branch},
-			},
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      scan.Spec.RepoURL,
-					Branch:       security.EffectiveWorkspaceBranch(scan),
-					Ref:          security.EffectiveRef(scan),
-					GitSecretRef: scan.Spec.GitSecretRef,
-					SubPath:      scan.Spec.SubPath,
-					ForkRepo:     scan.Spec.ForkRepo,
-					PRBaseBranch: scan.Spec.PRBaseBranch,
-					PushBranch:   branch,
-				},
-			},
+			Type:      corev1alpha1.TaskTypeAgent,
+			AgentRef:  &agentRef,
+			Prompt:    security.BuildPatchPrompt(scan, finding, branch),
+			Timeout:   &timeout,
+			Priority:  &priority,
+			Workspace: repositoryScanPatchTaskWorkspace(scan, branch),
 		},
 	}
-	if scan.Spec.GitSecretRef != nil {
-		if err := authorizeContextTokenGitCredentialSecretForUser(ui, h.contextTokenAuthorization, "createSecurityPatchTaskGitSecret", scan.Namespace, scan.Spec.GitSecretRef.Name); err != nil {
-			return nil, err
-		}
+	if err := authorizeContextTokenRepositoryScanCredentialRefsForUser(
+		ui,
+		h.contextTokenAuthorization,
+		"createSecurityPatchTaskCredential",
+		scan.Namespace,
+		credentialRefs,
+	); err != nil {
+		return nil, err
 	}
 	if err := authorizeAndStampTaskContext(ctx, h.client, h.clientset, contextTokenFromUserInfo(ui), h.contextTokenAuthorization, "createSecurityPatchTask", ui, task); err != nil {
 		return nil, err
@@ -556,10 +590,13 @@ func (h *Handlers) CreateRepositoryScan(c fiber.Ctx) error {
 	if err := h.authorizeContextTokenSecurityScanTask(c, "createRepositoryScan", scan, scan.Spec.AnalysisAgentRef); err != nil {
 		return err
 	}
-	if scan.Spec.GitSecretRef != nil {
-		if err := h.authorizeContextTokenGitCredentialSecretName(c, "createRepositoryScanGitSecret", namespace, scan.Spec.GitSecretRef.Name); err != nil {
-			return err
-		}
+	if err := h.authorizeContextTokenRepositoryScanCredentialRefs(
+		c,
+		"createRepositoryScanCredential",
+		namespace,
+		repositoryScanConfiguredCredentialRefs(scan),
+	); err != nil {
+		return err
 	}
 	if err := h.client.Create(c.Context(), scan); err != nil {
 		if apierrors.IsAlreadyExists(err) {
@@ -611,10 +648,13 @@ func (h *Handlers) UpdateRepositoryScan(c fiber.Ctx) error {
 	if err := h.authorizeContextTokenSecurityScanTask(c, "updateRepositoryScan", updated, updated.Spec.AnalysisAgentRef); err != nil {
 		return err
 	}
-	if updated.Spec.GitSecretRef != nil {
-		if err := h.authorizeContextTokenGitCredentialSecretName(c, "updateRepositoryScanGitSecret", namespace, updated.Spec.GitSecretRef.Name); err != nil {
-			return err
-		}
+	if err := h.authorizeContextTokenRepositoryScanCredentialRefs(
+		c,
+		"updateRepositoryScanCredential",
+		namespace,
+		repositoryScanConfiguredCredentialRefs(updated),
+	); err != nil {
+		return err
 	}
 	if err := h.client.Update(c.Context(), updated); err != nil {
 		return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to update repository scan: %v", err))
@@ -1231,29 +1271,7 @@ func (h *Handlers) authorizeContextTokenSecurityScanTask(c fiber.Ctx, action str
 	return h.handleContextTokenAuthorizationFailures(token, action, failures)
 }
 
-func extractGitToken(secret *corev1.Secret) string {
-	for _, key := range []string{"token", "password", workerenv.GitHubToken} {
-		if value, ok := secret.Data[key]; ok {
-			token := strings.TrimSpace(string(value))
-			if token != "" {
-				return token
-			}
-		}
-	}
-	return ""
-}
-
-var githubPullRequestAPIBaseURL = "https://api.github.com"
-
-func createGitHubPullRequest(ctx context.Context, token, owner, repo, head, base, title, body string) (string, int, string, error) {
-	pr, err := tools.CreateOrGetGitHubPullRequest(ctx, token, owner, repo, head, base, title, body, githubPullRequestAPIBaseURL)
-	if err != nil {
-		return "", 0, "", err
-	}
-	return pr.HTMLURL, pr.Number, pr.Status, nil
-}
-
-// CreateSecurityPullRequest opens a pull request from the latest successful patch proposal.
+// CreateSecurityPullRequest returns the pull request reconciled by the governed patch Task.
 func (h *Handlers) CreateSecurityPullRequest(c fiber.Ctx) error {
 	if err := h.ensureSecurityStore(); err != nil {
 		return err
@@ -1286,69 +1304,18 @@ func (h *Handlers) CreateSecurityPullRequest(c fiber.Ctx) error {
 	}
 	var proposal *store.PatchProposal
 	for i := range proposals {
-		if proposals[i].Status == "succeeded" {
+		if proposals[i].Status == "pr_opened" && proposals[i].PRNumber != nil && proposals[i].PRURL != "" {
 			proposal = &proposals[i]
 			break
 		}
 	}
 	if proposal == nil {
-		return fiber.NewError(fiber.StatusBadRequest, "no successful patch proposal available")
-	}
-	if proposal.Branch == "" {
-		return fiber.NewError(fiber.StatusBadRequest, "patch proposal does not have branch metadata")
-	}
-	if scan.Spec.GitSecretRef == nil {
-		return fiber.NewError(fiber.StatusBadRequest, "repository scan does not have git credentials configured")
-	}
-	if err := h.authorizeContextTokenGitCredentialSecretName(c, "createSecurityPullRequestGitSecret", namespace, scan.Spec.GitSecretRef.Name); err != nil {
-		return err
-	}
-
-	secret := &corev1.Secret{}
-	if err := h.client.Get(c.Context(), types.NamespacedName{Name: scan.Spec.GitSecretRef.Name, Namespace: namespace}, secret); err != nil {
-		return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to get git secret: %v", err))
-	}
-	token := extractGitToken(secret)
-	if token == "" {
-		return fiber.NewError(fiber.StatusBadRequest, "git secret does not contain a GitHub token")
-	}
-
-	owner, repo := security.ParseRepositoryURL(scan.Spec.RepoURL)
-	if owner == "" || repo == "" {
-		return fiber.NewError(fiber.StatusBadRequest, "repository URL must be a GitHub repository")
-	}
-
-	baseBranch := scan.Spec.PRBaseBranch
-	if baseBranch == "" {
-		baseBranch = security.EffectiveBranch(scan)
-	}
-	title := fmt.Sprintf("fix(security): %s", finding.Title)
-	body := fmt.Sprintf("Security remediation for finding `%s`.\n\nSummary:\n%s\n\nRoot cause:\n%s\n\nRemediation guidance:\n%s\n",
-		finding.ID, finding.Summary, finding.RootCause, finding.Remediation)
-
-	prURL, prNumber, prStatus, err := createGitHubPullRequest(c.Context(), token, owner, repo, proposal.Branch, baseBranch, title, body)
-	if err != nil {
-		return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to create pull request: %v", err))
-	}
-
-	proposal.Status = "pr_opened"
-	proposal.PRNumber = &prNumber
-	proposal.PRURL = prURL
-	if err := h.securityStore.UpdatePatchProposal(c.Context(), proposal); err != nil {
-		return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to update patch proposal: %v", err))
-	}
-
-	finding.State = "pr_open"
-	finding.PRNumber = &prNumber
-	finding.PRURL = prURL
-	finding.PatchProposalID = proposal.ID
-	if err := h.securityStore.UpsertFinding(c.Context(), finding); err != nil {
-		return fiber.NewError(fiber.StatusInternalServerError, fmt.Sprintf("failed to update finding: %v", err))
+		return fiber.NewError(fiber.StatusConflict, "governed pull request receipt is not available yet")
 	}
 
 	return c.JSON(fiber.Map{
-		"prNumber": prNumber,
-		"prURL":    prURL,
-		"status":   prStatus,
+		"prNumber": *proposal.PRNumber,
+		"prURL":    proposal.PRURL,
+		"status":   "Open",
 	})
 }
diff --git a/internal/api/security_handlers_test.go b/internal/api/security_handlers_test.go
index 552d2470e..5b885a82d 100644
--- a/internal/api/security_handlers_test.go
+++ b/internal/api/security_handlers_test.go
@@ -9,11 +9,14 @@ package api
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/gofiber/fiber/v3"
 	"github.com/stretchr/testify/require"
@@ -22,6 +25,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
 	"github.com/orka-agents/orka/internal/labels"
@@ -166,7 +170,7 @@ func TestGenerateSecurityPatch_ContextTokenTransactionContextAuthorization(t *te
 		want int
 	}{
 		{
-			name: "matching repo branch and agent allowed",
+			name: "matching repo branch and agent creates governed patch",
 			tctx: map[string]any{
 				"namespace":     "demo",
 				"repo":          repoURL,
@@ -227,10 +231,14 @@ func TestGenerateSecurityPatch_ContextTokenTransactionContextAuthorization(t *te
 					Namespace: "demo",
 				},
 				Spec: corev1alpha1.RepositoryScanSpec{
-					RepoURL:          repoURL,
-					Branch:           "main",
-					AnalysisAgentRef: corev1alpha1.AgentReference{Name: "analysis"},
-					PatchAgentRef:    &patchAgent,
+					RepoURL:                      repoURL,
+					Branch:                       "main",
+					ReadCredentialRef:            &corev1.LocalObjectReference{Name: "source-read"},
+					PublicationReadCredentialRef: &corev1.LocalObjectReference{Name: "target-read"},
+					PublicationCredentialRef:     &corev1.LocalObjectReference{Name: "target-write"},
+					ForgeCredentialRef:           &corev1.LocalObjectReference{Name: "forge"},
+					AnalysisAgentRef:             corev1alpha1.AgentReference{Name: "analysis"},
+					PatchAgentRef:                &patchAgent,
 				},
 			}
 			app, handlers := setupSecurityHandlersWithAuthzFixture(t, ctxTokenConfig, ContextTokenAuthorizationModeEnforce, scan)
@@ -252,7 +260,7 @@ func TestGenerateSecurityPatch_ContextTokenTransactionContextAuthorization(t *te
 			}))
 
 			token := issueTestContextToken(t, provider, nil, map[string]any{
-				"scope": ContextTokenScopeSecurityWrite,
+				"scope": ContextTokenScopeSecurityWrite + " " + ContextTokenScopeSecretsCredentialsRead,
 				"tctx":  tt.tctx,
 			})
 			req := httptest.NewRequest(http.MethodPost, "/security/findings/finding-1/patch?namespace=demo", nil)
@@ -261,21 +269,14 @@ func TestGenerateSecurityPatch_ContextTokenTransactionContextAuthorization(t *te
 			require.NoError(t, err)
 			require.Equal(t, tt.want, resp.StatusCode)
 
-			if tt.want != http.StatusCreated {
-				return
+			if tt.want == http.StatusCreated {
+				var tasks corev1alpha1.TaskList
+				require.NoError(t, handlers.client.List(ctx, &tasks, client.InNamespace("demo")))
+				require.Len(t, tasks.Items, 1)
+				proposals, err := handlers.securityStore.ListPatchProposals(ctx, "demo", "finding-1")
+				require.NoError(t, err)
+				require.Len(t, proposals, 1)
 			}
-			var proposal store.PatchProposal
-			require.NoError(t, json.NewDecoder(resp.Body).Decode(&proposal))
-			require.NotEmpty(t, proposal.TaskName)
-
-			task := &corev1alpha1.Task{}
-			require.NoError(t, handlers.client.Get(ctx, clientObjectKey(proposal.TaskName), task))
-			require.NotNil(t, task.Spec.AgentRef)
-			require.Equal(t, "patch", task.Spec.AgentRef.Name)
-			require.NotNil(t, task.Spec.RequestedBy)
-			require.Equal(t, testContextTokenSubject, task.Spec.RequestedBy.Subject)
-			require.NotNil(t, task.Spec.Transaction)
-			require.Equal(t, testContextTokenTransactionID, task.Spec.Transaction.ID)
 		})
 	}
 }
@@ -409,10 +410,9 @@ func TestCreateManualSecurityScan_ContextTokenAllowsRefOnlyWorkspaceWithBranchAn
 	require.NoError(t, json.NewDecoder(resp.Body).Decode(&run))
 	task := &corev1alpha1.Task{}
 	require.NoError(t, handlers.client.Get(context.Background(), clientObjectKey(run.TaskName), task))
-	require.NotNil(t, task.Spec.AgentRuntime)
-	require.NotNil(t, task.Spec.AgentRuntime.Workspace)
-	require.Empty(t, task.Spec.AgentRuntime.Workspace.Branch)
-	require.Equal(t, "refs/tags/v1.0.0", task.Spec.AgentRuntime.Workspace.Ref)
+	require.NotNil(t, task.Spec.Workspace)
+	require.Empty(t, task.Spec.Workspace.Branch)
+	require.Equal(t, "refs/tags/v1.0.0", task.Spec.Workspace.Ref)
 }
 
 func TestRepositoryScanMutations_ContextTokenTransactionContextAuthorizationDenials(t *testing.T) {
@@ -1293,40 +1293,144 @@ func TestCreateManualSecurityScan_ContextTokenStampsTaskRequesterAndTransaction(
 	require.Equal(t, testContextTokenTransactionID, task.Spec.Transaction.ID)
 	require.Equal(t, labels.SelectorValue(testContextTokenTransactionID), task.Labels[labels.LabelTransactionID])
 	require.Equal(t, testContextTokenTransactionID, task.Annotations[labels.AnnotationTransactionID])
-	require.Equal(t, security.StageThreatModel, envValue(task.Spec.Env, security.EnvStage))
-	require.Equal(t, "scan-1", envValue(task.Spec.Env, security.EnvRepositoryScanName))
-	require.NotNil(t, task.Spec.AgentRuntime)
-	require.NotNil(t, task.Spec.AgentRuntime.Workspace)
-	require.Empty(t, task.Spec.AgentRuntime.Workspace.Branch)
-	require.Equal(t, "refs/tags/v1.0.0", task.Spec.AgentRuntime.Workspace.Ref)
+	require.Empty(t, task.Spec.Env)
+	require.Contains(t, task.Spec.Prompt, `"kind":"`+security.AgentResultKindThreatModel+`"`)
+	require.Contains(t, task.Spec.Prompt, `"repositoryScan":"scan-1"`)
+	require.Contains(t, task.Spec.Prompt, `"scanId":"`+run.ID+`"`)
+	require.Contains(t, task.Spec.Prompt, `"policyDigest":"`+run.PolicyDigest+`"`)
+	require.NotNil(t, task.Spec.Workspace)
+	require.Empty(t, task.Spec.Workspace.Branch)
+	require.Equal(t, "refs/tags/v1.0.0", task.Spec.Workspace.Ref)
 }
 
-func TestCreateSecurityPullRequest_ExistingPR(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch r.Method {
-		case http.MethodPost:
-			w.WriteHeader(http.StatusUnprocessableEntity)
-			fmt.Fprint(w, `{"message":"Validation Failed","errors":[{"message":"A pull request already exists for sozercan:orka/security/fnd-123."}]}`) //nolint:errcheck
-		case http.MethodGet:
-			require.Equal(t, "sozercan:orka/security/fnd-123", r.URL.Query().Get("head"))
-			require.Equal(t, "main", r.URL.Query().Get("base"))
-			w.WriteHeader(http.StatusOK)
-			fmt.Fprintf(w, `[{"html_url":%q,"number":99}]`, securityTestRepoPRURL) //nolint:errcheck
+func TestCreateManualSecurityScanConcurrentRequestsReturnCreatedAndConflict(t *testing.T) {
+	provider := newTestOIDCProvider(t)
+	ctxTokenConfig := testContextTokenConfig(t, provider, "")
+	scan := &corev1alpha1.RepositoryScan{
+		ObjectMeta: metav1.ObjectMeta{Name: "scan-concurrent", Namespace: "demo"},
+		Spec: corev1alpha1.RepositoryScanSpec{
+			RepoURL:          securityTestRepoURL,
+			Branch:           "main",
+			AnalysisAgentRef: corev1alpha1.AgentReference{Name: "analysis"},
+		},
+	}
+	app, handlers := setupSecurityHandlersWithAuthzFixture(t, ctxTokenConfig, ContextTokenAuthorizationModeEnforce, scan)
+	token := issueTestContextToken(t, provider, nil, map[string]any{"scope": ContextTokenScopeSecurityWrite})
+
+	type response struct {
+		status int
+		body   string
+		err    error
+	}
+	start := make(chan struct{})
+	responses := make(chan response, 2)
+	for range 2 {
+		go func() {
+			<-start
+			req := httptest.NewRequest(http.MethodPost, "/security/repositories/scan-concurrent/scans?namespace=demo", nil)
+			req.Header.Set(TransactionTokenHeaderName, token)
+			resp, err := app.Test(req)
+			if err != nil {
+				responses <- response{err: err}
+				return
+			}
+			body, readErr := io.ReadAll(resp.Body)
+			_ = resp.Body.Close()
+			responses <- response{status: resp.StatusCode, body: string(body), err: readErr}
+		}()
+	}
+	close(start)
+
+	created := 0
+	conflicts := 0
+	for range 2 {
+		result := <-responses
+		require.NoError(t, result.err)
+		switch result.status {
+		case http.StatusCreated:
+			created++
+		case http.StatusConflict:
+			conflicts++
+			require.Contains(t, result.body, "a security scan is already running for this repository")
 		default:
-			t.Fatalf("unexpected method: %s", r.Method)
+			t.Fatalf("concurrent scan status = %d body=%q", result.status, result.body)
 		}
-	}))
-	defer server.Close()
+	}
+	require.Equal(t, 1, created)
+	require.Equal(t, 1, conflicts)
+
+	var tasks corev1alpha1.TaskList
+	require.NoError(t, handlers.client.List(context.Background(), &tasks, client.InNamespace("demo")))
+	require.Len(t, tasks.Items, 1)
+	runs, _, err := handlers.securityStore.ListScanRuns(context.Background(), "demo", "scan-concurrent", 10, "")
+	require.NoError(t, err)
+	require.Len(t, runs, 1)
+	require.Equal(t, "pending", runs[0].Phase)
+}
 
-	previousBaseURL := githubPullRequestAPIBaseURL
-	githubPullRequestAPIBaseURL = server.URL
-	t.Cleanup(func() {
-		githubPullRequestAPIBaseURL = previousBaseURL
+func TestCreateManualSecurityScanReleasesAdmissionWhenTaskCreationFails(t *testing.T) {
+	provider := newTestOIDCProvider(t)
+	ctxTokenConfig := testContextTokenConfig(t, provider, "")
+	scan := &corev1alpha1.RepositoryScan{
+		ObjectMeta: metav1.ObjectMeta{Name: "scan-create-failure", Namespace: "demo"},
+		Spec: corev1alpha1.RepositoryScanSpec{
+			RepoURL:          securityTestRepoURL,
+			Branch:           "main",
+			AnalysisAgentRef: corev1alpha1.AgentReference{Name: "analysis"},
+		},
+	}
+	app, handlers := setupSecurityHandlersWithAuthzFixture(t, ctxTokenConfig, ContextTokenAuthorizationModeEnforce, scan)
+	baseClient := handlers.client
+	baseWithWatch, ok := baseClient.(client.WithWatch)
+	require.True(t, ok)
+	handlers.client = interceptor.NewClient(baseWithWatch, interceptor.Funcs{
+		Create: func(ctx context.Context, c client.WithWatch, obj client.Object, opts ...client.CreateOption) error {
+			if _, ok := obj.(*corev1alpha1.Task); ok {
+				return errors.New("injected task create failure")
+			}
+			return c.Create(ctx, obj, opts...)
+		},
 	})
+	token := issueTestContextToken(t, provider, nil, map[string]any{"scope": ContextTokenScopeSecurityWrite})
+	req := httptest.NewRequest(http.MethodPost, "/security/repositories/scan-create-failure/scans?namespace=demo", nil)
+	req.Header.Set(TransactionTokenHeaderName, token)
+	resp, err := app.Test(req)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusInternalServerError, resp.StatusCode)
+
+	ctx := context.Background()
+	runs, _, err := handlers.securityStore.ListScanRuns(ctx, "demo", scan.Name, 10, "")
+	require.NoError(t, err)
+	require.Len(t, runs, 1)
+	require.Equal(t, "failed", runs[0].Phase)
+	require.NotNil(t, runs[0].CompletedAt)
+	require.Equal(t, "scan task creation failed", runs[0].ErrorMessage)
+	var tasks corev1alpha1.TaskList
+	require.NoError(t, baseClient.List(ctx, &tasks, client.InNamespace("demo")))
+	require.Empty(t, tasks.Items)
+
+	require.NoError(t, handlers.securityStore.CreateScanRun(ctx, &store.ScanRun{
+		ID:             "scan-create-failure-retry",
+		Namespace:      "demo",
+		RepositoryScan: scan.Name,
+		TaskName:       "scan-create-failure-retry-task",
+		Mode:           "manual",
+		Phase:          "pending",
+		IdempotencyKey: "scanidem:create-failure-retry",
+		StartedAt:      time.Now(),
+	}))
+}
+
+func TestCreateSecurityPullRequestReturnsGovernedReceiptWithoutGitHubMutation(t *testing.T) {
+	githubCalled := false
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		githubCalled = true
+		t.Fatalf("receipt lookup must not call the repository forge: %s %s", r.Method, r.URL.Path)
+	}))
+	defer server.Close()
 
 	scheme := runtime.NewScheme()
 	require.NoError(t, corev1alpha1.AddToScheme(scheme))
-	require.NoError(t, corev1.AddToScheme(scheme))
 
 	scan := &corev1alpha1.RepositoryScan{
 		ObjectMeta: metav1.ObjectMeta{
@@ -1334,25 +1438,12 @@ func TestCreateSecurityPullRequest_ExistingPR(t *testing.T) {
 			Namespace: "demo",
 		},
 		Spec: corev1alpha1.RepositoryScanSpec{
-			RepoURL: securityTestRepoURL,
+			RepoURL: server.URL,
 			Branch:  "main",
-			GitSecretRef: &corev1.LocalObjectReference{
-				Name: "git-creds",
-			},
-		},
-	}
-
-	secret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "git-creds",
-			Namespace: "demo",
-		},
-		Data: map[string][]byte{
-			"token": []byte("test-token"),
 		},
 	}
 
-	fakeClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(scan, secret).Build()
+	fakeClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(scan).Build()
 	db, err := sqlite.NewDB(":memory:")
 	require.NoError(t, err)
 	securityStore := sqlite.NewStore(db, ":memory:")
@@ -1363,6 +1454,8 @@ func TestCreateSecurityPullRequest_ExistingPR(t *testing.T) {
 	})
 
 	ctx := context.Background()
+	prNumber := 99
+	prURL := server.URL + "/pull/99"
 	require.NoError(t, securityStore.UpsertFinding(ctx, &store.Finding{
 		ID:             "finding-1",
 		Namespace:      "demo",
@@ -1373,9 +1466,11 @@ func TestCreateSecurityPullRequest_ExistingPR(t *testing.T) {
 		Summary:        "Unsanitized user input reaches shell execution.",
 		Severity:       "critical",
 		Confidence:     "high",
-		State:          "validated",
+		State:          "pr_open",
 		RootCause:      "Shell command arguments are concatenated directly.",
 		Remediation:    "Use argument arrays and validate inputs.",
+		PRNumber:       &prNumber,
+		PRURL:          prURL,
 	}))
 	require.NoError(t, securityStore.CreatePatchProposal(ctx, &store.PatchProposal{
 		ID:             "patch-1",
@@ -1384,7 +1479,9 @@ func TestCreateSecurityPullRequest_ExistingPR(t *testing.T) {
 		FindingID:      "finding-1",
 		TaskName:       "patch-task-1",
 		Branch:         "orka/security/fnd-123",
-		Status:         "succeeded",
+		Status:         "pr_opened",
+		PRNumber:       &prNumber,
+		PRURL:          prURL,
 	}))
 
 	app := fiber.New()
@@ -1394,34 +1491,32 @@ func TestCreateSecurityPullRequest_ExistingPR(t *testing.T) {
 	resp, err := app.Test(req)
 	require.NoError(t, err)
 	require.Equal(t, http.StatusOK, resp.StatusCode)
-
-	var result struct {
+	var body struct {
 		PRNumber int    `json:"prNumber"`
 		PRURL    string `json:"prURL"`
 		Status   string `json:"status"`
 	}
-	require.NoError(t, json.NewDecoder(resp.Body).Decode(&result))
-	require.Equal(t, 99, result.PRNumber)
-	require.Equal(t, securityTestRepoPRURL, result.PRURL)
-	require.Equal(t, "existing", result.Status)
+	require.NoError(t, json.NewDecoder(resp.Body).Decode(&body))
+	require.Equal(t, prNumber, body.PRNumber)
+	require.Equal(t, prURL, body.PRURL)
+	require.Equal(t, "Open", body.Status)
+	require.False(t, githubCalled)
 
 	proposals, err := securityStore.ListPatchProposals(ctx, "demo", "finding-1")
 	require.NoError(t, err)
 	require.Len(t, proposals, 1)
 	require.Equal(t, "pr_opened", proposals[0].Status)
-	require.Equal(t, securityTestRepoPRURL, proposals[0].PRURL)
-	require.NotNil(t, proposals[0].PRNumber)
-	require.Equal(t, 99, *proposals[0].PRNumber)
+	require.Equal(t, prURL, proposals[0].PRURL)
+	require.Equal(t, prNumber, *proposals[0].PRNumber)
 
 	finding, err := securityStore.GetFinding(ctx, "demo", "finding-1")
 	require.NoError(t, err)
 	require.Equal(t, "pr_open", finding.State)
-	require.Equal(t, securityTestRepoPRURL, finding.PRURL)
-	require.NotNil(t, finding.PRNumber)
-	require.Equal(t, 99, *finding.PRNumber)
+	require.Equal(t, prURL, finding.PRURL)
+	require.Equal(t, prNumber, *finding.PRNumber)
 }
 
-func TestCreateSecurityPatchTaskRequiresPushedBranch(t *testing.T) {
+func TestCreateSecurityPatchTaskRequestsGovernedPublication(t *testing.T) {
 	scheme := runtime.NewScheme()
 	require.NoError(t, corev1alpha1.AddToScheme(scheme))
 
@@ -1431,17 +1526,21 @@ func TestCreateSecurityPatchTaskRequiresPushedBranch(t *testing.T) {
 			Namespace: "demo",
 		},
 		Spec: corev1alpha1.RepositoryScanSpec{
-			RepoURL: securityTestRepoURL,
-			Ref:     "f00dbabe",
-			GitSecretRef: &corev1.LocalObjectReference{
-				Name: "git-creds",
-			},
-			AnalysisAgentRef: corev1alpha1.AgentReference{Name: "analysis"},
-			PatchAgentRef:    &corev1alpha1.AgentReference{Name: "patch"},
+			RepoURL:                      securityTestRepoURL,
+			ForkRepo:                     securityTestRepoURL,
+			Branch:                       "main",
+			Ref:                          "f00dbabe",
+			PRBaseBranch:                 "main",
+			ReadCredentialRef:            &corev1.LocalObjectReference{Name: "source-read"},
+			PublicationReadCredentialRef: &corev1.LocalObjectReference{Name: "target-read"},
+			PublicationCredentialRef:     &corev1.LocalObjectReference{Name: "target-write"},
+			ForgeCredentialRef:           &corev1.LocalObjectReference{Name: "forge"},
+			AnalysisAgentRef:             corev1alpha1.AgentReference{Name: "analysis"},
+			PatchAgentRef:                &corev1alpha1.AgentReference{Name: "patch"},
 		},
 	}
 
-	fakeClient := fake.NewClientBuilder().WithScheme(scheme).Build()
+	fakeClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(scan).Build()
 	db, err := sqlite.NewDB(":memory:")
 	require.NoError(t, err)
 	securityStore := sqlite.NewStore(db, ":memory:")
@@ -1461,31 +1560,81 @@ func TestCreateSecurityPatchTaskRequiresPushedBranch(t *testing.T) {
 
 	proposal, err := handlers.createSecurityPatchTask(context.Background(), nil, scan, finding)
 	require.NoError(t, err)
-	require.Regexp(t, `^orka/security/fnd-123-[a-f0-9]{12}$`, proposal.Branch)
+	require.NotNil(t, proposal)
+	require.Equal(t, "pending", proposal.Status)
+	require.NotEmpty(t, proposal.Branch)
+
+	var tasks corev1alpha1.TaskList
+	require.NoError(t, fakeClient.List(context.Background(), &tasks, client.InNamespace("demo")))
+	require.Len(t, tasks.Items, 1)
+	task := tasks.Items[0]
+	require.Equal(t, proposal.TaskName, task.Name)
+	require.Equal(t, corev1alpha1.TaskTypeAgent, task.Spec.Type)
+	require.Equal(t, "patch", task.Spec.AgentRef.Name)
+	require.Empty(t, task.Spec.Env)
+	require.Contains(t, task.Spec.Prompt, proposal.Branch)
+	require.NotNil(t, task.Spec.Workspace)
+	workspace := task.Spec.Workspace
+	require.Equal(t, corev1alpha1.WorkspaceIntentWrite, workspace.Intent)
+	require.Equal(t, securityTestRepoURL, workspace.GitRepo)
+	require.Equal(t, securityTestRepoURL, workspace.PublicationGitRepo)
+	require.Equal(t, "main", workspace.Branch)
+	require.Equal(t, "f00dbabe", workspace.Ref)
+	require.Equal(t, proposal.Branch, workspace.PushBranch)
+	require.Equal(t, "main", workspace.PRBaseBranch)
+	require.True(t, workspace.CreatePR)
+	for name, tc := range map[string]struct {
+		ref  *corev1alpha1.WorkspaceCredentialReference
+		want string
+	}{
+		"read":             {ref: workspace.ReadCredentialRef, want: "source-read"},
+		"publication read": {ref: workspace.PublicationReadCredentialRef, want: "target-read"},
+		"publication":      {ref: workspace.PublicationCredentialRef, want: "target-write"},
+		"forge":            {ref: workspace.ForgeCredentialRef, want: "forge"},
+	} {
+		require.NotNil(t, tc.ref, name)
+		require.Equal(t, tc.want, tc.ref.Name, name)
+	}
+	proposals, err := securityStore.ListPatchProposals(context.Background(), "demo", finding.ID)
+	require.NoError(t, err)
+	require.Len(t, proposals, 1)
+	require.Equal(t, proposal.ID, proposals[0].ID)
+	require.Equal(t, proposal.Branch, proposals[0].Branch)
+}
 
-	task := &corev1alpha1.Task{}
-	require.NoError(t, fakeClient.Get(context.Background(), clientObjectKey(proposal.TaskName), task))
-	require.Equal(t, "true", envValue(task.Spec.Env, "ORKA_REQUIRE_PUSH_BRANCH"))
-	require.NotNil(t, task.Spec.AgentRuntime)
-	require.NotNil(t, task.Spec.AgentRuntime.Workspace)
-	require.Equal(t, security.StagePatch, envValue(task.Spec.Env, security.EnvStage))
-	require.Equal(t, "scan-1", envValue(task.Spec.Env, security.EnvRepositoryScanName))
-	require.Equal(t, "fnd_123", envValue(task.Spec.Env, security.EnvFindingID))
-	require.Equal(t, proposal.Branch, envValue(task.Spec.Env, security.EnvPatchBranch))
-	require.Empty(t, task.Spec.AgentRuntime.Workspace.Branch)
-	require.Equal(t, "f00dbabe", task.Spec.AgentRuntime.Workspace.Ref)
-	require.Equal(t, proposal.Branch, task.Spec.AgentRuntime.Workspace.PushBranch)
+func TestCreateSecurityPatchTaskRejectsLegacyCredentialReuse(t *testing.T) {
+	scheme := runtime.NewScheme()
+	require.NoError(t, corev1alpha1.AddToScheme(scheme))
+	scan := &corev1alpha1.RepositoryScan{
+		ObjectMeta: metav1.ObjectMeta{Name: "scan-legacy", Namespace: "demo"},
+		Spec: corev1alpha1.RepositoryScanSpec{
+			RepoURL:          securityTestRepoURL,
+			GitSecretRef:     &corev1.LocalObjectReference{Name: "legacy-all-powerful"},
+			AnalysisAgentRef: corev1alpha1.AgentReference{Name: "analysis"},
+		},
+	}
+	fakeClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(scan).Build()
+	db, err := sqlite.NewDB(":memory:")
+	require.NoError(t, err)
+	securityStore := sqlite.NewStore(db, ":memory:")
+	handlers := NewHandlers(HandlersConfig{Client: fakeClient, SecurityStore: securityStore})
+	finding := &store.Finding{ID: "fnd_legacy", Namespace: "demo", Title: "Legacy authority reuse"}
+
+	proposal, err := handlers.createSecurityPatchTask(context.Background(), nil, scan, finding)
+	require.Nil(t, proposal)
+	var fiberErr *fiber.Error
+	require.ErrorAs(t, err, &fiberErr)
+	require.Equal(t, http.StatusBadRequest, fiberErr.Code)
+	require.Contains(t, fiberErr.Message, "spec.readCredentialRef is required")
+
+	var tasks corev1alpha1.TaskList
+	require.NoError(t, fakeClient.List(context.Background(), &tasks, client.InNamespace("demo")))
+	require.Empty(t, tasks.Items)
+	proposals, err := securityStore.ListPatchProposals(context.Background(), "demo", finding.ID)
+	require.NoError(t, err)
+	require.Empty(t, proposals)
 }
 
 func clientObjectKey(name string) client.ObjectKey {
 	return client.ObjectKey{Namespace: "demo", Name: name}
 }
-
-func envValue(envs []corev1.EnvVar, name string) string {
-	for _, env := range envs {
-		if env.Name == name {
-			return env.Value
-		}
-	}
-	return ""
-}
diff --git a/internal/api/server.go b/internal/api/server.go
index cd54471fe..4631dd7e7 100644
--- a/internal/api/server.go
+++ b/internal/api/server.go
@@ -23,7 +23,9 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 
+	"github.com/orka-agents/orka/internal/artifactcap"
 	"github.com/orka-agents/orka/internal/controller"
+	"github.com/orka-agents/orka/internal/executionmode"
 	gatewayruntime "github.com/orka-agents/orka/internal/gateway"
 	"github.com/orka-agents/orka/internal/gateway/protocol"
 	"github.com/orka-agents/orka/internal/store"
@@ -37,6 +39,7 @@ type ServerConfig struct {
 	Port                      int
 	MetricsPort               int
 	WatchNamespace            string
+	ExecutionMode             executionmode.Mode
 	EnforceNamespaceIsolation bool
 	OIDC                      OIDCConfig
 	ContextTokens             ContextTokenConfig
@@ -47,6 +50,7 @@ type ServerConfig struct {
 	PlanStore                 store.PlanStore
 	MessageStore              store.MessageStore
 	ArtifactStore             store.ArtifactStore
+	ArtifactReservations      artifactcap.CapabilityReservationRecorder
 	MemoryStore               store.MemoryStore
 	MemoryProposalStore       store.MemoryProposalStore
 	SecurityStore             store.SecurityStore
@@ -88,10 +92,12 @@ type Server struct {
 
 // NewServer creates a new API server
 func NewServer(c client.Client, sessionManager *controller.SessionManager, config ServerConfig) *Server {
+	config.Chat.ExecutionMode = config.ExecutionMode
 	app := fiber.New(fiber.Config{
-		AppName:      "Orka API",
-		BodyLimit:    15 << 20, // 15MB — allows artifact uploads up to 10MB + overhead
-		ErrorHandler: customErrorHandler,
+		AppName:           "Orka API",
+		BodyLimit:         defaultAPIRequestBodyLimit,
+		StreamRequestBody: true,
+		ErrorHandler:      customErrorHandler,
 	})
 	app.Server().HeaderReceived = requestBodyConfig
 
@@ -119,10 +125,12 @@ func NewServer(c client.Client, sessionManager *controller.SessionManager, confi
 		Client:                    c,
 		APIReader:                 config.APIReader,
 		WatchNamespace:            config.WatchNamespace,
+		ExecutionMode:             config.ExecutionMode,
 		EnforceNamespaceIsolation: config.EnforceNamespaceIsolation,
 		ContextTokenAuthorization: config.ContextTokenAuthorization,
 		ResultStore:               config.ResultStore,
 		SessionStore:              config.SessionStore,
+		SessionManager:            sessionManager,
 		PlanStore:                 config.PlanStore,
 		KubeClient:                config.Clientset,
 		HealthChecker:             config.HealthChecker,
@@ -146,7 +154,6 @@ func NewServer(c client.Client, sessionManager *controller.SessionManager, confi
 	server.setupMiddleware()
 	server.setupRoutes()
 	server.setupStaticFiles()
-
 	return server
 }
 
@@ -198,6 +205,7 @@ func (s *Server) setupMiddleware() {
 
 	// Metrics middleware
 	s.app.Use(NewMetricsMiddleware())
+
 }
 
 func allowedCORSHeaders(contextTokens ContextTokenConfig) []string {
@@ -224,6 +232,12 @@ func allowedCORSHeaders(contextTokens ContextTokenConfig) []string {
 
 // setupRoutes configures the API routes
 func (s *Server) setupRoutes() {
+	// The ACP artifact transport must be installed before other routes so large
+	// capability-bound uploads remain streamed while ordinary API bodies retain
+	// the historical bounded request limit.
+	s.installACPArtifactTransport()
+	s.installACPArtifactAuthorizationBroker()
+
 	// Health endpoints
 	s.app.Get("/healthz", s.handlers.Healthz)
 	s.app.Get("/readyz", s.handlers.Readyz)
@@ -309,6 +323,15 @@ func (s *Server) setupRoutes() {
 	api.Put("/tools/:name", s.handlers.UpdateTool)
 	api.Delete("/tools/:name", s.handlers.DeleteTool)
 
+	// Runtime fabric endpoints
+	api.Get("/runtime-pools", s.handlers.ListRuntimePools)
+	api.Get("/runtime-pools/:name", s.handlers.GetRuntimePool)
+	api.Get("/agent-runtimes", s.handlers.ListAgentRuntimes)
+	api.Post("/agent-runtimes", s.handlers.CreateAgentRuntime)
+	api.Get("/agent-runtimes/:name", s.handlers.GetAgentRuntime)
+	api.Put("/agent-runtimes/:name", s.handlers.UpdateAgentRuntime)
+	api.Delete("/agent-runtimes/:name", s.handlers.DeleteAgentRuntime)
+
 	// Agent endpoints
 	api.Post("/agents", s.handlers.CreateAgent)
 	api.Get("/agents", s.handlers.ListAgents)
@@ -403,7 +426,8 @@ func (s *Server) setupRoutes() {
 	anthropic.Post("/messages", s.anthropicHandler.HandleMessages)
 	anthropic.Get("/models", s.anthropicHandler.HandleListModels)
 
-	// Internal API for worker communication
+	// Internal API for worker communication. Harness v1 retirement is served
+	// only by the dedicated audience-bound TLS listener configured below.
 	if s.hasInternalStores() {
 		s.internalHandlers = NewInternalHandlers(
 			s.ResultStore,
@@ -471,7 +495,6 @@ func (s *Server) Start(ctx context.Context) error {
 			errCh <- err
 		}
 	}()
-
 	// Wait for shutdown signal or error
 	select {
 	case <-ctx.Done():
diff --git a/internal/api/server_test.go b/internal/api/server_test.go
index 33cf96ef0..5d84a1d0f 100644
--- a/internal/api/server_test.go
+++ b/internal/api/server_test.go
@@ -19,6 +19,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/executionmode"
 	"github.com/orka-agents/orka/internal/store/sqlite"
 )
 
@@ -36,6 +37,7 @@ func TestNewServer(t *testing.T) {
 		Port:           8080,
 		MetricsPort:    9090,
 		WatchNamespace: "default",
+		ExecutionMode:  executionmode.HarnessV1,
 	}
 
 	server := NewServer(fakeClient, nil, config)
@@ -52,6 +54,11 @@ func TestNewServer(t *testing.T) {
 	if server.config.Port != 8080 {
 		t.Errorf("Port = %d, want 8080", server.config.Port)
 	}
+	if server.config.Chat.ExecutionMode != executionmode.HarnessV1 ||
+		server.handlers.executionMode != executionmode.HarnessV1 ||
+		server.chatHandler.config.ExecutionMode != executionmode.HarnessV1 {
+		t.Fatal("execution mode was not propagated to every Agent producer")
+	}
 }
 
 func TestServer_HealthEndpoints(t *testing.T) {
diff --git a/internal/api/static.go b/internal/api/static.go
index 1cf81162f..ed1c6861a 100644
--- a/internal/api/static.go
+++ b/internal/api/static.go
@@ -63,6 +63,8 @@ func (s *Server) setupStaticFiles() {
 	s.app.Get("/sessions/*", serveIndex)
 	s.app.Get("/agents", serveIndex)
 	s.app.Get("/agents/*", serveIndex)
+	s.app.Get("/runtimes", serveIndex)
+	s.app.Get("/runtimes/*", serveIndex)
 	s.app.Get("/tools", serveIndex)
 	s.app.Get("/tools/*", serveIndex)
 }
diff --git a/internal/api/task_workspace.go b/internal/api/task_workspace.go
new file mode 100644
index 000000000..7a586ee1d
--- /dev/null
+++ b/internal/api/task_workspace.go
@@ -0,0 +1,114 @@
+package api
+
+import (
+	"fmt"
+	"strings"
+
+	corev1 "k8s.io/api/core/v1"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/security"
+)
+
+type repositoryScanCredentialRef struct {
+	field string
+	ref   *corev1.LocalObjectReference
+}
+
+func taskWorkspaceCredentialReference(ref *corev1.LocalObjectReference) *corev1alpha1.WorkspaceCredentialReference {
+	if ref == nil || strings.TrimSpace(ref.Name) == "" {
+		return nil
+	}
+	return &corev1alpha1.WorkspaceCredentialReference{Name: strings.TrimSpace(ref.Name)}
+}
+
+func repositoryScanReadCredentialRef(scan *corev1alpha1.RepositoryScan) *corev1.LocalObjectReference {
+	if scan == nil {
+		return nil
+	}
+	if scan.Spec.ReadCredentialRef != nil && strings.TrimSpace(scan.Spec.ReadCredentialRef.Name) != "" {
+		return scan.Spec.ReadCredentialRef
+	}
+	return scan.Spec.GitSecretRef
+}
+
+func repositoryScanConfiguredCredentialRefs(scan *corev1alpha1.RepositoryScan) []repositoryScanCredentialRef {
+	if scan == nil {
+		return nil
+	}
+	return []repositoryScanCredentialRef{
+		{field: "spec.gitSecretRef", ref: scan.Spec.GitSecretRef},
+		{field: "spec.readCredentialRef", ref: scan.Spec.ReadCredentialRef},
+		{field: "spec.publicationReadCredentialRef", ref: scan.Spec.PublicationReadCredentialRef},
+		{field: "spec.publicationCredentialRef", ref: scan.Spec.PublicationCredentialRef},
+		{field: "spec.forgeCredentialRef", ref: scan.Spec.ForgeCredentialRef},
+	}
+}
+
+func repositoryScanPatchCredentialRefs(scan *corev1alpha1.RepositoryScan) ([]repositoryScanCredentialRef, error) {
+	if scan == nil {
+		return nil, fmt.Errorf("repository scan is required")
+	}
+	refs := []repositoryScanCredentialRef{
+		{field: "spec.readCredentialRef", ref: scan.Spec.ReadCredentialRef},
+		{field: "spec.publicationReadCredentialRef", ref: scan.Spec.PublicationReadCredentialRef},
+		{field: "spec.publicationCredentialRef", ref: scan.Spec.PublicationCredentialRef},
+		{field: "spec.forgeCredentialRef", ref: scan.Spec.ForgeCredentialRef},
+	}
+	seen := make(map[string]string, len(refs))
+	for _, credential := range refs {
+		name := ""
+		if credential.ref != nil {
+			name = strings.TrimSpace(credential.ref.Name)
+		}
+		if name == "" {
+			return nil, fmt.Errorf("%s is required for repository scan patch publication", credential.field)
+		}
+		if previous := seen[name]; previous != "" {
+			return nil, fmt.Errorf("%s and %s must reference distinct Secrets", previous, credential.field)
+		}
+		seen[name] = credential.field
+	}
+	return refs, nil
+}
+
+func repositoryScanTaskWorkspace(scan *corev1alpha1.RepositoryScan, intent corev1alpha1.WorkspaceIntent) *corev1alpha1.WorkspaceConfig {
+	if scan == nil {
+		return nil
+	}
+	workspace := &corev1alpha1.WorkspaceConfig{
+		Intent: intent,
+		// The ACP workspace preflight admits only credential-free HTTPS URLs,
+		// so accepted GitHub-style SSH roots are canonicalized here.
+		GitRepo:           security.CanonicalRepositoryCloneURL(scan.Spec.RepoURL),
+		Branch:            security.EffectiveWorkspaceBranch(scan),
+		Ref:               security.EffectiveRef(scan),
+		ReadCredentialRef: taskWorkspaceCredentialReference(repositoryScanReadCredentialRef(scan)),
+		SubPath:           scan.Spec.SubPath,
+	}
+	if intent == corev1alpha1.WorkspaceIntentWrite {
+		// prBaseBranch is a publication field: the ACP workspace preflight
+		// rejects it on non-write intents.
+		workspace.PRBaseBranch = scan.Spec.PRBaseBranch
+		workspace.PublicationGitRepo = security.CanonicalRepositoryCloneURL(scan.Spec.ForkRepo)
+		if workspace.PublicationGitRepo == "" {
+			workspace.PublicationGitRepo = workspace.GitRepo
+		}
+		if strings.TrimSpace(workspace.PRBaseBranch) == "" {
+			workspace.PRBaseBranch = security.EffectiveBranch(scan)
+		}
+		workspace.PublicationReadCredentialRef = taskWorkspaceCredentialReference(scan.Spec.PublicationReadCredentialRef)
+		workspace.PublicationCredentialRef = taskWorkspaceCredentialReference(scan.Spec.PublicationCredentialRef)
+		workspace.ForgeCredentialRef = taskWorkspaceCredentialReference(scan.Spec.ForgeCredentialRef)
+		workspace.CreatePR = true
+	}
+	return workspace
+}
+
+func repositoryScanPatchTaskWorkspace(scan *corev1alpha1.RepositoryScan, branch string) *corev1alpha1.WorkspaceConfig {
+	workspace := repositoryScanTaskWorkspace(scan, corev1alpha1.WorkspaceIntentWrite)
+	if workspace != nil {
+		workspace.PushBranch = strings.TrimSpace(branch)
+	}
+	return workspace
+}
diff --git a/internal/api/task_workspace_test.go b/internal/api/task_workspace_test.go
new file mode 100644
index 000000000..fcb2dac1c
--- /dev/null
+++ b/internal/api/task_workspace_test.go
@@ -0,0 +1,112 @@
+package api
+
+import (
+	"strings"
+	"testing"
+
+	corev1 "k8s.io/api/core/v1"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+)
+
+func TestRepositoryScanPatchTaskWorkspaceBindsRoleSeparatedCredentials(t *testing.T) {
+	scan := &corev1alpha1.RepositoryScan{
+		Spec: corev1alpha1.RepositoryScanSpec{
+			RepoURL:                      "https://github.com/example/source.git",
+			ForkRepo:                     "https://github.com/example/fork.git",
+			GitSecretRef:                 &corev1.LocalObjectReference{Name: "legacy-read"},
+			ReadCredentialRef:            &corev1.LocalObjectReference{Name: "source-read"},
+			PublicationReadCredentialRef: &corev1.LocalObjectReference{Name: "target-read"},
+			PublicationCredentialRef:     &corev1.LocalObjectReference{Name: "target-write"},
+			ForgeCredentialRef:           &corev1.LocalObjectReference{Name: "forge"},
+		},
+	}
+
+	workspace := repositoryScanPatchTaskWorkspace(scan, "orka/fix")
+	if workspace == nil {
+		t.Fatal("repositoryScanPatchTaskWorkspace() returned nil")
+	}
+	if workspace.ReadCredentialRef == nil || workspace.ReadCredentialRef.Name != "source-read" {
+		t.Fatalf("readCredentialRef = %#v, want source-read", workspace.ReadCredentialRef)
+	}
+	if workspace.PublicationReadCredentialRef == nil || workspace.PublicationReadCredentialRef.Name != "target-read" {
+		t.Fatalf("publicationReadCredentialRef = %#v, want target-read", workspace.PublicationReadCredentialRef)
+	}
+	if workspace.PublicationCredentialRef == nil || workspace.PublicationCredentialRef.Name != "target-write" {
+		t.Fatalf("publicationCredentialRef = %#v, want target-write", workspace.PublicationCredentialRef)
+	}
+	if workspace.ForgeCredentialRef == nil || workspace.ForgeCredentialRef.Name != "forge" {
+		t.Fatalf("forgeCredentialRef = %#v, want forge", workspace.ForgeCredentialRef)
+	}
+	if !workspace.CreatePR {
+		t.Fatal("createPR = false, want true")
+	}
+	if workspace.PRBaseBranch != "main" {
+		t.Fatalf("prBaseBranch = %q, want main", workspace.PRBaseBranch)
+	}
+}
+
+func TestRepositoryScanTaskWorkspaceUsesLegacyCredentialForReadOnlyFallback(t *testing.T) {
+	scan := &corev1alpha1.RepositoryScan{Spec: corev1alpha1.RepositoryScanSpec{
+		RepoURL:      "https://github.com/example/source.git",
+		GitSecretRef: &corev1.LocalObjectReference{Name: "legacy-read"},
+	}}
+
+	workspace := repositoryScanTaskWorkspace(scan, corev1alpha1.WorkspaceIntentRead)
+	if workspace == nil || workspace.ReadCredentialRef == nil || workspace.ReadCredentialRef.Name != "legacy-read" {
+		t.Fatalf("read workspace = %#v, want legacy read credential", workspace)
+	}
+	if workspace.PublicationReadCredentialRef != nil || workspace.PublicationCredentialRef != nil || workspace.ForgeCredentialRef != nil || workspace.CreatePR {
+		t.Fatalf("read workspace gained publication authority: %#v", workspace)
+	}
+}
+
+const testCanonicalScanSourceCloneURL = "https://github.com/example/source"
+
+func TestRepositoryScanTaskWorkspaceCanonicalizesSSHRepositoryURLs(t *testing.T) {
+	scan := &corev1alpha1.RepositoryScan{Spec: corev1alpha1.RepositoryScanSpec{
+		RepoURL:  "git@github.com:example/source.git",
+		ForkRepo: "git@github.com:example/fork.git",
+	}}
+
+	read := repositoryScanTaskWorkspace(scan, corev1alpha1.WorkspaceIntentRead)
+	if read == nil || read.GitRepo != testCanonicalScanSourceCloneURL {
+		t.Fatalf("read workspace gitRepo = %#v, want canonical HTTPS clone URL", read)
+	}
+
+	write := repositoryScanTaskWorkspace(scan, corev1alpha1.WorkspaceIntentWrite)
+	if write == nil || write.GitRepo != testCanonicalScanSourceCloneURL ||
+		write.PublicationGitRepo != "https://github.com/example/fork" {
+		t.Fatalf("write workspace = %#v, want canonical HTTPS clone URLs", write)
+	}
+
+	scan.Spec.ForkRepo = ""
+	write = repositoryScanTaskWorkspace(scan, corev1alpha1.WorkspaceIntentWrite)
+	if write == nil || write.PublicationGitRepo != testCanonicalScanSourceCloneURL {
+		t.Fatalf("fallback publication repo = %#v, want canonical source clone URL", write)
+	}
+}
+
+func TestRepositoryScanPatchCredentialRefsRequireDistinctExplicitRoles(t *testing.T) {
+	scan := &corev1alpha1.RepositoryScan{Spec: corev1alpha1.RepositoryScanSpec{
+		GitSecretRef:                 &corev1.LocalObjectReference{Name: "legacy-read"},
+		ReadCredentialRef:            &corev1.LocalObjectReference{Name: "source-read"},
+		PublicationReadCredentialRef: &corev1.LocalObjectReference{Name: "target-read"},
+		PublicationCredentialRef:     &corev1.LocalObjectReference{Name: "target-write"},
+		ForgeCredentialRef:           &corev1.LocalObjectReference{Name: "forge"},
+	}}
+	if _, err := repositoryScanPatchCredentialRefs(scan); err != nil {
+		t.Fatalf("repositoryScanPatchCredentialRefs() error = %v", err)
+	}
+
+	scan.Spec.ReadCredentialRef = nil
+	if _, err := repositoryScanPatchCredentialRefs(scan); err == nil || !strings.Contains(err.Error(), "spec.readCredentialRef is required") {
+		t.Fatalf("missing read credential error = %v", err)
+	}
+
+	scan.Spec.ReadCredentialRef = &corev1.LocalObjectReference{Name: "source-read"}
+	scan.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: "target-write"}
+	if _, err := repositoryScanPatchCredentialRefs(scan); err == nil || !strings.Contains(err.Error(), "must reference distinct Secrets") {
+		t.Fatalf("duplicate credential error = %v", err)
+	}
+}
diff --git a/internal/artifactcap/capability.go b/internal/artifactcap/capability.go
new file mode 100644
index 000000000..a46cf6c30
--- /dev/null
+++ b/internal/artifactcap/capability.go
@@ -0,0 +1,121 @@
+package artifactcap
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"strings"
+	"time"
+
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+const maxCapabilityTokenBytes = 16 << 10
+
+func Issue(secret []byte, request OperationRequest, now time.Time, ttl time.Duration) (Authorization, error) {
+	if len(secret) < MinSecretBytes {
+		return Authorization{}, ErrUnauthorized
+	}
+	if err := request.Validate(); err != nil {
+		return Authorization{}, err
+	}
+	if ttl <= 0 || ttl > MaxCapabilityTTL {
+		return Authorization{}, ErrInvalidRequest
+	}
+	if now.IsZero() {
+		now = time.Now().UTC()
+	}
+	now = now.UTC()
+	requestDigest, err := RequestDigest(request)
+	if err != nil {
+		return Authorization{}, err
+	}
+	claims := CapabilityClaims{
+		Version:       CapabilityVersion,
+		Audience:      CapabilityAudience,
+		Request:       request,
+		RequestDigest: requestDigest,
+		IssuedAt:      now,
+		ExpiresAt:     now.Add(ttl),
+	}
+	payload, err := harnessv2.CanonicalValue(claims)
+	if err != nil {
+		return Authorization{}, ErrInvalidRequest
+	}
+	mac := hmac.New(sha256.New, secret)
+	_, _ = mac.Write(payload)
+	encoding := base64.RawURLEncoding
+	return Authorization{
+		Capability:    encoding.EncodeToString(payload) + "." + encoding.EncodeToString(mac.Sum(nil)),
+		RequestDigest: requestDigest,
+	}, nil
+}
+
+func Verify(secret []byte, token string, presented PresentedRequest, now time.Time) (CapabilityClaims, error) {
+	if len(secret) < MinSecretBytes || len(token) == 0 || len(token) > maxCapabilityTokenBytes {
+		return CapabilityClaims{}, ErrUnauthorized
+	}
+	parts := strings.Split(token, ".")
+	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
+		return CapabilityClaims{}, ErrUnauthorized
+	}
+	encoding := base64.RawURLEncoding
+	payload, err := encoding.DecodeString(parts[0])
+	if err != nil || len(payload) == 0 || len(payload) > maxCapabilityTokenBytes ||
+		!constantStringEqual(encoding.EncodeToString(payload), parts[0]) {
+		return CapabilityClaims{}, ErrUnauthorized
+	}
+	signature, err := encoding.DecodeString(parts[1])
+	if err != nil || len(signature) != sha256.Size ||
+		!constantStringEqual(encoding.EncodeToString(signature), parts[1]) {
+		return CapabilityClaims{}, ErrUnauthorized
+	}
+	mac := hmac.New(sha256.New, secret)
+	_, _ = mac.Write(payload)
+	if !hmac.Equal(signature, mac.Sum(nil)) {
+		return CapabilityClaims{}, ErrUnauthorized
+	}
+	canonical, err := harnessv2.CanonicalJSON(payload)
+	if err != nil || subtle.ConstantTimeCompare(canonical, payload) != 1 {
+		return CapabilityClaims{}, ErrUnauthorized
+	}
+	var claims CapabilityClaims
+	decoder := json.NewDecoder(strings.NewReader(string(payload)))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&claims); err != nil || decoder.Decode(&struct{}{}) == nil {
+		return CapabilityClaims{}, ErrUnauthorized
+	}
+	if err := claims.ValidateAt(now); err != nil {
+		if errors.Is(err, ErrExpired) {
+			return CapabilityClaims{}, ErrExpired
+		}
+		return CapabilityClaims{}, ErrUnauthorized
+	}
+	if err := presented.Validate(); err != nil {
+		return CapabilityClaims{}, ErrUnauthorized
+	}
+	expectedDigest, err := RequestDigest(claims.Request)
+	if err != nil {
+		return CapabilityClaims{}, ErrUnauthorized
+	}
+	if !constantStringEqual(expectedDigest, claims.RequestDigest) ||
+		!constantStringEqual(claims.RequestDigest, presented.RequestDigest) ||
+		!constantStringEqual(claims.Request.ObjectDigest, presented.ObjectDigest) ||
+		!constantStringEqual(claims.Request.Path(), presented.Path) ||
+		!constantStringEqual(claims.Request.Method(), presented.Method) ||
+		claims.Request.ContentLength != presented.ContentLength ||
+		!constantStringEqual(claims.Request.MediaType, presented.MediaType) {
+		return CapabilityClaims{}, ErrUnauthorized
+	}
+	return claims, nil
+}
+
+func constantStringEqual(left, right string) bool {
+	if len(left) != len(right) {
+		return false
+	}
+	return subtle.ConstantTimeCompare([]byte(left), []byte(right)) == 1
+}
diff --git a/internal/artifactcap/capability_test.go b/internal/artifactcap/capability_test.go
new file mode 100644
index 000000000..c68644162
--- /dev/null
+++ b/internal/artifactcap/capability_test.go
@@ -0,0 +1,97 @@
+package artifactcap
+
+import (
+	"errors"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestCapabilityBindsExactRequestAndExpires(t *testing.T) {
+	t.Parallel()
+	secret := []byte(strings.Repeat("s", MinSecretBytes))
+	now := time.Date(2026, 7, 24, 12, 0, 0, 0, time.UTC)
+	request := testOperationRequest(OperationUpload, []byte("artifact"), "operation-1")
+	authorization, err := Issue(secret, request, now, time.Minute)
+	if err != nil {
+		t.Fatal(err)
+	}
+	presented := present(request, authorization)
+	claims, err := Verify(secret, authorization.Capability, presented, now.Add(30*time.Second))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if claims.Request != request {
+		t.Fatalf("claims request = %#v, want %#v", claims.Request, request)
+	}
+
+	mutations := []struct {
+		name string
+		edit func(*PresentedRequest)
+	}{
+		{"method", func(value *PresentedRequest) { value.Method = "GET" }},
+		{"path", func(value *PresentedRequest) { value.Path += "/extra" }},
+		{"digest", func(value *PresentedRequest) { value.ObjectDigest = DigestBytes([]byte("different")) }},
+		{"length", func(value *PresentedRequest) { value.ContentLength++ }},
+		{"media", func(value *PresentedRequest) { value.MediaType = "application/json" }},
+		{"request digest", func(value *PresentedRequest) { value.RequestDigest = DigestBytes([]byte("different binding")) }},
+	}
+	for _, mutation := range mutations {
+		t.Run(mutation.name, func(t *testing.T) {
+			changed := presented
+			mutation.edit(&changed)
+			if _, err := Verify(secret, authorization.Capability, changed, now.Add(30*time.Second)); !errors.Is(err, ErrUnauthorized) {
+				t.Fatalf("Verify() error = %v, want ErrUnauthorized", err)
+			}
+		})
+	}
+	if _, err := Verify(secret, authorization.Capability, presented, now.Add(2*time.Minute)); !errors.Is(err, ErrExpired) {
+		t.Fatalf("expired Verify() error = %v, want ErrExpired", err)
+	}
+}
+
+func TestCapabilityRejectsTamperingWithoutSecretDisclosure(t *testing.T) {
+	t.Parallel()
+	secretText := strings.Repeat("super-secret-value-", 2)
+	secret := []byte(secretText)
+	now := time.Now().UTC()
+	request := testOperationRequest(OperationDownload, []byte("artifact"), "operation-2")
+	authorization, err := Issue(secret, request, now, time.Minute)
+	if err != nil {
+		t.Fatal(err)
+	}
+	replacement := "A"
+	if strings.HasSuffix(authorization.Capability, replacement) {
+		replacement = "B"
+	}
+	tampered := authorization.Capability[:len(authorization.Capability)-1] + replacement
+	_, err = Verify(secret, tampered, present(request, authorization), now)
+	if !errors.Is(err, ErrUnauthorized) {
+		t.Fatalf("Verify() error = %v, want ErrUnauthorized", err)
+	}
+	if strings.Contains(err.Error(), secretText) || strings.Contains(err.Error(), authorization.Capability) {
+		t.Fatalf("authorization error disclosed a secret: %q", err)
+	}
+}
+
+func testOperationRequest(operation Operation, data []byte, operationID string) OperationRequest {
+	return OperationRequest{
+		Operation:     operation,
+		ObjectDigest:  DigestBytes(data),
+		Identity:      Identity{Namespace: "default", TaskID: "task-uid-123"},
+		ContentLength: int64(len(data)),
+		MediaType:     "application/octet-stream",
+		OperationID:   operationID,
+	}
+}
+
+func present(request OperationRequest, authorization Authorization) PresentedRequest {
+	return PresentedRequest{
+		Method:        request.Method(),
+		Path:          request.Path(),
+		ObjectDigest:  request.ObjectDigest,
+		ContentLength: request.ContentLength,
+		MediaType:     request.MediaType,
+		RequestDigest: authorization.RequestDigest,
+	}
+}
diff --git a/internal/artifactcap/digest.go b/internal/artifactcap/digest.go
new file mode 100644
index 000000000..e1bea4b41
--- /dev/null
+++ b/internal/artifactcap/digest.go
@@ -0,0 +1,60 @@
+package artifactcap
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"regexp"
+
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+const requestDigestDomain = "orka.acp.artifact-request.v1\x00"
+
+var objectDigestPattern = regexp.MustCompile(`^sha256:[0-9a-f]{64}$`)
+
+func ValidateObjectDigest(value string) error {
+	if !objectDigestPattern.MatchString(value) {
+		return fmt.Errorf("%w: object digest must be lowercase sha256", ErrInvalidRequest)
+	}
+	return nil
+}
+
+func DigestHex(value string) (string, error) {
+	if err := ValidateObjectDigest(value); err != nil {
+		return "", err
+	}
+	return value[len("sha256:"):], nil
+}
+
+func DigestBytes(data []byte) string {
+	sum := sha256.Sum256(data)
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
+
+func RequestDigest(request OperationRequest) (string, error) {
+	if err := request.Validate(); err != nil {
+		return "", err
+	}
+	binding := struct {
+		Version string           `json:"version"`
+		Method  string           `json:"method"`
+		Path    string           `json:"path"`
+		Request OperationRequest `json:"request"`
+	}{
+		Version: CapabilityVersion,
+		Method:  request.Method(),
+		Path:    request.Path(),
+		Request: request,
+	}
+	canonical, err := harnessv2.CanonicalValue(binding)
+	if err != nil {
+		return "", fmt.Errorf("canonicalize artifact request: %w", err)
+	}
+	hash := sha256.New()
+	_, _ = hash.Write([]byte(requestDigestDomain))
+	_, _ = hash.Write(canonical)
+	return "sha256:" + hex.EncodeToString(hash.Sum(nil)), nil
+}
+
+func IsRequestDigest(value string) bool { return objectDigestPattern.MatchString(value) }
diff --git a/internal/artifactcap/io_helpers.go b/internal/artifactcap/io_helpers.go
new file mode 100644
index 000000000..413727341
--- /dev/null
+++ b/internal/artifactcap/io_helpers.go
@@ -0,0 +1,82 @@
+package artifactcap
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+)
+
+func bytesReader(data []byte) *bytes.Reader { return bytes.NewReader(data) }
+
+func decodeStrictJSON(data []byte, target any) error {
+	decoder := json.NewDecoder(bytesReader(data))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(target); err != nil {
+		return err
+	}
+	if err := decoder.Decode(&struct{}{}); !errors.Is(err, io.EOF) {
+		return ErrCorrupt
+	}
+	return nil
+}
+
+type contextReader struct {
+	ctx context.Context
+	r   io.Reader
+}
+
+func (r contextReader) Read(buffer []byte) (int, error) {
+	if err := r.ctx.Err(); err != nil {
+		return 0, err
+	}
+	n, err := r.r.Read(buffer)
+	if err == nil {
+		if ctxErr := r.ctx.Err(); ctxErr != nil {
+			return n, ctxErr
+		}
+	}
+	return n, err
+}
+
+func ensurePrivateDirectory(dir string) error {
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		return fmt.Errorf("create artifact storage directory: %w", err)
+	}
+	info, err := os.Lstat(dir)
+	if err != nil {
+		return fmt.Errorf("inspect artifact storage directory: %w", err)
+	}
+	if info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
+		return ErrUnsafePath
+	}
+	if info.Mode().Perm()&0o077 != 0 {
+		if err := os.Chmod(dir, 0o700); err != nil {
+			return fmt.Errorf("secure artifact storage directory: %w", err)
+		}
+	}
+	return nil
+}
+
+func syncDirectory(dir string) error {
+	file, err := openFileNoFollow(dir, os.O_RDONLY, 0)
+	if err != nil {
+		return err
+	}
+	defer file.Close() //nolint:errcheck
+	return file.Sync()
+}
+
+func replaceRegularFile(source, destination string) error {
+	if info, err := os.Lstat(destination); err == nil {
+		if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() {
+			return ErrUnsafePath
+		}
+	} else if !os.IsNotExist(err) {
+		return err
+	}
+	return os.Rename(source, destination)
+}
diff --git a/internal/artifactcap/ledger.go b/internal/artifactcap/ledger.go
new file mode 100644
index 000000000..9eb1d73af
--- /dev/null
+++ b/internal/artifactcap/ledger.go
@@ -0,0 +1,224 @@
+package artifactcap
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"time"
+)
+
+type OperationState string
+
+const (
+	OperationStarted   OperationState = "started"
+	OperationCompleted OperationState = "completed"
+	OperationFailed    OperationState = "failed"
+)
+
+type OperationRecord struct {
+	OperationID   string           `json:"operationID"`
+	RequestDigest string           `json:"requestDigest"`
+	Request       OperationRequest `json:"request"`
+	State         OperationState   `json:"state"`
+	FailureCode   string           `json:"failureCode,omitempty"`
+	StartedAt     time.Time        `json:"startedAt"`
+	FinishedAt    *time.Time       `json:"finishedAt,omitempty"`
+}
+
+type FileLedger struct {
+	dir string
+}
+
+func NewFileLedger(root string) (*FileLedger, error) {
+	if root == "" || !filepath.IsAbs(root) {
+		return nil, fmt.Errorf("%w: ledger root must be absolute", ErrUnsafePath)
+	}
+	if err := ensurePrivateDirectory(root); err != nil {
+		return nil, err
+	}
+	dir := filepath.Join(root, "operations")
+	if err := ensurePrivateDirectory(dir); err != nil {
+		return nil, err
+	}
+	return &FileLedger{dir: dir}, nil
+}
+
+func (l *FileLedger) Begin(ctx context.Context, record OperationRecord) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	if err := validateOperationRecord(record, OperationStarted); err != nil {
+		return err
+	}
+	if err := ensurePrivateDirectory(l.dir); err != nil {
+		return err
+	}
+	encoded, err := json.Marshal(record)
+	if err != nil {
+		return err
+	}
+	temp, err := os.CreateTemp(l.dir, ".operation-reservation-*.tmp")
+	if err != nil {
+		return fmt.Errorf("create artifact operation reservation: %w", err)
+	}
+	tempPath := temp.Name()
+	defer os.Remove(tempPath) //nolint:errcheck
+	if err = temp.Chmod(0o600); err == nil {
+		_, err = temp.Write(encoded)
+	}
+	if err == nil {
+		err = temp.Sync()
+	}
+	closeErr := temp.Close()
+	if err == nil {
+		err = closeErr
+	}
+	if err != nil {
+		return fmt.Errorf("persist artifact operation reservation: %w", err)
+	}
+	path := l.recordPath(record.OperationID)
+	if err := os.Link(tempPath, path); err != nil {
+		if errors.Is(err, os.ErrExist) {
+			existing, readErr := l.Get(ctx, record.OperationID)
+			if readErr != nil {
+				return readErr
+			}
+			if constantStringEqual(existing.RequestDigest, record.RequestDigest) {
+				return ErrReplay
+			}
+			return ErrOperationConflict
+		}
+		return fmt.Errorf("commit artifact operation reservation: %w", err)
+	}
+	if err := syncDirectory(l.dir); err != nil {
+		return fmt.Errorf("sync artifact operation reservation: %w", err)
+	}
+	return nil
+}
+
+func (l *FileLedger) Finish(ctx context.Context, operationID, requestDigest string, state OperationState, failureCode string, finishedAt time.Time) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	if state != OperationCompleted && state != OperationFailed {
+		return fmt.Errorf("%w: invalid terminal operation state", ErrInvalidRequest)
+	}
+	record, err := l.Get(ctx, operationID)
+	if err != nil {
+		return err
+	}
+	if !constantStringEqual(record.RequestDigest, requestDigest) {
+		return ErrOperationConflict
+	}
+	if record.State == state {
+		return nil
+	}
+	if record.State != OperationStarted {
+		return ErrOperationConflict
+	}
+	finishedAt = finishedAt.UTC()
+	record.State = state
+	record.FailureCode = failureCode
+	record.FinishedAt = &finishedAt
+	return l.replace(record)
+}
+
+func (l *FileLedger) Get(ctx context.Context, operationID string) (OperationRecord, error) {
+	if err := ctx.Err(); err != nil {
+		return OperationRecord{}, err
+	}
+	if err := validateIdentifier("operation ID", operationID, 512); err != nil {
+		return OperationRecord{}, err
+	}
+	if err := ensurePrivateDirectory(l.dir); err != nil {
+		return OperationRecord{}, err
+	}
+	file, err := openFileNoFollow(l.recordPath(operationID), os.O_RDONLY, 0)
+	if errors.Is(err, os.ErrNotExist) {
+		return OperationRecord{}, ErrNotFound
+	}
+	if err != nil {
+		return OperationRecord{}, fmt.Errorf("read artifact operation record: %w", err)
+	}
+	defer file.Close() //nolint:errcheck
+	info, err := file.Stat()
+	if err != nil || !info.Mode().IsRegular() || info.Size() > 64<<10 {
+		return OperationRecord{}, ErrCorrupt
+	}
+	data, err := io.ReadAll(io.LimitReader(file, 64<<10+1))
+	if err != nil || len(data) > 64<<10 {
+		return OperationRecord{}, ErrCorrupt
+	}
+	var record OperationRecord
+	if err := decodeStrictJSON(data, &record); err != nil {
+		return OperationRecord{}, ErrCorrupt
+	}
+	if err := validateOperationRecord(record, record.State); err != nil || record.OperationID != operationID {
+		return OperationRecord{}, ErrCorrupt
+	}
+	return record, nil
+}
+
+func (l *FileLedger) replace(record OperationRecord) error {
+	if err := ensurePrivateDirectory(l.dir); err != nil {
+		return err
+	}
+	data, err := json.Marshal(record)
+	if err != nil {
+		return err
+	}
+	temp, err := os.CreateTemp(l.dir, ".operation-*.tmp")
+	if err != nil {
+		return fmt.Errorf("create artifact operation temp record: %w", err)
+	}
+	tempPath := temp.Name()
+	defer os.Remove(tempPath) //nolint:errcheck
+	if err = temp.Chmod(0o600); err == nil {
+		_, err = temp.Write(data)
+	}
+	if err == nil {
+		err = temp.Sync()
+	}
+	closeErr := temp.Close()
+	if err == nil {
+		err = closeErr
+	}
+	if err != nil {
+		return fmt.Errorf("write artifact operation temp record: %w", err)
+	}
+	if err := replaceRegularFile(tempPath, l.recordPath(record.OperationID)); err != nil {
+		return fmt.Errorf("commit artifact operation record: %w", err)
+	}
+	return syncDirectory(l.dir)
+}
+
+func (l *FileLedger) recordPath(operationID string) string {
+	return filepath.Join(l.dir, operationRecordName(operationID))
+}
+
+func operationRecordName(operationID string) string {
+	sum := sha256.Sum256([]byte(operationID))
+	return hex.EncodeToString(sum[:]) + ".json"
+}
+
+func validateOperationRecord(record OperationRecord, state OperationState) error {
+	if err := validateIdentifier("operation ID", record.OperationID, 512); err != nil {
+		return err
+	}
+	if !IsRequestDigest(record.RequestDigest) {
+		return fmt.Errorf("%w: invalid operation request digest", ErrInvalidRequest)
+	}
+	if err := record.Request.Validate(); err != nil {
+		return err
+	}
+	if record.State != state || record.StartedAt.IsZero() {
+		return fmt.Errorf("%w: invalid operation record state", ErrInvalidRequest)
+	}
+	return nil
+}
diff --git a/internal/artifactcap/nofollow_other.go b/internal/artifactcap/nofollow_other.go
new file mode 100644
index 000000000..c8c7e71f3
--- /dev/null
+++ b/internal/artifactcap/nofollow_other.go
@@ -0,0 +1,14 @@
+//go:build !darwin && !linux
+
+package artifactcap
+
+import (
+	"os"
+)
+
+func openFileNoFollow(path string, flags int, perm os.FileMode) (*os.File, error) {
+	if info, err := os.Lstat(path); err == nil && info.Mode()&os.ModeSymlink != 0 {
+		return nil, ErrUnsafePath
+	}
+	return os.OpenFile(path, flags, perm)
+}
diff --git a/internal/artifactcap/nofollow_unix.go b/internal/artifactcap/nofollow_unix.go
new file mode 100644
index 000000000..5f55e511e
--- /dev/null
+++ b/internal/artifactcap/nofollow_unix.go
@@ -0,0 +1,41 @@
+//go:build darwin || linux
+
+package artifactcap
+
+import (
+	"fmt"
+	"os"
+
+	"golang.org/x/sys/unix"
+)
+
+func openFileNoFollow(path string, flags int, perm os.FileMode) (*os.File, error) {
+	unixFlags := unix.O_CLOEXEC | unix.O_NOFOLLOW
+	switch {
+	case flags&os.O_RDWR != 0:
+		unixFlags |= unix.O_RDWR
+	case flags&os.O_WRONLY != 0:
+		unixFlags |= unix.O_WRONLY
+	default:
+		unixFlags |= unix.O_RDONLY
+	}
+	if flags&os.O_CREATE != 0 {
+		unixFlags |= unix.O_CREAT
+	}
+	if flags&os.O_EXCL != 0 {
+		unixFlags |= unix.O_EXCL
+	}
+	if flags&os.O_TRUNC != 0 {
+		unixFlags |= unix.O_TRUNC
+	}
+	fd, err := unix.Open(path, unixFlags, uint32(perm.Perm()))
+	if err != nil {
+		return nil, err
+	}
+	file := os.NewFile(uintptr(fd), path)
+	if file == nil {
+		_ = unix.Close(fd)
+		return nil, fmt.Errorf("create artifact file handle")
+	}
+	return file, nil
+}
diff --git a/internal/artifactcap/retention.go b/internal/artifactcap/retention.go
new file mode 100644
index 000000000..8ed717fd8
--- /dev/null
+++ b/internal/artifactcap/retention.go
@@ -0,0 +1,853 @@
+package artifactcap
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"time"
+
+	logf "sigs.k8s.io/controller-runtime/pkg/log"
+)
+
+const (
+	// DefaultRoot is the controller PVC subdirectory used by ACP artifact transport.
+	DefaultRoot                   = "/data/acp-artifacts"
+	defaultRetentionSweepInterval = time.Minute
+	defaultRetentionLockTimeout   = 5 * time.Second
+	retirementRecordMaxBytes      = 16 << 10
+	reservationRecordMaxBytes     = 64 << 10
+	operationRecordMaxBytes       = 64 << 10
+)
+
+// MinimumRetirementGrace keeps a retired identity blocked until every
+// capability that could have been issued before retirement is expired.
+const MinimumRetirementGrace = MaxCapabilityTTL + MaxClockSkew
+
+// IdentityRetirer retires immutable artifact identities after their owning
+// attempt/publication state can no longer require transport or replay.
+type IdentityRetirer interface {
+	Retire(context.Context, ...Identity) error
+}
+
+// CapabilityReservationRecorder persists a digest reservation before a
+// capability is returned to a caller. Reservations keep cross-identity objects
+// live until the capability expires or its identity is retired.
+type CapabilityReservationRecorder interface {
+	Reserve(context.Context, OperationRequest, time.Time) error
+}
+
+// CollectorConfig configures reference-aware artifact retention.
+type CollectorConfig struct {
+	Root          string
+	SweepInterval time.Duration
+	LockTimeout   time.Duration
+	Now           func() time.Time
+}
+
+// Collector reclaims artifact objects and replay records only after the
+// controller explicitly retires their immutable Task/publication identities.
+// The artifact store and this retention format ship together in the ACP v2
+// hard cutover, so there is no supported pre-retention ledger to backfill.
+type Collector struct {
+	root          string
+	objectsDir    string
+	metadataDir   string
+	operationsDir string
+	retirements   *retirementStore
+	reservations  *reservationStore
+	sweepInterval time.Duration
+	lockTimeout   time.Duration
+	now           func() time.Time
+}
+
+type retirementStore struct {
+	dir string
+}
+
+type reservationStore struct {
+	dir string
+}
+
+type identityRetirement struct {
+	Identity   Identity  `json:"identity"`
+	RetiredAt  time.Time `json:"retiredAt"`
+	PurgeAfter time.Time `json:"purgeAfter"`
+}
+
+type operationFile struct {
+	path   string
+	record OperationRecord
+}
+
+type capabilityReservation struct {
+	Request   OperationRequest `json:"request"`
+	ExpiresAt time.Time        `json:"expiresAt"`
+}
+
+type reservationFile struct {
+	path   string
+	record capabilityReservation
+}
+
+func NewCollector(config CollectorConfig) (*Collector, error) {
+	if config.Root == "" || !filepath.IsAbs(config.Root) {
+		return nil, fmt.Errorf("%w: artifact root must be absolute", ErrUnsafePath)
+	}
+	root := filepath.Clean(config.Root)
+	objectsDir := filepath.Join(root, "objects")
+	metadataDir := filepath.Join(root, "metadata")
+	operationsDir := filepath.Join(root, "operations")
+	retirementsDir := filepath.Join(root, "retirements")
+	reservationsDir := filepath.Join(root, "reservations")
+	for _, dir := range []string{root, objectsDir, metadataDir, filepath.Join(root, "tmp"), operationsDir, retirementsDir, reservationsDir} {
+		if err := ensurePrivateDirectory(dir); err != nil {
+			return nil, err
+		}
+	}
+	sweepInterval := config.SweepInterval
+	if sweepInterval <= 0 {
+		sweepInterval = defaultRetentionSweepInterval
+	}
+	lockTimeout := config.LockTimeout
+	if lockTimeout <= 0 {
+		lockTimeout = defaultRetentionLockTimeout
+	}
+	now := config.Now
+	if now == nil {
+		now = func() time.Time { return time.Now().UTC() }
+	}
+	return &Collector{
+		root: root, objectsDir: objectsDir, metadataDir: metadataDir, operationsDir: operationsDir,
+		retirements: &retirementStore{dir: retirementsDir}, reservations: &reservationStore{dir: reservationsDir},
+		sweepInterval: sweepInterval, lockTimeout: lockTimeout, now: now,
+	}, nil
+}
+
+// NeedLeaderElection keeps periodic sweeping on the controller leader. The
+// filesystem lock still protects transport during rolling overlap.
+func (*Collector) NeedLeaderElection() bool { return true }
+
+// Start runs startup and periodic recovery sweeps. A direct Retire call still
+// performs synchronous reclamation; the loop bounds short-lived tombstones and
+// resumes cleanup after crashes.
+func (c *Collector) Start(ctx context.Context) error {
+	logger := logf.FromContext(ctx).WithName("acp-artifact-retention")
+	if err := c.Sweep(ctx); err != nil && !errors.Is(err, context.Canceled) {
+		logger.Error(err, "initial artifact retention sweep failed")
+	}
+	ticker := time.NewTicker(c.sweepInterval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-ticker.C:
+			if err := c.Sweep(ctx); err != nil && !errors.Is(err, context.Canceled) {
+				logger.Error(err, "artifact retention sweep failed")
+			}
+		}
+	}
+}
+
+// Reserve persists one exact capability reference before the capability is
+// returned. The exclusive lock serializes reservation publication with
+// reclamation; transport operations use the fair shared side of the same gate.
+func (c *Collector) Reserve(ctx context.Context, request OperationRequest, expiresAt time.Time) error {
+	if err := request.Validate(); err != nil {
+		return err
+	}
+	now := c.now().UTC()
+	expiresAt = expiresAt.UTC()
+	if !expiresAt.After(now) || expiresAt.After(now.Add(MaxCapabilityTTL+MaxClockSkew)) {
+		return fmt.Errorf("%w: capability reservation expiry is invalid", ErrInvalidRequest)
+	}
+	lockCtx, cancel := context.WithTimeout(ctx, c.lockTimeout)
+	release, err := acquireArtifactRootLock(lockCtx, c.root, true)
+	cancel()
+	if err != nil {
+		return err
+	}
+	defer func() { _ = release() }()
+	retired, err := c.retirements.isRetired(ctx, request.Identity)
+	if err != nil {
+		return err
+	}
+	if retired {
+		return ErrUnauthorized
+	}
+	if request.Operation == OperationDownload {
+		if err := c.verifyReservedDownload(request); err != nil {
+			return err
+		}
+	}
+	return c.reservations.record(ctx, capabilityReservation{Request: request, ExpiresAt: expiresAt})
+}
+
+func (c *Collector) verifyReservedDownload(request OperationRequest) error {
+	store := &FileObjectStore{root: c.root, objectsDir: c.objectsDir, metadataDir: c.metadataDir}
+	artifact, err := store.readMetadata(request.ObjectDigest)
+	if err != nil {
+		return err
+	}
+	if artifact.SizeBytes != request.ContentLength || !constantStringEqual(artifact.MediaType, request.MediaType) {
+		return ErrCorrupt
+	}
+	hexDigest, err := DigestHex(request.ObjectDigest)
+	if err != nil {
+		return err
+	}
+	file, err := openFileNoFollow(filepath.Join(c.objectsDir, hexDigest), os.O_RDONLY, 0)
+	if errors.Is(err, os.ErrNotExist) {
+		return ErrNotFound
+	}
+	if err != nil {
+		return err
+	}
+	defer file.Close() //nolint:errcheck
+	info, err := file.Stat()
+	if err != nil || !info.Mode().IsRegular() || info.Size() != request.ContentLength {
+		return ErrCorrupt
+	}
+	return nil
+}
+
+// Retire persistently blocks the supplied immutable identities before
+// reclaiming their unshared objects and replay records. Callers must establish
+// that no attempt, publication, external effect, or outbox recovery can need
+// the identities again.
+func (c *Collector) Retire(ctx context.Context, identities ...Identity) error {
+	if len(identities) == 0 {
+		return fmt.Errorf("%w: at least one artifact identity is required", ErrInvalidRequest)
+	}
+	unique := make(map[string]Identity, len(identities))
+	for _, identity := range identities {
+		if err := identity.Validate(); err != nil {
+			return err
+		}
+		key := identityStorageKey(identity)
+		unique[key] = identity
+	}
+	keys := make([]string, 0, len(unique))
+	for key := range unique {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+
+	lockCtx, cancel := context.WithTimeout(ctx, c.lockTimeout)
+	release, err := acquireArtifactRootLock(lockCtx, c.root, true)
+	cancel()
+	if err != nil {
+		return err
+	}
+	defer func() { _ = release() }()
+
+	retiredAt := c.now().UTC()
+	for _, key := range keys {
+		if err := c.retirements.record(ctx, unique[key], retiredAt); err != nil {
+			return err
+		}
+	}
+	// Keep objects and replay records through the maximum capability lifetime.
+	// This gives every capability issued to another live identity time to start
+	// and persist its own replay reference before reclamation.
+	return nil
+}
+
+// Sweep resumes crash-interrupted reclamation and prunes retirement tombstones
+// only after the maximum capability lifetime has elapsed.
+func (c *Collector) Sweep(ctx context.Context) error {
+	lockCtx, cancel := context.WithTimeout(ctx, c.lockTimeout)
+	release, err := acquireArtifactRootLock(lockCtx, c.root, true)
+	cancel()
+	if err != nil {
+		return err
+	}
+	defer func() { _ = release() }()
+	return c.sweepLocked(ctx, c.now().UTC())
+}
+
+func (c *Collector) sweepLocked(ctx context.Context, now time.Time) error {
+	retirements, err := c.retirements.list(ctx)
+	if err != nil {
+		return err
+	}
+	operations, err := c.listOperations(ctx)
+	if err != nil {
+		return err
+	}
+	reservations, err := c.reservations.list(ctx)
+	if err != nil {
+		return err
+	}
+	reservedDigests, err := c.pruneCapabilityReservations(ctx, now, retirements, reservations)
+	if err != nil {
+		return err
+	}
+	liveDigests, candidateDigests, retiredOperations, err := classifyRetiredOperations(ctx, now, retirements, operations)
+	if err != nil {
+		return err
+	}
+	allLiveDigests := make(map[string]struct{}, len(liveDigests)+len(reservedDigests))
+	for digest := range liveDigests {
+		allLiveDigests[digest] = struct{}{}
+	}
+	for digest := range reservedDigests {
+		allLiveDigests[digest] = struct{}{}
+	}
+	removableOperations, blockedRetirements := selectRemovableRetiredOperations(retiredOperations, liveDigests, reservedDigests)
+	if err := c.removeRetiredArtifacts(ctx, allLiveDigests, candidateDigests); err != nil {
+		return err
+	}
+	if err := c.removeRetiredOperationRecords(ctx, removableOperations); err != nil {
+		return err
+	}
+	return c.removeExpiredRetirements(ctx, now, retirements, blockedRetirements)
+}
+
+func classifyRetiredOperations(
+	ctx context.Context,
+	now time.Time,
+	retirements map[string]identityRetirement,
+	operations []operationFile,
+) (map[string]struct{}, map[string]struct{}, []operationFile, error) {
+	liveDigests := make(map[string]struct{}, len(operations))
+	candidateDigests := make(map[string]struct{})
+	retiredOperations := make([]operationFile, 0)
+	for _, operation := range operations {
+		if err := ctx.Err(); err != nil {
+			return nil, nil, nil, err
+		}
+		retirement, retired := retirements[identityStorageKey(operation.record.Request.Identity)]
+		if retired && !retirement.PurgeAfter.After(now) {
+			candidateDigests[operation.record.Request.ObjectDigest] = struct{}{}
+			retiredOperations = append(retiredOperations, operation)
+			continue
+		}
+		liveDigests[operation.record.Request.ObjectDigest] = struct{}{}
+	}
+	return liveDigests, candidateDigests, retiredOperations, nil
+}
+
+func (c *Collector) pruneCapabilityReservations(
+	ctx context.Context,
+	now time.Time,
+	retirements map[string]identityRetirement,
+	reservations []reservationFile,
+) (map[string]struct{}, error) {
+	live := make(map[string]struct{}, len(reservations))
+	removed := false
+	for _, reservation := range reservations {
+		if err := ctx.Err(); err != nil {
+			return nil, err
+		}
+		_, retired := retirements[identityStorageKey(reservation.record.Request.Identity)]
+		if retired || !reservation.record.ExpiresAt.After(now) {
+			deleted, err := removeManagedRegularFile(reservation.path)
+			if err != nil {
+				return nil, fmt.Errorf("remove expired artifact capability reservation: %w", err)
+			}
+			removed = removed || deleted
+			continue
+		}
+		live[reservation.record.Request.ObjectDigest] = struct{}{}
+	}
+	if removed {
+		if err := syncDirectory(c.reservations.dir); err != nil {
+			return nil, fmt.Errorf("sync artifact capability reservations: %w", err)
+		}
+	}
+	return live, nil
+}
+
+func selectRemovableRetiredOperations(
+	operations []operationFile,
+	liveOperationDigests map[string]struct{},
+	reservedDigests map[string]struct{},
+) ([]operationFile, map[string]struct{}) {
+	removable := make([]operationFile, 0, len(operations))
+	blocked := make(map[string]struct{})
+	reservationAnchors := make(map[string]struct{})
+	for _, operation := range operations {
+		digest := operation.record.Request.ObjectDigest
+		_, liveOperation := liveOperationDigests[digest]
+		_, reserved := reservedDigests[digest]
+		if reserved && !liveOperation {
+			if _, anchored := reservationAnchors[digest]; !anchored {
+				reservationAnchors[digest] = struct{}{}
+				blocked[identityStorageKey(operation.record.Request.Identity)] = struct{}{}
+				continue
+			}
+		}
+		removable = append(removable, operation)
+	}
+	return removable, blocked
+}
+
+func (c *Collector) removeRetiredArtifacts(ctx context.Context, liveDigests, candidateDigests map[string]struct{}) error {
+	removedMetadata := false
+	removedObjects := false
+	for _, digest := range sortedSet(candidateDigests) {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		if _, retained := liveDigests[digest]; retained {
+			continue
+		}
+		hexDigest, err := DigestHex(digest)
+		if err != nil {
+			return ErrCorrupt
+		}
+		removed, err := removeManagedRegularFile(filepath.Join(c.metadataDir, hexDigest+".json"))
+		if err != nil {
+			return fmt.Errorf("remove retired artifact metadata: %w", err)
+		}
+		removedMetadata = removedMetadata || removed
+		removed, err = removeManagedRegularFile(filepath.Join(c.objectsDir, hexDigest))
+		if err != nil {
+			return fmt.Errorf("remove retired artifact object: %w", err)
+		}
+		removedObjects = removedObjects || removed
+	}
+	// Persist object/metadata removal before deleting the replay records that
+	// identify crash-recovery candidates.
+	if removedMetadata {
+		if err := syncDirectory(c.metadataDir); err != nil {
+			return fmt.Errorf("sync retired artifact metadata: %w", err)
+		}
+	}
+	if removedObjects {
+		if err := syncDirectory(c.objectsDir); err != nil {
+			return fmt.Errorf("sync retired artifact objects: %w", err)
+		}
+	}
+	return nil
+}
+
+func (c *Collector) removeRetiredOperationRecords(ctx context.Context, operations []operationFile) error {
+	removed := false
+	for _, operation := range operations {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		deleted, err := removeManagedRegularFile(operation.path)
+		if err != nil {
+			return fmt.Errorf("remove retired artifact replay record: %w", err)
+		}
+		removed = removed || deleted
+	}
+	if removed {
+		if err := syncDirectory(c.operationsDir); err != nil {
+			return fmt.Errorf("sync retired artifact replay records: %w", err)
+		}
+	}
+	return nil
+}
+
+func (c *Collector) removeExpiredRetirements(
+	ctx context.Context,
+	now time.Time,
+	retirements map[string]identityRetirement,
+	blocked map[string]struct{},
+) error {
+	removed := false
+	for key, retirement := range retirements {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		if _, keep := blocked[key]; keep {
+			continue
+		}
+		if retirement.PurgeAfter.After(now) {
+			continue
+		}
+		deleted, err := removeManagedRegularFile(c.retirements.pathForKey(key))
+		if err != nil {
+			return fmt.Errorf("remove expired artifact retirement record: %w", err)
+		}
+		removed = removed || deleted
+	}
+	if removed {
+		if err := syncDirectory(c.retirements.dir); err != nil {
+			return fmt.Errorf("sync artifact retirement records: %w", err)
+		}
+	}
+	return nil
+}
+
+func (c *Collector) listOperations(ctx context.Context) ([]operationFile, error) {
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
+	if err := ensurePrivateDirectory(c.operationsDir); err != nil {
+		return nil, err
+	}
+	entries, err := os.ReadDir(c.operationsDir)
+	if err != nil {
+		return nil, fmt.Errorf("list artifact replay records: %w", err)
+	}
+	operations := make([]operationFile, 0, len(entries))
+	for _, entry := range entries {
+		if err := ctx.Err(); err != nil {
+			return nil, err
+		}
+		name := entry.Name()
+		if strings.HasPrefix(name, ".operation-") && strings.HasSuffix(name, ".tmp") {
+			if _, err := removeManagedRegularFile(filepath.Join(c.operationsDir, name)); err != nil {
+				return nil, fmt.Errorf("remove stale artifact replay temp record: %w", err)
+			}
+			continue
+		}
+		if entry.IsDir() || len(name) != sha256.Size*2+len(".json") || !strings.HasSuffix(name, ".json") {
+			return nil, ErrCorrupt
+		}
+		if _, err := hex.DecodeString(strings.TrimSuffix(name, ".json")); err != nil {
+			return nil, ErrCorrupt
+		}
+		path := filepath.Join(c.operationsDir, name)
+		record, err := readOperationRecordFile(path)
+		if err != nil || operationRecordName(record.OperationID) != name {
+			return nil, ErrCorrupt
+		}
+		operations = append(operations, operationFile{path: path, record: record})
+	}
+	return operations, nil
+}
+
+func (s *reservationStore) record(ctx context.Context, record capabilityReservation) error {
+	if err := validateCapabilityReservation(record); err != nil {
+		return err
+	}
+	if err := ensurePrivateDirectory(s.dir); err != nil {
+		return err
+	}
+	path := s.pathForOperation(record.Request.OperationID)
+	if existing, err := s.get(ctx, path); err == nil {
+		if existing.Request != record.Request {
+			return ErrOperationConflict
+		}
+		if !record.ExpiresAt.After(existing.ExpiresAt) {
+			return nil
+		}
+	} else if !errors.Is(err, ErrNotFound) {
+		return err
+	}
+	data, err := json.Marshal(record)
+	if err != nil {
+		return err
+	}
+	temp, err := os.CreateTemp(s.dir, ".reservation-*.tmp")
+	if err != nil {
+		return fmt.Errorf("create artifact reservation temp record: %w", err)
+	}
+	tempPath := temp.Name()
+	defer os.Remove(tempPath) //nolint:errcheck
+	if err = temp.Chmod(0o600); err == nil {
+		_, err = temp.Write(data)
+	}
+	if err == nil {
+		err = temp.Sync()
+	}
+	closeErr := temp.Close()
+	if err == nil {
+		err = closeErr
+	}
+	if err != nil {
+		return fmt.Errorf("persist artifact reservation record: %w", err)
+	}
+	if err := os.Rename(tempPath, path); err != nil {
+		return fmt.Errorf("commit artifact reservation record: %w", err)
+	}
+	return syncDirectory(s.dir)
+}
+
+func (s *reservationStore) list(ctx context.Context) ([]reservationFile, error) {
+	if err := ensurePrivateDirectory(s.dir); err != nil {
+		return nil, err
+	}
+	entries, err := os.ReadDir(s.dir)
+	if err != nil {
+		return nil, fmt.Errorf("list artifact capability reservations: %w", err)
+	}
+	result := make([]reservationFile, 0, len(entries))
+	for _, entry := range entries {
+		if err := ctx.Err(); err != nil {
+			return nil, err
+		}
+		name := entry.Name()
+		if strings.HasPrefix(name, ".reservation-") && strings.HasSuffix(name, ".tmp") {
+			if _, err := removeManagedRegularFile(filepath.Join(s.dir, name)); err != nil {
+				return nil, err
+			}
+			continue
+		}
+		if entry.IsDir() || len(name) != sha256.Size*2+len(".json") || !strings.HasSuffix(name, ".json") {
+			return nil, ErrCorrupt
+		}
+		if _, err := hex.DecodeString(strings.TrimSuffix(name, ".json")); err != nil {
+			return nil, ErrCorrupt
+		}
+		path := filepath.Join(s.dir, name)
+		record, err := s.get(ctx, path)
+		if err != nil || operationRecordName(record.Request.OperationID) != name {
+			return nil, ErrCorrupt
+		}
+		result = append(result, reservationFile{path: path, record: record})
+	}
+	return result, nil
+}
+
+func (s *reservationStore) get(ctx context.Context, path string) (capabilityReservation, error) {
+	if err := ctx.Err(); err != nil {
+		return capabilityReservation{}, err
+	}
+	file, err := openFileNoFollow(path, os.O_RDONLY, 0)
+	if errors.Is(err, os.ErrNotExist) {
+		return capabilityReservation{}, ErrNotFound
+	}
+	if err != nil {
+		return capabilityReservation{}, fmt.Errorf("read artifact reservation record: %w", err)
+	}
+	defer file.Close() //nolint:errcheck
+	info, err := file.Stat()
+	if err != nil || !info.Mode().IsRegular() || info.Size() > reservationRecordMaxBytes {
+		return capabilityReservation{}, ErrCorrupt
+	}
+	data, err := io.ReadAll(io.LimitReader(file, reservationRecordMaxBytes+1))
+	if err != nil || len(data) > reservationRecordMaxBytes {
+		return capabilityReservation{}, ErrCorrupt
+	}
+	var record capabilityReservation
+	if err := decodeStrictJSON(data, &record); err != nil || validateCapabilityReservation(record) != nil {
+		return capabilityReservation{}, ErrCorrupt
+	}
+	return record, nil
+}
+
+func (s *reservationStore) pathForOperation(operationID string) string {
+	return filepath.Join(s.dir, operationRecordName(operationID))
+}
+
+func validateCapabilityReservation(record capabilityReservation) error {
+	if err := record.Request.Validate(); err != nil {
+		return err
+	}
+	if record.ExpiresAt.IsZero() || record.ExpiresAt.Location() != time.UTC {
+		return ErrCorrupt
+	}
+	return nil
+}
+
+func newRetirementStore(root string) (*retirementStore, error) {
+	dir := filepath.Join(root, "retirements")
+	if err := ensurePrivateDirectory(dir); err != nil {
+		return nil, err
+	}
+	return &retirementStore{dir: dir}, nil
+}
+
+func (s *retirementStore) isRetired(ctx context.Context, identity Identity) (bool, error) {
+	if err := identity.Validate(); err != nil {
+		return false, err
+	}
+	_, err := s.get(ctx, identityStorageKey(identity))
+	if errors.Is(err, ErrNotFound) {
+		return false, nil
+	}
+	return err == nil, err
+}
+
+func (s *retirementStore) record(ctx context.Context, identity Identity, retiredAt time.Time) error {
+	key := identityStorageKey(identity)
+	existing, err := s.get(ctx, key)
+	if err == nil {
+		if existing.Identity != identity {
+			return ErrCorrupt
+		}
+		return nil
+	}
+	if !errors.Is(err, ErrNotFound) {
+		return err
+	}
+	record := identityRetirement{Identity: identity, RetiredAt: retiredAt.UTC(), PurgeAfter: retiredAt.UTC().Add(MinimumRetirementGrace)}
+	data, err := json.Marshal(record)
+	if err != nil {
+		return err
+	}
+	temp, err := os.CreateTemp(s.dir, ".retirement-*.tmp")
+	if err != nil {
+		return fmt.Errorf("create artifact retirement temp record: %w", err)
+	}
+	tempPath := temp.Name()
+	defer os.Remove(tempPath) //nolint:errcheck
+	if err = temp.Chmod(0o600); err == nil {
+		_, err = temp.Write(data)
+	}
+	if err == nil {
+		err = temp.Sync()
+	}
+	closeErr := temp.Close()
+	if err == nil {
+		err = closeErr
+	}
+	if err != nil {
+		return fmt.Errorf("persist artifact retirement record: %w", err)
+	}
+	if err := os.Link(tempPath, s.pathForKey(key)); err != nil {
+		if errors.Is(err, os.ErrExist) {
+			existing, readErr := s.get(ctx, key)
+			if readErr != nil || existing.Identity != identity {
+				return ErrCorrupt
+			}
+			return nil
+		}
+		return fmt.Errorf("commit artifact retirement record: %w", err)
+	}
+	return syncDirectory(s.dir)
+}
+
+func (s *retirementStore) get(ctx context.Context, key string) (identityRetirement, error) {
+	if err := ctx.Err(); err != nil {
+		return identityRetirement{}, err
+	}
+	file, err := openFileNoFollow(s.pathForKey(key), os.O_RDONLY, 0)
+	if errors.Is(err, os.ErrNotExist) {
+		return identityRetirement{}, ErrNotFound
+	}
+	if err != nil {
+		return identityRetirement{}, fmt.Errorf("read artifact retirement record: %w", err)
+	}
+	defer file.Close() //nolint:errcheck
+	info, err := file.Stat()
+	if err != nil || !info.Mode().IsRegular() || info.Size() > retirementRecordMaxBytes {
+		return identityRetirement{}, ErrCorrupt
+	}
+	data, err := io.ReadAll(io.LimitReader(file, retirementRecordMaxBytes+1))
+	if err != nil || len(data) > retirementRecordMaxBytes {
+		return identityRetirement{}, ErrCorrupt
+	}
+	var record identityRetirement
+	if err := decodeStrictJSON(data, &record); err != nil || validateIdentityRetirement(record) != nil || identityStorageKey(record.Identity) != key {
+		return identityRetirement{}, ErrCorrupt
+	}
+	return record, nil
+}
+
+func (s *retirementStore) list(ctx context.Context) (map[string]identityRetirement, error) {
+	if err := ensurePrivateDirectory(s.dir); err != nil {
+		return nil, err
+	}
+	entries, err := os.ReadDir(s.dir)
+	if err != nil {
+		return nil, fmt.Errorf("list artifact retirement records: %w", err)
+	}
+	result := make(map[string]identityRetirement, len(entries))
+	for _, entry := range entries {
+		if err := ctx.Err(); err != nil {
+			return nil, err
+		}
+		name := entry.Name()
+		if strings.HasPrefix(name, ".retirement-") && strings.HasSuffix(name, ".tmp") {
+			if _, err := removeManagedRegularFile(filepath.Join(s.dir, name)); err != nil {
+				return nil, err
+			}
+			continue
+		}
+		if entry.IsDir() || len(name) != sha256.Size*2+len(".json") || !strings.HasSuffix(name, ".json") {
+			return nil, ErrCorrupt
+		}
+		key := strings.TrimSuffix(name, ".json")
+		if _, err := hex.DecodeString(key); err != nil {
+			return nil, ErrCorrupt
+		}
+		record, err := s.get(ctx, key)
+		if err != nil {
+			return nil, err
+		}
+		result[key] = record
+	}
+	return result, nil
+}
+
+func (s *retirementStore) pathForKey(key string) string {
+	return filepath.Join(s.dir, key+".json")
+}
+
+func validateIdentityRetirement(record identityRetirement) error {
+	if err := record.Identity.Validate(); err != nil {
+		return err
+	}
+	if record.RetiredAt.IsZero() || record.PurgeAfter.IsZero() || record.RetiredAt.Location() != time.UTC || record.PurgeAfter.Location() != time.UTC ||
+		record.PurgeAfter.Before(record.RetiredAt.Add(MinimumRetirementGrace)) {
+		return ErrCorrupt
+	}
+	return nil
+}
+
+func identityStorageKey(identity Identity) string {
+	kind := "publication"
+	value := identity.PublicationID
+	if identity.TaskID != "" {
+		kind = "task"
+		value = identity.TaskID
+	}
+	sum := sha256.Sum256([]byte(identity.Namespace + "\x00" + kind + "\x00" + value))
+	return hex.EncodeToString(sum[:])
+}
+
+func readOperationRecordFile(path string) (OperationRecord, error) {
+	file, err := openFileNoFollow(path, os.O_RDONLY, 0)
+	if errors.Is(err, os.ErrNotExist) {
+		return OperationRecord{}, ErrNotFound
+	}
+	if err != nil {
+		return OperationRecord{}, fmt.Errorf("read artifact operation record: %w", err)
+	}
+	defer file.Close() //nolint:errcheck
+	info, err := file.Stat()
+	if err != nil || !info.Mode().IsRegular() || info.Size() > operationRecordMaxBytes {
+		return OperationRecord{}, ErrCorrupt
+	}
+	data, err := io.ReadAll(io.LimitReader(file, operationRecordMaxBytes+1))
+	if err != nil || len(data) > operationRecordMaxBytes {
+		return OperationRecord{}, ErrCorrupt
+	}
+	var record OperationRecord
+	if err := decodeStrictJSON(data, &record); err != nil || validateOperationRecord(record, record.State) != nil {
+		return OperationRecord{}, ErrCorrupt
+	}
+	return record, nil
+}
+
+func removeManagedRegularFile(path string) (bool, error) {
+	info, err := os.Lstat(path)
+	if errors.Is(err, os.ErrNotExist) {
+		return false, nil
+	}
+	if err != nil {
+		return false, err
+	}
+	if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() {
+		return false, ErrUnsafePath
+	}
+	if err := os.Remove(path); err != nil {
+		return false, err
+	}
+	return true, nil
+}
+
+func sortedSet(values map[string]struct{}) []string {
+	result := make([]string, 0, len(values))
+	for value := range values {
+		result = append(result, value)
+	}
+	sort.Strings(result)
+	return result
+}
diff --git a/internal/artifactcap/retention_test.go b/internal/artifactcap/retention_test.go
new file mode 100644
index 000000000..f269642d8
--- /dev/null
+++ b/internal/artifactcap/retention_test.go
@@ -0,0 +1,707 @@
+package artifactcap
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestCollectorRetiresOnlyAfterGraceAndPreservesLateLiveReferences(t *testing.T) {
+	t.Parallel()
+	root := t.TempDir()
+	secret := []byte(strings.Repeat("r", MinSecretBytes))
+	now := time.Date(2026, 7, 29, 12, 0, 0, 0, time.UTC)
+	nowFn := func() time.Time { return now }
+	service, err := NewService(ServiceConfig{Root: root, Secret: secret, MaxObjectBytes: 1 << 20, Now: nowFn})
+	if err != nil {
+		t.Fatal(err)
+	}
+	collector, err := NewCollector(CollectorConfig{Root: root, Now: nowFn})
+	if err != nil {
+		t.Fatal(err)
+	}
+	taskA := Identity{Namespace: "default", TaskID: "task-a"}
+	taskB := Identity{Namespace: "default", TaskID: "task-b"}
+	unique := []byte("owned only by task a")
+	shared := []byte("shared content")
+	uploadArtifactForIdentity(t, service, secret, now, taskA, unique, "task-a-unique")
+	uploadArtifactForIdentity(t, service, secret, now, taskA, shared, "task-a-shared")
+
+	staleDownload := operationRequestForIdentity(OperationDownload, taskA, unique, "task-a-stale-download")
+	staleAuthorization := issueTestAuthorization(t, secret, staleDownload, now)
+	lateLiveDownload := operationRequestForIdentity(OperationDownload, taskB, shared, "task-b-download")
+	retiredAt := now
+	if err := collector.Retire(context.Background(), taskA); err != nil {
+		t.Fatal(err)
+	}
+
+	// Retirement blocks stale capabilities immediately but keeps bytes and replay
+	// records through the capability grace window.
+	assertArtifactPresence(t, root, DigestBytes(unique), true)
+	assertArtifactPresence(t, root, DigestBytes(shared), true)
+	assertOperationPresence(t, root, "task-a-unique", true)
+	assertOperationPresence(t, root, "task-a-shared", true)
+	if _, err := service.OpenDownload(context.Background(), staleAuthorization.Capability, present(staleDownload, staleAuthorization)); !errors.Is(err, ErrUnauthorized) {
+		t.Fatalf("retired identity download error = %v, want ErrUnauthorized", err)
+	}
+
+	// A different live identity can receive a capability late in the retirement
+	// grace window. Its persisted reservation keeps the shared digest live even
+	// though the transfer has not started yet.
+	now = retiredAt.Add(4 * time.Minute)
+	lateLiveAuthorization, err := Issue(secret, lateLiveDownload, now, MaxCapabilityTTL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := collector.Reserve(context.Background(), lateLiveDownload, now.Add(MaxCapabilityTTL+MaxClockSkew)); err != nil {
+		t.Fatal(err)
+	}
+	collector.lockTimeout = time.Second
+	now = retiredAt.Add(MinimumRetirementGrace + time.Second)
+	if err := collector.Sweep(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	assertArtifactPresence(t, root, DigestBytes(unique), false)
+	assertArtifactPresence(t, root, DigestBytes(shared), true)
+	assertOperationPresence(t, root, "task-a-unique", false)
+	assertOperationPresence(t, root, "task-a-shared", true)
+	assertOperationPresence(t, root, "task-b-download", false)
+
+	// Starting the reserved transfer creates the live replay reference that takes
+	// over once the capability reservation expires.
+	download, err := service.OpenDownload(context.Background(), lateLiveAuthorization.Capability, present(lateLiveDownload, lateLiveAuthorization))
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := io.ReadAll(download)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := download.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(got, shared) {
+		t.Fatalf("late live download = %q, want %q", got, shared)
+	}
+
+	now = retiredAt.Add(4*time.Minute + MaxCapabilityTTL + MaxClockSkew + time.Second)
+	if err := collector.Sweep(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	assertArtifactPresence(t, root, DigestBytes(shared), true)
+	assertOperationPresence(t, root, "task-a-shared", false)
+	assertOperationPresence(t, root, "task-b-download", true)
+
+	taskBRetiredAt := now
+	if err := collector.Retire(context.Background(), taskB); err != nil {
+		t.Fatal(err)
+	}
+	now = taskBRetiredAt.Add(MinimumRetirementGrace + time.Second)
+	if err := collector.Sweep(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	assertArtifactPresence(t, root, DigestBytes(shared), false)
+	assertOperationPresence(t, root, "task-b-download", false)
+	retirements, err := os.ReadDir(filepath.Join(root, "retirements"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(retirements) != 0 {
+		t.Fatalf("expired retirement records = %v, want none", retirements)
+	}
+}
+
+func TestCollectorKeepsOneReclamationAnchorPerReservedDigest(t *testing.T) {
+	t.Parallel()
+	root := t.TempDir()
+	secret := []byte(strings.Repeat("q", MinSecretBytes))
+	now := time.Date(2026, 7, 29, 12, 15, 0, 0, time.UTC)
+	nowFn := func() time.Time { return now }
+	service, err := NewService(ServiceConfig{Root: root, Secret: secret, MaxObjectBytes: 1 << 20, Now: nowFn})
+	if err != nil {
+		t.Fatal(err)
+	}
+	collector, err := NewCollector(CollectorConfig{Root: root, Now: nowFn})
+	if err != nil {
+		t.Fatal(err)
+	}
+	data := []byte("multiply referenced content")
+	ownerA := Identity{Namespace: "default", TaskID: "owner-a"}
+	ownerB := Identity{Namespace: "default", TaskID: "owner-b"}
+	uploadArtifactForIdentity(t, service, secret, now, ownerA, data, "owner-a-upload")
+	uploadArtifactForIdentity(t, service, secret, now, ownerB, data, "owner-b-upload")
+	retiredAt := now
+	if err := collector.Retire(context.Background(), ownerA, ownerB); err != nil {
+		t.Fatal(err)
+	}
+	now = retiredAt.Add(4 * time.Minute)
+	reader := Identity{Namespace: "default", TaskID: "future-reader"}
+	request := operationRequestForIdentity(OperationDownload, reader, data, "future-reader-download")
+	if err := collector.Reserve(context.Background(), request, now.Add(MaxCapabilityTTL+MaxClockSkew)); err != nil {
+		t.Fatal(err)
+	}
+	now = retiredAt.Add(MinimumRetirementGrace + time.Second)
+	if err := collector.Sweep(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	operations, err := os.ReadDir(filepath.Join(root, "operations"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(operations) != 1 {
+		t.Fatalf("retired replay anchors = %d, want one per reserved digest", len(operations))
+	}
+	retirements, err := os.ReadDir(filepath.Join(root, "retirements"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(retirements) != 1 {
+		t.Fatalf("blocked retirement tombstones = %d, want one per reserved digest", len(retirements))
+	}
+}
+
+func TestCollectorRejectsDownloadReservationAfterReclamation(t *testing.T) {
+	t.Parallel()
+	root := t.TempDir()
+	secret := []byte(strings.Repeat("m", MinSecretBytes))
+	now := time.Date(2026, 7, 29, 12, 30, 0, 0, time.UTC)
+	service, err := NewService(ServiceConfig{Root: root, Secret: secret, MaxObjectBytes: 1 << 20, Now: func() time.Time { return now }})
+	if err != nil {
+		t.Fatal(err)
+	}
+	collector, err := NewCollector(CollectorConfig{Root: root, Now: func() time.Time { return now }})
+	if err != nil {
+		t.Fatal(err)
+	}
+	owner := Identity{Namespace: "default", TaskID: "deleted-owner"}
+	data := []byte("reclaimed artifact")
+	uploadArtifactForIdentity(t, service, secret, now, owner, data, "deleted-owner-upload")
+	if err := collector.Retire(context.Background(), owner); err != nil {
+		t.Fatal(err)
+	}
+	now = now.Add(MinimumRetirementGrace + time.Second)
+	if err := collector.Sweep(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	request := operationRequestForIdentity(OperationDownload, Identity{Namespace: "default", TaskID: "late-reader"}, data, "late-reader-download")
+	if err := collector.Reserve(context.Background(), request, now.Add(time.Minute)); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("Reserve after object reclamation error = %v, want ErrNotFound", err)
+	}
+}
+
+func TestCollectorRetirementLockWaitIsBounded(t *testing.T) {
+	t.Parallel()
+	root := t.TempDir()
+	secret := []byte(strings.Repeat("w", MinSecretBytes))
+	now := time.Date(2026, 7, 29, 13, 0, 0, 0, time.UTC)
+	service, err := NewService(ServiceConfig{Root: root, Secret: secret, MaxObjectBytes: 1 << 20, Now: func() time.Time { return now }})
+	if err != nil {
+		t.Fatal(err)
+	}
+	collector, err := NewCollector(CollectorConfig{Root: root, LockTimeout: 25 * time.Millisecond, Now: func() time.Time { return now }})
+	if err != nil {
+		t.Fatal(err)
+	}
+	identity := Identity{Namespace: "default", PublicationID: "publication-in-flight"}
+	data := []byte("in-flight artifact")
+	request := operationRequestForIdentity(OperationUpload, identity, data, "in-flight-upload")
+	authorization := issueTestAuthorization(t, secret, request, now)
+	reader := &gatedReader{data: data, entered: make(chan struct{}), release: make(chan struct{})}
+	uploadDone := make(chan error, 1)
+	go func() {
+		_, err := service.Upload(context.Background(), authorization.Capability, present(request, authorization), reader)
+		uploadDone <- err
+	}()
+	<-reader.entered
+
+	retireDone := make(chan error, 1)
+	go func() { retireDone <- collector.Retire(context.Background(), identity) }()
+	select {
+	case err := <-retireDone:
+		if !errors.Is(err, context.DeadlineExceeded) {
+			t.Fatalf("Retire while upload held storage lock = %v, want deadline exceeded", err)
+		}
+	case <-time.After(time.Second):
+		t.Fatal("Retire did not honor bounded lock timeout")
+	}
+	close(reader.release)
+	if err := <-uploadDone; err != nil {
+		t.Fatal(err)
+	}
+	if err := collector.Retire(context.Background(), identity); err != nil {
+		t.Fatal(err)
+	}
+	assertArtifactPresence(t, root, request.ObjectDigest, true)
+	assertOperationPresence(t, root, request.OperationID, true)
+
+	collector.lockTimeout = time.Second
+	now = now.Add(MinimumRetirementGrace + time.Second)
+	if err := collector.Sweep(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	assertArtifactPresence(t, root, request.ObjectDigest, false)
+	assertOperationPresence(t, root, request.OperationID, false)
+}
+
+func TestCollectorWriterIntentBlocksNewTransfers(t *testing.T) {
+	t.Parallel()
+	root := t.TempDir()
+	secret := []byte(strings.Repeat("f", MinSecretBytes))
+	now := time.Date(2026, 7, 29, 14, 0, 0, 0, time.UTC)
+	service, err := NewService(ServiceConfig{Root: root, Secret: secret, MaxObjectBytes: 1 << 20, Now: func() time.Time { return now }})
+	if err != nil {
+		t.Fatal(err)
+	}
+	collector, err := NewCollector(CollectorConfig{Root: root, LockTimeout: time.Second, Now: func() time.Time { return now }})
+	if err != nil {
+		t.Fatal(err)
+	}
+	retiredIdentity := Identity{Namespace: "default", TaskID: "retired-writer"}
+	firstData := []byte("first transfer")
+	firstRequest := operationRequestForIdentity(OperationUpload, retiredIdentity, firstData, "first-transfer")
+	firstAuthorization := issueTestAuthorization(t, secret, firstRequest, now)
+	reader := &gatedReader{data: firstData, entered: make(chan struct{}), release: make(chan struct{})}
+	firstDone := make(chan error, 1)
+	go func() {
+		_, err := service.Upload(context.Background(), firstAuthorization.Capability, present(firstRequest, firstAuthorization), reader)
+		firstDone <- err
+	}()
+	<-reader.entered
+
+	retireDone := make(chan error, 1)
+	go func() { retireDone <- collector.Retire(context.Background(), retiredIdentity) }()
+	waitForArtifactWriterIntent(t, root)
+
+	liveIdentity := Identity{Namespace: "default", TaskID: "live-reader"}
+	secondData := []byte("second transfer")
+	secondRequest := operationRequestForIdentity(OperationUpload, liveIdentity, secondData, "second-transfer")
+	secondAuthorization := issueTestAuthorization(t, secret, secondRequest, now)
+	secondDone := make(chan error, 1)
+	go func() {
+		_, err := service.Upload(context.Background(), secondAuthorization.Capability, present(secondRequest, secondAuthorization), bytes.NewReader(secondData))
+		secondDone <- err
+	}()
+	select {
+	case err := <-secondDone:
+		t.Fatalf("new transfer bypassed queued retention writer: %v", err)
+	case <-time.After(50 * time.Millisecond):
+	}
+
+	close(reader.release)
+	if err := <-firstDone; err != nil {
+		t.Fatal(err)
+	}
+	if err := <-retireDone; err != nil {
+		t.Fatal(err)
+	}
+	if err := <-secondDone; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func waitForArtifactWriterIntent(t *testing.T, root string) {
+	t.Helper()
+	deadline := time.Now().Add(time.Second)
+	for time.Now().Before(deadline) {
+		if value, ok := artifactRootProcessGates.Load(root); ok {
+			gate := value.(*artifactRootProcessGate)
+			if !gate.semaphore.TryAcquire(1) {
+				return
+			}
+			gate.semaphore.Release(1)
+		}
+		time.Sleep(time.Millisecond)
+	}
+	t.Fatal("retention writer did not queue behind active transfer")
+}
+
+func TestArtifactWriterIntentBlocksReadersAcrossProcessGate(t *testing.T) {
+	t.Parallel()
+	root := t.TempDir()
+	_, releaseIntent, err := acquireArtifactWriterIntent(context.Background(), root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Millisecond)
+	defer cancel()
+	if _, err := acquireArtifactRootLock(ctx, root, false); !errors.Is(err, context.DeadlineExceeded) {
+		t.Fatalf("shared lock with writer intent error = %v, want deadline exceeded", err)
+	}
+	if err := releaseIntent(); err != nil {
+		t.Fatal(err)
+	}
+	release, err := acquireArtifactRootLock(context.Background(), root, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := release(); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestArtifactWriterIntentQueueIsFIFO(t *testing.T) {
+	t.Parallel()
+	root := t.TempDir()
+	firstPath, releaseFirst, err := acquireArtifactWriterIntent(context.Background(), root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	time.Sleep(2 * time.Millisecond)
+	secondPath, releaseSecond, err := acquireArtifactWriterIntent(context.Background(), root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer releaseSecond() //nolint:errcheck
+	if err := waitForArtifactWriterTurn(context.Background(), root, firstPath); err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Millisecond)
+	defer cancel()
+	if err := waitForArtifactWriterTurn(ctx, root, secondPath); !errors.Is(err, context.DeadlineExceeded) {
+		t.Fatalf("second writer turn error = %v, want deadline exceeded while first owns turn", err)
+	}
+	if err := releaseFirst(); err != nil {
+		t.Fatal(err)
+	}
+	if err := waitForArtifactWriterTurn(context.Background(), root, secondPath); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestArtifactManagedFilesRepairFSGroupPermissions(t *testing.T) {
+	t.Parallel()
+	root := t.TempDir()
+
+	_, releaseIntent, err := acquireArtifactWriterIntent(context.Background(), root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := releaseIntent(); err != nil {
+		t.Fatal(err)
+	}
+	for _, path := range []string{
+		filepath.Join(root, artifactWriterSequenceName),
+		filepath.Join(root, artifactWriterSequenceLockName),
+	} {
+		if err := os.Chmod(path, 0o660); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	intentPath, releaseIntent, err := acquireArtifactWriterIntent(context.Background(), root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		if releaseIntent != nil {
+			_ = releaseIntent()
+		}
+	})
+	for _, path := range []string{
+		filepath.Join(root, artifactWriterSequenceName),
+		filepath.Join(root, artifactWriterSequenceLockName),
+	} {
+		assertArtifactManagedFileMode(t, path)
+	}
+	if err := os.Chmod(intentPath, 0o660); err != nil {
+		t.Fatal(err)
+	}
+	queue, err := artifactWriterQueue(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(queue) != 1 || queue[0].path != intentPath {
+		t.Fatalf("writer queue = %#v, want active intent %q", queue, intentPath)
+	}
+	assertArtifactManagedFileMode(t, intentPath)
+	if err := releaseIntent(); err != nil {
+		t.Fatal(err)
+	}
+	releaseIntent = nil
+
+	lockPath := filepath.Join(root, artifactRootLockName)
+	if err := os.WriteFile(lockPath, nil, 0o660); err != nil {
+		t.Fatal(err)
+	}
+	releaseLock, err := acquireArtifactRootLock(context.Background(), root, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := releaseLock(); err != nil {
+		t.Fatal(err)
+	}
+	assertArtifactManagedFileMode(t, lockPath)
+}
+
+func TestCollectorRepairsFSGroupManagedFilesAcrossLifecycle(t *testing.T) {
+	t.Parallel()
+	root := t.TempDir()
+	now := time.Date(2026, 8, 10, 9, 0, 0, 0, time.UTC)
+	collector, err := NewCollector(CollectorConfig{Root: root, Now: func() time.Time { return now }})
+	if err != nil {
+		t.Fatal(err)
+	}
+	identity := Identity{Namespace: "orka-system", TaskID: "task-fsgroup-restart"}
+	reserve := func(operationID string) {
+		t.Helper()
+		request := operationRequestForIdentity(OperationUpload, identity, []byte(operationID), operationID)
+		if err := collector.Reserve(context.Background(), request, now.Add(time.Minute)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	managedPaths := []string{
+		filepath.Join(root, artifactRootLockName),
+		filepath.Join(root, artifactWriterSequenceName),
+		filepath.Join(root, artifactWriterSequenceLockName),
+	}
+	chmodManaged := func() {
+		t.Helper()
+		for _, path := range managedPaths {
+			if err := os.Chmod(path, 0o660); err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
+	assertRepaired := func() {
+		t.Helper()
+		for _, path := range managedPaths {
+			assertArtifactManagedFileMode(t, path)
+		}
+	}
+
+	reserve("reserve-before-restart")
+	chmodManaged()
+	reserve("reserve-after-restart")
+	assertRepaired()
+	chmodManaged()
+	if err := collector.Sweep(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	assertRepaired()
+	chmodManaged()
+	if err := collector.Retire(context.Background(), identity); err != nil {
+		t.Fatal(err)
+	}
+	assertRepaired()
+}
+
+func TestArtifactManagedFilesRejectWorldPermissions(t *testing.T) {
+	t.Parallel()
+	createWithMode := func(t *testing.T, path string, data []byte, mode os.FileMode) {
+		t.Helper()
+		if err := os.WriteFile(path, data, 0o600); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.Chmod(path, mode); err != nil {
+			t.Fatal(err)
+		}
+	}
+	t.Run("sequence lock", func(t *testing.T) {
+		root := t.TempDir()
+		createWithMode(t, filepath.Join(root, artifactWriterSequenceLockName), nil, 0o606)
+		if _, _, err := acquireArtifactWriterIntent(context.Background(), root); !errors.Is(err, ErrUnsafePath) {
+			t.Fatalf("writer intent error = %v, want ErrUnsafePath", err)
+		}
+	})
+	t.Run("sequence", func(t *testing.T) {
+		root := t.TempDir()
+		createWithMode(t, filepath.Join(root, artifactWriterSequenceLockName), nil, 0o600)
+		createWithMode(t, filepath.Join(root, artifactWriterSequenceName), []byte("1\n"), 0o606)
+		if _, _, err := acquireArtifactWriterIntent(context.Background(), root); !errors.Is(err, ErrUnsafePath) {
+			t.Fatalf("writer intent error = %v, want ErrUnsafePath", err)
+		}
+	})
+	t.Run("root lock", func(t *testing.T) {
+		root := t.TempDir()
+		createWithMode(t, filepath.Join(root, artifactRootLockName), nil, 0o606)
+		if _, err := acquireArtifactRootLock(context.Background(), root, false); !errors.Is(err, ErrUnsafePath) {
+			t.Fatalf("root lock error = %v, want ErrUnsafePath", err)
+		}
+	})
+	t.Run("intent", func(t *testing.T) {
+		root := t.TempDir()
+		name := artifactWriterIntentPrefix + "00000000000000000001-test" + artifactWriterIntentSuffix
+		createWithMode(t, filepath.Join(root, name), []byte("1\n"), 0o606)
+		if _, err := artifactWriterQueue(root); !errors.Is(err, ErrUnsafePath) {
+			t.Fatalf("writer queue error = %v, want ErrUnsafePath", err)
+		}
+	})
+}
+
+func TestArtifactManagedFilesRejectSymlinkAndNonRegularEntries(t *testing.T) {
+	t.Parallel()
+	t.Run("sequence lock symlink", func(t *testing.T) {
+		root := t.TempDir()
+		target := filepath.Join(root, "target")
+		if err := os.WriteFile(target, nil, 0o600); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.Symlink(target, filepath.Join(root, artifactWriterSequenceLockName)); err != nil {
+			t.Fatal(err)
+		}
+		if _, _, err := acquireArtifactWriterIntent(context.Background(), root); err == nil {
+			t.Fatal("writer intent accepted a symlink sequence lock")
+		}
+	})
+	t.Run("sequence symlink", func(t *testing.T) {
+		root := t.TempDir()
+		target := filepath.Join(root, "target")
+		if err := os.WriteFile(target, []byte("1\n"), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(root, artifactWriterSequenceLockName), nil, 0o600); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.Symlink(target, filepath.Join(root, artifactWriterSequenceName)); err != nil {
+			t.Fatal(err)
+		}
+		if _, _, err := acquireArtifactWriterIntent(context.Background(), root); err == nil {
+			t.Fatal("writer intent accepted a symlink sequence")
+		}
+	})
+	t.Run("root lock symlink", func(t *testing.T) {
+		root := t.TempDir()
+		target := filepath.Join(root, "target")
+		if err := os.WriteFile(target, nil, 0o600); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.Symlink(target, filepath.Join(root, artifactRootLockName)); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := acquireArtifactRootLock(context.Background(), root, false); err == nil {
+			t.Fatal("root lock accepted a symlink lock file")
+		}
+	})
+	t.Run("sequence lock directory", func(t *testing.T) {
+		root := t.TempDir()
+		if err := os.Mkdir(filepath.Join(root, artifactWriterSequenceLockName), 0o700); err != nil {
+			t.Fatal(err)
+		}
+		if _, _, err := acquireArtifactWriterIntent(context.Background(), root); err == nil {
+			t.Fatal("writer intent accepted a non-regular sequence lock")
+		}
+	})
+	t.Run("sequence directory", func(t *testing.T) {
+		root := t.TempDir()
+		if err := os.WriteFile(filepath.Join(root, artifactWriterSequenceLockName), nil, 0o600); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.Mkdir(filepath.Join(root, artifactWriterSequenceName), 0o700); err != nil {
+			t.Fatal(err)
+		}
+		if _, _, err := acquireArtifactWriterIntent(context.Background(), root); err == nil {
+			t.Fatal("writer intent accepted a non-regular sequence")
+		}
+	})
+	t.Run("root lock directory", func(t *testing.T) {
+		root := t.TempDir()
+		if err := os.Mkdir(filepath.Join(root, artifactRootLockName), 0o700); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := acquireArtifactRootLock(context.Background(), root, false); err == nil {
+			t.Fatal("root lock accepted a non-regular lock file")
+		}
+	})
+	t.Run("intent symlink", func(t *testing.T) {
+		root := t.TempDir()
+		target := filepath.Join(root, "target")
+		if err := os.WriteFile(target, []byte("1\n"), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		name := artifactWriterIntentPrefix + "00000000000000000001-test" + artifactWriterIntentSuffix
+		if err := os.Symlink(target, filepath.Join(root, name)); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := artifactWriterQueue(root); err == nil {
+			t.Fatal("writer queue accepted a symlink intent entry")
+		}
+	})
+	t.Run("intent directory", func(t *testing.T) {
+		root := t.TempDir()
+		name := artifactWriterIntentPrefix + "00000000000000000001-test" + artifactWriterIntentSuffix
+		if err := os.Mkdir(filepath.Join(root, name), 0o700); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := artifactWriterQueue(root); err == nil {
+			t.Fatal("writer queue accepted a non-regular intent entry")
+		}
+	})
+}
+
+func assertArtifactManagedFileMode(t *testing.T, path string) {
+	t.Helper()
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := info.Mode().Perm(); got != 0o600 {
+		t.Fatalf("%s mode = %04o, want 0600", path, got)
+	}
+}
+
+func uploadArtifactForIdentity(t *testing.T, service *Service, secret []byte, now time.Time, identity Identity, data []byte, operationID string) {
+	t.Helper()
+	request := operationRequestForIdentity(OperationUpload, identity, data, operationID)
+	authorization := issueTestAuthorization(t, secret, request, now)
+	if _, err := service.Upload(context.Background(), authorization.Capability, present(request, authorization), bytes.NewReader(data)); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func operationRequestForIdentity(operation Operation, identity Identity, data []byte, operationID string) OperationRequest {
+	return OperationRequest{
+		Operation: operation, ObjectDigest: DigestBytes(data), Identity: identity,
+		ContentLength: int64(len(data)), MediaType: "application/octet-stream", OperationID: operationID,
+	}
+}
+
+func assertArtifactPresence(t *testing.T, root, digest string, want bool) {
+	t.Helper()
+	hexDigest, err := DigestHex(digest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, path := range []string{filepath.Join(root, "objects", hexDigest), filepath.Join(root, "metadata", hexDigest+".json")} {
+		_, err := os.Stat(path)
+		if want && err != nil {
+			t.Fatalf("expected artifact path %s: %v", path, err)
+		}
+		if !want && !errors.Is(err, os.ErrNotExist) {
+			t.Fatalf("retired artifact path %s still exists or returned unexpected error: %v", path, err)
+		}
+	}
+}
+
+func assertOperationPresence(t *testing.T, root, operationID string, want bool) {
+	t.Helper()
+	_, err := os.Stat(filepath.Join(root, "operations", operationRecordName(operationID)))
+	if want && err != nil {
+		t.Fatalf("expected operation %q: %v", operationID, err)
+	}
+	if !want && !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("retired operation %q still exists or returned unexpected error: %v", operationID, err)
+	}
+}
+
+type gatedReader struct {
+	data    []byte
+	entered chan struct{}
+	release chan struct{}
+	done    bool
+}
+
+func (r *gatedReader) Read(buffer []byte) (int, error) {
+	if r.done {
+		return 0, io.EOF
+	}
+	r.done = true
+	close(r.entered)
+	<-r.release
+	return copy(buffer, r.data), nil
+}
diff --git a/internal/artifactcap/root_lock_gate.go b/internal/artifactcap/root_lock_gate.go
new file mode 100644
index 000000000..5eebdfd4b
--- /dev/null
+++ b/internal/artifactcap/root_lock_gate.go
@@ -0,0 +1,34 @@
+package artifactcap
+
+import (
+	"context"
+	"sync"
+
+	"golang.org/x/sync/semaphore"
+)
+
+const artifactRootReaderWeight int64 = 1 << 20
+
+var artifactRootProcessGates sync.Map
+
+type artifactRootProcessGate struct {
+	semaphore *semaphore.Weighted
+}
+
+func acquireArtifactProcessGate(ctx context.Context, root string, exclusive bool) (func() error, error) {
+	value, _ := artifactRootProcessGates.LoadOrStore(root, &artifactRootProcessGate{
+		semaphore: semaphore.NewWeighted(artifactRootReaderWeight),
+	})
+	gate := value.(*artifactRootProcessGate)
+	weight := int64(1)
+	if exclusive {
+		weight = artifactRootReaderWeight
+	}
+	if err := gate.semaphore.Acquire(ctx, weight); err != nil {
+		return nil, err
+	}
+	return func() error {
+		gate.semaphore.Release(weight)
+		return nil
+	}, nil
+}
diff --git a/internal/artifactcap/root_lock_other.go b/internal/artifactcap/root_lock_other.go
new file mode 100644
index 000000000..9f44422d7
--- /dev/null
+++ b/internal/artifactcap/root_lock_other.go
@@ -0,0 +1,9 @@
+//go:build !darwin && !linux
+
+package artifactcap
+
+import "context"
+
+func acquireArtifactRootLock(ctx context.Context, root string, exclusive bool) (func() error, error) {
+	return acquireArtifactProcessGate(ctx, root, exclusive)
+}
diff --git a/internal/artifactcap/root_lock_unix.go b/internal/artifactcap/root_lock_unix.go
new file mode 100644
index 000000000..2edd97f28
--- /dev/null
+++ b/internal/artifactcap/root_lock_unix.go
@@ -0,0 +1,419 @@
+//go:build darwin || linux
+
+package artifactcap
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"golang.org/x/sys/unix"
+)
+
+const (
+	artifactRootLockRetryInterval  = 10 * time.Millisecond
+	artifactWriterIntentPrefix     = ".retention-writer-"
+	artifactWriterIntentSuffix     = ".intent"
+	artifactWriterSequenceName     = ".retention-writer-sequence"
+	artifactWriterSequenceLockName = ".retention-writer-sequence.lock"
+	artifactRootLockName           = ".retention.lock"
+)
+
+func acquireArtifactRootLock(ctx context.Context, root string, exclusive bool) (func() error, error) {
+	releaseGate, err := acquireArtifactProcessGate(ctx, root, exclusive)
+	if err != nil {
+		return nil, err
+	}
+	var releaseIntent func() error
+	if exclusive {
+		var intentPath string
+		intentPath, releaseIntent, err = acquireArtifactWriterIntent(ctx, root)
+		if err == nil {
+			err = waitForArtifactWriterTurn(ctx, root, intentPath)
+		}
+	} else {
+		err = waitForNoArtifactWriterIntent(ctx, root)
+	}
+	if err != nil {
+		_ = releaseGate()
+		return nil, err
+	}
+	cleanupIntentAndGate := func() {
+		if releaseIntent != nil {
+			_ = releaseIntent()
+		}
+		_ = releaseGate()
+	}
+
+	file, err := openFileNoFollow(filepath.Join(root, artifactRootLockName), os.O_CREATE|os.O_RDWR, 0o600)
+	if err != nil {
+		cleanupIntentAndGate()
+		return nil, fmt.Errorf("open artifact retention lock: %w", err)
+	}
+	if _, err := secureManagedArtifactFile(file, "artifact retention lock"); err != nil {
+		_ = file.Close()
+		cleanupIntentAndGate()
+		return nil, err
+	}
+	operation := unix.LOCK_SH | unix.LOCK_NB
+	if exclusive {
+		operation = unix.LOCK_EX | unix.LOCK_NB
+	}
+	for {
+		err = unix.Flock(int(file.Fd()), operation)
+		if err == nil {
+			return func() error {
+				unlockErr := unix.Flock(int(file.Fd()), unix.LOCK_UN)
+				closeErr := file.Close()
+				var intentErr error
+				if releaseIntent != nil {
+					intentErr = releaseIntent()
+				}
+				gateErr := releaseGate()
+				return errors.Join(unlockErr, closeErr, intentErr, gateErr)
+			}, nil
+		}
+		if !errors.Is(err, unix.EWOULDBLOCK) && !errors.Is(err, unix.EAGAIN) && !errors.Is(err, unix.EINTR) {
+			_ = file.Close()
+			cleanupIntentAndGate()
+			return nil, fmt.Errorf("lock artifact storage: %w", err)
+		}
+		if err := waitArtifactLockRetry(ctx); err != nil {
+			_ = file.Close()
+			cleanupIntentAndGate()
+			return nil, err
+		}
+	}
+}
+
+func acquireArtifactWriterIntent(ctx context.Context, root string) (string, func() error, error) {
+	if err := ctx.Err(); err != nil {
+		return "", nil, err
+	}
+	pendingDir := filepath.Join(root, "tmp")
+	if err := ensurePrivateDirectory(pendingDir); err != nil {
+		return "", nil, err
+	}
+	pending, err := os.CreateTemp(pendingDir, ".retention-writer-pending-*.tmp")
+	if err != nil {
+		return "", nil, fmt.Errorf("create artifact writer intent: %w", err)
+	}
+	pendingPath := pending.Name()
+	cleanupPending := func() {
+		_ = pending.Close()
+		_ = os.Remove(pendingPath)
+	}
+	if err := pending.Chmod(0o600); err != nil {
+		cleanupPending()
+		return "", nil, err
+	}
+	if err := unix.Flock(int(pending.Fd()), unix.LOCK_EX|unix.LOCK_NB); err != nil {
+		cleanupPending()
+		return "", nil, err
+	}
+	if _, err := fmt.Fprintf(pending, "%d\n", os.Getpid()); err != nil {
+		_ = unix.Flock(int(pending.Fd()), unix.LOCK_UN)
+		cleanupPending()
+		return "", nil, err
+	}
+	if err := pending.Sync(); err != nil {
+		_ = unix.Flock(int(pending.Fd()), unix.LOCK_UN)
+		cleanupPending()
+		return "", nil, err
+	}
+	base := filepath.Base(pendingPath)
+	nonce := strings.TrimSuffix(strings.TrimPrefix(base, ".retention-writer-pending-"), ".tmp")
+	intentPath, err := publishArtifactWriterIntent(ctx, root, pendingPath, nonce)
+	if err != nil {
+		_ = unix.Flock(int(pending.Fd()), unix.LOCK_UN)
+		cleanupPending()
+		return "", nil, err
+	}
+	return intentPath, func() error {
+		unlockErr := unix.Flock(int(pending.Fd()), unix.LOCK_UN)
+		closeErr := pending.Close()
+		removed, removeErr := removeManagedRegularFile(intentPath)
+		var syncErr error
+		if removed {
+			syncErr = syncDirectory(root)
+		}
+		return errors.Join(unlockErr, closeErr, removeErr, syncErr)
+	}, nil
+}
+
+func waitForArtifactWriterTurn(ctx context.Context, root, intentPath string) error {
+	for {
+		queue, err := artifactWriterQueue(root)
+		if err != nil {
+			return err
+		}
+		if len(queue) == 0 {
+			return ErrUnsafePath
+		}
+		if queue[0].path == intentPath {
+			return nil
+		}
+		if err := waitArtifactLockRetry(ctx); err != nil {
+			return err
+		}
+	}
+}
+
+type artifactWriterMarker struct {
+	path   string
+	name   string
+	ticket uint64
+}
+
+func waitForNoArtifactWriterIntent(ctx context.Context, root string) error {
+	for {
+		active, err := activeArtifactWriterIntent(root)
+		if err != nil {
+			return err
+		}
+		if !active {
+			return nil
+		}
+		if err := waitArtifactLockRetry(ctx); err != nil {
+			return err
+		}
+	}
+}
+
+func activeArtifactWriterIntent(root string) (bool, error) {
+	queue, err := artifactWriterQueue(root)
+	return len(queue) > 0, err
+}
+
+func artifactWriterQueue(root string) ([]artifactWriterMarker, error) {
+	entries, err := os.ReadDir(root)
+	if err != nil {
+		return nil, err
+	}
+	removed := false
+	queue := make([]artifactWriterMarker, 0)
+	for _, entry := range entries {
+		name := entry.Name()
+		isIntent := strings.HasPrefix(name, artifactWriterIntentPrefix) && strings.HasSuffix(name, artifactWriterIntentSuffix)
+		if !isIntent {
+			continue
+		}
+		path := filepath.Join(root, name)
+		ticket, err := artifactWriterTicket(name)
+		if err != nil {
+			return nil, err
+		}
+		active, stale, err := inspectArtifactWriterMarker(path)
+		if err != nil {
+			return nil, err
+		}
+		if active {
+			queue = append(queue, artifactWriterMarker{path: path, name: name, ticket: ticket})
+			continue
+		}
+		if stale {
+			deleted, err := removeManagedRegularFile(path)
+			if err != nil {
+				return nil, err
+			}
+			removed = removed || deleted
+		}
+	}
+	if removed {
+		if err := syncDirectory(root); err != nil {
+			return nil, err
+		}
+	}
+	sort.Slice(queue, func(i, j int) bool {
+		if queue[i].ticket == queue[j].ticket {
+			return queue[i].name < queue[j].name
+		}
+		return queue[i].ticket < queue[j].ticket
+	})
+	return queue, nil
+}
+
+func publishArtifactWriterIntent(ctx context.Context, root, pendingPath, nonce string) (string, error) {
+	lockPath := filepath.Join(root, artifactWriterSequenceLockName)
+	lockFile, err := openFileNoFollow(lockPath, os.O_CREATE|os.O_RDWR, 0o600)
+	if err != nil {
+		return "", err
+	}
+	defer lockFile.Close() //nolint:errcheck
+	if _, err := secureManagedArtifactFile(lockFile, "artifact writer sequence lock"); err != nil {
+		return "", err
+	}
+	for {
+		err = unix.Flock(int(lockFile.Fd()), unix.LOCK_EX|unix.LOCK_NB)
+		if err == nil {
+			break
+		}
+		if !errors.Is(err, unix.EWOULDBLOCK) && !errors.Is(err, unix.EAGAIN) && !errors.Is(err, unix.EINTR) {
+			return "", err
+		}
+		if err := waitArtifactLockRetry(ctx); err != nil {
+			return "", err
+		}
+	}
+	defer unix.Flock(int(lockFile.Fd()), unix.LOCK_UN) //nolint:errcheck
+
+	ticket, err := nextArtifactWriterTicket(root)
+	if err != nil {
+		return "", err
+	}
+	intentName := fmt.Sprintf("%s%020d-%s%s", artifactWriterIntentPrefix, ticket, nonce, artifactWriterIntentSuffix)
+	intentPath := filepath.Join(root, intentName)
+	if err := os.Rename(pendingPath, intentPath); err != nil {
+		return "", err
+	}
+	if err := syncDirectory(root); err != nil {
+		_ = os.Remove(intentPath)
+		return "", err
+	}
+	return intentPath, nil
+}
+
+func nextArtifactWriterTicket(root string) (uint64, error) {
+	sequencePath := filepath.Join(root, artifactWriterSequenceName)
+	current := uint64(0)
+	sequence, err := openFileNoFollow(sequencePath, os.O_RDONLY, 0)
+	if err == nil {
+		info, statErr := secureManagedArtifactFile(sequence, "artifact writer sequence")
+		if statErr != nil || info.Size() > 32 {
+			_ = sequence.Close()
+			if statErr != nil {
+				return 0, statErr
+			}
+			return 0, ErrUnsafePath
+		}
+		data, readErr := io.ReadAll(io.LimitReader(sequence, 33))
+		closeErr := sequence.Close()
+		if readErr != nil || closeErr != nil || len(data) > 32 {
+			return 0, ErrCorrupt
+		}
+		current, err = strconv.ParseUint(strings.TrimSpace(string(data)), 10, 64)
+		if err != nil {
+			return 0, ErrCorrupt
+		}
+	} else if !errors.Is(err, os.ErrNotExist) {
+		return 0, err
+	}
+	if current == ^uint64(0) {
+		return 0, ErrCorrupt
+	}
+	next := current + 1
+	temp, err := os.CreateTemp(root, ".retention-writer-sequence-*.tmp")
+	if err != nil {
+		return 0, err
+	}
+	tempPath := temp.Name()
+	defer os.Remove(tempPath) //nolint:errcheck
+	if err = temp.Chmod(0o600); err == nil {
+		_, err = fmt.Fprintf(temp, "%d\n", next)
+	}
+	if err == nil {
+		err = temp.Sync()
+	}
+	closeErr := temp.Close()
+	if err == nil {
+		err = closeErr
+	}
+	if err != nil {
+		return 0, err
+	}
+	if err := os.Rename(tempPath, sequencePath); err != nil {
+		return 0, err
+	}
+	if err := syncDirectory(root); err != nil {
+		return 0, err
+	}
+	return next, nil
+}
+
+func artifactWriterTicket(name string) (uint64, error) {
+	trimmed := strings.TrimSuffix(strings.TrimPrefix(name, artifactWriterIntentPrefix), artifactWriterIntentSuffix)
+	parts := strings.SplitN(trimmed, "-", 2)
+	if len(parts) != 2 || len(parts[0]) != 20 || parts[1] == "" {
+		return 0, ErrCorrupt
+	}
+	ticket, err := strconv.ParseUint(parts[0], 10, 64)
+	if err != nil || ticket == 0 {
+		return 0, ErrCorrupt
+	}
+	return ticket, nil
+}
+
+func inspectArtifactWriterMarker(path string) (active, stale bool, err error) {
+	file, err := openFileNoFollow(path, os.O_RDWR, 0)
+	if errors.Is(err, os.ErrNotExist) {
+		return false, false, nil
+	}
+	if err != nil {
+		return false, false, err
+	}
+	defer file.Close() //nolint:errcheck
+	if _, err := secureManagedArtifactFile(file, "artifact writer intent"); err != nil {
+		return false, false, err
+	}
+	if err := unix.Flock(int(file.Fd()), unix.LOCK_EX|unix.LOCK_NB); err != nil {
+		if errors.Is(err, unix.EWOULDBLOCK) || errors.Is(err, unix.EAGAIN) || errors.Is(err, unix.EINTR) {
+			return true, false, nil
+		}
+		return false, false, err
+	}
+	if err := unix.Flock(int(file.Fd()), unix.LOCK_UN); err != nil {
+		return false, false, err
+	}
+	return false, true, nil
+}
+
+func waitArtifactLockRetry(ctx context.Context) error {
+	timer := time.NewTimer(artifactRootLockRetryInterval)
+	defer timer.Stop()
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case <-timer.C:
+		return nil
+	}
+}
+
+// secureManagedArtifactFile repairs group permission bits that a Kubernetes
+// fsGroup volume mount can add to an existing controller-owned regular file.
+// Other-accessible files remain fail-closed. The file is already opened with
+// O_NOFOLLOW, and chmod operates on that descriptor, so symlinks and
+// non-regular replacements remain fail-closed.
+func secureManagedArtifactFile(file *os.File, description string) (os.FileInfo, error) {
+	info, err := file.Stat()
+	if err != nil {
+		return nil, fmt.Errorf("inspect %s: %w", description, err)
+	}
+	if !info.Mode().IsRegular() {
+		return nil, ErrUnsafePath
+	}
+	permissions := info.Mode().Perm()
+	if permissions&0o007 != 0 {
+		return nil, ErrUnsafePath
+	}
+	if permissions&0o070 == 0 {
+		return info, nil
+	}
+	if err := file.Chmod(0o600); err != nil {
+		return nil, fmt.Errorf("secure %s: %w", description, err)
+	}
+	info, err = file.Stat()
+	if err != nil {
+		return nil, fmt.Errorf("verify %s permissions: %w", description, err)
+	}
+	if !info.Mode().IsRegular() || info.Mode().Perm()&0o077 != 0 {
+		return nil, ErrUnsafePath
+	}
+	return info, nil
+}
diff --git a/internal/artifactcap/service.go b/internal/artifactcap/service.go
new file mode 100644
index 000000000..863bfa852
--- /dev/null
+++ b/internal/artifactcap/service.go
@@ -0,0 +1,258 @@
+package artifactcap
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"sync"
+	"time"
+)
+
+type ServiceConfig struct {
+	Root           string
+	Secret         []byte
+	MaxObjectBytes int64
+	Now            func() time.Time
+}
+
+type Service struct {
+	secret      []byte
+	store       *FileObjectStore
+	ledger      *FileLedger
+	retirements *retirementStore
+	now         func() time.Time
+}
+
+func NewService(config ServiceConfig) (*Service, error) {
+	if len(config.Secret) < MinSecretBytes {
+		return nil, ErrUnauthorized
+	}
+	objectStore, err := NewFileObjectStore(config.Root, config.MaxObjectBytes)
+	if err != nil {
+		return nil, err
+	}
+	ledger, err := NewFileLedger(config.Root)
+	if err != nil {
+		return nil, err
+	}
+	retirements, err := newRetirementStore(config.Root)
+	if err != nil {
+		return nil, err
+	}
+	now := config.Now
+	if now == nil {
+		now = func() time.Time { return time.Now().UTC() }
+	}
+	return &Service{
+		secret: append([]byte(nil), config.Secret...), store: objectStore, ledger: ledger, retirements: retirements, now: now,
+	}, nil
+}
+
+func (s *Service) Upload(ctx context.Context, token string, request PresentedRequest, body io.Reader) (Artifact, error) {
+	claims, err := Verify(s.secret, token, request, s.now())
+	if err != nil {
+		return Artifact{}, err
+	}
+	if claims.Request.Operation != OperationUpload {
+		return Artifact{}, ErrUnauthorized
+	}
+	release, err := acquireArtifactRootLock(ctx, s.store.root, false)
+	if err != nil {
+		return Artifact{}, err
+	}
+	defer func() { _ = release() }()
+	retired, err := s.retirements.isRetired(ctx, claims.Request.Identity)
+	if err != nil {
+		return Artifact{}, err
+	}
+	if retired {
+		return Artifact{}, ErrUnauthorized
+	}
+	record := newOperationRecord(claims, s.now())
+	if err := s.ledger.Begin(ctx, record); err != nil {
+		return Artifact{}, err
+	}
+	artifact, putErr := s.store.Put(ctx, claims.Request, body, s.now())
+	if putErr != nil {
+		s.finish(record, OperationFailed, failureCode(putErr))
+		return Artifact{}, putErr
+	}
+	if err := s.ledger.Finish(context.WithoutCancel(ctx), record.OperationID, record.RequestDigest, OperationCompleted, "", s.now()); err != nil {
+		return Artifact{}, fmt.Errorf("finalize artifact upload operation: %w", err)
+	}
+	return artifact, nil
+}
+
+func (s *Service) OpenDownload(ctx context.Context, token string, request PresentedRequest) (*Download, error) {
+	claims, err := Verify(s.secret, token, request, s.now())
+	if err != nil {
+		return nil, err
+	}
+	if claims.Request.Operation != OperationDownload {
+		return nil, ErrUnauthorized
+	}
+	release, err := acquireArtifactRootLock(ctx, s.store.root, false)
+	if err != nil {
+		return nil, err
+	}
+	releaseOnError := true
+	defer func() {
+		if releaseOnError {
+			_ = release()
+		}
+	}()
+	retired, err := s.retirements.isRetired(ctx, claims.Request.Identity)
+	if err != nil {
+		return nil, err
+	}
+	if retired {
+		return nil, ErrUnauthorized
+	}
+	record := newOperationRecord(claims, s.now())
+	if err := s.ledger.Begin(ctx, record); err != nil {
+		return nil, err
+	}
+	file, artifact, openErr := s.store.OpenVerified(ctx, claims.Request)
+	if openErr != nil {
+		s.finish(record, OperationFailed, failureCode(openErr))
+		return nil, openErr
+	}
+	releaseOnError = false
+	return &Download{
+		Artifact: artifact, file: file, ledger: s.ledger, record: record, now: s.now, releaseStorage: release,
+	}, nil
+}
+
+func (s *Service) finish(record OperationRecord, state OperationState, code string) {
+	_ = s.ledger.Finish(context.Background(), record.OperationID, record.RequestDigest, state, code, s.now())
+}
+
+func newOperationRecord(claims CapabilityClaims, now time.Time) OperationRecord {
+	return OperationRecord{
+		OperationID:   claims.Request.OperationID,
+		RequestDigest: claims.RequestDigest,
+		Request:       claims.Request,
+		State:         OperationStarted,
+		StartedAt:     now.UTC(),
+	}
+}
+
+func failureCode(err error) string {
+	switch {
+	case errors.Is(err, ErrTooLarge):
+		return "too_large"
+	case errors.Is(err, ErrPartialUpload):
+		return "partial_upload"
+	case errors.Is(err, ErrDigestMismatch):
+		return "digest_mismatch"
+	case errors.Is(err, ErrNotFound):
+		return "not_found"
+	case errors.Is(err, ErrUnsafePath):
+		return "unsafe_path"
+	case errors.Is(err, ErrCorrupt):
+		return "corrupt"
+	default:
+		return "io_failure"
+	}
+}
+
+type Download struct {
+	Artifact Artifact
+
+	file   *os.File
+	ledger *FileLedger
+	record OperationRecord
+	now    func() time.Time
+
+	mu             sync.Mutex
+	readBytes      int64
+	finished       bool
+	finishErr      error
+	releaseStorage func() error
+	releaseOnce    sync.Once
+	releaseErr     error
+}
+
+func (d *Download) Read(buffer []byte) (int, error) {
+	d.mu.Lock()
+	if d.finished {
+		err := d.finishErr
+		d.mu.Unlock()
+		if err != nil {
+			return 0, err
+		}
+		return 0, io.EOF
+	}
+	d.mu.Unlock()
+
+	n, err := d.file.Read(buffer)
+	d.mu.Lock()
+	d.readBytes += int64(n)
+	readBytes := d.readBytes
+	d.mu.Unlock()
+	if readBytes > d.Artifact.SizeBytes {
+		return n, d.finish(OperationFailed, "length_mismatch", ErrCorrupt)
+	}
+	if readBytes == d.Artifact.SizeBytes && err == nil {
+		if finishErr := d.finish(OperationCompleted, "", nil); finishErr != nil {
+			return n, finishErr
+		}
+	}
+	if errors.Is(err, io.EOF) {
+		if readBytes != d.Artifact.SizeBytes {
+			return n, d.finish(OperationFailed, "partial_download", ErrCorrupt)
+		}
+		finishErr := d.finish(OperationCompleted, "", nil)
+		if finishErr != nil {
+			return n, finishErr
+		}
+	}
+	if err != nil && !errors.Is(err, io.EOF) {
+		return n, d.finish(OperationFailed, "io_failure", err)
+	}
+	return n, err
+}
+
+func (d *Download) Close() error {
+	d.mu.Lock()
+	readBytes := d.readBytes
+	finished := d.finished
+	finishErr := d.finishErr
+	d.mu.Unlock()
+	if !finished {
+		state := OperationFailed
+		code := "partial_download"
+		if readBytes == d.Artifact.SizeBytes {
+			state = OperationCompleted
+			code = ""
+		}
+		finishErr = d.finish(state, code, nil)
+	}
+	closeErr := d.file.Close()
+	d.releaseOnce.Do(func() {
+		if d.releaseStorage != nil {
+			d.releaseErr = d.releaseStorage()
+		}
+	})
+	return errors.Join(finishErr, closeErr, d.releaseErr)
+}
+
+func (d *Download) finish(state OperationState, code string, cause error) error {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	if d.finished {
+		if d.finishErr != nil {
+			return d.finishErr
+		}
+		return cause
+	}
+	d.finished = true
+	if err := d.ledger.Finish(context.Background(), d.record.OperationID, d.record.RequestDigest, state, code, d.now()); err != nil {
+		d.finishErr = fmt.Errorf("finalize artifact download operation: %w", err)
+		return d.finishErr
+	}
+	d.finishErr = cause
+	return cause
+}
diff --git a/internal/artifactcap/service_test.go b/internal/artifactcap/service_test.go
new file mode 100644
index 000000000..14d5ef26a
--- /dev/null
+++ b/internal/artifactcap/service_test.go
@@ -0,0 +1,296 @@
+package artifactcap
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func TestServiceUploadDownloadAndPersistentReplay(t *testing.T) {
+	t.Parallel()
+	root := t.TempDir()
+	secret := []byte(strings.Repeat("k", MinSecretBytes))
+	now := time.Date(2026, 7, 24, 12, 0, 0, 0, time.UTC)
+	service := newTestService(t, root, secret, 1<<20, now)
+	data := []byte("durable artifact")
+	uploadRequest := testOperationRequest(OperationUpload, data, "upload-operation")
+	uploadAuthorization := issueTestAuthorization(t, secret, uploadRequest, now)
+	artifact, err := service.Upload(context.Background(), uploadAuthorization.Capability, present(uploadRequest, uploadAuthorization), bytes.NewReader(data))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if artifact.Digest != uploadRequest.ObjectDigest || artifact.SizeBytes != int64(len(data)) {
+		t.Fatalf("artifact = %#v", artifact)
+	}
+	hexDigest, _ := DigestHex(artifact.Digest)
+	if _, err := os.Stat(filepath.Join(root, "metadata", hexDigest+".json")); err != nil {
+		t.Fatalf("metadata was not visible after commit: %v", err)
+	}
+
+	downloadRequest := uploadRequest
+	downloadRequest.Operation = OperationDownload
+	downloadRequest.OperationID = "download-operation"
+	downloadAuthorization := issueTestAuthorization(t, secret, downloadRequest, now)
+	download, err := service.OpenDownload(context.Background(), downloadAuthorization.Capability, present(downloadRequest, downloadAuthorization))
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := io.ReadAll(download)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := download.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(got, data) {
+		t.Fatalf("download = %q, want %q", got, data)
+	}
+
+	if _, err := service.Upload(context.Background(), uploadAuthorization.Capability, present(uploadRequest, uploadAuthorization), bytes.NewReader(data)); !errors.Is(err, ErrReplay) {
+		t.Fatalf("replayed upload error = %v, want ErrReplay", err)
+	}
+	restarted := newTestService(t, root, secret, 1<<20, now)
+	if _, err := restarted.OpenDownload(context.Background(), downloadAuthorization.Capability, present(downloadRequest, downloadAuthorization)); !errors.Is(err, ErrReplay) {
+		t.Fatalf("replayed download after restart error = %v, want ErrReplay", err)
+	}
+}
+
+func TestServiceRejectsPartialMismatchOversizeAndDisconnectWithoutVisibility(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name      string
+		maxBytes  int64
+		request   func() OperationRequest
+		body      func() io.Reader
+		wantError error
+	}{
+		{
+			name: "partial upload", maxBytes: 1024,
+			request: func() OperationRequest {
+				request := testOperationRequest(OperationUpload, []byte("0123456789"), "partial-operation")
+				return request
+			},
+			body: func() io.Reader { return strings.NewReader("short") }, wantError: ErrPartialUpload,
+		},
+		{
+			name: "digest mismatch", maxBytes: 1024,
+			request: func() OperationRequest {
+				return testOperationRequest(OperationUpload, []byte("expected"), "mismatch-operation")
+			},
+			body: func() io.Reader { return strings.NewReader("mismatch") }, wantError: ErrDigestMismatch,
+		},
+		{
+			name: "oversized", maxBytes: 4,
+			request: func() OperationRequest {
+				return testOperationRequest(OperationUpload, []byte("12345"), "oversize-operation")
+			},
+			body: func() io.Reader { return strings.NewReader("12345") }, wantError: ErrTooLarge,
+		},
+		{
+			name: "disconnect", maxBytes: 1024,
+			request: func() OperationRequest {
+				return testOperationRequest(OperationUpload, []byte("0123456789"), "disconnect-operation")
+			},
+			body: func() io.Reader { return &disconnectReader{data: []byte("0123")} }, wantError: ErrPartialUpload,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			root := t.TempDir()
+			secret := []byte(strings.Repeat("z", MinSecretBytes))
+			now := time.Now().UTC()
+			service := newTestService(t, root, secret, test.maxBytes, now)
+			request := test.request()
+			authorization := issueTestAuthorization(t, secret, request, now)
+			_, err := service.Upload(context.Background(), authorization.Capability, present(request, authorization), test.body())
+			if !errors.Is(err, test.wantError) {
+				t.Fatalf("Upload() error = %v, want %v", err, test.wantError)
+			}
+			hexDigest, _ := DigestHex(request.ObjectDigest)
+			if _, statErr := os.Stat(filepath.Join(root, "metadata", hexDigest+".json")); !os.IsNotExist(statErr) {
+				t.Fatalf("metadata became visible after failed upload: %v", statErr)
+			}
+			if _, replayErr := service.Upload(context.Background(), authorization.Capability, present(request, authorization), test.body()); !errors.Is(replayErr, ErrReplay) {
+				t.Fatalf("failed operation replay error = %v, want ErrReplay", replayErr)
+			}
+		})
+	}
+}
+
+func TestServiceRejectsOperationIDDifferentDigest(t *testing.T) {
+	t.Parallel()
+	root := t.TempDir()
+	secret := []byte(strings.Repeat("c", MinSecretBytes))
+	now := time.Now().UTC()
+	service := newTestService(t, root, secret, 1024, now)
+	firstData := []byte("first")
+	first := testOperationRequest(OperationUpload, firstData, "shared-operation")
+	firstAuthorization := issueTestAuthorization(t, secret, first, now)
+	if _, err := service.Upload(context.Background(), firstAuthorization.Capability, present(first, firstAuthorization), bytes.NewReader(firstData)); err != nil {
+		t.Fatal(err)
+	}
+	secondData := []byte("second")
+	second := testOperationRequest(OperationUpload, secondData, "shared-operation")
+	secondAuthorization := issueTestAuthorization(t, secret, second, now)
+	if _, err := service.Upload(context.Background(), secondAuthorization.Capability, present(second, secondAuthorization), bytes.NewReader(secondData)); !errors.Is(err, ErrOperationConflict) {
+		t.Fatalf("different digest with same operation error = %v, want ErrOperationConflict", err)
+	}
+}
+
+func TestServiceRejectsTraversalAndManagedDirectorySymlink(t *testing.T) {
+	t.Parallel()
+	secret := []byte(strings.Repeat("p", MinSecretBytes))
+	now := time.Now().UTC()
+	data := []byte("artifact")
+
+	t.Run("traversal", func(t *testing.T) {
+		service := newTestService(t, t.TempDir(), secret, 1024, now)
+		request := testOperationRequest(OperationUpload, data, "traversal-operation")
+		authorization := issueTestAuthorization(t, secret, request, now)
+		presented := present(request, authorization)
+		presented.Path = "/internal/v2/acp/artifacts/sha256/../escape"
+		_, err := service.Upload(context.Background(), authorization.Capability, presented, bytes.NewReader(data))
+		if !errors.Is(err, ErrUnauthorized) {
+			t.Fatalf("traversal error = %v, want ErrUnauthorized", err)
+		}
+	})
+
+	t.Run("symlink", func(t *testing.T) {
+		root := t.TempDir()
+		outside := t.TempDir()
+		service := newTestService(t, root, secret, 1024, now)
+		if err := os.Remove(filepath.Join(root, "objects")); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.Symlink(outside, filepath.Join(root, "objects")); err != nil {
+			t.Fatal(err)
+		}
+		request := testOperationRequest(OperationUpload, data, "symlink-operation")
+		authorization := issueTestAuthorization(t, secret, request, now)
+		_, err := service.Upload(context.Background(), authorization.Capability, present(request, authorization), bytes.NewReader(data))
+		if !errors.Is(err, ErrUnsafePath) {
+			t.Fatalf("symlink error = %v, want ErrUnsafePath", err)
+		}
+		entries, err := os.ReadDir(outside)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if len(entries) != 0 {
+			t.Fatalf("upload followed managed directory symlink: %v", entries)
+		}
+	})
+}
+
+func TestServiceConcurrentOneShotOperation(t *testing.T) {
+	t.Parallel()
+	root := t.TempDir()
+	secret := []byte(strings.Repeat("q", MinSecretBytes))
+	now := time.Now().UTC()
+	service := newTestService(t, root, secret, 1024, now)
+	data := []byte("concurrent")
+	request := testOperationRequest(OperationUpload, data, "concurrent-operation")
+	authorization := issueTestAuthorization(t, secret, request, now)
+	var successes atomic.Int32
+	var unexpected atomic.Int32
+	var wait sync.WaitGroup
+	for range 16 {
+		wait.Go(func() {
+			_, err := service.Upload(context.Background(), authorization.Capability, present(request, authorization), bytes.NewReader(data))
+			switch {
+			case err == nil:
+				successes.Add(1)
+			case errors.Is(err, ErrReplay):
+			default:
+				unexpected.Add(1)
+			}
+		})
+	}
+	wait.Wait()
+	if successes.Load() != 1 || unexpected.Load() != 0 {
+		t.Fatalf("successes=%d unexpected=%d, want 1/0", successes.Load(), unexpected.Load())
+	}
+}
+
+func TestServiceDetectsCorruptDownload(t *testing.T) {
+	t.Parallel()
+	root := t.TempDir()
+	secret := []byte(strings.Repeat("r", MinSecretBytes))
+	now := time.Now().UTC()
+	service := newTestService(t, root, secret, 1024, now)
+	data := []byte("original")
+	upload := testOperationRequest(OperationUpload, data, "corrupt-upload")
+	uploadAuthorization := issueTestAuthorization(t, secret, upload, now)
+	if _, err := service.Upload(context.Background(), uploadAuthorization.Capability, present(upload, uploadAuthorization), bytes.NewReader(data)); err != nil {
+		t.Fatal(err)
+	}
+	hexDigest, _ := DigestHex(upload.ObjectDigest)
+	if err := os.WriteFile(filepath.Join(root, "objects", hexDigest), []byte("tampered"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	download := upload
+	download.Operation = OperationDownload
+	download.OperationID = "corrupt-download"
+	downloadAuthorization := issueTestAuthorization(t, secret, download, now)
+	if _, err := service.OpenDownload(context.Background(), downloadAuthorization.Capability, present(download, downloadAuthorization)); !errors.Is(err, ErrCorrupt) {
+		t.Fatalf("OpenDownload() error = %v, want ErrCorrupt", err)
+	}
+}
+
+func TestServiceErrorsRedactCapabilityAndSecret(t *testing.T) {
+	t.Parallel()
+	secretText := strings.Repeat("redaction-secret-", 2)
+	secret := []byte(secretText)
+	now := time.Now().UTC()
+	service := newTestService(t, t.TempDir(), secret, 1024, now)
+	request := testOperationRequest(OperationUpload, []byte("artifact"), "redaction-operation")
+	authorization := issueTestAuthorization(t, secret, request, now)
+	presented := present(request, authorization)
+	presented.RequestDigest = DigestBytes([]byte("wrong"))
+	_, err := service.Upload(context.Background(), authorization.Capability, presented, strings.NewReader("artifact"))
+	if err == nil {
+		t.Fatal("expected authorization error")
+	}
+	if strings.Contains(err.Error(), authorization.Capability) || strings.Contains(err.Error(), secretText) {
+		t.Fatalf("error disclosed capability or secret: %q", err)
+	}
+}
+
+func newTestService(t *testing.T, root string, secret []byte, maxBytes int64, now time.Time) *Service {
+	t.Helper()
+	service, err := NewService(ServiceConfig{Root: root, Secret: secret, MaxObjectBytes: maxBytes, Now: func() time.Time { return now }})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return service
+}
+
+func issueTestAuthorization(t *testing.T, secret []byte, request OperationRequest, now time.Time) Authorization {
+	t.Helper()
+	authorization, err := Issue(secret, request, now, time.Minute)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return authorization
+}
+
+type disconnectReader struct {
+	data []byte
+	done bool
+}
+
+func (r *disconnectReader) Read(buffer []byte) (int, error) {
+	if !r.done {
+		r.done = true
+		return copy(buffer, r.data), nil
+	}
+	return 0, fmt.Errorf("simulated disconnect")
+}
diff --git a/internal/artifactcap/store.go b/internal/artifactcap/store.go
new file mode 100644
index 000000000..dafe15351
--- /dev/null
+++ b/internal/artifactcap/store.go
@@ -0,0 +1,327 @@
+package artifactcap
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"sync"
+	"time"
+)
+
+const defaultCopyBufferBytes = 128 << 10
+
+type FileObjectStore struct {
+	root           string
+	objectsDir     string
+	metadataDir    string
+	tempDir        string
+	maxObjectBytes int64
+	commitMu       sync.Mutex
+}
+
+func NewFileObjectStore(root string, maxObjectBytes int64) (*FileObjectStore, error) {
+	if root == "" || !filepath.IsAbs(root) {
+		return nil, fmt.Errorf("%w: artifact root must be absolute", ErrUnsafePath)
+	}
+	if maxObjectBytes <= 0 {
+		return nil, fmt.Errorf("%w: maximum object size must be positive", ErrInvalidRequest)
+	}
+	store := &FileObjectStore{
+		root:           root,
+		objectsDir:     filepath.Join(root, "objects"),
+		metadataDir:    filepath.Join(root, "metadata"),
+		tempDir:        filepath.Join(root, "tmp"),
+		maxObjectBytes: maxObjectBytes,
+	}
+	for _, dir := range []string{store.root, store.objectsDir, store.metadataDir, store.tempDir} {
+		if err := ensurePrivateDirectory(dir); err != nil {
+			return nil, err
+		}
+	}
+	return store, nil
+}
+
+func (s *FileObjectStore) Put(ctx context.Context, request OperationRequest, body io.Reader, now time.Time) (Artifact, error) {
+	if request.ContentLength > s.maxObjectBytes {
+		return Artifact{}, ErrTooLarge
+	}
+	if body == nil {
+		return Artifact{}, ErrPartialUpload
+	}
+	if err := s.verifyDirectories(); err != nil {
+		return Artifact{}, err
+	}
+	temp, err := os.CreateTemp(s.tempDir, ".upload-*.tmp")
+	if err != nil {
+		return Artifact{}, fmt.Errorf("create artifact upload temp file: %w", err)
+	}
+	tempPath := temp.Name()
+	defer os.Remove(tempPath) //nolint:errcheck
+	if err := temp.Chmod(0o600); err != nil {
+		_ = temp.Close()
+		return Artifact{}, fmt.Errorf("secure artifact upload temp file: %w", err)
+	}
+	hash := sha256.New()
+	limited := io.LimitReader(contextReader{ctx: ctx, r: body}, request.ContentLength+1)
+	written, copyErr := io.CopyBuffer(io.MultiWriter(temp, hash), limited, make([]byte, defaultCopyBufferBytes))
+	if copyErr != nil {
+		_ = temp.Close()
+		return Artifact{}, ErrPartialUpload
+	}
+	if written < request.ContentLength {
+		_ = temp.Close()
+		return Artifact{}, ErrPartialUpload
+	}
+	if written > request.ContentLength {
+		_ = temp.Close()
+		return Artifact{}, fmt.Errorf("%w: received more than declared content length", ErrInvalidRequest)
+	}
+	actualDigest := "sha256:" + hex.EncodeToString(hash.Sum(nil))
+	if !constantStringEqual(actualDigest, request.ObjectDigest) {
+		_ = temp.Close()
+		return Artifact{}, ErrDigestMismatch
+	}
+	if err := temp.Sync(); err != nil {
+		_ = temp.Close()
+		return Artifact{}, fmt.Errorf("sync artifact upload temp file: %w", err)
+	}
+	if err := temp.Close(); err != nil {
+		return Artifact{}, fmt.Errorf("close artifact upload temp file: %w", err)
+	}
+	if now.IsZero() {
+		now = time.Now().UTC()
+	}
+	artifactID, err := ArtifactIDForDigest(request.ObjectDigest)
+	if err != nil {
+		return Artifact{}, err
+	}
+	artifact := Artifact{
+		ArtifactID: artifactID,
+		Digest:     request.ObjectDigest,
+		SizeBytes:  request.ContentLength,
+		MediaType:  request.MediaType,
+		CreatedAt:  now.UTC(),
+	}
+	return s.commit(tempPath, artifact)
+}
+
+func (s *FileObjectStore) OpenVerified(ctx context.Context, request OperationRequest) (*os.File, Artifact, error) {
+	if request.ContentLength > s.maxObjectBytes {
+		return nil, Artifact{}, ErrTooLarge
+	}
+	if err := s.verifyDirectories(); err != nil {
+		return nil, Artifact{}, err
+	}
+	artifact, err := s.readMetadata(request.ObjectDigest)
+	if err != nil {
+		return nil, Artifact{}, err
+	}
+	if artifact.SizeBytes != request.ContentLength || !constantStringEqual(artifact.MediaType, request.MediaType) {
+		return nil, Artifact{}, ErrCorrupt
+	}
+	objectPath, err := s.objectPath(request.ObjectDigest)
+	if err != nil {
+		return nil, Artifact{}, err
+	}
+	file, err := openFileNoFollow(objectPath, os.O_RDONLY, 0)
+	if errors.Is(err, os.ErrNotExist) {
+		return nil, Artifact{}, ErrNotFound
+	}
+	if err != nil {
+		return nil, Artifact{}, fmt.Errorf("open artifact object: %w", err)
+	}
+	info, err := file.Stat()
+	if err != nil || !info.Mode().IsRegular() || info.Size() != artifact.SizeBytes {
+		_ = file.Close()
+		return nil, Artifact{}, ErrCorrupt
+	}
+	hash := sha256.New()
+	read, err := io.CopyBuffer(hash, contextReader{ctx: ctx, r: file}, make([]byte, defaultCopyBufferBytes))
+	if err != nil || read != artifact.SizeBytes {
+		_ = file.Close()
+		return nil, Artifact{}, ErrCorrupt
+	}
+	actual := "sha256:" + hex.EncodeToString(hash.Sum(nil))
+	if !constantStringEqual(actual, artifact.Digest) {
+		_ = file.Close()
+		return nil, Artifact{}, ErrCorrupt
+	}
+	if _, err := file.Seek(0, io.SeekStart); err != nil {
+		_ = file.Close()
+		return nil, Artifact{}, ErrCorrupt
+	}
+	return file, artifact, nil
+}
+
+func (s *FileObjectStore) commit(tempPath string, artifact Artifact) (Artifact, error) {
+	s.commitMu.Lock()
+	defer s.commitMu.Unlock()
+	if err := s.verifyDirectories(); err != nil {
+		return Artifact{}, err
+	}
+	objectPath, err := s.objectPath(artifact.Digest)
+	if err != nil {
+		return Artifact{}, err
+	}
+	if info, statErr := os.Lstat(objectPath); statErr == nil {
+		if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() {
+			return Artifact{}, ErrUnsafePath
+		}
+		existing, verifyErr := s.verifyExistingObject(objectPath, artifact)
+		if verifyErr != nil {
+			return Artifact{}, verifyErr
+		}
+		artifact = existing
+	} else if !os.IsNotExist(statErr) {
+		return Artifact{}, fmt.Errorf("inspect artifact object: %w", statErr)
+	} else {
+		if err := os.Rename(tempPath, objectPath); err != nil {
+			return Artifact{}, fmt.Errorf("atomically commit artifact object: %w", err)
+		}
+		if err := syncDirectory(s.objectsDir); err != nil {
+			return Artifact{}, fmt.Errorf("sync artifact object directory: %w", err)
+		}
+	}
+	metadataPath, err := s.metadataPath(artifact.Digest)
+	if err != nil {
+		return Artifact{}, err
+	}
+	if info, statErr := os.Lstat(metadataPath); statErr == nil {
+		if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() {
+			return Artifact{}, ErrUnsafePath
+		}
+		existing, readErr := s.readMetadata(artifact.Digest)
+		if readErr != nil || existing.SizeBytes != artifact.SizeBytes || !constantStringEqual(existing.MediaType, artifact.MediaType) {
+			return Artifact{}, ErrCorrupt
+		}
+		return existing, nil
+	} else if !os.IsNotExist(statErr) {
+		return Artifact{}, fmt.Errorf("inspect artifact metadata: %w", statErr)
+	}
+	if err := s.writeMetadata(metadataPath, artifact); err != nil {
+		return Artifact{}, err
+	}
+	return artifact, nil
+}
+
+func (s *FileObjectStore) verifyExistingObject(objectPath string, expected Artifact) (Artifact, error) {
+	file, err := openFileNoFollow(objectPath, os.O_RDONLY, 0)
+	if err != nil {
+		return Artifact{}, err
+	}
+	defer file.Close() //nolint:errcheck
+	info, err := file.Stat()
+	if err != nil || !info.Mode().IsRegular() || info.Size() != expected.SizeBytes {
+		return Artifact{}, ErrCorrupt
+	}
+	hash := sha256.New()
+	read, err := io.CopyBuffer(hash, file, make([]byte, defaultCopyBufferBytes))
+	if err != nil || read != expected.SizeBytes {
+		return Artifact{}, ErrCorrupt
+	}
+	actual := "sha256:" + hex.EncodeToString(hash.Sum(nil))
+	if !constantStringEqual(actual, expected.Digest) {
+		return Artifact{}, ErrCorrupt
+	}
+	if metadata, err := s.readMetadata(expected.Digest); err == nil {
+		if metadata.SizeBytes != expected.SizeBytes || !constantStringEqual(metadata.MediaType, expected.MediaType) {
+			return Artifact{}, ErrCorrupt
+		}
+		return metadata, nil
+	} else if !errors.Is(err, ErrNotFound) {
+		return Artifact{}, err
+	}
+	return expected, nil
+}
+
+func (s *FileObjectStore) writeMetadata(path string, artifact Artifact) error {
+	data, err := json.Marshal(artifact)
+	if err != nil {
+		return err
+	}
+	temp, err := os.CreateTemp(s.metadataDir, ".metadata-*.tmp")
+	if err != nil {
+		return fmt.Errorf("create artifact metadata temp file: %w", err)
+	}
+	tempPath := temp.Name()
+	defer os.Remove(tempPath) //nolint:errcheck
+	if err = temp.Chmod(0o600); err == nil {
+		_, err = temp.Write(data)
+	}
+	if err == nil {
+		err = temp.Sync()
+	}
+	closeErr := temp.Close()
+	if err == nil {
+		err = closeErr
+	}
+	if err != nil {
+		return fmt.Errorf("write artifact metadata temp file: %w", err)
+	}
+	if err := os.Rename(tempPath, path); err != nil {
+		return fmt.Errorf("atomically commit artifact metadata: %w", err)
+	}
+	if err := syncDirectory(s.metadataDir); err != nil {
+		return fmt.Errorf("sync artifact metadata directory: %w", err)
+	}
+	return nil
+}
+
+func (s *FileObjectStore) readMetadata(digest string) (Artifact, error) {
+	path, err := s.metadataPath(digest)
+	if err != nil {
+		return Artifact{}, err
+	}
+	file, err := openFileNoFollow(path, os.O_RDONLY, 0)
+	if errors.Is(err, os.ErrNotExist) {
+		return Artifact{}, ErrNotFound
+	}
+	if err != nil {
+		return Artifact{}, fmt.Errorf("open artifact metadata: %w", err)
+	}
+	defer file.Close() //nolint:errcheck
+	info, err := file.Stat()
+	if err != nil || !info.Mode().IsRegular() || info.Size() > 16<<10 {
+		return Artifact{}, ErrCorrupt
+	}
+	data, err := io.ReadAll(io.LimitReader(file, 16<<10+1))
+	if err != nil || len(data) > 16<<10 {
+		return Artifact{}, ErrCorrupt
+	}
+	var artifact Artifact
+	if err := decodeStrictJSON(data, &artifact); err != nil || artifact.Validate() != nil || !constantStringEqual(artifact.Digest, digest) {
+		return Artifact{}, ErrCorrupt
+	}
+	return artifact, nil
+}
+
+func (s *FileObjectStore) verifyDirectories() error {
+	for _, dir := range []string{s.root, s.objectsDir, s.metadataDir, s.tempDir} {
+		if err := ensurePrivateDirectory(dir); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (s *FileObjectStore) objectPath(digest string) (string, error) {
+	hexDigest, err := DigestHex(digest)
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(s.objectsDir, hexDigest), nil
+}
+
+func (s *FileObjectStore) metadataPath(digest string) (string, error) {
+	hexDigest, err := DigestHex(digest)
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(s.metadataDir, hexDigest+".json"), nil
+}
diff --git a/internal/artifactcap/types.go b/internal/artifactcap/types.go
new file mode 100644
index 000000000..c4874d728
--- /dev/null
+++ b/internal/artifactcap/types.go
@@ -0,0 +1,254 @@
+package artifactcap
+
+import (
+	"errors"
+	"fmt"
+	"mime"
+	"path"
+	"regexp"
+	"strings"
+	"time"
+)
+
+const (
+	httpMethodGet                          = "GET"
+	httpMethodPut                          = "PUT"
+	CapabilityVersion                      = "orka.artifact.capability.v1"
+	CapabilityAudience                     = "orka.acp.artifact-api"
+	MinSecretBytes                         = 32
+	MaxCapabilityTTL                       = 5 * time.Minute
+	MaxClockSkew                           = 30 * time.Second
+	CapabilityHeader                       = "X-Orka-Artifact-Capability"
+	RequestDigestHeader                    = "X-Orka-Artifact-Request-Digest"
+	ContentLengthHeader                    = "X-Orka-Artifact-Content-Length"
+	MediaTypeHeader                        = "X-Orka-Artifact-Media-Type"
+	ObjectDigestHeader                     = "X-Orka-Artifact-Digest"
+	MediaTypeWorkspaceTar                  = "application/vnd.orka.workspace.v1+tar"
+	MediaTypeWorkspaceDelta                = "application/vnd.orka.workspace-delta.v1+tar"
+	MediaTypeGitBundle                     = "application/vnd.orka.git-bundle.v1"
+	DefaultWorkspaceArtifactMaxBytes int64 = 100 << 20
+)
+
+var (
+	ErrUnauthorized      = errors.New("artifact capability authorization failed")
+	ErrExpired           = errors.New("artifact capability expired")
+	ErrInvalidRequest    = errors.New("invalid artifact request")
+	ErrReplay            = errors.New("artifact operation already used")
+	ErrOperationConflict = errors.New("artifact operation conflicts with durable replay record")
+	ErrTooLarge          = errors.New("artifact exceeds configured size limit")
+	ErrPartialUpload     = errors.New("artifact upload ended before the declared content length")
+	ErrDigestMismatch    = errors.New("artifact digest mismatch")
+	ErrNotFound          = errors.New("artifact not found")
+	ErrUnsafePath        = errors.New("unsafe artifact storage path")
+	ErrCorrupt           = errors.New("artifact storage is corrupt")
+)
+
+var safeIdentifierPattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._:/@+-]*$`)
+
+type Operation string
+
+const (
+	OperationUpload   Operation = "upload"
+	OperationDownload Operation = "download"
+)
+
+func (o Operation) Validate() error {
+	switch o {
+	case OperationUpload, OperationDownload:
+		return nil
+	default:
+		return fmt.Errorf("%w: unsupported operation %q", ErrInvalidRequest, o)
+	}
+}
+
+func (o Operation) Method() string {
+	if o == OperationUpload {
+		return httpMethodPut
+	}
+	if o == OperationDownload {
+		return httpMethodGet
+	}
+	return ""
+}
+
+type Identity struct {
+	Namespace     string `json:"namespace"`
+	TaskID        string `json:"taskID,omitempty"`
+	PublicationID string `json:"publicationID,omitempty"`
+}
+
+func (i Identity) Validate() error {
+	if err := validateIdentifier("namespace", i.Namespace, 253); err != nil {
+		return err
+	}
+	if (i.TaskID == "") == (i.PublicationID == "") {
+		return fmt.Errorf("%w: exactly one task or publication identity is required", ErrInvalidRequest)
+	}
+	if i.TaskID != "" {
+		return validateIdentifier("task identity", i.TaskID, 512)
+	}
+	return validateIdentifier("publication identity", i.PublicationID, 512)
+}
+
+type OperationRequest struct {
+	Operation     Operation `json:"operation"`
+	ObjectDigest  string    `json:"objectDigest"`
+	Identity      Identity  `json:"identity"`
+	ContentLength int64     `json:"contentLength"`
+	MediaType     string    `json:"mediaType"`
+	OperationID   string    `json:"operationID"`
+}
+
+func (r OperationRequest) Validate() error {
+	if err := r.Operation.Validate(); err != nil {
+		return err
+	}
+	if err := ValidateObjectDigest(r.ObjectDigest); err != nil {
+		return err
+	}
+	if err := r.Identity.Validate(); err != nil {
+		return err
+	}
+	if r.ContentLength < 0 {
+		return fmt.Errorf("%w: content length must be non-negative", ErrInvalidRequest)
+	}
+	if err := ValidateMediaType(r.MediaType); err != nil {
+		return err
+	}
+	return validateIdentifier("operation ID", r.OperationID, 512)
+}
+
+func (r OperationRequest) Method() string { return r.Operation.Method() }
+
+func (r OperationRequest) Path() string {
+	value, _ := ObjectPath(r.ObjectDigest)
+	return value
+}
+
+func ObjectPath(digest string) (string, error) {
+	hexDigest, err := DigestHex(digest)
+	if err != nil {
+		return "", err
+	}
+	return path.Join("/internal/v2/acp/artifacts/sha256", hexDigest), nil
+}
+
+type Authorization struct {
+	Capability    string
+	RequestDigest string
+}
+
+type CapabilityClaims struct {
+	Version       string           `json:"version"`
+	Audience      string           `json:"audience"`
+	Request       OperationRequest `json:"request"`
+	RequestDigest string           `json:"requestDigest"`
+	IssuedAt      time.Time        `json:"issuedAt"`
+	ExpiresAt     time.Time        `json:"expiresAt"`
+}
+
+func (c CapabilityClaims) ValidateAt(now time.Time) error {
+	if c.Version != CapabilityVersion || c.Audience != CapabilityAudience {
+		return ErrUnauthorized
+	}
+	if err := c.Request.Validate(); err != nil {
+		return ErrUnauthorized
+	}
+	if !IsRequestDigest(c.RequestDigest) {
+		return ErrUnauthorized
+	}
+	if c.IssuedAt.IsZero() || c.ExpiresAt.IsZero() || !c.ExpiresAt.After(c.IssuedAt) || c.ExpiresAt.Sub(c.IssuedAt) > MaxCapabilityTTL {
+		return ErrUnauthorized
+	}
+	if now.IsZero() {
+		now = time.Now().UTC()
+	}
+	if c.IssuedAt.After(now.Add(MaxClockSkew)) {
+		return ErrUnauthorized
+	}
+	if !c.ExpiresAt.After(now) {
+		return ErrExpired
+	}
+	return nil
+}
+
+type PresentedRequest struct {
+	Method        string
+	Path          string
+	ObjectDigest  string
+	ContentLength int64
+	MediaType     string
+	RequestDigest string
+}
+
+func (r PresentedRequest) Validate() error {
+	if r.Method != "PUT" && r.Method != "GET" {
+		return fmt.Errorf("%w: unsupported HTTP method", ErrInvalidRequest)
+	}
+	if err := ValidateObjectDigest(r.ObjectDigest); err != nil {
+		return err
+	}
+	if r.Path == "" || !strings.HasPrefix(r.Path, "/") || path.Clean(r.Path) != r.Path {
+		return fmt.Errorf("%w: non-canonical request path", ErrInvalidRequest)
+	}
+	if r.ContentLength < 0 {
+		return fmt.Errorf("%w: content length must be non-negative", ErrInvalidRequest)
+	}
+	if err := ValidateMediaType(r.MediaType); err != nil {
+		return err
+	}
+	if !IsRequestDigest(r.RequestDigest) {
+		return fmt.Errorf("%w: invalid request digest", ErrInvalidRequest)
+	}
+	return nil
+}
+
+type Artifact struct {
+	ArtifactID string    `json:"artifactID"`
+	Digest     string    `json:"digest"`
+	SizeBytes  int64     `json:"sizeBytes"`
+	MediaType  string    `json:"mediaType"`
+	CreatedAt  time.Time `json:"createdAt"`
+}
+
+func (a Artifact) Validate() error {
+	if err := validateIdentifier("artifact ID", a.ArtifactID, 128); err != nil {
+		return err
+	}
+	if err := ValidateObjectDigest(a.Digest); err != nil {
+		return err
+	}
+	if a.SizeBytes < 0 {
+		return fmt.Errorf("%w: artifact size must be non-negative", ErrInvalidRequest)
+	}
+	return ValidateMediaType(a.MediaType)
+}
+
+func ArtifactIDForDigest(digest string) (string, error) {
+	hexDigest, err := DigestHex(digest)
+	if err != nil {
+		return "", err
+	}
+	return "sha256-" + hexDigest, nil
+}
+
+func ValidateMediaType(value string) error {
+	if value == "" || len(value) > 256 || strings.ContainsAny(value, "\r\n\x00") {
+		return fmt.Errorf("%w: invalid media type", ErrInvalidRequest)
+	}
+	mediaType, params, err := mime.ParseMediaType(value)
+	if err != nil || mediaType == "" {
+		return fmt.Errorf("%w: invalid media type", ErrInvalidRequest)
+	}
+	if canonical := mime.FormatMediaType(mediaType, params); canonical != value {
+		return fmt.Errorf("%w: media type must be canonical", ErrInvalidRequest)
+	}
+	return nil
+}
+
+func validateIdentifier(name, value string, max int) error {
+	if value == "" || len(value) > max || !safeIdentifierPattern.MatchString(value) || strings.Contains(value, "..") {
+		return fmt.Errorf("%w: invalid %s", ErrInvalidRequest, name)
+	}
+	return nil
+}
diff --git a/internal/controller/acp_agent_configuration.go b/internal/controller/acp_agent_configuration.go
new file mode 100644
index 000000000..71f8ed83d
--- /dev/null
+++ b/internal/controller/acp_agent_configuration.go
@@ -0,0 +1,272 @@
+package controller
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+type permanentACPAgentConfigurationError struct{ err error }
+
+func (e *permanentACPAgentConfigurationError) Error() string { return e.err.Error() }
+func (e *permanentACPAgentConfigurationError) Unwrap() error { return e.err }
+
+func permanentACPAgentConfiguration(err error) error {
+	if err == nil {
+		return nil
+	}
+	return &permanentACPAgentConfigurationError{err: err}
+}
+
+func isPermanentACPAgentConfigurationError(err error) bool {
+	var permanent *permanentACPAgentConfigurationError
+	return errors.As(err, &permanent)
+}
+
+func resolveACPAgentSessionConfiguration(
+	ctx context.Context,
+	reader client.Reader,
+	task *corev1alpha1.Task,
+	agent *corev1alpha1.Agent,
+) (harnessv2.AgentSessionConfiguration, error) {
+	if err := validateACPAgentSkills(agent); err != nil {
+		return harnessv2.AgentSessionConfiguration{}, permanentACPAgentConfiguration(err)
+	}
+	if err := validateACPAgentTools(agent); err != nil {
+		return harnessv2.AgentSessionConfiguration{}, permanentACPAgentConfiguration(err)
+	}
+	if reader == nil {
+		return harnessv2.AgentSessionConfiguration{}, fmt.Errorf("API reader is required to resolve ACP Agent configuration")
+	}
+	systemPrompt, err := resolveACPSystemPrompt(ctx, reader, agent)
+	if err != nil {
+		return harnessv2.AgentSessionConfiguration{}, err
+	}
+	return buildACPAgentSessionConfiguration(task, agent, systemPrompt)
+}
+
+func buildACPAgentSessionConfiguration(
+	task *corev1alpha1.Task,
+	agent *corev1alpha1.Agent,
+	systemPrompt string,
+) (harnessv2.AgentSessionConfiguration, error) {
+	if task == nil || agent == nil || agent.Spec.Runtime == nil {
+		return harnessv2.AgentSessionConfiguration{}, fmt.Errorf("task and built-in runtime Agent are required")
+	}
+	if err := validateACPAgentSkills(agent); err != nil {
+		return harnessv2.AgentSessionConfiguration{}, permanentACPAgentConfiguration(err)
+	}
+	if err := validateACPAgentTools(agent); err != nil {
+		return harnessv2.AgentSessionConfiguration{}, permanentACPAgentConfiguration(err)
+	}
+	if err := validateACPAgentModelControls(agent.Spec.Runtime, agent.Spec.Model); err != nil {
+		return harnessv2.AgentSessionConfiguration{}, permanentACPAgentConfiguration(err)
+	}
+	model := ""
+	if agent.Spec.Model != nil {
+		model = strings.TrimSpace(agent.Spec.Model.Name)
+	}
+	configuration := harnessv2.AgentSessionConfiguration{
+		AgentUID:        string(agent.UID),
+		AgentGeneration: agent.Generation,
+		ProviderKind:    string(agent.Spec.Runtime.Type),
+		Model:           model,
+		MaxTurns:        effectiveACPMaxTurns(task, agent),
+		ReasoningEffort: effectiveACPReasoningEffort(agent),
+		SystemPrompt:    systemPrompt,
+	}
+	if err := configuration.Validate(); err != nil {
+		return harnessv2.AgentSessionConfiguration{}, permanentACPAgentConfiguration(fmt.Errorf("ACP Agent session configuration: %w", err))
+	}
+	return configuration, nil
+}
+
+func validateACPAgentSkills(agent *corev1alpha1.Agent) error {
+	if agent == nil || len(agent.Spec.Skills) == 0 {
+		return nil
+	}
+	return errors.New("built-in ACP runtimes do not support Agent.spec.skills; refusing to omit declared skills")
+}
+
+func validateACPAgentTools(agent *corev1alpha1.Agent) error {
+	if agent == nil {
+		return nil
+	}
+	for _, toolRef := range agent.Spec.Tools {
+		if toolRef.Enabled != nil && !*toolRef.Enabled {
+			continue
+		}
+		// Agent.spec.tools is additive for the managed AI worker, while a non-empty
+		// ACP allowlist replaces the provider-native default set. Merging enabled
+		// references would therefore silently remove native tools, with no defined
+		// precedence against runtime defaults or Task overrides. Explicitly disabled
+		// references are inert and safe to ignore.
+		return errors.New("built-in ACP runtimes do not support enabled Agent.spec.tools; refusing to omit declared tools")
+	}
+	return nil
+}
+
+func resolveACPSystemPrompt(ctx context.Context, reader client.Reader, agent *corev1alpha1.Agent) (string, error) {
+	if agent == nil || agent.Spec.SystemPrompt == nil {
+		return "", nil
+	}
+	source := agent.Spec.SystemPrompt
+	inline := source.Inline
+	if inline != "" && source.ConfigMapRef != nil {
+		return "", permanentACPAgentConfiguration(fmt.Errorf("agent systemPrompt must use exactly one of inline or configMapRef"))
+	}
+	if source.ConfigMapRef == nil {
+		return inline, nil
+	}
+	name := strings.TrimSpace(source.ConfigMapRef.Name)
+	key := strings.TrimSpace(source.ConfigMapRef.Key)
+	if name == "" || key == "" {
+		return "", permanentACPAgentConfiguration(fmt.Errorf("agent systemPrompt ConfigMap name and key are required"))
+	}
+	configMap := &corev1.ConfigMap{}
+	if err := reader.Get(ctx, client.ObjectKey{Namespace: agent.Namespace, Name: name}, configMap); err != nil {
+		wrapped := fmt.Errorf("resolve Agent systemPrompt ConfigMap %q: %w", name, err)
+		if apierrors.IsNotFound(err) {
+			return "", permanentACPAgentConfiguration(wrapped)
+		}
+		return "", wrapped
+	}
+	value, ok := configMap.Data[key]
+	if !ok {
+		return "", permanentACPAgentConfiguration(fmt.Errorf("agent systemPrompt ConfigMap %q does not contain key %q", name, key))
+	}
+	return value, nil
+}
+
+const legacyDefaultACPTemperature = 0.7
+
+func validateACPAgentModelControls(runtimeCfg *corev1alpha1.AgentCLIRuntime, model *corev1alpha1.ModelConfig) error {
+	if runtimeCfg == nil || runtimeCfg.RuntimeRef != nil || model == nil {
+		return nil
+	}
+	switch runtimeCfg.Type {
+	case corev1alpha1.AgentRuntimeCodex, corev1alpha1.AgentRuntimeClaude, corev1alpha1.AgentRuntimeCopilot, corev1alpha1.AgentRuntimeOpencode:
+	default:
+		return nil
+	}
+	if model.Temperature != nil && *model.Temperature != legacyDefaultACPTemperature {
+		return fmt.Errorf("built-in ACP runtime %q does not support spec.model.temperature values other than the legacy default %.1f", runtimeCfg.Type, legacyDefaultACPTemperature)
+	}
+	if runtimeCfg.Type != corev1alpha1.AgentRuntimeOpencode {
+		if model.ContextWindow != nil {
+			return fmt.Errorf("built-in ACP runtime %q does not support spec.model.contextWindow", runtimeCfg.Type)
+		}
+		if model.MaxTokens != nil {
+			return fmt.Errorf("built-in ACP runtime %q does not support spec.model.maxTokens", runtimeCfg.Type)
+		}
+	}
+	if len(model.Fallbacks) > 0 {
+		return fmt.Errorf("built-in ACP runtime %q does not support spec.model.fallbacks", runtimeCfg.Type)
+	}
+	return nil
+}
+
+func effectiveACPAllowBash(task *corev1alpha1.Task, agent *corev1alpha1.Agent) bool {
+	allowBash := true
+	if agent != nil && agent.Spec.Runtime != nil && agent.Spec.Runtime.DefaultAllowBash != nil {
+		allowBash = *agent.Spec.Runtime.DefaultAllowBash
+	}
+	if task != nil && task.Spec.AgentRuntime != nil && task.Spec.AgentRuntime.AllowBash != nil {
+		allowBash = *task.Spec.AgentRuntime.AllowBash
+	}
+	return allowBash
+}
+
+func effectiveACPReasoningEffort(agent *corev1alpha1.Agent) string {
+	if agent == nil || agent.Spec.Runtime == nil {
+		return ""
+	}
+	return strings.ToLower(strings.TrimSpace(agent.Spec.Runtime.DefaultReasoningEffort))
+}
+
+func validateACPProviderNativePolicy(provider string, intent corev1alpha1.WorkspaceIntent, allowed, disallowed []string, allowBash bool) error {
+	unrestricted := allowed == nil && len(disallowed) == 0 && allowBash
+	switch provider {
+	case string(corev1alpha1.AgentRuntimeClaude):
+		return nil
+	case string(corev1alpha1.AgentRuntimeCodex):
+		if unrestricted {
+			return nil
+		}
+		if intent == corev1alpha1.WorkspaceIntentRead && codexReadOnlyNativePolicy(allowed) {
+			return nil
+		}
+		return fmt.Errorf("codex ACP runtime cannot exactly enforce provider-native tool restrictions")
+	case string(corev1alpha1.AgentRuntimeCopilot):
+		for _, name := range allowed {
+			if strings.EqualFold(strings.TrimSpace(name), "WebSearch") {
+				return fmt.Errorf("copilot ACP runtime cannot exactly enforce the WebSearch provider-native tool")
+			}
+		}
+		return nil
+	case string(corev1alpha1.AgentRuntimeOpencode):
+		return nil
+	default:
+		return fmt.Errorf("unsupported ACP provider %q", provider)
+	}
+}
+
+// codexReadOnlyNativePolicy reports whether the provider-native slice of the
+// allowed tools is exactly the {Glob, Grep, Read} read-only surface. That is
+// the single restricted policy codex sessions support: instead of per-tool
+// switches, the RuntimeSession boundary rejects every elevation request,
+// mediates file writes through the supervisor, and fails any read-intent turn
+// whose workspace delta shows a modification. Brokered and custom tool names
+// are ignored here because the MCP broker enforces them, not codex.
+func codexReadOnlyNativePolicy(allowed []string) bool {
+	native := providerNativeTools[strings.ToLower(string(corev1alpha1.AgentRuntimeCodex))]
+	surface := make(map[string]struct{}, 3)
+	for _, name := range allowed {
+		canonical, ok := native[strings.ToLower(strings.TrimSpace(name))]
+		if !ok {
+			continue
+		}
+		switch canonical {
+		case providerNativeToolGlob, providerNativeToolGrep, providerNativeToolRead:
+			surface[canonical] = struct{}{}
+		default:
+			return false
+		}
+	}
+	return len(surface) == 3
+}
+
+func validateACPProviderSystemPrompt(provider string, configuration harnessv2.AgentSessionConfiguration) error {
+	if configuration.SystemPrompt == "" {
+		return nil
+	}
+	switch provider {
+	case string(corev1alpha1.AgentRuntimeCodex):
+		const maxCodexConfigEnvironmentBytes = 96 << 10
+		encoded, err := json.Marshal(map[string]any{
+			"model": configuration.Model, "openai_base_url": strings.Repeat("x", 2048),
+			"check_for_update_on_startup": false, "developer_instructions": configuration.SystemPrompt,
+			"model_reasoning_effort": configuration.ReasoningEffort,
+		})
+		if err != nil {
+			return err
+		}
+		if len(encoded) > maxCodexConfigEnvironmentBytes {
+			return fmt.Errorf("codex session configuration exceeds the safe environment limit")
+		}
+	case string(corev1alpha1.AgentRuntimeCopilot):
+		return fmt.Errorf("copilot ACP runtime cannot enforce Agent systemPrompt")
+	case string(corev1alpha1.AgentRuntimeOpencode):
+		return fmt.Errorf("opencode ACP runtime cannot enforce Agent systemPrompt")
+	}
+	return nil
+}
diff --git a/internal/controller/acp_agent_configuration_skills_test.go b/internal/controller/acp_agent_configuration_skills_test.go
new file mode 100644
index 000000000..11aa37b2e
--- /dev/null
+++ b/internal/controller/acp_agent_configuration_skills_test.go
@@ -0,0 +1,153 @@
+package controller
+
+import (
+	"context"
+	"errors"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+	"github.com/orka-agents/orka/internal/store/sqlite"
+)
+
+const unsupportedACPAgentSkillsMessage = "built-in ACP runtimes do not support Agent.spec.skills; refusing to omit declared skills"
+
+func TestPlanACPRuntimeRejectsDeclaredAgentSkills(t *testing.T) {
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent}}
+	for _, runtimeType := range []corev1alpha1.AgentRuntimeType{
+		corev1alpha1.AgentRuntimeCodex,
+		corev1alpha1.AgentRuntimeClaude,
+		corev1alpha1.AgentRuntimeCopilot,
+	} {
+		t.Run(string(runtimeType), func(t *testing.T) {
+			agent := &corev1alpha1.Agent{
+				ObjectMeta: metav1.ObjectMeta{UID: types.UID("agent-uid"), Generation: 1},
+				Spec: corev1alpha1.AgentSpec{
+					Model:   &corev1alpha1.ModelConfig{Name: "model"},
+					Runtime: &corev1alpha1.AgentCLIRuntime{Type: runtimeType},
+					Skills:  []corev1alpha1.SkillReference{{Name: "required-skill"}},
+				},
+			}
+
+			_, err := PlanACPRuntime(task, agent, ACPRuntimeImages{})
+			if err == nil {
+				t.Fatal("PlanACPRuntime() succeeded and silently omitted Agent.spec.skills")
+			}
+			if err.Error() != unsupportedACPAgentSkillsMessage {
+				t.Fatalf("PlanACPRuntime() error = %q, want %q", err, unsupportedACPAgentSkillsMessage)
+			}
+			if !isPermanentACPAgentConfigurationError(err) {
+				t.Fatalf("PlanACPRuntime() error = %v, want permanent ACP configuration error", err)
+			}
+		})
+	}
+}
+
+func TestQueueACPRuntimeTaskRejectsAgentSkillsBeforePoolDemand(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace:  "default",
+			Name:       "task-with-skills",
+			UID:        types.UID("11111111-2222-3333-4444-555555555555"),
+			Generation: 1,
+		},
+		Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Prompt: "use the required skill"},
+	}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace:  "default",
+			Name:       "agent-with-skills",
+			UID:        types.UID("aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"),
+			Generation: 1,
+		},
+		Spec: corev1alpha1.AgentSpec{
+			Model:   &corev1alpha1.ModelConfig{Name: acpTestModel},
+			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeCodex},
+			Skills:  []corev1alpha1.SkillReference{{Name: "required-skill"}},
+		},
+	}
+	kubeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithStatusSubresource(&corev1alpha1.Task{}, &corev1alpha1.RuntimePool{}).
+		WithObjects(task).
+		Build()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "store.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	controlStore := sqlite.NewStore(db, "test")
+	epochs := NewControllerEpochManager(controlStore, "controller-test")
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	t.Cleanup(func() {
+		cancelEpoch()
+		if err := <-epochDone; err != nil {
+			t.Errorf("controller epoch manager shutdown: %v", err)
+		}
+	})
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	if _, err := epochs.CurrentFence(ctx); err != nil {
+		t.Fatal(err)
+	}
+
+	reconciler := &TaskReconciler{
+		Client: kubeClient, Scheme: scheme, DurableControlStore: controlStore,
+		ControllerEpochManager: epochs, ACPRuntimeEnabled: true, ACPRuntimeNamespace: "orka-runtimes",
+		ACPRuntimeImages: ACPRuntimeImages{Codex: "docker.io/example/codex@sha256:" + strings.Repeat("a", 64)},
+	}
+	current := configureAgentExecutionBindingTest(t, ctx, reconciler, task)
+	if result, err, handled := reconciler.ensureAgentExecutionBinding(ctx, current, agent); err != nil || !handled {
+		t.Fatalf("invalid skills binding result=%#v handled=%v err=%v", result, handled, err)
+	}
+
+	var pools corev1alpha1.RuntimePoolList
+	if err := kubeClient.List(ctx, &pools); err != nil {
+		t.Fatal(err)
+	}
+	if len(pools.Items) != 0 {
+		t.Fatalf("skills rejection unexpectedly created RuntimePools: %#v", pools.Items)
+	}
+	failed := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, failed); err != nil {
+		t.Fatal(err)
+	}
+	if failed.Status.Phase != corev1alpha1.TaskPhaseFailed || failed.Status.Message != unsupportedACPAgentSkillsMessage ||
+		failed.Status.Attempts != 0 || failed.Status.Execution == nil ||
+		failed.Status.Execution.State != corev1alpha1.TaskExecutionStateFailed ||
+		failed.Status.Execution.Reason != corev1alpha1.TaskExecutionReason("InvalidRuntimeProfile") ||
+		failed.Status.Execution.Attempt != 0 || failed.Status.Execution.PromptID != "" || failed.Status.Execution.RuntimePoolName != "" ||
+		failed.Status.Delivery == nil || failed.Status.Delivery.State != corev1alpha1.TaskDeliveryStateNotRequested ||
+		failed.Status.Delivery.Outcome != corev1alpha1.TaskDeliveryOutcomeNotRequested {
+		t.Fatalf("skills rejection status: %#v", failed.Status)
+	}
+	if failed.Labels[acpRuntimeTaskPoolLabel] != "" || failed.Annotations[acpRuntimeQueuedAtAnnotation] != "" {
+		t.Fatalf("skills rejection recorded queue metadata: labels=%#v annotations=%#v", failed.Labels, failed.Annotations)
+	}
+	attemptID, err := (store.PromptAttemptKey{
+		Namespace: task.Namespace,
+		TaskUID:   string(task.UID),
+		Attempt:   1,
+		PromptID:  "prompt-" + string(task.UID) + "-1",
+	}).CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := controlStore.GetPromptAttempt(ctx, attemptID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("skills rejection durable attempt error = %v, want not found", err)
+	}
+}
diff --git a/internal/controller/acp_agent_configuration_test.go b/internal/controller/acp_agent_configuration_test.go
new file mode 100644
index 000000000..5552c7a9a
--- /dev/null
+++ b/internal/controller/acp_agent_configuration_test.go
@@ -0,0 +1,359 @@
+package controller
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/utils/ptr"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+func TestBuildACPAgentSessionConfigurationRejectsUnsupportedModelControls(t *testing.T) {
+	temperature := 0.2
+	contextWindow := int32(32768)
+	maxTokens := int32(128)
+	fallbacks := []corev1alpha1.ModelFallback{{ProviderRef: "fallback-provider", Model: "fallback-model"}}
+	opencodeTemperature := testOpenCodeModelConfig()
+	opencodeTemperature.Temperature = &temperature
+	opencodeFallbacks := testOpenCodeModelConfig()
+	opencodeFallbacks.Fallbacks = fallbacks
+	for _, tt := range []struct {
+		name      string
+		runtime   corev1alpha1.AgentRuntimeType
+		model     *corev1alpha1.ModelConfig
+		wantError string
+	}{
+		{
+			name:      "codex temperature",
+			runtime:   corev1alpha1.AgentRuntimeCodex,
+			model:     &corev1alpha1.ModelConfig{Name: "model", Temperature: &temperature},
+			wantError: "spec.model.temperature",
+		},
+		{
+			name:      "copilot context window",
+			runtime:   corev1alpha1.AgentRuntimeCopilot,
+			model:     &corev1alpha1.ModelConfig{Name: "model", ContextWindow: &contextWindow},
+			wantError: "spec.model.contextWindow",
+		},
+		{
+			name:      "claude max tokens",
+			runtime:   corev1alpha1.AgentRuntimeClaude,
+			model:     &corev1alpha1.ModelConfig{Name: "model", MaxTokens: &maxTokens},
+			wantError: "spec.model.maxTokens",
+		},
+		{
+			name:      "codex fallbacks",
+			runtime:   corev1alpha1.AgentRuntimeCodex,
+			model:     &corev1alpha1.ModelConfig{Name: "model", Fallbacks: fallbacks},
+			wantError: "spec.model.fallbacks",
+		},
+		{
+			name:      "claude fallbacks",
+			runtime:   corev1alpha1.AgentRuntimeClaude,
+			model:     &corev1alpha1.ModelConfig{Name: "model", Fallbacks: fallbacks},
+			wantError: "spec.model.fallbacks",
+		},
+		{
+			name:      "copilot fallbacks",
+			runtime:   corev1alpha1.AgentRuntimeCopilot,
+			model:     &corev1alpha1.ModelConfig{Name: "model", Fallbacks: fallbacks},
+			wantError: "spec.model.fallbacks",
+		},
+		{
+			name:      "opencode temperature",
+			runtime:   corev1alpha1.AgentRuntimeOpencode,
+			model:     opencodeTemperature,
+			wantError: "spec.model.temperature",
+		},
+		{
+			name:      "opencode fallbacks",
+			runtime:   corev1alpha1.AgentRuntimeOpencode,
+			model:     opencodeFallbacks,
+			wantError: "spec.model.fallbacks",
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent}}
+			agent := &corev1alpha1.Agent{
+				ObjectMeta: metav1.ObjectMeta{UID: types.UID("agent-uid"), Generation: 1},
+				Spec: corev1alpha1.AgentSpec{
+					Model:   tt.model,
+					Runtime: &corev1alpha1.AgentCLIRuntime{Type: tt.runtime},
+				},
+			}
+
+			_, err := buildACPAgentSessionConfiguration(task, agent, "")
+			if err == nil || !isPermanentACPAgentConfigurationError(err) || !strings.Contains(err.Error(), tt.wantError) {
+				t.Fatalf("buildACPAgentSessionConfiguration() error = %v, permanent=%t, want %q", err, isPermanentACPAgentConfigurationError(err), tt.wantError)
+			}
+		})
+	}
+}
+
+func TestBuildACPAgentSessionConfigurationAcceptsOpenCodeTokenLimits(t *testing.T) {
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent}}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{UID: types.UID("agent-uid"), Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model:   testOpenCodeModelConfig(),
+			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeOpencode},
+		},
+	}
+	if _, err := buildACPAgentSessionConfiguration(task, agent, ""); err != nil {
+		t.Fatalf("buildACPAgentSessionConfiguration() error = %v", err)
+	}
+}
+
+func TestResolveACPAgentSessionConfigurationInlineAndConfigMap(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	configMap := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{Name: "agent-prompt", Namespace: "default"},
+		Data:       map[string]string{"prompt": "trusted system instructions"},
+	}
+	reader := fake.NewClientBuilder().WithScheme(scheme).WithObjects(configMap).Build()
+	maxTurns := int32(7)
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent}}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "agent", Namespace: "default", UID: types.UID("agent-uid"), Generation: 3},
+		Spec: corev1alpha1.AgentSpec{
+			Model: &corev1alpha1.ModelConfig{Name: "model"},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type: corev1alpha1.AgentRuntimeClaude, DefaultMaxTurns: &maxTurns, DefaultReasoningEffort: agentReasoningEffortHigh,
+			},
+			SystemPrompt: &corev1alpha1.PromptSource{Inline: "trusted system instructions"},
+		},
+	}
+	inline, err := resolveACPAgentSessionConfiguration(context.Background(), reader, task, agent)
+	if err != nil {
+		t.Fatal(err)
+	}
+	agent.Spec.SystemPrompt = &corev1alpha1.PromptSource{
+		ConfigMapRef: &corev1alpha1.ConfigMapKeySelector{Name: configMap.Name, Key: "prompt"},
+	}
+	fromConfigMap, err := resolveACPAgentSessionConfiguration(context.Background(), reader, task, agent)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if inline != fromConfigMap || inline.SystemPrompt != "trusted system instructions" || inline.MaxTurns != maxTurns || inline.ReasoningEffort != agentReasoningEffortHigh {
+		t.Fatalf("resolved configurations differ: inline=%#v configMap=%#v", inline, fromConfigMap)
+	}
+}
+
+func TestResolveACPAgentSessionConfigurationFailsClosed(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	reader := fake.NewClientBuilder().WithScheme(scheme).Build()
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent}}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "agent", Namespace: "default", UID: types.UID("agent-uid"), Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model:   &corev1alpha1.ModelConfig{Name: "model"},
+			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeCodex},
+		},
+	}
+
+	agent.Spec.SystemPrompt = &corev1alpha1.PromptSource{
+		Inline: "inline", ConfigMapRef: &corev1alpha1.ConfigMapKeySelector{Name: "prompt", Key: "prompt"},
+	}
+	if _, err := resolveACPAgentSessionConfiguration(context.Background(), reader, task, agent); err == nil || !strings.Contains(err.Error(), "exactly one") {
+		t.Fatalf("dual system prompt source error = %v", err)
+	}
+
+	agent.Spec.SystemPrompt = &corev1alpha1.PromptSource{ConfigMapRef: &corev1alpha1.ConfigMapKeySelector{Name: "missing", Key: "prompt"}}
+	if _, err := resolveACPAgentSessionConfiguration(context.Background(), reader, task, agent); err == nil || !strings.Contains(err.Error(), "missing") {
+		t.Fatalf("missing ConfigMap error = %v", err)
+	}
+}
+
+func TestResolveACPAgentSessionConfigurationPreservesTransientReadErrors(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	transient := errors.New("temporary API outage")
+	reader := fake.NewClientBuilder().WithScheme(scheme).WithInterceptorFuncs(interceptor.Funcs{
+		Get: func(context.Context, client.WithWatch, client.ObjectKey, client.Object, ...client.GetOption) error {
+			return transient
+		},
+	}).Build()
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent}}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "agent", Namespace: "default", UID: types.UID("agent-uid"), Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model:   &corev1alpha1.ModelConfig{Name: "model"},
+			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeCodex},
+			SystemPrompt: &corev1alpha1.PromptSource{
+				ConfigMapRef: &corev1alpha1.ConfigMapKeySelector{Name: "prompt", Key: "text"},
+			},
+		},
+	}
+	_, err := resolveACPAgentSessionConfiguration(context.Background(), reader, task, agent)
+	if !errors.Is(err, transient) || isPermanentACPAgentConfigurationError(err) {
+		t.Fatalf("transient resolution error = %v, permanent=%t", err, isPermanentACPAgentConfigurationError(err))
+	}
+}
+
+func TestACPAgentConfigurationAndNativePolicyRotateOrReject(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	configMap := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{Name: "prompt", Namespace: "default"},
+		Data:       map[string]string{"text": "first"},
+	}
+	reader := fake.NewClientBuilder().WithScheme(scheme).WithObjects(configMap).Build()
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent}}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "agent", Namespace: "default", UID: types.UID("agent-uid"), Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model: &corev1alpha1.ModelConfig{Name: "model"},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeClaude,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+			SystemPrompt: &corev1alpha1.PromptSource{ConfigMapRef: &corev1alpha1.ConfigMapKeySelector{Name: "prompt", Key: "text"}},
+		},
+	}
+	configuration, err := resolveACPAgentSessionConfiguration(context.Background(), reader, task, agent)
+	if err != nil {
+		t.Fatal(err)
+	}
+	images := ACPRuntimeImages{Claude: "docker.io/example/claude@sha256:" + strings.Repeat("a", 64)}
+	first, err := PlanACPRuntimeWithConfiguration(task, agent, images, configuration)
+	if err != nil {
+		t.Fatal(err)
+	}
+	updated := configMap.DeepCopy()
+	updated.ResourceVersion = configMap.ResourceVersion
+	updated.Data["text"] = "second"
+	if err := reader.Update(context.Background(), updated); err != nil {
+		t.Fatal(err)
+	}
+	configuration, err = resolveACPAgentSessionConfiguration(context.Background(), reader, task, agent)
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := PlanACPRuntimeWithConfiguration(task, agent, images, configuration)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if first.Digest == second.Digest || first.Profile.AgentConfigurationDigest == second.Profile.AgentConfigurationDigest {
+		t.Fatal("ConfigMap system prompt content did not rotate the runtime profile")
+	}
+
+	allowBash := false
+	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"Read"}, AllowBash: &allowBash}
+	agent.Spec.Runtime.Type = corev1alpha1.AgentRuntimeCodex
+	agent.Spec.SystemPrompt = nil
+	configuration, err = buildACPAgentSessionConfiguration(task, agent, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = PlanACPRuntimeWithConfiguration(
+		task, agent,
+		ACPRuntimeImages{Codex: "docker.io/example/codex@sha256:" + strings.Repeat("b", 64)},
+		configuration,
+	)
+	if err == nil || !strings.Contains(err.Error(), "cannot exactly enforce") {
+		t.Fatalf("unenforceable Codex native policy error = %v", err)
+	}
+
+	agent.Spec.SystemPrompt = &corev1alpha1.PromptSource{Inline: strings.Repeat("<", 16<<10)}
+	task.Spec.AgentRuntime = nil
+	configuration, err = buildACPAgentSessionConfiguration(task, agent, agent.Spec.SystemPrompt.Inline)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = PlanACPRuntimeWithConfiguration(
+		task, agent,
+		ACPRuntimeImages{Codex: "docker.io/example/codex@sha256:" + strings.Repeat("b", 64)},
+		configuration,
+	)
+	if err == nil || !strings.Contains(err.Error(), "safe environment limit") {
+		t.Fatalf("oversized Codex system prompt error = %v", err)
+	}
+
+	agent.Spec.Runtime.Type = corev1alpha1.AgentRuntimeCopilot
+	agent.Spec.SystemPrompt = &corev1alpha1.PromptSource{Inline: "unsupported"}
+	task.Spec.AgentRuntime = nil
+	configuration, err = buildACPAgentSessionConfiguration(task, agent, "unsupported")
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = PlanACPRuntimeWithConfiguration(
+		task, agent,
+		ACPRuntimeImages{Copilot: "docker.io/example/copilot@sha256:" + strings.Repeat("c", 64)},
+		configuration,
+	)
+	if err == nil || !strings.Contains(err.Error(), "cannot enforce Agent systemPrompt") {
+		t.Fatalf("unenforceable Copilot system prompt error = %v", err)
+	}
+}
+
+func TestResolvedACPAgentConfigurationDigestMatchesProfile(t *testing.T) {
+	maxTurns := int32(9)
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent}}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "agent", Namespace: "default", UID: types.UID("agent-uid"), Generation: 2},
+		Spec: corev1alpha1.AgentSpec{
+			Model: &corev1alpha1.ModelConfig{Name: "model"},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeClaude,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+				DefaultMaxTurns: &maxTurns,
+			},
+			SystemPrompt: &corev1alpha1.PromptSource{Inline: "system"},
+		},
+	}
+	configuration, err := buildACPAgentSessionConfiguration(task, agent, "system")
+	if err != nil {
+		t.Fatal(err)
+	}
+	plan, err := PlanACPRuntimeWithConfiguration(
+		task, agent,
+		ACPRuntimeImages{Claude: "docker.io/example/claude@sha256:" + strings.Repeat("d", 64)},
+		configuration,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	digest, err := harnessv2.CanonicalAgentConfigurationDigest(configuration)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if plan.Profile.AgentConfigurationDigest != digest {
+		t.Fatalf("profile AgentConfigurationDigest = %q, want %q", plan.Profile.AgentConfigurationDigest, digest)
+	}
+}
+
+func TestBuildACPAgentSessionConfigurationAcceptsLegacyDefaultTemperature(t *testing.T) {
+	temperature := legacyDefaultACPTemperature
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent}}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{UID: types.UID("agent-uid"), Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model:   &corev1alpha1.ModelConfig{Name: "model", Temperature: &temperature},
+			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeCodex},
+		},
+	}
+	if _, err := buildACPAgentSessionConfiguration(task, agent, ""); err != nil {
+		t.Fatalf("legacy default temperature rejected: %v", err)
+	}
+}
diff --git a/internal/controller/acp_agent_configuration_tools_test.go b/internal/controller/acp_agent_configuration_tools_test.go
new file mode 100644
index 000000000..c51493ce5
--- /dev/null
+++ b/internal/controller/acp_agent_configuration_tools_test.go
@@ -0,0 +1,190 @@
+package controller
+
+import (
+	"context"
+	"errors"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/utils/ptr"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+	"github.com/orka-agents/orka/internal/store/sqlite"
+)
+
+const unsupportedACPAgentToolsMessage = "built-in ACP runtimes do not support enabled Agent.spec.tools; refusing to omit declared tools"
+
+func TestPlanACPRuntimeAgentToolReferenceSemantics(t *testing.T) {
+	enabled := true
+	disabled := false
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent}}
+
+	for _, runtimeType := range []corev1alpha1.AgentRuntimeType{
+		corev1alpha1.AgentRuntimeCodex,
+		corev1alpha1.AgentRuntimeClaude,
+		corev1alpha1.AgentRuntimeCopilot,
+	} {
+		t.Run(string(runtimeType), func(t *testing.T) {
+			for _, test := range []struct {
+				name      string
+				enabled   *bool
+				wantError bool
+			}{
+				{name: "default enabled", wantError: true},
+				{name: "explicit enabled", enabled: &enabled, wantError: true},
+				{name: "explicit disabled", enabled: &disabled},
+			} {
+				t.Run(test.name, func(t *testing.T) {
+					agent := &corev1alpha1.Agent{
+						ObjectMeta: metav1.ObjectMeta{UID: types.UID("agent-uid"), Generation: 1},
+						Spec: corev1alpha1.AgentSpec{
+							Model: &corev1alpha1.ModelConfig{Name: "model"},
+							Runtime: &corev1alpha1.AgentCLIRuntime{
+								Type:            runtimeType,
+								ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+							},
+							Tools: []corev1alpha1.ToolReference{{Name: "web_search", Enabled: test.enabled}},
+						},
+					}
+
+					_, err := PlanACPRuntime(task, agent, acpAgentToolTestImages())
+					if test.wantError {
+						if err == nil {
+							t.Fatal("PlanACPRuntime() succeeded and silently omitted enabled Agent.spec.tools")
+						}
+						if err.Error() != unsupportedACPAgentToolsMessage {
+							t.Fatalf("PlanACPRuntime() error = %q, want %q", err, unsupportedACPAgentToolsMessage)
+						}
+						if !isPermanentACPAgentConfigurationError(err) {
+							t.Fatalf("PlanACPRuntime() error = %v, want permanent ACP configuration error", err)
+						}
+						return
+					}
+					if err != nil {
+						t.Fatalf("PlanACPRuntime() rejected explicitly disabled Agent.spec.tools: %v", err)
+					}
+				})
+			}
+		})
+	}
+}
+
+func TestQueueACPRuntimeTaskRejectsEnabledAgentToolsBeforePoolDemand(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace:  "default",
+			Name:       "task-with-tools",
+			UID:        types.UID("11111111-2222-3333-4444-555555555555"),
+			Generation: 1,
+		},
+		Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Prompt: "use the declared tool"},
+	}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace:  "default",
+			Name:       "agent-with-tools",
+			UID:        types.UID("aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"),
+			Generation: 1,
+		},
+		Spec: corev1alpha1.AgentSpec{
+			Model:   &corev1alpha1.ModelConfig{Name: acpTestModel},
+			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeCodex},
+			Tools:   []corev1alpha1.ToolReference{{Name: "web_search"}},
+		},
+	}
+	kubeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithStatusSubresource(&corev1alpha1.Task{}, &corev1alpha1.RuntimePool{}).
+		WithObjects(task).
+		Build()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "store.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		if err := db.Close(); err != nil {
+			t.Errorf("close durable control database: %v", err)
+		}
+	})
+	controlStore := sqlite.NewStore(db, "test")
+	epochs := NewControllerEpochManager(controlStore, "controller-test")
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	t.Cleanup(func() {
+		cancelEpoch()
+		if err := <-epochDone; err != nil {
+			t.Errorf("controller epoch manager shutdown: %v", err)
+		}
+	})
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	if _, err := epochs.CurrentFence(ctx); err != nil {
+		t.Fatal(err)
+	}
+
+	reconciler := &TaskReconciler{
+		Client: kubeClient, Scheme: scheme, DurableControlStore: controlStore,
+		ControllerEpochManager: epochs, ACPRuntimeEnabled: true, ACPRuntimeNamespace: "orka-runtimes",
+		ACPRuntimeImages: acpAgentToolTestImages(),
+	}
+	current := configureAgentExecutionBindingTest(t, ctx, reconciler, task)
+	if result, err, handled := reconciler.ensureAgentExecutionBinding(ctx, current, agent); err != nil || !handled {
+		t.Fatalf("invalid tools binding result=%#v handled=%v err=%v", result, handled, err)
+	}
+
+	var pools corev1alpha1.RuntimePoolList
+	if err := kubeClient.List(ctx, &pools); err != nil {
+		t.Fatal(err)
+	}
+	if len(pools.Items) != 0 {
+		t.Fatalf("tools rejection unexpectedly created RuntimePools: %#v", pools.Items)
+	}
+	failed := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, failed); err != nil {
+		t.Fatal(err)
+	}
+	if failed.Status.Phase != corev1alpha1.TaskPhaseFailed || failed.Status.Message != unsupportedACPAgentToolsMessage ||
+		failed.Status.Attempts != 0 || failed.Status.Execution == nil ||
+		failed.Status.Execution.State != corev1alpha1.TaskExecutionStateFailed ||
+		failed.Status.Execution.Reason != corev1alpha1.TaskExecutionReason("InvalidRuntimeProfile") ||
+		failed.Status.Execution.Attempt != 0 || failed.Status.Execution.PromptID != "" || failed.Status.Execution.RuntimePoolName != "" ||
+		failed.Status.Delivery == nil || failed.Status.Delivery.State != corev1alpha1.TaskDeliveryStateNotRequested ||
+		failed.Status.Delivery.Outcome != corev1alpha1.TaskDeliveryOutcomeNotRequested {
+		t.Fatalf("tools rejection status: %#v", failed.Status)
+	}
+	if failed.Labels[acpRuntimeTaskPoolLabel] != "" || failed.Annotations[acpRuntimeQueuedAtAnnotation] != "" {
+		t.Fatalf("tools rejection recorded queue metadata: labels=%#v annotations=%#v", failed.Labels, failed.Annotations)
+	}
+	attemptID, err := (store.PromptAttemptKey{
+		Namespace: task.Namespace,
+		TaskUID:   string(task.UID),
+		Attempt:   1,
+		PromptID:  "prompt-" + string(task.UID) + "-1",
+	}).CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := controlStore.GetPromptAttempt(ctx, attemptID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("tools rejection durable attempt error = %v, want not found", err)
+	}
+}
+
+func acpAgentToolTestImages() ACPRuntimeImages {
+	return ACPRuntimeImages{
+		Codex:   "docker.io/example/codex@sha256:" + strings.Repeat("a", 64),
+		Claude:  "docker.io/example/claude@sha256:" + strings.Repeat("b", 64),
+		Copilot: "docker.io/example/copilot@sha256:" + strings.Repeat("c", 64),
+	}
+}
diff --git a/internal/controller/acp_artifact_retention_test.go b/internal/controller/acp_artifact_retention_test.go
new file mode 100644
index 000000000..62c4d2afa
--- /dev/null
+++ b/internal/controller/acp_artifact_retention_test.go
@@ -0,0 +1,282 @@
+package controller
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/artifactcap"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+func TestRetireACPArtifactIdentitiesWaitsForAllAttemptsAndPublications(t *testing.T) {
+	t.Parallel()
+	scheme := newTestScheme()
+	task := artifactRetentionTask()
+	currentPublicationID := publicationIDForTask(task)
+	oldAttempt := &corev1alpha1.PromptAttempt{
+		ObjectMeta: metav1.ObjectMeta{Namespace: task.Namespace, Name: "old-attempt"},
+		Spec:       corev1alpha1.PromptAttemptSpec{ID: "old-attempt", TaskUID: string(task.UID), Attempt: 1, PromptID: "old-prompt"},
+		Status: corev1alpha1.PromptAttemptStatus{
+			ExecutionState: corev1alpha1.PromptAttemptExecutionState(store.PromptExecutionRunning),
+			DeliveryState:  corev1alpha1.PromptAttemptDeliveryState(store.PromptDeliveryNotRequested),
+		},
+	}
+	currentAttempt := &corev1alpha1.PromptAttempt{
+		ObjectMeta: metav1.ObjectMeta{Namespace: task.Namespace, Name: "current-attempt"},
+		Spec:       corev1alpha1.PromptAttemptSpec{ID: "current-attempt", TaskUID: string(task.UID), Attempt: 2, PromptID: task.Status.Execution.PromptID},
+		Status: corev1alpha1.PromptAttemptStatus{
+			ExecutionState: corev1alpha1.PromptAttemptExecutionState(store.PromptExecutionSucceeded),
+			DeliveryState:  corev1alpha1.PromptAttemptDeliveryState(store.PromptDeliveryVerifiedExact),
+		},
+	}
+	oldPublication := &corev1alpha1.Publication{
+		ObjectMeta: metav1.ObjectMeta{Namespace: task.Namespace, Name: "old-publication"},
+		Spec:       corev1alpha1.PublicationSpec{ID: "publication-old", TaskUID: string(task.UID)},
+		Status:     corev1alpha1.PublicationStatus{State: corev1alpha1.PublicationControlState(store.PublicationPublishing)},
+	}
+	currentPublication := &corev1alpha1.Publication{
+		ObjectMeta: metav1.ObjectMeta{Namespace: task.Namespace, Name: "current-publication"},
+		Spec:       corev1alpha1.PublicationSpec{ID: currentPublicationID, TaskUID: string(task.UID)},
+		Status:     corev1alpha1.PublicationStatus{State: corev1alpha1.PublicationControlState(store.PublicationVerifiedExact)},
+	}
+	reconciler := newUnitReconciler(scheme, task, oldAttempt, currentAttempt, oldPublication, currentPublication)
+	reconciler.DurableControlStore = artifactRetentionControlStore{}
+	retirer := &recordingIdentityRetirer{}
+	reconciler.ACPArtifactRetirer = retirer
+
+	ready, err := reconciler.retireACPArtifactIdentities(context.Background(), task)
+	if err != nil || ready || len(retirer.calls) != 0 {
+		t.Fatalf("retirement with active attempt = ready:%v calls:%v err:%v", ready, retirer.calls, err)
+	}
+	setPromptAttemptTerminal(t, reconciler.Client, oldAttempt)
+	ready, err = reconciler.retireACPArtifactIdentities(context.Background(), task)
+	if err != nil || ready || len(retirer.calls) != 0 {
+		t.Fatalf("retirement with active publication = ready:%v calls:%v err:%v", ready, retirer.calls, err)
+	}
+	setPublicationTerminal(t, reconciler.Client, oldPublication)
+	ready, err = reconciler.retireACPArtifactIdentities(context.Background(), task)
+	if err != nil || !ready {
+		t.Fatalf("terminal retirement = ready:%v err:%v", ready, err)
+	}
+	want := []artifactcap.Identity{
+		{Namespace: task.Namespace, TaskID: string(task.UID)},
+		{Namespace: task.Namespace, PublicationID: currentPublicationID},
+		{Namespace: task.Namespace, PublicationID: "publication-old"},
+	}
+	if len(retirer.calls) != 1 || !identitySlicesEqual(retirer.calls[0], want) {
+		t.Fatalf("retired identities = %#v, want %#v", retirer.calls, want)
+	}
+	stored := &corev1alpha1.Task{}
+	if err := reconciler.Get(context.Background(), client.ObjectKeyFromObject(task), stored); err != nil {
+		t.Fatal(err)
+	}
+	if !meta.IsStatusConditionTrue(stored.Status.Conditions, conditionTypeACPArtifactsRetired) {
+		t.Fatalf("Task conditions = %#v, want %s=True", stored.Status.Conditions, conditionTypeACPArtifactsRetired)
+	}
+}
+
+func TestHandleCompletedRetiresArtifactsAfterDurableSettlement(t *testing.T) {
+	t.Parallel()
+	task := artifactRetentionTask()
+	reconciler, retirer := newSettledArtifactRetentionReconciler(t, task)
+
+	result, err := reconciler.handleCompleted(context.Background(), task)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.RequeueAfter != 0 {
+		t.Fatalf("handleCompleted() requeue = %v, want none", result.RequeueAfter)
+	}
+	if len(retirer.calls) != 1 {
+		t.Fatalf("retirement calls = %#v, want one", retirer.calls)
+	}
+}
+
+func TestHandleCompletedRetiresArtifactsBeforeRetryingFailedWebhook(t *testing.T) {
+	t.Parallel()
+	var webhookAttempts atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		webhookAttempts.Add(1)
+		http.Error(w, "retry", http.StatusServiceUnavailable)
+	}))
+	t.Cleanup(server.Close)
+
+	task := artifactRetentionTask()
+	task.Spec.WebhookURL = server.URL
+	reconciler, retirer := newSettledArtifactRetentionReconciler(t, task)
+	notifier := NewWebhookNotifier()
+	notifier.skipURLValidation = true
+	reconciler.WebhookNotifier = notifier
+
+	for wantWebhookAttempts := int32(1); wantWebhookAttempts <= 2; wantWebhookAttempts++ {
+		current := &corev1alpha1.Task{}
+		if err := reconciler.Get(context.Background(), client.ObjectKeyFromObject(task), current); err != nil {
+			t.Fatal(err)
+		}
+		result, err := reconciler.handleCompleted(context.Background(), current)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if result.RequeueAfter != 30*time.Second {
+			t.Fatalf("handleCompleted() requeue = %v, want 30s", result.RequeueAfter)
+		}
+		if got := webhookAttempts.Load(); got != wantWebhookAttempts {
+			t.Fatalf("webhook attempts = %d, want %d", got, wantWebhookAttempts)
+		}
+		if len(retirer.calls) != 1 {
+			t.Fatalf("retirement calls after webhook attempt %d = %#v, want exactly one", wantWebhookAttempts, retirer.calls)
+		}
+		if !meta.IsStatusConditionTrue(current.Status.Conditions, conditionTypeACPArtifactsRetired) {
+			t.Fatalf("Task conditions after webhook attempt %d = %#v, want %s=True", wantWebhookAttempts, current.Status.Conditions, conditionTypeACPArtifactsRetired)
+		}
+	}
+}
+
+func newSettledArtifactRetentionReconciler(
+	t *testing.T,
+	task *corev1alpha1.Task,
+) (*TaskReconciler, *recordingIdentityRetirer) {
+	t.Helper()
+	scheme := newTestScheme()
+	attemptKey := store.PromptAttemptKey{
+		Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: int64(task.Status.Execution.Attempt), PromptID: task.Status.Execution.PromptID,
+	}
+	attemptID, err := attemptKey.CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	attempt := &store.PromptAttempt{
+		ID: attemptID, Key: attemptKey, ExecutionState: store.PromptExecutionSucceeded, DeliveryState: store.PromptDeliveryVerifiedExact,
+	}
+	publication := &store.Publication{ID: publicationIDForTask(task), State: store.PublicationVerifiedExact}
+	projection := &store.OutboxProjection{ID: standaloneTaskTerminalProjectionID(task, task.Status.Execution.Attempt), State: store.OutboxProjectionDelivered}
+	attemptObject := &corev1alpha1.PromptAttempt{
+		ObjectMeta: metav1.ObjectMeta{Namespace: task.Namespace, Name: "settled-attempt"},
+		Spec: corev1alpha1.PromptAttemptSpec{
+			ID: attemptID, TaskUID: string(task.UID), Attempt: int64(task.Status.Execution.Attempt), PromptID: task.Status.Execution.PromptID,
+		},
+		Status: corev1alpha1.PromptAttemptStatus{
+			ExecutionState: corev1alpha1.PromptAttemptExecutionState(store.PromptExecutionSucceeded),
+			DeliveryState:  corev1alpha1.PromptAttemptDeliveryState(store.PromptDeliveryVerifiedExact),
+		},
+	}
+	publicationObject := &corev1alpha1.Publication{
+		ObjectMeta: metav1.ObjectMeta{Namespace: task.Namespace, Name: "settled-publication"},
+		Spec:       corev1alpha1.PublicationSpec{ID: publication.ID, TaskUID: string(task.UID)},
+		Status:     corev1alpha1.PublicationStatus{State: corev1alpha1.PublicationControlState(store.PublicationVerifiedExact)},
+	}
+	reconciler := newUnitReconciler(scheme, task, attemptObject, publicationObject)
+	reconciler.DurableControlStore = artifactRetentionControlStore{attempt: attempt, publication: publication, projection: projection}
+	retirer := &recordingIdentityRetirer{}
+	reconciler.ACPArtifactRetirer = retirer
+	return reconciler, retirer
+}
+
+func artifactRetentionTask() *corev1alpha1.Task {
+	return &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "artifact-retention", UID: types.UID("11111111-2222-3333-4444-555555555555")},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent, Workspace: &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentWrite},
+		},
+		Status: corev1alpha1.TaskStatus{
+			Phase: corev1alpha1.TaskPhaseSucceeded,
+			Execution: &corev1alpha1.TaskExecutionStatus{
+				Attempt: 2, PromptID: "prompt-current", State: corev1alpha1.TaskExecutionStateSucceeded, Outcome: corev1alpha1.TaskExecutionOutcomeSucceeded,
+			},
+			Delivery: &corev1alpha1.TaskDeliveryStatus{
+				State: corev1alpha1.TaskDeliveryStateVerifiedExact, Outcome: corev1alpha1.TaskDeliveryOutcomeVerifiedExact,
+			},
+		},
+	}
+}
+
+type artifactRetentionControlStore struct {
+	store.DurableControlStore
+	attempt     *store.PromptAttempt
+	publication *store.Publication
+	projection  *store.OutboxProjection
+}
+
+func (s artifactRetentionControlStore) GetPromptAttempt(context.Context, string) (*store.PromptAttempt, error) {
+	if s.attempt == nil {
+		return nil, store.ErrNotFound
+	}
+	copy := *s.attempt
+	return &copy, nil
+}
+
+func (s artifactRetentionControlStore) GetPublication(context.Context, string) (*store.Publication, error) {
+	if s.publication == nil {
+		return nil, store.ErrNotFound
+	}
+	copy := *s.publication
+	return &copy, nil
+}
+
+func (s artifactRetentionControlStore) GetOutboxProjection(context.Context, string) (*store.OutboxProjection, error) {
+	if s.projection == nil {
+		return nil, store.ErrNotFound
+	}
+	copy := *s.projection
+	return &copy, nil
+}
+
+type recordingIdentityRetirer struct {
+	calls [][]artifactcap.Identity
+	err   error
+}
+
+func (r *recordingIdentityRetirer) Retire(_ context.Context, identities ...artifactcap.Identity) error {
+	if r.err != nil {
+		return r.err
+	}
+	r.calls = append(r.calls, append([]artifactcap.Identity(nil), identities...))
+	return nil
+}
+
+func setPromptAttemptTerminal(t *testing.T, kubeClient client.Client, object *corev1alpha1.PromptAttempt) {
+	t.Helper()
+	current := &corev1alpha1.PromptAttempt{}
+	if err := kubeClient.Get(context.Background(), client.ObjectKeyFromObject(object), current); err != nil {
+		t.Fatal(err)
+	}
+	current.Status.ExecutionState = corev1alpha1.PromptAttemptExecutionState(store.PromptExecutionFailed)
+	current.Status.DeliveryState = corev1alpha1.PromptAttemptDeliveryState(store.PromptDeliveryNoChange)
+	if err := kubeClient.Status().Update(context.Background(), current); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func setPublicationTerminal(t *testing.T, kubeClient client.Client, object *corev1alpha1.Publication) {
+	t.Helper()
+	current := &corev1alpha1.Publication{}
+	if err := kubeClient.Get(context.Background(), client.ObjectKeyFromObject(object), current); err != nil {
+		t.Fatal(err)
+	}
+	current.Status.State = corev1alpha1.PublicationControlState(store.PublicationDeliveryConflict)
+	if err := kubeClient.Status().Update(context.Background(), current); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func identitySlicesEqual(left, right []artifactcap.Identity) bool {
+	if len(left) != len(right) {
+		return false
+	}
+	for i := range left {
+		if left[i] != right[i] {
+			return false
+		}
+	}
+	return true
+}
diff --git a/internal/controller/acp_credentials.go b/internal/controller/acp_credentials.go
new file mode 100644
index 000000000..c372bc9f8
--- /dev/null
+++ b/internal/controller/acp_credentials.go
@@ -0,0 +1,184 @@
+package controller
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"strings"
+
+	corev1 "k8s.io/api/core/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+const (
+	defaultACPWorkspaceCredentialKey = "token"
+	maxACPWorkspaceCredentialBytes   = 32 << 10
+)
+
+// freezeWorkspaceCredentialVersions records only non-secret Secret
+// resourceVersions at reservation. The credential broker later requires the
+// exact version to remain current, so rotation after reservation fails closed
+// instead of silently changing the operation's authority.
+func (d *ACPDispatcher) freezeWorkspaceCredentialVersions(ctx context.Context, task *corev1alpha1.Task) error {
+	if task == nil || task.Status.Execution == nil || task.Spec.Workspace == nil {
+		return nil
+	}
+	workspace := task.Spec.Workspace
+	execution := task.Status.Execution
+	readVersion, err := d.workspaceCredentialResourceVersion(ctx, task, workspace.ReadCredentialRef)
+	if err != nil {
+		err = classifyACPWorkspaceCredentialFreezeError(
+			err, store.PromptCredentialSourceRead, "read workspace credential", execution.ReadCredentialResourceVersion,
+		)
+		return fmt.Errorf("freeze read workspace credential: %w", err)
+	}
+	publicationReadVersion, err := d.workspaceCredentialResourceVersion(ctx, task, workspace.PublicationReadCredentialRef)
+	if err != nil {
+		err = classifyACPWorkspaceCredentialFreezeError(
+			err, store.PromptCredentialTargetRead, "publication read credential", execution.PublicationReadCredentialResourceVersion,
+		)
+		return fmt.Errorf("freeze publication read credential: %w", err)
+	}
+	publicationVersion, err := d.workspaceCredentialResourceVersion(ctx, task, workspace.PublicationCredentialRef)
+	if err != nil {
+		err = classifyACPWorkspaceCredentialFreezeError(
+			err, store.PromptCredentialTargetWrite, "publication write credential", execution.PublicationCredentialResourceVersion,
+		)
+		return fmt.Errorf("freeze publication write credential: %w", err)
+	}
+	forgeVersion, err := d.workspaceCredentialResourceVersion(ctx, task, workspace.ForgeCredentialRef)
+	if err != nil {
+		err = classifyACPWorkspaceCredentialFreezeError(
+			err, store.PromptCredentialForge, "forge credential", execution.ForgeCredentialResourceVersion,
+		)
+		return fmt.Errorf("freeze forge credential: %w", err)
+	}
+	type frozenCredentialVersion struct {
+		role     store.PromptCredentialRole
+		expected string
+		current  string
+	}
+	for label, version := range map[string]frozenCredentialVersion{
+		"read credential":              {store.PromptCredentialSourceRead, execution.ReadCredentialResourceVersion, readVersion},
+		"publication read credential":  {store.PromptCredentialTargetRead, execution.PublicationReadCredentialResourceVersion, publicationReadVersion},
+		"publication write credential": {store.PromptCredentialTargetWrite, execution.PublicationCredentialResourceVersion, publicationVersion},
+		"forge credential":             {store.PromptCredentialForge, execution.ForgeCredentialResourceVersion, forgeVersion},
+	} {
+		if version.expected != version.current {
+			return &acpWorkspaceCredentialBlockedError{
+				role: version.role, label: label, expectedResourceVersion: version.expected,
+			}
+		}
+	}
+	if execution.ReadCredentialResourceVersion == readVersion &&
+		execution.PublicationReadCredentialResourceVersion == publicationReadVersion &&
+		execution.PublicationCredentialResourceVersion == publicationVersion &&
+		execution.ForgeCredentialResourceVersion == forgeVersion {
+		return nil
+	}
+	return d.patchExecution(ctx, task, func(status *corev1alpha1.TaskExecutionStatus) {
+		if status.ReadCredentialResourceVersion == "" {
+			status.ReadCredentialResourceVersion = readVersion
+		}
+		if status.PublicationReadCredentialResourceVersion == "" {
+			status.PublicationReadCredentialResourceVersion = publicationReadVersion
+		}
+		if status.PublicationCredentialResourceVersion == "" {
+			status.PublicationCredentialResourceVersion = publicationVersion
+		}
+		if status.ForgeCredentialResourceVersion == "" {
+			status.ForgeCredentialResourceVersion = forgeVersion
+		}
+	})
+}
+
+func (d *ACPDispatcher) workspaceCredentialResourceVersion(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	reference *corev1alpha1.WorkspaceCredentialReference,
+) (string, error) {
+	if reference == nil || strings.TrimSpace(reference.Name) == "" {
+		return "", nil
+	}
+	reader := client.Reader(d.Client)
+	if d.APIReader != nil {
+		reader = d.APIReader
+	}
+	secret := &corev1.Secret{}
+	if err := reader.Get(ctx, client.ObjectKey{Namespace: task.Namespace, Name: strings.TrimSpace(reference.Name)}, secret); err != nil {
+		return "", err
+	}
+	key := strings.TrimSpace(reference.Key)
+	if key == "" {
+		key = defaultACPWorkspaceCredentialKey
+	}
+	value, ok := secret.Data[key]
+	if !ok || len(bytes.TrimSpace(value)) == 0 || len(value) > maxACPWorkspaceCredentialBytes || bytes.ContainsAny(value, "\x00") {
+		return "", fmt.Errorf("secret key %q is missing or invalid", key)
+	}
+	if strings.TrimSpace(secret.ResourceVersion) == "" {
+		return "", fmt.Errorf("secret resourceVersion is unavailable")
+	}
+	return secret.ResourceVersion, nil
+}
+
+type acpCredentialVersions struct {
+	SourceRead  string
+	TargetRead  string
+	TargetWrite string
+	Forge       string
+}
+
+func resolvePromptCredentialBindings(
+	ctx context.Context,
+	reader client.Reader,
+	task *corev1alpha1.Task,
+) ([]store.PromptCredentialBinding, acpCredentialVersions, error) {
+	if reader == nil || task == nil || task.Spec.Workspace == nil {
+		return nil, acpCredentialVersions{}, nil
+	}
+	type requestedBinding struct {
+		role      store.PromptCredentialRole
+		reference *corev1alpha1.WorkspaceCredentialReference
+		set       func(*acpCredentialVersions, string)
+	}
+	workspace := task.Spec.Workspace
+	requests := []requestedBinding{
+		{store.PromptCredentialSourceRead, workspace.ReadCredentialRef, func(v *acpCredentialVersions, value string) { v.SourceRead = value }},
+		{store.PromptCredentialTargetRead, workspace.PublicationReadCredentialRef, func(v *acpCredentialVersions, value string) { v.TargetRead = value }},
+		{store.PromptCredentialTargetWrite, workspace.PublicationCredentialRef, func(v *acpCredentialVersions, value string) { v.TargetWrite = value }},
+		{store.PromptCredentialForge, workspace.ForgeCredentialRef, func(v *acpCredentialVersions, value string) { v.Forge = value }},
+	}
+	bindings := make([]store.PromptCredentialBinding, 0, len(requests))
+	versions := acpCredentialVersions{}
+	for _, requested := range requests {
+		if requested.reference == nil || strings.TrimSpace(requested.reference.Name) == "" {
+			continue
+		}
+		secret := &corev1.Secret{}
+		if err := reader.Get(ctx, client.ObjectKey{Namespace: task.Namespace, Name: strings.TrimSpace(requested.reference.Name)}, secret); err != nil {
+			return nil, acpCredentialVersions{}, err
+		}
+		key := strings.TrimSpace(requested.reference.Key)
+		if key == "" {
+			key = defaultACPWorkspaceCredentialKey
+		}
+		value, ok := secret.Data[key]
+		if !ok || len(bytes.TrimSpace(value)) == 0 || len(value) > maxACPWorkspaceCredentialBytes || bytes.ContainsAny(value, "\x00") {
+			return nil, acpCredentialVersions{}, fmt.Errorf("secret key %q is missing or invalid", key)
+		}
+		binding := store.PromptCredentialBinding{
+			Role: requested.role, Namespace: task.Namespace, SecretName: secret.Name, SecretKey: key,
+			SecretUID: string(secret.UID), ResourceVersion: secret.ResourceVersion,
+		}
+		if err := binding.Validate(); err != nil {
+			return nil, acpCredentialVersions{}, err
+		}
+		bindings = append(bindings, binding)
+		requested.set(&versions, secret.ResourceVersion)
+	}
+	return bindings, versions, nil
+}
diff --git a/internal/controller/acp_dispatcher.go b/internal/controller/acp_dispatcher.go
new file mode 100644
index 000000000..47a443a1d
--- /dev/null
+++ b/internal/controller/acp_dispatcher.go
@@ -0,0 +1,3961 @@
+package controller
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/url"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/util/retry"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	logf "sigs.k8s.io/controller-runtime/pkg/log"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/artifactcap"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	publisherservice "github.com/orka-agents/orka/internal/publisher/service"
+	"github.com/orka-agents/orka/internal/store"
+	"github.com/orka-agents/orka/internal/tools"
+)
+
+const (
+	DefaultACPDispatchInterval                           = time.Second
+	DefaultACPDispatchWorkers                            = 4
+	DefaultACPIdlePoolTTL                                = 15 * time.Minute
+	DefaultACPRuntimePoolReservationTTL                  = 2 * time.Minute
+	DefaultACPRateLimitReconcileInterval                 = time.Second
+	acpSucceededOperation                                = "succeeded"
+	acpCredentialBlockedOperation                        = "credential-blocked"
+	acpCredentialBlockedMessage                          = "workspace credential changed or became unavailable after queue; refusing to change frozen authority"
+	acpExternalRuntimeDispatchUnsupportedExecutionReason = corev1alpha1.TaskExecutionReason("ExternalRuntimeDispatchUnsupported")
+	acpCredentialBlockedExecutionReason                  = corev1alpha1.TaskExecutionReason("CredentialBlocked")
+)
+
+var (
+	errACPRuntimePoolAtCapacity      = errors.New("RuntimePool is at capacity")
+	errACPRuntimePoolNotAdmitting    = errors.New("RuntimePool is not admitting work")
+	errACPRuntimePoolReservationLost = errors.New("RuntimePool capacity reservation is no longer held")
+)
+
+type acpReservedRetryStage string
+
+const (
+	acpReservedRetryRuntimeClient        acpReservedRetryStage = "runtime-client"
+	acpReservedRetryCapabilities         acpReservedRetryStage = "capabilities"
+	acpReservedRetrySessionConfiguration acpReservedRetryStage = "session-configuration"
+	acpReservedRetryProfile              acpReservedRetryStage = "profile"
+	acpReservedRetryMCPConfiguration     acpReservedRetryStage = "mcp-configuration"
+	acpReservedRetryNamespaceLineage     acpReservedRetryStage = "namespace-lineage"
+	acpReservedRetrySessionPreparation   acpReservedRetryStage = "session-preparation"
+	acpReservedRetryReservationResize    acpReservedRetryStage = "reservation-resize"
+)
+
+// ACPDispatcher owns long-lived v2 prompt streams outside reconcile workers.
+// Task reconciliation only persists queued demand; this leader-elected runnable
+// reserves capacity and advances the durable attempt state machine.
+type ACPDispatcher struct {
+	Client                   client.Client
+	APIReader                client.Reader
+	Store                    store.DurableControlStore
+	ResultStore              store.ResultStore
+	Snapshots                store.AgentExecutionSnapshotStore
+	Epochs                   *ControllerEpochManager
+	Sessions                 *ACPSessionContinuity
+	Publisher                *publisherservice.Client
+	ArtifactCapabilitySecret []byte
+	ArtifactReservations     artifactcap.CapabilityReservationRecorder
+	MCPRegistry              *tools.Registry
+	Interval                 time.Duration
+	MaxConcurrent            int
+	IdlePoolTTL              time.Duration
+	ReservationTTL           time.Duration
+	RateLimitRetryInterval   time.Duration
+	AdmissionGate            *ACPAdmissionGate
+	runtimeContextFactory    func(context.Context, *corev1alpha1.Task) (context.Context, context.CancelFunc)
+
+	mu              sync.Mutex
+	active          map[types.UID]struct{}
+	sem             chan struct{}
+	runtimeSessions map[string]ACPRuntimeSessionBinding
+}
+
+func (d *ACPDispatcher) NeedLeaderElection() bool { return true }
+
+func (d *ACPDispatcher) Start(ctx context.Context) error {
+	if d.Client == nil || d.Store == nil || d.ResultStore == nil || d.Snapshots == nil || d.Epochs == nil {
+		return fmt.Errorf("ACP dispatcher requires Kubernetes client, durable control store, result store, immutable snapshot store, and epoch manager")
+	}
+	if d.APIReader == nil {
+		d.APIReader = d.Client
+	}
+	if d.Interval <= 0 {
+		d.Interval = DefaultACPDispatchInterval
+	}
+	if d.MaxConcurrent <= 0 {
+		d.MaxConcurrent = DefaultACPDispatchWorkers
+	}
+	if d.IdlePoolTTL <= 0 {
+		d.IdlePoolTTL = DefaultACPIdlePoolTTL
+	}
+	if d.ReservationTTL <= 0 {
+		d.ReservationTTL = DefaultACPRuntimePoolReservationTTL
+	}
+	if d.RateLimitRetryInterval <= 0 {
+		d.RateLimitRetryInterval = DefaultACPRateLimitReconcileInterval
+	}
+	d.mu.Lock()
+	if d.active == nil {
+		d.active = make(map[types.UID]struct{})
+	}
+	if d.sem == nil {
+		d.sem = make(chan struct{}, d.MaxConcurrent)
+	}
+	if d.runtimeSessions == nil {
+		d.runtimeSessions = make(map[string]ACPRuntimeSessionBinding)
+	}
+	d.mu.Unlock()
+	if _, err := d.Epochs.CurrentFence(ctx); err != nil {
+		return err
+	}
+	if err := d.recoverStaleAttempts(ctx); err != nil {
+		return fmt.Errorf("recover stale ACP attempts: %w", err)
+	}
+	ticker := time.NewTicker(d.Interval)
+	defer ticker.Stop()
+	for {
+		if err := d.dispatchOnce(ctx); err != nil && !errors.Is(err, context.Canceled) {
+			logf.FromContext(ctx).Error(err, "ACP dispatcher scan failed")
+		}
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-ticker.C:
+		}
+	}
+}
+
+func (d *ACPDispatcher) dispatchOnce(ctx context.Context) error {
+	if err := d.reconcileExpiredExternalEffects(ctx); err != nil {
+		return err
+	}
+	var tasks corev1alpha1.TaskList
+	if err := d.Client.List(ctx, &tasks); err != nil {
+		return err
+	}
+	if err := d.scheduleACPDeliveryRecoveries(ctx, tasks.Items); err != nil {
+		return err
+	}
+	if err := d.rejectPersistedExternalRuntimeDispatches(ctx, tasks.Items); err != nil {
+		return err
+	}
+	queued := make([]*corev1alpha1.Task, 0)
+	for i := range tasks.Items {
+		task := &tasks.Items[i]
+		if !taskDispatchableByACP(task) || task.Status.Execution == nil ||
+			(task.Status.Execution.State != corev1alpha1.TaskExecutionStateQueued && task.Status.Execution.State != corev1alpha1.TaskExecutionStateReserved) ||
+			strings.TrimSpace(task.Status.Execution.AgentRuntimeName) != "" || strings.TrimSpace(task.Status.Execution.RuntimePoolName) == "" {
+			continue
+		}
+		queued = append(queued, task.DeepCopy())
+	}
+	sortACPTasksByQueuePriority(queued, time.Now().UTC())
+	admissible := queued[:0]
+	for _, queuedTask := range queued {
+		keep, err := d.settleQueuedTaskBeforeAdmission(ctx, queuedTask)
+		if err != nil {
+			return fmt.Errorf("settle ACP task before admission %s/%s: %w", queuedTask.Namespace, queuedTask.Name, err)
+		}
+		if keep {
+			admissible = append(admissible, queuedTask)
+		}
+	}
+	queued = admissible
+	if err := d.AdmissionGate.Check(); err != nil {
+		return nil
+	}
+dispatchLoop:
+	for _, queuedTask := range queued {
+		select {
+		case d.sem <- struct{}{}:
+			if !d.markActive(queuedTask.UID) {
+				<-d.sem
+				continue
+			}
+			task, target, reserveErr := d.reserveTask(ctx, queuedTask)
+			if reserveErr != nil || task == nil {
+				<-d.sem
+				d.unmarkActive(queuedTask.UID)
+				if reserveErr != nil && !errors.Is(reserveErr, context.Canceled) {
+					logf.FromContext(ctx).Error(reserveErr, "ACP task reservation failed", "namespace", queuedTask.Namespace, "task", queuedTask.Name)
+				}
+				continue
+			}
+			go func(task *corev1alpha1.Task, target acpDispatchTarget) {
+				defer func() {
+					<-d.sem
+					d.unmarkActive(task.UID)
+				}()
+				if err := d.executeReservedTask(ctx, task, target); err != nil && !errors.Is(err, context.Canceled) {
+					logf.FromContext(ctx).Error(err, "ACP task execution failed", "namespace", task.Namespace, "task", task.Name)
+				}
+			}(task, target)
+		default:
+			break dispatchLoop
+		}
+	}
+	return d.reapIdlePools(ctx, tasks.Items)
+}
+
+func (d *ACPDispatcher) rejectPersistedExternalRuntimeDispatches(ctx context.Context, tasks []corev1alpha1.Task) error {
+	for i := range tasks {
+		task := &tasks[i]
+		if !persistedExternalRuntimeDispatch(task) {
+			continue
+		}
+		if err := d.rejectPersistedExternalRuntimeDispatch(ctx, task.DeepCopy()); err != nil {
+			return fmt.Errorf("reject persisted external runtime dispatch for Task %s/%s: %w", task.Namespace, task.Name, err)
+		}
+	}
+	return nil
+}
+
+func persistedExternalRuntimeDispatch(task *corev1alpha1.Task) bool {
+	if !taskDispatchableByACP(task) || task.Status.Execution == nil ||
+		strings.TrimSpace(task.Status.Execution.AgentRuntimeName) == "" {
+		return false
+	}
+	return task.Status.Execution.State == corev1alpha1.TaskExecutionStateQueued ||
+		task.Status.Execution.State == corev1alpha1.TaskExecutionStateReserved
+}
+
+func (d *ACPDispatcher) rejectPersistedExternalRuntimeDispatch(ctx context.Context, task *corev1alpha1.Task) error {
+	runtimeName := strings.TrimSpace(task.Status.Execution.AgentRuntimeName)
+	message := externalAgentRuntimeDispatchUnsupportedReason(runtimeName)
+	if err := d.failPersistedExternalRuntimeAttempt(ctx, task, message); err != nil {
+		return err
+	}
+	return d.failTask(
+		ctx,
+		task,
+		corev1alpha1.TaskExecutionStateFailed,
+		corev1alpha1.TaskExecutionOutcomeFailed,
+		acpExternalRuntimeDispatchUnsupportedExecutionReason,
+		message,
+	)
+}
+
+func (d *ACPDispatcher) failPersistedExternalRuntimeAttempt(ctx context.Context, task *corev1alpha1.Task, message string) error {
+	attemptID, err := promptAttemptIDFromTask(task)
+	if err != nil {
+		return nil
+	}
+	fence, err := d.Epochs.CurrentFence(ctx)
+	if err != nil {
+		return err
+	}
+	for range 3 {
+		attempt, getErr := d.Store.GetPromptAttempt(ctx, attemptID)
+		if errors.Is(getErr, store.ErrNotFound) {
+			return nil
+		}
+		if getErr != nil {
+			return getErr
+		}
+		if store.IsTerminalPromptExecutionState(attempt.ExecutionState) {
+			return nil
+		}
+		if transitionErr := store.ValidatePromptExecutionTransition(attempt.ExecutionState, store.PromptExecutionFailed); transitionErr != nil {
+			return nil
+		}
+		digest, digestErr := acpDomainDigest("external-runtime-dispatch-rejection", struct {
+			AttemptID string                     `json:"attemptID"`
+			From      store.PromptExecutionState `json:"from"`
+			Version   int64                      `json:"version"`
+			Message   string                     `json:"message"`
+		}{
+			AttemptID: attempt.ID, From: attempt.ExecutionState, Version: attempt.Version, Message: message,
+		})
+		if digestErr != nil {
+			return digestErr
+		}
+		_, transitionErr := d.Store.TransitionPromptAttemptExecution(ctx, store.PromptAttemptExecutionTransition{
+			ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+			NewState:    store.PromptExecutionFailed,
+			OperationID: "reject-external-runtime-dispatch-" + strconv.FormatInt(attempt.Version, 10), OperationDigest: digest,
+			TerminalReason: string(acpExternalRuntimeDispatchUnsupportedExecutionReason), UpdatedAt: time.Now().UTC(),
+		})
+		if errors.Is(transitionErr, store.ErrConflict) {
+			continue
+		}
+		return transitionErr
+	}
+	return fmt.Errorf("prompt attempt %s changed while rejecting external runtime dispatch", attemptID)
+}
+
+//nolint:gocyclo // Terminal projection and cleanup recovery branches are audited together.
+func (d *ACPDispatcher) scheduleACPDeliveryRecoveries(ctx context.Context, tasks []corev1alpha1.Task) error {
+	var fence store.ControllerEpochFence
+	haveFence := false
+	for i := range tasks {
+		task := &tasks[i]
+		if !taskDispatchableByACP(task) || task.Status.Execution == nil ||
+			task.Status.Execution.Attempt < 1 || strings.TrimSpace(task.Status.Execution.PromptID) == "" {
+			continue
+		}
+		attemptID, idErr := promptAttemptIDFromTask(task)
+		if idErr != nil {
+			return idErr
+		}
+		attempt, getErr := d.Store.GetPromptAttempt(ctx, attemptID)
+		if getErr != nil {
+			if errors.Is(getErr, store.ErrNotFound) {
+				continue
+			}
+			return getErr
+		}
+		recoveryKind := ""
+		switch attempt.ExecutionState {
+		case store.PromptExecutionSucceeded:
+			if task.Status.Execution.State != corev1alpha1.TaskExecutionStateSucceeded ||
+				!store.IsTerminalPromptDeliveryState(attempt.DeliveryState) || task.Status.Delivery == nil {
+				recoveryKind = acpSucceededOperation
+			}
+		case store.PromptExecutionFailed, store.PromptExecutionCancelled, store.PromptExecutionOutcomeUnknown:
+			if corev1alpha1.TaskExecutionState(attempt.ExecutionState) != task.Status.Execution.State || task.Status.Execution.Outcome == "" {
+				recoveryKind = "terminal"
+			}
+		}
+		cleanupPending := !taskScopedRuntimeSessionCleanupComplete(task)
+		if recoveryKind == "" && store.IsTerminalPromptExecutionState(attempt.ExecutionState) && store.IsTerminalPromptDeliveryState(attempt.DeliveryState) {
+			if !haveFence {
+				var fenceErr error
+				fence, fenceErr = d.Epochs.CurrentFence(ctx)
+				if fenceErr != nil {
+					return fenceErr
+				}
+				haveFence = true
+			}
+			if cleanupPending || task.Status.Execution.ControllerEpoch < fence.Epoch {
+				recoveryKind = "stale-terminal"
+			}
+		}
+		if recoveryKind == "" {
+			continue
+		}
+		if !haveFence {
+			var fenceErr error
+			fence, fenceErr = d.Epochs.CurrentFence(ctx)
+			if fenceErr != nil {
+				return fenceErr
+			}
+			haveFence = true
+		}
+		select {
+		case d.sem <- struct{}{}:
+			if !d.markActive(task.UID) {
+				<-d.sem
+				continue
+			}
+			go func(task *corev1alpha1.Task, attempt *store.PromptAttempt, kind string) {
+				defer func() {
+					<-d.sem
+					d.unmarkActive(task.UID)
+				}()
+				var err error
+				switch kind {
+				case "stale-terminal":
+					err = d.recoverStaleTask(ctx, task, fence)
+				case acpSucceededOperation:
+					err = d.recoverSucceededTaskProjection(ctx, task, attempt, fence)
+				default:
+					err = d.finalizeRecoveredTerminalSession(ctx, task, attempt, fence)
+					if err == nil {
+						err = d.patchRecoveredTerminalExecution(ctx, task, attempt, fence.Epoch)
+					}
+				}
+				if err != nil && !errors.Is(err, context.Canceled) {
+					logf.FromContext(ctx).Error(err, "ACP authoritative attempt projection recovery failed", "namespace", task.Namespace, "task", task.Name)
+				}
+			}(task.DeepCopy(), attempt, recoveryKind)
+		default:
+			return nil
+		}
+	}
+	return nil
+}
+
+//nolint:gocyclo // Demand-state accounting and all fail-closed pool capacity gates are intentionally audited together.
+func (d *ACPDispatcher) reapIdlePools(ctx context.Context, tasks []corev1alpha1.Task) error {
+	fence, err := d.Epochs.CurrentFence(ctx)
+	if err != nil {
+		return err
+	}
+	activeByPool := make(map[string]int)
+	queuedByPool := make(map[string]int32)
+	finalizingByPool := make(map[string]int32)
+	settledAtByPool := make(map[string]time.Time)
+	now := time.Now().UTC()
+	for i := range tasks {
+		task := &tasks[i]
+		poolName := strings.TrimSpace(task.Labels[acpRuntimeTaskPoolLabel])
+		if poolName == "" || task.Status.Execution == nil {
+			continue
+		}
+		key := task.Namespace + "/" + poolName
+		if taskExecutionStateTerminal(task.Status.Execution.State) {
+			if task.Status.Execution.State == corev1alpha1.TaskExecutionStateSucceeded && task.Status.Delivery != nil &&
+				!store.IsTerminalPromptDeliveryState(store.PromptDeliveryState(task.Status.Delivery.State)) {
+				activeByPool[key]++
+				finalizingByPool[key]++
+				continue
+			}
+			settledAt := acpTaskDemandSettledAt(task)
+			if !settledAt.IsZero() && settledAt.After(settledAtByPool[key]) {
+				settledAtByPool[key] = settledAt
+			}
+			continue
+		}
+		activeByPool[key]++
+		switch task.Status.Execution.State {
+		case corev1alpha1.TaskExecutionStateQueued, corev1alpha1.TaskExecutionStateReserved:
+			queuedByPool[key]++
+		case corev1alpha1.TaskExecutionStateSettling:
+			finalizingByPool[key]++
+		}
+	}
+	var pools corev1alpha1.RuntimePoolList
+	if err := d.Client.List(ctx, &pools); err != nil {
+		return err
+	}
+	for i := range pools.Items {
+		pool := &pools.Items[i]
+		key := pool.Namespace + "/" + pool.Name
+		latest, err := d.patchPoolCoordinatorCapacity(ctx, pool, fence.Epoch, now, queuedByPool[key], finalizingByPool[key])
+		if err != nil {
+			return err
+		}
+		if latest == nil {
+			continue
+		}
+		pool = latest
+		if runtimePoolHasActiveDemand(pool, activeByPool[key]) {
+			continue
+		}
+		if settledAt := settledAtByPool[key]; !settledAt.IsZero() {
+			pool, err = d.recordPoolLastDemandAt(ctx, pool, settledAt)
+			if err != nil {
+				return err
+			}
+			if runtimePoolHasActiveDemand(pool, activeByPool[key]) {
+				continue
+			}
+		}
+		lastDemand, err := time.Parse(time.RFC3339Nano, pool.Annotations[acpRuntimeLastDemandAnnotation])
+		if err != nil || now.Sub(lastDemand) < d.IdlePoolTTL {
+			continue
+		}
+		base := pool.DeepCopy()
+		pool.Spec.DesiredReplicas = 0
+		patch := client.MergeFromWithOptions(base, client.MergeFromWithOptimisticLock{})
+		if err := d.Client.Patch(ctx, pool, patch); err != nil && !apierrors.IsConflict(err) {
+			return err
+		}
+	}
+	return nil
+}
+
+func runtimePoolHasActiveDemand(pool *corev1alpha1.RuntimePool, activeTasks int) bool {
+	return pool == nil || pool.Spec.DesiredReplicas == 0 || activeTasks > 0 ||
+		pool.Status.Capacity.ResidentSessions > 0 || pool.Status.Capacity.RunningPrompts > 0 ||
+		pool.Status.Capacity.ReservedSessions > 0 || pool.Status.Capacity.ReservedPrompts > 0 ||
+		pool.Status.Capacity.FinalizingSessions > 0 || pool.Status.Capacity.PendingPermissions > 0
+}
+
+func acpTaskDemandSettledAt(task *corev1alpha1.Task) time.Time {
+	if task == nil || task.Status.Execution == nil {
+		return time.Time{}
+	}
+	settledAt := time.Time{}
+	if task.Status.Execution.LastTransitionTime != nil && !task.Status.Execution.LastTransitionTime.IsZero() {
+		settledAt = task.Status.Execution.LastTransitionTime.UTC()
+	}
+	if task.Status.Delivery != nil && store.IsTerminalPromptDeliveryState(store.PromptDeliveryState(task.Status.Delivery.State)) &&
+		task.Status.Delivery.LastTransitionTime != nil && !task.Status.Delivery.LastTransitionTime.IsZero() {
+		deliverySettledAt := task.Status.Delivery.LastTransitionTime.UTC()
+		if deliverySettledAt.After(settledAt) {
+			settledAt = deliverySettledAt
+		}
+	}
+	if settledAt.IsZero() && task.Status.CompletionTime != nil && !task.Status.CompletionTime.IsZero() {
+		settledAt = task.Status.CompletionTime.UTC()
+	}
+	if settledAt.IsZero() && !task.CreationTimestamp.IsZero() {
+		settledAt = task.CreationTimestamp.UTC()
+	}
+	return settledAt
+}
+
+func (d *ACPDispatcher) recordPoolLastDemandAt(ctx context.Context, pool *corev1alpha1.RuntimePool, settledAt time.Time) (*corev1alpha1.RuntimePool, error) {
+	key := client.ObjectKeyFromObject(pool)
+	var result *corev1alpha1.RuntimePool
+	err := retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		latest := &corev1alpha1.RuntimePool{}
+		if err := d.Client.Get(ctx, key, latest); err != nil {
+			return err
+		}
+		current, err := time.Parse(time.RFC3339Nano, latest.Annotations[acpRuntimeLastDemandAnnotation])
+		if err == nil && !settledAt.After(current) {
+			result = latest.DeepCopy()
+			return nil
+		}
+		base := latest.DeepCopy()
+		if latest.Annotations == nil {
+			latest.Annotations = make(map[string]string)
+		}
+		latest.Annotations[acpRuntimeLastDemandAnnotation] = settledAt.UTC().Format(time.RFC3339Nano)
+		patch := client.MergeFromWithOptions(base, client.MergeFromWithOptimisticLock{})
+		if err := d.Client.Patch(ctx, latest, patch); err != nil {
+			return err
+		}
+		result = latest.DeepCopy()
+		return nil
+	})
+	return result, err
+}
+
+func (d *ACPDispatcher) patchPoolCoordinatorCapacity(
+	ctx context.Context,
+	pool *corev1alpha1.RuntimePool,
+	controllerEpoch int64,
+	now time.Time,
+	queued, finalizing int32,
+) (*corev1alpha1.RuntimePool, error) {
+	key := types.NamespacedName{Namespace: pool.Namespace, Name: pool.Name}
+	var result *corev1alpha1.RuntimePool
+	err := retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		latest := &corev1alpha1.RuntimePool{}
+		if err := d.Client.Get(ctx, key, latest); err != nil {
+			if apierrors.IsNotFound(err) {
+				result = nil
+				return nil
+			}
+			return err
+		}
+		reservations, changed := activeRuntimePoolReservations(latest, controllerEpoch, now)
+		latest.Status.Capacity.Reservations = reservations
+		reservedSessionsBefore := latest.Status.Capacity.ReservedSessions
+		reservedPromptsBefore := latest.Status.Capacity.ReservedPrompts
+		updateRuntimePoolReservationCounters(&latest.Status.Capacity)
+		changed = changed || reservedSessionsBefore != latest.Status.Capacity.ReservedSessions || reservedPromptsBefore != latest.Status.Capacity.ReservedPrompts
+		if latest.Status.Capacity.QueuedTasks != queued {
+			latest.Status.Capacity.QueuedTasks = queued
+			changed = true
+		}
+		if latest.Status.Capacity.FinalizingSessions != finalizing {
+			latest.Status.Capacity.FinalizingSessions = finalizing
+			changed = true
+		}
+		if changed {
+			if err := d.Client.Status().Update(ctx, latest); err != nil {
+				return err
+			}
+		}
+		result = latest.DeepCopy()
+		return nil
+	})
+	return result, err
+}
+
+func (d *ACPDispatcher) watchTaskCancellation(ctx context.Context, cancel context.CancelFunc, key types.NamespacedName) {
+	ticker := time.NewTicker(time.Second)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			task := &corev1alpha1.Task{}
+			if err := d.APIReader.Get(ctx, key, task); err != nil {
+				if apierrors.IsNotFound(err) {
+					cancel()
+				}
+				continue
+			}
+			if !task.DeletionTimestamp.IsZero() || task.Status.Phase == corev1alpha1.TaskPhaseCancelled {
+				cancelCtx, stop := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
+				_, _ = d.cancelPreparedPublication(cancelCtx, task)
+				stop()
+				cancel()
+				return
+			}
+		}
+	}
+}
+
+func (d *ACPDispatcher) markActive(uid types.UID) bool {
+	if uid == "" {
+		return false
+	}
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	if _, ok := d.active[uid]; ok {
+		return false
+	}
+	d.active[uid] = struct{}{}
+	return true
+}
+
+func (d *ACPDispatcher) unmarkActive(uid types.UID) {
+	d.mu.Lock()
+	delete(d.active, uid)
+	d.mu.Unlock()
+}
+
+func (d *ACPDispatcher) isActive(uid types.UID) bool {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	_, ok := d.active[uid]
+	return ok
+}
+
+// loadVerifiedACPDispatchExecution re-establishes the immutable dispatch
+// authority after RuntimePool reservation and immediately before the first
+// supervisor RPC. Agent and Tool resources are deliberately not read here:
+// every executable value comes from the encrypted, content-addressed snapshot.
+func (d *ACPDispatcher) loadVerifiedACPDispatchExecution(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+) (*verifiedAgentExecution, error) {
+	if d.Snapshots == nil {
+		return nil, errors.New("ACP dispatch requires an immutable execution snapshot store")
+	}
+	if task == nil || task.Status.AgentExecutionBinding == nil || task.Status.Execution == nil {
+		return nil, errors.New("ACP dispatch requires a Task execution binding and queued attempt")
+	}
+	verifier := TaskReconciler{
+		Client:                  d.Client,
+		APIReader:               d.APIReader,
+		AgentExecutionSnapshots: d.Snapshots,
+	}
+	bound, err := verifier.loadVerifiedBoundExecution(ctx, task, task.Status.AgentExecutionBinding)
+	if err != nil {
+		return nil, fmt.Errorf("verify immutable ACP execution: %w", err)
+	}
+	matches, err := acpQueuedTaskRequestMatchesBinding(bound, task.Status.Execution)
+	if err != nil {
+		return nil, fmt.Errorf("verify frozen ACP request identity: %w", err)
+	}
+	if !matches {
+		return nil, errors.New("queued ACP request digest does not match the immutable execution binding and snapshot")
+	}
+	attemptID, err := promptAttemptIDFromTask(task)
+	if err != nil {
+		return nil, err
+	}
+	attempt, err := d.Store.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		return nil, fmt.Errorf("load frozen ACP PromptAttempt: %w", err)
+	}
+	if !queuedPromptAttemptMatchesTask(attempt, task) || attempt.BindingDigest != bound.binding.BindingDigest ||
+		attempt.SnapshotDigest != bound.snapshot.Digest || attempt.ExecutionState != store.PromptExecutionReserved {
+		return nil, errors.New("reserved ACP PromptAttempt does not exactly match the immutable Task binding, snapshot, and request")
+	}
+	bound.frozenTask.Status = *task.Status.DeepCopy()
+	return bound, nil
+}
+
+func validateFrozenACPDispatchTarget(
+	task *corev1alpha1.Task,
+	target acpDispatchTarget,
+	bound *verifiedAgentExecution,
+) error {
+	if task == nil || task.Status.Execution == nil || target.pool == nil || bound == nil || bound.binding == nil {
+		return errors.New("frozen ACP Task, RuntimePool target, and execution binding are required")
+	}
+	if target.pool.Name != bound.plan.PoolName || target.pool.Spec.Runtime.Image != bound.plan.Image ||
+		target.pool.Spec.Runtime.Profile.Digest != bound.body.ProfileDigest ||
+		task.Status.Execution.RuntimePoolName != target.pool.Name ||
+		task.Status.Execution.RuntimePoolUID != string(target.pool.UID) {
+		return errors.New("reserved RuntimePool does not exactly match the immutable execution snapshot")
+	}
+	return nil
+}
+
+//nolint:gocyclo // The explicit state-machine branches are easier to audit together.
+func (d *ACPDispatcher) executeReservedTask(ctx context.Context, task *corev1alpha1.Task, target acpDispatchTarget) (retErr error) {
+	reservationLease := newACPRuntimePoolReservationLease(d, target.reservation)
+	if reservationLease != nil {
+		defer func() {
+			releaseCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
+			defer cancel()
+			if releaseErr := reservationLease.release(releaseCtx); releaseErr != nil {
+				logf.FromContext(ctx).Error(releaseErr, "release ACP RuntimePool reservation", "namespace", task.Namespace, "task", task.Name)
+			}
+		}()
+	}
+	bound, err := d.loadVerifiedACPDispatchExecution(ctx, task)
+	if err != nil {
+		return err
+	}
+	task = bound.frozenTask
+	if err := validateFrozenACPDispatchTarget(task, target, bound); err != nil {
+		return err
+	}
+	if reservationLease != nil {
+		reservationLease.startRenewal(ctx)
+	}
+	runtimeCtx, cancelRuntime := d.newTaskRuntimeContext(ctx, task)
+	defer cancelRuntime()
+	go d.watchTaskCancellation(runtimeCtx, cancelRuntime, types.NamespacedName{Namespace: task.Namespace, Name: task.Name})
+	attemptID, err := promptAttemptIDFromTask(task)
+	if err != nil {
+		return d.failTask(ctx, task, corev1alpha1.TaskExecutionStateFailed, corev1alpha1.TaskExecutionOutcomeFailed, "InvalidAttempt", err.Error())
+	}
+	fence, err := d.Epochs.CurrentFence(ctx)
+	if err != nil {
+		return err
+	}
+	if handled, deadlineErr := d.handlePreSubmissionContextDone(ctx, runtimeCtx, task, attemptID, fence); handled {
+		return deadlineErr
+	}
+	runtimeClient, runtimeFence, profile, maxResultBytes, authErr := d.runtimeClient(runtimeCtx, target)
+	if authErr != nil {
+		if handled, deadlineErr := d.handlePreSubmissionContextDone(ctx, runtimeCtx, task, attemptID, fence); handled {
+			return deadlineErr
+		}
+		return d.requeueReservedTask(ctx, task, acpReservedRetryRuntimeClient, authErr)
+	}
+	if target.pool != nil {
+		capabilities, capabilityErr := runtimeClient.Capabilities(runtimeCtx)
+		if capabilityErr != nil {
+			return d.requeueReservedTask(ctx, task, acpReservedRetryCapabilities, capabilityErr)
+		}
+		if !capabilities.SupportsAgentSessionConfiguration {
+			return d.requeueReservedTask(ctx, task, acpReservedRetrySessionConfiguration, fmt.Errorf("RuntimePool supervisor is waiting for Agent session configuration support"))
+		}
+	}
+	runtimeProfileDigest, digestErr := harnessv2.CanonicalProfileDigest(profile)
+	if digestErr != nil || runtimeFence.RuntimeProfileDigest != bound.plan.Digest || runtimeProfileDigest != bound.plan.Digest {
+		return d.requeueReservedTask(ctx, task, acpReservedRetryProfile, errors.New("RuntimePool profile does not match the immutable execution snapshot"))
+	}
+	profile = bound.plan.Profile
+	agentConfiguration := bound.configuration
+	var agentConfigurationRef *harnessv2.AgentSessionConfiguration
+	if target.pool != nil {
+		agentConfigurationRef = &agentConfiguration
+	}
+	mcpConfiguration := bound.mcpConfiguration
+	mcpBindingDigest, err := acpDomainDigest("runtime-session-mcp-configuration", mcpConfiguration)
+	if err != nil {
+		return d.requeueReservedTask(ctx, task, acpReservedRetryMCPConfiguration, err)
+	}
+	lineage := acpSessionLineageIdentity{RuntimeIdentity: bound.body.RuntimeType}
+	if task.Spec.SessionRef != nil && d.Sessions.RecordsLineage() {
+		taskNamespace := &corev1.Namespace{}
+		if err := d.APIReader.Get(runtimeCtx, client.ObjectKey{Name: task.Namespace}, taskNamespace); err != nil {
+			return d.requeueReservedTask(ctx, task, acpReservedRetryNamespaceLineage, fmt.Errorf("resolve namespace identity for session lineage: %w", err))
+		}
+		lineage.NamespaceUID = string(taskNamespace.UID)
+	}
+	sessionExecution, err := d.prepareTaskSession(
+		runtimeCtx, task, fence, runtimeFence.RuntimeProfileDigest, mcpBindingDigest,
+		runtimeFence.RuntimeInstanceID, runtimeFence.SupervisorBootID, lineage,
+	)
+	if err != nil {
+		if errors.Is(runtimeContextError(runtimeCtx), context.DeadlineExceeded) {
+			recoveredSession, cleanupErr := d.quiesceInterruptedTaskSessionPreparation(ctx, task, attemptID, fence)
+			if cleanupErr != nil {
+				return errors.Join(err, cleanupErr)
+			}
+			if settleErr := d.settlePreSubmissionCancellation(
+				ctx, task, attemptID, fence, "timeout-before-submission", "TaskTimeout", "task deadline exceeded before prompt submission",
+			); settleErr != nil {
+				return errors.Join(err, settleErr)
+			}
+			if recoveredSession != nil {
+				cleanupCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), acpPreSubmissionCleanupTimeout)
+				defer cancel()
+				return d.reconcileUnfinalizedTaskSession(cleanupCtx, task, fence, recoveredSession, context.DeadlineExceeded)
+			}
+			return nil
+		}
+		return d.requeueReservedTask(ctx, task, acpReservedRetrySessionPreparation, err)
+	}
+	if sessionExecution != nil && sessionExecution.Turn != nil {
+		defer func() {
+			if sessionExecution.finalized || sessionExecution.requeued {
+				return
+			}
+			cleanupCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), acpPreSubmissionCleanupTimeout)
+			defer cancel()
+			finalizeErr := d.reconcileUnfinalizedTaskSession(cleanupCtx, task, fence, sessionExecution, retErr)
+			if retErr == nil && finalizeErr != nil {
+				retErr = finalizeErr
+			}
+		}()
+	}
+	if handled, deadlineErr := d.handlePreSubmissionContextDone(ctx, runtimeCtx, task, attemptID, fence); handled {
+		return deadlineErr
+	}
+	if reservationLease != nil && sessionExecution != nil {
+		residentSlots := int32(0)
+		if !sessionExecution.Reused {
+			residentSlots = 1
+		}
+		if err := reservationLease.setSlots(ctx, residentSlots); err != nil {
+			if requeueErr := d.requeuePreSubmissionTaskWithRuntimeBinding(
+				ctx, task, attemptID, fence, err, &sessionExecution.Binding,
+			); requeueErr != nil {
+				return errors.Join(err, requeueErr)
+			}
+			sessionExecution.requeued = true
+			return nil
+		}
+	}
+	leaseGeneration := int64(1)
+	if sessionExecution != nil {
+		runtimeFence.RuntimeSessionUID = harnessv2.RuntimeSessionUID(sessionExecution.Binding.SessionUID)
+		runtimeFence.RuntimeSessionGeneration = sessionExecution.Binding.Generation
+		leaseGeneration = sessionExecution.LeaseGeneration
+	} else {
+		runtimeFence.RuntimeSessionUID = harnessv2.RuntimeSessionUID(taskRuntimeSessionUID(task))
+		runtimeFence.RuntimeSessionGeneration = 1
+	}
+	if err := d.transitionAttempt(ctx, attemptID, fence, store.PromptExecutionReserved, store.PromptExecutionSessionStarting, "session-starting", nil); err != nil {
+		return err
+	}
+	if err := d.patchExecution(ctx, task, func(status *corev1alpha1.TaskExecutionStatus) {
+		status.State = corev1alpha1.TaskExecutionStateSessionStarting
+		status.LastTransitionTime = nowMeta()
+	}); err != nil {
+		return err
+	}
+	if err := d.transitionAttempt(ctx, attemptID, fence, store.PromptExecutionSessionStarting, store.PromptExecutionPlanned, "planned", &attemptRuntimeBinding{
+		RuntimeInstanceID: string(runtimeFence.RuntimeInstanceID), SessionUID: string(runtimeFence.RuntimeSessionUID), SessionGeneration: leaseGeneration,
+	}); err != nil {
+		return err
+	}
+	if err := d.patchExecution(ctx, task, func(status *corev1alpha1.TaskExecutionStatus) {
+		status.State = corev1alpha1.TaskExecutionStatePlanned
+		if sessionExecution != nil {
+			applyRuntimeSessionBindingToExecution(status, &sessionExecution.Binding)
+		} else {
+			status.RuntimeInstanceID = string(runtimeFence.RuntimeInstanceID)
+			status.RuntimeSessionUID = string(runtimeFence.RuntimeSessionUID)
+			status.RuntimeSessionGeneration = int64(runtimeFence.RuntimeSessionGeneration)
+			status.RuntimeSessionSupervisorBootID = ""
+			status.RuntimeSessionProfileDigest = ""
+			status.RuntimeSessionMCPDigest = ""
+			status.RuntimeSessionWorkspaceDigest = ""
+			status.RuntimeSessionRecreationPending = false
+		}
+		status.LastTransitionTime = nowMeta()
+	}); err != nil {
+		return err
+	}
+	if handled, deadlineErr := d.handlePreSubmissionContextDone(ctx, runtimeCtx, task, attemptID, fence); handled {
+		return deadlineErr
+	}
+	requeued, reconcileErr := d.reconcilePlannedRuntimeSession(
+		ctx, runtimeClient, task, attemptID, fence, sessionExecution, &runtimeFence,
+	)
+	if runtimeContextError(runtimeCtx) != nil && sessionExecution != nil {
+		// Cancellation supersedes an admission requeue. Let the deferred Session
+		// reconciler finalize the open turn and release its mutation lease.
+		sessionExecution.requeued = false
+	}
+	if handled, deadlineErr := d.handlePreSubmissionContextDone(ctx, runtimeCtx, task, attemptID, fence); handled {
+		return deadlineErr
+	}
+	if runtimeContextError(runtimeCtx) != nil {
+		return d.settlePreSubmissionCancellation(
+			ctx, task, attemptID, fence, "cancelled-before-submission", "Cancelled", "task cancelled before prompt submission",
+		)
+	}
+	if reconcileErr != nil {
+		return reconcileErr
+	} else if requeued {
+		return nil
+	}
+
+	preparedWorkspace, err := d.prepareRuntimeWorkspace(runtimeCtx, task, fence, sessionExecution)
+	if err != nil {
+		if handled, deadlineErr := d.handlePreSubmissionContextDone(ctx, runtimeCtx, task, attemptID, fence); handled {
+			return deadlineErr
+		}
+		if transitionErr := d.transitionAttemptToTerminal(ctx, attemptID, fence, store.PromptExecutionFailed, "workspace-unsupported"); transitionErr != nil {
+			return transitionErr
+		}
+		return d.failTask(ctx, task, corev1alpha1.TaskExecutionStateFailed, corev1alpha1.TaskExecutionOutcomeFailed, "WorkspaceUnsupported", err.Error())
+	}
+	baseline := preparedWorkspace.baseline
+	workspace := preparedWorkspace.spec
+	workspaceAuthorization := preparedWorkspace.authorization
+	if sessionExecution != nil {
+		previousRuntimeFence := runtimeFence
+		bound, workspaceChanged, bindErr := bindACPRuntimeSessionWorkspace(
+			sessionExecution.Binding, sessionExecution.Reused, preparedWorkspace.bindingDigest,
+		)
+		if bindErr != nil {
+			return bindErr
+		}
+		if workspaceChanged {
+			bound.Generation = max(bound.Generation, uint64(sessionExecution.LeaseGeneration))
+			bound.RecreationRequired = true
+			sessionExecution.Binding = bound
+			sessionExecution.Reused = false
+			d.setRuntimeSessionBinding(bound)
+			if err := d.patchExecution(ctx, task, func(execution *corev1alpha1.TaskExecutionStatus) {
+				applyRuntimeSessionBindingToExecution(execution, &bound)
+				execution.LastTransitionTime = nowMeta()
+			}); err != nil {
+				return err
+			}
+			if err := d.deleteRuntimeSessionReconciled(
+				context.WithoutCancel(ctx), runtimeClient, harnessv2.RuntimeSessionID(runtimeSessionID(previousRuntimeFence)),
+				task, previousRuntimeFence, "workspace_binding_changed",
+			); err != nil {
+				deleteErr := fmt.Errorf("retire workspace-mismatched RuntimeSession: %w", err)
+				if requeueErr := d.requeuePreSubmissionTaskWithRuntimeBinding(
+					ctx, task, attemptID, fence, deleteErr, &bound,
+				); requeueErr != nil {
+					return requeueErr
+				}
+				sessionExecution.requeued = true
+				return nil
+			}
+			if handled, deadlineErr := d.handlePreSubmissionContextDone(ctx, runtimeCtx, task, attemptID, fence); handled {
+				return deadlineErr
+			}
+			if runtimeContextError(runtimeCtx) != nil {
+				return d.settlePreSubmissionCancellation(
+					ctx, task, attemptID, fence, "cancelled-before-submission", "Cancelled", "task cancelled before prompt submission",
+				)
+			}
+			if err := d.requeuePreSubmissionTaskWithRuntimeBinding(
+				ctx, task, attemptID, fence, errors.New("RuntimeSession workspace binding changed"), &bound,
+			); err != nil {
+				return err
+			}
+			sessionExecution.requeued = true
+			return nil
+		}
+		runtimeFence.RuntimeSessionGeneration = bound.Generation
+		sessionExecution.Binding = bound
+	}
+	if reservationLease != nil {
+		if err := reservationLease.renew(runtimeCtx); err != nil {
+			if handled, deadlineErr := d.handlePreSubmissionContextDone(ctx, runtimeCtx, task, attemptID, fence); handled {
+				return deadlineErr
+			}
+			if runtimeContextError(runtimeCtx) != nil {
+				if sessionExecution != nil {
+					sessionExecution.requeued = false
+				}
+				return d.settlePreSubmissionCancellation(
+					ctx, task, attemptID, fence, "cancelled-before-submission", "Cancelled", "task cancelled before prompt submission",
+				)
+			}
+			if sessionExecution != nil {
+				if requeueErr := d.requeuePreSubmissionTaskWithRuntimeBinding(
+					ctx, task, attemptID, fence, err, &sessionExecution.Binding,
+				); requeueErr != nil {
+					return requeueErr
+				}
+				sessionExecution.requeued = true
+				return nil
+			}
+			return d.requeuePreSubmissionTask(ctx, task, attemptID, fence, err)
+		}
+	}
+	createOperation := "create-session"
+	createExpiresAt := time.Now().UTC().Add(max(runtimeSessionCreateTimeout(target), artifactcap.MaxCapabilityTTL))
+	if sessionExecution != nil {
+		createOperation = "create-session-g" + strconv.FormatUint(runtimeFence.RuntimeSessionGeneration, 10)
+	}
+	createRequest := harnessv2.CreateRuntimeSessionRequest{
+		Protocol:         harnessv2.ProtocolVersion,
+		Metadata:         mutationMetadata(runtimeFence, task, createOperation, false, createExpiresAt),
+		RuntimeSessionID: harnessv2.RuntimeSessionID(runtimeSessionID(runtimeFence)),
+		Profile:          profile, AgentConfiguration: agentConfigurationRef, MCPConfiguration: mcpConfiguration,
+		Workspace: workspace, WorkspaceArtifactAuthorization: workspaceAuthorization,
+	}
+	if err := sealMutation(&createRequest.Metadata.RequestDigest, createRequest); err != nil {
+		return err
+	}
+	runtimeSessionRetirementRequired := sessionExecution == nil || workspace.Intent == harnessv2.WorkspaceIntentWrite
+	runtimeSessionCleanupPending := sessionExecution != nil && workspace.Intent == harnessv2.WorkspaceIntentWrite
+	runtimeSessionSettlementRequired := false
+	runtimePublicationFinalizationRequired := false
+	runtimePublicationFinalized := false
+	var runtimePublicationFinalization *runtimeSessionPublicationFinalization
+	finalizePreparedRuntimeSession := func() error {
+		if !runtimePublicationFinalizationRequired || runtimePublicationFinalized {
+			return nil
+		}
+		if runtimePublicationFinalization == nil {
+			return fmt.Errorf("%w: prepared RuntimeSession publication lacks a terminal finalization receipt", store.ErrNotReady)
+		}
+		if err := d.finalizeRuntimeSessionPublication(
+			context.WithoutCancel(ctx), runtimeClient, createRequest.RuntimeSessionID, task, runtimeFence, *runtimePublicationFinalization,
+		); err != nil {
+			return err
+		}
+		runtimePublicationFinalized = true
+		return nil
+	}
+	cleanupRuntimeSession := func(reason string) error {
+		if !runtimeSessionCleanupPending {
+			return nil
+		}
+		if err := finalizePreparedRuntimeSession(); err != nil {
+			return err
+		}
+		if runtimeSessionSettlementRequired && sessionExecution != nil && sessionExecution.Turn != nil && !sessionExecution.finalized {
+			return fmt.Errorf("%w: RuntimeSession deletion requires durable Session terminal settlement", store.ErrNotReady)
+		}
+		cleanupErr := d.deleteRuntimeSession(
+			context.WithoutCancel(ctx), runtimeClient, createRequest.RuntimeSessionID, task, runtimeFence, reason,
+		)
+		if cleanupErr != nil {
+			logf.FromContext(ctx).Error(
+				cleanupErr, "delete ACP RuntimeSession", "namespace", task.Namespace, "task", task.Name,
+				"runtimeSessionID", createRequest.RuntimeSessionID, "reason", reason,
+			)
+			return cleanupErr
+		}
+		if runtimeSessionRetirementRequired {
+			if markErr := d.markTaskScopedRuntimeSessionCleanupComplete(
+				context.WithoutCancel(ctx), task, task.UID, string(runtimeFence.RuntimeInstanceID),
+				string(runtimeFence.RuntimeSessionUID), int64(runtimeFence.RuntimeSessionGeneration),
+			); markErr != nil {
+				return markErr
+			}
+			runtimeSessionCleanupPending = false
+		}
+		return nil
+	}
+	defer func() {
+		if !runtimeSessionCleanupPending {
+			return
+		}
+		if cleanupErr := cleanupRuntimeSession("task_scoped_terminal"); cleanupErr != nil && retErr == nil {
+			retErr = fmt.Errorf("delete task-scoped RuntimeSession: %w", cleanupErr)
+		}
+	}()
+	if sessionExecution == nil || !sessionExecution.Reused {
+		if sessionExecution != nil {
+			sessionExecution.Binding.RecreationRequired = true
+			d.setRuntimeSessionBinding(sessionExecution.Binding)
+			if err := d.patchExecution(ctx, task, func(status *corev1alpha1.TaskExecutionStatus) {
+				applyRuntimeSessionBindingToExecution(status, &sessionExecution.Binding)
+				status.LastTransitionTime = nowMeta()
+			}); err != nil {
+				return err
+			}
+		}
+		created := false
+		if _, err := runtimeClient.CreateRuntimeSession(runtimeCtx, createRequest); err != nil {
+			if runtimeSessionRetirementRequired && runtimeSessionCreationMayHaveApplied(err) {
+				runtimeSessionCleanupPending = true
+			}
+			if handled, deadlineErr := d.handlePreSubmissionContextDone(ctx, runtimeCtx, task, attemptID, fence); handled {
+				return deadlineErr
+			}
+			if sessionExecution != nil && runtimeSessionCreationMayHaveApplied(err) {
+				admitted, reconcileErr := waitForRuntimeSessionAdmission(
+					context.WithoutCancel(ctx), runtimeClient, createRequest.RuntimeSessionID,
+					runtimeFence.RuntimeSessionUID, runtimeFence.RuntimeSessionGeneration, 10*time.Second,
+				)
+				if handled, deadlineErr := d.handlePreSubmissionContextDone(ctx, runtimeCtx, task, attemptID, fence); handled {
+					return deadlineErr
+				}
+				if runtimeContextError(runtimeCtx) != nil {
+					return d.settlePreSubmissionCancellation(
+						ctx, task, attemptID, fence, "cancelled-before-submission", "Cancelled", "task cancelled before prompt submission",
+					)
+				}
+				if reconcileErr != nil {
+					if requeueErr := d.requeuePreSubmissionTaskWithRuntimeBinding(
+						ctx, task, attemptID, fence, reconcileErr, &sessionExecution.Binding,
+					); requeueErr != nil {
+						return requeueErr
+					}
+					sessionExecution.requeued = true
+					return nil
+				}
+				if admitted {
+					created = true
+				} else {
+					if requeueErr := d.requeuePreSubmissionTaskWithRuntimeBinding(
+						ctx, task, attemptID, fence, err, &sessionExecution.Binding,
+					); requeueErr != nil {
+						return requeueErr
+					}
+					sessionExecution.requeued = true
+					return nil
+				}
+			} else if sessionExecution != nil && isACPRateLimitedClientError(err) {
+				if requeueErr := d.requeuePreSubmissionTaskWithRuntimeBinding(
+					ctx, task, attemptID, fence, err, &sessionExecution.Binding,
+				); requeueErr != nil {
+					return requeueErr
+				}
+				sessionExecution.requeued = true
+				return nil
+			} else {
+				return d.handlePrePromptClientError(ctx, task, attemptID, fence, err)
+			}
+		} else {
+			created = true
+		}
+		if !created {
+			return fmt.Errorf("RuntimeSession creation was not reconciled")
+		}
+		if runtimeSessionRetirementRequired {
+			runtimeSessionCleanupPending = true
+		}
+		if sessionExecution != nil {
+			sessionExecution.Binding.RecreationRequired = false
+			d.setRuntimeSessionBinding(sessionExecution.Binding)
+			if err := d.patchExecution(ctx, task, func(status *corev1alpha1.TaskExecutionStatus) {
+				applyRuntimeSessionBindingToExecution(status, &sessionExecution.Binding)
+				status.LastTransitionTime = nowMeta()
+			}); err != nil {
+				if requeueErr := d.requeuePreSubmissionTaskWithRuntimeBinding(
+					ctx, task, attemptID, fence, err, &sessionExecution.Binding,
+				); requeueErr != nil {
+					return errors.Join(err, requeueErr)
+				}
+				sessionExecution.requeued = true
+				return nil
+			}
+		}
+		if reservationLease != nil {
+			if err := reservationLease.setSlots(ctx, 0); err != nil {
+				_ = cleanupRuntimeSession("capacity_reservation_lost")
+				return d.requeuePreSubmissionTask(ctx, task, attemptID, fence, err)
+			}
+		}
+	}
+
+	if err := d.openTaskSessionTurn(runtimeCtx, task, attemptID, fence, sessionExecution); err != nil {
+		if handled, deadlineErr := d.handlePreSubmissionContextDone(ctx, runtimeCtx, task, attemptID, fence); handled {
+			return deadlineErr
+		}
+		return err
+	}
+	if err := d.transitionAttempt(ctx, attemptID, fence, store.PromptExecutionPlanned, store.PromptExecutionSubmitting, "submitting", nil); err != nil {
+		return err
+	}
+	if err := d.patchExecution(ctx, task, func(status *corev1alpha1.TaskExecutionStatus) {
+		status.State = corev1alpha1.TaskExecutionStateSubmitting
+		status.LastTransitionTime = nowMeta()
+	}); err != nil {
+		return err
+	}
+
+	var bootstrap string
+	userPrompt := task.Spec.Prompt
+	if sessionExecution != nil {
+		bootstrap = bootstrapPromptText(sessionExecution.Bootstrap)
+		userPrompt = sessionExecution.UserPrompt
+	}
+	var terminal *harnessv2.Event
+	var assistant strings.Builder
+	assistantOverflow := false
+	accepted := false
+	admissionRetry := 0
+	for {
+		promptRequest, err := d.buildPromptRequest(
+			task, runtimeFence, profile, mcpConfiguration, bootstrap, userPrompt, admissionRetry,
+		)
+		if err != nil {
+			return err
+		}
+		if err := sealMutation(&promptRequest.Metadata.RequestDigest, promptRequest); err != nil {
+			return err
+		}
+		leaseCtx, stopLease := context.WithCancel(runtimeCtx)
+		go d.renewPromptLeaseLoop(
+			leaseCtx, cancelRuntime, runtimeClient, createRequest.RuntimeSessionID, task, runtimeFence,
+			promptRequest.Lease, promptRequest.MCPAuthorization,
+		)
+		summary, streamErr := runtimeClient.StreamPrompt(runtimeCtx, createRequest.RuntimeSessionID, promptRequest, func(event harnessv2.Event) error {
+			switch event.Type {
+			case harnessv2.EventAccepted:
+				runtimeSessionSettlementRequired = true
+				if !accepted {
+					if err := d.transitionAttempt(ctx, attemptID, fence, store.PromptExecutionSubmitting, store.PromptExecutionAccepted, "accepted", nil); err != nil {
+						return err
+					}
+					if err := d.transitionAttempt(ctx, attemptID, fence, store.PromptExecutionAccepted, store.PromptExecutionRunning, "running", nil); err != nil {
+						return err
+					}
+					accepted = true
+					if err := d.patchExecution(ctx, task, func(status *corev1alpha1.TaskExecutionStatus) {
+						status.State = corev1alpha1.TaskExecutionStateRunning
+						status.Reason = ""
+						status.Message = ""
+						status.LastTransitionTime = nowMeta()
+					}); err != nil {
+						return err
+					}
+					if reservationLease != nil {
+						releaseCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
+						releaseErr := reservationLease.release(releaseCtx)
+						cancel()
+						if releaseErr != nil {
+							logf.FromContext(ctx).Error(releaseErr, "release accepted ACP RuntimePool reservation", "namespace", task.Namespace, "task", task.Name)
+						}
+					}
+				}
+			case harnessv2.EventUpdate:
+				if event.Update != nil && event.Update.AssistantMessage != nil {
+					text := event.Update.AssistantMessage.Text
+					if !assistantOverflow {
+						if maxResultBytes < 1 || len(text) > maxResultBytes-assistant.Len() {
+							assistantOverflow = true
+						} else {
+							assistant.WriteString(text)
+						}
+					}
+				}
+			case harnessv2.EventPermissionRequested:
+				return d.resolvePromptPermission(runtimeCtx, runtimeClient, createRequest.RuntimeSessionID, task, runtimeFence, event)
+			case harnessv2.EventCompleted, harnessv2.EventCancelled, harnessv2.EventFailed, harnessv2.EventOutcomeUnknown:
+				copy := event
+				terminal = &copy
+			}
+			return nil
+		})
+		stopLease()
+		if accepted || summary.Accepted || streamErr == nil || !isACPRateLimitedClientError(streamErr) {
+			runtimeSessionSettlementRequired = true
+		}
+		if streamErr == nil {
+			break
+		}
+		if !accepted && !summary.Accepted && isACPRateLimitedClientError(streamErr) {
+			if reservationLease != nil {
+				releaseCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
+				releaseErr := reservationLease.release(releaseCtx)
+				cancel()
+				if releaseErr != nil {
+					return releaseErr
+				}
+			}
+			if err := d.patchExecution(ctx, task, func(status *corev1alpha1.TaskExecutionStatus) {
+				status.Reason = corev1alpha1.TaskExecutionReasonAtCapacity
+				status.Message = "RuntimePool prompt admission was rate limited and will be reconciled"
+				status.LastTransitionTime = nowMeta()
+			}); err != nil {
+				return err
+			}
+			admissionRetry++
+			reservationLease, err = d.waitForPromptCapacityReservation(runtimeCtx, task, target, fence, runtimeFence.RuntimeInstanceID)
+			if err != nil {
+				_ = cleanupRuntimeSession("prompt_admission_reconciliation_stopped")
+				if runtimeContextError(runtimeCtx) != nil {
+					return d.finishNonSuccess(ctx, task, attemptID, fence, sessionExecution, harnessv2.Event{Type: harnessv2.EventCancelled})
+				}
+				return d.finishNonSuccess(ctx, task, attemptID, fence, sessionExecution, harnessv2.Event{Type: harnessv2.EventFailed})
+			}
+			continue
+		}
+		return d.handlePromptStreamError(
+			ctx, runtimeClient, createRequest.RuntimeSessionID, task, attemptID, fence, runtimeFence,
+			accepted || summary.Accepted, summary.WriteEvidence, runtimeContextError(runtimeCtx), streamErr,
+		)
+	}
+	if terminal == nil {
+		return d.markOutcomeUnknown(ctx, task, attemptID, fence, "MissingTerminal", "ACP stream ended without a terminal event")
+	}
+	if terminal.Type != harnessv2.EventCompleted {
+		return d.finishNonSuccess(ctx, task, attemptID, fence, sessionExecution, *terminal)
+	}
+	if err := d.transitionAttempt(ctx, attemptID, fence, store.PromptExecutionRunning, store.PromptExecutionSettling, "settling", nil); err != nil {
+		return err
+	}
+	if err := d.patchExecution(ctx, task, func(status *corev1alpha1.TaskExecutionStatus) {
+		status.State = corev1alpha1.TaskExecutionStateSettling
+		status.LastTransitionTime = nowMeta()
+	}); err != nil {
+		return err
+	}
+	settlement := harnessv2.PromptSettlement{TerminalEvent: terminal.Type, Outcome: harnessv2.PromptOutcomeSucceeded, StopReason: harnessv2.ACPStopReasonEndTurn, SettledAt: terminal.Identity.Timestamp}
+	settlementDigest, err := harnessv2.CanonicalPromptSettlementDigest(settlement)
+	if err != nil {
+		return err
+	}
+	resultText, err := completedPromptResultText(terminal, assistant.String(), assistantOverflow)
+	if err != nil {
+		return err
+	}
+	if err := d.transitionDelivery(ctx, attemptID, fence, store.PromptDeliveryNotRequested, store.PromptDeliveryValidating, "validate-workspace", ""); err != nil {
+		return err
+	}
+	deltaRequest := harnessv2.CreateWorkspaceDeltaRequest{
+		Protocol: harnessv2.ProtocolVersion,
+		Metadata: mutationMetadata(runtimeFence, task, "workspace-delta", true, time.Now().UTC().Add(30*time.Second)),
+		DeltaID:  harnessv2.WorkspaceDeltaID("delta-" + task.Status.Execution.PromptID),
+		Intent:   workspace.Intent, VerifiedBaseline: baseline, PromptSettlementDigest: settlementDigest,
+		Limits: acpWorkspaceDeltaLimits(task),
+	}
+	if err := sealMutation(&deltaRequest.Metadata.RequestDigest, deltaRequest); err != nil {
+		return err
+	}
+	delta, err := runtimeClient.CreateWorkspaceDelta(runtimeCtx, createRequest.RuntimeSessionID, deltaRequest)
+	if err != nil {
+		httpStatus, code, kind := 0, harnessv2.ErrorCode(""), harnessv2.ClientErrorKind("")
+		var clientErr *harnessv2.ClientError
+		if errors.As(err, &clientErr) {
+			httpStatus, code, kind = clientErr.StatusCode, clientErr.Code, clientErr.Kind
+		}
+		logf.FromContext(ctx).Info(
+			"ACP workspace delta failed",
+			"status", httpStatus,
+			"code", code,
+			"kind", kind,
+			"serverMessage", boundedRuntimeSessionServerMessage(err),
+		)
+		if saveErr := d.saveTaskResult(ctx, task, []byte(resultText)); saveErr != nil {
+			return saveErr
+		}
+		if transitionErr := d.transitionAttempt(ctx, attemptID, fence, store.PromptExecutionSettling, store.PromptExecutionSucceeded, acpSucceededOperation, nil); transitionErr != nil {
+			return transitionErr
+		}
+		if patchErr := d.patchExecution(ctx, task, func(status *corev1alpha1.TaskExecutionStatus) {
+			status.State = corev1alpha1.TaskExecutionStateSucceeded
+			status.Outcome = corev1alpha1.TaskExecutionOutcomeSucceeded
+			status.LastTransitionTime = nowMeta()
+		}); patchErr != nil {
+			return patchErr
+		}
+		if transitionErr := d.transitionDelivery(ctx, attemptID, fence, store.PromptDeliveryValidating, store.PromptDeliveryConflict, "workspace-validation-failed", "workspace validation failed before a trusted delta was established"); transitionErr != nil {
+			return transitionErr
+		}
+		status := corev1alpha1.TaskDeliveryStatus{
+			State: corev1alpha1.TaskDeliveryStateDeliveryConflict, Outcome: corev1alpha1.TaskDeliveryOutcomeDeliveryConflict,
+			Reason: "WorkspaceValidationFailed", Message: "workspace validation failed before a trusted delta was established", LastTransitionTime: nowMeta(),
+		}
+		_ = d.patchDeliveryStatus(ctx, task, status)
+		_ = cleanupRuntimeSession("workspace_validation_failed")
+		if sessionExecution != nil {
+			d.forgetRuntimeSessionBinding(sessionExecution.Binding.SessionUID)
+		}
+		return d.failTaskForDelivery(ctx, task, status, "workspace validation failed")
+	}
+	runtimePublicationFinalizationRequired = delta.Delta.State == harnessv2.WorkspaceDeltaPrepared
+	if err := d.saveTaskResult(ctx, task, []byte(resultText)); err != nil {
+		return err
+	}
+	// ACP settlement is authoritative for execution. Delivery may still fail or
+	// remain ambiguous, but it must never rewrite a successfully settled prompt
+	// into a generic execution failure.
+	if err := d.transitionAttempt(ctx, attemptID, fence, store.PromptExecutionSettling, store.PromptExecutionSucceeded, acpSucceededOperation, nil); err != nil {
+		return err
+	}
+	if err := d.patchExecution(ctx, task, func(status *corev1alpha1.TaskExecutionStatus) {
+		status.State = corev1alpha1.TaskExecutionStateSucceeded
+		status.Outcome = corev1alpha1.TaskExecutionOutcomeSucceeded
+		status.LastTransitionTime = nowMeta()
+	}); err != nil {
+		return err
+	}
+
+	var deliveryStatus corev1alpha1.TaskDeliveryStatus
+	publicationID := ""
+	switch delta.Delta.State {
+	case harnessv2.WorkspaceDeltaNoChange:
+		terminalDelivery := store.PromptDeliveryNoChange
+		deliveryStatus = corev1alpha1.TaskDeliveryStatus{
+			State: corev1alpha1.TaskDeliveryStateNoChange, Outcome: corev1alpha1.TaskDeliveryOutcomeNoChange,
+			StartingSHA: baseline.Revision, LastTransitionTime: nowMeta(),
+		}
+		if workspace.Intent == harnessv2.WorkspaceIntentRead {
+			terminalDelivery = store.PromptDeliveryReadValidated
+			deliveryStatus.State = corev1alpha1.TaskDeliveryStateReadValidated
+			deliveryStatus.Outcome = corev1alpha1.TaskDeliveryOutcomeReadValidated
+		}
+		if err := d.transitionDelivery(ctx, attemptID, fence, store.PromptDeliveryValidating, terminalDelivery, "workspace-validated", ""); err != nil {
+			return err
+		}
+	case harnessv2.WorkspaceDeltaReadOnlyModified:
+		if err := d.transitionDelivery(ctx, attemptID, fence, store.PromptDeliveryValidating, store.PromptDeliveryReadOnlyWorkspaceModified, "read-only-workspace-modified", "read-only workspace was modified"); err != nil {
+			return err
+		}
+		deliveryStatus = corev1alpha1.TaskDeliveryStatus{
+			State: corev1alpha1.TaskDeliveryStateReadOnlyWorkspaceModified, Outcome: corev1alpha1.TaskDeliveryOutcomeReadOnlyWorkspaceModified,
+			Reason: "ReadOnlyWorkspaceModified", Message: "read-only workspace was modified", StartingSHA: baseline.Revision,
+			LastTransitionTime: nowMeta(),
+		}
+		if err := d.patchDeliveryStatus(ctx, task, deliveryStatus); err != nil {
+			return err
+		}
+		_ = cleanupRuntimeSession("read_only_workspace_modified")
+		if err := d.finalizeTaskSessionResult(
+			ctx, task, fence, sessionExecution, resultText, "", corev1alpha1.TaskPhaseFailed, deliveryStatus,
+		); err != nil {
+			return err
+		}
+		if sessionExecution != nil {
+			d.forgetRuntimeSessionBinding(sessionExecution.Binding.SessionUID)
+		}
+		return d.failTaskForDelivery(ctx, task, deliveryStatus, deliveryStatus.Message)
+	case harnessv2.WorkspaceDeltaPrepared:
+		publicationResult, publicationErr := d.publishWorkspaceDelta(runtimeCtx, task, attemptID, fence, baseline, delta.Delta, sessionExecution)
+		publicationID = publicationResult.PublicationID
+		deliveryStatus = publicationResult.Status
+		if deliveryStatus.State != "" {
+			if err := d.patchDeliveryStatus(ctx, task, deliveryStatus); err != nil {
+				return err
+			}
+		}
+		if publicationErr != nil {
+			var deliveryErr *acpDeliveryError
+			if errors.As(publicationErr, &deliveryErr) && deliveryStatus.State == "" {
+				deliveryStatus = corev1alpha1.TaskDeliveryStatus{State: deliveryErr.state, Outcome: deliveryErr.outcome, Reason: deliveryErr.reason, Message: deliveryErr.message, LastTransitionTime: nowMeta()}
+			}
+			if deliveryStatus.State == "" {
+				deliveryStatus = corev1alpha1.TaskDeliveryStatus{
+					State: corev1alpha1.TaskDeliveryStateDeliveryConflict, Outcome: corev1alpha1.TaskDeliveryOutcomeDeliveryConflict,
+					Reason: "PublicationFailed", Message: publicationErr.Error(), LastTransitionTime: nowMeta(),
+				}
+			}
+			if err := d.terminalizeDeliveryError(ctx, attemptID, fence, deliveryStatus); err != nil {
+				return err
+			}
+			if err := d.patchDeliveryStatus(ctx, task, deliveryStatus); err != nil {
+				return err
+			}
+			projectionPhase := corev1alpha1.TaskPhaseFailed
+			if errors.Is(publicationErr, errACPPublicationCancelled) {
+				projectionPhase = corev1alpha1.TaskPhaseCancelled
+			}
+			var finalization runtimeSessionPublicationFinalization
+			var finalizationErr error
+			if publicationID != "" {
+				finalization, finalizationErr = d.runtimeSessionPublicationFinalization(ctx, publicationID, delta.Delta.DeltaID)
+			} else {
+				finalization, finalizationErr = runtimeSessionDeltaAbandonmentFinalization(task, delta.Delta.DeltaID, deliveryStatus)
+			}
+			if finalizationErr != nil {
+				return finalizationErr
+			}
+			runtimePublicationFinalization = &finalization
+			if err := finalizePreparedRuntimeSession(); err != nil {
+				return err
+			}
+			if err := d.finalizeTaskSessionResult(
+				ctx, task, fence, sessionExecution, resultText, publicationID, projectionPhase, deliveryStatus,
+			); err != nil {
+				return err
+			}
+			if cleanupErr := cleanupRuntimeSession("write_task_finalized"); cleanupErr != nil {
+				return cleanupErr
+			}
+			if sessionExecution != nil {
+				d.forgetRuntimeSessionBinding(sessionExecution.Binding.SessionUID)
+			}
+			if errors.Is(publicationErr, errACPPublicationCancelled) {
+				return d.cancelTaskAfterExecution(ctx, task, deliveryStatus, "publication cancelled before push")
+			}
+			if errors.As(publicationErr, &deliveryErr) {
+				return d.failTaskForDelivery(ctx, task, deliveryStatus, deliveryErr.message)
+			}
+			return publicationErr
+		}
+	default:
+		return fmt.Errorf("unsupported workspace delta state %q", delta.Delta.State)
+	}
+
+	if err := d.patchDeliveryStatus(ctx, task, deliveryStatus); err != nil {
+		return err
+	}
+	// Write sessions are always recreated from the independently verified remote
+	// branch. Task-scoped sessions are also deleted after finalization.
+	if workspace.Intent == harnessv2.WorkspaceIntentWrite && publicationID != "" {
+		finalization, finalizationErr := d.runtimeSessionPublicationFinalization(ctx, publicationID, delta.Delta.DeltaID)
+		if finalizationErr != nil {
+			return finalizationErr
+		}
+		runtimePublicationFinalization = &finalization
+	}
+	if err := finalizePreparedRuntimeSession(); err != nil {
+		return err
+	}
+	if err := d.finalizeTaskSessionResult(
+		ctx, task, fence, sessionExecution, resultText, publicationID, corev1alpha1.TaskPhaseSucceeded, deliveryStatus,
+	); err != nil {
+		return err
+	}
+	if sessionExecution == nil || workspace.Intent == harnessv2.WorkspaceIntentWrite {
+		if cleanupErr := cleanupRuntimeSession("task_finalized"); cleanupErr != nil {
+			return cleanupErr
+		}
+		if sessionExecution != nil {
+			d.forgetRuntimeSessionBinding(sessionExecution.Binding.SessionUID)
+		}
+	}
+	return d.completeSuccessWithDelivery(ctx, task, deliveryStatus, "ACP task completed")
+}
+
+func completedPromptResultText(terminal *harnessv2.Event, streamed string, streamedOverflow bool) (string, error) {
+	var terminalText strings.Builder
+	if terminal != nil && terminal.Completed != nil {
+		for _, block := range terminal.Completed.Result.Content {
+			if block.Type == harnessv2.ContentBlockText {
+				terminalText.WriteString(block.Text)
+			}
+		}
+	}
+	if result := strings.TrimSpace(terminalText.String()); result != "" {
+		return result, nil
+	}
+	if streamedOverflow {
+		return "", fmt.Errorf("assistant updates exceed the negotiated terminal result limit and the terminal result is empty")
+	}
+	return strings.TrimSpace(streamed), nil
+}
+
+func acpWorkspaceDeltaLimits(task *corev1alpha1.Task) harnessv2.WorkspaceDeltaLimits {
+	limits := harnessv2.WorkspaceDeltaLimits{MaxBytes: 100 << 20, MaxEntries: 100_000}
+	if task == nil || task.Spec.Workspace == nil {
+		return limits
+	}
+	if task.Spec.Workspace.MaxChangedFiles != nil && *task.Spec.Workspace.MaxChangedFiles > 0 {
+		limits.MaxChangedFiles = uint32(*task.Spec.Workspace.MaxChangedFiles)
+	}
+	limits.AllowedPaths = append([]string(nil), task.Spec.Workspace.AllowedPaths...)
+	limits.DenyRepositoryControlPaths = task.Spec.Workspace.DenyRepositoryControlPaths
+	limits.RejectBinaryFiles = task.Spec.Workspace.RejectBinaryFiles
+	limits.RejectSecretLikeContent = task.Spec.Workspace.RejectSecretLikeContent
+	return limits
+}
+
+type runtimeSessionPublicationFinalization struct {
+	WorkspaceDeltaID      harnessv2.WorkspaceDeltaID
+	PublicationID         string
+	PublicationGeneration uint64
+	PublicationVersion    uint64
+	TerminalState         harnessv2.PublicationTerminalState
+	TerminalReceiptDigest string
+}
+
+func publicationTerminalState(state store.PublicationState) (harnessv2.PublicationTerminalState, error) {
+	switch state {
+	case store.PublicationVerifiedExact:
+		return harnessv2.PublicationTerminalVerifiedExact, nil
+	case store.PublicationDeliveredSuperseded:
+		return harnessv2.PublicationTerminalDeliveredSuperseded, nil
+	case store.PublicationCancelledBeforePublish:
+		return harnessv2.PublicationTerminalCancelledBeforePublish, nil
+	case store.PublicationDeliveryConflict:
+		return harnessv2.PublicationTerminalDeliveryConflict, nil
+	case store.PublicationCredentialBlocked:
+		return harnessv2.PublicationTerminalCredentialBlocked, nil
+	case store.PublicationPreparationFailed:
+		return harnessv2.PublicationTerminalPreparationFailed, nil
+	case store.PublicationOutcomeUnknown:
+		return harnessv2.PublicationTerminalOutcomeUnknown, nil
+	default:
+		return "", fmt.Errorf("publication state %q is not terminal", state)
+	}
+}
+
+func runtimeSessionDeltaAbandonmentFinalization(
+	task *corev1alpha1.Task,
+	deltaID harnessv2.WorkspaceDeltaID,
+	delivery corev1alpha1.TaskDeliveryStatus,
+) (runtimeSessionPublicationFinalization, error) {
+	return runtimeSessionDeltaAbandonmentFinalizationForTaskUID(task, task.UID, deltaID, delivery)
+}
+
+func runtimeSessionDeltaAbandonmentFinalizationForTaskUID(
+	task *corev1alpha1.Task,
+	taskUID types.UID,
+	deltaID harnessv2.WorkspaceDeltaID,
+	delivery corev1alpha1.TaskDeliveryStatus,
+) (runtimeSessionPublicationFinalization, error) {
+	if task == nil || task.Status.Execution == nil || taskUID == "" {
+		return runtimeSessionPublicationFinalization{}, fmt.Errorf("runtime session delta abandonment requires explicit Task identity")
+	}
+	terminal := harnessv2.PublicationTerminalDeliveryConflict
+	switch delivery.State {
+	case corev1alpha1.TaskDeliveryStateCredentialBlocked:
+		terminal = harnessv2.PublicationTerminalCredentialBlocked
+	case corev1alpha1.TaskDeliveryStateCancelledBeforePublish:
+		terminal = harnessv2.PublicationTerminalCancelledBeforePublish
+	case corev1alpha1.TaskDeliveryStatePublicationOutcomeUnknown:
+		terminal = harnessv2.PublicationTerminalOutcomeUnknown
+	}
+	syntheticPublicationID := publicationIDForTaskUID(task, taskUID)
+	digest, err := acpDomainDigest("runtime-session-delta-abandonment-receipt", map[string]any{
+		"taskUID": taskUID, "attempt": task.Status.Execution.Attempt, "deltaID": deltaID,
+		"publicationID": syntheticPublicationID, "terminal": terminal, "delivery": delivery,
+	})
+	if err != nil {
+		return runtimeSessionPublicationFinalization{}, err
+	}
+	return runtimeSessionPublicationFinalization{
+		WorkspaceDeltaID: deltaID, PublicationID: syntheticPublicationID,
+		PublicationGeneration: 1, PublicationVersion: 1,
+		TerminalState: terminal, TerminalReceiptDigest: digest,
+	}, nil
+}
+
+func (d *ACPDispatcher) runtimeSessionPublicationFinalization(
+	ctx context.Context, publicationID string, deltaID harnessv2.WorkspaceDeltaID,
+) (runtimeSessionPublicationFinalization, error) {
+	publication, err := d.Store.GetPublication(ctx, publicationID)
+	if err != nil {
+		return runtimeSessionPublicationFinalization{}, err
+	}
+	terminalState, err := publicationTerminalState(publication.State)
+	if err != nil {
+		return runtimeSessionPublicationFinalization{}, err
+	}
+	if publication.Generation < 1 || publication.Version < 1 {
+		return runtimeSessionPublicationFinalization{}, fmt.Errorf("publication generation and version must be positive")
+	}
+	receipt := store.PublicationReceipt{
+		PublicationID: publication.ID, Generation: publication.Generation, State: publication.State,
+		Prepared: publication.PreparedReceipt, Publish: publication.PublishReceipt,
+		Verification: publication.VerificationReceipt, PullRequest: publication.PullRequestReceipt,
+	}
+	digest, err := acpDomainDigest("runtime-session-publication-finalization-receipt", map[string]any{
+		"publication": receipt, "version": publication.Version,
+	})
+	if err != nil {
+		return runtimeSessionPublicationFinalization{}, err
+	}
+	return runtimeSessionPublicationFinalization{
+		WorkspaceDeltaID: deltaID, PublicationID: publication.ID,
+		PublicationGeneration: uint64(publication.Generation), PublicationVersion: uint64(publication.Version),
+		TerminalState: terminalState, TerminalReceiptDigest: digest,
+	}, nil
+}
+
+func (d *ACPDispatcher) finalizeRuntimeSessionPublication(
+	ctx context.Context, runtimeClient *harnessv2.Client, sessionID harnessv2.RuntimeSessionID, task *corev1alpha1.Task,
+	runtimeFence harnessv2.Fence, finalization runtimeSessionPublicationFinalization,
+) error {
+	return d.finalizeRuntimeSessionPublicationForTaskUID(ctx, runtimeClient, sessionID, task, task.UID, runtimeFence, finalization)
+}
+
+func (d *ACPDispatcher) finalizeRuntimeSessionPublicationForTaskUID(
+	ctx context.Context, runtimeClient *harnessv2.Client, sessionID harnessv2.RuntimeSessionID, task *corev1alpha1.Task,
+	taskUID types.UID, runtimeFence harnessv2.Fence, finalization runtimeSessionPublicationFinalization,
+) error {
+	if runtimeClient == nil {
+		return fmt.Errorf("runtime client is required")
+	}
+	if task == nil || task.Status.Execution == nil || taskUID == "" {
+		return fmt.Errorf("finalize RuntimeSession publication requires explicit Task identity")
+	}
+	finalizeCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
+	defer cancel()
+	now := time.Now().UTC()
+	request := harnessv2.FinalizeRuntimeSessionPublicationRequest{
+		Protocol: harnessv2.ProtocolVersion,
+		Metadata: mutationMetadataForTaskUID(
+			runtimeFence, task, taskUID, "fp-"+strconv.FormatInt(now.UnixNano(), 36), true, now.Add(30*time.Second),
+		),
+		WorkspaceDeltaID: finalization.WorkspaceDeltaID, PublicationID: finalization.PublicationID,
+		PublicationGeneration: finalization.PublicationGeneration, PublicationVersion: finalization.PublicationVersion,
+		TerminalState: finalization.TerminalState, TerminalReceiptDigest: finalization.TerminalReceiptDigest,
+	}
+	if err := sealMutation(&request.Metadata.RequestDigest, request); err != nil {
+		return fmt.Errorf("seal RuntimeSession publication finalization: %w", err)
+	}
+	if _, err := runtimeClient.FinalizeRuntimeSessionPublication(finalizeCtx, sessionID, request); err != nil {
+		var clientErr *harnessv2.ClientError
+		if errors.As(err, &clientErr) && (clientErr.StatusCode == http.StatusNotFound || clientErr.StatusCode == http.StatusGone) {
+			return nil
+		}
+		return fmt.Errorf("finalize RuntimeSession publication: %w", err)
+	}
+	return nil
+}
+
+func (d *ACPDispatcher) deleteRuntimeSession(
+	ctx context.Context,
+	runtimeClient *harnessv2.Client,
+	sessionID harnessv2.RuntimeSessionID,
+	task *corev1alpha1.Task,
+	runtimeFence harnessv2.Fence,
+	reason string,
+) error {
+	return d.deleteRuntimeSessionForTaskUID(ctx, runtimeClient, sessionID, task, task.UID, runtimeFence, reason)
+}
+
+func (d *ACPDispatcher) deleteRuntimeSessionForTaskUID(
+	ctx context.Context,
+	runtimeClient *harnessv2.Client,
+	sessionID harnessv2.RuntimeSessionID,
+	task *corev1alpha1.Task,
+	taskUID types.UID,
+	runtimeFence harnessv2.Fence,
+	reason string,
+) error {
+	now := time.Now().UTC()
+	request, err := newDeleteRuntimeSessionRequestForTaskUID(task, taskUID, runtimeFence, reason, now.Add(30*time.Second))
+	if err != nil {
+		return err
+	}
+	return d.deleteRuntimeSessionRequest(ctx, runtimeClient, sessionID, request)
+}
+
+func newDeleteRuntimeSessionRequestForTaskUID(
+	task *corev1alpha1.Task,
+	taskUID types.UID,
+	runtimeFence harnessv2.Fence,
+	reason string,
+	expiresAt time.Time,
+) (harnessv2.DeleteRuntimeSessionRequest, error) {
+	if task == nil || task.Status.Execution == nil || taskUID == "" {
+		return harnessv2.DeleteRuntimeSessionRequest{}, fmt.Errorf("delete RuntimeSession requires explicit Task identity")
+	}
+	now := time.Now().UTC()
+	request := harnessv2.DeleteRuntimeSessionRequest{
+		Protocol: harnessv2.ProtocolVersion,
+		Metadata: mutationMetadataForTaskUID(
+			runtimeFence, task, taskUID, "ds-"+strconv.FormatInt(now.UnixNano(), 36), false, expiresAt.UTC(),
+		),
+		Reason: reason,
+	}
+	if err := sealMutation(&request.Metadata.RequestDigest, request); err != nil {
+		return harnessv2.DeleteRuntimeSessionRequest{}, fmt.Errorf("seal RuntimeSession deletion: %w", err)
+	}
+	return request, nil
+}
+
+func (d *ACPDispatcher) deleteRuntimeSessionRequest(
+	ctx context.Context,
+	runtimeClient *harnessv2.Client,
+	sessionID harnessv2.RuntimeSessionID,
+	request harnessv2.DeleteRuntimeSessionRequest,
+) error {
+	if runtimeClient == nil {
+		return fmt.Errorf("runtime client is required")
+	}
+	deleteCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
+	defer cancel()
+	if _, err := runtimeClient.DeleteRuntimeSession(deleteCtx, sessionID, request); err != nil {
+		var clientErr *harnessv2.ClientError
+		if errors.As(err, &clientErr) && (clientErr.StatusCode == http.StatusNotFound || clientErr.StatusCode == http.StatusGone) {
+			return nil
+		}
+		return fmt.Errorf("delete RuntimeSession: %w", err)
+	}
+	return nil
+}
+
+func runtimeSessionStatusForUID(
+	ctx context.Context,
+	runtimeClient *harnessv2.Client,
+	sessionUID harnessv2.RuntimeSessionUID,
+) (*harnessv2.StatusResponse, *harnessv2.RuntimeSessionStatus, error) {
+	if runtimeClient == nil {
+		return nil, nil, fmt.Errorf("runtime client is required")
+	}
+	statusCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+	status, err := runtimeClient.Status(statusCtx)
+	if err != nil {
+		return nil, nil, fmt.Errorf("read RuntimeSession status: %w", err)
+	}
+	for i := range status.Sessions {
+		if status.Sessions[i].RuntimeSessionUID == sessionUID {
+			observed := status.Sessions[i]
+			return status, &observed, nil
+		}
+	}
+	return status, nil, nil
+}
+
+func waitForRuntimeSessionAdmission(
+	ctx context.Context,
+	runtimeClient *harnessv2.Client,
+	sessionID harnessv2.RuntimeSessionID,
+	sessionUID harnessv2.RuntimeSessionUID,
+	generation uint64,
+	timeout time.Duration,
+) (bool, error) {
+	waitCtx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+	ticker := time.NewTicker(250 * time.Millisecond)
+	defer ticker.Stop()
+	var lastStatusErr error
+	for {
+		_, observed, err := runtimeSessionStatusForUID(waitCtx, runtimeClient, sessionUID)
+		if err != nil {
+			lastStatusErr = err
+		} else if observed != nil {
+			if observed.RuntimeSessionID != sessionID || observed.Generation != generation {
+				return false, fmt.Errorf("%w: RuntimeSession status resolved to a different generation", store.ErrConflict)
+			}
+			if observed.State.CanAdmitPrompt() {
+				return true, nil
+			}
+			if observed.State == harnessv2.RuntimeSessionStateCreating {
+				lastStatusErr = nil
+				select {
+				case <-waitCtx.Done():
+					return false, nil
+				case <-ticker.C:
+					continue
+				}
+			}
+			return false, fmt.Errorf("%w: RuntimeSession creation settled in non-admissible state %s", store.ErrConflict, observed.State)
+		}
+		select {
+		case <-waitCtx.Done():
+			if lastStatusErr != nil {
+				return false, lastStatusErr
+			}
+			return false, nil
+		case <-ticker.C:
+		}
+	}
+}
+
+func (d *ACPDispatcher) reconcilePlannedRuntimeSession(
+	ctx context.Context,
+	runtimeClient *harnessv2.Client,
+	task *corev1alpha1.Task,
+	attemptID string,
+	fence store.ControllerEpochFence,
+	session *acpTaskSession,
+	runtimeFence *harnessv2.Fence,
+) (bool, error) {
+	if session == nil || runtimeFence == nil {
+		return false, nil
+	}
+	status, observed, err := runtimeSessionStatusForUID(ctx, runtimeClient, runtimeFence.RuntimeSessionUID)
+	if err != nil {
+		if requeueErr := d.requeuePreSubmissionTaskWithRuntimeBinding(
+			ctx, task, attemptID, fence, err, &session.Binding,
+		); requeueErr != nil {
+			return false, requeueErr
+		}
+		session.requeued = true
+		return true, nil
+	}
+	expectedPoolFence := *runtimeFence
+	expectedPoolFence.RuntimeSessionUID = ""
+	expectedPoolFence.RuntimeSessionGeneration = 0
+	if mismatch := harnessv2.CompareFence(expectedPoolFence, status.Fence, false); mismatch != harnessv2.FenceMatch {
+		fenceErr := fmt.Errorf("%w: RuntimeSession status fence mismatch: %s", store.ErrConflict, mismatch)
+		if requeueErr := d.requeuePreSubmissionTaskWithRuntimeBinding(
+			ctx, task, attemptID, fence, fenceErr, &session.Binding,
+		); requeueErr != nil {
+			return false, errors.Join(fenceErr, requeueErr)
+		}
+		session.requeued = true
+		return true, nil
+	}
+	expectedID := harnessv2.RuntimeSessionID(runtimeSessionID(*runtimeFence))
+	if observed == nil {
+		if !session.Reused {
+			return false, nil
+		}
+		if session.Binding.Generation >= maxControllerRuntimeSessionGeneration {
+			return false, store.ValidationErrorf("ACP runtime session generation is exhausted")
+		}
+		nextGeneration := max(session.Binding.Generation+1, uint64(session.LeaseGeneration))
+		if nextGeneration > maxControllerRuntimeSessionGeneration {
+			return false, store.ValidationErrorf("ACP runtime session generation is exhausted")
+		}
+		session.Binding.Generation = nextGeneration
+		session.Binding.WorkspaceDigest = ""
+		session.Binding.RecreationRequired = true
+		session.Reused = false
+		runtimeFence.RuntimeSessionGeneration = nextGeneration
+		d.setRuntimeSessionBinding(session.Binding)
+		if err := d.patchExecution(ctx, task, func(execution *corev1alpha1.TaskExecutionStatus) {
+			applyRuntimeSessionBindingToExecution(execution, &session.Binding)
+			execution.LastTransitionTime = nowMeta()
+		}); err != nil {
+			return false, err
+		}
+		if err := d.requeuePreSubmissionTaskWithRuntimeBinding(
+			ctx, task, attemptID, fence, errors.New("missing reusable RuntimeSession requires recreation"), &session.Binding,
+		); err != nil {
+			return false, err
+		}
+		session.requeued = true
+		return true, nil
+	}
+	if observed.RuntimeSessionID == expectedID && observed.Generation == runtimeFence.RuntimeSessionGeneration {
+		if observed.State.CanAdmitPrompt() {
+			if !session.Reused {
+				session.Reused = true
+				session.Binding.RecreationRequired = false
+				d.setRuntimeSessionBinding(session.Binding)
+				if err := d.patchExecution(ctx, task, func(execution *corev1alpha1.TaskExecutionStatus) {
+					applyRuntimeSessionBindingToExecution(execution, &session.Binding)
+					execution.LastTransitionTime = nowMeta()
+				}); err != nil {
+					if requeueErr := d.requeuePreSubmissionTaskWithRuntimeBinding(
+						ctx, task, attemptID, fence, err, &session.Binding,
+					); requeueErr != nil {
+						return false, errors.Join(err, requeueErr)
+					}
+					session.requeued = true
+					return true, nil
+				}
+			}
+			return false, nil
+		}
+		if observed.State == harnessv2.RuntimeSessionStateCreating {
+			if err := d.requeuePreSubmissionTaskWithRuntimeBinding(
+				ctx, task, attemptID, fence, errors.New("RuntimeSession creation is still settling"), &session.Binding,
+			); err != nil {
+				return false, err
+			}
+			session.requeued = true
+			return true, nil
+		}
+	}
+	if observed.Generation >= maxControllerRuntimeSessionGeneration {
+		return false, store.ValidationErrorf("ACP runtime session generation is exhausted")
+	}
+	nextGeneration := max(session.Binding.Generation, observed.Generation+1, uint64(session.LeaseGeneration))
+	if session.Reused {
+		if session.Binding.Generation >= maxControllerRuntimeSessionGeneration {
+			return false, store.ValidationErrorf("ACP runtime session generation is exhausted")
+		}
+		nextGeneration = max(nextGeneration, session.Binding.Generation+1)
+	}
+	if nextGeneration > maxControllerRuntimeSessionGeneration {
+		return false, store.ValidationErrorf("ACP runtime session generation is exhausted")
+	}
+	session.Binding.Generation = nextGeneration
+	session.Binding.WorkspaceDigest = ""
+	session.Binding.RecreationRequired = true
+	session.Reused = false
+	runtimeFence.RuntimeSessionGeneration = nextGeneration
+	d.setRuntimeSessionBinding(session.Binding)
+	if err := d.patchExecution(ctx, task, func(execution *corev1alpha1.TaskExecutionStatus) {
+		applyRuntimeSessionBindingToExecution(execution, &session.Binding)
+		execution.LastTransitionTime = nowMeta()
+	}); err != nil {
+		return false, err
+	}
+	observedFence := expectedPoolFence
+	observedFence.RuntimeSessionUID = observed.RuntimeSessionUID
+	observedFence.RuntimeSessionGeneration = observed.Generation
+	if err := d.deleteRuntimeSessionReconciled(
+		context.WithoutCancel(ctx), runtimeClient, observed.RuntimeSessionID, task, observedFence, "replace_stale_runtime_session",
+	); err != nil {
+		if requeueErr := d.requeuePreSubmissionTaskWithRuntimeBinding(
+			ctx, task, attemptID, fence, err, &session.Binding,
+		); requeueErr != nil {
+			return false, requeueErr
+		}
+		session.requeued = true
+		return true, nil
+	}
+	if err := d.requeuePreSubmissionTaskWithRuntimeBinding(
+		ctx, task, attemptID, fence, errors.New("stale RuntimeSession was retired before recreation"), &session.Binding,
+	); err != nil {
+		return false, err
+	}
+	session.requeued = true
+	return true, nil
+}
+
+func (d *ACPDispatcher) deleteRuntimeSessionReconciled(
+	ctx context.Context,
+	runtimeClient *harnessv2.Client,
+	sessionID harnessv2.RuntimeSessionID,
+	task *corev1alpha1.Task,
+	runtimeFence harnessv2.Fence,
+	reason string,
+) error {
+	_, observed, err := runtimeSessionStatusForUID(ctx, runtimeClient, runtimeFence.RuntimeSessionUID)
+	if err != nil {
+		return err
+	}
+	if observed == nil || observed.RuntimeSessionID != sessionID || observed.Generation != runtimeFence.RuntimeSessionGeneration {
+		return nil
+	}
+	if observed.State != harnessv2.RuntimeSessionStateDeleting {
+		if err := d.deleteRuntimeSession(ctx, runtimeClient, sessionID, task, runtimeFence, reason); err == nil {
+			return nil
+		} else {
+			deleteErr := err
+			settleCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
+			defer cancel()
+			ticker := time.NewTicker(250 * time.Millisecond)
+			defer ticker.Stop()
+			for {
+				_, current, statusErr := runtimeSessionStatusForUID(settleCtx, runtimeClient, runtimeFence.RuntimeSessionUID)
+				if statusErr == nil && (current == nil || current.RuntimeSessionID != sessionID || current.Generation != runtimeFence.RuntimeSessionGeneration) {
+					return nil
+				}
+				select {
+				case <-settleCtx.Done():
+					return deleteErr
+				case <-ticker.C:
+				}
+			}
+		}
+	}
+
+	settleCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
+	defer cancel()
+	ticker := time.NewTicker(250 * time.Millisecond)
+	defer ticker.Stop()
+	for {
+		_, current, statusErr := runtimeSessionStatusForUID(settleCtx, runtimeClient, runtimeFence.RuntimeSessionUID)
+		if statusErr == nil && (current == nil || current.RuntimeSessionID != sessionID || current.Generation != runtimeFence.RuntimeSessionGeneration) {
+			return nil
+		}
+		select {
+		case <-settleCtx.Done():
+			return fmt.Errorf("RuntimeSession deletion did not settle before retry")
+		case <-ticker.C:
+		}
+	}
+}
+
+type acpRuntimePoolReservationIdentity struct {
+	PoolKey           types.NamespacedName
+	PoolUID           types.UID
+	TaskUID           types.UID
+	Attempt           int32
+	ControllerEpoch   int64
+	RuntimeInstanceID string
+}
+
+type acpRuntimePoolReservationLease struct {
+	dispatcher *ACPDispatcher
+	identity   acpRuntimePoolReservationIdentity
+
+	mu     sync.Mutex
+	held   bool
+	cancel context.CancelFunc
+}
+
+func newACPRuntimePoolReservationLease(d *ACPDispatcher, identity *acpRuntimePoolReservationIdentity) *acpRuntimePoolReservationLease {
+	if d == nil || identity == nil {
+		return nil
+	}
+	return &acpRuntimePoolReservationLease{dispatcher: d, identity: *identity, held: true}
+}
+
+func (l *acpRuntimePoolReservationLease) startRenewal(ctx context.Context) {
+	if l == nil {
+		return
+	}
+	l.mu.Lock()
+	if !l.held || l.cancel != nil {
+		l.mu.Unlock()
+		return
+	}
+	renewCtx, cancel := context.WithCancel(ctx)
+	l.cancel = cancel
+	interval := max(l.dispatcher.effectiveReservationTTL()/3, time.Second)
+	l.mu.Unlock()
+	go func() {
+		ticker := time.NewTicker(interval)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-renewCtx.Done():
+				return
+			case <-ticker.C:
+				if err := l.renew(renewCtx); err != nil {
+					if !errors.Is(err, context.Canceled) {
+						logf.FromContext(renewCtx).Error(err, "ACP RuntimePool reservation renewal stopped", "namespace", l.identity.PoolKey.Namespace, "pool", l.identity.PoolKey.Name, "taskUID", l.identity.TaskUID, "attempt", l.identity.Attempt)
+					}
+					return
+				}
+			}
+		}
+	}()
+}
+
+func (l *acpRuntimePoolReservationLease) renew(ctx context.Context) error {
+	if l == nil {
+		return nil
+	}
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	if !l.held {
+		return errACPRuntimePoolReservationLost
+	}
+	if _, err := l.dispatcher.renewRuntimePoolReservation(ctx, l.identity); err != nil {
+		if errors.Is(err, errACPRuntimePoolReservationLost) {
+			l.held = false
+			if l.cancel != nil {
+				l.cancel()
+				l.cancel = nil
+			}
+		}
+		return err
+	}
+	return nil
+}
+
+func (l *acpRuntimePoolReservationLease) setSlots(ctx context.Context, residentSlots int32) error {
+	if l == nil {
+		return nil
+	}
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	if !l.held {
+		return errACPRuntimePoolReservationLost
+	}
+	if err := l.dispatcher.updateRuntimePoolReservationSlots(ctx, l.identity, residentSlots, 1); err != nil {
+		if errors.Is(err, errACPRuntimePoolReservationLost) {
+			l.held = false
+		}
+		return err
+	}
+	return nil
+}
+
+func (l *acpRuntimePoolReservationLease) release(ctx context.Context) error {
+	if l == nil {
+		return nil
+	}
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	if l.cancel != nil {
+		l.cancel()
+		l.cancel = nil
+	}
+	if !l.held {
+		return nil
+	}
+	if err := l.dispatcher.releaseRuntimePoolReservation(ctx, l.identity); err != nil {
+		return err
+	}
+	l.held = false
+	return nil
+}
+
+func (d *ACPDispatcher) effectiveReservationTTL() time.Duration {
+	if d.ReservationTTL > 0 {
+		return d.ReservationTTL
+	}
+	return DefaultACPRuntimePoolReservationTTL
+}
+
+func (d *ACPDispatcher) effectiveRateLimitRetryInterval() time.Duration {
+	if d.RateLimitRetryInterval > 0 {
+		return d.RateLimitRetryInterval
+	}
+	return DefaultACPRateLimitReconcileInterval
+}
+
+func (d *ACPDispatcher) claimRuntimePoolReservation(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	poolName string,
+	fence store.ControllerEpochFence,
+	residentSlots int32,
+) (*corev1alpha1.RuntimePool, *acpRuntimePoolReservationIdentity, error) {
+	if err := d.AdmissionGate.Check(); err != nil {
+		return nil, nil, err
+	}
+	const promptSlots int32 = 1
+	if task == nil || task.Status.Execution == nil || task.UID == "" || task.Status.Execution.Attempt < 1 {
+		return nil, nil, fmt.Errorf("task identity and execution attempt are required for RuntimePool reservation")
+	}
+	if residentSlots < 0 || residentSlots > 1 || promptSlots < 0 || promptSlots > 1 || residentSlots+promptSlots == 0 {
+		return nil, nil, fmt.Errorf("RuntimePool reservation slots must be zero or one and claim at least one slot")
+	}
+	poolUID := types.UID(strings.TrimSpace(task.Status.Execution.RuntimePoolUID))
+	if poolUID == "" {
+		return nil, nil, fmt.Errorf("task RuntimePool UID is required for capacity reservation")
+	}
+	key := types.NamespacedName{Namespace: task.Namespace, Name: strings.TrimSpace(poolName)}
+	identity := &acpRuntimePoolReservationIdentity{
+		PoolKey: key, PoolUID: poolUID, TaskUID: task.UID, Attempt: task.Status.Execution.Attempt, ControllerEpoch: fence.Epoch,
+	}
+	var claimed *corev1alpha1.RuntimePool
+	var unavailable error
+	err := retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		if err := d.AdmissionGate.Check(); err != nil {
+			return err
+		}
+		unavailable = nil
+		latest := &corev1alpha1.RuntimePool{}
+		if err := d.Client.Get(ctx, key, latest); err != nil {
+			return client.IgnoreNotFound(err)
+		}
+		now := time.Now().UTC()
+		reservations, changed := activeRuntimePoolReservations(latest, fence.Epoch, now)
+		latest.Status.Capacity.Reservations = reservations
+		updateRuntimePoolReservationCounters(&latest.Status.Capacity)
+		if string(latest.UID) != string(poolUID) {
+			unavailable = fmt.Errorf("%w: frozen RuntimePool UID no longer exists", errACPRuntimePoolNotAdmitting)
+			return updateRuntimePoolReservationStatusIfChanged(ctx, d.Client, latest, changed)
+		}
+		for i := range reservations {
+			if runtimePoolReservationMatches(reservations[i], *identity) {
+				identity.RuntimeInstanceID = reservations[i].RuntimeInstanceID
+				expiresAt := metav1.NewTime(now.Add(d.effectiveReservationTTL()))
+				if reservations[i].ExpiresAt.Time.Before(expiresAt.Time) {
+					latest.Status.Capacity.Reservations[i].ExpiresAt = expiresAt
+					changed = true
+				}
+				if err := updateRuntimePoolReservationStatusIfChanged(ctx, d.Client, latest, changed); err != nil {
+					return err
+				}
+				claimed = latest.DeepCopy()
+				return nil
+			}
+		}
+		runtimeInstanceID, admissionErr := runtimePoolReservationAdmission(latest, reservations, fence.Epoch, residentSlots, promptSlots)
+		if admissionErr != nil {
+			unavailable = admissionErr
+			return updateRuntimePoolReservationStatusIfChanged(ctx, d.Client, latest, changed)
+		}
+		identity.RuntimeInstanceID = runtimeInstanceID
+		reservedAt := metav1.NewTime(now)
+		latest.Status.Capacity.Reservations = append(latest.Status.Capacity.Reservations, corev1alpha1.RuntimePoolCapacityReservationStatus{
+			PoolUID: string(poolUID), TaskUID: string(task.UID), Attempt: task.Status.Execution.Attempt,
+			ControllerEpoch: fence.Epoch, RuntimeInstanceID: runtimeInstanceID,
+			ResidentSlots: residentSlots, PromptSlots: promptSlots, ReservedAt: reservedAt,
+			ExpiresAt: metav1.NewTime(now.Add(d.effectiveReservationTTL())),
+		})
+		sortRuntimePoolReservations(latest.Status.Capacity.Reservations)
+		updateRuntimePoolReservationCounters(&latest.Status.Capacity)
+		if err := d.Client.Status().Update(ctx, latest); err != nil {
+			return err
+		}
+		claimed = latest.DeepCopy()
+		return nil
+	})
+	if err != nil {
+		return nil, nil, err
+	}
+	if unavailable != nil {
+		return nil, nil, unavailable
+	}
+	if claimed == nil || identity.RuntimeInstanceID == "" {
+		return nil, nil, fmt.Errorf("%w: RuntimePool disappeared while reserving capacity", errACPRuntimePoolNotAdmitting)
+	}
+	return claimed, identity, nil
+}
+
+func runtimePoolReservationAdmission(
+	pool *corev1alpha1.RuntimePool,
+	reservations []corev1alpha1.RuntimePoolCapacityReservationStatus,
+	controllerEpoch int64,
+	residentSlots, promptSlots int32,
+) (string, error) {
+	active := pool.Status.ActiveInstance
+	requiresNewSession := residentSlots > 0
+	if pool.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleServing ||
+		(requiresNewSession && pool.Status.AdmissionState != corev1alpha1.RuntimePoolAdmissionAccepting) ||
+		active == nil || active.ControllerEpoch != controllerEpoch || strings.TrimSpace(active.RuntimeInstanceID) == "" {
+		return "", fmt.Errorf("%w: RuntimePool is not eligible for exact-instance admission on the current controller epoch", errACPRuntimePoolNotAdmitting)
+	}
+	maxResident, maxPrompts := effectiveRuntimePoolCapacityLimits(pool)
+	reservedResident, reservedPrompts := runtimePoolReservedSlots(reservations)
+	if int64(pool.Status.Capacity.ResidentSessions)+reservedResident+int64(residentSlots) > maxResident ||
+		int64(pool.Status.Capacity.RunningPrompts)+reservedPrompts+int64(promptSlots) > maxPrompts ||
+		len(reservations) >= corev1alpha1.MaxRuntimePoolCapacityReservations {
+		return "", fmt.Errorf("%w: RuntimePool has no unclaimed resident or prompt slot", errACPRuntimePoolAtCapacity)
+	}
+	return active.RuntimeInstanceID, nil
+}
+
+func (d *ACPDispatcher) renewRuntimePoolReservation(ctx context.Context, identity acpRuntimePoolReservationIdentity) (*corev1alpha1.RuntimePool, error) {
+	var renewed *corev1alpha1.RuntimePool
+	err := retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		latest := &corev1alpha1.RuntimePool{}
+		if err := d.Client.Get(ctx, identity.PoolKey, latest); err != nil {
+			if apierrors.IsNotFound(err) {
+				return errACPRuntimePoolReservationLost
+			}
+			return err
+		}
+		now := time.Now().UTC()
+		reservations, changed := activeRuntimePoolReservations(latest, identity.ControllerEpoch, now)
+		latest.Status.Capacity.Reservations = reservations
+		found := false
+		for i := range reservations {
+			if !runtimePoolReservationMatches(reservations[i], identity) {
+				continue
+			}
+			found = true
+			latest.Status.Capacity.Reservations[i].ExpiresAt = metav1.NewTime(now.Add(d.effectiveReservationTTL()))
+			changed = true
+			break
+		}
+		updateRuntimePoolReservationCounters(&latest.Status.Capacity)
+		if !found {
+			if err := updateRuntimePoolReservationStatusIfChanged(ctx, d.Client, latest, changed); err != nil {
+				return err
+			}
+			return errACPRuntimePoolReservationLost
+		}
+		if err := d.Client.Status().Update(ctx, latest); err != nil {
+			return err
+		}
+		renewed = latest.DeepCopy()
+		return nil
+	})
+	return renewed, err
+}
+
+func (d *ACPDispatcher) updateRuntimePoolReservationSlots(ctx context.Context, identity acpRuntimePoolReservationIdentity, residentSlots, promptSlots int32) error {
+	if residentSlots < 0 || residentSlots > 1 || promptSlots < 0 || promptSlots > 1 || residentSlots+promptSlots == 0 {
+		return fmt.Errorf("RuntimePool reservation slots must be zero or one and claim at least one slot")
+	}
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		latest := &corev1alpha1.RuntimePool{}
+		if err := d.Client.Get(ctx, identity.PoolKey, latest); err != nil {
+			if apierrors.IsNotFound(err) {
+				return errACPRuntimePoolReservationLost
+			}
+			return err
+		}
+		reservations, changed := activeRuntimePoolReservations(latest, identity.ControllerEpoch, time.Now().UTC())
+		latest.Status.Capacity.Reservations = reservations
+		found := false
+		for i := range reservations {
+			if !runtimePoolReservationMatches(reservations[i], identity) {
+				continue
+			}
+			found = true
+			if reservations[i].ResidentSlots != residentSlots || reservations[i].PromptSlots != promptSlots {
+				if residentSlots > reservations[i].ResidentSlots || promptSlots > reservations[i].PromptSlots {
+					others := make([]corev1alpha1.RuntimePoolCapacityReservationStatus, 0, len(reservations)-1)
+					others = append(others, reservations[:i]...)
+					others = append(others, reservations[i+1:]...)
+					runtimeInstanceID, admissionErr := runtimePoolReservationAdmission(
+						latest, others, identity.ControllerEpoch, residentSlots, promptSlots,
+					)
+					if admissionErr != nil {
+						if err := updateRuntimePoolReservationStatusIfChanged(ctx, d.Client, latest, changed); err != nil {
+							return err
+						}
+						return admissionErr
+					}
+					if runtimeInstanceID != reservations[i].RuntimeInstanceID {
+						if err := updateRuntimePoolReservationStatusIfChanged(ctx, d.Client, latest, changed); err != nil {
+							return err
+						}
+						return errACPRuntimePoolReservationLost
+					}
+				}
+				latest.Status.Capacity.Reservations[i].ResidentSlots = residentSlots
+				latest.Status.Capacity.Reservations[i].PromptSlots = promptSlots
+				changed = true
+			}
+			break
+		}
+		updateRuntimePoolReservationCounters(&latest.Status.Capacity)
+		if !found {
+			if err := updateRuntimePoolReservationStatusIfChanged(ctx, d.Client, latest, changed); err != nil {
+				return err
+			}
+			return errACPRuntimePoolReservationLost
+		}
+		return updateRuntimePoolReservationStatusIfChanged(ctx, d.Client, latest, changed)
+	})
+}
+
+func (d *ACPDispatcher) releaseRuntimePoolReservation(ctx context.Context, identity acpRuntimePoolReservationIdentity) error {
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		latest := &corev1alpha1.RuntimePool{}
+		if err := d.Client.Get(ctx, identity.PoolKey, latest); err != nil {
+			return client.IgnoreNotFound(err)
+		}
+		reservations := latest.Status.Capacity.Reservations
+		kept := make([]corev1alpha1.RuntimePoolCapacityReservationStatus, 0, len(reservations))
+		changed := false
+		for i := range reservations {
+			if runtimePoolReservationMatches(reservations[i], identity) {
+				changed = true
+				continue
+			}
+			kept = append(kept, reservations[i])
+		}
+		if !changed {
+			return nil
+		}
+		latest.Status.Capacity.Reservations = kept
+		updateRuntimePoolReservationCounters(&latest.Status.Capacity)
+		return d.Client.Status().Update(ctx, latest)
+	})
+}
+
+func activeRuntimePoolReservations(pool *corev1alpha1.RuntimePool, controllerEpoch int64, now time.Time) ([]corev1alpha1.RuntimePoolCapacityReservationStatus, bool) {
+	if pool == nil {
+		return nil, false
+	}
+	activeInstanceID := ""
+	if pool.Status.Lifecycle == corev1alpha1.RuntimePoolLifecycleServing && pool.Status.ActiveInstance != nil &&
+		pool.Status.ActiveInstance.ControllerEpoch == controllerEpoch {
+		activeInstanceID = strings.TrimSpace(pool.Status.ActiveInstance.RuntimeInstanceID)
+	}
+	reservations := make([]corev1alpha1.RuntimePoolCapacityReservationStatus, 0, len(pool.Status.Capacity.Reservations))
+	changed := false
+	for i := range pool.Status.Capacity.Reservations {
+		reservation := pool.Status.Capacity.Reservations[i]
+		valid := reservation.PoolUID == string(pool.UID) && reservation.ControllerEpoch == controllerEpoch &&
+			reservation.RuntimeInstanceID == activeInstanceID && activeInstanceID != "" && reservation.ExpiresAt.After(now) &&
+			reservation.ResidentSlots >= 0 && reservation.ResidentSlots <= 1 && reservation.PromptSlots >= 0 && reservation.PromptSlots <= 1 &&
+			reservation.ResidentSlots+reservation.PromptSlots > 0
+		if !valid {
+			changed = true
+			continue
+		}
+		reservations = append(reservations, reservation)
+	}
+	if len(reservations) != len(pool.Status.Capacity.Reservations) {
+		changed = true
+	}
+	sortRuntimePoolReservations(reservations)
+	return reservations, changed
+}
+
+func runtimePoolReservationMatches(reservation corev1alpha1.RuntimePoolCapacityReservationStatus, identity acpRuntimePoolReservationIdentity) bool {
+	return reservation.PoolUID == string(identity.PoolUID) && reservation.TaskUID == string(identity.TaskUID) &&
+		reservation.Attempt == identity.Attempt && reservation.ControllerEpoch == identity.ControllerEpoch &&
+		(identity.RuntimeInstanceID == "" || reservation.RuntimeInstanceID == identity.RuntimeInstanceID)
+}
+
+func runtimePoolReservedSlots(reservations []corev1alpha1.RuntimePoolCapacityReservationStatus) (int64, int64) {
+	var resident, prompts int64
+	for i := range reservations {
+		resident += int64(reservations[i].ResidentSlots)
+		prompts += int64(reservations[i].PromptSlots)
+	}
+	return resident, prompts
+}
+
+func updateRuntimePoolReservationCounters(capacity *corev1alpha1.RuntimePoolCapacityStatus) {
+	if capacity == nil {
+		return
+	}
+	resident, prompts := runtimePoolReservedSlots(capacity.Reservations)
+	capacity.ReservedSessions = int32(resident)
+	capacity.ReservedPrompts = int32(prompts)
+}
+
+func effectiveRuntimePoolCapacityLimits(pool *corev1alpha1.RuntimePool) (int64, int64) {
+	resident := pool.Status.Capacity.MaxResidentSessions
+	prompts := pool.Status.Capacity.MaxRunningPrompts
+	if resident <= 0 && pool.Spec.Capacity != nil {
+		resident = pool.Spec.Capacity.MaxResidentSessions
+	}
+	if prompts <= 0 && pool.Spec.Capacity != nil {
+		prompts = pool.Spec.Capacity.MaxRunningPrompts
+	}
+	if resident <= 0 {
+		resident = corev1alpha1.DefaultRuntimePoolMaxResidentSessions
+	}
+	if prompts <= 0 {
+		prompts = corev1alpha1.DefaultRuntimePoolMaxRunningPrompts
+	}
+	return int64(resident), int64(prompts)
+}
+
+func sortRuntimePoolReservations(reservations []corev1alpha1.RuntimePoolCapacityReservationStatus) {
+	sort.SliceStable(reservations, func(i, j int) bool {
+		if !reservations[i].ReservedAt.Equal(&reservations[j].ReservedAt) {
+			return reservations[i].ReservedAt.Before(&reservations[j].ReservedAt)
+		}
+		if reservations[i].TaskUID != reservations[j].TaskUID {
+			return reservations[i].TaskUID < reservations[j].TaskUID
+		}
+		if reservations[i].Attempt != reservations[j].Attempt {
+			return reservations[i].Attempt < reservations[j].Attempt
+		}
+		return reservations[i].ControllerEpoch < reservations[j].ControllerEpoch
+	})
+}
+
+func updateRuntimePoolReservationStatusIfChanged(ctx context.Context, kubeClient client.Client, pool *corev1alpha1.RuntimePool, changed bool) error {
+	if !changed {
+		return nil
+	}
+	return kubeClient.Status().Update(ctx, pool)
+}
+
+type acpDispatchTarget struct {
+	pool *corev1alpha1.RuntimePool
+	// external is retained only for terminal RuntimeSession cleanup and recovery.
+	// New Task dispatch must never construct an external target.
+	external    *corev1alpha1.AgentRuntime
+	reservation *acpRuntimePoolReservationIdentity
+}
+
+func runtimeSessionCreateTimeout(target acpDispatchTarget) time.Duration {
+	minimum := time.Duration(corev1alpha1.DefaultRuntimePoolColdStartTimeoutSeconds) * time.Second
+	if target.pool == nil {
+		return minimum
+	}
+	configured := time.Duration(target.pool.Spec.ColdStartTimeoutSeconds) * time.Second
+	if configured < minimum {
+		return minimum
+	}
+	return configured
+}
+
+func acpTaskDeadline(task *corev1alpha1.Task, now time.Time) (time.Time, bool) {
+	if task == nil || task.Spec.Timeout == nil || task.Spec.Timeout.Duration <= 0 {
+		return time.Time{}, false
+	}
+	now = now.UTC()
+	var startedAt time.Time
+	if !task.CreationTimestamp.IsZero() {
+		startedAt = task.CreationTimestamp.UTC()
+	} else {
+		startedAt = acpTaskQueuedAt(task)
+		if startedAt.Equal(time.Unix(0, 0).UTC()) {
+			startedAt = now
+		}
+	}
+	return startedAt.Add(task.Spec.Timeout.Duration), true
+}
+
+func (d *ACPDispatcher) settleQueuedTaskBeforeAdmission(ctx context.Context, queued *corev1alpha1.Task) (bool, error) {
+	if queued == nil {
+		return false, nil
+	}
+	reader := d.APIReader
+	if reader == nil {
+		reader = d.Client
+	}
+	task := &corev1alpha1.Task{}
+	if err := reader.Get(ctx, types.NamespacedName{Namespace: queued.Namespace, Name: queued.Name}, task); err != nil {
+		if apierrors.IsNotFound(err) {
+			return false, nil
+		}
+		return false, err
+	}
+	if task.Status.Execution == nil ||
+		(task.Status.Execution.State != corev1alpha1.TaskExecutionStateQueued && task.Status.Execution.State != corev1alpha1.TaskExecutionStateReserved) {
+		return false, nil
+	}
+	if d.isActive(task.UID) {
+		return false, nil
+	}
+	settled, err := d.settleTaskBeforeRuntimeAdmission(ctx, task)
+	return !settled, err
+}
+
+func (d *ACPDispatcher) settleTaskBeforeRuntimeAdmission(ctx context.Context, task *corev1alpha1.Task) (bool, error) {
+	if task == nil || task.Status.Execution == nil {
+		return false, nil
+	}
+	operation := ""
+	reason := corev1alpha1.TaskExecutionReason("")
+	message := ""
+	now := time.Now().UTC()
+	deadline, hasDeadline := acpTaskDeadline(task, now)
+	switch {
+	case !task.DeletionTimestamp.IsZero() || task.Status.Phase == corev1alpha1.TaskPhaseCancelled:
+		operation, reason, message = "cancelled-before-admission", "Cancelled", "task cancelled before runtime admission"
+	case hasDeadline && !now.Before(deadline):
+		operation, reason, message = "timeout-before-admission", "TaskTimeout", "task deadline exceeded before runtime admission"
+	default:
+		return false, nil
+	}
+	attemptID, err := promptAttemptIDFromTask(task)
+	if err != nil {
+		return true, err
+	}
+	fence, err := d.Epochs.CurrentFence(ctx)
+	if err != nil {
+		return true, err
+	}
+	var recoveredSession *acpTaskSession
+	if task.Status.Execution.State == corev1alpha1.TaskExecutionStateReserved {
+		if task.Spec.SessionRef == nil {
+			attempt, getErr := d.Store.GetPromptAttempt(ctx, attemptID)
+			if getErr != nil {
+				return true, getErr
+			}
+			bound, boundErr := promptAttemptSessionBound(attempt)
+			if boundErr != nil {
+				return true, boundErr
+			}
+			if bound {
+				task.Status.Execution.RuntimeInstanceID = attempt.RuntimeInstanceID
+				task.Status.Execution.RuntimeSessionUID = attempt.SessionUID
+				task.Status.Execution.RuntimeSessionGeneration = attempt.SessionLeaseGeneration
+				if err := d.patchExecution(ctx, task, func(status *corev1alpha1.TaskExecutionStatus) {
+					status.RuntimeInstanceID = attempt.RuntimeInstanceID
+					status.RuntimeSessionUID = attempt.SessionUID
+					status.RuntimeSessionGeneration = attempt.SessionLeaseGeneration
+				}); err != nil {
+					return true, err
+				}
+				complete, cleanupErr := d.cleanupRecoveredTaskScopedRuntimeSession(ctx, task)
+				if cleanupErr != nil || !complete {
+					return true, cleanupErr
+				}
+			}
+		} else {
+			recoveredSession, err = d.quiesceInterruptedTaskSessionPreparation(ctx, task, attemptID, fence)
+			if err != nil {
+				return true, err
+			}
+		}
+		identity := acpRuntimePoolReservationIdentity{
+			PoolKey: types.NamespacedName{Namespace: task.Namespace, Name: task.Status.Execution.RuntimePoolName},
+			PoolUID: types.UID(task.Status.Execution.RuntimePoolUID), TaskUID: task.UID,
+			Attempt: task.Status.Execution.Attempt, ControllerEpoch: task.Status.Execution.ControllerEpoch,
+		}
+		releaseCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
+		releaseErr := d.releaseRuntimePoolReservation(releaseCtx, identity)
+		cancel()
+		if releaseErr != nil {
+			return true, releaseErr
+		}
+	}
+	if err := d.settlePreSubmissionCancellation(ctx, task, attemptID, fence, operation, reason, message); err != nil {
+		return true, err
+	}
+	if recoveredSession != nil {
+		cleanupCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), acpPreSubmissionCleanupTimeout)
+		defer cancel()
+		var terminalErr = context.Canceled
+		if reason == corev1alpha1.TaskExecutionReason("TaskTimeout") {
+			terminalErr = context.DeadlineExceeded
+		}
+		if err := d.reconcileUnfinalizedTaskSession(cleanupCtx, task, fence, recoveredSession, terminalErr); err != nil {
+			return true, err
+		}
+	}
+	return true, nil
+}
+
+func (d *ACPDispatcher) reserveTask(ctx context.Context, queued *corev1alpha1.Task) (*corev1alpha1.Task, acpDispatchTarget, error) {
+	task := &corev1alpha1.Task{}
+	reader := d.APIReader
+	if reader == nil {
+		reader = d.Client
+	}
+	if err := reader.Get(ctx, types.NamespacedName{Namespace: queued.Namespace, Name: queued.Name}, task); err != nil {
+		return nil, acpDispatchTarget{}, client.IgnoreNotFound(err)
+	}
+	if task.Status.Execution == nil || (task.Status.Execution.State != corev1alpha1.TaskExecutionStateQueued && task.Status.Execution.State != corev1alpha1.TaskExecutionStateReserved) {
+		return nil, acpDispatchTarget{}, nil
+	}
+	if persistedExternalRuntimeDispatch(task) {
+		return nil, acpDispatchTarget{}, d.rejectPersistedExternalRuntimeDispatch(ctx, task)
+	}
+	settled, err := d.settleTaskBeforeRuntimeAdmission(ctx, task)
+	if err != nil || settled {
+		return nil, acpDispatchTarget{}, err
+	}
+	attemptID, err := promptAttemptIDFromTask(task)
+	if err != nil {
+		return nil, acpDispatchTarget{}, err
+	}
+	fence, err := d.Epochs.CurrentFence(ctx)
+	if err != nil {
+		return nil, acpDispatchTarget{}, err
+	}
+	var target acpDispatchTarget
+	residentSlots := int32(1)
+	if task.Spec.SessionRef != nil {
+		// Session planning is the authority for whether an existing resident
+		// RuntimeSession can be reused. Claim only prompt capacity until that
+		// plan proves a new resident slot is actually required.
+		residentSlots = 0
+	}
+	pool, reservation, claimErr := d.claimRuntimePoolReservation(
+		ctx, task, task.Status.Execution.RuntimePoolName, fence, residentSlots,
+	)
+	if claimErr != nil {
+		if errors.Is(claimErr, errACPRuntimePoolAtCapacity) || errors.Is(claimErr, errACPRuntimePoolNotAdmitting) {
+			_ = d.patchExecution(ctx, task, func(status *corev1alpha1.TaskExecutionStatus) {
+				status.Reason = corev1alpha1.TaskExecutionReasonAtCapacity
+				status.Message = claimErr.Error()
+			})
+			return nil, acpDispatchTarget{}, nil
+		}
+		return nil, acpDispatchTarget{}, claimErr
+	}
+	target.pool = pool
+	target.reservation = reservation
+	releaseClaim := func() {
+		if target.reservation == nil {
+			return
+		}
+		releaseCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
+		defer cancel()
+		_ = d.releaseRuntimePoolReservation(releaseCtx, *target.reservation)
+	}
+	if err := d.freezeWorkspaceCredentialVersions(ctx, task); err != nil {
+		releaseClaim()
+		if blocked, ok := asACPWorkspaceCredentialBlockedError(err); ok {
+			if settleErr := d.settleFrozenWorkspaceCredentialBlocked(ctx, task, attemptID, fence, blocked); settleErr != nil {
+				return nil, acpDispatchTarget{}, fmt.Errorf("settle frozen workspace credential failure: %w", settleErr)
+			}
+			return nil, acpDispatchTarget{}, nil
+		}
+		return nil, acpDispatchTarget{}, err
+	}
+	bound, err := d.refreshTaskRuntimePoolBinding(ctx, task, pool)
+	if err != nil {
+		releaseClaim()
+		return nil, acpDispatchTarget{}, err
+	}
+	if !bound {
+		releaseClaim()
+		return nil, acpDispatchTarget{}, nil
+	}
+	ready, err := d.preparePromptAttemptReservation(ctx, task, attemptID, fence)
+	if err != nil {
+		releaseClaim()
+		return nil, acpDispatchTarget{}, err
+	}
+	if !ready {
+		releaseClaim()
+		return nil, acpDispatchTarget{}, nil
+	}
+	bound, err = d.refreshTaskRuntimePoolBinding(ctx, task, pool)
+	if err != nil {
+		releaseClaim()
+		return nil, acpDispatchTarget{}, err
+	}
+	if !bound {
+		releaseClaim()
+		return nil, acpDispatchTarget{}, nil
+	}
+	if err := d.patchExecution(ctx, task, func(status *corev1alpha1.TaskExecutionStatus) {
+		status.State = corev1alpha1.TaskExecutionStateReserved
+		status.ControllerEpoch = fence.Epoch
+		status.Reason = ""
+		status.Message = ""
+		status.LastTransitionTime = nowMeta()
+	}); err != nil {
+		releaseClaim()
+		return nil, acpDispatchTarget{}, err
+	}
+	bound, err = d.refreshTaskRuntimePoolBinding(ctx, task, pool)
+	if err != nil {
+		releaseClaim()
+		return nil, acpDispatchTarget{}, err
+	}
+	if !bound {
+		releaseClaim()
+		return nil, acpDispatchTarget{}, nil
+	}
+	return task, target, nil
+}
+
+func (d *ACPDispatcher) preparePromptAttemptReservation(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attemptID string,
+	fence store.ControllerEpochFence,
+) (bool, error) {
+	attempt, err := d.Store.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		return false, err
+	}
+	switch attempt.ExecutionState {
+	case store.PromptExecutionQueued:
+		if err := d.transitionAttempt(
+			ctx, attemptID, fence, store.PromptExecutionQueued, store.PromptExecutionReserved, "reserve", nil,
+		); err != nil {
+			return false, err
+		}
+		return true, nil
+	case store.PromptExecutionReserved:
+		return true, nil
+	case store.PromptExecutionSessionStarting, store.PromptExecutionPlanned:
+		// The pre-submission path advances the durable PromptAttempt before it
+		// acquires the Session lease and projects the Task state. If its fenced
+		// rollback fails after a transient cross-store error, the Task remains
+		// Reserved while the PromptAttempt is left one step ahead. Re-enter the
+		// existing idempotent recovery barrier before strict dispatch verification
+		// so the exact Session lease/turn can be retried without replaying a prompt.
+		if task == nil || task.Status.Execution == nil ||
+			task.Status.Execution.State != corev1alpha1.TaskExecutionStateReserved {
+			return false, nil
+		}
+		if err := d.requeuePreSubmissionTask(
+			ctx, task, attemptID, fence, errors.New("recover incomplete pre-submission rollback"),
+		); err != nil {
+			return false, err
+		}
+		return true, nil
+	default:
+		return false, nil
+	}
+}
+
+func (d *ACPDispatcher) settleFrozenWorkspaceCredentialBlocked(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attemptID string,
+	fence store.ControllerEpochFence,
+	blocked *acpWorkspaceCredentialBlockedError,
+) error {
+	attempt, err := d.Store.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		return err
+	}
+	if !queuedPromptAttemptMatchesTask(attempt, task) {
+		return fmt.Errorf("%w: frozen credential PromptAttempt does not match Task execution identity", store.ErrConflict)
+	}
+	if !promptAttemptFreezesCredential(attempt, blocked) {
+		return fmt.Errorf("%w: PromptAttempt does not contain the reported frozen credential binding", store.ErrConflict)
+	}
+	if attempt.ExecutionState == store.PromptExecutionFailed {
+		if attempt.TerminalReason != acpCredentialBlockedOperation {
+			return fmt.Errorf("%w: PromptAttempt already failed for reason %q", store.ErrConflict, attempt.TerminalReason)
+		}
+	} else {
+		switch attempt.ExecutionState {
+		case store.PromptExecutionQueued, store.PromptExecutionReserved:
+		default:
+			return fmt.Errorf("%w: cannot settle credential-blocked PromptAttempt from state %s", store.ErrConflict, attempt.ExecutionState)
+		}
+		if attempt.RuntimeInstanceID != "" || attempt.SessionUID != "" || attempt.SessionLeaseGeneration != 0 {
+			return fmt.Errorf("%w: credential-blocked PromptAttempt already has a runtime or session binding", store.ErrConflict)
+		}
+		digest, digestErr := acpDomainDigest("attempt-transition", map[string]any{
+			"id": attemptID, "from": attempt.ExecutionState, "to": store.PromptExecutionFailed,
+			"operation": acpCredentialBlockedOperation, "version": attempt.Version,
+			"terminalReason": acpCredentialBlockedOperation, "credentialRole": blocked.role,
+		})
+		if digestErr != nil {
+			return digestErr
+		}
+		operationID := store.CanonicalControlID(
+			acpCredentialBlockedOperation, attempt.ID, strconv.FormatInt(attempt.Version, 10), string(blocked.role),
+		)
+		if _, err := d.Store.TransitionPromptAttemptExecution(ctx, store.PromptAttemptExecutionTransition{
+			ID: attemptID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+			NewState: store.PromptExecutionFailed, OperationID: operationID,
+			OperationDigest: digest, TerminalReason: acpCredentialBlockedOperation, UpdatedAt: time.Now().UTC(),
+		}); err != nil {
+			return err
+		}
+	}
+	return d.failTaskBeforeSessionBinding(
+		ctx, task, corev1alpha1.TaskExecutionStateFailed, corev1alpha1.TaskExecutionOutcomeFailed,
+		acpCredentialBlockedExecutionReason, acpCredentialBlockedMessage,
+	)
+}
+
+func (d *ACPDispatcher) refreshTaskRuntimePoolBinding(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	pool *corev1alpha1.RuntimePool,
+) (bool, error) {
+	if task == nil || pool == nil {
+		return false, nil
+	}
+	reader := d.APIReader
+	if reader == nil {
+		reader = d.Client
+	}
+	current := &corev1alpha1.Task{}
+	if err := reader.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, current); err != nil {
+		if apierrors.IsNotFound(err) {
+			return false, nil
+		}
+		return false, err
+	}
+	if current.UID != task.UID || current.Status.Execution == nil ||
+		(current.Status.Execution.State != corev1alpha1.TaskExecutionStateQueued &&
+			current.Status.Execution.State != corev1alpha1.TaskExecutionStateReserved) ||
+		current.Status.Execution.Attempt != task.Status.Execution.Attempt ||
+		current.Status.Execution.PromptID != task.Status.Execution.PromptID ||
+		current.Status.Execution.RequestDigest != task.Status.Execution.RequestDigest ||
+		!acpRuntimePoolBindingMatches(current.Status.Execution, pool) {
+		return false, nil
+	}
+	task.Status = current.Status
+	task.Labels = current.Labels
+	task.Annotations = current.Annotations
+	return true, nil
+}
+
+func (d *ACPDispatcher) handlePreSubmissionContextDone(
+	ctx context.Context,
+	runtimeCtx context.Context,
+	task *corev1alpha1.Task,
+	attemptID string,
+	fence store.ControllerEpochFence,
+) (bool, error) {
+	if !errors.Is(runtimeContextError(runtimeCtx), context.DeadlineExceeded) {
+		return false, nil
+	}
+	return true, d.settlePreSubmissionCancellation(
+		ctx, task, attemptID, fence, "timeout-before-submission", "TaskTimeout", "task deadline exceeded before prompt submission",
+	)
+}
+
+func (d *ACPDispatcher) newTaskRuntimeContext(ctx context.Context, task *corev1alpha1.Task) (context.Context, context.CancelFunc) {
+	if d != nil && d.runtimeContextFactory != nil {
+		return d.runtimeContextFactory(ctx, task)
+	}
+	if deadline, ok := acpTaskDeadline(task, time.Now().UTC()); ok {
+		return context.WithDeadline(ctx, deadline)
+	}
+	return context.WithCancel(ctx)
+}
+
+func runtimeContextError(ctx context.Context) error {
+	if ctx == nil {
+		return nil
+	}
+	if cause := context.Cause(ctx); cause != nil {
+		return cause
+	}
+	return ctx.Err()
+}
+
+func (d *ACPDispatcher) settlePreSubmissionCancellation(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attemptID string,
+	fence store.ControllerEpochFence,
+	operation string,
+	reason corev1alpha1.TaskExecutionReason,
+	message string,
+) error {
+	if err := d.transitionAttemptToTerminal(ctx, attemptID, fence, store.PromptExecutionCancelled, operation); err != nil {
+		return err
+	}
+	attempt, err := d.Store.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		return err
+	}
+	bound, err := promptAttemptSessionBound(attempt)
+	if err != nil {
+		return err
+	}
+	if task.Spec.SessionRef != nil && !bound {
+		return d.failTaskBeforeSessionBinding(
+			ctx, task, corev1alpha1.TaskExecutionStateCancelled, corev1alpha1.TaskExecutionOutcomeCancelled, reason, message,
+		)
+	}
+	return d.failTask(
+		ctx, task, corev1alpha1.TaskExecutionStateCancelled, corev1alpha1.TaskExecutionOutcomeCancelled, reason, message,
+	)
+}
+
+type attemptRuntimeBinding struct {
+	RuntimeInstanceID string
+	SessionUID        string
+	SessionGeneration int64
+}
+
+func (d *ACPDispatcher) transitionAttempt(ctx context.Context, id string, fence store.ControllerEpochFence, from, to store.PromptExecutionState, operation string, binding *attemptRuntimeBinding) error {
+	attempt, err := d.Store.GetPromptAttempt(ctx, id)
+	if err != nil {
+		return err
+	}
+	if attempt.ExecutionState == to {
+		return nil
+	}
+	if attempt.ExecutionState != from {
+		return fmt.Errorf("prompt attempt %s state is %s, want %s", id, attempt.ExecutionState, from)
+	}
+	digest, err := acpDomainDigest("attempt-transition", map[string]any{"id": id, "from": from, "to": to, "operation": operation, "version": attempt.Version})
+	if err != nil {
+		return err
+	}
+	transition := store.PromptAttemptExecutionTransition{
+		ID: id, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: from, NewState: to,
+		OperationID: operation + "-" + strconv.FormatInt(attempt.Version, 10), OperationDigest: digest, UpdatedAt: time.Now().UTC(),
+	}
+	if binding != nil {
+		transition.RuntimeInstanceID = binding.RuntimeInstanceID
+		transition.SessionUID = binding.SessionUID
+		transition.SessionLeaseGeneration = binding.SessionGeneration
+	}
+	_, err = d.Store.TransitionPromptAttemptExecution(ctx, transition)
+	return err
+}
+
+func (d *ACPDispatcher) transitionDelivery(ctx context.Context, id string, fence store.ControllerEpochFence, from, to store.PromptDeliveryState, operation, reason string) error {
+	attempt, err := d.Store.GetPromptAttempt(ctx, id)
+	if err != nil {
+		return err
+	}
+	if attempt.DeliveryState == to {
+		return nil
+	}
+	digest, err := acpDomainDigest("delivery-transition", map[string]any{"id": id, "from": from, "to": to, "operation": operation, "version": attempt.Version})
+	if err != nil {
+		return err
+	}
+	_, err = d.Store.TransitionPromptAttemptDelivery(ctx, store.PromptAttemptDeliveryTransition{
+		ID: id, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: from, NewState: to,
+		OperationID: operation + "-" + strconv.FormatInt(attempt.Version, 10), OperationDigest: digest, TerminalReason: reason, UpdatedAt: time.Now().UTC(),
+	})
+	return err
+}
+
+func (d *ACPDispatcher) runtimeClient(ctx context.Context, target acpDispatchTarget) (*harnessv2.Client, harnessv2.Fence, harnessv2.RuntimeProfile, int, error) {
+	if target.external != nil {
+		return d.externalRuntimeClient(ctx, target.external)
+	}
+	if target.pool == nil {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, fmt.Errorf("ACP runtime target is missing")
+	}
+	return d.runtimePoolClient(ctx, target.pool)
+}
+
+func (d *ACPDispatcher) runtimePoolClient(ctx context.Context, pool *corev1alpha1.RuntimePool) (*harnessv2.Client, harnessv2.Fence, harnessv2.RuntimeProfile, int, error) {
+	active := pool.Status.ActiveInstance
+	if active == nil {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, fmt.Errorf("RuntimePool has no active instance")
+	}
+	fence, err := d.Epochs.CurrentFence(ctx)
+	if err != nil {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, err
+	}
+	if active.ControllerEpoch != fence.Epoch {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, fmt.Errorf("RuntimePool active instance is bound to stale controller epoch")
+	}
+	secret, err := d.runtimeAuthSecret(ctx, pool)
+	if err != nil {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, err
+	}
+	controllerToken := strings.TrimSpace(string(secret.Data[runtimePoolControllerTokenKey]))
+	capabilitySecret := secret.Data[runtimePoolCapabilitySecretKey]
+	if controllerToken == "" || len(capabilitySecret) < harnessv2.MinCapabilitySecretBytes {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, fmt.Errorf("RuntimePool auth Secret is incomplete")
+	}
+	endpoint := exactPodEndpoint(active.PodAddress)
+	runtimeClient, err := harnessv2.NewClient(
+		endpoint,
+		harnessv2.WithControlTimeout(runtimeSessionCreateTimeout(acpDispatchTarget{pool: pool})),
+		harnessv2.WithControllerBearerToken(controllerToken),
+		harnessv2.WithOperationCapabilitySecret(capabilitySecret),
+	)
+	if err != nil {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, err
+	}
+	capabilities, err := runtimeClient.Capabilities(ctx)
+	if err != nil {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, err
+	}
+	if string(capabilities.RuntimeProfileDigest) != pool.Spec.Runtime.Profile.Digest || string(capabilities.RuntimeProfileDigest) != active.ProfileDigest {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, fmt.Errorf("RuntimePool capability profile digest mismatch")
+	}
+	if !capabilities.WorkspaceGovernance.Strict() {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, fmt.Errorf("RuntimePool does not provide strict workspace governance")
+	}
+	profile := runtimeProfileFromPool(pool.Spec.Runtime.Profile)
+	if profile.WorkspaceIntent == harnessv2.WorkspaceIntentWrite && !capabilities.SupportsPublicationFinalization {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, fmt.Errorf("RuntimePool does not support controller-owned RuntimeSession publication finalization required for write workspaces")
+	}
+	runtimeFence := harnessv2.Fence{
+		RuntimeInstanceID: harnessv2.RuntimeInstanceID(active.RuntimeInstanceID), SupervisorBootID: harnessv2.SupervisorBootID(active.BootID),
+		ControllerEpoch: uint64(fence.Epoch), RuntimePoolUID: harnessv2.RuntimePoolUID(pool.UID), RuntimePoolGeneration: uint64(pool.Generation),
+		RuntimeProfileDigest: harnessv2.ProfileDigest(pool.Spec.Runtime.Profile.Digest), ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+	}
+	return runtimeClient, runtimeFence, profile, capabilities.Limits.MaxTerminalResultBytes, nil
+}
+
+func (d *ACPDispatcher) externalRuntimeClient(ctx context.Context, runtime *corev1alpha1.AgentRuntime) (*harnessv2.Client, harnessv2.Fence, harnessv2.RuntimeProfile, int, error) {
+	if reason := externalAgentRuntimeReadinessReason(nil, runtime); reason != "" {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, fmt.Errorf("%s", reason)
+	}
+	currentFence, err := d.Epochs.CurrentFence(ctx)
+	if err != nil {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, err
+	}
+	observed := runtime.Status.ObservedCapabilities
+	if observed.ControllerEpoch != currentFence.Epoch {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, fmt.Errorf("external AgentRuntime is fenced to controller epoch %d, current epoch is %d", observed.ControllerEpoch, currentFence.Epoch)
+	}
+	if strings.TrimSpace(observed.RuntimePoolUID) == "" || observed.RuntimePoolGeneration < 1 || strings.TrimSpace(observed.SupervisorBootID) == "" {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, fmt.Errorf("external AgentRuntime did not advertise the required immutable fence")
+	}
+	auth, err := (&AgentRuntimeReconciler{Client: d.Client}).agentRuntimeAuthMaterial(ctx, runtime)
+	if err != nil {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, err
+	}
+	if runtime.Status.ObservedControllerAuthRefResourceVersion != auth.controllerResourceVersion ||
+		runtime.Status.ObservedOperationCapabilityRefResourceVersion != auth.capabilityResourceVersion {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, fmt.Errorf("external AgentRuntime authentication material changed after conformance")
+	}
+	runtimeClient, err := harnessv2.NewClient(
+		runtime.Spec.Deployment.Endpoint,
+		harnessv2.WithControlTimeout(runtimeSessionCreateTimeout(acpDispatchTarget{external: runtime})),
+		harnessv2.WithControllerBearerToken(auth.controllerBearerToken),
+		harnessv2.WithOperationCapabilitySecret(auth.operationCapabilitySecret),
+	)
+	if err != nil {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, err
+	}
+	capabilities, err := runtimeClient.Capabilities(ctx)
+	if err != nil {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, err
+	}
+	if string(capabilities.RuntimeProfileDigest) != runtime.Spec.Capabilities.Profile.Digest || !capabilities.WorkspaceGovernance.Strict() {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, fmt.Errorf("external AgentRuntime capability identity/profile drifted after conformance")
+	}
+	if runtime.Spec.Capabilities.Profile.WorkspaceIntent == corev1alpha1.WorkspaceIntentWrite && !capabilities.SupportsPublicationFinalization {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, fmt.Errorf("external AgentRuntime does not support controller-owned RuntimeSession publication finalization required for write workspaces")
+	}
+	status, err := runtimeClient.Status(ctx)
+	if err != nil {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, err
+	}
+	if string(status.Fence.RuntimeInstanceID) != observed.RuntimeInstanceID || string(status.Fence.SupervisorBootID) != observed.SupervisorBootID ||
+		int64(status.Fence.ControllerEpoch) != observed.ControllerEpoch || string(status.Fence.RuntimePoolUID) != observed.RuntimePoolUID ||
+		int64(status.Fence.RuntimePoolGeneration) != observed.RuntimePoolGeneration || string(status.Fence.RuntimeProfileDigest) != runtime.Spec.Capabilities.Profile.Digest {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, fmt.Errorf("external AgentRuntime status fence drifted after conformance")
+	}
+	profile, err := agentRuntimeProfile(*runtime.Spec.Capabilities.Profile)
+	if err != nil {
+		return nil, harnessv2.Fence{}, harnessv2.RuntimeProfile{}, 0, err
+	}
+	fence := harnessv2.Fence{
+		RuntimeInstanceID: harnessv2.RuntimeInstanceID(observed.RuntimeInstanceID), SupervisorBootID: harnessv2.SupervisorBootID(observed.SupervisorBootID),
+		ControllerEpoch: uint64(currentFence.Epoch), RuntimePoolUID: harnessv2.RuntimePoolUID(observed.RuntimePoolUID),
+		RuntimePoolGeneration: uint64(observed.RuntimePoolGeneration), RuntimeProfileDigest: harnessv2.ProfileDigest(runtime.Spec.Capabilities.Profile.Digest),
+		ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+	}
+	return runtimeClient, fence, profile, capabilities.Limits.MaxTerminalResultBytes, nil
+}
+
+func (d *ACPDispatcher) runtimeAuthSecret(ctx context.Context, pool *corev1alpha1.RuntimePool) (*corev1.Secret, error) {
+	namespace := pool.Spec.RuntimeNamespace
+	if namespace == "" && pool.Status.ActiveInstance != nil {
+		namespace = pool.Status.ActiveInstance.PodNamespace
+	}
+	var secrets corev1.SecretList
+	if err := d.APIReader.List(ctx, &secrets, client.InNamespace(namespace), client.MatchingLabels{
+		runtimePoolAuthLabel: "true", runtimePoolUIDLabel: string(pool.UID),
+	}); err != nil {
+		return nil, err
+	}
+	if len(secrets.Items) != 1 {
+		return nil, fmt.Errorf("RuntimePool requires exactly one auth Secret, found %d", len(secrets.Items))
+	}
+	return secrets.Items[0].DeepCopy(), nil
+}
+
+func runtimeProfileFromPool(profile corev1alpha1.RuntimePoolProfileSpec) harnessv2.RuntimeProfile {
+	var modelLimits *harnessv2.ModelTokenLimits
+	if profile.ModelLimits != nil {
+		modelLimits = &harnessv2.ModelTokenLimits{
+			Context: profile.ModelLimits.Context,
+			Output:  profile.ModelLimits.Output,
+		}
+	}
+	return harnessv2.RuntimeProfile{
+		ACPProfile: profile.ACPProfile, AdapterDigests: cloneMap(profile.AdapterDigests), ProviderKind: profile.ProviderKind,
+		Model:                    profile.Model,
+		ModelLimits:              modelLimits,
+		AgentConfigurationDigest: profile.AgentConfigurationDigest, ToolPolicyDigest: profile.ToolPolicyDigest,
+		ApprovalPolicyDigest: profile.ApprovalPolicyDigest, MCPConfigurationDigest: profile.MCPConfigurationDigest,
+		WorkspaceIntent: harnessv2.WorkspaceIntent(profile.WorkspaceIntent), ProxyCredentialRole: profile.ProxyCredentialRole,
+		ProxyCredentialScope: profile.ProxyCredentialScope, ResourceClass: profile.ResourceClass,
+	}
+}
+
+func emptyRuntimeWorkspace(task *corev1alpha1.Task) (harnessv2.WorkspaceBaseline, harnessv2.WorkspaceSpec, error) {
+	workspace := task.Spec.Workspace
+	if workspace != nil && strings.TrimSpace(workspace.GitRepo) != "" {
+		return harnessv2.WorkspaceBaseline{}, harnessv2.WorkspaceSpec{}, fmt.Errorf("clean-room Git workspace preparation is not implemented")
+	}
+	digest, err := acpDomainDigest("empty-workspace", map[string]any{"taskUID": string(task.UID)})
+	if err != nil {
+		return harnessv2.WorkspaceBaseline{}, harnessv2.WorkspaceSpec{}, err
+	}
+	baseline := harnessv2.WorkspaceBaseline{
+		RepositoryIdentity: acpNoWorkspaceRevision + ":" + string(task.UID),
+		Revision:           acpNoWorkspaceRevision,
+		TreeDigest:         digest,
+	}
+	intent := harnessv2.WorkspaceIntent(effectiveACPWorkspaceIntent(task))
+	return baseline, harnessv2.WorkspaceSpec{Intent: intent, Baseline: baseline}, nil
+}
+
+func (d *ACPDispatcher) buildPromptRequest(
+	task *corev1alpha1.Task,
+	fence harnessv2.Fence,
+	profile harnessv2.RuntimeProfile,
+	mcpConfiguration harnessv2.MCPPolicyConfiguration,
+	bootstrap string,
+	userPrompt string,
+	admissionRetry int,
+) (harnessv2.StartPromptRequest, error) {
+	if fence.RuntimeSessionUID == "" {
+		fence.RuntimeSessionUID = harnessv2.RuntimeSessionUID(taskRuntimeSessionUID(task))
+	}
+	if fence.RuntimeSessionGeneration == 0 {
+		fence.RuntimeSessionGeneration = 1
+	}
+	now := time.Now().UTC()
+	lease := harnessv2.PromptLease{Generation: 1, IssuedAt: now, ExpiresAt: now.Add(90 * time.Second)}
+	operation := "start-prompt"
+	if admissionRetry > 0 {
+		operation += "-retry-" + strconv.Itoa(admissionRetry)
+	}
+	metadata := mutationMetadata(fence, task, operation, true, now.Add(60*time.Second))
+	content := acpPromptInputContent(bootstrap, userPrompt)
+	authorization, err := buildPromptMCPAuthorization(
+		mcpConfiguration, fence, profile, metadata, lease, now.Add(60*time.Second),
+	)
+	if err != nil {
+		return harnessv2.StartPromptRequest{}, err
+	}
+	return harnessv2.StartPromptRequest{
+		Protocol: harnessv2.ProtocolVersion, Metadata: metadata, Lease: lease,
+		MCPAuthorization: authorization,
+		Input:            harnessv2.PromptInput{Content: content},
+	}, nil
+}
+
+func acpPromptInputContent(bootstrap, userPrompt string) []harnessv2.ContentBlock {
+	content := make([]harnessv2.ContentBlock, 0, 2)
+	if strings.TrimSpace(bootstrap) != "" {
+		content = append(content, harnessv2.ContentBlock{Type: harnessv2.ContentBlockText, Text: bootstrap})
+	}
+	content = append(content, harnessv2.ContentBlock{Type: harnessv2.ContentBlockText, Text: userPrompt})
+	return content
+}
+
+func mutationMetadata(fence harnessv2.Fence, task *corev1alpha1.Task, operation string, prompt bool, expiry time.Time) harnessv2.MutationMetadata {
+	return mutationMetadataForTaskUID(fence, task, task.UID, operation, prompt, expiry)
+}
+
+func mutationMetadataForTaskUID(
+	fence harnessv2.Fence,
+	task *corev1alpha1.Task,
+	taskUID types.UID,
+	operation string,
+	prompt bool,
+	expiry time.Time,
+) harnessv2.MutationMetadata {
+	if fence.RuntimeSessionUID == "" {
+		fence.RuntimeSessionUID = harnessv2.RuntimeSessionUID(taskRuntimeSessionUID(task))
+	}
+	if fence.RuntimeSessionGeneration == 0 {
+		fence.RuntimeSessionGeneration = 1
+	}
+	metadata := harnessv2.MutationMetadata{
+		Fence: fence, TaskUID: harnessv2.TaskUID(taskUID), TaskAttempt: uint32(task.Status.Execution.Attempt),
+		OperationID:                harnessv2.OperationID(operation + "-" + task.Status.Execution.PromptID),
+		RequestDigestSchemaVersion: harnessv2.RequestDigestSchemaVersion, ExpiresAt: expiry,
+	}
+	if prompt {
+		metadata.PromptID = harnessv2.PromptID(task.Status.Execution.PromptID)
+	}
+	return metadata
+}
+
+func sealMutation(target *harnessv2.RequestDigest, request any) error {
+	digest, err := harnessv2.CanonicalRequestDigest(request)
+	if err != nil {
+		return err
+	}
+	*target = digest
+	return nil
+}
+
+func taskRuntimeSessionUID(task *corev1alpha1.Task) string {
+	return "session-" + string(task.UID)
+}
+
+func runtimeSessionID(fence harnessv2.Fence) string {
+	return "runtime-" + string(fence.RuntimeSessionUID) + "-g" + strconv.FormatUint(fence.RuntimeSessionGeneration, 10)
+}
+
+func exactPodEndpoint(address string) string {
+	address = strings.TrimSpace(address)
+	if parsed := net.ParseIP(address); parsed != nil {
+		return (&url.URL{Scheme: "http", Host: net.JoinHostPort(address, "8080")}).String()
+	}
+	if _, _, err := net.SplitHostPort(address); err == nil {
+		return (&url.URL{Scheme: "http", Host: address}).String()
+	}
+	return (&url.URL{Scheme: "http", Host: net.JoinHostPort(address, "8080")}).String()
+}
+
+func promptAttemptIDFromTask(task *corev1alpha1.Task) (string, error) {
+	return promptAttemptIDFromTaskUID(task, task.UID)
+}
+
+func promptAttemptIDFromTaskUID(task *corev1alpha1.Task, taskUID types.UID) (string, error) {
+	if task.Status.Execution == nil {
+		return "", fmt.Errorf("task execution status is missing")
+	}
+	return (store.PromptAttemptKey{
+		Namespace: task.Namespace, TaskUID: string(taskUID), Attempt: int64(task.Status.Execution.Attempt), PromptID: task.Status.Execution.PromptID,
+	}).CanonicalID()
+}
+
+func (d *ACPDispatcher) patchExecution(ctx context.Context, task *corev1alpha1.Task, mutate func(*corev1alpha1.TaskExecutionStatus)) error {
+	key := types.NamespacedName{Namespace: task.Namespace, Name: task.Name}
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		latest := &corev1alpha1.Task{}
+		if err := d.Client.Get(ctx, key, latest); err != nil {
+			return err
+		}
+		base := latest.DeepCopy()
+		if latest.Status.Execution == nil {
+			latest.Status.Execution = &corev1alpha1.TaskExecutionStatus{}
+		}
+		mutate(latest.Status.Execution)
+		switch latest.Status.Execution.State {
+		case corev1alpha1.TaskExecutionStateAccepted, corev1alpha1.TaskExecutionStateRunning, corev1alpha1.TaskExecutionStateSettling:
+			if latest.Status.Phase == corev1alpha1.TaskPhasePending || latest.Status.Phase == "" {
+				latest.Status.Phase = corev1alpha1.TaskPhaseRunning
+				if latest.Status.StartTime == nil {
+					now := metav1.Now()
+					latest.Status.StartTime = &now
+				}
+			}
+		}
+		if err := d.Client.Status().Patch(ctx, latest, client.MergeFrom(base)); err != nil {
+			return err
+		}
+		task.Status = latest.Status
+		return nil
+	})
+}
+
+func (d *ACPDispatcher) saveTaskResult(ctx context.Context, task *corev1alpha1.Task, result []byte) error {
+	if err := d.ResultStore.SaveResult(ctx, task.Namespace, task.Name, result); err != nil {
+		return err
+	}
+	key := types.NamespacedName{Namespace: task.Namespace, Name: task.Name}
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		latest := &corev1alpha1.Task{}
+		if err := d.Client.Get(ctx, key, latest); err != nil {
+			return err
+		}
+		base := latest.DeepCopy()
+		latest.Status.ResultRef = &corev1alpha1.ResultReference{Available: true}
+		if err := d.Client.Status().Patch(ctx, latest, client.MergeFrom(base)); err != nil {
+			return err
+		}
+		task.Status = latest.Status
+		return nil
+	})
+}
+
+func (d *ACPDispatcher) renewPromptLeaseLoop(
+	ctx context.Context,
+	cancelRuntime context.CancelFunc,
+	runtimeClient *harnessv2.Client,
+	sessionID harnessv2.RuntimeSessionID,
+	task *corev1alpha1.Task,
+	fence harnessv2.Fence,
+	lease harnessv2.PromptLease,
+	authorization harnessv2.PromptMCPAuthorization,
+) {
+	for {
+		wait := max(time.Until(lease.ExpiresAt)/2, 5*time.Second)
+		timer := time.NewTimer(wait)
+		select {
+		case <-ctx.Done():
+			timer.Stop()
+			return
+		case <-timer.C:
+		}
+		now := time.Now().UTC()
+		proposed := harnessv2.PromptLease{Generation: lease.Generation + 1, IssuedAt: now, ExpiresAt: now.Add(90 * time.Second)}
+		metadata := mutationMetadata(
+			fence, task, "renew-lease-"+strconv.FormatUint(proposed.Generation, 10), true, now.Add(30*time.Second),
+		)
+		authorization.LeaseGeneration = proposed.Generation
+		authorization.ExpiresAt = proposed.ExpiresAt
+		if maximum := now.Add(60 * time.Second); authorization.ExpiresAt.After(maximum) {
+			authorization.ExpiresAt = maximum
+		}
+		authorization.RuntimeSessionUID = metadata.Fence.RuntimeSessionUID
+		authorization.SessionGeneration = metadata.Fence.RuntimeSessionGeneration
+		authorization.TaskUID = metadata.TaskUID
+		authorization.TaskAttempt = metadata.TaskAttempt
+		authorization.PromptID = metadata.PromptID
+		request := harnessv2.RenewPromptLeaseRequest{
+			Protocol: harnessv2.ProtocolVersion, Metadata: metadata,
+			ExpectedLeaseGeneration: lease.Generation, Lease: proposed, MCPAuthorization: authorization,
+		}
+		if err := sealMutation(&request.Metadata.RequestDigest, request); err != nil {
+			cancelRuntime()
+			return
+		}
+		response, err := runtimeClient.RenewPromptLease(ctx, sessionID, request)
+		if err != nil || response.Lease.Generation != proposed.Generation {
+			cancelRuntime()
+			return
+		}
+		lease = response.Lease
+	}
+}
+
+func (d *ACPDispatcher) resolvePromptPermission(ctx context.Context, runtimeClient *harnessv2.Client, sessionID harnessv2.RuntimeSessionID, task *corev1alpha1.Task, fence harnessv2.Fence, event harnessv2.Event) error {
+	permission := event.PermissionRequested
+	if permission == nil {
+		return nil
+	}
+	decision := harnessv2.PermissionDecision{Outcome: harnessv2.PermissionDecisionCancelled}
+	for _, option := range permission.Options {
+		if option.Kind == harnessv2.PermissionOptionRejectOnce {
+			decision = harnessv2.PermissionDecision{Outcome: harnessv2.PermissionDecisionSelected, OptionID: option.OptionID}
+			break
+		}
+	}
+	request := harnessv2.ResolvePermissionRequest{
+		Protocol:  harnessv2.ProtocolVersion,
+		Metadata:  mutationMetadata(fence, task, "permission-"+string(permission.RequestID), true, time.Now().UTC().Add(30*time.Second)),
+		RequestID: permission.RequestID, Decision: decision,
+	}
+	if err := sealMutation(&request.Metadata.RequestDigest, request); err != nil {
+		return err
+	}
+	_, err := runtimeClient.ResolvePermission(ctx, sessionID, request)
+	return err
+}
+
+func isACPRateLimitedClientError(err error) bool {
+	var clientErr *harnessv2.ClientError
+	return errors.As(err, &clientErr) && clientErr.StatusCode == 429 &&
+		clientErr.Code == harnessv2.ErrorCodeRateLimited && clientErr.Retryable
+}
+
+func (d *ACPDispatcher) requeuePreSubmissionTask(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attemptID string,
+	fence store.ControllerEpochFence,
+	cause error,
+) error {
+	return d.requeuePreSubmissionTaskWithRuntimeBinding(ctx, task, attemptID, fence, cause, nil)
+}
+
+func (d *ACPDispatcher) requeuePreSubmissionTaskWithRuntimeBinding(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attemptID string,
+	fence store.ControllerEpochFence,
+	cause error,
+	runtimeBinding *ACPRuntimeSessionBinding,
+) error {
+	attempt, err := d.Store.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		return err
+	}
+	switch attempt.ExecutionState {
+	case store.PromptExecutionReserved:
+	case store.PromptExecutionSessionStarting, store.PromptExecutionPlanned:
+		digest, err := acpDomainDigest("pre-admission-reconciliation", map[string]any{
+			"attemptID": attempt.ID, "state": attempt.ExecutionState, "version": attempt.Version, "epoch": fence.Epoch,
+		})
+		if err != nil {
+			return err
+		}
+		if _, err := d.Store.RecoverPromptAttemptPreSubmission(ctx, store.PromptAttemptPreSubmissionRecovery{
+			ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+			OperationID: "reconcile-pre-admission-" + strconv.FormatInt(attempt.Version, 10), OperationDigest: digest,
+			RecoveredAt: time.Now().UTC(),
+		}); err != nil {
+			return err
+		}
+	default:
+		return fmt.Errorf("prompt attempt %s cannot reconcile pre-admission state %s: %w", attemptID, attempt.ExecutionState, cause)
+	}
+	return d.patchExecution(ctx, task, func(status *corev1alpha1.TaskExecutionStatus) {
+		status.State = corev1alpha1.TaskExecutionStateReserved
+		status.ControllerEpoch = fence.Epoch
+		applyRuntimeSessionBindingToExecution(status, runtimeBinding)
+		status.Reason = corev1alpha1.TaskExecutionReasonAtCapacity
+		status.Message = "RuntimePool admission will be retried"
+		status.LastTransitionTime = nowMeta()
+	})
+}
+
+func applyRuntimeSessionBindingToExecution(
+	status *corev1alpha1.TaskExecutionStatus,
+	binding *ACPRuntimeSessionBinding,
+) {
+	if status == nil {
+		return
+	}
+	if binding == nil {
+		status.RuntimeInstanceID = ""
+		status.RuntimeSessionUID = ""
+		status.RuntimeSessionGeneration = 0
+		status.RuntimeSessionSupervisorBootID = ""
+		status.RuntimeSessionProfileDigest = ""
+		status.RuntimeSessionMCPDigest = ""
+		status.RuntimeSessionWorkspaceDigest = ""
+		status.RuntimeSessionRecreationPending = false
+		return
+	}
+	status.RuntimeInstanceID = string(binding.RuntimeInstanceID)
+	status.RuntimeSessionUID = binding.SessionUID
+	status.RuntimeSessionGeneration = int64(binding.Generation)
+	status.RuntimeSessionSupervisorBootID = string(binding.SupervisorBootID)
+	status.RuntimeSessionProfileDigest = string(binding.ProfileDigest)
+	status.RuntimeSessionMCPDigest = binding.MCPDigest
+	status.RuntimeSessionWorkspaceDigest = binding.WorkspaceDigest
+	status.RuntimeSessionRecreationPending = binding.RecreationRequired
+}
+
+func (d *ACPDispatcher) waitForPromptCapacityReservation(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	target acpDispatchTarget,
+	fence store.ControllerEpochFence,
+	expectedInstance harnessv2.RuntimeInstanceID,
+) (*acpRuntimePoolReservationLease, error) {
+	for {
+		timer := time.NewTimer(d.effectiveRateLimitRetryInterval())
+		select {
+		case <-ctx.Done():
+			timer.Stop()
+			return nil, ctx.Err()
+		case <-timer.C:
+		}
+		if target.pool == nil {
+			return nil, nil
+		}
+		pool, identity, err := d.claimRuntimePoolReservation(ctx, task, target.pool.Name, fence, 0)
+		if err != nil {
+			if errors.Is(err, errACPRuntimePoolAtCapacity) || errors.Is(err, errACPRuntimePoolNotAdmitting) {
+				continue
+			}
+			return nil, err
+		}
+		if pool.Status.ActiveInstance == nil || pool.Status.ActiveInstance.RuntimeInstanceID != string(expectedInstance) {
+			releaseCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
+			releaseErr := d.releaseRuntimePoolReservation(releaseCtx, *identity)
+			cancel()
+			if releaseErr != nil {
+				return nil, releaseErr
+			}
+			return nil, fmt.Errorf("RuntimePool exact instance changed before prompt acceptance")
+		}
+		lease := newACPRuntimePoolReservationLease(d, identity)
+		lease.startRenewal(ctx)
+		if err := d.patchExecution(ctx, task, func(status *corev1alpha1.TaskExecutionStatus) {
+			status.Reason = ""
+			status.Message = ""
+			status.LastTransitionTime = nowMeta()
+		}); err != nil {
+			releaseCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
+			_ = lease.release(releaseCtx)
+			cancel()
+			return nil, err
+		}
+		return lease, nil
+	}
+}
+
+func runtimeSessionStartFailureMessage(err error) string {
+	const fallback = "runtime session failed to start"
+	var clientErr *harnessv2.ClientError
+	if !errors.As(err, &clientErr) {
+		return fallback
+	}
+	switch clientErr.Message {
+	case "runtime session failed during identity allocation",
+		"runtime session failed during path preparation",
+		"runtime session failed during workspace materialization",
+		"runtime session failed during workspace baseline capture",
+		"runtime session failed during provider home preparation",
+		"runtime session failed during ownership finalization",
+		"runtime session failed during provider proxy setup",
+		"runtime session failed during MCP proxy setup",
+		"runtime session failed during provider environment setup",
+		"runtime session failed during provider adapter initialization":
+		return clientErr.Message
+	default:
+		return fallback
+	}
+}
+
+func boundedRuntimeSessionServerMessage(err error) string {
+	var clientErr *harnessv2.ClientError
+	if !errors.As(err, &clientErr) {
+		return "non-client runtime session error"
+	}
+	message := strings.TrimSpace(strings.Map(func(current rune) rune {
+		if current < 0x20 || current == 0x7f {
+			return ' '
+		}
+		return current
+	}, clientErr.Message))
+	if message == "" {
+		return "empty runtime error response"
+	}
+	runes := []rune(message)
+	if len(runes) > 256 {
+		message = string(runes[:256])
+	}
+	return message
+}
+
+func runtimeSessionCreationMayHaveApplied(err error) bool {
+	var clientErr *harnessv2.ClientError
+	if !errors.As(err, &clientErr) {
+		return err != nil
+	}
+	switch clientErr.Kind {
+	case harnessv2.ClientErrorConfiguration, harnessv2.ClientErrorValidation:
+		return false
+	case harnessv2.ClientErrorHTTP:
+		// A received non-retryable client rejection is authoritative: the
+		// supervisor rejected the mutation rather than ambiguously applying it.
+		if clientErr.StatusCode >= http.StatusBadRequest && clientErr.StatusCode < http.StatusInternalServerError {
+			return false
+		}
+	}
+	return !clientErr.WriteEvidence.SafeToResendSameIdentity()
+}
+
+func runtimeSessionStartDiagnostic(err error) (int, harnessv2.ErrorCode, string) {
+	var clientErr *harnessv2.ClientError
+	if !errors.As(err, &clientErr) {
+		return 0, "", "non-client runtime session error"
+	}
+	message := runtimeSessionStartFailureMessage(err)
+	if message == "runtime session failed to start" {
+		if clientErr.Message == "runtime operation failed; consult bounded supervisor diagnostics" {
+			message = clientErr.Message
+		} else {
+			message = "runtime session request rejected before classified creation"
+		}
+	}
+	return clientErr.StatusCode, clientErr.Code, message
+}
+
+func (d *ACPDispatcher) handlePrePromptClientError(ctx context.Context, task *corev1alpha1.Task, attemptID string, fence store.ControllerEpochFence, err error) error {
+	if isACPRateLimitedClientError(err) {
+		return d.requeuePreSubmissionTask(ctx, task, attemptID, fence, err)
+	}
+	status, code, diagnostic := runtimeSessionStartDiagnostic(err)
+	logf.FromContext(ctx).Info(
+		"ACP runtime session start failed",
+		"status", status,
+		"code", code,
+		"diagnostic", diagnostic,
+		"serverMessage", boundedRuntimeSessionServerMessage(err),
+	)
+	if transitionErr := d.transitionAttemptToTerminal(ctx, attemptID, fence, store.PromptExecutionFailed, "runtime-session-start-failed"); transitionErr != nil {
+		return transitionErr
+	}
+	return d.failTask(ctx, task, corev1alpha1.TaskExecutionStateFailed, corev1alpha1.TaskExecutionOutcomeFailed, "RuntimeSessionStartFailed", runtimeSessionStartFailureMessage(err))
+}
+
+func (d *ACPDispatcher) handlePromptStreamError(
+	ctx context.Context,
+	runtimeClient *harnessv2.Client,
+	sessionID harnessv2.RuntimeSessionID,
+	task *corev1alpha1.Task,
+	attemptID string,
+	fence store.ControllerEpochFence,
+	runtimeFence harnessv2.Fence,
+	accepted bool,
+	writeEvidence harnessv2.RequestWriteEvidence,
+	runtimeContextErr error,
+	err error,
+) error {
+	httpStatus, code, kind := 0, harnessv2.ErrorCode(""), harnessv2.ClientErrorKind("")
+	var streamClientErr *harnessv2.ClientError
+	if errors.As(err, &streamClientErr) {
+		httpStatus, code, kind = streamClientErr.StatusCode, streamClientErr.Code, streamClientErr.Kind
+	}
+	logf.FromContext(ctx).Info(
+		"ACP prompt stream failed",
+		"accepted", accepted,
+		"writeState", writeEvidence.State,
+		"runtimeContextDone", runtimeContextErr != nil,
+		"status", httpStatus,
+		"code", code,
+		"kind", kind,
+		"diagnostic", promptStreamDiagnostic(err),
+	)
+	if runtimeContextErr != nil {
+		if !accepted && writeEvidence.SafeToResendSameIdentity() {
+			if transitionErr := d.transitionAttemptToTerminal(ctx, attemptID, fence, store.PromptExecutionCancelled, "cancelled-before-acceptance"); transitionErr != nil {
+				return transitionErr
+			}
+			return d.failTask(ctx, task, corev1alpha1.TaskExecutionStateCancelled, corev1alpha1.TaskExecutionOutcomeCancelled, "Cancelled", "prompt cancelled before acceptance")
+		}
+		now := time.Now().UTC()
+		reason := harnessv2.CancelReasonControllerShutdown
+		if errors.Is(runtimeContextErr, context.DeadlineExceeded) {
+			reason = harnessv2.CancelReasonTaskTimeout
+		}
+		cancelRequest := harnessv2.CancelPromptRequest{
+			Protocol: harnessv2.ProtocolVersion,
+			Metadata: mutationMetadata(runtimeFence, task, "cancel-prompt", true, now.Add(30*time.Second)),
+			Reason:   reason, SettlementDeadline: now.Add(20 * time.Second),
+		}
+		if sealErr := sealMutation(&cancelRequest.Metadata.RequestDigest, cancelRequest); sealErr == nil {
+			cancelCtx, cancel := context.WithTimeout(ctx, 25*time.Second)
+			defer cancel()
+			response, cancelErr := runtimeClient.CancelPrompt(cancelCtx, sessionID, cancelRequest)
+			if cancelErr == nil && response.SettlementProven {
+				switch response.Settlement.TerminalEvent {
+				case harnessv2.EventCancelled:
+					if transitionErr := d.transitionAttemptToTerminal(ctx, attemptID, fence, store.PromptExecutionCancelled, "cancelled"); transitionErr != nil {
+						return transitionErr
+					}
+					return d.failTask(ctx, task, corev1alpha1.TaskExecutionStateCancelled, corev1alpha1.TaskExecutionOutcomeCancelled, "Cancelled", "prompt cancellation settled")
+				case harnessv2.EventFailed:
+					if transitionErr := d.transitionAttemptToTerminal(ctx, attemptID, fence, store.PromptExecutionFailed, "cancel-failed"); transitionErr != nil {
+						return transitionErr
+					}
+					return d.failTask(ctx, task, corev1alpha1.TaskExecutionStateFailed, corev1alpha1.TaskExecutionOutcomeFailed, "PromptFailed", "prompt failed during cancellation")
+				}
+			}
+		}
+		return d.markOutcomeUnknown(ctx, task, attemptID, fence, "RuntimeLost", "prompt cancellation settlement is unknown")
+	}
+	var clientErr *harnessv2.ClientError
+	if !accepted && errors.As(err, &clientErr) && clientErr.WriteEvidence.SafeToResendSameIdentity() {
+		if transitionErr := d.transitionAttemptToTerminal(ctx, attemptID, fence, store.PromptExecutionFailed, "prompt-not-accepted"); transitionErr != nil {
+			return transitionErr
+		}
+		return d.failTask(ctx, task, corev1alpha1.TaskExecutionStateFailed, corev1alpha1.TaskExecutionOutcomeFailed, "PromptNotAccepted", "prompt transport failed before any request bytes were written")
+	}
+	return d.markOutcomeUnknown(ctx, task, attemptID, fence, "RuntimeLost", "accepted prompt outcome is unknown")
+}
+
+func promptStreamDiagnostic(err error) string {
+	switch {
+	case err == nil:
+		return "no stream error"
+	case errors.Is(err, harnessv2.ErrEventLineTooLarge):
+		return "event line exceeded the negotiated limit"
+	case errors.Is(err, harnessv2.ErrMalformedEvent):
+		return "runtime emitted malformed event JSON"
+	case errors.Is(err, harnessv2.ErrEventIdentityMismatch):
+		return "runtime event identity did not match the prompt fence"
+	case errors.Is(err, harnessv2.ErrEventSequence):
+		return "runtime event sequence was invalid"
+	case errors.Is(err, harnessv2.ErrEventRateExceeded):
+		return "runtime update rate exceeded the negotiated limit"
+	case errors.Is(err, harnessv2.ErrEventByteRateExceeded):
+		return "runtime update byte rate exceeded the protocol limit"
+	case errors.Is(err, harnessv2.ErrEventAfterTerminal):
+		return "runtime emitted an event after terminal settlement"
+	case errors.Is(err, harnessv2.ErrMissingAcceptedEvent):
+		return "runtime stream omitted the accepted event"
+	case errors.Is(err, harnessv2.ErrMissingTerminalEvent):
+		return "runtime stream ended without a terminal event"
+	case errors.Is(err, harnessv2.ErrBufferedEventOverflow):
+		return "runtime buffered event limit was exceeded"
+	case errors.Is(err, harnessv2.ErrPromptStreamDisconnected):
+		return "runtime prompt stream disconnected"
+	case errors.Is(err, context.DeadlineExceeded):
+		return "prompt stream deadline exceeded"
+	case errors.Is(err, context.Canceled):
+		return "prompt stream context was cancelled"
+	case errors.Is(err, harnessv2.ErrClientProtocol):
+		return "runtime prompt response violated the protocol"
+	case errors.Is(err, harnessv2.ErrClientTransport):
+		return "runtime prompt transport failed"
+	case errors.Is(err, harnessv2.ErrClientStream):
+		return "runtime prompt stream failed"
+	default:
+		return "non-client prompt stream error"
+	}
+}
+
+func (d *ACPDispatcher) markOutcomeUnknown(ctx context.Context, task *corev1alpha1.Task, attemptID string, fence store.ControllerEpochFence, reason, message string) error {
+	if err := d.persistOutcomeUnknown(ctx, attemptID, fence, reason, message); err != nil {
+		return err
+	}
+	return d.failTask(ctx, task, corev1alpha1.TaskExecutionStateOutcomeUnknown, corev1alpha1.TaskExecutionOutcomeOutcomeUnknown, corev1alpha1.TaskExecutionReason(reason), message)
+}
+
+func (d *ACPDispatcher) persistOutcomeUnknown(ctx context.Context, attemptID string, fence store.ControllerEpochFence, reason, message string) error {
+	attempt, err := d.Store.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		return err
+	}
+	if attempt.ExecutionState == store.PromptExecutionSubmitting {
+		if err := d.transitionAttempt(ctx, attemptID, fence, store.PromptExecutionSubmitting, store.PromptExecutionSubmittedUnknown, "submitted-unknown", nil); err != nil {
+			return err
+		}
+		attempt, err = d.Store.GetPromptAttempt(ctx, attemptID)
+		if err != nil {
+			return err
+		}
+		if attempt == nil {
+			return fmt.Errorf("%w: prompt attempt %s is missing after submitted-unknown transition", store.ErrNotFound, attemptID)
+		}
+	}
+	from := attempt.ExecutionState
+	if from == store.PromptExecutionSubmittedUnknown || from == store.PromptExecutionAccepted || from == store.PromptExecutionRunning || from == store.PromptExecutionSettling {
+		attempt, err = d.Store.GetPromptAttempt(ctx, attemptID)
+		if err != nil {
+			return err
+		}
+		digest, digestErr := acpDomainDigest("attempt-transition", map[string]any{"id": attemptID, "from": from, "to": store.PromptExecutionOutcomeUnknown, "operation": "outcome-unknown", "version": attempt.Version, "marker": message})
+		if digestErr != nil {
+			return digestErr
+		}
+		if _, err := d.Store.TransitionPromptAttemptExecution(ctx, store.PromptAttemptExecutionTransition{
+			ID: attemptID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: from, NewState: store.PromptExecutionOutcomeUnknown,
+			OperationID: "outcome-unknown-" + strconv.FormatInt(attempt.Version, 10), OperationDigest: digest,
+			TerminalReason: reason, OutcomeMarker: message, UpdatedAt: time.Now().UTC(),
+		}); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (d *ACPDispatcher) finishNonSuccess(ctx context.Context, task *corev1alpha1.Task, attemptID string, fence store.ControllerEpochFence, session *acpTaskSession, terminal harnessv2.Event) error {
+	switch terminal.Type {
+	case harnessv2.EventCancelled:
+		if err := d.transitionAttemptToTerminal(ctx, attemptID, fence, store.PromptExecutionCancelled, "cancelled"); err != nil {
+			return err
+		}
+		execution := corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateCancelled, Outcome: corev1alpha1.TaskExecutionOutcomeCancelled,
+			Attempt: task.Status.Execution.Attempt, PromptID: task.Status.Execution.PromptID,
+			Reason: "Cancelled", Message: "prompt cancelled",
+		}
+		if err := d.finalizeTaskSessionMarker(ctx, task, fence, session, "Cancelled", "prompt cancelled", corev1alpha1.TaskPhaseCancelled, execution); err != nil {
+			return err
+		}
+		return d.failTask(ctx, task, corev1alpha1.TaskExecutionStateCancelled, corev1alpha1.TaskExecutionOutcomeCancelled, "Cancelled", "prompt cancelled")
+	case harnessv2.EventOutcomeUnknown:
+		if err := d.persistOutcomeUnknown(ctx, attemptID, fence, "RuntimeLost", "prompt outcome is unknown"); err != nil {
+			return err
+		}
+		if err := d.finalizeTaskSessionUnknown(ctx, task, fence, session, "prompt outcome is unknown"); err != nil {
+			return err
+		}
+		return d.failTask(ctx, task, corev1alpha1.TaskExecutionStateOutcomeUnknown, corev1alpha1.TaskExecutionOutcomeOutcomeUnknown, "RuntimeLost", "prompt outcome is unknown")
+	default:
+		if err := d.transitionAttemptToTerminal(ctx, attemptID, fence, store.PromptExecutionFailed, "failed"); err != nil {
+			return err
+		}
+		execution := corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateFailed, Outcome: corev1alpha1.TaskExecutionOutcomeFailed,
+			Attempt: task.Status.Execution.Attempt, PromptID: task.Status.Execution.PromptID,
+			Reason: "PromptFailed", Message: "prompt failed",
+		}
+		if err := d.finalizeTaskSessionMarker(ctx, task, fence, session, "Failed", "prompt failed", corev1alpha1.TaskPhaseFailed, execution); err != nil {
+			return err
+		}
+		return d.failTask(ctx, task, corev1alpha1.TaskExecutionStateFailed, corev1alpha1.TaskExecutionOutcomeFailed, "PromptFailed", "prompt failed")
+	}
+}
+
+func (d *ACPDispatcher) transitionAttemptToTerminal(ctx context.Context, id string, fence store.ControllerEpochFence, target store.PromptExecutionState, operation string) error {
+	attempt, err := d.Store.GetPromptAttempt(ctx, id)
+	if err != nil {
+		return err
+	}
+	if attempt.ExecutionState == target {
+		return nil
+	}
+	if err := store.ValidatePromptExecutionTransition(attempt.ExecutionState, target); err != nil {
+		return err
+	}
+	return d.transitionAttempt(ctx, id, fence, attempt.ExecutionState, target, operation, nil)
+}
+
+func (d *ACPDispatcher) failTask(ctx context.Context, task *corev1alpha1.Task, state corev1alpha1.TaskExecutionState, outcome corev1alpha1.TaskExecutionOutcome, reason corev1alpha1.TaskExecutionReason, message string) error {
+	return d.failTaskWithProjection(ctx, task, state, outcome, reason, message, false)
+}
+
+func (d *ACPDispatcher) failTaskBeforeSessionBinding(ctx context.Context, task *corev1alpha1.Task, state corev1alpha1.TaskExecutionState, outcome corev1alpha1.TaskExecutionOutcome, reason corev1alpha1.TaskExecutionReason, message string) error {
+	return d.failTaskWithProjection(ctx, task, state, outcome, reason, message, true)
+}
+
+func (d *ACPDispatcher) failTaskWithProjection(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	state corev1alpha1.TaskExecutionState,
+	outcome corev1alpha1.TaskExecutionOutcome,
+	reason corev1alpha1.TaskExecutionReason,
+	message string,
+	allowSessionRef bool,
+) error {
+	phase := corev1alpha1.TaskPhaseFailed
+	if state == corev1alpha1.TaskExecutionStateCancelled {
+		phase = corev1alpha1.TaskPhaseCancelled
+	}
+	// Build the projection from a deep copy of the frozen execution identity
+	// and overlay only the terminal classification: reclamation validates the
+	// payload against the Task's complete runtime identity, so a hand-picked
+	// field subset would leave the source PromptAttempt impossible to retire.
+	execution := terminalProjectionExecution(task, state, outcome, reason, message)
+	payload := taskTerminalProjection{
+		Namespace: task.Namespace, Task: task.Name, TaskUID: string(task.UID), Attempt: execution.Attempt,
+		Phase: phase, Message: message, Execution: execution, Delivery: task.Status.Delivery,
+	}
+	var projectionErr error
+	if allowSessionRef {
+		projectionErr = d.enqueueUnboundSessionTaskProjection(ctx, task, payload)
+	} else {
+		projectionErr = d.enqueueStandaloneTaskProjection(ctx, task, payload)
+	}
+	if projectionErr != nil {
+		return projectionErr
+	}
+	key := types.NamespacedName{Namespace: task.Namespace, Name: task.Name}
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		latest := &corev1alpha1.Task{}
+		if err := d.Client.Get(ctx, key, latest); err != nil {
+			return client.IgnoreNotFound(err)
+		}
+		base := latest.DeepCopy()
+		now := metav1.Now()
+		if latest.Status.Execution == nil {
+			latest.Status.Execution = &corev1alpha1.TaskExecutionStatus{}
+		}
+		latest.Status.Execution.State = state
+		latest.Status.Execution.Outcome = outcome
+		latest.Status.Execution.Reason = reason
+		latest.Status.Execution.Message = message
+		latest.Status.Execution.LastTransitionTime = &now
+		latest.Status.Phase = phase
+		return d.Client.Status().Patch(ctx, latest, client.MergeFrom(base))
+	})
+}
+
+func (d *ACPDispatcher) requeueReservedTask(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	stage acpReservedRetryStage,
+	cause error,
+) error {
+	_ = cause
+	// Reservation remains durable and is retried by this dispatcher. Surface the
+	// bounded stage without changing the execution state or consuming a Task
+	// retry. The underlying error is deliberately excluded because runtime and
+	// credential errors are not a safe status surface.
+	return d.patchExecution(ctx, task, func(status *corev1alpha1.TaskExecutionStatus) {
+		status.Reason = corev1alpha1.TaskExecutionReasonAtCapacity
+		status.Message = fmt.Sprintf("RuntimePool admission will be retried (stage: %s)", stage)
+	})
+}
+
+func nowMeta() *metav1.Time {
+	now := metav1.Now()
+	return &now
+}
diff --git a/internal/controller/acp_dispatcher_prompt_attempt_settlement_test.go b/internal/controller/acp_dispatcher_prompt_attempt_settlement_test.go
new file mode 100644
index 000000000..e3ef97266
--- /dev/null
+++ b/internal/controller/acp_dispatcher_prompt_attempt_settlement_test.go
@@ -0,0 +1,586 @@
+package controller
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/store"
+	"github.com/orka-agents/orka/internal/store/sqlite"
+	"github.com/orka-agents/orka/internal/taskterminal"
+)
+
+type postTransitionPromptAttemptReadStore struct {
+	store.DurableControlStore
+	postReadErr      error
+	returnNilRead    bool
+	transitioned     bool
+	postReadInjected bool
+}
+
+func (s *postTransitionPromptAttemptReadStore) GetPromptAttempt(ctx context.Context, id string) (*store.PromptAttempt, error) {
+	if s.transitioned && !s.postReadInjected {
+		s.postReadInjected = true
+		if s.returnNilRead {
+			return nil, nil
+		}
+		return nil, s.postReadErr
+	}
+	return s.DurableControlStore.GetPromptAttempt(ctx, id)
+}
+
+func (s *postTransitionPromptAttemptReadStore) TransitionPromptAttemptExecution(
+	ctx context.Context,
+	transition store.PromptAttemptExecutionTransition,
+) (*store.PromptAttempt, error) {
+	attempt, err := s.DurableControlStore.TransitionPromptAttemptExecution(ctx, transition)
+	if err == nil && transition.NewState == store.PromptExecutionSubmittedUnknown {
+		s.transitioned = true
+	}
+	return attempt, err
+}
+
+func TestPersistOutcomeUnknownHandlesPostTransitionAttemptReadFailure(t *testing.T) {
+	for _, test := range []struct {
+		name          string
+		postReadErr   error
+		returnNilRead bool
+		wantErr       error
+	}{
+		{
+			name:        "read error",
+			postReadErr: errors.New("simulated post-transition PromptAttempt read failure"),
+		},
+		{
+			name:          "nil attempt",
+			returnNilRead: true,
+			wantErr:       store.ErrNotFound,
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			defer cancel()
+
+			db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "prompt-attempt-read.db"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer db.Close() //nolint:errcheck
+
+			baseStore := sqlite.NewStore(db, "test")
+			epochs, stopEpoch := startACPRecoveryEpochManager(t, ctx, baseStore, "prompt-attempt-post-transition-read")
+			defer stopEpoch()
+			fence, err := epochs.CurrentFence(ctx)
+			if err != nil {
+				t.Fatal(err)
+			}
+			attempt := createPromptAttemptInStateForSettlementTest(t, ctx, baseStore, fence, store.PromptExecutionSubmitting)
+			failingStore := &postTransitionPromptAttemptReadStore{
+				DurableControlStore: baseStore,
+				postReadErr:         test.postReadErr,
+				returnNilRead:       test.returnNilRead,
+			}
+			dispatcher := &ACPDispatcher{Store: failingStore}
+
+			err = dispatcher.persistOutcomeUnknown(ctx, attempt.ID, fence, "RuntimeLost", "prompt outcome is unknown")
+			if test.wantErr != nil {
+				if !errors.Is(err, test.wantErr) {
+					t.Fatalf("persistOutcomeUnknown() error = %v, want %v", err, test.wantErr)
+				}
+			} else if !errors.Is(err, test.postReadErr) {
+				t.Fatalf("persistOutcomeUnknown() error = %v, want %v", err, test.postReadErr)
+			}
+			if !failingStore.postReadInjected {
+				t.Fatal("post-transition GetPromptAttempt failure was not injected")
+			}
+		})
+	}
+}
+
+type failingTerminalAttemptTransitionStore struct {
+	store.DurableControlStore
+	transitionState store.PromptExecutionState
+	transitionErr   error
+	enqueueCalls    int
+}
+
+func (s *failingTerminalAttemptTransitionStore) TransitionPromptAttemptExecution(
+	ctx context.Context,
+	transition store.PromptAttemptExecutionTransition,
+) (*store.PromptAttempt, error) {
+	if transition.NewState == s.transitionState {
+		return nil, s.transitionErr
+	}
+	return s.DurableControlStore.TransitionPromptAttemptExecution(ctx, transition)
+}
+
+func (s *failingTerminalAttemptTransitionStore) EnqueueOutboxProjection(
+	ctx context.Context,
+	projection *store.OutboxProjection,
+	fence store.ControllerEpochFence,
+) (*store.OutboxProjection, error) {
+	s.enqueueCalls++
+	return s.DurableControlStore.EnqueueOutboxProjection(ctx, projection, fence)
+}
+
+func TestFinishNonSuccessStopsStandaloneProjectionWhenAttemptTerminalTransitionFails(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "terminal-transition-failure.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+
+	baseStore := sqlite.NewStore(db, "test")
+	epochs, stopEpoch := startACPRecoveryEpochManager(t, ctx, baseStore, "terminal-transition-failure")
+	defer stopEpoch()
+	fence, err := epochs.CurrentFence(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	taskUID := types.UID("93939393-9393-9393-9393-939393939393")
+	promptID := "prompt-" + string(taskUID) + "-1"
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "terminal-transition-failure", UID: taskUID},
+		Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Prompt: "fail after durable settlement"},
+		Status: corev1alpha1.TaskStatus{
+			Phase:    corev1alpha1.TaskPhaseRunning,
+			Attempts: 1,
+			Execution: &corev1alpha1.TaskExecutionStatus{
+				State:           corev1alpha1.TaskExecutionStateRunning,
+				Attempt:         1,
+				PromptID:        promptID,
+				RequestDigest:   testControlDigestForDispatcher("terminal-transition-failure"),
+				ControllerEpoch: fence.Epoch,
+			},
+		},
+	}
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}).WithObjects(task).Build()
+	attempt := createPromptAttemptInStateForSettlementTest(t, ctx, baseStore, fence, store.PromptExecutionRunning)
+	if attempt.Key.TaskUID != string(taskUID) || attempt.Key.PromptID != promptID {
+		t.Fatalf("test attempt identity = %#v, want Task %s PromptID %s", attempt.Key, taskUID, promptID)
+	}
+
+	transitionErr := errors.New("simulated durable terminal transition failure")
+	failingStore := &failingTerminalAttemptTransitionStore{
+		DurableControlStore: baseStore,
+		transitionState:     store.PromptExecutionFailed,
+		transitionErr:       transitionErr,
+	}
+	dispatcher := &ACPDispatcher{Client: kubeClient, Store: failingStore, Epochs: epochs}
+
+	err = dispatcher.finishNonSuccess(
+		ctx,
+		task.DeepCopy(),
+		attempt.ID,
+		fence,
+		nil,
+		harnessv2.Event{Protocol: harnessv2.ProtocolVersion, Type: harnessv2.EventFailed},
+	)
+	if !errors.Is(err, transitionErr) {
+		t.Errorf("finishNonSuccess() error = %v, want %v", err, transitionErr)
+	}
+	if failingStore.enqueueCalls != 0 {
+		t.Errorf("terminal Task projection enqueue calls = %d, want 0", failingStore.enqueueCalls)
+	}
+
+	persistedTask := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(task), persistedTask); err != nil {
+		t.Fatal(err)
+	}
+	if persistedTask.Status.Phase != corev1alpha1.TaskPhaseRunning || persistedTask.Status.Execution == nil ||
+		persistedTask.Status.Execution.State != corev1alpha1.TaskExecutionStateRunning {
+		t.Errorf("Task was projected terminal after durable transition failure: %#v", persistedTask.Status)
+	}
+	persistedAttempt, err := baseStore.GetPromptAttempt(ctx, attempt.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if persistedAttempt.ExecutionState != store.PromptExecutionRunning {
+		t.Errorf("PromptAttempt state = %s, want %s", persistedAttempt.ExecutionState, store.PromptExecutionRunning)
+	}
+}
+
+type successfulSessionFinalizationStore struct {
+	store.SessionControlStore
+	finalizeCalls int
+	control       store.SessionControl
+	turn          store.SessionTurn
+}
+
+func (s *successfulSessionFinalizationStore) FinalizeSessionTurn(
+	_ context.Context,
+	_ store.FinalizeSessionTurnRequest,
+) (*store.SessionTurn, error) {
+	s.finalizeCalls++
+	turn := s.turn
+	turn.State = store.SessionTurnFinalized
+	return &turn, nil
+}
+
+func (s *successfulSessionFinalizationStore) GetSessionControl(
+	_ context.Context,
+	_, _ string,
+) (*store.SessionControl, error) {
+	control := s.control
+	return &control, nil
+}
+
+func TestFinishNonSuccessStopsCancellationFinalizationWhenAttemptTerminalTransitionFails(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "cancel-transition-failure.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+
+	baseStore := sqlite.NewStore(db, "test")
+	epochs, stopEpoch := startACPRecoveryEpochManager(t, ctx, baseStore, "cancel-transition-failure")
+	defer stopEpoch()
+	fence, err := epochs.CurrentFence(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	taskUID := types.UID("93939393-9393-9393-9393-939393939393")
+	promptID := "prompt-" + string(taskUID) + "-1"
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "cancel-transition-failure", UID: taskUID},
+		Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Prompt: "cancel after durable settlement"},
+		Status: corev1alpha1.TaskStatus{
+			Phase:    corev1alpha1.TaskPhaseRunning,
+			Attempts: 1,
+			Execution: &corev1alpha1.TaskExecutionStatus{
+				State:           corev1alpha1.TaskExecutionStateRunning,
+				Attempt:         1,
+				PromptID:        promptID,
+				RequestDigest:   testControlDigestForDispatcher("cancel-transition-failure"),
+				ControllerEpoch: fence.Epoch,
+			},
+		},
+	}
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}).WithObjects(task).Build()
+	attempt := createPromptAttemptInStateForSettlementTest(t, ctx, baseStore, fence, store.PromptExecutionRunning)
+	if attempt.Key.TaskUID != string(taskUID) || attempt.Key.PromptID != promptID {
+		t.Fatalf("test attempt identity = %#v, want Task %s PromptID %s", attempt.Key, taskUID, promptID)
+	}
+
+	transitionErr := errors.New("simulated durable cancellation transition failure")
+	failingStore := &failingTerminalAttemptTransitionStore{
+		DurableControlStore: baseStore,
+		transitionState:     store.PromptExecutionCancelled,
+		transitionErr:       transitionErr,
+	}
+	session, finalizationStore := newOpenTaskSessionForSettlementTest(t, task, attempt)
+	dispatcher := &ACPDispatcher{
+		Client:   kubeClient,
+		Store:    failingStore,
+		Epochs:   epochs,
+		Sessions: &ACPSessionContinuity{controls: finalizationStore},
+	}
+
+	err = dispatcher.finishNonSuccess(
+		ctx,
+		task.DeepCopy(),
+		attempt.ID,
+		fence,
+		session,
+		harnessv2.Event{Protocol: harnessv2.ProtocolVersion, Type: harnessv2.EventCancelled},
+	)
+	if !errors.Is(err, transitionErr) {
+		t.Errorf("finishNonSuccess() error = %v, want %v", err, transitionErr)
+	}
+	if finalizationStore.finalizeCalls != 0 {
+		t.Errorf("session finalization calls = %d, want 0", finalizationStore.finalizeCalls)
+	}
+	if session.finalized {
+		t.Error("session was marked finalized after durable cancellation transition failure")
+	}
+	if failingStore.enqueueCalls != 0 {
+		t.Errorf("terminal Task projection enqueue calls = %d, want 0", failingStore.enqueueCalls)
+	}
+
+	persistedTask := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(task), persistedTask); err != nil {
+		t.Fatal(err)
+	}
+	if persistedTask.Status.Phase != corev1alpha1.TaskPhaseRunning || persistedTask.Status.Execution == nil ||
+		persistedTask.Status.Execution.State != corev1alpha1.TaskExecutionStateRunning {
+		t.Errorf("Task was projected terminal after durable cancellation transition failure: %#v", persistedTask.Status)
+	}
+	persistedAttempt, err := baseStore.GetPromptAttempt(ctx, attempt.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if persistedAttempt.ExecutionState != store.PromptExecutionRunning {
+		t.Errorf("PromptAttempt state = %s, want %s", persistedAttempt.ExecutionState, store.PromptExecutionRunning)
+	}
+}
+
+func newOpenTaskSessionForSettlementTest(
+	t *testing.T,
+	task *corev1alpha1.Task,
+	attempt *store.PromptAttempt,
+) (*acpTaskSession, *successfulSessionFinalizationStore) {
+	t.Helper()
+
+	key := store.SessionTurnKey{
+		SessionUID:      "acp-session-settlement",
+		LeaseGeneration: 1,
+		TaskUID:         string(task.UID),
+		Attempt:         int64(task.Status.Execution.Attempt),
+		PromptID:        task.Status.Execution.PromptID,
+	}
+	turnID, err := key.CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	control := store.SessionControl{
+		Namespace:       task.Namespace,
+		SessionName:     "settlement-session",
+		SessionUID:      key.SessionUID,
+		Availability:    store.SessionAvailable,
+		LeaseGeneration: key.LeaseGeneration,
+		Lease: &store.SessionMutationLease{
+			Generation:    key.LeaseGeneration,
+			TaskUID:       key.TaskUID,
+			Attempt:       key.Attempt,
+			PromptID:      key.PromptID,
+			RequestDigest: testControlDigestForDispatcher("settlement-session-lease"),
+		},
+		Version: 1,
+	}
+	turn := store.SessionTurn{
+		ID:              turnID,
+		Key:             key,
+		PromptAttemptID: attempt.ID,
+		RequestDigest:   testControlDigestForDispatcher("settlement-session-turn"),
+		UserPrompt:      task.Spec.Prompt,
+		State:           store.SessionTurnOpen,
+		Version:         1,
+	}
+	finalizationStore := &successfulSessionFinalizationStore{control: control, turn: turn}
+	session := &acpTaskSession{
+		Turn: &ACPSessionTurn{
+			Lease: ACPSessionLease{Session: control, Key: key},
+			Turn:  turn,
+		},
+	}
+	return session, finalizationStore
+}
+
+func createPromptAttemptInStateForSettlementTest(
+	t *testing.T,
+	ctx context.Context,
+	controlStore store.DurableControlStore,
+	fence store.ControllerEpochFence,
+	target store.PromptExecutionState,
+) *store.PromptAttempt {
+	t.Helper()
+
+	const taskUID = "93939393-9393-9393-9393-939393939393"
+	key := store.PromptAttemptKey{
+		Namespace: "default",
+		TaskUID:   taskUID,
+		Attempt:   1,
+		PromptID:  "prompt-" + taskUID + "-1",
+	}
+	attempt, err := controlStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{
+		Key:           key,
+		RequestDigest: testControlDigestForDispatcher("prompt-attempt-settlement"),
+	}), fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if target == attempt.ExecutionState {
+		return attempt
+	}
+
+	path := []store.PromptExecutionState{
+		store.PromptExecutionReserved,
+		store.PromptExecutionSessionStarting,
+		store.PromptExecutionPlanned,
+		store.PromptExecutionSubmitting,
+		store.PromptExecutionAccepted,
+		store.PromptExecutionRunning,
+	}
+	for _, next := range path {
+		operation := "prompt-attempt-settlement-" + strings.ToLower(string(next))
+		attempt, err = controlStore.TransitionPromptAttemptExecution(ctx, store.PromptAttemptExecutionTransition{
+			ID:              attempt.ID,
+			Fence:           fence,
+			ExpectedVersion: attempt.Version,
+			ExpectedState:   attempt.ExecutionState,
+			NewState:        next,
+			OperationID:     operation,
+			OperationDigest: testControlDigestForDispatcher(operation),
+			UpdatedAt:       time.Now().UTC(),
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if next == target {
+			return attempt
+		}
+	}
+	t.Fatalf("unsupported target PromptAttempt state %s", target)
+	return nil
+}
+
+// TestTerminalProjectionExecutionRoundTripsReclamationValidation proves the
+// standalone failure, delivery-failure, and post-execution-cancellation
+// projection constructors preserve the complete frozen execution identity:
+// each classification is built through terminalProjectionExecution and must
+// round-trip taskterminal.ValidateRestoredProjection against the Task it was
+// built from, exactly as Kubernetes composite-store reclamation revalidates
+// it before retiring the source PromptAttempt.
+func TestTerminalProjectionExecutionRoundTripsReclamationValidation(t *testing.T) {
+	transition := metav1.NewTime(time.Date(2026, 8, 12, 9, 30, 0, 0, time.UTC))
+	frozen := &corev1alpha1.TaskExecutionStatus{
+		State: corev1alpha1.TaskExecutionStateRunning, Attempt: 1, PromptID: "prompt-standalone-terminal",
+		RuntimePoolName: "codex-pool", RuntimePoolUID: "pool-uid", AgentRuntimeName: "codex", AgentRuntimeUID: "agent-uid",
+		RuntimeInstanceID: "runtime-instance", RuntimeSessionUID: "runtime-session-uid", RuntimeSessionGeneration: 3,
+		RuntimeSessionSupervisorBootID: "boot-id",
+		RuntimeSessionProfileDigest:    acpSessionTestDigest("profile"),
+		RuntimeSessionMCPDigest:        acpSessionTestDigest("mcp"),
+		RuntimeSessionWorkspaceDigest:  acpSessionTestDigest("workspace"),
+		RequestDigest:                  acpSessionTestDigest("request"),
+		ControllerEpoch:                7, Message: "running", LastTransitionTime: &transition,
+	}
+	tests := []struct {
+		name           string
+		state          corev1alpha1.TaskExecutionState
+		outcome        corev1alpha1.TaskExecutionOutcome
+		reason         corev1alpha1.TaskExecutionReason
+		message        string
+		phase          corev1alpha1.TaskPhase
+		executionState store.PromptExecutionState
+		deliveryState  store.PromptDeliveryState
+		delivery       corev1alpha1.TaskDeliveryStatus
+	}{
+		{
+			// failTaskWithProjection: sessionless prompt failure after RuntimeSession binding.
+			name: "prompt failure", state: corev1alpha1.TaskExecutionStateFailed,
+			outcome: corev1alpha1.TaskExecutionOutcomeFailed, reason: "PromptFailed", message: "prompt failed",
+			phase: corev1alpha1.TaskPhaseFailed, executionState: store.PromptExecutionFailed,
+			deliveryState: store.PromptDeliveryNotRequested,
+			delivery: corev1alpha1.TaskDeliveryStatus{
+				State: corev1alpha1.TaskDeliveryStateNotRequested, Outcome: corev1alpha1.TaskDeliveryOutcomeNotRequested,
+			},
+		},
+		{
+			// failTaskWithProjection: sessionless prompt cancellation after RuntimeSession binding.
+			name: "prompt cancellation", state: corev1alpha1.TaskExecutionStateCancelled,
+			outcome: corev1alpha1.TaskExecutionOutcomeCancelled, reason: "Cancelled", message: "prompt cancelled",
+			phase: corev1alpha1.TaskPhaseCancelled, executionState: store.PromptExecutionCancelled,
+			deliveryState: store.PromptDeliveryNotRequested,
+			delivery: corev1alpha1.TaskDeliveryStatus{
+				State: corev1alpha1.TaskDeliveryStateNotRequested, Outcome: corev1alpha1.TaskDeliveryOutcomeNotRequested,
+			},
+		},
+		{
+			// failTaskForDelivery: execution succeeded, publication failed.
+			name: "delivery failure", state: corev1alpha1.TaskExecutionStateSucceeded,
+			outcome: corev1alpha1.TaskExecutionOutcomeSucceeded, reason: "", message: "",
+			phase: corev1alpha1.TaskPhaseFailed, executionState: store.PromptExecutionSucceeded,
+			deliveryState: store.PromptDeliveryConflict,
+			delivery: corev1alpha1.TaskDeliveryStatus{
+				State: corev1alpha1.TaskDeliveryStateDeliveryConflict, Outcome: corev1alpha1.TaskDeliveryOutcomeDeliveryConflict,
+			},
+		},
+		{
+			// cancelTaskAfterExecution: execution succeeded, publication cancelled before push.
+			name: "post-execution cancellation", state: corev1alpha1.TaskExecutionStateSucceeded,
+			outcome: corev1alpha1.TaskExecutionOutcomeSucceeded, reason: "", message: "",
+			phase: corev1alpha1.TaskPhaseCancelled, executionState: store.PromptExecutionSucceeded,
+			deliveryState: store.PromptDeliveryCancelledBeforePublish,
+			delivery: corev1alpha1.TaskDeliveryStatus{
+				State:   corev1alpha1.TaskDeliveryStateCancelledBeforePublish,
+				Outcome: corev1alpha1.TaskDeliveryOutcomeCancelledBeforePublish,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			delivery := tt.delivery
+			task := &corev1alpha1.Task{
+				ObjectMeta: metav1.ObjectMeta{Namespace: "orka-system", Name: "standalone-terminal", UID: types.UID("task-standalone-terminal")},
+				Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent},
+				Status: corev1alpha1.TaskStatus{
+					Phase: tt.phase, Execution: frozen.DeepCopy(), Delivery: &delivery,
+				},
+			}
+			execution := terminalProjectionExecution(task, tt.state, tt.outcome, tt.reason, tt.message)
+			expected := *frozen.DeepCopy()
+			expected.State = tt.state
+			expected.Outcome = tt.outcome
+			expected.Reason = tt.reason
+			expected.Message = tt.message
+			expected.LastTransitionTime = nil
+			if !reflect.DeepEqual(execution, expected) {
+				t.Fatalf("terminalProjectionExecution() = %#v, want %#v", execution, expected)
+			}
+			attempt := &store.PromptAttempt{
+				ID: "prompt-attempt-standalone-terminal",
+				Key: store.PromptAttemptKey{
+					Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: frozen.PromptID,
+				},
+				RequestDigest: frozen.RequestDigest, RuntimeInstanceID: frozen.RuntimeInstanceID,
+				ExecutionState: tt.executionState, DeliveryState: tt.deliveryState,
+			}
+			payload, err := json.Marshal(taskTerminalProjection{
+				Namespace: task.Namespace, Task: task.Name, TaskUID: string(task.UID), Attempt: execution.Attempt,
+				Phase: tt.phase, Message: tt.message, Execution: execution, Delivery: task.Status.Delivery,
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if _, err := taskterminal.ValidateRestoredProjection(payload, task, string(task.UID), attempt); err != nil {
+				t.Fatalf("terminal projection failed reclamation validation: %v", err)
+			}
+
+			// The pre-fix sparse payload omitted the frozen runtime identity and
+			// must keep failing closed at reclamation.
+			sparse, err := json.Marshal(taskTerminalProjection{
+				Namespace: task.Namespace, Task: task.Name, TaskUID: string(task.UID), Attempt: frozen.Attempt,
+				Phase: tt.phase, Message: tt.message, Delivery: task.Status.Delivery,
+				Execution: corev1alpha1.TaskExecutionStatus{
+					State: tt.state, Outcome: tt.outcome, Reason: tt.reason, Message: tt.message,
+					Attempt: frozen.Attempt, PromptID: frozen.PromptID,
+				},
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if _, err := taskterminal.ValidateRestoredProjection(sparse, task, string(task.UID), attempt); !errors.Is(err, store.ErrConflict) {
+				t.Fatalf("sparse terminal projection validation error = %v, want store.ErrConflict", err)
+			}
+		})
+	}
+}
diff --git a/internal/controller/acp_dispatcher_session.go b/internal/controller/acp_dispatcher_session.go
new file mode 100644
index 000000000..5e7ece16c
--- /dev/null
+++ b/internal/controller/acp_dispatcher_session.go
@@ -0,0 +1,825 @@
+package controller
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+type acpTaskSession struct {
+	Turn             *ACPSessionTurn
+	Binding          ACPRuntimeSessionBinding
+	Bootstrap        *ACPBootstrapTranscript
+	UserPrompt       string
+	VerifiedBaseline *store.VerifiedBranchBaseline
+	Reused           bool
+	LeaseGeneration  int64
+	finalized        bool
+	requeued         bool
+}
+
+const acpPreSubmissionCleanupTimeout = 30 * time.Second
+
+func promptAttemptSessionBound(attempt *store.PromptAttempt) (bool, error) {
+	if attempt == nil {
+		return false, fmt.Errorf("%w: PromptAttempt is required", store.ErrConflict)
+	}
+	sessionUID := strings.TrimSpace(attempt.SessionUID)
+	switch {
+	case sessionUID == "" && attempt.SessionLeaseGeneration == 0:
+		return false, nil
+	case sessionUID == "" || attempt.SessionLeaseGeneration < 1:
+		return false, fmt.Errorf("%w: prompt attempt %s has an incomplete SessionTurn binding", store.ErrConflict, attempt.ID)
+	default:
+		return true, nil
+	}
+}
+
+func (d *ACPDispatcher) reconcileUnfinalizedTaskSession(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	fence store.ControllerEpochFence,
+	session *acpTaskSession,
+	cause error,
+) error {
+	if session == nil || session.Turn == nil || session.finalized || session.requeued {
+		return nil
+	}
+	attemptID := session.Turn.Turn.PromptAttemptID
+	attempt, err := d.Store.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		return err
+	}
+	switch attempt.ExecutionState {
+	case store.PromptExecutionReserved, store.PromptExecutionSessionStarting, store.PromptExecutionPlanned:
+		if cause == nil {
+			cause = errors.New("ACP task left pre-submission execution without completing")
+		}
+		return d.requeuePreSubmissionTask(ctx, task, attemptID, fence, cause)
+	case store.PromptExecutionSubmitting, store.PromptExecutionSubmittedUnknown,
+		store.PromptExecutionAccepted, store.PromptExecutionRunning, store.PromptExecutionSettling:
+		if err := d.persistOutcomeUnknown(ctx, attemptID, fence, "RuntimeLost", "task exited before prompt settlement could be proven"); err != nil {
+			return err
+		}
+		attempt, err = d.Store.GetPromptAttempt(ctx, attemptID)
+		if err != nil {
+			return err
+		}
+	case store.PromptExecutionSucceeded:
+		if !store.IsTerminalPromptDeliveryState(attempt.DeliveryState) {
+			// Publication recovery owns the still-open SessionTurn and lease until
+			// delivery reaches a durable terminal receipt.
+			return nil
+		}
+	case store.PromptExecutionFailed, store.PromptExecutionCancelled, store.PromptExecutionOutcomeUnknown:
+	default:
+		return fmt.Errorf("unsupported unfinalized ACP SessionTurn attempt state %s", attempt.ExecutionState)
+	}
+	return d.finalizeRecoveredTerminalSession(ctx, task, attempt, fence)
+}
+
+type acpTaskSessionPreparation struct {
+	control          *store.SessionControl
+	current          *ACPRuntimeSessionBinding
+	plan             ACPRuntimeSessionPlan
+	bootstrap        *ACPBootstrapTranscript
+	userPrompt       string
+	verifiedBaseline *store.VerifiedBranchBaseline
+}
+
+type acpSessionTranscriptAppendPolicy struct {
+	skipTranscriptAppend bool
+	skipUserPromptAppend bool
+}
+
+func acpSessionTranscriptAppendPolicyForTask(task *corev1alpha1.Task) acpSessionTranscriptAppendPolicy {
+	if task == nil || task.Spec.SessionRef == nil {
+		return acpSessionTranscriptAppendPolicy{}
+	}
+	if !task.Spec.SessionRef.Append {
+		return acpSessionTranscriptAppendPolicy{skipTranscriptAppend: true}
+	}
+	return acpSessionTranscriptAppendPolicy{skipUserPromptAppend: task.Spec.SessionRef.PromptIncluded}
+}
+
+// acpSessionLineageIdentity carries the protocol/runtime lineage identity
+// claimed atomically with the Session mutation lease.
+type acpSessionLineageIdentity struct {
+	NamespaceUID    string
+	RuntimeIdentity string
+	ConfigDigest    string
+}
+
+func (d *ACPDispatcher) prepareTaskSession(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	fence store.ControllerEpochFence,
+	profileDigest harnessv2.ProfileDigest,
+	mcpBindingDigest string,
+	runtimeInstanceID harnessv2.RuntimeInstanceID,
+	supervisorBootID harnessv2.SupervisorBootID,
+	lineage acpSessionLineageIdentity,
+) (*acpTaskSession, error) {
+	if task.Spec.SessionRef == nil {
+		return nil, nil
+	}
+	if d.Sessions == nil {
+		return nil, fmt.Errorf("ACP Session continuity is not configured")
+	}
+	if lineage.ConfigDigest == "" {
+		lineage.ConfigDigest = string(profileDigest)
+	}
+	preparation, err := d.planTaskSession(ctx, task, fence, profileDigest, mcpBindingDigest, runtimeInstanceID, supervisorBootID)
+	if err != nil {
+		return nil, err
+	}
+	lease, turn, err := d.bindAndOpenTaskSessionTurn(
+		ctx, task, fence, runtimeInstanceID, preparation.control, preparation.userPrompt,
+		acpSessionTranscriptAppendPolicyForTask(task), lineage,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if preparation.current == nil && lease.Session.LeaseGeneration > 1 {
+		preparation.plan.Binding.Generation = uint64(lease.Session.LeaseGeneration)
+		preparation.plan.Recreate = true
+		preparation.plan.BootstrapRequired = true
+		preparation.plan.Reason = "controller-restarted"
+	}
+	if preparation.plan.Binding.Generation < uint64(lease.Session.LeaseGeneration) && preparation.plan.Recreate {
+		preparation.plan.Binding.Generation = uint64(lease.Session.LeaseGeneration)
+	}
+	if task.Status.Execution != nil && task.Status.Execution.RuntimeSessionGeneration > 0 {
+		if task.Status.Execution.RuntimeSessionUID != "" && task.Status.Execution.RuntimeSessionUID != preparation.control.SessionUID {
+			return nil, fmt.Errorf("%w: persisted Task RuntimeSession UID does not match durable Session UID", store.ErrConflict)
+		}
+		generationFloor := uint64(task.Status.Execution.RuntimeSessionGeneration)
+		if task.Status.Execution.RuntimeInstanceID != "" &&
+			task.Status.Execution.RuntimeInstanceID != string(runtimeInstanceID) {
+			if generationFloor >= maxControllerRuntimeSessionGeneration {
+				return nil, store.ValidationErrorf("ACP runtime session generation is exhausted")
+			}
+			generationFloor++
+		}
+		if preparation.plan.Binding.Generation < generationFloor {
+			preparation.plan.Binding.Generation = generationFloor
+			preparation.plan.Binding.RecreationRequired = true
+			preparation.plan.Recreate = true
+			preparation.plan.BootstrapRequired = true
+			preparation.plan.Reason = "persisted-runtime-session-recreation"
+		}
+	}
+	return &acpTaskSession{
+		Turn: turn, Binding: preparation.plan.Binding, Bootstrap: preparation.bootstrap,
+		UserPrompt:       preparation.userPrompt,
+		VerifiedBaseline: preparation.verifiedBaseline, Reused: !preparation.plan.Recreate,
+		LeaseGeneration: lease.Key.LeaseGeneration,
+	}, nil
+}
+
+func (d *ACPDispatcher) planTaskSession(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	fence store.ControllerEpochFence,
+	profileDigest harnessv2.ProfileDigest,
+	mcpBindingDigest string,
+	runtimeInstanceID harnessv2.RuntimeInstanceID,
+	supervisorBootID harnessv2.SupervisorBootID,
+) (*acpTaskSessionPreparation, error) {
+	name := strings.TrimSpace(task.Spec.SessionRef.Name)
+	if name == "" {
+		return nil, fmt.Errorf("SessionRef name is required")
+	}
+	transcriptBackedPrompt := task.Spec.SessionRef.PromptIncluded &&
+		strings.TrimSpace(task.Spec.SessionRef.ThroughMessageID) != ""
+	if !task.Spec.SessionRef.Create && !transcriptBackedPrompt {
+		if _, err := d.Store.GetSessionControl(ctx, task.Namespace, name); err != nil {
+			if errors.Is(err, store.ErrNotFound) {
+				return nil, fmt.Errorf("session %s/%s does not exist and create=false", task.Namespace, name)
+			}
+			return nil, err
+		}
+	}
+	sessionType := defaultACPSessionType
+	if task.Spec.SessionRef.PromptIncluded && strings.HasPrefix(task.Spec.SessionRef.ThroughMessageID, "gateway:") {
+		sessionType = store.SessionTypeGateway
+	}
+	control, err := d.Sessions.EnsureSession(ctx, ACPEnsureSessionRequest{
+		Namespace: task.Namespace, SessionName: name, SessionType: sessionType,
+		RequireExistingTranscript: transcriptBackedPrompt && !task.Spec.SessionRef.Create,
+		Fence:                     fence, CreatedAt: time.Now().UTC(),
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	// Complete every fallible transcript/runtime planning read before acquiring
+	// the mutation Lease. Once the Lease is held, the only next durable action is
+	// opening the exact SessionTurn.
+	current := d.currentRuntimeSessionBinding(control.SessionUID)
+	if current == nil {
+		current, err = runtimeSessionBindingFromTaskStatus(
+			task, control.SessionUID, profileDigest, runtimeInstanceID, supervisorBootID,
+		)
+		if err != nil {
+			return nil, err
+		}
+	}
+	plan, err := PlanACPRuntimeSession(*control, current, profileDigest, mcpBindingDigest, runtimeInstanceID, supervisorBootID)
+	if err != nil {
+		return nil, err
+	}
+	var userPrompt string
+	var bootstrap *ACPBootstrapTranscript
+	if plan.BootstrapRequired {
+		bootstrap, userPrompt, err = d.resolveTaskSessionBootstrap(ctx, task, control)
+	} else {
+		userPrompt, err = d.resolveTaskSessionPrompt(ctx, task, control)
+	}
+	if err != nil {
+		return nil, err
+	}
+	var verifiedBaseline *store.VerifiedBranchBaseline
+	if control.VerifiedBaseline != nil {
+		copyBaseline := *control.VerifiedBaseline
+		verifiedBaseline = &copyBaseline
+	}
+	return &acpTaskSessionPreparation{
+		control: control, current: current, plan: plan, bootstrap: bootstrap, userPrompt: userPrompt,
+		verifiedBaseline: verifiedBaseline,
+	}, nil
+}
+
+func (d *ACPDispatcher) resolveTaskSessionPrompt(
+	ctx context.Context, task *corev1alpha1.Task, control *store.SessionControl,
+) (string, error) {
+	userPrompt := task.Spec.Prompt
+	ref := task.Spec.SessionRef
+	if ref == nil || !ref.PromptIncluded {
+		return userPrompt, nil
+	}
+	throughMessageID := strings.TrimSpace(ref.ThroughMessageID)
+	if throughMessageID == "" {
+		return "", store.ValidationErrorf("prompt-included ACP session requires a through-message ID")
+	}
+	current, err := d.Sessions.controls.GetSessionControl(ctx, control.Namespace, control.SessionName)
+	if err != nil {
+		return "", fmt.Errorf("load ACP session for prompt resolution: %w", err)
+	}
+	if current.SessionUID != control.SessionUID {
+		return "", fmt.Errorf(
+			"%w: ACP prompt session UID changed from %q to %q",
+			store.ErrConflict, control.SessionUID, current.SessionUID,
+		)
+	}
+	if current.Availability != store.SessionAvailable {
+		return "", fmt.Errorf(
+			"%w: ACP session %s/%s is reconciliation-blocked",
+			store.ErrConflict, current.Namespace, current.SessionName,
+		)
+	}
+	messages, err := d.Sessions.transcripts.LoadTranscriptThrough(
+		ctx, current.Namespace, current.SessionName, throughMessageID, 1,
+	)
+	if err != nil {
+		return "", fmt.Errorf("load canonical ACP session prompt: %w", err)
+	}
+	if len(messages) != 1 || messages[0].ID != throughMessageID {
+		return "", fmt.Errorf(
+			"%w: bounded ACP transcript does not end at message %q",
+			store.ErrConflict, throughMessageID,
+		)
+	}
+	throughMessage := messages[0]
+	if throughMessage.Role != acpBootstrapRoleUser || strings.TrimSpace(throughMessage.Content) == "" {
+		return "", store.ValidationErrorf("prompt-included ACP session cutoff must end at a non-empty user message")
+	}
+	return throughMessage.Content, nil
+}
+
+func (d *ACPDispatcher) resolveTaskSessionBootstrap(
+	ctx context.Context, task *corev1alpha1.Task, control *store.SessionControl,
+) (*ACPBootstrapTranscript, string, error) {
+	userPrompt := task.Spec.Prompt
+	ref := task.Spec.SessionRef
+	if ref == nil || (!ref.Append && !ref.PromptIncluded) {
+		return nil, userPrompt, nil
+	}
+	if strings.TrimSpace(ref.ThroughMessageID) == "" {
+		if ref.PromptIncluded {
+			return nil, "", store.ValidationErrorf("prompt-included ACP session requires a through-message ID")
+		}
+		bootstrap, err := d.Sessions.BuildBootstrapTranscriptWithLimit(ctx, *control, acpSessionReferenceMaxMessages(ref))
+		return bootstrap, userPrompt, err
+	}
+	bootstrap, throughMessage, err := d.Sessions.BuildBootstrapTranscriptThrough(
+		ctx, *control, ref.ThroughMessageID, acpSessionReferenceMaxMessages(ref), ref.PromptIncluded,
+	)
+	if err != nil {
+		return nil, "", err
+	}
+	if ref.PromptIncluded {
+		if throughMessage == nil || throughMessage.Role != acpBootstrapRoleUser || strings.TrimSpace(throughMessage.Content) == "" {
+			return nil, "", store.ValidationErrorf("prompt-included ACP session cutoff must end at a non-empty user message")
+		}
+		userPrompt = throughMessage.Content
+	}
+	return bootstrap, userPrompt, nil
+}
+
+func acpSessionReferenceMaxMessages(ref *corev1alpha1.SessionReference) int {
+	if ref != nil && ref.MaxMessages > 0 {
+		return int(ref.MaxMessages)
+	}
+	return 50
+}
+
+func runtimeSessionBindingFromTaskStatus(
+	task *corev1alpha1.Task,
+	sessionUID string,
+	profileDigest harnessv2.ProfileDigest,
+	runtimeInstanceID harnessv2.RuntimeInstanceID,
+	supervisorBootID harnessv2.SupervisorBootID,
+) (*ACPRuntimeSessionBinding, error) {
+	if task == nil || task.Status.Execution == nil || task.Status.Execution.RuntimeSessionGeneration <= 0 {
+		return nil, nil
+	}
+	execution := task.Status.Execution
+	if execution.RuntimeSessionUID == "" {
+		return nil, nil
+	}
+	if execution.RuntimeSessionUID != sessionUID {
+		return nil, fmt.Errorf("%w: persisted Task RuntimeSession UID does not match durable Session UID", store.ErrConflict)
+	}
+	workspaceDigest := strings.TrimSpace(execution.RuntimeSessionWorkspaceDigest)
+	if workspaceDigest != "" {
+		if err := store.ValidateCanonicalDigest("persisted RuntimeSession workspace digest", workspaceDigest); err != nil {
+			return nil, err
+		}
+	}
+	persistedRuntimeInstanceID := harnessv2.RuntimeInstanceID(strings.TrimSpace(execution.RuntimeInstanceID))
+	if persistedRuntimeInstanceID == "" {
+		persistedRuntimeInstanceID = runtimeInstanceID
+	}
+	persistedSupervisorBootID := harnessv2.SupervisorBootID(strings.TrimSpace(execution.RuntimeSessionSupervisorBootID))
+	if persistedSupervisorBootID == "" {
+		persistedSupervisorBootID = supervisorBootID
+	}
+	persistedProfileDigest := harnessv2.ProfileDigest(strings.TrimSpace(execution.RuntimeSessionProfileDigest))
+	if persistedProfileDigest == "" {
+		persistedProfileDigest = profileDigest
+	} else if err := harnessv2.ValidateProfileDigest(persistedProfileDigest); err != nil {
+		return nil, fmt.Errorf("persisted RuntimeSession profile digest: %w", err)
+	}
+	persistedMCPDigest := strings.TrimSpace(execution.RuntimeSessionMCPDigest)
+	if persistedMCPDigest != "" {
+		if err := store.ValidateCanonicalDigest("persisted RuntimeSession MCP digest", persistedMCPDigest); err != nil {
+			return nil, err
+		}
+	}
+	return &ACPRuntimeSessionBinding{
+		SessionUID: sessionUID, Generation: uint64(execution.RuntimeSessionGeneration), ProfileDigest: persistedProfileDigest,
+		RuntimeInstanceID: persistedRuntimeInstanceID, SupervisorBootID: persistedSupervisorBootID,
+		WorkspaceDigest: workspaceDigest, MCPDigest: persistedMCPDigest,
+		RecreationRequired: execution.RuntimeSessionRecreationPending,
+	}, nil
+}
+
+func (d *ACPDispatcher) bindAndOpenTaskSessionTurn(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	fence store.ControllerEpochFence,
+	runtimeInstanceID harnessv2.RuntimeInstanceID,
+	control *store.SessionControl,
+	userPrompt string,
+	appendPolicy acpSessionTranscriptAppendPolicy,
+	lineage acpSessionLineageIdentity,
+) (*ACPSessionLease, *ACPSessionTurn, error) {
+	attemptID, err := promptAttemptIDFromTask(task)
+	if err != nil {
+		return nil, nil, err
+	}
+	existingLease, _, err := matchingTaskSessionLease(control, task)
+	if err != nil {
+		return nil, nil, err
+	}
+	leaseGeneration := control.LeaseGeneration + 1
+	if existingLease != nil {
+		leaseGeneration = existingLease.Generation
+	}
+	if err := d.transitionAttempt(ctx, attemptID, fence, store.PromptExecutionReserved, store.PromptExecutionSessionStarting, "session-starting", &attemptRuntimeBinding{
+		RuntimeInstanceID: string(runtimeInstanceID), SessionUID: control.SessionUID, SessionGeneration: leaseGeneration,
+	}); err != nil {
+		return nil, nil, err
+	}
+
+	// Re-enter exact lease acquisition even when the Lease already exists. This
+	// is idempotent and completes a lineage payload projection that may have
+	// failed after the Kubernetes-authoritative status CAS.
+	lease, err := d.acquireTaskSessionLease(ctx, task, fence, control, lineage)
+	if err != nil {
+		requeueErr := d.requeuePreSubmissionTask(ctx, task, attemptID, fence, err)
+		return nil, nil, errors.Join(err, requeueErr)
+	}
+	if lease.Key.LeaseGeneration != leaseGeneration {
+		err := fmt.Errorf("%w: acquired ACP Session lease generation changed after PromptAttempt binding", store.ErrConflict)
+		requeueErr := d.requeuePreSubmissionTask(ctx, task, attemptID, fence, err)
+		return nil, nil, errors.Join(err, requeueErr)
+	}
+	turn, err := d.Sessions.OpenTurn(ctx, ACPOpenSessionTurnRequest{
+		Lease: *lease, Fence: fence, PromptAttemptID: attemptID,
+		PromptRequestDigest: task.Status.Execution.RequestDigest, UserPrompt: userPrompt,
+		SkipTranscriptAppend: appendPolicy.skipTranscriptAppend,
+		SkipUserPromptAppend: appendPolicy.skipUserPromptAppend,
+		OpenedAt:             time.Now().UTC(),
+	})
+	if err != nil {
+		recovered, recoveryErr := d.handleSessionTurnOpenFailure(
+			ctx, task, fence, attemptID, lease, userPrompt, appendPolicy, err,
+		)
+		if recoveryErr != nil {
+			return nil, nil, recoveryErr
+		}
+		return lease, recovered, nil
+	}
+	return lease, turn, nil
+}
+
+func (d *ACPDispatcher) quiesceInterruptedTaskSessionPreparation(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attemptID string,
+	fence store.ControllerEpochFence,
+) (*acpTaskSession, error) {
+	if task == nil || task.Spec.SessionRef == nil || d.Sessions == nil {
+		return nil, nil
+	}
+	cleanupCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), acpPreSubmissionCleanupTimeout)
+	defer cancel()
+
+	attempt, err := d.Store.GetPromptAttempt(cleanupCtx, attemptID)
+	if err != nil {
+		return nil, err
+	}
+	bound, err := promptAttemptSessionBound(attempt)
+	if err != nil {
+		return nil, err
+	}
+	if !bound {
+		switch attempt.ExecutionState {
+		case store.PromptExecutionReserved, store.PromptExecutionCancelled:
+			return nil, nil
+		case store.PromptExecutionSessionStarting, store.PromptExecutionPlanned:
+			if err := d.requeuePreSubmissionTask(cleanupCtx, task, attemptID, fence, context.DeadlineExceeded); err != nil {
+				return nil, err
+			}
+			return nil, nil
+		default:
+			return nil, fmt.Errorf("%w: interrupted session preparation left prompt attempt %s in state %s", store.ErrConflict, attempt.ID, attempt.ExecutionState)
+		}
+	}
+
+	session, err := d.recoveredTaskSession(cleanupCtx, task, attempt)
+	if err == nil {
+		if session == nil || session.Turn == nil || session.Turn.Turn.State != store.SessionTurnOpen {
+			return nil, fmt.Errorf("%w: interrupted session preparation did not recover an open SessionTurn", store.ErrConflict)
+		}
+		return session, nil
+	}
+	if !errors.Is(err, store.ErrNotFound) {
+		return nil, err
+	}
+
+	control, controlErr := d.Store.GetSessionControl(cleanupCtx, task.Namespace, task.Spec.SessionRef.Name)
+	if controlErr != nil {
+		return nil, errors.Join(err, controlErr)
+	}
+	if control.SessionUID != attempt.SessionUID {
+		return nil, fmt.Errorf("%w: interrupted SessionControl UID does not match PromptAttempt", store.ErrConflict)
+	}
+	key := store.SessionTurnKey{
+		SessionUID: attempt.SessionUID, LeaseGeneration: attempt.SessionLeaseGeneration,
+		TaskUID: attempt.Key.TaskUID, Attempt: attempt.Key.Attempt, PromptID: attempt.Key.PromptID,
+	}
+	if control.Lease != nil {
+		lease := ACPSessionLease{Session: *control, Key: key}
+		if validateErr := validateACPSessionLease(control, key); validateErr != nil {
+			return nil, errors.Join(err, validateErr)
+		}
+		if _, releaseErr := d.Sessions.ReleaseMutationLease(cleanupCtx, ACPReleaseSessionLeaseRequest{
+			Lease: lease, Fence: fence, ReleasedAt: time.Now().UTC(),
+		}); releaseErr != nil {
+			return nil, errors.Join(err, releaseErr)
+		}
+	}
+	if requeueErr := d.requeuePreSubmissionTask(cleanupCtx, task, attemptID, fence, context.DeadlineExceeded); requeueErr != nil {
+		return nil, errors.Join(err, requeueErr)
+	}
+	return nil, nil
+}
+
+func (d *ACPDispatcher) handleSessionTurnOpenFailure(
+	ctx context.Context, task *corev1alpha1.Task, fence store.ControllerEpochFence,
+	attemptID string, lease *ACPSessionLease, userPrompt string,
+	appendPolicy acpSessionTranscriptAppendPolicy, openErr error,
+) (*ACPSessionTurn, error) {
+	turnID, err := lease.Key.CanonicalID()
+	if err != nil {
+		return nil, errors.Join(openErr, err)
+	}
+	persisted, getErr := d.Store.GetSessionTurn(ctx, turnID)
+	if getErr == nil {
+		effectivePolicy := appendPolicy
+		expectedDigest, digestErr := acpSessionTurnDigest(
+			turnID, attemptID, task.Status.Execution.RequestDigest, userPrompt,
+			effectivePolicy.skipTranscriptAppend, effectivePolicy.skipUserPromptAppend,
+		)
+		if digestErr == nil && persisted.RequestDigest != expectedDigest && (effectivePolicy.skipTranscriptAppend || effectivePolicy.skipUserPromptAppend) {
+			legacyDigest, legacyErr := acpSessionTurnDigest(
+				turnID, attemptID, task.Status.Execution.RequestDigest, userPrompt, false, false,
+			)
+			if legacyErr == nil && persisted.RequestDigest == legacyDigest {
+				effectivePolicy = acpSessionTranscriptAppendPolicy{}
+				expectedDigest = legacyDigest
+			}
+		}
+		if digestErr == nil && persisted.State == store.SessionTurnOpen && persisted.Key == lease.Key &&
+			persisted.PromptAttemptID == attemptID && persisted.RequestDigest == expectedDigest && persisted.UserPrompt == userPrompt {
+			return &ACPSessionTurn{
+				Lease: *lease, Turn: *persisted,
+				SkipTranscriptAppend: effectivePolicy.skipTranscriptAppend,
+				SkipUserPromptAppend: effectivePolicy.skipUserPromptAppend,
+			}, nil
+		}
+		return nil, errors.Join(openErr, fmt.Errorf("%w: persisted SessionTurn does not match failed open request", store.ErrConflict))
+	}
+	if !errors.Is(getErr, store.ErrNotFound) {
+		_ = d.requeuePreSubmissionTask(ctx, task, attemptID, fence, openErr)
+		return nil, errors.Join(openErr, getErr)
+	}
+	_, releaseErr := d.Sessions.ReleaseMutationLease(ctx, ACPReleaseSessionLeaseRequest{Lease: *lease, Fence: fence, ReleasedAt: time.Now().UTC()})
+	requeueErr := d.requeuePreSubmissionTask(ctx, task, attemptID, fence, openErr)
+	return nil, errors.Join(openErr, releaseErr, requeueErr)
+}
+
+func matchingTaskSessionLease(control *store.SessionControl, task *corev1alpha1.Task) (*store.SessionMutationLease, string, error) {
+	existing := control.Lease
+	if existing == nil {
+		return nil, "", nil
+	}
+	expectedDigest, err := acpSessionMutationLeaseDigest(
+		control.SessionUID, existing.Generation, string(task.UID), int64(task.Status.Execution.Attempt),
+		task.Status.Execution.PromptID, task.Status.Execution.RequestDigest,
+	)
+	if err != nil {
+		return nil, "", err
+	}
+	if existing.TaskUID != string(task.UID) || existing.Attempt != int64(task.Status.Execution.Attempt) ||
+		existing.PromptID != task.Status.Execution.PromptID || existing.RequestDigest != expectedDigest {
+		return nil, expectedDigest, nil
+	}
+	return existing, expectedDigest, nil
+}
+
+func (d *ACPDispatcher) acquireTaskSessionLease(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	fence store.ControllerEpochFence,
+	control *store.SessionControl,
+	lineage acpSessionLineageIdentity,
+) (*ACPSessionLease, error) {
+	expires := time.Now().UTC().Add(30 * time.Minute)
+	if task.Spec.Timeout != nil && task.Spec.Timeout.Duration > 0 {
+		expires = time.Now().UTC().Add(task.Spec.Timeout.Duration + time.Minute)
+	}
+	return d.Sessions.AcquireMutationLease(ctx, ACPAcquireSessionLeaseRequest{
+		Session: *control, Fence: fence, TaskUID: string(task.UID), Attempt: int64(task.Status.Execution.Attempt),
+		PromptID: task.Status.Execution.PromptID, PromptRequestDigest: task.Status.Execution.RequestDigest,
+		AcquiredAt: time.Now().UTC(), ExpiresAt: &expires,
+		NamespaceUID: lineage.NamespaceUID, RuntimeIdentity: lineage.RuntimeIdentity, ConfigDigest: lineage.ConfigDigest,
+	})
+}
+
+func (d *ACPDispatcher) openTaskSessionTurn(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attemptID string,
+	fence store.ControllerEpochFence,
+	session *acpTaskSession,
+) error {
+	if session == nil {
+		return nil
+	}
+	if session.Turn != nil {
+		return nil
+	}
+	control, err := d.Store.GetSessionControl(ctx, task.Namespace, task.Spec.SessionRef.Name)
+	if err != nil {
+		return err
+	}
+	lease := ACPSessionLease{Session: *control, Key: store.SessionTurnKey{
+		SessionUID: control.SessionUID, LeaseGeneration: control.LeaseGeneration,
+		TaskUID: string(task.UID), Attempt: int64(task.Status.Execution.Attempt), PromptID: task.Status.Execution.PromptID,
+	}}
+	userPrompt := session.UserPrompt
+	if strings.TrimSpace(userPrompt) == "" {
+		userPrompt = task.Spec.Prompt
+	}
+	appendPolicy := acpSessionTranscriptAppendPolicyForTask(task)
+	turn, err := d.Sessions.OpenTurn(ctx, ACPOpenSessionTurnRequest{
+		Lease: lease, Fence: fence, PromptAttemptID: attemptID,
+		PromptRequestDigest: task.Status.Execution.RequestDigest, UserPrompt: userPrompt,
+		SkipTranscriptAppend: appendPolicy.skipTranscriptAppend,
+		SkipUserPromptAppend: appendPolicy.skipUserPromptAppend,
+		OpenedAt:             time.Now().UTC(),
+	})
+	if err != nil {
+		return err
+	}
+	session.Turn = turn
+	return nil
+}
+
+func (d *ACPDispatcher) finalizeTaskSessionResult(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	fence store.ControllerEpochFence,
+	session *acpTaskSession,
+	result, publicationID string,
+	phase corev1alpha1.TaskPhase,
+	delivery corev1alpha1.TaskDeliveryStatus,
+) error {
+	if session == nil || session.Turn == nil {
+		return nil
+	}
+	execution, err := taskSessionProjectionExecution(task, corev1alpha1.TaskExecutionStatus{
+		State: corev1alpha1.TaskExecutionStateSucceeded, Outcome: corev1alpha1.TaskExecutionOutcomeSucceeded,
+		Attempt: task.Status.Execution.Attempt, PromptID: task.Status.Execution.PromptID,
+	})
+	if err != nil {
+		return err
+	}
+	payload, err := json.Marshal(taskTerminalProjection{
+		Namespace: task.Namespace, Task: task.Name, TaskUID: string(task.UID), Attempt: task.Status.Execution.Attempt,
+		Phase: phase, Execution: execution, Delivery: &delivery,
+	})
+	if err != nil {
+		return err
+	}
+	_, err = d.Sessions.FinalizeAssistantResult(ctx, ACPFinalizeAssistantRequest{
+		SessionTurn: *session.Turn, Fence: fence, AssistantResult: result,
+		PublicationID: publicationID,
+		Projection:    ACPFinalizationProjection{ProjectionKind: "TaskTerminalStatus", Payload: payload, AvailableAt: time.Now().UTC()},
+		FinalizedAt:   time.Now().UTC(),
+	})
+	if err == nil {
+		session.finalized = true
+		d.setRuntimeSessionBinding(session.Binding)
+	}
+	return err
+}
+
+func (d *ACPDispatcher) finalizeTaskSessionUnknown(ctx context.Context, task *corev1alpha1.Task, fence store.ControllerEpochFence, session *acpTaskSession, reason string) error {
+	if session == nil || session.Turn == nil || session.finalized {
+		return nil
+	}
+	execution, err := taskSessionProjectionExecution(task, corev1alpha1.TaskExecutionStatus{
+		State: corev1alpha1.TaskExecutionStateOutcomeUnknown, Outcome: corev1alpha1.TaskExecutionOutcomeOutcomeUnknown,
+		Attempt: task.Status.Execution.Attempt, PromptID: task.Status.Execution.PromptID,
+		Reason: "RuntimeLost", Message: reason,
+	})
+	if err != nil {
+		return err
+	}
+	payload, err := json.Marshal(taskTerminalProjection{
+		Namespace: task.Namespace, Task: task.Name, TaskUID: string(task.UID), Attempt: task.Status.Execution.Attempt,
+		Phase: corev1alpha1.TaskPhaseFailed, Execution: execution, Delivery: task.Status.Delivery,
+	})
+	if err != nil {
+		return err
+	}
+	_, err = d.Sessions.FinalizeOutcomeUnknown(ctx, ACPFinalizeOutcomeUnknownRequest{
+		SessionTurn: *session.Turn, Fence: fence, Reason: reason,
+		Projection:  ACPFinalizationProjection{ProjectionKind: "TaskTerminalStatus", Payload: payload, AvailableAt: time.Now().UTC()},
+		FinalizedAt: time.Now().UTC(),
+	})
+	if err == nil {
+		session.finalized = true
+		d.removeRuntimeSessionBinding(session.Binding.SessionUID)
+	}
+	return err
+}
+
+func (d *ACPDispatcher) finalizeTaskSessionMarker(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	fence store.ControllerEpochFence,
+	session *acpTaskSession,
+	kind, reason string,
+	phase corev1alpha1.TaskPhase,
+	execution corev1alpha1.TaskExecutionStatus,
+) error {
+	if session == nil || session.Turn == nil || session.finalized {
+		return nil
+	}
+	var err error
+	execution, err = taskSessionProjectionExecution(task, execution)
+	if err != nil {
+		return err
+	}
+	payload, err := json.Marshal(taskTerminalProjection{
+		Namespace: task.Namespace, Task: task.Name, TaskUID: string(task.UID), Attempt: execution.Attempt,
+		Phase: phase, Message: reason, Execution: execution, Delivery: task.Status.Delivery,
+	})
+	if err != nil {
+		return err
+	}
+	_, err = d.Sessions.FinalizeOutcomeMarker(ctx, ACPFinalizeOutcomeMarkerRequest{
+		SessionTurn: *session.Turn, Fence: fence, Kind: kind, Reason: reason,
+		Projection:  ACPFinalizationProjection{ProjectionKind: "TaskTerminalStatus", Payload: payload, AvailableAt: time.Now().UTC()},
+		FinalizedAt: time.Now().UTC(),
+	})
+	if err == nil {
+		session.finalized = true
+		d.removeRuntimeSessionBinding(session.Binding.SessionUID)
+	}
+	return err
+}
+
+// taskSessionProjectionExecution overlays only the terminal classification on
+// the Task's frozen execution identity. Session finalization projections are
+// immutable reclamation evidence, so omitting the request digest or runtime
+// identity would make the source PromptAttempt impossible to retire safely.
+func taskSessionProjectionExecution(
+	task *corev1alpha1.Task,
+	terminal corev1alpha1.TaskExecutionStatus,
+) (corev1alpha1.TaskExecutionStatus, error) {
+	if task == nil || task.Status.Execution == nil {
+		return corev1alpha1.TaskExecutionStatus{}, fmt.Errorf("task execution status is required for Session terminal projection")
+	}
+	if terminal.State == "" || terminal.Outcome == "" {
+		return corev1alpha1.TaskExecutionStatus{}, fmt.Errorf("session terminal projection requires execution state and outcome")
+	}
+	current := task.Status.Execution
+	if terminal.Attempt != 0 && terminal.Attempt != current.Attempt {
+		return corev1alpha1.TaskExecutionStatus{}, fmt.Errorf("session terminal projection attempt does not match the Task")
+	}
+	if terminal.PromptID != "" && terminal.PromptID != current.PromptID {
+		return corev1alpha1.TaskExecutionStatus{}, fmt.Errorf("session terminal projection prompt ID does not match the Task")
+	}
+	execution := *current.DeepCopy()
+	execution.State = terminal.State
+	execution.Outcome = terminal.Outcome
+	execution.Reason = terminal.Reason
+	execution.Message = terminal.Message
+	return execution, nil
+}
+
+func (d *ACPDispatcher) currentRuntimeSessionBinding(sessionUID string) *ACPRuntimeSessionBinding {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	if d.runtimeSessions == nil {
+		return nil
+	}
+	binding, ok := d.runtimeSessions[sessionUID]
+	if !ok {
+		return nil
+	}
+	copy := binding
+	return &copy
+}
+
+func (d *ACPDispatcher) setRuntimeSessionBinding(binding ACPRuntimeSessionBinding) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	if d.runtimeSessions == nil {
+		d.runtimeSessions = make(map[string]ACPRuntimeSessionBinding)
+	}
+	d.runtimeSessions[binding.SessionUID] = binding
+}
+
+func (d *ACPDispatcher) forgetRuntimeSessionBinding(sessionUID string) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	delete(d.runtimeSessions, strings.TrimSpace(sessionUID))
+}
+
+func (d *ACPDispatcher) removeRuntimeSessionBinding(sessionUID string) {
+	d.mu.Lock()
+	delete(d.runtimeSessions, strings.TrimSpace(sessionUID))
+	d.mu.Unlock()
+}
+
+func bootstrapPromptText(bootstrap *ACPBootstrapTranscript) string {
+	if bootstrap == nil || bootstrap.MessageCount == 0 || len(bootstrap.Artifact) == 0 {
+		return ""
+	}
+	return "Orka canonical session transcript (JSONL; provider-native history is non-authoritative):\n" + string(bootstrap.Artifact)
+}
diff --git a/internal/controller/acp_dispatcher_session_bootstrap_test.go b/internal/controller/acp_dispatcher_session_bootstrap_test.go
new file mode 100644
index 000000000..1f23f1328
--- /dev/null
+++ b/internal/controller/acp_dispatcher_session_bootstrap_test.go
@@ -0,0 +1,209 @@
+package controller
+
+import (
+	"context"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/store"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+func TestPrepareTaskSessionSkipsBootstrapForLiveRuntimeSessionReuse(t *testing.T) {
+	ctx := context.Background()
+	controlStore, fence, closeStore := newACPSessionTestStore(t, filepath.Join(t.TempDir(), "live-reuse.db"))
+	defer closeStore()
+	continuity, transcriptStore := newBootstrapTrackingSessionContinuity(t, controlStore, "live-reuse-session-uid")
+	control := ensureACPSessionForTest(t, continuity, fence, "live-reuse")
+	appendBootstrapHistoryForTest(t, controlStore, control)
+
+	profileDigest := harnessv2.ProfileDigest(testControlDigestForDispatcher("live-reuse-profile"))
+	mcpDigest := testControlDigestForDispatcher("live-reuse-mcp")
+	runtimeInstanceID := harnessv2.RuntimeInstanceID("live-runtime")
+	supervisorBootID := harnessv2.SupervisorBootID("live-boot")
+	task := newBootstrapSessionTaskForTest(
+		t, controlStore, fence, control, "live-reuse-task", types.UID("11111111-1111-1111-1111-111111111111"),
+	)
+	dispatcher := &ACPDispatcher{
+		Store: controlStore, Sessions: continuity, runtimeSessions: make(map[string]ACPRuntimeSessionBinding),
+	}
+	dispatcher.setRuntimeSessionBinding(ACPRuntimeSessionBinding{
+		SessionUID: control.SessionUID, Generation: 1, ProfileDigest: profileDigest, MCPDigest: mcpDigest,
+		RuntimeInstanceID: runtimeInstanceID, SupervisorBootID: supervisorBootID,
+	})
+
+	session, err := dispatcher.prepareTaskSession(
+		ctx, task, fence, profileDigest, mcpDigest, runtimeInstanceID, supervisorBootID,
+		acpSessionLineageIdentity{},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if session == nil || !session.Reused {
+		t.Fatalf("live RuntimeSession preparation = %#v, want reused session", session)
+	}
+	if session.Bootstrap != nil || bootstrapPromptText(session.Bootstrap) != "" {
+		t.Fatalf("live RuntimeSession reuse attached canonical bootstrap history: %#v", session.Bootstrap)
+	}
+	if transcriptStore.loadTranscriptCalls != 0 || transcriptStore.loadTranscriptThroughCalls != 0 {
+		t.Fatalf(
+			"live RuntimeSession reuse loaded canonical transcript: LoadTranscript=%d LoadTranscriptThrough=%d",
+			transcriptStore.loadTranscriptCalls, transcriptStore.loadTranscriptThroughCalls,
+		)
+	}
+}
+
+func TestPrepareTaskSessionRetainsBootstrapWhenRuntimeSessionRecreationIsRequired(t *testing.T) {
+	ctx := context.Background()
+	controlStore, fence, closeStore := newACPSessionTestStore(t, filepath.Join(t.TempDir(), "recreate.db"))
+	defer closeStore()
+	continuity, transcriptStore := newBootstrapTrackingSessionContinuity(t, controlStore, "recreate-session-uid")
+	control := ensureACPSessionForTest(t, continuity, fence, "recreate")
+	appendBootstrapHistoryForTest(t, controlStore, control)
+
+	profileDigest := harnessv2.ProfileDigest(testControlDigestForDispatcher("recreate-profile"))
+	mcpDigest := testControlDigestForDispatcher("recreate-mcp")
+	task := newBootstrapSessionTaskForTest(
+		t, controlStore, fence, control, "recreate-task", types.UID("22222222-2222-2222-2222-222222222222"),
+	)
+	dispatcher := &ACPDispatcher{
+		Store: controlStore, Sessions: continuity, runtimeSessions: make(map[string]ACPRuntimeSessionBinding),
+	}
+	dispatcher.setRuntimeSessionBinding(ACPRuntimeSessionBinding{
+		SessionUID: control.SessionUID, Generation: 1, ProfileDigest: profileDigest, MCPDigest: mcpDigest,
+		RuntimeInstanceID: "lost-runtime", SupervisorBootID: "lost-boot",
+	})
+
+	session, err := dispatcher.prepareTaskSession(
+		ctx, task, fence, profileDigest, mcpDigest, "replacement-runtime", "replacement-boot",
+		acpSessionLineageIdentity{},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if session == nil || session.Reused {
+		t.Fatalf("recreated RuntimeSession preparation = %#v, want non-reused session", session)
+	}
+	if session.Binding.Generation != 2 {
+		t.Fatalf("recreated RuntimeSession generation = %d, want 2", session.Binding.Generation)
+	}
+	if session.Bootstrap == nil || session.Bootstrap.MessageCount != 2 {
+		t.Fatalf("recreated RuntimeSession bootstrap = %#v, want retained two-message history", session.Bootstrap)
+	}
+	bootstrapText := bootstrapPromptText(session.Bootstrap)
+	if !strings.Contains(bootstrapText, "prior request") || !strings.Contains(bootstrapText, "prior response") {
+		t.Fatalf("recreated RuntimeSession bootstrap text = %q, want canonical history", bootstrapText)
+	}
+	if transcriptStore.loadTranscriptCalls != 1 || transcriptStore.loadTranscriptThroughCalls != 0 {
+		t.Fatalf(
+			"recreated RuntimeSession transcript loads: LoadTranscript=%d LoadTranscriptThrough=%d, want 1 and 0",
+			transcriptStore.loadTranscriptCalls, transcriptStore.loadTranscriptThroughCalls,
+		)
+	}
+}
+
+type bootstrapTrackingSessionStore struct {
+	store.SessionStore
+	loadTranscriptCalls        int
+	loadTranscriptThroughCalls int
+}
+
+func (s *bootstrapTrackingSessionStore) LoadTranscript(
+	ctx context.Context, namespace, name string, maxMessages int,
+) ([]store.SessionMessage, error) {
+	s.loadTranscriptCalls++
+	return s.SessionStore.LoadTranscript(ctx, namespace, name, maxMessages)
+}
+
+func (s *bootstrapTrackingSessionStore) LoadTranscriptThrough(
+	ctx context.Context, namespace, name, throughMessageID string, maxMessages int,
+) ([]store.SessionMessage, error) {
+	s.loadTranscriptThroughCalls++
+	return s.SessionStore.LoadTranscriptThrough(ctx, namespace, name, throughMessageID, maxMessages)
+}
+
+type bootstrapSessionTestStore interface {
+	store.DurableControlStore
+	store.SessionStore
+}
+
+func newBootstrapTrackingSessionContinuity(
+	t *testing.T,
+	controlStore bootstrapSessionTestStore,
+	sessionUID string,
+) (*ACPSessionContinuity, *bootstrapTrackingSessionStore) {
+	t.Helper()
+	transcriptStore := &bootstrapTrackingSessionStore{SessionStore: controlStore}
+	continuity, err := NewACPSessionContinuity(ACPSessionContinuityConfig{
+		SessionControls: controlStore,
+		Transcripts:     transcriptStore,
+		Publications:    controlStore,
+		BranchClaims:    controlStore,
+		NewSessionUID:   func() (string, error) { return sessionUID, nil },
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return continuity, transcriptStore
+}
+
+func appendBootstrapHistoryForTest(
+	t *testing.T, sessionStore store.SessionStore, control *store.SessionControl,
+) {
+	t.Helper()
+	if err := sessionStore.AppendMessages(context.Background(), control.Namespace, control.SessionName, []store.SessionMessage{
+		{ID: "prior-user", Role: "user", Content: "prior request", Timestamp: time.Now().UTC()},
+		{ID: "prior-assistant", Role: "assistant", Content: "prior response", Timestamp: time.Now().UTC()},
+	}); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func newBootstrapSessionTaskForTest(
+	t *testing.T,
+	controlStore store.DurableControlStore,
+	fence store.ControllerEpochFence,
+	control *store.SessionControl,
+	taskName string,
+	taskUID types.UID,
+) *corev1alpha1.Task {
+	t.Helper()
+	promptID := "prompt-" + string(taskUID) + "-1"
+	requestDigest := testControlDigestForDispatcher(taskName)
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: control.Namespace, Name: taskName, UID: taskUID},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent, Prompt: "continue without replaying history",
+			SessionRef: &corev1alpha1.SessionReference{
+				Name: control.SessionName, Create: false, Append: true, MaxMessages: 50,
+			},
+		},
+		Status: corev1alpha1.TaskStatus{Attempts: 1, Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateReserved, Attempt: 1, PromptID: promptID,
+			RequestDigest: requestDigest, ControllerEpoch: fence.Epoch,
+		}},
+	}
+	attempt, err := controlStore.CreatePromptAttempt(context.Background(), boundPromptAttemptForTest(&store.PromptAttempt{
+		Key: store.PromptAttemptKey{
+			Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: promptID,
+		},
+		RequestDigest: requestDigest,
+	}), fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	operationID := "reserve-" + taskName
+	if _, err := controlStore.TransitionPromptAttemptExecution(context.Background(), store.PromptAttemptExecutionTransition{
+		ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+		NewState: store.PromptExecutionReserved, OperationID: operationID,
+		OperationDigest: testControlDigestForDispatcher(operationID), UpdatedAt: time.Now().UTC(),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	return task
+}
diff --git a/internal/controller/acp_dispatcher_session_composite_test.go b/internal/controller/acp_dispatcher_session_composite_test.go
new file mode 100644
index 000000000..5a7c99e14
--- /dev/null
+++ b/internal/controller/acp_dispatcher_session_composite_test.go
@@ -0,0 +1,206 @@
+package controller
+
+import (
+	"context"
+	"fmt"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/onsi/ginkgo/v2"
+	"github.com/onsi/gomega"
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/store"
+	storekube "github.com/orka-agents/orka/internal/store/kube"
+	"github.com/orka-agents/orka/internal/store/sqlite"
+	coordinationv1 "k8s.io/api/coordination/v1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+)
+
+func TestPrepareTaskSessionCompositeStoreOpensTurn(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := coordinationv1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+
+	const (
+		namespaceName = "orka-system"
+		namespaceUID  = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
+		taskUID       = "11111111-2222-3333-4444-555555555555"
+	)
+	task := runtimePoolReservationTestTask("session-composite", taskUID, "runtime-pool-uid")
+	task.Namespace = namespaceName
+	task.Spec.Prompt = "first message in session"
+	task.Spec.SessionRef = &corev1alpha1.SessionReference{
+		Name: "session-composite", Create: true, Append: true,
+	}
+	task.Status.Attempts = 1
+	task.Status.Execution.State = corev1alpha1.TaskExecutionStateReserved
+	namespace := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{
+		Name: namespaceName, UID: types.UID(namespaceUID),
+	}}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).
+		WithStatusSubresource(
+			&corev1alpha1.Task{},
+			&corev1alpha1.ControllerEpoch{},
+			&corev1alpha1.PromptAttempt{},
+			&corev1alpha1.RuntimeSessionControl{},
+		).
+		WithObjects(namespace, task.DeepCopy()).
+		Build()
+	kubeClient = withControllerEpochLeaseUIDs(t, kubeClient)
+	testPrepareTaskSessionCompositeStoreOpensTurn(t, kubeClient, task, namespaceUID)
+}
+
+var _ = ginkgo.Describe("ACP dispatcher Session continuity", func() {
+	ginkgo.It("opens a SessionTurn through the composite store against a real API server", func() {
+		namespace := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{
+			Name: fmt.Sprintf("session-composite-%d", time.Now().UnixNano()),
+		}}
+		gomega.Expect(k8sClient.Create(ctx, namespace)).To(gomega.Succeed())
+		ginkgo.DeferCleanup(func() {
+			gomega.Expect(client.IgnoreNotFound(k8sClient.Delete(context.Background(), namespace))).To(gomega.Succeed())
+		})
+
+		task := runtimePoolReservationTestTask("session-composite", "11111111-2222-3333-4444-555555555555", "runtime-pool-uid")
+		task.Namespace = namespace.Name
+		task.Spec.Prompt = "first message in session"
+		task.Spec.SessionRef = &corev1alpha1.SessionReference{
+			Name: "session-composite", Create: true, Append: true,
+		}
+		task.Status.Attempts = 1
+		task.Status.Execution.State = corev1alpha1.TaskExecutionStateReserved
+		desiredStatus := *task.Status.DeepCopy()
+		task.UID = ""
+		task.Status = corev1alpha1.TaskStatus{}
+		gomega.Expect(k8sClient.Create(ctx, task)).To(gomega.Succeed())
+		task.Status = desiredStatus
+		task.Status.Execution.PromptID = "prompt-" + string(task.UID) + "-1"
+
+		testPrepareTaskSessionCompositeStoreOpensTurn(ginkgo.GinkgoT(), k8sClient, task, string(namespace.UID))
+	})
+})
+
+type sessionCompositeTestTB interface {
+	Helper()
+	Fatal(args ...any)
+	Fatalf(format string, args ...any)
+	Errorf(format string, args ...any)
+	Cleanup(func())
+	TempDir() string
+}
+
+func testPrepareTaskSessionCompositeStoreOpensTurn(
+	t sessionCompositeTestTB,
+	kubeClient client.Client,
+	task *corev1alpha1.Task,
+	namespaceUID string,
+) {
+	t.Helper()
+	const namespaceName = "orka-system"
+	if task.Namespace == "" {
+		task.Namespace = namespaceName
+	}
+
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "session-composite.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	sqliteStore := sqlite.NewStore(db, "session-composite-test")
+	controlStore, err := storekube.NewComposite(kubeClient, task.Namespace, sqliteStore, storekube.WithAPIReader(kubeClient))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	epochs := NewControllerEpochManager(controlStore, "session-composite-controller")
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	t.Cleanup(func() {
+		cancelEpoch()
+		if err := <-epochDone; err != nil {
+			t.Errorf("stop controller epoch manager: %v", err)
+		}
+	})
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	fence, err := epochs.CurrentFence(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	attemptKey := store.PromptAttemptKey{
+		Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1,
+		PromptID: task.Status.Execution.PromptID,
+	}
+	attempt, err := controlStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{
+		Key: attemptKey, RequestDigest: task.Status.Execution.RequestDigest,
+	}), fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	dispatcher := &ACPDispatcher{Client: kubeClient, APIReader: kubeClient, Store: controlStore}
+	if err := dispatcher.transitionAttempt(
+		ctx, attempt.ID, fence, store.PromptExecutionQueued, store.PromptExecutionReserved,
+		"reserve-session-composite", nil,
+	); err != nil {
+		t.Fatal(err)
+	}
+	continuity, err := NewACPSessionContinuity(ACPSessionContinuityConfig{
+		SessionControls: controlStore,
+		Transcripts:     sqliteStore,
+		Publications:    controlStore,
+		BranchClaims:    controlStore,
+		Lineages:        sqliteStore,
+		NewSessionUID:   func() (string, error) { return "session-composite-uid", nil },
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	dispatcher.Sessions = continuity
+
+	profileDigest := harnessv2.ProfileDigest(testControlDigestForDispatcher("session-composite-profile"))
+	session, err := dispatcher.prepareTaskSession(
+		ctx,
+		task,
+		fence,
+		profileDigest,
+		testControlDigestForDispatcher("session-composite-mcp"),
+		"runtime-instance",
+		"supervisor-boot",
+		acpSessionLineageIdentity{
+			NamespaceUID: namespaceUID, RuntimeIdentity: "claude", ConfigDigest: string(profileDigest),
+		},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if session == nil || session.Turn == nil || session.Turn.Turn.State != store.SessionTurnOpen {
+		t.Fatalf("prepared session = %#v, want an open SessionTurn", session)
+	}
+	persistedAttempt, err := controlStore.GetPromptAttempt(ctx, attempt.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if persistedAttempt.ExecutionState != store.PromptExecutionSessionStarting ||
+		persistedAttempt.SessionUID != session.Binding.SessionUID ||
+		persistedAttempt.SessionLeaseGeneration != session.LeaseGeneration {
+		t.Fatalf("prepared PromptAttempt = %#v, want the exact SessionTurn binding", persistedAttempt)
+	}
+	if _, err := sqliteStore.GetSessionLineage(ctx, task.Namespace, task.Spec.SessionRef.Name); err != nil {
+		t.Fatalf("load projected Session lineage: %v", err)
+	}
+}
diff --git a/internal/controller/acp_dispatcher_test.go b/internal/controller/acp_dispatcher_test.go
new file mode 100644
index 000000000..cdd77e165
--- /dev/null
+++ b/internal/controller/acp_dispatcher_test.go
@@ -0,0 +1,3536 @@
+package controller
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	coordinationv1 "k8s.io/api/coordination/v1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	types "k8s.io/apimachinery/pkg/types"
+	"k8s.io/utils/ptr"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/artifactcap"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/labels"
+	"github.com/orka-agents/orka/internal/publisher"
+	publisherservice "github.com/orka-agents/orka/internal/publisher/service"
+	"github.com/orka-agents/orka/internal/store"
+	kubestore "github.com/orka-agents/orka/internal/store/kube"
+	"github.com/orka-agents/orka/internal/store/sqlite"
+)
+
+// dispatchQueuedTask reserves the queued Task on its RuntimePool and executes
+// the reserved attempt, mirroring the dispatcher's production reserve/execute
+// sequence.
+func dispatchQueuedTask(ctx context.Context, t *testing.T, dispatcher *ACPDispatcher, queued *corev1alpha1.Task) {
+	t.Helper()
+	task, target, err := dispatcher.reserveTask(ctx, queued)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if task == nil {
+		t.Fatal("task was not reserved for ACP dispatch")
+	}
+	if err := dispatcher.executeReservedTask(ctx, task, target); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestCompletedPromptResultTextPrefersTerminalContent(t *testing.T) {
+	terminal := &harnessv2.Event{Completed: &harnessv2.CompletedEvent{Result: harnessv2.PromptResult{
+		Content: []harnessv2.ContentBlock{{Type: harnessv2.ContentBlockText, Text: `{"schemaVersion":1,"ok":true}`}},
+	}}}
+	got, err := completedPromptResultText(terminal, "commentary that must not become the result", true)
+	if err != nil {
+		t.Fatalf("terminal result selection: %v", err)
+	}
+	if got != `{"schemaVersion":1,"ok":true}` {
+		t.Fatalf("terminal result = %q", got)
+	}
+
+	got, err = completedPromptResultText(&harnessv2.Event{}, " legacy result ", false)
+	if err != nil || got != "legacy result" {
+		t.Fatalf("legacy fallback = %q, err=%v", got, err)
+	}
+	if _, err = completedPromptResultText(&harnessv2.Event{}, "truncated", true); err == nil {
+		t.Fatal("overflowed fallback without terminal result was accepted")
+	}
+}
+
+func prepareBoundACPDispatcherTaskForTest(
+	t *testing.T,
+	ctx context.Context,
+	kubeClient client.Client,
+	scheme *runtime.Scheme,
+	controlStore *sqlite.Store,
+	task *corev1alpha1.Task,
+	agent *corev1alpha1.Agent,
+	images ACPRuntimeImages,
+) *corev1alpha1.Task {
+	return prepareBoundACPDispatcherTaskWithStoresForTest(
+		t, ctx, kubeClient, scheme, controlStore, controlStore, task, agent, images,
+	)
+}
+
+func prepareBoundACPDispatcherTaskWithStoresForTest(
+	t *testing.T,
+	ctx context.Context,
+	kubeClient client.Client,
+	scheme *runtime.Scheme,
+	controlStore store.DurableControlStore,
+	persistence *sqlite.Store,
+	task *corev1alpha1.Task,
+	agent *corev1alpha1.Agent,
+	images ACPRuntimeImages,
+) *corev1alpha1.Task {
+	t.Helper()
+	cipher, err := sqlite.NewAgentExecutionSnapshotCipher(bytes.Repeat([]byte{0x61}, sqlite.AgentExecutionSnapshotKeyBytes))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := persistence.SetAgentExecutionSnapshotCipher(cipher); err != nil {
+		t.Fatal(err)
+	}
+	binder := &TaskReconciler{
+		Client:                  kubeClient,
+		APIReader:               kubeClient,
+		Scheme:                  scheme,
+		DurableControlStore:     controlStore,
+		AgentExecutionSnapshots: persistence,
+		ACPRuntimeEnabled:       true,
+		ACPRuntimeImages:        images,
+	}
+	bound := bindACPQueueTaskForTest(t, ctx, binder, task, agent)
+	verified, err := binder.loadVerifiedBoundExecution(ctx, bound, bound.Status.AgentExecutionBinding)
+	if err != nil {
+		t.Fatalf("load frozen dispatcher test execution: %v", err)
+	}
+	requestDigest, err := acpBoundTaskRequestDigest(
+		verified, bound.Status.Execution.Attempt, bound.Status.Execution.PromptID,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	current := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(bound), current); err != nil {
+		t.Fatal(err)
+	}
+	current.Status.Execution.RequestDigest = requestDigest
+	if err := kubeClient.Status().Update(ctx, current); err != nil {
+		t.Fatal(err)
+	}
+	if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(bound), current); err != nil {
+		t.Fatal(err)
+	}
+	return current
+}
+
+func frozenACPDispatcherPlanForTest(
+	t *testing.T,
+	task *corev1alpha1.Task,
+	agent *corev1alpha1.Agent,
+	images ACPRuntimeImages,
+) ACPRuntimePlan {
+	t.Helper()
+	configuration, err := buildACPAgentSessionConfiguration(task, agent, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	plan, err := PlanACPRuntimeWithConfiguration(task, agent, images, configuration)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return plan
+}
+
+func TestRuntimeSessionCreateTimeoutCoversColdAdapterInitialization(t *testing.T) {
+	t.Parallel()
+	minimum := time.Duration(corev1alpha1.DefaultRuntimePoolColdStartTimeoutSeconds) * time.Second
+	for _, test := range []struct {
+		name   string
+		target acpDispatchTarget
+		want   time.Duration
+	}{
+		{name: "external runtime", target: acpDispatchTarget{external: &corev1alpha1.AgentRuntime{}}, want: minimum},
+		{name: "unset pool timeout", target: acpDispatchTarget{pool: &corev1alpha1.RuntimePool{}}, want: minimum},
+		{name: "short pool timeout", target: acpDispatchTarget{pool: &corev1alpha1.RuntimePool{Spec: corev1alpha1.RuntimePoolSpec{ColdStartTimeoutSeconds: 30}}}, want: minimum},
+		{name: "long pool timeout", target: acpDispatchTarget{pool: &corev1alpha1.RuntimePool{Spec: corev1alpha1.RuntimePoolSpec{ColdStartTimeoutSeconds: 300}}}, want: 5 * time.Minute},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			if got := runtimeSessionCreateTimeout(test.target); got != test.want {
+				t.Fatalf("runtimeSessionCreateTimeout() = %s, want %s", got, test.want)
+			}
+		})
+	}
+}
+
+func TestACPTaskDeadlineIncludesTimeBeforeRuntimeAdmission(t *testing.T) {
+	t.Parallel()
+	now := time.Date(2026, time.July, 30, 12, 0, 0, 0, time.UTC)
+	timeout := metav1.Duration{Duration: 5 * time.Minute}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			CreationTimestamp: metav1.NewTime(now.Add(-4 * time.Minute)),
+			Annotations:       map[string]string{acpRuntimeQueuedAtAnnotation: now.Add(-time.Minute).Format(time.RFC3339Nano)},
+		},
+		Spec: corev1alpha1.TaskSpec{Timeout: &timeout},
+	}
+	deadline, ok := acpTaskDeadline(task, now)
+	if !ok || !deadline.Equal(now.Add(time.Minute)) {
+		t.Fatalf("deadline = %s, %v; want %s, true", deadline, ok, now.Add(time.Minute))
+	}
+
+	task.CreationTimestamp = metav1.Time{}
+	deadline, ok = acpTaskDeadline(task, now)
+	if !ok || !deadline.Equal(now.Add(4*time.Minute)) {
+		t.Fatalf("queue-derived deadline = %s, %v; want %s, true", deadline, ok, now.Add(4*time.Minute))
+	}
+}
+
+func TestRuntimeSessionStartFailureMessageAllowsOnlyKnownStages(t *testing.T) {
+	t.Parallel()
+	const fallback = "runtime session failed to start"
+	allowed := &harnessv2.ClientError{
+		StatusCode: http.StatusInternalServerError,
+		Code:       harnessv2.ErrorCodeSessionPoisoned,
+		Message:    "runtime session failed during provider adapter initialization",
+	}
+	if got := runtimeSessionStartFailureMessage(allowed); got != allowed.Message {
+		t.Fatalf("known stage message = %q", got)
+	}
+	status, code, diagnostic := runtimeSessionStartDiagnostic(allowed)
+	if status != http.StatusInternalServerError || code != harnessv2.ErrorCodeSessionPoisoned || diagnostic != allowed.Message {
+		t.Fatalf("known stage diagnostic = %d/%s/%q", status, code, diagnostic)
+	}
+	unknown := &harnessv2.ClientError{StatusCode: http.StatusBadRequest, Code: harnessv2.ErrorCodeInvalidRequest, Message: "runtime session failed during provider-secret-must-not-leak"}
+	if got := runtimeSessionStartFailureMessage(unknown); got != fallback {
+		t.Fatalf("unknown stage message = %q", got)
+	}
+	status, code, diagnostic = runtimeSessionStartDiagnostic(unknown)
+	if status != http.StatusBadRequest || code != harnessv2.ErrorCodeInvalidRequest || diagnostic != "runtime session request rejected before classified creation" {
+		t.Fatalf("unknown stage diagnostic = %d/%s/%q", status, code, diagnostic)
+	}
+	unknown.Message = "  fixed server detail\nwith control  "
+	if got := boundedRuntimeSessionServerMessage(unknown); got != "fixed server detail with control" {
+		t.Fatalf("bounded server message = %q", got)
+	}
+	if got := runtimeSessionStartFailureMessage(errors.New("raw-secret")); got != fallback {
+		t.Fatalf("raw error message = %q", got)
+	}
+}
+
+func TestRuntimeSessionCreationMayHaveApplied(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{name: "ambiguous write", err: &harnessv2.ClientError{WriteEvidence: harnessv2.RequestWriteEvidence{State: harnessv2.RequestWriteAmbiguous}}, want: true},
+		{name: "zero bytes", err: &harnessv2.ClientError{WriteEvidence: harnessv2.RequestWriteEvidence{State: harnessv2.RequestWriteZeroBytes}}, want: false},
+		{name: "definitive HTTP rejection", err: &harnessv2.ClientError{Kind: harnessv2.ClientErrorHTTP, StatusCode: http.StatusUnprocessableEntity, WriteEvidence: harnessv2.RequestWriteEvidence{State: harnessv2.RequestWriteComplete}}, want: false},
+		{name: "ambiguous server failure", err: &harnessv2.ClientError{Kind: harnessv2.ClientErrorHTTP, StatusCode: http.StatusInternalServerError, WriteEvidence: harnessv2.RequestWriteEvidence{State: harnessv2.RequestWriteComplete}}, want: true},
+		{name: "protocol failure after write", err: &harnessv2.ClientError{Kind: harnessv2.ClientErrorProtocol, StatusCode: http.StatusOK, WriteEvidence: harnessv2.RequestWriteEvidence{State: harnessv2.RequestWriteComplete}}, want: true},
+		{name: "non client error", err: errors.New("transport setup failed"), want: true},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := runtimeSessionCreationMayHaveApplied(tc.err); got != tc.want {
+				t.Fatalf("runtimeSessionCreationMayHaveApplied() = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestPublicationTerminalStateMapping(t *testing.T) {
+	t.Parallel()
+	for _, test := range []struct {
+		state store.PublicationState
+		want  harnessv2.PublicationTerminalState
+	}{
+		{store.PublicationVerifiedExact, harnessv2.PublicationTerminalVerifiedExact},
+		{store.PublicationDeliveredSuperseded, harnessv2.PublicationTerminalDeliveredSuperseded},
+		{store.PublicationCancelledBeforePublish, harnessv2.PublicationTerminalCancelledBeforePublish},
+		{store.PublicationDeliveryConflict, harnessv2.PublicationTerminalDeliveryConflict},
+		{store.PublicationCredentialBlocked, harnessv2.PublicationTerminalCredentialBlocked},
+		{store.PublicationPreparationFailed, harnessv2.PublicationTerminalPreparationFailed},
+		{store.PublicationOutcomeUnknown, harnessv2.PublicationTerminalOutcomeUnknown},
+	} {
+		got, err := publicationTerminalState(test.state)
+		if err != nil || got != test.want {
+			t.Fatalf("publicationTerminalState(%s) = %q, %v, want %q", test.state, got, err, test.want)
+		}
+	}
+	if _, err := publicationTerminalState(store.PublicationPublishing); err == nil {
+		t.Fatal("nonterminal publication state was accepted")
+	}
+}
+
+func TestFinalizeRuntimeSessionPublicationTreatsNotFoundAsSuccess(t *testing.T) {
+	var operationIDs []harnessv2.OperationID
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var request harnessv2.FinalizeRuntimeSessionPublicationRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Errorf("decode publication finalization: %v", err)
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		operationIDs = append(operationIDs, request.Metadata.OperationID)
+		writeDispatcherJSONStatus(w, http.StatusNotFound, harnessv2.ErrorResponse{
+			Protocol: harnessv2.ProtocolVersion, Code: harnessv2.ErrorCodeInvalidRequest, Message: "runtime session not found",
+		})
+	}))
+	defer server.Close()
+	runtimeClient, err := harnessv2.NewClient(
+		server.URL, harnessv2.WithControllerBearerToken(strings.Repeat("t", 32)),
+		harnessv2.WithOperationCapabilitySecret([]byte(strings.Repeat("s", 32))),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "finalize", UID: types.UID("88888888-8888-8888-8888-888888888888")},
+		Status:     corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{Attempt: 1, PromptID: "prompt-finalize"}},
+	}
+	fence := harnessv2.Fence{
+		RuntimeInstanceID: "runtime-instance", SupervisorBootID: "boot-id", ControllerEpoch: 1,
+		RuntimePoolUID: "pool-uid", RuntimePoolGeneration: 1, RuntimeProfileDigest: harnessv2.ProfileDigest(testControlDigestForDispatcher("finalize-profile")),
+		ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion, RuntimeSessionUID: "session-finalize", RuntimeSessionGeneration: 1,
+	}
+	finalization := runtimeSessionPublicationFinalization{
+		WorkspaceDeltaID: "delta-prompt-finalize", PublicationID: "publication-1", PublicationGeneration: 1, PublicationVersion: 7,
+		TerminalState: harnessv2.PublicationTerminalVerifiedExact, TerminalReceiptDigest: testControlDigestForDispatcher("receipt"),
+	}
+	dispatcher := &ACPDispatcher{}
+	for range 2 {
+		if err := dispatcher.finalizeRuntimeSessionPublication(
+			context.Background(), runtimeClient, "runtime-session-finalize-g1", task, fence, finalization,
+		); err != nil {
+			t.Fatalf("finalizeRuntimeSessionPublication(not found) = %v, want success", err)
+		}
+	}
+	if len(operationIDs) != 2 || operationIDs[0] == operationIDs[1] {
+		t.Fatalf("publication finalization operation IDs = %v, want two unique recovery-safe identities", operationIDs)
+	}
+	for _, operationID := range operationIDs {
+		if !strings.HasPrefix(string(operationID), "fp-") {
+			t.Fatalf("publication finalization operation ID = %q, want fp- prefix", operationID)
+		}
+	}
+}
+
+func TestDeleteRuntimeSessionTreatsNotFoundAsSuccess(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		writeDispatcherJSONStatus(w, http.StatusNotFound, harnessv2.ErrorResponse{
+			Protocol: harnessv2.ProtocolVersion, Code: harnessv2.ErrorCodeInvalidRequest,
+			Message: "runtime session not found", Retryable: false,
+		})
+	}))
+	defer server.Close()
+	runtimeClient, err := harnessv2.NewClient(
+		server.URL,
+		harnessv2.WithControllerBearerToken(strings.Repeat("t", 32)),
+		harnessv2.WithOperationCapabilitySecret([]byte(strings.Repeat("s", 32))),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "cleanup", UID: types.UID("99999999-9999-9999-9999-999999999999")},
+		Status:     corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{Attempt: 1, PromptID: "prompt-cleanup"}},
+	}
+	fence := harnessv2.Fence{
+		RuntimeInstanceID: "runtime-instance", SupervisorBootID: "boot-id", ControllerEpoch: 1,
+		RuntimePoolUID: "pool-uid", RuntimePoolGeneration: 1,
+		RuntimeProfileDigest: harnessv2.ProfileDigest(testControlDigestForDispatcher("cleanup-profile")), ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+		RuntimeSessionUID: "session-cleanup", RuntimeSessionGeneration: 1,
+	}
+	if err := (&ACPDispatcher{}).deleteRuntimeSession(context.Background(), runtimeClient, "runtime-session-cleanup-g1", task, fence, "test"); err != nil {
+		t.Fatalf("deleteRuntimeSession(not found) = %v, want success", err)
+	}
+}
+
+func TestDeleteRuntimeSessionAcceptsExactTombstoneReplay(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var request harnessv2.DeleteRuntimeSessionRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Errorf("decode delete replay: %v", err)
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		now := time.Now().UTC()
+		writeDispatcherJSON(w, harnessv2.DeleteRuntimeSessionResponse{
+			Protocol: harnessv2.ProtocolVersion,
+			Classification: harnessv2.Classification{
+				Class: harnessv2.RequestClassificationDuplicate, Phase: harnessv2.OperationPhaseDeleted,
+			},
+			State: harnessv2.RuntimeSessionStateDeleted,
+			Tombstone: harnessv2.RuntimeSessionTombstone{
+				RuntimeSessionUID:        request.Metadata.Fence.RuntimeSessionUID,
+				RuntimeSessionGeneration: request.Metadata.Fence.RuntimeSessionGeneration,
+				RuntimeProfileDigest:     request.Metadata.Fence.RuntimeProfileDigest,
+				DeletedAt:                now,
+				Operations: []harnessv2.OperationRecord{{
+					OperationID: request.Metadata.OperationID, RequestDigest: request.Metadata.RequestDigest,
+					Phase: harnessv2.OperationPhaseDeleted, RecordedAt: now, UpdatedAt: now,
+				}},
+			},
+		})
+	}))
+	defer server.Close()
+	runtimeClient, err := harnessv2.NewClient(
+		server.URL,
+		harnessv2.WithControllerBearerToken(strings.Repeat("t", 32)),
+		harnessv2.WithOperationCapabilitySecret([]byte(strings.Repeat("s", 32))),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "cleanup-replay", UID: types.UID("98989898-9898-9898-9898-989898989898")},
+		Status:     corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{Attempt: 1, PromptID: "prompt-cleanup-replay"}},
+	}
+	fence := harnessv2.Fence{
+		RuntimeInstanceID: "runtime-instance", SupervisorBootID: "boot-id", ControllerEpoch: 1,
+		RuntimePoolUID: "pool-uid", RuntimePoolGeneration: 1,
+		RuntimeProfileDigest:       harnessv2.ProfileDigest(testControlDigestForDispatcher("cleanup-replay-profile")),
+		ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+		RuntimeSessionUID:          "session-cleanup-replay",
+		RuntimeSessionGeneration:   1,
+	}
+	if err := (&ACPDispatcher{}).deleteRuntimeSession(
+		context.Background(), runtimeClient, "runtime-session-cleanup-replay-g1", task, fence, "retry",
+	); err != nil {
+		t.Fatalf("deleteRuntimeSession(tombstone replay) = %v, want success", err)
+	}
+}
+
+func TestPromptStreamDiagnosticIsBoundedAndClassified(t *testing.T) {
+	if got := promptStreamDiagnostic(fmt.Errorf("wrapped: %w", harnessv2.ErrMissingTerminalEvent)); got != "runtime stream ended without a terminal event" {
+		t.Fatalf("missing-terminal diagnostic = %q", got)
+	}
+	if got := promptStreamDiagnostic(fmt.Errorf("wrapped: %w", harnessv2.ErrEventRateExceeded)); got != "runtime update rate exceeded the negotiated limit" {
+		t.Fatalf("rate diagnostic = %q", got)
+	}
+	if got := promptStreamDiagnostic(fmt.Errorf("wrapped: %w", harnessv2.ErrEventByteRateExceeded)); got != "runtime update byte rate exceeded the protocol limit" {
+		t.Fatalf("byte-rate diagnostic = %q", got)
+	}
+	if got := promptStreamDiagnostic(errors.New("provider-secret-must-not-leak")); got != "non-client prompt stream error" {
+		t.Fatalf("generic diagnostic = %q", got)
+	}
+}
+
+func TestACPDispatcherExplicitRuntimeRPCFailureIsPromptFailed(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "rpc-failure.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	controlStore := sqlite.NewStore(db, "test")
+	epochs, stopEpoch := startACPRecoveryEpochManager(t, ctx, controlStore, "rpc-failure")
+	defer stopEpoch()
+	fence, err := epochs.CurrentFence(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	taskUID := types.UID("97979797-9797-9797-9797-979797979797")
+	promptID := "prompt-" + string(taskUID) + "-1"
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "rpc-failure", UID: taskUID},
+		Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Prompt: "fail explicitly"},
+		Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhaseRunning, Attempts: 1, Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateRunning, Attempt: 1, PromptID: promptID,
+			RequestDigest: testControlDigestForDispatcher("rpc-failure"), ControllerEpoch: fence.Epoch,
+		}},
+	}
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}).WithObjects(task).Build()
+	key := store.PromptAttemptKey{Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: promptID}
+	attempt, err := controlStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{Key: key, RequestDigest: task.Status.Execution.RequestDigest}), fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, next := range []store.PromptExecutionState{
+		store.PromptExecutionReserved, store.PromptExecutionSessionStarting, store.PromptExecutionPlanned,
+		store.PromptExecutionSubmitting, store.PromptExecutionAccepted, store.PromptExecutionRunning,
+	} {
+		operation := "rpc-failure-" + string(next)
+		attempt, err = controlStore.TransitionPromptAttemptExecution(ctx, store.PromptAttemptExecutionTransition{
+			ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+			NewState: next, OperationID: operation, OperationDigest: testControlDigestForDispatcher(operation), UpdatedAt: time.Now().UTC(),
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	dispatcher := &ACPDispatcher{Client: kubeClient, Store: controlStore, Epochs: epochs}
+	terminal := harnessv2.Event{
+		Protocol: harnessv2.ProtocolVersion,
+		Type:     harnessv2.EventFailed,
+		Failed: &harnessv2.FailedEvent{
+			StopReason: harnessv2.ACPStopReasonRefusal, Code: "acp_prompt_failed",
+			Message: "ACP prompt failed", Retryable: false,
+		},
+	}
+	if err := dispatcher.finishNonSuccess(ctx, task.DeepCopy(), attempt.ID, fence, nil, terminal); err != nil {
+		t.Fatal(err)
+	}
+	completed := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, completed); err != nil {
+		t.Fatal(err)
+	}
+	if completed.Status.Phase != corev1alpha1.TaskPhaseFailed || completed.Status.Execution == nil ||
+		completed.Status.Execution.State != corev1alpha1.TaskExecutionStateFailed ||
+		completed.Status.Execution.Outcome != corev1alpha1.TaskExecutionOutcomeFailed ||
+		completed.Status.Execution.Reason != corev1alpha1.TaskExecutionReason("PromptFailed") {
+		t.Fatalf("explicit runtime RPC failure status = %#v", completed.Status)
+	}
+	if completed.Status.Execution.Reason == corev1alpha1.TaskExecutionReason("RuntimeLost") ||
+		completed.Status.Execution.Outcome == corev1alpha1.TaskExecutionOutcomeOutcomeUnknown {
+		t.Fatalf("explicit runtime RPC failure was misclassified as runtime loss: %#v", completed.Status.Execution)
+	}
+	attempt, err = controlStore.GetPromptAttempt(ctx, attempt.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if attempt.ExecutionState != store.PromptExecutionFailed {
+		t.Fatalf("explicit runtime RPC failure attempt state = %s, want %s", attempt.ExecutionState, store.PromptExecutionFailed)
+	}
+}
+
+//nolint:goconst,gocyclo // Repeated literals and end-to-end assertions intentionally stay together.
+func TestACPDispatcherExecutesNoChangeTask(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := coordinationv1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	taskUID := types.UID("11111111-1111-1111-1111-111111111111")
+	promptID := "prompt-" + string(taskUID) + "-1"
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "task", UID: taskUID, Labels: map[string]string{acpRuntimeTaskPoolLabel: "pool"}},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent, Prompt: "respond briefly", AgentRuntime: &corev1alpha1.AgentRuntimeSpec{},
+			AgentRef:   &corev1alpha1.AgentReference{Name: "agent"},
+			SessionRef: &corev1alpha1.SessionReference{Name: "session", Create: true, Append: true},
+		},
+		Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhasePending, Attempts: 1, Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateQueued, Attempt: 1, PromptID: promptID, RuntimePoolName: "pool", RuntimePoolUID: "pool-uid",
+			RequestDigest: testControlDigestForDispatcher("task-request"), ControllerEpoch: 1,
+		}},
+	}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "agent", UID: types.UID("agent-uid"), Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model: &corev1alpha1.ModelConfig{Name: acpTestModel},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type: corev1alpha1.AgentRuntimeCodex, ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+		},
+	}
+	images := ACPRuntimeImages{Codex: "docker.io/example/acp@sha256:" + strings.Repeat("a", 64)}
+	plan := frozenACPDispatcherPlanForTest(t, task, agent, images)
+	profile := plan.Profile
+	profileDigest := plan.Digest
+	task.Labels[acpRuntimeTaskPoolLabel] = plan.PoolName
+	task.Status.Execution.RuntimePoolName = plan.PoolName
+	server := newDispatcherRuntimeServer(t, profile, profileDigest)
+	defer server.Close()
+	parsed, err := url.Parse(server.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	pool := &corev1alpha1.RuntimePool{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: plan.PoolName, UID: types.UID("pool-uid"), Generation: 1},
+		Spec: corev1alpha1.RuntimePoolSpec{
+			RuntimeNamespace: "orka-runtimes", Runtime: corev1alpha1.RuntimePoolRuntimeSpec{
+				Image: plan.Image, Profile: RuntimePoolProfileFromPlan(plan),
+			}, DesiredReplicas: 1,
+		},
+		Status: corev1alpha1.RuntimePoolStatus{
+			Lifecycle: corev1alpha1.RuntimePoolLifecycleServing, AdmissionState: corev1alpha1.RuntimePoolAdmissionAccepting,
+			ActiveInstance: &corev1alpha1.RuntimePoolActiveInstanceStatus{
+				PodNamespace: "orka-runtimes", PodName: "runtime-pod", PodAddress: parsed.Host,
+				PodUID: "pod-uid", BootID: "boot-id", RuntimeInstanceID: "pod-uid.boot-id", ControllerEpoch: 1,
+				ProtocolVersion: corev1alpha1.RuntimePoolProtocolHarnessV2, ProfileDigest: string(profileDigest), ProfileDigestSchemaVersion: strconv.FormatUint(uint64(harnessv2.ProfileDigestSchemaVersion), 10),
+			},
+		},
+	}
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "orka-runtimes", Name: "pool-auth", Labels: map[string]string{
+			runtimePoolAuthLabel: "true", runtimePoolUIDLabel: string(pool.UID),
+		}},
+		Data: map[string][]byte{runtimePoolControllerTokenKey: []byte(strings.Repeat("t", 32)), runtimePoolCapabilitySecretKey: []byte(strings.Repeat("s", 32))},
+	}
+	namespace := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{
+		Name: task.Namespace, UID: types.UID("default-namespace-uid"),
+	}}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(
+		&corev1alpha1.Task{}, &corev1alpha1.RuntimePool{}, &corev1alpha1.ControllerEpoch{},
+		&corev1alpha1.PromptAttempt{}, &corev1alpha1.RuntimeSessionControl{},
+		&corev1alpha1.BranchClaim{}, &corev1alpha1.Publication{}, &corev1alpha1.ExternalEffect{},
+	).WithObjects(task, pool, secret, agent, namespace).Build()
+	kubeClient = withControllerEpochLeaseUIDs(t, kubeClient)
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "store.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	persistence := sqlite.NewStore(db, "test")
+	controlStore, err := kubestore.NewComposite(kubeClient, "orka-system", persistence, kubestore.WithAPIReader(kubeClient))
+	if err != nil {
+		t.Fatal(err)
+	}
+	epochs := NewControllerEpochManager(controlStore, "controller-test").WithMirror(persistence)
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	fence, err := epochs.CurrentFence(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	task = prepareBoundACPDispatcherTaskWithStoresForTest(
+		t, ctx, kubeClient, scheme, controlStore, persistence, task, agent, images,
+	)
+	key := store.PromptAttemptKey{Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: promptID}
+	attemptID, err := key.CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := controlStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{
+		ID: attemptID, Key: key, RequestDigest: task.Status.Execution.RequestDigest,
+		BindingDigest: task.Status.AgentExecutionBinding.BindingDigest, SnapshotDigest: task.Status.AgentExecutionBinding.Snapshot.Digest,
+		ExecutionState: store.PromptExecutionQueued, DeliveryState: store.PromptDeliveryNotRequested,
+	}), fence); err != nil {
+		t.Fatal(err)
+	}
+	continuity, err := NewACPSessionContinuity(ACPSessionContinuityConfig{
+		SessionControls: controlStore, Transcripts: persistence, Publications: controlStore, BranchClaims: controlStore,
+		Lineages: persistence,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	dispatcher := &ACPDispatcher{
+		Client: kubeClient, APIReader: kubeClient, Store: controlStore, ResultStore: persistence,
+		Snapshots: persistence, Epochs: epochs, Sessions: continuity,
+	}
+	dispatchQueuedTask(ctx, t, dispatcher, task.DeepCopy())
+	completed := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, completed); err != nil {
+		t.Fatal(err)
+	}
+	if completed.Status.Phase != corev1alpha1.TaskPhaseSucceeded || completed.Status.Execution == nil || completed.Status.Execution.Outcome != corev1alpha1.TaskExecutionOutcomeSucceeded ||
+		completed.Status.Delivery == nil || completed.Status.Delivery.Outcome != corev1alpha1.TaskDeliveryOutcomeReadValidated ||
+		completed.Status.ResultRef == nil || !completed.Status.ResultRef.Available {
+		t.Fatalf("unexpected completed status: %#v", completed.Status)
+	}
+	result, err := persistence.GetResult(ctx, task.Namespace, task.Name)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(result) != "hello from runtime" {
+		t.Fatalf("result = %q", result)
+	}
+	transcript, err := persistence.LoadTranscript(ctx, "default", "session", 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(transcript) != 2 || transcript[0].Role != "user" || transcript[1].Role != "assistant" {
+		t.Fatalf("session transcript = %#v", transcript)
+	}
+	attempt, err := controlStore.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if attempt.ExecutionState != store.PromptExecutionSucceeded || attempt.DeliveryState != store.PromptDeliveryReadValidated {
+		t.Fatalf("attempt = %#v", attempt)
+	}
+	completedPool := &corev1alpha1.RuntimePool{}
+	if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: pool.Namespace, Name: pool.Name}, completedPool); err != nil {
+		t.Fatal(err)
+	}
+	if len(completedPool.Status.Capacity.Reservations) != 0 || completedPool.Status.Capacity.ReservedSessions != 0 || completedPool.Status.Capacity.ReservedPrompts != 0 {
+		t.Fatalf("capacity reservation leaked after acceptance: %#v", completedPool.Status.Capacity)
+	}
+	cancelEpoch()
+	if err := <-epochDone; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestACPDispatcherUsesFrozenAgentAndToolAfterLiveResourcesChange(t *testing.T) {
+	for _, test := range []struct {
+		name   string
+		change func(context.Context, client.Client, *corev1alpha1.Agent, *corev1alpha1.Tool) error
+	}{
+		{
+			name: "mutated",
+			change: func(ctx context.Context, kubeClient client.Client, agent *corev1alpha1.Agent, tool *corev1alpha1.Tool) error {
+				currentAgent := &corev1alpha1.Agent{}
+				if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(agent), currentAgent); err != nil {
+					return err
+				}
+				currentAgent.Generation++
+				currentAgent.Spec.Model.Name = "mutated-model"
+				currentAgent.Spec.Runtime.DefaultAllowedTools = []string{"different-tool"}
+				if err := kubeClient.Update(ctx, currentAgent); err != nil {
+					return err
+				}
+				currentTool := &corev1alpha1.Tool{}
+				if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(tool), currentTool); err != nil {
+					return err
+				}
+				currentTool.Generation++
+				currentTool.Spec.Description = "mutated tool description"
+				currentTool.Status.Endpoint = "https://mutated.example.test/tool"
+				return kubeClient.Update(ctx, currentTool)
+			},
+		},
+		{
+			name: "deleted",
+			change: func(ctx context.Context, kubeClient client.Client, agent *corev1alpha1.Agent, tool *corev1alpha1.Tool) error {
+				if err := kubeClient.Delete(ctx, agent.DeepCopy()); err != nil {
+					return err
+				}
+				return kubeClient.Delete(ctx, tool.DeepCopy())
+			},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+			defer cancel()
+			scheme := runtime.NewScheme()
+			if err := corev1alpha1.AddToScheme(scheme); err != nil {
+				t.Fatal(err)
+			}
+			if err := corev1.AddToScheme(scheme); err != nil {
+				t.Fatal(err)
+			}
+
+			const toolName = "frozen-custom-tool"
+			taskUID := types.UID("frozen-" + test.name + "-task-uid")
+			promptID := "prompt-" + string(taskUID) + "-1"
+			task := &corev1alpha1.Task{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: "default", Name: "frozen-" + test.name, UID: taskUID,
+					Labels: map[string]string{acpRuntimeTaskPoolLabel: "pending"},
+				},
+				Spec: corev1alpha1.TaskSpec{
+					Type: corev1alpha1.TaskTypeAgent, Prompt: "use the frozen configuration",
+					AgentRef: &corev1alpha1.AgentReference{Name: "frozen-agent"},
+				},
+				Status: corev1alpha1.TaskStatus{
+					Phase: corev1alpha1.TaskPhasePending, Attempts: 1,
+					Execution: &corev1alpha1.TaskExecutionStatus{
+						State: corev1alpha1.TaskExecutionStateQueued, Attempt: 1, PromptID: promptID,
+						RuntimePoolName: "pending", RuntimePoolUID: "frozen-pool-uid",
+						RequestDigest: testControlDigestForDispatcher("pre-binding-request"), ControllerEpoch: 1,
+					},
+				},
+			}
+			agent := &corev1alpha1.Agent{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: "default", Name: "frozen-agent", UID: types.UID("frozen-agent-uid"), Generation: 1,
+				},
+				Spec: corev1alpha1.AgentSpec{
+					Model: &corev1alpha1.ModelConfig{Name: acpTestModel},
+					Runtime: &corev1alpha1.AgentCLIRuntime{
+						Type: corev1alpha1.AgentRuntimeClaude, ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+						DefaultAllowedTools: []string{toolName},
+					},
+				},
+			}
+			tool := &corev1alpha1.Tool{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: "default", Name: toolName, UID: types.UID("frozen-tool-uid"), Generation: 1,
+				},
+				Spec: corev1alpha1.ToolSpec{
+					Description:       "original frozen tool description",
+					BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassRead,
+					HTTP:              &corev1alpha1.HTTPExecution{URL: "https://original.example.test/tool", Method: http.MethodPost},
+				},
+				Status: corev1alpha1.ToolStatus{Available: true, Endpoint: "https://original.example.test/tool"},
+			}
+			images := ACPRuntimeImages{Claude: "docker.io/example/claude@sha256:" + strings.Repeat("a", 64)}
+			plan := frozenACPDispatcherPlanForTest(t, task, agent, images)
+			task.Labels[acpRuntimeTaskPoolLabel] = plan.PoolName
+			task.Status.Execution.RuntimePoolName = plan.PoolName
+
+			createRequests := make(chan harnessv2.CreateRuntimeSessionRequest, 1)
+			server := newDispatcherRuntimeServer(t, plan.Profile, plan.Digest, func(request harnessv2.CreateRuntimeSessionRequest) {
+				createRequests <- request
+			})
+			defer server.Close()
+			parsed, err := url.Parse(server.URL)
+			if err != nil {
+				t.Fatal(err)
+			}
+			pool := &corev1alpha1.RuntimePool{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: "default", Name: plan.PoolName, UID: types.UID("frozen-pool-uid"), Generation: 1,
+				},
+				Spec: corev1alpha1.RuntimePoolSpec{
+					RuntimeNamespace: "orka-runtimes",
+					Runtime:          corev1alpha1.RuntimePoolRuntimeSpec{Image: plan.Image, Profile: RuntimePoolProfileFromPlan(plan)},
+					DesiredReplicas:  1,
+				},
+				Status: corev1alpha1.RuntimePoolStatus{
+					Lifecycle:      corev1alpha1.RuntimePoolLifecycleServing,
+					AdmissionState: corev1alpha1.RuntimePoolAdmissionAccepting,
+					ActiveInstance: &corev1alpha1.RuntimePoolActiveInstanceStatus{
+						PodNamespace: "orka-runtimes", PodName: "runtime-pod", PodAddress: parsed.Host,
+						PodUID: "pod-uid", BootID: "boot-id", RuntimeInstanceID: "pod-uid.boot-id", ControllerEpoch: 1,
+						ProtocolVersion:            corev1alpha1.RuntimePoolProtocolHarnessV2,
+						ProfileDigest:              string(plan.Digest),
+						ProfileDigestSchemaVersion: strconv.FormatUint(uint64(harnessv2.ProfileDigestSchemaVersion), 10),
+					},
+				},
+			}
+			secret := &corev1.Secret{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: "orka-runtimes", Name: "frozen-pool-auth",
+					Labels: map[string]string{runtimePoolAuthLabel: "true", runtimePoolUIDLabel: string(pool.UID)},
+				},
+				Data: map[string][]byte{
+					runtimePoolControllerTokenKey:  []byte(strings.Repeat("t", 32)),
+					runtimePoolCapabilitySecretKey: []byte(strings.Repeat("s", 32)),
+				},
+			}
+			kubeClient := fake.NewClientBuilder().WithScheme(scheme).
+				WithStatusSubresource(&corev1alpha1.Task{}, &corev1alpha1.RuntimePool{}).
+				WithObjects(task, pool, secret, agent, tool).Build()
+			db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "frozen-dispatch.db"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer db.Close() //nolint:errcheck
+			controlStore := sqlite.NewStore(db, "frozen-dispatch-test")
+			epochs, stopEpoch := startACPRecoveryEpochManager(t, ctx, controlStore, "frozen-"+test.name)
+			defer stopEpoch()
+			fence, err := epochs.CurrentFence(ctx)
+			if err != nil {
+				t.Fatal(err)
+			}
+			task = prepareBoundACPDispatcherTaskForTest(t, ctx, kubeClient, scheme, controlStore, task, agent, images)
+			verifier := TaskReconciler{
+				Client: kubeClient, APIReader: kubeClient,
+				AgentExecutionSnapshots: controlStore,
+			}
+			frozen, err := verifier.loadVerifiedBoundExecution(ctx, task, task.Status.AgentExecutionBinding)
+			if err != nil {
+				t.Fatal(err)
+			}
+			wantAgentConfiguration := frozen.configuration
+			wantMCPConfiguration := frozen.mcpConfiguration
+			wantDescriptor, ok := wantMCPConfiguration.ToolPolicy.Descriptor(toolName)
+			if !ok || wantDescriptor.Description != tool.Spec.Description || wantDescriptor.DefinitionDigest == "" {
+				t.Fatalf("frozen custom Tool descriptor = %#v", wantDescriptor)
+			}
+			attemptKey := store.PromptAttemptKey{
+				Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: promptID,
+			}
+			attemptID, err := attemptKey.CanonicalID()
+			if err != nil {
+				t.Fatal(err)
+			}
+			if _, err := controlStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{
+				ID: attemptID, Key: attemptKey, RequestDigest: task.Status.Execution.RequestDigest,
+				BindingDigest:  task.Status.AgentExecutionBinding.BindingDigest,
+				SnapshotDigest: task.Status.AgentExecutionBinding.Snapshot.Digest,
+				ExecutionState: store.PromptExecutionQueued, DeliveryState: store.PromptDeliveryNotRequested,
+			}), fence); err != nil {
+				t.Fatal(err)
+			}
+			if err := test.change(ctx, kubeClient, agent, tool); err != nil {
+				t.Fatal(err)
+			}
+
+			dispatcher := &ACPDispatcher{
+				Client: kubeClient, APIReader: kubeClient, Store: controlStore, ResultStore: controlStore,
+				Snapshots: controlStore, Epochs: epochs,
+			}
+			dispatchQueuedTask(ctx, t, dispatcher, task.DeepCopy())
+			var got harnessv2.CreateRuntimeSessionRequest
+			select {
+			case got = <-createRequests:
+			default:
+				t.Fatal("runtime did not receive CreateRuntimeSession")
+			}
+			if got.AgentConfiguration == nil || *got.AgentConfiguration != wantAgentConfiguration {
+				t.Fatalf("runtime Agent configuration = %#v, want frozen %#v", got.AgentConfiguration, wantAgentConfiguration)
+			}
+			if !got.MCPConfiguration.Matches(wantMCPConfiguration) {
+				t.Fatalf("runtime MCP configuration drifted from frozen snapshot: got=%#v want=%#v", got.MCPConfiguration, wantMCPConfiguration)
+			}
+			gotDescriptor, ok := got.MCPConfiguration.ToolPolicy.Descriptor(toolName)
+			if !ok || gotDescriptor.Description != wantDescriptor.Description ||
+				gotDescriptor.DefinitionDigest != wantDescriptor.DefinitionDigest {
+				t.Fatalf("runtime custom Tool descriptor = %#v, want frozen %#v", gotDescriptor, wantDescriptor)
+			}
+		})
+	}
+}
+
+//nolint:goconst,gocyclo // The end-to-end write-session lifecycle assertions intentionally stay together.
+func TestACPDispatcherWriteSessionFinalizesPublicationBeforeDeleteAndPersistsCleanupReceipt(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	taskUID := types.UID("12121212-1212-1212-1212-121212121212")
+	promptID := "prompt-" + string(taskUID) + "-1"
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "write-session", UID: taskUID, Labels: map[string]string{acpRuntimeTaskPoolLabel: "pool"}},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent, Prompt: "update the workspace", AgentRuntime: &corev1alpha1.AgentRuntimeSpec{},
+			AgentRef:   &corev1alpha1.AgentReference{Name: "agent"},
+			SessionRef: &corev1alpha1.SessionReference{Name: "write-session", Create: true, Append: true},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				Intent: corev1alpha1.WorkspaceIntentWrite, GitRepo: "https://github.com/orka-agents/orka.git", Ref: defaultACPSourceBranch,
+				ReadCredentialRef:            &corev1alpha1.WorkspaceCredentialReference{Name: "workspace-credential"},
+				PublicationGitRepo:           "https://github.com/orka-agents/orka.git",
+				PublicationReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "workspace-credential"},
+				PublicationCredentialRef:     &corev1alpha1.WorkspaceCredentialReference{Name: "workspace-credential"},
+				ForgeCredentialRef:           &corev1alpha1.WorkspaceCredentialReference{Name: "workspace-credential"},
+				CreatePR:                     true,
+				PRBaseBranch:                 "main",
+			},
+		},
+		Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhasePending, Attempts: 1, Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateQueued, Attempt: 1, PromptID: promptID, RuntimePoolName: "pool", RuntimePoolUID: "pool-uid",
+			RequestDigest: testControlDigestForDispatcher("write-session-request"), ControllerEpoch: 1,
+		}},
+	}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "agent", UID: types.UID("agent-uid"), Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model: &corev1alpha1.ModelConfig{Name: acpTestModel},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type: corev1alpha1.AgentRuntimeCodex, ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+		},
+	}
+	images := ACPRuntimeImages{Codex: "docker.io/example/acp@sha256:" + strings.Repeat("a", 64)}
+	plan := frozenACPDispatcherPlanForTest(t, task, agent, images)
+	profile := plan.Profile
+	profileDigest := plan.Digest
+	task.Labels[acpRuntimeTaskPoolLabel] = plan.PoolName
+	task.Status.Execution.RuntimePoolName = plan.PoolName
+	var operationMu sync.Mutex
+	operations := make([]string, 0, 2)
+	var finalizationRequest harnessv2.FinalizeRuntimeSessionPublicationRequest
+	runtimeServer := newDispatcherWriteRuntimeServer(
+		t, profile, profileDigest,
+		func(request harnessv2.FinalizeRuntimeSessionPublicationRequest) {
+			operationMu.Lock()
+			defer operationMu.Unlock()
+			operations = append(operations, "finalize")
+			finalizationRequest = request
+		},
+		func(harnessv2.DeleteRuntimeSessionRequest) {
+			operationMu.Lock()
+			defer operationMu.Unlock()
+			operations = append(operations, "delete")
+		},
+	)
+	defer runtimeServer.Close()
+	parsed, err := url.Parse(runtimeServer.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	pool := &corev1alpha1.RuntimePool{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: plan.PoolName, UID: types.UID("pool-uid"), Generation: 1},
+		Spec: corev1alpha1.RuntimePoolSpec{
+			RuntimeNamespace: "orka-runtimes", Runtime: corev1alpha1.RuntimePoolRuntimeSpec{
+				Image: plan.Image, Profile: RuntimePoolProfileFromPlan(plan),
+			}, DesiredReplicas: 1,
+		},
+		Status: corev1alpha1.RuntimePoolStatus{
+			Lifecycle: corev1alpha1.RuntimePoolLifecycleServing, AdmissionState: corev1alpha1.RuntimePoolAdmissionAccepting,
+			ActiveInstance: &corev1alpha1.RuntimePoolActiveInstanceStatus{
+				PodNamespace: "orka-runtimes", PodName: "runtime-pod", PodAddress: parsed.Host,
+				PodUID: "pod-uid", BootID: "boot-id", RuntimeInstanceID: "pod-uid.boot-id", ControllerEpoch: 1,
+				ProtocolVersion: corev1alpha1.RuntimePoolProtocolHarnessV2, ProfileDigest: string(profileDigest), ProfileDigestSchemaVersion: strconv.FormatUint(uint64(harnessv2.ProfileDigestSchemaVersion), 10),
+			},
+		},
+	}
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "orka-runtimes", Name: "pool-auth", Labels: map[string]string{
+			runtimePoolAuthLabel: "true", runtimePoolUIDLabel: string(pool.UID),
+		}},
+		Data: map[string][]byte{runtimePoolControllerTokenKey: []byte(strings.Repeat("t", 32)), runtimePoolCapabilitySecretKey: []byte(strings.Repeat("s", 32))},
+	}
+	workspaceCredential := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "default", Name: "workspace-credential", UID: types.UID("workspace-credential-uid"), ResourceVersion: "1",
+		},
+		Data: map[string][]byte{defaultACPWorkspaceCredentialKey: []byte("test-token")},
+	}
+	task.Status.Execution.ReadCredentialResourceVersion = workspaceCredential.ResourceVersion
+	task.Status.Execution.PublicationReadCredentialResourceVersion = workspaceCredential.ResourceVersion
+	task.Status.Execution.PublicationCredentialResourceVersion = workspaceCredential.ResourceVersion
+	task.Status.Execution.ForgeCredentialResourceVersion = workspaceCredential.ResourceVersion
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}, &corev1alpha1.RuntimePool{}).WithObjects(task, pool, secret, workspaceCredential, agent).Build()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "write-session.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	controlStore := sqlite.NewStore(db, "test")
+	epochs := NewControllerEpochManager(controlStore, "controller-write-session")
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	fence, err := epochs.CurrentFence(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	task = prepareBoundACPDispatcherTaskForTest(t, ctx, kubeClient, scheme, controlStore, task, agent, images)
+	key := store.PromptAttemptKey{Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: promptID}
+	attemptID, err := key.CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	credentialBindings := make([]store.PromptCredentialBinding, 0, 4)
+	for _, role := range []store.PromptCredentialRole{
+		store.PromptCredentialSourceRead, store.PromptCredentialTargetRead,
+		store.PromptCredentialTargetWrite, store.PromptCredentialForge,
+	} {
+		credentialBindings = append(credentialBindings, store.PromptCredentialBinding{
+			Role: role, Namespace: task.Namespace, SecretName: workspaceCredential.Name,
+			SecretKey: defaultACPWorkspaceCredentialKey, SecretUID: string(workspaceCredential.UID),
+			ResourceVersion: workspaceCredential.ResourceVersion,
+		})
+	}
+	if _, err := controlStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{
+		ID: attemptID, Key: key, RequestDigest: task.Status.Execution.RequestDigest,
+		BindingDigest: task.Status.AgentExecutionBinding.BindingDigest, SnapshotDigest: task.Status.AgentExecutionBinding.Snapshot.Digest,
+		CredentialBindings: credentialBindings,
+		ExecutionState:     store.PromptExecutionQueued, DeliveryState: store.PromptDeliveryNotRequested,
+	}), fence); err != nil {
+		t.Fatal(err)
+	}
+	recordingControls := &orderedSessionControlStore{
+		SessionControlStore: controlStore,
+		onFinalized: func() {
+			operationMu.Lock()
+			defer operationMu.Unlock()
+			operations = append(operations, "settle")
+		},
+	}
+	continuity, err := NewACPSessionContinuity(ACPSessionContinuityConfig{
+		SessionControls: recordingControls, Transcripts: controlStore, Publications: controlStore, BranchClaims: controlStore,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	baselineOID := strings.Repeat("1", 40)
+	treeOID := strings.Repeat("2", 40)
+	commitOID := strings.Repeat("3", 40)
+	bundleDigest := "sha256:" + strings.Repeat("4", 64)
+	publisherServer := newDispatcherPublisherServer(t, treeOID, commitOID, bundleDigest)
+	defer publisherServer.Close()
+	publisherClient, err := publisherservice.NewClient(publisherservice.ClientConfig{
+		BaseURL: publisherServer.URL, BearerToken: []byte(strings.Repeat("b", 32)),
+		CapabilitySecret: []byte(strings.Repeat("c", 32)), HTTPClient: publisherServer.Client(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	dispatcher := &ACPDispatcher{
+		Client: kubeClient, APIReader: kubeClient, Store: controlStore, ResultStore: controlStore, Epochs: epochs,
+		Snapshots: controlStore,
+		Sessions:  continuity, Publisher: publisherClient, ArtifactCapabilitySecret: []byte(strings.Repeat("d", 32)),
+		ArtifactReservations: acceptingArtifactReservations{},
+	}
+	dispatchQueuedTask(ctx, t, dispatcher, task.DeepCopy())
+	completed := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, completed); err != nil {
+		t.Fatal(err)
+	}
+	if completed.Status.Phase != corev1alpha1.TaskPhaseSucceeded || completed.Status.Execution == nil ||
+		completed.Status.Execution.Outcome != corev1alpha1.TaskExecutionOutcomeSucceeded || completed.Status.Delivery == nil ||
+		completed.Status.Delivery.Outcome != corev1alpha1.TaskDeliveryOutcomeVerifiedExact || completed.Status.Delivery.StartingSHA != baselineOID {
+		t.Fatalf("unexpected completed write status: status=%#v execution=%#v delivery=%#v", completed.Status, completed.Status.Execution, completed.Status.Delivery)
+	}
+	publication, err := controlStore.GetPublication(ctx, publicationIDForTask(completed))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if publication.SourceRef != baselineOID {
+		t.Fatalf("publication source ref = %q, want immutable baseline %q", publication.SourceRef, baselineOID)
+	}
+	wantCleanupDigest, err := taskScopedRuntimeSessionCleanupDigest(
+		completed.UID, completed.Status.Execution.Attempt, completed.Status.Execution.RuntimeInstanceID,
+		completed.Status.Execution.RuntimeSessionUID, completed.Status.Execution.RuntimeSessionGeneration,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if completed.Status.Execution.RuntimeSessionCleanupDigest != wantCleanupDigest {
+		t.Fatalf("cleanup receipt = %q, want %q", completed.Status.Execution.RuntimeSessionCleanupDigest, wantCleanupDigest)
+	}
+	operationMu.Lock()
+	gotOperations := append([]string(nil), operations...)
+	gotFinalization := finalizationRequest
+	operationMu.Unlock()
+	if fmt.Sprint(gotOperations) != "[finalize settle delete]" {
+		t.Fatalf("runtime cleanup operations = %v, want publication finalization, Session settlement, then deletion", gotOperations)
+	}
+	if gotFinalization.WorkspaceDeltaID != harnessv2.WorkspaceDeltaID("delta-"+promptID) ||
+		gotFinalization.PublicationID != publicationIDForTask(completed) ||
+		gotFinalization.TerminalState != harnessv2.PublicationTerminalVerifiedExact || gotFinalization.TerminalReceiptDigest == "" {
+		t.Fatalf("publication finalization request = %#v", gotFinalization)
+	}
+	cancelEpoch()
+	if err := <-epochDone; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestACPDispatcherDeletesTaskScopedRuntimeSessionAfterTimeoutCancellation(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	taskUID := types.UID("66666666-6666-6666-6666-666666666666")
+	promptID := "prompt-" + string(taskUID) + "-1"
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "timeout-task", UID: taskUID, Labels: map[string]string{acpRuntimeTaskPoolLabel: "pool"}},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent, Prompt: "block until timeout", AgentRuntime: &corev1alpha1.AgentRuntimeSpec{},
+			AgentRef: &corev1alpha1.AgentReference{Name: "agent"}, Timeout: &metav1.Duration{Duration: 30 * time.Second},
+		},
+		Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhasePending, Attempts: 1, Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateQueued, Attempt: 1, PromptID: promptID, RuntimePoolName: "pool", RuntimePoolUID: "pool-uid",
+			RequestDigest: testControlDigestForDispatcher("timeout-task-request"), ControllerEpoch: 1,
+		}},
+	}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "agent", UID: types.UID("agent-uid"), Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model: &corev1alpha1.ModelConfig{Name: acpTestModel},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type: corev1alpha1.AgentRuntimeCodex, ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+		},
+	}
+	images := ACPRuntimeImages{Codex: "docker.io/example/acp@sha256:" + strings.Repeat("a", 64)}
+	plan := frozenACPDispatcherPlanForTest(t, task, agent, images)
+	profile := plan.Profile
+	profileDigest := plan.Digest
+	task.Labels[acpRuntimeTaskPoolLabel] = plan.PoolName
+	task.Status.Execution.RuntimePoolName = plan.PoolName
+	var deleteCalls atomic.Int32
+	deadlineCancels := make(chan context.CancelCauseFunc, 1)
+	server := newDispatcherTimeoutRuntimeServer(t, profile, profileDigest, &deleteCalls, func() {
+		(<-deadlineCancels)(context.DeadlineExceeded)
+	})
+	defer server.Close()
+	parsed, err := url.Parse(server.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	pool := &corev1alpha1.RuntimePool{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: plan.PoolName, UID: types.UID("pool-uid"), Generation: 1},
+		Spec: corev1alpha1.RuntimePoolSpec{
+			RuntimeNamespace: "orka-runtimes", Runtime: corev1alpha1.RuntimePoolRuntimeSpec{
+				Image: plan.Image, Profile: RuntimePoolProfileFromPlan(plan),
+			}, DesiredReplicas: 1,
+		},
+		Status: corev1alpha1.RuntimePoolStatus{
+			Lifecycle: corev1alpha1.RuntimePoolLifecycleServing, AdmissionState: corev1alpha1.RuntimePoolAdmissionAccepting,
+			ActiveInstance: &corev1alpha1.RuntimePoolActiveInstanceStatus{
+				PodNamespace: "orka-runtimes", PodName: "runtime-pod", PodAddress: parsed.Host,
+				PodUID: "pod-uid", BootID: "boot-id", RuntimeInstanceID: "pod-uid.boot-id", ControllerEpoch: 1,
+				ProtocolVersion: corev1alpha1.RuntimePoolProtocolHarnessV2, ProfileDigest: string(profileDigest), ProfileDigestSchemaVersion: strconv.FormatUint(uint64(harnessv2.ProfileDigestSchemaVersion), 10),
+			},
+		},
+	}
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "orka-runtimes", Name: "pool-auth", Labels: map[string]string{
+			runtimePoolAuthLabel: "true", runtimePoolUIDLabel: string(pool.UID),
+		}},
+		Data: map[string][]byte{runtimePoolControllerTokenKey: []byte(strings.Repeat("t", 32)), runtimePoolCapabilitySecretKey: []byte(strings.Repeat("s", 32))},
+	}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}, &corev1alpha1.RuntimePool{}).WithObjects(task, pool, secret, agent).Build()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "timeout-store.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	controlStore := sqlite.NewStore(db, "test")
+	epochs := NewControllerEpochManager(controlStore, "controller-timeout-test")
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	fence, err := epochs.CurrentFence(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	task = prepareBoundACPDispatcherTaskForTest(t, ctx, kubeClient, scheme, controlStore, task, agent, images)
+	key := store.PromptAttemptKey{Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: promptID}
+	attemptID, err := key.CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := controlStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{
+		ID: attemptID, Key: key, RequestDigest: task.Status.Execution.RequestDigest,
+		BindingDigest: task.Status.AgentExecutionBinding.BindingDigest, SnapshotDigest: task.Status.AgentExecutionBinding.Snapshot.Digest,
+		ExecutionState: store.PromptExecutionQueued, DeliveryState: store.PromptDeliveryNotRequested,
+	}), fence); err != nil {
+		t.Fatal(err)
+	}
+	dispatcher := &ACPDispatcher{
+		Client: kubeClient, APIReader: kubeClient, Store: controlStore, ResultStore: controlStore, Epochs: epochs,
+		Snapshots: controlStore,
+		runtimeContextFactory: func(parent context.Context, _ *corev1alpha1.Task) (context.Context, context.CancelFunc) {
+			runtimeCtx, cancelCause := context.WithCancelCause(parent)
+			deadlineCancels <- cancelCause
+			return runtimeCtx, func() { cancelCause(context.Canceled) }
+		},
+	}
+	dispatchQueuedTask(ctx, t, dispatcher, task.DeepCopy())
+	completed := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, completed); err != nil {
+		t.Fatal(err)
+	}
+	if completed.Status.Phase != corev1alpha1.TaskPhaseCancelled || completed.Status.Execution == nil || completed.Status.Execution.Outcome != corev1alpha1.TaskExecutionOutcomeCancelled {
+		t.Fatalf("unexpected timeout status: %#v", completed.Status)
+	}
+	if got := deleteCalls.Load(); got != 1 {
+		t.Fatalf("RuntimeSession DELETE calls = %d, want 1", got)
+	}
+	attempt, err := controlStore.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if attempt.ExecutionState != store.PromptExecutionCancelled {
+		t.Fatalf("attempt execution state = %s, want %s", attempt.ExecutionState, store.PromptExecutionCancelled)
+	}
+	cancelEpoch()
+	if err := <-epochDone; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestACPDispatcherOpensSessionTurnBeforePrePromptFailureAndReleasesLease(t *testing.T) {
+	ctx := context.Background()
+	controlStore, fence, closeStore := newACPSessionTestStore(t, filepath.Join(t.TempDir(), "pre-prompt.db"))
+	defer closeStore()
+	continuity := newACPSessionTestContinuity(t, controlStore, ACPBootstrapLimits{})
+	taskUID := types.UID("55555555-5555-5555-5555-555555555555")
+	promptID := "prompt-" + string(taskUID) + "-1"
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "ns", Name: "pre-prompt", UID: taskUID},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent, Prompt: "fail before runtime creation",
+			SessionRef: &corev1alpha1.SessionReference{Name: "pre-prompt", Create: true, Append: true},
+		},
+		Status: corev1alpha1.TaskStatus{Attempts: 1, Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateReserved, Attempt: 1, PromptID: promptID,
+			RequestDigest: testControlDigestForDispatcher("pre-prompt"), ControllerEpoch: fence.Epoch,
+		}},
+	}
+	key := store.PromptAttemptKey{Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: promptID}
+	attempt, err := controlStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{Key: key, RequestDigest: task.Status.Execution.RequestDigest}), fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	attempt, err = controlStore.TransitionPromptAttemptExecution(ctx, store.PromptAttemptExecutionTransition{
+		ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+		NewState: store.PromptExecutionReserved, OperationID: "reserve-pre-prompt",
+		OperationDigest: testControlDigestForDispatcher("reserve-pre-prompt"), UpdatedAt: time.Now().UTC(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	dispatcher := &ACPDispatcher{Store: controlStore, Sessions: continuity, runtimeSessions: make(map[string]ACPRuntimeSessionBinding)}
+	session, err := dispatcher.prepareTaskSession(
+		ctx, task, fence, harnessv2.ProfileDigest(testControlDigestForDispatcher("profile-pre-prompt")),
+		testControlDigestForDispatcher("mcp-pre-prompt"),
+		harnessv2.RuntimeInstanceID("runtime-instance"), harnessv2.SupervisorBootID("boot-id"),
+		acpSessionLineageIdentity{},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if session == nil || session.Turn == nil || session.Turn.Turn.State != store.SessionTurnOpen {
+		t.Fatalf("SessionTurn was not opened immediately after lease acquisition: %#v", session)
+	}
+	attempt, err = controlStore.GetPromptAttempt(ctx, attempt.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if attempt.ExecutionState != store.PromptExecutionSessionStarting || attempt.SessionUID == "" || attempt.SessionLeaseGeneration < 1 {
+		t.Fatalf("PromptAttempt was not bound before opening SessionTurn: %#v", attempt)
+	}
+	attempt, err = controlStore.RecoverPromptAttemptPreSubmission(ctx, store.PromptAttemptPreSubmissionRecovery{
+		ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+		OperationID: "retry-pre-prompt", OperationDigest: testControlDigestForDispatcher("retry-pre-prompt"),
+		RecoveredAt: time.Now().UTC(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	retried, err := dispatcher.prepareTaskSession(
+		ctx, task, fence, harnessv2.ProfileDigest(testControlDigestForDispatcher("profile-pre-prompt")),
+		testControlDigestForDispatcher("mcp-pre-prompt"),
+		harnessv2.RuntimeInstanceID("runtime-instance"), harnessv2.SupervisorBootID("boot-id"),
+		acpSessionLineageIdentity{},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if retried == nil || retried.Turn == nil || retried.Turn.Turn.ID != session.Turn.Turn.ID {
+		t.Fatalf("pre-submission retry did not reuse the open SessionTurn: first=%#v retry=%#v", session, retried)
+	}
+	session = retried
+	if err := dispatcher.transitionAttemptToTerminal(ctx, attempt.ID, fence, store.PromptExecutionFailed, "pre-prompt-failed"); err != nil {
+		t.Fatal(err)
+	}
+	if err := dispatcher.reconcileUnfinalizedTaskSession(ctx, task, fence, session, errors.New("workspace preparation failed")); err != nil {
+		t.Fatal(err)
+	}
+	finalizedTurn, err := controlStore.GetSessionTurn(ctx, session.Turn.Turn.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if finalizedTurn.State != store.SessionTurnFinalized || finalizedTurn.TerminalKind != store.SessionTurnOutcomeMarker {
+		t.Fatalf("pre-prompt failure did not finalize SessionTurn: %#v", finalizedTurn)
+	}
+	control, err := controlStore.GetSessionControl(ctx, task.Namespace, task.Spec.SessionRef.Name)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if control.Lease != nil {
+		t.Fatalf("pre-prompt failure leaked Session mutation lease: %#v", control.Lease)
+	}
+}
+
+//nolint:gocyclo // The explicit state-machine branches are easier to audit together.
+func TestACPDispatcherPublishesPreparedWorkspaceDelta(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	taskUID := types.UID("22222222-2222-2222-2222-222222222222")
+	promptID := "prompt-" + string(taskUID) + "-1"
+	baselineOID := strings.Repeat("1", 40)
+	sessionUID := "session-publication-test"
+	targetRef := "refs/heads/orka/session-" + sessionUID
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "write-task", UID: taskUID, CreationTimestamp: metav1.NewTime(time.Date(2026, 7, 25, 12, 0, 0, 0, time.UTC))},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent, Prompt: "update the workspace",
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				Intent: corev1alpha1.WorkspaceIntentWrite, GitRepo: "https://github.com/orka-agents/orka.git", Branch: "main", Ref: baselineOID,
+				SubPath:                      "services/app",
+				PublicationGitRepo:           "https://github.com/sozercan/orka-fork.git",
+				PublicationReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "github-read"},
+				PublicationCredentialRef:     &corev1alpha1.WorkspaceCredentialReference{Name: "github-publish"},
+				ForgeCredentialRef:           &corev1alpha1.WorkspaceCredentialReference{Name: "github-forge"},
+				CreatePR:                     true, PRBaseBranch: "main",
+			},
+		},
+		Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhaseRunning, Attempts: 1, Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateSucceeded, Outcome: corev1alpha1.TaskExecutionOutcomeSucceeded,
+			Attempt: 1, PromptID: promptID, RequestDigest: testControlDigestForDispatcher("write-task"), ControllerEpoch: 1,
+		}},
+	}
+
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}).WithObjects(task).Build()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "store.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	controlStore := sqlite.NewStore(db, "test")
+	epochs := NewControllerEpochManager(controlStore, "controller-test")
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	fence, err := epochs.CurrentFence(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	claimID, err := store.CanonicalBranchClaimID("github.com/sozercan/orka-fork", targetRef)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := controlStore.CreateBranchClaim(ctx, &store.BranchClaim{
+		ID: claimID, RepositoryID: "github.com/sozercan/orka-fork", Ref: targetRef,
+		OwnerKind: store.BranchClaimOwnerSession, OwnerUID: sessionUID, Generation: 1,
+		LastVerified: store.RemoteRefState{SHA: baselineOID}, Availability: store.BranchClaimAvailable,
+		RequestDigest: testControlDigestForDispatcher("existing-session-branch"), CreatedAt: time.Now().UTC(),
+	}, fence); err != nil {
+		t.Fatal(err)
+	}
+	key := store.PromptAttemptKey{Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: promptID}
+	attemptID, err := key.CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	attempt, err := controlStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{
+		ID: attemptID, Key: key, RequestDigest: task.Status.Execution.RequestDigest,
+		ExecutionState: store.PromptExecutionQueued, DeliveryState: store.PromptDeliveryNotRequested,
+	}), fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	attempt = completeACPAttemptExecutionForTest(t, controlStore, fence, attempt, false)
+	transitionDigest := testControlDigestForDispatcher("delivery-validating")
+	_, err = controlStore.TransitionPromptAttemptDelivery(ctx, store.PromptAttemptDeliveryTransition{
+		ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: store.PromptDeliveryNotRequested,
+		NewState: store.PromptDeliveryValidating, OperationID: "delivery-validating", OperationDigest: transitionDigest, UpdatedAt: time.Now().UTC(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	treeOID := strings.Repeat("2", 40)
+	commitOID := strings.Repeat("3", 40)
+	bundleDigest := "sha256:" + strings.Repeat("4", 64)
+	deltaDigest := "sha256:" + strings.Repeat("5", 64)
+	deltaID, err := artifactcap.ArtifactIDForDigest(deltaDigest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	prIntents := make(chan publisher.PullRequestIntent, 1)
+	prepareRoots := make(chan string, 1)
+	publishRoots := make(chan string, 1)
+	publisherServer := newDispatcherPublisherServer(t, treeOID, commitOID, bundleDigest, dispatcherPublisherServerOptions{
+		inspectPullRequest: func(intent publisher.PullRequestIntent) { prIntents <- intent },
+		inspectPrepare:     func(request publisherservice.PublicationPrepareRequest) { prepareRoots <- request.Request.RelativeRoot },
+		inspectPublish: func(request publisherservice.PublicationPublishRequest) {
+			publishRoots <- request.Prepared.RelativeRoot
+		},
+	})
+	defer publisherServer.Close()
+	publisherClient, err := publisherservice.NewClient(publisherservice.ClientConfig{
+		BaseURL: publisherServer.URL, BearerToken: []byte(strings.Repeat("b", 32)),
+		CapabilitySecret: []byte(strings.Repeat("c", 32)), HTTPClient: publisherServer.Client(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ambiguousPublicationStore := &persistPublicationThenErrorStore{DurableControlStore: controlStore}
+	dispatcher := &ACPDispatcher{Client: kubeClient, APIReader: kubeClient, Store: ambiguousPublicationStore, ResultStore: controlStore, Epochs: epochs, Publisher: publisherClient}
+	delta := harnessv2.WorkspaceDeltaDescriptor{
+		DeltaID: "delta-1", RuntimeSessionUID: "runtime-session-1", SessionGeneration: 1,
+		State: harnessv2.WorkspaceDeltaPrepared, Intent: harnessv2.WorkspaceIntentWrite,
+		VerifiedBaseline: harnessv2.WorkspaceBaseline{RepositoryIdentity: "github.com/sozercan/orka-fork", Revision: baselineOID, TreeDigest: "sha256:" + strings.Repeat("6", 64)},
+		RelativeRoot:     "services/app",
+		ManifestDigest:   "sha256:" + strings.Repeat("7", 64),
+		Artifact:         &harnessv2.ArtifactReference{ArtifactID: harnessv2.ArtifactID(deltaID), Digest: deltaDigest, SizeBytes: 128, MediaType: artifactcap.MediaTypeWorkspaceDelta},
+		EntryCount:       1, ChangedFileCount: 1, NoFollowVerified: true, PublicationSafe: true, FrozenAt: time.Now().UTC(),
+	}
+	session := &acpTaskSession{
+		Binding: ACPRuntimeSessionBinding{SessionUID: sessionUID},
+		VerifiedBaseline: &store.VerifiedBranchBaseline{
+			RepositoryID: "github.com/sozercan/orka-fork", Ref: targetRef, SHA: baselineOID,
+		},
+	}
+	result, err := dispatcher.publishWorkspaceDelta(ctx, task, attemptID, fence, delta.VerifiedBaseline, delta, session)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.Status.Outcome != corev1alpha1.TaskDeliveryOutcomeVerifiedExact || result.Status.ExpectedCommitSHA != commitOID || result.Status.VerifiedRemoteSHA != commitOID ||
+		result.Status.PRReceipt == nil || result.Status.PRReceipt.ID != "42" || result.Status.PRReceipt.HeadSHA != commitOID {
+		t.Fatalf("publication result = %#v", result)
+	}
+	select {
+	case root := <-prepareRoots:
+		if root != "services/app" {
+			t.Fatalf("publisher prepare relative root = %q, want services/app", root)
+		}
+	default:
+		t.Fatal("publisher did not receive the workspace relative root")
+	}
+	select {
+	case root := <-publishRoots:
+		if root != "services/app" {
+			t.Fatalf("publisher publish relative root = %q, want services/app", root)
+		}
+	default:
+		t.Fatal("publisher publish did not receive the prepared workspace relative root")
+	}
+	select {
+	case intent := <-prIntents:
+		if intent.BaseRepository.ID != "github.com/orka-agents/orka" || intent.HeadRepository.ID != "github.com/sozercan/orka-fork" {
+			t.Fatalf("continuation PR repositories = base %#v head %#v", intent.BaseRepository, intent.HeadRepository)
+		}
+	default:
+		t.Fatal("publisher did not receive a pull request intent")
+	}
+	publicationRecord, err := controlStore.GetPublication(ctx, result.PublicationID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if publicationRecord.State != store.PublicationVerifiedExact || publicationRecord.PreparedReceipt == nil || publicationRecord.PublishReceipt == nil || publicationRecord.VerificationReceipt == nil ||
+		publicationRecord.PullRequestReceipt == nil || publicationRecord.PullRequestReceipt.ForgeID != "42" ||
+		publicationRecord.SourceRef != baselineOID || publicationRecord.TargetRef != targetRef ||
+		publicationRecord.Baseline.Absent || publicationRecord.Baseline.SHA != baselineOID {
+		t.Fatalf("publication = %#v", publicationRecord)
+	}
+	attempt, err = controlStore.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if attempt.DeliveryState != store.PromptDeliveryVerifiedExact {
+		t.Fatalf("delivery state = %s", attempt.DeliveryState)
+	}
+	claim, err := controlStore.GetBranchClaim(ctx, publicationRecord.BranchClaimID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if claim.LastVerified.SHA != baselineOID || claim.LastVerified.Absent {
+		t.Fatalf("branch claim = %#v", claim)
+	}
+	publishEffectID, err := (store.ExternalEffectIdentity{
+		Kind: "publisher.publish", Namespace: task.Namespace, AggregateID: result.PublicationID,
+		OperationID: publicationOperationID("publish", task),
+	}).CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	publishEffect, err := controlStore.GetExternalEffect(ctx, publishEffectID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if publishEffect.State != store.ExternalEffectSucceeded || len(publishEffect.Response) == 0 {
+		t.Fatalf("publish effect = %#v", publishEffect)
+	}
+	cancelEpoch()
+	if err := <-epochDone; err != nil {
+		t.Fatal(err)
+	}
+}
+
+type acceptingArtifactReservations struct{}
+
+func (acceptingArtifactReservations) Reserve(context.Context, artifactcap.OperationRequest, time.Time) error {
+	return nil
+}
+
+type dispatcherPublisherServerOptions struct {
+	inspectPrepare     func(publisherservice.PublicationPrepareRequest)
+	inspectPublish     func(publisherservice.PublicationPublishRequest)
+	inspectPullRequest func(publisher.PullRequestIntent)
+}
+
+func newDispatcherPublisherServer(t *testing.T, treeOID, commitOID, bundleDigest string, options ...dispatcherPublisherServerOptions) *httptest.Server {
+	t.Helper()
+	bundleArtifactID, err := artifactcap.ArtifactIDForDigest(bundleDigest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	workspaceDigest := "sha256:" + strings.Repeat("9", 64)
+	workspaceArtifactID, err := artifactcap.ArtifactIDForDigest(workspaceDigest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		switch r.URL.Path {
+		case publisherservice.WorkspaceResolvePath:
+			var request publisherservice.WorkspaceResolveRequest
+			if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+				t.Errorf("decode workspace resolve: %v", err)
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			}
+			resolvedRef := request.SourceRef
+			if resolvedRef == defaultACPSourceBranch {
+				resolvedRef = "refs/heads/" + defaultACPSourceBranch
+			}
+			writeDispatcherJSON(w, publisherservice.WorkspaceResolveResponse{
+				OperationID: request.Metadata.OperationID, RequestDigest: testControlDigestForDispatcher("workspace-resolve"),
+				RepositoryID: request.Source.ID, SourceRef: resolvedRef, BaselineOID: strings.Repeat("1", 40),
+			})
+		case publisherservice.WorkspacePreparePath:
+			var request publisherservice.WorkspacePrepareRequest
+			if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+				t.Errorf("decode workspace prepare: %v", err)
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			}
+			if request.SourceRef == defaultACPSourceBranch {
+				t.Error("workspace prepare reused unresolved bare source ref")
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			}
+			writeDispatcherJSON(w, publisherservice.WorkspacePrepareResponse{
+				OperationID: request.Metadata.OperationID, RequestDigest: testControlDigestForDispatcher("workspace-prepare"),
+				RepositoryID: request.Source.ID, SourceRef: request.SourceRef, BaselineOID: request.BaselineOID,
+				TreeOID: strings.Repeat("a", 40), ManifestDigest: "sha256:" + strings.Repeat("8", 64),
+				EntryCount: 1, ExpandedBytes: 128,
+				Artifact: harnessv2.ArtifactReference{
+					ArtifactID: harnessv2.ArtifactID(workspaceArtifactID), Digest: workspaceDigest,
+					SizeBytes: 128, MediaType: artifactcap.MediaTypeWorkspaceTar,
+				},
+			})
+		case publisherservice.PublicationPreflightPath:
+			var request publisherservice.PublicationPreflightRequest
+			if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+				t.Errorf("decode preflight: %v", err)
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			}
+			writeDispatcherJSON(w, publisherservice.PublicationPreflightResponse{
+				OperationID: request.Metadata.OperationID, RequestDigest: testControlDigestForDispatcher("preflight"),
+				Result: publisher.PreflightResult{Expected: request.Request.Claim.LastVerified, Observed: request.Request.Claim.LastVerified, Matches: true},
+			})
+		case publisherservice.PublicationPreparePath:
+			var request publisherservice.PublicationPrepareRequest
+			if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+				t.Errorf("decode prepare: %v", err)
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			}
+			if len(options) > 0 && options[0].inspectPrepare != nil {
+				options[0].inspectPrepare(request)
+			}
+			writeDispatcherJSON(w, publisherservice.PublicationPrepareResponse{
+				OperationID: request.Metadata.OperationID, RequestDigest: testControlDigestForDispatcher("prepare"),
+				Prepared: publisherservice.PreparedPublication{
+					PublicationID: request.Request.PublicationID, PublicationGeneration: request.Request.PublicationGeneration,
+					OperationID: request.Request.OperationID, RequestDigest: testControlDigestForDispatcher("prepared"),
+					Source: request.Request.Source, SourceRef: request.Request.SourceRef, Target: request.Request.Target, TargetRef: request.Request.TargetRef,
+					BranchClaimGeneration: request.Request.BranchClaimGeneration, BaselineOID: request.Request.BaselineOID,
+					RemoteBefore: request.Request.RemoteBefore, DeltaArtifactDigest: request.Request.DeltaArtifactDigest,
+					RelativeRoot:   request.Request.RelativeRoot,
+					ManifestDigest: "sha256:" + strings.Repeat("8", 64), TreeOID: treeOID, CommitOID: commitOID,
+					BundleDigest: bundleDigest, BundleSize: 256, BundleRef: "refs/orka/publications/" + strings.Repeat("f", 64),
+					BundleArtifact: harnessv2.ArtifactReference{ArtifactID: harnessv2.ArtifactID(bundleArtifactID), Digest: bundleDigest, SizeBytes: 256, MediaType: artifactcap.MediaTypeGitBundle},
+					CommitMessage:  request.Request.CommitMessage, CommitTimestamp: request.Request.CommitTimestamp,
+				},
+			})
+		case publisherservice.PublicationPublishPath:
+			var request publisherservice.PublicationPublishRequest
+			if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+				t.Errorf("decode publish: %v", err)
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			}
+			if len(options) > 0 && options[0].inspectPublish != nil {
+				options[0].inspectPublish(request)
+			}
+			writeDispatcherJSON(w, publisherservice.PublicationPublishResponse{
+				OperationID: request.Metadata.OperationID, RequestDigest: testControlDigestForDispatcher("publish-http"),
+				Receipt: publisher.PublishReceipt{
+					PublicationID: request.Request.PublicationID, PublicationGeneration: request.Request.PublicationGeneration,
+					OperationID: request.Request.OperationID, RequestDigest: testControlDigestForDispatcher("publish"),
+					Outcome: publisher.PublishAcknowledged, TargetRepositoryID: request.Request.Target.ID, TargetRef: request.Request.TargetRef,
+					RemoteBefore: request.Request.RemoteBefore, ExpectedCommitOID: request.Request.ExpectedCommitOID,
+					ObservedRemote: publisher.RemoteRef{OID: request.Request.ExpectedCommitOID},
+				},
+			})
+		case publisherservice.PublicationVerifyPath:
+			var request publisherservice.PublicationVerifyRequest
+			if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+				t.Errorf("decode verify: %v", err)
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			}
+			writeDispatcherJSON(w, publisherservice.PublicationVerifyResponse{
+				OperationID: request.Metadata.OperationID, RequestDigest: testControlDigestForDispatcher("verify-http"),
+				Receipt: publisher.VerificationReceipt{
+					PublicationID: request.Request.PublicationID, PublicationGeneration: request.Request.PublicationGeneration,
+					OperationID: request.Request.OperationID, RequestDigest: testControlDigestForDispatcher("verify"),
+					Outcome: publisher.VerifiedExact, TargetRepositoryID: request.Request.Target.ID, TargetRef: request.Request.TargetRef,
+					ExpectedCommitOID: request.Request.ExpectedCommitOID, ObservedRemote: publisher.RemoteRef{OID: request.Request.ExpectedCommitOID},
+				},
+			})
+		case publisherservice.PullRequestReconcilePath:
+			var request publisherservice.PullRequestReconcileRequest
+			if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+				t.Errorf("decode pull request: %v", err)
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			}
+			intentKey, err := request.Intent.Key()
+			if err != nil {
+				t.Errorf("PR intent key: %v", err)
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			}
+			if len(options) > 0 && options[0].inspectPullRequest != nil {
+				options[0].inspectPullRequest(request.Intent)
+			}
+			writeDispatcherJSON(w, publisherservice.PullRequestReconcileResponse{
+				OperationID: request.Metadata.OperationID, RequestDigest: testControlDigestForDispatcher("pr-http"),
+				Receipt: publisher.PullRequestReceipt{IntentKey: intentKey, ForgeID: "42", URL: "https://github.com/orka-agents/orka/pull/42", State: publisher.PullRequestOpen, HeadOID: request.Intent.ExpectedHeadOID},
+			})
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+}
+
+func newDispatcherTimeoutRuntimeServer(
+	t *testing.T,
+	profile harnessv2.RuntimeProfile,
+	digest harnessv2.ProfileDigest,
+	deleteCalls *atomic.Int32,
+	onAccepted func(),
+) *httptest.Server {
+	t.Helper()
+	mux := http.NewServeMux()
+	limits := harnessv2.DefaultProtocolLimits()
+	var acceptedOnce sync.Once
+	mux.HandleFunc("GET "+harnessv2.CapabilitiesPath, func(w http.ResponseWriter, _ *http.Request) {
+		writeDispatcherJSON(w, harnessv2.CapabilitiesResponse{
+			Protocol: harnessv2.ProtocolVersion, Transport: "http+ndjson", ACPVersion: harnessv2.ACPProfileV1,
+			RuntimeProfileDigest: digest, ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+			AdapterDigests: profile.AdapterDigests, Limits: limits,
+			Provider:                          harnessv2.ProviderCapabilities{ProviderKinds: []string{profile.ProviderKind}, Models: []string{profile.Model}, SupportsCancel: true, SupportsPermissions: true, SupportsTools: true},
+			WorkspaceGovernance:               harnessv2.StrictWorkspaceGovernanceCapabilities(),
+			SupportsDrain:                     true,
+			SupportsAgentSessionConfiguration: true,
+		})
+	})
+	mux.HandleFunc("PUT /v2/runtime-sessions/{sessionID}", func(w http.ResponseWriter, r *http.Request) {
+		var request harnessv2.CreateRuntimeSessionRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Errorf("decode create: %v", err)
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		now := time.Now().UTC()
+		writeDispatcherJSONStatus(w, http.StatusCreated, harnessv2.CreateRuntimeSessionResponse{
+			Protocol: harnessv2.ProtocolVersion, Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh},
+			Session: harnessv2.RuntimeSessionDescriptor{
+				RuntimeSessionID: request.RuntimeSessionID, RuntimeSessionUID: request.Metadata.Fence.RuntimeSessionUID,
+				Generation: request.Metadata.Fence.RuntimeSessionGeneration, RuntimeInstanceID: request.Metadata.Fence.RuntimeInstanceID,
+				SupervisorBootID: request.Metadata.Fence.SupervisorBootID, RuntimeProfileDigest: request.Metadata.Fence.RuntimeProfileDigest,
+				State: harnessv2.RuntimeSessionStateIdle, ProviderSessionID: "provider-session", WorkspaceBaseline: request.Workspace.Baseline,
+				CreatedAt: now, LastTransitionAt: now,
+			},
+		})
+	})
+	mux.HandleFunc("PUT /v2/runtime-sessions/{sessionID}/prompts/{promptID}", func(w http.ResponseWriter, r *http.Request) {
+		var request harnessv2.StartPromptRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Errorf("decode prompt: %v", err)
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		w.Header().Set("Content-Type", harnessv2.NDJSONMediaType)
+		encoder, err := harnessv2.NewEventEncoder(w, harnessv2.EventStreamLimits{
+			MaxLineBytes: limits.MaxEventLineBytes, MaxTerminalResultBytes: limits.MaxTerminalResultBytes,
+			MaxBufferedEvents: limits.MaxBufferedEvents, MaxUpdateEventsPerSecond: limits.MaxUpdateEventsPerSecond,
+		}, harnessv2.EventExpectationFromMetadata(request.Metadata))
+		if err != nil {
+			t.Errorf("event encoder: %v", err)
+			return
+		}
+		now := time.Now().UTC()
+		identity := harnessv2.EventIdentity{
+			RuntimeInstanceID: request.Metadata.Fence.RuntimeInstanceID, SupervisorBootID: request.Metadata.Fence.SupervisorBootID,
+			RuntimeSessionUID: request.Metadata.Fence.RuntimeSessionUID, RuntimeSessionGeneration: request.Metadata.Fence.RuntimeSessionGeneration,
+			TaskUID: request.Metadata.TaskUID, TaskAttempt: request.Metadata.TaskAttempt, PromptID: request.Metadata.PromptID,
+			Sequence: 1, RequestDigest: request.Metadata.RequestDigest, Timestamp: now,
+		}
+		if err := encoder.Encode(harnessv2.Event{
+			Protocol: harnessv2.ProtocolVersion, Type: harnessv2.EventAccepted, Identity: identity,
+			Accepted: &harnessv2.AcceptedEvent{AcceptedAt: now, Lease: request.Lease, ACPVersion: harnessv2.ACPProfileV1},
+		}); err != nil {
+			t.Errorf("encode accepted event: %v", err)
+			return
+		}
+		if flusher, ok := w.(http.Flusher); ok {
+			flusher.Flush()
+		}
+		if onAccepted != nil {
+			acceptedOnce.Do(onAccepted)
+		}
+		<-r.Context().Done()
+	})
+	mux.HandleFunc("PUT /v2/runtime-sessions/{sessionID}/prompts/{promptID}/cancel", func(w http.ResponseWriter, r *http.Request) {
+		var request harnessv2.CancelPromptRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Errorf("decode cancellation: %v", err)
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		now := time.Now().UTC()
+		writeDispatcherJSON(w, harnessv2.CancelPromptResponse{
+			Protocol: harnessv2.ProtocolVersion, Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh},
+			BarrierState: harnessv2.CancellationBarrierSettled, SettlementProven: true,
+			Settlement: harnessv2.PromptSettlement{
+				TerminalEvent: harnessv2.EventCancelled, Outcome: harnessv2.PromptOutcomeCancelled,
+				StopReason: harnessv2.ACPStopReasonCancelled, SettledAt: now,
+			},
+		})
+	})
+	mux.HandleFunc("DELETE /v2/runtime-sessions/{sessionID}", func(w http.ResponseWriter, r *http.Request) {
+		var request harnessv2.DeleteRuntimeSessionRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Errorf("decode delete: %v", err)
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		deleteCalls.Add(1)
+		writeDispatcherJSON(w, harnessv2.DeleteRuntimeSessionResponse{
+			Protocol: harnessv2.ProtocolVersion, Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh}, State: harnessv2.RuntimeSessionStateDeleted,
+			Tombstone: testDeleteTombstone(request, time.Now().UTC()),
+		})
+	})
+	return httptest.NewServer(mux)
+}
+
+func newDispatcherWriteRuntimeServer(
+	t *testing.T,
+	profile harnessv2.RuntimeProfile,
+	digest harnessv2.ProfileDigest,
+	onFinalize func(harnessv2.FinalizeRuntimeSessionPublicationRequest),
+	onDelete func(harnessv2.DeleteRuntimeSessionRequest),
+) *httptest.Server {
+	t.Helper()
+	mux := http.NewServeMux()
+	limits := harnessv2.DefaultProtocolLimits()
+	deltaDigest := "sha256:" + strings.Repeat("5", 64)
+	deltaArtifactID, err := artifactcap.ArtifactIDForDigest(deltaDigest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var descriptorMu sync.Mutex
+	var descriptor harnessv2.RuntimeSessionDescriptor
+	mux.HandleFunc("GET "+harnessv2.StatusPath, func(w http.ResponseWriter, _ *http.Request) {
+		descriptorMu.Lock()
+		current := descriptor
+		descriptorMu.Unlock()
+		writeDispatcherJSON(w, dispatcherRuntimeStatusResponse(digest, current))
+	})
+	mux.HandleFunc("GET "+harnessv2.CapabilitiesPath, func(w http.ResponseWriter, _ *http.Request) {
+		writeDispatcherJSON(w, harnessv2.CapabilitiesResponse{
+			Protocol: harnessv2.ProtocolVersion, Transport: "http+ndjson", ACPVersion: harnessv2.ACPProfileV1,
+			RuntimeProfileDigest: digest, ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+			AdapterDigests: profile.AdapterDigests, Limits: limits,
+			Provider: harnessv2.ProviderCapabilities{
+				ProviderKinds: []string{profile.ProviderKind}, Models: []string{profile.Model},
+				SupportsCancel: true, SupportsPermissions: true, SupportsTools: true,
+			},
+			WorkspaceGovernance:               harnessv2.StrictWorkspaceGovernanceCapabilities(),
+			SupportsDrain:                     true,
+			SupportsPublicationFinalization:   true,
+			SupportsAgentSessionConfiguration: true,
+		})
+	})
+	mux.HandleFunc("PUT /v2/runtime-sessions/{sessionID}", func(w http.ResponseWriter, r *http.Request) {
+		var request harnessv2.CreateRuntimeSessionRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Errorf("decode create: %v", err)
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		now := time.Now().UTC()
+		descriptorMu.Lock()
+		descriptor = harnessv2.RuntimeSessionDescriptor{
+			RuntimeSessionID: request.RuntimeSessionID, RuntimeSessionUID: request.Metadata.Fence.RuntimeSessionUID,
+			Generation: request.Metadata.Fence.RuntimeSessionGeneration, RuntimeInstanceID: request.Metadata.Fence.RuntimeInstanceID,
+			SupervisorBootID: request.Metadata.Fence.SupervisorBootID, RuntimeProfileDigest: request.Metadata.Fence.RuntimeProfileDigest,
+			State: harnessv2.RuntimeSessionStateIdle, ProviderSessionID: "provider-session", WorkspaceBaseline: request.Workspace.Baseline,
+			CreatedAt: now, LastTransitionAt: now,
+		}
+		responseDescriptor := descriptor
+		descriptorMu.Unlock()
+		writeDispatcherJSONStatus(w, http.StatusCreated, harnessv2.CreateRuntimeSessionResponse{
+			Protocol: harnessv2.ProtocolVersion, Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh},
+			Session: responseDescriptor,
+		})
+	})
+	mux.HandleFunc("PUT /v2/runtime-sessions/{sessionID}/prompts/{promptID}", func(w http.ResponseWriter, r *http.Request) {
+		var request harnessv2.StartPromptRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Errorf("decode prompt: %v", err)
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		w.Header().Set("Content-Type", harnessv2.NDJSONMediaType)
+		encoder, err := harnessv2.NewEventEncoder(w, harnessv2.EventStreamLimits{
+			MaxLineBytes: limits.MaxEventLineBytes, MaxTerminalResultBytes: limits.MaxTerminalResultBytes,
+			MaxBufferedEvents: limits.MaxBufferedEvents, MaxUpdateEventsPerSecond: limits.MaxUpdateEventsPerSecond,
+		}, harnessv2.EventExpectationFromMetadata(request.Metadata))
+		if err != nil {
+			t.Errorf("event encoder: %v", err)
+			return
+		}
+		now := time.Now().UTC()
+		identity := func(sequence uint64, at time.Time) harnessv2.EventIdentity {
+			return harnessv2.EventIdentity{
+				RuntimeInstanceID: request.Metadata.Fence.RuntimeInstanceID, SupervisorBootID: request.Metadata.Fence.SupervisorBootID,
+				RuntimeSessionUID: request.Metadata.Fence.RuntimeSessionUID, RuntimeSessionGeneration: request.Metadata.Fence.RuntimeSessionGeneration,
+				TaskUID: request.Metadata.TaskUID, TaskAttempt: request.Metadata.TaskAttempt, PromptID: request.Metadata.PromptID,
+				Sequence: sequence, RequestDigest: request.Metadata.RequestDigest, Timestamp: at,
+			}
+		}
+		_ = encoder.Encode(harnessv2.Event{
+			Protocol: harnessv2.ProtocolVersion, Type: harnessv2.EventAccepted, Identity: identity(1, now),
+			Accepted: &harnessv2.AcceptedEvent{AcceptedAt: now, Lease: request.Lease, ACPVersion: harnessv2.ACPProfileV1},
+		})
+		_ = encoder.Encode(harnessv2.Event{
+			Protocol: harnessv2.ProtocolVersion, Type: harnessv2.EventUpdate, Identity: identity(2, now.Add(time.Millisecond)),
+			Update: &harnessv2.UpdateEvent{Kind: harnessv2.UpdateAssistantMessageChunk, AssistantMessage: &harnessv2.AssistantMessageChunk{Text: "workspace updated"}},
+		})
+		_ = encoder.Encode(harnessv2.Event{
+			Protocol: harnessv2.ProtocolVersion, Type: harnessv2.EventCompleted, Identity: identity(3, now.Add(2*time.Millisecond)),
+			Completed: &harnessv2.CompletedEvent{
+				StopReason: harnessv2.ACPStopReasonEndTurn,
+				Result:     harnessv2.PromptResult{Content: []harnessv2.ContentBlock{{Type: harnessv2.ContentBlockText, Text: "workspace updated"}}, Model: profile.Model},
+			},
+		})
+		if err := encoder.Close(); err != nil {
+			t.Errorf("close encoder: %v", err)
+		}
+	})
+	mux.HandleFunc("PUT /v2/runtime-sessions/{sessionID}/workspace-deltas/{deltaID}", func(w http.ResponseWriter, r *http.Request) {
+		var request harnessv2.CreateWorkspaceDeltaRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Errorf("decode workspace delta: %v", err)
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		writeDispatcherJSON(w, harnessv2.CreateWorkspaceDeltaResponse{
+			Protocol: harnessv2.ProtocolVersion, Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh},
+			Delta: harnessv2.WorkspaceDeltaDescriptor{
+				DeltaID: request.DeltaID, RuntimeSessionUID: request.Metadata.Fence.RuntimeSessionUID,
+				SessionGeneration: request.Metadata.Fence.RuntimeSessionGeneration, State: harnessv2.WorkspaceDeltaPrepared,
+				Intent: request.Intent, VerifiedBaseline: request.VerifiedBaseline, ManifestDigest: "sha256:" + strings.Repeat("6", 64),
+				Artifact: &harnessv2.ArtifactReference{
+					ArtifactID: harnessv2.ArtifactID(deltaArtifactID), Digest: deltaDigest,
+					SizeBytes: 128, MediaType: artifactcap.MediaTypeWorkspaceDelta,
+				},
+				EntryCount: 1, ChangedFileCount: 1, NoFollowVerified: true, PublicationSafe: true, FrozenAt: time.Now().UTC(),
+			},
+		})
+	})
+	mux.HandleFunc("PUT /v2/runtime-sessions/{sessionID}/publication-finalization", func(w http.ResponseWriter, r *http.Request) {
+		var request harnessv2.FinalizeRuntimeSessionPublicationRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Errorf("decode publication finalization: %v", err)
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		if onFinalize != nil {
+			onFinalize(request)
+		}
+		now := time.Now().UTC()
+		descriptorMu.Lock()
+		responseDescriptor := descriptor
+		responseDescriptor.State = harnessv2.RuntimeSessionStateFinalizing
+		responseDescriptor.LastTransitionAt = now
+		descriptor = responseDescriptor
+		descriptorMu.Unlock()
+		writeDispatcherJSON(w, harnessv2.FinalizeRuntimeSessionPublicationResponse{
+			Protocol: harnessv2.ProtocolVersion, Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh},
+			Session: responseDescriptor,
+			Finalization: harnessv2.PublicationFinalizationReceipt{
+				WorkspaceDeltaID: request.WorkspaceDeltaID, PublicationID: request.PublicationID,
+				PublicationGeneration: request.PublicationGeneration, PublicationVersion: request.PublicationVersion,
+				TerminalState: request.TerminalState, TerminalReceiptDigest: request.TerminalReceiptDigest, AppliedAt: now,
+			},
+		})
+	})
+	mux.HandleFunc("DELETE /v2/runtime-sessions/{sessionID}", func(w http.ResponseWriter, r *http.Request) {
+		var request harnessv2.DeleteRuntimeSessionRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Errorf("decode delete: %v", err)
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		if onDelete != nil {
+			onDelete(request)
+		}
+		descriptorMu.Lock()
+		descriptor = harnessv2.RuntimeSessionDescriptor{}
+		descriptorMu.Unlock()
+		writeDispatcherJSON(w, harnessv2.DeleteRuntimeSessionResponse{
+			Protocol: harnessv2.ProtocolVersion, Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh},
+			State:     harnessv2.RuntimeSessionStateDeleted,
+			Tombstone: testDeleteTombstone(request, time.Now().UTC()),
+		})
+	})
+	return httptest.NewServer(mux)
+}
+
+func newDispatcherRuntimeServer(
+	t *testing.T,
+	profile harnessv2.RuntimeProfile,
+	digest harnessv2.ProfileDigest,
+	onCreate ...func(harnessv2.CreateRuntimeSessionRequest),
+) *httptest.Server {
+	t.Helper()
+	mux := http.NewServeMux()
+	limits := harnessv2.DefaultProtocolLimits()
+	var descriptorMu sync.Mutex
+	var descriptor harnessv2.RuntimeSessionDescriptor
+	mux.HandleFunc("GET "+harnessv2.StatusPath, func(w http.ResponseWriter, _ *http.Request) {
+		descriptorMu.Lock()
+		current := descriptor
+		descriptorMu.Unlock()
+		writeDispatcherJSON(w, dispatcherRuntimeStatusResponse(digest, current))
+	})
+	mux.HandleFunc("GET "+harnessv2.CapabilitiesPath, func(w http.ResponseWriter, _ *http.Request) {
+		writeDispatcherJSON(w, harnessv2.CapabilitiesResponse{
+			Protocol: harnessv2.ProtocolVersion, Transport: "http+ndjson", ACPVersion: harnessv2.ACPProfileV1,
+			RuntimeProfileDigest: digest, ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+			AdapterDigests: profile.AdapterDigests, Limits: limits,
+			Provider:                          harnessv2.ProviderCapabilities{ProviderKinds: []string{profile.ProviderKind}, Models: []string{profile.Model}, SupportsCancel: true, SupportsPermissions: true, SupportsTools: true},
+			WorkspaceGovernance:               harnessv2.StrictWorkspaceGovernanceCapabilities(),
+			SupportsDrain:                     true,
+			SupportsAgentSessionConfiguration: true,
+		})
+	})
+	mux.HandleFunc("PUT /v2/runtime-sessions/{sessionID}", func(w http.ResponseWriter, r *http.Request) {
+		var request harnessv2.CreateRuntimeSessionRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Errorf("decode create: %v", err)
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		for _, inspect := range onCreate {
+			if inspect != nil {
+				inspect(request)
+			}
+		}
+		now := time.Now().UTC()
+		created := harnessv2.RuntimeSessionDescriptor{
+			RuntimeSessionID: request.RuntimeSessionID, RuntimeSessionUID: request.Metadata.Fence.RuntimeSessionUID,
+			Generation: request.Metadata.Fence.RuntimeSessionGeneration, RuntimeInstanceID: request.Metadata.Fence.RuntimeInstanceID,
+			SupervisorBootID: request.Metadata.Fence.SupervisorBootID, RuntimeProfileDigest: request.Metadata.Fence.RuntimeProfileDigest,
+			State: harnessv2.RuntimeSessionStateIdle, ProviderSessionID: "provider-session", WorkspaceBaseline: request.Workspace.Baseline,
+			CreatedAt: now, LastTransitionAt: now,
+		}
+		descriptorMu.Lock()
+		descriptor = created
+		descriptorMu.Unlock()
+		writeDispatcherJSONStatus(w, http.StatusCreated, harnessv2.CreateRuntimeSessionResponse{
+			Protocol: harnessv2.ProtocolVersion, Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh},
+			Session: created,
+		})
+	})
+	mux.HandleFunc("PUT /v2/runtime-sessions/{sessionID}/prompts/{promptID}", func(w http.ResponseWriter, r *http.Request) {
+		var request harnessv2.StartPromptRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Errorf("decode prompt: %v", err)
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		w.Header().Set("Content-Type", harnessv2.NDJSONMediaType)
+		encoder, err := harnessv2.NewEventEncoder(w, harnessv2.EventStreamLimits{
+			MaxLineBytes: limits.MaxEventLineBytes, MaxTerminalResultBytes: limits.MaxTerminalResultBytes,
+			MaxBufferedEvents: limits.MaxBufferedEvents, MaxUpdateEventsPerSecond: limits.MaxUpdateEventsPerSecond,
+		}, harnessv2.EventExpectationFromMetadata(request.Metadata))
+		if err != nil {
+			t.Errorf("event encoder: %v", err)
+			return
+		}
+		now := time.Now().UTC()
+		identity := func(seq uint64, at time.Time) harnessv2.EventIdentity {
+			return harnessv2.EventIdentity{
+				RuntimeInstanceID: request.Metadata.Fence.RuntimeInstanceID, SupervisorBootID: request.Metadata.Fence.SupervisorBootID,
+				RuntimeSessionUID: request.Metadata.Fence.RuntimeSessionUID, RuntimeSessionGeneration: request.Metadata.Fence.RuntimeSessionGeneration,
+				TaskUID: request.Metadata.TaskUID, TaskAttempt: request.Metadata.TaskAttempt, PromptID: request.Metadata.PromptID,
+				Sequence: seq, RequestDigest: request.Metadata.RequestDigest, Timestamp: at,
+			}
+		}
+		_ = encoder.Encode(harnessv2.Event{Protocol: harnessv2.ProtocolVersion, Type: harnessv2.EventAccepted, Identity: identity(1, now), Accepted: &harnessv2.AcceptedEvent{AcceptedAt: now, Lease: request.Lease, ACPVersion: harnessv2.ACPProfileV1}})
+		_ = encoder.Encode(harnessv2.Event{Protocol: harnessv2.ProtocolVersion, Type: harnessv2.EventUpdate, Identity: identity(2, now.Add(time.Millisecond)), Update: &harnessv2.UpdateEvent{Kind: harnessv2.UpdateAssistantMessageChunk, AssistantMessage: &harnessv2.AssistantMessageChunk{Text: "hello from runtime"}}})
+		_ = encoder.Encode(harnessv2.Event{Protocol: harnessv2.ProtocolVersion, Type: harnessv2.EventCompleted, Identity: identity(3, now.Add(2*time.Millisecond)), Completed: &harnessv2.CompletedEvent{StopReason: harnessv2.ACPStopReasonEndTurn, Result: harnessv2.PromptResult{Content: []harnessv2.ContentBlock{{Type: harnessv2.ContentBlockText, Text: "hello from runtime"}}, Model: profile.Model}}})
+		if err := encoder.Close(); err != nil {
+			t.Errorf("close encoder: %v", err)
+		}
+	})
+	mux.HandleFunc("PUT /v2/runtime-sessions/{sessionID}/workspace-deltas/{deltaID}", func(w http.ResponseWriter, r *http.Request) {
+		var request harnessv2.CreateWorkspaceDeltaRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Errorf("decode delta: %v", err)
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		writeDispatcherJSON(w, harnessv2.CreateWorkspaceDeltaResponse{
+			Protocol: harnessv2.ProtocolVersion, Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh},
+			Delta: harnessv2.WorkspaceDeltaDescriptor{
+				DeltaID: request.DeltaID, RuntimeSessionUID: request.Metadata.Fence.RuntimeSessionUID,
+				SessionGeneration: request.Metadata.Fence.RuntimeSessionGeneration, State: harnessv2.WorkspaceDeltaNoChange,
+				Intent: request.Intent, VerifiedBaseline: request.VerifiedBaseline, NoFollowVerified: true, PublicationSafe: true, FrozenAt: time.Now().UTC(),
+			},
+		})
+	})
+	mux.HandleFunc("DELETE /v2/runtime-sessions/{sessionID}", func(w http.ResponseWriter, r *http.Request) {
+		var request harnessv2.DeleteRuntimeSessionRequest
+		_ = json.NewDecoder(r.Body).Decode(&request)
+		descriptorMu.Lock()
+		descriptor = harnessv2.RuntimeSessionDescriptor{}
+		descriptorMu.Unlock()
+		writeDispatcherJSON(w, harnessv2.DeleteRuntimeSessionResponse{
+			Protocol: harnessv2.ProtocolVersion, Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh}, State: harnessv2.RuntimeSessionStateDeleted,
+			Tombstone: testDeleteTombstone(request, time.Now().UTC()),
+		})
+	})
+	return httptest.NewServer(mux)
+}
+
+func dispatcherRuntimeStatusResponse(
+	digest harnessv2.ProfileDigest,
+	descriptor harnessv2.RuntimeSessionDescriptor,
+) harnessv2.StatusResponse {
+	response := harnessv2.StatusResponse{
+		Protocol: harnessv2.ProtocolVersion,
+		Fence: harnessv2.Fence{
+			RuntimeInstanceID: "pod-uid.boot-id", SupervisorBootID: "boot-id", ControllerEpoch: 1,
+			RuntimePoolUID: "pool-uid", RuntimePoolGeneration: 1, RuntimeProfileDigest: digest,
+			ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+		},
+		Lifecycle: harnessv2.SupervisorLifecycleReady,
+		Drain:     harnessv2.DrainStatus{AcceptingNewSessions: true},
+		Timestamp: time.Now().UTC(),
+	}
+	if descriptor.RuntimeSessionUID != "" {
+		response.Sessions = append(response.Sessions, harnessv2.RuntimeSessionStatus{
+			RuntimeSessionID: descriptor.RuntimeSessionID, RuntimeSessionUID: descriptor.RuntimeSessionUID,
+			Generation: descriptor.Generation, State: descriptor.State, LastTransitionAt: descriptor.LastTransitionAt,
+		})
+		response.Pressure.ResidentSessions = 1
+	}
+	return response
+}
+
+func testDeleteTombstone(request harnessv2.DeleteRuntimeSessionRequest, now time.Time) harnessv2.RuntimeSessionTombstone {
+	return harnessv2.RuntimeSessionTombstone{
+		RuntimeSessionUID: request.Metadata.Fence.RuntimeSessionUID, RuntimeSessionGeneration: request.Metadata.Fence.RuntimeSessionGeneration,
+		RuntimeProfileDigest: request.Metadata.Fence.RuntimeProfileDigest, DeletedAt: now,
+		Operations: []harnessv2.OperationRecord{{
+			OperationID: request.Metadata.OperationID, RequestDigest: request.Metadata.RequestDigest,
+			Phase: harnessv2.OperationPhaseDeleted, RecordedAt: now, UpdatedAt: now,
+		}},
+	}
+}
+
+func writeDispatcherJSON(w http.ResponseWriter, value any) {
+	writeDispatcherJSONStatus(w, http.StatusOK, value)
+}
+func writeDispatcherJSONStatus(w http.ResponseWriter, status int, value any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(value)
+}
+
+func testControlDigestForDispatcher(value string) string {
+	digest, _ := acpDomainDigest("dispatcher-test", value)
+	return digest
+}
+
+func boundPromptAttemptForTest(attempt *store.PromptAttempt) *store.PromptAttempt {
+	if attempt == nil {
+		return nil
+	}
+	if attempt.BindingDigest == "" {
+		attempt.BindingDigest = testControlDigestForDispatcher("test-v2-binding")
+	}
+	if attempt.SnapshotDigest == "" {
+		attempt.SnapshotDigest = testControlDigestForDispatcher("test-v2-snapshot")
+	}
+	return attempt
+}
+
+func testACPExecuteBindingForDispatcher() *corev1alpha1.AgentExecutionBinding {
+	return &corev1alpha1.AgentExecutionBinding{
+		SchemaVersion:   1,
+		ContractVersion: corev1alpha1.AgentRuntimeContractHarnessV2,
+		Backend:         corev1alpha1.AgentExecutionBackendRuntimePool,
+		BindingDigest:   testControlDigestForDispatcher("test-v2-binding"),
+		Snapshot: corev1alpha1.AgentExecutionSnapshotRef{
+			Digest: testControlDigestForDispatcher("test-v2-snapshot"),
+		},
+	}
+}
+
+func TestACPDispatcherRejectsPersistedExternalRuntimeAttemptsWithoutExecution(t *testing.T) {
+	for _, state := range []corev1alpha1.TaskExecutionState{
+		corev1alpha1.TaskExecutionStateQueued,
+		corev1alpha1.TaskExecutionStateReserved,
+	} {
+		t.Run(string(state), func(t *testing.T) {
+			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			defer cancel()
+			var runtimeCalls atomic.Int32
+			runtimeServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+				runtimeCalls.Add(1)
+				http.Error(w, "external runtime dispatch must remain unreachable", http.StatusInternalServerError)
+			}))
+			defer runtimeServer.Close()
+
+			db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "store.db"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer db.Close() //nolint:errcheck
+			controlStore := sqlite.NewStore(db, "test")
+			epochs, stopEpoch := startACPRecoveryEpochManager(t, ctx, controlStore, "external-cutover")
+			defer stopEpoch()
+			fence, err := epochs.CurrentFence(ctx)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			uid := types.UID("persisted-external-" + strings.ToLower(string(state)))
+			promptID := "prompt-" + string(uid) + "-1"
+			requestDigest := testControlDigestForDispatcher("external-cutover-" + string(state))
+			runtimeRegistration := plannerExternalRuntime()
+			runtimeRegistration.Spec.Deployment.Endpoint = runtimeServer.URL
+			task := &corev1alpha1.Task{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: "default", Name: "persisted-external-" + strings.ToLower(string(state)), UID: uid,
+					Labels: map[string]string{acpExternalRuntimeTaskLabel: runtimeRegistration.Name},
+				},
+				Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Prompt: "do not dispatch"},
+				Status: corev1alpha1.TaskStatus{
+					Phase: corev1alpha1.TaskPhasePending, Attempts: 1,
+					AgentExecutionBinding: testACPExecuteBindingForDispatcher(),
+					Execution: &corev1alpha1.TaskExecutionStatus{
+						State: state, Attempt: 1, PromptID: promptID, RequestDigest: requestDigest,
+						AgentRuntimeName: runtimeRegistration.Name, AgentRuntimeUID: string(runtimeRegistration.UID), ControllerEpoch: fence.Epoch,
+					},
+					Delivery: &corev1alpha1.TaskDeliveryStatus{
+						State: corev1alpha1.TaskDeliveryStateNotRequested, Outcome: corev1alpha1.TaskDeliveryOutcomeNotRequested,
+					},
+				},
+			}
+			scheme := runtime.NewScheme()
+			if err := corev1alpha1.AddToScheme(scheme); err != nil {
+				t.Fatal(err)
+			}
+			kubeClient := fake.NewClientBuilder().WithScheme(scheme).
+				WithStatusSubresource(&corev1alpha1.Task{}, &corev1alpha1.AgentRuntime{}).
+				WithObjects(task, runtimeRegistration).Build()
+			key := store.PromptAttemptKey{Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: promptID}
+			attempt, err := controlStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{
+				Key: key, RequestDigest: requestDigest, ExecutionState: store.PromptExecutionQueued, DeliveryState: store.PromptDeliveryNotRequested,
+			}), fence)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if state == corev1alpha1.TaskExecutionStateReserved {
+				attempt, err = controlStore.TransitionPromptAttemptExecution(ctx, store.PromptAttemptExecutionTransition{
+					ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: store.PromptExecutionQueued,
+					NewState: store.PromptExecutionReserved, OperationID: "persisted-reservation", OperationDigest: testControlDigestForDispatcher("persisted-reservation"), UpdatedAt: time.Now().UTC(),
+				})
+				if err != nil {
+					t.Fatal(err)
+				}
+			}
+
+			dispatcher := &ACPDispatcher{
+				Client: kubeClient, APIReader: kubeClient, Store: controlStore, ResultStore: controlStore, Epochs: epochs,
+				active: make(map[types.UID]struct{}), sem: make(chan struct{}, 1),
+			}
+			if err := dispatcher.dispatchOnce(ctx); err != nil {
+				t.Fatal(err)
+			}
+			if got := runtimeCalls.Load(); got != 0 {
+				t.Fatalf("external runtime received %d execution client calls", got)
+			}
+			terminalAttempt, err := controlStore.GetPromptAttempt(ctx, attempt.ID)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if terminalAttempt.ExecutionState != store.PromptExecutionFailed || terminalAttempt.TerminalReason != string(acpExternalRuntimeDispatchUnsupportedExecutionReason) {
+				t.Fatalf("persisted attempt was not failed closed: %#v", terminalAttempt)
+			}
+			failed := &corev1alpha1.Task{}
+			if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(task), failed); err != nil {
+				t.Fatal(err)
+			}
+			wantMessage := externalAgentRuntimeDispatchUnsupportedReason(runtimeRegistration.Name)
+			if failed.Status.Phase != corev1alpha1.TaskPhaseFailed || failed.Status.Execution == nil ||
+				failed.Status.Execution.State != corev1alpha1.TaskExecutionStateFailed || failed.Status.Execution.Outcome != corev1alpha1.TaskExecutionOutcomeFailed ||
+				failed.Status.Execution.Reason != acpExternalRuntimeDispatchUnsupportedExecutionReason || failed.Status.Execution.Message != wantMessage {
+				t.Fatalf("persisted external Task was not failed closed: %#v", failed.Status)
+			}
+		})
+	}
+}
+
+func TestACPDispatcherCapacityBackpressureRunsIdlePoolMaintenance(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now().UTC()
+	objects := make([]runtime.Object, 0, 4)
+	for i := range 3 {
+		objects = append(objects, &corev1alpha1.Task{
+			ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: fmt.Sprintf("task-%d", i), UID: types.UID(fmt.Sprintf("task-uid-%d", i)), CreationTimestamp: metav1.NewTime(now.Add(time.Duration(i) * time.Second))},
+			Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent},
+			Status: corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{
+				State: corev1alpha1.TaskExecutionStateQueued, RuntimePoolName: "busy-pool",
+			}},
+		})
+	}
+	idlePool := &corev1alpha1.RuntimePool{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "default", Name: "unrelated-idle-pool",
+			Annotations: map[string]string{acpRuntimeLastDemandAnnotation: now.Add(-time.Hour).Format(time.RFC3339Nano)},
+		},
+		Spec: corev1alpha1.RuntimePoolSpec{DesiredReplicas: 1},
+	}
+	objects = append(objects, idlePool)
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).
+		WithStatusSubresource(&corev1alpha1.RuntimePool{}).
+		WithRuntimeObjects(objects...).Build()
+	epochs := NewControllerEpochManager(nil, "dispatcher-backpressure-test")
+	epochs.current = &store.ControllerEpoch{Name: store.DefaultControllerEpochName, Epoch: 1, HolderID: "dispatcher-backpressure-test"}
+	close(epochs.ready)
+	dispatcher := &ACPDispatcher{
+		Client: kubeClient, APIReader: kubeClient, Epochs: epochs, IdlePoolTTL: time.Minute,
+		active: make(map[types.UID]struct{}), sem: make(chan struct{}, 1),
+	}
+	dispatcher.sem <- struct{}{}
+	if err := dispatcher.dispatchOnce(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	dispatcher.mu.Lock()
+	activeCount := len(dispatcher.active)
+	dispatcher.mu.Unlock()
+	if activeCount != 0 {
+		t.Fatalf("backpressured active task count = %d, want 0", activeCount)
+	}
+	maintained := &corev1alpha1.RuntimePool{}
+	if err := kubeClient.Get(context.Background(), client.ObjectKeyFromObject(idlePool), maintained); err != nil {
+		t.Fatal(err)
+	}
+	if maintained.Spec.DesiredReplicas != 0 {
+		t.Fatalf("unrelated expired idle pool replicas = %d, want 0 under dispatch saturation", maintained.Spec.DesiredReplicas)
+	}
+}
+
+func TestACPDispatcherRuntimePoolReservationCASAndIdempotentRelease(t *testing.T) {
+	ctx := context.Background()
+	dispatcher, kubeClient, pool, first, second := newRuntimePoolReservationTestFixture(t)
+	fence := store.ControllerEpochFence{Name: store.DefaultControllerEpochName, Epoch: 1}
+
+	claimed, firstIdentity, err := dispatcher.claimRuntimePoolReservation(ctx, first, pool.Name, fence, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if claimed.Status.ActiveInstance == nil || firstIdentity.RuntimeInstanceID != claimed.Status.ActiveInstance.RuntimeInstanceID {
+		t.Fatalf("reservation was not bound to the exact active instance: %#v", firstIdentity)
+	}
+	if _, duplicateIdentity, err := dispatcher.claimRuntimePoolReservation(ctx, first, pool.Name, fence, 1); err != nil {
+		t.Fatal(err)
+	} else if *duplicateIdentity != *firstIdentity {
+		t.Fatalf("idempotent claim changed identity: got %#v want %#v", duplicateIdentity, firstIdentity)
+	}
+	if _, _, err := dispatcher.claimRuntimePoolReservation(ctx, second, pool.Name, fence, 1); !errors.Is(err, errACPRuntimePoolAtCapacity) {
+		t.Fatalf("second claim error = %v, want capacity", err)
+	}
+
+	current := &corev1alpha1.RuntimePool{}
+	if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(pool), current); err != nil {
+		t.Fatal(err)
+	}
+	if len(current.Status.Capacity.Reservations) != 1 || current.Status.Capacity.ReservedSessions != 1 || current.Status.Capacity.ReservedPrompts != 1 {
+		t.Fatalf("unexpected reservation status: %#v", current.Status.Capacity)
+	}
+	if err := dispatcher.releaseRuntimePoolReservation(ctx, *firstIdentity); err != nil {
+		t.Fatal(err)
+	}
+	if err := dispatcher.releaseRuntimePoolReservation(ctx, *firstIdentity); err != nil {
+		t.Fatalf("idempotent release failed: %v", err)
+	}
+	if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(pool), current); err != nil {
+		t.Fatal(err)
+	}
+	if len(current.Status.Capacity.Reservations) != 0 || current.Status.Capacity.ReservedSessions != 0 || current.Status.Capacity.ReservedPrompts != 0 {
+		t.Fatalf("reservation was not released: %#v", current.Status.Capacity)
+	}
+}
+
+func TestACPDispatcherRuntimePoolConcurrentClaimsAreAtomic(t *testing.T) {
+	ctx := context.Background()
+	dispatcher, kubeClient, pool, first, second := newRuntimePoolReservationTestFixture(t)
+	fence := store.ControllerEpochFence{Name: store.DefaultControllerEpochName, Epoch: 1}
+	start := make(chan struct{})
+	results := make(chan error, 2)
+	var wg sync.WaitGroup
+	for _, task := range []*corev1alpha1.Task{first, second} {
+		wg.Add(1)
+		go func(task *corev1alpha1.Task) {
+			defer wg.Done()
+			<-start
+			_, _, err := dispatcher.claimRuntimePoolReservation(ctx, task, pool.Name, fence, 1)
+			results <- err
+		}(task)
+	}
+	close(start)
+	wg.Wait()
+	close(results)
+
+	var claimed, atCapacity int
+	for err := range results {
+		switch {
+		case err == nil:
+			claimed++
+		case errors.Is(err, errACPRuntimePoolAtCapacity):
+			atCapacity++
+		default:
+			t.Fatalf("unexpected claim error: %v", err)
+		}
+	}
+	if claimed != 1 || atCapacity != 1 {
+		t.Fatalf("claim results: claimed=%d atCapacity=%d", claimed, atCapacity)
+	}
+	current := &corev1alpha1.RuntimePool{}
+	if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(pool), current); err != nil {
+		t.Fatal(err)
+	}
+	if len(current.Status.Capacity.Reservations) != 1 {
+		t.Fatalf("atomic claim stored %d reservations", len(current.Status.Capacity.Reservations))
+	}
+}
+
+func TestACPDispatcherSettlesDeletingTaskBeforeRuntimePoolAdmission(t *testing.T) {
+	deletingAt := metav1.Now()
+	runACPDispatcherPreAdmissionSettlementTest(t, func(task *corev1alpha1.Task) {
+		task.DeletionTimestamp = &deletingAt
+		task.Finalizers = []string{labels.TaskFinalizer}
+	}, corev1alpha1.TaskExecutionReason("Cancelled"), "task cancelled before runtime admission", false)
+}
+
+func TestACPDispatcherSettlesDeletingTaskBeforeClosedAdmissionAndWorkerCapacity(t *testing.T) {
+	deletingAt := metav1.Now()
+	runACPDispatcherPreAdmissionSettlementTest(t, func(task *corev1alpha1.Task) {
+		task.DeletionTimestamp = &deletingAt
+		task.Finalizers = []string{labels.TaskFinalizer}
+	}, corev1alpha1.TaskExecutionReason("Cancelled"), "task cancelled before runtime admission", true)
+}
+
+func TestACPDispatcherSettlesExpiredTaskBeforeRuntimePoolAdmission(t *testing.T) {
+	timeout := metav1.Duration{Duration: time.Minute}
+	runACPDispatcherPreAdmissionSettlementTest(t, func(task *corev1alpha1.Task) {
+		task.CreationTimestamp = metav1.NewTime(time.Now().UTC().Add(-2 * time.Minute))
+		task.Spec.Timeout = &timeout
+	}, corev1alpha1.TaskExecutionReason("TaskTimeout"), "task deadline exceeded before runtime admission", false)
+}
+
+func TestACPDispatcherSettlesExpiredSessionTaskBeforeRuntimePoolAdmission(t *testing.T) {
+	timeout := metav1.Duration{Duration: time.Minute}
+	runACPDispatcherPreAdmissionSettlementTest(t, func(task *corev1alpha1.Task) {
+		task.CreationTimestamp = metav1.NewTime(time.Now().UTC().Add(-2 * time.Minute))
+		task.Spec.Timeout = &timeout
+		task.Spec.SessionRef = &corev1alpha1.SessionReference{Name: "pre-admission-session", Create: true, Append: true}
+	}, corev1alpha1.TaskExecutionReason("TaskTimeout"), "task deadline exceeded before runtime admission", false)
+}
+
+func runACPDispatcherPreAdmissionSettlementTest(
+	t *testing.T,
+	mutateTask func(*corev1alpha1.Task),
+	wantReason corev1alpha1.TaskExecutionReason,
+	wantMessage string,
+	throughDispatch bool,
+) {
+	t.Helper()
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	task := runtimePoolReservationTestTask("pre-admission", "pre-admission-uid", "pool-uid")
+	task.Status.AgentExecutionBinding = testACPExecuteBindingForDispatcher()
+	mutateTask(task)
+	pool := &corev1alpha1.RuntimePool{
+		ObjectMeta: metav1.ObjectMeta{Namespace: task.Namespace, Name: "pool", UID: types.UID("pool-uid"), Generation: 1},
+		Status: corev1alpha1.RuntimePoolStatus{
+			Lifecycle:      corev1alpha1.RuntimePoolLifecycleServing,
+			AdmissionState: corev1alpha1.RuntimePoolAdmissionDraining,
+			ActiveInstance: &corev1alpha1.RuntimePoolActiveInstanceStatus{RuntimeInstanceID: "pod-uid.boot-id", ControllerEpoch: 1},
+			Capacity:       corev1alpha1.RuntimePoolCapacityStatus{MaxResidentSessions: 1, MaxRunningPrompts: 1},
+		},
+	}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).
+		WithStatusSubresource(&corev1alpha1.Task{}, &corev1alpha1.RuntimePool{}).
+		WithObjects(task.DeepCopy(), pool.DeepCopy()).Build()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "pre-admission.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	controlStore := sqlite.NewStore(db, "pre-admission-test")
+	epochs := NewControllerEpochManager(controlStore, "pre-admission-controller")
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	fence, err := epochs.CurrentFence(ctx)
+	if err != nil {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+	key := store.PromptAttemptKey{
+		Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: task.Status.Execution.PromptID,
+	}
+	attemptID, err := key.CanonicalID()
+	if err != nil {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+	if _, err := controlStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{
+		ID: attemptID, Key: key, RequestDigest: task.Status.Execution.RequestDigest,
+		ExecutionState: store.PromptExecutionQueued, DeliveryState: store.PromptDeliveryNotRequested,
+	}), fence); err != nil {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+	dispatcher := &ACPDispatcher{Client: kubeClient, APIReader: kubeClient, Store: controlStore, ResultStore: controlStore, Epochs: epochs}
+	if throughDispatch {
+		dispatcher.AdmissionGate = NewACPAdmissionGate()
+		dispatcher.AdmissionGate.Close("planned drain", time.Now().UTC())
+		dispatcher.sem = make(chan struct{}, 1)
+		dispatcher.sem <- struct{}{}
+		dispatcher.active = make(map[types.UID]struct{})
+		if err := dispatcher.dispatchOnce(ctx); err != nil {
+			cancelEpoch()
+			t.Fatal(err)
+		}
+	} else {
+		reserved, _, err := dispatcher.reserveTask(ctx, task.DeepCopy())
+		if err != nil {
+			cancelEpoch()
+			t.Fatal(err)
+		}
+		if reserved != nil {
+			cancelEpoch()
+			t.Fatalf("reserveTask() returned task %#v, want pre-admission settlement", reserved)
+		}
+	}
+	attempt, err := controlStore.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+	if attempt.ExecutionState != store.PromptExecutionCancelled {
+		cancelEpoch()
+		t.Fatalf("attempt state = %s, want %s", attempt.ExecutionState, store.PromptExecutionCancelled)
+	}
+	updated := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(task), updated); err != nil {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+	if updated.Status.Phase != corev1alpha1.TaskPhaseCancelled || updated.Status.Execution == nil ||
+		updated.Status.Execution.State != corev1alpha1.TaskExecutionStateCancelled ||
+		updated.Status.Execution.Outcome != corev1alpha1.TaskExecutionOutcomeCancelled ||
+		updated.Status.Execution.Reason != wantReason || updated.Status.Execution.Message != wantMessage {
+		cancelEpoch()
+		t.Fatalf("settled task status = %#v, want reason=%s message=%q", updated.Status, wantReason, wantMessage)
+	}
+	projectionID := standaloneTaskTerminalProjectionID(task, task.Status.Execution.Attempt)
+	if _, err := controlStore.GetOutboxProjection(ctx, projectionID); err != nil {
+		cancelEpoch()
+		t.Fatalf("terminal projection %q: %v", projectionID, err)
+	}
+	updatedPool := &corev1alpha1.RuntimePool{}
+	if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(pool), updatedPool); err != nil {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+	if len(updatedPool.Status.Capacity.Reservations) != 0 {
+		cancelEpoch()
+		t.Fatalf("pre-admission settlement claimed RuntimePool capacity: %#v", updatedPool.Status.Capacity.Reservations)
+	}
+	cancelEpoch()
+	if err := <-epochDone; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestACPDispatcherRuntimePoolReservationReclaimsExpiredAndReplacedInstance(t *testing.T) {
+	ctx := context.Background()
+	dispatcher, kubeClient, pool, first, _ := newRuntimePoolReservationTestFixture(t)
+	now := time.Now().UTC()
+	pool.Status.Capacity.Reservations = []corev1alpha1.RuntimePoolCapacityReservationStatus{
+		{
+			PoolUID: string(pool.UID), TaskUID: "expired", Attempt: 1, ControllerEpoch: 1,
+			RuntimeInstanceID: pool.Status.ActiveInstance.RuntimeInstanceID, ResidentSlots: 1, PromptSlots: 1,
+			ReservedAt: metav1.NewTime(now.Add(-time.Minute)), ExpiresAt: metav1.NewTime(now.Add(-time.Second)),
+		},
+		{
+			PoolUID: string(pool.UID), TaskUID: "old-instance", Attempt: 1, ControllerEpoch: 1,
+			RuntimeInstanceID: "old-pod.old-boot", ResidentSlots: 1, PromptSlots: 1,
+			ReservedAt: metav1.NewTime(now.Add(-time.Minute)), ExpiresAt: metav1.NewTime(now.Add(time.Minute)),
+		},
+	}
+	pool.Status.Capacity.ReservedSessions = 2
+	pool.Status.Capacity.ReservedPrompts = 2
+	if err := kubeClient.Status().Update(ctx, pool); err != nil {
+		t.Fatal(err)
+	}
+	fence := store.ControllerEpochFence{Name: store.DefaultControllerEpochName, Epoch: 1}
+	if _, _, err := dispatcher.claimRuntimePoolReservation(ctx, first, pool.Name, fence, 1); err != nil {
+		t.Fatal(err)
+	}
+	current := &corev1alpha1.RuntimePool{}
+	if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(pool), current); err != nil {
+		t.Fatal(err)
+	}
+	if len(current.Status.Capacity.Reservations) != 1 || current.Status.Capacity.Reservations[0].TaskUID != string(first.UID) {
+		t.Fatalf("stale reservations were not reclaimed: %#v", current.Status.Capacity.Reservations)
+	}
+}
+
+func TestACPDispatcherPreAcceptanceRateLimitRequeuesWithoutTerminalFailure(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	task := runtimePoolReservationTestTask("rate-limited", "rate-limited-uid", "pool-uid")
+	task.Status.Execution.State = corev1alpha1.TaskExecutionStatePlanned
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}).WithObjects(task).Build()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "store.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	controlStore := sqlite.NewStore(db, "test")
+	epochs := NewControllerEpochManager(controlStore, "controller-test")
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	fence, err := epochs.CurrentFence(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	key := store.PromptAttemptKey{Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: task.Status.Execution.PromptID}
+	attemptID, err := key.CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := controlStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{
+		ID: attemptID, Key: key, RequestDigest: task.Status.Execution.RequestDigest,
+		ExecutionState: store.PromptExecutionQueued, DeliveryState: store.PromptDeliveryNotRequested,
+	}), fence); err != nil {
+		t.Fatal(err)
+	}
+	dispatcher := &ACPDispatcher{Client: kubeClient, Store: controlStore, Epochs: epochs}
+	for _, transition := range []struct {
+		from, to store.PromptExecutionState
+	}{
+		{store.PromptExecutionQueued, store.PromptExecutionReserved},
+		{store.PromptExecutionReserved, store.PromptExecutionSessionStarting},
+		{store.PromptExecutionSessionStarting, store.PromptExecutionPlanned},
+	} {
+		if err := dispatcher.transitionAttempt(ctx, attemptID, fence, transition.from, transition.to, "test-"+string(transition.to), nil); err != nil {
+			t.Fatal(err)
+		}
+	}
+	rateLimited := &harnessv2.ClientError{StatusCode: http.StatusTooManyRequests, Code: harnessv2.ErrorCodeRateLimited, Retryable: true}
+	if err := dispatcher.handlePrePromptClientError(ctx, task.DeepCopy(), attemptID, fence, rateLimited); err != nil {
+		t.Fatal(err)
+	}
+	attempt, err := controlStore.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if attempt.ExecutionState != store.PromptExecutionReserved {
+		t.Fatalf("rate-limited attempt state = %s, want Reserved", attempt.ExecutionState)
+	}
+	updated := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(task), updated); err != nil {
+		t.Fatal(err)
+	}
+	if updated.Status.Execution == nil || updated.Status.Execution.State != corev1alpha1.TaskExecutionStateReserved || updated.Status.Execution.Reason != corev1alpha1.TaskExecutionReasonAtCapacity || taskExecutionStateTerminal(updated.Status.Execution.State) {
+		t.Fatalf("rate-limited task was not nonterminal: %#v", updated.Status.Execution)
+	}
+	cancelEpoch()
+	if err := <-epochDone; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestACPDispatcherReservedRetryReportsOnlyBoundedStage(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	task := runtimePoolReservationTestTask("session-retry", "session-retry-uid", "pool-uid")
+	task.Status.Execution.State = corev1alpha1.TaskExecutionStateReserved
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).
+		WithStatusSubresource(&corev1alpha1.Task{}).
+		WithObjects(task).
+		Build()
+	dispatcher := &ACPDispatcher{Client: kubeClient}
+
+	if err := dispatcher.requeueReservedTask(
+		context.Background(), task.DeepCopy(), acpReservedRetrySessionPreparation,
+		errors.New("sensitive provider diagnostic"),
+	); err != nil {
+		t.Fatal(err)
+	}
+
+	updated := &corev1alpha1.Task{}
+	if err := kubeClient.Get(context.Background(), client.ObjectKeyFromObject(task), updated); err != nil {
+		t.Fatal(err)
+	}
+	if updated.Status.Execution == nil {
+		t.Fatal("reserved retry removed execution status")
+	}
+	if got, want := updated.Status.Execution.Message, "RuntimePool admission will be retried (stage: session-preparation)"; got != want {
+		t.Fatalf("retry message = %q, want %q", got, want)
+	}
+	if strings.Contains(updated.Status.Execution.Message, "sensitive provider diagnostic") {
+		t.Fatalf("retry message exposed the underlying cause: %q", updated.Status.Execution.Message)
+	}
+}
+
+//nolint:gocyclo // The recovery proof keeps the cross-store state transitions visible in one test.
+func TestACPDispatcherReserveTaskRecoversIncompletePreSubmissionRollback(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := coordinationv1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+
+	task := runtimePoolReservationTestTask("session-rollback", "session-rollback-uid", "pool-uid")
+	task.Status.Execution.State = corev1alpha1.TaskExecutionStateReserved
+	task.Spec.SessionRef = &corev1alpha1.SessionReference{Name: "session-rollback", Create: true, Append: true}
+	pool := &corev1alpha1.RuntimePool{
+		ObjectMeta: metav1.ObjectMeta{Namespace: task.Namespace, Name: "pool", UID: types.UID("pool-uid"), Generation: 1},
+		Spec: corev1alpha1.RuntimePoolSpec{
+			DesiredReplicas: 1,
+			Capacity: &corev1alpha1.RuntimePoolCapacitySpec{
+				MaxResidentSessions: 1,
+				MaxRunningPrompts:   1,
+			},
+		},
+		Status: corev1alpha1.RuntimePoolStatus{
+			Lifecycle:      corev1alpha1.RuntimePoolLifecycleServing,
+			AdmissionState: corev1alpha1.RuntimePoolAdmissionAccepting,
+			ActiveInstance: &corev1alpha1.RuntimePoolActiveInstanceStatus{
+				RuntimeInstanceID: "pod-uid.boot-id",
+				ControllerEpoch:   1,
+			},
+			Capacity: corev1alpha1.RuntimePoolCapacityStatus{
+				MaxResidentSessions: 1,
+				MaxRunningPrompts:   1,
+			},
+		},
+	}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).
+		WithStatusSubresource(
+			&corev1alpha1.Task{}, &corev1alpha1.RuntimePool{},
+			&corev1alpha1.ControllerEpoch{}, &corev1alpha1.PromptAttempt{},
+		).
+		WithObjects(task.DeepCopy(), pool.DeepCopy()).
+		Build()
+	kubeClient = withControllerEpochLeaseUIDs(t, kubeClient)
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "session-rollback.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	sqliteStore := sqlite.NewStore(db, "session-rollback-test")
+	controlStore, err := kubestore.NewComposite(kubeClient, "orka-system", sqliteStore)
+	if err != nil {
+		t.Fatal(err)
+	}
+	epochs := NewControllerEpochManager(controlStore, "session-rollback-controller")
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	fence, err := epochs.CurrentFence(ctx)
+	if err != nil {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+	if fence.Epoch != pool.Status.ActiveInstance.ControllerEpoch {
+		cancelEpoch()
+		t.Fatalf("controller epoch = %d, want %d", fence.Epoch, pool.Status.ActiveInstance.ControllerEpoch)
+	}
+
+	key := store.PromptAttemptKey{
+		Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: task.Status.Execution.PromptID,
+	}
+	attempt, err := controlStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{
+		Key: key, RequestDigest: task.Status.Execution.RequestDigest,
+	}), fence)
+	if err != nil {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+	dispatcher := &ACPDispatcher{
+		Client: kubeClient, APIReader: kubeClient, Store: controlStore, Epochs: epochs,
+		ReservationTTL: time.Minute,
+	}
+	if err := dispatcher.transitionAttempt(
+		ctx, attempt.ID, fence, store.PromptExecutionQueued, store.PromptExecutionReserved, "reserve-session-rollback", nil,
+	); err != nil {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+	if err := dispatcher.transitionAttempt(
+		ctx, attempt.ID, fence, store.PromptExecutionReserved, store.PromptExecutionSessionStarting,
+		"session-starting-session-rollback", &attemptRuntimeBinding{
+			RuntimeInstanceID: "pod-uid.boot-id", SessionUID: "session-uid", SessionGeneration: 1,
+		},
+	); err != nil {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+
+	reserved, target, err := dispatcher.reserveTask(ctx, task.DeepCopy())
+	if err != nil {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+	if reserved == nil || target.pool == nil || target.reservation == nil {
+		cancelEpoch()
+		t.Fatalf("reserveTask() = task %#v, target %#v; want recovered reservation", reserved, target)
+	}
+	reservedPool := &corev1alpha1.RuntimePool{}
+	if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(pool), reservedPool); err != nil {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+	if len(reservedPool.Status.Capacity.Reservations) != 1 ||
+		reservedPool.Status.Capacity.Reservations[0].ResidentSlots != 0 ||
+		reservedPool.Status.Capacity.Reservations[0].PromptSlots != 1 ||
+		reservedPool.Status.Capacity.ReservedSessions != 0 ||
+		reservedPool.Status.Capacity.ReservedPrompts != 1 {
+		cancelEpoch()
+		t.Fatalf("Session-backed reservation = %#v, want prompt-only capacity", reservedPool.Status.Capacity)
+	}
+	recovered, err := controlStore.GetPromptAttempt(ctx, attempt.ID)
+	if err != nil {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+	if recovered.ExecutionState != store.PromptExecutionReserved || recovered.SessionUID != "" || recovered.SessionLeaseGeneration != 0 {
+		cancelEpoch()
+		t.Fatalf("recovered PromptAttempt = %#v, want unbound Reserved", recovered)
+	}
+	if reserved.Status.Execution == nil || reserved.Status.Execution.State != corev1alpha1.TaskExecutionStateReserved ||
+		reserved.Status.Execution.Reason != "" || reserved.Status.Execution.Message != "" {
+		cancelEpoch()
+		t.Fatalf("recovered Task execution = %#v, want clean Reserved", reserved.Status.Execution)
+	}
+	if err := dispatcher.releaseRuntimePoolReservation(ctx, *target.reservation); err != nil {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+	cancelEpoch()
+	if err := <-epochDone; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func newRuntimePoolReservationTestFixture(t *testing.T) (*ACPDispatcher, client.Client, *corev1alpha1.RuntimePool, *corev1alpha1.Task, *corev1alpha1.Task) {
+	t.Helper()
+	const maxResident, maxPrompts int32 = 1, 1
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	pool := &corev1alpha1.RuntimePool{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "pool", UID: types.UID("pool-uid"), Generation: 1},
+		Spec:       corev1alpha1.RuntimePoolSpec{Capacity: &corev1alpha1.RuntimePoolCapacitySpec{MaxResidentSessions: maxResident, MaxRunningPrompts: maxPrompts}},
+		Status: corev1alpha1.RuntimePoolStatus{
+			Lifecycle: corev1alpha1.RuntimePoolLifecycleServing, AdmissionState: corev1alpha1.RuntimePoolAdmissionAccepting,
+			ActiveInstance: &corev1alpha1.RuntimePoolActiveInstanceStatus{RuntimeInstanceID: "pod-uid.boot-id", ControllerEpoch: 1},
+			Capacity:       corev1alpha1.RuntimePoolCapacityStatus{MaxResidentSessions: maxResident, MaxRunningPrompts: maxPrompts},
+		},
+	}
+	first := runtimePoolReservationTestTask("first", "first-uid", string(pool.UID))
+	second := runtimePoolReservationTestTask("second", "second-uid", string(pool.UID))
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.RuntimePool{}).WithObjects(pool).Build()
+	return &ACPDispatcher{Client: kubeClient, ReservationTTL: time.Minute}, kubeClient, pool.DeepCopy(), first, second
+}
+
+func TestACPDispatcherRuntimePoolReservationResidentUpgradeChecksCapacity(t *testing.T) {
+	dispatcher, kubeClient, pool, task, _ := newRuntimePoolReservationTestFixture(t)
+	ctx := context.Background()
+	current := &corev1alpha1.RuntimePool{}
+	if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(pool), current); err != nil {
+		t.Fatal(err)
+	}
+	current.Status.Capacity.ResidentSessions = 1
+	if err := kubeClient.Status().Update(ctx, current); err != nil {
+		t.Fatal(err)
+	}
+
+	_, identity, err := dispatcher.claimRuntimePoolReservation(
+		ctx, task, pool.Name, store.ControllerEpochFence{Epoch: 1}, 0,
+	)
+	if err != nil {
+		t.Fatalf("claim prompt-only reservation: %v", err)
+	}
+	lease := newACPRuntimePoolReservationLease(dispatcher, identity)
+	if err := lease.setSlots(ctx, 1); !errors.Is(err, errACPRuntimePoolAtCapacity) {
+		t.Fatalf("resident upgrade error = %v, want RuntimePool capacity", err)
+	}
+	if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(pool), current); err != nil {
+		t.Fatal(err)
+	}
+	if len(current.Status.Capacity.Reservations) != 1 ||
+		current.Status.Capacity.Reservations[0].ResidentSlots != 0 ||
+		current.Status.Capacity.Reservations[0].PromptSlots != 1 ||
+		current.Status.Capacity.ReservedSessions != 0 || current.Status.Capacity.ReservedPrompts != 1 {
+		t.Fatalf("capacity-denied upgrade mutated reservation: %#v", current.Status.Capacity)
+	}
+
+	current.Status.Capacity.ResidentSessions = 0
+	if err := kubeClient.Status().Update(ctx, current); err != nil {
+		t.Fatal(err)
+	}
+	if err := lease.setSlots(ctx, 1); err != nil {
+		t.Fatalf("upgrade reservation after capacity release: %v", err)
+	}
+	if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(pool), current); err != nil {
+		t.Fatal(err)
+	}
+	if len(current.Status.Capacity.Reservations) != 1 ||
+		current.Status.Capacity.Reservations[0].ResidentSlots != 1 ||
+		current.Status.Capacity.Reservations[0].PromptSlots != 1 ||
+		current.Status.Capacity.ReservedSessions != 1 || current.Status.Capacity.ReservedPrompts != 1 {
+		t.Fatalf("resident upgrade was not committed atomically: %#v", current.Status.Capacity)
+	}
+}
+
+func runtimePoolReservationTestTask(name, uid, poolUID string) *corev1alpha1.Task {
+	return &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: name, UID: types.UID(uid)},
+		Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent},
+		Status: corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateQueued, Attempt: 1, PromptID: "prompt-" + uid + "-1",
+			RuntimePoolName: "pool", RuntimePoolUID: poolUID, RequestDigest: testControlDigestForDispatcher(name), ControllerEpoch: 1,
+		}},
+	}
+}
+
+func TestACPDispatcherQuiescesInterruptedSessionPreparation(t *testing.T) {
+	for _, openTurn := range []bool{false, true} {
+		name := "lease-only"
+		if openTurn {
+			name = "open-turn"
+		}
+		t.Run(name, func(t *testing.T) {
+			ctx := context.Background()
+			controlStore, fence, closeStore := newACPSessionTestStore(t, filepath.Join(t.TempDir(), name+".db"))
+			defer closeStore()
+			continuity := newACPSessionTestContinuity(t, controlStore, ACPBootstrapLimits{})
+			taskUID := types.UID("77777777-7777-7777-7777-777777777777")
+			promptID := "prompt-" + string(taskUID) + "-1"
+			task := &corev1alpha1.Task{
+				ObjectMeta: metav1.ObjectMeta{Namespace: "ns", Name: "interrupted-" + name, UID: taskUID},
+				Spec: corev1alpha1.TaskSpec{
+					Type: corev1alpha1.TaskTypeAgent, Prompt: "deadline during session preparation",
+					SessionRef: &corev1alpha1.SessionReference{Name: "interrupted-" + name, Create: true, Append: true},
+				},
+				Status: corev1alpha1.TaskStatus{Attempts: 1, Execution: &corev1alpha1.TaskExecutionStatus{
+					State: corev1alpha1.TaskExecutionStateReserved, Attempt: 1, PromptID: promptID,
+					RequestDigest: testControlDigestForDispatcher("interrupted-" + name), ControllerEpoch: fence.Epoch,
+				}},
+			}
+			scheme := runtime.NewScheme()
+			if err := corev1alpha1.AddToScheme(scheme); err != nil {
+				t.Fatal(err)
+			}
+			kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}).WithObjects(task.DeepCopy()).Build()
+			key := store.PromptAttemptKey{Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: promptID}
+			attempt, err := controlStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{Key: key, RequestDigest: task.Status.Execution.RequestDigest}), fence)
+			if err != nil {
+				t.Fatal(err)
+			}
+			attempt, err = controlStore.TransitionPromptAttemptExecution(ctx, store.PromptAttemptExecutionTransition{
+				ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+				NewState: store.PromptExecutionReserved, OperationID: "reserve-" + name,
+				OperationDigest: testControlDigestForDispatcher("reserve-" + name), UpdatedAt: time.Now().UTC(),
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+			dispatcher := &ACPDispatcher{
+				Client: kubeClient, APIReader: kubeClient, Store: controlStore, Sessions: continuity,
+				runtimeSessions: make(map[string]ACPRuntimeSessionBinding),
+			}
+
+			var opened *acpTaskSession
+			if openTurn {
+				opened, err = dispatcher.prepareTaskSession(
+					ctx, task, fence, harnessv2.ProfileDigest(testControlDigestForDispatcher("profile-"+name)),
+					testControlDigestForDispatcher("mcp-"+name),
+					harnessv2.RuntimeInstanceID("runtime-instance"), harnessv2.SupervisorBootID("boot-id"),
+					acpSessionLineageIdentity{},
+				)
+				if err != nil {
+					t.Fatal(err)
+				}
+			} else {
+				control, err := continuity.EnsureSession(ctx, ACPEnsureSessionRequest{
+					Namespace: task.Namespace, SessionName: task.Spec.SessionRef.Name, SessionType: "task", Fence: fence, CreatedAt: time.Now().UTC(),
+				})
+				if err != nil {
+					t.Fatal(err)
+				}
+				if err := dispatcher.transitionAttempt(ctx, attempt.ID, fence, store.PromptExecutionReserved, store.PromptExecutionSessionStarting, "session-starting-"+name, &attemptRuntimeBinding{
+					RuntimeInstanceID: "runtime-instance", SessionUID: control.SessionUID, SessionGeneration: control.LeaseGeneration + 1,
+				}); err != nil {
+					t.Fatal(err)
+				}
+				if _, err := dispatcher.acquireTaskSessionLease(ctx, task, fence, control, acpSessionLineageIdentity{}); err != nil {
+					t.Fatal(err)
+				}
+			}
+
+			recovered, err := dispatcher.quiesceInterruptedTaskSessionPreparation(ctx, task, attempt.ID, fence)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if openTurn {
+				if recovered == nil || recovered.Turn == nil || opened == nil || recovered.Turn.Turn.ID != opened.Turn.Turn.ID {
+					t.Fatalf("recovered session = %#v, opened = %#v", recovered, opened)
+				}
+				if err := dispatcher.transitionAttemptToTerminal(ctx, attempt.ID, fence, store.PromptExecutionCancelled, "deadline-"+name); err != nil {
+					t.Fatal(err)
+				}
+				if err := dispatcher.reconcileUnfinalizedTaskSession(ctx, task, fence, recovered, context.DeadlineExceeded); err != nil {
+					t.Fatal(err)
+				}
+				turn, err := controlStore.GetSessionTurn(ctx, recovered.Turn.Turn.ID)
+				if err != nil {
+					t.Fatal(err)
+				}
+				if turn.State != store.SessionTurnFinalized {
+					t.Fatalf("SessionTurn state = %s, want %s", turn.State, store.SessionTurnFinalized)
+				}
+			} else {
+				if recovered != nil {
+					t.Fatalf("lease-only cleanup recovered SessionTurn %#v", recovered)
+				}
+				attempt, err := controlStore.GetPromptAttempt(ctx, attempt.ID)
+				if err != nil {
+					t.Fatal(err)
+				}
+				if attempt.ExecutionState != store.PromptExecutionReserved || attempt.SessionUID != "" || attempt.SessionLeaseGeneration != 0 {
+					t.Fatalf("quiesced PromptAttempt = %#v", attempt)
+				}
+			}
+			control, err := controlStore.GetSessionControl(ctx, task.Namespace, task.Spec.SessionRef.Name)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if control.Lease != nil {
+				t.Fatalf("interrupted preparation leaked mutation lease: %#v", control.Lease)
+			}
+		})
+	}
+}
+
+func TestACPDispatcherAbortsLeaseWhenSessionTurnOpenFails(t *testing.T) {
+	ctx := context.Background()
+	baseStore, fence, closeStore := newACPSessionTestStore(t, filepath.Join(t.TempDir(), "open-failure.db"))
+	defer closeStore()
+	failingStore := &failSessionTurnOpenStore{DurableControlStore: baseStore}
+	continuity, err := NewACPSessionContinuity(ACPSessionContinuityConfig{
+		SessionControls: failingStore, Transcripts: baseStore, Publications: failingStore, BranchClaims: failingStore,
+		NewSessionUID: func() (string, error) { return "open-failure-session-uid", nil },
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	taskUID := types.UID("66666666-6666-6666-6666-666666666666")
+	promptID := "prompt-" + string(taskUID) + "-1"
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "ns", Name: "open-failure", UID: taskUID},
+		Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Prompt: "fail open", SessionRef: &corev1alpha1.SessionReference{Name: "open-failure", Create: true, Append: true}},
+		Status: corev1alpha1.TaskStatus{Attempts: 1, Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateReserved, Attempt: 1, PromptID: promptID,
+			RequestDigest: testControlDigestForDispatcher("open-failure"), ControllerEpoch: fence.Epoch,
+		}},
+	}
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}).WithObjects(task.DeepCopy()).Build()
+	key := store.PromptAttemptKey{Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: promptID}
+	attempt, err := baseStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{Key: key, RequestDigest: task.Status.Execution.RequestDigest}), fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = baseStore.TransitionPromptAttemptExecution(ctx, store.PromptAttemptExecutionTransition{
+		ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+		NewState: store.PromptExecutionReserved, OperationID: "reserve-open-failure", OperationDigest: testControlDigestForDispatcher("reserve-open-failure"), UpdatedAt: time.Now().UTC(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	dispatcher := &ACPDispatcher{Client: kubeClient, Store: failingStore, Sessions: continuity, runtimeSessions: make(map[string]ACPRuntimeSessionBinding)}
+	if _, err := dispatcher.prepareTaskSession(
+		ctx, task, fence, harnessv2.ProfileDigest(testControlDigestForDispatcher("profile-open-failure")),
+		testControlDigestForDispatcher("mcp-open-failure"), "runtime", "boot",
+		acpSessionLineageIdentity{},
+	); err == nil {
+		t.Fatal("prepareTaskSession unexpectedly succeeded")
+	}
+	control, err := baseStore.GetSessionControl(ctx, task.Namespace, task.Spec.SessionRef.Name)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if control.Lease != nil {
+		t.Fatalf("failed SessionTurn open leaked lease: %#v", control.Lease)
+	}
+	attempt, err = baseStore.GetPromptAttempt(ctx, attempt.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if attempt.ExecutionState != store.PromptExecutionReserved {
+		t.Fatalf("attempt state = %s", attempt.ExecutionState)
+	}
+}
+
+type failSessionTurnOpenStore struct{ store.DurableControlStore }
+
+func (s *failSessionTurnOpenStore) CreateSessionTurn(context.Context, store.CreateSessionTurnRequest) (*store.SessionTurn, error) {
+	return nil, store.ValidationErrorf("simulated SessionTurn persistence failure")
+}
+func (s *failSessionTurnOpenStore) GetSessionTurn(context.Context, string) (*store.SessionTurn, error) {
+	return nil, store.ErrNotFound
+}
+
+type orderedSessionControlStore struct {
+	store.SessionControlStore
+	onFinalized func()
+}
+
+func (s *orderedSessionControlStore) FinalizeSessionTurn(
+	ctx context.Context,
+	request store.FinalizeSessionTurnRequest,
+) (*store.SessionTurn, error) {
+	turn, err := s.SessionControlStore.FinalizeSessionTurn(ctx, request)
+	if err == nil && s.onFinalized != nil {
+		s.onFinalized()
+	}
+	return turn, err
+}
+
+func TestACPWorkspaceDeltaLimitsFromTaskPolicy(t *testing.T) {
+	maxFiles := int32(7)
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Workspace: &corev1alpha1.WorkspaceConfig{
+		MaxChangedFiles:            &maxFiles,
+		AllowedPaths:               []string{"internal/**", "README.md"},
+		DenyRepositoryControlPaths: true,
+		RejectBinaryFiles:          true,
+		RejectSecretLikeContent:    true,
+	}}}
+	limits := acpWorkspaceDeltaLimits(task)
+	if limits.MaxChangedFiles != 7 || !slices.Equal(limits.AllowedPaths, []string{"internal/**", "README.md"}) || !limits.DenyRepositoryControlPaths || !limits.RejectBinaryFiles || !limits.RejectSecretLikeContent {
+		t.Fatalf("limits = %#v", limits)
+	}
+	limits.AllowedPaths[0] = "changed"
+	if task.Spec.Workspace.AllowedPaths[0] != "internal/**" {
+		t.Fatal("limits alias Task workspace policy")
+	}
+}
+
+func TestACPDispatcherGatewaySessionUsesTranscriptBackedPrompt(t *testing.T) {
+	ctx := context.Background()
+	controlStore, fence, closeStore := newACPSessionTestStore(t, filepath.Join(t.TempDir(), "gateway-transcript.db"))
+	defer closeStore()
+	continuity := newACPSessionTestContinuity(t, controlStore, ACPBootstrapLimits{})
+	const (
+		sessionName   = "gateway-session"
+		gatewayPrompt = "answer the gateway request from the canonical transcript"
+	)
+	throughMessageID := store.GatewayUserMessageID("gateway-event")
+	if err := controlStore.CreateSession(ctx, &store.SessionRecord{
+		Namespace: "ns", Name: sessionName, SessionType: store.SessionTypeGateway,
+		CreatedAt: time.Now().UTC(), UpdatedAt: time.Now().UTC(),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if err := controlStore.AppendMessages(ctx, "ns", sessionName, []store.SessionMessage{
+		{ID: "gateway:prior:user", Role: "user", Content: "earlier request", Timestamp: time.Now().UTC()},
+		{ID: "gateway:prior:assistant", Role: "assistant", Content: "earlier response", Timestamp: time.Now().UTC()},
+		{ID: throughMessageID, Role: "user", Content: gatewayPrompt, Timestamp: time.Now().UTC()},
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	taskUID := types.UID("88888888-8888-8888-8888-888888888888")
+	promptID := "prompt-" + string(taskUID) + "-1"
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "ns", Name: "gateway-task", UID: taskUID},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent,
+			SessionRef: &corev1alpha1.SessionReference{
+				Name: sessionName, Create: false, Append: false,
+				MaxMessages:      int32(store.GatewayTranscriptMessageLimit),
+				ThroughMessageID: throughMessageID, PromptIncluded: true,
+			},
+		},
+		Status: corev1alpha1.TaskStatus{Attempts: 1, Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateReserved, Attempt: 1, PromptID: promptID,
+			RequestDigest: testControlDigestForDispatcher("gateway-transcript"), ControllerEpoch: fence.Epoch,
+		}},
+	}
+	key := store.PromptAttemptKey{Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: promptID}
+	attempt, err := controlStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{Key: key, RequestDigest: task.Status.Execution.RequestDigest}), fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := controlStore.TransitionPromptAttemptExecution(ctx, store.PromptAttemptExecutionTransition{
+		ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+		NewState: store.PromptExecutionReserved, OperationID: "reserve-gateway-transcript",
+		OperationDigest: testControlDigestForDispatcher("reserve-gateway-transcript"), UpdatedAt: time.Now().UTC(),
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	dispatcher := &ACPDispatcher{Store: controlStore, Sessions: continuity, runtimeSessions: make(map[string]ACPRuntimeSessionBinding)}
+	session, err := dispatcher.prepareTaskSession(
+		ctx, task, fence, harnessv2.ProfileDigest(testControlDigestForDispatcher("profile-gateway-transcript")),
+		testControlDigestForDispatcher("mcp-gateway-transcript"),
+		harnessv2.RuntimeInstanceID("runtime-instance"), harnessv2.SupervisorBootID("boot-id"),
+		acpSessionLineageIdentity{},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if session == nil || session.Turn == nil || session.Bootstrap == nil {
+		t.Fatalf("gateway session preparation = %#v", session)
+	}
+	if !session.Turn.SkipTranscriptAppend {
+		t.Fatalf("gateway transcript append policy = %#v", session.Turn)
+	}
+	if session.UserPrompt != gatewayPrompt || session.Turn.Turn.UserPrompt != gatewayPrompt {
+		t.Fatalf("gateway prompt binding = %#v, turn=%#v", session, session.Turn.Turn)
+	}
+	if len(session.Bootstrap.Messages) != 2 || strings.Contains(string(session.Bootstrap.Artifact), gatewayPrompt) {
+		t.Fatalf("gateway bootstrap duplicated the current prompt: %#v", session.Bootstrap.Messages)
+	}
+	recovered, err := dispatcher.recoveredTaskSession(ctx, task, mustPromptAttemptForDispatcherTest(t, controlStore, attempt.ID))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if recovered == nil || recovered.UserPrompt != gatewayPrompt || recovered.Bootstrap == nil ||
+		strings.Contains(string(recovered.Bootstrap.Artifact), gatewayPrompt) {
+		t.Fatalf("recovered gateway session = %#v", recovered)
+	}
+	content := acpPromptInputContent(bootstrapPromptText(session.Bootstrap), session.UserPrompt)
+	if len(content) != 2 || !strings.Contains(content[0].Text, "earlier response") || content[1].Text != gatewayPrompt {
+		t.Fatalf("gateway provider input = %#v, want history then exact current prompt", content)
+	}
+
+	attempt, err = controlStore.GetPromptAttempt(ctx, attempt.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, state := range []store.PromptExecutionState{
+		store.PromptExecutionPlanned, store.PromptExecutionSubmitting, store.PromptExecutionAccepted,
+		store.PromptExecutionRunning, store.PromptExecutionSettling, store.PromptExecutionSucceeded,
+	} {
+		operationID := "gateway-execution-" + string(state)
+		attempt, err = controlStore.TransitionPromptAttemptExecution(ctx, store.PromptAttemptExecutionTransition{
+			ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+			NewState: state, OperationID: operationID, OperationDigest: testControlDigestForDispatcher(operationID),
+			UpdatedAt: attempt.UpdatedAt.Add(time.Second),
+		})
+		if err != nil {
+			t.Fatalf("transition gateway attempt to %s: %v", state, err)
+		}
+	}
+	if _, err := continuity.FinalizeAssistantResult(ctx, ACPFinalizeAssistantRequest{
+		SessionTurn: *session.Turn, Fence: fence, AssistantResult: "gateway response",
+		Projection: acpSessionProjectionForTest("gateway-final", "Succeeded"), FinalizedAt: time.Now().UTC(),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	transcript, err := controlStore.LoadTranscript(ctx, task.Namespace, sessionName, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(transcript) != 3 || transcript[2].ID != throughMessageID {
+		t.Fatalf("gateway ACP finalization duplicated transcript entries: %#v", transcript)
+	}
+}
+
+func TestACPDispatcherGatewayCreateFalseDoesNotCreateMissingTranscript(t *testing.T) {
+	ctx := context.Background()
+	controlStore, fence, closeStore := newACPSessionTestStore(t, filepath.Join(t.TempDir(), "gateway-missing.db"))
+	defer closeStore()
+	continuity := newACPSessionTestContinuity(t, controlStore, ACPBootstrapLimits{})
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "ns", Name: "gateway-missing", UID: types.UID("99999999-9999-9999-9999-999999999999")},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent,
+			SessionRef: &corev1alpha1.SessionReference{
+				Name: "missing-gateway-session", Create: false, Append: false,
+				MaxMessages:      int32(store.GatewayTranscriptMessageLimit),
+				ThroughMessageID: store.GatewayUserMessageID("missing-event"), PromptIncluded: true,
+			},
+		},
+	}
+	dispatcher := &ACPDispatcher{Store: controlStore, Sessions: continuity}
+	_, err := dispatcher.planTaskSession(
+		ctx, task, fence, harnessv2.ProfileDigest(testControlDigestForDispatcher("profile-gateway-missing")),
+		testControlDigestForDispatcher("mcp-gateway-missing"), "runtime", "boot",
+	)
+	if !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("missing gateway transcript error = %v, want ErrNotFound", err)
+	}
+	if _, err := controlStore.GetSession(ctx, task.Namespace, task.Spec.SessionRef.Name); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("missing gateway transcript was created: %v", err)
+	}
+	if _, err := controlStore.GetSessionControl(ctx, task.Namespace, task.Spec.SessionRef.Name); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("missing gateway SessionControl was created: %v", err)
+	}
+}
+
+func mustPromptAttemptForDispatcherTest(t *testing.T, storeValue store.PromptAttemptStore, id string) *store.PromptAttempt {
+	t.Helper()
+	attempt, err := storeValue.GetPromptAttempt(context.Background(), id)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return attempt
+}
+
+func TestACPDispatcherHonorsMaxMessagesWithoutThroughMessageID(t *testing.T) {
+	ctx := context.Background()
+	controlStore, fence, closeStore := newACPSessionTestStore(t, filepath.Join(t.TempDir(), "max-messages.db"))
+	defer closeStore()
+	continuity := newACPSessionTestContinuity(t, controlStore, ACPBootstrapLimits{})
+	control := ensureACPSessionForTest(t, continuity, fence, "max-messages")
+	if err := controlStore.AppendMessages(ctx, control.Namespace, control.SessionName, []store.SessionMessage{
+		{Role: "user", Content: "oldest", Timestamp: time.Now().UTC()},
+		{Role: "assistant", Content: "middle", Timestamp: time.Now().UTC()},
+		{Role: "user", Content: "newest", Timestamp: time.Now().UTC()},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: control.Namespace},
+		Spec: corev1alpha1.TaskSpec{
+			Prompt: "continue",
+			SessionRef: &corev1alpha1.SessionReference{
+				Name: control.SessionName, Append: true, MaxMessages: 1,
+			},
+		},
+	}
+	bootstrap, userPrompt, err := (&ACPDispatcher{Sessions: continuity}).resolveTaskSessionBootstrap(ctx, task, control)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if userPrompt != task.Spec.Prompt {
+		t.Fatalf("user prompt = %q, want %q", userPrompt, task.Spec.Prompt)
+	}
+	if bootstrap == nil || len(bootstrap.Messages) != 1 || bootstrap.Messages[0].Content != "newest" {
+		t.Fatalf("bounded bootstrap = %#v, want only newest message", bootstrap)
+	}
+}
+
+func TestACPDispatcherPromptIncludedSessionAppendsAssistantOnly(t *testing.T) {
+	ctx := context.Background()
+	controlStore, fence, closeStore := newACPSessionTestStore(t, filepath.Join(t.TempDir(), "prompt-included-append.db"))
+	defer closeStore()
+	continuity := newACPSessionTestContinuity(t, controlStore, ACPBootstrapLimits{})
+	control := ensureACPSessionForTest(t, continuity, fence, "prompt-included-append")
+	const (
+		throughMessageID = "canonical-user"
+		currentPrompt    = "canonical transcript prompt"
+		assistantResult  = "assistant result"
+	)
+	if err := controlStore.AppendMessages(ctx, control.Namespace, control.SessionName, []store.SessionMessage{
+		{ID: "earlier-assistant", Role: "assistant", Content: "earlier response", Timestamp: time.Now().UTC()},
+		{ID: throughMessageID, Role: "user", Content: currentPrompt, Timestamp: time.Now().UTC()},
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	taskUID := types.UID("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa")
+	promptID := "prompt-" + string(taskUID) + "-1"
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: control.Namespace, Name: "prompt-included-append", UID: taskUID},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent,
+			SessionRef: &corev1alpha1.SessionReference{
+				Name: control.SessionName, Create: false, Append: true, MaxMessages: 50,
+				ThroughMessageID: throughMessageID, PromptIncluded: true,
+			},
+		},
+		Status: corev1alpha1.TaskStatus{Attempts: 1, Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateReserved, Attempt: 1, PromptID: promptID,
+			RequestDigest: testControlDigestForDispatcher("prompt-included-append"), ControllerEpoch: fence.Epoch,
+		}},
+	}
+	key := store.PromptAttemptKey{Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: promptID}
+	attempt, err := controlStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{Key: key, RequestDigest: task.Status.Execution.RequestDigest}), fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	attempt, err = controlStore.TransitionPromptAttemptExecution(ctx, store.PromptAttemptExecutionTransition{
+		ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+		NewState: store.PromptExecutionReserved, OperationID: "reserve-prompt-included-append",
+		OperationDigest: testControlDigestForDispatcher("reserve-prompt-included-append"), UpdatedAt: time.Now().UTC(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	dispatcher := &ACPDispatcher{Store: controlStore, Sessions: continuity, runtimeSessions: make(map[string]ACPRuntimeSessionBinding)}
+	session, err := dispatcher.prepareTaskSession(
+		ctx, task, fence, harnessv2.ProfileDigest(testControlDigestForDispatcher("profile-prompt-included-append")),
+		testControlDigestForDispatcher("mcp-prompt-included-append"), "runtime", "boot",
+		acpSessionLineageIdentity{},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if session == nil || session.Turn == nil || session.Bootstrap == nil {
+		t.Fatalf("prompt-included session preparation = %#v", session)
+	}
+	if session.Turn.SkipTranscriptAppend || !session.Turn.SkipUserPromptAppend {
+		t.Fatalf("prompt-included append policy = %#v", session.Turn)
+	}
+	if session.UserPrompt != currentPrompt || session.Turn.Turn.UserPrompt != currentPrompt {
+		t.Fatalf("prompt binding = %#v, turn=%#v", session, session.Turn.Turn)
+	}
+	if len(session.Bootstrap.Messages) != 1 || session.Bootstrap.Messages[0].Content != "earlier response" {
+		t.Fatalf("prompt-included bootstrap = %#v", session.Bootstrap.Messages)
+	}
+	recovered, err := dispatcher.recoveredTaskSession(ctx, task, mustPromptAttemptForDispatcherTest(t, controlStore, attempt.ID))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if recovered == nil || recovered.Turn == nil || recovered.Turn.SkipTranscriptAppend || !recovered.Turn.SkipUserPromptAppend {
+		t.Fatalf("recovered prompt-included append policy = %#v", recovered)
+	}
+
+	attempt, err = controlStore.GetPromptAttempt(ctx, attempt.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, state := range []store.PromptExecutionState{
+		store.PromptExecutionPlanned, store.PromptExecutionSubmitting, store.PromptExecutionAccepted,
+		store.PromptExecutionRunning, store.PromptExecutionSettling, store.PromptExecutionSucceeded,
+	} {
+		operationID := "prompt-included-append-" + string(state)
+		attempt, err = controlStore.TransitionPromptAttemptExecution(ctx, store.PromptAttemptExecutionTransition{
+			ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+			NewState: state, OperationID: operationID, OperationDigest: testControlDigestForDispatcher(operationID),
+			UpdatedAt: attempt.UpdatedAt.Add(time.Second),
+		})
+		if err != nil {
+			t.Fatalf("transition prompt-included attempt to %s: %v", state, err)
+		}
+	}
+	if _, err := continuity.FinalizeAssistantResult(ctx, ACPFinalizeAssistantRequest{
+		SessionTurn: *session.Turn, Fence: fence, AssistantResult: assistantResult,
+		Projection: acpSessionProjectionForTest("prompt-included-final", "Succeeded"), FinalizedAt: time.Now().UTC(),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	transcript, err := controlStore.LoadTranscript(ctx, task.Namespace, control.SessionName, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(transcript) != 3 || transcript[0].Content != "earlier response" || transcript[1].ID != throughMessageID ||
+		transcript[2].Role != "assistant" || transcript[2].Content != assistantResult {
+		t.Fatalf("prompt-included final transcript = %#v, want existing messages plus assistant only", transcript)
+	}
+}
+
+func TestRecoveredTaskSessionPreservesLegacyNonAppendTurnPolicy(t *testing.T) {
+	ctx := context.Background()
+	controlStore, fence, closeStore := newACPSessionTestStore(t, filepath.Join(t.TempDir(), "legacy-non-append.db"))
+	defer closeStore()
+	continuity := newACPSessionTestContinuity(t, controlStore, ACPBootstrapLimits{})
+	control := ensureACPSessionForTest(t, continuity, fence, "legacy-non-append")
+	const (
+		taskUID    = "legacy-non-append-task"
+		promptID   = "legacy-non-append-prompt"
+		userPrompt = "legacy prompt"
+	)
+	turn, attempt := openACPSessionTurnForTest(
+		t, continuity, controlStore, fence, control, taskUID, promptID, userPrompt,
+	)
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: control.Namespace, Name: "legacy-non-append", UID: types.UID(taskUID)},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent, Prompt: userPrompt,
+			SessionRef: &corev1alpha1.SessionReference{Name: control.SessionName, Create: false, Append: false},
+		},
+		Status: corev1alpha1.TaskStatus{Attempts: 1, Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateReserved, Attempt: 1, PromptID: promptID,
+			RequestDigest: attempt.RequestDigest, ControllerEpoch: fence.Epoch,
+		}},
+	}
+	dispatcher := &ACPDispatcher{Store: controlStore, Sessions: continuity}
+	recovered, err := dispatcher.recoveredTaskSession(ctx, task, attempt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if recovered == nil || recovered.Turn == nil || recovered.Turn.Turn.ID != turn.Turn.ID {
+		t.Fatalf("recovered legacy session = %#v", recovered)
+	}
+	if recovered.Turn.SkipTranscriptAppend {
+		t.Fatal("legacy non-append turn was migrated to transcript suppression instead of preserving its durable digest")
+	}
+}
diff --git a/internal/controller/acp_external_effect.go b/internal/controller/acp_external_effect.go
new file mode 100644
index 000000000..b396de7de
--- /dev/null
+++ b/internal/controller/acp_external_effect.go
@@ -0,0 +1,415 @@
+package controller
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"os"
+	"strings"
+	"sync/atomic"
+	"time"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	publisherservice "github.com/orka-agents/orka/internal/publisher/service"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+// externalEffectLeaseSettlementMargin is the slack an effect lease keeps beyond
+// its bounded call duration so a response returned at the deadline can still be
+// committed under a valid lease.
+const externalEffectLeaseSettlementMargin = time.Minute
+
+const acpExternalEffectLease = maxACPExternalEffectCallDuration + externalEffectLeaseSettlementMargin
+
+// maxACPExternalEffectCallDuration bounds one in-flight brokered custom-Tool
+// call so its outcome can always be committed while the ledger lease is still
+// valid. Without this bound, a call that outlives the lease plus the
+// reconciliation grace period is marked OutcomeUnknown by
+// reconcileExpiredExternalEffects, and a late upstream success can never be
+// settled. Publisher-backed effects instead honor the configured publish
+// timeout (envACPPublisherEffectTimeout) and size their lease from it, so the
+// invariant lease > call duration holds for every effect kind.
+const maxACPExternalEffectCallDuration = 4 * time.Minute
+
+// envACPPublisherEffectTimeout mirrors the Workspace/Publisher's
+// ORKA_PUBLISHER_PUBLISH_TIMEOUT on the controller. When the publisher is
+// configured with a publish timeout above the default external-effect call
+// bound, set the same value on the controller so publisher-backed effects and
+// their ledger leases are sized to the real operation deadline instead of
+// truncating it.
+const envACPPublisherEffectTimeout = "ORKA_PUBLISHER_PUBLISH_TIMEOUT"
+
+// externalEffectCallTimeout returns the bounded call duration for one external
+// effect. Brokered custom-Tool calls keep the fixed clamp their descriptors
+// were admitted under (customACPMCPToolDescriptor rejects longer HTTP
+// timeouts); publisher-backed effects honor the controller-visible publish
+// timeout so legitimately configured long publisher operations are not
+// truncated. The claimed lease is always sized as call timeout plus settlement
+// margin, so no effect can run past its own lease.
+func externalEffectCallTimeout(identity store.ExternalEffectIdentity) time.Duration {
+	if !publisherBackedExternalEffectKind(identity.Kind) {
+		return maxACPExternalEffectCallDuration
+	}
+	raw := strings.TrimSpace(os.Getenv(envACPPublisherEffectTimeout))
+	if raw == "" {
+		return maxACPExternalEffectCallDuration
+	}
+	parsed, err := time.ParseDuration(raw)
+	if err != nil || parsed <= 0 {
+		return maxACPExternalEffectCallDuration
+	}
+	return parsed
+}
+
+func publisherBackedExternalEffectKind(kind string) bool {
+	return strings.HasPrefix(kind, "publisher.") || strings.HasPrefix(kind, "workspace.")
+}
+
+var externalEffectLeaseSequence atomic.Uint64
+
+// runACPExternalEffect persists a canonical pre-execution identity before one
+// idempotent publisher/broker operation. A committed response is replayed from
+// the ledger; an in-flight identity is reclaimed only under the current epoch
+// and exact request digest.
+func runACPExternalEffect[T any](
+	ctx context.Context,
+	d *ACPDispatcher,
+	fence store.ControllerEpochFence,
+	identity store.ExternalEffectIdentity,
+	request any,
+	call func(context.Context) (T, error),
+) (T, error) {
+	return runExternalEffect(ctx, d.Store, fence, identity, request, call)
+}
+
+func runExternalEffect[T any](
+	ctx context.Context,
+	effects store.ExternalEffectStore,
+	fence store.ControllerEpochFence,
+	identity store.ExternalEffectIdentity,
+	request any,
+	call func(context.Context) (T, error),
+) (T, error) {
+	response, _, err := runExternalEffectWithReplay(ctx, effects, fence, identity, request, call)
+	return response, err
+}
+
+func runExternalEffectWithReplay[T any](
+	ctx context.Context,
+	effects store.ExternalEffectStore,
+	fence store.ControllerEpochFence,
+	identity store.ExternalEffectIdentity,
+	request any,
+	call func(context.Context) (T, error),
+) (T, bool, error) {
+	return runExternalEffectWithReplayCallTimeout(
+		ctx, effects, fence, identity, request, externalEffectCallTimeout(identity), call,
+	)
+}
+
+// runExternalEffectWithReplayCallTimeout runs one external effect with an
+// explicit bounded call duration. Callers that know the operation's real
+// configured deadline (for example a brokered Tool's spec.http.timeout) use it
+// so the effect call and the ledger lease — always sized as call timeout plus
+// settlement margin — cover the full legitimate operation instead of the
+// per-kind default clamp.
+func runExternalEffectWithReplayCallTimeout[T any](
+	ctx context.Context,
+	effects store.ExternalEffectStore,
+	fence store.ControllerEpochFence,
+	identity store.ExternalEffectIdentity,
+	request any,
+	callTimeout time.Duration,
+	call func(context.Context) (T, error),
+) (T, bool, error) {
+	var zero T
+	if effects == nil {
+		return zero, false, fmt.Errorf("external-effect store is required")
+	}
+	if callTimeout <= 0 {
+		return zero, false, fmt.Errorf("external-effect call timeout must be positive")
+	}
+	requestDigest, err := acpDomainDigest("external-effect-request", map[string]any{
+		"identity": identity, "request": request,
+	})
+	if err != nil {
+		return zero, false, err
+	}
+	now := time.Now().UTC()
+	effect, err := effects.ReserveExternalEffect(ctx, store.ReserveExternalEffectRequest{
+		Identity: identity, RequestDigest: requestDigest, Fence: fence, CreatedAt: now,
+	})
+	if err != nil {
+		return zero, false, err
+	}
+	if effect.State == store.ExternalEffectSucceeded {
+		var response T
+		if len(effect.Response) == 0 || json.Unmarshal(effect.Response, &response) != nil {
+			return zero, false, fmt.Errorf("external effect %s has an invalid committed response", effect.ID)
+		}
+		return response, true, nil
+	}
+	if effect.State == store.ExternalEffectFailed || effect.State == store.ExternalEffectOutcomeUnknown {
+		return zero, false, fmt.Errorf("external effect %s is terminal in state %s", effect.ID, effect.State)
+	}
+	// Size the lease from this effect's bounded call duration so the outcome of
+	// a call that runs to its deadline can still be committed under a valid
+	// lease, regardless of the configured per-kind timeout.
+	leaseExpiry := now.Add(callTimeout + externalEffectLeaseSettlementMargin)
+	leaseOwner := externalEffectLeaseOwner(fence, identity, now)
+	claimed, err := effects.TransitionExternalEffect(ctx, store.ExternalEffectTransition{
+		ID: effect.ID, Fence: fence, ExpectedVersion: effect.Version, ExpectedState: effect.State,
+		NewState: store.ExternalEffectInFlight, RequestDigest: requestDigest,
+		ExpectedLeaseOwner: effect.LeaseOwner, LeaseOwner: leaseOwner, LeaseExpiresAt: &leaseExpiry, UpdatedAt: now,
+	})
+	if err != nil {
+		return zero, false, err
+	}
+	// Bound the call to the duration the claimed lease accounts for. A call
+	// that ran past the lease plus the reconciliation grace period would be
+	// classified OutcomeUnknown while still in flight, making a late success
+	// permanently unsettleable.
+	callCtx, cancelCall := context.WithTimeout(ctx, callTimeout)
+	response, callErr := call(callCtx)
+	cancelCall()
+	if callErr != nil {
+		// Leave the exact effect in-flight. The same identity/digest may be
+		// reclaimed and classified by a later reconciliation; a different request
+		// cannot reuse it.
+		return zero, false, callErr
+	}
+	if err := ctx.Err(); err != nil {
+		// The side effect may have crossed its external boundary, but prompt
+		// authority was revoked before a response could be committed. Leave the
+		// ledger in-flight for explicit reconciliation rather than claiming success.
+		return zero, false, err
+	}
+	encoded, err := json.Marshal(response)
+	if err != nil {
+		return zero, false, err
+	}
+	sum := sha256.Sum256(encoded)
+	responseDigest := "sha256:" + hex.EncodeToString(sum[:])
+	completed, err := effects.TransitionExternalEffect(ctx, store.ExternalEffectTransition{
+		ID: claimed.ID, Fence: fence, ExpectedVersion: claimed.Version, ExpectedState: store.ExternalEffectInFlight,
+		NewState: store.ExternalEffectSucceeded, RequestDigest: requestDigest,
+		ResponseDigest: responseDigest, Response: encoded, ExpectedLeaseOwner: leaseOwner,
+		UpdatedAt: time.Now().UTC(),
+	})
+	if err != nil {
+		return zero, false, err
+	}
+	if completed.State != store.ExternalEffectSucceeded {
+		return zero, false, fmt.Errorf("external effect %s did not commit success", completed.ID)
+	}
+	return response, false, nil
+}
+
+func externalEffectLeaseOwner(fence store.ControllerEpochFence, identity store.ExternalEffectIdentity, now time.Time) string {
+	sequence := externalEffectLeaseSequence.Add(1)
+	sum := sha256.Sum256(fmt.Appendf(nil, "%s\x00%d\x00%s\x00%s\x00%d", fence.HolderID, fence.Epoch, identity.OperationID, now.UTC().Format(time.RFC3339Nano), sequence))
+	return "effect-" + hex.EncodeToString(sum[:16])
+}
+
+const defaultACPExternalEffectRetryDelay = 5 * time.Second
+
+// runACPExternalEffectWithRetry retries the same immutable external-effect
+// operation while retaining its controller-side lease until it commits, a
+// non-retryable response is proven, or the caller's bounded reconciliation
+// context expires. Publisher operations are idempotent by operation ID, and
+// prompt input is never replayed.
+func runACPExternalEffectWithRetry[T any](
+	ctx context.Context,
+	d *ACPDispatcher,
+	fence store.ControllerEpochFence,
+	identity store.ExternalEffectIdentity,
+	request any,
+	call func(context.Context) (T, error),
+) (T, error) {
+	return runACPExternalEffectWithRetryPolicy(
+		ctx, d, fence, identity, request,
+		defaultACPExternalEffectRetryDelay, externalEffectCallTimeout(identity), call,
+	)
+}
+
+func runACPExternalEffectWithRetryDelay[T any](
+	ctx context.Context,
+	d *ACPDispatcher,
+	fence store.ControllerEpochFence,
+	identity store.ExternalEffectIdentity,
+	request any,
+	retryDelay time.Duration,
+	call func(context.Context) (T, error),
+) (T, error) {
+	return runACPExternalEffectWithRetryPolicy(
+		ctx, d, fence, identity, request, retryDelay, externalEffectCallTimeout(identity), call,
+	)
+}
+
+func runACPExternalEffectWithRetryPolicy[T any](
+	ctx context.Context,
+	d *ACPDispatcher,
+	fence store.ControllerEpochFence,
+	identity store.ExternalEffectIdentity,
+	request any,
+	retryDelay time.Duration,
+	retryBudget time.Duration,
+	call func(context.Context) (T, error),
+) (T, error) {
+	var zero T
+	if retryDelay <= 0 {
+		return zero, fmt.Errorf("external-effect retry delay must be positive")
+	}
+	if retryBudget <= 0 || retryBudget > externalEffectCallTimeout(identity) {
+		return zero, fmt.Errorf("external-effect retry budget must be positive and leave the required lease settlement margin")
+	}
+	return runACPExternalEffect(ctx, d, fence, identity, request, func(callCtx context.Context) (T, error) {
+		retryCtx, cancel := context.WithTimeout(callCtx, retryBudget)
+		defer cancel()
+		for {
+			value, err := call(retryCtx)
+			if retryErr := retryCtx.Err(); retryErr != nil {
+				return zero, fmt.Errorf("bounded external-effect reconciliation expired: %w", retryErr)
+			}
+			if err == nil {
+				return value, nil
+			}
+			if !retryableACPExternalEffectError(err) {
+				return zero, err
+			}
+			timer := time.NewTimer(retryDelay)
+			select {
+			case <-retryCtx.Done():
+				timer.Stop()
+				return zero, fmt.Errorf("bounded external-effect reconciliation expired: %w", retryCtx.Err())
+			case <-timer.C:
+			}
+		}
+	})
+}
+
+func retryableACPExternalEffectError(err error) bool {
+	if err == nil {
+		return false
+	}
+	var clientErr *publisherservice.ClientError
+	if errors.As(err, &clientErr) {
+		return clientErr.Response.Retryable || clientErr.StatusCode == http.StatusTooManyRequests || clientErr.StatusCode >= 500
+	}
+	if errors.Is(err, store.ErrConflict) || errors.Is(err, context.DeadlineExceeded) || errors.Is(err, context.Canceled) {
+		return true
+	}
+	// Transport failures intentionally do not expose a typed upstream response.
+	// Their side-effect outcome is ambiguous and must be reconciled with the same
+	// durable identity rather than classified as a deterministic request error.
+	return true
+}
+
+func settleACPExternalEffect(
+	ctx context.Context,
+	d *ACPDispatcher,
+	fence store.ControllerEpochFence,
+	identity store.ExternalEffectIdentity,
+	state store.ExternalEffectState,
+	response any,
+) error {
+	return settleExternalEffectStore(ctx, d.Store, fence, identity, state, response)
+}
+
+func settleExternalEffectStore(
+	ctx context.Context,
+	effects store.ExternalEffectStore,
+	fence store.ControllerEpochFence,
+	identity store.ExternalEffectIdentity,
+	state store.ExternalEffectState,
+	response any,
+) error {
+	id, err := identity.CanonicalID()
+	if err != nil {
+		return err
+	}
+	effect, err := effects.GetExternalEffect(ctx, id)
+	if err != nil {
+		if errors.Is(err, store.ErrNotFound) {
+			return nil
+		}
+		return err
+	}
+	if effect.State == state {
+		return nil
+	}
+	if effect.State == store.ExternalEffectSucceeded || effect.State == store.ExternalEffectFailed || effect.State == store.ExternalEffectOutcomeUnknown {
+		return fmt.Errorf("external effect %s is already terminal in state %s", effect.ID, effect.State)
+	}
+	var encoded json.RawMessage
+	responseDigest := ""
+	if response != nil {
+		value, marshalErr := json.Marshal(response)
+		if marshalErr != nil {
+			return marshalErr
+		}
+		encoded = value
+		sum := sha256.Sum256(value)
+		responseDigest = "sha256:" + hex.EncodeToString(sum[:])
+	}
+	_, err = effects.TransitionExternalEffect(ctx, store.ExternalEffectTransition{
+		ID: effect.ID, Fence: fence, ExpectedVersion: effect.Version, ExpectedState: effect.State,
+		NewState: state, RequestDigest: effect.RequestDigest, ResponseDigest: responseDigest, Response: encoded,
+		ExpectedLeaseOwner: effect.LeaseOwner, UpdatedAt: time.Now().UTC(),
+	})
+	return err
+}
+
+func settleACPExternalEffectError(
+	ctx context.Context,
+	d *ACPDispatcher,
+	fence store.ControllerEpochFence,
+	identity store.ExternalEffectIdentity,
+	callErr error,
+) error {
+	state := store.ExternalEffectOutcomeUnknown
+	var clientErr *publisherservice.ClientError
+	if errors.As(callErr, &clientErr) && !clientErr.Response.Retryable && clientErr.StatusCode != http.StatusTooManyRequests && clientErr.StatusCode < 500 {
+		state = store.ExternalEffectFailed
+	}
+	settleCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
+	defer cancel()
+	return settleACPExternalEffect(settleCtx, d, fence, identity, state, nil)
+}
+
+const acpExternalEffectReconcileGrace = time.Minute
+
+func (d *ACPDispatcher) reconcileExpiredExternalEffects(ctx context.Context) error {
+	if d.Client == nil || d.Store == nil || d.Epochs == nil {
+		return nil
+	}
+	fence, err := d.Epochs.CurrentFence(ctx)
+	if err != nil {
+		return err
+	}
+	var effects corev1alpha1.ExternalEffectList
+	if err := d.Client.List(ctx, &effects); err != nil {
+		return err
+	}
+	now := time.Now().UTC()
+	for i := range effects.Items {
+		effect := &effects.Items[i]
+		if store.ExternalEffectState(effect.Status.State) != store.ExternalEffectInFlight || effect.Status.LeaseExpiresAt == nil ||
+			now.Before(effect.Status.LeaseExpiresAt.Add(acpExternalEffectReconcileGrace)) {
+			continue
+		}
+		_, err := d.Store.TransitionExternalEffect(ctx, store.ExternalEffectTransition{
+			ID: effect.Spec.ID, Fence: fence, ExpectedVersion: effect.Status.Version,
+			ExpectedState: store.ExternalEffectInFlight, NewState: store.ExternalEffectOutcomeUnknown,
+			RequestDigest: effect.Spec.RequestDigest, ExpectedLeaseOwner: effect.Status.LeaseOwner, UpdatedAt: now,
+		})
+		if err != nil && !errors.Is(err, store.ErrConflict) {
+			return fmt.Errorf("reconcile expired external effect %s/%s: %w", effect.Namespace, effect.Name, err)
+		}
+	}
+	return nil
+}
diff --git a/internal/controller/acp_external_effect_test.go b/internal/controller/acp_external_effect_test.go
new file mode 100644
index 000000000..4dc92dd49
--- /dev/null
+++ b/internal/controller/acp_external_effect_test.go
@@ -0,0 +1,341 @@
+package controller
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"path/filepath"
+	"testing"
+	"time"
+
+	publisherservice "github.com/orka-agents/orka/internal/publisher/service"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+const testBrokeredEffectCommittedResult = "committed"
+
+func TestRunACPExternalEffectWithRetryRetainsLeaseAcrossTransientFailure(t *testing.T) {
+	controlStore, fence, closeStore := newACPSessionTestStore(
+		t, filepath.Join(t.TempDir(), "external-effect-retry.db"),
+	)
+	defer closeStore()
+	dispatcher := &ACPDispatcher{Store: controlStore}
+	identity := store.ExternalEffectIdentity{
+		Kind: "workspace.prepare", Namespace: "default", AggregateID: "task-1", OperationID: "workspace-prepare-prompt-1",
+	}
+	request := map[string]string{"source": "immutable"}
+	attempts := 0
+
+	result, err := runACPExternalEffectWithRetryDelay(
+		context.Background(), dispatcher, fence, identity, request, time.Millisecond,
+		func(context.Context) (string, error) {
+			attempts++
+			if attempts == 1 {
+				return "", &publisherservice.ClientError{
+					StatusCode: http.StatusBadGateway,
+					Response: publisherservice.ErrorResponse{
+						Code: "scm_failure", Message: "Git operation failed", Retryable: true,
+					},
+				}
+			}
+			return "prepared", nil
+		},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result != "prepared" || attempts != 2 {
+		t.Fatalf("retry result = %q after %d attempts, want prepared after 2", result, attempts)
+	}
+	effectID, err := identity.CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	effect, err := controlStore.GetExternalEffect(context.Background(), effectID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if effect.State != store.ExternalEffectSucceeded || effect.Attempts != 1 {
+		t.Fatalf("external effect = state %s attempts %d, want Succeeded with one lease claim", effect.State, effect.Attempts)
+	}
+}
+
+func TestRunACPExternalEffectWithRetryStopsWithinLeaseBudget(t *testing.T) {
+	controlStore, fence, closeStore := newACPSessionTestStore(
+		t, filepath.Join(t.TempDir(), "external-effect-budget.db"),
+	)
+	defer closeStore()
+	dispatcher := &ACPDispatcher{Store: controlStore}
+	identity := store.ExternalEffectIdentity{
+		Kind: "workspace.resolve", Namespace: "default", AggregateID: "task-budget", OperationID: "workspace-resolve-budget",
+	}
+	attempts := 0
+	started := time.Now()
+
+	_, err := runACPExternalEffectWithRetryPolicy(
+		context.Background(), dispatcher, fence, identity, map[string]string{"source": "immutable"},
+		time.Millisecond, 25*time.Millisecond,
+		func(context.Context) (string, error) {
+			attempts++
+			return "", errors.New("publisher response could not be classified")
+		},
+	)
+	if !errors.Is(err, context.DeadlineExceeded) {
+		t.Fatalf("retry budget error = %v, want context deadline exceeded", err)
+	}
+	if attempts < 2 {
+		t.Fatalf("retry attempts = %d, want multiple attempts before the budget expired", attempts)
+	}
+	if elapsed := time.Since(started); elapsed > time.Second {
+		t.Fatalf("retry budget expired after %s, want a prompt bounded return", elapsed)
+	}
+	assertInFlightExternalEffectWithOneLease(t, controlStore, identity)
+}
+
+func TestRunACPExternalEffectWithRetryRejectsSuccessAfterBudgetExpiry(t *testing.T) {
+	controlStore, fence, closeStore := newACPSessionTestStore(
+		t, filepath.Join(t.TempDir(), "external-effect-late-success.db"),
+	)
+	defer closeStore()
+	dispatcher := &ACPDispatcher{Store: controlStore}
+	identity := store.ExternalEffectIdentity{
+		Kind: "workspace.prepare", Namespace: "default", AggregateID: "task-late", OperationID: "workspace-prepare-late",
+	}
+
+	result, err := runACPExternalEffectWithRetryPolicy(
+		context.Background(), dispatcher, fence, identity, map[string]string{"source": "immutable"},
+		time.Millisecond, 5*time.Millisecond,
+		func(context.Context) (string, error) {
+			time.Sleep(20 * time.Millisecond)
+			return "late-success", nil
+		},
+	)
+	if result != "" || !errors.Is(err, context.DeadlineExceeded) {
+		t.Fatalf("late result = %q, error = %v; want no result and context deadline exceeded", result, err)
+	}
+	assertInFlightExternalEffectWithOneLease(t, controlStore, identity)
+}
+
+func TestRunACPExternalEffectWithRetryStopsOnCallerCancellation(t *testing.T) {
+	controlStore, fence, closeStore := newACPSessionTestStore(
+		t, filepath.Join(t.TempDir(), "external-effect-cancel.db"),
+	)
+	defer closeStore()
+	dispatcher := &ACPDispatcher{Store: controlStore}
+	identity := store.ExternalEffectIdentity{
+		Kind: "workspace.resolve", Namespace: "default", AggregateID: "task-cancel", OperationID: "workspace-resolve-cancel",
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	attempts := 0
+
+	_, err := runACPExternalEffectWithRetryPolicy(
+		ctx, dispatcher, fence, identity, map[string]string{"source": "immutable"},
+		time.Second, time.Second,
+		func(context.Context) (string, error) {
+			attempts++
+			cancel()
+			return "", errors.New("transient publisher failure")
+		},
+	)
+	if !errors.Is(err, context.Canceled) || attempts != 1 {
+		t.Fatalf("cancelled retry = attempts %d error %v, want one attempt and context cancellation", attempts, err)
+	}
+	assertInFlightExternalEffectWithOneLease(t, controlStore, identity)
+}
+
+func TestRunACPExternalEffectWithRetryDoesNotRetryNonRetryableResponse(t *testing.T) {
+	controlStore, fence, closeStore := newACPSessionTestStore(
+		t, filepath.Join(t.TempDir(), "external-effect-nonretryable.db"),
+	)
+	defer closeStore()
+	dispatcher := &ACPDispatcher{Store: controlStore}
+	identity := store.ExternalEffectIdentity{
+		Kind: "workspace.resolve", Namespace: "default", AggregateID: "task-rejected", OperationID: "workspace-resolve-rejected",
+	}
+	attempts := 0
+
+	_, err := runACPExternalEffectWithRetryPolicy(
+		context.Background(), dispatcher, fence, identity, map[string]string{"source": "invalid"},
+		time.Millisecond, 50*time.Millisecond,
+		func(context.Context) (string, error) {
+			attempts++
+			return "", &publisherservice.ClientError{
+				StatusCode: http.StatusBadRequest,
+				Response: publisherservice.ErrorResponse{
+					Code: "invalid_request", Message: "request is invalid", Retryable: false,
+				},
+			}
+		},
+	)
+	if err == nil || attempts != 1 {
+		t.Fatalf("non-retryable result = attempts %d error %v, want one failed attempt", attempts, err)
+	}
+	assertInFlightExternalEffectWithOneLease(t, controlStore, identity)
+}
+
+func TestRunExternalEffectBoundsCallToLeaseAccountableDuration(t *testing.T) {
+	controlStore, fence, closeStore := newACPSessionTestStore(
+		t, filepath.Join(t.TempDir(), "external-effect-call-bound.db"),
+	)
+	defer closeStore()
+	identity := store.ExternalEffectIdentity{
+		Kind: "acp-mcp-tool", Namespace: "default", AggregateID: "session-bound", OperationID: "mcp-call-bound",
+	}
+	start := time.Now()
+	var deadline time.Time
+	var hasDeadline bool
+
+	result, err := runExternalEffect(
+		context.Background(), controlStore, fence, identity, map[string]string{"call": "custom"},
+		func(ctx context.Context) (string, error) {
+			deadline, hasDeadline = ctx.Deadline()
+			return testBrokeredEffectCommittedResult, nil
+		},
+	)
+	if err != nil || result != testBrokeredEffectCommittedResult {
+		t.Fatalf("bounded call = %q error %v, want committed success", result, err)
+	}
+	if !hasDeadline {
+		t.Fatal("external-effect call context has no deadline; a call must not outlive its ledger lease")
+	}
+	if deadline.After(start.Add(maxACPExternalEffectCallDuration + time.Second)) {
+		t.Fatalf(
+			"external-effect call deadline = %s after start, want at most the lease-accountable %s",
+			deadline.Sub(start), maxACPExternalEffectCallDuration,
+		)
+	}
+	if maxACPExternalEffectCallDuration >= acpExternalEffectLease {
+		t.Fatalf(
+			"call bound %s does not leave settlement margin inside the %s lease",
+			maxACPExternalEffectCallDuration, acpExternalEffectLease,
+		)
+	}
+}
+
+func TestRunExternalEffectSizesPublisherLeaseFromConfiguredPublishTimeout(t *testing.T) {
+	t.Setenv(envACPPublisherEffectTimeout, "10m")
+	controlStore, fence, closeStore := newACPSessionTestStore(
+		t, filepath.Join(t.TempDir(), "external-effect-publisher-timeout.db"),
+	)
+	defer closeStore()
+	identity := store.ExternalEffectIdentity{
+		Kind: "publisher.publish", Namespace: "default", AggregateID: "publication-1", OperationID: "publish-configured-timeout",
+	}
+	effectID, err := identity.CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	start := time.Now()
+	var deadline time.Time
+	var hasDeadline bool
+	var leaseExpiresAt *time.Time
+
+	result, err := runExternalEffect(
+		context.Background(), controlStore, fence, identity, map[string]string{"artifact": "immutable"},
+		func(ctx context.Context) (string, error) {
+			deadline, hasDeadline = ctx.Deadline()
+			inFlight, getErr := controlStore.GetExternalEffect(ctx, effectID)
+			if getErr != nil {
+				return "", getErr
+			}
+			leaseExpiresAt = inFlight.LeaseExpiresAt
+			return "published", nil
+		},
+	)
+	if err != nil || result != "published" {
+		t.Fatalf("publisher effect = %q error %v, want published success", result, err)
+	}
+	if !hasDeadline {
+		t.Fatal("publisher external-effect call context has no deadline")
+	}
+	if deadline.Before(start.Add(9 * time.Minute)) {
+		t.Fatalf(
+			"publisher call deadline = %s after start, want the configured 10m publish timeout instead of the %s clamp",
+			deadline.Sub(start), maxACPExternalEffectCallDuration,
+		)
+	}
+	if leaseExpiresAt == nil {
+		t.Fatal("in-flight publisher effect has no lease expiry")
+	}
+	if leaseExpiresAt.Before(deadline) {
+		t.Fatalf(
+			"publisher lease expires at %s before the call deadline %s; an effect must never outlive its lease",
+			leaseExpiresAt, deadline,
+		)
+	}
+}
+
+func TestRunExternalEffectKeepsBrokeredClampWhenPublisherTimeoutConfigured(t *testing.T) {
+	t.Setenv(envACPPublisherEffectTimeout, "10m")
+	controlStore, fence, closeStore := newACPSessionTestStore(
+		t, filepath.Join(t.TempDir(), "external-effect-brokered-clamp.db"),
+	)
+	defer closeStore()
+	identity := store.ExternalEffectIdentity{
+		Kind: "acp-mcp-tool", Namespace: "default", AggregateID: "session-clamp", OperationID: "mcp-call-clamp",
+	}
+	start := time.Now()
+	var deadline time.Time
+
+	if _, err := runExternalEffect(
+		context.Background(), controlStore, fence, identity, map[string]string{"call": "custom"},
+		func(ctx context.Context) (string, error) {
+			deadline, _ = ctx.Deadline()
+			return testBrokeredEffectCommittedResult, nil
+		},
+	); err != nil {
+		t.Fatal(err)
+	}
+	if deadline.After(start.Add(maxACPExternalEffectCallDuration + time.Second)) {
+		t.Fatalf(
+			"brokered call deadline = %s after start, want the fixed %s clamp regardless of the publisher timeout",
+			deadline.Sub(start), maxACPExternalEffectCallDuration,
+		)
+	}
+}
+
+func TestPublicationSettlementWindowBudgetsSequentialPublisherStages(t *testing.T) {
+	// publishWorkspaceDelta runs up to three sequential publisher-backed
+	// stages under each bounded context (claim-refresh/preflight/prepare and
+	// publish/verify/PR reconcile), so the window must cover
+	// stages x (call timeout + margin) + margin — not a single call timeout.
+	t.Setenv(envACPPublisherEffectTimeout, "")
+	wantDefault := maxSequentialPublisherSettlementStages*(maxACPExternalEffectCallDuration+externalEffectLeaseSettlementMargin) + externalEffectLeaseSettlementMargin
+	if got := publicationSettlementWindow(); got != wantDefault || got != 16*time.Minute {
+		t.Fatalf("publicationSettlementWindow() = %s, want 3 x (4m + 1m) + 1m = %s", got, wantDefault)
+	}
+
+	t.Setenv(envACPPublisherEffectTimeout, "10m")
+	if got := publicationSettlementWindow(); got != 34*time.Minute {
+		t.Fatalf("publicationSettlementWindow() = %s, want 3 x (10m + 1m) + 1m = 34m", got)
+	}
+}
+
+func TestExternalEffectCallTimeoutFallsBackOnInvalidConfiguration(t *testing.T) {
+	publisherIdentity := store.ExternalEffectIdentity{Kind: "workspace.prepare"}
+	for _, value := range []string{"", "not-a-duration", "-1m", "0"} {
+		t.Setenv(envACPPublisherEffectTimeout, value)
+		if got := externalEffectCallTimeout(publisherIdentity); got != maxACPExternalEffectCallDuration {
+			t.Fatalf("externalEffectCallTimeout(%q) = %s, want default %s", value, got, maxACPExternalEffectCallDuration)
+		}
+	}
+}
+
+func assertInFlightExternalEffectWithOneLease(
+	t *testing.T,
+	controlStore store.ExternalEffectStore,
+	identity store.ExternalEffectIdentity,
+) {
+	t.Helper()
+	effectID, err := identity.CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	effect, err := controlStore.GetExternalEffect(context.Background(), effectID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if effect.State != store.ExternalEffectInFlight || effect.Attempts != 1 {
+		t.Fatalf("external effect = state %s attempts %d, want InFlight with one lease claim", effect.State, effect.Attempts)
+	}
+}
diff --git a/internal/controller/acp_frozen_authority.go b/internal/controller/acp_frozen_authority.go
new file mode 100644
index 000000000..89d104846
--- /dev/null
+++ b/internal/controller/acp_frozen_authority.go
@@ -0,0 +1,71 @@
+package controller
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+type acpWorkspaceCredentialBlockedError struct {
+	role                    store.PromptCredentialRole
+	label                   string
+	expectedResourceVersion string
+}
+
+func (e *acpWorkspaceCredentialBlockedError) Error() string {
+	if e == nil {
+		return "frozen workspace credential changed or became unavailable after queue"
+	}
+	return fmt.Sprintf("frozen %s changed or became unavailable after queue", e.label)
+}
+
+func asACPWorkspaceCredentialBlockedError(err error) (*acpWorkspaceCredentialBlockedError, bool) {
+	var blocked *acpWorkspaceCredentialBlockedError
+	if !errors.As(err, &blocked) {
+		return nil, false
+	}
+	return blocked, true
+}
+
+func classifyACPWorkspaceCredentialFreezeError(
+	err error,
+	role store.PromptCredentialRole,
+	label, expectedResourceVersion string,
+) error {
+	if frozenWorkspaceCredentialUnavailable(err) {
+		return &acpWorkspaceCredentialBlockedError{
+			role: role, label: label, expectedResourceVersion: expectedResourceVersion,
+		}
+	}
+	return err
+}
+
+func frozenWorkspaceCredentialUnavailable(err error) bool {
+	if apierrors.IsNotFound(err) {
+		return true
+	}
+	message := err.Error()
+	return strings.Contains(message, "credential Secret key ") ||
+		(strings.HasPrefix(message, "secret key ") && strings.HasSuffix(message, " is missing or invalid")) ||
+		strings.Contains(message, "credential Secret resourceVersion is unavailable")
+}
+
+func promptAttemptFreezesCredential(
+	attempt *store.PromptAttempt,
+	blocked *acpWorkspaceCredentialBlockedError,
+) bool {
+	if attempt == nil || blocked == nil {
+		return false
+	}
+	for _, binding := range attempt.CredentialBindings {
+		if binding.Role != blocked.role {
+			continue
+		}
+		return blocked.expectedResourceVersion != "" && binding.ResourceVersion == blocked.expectedResourceVersion
+	}
+	return blocked.expectedResourceVersion == ""
+}
diff --git a/internal/controller/acp_frozen_authority_settlement_test.go b/internal/controller/acp_frozen_authority_settlement_test.go
new file mode 100644
index 000000000..fd7a8a9d0
--- /dev/null
+++ b/internal/controller/acp_frozen_authority_settlement_test.go
@@ -0,0 +1,284 @@
+package controller
+
+import (
+	"context"
+	"encoding/json"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	coordinationv1 "k8s.io/api/coordination/v1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+	kubestore "github.com/orka-agents/orka/internal/store/kube"
+	"github.com/orka-agents/orka/internal/store/sqlite"
+)
+
+//nolint:gocyclo // The regression keeps rotation/deletion settlement invariants in one lifecycle.
+func TestReserveTaskSettlesFrozenWorkspaceCredentialBlocked(t *testing.T) {
+	for _, test := range []struct {
+		name         string
+		mutate       func(*corev1.Secret)
+		deleteSecret bool
+		added        bool
+	}{
+		{
+			name: "rotated",
+			mutate: func(secret *corev1.Secret) {
+				secret.Data[defaultACPWorkspaceCredentialKey] = []byte("rotated-secret-value")
+			},
+		},
+		{name: "deleted", deleteSecret: true},
+		{name: "added after queue", added: true},
+		{
+			name: "missing key",
+			mutate: func(secret *corev1.Secret) {
+				delete(secret.Data, defaultACPWorkspaceCredentialKey)
+			},
+		},
+		{
+			name: "empty key",
+			mutate: func(secret *corev1.Secret) {
+				secret.Data[defaultACPWorkspaceCredentialKey] = []byte(" \n\t")
+			},
+		},
+		{
+			name: "oversized key",
+			mutate: func(secret *corev1.Secret) {
+				secret.Data[defaultACPWorkspaceCredentialKey] = []byte(strings.Repeat("x", maxACPWorkspaceCredentialBytes+1))
+			},
+		},
+		{
+			name: "invalid key",
+			mutate: func(secret *corev1.Secret) {
+				secret.Data[defaultACPWorkspaceCredentialKey] = []byte("invalid\x00secret-value")
+			},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			defer cancel()
+			scheme := runtime.NewScheme()
+			if err := corev1alpha1.AddToScheme(scheme); err != nil {
+				t.Fatal(err)
+			}
+			if err := corev1.AddToScheme(scheme); err != nil {
+				t.Fatal(err)
+			}
+			if err := coordinationv1.AddToScheme(scheme); err != nil {
+				t.Fatal(err)
+			}
+			kubeClient := fake.NewClientBuilder().WithScheme(scheme).
+				WithStatusSubresource(
+					&corev1alpha1.Task{}, &corev1alpha1.RuntimePool{},
+					&corev1alpha1.ControllerEpoch{}, &corev1alpha1.PromptAttempt{},
+				).
+				Build()
+			kubeClient = withControllerEpochLeaseUIDs(t, kubeClient)
+
+			db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "credential-blocked.db"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer db.Close() //nolint:errcheck
+
+			sqliteStore := sqlite.NewStore(db, "credential-blocked-test")
+			controlStore, err := kubestore.NewComposite(kubeClient, "orka-system", sqliteStore)
+			if err != nil {
+				t.Fatal(err)
+			}
+			epochs, stopEpoch := startACPRecoveryEpochManager(t, ctx, controlStore, "credential-blocked-controller")
+			defer stopEpoch()
+			fence, err := epochs.CurrentFence(ctx)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			const (
+				originalSecretValue = "original-secret-value"
+				wantOperation       = "credential-blocked"
+				wantExecutionReason = corev1alpha1.TaskExecutionReason("CredentialBlocked")
+				wantMessage         = "workspace credential changed or became unavailable after queue; refusing to change frozen authority"
+			)
+			secret := &corev1.Secret{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: "default", Name: "workspace-credential", UID: types.UID("workspace-credential-uid"),
+				},
+				Data: map[string][]byte{defaultACPWorkspaceCredentialKey: []byte(originalSecretValue)},
+			}
+			if err := kubeClient.Create(ctx, secret); err != nil {
+				t.Fatal(err)
+			}
+			frozenSecret := &corev1.Secret{}
+			if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(secret), frozenSecret); err != nil {
+				t.Fatal(err)
+			}
+			frozenResourceVersion := frozenSecret.ResourceVersion
+			if frozenResourceVersion == "" {
+				t.Fatal("fake Kubernetes API did not assign a Secret resourceVersion")
+			}
+			if test.added {
+				frozenResourceVersion = ""
+			} else if test.deleteSecret {
+				if err := kubeClient.Delete(ctx, frozenSecret); err != nil {
+					t.Fatal(err)
+				}
+			} else {
+				test.mutate(frozenSecret)
+				if err := kubeClient.Update(ctx, frozenSecret); err != nil {
+					t.Fatal(err)
+				}
+				if frozenSecret.ResourceVersion == frozenResourceVersion {
+					t.Fatalf("Secret mutation did not advance resourceVersion %q", frozenResourceVersion)
+				}
+			}
+			task := runtimePoolReservationTestTask("credential-blocked", "credential-blocked-uid", "pool-uid")
+			task.Spec.Workspace = &corev1alpha1.WorkspaceConfig{
+				GitRepo: "https://github.com/orka-agents/orka.git",
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: "workspace-credential",
+				},
+			}
+			task.Spec.SessionRef = &corev1alpha1.SessionReference{Name: "credential-blocked-session", Create: true, Append: true}
+			task.Status.Execution.ControllerEpoch = fence.Epoch
+			task.Status.Execution.ReadCredentialResourceVersion = frozenResourceVersion
+			task.Status.Delivery = &corev1alpha1.TaskDeliveryStatus{
+				State: corev1alpha1.TaskDeliveryStateNotRequested, Outcome: corev1alpha1.TaskDeliveryOutcomeNotRequested,
+			}
+			pool := &corev1alpha1.RuntimePool{
+				ObjectMeta: metav1.ObjectMeta{Namespace: task.Namespace, Name: "pool", UID: types.UID("pool-uid"), Generation: 1},
+				Status: corev1alpha1.RuntimePoolStatus{
+					Lifecycle:      corev1alpha1.RuntimePoolLifecycleServing,
+					AdmissionState: corev1alpha1.RuntimePoolAdmissionAccepting,
+					ActiveInstance: &corev1alpha1.RuntimePoolActiveInstanceStatus{
+						RuntimeInstanceID: "pod-uid.boot-id", ControllerEpoch: fence.Epoch,
+					},
+					Capacity: corev1alpha1.RuntimePoolCapacityStatus{MaxResidentSessions: 1, MaxRunningPrompts: 1},
+				},
+			}
+
+			taskForCreate := task.DeepCopy()
+			taskForCreate.Status = corev1alpha1.TaskStatus{}
+			if err := kubeClient.Create(ctx, taskForCreate); err != nil {
+				t.Fatal(err)
+			}
+			currentTask := &corev1alpha1.Task{}
+			if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(task), currentTask); err != nil {
+				t.Fatal(err)
+			}
+			currentTask.Status = task.Status
+			if err := kubeClient.Status().Update(ctx, currentTask); err != nil {
+				t.Fatal(err)
+			}
+			poolForCreate := pool.DeepCopy()
+			poolForCreate.Status = corev1alpha1.RuntimePoolStatus{}
+			if err := kubeClient.Create(ctx, poolForCreate); err != nil {
+				t.Fatal(err)
+			}
+			currentPool := &corev1alpha1.RuntimePool{}
+			if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(pool), currentPool); err != nil {
+				t.Fatal(err)
+			}
+			currentPool.Status = pool.Status
+			if err := kubeClient.Status().Update(ctx, currentPool); err != nil {
+				t.Fatal(err)
+			}
+			key := store.PromptAttemptKey{
+				Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: task.Status.Execution.PromptID,
+			}
+			bindings := []store.PromptCredentialBinding(nil)
+			if !test.added {
+				bindings = []store.PromptCredentialBinding{{
+					Role: store.PromptCredentialSourceRead, Namespace: task.Namespace,
+					SecretName: "workspace-credential", SecretKey: defaultACPWorkspaceCredentialKey,
+					SecretUID: "workspace-credential-uid", ResourceVersion: frozenResourceVersion,
+				}}
+			}
+			attempt, err := controlStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{
+				Key: key, RequestDigest: task.Status.Execution.RequestDigest, CredentialBindings: bindings,
+			}), fence)
+			if err != nil {
+				t.Fatal(err)
+			}
+			dispatcher := &ACPDispatcher{
+				Client: kubeClient, APIReader: kubeClient, Store: controlStore, ResultStore: sqliteStore, Epochs: epochs,
+			}
+
+			reserved, _, err := dispatcher.reserveTask(ctx, task.DeepCopy())
+			if err != nil {
+				t.Fatalf("reserveTask() error = %v, want terminal credential-blocked settlement", err)
+			}
+			if reserved != nil {
+				t.Fatalf("reserveTask() returned reserved Task %#v, want terminal credential-blocked settlement", reserved)
+			}
+
+			attempt, err = controlStore.GetPromptAttempt(ctx, attempt.ID)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if attempt.ExecutionState != store.PromptExecutionFailed || attempt.TerminalReason != wantOperation {
+				t.Fatalf("PromptAttempt settlement = state %s reason %q, want %s/%q", attempt.ExecutionState, attempt.TerminalReason, store.PromptExecutionFailed, wantOperation)
+			}
+			wantOperationID := store.CanonicalControlID(
+				wantOperation, attempt.ID, strconv.FormatInt(attempt.Version-1, 10), string(store.PromptCredentialSourceRead),
+			)
+			if attempt.LastOperationID != wantOperationID {
+				t.Fatalf("credential-blocked operation ID = %q, want %q", attempt.LastOperationID, wantOperationID)
+			}
+
+			updatedTask := &corev1alpha1.Task{}
+			if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(task), updatedTask); err != nil {
+				t.Fatal(err)
+			}
+			if updatedTask.Status.Phase != corev1alpha1.TaskPhaseFailed || updatedTask.Status.Execution == nil ||
+				updatedTask.Status.Execution.State != corev1alpha1.TaskExecutionStateFailed ||
+				updatedTask.Status.Execution.Outcome != corev1alpha1.TaskExecutionOutcomeFailed ||
+				updatedTask.Status.Execution.Reason != wantExecutionReason ||
+				updatedTask.Status.Execution.Message != wantMessage {
+				t.Fatalf("Task settlement = %#v", updatedTask.Status)
+			}
+			if updatedTask.Status.Execution.ReadCredentialResourceVersion != frozenResourceVersion {
+				t.Fatalf("frozen credential resourceVersion = %q, want %q", updatedTask.Status.Execution.ReadCredentialResourceVersion, frozenResourceVersion)
+			}
+
+			projection, err := controlStore.GetOutboxProjection(ctx, standaloneTaskTerminalProjectionID(task, 1))
+			if err != nil {
+				t.Fatalf("get terminal Task projection: %v", err)
+			}
+			var payload taskTerminalProjection
+			if err := json.Unmarshal(projection.Payload, &payload); err != nil {
+				t.Fatalf("decode terminal Task projection: %v", err)
+			}
+			if payload.Execution.Reason != wantExecutionReason || payload.Execution.Message != wantMessage {
+				t.Fatalf("terminal Task projection = %#v", payload.Execution)
+			}
+
+			updatedPool := &corev1alpha1.RuntimePool{}
+			if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(pool), updatedPool); err != nil {
+				t.Fatal(err)
+			}
+			if len(updatedPool.Status.Capacity.Reservations) != 0 || updatedPool.Status.Capacity.ReservedSessions != 0 || updatedPool.Status.Capacity.ReservedPrompts != 0 {
+				t.Fatalf("credential-blocked settlement leaked RuntimePool reservation: %#v", updatedPool.Status.Capacity)
+			}
+
+			attemptJSON, err := json.Marshal(attempt)
+			if err != nil {
+				t.Fatal(err)
+			}
+			for _, secretValue := range []string{originalSecretValue, "rotated-secret-value"} {
+				if strings.Contains(string(attemptJSON), secretValue) || strings.Contains(string(projection.Payload), secretValue) {
+					t.Fatalf("credential value %q leaked into durable settlement or Task projection", secretValue)
+				}
+			}
+		})
+	}
+}
diff --git a/internal/controller/acp_idle_pool_test.go b/internal/controller/acp_idle_pool_test.go
new file mode 100644
index 000000000..6ff6f2789
--- /dev/null
+++ b/internal/controller/acp_idle_pool_test.go
@@ -0,0 +1,315 @@
+package controller
+
+import (
+	"context"
+	"path/filepath"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store/sqlite"
+)
+
+func TestReapIdlePoolsStartsTTLWhenActiveDemandSettles(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now().UTC()
+	settledAt := metav1.NewTime(now.Add(-5 * time.Second))
+	oldDemand := now.Add(-2 * time.Hour)
+	pool := &corev1alpha1.RuntimePool{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "default",
+			Name:      "pool",
+			UID:       types.UID("pool-uid"),
+			Annotations: map[string]string{
+				acpRuntimeLastDemandAnnotation: oldDemand.Format(time.RFC3339Nano),
+			},
+		},
+		Spec: corev1alpha1.RuntimePoolSpec{DesiredReplicas: 1},
+	}
+	task := corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "default",
+			Name:      "completed",
+			UID:       types.UID("task-uid"),
+			Labels:    map[string]string{acpRuntimeTaskPoolLabel: pool.Name},
+		},
+		Status: corev1alpha1.TaskStatus{
+			Execution: &corev1alpha1.TaskExecutionStatus{
+				State:              corev1alpha1.TaskExecutionStateSucceeded,
+				LastTransitionTime: &settledAt,
+			},
+			Delivery: &corev1alpha1.TaskDeliveryStatus{
+				State:              corev1alpha1.TaskDeliveryStateVerifiedExact,
+				LastTransitionTime: &settledAt,
+			},
+		},
+	}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.RuntimePool{}).WithObjects(pool).Build()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "idle-pool.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	controlStore := sqlite.NewStore(db, "test")
+	epochs := NewControllerEpochManager(controlStore, "idle-pool-controller")
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	if _, err := epochs.CurrentFence(ctx); err != nil {
+		t.Fatal(err)
+	}
+
+	dispatcher := &ACPDispatcher{Client: kubeClient, Epochs: epochs, IdlePoolTTL: time.Minute}
+	if err := dispatcher.reapIdlePools(ctx, []corev1alpha1.Task{task}); err != nil {
+		t.Fatal(err)
+	}
+	got := &corev1alpha1.RuntimePool{}
+	if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: pool.Namespace, Name: pool.Name}, got); err != nil {
+		t.Fatal(err)
+	}
+	if got.Spec.DesiredReplicas != 1 {
+		t.Fatalf("DesiredReplicas = %d, want warm pool retained after demand settled", got.Spec.DesiredReplicas)
+	}
+	lastDemand, err := time.Parse(time.RFC3339Nano, got.Annotations[acpRuntimeLastDemandAnnotation])
+	if err != nil {
+		t.Fatalf("last demand annotation = %q: %v", got.Annotations[acpRuntimeLastDemandAnnotation], err)
+	}
+	if !lastDemand.Equal(settledAt.Time) {
+		t.Fatalf("last demand = %s, want terminal demand time %s", lastDemand, settledAt.Time)
+	}
+
+	cancelEpoch()
+	if err := <-epochDone; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestReapIdlePoolsRechecksFreshCapacityBeforeScaleDown(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now().UTC()
+	settledAt := metav1.NewTime(now.Add(-2 * time.Minute))
+	pool := &corev1alpha1.RuntimePool{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "default", Name: "pool", UID: types.UID("pool-uid"),
+			Annotations: map[string]string{acpRuntimeLastDemandAnnotation: now.Add(-time.Hour).Format(time.RFC3339Nano)},
+		},
+		Spec: corev1alpha1.RuntimePoolSpec{DesiredReplicas: 1},
+	}
+	task := corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "completed", Labels: map[string]string{acpRuntimeTaskPoolLabel: pool.Name}},
+		Status: corev1alpha1.TaskStatus{
+			Execution: &corev1alpha1.TaskExecutionStatus{State: corev1alpha1.TaskExecutionStateSucceeded, LastTransitionTime: &settledAt},
+			Delivery:  &corev1alpha1.TaskDeliveryStatus{State: corev1alpha1.TaskDeliveryStateVerifiedExact, LastTransitionTime: &settledAt},
+		},
+	}
+	baseClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.RuntimePool{}).WithObjects(pool).Build()
+	kubeClient := &capacityAppearsOnRefreshClient{
+		Client: baseClient, pool: types.NamespacedName{Namespace: pool.Namespace, Name: pool.Name}, activateOnRefresh: true,
+	}
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "idle-pool-refresh.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	controlStore := sqlite.NewStore(db, "test")
+	epochs := NewControllerEpochManager(controlStore, "idle-pool-refresh-controller")
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	if _, err := epochs.CurrentFence(ctx); err != nil {
+		t.Fatal(err)
+	}
+
+	dispatcher := &ACPDispatcher{Client: kubeClient, Epochs: epochs, IdlePoolTTL: time.Minute}
+	if err := dispatcher.reapIdlePools(ctx, []corev1alpha1.Task{task}); err != nil {
+		t.Fatal(err)
+	}
+	got := &corev1alpha1.RuntimePool{}
+	if err := baseClient.Get(ctx, types.NamespacedName{Namespace: pool.Namespace, Name: pool.Name}, got); err != nil {
+		t.Fatal(err)
+	}
+	if got.Spec.DesiredReplicas != 1 {
+		t.Fatalf("DesiredReplicas = %d, want active refreshed capacity to retain pool", got.Spec.DesiredReplicas)
+	}
+
+	cancelEpoch()
+	if err := <-epochDone; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestReapIdlePoolsUsesOptimisticLockForFinalScaleDown(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now().UTC()
+	settledAt := metav1.NewTime(now.Add(-2 * time.Minute))
+	pool := &corev1alpha1.RuntimePool{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "default", Name: "pool", UID: types.UID("pool-uid"),
+			Annotations: map[string]string{acpRuntimeLastDemandAnnotation: settledAt.Format(time.RFC3339Nano)},
+		},
+		Spec: corev1alpha1.RuntimePoolSpec{DesiredReplicas: 1},
+	}
+	task := corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "completed", Labels: map[string]string{acpRuntimeTaskPoolLabel: pool.Name}},
+		Status: corev1alpha1.TaskStatus{
+			Execution: &corev1alpha1.TaskExecutionStatus{State: corev1alpha1.TaskExecutionStateSucceeded, LastTransitionTime: &settledAt},
+			Delivery:  &corev1alpha1.TaskDeliveryStatus{State: corev1alpha1.TaskDeliveryStateVerifiedExact, LastTransitionTime: &settledAt},
+		},
+	}
+	baseClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.RuntimePool{}).WithObjects(pool).Build()
+	kubeClient := &capacityAppearsOnRefreshClient{
+		Client: baseClient, pool: types.NamespacedName{Namespace: pool.Namespace, Name: pool.Name}, activateBeforeScalePatch: true,
+	}
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "idle-pool-final-cas.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	controlStore := sqlite.NewStore(db, "test")
+	epochs := NewControllerEpochManager(controlStore, "idle-pool-final-cas-controller")
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	if _, err := epochs.CurrentFence(ctx); err != nil {
+		t.Fatal(err)
+	}
+
+	dispatcher := &ACPDispatcher{Client: kubeClient, Epochs: epochs, IdlePoolTTL: time.Minute}
+	if err := dispatcher.reapIdlePools(ctx, []corev1alpha1.Task{task}); err != nil {
+		t.Fatal(err)
+	}
+	got := &corev1alpha1.RuntimePool{}
+	if err := baseClient.Get(ctx, types.NamespacedName{Namespace: pool.Namespace, Name: pool.Name}, got); err != nil {
+		t.Fatal(err)
+	}
+	if got.Spec.DesiredReplicas != 1 || got.Status.Capacity.RunningPrompts != 1 {
+		t.Fatalf("pool after final CAS race = replicas %d capacity %#v", got.Spec.DesiredReplicas, got.Status.Capacity)
+	}
+
+	cancelEpoch()
+	if err := <-epochDone; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestACPTaskDemandSettledAtUsesStableLegacyFallback(t *testing.T) {
+	created := metav1.NewTime(time.Date(2026, 8, 1, 12, 0, 0, 0, time.UTC))
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{CreationTimestamp: created},
+		Status:     corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{State: corev1alpha1.TaskExecutionStateSucceeded}},
+	}
+	if got := acpTaskDemandSettledAt(task); !got.Equal(created.Time) {
+		t.Fatalf("acpTaskDemandSettledAt() = %s, want stable creation fallback %s", got, created.Time)
+	}
+}
+
+func TestRecordPoolLastDemandAtPreservesConcurrentNewerTimestamp(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	oldDemand := time.Date(2026, 8, 1, 10, 0, 0, 0, time.UTC)
+	settledAt := oldDemand.Add(time.Minute)
+	newerDemand := settledAt.Add(time.Minute)
+	pool := &corev1alpha1.RuntimePool{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "default", Name: "pool",
+			Annotations: map[string]string{acpRuntimeLastDemandAnnotation: oldDemand.Format(time.RFC3339Nano)},
+		},
+		Spec: corev1alpha1.RuntimePoolSpec{DesiredReplicas: 1},
+	}
+	baseClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(pool).Build()
+	kubeClient := &capacityAppearsOnRefreshClient{
+		Client: baseClient, pool: types.NamespacedName{Namespace: pool.Namespace, Name: pool.Name},
+		advanceDemandBeforeTimestampPatch: true, newerDemand: newerDemand,
+	}
+	dispatcher := &ACPDispatcher{Client: kubeClient}
+	updated, err := dispatcher.recordPoolLastDemandAt(context.Background(), pool, settledAt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := time.Parse(time.RFC3339Nano, updated.Annotations[acpRuntimeLastDemandAnnotation])
+	if err != nil || !got.Equal(newerDemand) {
+		t.Fatalf("last demand = %s, %v, want concurrent newer value %s", got, err, newerDemand)
+	}
+}
+
+type capacityAppearsOnRefreshClient struct {
+	client.Client
+	pool                              types.NamespacedName
+	poolGets                          int
+	activateOnRefresh                 bool
+	activateBeforeScalePatch          bool
+	advanceDemandBeforeTimestampPatch bool
+	newerDemand                       time.Time
+	demandAdvanced                    bool
+}
+
+func (c *capacityAppearsOnRefreshClient) Get(ctx context.Context, key client.ObjectKey, object client.Object, options ...client.GetOption) error {
+	if err := c.Client.Get(ctx, key, object, options...); err != nil {
+		return err
+	}
+	pool, ok := object.(*corev1alpha1.RuntimePool)
+	if !ok || key != c.pool {
+		return nil
+	}
+	c.poolGets++
+	if c.activateOnRefresh && c.poolGets == 2 {
+		pool.Status.Capacity.RunningPrompts = 1
+		if err := c.Client.Status().Update(ctx, pool); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (c *capacityAppearsOnRefreshClient) Patch(ctx context.Context, object client.Object, patch client.Patch, options ...client.PatchOption) error {
+	pool, ok := object.(*corev1alpha1.RuntimePool)
+	if c.advanceDemandBeforeTimestampPatch && !c.demandAdvanced && ok && client.ObjectKeyFromObject(pool) == c.pool &&
+		pool.Spec.DesiredReplicas == 1 && pool.Annotations[acpRuntimeLastDemandAnnotation] != "" {
+		latest := &corev1alpha1.RuntimePool{}
+		if err := c.Client.Get(ctx, c.pool, latest); err != nil {
+			return err
+		}
+		if latest.Annotations == nil {
+			latest.Annotations = make(map[string]string)
+		}
+		latest.Annotations[acpRuntimeLastDemandAnnotation] = c.newerDemand.Format(time.RFC3339Nano)
+		if err := c.Update(ctx, latest); err != nil {
+			return err
+		}
+		c.demandAdvanced = true
+	}
+	if c.activateBeforeScalePatch && ok && client.ObjectKeyFromObject(pool) == c.pool && pool.Spec.DesiredReplicas == 0 {
+		latest := &corev1alpha1.RuntimePool{}
+		if err := c.Client.Get(ctx, c.pool, latest); err != nil {
+			return err
+		}
+		latest.Status.Capacity.RunningPrompts = 1
+		if err := c.Client.Status().Update(ctx, latest); err != nil {
+			return err
+		}
+	}
+	return c.Client.Patch(ctx, object, patch, options...)
+}
diff --git a/internal/controller/acp_mcp_broker.go b/internal/controller/acp_mcp_broker.go
new file mode 100644
index 000000000..a6c0623cf
--- /dev/null
+++ b/internal/controller/acp_mcp_broker.go
@@ -0,0 +1,783 @@
+package controller
+
+import (
+	"bytes"
+	"context"
+	"crypto/subtle"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"slices"
+	"strings"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/labels"
+	"github.com/orka-agents/orka/internal/outboundaccess"
+	"github.com/orka-agents/orka/internal/store"
+	"github.com/orka-agents/orka/internal/tools"
+	workerexecutor "github.com/orka-agents/orka/internal/worker"
+)
+
+type ACPMCPAuthenticatedTask struct {
+	Name         string
+	Namespace    string
+	UID          string
+	ParentTaskID string
+	AgentName    string
+}
+
+type acpMCPAuthenticatedTaskContextKey struct{}
+
+func withACPMCPAuthenticatedTask(ctx context.Context, task ACPMCPAuthenticatedTask) context.Context {
+	return context.WithValue(ctx, acpMCPAuthenticatedTaskContextKey{}, task)
+}
+
+func ACPMCPAuthenticatedTaskFromContext(ctx context.Context) (ACPMCPAuthenticatedTask, bool) {
+	task, ok := ctx.Value(acpMCPAuthenticatedTaskContextKey{}).(ACPMCPAuthenticatedTask)
+	return task, ok && task.Name != "" && task.Namespace != "" && task.UID != ""
+}
+
+type ACPMCPBrokerCredentials struct {
+	ControllerBearerToken string
+	CapabilitySecret      []byte
+	ExpectedFence         harnessv2.Fence
+	RuntimeProfile        harnessv2.RuntimeProfile
+	ControllerFence       store.ControllerEpochFence
+	Task                  ACPMCPAuthenticatedTask
+}
+
+type ACPMCPBrokerCredentialResolver interface {
+	ResolveACPMCPBrokerCredentials(context.Context, harnessv2.MCPBrokerCallRequest) (ACPMCPBrokerCredentials, error)
+}
+
+type ACPMCPBrokerCredentialResolverFunc func(context.Context, harnessv2.MCPBrokerCallRequest) (ACPMCPBrokerCredentials, error)
+
+func (f ACPMCPBrokerCredentialResolverFunc) ResolveACPMCPBrokerCredentials(ctx context.Context, request harnessv2.MCPBrokerCallRequest) (ACPMCPBrokerCredentials, error) {
+	return f(ctx, request)
+}
+
+type ACPMCPPromptAuthorizer interface {
+	AuthorizeACPMCPPrompt(context.Context, harnessv2.MCPBrokerCallRequest) error
+}
+
+type ACPMCPPromptAuthorizerFunc func(context.Context, harnessv2.MCPBrokerCallRequest) error
+
+func (f ACPMCPPromptAuthorizerFunc) AuthorizeACPMCPPrompt(ctx context.Context, request harnessv2.MCPBrokerCallRequest) error {
+	return f(ctx, request)
+}
+
+type ACPMCPToolExecutor interface {
+	ExecuteACPMCPTool(context.Context, harnessv2.MCPBrokerCallRequest, harnessv2.MCPToolDescriptor) (json.RawMessage, error)
+}
+
+type ACPMCPToolExecutorFunc func(context.Context, harnessv2.MCPBrokerCallRequest, harnessv2.MCPToolDescriptor) (json.RawMessage, error)
+
+func (f ACPMCPToolExecutorFunc) ExecuteACPMCPTool(ctx context.Context, request harnessv2.MCPBrokerCallRequest, descriptor harnessv2.MCPToolDescriptor) (json.RawMessage, error) {
+	return f(ctx, request, descriptor)
+}
+
+type RegistryACPMCPToolExecutor struct {
+	Registry            *tools.Registry
+	Reader              client.Reader
+	KubeClient          kubernetes.Interface
+	HTTPClient          *http.Client
+	OutboundAccess      outboundaccess.Resolver
+	TransactionExchange *workerexecutor.TransactionExchangeConfig
+	ContextFactory      func(context.Context, harnessv2.MCPBrokerCallRequest) (*tools.ToolContext, error)
+
+	// EnforceTransactionCredentialAuth mirrors the controller-wide context-token
+	// authorization enforcement mode. When set, custom-Tool executions bind the
+	// authenticated Task's transaction and credential authority before running.
+	EnforceTransactionCredentialAuth bool
+	// TransactionCredentialReadScopes lists the transaction scopes that
+	// authorize Secret-backed outbound credentials, matching the scopes the
+	// controller stamps into worker Jobs.
+	TransactionCredentialReadScopes []string
+}
+
+func (e RegistryACPMCPToolExecutor) ExecuteACPMCPTool(
+	ctx context.Context,
+	request harnessv2.MCPBrokerCallRequest,
+	descriptor harnessv2.MCPToolDescriptor,
+) (json.RawMessage, error) {
+	var result string
+	var err error
+	switch descriptor.Source {
+	case harnessv2.MCPToolSourceBrokeredBuiltin:
+		registry := e.Registry
+		if registry == nil {
+			registry = tools.DefaultRegistry
+		}
+		if _, ok := registry.Get(descriptor.Name); !ok {
+			return nil, fmt.Errorf("MCP tool %q is not registered", descriptor.Name)
+		}
+		if e.ContextFactory != nil {
+			toolContext, contextErr := e.ContextFactory(ctx, request)
+			if contextErr != nil {
+				return nil, contextErr
+			}
+			if toolContext != nil {
+				copy := *toolContext
+				copy.Namespace = request.Namespace
+				copy.TaskUID = string(request.Metadata.TaskUID)
+				copy.ToolCallID = request.Call.CallID
+				if copy.Tenant == "" {
+					copy.Tenant = request.Namespace
+				}
+				ctx = tools.WithToolContext(ctx, &copy)
+			}
+		}
+		result, err = registry.Execute(ctx, descriptor.Name, request.Call.Arguments)
+	case harnessv2.MCPToolSourceBrokeredCustom:
+		if e.Reader == nil || e.KubeClient == nil {
+			return nil, fmt.Errorf("custom MCP tool executor is not configured")
+		}
+		tool := &corev1alpha1.Tool{}
+		if getErr := e.Reader.Get(ctx, client.ObjectKey{Namespace: request.Namespace, Name: descriptor.Name}, tool); getErr != nil {
+			return nil, fmt.Errorf("load custom MCP tool %q: %w", descriptor.Name, getErr)
+		}
+		currentDescriptor, descriptorErr := customACPMCPToolDescriptor(tool)
+		if descriptorErr != nil {
+			return nil, descriptorErr
+		}
+		expected, expectedErr := harnessv2.CanonicalValue(descriptor)
+		current, currentErr := harnessv2.CanonicalValue(currentDescriptor)
+		if expectedErr != nil || currentErr != nil || !bytes.Equal(expected, current) {
+			return nil, fmt.Errorf("custom MCP tool %q changed after prompt authorization", descriptor.Name)
+		}
+		executor := workerexecutor.NewToolExecutorForNamespace(request.Namespace, e.KubeClient, e.HTTPClient, e.OutboundAccess)
+		executor.SetTransactionExchangeConfig(e.TransactionExchange)
+		if bindErr := e.bindTaskTransactionAuthority(ctx, request, executor); bindErr != nil {
+			return nil, bindErr
+		}
+		execCtx := workerexecutor.WithToolCallID(ctx, request.Call.CallID)
+		execCtx = workerexecutor.WithToolIdempotencyKey(execCtx, string(request.Metadata.OperationID))
+		result, err = executor.Execute(execCtx, tool, request.Call.Arguments)
+	default:
+		return nil, fmt.Errorf("MCP tool %q is not broker-executable", descriptor.Name)
+	}
+	if err != nil {
+		return nil, err
+	}
+	raw := json.RawMessage(result)
+	if _, err := harnessv2.CanonicalJSON(raw); err != nil {
+		encoded, encodeErr := json.Marshal(result)
+		if encodeErr != nil {
+			return nil, encodeErr
+		}
+		raw = encoded
+	}
+	if len(raw) > harnessv2.MaxMCPResultBytes {
+		return nil, fmt.Errorf("MCP tool result exceeds %d bytes", harnessv2.MaxMCPResultBytes)
+	}
+	return raw, nil
+}
+
+// bindTaskTransactionAuthority initializes the per-request custom-Tool
+// executor with the authenticated Task's transaction and credential authority,
+// mirroring the worker Job environment the controller stamps for per-Task
+// execution (setTransactionCredentialAuthorizationEnv/addTransactionEnvVars
+// plus the owner-referenced transaction-token Secret mount). It is a no-op
+// when context-token credential authorization is not enforced, and it fails
+// closed when enforcement is on and the Task's authority cannot be resolved.
+func (e RegistryACPMCPToolExecutor) bindTaskTransactionAuthority(
+	ctx context.Context,
+	request harnessv2.MCPBrokerCallRequest,
+	executor *workerexecutor.ToolExecutor,
+) error {
+	if !e.EnforceTransactionCredentialAuth {
+		return nil
+	}
+	authenticated, ok := ACPMCPAuthenticatedTaskFromContext(ctx)
+	if !ok || authenticated.Namespace != request.Namespace || authenticated.UID != string(request.Metadata.TaskUID) {
+		return errors.New("authenticated ACP MCP task authority is unavailable")
+	}
+	if e.Reader == nil {
+		return errors.New("ACP MCP task authority requires a Kubernetes reader")
+	}
+	task := &corev1alpha1.Task{}
+	if err := e.Reader.Get(ctx, client.ObjectKey{Namespace: authenticated.Namespace, Name: authenticated.Name}, task); err != nil {
+		return fmt.Errorf("load authenticated ACP MCP task authority: %w", err)
+	}
+	if string(task.UID) != authenticated.UID {
+		return errors.New("authenticated ACP MCP task identity changed")
+	}
+	transaction := task.Spec.Transaction
+	if transaction == nil {
+		// Worker parity: Jobs stamp TransactionCredentialAuthorizationEnforced
+		// as (tx != nil && enforced) and mount no transaction token, so a Task
+		// without transaction context has no credential authority to enforce
+		// and no task-scoped token. Empty authority still disables any
+		// controller-process token-file fallback.
+		executor.SetTransactionCredentialAuthority(false, false, "")
+		executor.SetTransactionAuthority("", nil)
+		return nil
+	}
+	scopes := append([]string(nil), transaction.Scopes...)
+	if len(scopes) == 0 {
+		scopes = strings.Fields(transaction.Scope)
+	}
+	required := make([]string, 0, len(e.TransactionCredentialReadScopes))
+	for _, scope := range e.TransactionCredentialReadScopes {
+		if scope = strings.TrimSpace(scope); scope != "" {
+			required = append(required, scope)
+		}
+	}
+	if len(required) == 0 {
+		required = []string{outboundaccess.DefaultCredentialReadScope}
+	}
+	scopeAllowed := slices.ContainsFunc(scopes, func(scope string) bool {
+		return slices.Contains(required, scope)
+	})
+	executor.SetTransactionCredentialAuthority(true, scopeAllowed, strings.TrimSpace(transaction.Context["secret"]))
+	token, err := e.readTaskOwnedTransactionToken(ctx, task)
+	if err != nil {
+		return err
+	}
+	executor.SetTransactionAuthority(token, scopes)
+	return nil
+}
+
+// readTaskOwnedTransactionToken loads the Task's delegated transaction token
+// from its owner-referenced Secret. The raw token is handed only to the
+// per-request executor and is never logged, persisted, or reused across Tasks.
+func (e RegistryACPMCPToolExecutor) readTaskOwnedTransactionToken(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+) (string, error) {
+	secretName := strings.TrimSpace(task.Annotations[labels.AnnotationTransactionTokenSecret])
+	if secretName == "" {
+		return "", nil
+	}
+	secret := &corev1.Secret{}
+	if err := e.Reader.Get(ctx, client.ObjectKey{Namespace: task.Namespace, Name: secretName}, secret); err != nil {
+		return "", fmt.Errorf("read ACP MCP task transaction-token Secret: %w", err)
+	}
+	owned := slices.ContainsFunc(secret.OwnerReferences, func(owner metav1.OwnerReference) bool {
+		return owner.APIVersion == corev1alpha1.GroupVersion.String() && owner.Kind == taskResourceKind &&
+			owner.Name == task.Name && owner.UID == task.UID
+	})
+	if !owned {
+		return "", errors.New("ACP MCP task transaction-token Secret is not owned by the authenticated Task")
+	}
+	token := strings.TrimSpace(string(secret.Data["token"]))
+	if token == "" {
+		return "", errors.New("ACP MCP task transaction-token Secret token is missing or empty")
+	}
+	return token, nil
+}
+
+type ACPMCPBrokerDependencies struct {
+	Reader              client.Reader
+	Epochs              *ControllerEpochManager
+	ControlStore        store.DurableControlStore
+	KubeClient          kubernetes.Interface
+	HTTPClient          *http.Client
+	Registry            *tools.Registry
+	OutboundAccess      outboundaccess.Resolver
+	TransactionExchange *workerexecutor.TransactionExchangeConfig
+	ContextFactory      func(context.Context, harnessv2.MCPBrokerCallRequest) (*tools.ToolContext, error)
+
+	// EnforceTransactionCredentialAuth and TransactionCredentialReadScopes bind
+	// brokered custom-Tool executions to the authenticated Task's transaction
+	// authority; see RegistryACPMCPToolExecutor.
+	EnforceTransactionCredentialAuth bool
+	TransactionCredentialReadScopes  []string
+}
+
+func NewProductionACPMCPBroker(dependencies ACPMCPBrokerDependencies) (*ACPMCPBroker, error) {
+	if dependencies.Reader == nil || dependencies.Epochs == nil || dependencies.ControlStore == nil || dependencies.KubeClient == nil {
+		return nil, fmt.Errorf("production ACP MCP broker dependencies are incomplete")
+	}
+	broker := &ACPMCPBroker{
+		Credentials: KubernetesACPMCPBrokerCredentialResolver{Reader: dependencies.Reader, Epochs: dependencies.Epochs},
+		Prompts:     DurableACPMCPPromptAuthorizer{Attempts: dependencies.ControlStore},
+		Executor: RegistryACPMCPToolExecutor{
+			Registry: dependencies.Registry, Reader: dependencies.Reader, KubeClient: dependencies.KubeClient,
+			HTTPClient: dependencies.HTTPClient, OutboundAccess: dependencies.OutboundAccess,
+			TransactionExchange: dependencies.TransactionExchange, ContextFactory: dependencies.ContextFactory,
+			EnforceTransactionCredentialAuth: dependencies.EnforceTransactionCredentialAuth,
+			TransactionCredentialReadScopes: append(
+				[]string(nil),
+				dependencies.TransactionCredentialReadScopes...,
+			),
+		},
+		Effects: dependencies.ControlStore,
+	}
+	if err := broker.Validate(); err != nil {
+		return nil, err
+	}
+	return broker, nil
+}
+
+type ACPMCPBroker struct {
+	Credentials  ACPMCPBrokerCredentialResolver
+	Prompts      ACPMCPPromptAuthorizer
+	Executor     ACPMCPToolExecutor
+	Effects      store.ExternalEffectStore
+	MaxBodyBytes int64
+}
+
+func (b *ACPMCPBroker) Validate() error {
+	if b == nil || b.Credentials == nil || b.Prompts == nil || b.Executor == nil || b.Effects == nil {
+		return fmt.Errorf("ACP MCP broker requires credentials, prompt authorization, tool executor, and external-effect store")
+	}
+	return nil
+}
+
+func (b *ACPMCPBroker) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost || r.URL.Path != harnessv2.MCPBrokerCallPath {
+		http.NotFound(w, r)
+		return
+	}
+	if err := b.Validate(); err != nil {
+		writeACPMCPError(w, http.StatusServiceUnavailable, "MCP broker is unavailable")
+		return
+	}
+	limit := b.MaxBodyBytes
+	if limit <= 0 || limit > harnessv2.MaxCanonicalJSONBytes {
+		limit = harnessv2.MaxCanonicalJSONBytes
+	}
+	body := http.MaxBytesReader(w, r.Body, limit)
+	defer body.Close() //nolint:errcheck
+	decoder := json.NewDecoder(body)
+	decoder.DisallowUnknownFields()
+	var request harnessv2.MCPBrokerCallRequest
+	if err := decoder.Decode(&request); err != nil {
+		writeACPMCPError(w, http.StatusBadRequest, "invalid MCP broker request")
+		return
+	}
+	var extra any
+	if err := decoder.Decode(&extra); !errors.Is(err, io.EOF) {
+		writeACPMCPError(w, http.StatusBadRequest, "invalid MCP broker request")
+		return
+	}
+	now := time.Now().UTC()
+	descriptor, err := request.ValidateAt(now)
+	if err != nil {
+		writeACPMCPError(w, http.StatusBadRequest, "invalid MCP broker request")
+		return
+	}
+	credentials, err := b.Credentials.ResolveACPMCPBrokerCredentials(r.Context(), request)
+	if err != nil || !constantTimeBearerMatch(r.Header.Get("Authorization"), credentials.ControllerBearerToken) {
+		writeACPMCPError(w, http.StatusUnauthorized, "MCP broker authentication failed")
+		return
+	}
+	if mismatch := harnessv2.CompareFence(credentials.ExpectedFence, request.Metadata.Fence, true); mismatch != harnessv2.FenceMatch {
+		writeACPMCPError(w, http.StatusGone, "MCP broker fence is stale")
+		return
+	}
+	if err := request.Authorization.ValidateProfile(credentials.RuntimeProfile); err != nil {
+		writeACPMCPError(w, http.StatusGone, "MCP broker policy is stale")
+		return
+	}
+	if err := harnessv2.VerifyOperationCapability(
+		credentials.CapabilitySecret, r.Header.Get(harnessv2.OperationCapabilityHeader), request.Metadata, true, now,
+	); err != nil {
+		writeACPMCPError(w, http.StatusForbidden, "MCP broker operation authorization failed")
+		return
+	}
+	if err := b.Prompts.AuthorizeACPMCPPrompt(r.Context(), request); err != nil {
+		writeACPMCPError(w, http.StatusForbidden, "MCP prompt is not active")
+		return
+	}
+	call := func(ctx context.Context) (json.RawMessage, error) {
+		ctx = withACPMCPAuthenticatedTask(ctx, credentials.Task)
+		result, executeErr := b.Executor.ExecuteACPMCPTool(ctx, request, descriptor)
+		if executeErr != nil {
+			return nil, executeErr
+		}
+		if err := ctx.Err(); err != nil {
+			return nil, err
+		}
+		if err := b.Prompts.AuthorizeACPMCPPrompt(ctx, request); err != nil {
+			return nil, fmt.Errorf("MCP prompt authority was revoked during tool execution")
+		}
+		return result, nil
+	}
+	var result json.RawMessage
+	replayed := false
+	var effectIdentity *store.ExternalEffectIdentity
+	if descriptor.Effect == harnessv2.MCPToolEffectConsequential {
+		identity := store.ExternalEffectIdentity{
+			Kind: "acp-mcp-tool", Namespace: request.Namespace,
+			AggregateID: string(request.Authorization.RuntimeSessionUID),
+			OperationID: string(request.Metadata.OperationID),
+		}
+		effectIdentity = &identity
+		result, replayed, err = runExternalEffectWithReplay(
+			r.Context(), b.Effects, credentials.ControllerFence, identity,
+			map[string]any{"call": request.Call, "descriptor": descriptor}, call,
+		)
+	} else {
+		result, err = call(r.Context())
+	}
+	if err != nil {
+		if effectIdentity != nil && !errors.Is(err, store.ErrConflict) {
+			settleCtx, cancel := context.WithTimeout(context.WithoutCancel(r.Context()), 10*time.Second)
+			_ = settleExternalEffectStore(settleCtx, b.Effects, credentials.ControllerFence, *effectIdentity, store.ExternalEffectOutcomeUnknown, nil)
+			cancel()
+		}
+		writeACPMCPError(w, http.StatusBadGateway, "MCP tool execution failed")
+		return
+	}
+	response := harnessv2.MCPBrokerCallResponse{
+		Protocol: harnessv2.ProtocolVersion, CallID: request.Call.CallID, Result: result,
+		IsError: mcpToolResultIsError(result), Replayed: replayed,
+	}
+	if err := response.Validate(); err != nil {
+		writeACPMCPError(w, http.StatusBadGateway, "MCP tool returned an invalid result")
+		return
+	}
+	writeACPMCPJSON(w, http.StatusOK, response)
+}
+
+func mcpToolResultIsError(result json.RawMessage) bool {
+	var envelope struct {
+		Success *bool `json:"success"`
+		IsError bool  `json:"isError"`
+	}
+	if json.Unmarshal(result, &envelope) != nil {
+		return false
+	}
+	return envelope.IsError || (envelope.Success != nil && !*envelope.Success)
+}
+
+func constantTimeBearerMatch(header, expected string) bool {
+	value := strings.TrimSpace(header)
+	if len(value) >= len("Bearer ") && strings.EqualFold(value[:len("Bearer ")], "Bearer ") {
+		value = strings.TrimSpace(value[len("Bearer "):])
+	}
+	expected = strings.TrimSpace(expected)
+	return len(value) == len(expected) && len(expected) >= 32 && subtle.ConstantTimeCompare([]byte(value), []byte(expected)) == 1
+}
+
+type DurableACPMCPPromptAuthorizer struct {
+	Attempts store.PromptAttemptStore
+}
+
+func (a DurableACPMCPPromptAuthorizer) AuthorizeACPMCPPrompt(ctx context.Context, request harnessv2.MCPBrokerCallRequest) error {
+	if a.Attempts == nil {
+		return fmt.Errorf("prompt-attempt store is required")
+	}
+	key := store.PromptAttemptKey{
+		Namespace: request.Namespace, TaskUID: string(request.Metadata.TaskUID),
+		Attempt: int64(request.Metadata.TaskAttempt), PromptID: string(request.Metadata.PromptID),
+	}
+	id, err := key.CanonicalID()
+	if err != nil {
+		return err
+	}
+	attempt, err := a.Attempts.GetPromptAttempt(ctx, id)
+	if err != nil {
+		return err
+	}
+	if attempt.ExecutionState != store.PromptExecutionSubmitting &&
+		attempt.ExecutionState != store.PromptExecutionAccepted && attempt.ExecutionState != store.PromptExecutionRunning {
+		return fmt.Errorf("prompt attempt is in state %s", attempt.ExecutionState)
+	}
+	if attempt.SessionUID != string(request.Authorization.RuntimeSessionUID) ||
+		attempt.RuntimeInstanceID != string(request.Metadata.Fence.RuntimeInstanceID) ||
+		attempt.ControllerEpoch != int64(request.Metadata.Fence.ControllerEpoch) {
+		return fmt.Errorf("prompt attempt identity does not match MCP authorization")
+	}
+	return nil
+}
+
+type KubernetesACPMCPBrokerCredentialResolver struct {
+	Reader client.Reader
+	Epochs *ControllerEpochManager
+}
+
+func (r KubernetesACPMCPBrokerCredentialResolver) ResolveACPMCPBrokerCredentials(
+	ctx context.Context,
+	request harnessv2.MCPBrokerCallRequest,
+) (ACPMCPBrokerCredentials, error) {
+	if r.Reader == nil || r.Epochs == nil {
+		return ACPMCPBrokerCredentials{}, fmt.Errorf("kubernetes MCP credential resolver is not configured")
+	}
+	controllerFence, err := r.Epochs.CurrentFence(ctx)
+	if err != nil {
+		return ACPMCPBrokerCredentials{}, err
+	}
+	if uint64(controllerFence.Epoch) != request.Metadata.Fence.ControllerEpoch {
+		return ACPMCPBrokerCredentials{}, fmt.Errorf("MCP request uses a stale controller epoch")
+	}
+	task, execution, err := findACPMCPTaskExecution(ctx, r.Reader, request, controllerFence)
+	if err != nil {
+		return ACPMCPBrokerCredentials{}, err
+	}
+	var credentials ACPMCPBrokerCredentials
+	switch {
+	case strings.TrimSpace(execution.RuntimePoolName) != "":
+		credentials, err = r.resolveRuntimePoolCredentials(ctx, request, execution, controllerFence)
+	case strings.TrimSpace(execution.AgentRuntimeName) != "":
+		credentials, err = r.resolveExternalRuntimeCredentials(ctx, request, execution, controllerFence)
+	default:
+		return ACPMCPBrokerCredentials{}, fmt.Errorf("active MCP task has no runtime target")
+	}
+	if err != nil {
+		return ACPMCPBrokerCredentials{}, err
+	}
+	credentials.Task = ACPMCPAuthenticatedTask{
+		Name: task.Name, Namespace: task.Namespace, UID: string(task.UID),
+		ParentTaskID: labels.ParentTaskName(task.Labels, task.Annotations),
+	}
+	if task.Spec.AgentRef != nil {
+		credentials.Task.AgentName = strings.TrimSpace(task.Spec.AgentRef.Name)
+	}
+	return credentials, nil
+}
+
+func (r KubernetesACPMCPBrokerCredentialResolver) resolveRuntimePoolCredentials(
+	ctx context.Context,
+	request harnessv2.MCPBrokerCallRequest,
+	execution *corev1alpha1.TaskExecutionStatus,
+	controllerFence store.ControllerEpochFence,
+) (ACPMCPBrokerCredentials, error) {
+	pool, err := findACPMCPRuntimePool(ctx, r.Reader, request.Namespace, request.Metadata.Fence.RuntimePoolUID)
+	if err != nil {
+		return ACPMCPBrokerCredentials{}, err
+	}
+	if execution.RuntimePoolUID != string(pool.UID) || execution.RuntimePoolName != pool.Name {
+		return ACPMCPBrokerCredentials{}, fmt.Errorf("active MCP task is bound to a different runtime pool")
+	}
+	active := pool.Status.ActiveInstance
+	if active.ControllerEpoch != controllerFence.Epoch || active.ProfileDigest != pool.Spec.Runtime.Profile.Digest ||
+		active.ProtocolVersion != corev1alpha1.RuntimePoolProtocolHarnessV2 {
+		return ACPMCPBrokerCredentials{}, fmt.Errorf("runtime pool active instance is stale")
+	}
+	expected := expectedACPMCPFence(pool, execution, controllerFence)
+	if mismatch := harnessv2.CompareFence(expected, request.Metadata.Fence, true); mismatch != harnessv2.FenceMatch {
+		return ACPMCPBrokerCredentials{}, fmt.Errorf("runtime pool active instance does not match MCP request")
+	}
+	bearer, capability, err := runtimePoolACPMCPAuthMaterial(ctx, r.Reader, pool)
+	if err != nil {
+		return ACPMCPBrokerCredentials{}, err
+	}
+	return ACPMCPBrokerCredentials{
+		ControllerBearerToken: bearer, CapabilitySecret: capability, ExpectedFence: expected,
+		RuntimeProfile: runtimeProfileFromPool(pool.Spec.Runtime.Profile), ControllerFence: controllerFence,
+	}, nil
+}
+
+func (r KubernetesACPMCPBrokerCredentialResolver) resolveExternalRuntimeCredentials(
+	ctx context.Context,
+	request harnessv2.MCPBrokerCallRequest,
+	execution *corev1alpha1.TaskExecutionStatus,
+	controllerFence store.ControllerEpochFence,
+) (ACPMCPBrokerCredentials, error) {
+	runtime := &corev1alpha1.AgentRuntime{}
+	key := client.ObjectKey{Namespace: request.Namespace, Name: execution.AgentRuntimeName}
+	if err := r.Reader.Get(ctx, key, runtime); err != nil {
+		return ACPMCPBrokerCredentials{}, err
+	}
+	observed := runtime.Status.ObservedCapabilities
+	if string(runtime.UID) != execution.AgentRuntimeUID || !runtime.Status.Ready || runtime.Status.ObservedGeneration != runtime.Generation ||
+		runtime.RegisteredContractVersion() != corev1alpha1.AgentRuntimeContractHarnessV2 || runtime.Spec.Capabilities == nil ||
+		runtime.Spec.Capabilities.WorkspaceGovernance == nil || runtime.Spec.Capabilities.Profile == nil ||
+		!runtime.Spec.Capabilities.WorkspaceGovernance.Strict() || observed == nil {
+		return ACPMCPBrokerCredentials{}, fmt.Errorf("external AgentRuntime is not ready for MCP brokering")
+	}
+	if observed.ControllerEpoch != controllerFence.Epoch || observed.RuntimeProfileDigest != runtime.Spec.Capabilities.Profile.Digest ||
+		observed.ProtocolVersion != string(corev1alpha1.RuntimePoolProtocolHarnessV2) {
+		return ACPMCPBrokerCredentials{}, fmt.Errorf("external AgentRuntime observation is stale")
+	}
+	profile, err := agentRuntimeProfile(*runtime.Spec.Capabilities.Profile)
+	if err != nil {
+		return ACPMCPBrokerCredentials{}, err
+	}
+	profileDigest, err := harnessv2.CanonicalProfileDigest(profile)
+	if err != nil || string(profileDigest) != runtime.Spec.Capabilities.Profile.Digest {
+		return ACPMCPBrokerCredentials{}, fmt.Errorf("external AgentRuntime profile digest is invalid")
+	}
+	expected := harnessv2.Fence{
+		RuntimeInstanceID: harnessv2.RuntimeInstanceID(observed.RuntimeInstanceID),
+		SupervisorBootID:  harnessv2.SupervisorBootID(observed.SupervisorBootID),
+		ControllerEpoch:   uint64(controllerFence.Epoch), RuntimePoolUID: harnessv2.RuntimePoolUID(observed.RuntimePoolUID),
+		RuntimePoolGeneration:      uint64(observed.RuntimePoolGeneration),
+		RuntimeSessionUID:          harnessv2.RuntimeSessionUID(execution.RuntimeSessionUID),
+		RuntimeSessionGeneration:   uint64(execution.RuntimeSessionGeneration),
+		RuntimeProfileDigest:       harnessv2.ProfileDigest(observed.RuntimeProfileDigest),
+		ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+	}
+	if mismatch := harnessv2.CompareFence(expected, request.Metadata.Fence, true); mismatch != harnessv2.FenceMatch {
+		return ACPMCPBrokerCredentials{}, fmt.Errorf("external AgentRuntime fence does not match MCP request")
+	}
+	if runtime.Spec.ClientAuth.ControllerBearerTokenSecretRef == nil || runtime.Spec.ClientAuth.OperationCapabilitySecretRef == nil {
+		return ACPMCPBrokerCredentials{}, fmt.Errorf("external AgentRuntime v2 client auth references are required")
+	}
+	bearerSecret, err := readAgentRuntimeMCPSecret(ctx, r.Reader, runtime.Namespace, *runtime.Spec.ClientAuth.ControllerBearerTokenSecretRef)
+	if err != nil {
+		return ACPMCPBrokerCredentials{}, err
+	}
+	capabilitySecret, err := readAgentRuntimeMCPSecret(ctx, r.Reader, runtime.Namespace, *runtime.Spec.ClientAuth.OperationCapabilitySecretRef)
+	if err != nil {
+		return ACPMCPBrokerCredentials{}, err
+	}
+	if bearerSecret.ResourceVersion != runtime.Status.ObservedControllerAuthRefResourceVersion ||
+		capabilitySecret.ResourceVersion != runtime.Status.ObservedOperationCapabilityRefResourceVersion {
+		return ACPMCPBrokerCredentials{}, fmt.Errorf("external AgentRuntime auth material changed after conformance")
+	}
+	bearer := strings.TrimSpace(string(bearerSecret.Data[runtime.Spec.ClientAuth.ControllerBearerTokenSecretRef.Key]))
+	capability := append([]byte(nil), capabilitySecret.Data[runtime.Spec.ClientAuth.OperationCapabilitySecretRef.Key]...)
+	if len(bearer) < 32 || len(capability) < harnessv2.MinCapabilitySecretBytes {
+		return ACPMCPBrokerCredentials{}, fmt.Errorf("external AgentRuntime auth material is incomplete")
+	}
+	return ACPMCPBrokerCredentials{
+		ControllerBearerToken: bearer, CapabilitySecret: capability, ExpectedFence: expected,
+		RuntimeProfile: profile, ControllerFence: controllerFence,
+	}, nil
+}
+
+func readAgentRuntimeMCPSecret(
+	ctx context.Context,
+	reader client.Reader,
+	namespace string,
+	reference corev1alpha1.AgentRuntimeSecretKeyReference,
+) (*corev1.Secret, error) {
+	secret := &corev1.Secret{}
+	if err := reader.Get(ctx, client.ObjectKey{Namespace: namespace, Name: reference.Name}, secret); err != nil {
+		return nil, err
+	}
+	if strings.TrimSpace(reference.Key) == "" {
+		return nil, fmt.Errorf("external AgentRuntime auth key is missing")
+	}
+	return secret, nil
+}
+
+func findACPMCPRuntimePool(
+	ctx context.Context,
+	reader client.Reader,
+	namespace string,
+	poolUID harnessv2.RuntimePoolUID,
+) (*corev1alpha1.RuntimePool, error) {
+	var pools corev1alpha1.RuntimePoolList
+	if err := reader.List(ctx, &pools, client.InNamespace(namespace)); err != nil {
+		return nil, err
+	}
+	var pool *corev1alpha1.RuntimePool
+	for index := range pools.Items {
+		candidate := &pools.Items[index]
+		if string(candidate.UID) != string(poolUID) {
+			continue
+		}
+		if pool != nil {
+			return nil, fmt.Errorf("runtime pool UID is ambiguous")
+		}
+		pool = candidate.DeepCopy()
+	}
+	if pool == nil || pool.Status.ActiveInstance == nil {
+		return nil, fmt.Errorf("runtime pool active instance was not found")
+	}
+	return pool, nil
+}
+
+func findACPMCPTaskExecution(
+	ctx context.Context,
+	reader client.Reader,
+	request harnessv2.MCPBrokerCallRequest,
+	controllerFence store.ControllerEpochFence,
+) (*corev1alpha1.Task, *corev1alpha1.TaskExecutionStatus, error) {
+	var tasks corev1alpha1.TaskList
+	if err := reader.List(ctx, &tasks, client.InNamespace(request.Namespace)); err != nil {
+		return nil, nil, err
+	}
+	var task *corev1alpha1.Task
+	var execution *corev1alpha1.TaskExecutionStatus
+	for index := range tasks.Items {
+		candidate := &tasks.Items[index]
+		if string(candidate.UID) != string(request.Metadata.TaskUID) {
+			continue
+		}
+		if task != nil {
+			return nil, nil, fmt.Errorf("task UID is ambiguous")
+		}
+		task = candidate.DeepCopy()
+		if candidate.Status.Execution != nil {
+			copy := *candidate.Status.Execution
+			execution = &copy
+		}
+	}
+	if execution == nil {
+		return nil, nil, fmt.Errorf("active MCP task was not found")
+	}
+	if execution.State != corev1alpha1.TaskExecutionStateSubmitting &&
+		execution.State != corev1alpha1.TaskExecutionStateAccepted && execution.State != corev1alpha1.TaskExecutionStateRunning {
+		return nil, nil, fmt.Errorf("active MCP task is not running")
+	}
+	if execution.Attempt != int32(request.Metadata.TaskAttempt) || execution.PromptID != string(request.Metadata.PromptID) ||
+		execution.RuntimeSessionUID != string(request.Authorization.RuntimeSessionUID) ||
+		execution.RuntimeSessionGeneration != int64(request.Authorization.SessionGeneration) ||
+		execution.RuntimeInstanceID != string(request.Metadata.Fence.RuntimeInstanceID) ||
+		execution.ControllerEpoch != controllerFence.Epoch {
+		return nil, nil, fmt.Errorf("active MCP task identity does not match request")
+	}
+	return task, execution, nil
+}
+
+func expectedACPMCPFence(
+	pool *corev1alpha1.RuntimePool,
+	execution *corev1alpha1.TaskExecutionStatus,
+	controllerFence store.ControllerEpochFence,
+) harnessv2.Fence {
+	active := pool.Status.ActiveInstance
+	return harnessv2.Fence{
+		RuntimeInstanceID: harnessv2.RuntimeInstanceID(active.RuntimeInstanceID),
+		SupervisorBootID:  harnessv2.SupervisorBootID(active.BootID),
+		ControllerEpoch:   uint64(controllerFence.Epoch), RuntimePoolUID: harnessv2.RuntimePoolUID(pool.UID),
+		RuntimePoolGeneration:      uint64(pool.Generation),
+		RuntimeSessionUID:          harnessv2.RuntimeSessionUID(execution.RuntimeSessionUID),
+		RuntimeSessionGeneration:   uint64(execution.RuntimeSessionGeneration),
+		RuntimeProfileDigest:       harnessv2.ProfileDigest(pool.Spec.Runtime.Profile.Digest),
+		ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+	}
+}
+
+func runtimePoolACPMCPAuthMaterial(
+	ctx context.Context,
+	reader client.Reader,
+	pool *corev1alpha1.RuntimePool,
+) (string, []byte, error) {
+	active := pool.Status.ActiveInstance
+	namespace := pool.Spec.RuntimeNamespace
+	if namespace == "" {
+		namespace = active.PodNamespace
+	}
+	var secrets corev1.SecretList
+	if err := reader.List(ctx, &secrets, client.InNamespace(namespace), client.MatchingLabels{
+		runtimePoolAuthLabel: "true", runtimePoolUIDLabel: string(pool.UID),
+	}); err != nil {
+		return "", nil, err
+	}
+	if len(secrets.Items) != 1 {
+		return "", nil, fmt.Errorf("runtime pool requires exactly one auth Secret")
+	}
+	secret := secrets.Items[0]
+	bearer := strings.TrimSpace(string(secret.Data[runtimePoolControllerTokenKey]))
+	capability := append([]byte(nil), secret.Data[runtimePoolCapabilitySecretKey]...)
+	if len(bearer) < 32 || len(capability) < harnessv2.MinCapabilitySecretBytes {
+		return "", nil, fmt.Errorf("runtime pool auth Secret is incomplete")
+	}
+	return bearer, capability, nil
+}
+
+func writeACPMCPError(w http.ResponseWriter, status int, message string) {
+	writeACPMCPJSON(w, status, map[string]any{"error": message})
+}
+
+func writeACPMCPJSON(w http.ResponseWriter, status int, value any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Cache-Control", "no-store")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(value)
+}
diff --git a/internal/controller/acp_mcp_broker_coordination_registration_test.go b/internal/controller/acp_mcp_broker_coordination_registration_test.go
new file mode 100644
index 000000000..c57eb8d36
--- /dev/null
+++ b/internal/controller/acp_mcp_broker_coordination_registration_test.go
@@ -0,0 +1,69 @@
+package controller
+
+import (
+	"context"
+	"slices"
+	"strings"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/utils/ptr"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/tools"
+)
+
+func TestBrokeredCoordinationRegistrationBuildsACPDescriptors(t *testing.T) {
+	registry := tools.NewRegistry()
+
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	k8sClient := fake.NewClientBuilder().WithScheme(scheme).Build()
+	if err := tools.RegisterBrokeredCoordinationTools(registry, k8sClient); err != nil {
+		t.Fatal(err)
+	}
+
+	allowed := []string{"delegate_task", "propose_memory", "recall_memory", "remember", "search_transcript"}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "task", Namespace: "default", UID: "task-uid"},
+		Spec:       corev1alpha1.TaskSpec{AgentRuntime: &corev1alpha1.AgentRuntimeSpec{AllowedTools: allowed}},
+	}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "agent", Namespace: "default", UID: "agent-uid", Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model: &corev1alpha1.ModelConfig{Name: "model"},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeClaude,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+		},
+	}
+	plan, err := PlanACPRuntime(task, agent, ACPRuntimeImages{
+		Claude: "docker.io/example/claude@sha256:" + strings.Repeat("a", 64),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	configuration, err := buildRuntimeSessionMCPConfigurationWithRegistry(
+		context.Background(), k8sClient, task, agent, plan.Profile, registry,
+	)
+	if err != nil {
+		t.Fatalf("buildRuntimeSessionMCPConfiguration() error = %v", err)
+	}
+
+	got := make([]string, 0, len(configuration.ToolPolicy.Tools))
+	for _, descriptor := range configuration.ToolPolicy.Tools {
+		if descriptor.Source != harnessv2.MCPToolSourceBrokeredBuiltin {
+			t.Fatalf("descriptor %q source = %q, want brokered_builtin", descriptor.Name, descriptor.Source)
+		}
+		got = append(got, descriptor.Name)
+	}
+	if !slices.Equal(got, allowed) {
+		t.Fatalf("brokered descriptors = %v, want %v", got, allowed)
+	}
+}
diff --git a/internal/controller/acp_mcp_broker_test.go b/internal/controller/acp_mcp_broker_test.go
new file mode 100644
index 000000000..6f0273ae1
--- /dev/null
+++ b/internal/controller/acp_mcp_broker_test.go
@@ -0,0 +1,743 @@
+package controller
+
+import (
+	"k8s.io/utils/ptr"
+
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	k8sfake "k8s.io/client-go/kubernetes/fake"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/store"
+	storesqlite "github.com/orka-agents/orka/internal/store/sqlite"
+)
+
+var apiextensionsJSONForMCPTest = apiextensionsv1.JSON{Raw: json.RawMessage(`{"type":"object"}`)}
+
+func TestRegistryACPMCPToolExecutorReusesCustomToolExecutorWithIdempotency(t *testing.T) {
+	request, _ := testMCPBrokerRequest(t, harnessv2.MCPToolEffectConsequential)
+	request.Call.ToolName = "custom_tool"
+	request.Call.Arguments = json.RawMessage(`{"value":"x"}`)
+	request.Metadata.OperationID = "mcp-custom-operation"
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("Idempotency-Key") != string(request.Metadata.OperationID) {
+			t.Fatalf("Idempotency-Key = %q", r.Header.Get("Idempotency-Key"))
+		}
+		var body map[string]any
+		if err := json.NewDecoder(r.Body).Decode(&body); err != nil || body["value"] != "x" {
+			t.Fatalf("custom tool body = %#v err=%v", body, err)
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"ok":true}`))
+	}))
+	defer upstream.Close()
+	tool := &corev1alpha1.Tool{
+		ObjectMeta: metav1.ObjectMeta{Name: "custom_tool", Namespace: request.Namespace},
+		Spec: corev1alpha1.ToolSpec{
+			Description: "custom write", BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassWrite,
+			Parameters: &apiextensionsJSONForMCPTest,
+			HTTP:       &corev1alpha1.HTTPExecution{URL: upstream.URL, Method: http.MethodPost},
+		},
+	}
+	descriptor, err := customACPMCPToolDescriptor(tool)
+	if err != nil {
+		t.Fatal(err)
+	}
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	reader := fake.NewClientBuilder().WithScheme(scheme).WithObjects(tool).Build()
+	executor := RegistryACPMCPToolExecutor{
+		Reader: reader, KubeClient: k8sfake.NewSimpleClientset(), HTTPClient: upstream.Client(),
+	}
+	result, err := executor.ExecuteACPMCPTool(context.Background(), request, descriptor)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(result) != `{"ok":true}` {
+		t.Fatalf("custom tool result = %s", result)
+	}
+
+	changed := tool.DeepCopy()
+	changed.Spec.Description = "changed after authorization"
+	reader = fake.NewClientBuilder().WithScheme(scheme).WithObjects(changed).Build()
+	executor.Reader = reader
+	if _, err := executor.ExecuteACPMCPTool(context.Background(), request, descriptor); err == nil ||
+		!strings.Contains(err.Error(), "changed after prompt authorization") {
+		t.Fatalf("descriptor drift error = %v", err)
+	}
+}
+
+func TestRegistryACPMCPToolExecutorBindsTaskTransactionAuthority(t *testing.T) {
+	request, _ := testMCPBrokerRequest(t, harnessv2.MCPToolEffectConsequential)
+	request.Call.ToolName = "custom_tool"
+	request.Call.Arguments = json.RawMessage(`{"value":"x"}`)
+	request.Metadata.OperationID = "mcp-custom-operation"
+	var lastTxnToken atomic.Value
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		lastTxnToken.Store(r.Header.Get("Txn-Token"))
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"ok":true}`))
+	}))
+	defer upstream.Close()
+	tool := &corev1alpha1.Tool{
+		ObjectMeta: metav1.ObjectMeta{Name: "custom_tool", Namespace: request.Namespace},
+		Spec: corev1alpha1.ToolSpec{
+			Description: "custom write", BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassWrite,
+			Parameters: &apiextensionsJSONForMCPTest,
+			HTTP: &corev1alpha1.HTTPExecution{
+				URL: upstream.URL, Method: http.MethodPost,
+				AuthSecretRef: &corev1alpha1.SecretKeySelector{Name: "tool-credential", Key: "token"},
+			},
+		},
+	}
+	descriptor, err := customACPMCPToolDescriptor(tool)
+	if err != nil {
+		t.Fatal(err)
+	}
+	scheme := runtime.NewScheme()
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	authenticated := ACPMCPAuthenticatedTask{Name: "task", Namespace: request.Namespace, UID: string(request.Metadata.TaskUID)}
+	newTask := func(scopes []string, constraint string, tokenSecret string) *corev1alpha1.Task {
+		task := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{
+			Name: authenticated.Name, Namespace: authenticated.Namespace, UID: "task-uid",
+		}}
+		if tokenSecret != "" {
+			task.Annotations = map[string]string{"orka.ai/transaction-token-secret": tokenSecret}
+		}
+		task.Spec.Transaction = &corev1alpha1.TaskTransaction{ID: "txn-1", Scopes: scopes}
+		if constraint != "" {
+			task.Spec.Transaction.Context = map[string]string{"secret": constraint}
+		}
+		return task
+	}
+	toolCredential := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{Name: "tool-credential", Namespace: request.Namespace},
+		Data:       map[string][]byte{"token": []byte("tool-token")},
+	}
+	newExecutor := func(enforce bool, objects ...client.Object) RegistryACPMCPToolExecutor {
+		objects = append(objects, tool.DeepCopy())
+		return RegistryACPMCPToolExecutor{
+			Reader:     fake.NewClientBuilder().WithScheme(scheme).WithObjects(objects...).Build(),
+			KubeClient: k8sfake.NewSimpleClientset(toolCredential.DeepCopy()), HTTPClient: upstream.Client(),
+			EnforceTransactionCredentialAuth: enforce,
+		}
+	}
+	authorizedTask := newTask([]string{"orka:secrets:credentials:read"}, "tool-credential", "")
+	ctx := withACPMCPAuthenticatedTask(context.Background(), authenticated)
+
+	t.Run("enforcement off preserves current behavior without task authority", func(t *testing.T) {
+		executor := newExecutor(false)
+		if _, err := executor.ExecuteACPMCPTool(context.Background(), request, descriptor); err != nil {
+			t.Fatalf("enforcement-off execution error = %v", err)
+		}
+	})
+	t.Run("missing authenticated task fails closed under enforcement", func(t *testing.T) {
+		executor := newExecutor(true, authorizedTask.DeepCopy())
+		if _, err := executor.ExecuteACPMCPTool(context.Background(), request, descriptor); err == nil ||
+			!strings.Contains(err.Error(), "task authority is unavailable") {
+			t.Fatalf("missing authenticated task error = %v", err)
+		}
+	})
+	t.Run("missing task object fails closed under enforcement", func(t *testing.T) {
+		executor := newExecutor(true)
+		if _, err := executor.ExecuteACPMCPTool(ctx, request, descriptor); err == nil ||
+			!strings.Contains(err.Error(), "load authenticated ACP MCP task authority") {
+			t.Fatalf("missing task object error = %v", err)
+		}
+	})
+	t.Run("task without credential-read scope is refused", func(t *testing.T) {
+		executor := newExecutor(true, newTask([]string{"reports.read"}, "", ""))
+		if _, err := executor.ExecuteACPMCPTool(ctx, request, descriptor); err == nil ||
+			!strings.Contains(err.Error(), "not authorized by task transaction authority") {
+			t.Fatalf("unauthorized scope error = %v", err)
+		}
+	})
+	t.Run("task secret constraint must match the tool credential", func(t *testing.T) {
+		executor := newExecutor(true, newTask([]string{"orka:secrets:credentials:read"}, "other-credential", ""))
+		if _, err := executor.ExecuteACPMCPTool(ctx, request, descriptor); err == nil ||
+			!strings.Contains(err.Error(), "does not match task transaction authority") {
+			t.Fatalf("secret constraint error = %v", err)
+		}
+	})
+	t.Run("authorized task executes and attaches its owner-referenced token", func(t *testing.T) {
+		tokenSecret := &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "task-txn-token", Namespace: request.Namespace,
+				OwnerReferences: []metav1.OwnerReference{{
+					APIVersion: corev1alpha1.GroupVersion.String(), Kind: "Task",
+					Name: authenticated.Name, UID: "task-uid",
+				}},
+			},
+			Data: map[string][]byte{"token": []byte("task-scoped-token")},
+		}
+		executor := newExecutor(true,
+			newTask([]string{"orka:secrets:credentials:read"}, "tool-credential", tokenSecret.Name), tokenSecret)
+		result, err := executor.ExecuteACPMCPTool(ctx, request, descriptor)
+		if err != nil {
+			t.Fatalf("authorized execution error = %v", err)
+		}
+		if string(result) != `{"ok":true}` {
+			t.Fatalf("authorized result = %s", result)
+		}
+		if got, _ := lastTxnToken.Load().(string); got != "task-scoped-token" {
+			t.Fatalf("Txn-Token header = %q, want the task's owner-referenced token", got)
+		}
+	})
+	t.Run("token secret not owned by the task fails closed", func(t *testing.T) {
+		unowned := &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{Name: "task-txn-token", Namespace: request.Namespace},
+			Data:       map[string][]byte{"token": []byte("task-scoped-token")},
+		}
+		executor := newExecutor(true,
+			newTask([]string{"orka:secrets:credentials:read"}, "tool-credential", unowned.Name), unowned)
+		if _, err := executor.ExecuteACPMCPTool(ctx, request, descriptor); err == nil ||
+			!strings.Contains(err.Error(), "not owned by the authenticated Task") {
+			t.Fatalf("unowned token secret error = %v", err)
+		}
+	})
+}
+
+func TestACPMCPBrokerConsequentialCallUsesDurableReplay(t *testing.T) {
+	effects, fence := newMCPBrokerControlStore(t)
+	request, profile := testMCPBrokerRequest(t, harnessv2.MCPToolEffectConsequential)
+	bearer := strings.Repeat("b", 32)
+	capability := []byte(strings.Repeat("c", 32))
+	var executions atomic.Int32
+	var authorizations atomic.Int32
+	broker := &ACPMCPBroker{
+		Credentials: ACPMCPBrokerCredentialResolverFunc(func(_ context.Context, got harnessv2.MCPBrokerCallRequest) (ACPMCPBrokerCredentials, error) {
+			return ACPMCPBrokerCredentials{
+				ControllerBearerToken: bearer, CapabilitySecret: capability,
+				ExpectedFence: got.Metadata.Fence, RuntimeProfile: profile, ControllerFence: fence,
+			}, nil
+		}),
+		Prompts: ACPMCPPromptAuthorizerFunc(func(_ context.Context, got harnessv2.MCPBrokerCallRequest) error {
+			authorizations.Add(1)
+			if got.Metadata.TaskUID != request.Metadata.TaskUID || got.Metadata.PromptID != request.Metadata.PromptID ||
+				got.Lease.Generation != request.Lease.Generation {
+				t.Fatalf("prompt authorizer received wrong identity: %#v", got)
+			}
+			return nil
+		}),
+		Executor: ACPMCPToolExecutorFunc(func(_ context.Context, got harnessv2.MCPBrokerCallRequest, descriptor harnessv2.MCPToolDescriptor) (json.RawMessage, error) {
+			executions.Add(1)
+			if descriptor.Name != "mutate" || got.Call.CallID != "call-1" {
+				t.Fatalf("executor received wrong call: descriptor=%#v call=%#v", descriptor, got.Call)
+			}
+			return json.RawMessage(`{"changed":true}`), nil
+		}),
+		Effects: effects,
+	}
+
+	first := performMCPBrokerCall(t, broker, request, bearer, capability)
+	if first.Code != http.StatusOK {
+		t.Fatalf("first status = %d body=%s", first.Code, first.Body.String())
+	}
+	second := performMCPBrokerCall(t, broker, request, bearer, capability)
+	if second.Code != http.StatusOK {
+		t.Fatalf("replay status = %d body=%s", second.Code, second.Body.String())
+	}
+	if executions.Load() != 1 {
+		t.Fatalf("executor calls = %d, want one durable consequential execution", executions.Load())
+	}
+	if authorizations.Load() != 3 {
+		t.Fatalf("prompt authorizer calls = %d, want pre-call plus post-execution authorization", authorizations.Load())
+	}
+	var response harnessv2.MCPBrokerCallResponse
+	if err := json.Unmarshal(second.Body.Bytes(), &response); err != nil {
+		t.Fatal(err)
+	}
+	if string(response.Result) != `{"changed":true}` || !response.Replayed {
+		t.Fatalf("replayed response = %#v", response)
+	}
+}
+
+func TestACPMCPBrokerConsequentialConcurrentDuplicateDoesNotDoubleExecute(t *testing.T) {
+	effects, fence := newMCPBrokerControlStore(t)
+	request, profile := testMCPBrokerRequest(t, harnessv2.MCPToolEffectConsequential)
+	bearer := strings.Repeat("b", 32)
+	capability := []byte(strings.Repeat("c", 32))
+	entered := make(chan struct{})
+	release := make(chan struct{})
+	var executions atomic.Int32
+	broker := &ACPMCPBroker{
+		Credentials: ACPMCPBrokerCredentialResolverFunc(func(_ context.Context, got harnessv2.MCPBrokerCallRequest) (ACPMCPBrokerCredentials, error) {
+			return ACPMCPBrokerCredentials{
+				ControllerBearerToken: bearer, CapabilitySecret: capability,
+				ExpectedFence: got.Metadata.Fence, RuntimeProfile: profile, ControllerFence: fence,
+			}, nil
+		}),
+		Prompts: ACPMCPPromptAuthorizerFunc(func(context.Context, harnessv2.MCPBrokerCallRequest) error { return nil }),
+		Executor: ACPMCPToolExecutorFunc(func(context.Context, harnessv2.MCPBrokerCallRequest, harnessv2.MCPToolDescriptor) (json.RawMessage, error) {
+			if executions.Add(1) == 1 {
+				close(entered)
+			}
+			<-release
+			return json.RawMessage(`{"changed":true}`), nil
+		}),
+		Effects: effects,
+	}
+	firstDone := make(chan *httptest.ResponseRecorder, 1)
+	go func() { firstDone <- performMCPBrokerCall(t, broker, request, bearer, capability) }()
+	select {
+	case <-entered:
+	case <-time.After(time.Second):
+		t.Fatal("first consequential execution did not start")
+	}
+	duplicate := performMCPBrokerCall(t, broker, request, bearer, capability)
+	if duplicate.Code == http.StatusOK {
+		t.Fatalf("concurrent duplicate unexpectedly succeeded: %s", duplicate.Body.String())
+	}
+	if executions.Load() != 1 {
+		t.Fatalf("concurrent executor calls = %d, want 1", executions.Load())
+	}
+	close(release)
+	select {
+	case first := <-firstDone:
+		if first.Code != http.StatusOK {
+			t.Fatalf("first consequential status = %d body=%s", first.Code, first.Body.String())
+		}
+	case <-time.After(time.Second):
+		t.Fatal("first consequential execution did not finish")
+	}
+	replay := performMCPBrokerCall(t, broker, request, bearer, capability)
+	if replay.Code != http.StatusOK || executions.Load() != 1 {
+		t.Fatalf("committed replay status=%d calls=%d body=%s", replay.Code, executions.Load(), replay.Body.String())
+	}
+}
+
+func TestACPMCPBrokerReadOnlyCallExecutesWithoutLedgerReplay(t *testing.T) {
+	effects, fence := newMCPBrokerControlStore(t)
+	request, profile := testMCPBrokerRequest(t, harnessv2.MCPToolEffectReadOnly)
+	bearer := strings.Repeat("b", 32)
+	capability := []byte(strings.Repeat("c", 32))
+	var executions atomic.Int32
+	broker := &ACPMCPBroker{
+		Credentials: ACPMCPBrokerCredentialResolverFunc(func(_ context.Context, got harnessv2.MCPBrokerCallRequest) (ACPMCPBrokerCredentials, error) {
+			return ACPMCPBrokerCredentials{
+				ControllerBearerToken: bearer, CapabilitySecret: capability,
+				ExpectedFence: got.Metadata.Fence, RuntimeProfile: profile, ControllerFence: fence,
+			}, nil
+		}),
+		Prompts: ACPMCPPromptAuthorizerFunc(func(context.Context, harnessv2.MCPBrokerCallRequest) error { return nil }),
+		Executor: ACPMCPToolExecutorFunc(func(context.Context, harnessv2.MCPBrokerCallRequest, harnessv2.MCPToolDescriptor) (json.RawMessage, error) {
+			executions.Add(1)
+			return json.RawMessage(`{"value":"fresh"}`), nil
+		}),
+		Effects: effects,
+	}
+	for range 2 {
+		response := performMCPBrokerCall(t, broker, request, bearer, capability)
+		if response.Code != http.StatusOK {
+			t.Fatalf("read-only status = %d body=%s", response.Code, response.Body.String())
+		}
+	}
+	if executions.Load() != 2 {
+		t.Fatalf("read-only executor calls = %d, want 2", executions.Load())
+	}
+}
+
+func TestACPMCPBrokerRejectsAuthFenceProfileAndInactivePrompt(t *testing.T) {
+	effects, fence := newMCPBrokerControlStore(t)
+	request, profile := testMCPBrokerRequest(t, harnessv2.MCPToolEffectReadOnly)
+	bearer := strings.Repeat("b", 32)
+	capability := []byte(strings.Repeat("c", 32))
+	promptAllowed := true
+	broker := &ACPMCPBroker{
+		Credentials: ACPMCPBrokerCredentialResolverFunc(func(_ context.Context, got harnessv2.MCPBrokerCallRequest) (ACPMCPBrokerCredentials, error) {
+			expected := got.Metadata.Fence
+			return ACPMCPBrokerCredentials{
+				ControllerBearerToken: bearer, CapabilitySecret: capability,
+				ExpectedFence: expected, RuntimeProfile: profile, ControllerFence: fence,
+			}, nil
+		}),
+		Prompts: ACPMCPPromptAuthorizerFunc(func(context.Context, harnessv2.MCPBrokerCallRequest) error {
+			if !promptAllowed {
+				return store.ErrConflict
+			}
+			return nil
+		}),
+		Executor: ACPMCPToolExecutorFunc(func(context.Context, harnessv2.MCPBrokerCallRequest, harnessv2.MCPToolDescriptor) (json.RawMessage, error) {
+			return json.RawMessage(`{"ok":true}`), nil
+		}),
+		Effects: effects,
+	}
+
+	wrongBearer := performMCPBrokerCall(t, broker, request, strings.Repeat("x", 32), capability)
+	if wrongBearer.Code != http.StatusUnauthorized {
+		t.Fatalf("wrong bearer status = %d", wrongBearer.Code)
+	}
+	wrongCapability := performMCPBrokerCall(t, broker, request, bearer, []byte(strings.Repeat("x", 32)))
+	if wrongCapability.Code != http.StatusForbidden {
+		t.Fatalf("wrong capability status = %d", wrongCapability.Code)
+	}
+	promptAllowed = false
+	inactive := performMCPBrokerCall(t, broker, request, bearer, capability)
+	if inactive.Code != http.StatusForbidden {
+		t.Fatalf("inactive prompt status = %d", inactive.Code)
+	}
+
+	promptAllowed = true
+	staleProfile := profile
+	staleProfile.ToolPolicyDigest = testControllerMCPDigest("stale")
+	broker.Credentials = ACPMCPBrokerCredentialResolverFunc(func(_ context.Context, got harnessv2.MCPBrokerCallRequest) (ACPMCPBrokerCredentials, error) {
+		return ACPMCPBrokerCredentials{
+			ControllerBearerToken: bearer, CapabilitySecret: capability,
+			ExpectedFence: got.Metadata.Fence, RuntimeProfile: staleProfile, ControllerFence: fence,
+		}, nil
+	})
+	profileResponse := performMCPBrokerCall(t, broker, request, bearer, capability)
+	if profileResponse.Code != http.StatusGone {
+		t.Fatalf("stale profile status = %d", profileResponse.Code)
+	}
+}
+
+func TestKubernetesACPMCPBrokerCredentialResolverChecksTaskSessionGeneration(t *testing.T) {
+	request, profile := testMCPBrokerRequest(t, harnessv2.MCPToolEffectReadOnly)
+	scheme := runtime.NewScheme()
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	pool := &corev1alpha1.RuntimePool{
+		ObjectMeta: metav1.ObjectMeta{Name: "pool", Namespace: request.Namespace, UID: "pool-uid", Generation: 2},
+		Spec: corev1alpha1.RuntimePoolSpec{
+			RuntimeNamespace: "runtime-system",
+			Runtime: corev1alpha1.RuntimePoolRuntimeSpec{
+				Profile: RuntimePoolProfileFromPlan(ACPRuntimePlan{Profile: profile, Digest: request.Metadata.Fence.RuntimeProfileDigest}),
+			},
+		},
+		Status: corev1alpha1.RuntimePoolStatus{ActiveInstance: &corev1alpha1.RuntimePoolActiveInstanceStatus{
+			PodNamespace: "runtime-system", PodName: "runtime-pod", PodAddress: "10.0.0.2", PodUID: "pod-uid",
+			BootID: string(request.Metadata.Fence.SupervisorBootID), RuntimeInstanceID: string(request.Metadata.Fence.RuntimeInstanceID),
+			ControllerEpoch: 1, ProfileDigest: string(request.Metadata.Fence.RuntimeProfileDigest),
+			ProfileDigestSchemaVersion: strconv.FormatUint(uint64(harnessv2.ProfileDigestSchemaVersion), 10), ProtocolVersion: corev1alpha1.RuntimePoolProtocolHarnessV2,
+		}},
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "task", Namespace: request.Namespace, UID: "task-uid"},
+		Status: corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateRunning, Attempt: 1, PromptID: "prompt-1",
+			RuntimePoolName: pool.Name, RuntimePoolUID: string(pool.UID),
+			RuntimeInstanceID:        string(request.Metadata.Fence.RuntimeInstanceID),
+			RuntimeSessionUID:        string(request.Authorization.RuntimeSessionUID),
+			RuntimeSessionGeneration: int64(request.Authorization.SessionGeneration), ControllerEpoch: 1,
+		}},
+	}
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{Name: "pool-auth", Namespace: "runtime-system", Labels: map[string]string{
+			runtimePoolAuthLabel: "true", runtimePoolUIDLabel: string(pool.UID),
+		}},
+		Data: map[string][]byte{
+			runtimePoolControllerTokenKey:  []byte(strings.Repeat("b", 32)),
+			runtimePoolCapabilitySecretKey: []byte(strings.Repeat("c", 32)),
+		},
+	}
+	reader := fake.NewClientBuilder().WithScheme(scheme).WithObjects(pool, task, secret).Build()
+	epochs := NewControllerEpochManager(nil, "controller-a")
+	epochs.current = &store.ControllerEpoch{Name: store.DefaultControllerEpochName, Epoch: 1, HolderID: "controller-a"}
+	close(epochs.ready)
+	resolver := KubernetesACPMCPBrokerCredentialResolver{Reader: reader, Epochs: epochs}
+	credentials, err := resolver.ResolveACPMCPBrokerCredentials(context.Background(), request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if credentials.ExpectedFence.RuntimeSessionGeneration != request.Authorization.SessionGeneration ||
+		credentials.ExpectedFence.RuntimeSessionUID != request.Authorization.RuntimeSessionUID {
+		t.Fatalf("resolved fence = %#v", credentials.ExpectedFence)
+	}
+
+	task.Status.Execution.RuntimeSessionGeneration++
+	reader = fake.NewClientBuilder().WithScheme(scheme).WithObjects(pool, task, secret).Build()
+	resolver.Reader = reader
+	if _, err := resolver.ResolveACPMCPBrokerCredentials(context.Background(), request); err == nil {
+		t.Fatal("mismatched Task RuntimeSession generation remained authorized")
+	}
+}
+
+func TestKubernetesACPMCPBrokerCredentialResolverSupportsExternalRuntime(t *testing.T) {
+	request, profile := testMCPBrokerRequest(t, harnessv2.MCPToolEffectReadOnly)
+	request.Metadata.Fence.RuntimeInstanceID = "external-instance"
+	request.Metadata.Fence.SupervisorBootID = "external-boot"
+	request.Metadata.Fence.RuntimePoolUID = "external-pool"
+	request.Metadata.Fence.RuntimePoolGeneration = 5
+	profileDigest, err := harnessv2.CanonicalProfileDigest(profile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request.Metadata.Fence.RuntimeProfileDigest = profileDigest
+	request.Authorization.RuntimeSessionUID = request.Metadata.Fence.RuntimeSessionUID
+	request.Authorization.SessionGeneration = request.Metadata.Fence.RuntimeSessionGeneration
+	digest, err := harnessv2.CanonicalRequestDigest(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request.Metadata.RequestDigest = digest
+	scheme := runtime.NewScheme()
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	profileSpec := corev1alpha1.AgentRuntimeProfileSpec{
+		Digest: string(request.Metadata.Fence.RuntimeProfileDigest), DigestSchemaVersion: int32(harnessv2.ProfileDigestSchemaVersion),
+		ACPProfile: profile.ACPProfile, AdapterName: "adapter", AdapterDigest: profile.AdapterDigests["adapter"],
+		ProviderKind: profile.ProviderKind, Model: profile.Model,
+		AgentConfigurationDigest: profile.AgentConfigurationDigest, ToolPolicyDigest: profile.ToolPolicyDigest,
+		ApprovalPolicyDigest: profile.ApprovalPolicyDigest, MCPConfigurationDigest: profile.MCPConfigurationDigest,
+		WorkspaceIntent:     corev1alpha1.WorkspaceIntent(profile.WorkspaceIntent),
+		ProxyCredentialRole: profile.ProxyCredentialRole, ProxyCredentialScope: profile.ProxyCredentialScope,
+		ResourceClass: profile.ResourceClass,
+	}
+	governance := corev1alpha1.AgentRuntimeWorkspaceGovernanceCapabilities{
+		Mode:                     corev1alpha1.AgentRuntimeWorkspaceGovernanceStrict,
+		OrkaOwnedWorkspaceDeltas: true, PromptScopedBrokerAuthorization: true, NoDirectSCMPublication: true,
+		OrkaOwnedCleanRoomPublication: true, ExactInstanceFencing: true,
+		DuplicateSafeMutations: true, CancellationSettlement: true,
+	}
+	external := &corev1alpha1.AgentRuntime{
+		ObjectMeta: metav1.ObjectMeta{Name: "external", Namespace: request.Namespace, UID: "external-uid", Generation: 1},
+		Spec: corev1alpha1.AgentRuntimeRegistrySpec{
+			ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			Deployment:      corev1alpha1.AgentRuntimeDeploymentSpec{Mode: corev1alpha1.AgentRuntimeDeploymentModeExternalEndpoint, Endpoint: "https://runtime.example.invalid"},
+			ClientAuth: corev1alpha1.AgentRuntimeClientAuth{
+				ControllerBearerTokenSecretRef: &corev1alpha1.AgentRuntimeSecretKeyReference{Name: "external-bearer", Key: "token"},
+				OperationCapabilitySecretRef:   &corev1alpha1.AgentRuntimeSecretKeyReference{Name: "external-capability", Key: "secret"},
+			},
+			Capabilities: &corev1alpha1.AgentRuntimeCapabilitiesSpec{
+				RuntimeInstanceID: "external-instance", Profile: &profileSpec, SupportsDrain: true,
+				WorkspaceGovernance: &governance,
+			},
+		},
+		Status: corev1alpha1.AgentRuntimeStatus{
+			Ready: true, ObservedGeneration: 1,
+			ObservedControllerAuthRefResourceVersion:      "rv-bearer",
+			ObservedOperationCapabilityRefResourceVersion: "rv-capability",
+			ObservedCapabilities: &corev1alpha1.AgentRuntimeObservedCapabilities{
+				ProtocolVersion: string(corev1alpha1.RuntimePoolProtocolHarnessV2), RuntimeInstanceID: "external-instance",
+				SupervisorBootID: "external-boot", ControllerEpoch: 1,
+				RuntimePoolUID: "external-pool", RuntimePoolGeneration: 5,
+				RuntimeProfileDigest: profileSpec.Digest, ProfileDigestSchemaVersion: int32(harnessv2.ProfileDigestSchemaVersion),
+			},
+		},
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "task", Namespace: request.Namespace, UID: "task-uid"},
+		Status: corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateRunning, Attempt: 1, PromptID: "prompt-1",
+			AgentRuntimeName: external.Name, AgentRuntimeUID: string(external.UID),
+			RuntimeInstanceID: "external-instance", RuntimeSessionUID: string(request.Authorization.RuntimeSessionUID),
+			RuntimeSessionGeneration: int64(request.Authorization.SessionGeneration), ControllerEpoch: 1,
+		}},
+	}
+	bearer := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{Name: "external-bearer", Namespace: request.Namespace, ResourceVersion: "rv-bearer"},
+		Data:       map[string][]byte{"token": []byte(strings.Repeat("b", 32))},
+	}
+	capability := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{Name: "external-capability", Namespace: request.Namespace, ResourceVersion: "rv-capability"},
+		Data:       map[string][]byte{"secret": []byte(strings.Repeat("c", 32))},
+	}
+	reader := fake.NewClientBuilder().WithScheme(scheme).WithObjects(external, task, bearer, capability).Build()
+	epochs := NewControllerEpochManager(nil, "controller-a")
+	epochs.current = &store.ControllerEpoch{Name: store.DefaultControllerEpochName, Epoch: 1, HolderID: "controller-a"}
+	close(epochs.ready)
+	resolver := KubernetesACPMCPBrokerCredentialResolver{Reader: reader, Epochs: epochs}
+	credentials, err := resolver.ResolveACPMCPBrokerCredentials(context.Background(), request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if credentials.ExpectedFence.RuntimeInstanceID != "external-instance" ||
+		credentials.ExpectedFence.RuntimePoolGeneration != 5 || credentials.RuntimeProfile.Model != profile.Model {
+		t.Fatalf("external credentials = %#v", credentials)
+	}
+}
+
+func TestDurableACPMCPPromptAuthorizerRequiresActiveExactAttempt(t *testing.T) {
+	request, _ := testMCPBrokerRequest(t, harnessv2.MCPToolEffectReadOnly)
+	attempt := &store.PromptAttempt{
+		Key: store.PromptAttemptKey{
+			Namespace: request.Namespace, TaskUID: string(request.Metadata.TaskUID),
+			Attempt: int64(request.Metadata.TaskAttempt), PromptID: string(request.Metadata.PromptID),
+		},
+		SessionUID: string(request.Authorization.RuntimeSessionUID), RuntimeInstanceID: string(request.Metadata.Fence.RuntimeInstanceID),
+		ControllerEpoch: int64(request.Metadata.Fence.ControllerEpoch), ExecutionState: store.PromptExecutionRunning,
+	}
+	attempt.ID, _ = attempt.Key.CanonicalID()
+	authorizer := DurableACPMCPPromptAuthorizer{Attempts: staticPromptAttemptStore{attempt: attempt}}
+	if err := authorizer.AuthorizeACPMCPPrompt(context.Background(), request); err != nil {
+		t.Fatalf("AuthorizeACPMCPPrompt() error = %v", err)
+	}
+	settling := *attempt
+	settling.ExecutionState = store.PromptExecutionSettling
+	authorizer.Attempts = staticPromptAttemptStore{attempt: &settling}
+	if err := authorizer.AuthorizeACPMCPPrompt(context.Background(), request); err == nil {
+		t.Fatal("settling prompt remained authorized")
+	}
+	wrongSession := *attempt
+	wrongSession.SessionUID = "other-session"
+	authorizer.Attempts = staticPromptAttemptStore{attempt: &wrongSession}
+	if err := authorizer.AuthorizeACPMCPPrompt(context.Background(), request); err == nil {
+		t.Fatal("mismatched RuntimeSession remained authorized")
+	}
+}
+
+type staticPromptAttemptStore struct {
+	attempt *store.PromptAttempt
+}
+
+func (s staticPromptAttemptStore) CreatePromptAttempt(context.Context, *store.PromptAttempt, store.ControllerEpochFence) (*store.PromptAttempt, error) {
+	return nil, store.ErrConflict
+}
+func (s staticPromptAttemptStore) GetPromptAttempt(context.Context, string) (*store.PromptAttempt, error) {
+	if s.attempt == nil {
+		return nil, store.ErrNotFound
+	}
+	copy := *s.attempt
+	return &copy, nil
+}
+func (s staticPromptAttemptStore) TransitionPromptAttemptExecution(context.Context, store.PromptAttemptExecutionTransition) (*store.PromptAttempt, error) {
+	return nil, store.ErrConflict
+}
+func (s staticPromptAttemptStore) RecoverPromptAttemptPreSubmission(context.Context, store.PromptAttemptPreSubmissionRecovery) (*store.PromptAttempt, error) {
+	return nil, store.ErrConflict
+}
+func (s staticPromptAttemptStore) TransitionPromptAttemptDelivery(context.Context, store.PromptAttemptDeliveryTransition) (*store.PromptAttempt, error) {
+	return nil, store.ErrConflict
+}
+
+func testMCPBrokerRequest(t *testing.T, effect harnessv2.MCPToolEffect) (harnessv2.MCPBrokerCallRequest, harnessv2.RuntimeProfile) {
+	t.Helper()
+	now := time.Now().UTC()
+	fence := harnessv2.Fence{
+		RuntimeInstanceID: "runtime-instance", SupervisorBootID: "boot", ControllerEpoch: 1,
+		RuntimePoolUID: "pool-uid", RuntimePoolGeneration: 2,
+		RuntimeSessionUID: "session-uid", RuntimeSessionGeneration: 3,
+		RuntimeProfileDigest:       harnessv2.ProfileDigest(testControllerMCPDigest("profile")),
+		ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+	}
+	descriptor := harnessv2.MCPToolDescriptor{
+		Name: "mutate", Description: "test broker tool", InputSchema: json.RawMessage(`{"type":"object"}`),
+		Source: harnessv2.MCPToolSourceBrokeredBuiltin, Effect: effect,
+	}
+	descriptorDigest, err := harnessv2.CanonicalMCPToolDescriptorDigest([]harnessv2.MCPToolDescriptor{descriptor})
+	if err != nil {
+		t.Fatal(err)
+	}
+	toolPolicy := harnessv2.MCPToolPolicy{
+		AllowedToolNames: []string{"mutate"}, AllowBash: true,
+		Tools: []harnessv2.MCPToolDescriptor{descriptor}, DescriptorDigest: descriptorDigest,
+	}
+	approvalPolicy := harnessv2.MCPApprovalPolicy{}
+	toolDigest, _ := harnessv2.CanonicalRuntimeToolPolicyDigest(toolPolicy.AllowedToolNames, toolPolicy.DisallowedToolNames, toolPolicy.AllowBash)
+	approvalDigest, _ := harnessv2.CanonicalMCPApprovalPolicyDigest(approvalPolicy)
+	mcpDigest, _ := harnessv2.CanonicalMCPConfigurationDigest(toolPolicy.AllowedToolNames)
+	profile := harnessv2.RuntimeProfile{
+		ACPProfile: harnessv2.ACPProfileV1, AdapterDigests: map[string]string{"adapter": testControllerMCPDigest("adapter")},
+		ProviderKind: "codex", Model: "model", AgentConfigurationDigest: testControllerMCPDigest("agent"),
+		ToolPolicyDigest: toolDigest, ApprovalPolicyDigest: approvalDigest,
+		MCPConfigurationDigest: mcpDigest, WorkspaceIntent: harnessv2.WorkspaceIntentRead,
+		ProxyCredentialRole: "provider", ProxyCredentialScope: "model:model", ResourceClass: "standard",
+	}
+	lease := harnessv2.PromptLease{Generation: 4, IssuedAt: now.Add(-time.Second), ExpiresAt: now.Add(2 * time.Minute)}
+	metadata := harnessv2.MutationMetadata{
+		Fence: fence, TaskUID: "task-uid", TaskAttempt: 1, PromptID: "prompt-1", OperationID: "mcp-operation-1",
+		RequestDigestSchemaVersion: harnessv2.RequestDigestSchemaVersion, ExpiresAt: now.Add(30 * time.Second),
+	}
+	authorization := harnessv2.PromptMCPAuthorization{
+		RuntimeSessionUID: fence.RuntimeSessionUID, SessionGeneration: fence.RuntimeSessionGeneration,
+		TaskUID: metadata.TaskUID, TaskAttempt: metadata.TaskAttempt, PromptID: metadata.PromptID,
+		LeaseGeneration: lease.Generation, ToolPolicyDigest: profile.ToolPolicyDigest,
+		ApprovalPolicyDigest: profile.ApprovalPolicyDigest, MCPConfigurationDigest: profile.MCPConfigurationDigest,
+		ToolPolicy: toolPolicy, ApprovalPolicy: approvalPolicy, ExpiresAt: now.Add(time.Minute),
+	}
+	request := harnessv2.MCPBrokerCallRequest{
+		Protocol: harnessv2.ProtocolVersion, Namespace: "default", SessionState: harnessv2.RuntimeSessionStatePromptRunning,
+		Metadata: metadata, Lease: lease, Authorization: authorization,
+		Call: harnessv2.MCPToolCall{CallID: "call-1", ToolName: "mutate", Arguments: json.RawMessage(`{"value":"x"}`)},
+	}
+	digest, err := harnessv2.CanonicalRequestDigest(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request.Metadata.RequestDigest = digest
+	return request, profile
+}
+
+func performMCPBrokerCall(
+	t *testing.T,
+	broker http.Handler,
+	request harnessv2.MCPBrokerCallRequest,
+	bearer string,
+	capabilitySecret []byte,
+) *httptest.ResponseRecorder {
+	t.Helper()
+	body, err := json.Marshal(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	capability, err := harnessv2.SignOperationCapability(capabilitySecret, harnessv2.ClaimsForMutation(request.Metadata))
+	if err != nil {
+		t.Fatal(err)
+	}
+	httpRequest := httptest.NewRequest(http.MethodPost, harnessv2.MCPBrokerCallPath, bytes.NewReader(body))
+	httpRequest.Header.Set("Content-Type", "application/json")
+	httpRequest.Header.Set("Authorization", "Bearer "+bearer)
+	httpRequest.Header.Set(harnessv2.OperationCapabilityHeader, capability)
+	response := httptest.NewRecorder()
+	broker.ServeHTTP(response, httpRequest)
+	return response
+}
+
+func newMCPBrokerControlStore(t *testing.T) (*storesqlite.Store, store.ControllerEpochFence) {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "control.db")
+	db, err := storesqlite.NewDB(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	control := storesqlite.NewStore(db, path)
+	epoch, err := control.CompareAndSwapControllerEpoch(context.Background(), store.ControllerEpochCAS{
+		ExpectedVersion: 0, ExpectedEpoch: 0, NewEpoch: 1, HolderID: "controller-a",
+		RequestDigest: testControllerMCPDigest("epoch"), UpdatedAt: time.Now().UTC(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return control, store.ControllerEpochFence{Name: epoch.Name, Epoch: epoch.Epoch, HolderID: epoch.HolderID}
+}
+
+func testControllerMCPDigest(value string) string {
+	sum := sha256.Sum256([]byte(value))
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
diff --git a/internal/controller/acp_mcp_policy.go b/internal/controller/acp_mcp_policy.go
new file mode 100644
index 000000000..bfcf3eb92
--- /dev/null
+++ b/internal/controller/acp_mcp_policy.go
@@ -0,0 +1,293 @@
+package controller
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/acp"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/tools"
+)
+
+// Only tools whose every invocation leaves durable state unchanged belong here.
+// check_messages is consequential because mark_read defaults to true.
+var readOnlyBrokeredTools = map[string]struct{}{
+	"check_pr_review_marker": {}, "check_pull_request_ci": {}, "check_task_progress": {},
+	"fetch_task_output": {}, "file_read": {}, "get_issue": {},
+	"list_agents": {}, "list_issues": {}, "list_pull_requests": {}, "list_tasks": {},
+	"list_tools": {}, "recall_memory": {}, "search_transcript": {}, "wait_for_task": {},
+	"wait_for_tasks": {}, "web_fetch": {}, "web_search": {},
+}
+
+var controllerLocalOnlyTools = map[string]struct{}{
+	"code_exec":  {},
+	"file_read":  {},
+	"file_write": {},
+}
+
+const (
+	providerNativeToolBash      = "Bash"
+	providerNativeToolEdit      = "Edit"
+	providerNativeToolGlob      = "Glob"
+	providerNativeToolGrep      = "Grep"
+	providerNativeToolRead      = "Read"
+	providerNativeToolWebFetch  = "WebFetch"
+	providerNativeToolWebSearch = "WebSearch"
+	providerNativeToolWrite     = "Write"
+)
+
+var providerNativeTools = map[string]map[string]string{
+	"codex":    canonicalToolSet(acp.BuiltInRuntimeNativeToolNames("codex")...),
+	"claude":   canonicalToolSet(acp.BuiltInRuntimeNativeToolNames("claude")...),
+	"copilot":  canonicalToolSet(acp.BuiltInRuntimeNativeToolNames("copilot")...),
+	"opencode": canonicalToolSet(acp.BuiltInRuntimeNativeToolNames("opencode")...),
+}
+
+func canonicalToolSet(names ...string) map[string]string {
+	result := make(map[string]string, len(names))
+	for _, name := range names {
+		result[strings.ToLower(name)] = name
+	}
+	return result
+}
+
+// normalizeACPProviderNativeToolPolicy expands only the provider-native tools
+// that are implicit when the runtime allowlist is empty. Brokered/custom tools
+// are never implicit: when configured they already appear in allowed, so the
+// explicit list is returned unchanged and those descriptors remain intact.
+func normalizeACPProviderNativeToolPolicy(
+	provider string,
+	allowed, disallowed []string,
+	allowBash bool,
+) ([]string, []string, bool) {
+	return acp.NormalizeBuiltInRuntimeToolPolicy(provider, allowed, disallowed, allowBash)
+}
+
+func buildRuntimeSessionMCPConfiguration(
+	ctx context.Context,
+	reader client.Reader,
+	task *corev1alpha1.Task,
+	agent *corev1alpha1.Agent,
+	profile harnessv2.RuntimeProfile,
+) (harnessv2.MCPPolicyConfiguration, error) {
+	return buildRuntimeSessionMCPConfigurationWithRegistry(ctx, reader, task, agent, profile, tools.DefaultRegistry)
+}
+
+func buildRuntimeSessionMCPConfigurationWithRegistry(
+	ctx context.Context,
+	reader client.Reader,
+	task *corev1alpha1.Task,
+	agent *corev1alpha1.Agent,
+	profile harnessv2.RuntimeProfile,
+	registry *tools.Registry,
+) (harnessv2.MCPPolicyConfiguration, error) {
+	if task == nil || agent == nil {
+		return harnessv2.MCPPolicyConfiguration{}, fmt.Errorf("task and Agent are required for MCP policy")
+	}
+	allowed := effectiveACPAllowedTools(task, agent)
+	disallowed := []string(nil)
+	if task.Spec.AgentRuntime != nil {
+		disallowed = sortedUnique(task.Spec.AgentRuntime.DisallowedTools)
+	}
+	allowBash := true
+	if agent.Spec.Runtime != nil && agent.Spec.Runtime.DefaultAllowBash != nil {
+		allowBash = *agent.Spec.Runtime.DefaultAllowBash
+	}
+	if task.Spec.AgentRuntime != nil && task.Spec.AgentRuntime.AllowBash != nil {
+		allowBash = *task.Spec.AgentRuntime.AllowBash
+	}
+	allowed, disallowed, allowBash = normalizeACPRuntimeToolPolicy(
+		profile.ProviderKind, corev1alpha1.WorkspaceIntent(profile.WorkspaceIntent), allowed, disallowed, allowBash,
+	)
+	toolDigest, err := harnessv2.CanonicalRuntimeToolPolicyDigest(allowed, disallowed, allowBash)
+	if err != nil || toolDigest != profile.ToolPolicyDigest {
+		return harnessv2.MCPPolicyConfiguration{}, fmt.Errorf("effective MCP tool policy does not match RuntimePool profile")
+	}
+	descriptors, err := buildCanonicalMCPToolDescriptors(
+		ctx, reader, task.Namespace, profile.ProviderKind, allowed, disallowed, allowBash, registry,
+	)
+	if err != nil {
+		return harnessv2.MCPPolicyConfiguration{}, err
+	}
+	descriptorDigest, err := harnessv2.CanonicalMCPToolDescriptorDigest(descriptors)
+	if err != nil {
+		return harnessv2.MCPPolicyConfiguration{}, err
+	}
+	approval := harnessv2.MCPApprovalPolicy{}
+	if agent.Spec.Coordination != nil {
+		approval.RequiredTools = sortedUnique(agent.Spec.Coordination.ApprovalRequiredTools)
+	}
+	approvalDigest, err := harnessv2.CanonicalMCPApprovalPolicyDigest(approval)
+	if err != nil || approvalDigest != profile.ApprovalPolicyDigest {
+		return harnessv2.MCPPolicyConfiguration{}, fmt.Errorf("effective MCP approval policy does not match RuntimePool profile")
+	}
+	mcpDigest, err := harnessv2.CanonicalMCPConfigurationDigest(allowed)
+	if err != nil || mcpDigest != profile.MCPConfigurationDigest {
+		return harnessv2.MCPPolicyConfiguration{}, fmt.Errorf("effective MCP configuration does not match RuntimePool profile")
+	}
+	configuration := harnessv2.MCPPolicyConfiguration{
+		ToolPolicyDigest: toolDigest, ApprovalPolicyDigest: approvalDigest, MCPConfigurationDigest: mcpDigest,
+		ToolPolicy: harnessv2.MCPToolPolicy{
+			AllowedToolNames: allowed, DisallowedToolNames: disallowed, AllowBash: allowBash,
+			Tools: descriptors, DescriptorDigest: descriptorDigest,
+		},
+		ApprovalPolicy: approval,
+	}
+	if err := configuration.ValidateProfile(profile); err != nil {
+		return harnessv2.MCPPolicyConfiguration{}, err
+	}
+	return configuration, nil
+}
+
+func buildPromptMCPAuthorization(
+	configuration harnessv2.MCPPolicyConfiguration,
+	fence harnessv2.Fence,
+	profile harnessv2.RuntimeProfile,
+	metadata harnessv2.MutationMetadata,
+	lease harnessv2.PromptLease,
+	expiresAt time.Time,
+) (harnessv2.PromptMCPAuthorization, error) {
+	if err := configuration.ValidateProfile(profile); err != nil {
+		return harnessv2.PromptMCPAuthorization{}, err
+	}
+	authorization := harnessv2.PromptMCPAuthorization{
+		RuntimeSessionUID: fence.RuntimeSessionUID, SessionGeneration: fence.RuntimeSessionGeneration,
+		TaskUID: metadata.TaskUID, TaskAttempt: metadata.TaskAttempt, PromptID: metadata.PromptID,
+		LeaseGeneration: lease.Generation, ToolPolicyDigest: configuration.ToolPolicyDigest,
+		ApprovalPolicyDigest:   configuration.ApprovalPolicyDigest,
+		MCPConfigurationDigest: configuration.MCPConfigurationDigest,
+		ToolPolicy:             configuration.ToolPolicy, ApprovalPolicy: configuration.ApprovalPolicy,
+		ExpiresAt: expiresAt,
+	}
+	if err := authorization.ValidateForAt(metadata, lease, time.Now().UTC()); err != nil {
+		return harnessv2.PromptMCPAuthorization{}, err
+	}
+	if err := authorization.ValidateProfile(profile); err != nil {
+		return harnessv2.PromptMCPAuthorization{}, err
+	}
+	return authorization, nil
+}
+
+func buildCanonicalMCPToolDescriptors(
+	ctx context.Context,
+	reader client.Reader,
+	namespace, provider string,
+	allowed, disallowed []string,
+	allowBash bool,
+	registry *tools.Registry,
+) ([]harnessv2.MCPToolDescriptor, error) {
+	policy := harnessv2.MCPToolPolicy{AllowedToolNames: allowed, DisallowedToolNames: disallowed, AllowBash: allowBash}
+	descriptors := make([]harnessv2.MCPToolDescriptor, 0, len(allowed))
+	for _, name := range allowed {
+		if !policy.Allows(name) {
+			continue
+		}
+		if registry != nil {
+			if tool, ok := registry.Get(name); ok {
+				if _, localOnly := controllerLocalOnlyTools[name]; localOnly {
+					return nil, fmt.Errorf("built-in tool %q is local-process-only and cannot be exposed through the controller MCP broker", name)
+				}
+				descriptors = append(descriptors, harnessv2.MCPToolDescriptor{
+					Name: name, Description: tool.Description(), InputSchema: append(json.RawMessage(nil), tool.Parameters()...),
+					Source: harnessv2.MCPToolSourceBrokeredBuiltin, Effect: brokeredToolEffect(name),
+				})
+				continue
+			}
+		}
+		if native := providerNativeTools[strings.ToLower(provider)]; native != nil {
+			if _, ok := native[strings.ToLower(name)]; ok {
+				descriptors = append(descriptors, harnessv2.MCPToolDescriptor{
+					Name: name, Description: "Provider-native tool; not exposed by the Orka MCP broker.",
+					Source: harnessv2.MCPToolSourceProviderNative, Effect: providerNativeToolEffect(name),
+				})
+				continue
+			}
+		}
+		if reader == nil {
+			return nil, fmt.Errorf("allowed tool %q is not a known provider-native or brokered built-in tool", name)
+		}
+		custom := &corev1alpha1.Tool{}
+		err := reader.Get(ctx, types.NamespacedName{Namespace: namespace, Name: name}, custom)
+		if apierrors.IsNotFound(err) {
+			return nil, fmt.Errorf("allowed tool %q is not a known provider-native, built-in, or Tool resource", name)
+		}
+		if err != nil {
+			return nil, fmt.Errorf("load allowed Tool %q: %w", name, err)
+		}
+		descriptor, descriptorErr := customACPMCPToolDescriptor(custom)
+		if descriptorErr != nil {
+			return nil, descriptorErr
+		}
+		descriptors = append(descriptors, descriptor)
+	}
+	sort.Slice(descriptors, func(i, j int) bool { return descriptors[i].Name < descriptors[j].Name })
+	return descriptors, nil
+}
+
+func customACPMCPToolDescriptor(tool *corev1alpha1.Tool) (harnessv2.MCPToolDescriptor, error) {
+	if tool == nil || strings.TrimSpace(tool.Name) == "" {
+		return harnessv2.MCPToolDescriptor{}, fmt.Errorf("custom tool identity is required")
+	}
+	if tool.Spec.BrokeredToolClass == "" {
+		return harnessv2.MCPToolDescriptor{}, fmt.Errorf("tool %q does not declare brokeredToolClass and cannot be exposed to ACP", tool.Name)
+	}
+	parameters := json.RawMessage(`{"type":"object","properties":{}}`)
+	if tool.Spec.Parameters != nil && len(tool.Spec.Parameters.Raw) > 0 {
+		parameters = append(json.RawMessage(nil), tool.Spec.Parameters.Raw...)
+	}
+	effect := harnessv2.MCPToolEffectConsequential
+	if tool.Spec.BrokeredToolClass == corev1alpha1.AgentRuntimeBrokeredToolClassRead {
+		effect = harnessv2.MCPToolEffectReadOnly
+	}
+	// Consequential calls run under the external-effect ledger, whose fixed
+	// lease can only account for maxACPExternalEffectCallDuration of execution.
+	// A longer configured timeout would be cut off mid-flight and settled
+	// OutcomeUnknown, so reject it at exposure time instead.
+	if effect == harnessv2.MCPToolEffectConsequential && tool.Spec.HTTP != nil && tool.Spec.HTTP.Timeout != nil &&
+		tool.Spec.HTTP.Timeout.Duration > maxACPExternalEffectCallDuration {
+		return harnessv2.MCPToolDescriptor{}, fmt.Errorf(
+			"tool %q spec.http.timeout %s exceeds the maximum brokered consequential call duration %s",
+			tool.Name, tool.Spec.HTTP.Timeout.Duration, maxACPExternalEffectCallDuration,
+		)
+	}
+	definitionDigest, err := acpDomainDigest("mcp-custom-tool-definition", map[string]any{
+		"uid": string(tool.UID), "generation": tool.Generation, "spec": tool.Spec,
+		"endpoint": tool.Status.Endpoint, "actor": tool.Status.Actor,
+	})
+	if err != nil {
+		return harnessv2.MCPToolDescriptor{}, err
+	}
+	descriptor := harnessv2.MCPToolDescriptor{
+		Name: tool.Name, Description: tool.Spec.Description, InputSchema: parameters,
+		Source: harnessv2.MCPToolSourceBrokeredCustom, Effect: effect, DefinitionDigest: definitionDigest,
+	}
+	if err := descriptor.Validate(); err != nil {
+		return harnessv2.MCPToolDescriptor{}, err
+	}
+	return descriptor, nil
+}
+
+func brokeredToolEffect(name string) harnessv2.MCPToolEffect {
+	if _, ok := readOnlyBrokeredTools[name]; ok {
+		return harnessv2.MCPToolEffectReadOnly
+	}
+	return harnessv2.MCPToolEffectConsequential
+}
+
+func providerNativeToolEffect(name string) harnessv2.MCPToolEffect {
+	switch strings.ToLower(name) {
+	case "read", "glob", "grep", "websearch", "webfetch":
+		return harnessv2.MCPToolEffectReadOnly
+	default:
+		return harnessv2.MCPToolEffectConsequential
+	}
+}
diff --git a/internal/controller/acp_mcp_policy_test.go b/internal/controller/acp_mcp_policy_test.go
new file mode 100644
index 000000000..81d48c7b4
--- /dev/null
+++ b/internal/controller/acp_mcp_policy_test.go
@@ -0,0 +1,829 @@
+package controller
+
+import (
+	"context"
+	"encoding/json"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/utils/ptr"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/labels"
+	"github.com/orka-agents/orka/internal/tools"
+)
+
+func TestBuildRuntimeSessionMCPConfigurationInjectsJournaledChildMessagingTools(t *testing.T) {
+	registry := tools.NewRegistry()
+	registry.Register(tools.NewSendMessageTool())
+	registry.Register(tools.NewCheckMessagesTool())
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "child", Namespace: "default", UID: "child-uid",
+			Labels: map[string]string{labels.LabelParentTask: "parent"},
+		},
+	}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "agent", Namespace: "default", UID: "agent-uid", Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model: &corev1alpha1.ModelConfig{Name: "model"},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:                corev1alpha1.AgentRuntimeClaude,
+				ContractVersion:     ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+				DefaultAllowedTools: []string{providerNativeToolRead},
+			},
+		},
+	}
+	plan, err := PlanACPRuntime(
+		task, agent,
+		ACPRuntimeImages{Claude: "docker.io/example/claude@sha256:" + strings.Repeat("a", 64)},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	configuration, err := buildRuntimeSessionMCPConfigurationWithRegistry(
+		context.Background(), nil, task, agent, plan.Profile, registry,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := configuration.ValidateProfile(plan.Profile); err != nil {
+		t.Fatalf("ValidateProfile() error = %v", err)
+	}
+	if want := []string{providerNativeToolRead, "check_messages", "send_message"}; !slices.Equal(configuration.ToolPolicy.AllowedToolNames, want) {
+		t.Fatalf("allowed tools = %v, want %v", configuration.ToolPolicy.AllowedToolNames, want)
+	}
+	byName := make(map[string]harnessv2.MCPToolDescriptor, len(configuration.ToolPolicy.Tools))
+	for _, descriptor := range configuration.ToolPolicy.Tools {
+		byName[descriptor.Name] = descriptor
+	}
+	for _, name := range []string{"check_messages", "send_message"} {
+		descriptor, ok := byName[name]
+		if !ok {
+			t.Fatalf("missing delegated child descriptor %q", name)
+		}
+		if descriptor.Source != harnessv2.MCPToolSourceBrokeredBuiltin {
+			t.Fatalf("descriptor %q source = %q, want brokered_builtin", name, descriptor.Source)
+		}
+		if descriptor.Effect != harnessv2.MCPToolEffectConsequential {
+			t.Fatalf("descriptor %q effect = %q, want consequential", name, descriptor.Effect)
+		}
+	}
+}
+
+func TestBuildRuntimeSessionMCPConfigurationSynthesizesDenyOnlyProviderNativeTools(t *testing.T) {
+	allowBashFalse := false
+	tests := []struct {
+		name           string
+		provider       corev1alpha1.AgentRuntimeType
+		images         ACPRuntimeImages
+		disallowed     []string
+		allowBash      *bool
+		wantAllowed    []string
+		wantDisallowed []string
+		wantAllowBash  bool
+	}{
+		{
+			name: "claude denylist", provider: corev1alpha1.AgentRuntimeClaude,
+			images:         ACPRuntimeImages{Claude: "docker.io/example/claude@sha256:" + strings.Repeat("a", 64)},
+			disallowed:     []string{"write"},
+			wantAllowed:    []string{providerNativeToolBash, providerNativeToolEdit, providerNativeToolGlob, providerNativeToolGrep, providerNativeToolRead, providerNativeToolWebFetch, providerNativeToolWebSearch},
+			wantDisallowed: []string{"write"},
+			wantAllowBash:  true,
+		},
+		{
+			name: "claude bash disabled", provider: corev1alpha1.AgentRuntimeClaude,
+			images:        ACPRuntimeImages{Claude: "docker.io/example/claude@sha256:" + strings.Repeat("a", 64)},
+			allowBash:     &allowBashFalse,
+			wantAllowed:   []string{providerNativeToolEdit, providerNativeToolGlob, providerNativeToolGrep, providerNativeToolRead, providerNativeToolWebFetch, providerNativeToolWebSearch, providerNativeToolWrite},
+			wantAllowBash: false,
+		},
+		{
+			name: "copilot denylist", provider: corev1alpha1.AgentRuntimeCopilot,
+			images:         ACPRuntimeImages{Copilot: "docker.io/example/copilot@sha256:" + strings.Repeat("b", 64)},
+			disallowed:     []string{"write", providerNativeToolWebSearch},
+			wantAllowed:    []string{providerNativeToolBash, providerNativeToolEdit, providerNativeToolGlob, providerNativeToolGrep, providerNativeToolRead, providerNativeToolWebFetch},
+			wantDisallowed: []string{providerNativeToolWebSearch, "write"},
+			wantAllowBash:  true,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			task := &corev1alpha1.Task{
+				ObjectMeta: metav1.ObjectMeta{Name: "task", Namespace: "default", UID: "task-uid"},
+				Spec: corev1alpha1.TaskSpec{AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
+					DisallowedTools: test.disallowed, AllowBash: test.allowBash,
+				}},
+			}
+			agent := &corev1alpha1.Agent{
+				ObjectMeta: metav1.ObjectMeta{Name: "agent", Namespace: "default", UID: "agent-uid", Generation: 1},
+				Spec: corev1alpha1.AgentSpec{
+					Model: &corev1alpha1.ModelConfig{Name: "model"},
+					Runtime: &corev1alpha1.AgentCLIRuntime{
+						Type:            test.provider,
+						ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+					},
+				},
+			}
+			plan, err := PlanACPRuntime(task, agent, test.images)
+			if err != nil {
+				t.Fatal(err)
+			}
+			configuration, err := buildRuntimeSessionMCPConfiguration(
+				context.Background(), nil, task, agent, plan.Profile,
+			)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if err := configuration.ValidateProfile(plan.Profile); err != nil {
+				t.Fatalf("ValidateProfile() error = %v", err)
+			}
+			if !slices.Equal(configuration.ToolPolicy.AllowedToolNames, test.wantAllowed) {
+				t.Fatalf("allowed tools = %v, want %v", configuration.ToolPolicy.AllowedToolNames, test.wantAllowed)
+			}
+			if !slices.Equal(configuration.ToolPolicy.DisallowedToolNames, test.wantDisallowed) {
+				t.Fatalf("disallowed tools = %v, want %v", configuration.ToolPolicy.DisallowedToolNames, test.wantDisallowed)
+			}
+			if configuration.ToolPolicy.AllowBash != test.wantAllowBash {
+				t.Fatalf("allowBash = %t, want %t", configuration.ToolPolicy.AllowBash, test.wantAllowBash)
+			}
+			gotDescriptors := make([]string, 0, len(configuration.ToolPolicy.Tools))
+			for _, descriptor := range configuration.ToolPolicy.Tools {
+				if descriptor.Source != harnessv2.MCPToolSourceProviderNative {
+					t.Fatalf("descriptor %q source = %q, want provider_native", descriptor.Name, descriptor.Source)
+				}
+				gotDescriptors = append(gotDescriptors, descriptor.Name)
+			}
+			if !slices.Equal(gotDescriptors, test.wantAllowed) {
+				t.Fatalf("provider-native descriptors = %v, want %v", gotDescriptors, test.wantAllowed)
+			}
+		})
+	}
+}
+
+func TestBuildRuntimeSessionMCPConfigurationTranslatesReadOnlyOpenCodeTools(t *testing.T) {
+	image := "docker.io/example/opencode@sha256:" + strings.Repeat("d", 64)
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "review", Namespace: "default", UID: "task-uid",
+			Annotations: map[string]string{labels.AnnotationAgentReadOnly: scheduledRunLabelValue},
+		},
+		Spec: corev1alpha1.TaskSpec{
+			Type:         corev1alpha1.TaskTypeAgent,
+			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{AllowedTools: readOnlyAgentAllowedTools()},
+			Workspace:    &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentRead},
+		},
+	}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "reviewer", Namespace: "default", UID: "agent-uid", Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model: testOpenCodeModelConfig(),
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeOpencode,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+		},
+	}
+	plan, err := PlanACPRuntime(task, agent, ACPRuntimeImages{Opencode: image})
+	if err != nil {
+		t.Fatal(err)
+	}
+	configuration, err := buildRuntimeSessionMCPConfiguration(context.Background(), nil, task, agent, plan.Profile)
+	if err != nil {
+		t.Fatalf("buildRuntimeSessionMCPConfiguration() error = %v", err)
+	}
+	if want := []string{"glob", "read"}; !slices.Equal(configuration.ToolPolicy.AllowedToolNames, want) {
+		t.Fatalf("read-only OpenCode tools = %#v, want %#v", configuration.ToolPolicy.AllowedToolNames, want)
+	}
+}
+
+func TestBuildRuntimeSessionMCPConfigurationTranslatesReadOnlyPresetPerRuntime(t *testing.T) {
+	tests := []struct {
+		name        string
+		runtime     corev1alpha1.AgentRuntimeType
+		model       *corev1alpha1.ModelConfig
+		images      ACPRuntimeImages
+		wantAllowed []string
+	}{
+		{
+			name: "claude", runtime: corev1alpha1.AgentRuntimeClaude,
+			model:       &corev1alpha1.ModelConfig{Name: "model"},
+			images:      ACPRuntimeImages{Claude: "docker.io/example/claude@sha256:" + strings.Repeat("a", 64)},
+			wantAllowed: []string{providerNativeToolGlob, providerNativeToolGrep, providerNativeToolRead},
+		},
+		{
+			name: "codex", runtime: corev1alpha1.AgentRuntimeCodex,
+			model:       &corev1alpha1.ModelConfig{Name: "model"},
+			images:      ACPRuntimeImages{Codex: "docker.io/example/codex@sha256:" + strings.Repeat("b", 64)},
+			wantAllowed: []string{providerNativeToolGlob, providerNativeToolGrep, providerNativeToolRead},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			task := &corev1alpha1.Task{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "review", Namespace: "default", UID: "task-uid",
+					Annotations: map[string]string{labels.AnnotationAgentReadOnly: scheduledRunLabelValue},
+				},
+				Spec: corev1alpha1.TaskSpec{
+					Type:         corev1alpha1.TaskTypeAgent,
+					AgentRuntime: &corev1alpha1.AgentRuntimeSpec{AllowedTools: readOnlyAgentAllowedTools()},
+					Workspace:    &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentRead},
+				},
+			}
+			agent := &corev1alpha1.Agent{
+				ObjectMeta: metav1.ObjectMeta{Name: "reviewer", Namespace: "default", UID: "agent-uid", Generation: 1},
+				Spec: corev1alpha1.AgentSpec{
+					Model: tt.model,
+					Runtime: &corev1alpha1.AgentCLIRuntime{
+						Type:            tt.runtime,
+						ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+					},
+				},
+			}
+			plan, err := PlanACPRuntime(task, agent, tt.images)
+			if err != nil {
+				t.Fatalf("PlanACPRuntime(read-only preset) error = %v", err)
+			}
+			configuration, err := buildRuntimeSessionMCPConfiguration(context.Background(), nil, task, agent, plan.Profile)
+			if err != nil {
+				t.Fatalf("buildRuntimeSessionMCPConfiguration(read-only preset) error = %v", err)
+			}
+			if !slices.Equal(configuration.ToolPolicy.AllowedToolNames, tt.wantAllowed) {
+				t.Fatalf("allowed tools = %v, want %v", configuration.ToolPolicy.AllowedToolNames, tt.wantAllowed)
+			}
+			for _, descriptor := range configuration.ToolPolicy.Tools {
+				if descriptor.Source != harnessv2.MCPToolSourceProviderNative {
+					t.Fatalf("descriptor %q source = %q, want provider_native", descriptor.Name, descriptor.Source)
+				}
+			}
+		})
+	}
+}
+
+func TestValidateACPProviderNativePolicyCodexReadOnlySurface(t *testing.T) {
+	surface := []string{providerNativeToolGlob, providerNativeToolGrep, providerNativeToolRead}
+	if err := validateACPProviderNativePolicy(
+		string(corev1alpha1.AgentRuntimeCodex), corev1alpha1.WorkspaceIntentRead, surface, nil, true,
+	); err != nil {
+		t.Fatalf("read-intent read-only surface rejected: %v", err)
+	}
+	// The same surface must stay rejected for write intent, and any other
+	// restricted shape must stay rejected for every intent.
+	if err := validateACPProviderNativePolicy(
+		string(corev1alpha1.AgentRuntimeCodex), corev1alpha1.WorkspaceIntentWrite, surface, nil, true,
+	); err == nil {
+		t.Fatal("write-intent restricted codex policy was accepted")
+	}
+	for _, allowed := range [][]string{
+		{providerNativeToolGlob, providerNativeToolRead},
+		{providerNativeToolGlob, providerNativeToolGrep, providerNativeToolRead, providerNativeToolWrite},
+		{providerNativeToolBash},
+		{},
+	} {
+		if err := validateACPProviderNativePolicy(
+			string(corev1alpha1.AgentRuntimeCodex), corev1alpha1.WorkspaceIntentRead, allowed, nil, true,
+		); err == nil {
+			t.Fatalf("restricted codex policy %v was accepted", allowed)
+		}
+	}
+	// Brokered tool names are enforced by the MCP broker and must not break
+	// the codex read-only surface (delegated children add coordination tools).
+	withBrokered := append([]string{"check_messages"}, surface...)
+	withBrokered = append(withBrokered, "send_message")
+	if err := validateACPProviderNativePolicy(
+		string(corev1alpha1.AgentRuntimeCodex), corev1alpha1.WorkspaceIntentRead, withBrokered, nil, true,
+	); err != nil {
+		t.Fatalf("read-only surface with brokered tools rejected: %v", err)
+	}
+	if err := validateACPProviderNativePolicy(
+		string(corev1alpha1.AgentRuntimeCodex), corev1alpha1.WorkspaceIntentRead, nil, nil, true,
+	); err != nil {
+		t.Fatalf("unrestricted codex policy rejected: %v", err)
+	}
+}
+
+func TestEffectiveACPAllowedToolsOnlyTranslatesReadOnlyOpenCodePreset(t *testing.T) {
+	agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+		Type: corev1alpha1.AgentRuntimeOpencode,
+	}}}
+	for _, tt := range []struct {
+		name    string
+		allowed []string
+		want    []string
+	}{
+		{name: "repository monitor preset", allowed: readOnlyAgentAllowedTools(), want: []string{providerNativeToolGlob, providerNativeToolRead}},
+		{name: "explicit deny all", allowed: []string{}, want: []string{}},
+		{name: "all blank remains deny all", allowed: []string{" "}, want: []string{}},
+		{name: "narrower glob only", allowed: []string{providerNativeToolGlob}, want: []string{providerNativeToolGlob}},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			task := &corev1alpha1.Task{
+				ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{labels.AnnotationAgentReadOnly: scheduledRunLabelValue}},
+				Spec:       corev1alpha1.TaskSpec{AgentRuntime: &corev1alpha1.AgentRuntimeSpec{AllowedTools: tt.allowed}},
+			}
+			got := effectiveACPAllowedTools(task, agent)
+			if !slices.Equal(got, tt.want) || (tt.want != nil && got == nil) {
+				t.Fatalf("effective tools = %#v, want %#v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestNormalizeACPProviderNativeToolPolicyPreservesExplicitAndUnrestrictedPolicies(t *testing.T) {
+	explicitAllowed := []string{providerNativeToolRead, "web_search"}
+	explicitDisallowed := []string{providerNativeToolWrite}
+	allowed, disallowed, allowBash := normalizeACPProviderNativeToolPolicy(
+		"claude", explicitAllowed, explicitDisallowed, false,
+	)
+	if !slices.Equal(allowed, explicitAllowed) || !slices.Equal(disallowed, explicitDisallowed) || allowBash {
+		t.Fatalf("explicit policy normalized to allowed=%v disallowed=%v allowBash=%t", allowed, disallowed, allowBash)
+	}
+
+	allowed, disallowed, allowBash = normalizeACPProviderNativeToolPolicy("copilot", nil, nil, true)
+	if allowed != nil || disallowed != nil || !allowBash {
+		t.Fatalf("unrestricted policy normalized to allowed=%v disallowed=%v allowBash=%t", allowed, disallowed, allowBash)
+	}
+
+	allowed, disallowed, allowBash = normalizeACPProviderNativeToolPolicy("claude", nil, nil, false)
+	wantBashDisabled := []string{providerNativeToolEdit, providerNativeToolGlob, providerNativeToolGrep, providerNativeToolRead, providerNativeToolWebFetch, providerNativeToolWebSearch, providerNativeToolWrite}
+	if !slices.Equal(allowed, wantBashDisabled) || disallowed != nil || allowBash {
+		t.Fatalf("bash-disabled policy normalized to allowed=%v disallowed=%v allowBash=%t", allowed, disallowed, allowBash)
+	}
+}
+
+func TestBuildRuntimeSessionMCPConfigurationDeliversCanonicalToolDescriptors(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	custom := &corev1alpha1.Tool{
+		ObjectMeta: metav1.ObjectMeta{Name: "dispatch_work", Namespace: "default"},
+		Spec: corev1alpha1.ToolSpec{
+			Description: "Dispatch a work order", BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassWrite,
+			Parameters: &apiextensionsv1.JSON{Raw: json.RawMessage(`{"type":"object","properties":{"id":{"type":"string"}}}`)},
+		},
+	}
+	reader := fake.NewClientBuilder().WithScheme(scheme).WithObjects(custom).Build()
+	allowBash := false
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "task", Namespace: "default", UID: "task-uid"},
+		Spec: corev1alpha1.TaskSpec{
+			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
+				AllowedTools: []string{"web_search", providerNativeToolRead, "dispatch_work"}, AllowBash: &allowBash,
+			},
+		},
+	}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "agent", Namespace: "default", UID: "agent-uid", Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model: &corev1alpha1.ModelConfig{Name: "model"},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeClaude,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+			Coordination: &corev1alpha1.CoordinationConfig{ApprovalRequiredTools: []string{"dispatch_work"}},
+		},
+	}
+	plan, err := PlanACPRuntime(task, agent, ACPRuntimeImages{Claude: "docker.io/example/claude@sha256:" + strings.Repeat("a", 64)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	configuration, err := buildRuntimeSessionMCPConfiguration(context.Background(), reader, task, agent, plan.Profile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := configuration.ValidateProfile(plan.Profile); err != nil {
+		t.Fatalf("ValidateProfile() error = %v", err)
+	}
+	if len(configuration.ToolPolicy.Tools) != 3 {
+		t.Fatalf("descriptor count = %d, want 3", len(configuration.ToolPolicy.Tools))
+	}
+	byName := make(map[string]harnessv2.MCPToolDescriptor, len(configuration.ToolPolicy.Tools))
+	for _, descriptor := range configuration.ToolPolicy.Tools {
+		byName[descriptor.Name] = descriptor
+	}
+	if byName[providerNativeToolRead].Source != harnessv2.MCPToolSourceProviderNative || byName[providerNativeToolRead].Effect != harnessv2.MCPToolEffectReadOnly {
+		t.Fatalf("provider-native descriptor = %#v", byName[providerNativeToolRead])
+	}
+	if byName["web_search"].Source != harnessv2.MCPToolSourceBrokeredBuiltin || byName["web_search"].Effect != harnessv2.MCPToolEffectReadOnly {
+		t.Fatalf("built-in descriptor = %#v", byName["web_search"])
+	}
+	if byName["dispatch_work"].Source != harnessv2.MCPToolSourceBrokeredCustom || byName["dispatch_work"].Effect != harnessv2.MCPToolEffectConsequential {
+		t.Fatalf("custom descriptor = %#v", byName["dispatch_work"])
+	}
+	if !configuration.ApprovalPolicy.Requires("dispatch_work") {
+		t.Fatal("custom approval-required tool was not frozen into the policy")
+	}
+	if configuration.ToolPolicy.DescriptorDigest == "" {
+		t.Fatal("descriptor digest is empty")
+	}
+	encoded, err := json.Marshal(configuration)
+	if err != nil {
+		t.Fatalf("marshal MCP configuration: %v", err)
+	}
+	var decoded harnessv2.MCPPolicyConfiguration
+	if err := json.Unmarshal(encoded, &decoded); err != nil {
+		t.Fatalf("unmarshal MCP configuration: %v", err)
+	}
+	if err := decoded.ValidateProfile(plan.Profile); err != nil {
+		t.Fatalf("JSON round-trip ValidateProfile() error = %v", err)
+	}
+}
+
+func TestBuildRuntimeSessionMCPConfigurationRejectsControllerLocalTools(t *testing.T) {
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "task", Namespace: "default", UID: "task-uid"},
+		Spec:       corev1alpha1.TaskSpec{AgentRuntime: &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"file_read"}}},
+	}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "agent", Namespace: "default", UID: "agent-uid", Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model: &corev1alpha1.ModelConfig{Name: "model"},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeClaude,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+		},
+	}
+	_, err := PlanACPRuntime(task, agent, ACPRuntimeImages{Claude: "docker.io/example/claude@sha256:" + strings.Repeat("a", 64)})
+	if err == nil || !strings.Contains(err.Error(), "local-process-only") {
+		t.Fatalf("controller-local tool error = %v", err)
+	}
+}
+
+func TestBuildRuntimeSessionMCPConfigurationClassifiesOpenCodeNativeTools(t *testing.T) {
+	requestedNativeTools := []string{"Read", "Write", "Edit", "Bash", "Glob", "Grep"}
+	nativeTools := []string{"apply_patch", "bash", "edit", "glob", "grep", "read", "write"}
+	brokeredTools := []string{"web_search", "web_fetch"}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "task", Namespace: "default", UID: "task-uid"},
+		Spec: corev1alpha1.TaskSpec{
+			Type:         corev1alpha1.TaskTypeAgent,
+			Workspace:    &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentWrite},
+			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{AllowedTools: append(append([]string(nil), requestedNativeTools...), brokeredTools...)},
+		},
+	}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "agent", Namespace: "default", UID: "agent-uid", Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model: testOpenCodeModelConfig(),
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeOpencode,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+		},
+	}
+	plan, err := PlanACPRuntime(task, agent, ACPRuntimeImages{
+		Opencode: "docker.io/example/opencode@sha256:" + strings.Repeat("a", 64),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	configuration, err := buildRuntimeSessionMCPConfiguration(context.Background(), nil, task, agent, plan.Profile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := len(nativeTools) + len(brokeredTools); len(configuration.ToolPolicy.Tools) != want {
+		t.Fatalf("descriptor count = %d, want %d", len(configuration.ToolPolicy.Tools), want)
+	}
+	byName := make(map[string]harnessv2.MCPToolDescriptor, len(configuration.ToolPolicy.Tools))
+	for _, descriptor := range configuration.ToolPolicy.Tools {
+		byName[descriptor.Name] = descriptor
+	}
+	for _, name := range nativeTools {
+		if got := byName[name].Source; got != harnessv2.MCPToolSourceProviderNative {
+			t.Fatalf("OpenCode tool %q source = %q, want provider-native", name, got)
+		}
+	}
+	for _, name := range brokeredTools {
+		if got := byName[name].Source; got != harnessv2.MCPToolSourceBrokeredBuiltin {
+			t.Fatalf("OpenCode tool %q source = %q, want brokered built-in", name, got)
+		}
+	}
+	for _, name := range []string{"read", "glob", "grep"} {
+		if got := byName[name].Effect; got != harnessv2.MCPToolEffectReadOnly {
+			t.Fatalf("OpenCode tool %q effect = %q, want read-only", name, got)
+		}
+	}
+	for _, name := range []string{"bash", "apply_patch", "edit", "write"} {
+		if got := byName[name].Effect; got != harnessv2.MCPToolEffectConsequential {
+			t.Fatalf("OpenCode tool %q effect = %q, want consequential", name, got)
+		}
+	}
+}
+
+func TestBuildRuntimeSessionMCPConfigurationNormalizesOpenCodeMutationAliases(t *testing.T) {
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "agent", Namespace: "default", UID: "agent-uid", Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model: testOpenCodeModelConfig(),
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeOpencode,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+		},
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "task", Namespace: "default", UID: "task-uid"},
+		Spec: corev1alpha1.TaskSpec{
+			Type:         corev1alpha1.TaskTypeAgent,
+			Workspace:    &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentWrite},
+			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"Edit"}},
+		},
+	}
+	images := ACPRuntimeImages{Opencode: "docker.io/example/opencode@sha256:" + strings.Repeat("a", 64)}
+	plan, err := PlanACPRuntime(task, agent, images)
+	if err != nil {
+		t.Fatal(err)
+	}
+	configuration, err := buildRuntimeSessionMCPConfiguration(context.Background(), nil, task, agent, plan.Profile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []string{"apply_patch", "edit", "write"}
+	if !slices.Equal(configuration.ToolPolicy.AllowedToolNames, want) {
+		t.Fatalf("allowed mutation aliases = %#v, want %#v", configuration.ToolPolicy.AllowedToolNames, want)
+	}
+	for _, name := range want {
+		descriptor, ok := configuration.ToolPolicy.Descriptor(name)
+		if !ok || descriptor.Source != harnessv2.MCPToolSourceProviderNative {
+			t.Fatalf("mutation alias %q descriptor = %#v, found=%v", name, descriptor, ok)
+		}
+	}
+}
+
+func TestBuildRuntimeSessionMCPConfigurationDefaultsOpenCodeToolsOnlyWhenOmitted(t *testing.T) {
+	tests := []struct {
+		name         string
+		allowedTools []string
+		want         []string
+	}{
+		{
+			name: "omitted",
+			want: []string{"apply_patch", "bash", "edit", "glob", "grep", "read", "write"},
+		},
+		{
+			name:         "explicit empty",
+			allowedTools: []string{},
+			want:         []string{},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			agent := &corev1alpha1.Agent{
+				ObjectMeta: metav1.ObjectMeta{Name: "agent", Namespace: "default", UID: "agent-uid", Generation: 1},
+				Spec: corev1alpha1.AgentSpec{
+					Model: testOpenCodeModelConfig(),
+					Runtime: &corev1alpha1.AgentCLIRuntime{
+						Type:                corev1alpha1.AgentRuntimeOpencode,
+						ContractVersion:     ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+						DefaultAllowedTools: tt.allowedTools,
+					},
+				},
+			}
+			task := &corev1alpha1.Task{
+				ObjectMeta: metav1.ObjectMeta{Name: "task", Namespace: "default", UID: "task-uid"},
+				Spec: corev1alpha1.TaskSpec{
+					Type:      corev1alpha1.TaskTypeAgent,
+					Workspace: &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentWrite},
+				},
+			}
+			images := ACPRuntimeImages{Opencode: "docker.io/example/opencode@sha256:" + strings.Repeat("a", 64)}
+			plan, err := PlanACPRuntime(task, agent, images)
+			if err != nil {
+				t.Fatal(err)
+			}
+			configuration, err := buildRuntimeSessionMCPConfiguration(context.Background(), nil, task, agent, plan.Profile)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !slices.Equal(configuration.ToolPolicy.AllowedToolNames, tt.want) {
+				t.Fatalf("allowed tools = %#v, want %#v", configuration.ToolPolicy.AllowedToolNames, tt.want)
+			}
+		})
+	}
+}
+
+func TestBuildRuntimeSessionMCPConfigurationOpenCodeReadIntentClosesConsequentialTools(t *testing.T) {
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "agent", Namespace: "default", UID: "agent-uid", Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model: testOpenCodeModelConfig(),
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:                corev1alpha1.AgentRuntimeOpencode,
+				ContractVersion:     ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+				DefaultAllowedTools: []string{"Read", "Write", "Edit", "Bash", "Glob", "Grep"},
+				DefaultAllowBash:    new(true),
+			},
+		},
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "task", Namespace: "default", UID: "task-uid"},
+		Spec: corev1alpha1.TaskSpec{
+			Type:      corev1alpha1.TaskTypeAgent,
+			Workspace: &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentRead},
+		},
+	}
+	images := ACPRuntimeImages{Opencode: "docker.io/example/opencode@sha256:" + strings.Repeat("a", 64)}
+	plan, err := PlanACPRuntime(task, agent, images)
+	if err != nil {
+		t.Fatal(err)
+	}
+	configuration, err := buildRuntimeSessionMCPConfiguration(context.Background(), nil, task, agent, plan.Profile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if configuration.ToolPolicy.AllowBash {
+		t.Fatal("read-intent OpenCode policy retained bash authority")
+	}
+	for _, name := range []string{"apply_patch", "bash", "edit", "grep", "write"} {
+		if configuration.ToolPolicy.Allows(name) {
+			t.Fatalf("read-intent OpenCode policy allows %q: %#v", name, configuration.ToolPolicy)
+		}
+	}
+	for _, name := range []string{"glob", "read"} {
+		if !configuration.ToolPolicy.Allows(name) {
+			t.Fatalf("read-intent OpenCode policy removed %q: %#v", name, configuration.ToolPolicy)
+		}
+	}
+}
+
+func TestBuildRuntimeSessionMCPConfigurationOpenCodeDenyIsCaseInsensitive(t *testing.T) {
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "agent", Namespace: "default", UID: "agent-uid", Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model: testOpenCodeModelConfig(),
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type: corev1alpha1.AgentRuntimeOpencode, DefaultAllowedTools: []string{"Read", "Bash"},
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+		},
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "task", Namespace: "default", UID: "task-uid"},
+		Spec: corev1alpha1.TaskSpec{
+			Type:      corev1alpha1.TaskTypeAgent,
+			Workspace: &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentWrite},
+			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
+				DisallowedTools: []string{"bAsH"},
+			},
+		},
+	}
+	images := ACPRuntimeImages{Opencode: "docker.io/example/opencode@sha256:" + strings.Repeat("a", 64)}
+	plan, err := PlanACPRuntime(task, agent, images)
+	if err != nil {
+		t.Fatal(err)
+	}
+	configuration, err := buildRuntimeSessionMCPConfiguration(context.Background(), nil, task, agent, plan.Profile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if configuration.ToolPolicy.Allows("bash") {
+		t.Fatalf("case-variant bash deny did not close policy: %#v", configuration.ToolPolicy)
+	}
+	if !configuration.ToolPolicy.Allows("read") {
+		t.Fatalf("read permission was unexpectedly removed: %#v", configuration.ToolPolicy)
+	}
+}
+
+func TestBuildRuntimeSessionMCPConfigurationRejectsUngovernedOpenCodeNativeTools(t *testing.T) {
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "agent", Namespace: "default", UID: "agent-uid", Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model: testOpenCodeModelConfig(),
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeOpencode,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+		},
+	}
+	for _, toolName := range []string{"task", "skill", "question", "todowrite", "WebSearch", "WebFetch"} {
+		t.Run(toolName, func(t *testing.T) {
+			task := &corev1alpha1.Task{
+				ObjectMeta: metav1.ObjectMeta{Name: "task", Namespace: "default", UID: "task-uid"},
+				Spec: corev1alpha1.TaskSpec{
+					Type:         corev1alpha1.TaskTypeAgent,
+					AgentRuntime: &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{toolName}},
+				},
+			}
+			plan, err := PlanACPRuntime(task, agent, ACPRuntimeImages{
+				Opencode: "docker.io/example/opencode@sha256:" + strings.Repeat("a", 64),
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if _, err := buildRuntimeSessionMCPConfiguration(context.Background(), nil, task, agent, plan.Profile); err == nil ||
+				!strings.Contains(err.Error(), "not a known provider-native") {
+				t.Fatalf("ungoverned OpenCode native tool error = %v, want rejection", err)
+			}
+		})
+	}
+}
+
+func TestBuildRuntimeSessionMCPConfigurationRejectsUnknownOrUngovernedTools(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	reader := fake.NewClientBuilder().WithScheme(scheme).Build()
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "task", Namespace: "default", UID: "task-uid"},
+		Spec:       corev1alpha1.TaskSpec{AgentRuntime: &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"unknown_tool"}}},
+	}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "agent", Namespace: "default", UID: "agent-uid", Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model: &corev1alpha1.ModelConfig{Name: "model"},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeClaude,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+		},
+	}
+	plan, err := PlanACPRuntime(task, agent, ACPRuntimeImages{Claude: "docker.io/example/claude@sha256:" + strings.Repeat("a", 64)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := buildRuntimeSessionMCPConfiguration(context.Background(), reader, task, agent, plan.Profile); err == nil ||
+		!strings.Contains(err.Error(), "not a known") {
+		t.Fatalf("unknown tool error = %v", err)
+	}
+
+	unclassified := &corev1alpha1.Tool{
+		ObjectMeta: metav1.ObjectMeta{Name: "unknown_tool", Namespace: "default"},
+		Spec:       corev1alpha1.ToolSpec{Description: "not governed"},
+	}
+	reader = fake.NewClientBuilder().WithScheme(scheme).WithObjects(unclassified).Build()
+	if _, err := buildRuntimeSessionMCPConfiguration(context.Background(), reader, task, agent, plan.Profile); err == nil ||
+		!strings.Contains(err.Error(), "brokeredToolClass") {
+		t.Fatalf("unclassified tool error = %v", err)
+	}
+}
+
+func TestBuildRuntimeSessionMCPConfigurationHonorsExplicitEmptyTaskOpenCodeTools(t *testing.T) {
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "agent", Namespace: "default", UID: "agent-uid", Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model: testOpenCodeModelConfig(),
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeOpencode,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+		},
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "task", Namespace: "default", UID: "task-uid"},
+		Spec: corev1alpha1.TaskSpec{
+			Type:         corev1alpha1.TaskTypeAgent,
+			Workspace:    &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentWrite},
+			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{}},
+		},
+	}
+	images := ACPRuntimeImages{Opencode: "docker.io/example/opencode@sha256:" + strings.Repeat("a", 64)}
+	plan, err := PlanACPRuntime(task, agent, images)
+	if err != nil {
+		t.Fatal(err)
+	}
+	configuration, err := buildRuntimeSessionMCPConfiguration(context.Background(), nil, task, agent, plan.Profile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if configuration.ToolPolicy.AllowedToolNames == nil || len(configuration.ToolPolicy.AllowedToolNames) != 0 {
+		t.Fatalf("allowed tools = %#v, want explicit deny-all", configuration.ToolPolicy.AllowedToolNames)
+	}
+}
+
+func TestCustomACPMCPToolDescriptorRejectsUnaccountableConsequentialTimeout(t *testing.T) {
+	newTool := func(class corev1alpha1.AgentRuntimeBrokeredToolClass, timeout time.Duration) *corev1alpha1.Tool {
+		return &corev1alpha1.Tool{
+			ObjectMeta: metav1.ObjectMeta{Name: "custom_tool", Namespace: "default"},
+			Spec: corev1alpha1.ToolSpec{
+				Description: "custom tool", BrokeredToolClass: class,
+				HTTP: &corev1alpha1.HTTPExecution{
+					URL: "https://tools.example/invoke", Method: "POST",
+					Timeout: &metav1.Duration{Duration: timeout},
+				},
+			},
+		}
+	}
+
+	_, err := customACPMCPToolDescriptor(newTool(corev1alpha1.AgentRuntimeBrokeredToolClassWrite, 10*time.Minute))
+	if err == nil || !strings.Contains(err.Error(), "exceeds the maximum brokered consequential call duration") {
+		t.Fatalf("consequential over-bound timeout error = %v, want ledger-accountability rejection", err)
+	}
+	if _, err := customACPMCPToolDescriptor(newTool(corev1alpha1.AgentRuntimeBrokeredToolClassWrite, maxACPExternalEffectCallDuration)); err != nil {
+		t.Fatalf("consequential at-bound timeout error = %v, want acceptance", err)
+	}
+	if _, err := customACPMCPToolDescriptor(newTool(corev1alpha1.AgentRuntimeBrokeredToolClassRead, 10*time.Minute)); err != nil {
+		t.Fatalf("read-only long timeout error = %v, want acceptance (read calls bypass the effect ledger)", err)
+	}
+}
diff --git a/internal/controller/acp_outbox.go b/internal/controller/acp_outbox.go
new file mode 100644
index 000000000..b8f7898d0
--- /dev/null
+++ b/internal/controller/acp_outbox.go
@@ -0,0 +1,403 @@
+package controller
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/util/retry"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	logf "sigs.k8s.io/controller-runtime/pkg/log"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+	"github.com/orka-agents/orka/internal/taskterminal"
+)
+
+func standaloneTaskTerminalProjectionID(task *corev1alpha1.Task, attempt int32) string {
+	if task == nil {
+		return ""
+	}
+	return standaloneTaskTerminalProjectionIDForUID(task.Namespace, task.UID, attempt)
+}
+
+func standaloneTaskTerminalProjectionIDForUID(namespace string, taskUID types.UID, attempt int32) string {
+	if strings.TrimSpace(namespace) == "" || taskUID == "" {
+		return ""
+	}
+	return store.CanonicalControlID("task-terminal-projection", namespace, string(taskUID), fmt.Sprint(attempt))
+}
+
+func (d *ACPDispatcher) enqueueStandaloneTaskProjection(ctx context.Context, task *corev1alpha1.Task, payload taskTerminalProjection) error {
+	return d.enqueueTaskTerminalProjection(ctx, task, payload, false)
+}
+
+func (d *ACPDispatcher) enqueueUnboundSessionTaskProjection(ctx context.Context, task *corev1alpha1.Task, payload taskTerminalProjection) error {
+	return d.enqueueTaskTerminalProjection(ctx, task, payload, true)
+}
+
+func (d *ACPDispatcher) enqueueTaskTerminalProjection(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	payload taskTerminalProjection,
+	allowSessionRef bool,
+) error {
+	if task == nil || (task.Spec.SessionRef != nil && !allowSessionRef) {
+		return nil
+	}
+	fence, err := d.Epochs.CurrentFence(ctx)
+	if err != nil {
+		return err
+	}
+	return enqueueDurableTaskTerminalProjection(ctx, d.Store, fence, task, payload)
+}
+
+func enqueueDurableTaskTerminalProjection(
+	ctx context.Context,
+	projectionStore store.OutboxProjectionStore,
+	fence store.ControllerEpochFence,
+	task *corev1alpha1.Task,
+	payload taskTerminalProjection,
+) error {
+	if task == nil {
+		return fmt.Errorf("durable Task terminal projection identity is incomplete")
+	}
+	return enqueueDurableTaskTerminalProjectionForUID(ctx, projectionStore, fence, task, task.UID, payload)
+}
+
+func enqueueDurableTaskTerminalProjectionForUID(
+	ctx context.Context,
+	projectionStore store.OutboxProjectionStore,
+	fence store.ControllerEpochFence,
+	task *corev1alpha1.Task,
+	projectionTaskUID types.UID,
+	payload taskTerminalProjection,
+) error {
+	if projectionStore == nil || task == nil || task.UID == "" || payload.Attempt < 1 {
+		return fmt.Errorf("durable Task terminal projection identity is incomplete")
+	}
+	if projectionTaskUID == "" {
+		return fmt.Errorf("durable Task terminal projection source identity is incomplete")
+	}
+	encoded, err := json.Marshal(payload)
+	if err != nil {
+		return err
+	}
+	sum := sha256.Sum256(encoded)
+	projectionTime := task.CreationTimestamp.UTC()
+	if payload.Execution.LastTransitionTime != nil && !payload.Execution.LastTransitionTime.IsZero() {
+		projectionTime = payload.Execution.LastTransitionTime.UTC()
+	} else if task.Status.CompletionTime != nil && !task.Status.CompletionTime.IsZero() {
+		projectionTime = task.Status.CompletionTime.UTC()
+	}
+	if projectionTime.IsZero() {
+		projectionTime = time.Unix(0, 0).UTC()
+	}
+	projection := &store.OutboxProjection{
+		ID:            standaloneTaskTerminalProjectionIDForUID(task.Namespace, projectionTaskUID, payload.Attempt),
+		AggregateKind: "Task", AggregateID: string(projectionTaskUID), ProjectionKind: "TaskTerminalStatus",
+		PayloadDigest: "sha256:" + hex.EncodeToString(sum[:]), Payload: encoded,
+		AvailableAt: projectionTime, CreatedAt: time.Now().UTC(),
+	}
+	if existing, getErr := projectionStore.GetOutboxProjection(ctx, projection.ID); getErr == nil {
+		return validateMatchingTaskTerminalProjection(existing, projection)
+	} else if !errors.Is(getErr, store.ErrNotFound) {
+		return getErr
+	}
+	if _, err = projectionStore.EnqueueOutboxProjection(ctx, projection, fence); err == nil {
+		return nil
+	} else if !errors.Is(err, store.ErrConflict) {
+		return err
+	}
+	existing, getErr := projectionStore.GetOutboxProjection(ctx, projection.ID)
+	if getErr != nil {
+		return errors.Join(err, getErr)
+	}
+	return validateMatchingTaskTerminalProjection(existing, projection)
+}
+
+func validateMatchingTaskTerminalProjection(existing *store.OutboxProjection, expected *store.OutboxProjection) error {
+	if existing == nil || expected == nil || existing.ID != expected.ID ||
+		existing.AggregateKind != expected.AggregateKind || existing.AggregateID != expected.AggregateID ||
+		existing.ProjectionKind != expected.ProjectionKind || existing.PayloadDigest != expected.PayloadDigest ||
+		!bytes.Equal(existing.Payload, expected.Payload) {
+		return fmt.Errorf("%w: Task terminal projection %q was reused with different payload or metadata", store.ErrConflict, expected.ID)
+	}
+	return nil
+}
+
+const (
+	defaultACPOutboxInterval = time.Second
+	defaultACPOutboxLease    = 30 * time.Second
+	defaultACPOutboxLimit    = 32
+	defaultACPOutboxAttempts = 10
+)
+
+type ACPOutboxProjector struct {
+	Client      client.Client
+	Store       store.OutboxProjectionStore
+	Epochs      *ControllerEpochManager
+	WorkerID    string
+	Interval    time.Duration
+	MaxAttempts int64
+}
+
+func (p *ACPOutboxProjector) NeedLeaderElection() bool { return true }
+
+func (p *ACPOutboxProjector) Start(ctx context.Context) error {
+	if p.Client == nil || p.Store == nil || p.Epochs == nil {
+		return fmt.Errorf("ACP outbox projector requires Kubernetes client, store, and epoch manager")
+	}
+	p.WorkerID = strings.TrimSpace(p.WorkerID)
+	if p.WorkerID == "" {
+		p.WorkerID = "acp-outbox-projector"
+	}
+	if p.Interval <= 0 {
+		p.Interval = defaultACPOutboxInterval
+	}
+	if p.MaxAttempts <= 0 {
+		p.MaxAttempts = defaultACPOutboxAttempts
+	}
+	ticker := time.NewTicker(p.Interval)
+	defer ticker.Stop()
+	for {
+		if err := p.projectOnce(ctx); err != nil && !errors.Is(err, context.Canceled) {
+			logf.FromContext(ctx).Error(err, "ACP outbox projection pass failed")
+		}
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-ticker.C:
+		}
+	}
+}
+
+func (p *ACPOutboxProjector) projectOnce(ctx context.Context) error {
+	fence, err := p.Epochs.CurrentFence(ctx)
+	if err != nil {
+		return err
+	}
+	now := time.Now().UTC()
+	projections, err := p.Store.ClaimOutboxProjections(ctx, store.ClaimOutboxProjectionsRequest{
+		Fence: fence, WorkerID: p.WorkerID, Limit: defaultACPOutboxLimit, LeaseDuration: defaultACPOutboxLease, Now: now,
+	})
+	if err != nil {
+		return err
+	}
+	for i := range projections {
+		projection := &projections[i]
+		deliveryDigest, projectErr := p.deliver(ctx, *projection)
+		state := store.OutboxProjectionDelivered
+		lastError := ""
+		availableAt := time.Time{}
+		if projectErr != nil {
+			lastError = sanitizeOutboxError(projectErr)
+			if isPermanentOutboxDeliveryError(projectErr) && projection.Attempts >= p.MaxAttempts {
+				state = store.OutboxProjectionDeadLetter
+			} else {
+				// Infrastructure failures (for example a Kubernetes control-plane
+				// outage) must stay retryable: recovery treats any existing
+				// projection as authoritative and Task deletion requires the
+				// projection to reach Delivered, so dead-lettering a transient
+				// failure would leave the Task nonterminal and undeletable.
+				state = store.OutboxProjectionPending
+				availableAt = now.Add(outboxBackoff(projection.Attempts))
+			}
+			deliveryDigest = ""
+		}
+		digest, err := acpDomainDigest("outbox-completion", map[string]any{
+			"id": projection.ID, "version": projection.Version, "state": state,
+			"deliveryDigest": deliveryDigest, "lastError": lastError, "availableAt": availableAt,
+		})
+		if err != nil {
+			return err
+		}
+		_, err = p.Store.CompleteOutboxProjection(ctx, store.CompleteOutboxProjectionRequest{
+			ID: projection.ID, Fence: fence, ExpectedVersion: projection.Version, LeaseOwner: p.WorkerID,
+			OperationID: "complete-" + fmt.Sprint(projection.Version), OperationDigest: digest,
+			NewState: state, DeliveryDigest: deliveryDigest, LastError: lastError, AvailableAt: availableAt, UpdatedAt: time.Now().UTC(),
+		})
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+type taskTerminalProjection = taskterminal.Projection
+
+// permanentOutboxDeliveryError marks delivery failures that can never succeed
+// on retry (payload corruption or identity mismatches). Only these may be
+// dead-lettered; every other failure is treated as transient infrastructure
+// trouble and stays pending so the terminal projection remains deliverable.
+type permanentOutboxDeliveryError struct{ err error }
+
+func (e *permanentOutboxDeliveryError) Error() string { return e.err.Error() }
+func (e *permanentOutboxDeliveryError) Unwrap() error { return e.err }
+
+func permanentOutboxDelivery(err error) error {
+	if err == nil {
+		return nil
+	}
+	return &permanentOutboxDeliveryError{err: err}
+}
+
+func isPermanentOutboxDeliveryError(err error) bool {
+	var permanent *permanentOutboxDeliveryError
+	return errors.As(err, &permanent)
+}
+
+func mergeTerminalExecutionStatus(existing *corev1alpha1.TaskExecutionStatus, projected corev1alpha1.TaskExecutionStatus) corev1alpha1.TaskExecutionStatus {
+	if existing == nil {
+		return projected
+	}
+	merged := *existing
+	merged.State = projected.State
+	merged.Outcome = projected.Outcome
+	if projected.Attempt > 0 {
+		merged.Attempt = projected.Attempt
+	}
+	if projected.PromptID != "" {
+		merged.PromptID = projected.PromptID
+	}
+	if projected.Reason != "" {
+		merged.Reason = projected.Reason
+	}
+	if projected.Message != "" {
+		merged.Message = projected.Message
+	}
+	return merged
+}
+
+func (p *ACPOutboxProjector) deliver(ctx context.Context, projection store.OutboxProjection) (string, error) {
+	if projection.ProjectionKind != "TaskTerminalStatus" {
+		return "", permanentOutboxDelivery(fmt.Errorf("unsupported projection kind %q", projection.ProjectionKind))
+	}
+	var payload taskTerminalProjection
+	if err := json.Unmarshal(projection.Payload, &payload); err != nil {
+		return "", permanentOutboxDelivery(fmt.Errorf("decode task terminal projection: %w", err))
+	}
+	if payload.Namespace == "" || payload.Task == "" || payload.TaskUID == "" || payload.Attempt < 1 {
+		return "", permanentOutboxDelivery(fmt.Errorf("task terminal projection identity is incomplete"))
+	}
+	key := types.NamespacedName{Namespace: payload.Namespace, Name: payload.Task}
+	var deliveredResourceVersion string
+	err := retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		task := &corev1alpha1.Task{}
+		if err := p.Client.Get(ctx, key, task); err != nil {
+			if apierrors.IsNotFound(err) {
+				deliveredResourceVersion = "deleted"
+				return nil
+			}
+			return err
+		}
+		if string(task.UID) != payload.TaskUID {
+			binding := executionBinding(task, corev1alpha1.AgentRuntimeContractHarnessV2)
+			if binding == nil || string(binding.Task.UID) != payload.TaskUID || !acpTaskUsesRestoredSourceIdentity(task) ||
+				task.Status.Execution == nil || task.Status.Execution.Attempt != payload.Attempt {
+				// Permanent so MaxAttempts applies: the bounded retries cover an
+				// in-progress restore settlement, while a Task name recreated
+				// with a different UID can never deliver and must not be
+				// claimed and retried forever.
+				return permanentOutboxDelivery(fmt.Errorf("task UID does not match outbox projection"))
+			}
+			// Clean-cluster restore settlement already patched the new Task
+			// incarnation directly. This projection remains immutable source
+			// history, so delivery is an exact no-op against the restored UID.
+			deliveredResourceVersion = task.ResourceVersion
+			return nil
+		}
+		if payload.HarnessRuntime != nil {
+			binding := task.Status.AgentExecutionBinding
+			if binding == nil || binding.ContractVersion != corev1alpha1.AgentRuntimeContractHarnessV1 ||
+				payload.BindingDigest == "" || binding.BindingDigest != payload.BindingDigest {
+				// Permanent for the same reason as the UID mismatch above: an
+				// incompatible binding cannot become deliverable, so it must
+				// dead-letter after MaxAttempts instead of retrying forever.
+				return permanentOutboxDelivery(fmt.Errorf("harness v1 task binding does not match outbox projection"))
+			}
+			if task.Status.HarnessRuntime != nil && task.Status.HarnessRuntime.Attempt > payload.Attempt {
+				deliveredResourceVersion = task.ResourceVersion
+				return nil
+			}
+			base := task.DeepCopy()
+			now := metav1.Now()
+			task.Status.Phase = payload.Phase
+			task.Status.Message = payload.Message
+			task.Status.Attempts = payload.Attempt
+			if payload.ResultRef != nil {
+				task.Status.ResultRef = payload.ResultRef.DeepCopy()
+			}
+			harnessRuntime := payload.HarnessRuntime.DeepCopy()
+			harnessRuntime.LastTransitionTime = &now
+			task.Status.HarnessRuntime = harnessRuntime
+			switch payload.Phase {
+			case corev1alpha1.TaskPhaseSucceeded, corev1alpha1.TaskPhaseFailed, corev1alpha1.TaskPhaseCancelled:
+				task.Status.CompletionTime = &now
+			default:
+				task.Status.CompletionTime = nil
+			}
+			if err := p.Client.Status().Patch(ctx, task, client.MergeFrom(base)); err != nil {
+				return err
+			}
+			deliveredResourceVersion = task.ResourceVersion
+			return nil
+		}
+		if task.Status.Execution != nil && task.Status.Execution.Attempt > payload.Attempt {
+			return fmt.Errorf("task has advanced beyond projected attempt")
+		}
+		base := task.DeepCopy()
+		now := metav1.Now()
+		task.Status.Phase = payload.Phase
+		task.Status.Message = payload.Message
+		task.Status.CompletionTime = &now
+		execution := mergeTerminalExecutionStatus(task.Status.Execution, payload.Execution)
+		execution.LastTransitionTime = &now
+		task.Status.Execution = &execution
+		if payload.Delivery != nil {
+			delivery := taskDeliveryStatusForKubernetes(task, *payload.Delivery)
+			delivery.LastTransitionTime = &now
+			task.Status.Delivery = &delivery
+		}
+		if err := p.Client.Status().Patch(ctx, task, client.MergeFrom(base)); err != nil {
+			return err
+		}
+		deliveredResourceVersion = task.ResourceVersion
+		return nil
+	})
+	if err != nil {
+		return "", err
+	}
+	return acpDomainDigest("outbox-delivery", map[string]any{
+		"projectionID": projection.ID, "payloadDigest": projection.PayloadDigest, "resourceVersion": deliveredResourceVersion,
+	})
+}
+
+func outboxBackoff(attempt int64) time.Duration {
+	if attempt < 1 {
+		attempt = 1
+	}
+	if attempt > 8 {
+		attempt = 8
+	}
+	return time.Duration(1<<uint(attempt-1)) * time.Second
+}
+
+func sanitizeOutboxError(err error) string {
+	if err == nil {
+		return ""
+	}
+	// The outbox store rejects invalid UTF-8, so repair invalid sequences and
+	// truncate on a rune boundary or the projection could never settle.
+	message := strings.ToValidUTF8(strings.TrimSpace(err.Error()), "�")
+	return truncateUTF8(message, 1024)
+}
diff --git a/internal/controller/acp_outbox_test.go b/internal/controller/acp_outbox_test.go
new file mode 100644
index 000000000..1d280f58f
--- /dev/null
+++ b/internal/controller/acp_outbox_test.go
@@ -0,0 +1,417 @@
+package controller
+
+import (
+	"context"
+	"encoding/json"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	types "k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/labels"
+	"github.com/orka-agents/orka/internal/store"
+	"github.com/orka-agents/orka/internal/store/sqlite"
+)
+
+func TestACPOutboxProjectorRepairsTerminalTaskStatus(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "task", UID: types.UID("task-uid")},
+		Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhaseRunning, Execution: &corev1alpha1.TaskExecutionStatus{
+			Attempt: 1, PromptID: "prompt-1", State: corev1alpha1.TaskExecutionStateSettling,
+			RuntimePoolName: "pool", RuntimePoolUID: "pool-uid", RuntimeInstanceID: "runtime-1",
+			RuntimeSessionUID: "session-1", RuntimeSessionGeneration: 3,
+			RequestDigest: "sha256:" + strings.Repeat("a", 64), ControllerEpoch: 7,
+			ReadCredentialResourceVersion: "11", PublicationReadCredentialResourceVersion: "12",
+			PublicationCredentialResourceVersion: "13", ForgeCredentialResourceVersion: "14",
+		}},
+	}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}).WithObjects(task).Build()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "store.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	controlStore := sqlite.NewStore(db, "test")
+	epochs := NewControllerEpochManager(controlStore, "controller")
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	fence, err := epochs.CurrentFence(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	payload, _ := json.Marshal(taskTerminalProjection{
+		Namespace: "default", Task: "task", TaskUID: "task-uid", Attempt: 1, Phase: corev1alpha1.TaskPhaseSucceeded,
+		Execution: corev1alpha1.TaskExecutionStatus{Attempt: 1, State: corev1alpha1.TaskExecutionStateSucceeded, Outcome: corev1alpha1.TaskExecutionOutcomeSucceeded},
+	})
+	projection := &store.OutboxProjection{
+		ID: store.CanonicalControlID("outbox", "turn", "TaskTerminalStatus"), AggregateKind: "SessionTurn", AggregateID: "turn",
+		ProjectionKind: "TaskTerminalStatus", Payload: payload, PayloadDigest: canonicalACPPayloadDigest(payload), AvailableAt: time.Now().UTC(),
+	}
+	if _, err := controlStore.EnqueueOutboxProjection(ctx, projection, fence); err != nil {
+		t.Fatal(err)
+	}
+	projector := &ACPOutboxProjector{Client: kubeClient, Store: controlStore, Epochs: epochs, WorkerID: "worker"}
+	if err := projector.projectOnce(ctx); err != nil {
+		t.Fatal(err)
+	}
+	updated := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: "default", Name: "task"}, updated); err != nil {
+		t.Fatal(err)
+	}
+	if updated.Status.Phase != corev1alpha1.TaskPhaseSucceeded || updated.Status.Execution.Outcome != corev1alpha1.TaskExecutionOutcomeSucceeded {
+		t.Fatalf("updated status = %#v", updated.Status)
+	}
+	gotExecution := updated.Status.Execution
+	if gotExecution.RuntimePoolUID != "pool-uid" || gotExecution.RuntimeInstanceID != "runtime-1" ||
+		gotExecution.RuntimeSessionUID != "session-1" || gotExecution.RuntimeSessionGeneration != 3 ||
+		gotExecution.ControllerEpoch != 7 || gotExecution.RequestDigest == "" ||
+		gotExecution.ReadCredentialResourceVersion != "11" || gotExecution.PublicationReadCredentialResourceVersion != "12" ||
+		gotExecution.PublicationCredentialResourceVersion != "13" || gotExecution.ForgeCredentialResourceVersion != "14" {
+		t.Fatalf("terminal projection erased execution identity: %#v", gotExecution)
+	}
+	stored, err := controlStore.GetOutboxProjection(ctx, projection.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if stored.State != store.OutboxProjectionDelivered || stored.DeliveryDigest == "" {
+		t.Fatalf("stored projection = %#v", stored)
+	}
+	cancelEpoch()
+	if err := <-epochDone; err != nil {
+		t.Fatal(err)
+	}
+}
+
+//nolint:gocyclo // This regression intentionally exercises status projection and finalizer settlement end to end.
+func TestACPNoWorkspaceTerminalProjectionSettlesStatusAndFinalizer(t *testing.T) {
+	scheme := newTestScheme()
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "default", Name: "no-workspace", UID: types.UID("no-workspace-task-uid"),
+			Finalizers: []string{labels.TaskFinalizer},
+		},
+		Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent},
+		Status: corev1alpha1.TaskStatus{
+			Phase: corev1alpha1.TaskPhaseRunning,
+			Execution: &corev1alpha1.TaskExecutionStatus{
+				Attempt: 1, PromptID: "prompt-1", State: corev1alpha1.TaskExecutionStateSettling,
+			},
+			Delivery: &corev1alpha1.TaskDeliveryStatus{
+				State: corev1alpha1.TaskDeliveryStateNotRequested, Outcome: corev1alpha1.TaskDeliveryOutcomeNotRequested,
+			},
+		},
+	}
+	kubeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithStatusSubresource(&corev1alpha1.Task{}).
+		WithObjects(task).
+		Build()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	noWorkspaceDelivery := corev1alpha1.TaskDeliveryStatus{
+		State: corev1alpha1.TaskDeliveryStateNoChange, Outcome: corev1alpha1.TaskDeliveryOutcomeNoChange,
+		StartingSHA: acpNoWorkspaceRevision,
+	}
+	workspaceTask := task.DeepCopy()
+	workspaceTask.Spec.Workspace = &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentRead}
+	if got := taskDeliveryStatusForKubernetes(workspaceTask, noWorkspaceDelivery); got.StartingSHA != acpNoWorkspaceRevision {
+		t.Fatalf("workspace delivery startingSHA = %q, want invalid sentinel preserved for API validation", got.StartingSHA)
+	}
+	dispatcher := &ACPDispatcher{Client: kubeClient}
+	if err := dispatcher.patchDeliveryStatus(ctx, task, noWorkspaceDelivery); err != nil {
+		t.Fatalf("patch no-workspace delivery status: %v", err)
+	}
+	patched := &corev1alpha1.Task{}
+	key := types.NamespacedName{Namespace: task.Namespace, Name: task.Name}
+	if err := kubeClient.Get(ctx, key, patched); err != nil {
+		t.Fatal(err)
+	}
+	if patched.Status.Delivery == nil || patched.Status.Delivery.StartingSHA != "" {
+		t.Fatalf("pre-terminal delivery status = %#v, want omitted startingSHA", patched.Status.Delivery)
+	}
+	encodedStatus, err := json.Marshal(patched.Status.Delivery)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(string(encodedStatus), `"startingSHA"`) {
+		t.Fatalf("pre-terminal delivery JSON contains unavailable startingSHA: %s", encodedStatus)
+	}
+
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "store.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	controlStore := sqlite.NewStore(db, "test")
+	epochs := NewControllerEpochManager(controlStore, "controller")
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	defer func() {
+		cancelEpoch()
+		if err := <-epochDone; err != nil {
+			t.Errorf("stop epoch manager: %v", err)
+		}
+	}()
+	fence, err := epochs.CurrentFence(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Bypass any future projection encoding normalization so this remains a
+	// regression for rows persisted by the broken controller version.
+	type legacyTaskTerminalProjection taskTerminalProjection
+	payload, err := json.Marshal(legacyTaskTerminalProjection{
+		Namespace: task.Namespace, Task: task.Name, TaskUID: string(task.UID), Attempt: 1,
+		Phase: corev1alpha1.TaskPhaseSucceeded,
+		Execution: corev1alpha1.TaskExecutionStatus{
+			Attempt: 1, PromptID: "prompt-1", State: corev1alpha1.TaskExecutionStateSucceeded,
+			Outcome: corev1alpha1.TaskExecutionOutcomeSucceeded,
+		},
+		Delivery: &noWorkspaceDelivery,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(payload), `"startingSHA":"empty"`) {
+		t.Fatalf("legacy projection payload = %s, want unavailable startingSHA sentinel", payload)
+	}
+	projection := &store.OutboxProjection{
+		ID: standaloneTaskTerminalProjectionID(task, 1), AggregateKind: "Task", AggregateID: string(task.UID),
+		ProjectionKind: "TaskTerminalStatus", Payload: payload, PayloadDigest: canonicalACPPayloadDigest(payload),
+		AvailableAt: time.Now().UTC(),
+	}
+	if _, err := controlStore.EnqueueOutboxProjection(ctx, projection, fence); err != nil {
+		t.Fatal(err)
+	}
+	projector := &ACPOutboxProjector{Client: kubeClient, Store: controlStore, Epochs: epochs, WorkerID: "worker"}
+	if err := projector.projectOnce(ctx); err != nil {
+		t.Fatal(err)
+	}
+
+	terminal := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, key, terminal); err != nil {
+		t.Fatal(err)
+	}
+	if terminal.Status.Phase != corev1alpha1.TaskPhaseSucceeded || terminal.Status.Execution == nil ||
+		terminal.Status.Execution.State != corev1alpha1.TaskExecutionStateSucceeded || terminal.Status.Delivery == nil ||
+		terminal.Status.Delivery.State != corev1alpha1.TaskDeliveryStateNoChange || terminal.Status.Delivery.StartingSHA != "" {
+		t.Fatalf("terminal no-workspace Task status = %#v", terminal.Status)
+	}
+	storedProjection, err := controlStore.GetOutboxProjection(ctx, projection.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if storedProjection.State != store.OutboxProjectionDelivered {
+		t.Fatalf("terminal projection state = %s, want %s", storedProjection.State, store.OutboxProjectionDelivered)
+	}
+
+	attemptKey := store.PromptAttemptKey{
+		Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: "prompt-1",
+	}
+	attemptID, err := attemptKey.CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	finalizerStore := &promptAttemptReclaimControlStore{
+		attempt: &store.PromptAttempt{
+			ID: attemptID, Key: attemptKey, ExecutionState: store.PromptExecutionSucceeded, DeliveryState: store.PromptDeliveryNoChange,
+		},
+		projection: &store.OutboxProjection{ID: projection.ID, State: store.OutboxProjectionDelivered},
+		reclaimed:  1,
+	}
+	if err := kubeClient.Delete(ctx, terminal); err != nil {
+		t.Fatal(err)
+	}
+	deleting := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, key, deleting); err != nil {
+		t.Fatal(err)
+	}
+	reconciler := &TaskReconciler{
+		Client: kubeClient, Scheme: scheme, DurableControlStore: finalizerStore,
+		ControllerEpochManager: readyPromptAttemptReclaimEpochManager(), EnforceNamespaceIsolation: true,
+	}
+	if _, err := reconciler.handleDeletion(ctx, deleting); err != nil {
+		t.Fatalf("settle no-workspace Task finalizer: %v", err)
+	}
+	settled := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, key, settled); err != nil {
+		if !apierrors.IsNotFound(err) {
+			t.Fatal(err)
+		}
+	} else if controllerutil.ContainsFinalizer(settled, labels.TaskFinalizer) {
+		t.Fatalf("Task finalizer remains after terminal projection settlement: %#v", settled.Finalizers)
+	}
+	if len(finalizerStore.reclaimRequests) != 1 || finalizerStore.reclaimRequests[0].TerminalProjectionID != projection.ID {
+		t.Fatalf("finalizer reclamation requests = %#v, want delivered projection %q", finalizerStore.reclaimRequests, projection.ID)
+	}
+}
+
+func TestACPOutboxProjectorAppliesHarnessV1ResultReference(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	bindingDigest := "sha256:" + strings.Repeat("a", 64)
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "task", UID: types.UID("task-uid")},
+		Status: corev1alpha1.TaskStatus{
+			Phase: corev1alpha1.TaskPhaseRunning,
+			AgentExecutionBinding: &corev1alpha1.AgentExecutionBinding{
+				ContractVersion: corev1alpha1.AgentRuntimeContractHarnessV1,
+				BindingDigest:   bindingDigest,
+			},
+		},
+	}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}).WithObjects(task).Build()
+	payload, err := json.Marshal(taskTerminalProjection{
+		Namespace: "default", Task: "task", TaskUID: "task-uid", Attempt: 1,
+		Phase: corev1alpha1.TaskPhaseSucceeded, BindingDigest: bindingDigest,
+		HarnessRuntime: &corev1alpha1.HarnessRuntimeStatus{
+			Attempt: 1, State: corev1alpha1.TaskExecutionStateSucceeded,
+			Outcome: corev1alpha1.TaskExecutionOutcomeSucceeded,
+		},
+		ResultRef: &corev1alpha1.ResultReference{Available: true},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	projection := store.OutboxProjection{
+		ID: "session-turn-projection", AggregateKind: "SessionTurn", AggregateID: "turn",
+		ProjectionKind: "TaskTerminalStatus", Payload: payload, PayloadDigest: canonicalACPPayloadDigest(payload),
+	}
+	projector := &ACPOutboxProjector{Client: kubeClient}
+	if _, err := projector.deliver(context.Background(), projection); err != nil {
+		t.Fatal(err)
+	}
+	updated := &corev1alpha1.Task{}
+	if err := kubeClient.Get(context.Background(), types.NamespacedName{Namespace: "default", Name: "task"}, updated); err != nil {
+		t.Fatal(err)
+	}
+	if updated.Status.ResultRef == nil || !updated.Status.ResultRef.Available {
+		t.Fatalf("Session outbox result reference = %#v, want available", updated.Status.ResultRef)
+	}
+}
+
+func TestACPOutboxProjectorDeliveryFailureClassification(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	validPayload, err := json.Marshal(taskTerminalProjection{
+		Namespace: "default", Task: "task", TaskUID: "task-uid", Attempt: 1, Phase: corev1alpha1.TaskPhaseSucceeded,
+		Execution: corev1alpha1.TaskExecutionStatus{Attempt: 1, State: corev1alpha1.TaskExecutionStateSucceeded, Outcome: corev1alpha1.TaskExecutionOutcomeSucceeded},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	corruptPayload := []byte(`{}`)
+	cases := []struct {
+		name      string
+		payload   []byte
+		kubeError error
+		objects   []client.Object
+		wantState store.OutboxProjectionState
+	}{
+		{
+			// A Kubernetes control-plane outage must never dead-letter the
+			// terminal projection: recovery accepts any existing projection and
+			// Task deletion requires Delivered, so the projection has to stay
+			// retryable until the API server recovers.
+			name: "infrastructure-failure-stays-pending", payload: validPayload,
+			kubeError: apierrors.NewInternalError(context.DeadlineExceeded), wantState: store.OutboxProjectionPending,
+		},
+		{
+			name: "permanent-payload-failure-dead-letters", payload: corruptPayload,
+			wantState: store.OutboxProjectionDeadLetter,
+		},
+		{
+			// A Task name recreated with a different UID (and no restored
+			// source identity) can never satisfy this projection: after
+			// MaxAttempts it must dead-letter rather than being claimed and
+			// retried forever.
+			name: "identity-mismatch-dead-letters", payload: validPayload,
+			objects: []client.Object{&corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{
+				Namespace: "default", Name: "task", UID: "recreated-uid",
+			}}},
+			wantState: store.OutboxProjectionDeadLetter,
+		},
+	}
+	for _, testCase := range cases {
+		t.Run(testCase.name, func(t *testing.T) {
+			builder := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{})
+			if len(testCase.objects) > 0 {
+				builder = builder.WithObjects(testCase.objects...)
+			}
+			if testCase.kubeError != nil {
+				builder = builder.WithInterceptorFuncs(interceptor.Funcs{
+					Get: func(context.Context, client.WithWatch, client.ObjectKey, client.Object, ...client.GetOption) error {
+						return testCase.kubeError
+					},
+				})
+			}
+			kubeClient := builder.Build()
+			db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "store.db"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer db.Close() //nolint:errcheck
+			controlStore := sqlite.NewStore(db, "test")
+			epochs := NewControllerEpochManager(controlStore, "controller")
+			epochCtx, cancelEpoch := context.WithCancel(context.Background())
+			epochDone := make(chan error, 1)
+			go func() { epochDone <- epochs.Start(epochCtx) }()
+			defer func() {
+				cancelEpoch()
+				if err := <-epochDone; err != nil {
+					t.Error(err)
+				}
+			}()
+			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+			defer cancel()
+			fence, err := epochs.CurrentFence(ctx)
+			if err != nil {
+				t.Fatal(err)
+			}
+			projection := &store.OutboxProjection{
+				ID: store.CanonicalControlID("outbox", "turn-"+testCase.name, "TaskTerminalStatus"), AggregateKind: "Task", AggregateID: "task-uid",
+				ProjectionKind: "TaskTerminalStatus", Payload: testCase.payload, PayloadDigest: canonicalACPPayloadDigest(testCase.payload), AvailableAt: time.Now().UTC(),
+			}
+			if _, err := controlStore.EnqueueOutboxProjection(ctx, projection, fence); err != nil {
+				t.Fatal(err)
+			}
+			projector := &ACPOutboxProjector{Client: kubeClient, Store: controlStore, Epochs: epochs, WorkerID: "worker", MaxAttempts: 1}
+			if err := projector.projectOnce(ctx); err != nil {
+				t.Fatal(err)
+			}
+			stored, err := controlStore.GetOutboxProjection(ctx, projection.ID)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if stored.State != testCase.wantState {
+				t.Fatalf("projection state after exhausted attempts = %s, want %s (lastError %q)", stored.State, testCase.wantState, stored.LastError)
+			}
+			if stored.LastError == "" {
+				t.Fatalf("projection last error should be recorded")
+			}
+		})
+	}
+}
diff --git a/internal/controller/acp_publication.go b/internal/controller/acp_publication.go
new file mode 100644
index 000000000..85d60aee7
--- /dev/null
+++ b/internal/controller/acp_publication.go
@@ -0,0 +1,1536 @@
+package controller
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/util/retry"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/publisher"
+	publisherservice "github.com/orka-agents/orka/internal/publisher/service"
+	"github.com/orka-agents/orka/internal/store"
+	"github.com/orka-agents/orka/internal/taskterminal"
+)
+
+const (
+	acpPublicationGeneration int64 = 1
+	acpNoWorkspaceRevision         = taskterminal.NoWorkspaceRevision
+)
+
+type acpPublicationResult struct {
+	PublicationID string
+	Status        corev1alpha1.TaskDeliveryStatus
+}
+
+// publishWorkspaceDelta runs the clean-room prepare/publish/verify transaction
+// for one immutable, already-durable workspace delta. The ACP child never
+// controls the Git repository, branch, commit, credential, or request identity
+// used by this path.
+//
+//nolint:gocyclo // The explicit state-machine branches are easier to audit together.
+func (d *ACPDispatcher) publishWorkspaceDelta(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attemptID string,
+	fence store.ControllerEpochFence,
+	baseline harnessv2.WorkspaceBaseline,
+	delta harnessv2.WorkspaceDeltaDescriptor,
+	session *acpTaskSession,
+) (acpPublicationResult, error) {
+	// The delivery context bounds the sequential pre-publish publisher stages
+	// (branch-claim refresh, preflight, prepare); the detached settlement
+	// context created after the publishing CAS separately bounds publish,
+	// verify, and PR reconciliation. Both windows budget
+	// maxSequentialPublisherSettlementStages full publisher calls.
+	deliveryCtx, cancelDelivery := context.WithTimeout(context.WithoutCancel(ctx), publicationSettlementWindow())
+	defer cancelDelivery()
+	ctx = deliveryCtx
+	if d.Publisher == nil {
+		return acpPublicationResult{}, fmt.Errorf("clean-room Workspace/Publisher is required")
+	}
+	workspace := task.Spec.Workspace
+	if workspace == nil || workspace.Intent != corev1alpha1.WorkspaceIntentWrite {
+		return acpPublicationResult{}, fmt.Errorf("non-empty workspace publication requires intent=write")
+	}
+	if delta.Artifact == nil || !delta.PublicationSafe || !delta.NoFollowVerified {
+		return acpPublicationResult{}, fmt.Errorf("workspace delta is not publication-safe")
+	}
+	relativeRoot := strings.TrimSpace(workspace.SubPath)
+	if delta.RelativeRoot != relativeRoot {
+		return acpPublicationResult{}, fmt.Errorf("workspace delta relative root does not match the Task workspace subpath")
+	}
+	if workspace.PublicationCredentialRef == nil || strings.TrimSpace(workspace.PublicationCredentialRef.Name) == "" {
+		return acpPublicationResult{}, &acpDeliveryError{
+			state: corev1alpha1.TaskDeliveryStateCredentialBlocked, outcome: corev1alpha1.TaskDeliveryOutcomeCredentialBlocked,
+			reason: "PublicationCredentialMissing", message: "write workspace requires a publication credential reference",
+		}
+	}
+	if workspace.CreatePR && (workspace.ForgeCredentialRef == nil || strings.TrimSpace(workspace.ForgeCredentialRef.Name) == "") {
+		return acpPublicationResult{}, &acpDeliveryError{
+			state: corev1alpha1.TaskDeliveryStateCredentialBlocked, outcome: corev1alpha1.TaskDeliveryOutcomeCredentialBlocked,
+			reason: "ForgeCredentialMissing", message: "pull request reconciliation requires a forge-only credential reference",
+		}
+	}
+
+	source, err := workspaceRepository(workspace)
+	if err != nil {
+		return acpPublicationResult{}, err
+	}
+	pullRequestBase := source
+	target, err := workspacePublicationRepository(workspace)
+	if err != nil {
+		return acpPublicationResult{}, err
+	}
+	if _, err := workspaceSourceRef(workspace); err != nil {
+		return acpPublicationResult{}, err
+	}
+	// Publication preparation is pinned to the verified immutable revision. The
+	// original selector may have been a bare branch or tag and is not durable
+	// enough to reconstruct later publish/verify requests safely.
+	sourceRef := baseline.Revision
+	sourceCredentialRef := workspace.ReadCredentialRef
+	sourceCredentialRole := publisherservice.CredentialRoleSourceRead
+	if session != nil && session.VerifiedBaseline != nil {
+		source = target
+		sourceRef = session.VerifiedBaseline.SHA
+		sourceCredentialRef = workspace.PublicationReadCredentialRef
+		sourceCredentialRole = publisherservice.CredentialRoleTargetRead
+	}
+	branch := publicationBranch(task, session, workspace)
+	targetRef := "refs/heads/" + branch
+	ownerKind := store.BranchClaimOwnerTask
+	ownerUID := string(task.UID)
+	sessionUID := ""
+	if session != nil {
+		ownerKind = store.BranchClaimOwnerSession
+		ownerUID = session.Binding.SessionUID
+		sessionUID = session.Binding.SessionUID
+	}
+	claimIncarnation := publicationID(task)
+	expectedRemote, err := expectedPublicationRemoteState(workspace, session, target, targetRef)
+	if err != nil {
+		return acpPublicationResult{}, err
+	}
+	currentClaimDigest, err := branchClaimRequestDigest(target.ID, targetRef, ownerKind, ownerUID, expectedRemote, claimIncarnation)
+	if err != nil {
+		return acpPublicationResult{}, err
+	}
+
+	claim, _, err := d.ensureBranchClaim(ctx, fence, target, targetRef, ownerKind, ownerUID, expectedRemote, claimIncarnation)
+	if err != nil {
+		return acpPublicationResult{}, err
+	}
+	if claim.Availability != store.BranchClaimAvailable {
+		return acpPublicationResult{}, &acpDeliveryError{
+			state: corev1alpha1.TaskDeliveryStateDeliveryConflict, outcome: corev1alpha1.TaskDeliveryOutcomeDeliveryConflict,
+			reason: "BranchClaimBlocked", message: "publication branch is reconciliation-blocked",
+		}
+	}
+
+	sourceCredential := publisherCredentialReference(sourceCredentialRef, sourceCredentialRole)
+	targetReadCredential := publisherCredentialReference(workspace.PublicationReadCredentialRef, publisherservice.CredentialRoleTargetRead)
+	writeCredential := publisherCredentialReference(workspace.PublicationCredentialRef, publisherservice.CredentialRoleTargetWrite)
+	refreshedClaim, err := d.refreshBranchClaimBaseline(ctx, task, fence, target, claim, expectedRemote, targetReadCredential)
+	if err != nil {
+		return acpPublicationResult{}, d.withUnpublishedBranchClaimCleanup(ctx, fence, claim, currentClaimDigest, publicationID(task), err)
+	}
+	claim = refreshedClaim
+	preflightOperation := publicationOperationID("preflight", task)
+	preflightRequest := publisherservice.PublicationPreflightRequest{
+		Metadata:      publisherservice.OperationMetadata{Namespace: task.Namespace, PublicationID: publicationID(task), OperationID: preflightOperation},
+		CredentialRef: targetReadCredential,
+		Request:       publisher.PreflightRequest{Target: target, Claim: publisherBranchClaim(*claim)},
+	}
+	preflightIdentity := store.ExternalEffectIdentity{
+		Kind: "publisher.preflight", Namespace: task.Namespace, AggregateID: publicationID(task), OperationID: preflightOperation,
+	}
+	preflight, err := runACPExternalEffect(ctx, d, fence, preflightIdentity, preflightRequest, func(callCtx context.Context) (publisherservice.PublicationPreflightResponse, error) {
+		return d.Publisher.PreflightPublication(callCtx, preflightRequest)
+	})
+	if err != nil {
+		if settleErr := settleACPExternalEffectError(ctx, d, fence, preflightIdentity, err); settleErr != nil {
+			return acpPublicationResult{}, d.withUnpublishedBranchClaimCleanup(
+				ctx, fence, claim, currentClaimDigest, publicationID(task), fmt.Errorf("settle failed publication preflight effect: %w", settleErr),
+			)
+		}
+		return acpPublicationResult{}, d.withUnpublishedBranchClaimCleanup(
+			ctx, fence, claim, currentClaimDigest, publicationID(task), classifyPublisherDeliveryError("PublicationPreflightFailed", err),
+		)
+	}
+	if !preflight.Result.Matches || !preflight.Result.Observed.Equal(publisherRemoteRef(claim.LastVerified)) {
+		return acpPublicationResult{}, d.withUnpublishedBranchClaimCleanup(ctx, fence, claim, currentClaimDigest, publicationID(task), &acpDeliveryError{
+			state: corev1alpha1.TaskDeliveryStateDeliveryConflict, outcome: corev1alpha1.TaskDeliveryOutcomeDeliveryConflict,
+			reason: "BranchMoved", message: "publication branch no longer matches its verified BranchClaim baseline",
+		})
+	}
+
+	publication, err := d.ensurePublication(ctx, task, attemptID, fence, sessionUID, source, sourceRef, target, targetRef, *claim, delta)
+	if err != nil {
+		durable, getErr := d.Store.GetPublication(ctx, publicationID(task))
+		switch {
+		case getErr == nil && publicationMatchesCreation(durable, task, attemptID, sessionUID, source, sourceRef, target, targetRef, claim, delta):
+			publication = durable
+		case errors.Is(getErr, store.ErrNotFound):
+			return acpPublicationResult{}, d.withUnpublishedBranchClaimCleanup(
+				ctx, fence, claim, currentClaimDigest, publicationID(task), err,
+			)
+		case getErr != nil:
+			return acpPublicationResult{}, errors.Join(err, getErr)
+		default:
+			return acpPublicationResult{}, errors.Join(err, fmt.Errorf("persisted Publication identity drifted after create error"))
+		}
+	}
+	if err := d.transitionDelivery(ctx, attemptID, fence, store.PromptDeliveryValidating, store.PromptDeliveryPreparing, "publication-preparing", ""); err != nil {
+		return acpPublicationResult{}, err
+	}
+	prepareOperation := publicationOperationID("prepare", task)
+	prepareRequest := publisherservice.PublicationPrepareRequest{
+		Metadata:            publisherservice.OperationMetadata{Namespace: task.Namespace, PublicationID: publication.ID, OperationID: prepareOperation},
+		SourceCredentialRef: sourceCredential,
+		DeltaArtifact:       *delta.Artifact,
+		Request: publisher.PrepareRequest{
+			PublicationID: publication.ID, PublicationGeneration: publication.Generation, OperationID: prepareOperation,
+			Source: source, SourceRef: sourceRef, Target: target, TargetRef: targetRef,
+			BranchClaimGeneration: claim.Generation, BaselineOID: baseline.Revision,
+			RemoteBefore: publisherRemoteRef(claim.LastVerified), DeltaArtifactDigest: delta.Artifact.Digest,
+			RelativeRoot:  delta.RelativeRoot,
+			CommitMessage: publication.CommitMessage, CommitTimestamp: publication.CommitTimestamp,
+		},
+	}
+	prepareIdentity := store.ExternalEffectIdentity{
+		Kind: "publisher.prepare", Namespace: task.Namespace, AggregateID: publication.ID, OperationID: prepareOperation,
+	}
+	preparedResponse, err := runACPExternalEffectWithRetry(ctx, d, fence, prepareIdentity, prepareRequest, func(callCtx context.Context) (publisherservice.PublicationPrepareResponse, error) {
+		return d.Publisher.PreparePublication(callCtx, prepareRequest)
+	})
+	if err != nil {
+		if settleErr := settleACPExternalEffectError(ctx, d, fence, prepareIdentity, err); settleErr != nil {
+			return acpPublicationResult{PublicationID: publication.ID}, fmt.Errorf("settle failed publication prepare effect: %w", settleErr)
+		}
+		if retryableACPExternalEffectError(err) {
+			reason := "publication preparation outcome could not be established within the reconciliation bound"
+			publicationID := publication.ID
+			if transitionErr := d.transitionPublicationTerminal(ctx, publication, fence, store.PublicationOutcomeUnknown, reason); transitionErr != nil {
+				return acpPublicationResult{PublicationID: publicationID}, transitionErr
+			}
+			publication, err = d.Store.GetPublication(ctx, publicationID)
+			if err != nil {
+				return acpPublicationResult{PublicationID: publicationID}, err
+			}
+			if transitionErr := d.transitionDelivery(ctx, attemptID, fence, store.PromptDeliveryPreparing, store.PromptDeliveryPublicationOutcomeUnknown, "publication-prepare-unknown", reason); transitionErr != nil {
+				return acpPublicationResult{PublicationID: publication.ID}, transitionErr
+			}
+			if reclaimErr := d.reclaimStandaloneTaskBranchClaim(ctx, task, attemptID, fence, publication); reclaimErr != nil {
+				return acpPublicationResult{PublicationID: publication.ID}, reclaimErr
+			}
+			return acpPublicationResult{PublicationID: publication.ID}, &acpDeliveryError{
+				state:   corev1alpha1.TaskDeliveryStatePublicationOutcomeUnknown,
+				outcome: corev1alpha1.TaskDeliveryOutcomePublicationOutcomeUnknown,
+				reason:  "PublicationPrepareOutcomeUnknown", message: reason,
+			}
+		}
+		classified := classifyPublisherDeliveryError("PublicationPrepareFailed", err)
+		terminalState := store.PublicationPreparationFailed
+		deliveryState := store.PromptDeliveryConflict
+		var deliveryErr *acpDeliveryError
+		if errors.As(classified, &deliveryErr) && deliveryErr.state == corev1alpha1.TaskDeliveryStateCredentialBlocked {
+			terminalState = store.PublicationCredentialBlocked
+			deliveryState = store.PromptDeliveryCredentialBlocked
+		}
+		publicationID := publication.ID
+		if transitionErr := d.transitionPublicationTerminal(ctx, publication, fence, terminalState, "publication preparation failed"); transitionErr != nil {
+			return acpPublicationResult{PublicationID: publicationID}, transitionErr
+		}
+		publication, err = d.Store.GetPublication(ctx, publicationID)
+		if err != nil {
+			return acpPublicationResult{PublicationID: publicationID}, err
+		}
+		if transitionErr := d.transitionDelivery(ctx, attemptID, fence, store.PromptDeliveryPreparing, deliveryState, "publication-prepare-failed", "publication preparation failed"); transitionErr != nil {
+			return acpPublicationResult{PublicationID: publication.ID}, transitionErr
+		}
+		if reclaimErr := d.reclaimStandaloneTaskBranchClaim(ctx, task, attemptID, fence, publication); reclaimErr != nil {
+			return acpPublicationResult{PublicationID: publication.ID}, reclaimErr
+		}
+		return acpPublicationResult{PublicationID: publication.ID}, classified
+	}
+	prepared, err := preparedReceiptFromPublisher(preparedResponse.Prepared)
+	if err != nil {
+		return acpPublicationResult{}, err
+	}
+	publication, err = d.transitionPublication(ctx, publication, fence, store.PublicationPrepared, prepareOperation, preparedResponse.RequestDigest, prepared, nil, nil, "")
+	if err != nil {
+		return acpPublicationResult{}, err
+	}
+
+	if err := d.transitionDelivery(ctx, attemptID, fence, store.PromptDeliveryPreparing, store.PromptDeliveryPrepared, "publication-prepared", ""); err != nil {
+		return acpPublicationResult{}, err
+	}
+
+	cancelCheckCtx, cancelCheck := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
+	cancelled, err := d.taskCancellationRequested(cancelCheckCtx, task)
+	cancelCheck()
+	if err != nil {
+		return acpPublicationResult{}, err
+	}
+	if cancelled {
+		won, cancelErr := d.cancelPreparedPublication(ctx, task)
+		if cancelErr != nil {
+			return acpPublicationResult{}, cancelErr
+		}
+		if !won {
+			return acpPublicationResult{}, fmt.Errorf("publication cancellation lost before the publishing decision was observed")
+		}
+		publication, err = d.Store.GetPublication(ctx, publication.ID)
+		if err != nil {
+			return acpPublicationResult{}, err
+		}
+		if err := d.transitionDelivery(ctx, attemptID, fence, store.PromptDeliveryPrepared, store.PromptDeliveryCancelledBeforePublish, "cancel-before-publish", ""); err != nil {
+			return acpPublicationResult{}, err
+		}
+		if err := d.reclaimStandaloneTaskBranchClaim(ctx, task, attemptID, fence, publication); err != nil {
+			return acpPublicationResult{}, err
+		}
+		return acpPublicationResult{PublicationID: publication.ID, Status: publicationTaskDeliveryStatus(workspace, baseline, delta, publication, branch)}, errACPPublicationCancelled
+	}
+
+	publication, err = d.transitionPublication(ctx, publication, fence, store.PublicationPublishing,
+		publicationOperationID("publishing", task), mustACPDomainDigest("publication-publishing", publication.ID), nil, nil, nil, "")
+	if err != nil {
+		if errors.Is(err, store.ErrConflict) {
+			latest, getErr := d.Store.GetPublication(ctx, publication.ID)
+			if getErr == nil && latest.State == store.PublicationCancelledBeforePublish {
+				if deliveryErr := d.transitionDelivery(ctx, attemptID, fence, store.PromptDeliveryPrepared, store.PromptDeliveryCancelledBeforePublish, "cancel-before-publish", ""); deliveryErr != nil {
+					return acpPublicationResult{}, deliveryErr
+				}
+				if reclaimErr := d.reclaimStandaloneTaskBranchClaim(ctx, task, attemptID, fence, latest); reclaimErr != nil {
+					return acpPublicationResult{}, reclaimErr
+				}
+				return acpPublicationResult{PublicationID: latest.ID, Status: publicationTaskDeliveryStatus(workspace, baseline, delta, latest, branch)}, errACPPublicationCancelled
+			}
+		}
+		return acpPublicationResult{}, err
+	}
+	if err := d.transitionDelivery(ctx, attemptID, fence, store.PromptDeliveryPrepared, store.PromptDeliveryPublishing, "publication-publishing", ""); err != nil {
+		return acpPublicationResult{}, err
+	}
+	// Publishing won the durable CAS. Task cancellation may be recorded by the
+	// caller, but it must not abort exact-commit publication or independent
+	// remote verification.
+	settlementCtx, cancelSettlement := context.WithTimeout(context.WithoutCancel(ctx), publicationSettlementWindow())
+	defer cancelSettlement()
+
+	publishOperation := publicationOperationID("publish", task)
+	publishRequest := publisher.PublishRequest{
+		PublicationID: publication.ID, PublicationGeneration: publication.Generation, OperationID: publishOperation,
+		Target: target, TargetRef: targetRef, Claim: publisherBranchClaim(*claim), RemoteBefore: publisherRemoteRef(claim.LastVerified),
+		ExpectedCommitOID: prepared.CommitSHA, BundleDigest: prepared.BundleDigest,
+	}
+	preparedTransport := publisherPreparedFromPublication(publication, source, target)
+	publishServiceRequest := publisherservice.PublicationPublishRequest{
+		Metadata:      publisherservice.OperationMetadata{Namespace: task.Namespace, PublicationID: publication.ID, OperationID: publishOperation},
+		CredentialRef: writeCredential, Prepared: preparedTransport, Request: publishRequest,
+	}
+	publishResponse, publishErr := runACPExternalEffect(settlementCtx, d, fence, store.ExternalEffectIdentity{
+		Kind: "publisher.publish", Namespace: task.Namespace, AggregateID: publication.ID, OperationID: publishOperation,
+	}, publishServiceRequest, func(callCtx context.Context) (publisherservice.PublicationPublishResponse, error) {
+		return d.Publisher.Publish(callCtx, publishServiceRequest)
+	})
+	publishReceipt := &store.PublishOperationReceipt{
+		OperationID: publishOperation, RequestDigest: mustACPDomainDigest("publisher-publish", publishRequest),
+		TargetRepositoryID: target.ID, TargetRef: targetRef, RemoteBefore: claim.LastVerified,
+		ExpectedCommitSHA: prepared.CommitSHA, AcknowledgementUnknown: publishErr != nil, PublishedAt: time.Now().UTC(),
+	}
+	if publishErr == nil {
+		publishReceipt.OperationID = publishResponse.Receipt.OperationID
+		publishReceipt.RequestDigest = publishResponse.Receipt.RequestDigest
+		publishReceipt.AcknowledgementUnknown = publishResponse.Receipt.Outcome == publisher.PublishOutcomeUnknown
+	}
+	publication, err = d.transitionPublication(ctx, publication, fence, store.PublicationVerifying,
+		publishReceipt.OperationID, publishReceipt.RequestDigest, nil, publishReceipt, nil, "")
+	if err != nil {
+		return acpPublicationResult{}, err
+	}
+	if err := d.transitionDelivery(ctx, attemptID, fence, store.PromptDeliveryPublishing, store.PromptDeliveryVerifying, "publication-verifying", ""); err != nil {
+		return acpPublicationResult{}, err
+	}
+
+	verifyOperation := publicationOperationID("verify", task)
+	verifyRequest := publisherservice.PublicationVerifyRequest{
+		Metadata:      publisherservice.OperationMetadata{Namespace: task.Namespace, PublicationID: publication.ID, OperationID: verifyOperation},
+		CredentialRef: targetReadCredential, Prepared: preparedTransport,
+		Request: publisher.VerifyRequest{
+			PublicationID: publication.ID, PublicationGeneration: publication.Generation, OperationID: verifyOperation,
+			Target: target, TargetRef: targetRef, Claim: publisherBranchClaim(*claim), ExpectedCommitOID: prepared.CommitSHA,
+			BundleDigest: prepared.BundleDigest,
+		},
+	}
+	verifyResponse, verifyErr := runACPExternalEffect(settlementCtx, d, fence, store.ExternalEffectIdentity{
+		Kind: "publisher.verify", Namespace: task.Namespace, AggregateID: publication.ID, OperationID: verifyOperation,
+	}, verifyRequest, func(callCtx context.Context) (publisherservice.PublicationVerifyResponse, error) {
+		return d.Publisher.Verify(callCtx, verifyRequest)
+	})
+	verification := &store.PublicationVerificationReceipt{
+		OperationID: verifyOperation, RequestDigest: mustACPDomainDigest("publisher-verify-unknown", publication.ID),
+		Outcome: store.PublicationOutcomeUnknown, ExpectedCommitSHA: prepared.CommitSHA,
+		ObservedRemote: store.RemoteRefState{}, VerifiedAt: time.Now().UTC(),
+	}
+	terminalReason := ""
+	if verifyErr == nil {
+		verification = storeVerificationReceipt(verifyResponse.Receipt)
+		switch verification.Outcome {
+		case store.PublicationDeliveryConflict:
+			terminalReason = "publication remote state conflicts with the durable BranchClaim"
+		case store.PublicationOutcomeUnknown:
+			terminalReason = "publication remote outcome could not be independently observed"
+		}
+	} else {
+		terminalReason = "publication remote outcome could not be independently observed"
+		if err := settleACPExternalEffect(settlementCtx, d, fence, store.ExternalEffectIdentity{
+			Kind: "publisher.verify", Namespace: task.Namespace, AggregateID: publication.ID, OperationID: verifyOperation,
+		}, store.ExternalEffectOutcomeUnknown, nil); err != nil {
+			return acpPublicationResult{}, err
+		}
+	}
+	if publishErr != nil {
+		publishIdentity := store.ExternalEffectIdentity{Kind: "publisher.publish", Namespace: task.Namespace, AggregateID: publication.ID, OperationID: publishOperation}
+		if verification.Outcome == store.PublicationVerifiedExact || verification.Outcome == store.PublicationDeliveredSuperseded {
+			reconciled := publisherservice.PublicationPublishResponse{
+				OperationID: publishOperation, RequestDigest: publishReceipt.RequestDigest,
+				Receipt: publisher.PublishReceipt{
+					PublicationID: publication.ID, PublicationGeneration: publication.Generation,
+					OperationID: publishOperation, RequestDigest: publishReceipt.RequestDigest, Outcome: publisher.PublishAcknowledged,
+					TargetRepositoryID: target.ID, TargetRef: targetRef, RemoteBefore: publisherRemoteRef(claim.LastVerified),
+					ExpectedCommitOID: prepared.CommitSHA, ObservedRemote: publisher.RemoteRef{OID: prepared.CommitSHA},
+				},
+			}
+			if err := settleACPExternalEffect(settlementCtx, d, fence, publishIdentity, store.ExternalEffectSucceeded, reconciled); err != nil {
+				return acpPublicationResult{}, err
+			}
+		} else if err := settleACPExternalEffect(settlementCtx, d, fence, publishIdentity, store.ExternalEffectOutcomeUnknown, nil); err != nil {
+			return acpPublicationResult{}, err
+		}
+	}
+	var prReceipt *corev1alpha1.TaskPullRequestReceipt
+	if verifyErr == nil && workspace.CreatePR &&
+		(verification.Outcome == store.PublicationVerifiedExact || verification.Outcome == store.PublicationDeliveredSuperseded) {
+		if publication.PRIntent == nil {
+			baseRef, baseErr := canonicalWorkspaceBranchRef(workspace.PRBaseBranch)
+			if baseErr != nil {
+				return acpPublicationResult{}, baseErr
+			}
+			intent := store.PullRequestIntent{
+				BaseRepositoryID: pullRequestBase.ID, BaseRef: baseRef, HeadRepositoryID: target.ID, HeadRef: targetRef,
+				PublicationGeneration: publication.Generation, ExpectedHeadSHA: verification.ObservedRemote.SHA,
+			}
+			intentOperation := publicationOperationID("pr-intent", task)
+			intentDigest, digestErr := acpDomainDigest("publication-pr-intent", map[string]any{"publicationID": publication.ID, "intent": intent})
+			if digestErr != nil {
+				return acpPublicationResult{}, digestErr
+			}
+			publication, err = d.Store.SetPublicationPRIntent(settlementCtx, store.SetPublicationPRIntentRequest{
+				ID: publication.ID, Fence: fence, ExpectedVersion: publication.Version, ExpectedGeneration: publication.Generation,
+				ExpectedState: store.PublicationVerifying, Intent: intent, OperationID: intentOperation,
+				OperationDigest: intentDigest, UpdatedAt: time.Now().UTC(),
+			})
+			if err != nil {
+				return acpPublicationResult{}, err
+			}
+		}
+		forgeIntent := publisher.PullRequestIntent{
+			BaseRepository: pullRequestBase, BaseRef: publication.PRIntent.BaseRef,
+			HeadRepository: target, HeadRef: publication.PRIntent.HeadRef,
+			PublicationGeneration: publication.Generation, ExpectedHeadOID: publication.PRIntent.ExpectedHeadSHA,
+		}
+		prOperation := publicationOperationID("pr-reconcile", task)
+		prRequest := publisherservice.PullRequestReconcileRequest{
+			Metadata:      publisherservice.OperationMetadata{Namespace: task.Namespace, PublicationID: publication.ID, OperationID: prOperation},
+			CredentialRef: publisherForgeCredentialReference(workspace.ForgeCredentialRef),
+			Intent:        forgeIntent,
+		}
+		prResponse, prErr := runACPExternalEffect(settlementCtx, d, fence, store.ExternalEffectIdentity{
+			Kind: "publisher.pull-request", Namespace: task.Namespace, AggregateID: publication.ID, OperationID: prOperation,
+		}, prRequest, func(callCtx context.Context) (publisherservice.PullRequestReconcileResponse, error) {
+			return d.Publisher.ReconcilePullRequest(callCtx, prRequest)
+		})
+		if prErr != nil {
+			if err := settleACPExternalEffect(settlementCtx, d, fence, store.ExternalEffectIdentity{
+				Kind: "publisher.pull-request", Namespace: task.Namespace, AggregateID: publication.ID, OperationID: prOperation,
+			}, store.ExternalEffectOutcomeUnknown, nil); err != nil {
+				return acpPublicationResult{}, err
+			}
+			verification = &store.PublicationVerificationReceipt{
+				OperationID: verifyOperation, RequestDigest: mustACPDomainDigest("publisher-pr-unknown", publication.ID),
+				Outcome: store.PublicationOutcomeUnknown, ExpectedCommitSHA: prepared.CommitSHA,
+				ObservedRemote: store.RemoteRefState{}, VerifiedAt: time.Now().UTC(),
+			}
+			terminalReason = "pull request reconciliation outcome could not be established"
+		} else {
+			storedReceipt := store.PullRequestOperationReceipt{
+				OperationID: prResponse.OperationID, RequestDigest: prResponse.RequestDigest,
+				IntentKey: prResponse.Receipt.IntentKey, ForgeID: prResponse.Receipt.ForgeID,
+				URL: prResponse.Receipt.URL, State: string(prResponse.Receipt.State), HeadSHA: prResponse.Receipt.HeadOID,
+				ReconciledAt: time.Now().UTC(),
+			}
+			receiptOperation := publicationOperationID("pr-receipt", task)
+			receiptDigest, digestErr := acpDomainDigest("publication-pr-receipt", map[string]any{"publicationID": publication.ID, "receipt": storedReceipt})
+			if digestErr != nil {
+				return acpPublicationResult{}, digestErr
+			}
+			publication, err = d.Store.SetPublicationPRReceipt(settlementCtx, store.SetPublicationPRReceiptRequest{
+				ID: publication.ID, Fence: fence, ExpectedVersion: publication.Version, ExpectedGeneration: publication.Generation,
+				ExpectedState: store.PublicationVerifying, Receipt: storedReceipt,
+				OperationID: receiptOperation, OperationDigest: receiptDigest, UpdatedAt: storedReceipt.ReconciledAt,
+			})
+			if err != nil {
+				return acpPublicationResult{}, err
+			}
+			prReceipt = taskPullRequestReceipt(prResponse.Receipt, workspace, branch)
+		}
+	}
+	publication, err = d.transitionPublication(ctx, publication, fence, verification.Outcome,
+		verification.OperationID, verification.RequestDigest, nil, nil, verification, terminalReason)
+	if err != nil {
+		return acpPublicationResult{}, err
+	}
+	if err := d.transitionDelivery(ctx, attemptID, fence, store.PromptDeliveryVerifying, promptDeliveryForPublication(publication.State),
+		"publication-verified", terminalReason); err != nil {
+		return acpPublicationResult{}, err
+	}
+
+	status := publicationTaskDeliveryStatus(workspace, baseline, delta, publication, branch)
+	status.PRReceipt = prReceipt
+	if cancelledAfterPublish, cancelErr := d.taskCancellationRequested(settlementCtx, task); cancelErr == nil && cancelledAfterPublish {
+		status.Reason = corev1alpha1.TaskDeliveryReasonCancellationRequestedAfterPublish
+		status.Message = "cancellation was requested after publication won the durable CAS; delivery reconciliation completed"
+	}
+	result := acpPublicationResult{PublicationID: publication.ID, Status: status}
+	if err := d.reclaimStandaloneTaskBranchClaim(ctx, task, attemptID, fence, publication); err != nil {
+		return acpPublicationResult{}, err
+	}
+	switch publication.State {
+	case store.PublicationVerifiedExact, store.PublicationDeliveredSuperseded:
+		return result, nil
+	case store.PublicationDeliveryConflict:
+		return result, &acpDeliveryError{state: status.State, outcome: status.Outcome, reason: "DeliveryConflict", message: "publication remote verification found a conflicting branch state"}
+	default:
+		return result, &acpDeliveryError{state: status.State, outcome: status.Outcome, reason: "PublicationOutcomeUnknown", message: "publication outcome remains unknown after bounded verification"}
+	}
+}
+
+func canonicalWorkspaceBranchRef(branch string) (string, error) {
+	branch = strings.TrimSpace(branch)
+	if strings.HasPrefix(branch, "refs/heads/") {
+		if err := store.ValidateFullBranchRef(branch); err != nil {
+			return "", err
+		}
+		return branch, nil
+	}
+	ref := "refs/heads/" + branch
+	if err := store.ValidateFullBranchRef(ref); err != nil {
+		return "", err
+	}
+	return ref, nil
+}
+
+func taskPullRequestReceipt(receipt publisher.PullRequestReceipt, workspace *corev1alpha1.WorkspaceConfig, headBranch string) *corev1alpha1.TaskPullRequestReceipt {
+	result := &corev1alpha1.TaskPullRequestReceipt{
+		ID: receipt.ForgeID, URL: receipt.URL, State: string(receipt.State),
+		BaseBranch: strings.TrimPrefix(workspace.PRBaseBranch, "refs/heads/"), HeadBranch: headBranch, HeadSHA: receipt.HeadOID,
+	}
+	if number, ok := pullRequestNumberFromForgeID(receipt.ForgeID); ok {
+		result.Number = number
+	}
+	return result
+}
+
+func pullRequestNumberFromForgeID(forgeID string) (int64, bool) {
+	parts := strings.Split(strings.TrimSpace(forgeID), ":")
+	if len(parts) < 3 || parts[0] != "github" {
+		return 0, false
+	}
+	// Parse with bitSize 32 so the number always fits platform int; real forge
+	// pull-request numbers never exceed that bound, and anything larger is an
+	// invalid forge identity.
+	number, err := strconv.ParseInt(parts[len(parts)-1], 10, 32)
+	return number, err == nil && number > 0
+}
+
+var errACPPublicationCancelled = errors.New("publication cancelled before publish")
+
+type acpDeliveryError struct {
+	state   corev1alpha1.TaskDeliveryState
+	outcome corev1alpha1.TaskDeliveryOutcome
+	reason  corev1alpha1.TaskDeliveryReason
+	message string
+}
+
+func (e *acpDeliveryError) Error() string { return e.message }
+
+func (d *ACPDispatcher) terminalizeDeliveryError(ctx context.Context, attemptID string, fence store.ControllerEpochFence, status corev1alpha1.TaskDeliveryStatus) error {
+	attempt, err := d.Store.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		return err
+	}
+	if store.IsTerminalPromptDeliveryState(attempt.DeliveryState) {
+		return nil
+	}
+	target := store.PromptDeliveryConflict
+	switch status.State {
+	case corev1alpha1.TaskDeliveryStateCredentialBlocked:
+		target = store.PromptDeliveryCredentialBlocked
+	case corev1alpha1.TaskDeliveryStatePublicationOutcomeUnknown:
+		target = store.PromptDeliveryPublicationOutcomeUnknown
+	}
+	if err := store.ValidatePromptDeliveryTransition(attempt.DeliveryState, target); err != nil {
+		return err
+	}
+	return d.transitionDelivery(ctx, attemptID, fence, attempt.DeliveryState, target, "publication-terminal-error", status.Message)
+}
+
+func classifyPublisherDeliveryError(reason string, err error) error {
+	state := corev1alpha1.TaskDeliveryStateDeliveryConflict
+	outcome := corev1alpha1.TaskDeliveryOutcomeDeliveryConflict
+	var clientErr *publisherservice.ClientError
+	if errors.As(err, &clientErr) && (clientErr.StatusCode == 401 || clientErr.StatusCode == 403 || strings.Contains(clientErr.Response.Code, "credential")) {
+		state = corev1alpha1.TaskDeliveryStateCredentialBlocked
+		outcome = corev1alpha1.TaskDeliveryOutcomeCredentialBlocked
+	}
+	return &acpDeliveryError{state: state, outcome: outcome, reason: corev1alpha1.TaskDeliveryReason(reason), message: err.Error()}
+}
+
+func (d *ACPDispatcher) refreshBranchClaimBaseline(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	fence store.ControllerEpochFence,
+	target publisher.Repository,
+	claim *store.BranchClaim,
+	expected store.RemoteRefState,
+	credential *publisherservice.CredentialReference,
+) (*store.BranchClaim, error) {
+	if claim.LastVerified.Equal(expected) {
+		return claim, nil
+	}
+	probe := *claim
+	probe.LastVerified = expected
+	operationID := publicationOperationID("claim-refresh", task)
+	request := publisherservice.PublicationPreflightRequest{
+		Metadata:      publisherservice.OperationMetadata{Namespace: task.Namespace, PublicationID: publicationID(task), OperationID: operationID},
+		CredentialRef: credential,
+		Request:       publisher.PreflightRequest{Target: target, Claim: publisherBranchClaim(probe)},
+	}
+	identity := store.ExternalEffectIdentity{Kind: "publisher.claim-refresh", Namespace: task.Namespace, AggregateID: publicationID(task), OperationID: operationID}
+	response, err := runACPExternalEffect(ctx, d, fence, identity, request, func(callCtx context.Context) (publisherservice.PublicationPreflightResponse, error) {
+		return d.Publisher.PreflightPublication(callCtx, request)
+	})
+	if err != nil {
+		if settleErr := settleACPExternalEffectError(ctx, d, fence, identity, err); settleErr != nil {
+			return nil, fmt.Errorf("settle branch-claim refresh effect: %w", settleErr)
+		}
+		return nil, classifyPublisherDeliveryError("BranchClaimRefreshFailed", err)
+	}
+	if !response.Result.Matches || !response.Result.Observed.Equal(publisherRemoteRef(expected)) {
+		return nil, &acpDeliveryError{
+			state: corev1alpha1.TaskDeliveryStateDeliveryConflict, outcome: corev1alpha1.TaskDeliveryOutcomeDeliveryConflict,
+			reason: "BranchMoved", message: "publication branch does not match the requested exact remote head",
+		}
+	}
+	digest := mustACPDomainDigest("branch-claim-refresh", map[string]any{"claim": claim.ID, "from": claim.LastVerified, "to": expected, "task": task.UID})
+	updated, err := d.Store.CompareAndSwapBranchClaim(ctx, store.BranchClaimCAS{
+		ID: claim.ID, Fence: fence,
+		ExpectedVersion: claim.Version, ExpectedGeneration: claim.Generation, NewGeneration: claim.Generation,
+		ExpectedLastVerified: claim.LastVerified, NewLastVerified: expected,
+		ExpectedAvailability: claim.Availability, NewAvailability: store.BranchClaimAvailable,
+		OperationID: operationID, OperationDigest: digest, UpdatedAt: time.Now().UTC(),
+	})
+	if err != nil {
+		return nil, err
+	}
+	return updated, nil
+}
+
+func expectedPublicationRemoteState(
+	workspace *corev1alpha1.WorkspaceConfig,
+	session *acpTaskSession,
+	target publisher.Repository,
+	targetRef string,
+) (store.RemoteRefState, error) {
+	if session != nil && session.VerifiedBaseline != nil {
+		baseline := session.VerifiedBaseline
+		if err := validateSessionExpectedRemoteSHA(workspace, baseline); err != nil {
+			return store.RemoteRefState{}, err
+		}
+		if !sameWorkspaceRepositoryIdentity(baseline.RepositoryID, target.ID) || baseline.Ref != targetRef {
+			return store.RemoteRefState{}, fmt.Errorf("verified session baseline does not match the publication target")
+		}
+		return store.RemoteRefState{SHA: baseline.SHA}, nil
+	}
+	if workspace != nil && strings.TrimSpace(workspace.ExpectedRemoteSHA) != "" {
+		return store.RemoteRefState{SHA: strings.TrimSpace(workspace.ExpectedRemoteSHA)}, nil
+	}
+	return store.RemoteRefState{Absent: true}, nil
+}
+
+func (d *ACPDispatcher) ensureBranchClaim(
+	ctx context.Context,
+	fence store.ControllerEpochFence,
+	target publisher.Repository,
+	targetRef string,
+	ownerKind store.BranchClaimOwnerKind,
+	ownerUID string,
+	expected store.RemoteRefState,
+	incarnation string,
+) (*store.BranchClaim, bool, error) {
+	id, err := store.CanonicalBranchClaimID(target.ID, targetRef)
+	if err != nil {
+		return nil, false, err
+	}
+	digest, err := branchClaimRequestDigest(target.ID, targetRef, ownerKind, ownerUID, expected, incarnation)
+	if err != nil {
+		return nil, false, err
+	}
+	legacyDigest, err := legacyBranchClaimRequestDigest(target.ID, targetRef, ownerKind, ownerUID, expected)
+	if err != nil {
+		return nil, false, err
+	}
+	existing, err := d.Store.GetBranchClaim(ctx, id)
+	if err == nil {
+		if existing.RepositoryID != target.ID || existing.Ref != targetRef || existing.OwnerKind != ownerKind || existing.OwnerUID != ownerUID {
+			return nil, false, fmt.Errorf("publication branch is already claimed by a different owner")
+		}
+		if ownerKind == store.BranchClaimOwnerTask && existing.RequestDigest != digest {
+			if existing.RequestDigest != legacyDigest || !d.persistedPublicationOwnsLegacyClaim(ctx, incarnation, existing, expected) {
+				return nil, false, fmt.Errorf("publication branch is already claimed by a different owner")
+			}
+		}
+		return existing, false, nil
+	}
+	if !errors.Is(err, store.ErrNotFound) {
+		return nil, false, err
+	}
+	request := &store.BranchClaim{
+		ID: id, RepositoryID: target.ID, Ref: targetRef, OwnerKind: ownerKind, OwnerUID: ownerUID,
+		Generation: 1, LastVerified: expected, Availability: store.BranchClaimAvailable,
+		RequestDigest: digest, CreatedAt: time.Now().UTC(),
+	}
+	if creator, ok := d.Store.(store.BranchClaimCreationStore); ok {
+		return creator.CreateBranchClaimWithResult(ctx, request, fence)
+	}
+	claim, err := d.Store.CreateBranchClaim(ctx, request, fence)
+	return claim, false, err
+}
+
+func (d *ACPDispatcher) persistedPublicationOwnsLegacyClaim(
+	ctx context.Context,
+	publicationID string,
+	claim *store.BranchClaim,
+	expected store.RemoteRefState,
+) bool {
+	if claim == nil || strings.TrimSpace(publicationID) == "" {
+		return false
+	}
+	publication, err := d.Store.GetPublication(ctx, publicationID)
+	if err != nil {
+		return false
+	}
+	return publication.ID == publicationID && publication.TaskUID == claim.OwnerUID &&
+		publication.BranchClaimID == claim.ID && publication.BranchClaimGeneration == claim.Generation &&
+		publication.TargetRepositoryID == claim.RepositoryID && publication.TargetRef == claim.Ref &&
+		publication.Baseline.Equal(expected)
+}
+
+func (d *ACPDispatcher) withUnpublishedBranchClaimCleanup(
+	ctx context.Context,
+	fence store.ControllerEpochFence,
+	claim *store.BranchClaim,
+	expectedRequestDigest string,
+	publicationID string,
+	cause error,
+) error {
+	if claim == nil || claim.RequestDigest != expectedRequestDigest {
+		return cause
+	}
+	if _, err := d.Store.GetPublication(ctx, publicationID); err == nil {
+		return cause
+	} else if !errors.Is(err, store.ErrNotFound) {
+		return errors.Join(cause, fmt.Errorf("check unpublished branch claim: %w", err))
+	}
+	cleanupErr := d.Store.ReclaimBranchClaim(ctx, store.ReclaimBranchClaimRequest{
+		ID: claim.ID, Fence: fence, ExpectedVersion: claim.Version, ExpectedGeneration: claim.Generation,
+		ExpectedRepositoryID: claim.RepositoryID, ExpectedRef: claim.Ref,
+		ExpectedOwnerKind: claim.OwnerKind, ExpectedOwnerUID: claim.OwnerUID,
+		ExpectedLastVerified: claim.LastVerified, ExpectedAvailability: claim.Availability,
+		ExpectedRequestDigest: claim.RequestDigest,
+	})
+	if cleanupErr != nil {
+		return errors.Join(cause, fmt.Errorf("reclaim unpublished branch claim: %w", cleanupErr))
+	}
+	return cause
+}
+
+func branchClaimRequestDigest(
+	repositoryID, ref string,
+	ownerKind store.BranchClaimOwnerKind,
+	ownerUID string,
+	expected store.RemoteRefState,
+	incarnation string,
+) (string, error) {
+	payload := map[string]any{
+		"repository": repositoryID,
+		"ref":        ref,
+		"ownerKind":  ownerKind,
+		"ownerUID":   ownerUID,
+		"expected":   expected,
+	}
+	if strings.TrimSpace(incarnation) == "" {
+		if ownerKind == store.BranchClaimOwnerTask {
+			return "", fmt.Errorf("task-owned branch claim requires an immutable incarnation")
+		}
+	} else {
+		payload["incarnation"] = incarnation
+	}
+	return acpDomainDigest("branch-claim", payload)
+}
+
+func legacyBranchClaimRequestDigest(
+	repositoryID, ref string,
+	ownerKind store.BranchClaimOwnerKind,
+	ownerUID string,
+	expected store.RemoteRefState,
+) (string, error) {
+	return acpDomainDigest("branch-claim", map[string]any{
+		"repository": repositoryID,
+		"ref":        ref,
+		"ownerKind":  ownerKind,
+		"ownerUID":   ownerUID,
+		"expected":   expected,
+	})
+}
+
+func (d *ACPDispatcher) ensurePublication(ctx context.Context, task *corev1alpha1.Task, attemptID string, fence store.ControllerEpochFence, sessionUID string, source publisher.Repository, sourceRef string, target publisher.Repository, targetRef string, claim store.BranchClaim, delta harnessv2.WorkspaceDeltaDescriptor) (*store.Publication, error) {
+	id := publicationID(task)
+	commitAt := task.CreationTimestamp.Time.UTC().Truncate(time.Second)
+	if commitAt.IsZero() {
+		commitAt = time.Now().UTC().Truncate(time.Second)
+	}
+	message := "orka: apply agent task " + task.Name + "\n"
+	requestDigest, err := acpDomainDigest("publication", map[string]any{
+		"id": id, "attemptID": attemptID, "source": source, "sourceRef": sourceRef, "target": target,
+		"targetRef": targetRef, "branchClaim": claim.ID, "branchClaimGeneration": claim.Generation,
+		"baseline": claim.LastVerified, "artifactDigest": delta.Artifact.Digest, "relativeRoot": delta.RelativeRoot,
+		"commitMessage": message, "commitTimestamp": commitAt,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return d.Store.CreatePublication(ctx, &store.Publication{
+		ID: id, Namespace: task.Namespace, Generation: acpPublicationGeneration,
+		TaskUID: string(task.UID), Attempt: int64(task.Status.Execution.Attempt), PromptID: task.Status.Execution.PromptID,
+		SessionUID: sessionUID, BranchClaimID: claim.ID, BranchClaimGeneration: claim.Generation,
+		SourceRepositoryID: source.ID, SourceRef: sourceRef, SourceBaselineSHA: delta.VerifiedBaseline.Revision,
+		TargetRepositoryID: target.ID, TargetRef: targetRef,
+		Baseline: claim.LastVerified, ArtifactID: string(delta.Artifact.ArtifactID), ArtifactDigest: delta.Artifact.Digest,
+		ArtifactSizeBytes: delta.Artifact.SizeBytes, ArtifactMediaType: delta.Artifact.MediaType,
+		PublicationCredentialRef: task.Spec.Workspace.PublicationCredentialRef.Name,
+		CommitIdentity:           publisher.CommitAuthorName + " <" + publisher.CommitAuthorEmail + ">",
+		CommitMessage:            message, CommitTimestamp: commitAt, RequestDigest: requestDigest, CreatedAt: time.Now().UTC(),
+	}, fence)
+}
+
+//nolint:gocyclo // Ambiguous-create recovery intentionally compares the complete immutable Publication identity in one audit point.
+func publicationMatchesCreation(
+	publication *store.Publication,
+	task *corev1alpha1.Task,
+	attemptID string,
+	sessionUID string,
+	source publisher.Repository,
+	sourceRef string,
+	target publisher.Repository,
+	targetRef string,
+	claim *store.BranchClaim,
+	delta harnessv2.WorkspaceDeltaDescriptor,
+) bool {
+	if publication == nil || task == nil || task.Status.Execution == nil || claim == nil || delta.Artifact == nil {
+		return false
+	}
+	commitAt := publication.CommitTimestamp
+	if !task.CreationTimestamp.IsZero() {
+		expectedCommitAt := task.CreationTimestamp.Time.UTC().Truncate(time.Second)
+		if !commitAt.Equal(expectedCommitAt) {
+			return false
+		}
+	}
+	message := "orka: apply agent task " + task.Name + "\n"
+	expectedDigest, err := acpDomainDigest("publication", map[string]any{
+		"id": publicationIDForTask(task), "attemptID": attemptID, "source": source, "sourceRef": sourceRef, "target": target,
+		"targetRef": targetRef, "branchClaim": claim.ID, "branchClaimGeneration": claim.Generation,
+		"baseline": claim.LastVerified, "artifactDigest": delta.Artifact.Digest, "relativeRoot": delta.RelativeRoot,
+		"commitMessage": message, "commitTimestamp": commitAt,
+	})
+	if err != nil {
+		return false
+	}
+	credentialName := ""
+	if task.Spec.Workspace != nil && task.Spec.Workspace.PublicationCredentialRef != nil {
+		credentialName = strings.TrimSpace(task.Spec.Workspace.PublicationCredentialRef.Name)
+	}
+	return publication.ID == publicationIDForTask(task) && publication.Namespace == task.Namespace &&
+		publication.Generation == acpPublicationGeneration &&
+		publication.TaskUID == string(task.UID) && publication.Attempt == int64(task.Status.Execution.Attempt) &&
+		publication.PromptID == task.Status.Execution.PromptID && publication.SessionUID == sessionUID &&
+		publication.BranchClaimID == claim.ID && publication.BranchClaimGeneration == claim.Generation &&
+		publication.SourceRepositoryID == source.ID && publication.SourceRef == sourceRef &&
+		publication.TargetRepositoryID == target.ID && publication.TargetRef == targetRef &&
+		publication.SourceBaselineSHA == delta.VerifiedBaseline.Revision && publication.Baseline.Equal(claim.LastVerified) &&
+		publication.ArtifactID == string(delta.Artifact.ArtifactID) &&
+		publication.ArtifactDigest == delta.Artifact.Digest && publication.ArtifactSizeBytes == delta.Artifact.SizeBytes &&
+		publication.ArtifactMediaType == delta.Artifact.MediaType && publication.PublicationCredentialRef == credentialName &&
+		publication.CommitIdentity == publisher.CommitAuthorName+" <"+publisher.CommitAuthorEmail+">" &&
+		publication.CommitMessage == message && publication.RequestDigest == expectedDigest
+}
+
+func (d *ACPDispatcher) transitionPublication(ctx context.Context, publication *store.Publication, fence store.ControllerEpochFence, state store.PublicationState, operationID, operationDigest string, prepared *store.PreparedPublicationReceipt, published *store.PublishOperationReceipt, verified *store.PublicationVerificationReceipt, reason string) (*store.Publication, error) {
+	return d.Store.TransitionPublication(ctx, store.PublicationTransition{
+		ID: publication.ID, Fence: fence, ExpectedVersion: publication.Version, ExpectedGeneration: publication.Generation,
+		ExpectedState: publication.State, NewState: state, OperationID: operationID, OperationDigest: operationDigest,
+		PreparedReceipt: prepared, PublishReceipt: published, VerificationReceipt: verified,
+		TerminalReason: reason, UpdatedAt: time.Now().UTC(),
+	})
+}
+
+func (d *ACPDispatcher) transitionPublicationTerminal(ctx context.Context, publication *store.Publication, fence store.ControllerEpochFence, state store.PublicationState, reason string) error {
+	_, err := d.transitionPublication(ctx, publication, fence, state, publicationOperationID("terminal", nil), mustACPDomainDigest("publication-terminal", map[string]any{"id": publication.ID, "state": state}), nil, nil, nil, reason)
+	return err
+}
+
+func (d *ACPDispatcher) taskCancellationRequested(ctx context.Context, task *corev1alpha1.Task) (bool, error) {
+	latest := &corev1alpha1.Task{}
+	if err := d.APIReader.Get(ctx, clientObjectKey(task), latest); err != nil {
+		return false, err
+	}
+	return !latest.DeletionTimestamp.IsZero() || latest.Status.Phase == corev1alpha1.TaskPhaseCancelled, nil
+}
+
+//nolint:gocyclo // Reclamation deliberately verifies every durable publication, attempt, effect, owner, and baseline fence together.
+func (d *ACPDispatcher) reclaimStandaloneTaskBranchClaim(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attemptID string,
+	fence store.ControllerEpochFence,
+	publication *store.Publication,
+) error {
+	if publication == nil {
+		return fmt.Errorf("publication is required for branch-claim reclamation")
+	}
+	if publication.SessionUID != "" {
+		return nil
+	}
+	if task == nil || task.Status.Execution == nil {
+		return fmt.Errorf("task execution identity is required for branch-claim reclamation")
+	}
+	if !store.IsTerminalPublicationState(publication.State) {
+		return fmt.Errorf("publication %s is not terminal", publication.ID)
+	}
+	if publication.State == store.PublicationOutcomeUnknown {
+		// An ambiguous remote outcome must retain its claim as a durable
+		// fail-closed ownership barrier until explicit reconciliation.
+		return nil
+	}
+	if publication.ID != publicationIDForTask(task) || publication.Namespace != task.Namespace ||
+		publication.TaskUID != string(task.UID) || publication.Attempt != int64(task.Status.Execution.Attempt) ||
+		publication.PromptID != task.Status.Execution.PromptID {
+		return fmt.Errorf("publication %s does not match the immutable Task execution identity", publication.ID)
+	}
+	attemptKey := store.PromptAttemptKey{
+		Namespace: publication.Namespace,
+		TaskUID:   publication.TaskUID,
+		Attempt:   publication.Attempt,
+		PromptID:  publication.PromptID,
+	}
+	expectedAttemptID, err := attemptKey.CanonicalID()
+	if err != nil {
+		return err
+	}
+	if attemptID != expectedAttemptID {
+		return fmt.Errorf("prompt attempt identity does not match publication %s", publication.ID)
+	}
+	attempt, err := d.Store.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		return err
+	}
+	expectedDelivery := promptDeliveryForPublication(publication.State)
+	if attempt.Key != attemptKey || !store.IsTerminalPromptExecutionState(attempt.ExecutionState) ||
+		attempt.DeliveryState != expectedDelivery || !store.IsTerminalPromptDeliveryState(attempt.DeliveryState) {
+		return fmt.Errorf("publication %s delivery has not settled at its exact terminal fence", publication.ID)
+	}
+	if err := d.ensurePublicationExternalEffectsSettled(ctx, task, publication); err != nil {
+		return err
+	}
+
+	expectedClaimDigest, err := branchClaimRequestDigest(
+		publication.TargetRepositoryID, publication.TargetRef, store.BranchClaimOwnerTask,
+		publication.TaskUID, publication.Baseline, publication.ID,
+	)
+	if err != nil {
+		return err
+	}
+	legacyClaimDigest, err := legacyBranchClaimRequestDigest(
+		publication.TargetRepositoryID, publication.TargetRef, store.BranchClaimOwnerTask,
+		publication.TaskUID, publication.Baseline,
+	)
+	if err != nil {
+		return err
+	}
+	claim, err := d.Store.GetBranchClaim(ctx, publication.BranchClaimID)
+	if errors.Is(err, store.ErrNotFound) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	if claim.OwnerKind != store.BranchClaimOwnerTask || claim.OwnerUID != publication.TaskUID ||
+		(claim.RequestDigest != expectedClaimDigest && claim.RequestDigest != legacyClaimDigest) {
+		// The immutable Task-owned identity was already deleted and replaced.
+		// Never let recovery for the old terminal Task reclaim the new owner.
+		return nil
+	}
+	if claim.ID != publication.BranchClaimID || claim.RepositoryID != publication.TargetRepositoryID ||
+		claim.Ref != publication.TargetRef || claim.Generation != publication.BranchClaimGeneration ||
+		claim.Availability != store.BranchClaimAvailable || claim.BlockedReason != "" || claim.RelatedPublicationID != "" {
+		return fmt.Errorf("branch claim %s does not match the terminal publication fence", claim.ID)
+	}
+
+	expectedBaseline := publication.Baseline
+	if publication.State == store.PublicationVerifiedExact || publication.State == store.PublicationDeliveredSuperseded {
+		verification := publication.VerificationReceipt
+		if verification == nil || verification.Outcome != publication.State ||
+			verification.ObservedRemote.Absent || verification.ObservedRemote.SHA == "" {
+			return fmt.Errorf("verified publication lacks an exact observed remote branch head")
+		}
+		expectedBaseline = verification.ObservedRemote
+		if !claim.LastVerified.Equal(expectedBaseline) {
+			if !claim.LastVerified.Equal(publication.Baseline) {
+				return fmt.Errorf("branch claim %s baseline drifted before terminal reclamation", claim.ID)
+			}
+			digest := mustACPDomainDigest("branch-claim-advance", map[string]any{
+				"claim": claim.ID, "publication": publication.ID, "sha": expectedBaseline.SHA,
+			})
+			claim, err = d.Store.CompareAndSwapBranchClaim(ctx, store.BranchClaimCAS{
+				ID: claim.ID, Fence: fence, ExpectedVersion: claim.Version,
+				ExpectedGeneration: claim.Generation, NewGeneration: claim.Generation,
+				ExpectedLastVerified: claim.LastVerified, NewLastVerified: expectedBaseline,
+				ExpectedAvailability: claim.Availability, NewAvailability: store.BranchClaimAvailable,
+				OperationID: publicationOperationID("claim-advance", nil), OperationDigest: digest, UpdatedAt: time.Now().UTC(),
+			})
+			if err != nil {
+				return err
+			}
+		}
+	} else if !claim.LastVerified.Equal(expectedBaseline) {
+		return fmt.Errorf("branch claim %s baseline drifted before terminal reclamation", claim.ID)
+	}
+
+	return d.Store.ReclaimBranchClaim(ctx, store.ReclaimBranchClaimRequest{
+		ID: claim.ID, Fence: fence, ExpectedVersion: claim.Version, ExpectedGeneration: claim.Generation,
+		ExpectedRepositoryID: claim.RepositoryID, ExpectedRef: claim.Ref,
+		ExpectedOwnerKind: store.BranchClaimOwnerTask, ExpectedOwnerUID: publication.TaskUID,
+		ExpectedLastVerified: expectedBaseline, ExpectedAvailability: store.BranchClaimAvailable,
+		ExpectedRequestDigest: claim.RequestDigest,
+	})
+}
+
+func (d *ACPDispatcher) ensurePublicationExternalEffectsSettled(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	publication *store.Publication,
+) error {
+	effects := []struct {
+		kind      string
+		operation string
+	}{
+		{kind: "publisher.claim-refresh", operation: "claim-refresh"},
+		{kind: "publisher.preflight", operation: "preflight"},
+		{kind: "publisher.prepare", operation: "prepare"},
+		{kind: "publisher.publish", operation: "publish"},
+		{kind: "publisher.verify", operation: "verify"},
+		{kind: "publisher.pull-request", operation: "pr-reconcile"},
+	}
+	for _, candidate := range effects {
+		identity := store.ExternalEffectIdentity{
+			Kind: candidate.kind, Namespace: publication.Namespace, AggregateID: publication.ID,
+			OperationID: publicationOperationID(candidate.operation, task),
+		}
+		id, err := identity.CanonicalID()
+		if err != nil {
+			return err
+		}
+		effect, err := d.Store.GetExternalEffect(ctx, id)
+		if errors.Is(err, store.ErrNotFound) {
+			continue
+		}
+		if err != nil {
+			return err
+		}
+		switch effect.State {
+		case store.ExternalEffectSucceeded, store.ExternalEffectFailed, store.ExternalEffectOutcomeUnknown:
+		default:
+			return fmt.Errorf("publication %s external effect %s has not settled", publication.ID, effect.ID)
+		}
+	}
+	return nil
+}
+
+func publicationTaskDeliveryStatus(workspace *corev1alpha1.WorkspaceConfig, baseline harnessv2.WorkspaceBaseline, delta harnessv2.WorkspaceDeltaDescriptor, publication *store.Publication, branch string) corev1alpha1.TaskDeliveryStatus {
+	status := corev1alpha1.TaskDeliveryStatus{
+		PublicationID: publication.ID, Branch: branch, StartingSHA: baseline.Revision,
+		ArtifactDigest: delta.Artifact.Digest, LastTransitionTime: nowMeta(),
+	}
+	if workspace.SourceRepository != nil {
+		copyValue := *workspace.SourceRepository
+		status.SourceRepository = &copyValue
+	} else {
+		status.SourceRepository = &corev1alpha1.RepositoryIdentity{Provider: workspaceRepositoryProviderGitHub, ID: publication.SourceRepositoryID}
+	}
+	if workspace.PublicationRepository != nil {
+		copyValue := *workspace.PublicationRepository
+		status.PublicationRepository = &copyValue
+	} else {
+		status.PublicationRepository = &corev1alpha1.RepositoryIdentity{Provider: workspaceRepositoryProviderGitHub, ID: publication.TargetRepositoryID}
+	}
+	if publication.Baseline.Absent {
+		empty := ""
+		status.RemoteBeforeSHA = &empty
+	} else {
+		value := publication.Baseline.SHA
+		status.RemoteBeforeSHA = &value
+	}
+	if publication.PreparedReceipt != nil {
+		status.TreeSHA = publication.PreparedReceipt.TreeSHA
+		status.ExpectedCommitSHA = publication.PreparedReceipt.CommitSHA
+	}
+	if publication.VerificationReceipt != nil && !publication.VerificationReceipt.ObservedRemote.Absent {
+		status.VerifiedRemoteSHA = publication.VerificationReceipt.ObservedRemote.SHA
+	}
+	if publication.PullRequestReceipt != nil && publication.PRIntent != nil {
+		status.PRReceipt = &corev1alpha1.TaskPullRequestReceipt{
+			ID: publication.PullRequestReceipt.ForgeID, URL: publication.PullRequestReceipt.URL,
+			State:      publication.PullRequestReceipt.State,
+			BaseBranch: strings.TrimPrefix(publication.PRIntent.BaseRef, "refs/heads/"),
+			HeadBranch: strings.TrimPrefix(publication.PRIntent.HeadRef, "refs/heads/"),
+			HeadSHA:    publication.PullRequestReceipt.HeadSHA,
+		}
+		if number, ok := pullRequestNumberFromForgeID(publication.PullRequestReceipt.ForgeID); ok {
+			status.PRReceipt.Number = number
+		}
+	}
+	switch publication.State {
+	case store.PublicationVerifiedExact:
+		status.State, status.Outcome = corev1alpha1.TaskDeliveryStateVerifiedExact, corev1alpha1.TaskDeliveryOutcomeVerifiedExact
+	case store.PublicationDeliveredSuperseded:
+		status.State, status.Outcome = corev1alpha1.TaskDeliveryStateDeliveredSuperseded, corev1alpha1.TaskDeliveryOutcomeDeliveredSuperseded
+		status.SupersedingRemoteSHA = status.VerifiedRemoteSHA
+	case store.PublicationCancelledBeforePublish:
+		status.State, status.Outcome = corev1alpha1.TaskDeliveryStateCancelledBeforePublish, corev1alpha1.TaskDeliveryOutcomeCancelledBeforePublish
+	case store.PublicationDeliveryConflict, store.PublicationPreparationFailed:
+		status.State, status.Outcome = corev1alpha1.TaskDeliveryStateDeliveryConflict, corev1alpha1.TaskDeliveryOutcomeDeliveryConflict
+	case store.PublicationCredentialBlocked:
+		status.State, status.Outcome = corev1alpha1.TaskDeliveryStateCredentialBlocked, corev1alpha1.TaskDeliveryOutcomeCredentialBlocked
+	default:
+		status.State, status.Outcome = corev1alpha1.TaskDeliveryStatePublicationOutcomeUnknown, corev1alpha1.TaskDeliveryOutcomePublicationOutcomeUnknown
+	}
+	status.Message = publication.TerminalReason
+	return status
+}
+
+func storeVerificationReceipt(receipt publisher.VerificationReceipt) *store.PublicationVerificationReceipt {
+	return &store.PublicationVerificationReceipt{
+		OperationID: receipt.OperationID, RequestDigest: receipt.RequestDigest,
+		Outcome: store.PublicationState(receipt.Outcome), ExpectedCommitSHA: receipt.ExpectedCommitOID,
+		ObservedRemote:        store.RemoteRefState{Absent: receipt.ObservedRemote.Absent, SHA: receipt.ObservedRemote.OID},
+		DescendantProofDigest: receipt.DescendantProofDigest, VerifiedAt: time.Now().UTC(),
+	}
+}
+
+func promptDeliveryForPublication(state store.PublicationState) store.PromptDeliveryState {
+	switch state {
+	case store.PublicationVerifiedExact:
+		return store.PromptDeliveryVerifiedExact
+	case store.PublicationDeliveredSuperseded:
+		return store.PromptDeliveryDeliveredSuperseded
+	case store.PublicationCancelledBeforePublish:
+		return store.PromptDeliveryCancelledBeforePublish
+	case store.PublicationDeliveryConflict, store.PublicationPreparationFailed:
+		return store.PromptDeliveryConflict
+	case store.PublicationCredentialBlocked:
+		return store.PromptDeliveryCredentialBlocked
+	default:
+		return store.PromptDeliveryPublicationOutcomeUnknown
+	}
+}
+
+func publisherBranchClaim(claim store.BranchClaim) publisher.BranchClaim {
+	return publisher.BranchClaim{
+		RepositoryID: claim.RepositoryID, Ref: claim.Ref, OwnerKind: string(claim.OwnerKind), OwnerUID: claim.OwnerUID,
+		Generation: claim.Generation, LastVerified: publisherRemoteRef(claim.LastVerified),
+	}
+}
+
+func publisherRemoteRef(remote store.RemoteRefState) publisher.RemoteRef {
+	return publisher.RemoteRef{Absent: remote.Absent, OID: remote.SHA}
+}
+
+func workspacePublicationRepository(workspace *corev1alpha1.WorkspaceConfig) (publisher.Repository, error) {
+	rawURL := strings.TrimSpace(workspace.PublicationGitRepo)
+	if rawURL == "" {
+		rawURL = strings.TrimSpace(workspace.GitRepo)
+	}
+	parsed, derivedID, err := canonicalWorkspaceRepositoryURL(rawURL)
+	if err != nil {
+		return publisher.Repository{}, fmt.Errorf("publication repository: %w", err)
+	}
+	provider := workspaceRepositoryProviderGitHub
+	identity := workspace.PublicationRepository
+	if identity == nil && rawURL == strings.TrimSpace(workspace.GitRepo) {
+		identity = workspace.SourceRepository
+	}
+	if identity != nil {
+		provider = strings.ToLower(strings.TrimSpace(identity.Provider))
+		id := strings.TrimSpace(identity.ID)
+		if provider != workspaceRepositoryProviderGitHub || !sameWorkspaceRepositoryIdentity(id, derivedID) {
+			return publisher.Repository{}, fmt.Errorf("publicationRepository must match the canonical credential-free URL identity %q", derivedID)
+		}
+	}
+	return publisher.Repository{Provider: provider, ID: derivedID, URL: parsed.String()}, nil
+}
+
+func workspaceSourceRef(workspace *corev1alpha1.WorkspaceConfig) (string, error) {
+	if raw := strings.TrimSpace(workspace.Ref); raw != "" {
+		canonical, err := publisherservice.CanonicalWorkspaceSourceRef(raw)
+		if err != nil {
+			return "", fmt.Errorf("workspace source ref is invalid: %w", err)
+		}
+		return canonical, nil
+	}
+	branch := strings.TrimSpace(workspace.Branch)
+	if branch == "" {
+		branch = "main"
+	}
+	if strings.HasPrefix(branch, "refs/heads/") {
+		return branch, nil
+	}
+	if strings.HasPrefix(branch, "refs/") || strings.Contains(branch, "..") || strings.ContainsAny(branch, " ~^:?*[\\") {
+		return "", fmt.Errorf("workspace source branch is invalid")
+	}
+	return "refs/heads/" + branch, nil
+}
+
+func publicationBranch(task *corev1alpha1.Task, session *acpTaskSession, workspace *corev1alpha1.WorkspaceConfig) string {
+	if branch := strings.TrimSpace(workspace.PushBranch); branch != "" {
+		return strings.TrimPrefix(branch, "refs/heads/")
+	}
+	if session != nil {
+		return "orka/session-" + session.Binding.SessionUID
+	}
+	return "orka/task-" + string(task.UID)
+}
+
+func preparedReceiptFromPublisher(value publisherservice.PreparedPublication) (*store.PreparedPublicationReceipt, error) {
+	if err := value.BundleArtifact.Validate(); err != nil || value.BundleArtifact.MediaType != store.PreparedBundleMediaType ||
+		value.BundleArtifact.Digest != value.BundleDigest || value.BundleArtifact.SizeBytes != value.BundleSize {
+		return nil, fmt.Errorf("publisher prepared bundle artifact is invalid")
+	}
+	return &store.PreparedPublicationReceipt{
+		OperationID: value.OperationID, RequestDigest: value.RequestDigest,
+		TreeSHA: value.TreeOID, CommitSHA: value.CommitOID, ManifestDigest: value.ManifestDigest, RelativeRoot: value.RelativeRoot,
+		BundleArtifactID: string(value.BundleArtifact.ArtifactID), BundleDigest: value.BundleDigest,
+		BundleSizeBytes: value.BundleSize, BundleMediaType: value.BundleArtifact.MediaType, BundleRef: value.BundleRef,
+		PreparedAt: value.CommitTimestamp,
+	}, nil
+}
+
+func publisherPreparedFromPublication(publication *store.Publication, source, target publisher.Repository) publisherservice.PreparedPublication {
+	if publication == nil || publication.PreparedReceipt == nil {
+		return publisherservice.PreparedPublication{}
+	}
+	prepared := publication.PreparedReceipt
+	return publisherservice.PreparedPublication{
+		PublicationID: publication.ID, PublicationGeneration: publication.Generation,
+		OperationID: prepared.OperationID, RequestDigest: prepared.RequestDigest,
+		Source: source, SourceRef: publication.SourceRef, Target: target, TargetRef: publication.TargetRef,
+		BranchClaimGeneration: publication.BranchClaimGeneration, BaselineOID: publication.SourceBaselineSHA,
+		RemoteBefore: publisherRemoteRef(publication.Baseline), DeltaArtifactDigest: publication.ArtifactDigest,
+		RelativeRoot: prepared.RelativeRoot, ManifestDigest: prepared.ManifestDigest, TreeOID: prepared.TreeSHA, CommitOID: prepared.CommitSHA,
+		BundleDigest: prepared.BundleDigest, BundleSize: prepared.BundleSizeBytes, BundleRef: prepared.BundleRef,
+		BundleArtifact: harnessv2.ArtifactReference{
+			ArtifactID: harnessv2.ArtifactID(prepared.BundleArtifactID), Digest: prepared.BundleDigest,
+			SizeBytes: prepared.BundleSizeBytes, MediaType: prepared.BundleMediaType,
+		},
+		CommitMessage: publication.CommitMessage, CommitTimestamp: publication.CommitTimestamp,
+	}
+}
+
+func publicationID(task *corev1alpha1.Task) string {
+	return publicationIDForTaskUID(task, task.UID)
+}
+
+func publicationIDForTaskUID(task *corev1alpha1.Task, taskUID types.UID) string {
+	digest := mustACPDomainDigest("publication-id", map[string]any{"taskUID": string(taskUID), "attempt": task.Status.Execution.Attempt, "promptID": task.Status.Execution.PromptID})
+	return "pub-" + strings.TrimPrefix(digest, "sha256:")[:48]
+}
+
+func publicationIDForTask(task *corev1alpha1.Task) string { return publicationID(task) }
+
+// ACPPublicationIDForTask returns the immutable publication identity used by the credential/artifact brokers.
+func ACPPublicationIDForTask(task *corev1alpha1.Task) string { return publicationID(task) }
+
+func publicationOperationID(kind string, task *corev1alpha1.Task) string {
+	return ACPPublicationOperationID(kind, task)
+}
+
+// ACPPublicationOperationID returns the deterministic external-effect operation identity for one Task publication step.
+func ACPPublicationOperationID(kind string, task *corev1alpha1.Task) string {
+	seed := kind
+	if task != nil && task.Status.Execution != nil {
+		seed += "-" + string(task.UID) + "-" + strconv.Itoa(int(task.Status.Execution.Attempt))
+	}
+	digest := mustACPDomainDigest("publication-operation", seed)
+	return kind + "-" + strings.TrimPrefix(digest, "sha256:")[:32]
+}
+
+func mustACPDomainDigest(domain string, value any) string {
+	digest, err := acpDomainDigest(domain, value)
+	if err != nil {
+		panic(err)
+	}
+	return digest
+}
+
+func clientObjectKey(task *corev1alpha1.Task) client.ObjectKey {
+	return client.ObjectKey{Namespace: task.Namespace, Name: task.Name}
+}
+
+func taskDeliveryStatusForKubernetes(task *corev1alpha1.Task, status corev1alpha1.TaskDeliveryStatus) corev1alpha1.TaskDeliveryStatus {
+	// Harness v2 uses "empty" as a protocol-only revision for Tasks without a
+	// repository workspace. It is not a Git object ID and must not escape into
+	// the schema-validated Task status. Preserve every other value so malformed
+	// real-workspace revisions continue to fail closed at the API boundary.
+	if task != nil && task.Spec.Workspace == nil && status.StartingSHA == acpNoWorkspaceRevision {
+		status.StartingSHA = ""
+	}
+	return status
+}
+
+func (d *ACPDispatcher) patchDeliveryStatus(ctx context.Context, task *corev1alpha1.Task, status corev1alpha1.TaskDeliveryStatus) error {
+	key := clientObjectKey(task)
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		latest := &corev1alpha1.Task{}
+		if err := d.Client.Get(ctx, key, latest); err != nil {
+			return err
+		}
+		base := latest.DeepCopy()
+		copyStatus := taskDeliveryStatusForKubernetes(latest, status)
+		latest.Status.Delivery = &copyStatus
+		return d.Client.Status().Patch(ctx, latest, client.MergeFrom(base))
+	})
+}
+
+// terminalProjectionExecution builds the immutable terminal-projection
+// execution payload from a deep copy of the Task's frozen execution identity,
+// overlaying only the terminal classification. Prompt attempt reclamation
+// validates the projection against the attempt's request digest and the
+// Task's complete runtime identity — including the RuntimeSession supervisor
+// boot ID and the profile/MCP/workspace digests — so a sparse payload makes
+// the source PromptAttempt impossible to retire and the Task undeletable.
+// The volatile transition time is cleared so retried settlements enqueue
+// byte-identical payloads.
+func terminalProjectionExecution(
+	task *corev1alpha1.Task,
+	state corev1alpha1.TaskExecutionState,
+	outcome corev1alpha1.TaskExecutionOutcome,
+	reason corev1alpha1.TaskExecutionReason,
+	message string,
+) corev1alpha1.TaskExecutionStatus {
+	execution := corev1alpha1.TaskExecutionStatus{}
+	if task != nil && task.Status.Execution != nil {
+		execution = *task.Status.Execution.DeepCopy()
+	}
+	execution.State = state
+	execution.Outcome = outcome
+	execution.Reason = reason
+	execution.Message = message
+	execution.LastTransitionTime = nil
+	return execution
+}
+
+func (d *ACPDispatcher) completeSuccessWithDelivery(ctx context.Context, task *corev1alpha1.Task, status corev1alpha1.TaskDeliveryStatus, message string) error {
+	execution := terminalProjectionExecution(task,
+		corev1alpha1.TaskExecutionStateSucceeded, corev1alpha1.TaskExecutionOutcomeSucceeded, "", "")
+	if err := d.enqueueStandaloneTaskProjection(ctx, task, taskTerminalProjection{
+		Namespace: task.Namespace, Task: task.Name, TaskUID: string(task.UID), Attempt: execution.Attempt,
+		Phase: corev1alpha1.TaskPhaseSucceeded, Message: message, Execution: execution, Delivery: &status,
+	}); err != nil {
+		return err
+	}
+	status = taskDeliveryStatusForKubernetes(task, status)
+	key := clientObjectKey(task)
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		latest := &corev1alpha1.Task{}
+		if err := d.Client.Get(ctx, key, latest); err != nil {
+			return err
+		}
+		base := latest.DeepCopy()
+		now := metav1.Now()
+		latest.Status.Phase = corev1alpha1.TaskPhaseSucceeded
+		latest.Status.Message = message
+		latest.Status.CompletionTime = &now
+		if latest.Status.Execution == nil {
+			latest.Status.Execution = &corev1alpha1.TaskExecutionStatus{}
+		}
+		latest.Status.Execution.State = corev1alpha1.TaskExecutionStateSucceeded
+		latest.Status.Execution.Outcome = corev1alpha1.TaskExecutionOutcomeSucceeded
+		latest.Status.Execution.LastTransitionTime = &now
+		status.LastTransitionTime = &now
+		latest.Status.Delivery = &status
+		return d.Client.Status().Patch(ctx, latest, client.MergeFrom(base))
+	})
+}
+
+func (d *ACPDispatcher) failTaskForDelivery(ctx context.Context, task *corev1alpha1.Task, status corev1alpha1.TaskDeliveryStatus, message string) error {
+	// Execution succeeded and only delivery failed, so the projection carries
+	// the frozen successful execution identity with the failed Phase.
+	execution := terminalProjectionExecution(task,
+		corev1alpha1.TaskExecutionStateSucceeded, corev1alpha1.TaskExecutionOutcomeSucceeded, "", "")
+	if err := d.enqueueStandaloneTaskProjection(ctx, task, taskTerminalProjection{
+		Namespace: task.Namespace, Task: task.Name, TaskUID: string(task.UID), Attempt: execution.Attempt,
+		Phase: corev1alpha1.TaskPhaseFailed, Message: message, Execution: execution, Delivery: &status,
+	}); err != nil {
+		return err
+	}
+	status = taskDeliveryStatusForKubernetes(task, status)
+	key := clientObjectKey(task)
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		latest := &corev1alpha1.Task{}
+		if err := d.Client.Get(ctx, key, latest); err != nil {
+			return err
+		}
+		base := latest.DeepCopy()
+		now := metav1.Now()
+		latest.Status.Phase = corev1alpha1.TaskPhaseFailed
+		latest.Status.Message = message
+		latest.Status.CompletionTime = &now
+		if latest.Status.Execution == nil {
+			latest.Status.Execution = &corev1alpha1.TaskExecutionStatus{}
+		}
+		latest.Status.Execution.State = corev1alpha1.TaskExecutionStateSucceeded
+		latest.Status.Execution.Outcome = corev1alpha1.TaskExecutionOutcomeSucceeded
+		latest.Status.Execution.LastTransitionTime = &now
+		status.LastTransitionTime = &now
+		latest.Status.Delivery = &status
+		return d.Client.Status().Patch(ctx, latest, client.MergeFrom(base))
+	})
+}
+
+func (d *ACPDispatcher) cancelTaskAfterExecution(ctx context.Context, task *corev1alpha1.Task, status corev1alpha1.TaskDeliveryStatus, message string) error {
+	// Execution succeeded before the cancellation settled the publication, so
+	// the projection carries the frozen successful execution identity with the
+	// cancelled Phase.
+	execution := terminalProjectionExecution(task,
+		corev1alpha1.TaskExecutionStateSucceeded, corev1alpha1.TaskExecutionOutcomeSucceeded, "", "")
+	if err := d.enqueueStandaloneTaskProjection(ctx, task, taskTerminalProjection{
+		Namespace: task.Namespace, Task: task.Name, TaskUID: string(task.UID), Attempt: execution.Attempt,
+		Phase: corev1alpha1.TaskPhaseCancelled, Message: message, Execution: execution, Delivery: &status,
+	}); err != nil {
+		return err
+	}
+	status = taskDeliveryStatusForKubernetes(task, status)
+	key := clientObjectKey(task)
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		latest := &corev1alpha1.Task{}
+		if err := d.Client.Get(ctx, key, latest); err != nil {
+			return err
+		}
+		base := latest.DeepCopy()
+		now := metav1.Now()
+		latest.Status.Phase = corev1alpha1.TaskPhaseCancelled
+		latest.Status.Message = message
+		latest.Status.CompletionTime = &now
+		if latest.Status.Execution == nil {
+			latest.Status.Execution = &corev1alpha1.TaskExecutionStatus{}
+		}
+		latest.Status.Execution.State = corev1alpha1.TaskExecutionStateSucceeded
+		latest.Status.Execution.Outcome = corev1alpha1.TaskExecutionOutcomeSucceeded
+		latest.Status.Execution.LastTransitionTime = &now
+		status.LastTransitionTime = &now
+		latest.Status.Delivery = &status
+		return d.Client.Status().Patch(ctx, latest, client.MergeFrom(base))
+	})
+}
+
+func (d *ACPDispatcher) cancelPreparedPublication(ctx context.Context, task *corev1alpha1.Task) (bool, error) {
+	if task == nil || task.Status.Execution == nil {
+		return false, nil
+	}
+	publication, err := d.Store.GetPublication(ctx, publicationIDForTask(task))
+	if err != nil {
+		if errors.Is(err, store.ErrNotFound) {
+			return false, nil
+		}
+		return false, err
+	}
+	if publication.State == store.PublicationCancelledBeforePublish {
+		return true, nil
+	}
+	if publication.State != store.PublicationPrepared {
+		return false, nil
+	}
+	fence, err := d.Epochs.CurrentFence(ctx)
+	if err != nil {
+		return false, err
+	}
+	_, err = d.transitionPublication(ctx, publication, fence, store.PublicationCancelledBeforePublish,
+		publicationOperationID("cancel-before-publish", task), mustACPDomainDigest("publication-cancel", publication.ID), nil, nil, nil, "")
+	if err != nil {
+		if errors.Is(err, store.ErrConflict) {
+			latest, getErr := d.Store.GetPublication(ctx, publication.ID)
+			if getErr != nil {
+				return false, getErr
+			}
+			return latest.State == store.PublicationCancelledBeforePublish, nil
+		}
+		return false, err
+	}
+	return true, nil
+}
+
+// maxSequentialPublisherSettlementStages is the largest number of sequential
+// publisher-backed external-effect stages that run under one bounded context
+// in publishWorkspaceDelta: the delivery context covers branch-claim refresh,
+// preflight, and prepare; the detached settlement context covers publish,
+// verify, and pull-request reconciliation. Ledger settle calls and durable
+// store bookkeeping between stages are covered by the trailing margin.
+const maxSequentialPublisherSettlementStages = 3
+
+// publicationSettlementWindow bounds the multi-effect publication settlement
+// and delivery flows. publishWorkspaceDelta runs its publisher-backed stages
+// sequentially under a single context, so the window must budget every stage
+// at its full bounded call duration rather than only one:
+//
+//	window = stages x (call timeout + settlement margin) + settlement margin
+//
+// With the default 4m publisher call bound that is 3 x 5m + 1m = 16m; with
+// ORKA_PUBLISHER_PUBLISH_TIMEOUT=10m it is 3 x 11m + 1m = 34m. Budgeting only
+// one call timeout would let a slow-but-acknowledged publish starve remote
+// verification and PR reconciliation, misclassifying a delivered push as
+// outcome-unknown.
+func publicationSettlementWindow() time.Duration {
+	perStage := externalEffectCallTimeout(store.ExternalEffectIdentity{Kind: "publisher.publish"}) + externalEffectLeaseSettlementMargin
+	return maxSequentialPublisherSettlementStages*perStage + externalEffectLeaseSettlementMargin
+}
diff --git a/internal/controller/acp_publication_receipt_test.go b/internal/controller/acp_publication_receipt_test.go
new file mode 100644
index 000000000..205d4ca19
--- /dev/null
+++ b/internal/controller/acp_publication_receipt_test.go
@@ -0,0 +1,116 @@
+package controller
+
+import (
+	"strings"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/publisher"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+func TestPullRequestNumberFromForgeID(t *testing.T) {
+	number, ok := pullRequestNumberFromForgeID("github:123456:42")
+	if !ok || number != 42 {
+		t.Fatalf("number, ok = %d, %t", number, ok)
+	}
+	for _, value := range []string{"42", "gitlab:123:42", "github:123:not-a-number", "github:123:0", "github:123:2147483648"} {
+		if _, ok := pullRequestNumberFromForgeID(value); ok {
+			t.Fatalf("unexpectedly parsed %q", value)
+		}
+	}
+}
+
+func TestExpectedPublicationRemoteState(t *testing.T) {
+	got, err := expectedPublicationRemoteState(nil, nil, publisher.Repository{}, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !got.Absent || got.SHA != "" {
+		t.Fatalf("nil workspace state = %#v, want absent", got)
+	}
+	workspace := &corev1alpha1.WorkspaceConfig{ExpectedRemoteSHA: strings.Repeat("a", 40)}
+	got, err = expectedPublicationRemoteState(workspace, nil, publisher.Repository{}, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Absent || got.SHA != workspace.ExpectedRemoteSHA {
+		t.Fatalf("exact workspace state = %#v", got)
+	}
+
+	baseline := &store.VerifiedBranchBaseline{
+		RepositoryID: "github.com/orka-agents/orka",
+		Ref:          "refs/heads/orka/session-session-uid",
+		SHA:          strings.Repeat("b", 40),
+	}
+	target := publisher.Repository{ID: baseline.RepositoryID}
+	session := &acpTaskSession{VerifiedBaseline: baseline}
+	workspace.ExpectedRemoteSHA = baseline.SHA
+	got, err = expectedPublicationRemoteState(workspace, session, target, baseline.Ref)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Absent || got.SHA != baseline.SHA {
+		t.Fatalf("session workspace state = %#v", got)
+	}
+	workspace.ExpectedRemoteSHA = strings.Repeat("c", 40)
+	if _, err := expectedPublicationRemoteState(workspace, session, target, baseline.Ref); err == nil {
+		t.Fatal("conflicting expectedRemoteSHA unexpectedly accepted")
+	}
+}
+
+func TestWorkspaceSourceRefPreservesHistoricalCommitOIDs(t *testing.T) {
+	for _, oid := range []string{strings.Repeat("a", 40), strings.Repeat("b", 64)} {
+		workspace := &corev1alpha1.WorkspaceConfig{Branch: "main", Ref: oid}
+		got, err := workspaceSourceRef(workspace)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got != oid {
+			t.Fatalf("workspaceSourceRef() = %q, want exact historical commit %q", got, oid)
+		}
+	}
+}
+
+func TestRuntimeSessionDeltaAbandonmentFinalization(t *testing.T) {
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "task", Namespace: "default", UID: types.UID("task-uid")},
+		Status:     corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{Attempt: 2}},
+	}
+	finalization, err := runtimeSessionDeltaAbandonmentFinalization(task, "delta-1", corev1alpha1.TaskDeliveryStatus{State: corev1alpha1.TaskDeliveryStateDeliveryConflict})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if finalization.PublicationID == "" || finalization.PublicationGeneration != 1 || finalization.PublicationVersion != 1 || finalization.TerminalState != harnessv2.PublicationTerminalDeliveryConflict || finalization.TerminalReceiptDigest == "" {
+		t.Fatalf("finalization = %#v", finalization)
+	}
+}
+
+func TestWorkspaceSourceRefPreservesExplicitAndBareSelectors(t *testing.T) {
+	const (
+		bareTag         = "v1.2.3"
+		canonicalTag    = "refs/tags/" + bareTag
+		canonicalBranch = "refs/heads/" + defaultACPSourceBranch
+	)
+	for _, test := range []struct {
+		name string
+		ref  string
+		want string
+	}{
+		{name: "canonical-tag", ref: canonicalTag, want: canonicalTag},
+		{name: "bare-tag", ref: bareTag, want: bareTag},
+		{name: "canonical-branch", ref: canonicalBranch, want: canonicalBranch},
+		{name: "bare-branch", ref: defaultACPSourceBranch, want: defaultACPSourceBranch},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			got, err := workspaceSourceRef(&corev1alpha1.WorkspaceConfig{Ref: test.ref})
+			if err != nil || got != test.want {
+				t.Fatalf("workspaceSourceRef(%q) = %q, %v, want %q, nil", test.ref, got, err, test.want)
+			}
+		})
+	}
+}
diff --git a/internal/controller/acp_publication_reclamation_test.go b/internal/controller/acp_publication_reclamation_test.go
new file mode 100644
index 000000000..ee72bb76f
--- /dev/null
+++ b/internal/controller/acp_publication_reclamation_test.go
@@ -0,0 +1,592 @@
+package controller
+
+import (
+	"context"
+	"errors"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/publisher"
+	publisherservice "github.com/orka-agents/orka/internal/publisher/service"
+	"github.com/orka-agents/orka/internal/store"
+	"github.com/orka-agents/orka/internal/store/sqlite"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+const targetReadCredentialName = "target-read"
+
+func TestReclaimStandaloneTaskBranchClaimAdvancesThenDeletes(t *testing.T) {
+	ctx := context.Background()
+	controlStore, fence := newBranchClaimReclamationStore(t)
+	task := branchClaimReclamationTask("task-old", "prompt-old")
+	attemptID := createTerminalBranchClaimReclamationAttempt(t, controlStore, fence, task, store.PromptDeliveryVerifiedExact)
+	publication, claim := createStandaloneBranchClaimPublication(t, controlStore, fence, task, store.PublicationVerifiedExact)
+	dispatcher := &ACPDispatcher{Store: controlStore}
+
+	if err := dispatcher.reclaimStandaloneTaskBranchClaim(ctx, task, attemptID, fence, publication); err != nil {
+		t.Fatalf("reclaimStandaloneTaskBranchClaim: %v", err)
+	}
+	if _, err := controlStore.GetBranchClaim(ctx, claim.ID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("GetBranchClaim after reclaim error = %v, want ErrNotFound", err)
+	}
+	if err := dispatcher.reclaimStandaloneTaskBranchClaim(ctx, task, attemptID, fence, publication); err != nil {
+		t.Fatalf("reclaimStandaloneTaskBranchClaim(idempotent retry): %v", err)
+	}
+
+	replacementDigest, err := branchClaimRequestDigest(
+		claim.RepositoryID, claim.Ref, store.BranchClaimOwnerTask, claim.OwnerUID,
+		publication.VerificationReceipt.ObservedRemote, "pub-replacement-attempt",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	replacement, err := controlStore.CreateBranchClaim(ctx, &store.BranchClaim{
+		RepositoryID: claim.RepositoryID, Ref: claim.Ref,
+		OwnerKind: store.BranchClaimOwnerTask, OwnerUID: claim.OwnerUID, LastVerified: publication.VerificationReceipt.ObservedRemote,
+		RequestDigest: replacementDigest, CreatedAt: time.Now().UTC(),
+	}, fence)
+	if err != nil {
+		t.Fatalf("CreateBranchClaim(replacement): %v", err)
+	}
+	if err := dispatcher.reclaimStandaloneTaskBranchClaim(ctx, task, attemptID, fence, publication); err != nil {
+		t.Fatalf("reclaimStandaloneTaskBranchClaim(old retry after replacement): %v", err)
+	}
+	preserved, err := controlStore.GetBranchClaim(ctx, replacement.ID)
+	if err != nil {
+		t.Fatalf("GetBranchClaim(replacement): %v", err)
+	}
+	if preserved.OwnerUID != replacement.OwnerUID || preserved.RequestDigest != replacement.RequestDigest {
+		t.Fatalf("replacement claim was changed: %#v", preserved)
+	}
+}
+
+func TestReclaimStandaloneTaskBranchClaimAcceptsLegacyDigest(t *testing.T) {
+	ctx := context.Background()
+	controlStore, fence := newBranchClaimReclamationStore(t)
+	task := branchClaimReclamationTask("task-legacy", "prompt-legacy")
+	attemptID := createTerminalBranchClaimReclamationAttempt(t, controlStore, fence, task, store.PromptDeliveryVerifiedExact)
+	publication, claim := createStandaloneBranchClaimPublication(t, controlStore, fence, task, store.PublicationVerifiedExact)
+	if err := controlStore.ReclaimBranchClaim(ctx, store.ReclaimBranchClaimRequest{
+		ID: claim.ID, Fence: fence, ExpectedVersion: claim.Version, ExpectedGeneration: claim.Generation,
+		ExpectedRepositoryID: claim.RepositoryID, ExpectedRef: claim.Ref,
+		ExpectedOwnerKind: claim.OwnerKind, ExpectedOwnerUID: claim.OwnerUID,
+		ExpectedLastVerified: claim.LastVerified, ExpectedAvailability: claim.Availability,
+		ExpectedRequestDigest: claim.RequestDigest,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	legacyDigest, err := legacyBranchClaimRequestDigest(
+		claim.RepositoryID, claim.Ref, claim.OwnerKind, claim.OwnerUID, publication.Baseline,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	legacy, err := controlStore.CreateBranchClaim(ctx, &store.BranchClaim{
+		RepositoryID: claim.RepositoryID, Ref: claim.Ref, OwnerKind: claim.OwnerKind, OwnerUID: claim.OwnerUID,
+		LastVerified: publication.Baseline, RequestDigest: legacyDigest, CreatedAt: time.Now().UTC(),
+	}, fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	publication.BranchClaimGeneration = legacy.Generation
+	dispatcher := &ACPDispatcher{Store: controlStore}
+	if err := dispatcher.reclaimStandaloneTaskBranchClaim(ctx, task, attemptID, fence, publication); err != nil {
+		t.Fatalf("reclaim legacy claim: %v", err)
+	}
+	if _, err := controlStore.GetBranchClaim(ctx, legacy.ID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("legacy claim remains: %v", err)
+	}
+}
+
+func TestEnsureBranchClaimAcceptsLegacyDigestOnlyForPersistedPublication(t *testing.T) {
+	ctx := context.Background()
+	controlStore, fence := newBranchClaimReclamationStore(t)
+	task := branchClaimReclamationTask("task-legacy-admission", "prompt-legacy-admission")
+	target := publisher.Repository{ID: "github.com/orka/legacy-target"}
+	ref := "refs/heads/legacy-admission"
+	baseline := store.RemoteRefState{Absent: true}
+	legacyDigest, err := legacyBranchClaimRequestDigest(target.ID, ref, store.BranchClaimOwnerTask, string(task.UID), baseline)
+	if err != nil {
+		t.Fatal(err)
+	}
+	legacy, err := controlStore.CreateBranchClaim(ctx, &store.BranchClaim{
+		RepositoryID: target.ID, Ref: ref, OwnerKind: store.BranchClaimOwnerTask, OwnerUID: string(task.UID),
+		LastVerified: baseline, RequestDigest: legacyDigest, CreatedAt: time.Now().UTC(),
+	}, fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	incarnation := publicationIDForTask(task)
+	dispatcher := &ACPDispatcher{Store: controlStore}
+	if _, _, err := dispatcher.ensureBranchClaim(
+		ctx, fence, target, ref, store.BranchClaimOwnerTask, string(task.UID), baseline, incarnation,
+	); err == nil {
+		t.Fatal("legacy claim without a persisted publication was admitted")
+	}
+	persisted := &store.Publication{
+		ID: incarnation, TaskUID: string(task.UID), BranchClaimID: legacy.ID, BranchClaimGeneration: legacy.Generation,
+		TargetRepositoryID: target.ID, TargetRef: ref, Baseline: baseline,
+	}
+	dispatcher.Store = &recoveredPublicationStore{DurableControlStore: controlStore, publication: persisted}
+	got, created, err := dispatcher.ensureBranchClaim(
+		ctx, fence, target, ref, store.BranchClaimOwnerTask, string(task.UID), baseline, incarnation,
+	)
+	if err != nil || created || got.ID != legacy.ID {
+		t.Fatalf("persisted legacy admission = claim %#v created %t err %v", got, created, err)
+	}
+}
+
+func TestReclaimStandaloneTaskBranchClaimWaitsForEffectsAndPreservesSessions(t *testing.T) {
+	ctx := context.Background()
+	controlStore, fence := newBranchClaimReclamationStore(t)
+	task := branchClaimReclamationTask("task-effects", "prompt-effects")
+	attemptID := createTerminalBranchClaimReclamationAttempt(t, controlStore, fence, task, store.PromptDeliveryConflict)
+	publication, claim := createStandaloneBranchClaimPublication(t, controlStore, fence, task, store.PublicationPreparationFailed)
+	identity := store.ExternalEffectIdentity{
+		Kind: "publisher.prepare", Namespace: task.Namespace, AggregateID: publication.ID,
+		OperationID: publicationOperationID("prepare", task),
+	}
+	effect, err := controlStore.ReserveExternalEffect(ctx, store.ReserveExternalEffectRequest{
+		Identity: identity, RequestDigest: testControlDigestForDispatcher("pending-effect"), Fence: fence, CreatedAt: time.Now().UTC(),
+	})
+	if err != nil {
+		t.Fatalf("ReserveExternalEffect: %v", err)
+	}
+	dispatcher := &ACPDispatcher{Store: controlStore}
+	if err := dispatcher.reclaimStandaloneTaskBranchClaim(ctx, task, attemptID, fence, publication); err == nil || !strings.Contains(err.Error(), "has not settled") {
+		t.Fatalf("reclaim with pending effect error = %v, want unsettled error", err)
+	}
+	if _, err := controlStore.GetBranchClaim(ctx, claim.ID); err != nil {
+		t.Fatalf("pending effect allowed claim deletion: %v", err)
+	}
+	if _, err := controlStore.TransitionExternalEffect(ctx, store.ExternalEffectTransition{
+		ID: effect.ID, Fence: fence, ExpectedVersion: effect.Version, ExpectedState: effect.State,
+		NewState: store.ExternalEffectFailed, RequestDigest: effect.RequestDigest, UpdatedAt: time.Now().UTC(),
+	}); err != nil {
+		t.Fatalf("TransitionExternalEffect(failed): %v", err)
+	}
+	if err := dispatcher.reclaimStandaloneTaskBranchClaim(ctx, task, attemptID, fence, publication); err != nil {
+		t.Fatalf("reclaim after effect settled: %v", err)
+	}
+	if _, err := controlStore.GetBranchClaim(ctx, claim.ID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("GetBranchClaim after settled reclaim error = %v, want ErrNotFound", err)
+	}
+
+	sessionTask := branchClaimReclamationTask("task-session", "prompt-session")
+	sessionAttemptID := createTerminalBranchClaimReclamationAttempt(t, controlStore, fence, sessionTask, store.PromptDeliveryVerifiedExact)
+	sessionPublication, sessionClaim := createStandaloneBranchClaimPublication(t, controlStore, fence, sessionTask, store.PublicationVerifiedExact)
+	sessionPublication.SessionUID = "session-owner"
+	if err := controlStore.ReclaimBranchClaim(ctx, store.ReclaimBranchClaimRequest{
+		ID: sessionClaim.ID, Fence: fence, ExpectedVersion: sessionClaim.Version, ExpectedGeneration: sessionClaim.Generation,
+		ExpectedRepositoryID: sessionClaim.RepositoryID, ExpectedRef: sessionClaim.Ref,
+		ExpectedOwnerKind: store.BranchClaimOwnerTask, ExpectedOwnerUID: sessionClaim.OwnerUID,
+		ExpectedLastVerified: sessionClaim.LastVerified, ExpectedAvailability: sessionClaim.Availability,
+		ExpectedRequestDigest: sessionClaim.RequestDigest,
+	}); err != nil {
+		t.Fatalf("remove temporary Task claim before Session fixture: %v", err)
+	}
+	sessionDigest, err := branchClaimRequestDigest(
+		sessionPublication.TargetRepositoryID, sessionPublication.TargetRef, store.BranchClaimOwnerSession,
+		sessionPublication.SessionUID, sessionPublication.Baseline, "",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	sessionClaim, err = controlStore.CreateBranchClaim(ctx, &store.BranchClaim{
+		RepositoryID: sessionPublication.TargetRepositoryID, Ref: sessionPublication.TargetRef,
+		OwnerKind: store.BranchClaimOwnerSession, OwnerUID: sessionPublication.SessionUID,
+		LastVerified: sessionPublication.Baseline, RequestDigest: sessionDigest, CreatedAt: time.Now().UTC(),
+	}, fence)
+	if err != nil {
+		t.Fatalf("CreateBranchClaim(session): %v", err)
+	}
+	if err := dispatcher.reclaimStandaloneTaskBranchClaim(ctx, sessionTask, sessionAttemptID, fence, sessionPublication); err != nil {
+		t.Fatalf("Session-owned reclamation should be a no-op: %v", err)
+	}
+	if _, err := controlStore.GetBranchClaim(ctx, sessionClaim.ID); err != nil {
+		t.Fatalf("Session-owned claim was removed: %v", err)
+	}
+}
+
+func TestReclaimStandaloneTaskBranchClaimPreservesOutcomeUnknown(t *testing.T) {
+	ctx := context.Background()
+	controlStore, fence := newBranchClaimReclamationStore(t)
+	task := branchClaimReclamationTask("task-unknown", "prompt-unknown")
+	publication, claim := createStandaloneBranchClaimPublication(t, controlStore, fence, task, store.PublicationOutcomeUnknown)
+	dispatcher := &ACPDispatcher{Store: controlStore}
+
+	if err := dispatcher.reclaimStandaloneTaskBranchClaim(ctx, task, "", fence, publication); err != nil {
+		t.Fatalf("reclaimStandaloneTaskBranchClaim: %v", err)
+	}
+	if _, err := controlStore.GetBranchClaim(ctx, claim.ID); err != nil {
+		t.Fatalf("outcome-unknown claim was removed: %v", err)
+	}
+}
+
+func TestUnpublishedBranchClaimCleanupReclaimsOnlyCreationWonByCaller(t *testing.T) {
+	ctx := context.Background()
+	controlStore, fence := newBranchClaimReclamationStore(t)
+	dispatcher := &ACPDispatcher{Store: controlStore}
+	target := publisher.Repository{ID: "github.com/orka/session-target"}
+	ref := "refs/heads/orka/session-cleanup"
+	baseline := store.RemoteRefState{Absent: true}
+	claim, created, err := dispatcher.ensureBranchClaim(
+		ctx, fence, target, ref, store.BranchClaimOwnerSession, "session-cleanup", baseline, "pub-session-cleanup",
+	)
+	if err != nil || !created {
+		t.Fatalf("ensureBranchClaim() = claim %#v created %t err %v", claim, created, err)
+	}
+	cause := errors.New("publication preflight failed")
+	if got := dispatcher.withUnpublishedBranchClaimCleanup(ctx, fence, claim, claim.RequestDigest, "pub-session-cleanup", cause); !errors.Is(got, cause) {
+		t.Fatalf("cleanup error = %v, want original cause", got)
+	}
+	if _, err := controlStore.GetBranchClaim(ctx, claim.ID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("new unpublished Session claim remains: %v", err)
+	}
+
+	existing, existingCreated, err := dispatcher.ensureBranchClaim(
+		ctx, fence, target, ref, store.BranchClaimOwnerSession, "session-cleanup", baseline, "pub-session-retry",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !existingCreated {
+		t.Fatal("recreated Session claim was not reported as a new insertion")
+	}
+	idempotent, idempotentCreated, err := dispatcher.ensureBranchClaim(
+		ctx, fence, target, ref, store.BranchClaimOwnerSession, "session-cleanup", baseline, "pub-session-retry",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if idempotentCreated {
+		t.Fatal("idempotent Session claim lookup incorrectly reported a new insertion")
+	}
+	if got := dispatcher.withUnpublishedBranchClaimCleanup(ctx, fence, idempotent, idempotent.RequestDigest, "pub-session-retry", cause); !errors.Is(got, cause) {
+		t.Fatalf("existing cleanup error = %v, want original cause", got)
+	}
+	if _, err := controlStore.GetBranchClaim(ctx, existing.ID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("same-incarnation Session claim was not reclaimed on retry: %v", err)
+	}
+
+	taskClaim, taskCreated, err := dispatcher.ensureBranchClaim(
+		ctx, fence, publisher.Repository{ID: "github.com/orka/task-target"}, "refs/heads/orka/task-cleanup",
+		store.BranchClaimOwnerTask, "task-cleanup", baseline, "pub-task-cleanup",
+	)
+	if err != nil || !taskCreated {
+		t.Fatalf("ensure task claim = %#v created %t err %v", taskClaim, taskCreated, err)
+	}
+	if got := dispatcher.withUnpublishedBranchClaimCleanup(ctx, fence, taskClaim, taskClaim.RequestDigest, "pub-task-cleanup", cause); !errors.Is(got, cause) {
+		t.Fatalf("Task cleanup error = %v, want original cause", got)
+	}
+	if _, err := controlStore.GetBranchClaim(ctx, taskClaim.ID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("new unpublished Task claim remains: %v", err)
+	}
+}
+
+func TestPersistedPublicationRecoveryFinishesAfterStandaloneClaimReclaimed(t *testing.T) {
+	ctx := context.Background()
+	controlStore, fence := newBranchClaimReclamationStore(t)
+	task := branchClaimReclamationTask("task-recovery", "prompt-recovery")
+	task.Spec.Workspace = &corev1alpha1.WorkspaceConfig{
+		Intent:  corev1alpha1.WorkspaceIntentWrite,
+		GitRepo: "https://github.com/orka/source.git", PublicationGitRepo: "https://github.com/orka/target.git",
+		PublicationCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "publish-secret"},
+	}
+	attemptID := createTerminalBranchClaimReclamationAttempt(t, controlStore, fence, task, store.PromptDeliveryVerifiedExact)
+	publication, _ := createStandaloneBranchClaimPublication(t, controlStore, fence, task, store.PublicationVerifiedExact)
+	publication.SourceRepositoryID = "github.com/orka/source"
+	publication.SourceRef = strings.Repeat("b", 40)
+	publication.SourceBaselineSHA = publication.SourceRef
+	publication.ArtifactID = "artifact-recovery"
+	publication.ArtifactDigest = testControlDigestForDispatcher("artifact-recovery")
+	publication.ArtifactSizeBytes = 64
+	publication.ArtifactMediaType = "application/vnd.orka.workspace-delta"
+	dispatcher := &ACPDispatcher{Store: controlStore}
+	if err := dispatcher.reclaimStandaloneTaskBranchClaim(ctx, task, attemptID, fence, publication); err != nil {
+		t.Fatalf("initial claim reclamation: %v", err)
+	}
+
+	recoveryStore := &recoveredPublicationStore{DurableControlStore: controlStore, publication: publication}
+	dispatcher.Store = recoveryStore
+	result, err := dispatcher.reconcilePersistedPublication(ctx, task, attemptID, fence)
+	if err != nil {
+		t.Fatalf("reconcilePersistedPublication after claim reclamation: %v", err)
+	}
+	if result.PublicationID != publication.ID || result.Status.Outcome != corev1alpha1.TaskDeliveryOutcomeVerifiedExact {
+		t.Fatalf("recovered result = %#v", result)
+	}
+}
+
+func TestLoadPersistedPublicationRecoveryUsesContinuationTargetSource(t *testing.T) {
+	ctx := context.Background()
+	controlStore, fence := newBranchClaimReclamationStore(t)
+	task := branchClaimReclamationTask("task-continuation-recovery", "prompt-continuation-recovery")
+	task.Spec.Workspace = &corev1alpha1.WorkspaceConfig{
+		Intent:                       corev1alpha1.WorkspaceIntentWrite,
+		GitRepo:                      "https://github.com/orka/upstream.git",
+		ReadCredentialRef:            &corev1alpha1.WorkspaceCredentialReference{Name: "source-read"},
+		PublicationGitRepo:           "https://github.com/orka/fork.git",
+		PublicationReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: targetReadCredentialName},
+		PublicationCredentialRef:     &corev1alpha1.WorkspaceCredentialReference{Name: "target-write"},
+		ForgeCredentialRef:           &corev1alpha1.WorkspaceCredentialReference{Name: "forge-only"},
+	}
+	task.Spec.SessionRef = &corev1alpha1.SessionReference{Name: "continuation", Append: true}
+	target, err := workspacePublicationRepository(task.Spec.Workspace)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ref := "refs/heads/orka/session-continuation"
+	baseline := store.RemoteRefState{SHA: strings.Repeat("a", 40)}
+	digest, err := branchClaimRequestDigest(target.ID, ref, store.BranchClaimOwnerSession, "session-continuation", baseline, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	claim, err := controlStore.CreateBranchClaim(ctx, &store.BranchClaim{
+		RepositoryID: target.ID, Ref: ref, OwnerKind: store.BranchClaimOwnerSession, OwnerUID: "session-continuation",
+		LastVerified: baseline, RequestDigest: digest, CreatedAt: time.Now().UTC(),
+	}, fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	publication := &store.Publication{
+		ID: publicationIDForTask(task), Namespace: task.Namespace, Generation: 1,
+		TaskUID: string(task.UID), Attempt: 1, PromptID: task.Status.Execution.PromptID,
+		SessionUID: "session-continuation", BranchClaimID: claim.ID, BranchClaimGeneration: claim.Generation,
+		SourceRepositoryID: target.ID, SourceRef: baseline.SHA, SourceBaselineSHA: baseline.SHA,
+		TargetRepositoryID: target.ID, TargetRef: ref, Baseline: baseline,
+		PublicationCredentialRef: "target-write", State: store.PublicationPrepared,
+		PRIntent: &store.PullRequestIntent{
+			BaseRepositoryID: "github.com/orka/upstream", BaseRef: "refs/heads/main",
+			HeadRepositoryID: target.ID, HeadRef: ref, PublicationGeneration: 1, ExpectedHeadSHA: baseline.SHA,
+		},
+	}
+	dispatcher := &ACPDispatcher{Store: &recoveredPublicationStore{
+		DurableControlStore: controlStore, publication: publication,
+		sessionControl: &store.SessionControl{
+			Namespace: task.Namespace, SessionName: task.Spec.SessionRef.Name, SessionUID: publication.SessionUID,
+			VerifiedBaseline: &store.VerifiedBranchBaseline{RepositoryID: target.ID, Ref: ref, SHA: baseline.SHA},
+		},
+	}}
+	_, recovery, err := dispatcher.loadPersistedPublicationRecovery(ctx, task, "attempt-unused", fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if recovery.source.ID != target.ID || recovery.pullRequestBase.ID != "github.com/orka/upstream" ||
+		recovery.sourceCredential == nil || recovery.sourceCredential.Name != targetReadCredentialName || recovery.sourceCredential.Role != publisherservice.CredentialRoleTargetRead ||
+		recovery.targetReadCredential == nil || recovery.targetReadCredential.Role != publisherservice.CredentialRoleTargetRead ||
+		recovery.writeCredential == nil || recovery.writeCredential.Role != publisherservice.CredentialRoleTargetWrite ||
+		recovery.forgeCredential == nil || recovery.forgeCredential.Name != "forge-only" ||
+		recovery.forgeCredential.Kind != publisherservice.CredentialForgeToken || recovery.forgeCredential.Role != publisherservice.CredentialRoleForge {
+		t.Fatalf("continuation recovery = source %#v base %#v source credential %#v forge credential %#v", recovery.source, recovery.pullRequestBase, recovery.sourceCredential, recovery.forgeCredential)
+	}
+}
+
+func TestLoadPersistedPublicationRecoveryUsesTargetReadForSameRepositoryContinuation(t *testing.T) {
+	ctx := context.Background()
+	controlStore, fence := newBranchClaimReclamationStore(t)
+	task := branchClaimReclamationTask("task-same-repo-continuation", "prompt-same-repo-continuation")
+	task.Spec.SessionRef = &corev1alpha1.SessionReference{Name: "same-repo", Append: true}
+	task.Spec.Workspace = &corev1alpha1.WorkspaceConfig{
+		Intent: corev1alpha1.WorkspaceIntentWrite, GitRepo: "https://github.com/orka/repo.git",
+		ReadCredentialRef:            &corev1alpha1.WorkspaceCredentialReference{Name: "source-read"},
+		PublicationGitRepo:           "https://github.com/orka/repo.git",
+		PublicationReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: targetReadCredentialName},
+		PublicationCredentialRef:     &corev1alpha1.WorkspaceCredentialReference{Name: "target-write"},
+	}
+	repository, err := workspacePublicationRepository(task.Spec.Workspace)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ref := "refs/heads/orka/same-repo"
+	baseline := store.RemoteRefState{SHA: strings.Repeat("a", 40)}
+	digest, err := branchClaimRequestDigest(repository.ID, ref, store.BranchClaimOwnerSession, "session-same-repo", baseline, publicationIDForTask(task))
+	if err != nil {
+		t.Fatal(err)
+	}
+	claim, err := controlStore.CreateBranchClaim(ctx, &store.BranchClaim{
+		RepositoryID: repository.ID, Ref: ref, OwnerKind: store.BranchClaimOwnerSession, OwnerUID: "session-same-repo",
+		LastVerified: baseline, RequestDigest: digest, CreatedAt: time.Now().UTC(),
+	}, fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	publication := &store.Publication{
+		ID: publicationIDForTask(task), Namespace: task.Namespace, Generation: 1,
+		TaskUID: string(task.UID), Attempt: 1, PromptID: task.Status.Execution.PromptID, SessionUID: "session-same-repo",
+		BranchClaimID: claim.ID, BranchClaimGeneration: claim.Generation,
+		SourceRepositoryID: repository.ID, SourceRef: baseline.SHA, SourceBaselineSHA: baseline.SHA,
+		TargetRepositoryID: repository.ID, TargetRef: ref, Baseline: baseline,
+		PublicationCredentialRef: "target-write", State: store.PublicationPrepared,
+	}
+	dispatcher := &ACPDispatcher{Store: &recoveredPublicationStore{
+		DurableControlStore: controlStore, publication: publication,
+		sessionControl: &store.SessionControl{
+			Namespace: task.Namespace, SessionName: task.Spec.SessionRef.Name, SessionUID: publication.SessionUID,
+			VerifiedBaseline: &store.VerifiedBranchBaseline{RepositoryID: repository.ID, Ref: ref, SHA: baseline.SHA},
+		},
+	}}
+	_, recovery, err := dispatcher.loadPersistedPublicationRecovery(ctx, task, "attempt-unused", fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if recovery.sourceCredential == nil || recovery.sourceCredential.Name != targetReadCredentialName ||
+		recovery.sourceCredential.Role != publisherservice.CredentialRoleTargetRead {
+		t.Fatalf("same-repository continuation source credential = %#v", recovery.sourceCredential)
+	}
+}
+
+func TestLoadPersistedPublicationRecoveryRejectsMissingOutcomeUnknownClaim(t *testing.T) {
+	ctx := context.Background()
+	controlStore, fence := newBranchClaimReclamationStore(t)
+	task := branchClaimReclamationTask("task-missing-unknown", "prompt-missing-unknown")
+	task.Spec.Workspace = &corev1alpha1.WorkspaceConfig{
+		Intent: corev1alpha1.WorkspaceIntentWrite, GitRepo: "https://github.com/orka/source.git",
+		PublicationGitRepo:       "https://github.com/orka/target.git",
+		PublicationCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "target-write"},
+	}
+	publication := &store.Publication{
+		ID: publicationIDForTask(task), Namespace: task.Namespace, Generation: 1,
+		TaskUID: string(task.UID), Attempt: 1, PromptID: task.Status.Execution.PromptID,
+		BranchClaimID: "missing-claim", BranchClaimGeneration: 1,
+		SourceRepositoryID: "github.com/orka/source", TargetRepositoryID: "github.com/orka/target",
+		State: store.PublicationOutcomeUnknown,
+	}
+	dispatcher := &ACPDispatcher{Store: &recoveredPublicationStore{DurableControlStore: controlStore, publication: publication}}
+	if _, _, err := dispatcher.loadPersistedPublicationRecovery(ctx, task, "attempt-unused", fence); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("missing outcome-unknown claim error = %v, want ErrNotFound", err)
+	}
+}
+
+func newBranchClaimReclamationStore(t *testing.T) (*sqlite.Store, store.ControllerEpochFence) {
+	t.Helper()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "store.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	controlStore := sqlite.NewStore(db, "test")
+	epoch, err := controlStore.CompareAndSwapControllerEpoch(context.Background(), store.ControllerEpochCAS{
+		ExpectedVersion: 0, ExpectedEpoch: 0, NewEpoch: 1, HolderID: "controller-test",
+		RequestDigest: testControlDigestForDispatcher("branch-reclaim-epoch"), UpdatedAt: time.Now().UTC(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return controlStore, store.ControllerEpochFence{Name: epoch.Name, Epoch: epoch.Epoch, HolderID: epoch.HolderID}
+}
+
+func branchClaimReclamationTask(uid, promptID string) *corev1alpha1.Task {
+	return &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: uid, UID: types.UID(uid)},
+		Status: corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{
+			Attempt: 1, PromptID: promptID, RequestDigest: testControlDigestForDispatcher("prompt-" + uid),
+		}},
+	}
+}
+
+func createTerminalBranchClaimReclamationAttempt(
+	t *testing.T,
+	controlStore *sqlite.Store,
+	fence store.ControllerEpochFence,
+	task *corev1alpha1.Task,
+	terminalDelivery store.PromptDeliveryState,
+) string {
+	t.Helper()
+	key := store.PromptAttemptKey{
+		Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: int64(task.Status.Execution.Attempt), PromptID: task.Status.Execution.PromptID,
+	}
+	attemptID, err := key.CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	attempt, err := controlStore.CreatePromptAttempt(context.Background(), boundPromptAttemptForTest(&store.PromptAttempt{
+		ID: attemptID, Key: key, RequestDigest: task.Status.Execution.RequestDigest,
+	}), fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	attempt = completeACPAttemptExecutionForTest(t, controlStore, fence, attempt, false)
+	path := []store.PromptDeliveryState{store.PromptDeliveryValidating}
+	switch terminalDelivery {
+	case store.PromptDeliveryVerifiedExact:
+		path = append(path, store.PromptDeliveryPreparing, store.PromptDeliveryPrepared, store.PromptDeliveryPublishing, store.PromptDeliveryVerifying, terminalDelivery)
+	case store.PromptDeliveryConflict:
+		path = append(path, store.PromptDeliveryPreparing, terminalDelivery)
+	default:
+		t.Fatalf("unsupported terminal delivery fixture %s", terminalDelivery)
+	}
+	for _, next := range path {
+		updated, transitionErr := controlStore.TransitionPromptAttemptDelivery(context.Background(), store.PromptAttemptDeliveryTransition{
+			ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.DeliveryState, NewState: next,
+			OperationID:     "delivery-" + strings.ToLower(string(next)) + "-" + string(task.UID),
+			OperationDigest: testControlDigestForDispatcher("delivery-" + string(next) + "-" + string(task.UID)), UpdatedAt: time.Now().UTC(),
+		})
+		if transitionErr != nil {
+			t.Fatalf("transition delivery to %s: %v", next, transitionErr)
+		}
+		attempt = updated
+	}
+	return attemptID
+}
+
+func createStandaloneBranchClaimPublication(
+	t *testing.T,
+	controlStore store.BranchClaimStore,
+	fence store.ControllerEpochFence,
+	task *corev1alpha1.Task,
+	state store.PublicationState,
+) (*store.Publication, *store.BranchClaim) {
+	t.Helper()
+	targetRepositoryID := "github.com/orka/target"
+	targetRef := "refs/heads/shared-" + string(task.UID)
+	baseline := store.RemoteRefState{Absent: true}
+	publicationID := publicationIDForTask(task)
+	requestDigest, err := branchClaimRequestDigest(
+		targetRepositoryID, targetRef, store.BranchClaimOwnerTask, string(task.UID), baseline, publicationID,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	claim, err := controlStore.CreateBranchClaim(context.Background(), &store.BranchClaim{
+		RepositoryID: targetRepositoryID, Ref: targetRef, OwnerKind: store.BranchClaimOwnerTask, OwnerUID: string(task.UID),
+		LastVerified: baseline, RequestDigest: requestDigest, CreatedAt: time.Now().UTC(),
+	}, fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	publication := &store.Publication{
+		ID: publicationID, Namespace: task.Namespace, Generation: 1,
+		TaskUID: string(task.UID), Attempt: int64(task.Status.Execution.Attempt), PromptID: task.Status.Execution.PromptID,
+		BranchClaimID: claim.ID, BranchClaimGeneration: claim.Generation,
+		TargetRepositoryID: targetRepositoryID, TargetRef: targetRef, Baseline: baseline, State: state,
+	}
+	if state == store.PublicationVerifiedExact {
+		publication.VerificationReceipt = &store.PublicationVerificationReceipt{
+			Outcome: state, ObservedRemote: store.RemoteRefState{SHA: strings.Repeat("a", 40)},
+		}
+	}
+	return publication, claim
+}
+
+type persistPublicationThenErrorStore struct {
+	store.DurableControlStore
+	failed bool
+}
+
+func (s *persistPublicationThenErrorStore) CreatePublication(
+	ctx context.Context,
+	publication *store.Publication,
+	fence store.ControllerEpochFence,
+) (*store.Publication, error) {
+	created, err := s.DurableControlStore.CreatePublication(ctx, publication, fence)
+	if err != nil || s.failed {
+		return created, err
+	}
+	s.failed = true
+	return nil, errors.New("simulated lost Publication create acknowledgement")
+}
diff --git a/internal/controller/acp_publication_recovery.go b/internal/controller/acp_publication_recovery.go
new file mode 100644
index 000000000..5cb84eea4
--- /dev/null
+++ b/internal/controller/acp_publication_recovery.go
@@ -0,0 +1,483 @@
+package controller
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/publisher"
+	publisherservice "github.com/orka-agents/orka/internal/publisher/service"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+type persistedPublicationRecoveryContext struct {
+	task                 *corev1alpha1.Task
+	attemptID            string
+	fence                store.ControllerEpochFence
+	workspace            *corev1alpha1.WorkspaceConfig
+	source               publisher.Repository
+	pullRequestBase      publisher.Repository
+	target               publisher.Repository
+	sourceCredential     *publisherservice.CredentialReference
+	targetReadCredential *publisherservice.CredentialReference
+	writeCredential      *publisherservice.CredentialReference
+	forgeCredential      *publisherservice.CredentialReference
+	claim                *store.BranchClaim
+	artifact             harnessv2.ArtifactReference
+}
+
+// reconcilePersistedPublication resumes only the immutable Publication already
+// attached to a successfully settled prompt. It never allocates a new prompt or
+// Publication identity.
+func (d *ACPDispatcher) reconcilePersistedPublication(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attemptID string,
+	fence store.ControllerEpochFence,
+) (acpPublicationResult, error) {
+	publication, recovery, err := d.loadPersistedPublicationRecovery(ctx, task, attemptID, fence)
+	if err != nil {
+		return acpPublicationResult{}, err
+	}
+	for step := 0; step < 5 && !store.IsTerminalPublicationState(publication.State); step++ {
+		publication, err = d.reconcilePersistedPublicationStep(ctx, publication, recovery)
+		if err != nil {
+			return acpPublicationResult{}, err
+		}
+	}
+	return d.finishPersistedPublicationRecovery(ctx, publication, recovery)
+}
+
+func (d *ACPDispatcher) loadPersistedPublicationRecovery(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attemptID string,
+	fence store.ControllerEpochFence,
+) (*store.Publication, persistedPublicationRecoveryContext, error) {
+	publication, err := d.Store.GetPublication(ctx, publicationIDForTask(task))
+	if err != nil {
+		return nil, persistedPublicationRecoveryContext{}, err
+	}
+	claim, err := d.Store.GetBranchClaim(ctx, publication.BranchClaimID)
+	if err != nil {
+		if !errors.Is(err, store.ErrNotFound) || publication.SessionUID != "" || !store.IsTerminalPublicationState(publication.State) ||
+			publication.State == store.PublicationOutcomeUnknown {
+			return nil, persistedPublicationRecoveryContext{}, err
+		}
+		claim = nil
+	}
+	workspace := task.Spec.Workspace
+	if workspace == nil || workspace.PublicationCredentialRef == nil {
+		return nil, persistedPublicationRecoveryContext{}, fmt.Errorf("persisted publication workspace credentials are unavailable")
+	}
+	source, err := workspaceRepository(workspace)
+	if err != nil {
+		return nil, persistedPublicationRecoveryContext{}, err
+	}
+	target, err := workspacePublicationRepository(workspace)
+	if err != nil {
+		return nil, persistedPublicationRecoveryContext{}, err
+	}
+	pullRequestBase := source
+	sourceCredential := publisherCredentialReference(workspace.ReadCredentialRef, publisherservice.CredentialRoleSourceRead)
+	continuation := false
+	if publication.SessionUID != "" {
+		if task.Spec.SessionRef == nil || strings.TrimSpace(task.Spec.SessionRef.Name) == "" {
+			return nil, persistedPublicationRecoveryContext{}, fmt.Errorf("persisted Session publication lacks Task session identity")
+		}
+		control, controlErr := d.Store.GetSessionControl(ctx, task.Namespace, task.Spec.SessionRef.Name)
+		if controlErr != nil {
+			return nil, persistedPublicationRecoveryContext{}, controlErr
+		}
+		if control.SessionUID != publication.SessionUID {
+			return nil, persistedPublicationRecoveryContext{}, fmt.Errorf("persisted Session publication UID drifted")
+		}
+		continuation = control.VerifiedBaseline != nil && publication.SourceRepositoryID == target.ID
+	}
+	if continuation {
+		// Continuation preparation reads from the independently verified
+		// publication target rather than the original upstream/PR base.
+		source = target
+		sourceCredential = publisherCredentialReference(workspace.PublicationReadCredentialRef, publisherservice.CredentialRoleTargetRead)
+	}
+	if source.ID != publication.SourceRepositoryID || target.ID != publication.TargetRepositoryID ||
+		(claim != nil && claim.ID != publication.BranchClaimID) {
+		return nil, persistedPublicationRecoveryContext{}, fmt.Errorf("persisted publication repository or BranchClaim identity drifted")
+	}
+	if publication.PRIntent != nil &&
+		(publication.PRIntent.BaseRepositoryID != pullRequestBase.ID || publication.PRIntent.HeadRepositoryID != target.ID) {
+		return nil, persistedPublicationRecoveryContext{}, fmt.Errorf("persisted pull request repository identity drifted")
+	}
+	return publication, persistedPublicationRecoveryContext{
+		task: task, attemptID: attemptID, fence: fence, workspace: workspace,
+		source: source, pullRequestBase: pullRequestBase, target: target,
+		sourceCredential:     sourceCredential,
+		targetReadCredential: publisherCredentialReference(workspace.PublicationReadCredentialRef, publisherservice.CredentialRoleTargetRead),
+		writeCredential:      publisherCredentialReference(workspace.PublicationCredentialRef, publisherservice.CredentialRoleTargetWrite),
+		forgeCredential:      publisherForgeCredentialReference(workspace.ForgeCredentialRef),
+		claim:                claim,
+		artifact: harnessv2.ArtifactReference{
+			ArtifactID: harnessv2.ArtifactID(publication.ArtifactID), Digest: publication.ArtifactDigest,
+			SizeBytes: publication.ArtifactSizeBytes, MediaType: publication.ArtifactMediaType,
+		},
+	}, nil
+}
+
+func (d *ACPDispatcher) reconcilePersistedPublicationStep(
+	ctx context.Context,
+	publication *store.Publication,
+	recovery persistedPublicationRecoveryContext,
+) (*store.Publication, error) {
+	switch publication.State {
+	case store.PublicationPreparing:
+		return d.recoverPublicationPreparing(ctx, publication, recovery)
+	case store.PublicationPrepared:
+		return d.recoverPublicationPrepared(ctx, publication, recovery)
+	case store.PublicationPublishing:
+		return d.recoverPublicationPublishing(ctx, publication, recovery)
+	case store.PublicationVerifying:
+		return d.recoverPublicationVerifying(ctx, publication, recovery)
+	default:
+		return nil, fmt.Errorf("publication recovery cannot resume state %s", publication.State)
+	}
+}
+
+func (d *ACPDispatcher) recoverPublicationPreparing(
+	ctx context.Context,
+	publication *store.Publication,
+	recovery persistedPublicationRecoveryContext,
+) (*store.Publication, error) {
+	if err := d.recoveryDeliveryTransition(ctx, recovery.attemptID, recovery.fence, store.PromptDeliveryValidating, store.PromptDeliveryPreparing, "recover-publication-preparing"); err != nil {
+		return nil, err
+	}
+	operation := publicationOperationID("prepare", recovery.task)
+	request := publisherservice.PublicationPrepareRequest{
+		Metadata:            publisherservice.OperationMetadata{Namespace: recovery.task.Namespace, PublicationID: publication.ID, OperationID: operation},
+		SourceCredentialRef: recovery.sourceCredential,
+		DeltaArtifact:       recovery.artifact,
+		Request: publisher.PrepareRequest{
+			PublicationID: publication.ID, PublicationGeneration: publication.Generation, OperationID: operation,
+			Source: recovery.source, SourceRef: publication.SourceRef, Target: recovery.target, TargetRef: publication.TargetRef,
+			BranchClaimGeneration: publication.BranchClaimGeneration, BaselineOID: publication.SourceBaselineSHA,
+			RemoteBefore: publisherRemoteRef(publication.Baseline), DeltaArtifactDigest: publication.ArtifactDigest,
+			RelativeRoot:  strings.TrimSpace(recovery.workspace.SubPath),
+			CommitMessage: publication.CommitMessage, CommitTimestamp: publication.CommitTimestamp,
+		},
+	}
+	identity := store.ExternalEffectIdentity{
+		Kind: "publisher.prepare", Namespace: recovery.task.Namespace, AggregateID: publication.ID, OperationID: operation,
+	}
+	response, err := runACPExternalEffect(ctx, d, recovery.fence, identity, request, func(callCtx context.Context) (publisherservice.PublicationPrepareResponse, error) {
+		return d.Publisher.PreparePublication(callCtx, request)
+	})
+	if err != nil {
+		effectID, idErr := identity.CanonicalID()
+		if idErr != nil {
+			return nil, idErr
+		}
+		effect, getErr := d.Store.GetExternalEffect(ctx, effectID)
+		if getErr != nil {
+			return nil, getErr
+		}
+		if !retryableACPExternalEffectError(err) || effect.Attempts >= 3 {
+			if settleErr := settleACPExternalEffectError(ctx, d, recovery.fence, identity, err); settleErr != nil {
+				return nil, settleErr
+			}
+			publicationState := store.PublicationPreparationFailed
+			deliveryState := store.PromptDeliveryConflict
+			reason := "publication preparation failed during recovery"
+			if retryableACPExternalEffectError(err) {
+				publicationState = store.PublicationOutcomeUnknown
+				deliveryState = store.PromptDeliveryPublicationOutcomeUnknown
+				reason = "publication preparation outcome remained unknown after bounded recovery"
+			}
+			updated, transitionErr := d.transitionPublication(ctx, publication, recovery.fence, publicationState,
+				publicationOperationID("prepare-terminal", recovery.task), mustACPDomainDigest("publication-prepare-terminal", publication.ID), nil, nil, nil, reason)
+			if transitionErr != nil {
+				return nil, transitionErr
+			}
+			if transitionErr := d.recoveryDeliveryTransition(ctx, recovery.attemptID, recovery.fence, store.PromptDeliveryPreparing, deliveryState, "recover-publication-prepare-terminal"); transitionErr != nil {
+				return nil, transitionErr
+			}
+			return updated, nil
+		}
+		return nil, err
+	}
+	prepared, err := preparedReceiptFromPublisher(response.Prepared)
+	if err != nil {
+		return nil, err
+	}
+	return d.transitionPublication(ctx, publication, recovery.fence, store.PublicationPrepared,
+		operation, response.RequestDigest, prepared, nil, nil, "")
+}
+
+func (d *ACPDispatcher) recoverPublicationPrepared(
+	ctx context.Context,
+	publication *store.Publication,
+	recovery persistedPublicationRecoveryContext,
+) (*store.Publication, error) {
+	if err := d.recoveryDeliveryTransition(ctx, recovery.attemptID, recovery.fence, store.PromptDeliveryPreparing, store.PromptDeliveryPrepared, "recover-publication-prepared"); err != nil {
+		return nil, err
+	}
+	cancelled, err := d.taskCancellationRequested(ctx, recovery.task)
+	if err != nil {
+		return nil, err
+	}
+	if !cancelled {
+		return d.transitionPublication(ctx, publication, recovery.fence, store.PublicationPublishing,
+			publicationOperationID("publishing", recovery.task), mustACPDomainDigest("publication-publishing", publication.ID), nil, nil, nil, "")
+	}
+	publication, err = d.transitionPublication(ctx, publication, recovery.fence, store.PublicationCancelledBeforePublish,
+		publicationOperationID("cancel-before-publish", recovery.task), mustACPDomainDigest("publication-cancel", publication.ID), nil, nil, nil, "")
+	if err != nil {
+		return nil, err
+	}
+	if err := d.recoveryDeliveryTransition(ctx, recovery.attemptID, recovery.fence, store.PromptDeliveryPrepared, store.PromptDeliveryCancelledBeforePublish, "recover-cancel-before-publish"); err != nil {
+		return nil, err
+	}
+	return publication, nil
+}
+
+func (d *ACPDispatcher) recoverPublicationPublishing(
+	ctx context.Context,
+	publication *store.Publication,
+	recovery persistedPublicationRecoveryContext,
+) (*store.Publication, error) {
+	if err := d.recoveryDeliveryTransition(ctx, recovery.attemptID, recovery.fence, store.PromptDeliveryPrepared, store.PromptDeliveryPublishing, "recover-publication-publishing"); err != nil {
+		return nil, err
+	}
+	if publication.PreparedReceipt == nil {
+		return nil, fmt.Errorf("persisted publishing Publication lacks prepared receipt")
+	}
+	operation := publicationOperationID("publish", recovery.task)
+	publishRequest := publisher.PublishRequest{
+		PublicationID: publication.ID, PublicationGeneration: publication.Generation, OperationID: operation,
+		Target: recovery.target, TargetRef: publication.TargetRef, Claim: publisherBranchClaim(*recovery.claim),
+		RemoteBefore: publisherRemoteRef(publication.Baseline), ExpectedCommitOID: publication.PreparedReceipt.CommitSHA,
+		BundleDigest: publication.PreparedReceipt.BundleDigest,
+	}
+	serviceRequest := publisherservice.PublicationPublishRequest{
+		Metadata:      publisherservice.OperationMetadata{Namespace: recovery.task.Namespace, PublicationID: publication.ID, OperationID: operation},
+		CredentialRef: recovery.writeCredential,
+		Prepared:      publisherPreparedFromPublication(publication, recovery.source, recovery.target),
+		Request:       publishRequest,
+	}
+	response, callErr := runACPExternalEffect(ctx, d, recovery.fence, store.ExternalEffectIdentity{
+		Kind: "publisher.publish", Namespace: recovery.task.Namespace, AggregateID: publication.ID, OperationID: operation,
+	}, serviceRequest, func(callCtx context.Context) (publisherservice.PublicationPublishResponse, error) {
+		return d.Publisher.Publish(callCtx, serviceRequest)
+	})
+	receipt := &store.PublishOperationReceipt{
+		OperationID: operation, RequestDigest: mustACPDomainDigest("publisher-publish", publishRequest),
+		TargetRepositoryID: recovery.target.ID, TargetRef: publication.TargetRef, RemoteBefore: publication.Baseline,
+		ExpectedCommitSHA: publication.PreparedReceipt.CommitSHA, AcknowledgementUnknown: callErr != nil, PublishedAt: time.Now().UTC(),
+	}
+	if callErr == nil {
+		receipt.OperationID, receipt.RequestDigest = response.Receipt.OperationID, response.Receipt.RequestDigest
+		receipt.AcknowledgementUnknown = response.Receipt.Outcome == publisher.PublishOutcomeUnknown
+	}
+	return d.transitionPublication(ctx, publication, recovery.fence, store.PublicationVerifying,
+		receipt.OperationID, receipt.RequestDigest, nil, receipt, nil, "")
+}
+
+func (d *ACPDispatcher) recoverPublicationVerifying(
+	ctx context.Context,
+	publication *store.Publication,
+	recovery persistedPublicationRecoveryContext,
+) (*store.Publication, error) {
+	if err := d.recoveryDeliveryTransition(ctx, recovery.attemptID, recovery.fence, store.PromptDeliveryPublishing, store.PromptDeliveryVerifying, "recover-publication-verifying"); err != nil {
+		return nil, err
+	}
+	if publication.PreparedReceipt == nil {
+		return nil, fmt.Errorf("persisted verifying Publication lacks prepared receipt")
+	}
+	operation := publicationOperationID("verify", recovery.task)
+	verifyRequest := publisherservice.PublicationVerifyRequest{
+		Metadata:      publisherservice.OperationMetadata{Namespace: recovery.task.Namespace, PublicationID: publication.ID, OperationID: operation},
+		CredentialRef: recovery.targetReadCredential,
+		Prepared:      publisherPreparedFromPublication(publication, recovery.source, recovery.target),
+		Request: publisher.VerifyRequest{
+			PublicationID: publication.ID, PublicationGeneration: publication.Generation, OperationID: operation,
+			Target: recovery.target, TargetRef: publication.TargetRef, Claim: publisherBranchClaim(*recovery.claim),
+			ExpectedCommitOID: publication.PreparedReceipt.CommitSHA, BundleDigest: publication.PreparedReceipt.BundleDigest,
+		},
+	}
+	response, callErr := runACPExternalEffect(ctx, d, recovery.fence, store.ExternalEffectIdentity{
+		Kind: "publisher.verify", Namespace: recovery.task.Namespace, AggregateID: publication.ID, OperationID: operation,
+	}, verifyRequest, func(callCtx context.Context) (publisherservice.PublicationVerifyResponse, error) {
+		return d.Publisher.Verify(callCtx, verifyRequest)
+	})
+	verification := &store.PublicationVerificationReceipt{
+		OperationID: operation, RequestDigest: mustACPDomainDigest("publisher-verify-unknown", publication.ID),
+		Outcome: store.PublicationOutcomeUnknown, ExpectedCommitSHA: publication.PreparedReceipt.CommitSHA,
+		ObservedRemote: store.RemoteRefState{}, VerifiedAt: time.Now().UTC(),
+	}
+	reason := "publication remote outcome could not be independently observed after restart"
+	if callErr == nil {
+		verification = storeVerificationReceipt(response.Receipt)
+		if verification.Outcome == store.PublicationVerifiedExact || verification.Outcome == store.PublicationDeliveredSuperseded {
+			reason = ""
+		}
+	} else if err := settleACPExternalEffect(ctx, d, recovery.fence, store.ExternalEffectIdentity{
+		Kind: "publisher.verify", Namespace: recovery.task.Namespace, AggregateID: publication.ID, OperationID: operation,
+	}, store.ExternalEffectOutcomeUnknown, nil); err != nil {
+		return nil, err
+	}
+	if publication.PublishReceipt != nil && publication.PublishReceipt.AcknowledgementUnknown {
+		publishOperation := publicationOperationID("publish", recovery.task)
+		publishIdentity := store.ExternalEffectIdentity{Kind: "publisher.publish", Namespace: recovery.task.Namespace, AggregateID: publication.ID, OperationID: publishOperation}
+		if verification.Outcome == store.PublicationVerifiedExact || verification.Outcome == store.PublicationDeliveredSuperseded {
+			reconciled := publisherservice.PublicationPublishResponse{
+				OperationID: publishOperation, RequestDigest: publication.PublishReceipt.RequestDigest,
+				Receipt: publisher.PublishReceipt{
+					PublicationID: publication.ID, PublicationGeneration: publication.Generation,
+					OperationID: publishOperation, RequestDigest: publication.PublishReceipt.RequestDigest, Outcome: publisher.PublishAcknowledged,
+					TargetRepositoryID: recovery.target.ID, TargetRef: publication.TargetRef,
+					RemoteBefore: publisherRemoteRef(publication.Baseline), ExpectedCommitOID: publication.PreparedReceipt.CommitSHA,
+					ObservedRemote: publisher.RemoteRef{OID: publication.PreparedReceipt.CommitSHA},
+				},
+			}
+			if err := settleACPExternalEffect(ctx, d, recovery.fence, publishIdentity, store.ExternalEffectSucceeded, reconciled); err != nil {
+				return nil, err
+			}
+		} else if err := settleACPExternalEffect(ctx, d, recovery.fence, publishIdentity, store.ExternalEffectOutcomeUnknown, nil); err != nil {
+			return nil, err
+		}
+	}
+	if reason == "" && recovery.workspace.CreatePR && publication.PRIntent == nil {
+		baseRef, baseErr := canonicalWorkspaceBranchRef(recovery.workspace.PRBaseBranch)
+		if baseErr != nil {
+			return nil, baseErr
+		}
+		intent := store.PullRequestIntent{
+			BaseRepositoryID: recovery.pullRequestBase.ID, BaseRef: baseRef,
+			HeadRepositoryID: recovery.target.ID, HeadRef: publication.TargetRef,
+			PublicationGeneration: publication.Generation, ExpectedHeadSHA: verification.ObservedRemote.SHA,
+		}
+		intentOperation := publicationOperationID("pr-intent", recovery.task)
+		intentDigest, digestErr := acpDomainDigest("publication-pr-intent", map[string]any{"publicationID": publication.ID, "intent": intent})
+		if digestErr != nil {
+			return nil, digestErr
+		}
+		updatedPublication, setErr := d.Store.SetPublicationPRIntent(ctx, store.SetPublicationPRIntentRequest{
+			ID: publication.ID, Fence: recovery.fence, ExpectedVersion: publication.Version, ExpectedGeneration: publication.Generation,
+			ExpectedState: store.PublicationVerifying, Intent: intent, OperationID: intentOperation,
+			OperationDigest: intentDigest, UpdatedAt: time.Now().UTC(),
+		})
+		if setErr != nil {
+			return nil, setErr
+		}
+		publication = updatedPublication
+	}
+	if reason == "" && publication.PRIntent != nil && publication.PullRequestReceipt == nil {
+		var err error
+		publication, verification, reason, err = d.recoverPublicationPullRequest(ctx, publication, verification, operation, recovery)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return d.transitionPublication(ctx, publication, recovery.fence, verification.Outcome,
+		verification.OperationID, verification.RequestDigest, nil, nil, verification, reason)
+}
+
+func (d *ACPDispatcher) recoverPublicationPullRequest(
+	ctx context.Context,
+	publication *store.Publication,
+	verification *store.PublicationVerificationReceipt,
+	verificationOperation string,
+	recovery persistedPublicationRecoveryContext,
+) (*store.Publication, *store.PublicationVerificationReceipt, string, error) {
+	prOperation := publicationOperationID("pr-reconcile", recovery.task)
+	prRequest := publisherservice.PullRequestReconcileRequest{
+		Metadata:      publisherservice.OperationMetadata{Namespace: recovery.task.Namespace, PublicationID: publication.ID, OperationID: prOperation},
+		CredentialRef: recovery.forgeCredential,
+		Intent: publisher.PullRequestIntent{
+			BaseRepository: recovery.pullRequestBase, BaseRef: publication.PRIntent.BaseRef,
+			HeadRepository: recovery.target, HeadRef: publication.PRIntent.HeadRef,
+			PublicationGeneration: publication.Generation, ExpectedHeadOID: publication.PRIntent.ExpectedHeadSHA,
+		},
+	}
+	prResponse, err := runACPExternalEffect(ctx, d, recovery.fence, store.ExternalEffectIdentity{
+		Kind: "publisher.pull-request", Namespace: recovery.task.Namespace, AggregateID: publication.ID, OperationID: prOperation,
+	}, prRequest, func(callCtx context.Context) (publisherservice.PullRequestReconcileResponse, error) {
+		return d.Publisher.ReconcilePullRequest(callCtx, prRequest)
+	})
+	if err != nil {
+		if settleErr := settleACPExternalEffect(ctx, d, recovery.fence, store.ExternalEffectIdentity{
+			Kind: "publisher.pull-request", Namespace: recovery.task.Namespace, AggregateID: publication.ID, OperationID: prOperation,
+		}, store.ExternalEffectOutcomeUnknown, nil); settleErr != nil {
+			return nil, nil, "", settleErr
+		}
+		return publication, &store.PublicationVerificationReceipt{
+			OperationID: verificationOperation, RequestDigest: mustACPDomainDigest("publisher-pr-unknown", publication.ID),
+			Outcome: store.PublicationOutcomeUnknown, ExpectedCommitSHA: publication.PreparedReceipt.CommitSHA,
+			ObservedRemote: store.RemoteRefState{}, VerifiedAt: time.Now().UTC(),
+		}, "pull request reconciliation outcome could not be established after restart", nil
+	}
+	receipt := store.PullRequestOperationReceipt{
+		OperationID: prResponse.OperationID, RequestDigest: prResponse.RequestDigest,
+		IntentKey: prResponse.Receipt.IntentKey, ForgeID: prResponse.Receipt.ForgeID,
+		URL: prResponse.Receipt.URL, State: string(prResponse.Receipt.State), HeadSHA: prResponse.Receipt.HeadOID,
+		ReconciledAt: time.Now().UTC(),
+	}
+	receiptOp := publicationOperationID("pr-receipt", recovery.task)
+	receiptDigest, err := acpDomainDigest("publication-pr-receipt", map[string]any{"publicationID": publication.ID, "receipt": receipt})
+	if err != nil {
+		return nil, nil, "", err
+	}
+	publication, err = d.Store.SetPublicationPRReceipt(ctx, store.SetPublicationPRReceiptRequest{
+		ID: publication.ID, Fence: recovery.fence, ExpectedVersion: publication.Version, ExpectedGeneration: publication.Generation,
+		ExpectedState: store.PublicationVerifying, Receipt: receipt,
+		OperationID: receiptOp, OperationDigest: receiptDigest, UpdatedAt: receipt.ReconciledAt,
+	})
+	return publication, verification, "", err
+}
+
+func (d *ACPDispatcher) finishPersistedPublicationRecovery(
+	ctx context.Context,
+	publication *store.Publication,
+	recovery persistedPublicationRecoveryContext,
+) (acpPublicationResult, error) {
+	if !store.IsTerminalPublicationState(publication.State) {
+		return acpPublicationResult{}, fmt.Errorf("publication reconciliation did not reach a terminal state")
+	}
+	attempt, err := d.Store.GetPromptAttempt(ctx, recovery.attemptID)
+	if err != nil {
+		return acpPublicationResult{}, err
+	}
+	terminalDelivery := promptDeliveryForPublication(publication.State)
+	if attempt.DeliveryState != terminalDelivery {
+		if err := d.transitionDelivery(ctx, recovery.attemptID, recovery.fence, attempt.DeliveryState, terminalDelivery, "recover-publication-terminal", publication.TerminalReason); err != nil {
+			return acpPublicationResult{}, err
+		}
+	}
+	if err := d.reclaimStandaloneTaskBranchClaim(ctx, recovery.task, recovery.attemptID, recovery.fence, publication); err != nil {
+		return acpPublicationResult{}, err
+	}
+	delta := harnessv2.WorkspaceDeltaDescriptor{
+		State: harnessv2.WorkspaceDeltaPrepared, Intent: harnessv2.WorkspaceIntentWrite,
+		VerifiedBaseline: harnessv2.WorkspaceBaseline{RepositoryIdentity: publication.SourceRepositoryID, Revision: publication.SourceBaselineSHA},
+		RelativeRoot:     strings.TrimSpace(recovery.workspace.SubPath), Artifact: &recovery.artifact,
+		PublicationSafe: true, NoFollowVerified: true,
+	}
+	status := publicationTaskDeliveryStatus(recovery.workspace, delta.VerifiedBaseline, delta, publication, strings.TrimPrefix(publication.TargetRef, "refs/heads/"))
+	return acpPublicationResult{PublicationID: publication.ID, Status: status}, nil
+}
+
+func (d *ACPDispatcher) recoveryDeliveryTransition(ctx context.Context, attemptID string, fence store.ControllerEpochFence, from, to store.PromptDeliveryState, operation string) error {
+	attempt, err := d.Store.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		return err
+	}
+	if attempt.DeliveryState == to || store.IsTerminalPromptDeliveryState(attempt.DeliveryState) {
+		return nil
+	}
+	if attempt.DeliveryState != from {
+		return fmt.Errorf("publication recovery delivery state is %s, want %s", attempt.DeliveryState, from)
+	}
+	return d.transitionDelivery(ctx, attemptID, fence, from, to, operation, "")
+}
diff --git a/internal/controller/acp_recovery.go b/internal/controller/acp_recovery.go
new file mode 100644
index 000000000..aad143dc6
--- /dev/null
+++ b/internal/controller/acp_recovery.go
@@ -0,0 +1,1393 @@
+package controller
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"reflect"
+	"strconv"
+	"strings"
+	"time"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/util/retry"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/store"
+	"github.com/orka-agents/orka/internal/taskterminal"
+)
+
+const (
+	taskResourceKind                     = "Task"
+	taskTerminalProjectionKind           = "TaskTerminalStatus"
+	acpControllerRestartRecoveredReason  = "ControllerRestartRecovered"
+	acpControllerRestartRecoveredMessage = "pre-submission attempt recovered under the new controller epoch"
+	acpRestoreIdentityChangedReason      = "RestoreIdentityChanged"
+	acpRestoreIdentityChangedOperation   = "restore-identity-changed"
+	acpRestorePreSubmissionMessage       = "Task incarnation changed during restore before prompt submission; source execution was not replayed"
+	acpRestorePostWriteMessage           = "Task incarnation changed during restore after the prompt request-write boundary; outcome is unknown and was not replayed"
+	acpRestoreTerminalPreservedMessage   = "Task incarnation changed during restore after source execution reached a durable terminal state; execution was preserved and was not replayed"
+)
+
+func acpTaskControlUID(task *corev1alpha1.Task) types.UID {
+	if task == nil {
+		return ""
+	}
+	if acpTaskUsesRestoredSourceIdentity(task) {
+		binding := task.Status.AgentExecutionBinding
+		return binding.Task.UID
+	}
+	return task.UID
+}
+
+func acpTaskUsesRestoredSourceIdentity(task *corev1alpha1.Task) bool {
+	if task == nil || task.Status.Execution == nil {
+		return false
+	}
+	switch task.Status.Phase {
+	case corev1alpha1.TaskPhaseSucceeded, corev1alpha1.TaskPhaseFailed, corev1alpha1.TaskPhaseCancelled:
+	default:
+		return false
+	}
+	binding := executionBinding(task, corev1alpha1.AgentRuntimeContractHarnessV2)
+	if binding == nil || binding.Task.UID == "" || binding.Task.UID == task.UID ||
+		task.Status.Execution.Reason != corev1alpha1.TaskExecutionReason(acpRestoreIdentityChangedReason) {
+		return false
+	}
+	switch task.Status.Execution.State {
+	case corev1alpha1.TaskExecutionStateSucceeded:
+		return task.Status.Execution.Outcome == corev1alpha1.TaskExecutionOutcomeSucceeded
+	case corev1alpha1.TaskExecutionStateFailed:
+		return task.Status.Execution.Outcome == corev1alpha1.TaskExecutionOutcomeFailed
+	case corev1alpha1.TaskExecutionStateCancelled:
+		return task.Status.Execution.Outcome == corev1alpha1.TaskExecutionOutcomeCancelled
+	case corev1alpha1.TaskExecutionStateOutcomeUnknown:
+		return task.Status.Execution.Outcome == corev1alpha1.TaskExecutionOutcomeOutcomeUnknown
+	default:
+		return false
+	}
+}
+
+func acpTaskHasUnvalidatedSourceIdentity(task *corev1alpha1.Task) bool {
+	return acpTaskHasRestoredSourceIdentityBinding(task) && !acpTaskUsesRestoredSourceIdentity(task)
+}
+
+func acpTaskHasRestoredSourceIdentityBinding(task *corev1alpha1.Task) bool {
+	binding := executionBinding(task, corev1alpha1.AgentRuntimeContractHarnessV2)
+	return binding != nil && binding.Task.UID != "" && binding.Task.UID != task.UID
+}
+
+// recoverStaleAttempts classifies every old-epoch ACP attempt before the new
+// leader admits work. It resumes only states that provably crossed no prompt
+// request-write boundary and makes all potentially accepted prompts terminally
+// OutcomeUnknown without allocating a replacement attempt.
+func (d *ACPDispatcher) recoverStaleAttempts(ctx context.Context) error {
+	fence, err := d.Epochs.CurrentFence(ctx)
+	if err != nil {
+		return err
+	}
+	var tasks corev1alpha1.TaskList
+	if err := d.Client.List(ctx, &tasks); err != nil {
+		return err
+	}
+	for i := range tasks.Items {
+		candidate := tasks.Items[i].DeepCopy()
+		task, recoverable, readErr := d.readRecoverableTask(ctx, candidate)
+		if readErr != nil {
+			return fmt.Errorf("refresh stale ACP task %s/%s: %w", candidate.Namespace, candidate.Name, readErr)
+		}
+		if !recoverable {
+			continue
+		}
+		if acpTaskHasRestoredSourceIdentityBinding(task) {
+			if restored, restoreErr := d.recoverRestoredTaskIncarnation(ctx, task, fence); restoreErr != nil {
+				return fmt.Errorf("recover restored ACP task %s/%s: %w", task.Namespace, task.Name, restoreErr)
+			} else if !restored {
+				return fmt.Errorf("recover restored ACP task %s/%s: %w: restored Task source identity was not classified",
+					task.Namespace, task.Name, store.ErrConflict)
+			}
+			continue
+		}
+		if !taskManagedByACP(task) || !taskDispatchableByACP(task) || task.Status.Execution == nil {
+			continue
+		}
+		if task.Status.Execution.ControllerEpoch >= fence.Epoch {
+			continue
+		}
+		if err := d.recoverStaleTask(ctx, task, fence); err != nil {
+			if errors.Is(err, store.ErrNotFound) || apierrors.IsNotFound(err) {
+				_, stillRecoverable, recheckErr := d.readRecoverableTask(ctx, task)
+				if recheckErr != nil {
+					return fmt.Errorf("recheck stale ACP task %s/%s after not found: %w", task.Namespace, task.Name, recheckErr)
+				}
+				if !stillRecoverable {
+					continue
+				}
+			}
+			return fmt.Errorf("recover stale ACP task %s/%s: %w", task.Namespace, task.Name, err)
+		}
+	}
+	return nil
+}
+
+// recoverRestoredTaskIncarnation settles a Task whose Kubernetes UID changed
+// during a clean-cluster restore. Kubernetes UIDs are incarnation fences, not
+// portable logical identifiers: all durable source records remain keyed by the
+// UID frozen in AgentExecutionBinding and are never rewritten or replayed under
+// the restored Task UID.
+func (d *ACPDispatcher) recoverRestoredTaskIncarnation(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	fence store.ControllerEpochFence,
+) (bool, error) {
+	if task == nil {
+		return false, nil
+	}
+	binding := executionBinding(task, corev1alpha1.AgentRuntimeContractHarnessV2)
+	if binding == nil {
+		return false, nil
+	}
+	sourceUID := strings.TrimSpace(string(binding.Task.UID))
+	if sourceUID == "" {
+		return false, nil
+	}
+	if sourceUID == string(task.UID) {
+		return false, nil
+	}
+	if task.Status.Execution == nil {
+		return true, fmt.Errorf("%w: restored Task execution status is missing", store.ErrConflict)
+	}
+	if task.Status.Execution.Attempt < 1 || strings.TrimSpace(task.Status.Execution.PromptID) == "" {
+		return true, fmt.Errorf("%w: restored Task execution identity is incomplete", store.ErrConflict)
+	}
+	attemptID, err := (store.PromptAttemptKey{
+		Namespace: task.Namespace,
+		TaskUID:   sourceUID,
+		Attempt:   int64(task.Status.Execution.Attempt),
+		PromptID:  task.Status.Execution.PromptID,
+	}).CanonicalID()
+	if err != nil {
+		return true, err
+	}
+	attempt, err := d.Store.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		return true, err
+	}
+	if err := validateRestoredTaskSourceAttempt(task, attempt, attemptID); err != nil {
+		return true, err
+	}
+
+	alreadySettled := acpTaskUsesRestoredSourceIdentity(task)
+
+	settlement, err := d.settleRestoredTaskExecution(ctx, attempt, fence)
+	if err != nil {
+		return true, err
+	}
+	attempt, err = d.Store.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		return true, err
+	}
+	if err := validateRestoredTaskSourceAttempt(task, attempt, attemptID); err != nil {
+		return true, err
+	}
+	attempt, err = d.settleRestoredTerminalDelivery(ctx, task, types.UID(sourceUID), attempt, fence)
+	if err != nil {
+		return true, err
+	}
+	delivery, err := restoredTerminalDeliveryStatus(task, attempt.DeliveryState)
+	if err != nil {
+		return true, err
+	}
+	cleanupComplete, err := d.cleanupRecoveredTaskScopedRuntimeSessionForUID(ctx, task, types.UID(sourceUID))
+	if err != nil {
+		return true, err
+	}
+	if !cleanupComplete {
+		return true, fmt.Errorf("%w: restored Task RuntimeSession cleanup is not complete", store.ErrNotReady)
+	}
+	if settlement.requiresProjection || alreadySettled {
+		if err := d.ensureRestoredTaskTerminalProjection(
+			ctx, task, types.UID(sourceUID), attempt, fence,
+			settlement.state, settlement.outcome, settlement.message, delivery,
+		); err != nil {
+			return true, err
+		}
+	}
+	return true, d.patchRestoredTaskTerminal(
+		ctx, task, fence.Epoch, settlement.state, settlement.outcome, settlement.message, delivery,
+	)
+}
+
+type restoredTaskExecutionSettlement struct {
+	state              corev1alpha1.TaskExecutionState
+	outcome            corev1alpha1.TaskExecutionOutcome
+	message            string
+	requiresProjection bool
+}
+
+func (d *ACPDispatcher) settleRestoredTaskExecution(
+	ctx context.Context,
+	attempt *store.PromptAttempt,
+	fence store.ControllerEpochFence,
+) (restoredTaskExecutionSettlement, error) {
+	settlement := restoredTaskExecutionSettlement{
+		state:   corev1alpha1.TaskExecutionStateFailed,
+		outcome: corev1alpha1.TaskExecutionOutcomeFailed,
+		message: acpRestorePreSubmissionMessage,
+	}
+	if attempt == nil {
+		return settlement, fmt.Errorf("%w: restored Task source PromptAttempt is missing", store.ErrConflict)
+	}
+	switch attempt.ExecutionState {
+	case store.PromptExecutionQueued, store.PromptExecutionReserved,
+		store.PromptExecutionSessionStarting, store.PromptExecutionPlanned:
+		if err := d.persistRestoredPreSubmissionFailure(ctx, attempt, fence); err != nil {
+			return settlement, err
+		}
+		settlement.requiresProjection = true
+	case store.PromptExecutionSubmitting, store.PromptExecutionSubmittedUnknown,
+		store.PromptExecutionAccepted, store.PromptExecutionRunning, store.PromptExecutionSettling:
+		settlement.state = corev1alpha1.TaskExecutionStateOutcomeUnknown
+		settlement.outcome = corev1alpha1.TaskExecutionOutcomeOutcomeUnknown
+		settlement.message = acpRestorePostWriteMessage
+		if err := d.persistOutcomeUnknown(ctx, attempt.ID, fence, acpRestoreIdentityChangedReason, settlement.message); err != nil {
+			return settlement, err
+		}
+		settlement.requiresProjection = true
+	case store.PromptExecutionSucceeded, store.PromptExecutionFailed,
+		store.PromptExecutionCancelled, store.PromptExecutionOutcomeUnknown:
+		settlement.requiresProjection = true
+		if attempt.ExecutionState == store.PromptExecutionFailed &&
+			attempt.TerminalReason == acpRestoreIdentityChangedReason &&
+			attempt.OutcomeMarker == acpRestorePreSubmissionMessage {
+			settlement.message = acpRestorePreSubmissionMessage
+		} else if attempt.ExecutionState == store.PromptExecutionOutcomeUnknown &&
+			attempt.TerminalReason == acpRestoreIdentityChangedReason &&
+			attempt.OutcomeMarker == acpRestorePostWriteMessage {
+			settlement.state = corev1alpha1.TaskExecutionStateOutcomeUnknown
+			settlement.outcome = corev1alpha1.TaskExecutionOutcomeOutcomeUnknown
+			settlement.message = acpRestorePostWriteMessage
+		} else {
+			settlement.state, settlement.outcome = restoredTerminalExecutionState(attempt.ExecutionState)
+			settlement.message = acpRestoreTerminalPreservedMessage
+		}
+	default:
+		return settlement, fmt.Errorf("%w: restored Task source PromptAttempt has unsupported state %q", store.ErrConflict, attempt.ExecutionState)
+	}
+	return settlement, nil
+}
+
+func restoredTerminalExecutionState(state store.PromptExecutionState) (corev1alpha1.TaskExecutionState, corev1alpha1.TaskExecutionOutcome) {
+	switch state {
+	case store.PromptExecutionSucceeded:
+		return corev1alpha1.TaskExecutionStateSucceeded, corev1alpha1.TaskExecutionOutcomeSucceeded
+	case store.PromptExecutionCancelled:
+		return corev1alpha1.TaskExecutionStateCancelled, corev1alpha1.TaskExecutionOutcomeCancelled
+	case store.PromptExecutionOutcomeUnknown:
+		return corev1alpha1.TaskExecutionStateOutcomeUnknown, corev1alpha1.TaskExecutionOutcomeOutcomeUnknown
+	default:
+		return corev1alpha1.TaskExecutionStateFailed, corev1alpha1.TaskExecutionOutcomeFailed
+	}
+}
+
+func restoredTaskPhase(state corev1alpha1.TaskExecutionState, delivery store.PromptDeliveryState) corev1alpha1.TaskPhase {
+	switch state {
+	case corev1alpha1.TaskExecutionStateCancelled:
+		return corev1alpha1.TaskPhaseCancelled
+	case corev1alpha1.TaskExecutionStateSucceeded:
+		switch delivery {
+		case store.PromptDeliveryNotRequested, store.PromptDeliveryReadValidated, store.PromptDeliveryNoChange,
+			store.PromptDeliveryVerifiedExact, store.PromptDeliveryDeliveredSuperseded:
+			return corev1alpha1.TaskPhaseSucceeded
+		case store.PromptDeliveryCancelledBeforePublish:
+			return corev1alpha1.TaskPhaseCancelled
+		}
+	}
+	return corev1alpha1.TaskPhaseFailed
+}
+
+func restoredTerminalDeliveryStatus(task *corev1alpha1.Task, state store.PromptDeliveryState) (*corev1alpha1.TaskDeliveryStatus, error) {
+	if !store.IsTerminalPromptDeliveryState(state) {
+		return nil, fmt.Errorf("%w: restored Task delivery state %q is not terminal", store.ErrConflict, state)
+	}
+	var delivery *corev1alpha1.TaskDeliveryStatus
+	if task != nil && task.Status.Delivery != nil {
+		delivery = task.Status.Delivery.DeepCopy()
+	} else {
+		delivery = &corev1alpha1.TaskDeliveryStatus{}
+	}
+	if store.PromptDeliveryState(delivery.State) == state && string(delivery.Outcome) == string(state) {
+		return delivery, nil
+	}
+	delivery.State = corev1alpha1.TaskDeliveryState(state)
+	delivery.Outcome = corev1alpha1.TaskDeliveryOutcome(state)
+	delivery.LastTransitionTime = nowMeta()
+	return delivery, nil
+}
+
+func (d *ACPDispatcher) persistRestoredPreSubmissionFailure(
+	ctx context.Context,
+	attempt *store.PromptAttempt,
+	fence store.ControllerEpochFence,
+) error {
+	if attempt == nil {
+		return fmt.Errorf("%w: restored Task source PromptAttempt is missing", store.ErrConflict)
+	}
+	if attempt.ExecutionState == store.PromptExecutionFailed {
+		if attempt.TerminalReason == acpRestoreIdentityChangedReason && attempt.OutcomeMarker == acpRestorePreSubmissionMessage {
+			return nil
+		}
+		return fmt.Errorf("%w: restored Task source PromptAttempt has a conflicting terminal failure", store.ErrConflict)
+	}
+	if err := store.ValidatePromptExecutionTransition(attempt.ExecutionState, store.PromptExecutionFailed); err != nil {
+		return err
+	}
+	digest, err := acpDomainDigest("attempt-transition", map[string]any{
+		"id": attempt.ID, "from": attempt.ExecutionState, "to": store.PromptExecutionFailed,
+		"operation": acpRestoreIdentityChangedOperation, "version": attempt.Version,
+	})
+	if err != nil {
+		return err
+	}
+	_, err = d.Store.TransitionPromptAttemptExecution(ctx, store.PromptAttemptExecutionTransition{
+		ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+		NewState:        store.PromptExecutionFailed,
+		OperationID:     acpRestoreIdentityChangedOperation + "-" + strconv.FormatInt(attempt.Version, 10),
+		OperationDigest: digest, TerminalReason: acpRestoreIdentityChangedReason,
+		OutcomeMarker: acpRestorePreSubmissionMessage, UpdatedAt: time.Now().UTC(),
+	})
+	return err
+}
+
+func (d *ACPDispatcher) ensureRestoredTaskTerminalProjection(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	sourceUID types.UID,
+	attempt *store.PromptAttempt,
+	fence store.ControllerEpochFence,
+	state corev1alpha1.TaskExecutionState,
+	outcome corev1alpha1.TaskExecutionOutcome,
+	message string,
+	delivery *corev1alpha1.TaskDeliveryStatus,
+) error {
+	if task == nil || task.Status.Execution == nil || attempt == nil || delivery == nil || sourceUID == "" || sourceUID == task.UID ||
+		store.PromptDeliveryState(delivery.State) != attempt.DeliveryState || string(delivery.Outcome) != string(attempt.DeliveryState) {
+		return fmt.Errorf("%w: restored Task projection identity is incomplete", store.ErrConflict)
+	}
+	projectionID := standaloneTaskTerminalProjectionIDForUID(task.Namespace, sourceUID, task.Status.Execution.Attempt)
+	existing, err := d.Store.GetOutboxProjection(ctx, projectionID)
+	if err == nil {
+		return validateRestoredSourceTerminalProjection(task, sourceUID, attempt, existing)
+	}
+	if !errors.Is(err, store.ErrNotFound) {
+		return err
+	}
+	execution := *task.Status.Execution
+	execution.State = state
+	execution.Outcome = outcome
+	phase := restoredTaskPhase(state, attempt.DeliveryState)
+	projectionMessage := message
+	if attempt.TerminalReason == acpRestoreIdentityChangedReason {
+		execution.Reason = corev1alpha1.TaskExecutionReason(acpRestoreIdentityChangedReason)
+		execution.Message = message
+	}
+	execution.ControllerEpoch = fence.Epoch
+	payload := taskTerminalProjection{
+		Namespace: task.Namespace,
+		Task:      task.Name,
+		TaskUID:   string(sourceUID),
+		Attempt:   execution.Attempt,
+		Phase:     phase,
+		Message:   projectionMessage,
+		Execution: execution,
+		Delivery:  delivery,
+	}
+	return enqueueDurableTaskTerminalProjectionForUID(ctx, d.Store, fence, task, sourceUID, payload)
+}
+
+func validateRestoredSourceTerminalProjection(task *corev1alpha1.Task, sourceUID types.UID, attempt *store.PromptAttempt, projection *store.OutboxProjection) error {
+	if projection == nil || projection.ID != standaloneTaskTerminalProjectionIDForUID(task.Namespace, sourceUID, task.Status.Execution.Attempt) ||
+		projection.AggregateKind != taskResourceKind || projection.AggregateID != string(sourceUID) || projection.ProjectionKind != taskTerminalProjectionKind {
+		return fmt.Errorf("%w: restored source terminal projection identity mismatch", store.ErrConflict)
+	}
+	_, err := taskterminal.ValidateRestoredProjection(projection.Payload, task, string(sourceUID), attempt)
+	return err
+}
+
+func validateRestoredTaskSourceAttempt(task *corev1alpha1.Task, attempt *store.PromptAttempt, attemptID string) error {
+	if task == nil || task.Status.Execution == nil || task.Status.AgentExecutionBinding == nil || attempt == nil {
+		return fmt.Errorf("%w: restored Task source execution evidence is incomplete", store.ErrConflict)
+	}
+	binding := task.Status.AgentExecutionBinding
+	if binding.ContractVersion != corev1alpha1.AgentRuntimeContractHarnessV2 ||
+		attempt.ID != attemptID || attempt.Key.Namespace != task.Namespace ||
+		attempt.Key.TaskUID != string(binding.Task.UID) || attempt.Key.Attempt != int64(task.Status.Execution.Attempt) ||
+		attempt.Key.PromptID != task.Status.Execution.PromptID || attempt.BindingDigest != binding.BindingDigest ||
+		attempt.SnapshotDigest != binding.Snapshot.Digest ||
+		(strings.TrimSpace(task.Status.Execution.RequestDigest) != "" && attempt.RequestDigest != task.Status.Execution.RequestDigest) {
+		return fmt.Errorf("%w: restored Task source PromptAttempt does not match its frozen execution binding", store.ErrConflict)
+	}
+	return nil
+}
+
+//nolint:gocyclo // Restore settlement must mirror every durable delivery/publication state without losing fail-closed cases.
+func (d *ACPDispatcher) settleRestoredTerminalDelivery(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	sourceUID types.UID,
+	attempt *store.PromptAttempt,
+	fence store.ControllerEpochFence,
+) (*store.PromptAttempt, error) {
+	if task == nil || task.Status.Execution == nil || attempt == nil || !store.IsTerminalPromptExecutionState(attempt.ExecutionState) {
+		return nil, fmt.Errorf("%w: restored delivery settlement requires terminal source execution", store.ErrConflict)
+	}
+	publicationState := store.PublicationState("")
+	if task.Spec.Workspace != nil && task.Spec.Workspace.Intent == corev1alpha1.WorkspaceIntentWrite {
+		publicationID := publicationIDForTaskUID(task, sourceUID)
+		publication, err := d.Store.GetPublication(ctx, publicationID)
+		if err != nil {
+			if !errors.Is(err, store.ErrNotFound) {
+				return nil, err
+			}
+			switch {
+			case store.IsTerminalPromptDeliveryState(attempt.DeliveryState):
+				return attempt, nil
+			case attempt.DeliveryState == store.PromptDeliveryValidating:
+				// Publication creation precedes the Validating -> Preparing
+				// transition. A restored Validating attempt may therefore have no
+				// Publication, and can settle fail-closed without inventing one.
+			default:
+				return nil, err
+			}
+		}
+		if publication != nil {
+			if publication.Namespace != task.Namespace || publication.TaskUID != string(sourceUID) ||
+				publication.Attempt != int64(task.Status.Execution.Attempt) || publication.PromptID != task.Status.Execution.PromptID {
+				return nil, fmt.Errorf("%w: restored Publication does not match frozen source identity", store.ErrConflict)
+			}
+			publicationState = publication.State
+			if !store.IsTerminalPublicationState(publication.State) {
+				const reason = "clean-cluster restore cannot prove the in-flight publication outcome"
+				switch publication.State {
+				case store.PublicationPreparing, store.PublicationPublishing:
+					if err := d.transitionPublicationTerminal(ctx, publication, fence, store.PublicationOutcomeUnknown, reason); err != nil {
+						return nil, err
+					}
+					publicationState = store.PublicationOutcomeUnknown
+				case store.PublicationPrepared:
+					if err := d.transitionPublicationTerminal(ctx, publication, fence, store.PublicationCancelledBeforePublish, reason); err != nil {
+						return nil, err
+					}
+					publicationState = store.PublicationCancelledBeforePublish
+				case store.PublicationVerifying:
+					if publication.PreparedReceipt == nil || publication.PublishReceipt == nil {
+						return nil, fmt.Errorf("%w: restored verifying Publication lacks durable prepare/publish receipts", store.ErrConflict)
+					}
+					op := publicationOperationID("restore-unknown", nil)
+					digest, digestErr := acpDomainDigest("publication-restore-unknown", map[string]any{
+						"id": publication.ID, "generation": publication.Generation, "version": publication.Version,
+					})
+					if digestErr != nil {
+						return nil, digestErr
+					}
+					receipt := &store.PublicationVerificationReceipt{
+						OperationID: op, RequestDigest: digest, Outcome: store.PublicationOutcomeUnknown,
+						ExpectedCommitSHA: publication.PreparedReceipt.CommitSHA, VerifiedAt: time.Now().UTC(),
+					}
+					if _, err := d.transitionPublication(ctx, publication, fence, store.PublicationOutcomeUnknown, op, digest, nil, nil, receipt, reason); err != nil {
+						return nil, err
+					}
+					publicationState = store.PublicationOutcomeUnknown
+				default:
+					return nil, fmt.Errorf("%w: unsupported restored Publication state %q", store.ErrConflict, publication.State)
+				}
+			}
+		}
+	}
+	if store.IsTerminalPromptDeliveryState(attempt.DeliveryState) {
+		return attempt, nil
+	}
+	to := store.PromptDeliveryPublicationOutcomeUnknown
+	if publicationState != "" {
+		to = promptDeliveryForPublication(publicationState)
+	}
+	switch attempt.DeliveryState {
+	case store.PromptDeliveryValidating:
+		if publicationState == "" {
+			to = store.PromptDeliveryConflict
+		}
+	case store.PromptDeliveryPrepared:
+	case store.PromptDeliveryPreparing, store.PromptDeliveryPublishing, store.PromptDeliveryVerifying:
+	default:
+		return nil, fmt.Errorf("%w: unsupported restored delivery state %q", store.ErrConflict, attempt.DeliveryState)
+	}
+	const reason = "clean-cluster restore terminalized an in-flight delivery without replay"
+	if err := d.transitionDelivery(ctx, attempt.ID, fence, attempt.DeliveryState, to, "restore-delivery-settlement", reason); err != nil {
+		return nil, err
+	}
+	return d.Store.GetPromptAttempt(ctx, attempt.ID)
+}
+
+func (d *ACPDispatcher) patchRestoredTaskTerminal(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	epoch int64,
+	state corev1alpha1.TaskExecutionState,
+	outcome corev1alpha1.TaskExecutionOutcome,
+	message string,
+	delivery *corev1alpha1.TaskDeliveryStatus,
+) error {
+	if delivery == nil || !store.IsTerminalPromptDeliveryState(store.PromptDeliveryState(delivery.State)) ||
+		string(delivery.Outcome) != string(delivery.State) {
+		return fmt.Errorf("%w: restored Task terminal delivery evidence is incomplete", store.ErrConflict)
+	}
+	deliveryState := store.PromptDeliveryState(delivery.State)
+	key := types.NamespacedName{Namespace: task.Namespace, Name: task.Name}
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		latest := &corev1alpha1.Task{}
+		if err := d.Client.Get(ctx, key, latest); err != nil {
+			return client.IgnoreNotFound(err)
+		}
+		if latest.UID != task.UID || latest.Status.Execution == nil || latest.Status.AgentExecutionBinding == nil ||
+			latest.Status.AgentExecutionBinding.Task.UID == latest.UID || task.Status.AgentExecutionBinding == nil ||
+			latest.Status.AgentExecutionBinding.Task.UID != task.Status.AgentExecutionBinding.Task.UID ||
+			latest.Status.AgentExecutionBinding.BindingDigest != task.Status.AgentExecutionBinding.BindingDigest ||
+			latest.Status.Execution.Attempt != task.Status.Execution.Attempt ||
+			latest.Status.Execution.PromptID != task.Status.Execution.PromptID {
+			return fmt.Errorf("%w: restored Task incarnation changed during settlement", store.ErrConflict)
+		}
+		if acpTaskUsesRestoredSourceIdentity(latest) && latest.Status.Execution.State == state &&
+			latest.Status.Execution.Outcome == outcome && latest.Status.Execution.ControllerEpoch == epoch &&
+			reflect.DeepEqual(latest.Status.Delivery, delivery) {
+			return nil
+		}
+		base := latest.DeepCopy()
+		now := metav1.Now()
+		latest.Status.Phase = restoredTaskPhase(state, deliveryState)
+		latest.Status.Message = message
+		latest.Status.Execution.State = state
+		latest.Status.Execution.Outcome = outcome
+		latest.Status.Execution.Reason = corev1alpha1.TaskExecutionReason(acpRestoreIdentityChangedReason)
+		latest.Status.Execution.Message = message
+		latest.Status.Execution.ControllerEpoch = epoch
+		latest.Status.Execution.LastTransitionTime = &now
+		latest.Status.Delivery = delivery.DeepCopy()
+		latest.Status.CompletionTime = &now
+		return d.Client.Status().Patch(ctx, latest, client.MergeFrom(base))
+	})
+}
+
+func (d *ACPDispatcher) readRecoverableTask(
+	ctx context.Context,
+	candidate *corev1alpha1.Task,
+) (*corev1alpha1.Task, bool, error) {
+	if candidate == nil {
+		return nil, false, nil
+	}
+	reader := d.APIReader
+	if reader == nil {
+		reader = d.Client
+	}
+	if reader == nil {
+		return nil, false, fmt.Errorf("ACP recovery requires a Kubernetes reader")
+	}
+	latest := &corev1alpha1.Task{}
+	err := reader.Get(ctx, types.NamespacedName{Namespace: candidate.Namespace, Name: candidate.Name}, latest)
+	if apierrors.IsNotFound(err) {
+		return nil, false, nil
+	}
+	if err != nil {
+		return nil, false, err
+	}
+	if latest.UID != candidate.UID ||
+		(!latest.DeletionTimestamp.IsZero() && !acpTaskHasUnvalidatedSourceIdentity(latest)) {
+		return nil, false, nil
+	}
+	return latest, true, nil
+}
+
+func (d *ACPDispatcher) recoverStaleTask(ctx context.Context, task *corev1alpha1.Task, fence store.ControllerEpochFence) error {
+	attemptID, err := promptAttemptIDFromTask(task)
+	if err != nil {
+		return err
+	}
+	attempt, err := d.Store.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		return err
+	}
+	sessionBound, err := promptAttemptSessionBound(attempt)
+	if err != nil {
+		return err
+	}
+	continuitySession := task.Spec.SessionRef != nil && sessionBound
+	if store.IsTerminalPromptExecutionState(attempt.ExecutionState) && store.IsTerminalPromptDeliveryState(attempt.DeliveryState) {
+		if continuitySession {
+			if err := d.finalizeRecoveredTerminalSession(ctx, task, attempt, fence); err != nil {
+				return err
+			}
+		}
+		cleanupComplete, cleanupErr := d.cleanupRecoveredTaskScopedRuntimeSession(ctx, task)
+		if cleanupErr != nil {
+			return cleanupErr
+		}
+		if !cleanupComplete {
+			return nil
+		}
+		exists, projectionErr := d.validateExistingStandaloneTaskProjection(ctx, task, attempt)
+		if projectionErr != nil {
+			return projectionErr
+		}
+		if exists {
+			return d.patchRecoveredTerminalEpoch(ctx, task, fence.Epoch)
+		}
+	}
+	switch attempt.ExecutionState {
+	case store.PromptExecutionQueued, store.PromptExecutionReserved:
+		return d.patchRecoveredTaskReserved(ctx, task, fence.Epoch, attempt.ExecutionState == store.PromptExecutionQueued)
+	case store.PromptExecutionSessionStarting, store.PromptExecutionPlanned:
+		digest, err := acpDomainDigest("pre-submission-recovery", map[string]any{
+			"attemptID": attempt.ID, "state": attempt.ExecutionState, "version": attempt.Version, "epoch": fence.Epoch,
+		})
+		if err != nil {
+			return err
+		}
+		if _, err := d.Store.RecoverPromptAttemptPreSubmission(ctx, store.PromptAttemptPreSubmissionRecovery{
+			ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+			OperationID: "recover-pre-submit-" + strconv.FormatInt(fence.Epoch, 10), OperationDigest: digest, RecoveredAt: time.Now().UTC(),
+		}); err != nil {
+			return err
+		}
+		return d.patchRecoveredTaskReserved(ctx, task, fence.Epoch, false)
+	case store.PromptExecutionSubmitting, store.PromptExecutionSubmittedUnknown,
+		store.PromptExecutionAccepted, store.PromptExecutionRunning, store.PromptExecutionSettling:
+		const reason = "RuntimeLost"
+		const message = "controller leadership changed after the prompt request-write boundary; outcome is unknown and was not replayed"
+		if err := d.persistOutcomeUnknown(ctx, attempt.ID, fence, reason, message); err != nil {
+			return err
+		}
+		if err := d.finalizeRecoveredSessionUnknown(ctx, task, fence, attempt.ID, reason); err != nil {
+			return err
+		}
+		return d.failTask(ctx, task, corev1alpha1.TaskExecutionStateOutcomeUnknown, corev1alpha1.TaskExecutionOutcomeOutcomeUnknown, reason, message)
+	case store.PromptExecutionSucceeded:
+		if err := d.recoverSucceededTaskProjection(ctx, task, attempt, fence); err != nil {
+			return err
+		}
+		return d.patchRecoveredTerminalEpoch(ctx, task, fence.Epoch)
+	case store.PromptExecutionFailed, store.PromptExecutionCancelled, store.PromptExecutionOutcomeUnknown:
+		if !continuitySession {
+			return d.recoverMissingStandaloneTerminalProjection(ctx, task, attempt)
+		}
+		if err := d.finalizeRecoveredTerminalSession(ctx, task, attempt, fence); err != nil {
+			return err
+		}
+		return d.patchRecoveredTerminalExecution(ctx, task, attempt, fence.Epoch)
+	default:
+		return fmt.Errorf("unsupported stale prompt attempt state %s", attempt.ExecutionState)
+	}
+}
+
+func taskScopedRuntimeSessionCleanupDigest(
+	taskUID types.UID,
+	attempt int32,
+	runtimeInstanceID string,
+	runtimeSessionUID string,
+	runtimeSessionGeneration int64,
+) (string, error) {
+	if taskUID == "" || attempt < 1 || strings.TrimSpace(runtimeInstanceID) == "" ||
+		strings.TrimSpace(runtimeSessionUID) == "" || runtimeSessionGeneration < 1 {
+		return "", fmt.Errorf("%w: task-scoped RuntimeSession cleanup identity is incomplete", store.ErrConflict)
+	}
+	return acpDomainDigest("task-runtime-session-cleanup", map[string]any{
+		"taskUID": string(taskUID), "attempt": attempt, "runtimeInstanceID": runtimeInstanceID,
+		"runtimeSessionUID": runtimeSessionUID, "runtimeSessionGeneration": runtimeSessionGeneration,
+	})
+}
+
+func taskScopedRuntimeSessionCleanupComplete(task *corev1alpha1.Task) bool {
+	return taskScopedRuntimeSessionCleanupCompleteForUID(task, acpTaskControlUID(task))
+}
+
+func taskScopedRuntimeSessionCleanupCompleteForUID(task *corev1alpha1.Task, taskUID types.UID) bool {
+	if task == nil || task.Status.Execution == nil || strings.TrimSpace(task.Status.Execution.RuntimeSessionUID) == "" {
+		return true
+	}
+	if task.Spec.SessionRef != nil && (task.Spec.Workspace == nil || task.Spec.Workspace.Intent != corev1alpha1.WorkspaceIntentWrite) {
+		return true
+	}
+	digest, err := taskScopedRuntimeSessionCleanupDigest(
+		taskUID, task.Status.Execution.Attempt, task.Status.Execution.RuntimeInstanceID,
+		task.Status.Execution.RuntimeSessionUID, task.Status.Execution.RuntimeSessionGeneration,
+	)
+	return err == nil && task.Status.Execution.RuntimeSessionCleanupDigest == digest
+}
+
+func (d *ACPDispatcher) markTaskScopedRuntimeSessionCleanupComplete(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	taskUID types.UID,
+	runtimeInstanceID string,
+	runtimeSessionUID string,
+	runtimeSessionGeneration int64,
+) error {
+	if task == nil || task.Status.Execution == nil {
+		return nil
+	}
+	if task.Spec.SessionRef != nil && (task.Spec.Workspace == nil || task.Spec.Workspace.Intent != corev1alpha1.WorkspaceIntentWrite) {
+		return nil
+	}
+	digest, err := taskScopedRuntimeSessionCleanupDigest(
+		taskUID, task.Status.Execution.Attempt, runtimeInstanceID, runtimeSessionUID, runtimeSessionGeneration,
+	)
+	if err != nil {
+		return err
+	}
+	key := types.NamespacedName{Namespace: task.Namespace, Name: task.Name}
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		latest := &corev1alpha1.Task{}
+		if err := d.Client.Get(ctx, key, latest); err != nil {
+			return client.IgnoreNotFound(err)
+		}
+		if latest.Status.Execution == nil {
+			return fmt.Errorf("%w: Task execution status is missing during RuntimeSession cleanup receipt", store.ErrConflict)
+		}
+		if latest.Status.Execution.Attempt != task.Status.Execution.Attempt ||
+			latest.Status.Execution.RuntimeInstanceID != runtimeInstanceID ||
+			latest.Status.Execution.RuntimeSessionUID != runtimeSessionUID ||
+			latest.Status.Execution.RuntimeSessionGeneration != runtimeSessionGeneration {
+			return fmt.Errorf("%w: Task execution identity changed during RuntimeSession cleanup receipt", store.ErrConflict)
+		}
+		if taskUID != latest.UID {
+			binding := executionBinding(latest, corev1alpha1.AgentRuntimeContractHarnessV2)
+			if binding == nil || binding.Task.UID != taskUID {
+				return fmt.Errorf("%w: restored Task source identity changed during RuntimeSession cleanup receipt", store.ErrConflict)
+			}
+		}
+		if latest.Status.Execution.RuntimeSessionCleanupDigest == digest {
+			return nil
+		}
+		latest.Status.Execution.RuntimeSessionCleanupDigest = digest
+		return d.Client.Status().Update(ctx, latest)
+	})
+}
+
+func (d *ACPDispatcher) prepareRecoveredTaskScopedRuntimeSessionForSettlement(ctx context.Context, task *corev1alpha1.Task) (bool, error) {
+	return d.reconcileRecoveredTaskScopedRuntimeSession(ctx, task, acpTaskControlUID(task), false)
+}
+
+func (d *ACPDispatcher) cleanupRecoveredTaskScopedRuntimeSession(ctx context.Context, task *corev1alpha1.Task) (bool, error) {
+	return d.cleanupRecoveredTaskScopedRuntimeSessionForUID(ctx, task, acpTaskControlUID(task))
+}
+
+func (d *ACPDispatcher) cleanupRecoveredTaskScopedRuntimeSessionForUID(ctx context.Context, task *corev1alpha1.Task, taskUID types.UID) (bool, error) {
+	return d.reconcileRecoveredTaskScopedRuntimeSession(ctx, task, taskUID, true)
+}
+
+//nolint:gocyclo // Recovery keeps exact runtime-state and fence cleanup decisions in one fail-closed boundary.
+func (d *ACPDispatcher) reconcileRecoveredTaskScopedRuntimeSession(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	taskUID types.UID,
+	deleteAfterSettlement bool,
+) (bool, error) {
+	if task == nil || task.Status.Execution == nil || strings.TrimSpace(task.Status.Execution.RuntimeSessionUID) == "" {
+		return true, nil
+	}
+	if task.Status.Execution.RuntimeSessionGeneration < 1 {
+		return false, fmt.Errorf("%w: RuntimeSession cleanup generation is missing", store.ErrConflict)
+	}
+	if task.Spec.SessionRef != nil && (task.Spec.Workspace == nil || task.Spec.Workspace.Intent != corev1alpha1.WorkspaceIntentWrite) {
+		return true, nil
+	}
+	if taskScopedRuntimeSessionCleanupCompleteForUID(task, taskUID) {
+		return true, nil
+	}
+	execution := task.Status.Execution
+	var target acpDispatchTarget
+	if poolName := strings.TrimSpace(execution.RuntimePoolName); poolName != "" {
+		pool := &corev1alpha1.RuntimePool{}
+		if err := d.APIReader.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: poolName}, pool); err != nil {
+			if apierrors.IsNotFound(err) {
+				if !deleteAfterSettlement {
+					return true, nil
+				}
+				if markErr := d.markTaskScopedRuntimeSessionCleanupComplete(ctx, task, taskUID, execution.RuntimeInstanceID, execution.RuntimeSessionUID, execution.RuntimeSessionGeneration); markErr != nil {
+					return false, markErr
+				}
+				return true, nil
+			}
+			return false, err
+		}
+		active := pool.Status.ActiveInstance
+		currentFence, err := d.Epochs.CurrentFence(ctx)
+		if err != nil {
+			return false, err
+		}
+		if active == nil || active.RuntimeInstanceID != execution.RuntimeInstanceID {
+			if !deleteAfterSettlement {
+				return true, nil
+			}
+			if markErr := d.markTaskScopedRuntimeSessionCleanupComplete(ctx, task, taskUID, execution.RuntimeInstanceID, execution.RuntimeSessionUID, execution.RuntimeSessionGeneration); markErr != nil {
+				return false, markErr
+			}
+			return true, nil
+		}
+		if active.ControllerEpoch != currentFence.Epoch {
+			return false, nil
+		}
+		target.pool = pool
+	} else if runtimeName := strings.TrimSpace(execution.AgentRuntimeName); runtimeName != "" {
+		runtime := &corev1alpha1.AgentRuntime{}
+		if err := d.APIReader.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: runtimeName}, runtime); err != nil {
+			if apierrors.IsNotFound(err) {
+				if !deleteAfterSettlement {
+					return true, nil
+				}
+				if markErr := d.markTaskScopedRuntimeSessionCleanupComplete(ctx, task, taskUID, execution.RuntimeInstanceID, execution.RuntimeSessionUID, execution.RuntimeSessionGeneration); markErr != nil {
+					return false, markErr
+				}
+				return true, nil
+			}
+			return false, err
+		}
+		if string(runtime.UID) != execution.AgentRuntimeUID || runtime.Status.ObservedCapabilities.RuntimeInstanceID != execution.RuntimeInstanceID {
+			if !deleteAfterSettlement {
+				return true, nil
+			}
+			if markErr := d.markTaskScopedRuntimeSessionCleanupComplete(ctx, task, taskUID, execution.RuntimeInstanceID, execution.RuntimeSessionUID, execution.RuntimeSessionGeneration); markErr != nil {
+				return false, markErr
+			}
+			return true, nil
+		}
+		currentFence, err := d.Epochs.CurrentFence(ctx)
+		if err != nil {
+			return false, err
+		}
+		if runtime.Status.ObservedCapabilities.ControllerEpoch != currentFence.Epoch {
+			return false, nil
+		}
+		target.external = runtime
+	} else {
+		if !deleteAfterSettlement {
+			return true, nil
+		}
+		if markErr := d.markTaskScopedRuntimeSessionCleanupComplete(ctx, task, taskUID, execution.RuntimeInstanceID, execution.RuntimeSessionUID, execution.RuntimeSessionGeneration); markErr != nil {
+			return false, markErr
+		}
+		return true, nil
+	}
+	runtimeClient, runtimeFence, _, _, err := d.runtimeClient(ctx, target)
+	if err != nil {
+		return false, err
+	}
+	runtimeFence.RuntimeSessionUID = harnessv2.RuntimeSessionUID(execution.RuntimeSessionUID)
+	runtimeFence.RuntimeSessionGeneration = uint64(execution.RuntimeSessionGeneration)
+	status, statusErr := runtimeClient.Status(ctx)
+	if statusErr != nil {
+		return false, statusErr
+	}
+	observed, present := runtimeSessionStatusForFence(status.Sessions, runtimeFence)
+	if !present {
+		if !deleteAfterSettlement {
+			return true, nil
+		}
+		if markErr := d.markTaskScopedRuntimeSessionCleanupComplete(
+			ctx, task, taskUID, execution.RuntimeInstanceID, execution.RuntimeSessionUID, execution.RuntimeSessionGeneration,
+		); markErr != nil {
+			return false, markErr
+		}
+		return true, nil
+	}
+	switch observed.State {
+	case harnessv2.RuntimeSessionStatePublicationPrepared:
+		if task.Spec.Workspace == nil || task.Spec.Workspace.Intent != corev1alpha1.WorkspaceIntentWrite {
+			return false, fmt.Errorf("recover RuntimeSession publication finalization: prepared session is not bound to a write workspace")
+		}
+		deltaID := harnessv2.WorkspaceDeltaID("delta-" + execution.PromptID)
+		finalization, finalizationErr := d.runtimeSessionPublicationFinalization(ctx, publicationIDForTaskUID(task, taskUID), deltaID)
+		if errors.Is(finalizationErr, store.ErrNotFound) && task.Status.Delivery != nil &&
+			task.Status.Delivery.Outcome != corev1alpha1.TaskDeliveryOutcomeNoChange {
+			finalization, finalizationErr = runtimeSessionDeltaAbandonmentFinalizationForTaskUID(task, taskUID, deltaID, *task.Status.Delivery)
+		}
+		if finalizationErr != nil {
+			return false, fmt.Errorf("recover task-scoped RuntimeSession publication finalization: %w", finalizationErr)
+		}
+		if err := d.finalizeRuntimeSessionPublicationForTaskUID(
+			context.WithoutCancel(ctx), runtimeClient, harnessv2.RuntimeSessionID(runtimeSessionID(runtimeFence)), task, taskUID, runtimeFence, finalization,
+		); err != nil {
+			return false, fmt.Errorf("recover task-scoped RuntimeSession publication finalization: %w", err)
+		}
+	case harnessv2.RuntimeSessionStateFinalizing, harnessv2.RuntimeSessionStateIdle, harnessv2.RuntimeSessionStatePoisoned:
+		// Ready for exact deletion.
+	case harnessv2.RuntimeSessionStateDeleting:
+		return false, nil
+	default:
+		return false, nil
+	}
+	if !deleteAfterSettlement {
+		return true, nil
+	}
+	if err := d.deleteRuntimeSessionForTaskUID(
+		context.WithoutCancel(ctx), runtimeClient, harnessv2.RuntimeSessionID(runtimeSessionID(runtimeFence)), task, taskUID, runtimeFence, "terminal_recovery",
+	); err != nil {
+		return false, fmt.Errorf("recover task-scoped RuntimeSession cleanup: %w", err)
+	}
+	if err := d.markTaskScopedRuntimeSessionCleanupComplete(
+		ctx, task, taskUID, execution.RuntimeInstanceID, execution.RuntimeSessionUID, execution.RuntimeSessionGeneration,
+	); err != nil {
+		return false, err
+	}
+	return true, nil
+}
+
+func runtimeSessionStatusForFence(sessions []harnessv2.RuntimeSessionStatus, fence harnessv2.Fence) (harnessv2.RuntimeSessionStatus, bool) {
+	for i := range sessions {
+		if sessions[i].RuntimeSessionUID == fence.RuntimeSessionUID && sessions[i].Generation == fence.RuntimeSessionGeneration {
+			return sessions[i], true
+		}
+	}
+	return harnessv2.RuntimeSessionStatus{}, false
+}
+
+func (d *ACPDispatcher) recoverMissingStandaloneTerminalProjection(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attempt *store.PromptAttempt,
+) error {
+	if task == nil || attempt == nil || task.Status.Execution == nil {
+		return fmt.Errorf("%w: standalone terminal recovery identity is incomplete", store.ErrConflict)
+	}
+	state := corev1alpha1.TaskExecutionState(attempt.ExecutionState)
+	outcome := corev1alpha1.TaskExecutionOutcome(attempt.ExecutionState)
+	reason := task.Status.Execution.Reason
+	message := task.Status.Execution.Message
+	switch attempt.ExecutionState {
+	case store.PromptExecutionFailed:
+		if reason == "" {
+			reason = "PromptFailed"
+		}
+		if message == "" {
+			message = "prompt failed"
+		}
+	case store.PromptExecutionCancelled:
+		if reason == "" {
+			reason = "Cancelled"
+		}
+		if message == "" {
+			message = "prompt cancelled"
+		}
+	case store.PromptExecutionOutcomeUnknown:
+		if reason == "" {
+			reason = "RuntimeLost"
+		}
+		if message == "" {
+			message = "prompt outcome is unknown"
+		}
+	default:
+		return fmt.Errorf("unsupported standalone terminal recovery state %s", attempt.ExecutionState)
+	}
+	recoveryTask := task.DeepCopy()
+	if recoveryTask.Status.Delivery == nil || store.PromptDeliveryState(recoveryTask.Status.Delivery.State) != attempt.DeliveryState {
+		recoveryTask.Status.Delivery = deliveryStatusFromPromptState(attempt.DeliveryState)
+	}
+	bound, err := promptAttemptSessionBound(attempt)
+	if err != nil {
+		return err
+	}
+	if task.Spec.SessionRef != nil && !bound {
+		return d.failTaskBeforeSessionBinding(ctx, recoveryTask, state, outcome, reason, message)
+	}
+	return d.failTask(ctx, recoveryTask, state, outcome, reason, message)
+}
+
+func (d *ACPDispatcher) validateExistingStandaloneTaskProjection(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attempt *store.PromptAttempt,
+) (bool, error) {
+	if task == nil || attempt == nil {
+		return false, nil
+	}
+	bound, err := promptAttemptSessionBound(attempt)
+	if err != nil {
+		return false, err
+	}
+	if task.Spec.SessionRef != nil && bound {
+		return false, nil
+	}
+	projectionID := standaloneTaskTerminalProjectionID(task, int32(attempt.Key.Attempt))
+	projection, err := d.Store.GetOutboxProjection(ctx, projectionID)
+	if err != nil {
+		if errors.Is(err, store.ErrNotFound) {
+			return false, nil
+		}
+		return false, err
+	}
+	if projection.AggregateKind != taskResourceKind || projection.AggregateID != string(task.UID) || projection.ProjectionKind != taskTerminalProjectionKind {
+		return false, fmt.Errorf("%w: standalone terminal projection %q has mismatched identity", store.ErrConflict, projectionID)
+	}
+	var payload taskTerminalProjection
+	if err := json.Unmarshal(projection.Payload, &payload); err != nil {
+		return false, fmt.Errorf("decode standalone terminal projection %q: %w", projectionID, err)
+	}
+	if payload.Namespace != task.Namespace || payload.Task != task.Name || payload.TaskUID != string(task.UID) || int64(payload.Attempt) != attempt.Key.Attempt {
+		return false, fmt.Errorf("%w: standalone terminal projection %q payload identity does not match its Task", store.ErrConflict, projectionID)
+	}
+	if string(payload.Execution.State) != string(attempt.ExecutionState) {
+		return false, fmt.Errorf("%w: standalone terminal projection %q execution state does not match its PromptAttempt", store.ErrConflict, projectionID)
+	}
+	projectedDelivery := store.PromptDeliveryNotRequested
+	if payload.Delivery != nil {
+		projectedDelivery = store.PromptDeliveryState(payload.Delivery.State)
+	}
+	if projectedDelivery != attempt.DeliveryState {
+		return false, fmt.Errorf("%w: standalone terminal projection %q delivery state does not match its PromptAttempt", store.ErrConflict, projectionID)
+	}
+	return true, nil
+}
+
+func (d *ACPDispatcher) patchRecoveredTerminalEpoch(ctx context.Context, task *corev1alpha1.Task, epoch int64) error {
+	key := types.NamespacedName{Namespace: task.Namespace, Name: task.Name}
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		latest := &corev1alpha1.Task{}
+		if err := d.Client.Get(ctx, key, latest); err != nil {
+			return client.IgnoreNotFound(err)
+		}
+		if latest.Status.Execution == nil || latest.Status.Execution.ControllerEpoch >= epoch {
+			return nil
+		}
+		latest.Status.Execution.ControllerEpoch = epoch
+		return d.Client.Status().Update(ctx, latest)
+	})
+}
+
+func (d *ACPDispatcher) patchRecoveredTaskReserved(ctx context.Context, task *corev1alpha1.Task, epoch int64, keepQueued bool) error {
+	key := types.NamespacedName{Namespace: task.Namespace, Name: task.Name}
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		latest := &corev1alpha1.Task{}
+		if err := d.Client.Get(ctx, key, latest); err != nil {
+			return client.IgnoreNotFound(err)
+		}
+		base := latest.DeepCopy()
+		if latest.Status.Execution == nil {
+			return nil
+		}
+		if keepQueued {
+			latest.Status.Execution.State = corev1alpha1.TaskExecutionStateQueued
+		} else {
+			latest.Status.Execution.State = corev1alpha1.TaskExecutionStateReserved
+		}
+		latest.Status.Execution.ControllerEpoch = epoch
+		latest.Status.Execution.RuntimeInstanceID = ""
+		latest.Status.Execution.RuntimeSessionUID = ""
+		latest.Status.Execution.RuntimeSessionGeneration = 0
+		latest.Status.Execution.Reason = acpControllerRestartRecoveredReason
+		latest.Status.Execution.Message = acpControllerRestartRecoveredMessage
+		latest.Status.Execution.LastTransitionTime = nowMeta()
+		return d.Client.Status().Patch(ctx, latest, client.MergeFrom(base))
+	})
+}
+
+func (d *ACPDispatcher) finalizeRecoveredSessionUnknown(ctx context.Context, task *corev1alpha1.Task, fence store.ControllerEpochFence, attemptID, reason string) error {
+	attempt, err := d.Store.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		return err
+	}
+	session, err := d.recoveredTaskSession(ctx, task, attempt)
+	if err != nil || session == nil {
+		return err
+	}
+	return d.finalizeTaskSessionUnknown(ctx, task, fence, session, reason+": controller takeover classified "+attemptID+" as OutcomeUnknown")
+}
+
+func (d *ACPDispatcher) recoveredTaskSession(ctx context.Context, task *corev1alpha1.Task, attempt *store.PromptAttempt) (*acpTaskSession, error) {
+	if task.Spec.SessionRef == nil || d.Sessions == nil {
+		return nil, nil
+	}
+	if attempt == nil {
+		return nil, fmt.Errorf("%w: session-backed ACP recovery requires a PromptAttempt", store.ErrConflict)
+	}
+	if attempt.Key.TaskUID != string(task.UID) || attempt.Key.Attempt != int64(task.Status.Execution.Attempt) || attempt.Key.PromptID != task.Status.Execution.PromptID {
+		return nil, fmt.Errorf("%w: recovered PromptAttempt does not match Task execution identity", store.ErrConflict)
+	}
+	if strings.TrimSpace(attempt.SessionUID) == "" || attempt.SessionLeaseGeneration < 1 {
+		return nil, fmt.Errorf("%w: session-backed terminal PromptAttempt lacks its durable SessionTurn identity", store.ErrConflict)
+	}
+	control, err := d.Store.GetSessionControl(ctx, task.Namespace, task.Spec.SessionRef.Name)
+	if err != nil {
+		return nil, err
+	}
+	if control.SessionUID != attempt.SessionUID {
+		return nil, fmt.Errorf("%w: recovered SessionControl UID does not match PromptAttempt", store.ErrConflict)
+	}
+	key := store.SessionTurnKey{
+		SessionUID: attempt.SessionUID, LeaseGeneration: attempt.SessionLeaseGeneration,
+		TaskUID: attempt.Key.TaskUID, Attempt: attempt.Key.Attempt, PromptID: attempt.Key.PromptID,
+	}
+	turnID, err := key.CanonicalID()
+	if err != nil {
+		return nil, err
+	}
+	turn, err := d.Store.GetSessionTurn(ctx, turnID)
+	if err != nil {
+		return nil, fmt.Errorf("load recovered ACP SessionTurn: %w", err)
+	}
+	if turn.Key != key || turn.PromptAttemptID != attempt.ID {
+		return nil, fmt.Errorf("%w: recovered SessionTurn does not match PromptAttempt identity", store.ErrConflict)
+	}
+	appendPolicy := acpSessionTranscriptAppendPolicyForTask(task)
+	expectedTurnDigest, err := acpSessionTurnDigest(
+		turn.ID, attempt.ID, attempt.RequestDigest, turn.UserPrompt,
+		appendPolicy.skipTranscriptAppend, appendPolicy.skipUserPromptAppend,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if turn.RequestDigest != expectedTurnDigest && (appendPolicy.skipTranscriptAppend || appendPolicy.skipUserPromptAppend) {
+		legacyDigest, legacyErr := acpSessionTurnDigest(
+			turn.ID, attempt.ID, attempt.RequestDigest, turn.UserPrompt, false, false,
+		)
+		if legacyErr == nil && turn.RequestDigest == legacyDigest {
+			appendPolicy = acpSessionTranscriptAppendPolicy{}
+			expectedTurnDigest = legacyDigest
+		}
+	}
+	if turn.RequestDigest != expectedTurnDigest {
+		return nil, fmt.Errorf("%w: recovered SessionTurn transcript append policy does not match its durable digest", store.ErrConflict)
+	}
+	if turn.State == store.SessionTurnOpen {
+		lease := control.Lease
+		if lease == nil || lease.Generation != key.LeaseGeneration || lease.TaskUID != key.TaskUID || lease.Attempt != key.Attempt || lease.PromptID != key.PromptID {
+			return nil, fmt.Errorf("%w: open recovered SessionTurn lacks its matching mutation lease", store.ErrConflict)
+		}
+	}
+	bootstrap, userPrompt, err := d.resolveTaskSessionBootstrap(ctx, task, control)
+	if err != nil {
+		return nil, err
+	}
+	if turn.UserPrompt != userPrompt {
+		return nil, fmt.Errorf("%w: recovered SessionTurn prompt does not match bounded Task input", store.ErrConflict)
+	}
+	return &acpTaskSession{
+		Turn: &ACPSessionTurn{
+			Lease: ACPSessionLease{Session: *control, Key: key}, Turn: *turn,
+			SkipTranscriptAppend: appendPolicy.skipTranscriptAppend,
+			SkipUserPromptAppend: appendPolicy.skipUserPromptAppend,
+		},
+		Binding:    ACPRuntimeSessionBinding{SessionUID: control.SessionUID},
+		Bootstrap:  bootstrap,
+		UserPrompt: userPrompt,
+	}, nil
+}
+
+func (d *ACPDispatcher) finalizeRecoveredTerminalSession(ctx context.Context, task *corev1alpha1.Task, attempt *store.PromptAttempt, fence store.ControllerEpochFence) error {
+	prepared, err := d.prepareRecoveredTaskScopedRuntimeSessionForSettlement(ctx, task)
+	if err != nil {
+		return err
+	}
+	if !prepared {
+		return fmt.Errorf("%w: RuntimeSession publication finalization is not ready for Session settlement", store.ErrNotReady)
+	}
+	session, err := d.recoveredTaskSession(ctx, task, attempt)
+	if err != nil || session == nil {
+		return err
+	}
+	if session.Turn.Turn.State == store.SessionTurnFinalized {
+		_, err := d.Sessions.ResumeSessionTurnFinalization(ctx, ACPResumeSessionTurnFinalizationRequest{SessionTurn: *session.Turn, Fence: fence})
+		if err == nil {
+			session.finalized = true
+			d.removeRuntimeSessionBinding(session.Binding.SessionUID)
+		}
+		return err
+	}
+	var finalizeErr error
+	switch attempt.ExecutionState {
+	case store.PromptExecutionOutcomeUnknown:
+		finalizeErr = d.finalizeTaskSessionUnknown(ctx, task, fence, session, "controller restart recovered terminal OutcomeUnknown")
+	case store.PromptExecutionCancelled:
+		execution := corev1alpha1.TaskExecutionStatus{State: corev1alpha1.TaskExecutionStateCancelled, Outcome: corev1alpha1.TaskExecutionOutcomeCancelled, Attempt: task.Status.Execution.Attempt, PromptID: task.Status.Execution.PromptID}
+		finalizeErr = d.finalizeTaskSessionMarker(ctx, task, fence, session, "Cancelled", "controller restart recovered terminal cancellation", corev1alpha1.TaskPhaseCancelled, execution)
+	case store.PromptExecutionFailed:
+		execution := corev1alpha1.TaskExecutionStatus{State: corev1alpha1.TaskExecutionStateFailed, Outcome: corev1alpha1.TaskExecutionOutcomeFailed, Attempt: task.Status.Execution.Attempt, PromptID: task.Status.Execution.PromptID}
+		finalizeErr = d.finalizeTaskSessionMarker(ctx, task, fence, session, "Failed", "controller restart recovered terminal failure", corev1alpha1.TaskPhaseFailed, execution)
+	case store.PromptExecutionSucceeded:
+		delivery := task.Status.Delivery
+		if delivery == nil {
+			delivery = deliveryStatusFromPromptState(attempt.DeliveryState)
+		}
+		phase := corev1alpha1.TaskPhaseFailed
+		switch attempt.DeliveryState {
+		case store.PromptDeliveryNotRequested, store.PromptDeliveryReadValidated, store.PromptDeliveryNoChange,
+			store.PromptDeliveryVerifiedExact, store.PromptDeliveryDeliveredSuperseded:
+			phase = corev1alpha1.TaskPhaseSucceeded
+		case store.PromptDeliveryCancelledBeforePublish:
+			phase = corev1alpha1.TaskPhaseCancelled
+		}
+		result, resultErr := d.ResultStore.GetResult(ctx, task.Namespace, task.Name)
+		if resultErr != nil {
+			return resultErr
+		}
+		publicationID := ""
+		if attempt.DeliveryState == store.PromptDeliveryVerifiedExact || attempt.DeliveryState == store.PromptDeliveryDeliveredSuperseded ||
+			attempt.DeliveryState == store.PromptDeliveryConflict || attempt.DeliveryState == store.PromptDeliveryPublicationOutcomeUnknown ||
+			attempt.DeliveryState == store.PromptDeliveryCancelledBeforePublish {
+			candidate := publicationIDForTask(task)
+			if _, publicationErr := d.Store.GetPublication(ctx, candidate); publicationErr == nil {
+				publicationID = candidate
+			} else if !errors.Is(publicationErr, store.ErrNotFound) {
+				return publicationErr
+			}
+		}
+		finalizeErr = d.finalizeTaskSessionResult(ctx, task, fence, session, string(result), publicationID, phase, *delivery)
+	}
+	if finalizeErr == nil {
+		session.finalized = true
+		d.removeRuntimeSessionBinding(session.Binding.SessionUID)
+	}
+	return finalizeErr
+}
+
+func (d *ACPDispatcher) recoverSucceededTaskProjection(ctx context.Context, task *corev1alpha1.Task, attempt *store.PromptAttempt, fence store.ControllerEpochFence) error {
+	if !store.IsTerminalPromptDeliveryState(attempt.DeliveryState) {
+		switch attempt.DeliveryState {
+		case store.PromptDeliveryValidating:
+			if err := d.transitionDelivery(ctx, attempt.ID, fence, store.PromptDeliveryValidating, store.PromptDeliveryConflict,
+				"controller-restart-workspace-lost", "runtime workspace was lost before durable validation completed"); err != nil {
+				return err
+			}
+			updatedAttempt, err := d.Store.GetPromptAttempt(ctx, attempt.ID)
+			if err != nil {
+				return err
+			}
+			attempt = updatedAttempt
+			if err := d.finalizeRecoveredTerminalSession(ctx, task, attempt, fence); err != nil {
+				return err
+			}
+			status := corev1alpha1.TaskDeliveryStatus{
+				State: corev1alpha1.TaskDeliveryStateDeliveryConflict, Outcome: corev1alpha1.TaskDeliveryOutcomeDeliveryConflict,
+				Reason: "RuntimeWorkspaceLost", Message: "runtime workspace was lost before durable validation completed", LastTransitionTime: nowMeta(),
+			}
+			return d.failTaskForDelivery(ctx, task, status, status.Message)
+		case store.PromptDeliveryPreparing, store.PromptDeliveryPrepared, store.PromptDeliveryPublishing, store.PromptDeliveryVerifying:
+			result, err := d.reconcilePersistedPublication(ctx, task, attempt.ID, fence)
+			if err != nil {
+				return err
+			}
+			if err := d.patchDeliveryStatus(ctx, task, result.Status); err != nil {
+				return err
+			}
+			attempt, err = d.Store.GetPromptAttempt(ctx, attempt.ID)
+			if err != nil {
+				return err
+			}
+			if err := d.finalizeRecoveredTerminalSession(ctx, task, attempt, fence); err != nil {
+				return err
+			}
+			switch result.Status.Outcome {
+			case corev1alpha1.TaskDeliveryOutcomeVerifiedExact, corev1alpha1.TaskDeliveryOutcomeDeliveredSuperseded:
+				return d.completeSuccessWithDelivery(ctx, task, result.Status, "ACP publication recovered after controller restart")
+			case corev1alpha1.TaskDeliveryOutcomeCancelledBeforePublish:
+				return d.cancelTaskAfterExecution(ctx, task, result.Status, "publication cancelled before push during recovery")
+			default:
+				return d.failTaskForDelivery(ctx, task, result.Status, "ACP publication recovery reached a terminal delivery failure")
+			}
+		default:
+			return fmt.Errorf("unsupported nonterminal delivery state %s during recovery", attempt.DeliveryState)
+		}
+	}
+	if err := d.finalizeRecoveredTerminalSession(ctx, task, attempt, fence); err != nil {
+		return err
+	}
+	return d.patchRecoveredTerminalExecution(ctx, task, attempt, fence.Epoch)
+}
+
+func (d *ACPDispatcher) recoveredTerminalDeliveryStatus(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attempt *store.PromptAttempt,
+) (*corev1alpha1.TaskDeliveryStatus, error) {
+	switch attempt.DeliveryState {
+	case store.PromptDeliveryVerifiedExact, store.PromptDeliveryDeliveredSuperseded,
+		store.PromptDeliveryConflict, store.PromptDeliveryCredentialBlocked,
+		store.PromptDeliveryPublicationOutcomeUnknown, store.PromptDeliveryCancelledBeforePublish:
+		publication, err := d.Store.GetPublication(ctx, publicationIDForTask(task))
+		if errors.Is(err, store.ErrNotFound) && task.Status.Delivery != nil && task.Status.Delivery.Outcome != "" {
+			status := *task.Status.Delivery
+			return &status, nil
+		}
+		if err != nil {
+			return nil, err
+		}
+		artifact := harnessv2.ArtifactReference{
+			ArtifactID: harnessv2.ArtifactID(publication.ArtifactID), Digest: publication.ArtifactDigest,
+			SizeBytes: publication.ArtifactSizeBytes, MediaType: publication.ArtifactMediaType,
+		}
+		delta := harnessv2.WorkspaceDeltaDescriptor{
+			State: harnessv2.WorkspaceDeltaPrepared, Intent: harnessv2.WorkspaceIntentWrite,
+			VerifiedBaseline: harnessv2.WorkspaceBaseline{RepositoryIdentity: publication.SourceRepositoryID, Revision: publication.SourceBaselineSHA},
+			RelativeRoot:     strings.TrimSpace(task.Spec.Workspace.SubPath), Artifact: &artifact,
+			PublicationSafe: true, NoFollowVerified: true,
+		}
+		status := publicationTaskDeliveryStatus(task.Spec.Workspace, delta.VerifiedBaseline, delta, publication, strings.TrimPrefix(publication.TargetRef, "refs/heads/"))
+		if task.Status.Delivery != nil && task.Status.Delivery.Reason == corev1alpha1.TaskDeliveryReasonCancellationRequestedAfterPublish {
+			status.Reason = task.Status.Delivery.Reason
+			status.Message = task.Status.Delivery.Message
+		}
+		return &status, nil
+	default:
+		if task.Status.Delivery != nil && store.PromptDeliveryState(task.Status.Delivery.State) == attempt.DeliveryState {
+			return task.Status.Delivery.DeepCopy(), nil
+		}
+		return deliveryStatusFromPromptState(attempt.DeliveryState), nil
+	}
+}
+
+func (d *ACPDispatcher) patchRecoveredTerminalExecution(ctx context.Context, task *corev1alpha1.Task, attempt *store.PromptAttempt, epoch int64) error {
+	if attempt.ExecutionState == store.PromptExecutionSucceeded {
+		status, err := d.recoveredTerminalDeliveryStatus(ctx, task, attempt)
+		if err != nil {
+			return err
+		}
+		switch attempt.DeliveryState {
+		case store.PromptDeliveryNotRequested, store.PromptDeliveryReadValidated, store.PromptDeliveryNoChange,
+			store.PromptDeliveryVerifiedExact, store.PromptDeliveryDeliveredSuperseded:
+			return d.completeSuccessWithDelivery(ctx, task, *status, "ACP task recovered after controller restart")
+		default:
+			return d.failTaskForDelivery(ctx, task, *status, "ACP delivery recovered as terminal failure after controller restart")
+		}
+	}
+	return d.patchRecoveredExecutionMessage(ctx, task, epoch, acpControllerRestartRecoveredReason, "terminal ACP attempt recovered under the new controller epoch")
+}
+
+func (d *ACPDispatcher) patchRecoveredExecutionMessage(ctx context.Context, task *corev1alpha1.Task, epoch int64, reason corev1alpha1.TaskExecutionReason, message string) error {
+	key := types.NamespacedName{Namespace: task.Namespace, Name: task.Name}
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		latest := &corev1alpha1.Task{}
+		if err := d.Client.Get(ctx, key, latest); err != nil {
+			if apierrors.IsNotFound(err) {
+				return nil
+			}
+			return err
+		}
+		base := latest.DeepCopy()
+		if latest.Status.Execution == nil {
+			return nil
+		}
+		latest.Status.Execution.ControllerEpoch = epoch
+		latest.Status.Execution.Reason = reason
+		latest.Status.Execution.Message = message
+		latest.Status.Execution.LastTransitionTime = nowMeta()
+		return d.Client.Status().Patch(ctx, latest, client.MergeFrom(base))
+	})
+}
+
+func deliveryStatusFromPromptState(state store.PromptDeliveryState) *corev1alpha1.TaskDeliveryStatus {
+	now := metav1.Now()
+	status := &corev1alpha1.TaskDeliveryStatus{State: corev1alpha1.TaskDeliveryState(state), Outcome: corev1alpha1.TaskDeliveryOutcome(state), LastTransitionTime: &now}
+	return status
+}
diff --git a/internal/controller/acp_recovery_test.go b/internal/controller/acp_recovery_test.go
new file mode 100644
index 000000000..3d128d2eb
--- /dev/null
+++ b/internal/controller/acp_recovery_test.go
@@ -0,0 +1,2589 @@
+package controller
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"path/filepath"
+	"reflect"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	coordinationv1 "k8s.io/api/coordination/v1"
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	apiMeta "k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/labels"
+	"github.com/orka-agents/orka/internal/store"
+	kubestore "github.com/orka-agents/orka/internal/store/kube"
+	"github.com/orka-agents/orka/internal/store/sqlite"
+)
+
+const acpTestModel = "gpt-test"
+
+type missingRecoveryPromptAttemptStore struct {
+	store.DurableControlStore
+	calls atomic.Int32
+}
+
+func (s *missingRecoveryPromptAttemptStore) GetPromptAttempt(context.Context, string) (*store.PromptAttempt, error) {
+	s.calls.Add(1)
+	return nil, store.ErrNotFound
+}
+
+type failOnceRecoveryProjectionStore struct {
+	store.DurableControlStore
+	err   error
+	calls atomic.Int32
+}
+
+func (s *failOnceRecoveryProjectionStore) EnqueueOutboxProjection(
+	ctx context.Context,
+	projection *store.OutboxProjection,
+	fence store.ControllerEpochFence,
+) (*store.OutboxProjection, error) {
+	if s.calls.Add(1) == 1 {
+		return nil, s.err
+	}
+	return s.DurableControlStore.EnqueueOutboxProjection(ctx, projection, fence)
+}
+
+func TestACPDispatcherRecoverySkipsTaskDeletedAfterCachedList(t *testing.T) {
+	fixture := newACPRecoveryFixture(t, store.PromptExecutionPlanned)
+	defer fixture.close(t)
+
+	missingStore := &missingRecoveryPromptAttemptStore{DurableControlStore: fixture.controlStore}
+	fixture.dispatcher.Store = missingStore
+	getCalls := 0
+	watchClient, ok := fixture.kubeClient.(client.WithWatch)
+	if !ok {
+		t.Fatal("recovery fake client does not implement client.WithWatch")
+	}
+	fixture.dispatcher.APIReader = interceptor.NewClient(watchClient, interceptor.Funcs{
+		Get: func(ctx context.Context, c client.WithWatch, key client.ObjectKey, obj client.Object, opts ...client.GetOption) error {
+			if _, isTask := obj.(*corev1alpha1.Task); !isTask {
+				return c.Get(ctx, key, obj, opts...)
+			}
+			getCalls++
+			if getCalls == 1 {
+				return c.Get(ctx, key, obj, opts...)
+			}
+			return apierrors.NewNotFound(
+				schema.GroupResource{Group: corev1alpha1.GroupVersion.Group, Resource: "tasks"},
+				key.Name,
+			)
+		},
+	})
+
+	if err := fixture.dispatcher.recoverStaleAttempts(fixture.ctx); err != nil {
+		t.Fatalf("recoverStaleAttempts() error = %v, want deleted Task race ignored", err)
+	}
+	if getCalls != 2 {
+		t.Fatalf("Task reads = %d, want initial refresh plus post-not-found recheck", getCalls)
+	}
+	if missingStore.calls.Load() != 1 {
+		t.Fatalf("GetPromptAttempt calls = %d, want 1", missingStore.calls.Load())
+	}
+}
+
+func TestACPDispatcherRecoveryFailsClosedWhenAttemptMissingForLiveTask(t *testing.T) {
+	fixture := newACPRecoveryFixture(t, store.PromptExecutionPlanned)
+	defer fixture.close(t)
+
+	missingStore := &missingRecoveryPromptAttemptStore{DurableControlStore: fixture.controlStore}
+	fixture.dispatcher.Store = missingStore
+
+	err := fixture.dispatcher.recoverStaleAttempts(fixture.ctx)
+	if err == nil || !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("recoverStaleAttempts() error = %v, want ErrNotFound for a still-live Task", err)
+	}
+	if missingStore.calls.Load() != 1 {
+		t.Fatalf("GetPromptAttempt calls = %d, want 1", missingStore.calls.Load())
+	}
+}
+
+func TestACPDispatcherRecoversPreSubmissionAttemptUnderNewEpoch(t *testing.T) {
+	fixture := newACPRecoveryFixture(t, store.PromptExecutionPlanned)
+	defer fixture.close(t)
+
+	if err := fixture.dispatcher.recoverStaleAttempts(fixture.ctx); err != nil {
+		t.Fatal(err)
+	}
+	attempt, err := fixture.controlStore.GetPromptAttempt(fixture.ctx, fixture.attemptID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if attempt.ExecutionState != store.PromptExecutionReserved || attempt.ControllerEpoch != fixture.fence.Epoch || attempt.RuntimeInstanceID != "" {
+		t.Fatalf("recovered attempt = %#v", attempt)
+	}
+	task := &corev1alpha1.Task{}
+	if err := fixture.kubeClient.Get(fixture.ctx, types.NamespacedName{Namespace: "default", Name: "task"}, task); err != nil {
+		t.Fatal(err)
+	}
+	if task.Status.Execution == nil || task.Status.Execution.State != corev1alpha1.TaskExecutionStateReserved || task.Status.Execution.ControllerEpoch != fixture.fence.Epoch {
+		t.Fatalf("recovered task = %#v", task.Status.Execution)
+	}
+}
+
+func TestACPDispatcherMakesAcceptedOldEpochAttemptOutcomeUnknown(t *testing.T) {
+	fixture := newACPRecoveryFixture(t, store.PromptExecutionAccepted)
+	defer fixture.close(t)
+
+	if err := fixture.dispatcher.recoverStaleAttempts(fixture.ctx); err != nil {
+		t.Fatal(err)
+	}
+	attempt, err := fixture.controlStore.GetPromptAttempt(fixture.ctx, fixture.attemptID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if attempt.ExecutionState != store.PromptExecutionOutcomeUnknown || attempt.OutcomeMarker == "" {
+		t.Fatalf("recovered attempt = %#v", attempt)
+	}
+	task := &corev1alpha1.Task{}
+	if err := fixture.kubeClient.Get(fixture.ctx, types.NamespacedName{Namespace: "default", Name: "task"}, task); err != nil {
+		t.Fatal(err)
+	}
+	if task.Status.Phase != corev1alpha1.TaskPhaseFailed || task.Status.Execution == nil || task.Status.Execution.Outcome != corev1alpha1.TaskExecutionOutcomeOutcomeUnknown {
+		t.Fatalf("recovered task status = %#v", task.Status)
+	}
+}
+
+func TestACPDispatcherFailsRestoredPreSubmissionTaskWithoutReplayingUnderNewUID(t *testing.T) {
+	fixture := newACPRecoveryFixture(t, store.PromptExecutionPlanned)
+	defer fixture.close(t)
+
+	sourceUID, restoredUID := restoreACPRecoveryFixtureTask(t, fixture)
+	if err := fixture.dispatcher.recoverStaleAttempts(fixture.ctx); err != nil {
+		t.Fatal(err)
+	}
+
+	attempt, err := fixture.controlStore.GetPromptAttempt(fixture.ctx, fixture.attemptID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if attempt.Key.TaskUID != string(sourceUID) || attempt.ExecutionState != store.PromptExecutionFailed {
+		t.Fatalf("source attempt = %#v", attempt)
+	}
+	targetAttemptID, err := (store.PromptAttemptKey{
+		Namespace: "default", TaskUID: string(restoredUID), Attempt: 1, PromptID: attempt.Key.PromptID,
+	}).CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := fixture.controlStore.GetPromptAttempt(fixture.ctx, targetAttemptID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("target-incarnation attempt lookup error = %v, want ErrNotFound", err)
+	}
+	projection := assertRestoredTaskTerminalProjection(t, fixture, sourceUID, restoredUID,
+		corev1alpha1.TaskExecutionStateFailed, corev1alpha1.TaskExecutionOutcomeFailed, acpRestorePreSubmissionMessage)
+
+	task := &corev1alpha1.Task{}
+	if err := fixture.kubeClient.Get(fixture.ctx, types.NamespacedName{Namespace: "default", Name: "task"}, task); err != nil {
+		t.Fatal(err)
+	}
+	if task.UID != restoredUID || task.Status.Phase != corev1alpha1.TaskPhaseFailed || task.Status.CompletionTime == nil ||
+		task.Status.Execution == nil || task.Status.Execution.State != corev1alpha1.TaskExecutionStateFailed ||
+		task.Status.Execution.Outcome != corev1alpha1.TaskExecutionOutcomeFailed ||
+		task.Status.Execution.Reason != corev1alpha1.TaskExecutionReason(acpRestoreIdentityChangedReason) ||
+		task.Status.Execution.ControllerEpoch != fixture.fence.Epoch {
+		t.Fatalf("restored task status = %#v", task.Status)
+	}
+
+	version, completion, projectionVersion := attempt.Version, task.Status.CompletionTime.DeepCopy(), projection.Version
+	if err := fixture.dispatcher.recoverStaleAttempts(fixture.ctx); err != nil {
+		t.Fatal(err)
+	}
+	attempt, err = fixture.controlStore.GetPromptAttempt(fixture.ctx, fixture.attemptID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if attempt.Version != version {
+		t.Fatalf("idempotent recovery changed source attempt version: got %d, want %d", attempt.Version, version)
+	}
+	if err := fixture.kubeClient.Get(fixture.ctx, types.NamespacedName{Namespace: "default", Name: "task"}, task); err != nil {
+		t.Fatal(err)
+	}
+	if task.Status.CompletionTime == nil || !task.Status.CompletionTime.Equal(completion) {
+		t.Fatalf("idempotent recovery changed completion time: got %v, want %v", task.Status.CompletionTime, completion)
+	}
+	projection = assertRestoredTaskTerminalProjection(t, fixture, sourceUID, restoredUID,
+		corev1alpha1.TaskExecutionStateFailed, corev1alpha1.TaskExecutionOutcomeFailed, acpRestorePreSubmissionMessage)
+	if projection.Version != projectionVersion {
+		t.Fatalf("idempotent recovery changed source projection version: got %d, want %d", projection.Version, projectionVersion)
+	}
+}
+
+func TestACPDispatcherRestoredTaskRecoveryReconstructsProjectionAfterCommittedAttemptTransition(t *testing.T) {
+	fixture := newACPRecoveryFixture(t, store.PromptExecutionPlanned)
+	defer fixture.close(t)
+
+	sourceUID, restoredUID := restoreACPRecoveryFixtureTask(t, fixture)
+	injectedErr := errors.New("injected projection enqueue failure")
+	failingStore := &failOnceRecoveryProjectionStore{DurableControlStore: fixture.controlStore, err: injectedErr}
+	fixture.dispatcher.Store = failingStore
+	if err := fixture.dispatcher.recoverStaleAttempts(fixture.ctx); !errors.Is(err, injectedErr) {
+		t.Fatalf("first recoverStaleAttempts() error = %v, want injected enqueue failure", err)
+	}
+
+	attempt, err := fixture.controlStore.GetPromptAttempt(fixture.ctx, fixture.attemptID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if attempt.ExecutionState != store.PromptExecutionFailed ||
+		attempt.TerminalReason != acpRestoreIdentityChangedReason || attempt.OutcomeMarker != acpRestorePreSubmissionMessage {
+		t.Fatalf("committed source attempt = %#v", attempt)
+	}
+	committedVersion := attempt.Version
+	projectionID := standaloneTaskTerminalProjectionIDForUID("default", sourceUID, 1)
+	if _, err := fixture.controlStore.GetOutboxProjection(fixture.ctx, projectionID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("projection after injected failure lookup error = %v, want ErrNotFound", err)
+	}
+	task := &corev1alpha1.Task{}
+	if err := fixture.kubeClient.Get(fixture.ctx, types.NamespacedName{Namespace: "default", Name: "task"}, task); err != nil {
+		t.Fatal(err)
+	}
+	if task.Status.Execution == nil || task.Status.Execution.Reason == corev1alpha1.TaskExecutionReason(acpRestoreIdentityChangedReason) {
+		t.Fatalf("Task was terminally patched before projection durability: %#v", task.Status.Execution)
+	}
+
+	if err := fixture.dispatcher.recoverStaleAttempts(fixture.ctx); err != nil {
+		t.Fatal(err)
+	}
+	attempt, err = fixture.controlStore.GetPromptAttempt(fixture.ctx, fixture.attemptID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if attempt.Version != committedVersion {
+		t.Fatalf("projection reconstruction changed source attempt version: got %d, want %d", attempt.Version, committedVersion)
+	}
+	assertRestoredTaskTerminalProjection(t, fixture, sourceUID, restoredUID,
+		corev1alpha1.TaskExecutionStateFailed, corev1alpha1.TaskExecutionOutcomeFailed, acpRestorePreSubmissionMessage)
+}
+
+func TestACPDispatcherMarksRestoredPostWriteTaskOutcomeUnknown(t *testing.T) {
+	fixture := newACPRecoveryFixture(t, store.PromptExecutionAccepted)
+	defer fixture.close(t)
+
+	sourceUID, restoredUID := restoreACPRecoveryFixtureTask(t, fixture)
+	if err := fixture.dispatcher.recoverStaleAttempts(fixture.ctx); err != nil {
+		t.Fatal(err)
+	}
+	attempt, err := fixture.controlStore.GetPromptAttempt(fixture.ctx, fixture.attemptID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if attempt.ExecutionState != store.PromptExecutionOutcomeUnknown ||
+		attempt.TerminalReason != acpRestoreIdentityChangedReason || attempt.OutcomeMarker == "" {
+		t.Fatalf("source attempt = %#v", attempt)
+	}
+	task := &corev1alpha1.Task{}
+	if err := fixture.kubeClient.Get(fixture.ctx, types.NamespacedName{Namespace: "default", Name: "task"}, task); err != nil {
+		t.Fatal(err)
+	}
+	if task.Status.Execution == nil || task.Status.Execution.State != corev1alpha1.TaskExecutionStateOutcomeUnknown ||
+		task.Status.Execution.Outcome != corev1alpha1.TaskExecutionOutcomeOutcomeUnknown ||
+		task.Status.Execution.Reason != corev1alpha1.TaskExecutionReason(acpRestoreIdentityChangedReason) {
+		t.Fatalf("restored task execution = %#v", task.Status.Execution)
+	}
+	assertRestoredTaskTerminalProjection(t, fixture, sourceUID, restoredUID,
+		corev1alpha1.TaskExecutionStateOutcomeUnknown, corev1alpha1.TaskExecutionOutcomeOutcomeUnknown, acpRestorePostWriteMessage)
+}
+
+func TestACPDispatcherRestoredTaskRecordsSourceBoundCleanupWhenRuntimeIsAbsent(t *testing.T) {
+	fixture := newACPRecoveryFixture(t, store.PromptExecutionAccepted)
+	defer fixture.close(t)
+
+	sourceUID, _ := restoreACPRecoveryFixtureTask(t, fixture)
+	task := &corev1alpha1.Task{}
+	key := types.NamespacedName{Namespace: "default", Name: "task"}
+	if err := fixture.kubeClient.Get(fixture.ctx, key, task); err != nil {
+		t.Fatal(err)
+	}
+	task.Status.Execution.RuntimePoolName = "absent-restored-pool"
+	task.Status.Execution.RuntimeInstanceID = "source-runtime-instance"
+	task.Status.Execution.RuntimeSessionUID = "source-runtime-session"
+	task.Status.Execution.RuntimeSessionGeneration = 3
+	task.Status.Execution.RuntimeSessionCleanupDigest = ""
+	if err := fixture.kubeClient.Status().Update(fixture.ctx, task); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := fixture.dispatcher.recoverStaleAttempts(fixture.ctx); err != nil {
+		t.Fatal(err)
+	}
+	if err := fixture.kubeClient.Get(fixture.ctx, key, task); err != nil {
+		t.Fatal(err)
+	}
+	wantDigest, err := taskScopedRuntimeSessionCleanupDigest(
+		sourceUID, task.Status.Execution.Attempt, task.Status.Execution.RuntimeInstanceID,
+		task.Status.Execution.RuntimeSessionUID, task.Status.Execution.RuntimeSessionGeneration,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if task.Status.Execution.RuntimeSessionCleanupDigest != wantDigest || !taskScopedRuntimeSessionCleanupComplete(task) {
+		t.Fatalf("restored cleanup receipt = %q, want source-bound %q", task.Status.Execution.RuntimeSessionCleanupDigest, wantDigest)
+	}
+
+	projector := &ACPOutboxProjector{
+		Client: fixture.kubeClient, Store: fixture.controlStore, Epochs: fixture.dispatcher.Epochs,
+		WorkerID: "restored-cleanup-projector", MaxAttempts: 3,
+	}
+	if err := projector.projectOnce(fixture.ctx); err != nil {
+		t.Fatal(err)
+	}
+	projectionID := standaloneTaskTerminalProjectionIDForUID(task.Namespace, sourceUID, task.Status.Execution.Attempt)
+	projection, err := fixture.controlStore.GetOutboxProjection(fixture.ctx, projectionID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if projection.State != store.OutboxProjectionDelivered {
+		t.Fatalf("restored source projection state = %s, want Delivered", projection.State)
+	}
+	reconciler := &TaskReconciler{Client: fixture.kubeClient, DurableControlStore: fixture.controlStore}
+	ready, err := reconciler.acpTaskDeletionReady(fixture.ctx, task)
+	if err != nil || !ready {
+		t.Fatalf("restored Task deletion readiness = %v, %v", ready, err)
+	}
+}
+
+//nolint:gocyclo // The restored publication states intentionally share one complete recovery/idempotency/finalizer matrix.
+func TestACPDispatcherRestoredTerminalExecutionSettlesNonterminalDeliveryAndPublication(t *testing.T) {
+	tests := []struct {
+		name                 string
+		deliveryState        store.PromptDeliveryState
+		publicationState     store.PublicationState
+		wantDeliveryState    store.PromptDeliveryState
+		wantPublicationState store.PublicationState
+		wantPreparedReceipt  bool
+		wantPhase            corev1alpha1.TaskPhase
+	}{
+		{
+			name: "validating before publication creation", deliveryState: store.PromptDeliveryValidating,
+			wantDeliveryState: store.PromptDeliveryConflict, wantPhase: corev1alpha1.TaskPhaseFailed,
+		},
+		{
+			name: "validating after publication creation", deliveryState: store.PromptDeliveryValidating,
+			publicationState: store.PublicationPreparing, wantDeliveryState: store.PromptDeliveryPublicationOutcomeUnknown,
+			wantPublicationState: store.PublicationOutcomeUnknown, wantPhase: corev1alpha1.TaskPhaseFailed,
+		},
+		{
+			name: "prepared before remote write", deliveryState: store.PromptDeliveryPrepared,
+			publicationState: store.PublicationPrepared, wantDeliveryState: store.PromptDeliveryCancelledBeforePublish,
+			wantPublicationState: store.PublicationCancelledBeforePublish, wantPreparedReceipt: true,
+			wantPhase: corev1alpha1.TaskPhaseCancelled,
+		},
+		{
+			name: "publishing with remote outcome unknown", deliveryState: store.PromptDeliveryPublishing,
+			publicationState: store.PublicationPublishing, wantDeliveryState: store.PromptDeliveryPublicationOutcomeUnknown,
+			wantPublicationState: store.PublicationOutcomeUnknown, wantPreparedReceipt: true,
+			wantPhase: corev1alpha1.TaskPhaseFailed,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fixture := newACPRecoveryFixture(t, store.PromptExecutionAccepted)
+			defer fixture.close(t)
+
+			attempt, err := fixture.controlStore.GetPromptAttempt(fixture.ctx, fixture.attemptID)
+			if err != nil {
+				t.Fatal(err)
+			}
+			for _, next := range []store.PromptExecutionState{
+				store.PromptExecutionRunning, store.PromptExecutionSettling, store.PromptExecutionSucceeded,
+			} {
+				attempt, err = fixture.controlStore.TransitionPromptAttemptExecution(fixture.ctx, store.PromptAttemptExecutionTransition{
+					ID: attempt.ID, Fence: fixture.fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+					NewState: next, OperationID: "restore-terminal-" + string(next),
+					OperationDigest: testControlDigestForDispatcher("restore-terminal-" + string(next)), UpdatedAt: time.Now().UTC(),
+				})
+				if err != nil {
+					t.Fatalf("transition source execution to %s: %v", next, err)
+				}
+			}
+			deliveryPath := []store.PromptDeliveryState{store.PromptDeliveryValidating}
+			switch tt.deliveryState {
+			case store.PromptDeliveryValidating:
+			case store.PromptDeliveryPrepared:
+				deliveryPath = append(deliveryPath, store.PromptDeliveryPreparing, store.PromptDeliveryPrepared)
+			case store.PromptDeliveryPublishing:
+				deliveryPath = append(deliveryPath, store.PromptDeliveryPreparing, store.PromptDeliveryPrepared)
+				deliveryPath = append(deliveryPath, store.PromptDeliveryPublishing)
+			default:
+				t.Fatalf("unsupported delivery fixture state %s", tt.deliveryState)
+			}
+			for _, next := range deliveryPath {
+				attempt, err = fixture.controlStore.TransitionPromptAttemptDelivery(fixture.ctx, store.PromptAttemptDeliveryTransition{
+					ID: attempt.ID, Fence: fixture.fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.DeliveryState,
+					NewState: next, OperationID: "restore-delivery-" + string(next),
+					OperationDigest: testControlDigestForDispatcher("restore-delivery-" + string(next)), UpdatedAt: time.Now().UTC(),
+				})
+				if err != nil {
+					t.Fatalf("transition source delivery to %s: %v", next, err)
+				}
+			}
+
+			key := types.NamespacedName{Namespace: "default", Name: "task"}
+			task := &corev1alpha1.Task{}
+			if err := fixture.kubeClient.Get(fixture.ctx, key, task); err != nil {
+				t.Fatal(err)
+			}
+			task.Spec.Workspace = &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentWrite}
+			if err := fixture.kubeClient.Update(fixture.ctx, task); err != nil {
+				t.Fatal(err)
+			}
+			if err := fixture.kubeClient.Get(fixture.ctx, key, task); err != nil {
+				t.Fatal(err)
+			}
+			task.Status.Phase = corev1alpha1.TaskPhaseRunning
+			task.Status.Execution.State = corev1alpha1.TaskExecutionStateSucceeded
+			task.Status.Execution.Outcome = corev1alpha1.TaskExecutionOutcomeSucceeded
+			evidenceTransition := metav1.NewTime(time.Date(2026, 8, 10, 11, 0, 0, 0, time.UTC))
+			task.Status.Delivery = restoredDeliveryEvidenceFixture(tt.deliveryState, "", evidenceTransition)
+			publicationID := publicationIDForTask(task)
+			task.Status.Delivery.PublicationID = publicationID
+			var publication *store.Publication
+			if tt.publicationState != "" {
+				publication = createACPRecoveryPublication(t, fixture, task, tt.publicationState)
+			}
+			sourceDeliveryEvidence := task.Status.Delivery.DeepCopy()
+			if err := fixture.kubeClient.Status().Update(fixture.ctx, task); err != nil {
+				t.Fatal(err)
+			}
+
+			sourceUID, restoredUID := restoreACPRecoveryFixtureTask(t, fixture)
+			if err := fixture.dispatcher.recoverStaleAttempts(fixture.ctx); err != nil {
+				t.Fatal(err)
+			}
+
+			attempt, err = fixture.controlStore.GetPromptAttempt(fixture.ctx, fixture.attemptID)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if attempt.ExecutionState != store.PromptExecutionSucceeded || attempt.DeliveryState != tt.wantDeliveryState {
+				t.Fatalf("settled source PromptAttempt = %#v", attempt)
+			}
+			if tt.wantPublicationState == "" {
+				if _, err := fixture.controlStore.GetPublication(fixture.ctx, publicationID); !errors.Is(err, store.ErrNotFound) {
+					t.Fatalf("restored recovery invented Publication %q: %v", publicationID, err)
+				}
+			} else {
+				publication, err = fixture.controlStore.GetPublication(fixture.ctx, publicationID)
+				if err != nil {
+					t.Fatal(err)
+				}
+				if publication.TaskUID != string(sourceUID) || publication.State != tt.wantPublicationState ||
+					(publication.PreparedReceipt != nil) != tt.wantPreparedReceipt {
+					t.Fatalf("settled source Publication = %#v", publication)
+				}
+			}
+			if err := fixture.kubeClient.Get(fixture.ctx, key, task); err != nil {
+				t.Fatal(err)
+			}
+			if task.UID != restoredUID || task.Status.Phase != tt.wantPhase || task.Status.Execution == nil ||
+				task.Status.Execution.State != corev1alpha1.TaskExecutionStateSucceeded ||
+				task.Status.Execution.Outcome != corev1alpha1.TaskExecutionOutcomeSucceeded ||
+				task.Status.Execution.Reason != corev1alpha1.TaskExecutionReason(acpRestoreIdentityChangedReason) ||
+				task.Status.Delivery == nil || store.PromptDeliveryState(task.Status.Delivery.State) != tt.wantDeliveryState {
+				t.Fatalf("settled restored Task status = %#v", task.Status)
+			}
+			assertRestoredDeliveryEvidence(t, task.Status.Delivery, sourceDeliveryEvidence, tt.wantDeliveryState)
+			if task.Status.Delivery.LastTransitionTime.Equal(sourceDeliveryEvidence.LastTransitionTime) {
+				t.Fatal("restored delivery settlement did not advance its transition time")
+			}
+			firstRestoredDelivery := task.Status.Delivery.DeepCopy()
+			projectionID := standaloneTaskTerminalProjectionIDForUID(task.Namespace, sourceUID, task.Status.Execution.Attempt)
+			projection, err := fixture.controlStore.GetOutboxProjection(fixture.ctx, projectionID)
+			if err != nil {
+				t.Fatal(err)
+			}
+			var payload taskTerminalProjection
+			if err := json.Unmarshal(projection.Payload, &payload); err != nil {
+				t.Fatal(err)
+			}
+			if payload.TaskUID != string(sourceUID) || payload.Phase != tt.wantPhase ||
+				payload.Execution.State != corev1alpha1.TaskExecutionStateSucceeded || payload.Delivery == nil ||
+				store.PromptDeliveryState(payload.Delivery.State) != tt.wantDeliveryState {
+				t.Fatalf("settled source projection payload = %#v", payload)
+			}
+			assertRestoredDeliveryEvidence(t, payload.Delivery, sourceDeliveryEvidence, tt.wantDeliveryState)
+			if !reflect.DeepEqual(payload.Delivery, task.Status.Delivery) {
+				t.Fatalf("projection and restored Task delivery evidence differ: projection=%#v task=%#v", payload.Delivery, task.Status.Delivery)
+			}
+
+			attemptVersion, projectionVersion := attempt.Version, projection.Version
+			publicationVersion := int64(0)
+			if publication != nil {
+				publicationVersion = publication.Version
+			}
+			if err := fixture.dispatcher.recoverStaleAttempts(fixture.ctx); err != nil {
+				t.Fatalf("idempotent restored recovery: %v", err)
+			}
+			attempt, err = fixture.controlStore.GetPromptAttempt(fixture.ctx, fixture.attemptID)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if tt.wantPublicationState == "" {
+				if _, err := fixture.controlStore.GetPublication(fixture.ctx, publicationID); !errors.Is(err, store.ErrNotFound) {
+					t.Fatalf("idempotent recovery invented Publication %q: %v", publicationID, err)
+				}
+			} else {
+				publication, err = fixture.controlStore.GetPublication(fixture.ctx, publicationID)
+				if err != nil {
+					t.Fatal(err)
+				}
+				if publication.Version != publicationVersion {
+					t.Fatalf("idempotent recovery changed Publication version: got %d, want %d", publication.Version, publicationVersion)
+				}
+			}
+			projection, err = fixture.controlStore.GetOutboxProjection(fixture.ctx, projectionID)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if attempt.Version != attemptVersion || projection.Version != projectionVersion {
+				t.Fatalf("idempotent recovery changed versions: attempt %d/%d projection %d/%d",
+					attemptVersion, attempt.Version, projectionVersion, projection.Version)
+			}
+			if err := fixture.kubeClient.Get(fixture.ctx, key, task); err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(task.Status.Delivery, firstRestoredDelivery) {
+				t.Fatalf("idempotent recovery changed restored delivery evidence: before=%#v after=%#v", firstRestoredDelivery, task.Status.Delivery)
+			}
+
+			projector := &ACPOutboxProjector{
+				Client: fixture.kubeClient, Store: fixture.controlStore, Epochs: fixture.dispatcher.Epochs,
+				WorkerID: "restored-publication-projector", MaxAttempts: 3,
+			}
+			if err := projector.projectOnce(fixture.ctx); err != nil {
+				t.Fatal(err)
+			}
+			reconciler := &TaskReconciler{Client: fixture.kubeClient, DurableControlStore: fixture.controlStore}
+			ready, err := reconciler.acpTaskDeletionReady(fixture.ctx, task)
+			if err != nil || !ready {
+				t.Fatalf("settled restored Task deletion readiness = %v, %v", ready, err)
+			}
+		})
+	}
+}
+
+// TestDeletingRestoredACPTaskReclaimsSourcePromptAttemptAndRemovesFinalizer
+// isolates the Kubernetes-backed PromptAttempt reclamation/finalizer boundary.
+// The recovery matrix above separately proves source-UID Publication settlement
+// and projection continuity for write workspaces.
+//
+//nolint:gocyclo // The matrix keeps each crash-tail step and its exactly-once assertions visible together.
+func TestDeletingRestoredACPTaskReclaimsSourcePromptAttemptAndRemovesFinalizer(t *testing.T) {
+	tests := []struct {
+		name     string
+		delivery store.PromptDeliveryState
+		phase    corev1alpha1.TaskPhase
+	}{
+		{name: "succeeded verified exact", delivery: store.PromptDeliveryVerifiedExact, phase: corev1alpha1.TaskPhaseSucceeded},
+		{name: "succeeded cancelled before publish", delivery: store.PromptDeliveryCancelledBeforePublish, phase: corev1alpha1.TaskPhaseCancelled},
+		{name: "succeeded publication outcome unknown", delivery: store.PromptDeliveryPublicationOutcomeUnknown, phase: corev1alpha1.TaskPhaseFailed},
+	}
+	for index, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+			defer cancel()
+
+			sourceUID := types.UID(fmt.Sprintf("55555555-5555-5555-5555-%012d", index+1))
+			restoredUID := types.UID(fmt.Sprintf("66666666-6666-6666-6666-%012d", index+1))
+			taskName := "restored-finalizer-" + strconv.Itoa(index+1)
+			promptID := "prompt-" + string(sourceUID) + "-1"
+			sourceTask := &corev1alpha1.Task{
+				ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: taskName, UID: sourceUID},
+				Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent},
+			}
+			reconciler := newUnitReconciler(newTestScheme(), sourceTask)
+			base := withControllerEpochLeaseUIDs(t, reconciler.Client)
+			var promptAttemptDeletes atomic.Int32
+			var finalizerPatches atomic.Int32
+			intercepted := interceptor.NewClient(base, interceptor.Funcs{
+				Delete: func(ctx context.Context, delegate client.WithWatch, object client.Object, options ...client.DeleteOption) error {
+					if _, isPromptAttempt := object.(*corev1alpha1.PromptAttempt); isPromptAttempt {
+						promptAttemptDeletes.Add(1)
+					}
+					return delegate.Delete(ctx, object, options...)
+				},
+				Patch: func(ctx context.Context, delegate client.WithWatch, object client.Object, patch client.Patch, options ...client.PatchOption) error {
+					if _, isTask := object.(*corev1alpha1.Task); isTask {
+						call := finalizerPatches.Add(1)
+						if call == 1 {
+							return errors.New("simulated crash after durable PromptAttempt reclamation")
+						}
+					}
+					return delegate.Patch(ctx, object, patch, options...)
+				},
+			})
+			reconciler.Client = intercepted
+			reconciler.APIReader = intercepted
+
+			db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "restored-finalizer.db"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer db.Close() //nolint:errcheck
+			persistence := sqlite.NewStore(db, "restored-finalizer")
+			controlStore, err := kubestore.NewComposite(intercepted, "default", persistence, kubestore.WithAPIReader(intercepted))
+			if err != nil {
+				t.Fatal(err)
+			}
+			epochs, stopEpoch := startACPRecoveryEpochManager(t, ctx, controlStore, "restored-finalizer-"+strconv.Itoa(index+1))
+			defer stopEpoch()
+			fence, err := epochs.CurrentFence(ctx)
+			if err != nil {
+				t.Fatal(err)
+			}
+			reconciler.DurableControlStore = controlStore
+			reconciler.ControllerEpochManager = epochs
+
+			attemptKey := store.PromptAttemptKey{Namespace: sourceTask.Namespace, TaskUID: string(sourceUID), Attempt: 1, PromptID: promptID}
+			attempt, err := controlStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{
+				Key: attemptKey, RequestDigest: testControlDigestForDispatcher("restored-finalizer-" + strconv.Itoa(index+1)),
+			}), fence)
+			if err != nil {
+				t.Fatal(err)
+			}
+			for _, state := range []store.PromptExecutionState{
+				store.PromptExecutionReserved, store.PromptExecutionSessionStarting, store.PromptExecutionPlanned,
+				store.PromptExecutionSubmitting, store.PromptExecutionAccepted, store.PromptExecutionRunning,
+				store.PromptExecutionSettling, store.PromptExecutionSucceeded,
+			} {
+				attempt = transitionACPRecoveryAttempt(t, ctx, controlStore, fence, attempt, state, nil)
+			}
+			attempt = transitionRestoredFinalizerDelivery(t, ctx, controlStore, fence, attempt, tt.delivery)
+
+			transitionTime := metav1.NewTime(time.Date(2026, 8, 10, 14, index, 0, 0, time.UTC))
+			execution := corev1alpha1.TaskExecutionStatus{
+				State: corev1alpha1.TaskExecutionStateSucceeded, Outcome: corev1alpha1.TaskExecutionOutcomeSucceeded,
+				Attempt: 1, PromptID: promptID, RequestDigest: attempt.RequestDigest, LastTransitionTime: &transitionTime,
+			}
+			delivery := &corev1alpha1.TaskDeliveryStatus{
+				State: corev1alpha1.TaskDeliveryState(tt.delivery), Outcome: corev1alpha1.TaskDeliveryOutcome(tt.delivery),
+				LastTransitionTime: &transitionTime,
+			}
+			projectionPayload := taskTerminalProjection{
+				Namespace: sourceTask.Namespace, Task: sourceTask.Name, TaskUID: string(sourceUID), Attempt: 1,
+				Phase: tt.phase, Execution: execution, Delivery: delivery.DeepCopy(),
+			}
+			if err := enqueueDurableTaskTerminalProjectionForUID(ctx, controlStore, fence, sourceTask, sourceUID, projectionPayload); err != nil {
+				t.Fatal(err)
+			}
+			projectionID := standaloneTaskTerminalProjectionIDForUID(sourceTask.Namespace, sourceUID, 1)
+			claims, err := controlStore.ClaimOutboxProjections(ctx, store.ClaimOutboxProjectionsRequest{
+				Fence: fence, WorkerID: "restored-finalizer", Limit: 1, LeaseDuration: time.Minute, Now: time.Now().UTC(),
+			})
+			if err != nil || len(claims) != 1 || claims[0].ID != projectionID {
+				t.Fatalf("claim restored source projection: claims=%#v err=%v", claims, err)
+			}
+			projection, err := controlStore.CompleteOutboxProjection(ctx, store.CompleteOutboxProjectionRequest{
+				ID: claims[0].ID, Fence: fence, ExpectedVersion: claims[0].Version, LeaseOwner: claims[0].LeaseOwner,
+				OperationID: "deliver-restored-finalizer", OperationDigest: testControlDigestForDispatcher("deliver-restored-finalizer-" + strconv.Itoa(index+1)),
+				NewState: store.OutboxProjectionDelivered, DeliveryDigest: testControlDigestForDispatcher("delivered-restored-finalizer-" + strconv.Itoa(index+1)),
+				UpdatedAt: time.Now().UTC(),
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if err := intercepted.Delete(ctx, sourceTask); err != nil {
+				t.Fatal(err)
+			}
+			binding := testACPExecuteBindingForDispatcher()
+			binding.Task.UID = sourceUID
+			binding.Snapshot.ID = (store.AgentExecutionSnapshotKey{TaskUID: string(sourceUID), Digest: attempt.SnapshotDigest}).ID()
+			binding.Snapshot.SchemaVersion = store.AgentExecutionSnapshotSchemaVersion
+			restored := &corev1alpha1.Task{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: sourceTask.Namespace, Name: sourceTask.Name, UID: restoredUID,
+					Finalizers: []string{labels.TaskFinalizer},
+				},
+				Spec: sourceTask.Spec,
+			}
+			if err := intercepted.Create(ctx, restored); err != nil {
+				t.Fatal(err)
+			}
+			restored.Status = corev1alpha1.TaskStatus{
+				Phase: tt.phase, Attempts: 1, AgentExecutionBinding: binding,
+				Execution: &corev1alpha1.TaskExecutionStatus{
+					State: corev1alpha1.TaskExecutionStateSucceeded, Outcome: corev1alpha1.TaskExecutionOutcomeSucceeded,
+					Attempt: 1, PromptID: promptID, RequestDigest: attempt.RequestDigest, LastTransitionTime: &transitionTime,
+				},
+				Delivery: delivery.DeepCopy(),
+			}
+			if err := intercepted.Status().Update(ctx, restored); err != nil {
+				t.Fatal(err)
+			}
+			if err := intercepted.Delete(ctx, restored); err != nil {
+				t.Fatal(err)
+			}
+			key := types.NamespacedName{Namespace: restored.Namespace, Name: restored.Name}
+			if err := intercepted.Get(ctx, key, restored); err != nil {
+				t.Fatal(err)
+			}
+			if !acpTaskHasUnvalidatedSourceIdentity(restored) || restored.Status.Execution.RuntimePoolName != "" ||
+				restored.Status.Execution.AgentRuntimeName != "" || restored.DeletionTimestamp.IsZero() {
+				t.Fatalf("pre-recovery deleting restore did not exercise the unvalidated no-runtime selector: %#v", restored)
+			}
+
+			dispatcher := &ACPDispatcher{
+				Client: intercepted, APIReader: intercepted, Store: controlStore, ResultStore: persistence, Epochs: epochs,
+			}
+			if err := dispatcher.recoverStaleAttempts(ctx); err != nil {
+				t.Fatalf("recover deleting restored Task: %v", err)
+			}
+			if err := intercepted.Get(ctx, key, restored); err != nil {
+				t.Fatal(err)
+			}
+			if !acpTaskUsesRestoredSourceIdentity(restored) || restored.DeletionTimestamp.IsZero() ||
+				restored.Status.Execution.RuntimePoolName != "" || restored.Status.Execution.AgentRuntimeName != "" {
+				t.Fatalf("recovered deleting restore = %#v", restored)
+			}
+
+			if _, err := reconciler.handleDeletion(ctx, restored); err == nil || !strings.Contains(err.Error(), "simulated crash") {
+				t.Fatalf("first handleDeletion() error = %v, want simulated finalizer-patch crash", err)
+			}
+			if got := promptAttemptDeletes.Load(); got != 1 {
+				t.Fatalf("source PromptAttempt delete calls after crash = %d, want 1", got)
+			}
+			if _, err := controlStore.GetPromptAttempt(ctx, attempt.ID); !errors.Is(err, store.ErrNotFound) {
+				t.Fatalf("source PromptAttempt after crash = %v, want ErrNotFound", err)
+			}
+			if err := intercepted.Get(ctx, key, restored); err != nil {
+				t.Fatal(err)
+			}
+			condition := apiMeta.FindStatusCondition(restored.Status.Conditions, "ACPPromptAttemptsReclaimed")
+			if condition == nil || condition.Status != metav1.ConditionTrue || condition.Reason != "PromptAttemptsReclaimed" || condition.Message == "" {
+				t.Fatalf("durable PromptAttempt reclamation receipt after crash = %#v", condition)
+			}
+			if !controllerutil.ContainsFinalizer(restored, labels.TaskFinalizer) || finalizerPatches.Load() != 1 {
+				t.Fatalf("Task finalizer after crash = %#v, patch calls=%d", restored.Finalizers, finalizerPatches.Load())
+			}
+			assertNoRestoredFinalizerReclamationMarker(t, ctx, intercepted)
+			storedProjection, err := controlStore.GetOutboxProjection(ctx, projectionID)
+			if err != nil || storedProjection.Version != projection.Version || storedProjection.State != store.OutboxProjectionDelivered {
+				t.Fatalf("source projection after crash = %#v err=%v, want unchanged delivered version %d", storedProjection, err, projection.Version)
+			}
+
+			missingStore := &missingRecoveryPromptAttemptStore{DurableControlStore: controlStore}
+			dispatcher.Store = missingStore
+			if err := dispatcher.recoverStaleAttempts(ctx); err != nil {
+				t.Fatalf("dispatcher restart after source attempt reclamation: %v", err)
+			}
+			if got := missingStore.calls.Load(); got != 0 {
+				t.Fatalf("dispatcher restart read reclaimed source PromptAttempt %d times, want 0", got)
+			}
+			if _, err := controlStore.GetPromptAttempt(ctx, attempt.ID); !errors.Is(err, store.ErrNotFound) {
+				t.Fatalf("dispatcher restart recreated source PromptAttempt: %v", err)
+			}
+
+			if _, err := reconciler.handleDeletion(ctx, restored); err != nil {
+				t.Fatalf("retry handleDeletion(): %v", err)
+			}
+			if got := promptAttemptDeletes.Load(); got != 1 {
+				t.Fatalf("source PromptAttempt delete calls after retry = %d, want exactly 1", got)
+			}
+			if got := finalizerPatches.Load(); got != 2 {
+				t.Fatalf("Task finalizer patch calls = %d, want failed call plus successful retry", got)
+			}
+			if err := intercepted.Get(ctx, key, &corev1alpha1.Task{}); !apierrors.IsNotFound(err) {
+				t.Fatalf("restored Task after finalizer retry = %v, want NotFound", err)
+			}
+			assertNoRestoredFinalizerReclamationMarker(t, ctx, intercepted)
+			storedProjection, err = controlStore.GetOutboxProjection(ctx, projectionID)
+			if err != nil || storedProjection.Version != projection.Version || storedProjection.State != store.OutboxProjectionDelivered {
+				t.Fatalf("source projection after retry = %#v err=%v, want unchanged delivered version %d", storedProjection, err, projection.Version)
+			}
+		})
+	}
+}
+
+func transitionRestoredFinalizerDelivery(
+	t *testing.T,
+	ctx context.Context,
+	controlStore store.PromptAttemptStore,
+	fence store.ControllerEpochFence,
+	attempt *store.PromptAttempt,
+	target store.PromptDeliveryState,
+) *store.PromptAttempt {
+	t.Helper()
+	path := []store.PromptDeliveryState{store.PromptDeliveryValidating, store.PromptDeliveryPreparing, store.PromptDeliveryPrepared}
+	switch target {
+	case store.PromptDeliveryVerifiedExact:
+		path = append(path, store.PromptDeliveryPublishing, store.PromptDeliveryVerifying, target)
+	case store.PromptDeliveryCancelledBeforePublish:
+		path = append(path, target)
+	case store.PromptDeliveryPublicationOutcomeUnknown:
+		path = append(path, store.PromptDeliveryPublishing, target)
+	default:
+		t.Fatalf("unsupported restored finalizer delivery target %q", target)
+	}
+	for index, next := range path {
+		updated, err := controlStore.TransitionPromptAttemptDelivery(ctx, store.PromptAttemptDeliveryTransition{
+			ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.DeliveryState,
+			NewState: next, OperationID: "restored-finalizer-delivery-" + strconv.Itoa(index),
+			OperationDigest: testControlDigestForDispatcher("restored-finalizer-delivery-" + string(target) + "-" + strconv.Itoa(index)),
+			UpdatedAt:       time.Now().UTC(),
+		})
+		if err != nil {
+			t.Fatalf("transition restored finalizer delivery to %s: %v", next, err)
+		}
+		attempt = updated
+	}
+	return attempt
+}
+
+func assertNoRestoredFinalizerReclamationMarker(t *testing.T, ctx context.Context, kubeClient client.Client) {
+	t.Helper()
+	markers := &corev1.ConfigMapList{}
+	if err := kubeClient.List(ctx, markers, client.InNamespace("default")); err != nil {
+		t.Fatal(err)
+	}
+	for i := range markers.Items {
+		if strings.HasPrefix(markers.Items[i].Name, "prompt-reclaim-") {
+			t.Fatalf("PromptAttempt reclamation marker remained: %s", markers.Items[i].Name)
+		}
+	}
+}
+
+func createACPRecoveryPublication(
+	t *testing.T,
+	fixture *recoveryFixture,
+	task *corev1alpha1.Task,
+	target store.PublicationState,
+) *store.Publication {
+	t.Helper()
+	now := time.Date(2026, 8, 10, 12, 0, 0, 0, time.UTC)
+	publicationID := publicationIDForTask(task)
+	targetRepositoryID := "github.com/orka/target"
+	targetRef := "refs/heads/restore"
+	baseline := store.RemoteRefState{Absent: true}
+	claimID, err := store.CanonicalBranchClaimID(targetRepositoryID, targetRef)
+	if err != nil {
+		t.Fatal(err)
+	}
+	claimDigest, err := branchClaimRequestDigest(
+		targetRepositoryID, targetRef, store.BranchClaimOwnerTask, string(task.UID), baseline, publicationID,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	claim, err := fixture.controlStore.CreateBranchClaim(fixture.ctx, &store.BranchClaim{
+		ID: claimID, RepositoryID: targetRepositoryID, Ref: targetRef,
+		OwnerKind: store.BranchClaimOwnerTask, OwnerUID: string(task.UID), Generation: 1,
+		LastVerified: baseline, RequestDigest: claimDigest, CreatedAt: now,
+	}, fixture.fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	publication, err := fixture.controlStore.CreatePublication(fixture.ctx, &store.Publication{
+		ID: publicationID, Namespace: task.Namespace, Generation: 1,
+		TaskUID: string(task.UID), Attempt: int64(task.Status.Execution.Attempt), PromptID: task.Status.Execution.PromptID,
+		BranchClaimID: claim.ID, BranchClaimGeneration: claim.Generation,
+		SourceRepositoryID: "github.com/orka/source", SourceRef: "refs/heads/main", SourceBaselineSHA: strings.Repeat("1", 40),
+		TargetRepositoryID: targetRepositoryID, TargetRef: targetRef, Baseline: baseline,
+		ArtifactID: "restore-artifact", ArtifactDigest: testControlDigestForDispatcher("restore-artifact"), ArtifactSizeBytes: 1,
+		ArtifactMediaType: "application/vnd.orka.workspace-delta.v1+tar", PublicationCredentialRef: "secret/default/publisher#token",
+		CommitIdentity: "Orka <orka@example.invalid>", CommitMessage: "restore publication fixture", CommitTimestamp: now,
+		RequestDigest: testControlDigestForDispatcher("restore-publication"), CreatedAt: now,
+	}, fixture.fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if target == store.PublicationPreparing {
+		return publication
+	}
+	prepared := &store.PreparedPublicationReceipt{
+		OperationID: "restore-prepare", RequestDigest: testControlDigestForDispatcher("restore-prepare"),
+		TreeSHA: strings.Repeat("2", 40), CommitSHA: strings.Repeat("3", 40),
+		ManifestDigest: testControlDigestForDispatcher("restore-manifest"), RelativeRoot: ".",
+		BundleArtifactID: "restore-bundle", BundleDigest: testControlDigestForDispatcher("restore-bundle"),
+		BundleSizeBytes: 1, BundleMediaType: store.PreparedBundleMediaType,
+		BundleRef: "refs/orka/publications/" + strings.Repeat("4", 64), PreparedAt: now.Add(time.Minute),
+	}
+	publication, err = fixture.controlStore.TransitionPublication(fixture.ctx, store.PublicationTransition{
+		ID: publication.ID, Fence: fixture.fence, ExpectedVersion: publication.Version, ExpectedGeneration: publication.Generation,
+		ExpectedState: publication.State, NewState: store.PublicationPrepared,
+		OperationID: prepared.OperationID, OperationDigest: prepared.RequestDigest, PreparedReceipt: prepared, UpdatedAt: prepared.PreparedAt,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if target == store.PublicationPublishing {
+		publication, err = fixture.controlStore.TransitionPublication(fixture.ctx, store.PublicationTransition{
+			ID: publication.ID, Fence: fixture.fence, ExpectedVersion: publication.Version, ExpectedGeneration: publication.Generation,
+			ExpectedState: publication.State, NewState: store.PublicationPublishing,
+			OperationID: "restore-publishing", OperationDigest: testControlDigestForDispatcher("restore-publishing"), UpdatedAt: now.Add(2 * time.Minute),
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	if publication.State != target {
+		t.Fatalf("publication fixture state = %s, want %s", publication.State, target)
+	}
+	return publication
+}
+
+func assertRestoredTaskTerminalProjection(
+	t *testing.T,
+	fixture *recoveryFixture,
+	sourceUID types.UID,
+	restoredUID types.UID,
+	state corev1alpha1.TaskExecutionState,
+	outcome corev1alpha1.TaskExecutionOutcome,
+	message string,
+) *store.OutboxProjection {
+	t.Helper()
+	projectionID := standaloneTaskTerminalProjectionIDForUID("default", sourceUID, 1)
+	projection, err := fixture.controlStore.GetOutboxProjection(fixture.ctx, projectionID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if projection.AggregateKind != "Task" || projection.AggregateID != string(sourceUID) ||
+		projection.ProjectionKind != "TaskTerminalStatus" {
+		t.Fatalf("source projection metadata = %#v", projection)
+	}
+	var payload taskTerminalProjection
+	if err := json.Unmarshal(projection.Payload, &payload); err != nil {
+		t.Fatal(err)
+	}
+	if payload.TaskUID != string(sourceUID) || payload.Attempt != 1 || payload.Phase != corev1alpha1.TaskPhaseFailed ||
+		payload.Execution.State != state || payload.Execution.Outcome != outcome ||
+		payload.Execution.Reason != corev1alpha1.TaskExecutionReason(acpRestoreIdentityChangedReason) ||
+		payload.Message != message {
+		t.Fatalf("source projection payload = %#v", payload)
+	}
+	targetProjectionID := standaloneTaskTerminalProjectionIDForUID("default", restoredUID, 1)
+	if _, err := fixture.controlStore.GetOutboxProjection(fixture.ctx, targetProjectionID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("target-incarnation projection lookup error = %v, want ErrNotFound", err)
+	}
+	return projection
+}
+
+func restoredDeliveryEvidenceFixture(
+	state store.PromptDeliveryState,
+	outcome corev1alpha1.TaskDeliveryOutcome,
+	transition metav1.Time,
+) *corev1alpha1.TaskDeliveryStatus {
+	remoteBefore := strings.Repeat("2", 40)
+	return &corev1alpha1.TaskDeliveryStatus{
+		State:                 corev1alpha1.TaskDeliveryState(state),
+		Outcome:               outcome,
+		Reason:                corev1alpha1.TaskDeliveryReason("RestoreEvidencePreserved"),
+		PublicationID:         "publication-restore-evidence",
+		SourceRepository:      &corev1alpha1.RepositoryIdentity{Provider: "github", ID: "github.com/orka/source"},
+		PublicationRepository: &corev1alpha1.RepositoryIdentity{Provider: "github", ID: "github.com/orka/target"},
+		Branch:                "restore-evidence",
+		StartingSHA:           strings.Repeat("1", 40),
+		RemoteBeforeSHA:       &remoteBefore,
+		TreeSHA:               strings.Repeat("3", 40),
+		ExpectedCommitSHA:     strings.Repeat("4", 40),
+		VerifiedRemoteSHA:     strings.Repeat("5", 40),
+		SupersedingRemoteSHA:  strings.Repeat("6", 40),
+		ArtifactDigest:        testControlDigestForDispatcher("restore-delivery-evidence"),
+		PRReceipt: &corev1alpha1.TaskPullRequestReceipt{
+			ID: "restore-evidence-pr", Number: 42, URL: "https://github.com/orka/target/pull/42", State: "open",
+		},
+		Message:            "bounded restore delivery evidence",
+		LastTransitionTime: &transition,
+	}
+}
+
+func assertRestoredDeliveryEvidence(
+	t *testing.T,
+	got *corev1alpha1.TaskDeliveryStatus,
+	wantEvidence *corev1alpha1.TaskDeliveryStatus,
+	terminalState store.PromptDeliveryState,
+) {
+	t.Helper()
+	if got == nil || wantEvidence == nil || got.LastTransitionTime == nil {
+		t.Fatalf("restored delivery evidence is incomplete: got=%#v want=%#v", got, wantEvidence)
+	}
+	want := wantEvidence.DeepCopy()
+	want.State = corev1alpha1.TaskDeliveryState(terminalState)
+	want.Outcome = corev1alpha1.TaskDeliveryOutcome(terminalState)
+	want.LastTransitionTime = got.LastTransitionTime
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("restored delivery evidence = %#v, want %#v", got, want)
+	}
+}
+
+func TestACPDispatcherRejectsCorruptRestoredSourceAttemptBinding(t *testing.T) {
+	fixture := newACPRecoveryFixture(t, store.PromptExecutionPlanned)
+	defer fixture.close(t)
+
+	restoreACPRecoveryFixtureTask(t, fixture)
+	task := markRestoredACPRecoveryTaskDeleting(t, fixture, func(task *corev1alpha1.Task) {
+		task.Status.Execution.RuntimePoolName = ""
+		task.Status.Execution.AgentRuntimeName = ""
+		task.Status.AgentExecutionBinding.Snapshot.Digest = testControlDigestForDispatcher("corrupt-restore-snapshot")
+	})
+	if !acpTaskHasUnvalidatedSourceIdentity(task) || task.DeletionTimestamp.IsZero() {
+		t.Fatalf("corrupt restored Task did not exercise deleting recovery selector: %#v", task)
+	}
+	before, err := fixture.controlStore.GetPromptAttempt(fixture.ctx, fixture.attemptID)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = fixture.dispatcher.recoverStaleAttempts(fixture.ctx)
+	if !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("recoverStaleAttempts() error = %v, want ErrConflict", err)
+	}
+	attempt, getErr := fixture.controlStore.GetPromptAttempt(fixture.ctx, fixture.attemptID)
+	if getErr != nil {
+		t.Fatal(getErr)
+	}
+	if attempt.ExecutionState != store.PromptExecutionPlanned || attempt.Version != before.Version {
+		t.Fatalf("corrupt restore mutated source attempt: before=%#v after=%#v", before, attempt)
+	}
+}
+
+func TestACPDispatcherRejectsDeletingRestoredTaskWithMissingExecutionBeforeRuntimeSelector(t *testing.T) {
+	fixture := newACPRecoveryFixture(t, store.PromptExecutionPlanned)
+	defer fixture.close(t)
+
+	restoreACPRecoveryFixtureTask(t, fixture)
+	task := markRestoredACPRecoveryTaskDeleting(t, fixture, func(task *corev1alpha1.Task) {
+		task.Status.Execution = nil
+	})
+	if !acpTaskHasUnvalidatedSourceIdentity(task) || task.DeletionTimestamp.IsZero() {
+		t.Fatalf("missing-execution restored Task did not exercise deleting recovery selector: %#v", task)
+	}
+	missingStore := &missingRecoveryPromptAttemptStore{DurableControlStore: fixture.controlStore}
+	fixture.dispatcher.Store = missingStore
+
+	err := fixture.dispatcher.recoverStaleAttempts(fixture.ctx)
+	if !errors.Is(err, store.ErrConflict) || !strings.Contains(err.Error(), "execution status is missing") {
+		t.Fatalf("recoverStaleAttempts() error = %v, want missing-execution ErrConflict", err)
+	}
+	if got := missingStore.calls.Load(); got != 0 {
+		t.Fatalf("missing-execution restore read source PromptAttempt %d times, want 0", got)
+	}
+	attempt, getErr := fixture.controlStore.GetPromptAttempt(fixture.ctx, fixture.attemptID)
+	if getErr != nil {
+		t.Fatal(getErr)
+	}
+	if attempt.ExecutionState != store.PromptExecutionPlanned {
+		t.Fatalf("missing-execution restore mutated source attempt to %s", attempt.ExecutionState)
+	}
+}
+
+func restoreACPRecoveryFixtureTask(t *testing.T, fixture *recoveryFixture) (types.UID, types.UID) {
+	t.Helper()
+	task := &corev1alpha1.Task{}
+	key := types.NamespacedName{Namespace: "default", Name: "task"}
+	if err := fixture.kubeClient.Get(fixture.ctx, key, task); err != nil {
+		t.Fatal(err)
+	}
+	sourceUID := task.UID
+	restoredUID := types.UID("44444444-4444-4444-4444-444444444444")
+	task.UID = restoredUID
+	task.ResourceVersion = ""
+	binding := *task.Status.AgentExecutionBinding
+	binding.Task.UID = sourceUID
+	task.Status.AgentExecutionBinding = &binding
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	fixture.kubeClient = fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}).WithObjects(task).Build()
+	fixture.dispatcher.Client = fixture.kubeClient
+	fixture.dispatcher.APIReader = fixture.kubeClient
+	return sourceUID, restoredUID
+}
+
+func markRestoredACPRecoveryTaskDeleting(
+	t *testing.T,
+	fixture *recoveryFixture,
+	mutateStatus func(*corev1alpha1.Task),
+) *corev1alpha1.Task {
+	t.Helper()
+	key := types.NamespacedName{Namespace: "default", Name: "task"}
+	task := &corev1alpha1.Task{}
+	if err := fixture.kubeClient.Get(fixture.ctx, key, task); err != nil {
+		t.Fatal(err)
+	}
+	controllerutil.AddFinalizer(task, labels.TaskFinalizer)
+	if err := fixture.kubeClient.Update(fixture.ctx, task); err != nil {
+		t.Fatal(err)
+	}
+	if err := fixture.kubeClient.Get(fixture.ctx, key, task); err != nil {
+		t.Fatal(err)
+	}
+	mutateStatus(task)
+	if err := fixture.kubeClient.Status().Update(fixture.ctx, task); err != nil {
+		t.Fatal(err)
+	}
+	if err := fixture.kubeClient.Get(fixture.ctx, key, task); err != nil {
+		t.Fatal(err)
+	}
+	if err := fixture.kubeClient.Delete(fixture.ctx, task); err != nil {
+		t.Fatal(err)
+	}
+	if err := fixture.kubeClient.Get(fixture.ctx, key, task); err != nil {
+		t.Fatal(err)
+	}
+	if task.DeletionTimestamp.IsZero() {
+		t.Fatal("restored Task deletion timestamp is missing")
+	}
+	return task
+}
+
+//nolint:gocyclo // This intentionally exercises the full production recovery boundary in one scenario.
+func TestACPDispatcherRecoveryReusesExistingTaskScopedTerminalProjection(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "task-projection.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	controlStore := sqlite.NewStore(db, "test")
+	oldEpochs, stopOld := startACPRecoveryEpochManager(t, ctx, controlStore, "controller-old-task-projection")
+	oldFence, err := oldEpochs.CurrentFence(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	uid := types.UID("77777777-7777-7777-7777-777777777777")
+	promptID := "prompt-" + string(uid) + "-1"
+	fixedTransition := metav1.NewTime(time.Date(2026, 7, 25, 12, 30, 0, 0, time.UTC))
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "task-projection", UID: uid},
+		Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Prompt: "test"},
+		Status: corev1alpha1.TaskStatus{
+			Phase: corev1alpha1.TaskPhaseSucceeded, Attempts: 1, Message: "ACP task completed",
+			AgentExecutionBinding: testACPExecuteBindingForDispatcher(),
+			Execution: &corev1alpha1.TaskExecutionStatus{
+				State: corev1alpha1.TaskExecutionStateSucceeded, Outcome: corev1alpha1.TaskExecutionOutcomeSucceeded,
+				Attempt: 1, PromptID: promptID, RuntimePoolName: "pool", RuntimePoolUID: "pool-uid", ControllerEpoch: oldFence.Epoch,
+				RequestDigest: testControlDigestForDispatcher("task-projection-request"), LastTransitionTime: &fixedTransition,
+			},
+			Delivery: restoredDeliveryEvidenceFixture(
+				store.PromptDeliveryReadValidated,
+				corev1alpha1.TaskDeliveryOutcomeReadValidated,
+				fixedTransition,
+			),
+		},
+	}
+	task.Status.AgentExecutionBinding.Task.UID = uid
+	key := store.PromptAttemptKey{Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: promptID}
+	attempt, err := controlStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{
+		Key: key, RequestDigest: task.Status.Execution.RequestDigest,
+	}), oldFence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	attempt = completeACPAttemptExecutionForTest(t, controlStore, oldFence, attempt, false)
+	for _, next := range []store.PromptDeliveryState{store.PromptDeliveryValidating, store.PromptDeliveryReadValidated} {
+		op := "task-projection-delivery-" + string(next)
+		attempt, err = controlStore.TransitionPromptAttemptDelivery(ctx, store.PromptAttemptDeliveryTransition{
+			ID: attempt.ID, Fence: oldFence, ExpectedVersion: attempt.Version, ExpectedState: attempt.DeliveryState,
+			NewState: next, OperationID: op, OperationDigest: testControlDigestForDispatcher(op), UpdatedAt: time.Now().UTC(),
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	oldDispatcher := &ACPDispatcher{Store: controlStore, Epochs: oldEpochs}
+	payload := taskTerminalProjection{
+		Namespace: task.Namespace, Task: task.Name, TaskUID: string(task.UID), Attempt: 1,
+		Phase: corev1alpha1.TaskPhaseSucceeded, Message: "ACP task completed",
+		Execution: *task.Status.Execution.DeepCopy(),
+		Delivery:  task.Status.Delivery.DeepCopy(),
+	}
+	if err := oldDispatcher.enqueueStandaloneTaskProjection(ctx, task, payload); err != nil {
+		t.Fatal(err)
+	}
+	projectionID := standaloneTaskTerminalProjectionID(task, 1)
+
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	sourceClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}).WithObjects(task).Build()
+	projector := &ACPOutboxProjector{Client: sourceClient, Store: controlStore, Epochs: oldEpochs, WorkerID: "task-projection-test"}
+	if err := projector.projectOnce(ctx); err != nil {
+		t.Fatal(err)
+	}
+	sourceTerminal := &corev1alpha1.Task{}
+	if err := sourceClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, sourceTerminal); err != nil {
+		t.Fatal(err)
+	}
+	original, err := controlStore.GetOutboxProjection(ctx, projectionID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if original.State != store.OutboxProjectionDelivered || original.DeliveryDigest == "" || original.DeliveredAt == nil {
+		t.Fatalf("projection was not delivered before restart: %#v", original)
+	}
+	restoredUID := types.UID("88888888-8888-8888-8888-888888888888")
+	restoredTask := sourceTerminal.DeepCopy()
+	restoredTask.UID = restoredUID
+	restoredTask.ResourceVersion = ""
+	binding := *restoredTask.Status.AgentExecutionBinding
+	binding.Task.UID = uid
+	restoredTask.Status.AgentExecutionBinding = &binding
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}).WithObjects(restoredTask).Build()
+	stopOld()
+	newEpochs, stopNew := startACPRecoveryEpochManager(t, ctx, controlStore, "controller-new-task-projection")
+	defer stopNew()
+	newFence, err := newEpochs.CurrentFence(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if newFence.Epoch <= oldFence.Epoch {
+		t.Fatalf("new epoch = %d, want > %d", newFence.Epoch, oldFence.Epoch)
+	}
+	dispatcher := &ACPDispatcher{Client: kubeClient, APIReader: kubeClient, Store: controlStore, ResultStore: controlStore, Epochs: newEpochs}
+	if err := dispatcher.recoverStaleAttempts(ctx); err != nil {
+		t.Fatal(err)
+	}
+	recoveredTask := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, recoveredTask); err != nil {
+		t.Fatal(err)
+	}
+	if recoveredTask.UID != restoredUID || recoveredTask.Status.Phase != corev1alpha1.TaskPhaseSucceeded ||
+		recoveredTask.Status.Execution == nil || recoveredTask.Status.Execution.ControllerEpoch != newFence.Epoch ||
+		recoveredTask.Status.Execution.State != corev1alpha1.TaskExecutionStateSucceeded ||
+		recoveredTask.Status.Execution.Outcome != corev1alpha1.TaskExecutionOutcomeSucceeded ||
+		recoveredTask.Status.Execution.Reason != corev1alpha1.TaskExecutionReason(acpRestoreIdentityChangedReason) ||
+		recoveredTask.Status.Delivery == nil || recoveredTask.Status.Delivery.State != corev1alpha1.TaskDeliveryStateReadValidated {
+		t.Fatalf("restored terminal Task status = %#v", recoveredTask.Status)
+	}
+	assertRestoredDeliveryEvidence(t, recoveredTask.Status.Delivery, task.Status.Delivery, store.PromptDeliveryReadValidated)
+	firstRecoveredDelivery := recoveredTask.Status.Delivery.DeepCopy()
+	if err := dispatcher.recoverStaleAttempts(ctx); err != nil {
+		t.Fatalf("same-epoch recovery retry: %v", err)
+	}
+	if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, recoveredTask); err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(recoveredTask.Status.Delivery, firstRecoveredDelivery) {
+		t.Fatalf("same-epoch recovery changed restored delivery evidence: before=%#v after=%#v", firstRecoveredDelivery, recoveredTask.Status.Delivery)
+	}
+	recovered, err := controlStore.GetOutboxProjection(ctx, projectionID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	deliveredAtMatches := recovered.DeliveredAt != nil && original.DeliveredAt != nil && recovered.DeliveredAt.Equal(*original.DeliveredAt)
+	if string(recovered.Payload) != string(original.Payload) || recovered.PayloadDigest != original.PayloadDigest ||
+		!recovered.InitialAvailableAt.Equal(original.InitialAvailableAt) || !recovered.AvailableAt.Equal(original.AvailableAt) ||
+		recovered.State != original.State || recovered.Version != original.Version || recovered.Attempts != original.Attempts ||
+		recovered.DeliveryDigest != original.DeliveryDigest || !deliveredAtMatches || recovered.ControllerEpoch != original.ControllerEpoch {
+		t.Fatalf("recovery changed existing task projection: before=%#v after=%#v", original, recovered)
+	}
+}
+
+func TestValidateRestoredSourceTerminalProjectionRejectsForgedOutcome(t *testing.T) {
+	sourceUID := types.UID("99999999-9999-9999-9999-999999999999")
+	restoredUID := types.UID("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa")
+	requestDigest := testControlDigestForDispatcher("forged-source-projection-request")
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "forged-source-projection", UID: restoredUID},
+		Status: corev1alpha1.TaskStatus{
+			Phase: corev1alpha1.TaskPhaseSucceeded,
+			Execution: &corev1alpha1.TaskExecutionStatus{
+				State: corev1alpha1.TaskExecutionStateSucceeded, Outcome: corev1alpha1.TaskExecutionOutcomeSucceeded,
+				Reason: corev1alpha1.TaskExecutionReason(acpRestoreIdentityChangedReason), Attempt: 1,
+				PromptID: "prompt-final", RequestDigest: requestDigest,
+			},
+			Delivery: &corev1alpha1.TaskDeliveryStatus{
+				State: corev1alpha1.TaskDeliveryStateVerifiedExact, Outcome: corev1alpha1.TaskDeliveryOutcomeVerifiedExact,
+			},
+			AgentExecutionBinding: testACPExecuteBindingForDispatcher(),
+		},
+	}
+	task.Status.AgentExecutionBinding.Task.UID = sourceUID
+	attempt := &store.PromptAttempt{
+		Key: store.PromptAttemptKey{
+			Namespace: task.Namespace, TaskUID: string(sourceUID), Attempt: 1, PromptID: task.Status.Execution.PromptID,
+		},
+		RequestDigest: requestDigest, ExecutionState: store.PromptExecutionSucceeded,
+		DeliveryState: store.PromptDeliveryVerifiedExact,
+	}
+	payload, err := json.Marshal(taskTerminalProjection{
+		Namespace: task.Namespace, Task: task.Name, TaskUID: string(sourceUID), Attempt: 1,
+		Phase: corev1alpha1.TaskPhaseSucceeded,
+		Execution: corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateSucceeded, Outcome: corev1alpha1.TaskExecutionOutcomeFailed,
+			Attempt: 1, PromptID: task.Status.Execution.PromptID, RequestDigest: requestDigest,
+		},
+		Delivery: task.Status.Delivery.DeepCopy(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	projection := &store.OutboxProjection{
+		ID:            standaloneTaskTerminalProjectionIDForUID(task.Namespace, sourceUID, 1),
+		AggregateKind: taskResourceKind, AggregateID: string(sourceUID), ProjectionKind: taskTerminalProjectionKind,
+		Payload: payload,
+	}
+
+	if err := validateRestoredSourceTerminalProjection(task, sourceUID, attempt, projection); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("validateRestoredSourceTerminalProjection() error = %v, want ErrConflict", err)
+	}
+}
+
+//nolint:gocyclo // The restart, drain, retry, receipt, and projection assertions stay in one scenario.
+func TestRecoveredTaskScopedRuntimeSessionCleanupRetriesBeforeEpochAdvance(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "recovered-cleanup.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	controlStore := sqlite.NewStore(db, "test")
+	epochs, stopEpoch := startACPRecoveryEpochManager(t, ctx, controlStore, "recovered-cleanup")
+	defer stopEpoch()
+	fence, err := epochs.CurrentFence(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	profile := harnessProfileForTest()
+	profile.Model = acpTestModel
+	profileDigest, err := harnessv2.CanonicalProfileDigest(profile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var deleteCalls atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodGet && r.URL.Path == harnessv2.CapabilitiesPath:
+			writeDispatcherJSON(w, harnessv2.CapabilitiesResponse{
+				Protocol: harnessv2.ProtocolVersion, Transport: "http+ndjson", ACPVersion: harnessv2.ACPProfileV1,
+				RuntimeProfileDigest: profileDigest, ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+				AdapterDigests: profile.AdapterDigests, Limits: harnessv2.DefaultProtocolLimits(),
+				Provider:            harnessv2.ProviderCapabilities{ProviderKinds: []string{profile.ProviderKind}, Models: []string{profile.Model}, SupportsCancel: true, SupportsPermissions: true, SupportsTools: true},
+				WorkspaceGovernance: harnessv2.StrictWorkspaceGovernanceCapabilities(), SupportsDrain: true,
+			})
+		case r.Method == http.MethodGet && r.URL.Path == harnessv2.StatusPath:
+			now := time.Now().UTC()
+			writeDispatcherJSON(w, harnessv2.StatusResponse{
+				Protocol: harnessv2.ProtocolVersion,
+				Fence: harnessv2.Fence{
+					RuntimeInstanceID: "pod-uid.boot-id", SupervisorBootID: "boot-id", ControllerEpoch: uint64(fence.Epoch),
+					RuntimePoolUID: "pool-uid", RuntimePoolGeneration: 1, RuntimeProfileDigest: profileDigest,
+					ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+				},
+				Lifecycle: harnessv2.SupervisorLifecycleReady, Drain: harnessv2.DrainStatus{AcceptingNewSessions: true},
+				Sessions: []harnessv2.RuntimeSessionStatus{{
+					RuntimeSessionID: "runtime-session-recovered-cleanup", RuntimeSessionUID: "session-recovered-cleanup",
+					Generation: 1, State: harnessv2.RuntimeSessionStateIdle, LastTransitionAt: now,
+				}},
+				Pressure: harnessv2.PressureMetadata{ResidentSessions: 1}, Timestamp: now,
+			})
+		case r.Method == http.MethodDelete:
+			var request harnessv2.DeleteRuntimeSessionRequest
+			if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+				t.Errorf("decode delete: %v", err)
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			}
+			if deleteCalls.Add(1) == 1 {
+				writeDispatcherJSONStatus(w, http.StatusInternalServerError, harnessv2.ErrorResponse{
+					Protocol: harnessv2.ProtocolVersion, Code: harnessv2.ErrorCodeSessionPoisoned,
+					Message: "runtime descendant cleanup could not be proven", Retryable: false,
+				})
+				return
+			}
+			writeDispatcherJSON(w, harnessv2.DeleteRuntimeSessionResponse{
+				Protocol: harnessv2.ProtocolVersion, Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh}, State: harnessv2.RuntimeSessionStateDeleted,
+				Tombstone: testDeleteTombstone(request, time.Now().UTC()),
+			})
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer server.Close()
+	parsed, err := url.Parse(server.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "recovered-cleanup", UID: types.UID("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa")},
+		Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent},
+		Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhaseCancelled, Attempts: 1,
+			AgentExecutionBinding: testACPExecuteBindingForDispatcher(),
+			Execution: &corev1alpha1.TaskExecutionStatus{
+				State: corev1alpha1.TaskExecutionStateCancelled, Outcome: corev1alpha1.TaskExecutionOutcomeCancelled,
+				Attempt: 1, PromptID: "prompt-recovered-cleanup", RuntimePoolName: "pool", RuntimePoolUID: "pool-uid",
+				RuntimeInstanceID: "pod-uid.boot-id", RuntimeSessionUID: "session-recovered-cleanup", RuntimeSessionGeneration: 1,
+				ControllerEpoch: fence.Epoch, RequestDigest: testControlDigestForDispatcher("recovered-cleanup"),
+			},
+			Delivery: &corev1alpha1.TaskDeliveryStatus{State: corev1alpha1.TaskDeliveryStateNotRequested, Outcome: corev1alpha1.TaskDeliveryOutcomeNotRequested},
+		},
+	}
+	pool := &corev1alpha1.RuntimePool{
+		ObjectMeta: metav1.ObjectMeta{Namespace: task.Namespace, Name: "pool", UID: types.UID("pool-uid"), Generation: 1},
+		Spec: corev1alpha1.RuntimePoolSpec{RuntimeNamespace: "orka-runtimes", Runtime: corev1alpha1.RuntimePoolRuntimeSpec{
+			Image:   "docker.io/example/acp@sha256:" + strings.Repeat("a", 64),
+			Profile: RuntimePoolProfileFromPlan(ACPRuntimePlan{Profile: profile, Digest: profileDigest}),
+		}},
+		Status: corev1alpha1.RuntimePoolStatus{ActiveInstance: &corev1alpha1.RuntimePoolActiveInstanceStatus{
+			PodNamespace: "orka-runtimes", PodName: "runtime-pod", PodAddress: parsed.Host, PodUID: "pod-uid", BootID: "boot-id",
+			RuntimeInstanceID: task.Status.Execution.RuntimeInstanceID, ControllerEpoch: fence.Epoch - 1,
+			ProtocolVersion: corev1alpha1.RuntimePoolProtocolHarnessV2, ProfileDigest: string(profileDigest), ProfileDigestSchemaVersion: strconv.FormatUint(uint64(harnessv2.ProfileDigestSchemaVersion), 10),
+		}},
+	}
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "orka-runtimes", Name: "pool-auth", Labels: map[string]string{
+			runtimePoolAuthLabel: "true", runtimePoolUIDLabel: string(pool.UID),
+		}},
+		Data: map[string][]byte{runtimePoolControllerTokenKey: []byte(strings.Repeat("t", 32)), runtimePoolCapabilitySecretKey: []byte(strings.Repeat("s", 32))},
+	}
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}).WithObjects(task, pool, secret).Build()
+	attemptKey := store.PromptAttemptKey{Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: task.Status.Execution.PromptID}
+	attempt, err := controlStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{Key: attemptKey, RequestDigest: task.Status.Execution.RequestDigest}), fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, next := range []store.PromptExecutionState{
+		store.PromptExecutionReserved, store.PromptExecutionSessionStarting, store.PromptExecutionPlanned,
+		store.PromptExecutionSubmitting, store.PromptExecutionAccepted, store.PromptExecutionRunning, store.PromptExecutionCancelled,
+	} {
+		op := "recovered-cleanup-" + string(next)
+		attempt, err = controlStore.TransitionPromptAttemptExecution(ctx, store.PromptAttemptExecutionTransition{
+			ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+			NewState: next, OperationID: op, OperationDigest: testControlDigestForDispatcher(op), UpdatedAt: time.Now().UTC(),
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	gate := NewACPAdmissionGate()
+	gate.Close("planned drain", time.Now().UTC())
+	dispatcher := &ACPDispatcher{
+		Client: kubeClient, APIReader: kubeClient, Store: controlStore, Epochs: epochs, AdmissionGate: gate,
+		sem: make(chan struct{}, 1), active: make(map[types.UID]struct{}),
+	}
+	if complete, err := dispatcher.cleanupRecoveredTaskScopedRuntimeSession(ctx, task); err != nil || complete {
+		t.Fatalf("stale-epoch cleanup = complete:%v err:%v, want pending without error", complete, err)
+	}
+	if got := deleteCalls.Load(); got != 0 {
+		t.Fatalf("stale-epoch cleanup issued %d DELETE calls, want 0", got)
+	}
+	currentPool := &corev1alpha1.RuntimePool{}
+	if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: pool.Namespace, Name: pool.Name}, currentPool); err != nil {
+		t.Fatal(err)
+	}
+	currentPool.Status.ActiveInstance.ControllerEpoch = fence.Epoch
+	if err := kubeClient.Update(ctx, currentPool); err != nil {
+		t.Fatal(err)
+	}
+	if complete, err := dispatcher.cleanupRecoveredTaskScopedRuntimeSession(ctx, task); err == nil || complete {
+		t.Fatalf("first cleanup = complete:%v err:%v, want incomplete error", complete, err)
+	}
+	if err := dispatcher.dispatchOnce(ctx); err != nil {
+		t.Fatal(err)
+	}
+	var recoveredTask corev1alpha1.Task
+	projectionReady := false
+	projectionID := standaloneTaskTerminalProjectionID(task, 1)
+	for range 100 {
+		if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, &recoveredTask); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := controlStore.GetOutboxProjection(ctx, projectionID); err == nil {
+			projectionReady = true
+		} else if !errors.Is(err, store.ErrNotFound) {
+			t.Fatal(err)
+		}
+		if deleteCalls.Load() == 2 && taskScopedRuntimeSessionCleanupComplete(&recoveredTask) && projectionReady {
+			break
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	if got := deleteCalls.Load(); got != 2 || !taskScopedRuntimeSessionCleanupComplete(&recoveredTask) || !projectionReady {
+		t.Fatalf("dispatcher retry = DELETE calls:%d cleanupComplete:%v projectionReady:%v", got, taskScopedRuntimeSessionCleanupComplete(&recoveredTask), projectionReady)
+	}
+}
+
+func TestRecoveredWriteSessionPublicationCleanupByRuntimeState(t *testing.T) {
+	for _, test := range []struct {
+		name              string
+		state             harnessv2.RuntimeSessionState
+		omitTaskDelivery  bool
+		prepareOperations []string
+		finalOperations   []string
+	}{
+		{
+			name: "publication prepared", state: harnessv2.RuntimeSessionStatePublicationPrepared,
+			prepareOperations: []string{"finalize"}, finalOperations: []string{"finalize", "delete"},
+		},
+		{
+			name: "publication prepared before Task delivery projection", state: harnessv2.RuntimeSessionStatePublicationPrepared,
+			omitTaskDelivery: true, prepareOperations: []string{"finalize"}, finalOperations: []string{"finalize", "delete"},
+		},
+		{name: "finalizing", state: harnessv2.RuntimeSessionStateFinalizing, finalOperations: []string{"delete"}},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			fixture := newRecoveredWriteCleanupFixture(t, recoveredWriteCleanupOptions{state: test.state})
+			if test.omitTaskDelivery {
+				fixture.task.Status.Delivery = nil
+			}
+			prepared, err := fixture.dispatcher.prepareRecoveredTaskScopedRuntimeSessionForSettlement(fixture.ctx, fixture.task.DeepCopy())
+			if err != nil || !prepared {
+				t.Fatalf("prepare for settlement = ready:%v err:%v, want ready", prepared, err)
+			}
+			operations, _, deletes := fixture.trace.snapshot()
+			if fmt.Sprint(operations) != fmt.Sprint(test.prepareOperations) {
+				t.Fatalf("pre-settlement operations = %v, want %v", operations, test.prepareOperations)
+			}
+			if len(deletes) != 0 {
+				t.Fatalf("pre-settlement delete requests = %d, want 0", len(deletes))
+			}
+			complete, err := fixture.dispatcher.cleanupRecoveredTaskScopedRuntimeSession(fixture.ctx, fixture.task.DeepCopy())
+			if err != nil || !complete {
+				t.Fatalf("cleanup = complete:%v err:%v, want complete", complete, err)
+			}
+			operations, finalizations, deletes := fixture.trace.snapshot()
+			if fmt.Sprint(operations) != fmt.Sprint(test.finalOperations) {
+				t.Fatalf("cleanup operations = %v, want %v", operations, test.finalOperations)
+			}
+			if len(deletes) != 1 {
+				t.Fatalf("delete requests = %d, want 1", len(deletes))
+			}
+			if test.state == harnessv2.RuntimeSessionStatePublicationPrepared {
+				if len(finalizations) != 1 {
+					t.Fatalf("publication finalization requests = %d, want 1", len(finalizations))
+				}
+				request := finalizations[0]
+				if request.WorkspaceDeltaID != harnessv2.WorkspaceDeltaID("delta-"+fixture.task.Status.Execution.PromptID) ||
+					request.PublicationID != publicationIDForTaskUID(fixture.task, fixture.controlUID) ||
+					request.PublicationGeneration != uint64(fixture.publication.Generation) ||
+					request.PublicationVersion != uint64(fixture.publication.Version) ||
+					request.TerminalState != harnessv2.PublicationTerminalVerifiedExact || request.TerminalReceiptDigest == "" {
+					t.Fatalf("recovered publication finalization request = %#v", request)
+				}
+			} else if len(finalizations) != 0 {
+				t.Fatalf("finalizing RuntimeSession was finalized again: %#v", finalizations)
+			}
+			fixture.assertCleanupReceipt(t)
+		})
+	}
+}
+
+//nolint:gocyclo // The two rows intentionally prove the full finalize/delete crash tail and retry boundary.
+func TestRestoredWriteSessionCleanupUsesFrozenSourceUID(t *testing.T) {
+	sourceUID := types.UID("cdcdcdcd-cdcd-cdcd-cdcd-cdcdcdcdcdcd")
+	restoredUID := types.UID("abababab-abab-abab-abab-abababababab")
+	for _, test := range []struct {
+		name                   string
+		omitPublication        bool
+		abortFirstDelete       bool
+		omitDeletedFromStatus  bool
+		wantFirstComplete      bool
+		wantFirstError         bool
+		wantTerminalState      harnessv2.PublicationTerminalState
+		setAbandonmentDelivery bool
+	}{
+		{
+			name: "durable source publication", wantFirstComplete: true,
+			wantTerminalState: harnessv2.PublicationTerminalVerifiedExact,
+		},
+		{
+			name:            "source-bound abandonment survives lost delete response",
+			omitPublication: true, abortFirstDelete: true, omitDeletedFromStatus: true,
+			wantFirstError: true, wantTerminalState: harnessv2.PublicationTerminalDeliveryConflict,
+			setAbandonmentDelivery: true,
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			fixture := newRecoveredWriteCleanupFixture(t, recoveredWriteCleanupOptions{
+				state: harnessv2.RuntimeSessionStatePublicationPrepared, sourceTaskUID: sourceUID,
+				omitPublication: test.omitPublication, abortFirstDeleteResponse: test.abortFirstDelete,
+				omitDeletedSessionFromStatus: test.omitDeletedFromStatus,
+			})
+			if fixture.task.UID != restoredUID || fixture.controlUID != sourceUID || fixture.task.Status.AgentExecutionBinding == nil ||
+				fixture.task.Status.AgentExecutionBinding.Task.UID != sourceUID {
+				t.Fatalf("restored fixture identity = uid:%q control:%q binding:%#v", fixture.task.UID, fixture.controlUID, fixture.task.Status.AgentExecutionBinding)
+			}
+			if test.setAbandonmentDelivery {
+				fixture.task.Status.Delivery = &corev1alpha1.TaskDeliveryStatus{
+					State: corev1alpha1.TaskDeliveryStateDeliveryConflict, Outcome: corev1alpha1.TaskDeliveryOutcomeDeliveryConflict,
+					Reason: "RestorePublicationMissing", Message: "source publication was not durably created",
+				}
+			}
+
+			complete, err := fixture.dispatcher.cleanupRecoveredTaskScopedRuntimeSessionForUID(
+				fixture.ctx, fixture.task.DeepCopy(), sourceUID,
+			)
+			if complete != test.wantFirstComplete || (err != nil) != test.wantFirstError {
+				t.Fatalf("first cleanup = complete:%v err:%v", complete, err)
+			}
+			var retryTask corev1alpha1.Task
+			if getErr := fixture.kubeClient.Get(
+				fixture.ctx, types.NamespacedName{Namespace: fixture.task.Namespace, Name: fixture.task.Name}, &retryTask,
+			); getErr != nil {
+				t.Fatal(getErr)
+			}
+			if test.wantFirstError && retryTask.Status.Execution.RuntimeSessionCleanupDigest != "" {
+				t.Fatalf("cleanup receipt persisted before delete response-loss reconciliation: %q", retryTask.Status.Execution.RuntimeSessionCleanupDigest)
+			}
+			complete, err = fixture.dispatcher.cleanupRecoveredTaskScopedRuntimeSessionForUID(fixture.ctx, &retryTask, sourceUID)
+			if err != nil || !complete {
+				t.Fatalf("idempotent cleanup retry = complete:%v err:%v", complete, err)
+			}
+
+			operations, finalizations, deletes := fixture.trace.snapshot()
+			if fmt.Sprint(operations) != "[finalize delete]" || len(finalizations) != 1 || len(deletes) != 1 {
+				t.Fatalf("restored cleanup operations = %v finalizations=%d deletes=%d", operations, len(finalizations), len(deletes))
+			}
+			finalizeRequest := finalizations[0]
+			deleteRequest := deletes[0]
+			if finalizeRequest.Metadata.TaskUID != harnessv2.TaskUID(sourceUID) ||
+				deleteRequest.Metadata.TaskUID != harnessv2.TaskUID(sourceUID) ||
+				finalizeRequest.Metadata.TaskUID == harnessv2.TaskUID(restoredUID) ||
+				deleteRequest.Metadata.TaskUID == harnessv2.TaskUID(restoredUID) ||
+				finalizeRequest.Metadata.TaskAttempt != 1 || deleteRequest.Metadata.TaskAttempt != 1 ||
+				finalizeRequest.Metadata.PromptID != harnessv2.PromptID(fixture.task.Status.Execution.PromptID) ||
+				deleteRequest.Metadata.PromptID != "" || finalizeRequest.Metadata.RequestDigest == "" ||
+				deleteRequest.Metadata.RequestDigest == "" {
+				t.Fatalf("restored cleanup mutation metadata = finalize:%#v delete:%#v", finalizeRequest.Metadata, deleteRequest.Metadata)
+			}
+			wantPublicationID := publicationIDForTaskUID(fixture.task, sourceUID)
+			if finalizeRequest.PublicationID != wantPublicationID ||
+				finalizeRequest.PublicationID == publicationIDForTask(fixture.task) ||
+				finalizeRequest.TerminalState != test.wantTerminalState {
+				t.Fatalf("restored finalization identity = %#v, want publication %q state %q", finalizeRequest, wantPublicationID, test.wantTerminalState)
+			}
+			if test.omitPublication {
+				want, finalizationErr := runtimeSessionDeltaAbandonmentFinalizationForTaskUID(
+					fixture.task, sourceUID, harnessv2.WorkspaceDeltaID("delta-"+fixture.task.Status.Execution.PromptID), *fixture.task.Status.Delivery,
+				)
+				if finalizationErr != nil {
+					t.Fatal(finalizationErr)
+				}
+				wrong, finalizationErr := runtimeSessionDeltaAbandonmentFinalizationForTaskUID(
+					fixture.task, restoredUID, harnessv2.WorkspaceDeltaID("delta-"+fixture.task.Status.Execution.PromptID), *fixture.task.Status.Delivery,
+				)
+				if finalizationErr != nil {
+					t.Fatal(finalizationErr)
+				}
+				if finalizeRequest.TerminalReceiptDigest != want.TerminalReceiptDigest ||
+					finalizeRequest.TerminalReceiptDigest == wrong.TerminalReceiptDigest {
+					t.Fatalf("abandonment receipt digest = %q, want source %q and not restored %q", finalizeRequest.TerminalReceiptDigest, want.TerminalReceiptDigest, wrong.TerminalReceiptDigest)
+				}
+			}
+			fixture.assertCleanupReceipt(t)
+			var recovered corev1alpha1.Task
+			if getErr := fixture.kubeClient.Get(
+				fixture.ctx, types.NamespacedName{Namespace: fixture.task.Namespace, Name: fixture.task.Name}, &recovered,
+			); getErr != nil {
+				t.Fatal(getErr)
+			}
+			if recovered.UID != restoredUID || recovered.Status.AgentExecutionBinding == nil ||
+				recovered.Status.AgentExecutionBinding.Task.UID != sourceUID {
+				t.Fatalf("cleanup changed restored/source identity: uid=%q binding=%#v", recovered.UID, recovered.Status.AgentExecutionBinding)
+			}
+		})
+	}
+}
+
+func TestRecoveredWriteSessionDeleteResponseLossUsesStatusAbsenceReceipt(t *testing.T) {
+	fixture := newRecoveredWriteCleanupFixture(t, recoveredWriteCleanupOptions{
+		state: harnessv2.RuntimeSessionStateFinalizing, abortFirstDeleteResponse: true, omitDeletedSessionFromStatus: true,
+	})
+	complete, err := fixture.dispatcher.cleanupRecoveredTaskScopedRuntimeSession(fixture.ctx, fixture.task.DeepCopy())
+	if err == nil || complete {
+		t.Fatalf("first cleanup after lost DELETE response = complete:%v err:%v, want incomplete error", complete, err)
+	}
+	var afterLoss corev1alpha1.Task
+	if err := fixture.kubeClient.Get(fixture.ctx, types.NamespacedName{Namespace: fixture.task.Namespace, Name: fixture.task.Name}, &afterLoss); err != nil {
+		t.Fatal(err)
+	}
+	if afterLoss.Status.Execution == nil || afterLoss.Status.Execution.RuntimeSessionCleanupDigest != "" {
+		t.Fatalf("cleanup receipt was persisted before deletion was proven: %#v", afterLoss.Status.Execution)
+	}
+	complete, err = fixture.dispatcher.cleanupRecoveredTaskScopedRuntimeSession(fixture.ctx, &afterLoss)
+	if err != nil || !complete {
+		t.Fatalf("status-absence recovery = complete:%v err:%v, want complete", complete, err)
+	}
+	operations, finalizations, deletes := fixture.trace.snapshot()
+	if fmt.Sprint(operations) != "[delete]" || len(finalizations) != 0 || len(deletes) != 1 {
+		t.Fatalf("response-loss recovery operations = %v finalizations=%d deletes=%d", operations, len(finalizations), len(deletes))
+	}
+	fixture.assertCleanupReceipt(t)
+}
+
+func TestACPDispatcherRecoveryAcceptsDeadLetteredStandaloneProjection(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "dead-letter.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	controlStore := sqlite.NewStore(db, "test")
+	epochs, stopEpoch := startACPRecoveryEpochManager(t, ctx, controlStore, "dead-letter")
+	defer stopEpoch()
+	fence, err := epochs.CurrentFence(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "dead-letter", UID: types.UID("bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb")},
+		Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent},
+		Status: corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateSucceeded, Outcome: corev1alpha1.TaskExecutionOutcomeSucceeded,
+			Attempt: 1, PromptID: "prompt-dead-letter",
+		}, Delivery: &corev1alpha1.TaskDeliveryStatus{
+			State: corev1alpha1.TaskDeliveryStateReadValidated, Outcome: corev1alpha1.TaskDeliveryOutcomeReadValidated,
+		}},
+	}
+	attempt := &store.PromptAttempt{
+		Key:            store.PromptAttemptKey{Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: task.Status.Execution.PromptID},
+		ExecutionState: store.PromptExecutionSucceeded, DeliveryState: store.PromptDeliveryReadValidated,
+	}
+	dispatcher := &ACPDispatcher{Store: controlStore, Epochs: epochs}
+	if err := dispatcher.enqueueStandaloneTaskProjection(ctx, task, taskTerminalProjection{
+		Namespace: task.Namespace, Task: task.Name, TaskUID: string(task.UID), Attempt: 1,
+		Phase: corev1alpha1.TaskPhaseSucceeded, Message: "ACP task completed",
+		Execution: *task.Status.Execution.DeepCopy(), Delivery: task.Status.Delivery.DeepCopy(),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	claimed, err := controlStore.ClaimOutboxProjections(ctx, store.ClaimOutboxProjectionsRequest{
+		Fence: fence, WorkerID: "dead-letter-worker", Limit: 1, LeaseDuration: time.Minute, Now: time.Now().UTC(),
+	})
+	if err != nil || len(claimed) != 1 {
+		t.Fatalf("claim projection: count=%d err=%v", len(claimed), err)
+	}
+	if _, err := controlStore.CompleteOutboxProjection(ctx, store.CompleteOutboxProjectionRequest{
+		ID: claimed[0].ID, Fence: fence, ExpectedVersion: claimed[0].Version, LeaseOwner: "dead-letter-worker",
+		OperationID: "dead-letter", OperationDigest: testControlDigestForDispatcher("dead-letter"),
+		NewState: store.OutboxProjectionDeadLetter, LastError: "delivery attempts exhausted", UpdatedAt: time.Now().UTC(),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	exists, err := dispatcher.validateExistingStandaloneTaskProjection(ctx, task, attempt)
+	if err != nil || !exists {
+		t.Fatalf("dead-letter projection validation = exists:%v err:%v", exists, err)
+	}
+}
+
+func TestACPDispatcherRecoveryCreatesMissingStandaloneNonSuccessProjection(t *testing.T) {
+	tests := []struct {
+		name       string
+		state      store.PromptExecutionState
+		phase      corev1alpha1.TaskPhase
+		outcome    corev1alpha1.TaskExecutionOutcome
+		sessionRef bool
+	}{
+		{name: "failed", state: store.PromptExecutionFailed, phase: corev1alpha1.TaskPhaseFailed, outcome: corev1alpha1.TaskExecutionOutcomeFailed},
+		{name: "cancelled", state: store.PromptExecutionCancelled, phase: corev1alpha1.TaskPhaseCancelled, outcome: corev1alpha1.TaskExecutionOutcomeCancelled},
+		{name: "cancelled before session binding", state: store.PromptExecutionCancelled, phase: corev1alpha1.TaskPhaseCancelled, outcome: corev1alpha1.TaskExecutionOutcomeCancelled, sessionRef: true},
+		{name: "outcome unknown", state: store.PromptExecutionOutcomeUnknown, phase: corev1alpha1.TaskPhaseFailed, outcome: corev1alpha1.TaskExecutionOutcomeOutcomeUnknown},
+	}
+	for i, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			defer cancel()
+			db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "missing-terminal.db"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer db.Close() //nolint:errcheck
+			controlStore := sqlite.NewStore(db, "test")
+			epochs, stopEpoch := startACPRecoveryEpochManager(t, ctx, controlStore, "missing-terminal-"+tc.name)
+			defer stopEpoch()
+			uid := types.UID(fmt.Sprintf("88888888-8888-8888-8888-%012d", i+1))
+			promptID := "prompt-" + string(uid) + "-1"
+			task := &corev1alpha1.Task{
+				ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "missing-" + tc.name, UID: uid},
+				Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent},
+				Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhaseRunning, Attempts: 1,
+					Execution: &corev1alpha1.TaskExecutionStatus{State: corev1alpha1.TaskExecutionState(tc.state), Outcome: tc.outcome, Attempt: 1, PromptID: promptID},
+					Delivery:  &corev1alpha1.TaskDeliveryStatus{State: corev1alpha1.TaskDeliveryStateNotRequested, Outcome: corev1alpha1.TaskDeliveryOutcomeNotRequested},
+				},
+			}
+			if tc.sessionRef {
+				task.Spec.SessionRef = &corev1alpha1.SessionReference{Name: "unbound-session", Create: true, Append: true}
+			}
+			scheme := runtime.NewScheme()
+			if err := corev1alpha1.AddToScheme(scheme); err != nil {
+				t.Fatal(err)
+			}
+			kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}).WithObjects(task).Build()
+			dispatcher := &ACPDispatcher{Client: kubeClient, APIReader: kubeClient, Store: controlStore, Epochs: epochs}
+			attempt := &store.PromptAttempt{
+				Key:            store.PromptAttemptKey{Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: promptID},
+				ExecutionState: tc.state, DeliveryState: store.PromptDeliveryNotRequested,
+			}
+			if err := dispatcher.recoverMissingStandaloneTerminalProjection(ctx, task, attempt); err != nil {
+				t.Fatal(err)
+			}
+			projection, err := controlStore.GetOutboxProjection(ctx, standaloneTaskTerminalProjectionID(task, 1))
+			if err != nil {
+				t.Fatal(err)
+			}
+			var payload taskTerminalProjection
+			if err := json.Unmarshal(projection.Payload, &payload); err != nil {
+				t.Fatal(err)
+			}
+			if payload.Phase != tc.phase || payload.Execution.State != corev1alpha1.TaskExecutionState(tc.state) || payload.Execution.Outcome != tc.outcome || payload.Delivery == nil || payload.Delivery.State != corev1alpha1.TaskDeliveryStateNotRequested {
+				t.Fatalf("terminal projection payload = %#v", payload)
+			}
+			updated := &corev1alpha1.Task{}
+			if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, updated); err != nil {
+				t.Fatal(err)
+			}
+			if updated.Status.Phase != tc.phase || updated.Status.Execution == nil || updated.Status.Execution.Outcome != tc.outcome {
+				t.Fatalf("recovered Task status = %#v", updated.Status)
+			}
+		})
+	}
+}
+
+func TestRecoveredTerminalDeliveryStatusPreservesTaskEvidence(t *testing.T) {
+	transition := metav1.NewTime(time.Date(2026, 7, 25, 13, 0, 0, 0, time.UTC))
+	task := &corev1alpha1.Task{Status: corev1alpha1.TaskStatus{Delivery: &corev1alpha1.TaskDeliveryStatus{
+		State: corev1alpha1.TaskDeliveryStateReadValidated, Outcome: corev1alpha1.TaskDeliveryOutcomeReadValidated,
+		StartingSHA: "740310bf8ecfbce4963628a51b6a11e26d7ee7be", LastTransitionTime: &transition,
+	}}}
+	attempt := &store.PromptAttempt{DeliveryState: store.PromptDeliveryReadValidated}
+	status, err := (&ACPDispatcher{}).recoveredTerminalDeliveryStatus(context.Background(), task, attempt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if status.StartingSHA != task.Status.Delivery.StartingSHA || status.LastTransitionTime == nil || !status.LastTransitionTime.Equal(&transition) {
+		t.Fatalf("recovered delivery evidence = %#v, want %#v", status, task.Status.Delivery)
+	}
+	if status == task.Status.Delivery {
+		t.Fatal("recovered delivery status aliased Task status")
+	}
+}
+
+//nolint:gocyclo // The restart-boundary assertions intentionally stay in one end-to-end scenario.
+func TestACPDispatcherRecoveryResumesCommittedSessionTurnFinalization(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "store.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	sqliteStore := sqlite.NewStore(db, "test")
+
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := coordinationv1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	taskUID := types.UID("44444444-4444-4444-4444-444444444444")
+	promptID := "prompt-" + string(taskUID) + "-1"
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "default", Name: "session-crash", UID: taskUID,
+			Labels: map[string]string{acpRuntimeTaskPoolLabel: "pool"},
+		},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent, Prompt: "persist this failed turn",
+			SessionRef: &corev1alpha1.SessionReference{Name: "session-crash", Create: true, Append: true},
+		},
+		Status: corev1alpha1.TaskStatus{
+			Phase: corev1alpha1.TaskPhaseRunning, Attempts: 1,
+			AgentExecutionBinding: testACPExecuteBindingForDispatcher(),
+		},
+	}
+	rawClient := withControllerEpochLeaseUIDs(t, fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithStatusSubresource(
+			&corev1alpha1.Task{}, &corev1alpha1.ControllerEpoch{}, &corev1alpha1.PromptAttempt{},
+			&corev1alpha1.RuntimeSessionControl{}, &corev1alpha1.BranchClaim{}, &corev1alpha1.Publication{},
+			&corev1alpha1.ExternalEffect{},
+		).
+		WithObjects(task).
+		Build())
+	controlStore, err := kubestore.NewComposite(rawClient, "orka-system", sqliteStore)
+	if err != nil {
+		t.Fatal(err)
+	}
+	oldEpochs, stopOldEpoch := startACPRecoveryEpochManager(t, ctx, controlStore, "controller-old")
+	oldFence, err := oldEpochs.CurrentFence(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	continuity := newACPRecoveryContinuity(t, controlStore, sqliteStore, "session-crash-uid")
+	control, err := continuity.EnsureSession(ctx, ACPEnsureSessionRequest{
+		Namespace: "default", SessionName: "session-crash", SessionType: "task",
+		ExpectedSessionUID: "session-crash-uid", Fence: oldFence, CreatedAt: time.Date(2026, 7, 25, 12, 0, 0, 0, time.UTC),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	attemptKey := store.PromptAttemptKey{Namespace: task.Namespace, TaskUID: string(taskUID), Attempt: 1, PromptID: promptID}
+	attempt, err := controlStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{Key: attemptKey, RequestDigest: testControlDigestForDispatcher("session-crash")}), oldFence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	attempt = transitionACPRecoveryAttempt(t, ctx, controlStore, oldFence, attempt, store.PromptExecutionReserved, nil)
+	lease, err := continuity.AcquireMutationLease(ctx, ACPAcquireSessionLeaseRequest{
+		Session: *control, Fence: oldFence, TaskUID: string(taskUID), Attempt: 1, PromptID: promptID,
+		PromptRequestDigest: attempt.RequestDigest, AcquiredAt: time.Date(2026, 7, 25, 12, 1, 0, 0, time.UTC),
+		NamespaceUID: "default-namespace-uid", RuntimeIdentity: "codex",
+		ConfigDigest: testControlDigestForDispatcher("session-crash-profile"),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	attempt = transitionACPRecoveryAttempt(t, ctx, controlStore, oldFence, attempt, store.PromptExecutionSessionStarting, lease)
+	turn, err := continuity.OpenTurn(ctx, ACPOpenSessionTurnRequest{
+		Lease: *lease, Fence: oldFence, PromptAttemptID: attempt.ID,
+		PromptRequestDigest: attempt.RequestDigest, UserPrompt: task.Spec.Prompt,
+		OpenedAt: time.Date(2026, 7, 25, 12, 2, 0, 0, time.UTC),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, state := range []store.PromptExecutionState{
+		store.PromptExecutionPlanned, store.PromptExecutionSubmitting, store.PromptExecutionAccepted,
+		store.PromptExecutionRunning, store.PromptExecutionFailed,
+	} {
+		attempt = transitionACPRecoveryAttempt(t, ctx, controlStore, oldFence, attempt, state, nil)
+	}
+	task.Status.Execution = &corev1alpha1.TaskExecutionStatus{
+		State: corev1alpha1.TaskExecutionStateFailed, Outcome: corev1alpha1.TaskExecutionOutcomeFailed,
+		Attempt: 1, PromptID: promptID, RuntimePoolName: "pool", RuntimeInstanceID: "runtime-old",
+		RuntimeSessionUID: control.SessionUID, RuntimeSessionGeneration: lease.Key.LeaseGeneration,
+		ControllerEpoch: oldFence.Epoch, RequestDigest: attempt.RequestDigest,
+	}
+	if err := rawClient.Status().Update(ctx, task); err != nil {
+		t.Fatal(err)
+	}
+
+	failSessionStatusOnce := true
+	failingClient := interceptor.NewClient(rawClient, interceptor.Funcs{
+		SubResourceUpdate: func(ctx context.Context, c client.Client, subresource string, obj client.Object, opts ...client.SubResourceUpdateOption) error {
+			if failSessionStatusOnce {
+				if _, isSession := obj.(*corev1alpha1.RuntimeSessionControl); isSession {
+					failSessionStatusOnce = false
+					return apierrors.NewConflict(schema.GroupResource{Group: corev1alpha1.GroupVersion.Group, Resource: "runtimesessioncontrols"}, obj.GetName(), errors.New("simulated controller crash"))
+				}
+			}
+			return c.SubResource(subresource).Update(ctx, obj, opts...)
+		},
+	})
+	failingStore, err := kubestore.NewComposite(failingClient, "orka-system", sqliteStore)
+	if err != nil {
+		t.Fatal(err)
+	}
+	failingContinuity := newACPRecoveryContinuity(t, failingStore, sqliteStore, control.SessionUID)
+	projectionPayload, err := json.Marshal(taskTerminalProjection{
+		Namespace: task.Namespace, Task: task.Name, TaskUID: string(task.UID), Attempt: 1,
+		Phase: corev1alpha1.TaskPhaseFailed,
+		Execution: corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateFailed, Outcome: corev1alpha1.TaskExecutionOutcomeFailed,
+			Attempt: 1, PromptID: promptID, Reason: "PromptFailed", Message: "prompt failed",
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	finalizedAt := time.Date(2026, 7, 25, 12, 3, 0, 0, time.UTC)
+	_, err = failingContinuity.FinalizeOutcomeMarker(ctx, ACPFinalizeOutcomeMarkerRequest{
+		SessionTurn: *turn, Fence: oldFence, Kind: "Failed", Reason: "prompt failed",
+		Projection: ACPFinalizationProjection{
+			ProjectionKind: "TaskTerminalStatus", Payload: projectionPayload, AvailableAt: finalizedAt,
+		},
+		FinalizedAt: finalizedAt,
+	})
+	if !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("partial finalization error = %v, want simulated conflict", err)
+	}
+	committedTurn, err := sqliteStore.GetSessionTurn(ctx, turn.Turn.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if committedTurn.State != store.SessionTurnFinalized || committedTurn.FinalizedAt == nil {
+		t.Fatalf("SQLite turn was not finalized before crash: %#v", committedTurn)
+	}
+	deferred, err := sqliteStore.GetOutboxProjection(ctx, committedTurn.ProjectionID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if deferred.AvailableAt.Year() != 9999 {
+		t.Fatalf("outbox was activated before Kubernetes completion: %s", deferred.AvailableAt)
+	}
+
+	stopOldEpoch()
+	restartedStore, err := kubestore.NewComposite(rawClient, "orka-system", sqliteStore)
+	if err != nil {
+		t.Fatal(err)
+	}
+	newEpochs, stopNewEpoch := startACPRecoveryEpochManager(t, ctx, restartedStore, "controller-new")
+	defer stopNewEpoch()
+	newContinuity := newACPRecoveryContinuity(t, restartedStore, sqliteStore, control.SessionUID)
+	dispatcher := &ACPDispatcher{
+		Client: rawClient, APIReader: rawClient, Store: restartedStore, ResultStore: sqliteStore,
+		Epochs: newEpochs, Sessions: newContinuity,
+	}
+	if err := dispatcher.recoverStaleAttempts(ctx); err != nil {
+		t.Fatal(err)
+	}
+
+	recoveredTurn, err := sqliteStore.GetSessionTurn(ctx, turn.Turn.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if recoveredTurn.FinalizationDigest != committedTurn.FinalizationDigest || recoveredTurn.FinalizedAt == nil ||
+		!recoveredTurn.FinalizedAt.Equal(*committedTurn.FinalizedAt) ||
+		!recoveredTurn.ProjectionAvailableAt.Equal(committedTurn.ProjectionAvailableAt) {
+		t.Fatalf("recovery changed persisted finalization identity: before=%#v after=%#v", committedTurn, recoveredTurn)
+	}
+	recoveredControl, err := restartedStore.GetSessionControl(ctx, control.Namespace, control.SessionName)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if recoveredControl.Lease != nil || recoveredControl.LastOperationID != "finalize:"+turn.Turn.ID || recoveredControl.LastOperationDigest != committedTurn.FinalizationDigest {
+		t.Fatalf("SessionControl finalization tail was not completed: %#v", recoveredControl)
+	}
+	activated, err := sqliteStore.GetOutboxProjection(ctx, committedTurn.ProjectionID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !activated.AvailableAt.Equal(committedTurn.ProjectionAvailableAt) || activated.PayloadDigest != committedTurn.ProjectionDigest {
+		t.Fatalf("outbox activation did not reuse persisted receipt: %#v", activated)
+	}
+	transcript, err := sqliteStore.LoadTranscript(ctx, control.Namespace, control.SessionName, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(transcript) != 2 {
+		t.Fatalf("recovery duplicated transcript entries: %d", len(transcript))
+	}
+}
+
+type recoveredWriteCleanupOptions struct {
+	state                        harnessv2.RuntimeSessionState
+	abortFirstDeleteResponse     bool
+	omitDeletedSessionFromStatus bool
+	sourceTaskUID                types.UID
+	omitPublication              bool
+}
+
+type recoveredWriteCleanupTrace struct {
+	mu            sync.Mutex
+	operations    []string
+	finalizations []harnessv2.FinalizeRuntimeSessionPublicationRequest
+	deletes       []harnessv2.DeleteRuntimeSessionRequest
+	finalized     bool
+	deleted       bool
+}
+
+func (t *recoveredWriteCleanupTrace) snapshot() (
+	[]string,
+	[]harnessv2.FinalizeRuntimeSessionPublicationRequest,
+	[]harnessv2.DeleteRuntimeSessionRequest,
+) {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	return append([]string(nil), t.operations...),
+		append([]harnessv2.FinalizeRuntimeSessionPublicationRequest(nil), t.finalizations...),
+		append([]harnessv2.DeleteRuntimeSessionRequest(nil), t.deletes...)
+}
+
+type recoveredWriteCleanupFixture struct {
+	ctx         context.Context
+	task        *corev1alpha1.Task
+	controlUID  types.UID
+	publication *store.Publication
+	kubeClient  client.Client
+	dispatcher  *ACPDispatcher
+	trace       *recoveredWriteCleanupTrace
+}
+
+func (f *recoveredWriteCleanupFixture) assertCleanupReceipt(t *testing.T) {
+	t.Helper()
+	var recovered corev1alpha1.Task
+	if err := f.kubeClient.Get(f.ctx, types.NamespacedName{Namespace: f.task.Namespace, Name: f.task.Name}, &recovered); err != nil {
+		t.Fatal(err)
+	}
+	if recovered.Status.Execution == nil {
+		t.Fatal("recovered task execution status is missing")
+	}
+	wantDigest, err := taskScopedRuntimeSessionCleanupDigest(
+		f.controlUID, recovered.Status.Execution.Attempt, recovered.Status.Execution.RuntimeInstanceID,
+		recovered.Status.Execution.RuntimeSessionUID, recovered.Status.Execution.RuntimeSessionGeneration,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if recovered.Status.Execution.RuntimeSessionCleanupDigest != wantDigest ||
+		!taskScopedRuntimeSessionCleanupCompleteForUID(&recovered, f.controlUID) {
+		t.Fatalf("write SessionRef cleanup receipt = %q, want %q", recovered.Status.Execution.RuntimeSessionCleanupDigest, wantDigest)
+	}
+}
+
+type recoveredPublicationStore struct {
+	store.DurableControlStore
+	publication    *store.Publication
+	sessionControl *store.SessionControl
+}
+
+func (s *recoveredPublicationStore) GetSessionControl(ctx context.Context, namespace, sessionName string) (*store.SessionControl, error) {
+	if s.sessionControl != nil && namespace == s.sessionControl.Namespace && sessionName == s.sessionControl.SessionName {
+		copy := *s.sessionControl
+		return &copy, nil
+	}
+	return s.DurableControlStore.GetSessionControl(ctx, namespace, sessionName)
+}
+
+func (s *recoveredPublicationStore) GetPublication(ctx context.Context, id string) (*store.Publication, error) {
+	if s.publication != nil && id == s.publication.ID {
+		copy := *s.publication
+		return &copy, nil
+	}
+	return s.DurableControlStore.GetPublication(ctx, id)
+}
+
+//nolint:gocyclo // This fixture keeps the authenticated recovery boundary explicit and auditable.
+func newRecoveredWriteCleanupFixture(t *testing.T, options recoveredWriteCleanupOptions) *recoveredWriteCleanupFixture {
+	t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "recovered-write-cleanup.db"))
+	if err != nil {
+		cancel()
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	t.Cleanup(cancel)
+	controlStore := sqlite.NewStore(db, "test")
+	epochs, stopEpoch := startACPRecoveryEpochManager(t, ctx, controlStore, "recovered-write-cleanup")
+	t.Cleanup(stopEpoch)
+	fence, err := epochs.CurrentFence(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	profile := harnessProfileForTest()
+	profile.Model = acpTestModel
+	profile.WorkspaceIntent = harnessv2.WorkspaceIntentWrite
+	profileDigest, err := harnessv2.CanonicalProfileDigest(profile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	trace := &recoveredWriteCleanupTrace{}
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodGet && r.URL.Path == harnessv2.CapabilitiesPath:
+			writeDispatcherJSON(w, harnessv2.CapabilitiesResponse{
+				Protocol: harnessv2.ProtocolVersion, Transport: "http+ndjson", ACPVersion: harnessv2.ACPProfileV1,
+				RuntimeProfileDigest: profileDigest, ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+				AdapterDigests: profile.AdapterDigests, Limits: harnessv2.DefaultProtocolLimits(),
+				Provider: harnessv2.ProviderCapabilities{
+					ProviderKinds: []string{profile.ProviderKind}, Models: []string{profile.Model},
+					SupportsCancel: true, SupportsPermissions: true, SupportsTools: true,
+				},
+				WorkspaceGovernance:             harnessv2.StrictWorkspaceGovernanceCapabilities(),
+				SupportsDrain:                   true,
+				SupportsPublicationFinalization: true,
+			})
+		case r.Method == http.MethodGet && r.URL.Path == harnessv2.StatusPath:
+			now := time.Now().UTC()
+			trace.mu.Lock()
+			deleted := trace.deleted
+			finalized := trace.finalized
+			trace.mu.Unlock()
+			sessions := []harnessv2.RuntimeSessionStatus(nil)
+			resident := uint32(0)
+			if !deleted || !options.omitDeletedSessionFromStatus {
+				state := options.state
+				if finalized && state == harnessv2.RuntimeSessionStatePublicationPrepared {
+					state = harnessv2.RuntimeSessionStateFinalizing
+				}
+				sessions = []harnessv2.RuntimeSessionStatus{{
+					RuntimeSessionID: "runtime-session-recovered-write", RuntimeSessionUID: "session-recovered-write",
+					Generation: 1, State: state,
+					ReservedForFinalization: state == harnessv2.RuntimeSessionStateFinalizing,
+					LastTransitionAt:        now,
+				}}
+				resident = 1
+			}
+			writeDispatcherJSON(w, harnessv2.StatusResponse{
+				Protocol: harnessv2.ProtocolVersion,
+				Fence: harnessv2.Fence{
+					RuntimeInstanceID: "pod-uid.boot-id", SupervisorBootID: "boot-id", ControllerEpoch: uint64(fence.Epoch),
+					RuntimePoolUID: "pool-uid", RuntimePoolGeneration: 1, RuntimeProfileDigest: profileDigest,
+					ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+				},
+				Lifecycle: harnessv2.SupervisorLifecycleReady, Drain: harnessv2.DrainStatus{AcceptingNewSessions: true},
+				Sessions: sessions, Pressure: harnessv2.PressureMetadata{ResidentSessions: resident}, Timestamp: now,
+			})
+		case r.Method == http.MethodPut && strings.HasSuffix(r.URL.Path, "/publication-finalization"):
+			var request harnessv2.FinalizeRuntimeSessionPublicationRequest
+			if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+				t.Errorf("decode recovered publication finalization: %v", err)
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			}
+			trace.mu.Lock()
+			trace.operations = append(trace.operations, "finalize")
+			trace.finalizations = append(trace.finalizations, request)
+			trace.finalized = true
+			trace.mu.Unlock()
+			now := time.Now().UTC()
+			writeDispatcherJSON(w, harnessv2.FinalizeRuntimeSessionPublicationResponse{
+				Protocol: harnessv2.ProtocolVersion, Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh},
+				Session: harnessv2.RuntimeSessionDescriptor{
+					RuntimeSessionID:  harnessv2.RuntimeSessionID(runtimeSessionID(request.Metadata.Fence)),
+					RuntimeSessionUID: request.Metadata.Fence.RuntimeSessionUID, Generation: request.Metadata.Fence.RuntimeSessionGeneration,
+					RuntimeInstanceID: request.Metadata.Fence.RuntimeInstanceID, SupervisorBootID: request.Metadata.Fence.SupervisorBootID,
+					RuntimeProfileDigest: request.Metadata.Fence.RuntimeProfileDigest, State: harnessv2.RuntimeSessionStateFinalizing,
+					ProviderSessionID: "provider-session",
+					WorkspaceBaseline: harnessv2.WorkspaceBaseline{
+						RepositoryIdentity: "github.com/orka-agents/orka", Revision: strings.Repeat("1", 40),
+						TreeDigest: "sha256:" + strings.Repeat("2", 64),
+					},
+					CreatedAt: now.Add(-time.Minute), LastTransitionAt: now,
+				},
+				Finalization: harnessv2.PublicationFinalizationReceipt{
+					WorkspaceDeltaID: request.WorkspaceDeltaID, PublicationID: request.PublicationID,
+					PublicationGeneration: request.PublicationGeneration, PublicationVersion: request.PublicationVersion,
+					TerminalState: request.TerminalState, TerminalReceiptDigest: request.TerminalReceiptDigest, AppliedAt: now,
+				},
+			})
+		case r.Method == http.MethodDelete:
+			var request harnessv2.DeleteRuntimeSessionRequest
+			if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+				t.Errorf("decode recovered delete: %v", err)
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			}
+			trace.mu.Lock()
+			trace.operations = append(trace.operations, "delete")
+			trace.deletes = append(trace.deletes, request)
+			deleteCall := len(trace.deletes)
+			trace.deleted = true
+			trace.mu.Unlock()
+			if options.abortFirstDeleteResponse && deleteCall == 1 {
+				panic(http.ErrAbortHandler)
+			}
+			writeDispatcherJSON(w, harnessv2.DeleteRuntimeSessionResponse{
+				Protocol: harnessv2.ProtocolVersion, Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh},
+				State:     harnessv2.RuntimeSessionStateDeleted,
+				Tombstone: testDeleteTombstone(request, time.Now().UTC()),
+			})
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	t.Cleanup(server.Close)
+	parsed, err := url.Parse(server.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "recovered-write", UID: types.UID("abababab-abab-abab-abab-abababababab")},
+		Spec: corev1alpha1.TaskSpec{
+			Type:       corev1alpha1.TaskTypeAgent,
+			SessionRef: &corev1alpha1.SessionReference{Name: "recovered-write", Create: true, Append: true},
+			Workspace:  &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentWrite},
+		},
+		Status: corev1alpha1.TaskStatus{
+			Phase: corev1alpha1.TaskPhaseSucceeded, Attempts: 1,
+			Execution: &corev1alpha1.TaskExecutionStatus{
+				State: corev1alpha1.TaskExecutionStateSucceeded, Outcome: corev1alpha1.TaskExecutionOutcomeSucceeded,
+				Attempt: 1, PromptID: "prompt-recovered-write", RuntimePoolName: "pool", RuntimePoolUID: "pool-uid",
+				RuntimeInstanceID: "pod-uid.boot-id", RuntimeSessionUID: "session-recovered-write", RuntimeSessionGeneration: 1,
+				ControllerEpoch: fence.Epoch, RequestDigest: testControlDigestForDispatcher("recovered-write"),
+			},
+			Delivery: &corev1alpha1.TaskDeliveryStatus{
+				State: corev1alpha1.TaskDeliveryStateVerifiedExact, Outcome: corev1alpha1.TaskDeliveryOutcomeVerifiedExact,
+				StartingSHA: strings.Repeat("1", 40), ExpectedCommitSHA: strings.Repeat("3", 40), VerifiedRemoteSHA: strings.Repeat("3", 40),
+			},
+		},
+	}
+	controlUID := task.UID
+	if options.sourceTaskUID != "" {
+		controlUID = options.sourceTaskUID
+		binding := testACPExecuteBindingForDispatcher()
+		binding.Task.UID = controlUID
+		task.Status.AgentExecutionBinding = binding
+	}
+	pool := &corev1alpha1.RuntimePool{
+		ObjectMeta: metav1.ObjectMeta{Namespace: task.Namespace, Name: "pool", UID: types.UID("pool-uid"), Generation: 1},
+		Spec: corev1alpha1.RuntimePoolSpec{RuntimeNamespace: "orka-runtimes", Runtime: corev1alpha1.RuntimePoolRuntimeSpec{
+			Image:   "docker.io/example/acp@sha256:" + strings.Repeat("a", 64),
+			Profile: RuntimePoolProfileFromPlan(ACPRuntimePlan{Profile: profile, Digest: profileDigest}),
+		}},
+		Status: corev1alpha1.RuntimePoolStatus{ActiveInstance: &corev1alpha1.RuntimePoolActiveInstanceStatus{
+			PodNamespace: "orka-runtimes", PodName: "runtime-pod", PodAddress: parsed.Host, PodUID: "pod-uid", BootID: "boot-id",
+			RuntimeInstanceID: task.Status.Execution.RuntimeInstanceID, ControllerEpoch: fence.Epoch,
+			ProtocolVersion: corev1alpha1.RuntimePoolProtocolHarnessV2, ProfileDigest: string(profileDigest), ProfileDigestSchemaVersion: strconv.FormatUint(uint64(harnessv2.ProfileDigestSchemaVersion), 10),
+		}},
+	}
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "orka-runtimes", Name: "pool-auth", Labels: map[string]string{
+			runtimePoolAuthLabel: "true", runtimePoolUIDLabel: string(pool.UID),
+		}},
+		Data: map[string][]byte{runtimePoolControllerTokenKey: []byte(strings.Repeat("t", 32)), runtimePoolCapabilitySecretKey: []byte(strings.Repeat("s", 32))},
+	}
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}).WithObjects(task, pool, secret).Build()
+	now := time.Date(2026, 7, 26, 12, 0, 0, 0, time.UTC)
+	var publication *store.Publication
+	if !options.omitPublication {
+		publication = &store.Publication{
+			ID: publicationIDForTaskUID(task, controlUID), Namespace: task.Namespace, Generation: 1, Version: 7,
+			TaskUID: string(controlUID), Attempt: 1, PromptID: task.Status.Execution.PromptID,
+			State: store.PublicationVerifiedExact,
+			PreparedReceipt: &store.PreparedPublicationReceipt{
+				OperationID: "prepare", RequestDigest: testControlDigestForDispatcher("recovered-prepare"),
+				TreeSHA: strings.Repeat("2", 40), CommitSHA: strings.Repeat("3", 40),
+				ManifestDigest: "sha256:" + strings.Repeat("4", 64), PreparedAt: now.Add(-2 * time.Minute),
+			},
+			PublishReceipt: &store.PublishOperationReceipt{
+				OperationID: "publish", RequestDigest: testControlDigestForDispatcher("recovered-publish"),
+				ExpectedCommitSHA: strings.Repeat("3", 40), PublishedAt: now.Add(-time.Minute),
+			},
+			VerificationReceipt: &store.PublicationVerificationReceipt{
+				OperationID: "verify", RequestDigest: testControlDigestForDispatcher("recovered-verify"),
+				Outcome: store.PublicationVerifiedExact, ExpectedCommitSHA: strings.Repeat("3", 40),
+				ObservedRemote: store.RemoteRefState{SHA: strings.Repeat("3", 40)}, VerifiedAt: now,
+			},
+		}
+	}
+	publicationStore := &recoveredPublicationStore{DurableControlStore: controlStore, publication: publication}
+	dispatcher := &ACPDispatcher{Client: kubeClient, APIReader: kubeClient, Store: publicationStore, Epochs: epochs}
+	return &recoveredWriteCleanupFixture{
+		ctx: ctx, task: task, controlUID: controlUID, publication: publication,
+		kubeClient: kubeClient, dispatcher: dispatcher, trace: trace,
+	}
+}
+
+func transitionACPRecoveryAttempt(
+	t *testing.T,
+	ctx context.Context,
+	controlStore store.PromptAttemptStore,
+	fence store.ControllerEpochFence,
+	attempt *store.PromptAttempt,
+	to store.PromptExecutionState,
+	lease *ACPSessionLease,
+) *store.PromptAttempt {
+	t.Helper()
+	transition := store.PromptAttemptExecutionTransition{
+		ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+		NewState: to, OperationID: "recovery-" + string(to) + "-" + strconv.FormatInt(attempt.Version, 10),
+		OperationDigest: testControlDigestForDispatcher("recovery-" + string(to) + "-" + strconv.FormatInt(attempt.Version, 10)),
+		UpdatedAt:       time.Now().UTC(),
+	}
+	if lease != nil {
+		transition.SessionUID = lease.Key.SessionUID
+		transition.SessionLeaseGeneration = lease.Key.LeaseGeneration
+		transition.RuntimeInstanceID = "runtime-old"
+	}
+	updated, err := controlStore.TransitionPromptAttemptExecution(ctx, transition)
+	if err != nil {
+		t.Fatalf("transition PromptAttempt to %s: %v", to, err)
+	}
+	return updated
+}
+
+func newACPRecoveryContinuity(t *testing.T, controls store.DurableControlStore, transcripts store.SessionStore, sessionUID string) *ACPSessionContinuity {
+	t.Helper()
+	lineages, _ := transcripts.(store.SessionLineageStore)
+	continuity, err := NewACPSessionContinuity(ACPSessionContinuityConfig{
+		SessionControls: controls, Transcripts: transcripts,
+		Publications: controls, BranchClaims: controls,
+		Lineages:      lineages,
+		NewSessionUID: func() (string, error) { return sessionUID, nil },
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return continuity
+}
+
+func startACPRecoveryEpochManager(t *testing.T, ctx context.Context, epochStore store.ControllerEpochStore, holder string) (*ControllerEpochManager, func()) {
+	t.Helper()
+	manager := NewControllerEpochManager(epochStore, holder)
+	epochCtx, cancel := context.WithCancel(ctx)
+	done := make(chan error, 1)
+	go func() { done <- manager.Start(epochCtx) }()
+	if _, err := manager.CurrentFence(ctx); err != nil {
+		cancel()
+		t.Fatal(err)
+	}
+	return manager, func() {
+		cancel()
+		if err := <-done; err != nil {
+			t.Errorf("stop epoch manager: %v", err)
+		}
+	}
+}
+
+type recoveryFixture struct {
+	ctx          context.Context
+	cancel       context.CancelFunc
+	db           *sql.DB
+	epochCancel  context.CancelFunc
+	epochDone    chan error
+	fence        store.ControllerEpochFence
+	controlStore *sqlite.Store
+	kubeClient   client.Client
+	dispatcher   *ACPDispatcher
+	attemptID    string
+}
+
+func newACPRecoveryFixture(t *testing.T, target store.PromptExecutionState) *recoveryFixture {
+	t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "store.db"))
+	if err != nil {
+		cancel()
+		t.Fatal(err)
+	}
+	controlStore := sqlite.NewStore(db, "test")
+	first := NewControllerEpochManager(controlStore, "controller-old")
+	oldCtx, stopOld := context.WithCancel(context.Background())
+	oldDone := make(chan error, 1)
+	go func() { oldDone <- first.Start(oldCtx) }()
+	oldFence, err := first.CurrentFence(ctx)
+	if err != nil {
+		cancel()
+		t.Fatal(err)
+	}
+
+	uid := types.UID("33333333-3333-3333-3333-333333333333")
+	promptID := "prompt-" + string(uid) + "-1"
+	key := store.PromptAttemptKey{Namespace: "default", TaskUID: string(uid), Attempt: 1, PromptID: promptID}
+	attemptID, err := key.CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	attempt, err := controlStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{
+		ID: attemptID, Key: key, RequestDigest: testControlDigestForDispatcher("recovery"),
+	}), oldFence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	path := []store.PromptExecutionState{store.PromptExecutionReserved, store.PromptExecutionSessionStarting, store.PromptExecutionPlanned}
+	if target == store.PromptExecutionAccepted {
+		path = append(path, store.PromptExecutionSubmitting, store.PromptExecutionAccepted)
+	}
+	for _, next := range path {
+		if attempt.ExecutionState == target {
+			break
+		}
+		attempt, err = controlStore.TransitionPromptAttemptExecution(ctx, store.PromptAttemptExecutionTransition{
+			ID: attempt.ID, Fence: oldFence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState, NewState: next,
+			OperationID: "recover-" + string(next), OperationDigest: testControlDigestForDispatcher("recover-" + string(next)), UpdatedAt: time.Now().UTC(),
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	stopOld()
+	if err := <-oldDone; err != nil {
+		t.Fatal(err)
+	}
+
+	second := NewControllerEpochManager(controlStore, "controller-new")
+	epochCtx, epochCancel := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- second.Start(epochCtx) }()
+	fence, err := second.CurrentFence(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "task", UID: uid, Labels: map[string]string{acpRuntimeTaskPoolLabel: "pool"}},
+		Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Prompt: "test"},
+		Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhaseRunning, Attempts: 1,
+			AgentExecutionBinding: testACPExecuteBindingForDispatcher(), Execution: &corev1alpha1.TaskExecutionStatus{
+				State: corev1alpha1.TaskExecutionState(target), Attempt: 1, PromptID: promptID, RuntimePoolName: "pool",
+				ControllerEpoch: oldFence.Epoch, RequestDigest: attempt.RequestDigest,
+			}},
+	}
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}).WithObjects(task).Build()
+	return &recoveryFixture{
+		ctx: ctx, cancel: cancel, db: db, epochCancel: epochCancel, epochDone: epochDone, fence: fence,
+		controlStore: controlStore, kubeClient: kubeClient,
+		dispatcher: &ACPDispatcher{Client: kubeClient, APIReader: kubeClient, Store: controlStore, ResultStore: controlStore, Epochs: second},
+		attemptID:  attemptID,
+	}
+}
+
+func (f *recoveryFixture) close(t *testing.T) {
+	t.Helper()
+	f.epochCancel()
+	if err := <-f.epochDone; err != nil {
+		t.Fatal(err)
+	}
+	f.cancel()
+	if err := f.db.Close(); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestRecoveredTerminalDeliveryStatusUsesTaskReceiptWithoutPublication(t *testing.T) {
+	storeValue, _, closeStore := newACPSessionTestStore(t, filepath.Join(t.TempDir(), "recovery-no-publication.db"))
+	defer closeStore()
+	dispatcher := &ACPDispatcher{Store: storeValue}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "no-publication", UID: types.UID("no-publication-uid")},
+		Status: corev1alpha1.TaskStatus{
+			Execution: &corev1alpha1.TaskExecutionStatus{Attempt: 1, PromptID: "prompt-no-publication"},
+			Delivery: &corev1alpha1.TaskDeliveryStatus{
+				State: corev1alpha1.TaskDeliveryStateDeliveryConflict, Outcome: corev1alpha1.TaskDeliveryOutcomeDeliveryConflict,
+				Reason: "BranchMoved", Message: "branch moved before publication",
+			},
+		},
+	}
+	attempt := &store.PromptAttempt{DeliveryState: store.PromptDeliveryConflict}
+	status, err := dispatcher.recoveredTerminalDeliveryStatus(context.Background(), task, attempt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if status.Outcome != corev1alpha1.TaskDeliveryOutcomeDeliveryConflict || status.Reason != task.Status.Delivery.Reason {
+		t.Fatalf("status = %#v", status)
+	}
+}
diff --git a/internal/controller/acp_runtime_pool_reserved_rebind_test.go b/internal/controller/acp_runtime_pool_reserved_rebind_test.go
new file mode 100644
index 000000000..9c2ee45e9
--- /dev/null
+++ b/internal/controller/acp_runtime_pool_reserved_rebind_test.go
@@ -0,0 +1,248 @@
+package controller
+
+import (
+	"context"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	types "k8s.io/apimachinery/pkg/types"
+	"k8s.io/utils/ptr"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+	"github.com/orka-agents/orka/internal/store/sqlite"
+)
+
+//nolint:gocyclo // The table verifies frozen pool and reservation lifecycle invariants together.
+func TestQueueACPRuntimeTaskKeepsFrozenPoolForReservedAttemptAfterRuntimeImageRotation(t *testing.T) {
+	for _, tc := range []struct {
+		name              string
+		activeReservation bool
+		wantRebound       bool
+	}{
+		{name: "recovered without active reservation", wantRebound: false},
+		{name: "active old-pool reservation blocks rebind", activeReservation: true, wantRebound: false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			scheme := runtime.NewScheme()
+			if err := corev1alpha1.AddToScheme(scheme); err != nil {
+				t.Fatal(err)
+			}
+			task := &corev1alpha1.Task{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: "default", Name: "reserved-image-rotation",
+					UID: types.UID("91d91425-e317-4f86-9c46-ee63ae111c42"), Generation: 2,
+				},
+				Spec: corev1alpha1.TaskSpec{
+					Type: corev1alpha1.TaskTypeAgent, Prompt: "inspect the repository",
+					AgentRuntime: &corev1alpha1.AgentRuntimeSpec{},
+					Workspace: &corev1alpha1.WorkspaceConfig{
+						Intent: corev1alpha1.WorkspaceIntentRead, GitRepo: "https://github.com/orka-agents/orka.git",
+					},
+				},
+			}
+			agent := &corev1alpha1.Agent{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: "default", Name: "codex",
+					UID: types.UID("33220495-a4a7-4f3e-9e07-8f3901048de5"), Generation: 3,
+				},
+				Spec: corev1alpha1.AgentSpec{
+					Model: &corev1alpha1.ModelConfig{Name: acpTestModel},
+					Runtime: &corev1alpha1.AgentCLIRuntime{
+						Type:            corev1alpha1.AgentRuntimeCodex,
+						ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+					},
+				},
+			}
+			oldImage := "docker.io/example/codex@sha256:" + strings.Repeat("a", 64)
+			newImage := "docker.io/example/codex@sha256:" + strings.Repeat("b", 64)
+			oldPlan, err := PlanACPRuntime(task, agent, ACPRuntimeImages{Codex: oldImage})
+			if err != nil {
+				t.Fatal(err)
+			}
+			newPlan, err := PlanACPRuntime(task, agent, ACPRuntimeImages{Codex: newImage})
+			if err != nil {
+				t.Fatal(err)
+			}
+			oldPoolFixture := runtimePoolForImageRotationTest(
+				task.Namespace, types.UID("101a20ba-2f11-44b5-8983-a912dc97800f"), oldPlan,
+			)
+			newPoolFixture := runtimePoolForImageRotationTest(
+				task.Namespace, types.UID("1d863930-2412-4c27-9f6c-bdf55ca10ac0"), newPlan,
+			)
+			kubeClient := fake.NewClientBuilder().
+				WithScheme(scheme).
+				WithStatusSubresource(&corev1alpha1.Task{}, &corev1alpha1.RuntimePool{}).
+				WithObjects(task, oldPoolFixture, newPoolFixture).
+				Build()
+			db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "store.db"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			t.Cleanup(func() {
+				if err := db.Close(); err != nil {
+					t.Errorf("close durable control database: %v", err)
+				}
+			})
+			controlStore := sqlite.NewStore(db, "test")
+			epochs := NewControllerEpochManager(controlStore, "controller-test")
+			epochCtx, cancelEpoch := context.WithCancel(context.Background())
+			epochDone := make(chan error, 1)
+			go func() { epochDone <- epochs.Start(epochCtx) }()
+			t.Cleanup(func() {
+				cancelEpoch()
+				if err := <-epochDone; err != nil {
+					t.Errorf("controller epoch manager shutdown: %v", err)
+				}
+			})
+			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			defer cancel()
+			fence, err := epochs.CurrentFence(ctx)
+			if err != nil {
+				t.Fatal(err)
+			}
+			reconciler := &TaskReconciler{
+				Client: kubeClient, Scheme: scheme, DurableControlStore: controlStore,
+				ControllerEpochManager: epochs, ACPRuntimeEnabled: true, ACPRuntimeNamespace: "orka-runtimes",
+				ACPRuntimeImages: ACPRuntimeImages{Codex: oldImage},
+			}
+			bound := bindACPQueueTaskForTest(t, ctx, reconciler, task, agent)
+			if _, err := reconciler.queueACPRuntimeTask(ctx, bound, agent); err != nil {
+				t.Fatalf("initial queue: %v", err)
+			}
+
+			reserved := &corev1alpha1.Task{}
+			if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, reserved); err != nil {
+				t.Fatal(err)
+			}
+			attemptID, err := promptAttemptIDFromTask(reserved)
+			if err != nil {
+				t.Fatal(err)
+			}
+			attempt, err := controlStore.GetPromptAttempt(ctx, attemptID)
+			if err != nil {
+				t.Fatal(err)
+			}
+			attempt = transitionPromptAttemptForImageRotationTest(
+				t, ctx, controlStore, fence, attempt, store.PromptExecutionReserved, "recover-reserved-before-image-rotation",
+			)
+			base := reserved.DeepCopy()
+			reserved.Status.Execution.State = corev1alpha1.TaskExecutionStateReserved
+			reserved.Status.Execution.ControllerEpoch = fence.Epoch
+			reserved.Status.Execution.Reason = acpControllerRestartRecoveredReason
+			reserved.Status.Execution.Message = acpControllerRestartRecoveredMessage
+			reserved.Status.Execution.LastTransitionTime = nowMeta()
+			if err := kubeClient.Status().Patch(ctx, reserved, client.MergeFrom(base)); err != nil {
+				t.Fatal(err)
+			}
+			if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, reserved); err != nil {
+				t.Fatal(err)
+			}
+			beforeExecution := reserved.Status.Execution.DeepCopy()
+			beforeAttempt := *attempt
+
+			oldPool := &corev1alpha1.RuntimePool{}
+			if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: oldPlan.PoolName}, oldPool); err != nil {
+				t.Fatal(err)
+			}
+			oldPool.Status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDegraded
+			oldPool.Status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+			if tc.activeReservation {
+				oldPool.Status.Capacity.Reservations = []corev1alpha1.RuntimePoolCapacityReservationStatus{{
+					PoolUID: string(oldPool.UID), TaskUID: string(task.UID), Attempt: beforeExecution.Attempt,
+					ControllerEpoch: fence.Epoch, RuntimeInstanceID: "old-pool-instance",
+					ResidentSlots: 1, PromptSlots: 1, ReservedAt: metav1.Now(),
+					ExpiresAt: metav1.NewTime(time.Now().UTC().Add(time.Minute)),
+				}}
+				updateRuntimePoolReservationCounters(&oldPool.Status.Capacity)
+			}
+			if err := kubeClient.Status().Update(ctx, oldPool); err != nil {
+				t.Fatal(err)
+			}
+
+			reconciler.ACPRuntimeImages = ACPRuntimeImages{Codex: newImage}
+			if _, err := reconciler.queueACPRuntimeTask(ctx, reserved.DeepCopy(), agent); err != nil {
+				t.Fatalf("queue after image rotation: %v", err)
+			}
+			current := &corev1alpha1.Task{}
+			if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, current); err != nil {
+				t.Fatal(err)
+			}
+			if current.Status.Execution == nil || current.Status.Execution.State != corev1alpha1.TaskExecutionStateReserved {
+				t.Fatalf("reserved execution status = %#v", current.Status.Execution)
+			}
+			if tc.wantRebound {
+				if current.Status.Execution.RuntimePoolName != newPlan.PoolName || current.Status.Execution.RuntimePoolUID != string(newPoolFixture.UID) {
+					t.Fatalf("reserved attempt was not rebound to replacement pool: %#v", current.Status.Execution)
+				}
+				wantExecution := beforeExecution.DeepCopy()
+				wantExecution.RuntimePoolName = newPlan.PoolName
+				wantExecution.RuntimePoolUID = string(newPoolFixture.UID)
+				wantExecution.Reason = ""
+				wantExecution.Message = ""
+				wantExecution.LastTransitionTime = current.Status.Execution.LastTransitionTime
+				if !reflect.DeepEqual(current.Status.Execution, wantExecution) {
+					t.Fatalf("reserved rebind changed frozen attempt fields:\n got: %#v\nwant: %#v", current.Status.Execution, wantExecution)
+				}
+				if current.Labels[acpRuntimeTaskPoolLabel] != newPlan.PoolName {
+					t.Fatalf("pool label = %q, want %q", current.Labels[acpRuntimeTaskPoolLabel], newPlan.PoolName)
+				}
+			} else if current.Status.Execution.RuntimePoolName != beforeExecution.RuntimePoolName ||
+				current.Status.Execution.RuntimePoolUID != beforeExecution.RuntimePoolUID {
+				t.Fatalf("active old-pool reservation was rebound: before=%#v after=%#v", beforeExecution, current.Status.Execution)
+			}
+			persisted, err := controlStore.GetPromptAttempt(ctx, attemptID)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if tc.wantRebound {
+				wantOperationID := store.CanonicalControlID(
+					"rebind-reserved-runtime-pool", beforeAttempt.ID, beforeExecution.RuntimePoolUID, string(newPoolFixture.UID),
+				)
+				if persisted.ExecutionState != store.PromptExecutionReserved || persisted.Version != beforeAttempt.Version+1 ||
+					persisted.LastOperationID != wantOperationID || persisted.RequestDigest != beforeAttempt.RequestDigest ||
+					persisted.RuntimeInstanceID != "" || persisted.SessionUID != "" || persisted.SessionLeaseGeneration != 0 {
+					t.Fatalf("reserved rebind did not durably fence the old dispatcher: before=%#v after=%#v", beforeAttempt, persisted)
+				}
+			} else if !reflect.DeepEqual(persisted, &beforeAttempt) {
+				t.Fatalf("blocked reserved rebind mutated durable attempt: before=%#v after=%#v", beforeAttempt, persisted)
+			}
+		})
+	}
+}
+
+func TestRebindPreSubmissionACPRuntimeTaskRejectsPostSubmissionStates(t *testing.T) {
+	pool := &corev1alpha1.RuntimePool{ObjectMeta: metav1.ObjectMeta{Name: "replacement", Namespace: "default", UID: "replacement-uid"}}
+	for _, state := range []corev1alpha1.TaskExecutionState{
+		corev1alpha1.TaskExecutionStateSubmitting,
+		corev1alpha1.TaskExecutionStateAccepted,
+		corev1alpha1.TaskExecutionStateRunning,
+	} {
+		t.Run(string(state), func(t *testing.T) {
+			task := &corev1alpha1.Task{
+				ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "post-submission", UID: "task-uid"},
+				Status: corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{
+					State: state, Attempt: 1, PromptID: "prompt-1",
+					RequestDigest:   "sha256:" + strings.Repeat("a", 64),
+					RuntimePoolName: "old", RuntimePoolUID: "old-uid",
+				}},
+			}
+			rebound, err := (&TaskReconciler{}).rebindQueuedACPRuntimeTask(
+				context.Background(), task, nil, pool,
+			)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if rebound {
+				t.Fatalf("post-submission state %s was rebound", state)
+			}
+		})
+	}
+}
diff --git a/internal/controller/acp_runtime_pool_rotation_rebind_test.go b/internal/controller/acp_runtime_pool_rotation_rebind_test.go
new file mode 100644
index 000000000..ae487a276
--- /dev/null
+++ b/internal/controller/acp_runtime_pool_rotation_rebind_test.go
@@ -0,0 +1,324 @@
+package controller
+
+import (
+	"context"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	types "k8s.io/apimachinery/pkg/types"
+	"k8s.io/utils/ptr"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+	"github.com/orka-agents/orka/internal/store/sqlite"
+)
+
+//nolint:gocyclo // The regression verifies frozen binding and no-replay invariants in one durable attempt lifecycle.
+func TestQueueACPRuntimeTaskKeepsFrozenPoolAfterRuntimeImageRotation(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace:  "default",
+			Name:       "image-rotation",
+			UID:        types.UID("4a2b6ec0-6dc9-4d81-8810-a5e93e8ed301"),
+			Generation: 2,
+		},
+		Spec: corev1alpha1.TaskSpec{
+			Type:         corev1alpha1.TaskTypeAgent,
+			Prompt:       "inspect the repository",
+			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				Intent:  corev1alpha1.WorkspaceIntentRead,
+				GitRepo: "https://github.com/orka-agents/orka.git",
+			},
+		},
+	}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace:  "default",
+			Name:       "codex",
+			UID:        types.UID("ca9f870c-14d5-4e69-9577-2dcc6698d509"),
+			Generation: 3,
+		},
+		Spec: corev1alpha1.AgentSpec{
+			Model: &corev1alpha1.ModelConfig{Name: acpTestModel},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeCodex,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+		},
+	}
+	oldImage := "docker.io/example/codex@sha256:" + strings.Repeat("a", 64)
+	newImage := "docker.io/example/codex@sha256:" + strings.Repeat("b", 64)
+	oldPlan, err := PlanACPRuntime(task, agent, ACPRuntimeImages{Codex: oldImage})
+	if err != nil {
+		t.Fatal(err)
+	}
+	newPlan, err := PlanACPRuntime(task, agent, ACPRuntimeImages{Codex: newImage})
+	if err != nil {
+		t.Fatal(err)
+	}
+	oldPoolFixture := runtimePoolForImageRotationTest(
+		task.Namespace, types.UID("4e7811bf-5202-4903-b8a6-54adca168a80"), oldPlan,
+	)
+	newPoolFixture := runtimePoolForImageRotationTest(
+		task.Namespace, types.UID("d6906fa9-f0d6-4633-b8c8-33d392aef7e9"), newPlan,
+	)
+	kubeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithStatusSubresource(&corev1alpha1.Task{}, &corev1alpha1.RuntimePool{}).
+		WithObjects(task, oldPoolFixture, newPoolFixture).
+		Build()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "store.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	controlStore := sqlite.NewStore(db, "test")
+	epochs := NewControllerEpochManager(controlStore, "controller-test")
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	if _, err := epochs.CurrentFence(ctx); err != nil {
+		t.Fatal(err)
+	}
+	defer func() {
+		cancelEpoch()
+		if err := <-epochDone; err != nil {
+			t.Errorf("epoch manager shutdown: %v", err)
+		}
+	}()
+
+	reconciler := &TaskReconciler{
+		Client: kubeClient, Scheme: scheme, DurableControlStore: controlStore,
+		ControllerEpochManager: epochs, ACPRuntimeEnabled: true, ACPRuntimeNamespace: "orka-runtimes",
+		ACPRuntimeImages: ACPRuntimeImages{Codex: oldImage},
+	}
+	bound := bindACPQueueTaskForTest(t, ctx, reconciler, task, agent)
+	if _, err := reconciler.queueACPRuntimeTask(ctx, bound, agent); err != nil {
+		t.Fatalf("initial queue: %v", err)
+	}
+
+	queuedBefore := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, queuedBefore); err != nil {
+		t.Fatal(err)
+	}
+	before := queuedBefore.Status.Execution.DeepCopy()
+	attemptID, err := storePromptKey(queuedBefore, before).CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	attemptBefore, err := controlStore.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	oldPool := &corev1alpha1.RuntimePool{}
+	if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: before.RuntimePoolName}, oldPool); err != nil {
+		t.Fatal(err)
+	}
+	oldPool.Status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDegraded
+	oldPool.Status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+	if err := kubeClient.Status().Update(ctx, oldPool); err != nil {
+		t.Fatal(err)
+	}
+
+	reconciler.ACPRuntimeImages = ACPRuntimeImages{Codex: newImage}
+	if _, err := reconciler.queueACPRuntimeTask(ctx, queuedBefore.DeepCopy(), agent); err != nil {
+		t.Fatalf("queue after image rotation: %v", err)
+	}
+
+	queuedAfter := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, queuedAfter); err != nil {
+		t.Fatal(err)
+	}
+	if queuedAfter.Status.Execution == nil {
+		t.Fatal("queued Task lost execution status")
+	}
+	after := queuedAfter.Status.Execution
+	if after.State != corev1alpha1.TaskExecutionStateQueued {
+		t.Fatalf("execution state = %s, want Queued", after.State)
+	}
+	if after.RuntimePoolName != before.RuntimePoolName || after.RuntimePoolUID != before.RuntimePoolUID {
+		t.Fatalf("queued Task escaped its frozen RuntimePool after live image rotation: before=%#v after=%#v", before, after)
+	}
+	if queuedAfter.Labels[acpRuntimeTaskPoolLabel] != after.RuntimePoolName {
+		t.Fatalf("pool label = %q, want %q", queuedAfter.Labels[acpRuntimeTaskPoolLabel], after.RuntimePoolName)
+	}
+	frozenPool := &corev1alpha1.RuntimePool{}
+	if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: after.RuntimePoolName}, frozenPool); err != nil {
+		t.Fatal(err)
+	}
+	if frozenPool.Spec.Runtime.Image != oldImage || string(frozenPool.UID) != after.RuntimePoolUID {
+		t.Fatalf("frozen pool binding = image %q UID %q, status = %#v", frozenPool.Spec.Runtime.Image, frozenPool.UID, after)
+	}
+	if queuedAfter.Status.Attempts != queuedBefore.Status.Attempts || after.Attempt != before.Attempt || after.PromptID != before.PromptID || after.RequestDigest != before.RequestDigest {
+		t.Fatalf("rebind changed durable attempt identity: before=%#v after=%#v attempts=%d/%d", before, after, queuedBefore.Status.Attempts, queuedAfter.Status.Attempts)
+	}
+	attemptAfter, err := controlStore.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if attemptAfter.ExecutionState != store.PromptExecutionQueued || attemptAfter.ID != attemptBefore.ID || attemptAfter.Key != attemptBefore.Key || attemptAfter.RequestDigest != attemptBefore.RequestDigest || attemptAfter.Version != attemptBefore.Version {
+		t.Fatalf("durable attempt changed during pool rebind: before=%#v after=%#v", attemptBefore, attemptAfter)
+	}
+
+	fence, err := epochs.CurrentFence(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	accepted := attemptAfter
+	for _, transition := range []struct {
+		to        store.PromptExecutionState
+		operation string
+	}{
+		{to: store.PromptExecutionReserved, operation: "test-reserve-before-next-rotation"},
+		{to: store.PromptExecutionSessionStarting, operation: "test-start-session-before-next-rotation"},
+		{to: store.PromptExecutionPlanned, operation: "test-plan-before-next-rotation"},
+		{to: store.PromptExecutionSubmitting, operation: "test-submit-before-next-rotation"},
+		{to: store.PromptExecutionAccepted, operation: "test-accept-before-next-rotation"},
+	} {
+		accepted = transitionPromptAttemptForImageRotationTest(t, ctx, controlStore, fence, accepted, transition.to, transition.operation)
+	}
+	thirdImage := "docker.io/example/codex@sha256:" + strings.Repeat("c", 64)
+	thirdPlan, err := PlanACPRuntime(task, agent, ACPRuntimeImages{Codex: thirdImage})
+	if err != nil {
+		t.Fatal(err)
+	}
+	thirdPool := runtimePoolForImageRotationTest(
+		task.Namespace, types.UID("0d53b279-1778-4539-8236-85e2ddc1a765"), thirdPlan,
+	)
+	if err := kubeClient.Create(ctx, thirdPool); err != nil {
+		t.Fatal(err)
+	}
+	reconciler.ACPRuntimeImages = ACPRuntimeImages{Codex: thirdImage}
+	if _, err := reconciler.queueACPRuntimeTask(ctx, queuedAfter.DeepCopy(), agent); err != nil {
+		t.Fatalf("queue after accepted attempt and second image rotation: %v", err)
+	}
+	acceptedTask := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, acceptedTask); err != nil {
+		t.Fatal(err)
+	}
+	if acceptedTask.Status.Execution == nil || acceptedTask.Status.Execution.RuntimePoolName != after.RuntimePoolName ||
+		acceptedTask.Status.Execution.RuntimePoolUID != after.RuntimePoolUID || acceptedTask.Status.Attempts != queuedAfter.Status.Attempts {
+		t.Fatalf("accepted prompt was rebound or replayed after later image rotation: before=%#v after=%#v", after, acceptedTask.Status.Execution)
+	}
+	acceptedAfter, err := controlStore.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if acceptedAfter.ExecutionState != store.PromptExecutionAccepted || acceptedAfter.ID != accepted.ID || acceptedAfter.Key != accepted.Key {
+		t.Fatalf("accepted prompt attempt changed after later image rotation: before=%#v after=%#v", accepted, acceptedAfter)
+	}
+}
+
+func runtimePoolForImageRotationTest(namespace string, uid types.UID, plan ACPRuntimePlan) *corev1alpha1.RuntimePool {
+	return &corev1alpha1.RuntimePool{
+		ObjectMeta: metav1.ObjectMeta{Namespace: namespace, Name: plan.PoolName, UID: uid},
+		Spec: corev1alpha1.RuntimePoolSpec{
+			TrustDomain:      corev1alpha1.RuntimePoolTrustDomain{Namespace: namespace, Identity: "namespace:" + namespace},
+			RuntimeNamespace: "orka-runtimes",
+			Runtime: corev1alpha1.RuntimePoolRuntimeSpec{
+				Image:   plan.Image,
+				Profile: RuntimePoolProfileFromPlan(plan),
+			},
+			DesiredReplicas: 1,
+			Capacity: &corev1alpha1.RuntimePoolCapacitySpec{
+				MaxResidentSessions: corev1alpha1.DefaultRuntimePoolMaxResidentSessions,
+				MaxRunningPrompts:   corev1alpha1.DefaultRuntimePoolMaxRunningPrompts,
+			},
+			ColdStartTimeoutSeconds: corev1alpha1.DefaultRuntimePoolColdStartTimeoutSeconds,
+		},
+	}
+}
+
+func transitionPromptAttemptForImageRotationTest(
+	t *testing.T,
+	ctx context.Context,
+	controlStore store.DurableControlStore,
+	fence store.ControllerEpochFence,
+	attempt *store.PromptAttempt,
+	to store.PromptExecutionState,
+	operation string,
+) *store.PromptAttempt {
+	t.Helper()
+	digest, err := acpDomainDigest("attempt-transition", map[string]any{
+		"id": attempt.ID, "from": attempt.ExecutionState, "to": to,
+		"operation": operation, "version": attempt.Version,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	updated, err := controlStore.TransitionPromptAttemptExecution(ctx, store.PromptAttemptExecutionTransition{
+		ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState, NewState: to,
+		OperationID: operation, OperationDigest: digest, UpdatedAt: time.Now().UTC(),
+	})
+	if err != nil {
+		t.Fatalf("transition prompt attempt to %s: %v", to, err)
+	}
+	return updated
+}
+
+func TestACPDispatcherRejectsStalePoolBindingAfterQueuedRebind(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	const requestDigest = "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+	current := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "default",
+			Name:      "reservation-race",
+			UID:       types.UID("78428d45-9b6f-488a-b29b-b2fbbce69e04"),
+		},
+		Status: corev1alpha1.TaskStatus{
+			Execution: &corev1alpha1.TaskExecutionStatus{
+				State:           corev1alpha1.TaskExecutionStateQueued,
+				Attempt:         1,
+				PromptID:        "prompt-reservation-race-1",
+				RequestDigest:   requestDigest,
+				RuntimePoolName: "replacement-pool",
+				RuntimePoolUID:  "replacement-pool-uid",
+			},
+		},
+	}
+	stale := current.DeepCopy()
+	stale.Status.Execution.RuntimePoolName = "degraded-pool"
+	stale.Status.Execution.RuntimePoolUID = "degraded-pool-uid"
+	degradedPool := &corev1alpha1.RuntimePool{
+		ObjectMeta: metav1.ObjectMeta{Namespace: current.Namespace, Name: "degraded-pool", UID: "degraded-pool-uid"},
+	}
+	replacementPool := &corev1alpha1.RuntimePool{
+		ObjectMeta: metav1.ObjectMeta{Namespace: current.Namespace, Name: "replacement-pool", UID: "replacement-pool-uid"},
+	}
+	kubeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithStatusSubresource(&corev1alpha1.Task{}).
+		WithObjects(current, degradedPool, replacementPool).
+		Build()
+	dispatcher := &ACPDispatcher{Client: kubeClient, APIReader: kubeClient}
+
+	bound, err := dispatcher.refreshTaskRuntimePoolBinding(context.Background(), stale, degradedPool)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if bound {
+		t.Fatal("stale degraded pool binding remained eligible after queued Task rebind")
+	}
+	bound, err = dispatcher.refreshTaskRuntimePoolBinding(context.Background(), stale, replacementPool)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bound || stale.Status.Execution.RuntimePoolName != replacementPool.Name || stale.Status.Execution.RuntimePoolUID != string(replacementPool.UID) {
+		t.Fatalf("replacement binding was not refreshed: bound=%t status=%#v", bound, stale.Status.Execution)
+	}
+}
diff --git a/internal/controller/acp_runtime_profile.go b/internal/controller/acp_runtime_profile.go
new file mode 100644
index 000000000..d0074b522
--- /dev/null
+++ b/internal/controller/acp_runtime_profile.go
@@ -0,0 +1,325 @@
+package controller
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"maps"
+	"slices"
+	"sort"
+	"strings"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/acp"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/labels"
+)
+
+type ACPRuntimeImages struct {
+	Codex    string
+	Claude   string
+	Copilot  string
+	Opencode string
+}
+
+type ACPRuntimePlan struct {
+	PoolName string
+	Image    string
+	Profile  harnessv2.RuntimeProfile
+	Digest   harnessv2.ProfileDigest
+}
+
+// validateACPRuntimePlanningAgent gates ACP planning on a complete built-in
+// runtime with an explicit orka.harness.v2 classification and a valid v2
+// OpenCode shape. A missing selector is never protocol evidence.
+func validateACPRuntimePlanningAgent(task *corev1alpha1.Task, agent *corev1alpha1.Agent) error {
+	if task == nil || agent == nil || agent.Spec.Runtime == nil || agent.Spec.Runtime.Type == "" {
+		return fmt.Errorf("built-in agent runtime is required")
+	}
+	if agent.BuiltInContractVersion() != corev1alpha1.AgentRuntimeContractHarnessV2 {
+		return fmt.Errorf("ACP runtime planning requires an Agent explicitly classified %s; a missing runtime.contractVersion selector is never protocol evidence", corev1alpha1.AgentRuntimeContractHarnessV2)
+	}
+	return ValidateOpenCodeAgentSpec(agent)
+}
+
+func PlanACPRuntimeWithConfiguration(
+	task *corev1alpha1.Task,
+	agent *corev1alpha1.Agent,
+	images ACPRuntimeImages,
+	configuration harnessv2.AgentSessionConfiguration,
+) (ACPRuntimePlan, error) {
+	if err := validateACPRuntimePlanningAgent(task, agent); err != nil {
+		return ACPRuntimePlan{}, err
+	}
+	provider := string(agent.Spec.Runtime.Type)
+	model := ""
+	if agent.Spec.Model != nil {
+		model = strings.TrimSpace(agent.Spec.Model.Name)
+	}
+	if model == "" {
+		return ACPRuntimePlan{}, fmt.Errorf("ACP runtime requires an explicit model")
+	}
+	if err := configuration.Validate(); err != nil {
+		return ACPRuntimePlan{}, fmt.Errorf("ACP Agent session configuration: %w", err)
+	}
+	if configuration.ProviderKind != provider || configuration.Model != model ||
+		configuration.MaxTurns != effectiveACPMaxTurns(task, agent) ||
+		configuration.ReasoningEffort != effectiveACPReasoningEffort(agent) ||
+		configuration.AgentUID != string(agent.UID) || configuration.AgentGeneration != agent.Generation {
+		return ACPRuntimePlan{}, fmt.Errorf("resolved ACP Agent session configuration does not match Task and Agent")
+	}
+	intent := effectiveACPWorkspaceIntent(task)
+	adapterDigests, image, err := acpRuntimeArtifacts(agent.Spec.Runtime.Type, images)
+	if err != nil {
+		return ACPRuntimePlan{}, err
+	}
+	if !ACPRuntimeImageAvailable(image) {
+		return ACPRuntimePlan{}, fmt.Errorf("ACP runtime image for %s must be a configured digest-pinned image", provider)
+	}
+	allowed := effectiveACPAllowedTools(task, agent)
+	disallowed := []string(nil)
+	if task.Spec.AgentRuntime != nil {
+		disallowed = sortedUnique(task.Spec.AgentRuntime.DisallowedTools)
+	}
+	allowBash := effectiveACPAllowBash(task, agent)
+	allowed, disallowed, allowBash = normalizeACPRuntimeToolPolicy(provider, intent, allowed, disallowed, allowBash)
+	if err := validateACPProviderNativePolicy(provider, intent, allowed, disallowed, allowBash); err != nil {
+		return ACPRuntimePlan{}, err
+	}
+	if err := validateACPProviderSystemPrompt(provider, configuration); err != nil {
+		return ACPRuntimePlan{}, err
+	}
+	for _, name := range allowed {
+		if _, localOnly := controllerLocalOnlyTools[name]; localOnly {
+			return ACPRuntimePlan{}, fmt.Errorf("built-in tool %q is local-process-only and cannot be exposed through the controller MCP broker", name)
+		}
+	}
+	var modelLimits *harnessv2.ModelTokenLimits
+	if agent.Spec.Runtime.Type == corev1alpha1.AgentRuntimeOpencode {
+		modelLimits = &harnessv2.ModelTokenLimits{
+			Context: int64(*agent.Spec.Model.ContextWindow),
+			Output:  int64(*agent.Spec.Model.MaxTokens),
+		}
+	}
+	agentDigest, err := harnessv2.CanonicalAgentConfigurationDigest(configuration)
+	if err != nil {
+		return ACPRuntimePlan{}, err
+	}
+	toolDigest, err := harnessv2.CanonicalRuntimeToolPolicyDigest(allowed, disallowed, allowBash)
+	if err != nil {
+		return ACPRuntimePlan{}, err
+	}
+	approvalTools := []string(nil)
+	if agent.Spec.Coordination != nil {
+		approvalTools = sortedUnique(agent.Spec.Coordination.ApprovalRequiredTools)
+	}
+	approvalDigest, err := harnessv2.CanonicalMCPApprovalPolicyDigest(harnessv2.MCPApprovalPolicy{RequiredTools: approvalTools})
+	if err != nil {
+		return ACPRuntimePlan{}, err
+	}
+	mcpDigest, err := harnessv2.CanonicalMCPConfigurationDigest(allowed)
+	if err != nil {
+		return ACPRuntimePlan{}, err
+	}
+	profile := harnessv2.RuntimeProfile{
+		ACPProfile: harnessv2.ACPProfileV1, AdapterDigests: adapterDigests, ProviderKind: provider, Model: model,
+		ModelLimits: modelLimits, AgentConfigurationDigest: agentDigest, ToolPolicyDigest: toolDigest, ApprovalPolicyDigest: approvalDigest,
+		MCPConfigurationDigest: mcpDigest, WorkspaceIntent: harnessv2.WorkspaceIntent(intent),
+		ProxyCredentialRole: "provider-inference", ProxyCredentialScope: "model:" + model, ResourceClass: "standard",
+	}
+	digest, err := harnessv2.CanonicalProfileDigest(profile)
+	if err != nil {
+		return ACPRuntimePlan{}, err
+	}
+	poolIdentityDigest, err := acpDomainDigest("runtime-pool-identity", map[string]string{
+		"profileDigest": string(digest), "runtimeImage": image,
+	})
+	if err != nil {
+		return ACPRuntimePlan{}, err
+	}
+	return ACPRuntimePlan{
+		PoolName: acpRuntimePoolName(provider, harnessv2.ProfileDigest(poolIdentityDigest)),
+		Image:    image, Profile: profile, Digest: digest,
+	}, nil
+}
+
+func RuntimePoolProfileFromPlan(plan ACPRuntimePlan) corev1alpha1.RuntimePoolProfileSpec {
+	var modelLimits *corev1alpha1.ModelTokenLimits
+	if plan.Profile.ModelLimits != nil {
+		modelLimits = &corev1alpha1.ModelTokenLimits{
+			Context: plan.Profile.ModelLimits.Context,
+			Output:  plan.Profile.ModelLimits.Output,
+		}
+	}
+	return corev1alpha1.RuntimePoolProfileSpec{
+		ProtocolVersion: corev1alpha1.RuntimePoolProtocolHarnessV2,
+		Digest:          string(plan.Digest), DigestSchemaVersion: fmt.Sprintf("%d", harnessv2.ProfileDigestSchemaVersion),
+		ACPProfile: plan.Profile.ACPProfile, AdapterDigests: cloneMap(plan.Profile.AdapterDigests),
+		ProviderKind: plan.Profile.ProviderKind, Model: plan.Profile.Model, ModelLimits: modelLimits,
+		AgentConfigurationDigest: plan.Profile.AgentConfigurationDigest, ToolPolicyDigest: plan.Profile.ToolPolicyDigest,
+		ApprovalPolicyDigest: plan.Profile.ApprovalPolicyDigest, MCPConfigurationDigest: plan.Profile.MCPConfigurationDigest,
+		WorkspaceIntent:     corev1alpha1.WorkspaceIntent(plan.Profile.WorkspaceIntent),
+		ProxyCredentialRole: plan.Profile.ProxyCredentialRole, ProxyCredentialScope: plan.Profile.ProxyCredentialScope,
+		ResourceClass: plan.Profile.ResourceClass,
+	}
+}
+
+func acpRuntimePoolBindingMatches(status *corev1alpha1.TaskExecutionStatus, pool *corev1alpha1.RuntimePool) bool {
+	return status != nil && pool != nil && pool.UID != "" &&
+		strings.TrimSpace(status.RuntimePoolName) == pool.Name &&
+		strings.TrimSpace(status.RuntimePoolUID) == string(pool.UID)
+}
+
+func effectiveACPWorkspaceIntent(task *corev1alpha1.Task) corev1alpha1.WorkspaceIntent {
+	if task == nil {
+		return corev1alpha1.WorkspaceIntentRead
+	}
+	workspace := task.Spec.Workspace
+	if workspace != nil && workspace.Intent != "" {
+		return workspace.Intent
+	}
+	return corev1alpha1.WorkspaceIntentRead
+}
+
+func effectiveACPAllowedTools(task *corev1alpha1.Task, agent *corev1alpha1.Agent) []string {
+	var values []string
+	if agent != nil && agent.Spec.Runtime != nil {
+		runtime := agent.Spec.Runtime
+		if runtime.Type == corev1alpha1.AgentRuntimeOpencode && runtime.DefaultAllowedTools == nil {
+			values = acp.OpenCodeDefaultAllowedTools()
+		} else if runtime.DefaultAllowedTools != nil {
+			values = append([]string{}, runtime.DefaultAllowedTools...)
+		}
+	}
+	if task != nil && task.Spec.AgentRuntime != nil && task.Spec.AgentRuntime.AllowedTools != nil {
+		values = append([]string{}, task.Spec.AgentRuntime.AllowedTools...)
+	}
+	if taskRequestsReadOnlyAgent(task) && taskUsesReadOnlyAgentToolPreset(task) &&
+		agent != nil && agent.Spec.Runtime != nil {
+		// Repository-monitor presets use Claude-style path-scoped names, which
+		// are not canonical provider-native descriptors, so translate the
+		// preset into the exact read-only surface each runtime can enforce.
+		switch agent.Spec.Runtime.Type {
+		case corev1alpha1.AgentRuntimeOpencode:
+			// OpenCode's Grep permission cannot carry the path-specific
+			// secret-file exclusions applied to Read, so it stays disabled.
+			values = []string{providerNativeToolRead, providerNativeToolGlob}
+		case corev1alpha1.AgentRuntimeClaude:
+			values = []string{providerNativeToolGlob, providerNativeToolGrep, providerNativeToolRead}
+		case corev1alpha1.AgentRuntimeCodex:
+			// Codex has no per-tool switches; this exact surface is enforced
+			// by the RuntimeSession boundary: elevation requests are rejected,
+			// file writes are supervisor-mediated, and the read-intent
+			// workspace delta classification fails any modifying turn.
+			values = []string{providerNativeToolGlob, providerNativeToolGrep, providerNativeToolRead}
+		}
+	}
+	if task != nil {
+		_, delegatedChild := task.Labels[labels.LabelParentTask]
+		disableCoordinationToolInjection := task.Annotations[labels.AnnotationDisableCoordinationToolInject] == scheduledRunLabelValue
+		if delegatedChild && !disableCoordinationToolInjection {
+			values = append(values, "send_message", "check_messages")
+		}
+	}
+	return sortedUnique(values)
+}
+
+func taskUsesReadOnlyAgentToolPreset(task *corev1alpha1.Task) bool {
+	return task != nil && task.Spec.AgentRuntime != nil && task.Spec.AgentRuntime.AllowedTools != nil &&
+		slices.Equal(sortedUnique(task.Spec.AgentRuntime.AllowedTools), sortedUnique(readOnlyAgentAllowedTools()))
+}
+
+func normalizeACPRuntimeToolPolicy(
+	provider string,
+	intent corev1alpha1.WorkspaceIntent,
+	allowed, disallowed []string,
+	allowBash bool,
+) ([]string, []string, bool) {
+	allowed, disallowed, allowBash = normalizeACPProviderNativeToolPolicy(provider, allowed, disallowed, allowBash)
+	if !strings.EqualFold(provider, string(corev1alpha1.AgentRuntimeOpencode)) {
+		return allowed, disallowed, allowBash
+	}
+	return acp.NormalizeOpenCodeToolPolicy(intent == corev1alpha1.WorkspaceIntentRead, allowed, disallowed, allowBash)
+}
+
+func effectiveACPMaxTurns(task *corev1alpha1.Task, agent *corev1alpha1.Agent) int32 {
+	if task != nil && task.Spec.AgentRuntime != nil && task.Spec.AgentRuntime.MaxTurns != nil {
+		return *task.Spec.AgentRuntime.MaxTurns
+	}
+	if agent != nil && agent.Spec.Runtime != nil && agent.Spec.Runtime.DefaultMaxTurns != nil {
+		return *agent.Spec.Runtime.DefaultMaxTurns
+	}
+	return 50
+}
+
+func acpRuntimeArtifacts(runtime corev1alpha1.AgentRuntimeType, images ACPRuntimeImages) (map[string]string, string, error) {
+	digests := acp.BuiltInRuntimeAdapterDigests(string(runtime))
+	if digests == nil {
+		return nil, "", fmt.Errorf("runtime %q is not supported by the ACP core pool", runtime)
+	}
+	var image string
+	switch runtime {
+	case corev1alpha1.AgentRuntimeCodex:
+		image = images.Codex
+	case corev1alpha1.AgentRuntimeClaude:
+		image = images.Claude
+	case corev1alpha1.AgentRuntimeCopilot:
+		image = images.Copilot
+	case corev1alpha1.AgentRuntimeOpencode:
+		image = images.Opencode
+	}
+	return digests, strings.TrimSpace(image), nil
+}
+
+// ACPRuntimeImageAvailable reports whether a built-in runtime image is an
+// immutable, non-placeholder reference suitable for task admission and chat.
+func ACPRuntimeImageAvailable(image string) bool {
+	image = strings.TrimSpace(image)
+	if !digestPinnedImagePattern.MatchString(image) {
+		return false
+	}
+	return !strings.HasSuffix(image, "@sha256:"+strings.Repeat("0", 64))
+}
+
+func acpDomainDigest(domain string, value any) (string, error) {
+	canonical, err := harnessv2.CanonicalValue(value)
+	if err != nil {
+		return "", err
+	}
+	hash := sha256.New()
+	_, _ = hash.Write([]byte("orka.acp." + domain + "\x00"))
+	_, _ = hash.Write(canonical)
+	return "sha256:" + hex.EncodeToString(hash.Sum(nil)), nil
+}
+
+func acpRuntimePoolName(provider string, digest harnessv2.ProfileDigest) string {
+	hexDigest := strings.TrimPrefix(string(digest), "sha256:")
+	return fmt.Sprintf("acp-%s-%s", provider, hexDigest[:16])
+}
+
+func sortedUnique(values []string) []string {
+	if values == nil {
+		return nil
+	}
+	seen := make(map[string]struct{}, len(values))
+	result := make([]string, 0, len(values))
+	for _, value := range values {
+		value = strings.TrimSpace(value)
+		if value == "" {
+			continue
+		}
+		if _, ok := seen[value]; ok {
+			continue
+		}
+		seen[value] = struct{}{}
+		result = append(result, value)
+	}
+	sort.Strings(result)
+	return result
+}
+
+func cloneMap(input map[string]string) map[string]string {
+	result := make(map[string]string, len(input))
+	maps.Copy(result, input)
+	return result
+}
diff --git a/internal/controller/acp_runtime_profile_helpers_test.go b/internal/controller/acp_runtime_profile_helpers_test.go
new file mode 100644
index 000000000..2c237d73e
--- /dev/null
+++ b/internal/controller/acp_runtime_profile_helpers_test.go
@@ -0,0 +1,28 @@
+package controller
+
+import (
+	"fmt"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+)
+
+// PlanACPRuntime is a test-only convenience wrapper: production planning goes
+// through PlanACPRuntimeWithConfiguration with a resolved session
+// configuration, which this helper builds from the Agent's inline systemPrompt.
+func PlanACPRuntime(task *corev1alpha1.Task, agent *corev1alpha1.Agent, images ACPRuntimeImages) (ACPRuntimePlan, error) {
+	if err := ValidateOpenCodeAgentSpec(agent); err != nil {
+		return ACPRuntimePlan{}, err
+	}
+	if agent != nil && agent.Spec.SystemPrompt != nil && agent.Spec.SystemPrompt.ConfigMapRef != nil {
+		return ACPRuntimePlan{}, fmt.Errorf("PlanACPRuntime requires a resolved ConfigMap-backed Agent systemPrompt")
+	}
+	systemPrompt := ""
+	if agent != nil && agent.Spec.SystemPrompt != nil {
+		systemPrompt = agent.Spec.SystemPrompt.Inline
+	}
+	configuration, err := buildACPAgentSessionConfiguration(task, agent, systemPrompt)
+	if err != nil {
+		return ACPRuntimePlan{}, err
+	}
+	return PlanACPRuntimeWithConfiguration(task, agent, images, configuration)
+}
diff --git a/internal/controller/acp_runtime_profile_test.go b/internal/controller/acp_runtime_profile_test.go
new file mode 100644
index 000000000..9e3fd6c38
--- /dev/null
+++ b/internal/controller/acp_runtime_profile_test.go
@@ -0,0 +1,563 @@
+package controller
+
+import (
+	"reflect"
+	"slices"
+	"strconv"
+	"strings"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	"k8s.io/utils/ptr"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/acp"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/labels"
+)
+
+func TestEffectiveACPAllowedToolsPreservesDelegatedChildMessagingInjection(t *testing.T) {
+	agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+		DefaultAllowedTools: []string{providerNativeToolRead},
+	}}}
+	tests := []struct {
+		name string
+		task *corev1alpha1.Task
+		want []string
+	}{
+		{
+			name: "delegated child",
+			task: &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{
+				Labels: map[string]string{labels.LabelParentTask: "parent"},
+			}},
+			want: []string{providerNativeToolRead, "check_messages", "send_message"},
+		},
+		{
+			name: "task override remains authoritative before child injection",
+			task: &corev1alpha1.Task{
+				ObjectMeta: metav1.ObjectMeta{Labels: map[string]string{labels.LabelParentTask: "parent"}},
+				Spec: corev1alpha1.TaskSpec{AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
+					AllowedTools: []string{providerNativeToolWrite},
+				}},
+			},
+			want: []string{providerNativeToolWrite, "check_messages", "send_message"},
+		},
+		{
+			name: "explicitly disabled child injection",
+			task: &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{
+				Labels:      map[string]string{labels.LabelParentTask: "parent"},
+				Annotations: map[string]string{labels.AnnotationDisableCoordinationToolInject: scheduledRunLabelValue},
+			}},
+			want: []string{providerNativeToolRead},
+		},
+		{
+			name: "non-child",
+			task: &corev1alpha1.Task{},
+			want: []string{providerNativeToolRead},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if got := effectiveACPAllowedTools(test.task, agent); !slices.Equal(got, test.want) {
+				t.Fatalf("effectiveACPAllowedTools() = %v, want %v", got, test.want)
+			}
+		})
+	}
+}
+
+func TestEffectiveACPAllowedToolsPreservesOpenCodeExplicitEmptyChildPolicy(t *testing.T) {
+	agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+		Type: corev1alpha1.AgentRuntimeOpencode,
+	}}}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Labels: map[string]string{labels.LabelParentTask: "parent"}},
+		Spec:       corev1alpha1.TaskSpec{AgentRuntime: &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{}}},
+	}
+	if got, want := effectiveACPAllowedTools(task, agent), []string{"check_messages", "send_message"}; !slices.Equal(got, want) {
+		t.Fatalf("delegated OpenCode child tools = %#v, want %#v", got, want)
+	}
+
+	task.Annotations = map[string]string{labels.AnnotationDisableCoordinationToolInject: scheduledRunLabelValue}
+	got := effectiveACPAllowedTools(task, agent)
+	if got == nil || len(got) != 0 {
+		t.Fatalf("disabled delegated OpenCode child tools = %#v, want explicit empty", got)
+	}
+}
+
+func TestPlanACPRuntimeHashesNormalizedDenyOnlyProviderNativePolicy(t *testing.T) {
+	tests := []struct {
+		name           string
+		provider       corev1alpha1.AgentRuntimeType
+		images         ACPRuntimeImages
+		disallowed     []string
+		wantAllowed    []string
+		wantDisallowed []string
+	}{
+		{
+			name: "claude", provider: corev1alpha1.AgentRuntimeClaude,
+			images:         ACPRuntimeImages{Claude: "docker.io/example/claude@sha256:" + strings.Repeat("a", 64)},
+			disallowed:     []string{"write"},
+			wantAllowed:    []string{providerNativeToolBash, providerNativeToolEdit, providerNativeToolGlob, providerNativeToolGrep, providerNativeToolRead, providerNativeToolWebFetch, providerNativeToolWebSearch},
+			wantDisallowed: []string{"write"},
+		},
+		{
+			name: "copilot", provider: corev1alpha1.AgentRuntimeCopilot,
+			images:         ACPRuntimeImages{Copilot: "docker.io/example/copilot@sha256:" + strings.Repeat("b", 64)},
+			disallowed:     []string{"write", providerNativeToolWebSearch},
+			wantAllowed:    []string{providerNativeToolBash, providerNativeToolEdit, providerNativeToolGlob, providerNativeToolGrep, providerNativeToolRead, providerNativeToolWebFetch},
+			wantDisallowed: []string{providerNativeToolWebSearch, "write"},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{
+				Type: corev1alpha1.TaskTypeAgent,
+				AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
+					DisallowedTools: test.disallowed,
+				},
+			}}
+			agent := &corev1alpha1.Agent{
+				ObjectMeta: metav1.ObjectMeta{UID: types.UID("agent-uid"), Generation: 1},
+				Spec: corev1alpha1.AgentSpec{
+					Model: &corev1alpha1.ModelConfig{Name: acpTestModel},
+					Runtime: &corev1alpha1.AgentCLIRuntime{
+						Type:            test.provider,
+						ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+					},
+				},
+			}
+			plan, err := PlanACPRuntime(task, agent, test.images)
+			if err != nil {
+				t.Fatal(err)
+			}
+			wantToolDigest, err := harnessv2.CanonicalRuntimeToolPolicyDigest(test.wantAllowed, test.wantDisallowed, true)
+			if err != nil {
+				t.Fatal(err)
+			}
+			wantMCPDigest, err := harnessv2.CanonicalMCPConfigurationDigest(test.wantAllowed)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if plan.Profile.ToolPolicyDigest != wantToolDigest {
+				t.Fatalf("tool policy digest = %q, want %q", plan.Profile.ToolPolicyDigest, wantToolDigest)
+			}
+			if plan.Profile.MCPConfigurationDigest != wantMCPDigest {
+				t.Fatalf("MCP configuration digest = %q, want %q", plan.Profile.MCPConfigurationDigest, wantMCPDigest)
+			}
+			allowed, disallowed, allowBash := normalizeACPProviderNativeToolPolicy(
+				string(test.provider), nil, test.wantDisallowed, true,
+			)
+			if !slices.Equal(allowed, test.wantAllowed) || !slices.Equal(disallowed, test.wantDisallowed) || !allowBash {
+				t.Fatalf("normalized policy = allowed=%v disallowed=%v allowBash=%t", allowed, disallowed, allowBash)
+			}
+		})
+	}
+}
+
+func TestPlanACPRuntimeTreatsExplicitEmptyDisallowedAsUnrestricted(t *testing.T) {
+	for _, tt := range []struct {
+		name    string
+		runtime corev1alpha1.AgentRuntimeType
+		images  ACPRuntimeImages
+	}{
+		{name: "codex", runtime: corev1alpha1.AgentRuntimeCodex, images: ACPRuntimeImages{Codex: "docker.io/example/codex@sha256:" + strings.Repeat("a", 64)}},
+		{name: "claude", runtime: corev1alpha1.AgentRuntimeClaude, images: ACPRuntimeImages{Claude: "docker.io/example/claude@sha256:" + strings.Repeat("b", 64)}},
+		{name: "copilot", runtime: corev1alpha1.AgentRuntimeCopilot, images: ACPRuntimeImages{Copilot: "docker.io/example/copilot@sha256:" + strings.Repeat("c", 64)}},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{
+				Type:         corev1alpha1.TaskTypeAgent,
+				AgentRuntime: &corev1alpha1.AgentRuntimeSpec{DisallowedTools: []string{}},
+			}}
+			agent := &corev1alpha1.Agent{
+				ObjectMeta: metav1.ObjectMeta{UID: types.UID("agent-uid"), Generation: 1},
+				Spec: corev1alpha1.AgentSpec{Model: &corev1alpha1.ModelConfig{Name: acpTestModel}, Runtime: &corev1alpha1.AgentCLIRuntime{
+					Type:            tt.runtime,
+					ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+				}},
+			}
+			if _, err := PlanACPRuntime(task, agent, tt.images); err != nil {
+				t.Fatalf("PlanACPRuntime() rejected explicit deny-none policy: %v", err)
+			}
+		})
+	}
+}
+
+func TestPlanACPRuntimeRejectsCodexExplicitEmptyProviderNativePolicy(t *testing.T) {
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{
+		Type: corev1alpha1.TaskTypeAgent,
+		AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
+			AllowedTools: []string{},
+		},
+	}}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{UID: types.UID("agent-uid"), Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model: &corev1alpha1.ModelConfig{Name: acpTestModel},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeCodex,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+		},
+	}
+	_, err := PlanACPRuntime(
+		task, agent,
+		ACPRuntimeImages{Codex: "docker.io/example/codex@sha256:" + strings.Repeat("c", 64)},
+	)
+	if err == nil || !strings.Contains(err.Error(), "cannot exactly enforce") {
+		t.Fatalf("Codex explicit-empty policy error = %v, want fail-closed rejection", err)
+	}
+}
+
+func TestPlanACPRuntimeRejectsCodexDenyOnlyProviderNativePolicy(t *testing.T) {
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{
+		Type: corev1alpha1.TaskTypeAgent,
+		AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
+			DisallowedTools: []string{providerNativeToolWrite},
+		},
+	}}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{UID: types.UID("agent-uid"), Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model: &corev1alpha1.ModelConfig{Name: acpTestModel},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeCodex,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+		},
+	}
+	_, err := PlanACPRuntime(
+		task, agent,
+		ACPRuntimeImages{Codex: "docker.io/example/codex@sha256:" + strings.Repeat("c", 64)},
+	)
+	if err == nil || !strings.Contains(err.Error(), "cannot exactly enforce") {
+		t.Fatalf("Codex deny-only policy error = %v, want fail-closed rejection", err)
+	}
+}
+
+func TestPlanACPRuntimeRejectsCopilotDenyOnlyPolicyThatRetainsWebSearch(t *testing.T) {
+	allowBash := false
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{
+		Type: corev1alpha1.TaskTypeAgent,
+		AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
+			DisallowedTools: []string{providerNativeToolWrite}, AllowBash: &allowBash,
+		},
+	}}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{UID: types.UID("agent-uid"), Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model: &corev1alpha1.ModelConfig{Name: acpTestModel},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeCopilot,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+		},
+	}
+	_, err := PlanACPRuntime(
+		task, agent,
+		ACPRuntimeImages{Copilot: "docker.io/example/copilot@sha256:" + strings.Repeat("d", 64)},
+	)
+	if err == nil || !strings.Contains(err.Error(), providerNativeToolWebSearch) {
+		t.Fatalf("Copilot deny-only WebSearch error = %v, want fail-closed rejection", err)
+	}
+}
+
+func TestPlanACPRuntimeDeterministicAndIntentScoped(t *testing.T) {
+	maxTurns := int32(20)
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{UID: types.UID("agent-uid"), Generation: 3},
+		Spec: corev1alpha1.AgentSpec{
+			Model: &corev1alpha1.ModelConfig{Name: acpTestModel},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type: corev1alpha1.AgentRuntimeCodex, DefaultMaxTurns: &maxTurns, DefaultReasoningEffort: "high",
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+		},
+	}
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{
+		Type: corev1alpha1.TaskTypeAgent, Workspace: &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentRead},
+	}}
+	images := ACPRuntimeImages{Codex: "docker.io/example/codex@sha256:" + strings.Repeat("a", 64)}
+	first, err := PlanACPRuntime(task, agent, images)
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := PlanACPRuntime(task, agent, images)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if first.Digest != second.Digest || first.PoolName != second.PoolName {
+		t.Fatalf("runtime plan is not deterministic: %#v %#v", first, second)
+	}
+	if first.Profile.WorkspaceIntent != "read" || first.Profile.AdapterDigests["codex-acp"] != "sha256:"+acp.CodexACPTarSHA256 ||
+		first.Profile.AdapterDigests["codex-acp-orka-patch"] != "sha256:"+acp.CodexACPOrkaPatchSHA256 ||
+		first.Profile.AdapterDigests["codex-acp-orka-dist"] != "sha256:"+acp.CodexACPOrkaDistSHA256 {
+		t.Fatalf("unexpected profile: %#v", first.Profile)
+	}
+	overrideTurns := int32(21)
+	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{MaxTurns: &overrideTurns}
+	overridePlan, err := PlanACPRuntime(task, agent, images)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if overridePlan.Digest == first.Digest {
+		t.Fatal("maxTurns override did not rotate the Agent-configuration-bound runtime profile")
+	}
+	task.Spec.AgentRuntime = nil
+	task.Spec.Workspace.Intent = corev1alpha1.WorkspaceIntentWrite
+	writePlan, err := PlanACPRuntime(task, agent, images)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if writePlan.Digest == first.Digest || writePlan.PoolName == first.PoolName {
+		t.Fatal("workspace intent did not rotate runtime profile")
+	}
+}
+
+func TestPlanACPRuntimeRequiresModelAndPinnedImage(t *testing.T) {
+	agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+		Type:            corev1alpha1.AgentRuntimeCodex,
+		ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+	}}}
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent}}
+	if _, err := PlanACPRuntime(task, agent, ACPRuntimeImages{}); err == nil {
+		t.Fatal("missing model unexpectedly accepted")
+	}
+	agent.Spec.Model = &corev1alpha1.ModelConfig{Name: acpTestModel}
+	if _, err := PlanACPRuntime(task, agent, ACPRuntimeImages{Codex: "docker.io/example/codex:latest"}); err == nil {
+		t.Fatal("mutable image unexpectedly accepted")
+	}
+}
+
+func TestPlanACPRuntimeSelectsCopilotProfileAndPinnedImage(t *testing.T) {
+	image := "docker.io/example/copilot@sha256:" + strings.Repeat("c", 64)
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{UID: types.UID("copilot-agent"), Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model: &corev1alpha1.ModelConfig{Name: "gpt-5"},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeCopilot,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+		},
+	}
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent}}
+
+	plan, err := PlanACPRuntime(task, agent, ACPRuntimeImages{Copilot: image})
+	if err != nil {
+		t.Fatalf("PlanACPRuntime() error = %v", err)
+	}
+	if plan.Image != image {
+		t.Fatalf("image = %q, want %q", plan.Image, image)
+	}
+	if plan.Profile.ProviderKind != string(corev1alpha1.AgentRuntimeCopilot) {
+		t.Fatalf("provider kind = %q, want copilot", plan.Profile.ProviderKind)
+	}
+	if plan.Profile.AdapterDigests["copilot-cli-linux-amd64"] != "sha256:"+acp.CopilotCLILinuxX64SHA256 ||
+		plan.Profile.AdapterDigests["copilot-cli-linux-arm64"] != "sha256:"+acp.CopilotCLILinuxARM64SHA256 {
+		t.Fatalf("unexpected Copilot adapter digests: %#v", plan.Profile.AdapterDigests)
+	}
+
+	if _, err := PlanACPRuntime(task, agent, ACPRuntimeImages{}); err == nil || !strings.Contains(err.Error(), "digest-pinned image") {
+		t.Fatalf("missing Copilot image error = %v, want digest-pinning rejection", err)
+	}
+}
+
+func TestPlanACPRuntimePreservesExplicitEmptyAllowedTools(t *testing.T) {
+	image := "docker.io/example/claude@sha256:" + strings.Repeat("a", 64)
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{UID: types.UID("agent-uid"), Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model: &corev1alpha1.ModelConfig{Name: "claude-test"},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeClaude,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+		},
+	}
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent}}
+	omitted, err := PlanACPRuntime(task, agent, ACPRuntimeImages{Claude: image})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := effectiveACPAllowedTools(task, agent); got != nil {
+		t.Fatalf("omitted allowed tools = %#v, want nil", got)
+	}
+
+	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{}, AllowBash: new(false)}
+	explicitEmpty, err := PlanACPRuntime(task, agent, ACPRuntimeImages{Claude: image})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := effectiveACPAllowedTools(task, agent); got == nil || len(got) != 0 {
+		t.Fatalf("explicit empty allowed tools = %#v, want non-nil empty", got)
+	}
+	if omitted.Profile.ToolPolicyDigest == explicitEmpty.Profile.ToolPolicyDigest || omitted.Digest == explicitEmpty.Digest {
+		t.Fatal("explicit deny-all tools collapsed into omitted/unrestricted ACP policy")
+	}
+}
+
+func TestPlanACPRuntimeOpenCodeUsesNativeACPImage(t *testing.T) {
+	imageDigest := "sha256:" + strings.Repeat("d", 64)
+	image := "docker.io/example/opencode@" + imageDigest
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{UID: types.UID("opencode-agent-uid"), Generation: 2},
+		Spec: corev1alpha1.AgentSpec{
+			Model: testOpenCodeModelConfig(),
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeOpencode,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+		},
+	}
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent}}
+
+	plan, err := PlanACPRuntime(task, agent, ACPRuntimeImages{Opencode: image})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if plan.Image != image {
+		t.Fatalf("image = %q, want %q", plan.Image, image)
+	}
+	if plan.Profile.ProviderKind != string(corev1alpha1.AgentRuntimeOpencode) || plan.Profile.Model != "openai/gpt-test" {
+		t.Fatalf("unexpected OpenCode profile: %#v", plan.Profile)
+	}
+	if plan.Profile.ModelLimits == nil || plan.Profile.ModelLimits.Context != int64(testOpenCodeContextWindow) ||
+		plan.Profile.ModelLimits.Output != int64(testOpenCodeMaxTokens) {
+		t.Fatalf("OpenCode model limits = %#v", plan.Profile.ModelLimits)
+	}
+	profileSpec := RuntimePoolProfileFromPlan(plan)
+	if profileSpec.ModelLimits == nil || profileSpec.ModelLimits.Context != int64(testOpenCodeContextWindow) ||
+		profileSpec.ModelLimits.Output != int64(testOpenCodeMaxTokens) {
+		t.Fatalf("RuntimePool model limits = %#v", profileSpec.ModelLimits)
+	}
+	dispatchProfile := runtimeProfileFromPool(profileSpec)
+	if dispatchProfile.ModelLimits == nil || dispatchProfile.ModelLimits.Context != int64(testOpenCodeContextWindow) ||
+		dispatchProfile.ModelLimits.Output != int64(testOpenCodeMaxTokens) {
+		t.Fatalf("dispatcher model limits = %#v", dispatchProfile.ModelLimits)
+	}
+	dispatchDigest, err := harnessv2.CanonicalProfileDigest(dispatchProfile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if dispatchDigest != plan.Digest {
+		t.Fatalf("dispatcher profile digest = %q, want %q", dispatchDigest, plan.Digest)
+	}
+	wantAdapterDigests := map[string]string{
+		"opencode-cli-linux-amd64":     "sha256:" + acp.OpenCodeLinuxX64BinarySHA256,
+		"opencode-cli-linux-arm64":     "sha256:" + acp.OpenCodeLinuxARM64BinarySHA256,
+		"opencode-ripgrep-linux-amd64": "sha256:" + acp.OpenCodeRipgrepLinuxX64BinarySHA256,
+		"opencode-ripgrep-linux-arm64": "sha256:" + acp.OpenCodeRipgrepLinuxARM64BinarySHA256,
+		"acp-schema":                   "sha256:" + acp.ACPSchemaSHA256,
+	}
+	if !reflect.DeepEqual(plan.Profile.AdapterDigests, wantAdapterDigests) {
+		t.Fatalf("adapter digests = %#v, want %#v", plan.Profile.AdapterDigests, wantAdapterDigests)
+	}
+	if !strings.HasPrefix(plan.PoolName, "acp-opencode-") {
+		t.Fatalf("pool name = %q, want OpenCode prefix", plan.PoolName)
+	}
+
+	fallbackAgent := agent.DeepCopy()
+	fallbackAgent.Spec.Model.Fallbacks = []corev1alpha1.ModelFallback{{ProviderRef: "fallback-provider", Model: "fallback-model"}}
+	if _, err := PlanACPRuntime(task, fallbackAgent, ACPRuntimeImages{Opencode: image}); err == nil || !strings.Contains(err.Error(), "spec.model.fallbacks") {
+		t.Fatalf("OpenCode fallbacks error = %v, want unsupported fallbacks rejection", err)
+	}
+
+	providerRefAgent := agent.DeepCopy()
+	providerRefAgent.Spec.ProviderRef = &corev1alpha1.ProviderReference{Name: "allowed-provider"}
+	if _, err := PlanACPRuntime(task, providerRefAgent, ACPRuntimeImages{Opencode: image}); err == nil || !strings.Contains(err.Error(), "does not accept spec.providerRef") {
+		t.Fatalf("OpenCode providerRef error = %v, want providerRef rejection", err)
+	}
+
+	changedAgent := agent.DeepCopy()
+	changedContext := *changedAgent.Spec.Model.ContextWindow + 1
+	changedAgent.Spec.Model.ContextWindow = &changedContext
+	changedPlan, err := PlanACPRuntime(task, changedAgent, ACPRuntimeImages{Opencode: image})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if changedPlan.Digest == plan.Digest || changedPlan.PoolName == plan.PoolName {
+		t.Fatal("changing OpenCode model limits did not rotate the immutable RuntimePool profile")
+	}
+
+	if _, err := PlanACPRuntime(task, agent, ACPRuntimeImages{Opencode: "docker.io/example/opencode:latest"}); err == nil ||
+		!strings.Contains(err.Error(), "digest-pinned image") {
+		t.Fatalf("mutable OpenCode image error = %v, want digest-pinned rejection", err)
+	}
+
+	reasoningAgent := agent.DeepCopy()
+	reasoningAgent.Spec.Runtime.DefaultReasoningEffort = agentReasoningEffortHigh
+	if _, err := PlanACPRuntime(task, reasoningAgent, ACPRuntimeImages{Opencode: image}); err == nil ||
+		!strings.Contains(err.Error(), "does not support spec.runtime.defaultReasoningEffort") {
+		t.Fatalf("OpenCode reasoning-effort error = %v, want unsupported-setting rejection", err)
+	}
+}
+
+func TestACPRuntimeImageAvailableRejectsPlaceholderAndMutableReferences(t *testing.T) {
+	valid := "docker.io/example/opencode@sha256:" + strings.Repeat("a", 64)
+	if !ACPRuntimeImageAvailable(valid) {
+		t.Fatalf("ACPRuntimeImageAvailable(%q) = false", valid)
+	}
+	for _, image := range []string{
+		"",
+		"docker.io/example/opencode:latest",
+		"docker.io/example/opencode@sha256:" + strings.Repeat("0", 64),
+	} {
+		if ACPRuntimeImageAvailable(image) {
+			t.Fatalf("ACPRuntimeImageAvailable(%q) = true, want false", image)
+		}
+	}
+}
+
+func TestRuntimePoolProfileFromPlan(t *testing.T) {
+	plan := ACPRuntimePlan{Profile: harnessProfileForTest(), Digest: harnessv2.ProfileDigest("sha256:" + strings.Repeat("b", 64))}
+	profile := RuntimePoolProfileFromPlan(plan)
+	if profile.ProviderKind != plan.Profile.ProviderKind || profile.Digest != string(plan.Digest) || profile.DigestSchemaVersion != strconv.FormatUint(uint64(harnessv2.ProfileDigestSchemaVersion), 10) {
+		t.Fatalf("unexpected API profile: %#v", profile)
+	}
+}
+
+func harnessProfileForTest() harnessv2.RuntimeProfile {
+	digest := "sha256:" + strings.Repeat("c", 64)
+	return harnessv2.RuntimeProfile{
+		ACPProfile: harnessv2.ACPProfileV1, AdapterDigests: map[string]string{"adapter": digest},
+		ProviderKind: "codex", Model: acpTestModel, AgentConfigurationDigest: digest,
+		ToolPolicyDigest: digest, ApprovalPolicyDigest: digest, MCPConfigurationDigest: digest,
+		WorkspaceIntent: harnessv2.WorkspaceIntentRead, ProxyCredentialRole: "provider",
+		ProxyCredentialScope: "model:gpt-test", ResourceClass: "standard",
+	}
+}
+
+func TestPlanACPRuntimePoolIdentityRotatesWithImageDigest(t *testing.T) {
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent}}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{UID: types.UID("agent-uid"), Generation: 1},
+		Spec: corev1alpha1.AgentSpec{
+			Model: &corev1alpha1.ModelConfig{Name: acpTestModel},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeClaude,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+		},
+	}
+	first, err := PlanACPRuntime(task, agent, ACPRuntimeImages{
+		Claude: "docker.io/example/claude@sha256:" + strings.Repeat("a", 64),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := PlanACPRuntime(task, agent, ACPRuntimeImages{
+		Claude: "docker.io/example/claude@sha256:" + strings.Repeat("b", 64),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if first.Digest != second.Digest {
+		t.Fatalf("runtime image changed protocol profile digest: first=%q second=%q", first.Digest, second.Digest)
+	}
+	if first.PoolName == second.PoolName {
+		t.Fatalf("runtime image did not rotate RuntimePool identity: %q", first.PoolName)
+	}
+}
diff --git a/internal/controller/acp_session.go b/internal/controller/acp_session.go
new file mode 100644
index 000000000..7dfab3a7d
--- /dev/null
+++ b/internal/controller/acp_session.go
@@ -0,0 +1,858 @@
+package controller
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+const (
+	defaultACPSessionType = "task"
+
+	acpSessionTurnAggregateKind    = "SessionTurn"
+	acpOutcomeUnknownKind          = "OutcomeUnknown"
+	acpPrePromptLeaseReleasePrefix = "release-pre-prompt:"
+)
+
+// ACPSessionContinuityConfig supplies the durable stores used by the ACP
+// session-continuity boundary. In production these interfaces are normally
+// implemented by the same SQLite-backed durable control store.
+type ACPSessionContinuityConfig struct {
+	SessionControls store.SessionControlStore
+	Transcripts     store.SessionStore
+	Publications    store.PublicationStore
+	BranchClaims    store.BranchClaimStore
+	BootstrapLimits ACPBootstrapLimits
+	NewSessionUID   func() (string, error)
+
+	// Lineages receives an idempotent SQLite payload projection only after the
+	// Kubernetes SessionControl store has established or verified lineage in
+	// the same status CAS that records the mutation Lease.
+	Lineages store.SessionLineageStore
+}
+
+// HarnessV1SessionContinuityConfig supplies only the namespaced continuity
+// stores used by the publication-free harness v1 contract.
+type HarnessV1SessionContinuityConfig struct {
+	SessionControls store.SessionControlStore
+	Transcripts     store.SessionStore
+	BootstrapLimits ACPBootstrapLimits
+	NewSessionUID   func() (string, error)
+	Lineages        store.SessionLineageStore
+}
+
+// ACPSessionContinuity is the controller-side integration boundary for durable
+// ACP Session identity, mutation fencing, canonical transcript bootstrap, and
+// atomic SessionTurn completion. It deliberately does not submit prompts.
+type ACPSessionContinuity struct {
+	controls        store.SessionControlStore
+	transcripts     store.SessionStore
+	publications    store.PublicationStore
+	branchClaims    store.BranchClaimStore
+	bootstrapLimits ACPBootstrapLimits
+	newSessionUID   func() (string, error)
+	lineages        store.SessionLineageStore
+}
+
+// RecordsLineage reports whether Session lineage recording is configured.
+func (c *ACPSessionContinuity) RecordsLineage() bool {
+	return c != nil && c.lineages != nil
+}
+
+// NewACPSessionContinuity creates a continuity component. All stores are
+// required because publication ambiguity and blocked-session recovery must be
+// classified from durable receipts rather than caller assertions.
+func NewACPSessionContinuity(config ACPSessionContinuityConfig) (*ACPSessionContinuity, error) {
+	if config.SessionControls == nil || config.Transcripts == nil || config.Publications == nil || config.BranchClaims == nil {
+		return nil, fmt.Errorf("ACP session continuity requires session-control, transcript, publication, and branch-claim stores")
+	}
+	return newSessionContinuity(config)
+}
+
+// NewHarnessV1SessionContinuity creates the publication-free v1 continuity
+// boundary. A nonempty publication ID fails closed because no PublicationStore
+// or cluster-scoped BranchClaimStore is attached.
+func NewHarnessV1SessionContinuity(config HarnessV1SessionContinuityConfig) (*ACPSessionContinuity, error) {
+	if config.SessionControls == nil || config.Transcripts == nil {
+		return nil, fmt.Errorf("harness v1 session continuity requires session-control and transcript stores")
+	}
+	return newSessionContinuity(ACPSessionContinuityConfig{
+		SessionControls: config.SessionControls,
+		Transcripts:     config.Transcripts,
+		BootstrapLimits: config.BootstrapLimits,
+		NewSessionUID:   config.NewSessionUID,
+		Lineages:        config.Lineages,
+	})
+}
+
+func newSessionContinuity(config ACPSessionContinuityConfig) (*ACPSessionContinuity, error) {
+	limits, err := config.BootstrapLimits.withDefaults()
+	if err != nil {
+		return nil, err
+	}
+	newSessionUID := config.NewSessionUID
+	if newSessionUID == nil {
+		newSessionUID = newACPSessionUID
+	}
+	return &ACPSessionContinuity{
+		controls:        config.SessionControls,
+		transcripts:     config.Transcripts,
+		publications:    config.Publications,
+		branchClaims:    config.BranchClaims,
+		lineages:        config.Lineages,
+		bootstrapLimits: limits,
+		newSessionUID:   newSessionUID,
+	}, nil
+}
+
+// ACPEnsureSessionRequest identifies one canonical transcript Session. An
+// optional ExpectedSessionUID turns loading into an exact immutable-identity
+// assertion; when omitted, a UID is generated only if the control record does
+// not already exist.
+type ACPEnsureSessionRequest struct {
+	Namespace                 string
+	SessionName               string
+	SessionType               string
+	ExpectedSessionUID        string
+	RequireExistingTranscript bool
+	Fence                     store.ControllerEpochFence
+	CreatedAt                 time.Time
+}
+
+// EnsureSession creates or loads the transcript Session and its immutable
+// SessionControl UID record. Concurrent creators converge on the first durable
+// UID; an explicitly expected different UID is rejected.
+func (c *ACPSessionContinuity) EnsureSession(ctx context.Context, request ACPEnsureSessionRequest) (*store.SessionControl, error) {
+	request.Namespace = strings.TrimSpace(request.Namespace)
+	request.SessionName = strings.TrimSpace(request.SessionName)
+	request.SessionType = strings.TrimSpace(request.SessionType)
+	request.ExpectedSessionUID = strings.TrimSpace(request.ExpectedSessionUID)
+	if request.SessionType == "" {
+		request.SessionType = defaultACPSessionType
+	}
+	for field, value := range map[string]string{
+		"session namespace": request.Namespace,
+		"session name":      request.SessionName,
+		"session type":      request.SessionType,
+	} {
+		if err := store.ValidateControlIdentifier(field, value); err != nil {
+			return nil, err
+		}
+	}
+	if request.SessionType != defaultACPSessionType && request.SessionType != "chat" && request.SessionType != store.SessionTypeGateway {
+		return nil, store.ValidationErrorf("unsupported transcript session type %q", request.SessionType)
+	}
+	if request.ExpectedSessionUID != "" {
+		if err := store.ValidateControlIdentifier("expected session UID", request.ExpectedSessionUID); err != nil {
+			return nil, err
+		}
+	}
+	if control, err := c.controls.GetSessionControl(ctx, request.Namespace, request.SessionName); err == nil {
+		if err := c.validateExistingSession(ctx, control, request); err != nil {
+			return nil, err
+		}
+		return control, nil
+	} else if !errors.Is(err, store.ErrNotFound) {
+		return nil, fmt.Errorf("load ACP session control: %w", err)
+	}
+
+	now := request.CreatedAt.UTC()
+	if now.IsZero() {
+		now = time.Now().UTC()
+	}
+	if request.RequireExistingTranscript {
+		existing, transcriptErr := c.transcripts.GetSession(ctx, request.Namespace, request.SessionName)
+		if transcriptErr != nil {
+			if errors.Is(transcriptErr, store.ErrNotFound) {
+				return nil, fmt.Errorf("session %s/%s does not exist and create=false: %w", request.Namespace, request.SessionName, store.ErrNotFound)
+			}
+			return nil, fmt.Errorf("load required transcript session: %w", transcriptErr)
+		}
+		if err := validateTranscriptSession(existing, request.SessionType); err != nil {
+			return nil, err
+		}
+	} else if err := c.ensureTranscriptSession(ctx, request, now); err != nil {
+		return nil, err
+	}
+
+	sessionUID := request.ExpectedSessionUID
+	if sessionUID == "" {
+		generated, err := c.newSessionUID()
+		if err != nil {
+			return nil, fmt.Errorf("generate ACP session UID: %w", err)
+		}
+		sessionUID = strings.TrimSpace(generated)
+		if err := store.ValidateControlIdentifier("generated session UID", sessionUID); err != nil {
+			return nil, err
+		}
+	}
+	requestDigest, err := acpDomainDigest("session-control", map[string]any{
+		"namespace": request.Namespace, "sessionName": request.SessionName, "sessionType": request.SessionType,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("digest ACP session control: %w", err)
+	}
+	created, err := c.controls.CreateSessionControl(ctx, &store.SessionControl{
+		Namespace:     request.Namespace,
+		SessionName:   request.SessionName,
+		SessionUID:    sessionUID,
+		RequestDigest: requestDigest,
+		Availability:  store.SessionAvailable,
+		CreatedAt:     now,
+		UpdatedAt:     now,
+	}, request.Fence)
+	if err == nil {
+		return created, nil
+	}
+	// A racing creator can win with a different generated UID. Load the winner
+	// and accept it only when the caller did not assert a specific UID.
+	winner, getErr := c.controls.GetSessionControl(ctx, request.Namespace, request.SessionName)
+	if getErr != nil {
+		return nil, fmt.Errorf("create ACP session control: %w", err)
+	}
+	if request.ExpectedSessionUID != "" && winner.SessionUID != request.ExpectedSessionUID {
+		return nil, fmt.Errorf("%w: session %s/%s has immutable UID %q, expected %q", store.ErrConflict,
+			request.Namespace, request.SessionName, winner.SessionUID, request.ExpectedSessionUID)
+	}
+	if validateErr := c.validateExistingSession(ctx, winner, request); validateErr != nil {
+		return nil, validateErr
+	}
+	return winner, nil
+}
+
+func (c *ACPSessionContinuity) ensureTranscriptSession(ctx context.Context, request ACPEnsureSessionRequest, now time.Time) error {
+	existing, err := c.transcripts.GetSession(ctx, request.Namespace, request.SessionName)
+	if err == nil {
+		return validateTranscriptSession(existing, request.SessionType)
+	}
+	if !errors.Is(err, store.ErrNotFound) {
+		return fmt.Errorf("load transcript session: %w", err)
+	}
+	createErr := c.transcripts.CreateSession(ctx, &store.SessionRecord{
+		Namespace: request.Namespace, Name: request.SessionName, SessionType: request.SessionType,
+		CreatedAt: now, UpdatedAt: now,
+	})
+	if createErr == nil {
+		return nil
+	}
+	// SessionStore predates typed create conflicts. Read after any create error
+	// so concurrent creators can converge without depending on driver errors.
+	existing, getErr := c.transcripts.GetSession(ctx, request.Namespace, request.SessionName)
+	if getErr != nil {
+		return fmt.Errorf("create transcript session: %w", createErr)
+	}
+	return validateTranscriptSession(existing, request.SessionType)
+}
+
+func (c *ACPSessionContinuity) validateExistingSession(ctx context.Context, control *store.SessionControl, request ACPEnsureSessionRequest) error {
+	if control == nil {
+		return fmt.Errorf("ACP session control is nil")
+	}
+	if request.ExpectedSessionUID != "" && control.SessionUID != request.ExpectedSessionUID {
+		return fmt.Errorf("%w: session %s/%s has immutable UID %q, expected %q", store.ErrConflict,
+			request.Namespace, request.SessionName, control.SessionUID, request.ExpectedSessionUID)
+	}
+	session, err := c.transcripts.GetSession(ctx, request.Namespace, request.SessionName)
+	if err != nil {
+		return fmt.Errorf("load transcript for ACP session control: %w", err)
+	}
+	return validateTranscriptSession(session, request.SessionType)
+}
+
+func validateTranscriptSession(session *store.SessionRecord, expectedType string) error {
+	if session == nil {
+		return fmt.Errorf("transcript session is nil")
+	}
+	if session.SessionType != expectedType {
+		return fmt.Errorf("%w: transcript session %s/%s has type %q, expected %q", store.ErrConflict,
+			session.Namespace, session.Name, session.SessionType, expectedType)
+	}
+	return nil
+}
+
+// ACPAcquireSessionLeaseRequest acquires the next generation from an exact
+// SessionControl snapshot. PromptRequestDigest binds the lease to the immutable
+// prompt attempt input without allowing a different prompt to reuse it.
+type ACPAcquireSessionLeaseRequest struct {
+	Session             store.SessionControl
+	Fence               store.ControllerEpochFence
+	TaskUID             string
+	Attempt             int64
+	PromptID            string
+	PromptRequestDigest string
+	AcquiredAt          time.Time
+	ExpiresAt           *time.Time
+
+	// NamespaceUID, RuntimeIdentity, and ConfigDigest establish or verify the
+	// Kubernetes-authoritative Session protocol/runtime lineage atomically with
+	// the lease status CAS when lineage projection is configured.
+	NamespaceUID      string
+	ContractVersion   corev1alpha1.AgentRuntimeContractVersion
+	LineageGeneration int64
+	RuntimeIdentity   string
+	ConfigDigest      string
+}
+
+// ACPSessionLease is the exact mutation fence that must be used when opening
+// and finalizing the SessionTurn.
+type ACPSessionLease struct {
+	Session store.SessionControl
+	Key     store.SessionTurnKey
+}
+
+type ACPReleaseSessionLeaseRequest struct {
+	Lease      ACPSessionLease
+	Fence      store.ControllerEpochFence
+	ReleasedAt time.Time
+}
+
+// AcquireMutationLease acquires one monotonic, non-reusable Session lease.
+func (c *ACPSessionContinuity) AcquireMutationLease(ctx context.Context, request ACPAcquireSessionLeaseRequest) (*ACPSessionLease, error) {
+	request.TaskUID = strings.TrimSpace(request.TaskUID)
+	request.PromptID = strings.TrimSpace(request.PromptID)
+	if request.Session.Availability != store.SessionAvailable {
+		return nil, fmt.Errorf("%w: session %s/%s is reconciliation-blocked", store.ErrConflict,
+			request.Session.Namespace, request.Session.SessionName)
+	}
+	if err := store.ValidateCanonicalDigest("prompt request digest", request.PromptRequestDigest); err != nil {
+		return nil, err
+	}
+	leaseGeneration := request.Session.LeaseGeneration + 1
+	if request.Session.Lease != nil {
+		leaseGeneration = request.Session.Lease.Generation
+	}
+	leaseDigest, err := acpSessionMutationLeaseDigest(
+		request.Session.SessionUID, leaseGeneration,
+		request.TaskUID, request.Attempt, request.PromptID, request.PromptRequestDigest,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("digest ACP session mutation lease: %w", err)
+	}
+	if existing := request.Session.Lease; existing != nil &&
+		(existing.TaskUID != request.TaskUID || existing.Attempt != request.Attempt ||
+			existing.PromptID != request.PromptID || existing.RequestDigest != leaseDigest) {
+		return nil, fmt.Errorf("%w: session %s/%s is already leased by a different prompt operation",
+			store.ErrConflict, request.Session.Namespace, request.Session.SessionName)
+	}
+	acquiredAt := request.AcquiredAt.UTC()
+	if acquiredAt.IsZero() {
+		acquiredAt = time.Now().UTC()
+	}
+	lineageClaim, err := c.prepareSessionLineageClaim(ctx, request)
+	if err != nil {
+		return nil, err
+	}
+	control, err := c.controls.AcquireSessionMutationLease(ctx, store.AcquireSessionMutationLeaseRequest{
+		Namespace: request.Session.Namespace, SessionName: request.Session.SessionName, SessionUID: request.Session.SessionUID,
+		Fence: request.Fence, ExpectedVersion: request.Session.Version, ExpectedLeaseGeneration: request.Session.LeaseGeneration,
+		TaskUID: request.TaskUID, Attempt: request.Attempt, PromptID: request.PromptID,
+		RequestDigest: leaseDigest, AcquiredAt: acquiredAt, ExpiresAt: request.ExpiresAt,
+		Lineage: lineageClaim,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("acquire ACP session mutation lease: %w", err)
+	}
+	key := store.SessionTurnKey{
+		SessionUID: control.SessionUID, LeaseGeneration: control.LeaseGeneration,
+		TaskUID: request.TaskUID, Attempt: request.Attempt, PromptID: request.PromptID,
+	}
+	if err := validateACPSessionLease(control, key); err != nil {
+		return nil, err
+	}
+	lease := &ACPSessionLease{Session: *control, Key: key}
+	if c.lineages != nil {
+		if control.Lineage == nil {
+			return nil, fmt.Errorf("kubernetes session lease committed without authoritative lineage")
+		}
+		if _, err := c.lineages.ProjectSessionLineage(ctx, *control.Lineage); err != nil {
+			// Retain the exact Kubernetes lease on projection failure. Releasing it
+			// would allow another owner to proceed before the payload projection is
+			// repaired; an idempotent retry completes the projection first.
+			return nil, fmt.Errorf("project Kubernetes-authoritative Session lineage: %w", err)
+		}
+	}
+	return lease, nil
+}
+
+// prepareSessionLineageClaim determines only whether an absent authoritative
+// lineage may be established. Kubernetes remains the decision point: a stale
+// caller that observes a nonempty transcript can still verify a lineage that a
+// concurrent first user already committed, but it cannot establish one.
+func (c *ACPSessionContinuity) prepareSessionLineageClaim(ctx context.Context, request ACPAcquireSessionLeaseRequest) (*store.ClaimSessionLineageRequest, error) {
+	if c.lineages == nil {
+		return nil, nil
+	}
+	contractVersion := request.ContractVersion
+	if contractVersion == "" {
+		contractVersion = corev1alpha1.AgentRuntimeContractHarnessV2
+	}
+	lineageGeneration := request.LineageGeneration
+	if lineageGeneration == 0 {
+		lineageGeneration = 1
+	}
+	claim := &store.ClaimSessionLineageRequest{
+		Namespace:         request.Session.Namespace,
+		SessionName:       request.Session.SessionName,
+		NamespaceUID:      request.NamespaceUID,
+		SessionUID:        request.Session.SessionUID,
+		ContractVersion:   string(contractVersion),
+		LineageGeneration: lineageGeneration,
+		RuntimeIdentity:   request.RuntimeIdentity,
+		ConfigDigest:      request.ConfigDigest,
+	}
+	if request.Session.Lineage != nil {
+		claim.LineageGeneration = request.Session.Lineage.LineageGeneration
+	} else {
+		record, err := c.transcripts.GetSession(ctx, request.Session.Namespace, request.Session.SessionName)
+		if err != nil {
+			return nil, fmt.Errorf("read session transcript for lineage classification: %w", err)
+		}
+		// A nonempty unclassified Session is never adopted implicitly. Static
+		// mode installations require it to be recreated with fresh lineage.
+		claim.EstablishIfAbsent = record.MessageCount == 0
+	}
+	if err := claim.Validate(); err != nil {
+		return nil, err
+	}
+	return claim, nil
+}
+
+func (c *ACPSessionContinuity) ReleaseMutationLease(ctx context.Context, request ACPReleaseSessionLeaseRequest) (*store.SessionControl, error) {
+	if err := validateACPSessionLease(&request.Lease.Session, request.Lease.Key); err != nil {
+		return nil, err
+	}
+	turnID, err := request.Lease.Key.CanonicalID()
+	if err != nil {
+		return nil, err
+	}
+	leaseDigest := request.Lease.Session.Lease.RequestDigest
+	operationID := acpPrePromptLeaseReleasePrefix + turnID
+	operationDigest, err := store.SessionLeaseReleaseOperationDigest(turnID, leaseDigest)
+	if err != nil {
+		return nil, err
+	}
+	releasedAt := request.ReleasedAt.UTC()
+	if releasedAt.IsZero() {
+		releasedAt = time.Now().UTC()
+	}
+	return c.controls.ReleaseSessionMutationLease(ctx, store.ReleaseSessionMutationLeaseRequest{
+		Namespace: request.Lease.Session.Namespace, SessionName: request.Lease.Session.SessionName,
+		SessionUID: request.Lease.Session.SessionUID, Key: request.Lease.Key, Fence: request.Fence,
+		ExpectedSessionVersion: request.Lease.Session.Version, LeaseRequestDigest: leaseDigest,
+		OperationID: operationID, OperationDigest: operationDigest, ReleasedAt: releasedAt,
+	})
+}
+
+func acpSessionMutationLeaseDigest(sessionUID string, leaseGeneration int64, taskUID string, attempt int64, promptID, promptRequestDigest string) (string, error) {
+	return store.SessionMutationLeaseRequestDigest(
+		sessionUID, leaseGeneration, taskUID, attempt, promptID, promptRequestDigest,
+	)
+}
+
+// ACPOpenSessionTurnRequest opens the durable turn after the PromptAttempt has
+// been bound to the returned lease, but before any prompt request is written.
+type ACPOpenSessionTurnRequest struct {
+	Lease                ACPSessionLease
+	Fence                store.ControllerEpochFence
+	PromptAttemptID      string
+	PromptRequestDigest  string
+	UserPrompt           string
+	SkipTranscriptAppend bool
+	SkipUserPromptAppend bool
+	OpenedAt             time.Time
+}
+
+// ACPSessionTurn is the exact session and turn snapshot used for terminal
+// finalization. A newer lease or Session version cannot finalize this turn.
+type ACPSessionTurn struct {
+	Lease                ACPSessionLease
+	Turn                 store.SessionTurn
+	SkipTranscriptAppend bool
+	SkipUserPromptAppend bool
+}
+
+// OpenTurn creates the SessionTurn durability barrier that prompt execution
+// must not cross before this method succeeds.
+func (c *ACPSessionContinuity) OpenTurn(ctx context.Context, request ACPOpenSessionTurnRequest) (*ACPSessionTurn, error) {
+	request.PromptAttemptID = strings.TrimSpace(request.PromptAttemptID)
+	if err := store.ValidateControlIdentifier("prompt attempt ID", request.PromptAttemptID); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateCanonicalDigest("prompt request digest", request.PromptRequestDigest); err != nil {
+		return nil, err
+	}
+	if strings.TrimSpace(request.UserPrompt) == "" {
+		return nil, store.ValidationErrorf("session turn user prompt is required")
+	}
+	if err := store.ValidateControlText("session turn user prompt", request.UserPrompt); err != nil {
+		return nil, err
+	}
+	if request.SkipTranscriptAppend && request.SkipUserPromptAppend {
+		return nil, store.ValidationErrorf("session turn cannot combine full transcript suppression with user-prompt-only suppression")
+	}
+	if err := validateACPSessionLease(&request.Lease.Session, request.Lease.Key); err != nil {
+		return nil, err
+	}
+	turnID, err := request.Lease.Key.CanonicalID()
+	if err != nil {
+		return nil, err
+	}
+	turnDigest, err := acpSessionTurnDigest(
+		turnID, request.PromptAttemptID, request.PromptRequestDigest, request.UserPrompt,
+		request.SkipTranscriptAppend, request.SkipUserPromptAppend,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("digest ACP session turn: %w", err)
+	}
+	openedAt := request.OpenedAt.UTC()
+	if openedAt.IsZero() {
+		openedAt = time.Now().UTC()
+	}
+	turn, err := c.controls.CreateSessionTurn(ctx, store.CreateSessionTurnRequest{
+		Turn: store.SessionTurn{
+			ID: turnID, Key: request.Lease.Key, PromptAttemptID: request.PromptAttemptID,
+			RequestDigest: turnDigest, UserPrompt: request.UserPrompt, CreatedAt: openedAt, UpdatedAt: openedAt,
+		},
+		Fence: request.Fence, ExpectedSessionVersion: request.Lease.Session.Version,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("open ACP session turn before prompt execution: %w", err)
+	}
+	return &ACPSessionTurn{
+		Lease: request.Lease, Turn: *turn,
+		SkipTranscriptAppend: request.SkipTranscriptAppend,
+		SkipUserPromptAppend: request.SkipUserPromptAppend,
+	}, nil
+}
+
+func acpSessionTurnDigest(
+	turnID, promptAttemptID, promptRequestDigest, userPrompt string,
+	skipTranscriptAppend, skipUserPromptAppend bool,
+) (string, error) {
+	identity := map[string]any{
+		"turnID": turnID, "promptAttemptID": promptAttemptID,
+		"promptRequestDigest": promptRequestDigest, "userPrompt": userPrompt,
+	}
+	if skipTranscriptAppend {
+		identity["skipTranscriptAppend"] = true
+	}
+	if skipUserPromptAppend {
+		identity["skipUserPromptAppend"] = true
+	}
+	return acpDomainDigest("session-turn", identity)
+}
+
+// ACPFinalizationProjection is the transactional-outbox projection committed
+// with the SessionTurn. The helper owns the aggregate identity and payload
+// digest so callers cannot accidentally project a different turn.
+type ACPFinalizationProjection struct {
+	ID             string
+	ProjectionKind string
+	Payload        json.RawMessage
+	AvailableAt    time.Time
+}
+
+// ACPFinalizeAssistantRequest finalizes a known prompt result. If publication
+// is terminally ambiguous, the assistant result remains canonical but the
+// Session and BranchClaim stay reconciliation-blocked.
+type ACPFinalizeAssistantRequest struct {
+	SessionTurn     ACPSessionTurn
+	Fence           store.ControllerEpochFence
+	AssistantResult string
+	PublicationID   string
+	Projection      ACPFinalizationProjection
+	FinalizedAt     time.Time
+}
+
+// ACPFinalizeOutcomeUnknownRequest records an explicit system outcome marker.
+// There is intentionally no assistant-result field, preventing invented output
+// when prompt acceptance or settlement cannot be established.
+type ACPFinalizeOutcomeUnknownRequest struct {
+	SessionTurn   ACPSessionTurn
+	Fence         store.ControllerEpochFence
+	Reason        string
+	PublicationID string
+	Projection    ACPFinalizationProjection
+	FinalizedAt   time.Time
+}
+
+// ACPFinalizeOutcomeMarkerRequest records a proven non-success terminal marker
+// such as Cancelled or Failed without misclassifying it as OutcomeUnknown.
+type ACPFinalizeOutcomeMarkerRequest struct {
+	SessionTurn ACPSessionTurn
+	Fence       store.ControllerEpochFence
+	Kind        string
+	Reason      string
+	Projection  ACPFinalizationProjection
+	FinalizedAt time.Time
+}
+
+// ACPSessionFinalization is the committed turn plus its latest Session state.
+type ACPSessionFinalization struct {
+	Turn    store.SessionTurn
+	Session store.SessionControl
+}
+
+// ACPResumeSessionTurnFinalizationRequest identifies an already-finalized
+// durable SessionTurn whose Kubernetes and outbox activation tail may have
+// been interrupted by controller restart.
+type ACPResumeSessionTurnFinalizationRequest struct {
+	SessionTurn ACPSessionTurn
+	Fence       store.ControllerEpochFence
+}
+
+// ResumeSessionTurnFinalization reloads every finalization input from the
+// persisted SessionTurn/outbox records and idempotently completes the remaining
+// BranchClaim, SessionControl, coordination Lease, and outbox activation steps.
+func (c *ACPSessionContinuity) ResumeSessionTurnFinalization(ctx context.Context, request ACPResumeSessionTurnFinalizationRequest) (*ACPSessionFinalization, error) {
+	turn := request.SessionTurn.Turn
+	if turn.State != store.SessionTurnFinalized || turn.FinalizedAt == nil {
+		return nil, fmt.Errorf("%w: ACP session turn is not durably finalized", store.ErrConflict)
+	}
+	if turn.Key != request.SessionTurn.Lease.Key || request.SessionTurn.Lease.Session.SessionUID != turn.Key.SessionUID {
+		return nil, fmt.Errorf("%w: ACP session turn recovery identity does not match the captured Session", store.ErrConflict)
+	}
+	resumed, err := c.controls.ResumeSessionTurnFinalization(ctx, store.ResumeSessionTurnFinalizationRequest{
+		Key: turn.Key, PromptAttemptID: turn.PromptAttemptID,
+		FinalizationDigest: turn.FinalizationDigest, Fence: request.Fence,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("resume ACP session turn finalization: %w", err)
+	}
+	control, err := c.controls.GetSessionControl(ctx, request.SessionTurn.Lease.Session.Namespace, request.SessionTurn.Lease.Session.SessionName)
+	if err != nil {
+		return nil, fmt.Errorf("reload resumed ACP session: %w", err)
+	}
+	if control.SessionUID != turn.Key.SessionUID {
+		return nil, fmt.Errorf("%w: resumed ACP session UID does not match the finalized turn", store.ErrConflict)
+	}
+	return &ACPSessionFinalization{Turn: *resumed, Session: *control}, nil
+}
+
+// FinalizeAssistantResult atomically appends the user prompt and known
+// assistant result, snapshots any durable publication receipt, releases only
+// the matching lease, and derives baseline advancement inside the store.
+func (c *ACPSessionContinuity) FinalizeAssistantResult(ctx context.Context, request ACPFinalizeAssistantRequest) (*ACPSessionFinalization, error) {
+	if err := store.ValidateControlText("assistant result", request.AssistantResult); err != nil {
+		return nil, err
+	}
+	return c.finalizeTurn(ctx, request.SessionTurn, request.Fence, store.SessionTurnAssistantResult,
+		request.AssistantResult, request.PublicationID, request.Projection, request.FinalizedAt)
+}
+
+// FinalizeOutcomeUnknown atomically appends the user prompt and an explicit
+// canonical outcome marker. It never accepts or synthesizes assistant content.
+func (c *ACPSessionContinuity) FinalizeOutcomeUnknown(ctx context.Context, request ACPFinalizeOutcomeUnknownRequest) (*ACPSessionFinalization, error) {
+	reason := strings.TrimSpace(request.Reason)
+	if reason == "" {
+		return nil, store.ValidationErrorf("OutcomeUnknown reason is required")
+	}
+	if err := store.ValidateControlReason("OutcomeUnknown reason", reason); err != nil {
+		return nil, err
+	}
+	marker, err := canonicalACPOutcomeUnknownMarker(reason)
+	if err != nil {
+		return nil, err
+	}
+	return c.finalizeTurn(ctx, request.SessionTurn, request.Fence, store.SessionTurnOutcomeMarker,
+		marker, request.PublicationID, request.Projection, request.FinalizedAt)
+}
+
+func (c *ACPSessionContinuity) FinalizeOutcomeMarker(ctx context.Context, request ACPFinalizeOutcomeMarkerRequest) (*ACPSessionFinalization, error) {
+	kind := strings.TrimSpace(request.Kind)
+	reason := strings.TrimSpace(request.Reason)
+	if kind == "" || reason == "" || kind == acpOutcomeUnknownKind {
+		return nil, store.ValidationErrorf("terminal outcome marker kind and reason are required")
+	}
+	if err := store.ValidateControlReason("terminal outcome marker reason", reason); err != nil {
+		return nil, err
+	}
+	markerBytes, err := json.Marshal(map[string]any{
+		"kind": kind, "reason": reason, "assistantResultRecorded": false,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return c.finalizeTurn(ctx, request.SessionTurn, request.Fence, store.SessionTurnOutcomeMarker,
+		string(markerBytes), "", request.Projection, request.FinalizedAt)
+}
+
+func (c *ACPSessionContinuity) finalizeTurn(
+	ctx context.Context,
+	sessionTurn ACPSessionTurn,
+	fence store.ControllerEpochFence,
+	terminalKind store.SessionTurnTerminalKind,
+	terminalContent string,
+	publicationID string,
+	projectionInput ACPFinalizationProjection,
+	finalizedAt time.Time,
+) (*ACPSessionFinalization, error) {
+	if err := validateACPSessionLease(&sessionTurn.Lease.Session, sessionTurn.Lease.Key); err != nil {
+		return nil, err
+	}
+	if sessionTurn.Turn.Key != sessionTurn.Lease.Key || sessionTurn.Turn.State != store.SessionTurnOpen {
+		return nil, fmt.Errorf("%w: ACP session turn is not the open turn for the captured lease", store.ErrConflict)
+	}
+	publicationID = strings.TrimSpace(publicationID)
+	blockReason, err := c.publicationBlockReason(ctx, publicationID)
+	if err != nil {
+		return nil, err
+	}
+	projection, err := buildACPSessionTurnProjection(sessionTurn.Turn.ID, projectionInput)
+	if err != nil {
+		return nil, err
+	}
+	finalizationIdentity := map[string]any{
+		"turnID": sessionTurn.Turn.ID, "terminalKind": terminalKind, "terminalContent": terminalContent,
+		"publicationID": publicationID, "projectionID": projection.ID, "projectionPayloadDigest": projection.PayloadDigest,
+	}
+	if blockReason != "" {
+		finalizationIdentity["blockReason"] = blockReason
+	}
+	if sessionTurn.SkipTranscriptAppend {
+		finalizationIdentity["skipTranscriptAppend"] = true
+	}
+	if sessionTurn.SkipUserPromptAppend {
+		finalizationIdentity["skipUserPromptAppend"] = true
+	}
+	finalizationDigest, err := acpDomainDigest("session-turn-finalization", finalizationIdentity)
+	if err != nil {
+		return nil, fmt.Errorf("digest ACP session turn finalization: %w", err)
+	}
+	when := finalizedAt.UTC()
+	if when.IsZero() {
+		when = time.Now().UTC()
+	}
+	finalized, err := c.controls.FinalizeSessionTurn(ctx, store.FinalizeSessionTurnRequest{
+		Key: sessionTurn.Turn.Key, Fence: fence,
+		ExpectedSessionVersion: sessionTurn.Lease.Session.Version, ExpectedTurnVersion: sessionTurn.Turn.Version,
+		FinalizationDigest: finalizationDigest, TerminalKind: terminalKind, TerminalContent: terminalContent,
+		SkipTranscriptAppend: sessionTurn.SkipTranscriptAppend,
+		SkipUserPromptAppend: sessionTurn.SkipUserPromptAppend,
+		PublicationID:        publicationID,
+		// VerifiedBaseline is deliberately omitted. The durable store may advance
+		// it only by deriving it from the independently verified Publication receipt.
+		BlockReason: blockReason, Projection: projection, FinalizedAt: when,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("finalize ACP session turn: %w", err)
+	}
+	control, err := c.controls.GetSessionControl(ctx, sessionTurn.Lease.Session.Namespace, sessionTurn.Lease.Session.SessionName)
+	if err != nil {
+		return nil, fmt.Errorf("reload finalized ACP session: %w", err)
+	}
+	return &ACPSessionFinalization{Turn: *finalized, Session: *control}, nil
+}
+
+func (c *ACPSessionContinuity) publicationBlockReason(ctx context.Context, publicationID string) (string, error) {
+	if publicationID == "" {
+		return "", nil
+	}
+	if err := store.ValidateControlIdentifier("publication ID", publicationID); err != nil {
+		return "", err
+	}
+	if c.publications == nil {
+		return "", fmt.Errorf("%w: harness v1 Session finalization cannot reference a publication", store.ErrConflict)
+	}
+	publication, err := c.publications.GetPublication(ctx, publicationID)
+	if err != nil {
+		return "", fmt.Errorf("load ACP session publication: %w", err)
+	}
+	if !store.IsTerminalPublicationState(publication.State) {
+		return "", fmt.Errorf("%w: publication %q is not terminal", store.ErrConflict, publication.ID)
+	}
+	switch publication.State {
+	case store.PublicationVerifiedExact:
+		if publication.PreparedReceipt == nil || publication.VerificationReceipt == nil ||
+			publication.VerificationReceipt.Outcome != store.PublicationVerifiedExact ||
+			publication.VerificationReceipt.ObservedRemote.SHA != publication.PreparedReceipt.CommitSHA {
+			return "", store.ValidationErrorf("verified publication %q lacks an independent exact receipt", publication.ID)
+		}
+	case store.PublicationDeliveredSuperseded:
+		if publication.VerificationReceipt == nil || publication.VerificationReceipt.Outcome != store.PublicationDeliveredSuperseded ||
+			publication.VerificationReceipt.ObservedRemote.Absent || publication.VerificationReceipt.ObservedRemote.SHA == "" ||
+			publication.VerificationReceipt.DescendantProofDigest == "" {
+			return "", store.ValidationErrorf("superseded publication %q lacks an independent descendant receipt", publication.ID)
+		}
+	case store.PublicationOutcomeUnknown, store.PublicationDeliveryConflict:
+		reason := strings.TrimSpace(publication.TerminalReason)
+		if reason == "" {
+			reason = fmt.Sprintf("publication %s remains unresolved", publication.ID)
+		}
+		return reason, nil
+	}
+	return "", nil
+}
+
+func buildACPSessionTurnProjection(turnID string, input ACPFinalizationProjection) (store.OutboxProjection, error) {
+	input.ID = strings.TrimSpace(input.ID)
+	input.ProjectionKind = strings.TrimSpace(input.ProjectionKind)
+	if input.ProjectionKind == "" {
+		return store.OutboxProjection{}, store.ValidationErrorf("session finalization projection kind is required")
+	}
+	if !json.Valid(input.Payload) {
+		return store.OutboxProjection{}, store.ValidationErrorf("session finalization projection payload must be valid JSON")
+	}
+	if input.ID == "" {
+		input.ID = store.CanonicalControlID("outbox", turnID, input.ProjectionKind)
+	}
+	return store.OutboxProjection{
+		ID: input.ID, AggregateKind: acpSessionTurnAggregateKind, AggregateID: turnID,
+		ProjectionKind: input.ProjectionKind, Payload: append(json.RawMessage(nil), input.Payload...),
+		PayloadDigest: canonicalACPPayloadDigest(input.Payload), AvailableAt: input.AvailableAt,
+	}, nil
+}
+
+func canonicalACPPayloadDigest(payload []byte) string {
+	sum := sha256.Sum256(payload)
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
+
+type acpOutcomeUnknownMarker struct {
+	Kind                    string `json:"kind"`
+	Reason                  string `json:"reason"`
+	AssistantResultRecorded bool   `json:"assistantResultRecorded"`
+}
+
+func canonicalACPOutcomeUnknownMarker(reason string) (string, error) {
+	canonical, err := json.Marshal(acpOutcomeUnknownMarker{
+		Kind: acpOutcomeUnknownKind, Reason: reason, AssistantResultRecorded: false,
+	})
+	if err != nil {
+		return "", fmt.Errorf("encode OutcomeUnknown marker: %w", err)
+	}
+	return string(canonical), nil
+}
+
+func validateACPSessionLease(control *store.SessionControl, key store.SessionTurnKey) error {
+	if control == nil || control.Lease == nil {
+		return fmt.Errorf("%w: ACP session mutation lease is not active", store.ErrConflict)
+	}
+	if err := key.Validate(); err != nil {
+		return err
+	}
+	lease := control.Lease
+	if control.SessionUID != key.SessionUID || control.LeaseGeneration != key.LeaseGeneration ||
+		lease.Generation != key.LeaseGeneration || lease.TaskUID != key.TaskUID ||
+		lease.Attempt != key.Attempt || lease.PromptID != key.PromptID {
+		return fmt.Errorf("%w: ACP session mutation lease does not match the turn fence", store.ErrConflict)
+	}
+	return nil
+}
+
+func newACPSessionUID() (string, error) {
+	var entropy [16]byte
+	if _, err := rand.Read(entropy[:]); err != nil {
+		return "", err
+	}
+	return "acp-session-" + hex.EncodeToString(entropy[:]), nil
+}
diff --git a/internal/controller/acp_session_json.go b/internal/controller/acp_session_json.go
new file mode 100644
index 000000000..380c717dc
--- /dev/null
+++ b/internal/controller/acp_session_json.go
@@ -0,0 +1,23 @@
+package controller
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+)
+
+func jsonUnmarshalStrict(raw []byte, target any) error {
+	decoder := json.NewDecoder(bytes.NewReader(raw))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(target); err != nil {
+		return err
+	}
+	if err := decoder.Decode(&struct{}{}); err != io.EOF {
+		if err == nil {
+			return fmt.Errorf("unexpected trailing JSON value")
+		}
+		return err
+	}
+	return nil
+}
diff --git a/internal/controller/acp_session_lineage_test.go b/internal/controller/acp_session_lineage_test.go
new file mode 100644
index 000000000..4d32a72e9
--- /dev/null
+++ b/internal/controller/acp_session_lineage_test.go
@@ -0,0 +1,254 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package controller
+
+import (
+	"context"
+	"errors"
+	"path/filepath"
+	"testing"
+	"time"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+	kubestore "github.com/orka-agents/orka/internal/store/kube"
+	"github.com/orka-agents/orka/internal/store/sqlite"
+	coordinationv1 "k8s.io/api/coordination/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+)
+
+type acpLineageTestFixture struct {
+	continuity  *ACPSessionContinuity
+	controls    *kubestore.Store
+	persistence *sqlite.Store
+	fence       store.ControllerEpochFence
+}
+
+func newACPLineageTestFixture(t *testing.T, wrapProjection func(store.SessionLineageStore) store.SessionLineageStore) *acpLineageTestFixture {
+	t.Helper()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "lineage.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	persistence := sqlite.NewStore(db, "lineage-test")
+
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := coordinationv1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	rawClient := fake.NewClientBuilder().WithScheme(scheme).
+		WithStatusSubresource(&corev1alpha1.ControllerEpoch{}, &corev1alpha1.RuntimeSessionControl{}).
+		Build()
+	rawClient = withControllerEpochLeaseUIDs(t, rawClient)
+	controls, err := kubestore.NewComposite(rawClient, "orka-system", persistence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	epoch, err := controls.CompareAndSwapControllerEpoch(context.Background(), store.ControllerEpochCAS{
+		ExpectedVersion: 0, ExpectedEpoch: 0, NewEpoch: 1,
+		HolderID: "lineage-controller", RequestDigest: acpSessionTestDigest("lineage-epoch"),
+		UpdatedAt: time.Date(2026, 8, 5, 9, 0, 0, 0, time.UTC),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	projection := store.SessionLineageStore(persistence)
+	if wrapProjection != nil {
+		projection = wrapProjection(projection)
+	}
+	continuity, err := NewACPSessionContinuity(ACPSessionContinuityConfig{
+		SessionControls: controls, Transcripts: persistence, Publications: controls, BranchClaims: controls,
+		Lineages:      projection,
+		NewSessionUID: func() (string, error) { return "acp-lineage-session-uid", nil },
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return &acpLineageTestFixture{
+		continuity: continuity, controls: controls, persistence: persistence,
+		fence: store.ControllerEpochFence{Name: epoch.Name, Epoch: epoch.Epoch, HolderID: epoch.HolderID},
+	}
+}
+
+func (f *acpLineageTestFixture) ensureSession(t *testing.T, name string) *store.SessionControl {
+	t.Helper()
+	control, err := f.continuity.EnsureSession(context.Background(), ACPEnsureSessionRequest{
+		Namespace: "ns", SessionName: name, SessionType: "task", Fence: f.fence,
+		CreatedAt: time.Date(2026, 8, 5, 9, 5, 0, 0, time.UTC),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return control
+}
+
+func acpLineageLeaseRequest(
+	control *store.SessionControl,
+	fence store.ControllerEpochFence,
+	taskUID string,
+) ACPAcquireSessionLeaseRequest {
+	return ACPAcquireSessionLeaseRequest{
+		Session: *control, Fence: fence, TaskUID: taskUID, Attempt: 1, PromptID: "prompt-" + taskUID,
+		PromptRequestDigest: acpSessionTestDigest("request-" + taskUID),
+		AcquiredAt:          time.Date(2026, 8, 5, 10, 0, 0, 0, time.UTC),
+		NamespaceUID:        "ns-uid-1",
+		RuntimeIdentity:     "codex",
+		ConfigDigest:        acpSessionTestDigest("profile-1"),
+	}
+}
+
+func TestAcquireMutationLeaseEstablishesKubernetesAuthoritativeLineage(t *testing.T) {
+	ctx := context.Background()
+	fixture := newACPLineageTestFixture(t, nil)
+	control := fixture.ensureSession(t, "lineage-session")
+
+	lease, err := fixture.continuity.AcquireMutationLease(ctx, acpLineageLeaseRequest(control, fixture.fence, "task-1"))
+	if err != nil {
+		t.Fatalf("acquire with lineage: %v", err)
+	}
+	if lease.Session.Lineage == nil || lease.Session.Lineage.ContractVersion != string(corev1alpha1.AgentRuntimeContractHarnessV2) ||
+		lease.Session.Lineage.RuntimeIdentity != "codex" || lease.Session.Lineage.NamespaceUID != "ns-uid-1" ||
+		lease.Session.Lineage.LineageGeneration != 1 || lease.Session.Lineage.ConfigDigest != acpSessionTestDigest("profile-1") {
+		t.Fatalf("authoritative lineage = %+v", lease.Session.Lineage)
+	}
+	authoritative, err := fixture.controls.GetSessionControl(ctx, "ns", "lineage-session")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if authoritative.Lineage == nil || authoritative.Lease == nil || authoritative.Version != 2 {
+		t.Fatalf("lineage and Lease were not committed together: %+v", authoritative)
+	}
+	projected, err := fixture.persistence.GetSessionLineage(ctx, "ns", "lineage-session")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if projected.SessionUID != authoritative.SessionUID || projected.ConfigDigest != authoritative.Lineage.ConfigDigest {
+		t.Fatalf("SQLite projection = %+v, authority = %+v", projected, authoritative.Lineage)
+	}
+}
+
+func TestAcquireMutationLeaseRejectsNonemptyUnclassifiedSession(t *testing.T) {
+	ctx := context.Background()
+	fixture := newACPLineageTestFixture(t, nil)
+	control := fixture.ensureSession(t, "unclassified-session")
+	if err := fixture.persistence.AppendMessages(ctx, "ns", "unclassified-session", []store.SessionMessage{{Role: "user", Content: "legacy transcript"}}); err != nil {
+		t.Fatal(err)
+	}
+
+	_, err := fixture.continuity.AcquireMutationLease(ctx, acpLineageLeaseRequest(control, fixture.fence, "task-1"))
+	if !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("nonempty unclassified acquisition error = %v, want conflict", err)
+	}
+	after, getErr := fixture.controls.GetSessionControl(ctx, "ns", "unclassified-session")
+	if getErr != nil {
+		t.Fatal(getErr)
+	}
+	if after.Lineage != nil || after.Lease != nil || after.LeaseGeneration != 0 {
+		t.Fatalf("unclassified Session mutated authority: %+v", after)
+	}
+	if _, getErr := fixture.persistence.GetSessionLineage(ctx, "ns", "unclassified-session"); !errors.Is(getErr, store.ErrNotFound) {
+		t.Fatalf("unclassified Session gained SQLite lineage: %v", getErr)
+	}
+}
+
+func TestAcquireMutationLeaseRejectsLineageIdentityAndConfigMismatch(t *testing.T) {
+	ctx := context.Background()
+	fixture := newACPLineageTestFixture(t, nil)
+	control := fixture.ensureSession(t, "mismatch-session")
+	lease, err := fixture.continuity.AcquireMutationLease(ctx, acpLineageLeaseRequest(control, fixture.fence, "task-1"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := fixture.continuity.ReleaseMutationLease(ctx, ACPReleaseSessionLeaseRequest{Lease: *lease, Fence: fixture.fence}); err != nil {
+		t.Fatal(err)
+	}
+	baseline, err := fixture.controls.GetSessionControl(ctx, "ns", "mismatch-session")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	tests := []struct {
+		name   string
+		mutate func(*ACPAcquireSessionLeaseRequest)
+	}{
+		{name: "runtime", mutate: func(request *ACPAcquireSessionLeaseRequest) { request.RuntimeIdentity = "opencode" }},
+		{name: "configuration", mutate: func(request *ACPAcquireSessionLeaseRequest) { request.ConfigDigest = acpSessionTestDigest("profile-2") }},
+		{name: "namespace UID", mutate: func(request *ACPAcquireSessionLeaseRequest) { request.NamespaceUID = "ns-uid-recreated" }},
+		{name: "Session UID", mutate: func(request *ACPAcquireSessionLeaseRequest) { request.Session.SessionUID = "session-uid-recreated" }},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			request := acpLineageLeaseRequest(baseline, fixture.fence, "task-2")
+			test.mutate(&request)
+			if _, err := fixture.continuity.AcquireMutationLease(ctx, request); !errors.Is(err, store.ErrConflict) {
+				t.Fatalf("mismatch error = %v, want conflict", err)
+			}
+			after, err := fixture.controls.GetSessionControl(ctx, "ns", "mismatch-session")
+			if err != nil {
+				t.Fatal(err)
+			}
+			if after.Lease != nil || after.LeaseGeneration != baseline.LeaseGeneration || after.Lineage == nil || after.Lineage.RuntimeIdentity != "codex" {
+				t.Fatalf("mismatch changed Session authority: %+v", after)
+			}
+		})
+	}
+}
+
+type failOnceLineageProjection struct {
+	store.SessionLineageStore
+	fail bool
+}
+
+func (s *failOnceLineageProjection) ProjectSessionLineage(ctx context.Context, lineage store.SessionLineage) (*store.SessionLineage, error) {
+	if s.fail {
+		s.fail = false
+		return nil, errors.New("simulated SQLite projection failure")
+	}
+	return s.SessionLineageStore.ProjectSessionLineage(ctx, lineage)
+}
+
+func TestAcquireMutationLeaseRecoversProjectionAfterKubernetesCommit(t *testing.T) {
+	ctx := context.Background()
+	var projection *failOnceLineageProjection
+	fixture := newACPLineageTestFixture(t, func(delegate store.SessionLineageStore) store.SessionLineageStore {
+		projection = &failOnceLineageProjection{SessionLineageStore: delegate, fail: true}
+		return projection
+	})
+	control := fixture.ensureSession(t, "projection-recovery")
+	request := acpLineageLeaseRequest(control, fixture.fence, "task-1")
+
+	if _, err := fixture.continuity.AcquireMutationLease(ctx, request); err == nil {
+		t.Fatal("expected simulated projection failure")
+	}
+	authoritative, err := fixture.controls.GetSessionControl(ctx, "ns", "projection-recovery")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if authoritative.Lineage == nil || authoritative.Lease == nil {
+		t.Fatalf("Kubernetes must retain lineage and exact Lease after projection failure: %+v", authoritative)
+	}
+	if _, err := fixture.persistence.GetSessionLineage(ctx, "ns", "projection-recovery"); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("failed projection unexpectedly became visible: %v", err)
+	}
+
+	request.Session = *authoritative
+	recovered, err := fixture.continuity.AcquireMutationLease(ctx, request)
+	if err != nil {
+		t.Fatalf("retry exact authoritative Lease: %v", err)
+	}
+	if recovered.Key.LeaseGeneration != authoritative.LeaseGeneration {
+		t.Fatalf("retry advanced Lease generation: got %d want %d", recovered.Key.LeaseGeneration, authoritative.LeaseGeneration)
+	}
+	if _, err := fixture.persistence.GetSessionLineage(ctx, "ns", "projection-recovery"); err != nil {
+		t.Fatalf("projection was not recovered: %v", err)
+	}
+}
diff --git a/internal/controller/acp_session_recovery.go b/internal/controller/acp_session_recovery.go
new file mode 100644
index 000000000..0c74ae9d2
--- /dev/null
+++ b/internal/controller/acp_session_recovery.go
@@ -0,0 +1,182 @@
+package controller
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+// ACPIndependentBranchReceipt is the controller boundary for a fresh remote
+// observation performed outside the runtime Pod. Digest covers the exact
+// repository, ref, SHA, operation, and observation time.
+type ACPIndependentBranchReceipt struct {
+	OperationID  string
+	RepositoryID string
+	Ref          string
+	SHA          string
+	VerifiedAt   time.Time
+	Digest       string
+}
+
+// NewACPIndependentBranchReceipt creates a canonical recovery receipt after an
+// independent clean-room remote observation has established the actual branch.
+func NewACPIndependentBranchReceipt(operationID, repositoryID, ref, sha string, verifiedAt time.Time) (ACPIndependentBranchReceipt, error) {
+	receipt := ACPIndependentBranchReceipt{
+		OperationID: strings.TrimSpace(operationID), RepositoryID: strings.TrimSpace(repositoryID),
+		Ref: strings.TrimSpace(ref), SHA: strings.TrimSpace(sha), VerifiedAt: verifiedAt.UTC(),
+	}
+	if receipt.VerifiedAt.IsZero() {
+		return ACPIndependentBranchReceipt{}, store.ValidationErrorf("independent branch verification time is required")
+	}
+	if err := receipt.validateIdentity(); err != nil {
+		return ACPIndependentBranchReceipt{}, err
+	}
+	digest, err := acpDomainDigest("independent-branch-verification", map[string]any{
+		"operationID": receipt.OperationID, "repositoryID": receipt.RepositoryID,
+		"ref": receipt.Ref, "sha": receipt.SHA, "verifiedAt": receipt.VerifiedAt,
+	})
+	if err != nil {
+		return ACPIndependentBranchReceipt{}, fmt.Errorf("digest independent branch receipt: %w", err)
+	}
+	receipt.Digest = digest
+	return receipt, nil
+}
+
+func (r ACPIndependentBranchReceipt) validate() error {
+	if err := r.validateIdentity(); err != nil {
+		return err
+	}
+	if r.VerifiedAt.IsZero() {
+		return store.ValidationErrorf("independent branch verification time is required")
+	}
+	expected, err := NewACPIndependentBranchReceipt(r.OperationID, r.RepositoryID, r.Ref, r.SHA, r.VerifiedAt)
+	if err != nil {
+		return err
+	}
+	if r.Digest != expected.Digest {
+		return store.ValidationErrorf("independent branch verification digest does not match receipt")
+	}
+	return nil
+}
+
+func (r ACPIndependentBranchReceipt) validateIdentity() error {
+	if err := store.ValidateControlIdentifier("branch verification operation ID", strings.TrimSpace(r.OperationID)); err != nil {
+		return err
+	}
+	if err := store.ValidateControlIdentifier("verified repository ID", strings.TrimSpace(r.RepositoryID)); err != nil {
+		return err
+	}
+	if err := store.ValidateFullBranchRef(strings.TrimSpace(r.Ref)); err != nil {
+		return err
+	}
+	return store.ValidateGitObjectID("verified branch SHA", strings.TrimSpace(r.SHA))
+}
+
+// ACPRecoverBlockedSessionRequest supplies the immutable Session identity and a
+// fresh independent branch receipt. Store versions and generations are loaded
+// immediately before the cross-aggregate CAS reconciliation.
+type ACPRecoverBlockedSessionRequest struct {
+	Namespace   string
+	SessionName string
+	SessionUID  string
+	Fence       store.ControllerEpochFence
+	Receipt     ACPIndependentBranchReceipt
+}
+
+// RecoverBlockedSession establishes the actual remote baseline and atomically
+// returns a PublicationOutcomeUnknown/DeliveryConflict Session and BranchClaim
+// to Available. It cannot be used to bypass a missing independent receipt.
+func (c *ACPSessionContinuity) RecoverBlockedSession(ctx context.Context, request ACPRecoverBlockedSessionRequest) (*store.SessionControl, error) {
+	request.Namespace = strings.TrimSpace(request.Namespace)
+	request.SessionName = strings.TrimSpace(request.SessionName)
+	request.SessionUID = strings.TrimSpace(request.SessionUID)
+	if err := request.Receipt.validate(); err != nil {
+		return nil, err
+	}
+	control, err := c.controls.GetSessionControl(ctx, request.Namespace, request.SessionName)
+	if err != nil {
+		return nil, fmt.Errorf("load blocked ACP session: %w", err)
+	}
+	if control.SessionUID != request.SessionUID {
+		return nil, fmt.Errorf("%w: blocked ACP session UID does not match immutable record", store.ErrConflict)
+	}
+	if committedSessionReconciliationMatchesReceipt(control, request.Receipt) {
+		return c.resumeCommittedSessionReconciliation(ctx, request, control)
+	}
+	if control.Availability != store.SessionReconciliationBlocked || control.Lease != nil || control.RelatedPublicationID == "" {
+		return nil, fmt.Errorf("%w: ACP session is not a lease-free reconciliation-blocked publication", store.ErrConflict)
+	}
+	publication, err := c.publications.GetPublication(ctx, control.RelatedPublicationID)
+	if err != nil {
+		return nil, fmt.Errorf("load blocked ACP publication: %w", err)
+	}
+	if publication.State != store.PublicationOutcomeUnknown && publication.State != store.PublicationDeliveryConflict {
+		return nil, fmt.Errorf("%w: publication %q state %s is not reconciliation-blocked", store.ErrConflict, publication.ID, publication.State)
+	}
+	claim, err := c.branchClaims.GetBranchClaim(ctx, publication.BranchClaimID)
+	if err != nil {
+		return nil, fmt.Errorf("load blocked ACP branch claim: %w", err)
+	}
+	if request.Receipt.RepositoryID != publication.TargetRepositoryID || request.Receipt.RepositoryID != claim.RepositoryID ||
+		request.Receipt.Ref != publication.TargetRef || request.Receipt.Ref != claim.Ref {
+		return nil, fmt.Errorf("%w: independent branch receipt does not match the blocked publication target", store.ErrConflict)
+	}
+	operationDigest, err := acpDomainDigest("session-reconciliation", map[string]any{
+		"sessionUID": control.SessionUID, "publicationID": publication.ID,
+		"branchClaimID": claim.ID, "receiptDigest": request.Receipt.Digest,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("digest ACP session reconciliation: %w", err)
+	}
+	claimBlocked := claim.Availability == store.BranchClaimReconciliationBlocked && claim.RelatedPublicationID == publication.ID
+	claimAlreadyAdvanced := claim.LastOperationID == request.Receipt.OperationID && claim.LastOperationDigest == operationDigest &&
+		claim.Availability == store.BranchClaimAvailable && claim.RelatedPublicationID == "" && claim.BlockedReason == "" &&
+		claim.LastVerified.Equal(store.RemoteRefState{SHA: request.Receipt.SHA})
+	if !claimBlocked && !claimAlreadyAdvanced {
+		return nil, fmt.Errorf("%w: branch claim %q is neither blocked by publication %q nor advanced by the same reconciliation intent", store.ErrConflict, claim.ID, publication.ID)
+	}
+	return c.controls.ReconcileSessionControl(ctx, store.ReconcileSessionControlRequest{
+		Namespace: control.Namespace, SessionName: control.SessionName, SessionUID: control.SessionUID,
+		Fence: request.Fence, ExpectedVersion: control.Version, ExpectedLeaseGeneration: control.LeaseGeneration,
+		ExpectedRelatedPublicationID: publication.ID, BranchClaimID: claim.ID,
+		ExpectedBranchClaimVersion: claim.Version, ExpectedBranchClaimGeneration: claim.Generation,
+		ExpectedBranchBaseline: claim.LastVerified,
+		VerifiedBaseline: store.VerifiedBranchBaseline{
+			RepositoryID: request.Receipt.RepositoryID, Ref: request.Receipt.Ref, SHA: request.Receipt.SHA,
+		},
+		OperationID: request.Receipt.OperationID, OperationDigest: operationDigest,
+		ReconciledAt: request.Receipt.VerifiedAt,
+	})
+}
+
+func committedSessionReconciliationMatchesReceipt(control *store.SessionControl, receipt ACPIndependentBranchReceipt) bool {
+	return control.Availability == store.SessionAvailable && control.Lease == nil && control.LastOperationID == receipt.OperationID &&
+		control.VerifiedBaseline != nil && sameWorkspaceRepositoryIdentity(control.VerifiedBaseline.RepositoryID, receipt.RepositoryID) &&
+		control.VerifiedBaseline.Ref == receipt.Ref && control.VerifiedBaseline.SHA == receipt.SHA
+}
+
+func (c *ACPSessionContinuity) resumeCommittedSessionReconciliation(ctx context.Context, request ACPRecoverBlockedSessionRequest, control *store.SessionControl) (*store.SessionControl, error) {
+	claimID, err := store.CanonicalBranchClaimID(request.Receipt.RepositoryID, request.Receipt.Ref)
+	if err != nil {
+		return nil, err
+	}
+	claim, err := c.branchClaims.GetBranchClaim(ctx, claimID)
+	if err != nil {
+		return nil, fmt.Errorf("load committed ACP branch reconciliation: %w", err)
+	}
+	if claim.LastOperationID != request.Receipt.OperationID || claim.LastOperationDigest != control.LastOperationDigest ||
+		claim.Availability != store.BranchClaimAvailable || claim.LastVerified.SHA != request.Receipt.SHA {
+		return nil, fmt.Errorf("%w: committed ACP session reconciliation does not match its BranchClaim", store.ErrConflict)
+	}
+	return c.controls.ReconcileSessionControl(ctx, store.ReconcileSessionControlRequest{
+		Namespace: control.Namespace, SessionName: control.SessionName, SessionUID: control.SessionUID,
+		Fence: request.Fence, ExpectedVersion: control.Version, ExpectedLeaseGeneration: control.LeaseGeneration,
+		BranchClaimID: claim.ID, ExpectedBranchClaimVersion: claim.Version,
+		ExpectedBranchClaimGeneration: claim.Generation, ExpectedBranchBaseline: claim.LastVerified,
+		VerifiedBaseline: *control.VerifiedBaseline, OperationID: request.Receipt.OperationID,
+		OperationDigest: control.LastOperationDigest, ReconciledAt: request.Receipt.VerifiedAt,
+	})
+}
diff --git a/internal/controller/acp_session_recovery_test.go b/internal/controller/acp_session_recovery_test.go
new file mode 100644
index 000000000..f77aa0e61
--- /dev/null
+++ b/internal/controller/acp_session_recovery_test.go
@@ -0,0 +1,133 @@
+package controller
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+func TestRecoverBlockedSessionResumesAfterBranchIntentCommitted(t *testing.T) {
+	verifiedAt := time.Date(2026, 7, 25, 13, 0, 0, 0, time.UTC)
+	receipt, err := NewACPIndependentBranchReceipt(
+		"reconcile-session", "repo-id", "refs/heads/session", acpSessionTestSHA2, verifiedAt,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	operationDigest, err := acpDomainDigest("session-reconciliation", map[string]any{
+		"sessionUID": "session-uid", "publicationID": "publication-id",
+		"branchClaimID": "branch-claim-id", "receiptDigest": receipt.Digest,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	fixture := &blockedSessionRecoveryStore{
+		control: store.SessionControl{
+			Namespace: "default", SessionName: "session", SessionUID: "session-uid",
+			Availability: store.SessionReconciliationBlocked, LeaseGeneration: 1,
+			RelatedPublicationID: "publication-id", Version: 4,
+		},
+		publication: store.Publication{
+			ID: "publication-id", State: store.PublicationOutcomeUnknown,
+			BranchClaimID: "branch-claim-id", TargetRepositoryID: receipt.RepositoryID, TargetRef: receipt.Ref,
+		},
+		claim: store.BranchClaim{
+			ID: "branch-claim-id", RepositoryID: receipt.RepositoryID, Ref: receipt.Ref,
+			Generation: 2, Version: 8, LastVerified: store.RemoteRefState{SHA: receipt.SHA},
+			Availability: store.BranchClaimAvailable, LastOperationID: receipt.OperationID,
+			LastOperationDigest: operationDigest,
+		},
+	}
+	continuity := &ACPSessionContinuity{controls: fixture, publications: fixture, branchClaims: fixture}
+	fence := store.ControllerEpochFence{Name: store.DefaultControllerEpochName, Epoch: 3, HolderID: "controller-new"}
+	recovered, err := continuity.RecoverBlockedSession(context.Background(), ACPRecoverBlockedSessionRequest{
+		Namespace: "default", SessionName: "session", SessionUID: "session-uid", Fence: fence, Receipt: receipt,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if recovered.Availability != store.SessionAvailable || recovered.VerifiedBaseline == nil || recovered.VerifiedBaseline.SHA != receipt.SHA {
+		t.Fatalf("recovered SessionControl = %#v", recovered)
+	}
+	if fixture.reconcile == nil || fixture.reconcile.OperationDigest != operationDigest ||
+		fixture.reconcile.ExpectedBranchClaimVersion != fixture.claim.Version ||
+		fixture.reconcile.ExpectedBranchBaseline != fixture.claim.LastVerified {
+		t.Fatalf("reconciliation request did not preserve the committed intent: %#v", fixture.reconcile)
+	}
+}
+
+type blockedSessionRecoveryStore struct {
+	store.DurableControlStore
+	control     store.SessionControl
+	publication store.Publication
+	claim       store.BranchClaim
+	reconcile   *store.ReconcileSessionControlRequest
+}
+
+func (s *blockedSessionRecoveryStore) GetSessionControl(_ context.Context, namespace, sessionName string) (*store.SessionControl, error) {
+	if namespace != s.control.Namespace || sessionName != s.control.SessionName {
+		return nil, store.ErrNotFound
+	}
+	value := s.control
+	return &value, nil
+}
+
+func (s *blockedSessionRecoveryStore) GetPublication(_ context.Context, id string) (*store.Publication, error) {
+	if id != s.publication.ID {
+		return nil, store.ErrNotFound
+	}
+	value := s.publication
+	return &value, nil
+}
+
+func (s *blockedSessionRecoveryStore) GetBranchClaim(_ context.Context, id string) (*store.BranchClaim, error) {
+	if id != s.claim.ID {
+		return nil, store.ErrNotFound
+	}
+	value := s.claim
+	return &value, nil
+}
+
+func (s *blockedSessionRecoveryStore) ReconcileSessionControl(_ context.Context, request store.ReconcileSessionControlRequest) (*store.SessionControl, error) {
+	s.reconcile = &request
+	value := s.control
+	value.Availability = store.SessionAvailable
+	value.BlockedReason = ""
+	value.RelatedPublicationID = ""
+	value.VerifiedBaseline = &request.VerifiedBaseline
+	return &value, nil
+}
+
+func TestRecoverBlockedSessionFinishesCommittedStatusLeaseTail(t *testing.T) {
+	verifiedAt := time.Date(2026, 7, 25, 14, 0, 0, 0, time.UTC)
+	receipt, err := NewACPIndependentBranchReceipt("reconcile-tail", "repo-tail", "refs/heads/session", acpSessionTestSHA2, verifiedAt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	digest := acpSessionTestDigest("reconcile-tail-digest")
+	fixture := &blockedSessionRecoveryStore{
+		control: store.SessionControl{
+			Namespace: "default", SessionName: "session-tail", SessionUID: "session-tail-uid",
+			Availability: store.SessionAvailable, LeaseGeneration: 2, Version: 5,
+			VerifiedBaseline: &store.VerifiedBranchBaseline{RepositoryID: receipt.RepositoryID, Ref: receipt.Ref, SHA: receipt.SHA},
+			LastOperationID:  receipt.OperationID, LastOperationDigest: digest,
+		},
+		claim: store.BranchClaim{
+			ID: store.CanonicalControlID("branch-claim", receipt.RepositoryID, receipt.Ref), RepositoryID: receipt.RepositoryID, Ref: receipt.Ref,
+			Generation: 1, Version: 4, LastVerified: store.RemoteRefState{SHA: receipt.SHA}, Availability: store.BranchClaimAvailable,
+			LastOperationID: receipt.OperationID, LastOperationDigest: digest,
+		},
+	}
+	continuity := &ACPSessionContinuity{controls: fixture, publications: fixture, branchClaims: fixture}
+	if _, err := continuity.RecoverBlockedSession(context.Background(), ACPRecoverBlockedSessionRequest{
+		Namespace: fixture.control.Namespace, SessionName: fixture.control.SessionName, SessionUID: fixture.control.SessionUID,
+		Fence: store.ControllerEpochFence{Name: store.DefaultControllerEpochName, Epoch: 3, HolderID: "controller"}, Receipt: receipt,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if fixture.reconcile == nil || fixture.reconcile.ExpectedRelatedPublicationID != "" || fixture.reconcile.OperationDigest != digest {
+		t.Fatalf("committed reconciliation tail request = %#v", fixture.reconcile)
+	}
+}
diff --git a/internal/controller/acp_session_runtime.go b/internal/controller/acp_session_runtime.go
new file mode 100644
index 000000000..9f76c1960
--- /dev/null
+++ b/internal/controller/acp_session_runtime.go
@@ -0,0 +1,168 @@
+package controller
+
+import (
+	"fmt"
+	"math"
+	"strings"
+
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+const maxControllerRuntimeSessionGeneration = uint64(math.MaxInt64)
+
+// ACPRuntimeSessionBinding is the controller-owned durable identity projected
+// into RuntimeSession status. Generation is incremented whenever the provider
+// session must be recreated rather than transparently recovered.
+type ACPRuntimeSessionBinding struct {
+	SessionUID         string
+	Generation         uint64
+	ProfileDigest      harnessv2.ProfileDigest
+	RuntimeInstanceID  harnessv2.RuntimeInstanceID
+	SupervisorBootID   harnessv2.SupervisorBootID
+	WorkspaceDigest    string
+	MCPDigest          string
+	RecreationRequired bool
+}
+
+// ACPRuntimeSessionPlan explains whether the supervisor session can be reused
+// or must be recreated from the verified branch plus bounded transcript.
+type ACPRuntimeSessionPlan struct {
+	Binding           ACPRuntimeSessionBinding
+	Recreate          bool
+	BootstrapRequired bool
+	Reason            string
+}
+
+// PlanACPRuntimeSession selects the next monotonic RuntimeSession generation.
+// A profile rotation or proven runtime loss increments exactly once and always
+// requires canonical bootstrap; unchanged live state is reused.
+func PlanACPRuntimeSession(
+	session store.SessionControl,
+	current *ACPRuntimeSessionBinding,
+	desiredProfileDigest harnessv2.ProfileDigest,
+	desiredMCPDigest string,
+	desiredRuntimeInstanceID harnessv2.RuntimeInstanceID,
+	desiredSupervisorBootID harnessv2.SupervisorBootID,
+) (ACPRuntimeSessionPlan, error) {
+	if err := store.ValidateControlIdentifier("ACP runtime session UID", strings.TrimSpace(session.SessionUID)); err != nil {
+		return ACPRuntimeSessionPlan{}, err
+	}
+	if session.Availability != store.SessionAvailable {
+		return ACPRuntimeSessionPlan{}, fmt.Errorf("%w: ACP runtime session is reconciliation-blocked", store.ErrConflict)
+	}
+	if err := harnessv2.ValidateProfileDigest(desiredProfileDigest); err != nil {
+		return ACPRuntimeSessionPlan{}, fmt.Errorf("desired ACP runtime profile digest: %w", err)
+	}
+	if err := store.ValidateCanonicalDigest("desired ACP runtime MCP digest", desiredMCPDigest); err != nil {
+		return ACPRuntimeSessionPlan{}, err
+	}
+	if current == nil {
+		return ACPRuntimeSessionPlan{
+			Binding: ACPRuntimeSessionBinding{
+				SessionUID: session.SessionUID, Generation: 1, ProfileDigest: desiredProfileDigest,
+				RuntimeInstanceID: desiredRuntimeInstanceID, SupervisorBootID: desiredSupervisorBootID, MCPDigest: desiredMCPDigest,
+			},
+			Recreate: true, BootstrapRequired: true, Reason: "initial-runtime-session",
+		}, nil
+	}
+	if current.SessionUID != session.SessionUID {
+		return ACPRuntimeSessionPlan{}, fmt.Errorf("%w: runtime session UID %q does not match durable Session UID %q",
+			store.ErrConflict, current.SessionUID, session.SessionUID)
+	}
+	if current.Generation == 0 {
+		return ACPRuntimeSessionPlan{}, store.ValidationErrorf("current ACP runtime session generation must be at least 1")
+	}
+	if current.Generation > maxControllerRuntimeSessionGeneration {
+		return ACPRuntimeSessionPlan{}, store.ValidationErrorf("current ACP runtime session generation exceeds durable Task status capacity")
+	}
+	if err := harnessv2.ValidateProfileDigest(current.ProfileDigest); err != nil {
+		return ACPRuntimeSessionPlan{}, fmt.Errorf("current ACP runtime profile digest: %w", err)
+	}
+	if current.MCPDigest != "" {
+		if err := store.ValidateCanonicalDigest("current ACP runtime MCP digest", current.MCPDigest); err != nil {
+			return ACPRuntimeSessionPlan{}, err
+		}
+	}
+	if current.RecreationRequired {
+		sameSupervisor := current.RuntimeInstanceID == desiredRuntimeInstanceID && current.SupervisorBootID == desiredSupervisorBootID
+		configurationChanged := current.ProfileDigest != desiredProfileDigest ||
+			(current.MCPDigest != "" && current.MCPDigest != desiredMCPDigest)
+		pending := *current
+		if !sameSupervisor || configurationChanged || current.MCPDigest == "" {
+			if pending.Generation >= maxControllerRuntimeSessionGeneration {
+				return ACPRuntimeSessionPlan{}, store.ValidationErrorf("ACP runtime session generation is exhausted")
+			}
+			pending.Generation++
+		}
+		pending.ProfileDigest = desiredProfileDigest
+		pending.MCPDigest = desiredMCPDigest
+		pending.RuntimeInstanceID = desiredRuntimeInstanceID
+		pending.SupervisorBootID = desiredSupervisorBootID
+		return ACPRuntimeSessionPlan{
+			Binding: pending, Recreate: true, BootstrapRequired: true, Reason: "runtime-session-recreation-pending",
+		}, nil
+	}
+	profileChanged := current.ProfileDigest != desiredProfileDigest
+	mcpChanged := current.MCPDigest == "" || current.MCPDigest != desiredMCPDigest
+	runtimeLost := current.RuntimeInstanceID != desiredRuntimeInstanceID || current.SupervisorBootID != desiredSupervisorBootID
+	if !profileChanged && !mcpChanged && !runtimeLost {
+		return ACPRuntimeSessionPlan{Binding: *current, Reason: "reuse-live-runtime-session"}, nil
+	}
+	if current.Generation == maxControllerRuntimeSessionGeneration {
+		return ACPRuntimeSessionPlan{}, store.ValidationErrorf("ACP runtime session generation is exhausted")
+	}
+	reason := "runtime-lost"
+	if profileChanged {
+		reason = "runtime-profile-rotated"
+	} else if mcpChanged {
+		reason = "runtime-mcp-rotated"
+	}
+	return ACPRuntimeSessionPlan{
+		Binding: ACPRuntimeSessionBinding{
+			SessionUID: session.SessionUID, Generation: current.Generation + 1, ProfileDigest: desiredProfileDigest,
+			RuntimeInstanceID: desiredRuntimeInstanceID, SupervisorBootID: desiredSupervisorBootID, MCPDigest: desiredMCPDigest,
+		},
+		Recreate: true, BootstrapRequired: true, Reason: reason,
+	}, nil
+}
+
+// bindACPRuntimeSessionWorkspace binds the exact prepared workspace identity to
+// a provider RuntimeSession. A live session may be reused only when repository,
+// source ref, verified baseline, intent, and relative root all match. Initial or
+// already-rotated sessions simply record the desired digest; a mismatch on a
+// reused live session advances the monotonic generation exactly once.
+func bindACPRuntimeSessionWorkspace(
+	binding ACPRuntimeSessionBinding,
+	reused bool,
+	desiredWorkspaceDigest string,
+) (ACPRuntimeSessionBinding, bool, error) {
+	desiredWorkspaceDigest = strings.TrimSpace(desiredWorkspaceDigest)
+	if err := store.ValidateCanonicalDigest("desired ACP runtime workspace digest", desiredWorkspaceDigest); err != nil {
+		return ACPRuntimeSessionBinding{}, false, err
+	}
+	if binding.WorkspaceDigest != "" {
+		if err := store.ValidateCanonicalDigest("current ACP runtime workspace digest", binding.WorkspaceDigest); err != nil {
+			return ACPRuntimeSessionBinding{}, false, err
+		}
+	}
+	if binding.WorkspaceDigest == desiredWorkspaceDigest {
+		return binding, false, nil
+	}
+	if binding.RecreationRequired && binding.WorkspaceDigest != "" {
+		if binding.Generation >= maxControllerRuntimeSessionGeneration {
+			return ACPRuntimeSessionBinding{}, false, store.ValidationErrorf("ACP runtime session generation is exhausted")
+		}
+		binding.Generation++
+		binding.WorkspaceDigest = desiredWorkspaceDigest
+		return binding, false, nil
+	}
+	if reused {
+		if binding.Generation >= maxControllerRuntimeSessionGeneration {
+			return ACPRuntimeSessionBinding{}, false, store.ValidationErrorf("ACP runtime session generation is exhausted")
+		}
+		binding.Generation++
+	}
+	binding.WorkspaceDigest = desiredWorkspaceDigest
+	return binding, reused, nil
+}
diff --git a/internal/controller/acp_session_test.go b/internal/controller/acp_session_test.go
new file mode 100644
index 000000000..0d5355043
--- /dev/null
+++ b/internal/controller/acp_session_test.go
@@ -0,0 +1,860 @@
+package controller
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/store"
+	"github.com/orka-agents/orka/internal/store/sqlite"
+	"github.com/orka-agents/orka/internal/taskterminal"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+const (
+	acpSessionTestSHA  = "0123456789012345678901234567890123456789"
+	acpSessionTestSHA2 = "abcdefabcdefabcdefabcdefabcdefabcdefabcd"
+)
+
+func TestTaskSessionProjectionExecutionPreservesFrozenIdentity(t *testing.T) {
+	transition := metav1.NewTime(time.Date(2026, 8, 11, 22, 9, 40, 0, time.UTC))
+	execution := &corev1alpha1.TaskExecutionStatus{
+		State: corev1alpha1.TaskExecutionStateRunning, Attempt: 1, PromptID: "prompt-session-terminal",
+		RuntimePoolName: "codex-pool", RuntimePoolUID: "pool-uid", RuntimeInstanceID: "runtime-instance",
+		RuntimeSessionUID: "session-uid", RuntimeSessionGeneration: 3, RuntimeSessionSupervisorBootID: "boot-id",
+		RuntimeSessionProfileDigest: acpSessionTestDigest("profile"), RuntimeSessionMCPDigest: acpSessionTestDigest("mcp"),
+		RuntimeSessionWorkspaceDigest: acpSessionTestDigest("workspace"), RuntimeSessionRecreationPending: true,
+		RuntimeSessionCleanupDigest: acpSessionTestDigest("cleanup"), RequestDigest: acpSessionTestDigest("request"),
+		ControllerEpoch: 7, ReadCredentialResourceVersion: "read-rv", PublicationReadCredentialResourceVersion: "target-read-rv",
+		PublicationCredentialResourceVersion: "target-write-rv", ForgeCredentialResourceVersion: "forge-rv",
+		Message: "running", LastTransitionTime: &transition,
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "orka-system", Name: "session-terminal", UID: types.UID("task-session-terminal")},
+		Spec: corev1alpha1.TaskSpec{
+			Type:       corev1alpha1.TaskTypeAgent,
+			SessionRef: &corev1alpha1.SessionReference{Name: "session-transcript", Create: true},
+		},
+		Status: corev1alpha1.TaskStatus{
+			Phase: corev1alpha1.TaskPhaseCancelled, Execution: execution,
+			Delivery: &corev1alpha1.TaskDeliveryStatus{
+				State: corev1alpha1.TaskDeliveryStateNotRequested, Outcome: corev1alpha1.TaskDeliveryOutcomeNotRequested,
+			},
+		},
+	}
+	terminal := corev1alpha1.TaskExecutionStatus{
+		State: corev1alpha1.TaskExecutionStateCancelled, Outcome: corev1alpha1.TaskExecutionOutcomeCancelled,
+		Attempt: 1, PromptID: execution.PromptID, Reason: "Cancelled", Message: "prompt cancelled",
+	}
+	projected, err := taskSessionProjectionExecution(task, terminal)
+	if err != nil {
+		t.Fatalf("taskSessionProjectionExecution() error = %v", err)
+	}
+	expected := *execution.DeepCopy()
+	expected.State = terminal.State
+	expected.Outcome = terminal.Outcome
+	expected.Reason = terminal.Reason
+	expected.Message = terminal.Message
+	if !reflect.DeepEqual(projected, expected) {
+		t.Fatalf("projected execution = %#v, want %#v", projected, expected)
+	}
+	attempt := &store.PromptAttempt{
+		ID: "prompt-attempt-session-terminal",
+		Key: store.PromptAttemptKey{
+			Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: execution.PromptID,
+		},
+		RequestDigest: execution.RequestDigest, RuntimeInstanceID: execution.RuntimeInstanceID,
+		SessionUID: execution.RuntimeSessionUID, SessionLeaseGeneration: execution.RuntimeSessionGeneration,
+		ExecutionState: store.PromptExecutionCancelled, DeliveryState: store.PromptDeliveryNotRequested,
+	}
+	payload, err := json.Marshal(taskTerminalProjection{
+		Namespace: task.Namespace, Task: task.Name, TaskUID: string(task.UID), Attempt: 1,
+		Phase: task.Status.Phase, Execution: projected, Delivery: task.Status.Delivery,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := taskterminal.ValidateRestoredProjection(payload, task, string(task.UID), attempt); err != nil {
+		t.Fatalf("new Session terminal projection failed reclamation validation: %v", err)
+	}
+
+	terminal.Attempt = 2
+	if _, err := taskSessionProjectionExecution(task, terminal); err == nil {
+		t.Fatal("mismatched terminal attempt was accepted")
+	}
+}
+
+func TestACPSessionContinuityConcurrentLeaseDenial(t *testing.T) {
+	ctx := context.Background()
+	s, fence, closeStore := newACPSessionTestStore(t, filepath.Join(t.TempDir(), "concurrent.db"))
+	defer closeStore()
+	continuity := newACPSessionTestContinuity(t, s, ACPBootstrapLimits{})
+	control := ensureACPSessionForTest(t, continuity, fence, "concurrent")
+
+	start := make(chan struct{})
+	results := make(chan error, 2)
+	for _, taskUID := range []string{"task-a", "task-b"} {
+		go func() {
+			<-start
+			_, err := continuity.AcquireMutationLease(ctx, ACPAcquireSessionLeaseRequest{
+				Session: *control, Fence: fence, TaskUID: taskUID, Attempt: 1,
+				PromptID: "prompt-" + taskUID, PromptRequestDigest: acpSessionTestDigest("prompt-" + taskUID),
+				AcquiredAt: time.Date(2026, 7, 24, 17, 0, 0, 0, time.UTC),
+			})
+			results <- err
+		}()
+	}
+	close(start)
+	var succeeded, conflicted int
+	for range 2 {
+		err := <-results
+		switch {
+		case err == nil:
+			succeeded++
+		case errors.Is(err, store.ErrConflict):
+			conflicted++
+		default:
+			t.Fatalf("lease result error = %v", err)
+		}
+	}
+	if succeeded != 1 || conflicted != 1 {
+		t.Fatalf("lease results succeeded=%d conflicted=%d", succeeded, conflicted)
+	}
+	current, err := s.GetSessionControl(ctx, control.Namespace, control.SessionName)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if current.LeaseGeneration != 1 || current.Lease == nil {
+		t.Fatalf("current lease = %#v", current)
+	}
+}
+
+func TestACPSessionContinuityRejectsStaleLeaseGeneration(t *testing.T) {
+	ctx := context.Background()
+	s, fence, closeStore := newACPSessionTestStore(t, filepath.Join(t.TempDir(), "stale.db"))
+	defer closeStore()
+	continuity := newACPSessionTestContinuity(t, s, ACPBootstrapLimits{})
+	control := ensureACPSessionForTest(t, continuity, fence, "stale")
+	turn, attempt := openACPSessionTurnForTest(t, continuity, s, fence, control, "task-stale", "prompt-stale", "first prompt")
+	completeACPAttemptExecutionForTest(t, s, fence, attempt, true)
+	finalized, err := continuity.FinalizeOutcomeUnknown(ctx, ACPFinalizeOutcomeUnknownRequest{
+		SessionTurn: *turn, Fence: fence, Reason: "runtime settlement could not be proven",
+		Projection:  acpSessionProjectionForTest("stale-final", "OutcomeUnknown"),
+		FinalizedAt: time.Date(2026, 7, 24, 17, 5, 0, 0, time.UTC),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	stale := finalized.Session
+	stale.LeaseGeneration--
+	if _, err := continuity.AcquireMutationLease(ctx, ACPAcquireSessionLeaseRequest{
+		Session: stale, Fence: fence, TaskUID: "task-next", Attempt: 1, PromptID: "prompt-next",
+		PromptRequestDigest: acpSessionTestDigest("prompt-next"),
+	}); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("stale generation error = %v, want ErrConflict", err)
+	}
+}
+
+func TestACPSessionContinuityRestartContinuity(t *testing.T) {
+	ctx := context.Background()
+	path := filepath.Join(t.TempDir(), "restart.db")
+	s, fence, closeStore := newACPSessionTestStore(t, path)
+	continuity := newACPSessionTestContinuity(t, s, ACPBootstrapLimits{})
+	control := ensureACPSessionForTest(t, continuity, fence, "restart")
+	turn, attempt := openACPSessionTurnForTest(t, continuity, s, fence, control, "task-restart", "prompt-restart", "remember this")
+	completeACPAttemptExecutionForTest(t, s, fence, attempt, false)
+	finalized, err := continuity.FinalizeAssistantResult(ctx, ACPFinalizeAssistantRequest{
+		SessionTurn: *turn, Fence: fence, AssistantResult: "durable answer",
+		Projection:  acpSessionProjectionForTest("restart-final", "Succeeded"),
+		FinalizedAt: time.Date(2026, 7, 24, 17, 10, 0, 0, time.UTC),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	before, err := continuity.BuildBootstrapTranscript(ctx, finalized.Session)
+	if err != nil {
+		t.Fatal(err)
+	}
+	closeStore()
+
+	db, err := sqlite.NewDB(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	restartedStore := sqlite.NewStore(db, path)
+	fence = advanceACPSessionTestEpoch(t, restartedStore, "controller-restarted")
+	restarted := newACPSessionTestContinuity(t, restartedStore, ACPBootstrapLimits{})
+	loaded, err := restarted.EnsureSession(ctx, ACPEnsureSessionRequest{
+		Namespace: "ns", SessionName: "restart", SessionType: "task",
+		ExpectedSessionUID: control.SessionUID, Fence: fence,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if loaded.SessionUID != control.SessionUID {
+		t.Fatalf("restarted Session UID = %q, want %q", loaded.SessionUID, control.SessionUID)
+	}
+	after, err := restarted.BuildBootstrapTranscript(ctx, *loaded)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if after.Digest != before.Digest || string(after.Artifact) != string(before.Artifact) || after.MessageCount != 2 {
+		t.Fatalf("restart bootstrap changed: before=%#v after=%#v", before, after)
+	}
+	profile := harnessv2.ProfileDigest(acpSessionTestDigest("profile-a"))
+	mcpDigest := acpSessionTestDigest("mcp-a")
+	plan, err := PlanACPRuntimeSession(*loaded, &ACPRuntimeSessionBinding{
+		SessionUID: loaded.SessionUID, Generation: 1, ProfileDigest: profile, MCPDigest: mcpDigest,
+		RuntimeInstanceID: "old-instance", SupervisorBootID: "old-boot",
+	}, profile, mcpDigest, "new-instance", "new-boot")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if plan.Binding.Generation != 2 || !plan.Recreate || !plan.BootstrapRequired || plan.Reason != "runtime-lost" {
+		t.Fatalf("runtime-loss plan = %#v", plan)
+	}
+}
+
+//nolint:goconst // Repeated role literals make transcript assertions explicit.
+func TestACPSessionContinuityOutcomeUnknownMarkerHasNoAssistantContent(t *testing.T) {
+	ctx := context.Background()
+	s, fence, closeStore := newACPSessionTestStore(t, filepath.Join(t.TempDir(), "unknown.db"))
+	defer closeStore()
+	continuity := newACPSessionTestContinuity(t, s, ACPBootstrapLimits{})
+	control := ensureACPSessionForTest(t, continuity, fence, "unknown")
+	turn, attempt := openACPSessionTurnForTest(t, continuity, s, fence, control, "task-unknown", "prompt-unknown", "do not replay")
+	completeACPAttemptExecutionForTest(t, s, fence, attempt, true)
+	result, err := continuity.FinalizeOutcomeUnknown(ctx, ACPFinalizeOutcomeUnknownRequest{
+		SessionTurn: *turn, Fence: fence, Reason: "ambiguous prompt acceptance",
+		Projection: acpSessionProjectionForTest("unknown-final", "OutcomeUnknown"),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	transcript, err := s.LoadTranscript(ctx, control.Namespace, control.SessionName, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(transcript) != 2 || transcript[0].Role != "user" || transcript[1].Role != "system" {
+		t.Fatalf("OutcomeUnknown transcript = %#v", transcript)
+	}
+	for _, message := range transcript {
+		if message.Role == "assistant" {
+			t.Fatalf("invented assistant transcript entry: %#v", message)
+		}
+	}
+	var marker acpOutcomeUnknownMarker
+	if err := json.Unmarshal([]byte(transcript[1].Content), &marker); err != nil {
+		t.Fatal(err)
+	}
+	if marker.Kind != "OutcomeUnknown" || marker.AssistantResultRecorded || marker.Reason != "ambiguous prompt acceptance" {
+		t.Fatalf("outcome marker = %#v", marker)
+	}
+	if result.Session.Lease != nil || result.Session.Availability != store.SessionAvailable {
+		t.Fatalf("resolved unknown prompt session = %#v", result.Session)
+	}
+}
+
+//nolint:gocyclo // The table of generation-rotation invariants is intentionally exercised together.
+func TestPlanACPRuntimeSessionProfileGenerationRotation(t *testing.T) {
+	session := store.SessionControl{SessionUID: "immutable-session", Availability: store.SessionAvailable}
+	profileA := harnessv2.ProfileDigest(acpSessionTestDigest("profile-a"))
+	profileB := harnessv2.ProfileDigest(acpSessionTestDigest("profile-b"))
+	mcpA := acpSessionTestDigest("mcp-a")
+	mcpB := acpSessionTestDigest("mcp-b")
+	initial, err := PlanACPRuntimeSession(session, nil, profileA, mcpA, "instance-a", "boot-a")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if initial.Binding.Generation != 1 || !initial.Recreate || !initial.BootstrapRequired {
+		t.Fatalf("initial plan = %#v", initial)
+	}
+	reused, err := PlanACPRuntimeSession(session, &initial.Binding, profileA, mcpA, "instance-a", "boot-a")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if reused.Binding.Generation != 1 || reused.Recreate || reused.BootstrapRequired {
+		t.Fatalf("reuse plan = %#v", reused)
+	}
+	rotated, err := PlanACPRuntimeSession(session, &initial.Binding, profileB, mcpA, "instance-a", "boot-a")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if rotated.Binding.Generation != 2 || rotated.Binding.ProfileDigest != profileB || !rotated.Recreate || !rotated.BootstrapRequired || rotated.Reason != "runtime-profile-rotated" {
+		t.Fatalf("rotated plan = %#v", rotated)
+	}
+	mcpRotated, err := PlanACPRuntimeSession(session, &initial.Binding, profileA, mcpB, "instance-a", "boot-a")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if mcpRotated.Binding.Generation != 2 || mcpRotated.Binding.MCPDigest != mcpB ||
+		!mcpRotated.Recreate || mcpRotated.Reason != "runtime-mcp-rotated" {
+		t.Fatalf("MCP rotation plan = %#v", mcpRotated)
+	}
+	pendingBinding := rotated.Binding
+	pendingBinding.Generation = 7
+	pendingBinding.WorkspaceDigest = acpSessionTestDigest("pending-workspace")
+	pendingBinding.RecreationRequired = true
+	pending, err := PlanACPRuntimeSession(session, &pendingBinding, profileA, mcpA, "instance-b", "boot-b")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if pending.Binding.Generation != pendingBinding.Generation+1 || !pending.Binding.RecreationRequired ||
+		pending.Binding.ProfileDigest != profileA || pending.Binding.RuntimeInstanceID != "instance-b" ||
+		pending.Binding.SupervisorBootID != "boot-b" || !pending.Recreate || !pending.BootstrapRequired ||
+		pending.Reason != "runtime-session-recreation-pending" {
+		t.Fatalf("pending recreation plan = %#v", pending)
+	}
+	sameSupervisorRotated, err := PlanACPRuntimeSession(
+		session, &pendingBinding, profileA, mcpA, pendingBinding.RuntimeInstanceID, pendingBinding.SupervisorBootID,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if sameSupervisorRotated.Binding.Generation != pendingBinding.Generation+1 || !sameSupervisorRotated.Recreate {
+		t.Fatalf("same-supervisor pending rotation plan = %#v", sameSupervisorRotated)
+	}
+	bootRotated, err := PlanACPRuntimeSession(
+		session, &pendingBinding, pendingBinding.ProfileDigest, pendingBinding.MCPDigest, pendingBinding.RuntimeInstanceID, "replacement-boot",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if bootRotated.Binding.Generation != pendingBinding.Generation+1 || !bootRotated.Recreate {
+		t.Fatalf("boot-only pending recreation plan = %#v", bootRotated)
+	}
+	exhaustedPending := pendingBinding
+	exhaustedPending.Generation = maxControllerRuntimeSessionGeneration
+	if _, err := PlanACPRuntimeSession(session, &exhaustedPending, profileB, mcpA, "replacement-instance", "replacement-boot"); err == nil {
+		t.Fatal("pending recreation migrated an exhausted generation to a replacement runtime")
+	}
+}
+
+func TestRuntimeSessionBindingFromTaskStatus(t *testing.T) {
+	digest := acpSessionTestDigest("persisted-workspace")
+	profileDigest := harnessv2.ProfileDigest(acpSessionTestDigest("profile"))
+	mcpDigest := acpSessionTestDigest("mcp")
+	task := &corev1alpha1.Task{Status: corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{
+		RuntimeInstanceID:               "old-instance",
+		RuntimeSessionUID:               "session-uid",
+		RuntimeSessionGeneration:        7,
+		RuntimeSessionSupervisorBootID:  "old-boot",
+		RuntimeSessionProfileDigest:     string(profileDigest),
+		RuntimeSessionMCPDigest:         mcpDigest,
+		RuntimeSessionWorkspaceDigest:   digest,
+		RuntimeSessionRecreationPending: true,
+	}}}
+	binding, err := runtimeSessionBindingFromTaskStatus(
+		task, "session-uid", harnessv2.ProfileDigest(acpSessionTestDigest("new-profile")), "new-instance", "new-boot",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if binding == nil || binding.Generation != 7 || binding.RuntimeInstanceID != "old-instance" ||
+		binding.SupervisorBootID != "old-boot" || binding.ProfileDigest != profileDigest ||
+		binding.MCPDigest != mcpDigest || binding.WorkspaceDigest != digest || !binding.RecreationRequired {
+		t.Fatalf("persisted RuntimeSession binding = %#v", binding)
+	}
+}
+
+func TestACPRuntimeSessionWorkspaceBindingRotation(t *testing.T) {
+	base := harnessv2.WorkspaceSpec{
+		Intent: harnessv2.WorkspaceIntentRead,
+		Baseline: harnessv2.WorkspaceBaseline{
+			RepositoryIdentity: "github.com/orka-agents/orka",
+			Revision:           acpSessionTestSHA,
+			TreeDigest:         acpSessionTestDigest("workspace-tree"),
+		},
+		RelativeRoot: "website",
+	}
+	baseDigest, err := acpRuntimeWorkspaceBindingDigest("refs/heads/main", base)
+	if err != nil {
+		t.Fatal(err)
+	}
+	changedRefDigest, err := acpRuntimeWorkspaceBindingDigest("refs/heads/release", base)
+	if err != nil {
+		t.Fatal(err)
+	}
+	changedRepository := base
+	changedRepository.Baseline.RepositoryIdentity = "github.com/orka-agents/other"
+	changedRepositoryDigest, err := acpRuntimeWorkspaceBindingDigest("refs/heads/main", changedRepository)
+	if err != nil {
+		t.Fatal(err)
+	}
+	changedBaseline := base
+	changedBaseline.Baseline.Revision = acpSessionTestSHA2
+	changedBaselineDigest, err := acpRuntimeWorkspaceBindingDigest("refs/heads/main", changedBaseline)
+	if err != nil {
+		t.Fatal(err)
+	}
+	changedRoot := base
+	changedRoot.RelativeRoot = "docs"
+	changedRootDigest, err := acpRuntimeWorkspaceBindingDigest("refs/heads/main", changedRoot)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for name, digest := range map[string]string{
+		"source ref": changedRefDigest, "repository": changedRepositoryDigest,
+		"baseline": changedBaselineDigest, "relative root": changedRootDigest,
+	} {
+		if digest == baseDigest {
+			t.Fatalf("%s change did not rotate workspace binding digest", name)
+		}
+	}
+
+	binding := ACPRuntimeSessionBinding{SessionUID: "session", Generation: 3, WorkspaceDigest: baseDigest}
+	same, rotated, err := bindACPRuntimeSessionWorkspace(binding, true, baseDigest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if rotated || same != binding {
+		t.Fatalf("matching workspace binding = %#v, rotated=%v", same, rotated)
+	}
+	updated, rotated, err := bindACPRuntimeSessionWorkspace(binding, true, changedRootDigest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !rotated || updated.Generation != 4 || updated.WorkspaceDigest != changedRootDigest {
+		t.Fatalf("changed workspace binding = %#v, rotated=%v", updated, rotated)
+	}
+	initial, rotated, err := bindACPRuntimeSessionWorkspace(
+		ACPRuntimeSessionBinding{SessionUID: "new-session", Generation: 1}, false, baseDigest,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if rotated || initial.Generation != 1 || initial.WorkspaceDigest != baseDigest {
+		t.Fatalf("initial workspace binding = %#v, rotated=%v", initial, rotated)
+	}
+	if _, _, err := bindACPRuntimeSessionWorkspace(
+		ACPRuntimeSessionBinding{SessionUID: "exhausted", Generation: maxControllerRuntimeSessionGeneration, WorkspaceDigest: baseDigest},
+		true, changedRootDigest,
+	); err == nil {
+		t.Fatal("expected workspace binding generation exhaustion")
+	}
+	pendingWorkspace, rotated, err := bindACPRuntimeSessionWorkspace(
+		ACPRuntimeSessionBinding{
+			SessionUID: "pending", Generation: 4, WorkspaceDigest: baseDigest, RecreationRequired: true,
+		}, false, changedRootDigest,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if rotated || pendingWorkspace.Generation != 5 || pendingWorkspace.WorkspaceDigest != changedRootDigest {
+		t.Fatalf("pending workspace rotation = %#v, rotated=%v", pendingWorkspace, rotated)
+	}
+}
+
+func TestPrepareRuntimeWorkspaceUsesStableEmptySessionBinding(t *testing.T) {
+	dispatcher := &ACPDispatcher{}
+	firstTask := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{UID: types.UID("empty-task-a")}}
+	secondTask := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{UID: types.UID("empty-task-b")}}
+	first, err := dispatcher.prepareRuntimeWorkspace(context.Background(), firstTask, store.ControllerEpochFence{}, &acpTaskSession{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := dispatcher.prepareRuntimeWorkspace(context.Background(), secondTask, store.ControllerEpochFence{}, &acpTaskSession{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if first.baseline.RepositoryIdentity == second.baseline.RepositoryIdentity {
+		t.Fatal("task-scoped empty workspace baselines unexpectedly share an identity")
+	}
+	if first.bindingDigest != second.bindingDigest {
+		t.Fatalf("empty Session workspace binding changed across turns: %q != %q", first.bindingDigest, second.bindingDigest)
+	}
+}
+
+func TestACPSessionContinuityBlockedSessionRecovery(t *testing.T) {
+	ctx := context.Background()
+	s, fence, closeStore := newACPSessionTestStore(t, filepath.Join(t.TempDir(), "blocked.db"))
+	defer closeStore()
+	continuity := newACPSessionTestContinuity(t, s, ACPBootstrapLimits{})
+	control := ensureACPSessionForTest(t, continuity, fence, "blocked")
+	turn, attempt := openACPSessionTurnForTest(t, continuity, s, fence, control, "task-blocked", "prompt-blocked", "publish this")
+	claim, publication := createACPOutcomeUnknownPublicationForTest(t, s, fence, turn.Lease, time.Date(2026, 7, 24, 18, 0, 0, 0, time.UTC))
+	attempt = completeACPAttemptExecutionForTest(t, s, fence, attempt, false)
+	completeACPAttemptDeliveryForTest(t, s, fence, attempt, store.PromptDeliveryPublicationOutcomeUnknown)
+	finalized, err := continuity.FinalizeAssistantResult(ctx, ACPFinalizeAssistantRequest{
+		SessionTurn: *turn, Fence: fence, AssistantResult: "the local change was prepared",
+		PublicationID: publication.ID, Projection: acpSessionProjectionForTest("blocked-final", "PublicationOutcomeUnknown"),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if finalized.Session.Availability != store.SessionReconciliationBlocked || finalized.Session.Lease != nil || finalized.Session.VerifiedBaseline != nil {
+		t.Fatalf("blocked finalization = %#v", finalized.Session)
+	}
+	if _, err := continuity.BuildBootstrapTranscript(ctx, finalized.Session); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("blocked bootstrap error = %v, want ErrConflict", err)
+	}
+	receipt, err := NewACPIndependentBranchReceipt(
+		"reconcile-blocked", claim.RepositoryID, claim.Ref, acpSessionTestSHA2,
+		time.Date(2026, 7, 24, 18, 10, 0, 0, time.UTC),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	tampered := receipt
+	tampered.SHA = acpSessionTestSHA
+	if _, err := continuity.RecoverBlockedSession(ctx, ACPRecoverBlockedSessionRequest{
+		Namespace: control.Namespace, SessionName: control.SessionName, SessionUID: control.SessionUID,
+		Fence: fence, Receipt: tampered,
+	}); !errors.Is(err, store.ErrValidation) {
+		t.Fatalf("tampered independent receipt error = %v, want ErrValidation", err)
+	}
+	recovered, err := continuity.RecoverBlockedSession(ctx, ACPRecoverBlockedSessionRequest{
+		Namespace: control.Namespace, SessionName: control.SessionName, SessionUID: control.SessionUID,
+		Fence: fence, Receipt: receipt,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if recovered.Availability != store.SessionAvailable || recovered.VerifiedBaseline == nil || recovered.VerifiedBaseline.SHA != acpSessionTestSHA2 {
+		t.Fatalf("recovered session = %#v", recovered)
+	}
+	recoveredClaim, err := s.GetBranchClaim(ctx, claim.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if recoveredClaim.Availability != store.BranchClaimAvailable || recoveredClaim.LastVerified.SHA != acpSessionTestSHA2 {
+		t.Fatalf("recovered branch claim = %#v", recoveredClaim)
+	}
+	next, err := continuity.AcquireMutationLease(ctx, ACPAcquireSessionLeaseRequest{
+		Session: *recovered, Fence: fence, TaskUID: "task-after-recovery", Attempt: 1, PromptID: "prompt-after-recovery",
+		PromptRequestDigest: acpSessionTestDigest("prompt-after-recovery"),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if next.Key.LeaseGeneration != 2 {
+		t.Fatalf("post-recovery lease generation = %d, want 2", next.Key.LeaseGeneration)
+	}
+}
+
+func TestACPBootstrapTranscriptIsCanonicalAndBounded(t *testing.T) {
+	messages := []store.SessionMessage{
+		{Role: "user", Content: "old"}, {Role: "assistant", Content: "old answer"},
+		{Role: "user", Content: strings.Repeat("x", 600)}, {Role: "assistant", Content: "new answer"},
+	}
+	limits := ACPBootstrapLimits{MaxMessages: 2, MaxBytes: 1024, MaxMessageBytes: 256}
+	first, err := buildACPBootstrapTranscript(messages, limits)
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := buildACPBootstrapTranscript(messages, limits)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if first.MessageCount != 2 || !first.Truncated || first.Messages[0].Role != "user" || first.Messages[1].Content != "new answer" {
+		t.Fatalf("bounded bootstrap = %#v", first)
+	}
+	if first.Digest != second.Digest || string(first.Artifact) != string(second.Artifact) || len(first.Artifact) > limits.MaxBytes {
+		t.Fatalf("bootstrap is not deterministic/bounded")
+	}
+}
+
+func newACPSessionTestStore(t *testing.T, path string) (*sqlite.Store, store.ControllerEpochFence, func()) {
+	t.Helper()
+	db, err := sqlite.NewDB(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	s := sqlite.NewStore(db, path)
+	epoch, err := s.CompareAndSwapControllerEpoch(context.Background(), store.ControllerEpochCAS{
+		ExpectedVersion: 0, ExpectedEpoch: 0, NewEpoch: 1, HolderID: "controller-test",
+		RequestDigest: acpSessionTestDigest("epoch-1"), UpdatedAt: time.Date(2026, 7, 24, 16, 0, 0, 0, time.UTC),
+	})
+	if err != nil {
+		db.Close() //nolint:errcheck
+		t.Fatal(err)
+	}
+	return s, store.ControllerEpochFence{Name: epoch.Name, Epoch: epoch.Epoch, HolderID: epoch.HolderID}, func() {
+		_ = db.Close()
+	}
+}
+
+func advanceACPSessionTestEpoch(t *testing.T, s *sqlite.Store, holder string) store.ControllerEpochFence {
+	t.Helper()
+	current, err := s.GetControllerEpoch(context.Background(), store.DefaultControllerEpochName)
+	if err != nil {
+		t.Fatal(err)
+	}
+	next, err := s.CompareAndSwapControllerEpoch(context.Background(), store.ControllerEpochCAS{
+		ExpectedVersion: current.Version, ExpectedEpoch: current.Epoch, NewEpoch: current.Epoch + 1,
+		HolderID: holder, RequestDigest: acpSessionTestDigest("epoch-" + holder), UpdatedAt: current.UpdatedAt.Add(time.Minute),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return store.ControllerEpochFence{Name: next.Name, Epoch: next.Epoch, HolderID: next.HolderID}
+}
+
+//nolint:unparam // The stable parameter keeps call sites explicit across related test cases.
+func newACPSessionTestContinuity(t *testing.T, s *sqlite.Store, limits ACPBootstrapLimits) *ACPSessionContinuity {
+	t.Helper()
+	continuity, err := NewACPSessionContinuity(ACPSessionContinuityConfig{
+		SessionControls: s, Transcripts: s, Publications: s, BranchClaims: s, BootstrapLimits: limits,
+		NewSessionUID: func() (string, error) { return "acp-session-fixed-uid", nil },
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return continuity
+}
+
+func ensureACPSessionForTest(t *testing.T, continuity *ACPSessionContinuity, fence store.ControllerEpochFence, name string) *store.SessionControl {
+	t.Helper()
+	control, err := continuity.EnsureSession(context.Background(), ACPEnsureSessionRequest{
+		Namespace: "ns", SessionName: name, SessionType: "task", Fence: fence,
+		CreatedAt: time.Date(2026, 7, 24, 16, 30, 0, 0, time.UTC),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return control
+}
+
+func openACPSessionTurnForTest(
+	t *testing.T,
+	continuity *ACPSessionContinuity,
+	s *sqlite.Store,
+	fence store.ControllerEpochFence,
+	control *store.SessionControl,
+	taskUID, promptID, userPrompt string,
+) (*ACPSessionTurn, *store.PromptAttempt) {
+	t.Helper()
+	ctx := context.Background()
+	requestDigest := acpSessionTestDigest("request-" + taskUID)
+	lease, err := continuity.AcquireMutationLease(ctx, ACPAcquireSessionLeaseRequest{
+		Session: *control, Fence: fence, TaskUID: taskUID, Attempt: 1, PromptID: promptID,
+		PromptRequestDigest: requestDigest, AcquiredAt: time.Date(2026, 7, 24, 16, 40, 0, 0, time.UTC),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	key := store.PromptAttemptKey{Namespace: control.Namespace, TaskUID: taskUID, Attempt: 1, PromptID: promptID}
+	attemptID, err := key.CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	attempt, err := s.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{
+		ID: attemptID, Key: key, SessionUID: control.SessionUID, SessionLeaseGeneration: lease.Key.LeaseGeneration,
+		RequestDigest: requestDigest, CreatedAt: time.Date(2026, 7, 24, 16, 41, 0, 0, time.UTC),
+	}), fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	turn, err := continuity.OpenTurn(ctx, ACPOpenSessionTurnRequest{
+		Lease: *lease, Fence: fence, PromptAttemptID: attempt.ID,
+		PromptRequestDigest: requestDigest, UserPrompt: userPrompt,
+		OpenedAt: time.Date(2026, 7, 24, 16, 42, 0, 0, time.UTC),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return turn, attempt
+}
+
+func completeACPAttemptExecutionForTest(t *testing.T, s *sqlite.Store, fence store.ControllerEpochFence, attempt *store.PromptAttempt, unknown bool) *store.PromptAttempt {
+	t.Helper()
+	path := []store.PromptExecutionState{
+		store.PromptExecutionReserved, store.PromptExecutionSessionStarting, store.PromptExecutionPlanned,
+		store.PromptExecutionSubmitting,
+	}
+	if unknown {
+		path = append(path, store.PromptExecutionSubmittedUnknown, store.PromptExecutionOutcomeUnknown)
+	} else {
+		path = append(path, store.PromptExecutionAccepted, store.PromptExecutionRunning, store.PromptExecutionSettling, store.PromptExecutionSucceeded)
+	}
+	for _, next := range path {
+		op := "execution-" + attempt.Key.TaskUID + "-" + string(next)
+		transition := store.PromptAttemptExecutionTransition{
+			ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+			NewState: next, OperationID: op, OperationDigest: acpSessionTestDigest(op),
+			UpdatedAt: attempt.UpdatedAt.Add(time.Second),
+		}
+		if next == store.PromptExecutionOutcomeUnknown {
+			transition.TerminalReason = "runtime outcome unknown"
+			transition.OutcomeMarker = "OutcomeUnknown"
+		}
+		updated, err := s.TransitionPromptAttemptExecution(context.Background(), transition)
+		if err != nil {
+			t.Fatalf("transition execution to %s: %v", next, err)
+		}
+		attempt = updated
+	}
+	return attempt
+}
+
+func completeACPAttemptDeliveryForTest(t *testing.T, s *sqlite.Store, fence store.ControllerEpochFence, attempt *store.PromptAttempt, terminal store.PromptDeliveryState) *store.PromptAttempt {
+	t.Helper()
+	path := []store.PromptDeliveryState{
+		store.PromptDeliveryValidating, store.PromptDeliveryPreparing, store.PromptDeliveryPrepared,
+		store.PromptDeliveryPublishing, store.PromptDeliveryVerifying, terminal,
+	}
+	for _, next := range path {
+		op := "delivery-" + attempt.Key.TaskUID + "-" + string(next)
+		updated, err := s.TransitionPromptAttemptDelivery(context.Background(), store.PromptAttemptDeliveryTransition{
+			ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.DeliveryState,
+			NewState: next, OperationID: op, OperationDigest: acpSessionTestDigest(op),
+			TerminalReason: "delivery terminal", UpdatedAt: attempt.UpdatedAt.Add(time.Second),
+		})
+		if err != nil {
+			t.Fatalf("transition delivery to %s: %v", next, err)
+		}
+		attempt = updated
+	}
+	return attempt
+}
+
+func createACPOutcomeUnknownPublicationForTest(t *testing.T, s *sqlite.Store, fence store.ControllerEpochFence, lease ACPSessionLease, now time.Time) (*store.BranchClaim, *store.Publication) {
+	t.Helper()
+	ctx := context.Background()
+	claim, err := s.CreateBranchClaim(ctx, &store.BranchClaim{
+		RepositoryID: "github:orka/acp-session", Ref: "refs/heads/orka/acp-session",
+		OwnerKind: store.BranchClaimOwnerSession, OwnerUID: lease.Session.SessionUID, Generation: 1,
+		LastVerified: store.RemoteRefState{Absent: true}, RequestDigest: acpSessionTestDigest("claim"), CreatedAt: now,
+	}, fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	publication, err := s.CreatePublication(ctx, &store.Publication{
+		ID: "publication-blocked", Namespace: lease.Session.Namespace, Generation: 1,
+		TaskUID: lease.Key.TaskUID, Attempt: lease.Key.Attempt, PromptID: lease.Key.PromptID,
+		SessionUID: lease.Session.SessionUID, BranchClaimID: claim.ID, BranchClaimGeneration: claim.Generation,
+		SourceRepositoryID: "github:orka/source", SourceBaselineSHA: acpSessionTestSHA, SourceRef: "refs/heads/main",
+		TargetRepositoryID: claim.RepositoryID, TargetRef: claim.Ref, Baseline: claim.LastVerified,
+		ArtifactID: "sha256-artifact", ArtifactDigest: acpSessionTestDigest("artifact"), ArtifactSizeBytes: 128,
+		ArtifactMediaType: "application/vnd.orka.workspace-delta.v1+tar", PublicationCredentialRef: "secret/ns/publisher#token",
+		CommitIdentity: "Orka <orka@example.invalid>", CommitMessage: "feat: ACP session change", CommitTimestamp: now,
+		RequestDigest: acpSessionTestDigest("publication"), CreatedAt: now,
+	}, fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	prepared := store.PreparedPublicationReceipt{
+		OperationID: "prepare", RequestDigest: acpSessionTestDigest("prepare-response"),
+		TreeSHA: acpSessionTestSHA2, CommitSHA: acpSessionTestSHA, ManifestDigest: acpSessionTestDigest("manifest"),
+		BundleArtifactID: "bundle-artifact", BundleDigest: acpSessionTestDigest("bundle"), BundleSizeBytes: 256,
+		BundleMediaType: store.PreparedBundleMediaType, BundleRef: "refs/orka/publications/" + strings.Repeat("f", 64),
+		PreparedAt: now.Add(time.Minute),
+	}
+	publication = transitionACPPublicationForTest(t, s, fence, publication, store.PublicationPrepared, "prepare", now.Add(time.Minute), &prepared, nil, nil, "")
+	publication = transitionACPPublicationForTest(t, s, fence, publication, store.PublicationPublishing, "publishing", now.Add(2*time.Minute), nil, nil, nil, "")
+	publish := store.PublishOperationReceipt{
+		OperationID: "publish", RequestDigest: acpSessionTestDigest("publish"),
+		TargetRepositoryID: publication.TargetRepositoryID, TargetRef: publication.TargetRef,
+		RemoteBefore: publication.Baseline, ExpectedCommitSHA: prepared.CommitSHA,
+		AcknowledgementUnknown: true, PublishedAt: now.Add(3 * time.Minute),
+	}
+	publication = transitionACPPublicationForTest(t, s, fence, publication, store.PublicationVerifying, publish.OperationID, now.Add(3*time.Minute), nil, &publish, nil, "")
+	verification := store.PublicationVerificationReceipt{
+		OperationID: "verify", RequestDigest: acpSessionTestDigest("verify"),
+		Outcome: store.PublicationOutcomeUnknown, ExpectedCommitSHA: prepared.CommitSHA, VerifiedAt: now.Add(4 * time.Minute),
+	}
+	publication = transitionACPPublicationForTest(t, s, fence, publication, store.PublicationOutcomeUnknown, verification.OperationID, now.Add(4*time.Minute), nil, nil, &verification, "remote ref remained unobservable")
+	return claim, publication
+}
+
+func transitionACPPublicationForTest(
+	t *testing.T,
+	s *sqlite.Store,
+	fence store.ControllerEpochFence,
+	publication *store.Publication,
+	state store.PublicationState,
+	operationID string,
+	updatedAt time.Time,
+	prepared *store.PreparedPublicationReceipt,
+	publish *store.PublishOperationReceipt,
+	verification *store.PublicationVerificationReceipt,
+	reason string,
+) *store.Publication {
+	t.Helper()
+	operationDigest := acpSessionTestDigest(operationID)
+	if publish != nil {
+		operationDigest = publish.RequestDigest
+	}
+	if verification != nil {
+		operationDigest = verification.RequestDigest
+	}
+	updated, err := s.TransitionPublication(context.Background(), store.PublicationTransition{
+		ID: publication.ID, Fence: fence, ExpectedVersion: publication.Version, ExpectedGeneration: publication.Generation,
+		ExpectedState: publication.State, NewState: state, OperationID: operationID, OperationDigest: operationDigest,
+		PreparedReceipt: prepared, PublishReceipt: publish, VerificationReceipt: verification,
+		TerminalReason: reason, UpdatedAt: updatedAt,
+	})
+	if err != nil {
+		t.Fatalf("transition publication to %s: %v", state, err)
+	}
+	return updated
+}
+
+func acpSessionProjectionForTest(id, outcome string) ACPFinalizationProjection {
+	payload, _ := json.Marshal(map[string]string{"outcome": outcome})
+	return ACPFinalizationProjection{ID: "outbox-" + id, ProjectionKind: "TaskStatus", Payload: payload}
+}
+
+func acpSessionTestDigest(value string) string {
+	sum := sha256.Sum256([]byte(value))
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
+
+func TestACPSessionTurnDigestPreservesLegacyAppendIdentity(t *testing.T) {
+	const (
+		turnID        = "turn-compatibility"
+		attemptID     = "attempt-compatibility"
+		userPrompt    = "compatibility prompt"
+		requestDigest = "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+	)
+	legacy, err := acpDomainDigest("session-turn", map[string]any{
+		"turnID": turnID, "promptAttemptID": attemptID,
+		"promptRequestDigest": requestDigest, "userPrompt": userPrompt,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	appendDigest, err := acpSessionTurnDigest(turnID, attemptID, requestDigest, userPrompt, false, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if appendDigest != legacy {
+		t.Fatalf("normal append digest = %q, want legacy %q", appendDigest, legacy)
+	}
+	skipDigest, err := acpSessionTurnDigest(turnID, attemptID, requestDigest, userPrompt, true, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if skipDigest == legacy {
+		t.Fatal("skip-transcript append policy did not rotate the SessionTurn digest")
+	}
+	legacySkip, err := acpDomainDigest("session-turn", map[string]any{
+		"turnID": turnID, "promptAttemptID": attemptID,
+		"promptRequestDigest": requestDigest, "userPrompt": userPrompt,
+		"skipTranscriptAppend": true,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if skipDigest != legacySkip {
+		t.Fatalf("full-suppression digest = %q, want legacy %q", skipDigest, legacySkip)
+	}
+	assistantOnlyDigest, err := acpSessionTurnDigest(turnID, attemptID, requestDigest, userPrompt, false, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if assistantOnlyDigest == legacy || assistantOnlyDigest == skipDigest {
+		t.Fatal("assistant-only append policy did not receive a distinct SessionTurn digest")
+	}
+}
diff --git a/internal/controller/acp_session_transcript.go b/internal/controller/acp_session_transcript.go
new file mode 100644
index 000000000..d477720b0
--- /dev/null
+++ b/internal/controller/acp_session_transcript.go
@@ -0,0 +1,303 @@
+package controller
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"strings"
+	"unicode/utf8"
+
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+const (
+	DefaultACPBootstrapMaxMessages     = 64
+	DefaultACPBootstrapMaxBytes        = 128 * 1024
+	DefaultACPBootstrapMaxMessageBytes = 32 * 1024
+
+	acpBootstrapTruncationSuffix = "\n[truncated by Orka session bootstrap]"
+	acpBootstrapRoleUser         = "user"
+)
+
+// ACPBootstrapLimits bound the canonical transcript artifact used to recreate
+// an ACP provider session after runtime loss, scale-to-zero, or profile rotation.
+type ACPBootstrapLimits struct {
+	MaxMessages     int
+	MaxBytes        int
+	MaxMessageBytes int
+}
+
+func (l ACPBootstrapLimits) withDefaults() (ACPBootstrapLimits, error) {
+	if l.MaxMessages == 0 {
+		l.MaxMessages = DefaultACPBootstrapMaxMessages
+	}
+	if l.MaxBytes == 0 {
+		l.MaxBytes = DefaultACPBootstrapMaxBytes
+	}
+	if l.MaxMessageBytes == 0 {
+		l.MaxMessageBytes = DefaultACPBootstrapMaxMessageBytes
+	}
+	if l.MaxMessages < 1 || l.MaxMessages > 4096 {
+		return ACPBootstrapLimits{}, store.ValidationErrorf("ACP bootstrap max messages must be in range 1..4096")
+	}
+	if l.MaxBytes < 1024 || l.MaxBytes > harnessv2.MaxCanonicalJSONBytes {
+		return ACPBootstrapLimits{}, store.ValidationErrorf("ACP bootstrap max bytes must be in range 1024..%d", harnessv2.MaxCanonicalJSONBytes)
+	}
+	if l.MaxMessageBytes < 256 || l.MaxMessageBytes > l.MaxBytes {
+		return ACPBootstrapLimits{}, store.ValidationErrorf("ACP bootstrap max message bytes must be in range 256..max bytes")
+	}
+	return l, nil
+}
+
+// ACPBootstrapTranscript is a deterministic JSONL suffix of the canonical Orka
+// transcript. Structured tool arguments are intentionally omitted: continuity
+// restores conversation text without replaying provider-native or tool state.
+type ACPBootstrapTranscript struct {
+	SessionUID       string
+	Messages         []ACPBootstrapMessage
+	Artifact         []byte
+	Digest           string
+	MessageCount     uint32
+	TotalMessages    int
+	Truncated        bool
+	VerifiedBaseline *store.VerifiedBranchBaseline
+}
+
+// ACPBootstrapMessage is the portable, provider-neutral transcript shape.
+type ACPBootstrapMessage struct {
+	Role       string `json:"role"`
+	Content    string `json:"content"`
+	Name       string `json:"name,omitempty"`
+	ToolCallID string `json:"toolCallID,omitempty"`
+}
+
+// BuildBootstrapTranscript returns a bounded, deterministic suffix of the Orka
+// transcript. It refuses reconciliation-blocked Sessions and returns the last
+// independently verified branch baseline for separate workspace recovery.
+func (c *ACPSessionContinuity) BuildBootstrapTranscript(ctx context.Context, session store.SessionControl) (*ACPBootstrapTranscript, error) {
+	return c.buildBootstrapTranscript(ctx, session, 0)
+}
+
+// BuildBootstrapTranscriptWithLimit returns the same canonical suffix while
+// applying the Task-specific transcript limit before the continuity-wide byte
+// and message caps. The explicit limit prevents a caller's narrower context
+// boundary from being widened during provider-session recreation.
+func (c *ACPSessionContinuity) BuildBootstrapTranscriptWithLimit(
+	ctx context.Context, session store.SessionControl, maxMessages int,
+) (*ACPBootstrapTranscript, error) {
+	if maxMessages < 1 {
+		return nil, store.ValidationErrorf("ACP bootstrap message limit must be positive")
+	}
+	return c.buildBootstrapTranscript(ctx, session, maxMessages)
+}
+
+func (c *ACPSessionContinuity) buildBootstrapTranscript(
+	ctx context.Context, session store.SessionControl, maxMessages int,
+) (*ACPBootstrapTranscript, error) {
+	current, err := c.controls.GetSessionControl(ctx, session.Namespace, session.SessionName)
+	if err != nil {
+		return nil, fmt.Errorf("load ACP session for bootstrap: %w", err)
+	}
+	if current.SessionUID != session.SessionUID {
+		return nil, fmt.Errorf("%w: ACP bootstrap session UID changed from %q to %q", store.ErrConflict, session.SessionUID, current.SessionUID)
+	}
+	if current.Availability != store.SessionAvailable {
+		return nil, fmt.Errorf("%w: ACP session %s/%s is reconciliation-blocked", store.ErrConflict, current.Namespace, current.SessionName)
+	}
+	messages, err := c.transcripts.LoadTranscript(ctx, current.Namespace, current.SessionName, maxMessages)
+	if err != nil {
+		return nil, fmt.Errorf("load canonical ACP transcript: %w", err)
+	}
+	bootstrap, err := buildACPBootstrapTranscript(messages, c.bootstrapLimits)
+	if err != nil {
+		return nil, err
+	}
+	bootstrap.SessionUID = current.SessionUID
+	bootstrap.TotalMessages = len(messages)
+	if current.VerifiedBaseline != nil {
+		baseline := *current.VerifiedBaseline
+		bootstrap.VerifiedBaseline = &baseline
+	}
+	return bootstrap, nil
+}
+
+// BuildBootstrapTranscriptThrough returns the bounded transcript ending at one
+// exact stable message ID together with that untruncated terminal message.
+// Gateway Tasks use the terminal user message as the durable SessionTurn prompt
+// while avoiding a duplicate prompt block in provider input.
+func (c *ACPSessionContinuity) BuildBootstrapTranscriptThrough(
+	ctx context.Context, session store.SessionControl, throughMessageID string, maxMessages int, excludeThroughMessage bool,
+) (*ACPBootstrapTranscript, *store.SessionMessage, error) {
+	throughMessageID = strings.TrimSpace(throughMessageID)
+	if throughMessageID == "" || maxMessages < 1 {
+		return nil, nil, store.ValidationErrorf("ACP bounded bootstrap requires a through-message ID and positive message limit")
+	}
+	current, err := c.controls.GetSessionControl(ctx, session.Namespace, session.SessionName)
+	if err != nil {
+		return nil, nil, fmt.Errorf("load ACP session for bounded bootstrap: %w", err)
+	}
+	if current.SessionUID != session.SessionUID {
+		return nil, nil, fmt.Errorf("%w: ACP bootstrap session UID changed from %q to %q", store.ErrConflict, session.SessionUID, current.SessionUID)
+	}
+	if current.Availability != store.SessionAvailable {
+		return nil, nil, fmt.Errorf("%w: ACP session %s/%s is reconciliation-blocked", store.ErrConflict, current.Namespace, current.SessionName)
+	}
+	messages, err := c.transcripts.LoadTranscriptThrough(ctx, current.Namespace, current.SessionName, throughMessageID, maxMessages)
+	if err != nil {
+		return nil, nil, fmt.Errorf("load bounded canonical ACP transcript: %w", err)
+	}
+	if len(messages) == 0 || messages[len(messages)-1].ID != throughMessageID {
+		return nil, nil, fmt.Errorf("%w: bounded ACP transcript does not end at message %q", store.ErrConflict, throughMessageID)
+	}
+	bootstrapMessages := messages
+	if excludeThroughMessage {
+		bootstrapMessages = messages[:len(messages)-1]
+	}
+	bootstrap, err := buildACPBootstrapTranscript(bootstrapMessages, c.bootstrapLimits)
+	if err != nil {
+		return nil, nil, err
+	}
+	bootstrap.SessionUID = current.SessionUID
+	bootstrap.TotalMessages = len(messages)
+	if current.VerifiedBaseline != nil {
+		baseline := *current.VerifiedBaseline
+		bootstrap.VerifiedBaseline = &baseline
+	}
+	terminal := messages[len(messages)-1]
+	return bootstrap, &terminal, nil
+}
+
+func buildACPBootstrapTranscript(messages []store.SessionMessage, limits ACPBootstrapLimits) (*ACPBootstrapTranscript, error) {
+	limits, err := limits.withDefaults()
+	if err != nil {
+		return nil, err
+	}
+	type encodedMessage struct {
+		message   ACPBootstrapMessage
+		line      []byte
+		truncated bool
+	}
+	encoded := make([]encodedMessage, 0, len(messages))
+	for index, message := range messages {
+		role := strings.TrimSpace(message.Role)
+		if role == "" {
+			return nil, store.ValidationErrorf("ACP bootstrap transcript message %d has an empty role", index)
+		}
+		if err := store.ValidateControlIdentifier("ACP bootstrap transcript role", role); err != nil {
+			return nil, err
+		}
+		canonical := ACPBootstrapMessage{
+			Role: role, Content: message.Content, Name: strings.TrimSpace(message.Name),
+			ToolCallID: strings.TrimSpace(message.ToolCallID),
+		}
+		if !utf8.ValidString(canonical.Content) || !utf8.ValidString(canonical.Name) || !utf8.ValidString(canonical.ToolCallID) {
+			return nil, store.ValidationErrorf("ACP bootstrap transcript message %d contains invalid UTF-8", index)
+		}
+		line, wasTruncated, err := encodeBoundedACPBootstrapMessage(canonical, limits.MaxMessageBytes, limits.MaxBytes)
+		if err != nil {
+			return nil, fmt.Errorf("encode ACP bootstrap transcript message %d: %w", index, err)
+		}
+		encoded = append(encoded, encodedMessage{message: canonical, line: line, truncated: wasTruncated})
+	}
+
+	selected := make([]encodedMessage, 0, min(limits.MaxMessages, len(encoded)))
+	totalBytes := 0
+	truncated := false
+	for index := len(encoded) - 1; index >= 0; index-- {
+		entry := encoded[index]
+		if len(selected) >= limits.MaxMessages || totalBytes+len(entry.line) > limits.MaxBytes {
+			truncated = true
+			break
+		}
+		selected = append(selected, entry)
+		totalBytes += len(entry.line)
+		truncated = truncated || entry.truncated
+	}
+	if len(selected) < len(encoded) {
+		truncated = true
+	}
+	for left, right := 0, len(selected)-1; left < right; left, right = left+1, right-1 {
+		selected[left], selected[right] = selected[right], selected[left]
+	}
+
+	var artifact bytes.Buffer
+	resultMessages := make([]ACPBootstrapMessage, 0, len(selected))
+	for _, entry := range selected {
+		artifact.Write(entry.line)
+		decoded, err := decodeACPBootstrapLine(entry.line)
+		if err != nil {
+			return nil, err
+		}
+		resultMessages = append(resultMessages, decoded)
+	}
+	artifactBytes := artifact.Bytes()
+	digest := sha256.Sum256(artifactBytes)
+	return &ACPBootstrapTranscript{
+		Messages: resultMessages, Artifact: append([]byte(nil), artifactBytes...),
+		Digest: "sha256:" + hex.EncodeToString(digest[:]), MessageCount: uint32(len(resultMessages)),
+		Truncated: truncated,
+	}, nil
+}
+
+func encodeBoundedACPBootstrapMessage(message ACPBootstrapMessage, maxMessageBytes, maxArtifactBytes int) ([]byte, bool, error) {
+	contentLimit := min(maxMessageBytes, maxArtifactBytes)
+	truncated := false
+	if len(message.Content) > contentLimit {
+		message.Content = truncateUTF8WithSuffix(message.Content, contentLimit, acpBootstrapTruncationSuffix)
+		truncated = true
+	}
+	for {
+		canonical, err := harnessv2.CanonicalValue(message)
+		if err != nil {
+			return nil, false, err
+		}
+		line := append(canonical, '\n')
+		if len(line) <= maxMessageBytes && len(line) <= maxArtifactBytes {
+			return line, truncated, nil
+		}
+		if message.Content == "" {
+			return nil, false, store.ValidationErrorf("ACP bootstrap message metadata exceeds configured bounds")
+		}
+		target := len(message.Content) - max(len(line)-min(maxMessageBytes, maxArtifactBytes), 1)
+		message.Content = truncateUTF8WithSuffix(message.Content, max(target, 0), acpBootstrapTruncationSuffix)
+		truncated = true
+	}
+}
+
+func decodeACPBootstrapLine(line []byte) (ACPBootstrapMessage, error) {
+	var message ACPBootstrapMessage
+	if err := jsonUnmarshalStrict(bytes.TrimSuffix(line, []byte{'\n'}), &message); err != nil {
+		return ACPBootstrapMessage{}, fmt.Errorf("decode canonical ACP bootstrap line: %w", err)
+	}
+	return message, nil
+}
+
+func truncateUTF8WithSuffix(value string, maxBytes int, suffix string) string {
+	if maxBytes <= 0 {
+		return ""
+	}
+	if len(value) <= maxBytes {
+		return value
+	}
+	if len(suffix) >= maxBytes {
+		return truncateUTF8(suffix, maxBytes)
+	}
+	return truncateUTF8(value, maxBytes-len(suffix)) + suffix
+}
+
+func truncateUTF8(value string, maxBytes int) string {
+	if maxBytes <= 0 {
+		return ""
+	}
+	if len(value) <= maxBytes {
+		return value
+	}
+	end := maxBytes
+	for end > 0 && !utf8.RuneStart(value[end]) {
+		end--
+	}
+	return value[:end]
+}
diff --git a/internal/controller/acp_task_finalizer.go b/internal/controller/acp_task_finalizer.go
new file mode 100644
index 000000000..dd2cd4191
--- /dev/null
+++ b/internal/controller/acp_task_finalizer.go
@@ -0,0 +1,537 @@
+package controller
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sort"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/artifactcap"
+	"github.com/orka-agents/orka/internal/publisher"
+	publisherservice "github.com/orka-agents/orka/internal/publisher/service"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+const conditionTypeACPArtifactsRetired = "ACPArtifactsRetired"
+
+// ACPPublicationReclaimer removes Publisher-local cache state after every
+// durable publication/session barrier for a deleting Task has settled.
+type ACPPublicationReclaimer interface {
+	ReclaimPublication(context.Context, publisherservice.PublicationReclaimRequest) (publisherservice.PublicationReclaimResponse, error)
+}
+
+type acpPublicationReclaimTarget struct {
+	id         string
+	generation int64
+}
+
+//nolint:gocyclo // Deletion readiness keeps every durable attempt, publication, effect, and projection barrier in one fail-closed boundary.
+func (r *TaskReconciler) acpTaskDeletionReady(ctx context.Context, task *corev1alpha1.Task) (bool, error) {
+	if task == nil || task.Spec.Type != corev1alpha1.TaskTypeAgent || r.DurableControlStore == nil {
+		return true, nil
+	}
+	if acpTaskHasUnvalidatedSourceIdentity(task) {
+		return false, fmt.Errorf("%w: Task execution binding UID differs from the live Task before validated restore settlement", store.ErrConflict)
+	}
+	if acpTaskRequiresAuthoritativeAttemptDiscovery(task) {
+		if task.Status.Execution != nil && task.Status.Execution.Attempt > 0 && task.Status.Execution.PromptID != "" {
+			projectionID := standaloneTaskTerminalProjectionIDForUID(task.Namespace, acpTaskControlUID(task), task.Status.Execution.Attempt)
+			projection, err := r.DurableControlStore.GetOutboxProjection(ctx, projectionID)
+			if err == nil {
+				if projection.State != store.OutboxProjectionDelivered {
+					return false, nil
+				}
+				// A queued timeout settled by the dispatcher already has a durable
+				// terminal projection, so keep the normal projected barriers below.
+			} else if !errors.Is(err, store.ErrNotFound) {
+				return false, err
+			} else {
+				publicationID := publicationIDForTaskUID(task, acpTaskControlUID(task))
+				unsettled, effectErr := r.acpTaskHasUnsettledExternalEffects(ctx, task, publicationID)
+				return !unsettled, effectErr
+			}
+		} else {
+			// A PromptAttempt is persisted before Task.status.execution. Continue to
+			// the authoritative reclamation preflight so it can either settle that
+			// unbound attempt or durably prove that no attempt ever existed.
+			publicationID := ""
+			if task.Status.Execution != nil {
+				publicationID = publicationIDForTaskUID(task, acpTaskControlUID(task))
+			}
+			unsettled, err := r.acpTaskHasUnsettledExternalEffects(ctx, task, publicationID)
+			return !unsettled, err
+		}
+	}
+	if task.Status.Execution.RuntimeSessionUID != "" && !taskScopedRuntimeSessionCleanupComplete(task) {
+		return false, nil
+	}
+	if acpTaskTerminalBeforeDurableAttempt(task) {
+		publicationID := publicationIDForTaskUID(task, acpTaskControlUID(task))
+		unsettled, err := r.acpTaskHasUnsettledExternalEffects(ctx, task, publicationID)
+		return !unsettled, err
+	}
+	attemptID, err := promptAttemptIDFromTaskUID(task, acpTaskControlUID(task))
+	if err != nil {
+		return false, err
+	}
+	attempt, err := r.DurableControlStore.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		if errors.Is(err, store.ErrNotFound) {
+			// The final attempt may already have been removed by a prepared
+			// reclamation. Let the store validate its durable marker on retry.
+			return true, nil
+		}
+		return false, err
+	}
+	if acpTaskUsesRestoredSourceIdentity(task) {
+		if err := validateRestoredTaskSourceAttempt(task, attempt, attemptID); err != nil {
+			return false, err
+		}
+	}
+	if !store.IsTerminalPromptExecutionState(attempt.ExecutionState) || !store.IsTerminalPromptDeliveryState(attempt.DeliveryState) {
+		return false, nil
+	}
+	publicationID := publicationIDForTaskUID(task, acpTaskControlUID(task))
+	if task.Spec.Workspace != nil && task.Spec.Workspace.Intent == corev1alpha1.WorkspaceIntentWrite {
+		publication, publicationErr := r.DurableControlStore.GetPublication(ctx, publicationID)
+		if publicationErr != nil {
+			if !errors.Is(publicationErr, store.ErrNotFound) {
+				return false, publicationErr
+			}
+		} else if !store.IsTerminalPublicationState(publication.State) {
+			return false, nil
+		}
+	}
+	if unsettled, err := r.acpTaskHasUnsettledExternalEffects(ctx, task, publicationID); err != nil {
+		return false, err
+	} else if unsettled {
+		return false, nil
+	}
+	projectionID, err := r.acpTaskTerminalProjectionID(ctx, task, attempt)
+	if err != nil {
+		return false, err
+	}
+	projection, err := r.DurableControlStore.GetOutboxProjection(ctx, projectionID)
+	if err != nil {
+		if errors.Is(err, store.ErrNotFound) {
+			return false, nil
+		}
+		return false, err
+	}
+	return projection.State == store.OutboxProjectionDelivered, nil
+}
+
+func acpTaskTerminalBeforeDurableAttempt(task *corev1alpha1.Task) bool {
+	if task == nil || task.Status.Execution == nil || task.Status.Delivery == nil {
+		return false
+	}
+	execution := task.Status.Execution
+	delivery := task.Status.Delivery
+	terminalBeforeAttempt := execution.State == corev1alpha1.TaskExecutionStateFailed &&
+		execution.Outcome == corev1alpha1.TaskExecutionOutcomeFailed &&
+		(execution.Reason == corev1alpha1.TaskExecutionReason("InvalidWorkspace") || execution.Reason == corev1alpha1.TaskExecutionReason("InvalidRuntimeProfile"))
+	if !terminalBeforeAttempt {
+		return false
+	}
+	if execution.Attempt != 0 || execution.PromptID != "" || execution.RuntimePoolName != "" || execution.RuntimePoolUID != "" ||
+		execution.AgentRuntimeName != "" || execution.AgentRuntimeUID != "" || execution.RuntimeInstanceID != "" || execution.RuntimeSessionUID != "" ||
+		execution.RequestDigest != "" {
+		return false
+	}
+	return delivery.State == corev1alpha1.TaskDeliveryStateNotRequested && delivery.Outcome == corev1alpha1.TaskDeliveryOutcomeNotRequested
+}
+
+func acpTaskRequiresAuthoritativeAttemptDiscovery(task *corev1alpha1.Task) bool {
+	if task == nil || task.Status.Execution == nil {
+		return true
+	}
+	execution := task.Status.Execution
+	if task.Status.Delivery == nil || task.Status.Delivery.State != corev1alpha1.TaskDeliveryStateNotRequested ||
+		task.Status.Delivery.Outcome != corev1alpha1.TaskDeliveryOutcomeNotRequested {
+		return false
+	}
+	return execution.State == corev1alpha1.TaskExecutionStateCancelled &&
+		execution.Outcome == corev1alpha1.TaskExecutionOutcomeCancelled &&
+		execution.Reason == corev1alpha1.TaskExecutionReason("TaskTimeout") &&
+		execution.RuntimePoolName == "" && execution.RuntimePoolUID == "" &&
+		execution.AgentRuntimeName == "" && execution.AgentRuntimeUID == "" &&
+		execution.RuntimeInstanceID == "" && execution.RuntimeSessionUID == "" &&
+		execution.RuntimeSessionGeneration == 0
+}
+
+func (r *TaskReconciler) acpTaskHasUnsettledExternalEffects(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	publicationID string,
+) (bool, error) {
+	var effects corev1alpha1.ExternalEffectList
+	if err := r.List(ctx, &effects, client.InNamespace(task.Namespace)); err != nil {
+		return false, err
+	}
+	related := map[string]struct{}{string(acpTaskControlUID(task)): {}, publicationID: {}}
+	if task.Status.Execution != nil && task.Status.Execution.RuntimeSessionUID != "" {
+		related[task.Status.Execution.RuntimeSessionUID] = struct{}{}
+	}
+	for i := range effects.Items {
+		effect := &effects.Items[i]
+		if _, ok := related[effect.Spec.AggregateID]; !ok {
+			continue
+		}
+		switch store.ExternalEffectState(effect.Status.State) {
+		case store.ExternalEffectSucceeded, store.ExternalEffectFailed, store.ExternalEffectOutcomeUnknown:
+		default:
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+func (r *TaskReconciler) acpTaskTerminalProjectionID(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attempt *store.PromptAttempt,
+) (string, error) {
+	if task == nil || task.Status.Execution == nil {
+		return "", fmt.Errorf("task execution status is missing")
+	}
+	sessionUID := task.Status.Execution.RuntimeSessionUID
+	leaseGeneration := task.Status.Execution.RuntimeSessionGeneration
+	bound := sessionUID != "" || leaseGeneration != 0
+	if attempt != nil {
+		var err error
+		bound, err = promptAttemptSessionBound(attempt)
+		if err != nil {
+			return "", err
+		}
+		sessionUID = attempt.SessionUID
+		leaseGeneration = attempt.SessionLeaseGeneration
+	}
+	if task.Spec.SessionRef == nil || !bound {
+		return standaloneTaskTerminalProjectionIDForUID(task.Namespace, acpTaskControlUID(task), task.Status.Execution.Attempt), nil
+	}
+	if sessionUID == "" || leaseGeneration < 1 {
+		return "", fmt.Errorf("session-backed ACP attempt lacks a frozen SessionTurn identity")
+	}
+	key := store.SessionTurnKey{
+		SessionUID: sessionUID, LeaseGeneration: leaseGeneration,
+		TaskUID: string(acpTaskControlUID(task)), Attempt: int64(task.Status.Execution.Attempt), PromptID: task.Status.Execution.PromptID,
+	}
+	turnID, err := key.CanonicalID()
+	if err != nil {
+		return "", err
+	}
+	turn, err := r.DurableControlStore.GetSessionTurn(ctx, turnID)
+	if err != nil {
+		return "", err
+	}
+	if turn.State != store.SessionTurnFinalized {
+		return "", fmt.Errorf("SessionTurn %s is not finalized", turnID)
+	}
+	return store.CanonicalControlID("outbox", turnID, "TaskTerminalStatus"), nil
+}
+
+func (r *TaskReconciler) reclaimACPTaskPublicationBundles(ctx context.Context, task *corev1alpha1.Task) (bool, error) {
+	if task == nil || task.Spec.Type != corev1alpha1.TaskTypeAgent || task.Spec.Workspace == nil ||
+		task.Spec.Workspace.Intent != corev1alpha1.WorkspaceIntentWrite || r.DurableControlStore == nil || r.ACPPublicationReclaimer == nil {
+		return true, nil
+	}
+	targets, ready, err := r.acpPublicationReclaimTargets(ctx, task)
+	if err != nil || !ready {
+		return ready, err
+	}
+	for _, target := range targets {
+		operationDigest, digestErr := acpDomainDigest("publication-reclaim-operation", map[string]any{
+			"namespace": task.Namespace, "taskUID": string(acpTaskControlUID(task)),
+			"publicationID": target.id, "publicationGeneration": target.generation,
+		})
+		if digestErr != nil {
+			return false, digestErr
+		}
+		operationID := "publication-reclaim-" + operationDigest[len("sha256:"):len("sha256:")+32]
+		request := publisherservice.PublicationReclaimRequest{
+			Metadata: publisherservice.OperationMetadata{
+				Namespace: task.Namespace, OperationID: operationID, PublicationID: target.id,
+			},
+			Request: publisherReclaimRequest(target),
+		}
+		response, reclaimErr := r.ACPPublicationReclaimer.ReclaimPublication(ctx, request)
+		if reclaimErr != nil {
+			return false, fmt.Errorf("reclaim Publisher publication cache %s generation %d: %w", target.id, target.generation, reclaimErr)
+		}
+		if response.OperationID != operationID || response.Result.PublicationID != target.id ||
+			response.Result.PublicationGeneration != target.generation || !response.Result.Reclaimed {
+			return false, fmt.Errorf("publisher returned a mismatched publication reclamation receipt")
+		}
+	}
+	return true, nil
+}
+
+func publisherReclaimRequest(target acpPublicationReclaimTarget) publisher.ReclaimRequest {
+	return publisher.ReclaimRequest{PublicationID: target.id, PublicationGeneration: target.generation}
+}
+
+func (r *TaskReconciler) acpPublicationReclaimTargets(
+	ctx context.Context, task *corev1alpha1.Task,
+) ([]acpPublicationReclaimTarget, bool, error) {
+	identities, ready, err := r.acpArtifactRetirementIdentities(ctx, task)
+	if err != nil || !ready {
+		return nil, ready, err
+	}
+
+	generations := make(map[string]int64)
+	var publications corev1alpha1.PublicationList
+	if err := r.taskMetadataReader().List(ctx, &publications, client.InNamespace(task.Namespace)); err != nil {
+		return nil, false, fmt.Errorf("list publications for Publisher cache reclamation: %w", err)
+	}
+	for i := range publications.Items {
+		publication := &publications.Items[i]
+		if publication.Spec.TaskUID != string(acpTaskControlUID(task)) {
+			continue
+		}
+		if publication.Spec.ID == "" || publication.Spec.Generation < 1 {
+			return nil, false, fmt.Errorf("publication cache reclamation identity is incomplete")
+		}
+		if existing, ok := generations[publication.Spec.ID]; ok && existing != publication.Spec.Generation {
+			return nil, false, fmt.Errorf("publication %s has conflicting generations", publication.Spec.ID)
+		}
+		generations[publication.Spec.ID] = publication.Spec.Generation
+	}
+
+	targets := make([]acpPublicationReclaimTarget, 0, len(identities))
+	for _, identity := range identities {
+		if identity.PublicationID == "" {
+			continue
+		}
+		generation := generations[identity.PublicationID]
+		publication, publicationErr := r.DurableControlStore.GetPublication(ctx, identity.PublicationID)
+		if publicationErr == nil {
+			if publication.ID != identity.PublicationID || publication.Generation < 1 {
+				return nil, false, fmt.Errorf("durable publication cache reclamation identity is invalid")
+			}
+			if generation != 0 && generation != publication.Generation {
+				return nil, false, fmt.Errorf("publication %s generation differs between durable stores", identity.PublicationID)
+			}
+			generation = publication.Generation
+		} else if !errors.Is(publicationErr, store.ErrNotFound) {
+			return nil, false, publicationErr
+		}
+		if generation == 0 {
+			// Reclamation is ordered before durable Publication removal. A missing
+			// record therefore means no cache was ever created or an earlier
+			// reclaim completed; the current schema's initial generation is enough
+			// for the endpoint's already-absent idempotency check.
+			generation = acpPublicationGeneration
+		}
+		targets = append(targets, acpPublicationReclaimTarget{id: identity.PublicationID, generation: generation})
+	}
+	sort.Slice(targets, func(i, j int) bool { return targets[i].id < targets[j].id })
+	return targets, true, nil
+}
+
+func (r *TaskReconciler) retireACPArtifactIdentities(ctx context.Context, task *corev1alpha1.Task) (bool, error) {
+	if task == nil || task.Spec.Type != corev1alpha1.TaskTypeAgent || r.DurableControlStore == nil {
+		return true, nil
+	}
+	if !task.DeletionTimestamp.IsZero() {
+		request, err := r.acpPromptAttemptReclamationRequest(ctx, task)
+		if err != nil {
+			return false, err
+		}
+		if err := r.DurableControlStore.PreparePromptAttemptReclamation(ctx, request); err != nil {
+			if errors.Is(err, store.ErrNotReady) {
+				return false, nil
+			}
+			return false, fmt.Errorf("prepare ACP prompt attempt reclamation: %w", err)
+		}
+		if !meta.IsStatusConditionTrue(task.Status.Conditions, conditionTypeACPArtifactsRetired) && r.ACPArtifactRetirer != nil {
+			identities, ready, identityErr := r.acpArtifactRetirementIdentities(ctx, task)
+			if identityErr != nil || !ready {
+				return ready, identityErr
+			}
+			if err := r.ACPArtifactRetirer.Retire(ctx, identities...); err != nil {
+				return false, fmt.Errorf("retire ACP artifact identities: %w", err)
+			}
+		}
+		return r.reclaimACPTaskPromptAttempts(ctx, request)
+	}
+	if task.Status.Execution == nil || r.ACPArtifactRetirer == nil ||
+		meta.IsStatusConditionTrue(task.Status.Conditions, conditionTypeACPArtifactsRetired) {
+		return true, nil
+	}
+	identities, ready, err := r.acpArtifactRetirementIdentities(ctx, task)
+	if err != nil || !ready {
+		return ready, err
+	}
+	if err := r.ACPArtifactRetirer.Retire(ctx, identities...); err != nil {
+		return false, fmt.Errorf("retire ACP artifact identities: %w", err)
+	}
+
+	now := metav1.Now()
+	if err := r.updateStatusWithRetry(ctx, task, func(current *corev1alpha1.Task) {
+		meta.SetStatusCondition(&current.Status.Conditions, metav1.Condition{
+			Type: conditionTypeACPArtifactsRetired, Status: metav1.ConditionTrue, Reason: "ArtifactReferencesReleased",
+			Message: "ACP artifact objects and replay records were released after terminal control-plane settlement", LastTransitionTime: now,
+		})
+	}); err != nil {
+		return false, fmt.Errorf("record ACP artifact retirement: %w", err)
+	}
+	return true, nil
+}
+
+func (r *TaskReconciler) acpPromptAttemptReclamationRequest(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+) (store.ReclaimPromptAttemptsRequest, error) {
+	if task == nil {
+		return store.ReclaimPromptAttemptsRequest{}, fmt.Errorf("task is required for ACP prompt attempt reclamation")
+	}
+	request := store.ReclaimPromptAttemptsRequest{
+		Namespace: task.Namespace, TaskName: task.Name, TaskUID: string(acpTaskControlUID(task)),
+		ContinuitySession: task.Spec.SessionRef != nil,
+	}
+	if acpTaskRequiresAuthoritativeAttemptDiscovery(task) {
+		request.Mode = store.PromptAttemptReclamationUnbound
+	} else {
+		if task.Status.Execution.RuntimeSessionUID != "" {
+			request.RelatedExternalEffectAggregateIDs = append(request.RelatedExternalEffectAggregateIDs, task.Status.Execution.RuntimeSessionUID)
+		}
+		request.RelatedExternalEffectAggregateIDs = append(request.RelatedExternalEffectAggregateIDs, publicationIDForTaskUID(task, acpTaskControlUID(task)))
+		if acpTaskTerminalBeforeDurableAttempt(task) {
+			request.Mode = store.PromptAttemptReclamationNoAttempt
+			request.FinalContinuitySession = false
+		} else {
+			request.Mode = store.PromptAttemptReclamationProjected
+			attemptID, err := promptAttemptIDFromTaskUID(task, acpTaskControlUID(task))
+			if err != nil {
+				return store.ReclaimPromptAttemptsRequest{}, err
+			}
+			request.FinalPromptAttemptID = attemptID
+			attempt, err := r.DurableControlStore.GetPromptAttempt(ctx, attemptID)
+			if err != nil && !errors.Is(err, store.ErrNotFound) {
+				return store.ReclaimPromptAttemptsRequest{}, err
+			}
+			if attempt != nil {
+				bound, bindingErr := promptAttemptSessionBound(attempt)
+				if bindingErr != nil {
+					return store.ReclaimPromptAttemptsRequest{}, bindingErr
+				}
+				request.FinalContinuitySession = task.Spec.SessionRef != nil && bound
+			} else {
+				request.FinalContinuitySession = task.Spec.SessionRef != nil &&
+					task.Status.Execution.RuntimeSessionUID != "" && task.Status.Execution.RuntimeSessionGeneration > 0
+			}
+			if attempt == nil && task.Spec.SessionRef != nil && !request.FinalContinuitySession {
+				// The prepared marker is authoritative after the final attempt has
+				// been reclaimed; the Task projection alone cannot reconstruct the
+				// frozen SessionTurn identity.
+				request.TerminalProjectionID = ""
+			} else {
+				projectionID, err := r.acpTaskTerminalProjectionID(ctx, task, attempt)
+				if err != nil {
+					return store.ReclaimPromptAttemptsRequest{}, err
+				}
+				request.TerminalProjectionID = projectionID
+			}
+		}
+	}
+	if r.ControllerEpochManager == nil {
+		return store.ReclaimPromptAttemptsRequest{}, fmt.Errorf("controller epoch manager is required to reclaim ACP prompt attempts")
+	}
+	fence, err := r.ControllerEpochManager.CurrentFence(ctx)
+	if err != nil {
+		return store.ReclaimPromptAttemptsRequest{}, err
+	}
+	request.Fence = fence
+	return request, nil
+}
+
+func (r *TaskReconciler) reclaimACPTaskPromptAttempts(
+	ctx context.Context,
+	request store.ReclaimPromptAttemptsRequest,
+) (bool, error) {
+	if _, err := r.DurableControlStore.ReclaimPromptAttempts(ctx, request); err != nil {
+		if errors.Is(err, store.ErrNotReady) {
+			return false, nil
+		}
+		return false, fmt.Errorf("reclaim ACP prompt attempts: %w", err)
+	}
+	return true, nil
+}
+
+func (r *TaskReconciler) acpArtifactRetirementIdentities(
+	ctx context.Context, task *corev1alpha1.Task,
+) ([]artifactcap.Identity, bool, error) {
+	reader := r.taskMetadataReader()
+	var attempts corev1alpha1.PromptAttemptList
+	if err := reader.List(ctx, &attempts, client.InNamespace(task.Namespace)); err != nil {
+		return nil, false, fmt.Errorf("list prompt attempts for artifact retirement: %w", err)
+	}
+	for i := range attempts.Items {
+		attempt := &attempts.Items[i]
+		if attempt.Spec.TaskUID != string(acpTaskControlUID(task)) {
+			continue
+		}
+		if !store.IsTerminalPromptExecutionState(store.PromptExecutionState(attempt.Status.ExecutionState)) ||
+			!store.IsTerminalPromptDeliveryState(store.PromptDeliveryState(attempt.Status.DeliveryState)) {
+			return nil, false, nil
+		}
+	}
+
+	publicationIDs := map[string]struct{}{}
+	var publications corev1alpha1.PublicationList
+	if err := reader.List(ctx, &publications, client.InNamespace(task.Namespace)); err != nil {
+		return nil, false, fmt.Errorf("list publications for artifact retirement: %w", err)
+	}
+	for i := range publications.Items {
+		publication := &publications.Items[i]
+		if publication.Spec.TaskUID != string(acpTaskControlUID(task)) {
+			continue
+		}
+		if !store.IsTerminalPublicationState(store.PublicationState(publication.Status.State)) {
+			return nil, false, nil
+		}
+		publicationIDs[publication.Spec.ID] = struct{}{}
+	}
+	if task.Status.Execution != nil && task.Spec.Workspace != nil && task.Spec.Workspace.Intent == corev1alpha1.WorkspaceIntentWrite {
+		publicationIDs[publicationIDForTaskUID(task, acpTaskControlUID(task))] = struct{}{}
+	}
+
+	relatedEffects := map[string]struct{}{string(acpTaskControlUID(task)): {}}
+	if task.Status.Execution != nil && task.Status.Execution.RuntimeSessionUID != "" {
+		relatedEffects[task.Status.Execution.RuntimeSessionUID] = struct{}{}
+	}
+	for publicationID := range publicationIDs {
+		relatedEffects[publicationID] = struct{}{}
+	}
+	var effects corev1alpha1.ExternalEffectList
+	if err := reader.List(ctx, &effects, client.InNamespace(task.Namespace)); err != nil {
+		return nil, false, fmt.Errorf("list external effects for artifact retirement: %w", err)
+	}
+	for i := range effects.Items {
+		effect := &effects.Items[i]
+		if _, related := relatedEffects[effect.Spec.AggregateID]; !related {
+			continue
+		}
+		switch store.ExternalEffectState(effect.Status.State) {
+		case store.ExternalEffectSucceeded, store.ExternalEffectFailed, store.ExternalEffectOutcomeUnknown:
+		default:
+			return nil, false, nil
+		}
+	}
+
+	identities := []artifactcap.Identity{{Namespace: task.Namespace, TaskID: string(acpTaskControlUID(task))}}
+	orderedPublications := make([]string, 0, len(publicationIDs))
+	for publicationID := range publicationIDs {
+		orderedPublications = append(orderedPublications, publicationID)
+	}
+	sort.Strings(orderedPublications)
+	for _, publicationID := range orderedPublications {
+		identities = append(identities, artifactcap.Identity{Namespace: task.Namespace, PublicationID: publicationID})
+	}
+	return identities, true, nil
+}
diff --git a/internal/controller/acp_task_finalizer_test.go b/internal/controller/acp_task_finalizer_test.go
new file mode 100644
index 000000000..9c8083a78
--- /dev/null
+++ b/internal/controller/acp_task_finalizer_test.go
@@ -0,0 +1,481 @@
+package controller
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/artifactcap"
+	"github.com/orka-agents/orka/internal/labels"
+	"github.com/orka-agents/orka/internal/publisher"
+	publisherservice "github.com/orka-agents/orka/internal/publisher/service"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+func TestDeletingACPTaskDefersPromptAttemptReclamationWhenStoreIsNotReady(t *testing.T) {
+	task, attempt := promptAttemptReclaimFinalizerFixture(t)
+	controlStore := &promptAttemptReclaimControlStore{attempt: attempt, reclaimErr: store.ErrNotReady}
+	reconciler := &TaskReconciler{
+		DurableControlStore:    controlStore,
+		ControllerEpochManager: readyPromptAttemptReclaimEpochManager(),
+	}
+
+	ready, err := reconciler.retireACPArtifactIdentities(context.Background(), task)
+	if err != nil {
+		t.Fatalf("retireACPArtifactIdentities() error = %v", err)
+	}
+	if ready {
+		t.Fatal("retireACPArtifactIdentities() reported ready while PromptAttempt reclamation was deferred")
+	}
+	if len(controlStore.reclaimRequests) != 1 {
+		t.Fatalf("reclaim requests = %#v, want one", controlStore.reclaimRequests)
+	}
+}
+
+func TestDeletingACPTaskReclaimsPromptAttemptsAfterFinalizationBarriers(t *testing.T) {
+	task, attempt := promptAttemptReclaimFinalizerFixture(t)
+	controlStore := &promptAttemptReclaimControlStore{attempt: attempt, reclaimed: 2}
+	epochs := readyPromptAttemptReclaimEpochManager()
+	reconciler := &TaskReconciler{DurableControlStore: controlStore, ControllerEpochManager: epochs}
+
+	ready, err := reconciler.retireACPArtifactIdentities(context.Background(), task)
+	if err != nil {
+		t.Fatalf("retireACPArtifactIdentities() error = %v", err)
+	}
+	if !ready {
+		t.Fatal("retireACPArtifactIdentities() did not complete after PromptAttempt reclamation")
+	}
+	if len(controlStore.reclaimRequests) != 1 {
+		t.Fatalf("reclaim requests = %#v, want one", controlStore.reclaimRequests)
+	}
+	request := controlStore.reclaimRequests[0]
+	if request.Namespace != task.Namespace || request.TaskUID != string(task.UID) ||
+		request.FinalPromptAttemptID != attempt.ID ||
+		request.TerminalProjectionID != standaloneTaskTerminalProjectionID(task, task.Status.Execution.Attempt) ||
+		request.Fence.Name != store.DefaultControllerEpochName || request.Fence.Epoch != 7 || request.Fence.HolderID != "reclaim-controller" {
+		t.Fatalf("reclaim request = %#v, want exact Task/final-attempt/projection/epoch binding", request)
+	}
+}
+
+func TestDeletingRestoredACPTaskUsesFrozenSourceIdentityForCleanup(t *testing.T) {
+	task, attempt := promptAttemptReclaimFinalizerFixture(t)
+	sourceUID := task.UID
+	restoredUID := types.UID("99999999-8888-7777-6666-555555555555")
+	task.UID = restoredUID
+	task.Finalizers = []string{labels.TaskFinalizer}
+	binding := testACPExecuteBindingForDispatcher()
+	binding.Task.UID = sourceUID
+	task.Status.AgentExecutionBinding = binding
+	task.Status.Phase = corev1alpha1.TaskPhaseFailed
+	task.Status.Execution.State = corev1alpha1.TaskExecutionStateOutcomeUnknown
+	task.Status.Execution.Outcome = corev1alpha1.TaskExecutionOutcomeOutcomeUnknown
+	task.Status.Execution.Reason = corev1alpha1.TaskExecutionReason(acpRestoreIdentityChangedReason)
+	task.Status.Execution.RuntimeInstanceID = "runtime-instance"
+	task.Status.Execution.RuntimeSessionUID = "runtime-session"
+	task.Status.Execution.RuntimeSessionGeneration = 1
+	cleanupDigest, err := taskScopedRuntimeSessionCleanupDigest(
+		sourceUID,
+		task.Status.Execution.Attempt,
+		task.Status.Execution.RuntimeInstanceID,
+		task.Status.Execution.RuntimeSessionUID,
+		task.Status.Execution.RuntimeSessionGeneration,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	task.Status.Execution.RuntimeSessionCleanupDigest = cleanupDigest
+	if !taskScopedRuntimeSessionCleanupComplete(task) {
+		t.Fatal("restored Task did not recognize the source-bound RuntimeSession cleanup receipt")
+	}
+	attempt.BindingDigest = binding.BindingDigest
+	attempt.SnapshotDigest = binding.Snapshot.Digest
+
+	sourcePublicationID := publicationIDForTaskUID(task, sourceUID)
+	sourceProjectionID := standaloneTaskTerminalProjectionIDForUID(task.Namespace, sourceUID, task.Status.Execution.Attempt)
+	task.Status.Delivery.PublicationID = sourcePublicationID
+	publication := &store.Publication{
+		ID: sourcePublicationID, Namespace: task.Namespace, Generation: 1, State: store.PublicationVerifiedExact,
+	}
+	controlStore := &promptAttemptReclaimControlStore{
+		attempt: attempt, publication: publication,
+		projection: &store.OutboxProjection{ID: sourceProjectionID, State: store.OutboxProjectionDelivered},
+		reclaimed:  1,
+	}
+	attemptObject := &corev1alpha1.PromptAttempt{
+		ObjectMeta: metav1.ObjectMeta{Namespace: task.Namespace, Name: "restored-source-attempt"},
+		Spec: corev1alpha1.PromptAttemptSpec{
+			ID: attempt.ID, TaskUID: string(sourceUID), Attempt: int64(task.Status.Execution.Attempt), PromptID: task.Status.Execution.PromptID,
+		},
+		Status: corev1alpha1.PromptAttemptStatus{
+			ExecutionState: corev1alpha1.PromptAttemptExecutionState(store.PromptExecutionSucceeded),
+			DeliveryState:  corev1alpha1.PromptAttemptDeliveryState(store.PromptDeliveryVerifiedExact),
+		},
+	}
+	publicationObject := &corev1alpha1.Publication{
+		ObjectMeta: metav1.ObjectMeta{Namespace: task.Namespace, Name: "restored-source-publication"},
+		Spec: corev1alpha1.PublicationSpec{
+			ID: sourcePublicationID, Generation: 1, TaskUID: string(sourceUID), Attempt: int64(task.Status.Execution.Attempt),
+		},
+		Status: corev1alpha1.PublicationStatus{State: corev1alpha1.PublicationControlState(store.PublicationVerifiedExact)},
+	}
+	reconciler := newUnitReconciler(newTestScheme(), task, attemptObject, publicationObject)
+	reconciler.DurableControlStore = controlStore
+	reconciler.ControllerEpochManager = readyPromptAttemptReclaimEpochManager()
+
+	ready, err := reconciler.acpTaskDeletionReady(context.Background(), task)
+	if err != nil || !ready {
+		t.Fatalf("restored Task deletion readiness = %v, %v", ready, err)
+	}
+	request, err := reconciler.acpPromptAttemptReclamationRequest(context.Background(), task)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if request.TaskUID != string(sourceUID) || request.FinalPromptAttemptID != attempt.ID ||
+		request.TerminalProjectionID != sourceProjectionID ||
+		len(request.RelatedExternalEffectAggregateIDs) != 2 ||
+		request.RelatedExternalEffectAggregateIDs[0] != task.Status.Execution.RuntimeSessionUID ||
+		request.RelatedExternalEffectAggregateIDs[1] != sourcePublicationID {
+		t.Fatalf("restored reclamation request = %#v", request)
+	}
+	identities, ready, err := reconciler.acpArtifactRetirementIdentities(context.Background(), task)
+	if err != nil || !ready {
+		t.Fatalf("restored artifact identities readiness = %v, %v", ready, err)
+	}
+	wantIdentities := []artifactcap.Identity{
+		{Namespace: task.Namespace, TaskID: string(sourceUID)},
+		{Namespace: task.Namespace, PublicationID: sourcePublicationID},
+	}
+	if !identitySlicesEqual(identities, wantIdentities) {
+		t.Fatalf("restored artifact identities = %#v, want %#v", identities, wantIdentities)
+	}
+}
+
+func TestDeletingACPTaskRejectsUnvalidatedMismatchedBindingUID(t *testing.T) {
+	task, attempt := promptAttemptReclaimFinalizerFixture(t)
+	foreignUID := types.UID("aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee")
+	binding := testACPExecuteBindingForDispatcher()
+	binding.Task.UID = foreignUID
+	task.Status.AgentExecutionBinding = binding
+	controlStore := &promptAttemptReclaimControlStore{attempt: attempt}
+	reconciler := &TaskReconciler{DurableControlStore: controlStore}
+
+	if got := acpTaskControlUID(task); got != task.UID {
+		t.Fatalf("unvalidated control UID = %q, want live Task UID %q", got, task.UID)
+	}
+	ready, err := reconciler.acpTaskDeletionReady(context.Background(), task)
+	if ready || !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("unvalidated mismatch deletion readiness = %v, %v, want false/ErrConflict", ready, err)
+	}
+	if len(controlStore.getAttemptIDs) != 0 {
+		t.Fatalf("unvalidated mismatch read foreign PromptAttempt IDs: %#v", controlStore.getAttemptIDs)
+	}
+}
+
+func TestDeletingACPTaskStillUsesDurableCleanupStoreWhenACPAdmissionDisabled(t *testing.T) {
+	task, attempt := promptAttemptReclaimFinalizerFixture(t)
+	controlStore := &promptAttemptReclaimControlStore{attempt: attempt, reclaimed: 1}
+	reconciler := &TaskReconciler{
+		DurableControlStore:    controlStore,
+		ControllerEpochManager: readyPromptAttemptReclaimEpochManager(),
+		ACPRuntimeEnabled:      false,
+	}
+
+	ready, err := reconciler.retireACPArtifactIdentities(context.Background(), task)
+	if err != nil {
+		t.Fatalf("retireACPArtifactIdentities() error = %v", err)
+	}
+	if !ready {
+		t.Fatal("retireACPArtifactIdentities() did not complete with ACP admission disabled")
+	}
+	if len(controlStore.reclaimRequests) != 1 {
+		t.Fatalf("reclaim requests = %#v, want one cleanup request", controlStore.reclaimRequests)
+	}
+}
+
+func TestDeletingACPTaskUsesStandaloneProjectionBeforeSessionBinding(t *testing.T) {
+	task, attempt := promptAttemptReclaimFinalizerFixture(t)
+	task.Spec.SessionRef = &corev1alpha1.SessionReference{Name: "unbound-session", Create: true, Append: true}
+	attempt.ExecutionState = store.PromptExecutionCancelled
+	attempt.DeliveryState = store.PromptDeliveryNotRequested
+	controlStore := &promptAttemptReclaimControlStore{attempt: attempt, reclaimed: 1}
+	reconciler := &TaskReconciler{
+		DurableControlStore: controlStore, ControllerEpochManager: readyPromptAttemptReclaimEpochManager(),
+	}
+
+	ready, err := reconciler.retireACPArtifactIdentities(context.Background(), task)
+	if err != nil {
+		t.Fatalf("retireACPArtifactIdentities() error = %v", err)
+	}
+	if !ready || len(controlStore.reclaimRequests) != 1 {
+		t.Fatalf("reclamation ready=%v requests=%#v", ready, controlStore.reclaimRequests)
+	}
+	if got, want := controlStore.reclaimRequests[0].TerminalProjectionID, standaloneTaskTerminalProjectionID(task, task.Status.Execution.Attempt); got != want {
+		t.Fatalf("terminal projection ID = %q, want %q", got, want)
+	}
+}
+
+func TestACPTaskTimeoutRequiresAuthoritativeAttemptDiscovery(t *testing.T) {
+	task := &corev1alpha1.Task{Status: corev1alpha1.TaskStatus{
+		Phase: corev1alpha1.TaskPhaseCancelled,
+		Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateCancelled, Outcome: corev1alpha1.TaskExecutionOutcomeCancelled,
+			Reason: corev1alpha1.TaskExecutionReason("TaskTimeout"),
+		},
+		Delivery: &corev1alpha1.TaskDeliveryStatus{
+			State: corev1alpha1.TaskDeliveryStateNotRequested, Outcome: corev1alpha1.TaskDeliveryOutcomeNotRequested,
+		},
+	}}
+	if acpTaskTerminalBeforeDurableAttempt(task) {
+		t.Fatal("pre-queue Task timeout was incorrectly classified as proven before durable attempt creation")
+	}
+	if !acpTaskRequiresAuthoritativeAttemptDiscovery(task) {
+		t.Fatal("pre-queue Task timeout did not require authoritative PromptAttempt discovery")
+	}
+}
+
+func TestACPNoAttemptReclamationIgnoresUnboundSessionReference(t *testing.T) {
+	task := artifactRetentionTask()
+	task.Spec.SessionRef = &corev1alpha1.SessionReference{Name: "never-bound", Create: true, Append: true}
+	task.Status.Execution = &corev1alpha1.TaskExecutionStatus{
+		State: corev1alpha1.TaskExecutionStateFailed, Outcome: corev1alpha1.TaskExecutionOutcomeFailed,
+		Reason: corev1alpha1.TaskExecutionReason("InvalidWorkspace"),
+	}
+	task.Status.Delivery = &corev1alpha1.TaskDeliveryStatus{
+		State: corev1alpha1.TaskDeliveryStateNotRequested, Outcome: corev1alpha1.TaskDeliveryOutcomeNotRequested,
+	}
+	reconciler := &TaskReconciler{
+		DurableControlStore:    &promptAttemptReclaimControlStore{},
+		ControllerEpochManager: readyPromptAttemptReclaimEpochManager(),
+	}
+	request, err := reconciler.acpPromptAttemptReclamationRequest(context.Background(), task)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if request.Mode != store.PromptAttemptReclamationNoAttempt || !request.ContinuitySession || request.FinalContinuitySession {
+		t.Fatalf("request = %#v, want NoAttempt with Task history but no final continuity binding", request)
+	}
+}
+
+func TestACPQueuedTimeoutPreservesTerminalProjectionBarrier(t *testing.T) {
+	task, attempt := promptAttemptReclaimFinalizerFixture(t)
+	task.Status.Execution.State = corev1alpha1.TaskExecutionStateCancelled
+	task.Status.Execution.Outcome = corev1alpha1.TaskExecutionOutcomeCancelled
+	task.Status.Execution.Reason = corev1alpha1.TaskExecutionReason("TaskTimeout")
+	task.Status.Execution.RuntimePoolName = "pool"
+	task.Status.Execution.RuntimePoolUID = "pool-uid"
+	task.Status.Execution.RuntimeInstanceID = ""
+	task.Status.Execution.RuntimeSessionUID = ""
+	task.Status.Execution.RuntimeSessionGeneration = 0
+	task.Status.Delivery = &corev1alpha1.TaskDeliveryStatus{
+		State: corev1alpha1.TaskDeliveryStateNotRequested, Outcome: corev1alpha1.TaskDeliveryOutcomeNotRequested,
+	}
+	task.Spec.Workspace = nil
+	attempt.ExecutionState = store.PromptExecutionCancelled
+	attempt.DeliveryState = store.PromptDeliveryNotRequested
+	projectionID := standaloneTaskTerminalProjectionID(task, task.Status.Execution.Attempt)
+	controlStore := &promptAttemptReclaimControlStore{
+		attempt:    attempt,
+		projection: &store.OutboxProjection{ID: projectionID, State: store.OutboxProjectionPending},
+	}
+	reconciler := &TaskReconciler{
+		DurableControlStore: controlStore, ControllerEpochManager: readyPromptAttemptReclaimEpochManager(),
+	}
+	request, err := reconciler.acpPromptAttemptReclamationRequest(context.Background(), task)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if request.Mode != store.PromptAttemptReclamationProjected || request.TerminalProjectionID != projectionID {
+		t.Fatalf("request = %#v, want projected reclamation barrier", request)
+	}
+}
+
+func TestDeletingACPTaskReclaimsPublisherCacheBeforeDurableArtifactsAndRetries(t *testing.T) {
+	task, attempt := promptAttemptReclaimFinalizerFixture(t)
+	task.Finalizers = []string{labels.TaskFinalizer}
+	publicationID := publicationIDForTask(task)
+	task.Status.Delivery.PublicationID = publicationID
+	publication := &store.Publication{ID: publicationID, Namespace: task.Namespace, Generation: 1, State: store.PublicationVerifiedExact}
+	projection := &store.OutboxProjection{
+		ID: standaloneTaskTerminalProjectionID(task, task.Status.Execution.Attempt), State: store.OutboxProjectionDelivered,
+	}
+	attemptObject := &corev1alpha1.PromptAttempt{
+		ObjectMeta: metav1.ObjectMeta{Namespace: task.Namespace, Name: "publisher-reclaim-attempt"},
+		Spec: corev1alpha1.PromptAttemptSpec{
+			ID: attempt.ID, TaskUID: string(task.UID), Attempt: int64(task.Status.Execution.Attempt), PromptID: task.Status.Execution.PromptID,
+		},
+		Status: corev1alpha1.PromptAttemptStatus{
+			ExecutionState: corev1alpha1.PromptAttemptExecutionState(store.PromptExecutionSucceeded),
+			DeliveryState:  corev1alpha1.PromptAttemptDeliveryState(store.PromptDeliveryVerifiedExact),
+		},
+	}
+	publicationObject := &corev1alpha1.Publication{
+		ObjectMeta: metav1.ObjectMeta{Namespace: task.Namespace, Name: "publisher-reclaim-publication"},
+		Spec: corev1alpha1.PublicationSpec{
+			ID: publicationID, Generation: publication.Generation, TaskUID: string(task.UID), Attempt: int64(task.Status.Execution.Attempt),
+		},
+		Status: corev1alpha1.PublicationStatus{State: corev1alpha1.PublicationControlState(store.PublicationVerifiedExact)},
+	}
+
+	events := []string{}
+	controlStore := &promptAttemptReclaimControlStore{
+		attempt: attempt, publication: publication, projection: projection, reclaimed: 1, events: &events,
+	}
+	reclaimer := &recordingPublicationReclaimer{failures: 1, events: &events}
+	reconciler := newUnitReconciler(newTestScheme(), task, attemptObject, publicationObject)
+	reconciler.DurableControlStore = controlStore
+	reconciler.ControllerEpochManager = readyPromptAttemptReclaimEpochManager()
+	reconciler.ACPPublicationReclaimer = reclaimer
+
+	if _, err := reconciler.handleDeletion(context.Background(), task); err == nil {
+		t.Fatal("first handleDeletion() error = nil, want Publisher reclaim retry")
+	}
+	if len(events) != 1 || events[0] != "publisher" {
+		t.Fatalf("first deletion events = %v, want Publisher only", events)
+	}
+	var stored corev1alpha1.Task
+	if err := reconciler.Get(context.Background(), types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, &stored); err != nil {
+		t.Fatalf("get Task after failed Publisher reclaim: %v", err)
+	}
+	if !controllerutil.ContainsFinalizer(&stored, labels.TaskFinalizer) {
+		t.Fatal("Task finalizer removed before Publisher reclaim succeeded")
+	}
+
+	if _, err := reconciler.handleDeletion(context.Background(), task); err != nil {
+		t.Fatalf("retry handleDeletion(): %v", err)
+	}
+	wantEvents := []string{"publisher", "publisher", "prepare-prompt-reclaim", "prompt-reclaim"}
+	if len(events) != len(wantEvents) {
+		t.Fatalf("retry deletion events = %v, want %v", events, wantEvents)
+	}
+	for index := range wantEvents {
+		if events[index] != wantEvents[index] {
+			t.Fatalf("retry deletion events = %v, want %v", events, wantEvents)
+		}
+	}
+	if len(reclaimer.requests) != 2 || reclaimer.requests[0] != reclaimer.requests[1] {
+		t.Fatalf("Publisher reclaim requests = %#v, want identical crash-safe retry", reclaimer.requests)
+	}
+	request := reclaimer.requests[1]
+	if request.Metadata.PublicationID != publicationID || request.Request.PublicationID != publicationID ||
+		request.Request.PublicationGeneration != publication.Generation {
+		t.Fatalf("Publisher reclaim request = %#v, want exact publication identity", request)
+	}
+	if err := reconciler.Get(context.Background(), types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, &stored); !apierrors.IsNotFound(err) && (err != nil || controllerutil.ContainsFinalizer(&stored, labels.TaskFinalizer)) {
+		t.Fatalf("Task finalizer remains after successful ordered cleanup: %v, %#v", err, stored.Finalizers)
+	}
+}
+
+type recordingPublicationReclaimer struct {
+	requests []publisherservice.PublicationReclaimRequest
+	failures int
+	events   *[]string
+}
+
+func (r *recordingPublicationReclaimer) ReclaimPublication(
+	_ context.Context, request publisherservice.PublicationReclaimRequest,
+) (publisherservice.PublicationReclaimResponse, error) {
+	r.requests = append(r.requests, request)
+	if r.events != nil {
+		*r.events = append(*r.events, "publisher")
+	}
+	if r.failures > 0 {
+		r.failures--
+		return publisherservice.PublicationReclaimResponse{}, errors.New("temporary Publisher reclaim failure")
+	}
+	return publisherservice.PublicationReclaimResponse{
+		OperationID: request.Metadata.OperationID,
+		Result: publisher.ReclaimResult{
+			PublicationID: request.Request.PublicationID, PublicationGeneration: request.Request.PublicationGeneration, Reclaimed: true,
+		},
+	}, nil
+}
+
+func promptAttemptReclaimFinalizerFixture(t *testing.T) (*corev1alpha1.Task, *store.PromptAttempt) {
+	t.Helper()
+	task := artifactRetentionTask()
+	now := metav1.Now()
+	task.DeletionTimestamp = &now
+	meta.SetStatusCondition(&task.Status.Conditions, metav1.Condition{
+		Type: conditionTypeACPArtifactsRetired, Status: metav1.ConditionTrue,
+		Reason: "ArtifactReferencesReleased", LastTransitionTime: now,
+	})
+	key := store.PromptAttemptKey{
+		Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: int64(task.Status.Execution.Attempt), PromptID: task.Status.Execution.PromptID,
+	}
+	id, err := key.CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return task, &store.PromptAttempt{
+		ID: id, Key: key, ExecutionState: store.PromptExecutionSucceeded, DeliveryState: store.PromptDeliveryVerifiedExact,
+	}
+}
+
+type promptAttemptReclaimControlStore struct {
+	store.DurableControlStore
+	attempt         *store.PromptAttempt
+	getAttemptIDs   []string
+	reclaimed       int
+	reclaimErr      error
+	reclaimRequests []store.ReclaimPromptAttemptsRequest
+	projection      *store.OutboxProjection
+	publication     *store.Publication
+	events          *[]string
+}
+
+func (s *promptAttemptReclaimControlStore) GetOutboxProjection(_ context.Context, id string) (*store.OutboxProjection, error) {
+	if s.projection == nil || s.projection.ID != id {
+		return nil, store.ErrNotFound
+	}
+	copy := *s.projection
+	return &copy, nil
+}
+
+func (s *promptAttemptReclaimControlStore) PreparePromptAttemptReclamation(context.Context, store.ReclaimPromptAttemptsRequest) error {
+	if s.events != nil {
+		*s.events = append(*s.events, "prepare-prompt-reclaim")
+	}
+	return nil
+}
+
+func (s *promptAttemptReclaimControlStore) GetPromptAttempt(_ context.Context, id string) (*store.PromptAttempt, error) {
+	s.getAttemptIDs = append(s.getAttemptIDs, id)
+	if s.attempt == nil || s.attempt.ID != id {
+		return nil, store.ErrNotFound
+	}
+	copy := *s.attempt
+	return &copy, nil
+}
+
+func (s *promptAttemptReclaimControlStore) GetPublication(_ context.Context, id string) (*store.Publication, error) {
+	if s.publication == nil || s.publication.ID != id {
+		return nil, store.ErrNotFound
+	}
+	copy := *s.publication
+	return &copy, nil
+}
+
+func (s *promptAttemptReclaimControlStore) ReclaimPromptAttempts(_ context.Context, request store.ReclaimPromptAttemptsRequest) (int, error) {
+	s.reclaimRequests = append(s.reclaimRequests, request)
+	if s.events != nil {
+		*s.events = append(*s.events, "prompt-reclaim")
+	}
+	if s.reclaimErr != nil {
+		return 0, s.reclaimErr
+	}
+	return s.reclaimed, nil
+}
+
+func readyPromptAttemptReclaimEpochManager() *ControllerEpochManager {
+	epochs := NewControllerEpochManager(nil, "reclaim-controller")
+	epochs.current = &store.ControllerEpoch{Name: store.DefaultControllerEpochName, Epoch: 7, HolderID: "reclaim-controller"}
+	close(epochs.ready)
+	return epochs
+}
diff --git a/internal/controller/acp_task_queue.go b/internal/controller/acp_task_queue.go
new file mode 100644
index 000000000..321fdc22c
--- /dev/null
+++ b/internal/controller/acp_task_queue.go
@@ -0,0 +1,1142 @@
+package controller
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"path"
+	"sort"
+	"strings"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/util/retry"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+const (
+	acpRuntimePoolLabel                      = "orka.ai/acp-runtime-pool"
+	acpRuntimeTrustLabel                     = "orka.ai/acp-trust-domain"
+	acpRuntimeProfileLabel                   = "orka.ai/acp-profile"
+	acpRuntimeTaskPoolLabel                  = "orka.ai/runtime-pool"
+	acpRuntimeSessionCleanupAnnotation       = "orka.ai/runtime-session-cleanup"
+	acpExternalRuntimeTaskLabel              = "orka.ai/agent-runtime"
+	acpRuntimeLastDemandAnnotation           = "orka.ai/acp-last-demand-at"
+	acpRuntimeQueuedAtAnnotation             = "orka.ai/acp-queued-at"
+	defaultACPTaskPriority             int32 = 500
+	defaultACPQueueAgingStep           int32 = 25
+)
+
+const (
+	DefaultACPQueueAgingInterval = 30 * time.Second
+	DefaultACPQueueMaximumWait   = 5 * time.Minute
+)
+
+//nolint:gocyclo // ACP queueing keeps durable planning, recovery, and binding gates auditable together.
+func (r *TaskReconciler) queueACPRuntimeTask(ctx context.Context, task *corev1alpha1.Task, _ *corev1alpha1.Agent) (ctrl.Result, error) {
+	if task == nil || task.Status.AgentExecutionBinding == nil {
+		return ctrl.Result{}, errors.New("immutable v2 execution binding is required before ACP queueing")
+	}
+	bound, err := r.loadVerifiedBoundExecution(ctx, task, task.Status.AgentExecutionBinding)
+	if err != nil {
+		return ctrl.Result{}, fmt.Errorf("verify immutable v2 execution before ACP queueing: %w", err)
+	}
+	frozenTask := bound.frozenTask
+	plan := bound.plan
+	if err := r.ACPAdmissionGate.Check(); err != nil {
+		return ctrl.Result{RequeueAfter: 5 * time.Second}, nil
+	}
+	if r.DurableControlStore == nil || r.ControllerEpochManager == nil {
+		return r.failTask(ctx, task, "durable ACP control store and controller epoch manager are required")
+	}
+	if handled, result, err := r.reconcileDurableACPPlanningFailure(ctx, task); handled || err != nil {
+		return result, err
+	}
+	if err := validateACPWorkspacePreflight(frozenTask); err != nil {
+		return r.failACPPlanningTask(ctx, task, corev1alpha1.TaskExecutionReason("InvalidWorkspace"), err.Error())
+	}
+	reader := r.APIReader
+	if reader == nil {
+		reader = r.Client
+	}
+	pool, err := r.ensureACPRuntimePool(ctx, task.Namespace, plan)
+	if err != nil {
+		return ctrl.Result{}, err
+	}
+	if task.Status.Execution != nil && !taskExecutionStateTerminal(task.Status.Execution.State) {
+		if task.Status.Execution.State == corev1alpha1.TaskExecutionStateQueued ||
+			task.Status.Execution.State == corev1alpha1.TaskExecutionStateReserved {
+			rebound, rebindErr := r.rebindQueuedACPRuntimeTask(ctx, task, bound, pool)
+			if rebindErr != nil {
+				return ctrl.Result{}, rebindErr
+			}
+			if rebound && r.Recorder != nil {
+				r.Recorder.Eventf(task, corev1.EventTypeNormal, "ACPRuntimePoolRebound", "Rebound pre-submission attempt %d to replacement RuntimePool %s", task.Status.Execution.Attempt, pool.Name)
+			}
+		}
+		return ctrl.Result{RequeueAfter: time.Second}, nil
+	}
+	if task.UID == "" {
+		return r.failTask(ctx, task, "Task UID is required for ACP prompt identity")
+	}
+	fence, err := r.ControllerEpochManager.CurrentFence(ctx)
+	if err != nil {
+		return ctrl.Result{}, err
+	}
+	attemptNumber := task.Status.Attempts + 1
+	queuedAt := time.Now().UTC()
+	promptID := fmt.Sprintf("prompt-%s-%d", task.UID, attemptNumber)
+	requestDigest, err := acpBoundTaskRequestDigest(bound, attemptNumber, promptID)
+	if err != nil {
+		return ctrl.Result{}, err
+	}
+	key := store.PromptAttemptKey{Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: int64(attemptNumber), PromptID: promptID}
+	attemptID, err := key.CanonicalID()
+	if err != nil {
+		return ctrl.Result{}, err
+	}
+	credentialBindings, credentialVersions, err := resolvePromptCredentialBindings(ctx, reader, frozenTask)
+	if err != nil {
+		credentialErr := fmt.Errorf("freeze ACP credential bindings: %w", err)
+		if !apierrors.IsNotFound(err) {
+			return ctrl.Result{}, credentialErr
+		}
+		return r.failACPPlanningTask(ctx, task, corev1alpha1.TaskExecutionReason("InvalidWorkspace"), credentialErr.Error())
+	}
+	attempt, err := r.DurableControlStore.CreatePromptAttempt(ctx, &store.PromptAttempt{
+		ID: attemptID, Key: key, RequestDigest: requestDigest,
+		BindingDigest: bound.binding.BindingDigest, SnapshotDigest: bound.snapshot.Digest,
+		CredentialBindings: credentialBindings,
+		ExecutionState:     store.PromptExecutionQueued, DeliveryState: store.PromptDeliveryNotRequested, CreatedAt: queuedAt,
+	}, fence)
+	if err != nil {
+		return ctrl.Result{}, fmt.Errorf("persist ACP prompt attempt: %w", err)
+	}
+
+	metadataBase := task.DeepCopy()
+	if task.Labels == nil {
+		task.Labels = make(map[string]string)
+	}
+	if task.Annotations == nil {
+		task.Annotations = make(map[string]string)
+	}
+	task.Labels[acpRuntimeTaskPoolLabel] = pool.Name
+	task.Annotations[acpRuntimeQueuedAtAnnotation] = queuedAt.Format(time.RFC3339Nano)
+	if err := r.Patch(ctx, task, client.MergeFrom(metadataBase)); err != nil {
+		return ctrl.Result{}, err
+	}
+	statusBase := task.DeepCopy()
+	now := metav1.NewTime(queuedAt)
+	task.Status.Attempts = attemptNumber
+	task.Status.Execution = &corev1alpha1.TaskExecutionStatus{
+		State: corev1alpha1.TaskExecutionStateQueued, Attempt: attemptNumber, PromptID: promptID,
+		RuntimePoolName: pool.Name, RuntimePoolUID: string(pool.UID), ControllerEpoch: fence.Epoch,
+		RequestDigest:                            attempt.RequestDigest,
+		ReadCredentialResourceVersion:            credentialVersions.SourceRead,
+		PublicationReadCredentialResourceVersion: credentialVersions.TargetRead,
+		PublicationCredentialResourceVersion:     credentialVersions.TargetWrite,
+		ForgeCredentialResourceVersion:           credentialVersions.Forge,
+		LastTransitionTime:                       &now,
+	}
+	task.Status.Delivery = &corev1alpha1.TaskDeliveryStatus{
+		State: corev1alpha1.TaskDeliveryStateNotRequested, Outcome: corev1alpha1.TaskDeliveryOutcomeNotRequested, LastTransitionTime: &now,
+	}
+	if err := r.Status().Patch(ctx, task, client.MergeFrom(statusBase)); err != nil {
+		return ctrl.Result{}, err
+	}
+	if r.Recorder != nil {
+		r.Recorder.Eventf(task, corev1.EventTypeNormal, "ACPTaskQueued", "Queued attempt %d for RuntimePool %s", attemptNumber, pool.Name)
+	}
+	return ctrl.Result{RequeueAfter: time.Second}, nil
+}
+
+//nolint:gocyclo // Rebinding keeps every queued-attempt fence and optimistic-lock check auditable together.
+func (r *TaskReconciler) rebindQueuedACPRuntimeTask(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	bound *verifiedAgentExecution,
+	pool *corev1alpha1.RuntimePool,
+) (bool, error) {
+	if task == nil || task.Status.Execution == nil ||
+		(task.Status.Execution.State != corev1alpha1.TaskExecutionStateQueued &&
+			task.Status.Execution.State != corev1alpha1.TaskExecutionStateReserved) ||
+		pool == nil || pool.UID == "" {
+		return false, nil
+	}
+	if acpRuntimePoolBindingMatches(task.Status.Execution, pool) {
+		return r.patchACPRuntimePoolTaskLabel(ctx, task, pool)
+	}
+	requestMatches, err := acpQueuedTaskRequestMatchesBinding(bound, task.Status.Execution)
+	if err != nil {
+		return false, err
+	}
+	if !requestMatches {
+		return false, nil
+	}
+	attemptID, err := promptAttemptIDFromTask(task)
+	if err != nil {
+		return false, err
+	}
+	attempt, err := r.DurableControlStore.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		return false, err
+	}
+	expectedAttemptState := store.PromptExecutionQueued
+	if task.Status.Execution.State == corev1alpha1.TaskExecutionStateReserved {
+		expectedAttemptState = store.PromptExecutionReserved
+	}
+	if !queuedPromptAttemptMatchesTask(attempt, task) || attempt.ExecutionState != expectedAttemptState ||
+		attempt.DeliveryState != store.PromptDeliveryNotRequested || promptAttemptHasRuntimeOrSessionBinding(attempt) ||
+		taskExecutionHasRuntimeOrSessionBinding(task.Status.Execution) {
+		return false, nil
+	}
+	fence, err := r.ControllerEpochManager.CurrentFence(ctx)
+	if err != nil {
+		return false, err
+	}
+	if expectedAttemptState == store.PromptExecutionReserved {
+		safe, safeErr := r.reservedACPRuntimeTaskRebindSafe(ctx, task, attempt, fence)
+		if safeErr != nil {
+			return false, safeErr
+		}
+		if !safe {
+			return false, nil
+		}
+		attempt, err = r.refreshReservedACPRuntimeTaskRebind(ctx, task, attempt, pool, fence)
+		if err != nil {
+			return false, err
+		}
+	}
+
+	key := types.NamespacedName{Namespace: task.Namespace, Name: task.Name}
+	expectedTaskUID := task.UID
+	expectedAttempt := task.Status.Execution.Attempt
+	expectedPromptID := task.Status.Execution.PromptID
+	expectedRequestDigest := task.Status.Execution.RequestDigest
+	expectedAttemptVersion := attempt.Version
+	rebound := false
+	if err := retry.RetryOnConflict(retry.DefaultBackoff, func() error {
+		current := &corev1alpha1.Task{}
+		if err := r.taskMetadataReader().Get(ctx, key, current); err != nil {
+			return err
+		}
+		status := current.Status.Execution
+		if current.UID != expectedTaskUID || status == nil || status.State != task.Status.Execution.State ||
+			status.Attempt != expectedAttempt || status.PromptID != expectedPromptID || status.RequestDigest != expectedRequestDigest ||
+			taskExecutionHasRuntimeOrSessionBinding(status) {
+			return nil
+		}
+		if acpRuntimePoolBindingMatches(status, pool) {
+			rebound = true
+			return nil
+		}
+		currentAttempt, err := r.DurableControlStore.GetPromptAttempt(ctx, attemptID)
+		if err != nil {
+			return err
+		}
+		if currentAttempt.Version != expectedAttemptVersion || currentAttempt.ExecutionState != expectedAttemptState ||
+			!queuedPromptAttemptMatchesTask(currentAttempt, current) ||
+			currentAttempt.DeliveryState != store.PromptDeliveryNotRequested || promptAttemptHasRuntimeOrSessionBinding(currentAttempt) {
+			return nil
+		}
+		if expectedAttemptState == store.PromptExecutionReserved {
+			safe, safeErr := r.reservedACPRuntimeTaskRebindSafe(ctx, current, currentAttempt, fence)
+			if safeErr != nil {
+				return safeErr
+			}
+			if !safe {
+				return nil
+			}
+		}
+		base := current.DeepCopy()
+		status.RuntimePoolName = pool.Name
+		status.RuntimePoolUID = string(pool.UID)
+		status.ControllerEpoch = fence.Epoch
+		status.Reason = ""
+		status.Message = ""
+		status.LastTransitionTime = nowMeta()
+		if err := r.Status().Patch(ctx, current, client.MergeFromWithOptions(base, client.MergeFromWithOptimisticLock{})); err != nil {
+			return err
+		}
+		rebound = true
+		return nil
+	}); err != nil {
+		return false, err
+	}
+	if !rebound {
+		return false, nil
+	}
+	labelPatched, err := r.patchACPRuntimePoolTaskLabel(ctx, task, pool)
+	if err != nil {
+		return false, err
+	}
+	return rebound || labelPatched, nil
+}
+
+func (r *TaskReconciler) patchACPRuntimePoolTaskLabel(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	pool *corev1alpha1.RuntimePool,
+) (bool, error) {
+	if task == nil || pool == nil {
+		return false, nil
+	}
+	key := types.NamespacedName{Namespace: task.Namespace, Name: task.Name}
+	expectedTaskUID := task.UID
+	patched := false
+	if err := retry.RetryOnConflict(retry.DefaultBackoff, func() error {
+		current := &corev1alpha1.Task{}
+		if err := r.taskMetadataReader().Get(ctx, key, current); err != nil {
+			return err
+		}
+		if current.UID != expectedTaskUID || !acpRuntimePoolBindingMatches(current.Status.Execution, pool) {
+			return nil
+		}
+		if current.Labels != nil && current.Labels[acpRuntimeTaskPoolLabel] == pool.Name {
+			return nil
+		}
+		base := current.DeepCopy()
+		if current.Labels == nil {
+			current.Labels = make(map[string]string)
+		}
+		current.Labels[acpRuntimeTaskPoolLabel] = pool.Name
+		if err := r.Patch(ctx, current, client.MergeFromWithOptions(base, client.MergeFromWithOptimisticLock{})); err != nil {
+			return err
+		}
+		patched = true
+		return nil
+	}); err != nil {
+		return false, err
+	}
+	return patched, nil
+}
+
+func taskExecutionHasRuntimeOrSessionBinding(status *corev1alpha1.TaskExecutionStatus) bool {
+	return status != nil && (strings.TrimSpace(status.RuntimeInstanceID) != "" ||
+		strings.TrimSpace(status.RuntimeSessionUID) != "" || status.RuntimeSessionGeneration != 0 ||
+		strings.TrimSpace(status.RuntimeSessionSupervisorBootID) != "" ||
+		strings.TrimSpace(status.RuntimeSessionProfileDigest) != "" || strings.TrimSpace(status.RuntimeSessionMCPDigest) != "" ||
+		strings.TrimSpace(status.RuntimeSessionWorkspaceDigest) != "" || status.RuntimeSessionRecreationPending)
+}
+
+func promptAttemptHasRuntimeOrSessionBinding(attempt *store.PromptAttempt) bool {
+	return attempt != nil && (strings.TrimSpace(attempt.RuntimeInstanceID) != "" ||
+		strings.TrimSpace(attempt.SessionUID) != "" || attempt.SessionLeaseGeneration != 0)
+}
+
+func (r *TaskReconciler) refreshReservedACPRuntimeTaskRebind(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attempt *store.PromptAttempt,
+	pool *corev1alpha1.RuntimePool,
+	fence store.ControllerEpochFence,
+) (*store.PromptAttempt, error) {
+	if task == nil || task.Status.Execution == nil || attempt == nil || pool == nil {
+		return nil, fmt.Errorf("reserved RuntimePool rebind identity is incomplete")
+	}
+	operationID := store.CanonicalControlID(
+		"rebind-reserved-runtime-pool", attempt.ID, task.Status.Execution.RuntimePoolUID, string(pool.UID),
+	)
+	operationDigest, err := acpDomainDigest("reserved-runtime-pool-rebind", map[string]any{
+		"attemptID": attempt.ID, "requestDigest": attempt.RequestDigest,
+		"fromPoolUID": task.Status.Execution.RuntimePoolUID, "toPoolUID": string(pool.UID),
+		"controllerEpoch": fence.Epoch,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return r.DurableControlStore.RecoverPromptAttemptPreSubmission(ctx, store.PromptAttemptPreSubmissionRecovery{
+		ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: store.PromptExecutionReserved,
+		OperationID: operationID, OperationDigest: operationDigest, RecoveredAt: time.Now().UTC(),
+	})
+}
+
+func (r *TaskReconciler) reservedACPRuntimeTaskRebindSafe(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attempt *store.PromptAttempt,
+	fence store.ControllerEpochFence,
+) (bool, error) {
+	if task == nil || task.Status.Execution == nil || attempt == nil ||
+		task.Status.Execution.State != corev1alpha1.TaskExecutionStateReserved ||
+		attempt.ExecutionState != store.PromptExecutionReserved || taskExecutionHasRuntimeOrSessionBinding(task.Status.Execution) ||
+		promptAttemptHasRuntimeOrSessionBinding(attempt) || task.Status.Execution.ControllerEpoch != fence.Epoch ||
+		attempt.ControllerEpoch != fence.Epoch || attempt.ControllerEpochName != fence.Name {
+		return false, nil
+	}
+	oldPool := &corev1alpha1.RuntimePool{}
+	key := types.NamespacedName{Namespace: task.Namespace, Name: strings.TrimSpace(task.Status.Execution.RuntimePoolName)}
+	if err := r.taskMetadataReader().Get(ctx, key, oldPool); err != nil {
+		if apierrors.IsNotFound(err) {
+			return true, nil
+		}
+		return false, err
+	}
+	if string(oldPool.UID) != strings.TrimSpace(task.Status.Execution.RuntimePoolUID) {
+		return true, nil
+	}
+	if oldPool.Status.Lifecycle == corev1alpha1.RuntimePoolLifecycleServing &&
+		oldPool.Status.AdmissionState == corev1alpha1.RuntimePoolAdmissionAccepting {
+		return false, nil
+	}
+	now := time.Now().UTC()
+	for i := range oldPool.Status.Capacity.Reservations {
+		reservation := oldPool.Status.Capacity.Reservations[i]
+		if reservation.PoolUID == string(oldPool.UID) && reservation.TaskUID == string(task.UID) &&
+			reservation.Attempt == task.Status.Execution.Attempt && reservation.ControllerEpoch == fence.Epoch &&
+			reservation.ExpiresAt.After(now) {
+			return false, nil
+		}
+	}
+	return true, nil
+}
+
+func queuedPromptAttemptMatchesTask(attempt *store.PromptAttempt, task *corev1alpha1.Task) bool {
+	return attempt != nil && task != nil && task.Status.Execution != nil &&
+		attempt.Key.Namespace == task.Namespace && attempt.Key.TaskUID == string(task.UID) &&
+		attempt.Key.Attempt == int64(task.Status.Execution.Attempt) && attempt.Key.PromptID == task.Status.Execution.PromptID &&
+		attempt.RequestDigest == task.Status.Execution.RequestDigest
+}
+
+type acpTaskQueueRank struct {
+	promoted          bool
+	effectivePriority int32
+	queuedAt          time.Time
+	createdAt         time.Time
+	namespace         string
+	name              string
+	uid               string
+}
+
+func sortACPTasksByQueuePriority(tasks []*corev1alpha1.Task, now time.Time) {
+	sortTasksByQueuePriority(tasks, now, acpTaskQueuedAt)
+}
+
+func sortTasksByQueuePriority(
+	tasks []*corev1alpha1.Task,
+	now time.Time,
+	queuedAt func(*corev1alpha1.Task) time.Time,
+) {
+	now = now.UTC()
+	ranks := make(map[*corev1alpha1.Task]acpTaskQueueRank, len(tasks))
+	for _, task := range tasks {
+		ranks[task] = rankTaskForQueue(task, now, queuedAt(task))
+	}
+	sort.SliceStable(tasks, func(i, j int) bool {
+		return taskQueueRankLess(ranks[tasks[i]], ranks[tasks[j]])
+	})
+}
+
+func rankTaskForQueue(task *corev1alpha1.Task, now, queuedAt time.Time) acpTaskQueueRank {
+	age := max(now.Sub(queuedAt), 0)
+	priority := defaultACPTaskPriority
+	if task != nil && task.Spec.Priority != nil {
+		priority = *task.Spec.Priority
+	}
+	agingSteps := int64(age / DefaultACPQueueAgingInterval)
+	agedPriority := min(int64(priority)+agingSteps*int64(defaultACPQueueAgingStep), 1000)
+	createdAt := queuedAt
+	var namespace, name, uid string
+	if task != nil {
+		if !task.CreationTimestamp.IsZero() {
+			createdAt = task.CreationTimestamp.UTC()
+		}
+		namespace, name, uid = task.Namespace, task.Name, string(task.UID)
+	}
+	return acpTaskQueueRank{
+		promoted: age >= DefaultACPQueueMaximumWait, effectivePriority: int32(agedPriority),
+		queuedAt: queuedAt, createdAt: createdAt, namespace: namespace, name: name, uid: uid,
+	}
+}
+
+func taskQueueRankLess(left, right acpTaskQueueRank) bool {
+	if left.promoted != right.promoted {
+		return left.promoted
+	}
+	if !left.promoted && left.effectivePriority != right.effectivePriority {
+		return left.effectivePriority > right.effectivePriority
+	}
+	if !left.queuedAt.Equal(right.queuedAt) {
+		return left.queuedAt.Before(right.queuedAt)
+	}
+	if !left.createdAt.Equal(right.createdAt) {
+		return left.createdAt.Before(right.createdAt)
+	}
+	if left.namespace != right.namespace {
+		return left.namespace < right.namespace
+	}
+	if left.name != right.name {
+		return left.name < right.name
+	}
+	return left.uid < right.uid
+}
+
+func acpTaskQueuedAt(task *corev1alpha1.Task) time.Time {
+	if task == nil {
+		return time.Unix(0, 0).UTC()
+	}
+	if value := strings.TrimSpace(task.Annotations[acpRuntimeQueuedAtAnnotation]); value != "" {
+		if parsed, err := time.Parse(time.RFC3339Nano, value); err == nil {
+			return parsed.UTC()
+		}
+	}
+	if task.Status.Execution != nil && task.Status.Execution.LastTransitionTime != nil && !task.Status.Execution.LastTransitionTime.IsZero() {
+		return task.Status.Execution.LastTransitionTime.UTC()
+	}
+	if !task.CreationTimestamp.IsZero() {
+		return task.CreationTimestamp.UTC()
+	}
+	return time.Unix(0, 0).UTC()
+}
+
+func (r *TaskReconciler) cancelACPTaskBeforeDurableAttempt(ctx context.Context, task *corev1alpha1.Task, message string) (ctrl.Result, error) {
+	reader := r.taskMetadataReader()
+	latest := &corev1alpha1.Task{}
+	key := types.NamespacedName{Namespace: task.Namespace, Name: task.Name}
+	if err := reader.Get(ctx, key, latest); err != nil {
+		return ctrl.Result{}, client.IgnoreNotFound(err)
+	}
+	nowUTC := time.Now().UTC()
+	deadline, expired := acpTaskDeadline(latest, nowUTC)
+	if latest.UID != task.UID || latest.Spec.Type != corev1alpha1.TaskTypeAgent || !expired || nowUTC.Before(deadline) {
+		return ctrl.Result{RequeueAfter: time.Second}, nil
+	}
+	if latest.Status.Execution != nil {
+		return ctrl.Result{RequeueAfter: time.Second}, nil
+	}
+
+	var attempt *store.PromptAttempt
+	if r.DurableControlStore != nil && latest.UID != "" {
+		attemptNumber := latest.Status.Attempts + 1
+		promptID := fmt.Sprintf("prompt-%s-%d", latest.UID, attemptNumber)
+		attemptKey := store.PromptAttemptKey{
+			Namespace: latest.Namespace, TaskUID: string(latest.UID), Attempt: int64(attemptNumber), PromptID: promptID,
+		}
+		attemptID, err := attemptKey.CanonicalID()
+		if err != nil {
+			return ctrl.Result{}, err
+		}
+		attempt, err = r.DurableControlStore.GetPromptAttempt(ctx, attemptID)
+		if err != nil && !errors.Is(err, store.ErrNotFound) {
+			return ctrl.Result{}, err
+		}
+		if attempt != nil {
+			if attempt.ExecutionState == store.PromptExecutionQueued {
+				if r.ControllerEpochManager == nil {
+					return ctrl.Result{}, fmt.Errorf("controller epoch manager is required to cancel queued ACP attempt")
+				}
+				fence, fenceErr := r.ControllerEpochManager.CurrentFence(ctx)
+				if fenceErr != nil {
+					return ctrl.Result{}, fenceErr
+				}
+				operationID := "timeout-before-status-" + fmt.Sprint(attempt.Version)
+				digest, digestErr := acpDomainDigest("attempt-transition", map[string]any{
+					"id": attempt.ID, "from": attempt.ExecutionState, "to": store.PromptExecutionCancelled,
+					"operation": operationID, "version": attempt.Version,
+				})
+				if digestErr != nil {
+					return ctrl.Result{}, digestErr
+				}
+				attempt, err = r.DurableControlStore.TransitionPromptAttemptExecution(ctx, store.PromptAttemptExecutionTransition{
+					ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: store.PromptExecutionQueued,
+					NewState: store.PromptExecutionCancelled, OperationID: operationID, OperationDigest: digest,
+					TerminalReason: "TaskTimeout", OutcomeMarker: message, UpdatedAt: time.Now().UTC(),
+				})
+				if err != nil {
+					return ctrl.Result{}, err
+				}
+			} else if attempt.ExecutionState != store.PromptExecutionCancelled {
+				return ctrl.Result{}, fmt.Errorf("prompt attempt %q is %s while Task execution status is empty", attempt.ID, attempt.ExecutionState)
+			}
+		}
+	}
+
+	now := metav1.Now()
+	statusBound := false
+	if err := retry.RetryOnConflict(retry.DefaultBackoff, func() error {
+		current := &corev1alpha1.Task{}
+		if err := reader.Get(ctx, key, current); err != nil {
+			return err
+		}
+		currentNow := time.Now().UTC()
+		currentDeadline, currentHasDeadline := acpTaskDeadline(current, currentNow)
+		if current.UID != task.UID || current.Spec.Type != corev1alpha1.TaskTypeAgent ||
+			!currentHasDeadline || currentNow.Before(currentDeadline) {
+			statusBound = true
+			return nil
+		}
+		if current.Status.Execution != nil {
+			statusBound = true
+			return nil
+		}
+		base := current.DeepCopy()
+		current.Status.Phase = corev1alpha1.TaskPhaseCancelled
+		current.Status.CompletionTime = &now
+		current.Status.Message = message
+		current.Status.Execution = &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateCancelled, Outcome: corev1alpha1.TaskExecutionOutcomeCancelled,
+			Reason: "TaskTimeout", Message: message, LastTransitionTime: &now,
+		}
+		if attempt != nil {
+			if current.Status.Attempts < int32(attempt.Key.Attempt) {
+				current.Status.Attempts = int32(attempt.Key.Attempt)
+			}
+			current.Status.Execution.Attempt = int32(attempt.Key.Attempt)
+			current.Status.Execution.PromptID = attempt.Key.PromptID
+			current.Status.Execution.RequestDigest = attempt.RequestDigest
+			current.Status.Execution.ControllerEpoch = attempt.ControllerEpoch
+		}
+		current.Status.Delivery = &corev1alpha1.TaskDeliveryStatus{
+			State: corev1alpha1.TaskDeliveryStateNotRequested, Outcome: corev1alpha1.TaskDeliveryOutcomeNotRequested,
+			LastTransitionTime: &now,
+		}
+		meta.SetStatusCondition(&current.Status.Conditions, metav1.Condition{
+			Type: ConditionTypeWaitingForApproval, Status: metav1.ConditionFalse, LastTransitionTime: now,
+			Reason: "TaskCancelled", Message: "task is terminal",
+		})
+		meta.SetStatusCondition(&current.Status.Conditions, metav1.Condition{
+			Type: ConditionTypeComplete, Status: metav1.ConditionTrue, LastTransitionTime: now,
+			Reason: "TaskCancelled", Message: message,
+		})
+		return r.Status().Patch(ctx, current, client.MergeFrom(base))
+	}); err != nil {
+		return ctrl.Result{}, err
+	}
+	if statusBound {
+		return ctrl.Result{RequeueAfter: time.Second}, nil
+	}
+	return ctrl.Result{}, nil
+}
+
+func (r *TaskReconciler) failACPPlanningTask(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	reason corev1alpha1.TaskExecutionReason,
+	message string,
+) (ctrl.Result, error) {
+	attempt, err := r.settleACPPlanningFailureAttempt(ctx, task, reason, message)
+	if errors.Is(err, store.ErrNotReady) {
+		return ctrl.Result{RequeueAfter: time.Second}, nil
+	}
+	if err != nil {
+		return ctrl.Result{}, err
+	}
+	if attempt != nil {
+		canonicalReason := corev1alpha1.TaskExecutionReason(attempt.TerminalReason)
+		canonicalMessage := strings.TrimSpace(attempt.OutcomeMarker)
+		if canonicalReason != reason || canonicalMessage == "" {
+			return ctrl.Result{}, fmt.Errorf("%w: settled ACP planning failure marker is inconsistent", store.ErrConflict)
+		}
+		reason = canonicalReason
+		message = canonicalMessage
+		if err := r.enqueueACPPlanningFailureProjection(ctx, task, attempt, reason, message); err != nil {
+			return ctrl.Result{}, err
+		}
+	}
+	return r.projectACPPlanningFailureTask(ctx, task, attempt, reason, message)
+}
+
+func (r *TaskReconciler) reconcileDurableACPPlanningFailure(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+) (bool, ctrl.Result, error) {
+	if task == nil || task.Status.Execution == nil || task.Status.Execution.Attempt < 1 ||
+		(task.Status.Execution.State != corev1alpha1.TaskExecutionStateQueued &&
+			task.Status.Execution.State != corev1alpha1.TaskExecutionStateReserved) {
+		return false, ctrl.Result{}, nil
+	}
+	attemptID, err := promptAttemptIDFromTask(task)
+	if err != nil {
+		return false, ctrl.Result{}, err
+	}
+	attempt, err := r.DurableControlStore.GetPromptAttempt(ctx, attemptID)
+	if errors.Is(err, store.ErrNotFound) {
+		return false, ctrl.Result{}, nil
+	}
+	if err != nil {
+		return false, ctrl.Result{}, err
+	}
+	if attempt.ExecutionState != store.PromptExecutionFailed {
+		return false, ctrl.Result{}, nil
+	}
+	reason := corev1alpha1.TaskExecutionReason(attempt.TerminalReason)
+	if reason != corev1alpha1.TaskExecutionReason("InvalidRuntimeProfile") &&
+		reason != corev1alpha1.TaskExecutionReason("InvalidWorkspace") {
+		return false, ctrl.Result{}, nil
+	}
+	message := strings.TrimSpace(attempt.OutcomeMarker)
+	if message == "" || !queuedPromptAttemptMatchesTask(attempt, task) {
+		return true, ctrl.Result{}, fmt.Errorf("%w: durable ACP planning failure is missing its canonical Task projection", store.ErrConflict)
+	}
+	if err := r.enqueueACPPlanningFailureProjection(ctx, task, attempt, reason, message); err != nil {
+		return true, ctrl.Result{}, err
+	}
+	result, err := r.projectACPPlanningFailureTask(ctx, task, attempt, reason, message)
+	return true, result, err
+}
+
+func (r *TaskReconciler) projectACPPlanningFailureTask(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attempt *store.PromptAttempt,
+	reason corev1alpha1.TaskExecutionReason,
+	message string,
+) (ctrl.Result, error) {
+	key := types.NamespacedName{Namespace: task.Namespace, Name: task.Name}
+	if err := retry.RetryOnConflict(retry.DefaultBackoff, func() error {
+		latest := &corev1alpha1.Task{}
+		if err := r.taskMetadataReader().Get(ctx, key, latest); err != nil {
+			return client.IgnoreNotFound(err)
+		}
+		if latest.UID != task.UID {
+			return fmt.Errorf("%w: Task identity changed while projecting ACP planning failure", store.ErrConflict)
+		}
+		base := latest.DeepCopy()
+		terminalTime := metav1.Now()
+		if attempt != nil {
+			terminalTime = metav1.NewTime(attempt.UpdatedAt.UTC())
+		} else if latest.Status.Execution != nil && latest.Status.Execution.State == corev1alpha1.TaskExecutionStateFailed &&
+			latest.Status.Execution.Reason == reason && latest.Status.Execution.LastTransitionTime != nil {
+			terminalTime = *latest.Status.Execution.LastTransitionTime
+		}
+		if attempt == nil {
+			execution := latest.Status.Execution
+			switch {
+			case execution == nil:
+				latest.Status.Execution = &corev1alpha1.TaskExecutionStatus{
+					State: corev1alpha1.TaskExecutionStateFailed, Outcome: corev1alpha1.TaskExecutionOutcomeFailed,
+					Reason: reason, Message: message, LastTransitionTime: &terminalTime,
+				}
+			case execution.State == corev1alpha1.TaskExecutionStateFailed && execution.Reason == reason &&
+				execution.Attempt == 0 && execution.PromptID == "" && execution.RequestDigest == "":
+				execution.Outcome = corev1alpha1.TaskExecutionOutcomeFailed
+				execution.Message = message
+				execution.LastTransitionTime = &terminalTime
+			default:
+				return fmt.Errorf("%w: Task acquired durable execution identity while projecting ACP planning failure", store.ErrConflict)
+			}
+		} else {
+			execution := latest.Status.Execution
+			if execution == nil || !queuedPromptAttemptMatchesTask(attempt, latest) {
+				return fmt.Errorf("%w: Task execution identity changed after ACP planning failure settlement", store.ErrConflict)
+			}
+			if execution.State != corev1alpha1.TaskExecutionStateQueued &&
+				execution.State != corev1alpha1.TaskExecutionStateReserved &&
+				(execution.State != corev1alpha1.TaskExecutionStateFailed || execution.Reason != reason) {
+				return fmt.Errorf("%w: Task execution advanced to %s after ACP planning failure settlement", store.ErrConflict, execution.State)
+			}
+			execution.State = corev1alpha1.TaskExecutionStateFailed
+			execution.Outcome = corev1alpha1.TaskExecutionOutcomeFailed
+			execution.Reason = reason
+			execution.Message = message
+			execution.ControllerEpoch = attempt.ControllerEpoch
+			execution.LastTransitionTime = &terminalTime
+		}
+		if latest.Status.Delivery == nil {
+			latest.Status.Delivery = &corev1alpha1.TaskDeliveryStatus{
+				State: corev1alpha1.TaskDeliveryStateNotRequested, Outcome: corev1alpha1.TaskDeliveryOutcomeNotRequested,
+				LastTransitionTime: &terminalTime,
+			}
+		} else if latest.Status.Delivery.State != corev1alpha1.TaskDeliveryStateNotRequested ||
+			latest.Status.Delivery.Outcome != corev1alpha1.TaskDeliveryOutcomeNotRequested {
+			return fmt.Errorf("%w: ACP planning failure cannot replace delivery state %s", store.ErrConflict, latest.Status.Delivery.State)
+		} else {
+			latest.Status.Delivery.LastTransitionTime = &terminalTime
+		}
+		latest.Status.Phase = corev1alpha1.TaskPhaseFailed
+		if attempt != nil || latest.Status.CompletionTime == nil {
+			latest.Status.CompletionTime = &terminalTime
+		}
+		latest.Status.Message = message
+		meta.SetStatusCondition(&latest.Status.Conditions, metav1.Condition{
+			Type: ConditionTypeWaitingForApproval, Status: metav1.ConditionFalse, LastTransitionTime: terminalTime,
+			Reason: "TaskFailed", Message: "task is terminal",
+		})
+		meta.SetStatusCondition(&latest.Status.Conditions, metav1.Condition{
+			Type: ConditionTypeComplete, Status: metav1.ConditionFalse, LastTransitionTime: terminalTime,
+			Reason: "TaskFailed", Message: message,
+		})
+		return r.Status().Patch(ctx, latest, client.MergeFromWithOptions(base, client.MergeFromWithOptimisticLock{}))
+	}); err != nil {
+		return ctrl.Result{}, err
+	}
+	return ctrl.Result{}, nil
+}
+
+func (r *TaskReconciler) enqueueACPPlanningFailureProjection(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attempt *store.PromptAttempt,
+	reason corev1alpha1.TaskExecutionReason,
+	message string,
+) error {
+	if task == nil || attempt == nil || r.DurableControlStore == nil || r.ControllerEpochManager == nil {
+		return fmt.Errorf("ACP planning failure projection dependencies are incomplete")
+	}
+	latest := &corev1alpha1.Task{}
+	if err := r.taskMetadataReader().Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, latest); err != nil {
+		return client.IgnoreNotFound(err)
+	}
+	if latest.UID != task.UID || latest.Status.Execution == nil || !queuedPromptAttemptMatchesTask(attempt, latest) ||
+		attempt.ExecutionState != store.PromptExecutionFailed || attempt.TerminalReason != string(reason) {
+		return fmt.Errorf("%w: ACP planning failure projection does not match its Task and PromptAttempt", store.ErrConflict)
+	}
+	state := latest.Status.Execution.State
+	if state != corev1alpha1.TaskExecutionStateQueued && state != corev1alpha1.TaskExecutionStateReserved &&
+		(state != corev1alpha1.TaskExecutionStateFailed || latest.Status.Execution.Reason != reason) {
+		return fmt.Errorf("%w: Task execution advanced to %s before ACP planning failure projection", store.ErrConflict, state)
+	}
+	execution := *latest.Status.Execution
+	execution.State = corev1alpha1.TaskExecutionStateFailed
+	execution.Outcome = corev1alpha1.TaskExecutionOutcomeFailed
+	execution.Reason = reason
+	execution.Message = message
+	execution.ControllerEpoch = attempt.ControllerEpoch
+	transitionTime := metav1.NewTime(attempt.UpdatedAt.UTC())
+	execution.LastTransitionTime = &transitionTime
+	delivery := latest.Status.Delivery
+	if delivery == nil {
+		delivery = &corev1alpha1.TaskDeliveryStatus{
+			State: corev1alpha1.TaskDeliveryStateNotRequested, Outcome: corev1alpha1.TaskDeliveryOutcomeNotRequested,
+			LastTransitionTime: &transitionTime,
+		}
+	} else if delivery.State != corev1alpha1.TaskDeliveryStateNotRequested ||
+		delivery.Outcome != corev1alpha1.TaskDeliveryOutcomeNotRequested {
+		return fmt.Errorf("%w: ACP planning failure projection cannot replace delivery state %s", store.ErrConflict, delivery.State)
+	} else {
+		copyDelivery := *delivery
+		copyDelivery.LastTransitionTime = &transitionTime
+		delivery = &copyDelivery
+	}
+	fence, err := r.ControllerEpochManager.CurrentFence(ctx)
+	if err != nil {
+		return err
+	}
+	return enqueueDurableTaskTerminalProjection(ctx, r.DurableControlStore, fence, latest, taskTerminalProjection{
+		Namespace: latest.Namespace, Task: latest.Name, TaskUID: string(latest.UID), Attempt: int32(attempt.Key.Attempt),
+		Phase: corev1alpha1.TaskPhaseFailed, Message: message, Execution: execution, Delivery: delivery,
+	})
+}
+
+func (r *TaskReconciler) reservedACPPlanningFailureSafe(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attempt *store.PromptAttempt,
+) (bool, error) {
+	if task == nil || task.Status.Execution == nil || attempt == nil ||
+		taskExecutionHasRuntimeOrSessionBinding(task.Status.Execution) || promptAttemptHasRuntimeOrSessionBinding(attempt) {
+		return false, nil
+	}
+	poolName := strings.TrimSpace(task.Status.Execution.RuntimePoolName)
+	poolUID := strings.TrimSpace(task.Status.Execution.RuntimePoolUID)
+	if poolName == "" || poolUID == "" {
+		return false, nil
+	}
+	pool := &corev1alpha1.RuntimePool{}
+	if err := r.taskMetadataReader().Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: poolName}, pool); err != nil {
+		if apierrors.IsNotFound(err) {
+			return true, nil
+		}
+		return false, err
+	}
+	if string(pool.UID) != poolUID {
+		return true, nil
+	}
+	now := time.Now().UTC()
+	for i := range pool.Status.Capacity.Reservations {
+		reservation := pool.Status.Capacity.Reservations[i]
+		if reservation.PoolUID == poolUID && reservation.TaskUID == string(task.UID) &&
+			reservation.Attempt == task.Status.Execution.Attempt && reservation.ExpiresAt.After(now) {
+			return false, nil
+		}
+	}
+	return true, nil
+}
+
+func (r *TaskReconciler) settleACPPlanningFailureAttempt(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	reason corev1alpha1.TaskExecutionReason,
+	message string,
+) (*store.PromptAttempt, error) {
+	if task == nil {
+		return nil, nil
+	}
+	latest := &corev1alpha1.Task{}
+	if err := r.taskMetadataReader().Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, latest); err != nil {
+		return nil, client.IgnoreNotFound(err)
+	}
+	if latest.UID != task.UID {
+		return nil, fmt.Errorf("%w: Task identity changed while settling ACP planning failure", store.ErrConflict)
+	}
+	execution := latest.Status.Execution
+	if execution == nil {
+		return nil, nil
+	}
+	projectedFailure := execution.State == corev1alpha1.TaskExecutionStateFailed && execution.Reason == reason
+	if execution.State != corev1alpha1.TaskExecutionStateQueued &&
+		execution.State != corev1alpha1.TaskExecutionStateReserved && !projectedFailure {
+		return nil, fmt.Errorf("%w: cannot settle ACP planning failure from Task execution state %s", store.ErrConflict, execution.State)
+	}
+	if projectedFailure && execution.Attempt == 0 {
+		return nil, nil
+	}
+	attemptID, err := promptAttemptIDFromTask(latest)
+	if err != nil {
+		return nil, err
+	}
+	fence, err := r.ControllerEpochManager.CurrentFence(ctx)
+	if err != nil {
+		return nil, err
+	}
+	for range 3 {
+		attempt, getErr := r.DurableControlStore.GetPromptAttempt(ctx, attemptID)
+		if getErr != nil {
+			return nil, getErr
+		}
+		if !queuedPromptAttemptMatchesTask(attempt, latest) || attempt.DeliveryState != store.PromptDeliveryNotRequested {
+			return nil, fmt.Errorf("%w: durable PromptAttempt does not match the Task planning-failure projection", store.ErrConflict)
+		}
+		if attempt.ExecutionState == store.PromptExecutionFailed && attempt.TerminalReason == string(reason) {
+			return attempt, nil
+		}
+		if attempt.ExecutionState != store.PromptExecutionQueued && attempt.ExecutionState != store.PromptExecutionReserved {
+			return nil, fmt.Errorf("%w: durable PromptAttempt advanced to %s before planning failure settlement", store.ErrConflict, attempt.ExecutionState)
+		}
+		if attempt.ExecutionState == store.PromptExecutionReserved {
+			safe, safeErr := r.reservedACPPlanningFailureSafe(ctx, latest, attempt)
+			if safeErr != nil {
+				return nil, safeErr
+			}
+			if !safe {
+				return nil, fmt.Errorf("%w: reserved ACP attempt still owns live RuntimePool capacity", store.ErrNotReady)
+			}
+		}
+		operationID := store.CanonicalControlID("fail-acp-planning", attempt.ID, fmt.Sprint(attempt.Version), string(reason))
+		operationDigest, digestErr := acpDomainDigest("planning-failure-attempt-transition", map[string]any{
+			"attemptID": attempt.ID, "requestDigest": attempt.RequestDigest, "from": attempt.ExecutionState,
+			"to": store.PromptExecutionFailed, "version": attempt.Version, "reason": reason, "message": message,
+		})
+		if digestErr != nil {
+			return nil, digestErr
+		}
+		settled, transitionErr := r.DurableControlStore.TransitionPromptAttemptExecution(ctx, store.PromptAttemptExecutionTransition{
+			ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+			NewState: store.PromptExecutionFailed, OperationID: operationID, OperationDigest: operationDigest,
+			TerminalReason: string(reason), OutcomeMarker: message, UpdatedAt: time.Now().UTC(),
+		})
+		if errors.Is(transitionErr, store.ErrConflict) {
+			continue
+		}
+		return settled, transitionErr
+	}
+	return nil, fmt.Errorf("%w: durable PromptAttempt changed repeatedly during planning failure settlement", store.ErrConflict)
+}
+
+//nolint:gocyclo // Workspace preflight intentionally keeps all fail-closed publication gates together.
+func validateACPWorkspacePreflight(task *corev1alpha1.Task) error {
+	if task == nil {
+		return nil
+	}
+	intent := effectiveACPWorkspaceIntent(task)
+	workspace := task.Spec.Workspace
+	if workspace == nil {
+		if intent == corev1alpha1.WorkspaceIntentWrite {
+			return fmt.Errorf("write workspace intent requires Task.spec.workspace")
+		}
+		return nil
+	}
+	if strings.TrimSpace(workspace.GitRepo) == "" {
+		switch {
+		case strings.TrimSpace(workspace.Branch) != "":
+			return fmt.Errorf("branch requires gitRepo")
+		case strings.TrimSpace(workspace.Ref) != "":
+			return fmt.Errorf("ref requires gitRepo")
+		case strings.TrimSpace(workspace.SubPath) != "":
+			return fmt.Errorf("subPath requires gitRepo")
+		case workspace.SourceRepository != nil:
+			return fmt.Errorf("sourceRepository requires gitRepo")
+		case workspace.ReadCredentialRef != nil:
+			return fmt.Errorf("readCredentialRef requires gitRepo")
+		}
+	} else {
+		if _, err := workspaceRepository(workspace); err != nil {
+			return err
+		}
+	}
+	if workspace.MaxChangedFiles != nil && *workspace.MaxChangedFiles <= 0 {
+		return fmt.Errorf("maxChangedFiles must be positive when configured")
+	}
+	for _, pattern := range workspace.AllowedPaths {
+		cleaned := strings.TrimPrefix(strings.TrimSpace(pattern), "./")
+		if cleaned == "" || len(cleaned) > 1024 || strings.ContainsAny(cleaned, "\\\x00") || strings.HasPrefix(cleaned, "/") || cleaned == ".." || strings.HasPrefix(cleaned, "../") || strings.Contains(cleaned, "/../") {
+			return fmt.Errorf("allowedPaths contains an invalid pattern")
+		}
+		if _, err := path.Match(cleaned, ""); err != nil {
+			return fmt.Errorf("allowedPaths contains an invalid pattern: %w", err)
+		}
+	}
+	if intent != corev1alpha1.WorkspaceIntentWrite {
+		switch {
+		case strings.TrimSpace(workspace.PublicationGitRepo) != "":
+			return fmt.Errorf("publicationGitRepo requires write workspace intent")
+		case workspace.PublicationRepository != nil:
+			return fmt.Errorf("publicationRepository requires write workspace intent")
+		case workspace.PublicationReadCredentialRef != nil:
+			return fmt.Errorf("publicationReadCredentialRef requires write workspace intent")
+		case workspace.PublicationCredentialRef != nil:
+			return fmt.Errorf("publicationCredentialRef requires write workspace intent")
+		case workspace.ForgeCredentialRef != nil:
+			return fmt.Errorf("forgeCredentialRef requires write workspace intent")
+		case strings.TrimSpace(workspace.PushBranch) != "":
+			return fmt.Errorf("pushBranch requires write workspace intent")
+		case strings.TrimSpace(workspace.PRBaseBranch) != "":
+			return fmt.Errorf("prBaseBranch requires write workspace intent")
+		case workspace.CreatePR:
+			return fmt.Errorf("createPR requires write workspace intent")
+		}
+		if strings.TrimSpace(workspace.ExpectedRemoteSHA) != "" || workspace.MaxChangedFiles != nil || len(workspace.AllowedPaths) > 0 || workspace.DenyRepositoryControlPaths || workspace.RejectBinaryFiles || workspace.RejectSecretLikeContent {
+			return fmt.Errorf("publication expectations and change policies require write workspace intent")
+		}
+		return nil
+	}
+	if workspace.PublicationCredentialRef == nil || strings.TrimSpace(workspace.PublicationCredentialRef.Name) == "" {
+		return fmt.Errorf("write workspace intent requires publicationCredentialRef before prompt execution")
+	}
+	if strings.TrimSpace(workspace.GitRepo) == "" {
+		return fmt.Errorf("write workspace intent requires a source gitRepo")
+	}
+	if _, err := workspacePublicationRepository(workspace); err != nil {
+		return err
+	}
+	if pushBranch := strings.TrimSpace(workspace.PushBranch); pushBranch != "" {
+		if _, err := canonicalWorkspaceBranchRef(pushBranch); err != nil {
+			return fmt.Errorf("pushBranch is invalid: %w", err)
+		}
+	}
+	if workspace.CreatePR && strings.TrimSpace(workspace.PRBaseBranch) == "" {
+		return fmt.Errorf("createPR requires prBaseBranch")
+	}
+	if workspace.CreatePR {
+		if _, err := canonicalWorkspaceBranchRef(workspace.PRBaseBranch); err != nil {
+			return fmt.Errorf("prBaseBranch is invalid: %w", err)
+		}
+	}
+	if workspace.CreatePR && (workspace.ForgeCredentialRef == nil || strings.TrimSpace(workspace.ForgeCredentialRef.Name) == "") {
+		return fmt.Errorf("createPR requires forgeCredentialRef before prompt execution")
+	}
+	return nil
+}
+
+func (r *TaskReconciler) ensureACPRuntimePool(ctx context.Context, namespace string, plan ACPRuntimePlan) (*corev1alpha1.RuntimePool, error) {
+	pool := &corev1alpha1.RuntimePool{}
+	key := types.NamespacedName{Namespace: namespace, Name: plan.PoolName}
+	err := r.Get(ctx, key, pool)
+	if apierrors.IsNotFound(err) {
+		pool = &corev1alpha1.RuntimePool{
+			ObjectMeta: metav1.ObjectMeta{
+				Namespace: namespace, Name: plan.PoolName,
+				Annotations: map[string]string{acpRuntimeLastDemandAnnotation: time.Now().UTC().Format(time.RFC3339Nano)},
+				Labels: map[string]string{
+					acpRuntimePoolLabel: "true", acpRuntimeTrustLabel: namespace,
+					acpRuntimeProfileLabel: strings.TrimPrefix(string(plan.Digest), "sha256:")[:16],
+				},
+			},
+			Spec: corev1alpha1.RuntimePoolSpec{
+				TrustDomain:      corev1alpha1.RuntimePoolTrustDomain{Namespace: namespace, Identity: "namespace:" + namespace},
+				RuntimeNamespace: strings.TrimSpace(r.ACPRuntimeNamespace),
+				Runtime:          corev1alpha1.RuntimePoolRuntimeSpec{Image: plan.Image, Profile: RuntimePoolProfileFromPlan(plan)},
+				DesiredReplicas:  1,
+				Capacity: &corev1alpha1.RuntimePoolCapacitySpec{
+					MaxResidentSessions: corev1alpha1.DefaultRuntimePoolMaxResidentSessions,
+					MaxRunningPrompts:   corev1alpha1.DefaultRuntimePoolMaxRunningPrompts,
+				},
+				ColdStartTimeoutSeconds: corev1alpha1.DefaultRuntimePoolColdStartTimeoutSeconds,
+			},
+		}
+		if err := r.Create(ctx, pool); err != nil {
+			if !apierrors.IsAlreadyExists(err) {
+				return nil, fmt.Errorf("create RuntimePool: %w", err)
+			}
+			if err := r.Get(ctx, key, pool); err != nil {
+				return nil, err
+			}
+		}
+		return pool, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	if pool.Spec.Runtime.Image != plan.Image || pool.Spec.Runtime.Profile.Digest != string(plan.Digest) {
+		return nil, fmt.Errorf("RuntimePool %s profile does not match queued Task", pool.Name)
+	}
+	base := pool.DeepCopy()
+	changed := false
+	if pool.Spec.DesiredReplicas == 0 {
+		pool.Spec.DesiredReplicas = 1
+		changed = true
+	}
+	if pool.Annotations == nil {
+		pool.Annotations = make(map[string]string)
+	}
+	lastDemand, _ := time.Parse(time.RFC3339Nano, pool.Annotations[acpRuntimeLastDemandAnnotation])
+	if time.Since(lastDemand) >= time.Minute {
+		pool.Annotations[acpRuntimeLastDemandAnnotation] = time.Now().UTC().Format(time.RFC3339Nano)
+		changed = true
+	}
+	if changed {
+		if err := r.Patch(ctx, pool, client.MergeFrom(base)); err != nil {
+			return nil, err
+		}
+	}
+	return pool, nil
+}
+
+func acpBoundTaskRequestDigest(bound *verifiedAgentExecution, attempt int32, promptID string) (string, error) {
+	if bound == nil || bound.binding == nil || bound.snapshot == nil {
+		return "", errors.New("verified binding and execution snapshot are required for ACP request identity")
+	}
+	return acpDomainDigest("task-request", map[string]any{
+		"taskUID": bound.binding.Task.UID, "taskGeneration": bound.binding.Task.BoundSpecGeneration,
+		"attempt": attempt, "promptID": promptID, "prompt": bound.body.Prompt,
+		"agentUID": bound.body.Agent.UID, "agentGeneration": bound.body.Agent.Generation,
+		"agentConfiguration":   bound.configuration,
+		"runtimeProfileDigest": bound.body.ProfileDigest, "workspace": bound.body.Workspace,
+		"bindingDigest": bound.binding.BindingDigest, "snapshotDigest": bound.snapshot.Digest,
+	})
+}
+
+func acpQueuedTaskRequestMatchesBinding(bound *verifiedAgentExecution, status *corev1alpha1.TaskExecutionStatus) (bool, error) {
+	if bound == nil || status == nil || status.Attempt < 1 || strings.TrimSpace(status.PromptID) == "" ||
+		strings.TrimSpace(status.RequestDigest) == "" {
+		return false, nil
+	}
+	digest, err := acpBoundTaskRequestDigest(bound, status.Attempt, status.PromptID)
+	if err != nil {
+		return false, err
+	}
+	return digest == status.RequestDigest, nil
+}
+
+func taskExecutionStateTerminal(state corev1alpha1.TaskExecutionState) bool {
+	switch state {
+	case corev1alpha1.TaskExecutionStateSucceeded, corev1alpha1.TaskExecutionStateFailed,
+		corev1alpha1.TaskExecutionStateCancelled, corev1alpha1.TaskExecutionStateOutcomeUnknown:
+		return true
+	default:
+		return false
+	}
+}
+
+func taskManagedByACP(task *corev1alpha1.Task) bool {
+	return task != nil && task.Spec.Type == corev1alpha1.TaskTypeAgent && task.Status.Execution != nil &&
+		(strings.TrimSpace(task.Status.Execution.RuntimePoolName) != "" || strings.TrimSpace(task.Status.Execution.AgentRuntimeName) != "")
+}
diff --git a/internal/controller/acp_task_queue_reconciliation_test.go b/internal/controller/acp_task_queue_reconciliation_test.go
new file mode 100644
index 000000000..9d9b8e731
--- /dev/null
+++ b/internal/controller/acp_task_queue_reconciliation_test.go
@@ -0,0 +1,338 @@
+package controller
+
+import (
+	"context"
+	"errors"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	types "k8s.io/apimachinery/pkg/types"
+	"k8s.io/utils/ptr"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+	"github.com/orka-agents/orka/internal/store/sqlite"
+)
+
+//nolint:gocyclo // The table verifies immutable snapshot behavior in queued and reserved states.
+func TestQueueACPRuntimeTaskIgnoresLiveAgentMutationAfterBinding(t *testing.T) {
+	for _, state := range []struct {
+		name       string
+		taskState  corev1alpha1.TaskExecutionState
+		storeState store.PromptExecutionState
+	}{
+		{name: "queued", taskState: corev1alpha1.TaskExecutionStateQueued, storeState: store.PromptExecutionQueued},
+		{name: "reserved", taskState: corev1alpha1.TaskExecutionStateReserved, storeState: store.PromptExecutionReserved},
+	} {
+		t.Run(state.name, func(t *testing.T) {
+			fixture := newACPQueuePlanningFailureFixture(t)
+			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			defer cancel()
+
+			queued, attempt := fixture.queueValidTask(t, ctx)
+			if state.storeState == store.PromptExecutionReserved {
+				fence, err := fixture.epochs.CurrentFence(ctx)
+				if err != nil {
+					t.Fatal(err)
+				}
+				attempt = transitionPromptAttemptForImageRotationTest(
+					t, ctx, fixture.controlStore, fence, attempt, store.PromptExecutionReserved, "reserve-before-configuration-drift",
+				)
+				base := queued.DeepCopy()
+				queued.Status.Execution.State = state.taskState
+				queued.Status.Execution.ControllerEpoch = fence.Epoch
+				queued.Status.Execution.Reason = acpControllerRestartRecoveredReason
+				queued.Status.Execution.Message = acpControllerRestartRecoveredMessage
+				if err := fixture.kubeClient.Status().Patch(ctx, queued, client.MergeFrom(base)); err != nil {
+					t.Fatal(err)
+				}
+				if err := fixture.kubeClient.Get(ctx, types.NamespacedName{Namespace: queued.Namespace, Name: queued.Name}, queued); err != nil {
+					t.Fatal(err)
+				}
+			}
+
+			beforeExecution := queued.Status.Execution.DeepCopy()
+			beforeAttempt := *attempt
+			invalidAgent := fixture.agent.DeepCopy()
+			invalidAgent.Spec.Skills = []corev1alpha1.SkillReference{{Name: "added-after-queue"}}
+			if _, err := fixture.reconciler.queueACPRuntimeTask(ctx, queued.DeepCopy(), invalidAgent); err != nil {
+				t.Fatalf("queue after live Agent mutation: %v", err)
+			}
+
+			current := &corev1alpha1.Task{}
+			if err := fixture.kubeClient.Get(ctx, types.NamespacedName{Namespace: queued.Namespace, Name: queued.Name}, current); err != nil {
+				t.Fatal(err)
+			}
+			if current.Status.Phase != queued.Status.Phase || !reflect.DeepEqual(current.Status.Execution, beforeExecution) ||
+				current.Status.Attempts != queued.Status.Attempts {
+				t.Fatalf("live Agent mutation changed frozen execution: before=%#v after=%#v", queued.Status, current.Status)
+			}
+
+			persistedAttempt, err := fixture.controlStore.GetPromptAttempt(ctx, attempt.ID)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(persistedAttempt, &beforeAttempt) {
+				t.Fatalf("live Agent mutation changed durable attempt: before=%#v after=%#v", beforeAttempt, persistedAttempt)
+			}
+		})
+	}
+}
+
+var errPlanningFailureTransition = errors.New("injected planning failure transition error")
+
+type failingPlanningFailureTransitionStore struct {
+	store.DurableControlStore
+}
+
+func (s *failingPlanningFailureTransitionStore) TransitionPromptAttemptExecution(
+	ctx context.Context,
+	transition store.PromptAttemptExecutionTransition,
+) (*store.PromptAttempt, error) {
+	if transition.NewState == store.PromptExecutionFailed && transition.TerminalReason == "InvalidRuntimeProfile" {
+		return nil, errPlanningFailureTransition
+	}
+	return s.DurableControlStore.TransitionPromptAttemptExecution(ctx, transition)
+}
+
+func TestQueueACPRuntimeTaskDoesNotSettleAttemptFromLiveAgentDrift(t *testing.T) {
+	fixture := newACPQueuePlanningFailureFixture(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	queued, attempt := fixture.queueValidTask(t, ctx)
+	fixture.reconciler.DurableControlStore = &failingPlanningFailureTransitionStore{DurableControlStore: fixture.controlStore}
+
+	invalidAgent := fixture.agent.DeepCopy()
+	invalidAgent.Spec.Skills = []corev1alpha1.SkillReference{{Name: "added-after-queue"}}
+	_, err := fixture.reconciler.queueACPRuntimeTask(ctx, queued.DeepCopy(), invalidAgent)
+	if err != nil {
+		t.Fatalf("queue after live Agent drift: %v", err)
+	}
+
+	current := &corev1alpha1.Task{}
+	if err := fixture.kubeClient.Get(ctx, types.NamespacedName{Namespace: queued.Namespace, Name: queued.Name}, current); err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(current.Status.Execution, queued.Status.Execution) || current.Status.Phase != queued.Status.Phase {
+		t.Fatalf("Task was projected terminal before durable settlement: before=%#v after=%#v", queued.Status, current.Status)
+	}
+	persisted, err := fixture.controlStore.GetPromptAttempt(ctx, attempt.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if persisted.ExecutionState != store.PromptExecutionQueued || persisted.Version != attempt.Version {
+		t.Fatalf("durable attempt changed from live Agent drift: before=%#v after=%#v", attempt, persisted)
+	}
+}
+
+type acpQueuePlanningFailureFixture struct {
+	task         *corev1alpha1.Task
+	agent        *corev1alpha1.Agent
+	kubeClient   client.Client
+	controlStore store.DurableControlStore
+	epochs       *ControllerEpochManager
+	reconciler   *TaskReconciler
+}
+
+func newACPQueuePlanningFailureFixture(t *testing.T) *acpQueuePlanningFailureFixture {
+	t.Helper()
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "default", Name: "post-queue-configuration-failure",
+			UID: types.UID("c72243b6-8b2f-4466-a321-644bff8b21c1"), Generation: 1,
+		},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent, Prompt: "inspect the repository",
+			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				Intent: corev1alpha1.WorkspaceIntentRead, GitRepo: "https://github.com/orka-agents/orka.git",
+			},
+		},
+	}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "default", Name: "codex",
+			UID: types.UID("4fba4a25-3c83-465c-9105-ded0b9c8029a"), Generation: 1,
+		},
+		Spec: corev1alpha1.AgentSpec{
+			Model: &corev1alpha1.ModelConfig{Name: acpTestModel},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeCodex,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+		},
+	}
+	runtimeImage := "docker.io/example/codex@sha256:" + strings.Repeat("a", 64)
+	plan, err := PlanACPRuntime(task, agent, ACPRuntimeImages{Codex: runtimeImage})
+	if err != nil {
+		t.Fatal(err)
+	}
+	pool := runtimePoolForImageRotationTest(
+		task.Namespace, types.UID("73ab20fa-2e2b-4f46-a410-ae4ed9c57751"), plan,
+	)
+	kubeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithStatusSubresource(&corev1alpha1.Task{}, &corev1alpha1.RuntimePool{}).
+		WithObjects(task, pool).
+		Build()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "store.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		if err := db.Close(); err != nil {
+			t.Errorf("close durable control database: %v", err)
+		}
+	})
+	controlStore := sqlite.NewStore(db, "test")
+	epochs := NewControllerEpochManager(controlStore, "controller-test")
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	t.Cleanup(func() {
+		cancelEpoch()
+		if err := <-epochDone; err != nil {
+			t.Errorf("controller epoch manager shutdown: %v", err)
+		}
+	})
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	if _, err := epochs.CurrentFence(ctx); err != nil {
+		t.Fatal(err)
+	}
+	reconciler := &TaskReconciler{
+		Client: kubeClient, Scheme: scheme, DurableControlStore: controlStore,
+		ControllerEpochManager: epochs, ACPRuntimeEnabled: true, ACPRuntimeNamespace: "orka-runtimes",
+		ACPRuntimeImages: ACPRuntimeImages{Codex: runtimeImage},
+	}
+	return &acpQueuePlanningFailureFixture{
+		task: task, agent: agent, kubeClient: kubeClient, controlStore: controlStore, epochs: epochs, reconciler: reconciler,
+	}
+}
+
+func (f *acpQueuePlanningFailureFixture) queueValidTask(t *testing.T, ctx context.Context) (*corev1alpha1.Task, *store.PromptAttempt) {
+	t.Helper()
+	bound := bindACPQueueTaskForTest(t, ctx, f.reconciler, f.task, f.agent)
+	if _, err := f.reconciler.queueACPRuntimeTask(ctx, bound, f.agent.DeepCopy()); err != nil {
+		t.Fatalf("initial queue: %v", err)
+	}
+	queued := &corev1alpha1.Task{}
+	if err := f.reconciler.Get(ctx, types.NamespacedName{Namespace: f.task.Namespace, Name: f.task.Name}, queued); err != nil {
+		t.Fatal(err)
+	}
+	attemptID, err := promptAttemptIDFromTask(queued)
+	if err != nil {
+		t.Fatal(err)
+	}
+	attempt, err := f.controlStore.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return queued, attempt
+}
+
+func TestFailACPPlanningTaskIsIdempotentBeforeDurableAttempt(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "default", Name: "pre-attempt-planning-failure",
+			UID: types.UID("da90c496-1f82-44a4-a610-8b46c9a90f55"),
+		},
+		Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent},
+	}
+	kubeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithStatusSubresource(&corev1alpha1.Task{}).
+		WithObjects(task).
+		Build()
+	reconciler := &TaskReconciler{Client: kubeClient, Scheme: scheme}
+	reason := corev1alpha1.TaskExecutionReason("InvalidRuntimeProfile")
+	message := "agent configuration is unsupported"
+
+	for attempt := 1; attempt <= 2; attempt++ {
+		current := &corev1alpha1.Task{}
+		if err := kubeClient.Get(context.Background(), client.ObjectKeyFromObject(task), current); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := reconciler.failACPPlanningTask(context.Background(), current, reason, message); err != nil {
+			t.Fatalf("failACPPlanningTask() call %d error = %v", attempt, err)
+		}
+	}
+
+	current := &corev1alpha1.Task{}
+	if err := kubeClient.Get(context.Background(), client.ObjectKeyFromObject(task), current); err != nil {
+		t.Fatal(err)
+	}
+	if current.Status.Phase != corev1alpha1.TaskPhaseFailed || current.Status.Execution == nil ||
+		current.Status.Execution.State != corev1alpha1.TaskExecutionStateFailed ||
+		current.Status.Execution.Reason != reason || current.Status.Execution.Attempt != 0 ||
+		current.Status.Execution.PromptID != "" || current.Status.Execution.RequestDigest != "" {
+		t.Fatalf("idempotent planning failure status = %#v", current.Status)
+	}
+}
+
+var errPlanningFailureProjectionEnqueue = errors.New("injected planning failure projection enqueue error")
+
+type failingPlanningFailureProjectionStore struct {
+	store.DurableControlStore
+	failed bool
+}
+
+func (s *failingPlanningFailureProjectionStore) EnqueueOutboxProjection(
+	ctx context.Context,
+	projection *store.OutboxProjection,
+	fence store.ControllerEpochFence,
+) (*store.OutboxProjection, error) {
+	if !s.failed {
+		s.failed = true
+		return nil, errPlanningFailureProjectionEnqueue
+	}
+	return s.DurableControlStore.EnqueueOutboxProjection(ctx, projection, fence)
+}
+
+func TestQueueACPRuntimeTaskDoesNotEnqueuePlanningFailureFromLiveAgentDrift(t *testing.T) {
+	fixture := newACPQueuePlanningFailureFixture(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	queued, attempt := fixture.queueValidTask(t, ctx)
+	failingStore := &failingPlanningFailureProjectionStore{DurableControlStore: fixture.controlStore}
+	fixture.reconciler.DurableControlStore = failingStore
+
+	invalidAgent := fixture.agent.DeepCopy()
+	invalidAgent.Spec.Skills = []corev1alpha1.SkillReference{{Name: "added-after-queue"}}
+	_, err := fixture.reconciler.queueACPRuntimeTask(ctx, queued.DeepCopy(), invalidAgent)
+	if err != nil {
+		t.Fatalf("queue after live Agent drift: %v", err)
+	}
+	if failingStore.failed {
+		t.Fatal("live Agent drift reached terminal outbox projection")
+	}
+	persisted, err := fixture.controlStore.GetPromptAttempt(ctx, attempt.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(persisted, attempt) {
+		t.Fatalf("live Agent drift changed durable attempt: before=%#v after=%#v", attempt, persisted)
+	}
+	current := &corev1alpha1.Task{}
+	if err := fixture.kubeClient.Get(ctx, client.ObjectKeyFromObject(queued), current); err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(current.Status.Execution, queued.Status.Execution) || current.Status.Phase != queued.Status.Phase {
+		t.Fatalf("live Agent drift changed Task projection: before=%#v after=%#v", queued.Status, current.Status)
+	}
+}
diff --git a/internal/controller/acp_task_queue_test.go b/internal/controller/acp_task_queue_test.go
new file mode 100644
index 000000000..27c840f2f
--- /dev/null
+++ b/internal/controller/acp_task_queue_test.go
@@ -0,0 +1,792 @@
+package controller
+
+import (
+	"context"
+	"errors"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	types "k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/tools/record"
+	"k8s.io/utils/ptr"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+	"github.com/orka-agents/orka/internal/store/sqlite"
+)
+
+func TestQueueACPRuntimeTaskCreatesPoolAndDurableAttempt(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "task", UID: types.UID("11111111-1111-1111-1111-111111111111"), Generation: 2},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent, Prompt: "implement", AgentRuntime: &corev1alpha1.AgentRuntimeSpec{},
+			Workspace: &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentRead, GitRepo: "https://github.com/orka-agents/orka.git"},
+		},
+	}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "agent", UID: types.UID("22222222-2222-2222-2222-222222222222"), Generation: 3},
+		Spec: corev1alpha1.AgentSpec{Model: &corev1alpha1.ModelConfig{Name: acpTestModel}, Runtime: &corev1alpha1.AgentCLIRuntime{
+			Type:            corev1alpha1.AgentRuntimeCodex,
+			ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+		}},
+	}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}, &corev1alpha1.RuntimePool{}).WithObjects(task).Build()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "store.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	controlStore := sqlite.NewStore(db, "test")
+	epochs := NewControllerEpochManager(controlStore, "controller-test")
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	if _, err := epochs.CurrentFence(ctx); err != nil {
+		t.Fatal(err)
+	}
+	reconciler := &TaskReconciler{
+		Client: kubeClient, Scheme: scheme, Recorder: record.NewFakeRecorder(10), DurableControlStore: controlStore,
+		ControllerEpochManager: epochs, ACPRuntimeEnabled: true, ACPRuntimeNamespace: "orka-runtimes",
+		ACPRuntimeImages: ACPRuntimeImages{Codex: "docker.io/example/codex@sha256:" + strings.Repeat("a", 64)},
+	}
+	bound := bindACPQueueTaskForTest(t, ctx, reconciler, task, agent)
+	if _, err := reconciler.queueACPRuntimeTask(ctx, bound, agent); err != nil {
+		t.Fatal(err)
+	}
+	var pools corev1alpha1.RuntimePoolList
+	if err := kubeClient.List(ctx, &pools); err != nil {
+		t.Fatal(err)
+	}
+	if len(pools.Items) != 1 || pools.Items[0].Spec.DesiredReplicas != 1 || pools.Items[0].Spec.RuntimeNamespace != "orka-runtimes" {
+		t.Fatalf("unexpected pools: %#v", pools.Items)
+	}
+	queued := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, queued); err != nil {
+		t.Fatal(err)
+	}
+	if queued.Status.Execution == nil || queued.Status.Execution.State != corev1alpha1.TaskExecutionStateQueued || queued.Status.Execution.RuntimePoolName != pools.Items[0].Name {
+		t.Fatalf("unexpected queued status: %#v", queued.Status.Execution)
+	}
+	if queued.Labels[acpRuntimeTaskPoolLabel] != pools.Items[0].Name {
+		t.Fatalf("pool label = %q", queued.Labels[acpRuntimeTaskPoolLabel])
+	}
+	if _, err := time.Parse(time.RFC3339Nano, queued.Annotations[acpRuntimeQueuedAtAnnotation]); err != nil {
+		t.Fatalf("queued-at annotation = %q: %v", queued.Annotations[acpRuntimeQueuedAtAnnotation], err)
+	}
+	key := queued.Status.Execution
+	attemptID, err := (storePromptKey(task, key)).CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := controlStore.GetPromptAttempt(ctx, attemptID); err != nil {
+		t.Fatal(err)
+	}
+	cancelEpoch()
+	if err := <-epochDone; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func storePromptKey(task *corev1alpha1.Task, status *corev1alpha1.TaskExecutionStatus) store.PromptAttemptKey {
+	return store.PromptAttemptKey{Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: int64(status.Attempt), PromptID: status.PromptID}
+}
+
+func TestQueueACPExternalRuntimeTaskFailsClosedWithoutDurableDispatchState(t *testing.T) {
+	const preservedLabel = "sentinel-label"
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "default", Name: "external-task", UID: types.UID("44444444-4444-4444-4444-444444444444"), Generation: 1,
+			Labels: map[string]string{"preserve": preservedLabel}, Annotations: map[string]string{"preserve": "sentinel-annotation"},
+		},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent, Prompt: "external boundary inspection",
+			Workspace: &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentRead},
+		},
+	}
+	registered := plannerExternalRuntime()
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}, &corev1alpha1.AgentRuntime{}).WithObjects(task, registered).Build()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "store.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	controlStore := sqlite.NewStore(db, "test")
+	epochs := NewControllerEpochManager(controlStore, "controller-test")
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	if _, err := epochs.CurrentFence(ctx); err != nil {
+		t.Fatal(err)
+	}
+	reconciler := &TaskReconciler{
+		Client: kubeClient, Scheme: scheme, Recorder: record.NewFakeRecorder(10),
+		DurableControlStore: controlStore, ControllerEpochManager: epochs,
+	}
+	result, err := reconciler.failTask(ctx, task.DeepCopy(), externalAgentRuntimeDispatchUnsupportedReason(registered.Name))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.RequeueAfter != time.Second {
+		t.Fatalf("requeueAfter = %s, want %s", result.RequeueAfter, time.Second)
+	}
+	failed := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, failed); err != nil {
+		t.Fatal(err)
+	}
+	wantMessage := externalAgentRuntimeDispatchUnsupportedReason(registered.Name)
+	if failed.Status.Phase != corev1alpha1.TaskPhaseFailed || failed.Status.Message != wantMessage || failed.Status.Execution != nil ||
+		failed.Status.Delivery != nil || failed.Status.Attempts != 0 {
+		t.Fatalf("external boundary status: %#v", failed.Status)
+	}
+	if failed.Labels["preserve"] != preservedLabel || failed.Labels[acpExternalRuntimeTaskLabel] != "" {
+		t.Fatalf("external boundary labels: %#v", failed.Labels)
+	}
+	if failed.Annotations["preserve"] != "sentinel-annotation" || failed.Annotations[acpRuntimeQueuedAtAnnotation] != "" {
+		t.Fatalf("external boundary annotations: %#v", failed.Annotations)
+	}
+	var pools corev1alpha1.RuntimePoolList
+	if err := kubeClient.List(ctx, &pools); err != nil || len(pools.Items) != 0 {
+		t.Fatalf("external rejection unexpectedly created pools: %#v err=%v", pools.Items, err)
+	}
+	attemptID, err := (store.PromptAttemptKey{
+		Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: "prompt-" + string(task.UID) + "-1",
+	}).CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := controlStore.GetPromptAttempt(ctx, attemptID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("external rejection durable attempt error = %v, want not found", err)
+	}
+	cancelEpoch()
+	if err := <-epochDone; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestQueueACPRuntimeTaskRejectsUnsafeRepositoryBeforePoolDemand(t *testing.T) {
+	tests := []struct {
+		name      string
+		workspace *corev1alpha1.WorkspaceConfig
+	}{
+		{
+			name: "source remote helper",
+			workspace: &corev1alpha1.WorkspaceConfig{
+				Intent:  corev1alpha1.WorkspaceIntentRead,
+				GitRepo: "ext::https://github.com/orka-agents/orka.git",
+			},
+		},
+		{
+			name: "publication remote helper",
+			workspace: &corev1alpha1.WorkspaceConfig{
+				Intent:                   corev1alpha1.WorkspaceIntentWrite,
+				GitRepo:                  "https://github.com/orka-agents/orka.git",
+				PublicationGitRepo:       "ext::https://github.com/sozercan/orka-acp-release-gate.git",
+				PublicationCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "publish"},
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			scheme := runtime.NewScheme()
+			if err := corev1alpha1.AddToScheme(scheme); err != nil {
+				t.Fatal(err)
+			}
+			task := &corev1alpha1.Task{
+				ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "unsafe-task", UID: types.UID("66666666-6666-6666-6666-666666666666"), Generation: 1},
+				Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Prompt: "inspect", Workspace: test.workspace},
+			}
+			agent := &corev1alpha1.Agent{
+				ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "agent", UID: types.UID("77777777-7777-7777-7777-777777777777"), Generation: 1},
+				Spec: corev1alpha1.AgentSpec{Model: &corev1alpha1.ModelConfig{Name: acpTestModel}, Runtime: &corev1alpha1.AgentCLIRuntime{
+					Type: corev1alpha1.AgentRuntimeCodex, ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+				}},
+			}
+			kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}, &corev1alpha1.RuntimePool{}).WithObjects(task).Build()
+			db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "store.db"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer db.Close() //nolint:errcheck
+			controlStore := sqlite.NewStore(db, "test")
+			epochs := NewControllerEpochManager(controlStore, "controller-test")
+			epochCtx, cancelEpoch := context.WithCancel(context.Background())
+			epochDone := make(chan error, 1)
+			go func() { epochDone <- epochs.Start(epochCtx) }()
+			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			defer cancel()
+			if _, err := epochs.CurrentFence(ctx); err != nil {
+				t.Fatal(err)
+			}
+			reconciler := &TaskReconciler{
+				Client: kubeClient, Scheme: scheme, Recorder: record.NewFakeRecorder(10), DurableControlStore: controlStore,
+				ControllerEpochManager: epochs, ACPRuntimeEnabled: true, ACPRuntimeNamespace: "orka-runtimes",
+				ACPRuntimeImages: ACPRuntimeImages{Codex: "docker.io/example/codex@sha256:" + strings.Repeat("a", 64)},
+			}
+			bound := bindACPQueueTaskForTest(t, ctx, reconciler, task, agent)
+			if _, err := reconciler.queueACPRuntimeTask(ctx, bound, agent); err != nil {
+				t.Fatal(err)
+			}
+			var pools corev1alpha1.RuntimePoolList
+			if err := kubeClient.List(ctx, &pools); err != nil {
+				t.Fatal(err)
+			}
+			if len(pools.Items) != 0 {
+				t.Fatalf("unsafe queue created RuntimePools: %#v", pools.Items)
+			}
+			failed := &corev1alpha1.Task{}
+			if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, failed); err != nil {
+				t.Fatal(err)
+			}
+			if failed.Status.Execution == nil || failed.Status.Execution.State != corev1alpha1.TaskExecutionStateFailed ||
+				failed.Status.Execution.Reason != corev1alpha1.TaskExecutionReason("InvalidWorkspace") || failed.Status.Execution.RuntimePoolName != "" ||
+				failed.Status.Delivery == nil || failed.Status.Delivery.State != corev1alpha1.TaskDeliveryStateNotRequested ||
+				failed.Status.Delivery.Outcome != corev1alpha1.TaskDeliveryOutcomeNotRequested {
+				t.Fatalf("unsafe queue status: execution=%#v delivery=%#v", failed.Status.Execution, failed.Status.Delivery)
+			}
+			ready, err := reconciler.acpTaskDeletionReady(ctx, failed)
+			if err != nil || !ready {
+				t.Fatalf("preflight-failed Task deletion readiness = %v, err=%v", ready, err)
+			}
+			cancelEpoch()
+			if err := <-epochDone; err != nil {
+				t.Fatal(err)
+			}
+		})
+	}
+}
+
+func TestQueueACPRuntimeTaskReportsInvalidWorkspaceWhenReadCredentialDoesNotExist(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "missing-read-credential", UID: types.UID("99999999-9999-9999-9999-999999999999"), Generation: 1},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent, Prompt: "inspect",
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				Intent: corev1alpha1.WorkspaceIntentRead, GitRepo: "https://github.com/orka-agents/orka.git",
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "does-not-exist"},
+			},
+		},
+	}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "agent", UID: types.UID("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"), Generation: 1},
+		Spec: corev1alpha1.AgentSpec{Model: &corev1alpha1.ModelConfig{Name: acpTestModel}, Runtime: &corev1alpha1.AgentCLIRuntime{
+			Type:            corev1alpha1.AgentRuntimeCodex,
+			ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+		}},
+	}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}, &corev1alpha1.RuntimePool{}).WithObjects(task).Build()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "store.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	controlStore := sqlite.NewStore(db, "test")
+	epochs := NewControllerEpochManager(controlStore, "controller-test")
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	if _, err := epochs.CurrentFence(ctx); err != nil {
+		t.Fatal(err)
+	}
+	reconciler := &TaskReconciler{
+		Client: kubeClient, Scheme: scheme, Recorder: record.NewFakeRecorder(10), DurableControlStore: controlStore,
+		ControllerEpochManager: epochs, ACPRuntimeEnabled: true, ACPRuntimeNamespace: "orka-runtimes",
+		ACPRuntimeImages: ACPRuntimeImages{Codex: "docker.io/example/codex@sha256:" + strings.Repeat("a", 64)},
+	}
+	bound := bindACPQueueTaskForTest(t, ctx, reconciler, task, agent)
+	if _, err := reconciler.queueACPRuntimeTask(ctx, bound, agent); err != nil {
+		t.Fatalf("queueACPRuntimeTask() error = %v, want terminal InvalidWorkspace status", err)
+	}
+	failed := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, failed); err != nil {
+		t.Fatal(err)
+	}
+	if failed.Status.Phase != corev1alpha1.TaskPhaseFailed || failed.Status.Execution == nil ||
+		failed.Status.Execution.State != corev1alpha1.TaskExecutionStateFailed ||
+		failed.Status.Execution.Outcome != corev1alpha1.TaskExecutionOutcomeFailed ||
+		failed.Status.Execution.Reason != corev1alpha1.TaskExecutionReason("InvalidWorkspace") ||
+		failed.Status.Execution.Attempt != 0 || failed.Status.Execution.PromptID != "" || failed.Status.Execution.RuntimePoolName != "" ||
+		failed.Status.Delivery == nil || failed.Status.Delivery.State != corev1alpha1.TaskDeliveryStateNotRequested ||
+		failed.Status.Delivery.Outcome != corev1alpha1.TaskDeliveryOutcomeNotRequested {
+		t.Fatalf("missing credential status: %#v", failed.Status)
+	}
+	if !strings.Contains(failed.Status.Message, "freeze ACP credential bindings") || !strings.Contains(failed.Status.Message, "does-not-exist") {
+		t.Fatalf("missing credential message = %q", failed.Status.Message)
+	}
+	attemptID, err := (store.PromptAttemptKey{
+		Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: "prompt-" + string(task.UID) + "-1",
+	}).CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := controlStore.GetPromptAttempt(ctx, attemptID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("missing credential durable attempt error = %v, want not found", err)
+	}
+	cancelEpoch()
+	if err := <-epochDone; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestQueueACPExternalRuntimeTaskSupportBoundaryPrecedesAdmissionAndWorkspaceValidation(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "unsafe-external-task", UID: types.UID("88888888-8888-8888-8888-888888888888"), Generation: 1},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent, Prompt: "inspect",
+			Workspace: &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentRead, GitRepo: "ext::https://github.com/orka-agents/orka.git"},
+		},
+	}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}).WithObjects(task).Build()
+	gate := NewACPAdmissionGate()
+	gate.Close("upgrade drain", time.Now())
+	reconciler := &TaskReconciler{Client: kubeClient, Scheme: scheme, Recorder: record.NewFakeRecorder(10), ACPAdmissionGate: gate}
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	if _, err := reconciler.failTask(ctx, task.DeepCopy(), externalAgentRuntimeDispatchUnsupportedReason(" external-v2 ")); err != nil {
+		t.Fatal(err)
+	}
+	failed := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, failed); err != nil {
+		t.Fatal(err)
+	}
+	wantMessage := externalAgentRuntimeDispatchUnsupportedReason("external-v2")
+	if failed.Status.Phase != corev1alpha1.TaskPhaseFailed || failed.Status.Message != wantMessage || failed.Status.Execution != nil || failed.Status.Attempts != 0 {
+		t.Fatalf("external support-boundary status: %#v", failed.Status)
+	}
+}
+
+func TestQueueACPRuntimeTaskReportsInvalidRuntimeProfile(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "invalid-profile-task", UID: types.UID("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"), Generation: 1},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent, Prompt: "inspect",
+			Workspace: &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentRead, GitRepo: "https://github.com/orka-agents/orka.git"},
+		},
+	}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "agent", UID: types.UID("bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"), Generation: 1},
+		Spec:       corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeCodex}},
+	}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.Task{}, &corev1alpha1.RuntimePool{}).WithObjects(task).Build()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "store.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	controlStore := sqlite.NewStore(db, "test")
+	epochs := NewControllerEpochManager(controlStore, "controller-test")
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	if _, err := epochs.CurrentFence(ctx); err != nil {
+		t.Fatal(err)
+	}
+	reconciler := &TaskReconciler{
+		Client: kubeClient, Scheme: scheme, Recorder: record.NewFakeRecorder(10), DurableControlStore: controlStore,
+		ControllerEpochManager: epochs, ACPRuntimeEnabled: true, ACPRuntimeNamespace: "orka-runtimes",
+		ACPRuntimeImages: ACPRuntimeImages{Codex: "docker.io/example/codex@sha256:" + strings.Repeat("a", 64)},
+	}
+	current := configureAgentExecutionBindingTest(t, ctx, reconciler, task)
+	if result, err, handled := reconciler.ensureAgentExecutionBinding(ctx, current, agent); err != nil || !handled {
+		t.Fatalf("invalid profile binding result=%#v handled=%v err=%v", result, handled, err)
+	}
+	failed := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, failed); err != nil {
+		t.Fatal(err)
+	}
+	if failed.Status.Execution == nil || failed.Status.Execution.Reason != corev1alpha1.TaskExecutionReason("InvalidRuntimeProfile") {
+		t.Fatalf("runtime profile failure status = %#v", failed.Status.Execution)
+	}
+	cancelEpoch()
+	if err := <-epochDone; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestValidateACPWorkspacePreflightRejectsUnsafeRepositoriesBeforeDemand(t *testing.T) {
+	tests := []struct {
+		name      string
+		workspace *corev1alpha1.WorkspaceConfig
+		want      string
+	}{
+		{
+			name: "read source remote helper",
+			workspace: &corev1alpha1.WorkspaceConfig{
+				Intent:  corev1alpha1.WorkspaceIntentRead,
+				GitRepo: "ext::https://github.com/orka-agents/orka.git",
+			},
+			want: "credential-free HTTPS",
+		},
+		{
+			name: "read source empty query marker",
+			workspace: &corev1alpha1.WorkspaceConfig{
+				Intent:  corev1alpha1.WorkspaceIntentRead,
+				GitRepo: "https://github.com/orka-agents/orka.git?",
+			},
+			want: "credential-free HTTPS",
+		},
+		{
+			name: "read source non-default HTTPS port",
+			workspace: &corev1alpha1.WorkspaceConfig{
+				Intent:  corev1alpha1.WorkspaceIntentRead,
+				GitRepo: "https://github.com:8443/orka-agents/orka.git",
+			},
+			want: errWorkspaceRepositoryHTTPSPort.Error(),
+		},
+		{
+			name: "write publication remote helper",
+			workspace: &corev1alpha1.WorkspaceConfig{
+				Intent:                   corev1alpha1.WorkspaceIntentWrite,
+				GitRepo:                  "https://github.com/orka-agents/orka.git",
+				PublicationGitRepo:       "ext::https://github.com/sozercan/orka-acp-release-gate.git",
+				PublicationCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "publish"},
+			},
+			want: "publication repository",
+		},
+		{
+			name: "write publication empty query marker",
+			workspace: &corev1alpha1.WorkspaceConfig{
+				Intent:                   corev1alpha1.WorkspaceIntentWrite,
+				GitRepo:                  "https://github.com/orka-agents/orka.git",
+				PublicationGitRepo:       "https://github.com/sozercan/orka-acp-release-gate.git?",
+				PublicationCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "publish"},
+			},
+			want: "publication repository",
+		},
+		{
+			name: "write publication non-default HTTPS port",
+			workspace: &corev1alpha1.WorkspaceConfig{
+				Intent:                   corev1alpha1.WorkspaceIntentWrite,
+				GitRepo:                  "https://github.com/orka-agents/orka.git",
+				PublicationGitRepo:       "https://github.com:8443/sozercan/orka-acp-release-gate.git",
+				PublicationCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "publish"},
+			},
+			want: errWorkspaceRepositoryHTTPSPort.Error(),
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Workspace: test.workspace}}
+			err := validateACPWorkspacePreflight(task)
+			if err == nil || !strings.Contains(err.Error(), test.want) {
+				t.Fatalf("validateACPWorkspacePreflight() = %v, want %q", err, test.want)
+			}
+		})
+	}
+}
+
+func TestValidateACPWorkspacePreflightRejectsWriteWithoutPublicationCredential(t *testing.T) {
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{
+		Type:      corev1alpha1.TaskTypeAgent,
+		Workspace: &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentWrite, GitRepo: "https://github.com/orka-agents/orka.git"},
+	}}
+	if err := validateACPWorkspacePreflight(task); err == nil || !strings.Contains(err.Error(), "publicationCredentialRef") {
+		t.Fatalf("validateACPWorkspacePreflight() = %v", err)
+	}
+}
+
+func TestValidateACPWorkspacePreflightRejectsMalformedAllowedPathGlobs(t *testing.T) {
+	tests := []struct {
+		name    string
+		pattern string
+		wantErr bool
+	}{
+		{name: "unclosed character class", pattern: "[", wantErr: true},
+		{name: "unclosed nested character class", pattern: "src/[abc", wantErr: true},
+		{name: "malformed recursive prefix", pattern: "[/**", wantErr: true},
+		{name: "malformed nested recursive prefix", pattern: "src/[abc/**", wantErr: true},
+		{name: "valid glob", pattern: "src/*.go"},
+		{name: "custom recursive prefix", pattern: "src/**"},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{
+				Type: corev1alpha1.TaskTypeAgent,
+				Workspace: &corev1alpha1.WorkspaceConfig{
+					Intent:                   corev1alpha1.WorkspaceIntentWrite,
+					GitRepo:                  "https://github.com/orka-agents/orka.git",
+					PublicationCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "publish"},
+					AllowedPaths:             []string{test.pattern},
+				},
+			}}
+
+			err := validateACPWorkspacePreflight(task)
+			if test.wantErr {
+				if err == nil || !strings.Contains(err.Error(), "allowedPaths") {
+					t.Fatalf("validateACPWorkspacePreflight() = %v, want invalid allowedPaths error", err)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("validateACPWorkspacePreflight() = %v, want nil", err)
+			}
+		})
+	}
+}
+
+func TestValidateACPWorkspacePreflightRejectsRepositorySelectorsWithoutGitRepo(t *testing.T) {
+	tests := []struct {
+		name      string
+		field     string
+		configure func(*corev1alpha1.WorkspaceConfig)
+	}{
+		{name: "branch", field: "branch", configure: func(workspace *corev1alpha1.WorkspaceConfig) { workspace.Branch = defaultACPSourceBranch }},
+		{name: "ref", field: "ref", configure: func(workspace *corev1alpha1.WorkspaceConfig) { workspace.Ref = "refs/tags/v1.0.0" }},
+		{name: "subPath", field: "subPath", configure: func(workspace *corev1alpha1.WorkspaceConfig) { workspace.SubPath = "cmd/orka" }},
+		{name: "sourceRepository", field: "sourceRepository", configure: func(workspace *corev1alpha1.WorkspaceConfig) {
+			workspace.SourceRepository = &corev1alpha1.RepositoryIdentity{Provider: "github", ID: "github.com/orka-agents/orka"}
+		}},
+		{name: "readCredentialRef", field: "readCredentialRef", configure: func(workspace *corev1alpha1.WorkspaceConfig) {
+			workspace.ReadCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: "source-read"}
+		}},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			workspace := &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentRead, GitRepo: "  "}
+			test.configure(workspace)
+			task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Workspace: workspace}}
+
+			err := validateACPWorkspacePreflight(task)
+			want := test.field + " requires gitRepo"
+			if err == nil || !strings.Contains(err.Error(), want) {
+				t.Fatalf("validateACPWorkspacePreflight() = %v, want %q", err, want)
+			}
+		})
+	}
+}
+
+func TestValidateACPWorkspacePreflightRejectsPublicationFieldsOnReadIntent(t *testing.T) {
+	tests := []struct {
+		name      string
+		field     string
+		configure func(*corev1alpha1.WorkspaceConfig)
+	}{
+		{name: "publicationGitRepo", field: "publicationGitRepo", configure: func(workspace *corev1alpha1.WorkspaceConfig) {
+			workspace.PublicationGitRepo = "https://github.com/orka-agents/orka-fork.git"
+		}},
+		{name: "publicationRepository", field: "publicationRepository", configure: func(workspace *corev1alpha1.WorkspaceConfig) {
+			workspace.PublicationRepository = &corev1alpha1.RepositoryIdentity{Provider: "github", ID: "github.com/orka-agents/orka-fork"}
+		}},
+		{name: "publicationReadCredentialRef", field: "publicationReadCredentialRef", configure: func(workspace *corev1alpha1.WorkspaceConfig) {
+			workspace.PublicationReadCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: "publication-read"}
+		}},
+		{name: "publicationCredentialRef", field: "publicationCredentialRef", configure: func(workspace *corev1alpha1.WorkspaceConfig) {
+			workspace.PublicationCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: "publication-write"}
+		}},
+		{name: "forgeCredentialRef", field: "forgeCredentialRef", configure: func(workspace *corev1alpha1.WorkspaceConfig) {
+			workspace.ForgeCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: "forge"}
+		}},
+		{name: "pushBranch", field: "pushBranch", configure: func(workspace *corev1alpha1.WorkspaceConfig) {
+			workspace.PushBranch = "orka/task"
+		}},
+		{name: "prBaseBranch", field: "prBaseBranch", configure: func(workspace *corev1alpha1.WorkspaceConfig) {
+			workspace.PRBaseBranch = defaultACPSourceBranch
+		}},
+		{name: "createPR", field: "createPR", configure: func(workspace *corev1alpha1.WorkspaceConfig) { workspace.CreatePR = true }},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			workspace := &corev1alpha1.WorkspaceConfig{
+				Intent:  corev1alpha1.WorkspaceIntentRead,
+				GitRepo: "https://github.com/orka-agents/orka.git",
+			}
+			test.configure(workspace)
+			task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Workspace: workspace}}
+
+			err := validateACPWorkspacePreflight(task)
+			want := test.field + " requires write workspace intent"
+			if err == nil || !strings.Contains(err.Error(), want) {
+				t.Fatalf("validateACPWorkspacePreflight() = %v, want %q", err, want)
+			}
+		})
+	}
+}
+
+func TestValidateACPWorkspacePreflightRejectsInvalidPublicationBranches(t *testing.T) {
+	credential := &corev1alpha1.WorkspaceCredentialReference{Name: "publish"}
+	forgeCredential := &corev1alpha1.WorkspaceCredentialReference{Name: "forge"}
+	base := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{
+		Type: corev1alpha1.TaskTypeAgent,
+		Workspace: &corev1alpha1.WorkspaceConfig{
+			Intent: corev1alpha1.WorkspaceIntentWrite, GitRepo: "https://github.com/orka-agents/orka.git",
+			PublicationGitRepo: "https://github.com/orka-agents/orka.git", PublicationCredentialRef: credential,
+		},
+	}}
+
+	invalidPush := base.DeepCopy()
+	invalidPush.Spec.Workspace.PushBranch = "bad branch"
+	if err := validateACPWorkspacePreflight(invalidPush); err == nil || !strings.Contains(err.Error(), "pushBranch is invalid") {
+		t.Fatalf("invalid pushBranch error = %v", err)
+	}
+
+	invalidBase := base.DeepCopy()
+	invalidBase.Spec.Workspace.CreatePR = true
+	invalidBase.Spec.Workspace.PRBaseBranch = "bad branch"
+	invalidBase.Spec.Workspace.ForgeCredentialRef = forgeCredential
+	if err := validateACPWorkspacePreflight(invalidBase); err == nil || !strings.Contains(err.Error(), "prBaseBranch is invalid") {
+		t.Fatalf("invalid prBaseBranch error = %v", err)
+	}
+
+	valid := base.DeepCopy()
+	valid.Spec.Workspace.PushBranch = "refs/heads/orka/task-valid"
+	valid.Spec.Workspace.CreatePR = true
+	valid.Spec.Workspace.PRBaseBranch = "release/v2"
+	valid.Spec.Workspace.ForgeCredentialRef = forgeCredential
+	if err := validateACPWorkspacePreflight(valid); err != nil {
+		t.Fatalf("valid publication branches rejected: %v", err)
+	}
+}
+
+func TestSortACPTasksByQueuePriorityPromotesMaximumWait(t *testing.T) {
+	now := time.Date(2026, 7, 25, 12, 0, 0, 0, time.UTC)
+	lowPriority := int32(0)
+	highPriority := int32(1000)
+	old := queuedTaskForOrderingTest("old-low", "old-low-uid", lowPriority, now.Add(-DefaultACPQueueMaximumWait))
+	newer := queuedTaskForOrderingTest("new-high", "new-high-uid", highPriority, now.Add(-time.Second))
+	tasks := []*corev1alpha1.Task{newer, old}
+
+	sortACPTasksByQueuePriority(tasks, now)
+
+	if tasks[0] != old {
+		t.Fatalf("maximum-wait task was not promoted: first=%s", tasks[0].Name)
+	}
+}
+
+func TestSortACPTasksByQueuePriorityAgesBeforePromotion(t *testing.T) {
+	now := time.Date(2026, 7, 25, 12, 0, 0, 0, time.UTC)
+	agedPriority := int32(500)
+	freshPriority := int32(575)
+	aged := queuedTaskForOrderingTest("aged", "aged-uid", agedPriority, now.Add(-2*time.Minute))
+	fresh := queuedTaskForOrderingTest("fresh", "fresh-uid", freshPriority, now.Add(-time.Second))
+	tasks := []*corev1alpha1.Task{fresh, aged}
+
+	sortACPTasksByQueuePriority(tasks, now)
+
+	if tasks[0] != aged {
+		t.Fatalf("aged effective priority did not win: first=%s", tasks[0].Name)
+	}
+}
+
+func TestSortACPTasksByQueuePriorityUsesFIFOForPromotedTasks(t *testing.T) {
+	now := time.Date(2026, 7, 25, 12, 0, 0, 0, time.UTC)
+	lowPriority := int32(1)
+	highPriority := int32(999)
+	oldest := queuedTaskForOrderingTest("oldest", "oldest-uid", lowPriority, now.Add(-7*time.Minute))
+	newer := queuedTaskForOrderingTest("newer", "newer-uid", highPriority, now.Add(-6*time.Minute))
+	tasks := []*corev1alpha1.Task{newer, oldest}
+
+	sortACPTasksByQueuePriority(tasks, now)
+
+	if tasks[0] != oldest {
+		t.Fatalf("promoted FIFO order was not preserved: first=%s", tasks[0].Name)
+	}
+}
+
+func queuedTaskForOrderingTest(name, uid string, priority int32, queuedAt time.Time) *corev1alpha1.Task {
+	transition := metav1.NewTime(queuedAt.Add(time.Minute))
+	return &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "default", Name: name, UID: types.UID(uid), CreationTimestamp: metav1.NewTime(queuedAt.Add(-time.Minute)),
+			Annotations: map[string]string{acpRuntimeQueuedAtAnnotation: queuedAt.Format(time.RFC3339Nano)},
+		},
+		Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Priority: &priority},
+		Status: corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateQueued, LastTransitionTime: &transition,
+		}},
+	}
+}
+
+func TestACPTaskDeletionReadyWaitsForWriteSessionRefRuntimeRetirement(t *testing.T) {
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "store.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	reconciler := &TaskReconciler{DurableControlStore: sqlite.NewStore(db, "test")}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "write-session", UID: types.UID("77777777-7777-7777-7777-777777777777")},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent,
+			SessionRef: &corev1alpha1.SessionReference{
+				Name: "write-session", Create: true, Append: true,
+			},
+			Workspace: &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentWrite},
+		},
+		Status: corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{
+			Attempt: 1, RuntimeInstanceID: "runtime-instance", RuntimeSessionUID: "runtime-session", RuntimeSessionGeneration: 1,
+		}},
+	}
+
+	ready, err := reconciler.acpTaskDeletionReady(context.Background(), task)
+	if err != nil {
+		t.Fatalf("acpTaskDeletionReady() error = %v, want cleanup barrier before attempt lookup", err)
+	}
+	if ready {
+		t.Fatal("write SessionRef Task became deletion-ready before exact RuntimeSession cleanup receipt")
+	}
+}
+
+func TestValidateACPWorkspacePreflightRejectsUnsafeChangePolicies(t *testing.T) {
+	credential := &corev1alpha1.WorkspaceCredentialReference{Name: "publish"}
+	base := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{
+		Type: corev1alpha1.TaskTypeAgent,
+		Workspace: &corev1alpha1.WorkspaceConfig{
+			Intent: corev1alpha1.WorkspaceIntentWrite, GitRepo: "https://github.com/orka-agents/orka.git",
+			PublicationGitRepo: "https://github.com/orka-agents/orka.git", PublicationCredentialRef: credential,
+		},
+	}}
+
+	zero := int32(0)
+	base.Spec.Workspace.MaxChangedFiles = &zero
+	if err := validateACPWorkspacePreflight(base); err == nil || !strings.Contains(err.Error(), "maxChangedFiles") {
+		t.Fatalf("zero maxChangedFiles error = %v", err)
+	}
+
+	maxFiles := int32(2)
+	base.Spec.Workspace.MaxChangedFiles = &maxFiles
+	base.Spec.Workspace.AllowedPaths = []string{"../outside"}
+	if err := validateACPWorkspacePreflight(base); err == nil || !strings.Contains(err.Error(), "allowedPaths") {
+		t.Fatalf("unsafe allowedPaths error = %v", err)
+	}
+
+	base.Spec.Workspace.AllowedPaths = []string{"internal/**"}
+	if err := validateACPWorkspacePreflight(base); err != nil {
+		t.Fatalf("valid change policy error = %v", err)
+	}
+}
diff --git a/internal/controller/acp_upgrade_drain.go b/internal/controller/acp_upgrade_drain.go
new file mode 100644
index 000000000..424db43d1
--- /dev/null
+++ b/internal/controller/acp_upgrade_drain.go
@@ -0,0 +1,1406 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package controller
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"reflect"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	coordinationv1 "k8s.io/api/coordination/v1"
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/util/retry"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/healthz"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+const (
+	DefaultACPUpgradeDrainBindAddress    = "127.0.0.1:8083"
+	DefaultACPUpgradeDrainPath           = "/acp/upgrade-drain"
+	DefaultACPUpgradeDrainTimeout        = 5 * time.Minute
+	DefaultACPUpgradeDrainPollInterval   = time.Second
+	DefaultACPUpgradeDrainTriggerTimeout = 5*time.Minute + 15*time.Second
+
+	acpUpgradeDrainMarkerAnnotation = "core.orka.ai/acp-upgrade-drain-marker"
+)
+
+var (
+	ErrACPAdmissionClosed       = errors.New("ACP admission is closed")
+	ErrACPUpgradeDrainTimedOut  = errors.New("ACP planned upgrade drain timed out")
+	ErrACPUpgradeDrainEpochLost = errors.New("controller epoch changed during ACP planned upgrade drain")
+)
+
+// ACPAdmissionGate is the process-local first barrier for new ACP demand. A
+// planned drain closes it before any RuntimePool mutation. Callers must also
+// check it inside the final RuntimePool reservation CAS so an admission that
+// raced an earlier queue scan cannot cross the shutdown boundary.
+type ACPAdmissionGate struct {
+	mu       sync.RWMutex
+	closed   bool
+	reason   string
+	closedAt time.Time
+}
+
+func NewACPAdmissionGate() *ACPAdmissionGate { return &ACPAdmissionGate{} }
+
+func (g *ACPAdmissionGate) Close(reason string, now time.Time) {
+	if g == nil {
+		return
+	}
+	reason = strings.TrimSpace(reason)
+	if reason == "" {
+		reason = "ACP admission closed"
+	}
+	if now.IsZero() {
+		now = time.Now().UTC()
+	} else {
+		now = now.UTC()
+	}
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if g.closed {
+		return
+	}
+	g.closed = true
+	g.reason = reason
+	g.closedAt = now
+}
+
+func (g *ACPAdmissionGate) Check() error {
+	if g == nil {
+		return nil
+	}
+	g.mu.RLock()
+	defer g.mu.RUnlock()
+	if !g.closed {
+		return nil
+	}
+	return fmt.Errorf("%w: %s", ErrACPAdmissionClosed, g.reason)
+}
+
+func (g *ACPAdmissionGate) Closed() (bool, string, time.Time) {
+	if g == nil {
+		return false, "", time.Time{}
+	}
+	g.mu.RLock()
+	defer g.mu.RUnlock()
+	return g.closed, g.reason, g.closedAt
+}
+
+// ACPUpgradeDrainOptions is shared by the normal controller process and the
+// same-binary preStop trigger mode. The trigger listener is deliberately
+// loopback-only; the preStop child shares the Pod network namespace.
+type ACPUpgradeDrainOptions struct {
+	BindAddress       string
+	Timeout           time.Duration
+	PollInterval      time.Duration
+	MarkerNamespace   string
+	WatchNamespace    string
+	RuntimePoolLabels map[string]string
+	TriggerURL        string
+	TriggerTimeout    time.Duration
+}
+
+func DefaultACPUpgradeDrainOptions() ACPUpgradeDrainOptions {
+	return ACPUpgradeDrainOptions{
+		BindAddress:       DefaultACPUpgradeDrainBindAddress,
+		Timeout:           DefaultACPUpgradeDrainTimeout,
+		PollInterval:      DefaultACPUpgradeDrainPollInterval,
+		RuntimePoolLabels: map[string]string{acpRuntimePoolLabel: scheduledRunLabelValue},
+		TriggerTimeout:    DefaultACPUpgradeDrainTriggerTimeout,
+	}
+}
+
+// BindFlags registers all flags required by cmd/main.go. TriggerURL is empty in
+// the long-running controller and non-empty only in the preStop child process.
+func (o *ACPUpgradeDrainOptions) BindFlags(fs *flag.FlagSet) {
+	if o == nil || fs == nil {
+		return
+	}
+	defaults := DefaultACPUpgradeDrainOptions()
+	if strings.TrimSpace(o.BindAddress) == "" {
+		o.BindAddress = defaults.BindAddress
+	}
+	if o.Timeout <= 0 {
+		o.Timeout = defaults.Timeout
+	}
+	if o.PollInterval <= 0 {
+		o.PollInterval = defaults.PollInterval
+	}
+	if o.TriggerTimeout <= 0 {
+		o.TriggerTimeout = defaults.TriggerTimeout
+	}
+	fs.StringVar(&o.BindAddress, "acp-upgrade-drain-bind-address", o.BindAddress, "Loopback address for the ACP planned-upgrade drain trigger.")
+	fs.DurationVar(&o.Timeout, "acp-upgrade-drain-timeout", o.Timeout, "Maximum time to reach ACP planned-upgrade quiescence before falling back to unplanned takeover semantics.")
+	fs.DurationVar(&o.PollInterval, "acp-upgrade-drain-poll-interval", o.PollInterval, "Polling interval for ACP planned-upgrade barriers.")
+	fs.StringVar(&o.MarkerNamespace, "acp-upgrade-drain-marker-namespace", o.MarkerNamespace, "Namespace containing the authoritative controller-epoch Lease used for the durable planned-upgrade marker.")
+	fs.StringVar(&o.TriggerURL, "acp-upgrade-drain-trigger-url", o.TriggerURL, "Loopback URL used only by the preStop child to trigger the running controller.")
+	fs.DurationVar(&o.TriggerTimeout, "acp-upgrade-drain-trigger-timeout", o.TriggerTimeout, "Timeout for the preStop child waiting for the running controller drain result.")
+}
+
+// ACPUpgradeDrainEpochSource supplies the epoch already acquired after
+// controller-runtime leader election.
+type ACPUpgradeDrainEpochSource interface {
+	CurrentFence(context.Context) (store.ControllerEpochFence, error)
+}
+
+// ACPUpgradeDrainOutboxBarrier must report all Pending or Delivering outbox
+// records, including records whose retry availability is in the future.
+type ACPUpgradeDrainOutboxBarrier interface {
+	CountUnsettledOutboxProjections(context.Context) (int64, error)
+}
+
+// ACPUpgradeDrainOutboxBarrierFunc adapts a function for store-specific wiring.
+type ACPUpgradeDrainOutboxBarrierFunc func(context.Context) (int64, error)
+
+func (f ACPUpgradeDrainOutboxBarrierFunc) CountUnsettledOutboxProjections(ctx context.Context) (int64, error) {
+	return f(ctx)
+}
+
+// ACPUpgradeDrainBarrierSnapshot is the durable work outside RuntimePool
+// supervisor state that must settle before a planned leader handoff.
+type ACPUpgradeDrainBarrierSnapshot struct {
+	UnsettledOutboxProjections int64 `json:"unsettledOutboxProjections"`
+	NonterminalPromptAttempts  int64 `json:"nonterminalPromptAttempts"`
+	ActiveSessionControls      int64 `json:"activeSessionControls"`
+	NonterminalPublications    int64 `json:"nonterminalPublications"`
+	NonterminalExternalEffects int64 `json:"nonterminalExternalEffects"`
+}
+
+func (s ACPUpgradeDrainBarrierSnapshot) Quiescent() bool {
+	return s.UnsettledOutboxProjections == 0 && s.NonterminalPromptAttempts == 0 &&
+		s.ActiveSessionControls == 0 && s.NonterminalPublications == 0 && s.NonterminalExternalEffects == 0
+}
+
+// ACPUpgradeDrainBarrierObserver reads the publication, external-effect, and
+// transactional-outbox barriers without mutating or claiming them.
+type ACPUpgradeDrainBarrierObserver interface {
+	ObserveACPUpgradeDrainBarriers(context.Context) (ACPUpgradeDrainBarrierSnapshot, error)
+}
+
+// ACPUpgradeDrainBarrierObserverFunc adapts a function for tests or a composite
+// store implementation during the Kubernetes control-store cutover.
+type ACPUpgradeDrainBarrierObserverFunc func(context.Context) (ACPUpgradeDrainBarrierSnapshot, error)
+
+func (f ACPUpgradeDrainBarrierObserverFunc) ObserveACPUpgradeDrainBarriers(ctx context.Context) (ACPUpgradeDrainBarrierSnapshot, error) {
+	return f(ctx)
+}
+
+// KubernetesACPUpgradeDrainBarrierObserver treats Kubernetes PromptAttempt,
+// RuntimeSessionControl, Publication, and ExternalEffect records as
+// authoritative. It samples the SQLite-backed outbox before and after those
+// sinks so a Delivering record cannot disappear into newly projected work.
+type KubernetesACPUpgradeDrainBarrierObserver struct {
+	Reader    client.Reader
+	Outbox    ACPUpgradeDrainOutboxBarrier
+	Namespace string
+}
+
+func (o *KubernetesACPUpgradeDrainBarrierObserver) ObserveACPUpgradeDrainBarriers(ctx context.Context) (ACPUpgradeDrainBarrierSnapshot, error) {
+	if o == nil || o.Reader == nil || o.Outbox == nil {
+		return ACPUpgradeDrainBarrierSnapshot{}, fmt.Errorf("ACP upgrade drain barrier observer requires Kubernetes reader and outbox barrier")
+	}
+	var snapshot ACPUpgradeDrainBarrierSnapshot
+	before, err := o.Outbox.CountUnsettledOutboxProjections(ctx)
+	if err != nil {
+		return snapshot, fmt.Errorf("count unsettled outbox projections before sink observation: %w", err)
+	}
+	if before < 0 {
+		return snapshot, fmt.Errorf("unsettled outbox projection count cannot be negative")
+	}
+	listOptions := []client.ListOption{}
+	if strings.TrimSpace(o.Namespace) != "" {
+		listOptions = append(listOptions, client.InNamespace(strings.TrimSpace(o.Namespace)))
+	}
+	var attempts corev1alpha1.PromptAttemptList
+	if err := o.Reader.List(ctx, &attempts, listOptions...); err != nil {
+		return snapshot, fmt.Errorf("list PromptAttempts for upgrade drain: %w", err)
+	}
+	for i := range attempts.Items {
+		if promptAttemptHasUpgradeDrainWork(&attempts.Items[i]) {
+			snapshot.NonterminalPromptAttempts++
+		}
+	}
+	var sessions corev1alpha1.RuntimeSessionControlList
+	if err := o.Reader.List(ctx, &sessions, listOptions...); err != nil {
+		return snapshot, fmt.Errorf("list RuntimeSessionControls for upgrade drain: %w", err)
+	}
+	for i := range sessions.Items {
+		if runtimeSessionControlHasUpgradeDrainWork(&sessions.Items[i]) {
+			snapshot.ActiveSessionControls++
+		}
+	}
+	var publications corev1alpha1.PublicationList
+	if err := o.Reader.List(ctx, &publications, listOptions...); err != nil {
+		return snapshot, fmt.Errorf("list Publications for upgrade drain: %w", err)
+	}
+	for i := range publications.Items {
+		if !store.IsTerminalPublicationState(store.PublicationState(publications.Items[i].Status.State)) {
+			snapshot.NonterminalPublications++
+		}
+	}
+	var effects corev1alpha1.ExternalEffectList
+	if err := o.Reader.List(ctx, &effects, listOptions...); err != nil {
+		return snapshot, fmt.Errorf("list ExternalEffects for upgrade drain: %w", err)
+	}
+	for i := range effects.Items {
+		switch store.ExternalEffectState(effects.Items[i].Status.State) {
+		case store.ExternalEffectSucceeded, store.ExternalEffectFailed, store.ExternalEffectOutcomeUnknown:
+		default:
+			snapshot.NonterminalExternalEffects++
+		}
+	}
+	after, err := o.Outbox.CountUnsettledOutboxProjections(ctx)
+	if err != nil {
+		return snapshot, fmt.Errorf("count unsettled outbox projections after sink observation: %w", err)
+	}
+	if after < 0 {
+		return snapshot, fmt.Errorf("unsettled outbox projection count cannot be negative")
+	}
+	snapshot.UnsettledOutboxProjections = max(before, after)
+	return snapshot, nil
+}
+
+func promptAttemptHasUpgradeDrainWork(attempt *corev1alpha1.PromptAttempt) bool {
+	if attempt == nil {
+		return false
+	}
+	execution := store.PromptExecutionState(attempt.Status.ExecutionState)
+	delivery := store.PromptDeliveryState(attempt.Status.DeliveryState)
+	if execution == store.PromptExecutionQueued && delivery == store.PromptDeliveryNotRequested {
+		return false
+	}
+	return !store.IsTerminalPromptExecutionState(execution) || !store.IsTerminalPromptDeliveryState(delivery)
+}
+
+func runtimeSessionControlHasUpgradeDrainWork(control *corev1alpha1.RuntimeSessionControl) bool {
+	if control == nil {
+		return false
+	}
+	if control.Status.MutationLease != nil {
+		return true
+	}
+	if control.Status.Availability == corev1alpha1.RuntimeSessionControlAvailability(store.SessionAvailable) &&
+		strings.TrimSpace(control.Status.BlockedReason) == "" && control.Status.RelatedPromptAttemptID == "" && control.Status.RelatedPublicationID == "" {
+		return false
+	}
+	switch control.Status.Lifecycle {
+	case corev1alpha1.RuntimeSessionControlLifecycle("Idle"),
+		corev1alpha1.RuntimeSessionControlLifecycle("Poisoned"),
+		corev1alpha1.RuntimeSessionControlLifecycle("Deleted"):
+		return false
+	default:
+		return true
+	}
+}
+
+type ACPUpgradeDrainPhase string
+
+const (
+	ACPUpgradeDrainReady     ACPUpgradeDrainPhase = "Ready"
+	ACPUpgradeDrainDraining  ACPUpgradeDrainPhase = "Draining"
+	ACPUpgradeDrainCompleted ACPUpgradeDrainPhase = "Completed"
+	ACPUpgradeDrainTimedOut  ACPUpgradeDrainPhase = "TimedOut"
+	ACPUpgradeDrainFailed    ACPUpgradeDrainPhase = "Failed"
+)
+
+// ACPUpgradeDrainSnapshot combines exact RuntimePool and durable-store barriers.
+type ACPUpgradeDrainSnapshot struct {
+	ObservedPools              int                            `json:"observedPools"`
+	PoolsAwaitingQuiescence    int                            `json:"poolsAwaitingQuiescence"`
+	QueuedTasks                int64                          `json:"queuedTasks"`
+	ReservedSessions           int64                          `json:"reservedSessions"`
+	ReservedPrompts            int64                          `json:"reservedPrompts"`
+	ReservationRecords         int64                          `json:"reservationRecords"`
+	RunningPrompts             int64                          `json:"runningPrompts"`
+	ResidentSessions           int64                          `json:"residentSessions"`
+	FinalizingSessions         int64                          `json:"finalizingSessions"`
+	PendingPermissions         int64                          `json:"pendingPermissions"`
+	LiveDescendants            int64                          `json:"liveDescendants"`
+	QueuedSupervisorAdmissions int64                          `json:"queuedSupervisorAdmissions"`
+	Barriers                   ACPUpgradeDrainBarrierSnapshot `json:"barriers"`
+}
+
+func (s ACPUpgradeDrainSnapshot) Quiescent() bool {
+	// Durable Queued+NotRequested attempts are safe to resume under the next
+	// controller epoch. QueuedTasks remains diagnostic, while finalization is
+	// fenced by the authoritative PromptAttempt, SessionControl, Publication,
+	// ExternalEffect, and outbox barriers instead of a potentially stale pool
+	// summary after dispatcher admission closes.
+	return s.PoolsAwaitingQuiescence == 0 &&
+		s.ReservedSessions == 0 && s.ReservedPrompts == 0 && s.ReservationRecords == 0 &&
+		s.RunningPrompts == 0 && s.ResidentSessions == 0 &&
+		s.PendingPermissions == 0 &&
+		s.LiveDescendants == 0 && s.QueuedSupervisorAdmissions == 0 &&
+		s.Barriers.Quiescent()
+}
+
+// ACPUpgradeDrainStatus is safe to expose through readiness and diagnostics.
+type ACPUpgradeDrainStatus struct {
+	Phase           ACPUpgradeDrainPhase    `json:"phase"`
+	ControllerEpoch int64                   `json:"controllerEpoch,omitempty"`
+	TriggeredAt     *time.Time              `json:"triggeredAt,omitempty"`
+	Deadline        *time.Time              `json:"deadline,omitempty"`
+	CompletedAt     *time.Time              `json:"completedAt,omitempty"`
+	LastError       string                  `json:"lastError,omitempty"`
+	Snapshot        ACPUpgradeDrainSnapshot `json:"snapshot"`
+}
+
+type ACPUpgradeDrainMarkerState string
+
+const (
+	ACPUpgradeDrainMarkerIntent    ACPUpgradeDrainMarkerState = "Intent"
+	ACPUpgradeDrainMarkerCompleted ACPUpgradeDrainMarkerState = "Completed"
+	ACPUpgradeDrainMarkerTimedOut  ACPUpgradeDrainMarkerState = "TimedOut"
+)
+
+// ACPUpgradeDrainMarker is the durable proof used by the next leader. Only a
+// Completed marker for the exact previous epoch permits planned-takeover
+// recovery; missing, Intent, TimedOut, malformed, or stale markers are
+// deliberately classified as unplanned takeover.
+type ACPUpgradeDrainMarker struct {
+	Version             string                     `json:"version"`
+	State               ACPUpgradeDrainMarkerState `json:"state"`
+	ControllerEpochName string                     `json:"controllerEpochName"`
+	ControllerEpoch     int64                      `json:"controllerEpoch"`
+	HolderID            string                     `json:"holderID"`
+	StartedAt           time.Time                  `json:"startedAt"`
+	Deadline            time.Time                  `json:"deadline"`
+	CompletedAt         *time.Time                 `json:"completedAt,omitempty"`
+	TimedOutAt          *time.Time                 `json:"timedOutAt,omitempty"`
+	LastError           string                     `json:"lastError,omitempty"`
+	Snapshot            ACPUpgradeDrainSnapshot    `json:"snapshot"`
+}
+
+// ACPUpgradeDrainCoordinator runs only on the elected leader. It exposes a
+// loopback trigger for a same-binary preStop child and retains leadership while
+// RuntimePools and durable finalization barriers settle.
+type ACPUpgradeDrainCoordinator struct {
+	Client           client.Client
+	APIReader        client.Reader
+	Epochs           ACPUpgradeDrainEpochSource
+	EpochStore       store.ControllerEpochStore
+	AdmissionGate    *ACPAdmissionGate
+	Barriers         ACPUpgradeDrainBarrierObserver
+	SupervisorClient RuntimePoolSupervisorClient
+	HTTPClient       *http.Client
+	Options          ACPUpgradeDrainOptions
+	Now              func() time.Time
+
+	initOnce sync.Once
+	initErr  error
+
+	triggerOnce sync.Once
+	done        chan struct{}
+	resultMu    sync.RWMutex
+	result      error
+
+	lifecycleMu  sync.RWMutex
+	lifecycleCtx context.Context
+
+	statusMu sync.RWMutex
+	status   ACPUpgradeDrainStatus
+}
+
+func NewACPUpgradeDrainCoordinator(
+	kubeClient client.Client,
+	reader client.Reader,
+	epochs ACPUpgradeDrainEpochSource,
+	epochStore store.ControllerEpochStore,
+	barriers ACPUpgradeDrainBarrierObserver,
+	gate *ACPAdmissionGate,
+	options ACPUpgradeDrainOptions,
+) *ACPUpgradeDrainCoordinator {
+	if gate == nil {
+		gate = NewACPAdmissionGate()
+	}
+	return &ACPUpgradeDrainCoordinator{
+		Client: kubeClient, APIReader: reader, Epochs: epochs, EpochStore: epochStore,
+		Barriers: barriers, AdmissionGate: gate, Options: options,
+		done: make(chan struct{}), status: ACPUpgradeDrainStatus{Phase: ACPUpgradeDrainReady},
+	}
+}
+
+func (c *ACPUpgradeDrainCoordinator) NeedLeaderElection() bool { return true }
+
+func (c *ACPUpgradeDrainCoordinator) Start(ctx context.Context) error {
+	if err := c.initialize(); err != nil {
+		return err
+	}
+	c.lifecycleMu.Lock()
+	c.lifecycleCtx = ctx
+	c.lifecycleMu.Unlock()
+
+	listener, err := net.Listen("tcp", c.Options.BindAddress)
+	if err != nil {
+		return fmt.Errorf("listen for ACP upgrade drain trigger: %w", err)
+	}
+	server := &http.Server{
+		Handler:           c.Handler(),
+		ReadHeaderTimeout: 5 * time.Second,
+		ReadTimeout:       c.Options.TriggerTimeout,
+		WriteTimeout:      c.Options.TriggerTimeout,
+		IdleTimeout:       30 * time.Second,
+	}
+	go func() {
+		<-ctx.Done()
+		shutdownCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		_ = server.Shutdown(shutdownCtx)
+	}()
+	log.FromContext(ctx).Info("serving loopback ACP planned-upgrade drain trigger", "address", c.Options.BindAddress, "path", DefaultACPUpgradeDrainPath)
+	if err := server.Serve(listener); err != nil && !errors.Is(err, http.ErrServerClosed) {
+		return fmt.Errorf("serve ACP upgrade drain trigger: %w", err)
+	}
+	return nil
+}
+
+func (c *ACPUpgradeDrainCoordinator) Handler() http.Handler {
+	mux := http.NewServeMux()
+	mux.HandleFunc(DefaultACPUpgradeDrainPath, c.handleTrigger)
+	return mux
+}
+
+func (c *ACPUpgradeDrainCoordinator) handleTrigger(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet && r.Method != http.MethodPost {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	if err := c.initialize(); err != nil {
+		http.Error(w, "ACP upgrade drain is not configured", http.StatusServiceUnavailable)
+		return
+	}
+	parent := c.currentLifecycleContext()
+	c.startDrain(parent)
+	if err := c.wait(r.Context()); err != nil {
+		writeACPUpgradeDrainHTTPStatus(w, http.StatusServiceUnavailable, c.Status())
+		return
+	}
+	writeACPUpgradeDrainHTTPStatus(w, http.StatusOK, c.Status())
+}
+
+func writeACPUpgradeDrainHTTPStatus(w http.ResponseWriter, statusCode int, status ACPUpgradeDrainStatus) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(statusCode)
+	_ = json.NewEncoder(w).Encode(status)
+}
+
+// Trigger starts the same drain path used by the preStop endpoint and waits for
+// completion, timeout, epoch loss, or caller cancellation.
+func (c *ACPUpgradeDrainCoordinator) Trigger(ctx context.Context) error {
+	if err := c.initialize(); err != nil {
+		return err
+	}
+	c.startDrain(ctx)
+	return c.wait(ctx)
+}
+
+func (c *ACPUpgradeDrainCoordinator) startDrain(parent context.Context) {
+	if parent == nil {
+		parent = context.Background()
+	}
+	c.triggerOnce.Do(func() {
+		go func() {
+			err := c.runDrain(parent)
+			c.resultMu.Lock()
+			c.result = err
+			c.resultMu.Unlock()
+			close(c.done)
+		}()
+	})
+}
+
+func (c *ACPUpgradeDrainCoordinator) wait(ctx context.Context) error {
+	select {
+	case <-c.done:
+		c.resultMu.RLock()
+		defer c.resultMu.RUnlock()
+		return c.result
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}
+
+func (c *ACPUpgradeDrainCoordinator) Status() ACPUpgradeDrainStatus {
+	if c == nil {
+		return ACPUpgradeDrainStatus{Phase: ACPUpgradeDrainFailed, LastError: "ACP upgrade drain coordinator is nil"}
+	}
+	c.statusMu.RLock()
+	defer c.statusMu.RUnlock()
+	return c.status
+}
+
+func (c *ACPUpgradeDrainCoordinator) ReadyzChecker() healthz.Checker {
+	return func(_ *http.Request) error {
+		status := c.Status()
+		if status.Phase == ACPUpgradeDrainReady {
+			return nil
+		}
+		if status.LastError != "" {
+			return fmt.Errorf("ACP upgrade drain is %s: %s", status.Phase, status.LastError)
+		}
+		return fmt.Errorf("ACP upgrade drain is %s", status.Phase)
+	}
+}
+
+func (c *ACPUpgradeDrainCoordinator) runDrain(parent context.Context) error {
+	fence, err := c.Epochs.CurrentFence(parent)
+	if err != nil {
+		c.failStatus(err)
+		return fmt.Errorf("get controller epoch for ACP upgrade drain: %w", err)
+	}
+	if err := c.requireCurrentEpoch(parent, fence); err != nil {
+		c.failStatus(err)
+		return err
+	}
+	now := c.now()
+	c.setDrainingStatus(fence, now, now.Add(c.Options.Timeout), ACPUpgradeDrainSnapshot{}, "")
+	c.AdmissionGate.Close("planned controller upgrade drain", now)
+	marker, err := c.persistIntent(parent, fence, now)
+	if err != nil {
+		c.failStatus(err)
+		return err
+	}
+	if marker.State == ACPUpgradeDrainMarkerCompleted {
+		c.completeStatus(fence, marker.Snapshot, marker.CompletedAt)
+		return nil
+	}
+	deadline := marker.Deadline
+	c.setDrainingStatus(fence, marker.StartedAt, deadline, ACPUpgradeDrainSnapshot{}, "")
+	if !deadline.After(now) {
+		return c.finishTimedOut(fence, marker, ACPUpgradeDrainSnapshot{}, fmt.Errorf("persisted planned-upgrade drain deadline already expired"))
+	}
+	drainCtx, cancel := context.WithDeadline(parent, deadline)
+	defer cancel()
+
+	ticker := time.NewTicker(c.Options.PollInterval)
+	defer ticker.Stop()
+	var lastSnapshot ACPUpgradeDrainSnapshot
+	var lastErr error
+	stableQuiescentPasses := 0
+	for {
+		if err := c.requireCurrentEpoch(drainCtx, fence); err != nil {
+			c.failStatus(err)
+			return err
+		}
+		snapshot, observeErr := c.reconcileDrainPass(drainCtx, fence)
+		lastSnapshot = snapshot
+		lastErr = observeErr
+		lastErrorText := ""
+		if observeErr != nil {
+			lastErrorText = sanitizeRuntimePoolMessage(observeErr.Error())
+		}
+		c.setDrainingStatus(fence, marker.StartedAt, deadline, snapshot, lastErrorText)
+		if observeErr == nil && snapshot.Quiescent() {
+			stableQuiescentPasses++
+			if stableQuiescentPasses >= 2 {
+				if err := c.requireCurrentEpoch(drainCtx, fence); err != nil {
+					c.failStatus(err)
+					return err
+				}
+				completedAt := c.now()
+				if err := c.persistTerminalMarker(drainCtx, marker, ACPUpgradeDrainMarkerCompleted, snapshot, completedAt, ""); err != nil {
+					c.failStatus(err)
+					return err
+				}
+				c.completeStatus(fence, snapshot, &completedAt)
+				return nil
+			}
+		} else {
+			stableQuiescentPasses = 0
+		}
+		select {
+		case <-drainCtx.Done():
+			if errors.Is(drainCtx.Err(), context.DeadlineExceeded) {
+				return c.finishTimedOut(fence, marker, lastSnapshot, lastErr)
+			}
+			c.failStatus(drainCtx.Err())
+			return drainCtx.Err()
+		case <-ticker.C:
+		}
+	}
+}
+
+func (c *ACPUpgradeDrainCoordinator) reconcileDrainPass(ctx context.Context, fence store.ControllerEpochFence) (ACPUpgradeDrainSnapshot, error) {
+	var pools corev1alpha1.RuntimePoolList
+	listOptions := []client.ListOption{client.MatchingLabels(c.Options.RuntimePoolLabels)}
+	if strings.TrimSpace(c.Options.WatchNamespace) != "" {
+		listOptions = append(listOptions, client.InNamespace(strings.TrimSpace(c.Options.WatchNamespace)))
+	}
+	if err := c.APIReader.List(ctx, &pools, listOptions...); err != nil {
+		return ACPUpgradeDrainSnapshot{}, fmt.Errorf("list owned RuntimePools for planned drain: %w", err)
+	}
+	snapshot := ACPUpgradeDrainSnapshot{ObservedPools: len(pools.Items)}
+	var errs []error
+	for i := range pools.Items {
+		pool := pools.Items[i].DeepCopy()
+		if pool.Status.ControllerEpoch > 0 && pool.Status.ControllerEpoch != fence.Epoch {
+			snapshot.PoolsAwaitingQuiescence++
+			errs = append(errs, fmt.Errorf("RuntimePool %s/%s belongs to controller epoch %d, not draining epoch %d", pool.Namespace, pool.Name, pool.Status.ControllerEpoch, fence.Epoch))
+			continue
+		}
+		if pool.Status.ActiveInstance != nil && pool.Status.ActiveInstance.ControllerEpoch != fence.Epoch {
+			snapshot.PoolsAwaitingQuiescence++
+			errs = append(errs, fmt.Errorf("RuntimePool %s/%s active instance belongs to controller epoch %d, not draining epoch %d", pool.Namespace, pool.Name, pool.Status.ActiveInstance.ControllerEpoch, fence.Epoch))
+			continue
+		}
+		if err := c.setRuntimePoolDesiredReplicasZero(ctx, types.NamespacedName{Namespace: pool.Namespace, Name: pool.Name}); err != nil {
+			errs = append(errs, err)
+		}
+		if err := c.closeRuntimePoolAdmission(ctx, types.NamespacedName{Namespace: pool.Namespace, Name: pool.Name}); err != nil {
+			errs = append(errs, err)
+		}
+		latest := &corev1alpha1.RuntimePool{}
+		if err := c.APIReader.Get(ctx, types.NamespacedName{Namespace: pool.Namespace, Name: pool.Name}, latest); err != nil {
+			if !apierrors.IsNotFound(err) {
+				errs = append(errs, fmt.Errorf("refresh RuntimePool %s/%s: %w", pool.Namespace, pool.Name, err))
+			}
+			continue
+		}
+		c.addControllerPoolCapacity(&snapshot, latest)
+		if err := c.observeAndDrainRuntimePool(ctx, fence, latest, &snapshot); err != nil {
+			snapshot.PoolsAwaitingQuiescence++
+			errs = append(errs, fmt.Errorf("RuntimePool %s/%s: %w", latest.Namespace, latest.Name, err))
+		}
+	}
+	barriers, err := c.Barriers.ObserveACPUpgradeDrainBarriers(ctx)
+	if err != nil {
+		errs = append(errs, err)
+	} else {
+		snapshot.Barriers = barriers
+	}
+	return snapshot, errors.Join(errs...)
+}
+
+func (c *ACPUpgradeDrainCoordinator) addControllerPoolCapacity(snapshot *ACPUpgradeDrainSnapshot, pool *corev1alpha1.RuntimePool) {
+	if snapshot == nil || pool == nil {
+		return
+	}
+	capacity := pool.Status.Capacity
+	snapshot.QueuedTasks += int64(capacity.QueuedTasks)
+	snapshot.ReservedSessions += int64(capacity.ReservedSessions)
+	snapshot.ReservedPrompts += int64(capacity.ReservedPrompts)
+	snapshot.ReservationRecords += int64(len(capacity.Reservations))
+	snapshot.FinalizingSessions += int64(capacity.FinalizingSessions)
+}
+
+func (c *ACPUpgradeDrainCoordinator) observeAndDrainRuntimePool(
+	ctx context.Context,
+	fence store.ControllerEpochFence,
+	pool *corev1alpha1.RuntimePool,
+	snapshot *ACPUpgradeDrainSnapshot,
+) error {
+	if pool == nil {
+		return nil
+	}
+	active := pool.Status.ActiveInstance
+	pods, err := c.listRuntimePoolPodsForUpgradeDrain(ctx, pool, active)
+	if err != nil {
+		return err
+	}
+	if active == nil {
+		if len(pods) == 0 {
+			return nil
+		}
+		return fmt.Errorf("has %d live runtime Pods but no authenticated active instance", len(pods))
+	}
+	if active.ControllerEpoch != fence.Epoch || pool.Status.ControllerEpoch != fence.Epoch {
+		return fmt.Errorf("active instance is fenced to controller epoch %d instead of %d", active.ControllerEpoch, fence.Epoch)
+	}
+	var pod *corev1.Pod
+	for i := range pods {
+		candidate := &pods[i]
+		if candidate.Name == active.PodName && string(candidate.UID) == active.PodUID {
+			pod = candidate
+			break
+		}
+	}
+	if pod == nil {
+		if len(pods) == 0 {
+			return nil
+		}
+		return fmt.Errorf("exact runtime Pod is absent while %d other owned Pods remain", len(pods))
+	}
+	if len(pods) != 1 {
+		return fmt.Errorf("found %d live owned runtime Pods during planned drain", len(pods))
+	}
+	auth, err := c.runtimePoolAuthSecret(ctx, pool, active, fence.Epoch)
+	if err != nil {
+		return err
+	}
+	supervisor := c.supervisorClient()
+	probe, err := supervisor.Probe(ctx, runtimePoolPodEndpoint(pod), string(auth.Data[runtimePoolControllerTokenKey]))
+	if err != nil {
+		return fmt.Errorf("authenticated supervisor probe failed: %w", err)
+	}
+	cfg, err := upgradeDrainRuntimePoolConfig(pool, fence.Epoch)
+	if err != nil {
+		return err
+	}
+	observed, err := validateRuntimePoolProbe(pool, cfg, pod, probe, c.now())
+	if err != nil {
+		return fmt.Errorf("validate authenticated supervisor probe: %w", err)
+	}
+	if observed.RuntimeInstanceID != active.RuntimeInstanceID || observed.BootID != active.BootID {
+		return fmt.Errorf("authenticated supervisor identity changed during planned drain")
+	}
+	addSupervisorPressure(snapshot, probe.Status)
+	if !probe.Status.Drain.Requested {
+		if err := supervisor.RequestDrain(
+			ctx,
+			runtimePoolPodEndpoint(pod),
+			string(auth.Data[runtimePoolControllerTokenKey]),
+			auth.Data[runtimePoolCapabilitySecretKey],
+			probe.Status,
+			"planned_controller_upgrade",
+		); err != nil {
+			return fmt.Errorf("request authenticated supervisor drain: %w", err)
+		}
+		return fmt.Errorf("authenticated drain requested; awaiting a subsequent quiescent observation")
+	}
+	if !upgradeDrainSupervisorIsQuiescent(probe.Status) {
+		return fmt.Errorf("authenticated supervisor is still draining")
+	}
+	return nil
+}
+
+func (c *ACPUpgradeDrainCoordinator) listRuntimePoolPodsForUpgradeDrain(
+	ctx context.Context,
+	pool *corev1alpha1.RuntimePool,
+	active *corev1alpha1.RuntimePoolActiveInstanceStatus,
+) ([]corev1.Pod, error) {
+	namespace := strings.TrimSpace(pool.Spec.RuntimeNamespace)
+	if namespace == "" {
+		namespace = pool.Namespace
+	}
+	if active != nil && strings.TrimSpace(active.PodNamespace) != "" {
+		namespace = strings.TrimSpace(active.PodNamespace)
+	}
+	var listed corev1.PodList
+	if err := c.APIReader.List(
+		ctx,
+		&listed,
+		client.InNamespace(namespace),
+		client.MatchingLabels{
+			runtimePoolKeyLabel: runtimePoolKey(pool.Namespace, pool.Name),
+			runtimePoolUIDLabel: string(pool.UID),
+		},
+	); err != nil {
+		return nil, fmt.Errorf("list owned runtime Pods: %w", err)
+	}
+	pods := make([]corev1.Pod, 0, len(listed.Items))
+	for i := range listed.Items {
+		if listed.Items[i].Status.Phase == corev1.PodSucceeded || listed.Items[i].Status.Phase == corev1.PodFailed {
+			continue
+		}
+		pods = append(pods, listed.Items[i])
+	}
+	return pods, nil
+}
+
+func addSupervisorPressure(snapshot *ACPUpgradeDrainSnapshot, status harnessv2.StatusResponse) {
+	if snapshot == nil {
+		return
+	}
+	snapshot.ResidentSessions += int64(status.Pressure.ResidentSessions)
+	snapshot.RunningPrompts += int64(status.Pressure.ActivePrompts)
+	snapshot.QueuedSupervisorAdmissions += int64(status.Pressure.QueuedAdmissions)
+	snapshot.PendingPermissions += int64(status.Pressure.PendingPermissions)
+	snapshot.LiveDescendants += int64(status.Pressure.LiveDescendants)
+}
+
+func upgradeDrainSupervisorIsQuiescent(status harnessv2.StatusResponse) bool {
+	return status.Drain.Requested && !status.Drain.AcceptingNewSessions &&
+		status.Pressure.ResidentSessions == 0 && status.Pressure.ActivePrompts == 0 &&
+		status.Pressure.QueuedAdmissions == 0 && status.Pressure.PendingPermissions == 0 &&
+		status.Pressure.LiveDescendants == 0 && len(status.Sessions) == 0 &&
+		len(status.ActivePrompts) == 0 && len(status.PendingPermissions) == 0
+}
+
+func upgradeDrainRuntimePoolConfig(pool *corev1alpha1.RuntimePool, epoch int64) (runtimePoolConfig, error) {
+	profile, protocol, err := validateRuntimePoolProfile(pool)
+	if err != nil {
+		return runtimePoolConfig{}, err
+	}
+	maxSessions, maxPrompts, err := runtimePoolCapacity(pool)
+	if err != nil {
+		return runtimePoolConfig{}, err
+	}
+	return runtimePoolConfig{
+		controllerEpoch: epoch, protocol: protocol, profile: profile,
+		maxResidentSessions: maxSessions, maxRunningPrompts: maxPrompts,
+	}, nil
+}
+
+func (c *ACPUpgradeDrainCoordinator) runtimePoolAuthSecret(
+	ctx context.Context,
+	pool *corev1alpha1.RuntimePool,
+	active *corev1alpha1.RuntimePoolActiveInstanceStatus,
+	epoch int64,
+) (*corev1.Secret, error) {
+	name := runtimePoolChildName(runtimePoolResourceName(pool.Namespace, pool.Name), "auth-e"+strconv.FormatInt(epoch, 10))
+	secret := &corev1.Secret{}
+	if err := c.APIReader.Get(ctx, types.NamespacedName{Namespace: active.PodNamespace, Name: name}, secret); err != nil {
+		return nil, fmt.Errorf("get RuntimePool auth Secret: %w", err)
+	}
+	if strings.TrimSpace(string(secret.Data[runtimePoolControllerTokenKey])) == "" || len(secret.Data[runtimePoolCapabilitySecretKey]) == 0 {
+		return nil, fmt.Errorf("RuntimePool auth Secret is missing controller credentials")
+	}
+	return secret, nil
+}
+
+func (c *ACPUpgradeDrainCoordinator) supervisorClient() RuntimePoolSupervisorClient {
+	reconciler := &RuntimePoolReconciler{SupervisorClient: c.SupervisorClient, HTTPClient: c.HTTPClient, Now: c.Now}
+	return reconciler.supervisorClient()
+}
+
+func (c *ACPUpgradeDrainCoordinator) setRuntimePoolDesiredReplicasZero(ctx context.Context, key types.NamespacedName) error {
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		pool := &corev1alpha1.RuntimePool{}
+		if err := c.Client.Get(ctx, key, pool); err != nil {
+			return client.IgnoreNotFound(err)
+		}
+		if pool.Spec.DesiredReplicas == 0 || !pool.DeletionTimestamp.IsZero() {
+			return nil
+		}
+		base := pool.DeepCopy()
+		pool.Spec.DesiredReplicas = 0
+		if err := c.Client.Patch(ctx, pool, client.MergeFrom(base)); err != nil {
+			return fmt.Errorf("set RuntimePool desired replicas to zero: %w", err)
+		}
+		return nil
+	})
+}
+
+func (c *ACPUpgradeDrainCoordinator) closeRuntimePoolAdmission(ctx context.Context, key types.NamespacedName) error {
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		pool := &corev1alpha1.RuntimePool{}
+		if err := c.Client.Get(ctx, key, pool); err != nil {
+			return client.IgnoreNotFound(err)
+		}
+		before := pool.Status.DeepCopy()
+		if pool.Status.CurrentReplicas == 0 || pool.Status.Lifecycle == corev1alpha1.RuntimePoolLifecycleStopped {
+			pool.Status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+		} else {
+			pool.Status.AdmissionState = corev1alpha1.RuntimePoolAdmissionDraining
+		}
+		pool.Status.Message = "planned controller upgrade drain has closed ACP admission"
+		meta.SetStatusCondition(&pool.Status.Conditions, metav1.Condition{
+			Type: corev1alpha1.RuntimePoolConditionAdmissionReady, Status: metav1.ConditionFalse,
+			Reason: "ControllerUpgradeDraining", Message: pool.Status.Message,
+			ObservedGeneration: pool.Generation,
+		})
+		if reflect.DeepEqual(*before, pool.Status) {
+			return nil
+		}
+		if err := c.Client.Status().Update(ctx, pool); err != nil {
+			return fmt.Errorf("close RuntimePool admission: %w", err)
+		}
+		return nil
+	})
+}
+
+func (c *ACPUpgradeDrainCoordinator) finishTimedOut(
+	fence store.ControllerEpochFence,
+	marker ACPUpgradeDrainMarker,
+	snapshot ACPUpgradeDrainSnapshot,
+	lastErr error,
+) error {
+	reason := "ACP planned-upgrade barriers did not settle before the configured deadline"
+	if lastErr != nil {
+		reason += ": " + sanitizeRuntimePoolMessage(lastErr.Error())
+	}
+	now := c.now()
+	markerErr := error(nil)
+	markerCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	if err := c.requireCurrentEpoch(markerCtx, fence); err == nil {
+		markerErr = c.persistTerminalMarker(markerCtx, marker, ACPUpgradeDrainMarkerTimedOut, snapshot, now, reason)
+	}
+	if markerErr != nil {
+		reason += "; failed to persist timeout marker: " + sanitizeRuntimePoolMessage(markerErr.Error())
+	}
+	c.setTerminalStatus(ACPUpgradeDrainTimedOut, fence, snapshot, nil, reason)
+	return fmt.Errorf("%w: %s", ErrACPUpgradeDrainTimedOut, reason)
+}
+
+func (c *ACPUpgradeDrainCoordinator) persistIntent(
+	ctx context.Context,
+	fence store.ControllerEpochFence,
+	startedAt time.Time,
+) (ACPUpgradeDrainMarker, error) {
+	desired := ACPUpgradeDrainMarker{
+		Version: "v1", State: ACPUpgradeDrainMarkerIntent,
+		ControllerEpochName: fence.Name, ControllerEpoch: fence.Epoch, HolderID: fence.HolderID,
+		StartedAt: startedAt.UTC(), Deadline: startedAt.UTC().Add(c.Options.Timeout),
+	}
+	var result ACPUpgradeDrainMarker
+	err := retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		lease, err := c.readControllerEpochLease(ctx, fence.Name)
+		if err != nil {
+			return err
+		}
+		if err := c.requireLeaseFence(ctx, lease, fence); err != nil {
+			return err
+		}
+		existing, present, err := decodeACPUpgradeDrainMarker(lease.Annotations[acpUpgradeDrainMarkerAnnotation])
+		if err != nil {
+			return err
+		}
+		if present && existing.ControllerEpoch == fence.Epoch {
+			if existing.ControllerEpochName != fence.Name || existing.HolderID != fence.HolderID {
+				return fmt.Errorf("ACP upgrade drain marker epoch %d is owned by another controller", fence.Epoch)
+			}
+			switch existing.State {
+			case ACPUpgradeDrainMarkerIntent, ACPUpgradeDrainMarkerCompleted:
+				result = existing
+				return nil
+			case ACPUpgradeDrainMarkerTimedOut:
+				return fmt.Errorf("%w: epoch %d already timed out", ErrACPUpgradeDrainTimedOut, fence.Epoch)
+			default:
+				return fmt.Errorf("unsupported ACP upgrade drain marker state %q", existing.State)
+			}
+		}
+		encoded, err := encodeACPUpgradeDrainMarker(desired)
+		if err != nil {
+			return err
+		}
+		updated := lease.DeepCopy()
+		if updated.Annotations == nil {
+			updated.Annotations = make(map[string]string)
+		}
+		updated.Annotations[acpUpgradeDrainMarkerAnnotation] = encoded
+		if err := c.Client.Update(ctx, updated); err != nil {
+			return err
+		}
+		result = desired
+		return nil
+	})
+	if err != nil {
+		return ACPUpgradeDrainMarker{}, fmt.Errorf("persist ACP upgrade drain intent on controller epoch Lease: %w", err)
+	}
+	return result, nil
+}
+
+func (c *ACPUpgradeDrainCoordinator) persistTerminalMarker(
+	ctx context.Context,
+	intent ACPUpgradeDrainMarker,
+	state ACPUpgradeDrainMarkerState,
+	snapshot ACPUpgradeDrainSnapshot,
+	at time.Time,
+	reason string,
+) error {
+	if state != ACPUpgradeDrainMarkerCompleted && state != ACPUpgradeDrainMarkerTimedOut {
+		return fmt.Errorf("unsupported terminal ACP upgrade drain marker state %q", state)
+	}
+	fence := store.ControllerEpochFence{
+		Name: intent.ControllerEpochName, Epoch: intent.ControllerEpoch, HolderID: intent.HolderID,
+	}
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		lease, err := c.readControllerEpochLease(ctx, fence.Name)
+		if err != nil {
+			return err
+		}
+		if err := c.requireLeaseFence(ctx, lease, fence); err != nil {
+			return err
+		}
+		existing, present, err := decodeACPUpgradeDrainMarker(lease.Annotations[acpUpgradeDrainMarkerAnnotation])
+		if err != nil {
+			return err
+		}
+		if !present || existing.ControllerEpochName != intent.ControllerEpochName || existing.ControllerEpoch != intent.ControllerEpoch ||
+			existing.HolderID != intent.HolderID || existing.State != ACPUpgradeDrainMarkerIntent {
+			return fmt.Errorf("ACP upgrade drain marker no longer matches the active intent")
+		}
+		existing.State = state
+		existing.Snapshot = snapshot
+		existing.LastError = sanitizeRuntimePoolMessage(reason)
+		at = at.UTC()
+		if state == ACPUpgradeDrainMarkerCompleted {
+			existing.CompletedAt = &at
+		} else {
+			existing.TimedOutAt = &at
+		}
+		encoded, err := encodeACPUpgradeDrainMarker(existing)
+		if err != nil {
+			return err
+		}
+		updated := lease.DeepCopy()
+		if updated.Annotations == nil {
+			updated.Annotations = make(map[string]string)
+		}
+		updated.Annotations[acpUpgradeDrainMarkerAnnotation] = encoded
+		return c.Client.Update(ctx, updated)
+	})
+}
+
+func (c *ACPUpgradeDrainCoordinator) requireLeaseFence(
+	ctx context.Context,
+	lease *coordinationv1.Lease,
+	fence store.ControllerEpochFence,
+) error {
+	if lease == nil || lease.Spec.HolderIdentity == nil || strings.TrimSpace(*lease.Spec.HolderIdentity) != fence.HolderID {
+		return fmt.Errorf("%w: controller epoch Lease holder no longer matches %q", ErrACPUpgradeDrainEpochLost, fence.HolderID)
+	}
+	return c.requireCurrentEpoch(ctx, fence)
+}
+
+func (c *ACPUpgradeDrainCoordinator) readControllerEpochLease(
+	ctx context.Context,
+	epochName string,
+) (*coordinationv1.Lease, error) {
+	return readACPUpgradeDrainControllerEpochLease(ctx, c.APIReader, c.Options.MarkerNamespace, epochName)
+}
+
+func readACPUpgradeDrainControllerEpochLease(
+	ctx context.Context,
+	reader client.Reader,
+	namespace, epochName string,
+) (*coordinationv1.Lease, error) {
+	if reader == nil {
+		return nil, fmt.Errorf("kubernetes reader is required")
+	}
+	var epochs corev1alpha1.ControllerEpochList
+	if err := reader.List(ctx, &epochs, client.InNamespace(namespace)); err != nil {
+		return nil, fmt.Errorf("list ControllerEpoch records for planned drain: %w", err)
+	}
+	leaseName := ""
+	for i := range epochs.Items {
+		epoch := &epochs.Items[i]
+		if epoch.Spec.Name != epochName {
+			continue
+		}
+		if leaseName != "" && leaseName != epoch.Status.LeaseName {
+			return nil, fmt.Errorf("multiple ControllerEpoch records resolve logical name %q", epochName)
+		}
+		leaseName = strings.TrimSpace(epoch.Status.LeaseName)
+	}
+	if leaseName == "" {
+		return nil, fmt.Errorf("ControllerEpoch %q has no authoritative Lease", epochName)
+	}
+	lease := &coordinationv1.Lease{}
+	if err := reader.Get(ctx, types.NamespacedName{Namespace: namespace, Name: leaseName}, lease); err != nil {
+		return nil, fmt.Errorf("get authoritative controller epoch Lease: %w", err)
+	}
+	return lease, nil
+}
+
+func encodeACPUpgradeDrainMarker(marker ACPUpgradeDrainMarker) (string, error) {
+	encoded, err := json.Marshal(marker)
+	if err != nil {
+		return "", fmt.Errorf("encode ACP upgrade drain marker: %w", err)
+	}
+	return string(encoded), nil
+}
+
+func decodeACPUpgradeDrainMarker(raw string) (ACPUpgradeDrainMarker, bool, error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return ACPUpgradeDrainMarker{}, false, nil
+	}
+	var marker ACPUpgradeDrainMarker
+	if err := json.Unmarshal([]byte(raw), &marker); err != nil {
+		return marker, true, fmt.Errorf("decode ACP upgrade drain marker: %w", err)
+	}
+	if marker.Version != "v1" || marker.ControllerEpochName == "" || marker.ControllerEpoch < 1 || marker.HolderID == "" || marker.StartedAt.IsZero() || marker.Deadline.IsZero() {
+		return marker, true, fmt.Errorf("ACP upgrade drain marker is incomplete")
+	}
+	switch marker.State {
+	case ACPUpgradeDrainMarkerIntent:
+		if marker.CompletedAt != nil || marker.TimedOutAt != nil {
+			return marker, true, fmt.Errorf("ACP upgrade drain intent marker carries terminal timestamps")
+		}
+	case ACPUpgradeDrainMarkerCompleted:
+		if marker.CompletedAt == nil || marker.TimedOutAt != nil || !marker.Snapshot.Quiescent() {
+			return marker, true, fmt.Errorf("ACP upgrade drain completion marker is invalid")
+		}
+	case ACPUpgradeDrainMarkerTimedOut:
+		if marker.TimedOutAt == nil || marker.CompletedAt != nil {
+			return marker, true, fmt.Errorf("ACP upgrade drain timeout marker is invalid")
+		}
+	default:
+		return marker, true, fmt.Errorf("unsupported ACP upgrade drain marker state %q", marker.State)
+	}
+	return marker, true, nil
+}
+
+// ReadACPUpgradeDrainMarker returns the marker atomically ordered on the
+// authoritative controller-epoch Lease.
+func ReadACPUpgradeDrainMarker(
+	ctx context.Context,
+	reader client.Reader,
+	namespace, epochName string,
+) (ACPUpgradeDrainMarker, error) {
+	lease, err := readACPUpgradeDrainControllerEpochLease(ctx, reader, namespace, epochName)
+	if err != nil {
+		return ACPUpgradeDrainMarker{}, err
+	}
+	marker, present, err := decodeACPUpgradeDrainMarker(lease.Annotations[acpUpgradeDrainMarkerAnnotation])
+	if err != nil {
+		return ACPUpgradeDrainMarker{}, err
+	}
+	if !present {
+		return ACPUpgradeDrainMarker{}, store.ErrNotFound
+	}
+	return marker, nil
+}
+
+// ACPUpgradeDrainCompletedForEpoch is the only planned-takeover predicate. A
+// timeout or merely persisted intent intentionally returns false.
+func ACPUpgradeDrainCompletedForEpoch(
+	ctx context.Context,
+	reader client.Reader,
+	namespace, epochName string,
+	epoch int64,
+) (bool, error) {
+	marker, err := ReadACPUpgradeDrainMarker(ctx, reader, namespace, epochName)
+	if errors.Is(err, store.ErrNotFound) {
+		return false, nil
+	}
+	if err != nil {
+		return false, err
+	}
+	return marker.ControllerEpoch == epoch && marker.State == ACPUpgradeDrainMarkerCompleted, nil
+}
+
+func (c *ACPUpgradeDrainCoordinator) requireCurrentEpoch(ctx context.Context, fence store.ControllerEpochFence) error {
+	current, err := c.EpochStore.GetControllerEpoch(ctx, fence.Name)
+	if err != nil {
+		return fmt.Errorf("read authoritative controller epoch: %w", err)
+	}
+	if current == nil {
+		return fmt.Errorf("read authoritative controller epoch: store returned no record")
+	}
+	if current.Epoch != fence.Epoch || current.HolderID != fence.HolderID {
+		return fmt.Errorf("%w: active epoch is %d held by %q, drain epoch is %d held by %q",
+			ErrACPUpgradeDrainEpochLost, current.Epoch, current.HolderID, fence.Epoch, fence.HolderID)
+	}
+	return nil
+}
+
+func (c *ACPUpgradeDrainCoordinator) initialize() error {
+	if c == nil {
+		return fmt.Errorf("ACP upgrade drain coordinator is nil")
+	}
+	c.initOnce.Do(func() {
+		if c.Client == nil || c.Epochs == nil || c.EpochStore == nil || c.Barriers == nil {
+			c.initErr = fmt.Errorf("ACP upgrade drain coordinator requires Kubernetes client, epoch source, epoch store, and barrier observer")
+			return
+		}
+		if c.APIReader == nil {
+			c.APIReader = c.Client
+		}
+		if c.AdmissionGate == nil {
+			c.AdmissionGate = NewACPAdmissionGate()
+		}
+		defaults := DefaultACPUpgradeDrainOptions()
+		if strings.TrimSpace(c.Options.BindAddress) == "" {
+			c.Options.BindAddress = defaults.BindAddress
+		}
+		if c.Options.Timeout <= 0 {
+			c.Options.Timeout = defaults.Timeout
+		}
+		if c.Options.PollInterval <= 0 {
+			c.Options.PollInterval = defaults.PollInterval
+		}
+		if c.Options.TriggerTimeout <= 0 {
+			c.Options.TriggerTimeout = defaults.TriggerTimeout
+		}
+		labels := cloneStringMap(defaults.RuntimePoolLabels)
+		c.Options.RuntimePoolLabels = mergeStringMap(labels, c.Options.RuntimePoolLabels)
+		if strings.TrimSpace(c.Options.WatchNamespace) == "" {
+			c.initErr = fmt.Errorf("ACP upgrade drain watch namespace is required")
+			return
+		}
+		if observer, ok := c.Barriers.(*KubernetesACPUpgradeDrainBarrierObserver); ok && strings.TrimSpace(observer.Namespace) == "" {
+			observer.Namespace = strings.TrimSpace(c.Options.WatchNamespace)
+		}
+		if c.Options.PollInterval >= c.Options.Timeout {
+			c.initErr = fmt.Errorf("ACP upgrade drain poll interval must be shorter than its timeout")
+			return
+		}
+		if c.Options.TriggerTimeout <= c.Options.Timeout {
+			c.initErr = fmt.Errorf("ACP upgrade drain trigger timeout must exceed its drain timeout")
+			return
+		}
+		if strings.TrimSpace(c.Options.MarkerNamespace) == "" {
+			c.initErr = fmt.Errorf("ACP upgrade drain marker namespace is required")
+			return
+		}
+		if err := validateACPUpgradeDrainBindAddress(c.Options.BindAddress); err != nil {
+			c.initErr = err
+			return
+		}
+		if c.done == nil {
+			c.done = make(chan struct{})
+		}
+		if c.status.Phase == "" {
+			c.status.Phase = ACPUpgradeDrainReady
+		}
+	})
+	return c.initErr
+}
+
+func validateACPUpgradeDrainBindAddress(address string) error {
+	host, port, err := net.SplitHostPort(strings.TrimSpace(address))
+	if err != nil {
+		return fmt.Errorf("ACP upgrade drain bind address is invalid: %w", err)
+	}
+	ip := net.ParseIP(host)
+	if ip == nil || !ip.IsLoopback() {
+		return fmt.Errorf("ACP upgrade drain bind address must use a literal loopback IP")
+	}
+	value, err := strconv.Atoi(port)
+	if err != nil || value < 0 || value > 65535 {
+		return fmt.Errorf("ACP upgrade drain bind port is invalid")
+	}
+	return nil
+}
+
+func (c *ACPUpgradeDrainCoordinator) currentLifecycleContext() context.Context {
+	c.lifecycleMu.RLock()
+	defer c.lifecycleMu.RUnlock()
+	if c.lifecycleCtx != nil {
+		return c.lifecycleCtx
+	}
+	return context.Background()
+}
+
+func (c *ACPUpgradeDrainCoordinator) now() time.Time {
+	if c.Now != nil {
+		return c.Now().UTC()
+	}
+	return time.Now().UTC()
+}
+
+func (c *ACPUpgradeDrainCoordinator) setDrainingStatus(
+	fence store.ControllerEpochFence,
+	triggeredAt, deadline time.Time,
+	snapshot ACPUpgradeDrainSnapshot,
+	lastError string,
+) {
+	triggeredAt = triggeredAt.UTC()
+	deadline = deadline.UTC()
+	c.statusMu.Lock()
+	defer c.statusMu.Unlock()
+	c.status = ACPUpgradeDrainStatus{
+		Phase: ACPUpgradeDrainDraining, ControllerEpoch: fence.Epoch,
+		TriggeredAt: &triggeredAt, Deadline: &deadline,
+		LastError: lastError, Snapshot: snapshot,
+	}
+}
+
+func (c *ACPUpgradeDrainCoordinator) completeStatus(
+	fence store.ControllerEpochFence,
+	snapshot ACPUpgradeDrainSnapshot,
+	completedAt *time.Time,
+) {
+	c.setTerminalStatus(ACPUpgradeDrainCompleted, fence, snapshot, completedAt, "")
+}
+
+func (c *ACPUpgradeDrainCoordinator) setTerminalStatus(
+	phase ACPUpgradeDrainPhase,
+	fence store.ControllerEpochFence,
+	snapshot ACPUpgradeDrainSnapshot,
+	completedAt *time.Time,
+	lastError string,
+) {
+	if completedAt != nil {
+		value := completedAt.UTC()
+		completedAt = &value
+	}
+	c.statusMu.Lock()
+	defer c.statusMu.Unlock()
+	status := c.status
+	status.Phase = phase
+	status.ControllerEpoch = fence.Epoch
+	status.CompletedAt = completedAt
+	status.LastError = lastError
+	status.Snapshot = snapshot
+	c.status = status
+}
+
+func (c *ACPUpgradeDrainCoordinator) failStatus(err error) {
+	message := ""
+	if err != nil {
+		message = sanitizeRuntimePoolMessage(err.Error())
+	}
+	c.statusMu.Lock()
+	defer c.statusMu.Unlock()
+	status := c.status
+	status.Phase = ACPUpgradeDrainFailed
+	status.LastError = message
+	c.status = status
+}
+
+// RunACPUpgradeDrainTriggerMode is the single early-entrypoint hook used by
+// cmd/main.go after flag parsing. It returns handled=true whenever TriggerURL is
+// set, so the preStop child must exit instead of opening the store or starting a
+// second controller manager.
+func RunACPUpgradeDrainTriggerMode(ctx context.Context, options ACPUpgradeDrainOptions) (handled bool, err error) {
+	if strings.TrimSpace(options.TriggerURL) == "" {
+		return false, nil
+	}
+	if options.TriggerTimeout <= 0 {
+		options.TriggerTimeout = DefaultACPUpgradeDrainTriggerTimeout
+	}
+	triggerCtx, cancel := context.WithTimeout(ctx, options.TriggerTimeout)
+	defer cancel()
+	return true, RequestACPUpgradeDrain(triggerCtx, options.TriggerURL)
+}
+
+// RequestACPUpgradeDrain is the distroless-compatible preStop helper. cmd/main
+// invokes it in trigger-only mode from a second /manager process; no shell,
+// curl, wget, Service, or externally reachable drain endpoint is required.
+func RequestACPUpgradeDrain(ctx context.Context, endpoint string) error {
+	parsed, err := url.Parse(strings.TrimSpace(endpoint))
+	if err != nil || parsed.Scheme != urlSchemeHTTP || parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" {
+		return fmt.Errorf("ACP upgrade drain trigger URL is invalid")
+	}
+	host := parsed.Hostname()
+	ip := net.ParseIP(host)
+	if ip == nil || !ip.IsLoopback() || parsed.Path != DefaultACPUpgradeDrainPath {
+		return fmt.Errorf("ACP upgrade drain trigger URL must use the loopback drain endpoint")
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, parsed.String(), nil)
+	if err != nil {
+		return err
+	}
+	httpClient := &http.Client{
+		CheckRedirect: func(_ *http.Request, _ []*http.Request) error { return http.ErrUseLastResponse },
+	}
+	response, err := httpClient.Do(request)
+	if err != nil {
+		return fmt.Errorf("request ACP upgrade drain: %w", err)
+	}
+	defer func() { _ = response.Body.Close() }()
+	body, _ := io.ReadAll(io.LimitReader(response.Body, 64<<10))
+	if response.StatusCode < 200 || response.StatusCode >= 300 {
+		return fmt.Errorf("ACP upgrade drain returned HTTP %d: %s", response.StatusCode, strings.TrimSpace(string(body)))
+	}
+	return nil
+}
diff --git a/internal/controller/acp_upgrade_drain_test.go b/internal/controller/acp_upgrade_drain_test.go
new file mode 100644
index 000000000..7c61ac8b7
--- /dev/null
+++ b/internal/controller/acp_upgrade_drain_test.go
@@ -0,0 +1,858 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package controller
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"flag"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	coordinationv1 "k8s.io/api/coordination/v1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	k8sruntime "k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+func TestACPUpgradeDrainOptionsBindManifestFlags(t *testing.T) {
+	options := DefaultACPUpgradeDrainOptions()
+	flags := flag.NewFlagSet("upgrade-drain", flag.ContinueOnError)
+	options.BindFlags(flags)
+	err := flags.Parse([]string{
+		"--acp-upgrade-drain-bind-address=127.0.0.1:18083",
+		"--acp-upgrade-drain-timeout=4m",
+		"--acp-upgrade-drain-poll-interval=2s",
+		"--acp-upgrade-drain-marker-namespace=orka-system",
+		"--acp-upgrade-drain-trigger-url=http://127.0.0.1:18083/acp/upgrade-drain",
+		"--acp-upgrade-drain-trigger-timeout=4m15s",
+	})
+	if err != nil {
+		t.Fatalf("Parse flags: %v", err)
+	}
+	if handled, err := RunACPUpgradeDrainTriggerMode(context.Background(), ACPUpgradeDrainOptions{}); err != nil || handled {
+		t.Fatalf("empty trigger mode = %t, %v, want unhandled", handled, err)
+	}
+	if options.BindAddress != "127.0.0.1:18083" || options.Timeout != 4*time.Minute ||
+		options.PollInterval != 2*time.Second || options.MarkerNamespace != runtimePoolDefaultControllerNamespace ||
+		options.TriggerTimeout != 4*time.Minute+15*time.Second ||
+		options.TriggerURL != "http://127.0.0.1:18083/acp/upgrade-drain" {
+		t.Fatalf("parsed options = %#v", options)
+	}
+}
+
+func TestACPUpgradeDrainRequiresWatchNamespace(t *testing.T) {
+	scheme := upgradeDrainTestScheme(t)
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).Build()
+	options := testUpgradeDrainOptions()
+	options.WatchNamespace = ""
+	coordinator := NewACPUpgradeDrainCoordinator(
+		kubeClient,
+		kubeClient,
+		fixedUpgradeDrainEpochSource{},
+		&fakeUpgradeDrainEpochStore{},
+		ACPUpgradeDrainBarrierObserverFunc(func(context.Context) (ACPUpgradeDrainBarrierSnapshot, error) {
+			return ACPUpgradeDrainBarrierSnapshot{}, nil
+		}),
+		NewACPAdmissionGate(),
+		options,
+	)
+
+	err := coordinator.initialize()
+	if err == nil || !strings.Contains(err.Error(), "watch namespace is required") {
+		t.Fatalf("initialize() error = %v, want missing watch namespace", err)
+	}
+}
+
+func TestACPUpgradeDrainCoordinatorCompletesExactInstanceDrain(t *testing.T) {
+	scheme := upgradeDrainTestScheme(t)
+	pool, pod, auth, supervisor := upgradeDrainRuntimePoolFixture(t)
+	fence := store.ControllerEpochFence{Name: store.DefaultControllerEpochName, Epoch: 7, HolderID: "controller-7"}
+	epochRecord, epochLease := upgradeDrainEpochObjects(fence)
+	kubeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithStatusSubresource(&corev1alpha1.RuntimePool{}).
+		WithObjects(pool, &pod, auth, epochRecord, epochLease).
+		Build()
+	epochStore := &fakeUpgradeDrainEpochStore{current: store.ControllerEpoch{Name: fence.Name, Epoch: fence.Epoch, HolderID: fence.HolderID}}
+	gate := NewACPAdmissionGate()
+	coordinator := NewACPUpgradeDrainCoordinator(
+		kubeClient,
+		kubeClient,
+		fixedUpgradeDrainEpochSource{fence: fence},
+		epochStore,
+		ACPUpgradeDrainBarrierObserverFunc(func(context.Context) (ACPUpgradeDrainBarrierSnapshot, error) {
+			return ACPUpgradeDrainBarrierSnapshot{}, nil
+		}),
+		gate,
+		testUpgradeDrainOptions(),
+	)
+	coordinator.SupervisorClient = supervisor
+
+	if err := coordinator.ReadyzChecker()(httptest.NewRequest(http.MethodGet, "/readyz", nil)); err != nil {
+		t.Fatalf("readiness before drain = %v, want nil", err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	if err := coordinator.Trigger(ctx); err != nil {
+		t.Fatalf("Trigger() error = %v", err)
+	}
+	if supervisor.drainCallCount() != 1 {
+		t.Fatalf("drain calls = %d, want 1", supervisor.drainCallCount())
+	}
+	if err := gate.Check(); !errors.Is(err, ErrACPAdmissionClosed) {
+		t.Fatalf("admission gate error = %v, want ErrACPAdmissionClosed", err)
+	}
+	if err := coordinator.ReadyzChecker()(httptest.NewRequest(http.MethodGet, "/readyz", nil)); err == nil {
+		t.Fatal("readiness remained true after planned drain began")
+	}
+
+	var current corev1alpha1.RuntimePool
+	if err := kubeClient.Get(ctx, types.NamespacedName{Namespace: pool.Namespace, Name: pool.Name}, &current); err != nil {
+		t.Fatalf("Get RuntimePool: %v", err)
+	}
+	if current.Spec.DesiredReplicas != 0 {
+		t.Fatalf("desiredReplicas = %d, want 0", current.Spec.DesiredReplicas)
+	}
+	if current.Status.AdmissionState == corev1alpha1.RuntimePoolAdmissionAccepting {
+		t.Fatalf("admissionState = %s, want closed or draining", current.Status.AdmissionState)
+	}
+	marker, err := ReadACPUpgradeDrainMarker(ctx, kubeClient, coordinator.Options.MarkerNamespace, fence.Name)
+	if err != nil {
+		t.Fatalf("ReadACPUpgradeDrainMarker: %v", err)
+	}
+	if marker.State != ACPUpgradeDrainMarkerCompleted || marker.CompletedAt == nil || !marker.Snapshot.Quiescent() {
+		t.Fatalf("marker = %#v, want quiescent Completed marker", marker)
+	}
+	completed, err := ACPUpgradeDrainCompletedForEpoch(ctx, kubeClient, coordinator.Options.MarkerNamespace, fence.Name, fence.Epoch)
+	if err != nil || !completed {
+		t.Fatalf("ACPUpgradeDrainCompletedForEpoch() = %t, %v, want true", completed, err)
+	}
+	if completed, err := ACPUpgradeDrainCompletedForEpoch(ctx, kubeClient, coordinator.Options.MarkerNamespace, fence.Name, fence.Epoch-1); err != nil || completed {
+		t.Fatalf("previous unrelated epoch completion = %t, %v, want false", completed, err)
+	}
+}
+
+func TestACPUpgradeDrainRejectsStaleIdentityAndInvalidCredentials(t *testing.T) {
+	tests := []struct {
+		name   string
+		mutate func(*corev1alpha1.RuntimePool, *corev1.Secret)
+	}{
+		{
+			name: "stale runtime instance",
+			mutate: func(pool *corev1alpha1.RuntimePool, _ *corev1.Secret) {
+				pool.Status.ActiveInstance.RuntimeInstanceID = "stale-runtime-instance"
+			},
+		},
+		{
+			name: "invalid controller credential",
+			mutate: func(_ *corev1alpha1.RuntimePool, auth *corev1.Secret) {
+				auth.Data[runtimePoolControllerTokenKey] = []byte("wrong-token")
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			scheme := upgradeDrainTestScheme(t)
+			pool, pod, auth, supervisor := upgradeDrainRuntimePoolFixture(t)
+			tt.mutate(pool, auth)
+			fence := store.ControllerEpochFence{Name: store.DefaultControllerEpochName, Epoch: 7, HolderID: "controller-7"}
+			epochRecord, epochLease := upgradeDrainEpochObjects(fence)
+			kubeClient := fake.NewClientBuilder().
+				WithScheme(scheme).
+				WithStatusSubresource(&corev1alpha1.RuntimePool{}).
+				WithObjects(pool, &pod, auth, epochRecord, epochLease).
+				Build()
+			options := testUpgradeDrainOptions()
+			options.Timeout = 40 * time.Millisecond
+			coordinator := NewACPUpgradeDrainCoordinator(
+				kubeClient,
+				kubeClient,
+				fixedUpgradeDrainEpochSource{fence: fence},
+				&fakeUpgradeDrainEpochStore{current: store.ControllerEpoch{Name: fence.Name, Epoch: fence.Epoch, HolderID: fence.HolderID}},
+				ACPUpgradeDrainBarrierObserverFunc(func(context.Context) (ACPUpgradeDrainBarrierSnapshot, error) {
+					return ACPUpgradeDrainBarrierSnapshot{}, nil
+				}),
+				NewACPAdmissionGate(),
+				options,
+			)
+			coordinator.SupervisorClient = supervisor
+			ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+			defer cancel()
+			if err := coordinator.Trigger(ctx); !errors.Is(err, ErrACPUpgradeDrainTimedOut) {
+				t.Fatalf("Trigger() error = %v, want safe timeout fallback", err)
+			}
+			if supervisor.drainCallCount() != 0 {
+				t.Fatalf("drain calls = %d, want 0 for rejected identity or credential", supervisor.drainCallCount())
+			}
+			marker, err := ReadACPUpgradeDrainMarker(ctx, kubeClient, options.MarkerNamespace, fence.Name)
+			if err != nil {
+				t.Fatalf("ReadACPUpgradeDrainMarker: %v", err)
+			}
+			if marker.State == ACPUpgradeDrainMarkerCompleted {
+				t.Fatal("rejected exact-instance boundary published a Completed marker")
+			}
+		})
+	}
+}
+
+func TestACPUpgradeDrainPreservesQueuedWorkAcrossPlannedHandoff(t *testing.T) {
+	scheme := upgradeDrainTestScheme(t)
+	fence := store.ControllerEpochFence{Name: store.DefaultControllerEpochName, Epoch: 7, HolderID: "controller-7"}
+	epochRecord, epochLease := upgradeDrainEpochObjects(fence)
+	pool := runtimePoolTestObject(1)
+	pool.Status = corev1alpha1.RuntimePoolStatus{
+		ControllerEpoch: fence.Epoch, Lifecycle: corev1alpha1.RuntimePoolLifecycleStopped,
+		AdmissionState: corev1alpha1.RuntimePoolAdmissionClosed,
+		Capacity:       corev1alpha1.RuntimePoolCapacityStatus{QueuedTasks: 2},
+	}
+	attempt := &corev1alpha1.PromptAttempt{
+		ObjectMeta: metav1.ObjectMeta{Name: "queued-attempt", Namespace: pool.Namespace},
+		Status: corev1alpha1.PromptAttemptStatus{
+			ExecutionState: corev1alpha1.PromptAttemptExecutionState(store.PromptExecutionQueued),
+			DeliveryState:  corev1alpha1.PromptAttemptDeliveryState(store.PromptDeliveryNotRequested),
+		},
+	}
+	kubeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithStatusSubresource(&corev1alpha1.RuntimePool{}).
+		WithObjects(pool, attempt, epochRecord, epochLease).
+		Build()
+	options := testUpgradeDrainOptions()
+	options.WatchNamespace = pool.Namespace
+	barriers := &KubernetesACPUpgradeDrainBarrierObserver{
+		Reader: kubeClient, Namespace: pool.Namespace,
+		Outbox: ACPUpgradeDrainOutboxBarrierFunc(func(context.Context) (int64, error) { return 0, nil }),
+	}
+	coordinator := NewACPUpgradeDrainCoordinator(
+		kubeClient,
+		kubeClient,
+		fixedUpgradeDrainEpochSource{fence: fence},
+		&fakeUpgradeDrainEpochStore{current: store.ControllerEpoch{Name: fence.Name, Epoch: fence.Epoch, HolderID: fence.HolderID}},
+		barriers,
+		NewACPAdmissionGate(),
+		options,
+	)
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	if err := coordinator.Trigger(ctx); err != nil {
+		t.Fatalf("Trigger() error = %v", err)
+	}
+	status := coordinator.Status()
+	if status.Phase != ACPUpgradeDrainCompleted || status.Snapshot.QueuedTasks != 2 ||
+		status.Snapshot.Barriers.NonterminalPromptAttempts != 0 {
+		t.Fatalf("status = %#v, want completed handoff preserving two queued Tasks", status)
+	}
+	var currentAttempt corev1alpha1.PromptAttempt
+	if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(attempt), &currentAttempt); err != nil {
+		t.Fatalf("Get queued PromptAttempt: %v", err)
+	}
+	if currentAttempt.Status.ExecutionState != corev1alpha1.PromptAttemptExecutionState(store.PromptExecutionQueued) ||
+		currentAttempt.Status.DeliveryState != corev1alpha1.PromptAttemptDeliveryState(store.PromptDeliveryNotRequested) {
+		t.Fatalf("queued PromptAttempt was mutated: %#v", currentAttempt.Status)
+	}
+}
+
+func TestACPUpgradeDrainDeletingPoolWaitsForLivePodQuiescence(t *testing.T) {
+	scheme := upgradeDrainTestScheme(t)
+	pool, pod, auth, supervisor := upgradeDrainRuntimePoolFixture(t)
+	now := metav1.Now()
+	pool.DeletionTimestamp = &now
+	pool.Finalizers = []string{runtimePoolFinalizer}
+	supervisor.probe.Status.Lifecycle = harnessv2.SupervisorLifecycleDraining
+	supervisor.probe.Status.Drain = harnessv2.DrainStatus{
+		Requested: true, AcceptingNewSessions: false, RequestedAt: time.Now().UTC(), Reason: "delete",
+	}
+	supervisor.probe.Status.Sessions = []harnessv2.RuntimeSessionStatus{{
+		RuntimeSessionID: "runtime-session-1", RuntimeSessionUID: "runtime-session-uid-1",
+		Generation: 1, State: harnessv2.RuntimeSessionStateIdle, LastTransitionAt: time.Now().UTC(),
+	}}
+	supervisor.probe.Status.Pressure.ResidentSessions = 1
+	fence := store.ControllerEpochFence{Name: store.DefaultControllerEpochName, Epoch: 7, HolderID: "controller-7"}
+	epochRecord, epochLease := upgradeDrainEpochObjects(fence)
+	kubeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithStatusSubresource(&corev1alpha1.RuntimePool{}).
+		WithObjects(pool, &pod, auth, epochRecord, epochLease).
+		Build()
+	options := testUpgradeDrainOptions()
+	options.Timeout = 45 * time.Millisecond
+	coordinator := NewACPUpgradeDrainCoordinator(
+		kubeClient,
+		kubeClient,
+		fixedUpgradeDrainEpochSource{fence: fence},
+		&fakeUpgradeDrainEpochStore{current: store.ControllerEpoch{Name: fence.Name, Epoch: fence.Epoch, HolderID: fence.HolderID}},
+		ACPUpgradeDrainBarrierObserverFunc(func(context.Context) (ACPUpgradeDrainBarrierSnapshot, error) {
+			return ACPUpgradeDrainBarrierSnapshot{}, nil
+		}),
+		NewACPAdmissionGate(),
+		options,
+	)
+	coordinator.SupervisorClient = supervisor
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	if err := coordinator.Trigger(ctx); !errors.Is(err, ErrACPUpgradeDrainTimedOut) {
+		t.Fatalf("Trigger() error = %v, want live deleting-pool timeout", err)
+	}
+	if got := coordinator.Status().Snapshot.ResidentSessions; got != 1 {
+		t.Fatalf("resident sessions = %d, want authenticated deleting-pool count 1", got)
+	}
+}
+
+func TestACPUpgradeDrainScopesRuntimePoolsBeforeMutation(t *testing.T) {
+	scheme := upgradeDrainTestScheme(t)
+	fence := store.ControllerEpochFence{Name: store.DefaultControllerEpochName, Epoch: 7, HolderID: "controller-7"}
+	epochRecord, epochLease := upgradeDrainEpochObjects(fence)
+	owned := runtimePoolTestObject(1)
+	owned.Status.ControllerEpoch = fence.Epoch
+	owned.Status.Lifecycle = corev1alpha1.RuntimePoolLifecycleStopped
+	owned.Labels["orka.ai/controller-scope"] = "release-a"
+	foreign := runtimePoolTestObject(1)
+	foreign.Name = "foreign"
+	foreign.Namespace = "tenant-b"
+	foreign.UID = "foreign-uid"
+	foreign.Spec.TrustDomain.Namespace = foreign.Namespace
+	foreign.Status.ControllerEpoch = fence.Epoch
+	foreign.Status.Lifecycle = corev1alpha1.RuntimePoolLifecycleStopped
+	foreign.Labels["orka.ai/controller-scope"] = "release-b"
+	kubeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithStatusSubresource(&corev1alpha1.RuntimePool{}).
+		WithObjects(owned, foreign, epochRecord, epochLease).
+		Build()
+	options := testUpgradeDrainOptions()
+	options.WatchNamespace = owned.Namespace
+	options.RuntimePoolLabels = map[string]string{"orka.ai/controller-scope": "release-a"}
+	coordinator := NewACPUpgradeDrainCoordinator(
+		kubeClient,
+		kubeClient,
+		fixedUpgradeDrainEpochSource{fence: fence},
+		&fakeUpgradeDrainEpochStore{current: store.ControllerEpoch{Name: fence.Name, Epoch: fence.Epoch, HolderID: fence.HolderID}},
+		ACPUpgradeDrainBarrierObserverFunc(func(context.Context) (ACPUpgradeDrainBarrierSnapshot, error) {
+			return ACPUpgradeDrainBarrierSnapshot{}, nil
+		}),
+		NewACPAdmissionGate(),
+		options,
+	)
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	if err := coordinator.Trigger(ctx); err != nil {
+		t.Fatalf("Trigger() error = %v", err)
+	}
+	var gotOwned, gotForeign corev1alpha1.RuntimePool
+	if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(owned), &gotOwned); err != nil {
+		t.Fatalf("Get owned pool: %v", err)
+	}
+	if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(foreign), &gotForeign); err != nil {
+		t.Fatalf("Get foreign pool: %v", err)
+	}
+	if gotOwned.Spec.DesiredReplicas != 0 {
+		t.Fatalf("owned desired replicas = %d, want 0", gotOwned.Spec.DesiredReplicas)
+	}
+	if gotForeign.Spec.DesiredReplicas != 1 {
+		t.Fatalf("foreign desired replicas = %d, want unchanged 1", gotForeign.Spec.DesiredReplicas)
+	}
+}
+
+func TestACPUpgradeDrainRequiresStableQuiescentRecheck(t *testing.T) {
+	scheme := upgradeDrainTestScheme(t)
+	fence := store.ControllerEpochFence{Name: store.DefaultControllerEpochName, Epoch: 31, HolderID: "controller-31"}
+	epochRecord, epochLease := upgradeDrainEpochObjects(fence)
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(epochRecord, epochLease).Build()
+	var mu sync.Mutex
+	calls := 0
+	options := testUpgradeDrainOptions()
+	options.Timeout = 45 * time.Millisecond
+	coordinator := NewACPUpgradeDrainCoordinator(
+		kubeClient,
+		kubeClient,
+		fixedUpgradeDrainEpochSource{fence: fence},
+		&fakeUpgradeDrainEpochStore{current: store.ControllerEpoch{Name: fence.Name, Epoch: fence.Epoch, HolderID: fence.HolderID}},
+		ACPUpgradeDrainBarrierObserverFunc(func(context.Context) (ACPUpgradeDrainBarrierSnapshot, error) {
+			mu.Lock()
+			defer mu.Unlock()
+			calls++
+			if calls == 1 {
+				return ACPUpgradeDrainBarrierSnapshot{}, nil
+			}
+			return ACPUpgradeDrainBarrierSnapshot{UnsettledOutboxProjections: 1}, nil
+		}),
+		NewACPAdmissionGate(),
+		options,
+	)
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	if err := coordinator.Trigger(ctx); !errors.Is(err, ErrACPUpgradeDrainTimedOut) {
+		t.Fatalf("Trigger() error = %v, want timeout after unstable quiescence", err)
+	}
+	marker, err := ReadACPUpgradeDrainMarker(ctx, kubeClient, options.MarkerNamespace, fence.Name)
+	if err != nil {
+		t.Fatalf("ReadACPUpgradeDrainMarker: %v", err)
+	}
+	if marker.State == ACPUpgradeDrainMarkerCompleted {
+		t.Fatal("single transient quiescent pass published completion")
+	}
+}
+
+func TestACPUpgradeDrainCoordinatorTimeoutFallsBackToUnplanned(t *testing.T) {
+	scheme := upgradeDrainTestScheme(t)
+	fence := store.ControllerEpochFence{Name: store.DefaultControllerEpochName, Epoch: 11, HolderID: "controller-11"}
+	epochRecord, epochLease := upgradeDrainEpochObjects(fence)
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(epochRecord, epochLease).Build()
+	epochStore := &fakeUpgradeDrainEpochStore{current: store.ControllerEpoch{Name: fence.Name, Epoch: fence.Epoch, HolderID: fence.HolderID}}
+	options := testUpgradeDrainOptions()
+	options.Timeout = 35 * time.Millisecond
+	options.PollInterval = 5 * time.Millisecond
+	coordinator := NewACPUpgradeDrainCoordinator(
+		kubeClient,
+		kubeClient,
+		fixedUpgradeDrainEpochSource{fence: fence},
+		epochStore,
+		ACPUpgradeDrainBarrierObserverFunc(func(context.Context) (ACPUpgradeDrainBarrierSnapshot, error) {
+			return ACPUpgradeDrainBarrierSnapshot{UnsettledOutboxProjections: 1}, nil
+		}),
+		NewACPAdmissionGate(),
+		options,
+	)
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	err := coordinator.Trigger(ctx)
+	if !errors.Is(err, ErrACPUpgradeDrainTimedOut) {
+		t.Fatalf("Trigger() error = %v, want ErrACPUpgradeDrainTimedOut", err)
+	}
+	status := coordinator.Status()
+	if status.Phase != ACPUpgradeDrainTimedOut || status.Snapshot.Barriers.UnsettledOutboxProjections != 1 {
+		t.Fatalf("status = %#v, want timed out on outbox barrier", status)
+	}
+	marker, err := ReadACPUpgradeDrainMarker(ctx, kubeClient, options.MarkerNamespace, fence.Name)
+	if err != nil {
+		t.Fatalf("ReadACPUpgradeDrainMarker: %v", err)
+	}
+	if marker.State != ACPUpgradeDrainMarkerTimedOut || marker.TimedOutAt == nil || marker.CompletedAt != nil {
+		t.Fatalf("marker = %#v, want TimedOut without completion", marker)
+	}
+	completed, err := ACPUpgradeDrainCompletedForEpoch(ctx, kubeClient, options.MarkerNamespace, fence.Name, fence.Epoch)
+	if err != nil || completed {
+		t.Fatalf("timed-out marker planned predicate = %t, %v, want false", completed, err)
+	}
+}
+
+func TestACPUpgradeDrainCoordinatorEpochLossCannotWriteCompletion(t *testing.T) {
+	scheme := upgradeDrainTestScheme(t)
+	fence := store.ControllerEpochFence{Name: store.DefaultControllerEpochName, Epoch: 19, HolderID: "controller-19"}
+	epochRecord, epochLease := upgradeDrainEpochObjects(fence)
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(epochRecord, epochLease).Build()
+	epochStore := &fakeUpgradeDrainEpochStore{
+		current:   store.ControllerEpoch{Name: fence.Name, Epoch: fence.Epoch, HolderID: fence.HolderID},
+		loseAfter: 2,
+	}
+	coordinator := NewACPUpgradeDrainCoordinator(
+		kubeClient,
+		kubeClient,
+		fixedUpgradeDrainEpochSource{fence: fence},
+		epochStore,
+		ACPUpgradeDrainBarrierObserverFunc(func(context.Context) (ACPUpgradeDrainBarrierSnapshot, error) {
+			return ACPUpgradeDrainBarrierSnapshot{}, nil
+		}),
+		NewACPAdmissionGate(),
+		testUpgradeDrainOptions(),
+	)
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	err := coordinator.Trigger(ctx)
+	if !errors.Is(err, ErrACPUpgradeDrainEpochLost) {
+		t.Fatalf("Trigger() error = %v, want ErrACPUpgradeDrainEpochLost", err)
+	}
+	marker, readErr := ReadACPUpgradeDrainMarker(ctx, kubeClient, coordinator.Options.MarkerNamespace, fence.Name)
+	if readErr != nil {
+		t.Fatalf("ReadACPUpgradeDrainMarker: %v", readErr)
+	}
+	if marker.State != ACPUpgradeDrainMarkerIntent || marker.CompletedAt != nil {
+		t.Fatalf("marker after epoch loss = %#v, want incomplete Intent", marker)
+	}
+}
+
+func TestACPUpgradeDrainCompletionLosesCASWhenEpochTurnsOver(t *testing.T) {
+	scheme := upgradeDrainTestScheme(t)
+	fence := store.ControllerEpochFence{Name: store.DefaultControllerEpochName, Epoch: 29, HolderID: "controller-29"}
+	epochRecord, epochLease := upgradeDrainEpochObjects(fence)
+	baseClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(epochRecord, epochLease).Build()
+	epochStore := &fakeUpgradeDrainEpochStore{current: store.ControllerEpoch{Name: fence.Name, Epoch: fence.Epoch, HolderID: fence.HolderID}}
+	racingClient := &epochTurnoverOnCompletionClient{Client: baseClient, epochStore: epochStore}
+	coordinator := NewACPUpgradeDrainCoordinator(
+		racingClient,
+		baseClient,
+		fixedUpgradeDrainEpochSource{fence: fence},
+		epochStore,
+		ACPUpgradeDrainBarrierObserverFunc(func(context.Context) (ACPUpgradeDrainBarrierSnapshot, error) {
+			return ACPUpgradeDrainBarrierSnapshot{}, nil
+		}),
+		NewACPAdmissionGate(),
+		testUpgradeDrainOptions(),
+	)
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	err := coordinator.Trigger(ctx)
+	if !errors.Is(err, ErrACPUpgradeDrainEpochLost) {
+		t.Fatalf("Trigger() error = %v, want epoch-loss failure", err)
+	}
+	marker, readErr := ReadACPUpgradeDrainMarker(ctx, baseClient, coordinator.Options.MarkerNamespace, fence.Name)
+	if readErr != nil {
+		t.Fatalf("ReadACPUpgradeDrainMarker: %v", readErr)
+	}
+	if marker.State != ACPUpgradeDrainMarkerIntent || marker.CompletedAt != nil {
+		t.Fatalf("marker after epoch turnover = %#v, want incomplete Intent", marker)
+	}
+}
+
+func TestKubernetesACPUpgradeDrainBarrierObserver(t *testing.T) {
+	scheme := upgradeDrainTestScheme(t)
+	objects := []client.Object{
+		&corev1alpha1.PromptAttempt{ObjectMeta: metav1.ObjectMeta{Name: "queued", Namespace: "tenant-a"}, Status: corev1alpha1.PromptAttemptStatus{ExecutionState: corev1alpha1.PromptAttemptExecutionState(store.PromptExecutionQueued), DeliveryState: corev1alpha1.PromptAttemptDeliveryState(store.PromptDeliveryNotRequested)}},
+		&corev1alpha1.PromptAttempt{ObjectMeta: metav1.ObjectMeta{Name: "reserved", Namespace: "tenant-a"}, Status: corev1alpha1.PromptAttemptStatus{ExecutionState: corev1alpha1.PromptAttemptExecutionState(store.PromptExecutionReserved), DeliveryState: corev1alpha1.PromptAttemptDeliveryState(store.PromptDeliveryNotRequested)}},
+		&corev1alpha1.PromptAttempt{ObjectMeta: metav1.ObjectMeta{Name: "running", Namespace: "tenant-a"}, Status: corev1alpha1.PromptAttemptStatus{ExecutionState: corev1alpha1.PromptAttemptExecutionState(store.PromptExecutionRunning), DeliveryState: corev1alpha1.PromptAttemptDeliveryState(store.PromptDeliveryNotRequested)}},
+		&corev1alpha1.PromptAttempt{ObjectMeta: metav1.ObjectMeta{Name: "complete", Namespace: "tenant-a"}, Status: corev1alpha1.PromptAttemptStatus{ExecutionState: corev1alpha1.PromptAttemptExecutionState(store.PromptExecutionSucceeded), DeliveryState: corev1alpha1.PromptAttemptDeliveryState(store.PromptDeliveryReadValidated)}},
+		&corev1alpha1.RuntimeSessionControl{ObjectMeta: metav1.ObjectMeta{Name: "leased", Namespace: "tenant-a"}, Status: corev1alpha1.RuntimeSessionControlStatus{Lifecycle: corev1alpha1.RuntimeSessionControlLifecycle("Idle"), MutationLease: &corev1alpha1.RuntimeSessionMutationLeaseStatus{}}},
+		&corev1alpha1.RuntimeSessionControl{ObjectMeta: metav1.ObjectMeta{Name: "idle", Namespace: "tenant-a"}, Status: corev1alpha1.RuntimeSessionControlStatus{Lifecycle: corev1alpha1.RuntimeSessionControlLifecycle("Idle")}},
+		&corev1alpha1.Publication{ObjectMeta: metav1.ObjectMeta{Name: "preparing", Namespace: "tenant-a"}, Status: corev1alpha1.PublicationStatus{State: corev1alpha1.PublicationControlState(store.PublicationPreparing)}},
+		&corev1alpha1.Publication{ObjectMeta: metav1.ObjectMeta{Name: "verified", Namespace: "tenant-a"}, Status: corev1alpha1.PublicationStatus{State: corev1alpha1.PublicationControlState(store.PublicationVerifiedExact)}},
+		&corev1alpha1.Publication{ObjectMeta: metav1.ObjectMeta{Name: "foreign-preparing", Namespace: "tenant-b"}, Status: corev1alpha1.PublicationStatus{State: corev1alpha1.PublicationControlState(store.PublicationPreparing)}},
+		&corev1alpha1.ExternalEffect{ObjectMeta: metav1.ObjectMeta{Name: "pending", Namespace: "tenant-a"}, Status: corev1alpha1.ExternalEffectStatus{State: corev1alpha1.ExternalEffectControlState(store.ExternalEffectPending)}},
+		&corev1alpha1.ExternalEffect{ObjectMeta: metav1.ObjectMeta{Name: "succeeded", Namespace: "tenant-a"}, Status: corev1alpha1.ExternalEffectStatus{State: corev1alpha1.ExternalEffectControlState(store.ExternalEffectSucceeded)}},
+	}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(objects...).Build()
+	observer := &KubernetesACPUpgradeDrainBarrierObserver{
+		Reader: kubeClient, Namespace: "tenant-a",
+		Outbox: ACPUpgradeDrainOutboxBarrierFunc(func(context.Context) (int64, error) { return 2, nil }),
+	}
+	snapshot, err := observer.ObserveACPUpgradeDrainBarriers(context.Background())
+	if err != nil {
+		t.Fatalf("ObserveACPUpgradeDrainBarriers: %v", err)
+	}
+	if snapshot.UnsettledOutboxProjections != 2 || snapshot.NonterminalPromptAttempts != 2 ||
+		snapshot.ActiveSessionControls != 1 || snapshot.NonterminalPublications != 1 || snapshot.NonterminalExternalEffects != 1 {
+		t.Fatalf("snapshot = %#v, want queued handoff excluded but Reserved and Running attempts blocked", snapshot)
+	}
+	if snapshot.Quiescent() {
+		t.Fatal("non-zero durable barriers reported quiescent")
+	}
+}
+
+func TestKubernetesACPUpgradeDrainBarrierObserverFencesOutboxMigration(t *testing.T) {
+	scheme := upgradeDrainTestScheme(t)
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).Build()
+	counts := []int64{1, 0}
+	var mu sync.Mutex
+	observer := &KubernetesACPUpgradeDrainBarrierObserver{
+		Reader: kubeClient,
+		Outbox: ACPUpgradeDrainOutboxBarrierFunc(func(context.Context) (int64, error) {
+			mu.Lock()
+			defer mu.Unlock()
+			value := counts[0]
+			counts = counts[1:]
+			return value, nil
+		}),
+	}
+	snapshot, err := observer.ObserveACPUpgradeDrainBarriers(context.Background())
+	if err != nil {
+		t.Fatalf("ObserveACPUpgradeDrainBarriers: %v", err)
+	}
+	if snapshot.UnsettledOutboxProjections != 1 || snapshot.Quiescent() {
+		t.Fatalf("snapshot = %#v, want pre-observation outbox work to remain a barrier", snapshot)
+	}
+}
+
+func TestACPUpgradeDrainHandlerSupportsSameBinaryPreStop(t *testing.T) {
+	scheme := upgradeDrainTestScheme(t)
+	fence := store.ControllerEpochFence{Name: store.DefaultControllerEpochName, Epoch: 23, HolderID: "controller-23"}
+	epochRecord, epochLease := upgradeDrainEpochObjects(fence)
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(epochRecord, epochLease).Build()
+	coordinator := NewACPUpgradeDrainCoordinator(
+		kubeClient,
+		kubeClient,
+		fixedUpgradeDrainEpochSource{fence: fence},
+		&fakeUpgradeDrainEpochStore{current: store.ControllerEpoch{Name: fence.Name, Epoch: fence.Epoch, HolderID: fence.HolderID}},
+		ACPUpgradeDrainBarrierObserverFunc(func(context.Context) (ACPUpgradeDrainBarrierSnapshot, error) {
+			return ACPUpgradeDrainBarrierSnapshot{}, nil
+		}),
+		NewACPAdmissionGate(),
+		testUpgradeDrainOptions(),
+	)
+	server := httptest.NewServer(coordinator.Handler())
+	defer server.Close()
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	handled, err := RunACPUpgradeDrainTriggerMode(ctx, ACPUpgradeDrainOptions{
+		TriggerURL: server.URL + DefaultACPUpgradeDrainPath, TriggerTimeout: time.Second,
+	})
+	if err != nil || !handled {
+		t.Fatalf("RunACPUpgradeDrainTriggerMode() = %t, %v, want handled success", handled, err)
+	}
+	if status := coordinator.Status(); status.Phase != ACPUpgradeDrainCompleted {
+		t.Fatalf("status phase = %s, want Completed", status.Phase)
+	}
+}
+
+func TestRequestACPUpgradeDrainUsesLoopbackSameBinaryEndpoint(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet || r.URL.Path != DefaultACPUpgradeDrainPath {
+			t.Fatalf("request = %s %s", r.Method, r.URL.Path)
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	if err := RequestACPUpgradeDrain(ctx, server.URL+DefaultACPUpgradeDrainPath); err != nil {
+		t.Fatalf("RequestACPUpgradeDrain: %v", err)
+	}
+	if err := RequestACPUpgradeDrain(ctx, "http://example.com"+DefaultACPUpgradeDrainPath); err == nil || !strings.Contains(err.Error(), "loopback") {
+		t.Fatalf("non-loopback trigger error = %v, want rejection", err)
+	}
+}
+
+func TestUpgradeDrainSupervisorQuiescenceIsStrict(t *testing.T) {
+	status := harnessv2.StatusResponse{Drain: harnessv2.DrainStatus{Requested: true, AcceptingNewSessions: false}}
+	if !upgradeDrainSupervisorIsQuiescent(status) {
+		t.Fatal("zero authenticated drain status was not quiescent")
+	}
+	status.Pressure.LiveDescendants = 1
+	if upgradeDrainSupervisorIsQuiescent(status) {
+		t.Fatal("live descendant was accepted as quiescent")
+	}
+	status.Pressure.LiveDescendants = 0
+	status.PendingPermissions = []harnessv2.PendingPermissionStatus{{}}
+	if upgradeDrainSupervisorIsQuiescent(status) {
+		t.Fatal("pending permission record was accepted as quiescent")
+	}
+}
+
+func upgradeDrainTestScheme(t *testing.T) *k8sruntime.Scheme {
+	t.Helper()
+	scheme := runtimePoolTestScheme(t)
+	if err := coordinationv1.AddToScheme(scheme); err != nil {
+		t.Fatalf("Add coordination/v1 to scheme: %v", err)
+	}
+	return scheme
+}
+
+func upgradeDrainEpochObjects(fence store.ControllerEpochFence) (*corev1alpha1.ControllerEpoch, *coordinationv1.Lease) {
+	const namespace = runtimePoolDefaultControllerNamespace
+	leaseName := "controller-epoch-authority"
+	holder := fence.HolderID
+	return &corev1alpha1.ControllerEpoch{
+			ObjectMeta: metav1.ObjectMeta{Name: "controller-epoch", Namespace: namespace},
+			Spec:       corev1alpha1.ControllerEpochSpec{Name: fence.Name},
+			Status: corev1alpha1.ControllerEpochStatus{
+				Epoch: fence.Epoch, HolderID: fence.HolderID, LeaseName: leaseName, LeaseResourceVersion: "1",
+			},
+		}, &coordinationv1.Lease{
+			ObjectMeta: metav1.ObjectMeta{Name: leaseName, Namespace: namespace},
+			Spec:       coordinationv1.LeaseSpec{HolderIdentity: &holder},
+		}
+}
+
+func testUpgradeDrainOptions() ACPUpgradeDrainOptions {
+	return ACPUpgradeDrainOptions{
+		BindAddress:     "127.0.0.1:0",
+		Timeout:         500 * time.Millisecond,
+		PollInterval:    5 * time.Millisecond,
+		MarkerNamespace: runtimePoolDefaultControllerNamespace,
+		WatchNamespace:  "tenant-a",
+		TriggerTimeout:  time.Second,
+	}
+}
+
+func upgradeDrainRuntimePoolFixture(t *testing.T) (*corev1alpha1.RuntimePool, corev1.Pod, *corev1.Secret, *fakeUpgradeDrainSupervisor) {
+	t.Helper()
+	pool := runtimePoolTestObject(1)
+	pod := runtimePoolReadyPod(pool, pool.Namespace, "codex-pod", "pod-uid-upgrade", "10.0.0.31")
+	probe := runtimePoolValidProbe(pool, &pod, "boot-upgrade", false)
+	pool.Status = corev1alpha1.RuntimePoolStatus{
+		ObservedGeneration: pool.Generation,
+		ControllerEpoch:    7,
+		DesiredReplicas:    1,
+		CurrentReplicas:    1,
+		Lifecycle:          corev1alpha1.RuntimePoolLifecycleServing,
+		AdmissionState:     corev1alpha1.RuntimePoolAdmissionAccepting,
+		ActiveInstance: &corev1alpha1.RuntimePoolActiveInstanceStatus{
+			PodNamespace: pool.Namespace, PodName: pod.Name, PodAddress: pod.Status.PodIP,
+			PodUID: string(pod.UID), BootID: "boot-upgrade",
+			RuntimeInstanceID: runtimePoolRuntimeInstanceID(pod.UID, "boot-upgrade"), ControllerEpoch: 7,
+			ProtocolVersion: corev1alpha1.RuntimePoolProtocolHarnessV2,
+			ProfileDigest:   pool.Spec.Runtime.Profile.Digest, ProfileDigestSchemaVersion: pool.Spec.Runtime.Profile.DigestSchemaVersion,
+		},
+		Capacity: corev1alpha1.RuntimePoolCapacityStatus{MaxResidentSessions: 10, MaxRunningPrompts: 4},
+	}
+	auth := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: pool.Namespace,
+			Name:      runtimePoolChildName(runtimePoolResourceName(pool.Namespace, pool.Name), "auth-e7"),
+		},
+		Data: map[string][]byte{
+			runtimePoolControllerTokenKey:  []byte("controller-token"),
+			runtimePoolCapabilitySecretKey: []byte("capability-secret-capability-secret"),
+		},
+	}
+	return pool, pod, auth, &fakeUpgradeDrainSupervisor{
+		probe: probe, expectedEndpoint: runtimePoolPodEndpoint(&pod), expectedToken: "controller-token",
+		expectedCapability: bytes.Clone(auth.Data[runtimePoolCapabilitySecretKey]),
+	}
+}
+
+type epochTurnoverOnCompletionClient struct {
+	client.Client
+	epochStore *fakeUpgradeDrainEpochStore
+	once       sync.Once
+}
+
+func (c *epochTurnoverOnCompletionClient) Update(
+	ctx context.Context,
+	object client.Object,
+	opts ...client.UpdateOption,
+) error {
+	lease, ok := object.(*coordinationv1.Lease)
+	if ok {
+		marker, present, err := decodeACPUpgradeDrainMarker(lease.Annotations[acpUpgradeDrainMarkerAnnotation])
+		if err == nil && present && marker.State == ACPUpgradeDrainMarkerCompleted {
+			c.once.Do(func() {
+				current := &coordinationv1.Lease{}
+				if getErr := c.Get(ctx, client.ObjectKeyFromObject(lease), current); getErr != nil {
+					return
+				}
+				replacement := current.DeepCopy()
+				holder := "replacement-controller"
+				replacement.Spec.HolderIdentity = &holder
+				if updateErr := c.Client.Update(ctx, replacement); updateErr != nil {
+					return
+				}
+				c.epochStore.setCurrent(store.ControllerEpoch{
+					Name: marker.ControllerEpochName, Epoch: marker.ControllerEpoch + 1, HolderID: holder,
+				})
+			})
+		}
+	}
+	return c.Client.Update(ctx, object, opts...)
+}
+
+type fixedUpgradeDrainEpochSource struct {
+	fence store.ControllerEpochFence
+}
+
+func (s fixedUpgradeDrainEpochSource) CurrentFence(context.Context) (store.ControllerEpochFence, error) {
+	return s.fence, nil
+}
+
+type fakeUpgradeDrainEpochStore struct {
+	mu        sync.Mutex
+	current   store.ControllerEpoch
+	reads     int
+	loseAfter int
+}
+
+func (s *fakeUpgradeDrainEpochStore) GetControllerEpoch(context.Context, string) (*store.ControllerEpoch, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.reads++
+	current := s.current
+	if s.loseAfter > 0 && s.reads > s.loseAfter {
+		current.Epoch++
+		current.HolderID = "replacement-controller"
+	}
+	return &current, nil
+}
+
+func (s *fakeUpgradeDrainEpochStore) CompareAndSwapControllerEpoch(context.Context, store.ControllerEpochCAS) (*store.ControllerEpoch, error) {
+	return nil, errors.New("not implemented")
+}
+
+func (s *fakeUpgradeDrainEpochStore) setCurrent(current store.ControllerEpoch) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.current = current
+}
+
+type fakeUpgradeDrainSupervisor struct {
+	mu                 sync.Mutex
+	probe              RuntimePoolProbeResult
+	drainCalls         int
+	expectedEndpoint   string
+	expectedToken      string
+	expectedCapability []byte
+}
+
+func (s *fakeUpgradeDrainSupervisor) Probe(_ context.Context, endpoint, token string) (RuntimePoolProbeResult, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if endpoint != s.expectedEndpoint {
+		return RuntimePoolProbeResult{}, errors.New("unexpected exact-Pod endpoint")
+	}
+	if token != s.expectedToken {
+		return RuntimePoolProbeResult{}, errors.New("unexpected RuntimePool controller token")
+	}
+	return s.probe, nil
+}
+
+func (s *fakeUpgradeDrainSupervisor) RequestDrain(
+	_ context.Context,
+	endpoint, token string,
+	capability []byte,
+	prior harnessv2.StatusResponse,
+	reason string,
+) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if endpoint != s.expectedEndpoint || token != s.expectedToken || !bytes.Equal(capability, s.expectedCapability) {
+		return errors.New("unexpected authenticated drain target or credential")
+	}
+	if prior.Fence.RuntimeInstanceID != s.probe.Status.Fence.RuntimeInstanceID ||
+		prior.Fence.SupervisorBootID != s.probe.Status.Fence.SupervisorBootID ||
+		prior.Fence.RuntimePoolUID != s.probe.Status.Fence.RuntimePoolUID {
+		return errors.New("unexpected exact-instance status fence")
+	}
+	s.drainCalls++
+	s.probe.Status.Lifecycle = harnessv2.SupervisorLifecycleDraining
+	s.probe.Status.Drain = harnessv2.DrainStatus{
+		Requested: true, AcceptingNewSessions: false,
+		RequestedAt: time.Now().UTC(), Reason: reason,
+	}
+	return nil
+}
+
+func (s *fakeUpgradeDrainSupervisor) drainCallCount() int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.drainCalls
+}
+
+func TestRuntimeSessionControlAvailableWithoutLeaseIsQuiescent(t *testing.T) {
+	control := &corev1alpha1.RuntimeSessionControl{Status: corev1alpha1.RuntimeSessionControlStatus{
+		Availability: corev1alpha1.RuntimeSessionControlAvailability(store.SessionAvailable),
+	}}
+	if runtimeSessionControlHasUpgradeDrainWork(control) {
+		t.Fatal("lease-free Available SessionControl blocked planned drain")
+	}
+	control.Status.MutationLease = &corev1alpha1.RuntimeSessionMutationLeaseStatus{Generation: 1}
+	if !runtimeSessionControlHasUpgradeDrainWork(control) {
+		t.Fatal("active Session mutation lease did not block planned drain")
+	}
+}
diff --git a/internal/controller/acp_workspace.go b/internal/controller/acp_workspace.go
new file mode 100644
index 000000000..76dd0278e
--- /dev/null
+++ b/internal/controller/acp_workspace.go
@@ -0,0 +1,329 @@
+package controller
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/url"
+	"path"
+	"strings"
+	"time"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/artifactcap"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/publisher"
+	publisherservice "github.com/orka-agents/orka/internal/publisher/service"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+const defaultACPSourceBranch = "main"
+
+const workspaceRepositoryProviderGitHub = "github"
+
+var errWorkspaceRepositoryHTTPSPort = errors.New("repository HTTPS URL must use port 443")
+
+type preparedACPRuntimeWorkspace struct {
+	baseline      harnessv2.WorkspaceBaseline
+	spec          harnessv2.WorkspaceSpec
+	authorization *harnessv2.ArtifactAuthorization
+	bindingDigest string
+}
+
+//nolint:gocyclo // Workspace continuation, clean-room preparation, and exact authorization checks are audited together.
+func (d *ACPDispatcher) prepareRuntimeWorkspace(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	fence store.ControllerEpochFence,
+	session *acpTaskSession,
+) (preparedACPRuntimeWorkspace, error) {
+	workspace := task.Spec.Workspace
+	if session != nil && session.VerifiedBaseline != nil {
+		continuationWorkspace, err := runtimeWorkspaceForSessionContinuation(workspace, session.VerifiedBaseline)
+		if err != nil {
+			return preparedACPRuntimeWorkspace{}, err
+		}
+		workspace = continuationWorkspace
+	}
+	if workspace == nil || strings.TrimSpace(workspace.GitRepo) == "" {
+		baseline, spec, err := emptyRuntimeWorkspace(task)
+		if err != nil {
+			return preparedACPRuntimeWorkspace{}, err
+		}
+		bindingSpec := spec
+		// The empty filesystem is the same reusable workspace across Session
+		// turns even though the task-scoped protocol baseline carries a Task UID.
+		bindingSpec.Baseline = harnessv2.WorkspaceBaseline{
+			RepositoryIdentity: acpNoWorkspaceRevision,
+			Revision:           acpNoWorkspaceRevision,
+		}
+		bindingDigest, err := acpRuntimeWorkspaceBindingDigest("", bindingSpec)
+		if err != nil {
+			return preparedACPRuntimeWorkspace{}, err
+		}
+		return preparedACPRuntimeWorkspace{baseline: baseline, spec: spec, bindingDigest: bindingDigest}, nil
+	}
+	if d.Publisher == nil || len(d.ArtifactCapabilitySecret) < artifactcap.MinSecretBytes {
+		return preparedACPRuntimeWorkspace{}, fmt.Errorf("clean-room Workspace/Publisher and artifact authorization are required")
+	}
+	repository, err := workspaceRepository(workspace)
+	if err != nil {
+		return preparedACPRuntimeWorkspace{}, err
+	}
+	if session != nil && session.VerifiedBaseline != nil && !sameWorkspaceRepositoryIdentity(repository.ID, session.VerifiedBaseline.RepositoryID) {
+		return preparedACPRuntimeWorkspace{}, fmt.Errorf("session workspace repository does not match the verified publication baseline")
+	}
+	sourceRef, err := runtimeWorkspaceSourceRef(workspace)
+	if err != nil {
+		return preparedACPRuntimeWorkspace{}, err
+	}
+	credentialRole := publisherservice.CredentialRoleSourceRead
+	if session != nil && session.VerifiedBaseline != nil {
+		credentialRole = publisherservice.CredentialRoleTargetRead
+	}
+	credential := publisherCredentialReference(workspace.ReadCredentialRef, credentialRole)
+	metadata := publisherservice.OperationMetadata{
+		Namespace: task.Namespace, TaskID: string(task.UID), OperationID: "workspace-resolve-" + task.Status.Execution.PromptID,
+	}
+	resolveRequest := publisherservice.WorkspaceResolveRequest{
+		Metadata: metadata, Source: repository, SourceRef: sourceRef, CredentialRef: credential,
+	}
+	resolveIdentity := store.ExternalEffectIdentity{
+		Kind: "workspace.resolve", Namespace: task.Namespace, AggregateID: string(task.UID), OperationID: metadata.OperationID,
+	}
+	resolved, err := runACPExternalEffectWithRetry(ctx, d, fence, resolveIdentity, resolveRequest, func(callCtx context.Context) (publisherservice.WorkspaceResolveResponse, error) {
+		return d.Publisher.ResolveWorkspace(callCtx, resolveRequest)
+	})
+	if err != nil {
+		if settleErr := settleACPExternalEffectError(ctx, d, fence, resolveIdentity, err); settleErr != nil {
+			return preparedACPRuntimeWorkspace{}, fmt.Errorf("settle failed workspace resolve effect: %w", settleErr)
+		}
+		return preparedACPRuntimeWorkspace{}, fmt.Errorf("resolve source workspace: %w", err)
+	}
+	if session != nil && session.VerifiedBaseline != nil {
+		if resolved.BaselineOID != session.VerifiedBaseline.SHA {
+			return preparedACPRuntimeWorkspace{}, fmt.Errorf("session workspace baseline moved from %s to %s", session.VerifiedBaseline.SHA, resolved.BaselineOID)
+		}
+	}
+	metadata.OperationID = "workspace-prepare-" + task.Status.Execution.PromptID
+	prepareRequest := publisherservice.WorkspacePrepareRequest{
+		Metadata: metadata, Source: repository, SourceRef: resolved.SourceRef, BaselineOID: resolved.BaselineOID,
+		CredentialRef: credential,
+	}
+	prepareIdentity := store.ExternalEffectIdentity{
+		Kind: "workspace.prepare", Namespace: task.Namespace, AggregateID: string(task.UID), OperationID: metadata.OperationID,
+	}
+	prepared, err := runACPExternalEffectWithRetry(ctx, d, fence, prepareIdentity, prepareRequest, func(callCtx context.Context) (publisherservice.WorkspacePrepareResponse, error) {
+		return d.Publisher.PrepareWorkspace(callCtx, prepareRequest)
+	})
+	if err != nil {
+		if settleErr := settleACPExternalEffectError(ctx, d, fence, prepareIdentity, err); settleErr != nil {
+			return preparedACPRuntimeWorkspace{}, fmt.Errorf("settle failed workspace prepare effect: %w", settleErr)
+		}
+		return preparedACPRuntimeWorkspace{}, fmt.Errorf("prepare source workspace: %w", err)
+	}
+	baseline := harnessv2.WorkspaceBaseline{
+		RepositoryIdentity: repository.ID, Revision: resolved.BaselineOID,
+		TreeDigest: prepared.ManifestDigest, Artifact: &prepared.Artifact,
+	}
+	spec := harnessv2.WorkspaceSpec{
+		Intent: harnessv2.WorkspaceIntent(effectiveACPWorkspaceIntent(task)), Baseline: baseline,
+		RelativeRoot: strings.TrimSpace(workspace.SubPath),
+	}
+	bindingDigest, err := acpRuntimeWorkspaceBindingDigest(resolved.SourceRef, spec)
+	if err != nil {
+		return preparedACPRuntimeWorkspace{}, err
+	}
+	result := preparedACPRuntimeWorkspace{baseline: baseline, spec: spec, bindingDigest: bindingDigest}
+	if session != nil && session.Reused {
+		return result, nil
+	}
+
+	binding := artifactcap.OperationRequest{
+		Operation: artifactcap.OperationDownload, ObjectDigest: prepared.Artifact.Digest,
+		Identity:      artifactcap.Identity{Namespace: task.Namespace, TaskID: string(task.UID)},
+		ContentLength: prepared.Artifact.SizeBytes, MediaType: prepared.Artifact.MediaType,
+		OperationID: "runtime-workspace-download-" + task.Status.Execution.PromptID,
+	}
+	authorizedAt := time.Now().UTC()
+	const capabilityTTL = artifactcap.MaxCapabilityTTL
+	authorization, err := artifactcap.Issue(d.ArtifactCapabilitySecret, binding, authorizedAt, capabilityTTL)
+	if err != nil {
+		return preparedACPRuntimeWorkspace{}, fmt.Errorf("authorize runtime workspace download: %w", err)
+	}
+	if d.ArtifactReservations == nil {
+		return preparedACPRuntimeWorkspace{}, fmt.Errorf("artifact capability reservation recorder is required")
+	}
+	if err := d.ArtifactReservations.Reserve(ctx, binding, authorizedAt.Add(capabilityTTL+artifactcap.MaxClockSkew)); err != nil {
+		return preparedACPRuntimeWorkspace{}, fmt.Errorf("reserve runtime workspace download: %w", err)
+	}
+	result.authorization = &harnessv2.ArtifactAuthorization{
+		Capability: authorization.Capability, RequestDigest: authorization.RequestDigest,
+	}
+	return result, nil
+}
+
+func acpRuntimeWorkspaceBindingDigest(sourceRef string, workspace harnessv2.WorkspaceSpec) (string, error) {
+	return acpDomainDigest("runtime-session-workspace-binding", map[string]any{
+		"repositoryIdentity": strings.TrimSpace(workspace.Baseline.RepositoryIdentity),
+		"sourceRef":          strings.TrimSpace(sourceRef),
+		"revision":           strings.TrimSpace(workspace.Baseline.Revision),
+		"treeDigest":         strings.TrimSpace(workspace.Baseline.TreeDigest),
+		"intent":             workspace.Intent,
+		"relativeRoot":       strings.TrimSpace(workspace.RelativeRoot),
+	})
+}
+
+func runtimeWorkspaceSourceRef(workspace *corev1alpha1.WorkspaceConfig) (string, error) {
+	if workspace == nil {
+		return "", fmt.Errorf("workspace is required")
+	}
+	if ref := strings.TrimSpace(workspace.Ref); ref != "" {
+		canonical, err := publisherservice.CanonicalWorkspaceSourceRef(ref)
+		if err != nil {
+			return "", fmt.Errorf("workspace source ref is invalid: %w", err)
+		}
+		return canonical, nil
+	}
+	branch := strings.TrimSpace(workspace.Branch)
+	if branch == "" {
+		// Empty is an explicit request for the Publisher to resolve and freeze
+		// the repository's advertised HEAD/default branch before execution.
+		return "", nil
+	}
+	if !strings.HasPrefix(branch, "refs/") {
+		branch = "refs/heads/" + branch
+	}
+	canonical, err := publisherservice.CanonicalWorkspaceSourceRef(branch)
+	if err != nil {
+		return "", fmt.Errorf("workspace source branch is invalid: %w", err)
+	}
+	return canonical, nil
+}
+
+func runtimeWorkspaceForSessionContinuation(workspace *corev1alpha1.WorkspaceConfig, baseline *store.VerifiedBranchBaseline) (*corev1alpha1.WorkspaceConfig, error) {
+	if workspace == nil {
+		return nil, fmt.Errorf("session continuation has a verified branch baseline but Task.spec.workspace is missing")
+	}
+	if baseline == nil {
+		return workspace, nil
+	}
+	if err := validateSessionExpectedRemoteSHA(workspace, baseline); err != nil {
+		return nil, err
+	}
+	copyWorkspace := *workspace
+	publicationGitRepo := strings.TrimSpace(copyWorkspace.PublicationGitRepo)
+	if publicationGitRepo != "" {
+		sourceGitRepo := copyWorkspace.GitRepo
+		copyWorkspace.GitRepo = copyWorkspace.PublicationGitRepo
+		if copyWorkspace.PublicationRepository == nil && !sameCanonicalWorkspaceRepository(sourceGitRepo, publicationGitRepo) {
+			copyWorkspace.SourceRepository = nil
+		}
+	}
+	if copyWorkspace.PublicationRepository != nil {
+		copyIdentity := *copyWorkspace.PublicationRepository
+		copyWorkspace.SourceRepository = &copyIdentity
+	}
+	copyWorkspace.ReadCredentialRef = copyWorkspace.PublicationReadCredentialRef
+	copyWorkspace.Branch = ""
+	copyWorkspace.Ref = baseline.Ref
+	return &copyWorkspace, nil
+}
+
+func sameWorkspaceRepositoryIdentity(first, second string) bool {
+	first = strings.TrimSpace(first)
+	second = strings.TrimSpace(second)
+	if first == second {
+		return true
+	}
+	return strings.HasPrefix(strings.ToLower(first), "github.com/") &&
+		strings.HasPrefix(strings.ToLower(second), "github.com/") &&
+		strings.EqualFold(first, second)
+}
+
+func sameCanonicalWorkspaceRepository(first, second string) bool {
+	_, firstID, firstErr := canonicalWorkspaceRepositoryURL(strings.TrimSpace(first))
+	_, secondID, secondErr := canonicalWorkspaceRepositoryURL(strings.TrimSpace(second))
+	if firstErr == nil && secondErr == nil {
+		return firstID == secondID
+	}
+	return strings.TrimSpace(first) == strings.TrimSpace(second)
+}
+
+func validateSessionExpectedRemoteSHA(workspace *corev1alpha1.WorkspaceConfig, baseline *store.VerifiedBranchBaseline) error {
+	if baseline == nil {
+		return nil
+	}
+	if workspace == nil {
+		return fmt.Errorf("session continuation has a verified branch baseline but Task.spec.workspace is missing")
+	}
+	if err := store.ValidateGitObjectID("verified session baseline", baseline.SHA); err != nil {
+		return err
+	}
+	if expected := strings.TrimSpace(workspace.ExpectedRemoteSHA); expected != "" && expected != baseline.SHA {
+		return fmt.Errorf("workspace expectedRemoteSHA conflicts with the verified session baseline")
+	}
+	return nil
+}
+
+func workspaceRepository(workspace *corev1alpha1.WorkspaceConfig) (publisher.Repository, error) {
+	rawURL := strings.TrimSpace(workspace.GitRepo)
+	parsed, derivedID, err := canonicalWorkspaceRepositoryURL(rawURL)
+	if err != nil {
+		return publisher.Repository{}, fmt.Errorf("workspace gitRepo: %w", err)
+	}
+	provider := workspaceRepositoryProviderGitHub
+	if workspace.SourceRepository != nil {
+		provider = strings.ToLower(strings.TrimSpace(workspace.SourceRepository.Provider))
+		id := strings.TrimSpace(workspace.SourceRepository.ID)
+		if provider != workspaceRepositoryProviderGitHub || !sameWorkspaceRepositoryIdentity(id, derivedID) {
+			return publisher.Repository{}, fmt.Errorf("workspace sourceRepository must match the canonical credential-free URL identity %q", derivedID)
+		}
+	}
+	return publisher.Repository{Provider: provider, ID: derivedID, URL: parsed.String()}, nil
+}
+
+func canonicalWorkspaceRepositoryURL(rawURL string) (*url.URL, string, error) {
+	parsed, err := url.Parse(rawURL)
+	if err != nil || parsed.User != nil || parsed.Scheme != urlSchemeHTTPS || parsed.Host == "" || parsed.RawQuery != "" || parsed.ForceQuery || parsed.Fragment != "" || parsed.Opaque != "" {
+		return nil, "", fmt.Errorf("repository must be a credential-free HTTPS URL without query or fragment")
+	}
+	if port := parsed.Port(); port != "" && port != "443" {
+		return nil, "", errWorkspaceRepositoryHTTPSPort
+	}
+	if parsed.RawPath != "" && parsed.EscapedPath() != parsed.Path {
+		return nil, "", fmt.Errorf("repository URL escaped path is non-canonical")
+	}
+	cleaned := strings.TrimSuffix(strings.TrimPrefix(path.Clean(parsed.Path), "/"), ".git")
+	if cleaned == "" || cleaned == "." || parsed.Path == "/" || path.Clean(parsed.Path) != parsed.Path {
+		return nil, "", fmt.Errorf("repository URL path is invalid")
+	}
+	parsed.Scheme = urlSchemeHTTPS
+	parsed.Host = strings.ToLower(parsed.Host)
+	identityPath := cleaned
+	if parsed.Hostname() == "github.com" {
+		identityPath = strings.ToLower(identityPath)
+	}
+	derivedID := parsed.Hostname() + "/" + identityPath
+	return parsed, derivedID, nil
+}
+
+func publisherCredentialReference(reference *corev1alpha1.WorkspaceCredentialReference, roles ...publisherservice.CredentialRole) *publisherservice.CredentialReference {
+	if reference == nil || strings.TrimSpace(reference.Name) == "" {
+		return nil
+	}
+	var role publisherservice.CredentialRole
+	if len(roles) > 0 {
+		role = roles[0]
+	}
+	return &publisherservice.CredentialReference{Name: strings.TrimSpace(reference.Name), Kind: publisherservice.CredentialHTTPExtraHeader, Role: role}
+}
+
+func publisherForgeCredentialReference(reference *corev1alpha1.WorkspaceCredentialReference) *publisherservice.CredentialReference {
+	if reference == nil || strings.TrimSpace(reference.Name) == "" {
+		return nil
+	}
+	return &publisherservice.CredentialReference{
+		Name: strings.TrimSpace(reference.Name), Kind: publisherservice.CredentialForgeToken, Role: publisherservice.CredentialRoleForge,
+	}
+}
diff --git a/internal/controller/acp_workspace_repository_identity_casing_test.go b/internal/controller/acp_workspace_repository_identity_casing_test.go
new file mode 100644
index 000000000..c917e54c0
--- /dev/null
+++ b/internal/controller/acp_workspace_repository_identity_casing_test.go
@@ -0,0 +1,103 @@
+package controller
+
+import (
+	"testing"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+)
+
+func TestWorkspaceRepositoryCanonicalizesGitHubOwnerRepoCasing(t *testing.T) {
+	const wantID = "github.com/orka-agents/orka"
+	variants := []string{
+		"https://github.com/orka-agents/orka.git",
+		"https://GitHub.COM/Orka-Agents/Orka.git",
+		"https://github.com/ORKA-AGENTS/ORKA.git",
+	}
+
+	for _, rawURL := range variants {
+		t.Run(rawURL, func(t *testing.T) {
+			repository, err := workspaceRepository(&corev1alpha1.WorkspaceConfig{
+				GitRepo: rawURL,
+				SourceRepository: &corev1alpha1.RepositoryIdentity{
+					Provider: workspaceRepositoryProviderGitHub,
+					ID:       wantID,
+				},
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if repository.ID != wantID {
+				t.Fatalf("workspaceRepository().ID = %q, want %q", repository.ID, wantID)
+			}
+			if !sameCanonicalWorkspaceRepository(variants[0], rawURL) {
+				t.Fatalf("sameCanonicalWorkspaceRepository(%q, %q) = false, want true", variants[0], rawURL)
+			}
+		})
+	}
+}
+
+func TestCanonicalWorkspaceRepositoryURLPreservesNonGitHubPathCasing(t *testing.T) {
+	upperURL := "https://git.example.com/Acme/Repo.git"
+	lowerURL := "https://git.example.com/acme/repo.git"
+
+	upperParsed, upperID, err := canonicalWorkspaceRepositoryURL(upperURL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	lowerParsed, lowerID, err := canonicalWorkspaceRepositoryURL(lowerURL)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if upperParsed.String() != upperURL || upperID != "git.example.com/Acme/Repo" {
+		t.Fatalf("canonicalWorkspaceRepositoryURL(%q) = (%q, %q), want (%q, %q)", upperURL, upperParsed.String(), upperID, upperURL, "git.example.com/Acme/Repo")
+	}
+	if lowerParsed.String() != lowerURL || lowerID != "git.example.com/acme/repo" {
+		t.Fatalf("canonicalWorkspaceRepositoryURL(%q) = (%q, %q), want (%q, %q)", lowerURL, lowerParsed.String(), lowerID, lowerURL, "git.example.com/acme/repo")
+	}
+	if upperID == lowerID {
+		t.Fatalf("non-GitHub repository identities unexpectedly ignored path casing: %q", upperID)
+	}
+	if sameCanonicalWorkspaceRepository(upperURL, lowerURL) {
+		t.Fatalf("sameCanonicalWorkspaceRepository(%q, %q) = true, want false", upperURL, lowerURL)
+	}
+}
+
+func TestWorkspaceRepositoryAcceptsLegacyMixedCaseGitHubIdentity(t *testing.T) {
+	workspace := &corev1alpha1.WorkspaceConfig{
+		GitRepo: "https://github.com/Orka-Agents/Orka.git",
+		SourceRepository: &corev1alpha1.RepositoryIdentity{
+			Provider: workspaceRepositoryProviderGitHub,
+			ID:       "github.com/Orka-Agents/Orka",
+		},
+		PublicationGitRepo: "https://github.com/SozerCan/Orka.git",
+		PublicationRepository: &corev1alpha1.RepositoryIdentity{
+			Provider: workspaceRepositoryProviderGitHub,
+			ID:       "github.com/SozerCan/Orka",
+		},
+	}
+
+	source, err := workspaceRepository(workspace)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if source.ID != "github.com/orka-agents/orka" {
+		t.Fatalf("workspaceRepository().ID = %q, want canonical lowercase identity", source.ID)
+	}
+	target, err := workspacePublicationRepository(workspace)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if target.ID != "github.com/sozercan/orka" {
+		t.Fatalf("workspacePublicationRepository().ID = %q, want canonical lowercase identity", target.ID)
+	}
+}
+
+func TestWorkspaceRepositoryIdentityCompatibilityIsGitHubOnly(t *testing.T) {
+	if !sameWorkspaceRepositoryIdentity("github.com/Orka-Agents/Orka", "github.com/orka-agents/orka") {
+		t.Fatal("legacy mixed-case GitHub identity was not accepted")
+	}
+	if sameWorkspaceRepositoryIdentity("git.example.com/Acme/Repo", "git.example.com/acme/repo") {
+		t.Fatal("non-GitHub repository identity unexpectedly ignored path casing")
+	}
+}
diff --git a/internal/controller/acp_workspace_test.go b/internal/controller/acp_workspace_test.go
new file mode 100644
index 000000000..0665de7df
--- /dev/null
+++ b/internal/controller/acp_workspace_test.go
@@ -0,0 +1,352 @@
+package controller
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/artifactcap"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	publisherservice "github.com/orka-agents/orka/internal/publisher/service"
+	"github.com/orka-agents/orka/internal/store"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+const (
+	canonicalWorkspaceRepositoryTestURL = "https://github.com/orka-agents/orka.git"
+	canonicalWorkspaceRepositoryTestID  = "github.com/orka-agents/orka"
+)
+
+func TestPrepareRuntimeWorkspaceRetriesTransientPublisherFailuresUnderOneLease(t *testing.T) {
+	const (
+		namespace = "tenant-a"
+		taskUID   = "task-workspace-retry"
+		promptID  = "prompt-workspace-retry"
+	)
+	baselineOID := strings.Repeat("a", 40)
+	manifestDigest := "sha256:" + strings.Repeat("b", 64)
+	artifactDigest := "sha256:" + strings.Repeat("c", 64)
+	artifactID, err := artifactcap.ArtifactIDForDigest(artifactDigest)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	resolveRequests := make([]publisherservice.WorkspaceResolveRequest, 0, 2)
+	prepareRequests := make([]publisherservice.WorkspacePrepareRequest, 0, 2)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		switch r.URL.Path {
+		case publisherservice.WorkspaceResolvePath:
+			var request publisherservice.WorkspaceResolveRequest
+			if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+				t.Errorf("decode resolve request: %v", err)
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			}
+			resolveRequests = append(resolveRequests, request)
+			if len(resolveRequests) == 1 {
+				writeDispatcherJSONStatus(w, http.StatusBadGateway, publisherservice.ErrorResponse{
+					Code: "scm_failure", Message: "transient Git failure", Retryable: true,
+				})
+				return
+			}
+			writeDispatcherJSON(w, publisherservice.WorkspaceResolveResponse{
+				OperationID: request.Metadata.OperationID, RequestDigest: testControlDigestForDispatcher("resolve-retry"),
+				RepositoryID: request.Source.ID, SourceRef: "refs/heads/main", BaselineOID: baselineOID,
+			})
+		case publisherservice.WorkspacePreparePath:
+			var request publisherservice.WorkspacePrepareRequest
+			if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+				t.Errorf("decode prepare request: %v", err)
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			}
+			prepareRequests = append(prepareRequests, request)
+			if len(prepareRequests) == 1 {
+				writeDispatcherJSONStatus(w, http.StatusBadGateway, publisherservice.ErrorResponse{
+					Code: "scm_failure", Message: "transient Git failure", Retryable: true,
+				})
+				return
+			}
+			writeDispatcherJSON(w, publisherservice.WorkspacePrepareResponse{
+				OperationID: request.Metadata.OperationID, RequestDigest: testControlDigestForDispatcher("prepare-retry"),
+				RepositoryID: request.Source.ID, SourceRef: request.SourceRef, BaselineOID: request.BaselineOID,
+				TreeOID: strings.Repeat("d", 40), ManifestDigest: manifestDigest, EntryCount: 1, ExpandedBytes: 64,
+				Artifact: harnessv2.ArtifactReference{
+					ArtifactID: harnessv2.ArtifactID(artifactID), Digest: artifactDigest,
+					SizeBytes: 64, MediaType: artifactcap.MediaTypeWorkspaceTar,
+				},
+			})
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+
+	publisherClient, err := publisherservice.NewClient(publisherservice.ClientConfig{
+		BaseURL: server.URL, HTTPClient: server.Client(),
+		BearerToken: []byte(strings.Repeat("e", 32)), CapabilitySecret: []byte(strings.Repeat("f", 32)),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	controlStore, fence, closeStore := newACPSessionTestStore(t, filepath.Join(t.TempDir(), "workspace-retry.db"))
+	defer closeStore()
+	dispatcher := &ACPDispatcher{
+		Store: controlStore, Publisher: publisherClient,
+		ArtifactCapabilitySecret: []byte(strings.Repeat("1", artifactcap.MinSecretBytes)),
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: namespace, Name: "workspace-retry", UID: types.UID(taskUID)},
+		Spec: corev1alpha1.TaskSpec{Workspace: &corev1alpha1.WorkspaceConfig{
+			Intent: corev1alpha1.WorkspaceIntentRead, GitRepo: canonicalWorkspaceRepositoryTestURL,
+			SourceRepository: &corev1alpha1.RepositoryIdentity{
+				Provider: workspaceRepositoryProviderGitHub, ID: canonicalWorkspaceRepositoryTestID,
+			},
+			Branch: "main",
+		}},
+		Status: corev1alpha1.TaskStatus{Execution: &corev1alpha1.TaskExecutionStatus{PromptID: promptID}},
+	}
+
+	prepared, err := dispatcher.prepareRuntimeWorkspace(context.Background(), task, fence, &acpTaskSession{Reused: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if prepared.baseline.Revision != baselineOID || prepared.baseline.TreeDigest != manifestDigest || prepared.spec.Baseline.Artifact == nil {
+		t.Fatalf("prepared workspace = %#v", prepared)
+	}
+	for label, check := range map[string]struct {
+		requestsEqual bool
+		attempts      int
+		operationIDs  []string
+		kind          string
+		operationID   string
+	}{
+		"resolve": {
+			len(resolveRequests) == 2 && reflect.DeepEqual(resolveRequests[0], resolveRequests[1]),
+			len(resolveRequests), workspaceResolveOperationIDs(resolveRequests),
+			"workspace.resolve", "workspace-resolve-" + promptID,
+		},
+		"prepare": {
+			len(prepareRequests) == 2 && reflect.DeepEqual(prepareRequests[0], prepareRequests[1]),
+			len(prepareRequests), workspacePrepareOperationIDs(prepareRequests),
+			"workspace.prepare", "workspace-prepare-" + promptID,
+		},
+	} {
+		if check.attempts != 2 || !check.requestsEqual {
+			t.Fatalf("%s requests changed across %d attempts", label, check.attempts)
+		}
+		if check.operationIDs[0] != check.operationID || check.operationIDs[1] != check.operationID {
+			t.Fatalf("%s operation IDs = %v, want two stable %q attempts", label, check.operationIDs, check.operationID)
+		}
+		identity := store.ExternalEffectIdentity{
+			Kind: check.kind, Namespace: namespace, AggregateID: taskUID, OperationID: check.operationID,
+		}
+		effectID, err := identity.CanonicalID()
+		if err != nil {
+			t.Fatal(err)
+		}
+		effect, err := controlStore.GetExternalEffect(context.Background(), effectID)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if effect.State != store.ExternalEffectSucceeded || effect.Attempts != 1 {
+			t.Fatalf("%s external effect = state %s attempts %d, want Succeeded with one lease", label, effect.State, effect.Attempts)
+		}
+	}
+}
+
+func workspaceResolveOperationIDs(requests []publisherservice.WorkspaceResolveRequest) []string {
+	operationIDs := make([]string, 0, len(requests))
+	for _, request := range requests {
+		operationIDs = append(operationIDs, request.Metadata.OperationID)
+	}
+	return operationIDs
+}
+
+func workspacePrepareOperationIDs(requests []publisherservice.WorkspacePrepareRequest) []string {
+	operationIDs := make([]string, 0, len(requests))
+	for _, request := range requests {
+		operationIDs = append(operationIDs, request.Metadata.OperationID)
+	}
+	return operationIDs
+}
+
+func TestRuntimeWorkspaceForSessionContinuationUsesPublicationTargetReadCredential(t *testing.T) {
+	sourceRead := &corev1alpha1.WorkspaceCredentialReference{Name: "source-read"}
+	targetRead := &corev1alpha1.WorkspaceCredentialReference{Name: "target-read"}
+	workspace := &corev1alpha1.WorkspaceConfig{
+		GitRepo:                      "https://github.com/orka-agents/source.git",
+		SourceRepository:             &corev1alpha1.RepositoryIdentity{Provider: "github", ID: "github.com/orka-agents/source"},
+		Branch:                       "main",
+		ReadCredentialRef:            sourceRead,
+		PublicationGitRepo:           "https://github.com/orka-agents/target.git",
+		PublicationRepository:        &corev1alpha1.RepositoryIdentity{Provider: "github", ID: "github.com/orka-agents/target"},
+		PublicationReadCredentialRef: targetRead,
+	}
+	baseline := &store.VerifiedBranchBaseline{
+		RepositoryID: "github.com/orka-agents/target",
+		Ref:          "refs/heads/orka/session-session-uid",
+		SHA:          strings.Repeat("a", 40),
+	}
+
+	got, err := runtimeWorkspaceForSessionContinuation(workspace, baseline)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got == workspace {
+		t.Fatal("session continuation mutated the original workspace instead of using a copy")
+	}
+	if got.GitRepo != workspace.PublicationGitRepo || got.SourceRepository == nil || got.SourceRepository.ID != workspace.PublicationRepository.ID {
+		t.Fatalf("continuation repository = %#v, want publication target", got)
+	}
+	if got.ReadCredentialRef == nil || got.ReadCredentialRef.Name != targetRead.Name {
+		t.Fatalf("continuation read credential = %#v, want target read credential", got.ReadCredentialRef)
+	}
+	if got.Ref != baseline.Ref || got.Branch != "" {
+		t.Fatalf("continuation source = ref %q branch %q, want verified ref %q", got.Ref, got.Branch, baseline.Ref)
+	}
+	if workspace.ReadCredentialRef == nil || workspace.ReadCredentialRef.Name != sourceRead.Name || workspace.GitRepo == workspace.PublicationGitRepo {
+		t.Fatalf("source workspace was mutated: %#v", workspace)
+	}
+
+	conflicting := *workspace
+	conflicting.ExpectedRemoteSHA = strings.Repeat("b", 40)
+	if _, err := runtimeWorkspaceForSessionContinuation(&conflicting, baseline); err == nil {
+		t.Fatal("conflicting expectedRemoteSHA unexpectedly accepted before prompt execution")
+	}
+}
+
+func TestRuntimeWorkspaceForSessionContinuationClearsSourceIdentityForCrossRepositoryPublication(t *testing.T) {
+	sourceIdentity := &corev1alpha1.RepositoryIdentity{Provider: "github", ID: "github.com/orka-agents/source"}
+	workspace := &corev1alpha1.WorkspaceConfig{
+		GitRepo:            "https://github.com/orka-agents/source.git",
+		SourceRepository:   sourceIdentity,
+		PublicationGitRepo: "https://github.com/orka-agents/target.git",
+	}
+	baseline := &store.VerifiedBranchBaseline{
+		RepositoryID: "github.com/orka-agents/target",
+		Ref:          "refs/heads/orka/session-session-uid",
+		SHA:          strings.Repeat("a", 40),
+	}
+
+	got, err := runtimeWorkspaceForSessionContinuation(workspace, baseline)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.GitRepo != workspace.PublicationGitRepo {
+		t.Fatalf("continuation gitRepo = %q, want %q", got.GitRepo, workspace.PublicationGitRepo)
+	}
+	if got.SourceRepository != nil {
+		t.Fatalf("continuation sourceRepository = %#v, want derived publication identity", got.SourceRepository)
+	}
+	if workspace.SourceRepository != sourceIdentity {
+		t.Fatalf("source workspace identity was mutated: %#v", workspace.SourceRepository)
+	}
+}
+
+func TestRuntimeWorkspaceForSessionContinuationPreservesSourceIdentityForSameRepositoryPublication(t *testing.T) {
+	sourceIdentity := &corev1alpha1.RepositoryIdentity{Provider: "github", ID: "github.com/orka-agents/source"}
+	workspace := &corev1alpha1.WorkspaceConfig{
+		GitRepo:            "https://GitHub.COM/orka-agents/source.git",
+		SourceRepository:   sourceIdentity,
+		PublicationGitRepo: "https://github.com/orka-agents/source",
+	}
+	baseline := &store.VerifiedBranchBaseline{
+		RepositoryID: sourceIdentity.ID,
+		Ref:          "refs/heads/orka/session-session-uid",
+		SHA:          strings.Repeat("a", 40),
+	}
+
+	got, err := runtimeWorkspaceForSessionContinuation(workspace, baseline)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.GitRepo != workspace.PublicationGitRepo {
+		t.Fatalf("continuation gitRepo = %q, want %q", got.GitRepo, workspace.PublicationGitRepo)
+	}
+	if got.SourceRepository == nil || *got.SourceRepository != *sourceIdentity {
+		t.Fatalf("continuation sourceRepository = %#v, want %#v", got.SourceRepository, sourceIdentity)
+	}
+}
+
+func TestRuntimeWorkspaceSourceRefDoesNotAssumeMain(t *testing.T) {
+	tests := []struct {
+		name      string
+		workspace *corev1alpha1.WorkspaceConfig
+		want      string
+		wantErr   string
+	}{
+		{name: "explicit branch", workspace: &corev1alpha1.WorkspaceConfig{Branch: "trunk"}, want: "refs/heads/trunk"},
+		{name: "full branch ref", workspace: &corev1alpha1.WorkspaceConfig{Branch: "refs/heads/release/v2"}, want: "refs/heads/release/v2"},
+		{name: "exact ref", workspace: &corev1alpha1.WorkspaceConfig{Ref: "v2.0.0"}, want: "v2.0.0"},
+		{name: "default resolved by publisher", workspace: &corev1alpha1.WorkspaceConfig{}, want: ""},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			got, err := runtimeWorkspaceSourceRef(test.workspace)
+			if test.wantErr != "" {
+				if err == nil || !strings.Contains(err.Error(), test.wantErr) {
+					t.Fatalf("runtimeWorkspaceSourceRef() error = %v, want %q", err, test.wantErr)
+				}
+				return
+			}
+			if err != nil || got != test.want {
+				t.Fatalf("runtimeWorkspaceSourceRef() = %q, %v, want %q", got, err, test.want)
+			}
+		})
+	}
+}
+
+func TestCanonicalWorkspaceRepositoryURLAllowsOnlyDefaultHTTPSPort(t *testing.T) {
+	tests := []struct {
+		name    string
+		rawURL  string
+		wantURL string
+		wantID  string
+		wantErr string
+	}{
+		{
+			name:    "implicit default port retains canonical host behavior",
+			rawURL:  "https://GitHub.COM/orka-agents/orka.git",
+			wantURL: canonicalWorkspaceRepositoryTestURL,
+			wantID:  canonicalWorkspaceRepositoryTestID,
+		},
+		{
+			name:    "explicit default port is accepted",
+			rawURL:  "https://GitHub.COM:443/orka-agents/orka.git",
+			wantURL: "https://github.com:443/orka-agents/orka.git",
+			wantID:  canonicalWorkspaceRepositoryTestID,
+		},
+		{
+			name:    "explicit non-default port is rejected",
+			rawURL:  "https://github.com:8443/orka-agents/orka.git",
+			wantErr: errWorkspaceRepositoryHTTPSPort.Error(),
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			parsed, id, err := canonicalWorkspaceRepositoryURL(test.rawURL)
+			if test.wantErr != "" {
+				if err == nil || !strings.Contains(err.Error(), test.wantErr) {
+					t.Fatalf("canonicalWorkspaceRepositoryURL() error = %v, want %q", err, test.wantErr)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatal(err)
+			}
+			if parsed.String() != test.wantURL || id != test.wantID {
+				t.Fatalf("canonicalWorkspaceRepositoryURL() = (%q, %q), want (%q, %q)", parsed.String(), id, test.wantURL, test.wantID)
+			}
+		})
+	}
+}
diff --git a/internal/controller/agent_controller.go b/internal/controller/agent_controller.go
index 4acb5c605..8af32fe47 100644
--- a/internal/controller/agent_controller.go
+++ b/internal/controller/agent_controller.go
@@ -97,7 +97,19 @@ func (r *AgentReconciler) validateAgent(ctx context.Context, agent *corev1alpha1
 		if agent.Spec.ProviderRef == nil && (agent.Spec.Model == nil || agent.Spec.Model.Provider == "") {
 			return fmt.Errorf("either providerRef or model.provider must be specified")
 		}
-	} else if err := validateAgentRuntimeReasoningEffort(agent.Spec.Runtime); err != nil {
+	} else {
+		if err := validateACPAgentModelControls(agent.Spec.Runtime, agent.Spec.Model); err != nil {
+			return err
+		}
+		if err := validateAgentRuntimeReasoningEffort(agent.Spec.Runtime); err != nil {
+			return err
+		}
+		if err := validateBuiltInACPAgentCredentialSecretRef(agent); err != nil {
+			return err
+		}
+	}
+
+	if err := ValidateOpenCodeAgentSpec(agent); err != nil {
 		return err
 	}
 
@@ -119,6 +131,24 @@ func (r *AgentReconciler) validateAgent(ctx context.Context, agent *corev1alpha1
 	return r.validateCoordination(ctx, agent)
 }
 
+func isBuiltInACPProviderRuntime(runtimeType corev1alpha1.AgentRuntimeType) bool {
+	switch runtimeType {
+	case corev1alpha1.AgentRuntimeCodex, corev1alpha1.AgentRuntimeClaude,
+		corev1alpha1.AgentRuntimeCopilot, corev1alpha1.AgentRuntimeOpencode:
+		return true
+	default:
+		return false
+	}
+}
+
+func validateBuiltInACPAgentCredentialSecretRef(agent *corev1alpha1.Agent) error {
+	if agent == nil || agent.Spec.Runtime == nil || agent.Spec.SecretRef == nil ||
+		!isBuiltInACPProviderRuntime(agent.Spec.Runtime.Type) {
+		return nil
+	}
+	return fmt.Errorf("built-in ACP runtime %q does not support agent secretRef; provider credentials are controller-managed", agent.Spec.Runtime.Type)
+}
+
 func validateAgentRuntimeReasoningEffort(runtimeCfg *corev1alpha1.AgentCLIRuntime) error {
 	if runtimeCfg == nil {
 		return nil
diff --git a/internal/controller/agent_controller_test.go b/internal/controller/agent_controller_test.go
index 00232a758..1294a0ee3 100644
--- a/internal/controller/agent_controller_test.go
+++ b/internal/controller/agent_controller_test.go
@@ -35,6 +35,7 @@ func TestValidateAgentRuntimeReasoningEffort(t *testing.T) {
 		{name: "codex max rejected", runtime: corev1alpha1.AgentRuntimeCodex, effort: "max", wantError: "low, medium, high, or xhigh"},
 		{name: "claude max", runtime: corev1alpha1.AgentRuntimeClaude, effort: "max"},
 		{name: "copilot rejected", runtime: corev1alpha1.AgentRuntimeCopilot, effort: agentReasoningEffortHigh, wantError: "does not support"},
+		{name: "opencode rejected", runtime: corev1alpha1.AgentRuntimeOpencode, effort: agentReasoningEffortHigh, wantError: "does not support"},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
 			err := validateAgentRuntimeReasoningEffort(&corev1alpha1.AgentCLIRuntime{
diff --git a/internal/controller/agent_controller_unit_test.go b/internal/controller/agent_controller_unit_test.go
index 18ae95b47..e2dd04ce7 100644
--- a/internal/controller/agent_controller_unit_test.go
+++ b/internal/controller/agent_controller_unit_test.go
@@ -8,6 +8,7 @@ package controller
 
 import (
 	"context"
+	"strings"
 	"testing"
 	"time"
 
@@ -15,6 +16,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/utils/ptr"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
@@ -104,6 +106,207 @@ func TestValidateAgent_RuntimeOnly(t *testing.T) {
 	}
 }
 
+func TestValidateAgent_OpenCodeRequirements(t *testing.T) {
+	for _, test := range []struct {
+		name          string
+		model         string
+		contextWindow *int32
+		maxTokens     *int32
+		secret        string
+		systemPrompt  string
+		wantErr       string
+	}{
+		{name: "valid", model: "openai/gpt-5.4", contextWindow: new(int32(32768)), maxTokens: new(int32(4096))},
+		{name: "system prompt", model: "openai/gpt-5.4", contextWindow: new(int32(32768)), maxTokens: new(int32(4096)), systemPrompt: "ignored", wantErr: "does not support spec.systemPrompt"},
+		{name: "missing model", wantErr: "requires spec.model.name"},
+		{name: "missing context window", model: "openai/gpt-5.4", maxTokens: new(int32(4096)), wantErr: "requires a positive spec.model.contextWindow"},
+		{name: "missing max tokens", model: "openai/gpt-5.4", contextWindow: new(int32(32768)), wantErr: "requires a positive spec.model.maxTokens"},
+		{name: "inverted limits", model: "openai/gpt-5.4", contextWindow: new(int32(4096)), maxTokens: new(int32(4096)), wantErr: "contextWindow must exceed"},
+		{name: "substitution model", model: "{env:ORKA_OPENCODE_PROVIDER_TOKEN}", contextWindow: new(int32(32768)), maxTokens: new(int32(4096)), wantErr: "substitution braces"},
+		{name: "legacy secret", model: "openai/gpt-5.4", contextWindow: new(int32(32768)), maxTokens: new(int32(4096)), secret: "placeholder", wantErr: "does not support agent secretRef"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			agent := baseAgent("opencode")
+			agent.Spec.ProviderRef = nil
+			agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeOpencode,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			}
+			agent.Spec.Model = &corev1alpha1.ModelConfig{Name: test.model, ContextWindow: test.contextWindow, MaxTokens: test.maxTokens}
+			if test.secret != "" {
+				agent.Spec.SecretRef = &corev1.LocalObjectReference{Name: test.secret}
+			}
+			if test.systemPrompt != "" {
+				agent.Spec.SystemPrompt = &corev1alpha1.PromptSource{Inline: test.systemPrompt}
+			}
+			err := setupAgentReconciler().validateAgent(context.Background(), agent)
+			if test.wantErr == "" {
+				if err != nil {
+					t.Fatalf("validateAgent() error = %v", err)
+				}
+				return
+			}
+			if err == nil || !strings.Contains(err.Error(), test.wantErr) {
+				t.Fatalf("validateAgent() error = %v, want %q", err, test.wantErr)
+			}
+		})
+	}
+
+	// runtime.type: opencode exists in both harness protocols and is never
+	// protocol evidence: the v2 rules must not fire for v1-classified or
+	// still-unclassified stored legacy OpenCode Agents, even when they carry
+	// historically valid v1 shapes the v2 contract forbids.
+	for _, test := range []struct {
+		name            string
+		contractVersion *corev1alpha1.AgentRuntimeContractVersion
+	}{
+		{name: "unclassified legacy opencode agent is preserved", contractVersion: nil},
+		{name: "harness v1 opencode agent is preserved", contractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV1)},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			agent := baseAgent("opencode-legacy")
+			agent.Spec.ProviderRef = nil
+			agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeOpencode,
+				ContractVersion: test.contractVersion,
+			}
+			agent.Spec.SystemPrompt = &corev1alpha1.PromptSource{Inline: "legacy prompt"}
+			agent.Spec.Model = &corev1alpha1.ModelConfig{Name: "gpt-5.4"}
+			agent.Spec.SecretRef = &corev1.LocalObjectReference{Name: "legacy-provider-creds"}
+
+			if err := ValidateOpenCodeAgentSpec(agent); err != nil {
+				t.Fatalf("ValidateOpenCodeAgentSpec() error = %v, want nil for preserved legacy opencode agent", err)
+			}
+		})
+	}
+}
+
+func TestValidateAgent_BuiltInRuntimeRejectsCredentialSecretRef(t *testing.T) {
+	for _, runtimeType := range []corev1alpha1.AgentRuntimeType{
+		corev1alpha1.AgentRuntimeCodex,
+		corev1alpha1.AgentRuntimeClaude,
+		corev1alpha1.AgentRuntimeCopilot,
+		corev1alpha1.AgentRuntimeOpencode,
+	} {
+		t.Run(string(runtimeType), func(t *testing.T) {
+			r := setupAgentReconciler()
+			agent := baseAgent(string(runtimeType))
+			agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{Type: runtimeType}
+			agent.Spec.SecretRef = &corev1.LocalObjectReference{Name: "legacy-provider-creds"}
+
+			err := r.validateAgent(context.Background(), agent)
+			if err == nil || !strings.Contains(err.Error(), "does not support agent secretRef") {
+				t.Fatalf("validateAgent() error = %v, want built-in ACP secretRef rejection", err)
+			}
+		})
+	}
+}
+
+func TestValidateAgent_CredentialSecretRefRemainsValidOutsideBuiltInACPRuntimes(t *testing.T) {
+	secret := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "provider-creds", Namespace: testNS}}
+	for _, tt := range []struct {
+		name    string
+		runtime *corev1alpha1.AgentCLIRuntime
+	}{
+		{name: "provider-backed agent"},
+		{
+			name: "custom runtimeRef agent",
+			runtime: &corev1alpha1.AgentCLIRuntime{
+				RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "custom-runtime"},
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			r := setupAgentReconciler(secret.DeepCopy())
+			agent := baseAgent(tt.name)
+			agent.Spec.Runtime = tt.runtime
+			agent.Spec.SecretRef = &corev1.LocalObjectReference{Name: secret.Name}
+
+			if err := r.validateAgent(context.Background(), agent); err != nil {
+				t.Fatalf("validateAgent() error = %v", err)
+			}
+		})
+	}
+}
+
+func TestValidateAgent_BuiltInRuntimeRejectsUnsupportedModelControls(t *testing.T) {
+	temperature := 0.2
+	maxTokens := int32(128)
+	zeroMaxTokens := int32(0)
+	for _, tt := range []struct {
+		name      string
+		runtime   corev1alpha1.AgentRuntimeType
+		configure func(*corev1alpha1.ModelConfig)
+		wantError string
+	}{
+		{
+			name:    "codex temperature",
+			runtime: corev1alpha1.AgentRuntimeCodex,
+			configure: func(model *corev1alpha1.ModelConfig) {
+				model.Temperature = &temperature
+			},
+			wantError: "spec.model.temperature",
+		},
+		{
+			name:    "claude max tokens",
+			runtime: corev1alpha1.AgentRuntimeClaude,
+			configure: func(model *corev1alpha1.ModelConfig) {
+				model.MaxTokens = &maxTokens
+			},
+			wantError: "spec.model.maxTokens",
+		},
+		{
+			name:    "copilot explicit zero max tokens",
+			runtime: corev1alpha1.AgentRuntimeCopilot,
+			configure: func(model *corev1alpha1.ModelConfig) {
+				model.MaxTokens = &zeroMaxTokens
+			},
+			wantError: "spec.model.maxTokens",
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			r := setupAgentReconciler()
+			agent := baseAgent(tt.name)
+			agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{Type: tt.runtime}
+			tt.configure(agent.Spec.Model)
+
+			err := r.validateAgent(context.Background(), agent)
+			if err == nil || !strings.Contains(err.Error(), tt.wantError) {
+				t.Fatalf("validateAgent() error = %v, want %q", err, tt.wantError)
+			}
+		})
+	}
+}
+
+func TestValidateAgent_ModelControlsRemainValidOutsideBuiltInACPRuntimes(t *testing.T) {
+	temperature := 0.2
+	maxTokens := int32(128)
+	for _, tt := range []struct {
+		name    string
+		runtime *corev1alpha1.AgentCLIRuntime
+	}{
+		{name: "provider-backed agent"},
+		{
+			name: "custom runtimeRef agent",
+			runtime: &corev1alpha1.AgentCLIRuntime{
+				RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "custom-runtime"},
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			r := setupAgentReconciler()
+			agent := baseAgent(tt.name)
+			agent.Spec.Runtime = tt.runtime
+			agent.Spec.Model.Temperature = &temperature
+			agent.Spec.Model.MaxTokens = &maxTokens
+
+			if err := r.validateAgent(context.Background(), agent); err != nil {
+				t.Fatalf("validateAgent() error = %v", err)
+			}
+		})
+	}
+}
+
 // ---------- validateProviderRef ----------
 
 func TestValidateProviderRef(t *testing.T) {
@@ -1067,3 +1270,14 @@ func findCondition(conditions []metav1.Condition, condType string) *metav1.Condi
 	}
 	return nil
 }
+
+func TestValidateAgent_BuiltInRuntimeAcceptsLegacyDefaultTemperature(t *testing.T) {
+	r := setupAgentReconciler()
+	agent := baseAgent("legacy-default-temperature")
+	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeClaude}
+	temperature := legacyDefaultACPTemperature
+	agent.Spec.Model.Temperature = &temperature
+	if err := r.validateAgent(context.Background(), agent); err != nil {
+		t.Fatalf("legacy default temperature rejected: %v", err)
+	}
+}
diff --git a/internal/controller/agent_execution_binding.go b/internal/controller/agent_execution_binding.go
new file mode 100644
index 000000000..f4734ef5b
--- /dev/null
+++ b/internal/controller/agent_execution_binding.go
@@ -0,0 +1,668 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package controller
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	logf "sigs.k8s.io/controller-runtime/pkg/log"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/labels"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+// The binding stage implements the coexistence plan's write-once execution
+// binding: every executable agent Task freezes its protocol, backend, and an
+// immutable content-addressed execution snapshot before any executor-specific
+// side effect. The snapshot store and revisioned backend control are mandatory:
+// a controller that cannot prove either one never queues executor demand.
+
+const agentExecutionBindingConflictReason = "BindingConflict"
+
+// agentExecutionCandidate is the pure resolution product: the prospective
+// binding plus the plaintext snapshot body it references. Resolution performs
+// reads only; no durable writes or runtime side effects.
+type agentExecutionCandidate struct {
+	binding      corev1alpha1.AgentExecutionBinding
+	snapshotBody []byte
+}
+
+// agentExecutionSnapshotBody is the canonical non-secret executable input
+// record frozen into the immutable snapshot. Credentials remain references
+// only; raw credential values and TxTokens never enter this structure.
+type agentExecutionSnapshotBody struct {
+	SchemaVersion    int32                             `json:"schemaVersion"`
+	ContractVersion  string                            `json:"contractVersion"`
+	Backend          string                            `json:"backend"`
+	RuntimeType      string                            `json:"runtimeType"`
+	Agent            agentExecutionSnapshotAgent       `json:"agent"`
+	Configuration    agentExecutionSnapshotConfig      `json:"configuration"`
+	RuntimeImage     string                            `json:"runtimeImage"`
+	RuntimeProfile   harnessv2.RuntimeProfile          `json:"runtimeProfile"`
+	ProfileDigest    string                            `json:"profileDigest"`
+	PoolName         string                            `json:"poolName"`
+	MCPConfiguration *harnessv2.MCPPolicyConfiguration `json:"mcpConfiguration,omitempty"`
+	Prompt           string                            `json:"prompt"`
+	Timeout          string                            `json:"timeout,omitempty"`
+	RetryPolicy      *corev1alpha1.RetryPolicy         `json:"retryPolicy,omitempty"`
+	SessionRef       *corev1alpha1.SessionReference    `json:"sessionRef,omitempty"`
+	Workspace        *corev1alpha1.WorkspaceConfig     `json:"workspace,omitempty"`
+	RuntimeOverride  *corev1alpha1.AgentRuntimeSpec    `json:"runtimeOverride,omitempty"`
+	DefaultTools     *agentExecutionSnapshotToolPolicy `json:"defaultTools,omitempty"`
+	HarnessV1        *agentExecutionSnapshotHarnessV1  `json:"harnessV1,omitempty"`
+}
+
+type agentExecutionSnapshotAgent struct {
+	Namespace  string `json:"namespace"`
+	Name       string `json:"name"`
+	UID        string `json:"uid"`
+	Generation int64  `json:"generation"`
+}
+
+type agentExecutionSnapshotConfig struct {
+	AgentUID        string `json:"agentUID"`
+	AgentGeneration int64  `json:"agentGeneration"`
+	ProviderKind    string `json:"providerKind"`
+	Model           string `json:"model"`
+	MaxTurns        int32  `json:"maxTurns"`
+	ReasoningEffort string `json:"reasoningEffort,omitempty"`
+	SystemPrompt    string `json:"systemPrompt,omitempty"`
+}
+
+// agentExecutionSnapshotToolPolicy preserves the omitted-versus-explicit-empty
+// allowlist distinction from the Agent defaults.
+type agentExecutionSnapshotToolPolicy struct {
+	AllowedToolsOmitted bool     `json:"allowedToolsOmitted"`
+	AllowedTools        []string `json:"allowedTools"`
+	AllowBash           *bool    `json:"allowBash,omitempty"`
+}
+
+// agentExecutionSnapshotHarnessV1 freezes the non-secret wrapper or external
+// endpoint identity used by the v1 dispatcher. Secret contents never enter the
+// snapshot; the exact Secret UID/resourceVersion is verified again before the
+// first executor side effect.
+type agentExecutionSnapshotHarnessV1 struct {
+	Endpoint                  string                                           `json:"endpoint"`
+	Backend                   string                                           `json:"backend"`
+	RuntimeName               string                                           `json:"runtimeName"`
+	ToolExecutionMode         string                                           `json:"toolExecutionMode,omitempty"`
+	BrokeredToolClasses       []corev1alpha1.AgentRuntimeBrokeredToolClass     `json:"brokeredToolClasses,omitempty"`
+	BrokeredTools             []agentExecutionSnapshotHarnessV1BrokeredTool    `json:"brokeredTools,omitempty"`
+	RuntimeAuthOnly           bool                                             `json:"runtimeAuthOnly,omitempty"`
+	AuthSecretNamespace       string                                           `json:"authSecretNamespace"`
+	AuthSecretName            string                                           `json:"authSecretName"`
+	AuthSecretKey             string                                           `json:"authSecretKey"`
+	AuthSecretUID             string                                           `json:"authSecretUID"`
+	AuthSecretResourceVersion string                                           `json:"authSecretResourceVersion"`
+	DuplicateSafe             bool                                             `json:"duplicateSafe"`
+	SessionName               string                                           `json:"sessionName"`
+	SessionBootstrap          *agentExecutionSnapshotHarnessV1SessionBootstrap `json:"sessionBootstrap,omitempty"`
+	CredentialRefs            []agentExecutionSnapshotSecretRef                `json:"credentialRefs,omitempty"`
+}
+
+// agentExecutionSnapshotHarnessV1SessionBootstrap freezes the canonical
+// transcript suffix used to give a fresh v1 CLI process conversation context.
+// The rendered JSONL is kept inside the encrypted, content-addressed snapshot
+// so dispatch and recovery never re-read mutable transcript state.
+type agentExecutionSnapshotHarnessV1SessionBootstrap struct {
+	SchemaVersion   int    `json:"schemaVersion"`
+	SessionUID      string `json:"sessionUID"`
+	ControlVersion  int64  `json:"controlVersion"`
+	LeaseGeneration int64  `json:"leaseGeneration"`
+	Artifact        string `json:"artifact"`
+	Digest          string `json:"digest"`
+	MessageCount    uint32 `json:"messageCount"`
+	TotalMessages   int    `json:"totalMessages"`
+	Truncated       bool   `json:"truncated,omitempty"`
+}
+
+type agentExecutionSnapshotSecretRef struct {
+	Role            string   `json:"role"`
+	Namespace       string   `json:"namespace"`
+	Name            string   `json:"name"`
+	UID             string   `json:"uid"`
+	ResourceVersion string   `json:"resourceVersion"`
+	Keys            []string `json:"keys"`
+}
+
+type verifiedAgentExecution struct {
+	binding          *corev1alpha1.AgentExecutionBinding
+	snapshot         *store.AgentExecutionSnapshot
+	body             agentExecutionSnapshotBody
+	plan             ACPRuntimePlan
+	frozenTask       *corev1alpha1.Task
+	configuration    harnessv2.AgentSessionConfiguration
+	mcpConfiguration harnessv2.MCPPolicyConfiguration
+}
+
+// resolveAgentExecutionCandidate performs pure candidate resolution for an
+// explicitly v2-classified built-in agent Task: it resolves the frozen session
+// configuration and runtime plan, assembles the snapshot body, and computes
+// the canonical binding. It performs no durable writes.
+func (r *TaskReconciler) resolveAgentExecutionCandidate(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	agent *corev1alpha1.Agent,
+) (*agentExecutionCandidate, error) {
+	if r.AgentExecutionSnapshots == nil {
+		return nil, errors.New("encrypted agent execution snapshot store is required; execution admission fails closed")
+	}
+	if task == nil || task.UID == "" || task.Generation < 1 {
+		return nil, errors.New("task UID and positive spec generation are required for execution binding")
+	}
+	reader := r.APIReader
+	if reader == nil {
+		reader = r.Client
+	}
+	configuration, err := resolveACPAgentSessionConfiguration(ctx, reader, task, agent)
+	if err != nil {
+		return nil, err
+	}
+	plan, err := PlanACPRuntimeWithConfiguration(task, agent, r.ACPRuntimeImages, configuration)
+	if err != nil {
+		return nil, permanentACPAgentConfiguration(err)
+	}
+	var mcpConfiguration harnessv2.MCPPolicyConfiguration
+	if r.MCPRegistry != nil {
+		mcpConfiguration, err = buildRuntimeSessionMCPConfigurationWithRegistry(
+			ctx, reader, task, agent, plan.Profile, r.MCPRegistry,
+		)
+	} else {
+		mcpConfiguration, err = buildRuntimeSessionMCPConfiguration(
+			ctx, reader, task, agent, plan.Profile,
+		)
+	}
+	if err != nil {
+		return nil, fmt.Errorf("resolve frozen ACP MCP configuration: %w", err)
+	}
+
+	namespace := &corev1.Namespace{}
+	if err := reader.Get(ctx, types.NamespacedName{Name: task.Namespace}, namespace); err != nil {
+		return nil, fmt.Errorf("resolve task namespace identity: %w", err)
+	}
+
+	body := agentExecutionSnapshotBody{
+		SchemaVersion:   store.AgentExecutionSnapshotSchemaVersion,
+		ContractVersion: string(corev1alpha1.AgentRuntimeContractHarnessV2),
+		Backend:         string(corev1alpha1.AgentExecutionBackendRuntimePool),
+		RuntimeType:     string(agent.Spec.Runtime.Type),
+		Agent: agentExecutionSnapshotAgent{
+			Namespace:  agent.Namespace,
+			Name:       agent.Name,
+			UID:        string(agent.UID),
+			Generation: agent.Generation,
+		},
+		Configuration: agentExecutionSnapshotConfig{
+			AgentUID:        configuration.AgentUID,
+			AgentGeneration: configuration.AgentGeneration,
+			ProviderKind:    configuration.ProviderKind,
+			Model:           configuration.Model,
+			MaxTurns:        configuration.MaxTurns,
+			ReasoningEffort: configuration.ReasoningEffort,
+			SystemPrompt:    configuration.SystemPrompt,
+		},
+		RuntimeImage:     plan.Image,
+		RuntimeProfile:   plan.Profile,
+		ProfileDigest:    string(plan.Digest),
+		PoolName:         plan.PoolName,
+		MCPConfiguration: &mcpConfiguration,
+		Prompt:           task.Spec.Prompt,
+		RetryPolicy:      task.Spec.RetryPolicy.DeepCopy(),
+		SessionRef:       task.Spec.SessionRef.DeepCopy(),
+		Workspace:        task.Spec.Workspace.DeepCopy(),
+		RuntimeOverride:  task.Spec.AgentRuntime.DeepCopy(),
+	}
+	if task.Spec.Timeout != nil {
+		body.Timeout = task.Spec.Timeout.Duration.String()
+	}
+	if agent.Spec.Runtime.DefaultAllowedTools != nil || agent.Spec.Runtime.DefaultAllowBash != nil {
+		body.DefaultTools = &agentExecutionSnapshotToolPolicy{
+			AllowedToolsOmitted: agent.Spec.Runtime.DefaultAllowedTools == nil,
+			AllowedTools:        append([]string(nil), agent.Spec.Runtime.DefaultAllowedTools...),
+			AllowBash:           agent.Spec.Runtime.DefaultAllowBash,
+		}
+	}
+
+	encoded, err := canonicalAgentExecutionSnapshotBody(body)
+	if err != nil {
+		return nil, err
+	}
+	snapshotDigest := store.CanonicalAgentExecutionSnapshotDigest(encoded)
+
+	binding := corev1alpha1.AgentExecutionBinding{
+		SchemaVersion:   1,
+		ContractVersion: corev1alpha1.AgentRuntimeContractHarnessV2,
+		Backend:         corev1alpha1.AgentExecutionBackendRuntimePool,
+		Task: corev1alpha1.AgentExecutionBindingTaskRef{
+			NamespaceUID:        namespace.UID,
+			UID:                 task.UID,
+			BoundSpecGeneration: task.Generation,
+		},
+		Agent: &corev1alpha1.AgentExecutionAgentRef{
+			Namespace:  agent.Namespace,
+			Name:       agent.Name,
+			UID:        agent.UID,
+			Generation: agent.Generation,
+		},
+		Snapshot: corev1alpha1.AgentExecutionSnapshotRef{
+			ID:            string(task.UID) + "/" + snapshotDigest,
+			Digest:        snapshotDigest,
+			SchemaVersion: store.AgentExecutionSnapshotSchemaVersion,
+		},
+		RuntimeType:                       agent.Spec.Runtime.Type,
+		RuntimeProfileDigest:              string(plan.Digest),
+		RuntimeProfileDigestSchemaVersion: 1,
+	}
+
+	digest, err := canonicalAgentExecutionBindingDigest(binding)
+	if err != nil {
+		return nil, err
+	}
+	binding.BindingDigest = digest
+	binding.BoundAt = metav1.Now()
+
+	return &agentExecutionCandidate{binding: binding, snapshotBody: encoded}, nil
+}
+
+// canonicalAgentExecutionBindingDigest computes the canonical binding digest
+// over the binding with its digest and timestamp cleared, so re-resolution of
+// identical inputs is digest-stable across reconciles.
+func canonicalAgentExecutionBindingDigest(binding corev1alpha1.AgentExecutionBinding) (string, error) {
+	normalized := *binding.DeepCopy()
+	normalized.BindingDigest = ""
+	normalized.BoundAt = metav1.Time{}
+	return acpDomainDigest("agent-execution-binding", normalized)
+}
+
+func canonicalAgentExecutionSnapshotBody(body agentExecutionSnapshotBody) ([]byte, error) {
+	encoded, err := harnessv2.CanonicalValue(body)
+	if err != nil {
+		return nil, fmt.Errorf("canonicalize snapshot body: %w", err)
+	}
+	return encoded, nil
+}
+
+// persistAgentExecutionSnapshot idempotently stores the immutable snapshot.
+func (r *TaskReconciler) persistAgentExecutionSnapshot(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	candidate *agentExecutionCandidate,
+) error {
+	return r.AgentExecutionSnapshots.PersistAgentExecutionSnapshot(ctx, store.AgentExecutionSnapshot{
+		TaskUID:       string(task.UID),
+		Digest:        candidate.binding.Snapshot.Digest,
+		SchemaVersion: candidate.binding.Snapshot.SchemaVersion,
+		Body:          candidate.snapshotBody,
+	})
+}
+
+// errAgentExecutionBindingConflict marks a permanent conflict: an existing
+// binding never gets overwritten and the Task never dispatches under a
+// mismatched candidate.
+type errAgentExecutionBindingConflict struct {
+	existingDigest  string
+	candidateDigest string
+}
+
+func (e *errAgentExecutionBindingConflict) Error() string {
+	return fmt.Sprintf("task already carries immutable execution binding %s; refusing to replace it with %s",
+		e.existingDigest, e.candidateDigest)
+}
+
+// persistAgentExecutionBinding implements the uncached compare-if-absent
+// write-once binding CAS. It never overwrites an existing binding.
+func (r *TaskReconciler) persistAgentExecutionBinding(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	candidate *agentExecutionCandidate,
+) (*corev1alpha1.AgentExecutionBinding, error) {
+	reader := r.APIReader
+	if reader == nil {
+		reader = r.Client
+	}
+	current := &corev1alpha1.Task{}
+	if err := reader.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, current); err != nil {
+		return nil, fmt.Errorf("uncached task read before binding: %w", err)
+	}
+	if current.UID != task.UID {
+		return nil, fmt.Errorf("task UID changed from %s to %s; never dispatching", task.UID, current.UID)
+	}
+	// A matching persisted binding is authoritative even if this reconcile is
+	// recovering an ambiguous status-patch response.
+	if existing := current.Status.AgentExecutionBinding; existing != nil {
+		if existing.BindingDigest == candidate.binding.BindingDigest {
+			return existing, nil
+		}
+		return nil, &errAgentExecutionBindingConflict{
+			existingDigest:  existing.BindingDigest,
+			candidateDigest: candidate.binding.BindingDigest,
+		}
+	}
+	if current.Generation != candidate.binding.Task.BoundSpecGeneration {
+		return nil, fmt.Errorf("task spec generation changed from bound candidate %d to %d; refusing stale binding",
+			candidate.binding.Task.BoundSpecGeneration, current.Generation)
+	}
+	if !current.DeletionTimestamp.IsZero() {
+		return nil, fmt.Errorf("task is deleting; a deleting task may be classified only for cleanup and never dispatches")
+	}
+	if !controllerutil.ContainsFinalizer(current, labels.TaskFinalizer) {
+		return nil, errors.New("task cleanup finalizer is missing; refusing to persist an executable binding")
+	}
+	base := current.DeepCopy()
+	current.Status.AgentExecutionBinding = candidate.binding.DeepCopy()
+	if err := r.Status().Patch(ctx, current, client.MergeFromWithOptions(base, client.MergeFromWithOptimisticLock{})); err != nil {
+		// A transport error can arrive after the API server committed the status
+		// patch. Re-read before classifying the failure so an exact binding is
+		// recognized instead of treated as a conflicting retry.
+		latest := &corev1alpha1.Task{}
+		if readErr := reader.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, latest); readErr == nil &&
+			latest.UID == task.UID {
+			if existing := latest.Status.AgentExecutionBinding; existing != nil {
+				if existing.BindingDigest == candidate.binding.BindingDigest {
+					return existing, nil
+				}
+				return nil, &errAgentExecutionBindingConflict{
+					existingDigest:  existing.BindingDigest,
+					candidateDigest: candidate.binding.BindingDigest,
+				}
+			}
+		}
+		return nil, fmt.Errorf("write-once binding patch: %w", err)
+	}
+	return current.Status.AgentExecutionBinding, nil
+}
+
+func decodeAgentExecutionSnapshot(body []byte) (agentExecutionSnapshotBody, error) {
+	decoder := json.NewDecoder(bytes.NewReader(body))
+	decoder.DisallowUnknownFields()
+	var decoded agentExecutionSnapshotBody
+	if err := decoder.Decode(&decoded); err != nil {
+		return agentExecutionSnapshotBody{}, fmt.Errorf("decode agent execution snapshot: %w", err)
+	}
+	if err := decoder.Decode(&struct{}{}); !errors.Is(err, io.EOF) {
+		if err == nil {
+			return agentExecutionSnapshotBody{}, errors.New("decode agent execution snapshot: multiple JSON values")
+		}
+		return agentExecutionSnapshotBody{}, fmt.Errorf("decode agent execution snapshot trailer: %w", err)
+	}
+	return decoded, nil
+}
+
+//nolint:gocyclo // Snapshot validation intentionally checks every immutable v2 execution field together.
+func validateAgentExecutionSnapshot(
+	binding *corev1alpha1.AgentExecutionBinding,
+	snapshot *store.AgentExecutionSnapshot,
+	body agentExecutionSnapshotBody,
+) (ACPRuntimePlan, harnessv2.AgentSessionConfiguration, harnessv2.MCPPolicyConfiguration, error) {
+	if binding == nil || snapshot == nil {
+		return ACPRuntimePlan{}, harnessv2.AgentSessionConfiguration{}, harnessv2.MCPPolicyConfiguration{}, errors.New("binding and execution snapshot are required")
+	}
+	key := store.AgentExecutionSnapshotKey{TaskUID: string(binding.Task.UID), Digest: binding.Snapshot.Digest}
+	if binding.Snapshot.ID != key.ID() || snapshot.TaskUID != key.TaskUID || snapshot.Digest != key.Digest {
+		return ACPRuntimePlan{}, harnessv2.AgentSessionConfiguration{}, harnessv2.MCPPolicyConfiguration{}, errors.New("execution snapshot identity does not exactly match the binding")
+	}
+	if binding.Snapshot.SchemaVersion != store.AgentExecutionSnapshotSchemaVersion ||
+		snapshot.SchemaVersion != binding.Snapshot.SchemaVersion || body.SchemaVersion != binding.Snapshot.SchemaVersion {
+		return ACPRuntimePlan{}, harnessv2.AgentSessionConfiguration{}, harnessv2.MCPPolicyConfiguration{}, fmt.Errorf("unsupported or mismatched execution snapshot schema version")
+	}
+	if binding.SchemaVersion != 1 || binding.RuntimeProfileDigestSchemaVersion != 1 {
+		return ACPRuntimePlan{}, harnessv2.AgentSessionConfiguration{}, harnessv2.MCPPolicyConfiguration{}, errors.New("unsupported execution binding or RuntimeProfile digest schema version")
+	}
+	if computed := store.CanonicalAgentExecutionSnapshotDigest(snapshot.Body); computed != binding.Snapshot.Digest {
+		return ACPRuntimePlan{}, harnessv2.AgentSessionConfiguration{}, harnessv2.MCPPolicyConfiguration{}, fmt.Errorf("execution snapshot body digest %s does not match binding digest %s", computed, binding.Snapshot.Digest)
+	}
+	canonicalBody, err := canonicalAgentExecutionSnapshotBody(body)
+	if err != nil || !bytes.Equal(canonicalBody, snapshot.Body) {
+		return ACPRuntimePlan{}, harnessv2.AgentSessionConfiguration{}, harnessv2.MCPPolicyConfiguration{}, errors.New("execution snapshot body is not canonical")
+	}
+	if body.ContractVersion != string(binding.ContractVersion) || body.Backend != string(binding.Backend) ||
+		body.RuntimeType != string(binding.RuntimeType) || binding.Agent == nil ||
+		body.Agent.Namespace != binding.Agent.Namespace || body.Agent.Name != binding.Agent.Name ||
+		body.Agent.UID != string(binding.Agent.UID) || body.Agent.Generation != binding.Agent.Generation {
+		return ACPRuntimePlan{}, harnessv2.AgentSessionConfiguration{}, harnessv2.MCPPolicyConfiguration{}, errors.New("execution snapshot route or Agent identity does not exactly match the binding")
+	}
+	configuration := harnessv2.AgentSessionConfiguration{
+		AgentUID: body.Configuration.AgentUID, AgentGeneration: body.Configuration.AgentGeneration,
+		ProviderKind: body.Configuration.ProviderKind, Model: body.Configuration.Model,
+		MaxTurns: body.Configuration.MaxTurns, ReasoningEffort: body.Configuration.ReasoningEffort,
+		SystemPrompt: body.Configuration.SystemPrompt,
+	}
+	if configuration.AgentUID != body.Agent.UID || configuration.AgentGeneration != body.Agent.Generation {
+		return ACPRuntimePlan{}, harnessv2.AgentSessionConfiguration{}, harnessv2.MCPPolicyConfiguration{}, errors.New("execution snapshot configuration Agent identity is inconsistent")
+	}
+	if body.RuntimeType != body.Configuration.ProviderKind || body.RuntimeType != body.RuntimeProfile.ProviderKind {
+		return ACPRuntimePlan{}, harnessv2.AgentSessionConfiguration{}, harnessv2.MCPPolicyConfiguration{}, errors.New("execution snapshot runtime type is inconsistent with the frozen configuration/profile")
+	}
+	if body.Timeout != "" {
+		if _, err := time.ParseDuration(body.Timeout); err != nil {
+			return ACPRuntimePlan{}, harnessv2.AgentSessionConfiguration{}, harnessv2.MCPPolicyConfiguration{}, fmt.Errorf("validate frozen Task timeout: %w", err)
+		}
+	}
+	if err := body.RuntimeProfile.Validate(); err != nil {
+		return ACPRuntimePlan{}, harnessv2.AgentSessionConfiguration{}, harnessv2.MCPPolicyConfiguration{}, fmt.Errorf("validate frozen RuntimeProfile: %w", err)
+	}
+	if err := configuration.ValidateProfile(body.RuntimeProfile); err != nil {
+		return ACPRuntimePlan{}, harnessv2.AgentSessionConfiguration{}, harnessv2.MCPPolicyConfiguration{}, fmt.Errorf("validate frozen Agent configuration: %w", err)
+	}
+	if body.MCPConfiguration == nil {
+		return ACPRuntimePlan{}, harnessv2.AgentSessionConfiguration{}, harnessv2.MCPPolicyConfiguration{}, errors.New("execution snapshot is missing the frozen MCP policy configuration")
+	}
+	mcpConfiguration := *body.MCPConfiguration
+	if err := mcpConfiguration.ValidateProfile(body.RuntimeProfile); err != nil {
+		return ACPRuntimePlan{}, harnessv2.AgentSessionConfiguration{}, harnessv2.MCPPolicyConfiguration{}, fmt.Errorf("validate frozen MCP policy configuration: %w", err)
+	}
+	profileDigest, err := harnessv2.CanonicalProfileDigest(body.RuntimeProfile)
+	if err != nil {
+		return ACPRuntimePlan{}, harnessv2.AgentSessionConfiguration{}, harnessv2.MCPPolicyConfiguration{}, fmt.Errorf("digest frozen RuntimeProfile: %w", err)
+	}
+	if string(profileDigest) != body.ProfileDigest || body.ProfileDigest != binding.RuntimeProfileDigest {
+		return ACPRuntimePlan{}, harnessv2.AgentSessionConfiguration{}, harnessv2.MCPPolicyConfiguration{}, errors.New("frozen RuntimeProfile digest does not exactly match the binding")
+	}
+	if !ACPRuntimeImageAvailable(body.RuntimeImage) {
+		return ACPRuntimePlan{}, harnessv2.AgentSessionConfiguration{}, harnessv2.MCPPolicyConfiguration{}, errors.New("frozen runtime image is not digest pinned")
+	}
+	poolIdentityDigest, err := acpDomainDigest("runtime-pool-identity", map[string]string{
+		"profileDigest": body.ProfileDigest, "runtimeImage": body.RuntimeImage,
+	})
+	if err != nil {
+		return ACPRuntimePlan{}, harnessv2.AgentSessionConfiguration{}, harnessv2.MCPPolicyConfiguration{}, err
+	}
+	wantPoolName := acpRuntimePoolName(body.RuntimeType, harnessv2.ProfileDigest(poolIdentityDigest))
+	if strings.TrimSpace(body.PoolName) == "" || body.PoolName != wantPoolName {
+		return ACPRuntimePlan{}, harnessv2.AgentSessionConfiguration{}, harnessv2.MCPPolicyConfiguration{}, errors.New("frozen RuntimePool identity is inconsistent")
+	}
+	return ACPRuntimePlan{
+		PoolName: body.PoolName, Image: body.RuntimeImage, Profile: body.RuntimeProfile, Digest: profileDigest,
+	}, configuration, mcpConfiguration, nil
+}
+
+func frozenTaskFromAgentExecutionSnapshot(task *corev1alpha1.Task, binding *corev1alpha1.AgentExecutionBinding, body agentExecutionSnapshotBody) *corev1alpha1.Task {
+	frozen := task.DeepCopy()
+	frozen.Generation = binding.Task.BoundSpecGeneration
+	frozen.Spec.Prompt = body.Prompt
+	frozen.Spec.Timeout = nil
+	if body.Timeout != "" {
+		if duration, err := time.ParseDuration(body.Timeout); err == nil {
+			frozen.Spec.Timeout = &metav1.Duration{Duration: duration}
+		}
+	}
+	frozen.Spec.SessionRef = body.SessionRef.DeepCopy()
+	frozen.Spec.Workspace = body.Workspace.DeepCopy()
+	frozen.Spec.AgentRuntime = body.RuntimeOverride.DeepCopy()
+	frozen.Spec.RetryPolicy = body.RetryPolicy.DeepCopy()
+	return frozen
+}
+
+// loadVerifiedBoundExecution re-reads the Task, backend control, and encrypted
+// snapshot uncached immediately before executor demand is persisted.
+func (r *TaskReconciler) loadVerifiedBoundExecution(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	binding *corev1alpha1.AgentExecutionBinding,
+) (*verifiedAgentExecution, error) {
+	if r.AgentExecutionSnapshots == nil {
+		return nil, errors.New("encrypted agent execution snapshot store is required; execution fails closed")
+	}
+	if task == nil || binding == nil {
+		return nil, errors.New("task and execution binding are required")
+	}
+	reader := r.APIReader
+	if reader == nil {
+		reader = r.Client
+	}
+	current := &corev1alpha1.Task{}
+	if err := reader.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, current); err != nil {
+		return nil, fmt.Errorf("uncached task read before executor side effect: %w", err)
+	}
+	if current.UID != task.UID {
+		return nil, fmt.Errorf("task UID changed after binding; never dispatching")
+	}
+	if !current.DeletionTimestamp.IsZero() {
+		return nil, fmt.Errorf("task began deleting after binding; dispatch is cancelled")
+	}
+	persisted := current.Status.AgentExecutionBinding
+	if persisted == nil || persisted.BindingDigest != binding.BindingDigest {
+		return nil, fmt.Errorf("persisted binding does not match the verified candidate; refusing to dispatch")
+	}
+	canonicalDigest, err := canonicalAgentExecutionBindingDigest(*persisted)
+	if err != nil || canonicalDigest != persisted.BindingDigest {
+		return nil, fmt.Errorf("persisted binding failed canonical integrity verification")
+	}
+	if persisted.Task.UID != current.UID || persisted.Task.BoundSpecGeneration != current.Generation {
+		return nil, fmt.Errorf("task UID/spec generation no longer exactly matches the immutable binding")
+	}
+	namespace := &corev1.Namespace{}
+	if err := reader.Get(ctx, types.NamespacedName{Name: current.Namespace}, namespace); err != nil {
+		return nil, fmt.Errorf("uncached namespace identity read before executor side effect: %w", err)
+	}
+	if namespace.UID == "" || namespace.UID != persisted.Task.NamespaceUID {
+		return nil, errors.New("task namespace identity no longer exactly matches the immutable binding")
+	}
+	if persisted.ContractVersion != corev1alpha1.AgentRuntimeContractHarnessV2 || persisted.Backend != corev1alpha1.AgentExecutionBackendRuntimePool {
+		return nil, fmt.Errorf("binding route %s/%s is not dispatchable by the ACP executor", persisted.ContractVersion, persisted.Backend)
+	}
+	snapshot, err := r.AgentExecutionSnapshots.GetAgentExecutionSnapshot(ctx, store.AgentExecutionSnapshotKey{
+		TaskUID: string(persisted.Task.UID), Digest: persisted.Snapshot.Digest,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("load immutable execution snapshot: %w", err)
+	}
+	body, err := decodeAgentExecutionSnapshot(snapshot.Body)
+	if err != nil {
+		return nil, err
+	}
+	plan, configuration, mcpConfiguration, err := validateAgentExecutionSnapshot(persisted, snapshot, body)
+	if err != nil {
+		return nil, err
+	}
+	return &verifiedAgentExecution{
+		binding: persisted.DeepCopy(), snapshot: snapshot, body: body, plan: plan,
+		frozenTask: frozenTaskFromAgentExecutionSnapshot(current, persisted, body), configuration: configuration,
+		mcpConfiguration: mcpConfiguration,
+	}, nil
+}
+
+// verifyBoundExecution preserves the narrow verification API used by binding
+// reconciliation while sharing the exact queue-time verification path.
+func (r *TaskReconciler) verifyBoundExecution(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	binding *corev1alpha1.AgentExecutionBinding,
+) error {
+	_, err := r.loadVerifiedBoundExecution(ctx, task, binding)
+	return err
+}
+
+// ensureAgentExecutionBinding runs the binding stage for the ACP execution
+// path. It returns handled=true when the caller must return the result
+// immediately (failure or requeue) and handled=false when dispatch may
+// proceed under a verified binding.
+func (r *TaskReconciler) ensureAgentExecutionBinding(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	agent *corev1alpha1.Agent,
+) (ctrl.Result, error, bool) {
+	log := logf.FromContext(ctx)
+	if task == nil {
+		return ctrl.Result{}, errors.New("task is required for execution binding"), true
+	}
+	reader := r.APIReader
+	if reader == nil {
+		reader = r.Client
+	}
+	if task.Status.AgentExecutionBinding == nil {
+		current := &corev1alpha1.Task{}
+		if err := reader.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, current); err != nil {
+			log.Error(err, "uncached Task read before execution binding")
+			return ctrl.Result{RequeueAfter: 2 * time.Second}, nil, true
+		}
+		if current.UID != task.UID {
+			log.Error(errors.New("task UID changed"), "execution binding withheld")
+			return ctrl.Result{RequeueAfter: 5 * time.Second}, nil, true
+		}
+		if current.Status.AgentExecutionBinding != nil {
+			task = current
+		}
+	}
+	if existing := task.Status.AgentExecutionBinding; existing != nil {
+		if err := r.verifyBoundExecution(ctx, task, existing); err != nil {
+			log.Error(err, "bound execution verification failed")
+			return ctrl.Result{RequeueAfter: 5 * time.Second}, nil, true
+		}
+		return ctrl.Result{}, nil, false
+	}
+
+	candidate, err := r.resolveAgentExecutionCandidate(ctx, task, agent)
+	if err != nil {
+		if isPermanentACPAgentConfigurationError(err) {
+			result, failErr := r.failACPPlanningTask(
+				ctx, task, corev1alpha1.TaskExecutionReason("InvalidRuntimeProfile"), err.Error(),
+			)
+			return result, failErr, true
+		}
+		log.Error(err, "agent execution candidate resolution failed")
+		return ctrl.Result{RequeueAfter: 5 * time.Second}, nil, true
+	}
+	if err := r.persistAgentExecutionSnapshot(ctx, task, candidate); err != nil {
+		log.Error(err, "immutable execution snapshot persistence failed")
+		return ctrl.Result{RequeueAfter: 5 * time.Second}, nil, true
+	}
+	binding, err := r.persistAgentExecutionBinding(ctx, task, candidate)
+	if err != nil {
+		conflict := &errAgentExecutionBindingConflict{}
+		if errors.As(err, &conflict) {
+			if r.Recorder != nil {
+				r.Recorder.Eventf(task, corev1.EventTypeWarning, agentExecutionBindingConflictReason, "%s", err.Error())
+			}
+			result, failErr := r.failTask(ctx, task, err.Error())
+			return result, failErr, true
+		}
+		log.Error(err, "write-once binding persistence failed")
+		return ctrl.Result{RequeueAfter: 2 * time.Second}, nil, true
+	}
+	task.Status.AgentExecutionBinding = binding
+	if err := r.verifyBoundExecution(ctx, task, binding); err != nil {
+		log.Error(err, "bound execution verification failed after binding")
+		return ctrl.Result{RequeueAfter: 5 * time.Second}, nil, true
+	}
+	return ctrl.Result{}, nil, false
+}
diff --git a/internal/controller/agent_execution_binding_test.go b/internal/controller/agent_execution_binding_test.go
new file mode 100644
index 000000000..28061bb22
--- /dev/null
+++ b/internal/controller/agent_execution_binding_test.go
@@ -0,0 +1,530 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package controller
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	types "k8s.io/apimachinery/pkg/types"
+	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/client-go/tools/record"
+	"k8s.io/utils/ptr"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/labels"
+	"github.com/orka-agents/orka/internal/store"
+	"github.com/orka-agents/orka/internal/store/sqlite"
+)
+
+func bindingTestScheme(t *testing.T) *runtime.Scheme {
+	t.Helper()
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	if err := clientgoscheme.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
+	}
+	return scheme
+}
+
+func bindingTestTask() *corev1alpha1.Task {
+	return &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "default", Name: "task",
+			UID: types.UID("11111111-1111-1111-1111-111111111111"), Generation: 2,
+			Finalizers: []string{labels.TaskFinalizer},
+		},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent, Prompt: "implement the fix",
+			AgentRef: &corev1alpha1.AgentReference{Name: "agent"},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				Intent: corev1alpha1.WorkspaceIntentRead, GitRepo: "https://github.com/orka-agents/orka.git",
+			},
+		},
+	}
+}
+
+func TestPersistAgentExecutionBindingRequiresCleanupFinalizerAtCAS(t *testing.T) {
+	ctx := context.Background()
+	task := bindingTestTask()
+	agent := bindingTestAgent()
+	reconciler, _ := newBindingTestReconciler(t, task, bindingTestNamespace())
+	candidate, err := reconciler.resolveAgentExecutionCandidate(ctx, task, agent)
+	if err != nil {
+		t.Fatal(err)
+	}
+	current := &corev1alpha1.Task{}
+	if err := reconciler.Get(ctx, client.ObjectKeyFromObject(task), current); err != nil {
+		t.Fatal(err)
+	}
+	current.Finalizers = nil
+	if err := reconciler.Update(ctx, current); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := reconciler.persistAgentExecutionBinding(ctx, task, candidate); err == nil ||
+		!strings.Contains(err.Error(), "cleanup finalizer is missing") {
+		t.Fatalf("missing-finalizer binding error = %v, want refusal", err)
+	}
+	if err := reconciler.Get(ctx, client.ObjectKeyFromObject(task), current); err != nil {
+		t.Fatal(err)
+	}
+	if current.Status.AgentExecutionBinding != nil {
+		t.Fatalf("binding persisted after finalizer removal: %+v", current.Status.AgentExecutionBinding)
+	}
+}
+
+func bindingTestAgent() *corev1alpha1.Agent {
+	return &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "default", Name: "agent",
+			UID: types.UID("22222222-2222-2222-2222-222222222222"), Generation: 3,
+		},
+		Spec: corev1alpha1.AgentSpec{
+			Model:        &corev1alpha1.ModelConfig{Name: acpTestModel},
+			SystemPrompt: &corev1alpha1.PromptSource{Inline: "You are a careful engineer."},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeCodex,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
+		},
+	}
+}
+
+func bindingTestNamespace() *corev1.Namespace {
+	return &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{
+		Name: "default", UID: types.UID("33333333-3333-3333-3333-333333333333"),
+	}}
+}
+
+func newBindingTestReconciler(t *testing.T, objects ...client.Object) (*TaskReconciler, *sqlite.Store) {
+	t.Helper()
+	scheme := bindingTestScheme(t)
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).
+		WithStatusSubresource(&corev1alpha1.Task{}, &corev1alpha1.RuntimePool{}).
+		WithObjects(objects...).Build()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "binding.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	snapshotStore := sqlite.NewStore(db, "test")
+	cipher, err := sqlite.NewAgentExecutionSnapshotCipher(bytes.Repeat([]byte{0x24}, sqlite.AgentExecutionSnapshotKeyBytes))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := snapshotStore.SetAgentExecutionSnapshotCipher(cipher); err != nil {
+		t.Fatal(err)
+	}
+	return &TaskReconciler{
+		Client: kubeClient, Scheme: scheme, Recorder: record.NewFakeRecorder(10),
+		AgentExecutionSnapshots: snapshotStore,
+		ACPRuntimeEnabled:       true, ACPRuntimeNamespace: "orka-runtimes",
+		ACPRuntimeImages: ACPRuntimeImages{Codex: "docker.io/example/codex@sha256:" + strings.Repeat("a", 64)},
+	}, snapshotStore
+}
+
+func TestEnsureAgentExecutionBindingFreezesSnapshotBeforeDispatch(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	task := bindingTestTask()
+	agent := bindingTestAgent()
+	reconciler, snapshots := newBindingTestReconciler(t, task, bindingTestNamespace())
+
+	if reconciler.AgentExecutionSnapshots == nil {
+		t.Fatal("binding stage requires a snapshot store")
+	}
+
+	live := task.DeepCopy()
+	_, err, handled := reconciler.ensureAgentExecutionBinding(ctx, live, agent)
+	if err != nil || handled {
+		t.Fatalf("ensure binding = handled=%v err=%v", handled, err)
+	}
+
+	bound := &corev1alpha1.Task{}
+	if err := reconciler.Get(ctx, types.NamespacedName{Namespace: "default", Name: "task"}, bound); err != nil {
+		t.Fatal(err)
+	}
+	binding := bound.Status.AgentExecutionBinding
+	if binding == nil {
+		t.Fatal("binding was not persisted before dispatch")
+	}
+	if binding.ContractVersion != corev1alpha1.AgentRuntimeContractHarnessV2 ||
+		binding.Backend != corev1alpha1.AgentExecutionBackendRuntimePool {
+		t.Fatalf("unexpected binding route: %+v", binding)
+	}
+	if binding.Task.NamespaceUID != "33333333-3333-3333-3333-333333333333" || binding.Task.UID != task.UID {
+		t.Fatalf("binding task identity = %+v", binding.Task)
+	}
+	if !strings.HasPrefix(binding.Snapshot.ID, string(task.UID)+"/sha256:") {
+		t.Fatalf("snapshot ID = %q", binding.Snapshot.ID)
+	}
+
+	// The immutable snapshot is durable, encrypted, and contains the resolved
+	// executable inputs.
+	snapshot, err := snapshots.GetAgentExecutionSnapshot(ctx, store.AgentExecutionSnapshotKey{
+		TaskUID: string(task.UID), Digest: binding.Snapshot.Digest,
+	})
+	if err != nil {
+		t.Fatalf("get snapshot: %v", err)
+	}
+	for _, required := range []string{"implement the fix", "You are a careful engineer.", "runtimeImage", "profileDigest"} {
+		if !strings.Contains(string(snapshot.Body), required) {
+			t.Fatalf("snapshot body is missing %q: %s", required, snapshot.Body)
+		}
+	}
+
+	// A second pass verifies the existing binding instead of re-binding.
+	_, err, handled = reconciler.ensureAgentExecutionBinding(ctx, bound, agent)
+	if err != nil || handled {
+		t.Fatalf("verify pass = handled=%v err=%v", handled, err)
+	}
+	again := &corev1alpha1.Task{}
+	if err := reconciler.Get(ctx, types.NamespacedName{Namespace: "default", Name: "task"}, again); err != nil {
+		t.Fatal(err)
+	}
+	if again.Status.AgentExecutionBinding.BindingDigest != binding.BindingDigest {
+		t.Fatal("verify pass must not rewrite the binding")
+	}
+}
+
+func TestResolveAgentExecutionCandidateDigestIsStable(t *testing.T) {
+	ctx := context.Background()
+	task := bindingTestTask()
+	agent := bindingTestAgent()
+	reconciler, _ := newBindingTestReconciler(t, task, bindingTestNamespace())
+
+	first, err := reconciler.resolveAgentExecutionCandidate(ctx, task, agent)
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := reconciler.resolveAgentExecutionCandidate(ctx, task, agent)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if first.binding.BindingDigest != second.binding.BindingDigest {
+		t.Fatalf("binding digest is not stable: %s vs %s", first.binding.BindingDigest, second.binding.BindingDigest)
+	}
+	if first.binding.Snapshot.Digest != second.binding.Snapshot.Digest {
+		t.Fatal("snapshot digest is not stable")
+	}
+
+	// Changing an executable input changes the candidate identity.
+	changed := agent.DeepCopy()
+	changed.Spec.SystemPrompt = &corev1alpha1.PromptSource{Inline: "different prompt"}
+	third, err := reconciler.resolveAgentExecutionCandidate(ctx, task, changed)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if third.binding.Snapshot.Digest == first.binding.Snapshot.Digest {
+		t.Fatal("snapshot digest must change when executable inputs change")
+	}
+}
+
+func TestPersistAgentExecutionBindingNeverOverwrites(t *testing.T) {
+	ctx := context.Background()
+	task := bindingTestTask()
+	agent := bindingTestAgent()
+	reconciler, _ := newBindingTestReconciler(t, task, bindingTestNamespace())
+
+	candidate, err := reconciler.resolveAgentExecutionCandidate(ctx, task, agent)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := reconciler.persistAgentExecutionBinding(ctx, task, candidate); err != nil {
+		t.Fatal(err)
+	}
+	// The identical candidate replays idempotently.
+	if _, err := reconciler.persistAgentExecutionBinding(ctx, task, candidate); err != nil {
+		t.Fatalf("idempotent persist: %v", err)
+	}
+
+	// A mismatched candidate is a permanent conflict and never overwrites.
+	changedAgent := agent.DeepCopy()
+	changedAgent.Spec.SystemPrompt = &corev1alpha1.PromptSource{Inline: "changed"}
+	mismatched, err := reconciler.resolveAgentExecutionCandidate(ctx, task, changedAgent)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = reconciler.persistAgentExecutionBinding(ctx, task, mismatched)
+	conflict := &errAgentExecutionBindingConflict{}
+	if !errors.As(err, &conflict) {
+		t.Fatalf("expected binding conflict, got %v", err)
+	}
+
+	stored := &corev1alpha1.Task{}
+	if err := reconciler.Get(ctx, types.NamespacedName{Namespace: "default", Name: "task"}, stored); err != nil {
+		t.Fatal(err)
+	}
+	if stored.Status.AgentExecutionBinding.BindingDigest != candidate.binding.BindingDigest {
+		t.Fatal("conflict must not overwrite the original binding")
+	}
+}
+
+func TestPersistAgentExecutionBindingRefusesDeletingTask(t *testing.T) {
+	ctx := context.Background()
+	task := bindingTestTask()
+	task.Finalizers = []string{"orka.ai/cleanup"}
+	agent := bindingTestAgent()
+	reconciler, _ := newBindingTestReconciler(t, task, bindingTestNamespace())
+
+	candidate, err := reconciler.resolveAgentExecutionCandidate(ctx, task, agent)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := reconciler.Delete(ctx, task.DeepCopy()); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := reconciler.persistAgentExecutionBinding(ctx, task, candidate); err == nil ||
+		!strings.Contains(err.Error(), "deleting") {
+		t.Fatalf("expected deleting-task refusal, got %v", err)
+	}
+}
+
+func TestPersistAgentExecutionBindingRejectsSpecGenerationRace(t *testing.T) {
+	ctx := context.Background()
+	task := bindingTestTask()
+	agent := bindingTestAgent()
+	reconciler, _ := newBindingTestReconciler(t, task, bindingTestNamespace())
+	candidate, err := reconciler.resolveAgentExecutionCandidate(ctx, task, agent)
+	if err != nil {
+		t.Fatal(err)
+	}
+	current := &corev1alpha1.Task{}
+	if err := reconciler.Get(ctx, client.ObjectKeyFromObject(task), current); err != nil {
+		t.Fatal(err)
+	}
+	current.Generation++
+	current.Spec.Prompt = "changed concurrently"
+	if err := reconciler.Update(ctx, current); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := reconciler.persistAgentExecutionBinding(ctx, task, candidate); err == nil ||
+		!strings.Contains(err.Error(), "spec generation changed") {
+		t.Fatalf("expected stale candidate refusal, got %v", err)
+	}
+	if err := reconciler.Get(ctx, client.ObjectKeyFromObject(task), current); err != nil {
+		t.Fatal(err)
+	}
+	if current.Status.AgentExecutionBinding != nil {
+		t.Fatal("generation race persisted a stale immutable binding")
+	}
+}
+
+func TestResolveCandidateFailsClosedWithoutSnapshotStore(t *testing.T) {
+	ctx := context.Background()
+	task := bindingTestTask()
+	agent := bindingTestAgent()
+	reconciler, _ := newBindingTestReconciler(t, task.DeepCopy(), bindingTestNamespace())
+	reconciler.AgentExecutionSnapshots = nil
+	if _, err := reconciler.resolveAgentExecutionCandidate(ctx, task, agent); err == nil ||
+		!strings.Contains(err.Error(), "snapshot store is required") {
+		t.Fatalf("expected missing snapshot store refusal, got %v", err)
+	}
+}
+
+func TestVerifyBoundExecutionDetectsDriftAndDeletion(t *testing.T) {
+	ctx := context.Background()
+	task := bindingTestTask()
+	agent := bindingTestAgent()
+	reconciler, _ := newBindingTestReconciler(t, task, bindingTestNamespace())
+
+	candidate, err := reconciler.resolveAgentExecutionCandidate(ctx, task, agent)
+	if err != nil {
+		t.Fatal(err)
+	}
+	binding, err := reconciler.persistAgentExecutionBinding(ctx, task, candidate)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := reconciler.persistAgentExecutionSnapshot(ctx, task, candidate); err != nil {
+		t.Fatal(err)
+	}
+	if err := reconciler.verifyBoundExecution(ctx, task, binding); err != nil {
+		t.Fatalf("verify bound execution: %v", err)
+	}
+
+	drifted := binding.DeepCopy()
+	drifted.BindingDigest = "sha256:" + strings.Repeat("f", 64)
+	if err := reconciler.verifyBoundExecution(ctx, task, drifted); err == nil {
+		t.Fatal("digest drift must block dispatch")
+	}
+}
+
+func TestQueueACPRuntimeTaskRequiresBindingAndSnapshot(t *testing.T) {
+	ctx := context.Background()
+	task := bindingTestTask()
+	agent := bindingTestAgent()
+	reconciler, snapshots := newBindingTestReconciler(t, task, bindingTestNamespace())
+
+	if _, err := reconciler.queueACPRuntimeTask(ctx, task.DeepCopy(), agent); err == nil ||
+		!strings.Contains(err.Error(), "binding is required") {
+		t.Fatalf("expected unbound queue refusal, got %v", err)
+	}
+	var pools corev1alpha1.RuntimePoolList
+	if err := reconciler.List(ctx, &pools); err != nil {
+		t.Fatal(err)
+	}
+	if len(pools.Items) != 0 {
+		t.Fatalf("unbound queue created RuntimePools: %#v", pools.Items)
+	}
+
+	if _, err, handled := reconciler.ensureAgentExecutionBinding(ctx, task.DeepCopy(), agent); err != nil || handled {
+		t.Fatalf("ensure binding = handled=%v err=%v", handled, err)
+	}
+	bound := &corev1alpha1.Task{}
+	if err := reconciler.Get(ctx, client.ObjectKeyFromObject(task), bound); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := snapshots.DeleteAgentExecutionSnapshots(ctx, string(task.UID)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := reconciler.queueACPRuntimeTask(ctx, bound.DeepCopy(), agent); err == nil ||
+		!strings.Contains(err.Error(), "load immutable execution snapshot") {
+		t.Fatalf("expected missing snapshot refusal, got %v", err)
+	}
+}
+
+func TestQueueACPRuntimeTaskRejectsTaskSpecGenerationRace(t *testing.T) {
+	ctx := context.Background()
+	task := bindingTestTask()
+	agent := bindingTestAgent()
+	reconciler, _ := newBindingTestReconciler(t, task, bindingTestNamespace())
+	if _, err, handled := reconciler.ensureAgentExecutionBinding(ctx, task.DeepCopy(), agent); err != nil || handled {
+		t.Fatalf("ensure binding = handled=%v err=%v", handled, err)
+	}
+	current := &corev1alpha1.Task{}
+	if err := reconciler.Get(ctx, client.ObjectKeyFromObject(task), current); err != nil {
+		t.Fatal(err)
+	}
+	current.Generation++
+	current.Spec.Prompt = "changed after binding"
+	if err := reconciler.Update(ctx, current); err != nil {
+		t.Fatal(err)
+	}
+	if err := reconciler.Get(ctx, client.ObjectKeyFromObject(task), current); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := reconciler.queueACPRuntimeTask(ctx, current, agent); err == nil ||
+		!strings.Contains(err.Error(), "spec generation no longer exactly matches") {
+		t.Fatalf("expected Task generation race refusal, got %v", err)
+	}
+	var pools corev1alpha1.RuntimePoolList
+	if err := reconciler.List(ctx, &pools); err != nil {
+		t.Fatal(err)
+	}
+	if len(pools.Items) != 0 {
+		t.Fatalf("Task generation race created RuntimePools: %#v", pools.Items)
+	}
+}
+
+func TestEnsureAgentExecutionBindingUsesUncachedExistingBinding(t *testing.T) {
+	ctx := context.Background()
+	task := bindingTestTask()
+	agent := bindingTestAgent()
+	reconciler, _ := newBindingTestReconciler(t, task, bindingTestNamespace())
+	if _, err, handled := reconciler.ensureAgentExecutionBinding(ctx, task.DeepCopy(), agent); err != nil || handled {
+		t.Fatalf("ensure binding = handled=%v err=%v", handled, err)
+	}
+	mutatedAgent := agent.DeepCopy()
+	mutatedAgent.Spec.SystemPrompt = &corev1alpha1.PromptSource{Inline: "changed after binding"}
+	if _, err, handled := reconciler.ensureAgentExecutionBinding(ctx, task.DeepCopy(), mutatedAgent); err != nil || handled {
+		t.Fatalf("stale cache should verify uncached binding, handled=%v err=%v", handled, err)
+	}
+}
+
+func TestQueueACPRuntimeTaskUsesFrozenSnapshotAfterLiveInputsMutate(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	task := bindingTestTask()
+	agent := bindingTestAgent()
+	reconciler, durableStore := newBindingTestReconciler(t, task, bindingTestNamespace())
+	reconciler.DurableControlStore = durableStore
+	epochs := NewControllerEpochManager(durableStore, "binding-queue-test")
+	reconciler.ControllerEpochManager = epochs
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	defer func() {
+		cancelEpoch()
+		if err := <-epochDone; err != nil {
+			t.Errorf("stop epoch manager: %v", err)
+		}
+	}()
+	if _, err := epochs.CurrentFence(ctx); err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err, handled := reconciler.ensureAgentExecutionBinding(ctx, task.DeepCopy(), agent); err != nil || handled {
+		t.Fatalf("ensure binding = handled=%v err=%v", handled, err)
+	}
+	boundTask := &corev1alpha1.Task{}
+	if err := reconciler.Get(ctx, client.ObjectKeyFromObject(task), boundTask); err != nil {
+		t.Fatal(err)
+	}
+	verified, err := reconciler.loadVerifiedBoundExecution(ctx, boundTask, boundTask.Status.AgentExecutionBinding)
+	if err != nil {
+		t.Fatal(err)
+	}
+	wantImage := verified.plan.Image
+	wantProfileDigest := string(verified.plan.Digest)
+	wantRequestDigest, err := acpBoundTaskRequestDigest(verified, 1, fmt.Sprintf("prompt-%s-1", task.UID))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	mutatedTask := boundTask.DeepCopy()
+	mutatedTask.Spec.Prompt = "mutable prompt must be ignored"
+	mutatedTask.Spec.Workspace.GitRepo = "https://example.invalid/mutated.git"
+	mutatedAgent := agent.DeepCopy()
+	mutatedAgent.Spec.Model.Name = "mutated/model"
+	mutatedAgent.Spec.SystemPrompt = &corev1alpha1.PromptSource{Inline: "mutable system prompt must be ignored"}
+	reconciler.ACPRuntimeImages.Codex = "docker.io/example/mutated@sha256:" + strings.Repeat("b", 64)
+
+	if _, err := reconciler.queueACPRuntimeTask(ctx, mutatedTask, mutatedAgent); err != nil {
+		t.Fatal(err)
+	}
+	var pools corev1alpha1.RuntimePoolList
+	if err := reconciler.List(ctx, &pools); err != nil {
+		t.Fatal(err)
+	}
+	if len(pools.Items) != 1 || pools.Items[0].Spec.Runtime.Image != wantImage ||
+		pools.Items[0].Spec.Runtime.Profile.Digest != wantProfileDigest {
+		t.Fatalf("RuntimePool did not use frozen plan: %#v", pools.Items)
+	}
+	queued := &corev1alpha1.Task{}
+	if err := reconciler.Get(ctx, client.ObjectKeyFromObject(task), queued); err != nil {
+		t.Fatal(err)
+	}
+	attemptID, err := promptAttemptIDFromTask(queued)
+	if err != nil {
+		t.Fatal(err)
+	}
+	attempt, err := durableStore.GetPromptAttempt(ctx, attemptID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if attempt.RequestDigest != wantRequestDigest ||
+		attempt.BindingDigest != verified.binding.BindingDigest || attempt.SnapshotDigest != verified.snapshot.Digest {
+		t.Fatalf("PromptAttempt immutable digests = request:%s binding:%s snapshot:%s, want %s/%s/%s",
+			attempt.RequestDigest, attempt.BindingDigest, attempt.SnapshotDigest,
+			wantRequestDigest, verified.binding.BindingDigest, verified.snapshot.Digest)
+	}
+}
diff --git a/internal/controller/agent_execution_binding_test_helpers_test.go b/internal/controller/agent_execution_binding_test_helpers_test.go
new file mode 100644
index 000000000..c1cfb58fa
--- /dev/null
+++ b/internal/controller/agent_execution_binding_test_helpers_test.go
@@ -0,0 +1,120 @@
+package controller
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"path/filepath"
+	"testing"
+
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/labels"
+	"github.com/orka-agents/orka/internal/store/sqlite"
+)
+
+func configureAgentExecutionBindingTest(
+	t *testing.T,
+	ctx context.Context,
+	reconciler *TaskReconciler,
+	task *corev1alpha1.Task,
+) *corev1alpha1.Task {
+	t.Helper()
+	if reconciler == nil || reconciler.Client == nil || reconciler.Scheme == nil || task == nil {
+		t.Fatal("binding test fixture requires reconciler client/scheme and Task")
+	}
+	if err := corev1.AddToScheme(reconciler.Scheme); err != nil {
+		t.Fatal(err)
+	}
+	if reconciler.AgentExecutionSnapshots == nil {
+		if sqliteStore, ok := reconciler.DurableControlStore.(*sqlite.Store); ok {
+			cipher, err := sqlite.NewAgentExecutionSnapshotCipher(bytes.Repeat([]byte{0x35}, sqlite.AgentExecutionSnapshotKeyBytes))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if err := sqliteStore.SetAgentExecutionSnapshotCipher(cipher); err != nil {
+				t.Fatal(err)
+			}
+			reconciler.AgentExecutionSnapshots = sqliteStore
+		} else {
+			db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "binding-snapshots.db"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			t.Cleanup(func() { _ = db.Close() })
+			snapshotStore := sqlite.NewStore(db, "binding-test")
+			cipher, err := sqlite.NewAgentExecutionSnapshotCipher(bytes.Repeat([]byte{0x35}, sqlite.AgentExecutionSnapshotKeyBytes))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if err := snapshotStore.SetAgentExecutionSnapshotCipher(cipher); err != nil {
+				t.Fatal(err)
+			}
+			reconciler.AgentExecutionSnapshots = snapshotStore
+		}
+	}
+	namespace := &corev1.Namespace{}
+	err := reconciler.Get(ctx, client.ObjectKey{Name: task.Namespace}, namespace)
+	if apierrors.IsNotFound(err) {
+		namespace = &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{
+			Name: task.Namespace, UID: types.UID(fmt.Sprintf("%s-namespace-uid", task.Namespace)),
+		}}
+		if err := reconciler.Create(ctx, namespace); err != nil {
+			t.Fatal(err)
+		}
+	} else if err != nil {
+		t.Fatal(err)
+	}
+	current := &corev1alpha1.Task{}
+	if err := reconciler.Get(ctx, client.ObjectKeyFromObject(task), current); err != nil {
+		t.Fatal(err)
+	}
+	if !controllerutil.ContainsFinalizer(current, labels.TaskFinalizer) {
+		controllerutil.AddFinalizer(current, labels.TaskFinalizer)
+		if err := reconciler.Update(ctx, current); err != nil {
+			t.Fatal(err)
+		}
+		if err := reconciler.Get(ctx, client.ObjectKeyFromObject(task), current); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if current.Generation < 1 {
+		current.Generation = 1
+		if err := reconciler.Update(ctx, current); err != nil {
+			t.Fatal(err)
+		}
+		if err := reconciler.Get(ctx, client.ObjectKeyFromObject(task), current); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return current
+}
+
+func bindACPQueueTaskForTest(
+	t *testing.T,
+	ctx context.Context,
+	reconciler *TaskReconciler,
+	task *corev1alpha1.Task,
+	agent *corev1alpha1.Agent,
+) *corev1alpha1.Task {
+	t.Helper()
+	current := configureAgentExecutionBindingTest(t, ctx, reconciler, task)
+	boundAgent := agent.DeepCopy()
+	if boundAgent.Generation < 1 {
+		boundAgent.Generation = 1
+	}
+	if result, err, handled := reconciler.ensureAgentExecutionBinding(ctx, current, boundAgent); err != nil || handled {
+		t.Fatalf("establish test execution binding: result=%#v handled=%v err=%v", result, handled, err)
+	}
+	bound := &corev1alpha1.Task{}
+	if err := reconciler.Get(ctx, client.ObjectKeyFromObject(current), bound); err != nil {
+		t.Fatal(err)
+	}
+	return bound
+}
diff --git a/internal/controller/agent_execution_cleanup.go b/internal/controller/agent_execution_cleanup.go
new file mode 100644
index 000000000..577a89c62
--- /dev/null
+++ b/internal/controller/agent_execution_cleanup.go
@@ -0,0 +1,25 @@
+package controller
+
+import corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+
+func executionBinding(
+	task *corev1alpha1.Task,
+	contract corev1alpha1.AgentRuntimeContractVersion,
+) *corev1alpha1.AgentExecutionBinding {
+	if task == nil || task.Spec.Type != corev1alpha1.TaskTypeAgent {
+		return nil
+	}
+	binding := task.Status.AgentExecutionBinding
+	if binding == nil || binding.ContractVersion != contract {
+		return nil
+	}
+	return binding
+}
+
+func taskDispatchableByHarnessV1(task *corev1alpha1.Task) bool {
+	return executionBinding(task, corev1alpha1.AgentRuntimeContractHarnessV1) != nil
+}
+
+func taskDispatchableByACP(task *corev1alpha1.Task) bool {
+	return executionBinding(task, corev1alpha1.AgentRuntimeContractHarnessV2) != nil
+}
diff --git a/internal/controller/agent_execution_cleanup_test.go b/internal/controller/agent_execution_cleanup_test.go
new file mode 100644
index 000000000..ec4dee111
--- /dev/null
+++ b/internal/controller/agent_execution_cleanup_test.go
@@ -0,0 +1,31 @@
+package controller
+
+import (
+	"testing"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+)
+
+func TestTaskDispatchabilityFollowsImmutableContract(t *testing.T) {
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent}}
+	if taskDispatchableByHarnessV1(task) || taskDispatchableByACP(task) {
+		t.Fatal("unbound agent Task must not be dispatchable")
+	}
+
+	task.Status.AgentExecutionBinding = &corev1alpha1.AgentExecutionBinding{
+		ContractVersion: corev1alpha1.AgentRuntimeContractHarnessV1,
+	}
+	if !taskDispatchableByHarnessV1(task) || taskDispatchableByACP(task) {
+		t.Fatal("harness-v1 binding selected the wrong dispatcher")
+	}
+
+	task.Status.AgentExecutionBinding.ContractVersion = corev1alpha1.AgentRuntimeContractHarnessV2
+	if taskDispatchableByHarnessV1(task) || !taskDispatchableByACP(task) {
+		t.Fatal("harness-v2 binding selected the wrong dispatcher")
+	}
+
+	task.Spec.Type = corev1alpha1.TaskTypeContainer
+	if taskDispatchableByHarnessV1(task) || taskDispatchableByACP(task) {
+		t.Fatal("non-agent Task must not be dispatched by an agent harness")
+	}
+}
diff --git a/internal/controller/agent_execution_plan.go b/internal/controller/agent_execution_plan.go
index ec44ca5f7..483b46428 100644
--- a/internal/controller/agent_execution_plan.go
+++ b/internal/controller/agent_execution_plan.go
@@ -12,6 +12,7 @@ import (
 	"strings"
 
 	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
 )
@@ -19,19 +20,25 @@ import (
 type agentExecutionPath string
 
 const (
-	agentExecutionPathHarnessWrapper agentExecutionPath = "harness-wrapper"
-	agentExecutionPathWorkerJob      agentExecutionPath = "worker-job"
-	agentExecutionPathRejected       agentExecutionPath = "rejected"
+	agentExecutionPathACP       agentExecutionPath = "acp-runtime-pool"
+	agentExecutionPathHarnessV1 agentExecutionPath = "harness-v1"
+	agentExecutionPathExternal  agentExecutionPath = "acp-external-runtime"
+	agentExecutionPathRejected  agentExecutionPath = "rejected"
 )
 
 type agentExecutionPlan struct {
 	path                 agentExecutionPath
+	externalRuntimeName  string
 	rejectionReason      string
 	workspaceStatusError error
 }
 
-func agentHarnessWrapperPlan() agentExecutionPlan {
-	return agentExecutionPlan{path: agentExecutionPathHarnessWrapper}
+func agentACPPlan() agentExecutionPlan {
+	return agentExecutionPlan{path: agentExecutionPathACP}
+}
+
+func agentHarnessV1Plan(runtimeName string) agentExecutionPlan {
+	return agentExecutionPlan{path: agentExecutionPathHarnessV1, externalRuntimeName: strings.TrimSpace(runtimeName)}
 }
 
 func rejectAgentExecutionPlan(reason string) agentExecutionPlan {
@@ -44,12 +51,11 @@ func rejectAgentExecutionPlanWithWorkspaceStatus(reason string, err error) agent
 	return plan
 }
 
-// planAgentExecution owns the controller's current routing decision for type:
-// agent Tasks. It assumes earlier Pending-phase validation has already checked
-// task/agent compatibility, basic execution-workspace policy, coordination, and
-// provider references. The remaining decision is whether the Task can advance as
-// a harness-wrapper turn, should use a future worker Job path, or must be
-// rejected with a normalized reason.
+// planAgentExecution owns the controller routing decision for type: agent
+// Tasks. Built-in Codex, Claude, Copilot, and OpenCode runtimes use only the ACP v2
+// RuntimePool path. External runtimeRef registrations and conformance remain
+// available, but Task dispatch fails closed until the v2 dispatcher support
+// boundary is enabled. There is no legacy turn or Job fallback.
 func (r *TaskReconciler) planAgentExecution(
 	ctx context.Context,
 	task *corev1alpha1.Task,
@@ -63,22 +69,100 @@ func (r *TaskReconciler) planAgentExecution(
 		)
 	}
 	if workspaceRequest != nil {
-		err := fmt.Errorf("execution workspace is not supported by harness runtime yet")
+		err := fmt.Errorf("Task.spec.execution.workspace is not supported by the ACP core runtime; use Task.spec.workspace") //nolint:staticcheck // Field path begins the user-facing validation message.
 		return rejectAgentExecutionPlanWithWorkspaceStatus(err.Error(), err)
 	}
 
-	if reason := agentHarnessWrapperUnsupportedReason(task, agent); reason != "" {
-		return rejectAgentExecutionPlan(reason)
+	if agent == nil || agent.Spec.Runtime == nil {
+		return rejectAgentExecutionPlan("agent runtime configuration is required")
+	}
+	if agent.Spec.Runtime.RuntimeRef != nil && strings.TrimSpace(agent.Spec.Runtime.RuntimeRef.Name) != "" {
+		name := strings.TrimSpace(agent.Spec.Runtime.RuntimeRef.Name)
+		reader := r.APIReader
+		if reader == nil {
+			reader = r.Client
+		}
+		runtime := &corev1alpha1.AgentRuntime{}
+		if err := reader.Get(ctx, client.ObjectKey{Namespace: task.Namespace, Name: name}, runtime); err != nil {
+			return rejectAgentExecutionPlan(fmt.Sprintf("resolve AgentRuntime %q: %v", name, err))
+		}
+		switch runtime.RegisteredContractVersion() {
+		case corev1alpha1.AgentRuntimeContractHarnessV1:
+			if !r.HarnessV1Enabled {
+				return rejectAgentExecutionPlan("AgentRuntime is classified orka.harness.v1, but harness v1 admission is disabled; v2 execution never substitutes for it")
+			}
+			return agentHarnessV1Plan(name)
+		case corev1alpha1.AgentRuntimeContractHarnessV2:
+			return rejectAgentExecutionPlan(externalAgentRuntimeDispatchUnsupportedReason(name))
+		default:
+			return rejectAgentExecutionPlan(fmt.Sprintf("AgentRuntime %q is unclassified; a missing selector is never protocol evidence", name))
+		}
 	}
 
-	if task.Spec.PriorTaskRef != nil && r.EnforceNamespaceIsolation {
-		priorNS := strings.TrimSpace(task.Spec.PriorTaskRef.Namespace)
-		if priorNS != "" && priorNS != task.Namespace {
-			return rejectAgentExecutionPlan("cross-namespace priorTaskRef is not supported by harness runtime when namespace isolation is enforced")
+	switch agent.Spec.Runtime.Type {
+	case corev1alpha1.AgentRuntimeCodex, corev1alpha1.AgentRuntimeClaude, corev1alpha1.AgentRuntimeCopilot, corev1alpha1.AgentRuntimeOpencode:
+	default:
+		return rejectAgentExecutionPlan(fmt.Sprintf("agent runtime %q is not supported by the ACP core runtime", agent.Spec.Runtime.Type))
+	}
+
+	contract := agent.BuiltInContractVersion()
+	switch contract {
+	case corev1alpha1.AgentRuntimeContractHarnessV2:
+		if reason := agentACPRuntimeUnsupportedReason(task, agent); reason != "" {
+			return rejectAgentExecutionPlan(reason)
+		}
+		if task.Spec.PriorTaskRef != nil {
+			return rejectAgentExecutionPlan("priorTaskRef continuation is not supported by the ACP core runtime; use sessionRef")
+		}
+		if !r.ACPRuntimeEnabled {
+			return rejectAgentExecutionPlan("ACP core runtime is disabled; built-in v2 agent runtimes have no fallback execution path")
+		}
+		return agentACPPlan()
+	case corev1alpha1.AgentRuntimeContractHarnessV1:
+		if !r.HarnessV1Enabled {
+			return rejectAgentExecutionPlan("agent is classified orka.harness.v1, but harness v1 admission is disabled; v2 execution never substitutes for it")
 		}
+		if agent.Spec.Runtime.Type == corev1alpha1.AgentRuntimeOpencode {
+			return rejectAgentExecutionPlan("new harness v1 OpenCode bindings are prohibited; only sealed-inventory legacy adoption may use the v1 OpenCode path")
+		}
+		if reason := agentHarnessV1InheritedAuthorityUnsupportedReason(agent); reason != "" {
+			return rejectAgentExecutionPlan(reason)
+		}
+		return agentHarnessV1Plan("")
+	default:
+		return rejectAgentExecutionPlan("agent runtime.contractVersion is unclassified; a missing selector is never interpreted as either protocol and execution admission fails closed")
 	}
+}
 
-	return agentHarnessWrapperPlan()
+func externalAgentRuntimeDispatchUnsupportedReason(name string) string {
+	return fmt.Sprintf("external AgentRuntime %q Task dispatch is not supported until the v2 dispatcher is wired", strings.TrimSpace(name))
+}
+
+func externalAgentRuntimeReadinessReason(task *corev1alpha1.Task, runtime *corev1alpha1.AgentRuntime) string {
+	if runtime == nil || runtime.RegisteredContractVersion() != corev1alpha1.AgentRuntimeContractHarnessV2 {
+		return "external AgentRuntime must use orka.harness.v2"
+	}
+	if !runtime.Status.Ready || runtime.Status.ObservedGeneration != runtime.Generation || runtime.Status.ObservedCapabilities == nil {
+		return fmt.Sprintf("external AgentRuntime %q has not passed current-generation v2 conformance", runtime.Name)
+	}
+	if runtime.Spec.Capabilities == nil || runtime.Spec.Capabilities.Profile == nil ||
+		runtime.Status.ObservedCapabilities.RuntimeInstanceID == "" ||
+		runtime.Status.ObservedCapabilities.RuntimeProfileDigest != runtime.Spec.Capabilities.Profile.Digest {
+		return fmt.Sprintf("external AgentRuntime %q does not have an exact observed runtime identity/profile", runtime.Name)
+	}
+	if task != nil {
+		intent := effectiveACPWorkspaceIntent(task)
+		if runtime.Spec.Capabilities.Profile.WorkspaceIntent != intent {
+			return fmt.Sprintf("external AgentRuntime %q profile workspace intent %q does not match Task intent %q", runtime.Name, runtime.Spec.Capabilities.Profile.WorkspaceIntent, intent)
+		}
+	}
+	if runtime.Spec.Capabilities.WorkspaceGovernance == nil ||
+		runtime.Status.ObservedCapabilities.WorkspaceGovernance == nil ||
+		!runtime.Spec.Capabilities.WorkspaceGovernance.Strict() ||
+		!runtime.Status.ObservedCapabilities.WorkspaceGovernance.Strict() {
+		return fmt.Sprintf("external AgentRuntime %q does not provide strict workspace governance", runtime.Name)
+	}
+	return ""
 }
 
 func (r *TaskReconciler) rejectPlannedAgentExecution(
@@ -94,17 +178,21 @@ func (r *TaskReconciler) rejectPlannedAgentExecution(
 	return r.failTask(ctx, task, plan.rejectionReason)
 }
 
-func agentHarnessWrapperUnsupportedReason(task *corev1alpha1.Task, agent *corev1alpha1.Agent) string {
+func agentACPRuntimeUnsupportedReason(task *corev1alpha1.Task, agent *corev1alpha1.Agent) string {
 	if task == nil {
 		return ""
 	}
 	switch {
 	case task.Spec.Transaction != nil:
-		return "agent CLI runtime tasks do not support transaction token delegation with the harness wrapper yet"
+		return "ACP core runtime tasks do not support transaction token delegation"
+	case agent != nil && agent.Spec.Coordination != nil && agent.Spec.Coordination.Autonomous:
+		return "ACP core runtime tasks do not support Agent.spec.coordination.autonomous; disable autonomous coordination"
+	case task.Spec.RetryPolicy != nil && task.Spec.RetryPolicy.MaxRetries > 0:
+		return "ACP core runtime tasks do not support effective Task.spec.retryPolicy retries; maxRetries must be 0"
 	case effectiveAgentResources(task, agent):
-		return "agent CLI runtime tasks do not support custom Kubernetes resources with the harness wrapper yet"
+		return "ACP core runtime tasks do not support custom Kubernetes resources until a reviewed RuntimePool resource class is selected"
 	case resolveExecution(task, agent) != nil:
-		return "agent CLI runtime tasks do not support execution placement with the harness wrapper yet"
+		return "ACP core runtime tasks do not support per-Task execution placement"
 	default:
 		return ""
 	}
@@ -116,3 +204,14 @@ func effectiveAgentResources(task *corev1alpha1.Task, agent *corev1alpha1.Agent)
 	}
 	return agent != nil && (len(agent.Spec.Resources.Requests) > 0 || len(agent.Spec.Resources.Limits) > 0)
 }
+
+func agentHarnessV1InheritedAuthorityUnsupportedReason(agent *corev1alpha1.Agent) string {
+	switch {
+	case effectiveAgentResources(nil, agent):
+		return "harness v1 built-in runtimes do not support inherited Agent.spec.resources"
+	case resolveExecution(nil, agent) != nil:
+		return "harness v1 built-in runtimes do not support inherited Agent.spec.execution placement"
+	default:
+		return ""
+	}
+}
diff --git a/internal/controller/agent_execution_plan_test.go b/internal/controller/agent_execution_plan_test.go
index 48cd5d615..14f459f79 100644
--- a/internal/controller/agent_execution_plan_test.go
+++ b/internal/controller/agent_execution_plan_test.go
@@ -7,6 +7,8 @@ MIT License - see LICENSE file for details.
 package controller
 
 import (
+	"k8s.io/utils/ptr"
+
 	"context"
 	"strings"
 	"testing"
@@ -19,6 +21,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
 )
 
 func TestPlanAgentExecutionMatrix(t *testing.T) {
@@ -31,56 +34,123 @@ func TestPlanAgentExecutionMatrix(t *testing.T) {
 		mutateAgent            func(*corev1alpha1.Agent)
 		objects                []client.Object
 		agentSandboxEnabled    bool
+		acpRuntimeEnabled      bool
 		wantPath               agentExecutionPath
 		wantReason             string
 		wantWorkspaceStatusErr string
 	}{
 		{
-			name:     "plain agent task runs as harness wrapper turn",
-			wantPath: agentExecutionPathHarnessWrapper,
+			name:              "built-in agent task uses ACP RuntimePool",
+			acpRuntimeEnabled: true,
+			wantPath:          agentExecutionPathACP,
+		},
+		{
+			name: "built-in Copilot task uses ACP RuntimePool",
+			mutateAgent: func(agent *corev1alpha1.Agent) {
+				agent.Spec.Runtime.Type = corev1alpha1.AgentRuntimeCopilot
+			},
+			acpRuntimeEnabled: true,
+			wantPath:          agentExecutionPathACP,
+		},
+		{
+			name:       "disabled ACP runtime fails closed without legacy fallback",
+			wantPath:   agentExecutionPathRejected,
+			wantReason: "no fallback execution path",
 		},
 		{
-			name: "transaction token delegation is rejected before harness start",
+			name: "conformant external runtimeRef remains fail-closed",
+			mutateAgent: func(agent *corev1alpha1.Agent) {
+				agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{
+					RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "external-v2"},
+				}
+			},
+			objects:           []client.Object{plannerExternalRuntime()},
+			acpRuntimeEnabled: true,
+			wantPath:          agentExecutionPathRejected,
+			wantReason:        "Task dispatch is not supported until the v2 dispatcher is wired",
+		},
+		{
+			name: "OpenCode uses ACP RuntimePool",
+			mutateAgent: func(agent *corev1alpha1.Agent) {
+				agent.Spec.Runtime.Type = corev1alpha1.AgentRuntimeOpencode
+			},
+			acpRuntimeEnabled: true,
+			wantPath:          agentExecutionPathACP,
+		},
+		{
+			name: "built-in agent without contractVersion is rejected as unclassified",
+			mutateAgent: func(agent *corev1alpha1.Agent) {
+				agent.Spec.Runtime.ContractVersion = nil
+			},
+			acpRuntimeEnabled: true,
+			wantPath:          agentExecutionPathRejected,
+			wantReason:        "unclassified",
+		},
+		{
+			name: "built-in agent classified orka.harness.v1 is rejected",
+			mutateAgent: func(agent *corev1alpha1.Agent) {
+				agent.Spec.Runtime.ContractVersion = ptr.To(corev1alpha1.AgentRuntimeContractHarnessV1)
+			},
+			acpRuntimeEnabled: true,
+			wantPath:          agentExecutionPathRejected,
+			wantReason:        "orka.harness.v1",
+		},
+		{
+			name: "priorTaskRef continuation is rejected",
+			mutateTask: func(task *corev1alpha1.Task) {
+				task.Spec.PriorTaskRef = &corev1alpha1.PriorTaskReference{Name: "parent"}
+			},
+			acpRuntimeEnabled: true,
+			wantPath:          agentExecutionPathRejected,
+			wantReason:        "use sessionRef",
+		},
+		{
+			name: "transaction token delegation is rejected before ACP admission",
 			mutateTask: func(task *corev1alpha1.Task) {
 				task.Spec.Transaction = &corev1alpha1.TaskTransaction{ID: "txn-1"}
 			},
-			wantPath:   agentExecutionPathRejected,
-			wantReason: "transaction token delegation",
+			acpRuntimeEnabled: true,
+			wantPath:          agentExecutionPathRejected,
+			wantReason:        "transaction token delegation",
 		},
 		{
-			name: "task resources are rejected before harness start",
+			name: "task resources are rejected until a RuntimePool class is selected",
 			mutateTask: func(task *corev1alpha1.Task) {
 				task.Spec.Resources.Requests = corev1.ResourceList{corev1.ResourceCPU: resource.MustParse("1")}
 			},
-			wantPath:   agentExecutionPathRejected,
-			wantReason: "custom Kubernetes resources",
+			acpRuntimeEnabled: true,
+			wantPath:          agentExecutionPathRejected,
+			wantReason:        "custom Kubernetes resources",
 		},
 		{
-			name: "agent resources are rejected before harness start",
+			name: "agent resources are rejected until a RuntimePool class is selected",
 			mutateAgent: func(agent *corev1alpha1.Agent) {
 				agent.Spec.Resources.Limits = corev1.ResourceList{corev1.ResourceMemory: resource.MustParse("1Gi")}
 			},
-			wantPath:   agentExecutionPathRejected,
-			wantReason: "custom Kubernetes resources",
+			acpRuntimeEnabled: true,
+			wantPath:          agentExecutionPathRejected,
+			wantReason:        "custom Kubernetes resources",
 		},
 		{
-			name: "task execution placement is rejected before harness start",
+			name: "task execution placement is rejected before ACP admission",
 			mutateTask: func(task *corev1alpha1.Task) {
 				task.Spec.Execution = &corev1alpha1.ExecutionSpec{RuntimeClassName: "kata"}
 			},
-			wantPath:   agentExecutionPathRejected,
-			wantReason: "execution placement",
+			acpRuntimeEnabled: true,
+			wantPath:          agentExecutionPathRejected,
+			wantReason:        "execution placement",
 		},
 		{
-			name: "agent execution placement is rejected before harness start",
+			name: "agent execution placement is rejected before ACP admission",
 			mutateAgent: func(agent *corev1alpha1.Agent) {
 				agent.Spec.Execution = &corev1alpha1.ExecutionSpec{NodeSelector: map[string]string{"disk": "ssd"}}
 			},
-			wantPath:   agentExecutionPathRejected,
-			wantReason: "execution placement",
+			acpRuntimeEnabled: true,
+			wantPath:          agentExecutionPathRejected,
+			wantReason:        "execution placement",
 		},
 		{
-			name: "valid execution workspace is rejected with workspace status error until harness supports it",
+			name: "legacy execution workspace is rejected in favor of Task.spec.workspace",
 			mutateTask: func(task *corev1alpha1.Task) {
 				task.Spec.Execution = &corev1alpha1.ExecutionSpec{Workspace: &corev1alpha1.ExecutionWorkspaceSpec{
 					Enabled:     true,
@@ -89,19 +159,14 @@ func TestPlanAgentExecutionMatrix(t *testing.T) {
 				}}
 			},
 			objects: []client.Object{
-				&sandboxextv1alpha1.SandboxTemplate{ObjectMeta: metav1.ObjectMeta{
-					Name:      "sandbox-template",
-					Namespace: defaultNS,
-				}},
-				&sandboxextv1beta1.SandboxWarmPool{ObjectMeta: metav1.ObjectMeta{
-					Name:      "sandbox-template",
-					Namespace: defaultNS,
-				}},
+				&sandboxextv1alpha1.SandboxTemplate{ObjectMeta: metav1.ObjectMeta{Name: "sandbox-template", Namespace: defaultNS}},
+				&sandboxextv1beta1.SandboxWarmPool{ObjectMeta: metav1.ObjectMeta{Name: "sandbox-template", Namespace: defaultNS}},
 			},
 			agentSandboxEnabled:    true,
+			acpRuntimeEnabled:      true,
 			wantPath:               agentExecutionPathRejected,
-			wantReason:             "execution workspace is not supported by harness runtime yet",
-			wantWorkspaceStatusErr: "execution workspace is not supported by harness runtime yet",
+			wantReason:             "use Task.spec.workspace",
+			wantWorkspaceStatusErr: "use Task.spec.workspace",
 		},
 		{
 			name: "execution workspace resolution failure is surfaced for status update",
@@ -113,35 +178,11 @@ func TestPlanAgentExecutionMatrix(t *testing.T) {
 				}}
 			},
 			agentSandboxEnabled:    true,
+			acpRuntimeEnabled:      true,
 			wantPath:               agentExecutionPathRejected,
 			wantReason:             "failed to resolve execution workspace",
 			wantWorkspaceStatusErr: "missing-template",
 		},
-		{
-			name: "execution workspace resolution failure is surfaced before placement rejection",
-			mutateTask: func(task *corev1alpha1.Task) {
-				task.Spec.Execution = &corev1alpha1.ExecutionSpec{
-					RuntimeClassName: "kata",
-					Workspace: &corev1alpha1.ExecutionWorkspaceSpec{
-						Enabled:     true,
-						Provider:    corev1alpha1.WorkspaceProviderAgentSandbox,
-						TemplateRef: &corev1alpha1.WorkspaceTemplateReference{Name: "missing-template"},
-					},
-				}
-			},
-			agentSandboxEnabled:    true,
-			wantPath:               agentExecutionPathRejected,
-			wantReason:             "failed to resolve execution workspace",
-			wantWorkspaceStatusErr: "missing-template",
-		},
-		{
-			name: "cross namespace prior task is rejected only when namespace isolation is enforced",
-			mutateTask: func(task *corev1alpha1.Task) {
-				task.Spec.PriorTaskRef = &corev1alpha1.PriorTaskReference{Name: "parent", Namespace: "other"}
-			},
-			wantPath:   agentExecutionPathRejected,
-			wantReason: "cross-namespace priorTaskRef",
-		},
 	}
 
 	for _, tt := range tests {
@@ -155,11 +196,9 @@ func TestPlanAgentExecutionMatrix(t *testing.T) {
 				tt.mutateAgent(agent)
 			}
 
-			objs := make([]client.Object, 0, len(tt.objects))
-			objs = append(objs, tt.objects...)
-			r := newUnitReconciler(scheme, objs...)
+			r := newUnitReconciler(scheme, tt.objects...)
 			r.AgentSandboxEnabled = tt.agentSandboxEnabled
-			r.EnforceNamespaceIsolation = true
+			r.ACPRuntimeEnabled = tt.acpRuntimeEnabled
 
 			plan := r.planAgentExecution(context.Background(), task, agent)
 			if plan.path != tt.wantPath {
@@ -181,14 +220,30 @@ func TestPlanAgentExecutionMatrix(t *testing.T) {
 	}
 }
 
-func TestPlanAgentExecutionAllowsCrossNamespacePriorTaskWhenIsolationDisabled(t *testing.T) {
-	r := &TaskReconciler{EnforceNamespaceIsolation: false}
-	task := validPlannerTask()
-	task.Spec.PriorTaskRef = &corev1alpha1.PriorTaskReference{Name: "parent", Namespace: "other"}
-
-	plan := r.planAgentExecution(context.Background(), task, validPlannerAgent())
-	if plan.path != agentExecutionPathHarnessWrapper {
-		t.Fatalf("plan path = %q, want %q", plan.path, agentExecutionPathHarnessWrapper)
+func plannerExternalRuntime() *corev1alpha1.AgentRuntime {
+	digest := func(char string) string { return "sha256:" + strings.Repeat(char, 64) }
+	governance := corev1alpha1.AgentRuntimeWorkspaceGovernanceCapabilities{
+		Mode:                     corev1alpha1.AgentRuntimeWorkspaceGovernanceStrict,
+		OrkaOwnedWorkspaceDeltas: true, PromptScopedBrokerAuthorization: true,
+		NoDirectSCMPublication: true, OrkaOwnedCleanRoomPublication: true,
+		ExactInstanceFencing: true, DuplicateSafeMutations: true, CancellationSettlement: true,
+	}
+	profile := corev1alpha1.AgentRuntimeProfileSpec{
+		Digest: digest("a"), DigestSchemaVersion: int32(harnessv2.ProfileDigestSchemaVersion), ACPProfile: "acp.v1", AdapterName: "external",
+		AdapterDigest: digest("b"), ProviderKind: "external", Model: "model",
+		AgentConfigurationDigest: digest("c"), ToolPolicyDigest: digest("d"), ApprovalPolicyDigest: digest("e"),
+		MCPConfigurationDigest: digest("f"), WorkspaceIntent: corev1alpha1.WorkspaceIntentRead,
+		ProxyCredentialRole: "provider", ProxyCredentialScope: "model:model", ResourceClass: "standard",
+	}
+	return &corev1alpha1.AgentRuntime{
+		ObjectMeta: metav1.ObjectMeta{Name: "external-v2", Namespace: defaultNS, UID: "external-runtime-uid", Generation: 1},
+		Spec: corev1alpha1.AgentRuntimeRegistrySpec{
+			ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			Capabilities:    &corev1alpha1.AgentRuntimeCapabilitiesSpec{RuntimeInstanceID: "external-instance", Profile: &profile, WorkspaceGovernance: &governance},
+		},
+		Status: corev1alpha1.AgentRuntimeStatus{Ready: true, ObservedGeneration: 1, ObservedCapabilities: &corev1alpha1.AgentRuntimeObservedCapabilities{
+			RuntimeInstanceID: "external-instance", RuntimeProfileDigest: profile.Digest, WorkspaceGovernance: &governance,
+		}},
 	}
 }
 
@@ -206,7 +261,10 @@ func validPlannerAgent() *corev1alpha1.Agent {
 	return &corev1alpha1.Agent{
 		ObjectMeta: metav1.ObjectMeta{Name: "agent", Namespace: defaultNS},
 		Spec: corev1alpha1.AgentSpec{
-			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeCodex},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeCodex,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
 		},
 	}
 }
diff --git a/internal/controller/agent_execution_plan_unsupported_semantics_test.go b/internal/controller/agent_execution_plan_unsupported_semantics_test.go
new file mode 100644
index 000000000..ed5e78d4e
--- /dev/null
+++ b/internal/controller/agent_execution_plan_unsupported_semantics_test.go
@@ -0,0 +1,173 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package controller
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+)
+
+func TestPlanAgentExecutionRejectsUnsupportedBuiltInTaskSemantics(t *testing.T) {
+	runtimeTypes := []corev1alpha1.AgentRuntimeType{
+		corev1alpha1.AgentRuntimeCodex,
+		corev1alpha1.AgentRuntimeClaude,
+		corev1alpha1.AgentRuntimeCopilot,
+	}
+
+	tests := []struct {
+		name        string
+		mutateTask  func(*corev1alpha1.Task)
+		mutateAgent func(*corev1alpha1.Agent)
+		wantPath    agentExecutionPath
+		wantReason  string
+	}{
+		{
+			name:     "ordinary task remains supported",
+			wantPath: agentExecutionPathACP,
+		},
+		{
+			name: "disabled autonomous coordination remains supported",
+			mutateAgent: func(agent *corev1alpha1.Agent) {
+				agent.Spec.Coordination = &corev1alpha1.CoordinationConfig{Enabled: true}
+			},
+			wantPath: agentExecutionPathACP,
+		},
+		{
+			name: "defaulted no-op retry policy remains supported",
+			mutateTask: func(task *corev1alpha1.Task) {
+				task.Spec.RetryPolicy = &corev1alpha1.RetryPolicy{BackoffMultiplier: 2}
+			},
+			wantPath: agentExecutionPathACP,
+		},
+		{
+			name: "autonomous coordination fails closed",
+			mutateAgent: func(agent *corev1alpha1.Agent) {
+				agent.Spec.Coordination = &corev1alpha1.CoordinationConfig{
+					Enabled:    true,
+					Autonomous: true,
+				}
+			},
+			wantPath:   agentExecutionPathRejected,
+			wantReason: "Agent.spec.coordination.autonomous",
+		},
+		{
+			name: "effective retry policy fails closed",
+			mutateTask: func(task *corev1alpha1.Task) {
+				task.Spec.RetryPolicy = &corev1alpha1.RetryPolicy{
+					MaxRetries:        1,
+					BackoffMultiplier: 2,
+				}
+			},
+			wantPath:   agentExecutionPathRejected,
+			wantReason: "Task.spec.retryPolicy",
+		},
+	}
+
+	for _, runtimeType := range runtimeTypes {
+		for _, tt := range tests {
+			t.Run(string(runtimeType)+"/"+tt.name, func(t *testing.T) {
+				task := validPlannerTask()
+				agent := validPlannerAgent()
+				agent.Spec.Runtime.Type = runtimeType
+				if tt.mutateTask != nil {
+					tt.mutateTask(task)
+				}
+				if tt.mutateAgent != nil {
+					tt.mutateAgent(agent)
+				}
+
+				r := newUnitReconciler(newTestScheme())
+				r.ACPRuntimeEnabled = true
+				plan := r.planAgentExecution(context.Background(), task, agent)
+
+				if plan.path != tt.wantPath {
+					t.Fatalf("plan path = %q, want %q (plan=%#v)", plan.path, tt.wantPath, plan)
+				}
+				if tt.wantReason == "" {
+					if plan.rejectionReason != "" {
+						t.Fatalf("rejection reason = %q, want empty", plan.rejectionReason)
+					}
+					return
+				}
+				if !strings.Contains(plan.rejectionReason, tt.wantReason) {
+					t.Fatalf("rejection reason = %q, want substring %q", plan.rejectionReason, tt.wantReason)
+				}
+			})
+		}
+	}
+}
+
+func TestPlanAgentExecutionAllowsHarnessV1RetryAdmission(t *testing.T) {
+	task := validPlannerTask()
+	task.Spec.RetryPolicy = &corev1alpha1.RetryPolicy{
+		MaxRetries:        1,
+		BackoffMultiplier: 2,
+	}
+	agent := validPlannerAgent()
+	contract := corev1alpha1.AgentRuntimeContractHarnessV1
+	agent.Spec.Runtime.ContractVersion = &contract
+
+	r := newUnitReconciler(newTestScheme())
+	r.HarnessV1Enabled = true
+	plan := r.planAgentExecution(context.Background(), task, agent)
+
+	if plan.path != agentExecutionPathHarnessV1 {
+		t.Fatalf("plan path = %q, want %q (plan=%#v)", plan.path, agentExecutionPathHarnessV1, plan)
+	}
+}
+
+func TestPlanAgentExecutionRejectsHarnessV1InheritedAgentAuthority(t *testing.T) {
+	tests := []struct {
+		name        string
+		mutateAgent func(*corev1alpha1.Agent)
+		wantReason  string
+	}{
+		{
+			name: "resources",
+			mutateAgent: func(agent *corev1alpha1.Agent) {
+				agent.Spec.Resources.Requests = corev1.ResourceList{
+					corev1.ResourceCPU: resource.MustParse("1"),
+				}
+			},
+			wantReason: "Agent.spec.resources",
+		},
+		{
+			name: "execution placement",
+			mutateAgent: func(agent *corev1alpha1.Agent) {
+				agent.Spec.Execution = &corev1alpha1.ExecutionSpec{RuntimeClassName: "kata"}
+			},
+			wantReason: "Agent.spec.execution",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			task := validPlannerTask()
+			agent := validPlannerAgent()
+			contract := corev1alpha1.AgentRuntimeContractHarnessV1
+			agent.Spec.Runtime.ContractVersion = &contract
+			tt.mutateAgent(agent)
+
+			r := newUnitReconciler(newTestScheme())
+			r.HarnessV1Enabled = true
+			plan := r.planAgentExecution(context.Background(), task, agent)
+
+			if plan.path != agentExecutionPathRejected {
+				t.Fatalf("plan path = %q, want %q (plan=%#v)", plan.path, agentExecutionPathRejected, plan)
+			}
+			if !strings.Contains(plan.rejectionReason, tt.wantReason) {
+				t.Fatalf("rejection reason = %q, want substring %q", plan.rejectionReason, tt.wantReason)
+			}
+		})
+	}
+}
diff --git a/internal/controller/agent_execution_snapshot_retention.go b/internal/controller/agent_execution_snapshot_retention.go
new file mode 100644
index 000000000..433e8c5fd
--- /dev/null
+++ b/internal/controller/agent_execution_snapshot_retention.go
@@ -0,0 +1,230 @@
+package controller
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+const (
+	// DefaultAgentExecutionSnapshotRetentionInterval is the default cadence for
+	// reference-aware encrypted snapshot collection.
+	DefaultAgentExecutionSnapshotRetentionInterval = time.Hour
+	// DefaultAgentExecutionSnapshotRetention is the minimum audit/backup
+	// retention period before an unreferenced snapshot becomes collectible.
+	DefaultAgentExecutionSnapshotRetention = 30 * 24 * time.Hour
+)
+
+// AgentExecutionSnapshotRetentionManager removes encrypted execution
+// snapshots only after both Kubernetes and durable-store references have been
+// absent for a complete retention window. The in-memory unreferenced clock is
+// intentionally conservative: a controller restart starts the window again,
+// delaying collection rather than risking premature deletion.
+type AgentExecutionSnapshotRetentionManager struct {
+	APIReader client.Reader
+	Store     store.AgentExecutionSnapshotLifecycleStore
+	Namespace string
+
+	Retention time.Duration
+	Interval  time.Duration
+	Now       func() time.Time
+
+	unreferencedSince map[string]time.Time
+}
+
+// NeedLeaderElection keeps lifecycle decisions on the single elected writer.
+func (*AgentExecutionSnapshotRetentionManager) NeedLeaderElection() bool { return true }
+
+// Start runs one pass immediately and then periodically until cancellation.
+func (m *AgentExecutionSnapshotRetentionManager) Start(ctx context.Context) error {
+	if err := m.validate(); err != nil {
+		return err
+	}
+	interval := m.Interval
+	if interval <= 0 {
+		interval = DefaultAgentExecutionSnapshotRetentionInterval
+	}
+	timer := time.NewTimer(0)
+	defer timer.Stop()
+	logger := log.FromContext(ctx).WithName("agent-execution-snapshot-retention")
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-timer.C:
+			if err := m.collectOnce(ctx); err != nil && !errors.Is(err, context.Canceled) {
+				logger.Error(err, "snapshot retention pass failed closed")
+			}
+			timer.Reset(interval)
+		}
+	}
+}
+
+func (m *AgentExecutionSnapshotRetentionManager) validate() error {
+	if m == nil || m.APIReader == nil || m.Store == nil {
+		return errors.New("snapshot retention requires an uncached Kubernetes reader and lifecycle store")
+	}
+	if strings.TrimSpace(m.Namespace) == "" {
+		return errors.New("snapshot retention namespace is required")
+	}
+	if m.retention() <= 0 {
+		return errors.New("snapshot retention duration must be positive")
+	}
+	return nil
+}
+
+func (m *AgentExecutionSnapshotRetentionManager) retention() time.Duration {
+	if m.Retention > 0 {
+		return m.Retention
+	}
+	return DefaultAgentExecutionSnapshotRetention
+}
+
+func (m *AgentExecutionSnapshotRetentionManager) now() time.Time {
+	if m.Now != nil {
+		return m.Now().UTC()
+	}
+	return time.Now().UTC()
+}
+
+func (m *AgentExecutionSnapshotRetentionManager) collectOnce(ctx context.Context) error {
+	if err := m.validate(); err != nil {
+		return err
+	}
+	now := m.now()
+	metadata, err := m.Store.ListAgentExecutionSnapshotMetadataBefore(ctx, now.Add(-m.retention()))
+	if err != nil {
+		return fmt.Errorf("list retained execution snapshots: %w", err)
+	}
+	references, err := m.loadKubernetesReferences(ctx)
+	if err != nil {
+		return err
+	}
+	if m.unreferencedSince == nil {
+		m.unreferencedSince = make(map[string]time.Time)
+	}
+	seen := make(map[string]struct{}, len(metadata))
+	for _, item := range metadata {
+		if err := item.Validate(); err != nil {
+			return fmt.Errorf("validate execution snapshot lifecycle metadata: %w", err)
+		}
+		id := item.Key.ID()
+		seen[id] = struct{}{}
+		if references.retains(item.Key) {
+			delete(m.unreferencedSince, id)
+			continue
+		}
+		counts, err := m.Store.CountAgentExecutionSnapshotReferences(ctx, item.Key)
+		if err != nil {
+			return fmt.Errorf("count durable execution snapshot references for %s: %w", id, err)
+		}
+		if counts.Total() != 0 {
+			delete(m.unreferencedSince, id)
+			continue
+		}
+		unreferencedAt, observed := m.unreferencedSince[id]
+		if !observed {
+			m.unreferencedSince[id] = now
+			continue
+		}
+		if now.Sub(unreferencedAt) < m.retention() {
+			continue
+		}
+
+		// Re-list all Kubernetes references and re-count durable references at
+		// the deletion boundary. Any uncertainty aborts the pass without
+		// deleting this or later candidates.
+		latestReferences, err := m.loadKubernetesReferences(ctx)
+		if err != nil {
+			return err
+		}
+		if latestReferences.retains(item.Key) {
+			delete(m.unreferencedSince, id)
+			continue
+		}
+		counts, err = m.Store.CountAgentExecutionSnapshotReferences(ctx, item.Key)
+		if err != nil {
+			return fmt.Errorf("recount durable execution snapshot references for %s: %w", id, err)
+		}
+		if counts.Total() != 0 {
+			delete(m.unreferencedSince, id)
+			continue
+		}
+		if err := m.Store.DeleteAgentExecutionSnapshot(ctx, item.Key); err != nil {
+			return fmt.Errorf("delete unreferenced execution snapshot %s: %w", id, err)
+		}
+		delete(m.unreferencedSince, id)
+		log.FromContext(ctx).Info("deleted expired unreferenced execution snapshot",
+			"taskUID", item.Key.TaskUID,
+			"snapshotDigest", abbreviatedSnapshotDigest(item.Key.Digest),
+			"schemaVersion", item.SchemaVersion,
+		)
+	}
+	for id := range m.unreferencedSince {
+		if _, ok := seen[id]; !ok {
+			delete(m.unreferencedSince, id)
+		}
+	}
+	return nil
+}
+
+type agentExecutionSnapshotKubernetesReferences struct {
+	taskUIDs             map[string]struct{}
+	sessionLeaseTaskUIDs map[string]struct{}
+}
+
+func (m *AgentExecutionSnapshotRetentionManager) loadKubernetesReferences(
+	ctx context.Context,
+) (agentExecutionSnapshotKubernetesReferences, error) {
+	result := agentExecutionSnapshotKubernetesReferences{
+		taskUIDs:             make(map[string]struct{}),
+		sessionLeaseTaskUIDs: make(map[string]struct{}),
+	}
+	namespace := client.InNamespace(strings.TrimSpace(m.Namespace))
+	tasks := &corev1alpha1.TaskList{}
+	if err := m.APIReader.List(ctx, tasks, namespace); err != nil {
+		return result, fmt.Errorf("list Tasks for snapshot retention: %w", err)
+	}
+	for i := range tasks.Items {
+		if uid := strings.TrimSpace(string(tasks.Items[i].UID)); uid != "" {
+			result.taskUIDs[uid] = struct{}{}
+		}
+	}
+	sessions := &corev1alpha1.RuntimeSessionControlList{}
+	if err := m.APIReader.List(ctx, sessions, namespace); err != nil {
+		return result, fmt.Errorf("list RuntimeSessionControls for snapshot retention: %w", err)
+	}
+	for i := range sessions.Items {
+		session := &sessions.Items[i]
+		if session.Status.MutationLease != nil {
+			if taskUID := strings.TrimSpace(session.Status.MutationLease.TaskUID); taskUID != "" {
+				result.sessionLeaseTaskUIDs[taskUID] = struct{}{}
+			}
+		}
+	}
+	return result, nil
+}
+
+func (r agentExecutionSnapshotKubernetesReferences) retains(key store.AgentExecutionSnapshotKey) bool {
+	if _, ok := r.taskUIDs[key.TaskUID]; ok {
+		return true
+	}
+	_, ok := r.sessionLeaseTaskUIDs[key.TaskUID]
+	return ok
+}
+
+func abbreviatedSnapshotDigest(digest string) string {
+	const prefixLength = len("sha256:") + 12
+	if len(digest) <= prefixLength {
+		return digest
+	}
+	return digest[:prefixLength]
+}
diff --git a/internal/controller/agent_execution_snapshot_retention_test.go b/internal/controller/agent_execution_snapshot_retention_test.go
new file mode 100644
index 000000000..4036dc732
--- /dev/null
+++ b/internal/controller/agent_execution_snapshot_retention_test.go
@@ -0,0 +1,226 @@
+package controller
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+func TestAgentExecutionSnapshotRetentionRequiresTwoReferenceFreeWindows(t *testing.T) {
+	ctx := context.Background()
+	now := time.Date(2026, 8, 6, 12, 0, 0, 0, time.UTC)
+	item := snapshotRetentionMetadata("task-uid", "snapshot", now.Add(-2*time.Hour))
+	lifecycle := newSnapshotRetentionLifecycleStore(item)
+	manager := &AgentExecutionSnapshotRetentionManager{
+		APIReader: emptySnapshotRetentionClient(t),
+		Store:     lifecycle, Namespace: "default", Retention: time.Hour, Now: func() time.Time { return now },
+	}
+
+	require.NoError(t, manager.collectOnce(ctx))
+	require.Empty(t, lifecycle.deleted)
+
+	now = now.Add(59 * time.Minute)
+	require.NoError(t, manager.collectOnce(ctx))
+	require.Empty(t, lifecycle.deleted)
+
+	now = now.Add(time.Minute)
+	require.NoError(t, manager.collectOnce(ctx))
+	require.Equal(t, []store.AgentExecutionSnapshotKey{item.Key}, lifecycle.deleted)
+}
+
+func TestAgentExecutionSnapshotRetentionHonorsKubernetesReferences(t *testing.T) {
+	ctx := context.Background()
+	now := time.Date(2026, 8, 6, 12, 0, 0, 0, time.UTC)
+	taskItem := snapshotRetentionMetadata("task-reference", "task", now.Add(-3*time.Hour))
+	leaseItem := snapshotRetentionMetadata("lease-reference", "lease", now.Add(-3*time.Hour))
+	lifecycle := newSnapshotRetentionLifecycleStore(taskItem, leaseItem)
+
+	task := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{
+		Namespace: "default", Name: "retained-task", UID: types.UID(taskItem.Key.TaskUID),
+	}}
+	session := &corev1alpha1.RuntimeSessionControl{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "retained-session"},
+		Status: corev1alpha1.RuntimeSessionControlStatus{
+			MutationLease: &corev1alpha1.RuntimeSessionMutationLeaseStatus{TaskUID: leaseItem.Key.TaskUID},
+		},
+	}
+	manager := &AgentExecutionSnapshotRetentionManager{
+		APIReader: snapshotRetentionClient(t, task, session),
+		Store:     lifecycle, Namespace: "default", Retention: time.Hour, Now: func() time.Time { return now },
+	}
+
+	require.NoError(t, manager.collectOnce(ctx))
+	now = now.Add(2 * time.Hour)
+	require.NoError(t, manager.collectOnce(ctx))
+	require.Empty(t, lifecycle.deleted)
+	require.Empty(t, manager.unreferencedSince)
+}
+
+func TestAgentExecutionSnapshotRetentionScopesKubernetesReferencesToNamespace(t *testing.T) {
+	ctx := context.Background()
+	now := time.Date(2026, 8, 6, 12, 0, 0, 0, time.UTC)
+	ownedItem := snapshotRetentionMetadata("owned-task", "owned", now.Add(-3*time.Hour))
+	foreignTaskItem := snapshotRetentionMetadata("foreign-task", "foreign-task", now.Add(-3*time.Hour))
+	foreignLeaseItem := snapshotRetentionMetadata("foreign-lease", "foreign-lease", now.Add(-3*time.Hour))
+	lifecycle := newSnapshotRetentionLifecycleStore(ownedItem, foreignTaskItem, foreignLeaseItem)
+
+	ownedTask := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{
+		Namespace: "tenant-a", Name: "owned", UID: types.UID(ownedItem.Key.TaskUID),
+	}}
+	foreignTask := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{
+		Namespace: "tenant-b", Name: "foreign", UID: types.UID(foreignTaskItem.Key.TaskUID),
+	}}
+	foreignSession := &corev1alpha1.RuntimeSessionControl{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "tenant-b", Name: "foreign-session"},
+		Status: corev1alpha1.RuntimeSessionControlStatus{
+			MutationLease: &corev1alpha1.RuntimeSessionMutationLeaseStatus{TaskUID: foreignLeaseItem.Key.TaskUID},
+		},
+	}
+	manager := &AgentExecutionSnapshotRetentionManager{
+		APIReader: snapshotRetentionClient(t, ownedTask, foreignTask, foreignSession),
+		Store:     lifecycle, Namespace: "tenant-a", Retention: time.Hour, Now: func() time.Time { return now },
+	}
+
+	require.NoError(t, manager.collectOnce(ctx))
+	now = now.Add(time.Hour)
+	require.NoError(t, manager.collectOnce(ctx))
+	require.ElementsMatch(t, []store.AgentExecutionSnapshotKey{foreignTaskItem.Key, foreignLeaseItem.Key}, lifecycle.deleted)
+	_, ownedRetained := lifecycle.metadata[ownedItem.Key.ID()]
+	require.True(t, ownedRetained)
+}
+
+func TestAgentExecutionSnapshotRetentionRequiresNamespace(t *testing.T) {
+	manager := &AgentExecutionSnapshotRetentionManager{
+		APIReader: emptySnapshotRetentionClient(t),
+		Store:     newSnapshotRetentionLifecycleStore(),
+		Retention: time.Hour,
+	}
+
+	require.EqualError(t, manager.collectOnce(context.Background()), "snapshot retention namespace is required")
+}
+
+func TestAgentExecutionSnapshotRetentionDoesNotTreatLineageConfigAsSnapshot(t *testing.T) {
+	ctx := context.Background()
+	now := time.Date(2026, 8, 6, 12, 0, 0, 0, time.UTC)
+	item := snapshotRetentionMetadata("lineage-task", "snapshot", now.Add(-3*time.Hour))
+	lifecycle := newSnapshotRetentionLifecycleStore(item)
+	session := &corev1alpha1.RuntimeSessionControl{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "unrelated-lineage"},
+		Status: corev1alpha1.RuntimeSessionControlStatus{
+			Lineage: &corev1alpha1.RuntimeSessionLineageStatus{ConfigDigest: item.Key.Digest},
+		},
+	}
+	manager := &AgentExecutionSnapshotRetentionManager{
+		APIReader: snapshotRetentionClient(t, session),
+		Store:     lifecycle, Namespace: "default", Retention: time.Hour, Now: func() time.Time { return now },
+	}
+
+	require.NoError(t, manager.collectOnce(ctx))
+	now = now.Add(time.Hour)
+	require.NoError(t, manager.collectOnce(ctx))
+	require.Equal(t, []store.AgentExecutionSnapshotKey{item.Key}, lifecycle.deleted)
+}
+
+func TestAgentExecutionSnapshotRetentionDurableReferenceResetsClock(t *testing.T) {
+	ctx := context.Background()
+	now := time.Date(2026, 8, 6, 12, 0, 0, 0, time.UTC)
+	item := snapshotRetentionMetadata("task-uid", "durable", now.Add(-3*time.Hour))
+	lifecycle := newSnapshotRetentionLifecycleStore(item)
+	manager := &AgentExecutionSnapshotRetentionManager{
+		APIReader: emptySnapshotRetentionClient(t),
+		Store:     lifecycle, Namespace: "default", Retention: time.Hour, Now: func() time.Time { return now },
+	}
+
+	require.NoError(t, manager.collectOnce(ctx))
+	now = now.Add(time.Hour)
+	lifecycle.references[item.Key.ID()] = store.AgentExecutionSnapshotReferenceCounts{SessionTurns: 1}
+	require.NoError(t, manager.collectOnce(ctx))
+	require.Empty(t, manager.unreferencedSince)
+
+	now = now.Add(time.Hour)
+	delete(lifecycle.references, item.Key.ID())
+	require.NoError(t, manager.collectOnce(ctx))
+	require.Empty(t, lifecycle.deleted)
+
+	now = now.Add(time.Hour)
+	require.NoError(t, manager.collectOnce(ctx))
+	require.Equal(t, []store.AgentExecutionSnapshotKey{item.Key}, lifecycle.deleted)
+}
+
+func snapshotRetentionMetadata(taskUID, seed string, createdAt time.Time) store.AgentExecutionSnapshotMetadata {
+	return store.AgentExecutionSnapshotMetadata{
+		Key: store.AgentExecutionSnapshotKey{
+			TaskUID: taskUID,
+			Digest:  store.CanonicalAgentExecutionSnapshotDigest([]byte(seed)),
+		},
+		SchemaVersion: store.AgentExecutionSnapshotSchemaVersion,
+		CreatedAt:     createdAt,
+	}
+}
+
+func emptySnapshotRetentionClient(t *testing.T) client.Client {
+	return snapshotRetentionClient(t)
+}
+
+func snapshotRetentionClient(t *testing.T, objects ...client.Object) client.Client {
+	t.Helper()
+	scheme := runtime.NewScheme()
+	require.NoError(t, corev1alpha1.AddToScheme(scheme))
+	return fake.NewClientBuilder().WithScheme(scheme).WithObjects(objects...).Build()
+}
+
+type snapshotRetentionLifecycleStore struct {
+	metadata   map[string]store.AgentExecutionSnapshotMetadata
+	references map[string]store.AgentExecutionSnapshotReferenceCounts
+	deleted    []store.AgentExecutionSnapshotKey
+}
+
+func newSnapshotRetentionLifecycleStore(items ...store.AgentExecutionSnapshotMetadata) *snapshotRetentionLifecycleStore {
+	result := &snapshotRetentionLifecycleStore{
+		metadata:   make(map[string]store.AgentExecutionSnapshotMetadata, len(items)),
+		references: make(map[string]store.AgentExecutionSnapshotReferenceCounts),
+	}
+	for _, item := range items {
+		result.metadata[item.Key.ID()] = item
+	}
+	return result
+}
+
+func (s *snapshotRetentionLifecycleStore) ListAgentExecutionSnapshotMetadataBefore(
+	_ context.Context,
+	cutoff time.Time,
+) ([]store.AgentExecutionSnapshotMetadata, error) {
+	result := make([]store.AgentExecutionSnapshotMetadata, 0, len(s.metadata))
+	for _, item := range s.metadata {
+		if item.CreatedAt.Before(cutoff) {
+			result = append(result, item)
+		}
+	}
+	return result, nil
+}
+
+func (s *snapshotRetentionLifecycleStore) CountAgentExecutionSnapshotReferences(
+	_ context.Context,
+	key store.AgentExecutionSnapshotKey,
+) (store.AgentExecutionSnapshotReferenceCounts, error) {
+	return s.references[key.ID()], nil
+}
+
+func (s *snapshotRetentionLifecycleStore) DeleteAgentExecutionSnapshot(
+	_ context.Context,
+	key store.AgentExecutionSnapshotKey,
+) error {
+	delete(s.metadata, key.ID())
+	s.deleted = append(s.deleted, key)
+	return nil
+}
diff --git a/internal/controller/agent_runtime_controller.go b/internal/controller/agent_runtime_controller.go
index 4852f4ba5..d800d225f 100644
--- a/internal/controller/agent_runtime_controller.go
+++ b/internal/controller/agent_runtime_controller.go
@@ -9,6 +9,7 @@ package controller
 import (
 	"context"
 	"fmt"
+	"net/http"
 	"net/netip"
 	"net/url"
 	"slices"
@@ -20,6 +21,7 @@ import (
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	k8sruntime "k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/log"
@@ -28,7 +30,9 @@ import (
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
 	"github.com/orka-agents/orka/internal/events"
 	"github.com/orka-agents/orka/internal/harness"
-	"github.com/orka-agents/orka/internal/harness/conformance"
+	v1conformance "github.com/orka-agents/orka/internal/harness/conformance"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	v2conformance "github.com/orka-agents/orka/internal/harness/v2/conformance"
 )
 
 var agentRuntimeAllowInsecureLoopbackForTests bool
@@ -39,16 +43,19 @@ const (
 	agentRuntimeReasonNotReady = "ConformanceFailed"
 	agentRuntimeProbeTimeout   = 60 * time.Second
 	agentRuntimeRequeue        = 30 * time.Second
+	agentRuntimeMinBearerBytes = 32
 
 	agentRuntimeAuthUseLabel           = "orka.ai/agent-runtime-auth"
 	agentRuntimeAuthRefNameLabel       = "orka.ai/agent-runtime-name"
 	agentRuntimeAuthEndpointAnnotation = "orka.ai/agent-runtime-endpoint"
 )
 
-// AgentRuntimeReconciler reconciles AgentRuntime registry entries.
+// AgentRuntimeReconciler reconciles external harness v1 and v2 registry entries.
 type AgentRuntimeReconciler struct {
 	client.Client
-	Scheme *k8sruntime.Scheme
+	APIReader           client.Reader
+	Scheme              *k8sruntime.Scheme
+	HarnessV1HTTPClient *http.Client
 }
 
 // +kubebuilder:rbac:groups=core.orka.ai,resources=agentruntimes,verbs=get;list;watch;create;update;patch;delete
@@ -57,7 +64,7 @@ type AgentRuntimeReconciler struct {
 // +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch
 // +kubebuilder:rbac:groups="",resources=services,verbs=get;list;watch
 
-// Reconcile validates an external Orka harness endpoint and publishes condition-ready status.
+// Reconcile validates one exact external runtime and publishes condition-ready status.
 func (r *AgentRuntimeReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	logger := log.FromContext(ctx)
 	runtime := &corev1alpha1.AgentRuntime{}
@@ -69,407 +76,770 @@ func (r *AgentRuntimeReconciler) Reconcile(ctx context.Context, req ctrl.Request
 	}
 
 	logger.Info("Reconciling AgentRuntime", "agentRuntime", runtime.Name, "mode", runtime.Spec.Deployment.Mode)
-	observed, ready, authRefResourceVersion, message := r.probeAgentRuntime(ctx, runtime)
-	return r.updateAgentRuntimeStatus(ctx, runtime, ready, observed, authRefResourceVersion, message)
+	observed, ready, controllerAuthVersion, capabilityAuthVersion, message := r.probeAgentRuntime(ctx, runtime)
+	return r.updateAgentRuntimeStatus(ctx, runtime, ready, observed, controllerAuthVersion, capabilityAuthVersion, message)
 }
 
 func (r *AgentRuntimeReconciler) probeAgentRuntime(
 	ctx context.Context,
 	runtime *corev1alpha1.AgentRuntime,
-) (*corev1alpha1.AgentRuntimeObservedCapabilities, bool, string, string) {
+) (*corev1alpha1.AgentRuntimeObservedCapabilities, bool, string, string, string) {
 	if err := validateAgentRuntimeSpec(runtime); err != nil {
-		return nil, false, "", err.Error()
+		return nil, false, "", "", err.Error()
 	}
 	if err := r.validateAgentRuntimeEndpointPolicy(ctx, runtime); err != nil {
-		return nil, false, "", err.Error()
+		return nil, false, "", "", err.Error()
 	}
-	token, authRefResourceVersion, err := r.agentRuntimeBearerToken(ctx, runtime)
+	if runtime.RegisteredContractVersion() == corev1alpha1.AgentRuntimeContractHarnessV1 {
+		return r.probeHarnessV1AgentRuntime(ctx, runtime)
+	}
+	auth, err := r.agentRuntimeAuthMaterial(ctx, runtime)
+	if err != nil {
+		return nil, false, "", "", err.Error()
+	}
+	profile, err := agentRuntimeProfile(*runtime.Spec.Capabilities.Profile)
+	if err != nil {
+		return nil, false, auth.controllerResourceVersion, auth.capabilityResourceVersion, err.Error()
+	}
+	limits, err := agentRuntimeProtocolLimits(*runtime.Spec.Capabilities.Limits)
+	if err != nil {
+		return nil, false, auth.controllerResourceVersion, auth.capabilityResourceVersion, err.Error()
+	}
+	governance, err := agentRuntimeWorkspaceGovernance(*runtime.Spec.Capabilities.WorkspaceGovernance)
 	if err != nil {
-		return nil, false, "", err.Error()
+		return nil, false, auth.controllerResourceVersion, auth.capabilityResourceVersion, err.Error()
 	}
+	deepProbe := runtime.Status.ObservedGeneration != runtime.Generation || !runtime.Status.Ready ||
+		runtime.Status.ObservedControllerAuthRefResourceVersion != auth.controllerResourceVersion ||
+		runtime.Status.ObservedOperationCapabilityRefResourceVersion != auth.capabilityResourceVersion
 	probeCtx, cancel := context.WithTimeout(ctx, agentRuntimeProbeTimeout)
 	defer cancel()
+	target := v2conformance.Target{
+		BaseURL:                         runtime.Spec.Deployment.Endpoint,
+		ControllerBearerToken:           auth.controllerBearerToken,
+		OperationCapabilitySecret:       auth.operationCapabilitySecret,
+		ControlTimeout:                  agentRuntimeProbeTimeout,
+		ExpectedRuntimeInstanceID:       harnessv2.RuntimeInstanceID(runtime.Spec.Capabilities.RuntimeInstanceID),
+		Profile:                         profile,
+		Limits:                          limits,
+		SupportsDrain:                   runtime.Spec.Capabilities.SupportsDrain,
+		SupportsPublicationFinalization: runtime.Spec.Capabilities.SupportsPublicationFinalization,
+		WorkspaceGovernance:             governance,
+		ProbeLifecycle:                  deepProbe,
+	}
+	probe := v2conformance.Check(probeCtx, target)
+	if !deepProbe && probe.Passed && agentRuntimeAuthenticatedIdentityChanged(runtime.Status.ObservedCapabilities, probe.ObservedStatus) {
+		target.ProbeLifecycle = true
+		probe = v2conformance.Check(probeCtx, target)
+	}
+	observed := observedCapabilitiesFromConformance(probe)
+	if !probe.Passed {
+		return observed, false, auth.controllerResourceVersion, auth.capabilityResourceVersion,
+			sanitizeAgentRuntimeStatusMessage(probe.Message)
+	}
+	return observed, true, auth.controllerResourceVersion, auth.capabilityResourceVersion,
+		"authenticated orka.harness.v2 conformance passed"
+}
+
+func agentRuntimeAuthenticatedIdentityChanged(
+	previous *corev1alpha1.AgentRuntimeObservedCapabilities,
+	current *harnessv2.StatusResponse,
+) bool {
+	if previous == nil || current == nil {
+		return true
+	}
+	fence := current.Fence
+	return previous.RuntimeInstanceID != string(fence.RuntimeInstanceID) ||
+		previous.SupervisorBootID != string(fence.SupervisorBootID) ||
+		previous.ControllerEpoch != int64(fence.ControllerEpoch) ||
+		previous.RuntimePoolUID != string(fence.RuntimePoolUID) ||
+		previous.RuntimePoolGeneration != int64(fence.RuntimePoolGeneration) ||
+		previous.RuntimeProfileDigest != string(fence.RuntimeProfileDigest) ||
+		previous.ProfileDigestSchemaVersion != int32(fence.ProfileDigestSchemaVersion)
+}
+
+func (r *AgentRuntimeReconciler) probeHarnessV1AgentRuntime(
+	ctx context.Context,
+	runtime *corev1alpha1.AgentRuntime,
+) (*corev1alpha1.AgentRuntimeObservedCapabilities, bool, string, string, string) {
+	auth, err := r.agentRuntimeV1BearerAuthMaterial(ctx, runtime)
+	if err != nil {
+		return nil, false, "", "", err.Error()
+	}
 	deepProbe := runtime.Status.ObservedGeneration != runtime.Generation || !runtime.Status.Ready ||
-		runtime.Status.ObservedAuthRefResourceVersion != authRefResourceVersion
-	preflight := conformance.Check(probeCtx, conformance.Target{
+		runtime.Status.ObservedAuthRefResourceVersion != auth.secretResourceVersion
+	probeCtx, cancel := context.WithTimeout(ctx, agentRuntimeProbeTimeout)
+	defer cancel()
+	target := v1conformance.Target{
 		BaseURL:        runtime.Spec.Deployment.Endpoint,
-		BearerToken:    token,
+		BearerToken:    auth.bearerToken,
+		HTTPClient:     r.HarnessV1HTTPClient,
 		ControlTimeout: agentRuntimeProbeTimeout,
 		RequireAuth:    true,
-	})
-	observed := observedCapabilitiesFromConformance(preflight.ObservedCapabilities)
-	if !preflight.Passed {
-		return observed, false, authRefResourceVersion, sanitizeAgentRuntimeStatusMessage(preflight.Message)
 	}
-	if err := validateAgentRuntimeRequiredCapabilities(runtime, preflight.ObservedCapabilities); err != nil {
-		return observed, false, authRefResourceVersion, err.Error()
+	var probe v1conformance.Result
+	if deepProbe {
+		probe = v1conformance.CheckReadiness(probeCtx, target)
+	} else {
+		probe = v1conformance.Check(probeCtx, target)
+	}
+	observed := observedHarnessV1CapabilitiesFromConformance(probe.ObservedCapabilities)
+	if !probe.Passed {
+		return observed, false, auth.secretResourceVersion, "", sanitizeAgentRuntimeStatusMessage(probe.Message)
 	}
-	if err := validateAgentRuntimeExecutableCapabilities(preflight.ObservedCapabilities); err != nil {
-		return observed, false, authRefResourceVersion, err.Error()
+	if err := validateHarnessV1AgentRuntimeRequiredCapabilities(runtime, probe.ObservedCapabilities); err != nil {
+		return observed, false, auth.secretResourceVersion, "", err.Error()
 	}
-	if deepProbe {
-		for _, class := range brokeredClassesToProbe(preflight.ObservedCapabilities) {
-			switch class {
-			case corev1alpha1.AgentRuntimeBrokeredToolClassRead:
-				brokeredReadProbe := conformance.Check(probeCtx, conformance.Target{
-					BaseURL:           runtime.Spec.Deployment.Endpoint,
-					BearerToken:       token,
-					ControlTimeout:    agentRuntimeProbeTimeout,
-					ProbeBrokeredRead: true,
-					RequireAuth:       true,
-				})
-				if !brokeredReadProbe.Passed {
-					return observed, false, authRefResourceVersion, sanitizeAgentRuntimeStatusMessage(brokeredReadProbe.Message)
-				}
-			case corev1alpha1.AgentRuntimeBrokeredToolClassWrite:
-				brokeredWriteProbe := conformance.Check(probeCtx, conformance.Target{
-					BaseURL:            runtime.Spec.Deployment.Endpoint,
-					BearerToken:        token,
-					ControlTimeout:     agentRuntimeProbeTimeout,
-					ProbeBrokeredWrite: true,
-					RequireAuth:        true,
-				})
-				if !brokeredWriteProbe.Passed {
-					return observed, false, authRefResourceVersion, sanitizeAgentRuntimeStatusMessage(brokeredWriteProbe.Message)
-				}
-			case corev1alpha1.AgentRuntimeBrokeredToolClassCoordination:
-				brokeredCoordinationProbe := conformance.Check(probeCtx, conformance.Target{
-					BaseURL:                   runtime.Spec.Deployment.Endpoint,
-					BearerToken:               token,
-					ControlTimeout:            agentRuntimeProbeTimeout,
-					ProbeBrokeredCoordination: true,
-					RequireAuth:               true,
-				})
-				if !brokeredCoordinationProbe.Passed {
-					return observed, false, authRefResourceVersion, sanitizeAgentRuntimeStatusMessage(brokeredCoordinationProbe.Message)
-				}
-			}
+	if err := validateHarnessV1AgentRuntimeExecutableCapabilities(probe.ObservedCapabilities); err != nil {
+		return observed, false, auth.secretResourceVersion, "", err.Error()
+	}
+	if err := r.requireCurrentAgentRuntimeV1BearerAuthMaterial(ctx, runtime, auth); err != nil {
+		return observed, false, auth.secretResourceVersion, "", err.Error()
+	}
+	return observed, true, auth.secretResourceVersion, "", "authenticated orka.harness.v1 conformance passed"
+}
+
+func validateHarnessV1AgentRuntimeRequiredCapabilities(
+	runtime *corev1alpha1.AgentRuntime,
+	capabilities *harness.CapabilitiesResponse,
+) error {
+	if runtime == nil {
+		return fmt.Errorf("AgentRuntime is required")
+	}
+	if capabilities == nil {
+		return fmt.Errorf("observed harness v1 capabilities are missing")
+	}
+	required := runtime.Spec.Capabilities
+	if required == nil {
+		return nil
+	}
+	if required.SupportsCancel != nil && *required.SupportsCancel && !capabilities.SupportsCancel {
+		return fmt.Errorf("runtime does not advertise required supportsCancel capability")
+	}
+	if required.SupportsRuntimeSessions != nil && *required.SupportsRuntimeSessions && !capabilities.SupportsRuntimeSessions {
+		return fmt.Errorf("runtime does not advertise required supportsRuntimeSessions capability")
+	}
+	if required.SupportsContinuation != nil && *required.SupportsContinuation && !capabilities.SupportsContinuation {
+		return fmt.Errorf("runtime does not advertise required supportsContinuation capability")
+	}
+	if required.SupportsArtifacts != nil && *required.SupportsArtifacts && !capabilities.SupportsArtifacts {
+		return fmt.Errorf("runtime does not advertise required supportsArtifacts capability")
+	}
+	for _, requiredMode := range required.ToolExecutionModes {
+		if !slices.ContainsFunc(capabilities.ToolExecutionModes, func(observed harness.ToolExecutionMode) bool {
+			return string(observed) == string(requiredMode)
+		}) {
+			return fmt.Errorf("runtime does not advertise required toolExecutionMode %q", requiredMode)
 		}
 	}
-	if deepProbe && capabilityHasToolMode(preflight.ObservedCapabilities, corev1alpha1.AgentRuntimeToolExecutionModeObserved) {
-		turnProbe := conformance.Check(probeCtx, conformance.Target{
-			BaseURL:        runtime.Spec.Deployment.Endpoint,
-			BearerToken:    token,
-			ControlTimeout: agentRuntimeProbeTimeout,
-			ProbeTurn:      true,
-			RequireAuth:    true,
-		})
-		if turnProbe.ObservedCapabilities != nil {
-			if err := validateAgentRuntimeRequiredCapabilities(runtime, turnProbe.ObservedCapabilities); err != nil {
-				return observed, false, authRefResourceVersion, err.Error()
-			}
-			observed = observedCapabilitiesFromConformance(turnProbe.ObservedCapabilities)
+	for _, requiredClass := range required.BrokeredToolClasses {
+		if !slices.ContainsFunc(capabilities.BrokeredToolClasses, func(observed harness.BrokeredToolClass) bool {
+			return string(observed) == string(requiredClass)
+		}) {
+			return fmt.Errorf("runtime does not advertise required brokeredToolClass %q", requiredClass)
 		}
-		if !turnProbe.Passed {
-			return observed, false, authRefResourceVersion, sanitizeAgentRuntimeStatusMessage(turnProbe.Message)
+	}
+	return nil
+}
+
+func validateHarnessV1AgentRuntimeExecutableCapabilities(capabilities *harness.CapabilitiesResponse) error {
+	if capabilities == nil {
+		return fmt.Errorf("observed harness v1 capabilities are missing")
+	}
+	if capabilities.RuntimeName != sanitizeAgentRuntimeCapabilityValue(capabilities.RuntimeName) {
+		return fmt.Errorf("runtimeName contains unsafe text or exceeds status length limits")
+	}
+	for _, mode := range capabilities.ToolExecutionModes {
+		if !harness.IsKnownToolExecutionMode(mode) {
+			return fmt.Errorf("unsupported toolExecutionMode %q", mode)
 		}
 	}
-	return observed, true, authRefResourceVersion, "AgentRuntime passed Orka harness readiness checks"
+	for _, class := range capabilities.BrokeredToolClasses {
+		if !harness.IsKnownBrokeredToolClass(class) {
+			return fmt.Errorf("unsupported brokeredToolClass %q", class)
+		}
+	}
+	if !capabilities.SupportsRuntimeSessions {
+		return fmt.Errorf("runtime does not advertise required supportsRuntimeSessions capability")
+	}
+	observed := slices.Contains(capabilities.ToolExecutionModes, harness.ToolExecutionModeObserved)
+	brokered := slices.Contains(capabilities.ToolExecutionModes, harness.ToolExecutionModeBrokered)
+	if !observed && !brokered {
+		return fmt.Errorf("runtime must advertise toolExecutionMode %q or %q",
+			corev1alpha1.AgentRuntimeToolExecutionModeObserved, corev1alpha1.AgentRuntimeToolExecutionModeBrokered)
+	}
+	if !capabilities.SupportsCancel {
+		return fmt.Errorf("runtime does not advertise required supportsCancel capability")
+	}
+	if brokered && !capabilities.SupportsContinuation {
+		return fmt.Errorf("runtime advertises brokered mode but not supportsContinuation")
+	}
+	if brokered && len(capabilities.BrokeredToolClasses) == 0 {
+		return fmt.Errorf("runtime advertises brokered mode but no brokeredToolClasses")
+	}
+	if capabilities.MaxOutputBytes > harness.MaxFetchTurnOutputBytes {
+		return fmt.Errorf(
+			"runtime maxOutputBytes %d exceeds controller fetch limit %d",
+			capabilities.MaxOutputBytes,
+			harness.MaxFetchTurnOutputBytes,
+		)
+	}
+	return nil
 }
 
-func brokeredClassesToProbe(caps *harness.CapabilitiesResponse) []corev1alpha1.AgentRuntimeBrokeredToolClass {
-	if caps == nil || len(caps.BrokeredToolClasses) == 0 {
+func observedHarnessV1CapabilitiesFromConformance(
+	capabilities *harness.CapabilitiesResponse,
+) *corev1alpha1.AgentRuntimeObservedCapabilities {
+	if capabilities == nil {
 		return nil
 	}
-	classes := make([]corev1alpha1.AgentRuntimeBrokeredToolClass, 0, len(caps.BrokeredToolClasses))
-	seen := map[corev1alpha1.AgentRuntimeBrokeredToolClass]struct{}{}
-	for _, class := range caps.BrokeredToolClasses {
+	modes := make([]corev1alpha1.AgentRuntimeToolExecutionMode, 0, len(capabilities.ToolExecutionModes))
+	seenModes := make(map[corev1alpha1.AgentRuntimeToolExecutionMode]struct{}, len(capabilities.ToolExecutionModes))
+	for _, mode := range capabilities.ToolExecutionModes {
+		converted := corev1alpha1.AgentRuntimeToolExecutionMode(mode)
+		if _, duplicate := seenModes[converted]; duplicate || !harness.IsKnownToolExecutionMode(mode) {
+			continue
+		}
+		seenModes[converted] = struct{}{}
+		modes = append(modes, converted)
+	}
+	classes := make([]corev1alpha1.AgentRuntimeBrokeredToolClass, 0, len(capabilities.BrokeredToolClasses))
+	seenClasses := make(map[corev1alpha1.AgentRuntimeBrokeredToolClass]struct{}, len(capabilities.BrokeredToolClasses))
+	for _, class := range capabilities.BrokeredToolClasses {
 		converted := corev1alpha1.AgentRuntimeBrokeredToolClass(class)
-		if _, ok := seen[converted]; ok {
+		if _, duplicate := seenClasses[converted]; duplicate || !harness.IsKnownBrokeredToolClass(class) {
 			continue
 		}
-		seen[converted] = struct{}{}
+		seenClasses[converted] = struct{}{}
 		classes = append(classes, converted)
 	}
-	return classes
+	return &corev1alpha1.AgentRuntimeObservedCapabilities{
+		ProtocolVersion:           sanitizeAgentRuntimeCapabilityValue(capabilities.ProtocolVersion),
+		Transport:                 sanitizeAgentRuntimeCapabilityValue(capabilities.Transport),
+		RuntimeName:               sanitizeAgentRuntimeCapabilityValue(capabilities.RuntimeName),
+		RuntimeVersion:            sanitizeAgentRuntimeCapabilityValue(capabilities.RuntimeVersion),
+		ProviderKind:              sanitizeAgentRuntimeCapabilityValue(string(capabilities.ProviderKind)),
+		ToolExecutionModes:        modes,
+		BrokeredToolClasses:       classes,
+		SupportsCancel:            capabilities.SupportsCancel,
+		SupportsRuntimeSessions:   capabilities.SupportsRuntimeSessions,
+		SupportsContinuation:      capabilities.SupportsContinuation,
+		SupportsArtifacts:         capabilities.SupportsArtifacts,
+		SupportsSuspend:           capabilities.SupportsSuspend,
+		SupportsWorkspaceSnapshot: capabilities.SupportsWorkspaceSnapshot,
+		MaxConcurrentTurns:        capabilities.MaxConcurrentTurns,
+		MaxTurnSeconds:            capabilities.MaxTurnSeconds,
+		MaxOutputBytes:            capabilities.MaxOutputBytes,
+	}
 }
 
-func validateAgentRuntimeSpec(runtime *corev1alpha1.AgentRuntime) error {
-	if runtime == nil {
-		return fmt.Errorf("AgentRuntime is required")
+type agentRuntimeV1AuthMaterial struct {
+	bearerToken           string
+	secretUID             types.UID
+	secretResourceVersion string
+}
+
+func (r *AgentRuntimeReconciler) agentRuntimeV1BearerAuthMaterial(
+	ctx context.Context,
+	runtime *corev1alpha1.AgentRuntime,
+) (agentRuntimeV1AuthMaterial, error) {
+	if runtime == nil || runtime.Spec.ClientAuth.BearerAuthRef == nil {
+		return agentRuntimeV1AuthMaterial{}, fmt.Errorf("AgentRuntime v1 bearerTokenSecretRef is required")
 	}
-	if runtime.Spec.ContractVersion != corev1alpha1.AgentRuntimeContractHarnessV1 {
-		return fmt.Errorf("unsupported contractVersion %q", runtime.Spec.ContractVersion)
+	if r.APIReader == nil {
+		return agentRuntimeV1AuthMaterial{}, fmt.Errorf("uncached APIReader is required for exact AgentRuntime v1 bearer Secret validation")
 	}
-	if runtime.Spec.Deployment.Mode != corev1alpha1.AgentRuntimeDeploymentModeExternalEndpoint {
-		return fmt.Errorf("unsupported deployment.mode %q", runtime.Spec.Deployment.Mode)
+	ref := *runtime.Spec.ClientAuth.BearerAuthRef
+	var secret corev1.Secret
+	if err := r.APIReader.Get(ctx, types.NamespacedName{Namespace: runtime.Namespace, Name: ref.Name}, &secret); err != nil {
+		if apierrors.IsNotFound(err) {
+			return agentRuntimeV1AuthMaterial{}, fmt.Errorf("AgentRuntime bearer token Secret %s/%s not found", runtime.Namespace, ref.Name)
+		}
+		return agentRuntimeV1AuthMaterial{}, fmt.Errorf("get AgentRuntime bearer token Secret %s/%s: %w", runtime.Namespace, ref.Name, err)
 	}
-	endpoint := strings.TrimSpace(runtime.Spec.Deployment.Endpoint)
-	if endpoint == "" {
-		return fmt.Errorf("deployment.endpoint is required for external-endpoint AgentRuntime")
+	if err := validateAgentRuntimeAuthSecretUse(runtime.Name, runtime.Spec.Deployment.Endpoint, &secret); err != nil {
+		return agentRuntimeV1AuthMaterial{}, err
 	}
-	parsed, err := url.Parse(endpoint)
-	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
-		return fmt.Errorf("deployment.endpoint must be an absolute http(s) URL")
+	if secret.UID == "" {
+		return agentRuntimeV1AuthMaterial{}, fmt.Errorf("AgentRuntime bearer token Secret %s/%s UID is required", secret.Namespace, secret.Name)
 	}
-	if parsed.Scheme != urlSchemeHTTP && parsed.Scheme != urlSchemeHTTPS {
-		return fmt.Errorf("deployment.endpoint scheme %q is not supported", parsed.Scheme)
+	resourceVersion := strings.TrimSpace(secret.ResourceVersion)
+	if resourceVersion == "" {
+		return agentRuntimeV1AuthMaterial{}, fmt.Errorf("AgentRuntime bearer token Secret %s/%s resourceVersion is required", secret.Namespace, secret.Name)
 	}
-	if parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" {
-		return fmt.Errorf("deployment.endpoint must not include credentials, query, or fragment components")
+	token := strings.TrimSpace(string(secret.Data[ref.Key]))
+	if token == "" {
+		return agentRuntimeV1AuthMaterial{}, fmt.Errorf("AgentRuntime bearer token Secret %s/%s key %q is empty or missing", secret.Namespace, secret.Name, ref.Key)
 	}
-	ref := runtime.Spec.ClientAuth.BearerAuthRef
-	if strings.TrimSpace(ref.Name) == "" {
-		return fmt.Errorf("clientAuth.bearerTokenSecretRef.name is required")
+	if len(token) < agentRuntimeMinBearerBytes {
+		return agentRuntimeV1AuthMaterial{}, fmt.Errorf("AgentRuntime bearer token Secret %s/%s key %q must contain at least %d bytes", secret.Namespace, secret.Name, ref.Key, agentRuntimeMinBearerBytes)
 	}
-	if strings.TrimSpace(ref.Key) == "" {
-		return fmt.Errorf("clientAuth.bearerTokenSecretRef.key is required")
+	if !agentRuntimeBearerTokenHeaderSafe(token) {
+		return agentRuntimeV1AuthMaterial{}, fmt.Errorf("AgentRuntime bearer token Secret %s/%s key %q contains invalid HTTP header bytes", secret.Namespace, secret.Name, ref.Key)
 	}
-	return nil
+	return agentRuntimeV1AuthMaterial{
+		bearerToken: token, secretUID: secret.UID, secretResourceVersion: resourceVersion,
+	}, nil
 }
 
-func (r *AgentRuntimeReconciler) validateAgentRuntimeEndpointPolicy(ctx context.Context, runtime *corev1alpha1.AgentRuntime) error {
-	parsed, err := url.Parse(strings.TrimSpace(runtime.Spec.Deployment.Endpoint))
-	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
-		return fmt.Errorf("deployment.endpoint must be an absolute http(s) URL")
-	}
-	if parsed.Scheme != urlSchemeHTTP {
-		return nil
-	}
-	host := parsed.Hostname()
-	if isLoopbackAgentRuntimeEndpoint(host) && agentRuntimeAllowInsecureLoopbackForTests {
-		return nil
-	}
-	if serviceName, serviceNamespace, ok := parseAgentRuntimeServiceNamespaceHost(host); ok && serviceNamespace == runtime.Namespace {
-		if r != nil && r.Client != nil {
-			service := &corev1.Service{}
-			if err := r.Get(ctx, client.ObjectKey{Name: serviceName, Namespace: serviceNamespace}, service); err == nil && service.Spec.Type != corev1.ServiceTypeExternalName && len(service.Spec.Selector) > 0 {
-				return nil
-			}
+func agentRuntimeBearerTokenHeaderSafe(token string) bool {
+	for i := 0; i < len(token); i++ {
+		if token[i] <= 0x20 || token[i] >= 0x7f {
+			return false
 		}
 	}
-	return fmt.Errorf("deployment.endpoint must use https for non-local AgentRuntime endpoints")
+	return true
 }
 
-func isLoopbackAgentRuntimeEndpoint(host string) bool {
-	host = strings.Trim(strings.ToLower(strings.TrimSpace(host)), "[]")
-	if host == "" {
-		return false
+func (r *AgentRuntimeReconciler) requireCurrentAgentRuntimeV1BearerAuthMaterial(
+	ctx context.Context,
+	runtime *corev1alpha1.AgentRuntime,
+	expected agentRuntimeV1AuthMaterial,
+) error {
+	current, err := r.agentRuntimeV1BearerAuthMaterial(ctx, runtime)
+	if err != nil {
+		return fmt.Errorf("revalidate AgentRuntime v1 bearer auth after conformance: %w", err)
 	}
-	if addr, err := netip.ParseAddr(host); err == nil {
-		return addr.IsLoopback()
+	if current.secretUID != expected.secretUID {
+		return fmt.Errorf("AgentRuntime v1 bearer token Secret was replaced during conformance; readiness fails closed")
 	}
-	return host == "localhost"
+	if current.secretResourceVersion != expected.secretResourceVersion {
+		return fmt.Errorf("AgentRuntime v1 bearer token Secret changed during conformance; readiness fails closed")
+	}
+	return nil
 }
 
-func parseAgentRuntimeServiceNamespaceHost(host string) (serviceName, serviceNamespace string, ok bool) {
-	host = strings.Trim(strings.ToLower(strings.TrimSpace(host)), ".")
-	if host == "" {
-		return "", "", false
+type agentRuntimeAuthMaterial struct {
+	controllerBearerToken     string
+	operationCapabilitySecret []byte
+	controllerResourceVersion string
+	capabilityResourceVersion string
+}
+
+func validateAgentRuntimeSpec(runtime *corev1alpha1.AgentRuntime) error {
+	if runtime == nil {
+		return fmt.Errorf("AgentRuntime is required")
 	}
-	parts := strings.Split(host, ".")
-	switch {
-	case len(parts) == 2:
-		serviceName, serviceNamespace = parts[0], parts[1]
-	case len(parts) == 3 && parts[2] == k8sServiceDNSLabel:
-		serviceName, serviceNamespace = parts[0], parts[1]
-	case len(parts) == 5 && parts[2] == k8sServiceDNSLabel && parts[3] == k8sClusterDNSLabel && parts[4] == k8sLocalDNSLabel:
-		serviceName, serviceNamespace = parts[0], parts[1]
+	contract := runtime.RegisteredContractVersion()
+	switch contract {
+	case corev1alpha1.AgentRuntimeContractHarnessV1, corev1alpha1.AgentRuntimeContractHarnessV2:
 	default:
-		return "", "", false
+		return fmt.Errorf("AgentRuntime contractVersion is unclassified; explicit %q or %q classification is required and omission is never protocol evidence",
+			corev1alpha1.AgentRuntimeContractHarnessV1, corev1alpha1.AgentRuntimeContractHarnessV2)
 	}
-	if serviceName == "" || serviceNamespace == "" {
-		return "", "", false
+	if runtime.Spec.Deployment.Mode != corev1alpha1.AgentRuntimeDeploymentModeExternalEndpoint {
+		return fmt.Errorf("unsupported AgentRuntime deployment mode %q", runtime.Spec.Deployment.Mode)
 	}
-	return serviceName, serviceNamespace, true
+	switch contract {
+	case corev1alpha1.AgentRuntimeContractHarnessV1:
+		if err := validateHarnessV1AgentRuntimeEndpointSpec(runtime.Spec.Deployment.Endpoint); err != nil {
+			return err
+		}
+		if err := validateHarnessV1AgentRuntimeClientAuthSpec(runtime.Spec.ClientAuth); err != nil {
+			return err
+		}
+		return validateHarnessV1AgentRuntimeCapabilitiesSpec(runtime.Spec.Capabilities)
+	case corev1alpha1.AgentRuntimeContractHarnessV2:
+		if err := validateAgentRuntimeEndpointSpec(runtime.Spec.Deployment.Endpoint); err != nil {
+			return err
+		}
+		if err := validateAgentRuntimeClientAuthSpec(runtime.Spec.ClientAuth); err != nil {
+			return err
+		}
+		return validateAgentRuntimeCapabilitiesSpec(runtime.Spec.Capabilities)
+	}
+	return nil
 }
 
-func validateAgentRuntimeBearerSecretUse(runtimeName string, endpoint string, secret *corev1.Secret) error {
-	runtimeName = strings.TrimSpace(runtimeName)
-	endpoint = strings.TrimSpace(endpoint)
-	if secret == nil {
-		return fmt.Errorf("bearer token Secret is required")
-	}
-	if secret.Labels[agentRuntimeAuthUseLabel] != scheduledRunLabelValue {
-		return fmt.Errorf("bearer token Secret %q must be labeled %s=%s before an AgentRuntime can use it", secret.Name, agentRuntimeAuthUseLabel, scheduledRunLabelValue)
+func validateHarnessV1AgentRuntimeEndpointSpec(endpoint string) error {
+	if _, err := harness.NewClient(endpoint); err != nil {
+		return fmt.Errorf("AgentRuntime endpoint is invalid: %w", err)
 	}
-	if allowed := strings.TrimSpace(secret.Labels[agentRuntimeAuthRefNameLabel]); allowed != "" && allowed != runtimeName {
-		return fmt.Errorf("bearer token Secret %q is labeled for AgentRuntime %q, not %q", secret.Name, allowed, runtimeName)
+	parsed, err := url.Parse(strings.TrimSpace(endpoint))
+	if err != nil {
+		return fmt.Errorf("AgentRuntime endpoint is invalid: %w", err)
 	}
-	boundEndpoint := strings.TrimSpace(secret.Annotations[agentRuntimeAuthEndpointAnnotation])
-	if boundEndpoint == "" {
-		return fmt.Errorf("bearer token Secret %q must be annotated %s=<deployment.endpoint> before an AgentRuntime can use it", secret.Name, agentRuntimeAuthEndpointAnnotation)
+	if parsed.Scheme != urlSchemeHTTPS {
+		host := strings.TrimSuffix(strings.ToLower(parsed.Hostname()), ".")
+		if !agentRuntimeAllowInsecureLoopbackForTests || !isLoopbackAgentRuntimeEndpoint(host) {
+			return fmt.Errorf("authenticated orka.harness.v1 AgentRuntime endpoints must use https")
+		}
 	}
-	if boundEndpoint != endpoint {
-		return fmt.Errorf("bearer token Secret %q is annotated for endpoint %q, not %q", secret.Name, sanitizeAgentRuntimeEndpointForStatus(boundEndpoint), sanitizeAgentRuntimeEndpointForStatus(endpoint))
+	return nil
+}
+
+func validateAgentRuntimeEndpointSpec(endpoint string) error {
+	if _, err := harnessv2.NewClient(endpoint); err != nil {
+		return fmt.Errorf("AgentRuntime endpoint is invalid: %w", err)
 	}
 	return nil
 }
 
-func (r *AgentRuntimeReconciler) agentRuntimeBearerToken(ctx context.Context, runtime *corev1alpha1.AgentRuntime) (string, string, error) {
-	ref := runtime.Spec.ClientAuth.BearerAuthRef
-	secret := &corev1.Secret{}
-	if err := r.Get(ctx, client.ObjectKey{Namespace: runtime.Namespace, Name: ref.Name}, secret); err != nil {
-		if apierrors.IsNotFound(err) {
-			return "", "", fmt.Errorf("bearer token Secret %q not found", ref.Name)
-		}
-		return "", "", fmt.Errorf("read bearer token Secret %q: %w", ref.Name, err)
+func validateAgentRuntimeClientAuthSpec(auth corev1alpha1.AgentRuntimeClientAuth) error {
+	if auth.BearerAuthRef != nil {
+		return fmt.Errorf("orka.harness.v2 AgentRuntime must not carry the legacy v1 bearerTokenSecretRef auth shape")
 	}
-	if err := validateAgentRuntimeBearerSecretUse(runtime.Name, runtime.Spec.Deployment.Endpoint, secret); err != nil {
-		return "", "", err
+	if auth.ControllerBearerTokenSecretRef == nil || auth.ControllerBearerTokenSecretRef.Name == "" || auth.ControllerBearerTokenSecretRef.Key == "" {
+		return fmt.Errorf("AgentRuntime controllerBearerTokenSecretRef name and key are required")
 	}
-	value := strings.TrimSpace(string(secret.Data[ref.Key]))
-	if value == "" {
-		return "", "", fmt.Errorf("bearer token Secret %q key %q is empty or missing", ref.Name, ref.Key)
+	if auth.OperationCapabilitySecretRef == nil || auth.OperationCapabilitySecretRef.Name == "" || auth.OperationCapabilitySecretRef.Key == "" {
+		return fmt.Errorf("AgentRuntime operationCapabilitySecretRef name and key are required")
 	}
-	return value, strings.TrimSpace(secret.ResourceVersion), nil
+	if *auth.ControllerBearerTokenSecretRef == *auth.OperationCapabilitySecretRef {
+		return fmt.Errorf("controller bearer token and operation capability must use distinct Secret keys")
+	}
+	return nil
 }
 
-func validateBaseHarnessCapabilities(caps *harness.CapabilitiesResponse) error {
-	if caps == nil {
-		return fmt.Errorf("observed capabilities are missing")
+func validateHarnessV1AgentRuntimeClientAuthSpec(auth corev1alpha1.AgentRuntimeClientAuth) error {
+	if auth.ControllerBearerTokenSecretRef != nil || auth.OperationCapabilitySecretRef != nil {
+		return fmt.Errorf("orka.harness.v1 AgentRuntime must not carry the v2 controller bearer or operation capability auth shape")
 	}
-	if caps.RuntimeName != sanitizeAgentRuntimeCapabilityValue(caps.RuntimeName) {
-		return fmt.Errorf("runtimeName contains unsafe text or exceeds status length limits")
+	if auth.BearerAuthRef == nil || strings.TrimSpace(auth.BearerAuthRef.Name) == "" || strings.TrimSpace(auth.BearerAuthRef.Key) == "" {
+		return fmt.Errorf("AgentRuntime bearerTokenSecretRef name and key are required")
 	}
-	for _, class := range caps.BrokeredToolClasses {
-		if !harness.IsKnownBrokeredToolClass(class) {
-			return fmt.Errorf("unsupported brokeredToolClass %q", class)
+	return nil
+}
+
+func validateHarnessV1AgentRuntimeCapabilitiesSpec(capabilities *corev1alpha1.AgentRuntimeCapabilitiesSpec) error {
+	if capabilities == nil {
+		return nil
+	}
+	if strings.TrimSpace(capabilities.RuntimeInstanceID) != "" || capabilities.Profile != nil ||
+		capabilities.Limits != nil || capabilities.WorkspaceGovernance != nil ||
+		capabilities.SupportsDrain || capabilities.SupportsPublicationFinalization {
+		return fmt.Errorf("orka.harness.v1 AgentRuntime capabilities must not carry harness v2 capability fields")
+	}
+	seenModes := make(map[corev1alpha1.AgentRuntimeToolExecutionMode]struct{}, len(capabilities.ToolExecutionModes))
+	for _, mode := range capabilities.ToolExecutionModes {
+		switch mode {
+		case corev1alpha1.AgentRuntimeToolExecutionModeObserved, corev1alpha1.AgentRuntimeToolExecutionModeBrokered:
+		default:
+			return fmt.Errorf("orka.harness.v1 AgentRuntime tool execution mode %q is unsupported", mode)
+		}
+		if _, duplicate := seenModes[mode]; duplicate {
+			return fmt.Errorf("orka.harness.v1 AgentRuntime tool execution mode %q is duplicated", mode)
+		}
+		seenModes[mode] = struct{}{}
+	}
+	seenClasses := make(map[corev1alpha1.AgentRuntimeBrokeredToolClass]struct{}, len(capabilities.BrokeredToolClasses))
+	for _, class := range capabilities.BrokeredToolClasses {
+		switch class {
+		case corev1alpha1.AgentRuntimeBrokeredToolClassRead,
+			corev1alpha1.AgentRuntimeBrokeredToolClassWrite,
+			corev1alpha1.AgentRuntimeBrokeredToolClassCoordination:
+		default:
+			return fmt.Errorf("orka.harness.v1 AgentRuntime brokered tool class %q is unsupported", class)
+		}
+		if _, duplicate := seenClasses[class]; duplicate {
+			return fmt.Errorf("orka.harness.v1 AgentRuntime brokered tool class %q is duplicated", class)
 		}
+		seenClasses[class] = struct{}{}
 	}
 	return nil
 }
 
-func validateAgentRuntimeExecutableCapabilities(caps *harness.CapabilitiesResponse) error {
-	if err := validateBaseHarnessCapabilities(caps); err != nil {
+func validateAgentRuntimeCapabilitiesSpec(capabilities *corev1alpha1.AgentRuntimeCapabilitiesSpec) error {
+	if capabilities == nil {
+		return fmt.Errorf("AgentRuntime capabilities are required")
+	}
+	if capabilities.Profile == nil || capabilities.Limits == nil || capabilities.WorkspaceGovernance == nil {
+		return fmt.Errorf("orka.harness.v2 AgentRuntime capabilities require profile, limits, and workspaceGovernance")
+	}
+	if len(capabilities.ToolExecutionModes) > 0 || len(capabilities.BrokeredToolClasses) > 0 ||
+		capabilities.SupportsCancel != nil || capabilities.SupportsRuntimeSessions != nil ||
+		capabilities.SupportsContinuation != nil || capabilities.SupportsArtifacts != nil {
+		return fmt.Errorf("orka.harness.v2 AgentRuntime capabilities must not carry harness v1 capability fields")
+	}
+	if _, err := harnessv2.PathSegment("runtime instance ID", capabilities.RuntimeInstanceID); err != nil {
+		return fmt.Errorf("AgentRuntime capabilities.runtimeInstanceID: %w", err)
+	}
+	profile, err := agentRuntimeProfile(*capabilities.Profile)
+	if err != nil {
 		return err
 	}
-	if !caps.SupportsRuntimeSessions {
-		return fmt.Errorf("runtime does not advertise required supportsRuntimeSessions capability")
+	digest, err := harnessv2.CanonicalProfileDigest(profile)
+	if err != nil {
+		return fmt.Errorf("canonicalize AgentRuntime profile: %w", err)
 	}
-	observed := capabilityHasToolMode(caps, corev1alpha1.AgentRuntimeToolExecutionModeObserved)
-	brokered := capabilityHasToolMode(caps, corev1alpha1.AgentRuntimeToolExecutionModeBrokered)
-	if observed && !caps.SupportsCancel {
-		return fmt.Errorf("runtime advertises observed mode but not supportsCancel")
+	if string(digest) != capabilities.Profile.Digest {
+		return fmt.Errorf("AgentRuntime profile digest %q does not match canonical digest %q", capabilities.Profile.Digest, digest)
 	}
-	if !observed && !brokered {
-		return fmt.Errorf("runtime must advertise toolExecutionMode %q or %q", corev1alpha1.AgentRuntimeToolExecutionModeObserved, corev1alpha1.AgentRuntimeToolExecutionModeBrokered)
+	if _, err := agentRuntimeProtocolLimits(*capabilities.Limits); err != nil {
+		return err
 	}
-	if brokered {
-		if !caps.SupportsContinuation {
-			return fmt.Errorf("runtime advertises brokered mode but not supportsContinuation")
-		}
-		if len(caps.BrokeredToolClasses) == 0 {
-			return fmt.Errorf("runtime advertises brokered mode but no brokeredToolClasses")
-		}
+	governance, err := agentRuntimeWorkspaceGovernance(*capabilities.WorkspaceGovernance)
+	if err != nil {
+		return err
+	}
+	if governance.Mode == v2conformance.WorkspaceGovernanceTrusted && hasStrictWorkspaceGovernanceClaim(governance) {
+		return fmt.Errorf("trusted-non-governed runtime must not claim strict workspace guarantees")
 	}
 	return nil
 }
 
-func validateObservedHarnessCapabilities(caps *harness.CapabilitiesResponse) error {
-	if err := validateBaseHarnessCapabilities(caps); err != nil {
-		return err
+func hasStrictWorkspaceGovernanceClaim(governance v2conformance.WorkspaceGovernanceClaims) bool {
+	return governance.OrkaOwnedWorkspaceDeltas || governance.PromptScopedBrokerAuthorization ||
+		governance.NoDirectSCMPublication || governance.OrkaOwnedCleanRoomPublication ||
+		governance.ExactInstanceFencing || governance.DuplicateSafeMutations || governance.CancellationSettlement
+}
+
+func agentRuntimeProfile(spec corev1alpha1.AgentRuntimeProfileSpec) (harnessv2.RuntimeProfile, error) {
+	var modelLimits *harnessv2.ModelTokenLimits
+	if spec.ModelLimits != nil {
+		modelLimits = &harnessv2.ModelTokenLimits{Context: spec.ModelLimits.Context, Output: spec.ModelLimits.Output}
+	}
+	profile := harnessv2.RuntimeProfile{
+		ACPProfile:               spec.ACPProfile,
+		AdapterDigests:           map[string]string{spec.AdapterName: spec.AdapterDigest},
+		ProviderKind:             spec.ProviderKind,
+		Model:                    spec.Model,
+		ModelLimits:              modelLimits,
+		AgentConfigurationDigest: spec.AgentConfigurationDigest,
+		ToolPolicyDigest:         spec.ToolPolicyDigest,
+		ApprovalPolicyDigest:     spec.ApprovalPolicyDigest,
+		MCPConfigurationDigest:   spec.MCPConfigurationDigest,
+		WorkspaceIntent:          harnessv2.WorkspaceIntent(spec.WorkspaceIntent),
+		ProxyCredentialRole:      spec.ProxyCredentialRole,
+		ProxyCredentialScope:     spec.ProxyCredentialScope,
+		ResourceClass:            spec.ResourceClass,
+	}
+	if spec.DigestSchemaVersion != int32(harnessv2.ProfileDigestSchemaVersion) {
+		return harnessv2.RuntimeProfile{}, fmt.Errorf("AgentRuntime profile digest schema version %d is unsupported; want %d", spec.DigestSchemaVersion, harnessv2.ProfileDigestSchemaVersion)
+	}
+	if err := profile.Validate(); err != nil {
+		return harnessv2.RuntimeProfile{}, fmt.Errorf("AgentRuntime profile: %w", err)
+	}
+	return profile, nil
+}
+
+func agentRuntimeProtocolLimits(spec corev1alpha1.AgentRuntimeProtocolLimits) (harnessv2.ProtocolLimits, error) {
+	limits := harnessv2.ProtocolLimits{
+		MaxResidentSessions:      uint32(spec.MaxResidentSessions),
+		MaxConcurrentPrompts:     uint32(spec.MaxConcurrentPrompts),
+		MaxRequestBytes:          int(spec.MaxRequestBytes),
+		MaxEventLineBytes:        int(spec.MaxEventLineBytes),
+		MaxTerminalResultBytes:   int(spec.MaxTerminalResultBytes),
+		MaxBufferedEvents:        int(spec.MaxBufferedEvents),
+		MaxUpdateEventsPerSecond: int(spec.MaxUpdateEventsPerSecond),
+		MinPromptLeaseMillis:     spec.MinPromptLeaseMillis,
+		MaxPromptLeaseMillis:     spec.MaxPromptLeaseMillis,
+		MaxPendingPermissions:    uint32(spec.MaxPendingPermissions),
+		MaxWorkspaceDeltaBytes:   spec.MaxWorkspaceDeltaBytes,
+	}
+	if spec.MaxResidentSessions <= 0 || spec.MaxConcurrentPrompts <= 0 || spec.MaxRequestBytes <= 0 ||
+		spec.MaxEventLineBytes <= 0 || spec.MaxTerminalResultBytes <= 0 || spec.MaxBufferedEvents <= 0 ||
+		spec.MaxUpdateEventsPerSecond <= 0 || spec.MinPromptLeaseMillis <= 0 || spec.MaxPromptLeaseMillis <= 0 ||
+		spec.MaxPendingPermissions <= 0 || spec.MaxWorkspaceDeltaBytes <= 0 {
+		return harnessv2.ProtocolLimits{}, fmt.Errorf("AgentRuntime protocol limits must all be positive")
+	}
+	if err := limits.Validate(); err != nil {
+		return harnessv2.ProtocolLimits{}, fmt.Errorf("AgentRuntime protocol limits: %w", err)
+	}
+	return limits, nil
+}
+
+func agentRuntimeWorkspaceGovernance(spec corev1alpha1.AgentRuntimeWorkspaceGovernanceCapabilities) (v2conformance.WorkspaceGovernanceClaims, error) {
+	claims := v2conformance.WorkspaceGovernanceClaims{
+		Mode:                            v2conformance.WorkspaceGovernanceMode(spec.Mode),
+		Trusted:                         spec.Trusted,
+		OrkaOwnedWorkspaceDeltas:        spec.OrkaOwnedWorkspaceDeltas,
+		PromptScopedBrokerAuthorization: spec.PromptScopedBrokerAuthorization,
+		NoDirectSCMPublication:          spec.NoDirectSCMPublication,
+		OrkaOwnedCleanRoomPublication:   spec.OrkaOwnedCleanRoomPublication,
+		ExactInstanceFencing:            spec.ExactInstanceFencing,
+		DuplicateSafeMutations:          spec.DuplicateSafeMutations,
+		CancellationSettlement:          spec.CancellationSettlement,
+	}
+	if err := claims.Validate(); err != nil {
+		return v2conformance.WorkspaceGovernanceClaims{}, fmt.Errorf("AgentRuntime workspace governance: %w", err)
+	}
+	return claims, nil
+}
+
+func (r *AgentRuntimeReconciler) validateAgentRuntimeEndpointPolicy(ctx context.Context, runtime *corev1alpha1.AgentRuntime) error {
+	parsed, err := url.Parse(strings.TrimSpace(runtime.Spec.Deployment.Endpoint))
+	if err != nil {
+		return fmt.Errorf("parse AgentRuntime endpoint: %w", err)
 	}
-	if !capabilityHasToolMode(caps, corev1alpha1.AgentRuntimeToolExecutionModeObserved) {
-		return fmt.Errorf("runtime does not advertise required toolExecutionMode %q", corev1alpha1.AgentRuntimeToolExecutionModeObserved)
+	host := strings.TrimSuffix(strings.ToLower(parsed.Hostname()), ".")
+	if host == "" {
+		return fmt.Errorf("AgentRuntime endpoint host is required")
 	}
-	if !caps.SupportsCancel {
-		return fmt.Errorf("runtime does not advertise required supportsCancel capability")
+	if isLoopbackAgentRuntimeEndpoint(host) {
+		if agentRuntimeAllowInsecureLoopbackForTests {
+			return nil
+		}
+		return fmt.Errorf("AgentRuntime endpoint loopback addresses are not permitted")
 	}
-	if !caps.SupportsRuntimeSessions {
-		return fmt.Errorf("runtime does not advertise required supportsRuntimeSessions capability")
+	serviceName, serviceNamespace, serviceEndpoint := parseAgentRuntimeServiceNamespaceHost(host)
+	if serviceEndpoint {
+		if serviceNamespace != runtime.Namespace {
+			return fmt.Errorf("AgentRuntime service endpoint namespace %q must match AgentRuntime namespace %q", serviceNamespace, runtime.Namespace)
+		}
+		var service corev1.Service
+		if err := r.Get(ctx, types.NamespacedName{Namespace: serviceNamespace, Name: serviceName}, &service); err != nil {
+			return fmt.Errorf("get AgentRuntime endpoint Service %s/%s: %w", serviceNamespace, serviceName, err)
+		}
+		return nil
+	}
+	if parsed.Scheme != urlSchemeHTTPS {
+		return fmt.Errorf("external AgentRuntime endpoints must use https")
 	}
 	return nil
 }
 
-func validateAgentRuntimeRequiredCapabilities(
-	runtime *corev1alpha1.AgentRuntime,
-	caps *harness.CapabilitiesResponse,
-) error {
-	if err := validateBaseHarnessCapabilities(caps); err != nil {
-		return err
+func isLoopbackAgentRuntimeEndpoint(host string) bool {
+	if host == "localhost" || strings.HasSuffix(host, ".localhost") {
+		return true
 	}
-	required := runtime.Spec.Capabilities
-	if required == nil {
-		return nil
+	address, err := netip.ParseAddr(host)
+	return err == nil && address.IsLoopback()
+}
+
+func parseAgentRuntimeServiceNamespaceHost(host string) (serviceName, serviceNamespace string, ok bool) {
+	labels := strings.Split(strings.TrimSuffix(strings.ToLower(host), "."), ".")
+	switch {
+	case len(labels) == 3 && labels[2] == k8sServiceDNSLabel:
+		return labels[0], labels[1], labels[0] != "" && labels[1] != ""
+	case len(labels) == 4 && labels[2] == k8sServiceDNSLabel && labels[3] == k8sClusterDNSLabel:
+		return labels[0], labels[1], labels[0] != "" && labels[1] != ""
+	case len(labels) == 5 && labels[2] == "svc" && labels[3] == "cluster" && labels[4] == "local":
+		return labels[0], labels[1], labels[0] != "" && labels[1] != ""
+	default:
+		return "", "", false
 	}
-	if required.SupportsCancel != nil && *required.SupportsCancel && !caps.SupportsCancel {
-		return fmt.Errorf("runtime does not advertise required supportsCancel capability")
+}
+
+func validateAgentRuntimeAuthSecretUse(runtimeName string, endpoint string, secret *corev1.Secret) error {
+	if secret == nil {
+		return fmt.Errorf("AgentRuntime auth Secret is required")
 	}
-	if required.SupportsRuntimeSessions != nil && *required.SupportsRuntimeSessions && !caps.SupportsRuntimeSessions {
-		return fmt.Errorf("runtime does not advertise required supportsRuntimeSessions capability")
+	if secret.Labels[agentRuntimeAuthUseLabel] != scheduledRunLabelValue {
+		return fmt.Errorf("AgentRuntime auth Secret %s/%s must set label %s=true", secret.Namespace, secret.Name, agentRuntimeAuthUseLabel)
 	}
-	if required.SupportsContinuation != nil && *required.SupportsContinuation && !caps.SupportsContinuation {
-		return fmt.Errorf("runtime does not advertise required supportsContinuation capability")
+	if boundRuntime := strings.TrimSpace(secret.Labels[agentRuntimeAuthRefNameLabel]); boundRuntime != "" && boundRuntime != runtimeName {
+		return fmt.Errorf("AgentRuntime auth Secret %s/%s is bound to AgentRuntime %q", secret.Namespace, secret.Name, boundRuntime)
 	}
-	if required.SupportsArtifacts != nil && *required.SupportsArtifacts && !caps.SupportsArtifacts {
-		return fmt.Errorf("runtime does not advertise required supportsArtifacts capability")
+	boundEndpoint := strings.TrimSpace(secret.Annotations[agentRuntimeAuthEndpointAnnotation])
+	if boundEndpoint == "" {
+		return fmt.Errorf("AgentRuntime auth Secret %s/%s must set annotation %s", secret.Namespace, secret.Name, agentRuntimeAuthEndpointAnnotation)
 	}
-	for _, requiredMode := range required.ToolExecutionModes {
-		if !capabilityHasToolMode(caps, requiredMode) {
-			return fmt.Errorf("runtime does not advertise required toolExecutionMode %q", requiredMode)
-		}
-	}
-	for _, requiredClass := range required.BrokeredToolClasses {
-		if !capabilityHasBrokeredToolClass(caps, requiredClass) {
-			return fmt.Errorf("runtime does not advertise required brokeredToolClass %q", requiredClass)
-		}
+	if boundEndpoint != strings.TrimSpace(endpoint) {
+		return fmt.Errorf("AgentRuntime auth Secret %s/%s endpoint binding does not match AgentRuntime endpoint %q", secret.Namespace, secret.Name, sanitizeAgentRuntimeEndpointForStatus(endpoint))
 	}
 	return nil
 }
 
-func capabilityHasToolMode(caps *harness.CapabilitiesResponse, want corev1alpha1.AgentRuntimeToolExecutionMode) bool {
-	if caps == nil {
-		return false
+func (r *AgentRuntimeReconciler) agentRuntimeAuthMaterial(ctx context.Context, runtime *corev1alpha1.AgentRuntime) (agentRuntimeAuthMaterial, error) {
+	if runtime.Spec.ClientAuth.ControllerBearerTokenSecretRef == nil || runtime.Spec.ClientAuth.OperationCapabilitySecretRef == nil {
+		return agentRuntimeAuthMaterial{}, fmt.Errorf("AgentRuntime v2 client auth references are required")
+	}
+	controllerRef := *runtime.Spec.ClientAuth.ControllerBearerTokenSecretRef
+	capabilityRef := *runtime.Spec.ClientAuth.OperationCapabilitySecretRef
+	controllerSecret, err := r.getAgentRuntimeAuthSecret(ctx, runtime, controllerRef)
+	if err != nil {
+		return agentRuntimeAuthMaterial{}, fmt.Errorf("controller bearer token: %w", err)
 	}
-	return slices.ContainsFunc(caps.ToolExecutionModes, func(got harness.ToolExecutionMode) bool {
-		return string(got) == string(want)
-	})
+	capabilitySecret, err := r.getAgentRuntimeAuthSecret(ctx, runtime, capabilityRef)
+	if err != nil {
+		return agentRuntimeAuthMaterial{}, fmt.Errorf("operation capability secret: %w", err)
+	}
+	controllerToken, ok := controllerSecret.Data[controllerRef.Key]
+	if !ok || len(controllerToken) < 32 {
+		return agentRuntimeAuthMaterial{}, fmt.Errorf("AgentRuntime controller bearer token Secret %s/%s key %q must contain at least 32 bytes", runtime.Namespace, controllerRef.Name, controllerRef.Key)
+	}
+	capabilityKey, ok := capabilitySecret.Data[capabilityRef.Key]
+	if !ok || len(capabilityKey) < harnessv2.MinCapabilitySecretBytes {
+		return agentRuntimeAuthMaterial{}, fmt.Errorf("AgentRuntime operation capability Secret %s/%s key %q must contain at least %d bytes", runtime.Namespace, capabilityRef.Name, capabilityRef.Key, harnessv2.MinCapabilitySecretBytes)
+	}
+	return agentRuntimeAuthMaterial{
+		controllerBearerToken:     string(controllerToken),
+		operationCapabilitySecret: append([]byte(nil), capabilityKey...),
+		controllerResourceVersion: controllerSecret.ResourceVersion,
+		capabilityResourceVersion: capabilitySecret.ResourceVersion,
+	}, nil
 }
 
-func capabilityHasBrokeredToolClass(caps *harness.CapabilitiesResponse, want corev1alpha1.AgentRuntimeBrokeredToolClass) bool {
-	if caps == nil {
-		return false
+func (r *AgentRuntimeReconciler) getAgentRuntimeAuthSecret(
+	ctx context.Context,
+	runtime *corev1alpha1.AgentRuntime,
+	ref corev1alpha1.AgentRuntimeSecretKeyReference,
+) (*corev1.Secret, error) {
+	var secret corev1.Secret
+	if err := r.Get(ctx, types.NamespacedName{Namespace: runtime.Namespace, Name: ref.Name}, &secret); err != nil {
+		return nil, fmt.Errorf("get AgentRuntime auth Secret %s/%s: %w", runtime.Namespace, ref.Name, err)
+	}
+	if err := validateAgentRuntimeAuthSecretUse(runtime.Name, runtime.Spec.Deployment.Endpoint, &secret); err != nil {
+		return nil, err
 	}
-	return slices.ContainsFunc(caps.BrokeredToolClasses, func(got harness.BrokeredToolClass) bool {
-		return string(got) == string(want)
-	})
+	return &secret, nil
 }
 
-func observedCapabilitiesFromConformance(caps *harness.CapabilitiesResponse) *corev1alpha1.AgentRuntimeObservedCapabilities {
-	if caps == nil {
+func observedCapabilitiesFromConformance(probe v2conformance.Result) *corev1alpha1.AgentRuntimeObservedCapabilities {
+	if probe.ObservedCapabilities == nil && probe.ObservedStatus == nil {
 		return nil
 	}
-	modes := make([]corev1alpha1.AgentRuntimeToolExecutionMode, 0, len(caps.ToolExecutionModes))
-	seenModes := map[corev1alpha1.AgentRuntimeToolExecutionMode]struct{}{}
-	for _, mode := range caps.ToolExecutionModes {
-		converted := corev1alpha1.AgentRuntimeToolExecutionMode(mode)
-		if _, seen := seenModes[converted]; seen {
-			continue
+	observed := &corev1alpha1.AgentRuntimeObservedCapabilities{}
+	if capabilities := probe.ObservedCapabilities; capabilities != nil {
+		base := capabilities.CapabilitiesResponse
+		observed.ProtocolVersion = sanitizeAgentRuntimeCapabilityValue(base.Protocol)
+		observed.Transport = sanitizeAgentRuntimeCapabilityValue(base.Transport)
+		observed.ACPVersion = sanitizeAgentRuntimeCapabilityValue(base.ACPVersion)
+		observed.RuntimeProfileDigest = sanitizeAgentRuntimeCapabilityValue(string(base.RuntimeProfileDigest))
+		observed.ProfileDigestSchemaVersion = int32(base.ProfileDigestSchemaVersion)
+		limits := agentRuntimeObservedProtocolLimits(base.Limits)
+		observed.Limits = &limits
+		observed.SupportsDrain = base.SupportsDrain
+		observed.SupportsPublicationFinalization = base.SupportsPublicationFinalization
+		observed.WorkspaceGovernance = &corev1alpha1.AgentRuntimeWorkspaceGovernanceCapabilities{
+			Mode:                            corev1alpha1.AgentRuntimeWorkspaceGovernanceMode(capabilities.WorkspaceGovernance.Mode),
+			Trusted:                         capabilities.WorkspaceGovernance.Trusted,
+			OrkaOwnedWorkspaceDeltas:        capabilities.WorkspaceGovernance.OrkaOwnedWorkspaceDeltas,
+			PromptScopedBrokerAuthorization: capabilities.WorkspaceGovernance.PromptScopedBrokerAuthorization,
+			NoDirectSCMPublication:          capabilities.WorkspaceGovernance.NoDirectSCMPublication,
+			OrkaOwnedCleanRoomPublication:   capabilities.WorkspaceGovernance.OrkaOwnedCleanRoomPublication,
+			ExactInstanceFencing:            capabilities.WorkspaceGovernance.ExactInstanceFencing,
+			DuplicateSafeMutations:          capabilities.WorkspaceGovernance.DuplicateSafeMutations,
+			CancellationSettlement:          capabilities.WorkspaceGovernance.CancellationSettlement,
 		}
-		seenModes[converted] = struct{}{}
-		modes = append(modes, converted)
-	}
-	classes := make([]corev1alpha1.AgentRuntimeBrokeredToolClass, 0, len(caps.BrokeredToolClasses))
-	seenClasses := map[corev1alpha1.AgentRuntimeBrokeredToolClass]struct{}{}
-	for _, class := range caps.BrokeredToolClasses {
-		if !harness.IsKnownBrokeredToolClass(class) {
-			continue
+		if len(base.AdapterDigests) == 1 {
+			for name, digest := range base.AdapterDigests {
+				observed.AdapterName = sanitizeAgentRuntimeCapabilityValue(name)
+				observed.AdapterDigest = sanitizeAgentRuntimeCapabilityValue(digest)
+			}
 		}
-		converted := corev1alpha1.AgentRuntimeBrokeredToolClass(class)
-		if _, seen := seenClasses[converted]; seen {
-			continue
+		if len(base.Provider.ProviderKinds) == 1 {
+			observed.ProviderKind = sanitizeAgentRuntimeCapabilityValue(base.Provider.ProviderKinds[0])
+		}
+		if len(base.Provider.Models) == 1 {
+			observed.Model = sanitizeAgentRuntimeCapabilityValue(base.Provider.Models[0])
 		}
-		seenClasses[converted] = struct{}{}
-		classes = append(classes, converted)
 	}
-	return &corev1alpha1.AgentRuntimeObservedCapabilities{
-		ProtocolVersion:           sanitizeAgentRuntimeCapabilityValue(caps.ProtocolVersion),
-		Transport:                 sanitizeAgentRuntimeCapabilityValue(caps.Transport),
-		RuntimeName:               sanitizeAgentRuntimeCapabilityValue(caps.RuntimeName),
-		RuntimeVersion:            sanitizeAgentRuntimeCapabilityValue(caps.RuntimeVersion),
-		ProviderKind:              sanitizeAgentRuntimeCapabilityValue(string(caps.ProviderKind)),
-		ToolExecutionModes:        modes,
-		BrokeredToolClasses:       classes,
-		SupportsCancel:            caps.SupportsCancel,
-		SupportsRuntimeSessions:   caps.SupportsRuntimeSessions,
-		SupportsContinuation:      caps.SupportsContinuation,
-		SupportsArtifacts:         caps.SupportsArtifacts,
-		SupportsSuspend:           caps.SupportsSuspend,
-		SupportsWorkspaceSnapshot: caps.SupportsWorkspaceSnapshot,
-		MaxConcurrentTurns:        caps.MaxConcurrentTurns,
-		MaxTurnSeconds:            caps.MaxTurnSeconds,
-		MaxOutputBytes:            caps.MaxOutputBytes,
+	if status := probe.ObservedStatus; status != nil {
+		observed.RuntimeInstanceID = sanitizeAgentRuntimeCapabilityValue(string(status.Fence.RuntimeInstanceID))
+		observed.SupervisorBootID = sanitizeAgentRuntimeCapabilityValue(string(status.Fence.SupervisorBootID))
+		observed.ControllerEpoch = int64(status.Fence.ControllerEpoch)
+		observed.RuntimePoolUID = sanitizeAgentRuntimeCapabilityValue(string(status.Fence.RuntimePoolUID))
+		observed.RuntimePoolGeneration = int64(status.Fence.RuntimePoolGeneration)
+		observed.Lifecycle = sanitizeAgentRuntimeCapabilityValue(string(status.Lifecycle))
+	}
+	return observed
+}
+
+func agentRuntimeObservedProtocolLimits(limits harnessv2.ProtocolLimits) corev1alpha1.AgentRuntimeProtocolLimits {
+	return corev1alpha1.AgentRuntimeProtocolLimits{
+		MaxResidentSessions:      int32(limits.MaxResidentSessions),
+		MaxConcurrentPrompts:     int32(limits.MaxConcurrentPrompts),
+		MaxRequestBytes:          int32(limits.MaxRequestBytes),
+		MaxEventLineBytes:        int32(limits.MaxEventLineBytes),
+		MaxTerminalResultBytes:   int32(limits.MaxTerminalResultBytes),
+		MaxBufferedEvents:        int32(limits.MaxBufferedEvents),
+		MaxUpdateEventsPerSecond: int32(limits.MaxUpdateEventsPerSecond),
+		MinPromptLeaseMillis:     limits.MinPromptLeaseMillis,
+		MaxPromptLeaseMillis:     limits.MaxPromptLeaseMillis,
+		MaxPendingPermissions:    int32(limits.MaxPendingPermissions),
+		MaxWorkspaceDeltaBytes:   limits.MaxWorkspaceDeltaBytes,
 	}
 }
 
@@ -478,14 +848,27 @@ func (r *AgentRuntimeReconciler) updateAgentRuntimeStatus(
 	runtime *corev1alpha1.AgentRuntime,
 	ready bool,
 	observed *corev1alpha1.AgentRuntimeObservedCapabilities,
-	authRefResourceVersion string,
+	controllerAuthResourceVersion string,
+	capabilityAuthResourceVersion string,
 	message string,
 ) (ctrl.Result, error) {
 	now := metav1.Now()
 	runtime.Status.Ready = ready
 	runtime.Status.ObservedGeneration = runtime.Generation
 	runtime.Status.ObservedCapabilities = observed
-	runtime.Status.ObservedAuthRefResourceVersion = authRefResourceVersion
+	runtime.Status.ObservedControllerAuthRefResourceVersion = ""
+	runtime.Status.ObservedOperationCapabilityRefResourceVersion = ""
+	runtime.Status.ObservedAuthRefResourceVersion = ""
+	switch runtime.RegisteredContractVersion() {
+	case corev1alpha1.AgentRuntimeContractHarnessV1:
+		runtime.Status.ObservedAuthRefResourceVersion = controllerAuthResourceVersion
+	case corev1alpha1.AgentRuntimeContractHarnessV2:
+		runtime.Status.ObservedControllerAuthRefResourceVersion = controllerAuthResourceVersion
+		runtime.Status.ObservedOperationCapabilityRefResourceVersion = capabilityAuthResourceVersion
+		// Preserve the historical v2 status alias during coexistence. V1 never
+		// writes the two v2-specific auth version fields.
+		runtime.Status.ObservedAuthRefResourceVersion = controllerAuthResourceVersion
+	}
 	runtime.Status.LastValidated = &now
 	runtime.Status.Message = sanitizeAgentRuntimeStatusMessage(message)
 	condition := metav1.Condition{
@@ -518,18 +901,12 @@ func sanitizeAgentRuntimeEndpointForStatus(endpoint string) string {
 
 func sanitizeAgentRuntimeStatusMessage(message string) string {
 	message = events.RedactExecutionEventText(strings.TrimSpace(message))
-	if len(message) > 1024 {
-		return message[:1024]
-	}
-	return message
+	return truncateUTF8(strings.ToValidUTF8(message, "�"), 1024)
 }
 
 func sanitizeAgentRuntimeCapabilityValue(value string) string {
 	value = events.RedactExecutionEventText(strings.TrimSpace(value))
-	if len(value) > 256 {
-		return value[:256]
-	}
-	return value
+	return truncateUTF8(strings.ToValidUTF8(value, "�"), 512)
 }
 
 // SetupWithManager sets up the controller with the Manager.
diff --git a/internal/controller/agent_runtime_controller_test.go b/internal/controller/agent_runtime_controller_test.go
index ca621f0cc..9f4fb68e3 100644
--- a/internal/controller/agent_runtime_controller_test.go
+++ b/internal/controller/agent_runtime_controller_test.go
@@ -2,17 +2,17 @@ package controller
 
 import (
 	"context"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
+	"crypto/sha256"
+	"encoding/hex"
 	"strings"
-	"sync"
 	"testing"
-	"time"
 
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/utils/ptr"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
@@ -20,786 +20,897 @@ import (
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
 	"github.com/orka-agents/orka/internal/harness"
 	"github.com/orka-agents/orka/internal/harness/harnesstest"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	v2conformance "github.com/orka-agents/orka/internal/harness/v2/conformance"
+	"github.com/orka-agents/orka/internal/harness/v2/conformance/conformancetest"
 )
 
-const agentRuntimeTestBearer = "mock-token"
-
-func TestAgentRuntimeReconcilerMarksReadyForFakeHarness(t *testing.T) {
-	server := harnesstest.NewFakeHarnessServer(harnesstest.FakeHarnessConfig{RuntimeName: "fibey-agentkit", AuthToken: agentRuntimeTestBearer})
+const agentRuntimeV1TestBearer = "0123456789abcdef0123456789abcdef"
+
+func TestAgentRuntimeReconcilerMarksStrictV2RuntimeReady(t *testing.T) {
+	profile, claims, limits := testAgentRuntimeProfileClaimsAndLimits()
+	config := conformancetest.Config{
+		ControllerBearerToken:     strings.Repeat("t", 32),
+		OperationCapabilitySecret: []byte(strings.Repeat("s", 32)),
+		RuntimeInstanceID:         "external-runtime-instance-1",
+		SupervisorBootID:          "boot-1",
+		RuntimePoolUID:            "external-pool-1",
+		Profile:                   profile,
+		Limits:                    limits,
+		SupportsDrain:             true,
+		WorkspaceGovernance:       claims,
+	}
+	server, err := conformancetest.NewServer(config)
+	if err != nil {
+		t.Fatal(err)
+	}
 	defer server.Close()
 
-	runtime, secret := testAgentRuntimeAndSecret(server.URL())
-	r := newAgentRuntimeUnitReconciler(t, runtime, secret)
-	if _, err := r.Reconcile(context.Background(), reconcileRequestFor(runtime)); err != nil {
+	runtimeObject, secret := testAgentRuntimeAndSecret(t, server.URL(), config)
+	reconciler := newAgentRuntimeUnitReconciler(t, runtimeObject, secret)
+	allowAgentRuntimeLoopback(t)
+	if _, err := reconciler.Reconcile(t.Context(), reconcileRequestFor(runtimeObject)); err != nil {
 		t.Fatalf("Reconcile: %v", err)
 	}
-	var updated corev1alpha1.AgentRuntime
-	if err := r.Get(context.Background(), client.ObjectKeyFromObject(runtime), &updated); err != nil {
-		t.Fatalf("Get AgentRuntime: %v", err)
-	}
+	updated := getAgentRuntime(t, reconciler, runtimeObject)
 	if !updated.Status.Ready {
 		t.Fatalf("Ready = false, message=%q", updated.Status.Message)
 	}
-	if updated.Status.ObservedGeneration != runtime.Generation {
-		t.Fatalf("ObservedGeneration = %d, want %d", updated.Status.ObservedGeneration, runtime.Generation)
+	if updated.Status.ObservedCapabilities == nil {
+		t.Fatal("ObservedCapabilities is nil")
 	}
-	if updated.Status.ObservedCapabilities == nil || updated.Status.ObservedCapabilities.RuntimeName != "fibey-agentkit" {
-		t.Fatalf("ObservedCapabilities = %#v", updated.Status.ObservedCapabilities)
+	observed := updated.Status.ObservedCapabilities
+	if observed.ProtocolVersion != harnessv2.ProtocolVersion || observed.Transport != "http+ndjson" {
+		t.Fatalf("observed protocol = %#v", observed)
 	}
-	cond := meta.FindStatusCondition(updated.Status.Conditions, agentRuntimeReadyCondition)
-	if cond == nil || cond.Status != metav1.ConditionTrue {
-		t.Fatalf("Ready condition = %#v, want true", cond)
+	if observed.RuntimeInstanceID != string(config.RuntimeInstanceID) || observed.SupervisorBootID != string(config.SupervisorBootID) {
+		t.Fatalf("observed exact instance = %#v", observed)
 	}
-}
-
-func TestValidateAgentRuntimeRequiredCapabilitiesChecksBrokeredProfiles(t *testing.T) {
-	supportsContinuation := true
-	runtime := &corev1alpha1.AgentRuntime{Spec: corev1alpha1.AgentRuntimeRegistrySpec{
-		Capabilities: &corev1alpha1.AgentRuntimeCapabilitiesSpec{
-			ToolExecutionModes:   []corev1alpha1.AgentRuntimeToolExecutionMode{corev1alpha1.AgentRuntimeToolExecutionModeBrokered},
-			BrokeredToolClasses:  []corev1alpha1.AgentRuntimeBrokeredToolClass{corev1alpha1.AgentRuntimeBrokeredToolClassRead},
-			SupportsContinuation: &supportsContinuation,
-		},
-	}}
-	caps := &harness.CapabilitiesResponse{
-		Version:                 harness.ProtocolVersion,
-		ProtocolVersion:         harness.ProtocolVersion,
-		Transport:               harness.HTTPTransport,
-		RuntimeName:             "fibey-http-runtime",
-		ProviderKind:            harness.ProviderKindRemote,
-		ToolExecutionModes:      []harness.ToolExecutionMode{harness.ToolExecutionModeBrokered},
-		BrokeredToolClasses:     []harness.BrokeredToolClass{harness.BrokeredToolClassRead},
-		SupportsCancel:          true,
-		SupportsRuntimeSessions: true,
-		SupportsContinuation:    true,
+	if observed.RuntimeProfileDigest != runtimeObject.Spec.Capabilities.Profile.Digest || observed.Limits == nil ||
+		observed.Limits.MaxConcurrentPrompts != int32(limits.MaxConcurrentPrompts) {
+		t.Fatalf("observed profile/limits = %#v", observed)
+	}
+	if observed.WorkspaceGovernance == nil || !observed.WorkspaceGovernance.Strict() {
+		t.Fatalf("observed strict governance = %#v", observed.WorkspaceGovernance)
 	}
-	if err := validateAgentRuntimeRequiredCapabilities(runtime, caps); err != nil {
-		t.Fatalf("validateAgentRuntimeRequiredCapabilities() error = %v", err)
+	if updated.Status.ObservedControllerAuthRefResourceVersion == "" || updated.Status.ObservedOperationCapabilityRefResourceVersion == "" {
+		t.Fatalf("observed auth versions = %#v", updated.Status)
 	}
-	caps.BrokeredToolClasses = nil
-	if err := validateAgentRuntimeRequiredCapabilities(runtime, caps); err == nil || !strings.Contains(err.Error(), "brokeredToolClass") {
-		t.Fatalf("validateAgentRuntimeRequiredCapabilities() = %v, want missing brokered class", err)
+	condition := meta.FindStatusCondition(updated.Status.Conditions, agentRuntimeReadyCondition)
+	if condition == nil || condition.Status != metav1.ConditionTrue || condition.Reason != agentRuntimeReasonReady {
+		t.Fatalf("Ready condition = %#v", condition)
+	}
+	counts := server.Counts()
+	if counts.PromptStarts != 1 || counts.PromptCancels != 1 || counts.SessionDeletes != 1 || counts.WorkspaceDeltas != 1 {
+		t.Fatalf("hostile conformance counts = %#v", counts)
 	}
 }
 
-func TestAgentRuntimeReconcilerMarksBrokeredOnlyRuntimeReadyWhenBrokeredConformancePasses(t *testing.T) {
-	type turnState struct {
-		request   harness.StartTurnRequest
-		continued chan harness.ContinueTurnRequest
+func TestAgentRuntimeReconcilerDoesNotRepeatHostileCycleWhenIdentityIsUnchanged(t *testing.T) {
+	profile, claims, limits := testAgentRuntimeProfileClaimsAndLimits()
+	config := conformancetest.Config{
+		ControllerBearerToken: strings.Repeat("t", 32), OperationCapabilitySecret: []byte(strings.Repeat("s", 32)),
+		RuntimeInstanceID: "external-runtime-instance-1", SupervisorBootID: "boot-1", RuntimePoolUID: "external-pool-1",
+		Profile: profile, Limits: limits, SupportsDrain: true, WorkspaceGovernance: claims,
 	}
-	turns := map[harness.HarnessTurnID]*turnState{}
-	completedTurns := map[harness.HarnessTurnID]struct{}{}
-	var turnsMu sync.Mutex
-	mux := http.NewServeMux()
-	mux.HandleFunc(harness.HealthPath, func(w http.ResponseWriter, r *http.Request) {
-		harness.WriteJSON(w, http.StatusOK, harness.HealthResponse{
-			Version:   harness.ProtocolVersion,
-			Status:    harness.HealthStatusOK,
-			Ready:     true,
-			CheckedAt: time.Now().UTC(),
-		})
-	})
-	mux.HandleFunc(harness.CapabilitiesPath, func(w http.ResponseWriter, r *http.Request) {
-		harness.WriteJSON(w, http.StatusOK, harness.CapabilitiesResponse{
-			Version:                 harness.ProtocolVersion,
-			ProtocolVersion:         harness.ProtocolVersion,
-			Transport:               harness.HTTPTransport,
-			RuntimeName:             "fibey-brokered-runtime",
-			ProviderKind:            harness.ProviderKindRemote,
-			ToolExecutionModes:      []harness.ToolExecutionMode{harness.ToolExecutionModeBrokered},
-			BrokeredToolClasses:     []harness.BrokeredToolClass{harness.BrokeredToolClassRead},
-			SupportsCancel:          true,
-			SupportsRuntimeSessions: true,
-			SupportsContinuation:    true,
-		})
-	})
-	mux.HandleFunc(harness.TurnsPath, func(w http.ResponseWriter, r *http.Request) {
-		if strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ") != agentRuntimeTestBearer {
-			harness.WriteError(w, http.StatusUnauthorized, "unauthorized")
-			return
-		}
-		var request harness.StartTurnRequest
-		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
-			harness.WriteError(w, http.StatusBadRequest, "invalid JSON")
-			return
-		}
-		turnsMu.Lock()
-		if _, completed := completedTurns[request.TurnID]; completed {
-			turnsMu.Unlock()
-			harness.WriteError(w, http.StatusConflict, "turn already completed")
-			return
-		}
-		turn := turns[request.TurnID]
-		if turn != nil && turn.request.Input.Prompt != request.Input.Prompt {
-			turnsMu.Unlock()
-			harness.WriteError(w, http.StatusConflict, "turn already exists")
-			return
-		}
-		if turn == nil {
-			turn = &turnState{request: request, continued: make(chan harness.ContinueTurnRequest, 1)}
-			turns[request.TurnID] = turn
-		}
-		turnsMu.Unlock()
-		eventsPath, _ := harness.EventStreamPath(request.TurnID)
-		harness.WriteJSON(w, http.StatusAccepted, harness.StartTurnResponse{Version: harness.ProtocolVersion, Accepted: true, RuntimeSessionID: turn.request.RuntimeSessionID, TurnID: turn.request.TurnID, CorrelationID: turn.request.CorrelationID, EventStreamPath: eventsPath})
-	})
-	mux.HandleFunc(harness.TurnsPath+"/", func(w http.ResponseWriter, r *http.Request) {
-		if strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ") != agentRuntimeTestBearer {
-			harness.WriteError(w, http.StatusUnauthorized, "unauthorized")
-			return
-		}
-		turnID, resource, err := harness.ParseTurnResourcePath(r.URL.EscapedPath())
-		if err != nil {
-			harness.WriteError(w, http.StatusNotFound, "not found")
-			return
-		}
-		turnsMu.Lock()
-		turn := turns[turnID]
-		turnsMu.Unlock()
-		if turn == nil {
-			harness.WriteError(w, http.StatusNotFound, "turn not found")
-			return
+	server, err := conformancetest.NewServer(config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer server.Close()
+	runtimeObject, secret := testAgentRuntimeAndSecret(t, server.URL(), config)
+	reconciler := newAgentRuntimeUnitReconciler(t, runtimeObject, secret)
+	allowAgentRuntimeLoopback(t)
+	for range 2 {
+		if _, err := reconciler.Reconcile(t.Context(), reconcileRequestFor(runtimeObject)); err != nil {
+			t.Fatal(err)
 		}
-		switch resource {
-		case harness.TurnResourceEvents:
-			_ = harness.WriteSSEFrame(w, harness.HarnessEventFrame{Version: harness.ProtocolVersion, Type: harness.FrameTurnStarted, RuntimeSessionID: turn.request.RuntimeSessionID, TurnID: turn.request.TurnID, CorrelationID: turn.request.CorrelationID, Seq: 1})
-			_ = harness.WriteSSEFrame(w, harness.HarnessEventFrame{Version: harness.ProtocolVersion, Type: harness.FrameToolCallRequested, RuntimeSessionID: turn.request.RuntimeSessionID, TurnID: turn.request.TurnID, CorrelationID: turn.request.CorrelationID, Seq: 2, ToolName: "conformance_read", ToolCallID: "call-1", Content: json.RawMessage(`{"probe":true}`)})
-			select {
-			case continued := <-turn.continued:
-				_ = harness.WriteSSEFrame(w, harness.HarnessEventFrame{Version: harness.ProtocolVersion, Type: harness.FrameToolResultReceived, RuntimeSessionID: turn.request.RuntimeSessionID, TurnID: turn.request.TurnID, CorrelationID: turn.request.CorrelationID, Seq: 3, ToolName: "conformance_read", ToolCallID: "call-1", Content: continued.ToolResults[0].Output})
-				_ = harness.WriteSSEFrame(w, harness.HarnessEventFrame{Version: harness.ProtocolVersion, Type: harness.FrameTurnCompleted, RuntimeSessionID: turn.request.RuntimeSessionID, TurnID: turn.request.TurnID, CorrelationID: turn.request.CorrelationID, Seq: 4, Completed: &harness.TurnCompleted{Result: "ok", FinalEventSeq: 4}})
-				turnsMu.Lock()
-				completedTurns[turn.request.TurnID] = struct{}{}
-				turnsMu.Unlock()
-			case <-time.After(2 * time.Second):
+	}
+	counts := server.Counts()
+	if counts.PromptStarts != 1 || counts.SessionCreates != 1 {
+		t.Fatalf("deep hostile cycle repeated on unchanged ready runtime: %#v", counts)
+	}
+}
+
+func TestAgentRuntimeReconcilerRechecksHostileCycleAfterAuthenticatedIdentityChange(t *testing.T) {
+	tests := []struct {
+		name   string
+		mutate func(*harnessv2.Fence)
+	}{
+		{name: "supervisor boot", mutate: func(fence *harnessv2.Fence) { fence.SupervisorBootID = "boot-2" }},
+		{name: "controller epoch", mutate: func(fence *harnessv2.Fence) { fence.ControllerEpoch++ }},
+		{name: "runtime pool UID", mutate: func(fence *harnessv2.Fence) { fence.RuntimePoolUID = "external-pool-2" }},
+		{name: "runtime pool generation", mutate: func(fence *harnessv2.Fence) { fence.RuntimePoolGeneration++ }},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			profile, claims, limits := testAgentRuntimeProfileClaimsAndLimits()
+			config := conformancetest.Config{
+				ControllerBearerToken: strings.Repeat("t", 32), OperationCapabilitySecret: []byte(strings.Repeat("s", 32)),
+				RuntimeInstanceID: "external-runtime-instance-1", SupervisorBootID: "boot-1", RuntimePoolUID: "external-pool-1",
+				Profile: profile, Limits: limits, SupportsDrain: true, WorkspaceGovernance: claims,
 			}
-			_ = harness.WriteSSEDone(w)
-		case harness.TurnResourceContinue:
-			var request harness.ContinueTurnRequest
-			if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
-				harness.WriteError(w, http.StatusBadRequest, "invalid JSON")
-				return
+			server, err := conformancetest.NewServer(config)
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer server.Close()
+			runtimeObject, secret := testAgentRuntimeAndSecret(t, server.URL(), config)
+			reconciler := newAgentRuntimeUnitReconciler(t, runtimeObject, secret)
+			allowAgentRuntimeLoopback(t)
+			if _, err := reconciler.Reconcile(t.Context(), reconcileRequestFor(runtimeObject)); err != nil {
+				t.Fatal(err)
 			}
-			turn.continued <- request
-			harness.WriteJSON(w, http.StatusAccepted, harness.ContinueTurnResponse{Version: harness.ProtocolVersion, Accepted: true, RuntimeSessionID: request.RuntimeSessionID, TurnID: request.TurnID, CorrelationID: request.CorrelationID})
-		default:
-			harness.WriteError(w, http.StatusNotFound, "not found")
-		}
-	})
-	server := httptest.NewServer(mux)
-	defer server.Close()
 
-	runtime, secret := testAgentRuntimeAndSecret(server.URL)
-	runtime.Spec.Capabilities.ToolExecutionModes = []corev1alpha1.AgentRuntimeToolExecutionMode{
-		corev1alpha1.AgentRuntimeToolExecutionModeBrokered,
+			fence := server.Fence()
+			test.mutate(&fence)
+			if err := server.SetFence(fence); err != nil {
+				t.Fatal(err)
+			}
+			if _, err := reconciler.Reconcile(t.Context(), reconcileRequestFor(runtimeObject)); err != nil {
+				t.Fatal(err)
+			}
+			updated := getAgentRuntime(t, reconciler, runtimeObject)
+			if !updated.Status.Ready {
+				t.Fatalf("Ready = false after identity change, message=%q", updated.Status.Message)
+			}
+			counts := server.Counts()
+			if counts.SessionCreates != 2 || counts.PromptStarts != 2 {
+				t.Fatalf("authenticated identity change did not rerun full lifecycle: %#v", counts)
+			}
+		})
 	}
-	runtime.Spec.Capabilities.BrokeredToolClasses = []corev1alpha1.AgentRuntimeBrokeredToolClass{
-		corev1alpha1.AgentRuntimeBrokeredToolClassRead,
+}
+
+func TestAgentRuntimeAuthenticatedIdentityChanged(t *testing.T) {
+	fence := harnessv2.Fence{
+		RuntimeInstanceID: "runtime-1", SupervisorBootID: "boot-1", ControllerEpoch: 1,
+		RuntimePoolUID: "pool-1", RuntimePoolGeneration: 1, RuntimeProfileDigest: harnessv2.ProfileDigest(testControllerDigest("profile")),
+		ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+	}
+	previous := &corev1alpha1.AgentRuntimeObservedCapabilities{
+		RuntimeInstanceID: string(fence.RuntimeInstanceID), SupervisorBootID: string(fence.SupervisorBootID),
+		ControllerEpoch: int64(fence.ControllerEpoch), RuntimePoolUID: string(fence.RuntimePoolUID),
+		RuntimePoolGeneration: int64(fence.RuntimePoolGeneration), RuntimeProfileDigest: string(fence.RuntimeProfileDigest),
+		ProfileDigestSchemaVersion: int32(fence.ProfileDigestSchemaVersion),
+	}
+	if agentRuntimeAuthenticatedIdentityChanged(previous, &harnessv2.StatusResponse{Fence: fence}) {
+		t.Fatal("unchanged authenticated identity was reported changed")
+	}
+	if !agentRuntimeAuthenticatedIdentityChanged(nil, &harnessv2.StatusResponse{Fence: fence}) {
+		t.Fatal("missing previous identity must require lifecycle conformance")
+	}
+	if !agentRuntimeAuthenticatedIdentityChanged(previous, nil) {
+		t.Fatal("missing current identity must require lifecycle conformance")
+	}
+
+	tests := []struct {
+		name   string
+		mutate func(*harnessv2.Fence)
+	}{
+		{name: "runtime instance", mutate: func(f *harnessv2.Fence) { f.RuntimeInstanceID = "runtime-2" }},
+		{name: "supervisor boot", mutate: func(f *harnessv2.Fence) { f.SupervisorBootID = "boot-2" }},
+		{name: "controller epoch", mutate: func(f *harnessv2.Fence) { f.ControllerEpoch++ }},
+		{name: "runtime pool UID", mutate: func(f *harnessv2.Fence) { f.RuntimePoolUID = "pool-2" }},
+		{name: "runtime pool generation", mutate: func(f *harnessv2.Fence) { f.RuntimePoolGeneration++ }},
+		{name: "runtime profile", mutate: func(f *harnessv2.Fence) {
+			f.RuntimeProfileDigest = harnessv2.ProfileDigest(testControllerDigest("profile-2"))
+		}},
+		{name: "profile schema", mutate: func(f *harnessv2.Fence) { f.ProfileDigestSchemaVersion++ }},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			changed := fence
+			test.mutate(&changed)
+			if !agentRuntimeAuthenticatedIdentityChanged(previous, &harnessv2.StatusResponse{Fence: changed}) {
+				t.Fatalf("%s change did not require lifecycle conformance", test.name)
+			}
+		})
 	}
-	supportsContinuation := true
-	runtime.Spec.Capabilities.SupportsContinuation = &supportsContinuation
-	r := newAgentRuntimeUnitReconciler(t, runtime, secret)
-	if _, err := r.Reconcile(context.Background(), reconcileRequestFor(runtime)); err != nil {
-		t.Fatalf("Reconcile: %v", err)
+}
+
+func TestAgentRuntimeReconcilerRechecksHostileCycleAfterAuthRotation(t *testing.T) {
+	profile, claims, limits := testAgentRuntimeProfileClaimsAndLimits()
+	config := conformancetest.Config{
+		ControllerBearerToken: strings.Repeat("t", 32), OperationCapabilitySecret: []byte(strings.Repeat("s", 32)),
+		RuntimeInstanceID: "external-runtime-instance-1", SupervisorBootID: "boot-1", RuntimePoolUID: "external-pool-1",
+		Profile: profile, Limits: limits, SupportsDrain: true, WorkspaceGovernance: claims,
 	}
-	var updated corev1alpha1.AgentRuntime
-	if err := r.Get(context.Background(), client.ObjectKeyFromObject(runtime), &updated); err != nil {
-		t.Fatalf("Get AgentRuntime: %v", err)
+	server, err := conformancetest.NewServer(config)
+	if err != nil {
+		t.Fatal(err)
 	}
-	if !updated.Status.Ready {
-		t.Fatalf("Ready = false, message=%q", updated.Status.Message)
+	defer server.Close()
+	runtimeObject, secret := testAgentRuntimeAndSecret(t, server.URL(), config)
+	reconciler := newAgentRuntimeUnitReconciler(t, runtimeObject, secret)
+	allowAgentRuntimeLoopback(t)
+	if _, err := reconciler.Reconcile(t.Context(), reconcileRequestFor(runtimeObject)); err != nil {
+		t.Fatal(err)
+	}
+	stored := &corev1.Secret{}
+	if err := reconciler.Get(t.Context(), client.ObjectKeyFromObject(secret), stored); err != nil {
+		t.Fatal(err)
+	}
+	stored.Data["capability-secret"] = []byte(strings.Repeat("q", 32))
+	if err := reconciler.Update(t.Context(), stored); err != nil {
+		t.Fatal(err)
+	}
+	// The fake runtime still has the old key, so rotation must force a deep probe
+	// and fail closed rather than leaving the prior Ready status in place.
+	if _, err := reconciler.Reconcile(t.Context(), reconcileRequestFor(runtimeObject)); err != nil {
+		t.Fatal(err)
 	}
-	if updated.Status.ObservedCapabilities == nil || len(updated.Status.ObservedCapabilities.ToolExecutionModes) != 1 || updated.Status.ObservedCapabilities.ToolExecutionModes[0] != corev1alpha1.AgentRuntimeToolExecutionModeBrokered {
-		t.Fatalf("ObservedCapabilities = %#v, want brokered-only", updated.Status.ObservedCapabilities)
+	updated := getAgentRuntime(t, reconciler, runtimeObject)
+	if updated.Status.Ready || !strings.Contains(updated.Status.Message, "operation capability") {
+		t.Fatalf("rotated mismatched capability key did not fail closed: %#v", updated.Status)
 	}
 }
 
-func TestAgentRuntimeReconcilerRequiresBrokeredReadConformanceWhenCapabilityRequested(t *testing.T) {
-	turns := map[harness.HarnessTurnID]harness.StartTurnRequest{}
-	mux := http.NewServeMux()
-	mux.HandleFunc(harness.HealthPath, func(w http.ResponseWriter, r *http.Request) {
-		harness.WriteJSON(w, http.StatusOK, harness.HealthResponse{Version: harness.ProtocolVersion, Status: harness.HealthStatusOK, Ready: true, CheckedAt: time.Now().UTC()})
+func TestAgentRuntimeReconcilerMarksHarnessV1RuntimeReady(t *testing.T) {
+	server := harnesstest.NewFakeHarnessServer(harnesstest.FakeHarnessConfig{
+		RuntimeName: "external-v1", AuthToken: agentRuntimeV1TestBearer,
 	})
-	mux.HandleFunc(harness.CapabilitiesPath, func(w http.ResponseWriter, r *http.Request) {
-		harness.WriteJSON(w, http.StatusOK, harness.CapabilitiesResponse{
-			Version:                 harness.ProtocolVersion,
-			ProtocolVersion:         harness.ProtocolVersion,
-			Transport:               harness.HTTPTransport,
-			RuntimeName:             "fibey-runtime",
-			ProviderKind:            harness.ProviderKindRemote,
-			ToolExecutionModes:      []harness.ToolExecutionMode{harness.ToolExecutionModeObserved, harness.ToolExecutionModeBrokered},
-			BrokeredToolClasses:     []harness.BrokeredToolClass{harness.BrokeredToolClassRead},
-			SupportsCancel:          true,
-			SupportsRuntimeSessions: true,
-			SupportsContinuation:    true,
-		})
-	})
-	mux.HandleFunc(harness.TurnsPath, func(w http.ResponseWriter, r *http.Request) {
-		if strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ") != agentRuntimeTestBearer {
-			harness.WriteError(w, http.StatusUnauthorized, "unauthorized")
-			return
-		}
-		var request harness.StartTurnRequest
-		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
-			harness.WriteError(w, http.StatusBadRequest, "invalid JSON")
-			return
-		}
-		if _, exists := turns[request.TurnID]; exists {
-			harness.WriteError(w, http.StatusConflict, "turn already exists")
-			return
-		}
-		turns[request.TurnID] = request
-		eventsPath, _ := harness.EventStreamPath(request.TurnID)
-		harness.WriteJSON(w, http.StatusAccepted, harness.StartTurnResponse{Version: harness.ProtocolVersion, Accepted: true, RuntimeSessionID: request.RuntimeSessionID, TurnID: request.TurnID, CorrelationID: request.CorrelationID, EventStreamPath: eventsPath})
-	})
-	mux.HandleFunc(harness.TurnsPath+"/", func(w http.ResponseWriter, r *http.Request) {
-		if strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ") != agentRuntimeTestBearer {
-			harness.WriteError(w, http.StatusUnauthorized, "unauthorized")
-			return
-		}
-		turnID, resource, err := harness.ParseTurnResourcePath(r.URL.EscapedPath())
-		if err != nil {
-			harness.WriteError(w, http.StatusNotFound, "not found")
-			return
-		}
-		request := turns[turnID]
-		switch resource {
-		case harness.TurnResourceEvents:
-			_ = harness.WriteSSEFrame(w, harness.HarnessEventFrame{Version: harness.ProtocolVersion, Type: harness.FrameTurnStarted, RuntimeSessionID: request.RuntimeSessionID, TurnID: request.TurnID, CorrelationID: request.CorrelationID, Seq: 1})
-			if request.ToolExecutionMode == harness.ToolExecutionModeBrokered {
-				_ = harness.WriteSSEFrame(w, harness.HarnessEventFrame{Version: harness.ProtocolVersion, Type: harness.FrameToolCallRequested, RuntimeSessionID: request.RuntimeSessionID, TurnID: request.TurnID, CorrelationID: request.CorrelationID, Seq: 2, ToolName: "read_incident", ToolCallID: "call-1", Content: json.RawMessage(`{"probe":true}`)})
-				return
-			}
-			_ = harness.WriteSSEFrame(w, harness.HarnessEventFrame{Version: harness.ProtocolVersion, Type: harness.FrameTurnCompleted, RuntimeSessionID: request.RuntimeSessionID, TurnID: request.TurnID, CorrelationID: request.CorrelationID, Seq: 2, Completed: &harness.TurnCompleted{Result: "ok", FinalEventSeq: 2}})
-			_ = harness.WriteSSEDone(w)
-		case harness.TurnResourceCancel:
-			harness.WriteJSON(w, http.StatusAccepted, harness.CancelTurnResponse{Version: harness.ProtocolVersion, Accepted: true, RuntimeSessionID: request.RuntimeSessionID, TurnID: request.TurnID, CorrelationID: request.CorrelationID})
-		default:
-			harness.WriteError(w, http.StatusNotFound, "not found")
-		}
-	})
-	server := httptest.NewServer(mux)
 	defer server.Close()
-
-	runtime, secret := testAgentRuntimeAndSecret(server.URL)
-	runtime.Spec.Capabilities.ToolExecutionModes = []corev1alpha1.AgentRuntimeToolExecutionMode{corev1alpha1.AgentRuntimeToolExecutionModeObserved, corev1alpha1.AgentRuntimeToolExecutionModeBrokered}
-	runtime.Spec.Capabilities.BrokeredToolClasses = []corev1alpha1.AgentRuntimeBrokeredToolClass{corev1alpha1.AgentRuntimeBrokeredToolClassRead}
-	supportsContinuation := true
-	runtime.Spec.Capabilities.SupportsContinuation = &supportsContinuation
-	r := newAgentRuntimeUnitReconciler(t, runtime, secret)
-	if _, err := r.Reconcile(context.Background(), reconcileRequestFor(runtime)); err != nil {
-		t.Fatalf("Reconcile: %v", err)
+	runtimeObject, secret := testHarnessV1AgentRuntimeAndSecret(server.URL())
+	reconciler := newAgentRuntimeUnitReconciler(t, runtimeObject, secret)
+	allowAgentRuntimeLoopback(t)
+	if _, err := reconciler.Reconcile(t.Context(), reconcileRequestFor(runtimeObject)); err != nil {
+		t.Fatal(err)
 	}
-	var updated corev1alpha1.AgentRuntime
-	if err := r.Get(context.Background(), client.ObjectKeyFromObject(runtime), &updated); err != nil {
-		t.Fatalf("Get AgentRuntime: %v", err)
+	updated := getAgentRuntime(t, reconciler, runtimeObject)
+	if !updated.Status.Ready {
+		t.Fatalf("harness v1 runtime Ready = false, message=%q", updated.Status.Message)
 	}
-	if updated.Status.Ready {
-		t.Fatalf("Ready = true, want false when brokered read continue path is broken")
+	if updated.Status.ObservedCapabilities == nil ||
+		updated.Status.ObservedCapabilities.ProtocolVersion != harness.ProtocolVersion ||
+		updated.Status.ObservedCapabilities.Transport != harness.HTTPTransport ||
+		updated.Status.ObservedCapabilities.RuntimeName != "external-v1" {
+		t.Fatalf("observed harness v1 capabilities = %#v", updated.Status.ObservedCapabilities)
 	}
-	if !strings.Contains(updated.Status.Message, "brokered") {
-		t.Fatalf("Message = %q, want brokered conformance failure", updated.Status.Message)
+	if updated.Status.ObservedAuthRefResourceVersion == "" ||
+		updated.Status.ObservedControllerAuthRefResourceVersion != "" ||
+		updated.Status.ObservedOperationCapabilityRefResourceVersion != "" {
+		t.Fatalf("contract-specific observed auth versions = %#v", updated.Status)
 	}
-}
-
-func TestAgentRuntimeReconcilerRevalidatesBearerAuthOnReadyRuntime(t *testing.T) {
-	server := harnesstest.NewFakeHarnessServer(harnesstest.FakeHarnessConfig{RuntimeName: "fibey-agentkit", AuthToken: agentRuntimeTestBearer})
-	defer server.Close()
-
-	runtime, secret := testAgentRuntimeAndSecret(server.URL())
-	r := newAgentRuntimeUnitReconciler(t, runtime, secret)
-	if _, err := r.Reconcile(context.Background(), reconcileRequestFor(runtime)); err != nil {
-		t.Fatalf("first Reconcile: %v", err)
+	condition := meta.FindStatusCondition(updated.Status.Conditions, agentRuntimeReadyCondition)
+	if condition == nil || condition.Status != metav1.ConditionTrue || condition.Reason != agentRuntimeReasonReady {
+		t.Fatalf("Ready condition = %#v", condition)
 	}
-	var ready corev1alpha1.AgentRuntime
-	if err := r.Get(context.Background(), client.ObjectKeyFromObject(runtime), &ready); err != nil {
-		t.Fatalf("Get ready AgentRuntime: %v", err)
+	encodedStatus := updated.Status.Message + updated.Status.ObservedCapabilities.RuntimeName +
+		updated.Status.ObservedCapabilities.RuntimeVersion
+	if strings.Contains(encodedStatus, agentRuntimeV1TestBearer) {
+		t.Fatal("harness v1 status leaked the bearer token")
 	}
-	if !ready.Status.Ready {
-		t.Fatalf("Ready = false after first reconcile, message=%q", ready.Status.Message)
+}
+
+func TestAgentRuntimeReconcilerHarnessV1RejectsWeakBearerToken(t *testing.T) {
+	tests := []struct {
+		name        string
+		token       string
+		wantMessage string
+	}{
+		{name: "short", token: strings.Repeat("t", agentRuntimeMinBearerBytes-1), wantMessage: "at least 32 bytes"},
+		{name: "space", token: strings.Repeat("t", 16) + " " + strings.Repeat("t", 16), wantMessage: "invalid HTTP header bytes"},
+		{name: "control", token: strings.Repeat("t", 16) + "\n" + strings.Repeat("t", 16), wantMessage: "invalid HTTP header bytes"},
+		{name: "non-ASCII", token: strings.Repeat("t", 31) + "é", wantMessage: "invalid HTTP header bytes"},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			server := harnesstest.NewFakeHarnessServer(harnesstest.FakeHarnessConfig{AuthToken: agentRuntimeV1TestBearer})
+			defer server.Close()
+			runtimeObject, secret := testHarnessV1AgentRuntimeAndSecret(server.URL())
+			secret.Data["token"] = []byte(test.token)
+			reconciler := newAgentRuntimeUnitReconciler(t, runtimeObject, secret)
+			allowAgentRuntimeLoopback(t)
+			if _, err := reconciler.Reconcile(t.Context(), reconcileRequestFor(runtimeObject)); err != nil {
+				t.Fatal(err)
+			}
+			updated := getAgentRuntime(t, reconciler, runtimeObject)
+			if updated.Status.Ready || !strings.Contains(updated.Status.Message, test.wantMessage) {
+				t.Fatalf("weak harness v1 bearer status = %#v, want message containing %q", updated.Status, test.wantMessage)
+			}
+			if strings.Contains(updated.Status.Message, test.token) {
+				t.Fatal("harness v1 status leaked the rejected bearer token")
+			}
+		})
 	}
+}
 
-	var changed corev1.Secret
-	if err := r.Get(context.Background(), client.ObjectKey{Name: secret.Name, Namespace: secret.Namespace}, &changed); err != nil {
-		t.Fatalf("Get Secret: %v", err)
+func TestValidateHarnessV1AgentRuntimeEndpointSpecRejectsUserinfo(t *testing.T) {
+	tests := []struct {
+		name      string
+		endpoint  string
+		forbidden []string
+	}{
+		{
+			name: "username", endpoint: "https://" + "operator" + "@runtime.example.invalid",
+			forbidden: []string{"operator@"},
+		},
+		{
+			name: "username and password", endpoint: "https://" + "operator" + ":" + "passphrase" + "@runtime.example.invalid",
+			forbidden: []string{"operator", "passphrase"},
+		},
+		{
+			name: "percent-encoded userinfo", endpoint: "https://" + "%6fperator" + ":" + "p%40ss" + "@runtime.example.invalid",
+			forbidden: []string{"%6fperator", "p%40ss", "operator", "p@ss"},
+		},
 	}
-	changed.Data["token"] = []byte("wrong-token")
-	if err := r.Update(context.Background(), &changed); err != nil {
-		t.Fatalf("Update Secret: %v", err)
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateHarnessV1AgentRuntimeEndpointSpec(tt.endpoint)
+			if err == nil || !strings.Contains(err.Error(), "must not include userinfo") {
+				t.Fatalf("validateHarnessV1AgentRuntimeEndpointSpec() error = %v, want userinfo rejection", err)
+			}
+			for _, forbidden := range tt.forbidden {
+				if strings.Contains(err.Error(), forbidden) {
+					t.Fatalf("endpoint validation error disclosed URL userinfo: %q", err)
+				}
+			}
+		})
 	}
-	if _, err := r.Reconcile(context.Background(), reconcileRequestFor(runtime)); err != nil {
-		t.Fatalf("second Reconcile: %v", err)
+}
+
+func TestValidateHarnessV1AgentRuntimeExecutableCapabilitiesRequiresControllerCompatibleRuntime(t *testing.T) {
+	base := harness.CapabilitiesResponse{
+		RuntimeName:             "external-v1",
+		ToolExecutionModes:      []harness.ToolExecutionMode{harness.ToolExecutionModeObserved},
+		SupportsCancel:          true,
+		SupportsRuntimeSessions: true,
+		MaxOutputBytes:          harness.MaxFetchTurnOutputBytes,
 	}
-	var updated corev1alpha1.AgentRuntime
-	if err := r.Get(context.Background(), client.ObjectKeyFromObject(runtime), &updated); err != nil {
-		t.Fatalf("Get updated AgentRuntime: %v", err)
+	if err := validateHarnessV1AgentRuntimeExecutableCapabilities(&base); err != nil {
+		t.Fatalf("controller-compatible capabilities rejected: %v", err)
 	}
-	if updated.Status.Ready {
-		t.Fatalf("Ready = true, want false after bearer auth changed")
+
+	brokeredWithoutCancel := base
+	brokeredWithoutCancel.ToolExecutionModes = []harness.ToolExecutionMode{harness.ToolExecutionModeBrokered}
+	brokeredWithoutCancel.BrokeredToolClasses = []harness.BrokeredToolClass{harness.BrokeredToolClassRead}
+	brokeredWithoutCancel.SupportsContinuation = true
+	brokeredWithoutCancel.SupportsCancel = false
+	if err := validateHarnessV1AgentRuntimeExecutableCapabilities(&brokeredWithoutCancel); err == nil ||
+		!strings.Contains(err.Error(), "supportsCancel") {
+		t.Fatalf("brokered runtime without cancellation error = %v, want supportsCancel", err)
 	}
-	if !strings.Contains(updated.Status.Message, "401") && !strings.Contains(updated.Status.Message, "unauthorized") {
-		t.Fatalf("Message = %q, want auth failure", updated.Status.Message)
+
+	oversizedOutput := base
+	oversizedOutput.MaxOutputBytes = harness.MaxFetchTurnOutputBytes + 1
+	if err := validateHarnessV1AgentRuntimeExecutableCapabilities(&oversizedOutput); err == nil ||
+		!strings.Contains(err.Error(), "fetch limit") {
+		t.Fatalf("oversized output capability error = %v, want fetch limit", err)
 	}
 }
 
-func TestAgentRuntimeReconcilerRechecksUnauthenticatedMutationOnReadyRuntime(t *testing.T) {
-	requireAuth := true
-	turns := map[harness.HarnessTurnID]harness.StartTurnRequest{}
-	mux := http.NewServeMux()
-	mux.HandleFunc(harness.HealthPath, func(w http.ResponseWriter, r *http.Request) {
-		harness.WriteJSON(w, http.StatusOK, harness.HealthResponse{
-			Version:   harness.ProtocolVersion,
-			Status:    harness.HealthStatusOK,
-			Ready:     true,
-			CheckedAt: time.Now().UTC(),
-		})
-	})
-	mux.HandleFunc(harness.CapabilitiesPath, func(w http.ResponseWriter, r *http.Request) {
-		harness.WriteJSON(w, http.StatusOK, harness.CapabilitiesResponse{
-			Version:                 harness.ProtocolVersion,
-			ProtocolVersion:         harness.ProtocolVersion,
-			Transport:               harness.HTTPTransport,
-			RuntimeName:             "fibey-agentkit",
-			ProviderKind:            harness.ProviderKindKubernetesService,
-			ToolExecutionModes:      []harness.ToolExecutionMode{harness.ToolExecutionModeObserved},
-			SupportsCancel:          true,
-			SupportsRuntimeSessions: true,
-		})
-	})
-	mux.HandleFunc(harness.TurnsPath, func(w http.ResponseWriter, r *http.Request) {
-		if requireAuth && strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ") != agentRuntimeTestBearer {
-			harness.WriteError(w, http.StatusUnauthorized, "unauthorized")
-			return
-		}
-		var request harness.StartTurnRequest
-		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
-			harness.WriteError(w, http.StatusBadRequest, "invalid JSON request")
-			return
-		}
-		if _, exists := turns[request.TurnID]; exists {
-			harness.WriteError(w, http.StatusConflict, "turn already exists")
-			return
-		}
-		turns[request.TurnID] = request
-		eventsPath, _ := harness.EventStreamPath(request.TurnID)
-		harness.WriteJSON(w, http.StatusAccepted, harness.StartTurnResponse{
-			Version:          harness.ProtocolVersion,
-			Accepted:         true,
-			RuntimeSessionID: request.RuntimeSessionID,
-			TurnID:           request.TurnID,
-			CorrelationID:    request.CorrelationID,
-			EventStreamPath:  eventsPath,
-		})
-	})
-	mux.HandleFunc(harness.TurnsPath+"/", func(w http.ResponseWriter, r *http.Request) {
-		if requireAuth && strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ") != agentRuntimeTestBearer {
-			harness.WriteError(w, http.StatusUnauthorized, "unauthorized")
-			return
-		}
-		turnID, resource, err := harness.ParseTurnResourcePath(r.URL.EscapedPath())
-		if err != nil {
-			harness.WriteError(w, http.StatusNotFound, "not found")
-			return
-		}
-		request, ok := turns[turnID]
-		if !ok {
-			harness.WriteError(w, http.StatusNotFound, "turn not found")
-			return
-		}
-		switch resource {
-		case "events":
-			_ = harness.WriteSSEFrame(w, harness.HarnessEventFrame{
-				Version:          harness.ProtocolVersion,
-				Type:             harness.FrameTurnCompleted,
-				RuntimeSessionID: request.RuntimeSessionID,
-				TurnID:           request.TurnID,
-				CorrelationID:    request.CorrelationID,
-				Seq:              1,
-				Completed:        &harness.TurnCompleted{Result: "ok", FinalEventSeq: 1},
-			})
-			_ = harness.WriteSSEDone(w)
-		case "cancel":
-			harness.WriteJSON(w, http.StatusAccepted, harness.CancelTurnResponse{Version: harness.ProtocolVersion, Accepted: true, RuntimeSessionID: request.RuntimeSessionID, TurnID: request.TurnID, CorrelationID: request.CorrelationID})
-		default:
-			harness.WriteError(w, http.StatusNotFound, "not found")
-		}
-	})
-	server := httptest.NewServer(mux)
+func TestAgentRuntimeReconcilerHarnessV1RequiresDeclaredCapabilitySubset(t *testing.T) {
+	server := harnesstest.NewFakeHarnessServer(harnesstest.FakeHarnessConfig{AuthToken: agentRuntimeV1TestBearer})
 	defer server.Close()
+	runtimeObject, secret := testHarnessV1AgentRuntimeAndSecret(server.URL())
+	required := true
+	runtimeObject.Spec.Capabilities.SupportsArtifacts = &required
+	reconciler := newAgentRuntimeUnitReconciler(t, runtimeObject, secret)
+	allowAgentRuntimeLoopback(t)
+	if _, err := reconciler.Reconcile(t.Context(), reconcileRequestFor(runtimeObject)); err != nil {
+		t.Fatal(err)
+	}
+	updated := getAgentRuntime(t, reconciler, runtimeObject)
+	if updated.Status.Ready || !strings.Contains(updated.Status.Message, "supportsArtifacts") {
+		t.Fatalf("missing declared harness v1 capability status = %#v", updated.Status)
+	}
+}
 
-	runtime, secret := testAgentRuntimeAndSecret(server.URL)
-	r := newAgentRuntimeUnitReconciler(t, runtime, secret)
-	if _, err := r.Reconcile(context.Background(), reconcileRequestFor(runtime)); err != nil {
-		t.Fatalf("first Reconcile: %v", err)
+func TestAgentRuntimeReconcilerHarnessV1AuthRotationForcesConformance(t *testing.T) {
+	server := harnesstest.NewFakeHarnessServer(harnesstest.FakeHarnessConfig{AuthToken: agentRuntimeV1TestBearer})
+	defer server.Close()
+	runtimeObject, secret := testHarnessV1AgentRuntimeAndSecret(server.URL())
+	reconciler := newAgentRuntimeUnitReconciler(t, runtimeObject, secret)
+	allowAgentRuntimeLoopback(t)
+	if _, err := reconciler.Reconcile(t.Context(), reconcileRequestFor(runtimeObject)); err != nil {
+		t.Fatal(err)
 	}
-	requireAuth = false
-	if _, err := r.Reconcile(context.Background(), reconcileRequestFor(runtime)); err != nil {
-		t.Fatalf("second Reconcile: %v", err)
+	ready := getAgentRuntime(t, reconciler, runtimeObject)
+	if !ready.Status.Ready {
+		t.Fatalf("initial harness v1 readiness = %#v", ready.Status)
 	}
-	var updated corev1alpha1.AgentRuntime
-	if err := r.Get(context.Background(), client.ObjectKeyFromObject(runtime), &updated); err != nil {
-		t.Fatalf("Get AgentRuntime: %v", err)
+	stored := &corev1.Secret{}
+	if err := reconciler.Get(t.Context(), client.ObjectKeyFromObject(secret), stored); err != nil {
+		t.Fatal(err)
+	}
+	stored.Data["token"] = []byte("rotated-token-not-accepted-by-runtime")
+	if err := reconciler.Update(t.Context(), stored); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := reconciler.Reconcile(t.Context(), reconcileRequestFor(runtimeObject)); err != nil {
+		t.Fatal(err)
 	}
-	if updated.Status.Ready {
-		t.Fatalf("Ready = true, want false after unauthenticated StartTurn became accepted")
+	updated := getAgentRuntime(t, reconciler, runtimeObject)
+	if updated.Status.Ready ||
+		(!strings.Contains(updated.Status.Message, "unauthorized") && !strings.Contains(updated.Status.Message, "401")) {
+		t.Fatalf("rotated harness v1 auth did not fail closed = %#v", updated.Status)
 	}
-	if !strings.Contains(updated.Status.Message, "unauthenticated start turn was accepted") {
-		t.Fatalf("Message = %q, want unauthenticated start failure", updated.Status.Message)
+	if updated.Status.ObservedAuthRefResourceVersion == ready.Status.ObservedAuthRefResourceVersion {
+		t.Fatalf("observed harness v1 auth resourceVersion did not advance: before=%q after=%q",
+			ready.Status.ObservedAuthRefResourceVersion, updated.Status.ObservedAuthRefResourceVersion)
 	}
 }
 
-func TestAgentRuntimeReconcilerMarksNotReadyForBadProtocol(t *testing.T) {
-	server := harnesstest.NewFakeHarnessServer(harnesstest.FakeHarnessConfig{ProtocolVersion: "orka.harness.v0", AuthToken: agentRuntimeTestBearer})
+func TestAgentRuntimeReconcilerHarnessV1ShallowProbeRejectsRuntimeBearerDrift(t *testing.T) {
+	server := harnesstest.NewFakeHarnessServer(harnesstest.FakeHarnessConfig{
+		RuntimeName: "external-v1", AuthToken: strings.Repeat("r", agentRuntimeMinBearerBytes),
+	})
 	defer server.Close()
-
-	runtime, secret := testAgentRuntimeAndSecret(server.URL())
-	r := newAgentRuntimeUnitReconciler(t, runtime, secret)
-	if _, err := r.Reconcile(context.Background(), reconcileRequestFor(runtime)); err != nil {
-		t.Fatalf("Reconcile: %v", err)
+	runtimeObject, secret := testHarnessV1AgentRuntimeAndSecret(server.URL())
+	runtimeObject.Status = corev1alpha1.AgentRuntimeStatus{
+		Ready:                          true,
+		ObservedGeneration:             runtimeObject.Generation,
+		ObservedAuthRefResourceVersion: secret.ResourceVersion,
+		ObservedCapabilities: &corev1alpha1.AgentRuntimeObservedCapabilities{
+			ProtocolVersion: harness.ProtocolVersion,
+			Transport:       harness.HTTPTransport,
+			RuntimeName:     "external-v1",
+		},
 	}
-	var updated corev1alpha1.AgentRuntime
-	if err := r.Get(context.Background(), client.ObjectKeyFromObject(runtime), &updated); err != nil {
-		t.Fatalf("Get AgentRuntime: %v", err)
+	reconciler := newAgentRuntimeUnitReconciler(t, runtimeObject, secret)
+	allowAgentRuntimeLoopback(t)
+	if _, err := reconciler.Reconcile(t.Context(), reconcileRequestFor(runtimeObject)); err != nil {
+		t.Fatal(err)
 	}
-	if updated.Status.Ready {
-		t.Fatalf("Ready = true, want false")
+	updated := getAgentRuntime(t, reconciler, runtimeObject)
+	if updated.Status.Ready || !strings.Contains(updated.Status.Message, "configured bearer was rejected") {
+		t.Fatalf("runtime-side bearer drift did not fail the shallow probe: %#v", updated.Status)
 	}
-	if !strings.Contains(updated.Status.Message, "unsupported protocol version") {
-		t.Fatalf("Message = %q, want unsupported protocol", updated.Status.Message)
+	if strings.Contains(updated.Status.Message, agentRuntimeV1TestBearer) {
+		t.Fatal("shallow probe status leaked the configured bearer")
 	}
 }
 
-func TestAgentRuntimeReconcilerRejectsUnlabeledBearerSecret(t *testing.T) {
-	server := harnesstest.NewFakeHarnessServer(harnesstest.FakeHarnessConfig{AuthToken: agentRuntimeTestBearer})
+func TestAgentRuntimeReconcilerHarnessV1UsesConfiguredTLSClient(t *testing.T) {
+	server := harnesstest.NewFakeHarnessServer(harnesstest.FakeHarnessConfig{
+		AuthToken: agentRuntimeV1TestBearer,
+		TLS:       true,
+	})
 	defer server.Close()
-
-	runtime, secret := testAgentRuntimeAndSecret(server.URL())
-	secret.Labels = nil
-	r := newAgentRuntimeUnitReconciler(t, runtime, secret)
-	if _, err := r.Reconcile(context.Background(), reconcileRequestFor(runtime)); err != nil {
-		t.Fatalf("Reconcile: %v", err)
-	}
-	var updated corev1alpha1.AgentRuntime
-	if err := r.Get(context.Background(), client.ObjectKeyFromObject(runtime), &updated); err != nil {
-		t.Fatalf("Get AgentRuntime: %v", err)
+	runtimeObject, secret := testHarnessV1AgentRuntimeAndSecret(server.URL())
+	reconciler := newAgentRuntimeUnitReconciler(t, runtimeObject, secret)
+	reconciler.HarnessV1HTTPClient = server.Client()
+	allowAgentRuntimeLoopback(t)
+	if _, err := reconciler.Reconcile(t.Context(), reconcileRequestFor(runtimeObject)); err != nil {
+		t.Fatal(err)
+	}
+	updated := getAgentRuntime(t, reconciler, runtimeObject)
+	if !updated.Status.Ready {
+		t.Fatalf("private-CA harness v1 readiness = %#v", updated.Status)
 	}
-	if updated.Status.Ready {
-		t.Fatalf("Ready = true, want false")
+}
+
+func TestAgentRuntimeReconcilerHarnessV1RejectsSecretIdentityChangeDuringConformance(t *testing.T) {
+	tests := []struct {
+		name        string
+		mutate      func(*corev1.Secret)
+		wantMessage string
+	}{
+		{
+			name:        "UID replacement",
+			mutate:      func(secret *corev1.Secret) { secret.UID = types.UID("replacement-secret-uid") },
+			wantMessage: "replaced during conformance",
+		},
+		{
+			name:        "resourceVersion rotation",
+			mutate:      func(secret *corev1.Secret) { secret.ResourceVersion = "rotated-resource-version" },
+			wantMessage: "changed during conformance",
+		},
 	}
-	if !strings.Contains(updated.Status.Message, agentRuntimeAuthUseLabel) {
-		t.Fatalf("Message = %q, want missing auth-secret label", updated.Status.Message)
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			server := harnesstest.NewFakeHarnessServer(harnesstest.FakeHarnessConfig{AuthToken: agentRuntimeV1TestBearer})
+			defer server.Close()
+			runtimeObject, secret := testHarnessV1AgentRuntimeAndSecret(server.URL())
+			reconciler := newAgentRuntimeUnitReconciler(t, runtimeObject, secret)
+			reconciler.APIReader = &agentRuntimeMutateSecondSecretReadClient{
+				Client: reconciler.Client, SecretKey: client.ObjectKeyFromObject(secret), Mutate: test.mutate,
+			}
+			allowAgentRuntimeLoopback(t)
+			if _, err := reconciler.Reconcile(t.Context(), reconcileRequestFor(runtimeObject)); err != nil {
+				t.Fatal(err)
+			}
+			updated := getAgentRuntime(t, reconciler, runtimeObject)
+			if updated.Status.Ready || !strings.Contains(updated.Status.Message, test.wantMessage) {
+				t.Fatalf("Secret identity race status = %#v", updated.Status)
+			}
+		})
 	}
 }
 
-func TestAgentRuntimeReconcilerRejectsBearerSecretWithoutEndpointBinding(t *testing.T) {
-	server := harnesstest.NewFakeHarnessServer(harnesstest.FakeHarnessConfig{AuthToken: agentRuntimeTestBearer})
+func TestAgentRuntimeReconcilerHarnessV1RequiresSecretUID(t *testing.T) {
+	server := harnesstest.NewFakeHarnessServer(harnesstest.FakeHarnessConfig{AuthToken: agentRuntimeV1TestBearer})
 	defer server.Close()
+	runtimeObject, secret := testHarnessV1AgentRuntimeAndSecret(server.URL())
+	secret.UID = ""
+	reconciler := newAgentRuntimeUnitReconciler(t, runtimeObject, secret)
+	allowAgentRuntimeLoopback(t)
+	if _, err := reconciler.Reconcile(t.Context(), reconcileRequestFor(runtimeObject)); err != nil {
+		t.Fatal(err)
+	}
+	updated := getAgentRuntime(t, reconciler, runtimeObject)
+	if updated.Status.Ready || !strings.Contains(updated.Status.Message, "UID is required") {
+		t.Fatalf("missing bearer Secret UID status = %#v", updated.Status)
+	}
+}
 
-	runtime, secret := testAgentRuntimeAndSecret(server.URL())
-	secret.Annotations = nil
-	r := newAgentRuntimeUnitReconciler(t, runtime, secret)
-	if _, err := r.Reconcile(context.Background(), reconcileRequestFor(runtime)); err != nil {
-		t.Fatalf("Reconcile: %v", err)
+func TestAgentRuntimeReconcilerUnclassifiedContractNotReady(t *testing.T) {
+	runtimeObject := &corev1alpha1.AgentRuntime{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "unclassified", Generation: 1},
+		Spec: corev1alpha1.AgentRuntimeRegistrySpec{
+			Deployment: corev1alpha1.AgentRuntimeDeploymentSpec{Mode: corev1alpha1.AgentRuntimeDeploymentModeExternalEndpoint, Endpoint: "https://runtime.example.com"},
+		},
 	}
-	var updated corev1alpha1.AgentRuntime
-	if err := r.Get(context.Background(), client.ObjectKeyFromObject(runtime), &updated); err != nil {
-		t.Fatalf("Get AgentRuntime: %v", err)
+	reconciler := newAgentRuntimeUnitReconciler(t, runtimeObject)
+	if _, err := reconciler.Reconcile(t.Context(), reconcileRequestFor(runtimeObject)); err != nil {
+		t.Fatal(err)
 	}
-	if updated.Status.Ready {
-		t.Fatalf("Ready = true, want false")
+	updated := getAgentRuntime(t, reconciler, runtimeObject)
+	if updated.Status.Ready || !strings.Contains(updated.Status.Message, "unclassified") {
+		t.Fatalf("unclassified runtime status = %#v", updated.Status)
 	}
-	if !strings.Contains(updated.Status.Message, agentRuntimeAuthEndpointAnnotation) {
-		t.Fatalf("Message = %q, want missing endpoint binding annotation", updated.Status.Message)
+}
+
+func TestValidateAgentRuntimeSpecRequiresExactCanonicalProfileDigest(t *testing.T) {
+	profile, claims, limits := testAgentRuntimeProfileClaimsAndLimits()
+	config := conformancetest.Config{RuntimeInstanceID: "runtime-1", Profile: profile, Limits: limits, WorkspaceGovernance: claims}
+	runtimeObject, _ := testAgentRuntimeAndSecret(t, "https://runtime.example.com", config)
+	runtimeObject.Spec.Capabilities.Profile.Digest = testControllerDigest("wrong")
+	if err := validateAgentRuntimeSpec(runtimeObject); err == nil || !strings.Contains(err.Error(), "canonical digest") {
+		t.Fatalf("validateAgentRuntimeSpec() = %v, want canonical digest mismatch", err)
 	}
 }
 
-func TestAgentRuntimeReconcilerRejectsBearerSecretEndpointMismatch(t *testing.T) {
-	server := harnesstest.NewFakeHarnessServer(harnesstest.FakeHarnessConfig{AuthToken: agentRuntimeTestBearer})
-	defer server.Close()
+func TestValidateAgentRuntimeSpecRejectsTrustedRuntimeStrictClaims(t *testing.T) {
+	profile, claims, limits := testAgentRuntimeProfileClaimsAndLimits()
+	claims.Mode = v2conformance.WorkspaceGovernanceTrusted
+	claims.Trusted = true
+	config := conformancetest.Config{RuntimeInstanceID: "runtime-1", Profile: profile, Limits: limits, WorkspaceGovernance: claims}
+	runtimeObject, _ := testAgentRuntimeAndSecret(t, "https://runtime.example.com", config)
+	if err := validateAgentRuntimeSpec(runtimeObject); err == nil || !strings.Contains(err.Error(), "must not claim strict") {
+		t.Fatalf("validateAgentRuntimeSpec() = %v, want trusted strict-claim rejection", err)
+	}
+}
 
-	runtime, secret := testAgentRuntimeAndSecret(server.URL())
-	secret.Annotations[agentRuntimeAuthEndpointAnnotation] = "http://different-runtime.default.svc.cluster.local:8080"
-	r := newAgentRuntimeUnitReconciler(t, runtime, secret)
-	if _, err := r.Reconcile(context.Background(), reconcileRequestFor(runtime)); err != nil {
-		t.Fatalf("Reconcile: %v", err)
+func TestAgentRuntimeTrustedNonGovernedRegistrationIsExplicitAndNotStrictEligible(t *testing.T) {
+	profile, _, limits := testAgentRuntimeProfileClaimsAndLimits()
+	claims := v2conformance.WorkspaceGovernanceClaims{Mode: v2conformance.WorkspaceGovernanceTrusted, Trusted: true}
+	config := conformancetest.Config{
+		ControllerBearerToken: strings.Repeat("t", 32), OperationCapabilitySecret: []byte(strings.Repeat("s", 32)),
+		RuntimeInstanceID: "trusted-runtime-1", SupervisorBootID: "boot-1", RuntimePoolUID: "external-pool-1",
+		Profile: profile, Limits: limits, WorkspaceGovernance: claims,
 	}
-	var updated corev1alpha1.AgentRuntime
-	if err := r.Get(context.Background(), client.ObjectKeyFromObject(runtime), &updated); err != nil {
-		t.Fatalf("Get AgentRuntime: %v", err)
+	server, err := conformancetest.NewServer(config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer server.Close()
+	runtimeObject, secret := testAgentRuntimeAndSecret(t, server.URL(), config)
+	if runtimeObject.Spec.Capabilities.SupportsStrictWorkspaceIntent(corev1alpha1.WorkspaceIntentRead) ||
+		runtimeObject.Spec.Capabilities.SupportsStrictWorkspaceIntent(corev1alpha1.WorkspaceIntentWrite) {
+		t.Fatal("trusted non-governed runtime was eligible for strict workspace intent")
+	}
+	reconciler := newAgentRuntimeUnitReconciler(t, runtimeObject, secret)
+	allowAgentRuntimeLoopback(t)
+	if _, err := reconciler.Reconcile(t.Context(), reconcileRequestFor(runtimeObject)); err != nil {
+		t.Fatal(err)
 	}
-	if updated.Status.Ready {
-		t.Fatalf("Ready = true, want false")
+	updated := getAgentRuntime(t, reconciler, runtimeObject)
+	if !updated.Status.Ready || updated.Status.ObservedCapabilities == nil ||
+		updated.Status.ObservedCapabilities.WorkspaceGovernance == nil ||
+		!updated.Status.ObservedCapabilities.WorkspaceGovernance.Trusted {
+		t.Fatalf("trusted runtime registration = %#v", updated.Status)
 	}
-	if !strings.Contains(updated.Status.Message, "annotated for endpoint") {
-		t.Fatalf("Message = %q, want endpoint mismatch", updated.Status.Message)
+	if server.Counts().WorkspaceDeltas != 0 {
+		t.Fatal("trusted non-governed conformance unexpectedly relied on strict workspace delta production")
 	}
 }
 
-func TestAgentRuntimeReconcilerReportsMissingBearerSecret(t *testing.T) {
-	server := harnesstest.NewFakeHarnessServer(harnesstest.FakeHarnessConfig{AuthToken: agentRuntimeTestBearer})
-	defer server.Close()
-
-	runtime, _ := testAgentRuntimeAndSecret(server.URL())
-	r := newAgentRuntimeUnitReconciler(t, runtime)
-	if _, err := r.Reconcile(context.Background(), reconcileRequestFor(runtime)); err != nil {
-		t.Fatalf("Reconcile: %v", err)
+func TestAgentRuntimeReconcilerFailsClosedWhenStatusIsUnauthenticated(t *testing.T) {
+	profile, claims, limits := testAgentRuntimeProfileClaimsAndLimits()
+	config := conformancetest.Config{
+		ControllerBearerToken: strings.Repeat("t", 32), OperationCapabilitySecret: []byte(strings.Repeat("s", 32)),
+		RuntimeInstanceID: "runtime-1", SupervisorBootID: "boot-1", RuntimePoolUID: "pool-1",
+		Profile: profile, Limits: limits, WorkspaceGovernance: claims, AllowUnauthenticatedStatus: true,
 	}
-	var updated corev1alpha1.AgentRuntime
-	if err := r.Get(context.Background(), client.ObjectKeyFromObject(runtime), &updated); err != nil {
-		t.Fatalf("Get AgentRuntime: %v", err)
+	server, err := conformancetest.NewServer(config)
+	if err != nil {
+		t.Fatal(err)
 	}
-	if updated.Status.Ready {
-		t.Fatalf("Ready = true, want false")
+	defer server.Close()
+	runtimeObject, secret := testAgentRuntimeAndSecret(t, server.URL(), config)
+	reconciler := newAgentRuntimeUnitReconciler(t, runtimeObject, secret)
+	allowAgentRuntimeLoopback(t)
+	if _, err := reconciler.Reconcile(t.Context(), reconcileRequestFor(runtimeObject)); err != nil {
+		t.Fatal(err)
 	}
-	if !strings.Contains(updated.Status.Message, "not found") {
-		t.Fatalf("Message = %q, want missing Secret context", updated.Status.Message)
+	updated := getAgentRuntime(t, reconciler, runtimeObject)
+	if updated.Status.Ready || !strings.Contains(updated.Status.Message, "status negative probe") {
+		t.Fatalf("unauthenticated status exposure = %#v", updated.Status)
 	}
 }
 
-func TestAgentRuntimeReconcilerReportsMissingBearerSecretKey(t *testing.T) {
-	server := harnesstest.NewFakeHarnessServer(harnesstest.FakeHarnessConfig{AuthToken: agentRuntimeTestBearer})
-	defer server.Close()
-
-	runtime, secret := testAgentRuntimeAndSecret(server.URL())
-	secret.Data = map[string][]byte{"other": []byte("x")}
-	r := newAgentRuntimeUnitReconciler(t, runtime, secret)
-	if _, err := r.Reconcile(context.Background(), reconcileRequestFor(runtime)); err != nil {
-		t.Fatalf("Reconcile: %v", err)
+func TestAgentRuntimeReconcilerRejectsMissingCapabilitySecretKey(t *testing.T) {
+	profile, claims, limits := testAgentRuntimeProfileClaimsAndLimits()
+	config := conformancetest.Config{
+		ControllerBearerToken: strings.Repeat("t", 32), OperationCapabilitySecret: []byte(strings.Repeat("s", 32)),
+		RuntimeInstanceID: "runtime-1", Profile: profile, Limits: limits, WorkspaceGovernance: claims,
 	}
-	var updated corev1alpha1.AgentRuntime
-	if err := r.Get(context.Background(), client.ObjectKeyFromObject(runtime), &updated); err != nil {
-		t.Fatalf("Get AgentRuntime: %v", err)
-	}
-	if updated.Status.Ready {
-		t.Fatalf("Ready = true, want false")
+	runtimeObject, secret := testAgentRuntimeAndSecret(t, "https://runtime.example.com", config)
+	delete(secret.Data, "capability-secret")
+	reconciler := newAgentRuntimeUnitReconciler(t, runtimeObject, secret)
+	if _, err := reconciler.Reconcile(t.Context(), reconcileRequestFor(runtimeObject)); err != nil {
+		t.Fatal(err)
 	}
-	if !strings.Contains(updated.Status.Message, "key") || !strings.Contains(updated.Status.Message, "empty or missing") {
-		t.Fatalf("Message = %q, want missing key context", updated.Status.Message)
+	updated := getAgentRuntime(t, reconciler, runtimeObject)
+	if updated.Status.Ready || !strings.Contains(updated.Status.Message, "at least 32 bytes") {
+		t.Fatalf("missing capability key status = %#v", updated.Status)
 	}
 }
 
-func TestAgentRuntimeReconcilerRequiresCapabilitySubset(t *testing.T) {
-	server := harnesstest.NewFakeHarnessServer(harnesstest.FakeHarnessConfig{AuthToken: agentRuntimeTestBearer})
-	defer server.Close()
-
-	runtime, secret := testAgentRuntimeAndSecret(server.URL())
-	runtime.Spec.Capabilities.ToolExecutionModes = []corev1alpha1.AgentRuntimeToolExecutionMode{corev1alpha1.AgentRuntimeToolExecutionMode("future")}
-	r := newAgentRuntimeUnitReconciler(t, runtime, secret)
-	if _, err := r.Reconcile(context.Background(), reconcileRequestFor(runtime)); err != nil {
-		t.Fatalf("Reconcile: %v", err)
+func TestAgentRuntimeEndpointPolicy(t *testing.T) {
+	profile, claims, limits := testAgentRuntimeProfileClaimsAndLimits()
+	config := conformancetest.Config{RuntimeInstanceID: "runtime-1", Profile: profile, Limits: limits, WorkspaceGovernance: claims}
+	runtimeObject, _ := testAgentRuntimeAndSecret(t, "http://runtime.default.svc.cluster.local:8080", config)
+	service := &corev1.Service{ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "runtime"}}
+	reconciler := newAgentRuntimeUnitReconciler(t, runtimeObject, service)
+	if err := reconciler.validateAgentRuntimeEndpointPolicy(t.Context(), runtimeObject); err != nil {
+		t.Fatalf("same-namespace Service endpoint: %v", err)
 	}
-	var updated corev1alpha1.AgentRuntime
-	if err := r.Get(context.Background(), client.ObjectKeyFromObject(runtime), &updated); err != nil {
-		t.Fatalf("Get AgentRuntime: %v", err)
+	runtimeObject.Spec.Deployment.Endpoint = "http://runtime.other.svc.cluster.local:8080"
+	if err := reconciler.validateAgentRuntimeEndpointPolicy(t.Context(), runtimeObject); err == nil || !strings.Contains(err.Error(), "must match") {
+		t.Fatalf("cross-namespace endpoint error = %v", err)
+	}
+	runtimeObject.Spec.Deployment.Endpoint = "http://runtime.example.com"
+	if err := reconciler.validateAgentRuntimeEndpointPolicy(t.Context(), runtimeObject); err == nil || !strings.Contains(err.Error(), "https") {
+		t.Fatalf("external HTTP endpoint error = %v", err)
 	}
-	if updated.Status.Ready {
-		t.Fatalf("Ready = true, want false")
+}
+
+func TestValidateHarnessV1AgentRuntimeEndpointSpecRequiresTLS(t *testing.T) {
+	for _, endpoint := range []string{
+		"http://runtime.default.svc:8080",
+		"http://runtime.default.svc.cluster.local:8080",
+		"http://runtime.example.invalid",
+	} {
+		t.Run(endpoint, func(t *testing.T) {
+			if err := validateHarnessV1AgentRuntimeEndpointSpec(endpoint); err == nil || !strings.Contains(err.Error(), "must use https") {
+				t.Fatalf("validateHarnessV1AgentRuntimeEndpointSpec(%q) error = %v, want TLS rejection", endpoint, err)
+			}
+		})
 	}
-	if !strings.Contains(updated.Status.Message, "toolExecutionMode") {
-		t.Fatalf("Message = %q, want capability failure", updated.Status.Message)
+	if err := validateHarnessV1AgentRuntimeEndpointSpec("https://runtime.default.svc:8443"); err != nil {
+		t.Fatalf("TLS Service endpoint rejected: %v", err)
 	}
 }
 
-func reconcileRequestFor(obj client.Object) ctrl.Request {
-	return ctrl.Request{NamespacedName: client.ObjectKeyFromObject(obj)}
+func TestAgentRuntimeProfilePreservesModelLimits(t *testing.T) {
+	base, _, _ := testAgentRuntimeProfileClaimsAndLimits()
+	base.ProviderKind = runtimePoolProviderOpencode
+	base.Model = "openai/gpt-test"
+	base.AdapterDigests = map[string]string{"opencode": testControllerDigest("opencode-adapter")}
+	base.ProxyCredentialScope = "model:openai/gpt-test"
+	base.ModelLimits = &harnessv2.ModelTokenLimits{Context: 32768, Output: 4096}
+	spec := corev1alpha1.AgentRuntimeProfileSpec{
+		DigestSchemaVersion:      int32(harnessv2.ProfileDigestSchemaVersion),
+		ACPProfile:               base.ACPProfile,
+		AdapterName:              "opencode",
+		AdapterDigest:            base.AdapterDigests["opencode"],
+		ProviderKind:             base.ProviderKind,
+		Model:                    base.Model,
+		ModelLimits:              &corev1alpha1.ModelTokenLimits{Context: 32768, Output: 4096},
+		AgentConfigurationDigest: base.AgentConfigurationDigest,
+		ToolPolicyDigest:         base.ToolPolicyDigest,
+		ApprovalPolicyDigest:     base.ApprovalPolicyDigest,
+		MCPConfigurationDigest:   base.MCPConfigurationDigest,
+		WorkspaceIntent:          corev1alpha1.WorkspaceIntent(base.WorkspaceIntent),
+		ProxyCredentialRole:      base.ProxyCredentialRole,
+		ProxyCredentialScope:     base.ProxyCredentialScope,
+		ResourceClass:            base.ResourceClass,
+	}
+	profile, err := agentRuntimeProfile(spec)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if profile.ModelLimits == nil || profile.ModelLimits.Context != 32768 || profile.ModelLimits.Output != 4096 {
+		t.Fatalf("model limits = %#v", profile.ModelLimits)
+	}
 }
 
-func newAgentRuntimeUnitReconciler(t *testing.T, objs ...client.Object) *AgentRuntimeReconciler {
+func testAgentRuntimeAndSecret(t *testing.T, endpoint string, config conformancetest.Config) (*corev1alpha1.AgentRuntime, *corev1.Secret) {
 	t.Helper()
-	previousAllowLoopback := agentRuntimeAllowInsecureLoopbackForTests
-	agentRuntimeAllowInsecureLoopbackForTests = true
-	t.Cleanup(func() { agentRuntimeAllowInsecureLoopbackForTests = previousAllowLoopback })
-	scheme := newTestScheme()
-	fc := fake.NewClientBuilder().
-		WithScheme(scheme).
-		WithStatusSubresource(&corev1alpha1.AgentRuntime{}).
-		WithObjects(objs...).
-		Build()
-	return &AgentRuntimeReconciler{Client: fc, Scheme: scheme}
+	profileDigest, err := harnessv2.CanonicalProfileDigest(config.Profile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	adapterName, adapterDigest := "", ""
+	for adapterName, adapterDigest = range config.Profile.AdapterDigests {
+		break
+	}
+	var apiModelLimits *corev1alpha1.ModelTokenLimits
+	if config.Profile.ModelLimits != nil {
+		apiModelLimits = &corev1alpha1.ModelTokenLimits{
+			Context: config.Profile.ModelLimits.Context,
+			Output:  config.Profile.ModelLimits.Output,
+		}
+	}
+	runtimeObject := &corev1alpha1.AgentRuntime{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "runtime", Generation: 1},
+		Spec: corev1alpha1.AgentRuntimeRegistrySpec{
+			ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			Deployment:      corev1alpha1.AgentRuntimeDeploymentSpec{Mode: corev1alpha1.AgentRuntimeDeploymentModeExternalEndpoint, Endpoint: endpoint},
+			ClientAuth: corev1alpha1.AgentRuntimeClientAuth{
+				ControllerBearerTokenSecretRef: &corev1alpha1.AgentRuntimeSecretKeyReference{Name: "runtime-auth", Key: "controller-token"},
+				OperationCapabilitySecretRef:   &corev1alpha1.AgentRuntimeSecretKeyReference{Name: "runtime-auth", Key: "capability-secret"},
+			},
+			Capabilities: &corev1alpha1.AgentRuntimeCapabilitiesSpec{
+				RuntimeInstanceID: string(config.RuntimeInstanceID),
+				Profile: &corev1alpha1.AgentRuntimeProfileSpec{
+					Digest: string(profileDigest), DigestSchemaVersion: int32(harnessv2.ProfileDigestSchemaVersion),
+					ACPProfile: config.Profile.ACPProfile, AdapterName: adapterName, AdapterDigest: adapterDigest,
+					ProviderKind: config.Profile.ProviderKind, Model: config.Profile.Model, ModelLimits: apiModelLimits,
+					AgentConfigurationDigest: config.Profile.AgentConfigurationDigest,
+					ToolPolicyDigest:         config.Profile.ToolPolicyDigest, ApprovalPolicyDigest: config.Profile.ApprovalPolicyDigest,
+					MCPConfigurationDigest: config.Profile.MCPConfigurationDigest,
+					WorkspaceIntent:        corev1alpha1.WorkspaceIntent(config.Profile.WorkspaceIntent),
+					ProxyCredentialRole:    config.Profile.ProxyCredentialRole, ProxyCredentialScope: config.Profile.ProxyCredentialScope,
+					ResourceClass: config.Profile.ResourceClass,
+				},
+				Limits: &corev1alpha1.AgentRuntimeProtocolLimits{
+					MaxResidentSessions: int32(config.Limits.MaxResidentSessions), MaxConcurrentPrompts: int32(config.Limits.MaxConcurrentPrompts),
+					MaxRequestBytes: int32(config.Limits.MaxRequestBytes), MaxEventLineBytes: int32(config.Limits.MaxEventLineBytes),
+					MaxTerminalResultBytes: int32(config.Limits.MaxTerminalResultBytes), MaxBufferedEvents: int32(config.Limits.MaxBufferedEvents),
+					MaxUpdateEventsPerSecond: int32(config.Limits.MaxUpdateEventsPerSecond), MinPromptLeaseMillis: config.Limits.MinPromptLeaseMillis,
+					MaxPromptLeaseMillis: config.Limits.MaxPromptLeaseMillis, MaxPendingPermissions: int32(config.Limits.MaxPendingPermissions),
+					MaxWorkspaceDeltaBytes: config.Limits.MaxWorkspaceDeltaBytes,
+				},
+				SupportsDrain: config.SupportsDrain,
+				WorkspaceGovernance: &corev1alpha1.AgentRuntimeWorkspaceGovernanceCapabilities{
+					Mode: corev1alpha1.AgentRuntimeWorkspaceGovernanceMode(config.WorkspaceGovernance.Mode), Trusted: config.WorkspaceGovernance.Trusted,
+					OrkaOwnedWorkspaceDeltas:        config.WorkspaceGovernance.OrkaOwnedWorkspaceDeltas,
+					PromptScopedBrokerAuthorization: config.WorkspaceGovernance.PromptScopedBrokerAuthorization,
+					NoDirectSCMPublication:          config.WorkspaceGovernance.NoDirectSCMPublication,
+					OrkaOwnedCleanRoomPublication:   config.WorkspaceGovernance.OrkaOwnedCleanRoomPublication,
+					ExactInstanceFencing:            config.WorkspaceGovernance.ExactInstanceFencing,
+					DuplicateSafeMutations:          config.WorkspaceGovernance.DuplicateSafeMutations,
+					CancellationSettlement:          config.WorkspaceGovernance.CancellationSettlement,
+				},
+			},
+		},
+	}
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "default", Name: "runtime-auth",
+			Labels:      map[string]string{agentRuntimeAuthUseLabel: "true", agentRuntimeAuthRefNameLabel: runtimeObject.Name},
+			Annotations: map[string]string{agentRuntimeAuthEndpointAnnotation: endpoint},
+		},
+		Data: map[string][]byte{
+			"controller-token":  []byte(config.ControllerBearerToken),
+			"capability-secret": append([]byte(nil), config.OperationCapabilitySecret...),
+		},
+	}
+	return runtimeObject, secret
 }
 
-func testAgentRuntimeAndSecret(endpoint string) (*corev1alpha1.AgentRuntime, *corev1.Secret) {
+func testHarnessV1AgentRuntimeAndSecret(endpoint string) (*corev1alpha1.AgentRuntime, *corev1.Secret) {
 	supportsCancel := true
-	supportsSessions := true
-	runtime := &corev1alpha1.AgentRuntime{
-		ObjectMeta: metav1.ObjectMeta{Name: "fibey-agentkit", Namespace: "default", Generation: 1},
+	supportsRuntimeSessions := true
+	runtimeObject := &corev1alpha1.AgentRuntime{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "runtime-v1", Generation: 1},
 		Spec: corev1alpha1.AgentRuntimeRegistrySpec{
-			ContractVersion: corev1alpha1.AgentRuntimeContractHarnessV1,
+			ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV1),
 			Deployment: corev1alpha1.AgentRuntimeDeploymentSpec{
-				Mode:     corev1alpha1.AgentRuntimeDeploymentModeExternalEndpoint,
-				Endpoint: endpoint,
+				Mode: corev1alpha1.AgentRuntimeDeploymentModeExternalEndpoint, Endpoint: endpoint,
+			},
+			ClientAuth: corev1alpha1.AgentRuntimeClientAuth{
+				BearerAuthRef: &corev1alpha1.AgentRuntimeBearerAuthReference{Name: "runtime-v1-auth", Key: "token"},
 			},
-			ClientAuth: corev1alpha1.AgentRuntimeClientAuth{BearerAuthRef: corev1alpha1.AgentRuntimeBearerAuthReference{
-				Name: "fibey-agentkit-harness-token",
-				Key:  "token",
-			}},
 			Capabilities: &corev1alpha1.AgentRuntimeCapabilitiesSpec{
-				ToolExecutionModes:      []corev1alpha1.AgentRuntimeToolExecutionMode{corev1alpha1.AgentRuntimeToolExecutionModeObserved},
+				ToolExecutionModes: []corev1alpha1.AgentRuntimeToolExecutionMode{
+					corev1alpha1.AgentRuntimeToolExecutionModeObserved,
+				},
 				SupportsCancel:          &supportsCancel,
-				SupportsRuntimeSessions: &supportsSessions,
+				SupportsRuntimeSessions: &supportsRuntimeSessions,
 			},
 		},
 	}
 	secret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: "fibey-agentkit-harness-token", Namespace: "default", Labels: map[string]string{agentRuntimeAuthUseLabel: scheduledRunLabelValue, agentRuntimeAuthRefNameLabel: "fibey-agentkit"}, Annotations: map[string]string{agentRuntimeAuthEndpointAnnotation: endpoint}},
-		Data:       map[string][]byte{"token": []byte(agentRuntimeTestBearer)},
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "default", Name: "runtime-v1-auth", UID: types.UID("runtime-v1-auth-uid"), ResourceVersion: "1",
+			Labels: map[string]string{
+				agentRuntimeAuthUseLabel: scheduledRunLabelValue, agentRuntimeAuthRefNameLabel: runtimeObject.Name,
+			},
+			Annotations: map[string]string{agentRuntimeAuthEndpointAnnotation: endpoint},
+		},
+		Data: map[string][]byte{"token": []byte(agentRuntimeV1TestBearer)},
 	}
-	return runtime, secret
+	return runtimeObject, secret
 }
 
-func TestAgentRuntimeEndpointPolicyRejectsInsecureExternalEndpoint(t *testing.T) {
-	runtime, secret := testAgentRuntimeAndSecret("http://runtime.example.com")
-	r := newAgentRuntimeUnitReconciler(t, runtime, secret)
-	if err := validateAgentRuntimeSpec(runtime); err != nil {
-		t.Fatalf("validateAgentRuntimeSpec() error = %v", err)
-	}
-	if err := r.validateAgentRuntimeEndpointPolicy(context.Background(), runtime); err == nil || !strings.Contains(err.Error(), "https") {
-		t.Fatalf("validateAgentRuntimeEndpointPolicy() = %v, want https requirement", err)
-	}
-	runtime.Spec.Deployment.Endpoint = "http://127.0.0.1:8080"
-	agentRuntimeAllowInsecureLoopbackForTests = false
-	if err := r.validateAgentRuntimeEndpointPolicy(context.Background(), runtime); err == nil || !strings.Contains(err.Error(), "https") {
-		t.Fatalf("validateAgentRuntimeEndpointPolicy(loopback) = %v, want https requirement", err)
-	}
-	agentRuntimeAllowInsecureLoopbackForTests = true
-	service := &corev1.Service{ObjectMeta: metav1.ObjectMeta{Name: "runtime", Namespace: "default"}, Spec: corev1.ServiceSpec{Selector: map[string]string{"app": "runtime"}}}
-	r = newAgentRuntimeUnitReconciler(t, runtime, secret, service)
-	runtime.Spec.Deployment.Endpoint = "http://runtime.default.svc.cluster.local:8080"
-	if err := r.validateAgentRuntimeEndpointPolicy(context.Background(), runtime); err != nil {
-		t.Fatalf("validateAgentRuntimeEndpointPolicy(cluster-local) error = %v", err)
-	}
-	runtime.Spec.Deployment.Endpoint = "http://runtime:8080"
-	if err := r.validateAgentRuntimeEndpointPolicy(context.Background(), runtime); err == nil || !strings.Contains(err.Error(), "https") {
-		t.Fatalf("validateAgentRuntimeEndpointPolicy(short-service) = %v, want https requirement", err)
-	}
-	runtime.Spec.Deployment.Endpoint = "http://runtime.default:8080"
-	if err := r.validateAgentRuntimeEndpointPolicy(context.Background(), runtime); err != nil {
-		t.Fatalf("validateAgentRuntimeEndpointPolicy(service-namespace) error = %v", err)
-	}
-	selectorlessService := &corev1.Service{ObjectMeta: metav1.ObjectMeta{Name: "selectorless-runtime", Namespace: "default"}}
-	externalNameService := &corev1.Service{
-		ObjectMeta: metav1.ObjectMeta{Name: "external-runtime", Namespace: "default"},
-		Spec:       corev1.ServiceSpec{Type: corev1.ServiceTypeExternalName, ExternalName: "runtime.example.com"},
-	}
-	r = newAgentRuntimeUnitReconciler(t, runtime, secret, service, selectorlessService, externalNameService)
-	runtime.Spec.Deployment.Endpoint = "http://selectorless-runtime.default.svc.cluster.local:8080"
-	if err := r.validateAgentRuntimeEndpointPolicy(context.Background(), runtime); err == nil || !strings.Contains(err.Error(), "https") {
-		t.Fatalf("validateAgentRuntimeEndpointPolicy(selectorless service) = %v, want https requirement", err)
-	}
-	runtime.Spec.Deployment.Endpoint = "http://external-runtime.default.svc.cluster.local:8080"
-	if err := r.validateAgentRuntimeEndpointPolicy(context.Background(), runtime); err == nil || !strings.Contains(err.Error(), "https") {
-		t.Fatalf("validateAgentRuntimeEndpointPolicy(externalName) = %v, want https requirement", err)
-	}
-	runtime.Spec.Deployment.Endpoint = "http://missing:8080"
-	if err := r.validateAgentRuntimeEndpointPolicy(context.Background(), runtime); err == nil || !strings.Contains(err.Error(), "https") {
-		t.Fatalf("validateAgentRuntimeEndpointPolicy(missing short service) = %v, want https requirement", err)
-	}
-	runtime.Spec.Deployment.Endpoint = "http://runtime.dev:8080"
-	if err := r.validateAgentRuntimeEndpointPolicy(context.Background(), runtime); err == nil || !strings.Contains(err.Error(), "https") {
-		t.Fatalf("validateAgentRuntimeEndpointPolicy(namespace-like external) = %v, want https requirement", err)
-	}
-	runtime.Spec.Deployment.Endpoint = "http://runtime.svc.attacker.com"
-	if err := r.validateAgentRuntimeEndpointPolicy(context.Background(), runtime); err == nil || !strings.Contains(err.Error(), "https") {
-		t.Fatalf("validateAgentRuntimeEndpointPolicy(svc-looking external) = %v, want https requirement", err)
-	}
-	runtime.Spec.Deployment.Endpoint = "http://runtime.default.svc.attacker.com"
-	if err := r.validateAgentRuntimeEndpointPolicy(context.Background(), runtime); err == nil || !strings.Contains(err.Error(), "https") {
-		t.Fatalf("validateAgentRuntimeEndpointPolicy(svc-extra-label external) = %v, want https requirement", err)
-	}
-	runtime.Spec.Deployment.Endpoint = "http://10.0.0.5:8080"
-	if err := r.validateAgentRuntimeEndpointPolicy(context.Background(), runtime); err == nil || !strings.Contains(err.Error(), "https") {
-		t.Fatalf("validateAgentRuntimeEndpointPolicy(private IP) = %v, want https requirement", err)
-	}
-	runtime.Spec.Deployment.Endpoint = "https://user:pass@runtime.example.com"
-	if err := validateAgentRuntimeSpec(runtime); err == nil || !strings.Contains(err.Error(), "credentials") {
-		t.Fatalf("validateAgentRuntimeSpec(credentials) = %v, want credentials rejection", err)
-	}
+func testAgentRuntimeProfileClaimsAndLimits() (harnessv2.RuntimeProfile, v2conformance.WorkspaceGovernanceClaims, harnessv2.ProtocolLimits) {
+	toolPolicy := harnessv2.MCPToolPolicy{AllowedToolNames: []string{}, Tools: []harnessv2.MCPToolDescriptor{}}
+	toolPolicyDigest, _ := harnessv2.CanonicalRuntimeToolPolicyDigest(toolPolicy.AllowedToolNames, toolPolicy.DisallowedToolNames, toolPolicy.AllowBash)
+	approvalPolicyDigest, _ := harnessv2.CanonicalMCPApprovalPolicyDigest(harnessv2.MCPApprovalPolicy{})
+	mcpConfigurationDigest, _ := harnessv2.CanonicalMCPConfigurationDigest(toolPolicy.AllowedToolNames)
+	profile := harnessv2.RuntimeProfile{
+		ACPProfile:     harnessv2.ACPProfileV1,
+		AdapterDigests: map[string]string{"codex": testControllerDigest("adapter")},
+		ProviderKind:   "codex", Model: acpTestModel,
+		AgentConfigurationDigest: testControllerDigest("agent"), ToolPolicyDigest: toolPolicyDigest,
+		ApprovalPolicyDigest: approvalPolicyDigest, MCPConfigurationDigest: mcpConfigurationDigest,
+		WorkspaceIntent:     harnessv2.WorkspaceIntentRead,
+		ProxyCredentialRole: "provider-proxy", ProxyCredentialScope: "session-and-prompt", ResourceClass: "standard",
+	}
+	claims := v2conformance.WorkspaceGovernanceClaims{
+		Mode:                     v2conformance.WorkspaceGovernanceStrict,
+		OrkaOwnedWorkspaceDeltas: true, PromptScopedBrokerAuthorization: true,
+		NoDirectSCMPublication: true, OrkaOwnedCleanRoomPublication: true,
+		ExactInstanceFencing: true, DuplicateSafeMutations: true, CancellationSettlement: true,
+	}
+	return profile, claims, harnessv2.DefaultProtocolLimits()
 }
 
-func TestValidateAgentRuntimeExecutableCapabilitiesRejectsUnknownBrokeredClass(t *testing.T) {
-	err := validateAgentRuntimeExecutableCapabilities(&harness.CapabilitiesResponse{
-		RuntimeName:             "runtime-a",
-		ToolExecutionModes:      []harness.ToolExecutionMode{harness.ToolExecutionModeBrokered},
-		BrokeredToolClasses:     []harness.BrokeredToolClass{harness.BrokeredToolClass("admin")},
-		SupportsRuntimeSessions: true,
-		SupportsContinuation:    true,
-	})
-	if err == nil || !strings.Contains(err.Error(), "unsupported brokeredToolClass") {
-		t.Fatalf("validateAgentRuntimeExecutableCapabilities() error = %v, want brokered class rejection", err)
-	}
+func testControllerDigest(seed string) string {
+	sum := sha256.Sum256([]byte(seed))
+	return "sha256:" + hex.EncodeToString(sum[:])
 }
 
-func TestValidateAgentRuntimeExecutableCapabilitiesRequiresBrokeredContinuation(t *testing.T) {
-	err := validateAgentRuntimeExecutableCapabilities(&harness.CapabilitiesResponse{
-		RuntimeName:             "runtime-a",
-		ToolExecutionModes:      []harness.ToolExecutionMode{harness.ToolExecutionModeObserved, harness.ToolExecutionModeBrokered},
-		BrokeredToolClasses:     []harness.BrokeredToolClass{harness.BrokeredToolClassRead},
-		SupportsCancel:          true,
-		SupportsRuntimeSessions: true,
-	})
-	if err == nil || !strings.Contains(err.Error(), "supportsContinuation") {
-		t.Fatalf("validateAgentRuntimeExecutableCapabilities() error = %v, want continuation requirement", err)
-	}
+func reconcileRequestFor(object client.Object) ctrl.Request {
+	return ctrl.Request{NamespacedName: client.ObjectKeyFromObject(object)}
 }
 
-func TestValidateObservedHarnessCapabilitiesRequiresCancelAndSessions(t *testing.T) {
-	err := validateObservedHarnessCapabilities(&harness.CapabilitiesResponse{
-		RuntimeName:             "runtime-a",
-		ToolExecutionModes:      []harness.ToolExecutionMode{harness.ToolExecutionModeObserved},
-		SupportsRuntimeSessions: true,
-	})
-	if err == nil || !strings.Contains(err.Error(), "supportsCancel") {
-		t.Fatalf("validateObservedHarnessCapabilities() error = %v, want supportsCancel requirement", err)
+func newAgentRuntimeUnitReconciler(t *testing.T, objects ...client.Object) *AgentRuntimeReconciler {
+	t.Helper()
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
 	}
-	err = validateObservedHarnessCapabilities(&harness.CapabilitiesResponse{
-		RuntimeName:        "runtime-a",
-		ToolExecutionModes: []harness.ToolExecutionMode{harness.ToolExecutionModeObserved},
-		SupportsCancel:     true,
-	})
-	if err == nil || !strings.Contains(err.Error(), "supportsRuntimeSessions") {
-		t.Fatalf("validateObservedHarnessCapabilities() error = %v, want supportsRuntimeSessions requirement", err)
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatal(err)
 	}
+	fakeClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.AgentRuntime{}).WithObjects(objects...).Build()
+	return &AgentRuntimeReconciler{Client: fakeClient, APIReader: fakeClient, Scheme: scheme}
 }
 
-func TestObservedCapabilitiesFromConformanceRedactsStrings(t *testing.T) {
-	leaked := "sk-" + strings.Repeat("a", 20)
-	got := observedCapabilitiesFromConformance(&harness.CapabilitiesResponse{
-		ProtocolVersion:         harness.ProtocolVersion,
-		Transport:               harness.HTTPTransport,
-		RuntimeName:             "runtime " + leaked,
-		RuntimeVersion:          "Authorization: Bearer " + leaked,
-		ProviderKind:            harness.ProviderKindKubernetesService,
-		ToolExecutionModes:      []harness.ToolExecutionMode{harness.ToolExecutionModeObserved},
-		SupportsCancel:          true,
-		SupportsRuntimeSessions: true,
-	})
-	if got == nil {
-		t.Fatal("observed = nil")
-	}
-	if strings.Contains(got.RuntimeName, leaked) || strings.Contains(got.RuntimeVersion, leaked) {
-		t.Fatalf("observed capabilities leaked secret-like values: %#v", got)
+func getAgentRuntime(t *testing.T, reconciler *AgentRuntimeReconciler, object *corev1alpha1.AgentRuntime) corev1alpha1.AgentRuntime {
+	t.Helper()
+	var updated corev1alpha1.AgentRuntime
+	if err := reconciler.Get(context.Background(), client.ObjectKeyFromObject(object), &updated); err != nil {
+		t.Fatal(err)
 	}
+	return updated
 }
 
-func TestValidateObservedHarnessCapabilitiesRequiresObservedMode(t *testing.T) {
-	err := validateObservedHarnessCapabilities(&harness.CapabilitiesResponse{
-		RuntimeName:        "runtime-a",
-		ToolExecutionModes: []harness.ToolExecutionMode{harness.ToolExecutionModeBrokered},
-	})
-	if err == nil || !strings.Contains(err.Error(), "observed") {
-		t.Fatalf("validateObservedHarnessCapabilities() error = %v, want observed mode requirement", err)
-	}
+func allowAgentRuntimeLoopback(t *testing.T) {
+	t.Helper()
+	agentRuntimeAllowInsecureLoopbackForTests = true
+	t.Cleanup(func() { agentRuntimeAllowInsecureLoopbackForTests = false })
 }
 
-func TestObservedCapabilitiesFromConformanceMapsModes(t *testing.T) {
-	got := observedCapabilitiesFromConformance(&harness.CapabilitiesResponse{
-		ProtocolVersion:         harness.ProtocolVersion,
-		RuntimeName:             "runtime-a",
-		ToolExecutionModes:      []harness.ToolExecutionMode{harness.ToolExecutionModeObserved},
-		SupportsCancel:          true,
-		SupportsRuntimeSessions: true,
-	})
-	if got == nil || len(got.ToolExecutionModes) != 1 || got.ToolExecutionModes[0] != corev1alpha1.AgentRuntimeToolExecutionModeObserved {
-		t.Fatalf("observed = %#v", got)
+type agentRuntimeMutateSecondSecretReadClient struct {
+	client.Client
+	SecretKey client.ObjectKey
+	Mutate    func(*corev1.Secret)
+	reads     int
+}
+
+func (c *agentRuntimeMutateSecondSecretReadClient) Get(
+	ctx context.Context,
+	key client.ObjectKey,
+	object client.Object,
+	options ...client.GetOption,
+) error {
+	if err := c.Client.Get(ctx, key, object, options...); err != nil {
+		return err
+	}
+	secret, ok := object.(*corev1.Secret)
+	if !ok || key != c.SecretKey {
+		return nil
+	}
+	c.reads++
+	if c.reads == 2 && c.Mutate != nil {
+		c.Mutate(secret)
 	}
+	return nil
 }
diff --git a/internal/controller/controller_epoch.go b/internal/controller/controller_epoch.go
new file mode 100644
index 000000000..b9021be12
--- /dev/null
+++ b/internal/controller/controller_epoch.go
@@ -0,0 +1,274 @@
+package controller
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+const defaultEpochCASRetries = 16
+
+// ControllerEpochManager acquires one durable epoch after controller-runtime
+// leader election. Every ACP control-store mutation must use CurrentFence so a
+// stale leader cannot commit authoritative state after takeover.
+type ControllerEpochManager struct {
+	Store    store.ControllerEpochStore
+	Name     string
+	HolderID string
+	Mirrors  []store.ControllerEpochMirror
+
+	mu      sync.RWMutex
+	current *store.ControllerEpoch
+	ready   chan struct{}
+	once    sync.Once
+}
+
+func NewControllerEpochManager(epochStore store.ControllerEpochStore, holderID string) *ControllerEpochManager {
+	return &ControllerEpochManager{
+		Store: epochStore, Name: store.DefaultControllerEpochName, HolderID: strings.TrimSpace(holderID), ready: make(chan struct{}),
+	}
+}
+
+// WithMirror registers a subordinate epoch mirror that must synchronize before
+// CurrentFence becomes available. Call this only during startup wiring.
+func (m *ControllerEpochManager) WithMirror(mirror store.ControllerEpochMirror) *ControllerEpochManager {
+	if m != nil {
+		m.Mirrors = append(m.Mirrors, mirror)
+	}
+	return m
+}
+
+func (m *ControllerEpochManager) NeedLeaderElection() bool { return true }
+
+func (m *ControllerEpochManager) Start(ctx context.Context) error {
+	if m == nil || m.Store == nil {
+		return fmt.Errorf("controller epoch store is required")
+	}
+	m.Name = strings.TrimSpace(m.Name)
+	if m.Name == "" {
+		m.Name = store.DefaultControllerEpochName
+	}
+	m.HolderID = strings.TrimSpace(m.HolderID)
+	if m.HolderID == "" {
+		return fmt.Errorf("controller epoch holder ID is required")
+	}
+	current, err := readControllerEpoch(ctx, m.Store, m.Name)
+	if err != nil {
+		return err
+	}
+	pending, err := newControllerEpochCASIntent(m.Name, m.HolderID, current)
+	if err != nil {
+		return err
+	}
+	var acquired *store.ControllerEpoch
+	for attempt := range defaultEpochCASRetries {
+		candidate, casErr := m.Store.CompareAndSwapControllerEpoch(ctx, pending.change)
+		err = casErr
+		if err == nil {
+			if !controllerEpochMatchesCAS(candidate, pending.change) {
+				return fmt.Errorf("advance controller epoch: store returned a result that does not match the submitted CAS intent")
+			}
+			acquired = candidate
+			break
+		}
+		if !errors.Is(err, store.ErrConflict) {
+			return fmt.Errorf("advance controller epoch: %w", err)
+		}
+		observed, readErr := readControllerEpoch(ctx, m.Store, m.Name)
+		if readErr != nil {
+			return fmt.Errorf("reconcile controller epoch CAS conflict: %w", readErr)
+		}
+		switch {
+		case controllerEpochMatchesCAS(observed, pending.change):
+			acquired = observed
+		case controllerEpochsEqual(observed, pending.predecessor):
+			// The CAS did not commit. Retain the exact payload, including its
+			// digest and timestamp, so a retry remains idempotent.
+		case coherentCompetingControllerEpoch(observed, pending):
+			pending, err = newControllerEpochCASIntent(m.Name, m.HolderID, observed)
+			if err != nil {
+				return err
+			}
+		default:
+			return fmt.Errorf(
+				"reconcile controller epoch CAS conflict: authoritative state is not the exact predecessor, submitted target, or a coherent competing advancement",
+			)
+		}
+		if acquired != nil {
+			break
+		}
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case <-time.After(time.Duration(attempt+1) * 10 * time.Millisecond):
+		}
+	}
+	if acquired == nil {
+		return fmt.Errorf("controller epoch CAS did not converge after %d attempts", defaultEpochCASRetries)
+	}
+	for i, mirror := range m.Mirrors {
+		if mirror == nil {
+			return fmt.Errorf("controller epoch mirror %d is nil", i)
+		}
+		if err := mirror.SyncControllerEpochMirror(ctx, *acquired); err != nil {
+			return fmt.Errorf("synchronize controller epoch mirror %d: %w", i, err)
+		}
+	}
+	m.mu.Lock()
+	m.current = acquired
+	m.mu.Unlock()
+	m.once.Do(func() { close(m.ready) })
+	<-ctx.Done()
+	return nil
+}
+
+type controllerEpochCASIntent struct {
+	change      store.ControllerEpochCAS
+	predecessor *store.ControllerEpoch
+}
+
+func readControllerEpoch(ctx context.Context, epochStore store.ControllerEpochStore, name string) (*store.ControllerEpoch, error) {
+	current, err := epochStore.GetControllerEpoch(ctx, name)
+	if errors.Is(err, store.ErrNotFound) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("read controller epoch: %w", err)
+	}
+	if err := validateControllerEpochForAcquisition(current, name); err != nil {
+		return nil, err
+	}
+	copy := *current
+	return &copy, nil
+}
+
+func newControllerEpochCASIntent(name, holderID string, predecessor *store.ControllerEpoch) (controllerEpochCASIntent, error) {
+	expectedVersion, expectedEpoch := int64(0), int64(0)
+	var predecessorCopy *store.ControllerEpoch
+	if predecessor != nil {
+		if err := validateControllerEpochForAcquisition(predecessor, name); err != nil {
+			return controllerEpochCASIntent{}, err
+		}
+		expectedVersion, expectedEpoch = predecessor.Version, predecessor.Epoch
+		copy := *predecessor
+		predecessorCopy = &copy
+	}
+	change := store.ControllerEpochCAS{
+		Name:            name,
+		ExpectedVersion: expectedVersion,
+		ExpectedEpoch:   expectedEpoch,
+		NewEpoch:        expectedEpoch + 1,
+		HolderID:        holderID,
+		UpdatedAt:       time.Now().UTC(),
+	}
+	change.RequestDigest = controllerEpochDigest(
+		change.Name,
+		change.HolderID,
+		change.ExpectedVersion,
+		change.ExpectedEpoch,
+		change.NewEpoch,
+	)
+	return controllerEpochCASIntent{change: change, predecessor: predecessorCopy}, nil
+}
+
+func validateControllerEpochForAcquisition(epoch *store.ControllerEpoch, name string) error {
+	if epoch == nil {
+		return fmt.Errorf("read controller epoch: store returned a nil record")
+	}
+	if epoch.Name != name {
+		return fmt.Errorf("read controller epoch: logical name %q does not match %q", epoch.Name, name)
+	}
+	if epoch.Epoch < 1 || epoch.Version < 1 || epoch.Epoch != epoch.Version {
+		return fmt.Errorf("read controller epoch: invalid epoch/version %d/%d", epoch.Epoch, epoch.Version)
+	}
+	if strings.TrimSpace(epoch.HolderID) != epoch.HolderID {
+		return fmt.Errorf("read controller epoch: holder ID is not canonical")
+	}
+	if err := store.ValidateControlIdentifier("controller epoch holder ID", epoch.HolderID); err != nil {
+		return fmt.Errorf("read controller epoch: %w", err)
+	}
+	if err := store.ValidateCanonicalDigest("controller epoch request digest", epoch.RequestDigest); err != nil {
+		return fmt.Errorf("read controller epoch: %w", err)
+	}
+	if epoch.AcquiredAt.IsZero() || epoch.UpdatedAt.IsZero() || !epoch.AcquiredAt.Equal(epoch.UpdatedAt) {
+		return fmt.Errorf("read controller epoch: invalid acquisition timestamps")
+	}
+	return nil
+}
+
+func controllerEpochMatchesCAS(epoch *store.ControllerEpoch, change store.ControllerEpochCAS) bool {
+	return epoch != nil &&
+		epoch.Name == change.Name &&
+		epoch.Version == change.ExpectedVersion+1 &&
+		epoch.Epoch == change.NewEpoch &&
+		epoch.HolderID == change.HolderID &&
+		epoch.RequestDigest == change.RequestDigest &&
+		epoch.AcquiredAt.Equal(change.UpdatedAt) &&
+		epoch.UpdatedAt.Equal(change.UpdatedAt)
+}
+
+func controllerEpochsEqual(left, right *store.ControllerEpoch) bool {
+	if left == nil || right == nil {
+		return left == nil && right == nil
+	}
+	return left.Name == right.Name &&
+		left.Version == right.Version &&
+		left.Epoch == right.Epoch &&
+		left.HolderID == right.HolderID &&
+		left.RequestDigest == right.RequestDigest &&
+		left.AcquiredAt.Equal(right.AcquiredAt) &&
+		left.UpdatedAt.Equal(right.UpdatedAt)
+}
+
+func coherentCompetingControllerEpoch(observed *store.ControllerEpoch, pending controllerEpochCASIntent) bool {
+	if observed == nil || observed.Name != pending.change.Name {
+		return false
+	}
+	epochDelta := observed.Epoch - pending.change.ExpectedEpoch
+	versionDelta := observed.Version - pending.change.ExpectedVersion
+	return epochDelta >= 1 && epochDelta == versionDelta &&
+		observed.HolderID != pending.change.HolderID &&
+		observed.RequestDigest != pending.change.RequestDigest
+}
+
+func (m *ControllerEpochManager) CurrentFence(ctx context.Context) (store.ControllerEpochFence, error) {
+	if m == nil || m.ready == nil {
+		return store.ControllerEpochFence{}, fmt.Errorf("controller epoch manager is not initialized")
+	}
+	select {
+	case <-m.ready:
+	case <-ctx.Done():
+		return store.ControllerEpochFence{}, ctx.Err()
+	}
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	if m.current == nil {
+		return store.ControllerEpochFence{}, fmt.Errorf("controller epoch is unavailable")
+	}
+	return store.ControllerEpochFence{Name: m.current.Name, Epoch: m.current.Epoch, HolderID: m.current.HolderID}, nil
+}
+
+func (m *ControllerEpochManager) Current() (store.ControllerEpoch, bool) {
+	if m == nil {
+		return store.ControllerEpoch{}, false
+	}
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	if m.current == nil {
+		return store.ControllerEpoch{}, false
+	}
+	return *m.current, true
+}
+
+func controllerEpochDigest(name, holder string, expectedVersion, expectedEpoch, newEpoch int64) string {
+	payload := fmt.Sprintf("orka-controller-epoch-v1\x00%s\x00%s\x00%d\x00%d\x00%d", name, holder, expectedVersion, expectedEpoch, newEpoch)
+	sum := sha256.Sum256([]byte(payload))
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
diff --git a/internal/controller/controller_epoch_test.go b/internal/controller/controller_epoch_test.go
new file mode 100644
index 000000000..d6494baa8
--- /dev/null
+++ b/internal/controller/controller_epoch_test.go
@@ -0,0 +1,659 @@
+package controller
+
+import (
+	"context"
+	"fmt"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+	kubestore "github.com/orka-agents/orka/internal/store/kube"
+	"github.com/orka-agents/orka/internal/store/sqlite"
+	coordinationv1 "k8s.io/api/coordination/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
+)
+
+func TestControllerEpochManagerCreatesAndAdvances(t *testing.T) {
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "store.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	controlStore := sqlite.NewStore(db, "test")
+
+	first := NewControllerEpochManager(controlStore, "controller-a")
+	ctx1, cancel1 := context.WithCancel(context.Background())
+	done1 := make(chan error, 1)
+	go func() { done1 <- first.Start(ctx1) }()
+	fence1, err := fenceWithTimeout(first)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if fence1.Epoch != 1 || fence1.HolderID != "controller-a" {
+		t.Fatalf("first fence = %#v", fence1)
+	}
+	cancel1()
+	if err := <-done1; err != nil {
+		t.Fatal(err)
+	}
+
+	second := NewControllerEpochManager(controlStore, "controller-b")
+	ctx2, cancel2 := context.WithCancel(context.Background())
+	done2 := make(chan error, 1)
+	go func() { done2 <- second.Start(ctx2) }()
+	fence2, err := fenceWithTimeout(second)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if fence2.Epoch != 2 || fence2.HolderID != "controller-b" {
+		t.Fatalf("second fence = %#v", fence2)
+	}
+	cancel2()
+	if err := <-done2; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestControllerEpochManagerMirrorsAuthoritativeFenceBeforeReadiness(t *testing.T) {
+	authorityDB, err := sqlite.NewDB(filepath.Join(t.TempDir(), "authority.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = authorityDB.Close() })
+	mirrorDB, err := sqlite.NewDB(filepath.Join(t.TempDir(), "mirror.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = mirrorDB.Close() })
+	authority := sqlite.NewStore(authorityDB, "authority")
+	mirror := sqlite.NewStore(mirrorDB, "mirror")
+	manager := NewControllerEpochManager(authority, "controller-a").WithMirror(mirror)
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan error, 1)
+	go func() { done <- manager.Start(ctx) }()
+	fence, err := fenceWithTimeout(manager)
+	if err != nil {
+		cancel()
+		t.Fatal(err)
+	}
+	mirrored, err := mirror.GetControllerEpoch(context.Background(), fence.Name)
+	if err != nil {
+		cancel()
+		t.Fatal(err)
+	}
+	if mirrored.Epoch != fence.Epoch || mirrored.HolderID != fence.HolderID {
+		cancel()
+		t.Fatalf("mirrored epoch = %#v, want fence %#v", mirrored, fence)
+	}
+	cancel()
+	if err := <-done; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestControllerEpochManagerAdoptsCommittedIntentAfterConflict(t *testing.T) {
+	authority := newRetainedIntentEpochStore(epochConflictCommitThenReportConflict)
+	mirror := &recordingControllerEpochMirror{}
+	manager := NewControllerEpochManager(authority, controllerEpochTestTakeoverHolder).WithMirror(mirror)
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan error, 1)
+	go func() { done <- manager.Start(ctx) }()
+
+	fence, err := fenceWithTimeout(manager)
+	if err != nil {
+		cancel()
+		t.Fatal(err)
+	}
+	if fence.Epoch != 8 || fence.HolderID != controllerEpochTestTakeoverHolder {
+		cancel()
+		t.Fatalf("fence after ambiguous commit = %#v, want exact acquired epoch 8", fence)
+	}
+	if len(authority.changes) != 1 {
+		cancel()
+		t.Fatalf("CAS submissions after committed conflict = %d, want 1 (no epoch 9 intent)", len(authority.changes))
+	}
+	if len(mirror.synced) != 1 || !controllerEpochMatchesCAS(&mirror.synced[0], authority.changes[0]) {
+		cancel()
+		t.Fatalf("mirrored authority = %#v, submitted intent = %#v", mirror.synced, authority.changes[0])
+	}
+
+	cancel()
+	if err := <-done; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestControllerEpochManagerRetriesExactIntentWhenPredecessorIsUnchanged(t *testing.T) {
+	authority := newRetainedIntentEpochStore(epochConflictLeavesPredecessor)
+	manager := NewControllerEpochManager(authority, controllerEpochTestTakeoverHolder)
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan error, 1)
+	go func() { done <- manager.Start(ctx) }()
+
+	fence, err := fenceWithTimeout(manager)
+	if err != nil {
+		cancel()
+		t.Fatal(err)
+	}
+	if fence.Epoch != 8 || fence.HolderID != controllerEpochTestTakeoverHolder {
+		cancel()
+		t.Fatalf("fence after predecessor retry = %#v", fence)
+	}
+	if len(authority.changes) != 2 {
+		cancel()
+		t.Fatalf("CAS submissions = %d, want conflict plus one retry", len(authority.changes))
+	}
+	if authority.changes[0] != authority.changes[1] {
+		cancel()
+		t.Fatalf("retry changed CAS intent:\nfirst=%#v\nretry=%#v", authority.changes[0], authority.changes[1])
+	}
+
+	cancel()
+	if err := <-done; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestControllerEpochManagerTakesOverOnceAfterCompetingAdvance(t *testing.T) {
+	authority := newRetainedIntentEpochStore(epochConflictCommitsCompetitor)
+	manager := NewControllerEpochManager(authority, controllerEpochTestTakeoverHolder)
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan error, 1)
+	go func() { done <- manager.Start(ctx) }()
+
+	fence, err := fenceWithTimeout(manager)
+	if err != nil {
+		cancel()
+		t.Fatal(err)
+	}
+	if fence.Epoch != 9 || fence.HolderID != controllerEpochTestTakeoverHolder {
+		cancel()
+		t.Fatalf("fence after competing advance = %#v, want one takeover at epoch 9", fence)
+	}
+	if len(authority.changes) != 2 {
+		cancel()
+		t.Fatalf("CAS submissions = %d, want original epoch 8 intent and one epoch 9 takeover", len(authority.changes))
+	}
+	first, second := authority.changes[0], authority.changes[1]
+	if first.ExpectedEpoch != 7 || first.NewEpoch != 8 || second.ExpectedEpoch != 8 || second.NewEpoch != 9 {
+		cancel()
+		t.Fatalf("CAS sequence = %#v, want 7->8 then 8->9", authority.changes)
+	}
+	if second.RequestDigest != controllerEpochDigest(second.Name, second.HolderID, second.ExpectedVersion, second.ExpectedEpoch, second.NewEpoch) {
+		cancel()
+		t.Fatalf("takeover digest %q does not bind the replanned epoch 9 intent", second.RequestDigest)
+	}
+
+	cancel()
+	if err := <-done; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestControllerEpochManagerFailsClosedOnIncomparableConflictState(t *testing.T) {
+	authority := newRetainedIntentEpochStore(epochConflictCommitsSameHolderDifferentIntent)
+	manager := NewControllerEpochManager(authority, controllerEpochTestTakeoverHolder)
+	err := manager.Start(context.Background())
+	if err == nil || !strings.Contains(err.Error(), "not the exact predecessor") {
+		t.Fatalf("manager error = %v, want incomparable-authority failure", err)
+	}
+	if _, ready := manager.Current(); ready {
+		t.Fatal("manager became ready after incomparable conflict state")
+	}
+	if len(authority.changes) != 1 {
+		t.Fatalf("CAS submissions after incomparable state = %d, want no retry", len(authority.changes))
+	}
+}
+
+func TestControllerEpochManagerFailsClosedWhenRestoredLeaseIsMissing(t *testing.T) {
+	ctx := context.Background()
+	authority, kubeClient := newKubernetesControllerEpochAuthority(t)
+	restored := advanceKubernetesControllerEpoch(t, ctx, authority, 7)
+	object, lease := kubernetesControllerEpochObjects(t, ctx, kubeClient)
+	if object.Status.Epoch != restored.Epoch || object.Status.Version != restored.Version {
+		t.Fatalf("restored controller epoch object = %#v, want epoch/version %d/%d", object.Status, restored.Epoch, restored.Version)
+	}
+	if err := kubeClient.Delete(ctx, lease); err != nil {
+		t.Fatalf("delete authoritative Lease to simulate incomplete restore: %v", err)
+	}
+
+	manager := NewControllerEpochManager(authority, "controller-after-incomplete-restore")
+	done := make(chan error, 1)
+	go func() { done <- manager.Start(ctx) }()
+	select {
+	case err := <-done:
+		if err == nil || !strings.Contains(err.Error(), "authoritative Lease is missing") {
+			t.Fatalf("manager startup error = %v, want missing-authority failure", err)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("manager startup did not fail closed for missing restored Lease")
+	}
+	if _, ready := manager.Current(); ready {
+		t.Fatal("manager became ready without the restored authoritative Lease")
+	}
+	readyCtx, cancel := context.WithTimeout(context.Background(), 20*time.Millisecond)
+	defer cancel()
+	if _, err := manager.CurrentFence(readyCtx); err == nil {
+		t.Fatal("CurrentFence succeeded without the restored authoritative Lease")
+	}
+
+	var leases coordinationv1.LeaseList
+	if err := kubeClient.List(ctx, &leases, client.InNamespace(controllerEpochManagerTestNamespace)); err != nil {
+		t.Fatalf("list controller epoch Leases after rejected startup: %v", err)
+	}
+	if len(leases.Items) != 0 {
+		t.Fatalf("manager recreated %d Lease(s) after incomplete restore", len(leases.Items))
+	}
+	var preserved corev1alpha1.ControllerEpoch
+	if err := kubeClient.Get(ctx, client.ObjectKeyFromObject(object), &preserved); err != nil {
+		t.Fatalf("get preserved controller epoch status: %v", err)
+	}
+	if preserved.Status.Epoch != 7 || preserved.Status.Version != 7 || preserved.Status.HolderID != restored.HolderID {
+		t.Fatalf("manager changed restored status after rejected startup: %#v", preserved.Status)
+	}
+}
+
+func TestControllerEpochManagerAdvancesRestoredAuthorityAndMirrorExactlyOnce(t *testing.T) {
+	ctx := context.Background()
+	authority, kubeClient := newKubernetesControllerEpochAuthority(t)
+	restored := advanceKubernetesControllerEpoch(t, ctx, authority, 7)
+	if restored.Epoch != 7 || restored.Version != 7 {
+		t.Fatalf("restored authority = %#v", restored)
+	}
+
+	mirrorDB, err := sqlite.NewDB(filepath.Join(t.TempDir(), "restored-mirror.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = mirrorDB.Close() })
+	mirror := sqlite.NewStore(mirrorDB, "restored-mirror")
+	manager := NewControllerEpochManager(authority, "controller-after-restore").WithMirror(mirror)
+	managerCtx, cancel := context.WithCancel(context.Background())
+	done := make(chan error, 1)
+	go func() { done <- manager.Start(managerCtx) }()
+
+	fence, err := fenceWithTimeout(manager)
+	if err != nil {
+		cancel()
+		t.Fatal(err)
+	}
+	if fence.Epoch != 8 || fence.HolderID != "controller-after-restore" {
+		cancel()
+		t.Fatalf("restored startup fence = %#v, want exact epoch 8", fence)
+	}
+	authoritative, err := authority.GetControllerEpoch(ctx, fence.Name)
+	if err != nil {
+		cancel()
+		t.Fatalf("read advanced Kubernetes authority: %v", err)
+	}
+	mirrored, err := mirror.GetControllerEpoch(ctx, fence.Name)
+	if err != nil {
+		cancel()
+		t.Fatalf("read synchronized durable mirror: %v", err)
+	}
+	if authoritative.Epoch != 8 || authoritative.Version != 8 || mirrored.Epoch != 8 || mirrored.Version != 8 ||
+		authoritative.HolderID != fence.HolderID || mirrored.HolderID != fence.HolderID ||
+		authoritative.RequestDigest != mirrored.RequestDigest {
+		cancel()
+		t.Fatalf("advanced authority/mirror mismatch: authority=%#v mirror=%#v fence=%#v", authoritative, mirrored, fence)
+	}
+	object, _ := kubernetesControllerEpochObjects(t, ctx, kubeClient)
+	if object.Status.Epoch != 8 || object.Status.Version != 8 || object.Status.HolderID != fence.HolderID ||
+		object.Status.RequestDigest != authoritative.RequestDigest {
+		cancel()
+		t.Fatalf("advanced controller epoch status = %#v", object.Status)
+	}
+
+	cancel()
+	if err := <-done; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestControllerEpochManagerFailsClosedOnCorruptRestoredAuthority(t *testing.T) {
+	tests := []struct {
+		name   string
+		mutate func(*testing.T, context.Context, client.Client, *corev1alpha1.ControllerEpoch, *coordinationv1.Lease)
+	}{
+		{
+			name: "blank ControllerEpoch status",
+			mutate: func(t *testing.T, ctx context.Context, kubeClient client.Client, object *corev1alpha1.ControllerEpoch, _ *coordinationv1.Lease) {
+				t.Helper()
+				object.Status = corev1alpha1.ControllerEpochStatus{}
+				if err := kubeClient.Status().Update(ctx, object); err != nil {
+					t.Fatalf("blank restored ControllerEpoch status: %v", err)
+				}
+			},
+		},
+		{
+			name: "stale ControllerEpoch status",
+			mutate: func(t *testing.T, ctx context.Context, kubeClient client.Client, object *corev1alpha1.ControllerEpoch, lease *coordinationv1.Lease) {
+				t.Helper()
+				staleAt := metav1.NewTime(time.Date(2026, time.August, 10, 10, 0, 0, 0, time.UTC).Add(6 * time.Minute))
+				staleHolder := "restored-controller-6"
+				object.Status = corev1alpha1.ControllerEpochStatus{
+					Epoch: 6, Version: 6, HolderID: staleHolder,
+					RequestDigest: controllerEpochDigest(store.DefaultControllerEpochName, staleHolder, 5, 5, 6),
+					AcquiredAt:    &staleAt, UpdatedAt: &staleAt,
+					LeaseName: lease.Name, LeaseResourceVersion: lease.ResourceVersion,
+				}
+				if err := kubeClient.Status().Update(ctx, object); err != nil {
+					t.Fatalf("restore stale ControllerEpoch status: %v", err)
+				}
+			},
+		},
+		{
+			name: "missing Lease holder",
+			mutate: func(t *testing.T, ctx context.Context, kubeClient client.Client, _ *corev1alpha1.ControllerEpoch, lease *coordinationv1.Lease) {
+				t.Helper()
+				lease.Spec.HolderIdentity = nil
+				if err := kubeClient.Update(ctx, lease); err != nil {
+					t.Fatalf("clear restored Lease holder: %v", err)
+				}
+			},
+		},
+		{
+			name: "invalid Lease digest",
+			mutate: func(t *testing.T, ctx context.Context, kubeClient client.Client, _ *corev1alpha1.ControllerEpoch, lease *coordinationv1.Lease) {
+				t.Helper()
+				lease.Annotations["core.orka.ai/request-digest"] = "sha256:invalid"
+				if err := kubeClient.Update(ctx, lease); err != nil {
+					t.Fatalf("corrupt restored Lease digest: %v", err)
+				}
+			},
+		},
+		{
+			name: "missing Lease epoch annotation",
+			mutate: func(t *testing.T, ctx context.Context, kubeClient client.Client, _ *corev1alpha1.ControllerEpoch, lease *coordinationv1.Lease) {
+				t.Helper()
+				delete(lease.Annotations, "core.orka.ai/controller-epoch")
+				if err := kubeClient.Update(ctx, lease); err != nil {
+					t.Fatalf("remove restored Lease epoch annotation: %v", err)
+				}
+			},
+		},
+		{
+			name: "status holder mismatch",
+			mutate: func(t *testing.T, ctx context.Context, kubeClient client.Client, object *corev1alpha1.ControllerEpoch, _ *coordinationv1.Lease) {
+				t.Helper()
+				object.Status.HolderID = "mismatched-restored-holder"
+				if err := kubeClient.Status().Update(ctx, object); err != nil {
+					t.Fatalf("mismatch restored status holder: %v", err)
+				}
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			ctx := context.Background()
+			authority, kubeClient := newKubernetesControllerEpochAuthority(t)
+			advanceKubernetesControllerEpoch(t, ctx, authority, 7)
+			object, lease := kubernetesControllerEpochObjects(t, ctx, kubeClient)
+			test.mutate(t, ctx, kubeClient, object, lease)
+
+			manager := NewControllerEpochManager(authority, "controller-after-corrupt-restore")
+			done := make(chan error, 1)
+			go func() { done <- manager.Start(ctx) }()
+			select {
+			case err := <-done:
+				if err == nil {
+					t.Fatal("manager accepted corrupt restored epoch authority")
+				}
+			case <-time.After(2 * time.Second):
+				t.Fatal("manager did not fail closed for corrupt restored epoch authority")
+			}
+			if _, ready := manager.Current(); ready {
+				t.Fatal("manager became ready with corrupt restored epoch authority")
+			}
+		})
+	}
+}
+
+func TestControllerEpochManagerRequiresHolderAndStore(t *testing.T) {
+	manager := NewControllerEpochManager(nil, "holder")
+	if err := manager.Start(context.Background()); err == nil {
+		t.Fatal("missing store unexpectedly accepted")
+	}
+	manager = NewControllerEpochManager(&conflictingEpochStore{}, "")
+	if err := manager.Start(context.Background()); err == nil {
+		t.Fatal("missing holder unexpectedly accepted")
+	}
+}
+
+func TestControllerEpochDigestChangesAcrossTargets(t *testing.T) {
+	first := controllerEpochDigest("epoch", "holder", 1, 1, 2)
+	second := controllerEpochDigest("epoch", "holder", 2, 2, 3)
+	if first == second {
+		t.Fatal("epoch digests unexpectedly equal")
+	}
+	if err := store.ValidateCanonicalDigest("epoch digest", first); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func fenceWithTimeout(manager *ControllerEpochManager) (store.ControllerEpochFence, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	return manager.CurrentFence(ctx)
+}
+
+type conflictingEpochStore struct{}
+
+func (*conflictingEpochStore) GetControllerEpoch(context.Context, string) (*store.ControllerEpoch, error) {
+	return nil, store.ErrNotFound
+}
+func (*conflictingEpochStore) CompareAndSwapControllerEpoch(context.Context, store.ControllerEpochCAS) (*store.ControllerEpoch, error) {
+	return nil, store.ErrConflict
+}
+
+var _ store.ControllerEpochStore = (*conflictingEpochStore)(nil)
+
+type retainedIntentEpochConflict int
+
+const (
+	epochConflictCommitThenReportConflict retainedIntentEpochConflict = iota
+	epochConflictLeavesPredecessor
+	epochConflictCommitsCompetitor
+	epochConflictCommitsSameHolderDifferentIntent
+)
+
+type retainedIntentEpochStore struct {
+	current  *store.ControllerEpoch
+	changes  []store.ControllerEpochCAS
+	conflict retainedIntentEpochConflict
+}
+
+func newRetainedIntentEpochStore(conflict retainedIntentEpochConflict) *retainedIntentEpochStore {
+	acquiredAt := time.Date(2026, time.August, 11, 12, 7, 0, 0, time.UTC)
+	holderID := "controller-before-takeover"
+	return &retainedIntentEpochStore{
+		current: &store.ControllerEpoch{
+			Name: store.DefaultControllerEpochName, Epoch: 7, Version: 7, HolderID: holderID,
+			RequestDigest: controllerEpochDigest(store.DefaultControllerEpochName, holderID, 6, 6, 7),
+			AcquiredAt:    acquiredAt, UpdatedAt: acquiredAt,
+		},
+		conflict: conflict,
+	}
+}
+
+func (s *retainedIntentEpochStore) GetControllerEpoch(context.Context, string) (*store.ControllerEpoch, error) {
+	if s.current == nil {
+		return nil, store.ErrNotFound
+	}
+	copy := *s.current
+	return &copy, nil
+}
+
+func (s *retainedIntentEpochStore) CompareAndSwapControllerEpoch(
+	_ context.Context,
+	change store.ControllerEpochCAS,
+) (*store.ControllerEpoch, error) {
+	s.changes = append(s.changes, change)
+	if len(s.changes) == 1 {
+		switch s.conflict {
+		case epochConflictCommitThenReportConflict:
+			s.current = controllerEpochFromTestCAS(change)
+			return nil, store.ErrConflict
+		case epochConflictLeavesPredecessor:
+			copy := *s.current
+			return &copy, store.ErrConflict
+		case epochConflictCommitsCompetitor:
+			competitor := change
+			competitor.HolderID = "competing-controller"
+			competitor.RequestDigest = controllerEpochDigest(
+				competitor.Name,
+				competitor.HolderID,
+				competitor.ExpectedVersion,
+				competitor.ExpectedEpoch,
+				competitor.NewEpoch,
+			)
+			competitor.UpdatedAt = competitor.UpdatedAt.Add(time.Millisecond)
+			s.current = controllerEpochFromTestCAS(competitor)
+			copy := *s.current
+			return &copy, store.ErrConflict
+		case epochConflictCommitsSameHolderDifferentIntent:
+			corrupt := change
+			corrupt.RequestDigest = controllerEpochDigest(
+				corrupt.Name,
+				corrupt.HolderID,
+				corrupt.ExpectedVersion+1,
+				corrupt.ExpectedEpoch,
+				corrupt.NewEpoch,
+			)
+			s.current = controllerEpochFromTestCAS(corrupt)
+			return nil, store.ErrConflict
+		}
+	}
+	if s.current == nil || s.current.Version != change.ExpectedVersion || s.current.Epoch != change.ExpectedEpoch {
+		return nil, store.ErrConflict
+	}
+	s.current = controllerEpochFromTestCAS(change)
+	copy := *s.current
+	return &copy, nil
+}
+
+func controllerEpochFromTestCAS(change store.ControllerEpochCAS) *store.ControllerEpoch {
+	return &store.ControllerEpoch{
+		Name: change.Name, Epoch: change.NewEpoch, Version: change.ExpectedVersion + 1,
+		HolderID: change.HolderID, RequestDigest: change.RequestDigest,
+		AcquiredAt: change.UpdatedAt, UpdatedAt: change.UpdatedAt,
+	}
+}
+
+type recordingControllerEpochMirror struct {
+	synced []store.ControllerEpoch
+}
+
+func (m *recordingControllerEpochMirror) SyncControllerEpochMirror(_ context.Context, epoch store.ControllerEpoch) error {
+	m.synced = append(m.synced, epoch)
+	return nil
+}
+
+var (
+	_ store.ControllerEpochStore  = (*retainedIntentEpochStore)(nil)
+	_ store.ControllerEpochMirror = (*recordingControllerEpochMirror)(nil)
+)
+
+const (
+	controllerEpochManagerTestNamespace = "orka-system"
+	controllerEpochTestTakeoverHolder   = "controller-takeover"
+)
+
+var controllerEpochTestLeaseUIDSequence atomic.Int64
+
+func withControllerEpochLeaseUIDs(t testing.TB, baseClient client.Client) client.WithWatch {
+	t.Helper()
+	withWatch, ok := baseClient.(client.WithWatch)
+	if !ok {
+		t.Fatal("controller epoch test client does not implement client.WithWatch")
+	}
+	return interceptor.NewClient(withWatch, interceptor.Funcs{
+		Create: func(ctx context.Context, delegate client.WithWatch, object client.Object, options ...client.CreateOption) error {
+			if lease, ok := object.(*coordinationv1.Lease); ok && lease.UID == "" {
+				lease.UID = types.UID(fmt.Sprintf("controller-test-lease-uid-%d", controllerEpochTestLeaseUIDSequence.Add(1)))
+			}
+			return delegate.Create(ctx, object, options...)
+		},
+	})
+}
+
+func newKubernetesControllerEpochAuthority(t *testing.T) (*kubestore.Store, client.Client) {
+	t.Helper()
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatalf("add Orka scheme: %v", err)
+	}
+	if err := coordinationv1.AddToScheme(scheme); err != nil {
+		t.Fatalf("add coordination scheme: %v", err)
+	}
+	baseClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithStatusSubresource(&corev1alpha1.ControllerEpoch{}).
+		Build()
+	kubeClient := withControllerEpochLeaseUIDs(t, baseClient)
+	authority, err := kubestore.New(kubeClient, controllerEpochManagerTestNamespace)
+	if err != nil {
+		t.Fatalf("create Kubernetes controller epoch store: %v", err)
+	}
+	return authority, kubeClient
+}
+
+func advanceKubernetesControllerEpoch(
+	t *testing.T,
+	ctx context.Context,
+	authority store.ControllerEpochStore,
+	target int64,
+) *store.ControllerEpoch {
+	t.Helper()
+	var current *store.ControllerEpoch
+	for next := int64(1); next <= target; next++ {
+		expectedVersion, expectedEpoch := int64(0), int64(0)
+		if current != nil {
+			expectedVersion, expectedEpoch = current.Version, current.Epoch
+		}
+		holder := fmt.Sprintf("restored-controller-%d", next)
+		var err error
+		current, err = authority.CompareAndSwapControllerEpoch(ctx, store.ControllerEpochCAS{
+			Name: store.DefaultControllerEpochName, ExpectedVersion: expectedVersion, ExpectedEpoch: expectedEpoch, NewEpoch: next,
+			HolderID: holder, RequestDigest: controllerEpochDigest(store.DefaultControllerEpochName, holder, expectedVersion, expectedEpoch, next),
+			UpdatedAt: time.Date(2026, time.August, 10, 10, 0, 0, 0, time.UTC).Add(time.Duration(next) * time.Minute),
+		})
+		if err != nil {
+			t.Fatalf("advance Kubernetes controller epoch to %d: %v", next, err)
+		}
+	}
+	return current
+}
+
+func kubernetesControllerEpochObjects(
+	t *testing.T,
+	ctx context.Context,
+	kubeClient client.Client,
+) (*corev1alpha1.ControllerEpoch, *coordinationv1.Lease) {
+	t.Helper()
+	var objects corev1alpha1.ControllerEpochList
+	if err := kubeClient.List(ctx, &objects, client.InNamespace(controllerEpochManagerTestNamespace)); err != nil {
+		t.Fatalf("list controller epoch objects: %v", err)
+	}
+	if len(objects.Items) != 1 {
+		t.Fatalf("controller epoch object count = %d, want 1", len(objects.Items))
+	}
+	var leases coordinationv1.LeaseList
+	if err := kubeClient.List(ctx, &leases, client.InNamespace(controllerEpochManagerTestNamespace)); err != nil {
+		t.Fatalf("list controller epoch Leases: %v", err)
+	}
+	if len(leases.Items) != 1 {
+		t.Fatalf("controller epoch Lease count = %d, want 1", len(leases.Items))
+	}
+	return objects.Items[0].DeepCopy(), leases.Items[0].DeepCopy()
+}
diff --git a/internal/controller/execution_workspace_config.go b/internal/controller/execution_workspace_config.go
index 2d9c88b7c..374f4caed 100644
--- a/internal/controller/execution_workspace_config.go
+++ b/internal/controller/execution_workspace_config.go
@@ -25,6 +25,8 @@ const (
 
 // ExecutionWorkspaceDefaultProviderFromEnv reads the provider-neutral default
 // workspace backend. Empty preserves the compatibility default.
+const executionWorkspaceUnknownIdentity = "unknown"
+
 func ExecutionWorkspaceDefaultProviderFromEnv(getenv func(string) string) corev1alpha1.WorkspaceProvider {
 	if value := strings.TrimSpace(getenv(EnvExecutionWorkspaceDefaultProvider)); value != "" {
 		return corev1alpha1.WorkspaceProvider(value)
@@ -118,7 +120,7 @@ func deterministicSubstrateSessionActorID(taskNamespace, templateNamespace, temp
 func deterministicSubstrateTaskActorID(taskUID string, attempt int32) string {
 	uid := strings.TrimSpace(taskUID)
 	if uid == "" {
-		uid = "unknown"
+		uid = executionWorkspaceUnknownIdentity
 	}
 	uid = strings.ToLower(uid)
 	sum := sha256.Sum256([]byte(uid))
diff --git a/internal/controller/execution_workspace_controller.go b/internal/controller/execution_workspace_controller.go
index 3287e1eb7..1721795af 100644
--- a/internal/controller/execution_workspace_controller.go
+++ b/internal/controller/execution_workspace_controller.go
@@ -813,7 +813,7 @@ func (r *ExecutionWorkspaceReconciler) projectWorkspaceToOwnerWithTerminalDeleti
 		}
 	}
 	switch owner.Kind {
-	case "Task":
+	case taskResourceKind:
 		return retry.RetryOnConflict(retry.DefaultBackoff, func() error {
 			task := &corev1alpha1.Task{}
 			if err := r.Get(ctx, key, task); err != nil {
@@ -830,7 +830,7 @@ func (r *ExecutionWorkspaceReconciler) projectWorkspaceToOwnerWithTerminalDeleti
 			projection.ClassRef = &corev1alpha1.WorkspaceClassReference{Name: workspace.Spec.ClassBinding.Name}
 			projection.WorkspaceRef = &corev1alpha1.WorkspaceObjectReference{Name: workspace.Name, UID: string(workspace.UID)}
 			projection.State = string(state)
-			projection.AttachedEpoch = attachedEpoch
+			projection.AttachedEpoch = max(projection.AttachedEpoch, workspace.Spec.AttachmentEpoch, attachedEpoch)
 			projection.Conditions = append([]metav1.Condition(nil), conditions...)
 			task.Status.ExecutionWorkspace = projection
 			return r.Status().Patch(ctx, task, client.MergeFrom(before))
diff --git a/internal/controller/fake_workspace_provider_controller.go b/internal/controller/fake_workspace_provider_controller.go
index 816a37b00..5818886a8 100644
--- a/internal/controller/fake_workspace_provider_controller.go
+++ b/internal/controller/fake_workspace_provider_controller.go
@@ -304,7 +304,7 @@ func (r *FakeExecutionWorkspaceReconciler) Reconcile(ctx context.Context, req ct
 				scheme := "http"
 				switch port.Protocol {
 				case "HTTPS":
-					scheme = "https"
+					scheme = urlSchemeHTTPS
 				case "TCP":
 					scheme = "tcp"
 				}
diff --git a/internal/controller/gateway_controller.go b/internal/controller/gateway_controller.go
index 622492b28..2cdf4b8e6 100644
--- a/internal/controller/gateway_controller.go
+++ b/internal/controller/gateway_controller.go
@@ -790,16 +790,10 @@ func setGatewayCondition(conditions *[]metav1.Condition, conditionType string, v
 
 func sanitizeGatewayStatusMessage(message string) string {
 	message = events.RedactExecutionEventText(strings.TrimSpace(message))
-	if len(message) > 1024 {
-		message = message[:1024]
-	}
-	return message
+	return truncateUTF8(strings.ToValidUTF8(message, "�"), 1024)
 }
 
 func sanitizeGatewayCapability(value string) string {
 	value = events.RedactExecutionEventText(strings.TrimSpace(value))
-	if len(value) > protocol.MaxIdentityBytes {
-		value = value[:protocol.MaxIdentityBytes]
-	}
-	return value
+	return truncateUTF8(strings.ToValidUTF8(value, "�"), protocol.MaxIdentityBytes)
 }
diff --git a/internal/controller/harness_broker.go b/internal/controller/harness_broker.go
deleted file mode 100644
index e1373634d..000000000
--- a/internal/controller/harness_broker.go
+++ /dev/null
@@ -1,1339 +0,0 @@
-package controller
-
-import (
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"maps"
-	"net/http"
-	"os"
-	"slices"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-
-	ctrlclient "sigs.k8s.io/controller-runtime/pkg/client"
-
-	"github.com/google/jsonschema-go/jsonschema"
-	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
-	"github.com/orka-agents/orka/internal/approvals"
-	"github.com/orka-agents/orka/internal/events"
-	"github.com/orka-agents/orka/internal/harness"
-	"github.com/orka-agents/orka/internal/labels"
-	"github.com/orka-agents/orka/internal/outboundaccess"
-	"github.com/orka-agents/orka/internal/store"
-	toolspkg "github.com/orka-agents/orka/internal/tools"
-	worker "github.com/orka-agents/orka/internal/worker"
-	"github.com/orka-agents/orka/internal/workerenv"
-	corev1 "k8s.io/api/core/v1"
-)
-
-const (
-	harnessWrapperBrokeredToolTimeout = 30 * time.Second
-	harnessBrokeredToolDelegateTask   = "delegate_task"
-	harnessBrokeredToolWaitForTasks   = "wait_for_tasks"
-	harnessBrokeredToolCancelTask     = "cancel_task"
-	harnessBrokeredToolSendMessage    = "send_message"
-	harnessBrokeredToolCheckMessages  = "check_messages"
-	harnessBrokeredExecutionStarted   = "started"
-)
-
-var (
-	errHarnessBrokeredApprovalPending = errors.New("brokered tool call awaiting approval")
-	harnessBrokeredCoordinationEnvMu  = sync.Mutex{}
-)
-
-type harnessBrokeredApprovalPendingError struct {
-	approvalID string
-	toolName   string
-}
-
-func (e harnessBrokeredApprovalPendingError) Error() string {
-	if strings.TrimSpace(e.approvalID) == "" {
-		return errHarnessBrokeredApprovalPending.Error()
-	}
-	return fmt.Sprintf("brokered tool call awaiting approval %s", e.approvalID)
-}
-
-func (e harnessBrokeredApprovalPendingError) Is(target error) bool {
-	return target == errHarnessBrokeredApprovalPending
-}
-
-func harnessBrokeredPendingApproval(err error) (string, string, bool) {
-	var pending harnessBrokeredApprovalPendingError
-	if errors.As(err, &pending) {
-		return strings.TrimSpace(pending.approvalID), strings.TrimSpace(pending.toolName), true
-	}
-	return "", "", false
-}
-
-func harnessWrapperBrokeredToolNames(task *corev1alpha1.Task) []string {
-	if task != nil && task.Spec.AgentRuntime != nil && len(task.Spec.AgentRuntime.AllowedTools) > 0 {
-		return normalizeToolNames(task.Spec.AgentRuntime.AllowedTools)
-	}
-	return nil
-}
-
-func normalizeToolNames(values []string) []string {
-	seen := map[string]struct{}{}
-	out := make([]string, 0, len(values))
-	for _, value := range values {
-		value = strings.TrimSpace(value)
-		if value == "" {
-			continue
-		}
-		if _, ok := seen[value]; ok {
-			continue
-		}
-		seen[value] = struct{}{}
-		out = append(out, value)
-	}
-	return out
-}
-
-func harnessWrapperToolExecutionMode(task *corev1alpha1.Task, agent *corev1alpha1.Agent) harness.ToolExecutionMode {
-	runtimeRefName := agentHarnessRuntimeRefName(agent)
-	if runtimeRefName == "" && task != nil && task.Status.HarnessRuntime != nil {
-		runtimeRefName = strings.TrimSpace(task.Status.HarnessRuntime.RuntimeRefName)
-	}
-	if runtimeRefName == "" && task != nil && task.Annotations != nil {
-		runtimeRefName = strings.TrimSpace(task.Annotations[harnessWrapperRuntimeRefAnno])
-	}
-	if runtimeRefName != "" && len(harnessWrapperBrokeredToolNames(task)) > 0 {
-		return harness.ToolExecutionModeBrokered
-	}
-	return harness.ToolExecutionModeObserved
-}
-
-func isHarnessBrokeredCoordinationToolName(name string) bool {
-	switch strings.TrimSpace(name) {
-	case harnessBrokeredToolDelegateTask, harnessBrokeredToolWaitForTasks, harnessBrokeredToolCancelTask, harnessBrokeredToolSendMessage, harnessBrokeredToolCheckMessages:
-		return true
-	default:
-		return false
-	}
-}
-
-func (r *TaskReconciler) harnessBrokeredCoordinationTool(name string) toolspkg.Tool {
-	switch strings.TrimSpace(name) {
-	case harnessBrokeredToolDelegateTask:
-		return toolspkg.NewDelegateTaskTool(r.Client)
-	case harnessBrokeredToolWaitForTasks:
-		return toolspkg.NewWaitForTasksTool(r.Client)
-	case harnessBrokeredToolCancelTask:
-		return toolspkg.NewCancelTaskTool(r.Client)
-	case harnessBrokeredToolSendMessage:
-		return toolspkg.NewSendMessageTool()
-	case harnessBrokeredToolCheckMessages:
-		return toolspkg.NewCheckMessagesTool()
-	default:
-		return nil
-	}
-}
-
-func (r *TaskReconciler) executeHarnessBrokeredCoordinationTool(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	agent *corev1alpha1.Agent,
-	frame harness.HarnessEventFrame,
-	tool toolspkg.Tool,
-) (string, error) {
-	// Coordination tools still read some policy from the legacy worker env surface.
-	// Serialize this narrow bridge so concurrent controller reconciles cannot leak
-	// one task 's env into another in-process coordination call.
-	harnessBrokeredCoordinationEnvMu.Lock()
-	defer harnessBrokeredCoordinationEnvMu.Unlock()
-	restore := setHarnessBrokeredCoordinationEnv(task, agent)
-	defer restore()
-	toolCtx := &toolspkg.ToolContext{
-		Client:       r.Client,
-		Namespace:    task.Namespace,
-		Tenant:       task.Namespace,
-		TaskID:       task.Name,
-		TaskUID:      string(task.UID),
-		ParentTaskID: harnessBrokeredParentTaskName(task),
-		ToolCallID:   frame.ToolCallID,
-		ResultStore:  r.ResultStore,
-		MessageStore: r.MessageStore,
-	}
-	return tool.Execute(toolspkg.WithToolContext(ctx, toolCtx), argsOrEmptyObject(frame.Content))
-}
-
-func setHarnessBrokeredCoordinationEnv(task *corev1alpha1.Task, agent *corev1alpha1.Agent) func() {
-	values := map[string]string{
-		workerenv.TaskName:                  task.Name,
-		workerenv.TaskNamespace:             task.Namespace,
-		workerenv.ParentTask:                harnessBrokeredParentTaskName(task),
-		workerenv.CoordinationAllowedAgents: "",
-		workerenv.CoordinationDepth: func() string {
-			if task.Annotations != nil {
-				if depth := strings.TrimSpace(task.Annotations[labels.AnnotationCoordinationDepth]); depth != "" {
-					return depth
-				}
-			}
-			return "0"
-		}(),
-		workerenv.CoordinationMaxDepth: "3",
-	}
-	if agent != nil && agent.Spec.Coordination != nil {
-		if agent.Spec.Coordination.MaxDepth > 0 {
-			values[workerenv.CoordinationMaxDepth] = strconv.Itoa(int(agent.Spec.Coordination.MaxDepth))
-		}
-		if len(agent.Spec.Coordination.AllowedAgents) > 0 {
-			allowed := make([]string, 0, len(agent.Spec.Coordination.AllowedAgents))
-			for _, allowedAgent := range agent.Spec.Coordination.AllowedAgents {
-				if strings.TrimSpace(allowedAgent.Name) != "" {
-					if strings.TrimSpace(allowedAgent.Namespace) != "" {
-						allowed = append(allowed, strings.TrimSpace(allowedAgent.Namespace)+"/"+strings.TrimSpace(allowedAgent.Name))
-					} else {
-						allowed = append(allowed, strings.TrimSpace(allowedAgent.Name))
-					}
-				}
-			}
-			values[workerenv.CoordinationAllowedAgents] = strings.Join(allowed, ",")
-		}
-	}
-	previous := map[string]*string{}
-	for key, value := range values {
-		if current, ok := os.LookupEnv(key); ok {
-			copyValue := current
-			previous[key] = &copyValue
-		} else {
-			previous[key] = nil
-		}
-		_ = os.Setenv(key, value)
-	}
-	return func() {
-		for key, value := range previous {
-			if value == nil {
-				_ = os.Unsetenv(key)
-			} else {
-				_ = os.Setenv(key, *value)
-			}
-		}
-	}
-}
-
-func harnessBrokeredParentTaskName(task *corev1alpha1.Task) string {
-	if task == nil {
-		return ""
-	}
-	if parent := labels.ParentTaskName(task.Labels, task.Annotations); strings.TrimSpace(parent) != "" {
-		return strings.TrimSpace(parent)
-	}
-	return strings.TrimSpace(task.Name)
-}
-
-func argsOrEmptyObject(args json.RawMessage) json.RawMessage {
-	if len(args) == 0 {
-		return json.RawMessage(`{}`)
-	}
-	return args
-}
-
-func (r *TaskReconciler) harnessBrokeredTransactionAuthority(ctx context.Context, task *corev1alpha1.Task) (string, []string, error) {
-	if task == nil || task.Spec.Transaction == nil {
-		return "", nil, nil
-	}
-	scopes := append([]string(nil), task.Spec.Transaction.Scopes...)
-	if len(scopes) == 0 {
-		scopes = strings.Fields(task.Spec.Transaction.Scope)
-	}
-	secretName := ""
-	if task.Annotations != nil {
-		secretName = strings.TrimSpace(task.Annotations[labels.AnnotationTransactionTokenSecret])
-	}
-	if secretName == "" {
-		return "", scopes, nil
-	}
-	reader := ctrlclient.Reader(r.Client)
-	if r.APIReader != nil {
-		reader = r.APIReader
-	}
-	secret := &corev1.Secret{}
-	if err := reader.Get(ctx, ctrlclient.ObjectKey{Namespace: task.Namespace, Name: secretName}, secret); err != nil {
-		return "", nil, fmt.Errorf("read task transaction authority: %w", err)
-	}
-	owned := false
-	for _, owner := range secret.OwnerReferences {
-		if owner.Kind == "Task" && owner.Name == task.Name && owner.UID == task.UID {
-			owned = true
-			break
-		}
-	}
-	if !owned {
-		return "", nil, errors.New("task transaction authority Secret is not owned by the Task")
-	}
-	token := strings.TrimSpace(string(secret.Data["token"]))
-	if token == "" {
-		return "", nil, errors.New("task transaction authority Secret token is empty")
-	}
-	return token, scopes, nil
-}
-
-func (r *TaskReconciler) harnessBrokeredTransactionCredentialAuthority(task *corev1alpha1.Task) (bool, bool, string) {
-	if task == nil || task.Spec.Transaction == nil {
-		return false, false, ""
-	}
-	tx := task.Spec.Transaction
-	requiredScopes := r.TransactionCredentialReadScopes
-	if len(requiredScopes) == 0 {
-		requiredScopes = []string{outboundaccess.DefaultCredentialReadScope}
-	}
-	allowed := false
-	for _, scope := range requiredScopes {
-		if toolspkg.TransactionHasScope(tx, scope) {
-			allowed = true
-			break
-		}
-	}
-	constraint := ""
-	if tx.Context != nil {
-		constraint = strings.TrimSpace(tx.Context["secret"])
-	}
-	return r.EnforceTransactionCredentialAuth, allowed, constraint
-}
-
-//nolint:gocyclo // Brokered tool handling is a compact policy/approval/idempotency state machine.
-func (r *TaskReconciler) handleHarnessBrokeredToolCall(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	agent *corev1alpha1.Agent,
-	frame harness.HarnessEventFrame,
-) (harness.ToolCallResult, error) {
-	toolName := strings.TrimSpace(frame.ToolName)
-	toolCallID := strings.TrimSpace(frame.ToolCallID)
-	frame.ToolName = toolName
-	frame.ToolCallID = toolCallID
-	idempotencyKey := harness.ToolRequestIdempotencyKey(frame.RuntimeSessionID, frame.TurnID, toolCallID)
-	result := harness.ToolCallResult{
-		Version:          harness.ProtocolVersion,
-		RuntimeSessionID: frame.RuntimeSessionID,
-		TurnID:           frame.TurnID,
-		ToolCallID:       toolCallID,
-		IdempotencyKey:   idempotencyKey,
-		Approved:         true,
-	}
-	if toolName == "" || result.ToolCallID == "" {
-		err := fmt.Errorf("brokered tool name and toolCallID are required")
-		result.Error = brokeredToolError("invalid_tool_call", err)
-		return result, r.recordHarnessBrokeredToolEvent(ctx, task, frame, events.ExecutionEventTypeToolCallFailed, err.Error(), brokeredToolEventContent(result, nil))
-	}
-	args := frame.Content
-	if len(args) == 0 {
-		args = json.RawMessage(`{}`)
-	}
-	argsDigest, err := approvals.TargetArgsDigest(args)
-	if err != nil {
-		result.Error = brokeredToolError("invalid_tool_arguments", err)
-		return result, r.recordHarnessBrokeredToolEvent(ctx, task, frame, events.ExecutionEventTypeToolCallFailed, err.Error(), brokeredToolEventContent(result, map[string]any{"targetArgsDigestError": true}))
-	}
-	if previous, ok, err := r.previousHarnessBrokeredToolResult(ctx, task, frame, idempotencyKey, argsDigest); err != nil {
-		return result, err
-	} else if ok {
-		return previous, nil
-	}
-	plannedClasses, err := harnessWrapperPlannedBrokeredToolClassMap(task)
-	if err != nil {
-		result.Error = brokeredToolError("invalid_brokered_plan", err)
-		return result, r.recordHarnessBrokeredToolEvent(ctx, task, frame, events.ExecutionEventTypeToolCallFailed, err.Error(), brokeredToolEventContent(result, nil))
-	}
-	frozenClass, allowed := plannedClasses[toolName]
-	if !allowed && len(plannedClasses) == 0 {
-		if slices.Contains(harnessWrapperBrokeredToolNames(task), toolName) {
-			allowed = true
-		}
-	}
-	if !allowed {
-		err := fmt.Errorf("brokered tool %q is not allowed for this task", toolName)
-		result.Error = brokeredToolError("tool_not_allowed", err)
-		return result, r.recordHarnessBrokeredToolEvent(ctx, task, frame, events.ExecutionEventTypeToolCallFailed, err.Error(), brokeredToolEventContent(result, nil))
-	}
-	if tool := r.harnessBrokeredCoordinationTool(toolName); tool != nil {
-		if frozenClass != "" && frozenClass != corev1alpha1.AgentRuntimeBrokeredToolClassCoordination {
-			err := fmt.Errorf("brokered tool %q class changed from %q to %q", toolName, frozenClass, corev1alpha1.AgentRuntimeBrokeredToolClassCoordination)
-			result.Error = brokeredToolError("tool_class_changed", err)
-			return result, r.recordHarnessBrokeredToolEvent(ctx, task, frame, events.ExecutionEventTypeToolCallFailed, err.Error(), brokeredToolEventContent(result, nil))
-		}
-		if started, err := r.hasUnresolvedHarnessBrokeredToolExecution(ctx, task, frame, idempotencyKey, argsDigest); err != nil {
-			return result, err
-		} else if started {
-			err := fmt.Errorf("brokered coordination tool %q has an unresolved prior execution ledger entry", toolName)
-			result.Error = brokeredToolError("tool_execution_outcome_unknown", err)
-			content := brokeredToolEventContent(result, map[string]any{
-				"targetArgsDigest": argsDigest,
-				"outcomeUnknown":   true,
-			})
-			return result, r.recordHarnessBrokeredToolEvent(ctx, task, frame, events.ExecutionEventTypeToolCallFailed, err.Error(), content)
-		}
-		startedContent := brokeredToolEventContent(result, map[string]any{
-			"targetArgsDigest": argsDigest,
-			"brokeredClass":    string(corev1alpha1.AgentRuntimeBrokeredToolClassCoordination),
-			"executionState":   harnessBrokeredExecutionStarted,
-		})
-		if err := r.recordHarnessBrokeredToolEvent(ctx, task, frame, events.ExecutionEventTypeToolCallStarted, "brokered coordination tool execution started", startedContent); err != nil {
-			return result, err
-		}
-		execCtx, cancel := context.WithTimeout(ctx, harnessWrapperBrokeredToolTimeout)
-		defer cancel()
-		output, err := r.executeHarnessBrokeredCoordinationTool(execCtx, task, agent, frame, tool)
-		if err != nil {
-			result.Error = brokeredToolError("coordination_tool_failed", err)
-			content := brokeredToolEventContent(result, map[string]any{"targetArgsDigest": argsDigest})
-			return result, r.recordHarnessBrokeredToolEvent(ctx, task, frame, events.ExecutionEventTypeToolCallFailed, err.Error(), content)
-		}
-		result.Output = brokeredToolOutput(output)
-		resultRef, err := r.saveHarnessBrokeredToolResult(ctx, task, idempotencyKey, result.Output)
-		if err != nil {
-			result.Error = brokeredToolError("tool_result_store_failed", err)
-			result.Output = nil
-			content := brokeredToolEventContent(result, map[string]any{"targetArgsDigest": argsDigest})
-			return result, r.recordHarnessBrokeredToolEvent(ctx, task, frame, events.ExecutionEventTypeToolCallFailed, err.Error(), content)
-		}
-		content := brokeredToolEventContent(result, map[string]any{
-			"toolResultRef":    resultRef,
-			"targetArgsDigest": argsDigest,
-			"resultLength":     len(output),
-			"brokeredClass":    string(corev1alpha1.AgentRuntimeBrokeredToolClassCoordination),
-		})
-		return result, r.recordHarnessBrokeredToolEvent(ctx, task, frame, events.ExecutionEventTypeToolCallCompleted, "brokered coordination tool call completed", content)
-	}
-	tool := &corev1alpha1.Tool{}
-	if err := r.Get(ctx, ctrlclient.ObjectKey{Namespace: task.Namespace, Name: toolName}, tool); err != nil {
-		err = fmt.Errorf("read brokered tool %q: %w", toolName, err)
-		result.Error = brokeredToolError("tool_not_found", err)
-		return result, r.recordHarnessBrokeredToolEvent(ctx, task, frame, events.ExecutionEventTypeToolCallFailed, err.Error(), brokeredToolEventContent(result, nil))
-	}
-	if frozenClass != "" && tool.Spec.BrokeredToolClass != frozenClass {
-		err := fmt.Errorf("brokered tool %q class changed from %q to %q", toolName, frozenClass, tool.Spec.BrokeredToolClass)
-		result.Error = brokeredToolError("tool_class_changed", err)
-		return result, r.recordHarnessBrokeredToolEvent(ctx, task, frame, events.ExecutionEventTypeToolCallFailed, err.Error(), brokeredToolEventContent(result, nil))
-	}
-	execIdempotencyKey := idempotencyKey
-	approvalID := ""
-	if err := validateBrokeredToolArguments(tool, args); err != nil {
-		result.Error = brokeredToolError("invalid_tool_arguments", err)
-		content := brokeredToolEventContent(result, map[string]any{"targetArgsDigest": argsDigest})
-		return result, r.recordHarnessBrokeredToolEvent(ctx, task, frame, events.ExecutionEventTypeToolCallFailed, err.Error(), content)
-	}
-	transactionToken, transactionScopes, err := r.harnessBrokeredTransactionAuthority(ctx, task)
-	if err != nil {
-		result.Error = brokeredToolError("transaction_authority_unavailable", err)
-		return result, r.recordHarnessBrokeredToolEvent(
-			ctx, task, frame, events.ExecutionEventTypeToolCallFailed, err.Error(), brokeredToolEventContent(result, nil),
-		)
-	}
-	credentialAuthorityEnforced, credentialScopeAllowed, credentialSecret :=
-		r.harnessBrokeredTransactionCredentialAuthority(task)
-	if tool.Spec.HTTP != nil && tool.Spec.HTTP.AuthSecretRef != nil {
-		if err := outboundaccess.ValidateCredentialAuthority(
-			credentialAuthorityEnforced,
-			credentialScopeAllowed,
-			credentialSecret,
-			[]string{tool.Spec.HTTP.AuthSecretRef.Name},
-			false,
-		); err != nil {
-			result.Error = brokeredToolError("credential_authority_unavailable", err)
-			return result, r.recordHarnessBrokeredToolEvent(
-				ctx,
-				task,
-				frame,
-				events.ExecutionEventTypeToolCallFailed,
-				err.Error(),
-				brokeredToolEventContent(result, nil),
-			)
-		}
-	}
-	transactionIdentity, err := r.harnessBrokeredTransactionAuthorityIdentityFromSnapshot(
-		ctx, task, transactionToken, transactionScopes,
-	)
-	if err != nil {
-		result.Error = brokeredToolError("transaction_authority_unavailable", err)
-		return result, r.recordHarnessBrokeredToolEvent(
-			ctx, task, frame, events.ExecutionEventTypeToolCallFailed, err.Error(), brokeredToolEventContent(result, nil),
-		)
-	}
-	authSecretValue, authSecretIdentity, err := r.harnessBrokeredAuthSecretSnapshot(ctx, tool)
-	if err != nil {
-		result.Error = brokeredToolError("credential_authority_unavailable", err)
-		return result, r.recordHarnessBrokeredToolEvent(
-			ctx, task, frame, events.ExecutionEventTypeToolCallFailed, err.Error(), brokeredToolEventContent(result, nil),
-		)
-	}
-	switch tool.Spec.BrokeredToolClass {
-	case corev1alpha1.AgentRuntimeBrokeredToolClassRead:
-		// Read-only brokered tools execute immediately below.
-	case corev1alpha1.AgentRuntimeBrokeredToolClassWrite:
-		approved, decisionApprovalID, err := r.ensureHarnessBrokeredWriteApproval(ctx, task, frame, tool, args, transactionIdentity, authSecretIdentity)
-		if err != nil {
-			if errors.Is(err, errHarnessBrokeredApprovalPending) {
-				return result, err
-			}
-			result.Error = brokeredToolError("approval_failed", err)
-			return result, r.recordHarnessBrokeredToolEvent(ctx, task, frame, events.ExecutionEventTypeToolCallFailed, err.Error(), brokeredToolEventContent(result, nil))
-		}
-		if !approved {
-			result.Approved = false
-			result.Error = &harness.ErrorInfo{Code: "approval_declined", Message: "approval declined"}
-			content := brokeredToolEventContent(result, map[string]any{"approvalID": decisionApprovalID, "targetArgsDigest": argsDigest, "approved": false})
-			return result, r.recordHarnessBrokeredToolEvent(ctx, task, frame, events.ExecutionEventTypeToolCallFailed, "approval declined", content)
-		}
-		execIdempotencyKey = decisionApprovalID
-		approvalID = decisionApprovalID
-	default:
-		err := fmt.Errorf("brokered tool %q is not classified as read or write", toolName)
-		result.Error = brokeredToolError("tool_class_not_allowed", err)
-		return result, r.recordHarnessBrokeredToolEvent(ctx, task, frame, events.ExecutionEventTypeToolCallFailed, err.Error(), brokeredToolEventContent(result, nil))
-	}
-	if tool.Spec.BrokeredToolClass == corev1alpha1.AgentRuntimeBrokeredToolClassWrite {
-		if started, err := r.hasUnresolvedHarnessBrokeredToolExecution(ctx, task, frame, idempotencyKey, argsDigest); err != nil {
-			return result, err
-		} else if started {
-			err := fmt.Errorf("brokered write tool %q has an unresolved prior execution ledger entry", toolName)
-			result.Error = brokeredToolError("tool_execution_outcome_unknown", err)
-			content := brokeredToolEventContent(result, map[string]any{
-				"targetArgsDigest":        argsDigest,
-				"approvalID":              approvalID,
-				"executionIdempotencyKey": execIdempotencyKey,
-				"outcomeUnknown":          true,
-			})
-			return result, r.recordHarnessBrokeredToolEvent(ctx, task, frame, events.ExecutionEventTypeToolCallFailed, err.Error(), content)
-		}
-		content := brokeredToolEventContent(result, map[string]any{
-			"targetArgsDigest":        argsDigest,
-			"approvalID":              approvalID,
-			"executionIdempotencyKey": execIdempotencyKey,
-			"brokeredClass":           string(tool.Spec.BrokeredToolClass),
-			"executionState":          harnessBrokeredExecutionStarted,
-		})
-		if err := r.recordHarnessBrokeredToolEvent(ctx, task, frame, events.ExecutionEventTypeToolCallStarted, "brokered write tool execution started", content); err != nil {
-			return result, err
-		}
-	}
-	execCtx, cancel := context.WithTimeout(ctx, harnessWrapperBrokeredToolTimeout)
-	defer cancel()
-	execCtx = worker.WithToolCallID(execCtx, frame.ToolCallID)
-	execCtx = worker.WithToolIdempotencyKey(execCtx, execIdempotencyKey)
-	executor := worker.NewToolExecutorForNamespace(task.Namespace, r.KubeClient, nil, r.OutboundAccessResolver)
-	executor.SetTransactionAuthority(transactionToken, transactionScopes)
-	executor.SetTransactionCredentialAuthority(credentialAuthorityEnforced, credentialScopeAllowed, credentialSecret)
-	executor.SetTransactionExchangeConfig(r.BrokeredTransactionExchange)
-	if tool.Spec.HTTP != nil && tool.Spec.HTTP.AuthSecretRef != nil {
-		executor.SetAuthSecretValue(tool.Spec.HTTP.AuthSecretRef.Name, tool.Spec.HTTP.AuthSecretRef.Key, authSecretValue)
-	}
-	output, err := executor.Execute(execCtx, tool, args)
-	if err != nil {
-		result.Error = brokeredToolError("tool_execution_failed", err)
-		content := brokeredToolEventContent(result, map[string]any{
-			"targetArgsDigest":        argsDigest,
-			"approvalID":              approvalID,
-			"executionIdempotencyKey": execIdempotencyKey,
-			"toolRequestAttempted":    worker.ToolRequestWasAttempted(err),
-		})
-		return result, r.recordHarnessBrokeredToolEvent(ctx, task, frame, events.ExecutionEventTypeToolCallFailed, err.Error(), content)
-	}
-	result.Output = brokeredToolOutput(output)
-	resultRef, err := r.saveHarnessBrokeredToolResult(ctx, task, idempotencyKey, result.Output)
-	if err != nil {
-		result.Error = brokeredToolError("tool_result_store_failed", err)
-		result.Output = nil
-		content := brokeredToolEventContent(result, map[string]any{
-			"targetArgsDigest":        argsDigest,
-			"approvalID":              approvalID,
-			"executionIdempotencyKey": execIdempotencyKey,
-		})
-		return result, r.recordHarnessBrokeredToolEvent(ctx, task, frame, events.ExecutionEventTypeToolCallFailed, err.Error(), content)
-	}
-	content := brokeredToolEventContent(result, map[string]any{
-		"toolResultRef":           resultRef,
-		"targetArgsDigest":        argsDigest,
-		"executionIdempotencyKey": execIdempotencyKey,
-		"resultLength":            len(output),
-		"brokeredClass":           string(tool.Spec.BrokeredToolClass),
-		"approvalID":              approvalID,
-	})
-	return result, r.recordHarnessBrokeredToolEvent(ctx, task, frame, events.ExecutionEventTypeToolCallCompleted, "brokered tool call completed", content)
-}
-
-func (r *TaskReconciler) ensureHarnessBrokeredWriteApproval(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	frame harness.HarnessEventFrame,
-	tool *corev1alpha1.Tool,
-	args json.RawMessage,
-	transactionIdentity map[string]any,
-	authSecretIdentity map[string]string,
-) (bool, string, error) {
-	target, err := r.harnessBrokeredApprovalTarget(
-		ctx, task, frame, tool, args, transactionIdentity, authSecretIdentity,
-	)
-	if err != nil {
-		return false, "", err
-	}
-	approval, found, err := r.harnessBrokeredApprovalState(ctx, task, target.ApprovalID)
-	if err != nil {
-		return false, target.ApprovalID, err
-	}
-	if !found {
-		if err := r.recordHarnessBrokeredApprovalRequested(ctx, task, frame, target); err != nil {
-			return false, target.ApprovalID, err
-		}
-		return false, target.ApprovalID, harnessBrokeredApprovalPendingError{approvalID: target.ApprovalID, toolName: tool.Name}
-	}
-	if approval.TargetArgsDigest != target.TargetArgsDigest || approval.TargetSpecDigest != target.TargetSpecDigest {
-		return false, target.ApprovalID, fmt.Errorf("approval target changed for %s", target.TargetTool)
-	}
-	switch approval.Status {
-	case approvals.StatusApproved:
-		return true, target.ApprovalID, nil
-	case approvals.StatusDeclined, approvals.StatusExpired, approvals.StatusCancelled:
-		return false, target.ApprovalID, nil
-	default:
-		return false, target.ApprovalID, harnessBrokeredApprovalPendingError{approvalID: target.ApprovalID, toolName: tool.Name}
-	}
-}
-
-func (r *TaskReconciler) harnessBrokeredApprovalTarget(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	frame harness.HarnessEventFrame,
-	tool *corev1alpha1.Tool,
-	args json.RawMessage,
-	transactionIdentity map[string]any,
-	authSecretIdentity map[string]string,
-) (approvals.ApprovalTarget, error) {
-	outboundPolicyIdentity, err := r.harnessBrokeredOutboundPolicyIdentity(ctx, tool)
-	if err != nil {
-		return approvals.ApprovalTarget{}, err
-	}
-	specDigest, err := approvals.TargetSpecDigest(map[string]any{
-		"toolResourceVersion":  tool.ResourceVersion,
-		"toolName":             tool.Name,
-		"brokeredToolClass":    string(tool.Spec.BrokeredToolClass),
-		"runtimeSessionID":     string(frame.RuntimeSessionID),
-		"turnID":               string(frame.TurnID),
-		"toolCallID":           frame.ToolCallID,
-		"transactionAuthority": transactionIdentity,
-		"authSecret":           authSecretIdentity,
-		"outboundPolicy":       outboundPolicyIdentity,
-	})
-	if err != nil {
-		return approvals.ApprovalTarget{}, err
-	}
-	return approvals.NewApprovalTarget(
-		task.Namespace,
-		task.Name,
-		string(task.UID),
-		tool.Name,
-		args,
-		fmt.Sprintf("Execute brokered write tool %s", tool.Name),
-		"Remote runtime requested a consequential brokered tool call; Orka must approve exact arguments before execution.",
-		"warning",
-		specDigest,
-	)
-}
-
-func (r *TaskReconciler) brokeredApprovalReader() ctrlclient.Reader {
-	if r.APIReader != nil {
-		return r.APIReader
-	}
-	return r.Client
-}
-
-func (r *TaskReconciler) harnessBrokeredTransactionAuthorityIdentity(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-) (map[string]any, error) {
-	token, scopes, err := r.harnessBrokeredTransactionAuthority(ctx, task)
-	if err != nil {
-		return nil, err
-	}
-	return r.harnessBrokeredTransactionAuthorityIdentityFromSnapshot(ctx, task, token, scopes)
-}
-
-func (r *TaskReconciler) harnessBrokeredTransactionAuthorityIdentityFromSnapshot(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	token string,
-	scopes []string,
-) (map[string]any, error) {
-	if task == nil || task.Spec.Transaction == nil {
-		return nil, nil
-	}
-	identity := map[string]any{
-		"transactionID":          task.Spec.Transaction.ID,
-		"scope":                  task.Spec.Transaction.Scope,
-		"scopes":                 scopes,
-		"contextDigest":          task.Spec.Transaction.ContextDigest,
-		"requesterContextDigest": task.Spec.Transaction.RequesterContextDigest,
-	}
-	if token != "" {
-		sum := sha256.Sum256([]byte(token))
-		identity["tokenDigest"] = hex.EncodeToString(sum[:])
-	}
-	if task.Annotations != nil {
-		if secretName := strings.TrimSpace(task.Annotations[labels.AnnotationTransactionTokenSecret]); secretName != "" {
-			secret := &corev1.Secret{}
-			if err := r.brokeredApprovalReader().Get(
-				ctx,
-				ctrlclient.ObjectKey{Namespace: task.Namespace, Name: secretName},
-				secret,
-			); err != nil {
-				return nil, fmt.Errorf("resolve task transaction authority approval identity: %w", err)
-			}
-			identity["secretUID"] = string(secret.UID)
-			identity["secretResourceVersion"] = secret.ResourceVersion
-		}
-	}
-	if config := r.BrokeredTransactionExchange; config != nil {
-		endpointDigest := ""
-		if config.TTS.Endpoint != "" {
-			sum := sha256.Sum256([]byte(config.TTS.Endpoint))
-			endpointDigest = hex.EncodeToString(sum[:])
-		}
-		identity["exchange"] = map[string]any{
-			"endpointDigest": endpointDigest,
-			"audience":       config.TTS.Audience,
-			"timeout":        config.TTS.Timeout.String(),
-			"tokenSource":    config.TTS.TokenSource,
-			"toolTokenTTL":   config.TTS.ToolTokenTTL.String(),
-			"subjectType":    config.SubjectTokenType,
-			"outboundScope":  config.OutboundScope,
-		}
-	}
-	return identity, nil
-}
-
-func (r *TaskReconciler) harnessBrokeredAuthSecretSnapshot(
-	ctx context.Context,
-	tool *corev1alpha1.Tool,
-) (string, map[string]string, error) {
-	if tool == nil || tool.Spec.HTTP == nil || tool.Spec.HTTP.AuthSecretRef == nil {
-		return "", nil, nil
-	}
-	secret := &corev1.Secret{}
-	ref := tool.Spec.HTTP.AuthSecretRef
-	key := ctrlclient.ObjectKey{Namespace: tool.Namespace, Name: ref.Name}
-	if err := r.brokeredApprovalReader().Get(ctx, key, secret); err != nil {
-		return "", nil, fmt.Errorf("resolve Tool auth Secret approval identity: %w", err)
-	}
-	value := strings.TrimSpace(string(secret.Data[ref.Key]))
-	if value == "" {
-		return "", nil, errors.New("tool auth Secret key is missing or empty")
-	}
-	return value, map[string]string{
-		"uid":             string(secret.UID),
-		"resourceVersion": secret.ResourceVersion,
-	}, nil
-}
-
-func (r *TaskReconciler) harnessBrokeredOutboundPolicyIdentity(ctx context.Context, tool *corev1alpha1.Tool) (map[string]any, error) {
-	if tool == nil || tool.Spec.HTTP == nil || tool.Spec.HTTP.OutboundAccessPolicyRef == nil {
-		return nil, nil
-	}
-	policy := &corev1alpha1.OutboundAccessPolicy{}
-	key := ctrlclient.ObjectKey{Namespace: tool.Namespace, Name: tool.Spec.HTTP.OutboundAccessPolicyRef.Name}
-	if err := r.brokeredApprovalReader().Get(ctx, key, policy); err != nil {
-		return nil, fmt.Errorf("resolve outbound access policy approval identity: %w", err)
-	}
-	secretRefs := []*corev1alpha1.NamespacedSecretKeySelector{}
-	appendTLS := func(config *corev1alpha1.OutboundTLSConfig) {
-		if config != nil && config.CASecretRef != nil {
-			secretRefs = append(secretRefs, config.CASecretRef)
-		}
-	}
-	if direct := policy.Spec.Direct; direct != nil {
-		secretRefs = append(secretRefs, direct.Subject.SecretRef)
-		if direct.Actor != nil {
-			secretRefs = append(secretRefs, direct.Actor.SecretRef)
-		}
-		if auth := direct.ClientAuthentication; auth != nil {
-			secretRefs = append(secretRefs, auth.ClientSecretRef, auth.PrivateKeyRef)
-		}
-		appendTLS(direct.TokenEndpoint.TLS)
-	}
-	if gateway := policy.Spec.Gateway; gateway != nil {
-		appendTLS(gateway.TLS)
-	}
-	serviceAccountNames := []string{}
-	if direct := policy.Spec.Direct; direct != nil {
-		appendSource := func(source *corev1alpha1.OutboundTokenSource) {
-			if source == nil || source.ServiceAccountRef == nil {
-				return
-			}
-			if name := strings.TrimSpace(source.ServiceAccountRef.Name); name != "" {
-				serviceAccountNames = append(serviceAccountNames, name)
-			}
-		}
-		appendSource(&direct.Subject)
-		appendSource(direct.Actor)
-	}
-	serviceRefs := []corev1alpha1.OutboundServiceReference{}
-	if policy.Spec.Direct != nil && policy.Spec.Direct.TokenEndpoint.ServiceRef != nil {
-		serviceRefs = append(serviceRefs, *policy.Spec.Direct.TokenEndpoint.ServiceRef)
-	}
-	if policy.Spec.Gateway != nil {
-		serviceRefs = append(serviceRefs, policy.Spec.Gateway.ServiceRef)
-	}
-	versions := make([]string, 0, len(secretRefs)+len(serviceAccountNames)+len(serviceRefs))
-	for _, name := range serviceAccountNames {
-		serviceAccount := &corev1.ServiceAccount{}
-		if err := r.brokeredApprovalReader().Get(
-			ctx,
-			ctrlclient.ObjectKey{Namespace: policy.Namespace, Name: name},
-			serviceAccount,
-		); err != nil {
-			return nil, fmt.Errorf("resolve outbound access ServiceAccount approval identity: %w", err)
-		}
-		versions = append(
-			versions,
-			policy.Namespace+"/"+name+"\x00"+string(serviceAccount.UID)+"\x00"+serviceAccount.ResourceVersion,
-		)
-	}
-	for _, ref := range serviceRefs {
-		serviceNamespace := strings.TrimSpace(ref.Namespace)
-		if serviceNamespace == "" {
-			serviceNamespace = policy.Namespace
-		}
-		service := &corev1.Service{}
-		if err := r.brokeredApprovalReader().Get(ctx, ctrlclient.ObjectKey{Namespace: serviceNamespace, Name: ref.Name}, service); err != nil {
-			return nil, fmt.Errorf("resolve outbound access Service approval identity: %w", err)
-		}
-		versions = append(versions, serviceNamespace+"/"+ref.Name+"\x00"+string(service.UID)+"\x00"+service.ResourceVersion)
-	}
-	for _, ref := range secretRefs {
-		if ref == nil || strings.TrimSpace(ref.Name) == "" {
-			continue
-		}
-		namespace := strings.TrimSpace(ref.Namespace)
-		if namespace == "" {
-			namespace = policy.Namespace
-		}
-		secret := &corev1.Secret{}
-		if err := r.brokeredApprovalReader().Get(
-			ctx,
-			ctrlclient.ObjectKey{Namespace: namespace, Name: ref.Name},
-			secret,
-		); err != nil {
-			return nil, fmt.Errorf("resolve outbound access credential approval identity: %w", err)
-		}
-		versions = append(versions, namespace+"/"+ref.Name+"\x00"+string(secret.UID)+"\x00"+secret.ResourceVersion)
-	}
-	slices.Sort(versions)
-	secretDigest := ""
-	if len(versions) > 0 {
-		sum := sha256.Sum256([]byte(strings.Join(versions, "\n")))
-		secretDigest = hex.EncodeToString(sum[:])
-	}
-	return map[string]any{
-		"uid":             string(policy.UID),
-		"generation":      policy.Generation,
-		"resourceVersion": policy.ResourceVersion,
-		"secretsDigest":   secretDigest,
-	}, nil
-}
-
-func (r *TaskReconciler) harnessBrokeredApprovalState(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	approvalID string,
-) (approvals.Approval, bool, error) {
-	listed, err := approvals.ListEvents(ctx, r.ExecutionEventStore, task.Namespace, task.Name)
-	if err != nil {
-		return approvals.Approval{}, false, err
-	}
-	for _, approval := range approvals.Derive(approvals.FilterEventsForTaskUID(listed, string(task.UID)), time.Now().UTC()) {
-		if approval.ID == approvalID {
-			return approval, true, nil
-		}
-	}
-	return approvals.Approval{}, false, nil
-}
-
-func (r *TaskReconciler) recordHarnessBrokeredApprovalRequested(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	frame harness.HarnessEventFrame,
-	target approvals.ApprovalTarget,
-) error {
-	content, err := json.Marshal(map[string]any{
-		"approvalID":        target.ApprovalID,
-		"taskUID":           target.TaskUID,
-		"targetTool":        target.TargetTool,
-		"targetArgsDigest":  target.TargetArgsDigest,
-		"targetSpecDigest":  target.TargetSpecDigest,
-		"targetArgsPreview": target.TargetArgsPreview,
-		"action":            target.Action,
-		"riskSummary":       target.RiskSummary,
-		"severity":          target.Severity,
-		"toolCallID":        frame.ToolCallID,
-		"runtimeSessionID":  string(frame.RuntimeSessionID),
-		"turnID":            string(frame.TurnID),
-		"correlationID":     frame.CorrelationID,
-	})
-	if err != nil {
-		return err
-	}
-	_, err = r.ExecutionEventStore.AppendExecutionEvent(ctx, &store.ExecutionEvent{
-		Namespace:   task.Namespace,
-		StreamType:  store.ExecutionEventStreamTypeTask,
-		StreamID:    task.Name,
-		TaskName:    task.Name,
-		SessionName: r.executionEventSessionName(ctx, task),
-		AgentName:   harnessWrapperTaskAgentName(task),
-		Type:        events.ExecutionEventTypeApprovalRequested,
-		Severity:    events.ExecutionEventSeverityWarning,
-		ToolName:    target.TargetTool,
-		ToolCallID:  target.ApprovalID,
-		Summary:     "approval requested for brokered tool call",
-		Content:     content,
-	})
-	return err
-}
-
-func (r *TaskReconciler) saveHarnessBrokeredToolResult(ctx context.Context, task *corev1alpha1.Task, idempotencyKey string, output json.RawMessage) (string, error) {
-	if len(output) == 0 {
-		return "", nil
-	}
-	if r == nil || r.ResultStore == nil {
-		return "", fmt.Errorf("result store is required for brokered tool result replay")
-	}
-	ref := harnessBrokeredToolResultRef(task, idempotencyKey)
-	if err := r.ResultStore.SaveResult(ctx, task.Namespace, ref, []byte(output)); err != nil {
-		return "", fmt.Errorf("store brokered tool result: %w", err)
-	}
-	return ref, nil
-}
-
-func harnessBrokeredToolResultRef(task *corev1alpha1.Task, idempotencyKey string) string {
-	sum := sha256.Sum256([]byte(strings.TrimSpace(idempotencyKey)))
-	return strings.TrimSpace(task.Name) + "-brokered-" + hex.EncodeToString(sum[:])[:24]
-}
-
-func (r *TaskReconciler) hasUnresolvedHarnessBrokeredToolExecution(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	frame harness.HarnessEventFrame,
-	idempotencyKey string,
-	argsDigest string,
-) (bool, error) {
-	if r == nil || r.ExecutionEventStore == nil || task == nil {
-		return false, nil
-	}
-	listed, err := r.ExecutionEventStore.ListExecutionEvents(ctx, store.ExecutionEventFilter{
-		Namespace:  task.Namespace,
-		StreamID:   task.Name,
-		EventTypes: []string{events.ExecutionEventTypeToolCallStarted, events.ExecutionEventTypeToolCallCompleted, events.ExecutionEventTypeToolCallFailed},
-	})
-	if err != nil {
-		return false, fmt.Errorf("read brokered tool ledger: %w", err)
-	}
-	started := false
-	for _, event := range listed {
-		if event.ToolCallID != frame.ToolCallID {
-			continue
-		}
-		var payload struct {
-			Brokered         bool   `json:"brokered"`
-			IdempotencyKey   string `json:"idempotencyKey"`
-			TargetArgsDigest string `json:"targetArgsDigest,omitempty"`
-			ExecutionState   string `json:"executionState,omitempty"`
-		}
-		if err := json.Unmarshal(event.Content, &payload); err != nil || !payload.Brokered || payload.IdempotencyKey != idempotencyKey {
-			continue
-		}
-		if event.ToolName != frame.ToolName {
-			return true, nil
-		}
-		if payload.TargetArgsDigest != "" && argsDigest != "" && payload.TargetArgsDigest != argsDigest {
-			if event.Type == events.ExecutionEventTypeToolCallStarted && payload.ExecutionState == harnessBrokeredExecutionStarted {
-				return true, nil
-			}
-			continue
-		}
-		switch event.Type {
-		case events.ExecutionEventTypeToolCallStarted:
-			if payload.ExecutionState == harnessBrokeredExecutionStarted {
-				started = true
-			}
-		case events.ExecutionEventTypeToolCallCompleted, events.ExecutionEventTypeToolCallFailed:
-			started = false
-		}
-	}
-	return started, nil
-}
-
-func (r *TaskReconciler) previousHarnessBrokeredToolResult(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	frame harness.HarnessEventFrame,
-	idempotencyKey string,
-	argsDigest string,
-) (harness.ToolCallResult, bool, error) {
-	if r == nil || r.ExecutionEventStore == nil || task == nil {
-		return harness.ToolCallResult{}, false, nil
-	}
-	listed, err := r.ExecutionEventStore.ListExecutionEvents(ctx, store.ExecutionEventFilter{
-		Namespace:  task.Namespace,
-		StreamID:   task.Name,
-		EventTypes: []string{events.ExecutionEventTypeToolCallCompleted, events.ExecutionEventTypeToolCallFailed},
-	})
-	if err != nil {
-		return harness.ToolCallResult{}, false, fmt.Errorf("read brokered tool ledger: %w", err)
-	}
-	for i := len(listed) - 1; i >= 0; i-- {
-		event := listed[i]
-		if event.ToolCallID != frame.ToolCallID {
-			continue
-		}
-		var payload struct {
-			Brokered         bool               `json:"brokered"`
-			IdempotencyKey   string             `json:"idempotencyKey"`
-			TargetArgsDigest string             `json:"targetArgsDigest,omitempty"`
-			Approved         *bool              `json:"approved,omitempty"`
-			ToolResultRef    string             `json:"toolResultRef,omitempty"`
-			ToolResult       json.RawMessage    `json:"toolResult,omitempty"`
-			ToolError        *harness.ErrorInfo `json:"toolError,omitempty"`
-		}
-		if err := json.Unmarshal(event.Content, &payload); err != nil || !payload.Brokered || payload.IdempotencyKey != idempotencyKey {
-			continue
-		}
-		if event.ToolName != frame.ToolName {
-			result := harness.ToolCallResult{
-				Version:          harness.ProtocolVersion,
-				RuntimeSessionID: frame.RuntimeSessionID,
-				TurnID:           frame.TurnID,
-				ToolCallID:       strings.TrimSpace(frame.ToolCallID),
-				IdempotencyKey:   idempotencyKey,
-				Approved:         false,
-				Error:            &harness.ErrorInfo{Code: "tool_call_id_reused", Message: "brokered tool call id was reused for a different tool"},
-			}
-			return result, true, nil
-		}
-		if payload.TargetArgsDigest != "" && argsDigest != "" && payload.TargetArgsDigest != argsDigest {
-			result := harness.ToolCallResult{
-				Version:          harness.ProtocolVersion,
-				RuntimeSessionID: frame.RuntimeSessionID,
-				TurnID:           frame.TurnID,
-				ToolCallID:       strings.TrimSpace(frame.ToolCallID),
-				IdempotencyKey:   idempotencyKey,
-				Approved:         false,
-				Error:            &harness.ErrorInfo{Code: "tool_call_arguments_changed", Message: "brokered tool call arguments changed after a result was recorded"},
-			}
-			return result, true, nil
-		}
-		approved := true
-		if payload.Approved != nil {
-			approved = *payload.Approved
-		}
-		if len(payload.ToolResult) == 0 && payload.ToolResultRef != "" {
-			if r.ResultStore == nil {
-				result := harness.ToolCallResult{
-					Version:          harness.ProtocolVersion,
-					RuntimeSessionID: frame.RuntimeSessionID,
-					TurnID:           frame.TurnID,
-					ToolCallID:       strings.TrimSpace(frame.ToolCallID),
-					IdempotencyKey:   idempotencyKey,
-					Approved:         false,
-					Error:            &harness.ErrorInfo{Code: "tool_result_replay_unavailable", Message: "brokered tool result store is unavailable"},
-				}
-				return result, true, nil
-			}
-			stored, err := r.ResultStore.GetResult(ctx, task.Namespace, payload.ToolResultRef)
-			if err != nil {
-				result := harness.ToolCallResult{
-					Version:          harness.ProtocolVersion,
-					RuntimeSessionID: frame.RuntimeSessionID,
-					TurnID:           frame.TurnID,
-					ToolCallID:       strings.TrimSpace(frame.ToolCallID),
-					IdempotencyKey:   idempotencyKey,
-					Approved:         false,
-					Error:            &harness.ErrorInfo{Code: "tool_result_replay_unavailable", Message: "brokered tool result is unavailable"},
-				}
-				return result, true, nil
-			}
-			payload.ToolResult = json.RawMessage(stored)
-		}
-		result := harness.ToolCallResult{
-			Version:          harness.ProtocolVersion,
-			RuntimeSessionID: frame.RuntimeSessionID,
-			TurnID:           frame.TurnID,
-			ToolCallID:       strings.TrimSpace(frame.ToolCallID),
-			IdempotencyKey:   idempotencyKey,
-			Approved:         approved,
-			Output:           payload.ToolResult,
-			Error:            payload.ToolError,
-		}
-		if len(result.Output) == 0 && result.Error == nil {
-			if event.Type == events.ExecutionEventTypeToolCallCompleted {
-				result.Output = json.RawMessage(`{"success":true,"replayed":true}`)
-			} else {
-				continue
-			}
-		}
-		return result, true, nil
-	}
-	return harness.ToolCallResult{}, false, nil
-}
-
-func brokeredToolEventContent(result harness.ToolCallResult, extra map[string]any) map[string]any {
-	content := map[string]any{
-		"idempotencyKey": result.IdempotencyKey,
-		"approved":       result.Approved,
-	}
-	if len(result.Output) > 0 {
-		content["toolResultLength"] = len(result.Output)
-		preview := events.RedactExecutionEventText(string(result.Output))
-		if len(preview) > 512 {
-			preview = preview[:512] + "...[truncated]"
-		}
-		content["toolResultPreview"] = preview
-	}
-	if result.Error != nil {
-		content["toolError"] = result.Error
-	}
-	maps.Copy(content, extra)
-	return content
-}
-
-func validateBrokeredToolArguments(tool *corev1alpha1.Tool, args json.RawMessage) error {
-	if len(args) == 0 {
-		args = json.RawMessage(`{}`)
-	}
-	var decoded any
-	if err := json.Unmarshal(args, &decoded); err != nil {
-		return fmt.Errorf("brokered tool arguments must be valid JSON: %w", err)
-	}
-	if _, ok := decoded.(map[string]any); !ok {
-		return fmt.Errorf("brokered tool arguments must be a JSON object")
-	}
-	if tool == nil || tool.Spec.Parameters == nil || len(tool.Spec.Parameters.Raw) == 0 {
-		return nil
-	}
-	var schema jsonschema.Schema
-	if err := json.Unmarshal(tool.Spec.Parameters.Raw, &schema); err != nil {
-		return fmt.Errorf("brokered tool schema is invalid JSON: %w", err)
-	}
-	resolved, err := schema.Resolve(nil)
-	if err != nil {
-		return fmt.Errorf("brokered tool schema is invalid: %w", err)
-	}
-	if err := resolved.Validate(decoded); err != nil {
-		return fmt.Errorf("brokered tool arguments do not match schema: %w", err)
-	}
-	return nil
-}
-
-func (r *TaskReconciler) continueHarnessBrokeredToolCall(
-	ctx context.Context,
-	client *harness.Client,
-	task *corev1alpha1.Task,
-	agent *corev1alpha1.Agent,
-	frame harness.HarnessEventFrame,
-) error {
-	if harnessWrapperPlannedToolExecutionMode(task) != harness.ToolExecutionModeBrokered {
-		return nil
-	}
-	result, err := r.handleHarnessBrokeredToolCall(ctx, task, agent, frame)
-	if err != nil {
-		if errors.Is(err, errHarnessBrokeredApprovalPending) {
-			return err
-		}
-		return fmt.Errorf("brokered tool call failed: %w", err)
-	}
-	// Persist continuation intent before the remote side effect. If this write
-	// fails, the tool result is replayable locally and /continue has not run; if
-	// /continue later has an ambiguous outcome, the marker keeps clean EOFs in the
-	// polling path until a terminal frame arrives.
-	continuationAlreadyPending := harnessWrapperBrokeredContinuationPending(task)
-	if err := r.patchHarnessWrapperBrokeredContinuationPending(ctx, task, true); err != nil {
-		return err
-	}
-	continueCtx, cancel := context.WithTimeout(ctx, harnessWrapperBrokeredToolTimeout)
-	defer cancel()
-	_, err = client.ContinueTurn(continueCtx, harness.ContinueTurnRequest{
-		Version:          harness.ProtocolVersion,
-		Namespace:        task.Namespace,
-		TaskName:         task.Name,
-		SessionName:      harnessWrapperSessionName(task),
-		RuntimeSessionID: frame.RuntimeSessionID,
-		TurnID:           frame.TurnID,
-		CorrelationID:    frame.CorrelationID,
-		ToolResults:      []harness.ToolCallResult{result},
-	})
-	if err != nil {
-		if harnessContinuationMarkerShouldClear(continuationAlreadyPending, err) {
-			if clearErr := r.patchHarnessWrapperBrokeredContinuationPending(ctx, task, false); clearErr != nil {
-				return fmt.Errorf("clear brokered continuation marker after rejection: %w", clearErr)
-			}
-		}
-		return fmt.Errorf("continue brokered tool call %q: %w", frame.ToolCallID, err)
-	}
-	if err := r.clearHarnessBrokeredApprovalWaiting(ctx, task, frame.ToolName); err != nil {
-		return err
-	}
-	return nil
-}
-
-func harnessContinuationMarkerShouldClear(wasPending bool, err error) bool {
-	return !wasPending && !harnessMutationMayHaveBeenAccepted(err)
-}
-
-func harnessMutationMayHaveBeenAccepted(err error) bool {
-	if err == nil {
-		return false
-	}
-	var clientErr harness.ClientError
-	if !errors.As(err, &clientErr) {
-		return legacyMutationMayHaveBeenAccepted(err)
-	}
-	return clientErr.RemoteAccepted || clientErr.RemoteAcceptanceUnknown ||
-		clientErr.StatusCode >= http.StatusInternalServerError ||
-		clientErr.StatusCode == http.StatusRequestTimeout || clientErr.StatusCode == http.StatusTooManyRequests ||
-		(clientErr.StatusCode >= http.StatusOK && clientErr.StatusCode < http.StatusMultipleChoices)
-}
-
-func legacyMutationMayHaveBeenAccepted(err error) bool {
-	if err == nil {
-		return false
-	}
-	if status, _, ok := legacyMutationResponse(err); ok {
-		return status == http.StatusRequestTimeout || status == http.StatusTooManyRequests ||
-			status >= http.StatusInternalServerError ||
-			(status >= http.StatusOK && status < http.StatusMultipleChoices)
-	}
-	if message, ok := legacyMutationMessage(err); ok {
-		return !strings.Contains(strings.ToLower(message), "harness did not accept")
-	}
-	return true
-}
-
-func legacyMutationMessage(err error) (string, bool) {
-	if err == nil {
-		return "", false
-	}
-	message := err.Error()
-	marker := " failed:"
-	markerIndex := strings.Index(message, marker)
-	if markerIndex < 0 {
-		return "", false
-	}
-	operation := strings.TrimSpace(message[:markerIndex])
-	operation = strings.TrimSpace(strings.TrimPrefix(operation, "harness "))
-	switch operation {
-	case "post", "start_turn", "continue_turn":
-		return strings.TrimSpace(message[markerIndex+len(marker):]), true
-	default:
-		return "", false
-	}
-}
-
-func legacyMutationResponse(err error) (int, string, bool) {
-	if err == nil {
-		return 0, "", false
-	}
-	message := err.Error()
-	marker := " failed ("
-	markerIndex := strings.Index(message, marker)
-	if markerIndex < 0 {
-		return 0, "", false
-	}
-	operation := strings.TrimSpace(message[:markerIndex])
-	operation = strings.TrimSpace(strings.TrimPrefix(operation, "harness "))
-	switch operation {
-	case "post", "start_turn", "continue_turn":
-	default:
-		return 0, "", false
-	}
-	statusStart := markerIndex + len(marker)
-	if statusStart+4 > len(message) || message[statusStart+3] != ')' {
-		return 0, "", false
-	}
-	status, parseErr := strconv.Atoi(message[statusStart : statusStart+3])
-	if parseErr != nil || status < 100 || status > 599 {
-		return 0, "", false
-	}
-	remainder := strings.TrimSpace(message[statusStart+4:])
-	remainder = strings.TrimSpace(strings.TrimPrefix(remainder, ":"))
-	var envelope struct {
-		Error   string `json:"error"`
-		Message string `json:"message"`
-	}
-	if json.Unmarshal([]byte(remainder), &envelope) == nil {
-		if envelope.Error != "" {
-			remainder = envelope.Error
-		} else if envelope.Message != "" {
-			remainder = envelope.Message
-		}
-	}
-	return status, remainder, true
-}
-
-func brokeredToolError(code string, err error) *harness.ErrorInfo {
-	message := "brokered tool call failed"
-	if err != nil {
-		message = events.RedactExecutionEventText(err.Error())
-	}
-	return &harness.ErrorInfo{Code: code, Message: message}
-}
-
-func brokeredToolOutput(output string) json.RawMessage {
-	trimmed := strings.TrimSpace(output)
-	if trimmed == "" {
-		return json.RawMessage(`{"success":true}`)
-	}
-	if json.Valid([]byte(trimmed)) {
-		return json.RawMessage(trimmed)
-	}
-	encoded, _ := json.Marshal(map[string]any{"result": output})
-	return encoded
-}
-
-func (r *TaskReconciler) recordHarnessBrokeredToolEvent(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	frame harness.HarnessEventFrame,
-	eventType string,
-	summary string,
-	content map[string]any,
-) error {
-	if r == nil || r.ExecutionEventStore == nil || task == nil {
-		return nil
-	}
-	severity := events.ExecutionEventSeverityInfo
-	if eventType == events.ExecutionEventTypeToolCallFailed {
-		severity = events.ExecutionEventSeverityError
-	}
-	if content == nil {
-		content = map[string]any{}
-	}
-	content["toolName"] = strings.TrimSpace(frame.ToolName)
-	content["toolCallID"] = strings.TrimSpace(frame.ToolCallID)
-	content["runtimeSessionID"] = string(frame.RuntimeSessionID)
-	content["turnID"] = string(frame.TurnID)
-	content["correlationID"] = frame.CorrelationID
-	content["brokered"] = true
-	encoded, err := json.Marshal(content)
-	if err != nil {
-		return fmt.Errorf("marshal brokered tool event content: %w", err)
-	}
-	_, err = r.ExecutionEventStore.AppendExecutionEvent(ctx, &store.ExecutionEvent{
-		Namespace:   task.Namespace,
-		StreamType:  store.ExecutionEventStreamTypeTask,
-		StreamID:    task.Name,
-		TaskName:    task.Name,
-		SessionName: r.executionEventSessionName(ctx, task),
-		AgentName:   harnessWrapperTaskAgentName(task),
-		Type:        eventType,
-		Severity:    severity,
-		ToolName:    strings.TrimSpace(frame.ToolName),
-		ToolCallID:  strings.TrimSpace(frame.ToolCallID),
-		Summary:     events.RedactExecutionEventText(summary),
-		Content:     encoded,
-	})
-	return err
-}
diff --git a/internal/controller/harness_v1_binding.go b/internal/controller/harness_v1_binding.go
new file mode 100644
index 000000000..b7b42dedd
--- /dev/null
+++ b/internal/controller/harness_v1_binding.go
@@ -0,0 +1,1166 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package controller
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	logf "sigs.k8s.io/controller-runtime/pkg/log"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/harness"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+const (
+	defaultHarnessV1SessionName = "task"
+
+	harnessV1SessionBootstrapSchemaVersion   = 1
+	harnessV1SessionBootstrapMaxMessages     = 64
+	harnessV1SessionBootstrapMaxBytes        = 128 * 1024
+	harnessV1SessionBootstrapMaxMessageBytes = 32 * 1024
+	harnessV1CredentialFlagYes               = "yes"
+)
+
+type resolvedHarnessV1Target struct {
+	endpoint             string
+	backend              corev1alpha1.AgentExecutionBackend
+	runtimeName          string
+	authSecret           *corev1.Secret
+	authSecretKey        string
+	runtimeRef           *corev1alpha1.AgentRuntime
+	toolExecutionModes   []corev1alpha1.AgentRuntimeToolExecutionMode
+	brokeredToolClasses  []corev1alpha1.AgentRuntimeBrokeredToolClass
+	supportsContinuation bool
+}
+
+type verifiedHarnessV1Execution struct {
+	binding    *corev1alpha1.AgentExecutionBinding
+	snapshot   *store.AgentExecutionSnapshot
+	body       agentExecutionSnapshotBody
+	frozenTask *corev1alpha1.Task
+}
+
+// permanentHarnessV1CandidateError marks deterministic Task or Agent
+// violations. Candidate resolution errors without this marker remain retryable
+// because they may depend on mutable control-plane state.
+type permanentHarnessV1CandidateError struct{ err error }
+
+func (e *permanentHarnessV1CandidateError) Error() string { return e.err.Error() }
+func (e *permanentHarnessV1CandidateError) Unwrap() error { return e.err }
+
+func permanentHarnessV1Candidate(err error) error {
+	if err == nil {
+		return nil
+	}
+	return &permanentHarnessV1CandidateError{err: err}
+}
+
+func isPermanentHarnessV1CandidateError(err error) bool {
+	var permanent *permanentHarnessV1CandidateError
+	return errors.As(err, &permanent)
+}
+
+//nolint:gocyclo // Candidate resolution keeps the fail-closed admission checks auditable in one path.
+func (r *TaskReconciler) resolveHarnessV1ExecutionCandidate(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	agent *corev1alpha1.Agent,
+) (*agentExecutionCandidate, error) {
+	if r.AgentExecutionSnapshots == nil {
+		return nil, errors.New("encrypted agent execution snapshot store is required; v1 admission fails closed")
+	}
+	if task == nil || task.UID == "" || task.Generation < 1 || agent == nil || agent.UID == "" || agent.Generation < 1 {
+		return nil, errors.New("task and Agent immutable identities are required for a harness v1 binding")
+	}
+	if agent.Spec.Runtime == nil {
+		return nil, permanentHarnessV1Candidate(errors.New("agent runtime configuration is required for a harness v1 binding"))
+	}
+	if err := validateNewHarnessV1Workload(task, agent); err != nil {
+		return nil, permanentHarnessV1Candidate(err)
+	}
+	reader := r.APIReader
+	if reader == nil {
+		reader = r.Client
+	}
+	if reader == nil {
+		return nil, errors.New("API reader is required for harness v1 binding")
+	}
+
+	namespace := &corev1.Namespace{}
+	if err := reader.Get(ctx, types.NamespacedName{Name: task.Namespace}, namespace); err != nil {
+		return nil, fmt.Errorf("resolve Task namespace identity: %w", err)
+	}
+	target, err := r.resolveHarnessV1Target(ctx, reader, task, agent)
+	if err != nil {
+		return nil, err
+	}
+	binding := corev1alpha1.AgentExecutionBinding{
+		SchemaVersion:   1,
+		ContractVersion: corev1alpha1.AgentRuntimeContractHarnessV1,
+		Backend:         target.backend,
+		Task: corev1alpha1.AgentExecutionBindingTaskRef{
+			NamespaceUID: namespace.UID, UID: task.UID, BoundSpecGeneration: task.Generation,
+		},
+		Agent: &corev1alpha1.AgentExecutionAgentRef{
+			Namespace: agent.Namespace, Name: agent.Name, UID: agent.UID, Generation: agent.Generation,
+		},
+		RuntimeType: agent.Spec.Runtime.Type,
+	}
+	if target.runtimeRef != nil {
+		binding.RuntimeType = ""
+		binding.RuntimeRef = &corev1alpha1.AgentExecutionRuntimeRef{
+			Name: target.runtimeRef.Name, UID: target.runtimeRef.UID, Generation: target.runtimeRef.Generation,
+		}
+	}
+	toolGovernance, err := resolveHarnessV1ToolGovernance(ctx, reader, task, agent, target)
+	if err != nil {
+		return nil, err
+	}
+	workspace, err := resolveHarnessV1PublicReadOnlyWorkspace(task, agent, target)
+	if err != nil {
+		return nil, permanentHarnessV1Candidate(err)
+	}
+	runtimeAuthOnly, err := validateHarnessV1RuntimeAuthOnly(task, agent, target)
+	if err != nil {
+		return nil, err
+	}
+	systemPrompt, err := resolveACPSystemPrompt(ctx, reader, agent)
+	if err != nil {
+		if isPermanentACPAgentConfigurationError(err) {
+			return nil, permanentHarnessV1Candidate(err)
+		}
+		return nil, err
+	}
+	sessionPrompt, sessionBootstrap, err := r.resolveHarnessV1SessionInput(ctx, task, &binding)
+	if err != nil {
+		return nil, fmt.Errorf("resolve frozen harness v1 Session input: %w", err)
+	}
+
+	credentialRefs, err := resolveHarnessV1CredentialRefs(ctx, reader, agent, target, runtimeAuthOnly)
+	if err != nil {
+		return nil, err
+	}
+	if runtimeAuthOnly && len(credentialRefs) == 0 {
+		return nil, permanentHarnessV1Candidate(errors.New("harness v1 runtime-auth-only binding requires frozen provider credentials"))
+	}
+	maxTurns := int32(50)
+	if agent.Spec.Runtime.DefaultMaxTurns != nil {
+		maxTurns = *agent.Spec.Runtime.DefaultMaxTurns
+	}
+	if task.Spec.AgentRuntime != nil && task.Spec.AgentRuntime.MaxTurns != nil {
+		maxTurns = *task.Spec.AgentRuntime.MaxTurns
+	}
+	model := ""
+	provider := ""
+	if agent.Spec.Model != nil {
+		model = strings.TrimSpace(agent.Spec.Model.Name)
+		provider = strings.TrimSpace(agent.Spec.Model.Provider)
+	}
+	if provider == "" {
+		provider = target.runtimeName
+	}
+	duplicateSafe := target.backend == corev1alpha1.AgentExecutionBackendHarnessWrapper && len(credentialRefs) == 0
+	if task.Spec.RetryPolicy != nil && task.Spec.RetryPolicy.MaxRetries > 0 && !duplicateSafe {
+		return nil, permanentHarnessV1Candidate(errors.New("harness v1 retry requires a duplicate-safe built-in workload without provider credentials"))
+	}
+	body := agentExecutionSnapshotBody{
+		SchemaVersion:   store.AgentExecutionSnapshotSchemaVersion,
+		ContractVersion: string(corev1alpha1.AgentRuntimeContractHarnessV1),
+		Backend:         string(target.backend),
+		RuntimeType:     string(agent.Spec.Runtime.Type),
+		Agent: agentExecutionSnapshotAgent{
+			Namespace: agent.Namespace, Name: agent.Name, UID: string(agent.UID), Generation: agent.Generation,
+		},
+		Configuration: agentExecutionSnapshotConfig{
+			AgentUID: string(agent.UID), AgentGeneration: agent.Generation,
+			ProviderKind: provider, Model: model, MaxTurns: maxTurns,
+			ReasoningEffort: strings.TrimSpace(agent.Spec.Runtime.DefaultReasoningEffort),
+			SystemPrompt:    systemPrompt,
+		},
+		Prompt:          sessionPrompt,
+		RetryPolicy:     task.Spec.RetryPolicy.DeepCopy(),
+		SessionRef:      task.Spec.SessionRef.DeepCopy(),
+		Workspace:       workspace,
+		RuntimeOverride: task.Spec.AgentRuntime.DeepCopy(),
+		HarnessV1: &agentExecutionSnapshotHarnessV1{
+			Endpoint: target.endpoint, Backend: string(target.backend), RuntimeName: target.runtimeName,
+			ToolExecutionMode:   string(toolGovernance.mode),
+			BrokeredToolClasses: toolGovernance.classes,
+			BrokeredTools:       toolGovernance.tools,
+			RuntimeAuthOnly:     runtimeAuthOnly,
+			AuthSecretNamespace: target.authSecret.Namespace, AuthSecretName: target.authSecret.Name,
+			AuthSecretKey: target.authSecretKey, AuthSecretUID: string(target.authSecret.UID),
+			AuthSecretResourceVersion: target.authSecret.ResourceVersion,
+			DuplicateSafe:             duplicateSafe,
+			SessionName:               harnessV1SessionName(task), SessionBootstrap: sessionBootstrap,
+			CredentialRefs: credentialRefs,
+		},
+	}
+	if task.Spec.Timeout != nil {
+		body.Timeout = task.Spec.Timeout.Duration.String()
+	}
+	if agent.Spec.Runtime.DefaultAllowedTools != nil || agent.Spec.Runtime.DefaultAllowBash != nil {
+		body.DefaultTools = &agentExecutionSnapshotToolPolicy{
+			AllowedToolsOmitted: agent.Spec.Runtime.DefaultAllowedTools == nil,
+			AllowedTools:        append([]string(nil), agent.Spec.Runtime.DefaultAllowedTools...),
+			AllowBash:           agent.Spec.Runtime.DefaultAllowBash,
+		}
+	}
+	encoded, err := canonicalAgentExecutionSnapshotBody(body)
+	if err != nil {
+		return nil, err
+	}
+	snapshotDigest := store.CanonicalAgentExecutionSnapshotDigest(encoded)
+	binding.Snapshot = corev1alpha1.AgentExecutionSnapshotRef{
+		ID: string(task.UID) + "/" + snapshotDigest, Digest: snapshotDigest,
+		SchemaVersion: store.AgentExecutionSnapshotSchemaVersion,
+	}
+	binding.BindingDigest, err = canonicalAgentExecutionBindingDigest(binding)
+	if err != nil {
+		return nil, err
+	}
+	binding.BoundAt = metav1.Now()
+	return &agentExecutionCandidate{binding: binding, snapshotBody: encoded}, nil
+}
+
+func validateHarnessV1RuntimeAuthOnly(
+	task *corev1alpha1.Task,
+	agent *corev1alpha1.Agent,
+	target resolvedHarnessV1Target,
+) (bool, error) {
+	if !taskRequestsRuntimeAuthOnly(task) {
+		return false, nil
+	}
+	if target.backend != corev1alpha1.AgentExecutionBackendHarnessWrapper || target.runtimeRef != nil {
+		return false, permanentHarnessV1Candidate(errors.New("harness v1 runtime-auth-only binding requires the built-in wrapper"))
+	}
+	switch agent.Spec.Runtime.Type {
+	case corev1alpha1.AgentRuntimeCodex, corev1alpha1.AgentRuntimeClaude:
+		return true, nil
+	default:
+		return false, permanentHarnessV1Candidate(fmt.Errorf(
+			"harness v1 runtime-auth-only binding does not support runtime %q",
+			agent.Spec.Runtime.Type,
+		))
+	}
+}
+
+func validateNewHarnessV1Workload(task *corev1alpha1.Task, agent *corev1alpha1.Agent) error {
+	if task.Spec.Transaction != nil {
+		return errors.New("harness v1 agent Tasks do not accept transaction tokens")
+	}
+	if task.Spec.AgentRuntime != nil && task.Spec.AgentRuntime.Workspace != nil {
+		return errors.New("new harness v1 bindings do not accept the legacy agentRuntime.workspace surface")
+	}
+	if task.Spec.SecretRef != nil || len(task.Spec.Env) != 0 {
+		return errors.New("new harness v1 bindings reject arbitrary Task Secret and env delivery")
+	}
+	if task.Spec.PriorTaskRef != nil || task.Spec.Execution != nil || len(task.Spec.Resources.Requests) != 0 || len(task.Spec.Resources.Limits) != 0 {
+		return errors.New("new harness v1 bindings reject prior-task, placement, and custom resource authority")
+	}
+	if len(agent.Spec.Skills) != 0 {
+		return errors.New("new harness v1 bindings reject unresolved Agent skills")
+	}
+	for _, tool := range agent.Spec.Tools {
+		if tool.Enabled == nil || *tool.Enabled {
+			return errors.New("new harness v1 pure-prompt bindings reject enabled Agent tools")
+		}
+	}
+	if agent.Spec.Coordination != nil && agent.Spec.Coordination.Enabled {
+		return errors.New("new harness v1 pure-prompt bindings reject agent coordination")
+	}
+	if agent.Spec.ProviderRef != nil {
+		return errors.New("new harness v1 bindings do not resolve mutable Provider references")
+	}
+	if agent.Spec.Model != nil && len(agent.Spec.Model.Fallbacks) != 0 {
+		return errors.New("new harness v1 bindings reject model fallbacks")
+	}
+	switch agent.Spec.Runtime.Type {
+	case corev1alpha1.AgentRuntimeCopilot:
+		return errors.New("new harness v1 Copilot bindings are prohibited because provider authentication requires a GitHub mutation-capable credential")
+	case corev1alpha1.AgentRuntimeOpencode:
+		return errors.New("new harness v1 OpenCode bindings are prohibited")
+	}
+	return nil
+}
+
+//nolint:gocyclo // Built-in and external v1 targets have distinct fail-closed admission proofs.
+func (r *TaskReconciler) resolveHarnessV1Target(
+	ctx context.Context,
+	reader client.Reader,
+	task *corev1alpha1.Task,
+	agent *corev1alpha1.Agent,
+) (resolvedHarnessV1Target, error) {
+	runtimeRef := agent.Spec.Runtime.RuntimeRef
+	if runtimeRef == nil || strings.TrimSpace(runtimeRef.Name) == "" {
+		endpoint := strings.TrimSpace(r.HarnessV1Endpoint)
+		namespace := strings.TrimSpace(r.HarnessV1AuthSecretNamespace)
+		name := strings.TrimSpace(r.HarnessV1AuthSecretName)
+		key := strings.TrimSpace(r.HarnessV1AuthSecretKey)
+		if endpoint == "" || namespace == "" || name == "" || key == "" {
+			return resolvedHarnessV1Target{}, errors.New("built-in harness v1 endpoint and auth Secret coordinates are required")
+		}
+		if _, err := harness.NewClient(endpoint); err != nil {
+			return resolvedHarnessV1Target{}, fmt.Errorf("validate built-in harness v1 endpoint: %w", err)
+		}
+		secret := &corev1.Secret{}
+		if err := reader.Get(ctx, types.NamespacedName{Namespace: namespace, Name: name}, secret); err != nil {
+			return resolvedHarnessV1Target{}, fmt.Errorf("read built-in harness v1 auth Secret: %w", err)
+		}
+		if secret.UID == "" || secret.ResourceVersion == "" || len(secret.Data[key]) == 0 {
+			return resolvedHarnessV1Target{}, errors.New("built-in harness v1 auth Secret identity/key is incomplete")
+		}
+		return resolvedHarnessV1Target{
+			endpoint: endpoint, backend: corev1alpha1.AgentExecutionBackendHarnessWrapper,
+			runtimeName: string(agent.Spec.Runtime.Type), authSecret: secret, authSecretKey: key,
+			toolExecutionModes: []corev1alpha1.AgentRuntimeToolExecutionMode{
+				corev1alpha1.AgentRuntimeToolExecutionModeObserved,
+			},
+		}, nil
+	}
+
+	runtime := &corev1alpha1.AgentRuntime{}
+	if err := reader.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: strings.TrimSpace(runtimeRef.Name)}, runtime); err != nil {
+		return resolvedHarnessV1Target{}, fmt.Errorf("read harness v1 AgentRuntime: %w", err)
+	}
+	if runtime.RegisteredContractVersion() != corev1alpha1.AgentRuntimeContractHarnessV1 ||
+		runtime.Spec.Deployment.Mode != corev1alpha1.AgentRuntimeDeploymentModeExternalEndpoint ||
+		!runtime.Status.Ready || runtime.Status.ObservedGeneration != runtime.Generation {
+		return resolvedHarnessV1Target{}, errors.New("harness v1 AgentRuntime is not current-generation Ready with the exact v1 contract")
+	}
+	capabilities := runtime.Status.ObservedCapabilities
+	if capabilities == nil || !slices.Contains(capabilities.ToolExecutionModes, corev1alpha1.AgentRuntimeToolExecutionModeObserved) &&
+		!slices.Contains(capabilities.ToolExecutionModes, corev1alpha1.AgentRuntimeToolExecutionModeBrokered) {
+		return resolvedHarnessV1Target{}, errors.New("harness v1 AgentRuntime does not advertise a supported tool execution mode")
+	}
+	if slices.Contains(capabilities.ToolExecutionModes, corev1alpha1.AgentRuntimeToolExecutionModeBrokered) &&
+		(!capabilities.SupportsContinuation || len(capabilities.BrokeredToolClasses) == 0) {
+		return resolvedHarnessV1Target{}, errors.New("harness v1 AgentRuntime brokered mode requires continuation and brokered tool classes")
+	}
+	if err := validateHarnessV1AgentRuntimeEndpointSpec(runtime.Spec.Deployment.Endpoint); err != nil {
+		return resolvedHarnessV1Target{}, fmt.Errorf("validate harness v1 AgentRuntime endpoint: %w", err)
+	}
+	ref := runtime.Spec.ClientAuth.BearerAuthRef
+	if ref == nil || strings.TrimSpace(ref.Name) == "" || strings.TrimSpace(ref.Key) == "" {
+		return resolvedHarnessV1Target{}, errors.New("harness v1 AgentRuntime bearer auth reference is required")
+	}
+	secret := &corev1.Secret{}
+	if err := reader.Get(ctx, types.NamespacedName{Namespace: runtime.Namespace, Name: ref.Name}, secret); err != nil {
+		return resolvedHarnessV1Target{}, fmt.Errorf("read harness v1 AgentRuntime auth Secret: %w", err)
+	}
+	if err := validateAgentRuntimeAuthSecretUse(runtime.Name, runtime.Spec.Deployment.Endpoint, secret); err != nil {
+		return resolvedHarnessV1Target{}, err
+	}
+	if secret.UID == "" || secret.ResourceVersion == "" || len(secret.Data[ref.Key]) == 0 ||
+		runtime.Status.ObservedAuthRefResourceVersion != secret.ResourceVersion {
+		return resolvedHarnessV1Target{}, errors.New("harness v1 AgentRuntime auth Secret identity does not match its current readiness observation")
+	}
+	runtimeName := runtime.Name
+	if runtime.Status.ObservedCapabilities != nil && strings.TrimSpace(runtime.Status.ObservedCapabilities.RuntimeName) != "" {
+		runtimeName = strings.TrimSpace(runtime.Status.ObservedCapabilities.RuntimeName)
+	}
+	return resolvedHarnessV1Target{
+		endpoint: strings.TrimSpace(runtime.Spec.Deployment.Endpoint),
+		backend:  corev1alpha1.AgentExecutionBackendExternalEndpoint, runtimeName: runtimeName,
+		authSecret: secret, authSecretKey: strings.TrimSpace(ref.Key), runtimeRef: runtime,
+		toolExecutionModes:   append([]corev1alpha1.AgentRuntimeToolExecutionMode(nil), capabilities.ToolExecutionModes...),
+		brokeredToolClasses:  append([]corev1alpha1.AgentRuntimeBrokeredToolClass(nil), capabilities.BrokeredToolClasses...),
+		supportsContinuation: capabilities.SupportsContinuation,
+	}, nil
+}
+
+func resolveHarnessV1CredentialRefs(
+	ctx context.Context,
+	reader client.Reader,
+	agent *corev1alpha1.Agent,
+	target resolvedHarnessV1Target,
+	runtimeAuthOnly bool,
+) ([]agentExecutionSnapshotSecretRef, error) {
+	if target.runtimeRef != nil || agent.Spec.SecretRef == nil || strings.TrimSpace(agent.Spec.SecretRef.Name) == "" {
+		return nil, nil
+	}
+	secret := &corev1.Secret{}
+	if err := reader.Get(ctx, types.NamespacedName{Namespace: agent.Namespace, Name: agent.Spec.SecretRef.Name}, secret); err != nil {
+		return nil, fmt.Errorf("read harness v1 provider credential Secret: %w", err)
+	}
+	if secret.UID == "" || secret.ResourceVersion == "" {
+		return nil, errors.New("harness v1 provider credential Secret identity is incomplete")
+	}
+	if runtimeAuthOnly && agent.Spec.Runtime.Type == corev1alpha1.AgentRuntimeClaude &&
+		harnessV1ClaudeFoundryConfigured(secret.Data) {
+		return nil, permanentHarnessV1Candidate(errors.New(
+			"harness v1 runtime-auth-only Claude binding does not support Azure AI Foundry credentials",
+		))
+	}
+	allowedKeys, err := readOnlyAgentRuntimeSecretKeys(agent)
+	if err != nil {
+		return nil, permanentHarnessV1Candidate(fmt.Errorf("resolve harness v1 provider credential keys: %w", err))
+	}
+	allowedKeySet := make(map[string]struct{}, len(allowedKeys))
+	for _, key := range allowedKeys {
+		allowedKeySet[key] = struct{}{}
+	}
+	keys := make([]string, 0, len(secret.Data))
+	for key, value := range secret.Data {
+		key = strings.TrimSpace(key)
+		if key == "" || len(value) == 0 {
+			continue
+		}
+		if _, ok := allowedKeySet[key]; !ok {
+			return nil, permanentHarnessV1Candidate(fmt.Errorf(
+				"provider credential Secret key %q is not allowed for harness v1 runtime %q",
+				key, agent.Spec.Runtime.Type,
+			))
+		}
+		keys = append(keys, key)
+	}
+	slices.Sort(keys)
+	if len(keys) == 0 {
+		return nil, errors.New("harness v1 provider credential Secret has no usable keys")
+	}
+	return []agentExecutionSnapshotSecretRef{{
+		Role: "provider-runtime", Namespace: secret.Namespace, Name: secret.Name,
+		UID: string(secret.UID), ResourceVersion: secret.ResourceVersion, Keys: keys,
+	}}, nil
+}
+
+func harnessV1ClaudeFoundryConfigured(data map[string][]byte) bool {
+	if strings.TrimSpace(string(data["ANTHROPIC_FOUNDRY_API_KEY"])) != "" {
+		return true
+	}
+	switch strings.ToLower(strings.TrimSpace(string(data["CLAUDE_CODE_USE_FOUNDRY"]))) {
+	case "1", scheduledRunLabelValue, harnessV1CredentialFlagYes, "on":
+		return true
+	default:
+		return false
+	}
+}
+
+func harnessV1SessionName(task *corev1alpha1.Task) string {
+	if task != nil && task.Spec.SessionRef != nil && strings.TrimSpace(task.Spec.SessionRef.Name) != "" {
+		return strings.TrimSpace(task.Spec.SessionRef.Name)
+	}
+	if task != nil {
+		return task.Name
+	}
+	return defaultHarnessV1SessionName
+}
+
+// resolveHarnessV1SessionInput freezes the canonical transcript suffix and the
+// exact current user prompt before the binding is persisted. Harness v1 CLI
+// adapters start a fresh process for every turn, so dispatch must not depend on
+// either mutable transcript reads or provider-native session continuation.
+//
+//nolint:gocyclo // Freezing spans the control and transcript stores and keeps every cross-store fence in one boundary.
+func (r *TaskReconciler) resolveHarnessV1SessionInput(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	binding *corev1alpha1.AgentExecutionBinding,
+) (string, *agentExecutionSnapshotHarnessV1SessionBootstrap, error) {
+	if task == nil {
+		return "", nil, store.ValidationErrorf("Task is required")
+	}
+	prompt := task.Spec.Prompt
+	ref := task.Spec.SessionRef
+	if ref == nil {
+		return prompt, nil, nil
+	}
+	name := strings.TrimSpace(ref.Name)
+	if name == "" {
+		return "", nil, store.ValidationErrorf("harness v1 SessionRef name is required")
+	}
+	if r.DurableControlStore == nil {
+		return "", nil, errors.New("session control store is required")
+	}
+	requiresTranscript := ref.Append || ref.PromptIncluded
+	if r.SessionManager == nil || r.SessionManager.store == nil {
+		return "", nil, errors.New("session transcript store is required")
+	}
+	throughMessageID := strings.TrimSpace(ref.ThroughMessageID)
+	if ref.PromptIncluded && throughMessageID == "" {
+		return "", nil, store.ValidationErrorf("prompt-included harness v1 Session requires a through-message ID")
+	}
+
+	control, err := r.DurableControlStore.GetSessionControl(ctx, task.Namespace, name)
+	newSession := false
+	if errors.Is(err, store.ErrNotFound) {
+		if !ref.Create {
+			return "", nil, fmt.Errorf("session %s/%s does not exist and create=false: %w", task.Namespace, name, store.ErrNotFound)
+		}
+		newSession = true
+		uid, uidErr := newACPSessionUID()
+		if uidErr != nil {
+			return "", nil, fmt.Errorf("generate frozen harness v1 Session UID: %w", uidErr)
+		}
+		control = &store.SessionControl{
+			Namespace: task.Namespace, SessionName: name, SessionUID: uid,
+			Availability: store.SessionAvailable,
+		}
+	} else if err != nil {
+		return "", nil, fmt.Errorf("load harness v1 Session control: %w", err)
+	} else if err := validateAvailableUnleasedHarnessV1SessionControl(control, task.Namespace, name); err != nil {
+		return "", nil, err
+	}
+
+	maxMessages := acpSessionReferenceMaxMessages(ref)
+	var messages []store.SessionMessage
+	if requiresTranscript {
+		if throughMessageID != "" {
+			messages, err = r.SessionManager.store.LoadTranscriptThrough(
+				ctx, task.Namespace, name, throughMessageID, maxMessages,
+			)
+		} else {
+			messages, err = r.SessionManager.store.LoadTranscript(ctx, task.Namespace, name, maxMessages)
+		}
+		if err != nil && (!newSession || !ref.Create || ref.PromptIncluded || !errors.Is(err, store.ErrNotFound)) {
+			return "", nil, fmt.Errorf("load canonical Session transcript: %w", err)
+		}
+		if errors.Is(err, store.ErrNotFound) {
+			messages = nil
+		}
+	} else if newSession {
+		record, getErr := r.SessionManager.store.GetSession(ctx, task.Namespace, name)
+		if getErr == nil && record.MessageCount > 0 {
+			return "", nil, fmt.Errorf(
+				"%w: control-less Session %s/%s has a non-empty transcript",
+				store.ErrConflict, task.Namespace, name,
+			)
+		}
+		if getErr != nil && !errors.Is(getErr, store.ErrNotFound) {
+			return "", nil, fmt.Errorf("inspect new harness v1 Session transcript: %w", getErr)
+		}
+	}
+	existingTranscriptHasMessages := !newSession && len(messages) > 0
+	if !newSession && !requiresTranscript {
+		lineageProbe, probeErr := r.SessionManager.store.LoadTranscript(ctx, task.Namespace, name, 1)
+		if probeErr != nil && !errors.Is(probeErr, store.ErrNotFound) {
+			return "", nil, fmt.Errorf("inspect harness v1 Session transcript lineage eligibility: %w", probeErr)
+		}
+		existingTranscriptHasMessages = len(lineageProbe) > 0
+	}
+	if newSession && len(messages) > 0 {
+		return "", nil, fmt.Errorf(
+			"%w: control-less Session %s/%s has a non-empty transcript",
+			store.ErrConflict, task.Namespace, name,
+		)
+	}
+	if throughMessageID != "" && (len(messages) == 0 || messages[len(messages)-1].ID != throughMessageID) {
+		return "", nil, fmt.Errorf(
+			"%w: bounded harness v1 transcript does not end at message %q",
+			store.ErrConflict, throughMessageID,
+		)
+	}
+	totalMessages := len(messages)
+	bootstrapMessages := messages
+	if ref.PromptIncluded {
+		throughMessage := messages[len(messages)-1]
+		if throughMessage.Role != acpBootstrapRoleUser || strings.TrimSpace(throughMessage.Content) == "" {
+			return "", nil, store.ValidationErrorf(
+				"prompt-included harness v1 Session cutoff must end at a non-empty user message",
+			)
+		}
+		prompt = throughMessage.Content
+		bootstrapMessages = messages[:len(messages)-1]
+	}
+	limits, err := harnessV1SessionBootstrapLimits(harnessV1SessionBootstrapSchemaVersion)
+	if err != nil {
+		return "", nil, err
+	}
+	bootstrap, err := buildACPBootstrapTranscript(bootstrapMessages, limits)
+	if err != nil {
+		return "", nil, fmt.Errorf("build bounded harness v1 Session bootstrap: %w", err)
+	}
+	if newSession {
+		if winner, getErr := r.DurableControlStore.GetSessionControl(ctx, task.Namespace, name); getErr == nil {
+			return "", nil, fmt.Errorf(
+				"%w: session %s/%s was created as UID %q while freezing UID %q",
+				store.ErrConflict, task.Namespace, name, winner.SessionUID, control.SessionUID,
+			)
+		} else if !errors.Is(getErr, store.ErrNotFound) {
+			return "", nil, fmt.Errorf("recheck new harness v1 Session control: %w", getErr)
+		}
+	} else {
+		current, getErr := r.DurableControlStore.GetSessionControl(ctx, task.Namespace, name)
+		if getErr != nil {
+			return "", nil, fmt.Errorf("recheck harness v1 Session control: %w", getErr)
+		}
+		if err := validateAvailableUnleasedHarnessV1SessionControl(current, task.Namespace, name); err != nil {
+			return "", nil, err
+		}
+		if current.SessionUID != control.SessionUID || current.Version != control.Version ||
+			current.LeaseGeneration != control.LeaseGeneration {
+			return "", nil, fmt.Errorf("%w: harness v1 Session control changed while freezing its transcript", store.ErrConflict)
+		}
+		if current.Lineage == nil && existingTranscriptHasMessages {
+			return "", nil, permanentHarnessV1Candidate(fmt.Errorf(
+				"%w: non-empty Session %s/%s has no authoritative execution lineage",
+				store.ErrConflict, task.Namespace, name,
+			))
+		}
+		if current.Lineage != nil {
+			if err := validateHarnessV1CandidateSessionLineage(current.Lineage, binding, task.Namespace, name, current.SessionUID); err != nil {
+				return "", nil, permanentHarnessV1Candidate(err)
+			}
+		}
+	}
+	return prompt, &agentExecutionSnapshotHarnessV1SessionBootstrap{
+		SchemaVersion: harnessV1SessionBootstrapSchemaVersion,
+		SessionUID:    control.SessionUID, ControlVersion: control.Version,
+		LeaseGeneration: control.LeaseGeneration,
+		Artifact:        string(bootstrap.Artifact), Digest: bootstrap.Digest,
+		MessageCount: bootstrap.MessageCount, TotalMessages: totalMessages,
+		Truncated: bootstrap.Truncated,
+	}, nil
+}
+
+func validateHarnessV1CandidateSessionLineage(
+	lineage *store.SessionLineage,
+	binding *corev1alpha1.AgentExecutionBinding,
+	namespace, sessionName, sessionUID string,
+) error {
+	if lineage == nil {
+		return nil
+	}
+	configDigest, err := harnessV1SessionLineageConfigDigest(binding)
+	if err != nil {
+		return err
+	}
+	if lineage.Namespace != namespace || lineage.SessionName != sessionName ||
+		lineage.NamespaceUID != string(binding.Task.NamespaceUID) || lineage.SessionUID != sessionUID ||
+		lineage.ContractVersion != string(corev1alpha1.AgentRuntimeContractHarnessV1) ||
+		lineage.LineageGeneration != 1 ||
+		lineage.RuntimeIdentity != harnessV1SessionRuntimeIdentity(binding) ||
+		lineage.ConfigDigest != configDigest {
+		return fmt.Errorf(
+			"%w: Session %s/%s lineage does not match the prospective harness v1 binding",
+			store.ErrConflict, namespace, sessionName,
+		)
+	}
+	return nil
+}
+
+func harnessV1SessionBootstrapLimits(schemaVersion int) (ACPBootstrapLimits, error) {
+	if schemaVersion != harnessV1SessionBootstrapSchemaVersion {
+		return ACPBootstrapLimits{}, store.ValidationErrorf(
+			"unsupported harness v1 Session bootstrap schema version %d", schemaVersion,
+		)
+	}
+	return ACPBootstrapLimits{
+		MaxMessages:     harnessV1SessionBootstrapMaxMessages,
+		MaxBytes:        harnessV1SessionBootstrapMaxBytes,
+		MaxMessageBytes: harnessV1SessionBootstrapMaxMessageBytes,
+	}, nil
+}
+
+func validateAvailableUnleasedHarnessV1SessionControl(
+	control *store.SessionControl,
+	namespace, name string,
+) error {
+	if control == nil || control.Namespace != namespace || control.SessionName != name ||
+		strings.TrimSpace(control.SessionUID) == "" || control.Version < 1 || control.LeaseGeneration < 0 {
+		return fmt.Errorf("%w: harness v1 Session control identity is incomplete", store.ErrConflict)
+	}
+	if control.Availability != store.SessionAvailable || control.Lease != nil {
+		return fmt.Errorf("%w: harness v1 Session %s/%s is not available and unleased", store.ErrConflict, namespace, name)
+	}
+	return nil
+}
+
+//nolint:gocyclo // Snapshot validation intentionally checks every frozen v1 field in one boundary.
+func validateHarnessV1Snapshot(
+	binding *corev1alpha1.AgentExecutionBinding,
+	snapshot *store.AgentExecutionSnapshot,
+	body agentExecutionSnapshotBody,
+) error {
+	if binding == nil || snapshot == nil || body.HarnessV1 == nil {
+		return errors.New("harness v1 binding, snapshot, and target metadata are required")
+	}
+	key := store.AgentExecutionSnapshotKey{TaskUID: string(binding.Task.UID), Digest: binding.Snapshot.Digest}
+	if binding.Snapshot.ID != key.ID() || snapshot.TaskUID != key.TaskUID || snapshot.Digest != key.Digest ||
+		binding.Snapshot.SchemaVersion != store.AgentExecutionSnapshotSchemaVersion ||
+		snapshot.SchemaVersion != binding.Snapshot.SchemaVersion || body.SchemaVersion != binding.Snapshot.SchemaVersion {
+		return errors.New("harness v1 execution snapshot identity/schema does not exactly match the binding")
+	}
+	if store.CanonicalAgentExecutionSnapshotDigest(snapshot.Body) != binding.Snapshot.Digest {
+		return errors.New("harness v1 execution snapshot body digest does not match the binding")
+	}
+	canonical, err := canonicalAgentExecutionSnapshotBody(body)
+	if err != nil || !bytes.Equal(canonical, snapshot.Body) {
+		return errors.New("harness v1 execution snapshot body is not canonical")
+	}
+	if binding.SchemaVersion != 1 || binding.ContractVersion != corev1alpha1.AgentRuntimeContractHarnessV1 ||
+		body.ContractVersion != string(binding.ContractVersion) || body.Backend != string(binding.Backend) ||
+		body.HarnessV1.Backend != string(binding.Backend) || binding.Agent == nil ||
+		body.Agent.Namespace != binding.Agent.Namespace || body.Agent.Name != binding.Agent.Name ||
+		body.Agent.UID != string(binding.Agent.UID) || body.Agent.Generation != binding.Agent.Generation {
+		return errors.New("harness v1 snapshot route or Agent identity does not exactly match the binding")
+	}
+	if _, err := harness.NewClient(body.HarnessV1.Endpoint); err != nil {
+		return fmt.Errorf("validate frozen harness v1 endpoint: %w", err)
+	}
+	if body.HarnessV1.AuthSecretNamespace == "" || body.HarnessV1.AuthSecretName == "" ||
+		body.HarnessV1.AuthSecretKey == "" || body.HarnessV1.AuthSecretUID == "" ||
+		body.HarnessV1.AuthSecretResourceVersion == "" || body.HarnessV1.SessionName == "" {
+		return errors.New("harness v1 snapshot has incomplete frozen endpoint/auth/session identity")
+	}
+	if err := validateFrozenHarnessV1ToolGovernance(body); err != nil {
+		return err
+	}
+	if err := validateFrozenHarnessV1SessionInput(body); err != nil {
+		return err
+	}
+	if body.HarnessV1.RuntimeAuthOnly {
+		if body.HarnessV1.Backend != string(corev1alpha1.AgentExecutionBackendHarnessWrapper) ||
+			len(body.HarnessV1.CredentialRefs) == 0 {
+			return errors.New("harness v1 runtime-auth-only snapshot is not bound to the built-in wrapper and frozen credentials")
+		}
+		switch corev1alpha1.AgentRuntimeType(body.RuntimeType) {
+		case corev1alpha1.AgentRuntimeCodex, corev1alpha1.AgentRuntimeClaude:
+		default:
+			return errors.New("harness v1 runtime-auth-only snapshot uses an unsupported runtime")
+		}
+	}
+	if err := validateFrozenHarnessV1PublicReadOnlyWorkspace(body); err != nil {
+		return err
+	}
+	if body.RetryPolicy != nil {
+		if body.RetryPolicy.MaxRetries < 0 ||
+			(body.RetryPolicy.InitialDelay != nil && body.RetryPolicy.InitialDelay.Duration < 0) {
+			return errors.New("harness v1 snapshot has an invalid frozen retry policy")
+		}
+		if body.RetryPolicy.MaxRetries > 0 && !body.HarnessV1.DuplicateSafe {
+			return errors.New("harness v1 snapshot retry policy is not duplicate-safe")
+		}
+	}
+	return nil
+}
+
+//nolint:gocyclo // Snapshot validation intentionally checks every frozen Session field in one boundary.
+func validateFrozenHarnessV1SessionInput(body agentExecutionSnapshotBody) error {
+	if body.HarnessV1 == nil {
+		return errors.New("harness v1 target metadata is required")
+	}
+	ref := body.SessionRef
+	bootstrap := body.HarnessV1.SessionBootstrap
+	if ref == nil {
+		if bootstrap != nil {
+			return errors.New("harness v1 snapshot has a Session bootstrap without a SessionRef")
+		}
+		return nil
+	}
+	if bootstrap == nil {
+		return errors.New("harness v1 snapshot is missing its frozen Session identity/bootstrap")
+	}
+	if body.HarnessV1.SessionName != strings.TrimSpace(ref.Name) {
+		return errors.New("harness v1 snapshot Session name does not match its frozen SessionRef")
+	}
+	limits, err := harnessV1SessionBootstrapLimits(bootstrap.SchemaVersion)
+	if err != nil {
+		return err
+	}
+	if err := store.ValidateControlIdentifier("frozen harness v1 Session UID", bootstrap.SessionUID); err != nil {
+		return err
+	}
+	if bootstrap.ControlVersion < 0 || bootstrap.LeaseGeneration < 0 ||
+		(bootstrap.ControlVersion == 0 && bootstrap.LeaseGeneration != 0) {
+		return errors.New("harness v1 snapshot has an invalid frozen Session control revision")
+	}
+	if bootstrap.ControlVersion == 0 && (!ref.Create || bootstrap.MessageCount != 0 ||
+		bootstrap.TotalMessages != 0 || bootstrap.Truncated || bootstrap.Artifact != "") {
+		return errors.New("new harness v1 Session bootstrap must freeze an empty create-only transcript")
+	}
+	if strings.TrimSpace(body.Prompt) == "" {
+		return errors.New("harness v1 snapshot has an empty frozen Session prompt")
+	}
+	if ref.PromptIncluded && strings.TrimSpace(ref.ThroughMessageID) == "" {
+		return errors.New("prompt-included harness v1 snapshot is missing its through-message ID")
+	}
+	requiresTranscript := ref.Append || ref.PromptIncluded
+	minimumTotal := int(bootstrap.MessageCount)
+	if ref.PromptIncluded {
+		minimumTotal++
+	}
+	if (!requiresTranscript && (bootstrap.MessageCount != 0 || bootstrap.TotalMessages != 0 || bootstrap.Truncated)) ||
+		bootstrap.TotalMessages < minimumTotal || bootstrap.TotalMessages > acpSessionReferenceMaxMessages(ref) {
+		return errors.New("harness v1 snapshot has inconsistent Session bootstrap message counts")
+	}
+	artifact := []byte(bootstrap.Artifact)
+	if bootstrap.MessageCount == 0 {
+		if len(artifact) != 0 {
+			return errors.New("empty harness v1 Session bootstrap has a non-empty artifact")
+		}
+	} else if len(artifact) == 0 || artifact[len(artifact)-1] != '\n' {
+		return errors.New("harness v1 Session bootstrap artifact is incomplete")
+	}
+	lines := bytes.Split(artifact, []byte{'\n'})
+	if len(lines) > 0 && len(lines[len(lines)-1]) == 0 {
+		lines = lines[:len(lines)-1]
+	}
+	if len(lines) != int(bootstrap.MessageCount) {
+		return errors.New("harness v1 Session bootstrap artifact count does not match its metadata")
+	}
+	messages := make([]store.SessionMessage, 0, len(lines))
+	for _, line := range lines {
+		canonicalLine := append(append([]byte(nil), line...), '\n')
+		message, err := decodeACPBootstrapLine(canonicalLine)
+		if err != nil {
+			return fmt.Errorf("validate frozen harness v1 Session bootstrap: %w", err)
+		}
+		messages = append(messages, store.SessionMessage{
+			Role: message.Role, Content: message.Content, Name: message.Name, ToolCallID: message.ToolCallID,
+		})
+	}
+	rebuilt, err := buildACPBootstrapTranscript(messages, limits)
+	if err != nil {
+		return fmt.Errorf("validate frozen harness v1 Session bootstrap bounds: %w", err)
+	}
+	if !bytes.Equal(rebuilt.Artifact, artifact) || rebuilt.Digest != bootstrap.Digest ||
+		rebuilt.MessageCount != bootstrap.MessageCount {
+		return errors.New("harness v1 Session bootstrap artifact is not canonical or digest-consistent")
+	}
+	return nil
+}
+
+func (r *TaskReconciler) loadVerifiedHarnessV1Execution(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	binding *corev1alpha1.AgentExecutionBinding,
+) (*verifiedHarnessV1Execution, error) {
+	return r.loadHarnessV1ExecutionWithOptions(ctx, task, binding, false, true)
+}
+
+// loadVerifiedHarnessV1ExecutionForRecovery performs the same immutable
+// binding/snapshot/Secret verification as admission, while permitting the v1
+// dispatcher to observe, cancel, and settle already-admitted work after Task
+// deletion or after the backend enters disabled mode. Callers must not use the
+// relaxed flags to submit a new turn.
+//
+//nolint:gocyclo // Recovery verification mirrors the complete immutable v1 admission boundary.
+func (r *TaskReconciler) loadVerifiedHarnessV1ExecutionForRecovery(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	binding *corev1alpha1.AgentExecutionBinding,
+	allowDeleting bool,
+) (*verifiedHarnessV1Execution, error) {
+	return r.loadHarnessV1ExecutionWithOptions(ctx, task, binding, allowDeleting, true)
+}
+
+// loadHarnessV1ExecutionForSettlement validates only immutable Task,
+// namespace, binding, and encrypted-snapshot authority. Terminal
+// Session/outbox settlement does not read live Agent/configuration objects and
+// does not require credentials that are no longer used for executor effects.
+func (d *HarnessV1Dispatcher) loadHarnessV1ExecutionForSettlement(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	binding *corev1alpha1.AgentExecutionBinding,
+) (*verifiedHarnessV1Execution, error) {
+	verifier := TaskReconciler{
+		Client: d.Client, APIReader: d.APIReader, AgentExecutionSnapshots: d.Snapshots,
+	}
+	return verifier.loadHarnessV1ExecutionWithOptions(ctx, task, binding, true, false)
+}
+
+//nolint:gocyclo // The options separate executor authorization from terminal-only settlement verification.
+func (r *TaskReconciler) loadHarnessV1ExecutionWithOptions(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	binding *corev1alpha1.AgentExecutionBinding,
+	allowDeleting bool,
+	verifySecrets bool,
+) (*verifiedHarnessV1Execution, error) {
+	if r.AgentExecutionSnapshots == nil || task == nil || binding == nil {
+		return nil, errors.New("task, v1 binding, and encrypted snapshot store are required")
+	}
+	reader := r.APIReader
+	if reader == nil {
+		reader = r.Client
+	}
+	current := &corev1alpha1.Task{}
+	if err := reader.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, current); err != nil {
+		return nil, fmt.Errorf("uncached Task read before harness v1 dispatch: %w", err)
+	}
+	if current.UID != task.UID || (!allowDeleting && !current.DeletionTimestamp.IsZero()) || current.Generation != binding.Task.BoundSpecGeneration ||
+		current.Status.AgentExecutionBinding == nil || current.Status.AgentExecutionBinding.BindingDigest != binding.BindingDigest {
+		return nil, errors.New("task identity, generation, deletion state, or persisted harness v1 binding changed")
+	}
+	canonicalDigest, err := canonicalAgentExecutionBindingDigest(*current.Status.AgentExecutionBinding)
+	if err != nil || canonicalDigest != binding.BindingDigest {
+		return nil, errors.New("persisted harness v1 binding failed canonical integrity verification")
+	}
+	namespace := &corev1.Namespace{}
+	if err := reader.Get(ctx, types.NamespacedName{Name: current.Namespace}, namespace); err != nil {
+		return nil, err
+	}
+	if namespace.UID == "" || namespace.UID != binding.Task.NamespaceUID {
+		return nil, errors.New("harness v1 binding namespace identity is invalid")
+	}
+	if binding.ContractVersion != corev1alpha1.AgentRuntimeContractHarnessV1 ||
+		(binding.Backend != corev1alpha1.AgentExecutionBackendHarnessWrapper && binding.Backend != corev1alpha1.AgentExecutionBackendExternalEndpoint) {
+		return nil, errors.New("binding is not dispatchable by HarnessV1Dispatcher")
+	}
+	snapshot, err := r.AgentExecutionSnapshots.GetAgentExecutionSnapshot(ctx, store.AgentExecutionSnapshotKey{
+		TaskUID: string(binding.Task.UID), Digest: binding.Snapshot.Digest,
+	})
+	if err != nil {
+		return nil, err
+	}
+	body, err := decodeAgentExecutionSnapshot(snapshot.Body)
+	if err != nil {
+		return nil, err
+	}
+	if err := validateHarnessV1Snapshot(binding, snapshot, body); err != nil {
+		return nil, err
+	}
+	if verifySecrets {
+		allRefs := append([]agentExecutionSnapshotSecretRef(nil), body.HarnessV1.CredentialRefs...)
+		allRefs = append(allRefs, agentExecutionSnapshotSecretRef{
+			Role: "harness-auth", Namespace: body.HarnessV1.AuthSecretNamespace,
+			Name: body.HarnessV1.AuthSecretName, UID: body.HarnessV1.AuthSecretUID,
+			ResourceVersion: body.HarnessV1.AuthSecretResourceVersion, Keys: []string{body.HarnessV1.AuthSecretKey},
+		})
+		for _, ref := range allRefs {
+			secret := &corev1.Secret{}
+			if err := reader.Get(ctx, types.NamespacedName{Namespace: ref.Namespace, Name: ref.Name}, secret); err != nil {
+				return nil, fmt.Errorf("read frozen %s Secret identity: %w", ref.Role, err)
+			}
+			if string(secret.UID) != ref.UID || secret.ResourceVersion != ref.ResourceVersion {
+				return nil, fmt.Errorf("frozen %s Secret identity or resourceVersion changed", ref.Role)
+			}
+			for _, key := range ref.Keys {
+				if len(secret.Data[key]) == 0 {
+					return nil, fmt.Errorf("frozen %s Secret key %q is empty or missing", ref.Role, key)
+				}
+			}
+		}
+	}
+	return &verifiedHarnessV1Execution{
+		binding: binding.DeepCopy(), snapshot: snapshot, body: body,
+		frozenTask: frozenTaskFromAgentExecutionSnapshot(current, binding, body),
+	}, nil
+}
+
+func (r *TaskReconciler) ensureHarnessV1ExecutionBinding(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	agent *corev1alpha1.Agent,
+) (ctrl.Result, error, bool) {
+	log := logf.FromContext(ctx)
+	if task == nil {
+		return ctrl.Result{}, errors.New("task is required for harness v1 execution binding"), true
+	}
+	reader := r.APIReader
+	if reader == nil {
+		reader = r.Client
+	}
+	if task.Status.AgentExecutionBinding == nil {
+		current := &corev1alpha1.Task{}
+		if err := reader.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, current); err != nil {
+			return ctrl.Result{RequeueAfter: 2 * time.Second}, nil, true
+		}
+		if current.UID != task.UID {
+			return ctrl.Result{}, errors.New("task UID changed before harness v1 binding"), true
+		}
+		task = current
+	}
+	if existing := task.Status.AgentExecutionBinding; existing != nil {
+		if _, err := r.loadVerifiedHarnessV1Execution(ctx, task, existing); err != nil {
+			log.Error(err, "harness v1 bound execution verification failed")
+			return ctrl.Result{RequeueAfter: 5 * time.Second}, nil, true
+		}
+		return ctrl.Result{}, nil, false
+	}
+
+	candidate, err := r.resolveHarnessV1ExecutionCandidate(ctx, task, agent)
+	if err != nil {
+		if isPermanentHarnessV1CandidateError(err) {
+			result, failErr := r.failTask(ctx, task, err.Error())
+			return result, failErr, true
+		}
+		log.Error(err, "harness v1 execution candidate resolution failed")
+		return ctrl.Result{RequeueAfter: 5 * time.Second}, nil, true
+	}
+	if err := r.persistAgentExecutionSnapshot(ctx, task, candidate); err != nil {
+		log.Error(err, "harness v1 immutable snapshot persistence failed")
+		return ctrl.Result{RequeueAfter: 5 * time.Second}, nil, true
+	}
+	binding, err := r.persistAgentExecutionBinding(ctx, task, candidate)
+	if err != nil {
+		conflict := &errAgentExecutionBindingConflict{}
+		if errors.As(err, &conflict) {
+			result, failErr := r.failTask(ctx, task, err.Error())
+			return result, failErr, true
+		}
+		if isPermanentHarnessV1CandidateError(err) {
+			result, failErr := r.failTask(ctx, task, err.Error())
+			return result, failErr, true
+		}
+		return ctrl.Result{RequeueAfter: 2 * time.Second}, nil, true
+	}
+	task.Status.AgentExecutionBinding = binding
+	if _, err := r.loadVerifiedHarnessV1Execution(ctx, task, binding); err != nil {
+		log.Error(err, "verify harness v1 binding after persistence")
+		return ctrl.Result{RequeueAfter: 5 * time.Second}, nil, true
+	}
+	return ctrl.Result{}, nil, false
+}
+
+func (r *TaskReconciler) queueHarnessV1Task(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+) (ctrl.Result, error) {
+	if r.HarnessV1Attempts == nil || r.ControllerEpochManager == nil {
+		return r.failTask(ctx, task, "durable harness v1 attempt store and controller epoch manager are required")
+	}
+	binding := task.Status.AgentExecutionBinding
+	verified, err := r.loadVerifiedHarnessV1Execution(ctx, task, binding)
+	if err != nil {
+		return ctrl.Result{RequeueAfter: 5 * time.Second}, nil
+	}
+	existing, err := r.HarnessV1Attempts.ListHarnessV1AttemptsByTask(ctx, task.Namespace, string(task.UID))
+	if err != nil {
+		return ctrl.Result{}, err
+	}
+	if len(existing) != 0 {
+		latest := existing[len(existing)-1]
+		if latest.BindingDigest != binding.BindingDigest || latest.SnapshotDigest != binding.Snapshot.Digest {
+			return r.failTask(ctx, task, "durable harness v1 attempt does not match the immutable binding")
+		}
+		if task.Status.Phase != corev1alpha1.TaskPhaseRunning && !store.IsTerminalHarnessV1AttemptState(latest.State) {
+			if err := r.patchHarnessV1QueuedStatus(ctx, task, verified, &latest); err != nil {
+				return ctrl.Result{}, err
+			}
+		}
+		return ctrl.Result{RequeueAfter: time.Second}, nil
+	}
+
+	const attemptNumber int32 = 1
+	turnID := harnessV1TurnID(task, attemptNumber)
+	runtimeSessionID := harness.ResolveRuntimeSessionIdentity(harness.RuntimeSessionIdentityInput{
+		Namespace: task.Namespace, TaskName: task.Name, TaskUID: string(task.UID),
+		SessionName: func() string {
+			if task.Spec.SessionRef != nil {
+				return strings.TrimSpace(task.Spec.SessionRef.Name)
+			}
+			return ""
+		}(),
+		RuntimeName: verified.body.HarnessV1.RuntimeName, ActiveTask: task.Name,
+		AgentName: verified.body.Agent.Name, Provider: harness.ProviderKindKubernetesService,
+	}).ID
+	fence, err := r.ControllerEpochManager.CurrentFence(ctx)
+	if err != nil {
+		return ctrl.Result{}, err
+	}
+	retryClass := store.HarnessV1RetryClassNone
+	if verified.body.HarnessV1.DuplicateSafe {
+		retryClass = store.HarnessV1RetryClassDuplicateSafe
+	}
+	attempt := &store.HarnessV1Attempt{
+		Namespace: task.Namespace, TaskName: task.Name, TaskUID: string(task.UID), Attempt: attemptNumber,
+		BindingDigest: binding.BindingDigest, SnapshotDigest: binding.Snapshot.Digest,
+		TurnID: string(turnID), RuntimeSessionID: string(runtimeSessionID),
+		CorrelationID: string(task.UID), Backend: string(binding.Backend),
+		BackendEndpoint:           verified.body.HarnessV1.Endpoint,
+		AuthSecretNamespace:       verified.body.HarnessV1.AuthSecretNamespace,
+		AuthSecretName:            verified.body.HarnessV1.AuthSecretName,
+		AuthSecretKey:             verified.body.HarnessV1.AuthSecretKey,
+		AuthSecretUID:             verified.body.HarnessV1.AuthSecretUID,
+		AuthSecretResourceVersion: verified.body.HarnessV1.AuthSecretResourceVersion,
+		State:                     store.HarnessV1AttemptPrepared, DuplicateSafe: verified.body.HarnessV1.DuplicateSafe,
+		RetryClass: retryClass, ControllerEpochName: fence.Name, ControllerEpoch: fence.Epoch,
+	}
+	reader := r.APIReader
+	if reader == nil {
+		reader = r.Client
+	}
+	env, err := resolveFrozenHarnessV1Env(ctx, reader, verified.body.HarnessV1.CredentialRefs)
+	if err != nil {
+		return ctrl.Result{}, err
+	}
+	request, err := buildHarnessV1StartTurnRequest(task, verified, attempt, env)
+	if err != nil {
+		return ctrl.Result{}, err
+	}
+	attempt.RequestDigest, err = harness.CanonicalStartTurnRequestDigest(request)
+	if err != nil {
+		return ctrl.Result{}, err
+	}
+	if err := r.HarnessV1Attempts.CreateHarnessV1Attempt(ctx, attempt, fence); err != nil {
+		return ctrl.Result{}, err
+	}
+	if err := r.patchHarnessV1QueuedStatus(ctx, task, verified, attempt); err != nil {
+		return ctrl.Result{}, err
+	}
+	return ctrl.Result{RequeueAfter: time.Second}, nil
+}
+
+func (r *TaskReconciler) patchHarnessV1QueuedStatus(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	verified *verifiedHarnessV1Execution,
+	attempt *store.HarnessV1Attempt,
+) error {
+	if attempt == nil {
+		return errors.New("harness v1 queued attempt is required")
+	}
+	now := metav1.Now()
+	target := verified.body.HarnessV1
+	return r.updateStatusWithRetry(ctx, task, func(current *corev1alpha1.Task) {
+		if current.UID != task.UID || current.Status.AgentExecutionBinding == nil ||
+			current.Status.AgentExecutionBinding.BindingDigest != verified.binding.BindingDigest ||
+			(current.Status.Phase != corev1alpha1.TaskPhasePending && current.Status.Phase != corev1alpha1.TaskPhaseRunning) {
+			return
+		}
+		current.Status.Phase = corev1alpha1.TaskPhaseRunning
+		if current.Status.StartTime == nil {
+			current.Status.StartTime = &now
+		}
+		current.Status.Attempts = attempt.Attempt
+		current.Status.JobName = ""
+		current.Status.Message = "queued for harness v1 dispatcher"
+		current.Status.HarnessRuntime = &corev1alpha1.HarnessRuntimeStatus{
+			RuntimeName: target.RuntimeName, ContractVersion: harness.ProtocolVersion,
+			Endpoint: target.Endpoint, AuthRefName: target.AuthSecretName,
+			AuthRefField: target.AuthSecretKey, AuthRefResourceVersion: target.AuthSecretResourceVersion,
+			Attempt: attempt.Attempt, TurnID: attempt.TurnID, RuntimeSessionID: attempt.RuntimeSessionID,
+			State: corev1alpha1.TaskExecutionStateQueued, RequestDigest: attempt.RequestDigest,
+			ControllerEpoch: attempt.ControllerEpoch, Message: "queued for harness v1 dispatcher",
+			LastTransitionTime: &now,
+		}
+		if verified.binding.RuntimeRef != nil {
+			current.Status.HarnessRuntime.RuntimeRefName = verified.binding.RuntimeRef.Name
+			current.Status.HarnessRuntime.RuntimeGeneration = verified.binding.RuntimeRef.Generation
+		}
+	})
+}
+
+func harnessV1TurnID(task *corev1alpha1.Task, attempt int32) harness.HarnessTurnID {
+	identity := task.Namespace + "/" + task.Name + "/" + string(task.UID) + "/" + strconv.FormatInt(int64(attempt), 10)
+	sum := sha256.Sum256([]byte(identity))
+	prefix := strings.ToLower(strings.Trim(task.Name, "-_."))
+	if prefix == "" {
+		prefix = "turn"
+	}
+	if len(prefix) > 40 {
+		prefix = prefix[:40]
+	}
+	return harness.HarnessTurnID(fmt.Sprintf("%s-%s-%d", prefix, hex.EncodeToString(sum[:])[:12], attempt))
+}
diff --git a/internal/controller/harness_v1_binding_test.go b/internal/controller/harness_v1_binding_test.go
new file mode 100644
index 000000000..be02e2d92
--- /dev/null
+++ b/internal/controller/harness_v1_binding_test.go
@@ -0,0 +1,1341 @@
+package controller
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/utils/ptr"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/harness"
+	"github.com/orka-agents/orka/internal/labels"
+	"github.com/orka-agents/orka/internal/store"
+	"github.com/orka-agents/orka/internal/store/sqlite"
+)
+
+type harnessV1CandidateErrorReader struct {
+	client.Reader
+	get func(client.ObjectKey, client.Object) error
+}
+
+type harnessV1SessionControlSequenceStore struct {
+	store.DurableControlStore
+	controls []*store.SessionControl
+	reads    int
+}
+
+type harnessV1LineageControlStore struct {
+	store.DurableControlStore
+	lineages map[string]*store.SessionLineage
+}
+
+func (s *harnessV1LineageControlStore) GetSessionControl(
+	ctx context.Context,
+	namespace, sessionName string,
+) (*store.SessionControl, error) {
+	control, err := s.DurableControlStore.GetSessionControl(ctx, namespace, sessionName)
+	if err != nil {
+		return nil, err
+	}
+	if lineage := s.lineages[namespace+"\x00"+sessionName]; lineage != nil {
+		copyLineage := *lineage
+		control.Lineage = &copyLineage
+	}
+	return control, nil
+}
+
+func (s *harnessV1SessionControlSequenceStore) GetSessionControl(
+	ctx context.Context,
+	namespace, sessionName string,
+) (*store.SessionControl, error) {
+	if s.reads >= len(s.controls) {
+		return s.DurableControlStore.GetSessionControl(ctx, namespace, sessionName)
+	}
+	control := s.controls[s.reads]
+	s.reads++
+	if control == nil {
+		return nil, store.ErrNotFound
+	}
+	copyControl := *control
+	if control.Lease != nil {
+		copyLease := *control.Lease
+		copyControl.Lease = &copyLease
+	}
+	return &copyControl, nil
+}
+
+type harnessV1BindingResponseLostClient struct {
+	client.Client
+	lost bool
+}
+
+func (c *harnessV1BindingResponseLostClient) Status() client.SubResourceWriter {
+	return &harnessV1BindingResponseLostWriter{
+		SubResourceWriter: c.Client.Status(),
+		parent:            c,
+	}
+}
+
+type harnessV1BindingResponseLostWriter struct {
+	client.SubResourceWriter
+	parent *harnessV1BindingResponseLostClient
+}
+
+func (w *harnessV1BindingResponseLostWriter) Patch(
+	ctx context.Context,
+	object client.Object,
+	patch client.Patch,
+	options ...client.SubResourcePatchOption,
+) error {
+	if err := w.SubResourceWriter.Patch(ctx, object, patch, options...); err != nil {
+		return err
+	}
+	task, ok := object.(*corev1alpha1.Task)
+	if !ok || task.Status.AgentExecutionBinding == nil || w.parent.lost {
+		return nil
+	}
+	w.parent.lost = true
+	return errors.New("simulated binding status response loss")
+}
+
+func (r *harnessV1CandidateErrorReader) Get(
+	ctx context.Context,
+	key client.ObjectKey,
+	object client.Object,
+	options ...client.GetOption,
+) error {
+	if r.get != nil {
+		if err := r.get(key, object); err != nil {
+			return err
+		}
+	}
+	return r.Reader.Get(ctx, key, object, options...)
+}
+
+func TestEnsureHarnessV1ExecutionBindingRequeuesTransientCandidateErrors(t *testing.T) {
+	tests := []struct {
+		name      string
+		intercept func(client.Object) bool
+	}{
+		{
+			name: "wrapper auth Secret API read",
+			intercept: func(object client.Object) bool {
+				_, ok := object.(*corev1.Secret)
+				return ok
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			ctx := context.Background()
+			fixture := newHarnessV1CandidateFixture(t)
+			transientErr := errors.New("temporary Kubernetes API outage")
+			fixture.reconciler.APIReader = &harnessV1CandidateErrorReader{
+				Reader: fixture.reconciler.Client,
+				get: func(_ client.ObjectKey, object client.Object) error {
+					if test.intercept(object) {
+						return transientErr
+					}
+					return nil
+				},
+			}
+
+			result, err, handled := fixture.reconciler.ensureHarnessV1ExecutionBinding(
+				ctx, fixture.task.DeepCopy(), fixture.agent,
+			)
+			if err != nil || !handled || result.RequeueAfter != 5*time.Second {
+				t.Fatalf("ensure binding = result=%#v handled=%v err=%v, want five-second requeue", result, handled, err)
+			}
+			current := &corev1alpha1.Task{}
+			if err := fixture.reconciler.Get(ctx, client.ObjectKeyFromObject(fixture.task), current); err != nil {
+				t.Fatal(err)
+			}
+			if current.Status.Phase == corev1alpha1.TaskPhaseFailed || current.Status.AgentExecutionBinding != nil {
+				t.Fatalf("transient resolution error terminalized or bound Task: %#v", current.Status)
+			}
+		})
+	}
+}
+
+func TestEnsureHarnessV1ExecutionBindingRecoversCommittedPatchAfterResponseLoss(t *testing.T) {
+	ctx := context.Background()
+	fixture := newHarnessV1CandidateFixture(t)
+	baseClient := fixture.reconciler.Client
+	lostClient := &harnessV1BindingResponseLostClient{Client: baseClient}
+	fixture.reconciler.Client = lostClient
+
+	_, err, handled := fixture.reconciler.ensureHarnessV1ExecutionBinding(
+		ctx, fixture.task.DeepCopy(), fixture.agent,
+	)
+	if err != nil || handled {
+		t.Fatalf("ensure binding ambiguity recovery = handled=%v err=%v", handled, err)
+	}
+	if !lostClient.lost {
+		t.Fatal("test client did not simulate a committed status patch with a lost response")
+	}
+	bound := &corev1alpha1.Task{}
+	if err := baseClient.Get(ctx, client.ObjectKeyFromObject(fixture.task), bound); err != nil {
+		t.Fatal(err)
+	}
+	if bound.Status.AgentExecutionBinding == nil {
+		t.Fatal("committed binding was not recovered after the response was lost")
+	}
+}
+
+func TestResolveHarnessV1ExecutionCandidateMarksSpecViolationPermanent(t *testing.T) {
+	ctx := context.Background()
+	fixture := newHarnessV1CandidateFixture(t)
+	task := fixture.task.DeepCopy()
+	task.Spec.Workspace = &corev1alpha1.WorkspaceConfig{}
+
+	_, err := fixture.reconciler.resolveHarnessV1ExecutionCandidate(ctx, task, fixture.agent)
+	if err == nil || !isPermanentHarnessV1CandidateError(err) {
+		t.Fatalf("workspace violation error = %v, permanent=%v", err, isPermanentHarnessV1CandidateError(err))
+	}
+}
+
+func TestResolveHarnessV1ExecutionCandidateFreezesBoundedSessionTranscript(t *testing.T) {
+	ctx := context.Background()
+	fixture := newHarnessV1CandidateFixture(t)
+	const sessionName = "continued-session"
+	seedHarnessV1BindingTranscript(t, ctx, fixture, sessionName, defaultACPSessionType, []store.SessionMessage{
+		{ID: "message-1", Role: "user", Content: "old request"},
+		{ID: "message-2", Role: "assistant", Content: "old response"},
+		{ID: "message-3", Role: "user", Content: "recent request"},
+	})
+	task := fixture.task.DeepCopy()
+	task.Spec.SessionRef = &corev1alpha1.SessionReference{
+		Name: sessionName, Append: true, MaxMessages: 2,
+	}
+	control, err := fixture.controls.GetSessionControl(ctx, task.Namespace, sessionName)
+	if err != nil {
+		t.Fatal(err)
+	}
+	sequence := &harnessV1SessionControlSequenceStore{
+		DurableControlStore: fixture.controls,
+		controls:            []*store.SessionControl{control, control},
+	}
+	fixture.reconciler.DurableControlStore = sequence
+
+	candidate, err := fixture.reconciler.resolveHarnessV1ExecutionCandidate(ctx, task, fixture.agent)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var body agentExecutionSnapshotBody
+	if err := json.Unmarshal(candidate.snapshotBody, &body); err != nil {
+		t.Fatal(err)
+	}
+	bootstrap := body.HarnessV1.SessionBootstrap
+	if bootstrap == nil || bootstrap.SchemaVersion != harnessV1SessionBootstrapSchemaVersion ||
+		bootstrap.SessionUID != control.SessionUID || bootstrap.ControlVersion != control.Version ||
+		bootstrap.LeaseGeneration != control.LeaseGeneration || bootstrap.MessageCount != 2 ||
+		bootstrap.TotalMessages != 2 || sequence.reads != 2 {
+		t.Fatalf("frozen Session bootstrap = %#v, want bounded two-message suffix", bootstrap)
+	}
+	if body.Prompt != task.Spec.Prompt || strings.Contains(bootstrap.Artifact, "old request") ||
+		!strings.Contains(bootstrap.Artifact, "old response") || !strings.Contains(bootstrap.Artifact, "recent request") {
+		t.Fatalf("frozen Session input = prompt %q bootstrap %q", body.Prompt, bootstrap.Artifact)
+	}
+	if err := validateFrozenHarnessV1SessionInput(body); err != nil {
+		t.Fatalf("validate frozen Session input: %v", err)
+	}
+}
+
+func TestResolveHarnessV1ExecutionCandidateRejectsSessionControlRace(t *testing.T) {
+	ctx := context.Background()
+	fixture := newHarnessV1CandidateFixture(t)
+	const sessionName = "racing-session"
+	seedHarnessV1BindingTranscript(t, ctx, fixture, sessionName, defaultACPSessionType, []store.SessionMessage{
+		{ID: "message-1", Role: "user", Content: "stable request"},
+	})
+	task := fixture.task.DeepCopy()
+	task.Spec.SessionRef = &corev1alpha1.SessionReference{Name: sessionName, Append: true}
+	control, err := fixture.controls.GetSessionControl(ctx, task.Namespace, sessionName)
+	if err != nil {
+		t.Fatal(err)
+	}
+	advanced := *control
+	advanced.Version++
+	fixture.reconciler.DurableControlStore = &harnessV1SessionControlSequenceStore{
+		DurableControlStore: fixture.controls,
+		controls:            []*store.SessionControl{control, &advanced},
+	}
+
+	if _, err := fixture.reconciler.resolveHarnessV1ExecutionCandidate(ctx, task, fixture.agent); err == nil ||
+		!errors.Is(err, store.ErrConflict) {
+		t.Fatalf("Session control race error = %v, want ErrConflict", err)
+	}
+}
+
+func TestResolveHarnessV1ExecutionCandidateKeepsReplacementRaceTransient(t *testing.T) {
+	ctx := context.Background()
+	fixture := newHarnessV1CandidateFixture(t)
+	const sessionName = "replaced-session"
+	seedHarnessV1BindingTranscript(t, ctx, fixture, sessionName, defaultACPSessionType, []store.SessionMessage{
+		{ID: "message-1", Role: "user", Content: "stable request"},
+	})
+	task := fixture.task.DeepCopy()
+	task.Spec.SessionRef = &corev1alpha1.SessionReference{Name: sessionName, Append: true}
+	control, err := fixture.controls.GetSessionControl(ctx, task.Namespace, sessionName)
+	if err != nil {
+		t.Fatal(err)
+	}
+	replacement := *control
+	replacement.SessionUID = "replacement-session-uid"
+	replacement.Lineage = nil
+	fixture.reconciler.DurableControlStore = &harnessV1SessionControlSequenceStore{
+		DurableControlStore: fixture.controls,
+		controls:            []*store.SessionControl{control, &replacement},
+	}
+
+	candidate, err := fixture.reconciler.resolveHarnessV1ExecutionCandidate(ctx, task, fixture.agent)
+	if candidate != nil || err == nil || !errors.Is(err, store.ErrConflict) || isPermanentHarnessV1CandidateError(err) {
+		t.Fatalf("replacement race candidate = %#v, error = %v, want transient ErrConflict", candidate, err)
+	}
+}
+
+func TestResolveHarnessV1ExecutionCandidateFreezesNewSessionUID(t *testing.T) {
+	ctx := context.Background()
+	fixture := newHarnessV1CandidateFixture(t)
+	task := fixture.task.DeepCopy()
+	task.Spec.SessionRef = &corev1alpha1.SessionReference{
+		Name: "new-session", Create: true, Append: true,
+	}
+
+	candidate, err := fixture.reconciler.resolveHarnessV1ExecutionCandidate(ctx, task, fixture.agent)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var body agentExecutionSnapshotBody
+	if err := json.Unmarshal(candidate.snapshotBody, &body); err != nil {
+		t.Fatal(err)
+	}
+	bootstrap := body.HarnessV1.SessionBootstrap
+	if bootstrap == nil || bootstrap.SchemaVersion != harnessV1SessionBootstrapSchemaVersion ||
+		strings.TrimSpace(bootstrap.SessionUID) == "" || bootstrap.ControlVersion != 0 ||
+		bootstrap.LeaseGeneration != 0 || bootstrap.MessageCount != 0 || bootstrap.TotalMessages != 0 ||
+		bootstrap.Artifact != "" {
+		t.Fatalf("new Session bootstrap = %#v, want frozen UID at V0/G0 with empty transcript", bootstrap)
+	}
+	if err := validateFrozenHarnessV1SessionInput(body); err != nil {
+		t.Fatalf("validate new Session bootstrap: %v", err)
+	}
+}
+
+func TestResolveHarnessV1ExecutionCandidateRejectsControlLessTranscriptAdoption(t *testing.T) {
+	ctx := context.Background()
+	fixture := newHarnessV1CandidateFixture(t)
+	const sessionName = "legacy-transcript"
+	transcripts := fixture.reconciler.SessionManager.store
+	now := time.Now().UTC()
+	if err := transcripts.CreateSession(ctx, &store.SessionRecord{
+		Namespace: fixture.task.Namespace, Name: sessionName, SessionType: defaultACPSessionType,
+		CreatedAt: now, UpdatedAt: now,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if err := transcripts.AppendMessages(ctx, fixture.task.Namespace, sessionName, []store.SessionMessage{
+		{ID: "legacy-message", Role: "user", Content: "unclassified history", Timestamp: now},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	task := fixture.task.DeepCopy()
+	task.Spec.SessionRef = &corev1alpha1.SessionReference{Name: sessionName, Create: true, Append: true}
+
+	if _, err := fixture.reconciler.resolveHarnessV1ExecutionCandidate(ctx, task, fixture.agent); err == nil ||
+		!errors.Is(err, store.ErrConflict) {
+		t.Fatalf("control-less transcript adoption error = %v, want ErrConflict", err)
+	}
+}
+
+func TestResolveHarnessV1ExecutionCandidateRejectsUnclassifiedExistingTranscript(t *testing.T) {
+	ctx := context.Background()
+	fixture := newHarnessV1CandidateFixture(t)
+	const sessionName = "unclassified-session"
+	transcripts := fixture.reconciler.SessionManager.store
+	now := time.Now().UTC()
+	if err := transcripts.CreateSession(ctx, &store.SessionRecord{
+		Namespace: fixture.task.Namespace, Name: sessionName, SessionType: defaultACPSessionType,
+		CreatedAt: now, UpdatedAt: now,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := fixture.controls.CreateSessionControl(ctx, &store.SessionControl{
+		Namespace: fixture.task.Namespace, SessionName: sessionName,
+		SessionUID:    "unclassified-session-uid",
+		RequestDigest: store.CanonicalAgentExecutionSnapshotDigest([]byte("unclassified-session-control")),
+		Availability:  store.SessionAvailable, CreatedAt: now, UpdatedAt: now,
+	}, fixture.fence); err != nil {
+		t.Fatal(err)
+	}
+	if err := transcripts.AppendMessages(ctx, fixture.task.Namespace, sessionName, []store.SessionMessage{{
+		ID: "legacy-message", Role: "user", Content: "unclassified history", Timestamp: now,
+	}}); err != nil {
+		t.Fatal(err)
+	}
+	task := fixture.task.DeepCopy()
+	task.Spec.SessionRef = &corev1alpha1.SessionReference{Name: sessionName, Append: true}
+
+	candidate, err := fixture.reconciler.resolveHarnessV1ExecutionCandidate(ctx, task, fixture.agent)
+	if candidate != nil || err == nil || !errors.Is(err, store.ErrConflict) || !isPermanentHarnessV1CandidateError(err) {
+		t.Fatalf("unclassified Session candidate = %#v, error = %v, want permanent ErrConflict", candidate, err)
+	}
+}
+
+func TestResolveHarnessV1ExecutionCandidateRejectsIncompatibleExistingLineage(t *testing.T) {
+	tests := []struct {
+		name   string
+		mutate func(*store.SessionLineage)
+	}{
+		{
+			name: "v2 contract",
+			mutate: func(lineage *store.SessionLineage) {
+				lineage.ContractVersion = string(corev1alpha1.AgentRuntimeContractHarnessV2)
+			},
+		},
+		{
+			name: "different v1 configuration",
+			mutate: func(lineage *store.SessionLineage) {
+				lineage.ConfigDigest = store.CanonicalAgentExecutionSnapshotDigest([]byte("different-v1-configuration"))
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			ctx := context.Background()
+			fixture := newHarnessV1CandidateFixture(t)
+			const sessionName = "incompatible-lineage"
+			seedHarnessV1BindingTranscript(t, ctx, fixture, sessionName, defaultACPSessionType, []store.SessionMessage{
+				{ID: "message-1", Role: "user", Content: "existing request"},
+			})
+			lineage := fixture.lineageControls.lineages[fixture.task.Namespace+"\x00"+sessionName]
+			test.mutate(lineage)
+			task := fixture.task.DeepCopy()
+			task.Spec.SessionRef = &corev1alpha1.SessionReference{Name: sessionName, Append: true}
+
+			candidate, err := fixture.reconciler.resolveHarnessV1ExecutionCandidate(ctx, task, fixture.agent)
+			if candidate != nil || err == nil || !errors.Is(err, store.ErrConflict) || !isPermanentHarnessV1CandidateError(err) {
+				t.Fatalf("incompatible-lineage candidate = %#v, error = %v, want permanent ErrConflict", candidate, err)
+			}
+		})
+	}
+}
+
+func TestResolveHarnessV1ExecutionCandidateFreezesPromptIncludedCutoff(t *testing.T) {
+	ctx := context.Background()
+	fixture := newHarnessV1CandidateFixture(t)
+	const (
+		sessionName   = "gateway-session"
+		currentPrompt = "answer the canonical gateway message"
+	)
+	throughMessageID := store.GatewayUserMessageID("event-current")
+	seedHarnessV1BindingTranscript(t, ctx, fixture, sessionName, store.SessionTypeGateway, []store.SessionMessage{
+		{ID: "gateway:prior:user", Role: "user", Content: "earlier request"},
+		{ID: "gateway:prior:assistant", Role: "assistant", Content: "earlier response"},
+		{ID: throughMessageID, Role: "user", Content: currentPrompt},
+		{ID: store.GatewayUserMessageID("event-later"), Role: "user", Content: "later queued request"},
+	})
+	task := fixture.task.DeepCopy()
+	task.Spec.Prompt = ""
+	task.Spec.SessionRef = &corev1alpha1.SessionReference{
+		Name: sessionName, Append: false, MaxMessages: int32(store.GatewayTranscriptMessageLimit),
+		ThroughMessageID: throughMessageID, PromptIncluded: true,
+	}
+
+	candidate, err := fixture.reconciler.resolveHarnessV1ExecutionCandidate(ctx, task, fixture.agent)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var body agentExecutionSnapshotBody
+	if err := json.Unmarshal(candidate.snapshotBody, &body); err != nil {
+		t.Fatal(err)
+	}
+	bootstrap := body.HarnessV1.SessionBootstrap
+	if body.Prompt != currentPrompt || bootstrap == nil || bootstrap.MessageCount != 2 || bootstrap.TotalMessages != 3 {
+		t.Fatalf("frozen prompt-included Session input = prompt %q bootstrap %#v", body.Prompt, bootstrap)
+	}
+	if strings.Contains(bootstrap.Artifact, currentPrompt) || strings.Contains(bootstrap.Artifact, "later queued request") ||
+		!strings.Contains(bootstrap.Artifact, "earlier response") {
+		t.Fatalf("prompt-included bootstrap crossed its cutoff or duplicated the current prompt: %q", bootstrap.Artifact)
+	}
+	if err := validateFrozenHarnessV1SessionInput(body); err != nil {
+		t.Fatalf("validate frozen prompt-included Session input: %v", err)
+	}
+}
+
+func TestResolveHarnessV1ExecutionCandidateRejectsMissingPromptCutoff(t *testing.T) {
+	ctx := context.Background()
+	fixture := newHarnessV1CandidateFixture(t)
+	seedHarnessV1BindingTranscript(t, ctx, fixture, "gateway-session", store.SessionTypeGateway, nil)
+	task := fixture.task.DeepCopy()
+	task.Spec.Prompt = ""
+	task.Spec.SessionRef = &corev1alpha1.SessionReference{
+		Name: "gateway-session", Append: false, MaxMessages: int32(store.GatewayTranscriptMessageLimit),
+		ThroughMessageID: store.GatewayUserMessageID("missing"), PromptIncluded: true,
+	}
+
+	if _, err := fixture.reconciler.resolveHarnessV1ExecutionCandidate(ctx, task, fixture.agent); err == nil ||
+		!errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("missing canonical prompt cutoff error = %v, want ErrNotFound", err)
+	}
+}
+
+func TestResolveHarnessV1ExecutionCandidateRejectsCopilotPermanently(t *testing.T) {
+	ctx := context.Background()
+	fixture := newHarnessV1CandidateFixture(t)
+	agent := fixture.agent.DeepCopy()
+	agent.Spec.Runtime.Type = corev1alpha1.AgentRuntimeCopilot
+
+	candidate, err := fixture.reconciler.resolveHarnessV1ExecutionCandidate(ctx, fixture.task, agent)
+	if candidate != nil || err == nil || !isPermanentHarnessV1CandidateError(err) ||
+		!strings.Contains(err.Error(), "GitHub mutation-capable credential") {
+		t.Fatalf("Copilot candidate = %#v, error = %v, want permanent safe-credential rejection", candidate, err)
+	}
+}
+
+func TestResolveHarnessV1TargetRequiresSupportedToolMode(t *testing.T) {
+	const (
+		endpoint   = "https://runtime.example.invalid"
+		runtimeKey = "token"
+	)
+	tests := []struct {
+		name         string
+		capabilities *corev1alpha1.AgentRuntimeObservedCapabilities
+		wantError    string
+	}{
+		{name: "missing capabilities", wantError: "supported tool execution mode"},
+		{
+			name:         "missing modes",
+			capabilities: &corev1alpha1.AgentRuntimeObservedCapabilities{},
+			wantError:    "supported tool execution mode",
+		},
+		{
+			name: "incomplete brokered mode",
+			capabilities: &corev1alpha1.AgentRuntimeObservedCapabilities{
+				ToolExecutionModes: []corev1alpha1.AgentRuntimeToolExecutionMode{
+					corev1alpha1.AgentRuntimeToolExecutionModeBrokered,
+				},
+			},
+			wantError: "requires continuation and brokered tool classes",
+		},
+		{
+			name: "observed only",
+			capabilities: &corev1alpha1.AgentRuntimeObservedCapabilities{
+				ToolExecutionModes: []corev1alpha1.AgentRuntimeToolExecutionMode{
+					corev1alpha1.AgentRuntimeToolExecutionModeObserved,
+				},
+			},
+		},
+		{
+			name: "brokered only",
+			capabilities: &corev1alpha1.AgentRuntimeObservedCapabilities{
+				ToolExecutionModes: []corev1alpha1.AgentRuntimeToolExecutionMode{
+					corev1alpha1.AgentRuntimeToolExecutionModeBrokered,
+				},
+				SupportsContinuation: true,
+				BrokeredToolClasses: []corev1alpha1.AgentRuntimeBrokeredToolClass{
+					corev1alpha1.AgentRuntimeBrokeredToolClassRead,
+				},
+			},
+		},
+		{
+			name: "observed and brokered",
+			capabilities: &corev1alpha1.AgentRuntimeObservedCapabilities{
+				ToolExecutionModes: []corev1alpha1.AgentRuntimeToolExecutionMode{
+					corev1alpha1.AgentRuntimeToolExecutionModeObserved,
+					corev1alpha1.AgentRuntimeToolExecutionModeBrokered,
+				},
+				SupportsContinuation: true,
+				BrokeredToolClasses: []corev1alpha1.AgentRuntimeBrokeredToolClass{
+					corev1alpha1.AgentRuntimeBrokeredToolClassRead,
+				},
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			runtime := &corev1alpha1.AgentRuntime{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: "default", Name: "external-v1", UID: types.UID("external-v1-uid"), Generation: 1,
+				},
+				Spec: corev1alpha1.AgentRuntimeRegistrySpec{
+					ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV1),
+					Deployment: corev1alpha1.AgentRuntimeDeploymentSpec{
+						Mode: corev1alpha1.AgentRuntimeDeploymentModeExternalEndpoint, Endpoint: endpoint,
+					},
+					ClientAuth: corev1alpha1.AgentRuntimeClientAuth{
+						BearerAuthRef: &corev1alpha1.AgentRuntimeBearerAuthReference{Name: "external-v1-auth", Key: runtimeKey},
+					},
+				},
+				Status: corev1alpha1.AgentRuntimeStatus{
+					Ready: true, ObservedGeneration: 1, ObservedAuthRefResourceVersion: "1",
+					ObservedCapabilities: test.capabilities,
+				},
+			}
+			secret := &corev1.Secret{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: runtime.Namespace, Name: runtime.Spec.ClientAuth.BearerAuthRef.Name,
+					UID: types.UID("external-v1-auth-uid"), ResourceVersion: "1",
+					Labels: map[string]string{
+						agentRuntimeAuthUseLabel: scheduledRunLabelValue, agentRuntimeAuthRefNameLabel: runtime.Name,
+					},
+					Annotations: map[string]string{agentRuntimeAuthEndpointAnnotation: endpoint},
+				},
+				Data: map[string][]byte{runtimeKey: []byte("runtime-auth-value")},
+			}
+			reconciler, _ := newBindingTestReconciler(t, runtime, secret)
+			task := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{Namespace: runtime.Namespace}}
+			agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+				RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: runtime.Name},
+			}}}
+
+			target, err := reconciler.resolveHarnessV1Target(t.Context(), reconciler.Client, task, agent)
+			if test.wantError != "" {
+				if err == nil || !strings.Contains(err.Error(), test.wantError) {
+					t.Fatalf("resolve target = %#v, error = %v, want rejection containing %q", target, err, test.wantError)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatal(err)
+			}
+			if target.runtimeRef == nil || target.runtimeRef.Name != runtime.Name ||
+				target.backend != corev1alpha1.AgentExecutionBackendExternalEndpoint {
+				t.Fatalf("resolved target = %#v, want external AgentRuntime %q", target, runtime.Name)
+			}
+			if !slices.Equal(target.toolExecutionModes, test.capabilities.ToolExecutionModes) ||
+				target.supportsContinuation != test.capabilities.SupportsContinuation ||
+				!slices.Equal(target.brokeredToolClasses, test.capabilities.BrokeredToolClasses) {
+				t.Fatalf("resolved target capabilities = modes=%v continuation=%v classes=%v, want %#v",
+					target.toolExecutionModes, target.supportsContinuation, target.brokeredToolClasses, test.capabilities)
+			}
+		})
+	}
+}
+
+func TestResolveHarnessV1ExecutionCandidateFreezesBrokeredToolAuthority(t *testing.T) {
+	ctx := context.Background()
+	fixture := newHarnessV1CandidateFixture(t)
+	const (
+		runtimeName     = "external-brokered-v1"
+		runtimeEndpoint = "https://runtime.example.invalid"
+		runtimeAuthKey  = "token"
+		toolName        = "lookup"
+		toolEndpoint    = "https://tools.example.invalid/lookup"
+	)
+
+	runtimeAuth := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: fixture.task.Namespace, Name: runtimeName + "-auth",
+			UID: types.UID(runtimeName + "-auth-uid"),
+			Labels: map[string]string{
+				agentRuntimeAuthUseLabel: scheduledRunLabelValue, agentRuntimeAuthRefNameLabel: runtimeName,
+			},
+			Annotations: map[string]string{agentRuntimeAuthEndpointAnnotation: runtimeEndpoint},
+		},
+		Data: map[string][]byte{runtimeAuthKey: []byte("external-runtime-auth-value")},
+	}
+	runtime := &corev1alpha1.AgentRuntime{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: fixture.task.Namespace, Name: runtimeName,
+			UID: types.UID(runtimeName + "-uid"), Generation: 1,
+		},
+		Spec: corev1alpha1.AgentRuntimeRegistrySpec{
+			ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV1),
+			Deployment: corev1alpha1.AgentRuntimeDeploymentSpec{
+				Mode: corev1alpha1.AgentRuntimeDeploymentModeExternalEndpoint, Endpoint: runtimeEndpoint,
+			},
+			ClientAuth: corev1alpha1.AgentRuntimeClientAuth{BearerAuthRef: &corev1alpha1.AgentRuntimeBearerAuthReference{
+				Name: runtimeAuth.Name, Key: runtimeAuthKey,
+			}},
+		},
+		Status: corev1alpha1.AgentRuntimeStatus{
+			Ready: true, ObservedGeneration: 1,
+			ObservedCapabilities: &corev1alpha1.AgentRuntimeObservedCapabilities{
+				RuntimeName: runtimeName,
+				ToolExecutionModes: []corev1alpha1.AgentRuntimeToolExecutionMode{
+					corev1alpha1.AgentRuntimeToolExecutionModeBrokered,
+				},
+				SupportsContinuation: true,
+				BrokeredToolClasses: []corev1alpha1.AgentRuntimeBrokeredToolClass{
+					corev1alpha1.AgentRuntimeBrokeredToolClassRead,
+				},
+			},
+		},
+	}
+	parameters := []byte(`{"type":"object","properties":{"query":{"type":"string"}},"required":["query"]}`)
+	tool := &corev1alpha1.Tool{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: fixture.task.Namespace, Name: toolName,
+			UID: types.UID(toolName + "-uid"), Generation: 1,
+		},
+		Spec: corev1alpha1.ToolSpec{
+			Description: "look up a value", BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassRead,
+			Parameters: &apiextensionsv1.JSON{Raw: parameters},
+			HTTP:       &corev1alpha1.HTTPExecution{URL: toolEndpoint, Method: "POST"},
+		},
+	}
+	if err := fixture.reconciler.Create(ctx, runtimeAuth); err != nil {
+		t.Fatal(err)
+	}
+	currentRuntimeAuth := &corev1.Secret{}
+	if err := fixture.reconciler.Get(ctx, client.ObjectKeyFromObject(runtimeAuth), currentRuntimeAuth); err != nil {
+		t.Fatal(err)
+	}
+	runtime.Status.ObservedAuthRefResourceVersion = currentRuntimeAuth.ResourceVersion
+	for _, object := range []client.Object{runtime, tool} {
+		if err := fixture.reconciler.Create(ctx, object); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	task := &corev1alpha1.Task{}
+	if err := fixture.reconciler.Get(ctx, client.ObjectKeyFromObject(fixture.task), task); err != nil {
+		t.Fatal(err)
+	}
+	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{toolName}}
+	if err := fixture.reconciler.Update(ctx, task); err != nil {
+		t.Fatal(err)
+	}
+	agent := fixture.agent.DeepCopy()
+	agent.Spec.Runtime.RuntimeRef = &corev1alpha1.AgentRuntimeReference{Name: runtime.Name}
+	agent.Spec.Runtime.DefaultAllowedTools = nil
+	agent.Spec.Runtime.DefaultAllowBash = nil
+
+	candidate, err := fixture.reconciler.resolveHarnessV1ExecutionCandidate(ctx, task, agent)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var body agentExecutionSnapshotBody
+	if err := json.Unmarshal(candidate.snapshotBody, &body); err != nil {
+		t.Fatal(err)
+	}
+	currentTool := &corev1alpha1.Tool{}
+	if err := fixture.reconciler.Get(ctx, client.ObjectKeyFromObject(tool), currentTool); err != nil {
+		t.Fatal(err)
+	}
+	wantDefinitionDigest, err := harnessV1BrokeredToolDefinitionDigest(currentTool)
+	if err != nil {
+		t.Fatal(err)
+	}
+	assertHarnessV1BrokeredCandidateRoute(t, candidate, runtime)
+	frozenTool := assertHarnessV1BrokeredSnapshot(
+		t, candidate.snapshotBody, body, currentTool, parameters, wantDefinitionDigest, toolEndpoint,
+	)
+
+	if result, err, handled := fixture.reconciler.ensureHarnessV1ExecutionBinding(ctx, task.DeepCopy(), agent); err != nil || handled {
+		t.Fatalf("ensure brokered binding = result=%#v handled=%v err=%v", result, handled, err)
+	}
+	bound := &corev1alpha1.Task{}
+	if err := fixture.reconciler.Get(ctx, client.ObjectKeyFromObject(task), bound); err != nil {
+		t.Fatal(err)
+	}
+	if bound.Status.AgentExecutionBinding == nil || bound.Status.AgentExecutionBinding.BindingDigest == "" {
+		t.Fatalf("persisted brokered binding = %#v", bound.Status.AgentExecutionBinding)
+	}
+	verified, err := fixture.reconciler.loadVerifiedHarnessV1Execution(
+		ctx, bound, bound.Status.AgentExecutionBinding,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	attempt := &store.HarnessV1Attempt{
+		Namespace: bound.Namespace, TaskName: bound.Name, TaskUID: string(bound.UID), Attempt: 1,
+		BindingDigest:  bound.Status.AgentExecutionBinding.BindingDigest,
+		SnapshotDigest: bound.Status.AgentExecutionBinding.Snapshot.Digest,
+		TurnID:         "brokered-turn", RuntimeSessionID: "brokered-runtime-session",
+		CorrelationID: string(bound.UID),
+	}
+	request, err := buildHarnessV1StartTurnRequest(bound, verified, attempt, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	assertHarnessV1BrokeredStartTurn(t, request, frozenTool)
+}
+
+func assertHarnessV1BrokeredCandidateRoute(
+	t *testing.T,
+	candidate *agentExecutionCandidate,
+	runtime *corev1alpha1.AgentRuntime,
+) {
+	t.Helper()
+	if candidate.binding.Backend != corev1alpha1.AgentExecutionBackendExternalEndpoint ||
+		candidate.binding.RuntimeRef == nil || candidate.binding.RuntimeRef.Name != runtime.Name ||
+		candidate.binding.RuntimeRef.UID != runtime.UID || candidate.binding.RuntimeRef.Generation != runtime.Generation {
+		t.Fatalf("brokered candidate binding route = %#v", candidate.binding)
+	}
+}
+
+func assertHarnessV1BrokeredSnapshot(
+	t *testing.T,
+	snapshotBody []byte,
+	body agentExecutionSnapshotBody,
+	currentTool *corev1alpha1.Tool,
+	parameters []byte,
+	wantDefinitionDigest string,
+	toolEndpoint string,
+) agentExecutionSnapshotHarnessV1BrokeredTool {
+	t.Helper()
+	if body.HarnessV1 == nil || body.HarnessV1.ToolExecutionMode != string(harness.ToolExecutionModeBrokered) ||
+		!slices.Equal(body.HarnessV1.BrokeredToolClasses, []corev1alpha1.AgentRuntimeBrokeredToolClass{
+			corev1alpha1.AgentRuntimeBrokeredToolClassRead,
+		}) || len(body.HarnessV1.BrokeredTools) != 1 {
+		t.Fatalf("frozen brokered governance = %#v", body.HarnessV1)
+	}
+	frozenTool := body.HarnessV1.BrokeredTools[0]
+	if frozenTool.Name != currentTool.Name || frozenTool.Description != currentTool.Spec.Description ||
+		frozenTool.BrokeredClass != currentTool.Spec.BrokeredToolClass ||
+		!jsonEqual(frozenTool.Parameters, parameters) || frozenTool.UID != string(currentTool.UID) ||
+		frozenTool.Generation != currentTool.Generation || frozenTool.DefinitionDigest != wantDefinitionDigest {
+		t.Fatalf("frozen Tool authority = %#v, want Tool %s/%s at %s", frozenTool, currentTool.Namespace, currentTool.Name, wantDefinitionDigest)
+	}
+	if strings.Contains(string(snapshotBody), toolEndpoint) ||
+		strings.Contains(string(snapshotBody), "external-runtime-auth-value") {
+		t.Fatal("brokered snapshot exposed Tool execution or runtime credential material")
+	}
+	return frozenTool
+}
+
+func assertHarnessV1BrokeredStartTurn(
+	t *testing.T,
+	request harness.StartTurnRequest,
+	frozenTool agentExecutionSnapshotHarnessV1BrokeredTool,
+) {
+	t.Helper()
+	if request.ToolExecutionMode != harness.ToolExecutionModeBrokered || len(request.Input.Tools) != 1 ||
+		request.Metadata["brokeredToolClasses"] != string(corev1alpha1.AgentRuntimeBrokeredToolClassRead) {
+		t.Fatalf("brokered StartTurn = %#v", request)
+	}
+	definition := request.Input.Tools[0]
+	if definition.Name != frozenTool.Name || definition.Description != frozenTool.Description ||
+		definition.BrokeredClass != harness.BrokeredToolClass(frozenTool.BrokeredClass) ||
+		!jsonEqual(definition.Parameters, frozenTool.Parameters) {
+		t.Fatalf("brokered StartTurn Tool definition = %#v, want frozen %#v", definition, frozenTool)
+	}
+}
+
+func jsonEqual(left, right []byte) bool {
+	var leftValue any
+	var rightValue any
+	return json.Unmarshal(left, &leftValue) == nil && json.Unmarshal(right, &rightValue) == nil &&
+		fmt.Sprint(leftValue) == fmt.Sprint(rightValue)
+}
+
+func TestResolveHarnessV1TargetRevalidatesTLSForReadyRuntime(t *testing.T) {
+	const (
+		endpoint   = "http://runtime.default.svc:8080"
+		runtimeKey = "token"
+	)
+	runtime := &corev1alpha1.AgentRuntime{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "default", Name: "stale-ready-v1", UID: types.UID("stale-ready-v1-uid"), Generation: 1,
+		},
+		Spec: corev1alpha1.AgentRuntimeRegistrySpec{
+			ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV1),
+			Deployment: corev1alpha1.AgentRuntimeDeploymentSpec{
+				Mode: corev1alpha1.AgentRuntimeDeploymentModeExternalEndpoint, Endpoint: endpoint,
+			},
+			ClientAuth: corev1alpha1.AgentRuntimeClientAuth{
+				BearerAuthRef: &corev1alpha1.AgentRuntimeBearerAuthReference{Name: "stale-ready-v1-auth", Key: runtimeKey},
+			},
+		},
+		Status: corev1alpha1.AgentRuntimeStatus{
+			Ready: true, ObservedGeneration: 1, ObservedAuthRefResourceVersion: "1",
+			ObservedCapabilities: &corev1alpha1.AgentRuntimeObservedCapabilities{
+				ToolExecutionModes: []corev1alpha1.AgentRuntimeToolExecutionMode{
+					corev1alpha1.AgentRuntimeToolExecutionModeObserved,
+				},
+			},
+		},
+	}
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: runtime.Namespace, Name: runtime.Spec.ClientAuth.BearerAuthRef.Name,
+			UID: types.UID("stale-ready-v1-auth-uid"), ResourceVersion: "1",
+		},
+		Data: map[string][]byte{runtimeKey: []byte("runtime-auth-value")},
+	}
+	reconciler, _ := newBindingTestReconciler(t, runtime, secret)
+	task := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{Namespace: runtime.Namespace}}
+	agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+		RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: runtime.Name},
+	}}}
+
+	target, err := reconciler.resolveHarnessV1Target(t.Context(), reconciler.Client, task, agent)
+	if err == nil || !strings.Contains(err.Error(), "must use https") {
+		t.Fatalf("resolve target = %#v, error = %v, want stale Ready cleartext rejection", target, err)
+	}
+}
+
+func TestResolveHarnessV1ExecutionCandidateFreezesRuntimeAuthOnly(t *testing.T) {
+	ctx := context.Background()
+	fixture := newHarnessV1CandidateFixture(t)
+	credential := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: fixture.task.Namespace, Name: "runtime-auth-credentials",
+			UID: types.UID("runtime-auth-credentials-uid"),
+		},
+		Data: map[string][]byte{"OPENAI_API_KEY": []byte("runtime-auth-secret-value")},
+	}
+	if err := fixture.reconciler.Create(ctx, credential); err != nil {
+		t.Fatal(err)
+	}
+	fixture.agent.Spec.SecretRef = &corev1.LocalObjectReference{Name: credential.Name}
+	task := fixture.task.DeepCopy()
+	task.Annotations = map[string]string{labels.AnnotationAgentRuntimeAuthOnly: scheduledRunLabelValue}
+
+	candidate, err := fixture.reconciler.resolveHarnessV1ExecutionCandidate(ctx, task, fixture.agent)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var body agentExecutionSnapshotBody
+	if err := json.Unmarshal(candidate.snapshotBody, &body); err != nil {
+		t.Fatal(err)
+	}
+	if body.HarnessV1 == nil || !body.HarnessV1.RuntimeAuthOnly {
+		t.Fatalf("frozen harness v1 metadata = %#v, want runtimeAuthOnly", body.HarnessV1)
+	}
+	if strings.Contains(string(candidate.snapshotBody), "runtime-auth-secret-value") {
+		t.Fatal("encrypted snapshot plaintext body retained a raw provider credential")
+	}
+
+	unprotectedTask := task.DeepCopy()
+	delete(unprotectedTask.Annotations, labels.AnnotationAgentRuntimeAuthOnly)
+	unprotected, err := fixture.reconciler.resolveHarnessV1ExecutionCandidate(ctx, unprotectedTask, fixture.agent)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if unprotected.binding.Snapshot.Digest == candidate.binding.Snapshot.Digest {
+		t.Fatal("runtime-auth-only annotation did not change the immutable snapshot digest")
+	}
+}
+
+func TestResolveHarnessV1CredentialRefsAllowlistsRuntimeProviderKeys(t *testing.T) {
+	ctx := context.Background()
+	fixture := newHarnessV1CandidateFixture(t)
+	tests := []struct {
+		name        string
+		runtimeType corev1alpha1.AgentRuntimeType
+		data        map[string][]byte
+		wantKeys    []string
+	}{
+		{
+			name: "codex", runtimeType: corev1alpha1.AgentRuntimeCodex,
+			data: map[string][]byte{
+				"OPENAI_API_KEY":  []byte("codex-provider-key"),
+				"OPENAI_BASE_URL": []byte("https://provider.example.invalid"),
+			},
+			wantKeys: []string{"OPENAI_API_KEY", "OPENAI_BASE_URL"},
+		},
+		{
+			name: "claude", runtimeType: corev1alpha1.AgentRuntimeClaude,
+			data: map[string][]byte{
+				"ANTHROPIC_API_KEY":  []byte("claude-provider-key"),
+				"ANTHROPIC_BASE_URL": []byte("https://provider.example.invalid"),
+			},
+			wantKeys: []string{"ANTHROPIC_API_KEY", "ANTHROPIC_BASE_URL"},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			secret := &corev1.Secret{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: fixture.task.Namespace, Name: "provider-" + tt.name,
+					UID: types.UID("provider-" + tt.name + "-uid"),
+				},
+				Data: tt.data,
+			}
+			if err := fixture.reconciler.Create(ctx, secret); err != nil {
+				t.Fatal(err)
+			}
+			agent := fixture.agent.DeepCopy()
+			agent.Spec.Runtime.Type = tt.runtimeType
+			agent.Spec.SecretRef = &corev1.LocalObjectReference{Name: secret.Name}
+			refs, err := resolveHarnessV1CredentialRefs(
+				ctx, fixture.reconciler.Client, agent, resolvedHarnessV1Target{}, false,
+			)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if len(refs) != 1 || !slices.Equal(refs[0].Keys, tt.wantKeys) {
+				t.Fatalf("credential refs = %#v, want keys %v", refs, tt.wantKeys)
+			}
+		})
+	}
+}
+
+func TestResolveHarnessV1CredentialRefsRejectsFoundryOnlyForRuntimeAuthOnly(t *testing.T) {
+	ctx := context.Background()
+	fixture := newHarnessV1CandidateFixture(t)
+	tests := []struct {
+		name string
+		data map[string][]byte
+	}{
+		{
+			name: "Foundry flag",
+			data: map[string][]byte{
+				"CLAUDE_CODE_USE_FOUNDRY": []byte("true"),
+				"ANTHROPIC_API_KEY":       []byte("direct-provider-key"),
+			},
+		},
+		{
+			name: "Foundry key",
+			data: map[string][]byte{
+				"ANTHROPIC_FOUNDRY_API_KEY": []byte("foundry-provider-key"),
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			secret := &corev1.Secret{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: fixture.task.Namespace, Name: "provider-" + strings.ReplaceAll(strings.ToLower(test.name), " ", "-"),
+					UID: types.UID("provider-" + strings.ReplaceAll(strings.ToLower(test.name), " ", "-") + "-uid"),
+				},
+				Data: test.data,
+			}
+			if err := fixture.reconciler.Create(ctx, secret); err != nil {
+				t.Fatal(err)
+			}
+			agent := fixture.agent.DeepCopy()
+			agent.Spec.Runtime.Type = corev1alpha1.AgentRuntimeClaude
+			agent.Spec.SecretRef = &corev1.LocalObjectReference{Name: secret.Name}
+
+			if _, err := resolveHarnessV1CredentialRefs(
+				ctx, fixture.reconciler.Client, agent, resolvedHarnessV1Target{}, true,
+			); err == nil || !isPermanentHarnessV1CandidateError(err) || !strings.Contains(err.Error(), "does not support Azure AI Foundry") {
+				t.Fatalf("runtime-auth-only Foundry error = %v, want permanent early rejection", err)
+			}
+			refs, err := resolveHarnessV1CredentialRefs(
+				ctx, fixture.reconciler.Client, agent, resolvedHarnessV1Target{}, false,
+			)
+			if err != nil || len(refs) != 1 {
+				t.Fatalf("non-proxied Foundry refs = %#v, error = %v, want preserved support", refs, err)
+			}
+		})
+	}
+}
+
+func TestResolveHarnessV1CredentialRefsRejectsUnrelatedKeys(t *testing.T) {
+	ctx := context.Background()
+	fixture := newHarnessV1CandidateFixture(t)
+	for _, prohibitedKey := range []string{"GITHUB_TOKEN", "GIT_TOKEN", "KONTXT_TXN_TOKEN"} {
+		t.Run(prohibitedKey, func(t *testing.T) {
+			secret := &corev1.Secret{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: fixture.task.Namespace, Name: "provider-" + strings.ToLower(prohibitedKey),
+					UID: types.UID("provider-" + strings.ToLower(prohibitedKey) + "-uid"),
+				},
+				Data: map[string][]byte{
+					"OPENAI_API_KEY": []byte("provider-key"),
+					prohibitedKey:    []byte("unrelated-sensitive-value"),
+				},
+			}
+			if err := fixture.reconciler.Create(ctx, secret); err != nil {
+				t.Fatal(err)
+			}
+			agent := fixture.agent.DeepCopy()
+			agent.Spec.SecretRef = &corev1.LocalObjectReference{Name: secret.Name}
+			_, err := resolveHarnessV1CredentialRefs(
+				ctx, fixture.reconciler.Client, agent, resolvedHarnessV1Target{}, false,
+			)
+			if err == nil || !isPermanentHarnessV1CandidateError(err) || !strings.Contains(err.Error(), prohibitedKey) {
+				t.Fatalf("unrelated credential key error = %v, want permanent rejection mentioning %s", err, prohibitedKey)
+			}
+		})
+	}
+}
+
+func TestHarnessV1SessionLineageDigestExcludesTurnSnapshot(t *testing.T) {
+	binding := &corev1alpha1.AgentExecutionBinding{
+		ContractVersion: corev1alpha1.AgentRuntimeContractHarnessV1,
+		Backend:         corev1alpha1.AgentExecutionBackendHarnessWrapper,
+		RuntimeType:     corev1alpha1.AgentRuntimeCodex,
+		Agent: &corev1alpha1.AgentExecutionAgentRef{
+			Namespace: "default", Name: "agent", UID: types.UID("agent-uid"), Generation: 1,
+		},
+		Snapshot: corev1alpha1.AgentExecutionSnapshotRef{Digest: "sha256:" + strings.Repeat("b", 64)},
+	}
+	first, err := harnessV1SessionLineageConfigDigest(binding)
+	if err != nil {
+		t.Fatal(err)
+	}
+	secondTurn := *binding
+	secondTurn.Snapshot.Digest = "sha256:" + strings.Repeat("c", 64)
+	second, err := harnessV1SessionLineageConfigDigest(&secondTurn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if first != second {
+		t.Fatalf("turn-specific snapshots changed v1 Session lineage digest: %s != %s", first, second)
+	}
+	otherRuntime := secondTurn
+	otherRuntime.RuntimeType = corev1alpha1.AgentRuntimeClaude
+	third, err := harnessV1SessionLineageConfigDigest(&otherRuntime)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if third == first {
+		t.Fatal("runtime identity change did not change v1 Session lineage digest")
+	}
+}
+
+func TestValidateHarnessV1RuntimeAuthOnlyRejectsUnsupportedRoute(t *testing.T) {
+	task := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{
+		Annotations: map[string]string{labels.AnnotationAgentRuntimeAuthOnly: scheduledRunLabelValue},
+	}}
+	tests := []struct {
+		name       string
+		runtime    corev1alpha1.AgentRuntimeType
+		target     resolvedHarnessV1Target
+		wantReason string
+	}{
+		{
+			name: "external endpoint", runtime: corev1alpha1.AgentRuntimeCodex,
+			target: resolvedHarnessV1Target{
+				backend:    corev1alpha1.AgentExecutionBackendExternalEndpoint,
+				runtimeRef: &corev1alpha1.AgentRuntime{},
+			},
+			wantReason: "built-in wrapper",
+		},
+		{
+			name: "unsupported built-in runtime", runtime: corev1alpha1.AgentRuntimeCopilot,
+			target:     resolvedHarnessV1Target{backend: corev1alpha1.AgentExecutionBackendHarnessWrapper},
+			wantReason: "does not support runtime",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{
+				Runtime: &corev1alpha1.AgentCLIRuntime{Type: test.runtime},
+			}}
+			_, err := validateHarnessV1RuntimeAuthOnly(task, agent, test.target)
+			if err == nil || !isPermanentHarnessV1CandidateError(err) || !strings.Contains(err.Error(), test.wantReason) {
+				t.Fatalf("validate runtime-auth-only route error = %v, want permanent %q failure", err, test.wantReason)
+			}
+		})
+	}
+}
+
+func TestHandlePendingRoutesExpiredHarnessV1BindingBeforeACPTimeout(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	fixture := newHarnessV1CandidateFixture(t)
+
+	current := &corev1alpha1.Task{}
+	if err := fixture.reconciler.Get(ctx, client.ObjectKeyFromObject(fixture.task), current); err != nil {
+		t.Fatal(err)
+	}
+	timeout := metav1.Duration{Duration: time.Minute}
+	current.Spec.Timeout = &timeout
+	current.CreationTimestamp = metav1.NewTime(time.Now().UTC().Add(-2 * time.Minute))
+	if err := fixture.reconciler.Update(ctx, current); err != nil {
+		t.Fatal(err)
+	}
+	current.Status.Phase = corev1alpha1.TaskPhasePending
+	if err := fixture.reconciler.Status().Update(ctx, current); err != nil {
+		t.Fatal(err)
+	}
+	if err := fixture.reconciler.Get(ctx, client.ObjectKeyFromObject(fixture.task), current); err != nil {
+		t.Fatal(err)
+	}
+	fixture.task = current.DeepCopy()
+	if result, err, handled := fixture.reconciler.ensureHarnessV1ExecutionBinding(
+		ctx, current, fixture.agent,
+	); err != nil || handled {
+		t.Fatalf("establish harness v1 binding: result=%#v handled=%v err=%v", result, handled, err)
+	}
+	bound := &corev1alpha1.Task{}
+	if err := fixture.reconciler.Get(ctx, client.ObjectKeyFromObject(fixture.task), bound); err != nil {
+		t.Fatal(err)
+	}
+
+	attempts, ok := fixture.reconciler.AgentExecutionSnapshots.(*sqlite.Store)
+	if !ok {
+		t.Fatalf("snapshot store type = %T, want *sqlite.Store", fixture.reconciler.AgentExecutionSnapshots)
+	}
+	epochs, stopEpochs := startACPRecoveryEpochManager(t, ctx, attempts, "harness-v1-expired-routing")
+	defer stopEpochs()
+	fixture.reconciler.HarnessV1Attempts = attempts
+	fixture.reconciler.ControllerEpochManager = epochs
+
+	result, err := fixture.reconciler.handlePending(ctx, bound)
+	if err != nil {
+		t.Fatalf("handlePending: %v", err)
+	}
+	if result.RequeueAfter != time.Second {
+		t.Fatalf("handlePending result = %#v, want one-second harness v1 dispatch requeue", result)
+	}
+	updated := &corev1alpha1.Task{}
+	if err := fixture.reconciler.Get(ctx, client.ObjectKeyFromObject(bound), updated); err != nil {
+		t.Fatal(err)
+	}
+	if updated.Status.Execution != nil {
+		t.Fatalf("expired bound harness v1 Task received ACP execution status: %#v", updated.Status.Execution)
+	}
+	if updated.Status.Phase != corev1alpha1.TaskPhaseRunning || updated.Status.HarnessRuntime == nil ||
+		updated.Status.HarnessRuntime.State != corev1alpha1.TaskExecutionStateQueued {
+		t.Fatalf("expired bound harness v1 Task was not routed to its immutable plane: %#v", updated.Status)
+	}
+}
+
+type harnessV1CandidateFixture struct {
+	reconciler      *TaskReconciler
+	controls        store.DurableControlStore
+	lineageControls *harnessV1LineageControlStore
+	fence           store.ControllerEpochFence
+	task            *corev1alpha1.Task
+	agent           *corev1alpha1.Agent
+}
+
+func seedHarnessV1BindingTranscript(
+	t *testing.T,
+	ctx context.Context,
+	fixture *harnessV1CandidateFixture,
+	sessionName string,
+	sessionType string,
+	messages []store.SessionMessage,
+) {
+	t.Helper()
+	if fixture == nil || fixture.reconciler == nil || fixture.reconciler.SessionManager == nil {
+		t.Fatal("harness v1 binding fixture is missing its Session transcript store")
+	}
+	transcripts := fixture.reconciler.SessionManager.store
+	if err := transcripts.CreateSession(ctx, &store.SessionRecord{
+		Namespace: fixture.task.Namespace, Name: sessionName, SessionType: sessionType,
+		CreatedAt: time.Now().UTC(), UpdatedAt: time.Now().UTC(),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now().UTC()
+	control, err := fixture.controls.CreateSessionControl(ctx, &store.SessionControl{
+		Namespace: fixture.task.Namespace, SessionName: sessionName,
+		SessionUID:    "frozen-" + sessionName + "-uid",
+		RequestDigest: store.CanonicalAgentExecutionSnapshotDigest([]byte("session-control:" + sessionName)),
+		Availability:  store.SessionAvailable, CreatedAt: now, UpdatedAt: now,
+	}, fixture.fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	lineageConfigDigest, err := harnessV1SessionLineageConfigDigest(&corev1alpha1.AgentExecutionBinding{
+		ContractVersion: corev1alpha1.AgentRuntimeContractHarnessV1,
+		Backend:         corev1alpha1.AgentExecutionBackendHarnessWrapper,
+		RuntimeType:     fixture.agent.Spec.Runtime.Type,
+		Agent: &corev1alpha1.AgentExecutionAgentRef{
+			Namespace: fixture.agent.Namespace, Name: fixture.agent.Name,
+			UID: fixture.agent.UID, Generation: fixture.agent.Generation,
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	fixture.lineageControls.lineages[fixture.task.Namespace+"\x00"+sessionName] = &store.SessionLineage{
+		Namespace: fixture.task.Namespace, SessionName: sessionName,
+		NamespaceUID: "harness-v1-recovery-namespace-uid", SessionUID: control.SessionUID,
+		ContractVersion: string(corev1alpha1.AgentRuntimeContractHarnessV1), LineageGeneration: 1,
+		RuntimeIdentity: string(fixture.agent.Spec.Runtime.Type), ConfigDigest: lineageConfigDigest,
+		Version: 1, CreatedAt: now, UpdatedAt: now,
+	}
+	if len(messages) == 0 {
+		return
+	}
+	for index := range messages {
+		if messages[index].Timestamp.IsZero() {
+			messages[index].Timestamp = now.Add(time.Duration(index) * time.Millisecond)
+		}
+	}
+	if err := transcripts.AppendMessages(ctx, fixture.task.Namespace, sessionName, messages); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func newHarnessV1CandidateFixture(
+	t *testing.T,
+) *harnessV1CandidateFixture {
+	t.Helper()
+	const authSecretKey = "harness-auth"
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "default", Name: "harness-v1-recovery", UID: types.UID("harness-v1-recovery-task-uid"), Generation: 1,
+			Finalizers: []string{labels.TaskFinalizer},
+		},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent, Prompt: "continue admitted work",
+			AgentRef: &corev1alpha1.AgentReference{Name: "harness-v1-agent"},
+		},
+	}
+	namespace := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{
+		Name: task.Namespace, UID: types.UID("harness-v1-recovery-namespace-uid"),
+	}}
+	authSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: task.Namespace, Name: "harness-v1-auth",
+			UID: types.UID("harness-v1-auth-secret-uid"), ResourceVersion: "1",
+		},
+		Data: map[string][]byte{authSecretKey: []byte(strings.Repeat("t", 32))},
+	}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: task.Namespace, Name: task.Spec.AgentRef.Name,
+			UID: types.UID("harness-v1-recovery-agent-uid"), Generation: 1,
+		},
+		Spec: corev1alpha1.AgentSpec{
+			Model: &corev1alpha1.ModelConfig{Name: "test-model"},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type: corev1alpha1.AgentRuntimeCodex, ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV1),
+				DefaultAllowedTools: []string{}, DefaultAllowBash: new(false),
+			},
+		},
+	}
+
+	reconciler, durable := newBindingTestReconciler(t, task, namespace, authSecret)
+	fence := seedHarnessV1AttemptEpoch(t, durable)
+	reconciler.HarnessV1Endpoint = "http://harness-v1.default.svc:8080"
+	reconciler.HarnessV1AuthSecretNamespace = authSecret.Namespace
+	reconciler.HarnessV1AuthSecretName = authSecret.Name
+	reconciler.HarnessV1AuthSecretKey = authSecretKey
+	reconciler.SessionManager = NewSessionManager(durable)
+	lineageControls := &harnessV1LineageControlStore{
+		DurableControlStore: durable,
+		lineages:            make(map[string]*store.SessionLineage),
+	}
+	reconciler.DurableControlStore = lineageControls
+	return &harnessV1CandidateFixture{
+		reconciler:      reconciler,
+		controls:        lineageControls,
+		lineageControls: lineageControls,
+		fence:           fence,
+		task:            task,
+		agent:           agent,
+	}
+}
+
+func newHarnessV1RecoveryBindingFixture(
+	t *testing.T,
+	ctx context.Context,
+) (*TaskReconciler, *corev1alpha1.Task) {
+	t.Helper()
+	fixture := newHarnessV1CandidateFixture(t)
+	if result, err, handled := fixture.reconciler.ensureHarnessV1ExecutionBinding(
+		ctx, fixture.task.DeepCopy(), fixture.agent,
+	); err != nil || handled {
+		t.Fatalf("establish harness v1 recovery fixture binding: result=%#v handled=%v err=%v", result, handled, err)
+	}
+	bound := &corev1alpha1.Task{}
+	if err := fixture.reconciler.Get(ctx, client.ObjectKeyFromObject(fixture.task), bound); err != nil {
+		t.Fatal(err)
+	}
+	return fixture.reconciler, bound
+}
diff --git a/internal/controller/harness_v1_brokered.go b/internal/controller/harness_v1_brokered.go
new file mode 100644
index 000000000..00c63d53c
--- /dev/null
+++ b/internal/controller/harness_v1_brokered.go
@@ -0,0 +1,613 @@
+package controller
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"slices"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/google/jsonschema-go/jsonschema"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/harness"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+const maxHarnessV1BrokeredTools = 128
+
+const maxHarnessV1BrokeredToolResultBytes = 1 << 20
+
+// HarnessV1BrokeredToolExecutor is the controller-owned execution boundary for
+// Tool CRDs requested by an external harness v1 runtime. Implementations must
+// propagate request.IdempotencyKey to the downstream operation.
+type HarnessV1BrokeredToolExecutor interface {
+	ExecuteHarnessV1BrokeredTool(
+		context.Context,
+		string,
+		*corev1alpha1.Tool,
+		harness.ToolCallRequest,
+	) (json.RawMessage, error)
+}
+
+type HarnessV1BrokeredToolExecutorFunc func(
+	context.Context,
+	string,
+	*corev1alpha1.Tool,
+	harness.ToolCallRequest,
+) (json.RawMessage, error)
+
+func (f HarnessV1BrokeredToolExecutorFunc) ExecuteHarnessV1BrokeredTool(
+	ctx context.Context,
+	namespace string,
+	tool *corev1alpha1.Tool,
+	request harness.ToolCallRequest,
+) (json.RawMessage, error) {
+	return f(ctx, namespace, tool, request)
+}
+
+// agentExecutionSnapshotHarnessV1BrokeredTool is the safe, immutable schema
+// exposed to a brokered external runtime. Execution authority remains in Orka:
+// the live Tool object must retain this exact identity and definition digest.
+type agentExecutionSnapshotHarnessV1BrokeredTool struct {
+	Name             string                                     `json:"name"`
+	Description      string                                     `json:"description,omitempty"`
+	BrokeredClass    corev1alpha1.AgentRuntimeBrokeredToolClass `json:"brokeredClass"`
+	Parameters       json.RawMessage                            `json:"parameters"`
+	UID              string                                     `json:"uid"`
+	Generation       int64                                      `json:"generation"`
+	DefinitionDigest string                                     `json:"definitionDigest"`
+}
+
+type resolvedHarnessV1ToolGovernance struct {
+	mode    harness.ToolExecutionMode
+	classes []corev1alpha1.AgentRuntimeBrokeredToolClass
+	tools   []agentExecutionSnapshotHarnessV1BrokeredTool
+}
+
+func resolveHarnessV1ToolGovernance(
+	ctx context.Context,
+	reader client.Reader,
+	task *corev1alpha1.Task,
+	agent *corev1alpha1.Agent,
+	target resolvedHarnessV1Target,
+) (resolvedHarnessV1ToolGovernance, error) {
+	if task == nil || agent == nil || agent.Spec.Runtime == nil {
+		return resolvedHarnessV1ToolGovernance{}, errors.New("harness v1 tool governance requires Task, Agent, and runtime")
+	}
+	supportsObserved := slices.Contains(
+		target.toolExecutionModes,
+		corev1alpha1.AgentRuntimeToolExecutionModeObserved,
+	)
+	supportsBrokered := slices.Contains(
+		target.toolExecutionModes,
+		corev1alpha1.AgentRuntimeToolExecutionModeBrokered,
+	) && target.supportsContinuation
+	brokeredToolsRequested := task.Spec.AgentRuntime != nil && len(task.Spec.AgentRuntime.AllowedTools) > 0
+
+	if supportsBrokered && (brokeredToolsRequested || !supportsObserved || target.runtimeRef != nil) {
+		return resolveHarnessV1BrokeredTools(ctx, reader, task, agent, target)
+	}
+	if !supportsObserved {
+		if supportsBrokered {
+			return resolveHarnessV1BrokeredTools(ctx, reader, task, agent, target)
+		}
+		return resolvedHarnessV1ToolGovernance{}, permanentHarnessV1Candidate(
+			errors.New("harness v1 runtime does not expose an executable tool mode"),
+		)
+	}
+	if target.runtimeRef != nil {
+		return resolvedHarnessV1ToolGovernance{}, permanentHarnessV1Candidate(
+			errors.New("harness v1 external runtimes must use brokered tool execution"),
+		)
+	}
+	if err := validateHarnessV1ObservedToolPolicy(task, agent, target); err != nil {
+		return resolvedHarnessV1ToolGovernance{}, permanentHarnessV1Candidate(err)
+	}
+	return resolvedHarnessV1ToolGovernance{mode: harness.ToolExecutionModeObserved}, nil
+}
+
+func validateHarnessV1ObservedToolPolicy(
+	task *corev1alpha1.Task,
+	agent *corev1alpha1.Agent,
+	target resolvedHarnessV1Target,
+) error {
+	if target.runtimeRef != nil {
+		if agent.Spec.Runtime.DefaultAllowedTools != nil || agent.Spec.Runtime.DefaultAllowBash != nil {
+			return errors.New("observed external harness v1 runtimes reject built-in native tool policy metadata")
+		}
+		if task.Spec.AgentRuntime != nil && len(task.Spec.AgentRuntime.AllowedTools) != 0 {
+			return errors.New("observed external harness v1 runtimes do not accept brokered allowedTools")
+		}
+		if task.Spec.AgentRuntime == nil || task.Spec.AgentRuntime.AllowedTools == nil ||
+			task.Spec.AgentRuntime.AllowBash == nil || *task.Spec.AgentRuntime.AllowBash {
+			return errors.New("new harness v1 observed bindings require an explicit empty allowedTools list and allowBash=false")
+		}
+		return nil
+	}
+
+	allowed := agent.Spec.Runtime.DefaultAllowedTools
+	allowBash := agent.Spec.Runtime.DefaultAllowBash
+	if task.Spec.AgentRuntime != nil {
+		if task.Spec.AgentRuntime.AllowedTools != nil {
+			allowed = task.Spec.AgentRuntime.AllowedTools
+		}
+		if task.Spec.AgentRuntime.AllowBash != nil {
+			allowBash = task.Spec.AgentRuntime.AllowBash
+		}
+	}
+	if allowed == nil || len(allowed) != 0 || allowBash == nil || *allowBash {
+		return errors.New("new harness v1 observed bindings require an explicit empty allowedTools list and allowBash=false")
+	}
+	return nil
+}
+
+func resolveHarnessV1BrokeredTools(
+	ctx context.Context,
+	reader client.Reader,
+	task *corev1alpha1.Task,
+	agent *corev1alpha1.Agent,
+	target resolvedHarnessV1Target,
+) (resolvedHarnessV1ToolGovernance, error) {
+	if target.runtimeRef == nil || target.backend != corev1alpha1.AgentExecutionBackendExternalEndpoint {
+		return resolvedHarnessV1ToolGovernance{}, permanentHarnessV1Candidate(
+			errors.New("brokered harness v1 execution requires an external AgentRuntime"),
+		)
+	}
+	if !target.supportsContinuation {
+		return resolvedHarnessV1ToolGovernance{}, permanentHarnessV1Candidate(
+			errors.New("brokered harness v1 execution requires durable continuation support"),
+		)
+	}
+	if task.Spec.AgentRuntime == nil || task.Spec.AgentRuntime.AllowedTools == nil {
+		return resolvedHarnessV1ToolGovernance{}, permanentHarnessV1Candidate(
+			errors.New("brokered harness v1 execution requires an explicit task-level allowedTools list"),
+		)
+	}
+	if len(task.Spec.AgentRuntime.AllowedTools) > maxHarnessV1BrokeredTools {
+		return resolvedHarnessV1ToolGovernance{}, permanentHarnessV1Candidate(fmt.Errorf(
+			"brokered harness v1 allowedTools exceeds %d entries", maxHarnessV1BrokeredTools,
+		))
+	}
+	if len(agent.Spec.Runtime.DefaultAllowedTools) != 0 || agent.Spec.Runtime.DefaultAllowBash != nil ||
+		task.Spec.AgentRuntime.AllowBash != nil || len(task.Spec.AgentRuntime.DisallowedTools) != 0 {
+		return resolvedHarnessV1ToolGovernance{}, permanentHarnessV1Candidate(
+			errors.New("brokered harness v1 execution rejects observed/native tool policy metadata"),
+		)
+	}
+
+	seen := make(map[string]struct{}, len(task.Spec.AgentRuntime.AllowedTools))
+	tools := make([]agentExecutionSnapshotHarnessV1BrokeredTool, 0, len(task.Spec.AgentRuntime.AllowedTools))
+	classes := make(map[corev1alpha1.AgentRuntimeBrokeredToolClass]struct{})
+	for _, requestedName := range task.Spec.AgentRuntime.AllowedTools {
+		name := strings.TrimSpace(requestedName)
+		if name == "" || name != requestedName {
+			return resolvedHarnessV1ToolGovernance{}, permanentHarnessV1Candidate(
+				fmt.Errorf("brokered harness v1 tool name %q is not canonical", requestedName),
+			)
+		}
+		if _, duplicate := seen[name]; duplicate {
+			return resolvedHarnessV1ToolGovernance{}, permanentHarnessV1Candidate(
+				fmt.Errorf("brokered harness v1 tool %q is duplicated", name),
+			)
+		}
+		seen[name] = struct{}{}
+
+		tool := &corev1alpha1.Tool{}
+		if err := reader.Get(ctx, client.ObjectKey{Namespace: task.Namespace, Name: name}, tool); err != nil {
+			return resolvedHarnessV1ToolGovernance{}, fmt.Errorf("load brokered harness v1 Tool %q: %w", name, err)
+		}
+		if tool.UID == "" || tool.Generation < 1 || !tool.DeletionTimestamp.IsZero() {
+			return resolvedHarnessV1ToolGovernance{}, fmt.Errorf("brokered harness v1 Tool %q identity is not ready", name)
+		}
+		class := tool.Spec.BrokeredToolClass
+		if !harness.IsKnownBrokeredToolClass(harness.BrokeredToolClass(class)) {
+			return resolvedHarnessV1ToolGovernance{}, permanentHarnessV1Candidate(
+				fmt.Errorf("brokered harness v1 Tool %q has unsupported class %q", name, class),
+			)
+		}
+		if class != corev1alpha1.AgentRuntimeBrokeredToolClassRead {
+			return resolvedHarnessV1ToolGovernance{}, permanentHarnessV1Candidate(
+				fmt.Errorf("harness v1 static safety profile does not allow brokered tool class %q", class),
+			)
+		}
+		if !slices.Contains(target.brokeredToolClasses, class) {
+			return resolvedHarnessV1ToolGovernance{}, permanentHarnessV1Candidate(
+				fmt.Errorf("harness v1 AgentRuntime does not support brokered tool class %q", class),
+			)
+		}
+		parameters := json.RawMessage(`{"type":"object","properties":{}}`)
+		if tool.Spec.Parameters != nil && len(tool.Spec.Parameters.Raw) > 0 {
+			parameters = append(json.RawMessage(nil), tool.Spec.Parameters.Raw...)
+		}
+		if !json.Valid(parameters) {
+			return resolvedHarnessV1ToolGovernance{}, permanentHarnessV1Candidate(
+				fmt.Errorf("brokered harness v1 Tool %q parameters are invalid JSON", name),
+			)
+		}
+		if _, err := resolveHarnessV1BrokeredToolSchema(parameters); err != nil {
+			return resolvedHarnessV1ToolGovernance{}, permanentHarnessV1Candidate(
+				fmt.Errorf("brokered harness v1 Tool %q parameters schema is invalid: %w", name, err),
+			)
+		}
+		digest, err := harnessV1BrokeredToolDefinitionDigest(tool)
+		if err != nil {
+			return resolvedHarnessV1ToolGovernance{}, err
+		}
+		tools = append(tools, agentExecutionSnapshotHarnessV1BrokeredTool{
+			Name: name, Description: tool.Spec.Description, BrokeredClass: class,
+			Parameters: parameters, UID: string(tool.UID), Generation: tool.Generation,
+			DefinitionDigest: digest,
+		})
+		classes[class] = struct{}{}
+	}
+	sort.Slice(tools, func(i, j int) bool { return tools[i].Name < tools[j].Name })
+	classList := make([]corev1alpha1.AgentRuntimeBrokeredToolClass, 0, len(classes))
+	for class := range classes {
+		classList = append(classList, class)
+	}
+	slices.Sort(classList)
+	return resolvedHarnessV1ToolGovernance{
+		mode: harness.ToolExecutionModeBrokered, classes: classList, tools: tools,
+	}, nil
+}
+
+func harnessV1BrokeredToolDefinitionDigest(tool *corev1alpha1.Tool) (string, error) {
+	if tool == nil {
+		return "", errors.New("brokered harness v1 Tool is required")
+	}
+	return acpDomainDigest("harness-v1-brokered-tool-definition", map[string]any{
+		"uid": string(tool.UID), "generation": tool.Generation, "spec": tool.Spec,
+		"endpoint": tool.Status.Endpoint, "workspace": tool.Status.Workspace, "actor": tool.Status.Actor,
+	})
+}
+
+func frozenHarnessV1ToolExecutionMode(body agentExecutionSnapshotBody) harness.ToolExecutionMode {
+	if body.HarnessV1 == nil || strings.TrimSpace(body.HarnessV1.ToolExecutionMode) == "" {
+		// Snapshots created before brokered execution was implemented were
+		// observed-only. Preserve their immutable recovery behavior.
+		return harness.ToolExecutionModeObserved
+	}
+	return harness.ToolExecutionMode(body.HarnessV1.ToolExecutionMode)
+}
+
+func frozenHarnessV1BrokeredToolDefinitions(body agentExecutionSnapshotBody) ([]harness.ToolDefinition, error) {
+	if err := validateFrozenHarnessV1ToolGovernance(body); err != nil {
+		return nil, err
+	}
+	definitions := make([]harness.ToolDefinition, 0, len(body.HarnessV1.BrokeredTools))
+	for _, tool := range body.HarnessV1.BrokeredTools {
+		definitions = append(definitions, harness.ToolDefinition{
+			Name: tool.Name, Description: tool.Description,
+			BrokeredClass: harness.BrokeredToolClass(tool.BrokeredClass),
+			Parameters:    append(json.RawMessage(nil), tool.Parameters...),
+		})
+	}
+	return definitions, nil
+}
+
+func validateFrozenHarnessV1ToolGovernance(body agentExecutionSnapshotBody) error {
+	if body.HarnessV1 == nil {
+		return errors.New("frozen harness v1 target metadata is required")
+	}
+	mode := frozenHarnessV1ToolExecutionMode(body)
+	switch mode {
+	case harness.ToolExecutionModeObserved:
+		if len(body.HarnessV1.BrokeredToolClasses) != 0 || len(body.HarnessV1.BrokeredTools) != 0 {
+			return errors.New("observed harness v1 snapshot carries brokered tool authority")
+		}
+		return nil
+	case harness.ToolExecutionModeBrokered:
+	default:
+		return fmt.Errorf("frozen harness v1 tool execution mode %q is unsupported", mode)
+	}
+	if body.HarnessV1.Backend != string(corev1alpha1.AgentExecutionBackendExternalEndpoint) ||
+		body.HarnessV1.RuntimeAuthOnly || len(body.HarnessV1.CredentialRefs) != 0 || body.Workspace != nil {
+		return errors.New("brokered harness v1 snapshot carries unsupported runtime or credential authority")
+	}
+	if len(body.HarnessV1.BrokeredTools) > maxHarnessV1BrokeredTools {
+		return fmt.Errorf("brokered harness v1 snapshot exceeds %d tools", maxHarnessV1BrokeredTools)
+	}
+	classes := body.HarnessV1.BrokeredToolClasses
+	for i, class := range classes {
+		if !harness.IsKnownBrokeredToolClass(harness.BrokeredToolClass(class)) ||
+			i > 0 && classes[i-1] >= class {
+			return errors.New("brokered harness v1 snapshot classes are unsupported, duplicated, or unsorted")
+		}
+	}
+	names := make([]string, 0, len(body.HarnessV1.BrokeredTools))
+	for i, tool := range body.HarnessV1.BrokeredTools {
+		if tool.Name == "" || tool.Name != strings.TrimSpace(tool.Name) || tool.UID == "" || tool.Generation < 1 ||
+			!json.Valid(tool.Parameters) || store.ValidateCanonicalDigest("brokered harness v1 Tool definition", tool.DefinitionDigest) != nil ||
+			!slices.Contains(classes, tool.BrokeredClass) || i > 0 && body.HarnessV1.BrokeredTools[i-1].Name >= tool.Name {
+			return errors.New("brokered harness v1 snapshot Tool authority is incomplete, duplicated, or unsorted")
+		}
+		if _, err := resolveHarnessV1BrokeredToolSchema(tool.Parameters); err != nil {
+			return errors.New("brokered harness v1 snapshot Tool parameters schema is invalid")
+		}
+		names = append(names, tool.Name)
+	}
+	if body.RuntimeOverride == nil || body.RuntimeOverride.AllowedTools == nil {
+		return errors.New("brokered harness v1 snapshot is missing its explicit allowedTools authority")
+	}
+	wantNames := append([]string(nil), body.RuntimeOverride.AllowedTools...)
+	sort.Strings(wantNames)
+	if !slices.Equal(names, wantNames) {
+		return errors.New("brokered harness v1 snapshot Tool definitions do not match allowedTools")
+	}
+	return nil
+}
+
+func parseHarnessV1BrokeredToolCall(
+	frame harness.HarnessEventFrame,
+	turn harness.StartTurnRequest,
+	body agentExecutionSnapshotBody,
+) (harness.ToolCallRequest, agentExecutionSnapshotHarnessV1BrokeredTool, error) {
+	var zeroTool agentExecutionSnapshotHarnessV1BrokeredTool
+	if frozenHarnessV1ToolExecutionMode(body) != harness.ToolExecutionModeBrokered {
+		return harness.ToolCallRequest{}, zeroTool, errors.New("observed harness v1 turn requested a brokered tool")
+	}
+	var request harness.ToolCallRequest
+	if len(frame.Content) == 0 || json.Unmarshal(frame.Content, &request) != nil {
+		return harness.ToolCallRequest{}, zeroTool, errors.New("brokered harness v1 tool call content is invalid")
+	}
+	if err := request.Validate(); err != nil {
+		return harness.ToolCallRequest{}, zeroTool, fmt.Errorf("validate brokered harness v1 tool call: %w", err)
+	}
+	if request.RuntimeSessionID != turn.RuntimeSessionID || request.TurnID != turn.TurnID ||
+		frame.RuntimeSessionID != turn.RuntimeSessionID || frame.TurnID != turn.TurnID ||
+		frame.CorrelationID != turn.CorrelationID {
+		return harness.ToolCallRequest{}, zeroTool, errors.New("brokered harness v1 tool call identity does not match the frozen turn")
+	}
+	request.ToolCallID = strings.TrimSpace(request.ToolCallID)
+	request.ToolName = strings.TrimSpace(request.ToolName)
+	if strings.TrimSpace(frame.ToolCallID) != request.ToolCallID || strings.TrimSpace(frame.ToolName) != request.ToolName {
+		return harness.ToolCallRequest{}, zeroTool, errors.New("brokered harness v1 frame and tool call identities do not match")
+	}
+	wantKey := harness.ToolRequestIdempotencyKey(request.RuntimeSessionID, request.TurnID, request.ToolCallID)
+	if request.IdempotencyKey != wantKey {
+		return harness.ToolCallRequest{}, zeroTool, errors.New("brokered harness v1 tool call has a non-canonical idempotency key")
+	}
+	if request.RequiresApproval || request.ApprovalPolicyRef != nil {
+		return harness.ToolCallRequest{}, zeroTool, errors.New("brokered harness v1 approval requests are not authorized")
+	}
+	if len(request.Input) == 0 {
+		request.Input = json.RawMessage(`{}`)
+	}
+	if !json.Valid(request.Input) {
+		return harness.ToolCallRequest{}, zeroTool, errors.New("brokered harness v1 tool input is invalid JSON")
+	}
+	for _, tool := range body.HarnessV1.BrokeredTools {
+		if tool.Name == request.ToolName {
+			return request, tool, nil
+		}
+	}
+	return harness.ToolCallRequest{}, zeroTool, fmt.Errorf("brokered harness v1 tool %q is outside the frozen allowlist", request.ToolName)
+}
+
+func (d *HarnessV1Dispatcher) continueHarnessV1BrokeredToolCall(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	verified *verifiedHarnessV1Execution,
+	protocolClient harnessV1ProtocolClient,
+	turn harness.StartTurnRequest,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+	frame harness.HarnessEventFrame,
+) error {
+	if d == nil {
+		return errors.New("harness v1 brokered tool execution is not configured")
+	}
+	if task == nil || verified == nil || verified.body.HarnessV1 == nil || attempt == nil {
+		return errors.New("harness v1 brokered continuation requires Task, snapshot, and attempt")
+	}
+	if d.ExternalEffects == nil {
+		return errors.New("harness v1 brokered tool execution is not configured")
+	}
+	if attempt.State == store.HarnessV1AttemptCancelRequested {
+		return settleCancelledHarnessV1BrokeredToolEffect(
+			ctx,
+			d.ExternalEffects,
+			fence,
+			harnessV1BrokeredToolEffectIdentity(task, turn, strings.TrimSpace(frame.ToolCallID)),
+		)
+	}
+	if d.BrokeredToolExecutor == nil {
+		return errors.New("harness v1 brokered tool execution is not configured")
+	}
+	request, frozenTool, err := parseHarnessV1BrokeredToolCall(frame, turn, verified.body)
+	if err != nil {
+		return fmt.Errorf("%w: %v", errHarnessV1FrameAuthorityViolation, err)
+	}
+	reader := d.APIReader
+	if reader == nil {
+		reader = d.Client
+	}
+	if reader == nil {
+		return errors.New("harness v1 brokered tool execution requires a Kubernetes reader")
+	}
+	tool := &corev1alpha1.Tool{}
+	if err := reader.Get(ctx, client.ObjectKey{Namespace: task.Namespace, Name: request.ToolName}, tool); err != nil {
+		return fmt.Errorf("load brokered harness v1 Tool %q: %w", request.ToolName, err)
+	}
+	digest, err := harnessV1BrokeredToolDefinitionDigest(tool)
+	if err != nil {
+		return fmt.Errorf("%w: brokered harness v1 Tool %q is invalid: %v", errHarnessV1FrameAuthorityViolation, request.ToolName, err)
+	}
+	if string(tool.UID) != frozenTool.UID || tool.Generation != frozenTool.Generation || digest != frozenTool.DefinitionDigest ||
+		tool.Spec.BrokeredToolClass != frozenTool.BrokeredClass || !tool.DeletionTimestamp.IsZero() {
+		return fmt.Errorf("%w: brokered harness v1 Tool %q changed after binding", errHarnessV1FrameAuthorityViolation, request.ToolName)
+	}
+	if err := validateHarnessV1BrokeredToolInput(frozenTool.Parameters, request.Input); err != nil {
+		return fmt.Errorf("%w: validate brokered harness v1 Tool %q input: %v", errHarnessV1FrameAuthorityViolation, request.ToolName, err)
+	}
+	identity := harnessV1BrokeredToolEffectIdentity(task, turn, request.ToolCallID)
+	effectRequest := map[string]any{
+		"taskUID": task.UID, "attempt": attempt.Attempt, "bindingDigest": attempt.BindingDigest,
+		"snapshotDigest": attempt.SnapshotDigest, "toolDefinitionDigest": frozenTool.DefinitionDigest,
+		"request": request,
+	}
+	result, _, err := runExternalEffectWithReplayCallTimeout(
+		ctx,
+		d.ExternalEffects,
+		fence,
+		identity,
+		effectRequest,
+		harnessV1BrokeredToolCallTimeout(tool),
+		func(callCtx context.Context) (harness.ToolCallResult, error) {
+			output, executeErr := d.BrokeredToolExecutor.ExecuteHarnessV1BrokeredTool(
+				callCtx, task.Namespace, tool.DeepCopy(), request,
+			)
+			result := harness.ToolCallResult{
+				Version: harness.ProtocolVersion, RuntimeSessionID: request.RuntimeSessionID,
+				TurnID: request.TurnID, ToolCallID: request.ToolCallID,
+				IdempotencyKey: request.IdempotencyKey, Approved: true,
+			}
+			if executeErr != nil {
+				if callCtx.Err() != nil {
+					// The bounded effect budget expired (or prompt authority
+					// was revoked) before the Tool produced an outcome. Do not
+					// commit ToolExecutionFailed: returning the error leaves
+					// the ledger entry in-flight so a retry can re-execute
+					// this read-class call under the same identity, and lease
+					// expiry reconciliation classifies an abandoned entry
+					// OutcomeUnknown instead of permanently replaying a
+					// deadline artifact as a committed deterministic failure.
+					return harness.ToolCallResult{}, fmt.Errorf(
+						"brokered harness v1 tool call did not complete within its bounded effect budget: %w", executeErr,
+					)
+				}
+				result.Approved = false
+				result.Error = &harness.ErrorInfo{Code: "ToolExecutionFailed", Message: "brokered tool execution failed"}
+				return result, nil
+			}
+			if len(output) == 0 || !json.Valid(output) {
+				encoded, marshalErr := json.Marshal(string(output))
+				if marshalErr != nil {
+					return harness.ToolCallResult{}, marshalErr
+				}
+				output = encoded
+			}
+			if len(output) > maxHarnessV1BrokeredToolResultBytes {
+				result.Approved = false
+				result.Error = &harness.ErrorInfo{Code: "ToolResultTooLarge", Message: "brokered tool result exceeded the size limit"}
+				return result, nil
+			}
+			result.Output = append(json.RawMessage(nil), output...)
+			return result, nil
+		},
+	)
+	if err != nil {
+		return fmt.Errorf("execute brokered harness v1 tool %q: %w", request.ToolName, err)
+	}
+	continueRequest := harness.ContinueTurnRequest{
+		Version: harness.ProtocolVersion, Namespace: turn.Namespace, TaskName: turn.TaskName,
+		SessionName: turn.SessionName, RuntimeSessionID: turn.RuntimeSessionID, TurnID: turn.TurnID,
+		CorrelationID: turn.CorrelationID, ToolResults: []harness.ToolCallResult{result},
+		Metadata: map[string]string{"toolCallFrameSeq": fmt.Sprint(frame.Seq)},
+	}
+	if _, err := protocolClient.ContinueTurn(ctx, continueRequest); err != nil {
+		return fmt.Errorf("continue brokered harness v1 turn: %w", err)
+	}
+	return nil
+}
+
+// harnessV1BrokeredToolCallTimeout sizes the bounded external-effect call —
+// and therefore its ledger lease, which the effect runner derives as call
+// timeout plus settlement margin — from the Tool's own spec.http.timeout.
+// Harness v1 admits only read-class brokered Tools, which never pass the v2
+// consequential-timeout admission gate that caps spec.http.timeout at the
+// fixed brokered clamp, so a legitimately larger configured timeout must grow
+// the effect deadline instead of being truncated mid-flight. The added margin
+// lets the executor's own HTTP timeout fire first and produce a deterministic
+// classification before the effect budget expires.
+func harnessV1BrokeredToolCallTimeout(tool *corev1alpha1.Tool) time.Duration {
+	if tool != nil && tool.Spec.HTTP != nil && tool.Spec.HTTP.Timeout != nil && tool.Spec.HTTP.Timeout.Duration > 0 {
+		if sized := tool.Spec.HTTP.Timeout.Duration + externalEffectLeaseSettlementMargin; sized > maxACPExternalEffectCallDuration {
+			return sized
+		}
+	}
+	return maxACPExternalEffectCallDuration
+}
+
+func harnessV1BrokeredToolEffectIdentity(
+	task *corev1alpha1.Task,
+	turn harness.StartTurnRequest,
+	toolCallID string,
+) store.ExternalEffectIdentity {
+	return store.ExternalEffectIdentity{
+		Kind: "harness-v1-tool", Namespace: task.Namespace, AggregateID: string(task.UID),
+		OperationID: store.CanonicalControlID(
+			"harness-v1-tool-call", string(turn.RuntimeSessionID), string(turn.TurnID), toolCallID,
+		),
+	}
+}
+
+// settleCancelledHarnessV1BrokeredToolEffect closes any reservation that may
+// have crossed its execution boundary before cancellation became durable. A
+// missing effect means execution never reserved the call; an already-terminal
+// effect keeps its authoritative classification.
+func settleCancelledHarnessV1BrokeredToolEffect(
+	ctx context.Context,
+	effects store.ExternalEffectStore,
+	fence store.ControllerEpochFence,
+	identity store.ExternalEffectIdentity,
+) error {
+	id, err := identity.CanonicalID()
+	if err != nil {
+		return err
+	}
+	effect, err := effects.GetExternalEffect(ctx, id)
+	if err != nil {
+		if errors.Is(err, store.ErrNotFound) {
+			return nil
+		}
+		return err
+	}
+	switch effect.State {
+	case store.ExternalEffectSucceeded, store.ExternalEffectFailed, store.ExternalEffectOutcomeUnknown:
+		return nil
+	default:
+		return settleExternalEffectStore(
+			ctx, effects, fence, identity, store.ExternalEffectOutcomeUnknown, nil,
+		)
+	}
+}
+
+func resolveHarnessV1BrokeredToolSchema(parameters json.RawMessage) (*jsonschema.Resolved, error) {
+	var schema jsonschema.Schema
+	if err := json.Unmarshal(parameters, &schema); err != nil {
+		return nil, fmt.Errorf("decode JSON Schema: %w", err)
+	}
+	resolved, err := schema.Resolve(nil)
+	if err != nil {
+		return nil, fmt.Errorf("resolve JSON Schema: %w", err)
+	}
+	return resolved, nil
+}
+
+func validateHarnessV1BrokeredToolInput(parameters, input json.RawMessage) error {
+	resolved, err := resolveHarnessV1BrokeredToolSchema(parameters)
+	if err != nil {
+		return err
+	}
+	decoder := json.NewDecoder(bytes.NewReader(input))
+	decoder.UseNumber()
+	var instance any
+	if err := decoder.Decode(&instance); err != nil {
+		return fmt.Errorf("decode input JSON: %w", err)
+	}
+	if err := decoder.Decode(&struct{}{}); !errors.Is(err, io.EOF) {
+		return errors.New("input contains more than one JSON value")
+	}
+	if err := resolved.Validate(instance); err != nil {
+		return fmt.Errorf("input does not match the frozen parameters schema: %w", err)
+	}
+	return nil
+}
diff --git a/internal/controller/harness_v1_dispatcher.go b/internal/controller/harness_v1_dispatcher.go
new file mode 100644
index 000000000..5d9a594a7
--- /dev/null
+++ b/internal/controller/harness_v1_dispatcher.go
@@ -0,0 +1,2273 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package controller
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"slices"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/util/retry"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	logf "sigs.k8s.io/controller-runtime/pkg/log"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/harness"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+const (
+	DefaultHarnessV1DispatchInterval = time.Second
+	// The shipped harness v1 wrapper advertises and enforces one concurrent
+	// turn. Keep the default dispatcher capacity aligned so wrapper capacity is
+	// controller backpressure rather than a terminal Task rejection.
+	DefaultHarnessV1DispatchWorkers = 1
+	defaultHarnessV1TurnTimeout     = 30 * time.Minute
+	// Give a deadline-triggered, durably requested cancellation a bounded
+	// interval to produce authoritative terminal evidence before the controller
+	// conservatively classifies the turn as OutcomeUnknown.
+	defaultHarnessV1CancellationSettlementTimeout = 20 * time.Second
+
+	harnessV1ReasonRejected           = "PromptNotAccepted"
+	harnessV1ReasonFailed             = "PromptFailed"
+	harnessV1ReasonRetryableFailure   = "RetryablePromptFailure"
+	harnessV1ReasonCancelled          = "Cancelled"
+	harnessV1ReasonOutcomeUnknown     = "RuntimeLost"
+	harnessV1ReasonInvalidBinding     = "InvalidBinding"
+	harnessV1ReasonBackendDisabled    = "BackendDisabled"
+	harnessV1ReasonCredentialChanged  = "CredentialChanged"
+	harnessV1ReasonProtocolViolation  = "ProtocolViolation"
+	harnessV1ReasonOutputUnavailable  = "OutputUnavailable"
+	harnessV1ReasonSessionConflict    = "SessionConflict"
+	harnessV1OutcomeUnknownMessage    = "harness v1 submission or terminal outcome cannot be proven"
+	harnessV1AdmissionClosedOperation = "admission-closed"
+	harnessV1AdmissionClosedMessage   = "harness v1 wrapper admission is temporarily closed"
+)
+
+var (
+	errHarnessV1TerminalFrame              = errors.New("harness v1 terminal frame received")
+	errHarnessV1FrameAuthorityViolation    = errors.New("harness v1 frame violates frozen execution authority")
+	errHarnessV1FrameSequenceViolation     = fmt.Errorf("%w: frame sequence is not strictly increasing", errHarnessV1FrameAuthorityViolation)
+	errHarnessV1StreamEndedWithoutTerminal = errors.New("harness v1 frame stream ended without terminal evidence")
+)
+
+type harnessV1ProtocolClient interface {
+	StartTurn(context.Context, harness.StartTurnRequest) (*harness.StartTurnResponse, error)
+	DurableTurnStatus(context.Context, harness.HarnessTurnID) (*harness.DurableTurnStatus, error)
+	StreamFrames(context.Context, harness.HarnessTurnID, int64, func(harness.HarnessEventFrame) error) error
+	ContinueTurn(context.Context, harness.ContinueTurnRequest) (*harness.ContinueTurnResponse, error)
+	FetchTurnOutput(context.Context, harness.HarnessTurnID, string) ([]byte, error)
+	AcknowledgeTurnOutput(context.Context, harness.TurnOutputAcknowledgementRequest) error
+	AcknowledgeTurnSettlement(context.Context, harness.TurnSettlementAcknowledgementRequest) error
+	CancelTurn(context.Context, harness.CancelTurnRequest) (*harness.CancelTurnResponse, error)
+}
+
+type harnessV1ClientFactory func(endpoint, bearer string, httpClient *http.Client) (harnessV1ProtocolClient, error)
+
+func defaultHarnessV1ClientFactory(
+	endpoint, bearer string,
+	httpClient *http.Client,
+) (harnessV1ProtocolClient, error) {
+	options := []harness.ClientOption{harness.WithBearerToken(bearer)}
+	if httpClient != nil {
+		options = append(options, harness.WithHTTPClient(httpClient))
+	}
+	return harness.NewClient(endpoint, options...)
+}
+
+type harnessV1DispatchCandidate struct {
+	task    *corev1alpha1.Task
+	attempt store.HarnessV1Attempt
+}
+
+// HarnessV1Dispatcher owns harness v1 network effects outside Task reconcile.
+// A Prepared attempt is moved durably to Submitting before StartTurn. On
+// takeover, Submitting is always treated as potentially submitted: ledger and
+// frame evidence are consulted before any state change and the request is never
+// replayed merely because evidence is unavailable.
+type HarnessV1Dispatcher struct {
+	Client               client.Client
+	APIReader            client.Reader
+	Attempts             store.HarnessV1AttemptStore
+	Snapshots            store.AgentExecutionSnapshotStore
+	ResultStore          store.ResultStore
+	EventStore           store.ExecutionEventStore
+	ExternalEffects      store.ExternalEffectStore
+	BrokeredToolExecutor HarnessV1BrokeredToolExecutor
+	Sessions             *ACPSessionContinuity
+	Epochs               *ControllerEpochManager
+	Interval             time.Duration
+	MaxConcurrent        int
+	HTTPClient           *http.Client
+	clientFactory        harnessV1ClientFactory
+
+	mu     sync.Mutex
+	active map[types.UID]struct{}
+	sem    chan struct{}
+}
+
+func (d *HarnessV1Dispatcher) NeedLeaderElection() bool { return true }
+
+// ValidateHarnessV1DispatchWorkers keeps controller admission aligned with the
+// shipped wrapper's MaxConcurrentTurns=1 capability.
+func ValidateHarnessV1DispatchWorkers(workers int) error {
+	if workers != DefaultHarnessV1DispatchWorkers {
+		return fmt.Errorf("harness v1 dispatch workers must be exactly %d", DefaultHarnessV1DispatchWorkers)
+	}
+	return nil
+}
+
+func (d *HarnessV1Dispatcher) Start(ctx context.Context) error {
+	if d.MaxConcurrent == 0 {
+		d.MaxConcurrent = DefaultHarnessV1DispatchWorkers
+	}
+	if err := ValidateHarnessV1DispatchWorkers(d.MaxConcurrent); err != nil {
+		return err
+	}
+	if d.Client == nil || d.Attempts == nil || d.Snapshots == nil || d.ResultStore == nil ||
+		d.EventStore == nil || d.Sessions == nil || d.Epochs == nil {
+		return errors.New("harness v1 dispatcher requires Kubernetes client, attempt/snapshot stores, result/event stores, Session continuity, and epoch manager")
+	}
+	if d.APIReader == nil {
+		d.APIReader = d.Client
+	}
+	if d.Interval <= 0 {
+		d.Interval = DefaultHarnessV1DispatchInterval
+	}
+	d.mu.Lock()
+	if d.active == nil {
+		d.active = make(map[types.UID]struct{})
+	}
+	if d.sem == nil {
+		d.sem = make(chan struct{}, d.MaxConcurrent)
+	}
+	d.mu.Unlock()
+	if _, err := d.Epochs.CurrentFence(ctx); err != nil {
+		return err
+	}
+
+	ticker := time.NewTicker(d.Interval)
+	defer ticker.Stop()
+	for {
+		if err := d.dispatchOnce(ctx); err != nil && !errors.Is(err, context.Canceled) {
+			logf.FromContext(ctx).Error(err, "harness v1 dispatcher scan failed")
+		}
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-ticker.C:
+		}
+	}
+}
+
+func (d *HarnessV1Dispatcher) dispatchOnce(ctx context.Context) error {
+	var tasks corev1alpha1.TaskList
+	if err := d.Client.List(ctx, &tasks); err != nil {
+		return err
+	}
+	candidates := make([]harnessV1DispatchCandidate, 0, len(tasks.Items))
+	for i := range tasks.Items {
+		task := &tasks.Items[i]
+		if !taskDispatchableByHarnessV1(task) {
+			continue
+		}
+		attempts, err := d.Attempts.ListHarnessV1AttemptsByTask(ctx, task.Namespace, string(task.UID))
+		if err != nil {
+			return fmt.Errorf("list harness v1 attempts for Task %s/%s: %w", task.Namespace, task.Name, err)
+		}
+		if len(attempts) == 0 {
+			continue
+		}
+		latest := attempts[len(attempts)-1]
+		if store.IsTerminalHarnessV1AttemptState(latest.State) && harnessV1AttemptProjectionMatches(task, &latest) {
+			continue
+		}
+		candidates = append(candidates, harnessV1DispatchCandidate{task: task, attempt: latest})
+	}
+	sortHarnessV1DispatchCandidates(candidates, time.Now().UTC())
+	for i := range candidates {
+		candidate := candidates[i]
+		task, latest := candidate.task, candidate.attempt
+		select {
+		case d.sem <- struct{}{}:
+			if !d.markActive(task.UID) {
+				<-d.sem
+				continue
+			}
+			go func(task *corev1alpha1.Task, attempt store.HarnessV1Attempt) {
+				defer func() {
+					<-d.sem
+					d.unmarkActive(task.UID)
+				}()
+				if err := d.reconcileAttempt(ctx, task.DeepCopy(), &attempt); err != nil && !errors.Is(err, context.Canceled) {
+					logf.FromContext(ctx).Error(err, "harness v1 attempt reconciliation failed",
+						"namespace", task.Namespace, "task", task.Name, "attempt", attempt.Attempt)
+				}
+			}(task.DeepCopy(), latest)
+		default:
+			return nil
+		}
+	}
+	return nil
+}
+
+func sortHarnessV1DispatchCandidates(candidates []harnessV1DispatchCandidate, now time.Time) {
+	ranks := make(map[*corev1alpha1.Task]acpTaskQueueRank, len(candidates))
+	for i := range candidates {
+		task := candidates[i].task
+		ranks[task] = rankTaskForQueue(task, now.UTC(), harnessV1TaskQueuedAt(task))
+	}
+	sort.SliceStable(candidates, func(i, j int) bool {
+		leftRecovery := candidates[i].attempt.State != store.HarnessV1AttemptPrepared
+		rightRecovery := candidates[j].attempt.State != store.HarnessV1AttemptPrepared
+		if leftRecovery != rightRecovery {
+			return leftRecovery
+		}
+		return taskQueueRankLess(ranks[candidates[i].task], ranks[candidates[j].task])
+	})
+}
+
+func harnessV1TaskQueuedAt(task *corev1alpha1.Task) time.Time {
+	if task == nil {
+		return time.Unix(0, 0).UTC()
+	}
+	if task.Status.HarnessRuntime != nil && task.Status.HarnessRuntime.LastTransitionTime != nil &&
+		!task.Status.HarnessRuntime.LastTransitionTime.IsZero() {
+		return task.Status.HarnessRuntime.LastTransitionTime.UTC()
+	}
+	if !task.CreationTimestamp.IsZero() {
+		return task.CreationTimestamp.UTC()
+	}
+	return time.Unix(0, 0).UTC()
+}
+
+func (d *HarnessV1Dispatcher) markActive(uid types.UID) bool {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	if _, exists := d.active[uid]; exists {
+		return false
+	}
+	d.active[uid] = struct{}{}
+	return true
+}
+
+func (d *HarnessV1Dispatcher) unmarkActive(uid types.UID) {
+	d.mu.Lock()
+	delete(d.active, uid)
+	d.mu.Unlock()
+}
+
+//nolint:gocyclo // The attempt state machine is kept together so crash boundaries remain auditable.
+func (d *HarnessV1Dispatcher) reconcileAttempt(ctx context.Context, task *corev1alpha1.Task, observed *store.HarnessV1Attempt) error {
+	if task == nil || observed == nil || task.Status.AgentExecutionBinding == nil {
+		return errors.New("harness v1 Task, binding, and attempt are required")
+	}
+	fence, err := d.Epochs.CurrentFence(ctx)
+	if err != nil {
+		return err
+	}
+	attempt, err := d.Attempts.GetHarnessV1Attempt(ctx, store.HarnessV1AttemptKey{
+		Namespace: observed.Namespace, TaskUID: observed.TaskUID, Attempt: observed.Attempt,
+	})
+	if err != nil {
+		return err
+	}
+	if err := d.validateAttemptIdentity(task, attempt); err != nil {
+		return d.failUnsubmittedAttempt(ctx, task, attempt, fence, harnessV1ReasonInvalidBinding)
+	}
+
+	if store.IsTerminalHarnessV1AttemptState(attempt.State) {
+		return d.reconcileTerminalAttemptAfterOutputAcknowledgement(ctx, task, attempt, fence)
+	}
+
+	verifier := TaskReconciler{
+		Client: d.Client, APIReader: d.APIReader, AgentExecutionSnapshots: d.Snapshots,
+	}
+	var (
+		verified  *verifiedHarnessV1Execution
+		verifyErr error
+	)
+	if attempt.State == store.HarnessV1AttemptPrepared {
+		// Prepared is the one recovery state that may still cross StartTurn.
+		// Verify its immutable binding, snapshot, and Secret identities here
+		// immediately before submission below.
+		verified, verifyErr = verifier.loadHarnessV1ExecutionWithOptions(
+			ctx, task, task.Status.AgentExecutionBinding, true, true,
+		)
+	} else {
+		verified, verifyErr = verifier.loadVerifiedHarnessV1ExecutionForRecovery(
+			ctx, task, task.Status.AgentExecutionBinding, true,
+		)
+	}
+	if verifyErr != nil {
+		if attempt.State == store.HarnessV1AttemptPrepared {
+			return d.failUnsubmittedAttempt(ctx, task, attempt, fence, harnessV1ReasonCredentialChanged)
+		}
+		if attempt.State == store.HarnessV1AttemptSettling {
+			return fmt.Errorf("verify settling harness v1 execution: %w", verifyErr)
+		}
+		return d.markOutcomeUnknown(ctx, task, attempt, fence, harnessV1ReasonCredentialChanged)
+	}
+	if attempt.State == store.HarnessV1AttemptSettling {
+		protocolClient, request, err := d.protocolClientAndRequest(ctx, task, verified, attempt)
+		if err != nil {
+			return fmt.Errorf("build settling harness v1 recovery request: %w", err)
+		}
+		return d.recoverSettlingAttempt(ctx, task, protocolClient, request, attempt, fence)
+	}
+
+	if !task.DeletionTimestamp.IsZero() || task.Status.Phase == corev1alpha1.TaskPhaseCancelled {
+		return d.cancelAttempt(ctx, task, verified, attempt, fence)
+	}
+
+	switch attempt.State {
+	case store.HarnessV1AttemptPrepared:
+		if !d.v1PreparedExecutionAuthorized(task, verified.binding) {
+			return d.failUnsubmittedAttempt(ctx, task, attempt, fence, harnessV1ReasonBackendDisabled)
+		}
+		protocolClient, request, err := d.protocolClientAndRequest(ctx, task, verified, attempt)
+		if err != nil {
+			return d.failUnsubmittedAttempt(ctx, task, attempt, fence, harnessV1ReasonCredentialChanged)
+		}
+		// Establish or verify the protocol lineage, acquire the exact Kubernetes
+		// Session lease, and persist the open SQLite SessionTurn before crossing
+		// the StartTurn request-write boundary.
+		if err := d.prepareHarnessV1TaskSession(ctx, task, verified, attempt, fence); err != nil {
+			if isPermanentHarnessV1PreSubmitSessionError(err) {
+				return d.failUnsubmittedAttempt(
+					ctx, task, attempt, fence, harnessV1ReasonSessionConflict,
+				)
+			}
+			return err
+		}
+		attempt, err = d.transitionAttempt(ctx, attempt, fence, store.HarnessV1AttemptSubmitting, "begin-submit", store.HarnessV1AttemptUpdates{})
+		if err != nil {
+			return err
+		}
+		if err := d.projectAttemptState(ctx, task, attempt, "submitting harness v1 turn"); err != nil {
+			return err
+		}
+		accepted, startErr := protocolClient.StartTurn(ctx, request)
+		if startErr != nil {
+			return d.handleStartTurnError(ctx, task, verified, protocolClient, request, attempt, fence, startErr)
+		}
+		runtimeSessionID := string(accepted.RuntimeSessionID)
+		correlationID := accepted.CorrelationID
+		if correlationID == "" {
+			correlationID = attempt.CorrelationID
+		}
+		attempt, err = d.transitionAttempt(ctx, attempt, fence, store.HarnessV1AttemptAccepted, "accepted", store.HarnessV1AttemptUpdates{
+			RuntimeSessionID: &runtimeSessionID, CorrelationID: &correlationID,
+		})
+		if err != nil {
+			return err
+		}
+		return d.streamAcceptedAttempt(ctx, task, verified, protocolClient, request, attempt, fence)
+
+	case store.HarnessV1AttemptSubmitting, store.HarnessV1AttemptSubmittedUnknown:
+		protocolClient, request, err := d.protocolClientAndRequest(ctx, task, verified, attempt)
+		if err != nil {
+			return d.markOutcomeUnknown(ctx, task, attempt, fence, harnessV1ReasonCredentialChanged)
+		}
+		return d.recoverAmbiguousSubmission(ctx, task, verified, protocolClient, request, attempt, fence)
+
+	case store.HarnessV1AttemptAccepted, store.HarnessV1AttemptRunning,
+		store.HarnessV1AttemptCancelRequested:
+		protocolClient, request, err := d.protocolClientAndRequest(ctx, task, verified, attempt)
+		if err != nil {
+			return d.markOutcomeUnknown(ctx, task, attempt, fence, harnessV1ReasonCredentialChanged)
+		}
+		return d.recoverActiveAttempt(ctx, task, verified, protocolClient, request, attempt, fence)
+	default:
+		return fmt.Errorf("unsupported harness v1 attempt state %q", attempt.State)
+	}
+}
+
+func (d *HarnessV1Dispatcher) validateAttemptIdentity(task *corev1alpha1.Task, attempt *store.HarnessV1Attempt) error {
+	binding := task.Status.AgentExecutionBinding
+	if task.UID == "" || attempt.TaskUID != string(task.UID) || attempt.TaskName != task.Name ||
+		binding == nil || binding.ContractVersion != corev1alpha1.AgentRuntimeContractHarnessV1 ||
+		attempt.BindingDigest != binding.BindingDigest || attempt.SnapshotDigest != binding.Snapshot.Digest ||
+		attempt.TurnID == "" || attempt.RequestDigest == "" {
+		return errors.New("attempt identity does not match immutable harness v1 Task binding")
+	}
+	return nil
+}
+
+// v1PreparedExecutionAuthorized proves that a Prepared attempt belongs to the
+// immutable v1 binding. The dispatcher itself is registered only in the
+// process-static harness-v1 controller mode.
+func (d *HarnessV1Dispatcher) v1PreparedExecutionAuthorized(
+	task *corev1alpha1.Task,
+	binding *corev1alpha1.AgentExecutionBinding,
+) bool {
+	if task == nil || binding == nil || task.Status.AgentExecutionBinding == nil {
+		return false
+	}
+	return binding.ContractVersion == corev1alpha1.AgentRuntimeContractHarnessV1 &&
+		task.Status.AgentExecutionBinding.BindingDigest == binding.BindingDigest
+}
+
+func (d *HarnessV1Dispatcher) protocolClientAndRequest(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	verified *verifiedHarnessV1Execution,
+	attempt *store.HarnessV1Attempt,
+) (harnessV1ProtocolClient, harness.StartTurnRequest, error) {
+	if verified == nil || verified.body.HarnessV1 == nil {
+		return nil, harness.StartTurnRequest{}, errors.New("verified harness v1 snapshot is required")
+	}
+	target := verified.body.HarnessV1
+	reader := d.APIReader
+	if reader == nil {
+		reader = d.Client
+	}
+	if reader == nil {
+		return nil, harness.StartTurnRequest{}, errors.New("kubernetes reader is required for harness v1 protocol client")
+	}
+	env, err := resolveFrozenHarnessV1Env(ctx, reader, target.CredentialRefs)
+	if err != nil {
+		return nil, harness.StartTurnRequest{}, err
+	}
+	request, err := buildHarnessV1StartTurnRequest(task, verified, attempt, env)
+	if err != nil {
+		return nil, harness.StartTurnRequest{}, err
+	}
+	protocolClient, err := d.protocolClientForHarnessV1Execution(ctx, verified)
+	return protocolClient, request, err
+}
+
+// protocolClientForHarnessV1Execution reconstructs only the frozen wrapper
+// transport. It intentionally does not resolve provider CredentialRefs: those
+// remain executor authority and are not needed to acknowledge a turn whose
+// durable identity and settlement receipt are already stored.
+func (d *HarnessV1Dispatcher) protocolClientForHarnessV1Execution(
+	ctx context.Context,
+	verified *verifiedHarnessV1Execution,
+) (harnessV1ProtocolClient, error) {
+	if verified == nil || verified.body.HarnessV1 == nil {
+		return nil, errors.New("verified harness v1 snapshot is required")
+	}
+	target := verified.body.HarnessV1
+	reader := d.APIReader
+	if reader == nil {
+		reader = d.Client
+	}
+	if reader == nil {
+		return nil, errors.New("kubernetes reader is required for harness v1 protocol client")
+	}
+	auth := &corev1.Secret{}
+	if err := reader.Get(ctx, types.NamespacedName{Namespace: target.AuthSecretNamespace, Name: target.AuthSecretName}, auth); err != nil {
+		return nil, err
+	}
+	if string(auth.UID) != target.AuthSecretUID || auth.ResourceVersion != target.AuthSecretResourceVersion {
+		return nil, errors.New("frozen harness auth Secret identity changed")
+	}
+	bearer := string(auth.Data[target.AuthSecretKey])
+	if strings.TrimSpace(bearer) == "" {
+		return nil, errors.New("frozen harness auth Secret key is empty")
+	}
+	clientFactory := d.clientFactory
+	if clientFactory == nil {
+		clientFactory = defaultHarnessV1ClientFactory
+	}
+	return clientFactory(target.Endpoint, bearer, d.HTTPClient)
+}
+
+func buildHarnessV1StartTurnRequest(
+	task *corev1alpha1.Task,
+	verified *verifiedHarnessV1Execution,
+	attempt *store.HarnessV1Attempt,
+	env []harness.TurnEnvVar,
+) (harness.StartTurnRequest, error) {
+	if task == nil || verified == nil || verified.binding == nil || verified.body.HarnessV1 == nil || attempt == nil {
+		return harness.StartTurnRequest{}, errors.New("task, verified harness v1 execution, and attempt are required")
+	}
+	if verified.binding.BoundAt.IsZero() {
+		return harness.StartTurnRequest{}, errors.New("harness v1 binding time is required")
+	}
+	timeout := defaultHarnessV1TurnTimeout
+	deadlineBase := verified.binding.BoundAt.UTC()
+	if verified.body.Timeout != "" {
+		parsed, err := time.ParseDuration(verified.body.Timeout)
+		if err != nil || parsed <= 0 {
+			return harness.StartTurnRequest{}, errors.New("frozen harness v1 timeout must be a positive duration")
+		}
+		timeout = parsed
+		if !task.CreationTimestamp.IsZero() {
+			deadlineBase = task.CreationTimestamp.UTC()
+		}
+	}
+	inputPrompt, err := frozenHarnessV1InputPrompt(verified.body)
+	if err != nil {
+		return harness.StartTurnRequest{}, err
+	}
+	request := harness.StartTurnRequest{
+		Version: harness.ProtocolVersion, Namespace: task.Namespace, TaskName: task.Name,
+		SessionName:       verified.body.HarnessV1.SessionName,
+		RuntimeSessionID:  harness.RuntimeSessionID(attempt.RuntimeSessionID),
+		TurnID:            harness.HarnessTurnID(attempt.TurnID),
+		CorrelationID:     attempt.CorrelationID,
+		Deadline:          deadlineBase.Add(timeout),
+		AuthIdentity:      harness.AuthIdentity{Subject: "orka-task:" + attempt.TaskUID},
+		Input:             harness.TurnInput{Prompt: inputPrompt, Env: env},
+		ToolExecutionMode: frozenHarnessV1ToolExecutionMode(verified.body),
+		Metadata: map[string]string{
+			harness.MetadataTaskUID:             attempt.TaskUID,
+			harness.MetadataAttempt:             strconv.FormatInt(int64(attempt.Attempt), 10),
+			harness.MetadataBindingDigest:       attempt.BindingDigest,
+			harness.MetadataSnapshotDigest:      attempt.SnapshotDigest,
+			"runtime":                           verified.body.HarnessV1.RuntimeName,
+			"orka.runtimeName":                  verified.body.HarnessV1.RuntimeName,
+			harness.MetadataRuntimePolicyFrozen: booleanTrueValue,
+			"model":                             verified.body.Configuration.Model,
+			"systemPrompt":                      verified.body.Configuration.SystemPrompt,
+			"maxTurns":                          strconv.FormatInt(int64(verified.body.Configuration.MaxTurns), 10),
+			"reasoningEffort":                   verified.body.Configuration.ReasoningEffort,
+		},
+	}
+	if verified.body.Configuration.MaxTurns < 1 {
+		return harness.StartTurnRequest{}, errors.New("frozen harness v1 max turns must be positive")
+	}
+	if request.ToolExecutionMode == harness.ToolExecutionModeBrokered {
+		definitions, err := frozenHarnessV1BrokeredToolDefinitions(verified.body)
+		if err != nil {
+			return harness.StartTurnRequest{}, err
+		}
+		request.Input.Tools = definitions
+		classes := make([]string, 0, len(verified.body.HarnessV1.BrokeredToolClasses))
+		for _, class := range verified.body.HarnessV1.BrokeredToolClasses {
+			classes = append(classes, string(class))
+		}
+		request.Metadata["brokeredToolClasses"] = strings.Join(classes, ",")
+	} else {
+		allowedTools, allowedToolsSet, disallowedTools, allowBash := frozenHarnessV1ToolPolicy(verified.body)
+		if !allowedToolsSet || allowBash == nil {
+			return harness.StartTurnRequest{}, errors.New("frozen harness v1 tool policy must explicitly set allowedTools and allowBash")
+		}
+		request.Metadata[harness.MetadataAllowedToolsSet] = booleanTrueValue
+		request.Metadata["allowedTools"] = strings.Join(allowedTools, ",")
+		request.Metadata["disallowedTools"] = strings.Join(disallowedTools, ",")
+		request.Metadata["allowBash"] = strconv.FormatBool(*allowBash)
+		if strings.EqualFold(strings.TrimSpace(verified.body.HarnessV1.RuntimeName), string(corev1alpha1.AgentRuntimeCodex)) &&
+			len(allowedTools) == 0 && !*allowBash {
+			request.Metadata["readOnly"] = booleanTrueValue
+		}
+	}
+	if err := applyHarnessV1WorkspaceMetadata(&request, verified.body); err != nil {
+		return harness.StartTurnRequest{}, err
+	}
+	if attempt.RequestDigest != "" {
+		request.Metadata[harness.MetadataRequestDigest] = attempt.RequestDigest
+	}
+	if verified.body.HarnessV1.RuntimeAuthOnly {
+		request.Metadata["runtimeAuthOnly"] = booleanTrueValue
+	}
+	if err := request.Validate(); err != nil {
+		return harness.StartTurnRequest{}, err
+	}
+	digest, err := harness.CanonicalStartTurnRequestDigest(request)
+	if err != nil {
+		return harness.StartTurnRequest{}, err
+	}
+	if attempt.RequestDigest != "" && digest != attempt.RequestDigest {
+		return harness.StartTurnRequest{}, errors.New("reconstructed harness v1 request digest does not match the durable attempt")
+	}
+	return request, nil
+}
+
+func frozenHarnessV1InputPrompt(body agentExecutionSnapshotBody) (string, error) {
+	if body.HarnessV1 == nil {
+		return "", errors.New("frozen harness v1 target metadata is required")
+	}
+	bootstrap := body.HarnessV1.SessionBootstrap
+	if bootstrap == nil || bootstrap.MessageCount == 0 {
+		return body.Prompt, nil
+	}
+	if bootstrap.Artifact == "" {
+		return "", errors.New("frozen harness v1 Session bootstrap artifact is required")
+	}
+	bootstrapText := bootstrapPromptText(&ACPBootstrapTranscript{
+		Artifact:     []byte(bootstrap.Artifact),
+		MessageCount: bootstrap.MessageCount,
+	})
+	if bootstrapText == "" {
+		return "", errors.New("frozen harness v1 Session bootstrap is invalid")
+	}
+	return bootstrapText + "Orka current user prompt:\n" + body.Prompt, nil
+}
+
+func frozenHarnessV1ToolPolicy(
+	body agentExecutionSnapshotBody,
+) (allowedTools []string, allowedToolsSet bool, disallowedTools []string, allowBash *bool) {
+	if body.DefaultTools != nil {
+		if !body.DefaultTools.AllowedToolsOmitted {
+			allowedTools = append([]string(nil), body.DefaultTools.AllowedTools...)
+			allowedToolsSet = true
+		}
+		if body.DefaultTools.AllowBash != nil {
+			value := *body.DefaultTools.AllowBash
+			allowBash = &value
+		}
+	}
+	if body.RuntimeOverride != nil {
+		if body.RuntimeOverride.AllowedTools != nil {
+			allowedTools = append([]string(nil), body.RuntimeOverride.AllowedTools...)
+			allowedToolsSet = true
+		}
+		disallowedTools = append([]string(nil), body.RuntimeOverride.DisallowedTools...)
+		if body.RuntimeOverride.AllowBash != nil {
+			value := *body.RuntimeOverride.AllowBash
+			allowBash = &value
+		}
+	}
+	return allowedTools, allowedToolsSet, disallowedTools, allowBash
+}
+
+func resolveFrozenHarnessV1Env(
+	ctx context.Context,
+	reader client.Reader,
+	refs []agentExecutionSnapshotSecretRef,
+) ([]harness.TurnEnvVar, error) {
+	if reader == nil {
+		return nil, errors.New("API reader is required to resolve frozen harness v1 environment")
+	}
+	var env []harness.TurnEnvVar
+	seen := make(map[string]struct{})
+	for _, ref := range refs {
+		secret := &corev1.Secret{}
+		if err := reader.Get(ctx, types.NamespacedName{Namespace: ref.Namespace, Name: ref.Name}, secret); err != nil {
+			return nil, err
+		}
+		if string(secret.UID) != ref.UID || secret.ResourceVersion != ref.ResourceVersion {
+			return nil, fmt.Errorf("frozen %s Secret identity changed", ref.Role)
+		}
+		keys := append([]string(nil), ref.Keys...)
+		slices.Sort(keys)
+		for _, key := range keys {
+			if _, duplicate := seen[key]; duplicate {
+				return nil, fmt.Errorf("duplicate frozen harness environment key %q", key)
+			}
+			value := secret.Data[key]
+			if len(value) == 0 {
+				return nil, fmt.Errorf("frozen %s Secret key %q is empty", ref.Role, key)
+			}
+			seen[key] = struct{}{}
+			env = append(env, harness.TurnEnvVar{Name: key, Value: string(value)})
+		}
+	}
+	return env, nil
+}
+
+func (d *HarnessV1Dispatcher) handleStartTurnError(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	verified *verifiedHarnessV1Execution,
+	protocolClient harnessV1ProtocolClient,
+	request harness.StartTurnRequest,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+	startErr error,
+) error {
+	var clientErr harness.ClientError
+	if errors.As(startErr, &clientErr) {
+		switch {
+		case clientErr.RemoteAccepted:
+			accepted, err := d.transitionAttempt(ctx, attempt, fence, store.HarnessV1AttemptAccepted, "accepted-response-invalid", store.HarnessV1AttemptUpdates{})
+			if err != nil {
+				return err
+			}
+			return d.streamAcceptedAttempt(ctx, task, verified, protocolClient, request, accepted, fence)
+		case clientErr.IsDuplicateTurn(), clientErr.RemoteAcceptanceUnknown:
+			unknown, err := d.transitionAttempt(ctx, attempt, fence, store.HarnessV1AttemptSubmittedUnknown, "submission-unknown", store.HarnessV1AttemptUpdates{})
+			if err != nil {
+				return err
+			}
+			return d.recoverAmbiguousSubmission(ctx, task, verified, protocolClient, request, unknown, fence)
+		case isHarnessV1AdmissionClosedError(clientErr):
+			recoverable, err := d.transitionAttempt(
+				ctx,
+				attempt,
+				fence,
+				store.HarnessV1AttemptSubmittedUnknown,
+				harnessV1AdmissionClosedOperation,
+				store.HarnessV1AttemptUpdates{},
+			)
+			if err != nil {
+				return err
+			}
+			return d.projectAttemptState(ctx, task, recoverable, harnessV1AdmissionClosedMessage)
+		default:
+			return d.failUnsubmittedAttempt(ctx, task, attempt, fence, harnessV1ReasonRejected)
+		}
+	}
+	unknown, err := d.transitionAttempt(ctx, attempt, fence, store.HarnessV1AttemptSubmittedUnknown, "submission-unknown", store.HarnessV1AttemptUpdates{})
+	if err != nil {
+		return err
+	}
+	return d.recoverAmbiguousSubmission(ctx, task, verified, protocolClient, request, unknown, fence)
+}
+
+func isHarnessV1AdmissionClosedError(err harness.ClientError) bool {
+	return err.StatusCode == http.StatusConflict && err.Message == "wrapper admission is closed"
+}
+
+func isHarnessV1DurableTurnNotFoundError(err error) bool {
+	var clientErr harness.ClientError
+	return errors.As(err, &clientErr) && clientErr.StatusCode == http.StatusNotFound && clientErr.Message == "turn not found"
+}
+
+func harnessV1AttemptHasAdmissionClosedProof(attempt *store.HarnessV1Attempt) bool {
+	return attempt != nil && attempt.State == store.HarnessV1AttemptSubmittedUnknown &&
+		strings.HasPrefix(attempt.LastOperationID, harnessV1AdmissionClosedOperation+"-")
+}
+
+func (d *HarnessV1Dispatcher) retryAdmissionClosedStartTurn(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	verified *verifiedHarnessV1Execution,
+	protocolClient harnessV1ProtocolClient,
+	request harness.StartTurnRequest,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+) error {
+	accepted, startErr := protocolClient.StartTurn(ctx, request)
+	if startErr != nil {
+		var clientErr harness.ClientError
+		if !errors.As(startErr, &clientErr) {
+			// The request-write outcome is ambiguous. Preserve the durable
+			// admission-closed proof and require another exact ledger lookup
+			// before any later resend.
+			return startErr
+		}
+		switch {
+		case isHarnessV1AdmissionClosedError(clientErr):
+			return d.projectAttemptState(ctx, task, attempt, harnessV1AdmissionClosedMessage)
+		case clientErr.RemoteAccepted:
+			acceptedAttempt, err := d.transitionAttempt(
+				ctx, attempt, fence, store.HarnessV1AttemptAccepted,
+				"accepted-response-invalid-after-admission-reopen", store.HarnessV1AttemptUpdates{},
+			)
+			if err != nil {
+				return err
+			}
+			return d.streamAcceptedAttempt(ctx, task, verified, protocolClient, request, acceptedAttempt, fence)
+		case clientErr.IsDuplicateTurn(), clientErr.RemoteAcceptanceUnknown:
+			// Do not recursively resend after an ambiguous response. A future
+			// reconciliation must consult the durable ledger again.
+			return startErr
+		default:
+			return d.failUnsubmittedAttempt(ctx, task, attempt, fence, harnessV1ReasonRejected)
+		}
+	}
+
+	runtimeSessionID := string(accepted.RuntimeSessionID)
+	correlationID := accepted.CorrelationID
+	if correlationID == "" {
+		correlationID = attempt.CorrelationID
+	}
+	acceptedAttempt, err := d.transitionAttempt(
+		ctx,
+		attempt,
+		fence,
+		store.HarnessV1AttemptAccepted,
+		"accepted-after-admission-reopen",
+		store.HarnessV1AttemptUpdates{
+			RuntimeSessionID: &runtimeSessionID,
+			CorrelationID:    &correlationID,
+		},
+	)
+	if err != nil {
+		return err
+	}
+	return d.streamAcceptedAttempt(ctx, task, verified, protocolClient, request, acceptedAttempt, fence)
+}
+
+type persistedHarnessV1Evidence struct {
+	found             bool
+	lastSeq           int64
+	terminal          harness.FrameType
+	completed         *harness.TurnCompleted
+	failed            *harness.TurnFailed
+	brokeredToolCalls []harness.HarnessEventFrame
+}
+
+//nolint:gocyclo // Submission recovery keeps every durable evidence branch in one auditable state machine.
+func (d *HarnessV1Dispatcher) recoverAmbiguousSubmission(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	verified *verifiedHarnessV1Execution,
+	protocolClient harnessV1ProtocolClient,
+	request harness.StartTurnRequest,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+) error {
+	var durableOutcomeUnknownReceiptDigest string
+	status, statusErr := protocolClient.DurableTurnStatus(ctx, request.TurnID)
+	if statusErr == nil {
+		if status.TaskUID != attempt.TaskUID || status.Attempt != attempt.Attempt || status.RequestDigest != attempt.RequestDigest {
+			return d.markOutcomeUnknown(ctx, task, attempt, fence, harnessV1ReasonProtocolViolation)
+		}
+		switch status.State {
+		case harness.DurableTurnRejected:
+			if attempt.State == store.HarnessV1AttemptSubmitting || attempt.State == store.HarnessV1AttemptSubmittedUnknown {
+				return d.failUnsubmittedAttempt(ctx, task, attempt, fence, harnessV1ReasonRejected)
+			}
+			return d.markOutcomeUnknown(ctx, task, attempt, fence, harnessV1ReasonProtocolViolation)
+		case harness.DurableTurnOutcomeUnknown:
+			if err := validateHarnessV1DurableTerminalReceipt(status, request, true); err != nil {
+				return d.markOutcomeUnknown(ctx, task, attempt, fence, harnessV1ReasonProtocolViolation)
+			}
+			durableOutcomeUnknownReceiptDigest = status.TerminalReceiptDigest
+		case harness.DurableTurnTerminal:
+			if err := validateHarnessV1DurableTerminalReceipt(status, request, false); err != nil {
+				return d.markOutcomeUnknown(ctx, task, attempt, fence, harnessV1ReasonProtocolViolation)
+			}
+			accepted, err := d.ensureAttemptAccepted(ctx, attempt, fence, status.TerminalReceiptDigest)
+			if err != nil {
+				return err
+			}
+			frame, ok := status.TerminalReceipt.HarnessFrame()
+			if !ok {
+				return d.markOutcomeUnknown(ctx, task, accepted, fence, harnessV1ReasonProtocolViolation)
+			}
+			return d.settleTerminalFrameWithReceiptDigest(
+				ctx, task, protocolClient, request, accepted, fence, frame, status.TerminalReceiptDigest,
+			)
+		case harness.DurableTurnAccepted, harness.DurableTurnAdmitted:
+			accepted, err := d.ensureAttemptAccepted(ctx, attempt, fence, "")
+			if err != nil {
+				return err
+			}
+			attempt = accepted
+		}
+	}
+
+	evidence, err := d.persistedEvidence(ctx, task, attempt)
+	if err != nil {
+		return err
+	}
+	if evidence.terminal != "" {
+		accepted, err := d.ensureAttemptAccepted(ctx, attempt, fence, "")
+		if err != nil {
+			return err
+		}
+		return d.settlePersistedTerminal(ctx, task, protocolClient, request, accepted, fence, evidence)
+	}
+	if durableOutcomeUnknownReceiptDigest != "" {
+		return d.markOutcomeUnknownWithReceipt(
+			ctx, task, attempt, fence, harnessV1ReasonOutcomeUnknown, durableOutcomeUnknownReceiptDigest,
+		)
+	}
+	if evidence.found {
+		accepted, err := d.ensureAttemptAccepted(ctx, attempt, fence, "")
+		if err != nil {
+			return err
+		}
+		return d.streamAcceptedAttempt(ctx, task, verified, protocolClient, request, accepted, fence)
+	}
+	if harnessV1AttemptHasAdmissionClosedProof(attempt) && statusErr != nil {
+		if isHarnessV1DurableTurnNotFoundError(statusErr) {
+			return d.retryAdmissionClosedStartTurn(
+				ctx, task, verified, protocolClient, request, attempt, fence,
+			)
+		}
+		return fmt.Errorf("recover admission-closed harness v1 turn status: %w", statusErr)
+	}
+	if statusErr == nil && status != nil && status.State != harness.DurableTurnRejected {
+		accepted, err := d.ensureAttemptAccepted(ctx, attempt, fence, status.TerminalReceiptDigest)
+		if err != nil {
+			return err
+		}
+		return d.streamAcceptedAttempt(ctx, task, verified, protocolClient, request, accepted, fence)
+	}
+	if attempt.State == store.HarnessV1AttemptSubmitting {
+		var transitionErr error
+		attempt, transitionErr = d.transitionAttempt(ctx, attempt, fence, store.HarnessV1AttemptSubmittedUnknown, "submission-unknown-recovery", store.HarnessV1AttemptUpdates{})
+		if transitionErr != nil {
+			return transitionErr
+		}
+	}
+	return d.markOutcomeUnknown(ctx, task, attempt, fence, harnessV1ReasonOutcomeUnknown)
+}
+
+// recoverActiveAttempt consults the durable wrapper ledger before reopening a
+// frame stream. A wrapper can commit its terminal receipt immediately before
+// either side restarts, so streaming first could turn authoritative terminal
+// evidence into OutcomeUnknown when the process-local turn is gone.
+func (d *HarnessV1Dispatcher) recoverActiveAttempt(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	verified *verifiedHarnessV1Execution,
+	protocolClient harnessV1ProtocolClient,
+	request harness.StartTurnRequest,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+) error {
+	var durableOutcomeUnknownReceiptDigest string
+	status, statusErr := protocolClient.DurableTurnStatus(ctx, request.TurnID)
+	if statusErr == nil {
+		if status == nil || status.TurnID != attempt.TurnID || status.TaskUID != attempt.TaskUID ||
+			status.Attempt != attempt.Attempt || status.RequestDigest != attempt.RequestDigest {
+			return d.markOutcomeUnknown(ctx, task, attempt, fence, harnessV1ReasonProtocolViolation)
+		}
+		switch status.State {
+		case harness.DurableTurnTerminal:
+			if err := validateHarnessV1DurableTerminalReceipt(status, request, false); err != nil {
+				return d.markOutcomeUnknown(ctx, task, attempt, fence, harnessV1ReasonProtocolViolation)
+			}
+			frame, ok := status.TerminalReceipt.HarnessFrame()
+			if !ok {
+				return d.markOutcomeUnknown(ctx, task, attempt, fence, harnessV1ReasonProtocolViolation)
+			}
+			return d.settleTerminalFrameWithReceiptDigest(
+				ctx, task, protocolClient, request, attempt, fence, frame, status.TerminalReceiptDigest,
+			)
+		case harness.DurableTurnOutcomeUnknown:
+			if err := validateHarnessV1DurableTerminalReceipt(status, request, true); err != nil {
+				return d.markOutcomeUnknown(ctx, task, attempt, fence, harnessV1ReasonProtocolViolation)
+			}
+			durableOutcomeUnknownReceiptDigest = status.TerminalReceiptDigest
+		case harness.DurableTurnRejected:
+			// An active durable attempt cannot also have definitive
+			// non-acceptance evidence.
+			return d.markOutcomeUnknown(ctx, task, attempt, fence, harnessV1ReasonProtocolViolation)
+		case harness.DurableTurnAdmitted, harness.DurableTurnAccepted:
+			// Nonterminal ledger evidence is compatible with streaming below.
+		default:
+			return d.markOutcomeUnknown(ctx, task, attempt, fence, harnessV1ReasonProtocolViolation)
+		}
+	}
+	if durableOutcomeUnknownReceiptDigest != "" {
+		evidence, err := d.persistedEvidence(ctx, task, attempt)
+		if err != nil {
+			return err
+		}
+		if evidence.terminal != "" {
+			return d.settlePersistedTerminal(ctx, task, protocolClient, request, attempt, fence, evidence)
+		}
+		return d.markOutcomeUnknownWithReceipt(
+			ctx, task, attempt, fence, harnessV1ReasonOutcomeUnknown, durableOutcomeUnknownReceiptDigest,
+		)
+	}
+	return d.streamAcceptedAttempt(ctx, task, verified, protocolClient, request, attempt, fence)
+}
+
+func validateHarnessV1DurableTerminalReceipt(
+	status *harness.DurableTurnStatus,
+	request harness.StartTurnRequest,
+	wantOutcomeUnknown bool,
+) error {
+	if status == nil || status.TerminalReceipt == nil {
+		return errors.New("durable terminal receipt is required")
+	}
+	receipt := status.TerminalReceipt
+	if err := receipt.Validate(); err != nil {
+		return err
+	}
+	if receipt.RuntimeSessionID != request.RuntimeSessionID || receipt.TurnID != request.TurnID ||
+		receipt.CorrelationID != request.CorrelationID {
+		return errors.New("durable terminal receipt identity does not match the immutable request")
+	}
+	digest, err := harness.DurableTurnTerminalReceiptDigest(*receipt)
+	if err != nil {
+		return err
+	}
+	if digest != status.TerminalReceiptDigest {
+		return errors.New("durable terminal receipt digest mismatch")
+	}
+	isOutcomeUnknown := receipt.Kind == harness.DurableTurnTerminalOutcomeUnknown
+	if isOutcomeUnknown != wantOutcomeUnknown {
+		return errors.New("durable terminal receipt kind does not match ledger state")
+	}
+	return nil
+}
+
+func (d *HarnessV1Dispatcher) recoverSettlingAttempt(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	protocolClient harnessV1ProtocolClient,
+	request harness.StartTurnRequest,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+) error {
+	if attempt == nil || attempt.State != store.HarnessV1AttemptSettling {
+		return errors.New("a settling harness v1 attempt is required")
+	}
+	if err := store.ValidateCanonicalDigest("harness v1 settling terminal receipt digest", attempt.TerminalReceiptDigest); err != nil {
+		return err
+	}
+	status, statusErr := protocolClient.DurableTurnStatus(ctx, request.TurnID)
+	if statusErr == nil {
+		if status == nil || status.TurnID != attempt.TurnID || status.TaskUID != attempt.TaskUID ||
+			status.Attempt != attempt.Attempt || status.RequestDigest != attempt.RequestDigest {
+			return errors.New("settling durable turn status does not match the immutable attempt")
+		}
+	}
+	if statusErr == nil && status.State == harness.DurableTurnTerminal {
+		if err := validateHarnessV1DurableTerminalReceipt(status, request, false); err != nil {
+			return fmt.Errorf("validate settling durable terminal receipt: %w", err)
+		}
+		if status.TerminalReceiptDigest != attempt.TerminalReceiptDigest {
+			return errors.New("settling durable terminal receipt does not match the persisted receipt digest")
+		}
+		frame, ok := status.TerminalReceipt.HarnessFrame()
+		if !ok {
+			return errors.New("settling durable terminal receipt has no authoritative terminal frame")
+		}
+		return d.settleTerminalFrameWithReceiptDigest(
+			ctx, task, protocolClient, request, attempt, fence, frame, status.TerminalReceiptDigest,
+		)
+	}
+	if statusErr == nil {
+		switch status.State {
+		case harness.DurableTurnAdmitted, harness.DurableTurnAccepted:
+			// The terminal frame can become visible immediately before the wrapper
+			// commits its ledger receipt. Persisted mapped evidence may already be
+			// sufficient to finish controller-side settlement.
+		case harness.DurableTurnOutcomeUnknown:
+			if err := validateHarnessV1DurableTerminalReceipt(status, request, true); err != nil {
+				return fmt.Errorf("validate settling durable outcome-unknown receipt: %w", err)
+			}
+		default:
+			return fmt.Errorf("settling durable turn has incompatible ledger state %q", status.State)
+		}
+	}
+
+	evidence, err := d.persistedEvidence(ctx, task, attempt)
+	if err != nil {
+		return fmt.Errorf("recover settling persisted terminal evidence: %w", err)
+	}
+	if evidence.terminal != "" {
+		// settlePersistedTerminal reconstructs the canonical receipt and
+		// settleTerminalFrameWithReceiptDigest requires its digest to match the
+		// immutable digest already stored on the Settling attempt.
+		return d.settlePersistedTerminal(ctx, task, protocolClient, request, attempt, fence, evidence)
+	}
+	if statusErr != nil {
+		return fmt.Errorf("recover settling harness v1 terminal receipt: %w", statusErr)
+	}
+	return fmt.Errorf("durable terminal receipt is not yet available for settling turn %s", request.TurnID)
+}
+
+func (d *HarnessV1Dispatcher) ensureAttemptAccepted(
+	ctx context.Context,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+	receiptDigest string,
+) (*store.HarnessV1Attempt, error) {
+	if attempt.State == store.HarnessV1AttemptAccepted || attempt.State == store.HarnessV1AttemptRunning ||
+		attempt.State == store.HarnessV1AttemptCancelRequested || attempt.State == store.HarnessV1AttemptSettling {
+		return attempt, nil
+	}
+	updates := store.HarnessV1AttemptUpdates{}
+	if receiptDigest != "" {
+		updates.TerminalReceiptDigest = &receiptDigest
+	}
+	return d.transitionAttempt(ctx, attempt, fence, store.HarnessV1AttemptAccepted, "accepted-recovery", updates)
+}
+
+func harnessV1TurnDeadlineReached(request harness.StartTurnRequest, now time.Time) bool {
+	return !request.Deadline.IsZero() && !now.UTC().Before(request.Deadline.UTC())
+}
+
+func harnessV1CancellationSettlementDeadline(
+	request harness.StartTurnRequest,
+	attempt *store.HarnessV1Attempt,
+) (time.Time, bool) {
+	if request.Deadline.IsZero() || attempt == nil || attempt.CancelRequestedAt == nil {
+		return time.Time{}, false
+	}
+	windowStart := request.Deadline.UTC()
+	if requestedAt := attempt.CancelRequestedAt.UTC(); requestedAt.After(windowStart) {
+		windowStart = requestedAt
+	}
+	return windowStart.Add(defaultHarnessV1CancellationSettlementTimeout), true
+}
+
+func (d *HarnessV1Dispatcher) ensureHarnessV1CancellationRequested(
+	ctx context.Context,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+	operation string,
+) (*store.HarnessV1Attempt, error) {
+	if attempt.State == store.HarnessV1AttemptCancelRequested {
+		return attempt, nil
+	}
+	now := time.Now().UTC()
+	return d.transitionAttempt(
+		ctx, attempt, fence, store.HarnessV1AttemptCancelRequested, operation,
+		store.HarnessV1AttemptUpdates{CancelRequestedAt: &now},
+	)
+}
+
+func (d *HarnessV1Dispatcher) requestHarnessV1Cancellation(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	protocolClient harnessV1ProtocolClient,
+	request harness.StartTurnRequest,
+	reason string,
+) error {
+	_, err := protocolClient.CancelTurn(ctx, harness.CancelTurnRequest{
+		Version: harness.ProtocolVersion, Namespace: task.Namespace, TaskName: task.Name,
+		SessionName: request.SessionName, RuntimeSessionID: request.RuntimeSessionID,
+		TurnID: request.TurnID, CorrelationID: request.CorrelationID, Reason: reason,
+	})
+	if err != nil {
+		return fmt.Errorf("request harness v1 cancellation: %w", err)
+	}
+	return nil
+}
+
+//nolint:gocyclo // Streaming and terminal persistence are one crash-sensitive boundary.
+func (d *HarnessV1Dispatcher) streamAcceptedAttempt(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	verified *verifiedHarnessV1Execution,
+	protocolClient harnessV1ProtocolClient,
+	request harness.StartTurnRequest,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+) error {
+	evidence, err := d.persistedEvidence(ctx, task, attempt)
+	if err != nil {
+		return err
+	}
+	if evidence.terminal != "" {
+		return d.settlePersistedTerminal(ctx, task, protocolClient, request, attempt, fence, evidence)
+	}
+	current := attempt
+	now := time.Now().UTC()
+	cancelReason := "Task cancellation requested"
+	switch {
+	case harnessV1TurnDeadlineReached(request, now):
+		cancelReason = "Task deadline exceeded"
+		current, err = d.ensureHarnessV1CancellationRequested(
+			ctx, current, fence, "deadline-cancel-requested",
+		)
+		if err != nil {
+			return err
+		}
+	case !task.DeletionTimestamp.IsZero() || task.Status.Phase == corev1alpha1.TaskPhaseCancelled:
+		current, err = d.ensureHarnessV1CancellationRequested(
+			ctx, current, fence, "cancel-requested",
+		)
+		if err != nil {
+			return err
+		}
+	}
+	cancellationWindowExpired := false
+	if current.State == store.HarnessV1AttemptCancelRequested {
+		if cancellationDeadline, ok := harnessV1CancellationSettlementDeadline(request, current); ok {
+			cancellationWindowExpired = !now.Before(cancellationDeadline)
+		}
+		if !cancellationWindowExpired {
+			if err := d.requestHarnessV1Cancellation(ctx, task, protocolClient, request, cancelReason); err != nil {
+				return err
+			}
+		}
+	}
+	for _, frame := range evidence.brokeredToolCalls {
+		if frame.Seq <= current.LastEventSeq {
+			continue
+		}
+		if err := d.continueHarnessV1BrokeredToolCall(
+			ctx, task, verified, protocolClient, request, current, fence, frame,
+		); err != nil {
+			if errors.Is(err, errHarnessV1FrameAuthorityViolation) {
+				return d.markOutcomeUnknown(ctx, task, current, fence, harnessV1ReasonProtocolViolation)
+			}
+			return err
+		}
+		last := frame.Seq
+		current, err = d.transitionAttemptProgress(ctx, current, fence, last)
+		if err != nil {
+			return err
+		}
+	}
+	if evidence.lastSeq > current.LastEventSeq {
+		last := evidence.lastSeq
+		current, err = d.transitionAttemptProgress(ctx, current, fence, last)
+		if err != nil {
+			return err
+		}
+	}
+	if cancellationWindowExpired {
+		return d.markOutcomeUnknown(ctx, task, current, fence, harnessV1ReasonOutcomeUnknown)
+	}
+	journalState, err := (harness.TurnJournal{EventStore: d.EventStore, MapContext: harness.EventMapContext{
+		Namespace: task.Namespace, TaskName: task.Name, SessionName: request.SessionName,
+		AgentName: task.Status.AgentExecutionBinding.Agent.Name, StreamID: task.Name,
+	}}).Open(ctx)
+	if err != nil {
+		return err
+	}
+	var terminal *harness.HarnessEventFrame
+	pollTimeout := d.Interval
+	if pollTimeout <= 0 {
+		pollTimeout = DefaultHarnessV1DispatchInterval
+	}
+	pollDeadline := time.Now().UTC().Add(pollTimeout)
+	if !request.Deadline.IsZero() {
+		turnBoundary := request.Deadline.UTC()
+		if current.State == store.HarnessV1AttemptCancelRequested && harnessV1TurnDeadlineReached(request, time.Now().UTC()) {
+			if cancellationDeadline, ok := harnessV1CancellationSettlementDeadline(request, current); ok {
+				turnBoundary = cancellationDeadline
+			}
+		}
+		if turnBoundary.Before(pollDeadline) {
+			pollDeadline = turnBoundary
+		}
+	}
+	streamCtx, cancelStream := context.WithDeadline(ctx, pollDeadline)
+	lastSeenSeq := current.LastEventSeq
+	streamErr := protocolClient.StreamFrames(streamCtx, request.TurnID, current.LastEventSeq, func(frame harness.HarnessEventFrame) error {
+		if frame.RuntimeSessionID != request.RuntimeSessionID || frame.TurnID != request.TurnID ||
+			frame.CorrelationID != request.CorrelationID {
+			return fmt.Errorf("%w: frame identity does not match the durable attempt", errHarnessV1FrameAuthorityViolation)
+		}
+		if frame.Seq <= lastSeenSeq {
+			return fmt.Errorf("%w: got %d after %d", errHarnessV1FrameSequenceViolation, frame.Seq, lastSeenSeq)
+		}
+		if frame.Type == harness.FrameApprovalRequested {
+			return fmt.Errorf("%w: binding received an unauthorized approval request", errHarnessV1FrameAuthorityViolation)
+		}
+		if frame.Type == harness.FrameToolCallRequested &&
+			frozenHarnessV1ToolExecutionMode(verified.body) != harness.ToolExecutionModeBrokered {
+			return fmt.Errorf("%w: observed binding received an unauthorized continuation request", errHarnessV1FrameAuthorityViolation)
+		}
+		if _, _, err := journalState.AppendFrameIfNew(ctx, frame); err != nil {
+			return err
+		}
+		if frame.Type == harness.FrameToolCallRequested {
+			if err := d.continueHarnessV1BrokeredToolCall(
+				ctx, task, verified, protocolClient, request, current, fence, frame,
+			); err != nil {
+				return err
+			}
+		}
+		targetState := current.State
+		if targetState == store.HarnessV1AttemptAccepted {
+			targetState = store.HarnessV1AttemptRunning
+		}
+		seq := frame.Seq
+		if targetState == current.State {
+			current, err = d.transitionAttemptProgress(ctx, current, fence, seq)
+		} else {
+			current, err = d.transitionAttempt(ctx, current, fence, targetState, "frame-"+strconv.FormatInt(seq, 10), store.HarnessV1AttemptUpdates{LastEventSeq: &seq})
+		}
+		if err != nil {
+			return err
+		}
+		lastSeenSeq = seq
+		if frame.Type == harness.FrameTurnCompleted || frame.Type == harness.FrameTurnFailed || frame.Type == harness.FrameTurnCancelled {
+			copy := frame
+			terminal = &copy
+			return errHarnessV1TerminalFrame
+		}
+		return nil
+	})
+	streamCtxErr := streamCtx.Err()
+	cancelStream()
+	if errors.Is(streamErr, errHarnessV1TerminalFrame) {
+		streamErr = nil
+	}
+	if terminal != nil {
+		return d.settleTerminalFrame(ctx, task, protocolClient, request, current, fence, *terminal)
+	}
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	if errors.Is(streamErr, errHarnessV1FrameAuthorityViolation) {
+		return d.markOutcomeUnknown(ctx, task, current, fence, harnessV1ReasonProtocolViolation)
+	}
+	var clientErr harness.ClientError
+	if errors.As(streamErr, &clientErr) && clientErr.IsProtocolViolation() {
+		return d.markOutcomeUnknown(ctx, task, current, fence, harnessV1ReasonProtocolViolation)
+	}
+	normalPollBoundary := errors.Is(streamCtxErr, context.DeadlineExceeded) &&
+		(streamErr == nil || errors.Is(streamErr, context.Canceled) || errors.Is(streamErr, context.DeadlineExceeded))
+	if harnessV1TurnDeadlineReached(request, time.Now().UTC()) && current.State != store.HarnessV1AttemptCancelRequested {
+		current, err = d.ensureHarnessV1CancellationRequested(
+			ctx, current, fence, "deadline-cancel-requested",
+		)
+		if err != nil {
+			return err
+		}
+		if err := d.requestHarnessV1Cancellation(ctx, task, protocolClient, request, "Task deadline exceeded"); err != nil {
+			return err
+		}
+	}
+	if normalPollBoundary {
+		if current.State == store.HarnessV1AttemptCancelRequested {
+			if cancellationDeadline, ok := harnessV1CancellationSettlementDeadline(request, current); ok &&
+				!time.Now().UTC().Before(cancellationDeadline) {
+				return d.markOutcomeUnknown(ctx, task, current, fence, harnessV1ReasonOutcomeUnknown)
+			}
+		}
+		// A bounded poll lets the dispatcher release its active-Task guard so the
+		// next scan can observe post-accept cancellation or deletion and issue
+		// CancelTurn. It is a normal retry boundary, not a stream failure.
+		return nil
+	}
+	if streamErr != nil {
+		return fmt.Errorf("%w: %v", errHarnessV1StreamEndedWithoutTerminal, streamErr)
+	}
+	return errHarnessV1StreamEndedWithoutTerminal
+}
+
+func (d *HarnessV1Dispatcher) persistedEvidence(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attempt *store.HarnessV1Attempt,
+) (persistedHarnessV1Evidence, error) {
+	var evidence persistedHarnessV1Evidence
+	var after int64
+	for {
+		events, err := d.EventStore.ListExecutionEvents(ctx, store.ExecutionEventFilter{
+			Namespace: task.Namespace, StreamType: store.ExecutionEventStreamTypeTask, StreamID: task.Name,
+			AfterSeq: after, Limit: store.MaxExecutionEventLimit,
+		})
+		if err != nil {
+			return evidence, err
+		}
+		if len(events) == 0 {
+			return evidence, nil
+		}
+		for _, event := range events {
+			if event.Seq > after {
+				after = event.Seq
+			}
+			identity, ok := harness.MappedFrameIdentityFromEvent(event)
+			if !ok || !identity.HasTurnID(harness.HarnessTurnID(attempt.TurnID)) {
+				continue
+			}
+			evidence.found = true
+			if identity.Seq > evidence.lastSeq {
+				evidence.lastSeq = identity.Seq
+			}
+			if identity.FrameType == harness.FrameToolCallRequested {
+				var content struct {
+					FrameContent json.RawMessage `json:"frameContent"`
+				}
+				if err := json.Unmarshal(event.Content, &content); err != nil || len(content.FrameContent) == 0 {
+					return evidence, errors.New("persisted brokered harness v1 tool call is incomplete")
+				}
+				evidence.brokeredToolCalls = append(evidence.brokeredToolCalls, harness.HarnessEventFrame{
+					Version: identity.Version, Type: identity.FrameType, RuntimeSessionID: identity.RuntimeSessionID,
+					TurnID: identity.TurnID, CorrelationID: identity.CorrelationID, Seq: identity.Seq,
+					ToolName: event.ToolName, ToolCallID: event.ToolCallID, Content: content.FrameContent,
+				})
+			}
+			if identity.FrameType == harness.FrameTurnCompleted || identity.FrameType == harness.FrameTurnFailed || identity.FrameType == harness.FrameTurnCancelled {
+				evidence.terminal = identity.FrameType
+				var content struct {
+					Completed *harness.TurnCompleted `json:"completed"`
+					Failed    *harness.TurnFailed    `json:"failed"`
+				}
+				if err := json.Unmarshal(event.Content, &content); err == nil {
+					evidence.completed = content.Completed
+					evidence.failed = content.Failed
+				}
+			}
+		}
+		if len(events) < store.MaxExecutionEventLimit {
+			sort.Slice(evidence.brokeredToolCalls, func(i, j int) bool {
+				return evidence.brokeredToolCalls[i].Seq < evidence.brokeredToolCalls[j].Seq
+			})
+			return evidence, nil
+		}
+	}
+}
+
+func (d *HarnessV1Dispatcher) settlePersistedTerminal(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	protocolClient harnessV1ProtocolClient,
+	request harness.StartTurnRequest,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+	evidence persistedHarnessV1Evidence,
+) error {
+	frame := harness.HarnessEventFrame{
+		Version: harness.ProtocolVersion, Type: evidence.terminal, RuntimeSessionID: request.RuntimeSessionID,
+		TurnID: request.TurnID, CorrelationID: request.CorrelationID, Seq: evidence.lastSeq,
+		Completed: evidence.completed, Failed: evidence.failed,
+	}
+	return d.settleTerminalFrame(ctx, task, protocolClient, request, attempt, fence, frame)
+}
+
+func (d *HarnessV1Dispatcher) settleTerminalFrame(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	protocolClient harnessV1ProtocolClient,
+	request harness.StartTurnRequest,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+	frame harness.HarnessEventFrame,
+) error {
+	receipt, err := harness.DurableTurnTerminalReceiptFromFrame(frame)
+	if err != nil {
+		return err
+	}
+	receiptDigest, err := harness.DurableTurnTerminalReceiptDigest(receipt)
+	if err != nil {
+		return err
+	}
+	return d.settleTerminalFrameWithReceiptDigest(
+		ctx, task, protocolClient, request, attempt, fence, frame, receiptDigest,
+	)
+}
+
+func (d *HarnessV1Dispatcher) settleTerminalFrameWithReceiptDigest(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	protocolClient harnessV1ProtocolClient,
+	request harness.StartTurnRequest,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+	frame harness.HarnessEventFrame,
+	receiptDigest string,
+) error {
+	if err := store.ValidateCanonicalDigest("harness v1 terminal receipt digest", receiptDigest); err != nil {
+		return err
+	}
+	if attempt.State == store.HarnessV1AttemptSettling && attempt.TerminalReceiptDigest != receiptDigest {
+		return errors.New("terminal receipt does not match the persisted settling digest")
+	}
+	var err error
+	if attempt.State != store.HarnessV1AttemptSettling {
+		if store.IsTerminalHarnessV1AttemptState(attempt.State) {
+			return d.reconcileTerminalAttempt(ctx, task, attempt, fence)
+		}
+		updates := store.HarnessV1AttemptUpdates{
+			TerminalReceiptDigest: &receiptDigest,
+		}
+		if frame.Seq > attempt.LastEventSeq {
+			updates.LastEventSeq = &frame.Seq
+		}
+		attempt, err = d.transitionAttempt(ctx, attempt, fence, store.HarnessV1AttemptSettling, "settling", updates)
+		if err != nil {
+			return err
+		}
+	}
+	switch frame.Type {
+	case harness.FrameTurnCompleted:
+		if frame.Completed == nil {
+			return d.markOutcomeUnknown(ctx, task, attempt, fence, harnessV1ReasonProtocolViolation)
+		}
+		result := []byte(frame.Completed.Result)
+		if frame.Completed.OutputRef != "" {
+			result, err = protocolClient.FetchTurnOutput(ctx, request.TurnID, frame.Completed.OutputRef)
+			if err != nil {
+				return fmt.Errorf("fetch harness v1 terminal output: %w", err)
+			}
+		}
+		if err := d.saveTaskResult(ctx, task, result); err != nil {
+			return err
+		}
+		if frame.Completed.OutputRef != "" {
+			return d.finishAttemptWithOutputAcknowledgement(
+				ctx, task, protocolClient, request, attempt, fence,
+				store.HarnessV1AttemptSucceeded, "Succeeded", receiptDigest, frame.Completed.OutputRef,
+			)
+		}
+		return d.finishAttemptWithProtocol(
+			ctx, task, protocolClient, request, attempt, fence,
+			store.HarnessV1AttemptSucceeded, "Succeeded", receiptDigest,
+		)
+	case harness.FrameTurnFailed:
+		reason := harnessV1ReasonFailed
+		if frame.Failed != nil && frame.Failed.Retryable {
+			reason = harnessV1ReasonRetryableFailure
+		}
+		if frame.Failed != nil && frame.Failed.OutputRef != "" {
+			result, err := protocolClient.FetchTurnOutput(ctx, request.TurnID, frame.Failed.OutputRef)
+			if err != nil {
+				return fmt.Errorf("fetch harness v1 failed-turn output: %w", err)
+			}
+			if err := d.saveTaskResult(ctx, task, result); err != nil {
+				return err
+			}
+			return d.finishAttemptWithOutputAcknowledgement(
+				ctx, task, protocolClient, request, attempt, fence,
+				store.HarnessV1AttemptFailed, reason, receiptDigest, frame.Failed.OutputRef,
+			)
+		}
+		if frame.Failed != nil && frame.Failed.Result != "" {
+			if err := d.saveTaskResult(ctx, task, []byte(frame.Failed.Result)); err != nil {
+				return err
+			}
+		}
+		return d.finishAttemptWithProtocol(
+			ctx, task, protocolClient, request, attempt, fence,
+			store.HarnessV1AttemptFailed, reason, receiptDigest,
+		)
+	case harness.FrameTurnCancelled:
+		return d.finishAttemptWithProtocol(
+			ctx, task, protocolClient, request, attempt, fence,
+			store.HarnessV1AttemptCancelled, harnessV1ReasonCancelled, receiptDigest,
+		)
+	default:
+		return d.markOutcomeUnknown(ctx, task, attempt, fence, harnessV1ReasonProtocolViolation)
+	}
+}
+
+func (d *HarnessV1Dispatcher) cancelAttempt(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	verified *verifiedHarnessV1Execution,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+) error {
+	if attempt.State == store.HarnessV1AttemptPrepared {
+		return d.finishAttempt(ctx, task, attempt, fence, store.HarnessV1AttemptCancelled, harnessV1ReasonCancelled, "")
+	}
+	protocolClient, request, err := d.protocolClientAndRequest(ctx, task, verified, attempt)
+	if err != nil {
+		return d.markOutcomeUnknown(ctx, task, attempt, fence, harnessV1ReasonCredentialChanged)
+	}
+	if attempt.State == store.HarnessV1AttemptSubmitting || attempt.State == store.HarnessV1AttemptSubmittedUnknown {
+		return d.recoverAmbiguousSubmission(ctx, task, verified, protocolClient, request, attempt, fence)
+	}
+	if attempt.State != store.HarnessV1AttemptCancelRequested {
+		attempt, err = d.ensureHarnessV1CancellationRequested(ctx, attempt, fence, "cancel-requested")
+		if err != nil {
+			return err
+		}
+	}
+	// CancelAccepted is explicitly nonterminal; only a terminal frame or durable
+	// receipt may settle the attempt. streamAcceptedAttempt retries CancelTurn
+	// from the durable CancelRequested state before each bounded drain poll.
+	return d.streamAcceptedAttempt(ctx, task, verified, protocolClient, request, attempt, fence)
+}
+
+func (d *HarnessV1Dispatcher) failUnsubmittedAttempt(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+	reason string,
+) error {
+	if attempt.State != store.HarnessV1AttemptPrepared && attempt.State != store.HarnessV1AttemptSubmitting && attempt.State != store.HarnessV1AttemptSubmittedUnknown {
+		return d.markOutcomeUnknown(ctx, task, attempt, fence, reason)
+	}
+	updated, err := d.transitionAttempt(ctx, attempt, fence, store.HarnessV1AttemptRejected, "rejected-"+reason, store.HarnessV1AttemptUpdates{TerminalReason: &reason})
+	if err != nil {
+		return err
+	}
+	return d.reconcileTerminalAttempt(ctx, task, updated, fence)
+}
+
+func (d *HarnessV1Dispatcher) markOutcomeUnknown(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+	reason string,
+) error {
+	return d.markOutcomeUnknownWithReceipt(ctx, task, attempt, fence, reason, "")
+}
+
+func (d *HarnessV1Dispatcher) markOutcomeUnknownWithReceipt(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+	reason, receiptDigest string,
+) error {
+	if attempt.State == store.HarnessV1AttemptSubmitting {
+		var err error
+		attempt, err = d.transitionAttempt(ctx, attempt, fence, store.HarnessV1AttemptSubmittedUnknown, "submission-unknown-before-outcome", store.HarnessV1AttemptUpdates{})
+		if err != nil {
+			return err
+		}
+	}
+	if attempt.State == store.HarnessV1AttemptPrepared || attempt.State == store.HarnessV1AttemptRejected || store.IsTerminalHarnessV1AttemptState(attempt.State) {
+		if attempt.State == store.HarnessV1AttemptOutcomeUnknown {
+			return d.reconcileTerminalAttempt(ctx, task, attempt, fence)
+		}
+		return fmt.Errorf("attempt state %s cannot become OutcomeUnknown", attempt.State)
+	}
+	updates := store.HarnessV1AttemptUpdates{TerminalReason: &reason}
+	if receiptDigest != "" {
+		updates.TerminalReceiptDigest = &receiptDigest
+	}
+	updated, err := d.transitionAttempt(ctx, attempt, fence, store.HarnessV1AttemptOutcomeUnknown, "outcome-unknown-"+reason, updates)
+	if err != nil {
+		return err
+	}
+	return d.reconcileTerminalAttempt(ctx, task, updated, fence)
+}
+
+func (d *HarnessV1Dispatcher) finishAttempt(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+	target store.HarnessV1AttemptState,
+	reason, receiptDigest string,
+) error {
+	updated, err := d.finishAttemptDurably(ctx, attempt, fence, target, reason, receiptDigest)
+	if err != nil {
+		return err
+	}
+	return d.reconcileTerminalAttempt(ctx, task, updated, fence)
+}
+
+func (d *HarnessV1Dispatcher) finishAttemptWithProtocol(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	protocolClient harnessV1ProtocolClient,
+	request harness.StartTurnRequest,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+	target store.HarnessV1AttemptState,
+	reason, receiptDigest string,
+) error {
+	updated, err := d.finishAttemptDurably(ctx, attempt, fence, target, reason, receiptDigest)
+	if err != nil {
+		return err
+	}
+	return d.reconcileTerminalAttemptWithProtocol(ctx, task, updated, fence, protocolClient, &request)
+}
+
+func (d *HarnessV1Dispatcher) finishAttemptWithOutputAcknowledgement(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	protocolClient harnessV1ProtocolClient,
+	request harness.StartTurnRequest,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+	target store.HarnessV1AttemptState,
+	reason, receiptDigest, outputRef string,
+) error {
+	updated, err := d.finishAttemptDurably(ctx, attempt, fence, target, reason, receiptDigest)
+	if err != nil {
+		return err
+	}
+	if err := d.acknowledgeTerminalOutput(ctx, task, protocolClient, request, updated, outputRef); err != nil {
+		return err
+	}
+	return d.reconcileTerminalAttemptWithProtocol(ctx, task, updated, fence, protocolClient, &request)
+}
+
+func (d *HarnessV1Dispatcher) finishAttemptDurably(
+	ctx context.Context,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+	target store.HarnessV1AttemptState,
+	reason, receiptDigest string,
+) (*store.HarnessV1Attempt, error) {
+	if attempt.State == target {
+		return attempt, nil
+	}
+	updates := store.HarnessV1AttemptUpdates{TerminalReason: &reason}
+	if receiptDigest != "" {
+		updates.TerminalReceiptDigest = &receiptDigest
+	}
+	return d.transitionAttempt(ctx, attempt, fence, target, "terminal-"+string(target), updates)
+}
+
+func (d *HarnessV1Dispatcher) reconcileTerminalAttemptAfterOutputAcknowledgement(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+) error {
+	if (attempt.State != store.HarnessV1AttemptSucceeded && attempt.State != store.HarnessV1AttemptFailed) ||
+		attempt.TerminalReceiptDigest == "" {
+		return d.reconcileTerminalAttempt(ctx, task, attempt, fence)
+	}
+
+	outputRef, found, err := d.persistedTerminalOutputRef(ctx, task, attempt)
+	if err != nil {
+		return err
+	}
+	var (
+		protocolClient harnessV1ProtocolClient
+		request        harness.StartTurnRequest
+	)
+	if !found {
+		verified, loadErr := d.loadHarnessV1ExecutionForSettlement(ctx, task, task.Status.AgentExecutionBinding)
+		if loadErr != nil {
+			return loadErr
+		}
+		protocolClient, request, err = d.protocolClientAndRequest(ctx, task, verified, attempt)
+		if err != nil {
+			return err
+		}
+		status, statusErr := protocolClient.DurableTurnStatus(ctx, request.TurnID)
+		if statusErr != nil {
+			return fmt.Errorf("recover harness v1 terminal output receipt: %w", statusErr)
+		}
+		if status == nil || status.TurnID != attempt.TurnID || status.TaskUID != attempt.TaskUID ||
+			status.Attempt != attempt.Attempt || status.RequestDigest != attempt.RequestDigest ||
+			status.State != harness.DurableTurnTerminal || status.TerminalReceiptDigest != attempt.TerminalReceiptDigest {
+			return errors.New("durable terminal output receipt does not match the settled attempt")
+		}
+		if err := validateHarnessV1DurableTerminalReceipt(status, request, false); err != nil {
+			return fmt.Errorf("validate harness v1 terminal output receipt: %w", err)
+		}
+		frame, ok := status.TerminalReceipt.HarnessFrame()
+		if !ok {
+			return errors.New("durable terminal output receipt has no terminal frame")
+		}
+		outputRef = harnessV1TerminalOutputRef(frame)
+	}
+	if outputRef == "" {
+		return d.reconcileTerminalAttempt(ctx, task, attempt, fence)
+	}
+	if protocolClient == nil {
+		verified, loadErr := d.loadHarnessV1ExecutionForSettlement(ctx, task, task.Status.AgentExecutionBinding)
+		if loadErr != nil {
+			return loadErr
+		}
+		protocolClient, request, err = d.protocolClientAndRequest(ctx, task, verified, attempt)
+		if err != nil {
+			return err
+		}
+	}
+	if err := d.acknowledgeTerminalOutput(ctx, task, protocolClient, request, attempt, outputRef); err != nil {
+		return err
+	}
+	return d.reconcileTerminalAttempt(ctx, task, attempt, fence)
+}
+
+func (d *HarnessV1Dispatcher) persistedTerminalOutputRef(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attempt *store.HarnessV1Attempt,
+) (string, bool, error) {
+	evidence, err := d.persistedEvidence(ctx, task, attempt)
+	if err != nil {
+		return "", false, err
+	}
+	if evidence.terminal == "" {
+		return "", false, nil
+	}
+	frame := harness.HarnessEventFrame{
+		Version: harness.ProtocolVersion, Type: evidence.terminal,
+		RuntimeSessionID: harness.RuntimeSessionID(attempt.RuntimeSessionID),
+		TurnID:           harness.HarnessTurnID(attempt.TurnID), CorrelationID: attempt.CorrelationID,
+		Seq: evidence.lastSeq, Completed: evidence.completed, Failed: evidence.failed,
+	}
+	receipt, err := harness.DurableTurnTerminalReceiptFromFrame(frame)
+	if err != nil {
+		return "", false, err
+	}
+	digest, err := harness.DurableTurnTerminalReceiptDigest(receipt)
+	if err != nil {
+		return "", false, err
+	}
+	if digest != attempt.TerminalReceiptDigest {
+		return "", false, errors.New("persisted terminal output receipt does not match the settled attempt")
+	}
+	return harnessV1TerminalOutputRef(frame), true, nil
+}
+
+func harnessV1TerminalOutputRef(frame harness.HarnessEventFrame) string {
+	switch frame.Type {
+	case harness.FrameTurnCompleted:
+		if frame.Completed != nil {
+			return frame.Completed.OutputRef
+		}
+	case harness.FrameTurnFailed:
+		if frame.Failed != nil {
+			return frame.Failed.OutputRef
+		}
+	}
+	return ""
+}
+
+func (d *HarnessV1Dispatcher) acknowledgeTerminalOutput(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	protocolClient harnessV1ProtocolClient,
+	request harness.StartTurnRequest,
+	attempt *store.HarnessV1Attempt,
+	outputRef string,
+) error {
+	if outputRef == "" {
+		return nil
+	}
+	if !store.IsTerminalHarnessV1AttemptState(attempt.State) {
+		return errors.New("harness v1 output cannot be acknowledged before terminal attempt settlement")
+	}
+	if _, err := d.ResultStore.GetResult(ctx, task.Namespace, task.Name); err != nil {
+		return fmt.Errorf("verify durable harness v1 result before output acknowledgement: %w", err)
+	}
+	if err := protocolClient.AcknowledgeTurnOutput(ctx, harness.TurnOutputAcknowledgementRequest{
+		Version: harness.ProtocolVersion, TurnID: request.TurnID,
+		OutputRef: outputRef, TerminalReceiptDigest: attempt.TerminalReceiptDigest,
+	}); err != nil {
+		return fmt.Errorf("acknowledge durable harness v1 terminal output: %w", err)
+	}
+	return nil
+}
+
+func (d *HarnessV1Dispatcher) reconcileTerminalAttempt(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+) error {
+	return d.reconcileTerminalAttemptWithProtocol(ctx, task, attempt, fence, nil, nil)
+}
+
+func (d *HarnessV1Dispatcher) reconcileTerminalAttemptWithProtocol(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+	protocolClient harnessV1ProtocolClient,
+	request *harness.StartTurnRequest,
+) error {
+	retryPolicy, err := d.frozenRetryPolicy(ctx, attempt)
+	if err != nil {
+		return err
+	}
+	retrying := ((attempt.State == store.HarnessV1AttemptRejected && attempt.TerminalReason == harnessV1ReasonRejected) ||
+		(attempt.State == store.HarnessV1AttemptFailed && attempt.TerminalReason == harnessV1ReasonRetryableFailure)) &&
+		d.retryAllowed(task, attempt, retryPolicy)
+	verified, err := d.loadHarnessV1ExecutionForSettlement(ctx, task, task.Status.AgentExecutionBinding)
+	if err != nil {
+		return err
+	}
+	sessionSettled, err := d.finalizeHarnessV1TaskSession(ctx, task, verified, attempt, fence, retrying)
+	if err != nil {
+		return err
+	}
+	if !retrying {
+		if err := d.settleHarnessV1RuntimeSessionRecord(ctx, task, attempt); err != nil {
+			return err
+		}
+	}
+	if err := d.acknowledgeDurableHarnessV1Settlement(
+		ctx, task, verified, attempt, protocolClient, request,
+	); err != nil {
+		return err
+	}
+	if retrying {
+		return d.createRetryAttempt(ctx, task, attempt, fence, retryPolicy)
+	}
+	if sessionSettled {
+		// The deferred outbox projection is the only terminal Task visibility
+		// point for Session-backed execution.
+		return nil
+	}
+	return d.projectAttemptState(ctx, task, attempt, d.terminalMessage(attempt))
+}
+
+func (d *HarnessV1Dispatcher) acknowledgeDurableHarnessV1Settlement(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	verified *verifiedHarnessV1Execution,
+	attempt *store.HarnessV1Attempt,
+	protocolClient harnessV1ProtocolClient,
+	request *harness.StartTurnRequest,
+) error {
+	if task == nil || verified == nil || verified.body.HarnessV1 == nil || attempt == nil {
+		return errors.New("harness v1 settlement acknowledgement requires Task, execution, and attempt")
+	}
+	if !harnessV1AttemptRequiresWrapperSettlementAcknowledgement(attempt) {
+		return nil
+	}
+	ledgerBackedRejection := harnessV1AttemptIsLedgerBackedRejection(attempt)
+	turnID := harness.HarnessTurnID(attempt.TurnID)
+	if request != nil {
+		if request.TurnID != turnID || request.Metadata[harness.MetadataRequestDigest] != attempt.RequestDigest {
+			return errors.New("harness v1 settlement acknowledgement request does not match the durable attempt")
+		}
+	}
+	if protocolClient == nil {
+		var err error
+		protocolClient, err = d.protocolClientForHarnessV1Execution(ctx, verified)
+		if err != nil {
+			return fmt.Errorf("build harness v1 settlement acknowledgement client: %w", err)
+		}
+	}
+	if err := protocolClient.AcknowledgeTurnSettlement(ctx, harness.TurnSettlementAcknowledgementRequest{
+		Version: harness.ProtocolVersion, TurnID: turnID,
+		RequestDigest: attempt.RequestDigest, TerminalReceiptDigest: attempt.TerminalReceiptDigest,
+	}); err != nil {
+		if ledgerBackedRejection && isHarnessV1DurableTurnNotFoundError(err) {
+			// The wrapper can reject a malformed request before durable admission.
+			// There is no ledger row to retain or acknowledge in that case.
+			return nil
+		}
+		return fmt.Errorf("acknowledge durable harness v1 turn settlement: %w", err)
+	}
+	return nil
+}
+
+// AcknowledgeHarnessV1Settlement retries the wrapper's idempotent terminal
+// acknowledgement before Task finalization removes the durable attempt used
+// to reconstruct it.
+func (d *HarnessV1Dispatcher) AcknowledgeHarnessV1Settlement(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attempt *store.HarnessV1Attempt,
+) error {
+	if !harnessV1AttemptRequiresWrapperSettlementAcknowledgement(attempt) {
+		return nil
+	}
+	if task == nil || task.Status.AgentExecutionBinding == nil {
+		return errors.New("harness v1 settlement acknowledgement requires Task binding")
+	}
+	verified, err := d.loadHarnessV1ExecutionForSettlement(ctx, task, task.Status.AgentExecutionBinding)
+	if err != nil {
+		return fmt.Errorf("load harness v1 execution for settlement acknowledgement: %w", err)
+	}
+	return d.acknowledgeDurableHarnessV1Settlement(ctx, task, verified, attempt, nil, nil)
+}
+
+func harnessV1AttemptRequiresWrapperSettlementAcknowledgement(attempt *store.HarnessV1Attempt) bool {
+	if attempt == nil || attempt.Backend != string(corev1alpha1.AgentExecutionBackendHarnessWrapper) {
+		return false
+	}
+	return harnessV1AttemptIsLedgerBackedRejection(attempt) ||
+		(attempt.TerminalReceiptDigest != "" &&
+			(attempt.State == store.HarnessV1AttemptSucceeded || attempt.State == store.HarnessV1AttemptFailed ||
+				attempt.State == store.HarnessV1AttemptCancelled || attempt.State == store.HarnessV1AttemptOutcomeUnknown))
+}
+
+func harnessV1AttemptIsLedgerBackedRejection(attempt *store.HarnessV1Attempt) bool {
+	return attempt != nil && attempt.State == store.HarnessV1AttemptRejected &&
+		attempt.TerminalReason == harnessV1ReasonRejected && attempt.TerminalReceiptDigest == ""
+}
+
+func (d *HarnessV1Dispatcher) frozenRetryPolicy(
+	ctx context.Context,
+	attempt *store.HarnessV1Attempt,
+) (*corev1alpha1.RetryPolicy, error) {
+	snapshot, err := d.Snapshots.GetAgentExecutionSnapshot(ctx, store.AgentExecutionSnapshotKey{
+		TaskUID: attempt.TaskUID, Digest: attempt.SnapshotDigest,
+	})
+	if err != nil {
+		return nil, err
+	}
+	if store.CanonicalAgentExecutionSnapshotDigest(snapshot.Body) != attempt.SnapshotDigest {
+		return nil, errors.New("harness v1 retry snapshot digest mismatch")
+	}
+	body, err := decodeAgentExecutionSnapshot(snapshot.Body)
+	if err != nil {
+		return nil, err
+	}
+	if body.ContractVersion != string(corev1alpha1.AgentRuntimeContractHarnessV1) || body.HarnessV1 == nil {
+		return nil, errors.New("harness v1 retry snapshot route mismatch")
+	}
+	return body.RetryPolicy.DeepCopy(), nil
+}
+
+func (d *HarnessV1Dispatcher) retryAllowed(
+	task *corev1alpha1.Task,
+	attempt *store.HarnessV1Attempt,
+	policy *corev1alpha1.RetryPolicy,
+) bool {
+	return task != nil && attempt != nil && task.DeletionTimestamp.IsZero() &&
+		attempt.DuplicateSafe && attempt.RetryClass == store.HarnessV1RetryClassDuplicateSafe &&
+		policy != nil && attempt.Attempt <= policy.MaxRetries &&
+		attempt.State != store.HarnessV1AttemptOutcomeUnknown
+}
+
+func (d *HarnessV1Dispatcher) createRetryAttempt(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	previous *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+	retryPolicy *corev1alpha1.RetryPolicy,
+) error {
+	if delay := harnessV1RetryDelay(retryPolicy, previous.Attempt); delay > 0 && time.Since(previous.UpdatedAt) < delay {
+		return nil
+	}
+	number := previous.Attempt + 1
+	turnID := harnessV1TurnID(task, number)
+	next := &store.HarnessV1Attempt{
+		Namespace: previous.Namespace, TaskName: previous.TaskName, TaskUID: previous.TaskUID, Attempt: number,
+		BindingDigest: previous.BindingDigest, SnapshotDigest: previous.SnapshotDigest,
+		TurnID: string(turnID), RuntimeSessionID: previous.RuntimeSessionID, CorrelationID: previous.CorrelationID,
+		Backend: previous.Backend, BackendEndpoint: previous.BackendEndpoint,
+		AuthSecretNamespace: previous.AuthSecretNamespace, AuthSecretName: previous.AuthSecretName,
+		AuthSecretKey: previous.AuthSecretKey, AuthSecretUID: previous.AuthSecretUID,
+		AuthSecretResourceVersion: previous.AuthSecretResourceVersion,
+		State:                     store.HarnessV1AttemptPrepared, DuplicateSafe: previous.DuplicateSafe, RetryClass: previous.RetryClass,
+		ControllerEpochName: fence.Name, ControllerEpoch: fence.Epoch,
+	}
+	verifier := TaskReconciler{
+		Client: d.Client, APIReader: d.APIReader, AgentExecutionSnapshots: d.Snapshots,
+	}
+	verified, err := verifier.loadVerifiedHarnessV1ExecutionForRecovery(
+		ctx, task, task.Status.AgentExecutionBinding, false,
+	)
+	if err != nil {
+		return err
+	}
+	env, err := resolveFrozenHarnessV1Env(ctx, d.APIReader, verified.body.HarnessV1.CredentialRefs)
+	if err != nil {
+		return err
+	}
+	request, err := buildHarnessV1StartTurnRequest(task, verified, next, env)
+	if err != nil {
+		return err
+	}
+	next.RequestDigest, err = harness.CanonicalStartTurnRequestDigest(request)
+	if err != nil {
+		return err
+	}
+	if err := d.Attempts.CreateHarnessV1Attempt(ctx, next, fence); err != nil {
+		return err
+	}
+	return d.projectAttemptState(ctx, task, next, "queued safe harness v1 retry")
+}
+
+func harnessV1RetryDelay(policy *corev1alpha1.RetryPolicy, completedAttempt int32) time.Duration {
+	if policy == nil || policy.InitialDelay == nil || policy.InitialDelay.Duration <= 0 {
+		return 0
+	}
+	const maxDelay = 5 * time.Minute
+	delay := float64(policy.InitialDelay.Duration)
+	if delay >= float64(maxDelay) {
+		return maxDelay
+	}
+	multiplier := policy.BackoffMultiplier
+	if multiplier <= 0 {
+		multiplier = 1
+	}
+	for i := int32(1); i < completedAttempt; i++ {
+		delay *= multiplier
+		if delay >= float64(maxDelay) {
+			return maxDelay
+		}
+	}
+	return time.Duration(delay)
+}
+
+func (d *HarnessV1Dispatcher) transitionAttempt(
+	ctx context.Context,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+	target store.HarnessV1AttemptState,
+	operation string,
+	updates store.HarnessV1AttemptUpdates,
+) (*store.HarnessV1Attempt, error) {
+	digest, err := acpDomainDigest("harness-v1-attempt-transition", struct {
+		ID        string                        `json:"id"`
+		Version   int64                         `json:"version"`
+		From      store.HarnessV1AttemptState   `json:"from"`
+		To        store.HarnessV1AttemptState   `json:"to"`
+		Operation string                        `json:"operation"`
+		Updates   store.HarnessV1AttemptUpdates `json:"updates"`
+	}{harnessV1AttemptKey(attempt).CanonicalID(), attempt.Version, attempt.State, target, operation, updates})
+	if err != nil {
+		return nil, err
+	}
+	return d.Attempts.TransitionHarnessV1Attempt(ctx, store.HarnessV1AttemptTransition{
+		Key: harnessV1AttemptKey(attempt), ExpectedVersion: attempt.Version, ExpectedState: attempt.State, TargetState: target,
+		OperationID: operation + "-" + strconv.FormatInt(attempt.Version, 10), OperationDigest: digest,
+		Fence: fence, Updates: updates,
+	})
+}
+
+func (d *HarnessV1Dispatcher) transitionAttemptProgress(
+	ctx context.Context,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+	seq int64,
+) (*store.HarnessV1Attempt, error) {
+	if seq <= attempt.LastEventSeq {
+		return attempt, nil
+	}
+	// Progress uses the legal Running -> Running self-transition only through an
+	// explicit store operation. The aggregate transition validator intentionally
+	// excludes self-transitions, so persist progress while advancing Accepted to
+	// Running; subsequent sequence durability is represented by mapped frames and
+	// folded into the next state transition.
+	if attempt.State == store.HarnessV1AttemptAccepted {
+		return d.transitionAttempt(ctx, attempt, fence, store.HarnessV1AttemptRunning, "running-"+strconv.FormatInt(seq, 10), store.HarnessV1AttemptUpdates{LastEventSeq: &seq})
+	}
+	return attempt, nil
+}
+
+func (d *HarnessV1Dispatcher) projectAttemptState(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attempt *store.HarnessV1Attempt,
+	message string,
+) error {
+	key := types.NamespacedName{Namespace: task.Namespace, Name: task.Name}
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		latest := &corev1alpha1.Task{}
+		if err := d.Client.Get(ctx, key, latest); err != nil {
+			return client.IgnoreNotFound(err)
+		}
+		if latest.UID != task.UID || latest.Status.AgentExecutionBinding == nil ||
+			latest.Status.AgentExecutionBinding.BindingDigest != attempt.BindingDigest {
+			return errors.New("task binding changed before harness v1 status projection")
+		}
+		if latest.Status.HarnessRuntime != nil && latest.Status.HarnessRuntime.Attempt > attempt.Attempt {
+			return nil
+		}
+		if harnessV1AttemptProjectionMatches(latest, attempt) {
+			return nil
+		}
+		base := latest.DeepCopy()
+		now := metav1.Now()
+		state, outcome, phase := harnessV1TaskProjection(attempt.State)
+		if latest.Status.HarnessRuntime == nil {
+			latest.Status.HarnessRuntime = &corev1alpha1.HarnessRuntimeStatus{ContractVersion: harness.ProtocolVersion}
+		}
+		latest.Status.HarnessRuntime.Attempt = attempt.Attempt
+		latest.Status.HarnessRuntime.TurnID = attempt.TurnID
+		latest.Status.HarnessRuntime.RuntimeSessionID = attempt.RuntimeSessionID
+		latest.Status.HarnessRuntime.State = state
+		latest.Status.HarnessRuntime.Outcome = outcome
+		latest.Status.HarnessRuntime.Reason = attempt.TerminalReason
+		latest.Status.HarnessRuntime.TerminalReceiptDigest = attempt.TerminalReceiptDigest
+		latest.Status.HarnessRuntime.RequestDigest = attempt.RequestDigest
+		latest.Status.HarnessRuntime.ControllerEpoch = attempt.ControllerEpoch
+		latest.Status.HarnessRuntime.LastEventSeq = attempt.LastEventSeq
+		latest.Status.HarnessRuntime.Message = message
+		latest.Status.HarnessRuntime.LastTransitionTime = &now
+		if attempt.CancelRequestedAt != nil {
+			requestedAt := metav1.NewTime(attempt.CancelRequestedAt.UTC())
+			latest.Status.HarnessRuntime.CancelRequestedAt = &requestedAt
+		} else {
+			latest.Status.HarnessRuntime.CancelRequestedAt = nil
+		}
+		latest.Status.Attempts = attempt.Attempt
+		latest.Status.Phase = phase
+		latest.Status.Message = message
+		if latest.Status.StartTime == nil && phase == corev1alpha1.TaskPhaseRunning {
+			latest.Status.StartTime = &now
+		}
+		if store.IsTerminalHarnessV1AttemptState(attempt.State) {
+			latest.Status.CompletionTime = &now
+		}
+		return d.Client.Status().Patch(ctx, latest, client.MergeFrom(base))
+	})
+}
+
+func (d *HarnessV1Dispatcher) saveTaskResult(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	result []byte,
+) error {
+	if err := d.ResultStore.SaveResult(ctx, task.Namespace, task.Name, result); err != nil {
+		return err
+	}
+	key := types.NamespacedName{Namespace: task.Namespace, Name: task.Name}
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		latest := &corev1alpha1.Task{}
+		if err := d.Client.Get(ctx, key, latest); err != nil {
+			return err
+		}
+		if latest.UID != task.UID {
+			return errors.New("task UID changed before harness v1 result projection")
+		}
+		if latest.Status.ResultRef != nil && latest.Status.ResultRef.Available {
+			task.Status = latest.Status
+			return nil
+		}
+		base := latest.DeepCopy()
+		latest.Status.ResultRef = &corev1alpha1.ResultReference{Available: true}
+		if err := d.Client.Status().Patch(ctx, latest, client.MergeFrom(base)); err != nil {
+			return err
+		}
+		task.Status = latest.Status
+		return nil
+	})
+}
+
+func harnessV1AttemptProjectionMatches(task *corev1alpha1.Task, attempt *store.HarnessV1Attempt) bool {
+	if task == nil || attempt == nil || task.Status.HarnessRuntime == nil {
+		return false
+	}
+	state, outcome, phase := harnessV1TaskProjection(attempt.State)
+	runtime := task.Status.HarnessRuntime
+	if runtime.Attempt != attempt.Attempt || runtime.TurnID != attempt.TurnID ||
+		runtime.RuntimeSessionID != attempt.RuntimeSessionID || runtime.State != state ||
+		runtime.Outcome != outcome || runtime.Reason != attempt.TerminalReason ||
+		runtime.TerminalReceiptDigest != attempt.TerminalReceiptDigest ||
+		runtime.RequestDigest != attempt.RequestDigest || runtime.ControllerEpoch != attempt.ControllerEpoch ||
+		runtime.LastEventSeq != attempt.LastEventSeq || runtime.LastTransitionTime == nil ||
+		task.Status.Attempts != attempt.Attempt || task.Status.Phase != phase {
+		return false
+	}
+	if attempt.CancelRequestedAt == nil {
+		if runtime.CancelRequestedAt != nil {
+			return false
+		}
+	} else if runtime.CancelRequestedAt == nil || !runtime.CancelRequestedAt.Time.Equal(attempt.CancelRequestedAt.UTC()) {
+		return false
+	}
+	return !store.IsTerminalHarnessV1AttemptState(attempt.State) || task.Status.CompletionTime != nil
+}
+
+func harnessV1TaskProjection(state store.HarnessV1AttemptState) (
+	corev1alpha1.TaskExecutionState,
+	corev1alpha1.TaskExecutionOutcome,
+	corev1alpha1.TaskPhase,
+) {
+	switch state {
+	case store.HarnessV1AttemptPrepared:
+		return corev1alpha1.TaskExecutionStateQueued, "", corev1alpha1.TaskPhaseRunning
+	case store.HarnessV1AttemptSubmitting:
+		return corev1alpha1.TaskExecutionStateSubmitting, "", corev1alpha1.TaskPhaseRunning
+	case store.HarnessV1AttemptSubmittedUnknown:
+		return corev1alpha1.TaskExecutionStateSubmittedUnknown, "", corev1alpha1.TaskPhaseRunning
+	case store.HarnessV1AttemptAccepted:
+		return corev1alpha1.TaskExecutionStateAccepted, "", corev1alpha1.TaskPhaseRunning
+	case store.HarnessV1AttemptRunning:
+		return corev1alpha1.TaskExecutionStateRunning, "", corev1alpha1.TaskPhaseRunning
+	case store.HarnessV1AttemptCancelRequested, store.HarnessV1AttemptSettling:
+		return corev1alpha1.TaskExecutionStateSettling, "", corev1alpha1.TaskPhaseRunning
+	case store.HarnessV1AttemptSucceeded:
+		return corev1alpha1.TaskExecutionStateSucceeded, corev1alpha1.TaskExecutionOutcomeSucceeded, corev1alpha1.TaskPhaseSucceeded
+	case store.HarnessV1AttemptCancelled:
+		return corev1alpha1.TaskExecutionStateCancelled, corev1alpha1.TaskExecutionOutcomeCancelled, corev1alpha1.TaskPhaseCancelled
+	case store.HarnessV1AttemptOutcomeUnknown:
+		return corev1alpha1.TaskExecutionStateOutcomeUnknown, corev1alpha1.TaskExecutionOutcomeOutcomeUnknown, corev1alpha1.TaskPhaseFailed
+	case store.HarnessV1AttemptRejected, store.HarnessV1AttemptFailed:
+		return corev1alpha1.TaskExecutionStateFailed, corev1alpha1.TaskExecutionOutcomeFailed, corev1alpha1.TaskPhaseFailed
+	default:
+		return corev1alpha1.TaskExecutionStateOutcomeUnknown, corev1alpha1.TaskExecutionOutcomeOutcomeUnknown, corev1alpha1.TaskPhaseFailed
+	}
+}
+
+func (d *HarnessV1Dispatcher) terminalMessage(attempt *store.HarnessV1Attempt) string {
+	switch attempt.State {
+	case store.HarnessV1AttemptSucceeded:
+		return "harness v1 turn succeeded"
+	case store.HarnessV1AttemptCancelled:
+		return "harness v1 turn cancelled"
+	case store.HarnessV1AttemptOutcomeUnknown:
+		return harnessV1OutcomeUnknownMessage
+	case store.HarnessV1AttemptRejected:
+		return "harness v1 turn was definitively not accepted"
+	default:
+		return "harness v1 turn failed"
+	}
+}
+
+func harnessV1AttemptKey(a *store.HarnessV1Attempt) store.HarnessV1AttemptKey {
+	return store.HarnessV1AttemptKey{Namespace: a.Namespace, TaskUID: a.TaskUID, Attempt: a.Attempt}
+}
+
+var _ interface{ NeedLeaderElection() bool } = (*HarnessV1Dispatcher)(nil)
+var _ HarnessV1SettlementAcknowledger = (*HarnessV1Dispatcher)(nil)
diff --git a/internal/controller/harness_v1_dispatcher_test.go b/internal/controller/harness_v1_dispatcher_test.go
new file mode 100644
index 000000000..c990002eb
--- /dev/null
+++ b/internal/controller/harness_v1_dispatcher_test.go
@@ -0,0 +1,2719 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package controller
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/harness"
+	"github.com/orka-agents/orka/internal/store"
+	"github.com/orka-agents/orka/internal/store/sqlite"
+)
+
+func TestHarnessV1RetryDelayCapsBeforeDurationOverflow(t *testing.T) {
+	policy := &corev1alpha1.RetryPolicy{
+		MaxRetries:        20,
+		BackoffMultiplier: 10,
+		InitialDelay:      &metav1.Duration{Duration: time.Minute},
+	}
+	if delay := harnessV1RetryDelay(policy, 20); delay != 5*time.Minute {
+		t.Fatalf("harnessV1RetryDelay() = %s, want 5m cap", delay)
+	}
+}
+
+func TestBuildHarnessV1StartTurnRequestUsesStableCanonicalDigest(t *testing.T) {
+	boundAt := time.Date(2026, 8, 5, 18, 0, 0, 123000000, time.UTC)
+	bindingDigest := "sha256:" + strings.Repeat("a", 64)
+	snapshotDigest := "sha256:" + strings.Repeat("b", 64)
+	task := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{
+		Namespace: "default", Name: "turn-task", UID: types.UID("task-uid"),
+		CreationTimestamp: metav1.NewTime(boundAt.Add(-30 * time.Second)),
+	}}
+	verified := &verifiedHarnessV1Execution{
+		binding: &corev1alpha1.AgentExecutionBinding{
+			BindingDigest: bindingDigest, BoundAt: metav1.NewTime(boundAt),
+			Snapshot: corev1alpha1.AgentExecutionSnapshotRef{Digest: snapshotDigest},
+		},
+		body: agentExecutionSnapshotBody{
+			Prompt: "perform the work", Timeout: "2m",
+			Configuration: agentExecutionSnapshotConfig{
+				Model: "frozen-model", SystemPrompt: "frozen system prompt",
+				MaxTurns: 7, ReasoningEffort: "high",
+			},
+			DefaultTools: &agentExecutionSnapshotToolPolicy{
+				AllowedToolsOmitted: false, AllowedTools: []string{"Read"}, AllowBash: new(true),
+			},
+			RuntimeOverride: &corev1alpha1.AgentRuntimeSpec{
+				AllowedTools: []string{}, DisallowedTools: []string{"Bash"}, AllowBash: new(false),
+			},
+			HarnessV1: &agentExecutionSnapshotHarnessV1{
+				SessionName: "session-a", RuntimeName: string(corev1alpha1.AgentRuntimeCodex), RuntimeAuthOnly: true,
+			},
+		},
+	}
+	attempt := &store.HarnessV1Attempt{
+		Namespace: task.Namespace, TaskName: task.Name, TaskUID: string(task.UID), Attempt: 1,
+		BindingDigest: bindingDigest, SnapshotDigest: snapshotDigest,
+		RuntimeSessionID: "runtime-session-a", TurnID: "turn-a", CorrelationID: "correlation-a",
+	}
+	env := []harness.TurnEnvVar{{Name: "PROVIDER_TOKEN", Value: "test-value"}}
+
+	request, err := buildHarnessV1StartTurnRequest(task, verified, attempt, env)
+	if err != nil {
+		t.Fatal(err)
+	}
+	wantDeadline := task.CreationTimestamp.Add(2 * time.Minute)
+	if !request.Deadline.Equal(wantDeadline) {
+		t.Fatalf("deadline = %s, want %s", request.Deadline, wantDeadline)
+	}
+	if request.Metadata["runtimeAuthOnly"] != "true" {
+		t.Fatalf("runtimeAuthOnly metadata = %q, want true", request.Metadata["runtimeAuthOnly"])
+	}
+	for key, want := range map[string]string{
+		harness.MetadataRuntimePolicyFrozen: "true",
+		harness.MetadataAllowedToolsSet:     "true",
+		"runtime":                           string(corev1alpha1.AgentRuntimeCodex),
+		"orka.runtimeName":                  string(corev1alpha1.AgentRuntimeCodex),
+		"model":                             "frozen-model",
+		"systemPrompt":                      "frozen system prompt",
+		"maxTurns":                          "7",
+		"reasoningEffort":                   "high",
+		"allowedTools":                      "",
+		"disallowedTools":                   "Bash",
+		"allowBash":                         "false",
+		"readOnly":                          "true",
+	} {
+		if got := request.Metadata[key]; got != want {
+			t.Fatalf("metadata[%q] = %q, want %q", key, got, want)
+		}
+	}
+	digest, err := harness.CanonicalStartTurnRequestDigest(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	attempt.RequestDigest = digest
+
+	reconstructed, err := buildHarnessV1StartTurnRequest(task, verified, attempt, env)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if reconstructed.Metadata[harness.MetadataRequestDigest] != digest {
+		t.Fatalf("request metadata digest = %q, want %q", reconstructed.Metadata[harness.MetadataRequestDigest], digest)
+	}
+	reconstructedDigest, err := harness.CanonicalStartTurnRequestDigest(reconstructed)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if reconstructedDigest != digest {
+		t.Fatalf("reconstructed digest = %q, want %q", reconstructedDigest, digest)
+	}
+
+	mutatedAuth := *verified
+	mutatedAuth.body = verified.body
+	mutatedHarnessV1 := *verified.body.HarnessV1
+	mutatedHarnessV1.RuntimeAuthOnly = false
+	mutatedAuth.body.HarnessV1 = &mutatedHarnessV1
+	if _, err := buildHarnessV1StartTurnRequest(task, &mutatedAuth, attempt, env); err == nil ||
+		!strings.Contains(err.Error(), "does not match the durable attempt") {
+		t.Fatalf("mutated runtime-auth-only error = %v, want durable digest mismatch", err)
+	}
+
+	mutated := *verified
+	mutated.body = verified.body
+	mutated.body.Prompt = "different prompt"
+	if _, err := buildHarnessV1StartTurnRequest(task, &mutated, attempt, env); err == nil ||
+		!strings.Contains(err.Error(), "does not match the durable attempt") {
+		t.Fatalf("mutated request error = %v, want durable digest mismatch", err)
+	}
+}
+
+func TestContinueHarnessV1BrokeredToolCallReplaysDurableResult(t *testing.T) {
+	fixture := newHarnessV1DispatcherStateFixture(t)
+	tool := &corev1alpha1.Tool{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: fixture.task.Namespace, Name: "lookup", UID: types.UID("lookup-tool-uid"), Generation: 1,
+		},
+		Spec: corev1alpha1.ToolSpec{
+			Description: "look up a value", BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassRead,
+			HTTP: &corev1alpha1.HTTPExecution{URL: "https://tools.example.test/lookup", Method: http.MethodPost},
+		},
+	}
+	if err := fixture.dispatcher.Client.Create(fixture.ctx, tool); err != nil {
+		t.Fatal(err)
+	}
+	current := &corev1alpha1.Tool{}
+	if err := fixture.dispatcher.APIReader.Get(fixture.ctx, client.ObjectKeyFromObject(tool), current); err != nil {
+		t.Fatal(err)
+	}
+	digest, err := harnessV1BrokeredToolDefinitionDigest(current)
+	if err != nil {
+		t.Fatal(err)
+	}
+	fixture.verified.body.HarnessV1.ToolExecutionMode = string(harness.ToolExecutionModeBrokered)
+	fixture.verified.body.HarnessV1.BrokeredToolClasses = []corev1alpha1.AgentRuntimeBrokeredToolClass{
+		corev1alpha1.AgentRuntimeBrokeredToolClassRead,
+	}
+	fixture.verified.body.HarnessV1.BrokeredTools = []agentExecutionSnapshotHarnessV1BrokeredTool{{
+		Name: current.Name, Description: current.Spec.Description, BrokeredClass: current.Spec.BrokeredToolClass,
+		Parameters: json.RawMessage(`{"type":"object","properties":{"query":{"type":"string","minLength":2}},"required":["query"],"additionalProperties":false}`),
+		UID:        string(current.UID), Generation: current.Generation,
+		DefinitionDigest: digest,
+	}}
+	call := harness.ToolCallRequest{
+		Version: harness.ProtocolVersion, RuntimeSessionID: fixture.request.RuntimeSessionID,
+		TurnID: fixture.request.TurnID, ToolCallID: "call-1", ToolName: current.Name,
+		Input: json.RawMessage(`{"query":"value"}`),
+	}
+	call.IdempotencyKey = harness.ToolRequestIdempotencyKey(call.RuntimeSessionID, call.TurnID, call.ToolCallID)
+	content, err := json.Marshal(call)
+	if err != nil {
+		t.Fatal(err)
+	}
+	frame := harness.HarnessEventFrame{
+		Version: harness.ProtocolVersion, Type: harness.FrameToolCallRequested,
+		RuntimeSessionID: fixture.request.RuntimeSessionID, TurnID: fixture.request.TurnID,
+		CorrelationID: fixture.request.CorrelationID, Seq: 2,
+		ToolName: current.Name, ToolCallID: call.ToolCallID, Content: content,
+	}
+	executeCalls := 0
+	fixture.dispatcher.ExternalEffects = fixture.durable
+	fixture.dispatcher.BrokeredToolExecutor = HarnessV1BrokeredToolExecutorFunc(func(
+		_ context.Context,
+		namespace string,
+		gotTool *corev1alpha1.Tool,
+		request harness.ToolCallRequest,
+	) (json.RawMessage, error) {
+		executeCalls++
+		if namespace != fixture.task.Namespace || gotTool.UID != current.UID || request.IdempotencyKey != call.IdempotencyKey {
+			t.Fatalf("unexpected brokered execution: namespace=%q tool=%s request=%+v", namespace, gotTool.UID, request)
+		}
+		return json.RawMessage(`{"answer":42}`), nil
+	})
+	var continuedResults []harness.ToolCallResult
+	protocolClient := &recordingHarnessV1RecoveryClient{continueTurn: func(
+		_ context.Context,
+		request harness.ContinueTurnRequest,
+	) (*harness.ContinueTurnResponse, error) {
+		if err := request.Validate(); err != nil {
+			t.Fatalf("invalid ContinueTurn request: %v", err)
+		}
+		continuedResults = append(continuedResults, request.ToolResults[0])
+		return &harness.ContinueTurnResponse{
+			Version: harness.ProtocolVersion, Accepted: true, RuntimeSessionID: request.RuntimeSessionID,
+			TurnID: request.TurnID, CorrelationID: request.CorrelationID,
+		}, nil
+	}}
+
+	for i := range 2 {
+		if err := fixture.dispatcher.continueHarnessV1BrokeredToolCall(
+			fixture.ctx, fixture.task, fixture.verified, protocolClient, fixture.request,
+			fixture.attempt, fixture.fence, frame,
+		); err != nil {
+			t.Fatalf("continue brokered call %d: %v", i+1, err)
+		}
+	}
+	if executeCalls != 1 {
+		t.Fatalf("brokered executor calls = %d, want one durable execution", executeCalls)
+	}
+	if protocolClient.continueCalls != 2 || len(continuedResults) != 2 {
+		t.Fatalf("ContinueTurn calls/results = %d/%d, want 2/2", protocolClient.continueCalls, len(continuedResults))
+	}
+	first, err := json.Marshal(continuedResults[0])
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := json.Marshal(continuedResults[1])
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(first) != string(second) || string(continuedResults[0].Output) != `{"answer":42}` {
+		t.Fatalf("replayed tool result differs: first=%s second=%s", first, second)
+	}
+
+	invalidCall := call
+	invalidCall.ToolCallID = "call-invalid"
+	invalidCall.Input = json.RawMessage(`{"query":1}`)
+	invalidCall.IdempotencyKey = harness.ToolRequestIdempotencyKey(
+		invalidCall.RuntimeSessionID, invalidCall.TurnID, invalidCall.ToolCallID,
+	)
+	invalidContent, err := json.Marshal(invalidCall)
+	if err != nil {
+		t.Fatal(err)
+	}
+	invalidFrame := frame
+	invalidFrame.Seq = 3
+	invalidFrame.ToolCallID = invalidCall.ToolCallID
+	invalidFrame.Content = invalidContent
+	if err := fixture.dispatcher.continueHarnessV1BrokeredToolCall(
+		fixture.ctx, fixture.task, fixture.verified, protocolClient, fixture.request,
+		fixture.attempt, fixture.fence, invalidFrame,
+	); err == nil || !strings.Contains(err.Error(), "input does not match the frozen parameters schema") {
+		t.Fatalf("invalid brokered input error = %v, want frozen schema rejection", err)
+	}
+	if executeCalls != 1 || protocolClient.continueCalls != 2 {
+		t.Fatalf("invalid input reached executor/continuation: execute=%d continue=%d", executeCalls, protocolClient.continueCalls)
+	}
+	invalidIdentity := store.ExternalEffectIdentity{
+		Kind: "harness-v1-tool", Namespace: fixture.task.Namespace, AggregateID: string(fixture.task.UID),
+		OperationID: store.CanonicalControlID(
+			"harness-v1-tool-call", string(invalidCall.RuntimeSessionID), string(invalidCall.TurnID), invalidCall.ToolCallID,
+		),
+	}
+	invalidEffectID, err := invalidIdentity.CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := fixture.durable.GetExternalEffect(fixture.ctx, invalidEffectID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("invalid input external effect error = %v, want no durable reservation", err)
+	}
+}
+
+type harnessV1BrokeredToolTestSetup struct {
+	fixture  *harnessV1DispatcherStateFixture
+	tool     *corev1alpha1.Tool
+	call     harness.ToolCallRequest
+	frame    harness.HarnessEventFrame
+	identity store.ExternalEffectIdentity
+}
+
+func newHarnessV1BrokeredToolTestSetup(t *testing.T, timeout *metav1.Duration) *harnessV1BrokeredToolTestSetup {
+	t.Helper()
+	fixture := newHarnessV1DispatcherStateFixture(t)
+	tool := &corev1alpha1.Tool{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: fixture.task.Namespace, Name: "slow-lookup", UID: types.UID("slow-lookup-tool-uid"), Generation: 1,
+		},
+		Spec: corev1alpha1.ToolSpec{
+			Description: "look up a value", BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassRead,
+			HTTP: &corev1alpha1.HTTPExecution{URL: "https://tools.example.test/slow-lookup", Method: http.MethodPost, Timeout: timeout},
+		},
+	}
+	if err := fixture.dispatcher.Client.Create(fixture.ctx, tool); err != nil {
+		t.Fatal(err)
+	}
+	current := &corev1alpha1.Tool{}
+	if err := fixture.dispatcher.APIReader.Get(fixture.ctx, client.ObjectKeyFromObject(tool), current); err != nil {
+		t.Fatal(err)
+	}
+	digest, err := harnessV1BrokeredToolDefinitionDigest(current)
+	if err != nil {
+		t.Fatal(err)
+	}
+	fixture.verified.body.HarnessV1.ToolExecutionMode = string(harness.ToolExecutionModeBrokered)
+	fixture.verified.body.HarnessV1.BrokeredToolClasses = []corev1alpha1.AgentRuntimeBrokeredToolClass{
+		corev1alpha1.AgentRuntimeBrokeredToolClassRead,
+	}
+	fixture.verified.body.HarnessV1.BrokeredTools = []agentExecutionSnapshotHarnessV1BrokeredTool{{
+		Name: current.Name, Description: current.Spec.Description, BrokeredClass: current.Spec.BrokeredToolClass,
+		Parameters: json.RawMessage(`{"type":"object","properties":{"query":{"type":"string"}},"required":["query"],"additionalProperties":false}`),
+		UID:        string(current.UID), Generation: current.Generation,
+		DefinitionDigest: digest,
+	}}
+	call := harness.ToolCallRequest{
+		Version: harness.ProtocolVersion, RuntimeSessionID: fixture.request.RuntimeSessionID,
+		TurnID: fixture.request.TurnID, ToolCallID: "call-slow-1", ToolName: current.Name,
+		Input: json.RawMessage(`{"query":"value"}`),
+	}
+	call.IdempotencyKey = harness.ToolRequestIdempotencyKey(call.RuntimeSessionID, call.TurnID, call.ToolCallID)
+	content, err := json.Marshal(call)
+	if err != nil {
+		t.Fatal(err)
+	}
+	frame := harness.HarnessEventFrame{
+		Version: harness.ProtocolVersion, Type: harness.FrameToolCallRequested,
+		RuntimeSessionID: fixture.request.RuntimeSessionID, TurnID: fixture.request.TurnID,
+		CorrelationID: fixture.request.CorrelationID, Seq: 2,
+		ToolName: current.Name, ToolCallID: call.ToolCallID, Content: content,
+	}
+	fixture.dispatcher.ExternalEffects = fixture.durable
+	return &harnessV1BrokeredToolTestSetup{
+		fixture: fixture, tool: current, call: call, frame: frame,
+		identity: harnessV1BrokeredToolEffectIdentity(fixture.task, fixture.request, call.ToolCallID),
+	}
+}
+
+func acceptingHarnessV1ProtocolClient(t *testing.T) *recordingHarnessV1RecoveryClient {
+	t.Helper()
+	return &recordingHarnessV1RecoveryClient{continueTurn: func(
+		_ context.Context,
+		request harness.ContinueTurnRequest,
+	) (*harness.ContinueTurnResponse, error) {
+		return &harness.ContinueTurnResponse{
+			Version: harness.ProtocolVersion, Accepted: true, RuntimeSessionID: request.RuntimeSessionID,
+			TurnID: request.TurnID, CorrelationID: request.CorrelationID,
+		}, nil
+	}}
+}
+
+func TestContinueHarnessV1BrokeredToolCallHonorsConfiguredToolTimeout(t *testing.T) {
+	// Read-class brokered Tools never pass the v2 consequential admission gate
+	// that caps spec.http.timeout at the fixed 4m clamp, so a legitimately
+	// larger configured timeout must size the effect call deadline and lease.
+	setup := newHarnessV1BrokeredToolTestSetup(t, &metav1.Duration{Duration: 10 * time.Minute})
+	fixture := setup.fixture
+	effectID, err := setup.identity.CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	start := time.Now()
+	var deadline time.Time
+	var hasDeadline bool
+	var leaseExpiresAt *time.Time
+	fixture.dispatcher.BrokeredToolExecutor = HarnessV1BrokeredToolExecutorFunc(func(
+		callCtx context.Context,
+		_ string,
+		_ *corev1alpha1.Tool,
+		_ harness.ToolCallRequest,
+	) (json.RawMessage, error) {
+		deadline, hasDeadline = callCtx.Deadline()
+		inFlight, getErr := fixture.durable.GetExternalEffect(callCtx, effectID)
+		if getErr != nil {
+			t.Errorf("get in-flight effect: %v", getErr)
+			return nil, getErr
+		}
+		leaseExpiresAt = inFlight.LeaseExpiresAt
+		return json.RawMessage(`{"answer":42}`), nil
+	})
+	if err := fixture.dispatcher.continueHarnessV1BrokeredToolCall(
+		fixture.ctx, fixture.task, fixture.verified, acceptingHarnessV1ProtocolClient(t), fixture.request,
+		fixture.attempt, fixture.fence, setup.frame,
+	); err != nil {
+		t.Fatalf("continue brokered call: %v", err)
+	}
+	if !hasDeadline {
+		t.Fatal("brokered tool call context has no deadline")
+	}
+	if deadline.Before(start.Add(10 * time.Minute)) {
+		t.Fatalf(
+			"brokered call deadline = %s after start, want at least the configured 10m spec.http.timeout instead of the %s clamp",
+			deadline.Sub(start), maxACPExternalEffectCallDuration,
+		)
+	}
+	if leaseExpiresAt == nil || leaseExpiresAt.Before(deadline) {
+		t.Fatalf("effect lease expires at %v before the call deadline %s; an effect must never outlive its lease", leaseExpiresAt, deadline)
+	}
+}
+
+func TestContinueHarnessV1BrokeredToolCallDoesNotCommitDeadlineCancellation(t *testing.T) {
+	// A call abandoned because its bounded budget (or prompt authority)
+	// expired must stay in-flight for reconciliation instead of committing a
+	// permanently replayed ToolExecutionFailed result.
+	setup := newHarnessV1BrokeredToolTestSetup(t, nil)
+	fixture := setup.fixture
+	cancelCtx, cancel := context.WithCancel(fixture.ctx)
+	fixture.dispatcher.BrokeredToolExecutor = HarnessV1BrokeredToolExecutorFunc(func(
+		_ context.Context,
+		_ string,
+		_ *corev1alpha1.Tool,
+		_ harness.ToolCallRequest,
+	) (json.RawMessage, error) {
+		cancel()
+		return nil, errors.New("request interrupted by context cancellation")
+	})
+	protocolClient := acceptingHarnessV1ProtocolClient(t)
+	err := fixture.dispatcher.continueHarnessV1BrokeredToolCall(
+		cancelCtx, fixture.task, fixture.verified, protocolClient, fixture.request,
+		fixture.attempt, fixture.fence, setup.frame,
+	)
+	if err == nil || !strings.Contains(err.Error(), "did not complete within its bounded effect budget") {
+		t.Fatalf("continue brokered call error = %v, want bounded effect budget error", err)
+	}
+	if protocolClient.continueCalls != 0 {
+		t.Fatalf("ContinueTurn calls = %d, want none for an unsettled call", protocolClient.continueCalls)
+	}
+	assertInFlightExternalEffectWithOneLease(t, fixture.durable, setup.identity)
+
+	// Age the abandoned lease past expiry so a later retry may reclaim the
+	// same durable identity, exactly as it could after real lease expiry.
+	effectID, err := setup.identity.CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	effect, err := fixture.durable.GetExternalEffect(fixture.ctx, effectID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	expiredAt := time.Now().Add(-time.Minute).UTC()
+	if _, err := fixture.durable.TransitionExternalEffect(fixture.ctx, store.ExternalEffectTransition{
+		ID: effect.ID, Fence: fixture.fence, ExpectedVersion: effect.Version, ExpectedState: store.ExternalEffectInFlight,
+		NewState: store.ExternalEffectInFlight, RequestDigest: effect.RequestDigest,
+		ExpectedLeaseOwner: effect.LeaseOwner, LeaseOwner: effect.LeaseOwner,
+		LeaseExpiresAt: &expiredAt, UpdatedAt: expiredAt.Add(-time.Minute),
+	}); err != nil {
+		t.Fatalf("age abandoned lease: %v", err)
+	}
+
+	// A later retry under the same durable identity re-executes the read-class
+	// call and can still commit success — the cancellation was not replayed as
+	// a committed deterministic failure.
+	executeCalls := 0
+	fixture.dispatcher.BrokeredToolExecutor = HarnessV1BrokeredToolExecutorFunc(func(
+		_ context.Context,
+		_ string,
+		_ *corev1alpha1.Tool,
+		_ harness.ToolCallRequest,
+	) (json.RawMessage, error) {
+		executeCalls++
+		return json.RawMessage(`{"answer":42}`), nil
+	})
+	var continuedResults []harness.ToolCallResult
+	retryClient := &recordingHarnessV1RecoveryClient{continueTurn: func(
+		_ context.Context,
+		request harness.ContinueTurnRequest,
+	) (*harness.ContinueTurnResponse, error) {
+		continuedResults = append(continuedResults, request.ToolResults[0])
+		return &harness.ContinueTurnResponse{
+			Version: harness.ProtocolVersion, Accepted: true, RuntimeSessionID: request.RuntimeSessionID,
+			TurnID: request.TurnID, CorrelationID: request.CorrelationID,
+		}, nil
+	}}
+	if err := fixture.dispatcher.continueHarnessV1BrokeredToolCall(
+		fixture.ctx, fixture.task, fixture.verified, retryClient, fixture.request,
+		fixture.attempt, fixture.fence, setup.frame,
+	); err != nil {
+		t.Fatalf("retry brokered call: %v", err)
+	}
+	if executeCalls != 1 || len(continuedResults) != 1 {
+		t.Fatalf("retry execute/continue = %d/%d, want 1/1", executeCalls, len(continuedResults))
+	}
+	if !continuedResults[0].Approved || continuedResults[0].Error != nil || string(continuedResults[0].Output) != `{"answer":42}` {
+		t.Fatalf("retried result = %+v, want committed success output", continuedResults[0])
+	}
+}
+
+func TestBuildHarnessV1StartTurnRequestRendersFrozenSessionBootstrap(t *testing.T) {
+	bootstrap, err := buildACPBootstrapTranscript([]store.SessionMessage{
+		{Role: "user", Content: "earlier request"},
+		{Role: "assistant", Content: "earlier response"},
+	}, ACPBootstrapLimits{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	boundAt := time.Date(2026, 8, 6, 18, 0, 0, 0, time.UTC)
+	task := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{
+		Namespace: "default", Name: "continued-turn", UID: types.UID("continued-turn-uid"),
+	}}
+	verified := &verifiedHarnessV1Execution{
+		binding: &corev1alpha1.AgentExecutionBinding{BoundAt: metav1.NewTime(boundAt)},
+		body: agentExecutionSnapshotBody{
+			Prompt:        "current request",
+			Configuration: agentExecutionSnapshotConfig{MaxTurns: 5},
+			DefaultTools: &agentExecutionSnapshotToolPolicy{
+				AllowedToolsOmitted: false, AllowedTools: []string{}, AllowBash: new(false),
+			},
+			HarnessV1: &agentExecutionSnapshotHarnessV1{
+				SessionName: "continued-session", RuntimeName: string(corev1alpha1.AgentRuntimeCodex),
+				SessionBootstrap: &agentExecutionSnapshotHarnessV1SessionBootstrap{
+					Artifact: string(bootstrap.Artifact), Digest: bootstrap.Digest,
+					MessageCount: bootstrap.MessageCount, TotalMessages: len(bootstrap.Messages),
+				},
+			},
+		},
+	}
+	attempt := &store.HarnessV1Attempt{
+		TaskUID: string(task.UID), Attempt: 1, RuntimeSessionID: "continued-runtime-session",
+		TurnID: "continued-turn", CorrelationID: "continued-correlation",
+	}
+
+	request, err := buildHarnessV1StartTurnRequest(task, verified, attempt, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	wantPrompt := bootstrapPromptText(bootstrap) + "Orka current user prompt:\ncurrent request"
+	if request.Input.Prompt != wantPrompt {
+		t.Fatalf("rendered v1 prompt = %q, want %q", request.Input.Prompt, wantPrompt)
+	}
+	digest, err := harness.CanonicalStartTurnRequestDigest(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	attempt.RequestDigest = digest
+	if _, err := buildHarnessV1StartTurnRequest(task, verified, attempt, nil); err != nil {
+		t.Fatalf("reconstruct request from frozen Session input: %v", err)
+	}
+
+	mutated := *verified
+	mutated.body = verified.body
+	mutatedHarness := *verified.body.HarnessV1
+	mutatedBootstrap := *verified.body.HarnessV1.SessionBootstrap
+	mutatedBootstrap.Artifact = strings.ReplaceAll(mutatedBootstrap.Artifact, "earlier response", "later response")
+	mutatedHarness.SessionBootstrap = &mutatedBootstrap
+	mutated.body.HarnessV1 = &mutatedHarness
+	if _, err := buildHarnessV1StartTurnRequest(task, &mutated, attempt, nil); err == nil ||
+		!strings.Contains(err.Error(), "does not match the durable attempt") {
+		t.Fatalf("mutated frozen Session bootstrap error = %v, want durable digest mismatch", err)
+	}
+}
+
+func TestDefaultHarnessV1DispatchWorkersMatchesShippedWrapperCapacity(t *testing.T) {
+	if DefaultHarnessV1DispatchWorkers != 1 {
+		t.Fatalf("default harness v1 dispatch workers = %d, want 1", DefaultHarnessV1DispatchWorkers)
+	}
+}
+
+func TestHarnessV1DispatcherRejectsParallelWorkers(t *testing.T) {
+	dispatcher := &HarnessV1Dispatcher{MaxConcurrent: 2}
+	err := dispatcher.Start(t.Context())
+	if err == nil || !strings.Contains(err.Error(), "harness v1 dispatch workers must be exactly 1") {
+		t.Fatalf("parallel worker startup error = %v, want exact-one rejection", err)
+	}
+}
+
+func TestSortHarnessV1DispatchCandidatesPrioritizesRecoveryAndQueueRank(t *testing.T) {
+	now := time.Date(2026, 8, 6, 12, 0, 0, 0, time.UTC)
+	lowPriority, highPriority := int32(100), int32(900)
+	queuedAt := metav1.NewTime(now.Add(-time.Minute))
+	task := func(name string, priority int32) *corev1alpha1.Task {
+		return &corev1alpha1.Task{
+			ObjectMeta: metav1.ObjectMeta{
+				Namespace: "default", Name: name, UID: types.UID(name + "-uid"),
+				CreationTimestamp: metav1.NewTime(now.Add(-2 * time.Minute)),
+			},
+			Spec: corev1alpha1.TaskSpec{Priority: &priority},
+			Status: corev1alpha1.TaskStatus{HarnessRuntime: &corev1alpha1.HarnessRuntimeStatus{
+				LastTransitionTime: &queuedAt,
+			}},
+		}
+	}
+	candidates := []harnessV1DispatchCandidate{
+		{task: task("low-prepared", lowPriority), attempt: store.HarnessV1Attempt{State: store.HarnessV1AttemptPrepared}},
+		{task: task("high-prepared", highPriority), attempt: store.HarnessV1Attempt{State: store.HarnessV1AttemptPrepared}},
+		{task: task("recovery", lowPriority), attempt: store.HarnessV1Attempt{State: store.HarnessV1AttemptAccepted}},
+	}
+
+	sortHarnessV1DispatchCandidates(candidates, now)
+	want := []string{"recovery", "high-prepared", "low-prepared"}
+	for i := range want {
+		if got := candidates[i].task.Name; got != want[i] {
+			t.Fatalf("candidate[%d] = %q, want %q", i, got, want[i])
+		}
+	}
+}
+
+func TestSortHarnessV1DispatchCandidatesPromotesMaximumWait(t *testing.T) {
+	now := time.Date(2026, 8, 6, 12, 0, 0, 0, time.UTC)
+	lowPriority, highPriority := int32(0), int32(1000)
+	oldQueuedAt := metav1.NewTime(now.Add(-DefaultACPQueueMaximumWait))
+	recentQueuedAt := metav1.NewTime(now.Add(-time.Minute))
+	oldTask := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "old", UID: "old-uid"},
+		Spec:       corev1alpha1.TaskSpec{Priority: &lowPriority},
+		Status: corev1alpha1.TaskStatus{HarnessRuntime: &corev1alpha1.HarnessRuntimeStatus{
+			LastTransitionTime: &oldQueuedAt,
+		}},
+	}
+	recentTask := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "recent", UID: "recent-uid"},
+		Spec:       corev1alpha1.TaskSpec{Priority: &highPriority},
+		Status: corev1alpha1.TaskStatus{HarnessRuntime: &corev1alpha1.HarnessRuntimeStatus{
+			LastTransitionTime: &recentQueuedAt,
+		}},
+	}
+	candidates := []harnessV1DispatchCandidate{
+		{task: recentTask, attempt: store.HarnessV1Attempt{State: store.HarnessV1AttemptPrepared}},
+		{task: oldTask, attempt: store.HarnessV1Attempt{State: store.HarnessV1AttemptPrepared}},
+	}
+
+	sortHarnessV1DispatchCandidates(candidates, now)
+	if got := candidates[0].task.Name; got != "old" {
+		t.Fatalf("first candidate = %q, want promoted old Task", got)
+	}
+}
+
+func seedHarnessV1AttemptEpoch(t *testing.T, attemptStore *sqlite.Store) store.ControllerEpochFence {
+	t.Helper()
+	epoch, err := attemptStore.CompareAndSwapControllerEpoch(context.Background(), store.ControllerEpochCAS{
+		ExpectedVersion: 0,
+		ExpectedEpoch:   0,
+		NewEpoch:        1,
+		HolderID:        "harness-v1-test-controller",
+		RequestDigest:   store.CanonicalAgentExecutionSnapshotDigest([]byte("harness-v1-test-epoch")),
+		UpdatedAt:       time.Date(2026, 8, 6, 12, 0, 0, 0, time.UTC),
+	})
+	if err != nil {
+		t.Fatalf("seed harness v1 controller epoch: %v", err)
+	}
+	return store.ControllerEpochFence{Name: epoch.Name, Epoch: epoch.Epoch, HolderID: epoch.HolderID}
+}
+
+func TestRecoverAmbiguousSubmissionUsesLedgerWithoutReplayingStartTurn(t *testing.T) {
+	ctx := context.Background()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "harness-v1-recovery.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	attemptStore := sqlite.NewStore(db, "harness-v1-test")
+	fence := seedHarnessV1AttemptEpoch(t, attemptStore)
+	attempt := &store.HarnessV1Attempt{
+		Namespace: "default", TaskName: "turn-task", TaskUID: "task-uid", Attempt: 1,
+		BindingDigest:  "sha256:" + strings.Repeat("a", 64),
+		SnapshotDigest: "sha256:" + strings.Repeat("b", 64),
+		RequestDigest:  "sha256:" + strings.Repeat("c", 64),
+		TurnID:         "turn-a", RuntimeSessionID: "runtime-session-a", CorrelationID: "correlation-a",
+		State: store.HarnessV1AttemptPrepared, RetryClass: store.HarnessV1RetryClassNone,
+	}
+	if err := attemptStore.CreateHarnessV1Attempt(ctx, attempt, fence); err != nil {
+		t.Fatal(err)
+	}
+	attempt, err = attemptStore.GetHarnessV1Attempt(ctx, harnessV1AttemptKey(attempt))
+	if err != nil {
+		t.Fatal(err)
+	}
+	evidenceErr := errors.New("stop after durable admission recovery")
+	dispatcher := &HarnessV1Dispatcher{
+		Attempts:   attemptStore,
+		EventStore: failingExecutionEventStore{err: evidenceErr},
+	}
+	attempt, err = dispatcher.transitionAttempt(
+		ctx, attempt, fence, store.HarnessV1AttemptSubmitting, "begin-submit", store.HarnessV1AttemptUpdates{},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	protocolClient := &recordingHarnessV1RecoveryClient{status: &harness.DurableTurnStatus{
+		TurnID: attempt.TurnID, TaskUID: attempt.TaskUID, Attempt: attempt.Attempt,
+		RequestDigest: attempt.RequestDigest, State: harness.DurableTurnAdmitted,
+	}}
+	task := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{
+		Namespace: attempt.Namespace, Name: attempt.TaskName, UID: types.UID(attempt.TaskUID),
+	}}
+	request := harness.StartTurnRequest{TurnID: harness.HarnessTurnID(attempt.TurnID)}
+
+	err = dispatcher.recoverAmbiguousSubmission(ctx, task, nil, protocolClient, request, attempt, fence)
+	if !errors.Is(err, evidenceErr) {
+		t.Fatalf("recover error = %v, want %v", err, evidenceErr)
+	}
+	if protocolClient.startCalls != 0 {
+		t.Fatalf("StartTurn calls = %d, want zero during ambiguity recovery", protocolClient.startCalls)
+	}
+	if protocolClient.streamCalls != 0 {
+		t.Fatalf("StreamFrames calls = %d, want zero before persisted evidence succeeds", protocolClient.streamCalls)
+	}
+	persisted, err := attemptStore.GetHarnessV1Attempt(ctx, harnessV1AttemptKey(attempt))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if persisted.State != store.HarnessV1AttemptAccepted {
+		t.Fatalf("attempt state = %s, want %s", persisted.State, store.HarnessV1AttemptAccepted)
+	}
+}
+
+func TestRecoverAmbiguousSubmissionSettlesDurableTerminalReceiptWithoutStreaming(t *testing.T) {
+	ctx := context.Background()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "harness-v1-terminal-recovery.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	attemptStore := sqlite.NewStore(db, "harness-v1-terminal-test")
+	fence := seedHarnessV1AttemptEpoch(t, attemptStore)
+	attempt := &store.HarnessV1Attempt{
+		Namespace: "default", TaskName: "turn-task", TaskUID: "task-uid", Attempt: 1,
+		BindingDigest:  "sha256:" + strings.Repeat("a", 64),
+		SnapshotDigest: "sha256:" + strings.Repeat("b", 64),
+		RequestDigest:  "sha256:" + strings.Repeat("c", 64),
+		TurnID:         "turn-a", RuntimeSessionID: "runtime-session-a", CorrelationID: "correlation-a",
+		State: store.HarnessV1AttemptPrepared, RetryClass: store.HarnessV1RetryClassNone,
+	}
+	if err := attemptStore.CreateHarnessV1Attempt(ctx, attempt, fence); err != nil {
+		t.Fatal(err)
+	}
+	attempt, err = attemptStore.GetHarnessV1Attempt(ctx, harnessV1AttemptKey(attempt))
+	if err != nil {
+		t.Fatal(err)
+	}
+	saveErr := errors.New("stop after durable terminal settlement begins")
+	dispatcher := &HarnessV1Dispatcher{
+		Attempts:    attemptStore,
+		EventStore:  failingExecutionEventStore{err: errors.New("frame evidence must not be read")},
+		ResultStore: failingHarnessV1ResultStore{err: saveErr},
+	}
+	attempt, err = dispatcher.transitionAttempt(
+		ctx, attempt, fence, store.HarnessV1AttemptSubmitting, "begin-submit", store.HarnessV1AttemptUpdates{},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	receipt := harness.DurableTurnTerminalReceipt{
+		Version: harness.ProtocolVersion, Kind: harness.DurableTurnTerminalCompleted,
+		RuntimeSessionID: harness.RuntimeSessionID(attempt.RuntimeSessionID),
+		TurnID:           harness.HarnessTurnID(attempt.TurnID),
+		CorrelationID:    attempt.CorrelationID, Seq: 2,
+		Completed: &harness.DurableTurnCompletedReceipt{Result: "done", FinalEventSeq: 1},
+	}
+	receiptDigest, err := harness.DurableTurnTerminalReceiptDigest(receipt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	protocolClient := &recordingHarnessV1RecoveryClient{status: &harness.DurableTurnStatus{
+		TurnID: attempt.TurnID, TaskUID: attempt.TaskUID, Attempt: attempt.Attempt,
+		RequestDigest: attempt.RequestDigest, State: harness.DurableTurnTerminal,
+		TerminalReceiptDigest: receiptDigest, TerminalReceipt: &receipt,
+	}}
+	task := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{
+		Namespace: attempt.Namespace, Name: attempt.TaskName, UID: types.UID(attempt.TaskUID),
+	}}
+	request := harness.StartTurnRequest{
+		RuntimeSessionID: harness.RuntimeSessionID(attempt.RuntimeSessionID),
+		TurnID:           harness.HarnessTurnID(attempt.TurnID),
+		CorrelationID:    attempt.CorrelationID,
+	}
+
+	err = dispatcher.recoverAmbiguousSubmission(ctx, task, nil, protocolClient, request, attempt, fence)
+	if !errors.Is(err, saveErr) {
+		t.Fatalf("recover error = %v, want %v", err, saveErr)
+	}
+	if protocolClient.startCalls != 0 || protocolClient.streamCalls != 0 {
+		t.Fatalf("recovery replayed network effects: StartTurn=%d StreamFrames=%d", protocolClient.startCalls, protocolClient.streamCalls)
+	}
+	persisted, err := attemptStore.GetHarnessV1Attempt(ctx, harnessV1AttemptKey(attempt))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if persisted.State != store.HarnessV1AttemptSettling {
+		t.Fatalf("attempt state = %s, want %s", persisted.State, store.HarnessV1AttemptSettling)
+	}
+	if persisted.TerminalReceiptDigest != receiptDigest {
+		t.Fatalf("terminal receipt digest = %q, want %q", persisted.TerminalReceiptDigest, receiptDigest)
+	}
+
+	// A controller crash after Settling is durable must recover through the
+	// authenticated wrapper ledger again. It must not stream frames or downgrade
+	// the already proven terminal result merely because result persistence still
+	// needs to be retried.
+	err = dispatcher.recoverSettlingAttempt(ctx, task, protocolClient, request, persisted, fence)
+	if !errors.Is(err, saveErr) {
+		t.Fatalf("second settling recovery error = %v, want %v", err, saveErr)
+	}
+	if protocolClient.statusCalls != 2 || protocolClient.startCalls != 0 || protocolClient.streamCalls != 0 {
+		t.Fatalf(
+			"second recovery calls: status=%d StartTurn=%d StreamFrames=%d, want 2/0/0",
+			protocolClient.statusCalls, protocolClient.startCalls, protocolClient.streamCalls,
+		)
+	}
+	persisted, err = attemptStore.GetHarnessV1Attempt(ctx, harnessV1AttemptKey(attempt))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if persisted.State != store.HarnessV1AttemptSettling || persisted.TerminalReceiptDigest != receiptDigest {
+		t.Fatalf("attempt after second recovery = %+v, want unchanged settling receipt", persisted)
+	}
+
+	conflictingReceipt := receipt
+	conflictingReceipt.Completed = &harness.DurableTurnCompletedReceipt{Result: "different", FinalEventSeq: 1}
+	conflictingDigest, err := harness.DurableTurnTerminalReceiptDigest(conflictingReceipt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	protocolClient.status.TerminalReceipt = &conflictingReceipt
+	protocolClient.status.TerminalReceiptDigest = conflictingDigest
+	err = dispatcher.recoverSettlingAttempt(ctx, task, protocolClient, request, persisted, fence)
+	if err == nil || !strings.Contains(err.Error(), "does not match the persisted receipt digest") {
+		t.Fatalf("conflicting settling recovery error = %v, want persisted digest mismatch", err)
+	}
+	persisted, err = attemptStore.GetHarnessV1Attempt(ctx, harnessV1AttemptKey(attempt))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if persisted.State != store.HarnessV1AttemptSettling || persisted.TerminalReceiptDigest != receiptDigest {
+		t.Fatalf("attempt after conflicting recovery = %+v, want original settling receipt", persisted)
+	}
+}
+
+func TestRecoverActiveAttemptSettlesDurableTerminalReceiptWithoutStreaming(t *testing.T) {
+	ctx := context.Background()
+	db, err := sqlite.NewDB(filepath.Join(t.TempDir(), "harness-v1-active-terminal-recovery.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	attemptStore := sqlite.NewStore(db, "harness-v1-active-terminal-test")
+	fence := seedHarnessV1AttemptEpoch(t, attemptStore)
+	attempt := &store.HarnessV1Attempt{
+		Namespace: "default", TaskName: "turn-task", TaskUID: "task-uid", Attempt: 1,
+		BindingDigest:  "sha256:" + strings.Repeat("a", 64),
+		SnapshotDigest: "sha256:" + strings.Repeat("b", 64),
+		RequestDigest:  "sha256:" + strings.Repeat("c", 64),
+		TurnID:         "turn-a", RuntimeSessionID: "runtime-session-a", CorrelationID: "correlation-a",
+		State: store.HarnessV1AttemptPrepared, RetryClass: store.HarnessV1RetryClassNone,
+	}
+	if err := attemptStore.CreateHarnessV1Attempt(ctx, attempt, fence); err != nil {
+		t.Fatal(err)
+	}
+	attempt, err = attemptStore.GetHarnessV1Attempt(ctx, harnessV1AttemptKey(attempt))
+	if err != nil {
+		t.Fatal(err)
+	}
+	saveErr := errors.New("stop after active durable terminal settlement begins")
+	dispatcher := &HarnessV1Dispatcher{
+		Attempts:    attemptStore,
+		EventStore:  failingExecutionEventStore{err: errors.New("frame evidence must not be read")},
+		ResultStore: failingHarnessV1ResultStore{err: saveErr},
+	}
+	attempt, err = dispatcher.transitionAttempt(
+		ctx, attempt, fence, store.HarnessV1AttemptSubmitting, "begin-submit", store.HarnessV1AttemptUpdates{},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	attempt, err = dispatcher.transitionAttempt(
+		ctx, attempt, fence, store.HarnessV1AttemptAccepted, "accepted", store.HarnessV1AttemptUpdates{},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	receipt := harness.DurableTurnTerminalReceipt{
+		Version: harness.ProtocolVersion, Kind: harness.DurableTurnTerminalCompleted,
+		RuntimeSessionID: harness.RuntimeSessionID(attempt.RuntimeSessionID),
+		TurnID:           harness.HarnessTurnID(attempt.TurnID),
+		CorrelationID:    attempt.CorrelationID, Seq: 2,
+		Completed: &harness.DurableTurnCompletedReceipt{Result: "done", FinalEventSeq: 1},
+	}
+	receiptDigest, err := harness.DurableTurnTerminalReceiptDigest(receipt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	protocolClient := &recordingHarnessV1RecoveryClient{status: &harness.DurableTurnStatus{
+		TurnID: attempt.TurnID, TaskUID: attempt.TaskUID, Attempt: attempt.Attempt,
+		RequestDigest: attempt.RequestDigest, State: harness.DurableTurnTerminal,
+		TerminalReceiptDigest: receiptDigest, TerminalReceipt: &receipt,
+	}}
+	task := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{
+		Namespace: attempt.Namespace, Name: attempt.TaskName, UID: types.UID(attempt.TaskUID),
+	}}
+	request := harness.StartTurnRequest{
+		RuntimeSessionID: harness.RuntimeSessionID(attempt.RuntimeSessionID),
+		TurnID:           harness.HarnessTurnID(attempt.TurnID),
+		CorrelationID:    attempt.CorrelationID,
+	}
+
+	err = dispatcher.recoverActiveAttempt(ctx, task, nil, protocolClient, request, attempt, fence)
+	if !errors.Is(err, saveErr) {
+		t.Fatalf("recover error = %v, want %v", err, saveErr)
+	}
+	if protocolClient.statusCalls != 1 || protocolClient.startCalls != 0 || protocolClient.streamCalls != 0 {
+		t.Fatalf(
+			"active recovery calls: status=%d StartTurn=%d StreamFrames=%d, want 1/0/0",
+			protocolClient.statusCalls, protocolClient.startCalls, protocolClient.streamCalls,
+		)
+	}
+	persisted, err := attemptStore.GetHarnessV1Attempt(ctx, harnessV1AttemptKey(attempt))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if persisted.State != store.HarnessV1AttemptSettling || persisted.TerminalReceiptDigest != receiptDigest {
+		t.Fatalf("attempt after active recovery = %+v, want settling terminal receipt", persisted)
+	}
+}
+
+func TestRecoverAmbiguousSubmissionPrefersPersistedTerminalOverDurableOutcomeUnknown(t *testing.T) {
+	fixture := newHarnessV1DispatcherPreparedFixture(t)
+	var err error
+	fixture.attempt, err = fixture.dispatcher.transitionAttempt(
+		fixture.ctx,
+		fixture.attempt,
+		fixture.fence,
+		store.HarnessV1AttemptSubmitting,
+		"test-submitting",
+		store.HarnessV1AttemptUpdates{},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	fixture.attempt, err = fixture.dispatcher.transitionAttempt(
+		fixture.ctx,
+		fixture.attempt,
+		fixture.fence,
+		store.HarnessV1AttemptSubmittedUnknown,
+		"test-submission-unknown",
+		store.HarnessV1AttemptUpdates{},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	frame := harnessV1CompletedFrame(fixture.request, "persisted ambiguous result")
+	appendPersistedHarnessV1Frame(t, fixture, frame)
+	protocolClient := &recordingHarnessV1RecoveryClient{
+		status: durableHarnessV1OutcomeUnknownStatus(t, fixture),
+	}
+
+	if err := fixture.dispatcher.recoverAmbiguousSubmission(
+		fixture.ctx,
+		fixture.task,
+		fixture.verified,
+		protocolClient,
+		fixture.request,
+		fixture.attempt,
+		fixture.fence,
+	); err != nil {
+		t.Fatalf("recoverAmbiguousSubmission: %v", err)
+	}
+	persisted := assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptSucceeded)
+	wantReceipt, err := harness.DurableTurnTerminalReceiptFromFrame(frame)
+	if err != nil {
+		t.Fatal(err)
+	}
+	wantReceiptDigest, err := harness.DurableTurnTerminalReceiptDigest(wantReceipt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if persisted.TerminalReceiptDigest != wantReceiptDigest {
+		t.Fatalf("terminal receipt digest = %q, want persisted frame digest %q", persisted.TerminalReceiptDigest, wantReceiptDigest)
+	}
+	result, err := fixture.durable.GetResult(fixture.ctx, fixture.task.Namespace, fixture.task.Name)
+	if err != nil {
+		t.Fatalf("GetResult: %v", err)
+	}
+	if string(result) != frame.Completed.Result {
+		t.Fatalf("result = %q, want %q", result, frame.Completed.Result)
+	}
+	if protocolClient.statusCalls != 1 || protocolClient.startCalls != 0 || protocolClient.streamCalls != 0 {
+		t.Fatalf(
+			"ambiguous recovery calls: status=%d StartTurn=%d StreamFrames=%d, want 1/0/0",
+			protocolClient.statusCalls, protocolClient.startCalls, protocolClient.streamCalls,
+		)
+	}
+}
+
+func TestRecoverActiveAttemptPrefersPersistedTerminalOverDurableOutcomeUnknown(t *testing.T) {
+	fixture := newHarnessV1DispatcherStateFixture(t)
+	frame := harnessV1CompletedFrame(fixture.request, "persisted active result")
+	appendPersistedHarnessV1Frame(t, fixture, frame)
+	protocolClient := &recordingHarnessV1RecoveryClient{
+		status: durableHarnessV1OutcomeUnknownStatus(t, fixture),
+	}
+
+	if err := fixture.dispatcher.recoverActiveAttempt(
+		fixture.ctx,
+		fixture.task,
+		fixture.verified,
+		protocolClient,
+		fixture.request,
+		fixture.attempt,
+		fixture.fence,
+	); err != nil {
+		t.Fatalf("recoverActiveAttempt: %v", err)
+	}
+	persisted := assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptSucceeded)
+	wantReceipt, err := harness.DurableTurnTerminalReceiptFromFrame(frame)
+	if err != nil {
+		t.Fatal(err)
+	}
+	wantReceiptDigest, err := harness.DurableTurnTerminalReceiptDigest(wantReceipt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if persisted.TerminalReceiptDigest != wantReceiptDigest {
+		t.Fatalf("terminal receipt digest = %q, want persisted frame digest %q", persisted.TerminalReceiptDigest, wantReceiptDigest)
+	}
+	result, err := fixture.durable.GetResult(fixture.ctx, fixture.task.Namespace, fixture.task.Name)
+	if err != nil {
+		t.Fatalf("GetResult: %v", err)
+	}
+	if string(result) != frame.Completed.Result {
+		t.Fatalf("result = %q, want %q", result, frame.Completed.Result)
+	}
+	if protocolClient.statusCalls != 1 || protocolClient.startCalls != 0 || protocolClient.streamCalls != 0 {
+		t.Fatalf(
+			"active recovery calls: status=%d StartTurn=%d StreamFrames=%d, want 1/0/0",
+			protocolClient.statusCalls, protocolClient.startCalls, protocolClient.streamCalls,
+		)
+	}
+}
+
+func TestHarnessV1DispatcherSettlingRetryUsesPersistedTerminalEvidence(t *testing.T) {
+	recoveries := []struct {
+		name    string
+		fixture func(*testing.T) *harnessV1DispatcherStateFixture
+		recover func(*harnessV1DispatcherStateFixture, *recordingHarnessV1RecoveryClient) error
+	}{
+		{
+			name:    "ambiguous",
+			fixture: newHarnessV1DispatcherAmbiguousFixture,
+			recover: func(f *harnessV1DispatcherStateFixture, c *recordingHarnessV1RecoveryClient) error {
+				return f.dispatcher.recoverAmbiguousSubmission(
+					f.ctx, f.task, f.verified, c, f.request, f.attempt, f.fence,
+				)
+			},
+		},
+		{
+			name:    "active",
+			fixture: newHarnessV1DispatcherStateFixture,
+			recover: func(f *harnessV1DispatcherStateFixture, c *recordingHarnessV1RecoveryClient) error {
+				return f.dispatcher.recoverActiveAttempt(
+					f.ctx, f.task, f.verified, c, f.request, f.attempt, f.fence,
+				)
+			},
+		},
+	}
+	failures := []struct {
+		name    string
+		install func(*harnessV1DispatcherStateFixture, error)
+	}{
+		{
+			name: "save-result",
+			install: func(f *harnessV1DispatcherStateFixture, transientErr error) {
+				f.dispatcher.ResultStore = &failingOnceHarnessV1ResultStore{
+					ResultStore: f.durable,
+					err:         transientErr,
+				}
+			},
+		},
+		{
+			name: "final-cas",
+			install: func(f *harnessV1DispatcherStateFixture, transientErr error) {
+				f.dispatcher.Attempts = &failingOnceHarnessV1AttemptStore{
+					HarnessV1AttemptStore: f.durable,
+					target:                store.HarnessV1AttemptSucceeded,
+					err:                   transientErr,
+				}
+			},
+		},
+	}
+
+	for _, recovery := range recoveries {
+		for _, failure := range failures {
+			t.Run(recovery.name+"/"+failure.name, func(t *testing.T) {
+				fixture := recovery.fixture(t)
+				frame := harnessV1CompletedFrame(fixture.request, recovery.name+" "+failure.name)
+				appendPersistedHarnessV1Frame(t, fixture, frame)
+				protocolClient := &recordingHarnessV1RecoveryClient{
+					status: durableHarnessV1OutcomeUnknownStatus(t, fixture),
+				}
+				transientErr := errors.New("transient " + failure.name)
+				failure.install(fixture, transientErr)
+
+				if err := recovery.recover(fixture, protocolClient); !errors.Is(err, transientErr) {
+					t.Fatalf("initial recovery error = %v, want %v", err, transientErr)
+				}
+				persisted := assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptSettling)
+				receipt, err := harness.DurableTurnTerminalReceiptFromFrame(frame)
+				if err != nil {
+					t.Fatal(err)
+				}
+				receiptDigest, err := harness.DurableTurnTerminalReceiptDigest(receipt)
+				if err != nil {
+					t.Fatal(err)
+				}
+				if persisted.TerminalReceiptDigest != receiptDigest {
+					t.Fatalf("settling digest = %q, want %q", persisted.TerminalReceiptDigest, receiptDigest)
+				}
+
+				if err := fixture.dispatcher.recoverSettlingAttempt(
+					fixture.ctx,
+					fixture.task,
+					protocolClient,
+					fixture.request,
+					persisted,
+					fixture.fence,
+				); err != nil {
+					t.Fatalf("recoverSettlingAttempt: %v", err)
+				}
+				assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptSucceeded)
+				result, err := fixture.durable.GetResult(fixture.ctx, fixture.task.Namespace, fixture.task.Name)
+				if err != nil {
+					t.Fatalf("GetResult: %v", err)
+				}
+				if string(result) != frame.Completed.Result {
+					t.Fatalf("result = %q, want %q", result, frame.Completed.Result)
+				}
+				if protocolClient.statusCalls != 2 || protocolClient.startCalls != 0 || protocolClient.streamCalls != 0 {
+					t.Fatalf(
+						"recovery calls: status=%d StartTurn=%d StreamFrames=%d, want 2/0/0",
+						protocolClient.statusCalls, protocolClient.startCalls, protocolClient.streamCalls,
+					)
+				}
+			})
+		}
+	}
+}
+
+func TestHarnessV1DispatcherAdmissionClosedRecoveryEventuallyAccepts(t *testing.T) {
+	fixture := newHarnessV1DispatcherPreparedFixture(t)
+	markHarnessV1AdmissionClosedAttempt(t, fixture)
+	protocolClient := &recordingHarnessV1RecoveryClient{
+		statusErr: harness.ClientError{StatusCode: http.StatusNotFound, Message: "turn not found"},
+	}
+	protocolClient.start = func(
+		_ context.Context,
+		request harness.StartTurnRequest,
+	) (*harness.StartTurnResponse, error) {
+		if protocolClient.startCalls == 1 {
+			return nil, harness.ClientError{StatusCode: http.StatusConflict, Message: "wrapper admission is closed"}
+		}
+		return &harness.StartTurnResponse{
+			Version: harness.ProtocolVersion, Accepted: true,
+			RuntimeSessionID: request.RuntimeSessionID, TurnID: request.TurnID,
+			CorrelationID: request.CorrelationID,
+		}, nil
+	}
+	protocolClient.stream = func(
+		_ context.Context,
+		_ harness.HarnessTurnID,
+		_ int64,
+		onFrame func(harness.HarnessEventFrame) error,
+	) error {
+		return onFrame(harnessV1CompletedFrame(fixture.request, "accepted after reopen"))
+	}
+
+	if err := fixture.dispatcher.recoverAmbiguousSubmission(
+		fixture.ctx, fixture.task, fixture.verified, protocolClient, fixture.request, fixture.attempt, fixture.fence,
+	); err != nil {
+		t.Fatalf("recover while admission remains closed: %v", err)
+	}
+	persisted := assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptSubmittedUnknown)
+	if !harnessV1AttemptHasAdmissionClosedProof(persisted) || protocolClient.startCalls != 1 {
+		t.Fatalf("closed recovery = attempt %#v StartTurn=%d", persisted, protocolClient.startCalls)
+	}
+	fixture.attempt = persisted
+
+	if err := fixture.dispatcher.recoverAmbiguousSubmission(
+		fixture.ctx, fixture.task, fixture.verified, protocolClient, fixture.request, fixture.attempt, fixture.fence,
+	); err != nil {
+		t.Fatalf("recover after admission reopened: %v", err)
+	}
+	assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptSucceeded)
+	if protocolClient.statusCalls != 2 || protocolClient.startCalls != 2 || protocolClient.streamCalls != 1 {
+		t.Fatalf(
+			"reopen calls: status=%d StartTurn=%d StreamFrames=%d, want 2/2/1",
+			protocolClient.statusCalls, protocolClient.startCalls, protocolClient.streamCalls,
+		)
+	}
+}
+
+func TestHarnessV1DispatcherAdmissionClosedAmbiguousRetryWaitsForLedger(t *testing.T) {
+	fixture := newHarnessV1DispatcherPreparedFixture(t)
+	markHarnessV1AdmissionClosedAttempt(t, fixture)
+	protocolClient := &recordingHarnessV1RecoveryClient{
+		statusErr: harness.ClientError{StatusCode: http.StatusNotFound, Message: "turn not found"},
+		start: func(context.Context, harness.StartTurnRequest) (*harness.StartTurnResponse, error) {
+			return nil, harness.ClientError{RemoteAcceptanceUnknown: true, Message: "response lost"}
+		},
+	}
+	ambiguousErr := fixture.dispatcher.recoverAmbiguousSubmission(
+		fixture.ctx, fixture.task, fixture.verified, protocolClient, fixture.request, fixture.attempt, fixture.fence,
+	)
+	if ambiguousErr == nil {
+		t.Fatal("ambiguous StartTurn retry error = nil")
+	}
+	persisted := assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptSubmittedUnknown)
+	if !harnessV1AttemptHasAdmissionClosedProof(persisted) || protocolClient.startCalls != 1 || protocolClient.streamCalls != 0 {
+		t.Fatalf(
+			"ambiguous retry = attempt %#v StartTurn=%d StreamFrames=%d",
+			persisted, protocolClient.startCalls, protocolClient.streamCalls,
+		)
+	}
+	fixture.attempt = persisted
+	protocolClient.statusErr = nil
+	protocolClient.status = &harness.DurableTurnStatus{
+		TurnID: fixture.attempt.TurnID, TaskUID: fixture.attempt.TaskUID, Attempt: fixture.attempt.Attempt,
+		RequestDigest: fixture.attempt.RequestDigest, State: harness.DurableTurnAccepted,
+	}
+	protocolClient.stream = func(
+		_ context.Context,
+		_ harness.HarnessTurnID,
+		_ int64,
+		onFrame func(harness.HarnessEventFrame) error,
+	) error {
+		return onFrame(harnessV1CompletedFrame(fixture.request, "accepted despite lost response"))
+	}
+
+	if err := fixture.dispatcher.recoverAmbiguousSubmission(
+		fixture.ctx, fixture.task, fixture.verified, protocolClient, fixture.request, fixture.attempt, fixture.fence,
+	); err != nil {
+		t.Fatalf("recover accepted ambiguous retry: %v", err)
+	}
+	assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptSucceeded)
+	if protocolClient.startCalls != 1 || protocolClient.statusCalls != 2 || protocolClient.streamCalls != 1 {
+		t.Fatalf(
+			"ambiguous recovery calls: StartTurn=%d status=%d StreamFrames=%d, want 1/2/1",
+			protocolClient.startCalls, protocolClient.statusCalls, protocolClient.streamCalls,
+		)
+	}
+}
+
+func TestHarnessV1DispatcherPreparedSnapshotDispatchSucceeds(t *testing.T) {
+	fixture := newHarnessV1DispatcherPreparedFixture(t)
+	fixture.dispatcher.Epochs = readyHarnessV1TestEpochManager(fixture.durable, fixture.fence)
+	var acceptedRequest harness.StartTurnRequest
+	protocolClient := &recordingHarnessV1RecoveryClient{}
+	protocolClient.start = func(
+		_ context.Context,
+		request harness.StartTurnRequest,
+	) (*harness.StartTurnResponse, error) {
+		acceptedRequest = request
+		return &harness.StartTurnResponse{
+			Version: harness.ProtocolVersion, Accepted: true,
+			RuntimeSessionID: request.RuntimeSessionID, TurnID: request.TurnID,
+			CorrelationID: request.CorrelationID,
+		}, nil
+	}
+	protocolClient.stream = func(
+		_ context.Context,
+		_ harness.HarnessTurnID,
+		_ int64,
+		onFrame func(harness.HarnessEventFrame) error,
+	) error {
+		return onFrame(harnessV1CompletedFrame(acceptedRequest, "full dispatch"))
+	}
+	fixture.dispatcher.clientFactory = func(string, string, *http.Client) (harnessV1ProtocolClient, error) {
+		return protocolClient, nil
+	}
+
+	if err := fixture.dispatcher.reconcileAttempt(fixture.ctx, fixture.task, fixture.attempt); err != nil {
+		t.Fatalf("reconcileAttempt: %v", err)
+	}
+	assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptSucceeded)
+	result, err := fixture.durable.GetResult(fixture.ctx, fixture.task.Namespace, fixture.task.Name)
+	if err != nil {
+		t.Fatalf("GetResult: %v", err)
+	}
+	if string(result) != "full dispatch" {
+		t.Fatalf("result = %q, want full dispatch", result)
+	}
+	if protocolClient.startCalls != 1 || protocolClient.streamCalls != 1 {
+		t.Fatalf("network calls: start=%d stream=%d, want 1/1", protocolClient.startCalls, protocolClient.streamCalls)
+	}
+}
+
+func TestHarnessV1DispatcherRejectsNonIncreasingFrameSequences(t *testing.T) {
+	for _, test := range []struct {
+		name string
+		seqs []int64
+	}{
+		{name: "decrease", seqs: []int64{1, 3, 2}},
+		{name: "duplicate", seqs: []int64{1, 1}},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			fixture := newHarnessV1DispatcherStateFixture(t)
+			protocolClient := &recordingHarnessV1RecoveryClient{
+				stream: func(
+					_ context.Context,
+					_ harness.HarnessTurnID,
+					_ int64,
+					onFrame func(harness.HarnessEventFrame) error,
+				) error {
+					for _, seq := range test.seqs {
+						if err := onFrame(harness.HarnessEventFrame{
+							Version: harness.ProtocolVersion, Type: harness.FrameRuntimeOutput,
+							RuntimeSessionID: fixture.request.RuntimeSessionID, TurnID: fixture.request.TurnID,
+							CorrelationID: fixture.request.CorrelationID, Seq: seq, ContentText: "progress",
+						}); err != nil {
+							return err
+						}
+					}
+					return nil
+				},
+			}
+
+			if err := fixture.dispatcher.streamAcceptedAttempt(
+				fixture.ctx,
+				fixture.task,
+				fixture.verified,
+				protocolClient,
+				fixture.request,
+				fixture.attempt,
+				fixture.fence,
+			); err != nil {
+				t.Fatalf("streamAcceptedAttempt: %v", err)
+			}
+			persisted := assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptOutcomeUnknown)
+			if persisted.TerminalReason != harnessV1ReasonProtocolViolation {
+				t.Fatalf("terminal reason = %q, want %q", persisted.TerminalReason, harnessV1ReasonProtocolViolation)
+			}
+		})
+	}
+}
+
+func TestHarnessV1DispatcherClassifiesDeterministicFrameAuthorityViolations(t *testing.T) {
+	tests := []struct {
+		name  string
+		frame func(harness.StartTurnRequest) harness.HarnessEventFrame
+	}{
+		{
+			name: "identity mismatch",
+			frame: func(request harness.StartTurnRequest) harness.HarnessEventFrame {
+				return harness.HarnessEventFrame{
+					Version: harness.ProtocolVersion, Type: harness.FrameRuntimeOutput,
+					RuntimeSessionID: request.RuntimeSessionID, TurnID: "different-turn",
+					CorrelationID: request.CorrelationID, Seq: 1, ContentText: "progress",
+				}
+			},
+		},
+		{
+			name: "approval request",
+			frame: func(request harness.StartTurnRequest) harness.HarnessEventFrame {
+				return harness.HarnessEventFrame{
+					Version: harness.ProtocolVersion, Type: harness.FrameApprovalRequested,
+					RuntimeSessionID: request.RuntimeSessionID, TurnID: request.TurnID,
+					CorrelationID: request.CorrelationID, Seq: 1,
+				}
+			},
+		},
+		{
+			name: "unauthorized continuation",
+			frame: func(request harness.StartTurnRequest) harness.HarnessEventFrame {
+				return harness.HarnessEventFrame{
+					Version: harness.ProtocolVersion, Type: harness.FrameToolCallRequested,
+					RuntimeSessionID: request.RuntimeSessionID, TurnID: request.TurnID,
+					CorrelationID: request.CorrelationID, Seq: 1,
+				}
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			fixture := newHarnessV1DispatcherStateFixture(t)
+			protocolClient := &recordingHarnessV1RecoveryClient{stream: func(
+				_ context.Context,
+				_ harness.HarnessTurnID,
+				_ int64,
+				onFrame func(harness.HarnessEventFrame) error,
+			) error {
+				return onFrame(test.frame(fixture.request))
+			}}
+
+			if err := fixture.dispatcher.streamAcceptedAttempt(
+				fixture.ctx, fixture.task, fixture.verified, protocolClient,
+				fixture.request, fixture.attempt, fixture.fence,
+			); err != nil {
+				t.Fatalf("streamAcceptedAttempt: %v", err)
+			}
+			persisted := assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptOutcomeUnknown)
+			if persisted.TerminalReason != harnessV1ReasonProtocolViolation {
+				t.Fatalf("terminal reason = %q, want %q", persisted.TerminalReason, harnessV1ReasonProtocolViolation)
+			}
+		})
+	}
+}
+
+func TestHarnessV1DispatcherTerminalFrameWinsOverTrailingStreamError(t *testing.T) {
+	fixture := newHarnessV1DispatcherStateFixture(t)
+	trailingErr := errors.New("stream disconnected after terminal frame")
+	protocolClient := &recordingHarnessV1RecoveryClient{
+		stream: func(
+			_ context.Context,
+			_ harness.HarnessTurnID,
+			_ int64,
+			onFrame func(harness.HarnessEventFrame) error,
+		) error {
+			callbackErr := onFrame(harnessV1CompletedFrame(fixture.request, "done"))
+			if !errors.Is(callbackErr, errHarnessV1TerminalFrame) {
+				t.Fatalf("terminal frame callback error = %v, want %v", callbackErr, errHarnessV1TerminalFrame)
+			}
+			return trailingErr
+		},
+	}
+
+	if err := fixture.dispatcher.streamAcceptedAttempt(
+		fixture.ctx,
+		fixture.task,
+		fixture.verified,
+		protocolClient,
+		fixture.request,
+		fixture.attempt,
+		fixture.fence,
+	); err != nil {
+		t.Fatalf("streamAcceptedAttempt: %v", err)
+	}
+	assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptSucceeded)
+	result, err := fixture.durable.GetResult(fixture.ctx, fixture.task.Namespace, fixture.task.Name)
+	if err != nil {
+		t.Fatalf("GetResult: %v", err)
+	}
+	if string(result) != "done" {
+		t.Fatalf("result = %q, want done", result)
+	}
+	if protocolClient.streamCalls != 1 || protocolClient.startCalls != 0 {
+		t.Fatalf("network calls: stream=%d start=%d, want 1/0", protocolClient.streamCalls, protocolClient.startCalls)
+	}
+}
+
+func TestHarnessV1DispatcherBoundedStreamPollAllowsCancellationFollowUp(t *testing.T) {
+	tests := []struct {
+		name       string
+		deleteTask bool
+		mutate     func(*corev1alpha1.Task)
+	}{
+		{
+			name: "cancelled Task",
+			mutate: func(task *corev1alpha1.Task) {
+				task.Status.Phase = corev1alpha1.TaskPhaseCancelled
+			},
+		},
+		{
+			name:       "deleting Task",
+			deleteTask: true,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			fixture := newHarnessV1DispatcherStateFixture(t)
+			fixture.dispatcher.Interval = 10 * time.Millisecond
+			fixture.dispatcher.Epochs = readyHarnessV1TestEpochManager(fixture.durable, fixture.fence)
+			protocolClient := &recordingHarnessV1RecoveryClient{}
+			protocolClient.cancel = func(ctx context.Context, request harness.CancelTurnRequest) (*harness.CancelTurnResponse, error) {
+				if err := ctx.Err(); err != nil {
+					t.Fatalf("CancelTurn context already ended: %v", err)
+				}
+				if request.TurnID != fixture.request.TurnID || request.RuntimeSessionID != fixture.request.RuntimeSessionID {
+					t.Fatalf("CancelTurn request = %#v, want exact accepted turn", request)
+				}
+				return &harness.CancelTurnResponse{Accepted: true}, nil
+			}
+			protocolClient.stream = func(
+				ctx context.Context,
+				_ harness.HarnessTurnID,
+				_ int64,
+				onFrame func(harness.HarnessEventFrame) error,
+			) error {
+				if protocolClient.cancelCalls == 0 {
+					deadline, ok := ctx.Deadline()
+					if !ok || time.Until(deadline) > 100*time.Millisecond {
+						t.Fatalf("accepted stream context deadline = %v, %t; want bounded poll", deadline, ok)
+					}
+					<-ctx.Done()
+					return ctx.Err()
+				}
+				return onFrame(harness.HarnessEventFrame{
+					Version: harness.ProtocolVersion, Type: harness.FrameTurnCancelled,
+					RuntimeSessionID: fixture.request.RuntimeSessionID, TurnID: fixture.request.TurnID,
+					CorrelationID: fixture.request.CorrelationID, Seq: 1,
+				})
+			}
+			fixture.dispatcher.clientFactory = func(string, string, *http.Client) (harnessV1ProtocolClient, error) {
+				return protocolClient, nil
+			}
+
+			managerCtx, cancelManager := context.WithTimeout(context.Background(), time.Second)
+			defer cancelManager()
+			if err := fixture.dispatcher.streamAcceptedAttempt(
+				managerCtx,
+				fixture.task,
+				fixture.verified,
+				protocolClient,
+				fixture.request,
+				fixture.attempt,
+				fixture.fence,
+			); err != nil {
+				t.Fatalf("bounded accepted stream poll: %v", err)
+			}
+			if protocolClient.streamCalls != 1 || protocolClient.cancelCalls != 0 {
+				t.Fatalf(
+					"first pass calls: stream=%d cancel=%d, want 1/0",
+					protocolClient.streamCalls,
+					protocolClient.cancelCalls,
+				)
+			}
+
+			current := &corev1alpha1.Task{}
+			key := types.NamespacedName{Namespace: fixture.task.Namespace, Name: fixture.task.Name}
+			if err := fixture.dispatcher.Client.Get(fixture.ctx, key, current); err != nil {
+				t.Fatal(err)
+			}
+			var err error
+			if test.deleteTask {
+				err = fixture.dispatcher.Client.Delete(fixture.ctx, current)
+			} else {
+				test.mutate(current)
+				err = fixture.dispatcher.Client.Status().Update(fixture.ctx, current)
+			}
+			if err != nil {
+				t.Fatalf("persist %s intent: %v", test.name, err)
+			}
+			if err := fixture.dispatcher.Client.Get(fixture.ctx, key, current); err != nil {
+				t.Fatal(err)
+			}
+			fixture.attempt = assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptAccepted)
+
+			if err := fixture.dispatcher.reconcileAttempt(fixture.ctx, current, fixture.attempt); err != nil {
+				t.Fatalf("cancellation follow-up reconcile: %v", err)
+			}
+			assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptCancelled)
+			if protocolClient.cancelCalls != 1 || protocolClient.streamCalls != 2 || protocolClient.startCalls != 0 {
+				t.Fatalf(
+					"follow-up calls: cancel=%d stream=%d start=%d, want 1/2/0",
+					protocolClient.cancelCalls,
+					protocolClient.streamCalls,
+					protocolClient.startCalls,
+				)
+			}
+		})
+	}
+}
+
+func TestHarnessV1DispatcherDeadlineDurablyRequestsAndRetriesCancellation(t *testing.T) {
+	fixture := newHarnessV1DispatcherStateFixture(t)
+	fixture.dispatcher.Interval = time.Second
+	fixture.request.Deadline = time.Now().UTC().Add(100 * time.Millisecond)
+	protocolClient := &recordingHarnessV1RecoveryClient{}
+	protocolClient.cancel = func(_ context.Context, request harness.CancelTurnRequest) (*harness.CancelTurnResponse, error) {
+		if request.Reason != "Task deadline exceeded" || request.TurnID != fixture.request.TurnID {
+			t.Fatalf("deadline cancellation = %#v", request)
+		}
+		return &harness.CancelTurnResponse{Accepted: true}, nil
+	}
+	protocolClient.stream = func(
+		ctx context.Context,
+		_ harness.HarnessTurnID,
+		_ int64,
+		onFrame func(harness.HarnessEventFrame) error,
+	) error {
+		if protocolClient.streamCalls == 1 {
+			deadline, ok := ctx.Deadline()
+			if !ok || deadline.After(fixture.request.Deadline.Add(10*time.Millisecond)) {
+				t.Fatalf("first stream deadline = %v, %t; want immutable request deadline %v", deadline, ok, fixture.request.Deadline)
+			}
+			<-ctx.Done()
+			return ctx.Err()
+		}
+		return onFrame(harness.HarnessEventFrame{
+			Version: harness.ProtocolVersion, Type: harness.FrameTurnCancelled,
+			RuntimeSessionID: fixture.request.RuntimeSessionID, TurnID: fixture.request.TurnID,
+			CorrelationID: fixture.request.CorrelationID, Seq: 1,
+		})
+	}
+
+	if err := fixture.dispatcher.streamAcceptedAttempt(
+		fixture.ctx, fixture.task, fixture.verified, protocolClient,
+		fixture.request, fixture.attempt, fixture.fence,
+	); err != nil {
+		t.Fatalf("deadline stream poll: %v", err)
+	}
+	fixture.attempt = assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptCancelRequested)
+	if fixture.attempt.CancelRequestedAt == nil || protocolClient.cancelCalls != 1 || protocolClient.streamCalls != 1 {
+		t.Fatalf("deadline boundary = attempt %+v cancel=%d stream=%d", fixture.attempt, protocolClient.cancelCalls, protocolClient.streamCalls)
+	}
+
+	if err := fixture.dispatcher.streamAcceptedAttempt(
+		fixture.ctx, fixture.task, fixture.verified, protocolClient,
+		fixture.request, fixture.attempt, fixture.fence,
+	); err != nil {
+		t.Fatalf("deadline cancellation retry: %v", err)
+	}
+	assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptCancelled)
+	if protocolClient.cancelCalls != 2 || protocolClient.streamCalls != 2 {
+		t.Fatalf("deadline cancellation calls = cancel=%d stream=%d, want 2/2", protocolClient.cancelCalls, protocolClient.streamCalls)
+	}
+}
+
+func TestHarnessV1DispatcherExpiredDeadlineCancellationWindowBecomesOutcomeUnknown(t *testing.T) {
+	fixture := newHarnessV1DispatcherStateFixture(t)
+	now := time.Now().UTC()
+	requestedAt := now.Add(-defaultHarnessV1CancellationSettlementTimeout - time.Second)
+	fixture.request.Deadline = requestedAt.Add(-time.Second)
+	var err error
+	fixture.attempt, err = fixture.dispatcher.transitionAttempt(
+		fixture.ctx, fixture.attempt, fixture.fence,
+		store.HarnessV1AttemptCancelRequested, "test-expired-deadline-cancellation",
+		store.HarnessV1AttemptUpdates{CancelRequestedAt: &requestedAt},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	protocolClient := &recordingHarnessV1RecoveryClient{status: &harness.DurableTurnStatus{
+		TurnID: fixture.attempt.TurnID, TaskUID: fixture.attempt.TaskUID,
+		Attempt: fixture.attempt.Attempt, RequestDigest: fixture.attempt.RequestDigest,
+		State: harness.DurableTurnAccepted,
+	}}
+	protocolClient.cancel = func(context.Context, harness.CancelTurnRequest) (*harness.CancelTurnResponse, error) {
+		t.Fatal("CancelTurn was retried after the bounded settlement window")
+		return nil, nil
+	}
+	protocolClient.stream = func(context.Context, harness.HarnessTurnID, int64, func(harness.HarnessEventFrame) error) error {
+		t.Fatal("frames were streamed after the bounded settlement window")
+		return nil
+	}
+
+	if err := fixture.dispatcher.recoverActiveAttempt(
+		fixture.ctx, fixture.task, fixture.verified, protocolClient,
+		fixture.request, fixture.attempt, fixture.fence,
+	); err != nil {
+		t.Fatalf("recover expired deadline cancellation: %v", err)
+	}
+	persisted := assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptOutcomeUnknown)
+	if persisted.TerminalReason != harnessV1ReasonOutcomeUnknown {
+		t.Fatalf("terminal reason = %q, want %q", persisted.TerminalReason, harnessV1ReasonOutcomeUnknown)
+	}
+	if protocolClient.statusCalls != 1 || protocolClient.cancelCalls != 0 || protocolClient.streamCalls != 0 {
+		t.Fatalf("expired cancellation calls = status=%d cancel=%d stream=%d, want 1/0/0", protocolClient.statusCalls, protocolClient.cancelCalls, protocolClient.streamCalls)
+	}
+}
+
+func TestHarnessV1DispatcherSettlingRecoveryFinalizesDurableDecision(t *testing.T) {
+	fixture := newHarnessV1DispatcherStateFixture(t)
+	frame := harnessV1CompletedFrame(fixture.request, "durably recovered")
+	receipt, err := harness.DurableTurnTerminalReceiptFromFrame(frame)
+	if err != nil {
+		t.Fatal(err)
+	}
+	receiptDigest, err := harness.DurableTurnTerminalReceiptDigest(receipt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	fixture.attempt, err = fixture.dispatcher.transitionAttempt(
+		fixture.ctx,
+		fixture.attempt,
+		fixture.fence,
+		store.HarnessV1AttemptSettling,
+		"test-settling",
+		store.HarnessV1AttemptUpdates{TerminalReceiptDigest: &receiptDigest},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	protocolClient := &recordingHarnessV1RecoveryClient{status: &harness.DurableTurnStatus{
+		TurnID: fixture.attempt.TurnID, TaskUID: fixture.attempt.TaskUID, Attempt: fixture.attempt.Attempt,
+		RequestDigest: fixture.attempt.RequestDigest, State: harness.DurableTurnTerminal,
+		TerminalReceiptDigest: receiptDigest, TerminalReceipt: &receipt,
+	}}
+
+	if err := fixture.dispatcher.recoverSettlingAttempt(
+		fixture.ctx,
+		fixture.task,
+		protocolClient,
+		fixture.request,
+		fixture.attempt,
+		fixture.fence,
+	); err != nil {
+		t.Fatalf("recoverSettlingAttempt: %v", err)
+	}
+	assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptSucceeded)
+	result, err := fixture.durable.GetResult(fixture.ctx, fixture.task.Namespace, fixture.task.Name)
+	if err != nil {
+		t.Fatalf("GetResult: %v", err)
+	}
+	if string(result) != "durably recovered" {
+		t.Fatalf("result = %q, want durably recovered", result)
+	}
+	if protocolClient.statusCalls != 1 || protocolClient.streamCalls != 0 || protocolClient.startCalls != 0 {
+		t.Fatalf(
+			"recovery calls: status=%d stream=%d start=%d, want 1/0/0",
+			protocolClient.statusCalls,
+			protocolClient.streamCalls,
+			protocolClient.startCalls,
+		)
+	}
+}
+
+func TestHarnessV1DispatcherReconnectsAcceptedTurnAfterTransientStreamFailure(t *testing.T) {
+	fixture := newHarnessV1DispatcherStateFixture(t)
+	protocolClient := &recordingHarnessV1RecoveryClient{
+		status: &harness.DurableTurnStatus{
+			TurnID: fixture.attempt.TurnID, TaskUID: fixture.attempt.TaskUID,
+			Attempt: fixture.attempt.Attempt, RequestDigest: fixture.attempt.RequestDigest,
+			State: harness.DurableTurnAccepted,
+		},
+	}
+	protocolClient.stream = func(
+		_ context.Context,
+		_ harness.HarnessTurnID,
+		_ int64,
+		onFrame func(harness.HarnessEventFrame) error,
+	) error {
+		if protocolClient.streamCalls == 1 {
+			return errors.New("transient stream reset")
+		}
+		return onFrame(harnessV1CompletedFrame(fixture.request, "reconnected"))
+	}
+
+	err := fixture.dispatcher.recoverActiveAttempt(
+		fixture.ctx,
+		fixture.task,
+		fixture.verified,
+		protocolClient,
+		fixture.request,
+		fixture.attempt,
+		fixture.fence,
+	)
+	if !errors.Is(err, errHarnessV1StreamEndedWithoutTerminal) {
+		t.Fatalf("first recoverActiveAttempt error = %v, want retryable stream boundary", err)
+	}
+	fixture.attempt = assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptAccepted)
+
+	if err := fixture.dispatcher.recoverActiveAttempt(
+		fixture.ctx,
+		fixture.task,
+		fixture.verified,
+		protocolClient,
+		fixture.request,
+		fixture.attempt,
+		fixture.fence,
+	); err != nil {
+		t.Fatalf("second recoverActiveAttempt: %v", err)
+	}
+	assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptSucceeded)
+	result, err := fixture.durable.GetResult(fixture.ctx, fixture.task.Namespace, fixture.task.Name)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(result) != "reconnected" {
+		t.Fatalf("result = %q, want reconnected", result)
+	}
+	if protocolClient.statusCalls != 2 || protocolClient.streamCalls != 2 || protocolClient.startCalls != 0 {
+		t.Fatalf(
+			"recovery calls: status=%d stream=%d start=%d, want 2/2/0",
+			protocolClient.statusCalls,
+			protocolClient.streamCalls,
+			protocolClient.startCalls,
+		)
+	}
+}
+
+func TestHarnessV1DispatcherRetriesCancellationUntilAcknowledged(t *testing.T) {
+	fixture := newHarnessV1DispatcherStateFixture(t)
+	protocolClient := &recordingHarnessV1RecoveryClient{}
+	protocolClient.cancel = func(context.Context, harness.CancelTurnRequest) (*harness.CancelTurnResponse, error) {
+		if protocolClient.cancelCalls == 1 {
+			return nil, errors.New("transient cancellation transport failure")
+		}
+		return &harness.CancelTurnResponse{Accepted: true}, nil
+	}
+	protocolClient.stream = func(
+		_ context.Context,
+		_ harness.HarnessTurnID,
+		_ int64,
+		onFrame func(harness.HarnessEventFrame) error,
+	) error {
+		persisted, err := fixture.durable.GetHarnessV1Attempt(fixture.ctx, harnessV1AttemptKey(fixture.attempt))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if persisted.State != store.HarnessV1AttemptCancelRequested || persisted.CancelRequestedAt == nil {
+			t.Fatalf("attempt at stream boundary = %+v, want nonterminal CancelRequested", persisted)
+		}
+		return onFrame(harness.HarnessEventFrame{
+			Version: harness.ProtocolVersion, Type: harness.FrameTurnCancelled,
+			RuntimeSessionID: fixture.request.RuntimeSessionID, TurnID: fixture.request.TurnID,
+			CorrelationID: fixture.request.CorrelationID, Seq: 1,
+		})
+	}
+	fixture.dispatcher.clientFactory = func(string, string, *http.Client) (harnessV1ProtocolClient, error) {
+		return protocolClient, nil
+	}
+
+	err := fixture.dispatcher.cancelAttempt(
+		fixture.ctx,
+		fixture.task,
+		fixture.verified,
+		fixture.attempt,
+		fixture.fence,
+	)
+	if err == nil || !strings.Contains(err.Error(), "transient cancellation transport failure") {
+		t.Fatalf("first cancelAttempt error = %v, want transient transport failure", err)
+	}
+	fixture.attempt = assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptCancelRequested)
+	if protocolClient.cancelCalls != 1 || protocolClient.streamCalls != 0 {
+		t.Fatalf("first cancellation calls: cancel=%d stream=%d, want 1/0", protocolClient.cancelCalls, protocolClient.streamCalls)
+	}
+
+	if err := fixture.dispatcher.cancelAttempt(
+		fixture.ctx,
+		fixture.task,
+		fixture.verified,
+		fixture.attempt,
+		fixture.fence,
+	); err != nil {
+		t.Fatalf("second cancelAttempt: %v", err)
+	}
+	assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptCancelled)
+	if protocolClient.cancelCalls != 2 || protocolClient.streamCalls != 1 || protocolClient.startCalls != 0 {
+		t.Fatalf(
+			"cancellation calls: cancel=%d stream=%d start=%d, want 2/1/0",
+			protocolClient.cancelCalls,
+			protocolClient.streamCalls,
+			protocolClient.startCalls,
+		)
+	}
+}
+
+func TestHarnessV1DispatcherCancellationSkipsPersistedAndLiveBrokeredToolCalls(t *testing.T) {
+	fixture := newHarnessV1DispatcherStateFixture(t)
+	tool := &corev1alpha1.Tool{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: fixture.task.Namespace, Name: "lookup", UID: types.UID("lookup-tool-uid"), Generation: 1,
+		},
+		Spec: corev1alpha1.ToolSpec{
+			Description: "look up a value", BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassRead,
+			HTTP: &corev1alpha1.HTTPExecution{URL: "https://tools.example.test/lookup", Method: http.MethodPost},
+		},
+	}
+	if err := fixture.dispatcher.Client.Create(fixture.ctx, tool); err != nil {
+		t.Fatal(err)
+	}
+	current := &corev1alpha1.Tool{}
+	if err := fixture.dispatcher.APIReader.Get(fixture.ctx, client.ObjectKeyFromObject(tool), current); err != nil {
+		t.Fatal(err)
+	}
+	digest, err := harnessV1BrokeredToolDefinitionDigest(current)
+	if err != nil {
+		t.Fatal(err)
+	}
+	fixture.verified.body.HarnessV1.ToolExecutionMode = string(harness.ToolExecutionModeBrokered)
+	fixture.verified.body.HarnessV1.BrokeredToolClasses = []corev1alpha1.AgentRuntimeBrokeredToolClass{
+		corev1alpha1.AgentRuntimeBrokeredToolClassRead,
+	}
+	fixture.verified.body.HarnessV1.BrokeredTools = []agentExecutionSnapshotHarnessV1BrokeredTool{{
+		Name: current.Name, Description: current.Spec.Description, BrokeredClass: current.Spec.BrokeredToolClass,
+		Parameters:       json.RawMessage(`{"type":"object","additionalProperties":true}`),
+		UID:              string(current.UID),
+		Generation:       current.Generation,
+		DefinitionDigest: digest,
+	}}
+	brokeredFrame := func(seq int64, callID string) harness.HarnessEventFrame {
+		t.Helper()
+		call := harness.ToolCallRequest{
+			Version: harness.ProtocolVersion, RuntimeSessionID: fixture.request.RuntimeSessionID,
+			TurnID: fixture.request.TurnID, ToolCallID: callID, ToolName: current.Name,
+			Input: json.RawMessage(`{"query":"value"}`),
+		}
+		call.IdempotencyKey = harness.ToolRequestIdempotencyKey(call.RuntimeSessionID, call.TurnID, call.ToolCallID)
+		content, marshalErr := json.Marshal(call)
+		if marshalErr != nil {
+			t.Fatal(marshalErr)
+		}
+		return harness.HarnessEventFrame{
+			Version: harness.ProtocolVersion, Type: harness.FrameToolCallRequested,
+			RuntimeSessionID: fixture.request.RuntimeSessionID, TurnID: fixture.request.TurnID,
+			CorrelationID: fixture.request.CorrelationID, Seq: seq,
+			ToolName: current.Name, ToolCallID: callID, Content: content,
+		}
+	}
+	persistedFrame := brokeredFrame(1, "persisted-call")
+	liveFrame := brokeredFrame(2, "live-call")
+	appendPersistedHarnessV1Frame(t, fixture, persistedFrame)
+	evidence, err := fixture.dispatcher.persistedEvidence(fixture.ctx, fixture.task, fixture.attempt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(evidence.brokeredToolCalls) != 1 || evidence.brokeredToolCalls[0].Seq != persistedFrame.Seq {
+		t.Fatalf("persisted brokered evidence = %#v, want sequence %d", evidence, persistedFrame.Seq)
+	}
+
+	now := time.Now().UTC()
+	seededIdentity := harnessV1BrokeredToolEffectIdentity(
+		fixture.task, fixture.request, persistedFrame.ToolCallID,
+	)
+	seededEffect, err := fixture.durable.ReserveExternalEffect(fixture.ctx, store.ReserveExternalEffectRequest{
+		Identity: seededIdentity, RequestDigest: "sha256:" + strings.Repeat("c", 64),
+		Fence: fixture.fence, CreatedAt: now,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	leaseExpiry := now.Add(time.Minute)
+	seededEffect, err = fixture.durable.TransitionExternalEffect(fixture.ctx, store.ExternalEffectTransition{
+		ID: seededEffect.ID, Fence: fixture.fence, ExpectedVersion: seededEffect.Version,
+		ExpectedState: seededEffect.State, NewState: store.ExternalEffectInFlight,
+		RequestDigest: seededEffect.RequestDigest, LeaseOwner: "seeded-harness-v1-tool-call",
+		LeaseExpiresAt: &leaseExpiry, UpdatedAt: now,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	fixture.attempt, err = fixture.dispatcher.transitionAttempt(
+		fixture.ctx, fixture.attempt, fixture.fence,
+		store.HarnessV1AttemptCancelRequested, "test-cancel-requested",
+		store.HarnessV1AttemptUpdates{CancelRequestedAt: &now},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := fixture.dispatcher.Client.Delete(fixture.ctx, current); err != nil {
+		t.Fatal(err)
+	}
+	executeCalls := 0
+	fixture.dispatcher.ExternalEffects = fixture.durable
+	fixture.dispatcher.BrokeredToolExecutor = HarnessV1BrokeredToolExecutorFunc(func(
+		context.Context, string, *corev1alpha1.Tool, harness.ToolCallRequest,
+	) (json.RawMessage, error) {
+		executeCalls++
+		return json.RawMessage(`{"unexpected":true}`), nil
+	})
+	protocolClient := &recordingHarnessV1RecoveryClient{cancel: func(
+		context.Context,
+		harness.CancelTurnRequest,
+	) (*harness.CancelTurnResponse, error) {
+		return &harness.CancelTurnResponse{Accepted: true}, nil
+	}, stream: func(
+		_ context.Context,
+		_ harness.HarnessTurnID,
+		afterSeq int64,
+		onFrame func(harness.HarnessEventFrame) error,
+	) error {
+		if afterSeq != 0 {
+			t.Fatalf("stream after sequence = %d, want 0 while CancelRequested progress remains journal-backed", afterSeq)
+		}
+		if err := onFrame(persistedFrame); err != nil {
+			return err
+		}
+		if err := onFrame(liveFrame); err != nil {
+			return err
+		}
+		return onFrame(harness.HarnessEventFrame{
+			Version: harness.ProtocolVersion, Type: harness.FrameTurnCancelled,
+			RuntimeSessionID: fixture.request.RuntimeSessionID, TurnID: fixture.request.TurnID,
+			CorrelationID: fixture.request.CorrelationID, Seq: 3,
+		})
+	}}
+
+	if err := fixture.dispatcher.streamAcceptedAttempt(
+		fixture.ctx, fixture.task, fixture.verified, protocolClient,
+		fixture.request, fixture.attempt, fixture.fence,
+	); err != nil {
+		t.Fatalf("stream cancelled brokered attempt: %v", err)
+	}
+	assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptCancelled)
+	if executeCalls != 0 || protocolClient.continueCalls != 0 {
+		t.Fatalf(
+			"cancelled brokered attempt calls = execute=%d continue=%d, want 0/0",
+			executeCalls, protocolClient.continueCalls,
+		)
+	}
+	settledEffect, err := fixture.durable.GetExternalEffect(fixture.ctx, seededEffect.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if settledEffect.State != store.ExternalEffectOutcomeUnknown || settledEffect.LeaseOwner != "" ||
+		settledEffect.LeaseExpiresAt != nil {
+		t.Fatalf("settled cancelled brokered effect = %#v, want terminal OutcomeUnknown without a lease", settledEffect)
+	}
+	liveIdentity := harnessV1BrokeredToolEffectIdentity(fixture.task, fixture.request, liveFrame.ToolCallID)
+	liveEffectID, err := liveIdentity.CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := fixture.durable.GetExternalEffect(fixture.ctx, liveEffectID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("live cancelled brokered call external effect error = %v, want ErrNotFound", err)
+	}
+}
+
+func TestHarnessV1DispatcherRetriesOutputAcknowledgementBeforeProjection(t *testing.T) {
+	fixture := newHarnessV1DispatcherStateFixture(t)
+	frame := harnessV1CompletedFrame(fixture.request, "")
+	frame.Completed.OutputRef = "durable-output-v1"
+	appendPersistedHarnessV1Frame(t, fixture, frame)
+	ackErr := errors.New("lost output acknowledgement response")
+	protocolClient := &recordingHarnessV1RecoveryClient{
+		fetch: func(context.Context, harness.HarnessTurnID, string) ([]byte, error) {
+			return []byte("durable result"), nil
+		},
+	}
+	protocolClient.acknowledge = func(_ context.Context, request harness.TurnOutputAcknowledgementRequest) error {
+		persisted, err := fixture.durable.GetHarnessV1Attempt(fixture.ctx, harnessV1AttemptKey(fixture.attempt))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if persisted.State != store.HarnessV1AttemptSucceeded || persisted.TerminalReceiptDigest != request.TerminalReceiptDigest {
+			t.Fatalf("attempt at acknowledgement boundary = %+v, want durable Succeeded receipt", persisted)
+		}
+		result, err := fixture.durable.GetResult(fixture.ctx, fixture.task.Namespace, fixture.task.Name)
+		if err != nil || string(result) != "durable result" {
+			t.Fatalf("result at acknowledgement boundary = %q, %v", result, err)
+		}
+		if protocolClient.ackCalls == 1 {
+			return ackErr
+		}
+		return nil
+	}
+	protocolClient.settle = func(_ context.Context, request harness.TurnSettlementAcknowledgementRequest) error {
+		if request.TurnID != fixture.request.TurnID || request.RequestDigest != fixture.attempt.RequestDigest ||
+			request.TerminalReceiptDigest == "" {
+			t.Fatalf("settlement acknowledgement = %+v, want exact terminal attempt fence", request)
+		}
+		return nil
+	}
+	fixture.dispatcher.clientFactory = func(string, string, *http.Client) (harnessV1ProtocolClient, error) {
+		return protocolClient, nil
+	}
+
+	err := fixture.dispatcher.settleTerminalFrame(
+		fixture.ctx, fixture.task, protocolClient, fixture.request, fixture.attempt, fixture.fence, frame,
+	)
+	if !errors.Is(err, ackErr) {
+		t.Fatalf("settleTerminalFrame error = %v, want lost acknowledgement response", err)
+	}
+	fixture.attempt = assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptSucceeded)
+	latest := &corev1alpha1.Task{}
+	if err := fixture.dispatcher.Client.Get(
+		fixture.ctx,
+		types.NamespacedName{Namespace: fixture.task.Namespace, Name: fixture.task.Name},
+		latest,
+	); err != nil {
+		t.Fatal(err)
+	}
+	if harnessV1AttemptProjectionMatches(latest, fixture.attempt) {
+		t.Fatal("terminal attempt was projected before output acknowledgement")
+	}
+
+	fixture.dispatcher.Epochs = readyHarnessV1TestEpochManager(fixture.durable, fixture.fence)
+	if err := fixture.dispatcher.reconcileAttempt(fixture.ctx, latest, fixture.attempt); err != nil {
+		t.Fatalf("reconcile terminal acknowledgement retry: %v", err)
+	}
+	if err := fixture.dispatcher.Client.Get(
+		fixture.ctx,
+		types.NamespacedName{Namespace: fixture.task.Namespace, Name: fixture.task.Name},
+		latest,
+	); err != nil {
+		t.Fatal(err)
+	}
+	if !harnessV1AttemptProjectionMatches(latest, fixture.attempt) {
+		t.Fatalf("terminal attempt was not projected after acknowledgement: %+v", latest.Status.HarnessRuntime)
+	}
+	if protocolClient.fetchCalls != 1 || protocolClient.ackCalls != 2 ||
+		protocolClient.settleCalls != 1 || protocolClient.statusCalls != 0 {
+		t.Fatalf(
+			"output recovery calls: fetch=%d outputAck=%d settlementAck=%d status=%d, want 1/2/1/0",
+			protocolClient.fetchCalls, protocolClient.ackCalls,
+			protocolClient.settleCalls, protocolClient.statusCalls,
+		)
+	}
+}
+
+func TestHarnessV1DispatcherRetriesSettlementAcknowledgementBeforeProjection(t *testing.T) {
+	fixture := newHarnessV1DispatcherStateFixture(t)
+	frame := harnessV1CompletedFrame(fixture.request, "durable result")
+	appendPersistedHarnessV1Frame(t, fixture, frame)
+	ackErr := errors.New("lost settlement acknowledgement response")
+	protocolClient := &recordingHarnessV1RecoveryClient{}
+	protocolClient.settle = func(_ context.Context, request harness.TurnSettlementAcknowledgementRequest) error {
+		persisted, err := fixture.durable.GetHarnessV1Attempt(fixture.ctx, harnessV1AttemptKey(fixture.attempt))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if persisted.State != store.HarnessV1AttemptSucceeded || persisted.TerminalReceiptDigest == "" ||
+			request.TurnID != fixture.request.TurnID || request.RequestDigest != persisted.RequestDigest ||
+			request.TerminalReceiptDigest != persisted.TerminalReceiptDigest {
+			t.Fatalf("settlement acknowledgement boundary = attempt %+v request %+v", persisted, request)
+		}
+		if protocolClient.settleCalls == 1 {
+			return ackErr
+		}
+		return nil
+	}
+	fixture.dispatcher.clientFactory = func(string, string, *http.Client) (harnessV1ProtocolClient, error) {
+		return protocolClient, nil
+	}
+
+	err := fixture.dispatcher.settleTerminalFrame(
+		fixture.ctx, fixture.task, protocolClient, fixture.request, fixture.attempt, fixture.fence, frame,
+	)
+	if !errors.Is(err, ackErr) {
+		t.Fatalf("settleTerminalFrame error = %v, want lost settlement acknowledgement", err)
+	}
+	fixture.attempt = assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptSucceeded)
+	latest := &corev1alpha1.Task{}
+	key := types.NamespacedName{Namespace: fixture.task.Namespace, Name: fixture.task.Name}
+	if err := fixture.dispatcher.Client.Get(fixture.ctx, key, latest); err != nil {
+		t.Fatal(err)
+	}
+	if harnessV1AttemptProjectionMatches(latest, fixture.attempt) {
+		t.Fatal("terminal attempt was projected before settlement acknowledgement")
+	}
+
+	fixture.dispatcher.Epochs = readyHarnessV1TestEpochManager(fixture.durable, fixture.fence)
+	if err := fixture.dispatcher.reconcileAttempt(fixture.ctx, latest, fixture.attempt); err != nil {
+		t.Fatalf("reconcile settlement acknowledgement retry: %v", err)
+	}
+	if err := fixture.dispatcher.Client.Get(fixture.ctx, key, latest); err != nil {
+		t.Fatal(err)
+	}
+	if !harnessV1AttemptProjectionMatches(latest, fixture.attempt) {
+		t.Fatalf("terminal attempt was not projected after settlement acknowledgement: %+v", latest.Status.HarnessRuntime)
+	}
+	if latest.Status.ResultRef == nil || !latest.Status.ResultRef.Available {
+		t.Fatalf("terminal result reference = %#v, want available", latest.Status.ResultRef)
+	}
+	if protocolClient.settleCalls != 2 || protocolClient.startCalls != 0 || protocolClient.statusCalls != 0 {
+		t.Fatalf(
+			"settlement recovery calls: settlementAck=%d start=%d status=%d, want 2/0/0",
+			protocolClient.settleCalls, protocolClient.startCalls, protocolClient.statusCalls,
+		)
+	}
+}
+
+func TestHarnessV1DispatcherPersistsInlineFailedResultBeforeSettlement(t *testing.T) {
+	fixture := newHarnessV1DispatcherStateFixture(t)
+	frame := harness.HarnessEventFrame{
+		Version: harness.ProtocolVersion, Type: harness.FrameTurnFailed,
+		RuntimeSessionID: fixture.request.RuntimeSessionID, TurnID: fixture.request.TurnID,
+		CorrelationID: fixture.request.CorrelationID, Seq: 1,
+		Failed: &harness.TurnFailed{Reason: "provider_failed", Result: "partial result"},
+	}
+	saveErr := errors.New("result persistence unavailable")
+	fixture.dispatcher.ResultStore = &failingOnceHarnessV1ResultStore{
+		ResultStore: fixture.durable,
+		err:         saveErr,
+	}
+	protocolClient := &recordingHarnessV1RecoveryClient{}
+
+	err := fixture.dispatcher.settleTerminalFrame(
+		fixture.ctx, fixture.task, protocolClient, fixture.request, fixture.attempt, fixture.fence, frame,
+	)
+	if !errors.Is(err, saveErr) {
+		t.Fatalf("settleTerminalFrame first error = %v, want %v", err, saveErr)
+	}
+	fixture.attempt = assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptSettling)
+	if protocolClient.settleCalls != 0 {
+		t.Fatalf("settlement calls before result persistence = %d, want zero", protocolClient.settleCalls)
+	}
+	if _, err := fixture.durable.GetResult(fixture.ctx, fixture.task.Namespace, fixture.task.Name); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("GetResult() before persistence error = %v, want ErrNotFound", err)
+	}
+	latest := &corev1alpha1.Task{}
+	key := types.NamespacedName{Namespace: fixture.task.Namespace, Name: fixture.task.Name}
+	if err := fixture.dispatcher.Client.Get(fixture.ctx, key, latest); err != nil {
+		t.Fatal(err)
+	}
+	if latest.Status.ResultRef != nil {
+		t.Fatalf("result reference before persistence = %#v, want nil", latest.Status.ResultRef)
+	}
+
+	if err := fixture.dispatcher.settleTerminalFrame(
+		fixture.ctx, fixture.task, protocolClient, fixture.request, fixture.attempt, fixture.fence, frame,
+	); err != nil {
+		t.Fatalf("settleTerminalFrame retry: %v", err)
+	}
+	fixture.attempt = assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptFailed)
+	result, err := fixture.durable.GetResult(fixture.ctx, fixture.task.Namespace, fixture.task.Name)
+	if err != nil {
+		t.Fatalf("GetResult() after settlement: %v", err)
+	}
+	if string(result) != frame.Failed.Result {
+		t.Fatalf("result = %q, want %q", result, frame.Failed.Result)
+	}
+	if err := fixture.dispatcher.Client.Get(fixture.ctx, key, latest); err != nil {
+		t.Fatal(err)
+	}
+	if latest.Status.ResultRef == nil || !latest.Status.ResultRef.Available {
+		t.Fatalf("inline failure result reference = %#v, want available", latest.Status.ResultRef)
+	}
+	if protocolClient.fetchCalls != 0 || protocolClient.ackCalls != 0 || protocolClient.settleCalls != 1 {
+		t.Fatalf(
+			"inline failure settlement calls: fetch=%d outputAck=%d settlementAck=%d, want 0/0/1",
+			protocolClient.fetchCalls, protocolClient.ackCalls, protocolClient.settleCalls,
+		)
+	}
+}
+
+func TestHarnessV1DispatcherSettlementAcknowledgementDoesNotResolveProviderCredentials(t *testing.T) {
+	fixture := newHarnessV1DispatcherStateFixture(t)
+	receipt, err := harness.DurableTurnTerminalReceiptFromFrame(
+		harnessV1CompletedFrame(fixture.request, "settled"),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	receiptDigest, err := harness.DurableTurnTerminalReceiptDigest(receipt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	terminal, err := fixture.dispatcher.finishAttemptDurably(
+		fixture.ctx, fixture.attempt, fixture.fence,
+		store.HarnessV1AttemptSucceeded, "Succeeded", receiptDigest,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	fixture.verified.body.HarnessV1.CredentialRefs = []agentExecutionSnapshotSecretRef{{
+		Role: "provider", Namespace: fixture.task.Namespace, Name: "deleted-provider-credentials",
+		UID: "deleted-provider-uid", ResourceVersion: "1", Keys: []string{"OPENAI_API_KEY"},
+	}}
+	protocolClient := &recordingHarnessV1RecoveryClient{settle: func(
+		_ context.Context,
+		request harness.TurnSettlementAcknowledgementRequest,
+	) error {
+		if request.TurnID != fixture.request.TurnID || request.RequestDigest != terminal.RequestDigest ||
+			request.TerminalReceiptDigest != terminal.TerminalReceiptDigest {
+			t.Fatalf("settlement acknowledgement = %+v, want durable attempt fences", request)
+		}
+		return nil
+	}}
+	fixture.dispatcher.clientFactory = func(endpoint, bearer string, _ *http.Client) (harnessV1ProtocolClient, error) {
+		if endpoint != fixture.verified.body.HarnessV1.Endpoint || strings.TrimSpace(bearer) == "" {
+			t.Fatalf("wrapper client transport = endpoint %q bearerPresent=%t", endpoint, strings.TrimSpace(bearer) != "")
+		}
+		return protocolClient, nil
+	}
+
+	if err := fixture.dispatcher.acknowledgeDurableHarnessV1Settlement(
+		fixture.ctx, fixture.task, fixture.verified, terminal, nil, nil,
+	); err != nil {
+		t.Fatalf("acknowledge without provider credentials: %v", err)
+	}
+	if protocolClient.settleCalls != 1 || protocolClient.startCalls != 0 || protocolClient.statusCalls != 0 {
+		t.Fatalf("settlement calls = settle=%d start=%d status=%d, want 1/0/0", protocolClient.settleCalls, protocolClient.startCalls, protocolClient.statusCalls)
+	}
+
+	fixture.verified.body.HarnessV1.AuthSecretResourceVersion = "rotated-wrapper-auth"
+	err = fixture.dispatcher.acknowledgeDurableHarnessV1Settlement(
+		fixture.ctx, fixture.task, fixture.verified, terminal, nil, nil,
+	)
+	if err == nil || !strings.Contains(err.Error(), "frozen harness auth Secret identity changed") {
+		t.Fatalf("wrapper auth rotation error = %v, want frozen identity rejection", err)
+	}
+	if protocolClient.settleCalls != 1 {
+		t.Fatalf("settlement was attempted after wrapper auth rotation: %d calls", protocolClient.settleCalls)
+	}
+}
+
+func TestHarnessV1AttemptProjectionMatchesRequiresCompleteTerminalProjection(t *testing.T) {
+	completedAt := metav1.NewTime(time.Date(2026, 8, 7, 1, 0, 0, 0, time.UTC))
+	attempt := &store.HarnessV1Attempt{
+		Attempt: 2, TurnID: "turn-terminal", RuntimeSessionID: "runtime-terminal",
+		State: store.HarnessV1AttemptSucceeded, TerminalReason: "Succeeded",
+		TerminalReceiptDigest: "sha256:" + strings.Repeat("a", 64),
+		RequestDigest:         "sha256:" + strings.Repeat("b", 64),
+		ControllerEpoch:       3, LastEventSeq: 7,
+	}
+	task := &corev1alpha1.Task{Status: corev1alpha1.TaskStatus{
+		Phase: corev1alpha1.TaskPhaseSucceeded, Attempts: attempt.Attempt,
+		CompletionTime: &completedAt,
+		HarnessRuntime: &corev1alpha1.HarnessRuntimeStatus{
+			Attempt: attempt.Attempt, TurnID: attempt.TurnID, RuntimeSessionID: attempt.RuntimeSessionID,
+			State: corev1alpha1.TaskExecutionStateSucceeded, Outcome: corev1alpha1.TaskExecutionOutcomeSucceeded,
+			Reason: attempt.TerminalReason, TerminalReceiptDigest: attempt.TerminalReceiptDigest,
+			RequestDigest: attempt.RequestDigest, ControllerEpoch: attempt.ControllerEpoch,
+			LastEventSeq: attempt.LastEventSeq, LastTransitionTime: &completedAt,
+		},
+	}}
+	if !harnessV1AttemptProjectionMatches(task, attempt) {
+		t.Fatal("complete terminal projection did not match")
+	}
+	task.Status.CompletionTime = nil
+	if harnessV1AttemptProjectionMatches(task, attempt) {
+		t.Fatal("terminal projection without completion time matched")
+	}
+}
+
+type harnessV1DispatcherStateFixture struct {
+	ctx        context.Context
+	dispatcher *HarnessV1Dispatcher
+	durable    *sqlite.Store
+	task       *corev1alpha1.Task
+	verified   *verifiedHarnessV1Execution
+	attempt    *store.HarnessV1Attempt
+	request    harness.StartTurnRequest
+	fence      store.ControllerEpochFence
+}
+
+func newHarnessV1DispatcherAmbiguousFixture(t *testing.T) *harnessV1DispatcherStateFixture {
+	t.Helper()
+	fixture := newHarnessV1DispatcherPreparedFixture(t)
+	var err error
+	fixture.attempt, err = fixture.dispatcher.transitionAttempt(
+		fixture.ctx,
+		fixture.attempt,
+		fixture.fence,
+		store.HarnessV1AttemptSubmitting,
+		"test-submitting",
+		store.HarnessV1AttemptUpdates{},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	fixture.attempt, err = fixture.dispatcher.transitionAttempt(
+		fixture.ctx,
+		fixture.attempt,
+		fixture.fence,
+		store.HarnessV1AttemptSubmittedUnknown,
+		"test-submission-unknown",
+		store.HarnessV1AttemptUpdates{},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return fixture
+}
+
+func markHarnessV1AdmissionClosedAttempt(t *testing.T, fixture *harnessV1DispatcherStateFixture) {
+	t.Helper()
+	var err error
+	fixture.attempt, err = fixture.dispatcher.transitionAttempt(
+		fixture.ctx,
+		fixture.attempt,
+		fixture.fence,
+		store.HarnessV1AttemptSubmitting,
+		"test-submitting",
+		store.HarnessV1AttemptUpdates{},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	protocolClient := &recordingHarnessV1RecoveryClient{}
+	err = fixture.dispatcher.handleStartTurnError(
+		fixture.ctx,
+		fixture.task,
+		fixture.verified,
+		protocolClient,
+		fixture.request,
+		fixture.attempt,
+		fixture.fence,
+		harness.ClientError{StatusCode: http.StatusConflict, Message: "wrapper admission is closed"},
+	)
+	if err != nil {
+		t.Fatalf("handleStartTurnError(admission closed): %v", err)
+	}
+	fixture.attempt = assertHarnessV1AttemptState(t, fixture, store.HarnessV1AttemptSubmittedUnknown)
+	if !harnessV1AttemptHasAdmissionClosedProof(fixture.attempt) {
+		t.Fatalf("attempt operation = %q, want durable admission-closed proof", fixture.attempt.LastOperationID)
+	}
+}
+
+func newHarnessV1DispatcherStateFixture(t *testing.T) *harnessV1DispatcherStateFixture {
+	t.Helper()
+	fixture := newHarnessV1DispatcherPreparedFixture(t)
+	var err error
+	fixture.attempt, err = fixture.dispatcher.transitionAttempt(
+		fixture.ctx,
+		fixture.attempt,
+		fixture.fence,
+		store.HarnessV1AttemptSubmitting,
+		"test-submitting",
+		store.HarnessV1AttemptUpdates{},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	fixture.attempt, err = fixture.dispatcher.transitionAttempt(
+		fixture.ctx,
+		fixture.attempt,
+		fixture.fence,
+		store.HarnessV1AttemptAccepted,
+		"test-accepted",
+		store.HarnessV1AttemptUpdates{},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return fixture
+}
+
+func newHarnessV1DispatcherPreparedFixture(t *testing.T) *harnessV1DispatcherStateFixture {
+	t.Helper()
+	ctx := context.Background()
+	reconciler, task := newHarnessV1RecoveryBindingFixture(t, ctx)
+	durable, ok := reconciler.AgentExecutionSnapshots.(*sqlite.Store)
+	if !ok {
+		t.Fatalf("snapshot store type = %T, want *sqlite.Store", reconciler.AgentExecutionSnapshots)
+	}
+	fence := seedHarnessV1AttemptEpoch(t, durable)
+	verified, err := reconciler.loadVerifiedHarnessV1ExecutionForRecovery(
+		ctx,
+		task,
+		task.Status.AgentExecutionBinding,
+		false,
+	)
+	if err != nil {
+		t.Fatalf("load verified harness v1 execution: %v", err)
+	}
+	attempt := &store.HarnessV1Attempt{
+		Namespace: task.Namespace, TaskName: task.Name, TaskUID: string(task.UID), Attempt: 1,
+		BindingDigest:  task.Status.AgentExecutionBinding.BindingDigest,
+		SnapshotDigest: task.Status.AgentExecutionBinding.Snapshot.Digest,
+		TurnID:         "turn-state-machine", RuntimeSessionID: "runtime-session-state-machine",
+		CorrelationID: string(task.UID), Backend: string(task.Status.AgentExecutionBinding.Backend),
+		BackendEndpoint:           verified.body.HarnessV1.Endpoint,
+		AuthSecretNamespace:       verified.body.HarnessV1.AuthSecretNamespace,
+		AuthSecretName:            verified.body.HarnessV1.AuthSecretName,
+		AuthSecretKey:             verified.body.HarnessV1.AuthSecretKey,
+		AuthSecretUID:             verified.body.HarnessV1.AuthSecretUID,
+		AuthSecretResourceVersion: verified.body.HarnessV1.AuthSecretResourceVersion,
+		State:                     store.HarnessV1AttemptPrepared, RetryClass: store.HarnessV1RetryClassNone,
+		ControllerEpochName: fence.Name, ControllerEpoch: fence.Epoch,
+	}
+	request, err := buildHarnessV1StartTurnRequest(task, verified, attempt, nil)
+	if err != nil {
+		t.Fatalf("build harness v1 request: %v", err)
+	}
+	attempt.RequestDigest, err = harness.CanonicalStartTurnRequestDigest(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request, err = buildHarnessV1StartTurnRequest(task, verified, attempt, nil)
+	if err != nil {
+		t.Fatalf("rebuild harness v1 request: %v", err)
+	}
+	if err := durable.CreateHarnessV1Attempt(ctx, attempt, fence); err != nil {
+		t.Fatalf("create harness v1 attempt: %v", err)
+	}
+	attempt, err = durable.GetHarnessV1Attempt(ctx, harnessV1AttemptKey(attempt))
+	if err != nil {
+		t.Fatal(err)
+	}
+	dispatcher := &HarnessV1Dispatcher{
+		Client: reconciler.Client, APIReader: reconciler.Client,
+		Attempts: durable, Snapshots: durable,
+		ResultStore: durable, EventStore: store.NewFakeExecutionEventStore(),
+	}
+	return &harnessV1DispatcherStateFixture{
+		ctx: ctx, dispatcher: dispatcher, durable: durable, task: task,
+		verified: verified, attempt: attempt, request: request, fence: fence,
+	}
+}
+
+func readyHarnessV1TestEpochManager(
+	durable *sqlite.Store,
+	fence store.ControllerEpochFence,
+) *ControllerEpochManager {
+	epochs := NewControllerEpochManager(durable, fence.HolderID)
+	epochs.current = &store.ControllerEpoch{Name: fence.Name, Epoch: fence.Epoch, HolderID: fence.HolderID}
+	close(epochs.ready)
+	return epochs
+}
+
+func harnessV1CompletedFrame(request harness.StartTurnRequest, result string) harness.HarnessEventFrame {
+	return harness.HarnessEventFrame{
+		Version: harness.ProtocolVersion, Type: harness.FrameTurnCompleted,
+		RuntimeSessionID: request.RuntimeSessionID, TurnID: request.TurnID,
+		CorrelationID: request.CorrelationID, Seq: 1,
+		Completed: &harness.TurnCompleted{Result: result, FinalEventSeq: 1},
+	}
+}
+
+func durableHarnessV1OutcomeUnknownStatus(
+	t *testing.T,
+	fixture *harnessV1DispatcherStateFixture,
+) *harness.DurableTurnStatus {
+	t.Helper()
+	receipt := harness.DurableTurnTerminalReceipt{
+		Version:          harness.ProtocolVersion,
+		Kind:             harness.DurableTurnTerminalOutcomeUnknown,
+		RuntimeSessionID: fixture.request.RuntimeSessionID,
+		TurnID:           fixture.request.TurnID,
+		CorrelationID:    fixture.request.CorrelationID,
+		OutcomeUnknown:   &harness.DurableTurnOutcomeUnknownReceipt{Reason: "wrapper outcome unknown"},
+	}
+	digest, err := harness.DurableTurnTerminalReceiptDigest(receipt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return &harness.DurableTurnStatus{
+		TurnID:                fixture.attempt.TurnID,
+		TaskUID:               fixture.attempt.TaskUID,
+		Attempt:               fixture.attempt.Attempt,
+		RequestDigest:         fixture.attempt.RequestDigest,
+		State:                 harness.DurableTurnOutcomeUnknown,
+		TerminalReceiptDigest: digest,
+		TerminalReceipt:       &receipt,
+	}
+}
+
+func appendPersistedHarnessV1Frame(
+	t *testing.T,
+	fixture *harnessV1DispatcherStateFixture,
+	frame harness.HarnessEventFrame,
+) {
+	t.Helper()
+	journalState, err := (harness.TurnJournal{
+		EventStore: fixture.dispatcher.EventStore,
+		MapContext: harness.EventMapContext{
+			Namespace:   fixture.task.Namespace,
+			TaskName:    fixture.task.Name,
+			SessionName: fixture.request.SessionName,
+			AgentName:   fixture.task.Status.AgentExecutionBinding.Agent.Name,
+			StreamID:    fixture.task.Name,
+		},
+	}).Open(fixture.ctx)
+	if err != nil {
+		t.Fatalf("open harness v1 turn journal: %v", err)
+	}
+	if _, appended, err := journalState.AppendFrameIfNew(fixture.ctx, frame); err != nil {
+		t.Fatalf("append persisted harness v1 frame: %v", err)
+	} else if !appended {
+		t.Fatal("persisted harness v1 frame was not appended")
+	}
+}
+
+func assertHarnessV1AttemptState(
+	t *testing.T,
+	fixture *harnessV1DispatcherStateFixture,
+	want store.HarnessV1AttemptState,
+) *store.HarnessV1Attempt {
+	t.Helper()
+	persisted, err := fixture.durable.GetHarnessV1Attempt(fixture.ctx, harnessV1AttemptKey(fixture.attempt))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if persisted.State != want {
+		t.Fatalf("attempt state = %s, want %s", persisted.State, want)
+	}
+	return persisted
+}
+
+type recordingHarnessV1RecoveryClient struct {
+	status        *harness.DurableTurnStatus
+	statusErr     error
+	start         func(context.Context, harness.StartTurnRequest) (*harness.StartTurnResponse, error)
+	stream        func(context.Context, harness.HarnessTurnID, int64, func(harness.HarnessEventFrame) error) error
+	continueTurn  func(context.Context, harness.ContinueTurnRequest) (*harness.ContinueTurnResponse, error)
+	fetch         func(context.Context, harness.HarnessTurnID, string) ([]byte, error)
+	acknowledge   func(context.Context, harness.TurnOutputAcknowledgementRequest) error
+	settle        func(context.Context, harness.TurnSettlementAcknowledgementRequest) error
+	cancel        func(context.Context, harness.CancelTurnRequest) (*harness.CancelTurnResponse, error)
+	statusCalls   int
+	startCalls    int
+	streamCalls   int
+	continueCalls int
+	fetchCalls    int
+	ackCalls      int
+	settleCalls   int
+	cancelCalls   int
+}
+
+type failingHarnessV1ResultStore struct{ err error }
+
+type failingOnceHarnessV1ResultStore struct {
+	store.ResultStore
+	err    error
+	failed bool
+}
+
+func (s *failingOnceHarnessV1ResultStore) SaveResult(
+	ctx context.Context,
+	namespace, taskName string,
+	result []byte,
+) error {
+	if !s.failed {
+		s.failed = true
+		return s.err
+	}
+	return s.ResultStore.SaveResult(ctx, namespace, taskName, result)
+}
+
+type failingOnceHarnessV1AttemptStore struct {
+	store.HarnessV1AttemptStore
+	target store.HarnessV1AttemptState
+	err    error
+	failed bool
+}
+
+func (s *failingOnceHarnessV1AttemptStore) TransitionHarnessV1Attempt(
+	ctx context.Context,
+	transition store.HarnessV1AttemptTransition,
+) (*store.HarnessV1Attempt, error) {
+	if !s.failed && transition.TargetState == s.target {
+		s.failed = true
+		return nil, s.err
+	}
+	return s.HarnessV1AttemptStore.TransitionHarnessV1Attempt(ctx, transition)
+}
+
+func (s failingHarnessV1ResultStore) SaveResult(context.Context, string, string, []byte) error {
+	return s.err
+}
+
+func (s failingHarnessV1ResultStore) GetResult(context.Context, string, string) ([]byte, error) {
+	return nil, s.err
+}
+
+func (s failingHarnessV1ResultStore) DeleteResult(context.Context, string, string) error {
+	return s.err
+}
+
+func (c *recordingHarnessV1RecoveryClient) StartTurn(
+	ctx context.Context,
+	request harness.StartTurnRequest,
+) (*harness.StartTurnResponse, error) {
+	c.startCalls++
+	if c.start != nil {
+		return c.start(ctx, request)
+	}
+	return nil, errors.New("StartTurn must not be called during recovery")
+}
+
+func (c *recordingHarnessV1RecoveryClient) DurableTurnStatus(context.Context, harness.HarnessTurnID) (*harness.DurableTurnStatus, error) {
+	c.statusCalls++
+	return c.status, c.statusErr
+}
+
+func (c *recordingHarnessV1RecoveryClient) StreamFrames(
+	ctx context.Context,
+	turnID harness.HarnessTurnID,
+	afterSeq int64,
+	onFrame func(harness.HarnessEventFrame) error,
+) error {
+	c.streamCalls++
+	if c.stream != nil {
+		return c.stream(ctx, turnID, afterSeq, onFrame)
+	}
+	return errors.New("unexpected frame stream")
+}
+
+func (c *recordingHarnessV1RecoveryClient) ContinueTurn(
+	ctx context.Context,
+	request harness.ContinueTurnRequest,
+) (*harness.ContinueTurnResponse, error) {
+	c.continueCalls++
+	if c.continueTurn != nil {
+		return c.continueTurn(ctx, request)
+	}
+	return nil, errors.New("unexpected continuation")
+}
+
+func (c *recordingHarnessV1RecoveryClient) FetchTurnOutput(
+	ctx context.Context,
+	turnID harness.HarnessTurnID,
+	outputRef string,
+) ([]byte, error) {
+	c.fetchCalls++
+	if c.fetch != nil {
+		return c.fetch(ctx, turnID, outputRef)
+	}
+	return nil, errors.New("unexpected output fetch")
+}
+
+func (c *recordingHarnessV1RecoveryClient) AcknowledgeTurnOutput(
+	ctx context.Context,
+	request harness.TurnOutputAcknowledgementRequest,
+) error {
+	c.ackCalls++
+	if c.acknowledge != nil {
+		return c.acknowledge(ctx, request)
+	}
+	return errors.New("unexpected output acknowledgement")
+}
+
+func (c *recordingHarnessV1RecoveryClient) AcknowledgeTurnSettlement(
+	ctx context.Context,
+	request harness.TurnSettlementAcknowledgementRequest,
+) error {
+	c.settleCalls++
+	if c.settle != nil {
+		return c.settle(ctx, request)
+	}
+	return nil
+}
+
+func (c *recordingHarnessV1RecoveryClient) CancelTurn(
+	ctx context.Context,
+	request harness.CancelTurnRequest,
+) (*harness.CancelTurnResponse, error) {
+	c.cancelCalls++
+	if c.cancel != nil {
+		return c.cancel(ctx, request)
+	}
+	return nil, errors.New("unexpected cancellation")
+}
+
+var _ harnessV1ProtocolClient = (*recordingHarnessV1RecoveryClient)(nil)
+var _ store.ResultStore = failingHarnessV1ResultStore{}
+var _ store.ResultStore = (*failingOnceHarnessV1ResultStore)(nil)
+var _ store.HarnessV1AttemptStore = (*failingOnceHarnessV1AttemptStore)(nil)
diff --git a/internal/controller/harness_v1_finalizer.go b/internal/controller/harness_v1_finalizer.go
new file mode 100644
index 000000000..a6b233d70
--- /dev/null
+++ b/internal/controller/harness_v1_finalizer.go
@@ -0,0 +1,115 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package controller
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+// HarnessV1SettlementAcknowledger proves that a terminal wrapper ledger row
+// may be reclaimed before its durable attempt identity is removed.
+type HarnessV1SettlementAcknowledger interface {
+	AcknowledgeHarnessV1Settlement(
+		context.Context,
+		*corev1alpha1.Task,
+		*store.HarnessV1Attempt,
+	) error
+}
+
+// harnessV1TaskDeletionReady atomically re-proves every route-specific v1
+// terminal, wrapper-settlement, and Session/outbox barrier before removing the
+// attempt aggregates. Reclamation is the finalization proof: an active attempt
+// or incomplete settlement retains the Task finalizer for dispatcher recovery.
+func (r *TaskReconciler) harnessV1TaskDeletionReady(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+) (bool, error) {
+	if !taskManagedByHarnessV1(task) {
+		return true, nil
+	}
+	binding := task.Status.AgentExecutionBinding
+	if task.UID == "" || binding == nil {
+		return false, fmt.Errorf("harness v1 Task identity and binding are required for deletion")
+	}
+	if r.HarnessV1Attempts == nil {
+		return false, fmt.Errorf("harness v1 attempt store is required for deletion")
+	}
+	if r.ControllerEpochManager == nil {
+		return false, fmt.Errorf("controller epoch manager is required for harness v1 deletion")
+	}
+	attempts, err := r.HarnessV1Attempts.ListHarnessV1AttemptsByTask(
+		ctx, task.Namespace, string(task.UID),
+	)
+	if err != nil {
+		return false, fmt.Errorf("list harness v1 attempts before Task deletion: %w", err)
+	}
+	reclamationBindingDigest := binding.BindingDigest
+	allTerminal := true
+	for i := range attempts {
+		attempt := &attempts[i]
+		if attempt.Namespace != task.Namespace || attempt.TaskName != task.Name ||
+			attempt.TaskUID != string(task.UID) {
+			return false, fmt.Errorf("harness v1 attempt identity changed before Task deletion")
+		}
+		if attempt.BindingDigest != reclamationBindingDigest {
+			return false, errors.New("harness v1 attempt binding changed before Task deletion")
+		}
+		if attempt.Backend != string(binding.Backend) {
+			return false, errors.New("harness v1 attempt backend changed before Task deletion")
+		}
+		if !store.IsTerminalHarnessV1AttemptState(attempt.State) {
+			allTerminal = false
+		}
+	}
+	if !allTerminal {
+		return false, nil
+	}
+	if len(attempts) > 0 && r.HarnessV1SettlementAcknowledger == nil {
+		return false, errors.New("harness v1 settlement acknowledger is required for deletion")
+	}
+	// A crash may occur after terminal attempt persistence but before ordinary
+	// dispatcher settlement retires the wrapper ledger and legacy
+	// runtime_sessions rows. Perform the same idempotent settlement used by the
+	// dispatcher before the attempt aggregate can be reclaimed.
+	runtimeSessions := HarnessV1Dispatcher{Attempts: r.HarnessV1Attempts}
+	for i := range attempts {
+		if err := runtimeSessions.settleHarnessV1RuntimeSessionRecord(ctx, task, &attempts[i]); err != nil {
+			if errors.Is(err, store.ErrNotReady) {
+				return false, nil
+			}
+			return false, fmt.Errorf("settle harness v1 runtime session before Task deletion: %w", err)
+		}
+		if err := r.HarnessV1SettlementAcknowledger.AcknowledgeHarnessV1Settlement(
+			ctx, task, &attempts[i],
+		); err != nil {
+			return false, fmt.Errorf("acknowledge harness v1 wrapper settlement before Task deletion: %w", err)
+		}
+	}
+	fence, err := r.ControllerEpochManager.CurrentFence(ctx)
+	if err != nil {
+		return false, err
+	}
+	_, err = r.HarnessV1Attempts.ReclaimHarnessV1Attempts(ctx, store.ReclaimHarnessV1AttemptsRequest{
+		Namespace:       task.Namespace,
+		TaskUID:         string(task.UID),
+		BindingDigest:   reclamationBindingDigest,
+		SessionRequired: task.Spec.SessionRef != nil,
+		Fence:           fence,
+	})
+	if errors.Is(err, store.ErrNotReady) {
+		return false, nil
+	}
+	if err != nil {
+		return false, fmt.Errorf("reclaim harness v1 attempts before Task deletion: %w", err)
+	}
+	return true, nil
+}
diff --git a/internal/controller/harness_v1_finalizer_test.go b/internal/controller/harness_v1_finalizer_test.go
new file mode 100644
index 000000000..39a464660
--- /dev/null
+++ b/internal/controller/harness_v1_finalizer_test.go
@@ -0,0 +1,329 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package controller
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+	"github.com/orka-agents/orka/internal/store/sqlite"
+)
+
+func TestHarnessV1DeletionReclaimsCurrentBindingLineage(t *testing.T) {
+	ctx := context.Background()
+	durable, fence := newHarnessV1FinalizerStore(t)
+	bindingDigest := store.CanonicalAgentExecutionSnapshotDigest([]byte("current-execution-binding"))
+	task := harnessV1FinalizerTask(
+		"current-binding-terminal",
+		"current-binding-terminal-uid",
+		bindingDigest,
+	)
+	key := createHarnessV1FinalizerAttempt(t, ctx, durable, fence, task, bindingDigest, true)
+
+	r := newHarnessV1FinalizerReconciler(durable, fence)
+	ready, err := r.harnessV1TaskDeletionReady(ctx, task)
+	if err != nil {
+		t.Fatalf("harness v1 deletion: %v", err)
+	}
+	if !ready {
+		t.Fatal("terminal current lineage did not become deletion-ready")
+	}
+	if _, err := durable.GetHarnessV1Attempt(ctx, key); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("current attempt after reclamation = %v, want ErrNotFound", err)
+	}
+}
+
+func TestHarnessV1DeletionWaitsForTerminalAttempt(t *testing.T) {
+	ctx := context.Background()
+	durable, fence := newHarnessV1FinalizerStore(t)
+	bindingDigest := store.CanonicalAgentExecutionSnapshotDigest([]byte("active-execution-binding"))
+	task := harnessV1FinalizerTask("active-binding", "active-binding-uid", bindingDigest)
+	key := createHarnessV1FinalizerAttempt(t, ctx, durable, fence, task, bindingDigest, false)
+
+	r := newHarnessV1FinalizerReconciler(durable, fence)
+	ready, err := r.harnessV1TaskDeletionReady(ctx, task)
+	if err != nil {
+		t.Fatalf("active harness v1 deletion: %v", err)
+	}
+	if ready {
+		t.Fatal("active attempt became deletion-ready")
+	}
+	if _, err := durable.GetHarnessV1Attempt(ctx, key); err != nil {
+		t.Fatalf("active attempt was mutated: %v", err)
+	}
+}
+
+func TestHarnessV1DeletionPreservesSessionOutboxBarrier(t *testing.T) {
+	ctx := context.Background()
+	durable, fence := newHarnessV1FinalizerStore(t)
+	bindingDigest := store.CanonicalAgentExecutionSnapshotDigest([]byte("session-binding"))
+	task := harnessV1FinalizerTask("session-binding", "session-binding-uid", bindingDigest)
+	task.Spec.SessionRef = &corev1alpha1.SessionReference{Name: "session", Append: true}
+	key := createHarnessV1FinalizerAttempt(t, ctx, durable, fence, task, bindingDigest, true)
+
+	r := newHarnessV1FinalizerReconciler(durable, fence)
+	ready, err := r.harnessV1TaskDeletionReady(ctx, task)
+	if err != nil {
+		t.Fatalf("harness v1 Session barrier: %v", err)
+	}
+	if ready {
+		t.Fatal("missing finalized SessionTurn/outbox projection allowed deletion")
+	}
+	if _, err := durable.GetHarnessV1Attempt(ctx, key); err != nil {
+		t.Fatalf("Session-barrier attempt was reclaimed: %v", err)
+	}
+}
+
+func TestHarnessV1DeletionRequiresCurrentBindingDigest(t *testing.T) {
+	ctx := context.Background()
+	durable, fence := newHarnessV1FinalizerStore(t)
+	task := harnessV1FinalizerTask(
+		"binding-mismatch",
+		"binding-mismatch-uid",
+		store.CanonicalAgentExecutionSnapshotDigest([]byte("current-execution-binding")),
+	)
+	key := createHarnessV1FinalizerAttempt(t, ctx, durable, fence, task,
+		store.CanonicalAgentExecutionSnapshotDigest([]byte("different-execution-binding")), true)
+
+	r := newHarnessV1FinalizerReconciler(durable, fence)
+	ready, err := r.harnessV1TaskDeletionReady(ctx, task)
+	if err == nil || !strings.Contains(err.Error(), "binding changed") {
+		t.Fatalf("binding mismatch = ready %t, err %v", ready, err)
+	}
+	if _, err := durable.GetHarnessV1Attempt(ctx, key); err != nil {
+		t.Fatalf("mismatched attempt was reclaimed: %v", err)
+	}
+}
+
+func TestHarnessV1DeletionRetainsAttemptUntilWrapperSettlementAcknowledged(t *testing.T) {
+	ctx := context.Background()
+	durable, fence := newHarnessV1FinalizerStore(t)
+	bindingDigest := store.CanonicalAgentExecutionSnapshotDigest([]byte("wrapper-settlement-binding"))
+	task := harnessV1FinalizerTask("wrapper-settlement", "wrapper-settlement-uid", bindingDigest)
+	key, terminal := createHarnessV1FinalizerLedgerAttempt(t, ctx, durable, fence, task, bindingDigest)
+
+	ackErr := errors.New("lost wrapper settlement acknowledgement response")
+	acknowledger := &recordingHarnessV1SettlementAcknowledger{failures: 1, err: ackErr}
+	r := newHarnessV1FinalizerReconciler(durable, fence)
+	r.HarnessV1SettlementAcknowledger = acknowledger
+
+	ready, err := r.harnessV1TaskDeletionReady(ctx, task)
+	if ready || !errors.Is(err, ackErr) {
+		t.Fatalf("first deletion readiness = %t, %v, want false and acknowledgement error", ready, err)
+	}
+	if _, err := durable.GetHarnessV1Attempt(ctx, key); err != nil {
+		t.Fatalf("attempt was reclaimed before wrapper acknowledgement: %v", err)
+	}
+
+	ready, err = r.harnessV1TaskDeletionReady(ctx, task)
+	if err != nil {
+		t.Fatalf("retry harness v1 deletion: %v", err)
+	}
+	if !ready {
+		t.Fatal("acknowledged wrapper attempt did not become deletion-ready")
+	}
+	if _, err := durable.GetHarnessV1Attempt(ctx, key); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("acknowledged attempt after reclamation = %v, want ErrNotFound", err)
+	}
+	if len(acknowledger.calls) != 2 {
+		t.Fatalf("wrapper settlement acknowledgement calls = %d, want 2", len(acknowledger.calls))
+	}
+	for i := range acknowledger.calls {
+		call := acknowledger.calls[i]
+		if call.taskUID != task.UID || call.attempt != terminal.Attempt || call.turnID != terminal.TurnID ||
+			call.requestDigest != terminal.RequestDigest || call.terminalReceiptDigest != terminal.TerminalReceiptDigest {
+			t.Fatalf("wrapper settlement acknowledgement call %d = %+v, want attempt %+v", i+1, call, terminal)
+		}
+	}
+}
+
+func newHarnessV1FinalizerReconciler(
+	durable *sqlite.Store,
+	fence store.ControllerEpochFence,
+) *TaskReconciler {
+	return &TaskReconciler{
+		HarnessV1Attempts:               durable,
+		HarnessV1SettlementAcknowledger: &recordingHarnessV1SettlementAcknowledger{},
+		ControllerEpochManager:          readyHarnessV1TestEpochManager(durable, fence),
+	}
+}
+
+func newHarnessV1FinalizerStore(t *testing.T) (*sqlite.Store, store.ControllerEpochFence) {
+	t.Helper()
+	db, err := sqlite.NewDB(":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	durable := sqlite.NewStore(db, "harness-v1-finalizer-test")
+	return durable, seedHarnessV1AttemptEpoch(t, durable)
+}
+
+func harnessV1FinalizerTask(
+	name string,
+	uid types.UID,
+	bindingDigest string,
+) *corev1alpha1.Task {
+	snapshotDigest := store.CanonicalAgentExecutionSnapshotDigest([]byte("snapshot-" + name))
+	return &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: "default", UID: uid},
+		Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent},
+		Status: corev1alpha1.TaskStatus{AgentExecutionBinding: &corev1alpha1.AgentExecutionBinding{
+			SchemaVersion:   1,
+			ContractVersion: corev1alpha1.AgentRuntimeContractHarnessV1,
+			Backend:         corev1alpha1.AgentExecutionBackendHarnessWrapper,
+			BindingDigest:   bindingDigest,
+			Task: corev1alpha1.AgentExecutionBindingTaskRef{
+				UID: uid, BoundSpecGeneration: 1,
+			},
+			Snapshot: corev1alpha1.AgentExecutionSnapshotRef{
+				ID: string(uid) + "/" + snapshotDigest, Digest: snapshotDigest,
+				SchemaVersion: store.AgentExecutionSnapshotSchemaVersion,
+			},
+		}},
+	}
+}
+
+func createHarnessV1FinalizerAttempt(
+	t *testing.T,
+	ctx context.Context,
+	durable *sqlite.Store,
+	fence store.ControllerEpochFence,
+	task *corev1alpha1.Task,
+	bindingDigest string,
+	terminal bool,
+) store.HarnessV1AttemptKey {
+	t.Helper()
+	const number int32 = 1
+	key := store.HarnessV1AttemptKey{Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: number}
+	attempt := &store.HarnessV1Attempt{
+		Namespace: task.Namespace, TaskName: task.Name, TaskUID: string(task.UID), Attempt: number,
+		BindingDigest:  bindingDigest,
+		SnapshotDigest: store.CanonicalAgentExecutionSnapshotDigest(fmt.Appendf(nil, "snapshot-%s-%d", task.UID, number)),
+		RequestDigest:  store.CanonicalAgentExecutionSnapshotDigest(fmt.Appendf(nil, "request-%s-%d", task.UID, number)),
+		TurnID:         fmt.Sprintf("turn-%s-%d", task.UID, number),
+		Backend:        string(corev1alpha1.AgentExecutionBackendHarnessWrapper),
+		State:          store.HarnessV1AttemptPrepared,
+		RetryClass:     store.HarnessV1RetryClassNone,
+	}
+	if err := durable.CreateHarnessV1Attempt(ctx, attempt, fence); err != nil {
+		t.Fatal(err)
+	}
+	if !terminal {
+		return key
+	}
+	reason := "Terminal"
+	operation := fmt.Sprintf("terminal-%s-%d", task.UID, number)
+	if _, err := durable.TransitionHarnessV1Attempt(ctx, store.HarnessV1AttemptTransition{
+		Key: key, ExpectedVersion: 1, ExpectedState: store.HarnessV1AttemptPrepared,
+		TargetState: store.HarnessV1AttemptRejected, OperationID: operation,
+		OperationDigest: store.CanonicalAgentExecutionSnapshotDigest([]byte(operation)), Fence: fence,
+		Updates: store.HarnessV1AttemptUpdates{TerminalReason: &reason},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	return key
+}
+
+func createHarnessV1FinalizerLedgerAttempt(
+	t *testing.T,
+	ctx context.Context,
+	durable *sqlite.Store,
+	fence store.ControllerEpochFence,
+	task *corev1alpha1.Task,
+	bindingDigest string,
+) (store.HarnessV1AttemptKey, *store.HarnessV1Attempt) {
+	t.Helper()
+	const number int32 = 1
+	key := store.HarnessV1AttemptKey{Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: number}
+	attempt := &store.HarnessV1Attempt{
+		Namespace: task.Namespace, TaskName: task.Name, TaskUID: string(task.UID), Attempt: number,
+		BindingDigest:  bindingDigest,
+		SnapshotDigest: store.CanonicalAgentExecutionSnapshotDigest([]byte("wrapper-settlement-snapshot")),
+		RequestDigest:  store.CanonicalAgentExecutionSnapshotDigest([]byte("wrapper-settlement-request")),
+		TurnID:         "wrapper-settlement-turn",
+		Backend:        string(corev1alpha1.AgentExecutionBackendHarnessWrapper),
+		State:          store.HarnessV1AttemptPrepared,
+		RetryClass:     store.HarnessV1RetryClassNone,
+	}
+	if err := durable.CreateHarnessV1Attempt(ctx, attempt, fence); err != nil {
+		t.Fatal(err)
+	}
+	transitions := []struct {
+		from    store.HarnessV1AttemptState
+		to      store.HarnessV1AttemptState
+		updates store.HarnessV1AttemptUpdates
+	}{
+		{from: store.HarnessV1AttemptPrepared, to: store.HarnessV1AttemptSubmitting},
+		{from: store.HarnessV1AttemptSubmitting, to: store.HarnessV1AttemptAccepted},
+		{
+			from: store.HarnessV1AttemptAccepted,
+			to:   store.HarnessV1AttemptSucceeded,
+			updates: store.HarnessV1AttemptUpdates{
+				TerminalReason:        new("Succeeded"),
+				TerminalReceiptDigest: new(store.CanonicalAgentExecutionSnapshotDigest([]byte("wrapper-settlement-receipt"))),
+			},
+		},
+	}
+	current, err := durable.GetHarnessV1Attempt(ctx, key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for i := range transitions {
+		transition := transitions[i]
+		operation := fmt.Sprintf("wrapper-settlement-%d", i+1)
+		updated, err := durable.TransitionHarnessV1Attempt(ctx, store.HarnessV1AttemptTransition{
+			Key: key, ExpectedVersion: current.Version, ExpectedState: transition.from,
+			TargetState: transition.to, OperationID: operation,
+			OperationDigest: store.CanonicalAgentExecutionSnapshotDigest([]byte(operation)),
+			Fence:           fence, Updates: transition.updates,
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		current = updated
+	}
+	return key, current
+}
+
+type harnessV1SettlementAcknowledgementCall struct {
+	taskUID               types.UID
+	attempt               int32
+	turnID                string
+	requestDigest         string
+	terminalReceiptDigest string
+}
+
+type recordingHarnessV1SettlementAcknowledger struct {
+	failures int
+	err      error
+	calls    []harnessV1SettlementAcknowledgementCall
+}
+
+func (r *recordingHarnessV1SettlementAcknowledger) AcknowledgeHarnessV1Settlement(
+	_ context.Context,
+	task *corev1alpha1.Task,
+	attempt *store.HarnessV1Attempt,
+) error {
+	r.calls = append(r.calls, harnessV1SettlementAcknowledgementCall{
+		taskUID: task.UID, attempt: attempt.Attempt, turnID: attempt.TurnID,
+		requestDigest: attempt.RequestDigest, terminalReceiptDigest: attempt.TerminalReceiptDigest,
+	})
+	if r.failures > 0 {
+		r.failures--
+		return r.err
+	}
+	return nil
+}
diff --git a/internal/controller/harness_v1_runtime_session.go b/internal/controller/harness_v1_runtime_session.go
new file mode 100644
index 000000000..c70058b09
--- /dev/null
+++ b/internal/controller/harness_v1_runtime_session.go
@@ -0,0 +1,102 @@
+package controller
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/harness"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+// settleHarnessV1RuntimeSessionRecord owns the restored legacy runtime-session
+// payload lifecycle. The durable v1 attempt and SessionTurn are already
+// terminal before this method clears Task ownership or physically reclaims a
+// task-scoped record.
+func (d *HarnessV1Dispatcher) settleHarnessV1RuntimeSessionRecord(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	attempt *store.HarnessV1Attempt,
+) error {
+	runtimes, ok := d.Attempts.(harness.RuntimeSessionStore)
+	if !ok || attempt == nil || attempt.RuntimeSessionID == "" {
+		return nil
+	}
+	id := harness.RuntimeSessionID(attempt.RuntimeSessionID)
+	session, err := runtimes.GetRuntimeSession(ctx, task.Namespace, id)
+	if errors.Is(err, store.ErrNotFound) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	if session.Owner.ActiveTask != "" && session.Owner.ActiveTask != task.Name {
+		return fmt.Errorf("%w: runtime session %s is owned by Task %q", store.ErrConflict, id, session.Owner.ActiveTask)
+	}
+	sessionBacked := task.Spec.SessionRef != nil
+	clearOwner := ""
+	transition := func(target harness.RuntimeSessionState) error {
+		updated, transitionErr := runtimes.TransitionRuntimeSession(ctx, harness.RuntimeSessionTransition{
+			Namespace: task.Namespace, ID: id, From: session.State, To: target,
+			ActiveTask: &clearOwner, UpdatedAt: time.Now().UTC(),
+		})
+		if transitionErr != nil {
+			return transitionErr
+		}
+		session = updated
+		return nil
+	}
+
+	for range 4 {
+		if session.State == harness.RuntimeSessionStateDeleted {
+			return runtimes.DeleteRuntimeSession(ctx, task.Namespace, id)
+		}
+		if sessionBacked {
+			switch session.CleanupPolicy {
+			case harness.RuntimeCleanupPolicyRetain:
+				switch session.State {
+				case harness.RuntimeSessionStateTurnRunning, harness.RuntimeSessionStateReady:
+					if err := transition(harness.RuntimeSessionStateIdle); err != nil {
+						return err
+					}
+					continue
+				case harness.RuntimeSessionStateIdle:
+					return transition(harness.RuntimeSessionStateRetained)
+				case harness.RuntimeSessionStateRetained:
+					return transition(harness.RuntimeSessionStateRetained)
+				}
+			case harness.RuntimeCleanupPolicySuspend:
+				switch session.State {
+				case harness.RuntimeSessionStateTurnRunning, harness.RuntimeSessionStateReady:
+					if err := transition(harness.RuntimeSessionStateIdle); err != nil {
+						return err
+					}
+					continue
+				case harness.RuntimeSessionStateIdle:
+					return transition(harness.RuntimeSessionStateSuspended)
+				case harness.RuntimeSessionStateSuspended:
+					return transition(harness.RuntimeSessionStateSuspended)
+				}
+			case harness.RuntimeCleanupPolicyDelete:
+				// Continue into the deletion state machine below.
+			}
+		}
+		switch session.State {
+		case harness.RuntimeSessionStateDeleting:
+			if err := transition(harness.RuntimeSessionStateDeleted); err != nil {
+				return err
+			}
+		default:
+			if !harness.RuntimeSessionTransitionAllowed(session.State, harness.RuntimeSessionStateDeleting) {
+				return fmt.Errorf("%w: runtime session %s state %s cannot be reclaimed after terminal attempt",
+					store.ErrConflict, id, session.State)
+			}
+			if err := transition(harness.RuntimeSessionStateDeleting); err != nil {
+				return err
+			}
+		}
+	}
+	return fmt.Errorf("%w: runtime session %s did not reach a terminal cleanup state", store.ErrNotReady, id)
+}
diff --git a/internal/controller/harness_v1_session.go b/internal/controller/harness_v1_session.go
new file mode 100644
index 000000000..9208549b6
--- /dev/null
+++ b/internal/controller/harness_v1_session.go
@@ -0,0 +1,461 @@
+package controller
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+// permanentHarnessV1PreSubmitSessionError marks a Session identity conflict
+// that immutable control state proves cannot succeed on retry. Storage,
+// controller-epoch, and failed re-read conflicts intentionally remain untyped
+// so the Prepared attempt can be retried.
+type permanentHarnessV1PreSubmitSessionError struct{ err error }
+
+func (e *permanentHarnessV1PreSubmitSessionError) Error() string { return e.err.Error() }
+func (e *permanentHarnessV1PreSubmitSessionError) Unwrap() error { return e.err }
+
+func permanentHarnessV1PreSubmitSession(err error) error {
+	if err == nil || isPermanentHarnessV1PreSubmitSessionError(err) {
+		return err
+	}
+	return &permanentHarnessV1PreSubmitSessionError{err: err}
+}
+
+func isPermanentHarnessV1PreSubmitSessionError(err error) bool {
+	var permanent *permanentHarnessV1PreSubmitSessionError
+	return errors.As(err, &permanent)
+}
+
+func harnessV1SessionAttemptReference(attempt *store.HarnessV1Attempt) string {
+	if attempt == nil {
+		return ""
+	}
+	return harnessV1AttemptKey(attempt).SessionReferenceID()
+}
+
+func harnessV1SessionRuntimeIdentity(binding *corev1alpha1.AgentExecutionBinding) string {
+	if binding == nil {
+		return ""
+	}
+	if binding.RuntimeRef != nil && binding.RuntimeRef.UID != "" {
+		return string(binding.RuntimeRef.UID)
+	}
+	return string(binding.RuntimeType)
+}
+
+func harnessV1SessionLineageConfigDigest(binding *corev1alpha1.AgentExecutionBinding) (string, error) {
+	if binding == nil {
+		return "", errors.New("execution binding is required for Session lineage")
+	}
+	if store.ValidateCanonicalDigest("runtime profile digest", binding.RuntimeProfileDigest) == nil {
+		return binding.RuntimeProfileDigest, nil
+	}
+	// Harness v1 has no managed RuntimeProfile. Commit to the immutable route,
+	// runtime, and Agent identities while excluding turn-local prompt fields.
+	return acpDomainDigest("agent-execution-session-lineage-config/v1", struct {
+		Contract   corev1alpha1.AgentRuntimeContractVersion `json:"contract"`
+		Backend    corev1alpha1.AgentExecutionBackend       `json:"backend"`
+		Runtime    corev1alpha1.AgentRuntimeType            `json:"runtime,omitempty"`
+		RuntimeRef *corev1alpha1.AgentExecutionRuntimeRef   `json:"runtimeRef,omitempty"`
+		Agent      *corev1alpha1.AgentExecutionAgentRef     `json:"agent,omitempty"`
+	}{binding.ContractVersion, binding.Backend, binding.RuntimeType, binding.RuntimeRef, binding.Agent})
+}
+
+func (d *HarnessV1Dispatcher) prepareHarnessV1TaskSession(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	verified *verifiedHarnessV1Execution,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+) error {
+	if verified == nil || verified.frozenTask == nil || verified.frozenTask.Spec.SessionRef == nil {
+		return nil
+	}
+	if d.Sessions == nil {
+		return errors.New("harness v1 Session continuity is not configured")
+	}
+	ref := verified.frozenTask.Spec.SessionRef
+	name := strings.TrimSpace(ref.Name)
+	if name == "" {
+		return store.ValidationErrorf("harness v1 SessionRef name is required")
+	}
+	if verified.body.HarnessV1 == nil || verified.body.HarnessV1.SessionName != name ||
+		verified.body.HarnessV1.SessionBootstrap == nil {
+		return fmt.Errorf("%w: frozen harness v1 Session identity is incomplete", store.ErrConflict)
+	}
+	bootstrap := verified.body.HarnessV1.SessionBootstrap
+	transcriptBackedPrompt := ref.PromptIncluded && strings.TrimSpace(ref.ThroughMessageID) != ""
+	if !ref.Create && !transcriptBackedPrompt {
+		if _, err := d.Sessions.controls.GetSessionControl(ctx, task.Namespace, name); err != nil {
+			if errors.Is(err, store.ErrNotFound) {
+				return fmt.Errorf("session %s/%s does not exist and create=false: %w", task.Namespace, name, store.ErrNotFound)
+			}
+			return err
+		}
+	}
+	sessionType := defaultACPSessionType
+	if ref.PromptIncluded && strings.HasPrefix(ref.ThroughMessageID, "gateway:") {
+		sessionType = store.SessionTypeGateway
+	}
+	control, err := d.Sessions.EnsureSession(ctx, ACPEnsureSessionRequest{
+		Namespace:                 task.Namespace,
+		SessionName:               name,
+		SessionType:               sessionType,
+		ExpectedSessionUID:        bootstrap.SessionUID,
+		RequireExistingTranscript: transcriptBackedPrompt && !ref.Create,
+		Fence:                     fence,
+		CreatedAt:                 time.Now().UTC(),
+	})
+	if err != nil {
+		return d.classifyHarnessV1PreSubmitSessionConflict(
+			ctx, task.Namespace, name, bootstrap, task, attempt, err,
+		)
+	}
+	if err := validateFrozenHarnessV1SessionControl(bootstrap, control, task, attempt); err != nil {
+		return err
+	}
+	expiresAt := time.Now().UTC().Add(defaultHarnessV1TurnTimeout + time.Minute)
+	if verified.frozenTask.Spec.Timeout != nil && verified.frozenTask.Spec.Timeout.Duration > 0 {
+		expiresAt = time.Now().UTC().Add(verified.frozenTask.Spec.Timeout.Duration + time.Minute)
+	}
+	lineageConfigDigest, err := harnessV1SessionLineageConfigDigest(verified.binding)
+	if err != nil {
+		return err
+	}
+	control, err = d.Sessions.controls.GetSessionControl(ctx, task.Namespace, name)
+	if err != nil {
+		return fmt.Errorf("recheck frozen harness v1 Session control before lease acquisition: %w", err)
+	}
+	if err := validateFrozenHarnessV1SessionControl(bootstrap, control, task, attempt); err != nil {
+		return err
+	}
+	lease, err := d.Sessions.AcquireMutationLease(ctx, ACPAcquireSessionLeaseRequest{
+		Session:             *control,
+		Fence:               fence,
+		TaskUID:             string(task.UID),
+		Attempt:             int64(attempt.Attempt),
+		PromptID:            attempt.TurnID,
+		PromptRequestDigest: attempt.RequestDigest,
+		AcquiredAt:          time.Now().UTC(),
+		ExpiresAt:           &expiresAt,
+		NamespaceUID:        string(verified.binding.Task.NamespaceUID),
+		ContractVersion:     corev1alpha1.AgentRuntimeContractHarnessV1,
+		LineageGeneration:   1,
+		RuntimeIdentity:     harnessV1SessionRuntimeIdentity(verified.binding),
+		ConfigDigest:        lineageConfigDigest,
+	})
+	if err != nil {
+		return d.classifyHarnessV1PreSubmitSessionConflict(
+			ctx, task.Namespace, name, bootstrap, task, attempt, err,
+		)
+	}
+	appendPolicy := acpSessionTranscriptAppendPolicyForTask(verified.frozenTask)
+	_, err = d.Sessions.OpenTurn(ctx, ACPOpenSessionTurnRequest{
+		Lease:                *lease,
+		Fence:                fence,
+		PromptAttemptID:      harnessV1SessionAttemptReference(attempt),
+		PromptRequestDigest:  attempt.RequestDigest,
+		UserPrompt:           verified.frozenTask.Spec.Prompt,
+		SkipTranscriptAppend: appendPolicy.skipTranscriptAppend,
+		SkipUserPromptAppend: appendPolicy.skipUserPromptAppend,
+		OpenedAt:             time.Now().UTC(),
+	})
+	return err
+}
+
+// classifyHarnessV1PreSubmitSessionConflict promotes only a conflict whose
+// current authoritative control proves that the frozen Session identity was
+// lost. In particular, an unchanged control after a lease-acquisition conflict
+// can be an API or controller-epoch race and must remain retryable.
+func (d *HarnessV1Dispatcher) classifyHarnessV1PreSubmitSessionConflict(
+	ctx context.Context,
+	namespace, name string,
+	bootstrap *agentExecutionSnapshotHarnessV1SessionBootstrap,
+	task *corev1alpha1.Task,
+	attempt *store.HarnessV1Attempt,
+	cause error,
+) error {
+	if cause == nil || !errors.Is(cause, store.ErrConflict) {
+		return cause
+	}
+	current, err := d.Sessions.controls.GetSessionControl(ctx, namespace, name)
+	if err != nil {
+		return errors.Join(cause, fmt.Errorf("recheck harness v1 Session control after conflict: %w", err))
+	}
+	if err := validateFrozenHarnessV1SessionControl(bootstrap, current, task, attempt); err != nil {
+		return err
+	}
+	return cause
+}
+
+func validateFrozenHarnessV1SessionControl(
+	bootstrap *agentExecutionSnapshotHarnessV1SessionBootstrap,
+	control *store.SessionControl,
+	task *corev1alpha1.Task,
+	attempt *store.HarnessV1Attempt,
+) error {
+	if bootstrap == nil || control == nil || task == nil || attempt == nil ||
+		control.SessionUID != bootstrap.SessionUID || control.Availability != store.SessionAvailable {
+		return permanentHarnessV1PreSubmitSession(fmt.Errorf(
+			"%w: current harness v1 Session control does not match the frozen available identity", store.ErrConflict,
+		))
+	}
+	if attempt.Attempt < 1 {
+		return permanentHarnessV1PreSubmitSession(fmt.Errorf(
+			"%w: harness v1 Session attempt number must be positive", store.ErrConflict,
+		))
+	}
+	initialVersion := bootstrap.ControlVersion
+	if bootstrap.ControlVersion == 0 {
+		initialVersion = 1
+	}
+	priorAttempts := int64(attempt.Attempt - 1)
+	expectedVersion := initialVersion + 2*priorAttempts
+	expectedGeneration := bootstrap.LeaseGeneration + priorAttempts
+	if priorAttempts > 0 {
+		priorTurnID, err := store.SessionTurnKey{
+			SessionUID:      bootstrap.SessionUID,
+			LeaseGeneration: expectedGeneration,
+			TaskUID:         string(task.UID),
+			Attempt:         priorAttempts,
+			PromptID:        string(harnessV1TurnID(task, attempt.Attempt-1)),
+		}.CanonicalID()
+		if err != nil {
+			return err
+		}
+		if control.LastOperationID != "finalize:"+priorTurnID {
+			return permanentHarnessV1PreSubmitSession(fmt.Errorf(
+				"%w: harness v1 Session retry does not follow its own finalized turn", store.ErrConflict,
+			))
+		}
+	}
+	if control.Lease == nil {
+		if control.Version == expectedVersion && control.LeaseGeneration == expectedGeneration {
+			return nil
+		}
+		return permanentHarnessV1PreSubmitSession(fmt.Errorf(
+			"%w: harness v1 Session control advanced after transcript freeze", store.ErrConflict,
+		))
+	}
+	expectedGeneration++
+	expectedDigest, err := acpSessionMutationLeaseDigest(
+		bootstrap.SessionUID, expectedGeneration, string(task.UID), int64(attempt.Attempt),
+		attempt.TurnID, attempt.RequestDigest,
+	)
+	if err != nil {
+		return err
+	}
+	lease := control.Lease
+	if control.Version != expectedVersion+1 || control.LeaseGeneration != expectedGeneration ||
+		lease.Generation != expectedGeneration || lease.TaskUID != string(task.UID) ||
+		lease.Attempt != int64(attempt.Attempt) || lease.PromptID != attempt.TurnID ||
+		lease.RequestDigest != expectedDigest {
+		return permanentHarnessV1PreSubmitSession(fmt.Errorf(
+			"%w: harness v1 Session is leased by stale or foreign work", store.ErrConflict,
+		))
+	}
+	return nil
+}
+
+func (d *HarnessV1Dispatcher) recoverHarnessV1TaskSession(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	verified *verifiedHarnessV1Execution,
+	attempt *store.HarnessV1Attempt,
+) (*ACPSessionTurn, error) {
+	if verified == nil || verified.frozenTask == nil || verified.frozenTask.Spec.SessionRef == nil {
+		return nil, nil
+	}
+	if d.Sessions == nil {
+		return nil, errors.New("harness v1 Session continuity is not configured")
+	}
+	name := strings.TrimSpace(verified.frozenTask.Spec.SessionRef.Name)
+	control, err := d.Sessions.controls.GetSessionControl(ctx, task.Namespace, name)
+	if err != nil {
+		return nil, err
+	}
+	lineageConfigDigest, err := harnessV1SessionLineageConfigDigest(verified.binding)
+	if err != nil {
+		return nil, err
+	}
+	lineage := control.Lineage
+	if lineage == nil || lineage.ContractVersion != string(corev1alpha1.AgentRuntimeContractHarnessV1) ||
+		lineage.NamespaceUID != string(verified.binding.Task.NamespaceUID) ||
+		lineage.RuntimeIdentity != harnessV1SessionRuntimeIdentity(verified.binding) ||
+		lineage.ConfigDigest != lineageConfigDigest {
+		return nil, fmt.Errorf("%w: harness v1 Session lineage does not match the immutable Task binding", store.ErrConflict)
+	}
+	key := store.SessionTurnKey{
+		SessionUID: control.SessionUID, LeaseGeneration: control.LeaseGeneration,
+		TaskUID: string(task.UID), Attempt: int64(attempt.Attempt), PromptID: attempt.TurnID,
+	}
+	turnID, err := key.CanonicalID()
+	if err != nil {
+		return nil, err
+	}
+	turn, err := d.Sessions.controls.GetSessionTurn(ctx, turnID)
+	if err != nil {
+		return nil, err
+	}
+	if turn.PromptAttemptID != harnessV1SessionAttemptReference(attempt) || turn.Key != key {
+		return nil, fmt.Errorf("%w: harness v1 SessionTurn identity does not match the durable attempt", store.ErrConflict)
+	}
+	lease := ACPSessionLease{Session: *control, Key: key}
+	if turn.State == store.SessionTurnOpen {
+		if err := validateACPSessionLease(control, key); err != nil {
+			return nil, err
+		}
+	}
+	appendPolicy := acpSessionTranscriptAppendPolicyForTask(verified.frozenTask)
+	return &ACPSessionTurn{
+		Lease: lease, Turn: *turn,
+		SkipTranscriptAppend: appendPolicy.skipTranscriptAppend,
+		SkipUserPromptAppend: appendPolicy.skipUserPromptAppend,
+	}, nil
+}
+
+func harnessV1SessionCanBeAbsent(attempt *store.HarnessV1Attempt) bool {
+	if attempt == nil || attempt.TerminalReceiptDigest != "" {
+		return false
+	}
+	if attempt.State == store.HarnessV1AttemptCancelled {
+		return true
+	}
+	if attempt.State != store.HarnessV1AttemptRejected {
+		return false
+	}
+	switch attempt.TerminalReason {
+	case harnessV1ReasonBackendDisabled, harnessV1ReasonCredentialChanged, harnessV1ReasonInvalidBinding,
+		harnessV1ReasonSessionConflict:
+		return true
+	default:
+		return false
+	}
+}
+
+func harnessV1RuntimeProjection(
+	task *corev1alpha1.Task,
+	attempt *store.HarnessV1Attempt,
+	message string,
+) *corev1alpha1.HarnessRuntimeStatus {
+	projected := &corev1alpha1.HarnessRuntimeStatus{}
+	if task.Status.HarnessRuntime != nil {
+		projected = task.Status.HarnessRuntime.DeepCopy()
+	}
+	state, outcome, _ := harnessV1TaskProjection(attempt.State)
+	projected.Attempt = attempt.Attempt
+	projected.TurnID = attempt.TurnID
+	projected.RuntimeSessionID = attempt.RuntimeSessionID
+	projected.State = state
+	projected.Outcome = outcome
+	projected.Reason = attempt.TerminalReason
+	projected.TerminalReceiptDigest = attempt.TerminalReceiptDigest
+	projected.RequestDigest = attempt.RequestDigest
+	projected.ControllerEpoch = attempt.ControllerEpoch
+	projected.LastEventSeq = attempt.LastEventSeq
+	projected.Message = message
+	if attempt.CancelRequestedAt != nil {
+		when := metav1.NewTime(attempt.CancelRequestedAt.UTC())
+		projected.CancelRequestedAt = &when
+	} else {
+		projected.CancelRequestedAt = nil
+	}
+	return projected
+}
+
+func (d *HarnessV1Dispatcher) finalizeHarnessV1TaskSession(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	verified *verifiedHarnessV1Execution,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+	retrying bool,
+) (bool, error) {
+	if verified == nil || verified.frozenTask == nil || verified.frozenTask.Spec.SessionRef == nil {
+		return false, nil
+	}
+	// SessionConflict is emitted only when preparation proves the frozen
+	// identity was lost before this attempt acquired a lease or opened a turn.
+	// Recovery against the winning control would itself conflict, so skip it.
+	if attempt != nil && attempt.State == store.HarnessV1AttemptRejected &&
+		attempt.TerminalReason == harnessV1ReasonSessionConflict && attempt.TerminalReceiptDigest == "" {
+		return false, nil
+	}
+	sessionTurn, err := d.recoverHarnessV1TaskSession(ctx, task, verified, attempt)
+	if err != nil {
+		if errors.Is(err, store.ErrNotFound) && harnessV1SessionCanBeAbsent(attempt) {
+			return false, nil
+		}
+		return false, err
+	}
+	if sessionTurn == nil {
+		return false, nil
+	}
+	if sessionTurn.Turn.State == store.SessionTurnFinalized {
+		_, err := d.Sessions.ResumeSessionTurnFinalization(ctx, ACPResumeSessionTurnFinalizationRequest{
+			SessionTurn: *sessionTurn, Fence: fence,
+		})
+		return true, err
+	}
+	message := d.terminalMessage(attempt)
+	_, _, phase := harnessV1TaskProjection(attempt.State)
+	if retrying {
+		phase = corev1alpha1.TaskPhaseRunning
+		sessionTurn.SkipTranscriptAppend = true
+		sessionTurn.SkipUserPromptAppend = false
+		message = "harness v1 attempt settled; a safe retry is pending"
+	}
+	payload, err := json.Marshal(taskTerminalProjection{
+		Namespace: task.Namespace, Task: task.Name, TaskUID: string(task.UID), Attempt: attempt.Attempt,
+		Phase: phase, Message: message, BindingDigest: attempt.BindingDigest,
+		HarnessRuntime: harnessV1RuntimeProjection(task, attempt, message), ResultRef: task.Status.ResultRef.DeepCopy(),
+	})
+	if err != nil {
+		return false, err
+	}
+	projection := ACPFinalizationProjection{
+		ProjectionKind: "TaskTerminalStatus", Payload: payload, AvailableAt: time.Now().UTC(),
+	}
+	finalizedAt := time.Now().UTC()
+	switch attempt.State {
+	case store.HarnessV1AttemptSucceeded:
+		result, err := d.ResultStore.GetResult(ctx, task.Namespace, task.Name)
+		if err != nil {
+			return false, err
+		}
+		_, err = d.Sessions.FinalizeAssistantResult(ctx, ACPFinalizeAssistantRequest{
+			SessionTurn: *sessionTurn, Fence: fence, AssistantResult: string(result),
+			Projection: projection, FinalizedAt: finalizedAt,
+		})
+		return true, err
+	case store.HarnessV1AttemptOutcomeUnknown:
+		reason := strings.TrimSpace(attempt.TerminalReason)
+		if reason == "" {
+			reason = harnessV1OutcomeUnknownMessage
+		}
+		_, err = d.Sessions.FinalizeOutcomeUnknown(ctx, ACPFinalizeOutcomeUnknownRequest{
+			SessionTurn: *sessionTurn, Fence: fence, Reason: reason,
+			Projection: projection, FinalizedAt: finalizedAt,
+		})
+		return true, err
+	default:
+		reason := strings.TrimSpace(attempt.TerminalReason)
+		if reason == "" {
+			reason = string(attempt.State)
+		}
+		_, err = d.Sessions.FinalizeOutcomeMarker(ctx, ACPFinalizeOutcomeMarkerRequest{
+			SessionTurn: *sessionTurn, Fence: fence, Kind: string(attempt.State), Reason: reason,
+			Projection: projection, FinalizedAt: finalizedAt,
+		})
+		return true, err
+	}
+}
diff --git a/internal/controller/harness_v1_session_test.go b/internal/controller/harness_v1_session_test.go
new file mode 100644
index 000000000..3d3bce995
--- /dev/null
+++ b/internal/controller/harness_v1_session_test.go
@@ -0,0 +1,394 @@
+package controller
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"path/filepath"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+type harnessV1SessionFenceStore struct {
+	store.SessionControlStore
+	controls        []store.SessionControl
+	getErrors       map[int]error
+	acquireErr      error
+	getCalls        int
+	acquireCalls    int
+	createTurnCalls int
+}
+
+func (s *harnessV1SessionFenceStore) GetSessionControl(
+	context.Context,
+	string,
+	string,
+) (*store.SessionControl, error) {
+	call := s.getCalls
+	s.getCalls++
+	if err := s.getErrors[call]; err != nil {
+		return nil, err
+	}
+	if len(s.controls) == 0 {
+		return nil, store.ErrNotFound
+	}
+	index := call
+	if index >= len(s.controls) {
+		index = len(s.controls) - 1
+	}
+	return copyHarnessV1SessionControl(s.controls[index]), nil
+}
+
+func (s *harnessV1SessionFenceStore) AcquireSessionMutationLease(
+	_ context.Context,
+	request store.AcquireSessionMutationLeaseRequest,
+) (*store.SessionControl, error) {
+	s.acquireCalls++
+	if s.acquireErr != nil {
+		return nil, s.acquireErr
+	}
+	control := *copyHarnessV1SessionControl(s.controls[len(s.controls)-1])
+	if control.SessionUID != request.SessionUID {
+		return nil, store.ErrConflict
+	}
+	if control.Lease == nil {
+		if control.Version != request.ExpectedVersion ||
+			control.LeaseGeneration != request.ExpectedLeaseGeneration {
+			return nil, store.ErrConflict
+		}
+		control.Version++
+		control.LeaseGeneration++
+		control.Lease = &store.SessionMutationLease{
+			Generation:    control.LeaseGeneration,
+			TaskUID:       request.TaskUID,
+			Attempt:       request.Attempt,
+			PromptID:      request.PromptID,
+			RequestDigest: request.RequestDigest,
+			AcquiredAt:    request.AcquiredAt,
+			ExpiresAt:     request.ExpiresAt,
+		}
+	}
+	return &control, nil
+}
+
+func (s *harnessV1SessionFenceStore) CreateSessionTurn(
+	_ context.Context,
+	request store.CreateSessionTurnRequest,
+) (*store.SessionTurn, error) {
+	s.createTurnCalls++
+	turn := request.Turn
+	turn.State = store.SessionTurnOpen
+	turn.Version = 1
+	return &turn, nil
+}
+
+func copyHarnessV1SessionControl(control store.SessionControl) *store.SessionControl {
+	copyControl := control
+	if control.Lease != nil {
+		copyLease := *control.Lease
+		copyControl.Lease = &copyLease
+	}
+	return &copyControl
+}
+
+func TestPrepareHarnessV1TaskSessionRechecksFrozenControlBeforeAcquire(t *testing.T) {
+	bootstrap, initial, task, verified, attempt := harnessV1SessionFenceFixture(t, false)
+	advanced := initial
+	advanced.Version++
+	controls := &harnessV1SessionFenceStore{controls: []store.SessionControl{initial, initial, advanced}}
+	dispatcher, fence, closeStore := harnessV1SessionFenceDispatcher(t, controls, task)
+	defer closeStore()
+
+	err := dispatcher.prepareHarnessV1TaskSession(context.Background(), task, verified, attempt, fence)
+	if err == nil || !errors.Is(err, store.ErrConflict) || !isPermanentHarnessV1PreSubmitSessionError(err) {
+		t.Fatalf("stale frozen Session control error = %v, want permanent ErrConflict", err)
+	}
+	if bootstrap.ControlVersion != initial.Version || controls.acquireCalls != 0 {
+		t.Fatalf("frozen version=%d initial=%d acquire calls=%d, want no acquire", bootstrap.ControlVersion, initial.Version, controls.acquireCalls)
+	}
+}
+
+func TestPrepareHarnessV1TaskSessionRejectsRecreatedSessionUID(t *testing.T) {
+	_, initial, task, verified, attempt := harnessV1SessionFenceFixture(t, false)
+	recreated := initial
+	recreated.SessionUID = "recreated-session-uid"
+	controls := &harnessV1SessionFenceStore{controls: []store.SessionControl{recreated}}
+	dispatcher, fence, closeStore := harnessV1SessionFenceDispatcher(t, controls, task)
+	defer closeStore()
+
+	err := dispatcher.prepareHarnessV1TaskSession(context.Background(), task, verified, attempt, fence)
+	if err == nil || !errors.Is(err, store.ErrConflict) || !isPermanentHarnessV1PreSubmitSessionError(err) {
+		t.Fatalf("recreated Session UID error = %v, want permanent ErrConflict", err)
+	}
+	if controls.acquireCalls != 0 {
+		t.Fatalf("acquire calls after Session recreation = %d, want 0", controls.acquireCalls)
+	}
+}
+
+func TestPrepareHarnessV1TaskSessionNewUIDMustWinCreation(t *testing.T) {
+	_, initial, task, verified, attempt := harnessV1SessionFenceFixture(t, true)
+	competing := initial
+	competing.SessionUID = "competing-session-uid"
+	competing.Version = 1
+	controls := &harnessV1SessionFenceStore{controls: []store.SessionControl{competing}}
+	dispatcher, fence, closeStore := harnessV1SessionFenceDispatcher(t, controls, task)
+	defer closeStore()
+
+	err := dispatcher.prepareHarnessV1TaskSession(context.Background(), task, verified, attempt, fence)
+	if err == nil || !errors.Is(err, store.ErrConflict) || !isPermanentHarnessV1PreSubmitSessionError(err) {
+		t.Fatalf("competing new Session UID error = %v, want permanent ErrConflict", err)
+	}
+	if controls.acquireCalls != 0 {
+		t.Fatalf("acquire calls after losing Session creation = %d, want 0", controls.acquireCalls)
+	}
+}
+
+func TestPrepareHarnessV1TaskSessionClassifiesAcquireWinnerAsPermanent(t *testing.T) {
+	_, initial, task, verified, attempt := harnessV1SessionFenceFixture(t, false)
+	advanced := initial
+	advanced.Version++
+	controls := &harnessV1SessionFenceStore{
+		controls:   []store.SessionControl{initial, initial, initial, advanced},
+		acquireErr: fmt.Errorf("lease compare-and-swap: %w", store.ErrConflict),
+	}
+	dispatcher, fence, closeStore := harnessV1SessionFenceDispatcher(t, controls, task)
+	defer closeStore()
+
+	err := dispatcher.prepareHarnessV1TaskSession(context.Background(), task, verified, attempt, fence)
+	if err == nil || !errors.Is(err, store.ErrConflict) || !isPermanentHarnessV1PreSubmitSessionError(err) {
+		t.Fatalf("acquire winner error = %v, want permanent ErrConflict", err)
+	}
+	if controls.acquireCalls != 1 || controls.createTurnCalls != 0 {
+		t.Fatalf("acquire winner calls acquire=%d createTurn=%d, want 1/0", controls.acquireCalls, controls.createTurnCalls)
+	}
+}
+
+func TestPrepareHarnessV1TaskSessionKeepsUnchangedAcquireConflictRetryable(t *testing.T) {
+	_, initial, task, verified, attempt := harnessV1SessionFenceFixture(t, false)
+	controls := &harnessV1SessionFenceStore{
+		controls:   []store.SessionControl{initial},
+		acquireErr: fmt.Errorf("stale controller epoch: %w", store.ErrConflict),
+	}
+	dispatcher, fence, closeStore := harnessV1SessionFenceDispatcher(t, controls, task)
+	defer closeStore()
+
+	err := dispatcher.prepareHarnessV1TaskSession(context.Background(), task, verified, attempt, fence)
+	if err == nil || !errors.Is(err, store.ErrConflict) || isPermanentHarnessV1PreSubmitSessionError(err) {
+		t.Fatalf("unchanged acquire conflict = %v, want retryable ErrConflict", err)
+	}
+	if controls.acquireCalls != 1 || controls.createTurnCalls != 0 {
+		t.Fatalf("unchanged conflict calls acquire=%d createTurn=%d, want 1/0", controls.acquireCalls, controls.createTurnCalls)
+	}
+}
+
+func TestPrepareHarnessV1TaskSessionKeepsFailedConflictRecheckRetryable(t *testing.T) {
+	_, initial, task, verified, attempt := harnessV1SessionFenceFixture(t, false)
+	recheckErr := errors.New("temporary Session API read failure")
+	controls := &harnessV1SessionFenceStore{
+		controls:   []store.SessionControl{initial},
+		getErrors:  map[int]error{3: recheckErr},
+		acquireErr: fmt.Errorf("lease compare-and-swap: %w", store.ErrConflict),
+	}
+	dispatcher, fence, closeStore := harnessV1SessionFenceDispatcher(t, controls, task)
+	defer closeStore()
+
+	err := dispatcher.prepareHarnessV1TaskSession(context.Background(), task, verified, attempt, fence)
+	if err == nil || !errors.Is(err, store.ErrConflict) || !errors.Is(err, recheckErr) ||
+		isPermanentHarnessV1PreSubmitSessionError(err) {
+		t.Fatalf("failed conflict recheck = %v, want retryable joined error", err)
+	}
+	if controls.acquireCalls != 1 || controls.createTurnCalls != 0 {
+		t.Fatalf("failed recheck calls acquire=%d createTurn=%d, want 1/0", controls.acquireCalls, controls.createTurnCalls)
+	}
+}
+
+func TestPrepareHarnessV1TaskSessionRecoversExactPreparedLease(t *testing.T) {
+	bootstrap, initial, task, verified, attempt := harnessV1SessionFenceFixture(t, false)
+	expectedGeneration := bootstrap.LeaseGeneration + 1
+	leaseDigest, err := acpSessionMutationLeaseDigest(
+		bootstrap.SessionUID,
+		expectedGeneration,
+		string(task.UID),
+		int64(attempt.Attempt),
+		attempt.TurnID,
+		attempt.RequestDigest,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	leased := initial
+	leased.Version++
+	leased.LeaseGeneration = expectedGeneration
+	leased.Lease = &store.SessionMutationLease{
+		Generation: expectedGeneration,
+		TaskUID:    string(task.UID), Attempt: int64(attempt.Attempt), PromptID: attempt.TurnID,
+		RequestDigest: leaseDigest, AcquiredAt: time.Now().UTC(),
+	}
+	controls := &harnessV1SessionFenceStore{controls: []store.SessionControl{leased}}
+	dispatcher, fence, closeStore := harnessV1SessionFenceDispatcher(t, controls, task)
+	defer closeStore()
+
+	if err := dispatcher.prepareHarnessV1TaskSession(context.Background(), task, verified, attempt, fence); err != nil {
+		t.Fatalf("recover exact Prepared Session lease: %v", err)
+	}
+	if controls.acquireCalls != 1 || controls.createTurnCalls != 1 {
+		t.Fatalf("Prepared lease recovery calls acquire=%d createTurn=%d, want 1/1", controls.acquireCalls, controls.createTurnCalls)
+	}
+}
+
+func TestPrepareHarnessV1TaskSessionAllowsOwnFinalizedRetry(t *testing.T) {
+	bootstrap, initial, task, verified, attempt := harnessV1SessionFenceFixture(t, false)
+	attempt.Attempt = 2
+	attempt.TurnID = string(harnessV1TurnID(task, attempt.Attempt))
+	retryReady := initial
+	retryReady.Version += 2
+	retryReady.LeaseGeneration++
+	priorTurnID, err := store.SessionTurnKey{
+		SessionUID:      bootstrap.SessionUID,
+		LeaseGeneration: retryReady.LeaseGeneration,
+		TaskUID:         string(task.UID),
+		Attempt:         1,
+		PromptID:        string(harnessV1TurnID(task, 1)),
+	}.CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	retryReady.LastOperationID = "finalize:" + priorTurnID
+	controls := &harnessV1SessionFenceStore{controls: []store.SessionControl{retryReady, retryReady, retryReady}}
+	dispatcher, fence, closeStore := harnessV1SessionFenceDispatcher(t, controls, task)
+	defer closeStore()
+
+	if err := dispatcher.prepareHarnessV1TaskSession(context.Background(), task, verified, attempt, fence); err != nil {
+		t.Fatalf("prepare Session-backed safe retry: %v", err)
+	}
+	if controls.acquireCalls != 1 || controls.createTurnCalls != 1 {
+		t.Fatalf("safe retry calls acquire=%d createTurn=%d, want 1/1", controls.acquireCalls, controls.createTurnCalls)
+	}
+}
+
+func TestValidateFrozenHarnessV1SessionControlRejectsForeignRetryAdvance(t *testing.T) {
+	_, initial, task, verified, attempt := harnessV1SessionFenceFixture(t, false)
+	attempt.Attempt = 2
+	attempt.TurnID = string(harnessV1TurnID(task, attempt.Attempt))
+	advanced := initial
+	advanced.Version += 2
+	advanced.LeaseGeneration++
+
+	err := validateFrozenHarnessV1SessionControl(
+		verified.body.HarnessV1.SessionBootstrap,
+		&advanced,
+		task,
+		attempt,
+	)
+	if err == nil || !errors.Is(err, store.ErrConflict) || !isPermanentHarnessV1PreSubmitSessionError(err) {
+		t.Fatalf("foreign retry advance error = %v, want permanent ErrConflict", err)
+	}
+}
+
+func TestFinalizeHarnessV1TaskSessionDoesNotRequireTurnAfterSessionConflict(t *testing.T) {
+	_, _, task, verified, attempt := harnessV1SessionFenceFixture(t, false)
+	attempt.State = store.HarnessV1AttemptRejected
+	attempt.TerminalReason = harnessV1ReasonSessionConflict
+
+	settled, err := (&HarnessV1Dispatcher{}).finalizeHarnessV1TaskSession(
+		context.Background(), task, verified, attempt, store.ControllerEpochFence{}, false,
+	)
+	if err != nil || settled {
+		t.Fatalf("finalize pre-submit Session conflict = settled:%t err:%v, want false/nil", settled, err)
+	}
+}
+
+func harnessV1SessionFenceFixture(
+	t *testing.T,
+	newSession bool,
+) (*agentExecutionSnapshotHarnessV1SessionBootstrap, store.SessionControl, *corev1alpha1.Task, *verifiedHarnessV1Execution, *store.HarnessV1Attempt) {
+	t.Helper()
+	controlVersion := int64(3)
+	if newSession {
+		controlVersion = 0
+	}
+	bootstrapTranscript, err := buildACPBootstrapTranscript(nil, ACPBootstrapLimits{
+		MaxMessages:     harnessV1SessionBootstrapMaxMessages,
+		MaxBytes:        harnessV1SessionBootstrapMaxBytes,
+		MaxMessageBytes: harnessV1SessionBootstrapMaxMessageBytes,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	bootstrap := &agentExecutionSnapshotHarnessV1SessionBootstrap{
+		SchemaVersion: harnessV1SessionBootstrapSchemaVersion,
+		SessionUID:    "frozen-session-uid", ControlVersion: controlVersion, LeaseGeneration: 4,
+		Artifact: string(bootstrapTranscript.Artifact), Digest: bootstrapTranscript.Digest,
+	}
+	if newSession {
+		bootstrap.LeaseGeneration = 0
+	}
+	initialVersion := controlVersion
+	if newSession {
+		initialVersion = 1
+	}
+	initial := store.SessionControl{
+		Namespace: "ns", SessionName: "continued-session", SessionUID: bootstrap.SessionUID,
+		Availability: store.SessionAvailable, Version: initialVersion,
+		LeaseGeneration: bootstrap.LeaseGeneration,
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "ns", Name: "continued-task", UID: types.UID("continued-task-uid")},
+		Spec: corev1alpha1.TaskSpec{
+			Prompt: "continue the Session",
+			SessionRef: &corev1alpha1.SessionReference{
+				Name: initial.SessionName, Create: newSession, Append: true,
+			},
+		},
+	}
+	binding := &corev1alpha1.AgentExecutionBinding{
+		ContractVersion: corev1alpha1.AgentRuntimeContractHarnessV1,
+		Backend:         corev1alpha1.AgentExecutionBackendHarnessWrapper,
+		RuntimeType:     corev1alpha1.AgentRuntimeCodex,
+		Task:            corev1alpha1.AgentExecutionBindingTaskRef{NamespaceUID: types.UID("ns-uid"), UID: task.UID, BoundSpecGeneration: 1},
+		Agent:           &corev1alpha1.AgentExecutionAgentRef{Namespace: "ns", Name: "agent", UID: types.UID("agent-uid"), Generation: 1},
+	}
+	verified := &verifiedHarnessV1Execution{
+		binding: binding, frozenTask: task.DeepCopy(),
+		body: agentExecutionSnapshotBody{HarnessV1: &agentExecutionSnapshotHarnessV1{
+			SessionName: initial.SessionName, SessionBootstrap: bootstrap,
+		}},
+	}
+	attempt := &store.HarnessV1Attempt{
+		Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1,
+		TurnID: "continued-turn", RequestDigest: store.CanonicalAgentExecutionSnapshotDigest([]byte("continued-request")),
+	}
+	return bootstrap, initial, task, verified, attempt
+}
+
+func harnessV1SessionFenceDispatcher(
+	t *testing.T,
+	controls *harnessV1SessionFenceStore,
+	task *corev1alpha1.Task,
+) (*HarnessV1Dispatcher, store.ControllerEpochFence, func()) {
+	t.Helper()
+	transcripts, fence, closeStore := newACPSessionTestStore(t, filepath.Join(t.TempDir(), "harness-v1-session-fence.db"))
+	now := time.Now().UTC()
+	if err := transcripts.CreateSession(context.Background(), &store.SessionRecord{
+		Namespace: task.Namespace, Name: task.Spec.SessionRef.Name, SessionType: defaultACPSessionType,
+		CreatedAt: now, UpdatedAt: now,
+	}); err != nil {
+		closeStore()
+		t.Fatal(err)
+	}
+	continuity, err := NewACPSessionContinuity(ACPSessionContinuityConfig{
+		SessionControls: controls, Transcripts: transcripts,
+		Publications: transcripts, BranchClaims: transcripts,
+	})
+	if err != nil {
+		closeStore()
+		t.Fatal(err)
+	}
+	return &HarnessV1Dispatcher{Sessions: continuity}, fence, closeStore
+}
diff --git a/internal/controller/harness_v1_workspace.go b/internal/controller/harness_v1_workspace.go
new file mode 100644
index 000000000..b09e9c99e
--- /dev/null
+++ b/internal/controller/harness_v1_workspace.go
@@ -0,0 +1,155 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package controller
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path"
+	"strings"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/harness"
+)
+
+// resolveHarnessV1PublicReadOnlyWorkspace admits the one workspace lane whose
+// safety properties the compatibility wrapper can enforce: a credential-free
+// public source cloned for a built-in Codex turn under its read-only sandbox.
+func resolveHarnessV1PublicReadOnlyWorkspace(
+	task *corev1alpha1.Task,
+	agent *corev1alpha1.Agent,
+	target resolvedHarnessV1Target,
+) (*corev1alpha1.WorkspaceConfig, error) {
+	if task == nil || task.Spec.Workspace == nil {
+		return nil, nil
+	}
+	if agent == nil || agent.Spec.Runtime == nil {
+		return nil, errors.New("harness v1 public read-only workspace requires an Agent")
+	}
+	if target.backend != corev1alpha1.AgentExecutionBackendHarnessWrapper || target.runtimeRef != nil {
+		return nil, errors.New("harness v1 public read-only workspace requires the built-in wrapper")
+	}
+	if agent.Spec.Runtime.Type != corev1alpha1.AgentRuntimeCodex {
+		return nil, fmt.Errorf(
+			"harness v1 public read-only workspace does not support runtime %q",
+			agent.Spec.Runtime.Type,
+		)
+	}
+	if err := validateHarnessV1PublicReadOnlyWorkspace(task.Spec.Workspace); err != nil {
+		return nil, err
+	}
+	return task.Spec.Workspace.DeepCopy(), nil
+}
+
+func validateHarnessV1PublicReadOnlyWorkspace(workspace *corev1alpha1.WorkspaceConfig) error {
+	if workspace == nil {
+		return nil
+	}
+	if workspace.Intent != "" && workspace.Intent != corev1alpha1.WorkspaceIntentRead {
+		return errors.New("harness v1 public workspace requires read intent")
+	}
+	if workspace.GitRepo == "" || workspace.GitRepo != strings.TrimSpace(workspace.GitRepo) {
+		return errors.New("harness v1 public workspace requires a canonical credential-free gitRepo")
+	}
+	repository, err := workspaceRepository(workspace)
+	if err != nil {
+		return fmt.Errorf("validate harness v1 public workspace repository: %w", err)
+	}
+	parsed, _, err := canonicalWorkspaceRepositoryURL(repository.URL)
+	if err != nil {
+		return fmt.Errorf("validate harness v1 public workspace repository: %w", err)
+	}
+	if !harness.WrapperGitHostAllowed(parsed.Hostname(), os.Getenv(harness.WrapperAllowedGitHostsEnv)) {
+		return fmt.Errorf("harness v1 public workspace repository host %q is not allowed", parsed.Hostname())
+	}
+	if err := validateHarnessV1PublicWorkspaceAuthority(workspace); err != nil {
+		return err
+	}
+	return validateHarnessV1PublicWorkspaceLocation(workspace)
+}
+
+func validateHarnessV1PublicWorkspaceAuthority(workspace *corev1alpha1.WorkspaceConfig) error {
+	if workspace.ReadCredentialRef != nil || workspace.PublicationReadCredentialRef != nil ||
+		workspace.PublicationCredentialRef != nil || workspace.ForgeCredentialRef != nil {
+		return errors.New("harness v1 public workspace rejects every read, publication, and forge credential reference")
+	}
+	if strings.TrimSpace(workspace.PublicationGitRepo) != "" || workspace.PublicationRepository != nil ||
+		strings.TrimSpace(workspace.PRBaseBranch) != "" || strings.TrimSpace(workspace.PushBranch) != "" ||
+		strings.TrimSpace(workspace.ExpectedRemoteSHA) != "" || workspace.CreatePR {
+		return errors.New("harness v1 public workspace rejects publication and pull-request authority")
+	}
+	if workspace.MaxChangedFiles != nil || len(workspace.AllowedPaths) != 0 ||
+		workspace.DenyRepositoryControlPaths || workspace.RejectBinaryFiles || workspace.RejectSecretLikeContent {
+		return errors.New("harness v1 public workspace rejects v2 publication policy fields")
+	}
+	return nil
+}
+
+func validateHarnessV1PublicWorkspaceLocation(workspace *corev1alpha1.WorkspaceConfig) error {
+	for label, value := range map[string]string{
+		"branch": workspace.Branch,
+		"ref":    workspace.Ref,
+	} {
+		if value != strings.TrimSpace(value) || strings.HasPrefix(value, "-") ||
+			strings.Contains(value, "..") || strings.Contains(value, "@{") ||
+			strings.ContainsAny(value, "\x00\r\n ~^:?*[\\") {
+			return fmt.Errorf("harness v1 public workspace %s %q is invalid", label, value)
+		}
+	}
+	if subPath := workspace.SubPath; subPath != "" {
+		cleaned := path.Clean(subPath)
+		if subPath != strings.TrimSpace(subPath) || path.IsAbs(subPath) || cleaned != subPath ||
+			cleaned == "." || cleaned == ".." || strings.HasPrefix(cleaned, "../") {
+			return fmt.Errorf("harness v1 public workspace subPath %q is invalid", subPath)
+		}
+	}
+	return nil
+}
+
+func validateFrozenHarnessV1PublicReadOnlyWorkspace(body agentExecutionSnapshotBody) error {
+	if body.Workspace == nil {
+		return nil
+	}
+	if body.HarnessV1 == nil ||
+		body.HarnessV1.Backend != string(corev1alpha1.AgentExecutionBackendHarnessWrapper) ||
+		corev1alpha1.AgentRuntimeType(body.RuntimeType) != corev1alpha1.AgentRuntimeCodex {
+		return errors.New("frozen harness v1 public workspace is not bound to the supported read-only wrapper runtime")
+	}
+	allowedTools, allowedToolsSet, _, allowBash := frozenHarnessV1ToolPolicy(body)
+	if !allowedToolsSet || len(allowedTools) != 0 || allowBash == nil || *allowBash {
+		return errors.New("frozen harness v1 public workspace requires write-capable native tools and Bash to remain disabled")
+	}
+	return validateHarnessV1PublicReadOnlyWorkspace(body.Workspace)
+}
+
+// applyHarnessV1WorkspaceMetadata projects only the frozen, credential-free
+// workspace coordinates into the digest-bound turn request. Callers must run
+// this before request validation and CanonicalStartTurnRequestDigest.
+func applyHarnessV1WorkspaceMetadata(
+	request *harness.StartTurnRequest,
+	body agentExecutionSnapshotBody,
+) error {
+	if body.Workspace == nil {
+		return nil
+	}
+	if request == nil {
+		return errors.New("harness v1 turn request is required for frozen workspace metadata")
+	}
+	if err := validateFrozenHarnessV1PublicReadOnlyWorkspace(body); err != nil {
+		return err
+	}
+	if request.Metadata == nil {
+		request.Metadata = map[string]string{}
+	}
+	request.Metadata["gitRepo"] = body.Workspace.GitRepo
+	request.Metadata["gitBranch"] = body.Workspace.Branch
+	request.Metadata["gitRef"] = body.Workspace.Ref
+	request.Metadata["workspaceSubPath"] = body.Workspace.SubPath
+	request.Metadata["readOnly"] = booleanTrueValue
+	return nil
+}
diff --git a/internal/controller/harness_v1_workspace_test.go b/internal/controller/harness_v1_workspace_test.go
new file mode 100644
index 000000000..448192da1
--- /dev/null
+++ b/internal/controller/harness_v1_workspace_test.go
@@ -0,0 +1,230 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package controller
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/harness"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+func TestEnsureHarnessV1ExecutionBindingFreezesPublicReadOnlyWorkspace(t *testing.T) {
+	ctx := context.Background()
+	fixture := newHarnessV1CandidateFixture(t)
+	task := &corev1alpha1.Task{}
+	if err := fixture.reconciler.Get(ctx, client.ObjectKeyFromObject(fixture.task), task); err != nil {
+		t.Fatal(err)
+	}
+	task.Spec.Workspace = &corev1alpha1.WorkspaceConfig{
+		Intent:  corev1alpha1.WorkspaceIntentRead,
+		GitRepo: "https://github.com/orka-agents/orka.git",
+		Branch:  "main",
+		Ref:     "0123456789abcdef0123456789abcdef01234567",
+		SubPath: "website/docs",
+	}
+	task.Generation++
+	if err := fixture.reconciler.Update(ctx, task); err != nil {
+		t.Fatal(err)
+	}
+
+	_, err, handled := fixture.reconciler.ensureHarnessV1ExecutionBinding(ctx, task, fixture.agent)
+	if err != nil || handled {
+		t.Fatalf("ensure public workspace binding = handled=%v err=%v", handled, err)
+	}
+	bound := &corev1alpha1.Task{}
+	if err := fixture.reconciler.Get(ctx, client.ObjectKeyFromObject(task), bound); err != nil {
+		t.Fatal(err)
+	}
+	binding := bound.Status.AgentExecutionBinding
+	if binding == nil {
+		t.Fatal("public read-only workspace binding was not persisted")
+	}
+	snapshot, err := fixture.reconciler.AgentExecutionSnapshots.GetAgentExecutionSnapshot(ctx, store.AgentExecutionSnapshotKey{
+		TaskUID: string(bound.UID),
+		Digest:  binding.Snapshot.Digest,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var body agentExecutionSnapshotBody
+	if err := json.Unmarshal(snapshot.Body, &body); err != nil {
+		t.Fatal(err)
+	}
+	if body.Workspace == nil || body.Workspace.GitRepo != task.Spec.Workspace.GitRepo ||
+		body.Workspace.Branch != task.Spec.Workspace.Branch || body.Workspace.Ref != task.Spec.Workspace.Ref ||
+		body.Workspace.SubPath != task.Spec.Workspace.SubPath {
+		t.Fatalf("frozen public workspace = %#v, want %#v", body.Workspace, task.Spec.Workspace)
+	}
+}
+
+func TestValidateHarnessV1PublicReadOnlyWorkspace(t *testing.T) {
+	t.Setenv(harness.WrapperAllowedGitHostsEnv, "")
+	valid := &corev1alpha1.WorkspaceConfig{
+		Intent:  corev1alpha1.WorkspaceIntentRead,
+		GitRepo: "https://github.com/orka-agents/orka.git",
+		Branch:  "main",
+		SubPath: "website/docs",
+	}
+	if err := validateHarnessV1PublicReadOnlyWorkspace(valid); err != nil {
+		t.Fatalf("valid public read-only workspace rejected: %v", err)
+	}
+
+	tests := []struct {
+		name   string
+		mutate func(*corev1alpha1.WorkspaceConfig)
+		want   string
+	}{
+		{
+			name: "write intent",
+			mutate: func(workspace *corev1alpha1.WorkspaceConfig) {
+				workspace.Intent = corev1alpha1.WorkspaceIntentWrite
+			},
+			want: "read intent",
+		},
+		{
+			name: "read credential",
+			mutate: func(workspace *corev1alpha1.WorkspaceConfig) {
+				workspace.ReadCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: "git-read"}
+			},
+			want: "credential reference",
+		},
+		{
+			name: "publication target",
+			mutate: func(workspace *corev1alpha1.WorkspaceConfig) {
+				workspace.PublicationGitRepo = "https://github.com/orka-agents/orka-fork.git"
+			},
+			want: "publication",
+		},
+		{
+			name: "unsupported repository host",
+			mutate: func(workspace *corev1alpha1.WorkspaceConfig) {
+				workspace.GitRepo = "https://codeberg.org/orka-agents/orka.git"
+			},
+			want: "host",
+		},
+		{
+			name: "unsafe ref",
+			mutate: func(workspace *corev1alpha1.WorkspaceConfig) {
+				workspace.Ref = "refs/heads/main..other"
+			},
+			want: "ref",
+		},
+		{
+			name: "escaping subpath",
+			mutate: func(workspace *corev1alpha1.WorkspaceConfig) {
+				workspace.SubPath = "../private"
+			},
+			want: "subPath",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			workspace := valid.DeepCopy()
+			test.mutate(workspace)
+			err := validateHarnessV1PublicReadOnlyWorkspace(workspace)
+			if err == nil || !strings.Contains(err.Error(), test.want) {
+				t.Fatalf("validate workspace error = %v, want %q", err, test.want)
+			}
+		})
+	}
+
+	t.Setenv(harness.WrapperAllowedGitHostsEnv, "codeberg.org")
+	configuredHost := valid.DeepCopy()
+	configuredHost.GitRepo = "https://codeberg.org/orka-agents/orka.git"
+	if err := validateHarnessV1PublicReadOnlyWorkspace(configuredHost); err != nil {
+		t.Fatalf("configured wrapper repository host rejected: %v", err)
+	}
+}
+
+func TestResolveHarnessV1PublicReadOnlyWorkspaceRequiresSupportedRuntime(t *testing.T) {
+	workspace := &corev1alpha1.WorkspaceConfig{
+		Intent: corev1alpha1.WorkspaceIntentRead, GitRepo: "https://github.com/orka-agents/orka.git",
+	}
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Workspace: workspace}}
+	agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+		Type: corev1alpha1.AgentRuntimeCodex,
+	}}}
+	target := resolvedHarnessV1Target{backend: corev1alpha1.AgentExecutionBackendHarnessWrapper}
+	resolved, err := resolveHarnessV1PublicReadOnlyWorkspace(task, agent, target)
+	if err != nil || resolved == nil || resolved == workspace {
+		t.Fatalf("resolved workspace = %#v, err=%v; want independent frozen copy", resolved, err)
+	}
+
+	claude := agent.DeepCopy()
+	claude.Spec.Runtime.Type = corev1alpha1.AgentRuntimeClaude
+	if _, err := resolveHarnessV1PublicReadOnlyWorkspace(task, claude, target); err == nil ||
+		!strings.Contains(err.Error(), "does not support runtime") {
+		t.Fatalf("unsupported runtime error = %v", err)
+	}
+	external := target
+	external.backend = corev1alpha1.AgentExecutionBackendExternalEndpoint
+	external.runtimeRef = &corev1alpha1.AgentRuntime{}
+	if _, err := resolveHarnessV1PublicReadOnlyWorkspace(task, agent, external); err == nil ||
+		!strings.Contains(err.Error(), "built-in wrapper") {
+		t.Fatalf("external runtime error = %v", err)
+	}
+}
+
+func TestApplyHarnessV1WorkspaceMetadataUsesFrozenCredentialFreeFields(t *testing.T) {
+	body := agentExecutionSnapshotBody{
+		RuntimeType: string(corev1alpha1.AgentRuntimeCodex),
+		Workspace: &corev1alpha1.WorkspaceConfig{
+			Intent:  corev1alpha1.WorkspaceIntentRead,
+			GitRepo: "https://github.com/orka-agents/orka.git", Branch: "main",
+			Ref: "0123456789abcdef0123456789abcdef01234567", SubPath: "website/docs",
+		},
+		DefaultTools: &agentExecutionSnapshotToolPolicy{
+			AllowedTools: []string{}, AllowBash: new(false),
+		},
+		HarnessV1: &agentExecutionSnapshotHarnessV1{
+			Backend: string(corev1alpha1.AgentExecutionBackendHarnessWrapper),
+		},
+	}
+	request := &harness.StartTurnRequest{Metadata: map[string]string{"existing": "value"}}
+	if err := applyHarnessV1WorkspaceMetadata(request, body); err != nil {
+		t.Fatal(err)
+	}
+	for key, want := range map[string]string{
+		"gitRepo":          body.Workspace.GitRepo,
+		"gitBranch":        body.Workspace.Branch,
+		"gitRef":           body.Workspace.Ref,
+		"workspaceSubPath": body.Workspace.SubPath,
+		"readOnly":         "true",
+		"existing":         "value",
+	} {
+		if got := request.Metadata[key]; got != want {
+			t.Fatalf("request metadata[%q] = %q, want %q", key, got, want)
+		}
+	}
+	unsafe := body
+	unsafe.DefaultTools = &agentExecutionSnapshotToolPolicy{
+		AllowedTools: []string{}, AllowBash: new(true),
+	}
+	if err := applyHarnessV1WorkspaceMetadata(&harness.StartTurnRequest{}, unsafe); err == nil ||
+		!strings.Contains(err.Error(), "Bash") {
+		t.Fatalf("unsafe frozen workspace error = %v", err)
+	}
+
+	encoded, err := canonicalAgentExecutionSnapshotBody(body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var decoded agentExecutionSnapshotBody
+	if err := json.Unmarshal(encoded, &decoded); err != nil {
+		t.Fatal(err)
+	}
+	if decoded.Workspace == nil || decoded.Workspace.GitRepo != body.Workspace.GitRepo {
+		t.Fatalf("canonical snapshot lost frozen workspace: %#v", decoded.Workspace)
+	}
+}
diff --git a/internal/controller/harness_wrapper.go b/internal/controller/harness_wrapper.go
deleted file mode 100644
index 388a1b3cd..000000000
--- a/internal/controller/harness_wrapper.go
+++ /dev/null
@@ -1,2664 +0,0 @@
-package controller
-
-import (
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"maps"
-	"net/http"
-	"os"
-	"path"
-	"slices"
-	"sort"
-	"strconv"
-	"strings"
-	"time"
-	"unicode/utf8"
-
-	corev1 "k8s.io/api/core/v1"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/api/meta"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	ctrl "sigs.k8s.io/controller-runtime"
-	ctrlclient "sigs.k8s.io/controller-runtime/pkg/client"
-	logf "sigs.k8s.io/controller-runtime/pkg/log"
-
-	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
-	"github.com/orka-agents/orka/internal/events"
-	"github.com/orka-agents/orka/internal/harness"
-	"github.com/orka-agents/orka/internal/labels"
-	"github.com/orka-agents/orka/internal/metrics"
-	"github.com/orka-agents/orka/internal/store"
-	"github.com/orka-agents/orka/internal/workerenv"
-	"github.com/orka-agents/orka/workers/common"
-)
-
-const cliwrapperLocalOutputRef = "cliwrapper-result-v1"
-
-var deprecatedHarnessRuntimeAnnotationKeys = []string{
-	"orka.ai/harness-wrapper-runtime-endpoint",
-	"orka.ai/harness-wrapper-runtime-generation",
-	"orka.ai/harness-wrapper-runtime-auth-secret-name",
-	"orka.ai/harness-wrapper-runtime-auth-secret-key",
-}
-
-func clearDeprecatedHarnessRuntimeAnnotations(annotations map[string]string) {
-	for _, key := range deprecatedHarnessRuntimeAnnotationKeys {
-		delete(annotations, key)
-	}
-}
-
-const (
-	harnessWrapperEndpointEnv                 = "ORKA_HARNESS_WRAPPER_ENDPOINT"
-	harnessWrapperAuthValueEnv                = "ORKA_HARNESS_WRAPPER_BEARER_TOKEN"
-	harnessWrapperAuthValueFileEnv            = "ORKA_HARNESS_WRAPPER_BEARER_TOKEN_FILE"
-	harnessWrapperTurnIDAnnotation            = "orka.ai/harness-wrapper-turn-id"
-	harnessWrapperRuntimeAnnotation           = "orka.ai/harness-wrapper-runtime-session-id"
-	harnessWrapperCorrelationIDAnno           = "orka.ai/harness-wrapper-correlation-id"
-	harnessWrapperLastFrameSeqAnno            = "orka.ai/harness-wrapper-last-frame-seq"
-	harnessWrapperStartedAnno                 = "orka.ai/harness-wrapper-started"
-	harnessWrapperPlannedAtAnno               = "orka.ai/harness-wrapper-planned-at"
-	harnessWrapperMetadataAnno                = "orka.ai/harness-wrapper-metadata"
-	harnessWrapperRuntimeRefAnno              = "orka.ai/harness-wrapper-runtime-ref"
-	harnessWrapperContractAnno                = "orka.ai/harness-wrapper-contract-version"
-	harnessWrapperOutputFetchRetriesAnno      = "orka.ai/harness-wrapper-output-fetch-retries"
-	harnessWrapperCancelDependencyRetriesAnno = "orka.ai/harness-wrapper-cancel-dependency-retries"
-	harnessWrapperAuthRetriesAnno             = "orka.ai/harness-wrapper-auth-retries"
-	harnessWrapperBrokeredContinuationAnno    = "orka.ai/harness-wrapper-brokered-continuation-pending"
-	harnessWrapperMaxOutputFetchRetries       = 3
-	harnessWrapperMaxCancelDependencyRetries  = 3
-	harnessWrapperMaxAuthRetries              = 3
-	harnessWrapperSkillsFilesMeta             = "skillsFiles"
-	harnessWrapperStreamPollTimeout           = 2 * time.Second
-	harnessWrapperNoTimeoutDuration           = time.Hour * 24 * 365 * 100
-	harnessWrapperRuntimeGeneric              = "generic"
-)
-
-func taskHasHarnessWrapperTurn(task *corev1alpha1.Task) bool {
-	if task == nil || task.Annotations == nil {
-		return false
-	}
-	return strings.EqualFold(strings.TrimSpace(task.Annotations[harnessWrapperStartedAnno]), scheduledRunLabelValue) &&
-		taskHasPlannedHarnessWrapperTurn(task)
-}
-
-func taskHasPlannedHarnessWrapperTurn(task *corev1alpha1.Task) bool {
-	if task == nil || task.Annotations == nil {
-		return false
-	}
-	return strings.TrimSpace(task.Annotations[harnessWrapperTurnIDAnnotation]) != "" &&
-		strings.TrimSpace(task.Annotations[harnessWrapperRuntimeAnnotation]) != "" &&
-		strings.TrimSpace(task.Annotations[harnessWrapperCorrelationIDAnno]) != ""
-}
-
-func harnessWrapperEndpoint() string {
-	return strings.TrimSpace(os.Getenv(harnessWrapperEndpointEnv))
-}
-
-func harnessWrapperAuthValue() string {
-	if tokenPath := strings.TrimSpace(os.Getenv(harnessWrapperAuthValueFileEnv)); tokenPath != "" {
-		data, err := os.ReadFile(tokenPath)
-		if err == nil {
-			return strings.TrimSpace(string(data))
-		}
-	}
-	return strings.TrimSpace(os.Getenv(harnessWrapperAuthValueEnv))
-}
-
-type harnessRuntimeTarget struct {
-	Endpoint               string
-	BearerToken            string
-	RuntimeName            string
-	RuntimeRefName         string
-	ContractVersion        string
-	Wrapper                string
-	Generation             int64
-	AuthRefName            string
-	AuthRefField           string
-	AuthRefResourceVersion string
-	ToolExecutionModes     []corev1alpha1.AgentRuntimeToolExecutionMode
-	BrokeredToolClasses    []corev1alpha1.AgentRuntimeBrokeredToolClass
-	SupportsContinuation   bool
-}
-
-type agentRuntimeDependencyNotReadyError struct {
-	message string
-}
-
-func (e agentRuntimeDependencyNotReadyError) Error() string { return e.message }
-
-func isAgentRuntimeDependencyNotReady(err error) bool {
-	var notReady agentRuntimeDependencyNotReadyError
-	return errors.As(err, &notReady)
-}
-
-func agentHarnessRuntimeName(agent *corev1alpha1.Agent) string {
-	if agent != nil && agent.Spec.Runtime != nil {
-		if agent.Spec.Runtime.RuntimeRef != nil && strings.TrimSpace(agent.Spec.Runtime.RuntimeRef.Name) != "" {
-			return strings.TrimSpace(agent.Spec.Runtime.RuntimeRef.Name)
-		}
-		if strings.TrimSpace(string(agent.Spec.Runtime.Type)) != "" {
-			return string(agent.Spec.Runtime.Type)
-		}
-	}
-	return string(corev1alpha1.AgentRuntimeClaude)
-}
-
-func agentHarnessRuntimeRefName(agent *corev1alpha1.Agent) string {
-	if agent == nil || agent.Spec.Runtime == nil || agent.Spec.Runtime.RuntimeRef == nil {
-		return ""
-	}
-	return strings.TrimSpace(agent.Spec.Runtime.RuntimeRef.Name)
-}
-
-func harnessRuntimeTargetFromStatus(task *corev1alpha1.Task) (harnessRuntimeTarget, bool) {
-	if task == nil || task.Status.HarnessRuntime == nil {
-		return harnessRuntimeTarget{}, false
-	}
-	status := task.Status.HarnessRuntime
-	if strings.TrimSpace(status.RuntimeRefName) == "" || strings.TrimSpace(status.Endpoint) == "" ||
-		strings.TrimSpace(status.AuthRefName) == "" || strings.TrimSpace(status.AuthRefField) == "" {
-		return harnessRuntimeTarget{}, false
-	}
-	contract := strings.TrimSpace(status.ContractVersion)
-	if contract == "" {
-		contract = harness.ProtocolVersion
-	}
-	runtimeName := strings.TrimSpace(status.RuntimeName)
-	if runtimeName == "" {
-		runtimeName = strings.TrimSpace(status.RuntimeRefName)
-	}
-	return harnessRuntimeTarget{
-		Endpoint:               strings.TrimSpace(status.Endpoint),
-		RuntimeName:            runtimeName,
-		RuntimeRefName:         strings.TrimSpace(status.RuntimeRefName),
-		ContractVersion:        contract,
-		Wrapper:                "external-endpoint",
-		Generation:             status.RuntimeGeneration,
-		AuthRefName:            strings.TrimSpace(status.AuthRefName),
-		AuthRefField:           strings.TrimSpace(status.AuthRefField),
-		AuthRefResourceVersion: strings.TrimSpace(status.AuthRefResourceVersion),
-	}, true
-}
-
-func harnessWrapperApplyRuntimeTargetMetadata(metadata map[string]string, target harnessRuntimeTarget) map[string]string {
-	if metadata == nil {
-		metadata = map[string]string{}
-	}
-	if strings.TrimSpace(target.RuntimeName) != "" {
-		metadata["runtime"] = strings.TrimSpace(target.RuntimeName)
-	}
-	if target.RuntimeRefName == "" {
-		return metadata
-	}
-	metadata["runtimeRef"] = target.RuntimeRefName
-	metadata["wrapper"] = target.Wrapper
-	metadata["contractVersion"] = target.ContractVersion
-	return metadata
-}
-
-func harnessRuntimeStatusFromTarget(target harnessRuntimeTarget) *corev1alpha1.HarnessRuntimeStatus {
-	if target.RuntimeRefName == "" {
-		return nil
-	}
-	return &corev1alpha1.HarnessRuntimeStatus{
-		RuntimeRefName:         target.RuntimeRefName,
-		RuntimeName:            target.RuntimeName,
-		ContractVersion:        target.ContractVersion,
-		Endpoint:               target.Endpoint,
-		RuntimeGeneration:      target.Generation,
-		AuthRefName:            target.AuthRefName,
-		AuthRefField:           target.AuthRefField,
-		AuthRefResourceVersion: target.AuthRefResourceVersion,
-	}
-}
-
-func (r *TaskReconciler) patchHarnessRuntimeStatus(ctx context.Context, task *corev1alpha1.Task, target harnessRuntimeTarget) error {
-	status := harnessRuntimeStatusFromTarget(target)
-	if status == nil {
-		return nil
-	}
-	return r.updateStatusWithRetry(ctx, task, func(t *corev1alpha1.Task) {
-		t.Status.HarnessRuntime = status
-	})
-}
-
-func (r *TaskReconciler) resolveHarnessRuntimeTarget(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	agent *corev1alpha1.Agent,
-) (harnessRuntimeTarget, error) {
-	if taskHasPlannedHarnessWrapperTurn(task) {
-		if frozen, ok := harnessRuntimeTargetFromStatus(task); ok {
-			token, authRefResourceVersion, err := r.resolveAgentRuntimeBearerTokenFromRef(ctx, task.Namespace, frozen.RuntimeRefName, frozen.Endpoint, frozen.AuthRefName, frozen.AuthRefField)
-			if err != nil {
-				return harnessRuntimeTarget{}, agentRuntimeDependencyNotReadyError{message: fmt.Sprintf("AgentRuntime %q is not ready: %v", frozen.RuntimeRefName, err)}
-			}
-			if strings.TrimSpace(frozen.AuthRefResourceVersion) != authRefResourceVersion {
-				if err := r.validateFrozenRuntimeAuthObserved(ctx, task, frozen.RuntimeRefName, authRefResourceVersion); err != nil {
-					return harnessRuntimeTarget{}, err
-				}
-			}
-			frozen.BearerToken = token
-			frozen.AuthRefResourceVersion = authRefResourceVersion
-			return frozen, nil
-		}
-	}
-	runtimeRefName := agentHarnessRuntimeRefName(agent)
-	if runtimeRefName == "" {
-		endpoint := harnessWrapperEndpoint()
-		if endpoint == "" {
-			return harnessRuntimeTarget{}, fmt.Errorf("%s is required when agent harness runtime is enabled", harnessWrapperEndpointEnv)
-		}
-		return harnessRuntimeTarget{
-			Endpoint:        endpoint,
-			BearerToken:     (harnessWrapperAuthValue()),
-			RuntimeName:     agentHarnessRuntimeName(agent),
-			ContractVersion: harness.ProtocolVersion,
-			Wrapper:         "cli",
-		}, nil
-	}
-	return r.resolveReadyAgentRuntimeTarget(ctx, task, runtimeRefName)
-}
-
-func (r *TaskReconciler) validateFrozenRuntimeAuthObserved(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	runtimeRefName string,
-	authRefResourceVersion string,
-) error {
-	if task == nil {
-		return fmt.Errorf("task is required to validate runtimeRef %q", runtimeRefName)
-	}
-	runtime := &corev1alpha1.AgentRuntime{}
-	if err := r.Get(ctx, ctrlclient.ObjectKey{Namespace: task.Namespace, Name: runtimeRefName}, runtime); err != nil {
-		if apierrors.IsNotFound(err) {
-			return fmt.Errorf("AgentRuntime %q not found in namespace %q", runtimeRefName, task.Namespace)
-		}
-		return fmt.Errorf("read AgentRuntime %q: %w", runtimeRefName, err)
-	}
-	if runtime.Status.ObservedGeneration != runtime.Generation {
-		return agentRuntimeDependencyNotReadyError{message: fmt.Sprintf("AgentRuntime %q is not ready: observedGeneration %d is stale for generation %d", runtimeRefName, runtime.Status.ObservedGeneration, runtime.Generation)}
-	}
-	if !runtime.Status.Ready {
-		message := strings.TrimSpace(runtime.Status.Message)
-		if message == "" {
-			message = "runtime is not Ready"
-		}
-		return agentRuntimeDependencyNotReadyError{message: fmt.Sprintf("AgentRuntime %q is not ready: %s", runtimeRefName, message)}
-	}
-	if strings.TrimSpace(runtime.Status.ObservedAuthRefResourceVersion) != authRefResourceVersion {
-		return agentRuntimeDependencyNotReadyError{message: fmt.Sprintf("AgentRuntime %q is not ready: bearer token Secret version changed since runtime readiness", runtimeRefName)}
-	}
-	return nil
-}
-
-func (r *TaskReconciler) resolveReadyAgentRuntimeTarget(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	runtimeRefName string,
-) (harnessRuntimeTarget, error) {
-	if task == nil {
-		return harnessRuntimeTarget{}, fmt.Errorf("task is required to resolve runtimeRef %q", runtimeRefName)
-	}
-	runtime := &corev1alpha1.AgentRuntime{}
-	if err := r.Get(ctx, ctrlclient.ObjectKey{Namespace: task.Namespace, Name: runtimeRefName}, runtime); err != nil {
-		if apierrors.IsNotFound(err) {
-			return harnessRuntimeTarget{}, fmt.Errorf("AgentRuntime %q not found in namespace %q", runtimeRefName, task.Namespace)
-		}
-		return harnessRuntimeTarget{}, fmt.Errorf("read AgentRuntime %q: %w", runtimeRefName, err)
-	}
-	if runtime.Status.ObservedGeneration != runtime.Generation {
-		return harnessRuntimeTarget{}, agentRuntimeDependencyNotReadyError{message: fmt.Sprintf("AgentRuntime %q is not ready: observedGeneration %d is stale for generation %d", runtimeRefName, runtime.Status.ObservedGeneration, runtime.Generation)}
-	}
-	if !runtime.Status.Ready {
-		message := strings.TrimSpace(runtime.Status.Message)
-		if message == "" {
-			message = "runtime is not Ready"
-		}
-		return harnessRuntimeTarget{}, agentRuntimeDependencyNotReadyError{message: fmt.Sprintf("AgentRuntime %q is not ready: %s", runtimeRefName, message)}
-	}
-	if runtime.Spec.ContractVersion != corev1alpha1.AgentRuntimeContractHarnessV1 {
-		return harnessRuntimeTarget{}, fmt.Errorf("AgentRuntime %q has unsupported contractVersion %q", runtimeRefName, runtime.Spec.ContractVersion)
-	}
-	if runtime.Spec.Deployment.Mode != corev1alpha1.AgentRuntimeDeploymentModeExternalEndpoint {
-		return harnessRuntimeTarget{}, fmt.Errorf("AgentRuntime %q has unsupported deployment.mode %q", runtimeRefName, runtime.Spec.Deployment.Mode)
-	}
-	token, authRefResourceVersion, err := r.resolveAgentRuntimeBearerToken(ctx, runtime)
-	if err != nil {
-		return harnessRuntimeTarget{}, agentRuntimeDependencyNotReadyError{message: fmt.Sprintf("AgentRuntime %q is not ready: %v", runtimeRefName, err)}
-	}
-	if strings.TrimSpace(runtime.Status.ObservedAuthRefResourceVersion) != authRefResourceVersion {
-		return harnessRuntimeTarget{}, agentRuntimeDependencyNotReadyError{message: fmt.Sprintf("AgentRuntime %q is not ready: bearer token Secret version changed since runtime readiness", runtimeRefName)}
-	}
-	ref := runtime.Spec.ClientAuth.BearerAuthRef
-	runtimeName := runtimeRefName
-	if runtime.Status.ObservedCapabilities != nil && strings.TrimSpace(runtime.Status.ObservedCapabilities.RuntimeName) != "" {
-		runtimeName = strings.TrimSpace(runtime.Status.ObservedCapabilities.RuntimeName)
-	}
-	return harnessRuntimeTarget{
-		Endpoint:               strings.TrimSpace(runtime.Spec.Deployment.Endpoint),
-		BearerToken:            token,
-		RuntimeName:            runtimeName,
-		RuntimeRefName:         runtimeRefName,
-		ContractVersion:        string(runtime.Spec.ContractVersion),
-		Wrapper:                "external-endpoint",
-		Generation:             runtime.Generation,
-		AuthRefName:            strings.TrimSpace(ref.Name),
-		AuthRefField:           strings.TrimSpace(ref.Key),
-		AuthRefResourceVersion: authRefResourceVersion,
-		ToolExecutionModes: func() []corev1alpha1.AgentRuntimeToolExecutionMode {
-			if runtime.Status.ObservedCapabilities == nil {
-				return nil
-			}
-			return append([]corev1alpha1.AgentRuntimeToolExecutionMode(nil), runtime.Status.ObservedCapabilities.ToolExecutionModes...)
-		}(),
-		BrokeredToolClasses: func() []corev1alpha1.AgentRuntimeBrokeredToolClass {
-			if runtime.Status.ObservedCapabilities == nil {
-				return nil
-			}
-			return append([]corev1alpha1.AgentRuntimeBrokeredToolClass(nil), runtime.Status.ObservedCapabilities.BrokeredToolClasses...)
-		}(),
-		SupportsContinuation: runtime.Status.ObservedCapabilities != nil && runtime.Status.ObservedCapabilities.SupportsContinuation,
-	}, nil
-}
-
-func (r *TaskReconciler) resolveAgentRuntimeBearerToken(ctx context.Context, runtime *corev1alpha1.AgentRuntime) (string, string, error) {
-	if runtime == nil {
-		return "", "", fmt.Errorf("AgentRuntime is required")
-	}
-	ref := runtime.Spec.ClientAuth.BearerAuthRef
-	return r.resolveAgentRuntimeBearerTokenFromRef(ctx, runtime.Namespace, runtime.Name, runtime.Spec.Deployment.Endpoint, ref.Name, ref.Key)
-}
-
-func (r *TaskReconciler) resolveAgentRuntimeBearerTokenFromRef(
-	ctx context.Context,
-	namespace string,
-	runtimeName string,
-	endpoint string,
-	refName string,
-	refField string,
-) (string, string, error) {
-	refName = strings.TrimSpace(refName)
-	refField = strings.TrimSpace(refField)
-	secret := &corev1.Secret{}
-	if err := r.Get(ctx, ctrlclient.ObjectKey{Namespace: namespace, Name: refName}, secret); err != nil {
-		if apierrors.IsNotFound(err) {
-			return "", "", fmt.Errorf("AgentRuntime %q bearer token Secret %q not found", runtimeName, refName)
-		}
-		return "", "", fmt.Errorf("read AgentRuntime %q bearer token Secret %q: %w", runtimeName, refName, err)
-	}
-	if err := validateAgentRuntimeBearerSecretUse(runtimeName, endpoint, secret); err != nil {
-		return "", "", err
-	}
-	value := strings.TrimSpace(string(secret.Data[refField]))
-	if value == "" {
-		return "", "", fmt.Errorf("AgentRuntime %q bearer token Secret %q key %q is empty or missing", runtimeName, refName, refField)
-	}
-	return value, strings.TrimSpace(secret.ResourceVersion), nil
-}
-
-//nolint:gocyclo // Coordinates idempotent turn planning, wrapper start, and Running transition.
-func (r *TaskReconciler) runHarnessWrapperTask(ctx context.Context, task *corev1alpha1.Task, agent *corev1alpha1.Agent) (ctrl.Result, error) {
-	// Agent execution planning owns path compatibility and rejection decisions.
-	// This method starts or resumes an already-approved harness-wrapper turn.
-	now := metav1.Now()
-	attempts := task.Status.Attempts + 1
-	if taskHasPlannedHarnessWrapperTurn(task) && !harnessWrapperPlannedTurnMatchesTask(task, agent, attempts) {
-		if err := r.clearHarnessWrapperTurnState(ctx, task); err != nil {
-			return ctrl.Result{}, err
-		}
-		return ctrl.Result{RequeueAfter: 100 * time.Millisecond}, nil
-	}
-
-	if r.ExecutionEventStore == nil {
-		return r.failTask(ctx, task, "execution event store is required for harness wrapper mode")
-	}
-	var request harness.StartTurnRequest
-	var target harnessRuntimeTarget
-	var err error
-	startedPlannedTurn := false
-	if taskHasPlannedHarnessWrapperTurn(task) {
-		if taskHasHarnessWrapperTurn(task) {
-			startedPlannedTurn = true
-		}
-		request, err = r.plannedHarnessWrapperStartTurnRequest(ctx, task, agent, now.Time)
-		if err != nil {
-			return r.failTask(ctx, task, err.Error())
-		}
-		targetAgent := agent
-		if strings.TrimSpace(request.Metadata["runtimeRef"]) == "" {
-			plannedRuntime := corev1alpha1.AgentRuntimeType(strings.TrimSpace(request.Metadata["runtime"]))
-			if plannedRuntime == "" {
-				plannedRuntime = corev1alpha1.AgentRuntimeClaude
-			}
-			targetAgent = &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{Type: plannedRuntime}}}
-		}
-		target, err = r.resolveHarnessRuntimeTarget(ctx, task, targetAgent)
-		if err != nil {
-			if isAgentRuntimeDependencyNotReady(err) {
-				return ctrl.Result{RequeueAfter: time.Second}, nil
-			}
-			return r.failTask(ctx, task, events.RedactExecutionEventText(err.Error()))
-		}
-	} else {
-		request, err = r.harnessWrapperStartTurnRequest(ctx, task, agent, now.Time, attempts)
-		if err != nil {
-			return r.failTask(ctx, task, err.Error())
-		}
-		target, err = r.resolveHarnessRuntimeTarget(ctx, task, agent)
-		if err != nil {
-			if isAgentRuntimeDependencyNotReady(err) {
-				return ctrl.Result{RequeueAfter: time.Second}, nil
-			}
-			return r.failTask(ctx, task, events.RedactExecutionEventText(err.Error()))
-		}
-		request.Metadata = harnessWrapperApplyRuntimeTargetMetadata(request.Metadata, target)
-		if err := applyHarnessRuntimeToolExecutionMode(&request, target); err != nil {
-			return r.failTask(ctx, task, events.RedactExecutionEventText(err.Error()))
-		}
-		if err := r.patchHarnessWrapperPlannedTurn(ctx, task, request); err != nil {
-			return ctrl.Result{}, err
-		}
-		if err := r.patchHarnessRuntimeStatus(ctx, task, target); err != nil {
-			return ctrl.Result{}, err
-		}
-		// Persist the deterministic turn identity in a separate reconcile before
-		// accepting the turn. The Running path requires the planned identity
-		// annotations/status to be durable; keeping planning and start in one
-		// reconcile can leave a flaky observed state where started=true is visible
-		// but the identity annotations are not, causing handleRunning to fail the
-		// task as missing its harness runtime turn identity.
-		return ctrl.Result{RequeueAfter: 100 * time.Millisecond}, nil
-	}
-	turnAccepted := startedPlannedTurn
-	if !startedPlannedTurn {
-		latest := &corev1alpha1.Task{}
-		if err := r.Get(ctx, ctrlclient.ObjectKey{Name: task.Name, Namespace: task.Namespace}, latest); err != nil {
-			return ctrl.Result{}, err
-		}
-		if latest.Status.Phase != corev1alpha1.TaskPhasePending {
-			task.Status = latest.Status
-			return ctrl.Result{}, nil
-		}
-		if strings.TrimSpace(target.Endpoint) == "" {
-			target, err = r.resolveHarnessRuntimeTarget(ctx, task, agent)
-			if err != nil {
-				if isAgentRuntimeDependencyNotReady(err) {
-					return ctrl.Result{RequeueAfter: time.Second}, nil
-				}
-				return r.failTask(ctx, task, events.RedactExecutionEventText(err.Error()))
-			}
-			request.Metadata = harnessWrapperApplyRuntimeTargetMetadata(request.Metadata, target)
-		}
-		client, err := harness.NewClient(target.Endpoint, harness.WithBearerToken(target.BearerToken))
-		if err != nil {
-			return r.failTask(ctx, task, fmt.Sprintf("invalid harness runtime endpoint: %v", err))
-		}
-		// Cross-restart idempotency backstop: if this deterministic turn ID already
-		// produced persisted frames, the turn was already accepted and ran. Do NOT
-		// re-issue StartTurn (which would duplicate external side effects after a
-		// wrapper pod restart wiped its in-memory turn map); recover by treating the
-		// turn as accepted and proceeding to the Running transition. Check persisted
-		// frames before live capabilities so accepted turns remain recoverable if the
-		// runtime rolls after emitting frames but before started=true is persisted.
-		journal := r.harnessWrapperTurnJournal(ctx, task)
-		hasFrames, framesErr := journal.HasPersistedFrames(ctx, request.TurnID)
-		if framesErr != nil {
-			return ctrl.Result{RequeueAfter: time.Second}, nil
-		}
-		if !hasFrames {
-			if r.ResultStore != nil {
-				if err := r.ResultStore.DeleteResult(ctx, task.Namespace, task.Name); err != nil {
-					return ctrl.Result{RequeueAfter: time.Second}, nil
-				}
-			}
-			if err := r.validateHarnessWrapperCapabilities(ctx, client, request); err != nil {
-				if target.RuntimeRefName != "" && harnessWrapperAuthError(err) {
-					if shouldWait, waitErr := r.waitForHarnessWrapperAuthRetry(ctx, task); waitErr != nil {
-						return ctrl.Result{}, waitErr
-					} else if shouldWait {
-						return ctrl.Result{RequeueAfter: time.Second}, nil
-					}
-				}
-				if harnessWrapperCapabilitiesErrorIsRetryable(err) {
-					return ctrl.Result{RequeueAfter: time.Second}, nil
-				}
-				return r.failTask(ctx, task, err.Error())
-			}
-			if _, err := client.StartTurn(ctx, request); err != nil {
-				message := err.Error()
-				switch {
-				case harnessWrapperDuplicateTurnError(err):
-					// Treat an already-started or already-completed turn ID as idempotent
-					// recovery after the wrapper accepted the planned turn before Running
-					// status was persisted.
-				case harnessWrapperCapacityError(err):
-					if clearErr := r.clearHarnessWrapperTurnState(ctx, task); clearErr != nil {
-						return ctrl.Result{}, clearErr
-					}
-					return ctrl.Result{RequeueAfter: time.Second}, nil
-				case target.RuntimeRefName != "" && harnessWrapperAuthError(err):
-					if wait, waitErr := r.waitForHarnessWrapperAuthRetry(ctx, task); waitErr != nil {
-						return ctrl.Result{}, waitErr
-					} else if wait {
-						return ctrl.Result{RequeueAfter: time.Second}, nil
-					}
-					return r.failTask(ctx, task, events.RedactExecutionEventText(message))
-				case harnessWrapperStartTurnErrorIsRetryable(err):
-					return ctrl.Result{RequeueAfter: time.Second}, nil
-				default:
-					return r.failTask(ctx, task, events.RedactExecutionEventText(message))
-				}
-			}
-		}
-		turnAccepted = true
-		if err := r.patchHarnessWrapperStarted(ctx, task); err != nil {
-			return ctrl.Result{}, err
-		}
-	}
-
-	if strings.TrimSpace(target.Endpoint) == "" {
-		target, err = r.resolveHarnessRuntimeTarget(ctx, task, agent)
-		if err != nil {
-			if isAgentRuntimeDependencyNotReady(err) {
-				return ctrl.Result{RequeueAfter: time.Second}, nil
-			}
-			return r.failTask(ctx, task, events.RedactExecutionEventText(err.Error()))
-		}
-	}
-
-	transitionedToRunning := false
-	if err := r.updateStatusWithRetry(ctx, task, func(t *corev1alpha1.Task) {
-		if t.Status.Phase != corev1alpha1.TaskPhasePending && t.Status.Phase != corev1alpha1.TaskPhaseRunning {
-			return
-		}
-		t.Status.Phase = corev1alpha1.TaskPhaseRunning
-		t.Status.StartTime = &now
-		t.Status.Attempts = attempts
-		t.Status.JobName = ""
-		t.Status.HarnessRuntime = harnessRuntimeStatusFromTarget(target)
-		t.Status.Message = "harness wrapper turn running"
-		transitionedToRunning = true
-	}); err != nil {
-		return ctrl.Result{}, err
-	}
-	if !transitionedToRunning {
-		if turnAccepted {
-			if cancelErr := r.cancelHarnessWrapperTurn(ctx, task, "task left pending before running transition"); cancelErr != nil {
-				return ctrl.Result{}, cancelErr
-			}
-		}
-		return ctrl.Result{}, nil
-	}
-	// TaskStarted is best-effort, mirroring the general-worker Job path
-	// (task_controller.go). The status has already transitioned to Running above;
-	// returning an error here would route the next reconcile to
-	// finishHarnessWrapperTask (which does not append TaskStarted), permanently
-	// dropping the start event on a transient store failure. Log and continue.
-	if err := r.recordTaskLifecycleEvent(
-		ctx,
-		task,
-		events.ExecutionEventTypeTaskStarted,
-		events.ExecutionEventSeverityInfo,
-		"harness wrapper task started",
-	); err != nil {
-		logf.FromContext(ctx).Info("best-effort harness TaskStarted event append failed", "error", err, "task", task.Name)
-	}
-	return ctrl.Result{RequeueAfter: 100 * time.Millisecond}, nil
-}
-
-func (r *TaskReconciler) harnessWrapperTurnJournal(ctx context.Context, task *corev1alpha1.Task) harness.TurnJournal {
-	journal := harness.TurnJournal{EventStore: r.ExecutionEventStore}
-	if task == nil {
-		return journal
-	}
-	journal.MapContext = harness.EventMapContext{
-		Namespace: task.Namespace,
-		TaskName:  task.Name,
-		// Use the real-session-only helper here (not harnessWrapperSessionName,
-		// which falls back to task.Name): this SessionName is PERSISTED as the
-		// execution event's session key, so a task-name fallback would collide a
-		// SessionRef-less task's events into any real Session of the same name.
-		// The StartTurn/CancelTurn request sites intentionally keep
-		// harnessWrapperSessionName because the protocol requires a non-empty
-		// identifier there (it is not a stored timeline key).
-		SessionName: r.executionEventSessionName(ctx, task),
-		AgentName:   harnessWrapperTaskAgentName(task),
-	}
-	return journal
-}
-
-//nolint:gocyclo // Handles stream polling, event mapping, and terminal task classification in one reconcile step.
-func (r *TaskReconciler) finishHarnessWrapperTask(ctx context.Context, task *corev1alpha1.Task) (ctrl.Result, error) {
-	log := logf.FromContext(ctx)
-	target, targetErr := r.resolveHarnessRuntimeTarget(ctx, task, nil)
-	if targetErr != nil {
-		if isAgentRuntimeDependencyNotReady(targetErr) {
-			return ctrl.Result{RequeueAfter: time.Second}, nil
-		}
-		return r.completeTask(ctx, task, corev1alpha1.TaskPhaseFailed, events.RedactExecutionEventText(targetErr.Error()))
-	}
-	if r.ExecutionEventStore == nil {
-		return r.completeTask(ctx, task, corev1alpha1.TaskPhaseFailed, "execution event store is required for harness wrapper mode")
-	}
-	agent, agentErr := r.resolveAgent(ctx, task)
-	if agentErr != nil && harnessWrapperPlannedToolExecutionMode(task) == harness.ToolExecutionModeBrokered {
-		return r.completeTask(ctx, task, corev1alpha1.TaskPhaseFailed, events.RedactExecutionEventText(agentErr.Error()))
-	}
-	turnID := harness.HarnessTurnID(strings.TrimSpace(task.Annotations[harnessWrapperTurnIDAnnotation]))
-	runtimeSessionID := harness.RuntimeSessionID(strings.TrimSpace(task.Annotations[harnessWrapperRuntimeAnnotation]))
-	correlationID := strings.TrimSpace(task.Annotations[harnessWrapperCorrelationIDAnno])
-	if turnID == "" || runtimeSessionID == "" || correlationID == "" {
-		return r.completeTask(ctx, task, corev1alpha1.TaskPhaseFailed, "harness wrapper turn identity is missing")
-	}
-	if !harnessWrapperTurnAnnotationsMatchTaskAttempt(task, harnessWrapperCurrentAttempt(task)) {
-		return r.completeTask(ctx, task, corev1alpha1.TaskPhaseFailed, "harness wrapper turn identity does not match task")
-	}
-	client, err := harness.NewClient(target.Endpoint, harness.WithBearerToken(target.BearerToken))
-	if err != nil {
-		return r.completeTask(ctx, task, corev1alpha1.TaskPhaseFailed, fmt.Sprintf("invalid harness runtime endpoint: %v", err))
-	}
-	result := harness.TurnRunResult{}
-	journal := r.harnessWrapperTurnJournal(ctx, task)
-	afterSeq := harnessWrapperLastFrameSeq(task)
-	lastFrameSeq := afterSeq
-	journalState, err := journal.Open(ctx)
-	if err != nil {
-		return ctrl.Result{}, err
-	}
-	streamCtx, cancel := context.WithTimeout(ctx, harnessWrapperStreamPollTimeout)
-	defer cancel()
-	err = client.StreamFrames(streamCtx, turnID, afterSeq, func(frame harness.HarnessEventFrame) error {
-		if frame.RuntimeSessionID != runtimeSessionID || frame.TurnID != turnID || frame.CorrelationID != correlationID {
-			return fmt.Errorf("harness frame identity does not match running turn")
-		}
-		result.Frames = append(result.Frames, frame)
-		appended, appendedNew, err := journalState.AppendFrameIfNew(streamCtx, frame)
-		if err != nil {
-			return err
-		}
-		if appendedNew {
-			result.Events = append(result.Events, *appended)
-		}
-		if frame.Type == harness.FrameToolCallRequested && harnessWrapperPlannedToolExecutionMode(task) == harness.ToolExecutionModeBrokered {
-			if err := r.continueHarnessBrokeredToolCall(ctx, client, task, agent, frame); err != nil {
-				if approvalID, toolName, ok := harnessBrokeredPendingApproval(err); ok || errors.Is(err, errHarnessBrokeredApprovalPending) {
-					if statusErr := r.markHarnessBrokeredApprovalWaiting(ctx, task, approvalID, toolName); statusErr != nil {
-						return statusErr
-					}
-				}
-				return err
-			}
-		}
-		if frame.Seq > lastFrameSeq {
-			lastFrameSeq = frame.Seq
-		}
-		switch frame.Type {
-		case harness.FrameTurnCompleted:
-			result.Completed = frame.Completed
-		case harness.FrameTurnFailed:
-			result.Failed = frame.Failed
-		case harness.FrameTurnCancelled:
-			result.Cancelled = true
-		}
-		return nil
-	})
-	terminalFrameSeen := result.Completed != nil || result.Failed != nil || result.Cancelled
-	// Deliberately checkpoint only non-terminal cursors. If persisting the terminal
-	// task status fails, the next reconciliation must replay the terminal frame; the
-	// turn journal deduplicates its execution event. This also ensures a stale
-	// continuation-pending marker cannot hide an already-observed terminal frame.
-	if lastFrameSeq > afterSeq && !terminalFrameSeen && !harnessWrapperStreamErrorIsBrokeredPause(err) {
-		if patchErr := r.patchHarnessWrapperLastFrameSeq(ctx, task, lastFrameSeq); patchErr != nil {
-			return ctrl.Result{}, patchErr
-		}
-	}
-	if err == nil && !terminalFrameSeen && harnessWrapperBrokeredContinuationPending(task) {
-		// Some remote runtimes intentionally close the paused event stream before
-		// Orka's continuation request arrives. Reconnect from the persisted frame
-		// cursor instead of treating that clean EOF as a terminal turn with no
-		// result; the continuation may still be executing asynchronously.
-		return ctrl.Result{RequeueAfter: time.Second}, nil
-	}
-	if err != nil && result.Completed == nil && result.Failed == nil && !result.Cancelled {
-		if target.RuntimeRefName != "" && harnessWrapperAuthError(err) {
-			if wait, waitErr := r.waitForHarnessWrapperAuthRetry(ctx, task); waitErr != nil {
-				return ctrl.Result{}, waitErr
-			} else if wait {
-				return ctrl.Result{RequeueAfter: time.Second}, nil
-			}
-		}
-		if harnessWrapperStreamErrorIsMissingTurn(err) && r.shouldRetry(task) {
-			if clearErr := r.clearHarnessWrapperTurnState(ctx, task); clearErr != nil {
-				return ctrl.Result{}, clearErr
-			}
-			return r.retryTask(ctx, task)
-		}
-		if harnessWrapperStreamErrorIsTerminal(err) {
-			return r.completeTask(ctx, task, corev1alpha1.TaskPhaseFailed, events.RedactExecutionEventText(err.Error()))
-		}
-		return ctrl.Result{RequeueAfter: time.Second}, nil
-	}
-	if result.Completed != nil && r.ResultStore != nil {
-		resultBytes := harnessWrapperCompletedResultBytes(result.Completed)
-		if outputRef := strings.TrimSpace(result.Completed.OutputRef); outputRef == cliwrapperLocalOutputRef {
-			fetched, fetchErr := client.FetchTurnOutput(ctx, turnID, outputRef)
-			if fetchErr != nil {
-				log.Error(fetchErr, "failed to fetch harness wrapper result")
-				retries := harnessWrapperOutputFetchRetries(task)
-				if retries >= harnessWrapperMaxOutputFetchRetries {
-					return r.completeAfterSuccessfulExecutionError(
-						ctx, task, fmt.Sprintf("failed to fetch harness wrapper result: %v", fetchErr),
-					)
-				}
-				if patchErr := r.patchHarnessWrapperOutputFetchRetries(ctx, task, retries+1); patchErr != nil {
-					return ctrl.Result{}, patchErr
-				}
-				return ctrl.Result{RequeueAfter: time.Second}, nil
-			}
-			resultBytes = fetched
-		}
-		if saveErr := r.ResultStore.SaveResult(ctx, task.Namespace, task.Name, resultBytes); saveErr != nil {
-			log.Error(saveErr, "failed to save harness wrapper result")
-			return r.completeAfterSuccessfulExecutionError(
-				ctx, task, fmt.Sprintf("failed to save harness wrapper result: %v", saveErr),
-			)
-		}
-		task.Status.ResultRef = &corev1alpha1.ResultReference{Available: true}
-	}
-	if result.Failed != nil && r.ResultStore != nil && (!result.Failed.Retryable || !r.shouldRetry(task)) {
-		resultBytes := harnessWrapperFailedResultBytes(result.Failed)
-		if outputRef := strings.TrimSpace(result.Failed.OutputRef); outputRef == cliwrapperLocalOutputRef {
-			fetched, fetchErr := client.FetchTurnOutput(ctx, turnID, outputRef)
-			if fetchErr != nil {
-				log.Error(fetchErr, "failed to fetch failed harness wrapper result")
-			} else {
-				resultBytes = fetched
-			}
-		}
-		if len(resultBytes) > 0 {
-			if saveErr := r.ResultStore.SaveResult(ctx, task.Namespace, task.Name, resultBytes); saveErr != nil {
-				log.Error(saveErr, "failed to save failed harness wrapper result")
-			} else {
-				task.Status.ResultRef = &corev1alpha1.ResultReference{Available: true}
-			}
-		}
-	}
-	if result.Cancelled {
-		return r.completeExecutedTask(ctx, task, corev1alpha1.TaskPhaseCancelled, "harness wrapper turn cancelled")
-	}
-	if result.Failed != nil {
-		if result.Failed.Retryable && r.shouldRetry(task) {
-			if clearErr := r.clearHarnessWrapperTurnState(ctx, task); clearErr != nil {
-				return ctrl.Result{}, clearErr
-			}
-			return r.retryTask(ctx, task)
-		}
-		message := strings.TrimSpace(result.Failed.Message)
-		if message == "" {
-			message = strings.TrimSpace(result.Failed.Reason)
-		}
-		if message == "" && err != nil {
-			message = err.Error()
-		}
-		if message == "" {
-			message = "harness wrapper turn failed"
-		}
-		return r.completeExecutedTask(ctx, task, corev1alpha1.TaskPhaseFailed, events.RedactExecutionEventText(message))
-	}
-	if result.Completed == nil {
-		return r.completeExecutedTask(ctx, task, corev1alpha1.TaskPhaseFailed, "harness wrapper turn ended without result")
-	}
-	return r.completeExecutedTask(ctx, task, corev1alpha1.TaskPhaseSucceeded, "harness wrapper task completed successfully")
-}
-
-func (r *TaskReconciler) markHarnessBrokeredApprovalWaiting(ctx context.Context, task *corev1alpha1.Task, approvalID, toolName string) error {
-	if r == nil || task == nil {
-		return nil
-	}
-	toolName = strings.TrimSpace(toolName)
-	if toolName == "" {
-		toolName = "brokered tool"
-	}
-	approvalID = strings.TrimSpace(approvalID)
-	if approvalID == "" {
-		approvalID = "pending"
-	}
-	message := fmt.Sprintf("waiting for brokered approval %s for %s", approvalID, toolName)
-	now := metav1.Now()
-	return r.updateStatusWithRetry(ctx, task, func(t *corev1alpha1.Task) {
-		if t.Status.Phase != corev1alpha1.TaskPhaseRunning {
-			return
-		}
-		t.Status.Message = message
-		meta.SetStatusCondition(&t.Status.Conditions, metav1.Condition{
-			Type:               ConditionTypeWaitingForApproval,
-			Status:             metav1.ConditionTrue,
-			LastTransitionTime: now,
-			Reason:             "BrokeredToolApprovalPending",
-			Message:            message,
-		})
-	})
-}
-
-func (r *TaskReconciler) clearHarnessBrokeredApprovalWaiting(ctx context.Context, task *corev1alpha1.Task, toolName string) error {
-	if r == nil || task == nil {
-		return nil
-	}
-	toolName = strings.TrimSpace(toolName)
-	if toolName == "" {
-		toolName = "brokered tool"
-	}
-	now := metav1.Now()
-	return r.updateStatusWithRetry(ctx, task, func(t *corev1alpha1.Task) {
-		if t.Status.Phase != corev1alpha1.TaskPhaseRunning {
-			return
-		}
-		cond := meta.FindStatusCondition(t.Status.Conditions, ConditionTypeWaitingForApproval)
-		if cond == nil || cond.Status != metav1.ConditionTrue {
-			return
-		}
-		if strings.HasPrefix(t.Status.Message, "waiting for brokered approval ") {
-			t.Status.Message = "harness wrapper turn running"
-		}
-		meta.SetStatusCondition(&t.Status.Conditions, metav1.Condition{
-			Type:               ConditionTypeWaitingForApproval,
-			Status:             metav1.ConditionFalse,
-			LastTransitionTime: now,
-			Reason:             "BrokeredToolContinued",
-			Message:            fmt.Sprintf("brokered tool %s continued", toolName),
-		})
-	})
-}
-
-func harnessWrapperCompletedResultBytes(completed *harness.TurnCompleted) []byte {
-	if completed == nil {
-		return nil
-	}
-	if len(completed.Data) == 0 && len(completed.Artifacts) == 0 {
-		return []byte(completed.Result)
-	}
-	encoded, err := common.FormatStructuredResult(&common.StructuredResult{
-		Version:   1,
-		Summary:   completed.Result,
-		Data:      completed.Data,
-		Artifacts: harnessArtifactRefsToStructured(completed.Artifacts),
-	})
-	if err != nil {
-		return []byte(completed.Result)
-	}
-	return encoded
-}
-
-func harnessWrapperFailedResultBytes(failed *harness.TurnFailed) []byte {
-	if failed == nil {
-		return nil
-	}
-	if len(failed.Data) == 0 && len(failed.Artifacts) == 0 {
-		return []byte(failed.Result)
-	}
-	summary := strings.TrimSpace(failed.Result)
-	if summary == "" {
-		summary = strings.TrimSpace(failed.Message)
-	}
-	encoded, err := common.FormatStructuredResult(&common.StructuredResult{
-		Version:   1,
-		Summary:   summary,
-		Data:      failed.Data,
-		Artifacts: harnessArtifactRefsToStructured(failed.Artifacts),
-	})
-	if err != nil {
-		return []byte(failed.Result)
-	}
-	return encoded
-}
-
-func harnessArtifactRefsToStructured(refs []harness.ArtifactRef) []common.ArtifactRef {
-	if len(refs) == 0 {
-		return nil
-	}
-	out := make([]common.ArtifactRef, 0, len(refs))
-	for _, ref := range refs {
-		filename := strings.TrimSpace(ref.Filename)
-		if filename == "" {
-			continue
-		}
-		out = append(out, common.ArtifactRef{
-			Filename:    filename,
-			ContentType: strings.TrimSpace(ref.ContentType),
-			Size:        ref.Size,
-			Description: strings.TrimSpace(ref.Description),
-		})
-	}
-	return out
-}
-
-func harnessWrapperAuthRetries(task *corev1alpha1.Task) int {
-	if task == nil || task.Annotations == nil {
-		return 0
-	}
-	retries, err := strconv.Atoi(strings.TrimSpace(task.Annotations[harnessWrapperAuthRetriesAnno]))
-	if err != nil || retries < 0 {
-		return 0
-	}
-	return retries
-}
-
-func (r *TaskReconciler) waitForHarnessWrapperAuthRetry(ctx context.Context, task *corev1alpha1.Task) (bool, error) {
-	retries := harnessWrapperAuthRetries(task)
-	if retries >= harnessWrapperMaxAuthRetries {
-		return false, nil
-	}
-	patch := ctrlclient.MergeFrom(task.DeepCopy())
-	if task.Annotations == nil {
-		task.Annotations = map[string]string{}
-	}
-	task.Annotations[harnessWrapperAuthRetriesAnno] = strconv.Itoa(retries + 1)
-	if err := r.Patch(ctx, task, patch); err != nil {
-		return false, err
-	}
-	return true, nil
-}
-
-func harnessWrapperCancelDependencyRetries(task *corev1alpha1.Task) int {
-	if task == nil || task.Annotations == nil {
-		return 0
-	}
-	retries, err := strconv.Atoi(strings.TrimSpace(task.Annotations[harnessWrapperCancelDependencyRetriesAnno]))
-	if err != nil || retries < 0 {
-		return 0
-	}
-	return retries
-}
-
-func (r *TaskReconciler) patchHarnessWrapperCancelDependencyRetries(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	retries int,
-) error {
-	patch := ctrlclient.MergeFrom(task.DeepCopy())
-	if task.Annotations == nil {
-		task.Annotations = map[string]string{}
-	}
-	task.Annotations[harnessWrapperCancelDependencyRetriesAnno] = strconv.Itoa(retries)
-	return r.Patch(ctx, task, patch)
-}
-
-func (r *TaskReconciler) waitForHarnessCancelDependency(ctx context.Context, task *corev1alpha1.Task) (bool, error) {
-	retries := harnessWrapperCancelDependencyRetries(task)
-	if retries >= harnessWrapperMaxCancelDependencyRetries {
-		return false, nil
-	}
-	if err := r.patchHarnessWrapperCancelDependencyRetries(ctx, task, retries+1); err != nil {
-		return false, err
-	}
-	return true, nil
-}
-
-func harnessWrapperOutputFetchRetries(task *corev1alpha1.Task) int {
-	if task == nil || task.Annotations == nil {
-		return 0
-	}
-	retries, err := strconv.Atoi(strings.TrimSpace(task.Annotations[harnessWrapperOutputFetchRetriesAnno]))
-	if err != nil || retries < 0 {
-		return 0
-	}
-	return retries
-}
-
-func (r *TaskReconciler) patchHarnessWrapperOutputFetchRetries(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	retries int,
-) error {
-	patch := ctrlclient.MergeFrom(task.DeepCopy())
-	if task.Annotations == nil {
-		task.Annotations = map[string]string{}
-	}
-	task.Annotations[harnessWrapperOutputFetchRetriesAnno] = strconv.Itoa(retries)
-	return r.Patch(ctx, task, patch)
-}
-
-func (r *TaskReconciler) patchHarnessWrapperPlannedTurn(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	request harness.StartTurnRequest,
-) error {
-	patch := ctrlclient.MergeFrom(task.DeepCopy())
-	if task.Annotations == nil {
-		task.Annotations = map[string]string{}
-	}
-	task.Annotations[harnessWrapperTurnIDAnnotation] = string(request.TurnID)
-	task.Annotations[harnessWrapperRuntimeAnnotation] = string(request.RuntimeSessionID)
-	task.Annotations[harnessWrapperCorrelationIDAnno] = request.CorrelationID
-	task.Annotations[harnessWrapperLastFrameSeqAnno] = "0"
-	task.Annotations[harnessWrapperStartedAnno] = "false"
-	task.Annotations[harnessWrapperPlannedAtAnno] = time.Now().UTC().Format(time.RFC3339Nano)
-	delete(task.Annotations, harnessWrapperBrokeredContinuationAnno)
-	if runtimeRefName := strings.TrimSpace(request.Metadata["runtimeRef"]); runtimeRefName != "" {
-		task.Annotations[harnessWrapperRuntimeRefAnno] = runtimeRefName
-	} else {
-		delete(task.Annotations, harnessWrapperRuntimeRefAnno)
-	}
-	if contractVersion := strings.TrimSpace(request.Metadata["contractVersion"]); contractVersion != "" {
-		task.Annotations[harnessWrapperContractAnno] = contractVersion
-	} else {
-		task.Annotations[harnessWrapperContractAnno] = harness.ProtocolVersion
-	}
-	clearDeprecatedHarnessRuntimeAnnotations(task.Annotations)
-
-	plannedMetadata := make(map[string]string, len(request.Metadata))
-	for key, value := range request.Metadata {
-		if key == "systemPrompt" || key == harnessWrapperSkillsFilesMeta {
-			continue
-		}
-		plannedMetadata[key] = value
-	}
-	metadata, err := json.Marshal(plannedMetadata)
-	if err != nil {
-		return err
-	}
-	task.Annotations[harnessWrapperMetadataAnno] = string(metadata)
-	return r.Patch(ctx, task, patch)
-}
-
-func (r *TaskReconciler) patchHarnessWrapperStarted(ctx context.Context, task *corev1alpha1.Task) error {
-	latest := &corev1alpha1.Task{}
-	if err := r.Get(ctx, ctrlclient.ObjectKey{Name: task.Name, Namespace: task.Namespace}, latest); err != nil {
-		return err
-	}
-	patch := ctrlclient.MergeFrom(latest.DeepCopy())
-	if latest.Annotations == nil {
-		latest.Annotations = map[string]string{}
-	}
-	for _, key := range []string{
-		harnessWrapperTurnIDAnnotation,
-		harnessWrapperRuntimeAnnotation,
-		harnessWrapperCorrelationIDAnno,
-		harnessWrapperLastFrameSeqAnno,
-		harnessWrapperPlannedAtAnno,
-		harnessWrapperMetadataAnno,
-	} {
-		if strings.TrimSpace(latest.Annotations[key]) == "" && task != nil && task.Annotations != nil {
-			if value := task.Annotations[key]; strings.TrimSpace(value) != "" {
-				latest.Annotations[key] = value
-			}
-		}
-	}
-	latest.Annotations[harnessWrapperStartedAnno] = scheduledRunLabelValue
-	if err := r.Patch(ctx, latest, patch); err != nil {
-		return err
-	}
-	latest.DeepCopyInto(task)
-	return nil
-}
-
-func harnessWrapperPlannedMetadata(task *corev1alpha1.Task, runtimeName string) map[string]string {
-	metadata := map[string]string{}
-	if task != nil && task.Annotations != nil {
-		_ = json.Unmarshal([]byte(task.Annotations[harnessWrapperMetadataAnno]), &metadata)
-	}
-	if metadata == nil {
-		metadata = map[string]string{}
-	}
-	if strings.TrimSpace(metadata["runtime"]) == "" {
-		metadata["runtime"] = runtimeName
-	}
-	if strings.TrimSpace(metadata["wrapper"]) == "" {
-		metadata["wrapper"] = "cli"
-	}
-	return metadata
-}
-
-func harnessWrapperPlannedToolExecutionMode(task *corev1alpha1.Task) harness.ToolExecutionMode {
-	metadata := harnessWrapperPlannedMetadata(task, "")
-	return harness.ToolExecutionMode(strings.TrimSpace(metadata["toolExecutionMode"]))
-}
-
-func harnessWrapperCurrentAttempt(task *corev1alpha1.Task) int32 {
-	if task == nil || task.Status.Attempts <= 0 {
-		return 1
-	}
-	return task.Status.Attempts
-}
-
-func harnessWrapperTurnAnnotationsMatchTaskAttempt(task *corev1alpha1.Task, attempts int32) bool {
-	if !taskHasPlannedHarnessWrapperTurn(task) {
-		return false
-	}
-	correlationID := ""
-	if task != nil {
-		correlationID = string(task.UID)
-		if strings.TrimSpace(correlationID) == "" {
-			correlationID = task.Namespace + "/" + task.Name
-		}
-	}
-	return strings.TrimSpace(task.Annotations[harnessWrapperTurnIDAnnotation]) == string(harnessWrapperTurnID(task, attempts)) &&
-		strings.TrimSpace(task.Annotations[harnessWrapperCorrelationIDAnno]) == correlationID
-}
-
-func harnessWrapperPlannedTurnMatchesTask(task *corev1alpha1.Task, agent *corev1alpha1.Agent, attempts int32) bool {
-	if !taskHasPlannedHarnessWrapperTurn(task) {
-		return false
-	}
-	runtimeName := agentHarnessRuntimeName(agent)
-	if plannedRuntime := strings.TrimSpace(harnessWrapperPlannedMetadata(task, "")["runtime"]); plannedRuntime != "" {
-		runtimeName = plannedRuntime
-	}
-	if task != nil && task.Status.HarnessRuntime != nil && strings.TrimSpace(task.Status.HarnessRuntime.RuntimeRefName) != "" {
-		runtimeName = strings.TrimSpace(task.Status.HarnessRuntime.RuntimeRefName)
-	}
-	correlationID := string(task.UID)
-	if strings.TrimSpace(correlationID) == "" {
-		correlationID = task.Namespace + "/" + task.Name
-	}
-	expectedRuntimeSessionID := string(harnessWrapperRuntimeSessionID(task, runtimeName))
-	return strings.TrimSpace(task.Annotations[harnessWrapperTurnIDAnnotation]) == string(harnessWrapperTurnID(task, attempts)) &&
-		strings.TrimSpace(task.Annotations[harnessWrapperRuntimeAnnotation]) == expectedRuntimeSessionID &&
-		strings.TrimSpace(task.Annotations[harnessWrapperCorrelationIDAnno]) == correlationID
-}
-
-func (r *TaskReconciler) validateHarnessWrapperCapabilities(
-	ctx context.Context,
-	client *harness.Client,
-	request harness.StartTurnRequest,
-) error {
-	capabilities, err := client.Capabilities(ctx)
-	if err != nil {
-		return fmt.Errorf("read harness runtime capabilities: %w", err)
-	}
-	wantRuntime := strings.TrimSpace(request.Metadata["runtime"])
-	runtimeMatches := wantRuntime == "" || capabilities.RuntimeName == wantRuntime
-	if !runtimeMatches {
-		for runtime := range strings.SplitSeq(capabilities.Metadata["supportedRuntimes"], ",") {
-			if strings.TrimSpace(runtime) == wantRuntime {
-				runtimeMatches = true
-				break
-			}
-		}
-	}
-	if !runtimeMatches {
-		return fmt.Errorf("harness runtime %q does not match task runtime %q", sanitizeAgentRuntimeCapabilityValue(capabilities.RuntimeName), sanitizeAgentRuntimeCapabilityValue(wantRuntime))
-	}
-	if strings.TrimSpace(request.Metadata["runtimeRef"]) != "" {
-		if request.ToolExecutionMode == harness.ToolExecutionModeBrokered {
-			if err := validateAgentRuntimeExecutableCapabilities(capabilities); err != nil {
-				return err
-			}
-		} else if err := validateObservedHarnessCapabilities(capabilities); err != nil {
-			return err
-		}
-	}
-	if request.ToolExecutionMode == harness.ToolExecutionModeBrokered {
-		if !capabilityHasToolMode(capabilities, corev1alpha1.AgentRuntimeToolExecutionModeBrokered) {
-			return fmt.Errorf("runtime does not advertise required toolExecutionMode %q", corev1alpha1.AgentRuntimeToolExecutionModeBrokered)
-		}
-		for _, requiredClass := range harnessWrapperRequiredBrokeredClassesFromTurnRequest(request) {
-			if !capabilityHasBrokeredToolClass(capabilities, requiredClass) {
-				return fmt.Errorf("runtime does not advertise required brokeredToolClass %q", requiredClass)
-			}
-		}
-		if !capabilities.SupportsContinuation {
-			return fmt.Errorf("runtime does not advertise required supportsContinuation capability")
-		}
-	}
-	return nil
-}
-
-func applyHarnessRuntimeToolExecutionMode(request *harness.StartTurnRequest, target harnessRuntimeTarget) error {
-	if request == nil || strings.TrimSpace(target.RuntimeRefName) == "" {
-		return nil
-	}
-	observed := slices.Contains(target.ToolExecutionModes, corev1alpha1.AgentRuntimeToolExecutionModeObserved)
-	brokered := slices.Contains(target.ToolExecutionModes, corev1alpha1.AgentRuntimeToolExecutionModeBrokered)
-	requestedClasses := harnessWrapperRequiredBrokeredClassesFromTurnRequest(*request)
-	if len(request.Input.Tools) > 0 || len(requestedClasses) > 0 {
-		if !brokered {
-			return fmt.Errorf("AgentRuntime %q does not advertise brokered tool execution", target.RuntimeRefName)
-		}
-		if !target.SupportsContinuation {
-			return fmt.Errorf("AgentRuntime %q does not advertise brokered continuation", target.RuntimeRefName)
-		}
-		for _, class := range requestedClasses {
-			if !slices.Contains(target.BrokeredToolClasses, class) {
-				return fmt.Errorf("AgentRuntime %q does not advertise brokeredToolClass %q", target.RuntimeRefName, class)
-			}
-		}
-		request.ToolExecutionMode = harness.ToolExecutionModeBrokered
-		if request.Metadata == nil {
-			request.Metadata = map[string]string{}
-		}
-		request.Metadata["toolExecutionMode"] = string(harness.ToolExecutionModeBrokered)
-		return nil
-	}
-	if !observed {
-		return fmt.Errorf("AgentRuntime %q does not advertise observed mode and task exposes no brokered tools", target.RuntimeRefName)
-	}
-	request.ToolExecutionMode = harness.ToolExecutionModeObserved
-	if request.Metadata == nil {
-		request.Metadata = map[string]string{}
-	}
-	request.Metadata["toolExecutionMode"] = string(harness.ToolExecutionModeObserved)
-	return nil
-}
-
-func harnessWrapperRequiredBrokeredClassesFromTurnRequest(request harness.StartTurnRequest) []corev1alpha1.AgentRuntimeBrokeredToolClass {
-	seen := map[corev1alpha1.AgentRuntimeBrokeredToolClass]struct{}{}
-	out := []corev1alpha1.AgentRuntimeBrokeredToolClass{}
-	for _, definition := range request.Input.Tools {
-		class := corev1alpha1.AgentRuntimeBrokeredToolClass(strings.TrimSpace(string(definition.BrokeredClass)))
-		if class == "" {
-			continue
-		}
-		if _, ok := seen[class]; ok {
-			continue
-		}
-		seen[class] = struct{}{}
-		out = append(out, class)
-	}
-	if len(out) > 0 {
-		return out
-	}
-	return harnessWrapperRequiredBrokeredClassesFromMetadata(request.Metadata)
-}
-
-func harnessWrapperRequiredBrokeredClassesFromMetadata(metadata map[string]string) []corev1alpha1.AgentRuntimeBrokeredToolClass {
-	if len(metadata) == 0 {
-		return nil
-	}
-	return parseBrokeredToolClasses(metadata["brokeredToolClasses"])
-}
-
-func parseBrokeredToolClasses(value string) []corev1alpha1.AgentRuntimeBrokeredToolClass {
-	seen := map[corev1alpha1.AgentRuntimeBrokeredToolClass]struct{}{}
-	out := []corev1alpha1.AgentRuntimeBrokeredToolClass{}
-	for raw := range strings.SplitSeq(value, ",") {
-		class := corev1alpha1.AgentRuntimeBrokeredToolClass(strings.TrimSpace(raw))
-		if class == "" {
-			continue
-		}
-		if _, ok := seen[class]; ok {
-			continue
-		}
-		seen[class] = struct{}{}
-		out = append(out, class)
-	}
-	return out
-}
-
-func harnessWrapperPlannedBrokeredToolClassMap(task *corev1alpha1.Task) (map[string]corev1alpha1.AgentRuntimeBrokeredToolClass, error) {
-	metadata := harnessWrapperPlannedMetadata(task, "")
-	raw := strings.TrimSpace(metadata["brokeredToolClassMap"])
-	if raw == "" {
-		return nil, nil
-	}
-	decoded := map[string]corev1alpha1.AgentRuntimeBrokeredToolClass{}
-	if err := json.Unmarshal([]byte(raw), &decoded); err != nil {
-		return nil, fmt.Errorf("parse planned brokered tool class map: %w", err)
-	}
-	return decoded, nil
-}
-
-func (r *TaskReconciler) harnessWrapperBrokeredToolClassMap(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-) (map[string]corev1alpha1.AgentRuntimeBrokeredToolClass, error) {
-	out := map[string]corev1alpha1.AgentRuntimeBrokeredToolClass{}
-	for _, toolName := range harnessWrapperBrokeredToolNames(task) {
-		if isHarnessBrokeredCoordinationToolName(toolName) {
-			out[toolName] = corev1alpha1.AgentRuntimeBrokeredToolClassCoordination
-			continue
-		}
-		tool := &corev1alpha1.Tool{}
-		if err := r.Get(ctx, ctrlclient.ObjectKey{Namespace: task.Namespace, Name: toolName}, tool); err != nil {
-			return nil, fmt.Errorf("read brokered tool %q: %w", toolName, err)
-		}
-		if tool.Spec.BrokeredToolClass == "" {
-			return nil, fmt.Errorf("brokered tool %q must set spec.brokeredToolClass", toolName)
-		}
-		out[toolName] = tool.Spec.BrokeredToolClass
-	}
-	return out, nil
-}
-
-func (r *TaskReconciler) harnessWrapperRequiredBrokeredToolClasses(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	agent *corev1alpha1.Agent,
-) ([]string, error) {
-	if harnessWrapperToolExecutionMode(task, agent) != harness.ToolExecutionModeBrokered {
-		return nil, nil
-	}
-	classMap, err := r.harnessWrapperBrokeredToolClassMap(ctx, task)
-	if err != nil {
-		return nil, err
-	}
-	seen := map[corev1alpha1.AgentRuntimeBrokeredToolClass]struct{}{}
-	classes := []string{}
-	for _, class := range classMap {
-		if _, ok := seen[class]; ok {
-			continue
-		}
-		seen[class] = struct{}{}
-		classes = append(classes, string(class))
-	}
-	sort.Strings(classes)
-	return classes, nil
-}
-
-func (r *TaskReconciler) harnessWrapperBrokeredToolDefinitions(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-) ([]harness.ToolDefinition, error) {
-	toolNames := harnessWrapperBrokeredToolNames(task)
-	if len(toolNames) == 0 {
-		return nil, nil
-	}
-	definitions := make([]harness.ToolDefinition, 0, len(toolNames))
-	for _, toolName := range toolNames {
-		if isHarnessBrokeredCoordinationToolName(toolName) {
-			definitions = append(definitions, harnessBrokeredCoordinationToolDefinition(toolName))
-			continue
-		}
-		tool := &corev1alpha1.Tool{}
-		if err := r.Get(ctx, ctrlclient.ObjectKey{Namespace: task.Namespace, Name: toolName}, tool); err != nil {
-			return nil, fmt.Errorf("read brokered tool %q: %w", toolName, err)
-		}
-		if tool.Spec.BrokeredToolClass == "" {
-			return nil, fmt.Errorf("brokered tool %q must set spec.brokeredToolClass", toolName)
-		}
-		definition := harness.ToolDefinition{
-			Name:          tool.Name,
-			Description:   strings.TrimSpace(tool.Spec.Description),
-			BrokeredClass: harness.BrokeredToolClass(tool.Spec.BrokeredToolClass),
-		}
-		if tool.Spec.Parameters != nil && len(tool.Spec.Parameters.Raw) > 0 {
-			definition.Parameters = append(json.RawMessage(nil), tool.Spec.Parameters.Raw...)
-		}
-		definitions = append(definitions, definition)
-	}
-	return definitions, nil
-}
-
-func harnessBrokeredCoordinationToolDefinition(name string) harness.ToolDefinition {
-	definition := harness.ToolDefinition{
-		Name:          strings.TrimSpace(name),
-		BrokeredClass: harness.BrokeredToolClassCoordination,
-		Parameters:    json.RawMessage(`{"type":"object","additionalProperties":true}`),
-	}
-	switch definition.Name {
-	case "delegate_task":
-		definition.Description = "Create a governed child Orka agent task."
-	case "wait_for_tasks":
-		definition.Description = "Wait for delegated child tasks and return bounded result summaries."
-	case "cancel_task":
-		definition.Description = "Cancel a governed child Orka task."
-	case "send_message":
-		definition.Description = "Send a coordination message to another task."
-	case "check_messages":
-		definition.Description = "Check coordination messages for this task."
-	default:
-		definition.Description = "Orka coordination tool."
-	}
-	return definition
-}
-
-func harnessWrapperAuthError(err error) bool {
-	if err == nil {
-		return false
-	}
-	var clientErr harness.ClientError
-	if errors.As(err, &clientErr) {
-		return clientErr.StatusCode == http.StatusUnauthorized || clientErr.StatusCode == http.StatusForbidden
-	}
-	if status, _, ok := legacyMutationResponse(err); ok {
-		return status == http.StatusUnauthorized || status == http.StatusForbidden
-	}
-	message := strings.ToLower(err.Error())
-	return strings.Contains(message, "unauthorized") || strings.Contains(message, "forbidden")
-}
-
-func harnessWrapperDuplicateTurnError(err error) bool {
-	var clientErr harness.ClientError
-	if errors.As(err, &clientErr) {
-		return clientErr.IsDuplicateTurn()
-	}
-	status, message, ok := legacyMutationResponse(err)
-	return ok && status == http.StatusConflict &&
-		(message == "turn already exists" || message == "turn already completed")
-}
-
-func harnessWrapperCapacityError(err error) bool {
-	var clientErr harness.ClientError
-	if errors.As(err, &clientErr) {
-		return clientErr.IsCapacityExceeded()
-	}
-	status, message, ok := legacyMutationResponse(err)
-	return ok && status == http.StatusConflict && message == "maximum concurrent turns reached"
-}
-
-func harnessWrapperStartTurnErrorIsRetryable(err error) bool {
-	if err == nil {
-		return false
-	}
-	var clientErr harness.ClientError
-	if errors.As(err, &clientErr) {
-		if harnessMutationMayHaveBeenAccepted(err) {
-			return true
-		}
-		if clientErr.StatusCode >= http.StatusBadRequest && clientErr.StatusCode < http.StatusInternalServerError {
-			return false
-		}
-		return !clientErr.IsUnsupportedVersion() && !clientErr.IsRemoteRejected()
-	}
-	return legacyMutationMayHaveBeenAccepted(err)
-}
-
-func harnessWrapperCapabilitiesErrorIsRetryable(err error) bool {
-	if err == nil {
-		return false
-	}
-	var clientErr harness.ClientError
-	if errors.As(err, &clientErr) {
-		switch clientErr.StatusCode {
-		case http.StatusBadRequest, http.StatusUnauthorized, http.StatusForbidden, http.StatusNotFound:
-			return false
-		}
-		return !clientErr.IsUnsupportedVersion() && !clientErr.IsProtocolViolation()
-	}
-	message := strings.ToLower(err.Error())
-	if !strings.Contains(message, "read harness runtime capabilities") {
-		return false
-	}
-	for _, marker := range []string{"(400)", "(401)", "(403)", "(404)", "unsupported version"} {
-		if strings.Contains(message, marker) {
-			return false
-		}
-	}
-	return true
-}
-
-func (r *TaskReconciler) clearHarnessWrapperTurnState(ctx context.Context, task *corev1alpha1.Task) error {
-	patch := ctrlclient.MergeFrom(task.DeepCopy())
-	if task.Annotations != nil {
-		delete(task.Annotations, harnessWrapperTurnIDAnnotation)
-		delete(task.Annotations, harnessWrapperRuntimeAnnotation)
-		delete(task.Annotations, harnessWrapperCorrelationIDAnno)
-		delete(task.Annotations, harnessWrapperLastFrameSeqAnno)
-		delete(task.Annotations, harnessWrapperStartedAnno)
-		delete(task.Annotations, harnessWrapperPlannedAtAnno)
-		delete(task.Annotations, harnessWrapperMetadataAnno)
-		delete(task.Annotations, harnessWrapperRuntimeRefAnno)
-		delete(task.Annotations, harnessWrapperContractAnno)
-		clearDeprecatedHarnessRuntimeAnnotations(task.Annotations)
-		delete(task.Annotations, harnessWrapperOutputFetchRetriesAnno)
-		delete(task.Annotations, harnessWrapperCancelDependencyRetriesAnno)
-		delete(task.Annotations, harnessWrapperAuthRetriesAnno)
-		delete(task.Annotations, harnessWrapperBrokeredContinuationAnno)
-	}
-	if err := r.Patch(ctx, task, patch); err != nil {
-		return err
-	}
-	return r.updateStatusWithRetry(ctx, task, func(t *corev1alpha1.Task) {
-		t.Status.HarnessRuntime = nil
-	})
-}
-
-func harnessWrapperStreamErrorIsMissingTurn(err error) bool {
-	if err == nil {
-		return false
-	}
-	var clientErr harness.ClientError
-	if errors.As(err, &clientErr) {
-		return clientErr.StatusCode == http.StatusNotFound || clientErr.StatusCode == http.StatusGone || clientErr.IsTurnNotFound()
-	}
-	message := err.Error()
-	for _, marker := range []string{"(404)", "(410)", "turn not found"} {
-		if strings.Contains(message, marker) {
-			return true
-		}
-	}
-	return false
-}
-
-func harnessWrapperStreamErrorIsTerminal(err error) bool {
-	if err == nil {
-		return false
-	}
-	var clientErr harness.ClientError
-	if errors.As(err, &clientErr) {
-		switch clientErr.StatusCode {
-		case http.StatusUnauthorized, http.StatusForbidden, http.StatusNotFound, http.StatusGone:
-			return true
-		}
-		return clientErr.IsTurnNotFound() || clientErr.IsProtocolViolation()
-	}
-	message := err.Error()
-	for _, marker := range []string{
-		"(401)", "(403)", "(404)", "(410)", "turn not found", "unauthorized",
-		"harness frame identity does not match", "invalid harness frame", "invalid harness frame content JSON",
-		"decode harness frame",
-	} {
-		if strings.Contains(message, marker) {
-			return true
-		}
-	}
-	return false
-}
-
-func harnessWrapperStreamErrorIsBrokeredPause(err error) bool {
-	if err == nil {
-		return false
-	}
-	return strings.Contains(err.Error(), "continue brokered tool call") || errors.Is(err, errHarnessBrokeredApprovalPending)
-}
-
-func (r *TaskReconciler) cancelHarnessWrapperTurn(ctx context.Context, task *corev1alpha1.Task, reason string) error {
-	if !taskHasPlannedHarnessWrapperTurn(task) {
-		return nil
-	}
-	if !harnessWrapperTurnAnnotationsMatchTaskAttempt(task, harnessWrapperCurrentAttempt(task)) {
-		return nil
-	}
-	target, err := r.resolveHarnessRuntimeTarget(ctx, task, nil)
-	if err != nil {
-		return err
-	}
-	client, err := harness.NewClient(target.Endpoint, harness.WithBearerToken(target.BearerToken))
-	if err != nil {
-		return err
-	}
-	_, err = client.CancelTurn(ctx, harness.CancelTurnRequest{
-		Version:          harness.ProtocolVersion,
-		Namespace:        task.Namespace,
-		TaskName:         task.Name,
-		SessionName:      harnessWrapperSessionName(task),
-		RuntimeSessionID: harness.RuntimeSessionID(strings.TrimSpace(task.Annotations[harnessWrapperRuntimeAnnotation])),
-		TurnID:           harness.HarnessTurnID(strings.TrimSpace(task.Annotations[harnessWrapperTurnIDAnnotation])),
-		CorrelationID:    strings.TrimSpace(task.Annotations[harnessWrapperCorrelationIDAnno]),
-		Reason:           reason,
-	})
-	if err != nil && harnessWrapperStreamErrorIsMissingTurn(err) {
-		return nil
-	}
-	return err
-}
-
-func (r *TaskReconciler) plannedHarnessWrapperStartTurnRequest(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	agent *corev1alpha1.Agent,
-	now time.Time,
-) (harness.StartTurnRequest, error) {
-	deadline := now.Add(harnessWrapperNoTimeoutDuration)
-	if task.Spec.Timeout != nil {
-		deadline = now.Add(task.Spec.Timeout.Duration)
-	}
-	plannedMetadata := harnessWrapperPlannedMetadata(task, agentHarnessRuntimeName(agent))
-	attempts := harnessWrapperCurrentAttempt(task)
-	request, err := r.harnessWrapperStartTurnRequest(ctx, task, agent, now, attempts)
-	if err != nil {
-		return harness.StartTurnRequest{}, err
-	}
-	request.RuntimeSessionID = harness.RuntimeSessionID(strings.TrimSpace(task.Annotations[harnessWrapperRuntimeAnnotation]))
-	request.TurnID = harness.HarnessTurnID(strings.TrimSpace(task.Annotations[harnessWrapperTurnIDAnnotation]))
-	request.CorrelationID = strings.TrimSpace(task.Annotations[harnessWrapperCorrelationIDAnno])
-	request.Deadline = deadline.UTC()
-	if request.Metadata == nil {
-		request.Metadata = map[string]string{}
-	}
-	maps.Copy(request.Metadata, plannedMetadata)
-	return request, nil
-}
-
-func sessionMessagesPrompt(messages []store.SessionMessage) string {
-	const maxPromptBytes = 96 << 10
-	const header = "Canonical conversation transcript:\n\n"
-	const instruction = "\n\nRespond to the final user message."
-	chunks := make([]string, 0, len(messages))
-	used := len(header) + len(instruction)
-	for i := len(messages) - 1; i >= 0; i-- {
-		role := strings.ToUpper(strings.TrimSpace(messages[i].Role))
-		if role != "USER" && role != "ASSISTANT" {
-			continue
-		}
-		chunk := role + ":\n" + store.RuntimeSessionMessageContent(messages[i])
-		separator := 2
-		if used+separator+len(chunk) > maxPromptBytes && len(chunks) > 0 {
-			break
-		}
-		if used+separator+len(chunk) > maxPromptBytes {
-			remaining := maxPromptBytes - used - separator
-			if remaining <= len(role)+2 {
-				return ""
-			}
-			chunk = truncateHarnessPromptUTF8(chunk, remaining)
-		}
-		chunks = append(chunks, chunk)
-		used += separator + len(chunk)
-	}
-	if len(chunks) == 0 {
-		return ""
-	}
-	slices.Reverse(chunks)
-	for len(chunks) > 0 && strings.HasPrefix(chunks[0], "ASSISTANT:\n") {
-		chunks = chunks[1:]
-	}
-	if len(chunks) == 0 {
-		return ""
-	}
-	return header + strings.Join(chunks, "\n\n") + instruction
-}
-
-func truncateHarnessPromptUTF8(value string, maxBytes int) string {
-	if maxBytes <= 0 {
-		return ""
-	}
-	if len(value) <= maxBytes {
-		return value
-	}
-	value = value[:maxBytes]
-	for len(value) > 0 && !utf8.ValidString(value) {
-		value = value[:len(value)-1]
-	}
-	return value
-}
-
-func (r *TaskReconciler) harnessWrapperStartTurnRequest(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	agent *corev1alpha1.Agent,
-	now time.Time,
-	attempts int32,
-) (harness.StartTurnRequest, error) {
-	deadline := now.Add(harnessWrapperNoTimeoutDuration)
-	if task.Spec.Timeout != nil {
-		deadline = now.Add(task.Spec.Timeout.Duration)
-	}
-	runtimeName := agentHarnessRuntimeName(agent)
-	turnID := harnessWrapperTurnID(task, attempts)
-	correlationID := string(task.UID)
-	if strings.TrimSpace(correlationID) == "" {
-		correlationID = task.Namespace + "/" + task.Name
-	}
-	prompt := task.Spec.Prompt
-	if prompt == "" && task.Spec.AI != nil {
-		prompt = task.Spec.AI.Prompt
-	}
-	if task.Spec.SessionRef != nil && task.Spec.SessionRef.PromptIncluded {
-		if r.SessionManager == nil {
-			return harness.StartTurnRequest{}, fmt.Errorf("session manager is required for transcript-backed prompt")
-		}
-		messages, err := r.SessionManager.LoadTranscript(ctx, task)
-		if err != nil {
-			return harness.StartTurnRequest{}, fmt.Errorf("load transcript-backed prompt: %w", err)
-		}
-		prompt = sessionMessagesPrompt(messages)
-		if prompt == "" {
-			return harness.StartTurnRequest{}, fmt.Errorf("transcript-backed prompt is empty")
-		}
-	}
-	metadata, err := r.harnessWrapperTurnMetadata(ctx, task, agent, runtimeName)
-	if err != nil {
-		return harness.StartTurnRequest{}, err
-	}
-	brokeredClasses, err := r.harnessWrapperRequiredBrokeredToolClasses(ctx, task, agent)
-	if err != nil {
-		return harness.StartTurnRequest{}, err
-	}
-	if len(brokeredClasses) > 0 {
-		metadata["brokeredToolClasses"] = strings.Join(brokeredClasses, ",")
-		classMap, err := r.harnessWrapperBrokeredToolClassMap(ctx, task)
-		if err != nil {
-			return harness.StartTurnRequest{}, err
-		}
-		encoded, err := json.Marshal(classMap)
-		if err != nil {
-			return harness.StartTurnRequest{}, fmt.Errorf("marshal brokered tool class map: %w", err)
-		}
-		metadata["brokeredToolClassMap"] = string(encoded)
-	}
-	toolExecutionMode := harnessWrapperToolExecutionMode(task, agent)
-	if toolExecutionMode != "" {
-		metadata["toolExecutionMode"] = string(toolExecutionMode)
-	}
-	turnEnv, err := r.harnessWrapperTurnEnv(ctx, task, agent)
-	if err != nil {
-		return harness.StartTurnRequest{}, err
-	}
-	var toolDefinitions []harness.ToolDefinition
-	if toolExecutionMode == harness.ToolExecutionModeBrokered {
-		toolDefinitions, err = r.harnessWrapperBrokeredToolDefinitions(ctx, task)
-		if err != nil {
-			return harness.StartTurnRequest{}, err
-		}
-	}
-	runtimeIdentity := harnessWrapperRuntimeSessionIdentity(task, agent, runtimeName)
-	return harness.StartTurnRequest{
-		Version:          harness.ProtocolVersion,
-		Namespace:        task.Namespace,
-		TaskName:         task.Name,
-		SessionName:      harnessWrapperSessionName(task),
-		RuntimeSessionID: runtimeIdentity.ID,
-		TurnID:           turnID,
-		CorrelationID:    correlationID,
-		Deadline:         deadline.UTC(),
-		AuthIdentity: harness.AuthIdentity{
-			Subject: "task:" + task.Namespace + "/" + task.Name,
-		},
-		Input:             harness.TurnInput{Prompt: prompt, Env: turnEnv, Tools: toolDefinitions},
-		ToolExecutionMode: toolExecutionMode,
-		Metadata:          metadata,
-	}, nil
-}
-
-//nolint:gocyclo // Collects runtime metadata from Agent and Task defaults in one place.
-func (r *TaskReconciler) harnessWrapperTurnMetadata(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	agent *corev1alpha1.Agent,
-	runtimeName string,
-) (map[string]string, error) {
-	metadata := map[string]string{
-		"runtime":         runtimeName,
-		"wrapper":         "cli",
-		"contractVersion": harness.ProtocolVersion,
-		"maxTurns":        "50",
-	}
-	if runtimeRefName := agentHarnessRuntimeRefName(agent); runtimeRefName != "" {
-		metadata["runtimeRef"] = runtimeRefName
-		metadata["wrapper"] = "external-endpoint"
-	}
-	if task != nil && task.Annotations != nil {
-		if traceparent := strings.TrimSpace(task.Annotations[labels.AnnotationTraceParent]); traceparent != "" {
-			metadata["traceparent"] = traceparent
-		}
-		if tracestate := strings.TrimSpace(task.Annotations[labels.AnnotationTraceState]); tracestate != "" {
-			metadata["tracestate"] = tracestate
-		}
-	}
-	if agent != nil {
-		metadata["agentName"] = agent.Name
-		if agent.Spec.Model != nil && strings.TrimSpace(agent.Spec.Model.Name) != "" {
-			metadata["model"] = strings.TrimSpace(agent.Spec.Model.Name)
-		}
-		if strings.TrimSpace(metadata["model"]) == "" {
-			if model := r.harnessWrapperDefaultProviderModel(ctx, agent.Namespace); model != "" {
-				metadata["model"] = model
-			}
-		}
-		if agent.Spec.SystemPrompt != nil {
-			systemPrompt := strings.TrimSpace(agent.Spec.SystemPrompt.Inline)
-			if systemPrompt == "" && agent.Spec.SystemPrompt.ConfigMapRef != nil {
-				resolved, err := r.resolveHarnessWrapperConfigMapValue(
-					ctx,
-					agent.Namespace,
-					agent.Spec.SystemPrompt.ConfigMapRef,
-				)
-				if err != nil {
-					return nil, err
-				}
-				systemPrompt = strings.TrimSpace(resolved)
-			}
-			if systemPrompt != "" {
-				metadata["systemPrompt"] = systemPrompt
-			}
-		}
-	}
-	skillsPrompt, skillsFiles, err := r.harnessWrapperSkillsPrompt(ctx, task, agent)
-	if err != nil {
-		return nil, err
-	}
-	if skillsPrompt != "" {
-		metadata["systemPrompt"] = strings.TrimSpace(strings.Join(
-			[]string{skillsPrompt, strings.TrimSpace(metadata["systemPrompt"])},
-			"\n\n",
-		))
-	}
-	if skillsFiles != "" {
-		metadata[harnessWrapperSkillsFilesMeta] = skillsFiles
-	}
-	if agent != nil && agent.Spec.Runtime != nil && agent.Spec.Runtime.DefaultMaxTurns != nil {
-		metadata["maxTurns"] = strconv.FormatInt(int64(*agent.Spec.Runtime.DefaultMaxTurns), 10)
-	}
-	if agent != nil && agent.Spec.Runtime != nil {
-		if effort := strings.ToLower(strings.TrimSpace(agent.Spec.Runtime.DefaultReasoningEffort)); effort != "" {
-			metadata["reasoningEffort"] = effort
-		}
-	}
-	if task.Spec.AgentRuntime != nil && task.Spec.AgentRuntime.MaxTurns != nil {
-		metadata["maxTurns"] = strconv.FormatInt(int64(*task.Spec.AgentRuntime.MaxTurns), 10)
-	}
-	if task.Spec.Timeout != nil && task.Spec.Timeout.Duration > 0 {
-		metadata["timeoutSeconds"] = strconv.FormatInt(int64(task.Spec.Timeout.Duration/time.Second), 10)
-	}
-	allowedTools := []string(nil)
-	if agent != nil && agent.Spec.Runtime != nil {
-		allowedTools = agent.Spec.Runtime.DefaultAllowedTools
-	}
-	if task.Spec.AgentRuntime != nil && len(task.Spec.AgentRuntime.AllowedTools) > 0 {
-		allowedTools = task.Spec.AgentRuntime.AllowedTools
-	}
-	disallowedTools := []string(nil)
-	if task.Spec.AgentRuntime != nil && len(task.Spec.AgentRuntime.DisallowedTools) > 0 {
-		disallowedTools = append(disallowedTools, task.Spec.AgentRuntime.DisallowedTools...)
-	}
-	if taskRequestsRuntimeAuthOnly(task) {
-		metadata["runtimeAuthOnly"] = scheduledRunLabelValue
-	}
-	if taskRequestsReadOnlyAgent(task) {
-		metadata["readOnly"] = scheduledRunLabelValue
-		allowedTools = readOnlyAgentAllowedTools()
-		disallowedTools = append(disallowedTools, readOnlyAgentDisallowedTools()...)
-		metadata["claudeBare"] = scheduledRunLabelValue
-		metadata["claudeDisableSettingSources"] = scheduledRunLabelValue
-		metadata["claudePermissionMode"] = "dontAsk"
-	}
-	if len(allowedTools) > 0 {
-		metadata["allowedTools"] = strings.Join(allowedTools, ",")
-	}
-	if len(disallowedTools) > 0 {
-		metadata["disallowedTools"] = strings.Join(disallowedTools, ",")
-	}
-	allowBash := true
-	if agent != nil && agent.Spec.Runtime != nil && agent.Spec.Runtime.DefaultAllowBash != nil {
-		allowBash = *agent.Spec.Runtime.DefaultAllowBash
-	}
-	if task.Spec.AgentRuntime != nil && task.Spec.AgentRuntime.AllowBash != nil {
-		allowBash = *task.Spec.AgentRuntime.AllowBash
-	}
-	if taskRequestsReadOnlyAgent(task) {
-		allowBash = false
-	}
-	metadata["allowBash"] = strconv.FormatBool(allowBash)
-	if ws := effectiveWorkspace(task); ws != nil {
-		if strings.TrimSpace(ws.GitRepo) != "" {
-			metadata["gitRepo"] = strings.TrimSpace(ws.GitRepo)
-		}
-		if strings.TrimSpace(ws.Branch) != "" {
-			metadata["gitBranch"] = strings.TrimSpace(ws.Branch)
-		}
-		if strings.TrimSpace(ws.Ref) != "" {
-			metadata["gitRef"] = strings.TrimSpace(ws.Ref)
-		}
-		if strings.TrimSpace(ws.SubPath) != "" {
-			metadata["workspaceSubPath"] = strings.TrimSpace(ws.SubPath)
-		}
-		if strings.TrimSpace(ws.ForkRepo) != "" {
-			metadata["forkRepo"] = strings.TrimSpace(ws.ForkRepo)
-		}
-		if strings.TrimSpace(ws.PRBaseBranch) != "" {
-			metadata["prBaseBranch"] = strings.TrimSpace(ws.PRBaseBranch)
-		}
-		if strings.TrimSpace(ws.PushBranch) != "" {
-			metadata["pushBranch"] = strings.TrimSpace(ws.PushBranch)
-		}
-	}
-	for _, env := range task.Spec.Env {
-		switch env.Name {
-		case workerenv.PRBaseRepo:
-			metadata["prBaseRepo"] = strings.TrimSpace(env.Value)
-		case workerenv.PRBaseSHA:
-			metadata["prBaseSHA"] = strings.TrimSpace(env.Value)
-		}
-	}
-	return metadata, nil
-}
-
-func (r *TaskReconciler) harnessWrapperDefaultProviderModel(ctx context.Context, namespace string) string {
-	if r == nil || r.Client == nil || strings.TrimSpace(namespace) == "" {
-		return ""
-	}
-	provider := &corev1alpha1.Provider{}
-	if err := r.Get(ctx, ctrlclient.ObjectKey{Namespace: namespace, Name: "default"}, provider); err != nil {
-		return ""
-	}
-	return strings.TrimSpace(provider.Spec.DefaultModel)
-}
-
-func (r *TaskReconciler) harnessWrapperSkillsPrompt(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	agent *corev1alpha1.Agent,
-) (string, string, error) {
-	if task == nil {
-		return "", "", nil
-	}
-	skillRefs := harnessWrapperSkillReferences(task, agent)
-	if len(skillRefs) == 0 {
-		return "", "", nil
-	}
-	promptParts := make([]string, 0, len(skillRefs))
-	files := map[string]string{}
-	for _, ref := range skillRefs {
-		switch {
-		case ref.Name != "":
-			skillName := strings.TrimSpace(ref.Name)
-			skill := &corev1alpha1.Skill{}
-			if err := r.Get(ctx, ctrlclient.ObjectKey{Name: skillName, Namespace: task.Namespace}, skill); err != nil {
-				return "", "", fmt.Errorf("failed to get Skill %q: %w", skillName, err)
-			}
-			metrics.SkillsLoaded.WithLabelValues(skill.Name, task.Namespace).Inc()
-			if content := strings.TrimSpace(skill.Spec.Content.Inline); content != "" {
-				promptParts = append(promptParts, content)
-				files[path.Join(skillName, "SKILL.md")] = skill.Spec.Content.Inline
-			}
-			filePaths := make([]string, 0, len(skill.Spec.Content.Files))
-			for filePath := range skill.Spec.Content.Files {
-				filePaths = append(filePaths, filePath)
-			}
-			sort.Strings(filePaths)
-			for _, filePath := range filePaths {
-				files[path.Join(skillName, filePath)] = skill.Spec.Content.Files[filePath]
-			}
-		case ref.ConfigMapRef != nil:
-			cmName := strings.TrimSpace(ref.ConfigMapRef.Name)
-			cmKey := strings.TrimSpace(ref.ConfigMapRef.Key)
-			cm := &corev1.ConfigMap{}
-			if err := r.Get(ctx, ctrlclient.ObjectKey{Name: cmName, Namespace: task.Namespace}, cm); err != nil {
-				return "", "", fmt.Errorf("failed to get skill ConfigMap %q: %w", cmName, err)
-			}
-			content, ok := cm.Data[cmKey]
-			if !ok {
-				return "", "", fmt.Errorf("key %q not found in skill ConfigMap %q", cmKey, cmName)
-			}
-			metrics.SkillsLoaded.WithLabelValues(cmName, task.Namespace).Inc()
-			if content = strings.TrimSpace(content); content != "" {
-				promptParts = append(promptParts, content)
-				files[path.Join(cmName+"-"+cmKey, "SKILL.md")] = content
-			}
-		default:
-			return "", "", fmt.Errorf("skill reference must set either name or configMapRef")
-		}
-	}
-	filesJSON := ""
-	if len(files) > 0 {
-		data, err := json.Marshal(files)
-		if err != nil {
-			return "", "", err
-		}
-		filesJSON = string(data)
-	}
-	return strings.TrimSpace(strings.Join(promptParts, "\n\n")), filesJSON, nil
-}
-
-func harnessWrapperSkillReferences(
-	task *corev1alpha1.Task,
-	agent *corev1alpha1.Agent,
-) []corev1alpha1.SkillReference {
-	var skillRefs []corev1alpha1.SkillReference
-	if agent != nil {
-		skillRefs = append(skillRefs, agent.Spec.Skills...)
-	}
-	if task != nil && task.Spec.AI != nil {
-		skillRefs = append(skillRefs, task.Spec.AI.Skills...)
-	}
-	if len(skillRefs) == 0 {
-		return nil
-	}
-	seen := make(map[string]struct{}, len(skillRefs))
-	deduped := make([]corev1alpha1.SkillReference, 0, len(skillRefs))
-	for _, ref := range skillRefs {
-		key := ""
-		switch {
-		case strings.TrimSpace(ref.Name) != "":
-			name := strings.TrimSpace(ref.Name)
-			ref.Name = name
-			key = "skill:" + name
-		case ref.ConfigMapRef != nil:
-			cmName := strings.TrimSpace(ref.ConfigMapRef.Name)
-			cmKey := strings.TrimSpace(ref.ConfigMapRef.Key)
-			ref.ConfigMapRef = &corev1alpha1.ConfigMapKeySelector{Name: cmName, Key: cmKey}
-			key = "configmap:" + cmName + "/" + cmKey
-		}
-		if key == "" {
-			continue
-		}
-		if _, ok := seen[key]; ok {
-			continue
-		}
-		seen[key] = struct{}{}
-		deduped = append(deduped, ref)
-	}
-	return deduped
-}
-
-// harnessWrapperBaseTurnEnv copies literal Task env and resolves supported valueFrom
-// entries after validateTaskAgentCompatibility has rejected secret-looking task env
-// names. Runtime credentials are resolved separately from Agent/Task SecretRefs and
-// are never persisted in annotations.
-func (r *TaskReconciler) harnessWrapperBaseTurnEnv(ctx context.Context, task *corev1alpha1.Task) ([]harness.TurnEnvVar, error) {
-	if task == nil {
-		return nil, nil
-	}
-	env := make([]harness.TurnEnvVar, 0, len(task.Spec.Env)+4)
-	for _, item := range task.Spec.Env {
-		name := strings.TrimSpace(item.Name)
-		if name == "" {
-			continue
-		}
-		if taskRequestsReadOnlyAgent(task) && harnessWrapperReadOnlyEnvBlocked(name) {
-			continue
-		}
-		value := item.Value
-		if item.ValueFrom != nil {
-			resolved, present, err := r.resolveHarnessWrapperTaskEnvValueFrom(ctx, task, item)
-			if err != nil {
-				return nil, err
-			}
-			if !present {
-				continue
-			}
-			value = resolved
-		}
-		env = append(env, harness.TurnEnvVar{Name: item.Name, Value: value})
-	}
-	if r != nil && r.JobBuilder != nil && strings.TrimSpace(r.JobBuilder.ControllerURL) != "" {
-		controllerURL := strings.TrimSpace(r.JobBuilder.ControllerURL)
-		env = append(env,
-			harness.TurnEnvVar{Name: workerenv.ControllerURL, Value: controllerURL},
-			harness.TurnEnvVar{
-				Name:  workerenv.ResultEndpoint,
-				Value: fmt.Sprintf("%s/internal/v1/results/%s/%s", controllerURL, task.Namespace, task.Name),
-			},
-		)
-	}
-	if task.Spec.PriorTaskRef != nil {
-		env = append(env, harness.TurnEnvVar{Name: workerenv.PriorTask, Value: task.Spec.PriorTaskRef.Name})
-		priorNS := task.Spec.PriorTaskRef.Namespace
-		if strings.TrimSpace(priorNS) == "" {
-			priorNS = task.Namespace
-		}
-		env = append(env, harness.TurnEnvVar{Name: workerenv.PriorTaskNamespace, Value: priorNS})
-	}
-	if task.Annotations != nil {
-		if traceparent := strings.TrimSpace(task.Annotations[labels.AnnotationTraceParent]); traceparent != "" {
-			env = setHarnessTurnEnv(env, workerenv.TraceParent, traceparent)
-		}
-	}
-	if parentTask := labels.ParentTaskName(task.Labels, task.Annotations); parentTask != "" {
-		env = append(env, harness.TurnEnvVar{Name: workerenv.ParentTask, Value: parentTask})
-	}
-	if taskRequestsReadOnlyAgent(task) {
-		env = setHarnessTurnEnv(env, workerenv.AgentReadOnly, scheduledRunLabelValue)
-		env = setHarnessTurnEnv(env, workerenv.ResultStdout, scheduledRunLabelValue)
-	}
-	return env, nil
-}
-
-// harnessWrapperTurnEnv intentionally does not accept a Provider: type: agent tasks with
-// Agent.providerRef are rejected by validateTaskAgentCompatibility. CLI runtime
-// credentials come from Agent.spec.secretRef and Task.spec.secretRef.
-func (r *TaskReconciler) harnessWrapperTurnEnv(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	agent *corev1alpha1.Agent,
-) ([]harness.TurnEnvVar, error) {
-	if err := validateHarnessWrapperRestrictedAgentRuntime(task, agent); err != nil {
-		return nil, err
-	}
-	env, err := r.harnessWrapperBaseTurnEnv(ctx, task)
-	if err != nil {
-		return nil, err
-	}
-	workspaceGitEnv, err := r.harnessWrapperWorkspaceGitSecretEnv(ctx, task)
-	if err != nil {
-		return nil, err
-	}
-	agentSecretEnv, err := r.harnessWrapperAgentSecretEnv(ctx, task, agent)
-	if err != nil {
-		return nil, err
-	}
-	env = append(env, agentSecretEnv...)
-	if !taskRequestsReadOnlyAgent(task) && !taskRequestsRuntimeAuthOnly(task) {
-		taskSecretEnv, err := r.harnessWrapperTaskSecretEnv(ctx, task)
-		if err != nil {
-			return nil, err
-		}
-		env = append(env, taskSecretEnv...)
-	}
-	// Workspace credentials are used by root-side clone/fetch/push preparation and
-	// must remain authoritative over broad runtime Secret keys such as GIT_TOKEN.
-	env = append(env, workspaceGitEnv...)
-	return env, nil
-}
-
-func validateHarnessWrapperRestrictedAgentRuntime(task *corev1alpha1.Task, agent *corev1alpha1.Agent) error {
-	if err := validateReadOnlyAgentRuntime(task, agent); err != nil {
-		return err
-	}
-	if !taskRequestsRuntimeAuthOnly(task) || agent == nil || agent.Spec.Runtime == nil || agent.Spec.Runtime.RuntimeRef == nil {
-		return nil
-	}
-	if runtimeRefName := strings.TrimSpace(agent.Spec.Runtime.RuntimeRef.Name); runtimeRefName != "" {
-		return fmt.Errorf("runtime-auth-only tasks do not support external runtimeRef %q", runtimeRefName)
-	}
-	return nil
-}
-
-func (r *TaskReconciler) harnessWrapperWorkspaceGitSecretEnv(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-) ([]harness.TurnEnvVar, error) {
-	ws := effectiveWorkspace(task)
-	if ws == nil || ws.GitSecretRef == nil || strings.TrimSpace(ws.GitSecretRef.Name) == "" {
-		return nil, nil
-	}
-	secret := &corev1.Secret{}
-	key := ctrlclient.ObjectKey{Name: ws.GitSecretRef.Name, Namespace: task.Namespace}
-	if err := r.Get(ctx, key, secret); err != nil {
-		return nil, fmt.Errorf("resolve harness runtime git credential Secret %s/%s: %w", key.Namespace, key.Name, err)
-	}
-	var token string
-	for _, key := range []string{"token", "password", workerenv.GitHubToken} {
-		if value := strings.TrimSpace(string(secret.Data[key])); value != "" {
-			token = value
-			break
-		}
-	}
-	if token == "" {
-		return nil, fmt.Errorf("workspace git secret %q must contain token, password, or %s", ws.GitSecretRef.Name, workerenv.GitHubToken)
-	}
-	env := []harness.TurnEnvVar{
-		{Name: workerenv.GitToken, Value: token},
-		{Name: workerenv.GitAskpass, Value: "/bin/echo-token"},
-	}
-	if username := strings.TrimSpace(string(secret.Data["username"])); username != "" {
-		env = append(env, harness.TurnEnvVar{Name: workerenv.GitUsername, Value: username})
-	}
-	return env, nil
-}
-
-func (r *TaskReconciler) harnessWrapperAgentSecretEnv(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	agent *corev1alpha1.Agent,
-) ([]harness.TurnEnvVar, error) {
-	if taskRequestsRuntimeAuthOnly(task) {
-		if runtimeRefName := agentHarnessRuntimeRefName(agent); runtimeRefName != "" {
-			return nil, fmt.Errorf("runtime-auth-only tasks do not support external runtimeRef %q", runtimeRefName)
-		}
-		secretNamespace, secretName, err := scopedAgentRuntimeSecretCoordinates(task, agent)
-		if err != nil {
-			return nil, err
-		}
-		if secretName == "" {
-			return nil, nil
-		}
-		secret := &corev1.Secret{}
-		key := ctrlclient.ObjectKey{Name: secretName, Namespace: secretNamespace}
-		if err := r.Get(ctx, key, secret); err != nil {
-			return nil, fmt.Errorf("resolve harness runtime credential Secret %s/%s: %w", key.Namespace, key.Name, err)
-		}
-		if err := validateScopedAgentRuntimeBinding(task, agent, secret); err != nil {
-			return nil, err
-		}
-		env, err := harnessWrapperSecretEnvFromSecret(key, secret)
-		if err != nil {
-			return nil, err
-		}
-		allowedKeys, credentialKeys, err := scopedAgentRuntimeSecretKeys(agent)
-		if err != nil {
-			return nil, err
-		}
-		filtered := filterHarnessTurnEnv(env, allowedKeys)
-		if !harnessTurnEnvHasAny(filtered, credentialKeys) {
-			return nil, fmt.Errorf("runtime-auth-only agent secret contains no supported credentials")
-		}
-		return filtered, nil
-	}
-	if agent == nil || agent.Spec.SecretRef == nil || strings.TrimSpace(agent.Spec.SecretRef.Name) == "" {
-		return nil, nil
-	}
-	env, err := r.harnessWrapperSecretEnv(ctx, ctrlclient.ObjectKey{Name: agent.Spec.SecretRef.Name, Namespace: task.Namespace})
-	if err != nil {
-		return nil, err
-	}
-	if !taskRequestsReadOnlyAgent(task) {
-		return env, nil
-	}
-	allowedKeys, err := readOnlyAgentRuntimeSecretKeys(agent)
-	if err != nil {
-		return nil, err
-	}
-	return filterHarnessTurnEnv(env, allowedKeys), nil
-}
-
-func (r *TaskReconciler) harnessWrapperSecretEnv(
-	ctx context.Context,
-	key ctrlclient.ObjectKey,
-) ([]harness.TurnEnvVar, error) {
-	secret := &corev1.Secret{}
-	if err := r.Get(ctx, key, secret); err != nil {
-		return nil, fmt.Errorf("resolve harness runtime credential Secret %s/%s: %w", key.Namespace, key.Name, err)
-	}
-	return harnessWrapperSecretEnvFromSecret(key, secret)
-}
-
-func harnessWrapperSecretEnvFromSecret(key ctrlclient.ObjectKey, secret *corev1.Secret) ([]harness.TurnEnvVar, error) {
-	env := make([]harness.TurnEnvVar, 0, len(secret.Data))
-	for name, raw := range secret.Data {
-		name = strings.TrimSpace(name)
-		if name == "" {
-			continue
-		}
-		if !harnessWrapperEnvNameValid(name) {
-			continue
-		}
-		if harnessWrapperPrivateEnvName(name) {
-			return nil, fmt.Errorf(
-				"harness runtime credential Secret %s/%s key %q is reserved for wrapper configuration",
-				key.Namespace,
-				key.Name,
-				name,
-			)
-		}
-		if harnessWrapperRootEnvNameBlocked(name) && !harnessWrapperRuntimeSecretEnvAllowed(name) {
-			return nil, fmt.Errorf(
-				"harness runtime credential Secret %s/%s key %q is reserved for controller-managed runtime configuration",
-				key.Namespace,
-				key.Name,
-				name,
-			)
-		}
-		if len(raw) == 0 {
-			continue
-		}
-		env = append(env, harness.TurnEnvVar{Name: name, Value: string(raw)})
-	}
-	return env, nil
-}
-
-func (r *TaskReconciler) harnessWrapperTaskSecretEnv(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-) ([]harness.TurnEnvVar, error) {
-	if task == nil || task.Spec.SecretRef == nil || strings.TrimSpace(task.Spec.SecretRef.Name) == "" {
-		return nil, nil
-	}
-	namespace := strings.TrimSpace(task.Spec.SecretRef.Namespace)
-	if namespace == "" {
-		namespace = task.Namespace
-	}
-	if namespace != task.Namespace {
-		return nil, fmt.Errorf("task secretRef namespace %q does not match task namespace %q", namespace, task.Namespace)
-	}
-	return r.harnessWrapperSecretEnv(ctx, ctrlclient.ObjectKey{Name: task.Spec.SecretRef.Name, Namespace: namespace})
-}
-
-func harnessTurnEnvHasAny(env []harness.TurnEnvVar, names []string) bool {
-	wanted := make(map[string]struct{}, len(names))
-	for _, name := range names {
-		wanted[strings.TrimSpace(name)] = struct{}{}
-	}
-	for _, item := range env {
-		if _, ok := wanted[item.Name]; ok && strings.TrimSpace(item.Value) != "" {
-			return true
-		}
-	}
-	return false
-}
-
-func filterHarnessTurnEnv(env []harness.TurnEnvVar, allowedKeys []string) []harness.TurnEnvVar {
-	if len(env) == 0 || len(allowedKeys) == 0 {
-		return nil
-	}
-	allowed := make(map[string]struct{}, len(allowedKeys))
-	for _, key := range allowedKeys {
-		allowed[strings.TrimSpace(key)] = struct{}{}
-	}
-	out := make([]harness.TurnEnvVar, 0, len(env))
-	for _, item := range env {
-		if _, ok := allowed[item.Name]; ok {
-			out = append(out, item)
-		}
-	}
-	return out
-}
-
-func setHarnessTurnEnv(env []harness.TurnEnvVar, name, value string) []harness.TurnEnvVar {
-	for i, item := range env {
-		if item.Name == name {
-			env[i].Value = value
-			return env
-		}
-	}
-	return append(env, harness.TurnEnvVar{Name: name, Value: value})
-}
-
-func harnessWrapperReadOnlyEnvBlocked(name string) bool {
-	name = strings.TrimSpace(name)
-	if strings.HasPrefix(name, "GIT_CONFIG_") || strings.HasPrefix(name, "DYLD_") {
-		return true
-	}
-	switch name {
-	case workerenv.AgentReadOnly,
-		workerenv.ResultStdout,
-		workerenv.AllowBash,
-		workerenv.AllowedTools,
-		workerenv.DisallowedTools,
-		workerenv.ClaudeBare,
-		workerenv.ClaudeDisableSettingSources,
-		workerenv.ClaudePermissionMode,
-		workerenv.CodexDisableSandbox,
-		workerenv.CodexSandboxMode,
-		"NODE_OPTIONS",
-		"NODE_PATH",
-		"HOME",
-		"ZDOTDIR",
-		"CODEX_HOME",
-		"BASH_ENV",
-		"ENV",
-		"LD_PRELOAD",
-		"LD_AUDIT",
-		"LD_LIBRARY_PATH",
-		"PYTHONPATH",
-		"PERL5OPT",
-		"RUBYOPT",
-		"NPM_CONFIG_USERCONFIG",
-		"XDG_CONFIG_HOME",
-		"XDG_DATA_HOME":
-		return true
-	default:
-		return false
-	}
-}
-
-func (r *TaskReconciler) resolveHarnessWrapperTaskEnvValueFrom(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	item corev1.EnvVar,
-) (string, bool, error) {
-	if item.ValueFrom == nil {
-		return item.Value, true, nil
-	}
-	name := strings.TrimSpace(item.Name)
-	source := item.ValueFrom
-	switch {
-	case source.FieldRef != nil:
-		switch strings.TrimSpace(source.FieldRef.FieldPath) {
-		case "metadata.name":
-			return task.Name, true, nil
-		case "metadata.namespace":
-			return task.Namespace, true, nil
-		case "metadata.uid":
-			return string(task.UID), true, nil
-		default:
-			return "", false, fmt.Errorf("task env %q fieldRef %q is not supported by harness runtime", name, source.FieldRef.FieldPath)
-		}
-	case source.ConfigMapKeyRef != nil:
-		return r.resolveHarnessWrapperConfigMapEnv(ctx, task, name, source.ConfigMapKeyRef)
-	default:
-		return "", false, fmt.Errorf("task env %q uses unsupported valueFrom source for harness runtime", name)
-	}
-}
-
-func (r *TaskReconciler) resolveHarnessWrapperConfigMapEnv(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	envName string,
-	ref *corev1.ConfigMapKeySelector,
-) (string, bool, error) {
-	if ref == nil || strings.TrimSpace(ref.Name) == "" || strings.TrimSpace(ref.Key) == "" {
-		return "", false, fmt.Errorf("task env %q configMapKeyRef name and key are required", envName)
-	}
-	cm := &corev1.ConfigMap{}
-	key := ctrlclient.ObjectKey{Name: strings.TrimSpace(ref.Name), Namespace: task.Namespace}
-	if err := r.Get(ctx, key, cm); err != nil {
-		if ref.Optional != nil && *ref.Optional && apierrors.IsNotFound(err) {
-			return "", false, nil
-		}
-		return "", false, fmt.Errorf("resolve task env %q ConfigMap %s/%s: %w", envName, key.Namespace, key.Name, err)
-	}
-	value, ok := cm.Data[ref.Key]
-	if !ok {
-		if ref.Optional != nil && *ref.Optional {
-			return "", false, nil
-		}
-		return "", false, fmt.Errorf("resolve task env %q ConfigMap %s/%s key %q: not found", envName, key.Namespace, key.Name, ref.Key)
-	}
-	return value, true, nil
-}
-
-func harnessWrapperTaskEnvValueFromSupported(source *corev1.EnvVarSource) bool {
-	if source == nil {
-		return true
-	}
-	if source.SecretKeyRef != nil || source.ResourceFieldRef != nil {
-		return false
-	}
-	count := 0
-	if source.FieldRef != nil {
-		count++
-	}
-	if source.ConfigMapKeyRef != nil {
-		count++
-	}
-	return count == 1
-}
-
-func validateHarnessWrapperTaskEnv(env []corev1.EnvVar) error {
-	for i, item := range env {
-		name := strings.TrimSpace(item.Name)
-		if name == "" {
-			return fmt.Errorf("task env %d name is required", i)
-		}
-		if !harnessWrapperEnvNameValid(name) {
-			return fmt.Errorf("task env %q has an invalid name", name)
-		}
-		if item.ValueFrom != nil && !harnessWrapperTaskEnvValueFromSupported(item.ValueFrom) {
-			return fmt.Errorf("task env %q uses unsupported valueFrom source for harness runtime", name)
-		}
-		if harnessWrapperPrivateEnvName(name) || harnessWrapperRootEnvNameBlocked(name) || harnessWrapperEnvNameLooksSecret(name) {
-			return fmt.Errorf("task env %q is not supported by harness runtime", name)
-		}
-	}
-	return nil
-}
-
-func harnessWrapperPrivateEnvName(name string) bool {
-	return strings.HasPrefix(strings.TrimSpace(name), "ORKA_HARNESS_WRAPPER_")
-}
-
-func harnessWrapperRootEnvNameBlocked(name string) bool {
-	switch strings.ToUpper(strings.TrimSpace(name)) {
-	case workerenv.ControllerURL,
-		workerenv.ResultEndpoint,
-		workerenv.GitAskpass,
-		workerenv.OpenAIBaseURL,
-		workerenv.ServiceAccountToken,
-		workerenv.ServiceAccountTokenPath,
-		"ORKA_ARTIFACTS_DIR",
-		"HTTP_PROXY",
-		"HTTPS_PROXY",
-		"ALL_PROXY",
-		"NO_PROXY":
-		return true
-	default:
-		return false
-	}
-}
-
-func harnessWrapperEnvNameValid(name string) bool {
-	name = strings.TrimSpace(name)
-	if name == "" {
-		return false
-	}
-	for i, r := range name {
-		switch {
-		case r == '_', r >= 'A' && r <= 'Z', r >= 'a' && r <= 'z':
-		case i > 0 && r >= '0' && r <= '9':
-		default:
-			return false
-		}
-	}
-	return true
-}
-
-func harnessWrapperRuntimeSecretEnvAllowed(name string) bool {
-	switch strings.TrimSpace(name) {
-	case workerenv.OpenAIBaseURL, workerenv.AnthropicBaseURL, workerenv.AIBaseURL:
-		return true
-	default:
-		return false
-	}
-}
-
-func harnessWrapperEnvNameLooksSecret(name string) bool {
-	upper := strings.ToUpper(strings.TrimSpace(name))
-	for _, marker := range []string{"TOKEN", "SECRET", "PASSWORD", "PASSWD", "API_KEY", "ACCESS_KEY", "PRIVATE_KEY", "CREDENTIAL", "AUTHORIZATION"} {
-		if strings.Contains(upper, marker) {
-			return true
-		}
-	}
-	return false
-}
-
-func (r *TaskReconciler) resolveHarnessWrapperConfigMapValue(
-	ctx context.Context,
-	namespace string,
-	ref *corev1alpha1.ConfigMapKeySelector,
-) (string, error) {
-	if ref == nil {
-		return "", nil
-	}
-	cm := &corev1.ConfigMap{}
-	if err := r.Get(ctx, ctrlclient.ObjectKey{Name: ref.Name, Namespace: namespace}, cm); err != nil {
-		return "", fmt.Errorf("resolve harness runtime system prompt ConfigMap %s/%s: %w", namespace, ref.Name, err)
-	}
-	value, ok := cm.Data[ref.Key]
-	if !ok {
-		return "", fmt.Errorf("resolve harness runtime system prompt ConfigMap %s/%s key %q: key not found", namespace, ref.Name, ref.Key)
-	}
-	return value, nil
-}
-
-func harnessWrapperTurnID(task *corev1alpha1.Task, attempts int32) harness.HarnessTurnID {
-	identity := fmt.Sprintf("%s/%s/%s/%d", task.Namespace, task.Name, task.UID, attempts)
-	sum := sha256.Sum256([]byte(identity))
-	prefix := harnessWrapperTurnIDPrefix(task.Name)
-	return harness.HarnessTurnID(fmt.Sprintf("%s-%s-%d", prefix, hex.EncodeToString(sum[:])[:12], attempts))
-}
-
-func harnessWrapperTurnIDPrefix(value string) string {
-	value = strings.ToLower(strings.TrimSpace(value))
-	var out strings.Builder
-	for _, r := range value {
-		switch {
-		case r >= 'a' && r <= 'z', r >= '0' && r <= '9':
-			out.WriteRune(r)
-		case r == '-', r == '_', r == '.':
-			out.WriteRune(r)
-		default:
-			out.WriteByte('-')
-		}
-		if out.Len() >= 40 {
-			break
-		}
-	}
-	prefix := strings.Trim(out.String(), "-_.")
-	if prefix == "" {
-		return "turn"
-	}
-	return prefix
-}
-
-func harnessWrapperRuntimeSessionIdentity(task *corev1alpha1.Task, agent *corev1alpha1.Agent, runtimeName string) harness.RuntimeSessionIdentity {
-	input := harness.RuntimeSessionIdentityInput{
-		Namespace:   "default",
-		SessionName: "default",
-		RuntimeName: runtimeName,
-		Provider:    harness.ProviderKindKubernetesService,
-	}
-	if task != nil {
-		input.Namespace = task.Namespace
-		input.TaskName = task.Name
-		input.TaskUID = string(task.UID)
-		input.ActiveTask = task.Name
-		input.SessionName = ""
-		if task.Spec.SessionRef != nil && !task.Spec.SessionRef.PromptIncluded {
-			input.SessionName = task.Spec.SessionRef.Name
-		}
-	}
-	if agent != nil {
-		input.AgentName = agent.Name
-	}
-	return harness.ResolveRuntimeSessionIdentity(input)
-}
-
-func harnessWrapperRuntimeSessionID(task *corev1alpha1.Task, runtimeName string) harness.RuntimeSessionID {
-	return harnessWrapperRuntimeSessionIdentity(task, nil, runtimeName).ID
-}
-
-func harnessWrapperSessionName(task *corev1alpha1.Task) string {
-	if task != nil && task.Spec.SessionRef != nil && strings.TrimSpace(task.Spec.SessionRef.Name) != "" {
-		return strings.TrimSpace(task.Spec.SessionRef.Name)
-	}
-	if task != nil {
-		return task.Name
-	}
-	return "default" //nolint:goconst
-}
-
-func harnessWrapperTaskAgentName(task *corev1alpha1.Task) string {
-	if task != nil && task.Spec.AgentRef != nil {
-		return task.Spec.AgentRef.Name
-	}
-	return ""
-}
-
-func harnessWrapperLastFrameSeq(task *corev1alpha1.Task) int64 {
-	if task == nil || task.Annotations == nil {
-		return 0
-	}
-	seq, err := strconv.ParseInt(strings.TrimSpace(task.Annotations[harnessWrapperLastFrameSeqAnno]), 10, 64)
-	if err != nil || seq < 0 {
-		return 0
-	}
-	return seq
-}
-
-func (r *TaskReconciler) patchHarnessWrapperLastFrameSeq(ctx context.Context, task *corev1alpha1.Task, seq int64) error {
-	patch := ctrlclient.MergeFrom(task.DeepCopy())
-	if task.Annotations == nil {
-		task.Annotations = map[string]string{}
-	}
-	task.Annotations[harnessWrapperLastFrameSeqAnno] = strconv.FormatInt(seq, 10)
-	return r.Patch(ctx, task, patch)
-}
-
-func harnessWrapperBrokeredContinuationPending(task *corev1alpha1.Task) bool {
-	if task == nil || task.Annotations == nil {
-		return false
-	}
-	return strings.EqualFold(strings.TrimSpace(task.Annotations[harnessWrapperBrokeredContinuationAnno]), scheduledRunLabelValue)
-}
-
-func (r *TaskReconciler) patchHarnessWrapperBrokeredContinuationPending(
-	ctx context.Context,
-	task *corev1alpha1.Task,
-	pending bool,
-) error {
-	latest := &corev1alpha1.Task{}
-	if err := r.Get(ctx, ctrlclient.ObjectKey{Name: task.Name, Namespace: task.Namespace}, latest); err != nil {
-		return err
-	}
-	patch := ctrlclient.MergeFrom(latest.DeepCopy())
-	if latest.Annotations == nil {
-		latest.Annotations = map[string]string{}
-	}
-	if pending {
-		latest.Annotations[harnessWrapperBrokeredContinuationAnno] = scheduledRunLabelValue
-	} else {
-		delete(latest.Annotations, harnessWrapperBrokeredContinuationAnno)
-	}
-	if err := r.Patch(ctx, latest, patch); err != nil {
-		return err
-	}
-	latest.DeepCopyInto(task)
-	return nil
-}
diff --git a/internal/controller/harness_wrapper_test.go b/internal/controller/harness_wrapper_test.go
deleted file mode 100644
index 73d8a7c12..000000000
--- a/internal/controller/harness_wrapper_test.go
+++ /dev/null
@@ -1,3609 +0,0 @@
-package controller
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"maps"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"sync/atomic"
-	"testing"
-	"time"
-	"unicode/utf8"
-
-	corev1 "k8s.io/api/core/v1"
-	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
-	"k8s.io/apimachinery/pkg/api/meta"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/types"
-	ctrlclient "sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
-
-	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
-	"github.com/orka-agents/orka/internal/events"
-	"github.com/orka-agents/orka/internal/harness"
-	"github.com/orka-agents/orka/internal/harness/harnesstest"
-	"github.com/orka-agents/orka/internal/labels"
-	"github.com/orka-agents/orka/internal/outboundaccess"
-	"github.com/orka-agents/orka/internal/store"
-	"github.com/orka-agents/orka/internal/workerenv"
-	"github.com/orka-agents/orka/workers/common"
-	"github.com/orka-agents/orka/workers/harness/cliwrapper"
-)
-
-const testFalseValue = "false"
-
-func TestHarnessWrapperTaskRunsThroughTurnRunner(t *testing.T) {
-	cfg := cliwrapper.DefaultConfig()
-	cfg.AllowUnauthenticated = true
-	server, err := cliwrapper.NewServer(cfg, &cliwrapper.FakeAdapter{Behavior: cliwrapper.FakeBehaviorSuccess, RuntimeName: "codex"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	srv := httptest.NewServer(server.Handler())
-	defer srv.Close()
-	t.Setenv(harnessWrapperEndpointEnv, srv.URL)
-
-	task, agent := harnessWrapperTaskAndAgent()
-	secret := attachHarnessWrapperRuntimeSecret(task, agent)
-	r := newUnitReconciler(newTestScheme(), task, agent, secret)
-	updated := runHarnessWrapperTaskToCompletion(t, r, task)
-	if updated.Status.Phase != corev1alpha1.TaskPhaseSucceeded {
-		t.Fatalf("phase = %s, want Succeeded (message=%s)", updated.Status.Phase, updated.Status.Message)
-	}
-	if updated.Status.JobName != "" {
-		t.Fatalf("JobName = %q, want no worker job", updated.Status.JobName)
-	}
-	if updated.Status.ResultRef == nil || !updated.Status.ResultRef.Available {
-		t.Fatalf("ResultRef = %#v, want available result reference", updated.Status.ResultRef)
-	}
-	result, err := r.ResultStore.GetResult(context.Background(), task.Namespace, task.Name)
-	if err != nil {
-		t.Fatalf("GetResult: %v", err)
-	}
-	if string(result) != "ok" {
-		t.Fatalf("result = %q, want ok", string(result))
-	}
-	eventsList, err := r.ExecutionEventStore.ListExecutionEvents(context.Background(), store.ExecutionEventFilter{Namespace: task.Namespace, StreamID: task.Name})
-	if err != nil {
-		t.Fatalf("ListExecutionEvents: %v", err)
-	}
-	if !hasExecutionEventType(eventsList, events.ExecutionEventTypeAgentRuntimeCompleted) {
-		t.Fatalf("events = %#v, want harness mapped runtime completed", eventsList)
-	}
-}
-
-func TestHarnessWrapperStartClearsStaleResult(t *testing.T) {
-	cfg := cliwrapper.DefaultConfig()
-	cfg.AllowUnauthenticated = true
-	server, err := cliwrapper.NewServer(cfg, &cliwrapper.FakeAdapter{Behavior: cliwrapper.FakeBehaviorSuccess, RuntimeName: "codex"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	srv := httptest.NewServer(server.Handler())
-	defer srv.Close()
-	t.Setenv(harnessWrapperEndpointEnv, srv.URL)
-
-	task, agent := harnessWrapperTaskAndAgent()
-	secret := attachHarnessWrapperRuntimeSecret(task, agent)
-	r := newUnitReconciler(newTestScheme(), task, agent, secret)
-	if err := r.ResultStore.SaveResult(context.Background(), task.Namespace, task.Name, []byte("stale")); err != nil {
-		t.Fatal(err)
-	}
-	_ = runHarnessWrapperTaskToRunning(t, r, task)
-	if _, err := r.ResultStore.GetResult(context.Background(), task.Namespace, task.Name); !errors.Is(err, store.ErrNotFound) {
-		t.Fatalf("GetResult() after new turn start = %v, want ErrNotFound", err)
-	}
-}
-
-func TestHarnessWrapperControllerSendsBearerToken(t *testing.T) {
-	t.Setenv(harnessWrapperAuthValueEnv, "mock-token")
-	cfg := cliwrapper.DefaultConfig()
-	cfg.AuthValue = "mock-token"
-	server, err := cliwrapper.NewServer(cfg, &cliwrapper.FakeAdapter{Behavior: cliwrapper.FakeBehaviorSuccess, RuntimeName: "codex"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	srv := httptest.NewServer(server.Handler())
-	defer srv.Close()
-	t.Setenv(harnessWrapperEndpointEnv, srv.URL)
-
-	task, agent := harnessWrapperTaskAndAgent()
-	secret := attachHarnessWrapperRuntimeSecret(task, agent)
-	r := newUnitReconciler(newTestScheme(), task, agent, secret)
-	updated := runHarnessWrapperTaskToCompletion(t, r, task)
-	if updated.Status.Phase != corev1alpha1.TaskPhaseSucceeded {
-		t.Fatalf("phase = %s, want Succeeded", updated.Status.Phase)
-	}
-}
-
-func TestPatchHarnessWrapperStartedPreservesPlannedTurnAnnotationsFromLocalTask(t *testing.T) {
-	task, _ := harnessWrapperTaskAndAgent()
-	expected := map[string]string{
-		harnessWrapperTurnIDAnnotation:  "turn-1",
-		harnessWrapperRuntimeAnnotation: "runtime-1",
-		harnessWrapperCorrelationIDAnno: "correlation-1",
-		harnessWrapperLastFrameSeqAnno:  "0",
-		harnessWrapperPlannedAtAnno:     time.Now().UTC().Format(time.RFC3339Nano),
-		harnessWrapperMetadataAnno:      ` {"runtime":"claude","wrapper":"cli"} `,
-	}
-	local := task.DeepCopy()
-	local.Annotations = map[string]string{}
-	maps.Copy(local.Annotations, expected)
-	local.Annotations[harnessWrapperOutputFetchRetriesAnno] = "1"
-	r := newUnitReconciler(newTestScheme(), task)
-
-	if err := r.patchHarnessWrapperStarted(context.Background(), local); err != nil {
-		t.Fatalf("patchHarnessWrapperStarted: %v", err)
-	}
-
-	var updated corev1alpha1.Task
-	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &updated); err != nil {
-		t.Fatalf("get task: %v", err)
-	}
-	for _, key := range []string{
-		harnessWrapperTurnIDAnnotation,
-		harnessWrapperRuntimeAnnotation,
-		harnessWrapperCorrelationIDAnno,
-		harnessWrapperLastFrameSeqAnno,
-		harnessWrapperPlannedAtAnno,
-		harnessWrapperMetadataAnno,
-	} {
-		if updated.Annotations[key] != expected[key] {
-			t.Fatalf("annotation %s = %q, want %q", key, updated.Annotations[key], expected[key])
-		}
-	}
-	if updated.Annotations[harnessWrapperStartedAnno] != scheduledRunLabelValue {
-		t.Fatalf("started annotation = %q, want %q", updated.Annotations[harnessWrapperStartedAnno], scheduledRunLabelValue)
-	}
-	if _, ok := updated.Annotations[harnessWrapperOutputFetchRetriesAnno]; ok {
-		t.Fatalf("output retry annotation should not be restored during start: %#v", updated.Annotations)
-	}
-}
-
-func TestHarnessWrapperTaskRunsAgainstRuntimeRefAgentRuntime(t *testing.T) {
-	server := harnesstest.NewFakeHarnessServer(harnesstest.FakeHarnessConfig{RuntimeName: "fibey-agentkit"})
-	defer server.Close()
-
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "fibey-agentkit"}}
-	runtime, token := harnessWrapperReadyAgentRuntime(task.Namespace, server.URL())
-	r := newUnitReconciler(newTestScheme(), task, agent, runtime, token)
-
-	updated := runHarnessWrapperTaskToCompletion(t, r, task)
-	if updated.Status.Phase != corev1alpha1.TaskPhaseSucceeded {
-		t.Fatalf("phase = %s, want Succeeded (message=%s)", updated.Status.Phase, updated.Status.Message)
-	}
-	if got := updated.Annotations[harnessWrapperRuntimeRefAnno]; got != "fibey-agentkit" {
-		t.Fatalf("runtimeRef annotation = %q, want fibey-agentkit", got)
-	}
-	if got := updated.Annotations[harnessWrapperContractAnno]; got != "orka.harness.v1" {
-		t.Fatalf("contract annotation = %q, want orka.harness.v1", got)
-	}
-}
-
-func TestHarnessWrapperBrokeredReadToolExecutesAndContinuesRuntime(t *testing.T) {
-	var toolCalls atomic.Int32
-	var idempotencyHeader atomic.Value
-	toolServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		toolCalls.Add(1)
-		idempotencyHeader.Store(r.Header.Get("Idempotency-Key"))
-		var body map[string]any
-		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-			t.Fatalf("decode tool request: %v", err)
-		}
-		if body["incident"] != "quincy-north" {
-			t.Fatalf("tool body = %#v, want incident", body)
-		}
-		_, _ = w.Write([]byte(`{"success":true,"data":{"status":"investigating"}}`))
-	}))
-	defer toolServer.Close()
-
-	var started harness.StartTurnRequest
-	var continued harness.ContinueTurnRequest
-	continueCh := make(chan struct{})
-	runtimeServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch r.URL.Path {
-		case harness.CapabilitiesPath:
-			harness.WriteJSON(w, http.StatusOK, harness.CapabilitiesResponse{
-				Version:                 harness.ProtocolVersion,
-				ProtocolVersion:         harness.ProtocolVersion,
-				Transport:               harness.HTTPTransport,
-				RuntimeName:             "fibey-agentkit",
-				ProviderKind:            harness.ProviderKindRemote,
-				ToolExecutionModes:      []harness.ToolExecutionMode{harness.ToolExecutionModeObserved, harness.ToolExecutionModeBrokered},
-				BrokeredToolClasses:     []harness.BrokeredToolClass{harness.BrokeredToolClassRead},
-				SupportsCancel:          true,
-				SupportsRuntimeSessions: true,
-				SupportsContinuation:    true,
-			})
-		case harness.TurnsPath:
-			if err := json.NewDecoder(r.Body).Decode(&started); err != nil {
-				t.Fatalf("decode start turn: %v", err)
-			}
-			eventsPath, _ := harness.EventStreamPath(started.TurnID)
-			harness.WriteJSON(w, http.StatusAccepted, harness.StartTurnResponse{
-				Version:          harness.ProtocolVersion,
-				Accepted:         true,
-				RuntimeSessionID: started.RuntimeSessionID,
-				TurnID:           started.TurnID,
-				CorrelationID:    started.CorrelationID,
-				EventStreamPath:  eventsPath,
-			})
-		default:
-			turnID, resource, err := harness.ParseTurnResourcePath(r.URL.EscapedPath())
-			if err != nil || turnID != started.TurnID {
-				harness.WriteError(w, http.StatusNotFound, "not found")
-				return
-			}
-			switch resource {
-			case harness.TurnResourceEvents:
-				w.Header().Set("Content-Type", "text/event-stream")
-				_ = harness.WriteSSEFrame(w, harness.HarnessEventFrame{
-					Version:          harness.ProtocolVersion,
-					Type:             harness.FrameTurnStarted,
-					RuntimeSessionID: started.RuntimeSessionID,
-					TurnID:           started.TurnID,
-					CorrelationID:    started.CorrelationID,
-					Seq:              1,
-				})
-				_ = harness.WriteSSEFrame(w, harness.HarnessEventFrame{
-					Version:          harness.ProtocolVersion,
-					Type:             harness.FrameToolCallRequested,
-					RuntimeSessionID: started.RuntimeSessionID,
-					TurnID:           started.TurnID,
-					CorrelationID:    started.CorrelationID,
-					Seq:              2,
-					ToolName:         "read_incident",
-					ToolCallID:       "call-read-1",
-					Content:          json.RawMessage(`{"incident":"quincy-north"}`),
-				})
-				<-continueCh
-				_ = harness.WriteSSEFrame(w, harness.HarnessEventFrame{
-					Version:          harness.ProtocolVersion,
-					Type:             harness.FrameToolResultReceived,
-					RuntimeSessionID: started.RuntimeSessionID,
-					TurnID:           started.TurnID,
-					CorrelationID:    started.CorrelationID,
-					Seq:              3,
-					ToolName:         "read_incident",
-					ToolCallID:       "call-read-1",
-					Content:          continued.ToolResults[0].Output,
-				})
-				_ = harness.WriteSSEFrame(w, harness.HarnessEventFrame{
-					Version:          harness.ProtocolVersion,
-					Type:             harness.FrameTurnCompleted,
-					RuntimeSessionID: started.RuntimeSessionID,
-					TurnID:           started.TurnID,
-					CorrelationID:    started.CorrelationID,
-					Seq:              4,
-					Completed:        &harness.TurnCompleted{Result: "done", FinalEventSeq: 4},
-				})
-				_ = harness.WriteSSEDone(w)
-			case harness.TurnResourceContinue:
-				if err := json.NewDecoder(r.Body).Decode(&continued); err != nil {
-					t.Fatalf("decode continue turn: %v", err)
-				}
-				close(continueCh)
-				harness.WriteJSON(w, http.StatusAccepted, harness.ContinueTurnResponse{
-					Version:          harness.ProtocolVersion,
-					Accepted:         true,
-					RuntimeSessionID: continued.RuntimeSessionID,
-					TurnID:           continued.TurnID,
-					CorrelationID:    continued.CorrelationID,
-				})
-			default:
-				harness.WriteError(w, http.StatusNotFound, "not found")
-			}
-		}
-	}))
-	defer runtimeServer.Close()
-
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "fibey-agentkit"}}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"read_incident"}}
-	runtime, token := harnessWrapperReadyAgentRuntime(task.Namespace, runtimeServer.URL)
-	runtime.Status.ObservedCapabilities.ProviderKind = string(harness.ProviderKindRemote)
-	runtime.Status.ObservedCapabilities.ToolExecutionModes = []corev1alpha1.AgentRuntimeToolExecutionMode{
-		corev1alpha1.AgentRuntimeToolExecutionModeObserved,
-		corev1alpha1.AgentRuntimeToolExecutionModeBrokered,
-	}
-	runtime.Status.ObservedCapabilities.BrokeredToolClasses = []corev1alpha1.AgentRuntimeBrokeredToolClass{
-		corev1alpha1.AgentRuntimeBrokeredToolClassRead,
-	}
-	runtime.Status.ObservedCapabilities.SupportsContinuation = true
-	tool := &corev1alpha1.Tool{
-		ObjectMeta: metav1.ObjectMeta{Name: "read_incident", Namespace: task.Namespace},
-		Spec: corev1alpha1.ToolSpec{
-			Description:       "Read incident status",
-			BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassRead,
-			HTTP:              &corev1alpha1.HTTPExecution{URL: toolServer.URL},
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, runtime, token, tool)
-
-	updated := runHarnessWrapperTaskToCompletion(t, r, task)
-	if updated.Status.Phase != corev1alpha1.TaskPhaseSucceeded {
-		t.Fatalf("phase = %s, want Succeeded (message=%s)", updated.Status.Phase, updated.Status.Message)
-	}
-	if started.ToolExecutionMode != harness.ToolExecutionModeBrokered {
-		t.Fatalf("ToolExecutionMode = %q, want brokered", started.ToolExecutionMode)
-	}
-	if toolCalls.Load() != 1 {
-		t.Fatalf("tool calls = %d, want 1", toolCalls.Load())
-	}
-	if got, _ := idempotencyHeader.Load().(string); got == "" {
-		t.Fatalf("Idempotency-Key header was not set")
-	}
-	if len(continued.ToolResults) != 1 || continued.ToolResults[0].ToolCallID != "call-read-1" {
-		t.Fatalf("continue tool results = %#v", continued.ToolResults)
-	}
-	listed, err := r.ExecutionEventStore.ListExecutionEvents(context.Background(), store.ExecutionEventFilter{
-		Namespace: task.Namespace,
-		StreamID:  task.Name,
-	})
-	if err != nil {
-		t.Fatalf("ListExecutionEvents: %v", err)
-	}
-	if !hasExecutionEventType(listed, events.ExecutionEventTypeToolCallCompleted) {
-		t.Fatalf("events = %#v, want brokered ToolCallCompleted", listed)
-	}
-}
-
-func TestHarnessWrapperBrokeredContinuationReconnectsAfterPauseStreamCloses(t *testing.T) {
-	toolServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		_, _ = w.Write([]byte(`{"success":true}`))
-	}))
-	defer toolServer.Close()
-
-	var started harness.StartTurnRequest
-	var continued atomic.Bool
-	var postContinuationPolls atomic.Int32
-	runtimeServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch r.URL.Path {
-		case harness.CapabilitiesPath:
-			harness.WriteJSON(w, http.StatusOK, harness.CapabilitiesResponse{
-				Version:                 harness.ProtocolVersion,
-				ProtocolVersion:         harness.ProtocolVersion,
-				Transport:               harness.HTTPTransport,
-				RuntimeName:             "async-runtime",
-				ProviderKind:            harness.ProviderKindRemote,
-				ToolExecutionModes:      []harness.ToolExecutionMode{harness.ToolExecutionModeObserved, harness.ToolExecutionModeBrokered},
-				BrokeredToolClasses:     []harness.BrokeredToolClass{harness.BrokeredToolClassRead},
-				SupportsCancel:          true,
-				SupportsRuntimeSessions: true,
-				SupportsContinuation:    true,
-			})
-		case harness.TurnsPath:
-			if err := json.NewDecoder(r.Body).Decode(&started); err != nil {
-				t.Fatalf("decode start turn: %v", err)
-			}
-			eventsPath, _ := harness.EventStreamPath(started.TurnID)
-			harness.WriteJSON(w, http.StatusAccepted, harness.StartTurnResponse{
-				Version:          harness.ProtocolVersion,
-				Accepted:         true,
-				RuntimeSessionID: started.RuntimeSessionID,
-				TurnID:           started.TurnID,
-				CorrelationID:    started.CorrelationID,
-				EventStreamPath:  eventsPath,
-			})
-		default:
-			turnID, resource, err := harness.ParseTurnResourcePath(r.URL.EscapedPath())
-			if err != nil || turnID != started.TurnID {
-				harness.WriteError(w, http.StatusNotFound, "not found")
-				return
-			}
-			switch resource {
-			case harness.TurnResourceEvents:
-				w.Header().Set("Content-Type", "text/event-stream")
-				afterSeq := strings.TrimSpace(r.URL.Query().Get("afterSeq"))
-				if afterSeq == "" || afterSeq == "0" {
-					_ = harness.WriteSSEFrame(w, harness.HarnessEventFrame{
-						Version:          harness.ProtocolVersion,
-						Type:             harness.FrameTurnStarted,
-						RuntimeSessionID: started.RuntimeSessionID,
-						TurnID:           started.TurnID,
-						CorrelationID:    started.CorrelationID,
-						Seq:              1,
-					})
-					_ = harness.WriteSSEFrame(w, harness.HarnessEventFrame{
-						Version:          harness.ProtocolVersion,
-						Type:             harness.FrameToolCallRequested,
-						RuntimeSessionID: started.RuntimeSessionID,
-						TurnID:           started.TurnID,
-						CorrelationID:    started.CorrelationID,
-						Seq:              2,
-						ToolName:         "read_incident",
-						ToolCallID:       "call-read-async",
-						Content:          json.RawMessage(`{"incident":"quincy-north"}`),
-					})
-					_ = harness.WriteSSEDone(w)
-					return
-				}
-				if afterSeq == "2" && continued.Load() && postContinuationPolls.Add(1) > 1 {
-					_ = harness.WriteSSEFrame(w, harness.HarnessEventFrame{
-						Version:          harness.ProtocolVersion,
-						Type:             harness.FrameToolResultReceived,
-						RuntimeSessionID: started.RuntimeSessionID,
-						TurnID:           started.TurnID,
-						CorrelationID:    started.CorrelationID,
-						Seq:              3,
-						ToolName:         "read_incident",
-						ToolCallID:       "call-read-async",
-						Content:          json.RawMessage(`{"success":true}`),
-					})
-					_ = harness.WriteSSEFrame(w, harness.HarnessEventFrame{
-						Version:          harness.ProtocolVersion,
-						Type:             harness.FrameTurnCompleted,
-						RuntimeSessionID: started.RuntimeSessionID,
-						TurnID:           started.TurnID,
-						CorrelationID:    started.CorrelationID,
-						Seq:              4,
-						Completed:        &harness.TurnCompleted{Result: "done", FinalEventSeq: 4},
-					})
-				}
-				_ = harness.WriteSSEDone(w)
-			case harness.TurnResourceContinue:
-				var request harness.ContinueTurnRequest
-				if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
-					t.Fatalf("decode continue turn: %v", err)
-				}
-				continued.Store(true)
-				harness.WriteJSON(w, http.StatusAccepted, harness.ContinueTurnResponse{
-					Version:          harness.ProtocolVersion,
-					Accepted:         true,
-					RuntimeSessionID: request.RuntimeSessionID,
-					TurnID:           request.TurnID,
-					CorrelationID:    request.CorrelationID,
-				})
-			default:
-				harness.WriteError(w, http.StatusNotFound, "not found")
-			}
-		}
-	}))
-	defer runtimeServer.Close()
-
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "async-runtime"}}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"read_incident"}}
-	runtime, token := harnessWrapperReadyAgentRuntime(task.Namespace, runtimeServer.URL)
-	runtime.Name = "async-runtime"
-	runtime.Status.ObservedCapabilities.RuntimeName = "async-runtime"
-	runtime.Status.ObservedCapabilities.ProviderKind = string(harness.ProviderKindRemote)
-	runtime.Status.ObservedCapabilities.ToolExecutionModes = []corev1alpha1.AgentRuntimeToolExecutionMode{
-		corev1alpha1.AgentRuntimeToolExecutionModeObserved,
-		corev1alpha1.AgentRuntimeToolExecutionModeBrokered,
-	}
-	runtime.Status.ObservedCapabilities.BrokeredToolClasses = []corev1alpha1.AgentRuntimeBrokeredToolClass{
-		corev1alpha1.AgentRuntimeBrokeredToolClassRead,
-	}
-	runtime.Status.ObservedCapabilities.SupportsContinuation = true
-	token.Labels[agentRuntimeAuthRefNameLabel] = runtime.Name
-	tool := &corev1alpha1.Tool{
-		ObjectMeta: metav1.ObjectMeta{Name: "read_incident", Namespace: task.Namespace},
-		Spec: corev1alpha1.ToolSpec{
-			Description:       "Read incident status",
-			BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassRead,
-			HTTP:              &corev1alpha1.HTTPExecution{URL: toolServer.URL},
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, runtime, token, tool)
-	running := runHarnessWrapperTaskToRunning(t, r, task)
-
-	result, err := r.handleRunning(context.Background(), &running)
-	if err != nil {
-		t.Fatalf("first handleRunning: %v", err)
-	}
-	if result.RequeueAfter <= 0 {
-		t.Fatalf("first handleRunning result = %#v, want requeue for continuation stream", result)
-	}
-	var afterFirst corev1alpha1.Task
-	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &afterFirst); err != nil {
-		t.Fatalf("get after first running: %v", err)
-	}
-	if afterFirst.Status.Phase != corev1alpha1.TaskPhaseRunning {
-		t.Fatalf("phase after first stream = %s, want Running (message=%s)", afterFirst.Status.Phase, afterFirst.Status.Message)
-	}
-	if got := harnessWrapperLastFrameSeq(&afterFirst); got != 2 {
-		t.Fatalf("last frame seq after continuation = %d, want 2", got)
-	}
-	if !harnessWrapperBrokeredContinuationPending(&afterFirst) {
-		t.Fatal("brokered continuation pending annotation was not persisted")
-	}
-
-	secondResult, err := r.handleRunning(context.Background(), &afterFirst)
-	if err != nil {
-		t.Fatalf("second handleRunning: %v", err)
-	}
-	if secondResult.RequeueAfter <= 0 {
-		t.Fatalf("second handleRunning result = %#v, want continued polling", secondResult)
-	}
-	var afterSecond corev1alpha1.Task
-	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &afterSecond); err != nil {
-		t.Fatalf("get after second running: %v", err)
-	}
-	if afterSecond.Status.Phase != corev1alpha1.TaskPhaseRunning {
-		t.Fatalf("phase after empty continuation poll = %s, want Running (message=%s)", afterSecond.Status.Phase, afterSecond.Status.Message)
-	}
-	if !harnessWrapperBrokeredContinuationPending(&afterSecond) {
-		t.Fatal("brokered continuation pending annotation was not retained")
-	}
-
-	if _, err := r.handleRunning(context.Background(), &afterSecond); err != nil {
-		t.Fatalf("third handleRunning: %v", err)
-	}
-	var completed corev1alpha1.Task
-	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &completed); err != nil {
-		t.Fatalf("get completed task: %v", err)
-	}
-	if completed.Status.Phase != corev1alpha1.TaskPhaseSucceeded {
-		t.Fatalf("completed phase = %s, want Succeeded (message=%s)", completed.Status.Phase, completed.Status.Message)
-	}
-}
-
-type captureBrokeredOutboundResolver struct {
-	request outboundaccess.ResolveRequest
-}
-
-func (r *captureBrokeredOutboundResolver) Resolve(_ context.Context, req outboundaccess.ResolveRequest) (outboundaccess.Resolution, error) {
-	r.request = req
-	return outboundaccess.Resolution{}, errors.New("captured outbound resolution")
-}
-
-func TestHarnessWrapperBrokeredPropagatesTransactionCredentialAuthority(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "runtime"}}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"read_incident"}}
-	task.Spec.Transaction = &corev1alpha1.TaskTransaction{
-		ID:     "txn-1",
-		Scopes: []string{"tenant:outbound-credentials:read"},
-		Context: map[string]string{
-			"secret": "resource-subject",
-		},
-	}
-	tool := &corev1alpha1.Tool{
-		ObjectMeta: metav1.ObjectMeta{Name: "read_incident", Namespace: task.Namespace},
-		Spec: corev1alpha1.ToolSpec{
-			Description:       "Read incident",
-			BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassRead,
-			HTTP: &corev1alpha1.HTTPExecution{
-				URL:                     "https://api.example.test/incidents",
-				OutboundAccessPolicyRef: &corev1alpha1.LocalObjectReference{Name: "resource-api"},
-			},
-		},
-	}
-	resolver := &captureBrokeredOutboundResolver{}
-	r := newUnitReconciler(newTestScheme(), task, agent, tool)
-	r.EnforceTransactionCredentialAuth = true
-	r.TransactionCredentialReadScopes = []string{"tenant:outbound-credentials:read"}
-	r.OutboundAccessResolver = resolver
-	frame := harness.HarnessEventFrame{
-		Version:          harness.ProtocolVersion,
-		Type:             harness.FrameToolCallRequested,
-		RuntimeSessionID: "runtime-session",
-		TurnID:           "turn-1",
-		CorrelationID:    "corr-1",
-		Seq:              1,
-		ToolName:         tool.Name,
-		ToolCallID:       "call-1",
-		Content:          json.RawMessage(`{"incident":"inc-1"}`),
-	}
-	result, err := r.handleHarnessBrokeredToolCall(context.Background(), task, agent, frame)
-	if err != nil {
-		t.Fatalf("handleHarnessBrokeredToolCall() error = %v", err)
-	}
-	if result.Error == nil || result.Error.Code != "tool_execution_failed" {
-		t.Fatalf("result = %#v, want captured tool_execution_failed", result)
-	}
-	if !resolver.request.CredentialAuthorityEnforced || !resolver.request.CredentialScopeAllowed || resolver.request.CredentialSecret != "resource-subject" {
-		t.Fatalf("resolver credential authority = enforced %t allowed %t secret %q", resolver.request.CredentialAuthorityEnforced, resolver.request.CredentialScopeAllowed, resolver.request.CredentialSecret)
-	}
-}
-
-func TestHarnessWrapperBrokeredRejectsUnauthorizedAuthSecretBeforeRead(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "runtime"}}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"read_incident"}}
-	task.Spec.Transaction = &corev1alpha1.TaskTransaction{ID: "txn-1"}
-	tool := &corev1alpha1.Tool{
-		ObjectMeta: metav1.ObjectMeta{Name: "read_incident", Namespace: task.Namespace},
-		Spec: corev1alpha1.ToolSpec{
-			Description:       "Read incident",
-			BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassRead,
-			HTTP: &corev1alpha1.HTTPExecution{
-				URL:           "https://api.example.test/incidents",
-				AuthSecretRef: &corev1alpha1.SecretKeySelector{Name: "resource-auth", Key: "token"},
-			},
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, tool)
-	r.EnforceTransactionCredentialAuth = true
-	frame := harness.HarnessEventFrame{
-		Version:          harness.ProtocolVersion,
-		Type:             harness.FrameToolCallRequested,
-		RuntimeSessionID: "runtime-session",
-		TurnID:           "turn-1",
-		CorrelationID:    "corr-1",
-		Seq:              1,
-		ToolName:         tool.Name,
-		ToolCallID:       "call-1",
-		Content:          json.RawMessage(`{"incident":"inc-1"}`),
-	}
-	result, err := r.handleHarnessBrokeredToolCall(context.Background(), task, agent, frame)
-	if err != nil {
-		t.Fatalf("handleHarnessBrokeredToolCall() error = %v", err)
-	}
-	if result.Error == nil || result.Error.Code != "credential_authority_unavailable" ||
-		!strings.Contains(result.Error.Message, "not authorized") {
-		t.Fatalf("result = %#v, want pre-read credential authority rejection", result)
-	}
-}
-
-func TestHarnessBrokeredTransactionCredentialAuthorityDisabledOutsideEnforceMode(t *testing.T) {
-	task, _ := harnessWrapperTaskAndAgent()
-	task.Spec.Transaction = &corev1alpha1.TaskTransaction{
-		ID:     "txn-1",
-		Scopes: []string{"tenant:outbound-credentials:read"},
-	}
-	r := newUnitReconciler(newTestScheme(), task)
-	r.TransactionCredentialReadScopes = []string{"tenant:outbound-credentials:read"}
-	enforced, allowed, secret := r.harnessBrokeredTransactionCredentialAuthority(task)
-	if enforced || !allowed || secret != "" {
-		t.Fatalf("credential authority = enforced %t allowed %t secret %q", enforced, allowed, secret)
-	}
-}
-
-func TestHarnessWrapperBrokeredContinuationMarkerIsWriteAhead(t *testing.T) {
-	var toolCalls atomic.Int32
-	toolServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		toolCalls.Add(1)
-		_, _ = w.Write([]byte(`{"success":true}`))
-	}))
-	defer toolServer.Close()
-
-	task, agent := harnessWrapperTaskAndAgent()
-	task.Annotations = map[string]string{
-		harnessWrapperMetadataAnno: `{"toolExecutionMode":"brokered","brokeredToolClassMap":"{\"read_incident\":\"read\"}"}`,
-	}
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "runtime"}}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"read_incident"}}
-	tool := &corev1alpha1.Tool{
-		ObjectMeta: metav1.ObjectMeta{Name: "read_incident", Namespace: task.Namespace},
-		Spec: corev1alpha1.ToolSpec{
-			Description:       "Read incident",
-			BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassRead,
-			HTTP:              &corev1alpha1.HTTPExecution{URL: toolServer.URL},
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, tool)
-
-	var markerPatchAttempts atomic.Int32
-	baseClient, ok := r.Client.(ctrlclient.WithWatch)
-	if !ok {
-		t.Fatalf("test client type = %T, want client.WithWatch", r.Client)
-	}
-	r.Client = interceptor.NewClient(baseClient, interceptor.Funcs{
-		Patch: func(ctx context.Context, c ctrlclient.WithWatch, obj ctrlclient.Object, patch ctrlclient.Patch, opts ...ctrlclient.PatchOption) error {
-			if current, ok := obj.(*corev1alpha1.Task); ok && harnessWrapperBrokeredContinuationPending(current) {
-				if markerPatchAttempts.Add(1) == 1 {
-					return errors.New("injected continuation marker patch failure")
-				}
-			}
-			return c.Patch(ctx, obj, patch, opts...)
-		},
-	})
-
-	var continueCalls atomic.Int32
-	var reconcilerForHandler = r
-	runtimeServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		continueCalls.Add(1)
-		var stored corev1alpha1.Task
-		if err := reconcilerForHandler.Get(req.Context(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &stored); err != nil {
-			t.Errorf("get task during continue: %v", err)
-		} else if !harnessWrapperBrokeredContinuationPending(&stored) {
-			t.Error("continue request arrived before continuation marker was persisted")
-		}
-		harness.WriteJSON(w, http.StatusAccepted, harness.ContinueTurnResponse{
-			Version:          harness.ProtocolVersion,
-			Accepted:         true,
-			RuntimeSessionID: "runtime-session",
-			TurnID:           "turn-1",
-			CorrelationID:    "corr-1",
-		})
-	}))
-	defer runtimeServer.Close()
-	client, err := harness.NewClient(runtimeServer.URL)
-	if err != nil {
-		t.Fatalf("NewClient() error = %v", err)
-	}
-	frame := harness.HarnessEventFrame{
-		Version:          harness.ProtocolVersion,
-		Type:             harness.FrameToolCallRequested,
-		RuntimeSessionID: "runtime-session",
-		TurnID:           "turn-1",
-		CorrelationID:    "corr-1",
-		Seq:              1,
-		ToolName:         tool.Name,
-		ToolCallID:       "call-1",
-		Content:          json.RawMessage(`{"incident":"inc-1"}`),
-	}
-
-	err = r.continueHarnessBrokeredToolCall(context.Background(), client, task, agent, frame)
-	if err == nil || !strings.Contains(err.Error(), "injected continuation marker patch failure") {
-		t.Fatalf("first continueHarnessBrokeredToolCall() error = %v, want marker patch failure", err)
-	}
-	if continueCalls.Load() != 0 {
-		t.Fatalf("continue calls after failed marker patch = %d, want 0", continueCalls.Load())
-	}
-	if toolCalls.Load() != 1 {
-		t.Fatalf("tool calls after failed marker patch = %d, want 1", toolCalls.Load())
-	}
-
-	if err := r.continueHarnessBrokeredToolCall(context.Background(), client, task, agent, frame); err != nil {
-		t.Fatalf("second continueHarnessBrokeredToolCall() error = %v", err)
-	}
-	if continueCalls.Load() != 1 {
-		t.Fatalf("continue calls after retry = %d, want 1", continueCalls.Load())
-	}
-	if toolCalls.Load() != 1 {
-		t.Fatalf("tool calls after retry = %d, want replay without re-execution", toolCalls.Load())
-	}
-	if markerPatchAttempts.Load() != 2 {
-		t.Fatalf("marker patch attempts = %d, want 2", markerPatchAttempts.Load())
-	}
-}
-
-func TestHarnessWrapperBrokeredContinuationMarkerClearsOnDefinitiveRejection(t *testing.T) {
-	var toolCalls atomic.Int32
-	toolServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		toolCalls.Add(1)
-		_, _ = w.Write([]byte(`{"success":true}`))
-	}))
-	defer toolServer.Close()
-
-	task, agent := harnessWrapperTaskAndAgent()
-	task.Annotations = map[string]string{
-		harnessWrapperMetadataAnno: `{"toolExecutionMode":"brokered","brokeredToolClassMap":"{\"read_incident\":\"read\"}"}`,
-	}
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "runtime"}}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"read_incident"}}
-	tool := &corev1alpha1.Tool{
-		ObjectMeta: metav1.ObjectMeta{Name: "read_incident", Namespace: task.Namespace},
-		Spec: corev1alpha1.ToolSpec{
-			Description:       "Read incident",
-			BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassRead,
-			HTTP:              &corev1alpha1.HTTPExecution{URL: toolServer.URL},
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, tool)
-
-	var continueCalls atomic.Int32
-	runtimeServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		continueCalls.Add(1)
-		harness.WriteError(w, http.StatusBadRequest, "continuation rejected")
-	}))
-	defer runtimeServer.Close()
-	client, err := harness.NewClient(runtimeServer.URL)
-	if err != nil {
-		t.Fatalf("NewClient() error = %v", err)
-	}
-	frame := harness.HarnessEventFrame{
-		Version:          harness.ProtocolVersion,
-		Type:             harness.FrameToolCallRequested,
-		RuntimeSessionID: "runtime-session",
-		TurnID:           "turn-1",
-		CorrelationID:    "corr-1",
-		Seq:              1,
-		ToolName:         tool.Name,
-		ToolCallID:       "call-1",
-		Content:          json.RawMessage(`{"incident":"inc-1"}`),
-	}
-
-	err = r.continueHarnessBrokeredToolCall(context.Background(), client, task, agent, frame)
-	if err == nil || !strings.Contains(err.Error(), "continuation rejected") {
-		t.Fatalf("continueHarnessBrokeredToolCall() error = %v, want rejection", err)
-	}
-	if continueCalls.Load() != 1 {
-		t.Fatalf("continue calls = %d, want 1", continueCalls.Load())
-	}
-	if toolCalls.Load() != 1 {
-		t.Fatalf("tool calls = %d, want 1", toolCalls.Load())
-	}
-	var stored corev1alpha1.Task
-	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &stored); err != nil {
-		t.Fatalf("get task: %v", err)
-	}
-	if harnessWrapperBrokeredContinuationPending(&stored) {
-		t.Fatal("definitively rejected continuation retained pending marker")
-	}
-}
-
-func TestHarnessWrapperBrokeredRejectsToolCallIDReuseAcrossTools(t *testing.T) {
-	var readExecutions atomic.Int32
-	readServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		readExecutions.Add(1)
-		_, _ = w.Write([]byte(`{"success":true}`))
-	}))
-	defer readServer.Close()
-	var otherExecutions atomic.Int32
-	otherServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		otherExecutions.Add(1)
-		_, _ = w.Write([]byte(`{"success":true}`))
-	}))
-	defer otherServer.Close()
-
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "runtime"}}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"read_incident", "other_read"}}
-	readTool := &corev1alpha1.Tool{ObjectMeta: metav1.ObjectMeta{Name: "read_incident", Namespace: task.Namespace}, Spec: corev1alpha1.ToolSpec{Description: "Read incident", BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassRead, HTTP: &corev1alpha1.HTTPExecution{URL: readServer.URL}}}
-	otherTool := &corev1alpha1.Tool{ObjectMeta: metav1.ObjectMeta{Name: "other_read", Namespace: task.Namespace}, Spec: corev1alpha1.ToolSpec{Description: "Other read", BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassRead, HTTP: &corev1alpha1.HTTPExecution{URL: otherServer.URL}}}
-	r := newUnitReconciler(newTestScheme(), task, agent, readTool, otherTool)
-	frame := harness.HarnessEventFrame{Version: harness.ProtocolVersion, Type: harness.FrameToolCallRequested, RuntimeSessionID: "runtime-session", TurnID: "turn-1", CorrelationID: "corr-1", Seq: 1, ToolName: "read_incident", ToolCallID: "call-1", Content: json.RawMessage(`{"incident":"inc-1"}`)}
-	if result, err := r.handleHarnessBrokeredToolCall(context.Background(), task, agent, frame); err != nil || result.Error != nil {
-		t.Fatalf("first handle = %#v, %v", result, err)
-	}
-	frame.ToolName = "other_read"
-	result, err := r.handleHarnessBrokeredToolCall(context.Background(), task, agent, frame)
-	if err != nil {
-		t.Fatalf("reused id handle error = %v", err)
-	}
-	if result.Error == nil || result.Error.Code != "tool_call_id_reused" {
-		t.Fatalf("result = %#v, want tool_call_id_reused", result)
-	}
-	if readExecutions.Load() != 1 || otherExecutions.Load() != 0 {
-		t.Fatalf("executions read=%d other=%d, want only initial tool", readExecutions.Load(), otherExecutions.Load())
-	}
-}
-
-func TestHarnessWrapperBrokeredReplayNormalizesToolIdentity(t *testing.T) {
-	var executions atomic.Int32
-	toolServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		executions.Add(1)
-		_, _ = w.Write([]byte(`{"success":true}`))
-	}))
-	defer toolServer.Close()
-
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "runtime"}}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"read_incident"}}
-	tool := &corev1alpha1.Tool{ObjectMeta: metav1.ObjectMeta{Name: "read_incident", Namespace: task.Namespace}, Spec: corev1alpha1.ToolSpec{Description: "Read incident", BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassRead, HTTP: &corev1alpha1.HTTPExecution{URL: toolServer.URL}}}
-	r := newUnitReconciler(newTestScheme(), task, agent, tool)
-	frame := harness.HarnessEventFrame{Version: harness.ProtocolVersion, Type: harness.FrameToolCallRequested, RuntimeSessionID: "runtime-session", TurnID: "turn-1", CorrelationID: "corr-1", Seq: 1, ToolName: " read_incident ", ToolCallID: " call-1 ", Content: json.RawMessage(`{"incident":"inc-1"}`)}
-	if result, err := r.handleHarnessBrokeredToolCall(context.Background(), task, agent, frame); err != nil || result.Error != nil {
-		t.Fatalf("first handle = %#v, %v", result, err)
-	}
-	if result, err := r.handleHarnessBrokeredToolCall(context.Background(), task, agent, frame); err != nil || result.Error != nil {
-		t.Fatalf("replay handle = %#v, %v", result, err)
-	}
-	if executions.Load() != 1 {
-		t.Fatalf("executions = %d, want replay from normalized ledger", executions.Load())
-	}
-}
-
-func TestHarnessWrapperBrokeredReplayRejectsChangedArguments(t *testing.T) {
-	var executions atomic.Int32
-	toolServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		executions.Add(1)
-		_, _ = w.Write([]byte(`{"success":true,"data":{"status":"investigating"}}`))
-	}))
-	defer toolServer.Close()
-
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "runtime"}}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"read_incident"}}
-	tool := &corev1alpha1.Tool{
-		ObjectMeta: metav1.ObjectMeta{Name: "read_incident", Namespace: task.Namespace},
-		Spec: corev1alpha1.ToolSpec{
-			Description:       "Read incident",
-			BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassRead,
-			HTTP:              &corev1alpha1.HTTPExecution{URL: toolServer.URL},
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, tool)
-	frame := harness.HarnessEventFrame{Version: harness.ProtocolVersion, Type: harness.FrameToolCallRequested, RuntimeSessionID: "runtime-session", TurnID: "turn-1", CorrelationID: "corr-1", Seq: 1, ToolName: "read_incident", ToolCallID: "call-1", Content: json.RawMessage(`{"incident":"inc-1"}`)}
-	result, err := r.handleHarnessBrokeredToolCall(context.Background(), task, agent, frame)
-	if err != nil || result.Error != nil {
-		t.Fatalf("first handle = %#v, %v", result, err)
-	}
-	changed := frame
-	changed.Content = json.RawMessage(`{"incident":"inc-2"}`)
-	result, err = r.handleHarnessBrokeredToolCall(context.Background(), task, agent, changed)
-	if err != nil {
-		t.Fatalf("changed handle error = %v", err)
-	}
-	if result.Error == nil || result.Error.Code != "tool_call_arguments_changed" {
-		t.Fatalf("result = %#v, want changed arguments error", result)
-	}
-	if executions.Load() != 1 {
-		t.Fatalf("executions = %d, want cached failure without second call", executions.Load())
-	}
-}
-
-func TestHarnessWrapperBrokeredReadRejectsInvalidArgsBeforeExecution(t *testing.T) {
-	var executions atomic.Int32
-	toolServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		executions.Add(1)
-		_, _ = w.Write([]byte(`{"success":true}`))
-	}))
-	defer toolServer.Close()
-
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "runtime"}}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"read_incident"}}
-	tool := &corev1alpha1.Tool{
-		ObjectMeta: metav1.ObjectMeta{Name: "read_incident", Namespace: task.Namespace},
-		Spec: corev1alpha1.ToolSpec{
-			Description:       "Read incident",
-			BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassRead,
-			Parameters:        &apiextensionsv1.JSON{Raw: []byte(`{"type":"object","required":["incident"],"properties":{"incident":{"type":"string"}}}`)},
-			HTTP:              &corev1alpha1.HTTPExecution{URL: toolServer.URL},
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, tool)
-	frame := harness.HarnessEventFrame{
-		Version:          harness.ProtocolVersion,
-		Type:             harness.FrameToolCallRequested,
-		RuntimeSessionID: "runtime-session",
-		TurnID:           "turn-1",
-		CorrelationID:    "corr-1",
-		Seq:              1,
-		ToolName:         "read_incident",
-		ToolCallID:       "call-1",
-		Content:          json.RawMessage(`{"other":"value"}`),
-	}
-	result, err := r.handleHarnessBrokeredToolCall(context.Background(), task, agent, frame)
-	if err != nil {
-		t.Fatalf("handleHarnessBrokeredToolCall() error = %v", err)
-	}
-	if result.Error == nil || result.Error.Code != "invalid_tool_arguments" {
-		t.Fatalf("result = %#v, want invalid_tool_arguments", result)
-	}
-	if executions.Load() != 0 {
-		t.Fatalf("executions = %d, want none", executions.Load())
-	}
-}
-
-func TestHarnessWrapperBrokeredWriteRejectsInvalidArgsBeforeApproval(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "runtime"}}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"dispatch_work_order"}}
-	tool := &corev1alpha1.Tool{
-		ObjectMeta: metav1.ObjectMeta{Name: "dispatch_work_order", Namespace: task.Namespace, ResourceVersion: "1"},
-		Spec: corev1alpha1.ToolSpec{
-			Description:       "Dispatch technician",
-			BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassWrite,
-			Parameters:        &apiextensionsv1.JSON{Raw: []byte(`{"type":"object","required":["incident"],"properties":{"incident":{"type":"string"}}}`)},
-			HTTP:              &corev1alpha1.HTTPExecution{URL: "http://tool.invalid"},
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, tool)
-	frame := brokeredWriteFrame()
-	frame.Content = json.RawMessage(`{"action":"dispatch technician"}`)
-	result, err := r.handleHarnessBrokeredToolCall(context.Background(), task, agent, frame)
-	if err != nil {
-		t.Fatalf("handleHarnessBrokeredToolCall() error = %v", err)
-	}
-	if result.Error == nil || result.Error.Code != "invalid_tool_arguments" {
-		t.Fatalf("result = %#v, want invalid_tool_arguments", result)
-	}
-	listed, err := r.ExecutionEventStore.ListExecutionEvents(context.Background(), store.ExecutionEventFilter{Namespace: task.Namespace, StreamID: task.Name, EventTypes: []string{events.ExecutionEventTypeApprovalRequested}})
-	if err != nil {
-		t.Fatalf("list events: %v", err)
-	}
-	if len(listed) != 0 {
-		t.Fatalf("approval events = %d, want none", len(listed))
-	}
-}
-
-func TestHarnessWrapperBrokeredToolCallRejectsDisallowedAndUnclassifiedTools(t *testing.T) {
-	tests := []struct {
-		name         string
-		allowedTools []string
-		toolClass    corev1alpha1.AgentRuntimeBrokeredToolClass
-		wantCode     string
-	}{
-		{
-			name:         "disallowed",
-			allowedTools: []string{"other_tool"},
-			toolClass:    corev1alpha1.AgentRuntimeBrokeredToolClassRead,
-			wantCode:     "tool_not_allowed",
-		},
-		{
-			name:         "unclassified",
-			allowedTools: []string{"read_incident"},
-			wantCode:     "tool_class_not_allowed",
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			task, agent := harnessWrapperTaskAndAgent()
-			agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "runtime"}}
-			task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: tt.allowedTools}
-			tool := &corev1alpha1.Tool{
-				ObjectMeta: metav1.ObjectMeta{Name: "read_incident", Namespace: task.Namespace},
-				Spec: corev1alpha1.ToolSpec{
-					Description:       "Read incident status",
-					BrokeredToolClass: tt.toolClass,
-					HTTP:              &corev1alpha1.HTTPExecution{URL: "https://tools.example.test/read"},
-				},
-			}
-			r := newUnitReconciler(newTestScheme(), task, agent, tool)
-			result, err := r.handleHarnessBrokeredToolCall(context.Background(), task, agent, harness.HarnessEventFrame{
-				Version:          harness.ProtocolVersion,
-				Type:             harness.FrameToolCallRequested,
-				RuntimeSessionID: "runtime-session",
-				TurnID:           "turn",
-				CorrelationID:    "corr",
-				Seq:              1,
-				ToolName:         "read_incident",
-				ToolCallID:       "call-read-1",
-				Content:          json.RawMessage(`{"incident":"quincy-north"}`),
-			})
-			if err != nil {
-				t.Fatalf("handleHarnessBrokeredToolCall() error = %v", err)
-			}
-			if result.Error == nil || result.Error.Code != tt.wantCode {
-				t.Fatalf("result.Error = %#v, want %s", result.Error, tt.wantCode)
-			}
-			listed, err := r.ExecutionEventStore.ListExecutionEvents(context.Background(), store.ExecutionEventFilter{
-				Namespace: task.Namespace,
-				StreamID:  task.Name,
-			})
-			if err != nil {
-				t.Fatalf("ListExecutionEvents: %v", err)
-			}
-			if !hasExecutionEventType(listed, events.ExecutionEventTypeToolCallFailed) {
-				t.Fatalf("events = %#v, want ToolCallFailed", listed)
-			}
-		})
-	}
-}
-
-func TestHarnessWrapperBrokeredToolRejectsClassChangedAfterPlanning(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "runtime"}}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"read_incident"}}
-	task.Annotations = map[string]string{
-		harnessWrapperMetadataAnno: `{"toolExecutionMode":"brokered","brokeredToolClassMap":"{\"read_incident\":\"read\"}"}`,
-	}
-	tool := &corev1alpha1.Tool{
-		ObjectMeta: metav1.ObjectMeta{Name: "read_incident", Namespace: task.Namespace},
-		Spec: corev1alpha1.ToolSpec{
-			Description:       "Read incident status",
-			BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassWrite,
-			HTTP:              &corev1alpha1.HTTPExecution{URL: "https://tools.example.test/read"},
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, tool)
-	result, err := r.handleHarnessBrokeredToolCall(context.Background(), task, agent, harness.HarnessEventFrame{
-		Version:          harness.ProtocolVersion,
-		Type:             harness.FrameToolCallRequested,
-		RuntimeSessionID: "runtime-session",
-		TurnID:           "turn",
-		CorrelationID:    "corr",
-		Seq:              1,
-		ToolName:         "read_incident",
-		ToolCallID:       "call-read-1",
-		Content:          json.RawMessage(`{"incident":"quincy-north"}`),
-	})
-	if err != nil {
-		t.Fatalf("handleHarnessBrokeredToolCall() error = %v", err)
-	}
-	if result.Error == nil || result.Error.Code != "tool_class_changed" {
-		t.Fatalf("result.Error = %#v, want tool_class_changed", result.Error)
-	}
-}
-
-func TestHarnessWrapperBrokeredToolRejectsCorruptPlannedClassMap(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "runtime"}}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"read_incident"}}
-	task.Annotations = map[string]string{
-		harnessWrapperMetadataAnno: `{"toolExecutionMode":"brokered","brokeredToolClassMap":"not-json"}`,
-	}
-	tool := &corev1alpha1.Tool{
-		ObjectMeta: metav1.ObjectMeta{Name: "read_incident", Namespace: task.Namespace},
-		Spec: corev1alpha1.ToolSpec{
-			Description:       "Read incident status",
-			BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassRead,
-			HTTP:              &corev1alpha1.HTTPExecution{URL: "https://tools.example.test/read"},
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, tool)
-	result, err := r.handleHarnessBrokeredToolCall(context.Background(), task, agent, harness.HarnessEventFrame{
-		Version:          harness.ProtocolVersion,
-		Type:             harness.FrameToolCallRequested,
-		RuntimeSessionID: "runtime-session",
-		TurnID:           "turn",
-		CorrelationID:    "corr",
-		Seq:              1,
-		ToolName:         "read_incident",
-		ToolCallID:       "call-read-1",
-		Content:          json.RawMessage(`{"incident":"quincy-north"}`),
-	})
-	if err != nil {
-		t.Fatalf("handleHarnessBrokeredToolCall() error = %v", err)
-	}
-	if result.Error == nil || result.Error.Code != "invalid_brokered_plan" {
-		t.Fatalf("result.Error = %#v, want invalid_brokered_plan", result.Error)
-	}
-}
-
-func TestHarnessWrapperBrokeredWriteToolRequestsApprovalThenExecutesAfterApproval(t *testing.T) {
-	var executions atomic.Int32
-	var idempotencyHeader atomic.Value
-	toolServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		executions.Add(1)
-		idempotencyHeader.Store(r.Header.Get("Idempotency-Key"))
-		_, _ = w.Write([]byte(`{"success":true,"data":{"dispatched":true}}`))
-	}))
-	defer toolServer.Close()
-
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "runtime"}}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"dispatch_work_order"}}
-	tool := &corev1alpha1.Tool{
-		ObjectMeta: metav1.ObjectMeta{Name: "dispatch_work_order", Namespace: task.Namespace, ResourceVersion: "1"},
-		Spec: corev1alpha1.ToolSpec{
-			Description:       "Dispatch technician",
-			BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassWrite,
-			HTTP:              &corev1alpha1.HTTPExecution{URL: toolServer.URL},
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, tool)
-	frame := brokeredWriteFrame()
-
-	_, err := r.handleHarnessBrokeredToolCall(context.Background(), task, agent, frame)
-	if !errors.Is(err, errHarnessBrokeredApprovalPending) {
-		t.Fatalf("first handleHarnessBrokeredToolCall() error = %v, want pending", err)
-	}
-	approvalID := brokeredApprovalIDForTest(t, r, task)
-	if executions.Load() != 0 {
-		t.Fatalf("executions before approval = %d, want 0", executions.Load())
-	}
-	appendApprovalDecisionForTest(t, r, task, approvalID, events.ExecutionEventTypeApprovalApproved)
-
-	result, err := r.handleHarnessBrokeredToolCall(context.Background(), task, agent, frame)
-	if err != nil {
-		t.Fatalf("approved handleHarnessBrokeredToolCall() error = %v", err)
-	}
-	if result.Error != nil || len(result.Output) == 0 {
-		t.Fatalf("result = %#v, want successful output", result)
-	}
-	if executions.Load() != 1 {
-		t.Fatalf("executions after approval = %d, want 1", executions.Load())
-	}
-	if got, _ := idempotencyHeader.Load().(string); got != approvalID {
-		t.Fatalf("Idempotency-Key = %q, want approvalID %q", got, approvalID)
-	}
-	result, err = r.handleHarnessBrokeredToolCall(context.Background(), task, agent, frame)
-	if err != nil {
-		t.Fatalf("replay handleHarnessBrokeredToolCall() error = %v", err)
-	}
-	if executions.Load() != 1 {
-		t.Fatalf("executions after replay = %d, want 1", executions.Load())
-	}
-}
-
-func TestHarnessWrapperBrokeredWriteToolFailsClosedForUnresolvedExecutionLedger(t *testing.T) {
-	var executions atomic.Int32
-	toolServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		executions.Add(1)
-		_, _ = w.Write([]byte(`{"success":true}`))
-	}))
-	defer toolServer.Close()
-
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "runtime"}}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"dispatch_work_order"}}
-	tool := &corev1alpha1.Tool{
-		ObjectMeta: metav1.ObjectMeta{Name: "dispatch_work_order", Namespace: task.Namespace, ResourceVersion: "1"},
-		Spec: corev1alpha1.ToolSpec{
-			Description:       "Dispatch technician",
-			BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassWrite,
-			HTTP:              &corev1alpha1.HTTPExecution{URL: toolServer.URL},
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, tool)
-	frame := brokeredWriteFrame()
-	_, err := r.handleHarnessBrokeredToolCall(context.Background(), task, agent, frame)
-	if !errors.Is(err, errHarnessBrokeredApprovalPending) {
-		t.Fatalf("first handleHarnessBrokeredToolCall() error = %v, want pending", err)
-	}
-	approvalID := brokeredApprovalIDForTest(t, r, task)
-	appendApprovalDecisionForTest(t, r, task, approvalID, events.ExecutionEventTypeApprovalApproved)
-	idempotencyKey := harness.ToolRequestIdempotencyKey(frame.RuntimeSessionID, frame.TurnID, frame.ToolCallID)
-	content, _ := json.Marshal(map[string]any{
-		"brokered":         true,
-		"idempotencyKey":   idempotencyKey,
-		"targetArgsDigest": "sha256:different",
-		"executionState":   "started",
-	})
-	if _, err := r.ExecutionEventStore.AppendExecutionEvent(context.Background(), &store.ExecutionEvent{
-		Namespace:  task.Namespace,
-		StreamID:   task.Name,
-		TaskName:   task.Name,
-		Type:       events.ExecutionEventTypeToolCallStarted,
-		ToolName:   frame.ToolName,
-		ToolCallID: frame.ToolCallID,
-		Content:    content,
-	}); err != nil {
-		t.Fatalf("append unresolved ledger: %v", err)
-	}
-
-	result, err := r.handleHarnessBrokeredToolCall(context.Background(), task, agent, frame)
-	if err != nil {
-		t.Fatalf("handleHarnessBrokeredToolCall() error = %v", err)
-	}
-	if result.Error == nil || result.Error.Code != "tool_execution_outcome_unknown" {
-		t.Fatalf("result = %#v, want outcome unknown error", result)
-	}
-	if executions.Load() != 0 {
-		t.Fatalf("executions = %d, want fail-closed without duplicate side effect", executions.Load())
-	}
-}
-
-func TestHarnessWrapperBrokeredWriteToolDeclineContinuesWithoutExecution(t *testing.T) {
-	var executions atomic.Int32
-	toolServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		executions.Add(1)
-		_, _ = w.Write([]byte(`{"success":true}`))
-	}))
-	defer toolServer.Close()
-
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "runtime"}}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"dispatch_work_order"}}
-	tool := &corev1alpha1.Tool{
-		ObjectMeta: metav1.ObjectMeta{Name: "dispatch_work_order", Namespace: task.Namespace, ResourceVersion: "1"},
-		Spec: corev1alpha1.ToolSpec{
-			Description:       "Dispatch technician",
-			BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassWrite,
-			HTTP:              &corev1alpha1.HTTPExecution{URL: toolServer.URL},
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, tool)
-	frame := brokeredWriteFrame()
-
-	_, err := r.handleHarnessBrokeredToolCall(context.Background(), task, agent, frame)
-	if !errors.Is(err, errHarnessBrokeredApprovalPending) {
-		t.Fatalf("first handleHarnessBrokeredToolCall() error = %v, want pending", err)
-	}
-	approvalID := brokeredApprovalIDForTest(t, r, task)
-	appendApprovalDecisionForTest(t, r, task, approvalID, events.ExecutionEventTypeApprovalDeclined)
-
-	result, err := r.handleHarnessBrokeredToolCall(context.Background(), task, agent, frame)
-	if err != nil {
-		t.Fatalf("declined handleHarnessBrokeredToolCall() error = %v", err)
-	}
-	if result.Error == nil || result.Error.Code != "approval_declined" {
-		t.Fatalf("result = %#v, want approval_declined", result)
-	}
-	if executions.Load() != 0 {
-		t.Fatalf("executions after decline = %d, want 0", executions.Load())
-	}
-	result, err = r.handleHarnessBrokeredToolCall(context.Background(), task, agent, frame)
-	if err != nil {
-		t.Fatalf("decline replay error = %v", err)
-	}
-	if result.Approved || result.Error == nil || result.Error.Code != "approval_declined" {
-		t.Fatalf("decline replay result = %#v, want Approved=false approval_declined", result)
-	}
-}
-
-func TestHarnessWrapperBrokeredCoordinationDelegateTaskCreatesChild(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "runtime"}}
-	agent.Spec.Coordination = &corev1alpha1.CoordinationConfig{
-		Enabled:  true,
-		MaxDepth: 3,
-		AllowedAgents: []corev1alpha1.AllowedAgent{{
-			Name: "worker-agent",
-		}},
-	}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"delegate_task"}}
-	targetAgent := &corev1alpha1.Agent{
-		ObjectMeta: metav1.ObjectMeta{Name: "worker-agent", Namespace: task.Namespace},
-		Spec: corev1alpha1.AgentSpec{
-			ProviderRef: &corev1alpha1.ProviderReference{Name: "test-provider"},
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, targetAgent)
-	frame := harness.HarnessEventFrame{
-		Version:          harness.ProtocolVersion,
-		Type:             harness.FrameToolCallRequested,
-		RuntimeSessionID: "runtime-session",
-		TurnID:           "turn",
-		CorrelationID:    "corr",
-		Seq:              1,
-		ToolName:         "delegate_task",
-		ToolCallID:       "call-delegate-1",
-		Content:          json.RawMessage(`{"agent":"worker-agent","prompt":"investigate"}`),
-	}
-
-	result, err := r.handleHarnessBrokeredToolCall(context.Background(), task, agent, frame)
-	if err != nil {
-		t.Fatalf("handleHarnessBrokeredToolCall() error = %v", err)
-	}
-	if result.Error != nil || len(result.Output) == 0 {
-		t.Fatalf("result = %#v, want successful delegate output", result)
-	}
-	var tasks corev1alpha1.TaskList
-	if err := r.List(context.Background(), &tasks); err != nil {
-		t.Fatalf("List Tasks: %v", err)
-	}
-	childCount := 0
-	for _, item := range tasks.Items {
-		if item.Name != task.Name && labels.ParentTaskName(item.Labels, item.Annotations) == task.Name {
-			childCount++
-			if item.Spec.AgentRef == nil || item.Spec.AgentRef.Name != "worker-agent" {
-				t.Fatalf("child AgentRef = %#v", item.Spec.AgentRef)
-			}
-		}
-	}
-	if childCount != 1 {
-		t.Fatalf("child task count = %d, want 1; tasks=%#v", childCount, tasks.Items)
-	}
-}
-
-func TestHarnessWrapperBrokeredCoordinationMessagingToolsUseMessageStore(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "runtime"}}
-	agent.Spec.Coordination = &corev1alpha1.CoordinationConfig{Enabled: true, MaxDepth: 3}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"send_message", "check_messages"}}
-	r := newUnitReconciler(newTestScheme(), task, agent)
-
-	sendResult, err := r.handleHarnessBrokeredToolCall(context.Background(), task, agent, harness.HarnessEventFrame{
-		Version:          harness.ProtocolVersion,
-		Type:             harness.FrameToolCallRequested,
-		RuntimeSessionID: "runtime-session",
-		TurnID:           "turn",
-		CorrelationID:    "corr",
-		Seq:              1,
-		ToolName:         "send_message",
-		ToolCallID:       "call-send-1",
-		Content:          json.RawMessage(`{"to_task":"*","content":"hello sibling"}`),
-	})
-	if err != nil {
-		t.Fatalf("send handleHarnessBrokeredToolCall() error = %v", err)
-	}
-	if sendResult.Error != nil {
-		t.Fatalf("send result error = %#v", sendResult.Error)
-	}
-
-	workerTask := &corev1alpha1.Task{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "worker-b",
-			Namespace: task.Namespace,
-			Labels:    map[string]string{labels.LabelParentTask: labels.SelectorValue(task.Name)},
-			Annotations: map[string]string{
-				labels.AnnotationParentTaskName: task.Name,
-			},
-		},
-		Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAI},
-	}
-	checkAgent := agent.DeepCopy()
-	checkTask := task.DeepCopy()
-	checkTask.Name = "worker-b"
-	checkTask.Labels = maps.Clone(workerTask.Labels)
-	checkTask.Annotations = maps.Clone(workerTask.Annotations)
-	checkTask.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"check_messages"}}
-	if err := r.Create(context.Background(), workerTask); err != nil {
-		t.Fatalf("create worker task: %v", err)
-	}
-	checkResult, err := r.handleHarnessBrokeredToolCall(context.Background(), checkTask, checkAgent, harness.HarnessEventFrame{
-		Version:          harness.ProtocolVersion,
-		Type:             harness.FrameToolCallRequested,
-		RuntimeSessionID: "runtime-session",
-		TurnID:           "turn",
-		CorrelationID:    "corr",
-		Seq:              2,
-		ToolName:         "check_messages",
-		ToolCallID:       "call-check-1",
-		Content:          json.RawMessage(`{"mark_read":true}`),
-	})
-	if err != nil {
-		t.Fatalf("check handleHarnessBrokeredToolCall() error = %v", err)
-	}
-	if checkResult.Error != nil {
-		t.Fatalf("check result = %#v", checkResult)
-	}
-	if !strings.Contains(string(checkResult.Output), "hello sibling") {
-		t.Fatalf("check output = %s, want message content", string(checkResult.Output))
-	}
-}
-
-func TestHarnessWrapperBrokeredRunningTaskFailsClosedWhenAgentMissing(t *testing.T) {
-	server := harnesstest.NewFakeHarnessServer(harnesstest.FakeHarnessConfig{RuntimeName: "fibey-agentkit", AuthToken: "mock-token"})
-	defer server.Close()
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "fibey-agentkit"}}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"read_incident"}}
-	task.Status.Phase = corev1alpha1.TaskPhaseRunning
-	task.Status.Attempts = 1
-	if task.Annotations == nil {
-		task.Annotations = map[string]string{}
-	}
-	task.Annotations[harnessWrapperStartedAnno] = scheduledRunLabelValue
-	task.Annotations[harnessWrapperTurnIDAnnotation] = string(harnessWrapperTurnID(task, 1))
-	task.Annotations[harnessWrapperRuntimeAnnotation] = string(harnessWrapperRuntimeSessionID(task, "fibey-agentkit"))
-	task.Annotations[harnessWrapperCorrelationIDAnno] = string(task.UID)
-	task.Annotations[harnessWrapperLastFrameSeqAnno] = "0"
-	task.Annotations[harnessWrapperMetadataAnno] = `{"runtime":"fibey-agentkit","runtimeRef":"fibey-agentkit","toolExecutionMode":"brokered"}`
-	runtime, token := harnessWrapperReadyAgentRuntime(task.Namespace, server.URL())
-	task.Status.HarnessRuntime = &corev1alpha1.HarnessRuntimeStatus{
-		RuntimeRefName:         runtime.Name,
-		RuntimeName:            runtime.Name,
-		ContractVersion:        harness.ProtocolVersion,
-		Endpoint:               runtime.Spec.Deployment.Endpoint,
-		RuntimeGeneration:      runtime.Generation,
-		AuthRefName:            token.Name,
-		AuthRefField:           "token",
-		AuthRefResourceVersion: token.ResourceVersion,
-	}
-	r := newUnitReconciler(newTestScheme(), task, runtime, token)
-	if _, err := r.handleRunning(context.Background(), task); err != nil {
-		t.Fatalf("handleRunning: %v", err)
-	}
-	var updated corev1alpha1.Task
-	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &updated); err != nil {
-		t.Fatalf("get task: %v", err)
-	}
-	if updated.Status.Phase != corev1alpha1.TaskPhaseFailed {
-		t.Fatalf("phase = %s, want Failed", updated.Status.Phase)
-	}
-}
-
-func brokeredWriteFrame() harness.HarnessEventFrame {
-	return harness.HarnessEventFrame{
-		Version:          harness.ProtocolVersion,
-		Type:             harness.FrameToolCallRequested,
-		RuntimeSessionID: "runtime-session",
-		TurnID:           "turn",
-		CorrelationID:    "corr",
-		Seq:              1,
-		ToolName:         "dispatch_work_order",
-		ToolCallID:       "call-write-1",
-		Content:          json.RawMessage(`{"incident":"quincy-north","action":"dispatch technician"}`),
-	}
-}
-
-func TestMarkHarnessBrokeredApprovalWaitingSetsTaskCondition(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	task.Status.Phase = corev1alpha1.TaskPhaseRunning
-	r := newUnitReconciler(newTestScheme(), task, agent)
-	if err := r.markHarnessBrokeredApprovalWaiting(context.Background(), task, "approval-canonical", "dispatch_work_order"); err != nil {
-		t.Fatalf("markHarnessBrokeredApprovalWaiting: %v", err)
-	}
-	var updated corev1alpha1.Task
-	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &updated); err != nil {
-		t.Fatalf("get task: %v", err)
-	}
-	cond := meta.FindStatusCondition(updated.Status.Conditions, ConditionTypeWaitingForApproval)
-	if cond == nil || cond.Status != metav1.ConditionTrue || cond.Reason != "BrokeredToolApprovalPending" {
-		t.Fatalf("WaitingForApproval condition = %#v", cond)
-	}
-	if !strings.Contains(updated.Status.Message, "approval-canonical") {
-		t.Fatalf("status message = %q", updated.Status.Message)
-	}
-	if err := r.clearHarnessBrokeredApprovalWaiting(context.Background(), task, "dispatch_work_order"); err != nil {
-		t.Fatalf("clearHarnessBrokeredApprovalWaiting: %v", err)
-	}
-	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &updated); err != nil {
-		t.Fatalf("get cleared task: %v", err)
-	}
-	cond = meta.FindStatusCondition(updated.Status.Conditions, ConditionTypeWaitingForApproval)
-	if cond == nil || cond.Status != metav1.ConditionFalse || cond.Reason != "BrokeredToolContinued" {
-		t.Fatalf("cleared WaitingForApproval condition = %#v", cond)
-	}
-}
-
-func brokeredApprovalIDForTest(t *testing.T, r *TaskReconciler, task *corev1alpha1.Task) string {
-	t.Helper()
-	listed, err := r.ExecutionEventStore.ListExecutionEvents(context.Background(), store.ExecutionEventFilter{
-		Namespace:  task.Namespace,
-		StreamID:   task.Name,
-		EventTypes: []string{events.ExecutionEventTypeApprovalRequested},
-	})
-	if err != nil {
-		t.Fatalf("ListExecutionEvents: %v", err)
-	}
-	if len(listed) != 1 || listed[0].ToolCallID == "" {
-		t.Fatalf("approval events = %#v, want one approval with ID", listed)
-	}
-	return listed[0].ToolCallID
-}
-
-func appendApprovalDecisionForTest(t *testing.T, r *TaskReconciler, task *corev1alpha1.Task, approvalID, eventType string) {
-	t.Helper()
-	content, err := json.Marshal(map[string]string{
-		"approvalID": approvalID,
-		"taskUID":    string(task.UID),
-		"actor":      "unit-test",
-	})
-	if err != nil {
-		t.Fatalf("marshal approval decision: %v", err)
-	}
-	if _, err := r.ExecutionEventStore.AppendExecutionEvent(context.Background(), &store.ExecutionEvent{
-		Namespace:  task.Namespace,
-		StreamType: store.ExecutionEventStreamTypeTask,
-		StreamID:   task.Name,
-		TaskName:   task.Name,
-		Type:       eventType,
-		Severity:   events.ExecutionEventSeverityInfo,
-		ToolCallID: approvalID,
-		Summary:    "approval decision",
-		Content:    content,
-	}); err != nil {
-		t.Fatalf("append approval decision: %v", err)
-	}
-}
-
-func TestHarnessWrapperBrokeredContinueFailureRetriesToolRequest(t *testing.T) {
-	var toolCalls atomic.Int32
-	toolServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		toolCalls.Add(1)
-		_, _ = w.Write([]byte(`{"success":true}`))
-	}))
-	defer toolServer.Close()
-
-	var started harness.StartTurnRequest
-	var continueAttempts atomic.Int32
-	continueCh := make(chan struct{})
-	runtimeServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch r.URL.Path {
-		case harness.CapabilitiesPath:
-			harness.WriteJSON(w, http.StatusOK, harness.CapabilitiesResponse{
-				Version:                 harness.ProtocolVersion,
-				ProtocolVersion:         harness.ProtocolVersion,
-				Transport:               harness.HTTPTransport,
-				RuntimeName:             "fibey-agentkit",
-				ProviderKind:            harness.ProviderKindRemote,
-				ToolExecutionModes:      []harness.ToolExecutionMode{harness.ToolExecutionModeObserved, harness.ToolExecutionModeBrokered},
-				BrokeredToolClasses:     []harness.BrokeredToolClass{harness.BrokeredToolClassRead},
-				SupportsCancel:          true,
-				SupportsRuntimeSessions: true,
-				SupportsContinuation:    true,
-			})
-		case harness.TurnsPath:
-			_ = json.NewDecoder(r.Body).Decode(&started)
-			eventsPath, _ := harness.EventStreamPath(started.TurnID)
-			harness.WriteJSON(w, http.StatusAccepted, harness.StartTurnResponse{
-				Version:          harness.ProtocolVersion,
-				Accepted:         true,
-				RuntimeSessionID: started.RuntimeSessionID,
-				TurnID:           started.TurnID,
-				CorrelationID:    started.CorrelationID,
-				EventStreamPath:  eventsPath,
-			})
-		default:
-			_, resource, err := harness.ParseTurnResourcePath(r.URL.EscapedPath())
-			if err != nil {
-				harness.WriteError(w, http.StatusNotFound, "not found")
-				return
-			}
-			switch resource {
-			case harness.TurnResourceEvents:
-				w.Header().Set("Content-Type", "text/event-stream")
-				_ = harness.WriteSSEFrame(w, harness.HarnessEventFrame{
-					Version:          harness.ProtocolVersion,
-					Type:             harness.FrameTurnStarted,
-					RuntimeSessionID: started.RuntimeSessionID,
-					TurnID:           started.TurnID,
-					CorrelationID:    started.CorrelationID,
-					Seq:              1,
-				})
-				_ = harness.WriteSSEFrame(w, harness.HarnessEventFrame{
-					Version:          harness.ProtocolVersion,
-					Type:             harness.FrameToolCallRequested,
-					RuntimeSessionID: started.RuntimeSessionID,
-					TurnID:           started.TurnID,
-					CorrelationID:    started.CorrelationID,
-					Seq:              2,
-					ToolName:         "read_incident",
-					ToolCallID:       "call-read-1",
-					Content:          json.RawMessage(`{"incident":"quincy-north"}`),
-				})
-				select {
-				case <-continueCh:
-					_ = harness.WriteSSEFrame(w, harness.HarnessEventFrame{
-						Version:          harness.ProtocolVersion,
-						Type:             harness.FrameTurnCompleted,
-						RuntimeSessionID: started.RuntimeSessionID,
-						TurnID:           started.TurnID,
-						CorrelationID:    started.CorrelationID,
-						Seq:              3,
-						Completed:        &harness.TurnCompleted{Result: "done", FinalEventSeq: 3},
-					})
-					_ = harness.WriteSSEDone(w)
-				case <-r.Context().Done():
-				}
-			case harness.TurnResourceContinue:
-				if continueAttempts.Add(1) == 1 {
-					harness.WriteError(w, http.StatusServiceUnavailable, "transient")
-					return
-				}
-				close(continueCh)
-				harness.WriteJSON(w, http.StatusAccepted, harness.ContinueTurnResponse{
-					Version:          harness.ProtocolVersion,
-					Accepted:         true,
-					RuntimeSessionID: started.RuntimeSessionID,
-					TurnID:           started.TurnID,
-					CorrelationID:    started.CorrelationID,
-				})
-			}
-		}
-	}))
-	defer runtimeServer.Close()
-
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "fibey-agentkit"}}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"read_incident"}}
-	runtime, token := harnessWrapperReadyAgentRuntime(task.Namespace, runtimeServer.URL)
-	runtime.Status.ObservedCapabilities.ToolExecutionModes = []corev1alpha1.AgentRuntimeToolExecutionMode{
-		corev1alpha1.AgentRuntimeToolExecutionModeObserved,
-		corev1alpha1.AgentRuntimeToolExecutionModeBrokered,
-	}
-	runtime.Status.ObservedCapabilities.BrokeredToolClasses = []corev1alpha1.AgentRuntimeBrokeredToolClass{
-		corev1alpha1.AgentRuntimeBrokeredToolClassRead,
-	}
-	runtime.Status.ObservedCapabilities.SupportsContinuation = true
-	tool := &corev1alpha1.Tool{
-		ObjectMeta: metav1.ObjectMeta{Name: "read_incident", Namespace: task.Namespace},
-		Spec: corev1alpha1.ToolSpec{
-			Description:       "Read incident status",
-			BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassRead,
-			HTTP:              &corev1alpha1.HTTPExecution{URL: toolServer.URL},
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, runtime, token, tool)
-	running := runHarnessWrapperTaskToRunning(t, r, task)
-	if _, err := r.handleRunning(context.Background(), &running); err != nil {
-		t.Fatalf("first handleRunning: %v", err)
-	}
-	var afterFirst corev1alpha1.Task
-	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &afterFirst); err != nil {
-		t.Fatalf("get after first running: %v", err)
-	}
-	if got := harnessWrapperLastFrameSeq(&afterFirst); got != 0 {
-		t.Fatalf("last frame seq after failed continue = %d, want 0 for retry", got)
-	}
-	if _, err := r.handleRunning(context.Background(), &afterFirst); err != nil {
-		t.Fatalf("second handleRunning: %v", err)
-	}
-	var updated corev1alpha1.Task
-	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &updated); err != nil {
-		t.Fatalf("get completed: %v", err)
-	}
-	if updated.Status.Phase != corev1alpha1.TaskPhaseSucceeded {
-		t.Fatalf("phase = %s, want Succeeded (message=%s)", updated.Status.Phase, updated.Status.Message)
-	}
-	if continueAttempts.Load() != 2 {
-		t.Fatalf("continue attempts = %d, want 2", continueAttempts.Load())
-	}
-	if toolCalls.Load() != 1 {
-		t.Fatalf("tool calls = %d, want 1 despite continuation retry", toolCalls.Load())
-	}
-}
-
-func TestHarnessWrapperDuplicateTurnErrorUsesTypedReason(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		harness.WriteError(w, http.StatusConflict, "turn already exists")
-	}))
-	defer server.Close()
-	client, err := harness.NewClient(server.URL, harness.WithBearerToken("turn already"))
-	if err != nil {
-		t.Fatalf("NewClient() error = %v", err)
-	}
-	_, err = client.StartTurn(context.Background(), harness.StartTurnRequest{
-		Version:          harness.ProtocolVersion,
-		Namespace:        "default",
-		TaskName:         "task-a",
-		SessionName:      "session-a",
-		RuntimeSessionID: "runtime-a",
-		TurnID:           "turn-a",
-		CorrelationID:    "corr-a",
-		Deadline:         time.Now().UTC().Add(time.Minute),
-		AuthIdentity:     harness.AuthIdentity{Subject: "user:test"},
-	})
-	if err == nil {
-		t.Fatal("StartTurn() error = nil, want duplicate conflict")
-	}
-	if strings.Contains(strings.ToLower(err.Error()), "turn already") {
-		t.Fatalf("StartTurn() error = %v, configured bearer leaked", err)
-	}
-	if !harnessWrapperDuplicateTurnError(err) {
-		t.Fatal("typed duplicate-turn error was not recognized for recovery")
-	}
-}
-
-func TestHarnessWrapperRuntimeRefUsesObservedRuntimeName(t *testing.T) {
-	server := harnesstest.NewFakeHarnessServer(harnesstest.FakeHarnessConfig{RuntimeName: "agentkit-fibey-runtime"})
-	defer server.Close()
-
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "fibey-agentkit"}}
-	runtime, token := harnessWrapperReadyAgentRuntime(task.Namespace, server.URL())
-	runtime.Status.ObservedCapabilities.RuntimeName = "agentkit-fibey-runtime"
-	r := newUnitReconciler(newTestScheme(), task, agent, runtime, token)
-
-	updated := runHarnessWrapperTaskToCompletion(t, r, task)
-	if updated.Status.Phase != corev1alpha1.TaskPhaseSucceeded {
-		t.Fatalf("phase = %s, want Succeeded (message=%s)", updated.Status.Phase, updated.Status.Message)
-	}
-	if updated.Status.HarnessRuntime == nil || updated.Status.HarnessRuntime.RuntimeName != "agentkit-fibey-runtime" {
-		t.Fatalf("HarnessRuntime = %#v, want observed runtime name", updated.Status.HarnessRuntime)
-	}
-}
-
-func TestHarnessWrapperRuntimeRefFreezesEndpointForRunningTurn(t *testing.T) {
-	server := harnesstest.NewFakeHarnessServer(harnesstest.FakeHarnessConfig{RuntimeName: "fibey-agentkit"})
-	defer server.Close()
-
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "fibey-agentkit"}}
-	runtime, token := harnessWrapperReadyAgentRuntime(task.Namespace, server.URL())
-	r := newUnitReconciler(newTestScheme(), task, agent, runtime, token)
-	running := runHarnessWrapperTaskToRunning(t, r, task)
-	var changed corev1alpha1.AgentRuntime
-	if err := r.Get(context.Background(), types.NamespacedName{Name: "fibey-agentkit", Namespace: task.Namespace}, &changed); err != nil {
-		t.Fatalf("get runtime: %v", err)
-	}
-	changed.Spec.Deployment.Endpoint = "http://127.0.0.1:1"
-	changed.Generation = 2
-	changed.Status.Ready = false
-	changed.Status.ObservedGeneration = 1
-	if err := r.Update(context.Background(), &changed); err != nil {
-		t.Fatalf("update runtime spec: %v", err)
-	}
-	if err := r.Status().Update(context.Background(), &changed); err != nil {
-		t.Fatalf("update runtime status: %v", err)
-	}
-
-	if _, err := r.handleRunning(context.Background(), &running); err != nil {
-		t.Fatalf("handleRunning: %v", err)
-	}
-	var updated corev1alpha1.Task
-	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &updated); err != nil {
-		t.Fatalf("get completed task: %v", err)
-	}
-	if updated.Status.Phase != corev1alpha1.TaskPhaseSucceeded {
-		t.Fatalf("phase = %s, want Succeeded using frozen endpoint (message=%s)", updated.Status.Phase, updated.Status.Message)
-	}
-}
-
-func TestHarnessWrapperRuntimeRefNotReadyWaitsBeforeStartTurn(t *testing.T) {
-	var requests atomic.Int32
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		requests.Add(1)
-		http.Error(w, "should not be called", http.StatusInternalServerError)
-	}))
-	defer server.Close()
-
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "fibey-agentkit"}}
-	runtime, token := harnessWrapperReadyAgentRuntime(task.Namespace, server.URL)
-	runtime.Status.Ready = false
-	runtime.Status.Message = "probe failed"
-	r := newUnitReconciler(newTestScheme(), task, agent, runtime, token)
-
-	result, err := r.handlePending(context.Background(), task)
-	if err != nil {
-		t.Fatalf("handlePending: %v", err)
-	}
-	if result.RequeueAfter <= 0 {
-		t.Fatalf("RequeueAfter = %s, want dependency wait", result.RequeueAfter)
-	}
-	var updated corev1alpha1.Task
-	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &updated); err != nil {
-		t.Fatalf("get task: %v", err)
-	}
-	if updated.Status.Phase != corev1alpha1.TaskPhasePending {
-		t.Fatalf("phase = %s, want Pending", updated.Status.Phase)
-	}
-	if got := requests.Load(); got != 0 {
-		t.Fatalf("server requests = %d, want 0 before StartTurn", got)
-	}
-}
-
-func TestHarnessWrapperRuntimeRefStaleGenerationWaitsBeforeStartTurn(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "fibey-agentkit"}}
-	runtime, token := harnessWrapperReadyAgentRuntime(task.Namespace, "http://127.0.0.1:1")
-	runtime.Generation = 2
-	runtime.Status.ObservedGeneration = 1
-	r := newUnitReconciler(newTestScheme(), task, agent, runtime, token)
-
-	result, err := r.handlePending(context.Background(), task)
-	if err != nil {
-		t.Fatalf("handlePending: %v", err)
-	}
-	if result.RequeueAfter <= 0 {
-		t.Fatalf("RequeueAfter = %s, want dependency wait", result.RequeueAfter)
-	}
-	var updated corev1alpha1.Task
-	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &updated); err != nil {
-		t.Fatalf("get task: %v", err)
-	}
-	if updated.Status.Phase != corev1alpha1.TaskPhasePending {
-		t.Fatalf("phase = %s, want Pending", updated.Status.Phase)
-	}
-}
-
-func TestHarnessWrapperBuiltInRuntimeIgnoresRuntimeRefAnnotation(t *testing.T) {
-	t.Setenv(harnessWrapperEndpointEnv, "http://wrapper.example.invalid")
-	task, agent := harnessWrapperTaskAndAgent()
-	task.Annotations = map[string]string{harnessWrapperRuntimeRefAnno: "fibey-agentkit"}
-	runtime, token := harnessWrapperReadyAgentRuntime(task.Namespace, "http://custom.example.invalid")
-	r := newUnitReconciler(newTestScheme(), task, agent, runtime, token)
-
-	target, err := r.resolveHarnessRuntimeTarget(context.Background(), task, agent)
-	if err != nil {
-		t.Fatalf("resolveHarnessRuntimeTarget: %v", err)
-	}
-	if target.RuntimeRefName != "" {
-		t.Fatalf("RuntimeRefName = %q, want built-in wrapper target", target.RuntimeRefName)
-	}
-	if target.Endpoint != "http://wrapper.example.invalid" {
-		t.Fatalf("Endpoint = %q, want shared wrapper endpoint", target.Endpoint)
-	}
-	if target.RuntimeName != string(corev1alpha1.AgentRuntimeCodex) {
-		t.Fatalf("RuntimeName = %q, want codex", target.RuntimeName)
-	}
-}
-
-func TestHarnessWrapperFrozenRuntimeRefWaitsForAuthRevalidation(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "fibey-agentkit"}}
-	runtime, token := harnessWrapperReadyAgentRuntime(task.Namespace, "http://custom.example.invalid")
-	runtime.Status.ObservedAuthRefResourceVersion = "1"
-	token.ResourceVersion = "2"
-	task.Annotations = map[string]string{
-		harnessWrapperTurnIDAnnotation:  string(harnessWrapperTurnID(task, 1)),
-		harnessWrapperRuntimeAnnotation: string(harnessWrapperRuntimeSessionID(task, "fibey-agentkit")),
-		harnessWrapperCorrelationIDAnno: string(task.UID),
-	}
-	task.Status.HarnessRuntime = &corev1alpha1.HarnessRuntimeStatus{
-		RuntimeRefName:         "fibey-agentkit",
-		RuntimeName:            "fibey-agentkit",
-		ContractVersion:        "orka.harness.v1",
-		Endpoint:               "http://custom.example.invalid",
-		RuntimeGeneration:      1,
-		AuthRefName:            "fibey-agentkit-token",
-		AuthRefField:           "token",
-		AuthRefResourceVersion: "1",
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, runtime, token)
-
-	_, err := r.resolveHarnessRuntimeTarget(context.Background(), task, agent)
-	if !isAgentRuntimeDependencyNotReady(err) {
-		t.Fatalf("resolveHarnessRuntimeTarget() error = %v, want dependency-not-ready for frozen target after auth Secret version changed", err)
-	}
-}
-
-func TestHarnessWrapperRuntimeRefWaitsForAuthRevalidation(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "fibey-agentkit"}}
-	runtime, token := harnessWrapperReadyAgentRuntime(task.Namespace, "http://custom.example.invalid")
-	runtime.Status.ObservedAuthRefResourceVersion = "1"
-	token.ResourceVersion = "2"
-	r := newUnitReconciler(newTestScheme(), task, agent, runtime, token)
-
-	_, err := r.resolveHarnessRuntimeTarget(context.Background(), task, agent)
-	if !isAgentRuntimeDependencyNotReady(err) {
-		t.Fatalf("resolveHarnessRuntimeTarget() error = %v, want dependency-not-ready after auth Secret version changed", err)
-	}
-}
-
-func TestHarnessWrapperRuntimeRefMissingAgentRuntimeFailsClearly(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "missing-runtime"}}
-	r := newUnitReconciler(newTestScheme(), task, agent)
-
-	if _, err := r.handlePending(context.Background(), task); err != nil {
-		t.Fatalf("handlePending: %v", err)
-	}
-	var updated corev1alpha1.Task
-	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &updated); err != nil {
-		t.Fatalf("get task: %v", err)
-	}
-	if updated.Status.Phase != corev1alpha1.TaskPhaseFailed {
-		t.Fatalf("phase = %s, want Failed", updated.Status.Phase)
-	}
-	if !strings.Contains(updated.Status.Message, `AgentRuntime "missing-runtime" not found`) {
-		t.Fatalf("message = %q, want missing AgentRuntime context", updated.Status.Message)
-	}
-}
-
-func TestHarnessWrapperPlannedTurnMatchesFrozenRuntimeRefAfterAgentChange(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "changed-runtime"}}
-	task.Status.HarnessRuntime = &corev1alpha1.HarnessRuntimeStatus{RuntimeRefName: "fibey-agentkit"}
-	task.Annotations = map[string]string{
-		harnessWrapperTurnIDAnnotation:  string(harnessWrapperTurnID(task, 1)),
-		harnessWrapperRuntimeAnnotation: string(harnessWrapperRuntimeSessionID(task, "fibey-agentkit")),
-		harnessWrapperCorrelationIDAnno: string(task.UID),
-	}
-	if !harnessWrapperPlannedTurnMatchesTask(task, agent, 1) {
-		t.Fatal("planned turn should match frozen runtimeRef even after Agent runtimeRef changes")
-	}
-}
-
-func TestHarnessWrapperCapabilitiesRequireObservedRuntimeRefCapabilities(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != harness.CapabilitiesPath {
-			harness.WriteError(w, http.StatusNotFound, "not found")
-			return
-		}
-		harness.WriteJSON(w, http.StatusOK, harness.CapabilitiesResponse{
-			Version:                 harness.ProtocolVersion,
-			ProtocolVersion:         harness.ProtocolVersion,
-			Transport:               harness.HTTPTransport,
-			RuntimeName:             "fibey-agentkit",
-			ProviderKind:            harness.ProviderKindKubernetesService,
-			ToolExecutionModes:      []harness.ToolExecutionMode{harness.ToolExecutionModeObserved},
-			SupportsCancel:          false,
-			SupportsRuntimeSessions: true,
-		})
-	}))
-	defer server.Close()
-	client, err := harness.NewClient(server.URL)
-	if err != nil {
-		t.Fatalf("NewClient: %v", err)
-	}
-	err = (&TaskReconciler{}).validateHarnessWrapperCapabilities(context.Background(), client, harness.StartTurnRequest{
-		Metadata: map[string]string{"runtime": "fibey-agentkit", "runtimeRef": "fibey-agentkit"},
-	})
-	if err == nil || !strings.Contains(err.Error(), "supportsCancel") {
-		t.Fatalf("validateHarnessWrapperCapabilities() error = %v, want supportsCancel requirement", err)
-	}
-}
-
-func TestHarnessWrapperStartTurnUsesComputedAttemptForTurnID(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	task.Status.Attempts = 1
-	r := newUnitReconciler(newTestScheme(), task, agent)
-	request, err := r.harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 2)
-	if err != nil {
-		t.Fatalf("harnessWrapperStartTurnRequest: %v", err)
-	}
-	if !strings.HasPrefix(string(request.TurnID), "harness-task-") || !strings.HasSuffix(string(request.TurnID), "-2") {
-		t.Fatalf("TurnID = %q, want namespaced/UID-scoped attempt 2 turn ID", request.TurnID)
-	}
-}
-
-func TestHarnessWrapperPlannedBuiltInRetryUsesFrozenRuntimeMetadata(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	turnID := harnessWrapperTurnID(task, 1)
-	runtimeID := harnessWrapperRuntimeSessionID(task, string(corev1alpha1.AgentRuntimeCodex))
-	var startCalls int
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch {
-		case r.Method == http.MethodGet && r.URL.Path == harness.CapabilitiesPath:
-			harness.WriteJSON(w, http.StatusOK, harness.CapabilitiesResponse{
-				Version:                 harness.ProtocolVersion,
-				ProtocolVersion:         harness.ProtocolVersion,
-				Transport:               harness.HTTPTransport,
-				RuntimeName:             "codex",
-				ProviderKind:            harness.ProviderKindKubernetesService,
-				ToolExecutionModes:      []harness.ToolExecutionMode{harness.ToolExecutionModeObserved},
-				SupportsCancel:          true,
-				SupportsRuntimeSessions: true,
-			})
-		case r.Method == http.MethodPost && r.URL.Path == harness.TurnsPath:
-			startCalls++
-			var request harness.StartTurnRequest
-			if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
-				http.Error(w, err.Error(), http.StatusBadRequest)
-				return
-			}
-			if got := request.Metadata["runtime"]; got != "codex" {
-				harness.WriteError(w, http.StatusBadRequest, fmt.Sprintf("runtime metadata = %q, want codex", got))
-				return
-			}
-			if request.RuntimeSessionID != runtimeID {
-				harness.WriteError(w, http.StatusBadRequest, fmt.Sprintf("runtimeSessionID = %q", request.RuntimeSessionID))
-				return
-			}
-			if got := request.Metadata["systemPrompt"]; got != "private instructions" {
-				harness.WriteError(w, http.StatusBadRequest, fmt.Sprintf("systemPrompt metadata = %q, want private instructions", got))
-				return
-			}
-			streamPath, _ := harness.EventStreamPath(request.TurnID)
-			harness.WriteJSON(w, http.StatusAccepted, harness.StartTurnResponse{
-				Version:          harness.ProtocolVersion,
-				Accepted:         true,
-				RuntimeSessionID: request.RuntimeSessionID,
-				TurnID:           request.TurnID,
-				CorrelationID:    request.CorrelationID,
-				EventStreamPath:  streamPath,
-			})
-		default:
-			http.NotFound(w, r)
-		}
-	}))
-	defer srv.Close()
-	t.Setenv(harnessWrapperEndpointEnv, srv.URL)
-
-	task.Annotations = map[string]string{
-		harnessWrapperTurnIDAnnotation:  string(turnID),
-		harnessWrapperRuntimeAnnotation: string(runtimeID),
-		harnessWrapperCorrelationIDAnno: string(task.UID),
-		harnessWrapperLastFrameSeqAnno:  "0",
-		harnessWrapperStartedAnno:       testFalseValue,
-		harnessWrapperMetadataAnno:      `{"runtime":"codex","wrapper":"cli","contractVersion":"orka.harness.v1"}`,
-	}
-	agent.Spec.Runtime.Type = corev1alpha1.AgentRuntimeClaude
-	agent.Spec.SystemPrompt = &corev1alpha1.PromptSource{Inline: "private instructions"}
-	task.Annotations[harnessWrapperMetadataAnno] = `{"runtime":"codex","wrapper":"cli","contractVersion":"orka.harness.v1","maxTurns":"50"}`
-	r := newUnitReconciler(newTestScheme(), task, agent)
-
-	result, err := r.handlePending(context.Background(), task)
-	if err != nil {
-		t.Fatalf("handlePending: %v", err)
-	}
-	if result.RequeueAfter <= 0 {
-		t.Fatalf("RequeueAfter = %s, want positive delay", result.RequeueAfter)
-	}
-	if startCalls != 1 {
-		t.Fatalf("StartTurn calls = %d, want 1", startCalls)
-	}
-	var updated corev1alpha1.Task
-	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &updated); err != nil {
-		t.Fatalf("get task: %v", err)
-	}
-	if updated.Status.Phase != corev1alpha1.TaskPhaseRunning {
-		t.Fatalf("phase = %s, want Running (message=%s)", updated.Status.Phase, updated.Status.Message)
-	}
-}
-
-func TestHarnessWrapperPendingFirstOnlyPlansTurn(t *testing.T) {
-	startCalls := 0
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch {
-		case r.Method == http.MethodGet && r.URL.Path == harness.CapabilitiesPath:
-			harness.WriteJSON(w, http.StatusOK, harness.CapabilitiesResponse{
-				Version:            harness.ProtocolVersion,
-				ProtocolVersion:    harness.ProtocolVersion,
-				Transport:          harness.HTTPTransport,
-				RuntimeName:        "codex",
-				ProviderKind:       harness.ProviderKindKubernetesService,
-				ToolExecutionModes: []harness.ToolExecutionMode{harness.ToolExecutionModeObserved},
-			})
-		case r.Method == http.MethodPost && r.URL.Path == harness.TurnsPath:
-			startCalls++
-			var request harness.StartTurnRequest
-			if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
-				http.Error(w, err.Error(), http.StatusBadRequest)
-				return
-			}
-			eventStreamPath, err := harness.EventStreamPath(request.TurnID)
-			if err != nil {
-				http.Error(w, err.Error(), http.StatusBadRequest)
-				return
-			}
-			harness.WriteJSON(w, http.StatusAccepted, harness.StartTurnResponse{
-				Version:          harness.ProtocolVersion,
-				Accepted:         true,
-				RuntimeSessionID: request.RuntimeSessionID,
-				TurnID:           request.TurnID,
-				CorrelationID:    request.CorrelationID,
-				EventStreamPath:  eventStreamPath,
-			})
-		default:
-			http.NotFound(w, r)
-		}
-	}))
-	defer srv.Close()
-	t.Setenv(harnessWrapperEndpointEnv, srv.URL)
-
-	task, agent := harnessWrapperTaskAndAgent()
-	secret := attachHarnessWrapperRuntimeSecret(task, agent)
-	r := newUnitReconciler(newTestScheme(), task, agent, secret)
-
-	result, err := r.handlePending(context.Background(), task)
-	if err != nil {
-		t.Fatalf("first handlePending: %v", err)
-	}
-	if result.RequeueAfter <= 0 {
-		t.Fatalf("first handlePending requeue = %s, want positive delay", result.RequeueAfter)
-	}
-	if startCalls != 0 {
-		t.Fatalf("StartTurn calls after planning = %d, want 0", startCalls)
-	}
-	var planned corev1alpha1.Task
-	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &planned); err != nil {
-		t.Fatalf("get planned task: %v", err)
-	}
-	if planned.Status.Phase != corev1alpha1.TaskPhasePending {
-		t.Fatalf("phase after planning = %s, want Pending", planned.Status.Phase)
-	}
-	if !taskHasPlannedHarnessWrapperTurn(&planned) {
-		t.Fatalf("planned harness annotations missing: %#v", planned.Annotations)
-	}
-	if taskHasHarnessWrapperTurn(&planned) {
-		t.Fatalf("harness turn marked started during planning: %#v", planned.Annotations)
-	}
-	if got := planned.Annotations[harnessWrapperStartedAnno]; got != testFalseValue {
-		t.Fatalf("%s = %q, want false", harnessWrapperStartedAnno, got)
-	}
-
-	if _, err := r.handlePending(context.Background(), &planned); err != nil {
-		t.Fatalf("second handlePending: %v", err)
-	}
-	if startCalls != 1 {
-		t.Fatalf("StartTurn calls after start = %d, want 1", startCalls)
-	}
-	var running corev1alpha1.Task
-	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &running); err != nil {
-		t.Fatalf("get running task: %v", err)
-	}
-	if running.Status.Phase != corev1alpha1.TaskPhaseRunning {
-		t.Fatalf("phase after start = %s, want Running", running.Status.Phase)
-	}
-	if !taskHasHarnessWrapperTurn(&running) {
-		t.Fatalf("started harness annotations missing: %#v", running.Annotations)
-	}
-}
-
-func TestHarnessRuntimeRunningTaskFinishesAfterStart(t *testing.T) {
-	cfg := cliwrapper.DefaultConfig()
-	cfg.AllowUnauthenticated = true
-	server, err := cliwrapper.NewServer(cfg, &cliwrapper.FakeAdapter{Behavior: cliwrapper.FakeBehaviorSuccess, RuntimeName: "codex"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	srv := httptest.NewServer(server.Handler())
-	defer srv.Close()
-	t.Setenv(harnessWrapperEndpointEnv, srv.URL)
-
-	task, agent := harnessWrapperTaskAndAgent()
-	secret := attachHarnessWrapperRuntimeSecret(task, agent)
-	r := newUnitReconciler(newTestScheme(), task, agent, secret)
-	running := runHarnessWrapperTaskToRunning(t, r, task)
-	if _, err := r.handleRunning(context.Background(), &running); err != nil {
-		t.Fatalf("handleRunning: %v", err)
-	}
-	var updated corev1alpha1.Task
-	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &updated); err != nil {
-		t.Fatalf("get completed task: %v", err)
-	}
-	if updated.Status.Phase != corev1alpha1.TaskPhaseSucceeded {
-		t.Fatalf("phase = %s, want Succeeded", updated.Status.Phase)
-	}
-}
-
-func TestHarnessWrapperStartSkipsStartTurnWhenJournalHasPersistedFrames(t *testing.T) {
-	startCalls := 0
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch {
-		case r.Method == http.MethodGet && r.URL.Path == harness.CapabilitiesPath:
-			harness.WriteJSON(w, http.StatusOK, harness.CapabilitiesResponse{
-				Version:                 harness.ProtocolVersion,
-				ProtocolVersion:         harness.ProtocolVersion,
-				Transport:               harness.HTTPTransport,
-				RuntimeName:             string(corev1alpha1.AgentRuntimeCodex),
-				ProviderKind:            harness.ProviderKindKubernetesService,
-				ToolExecutionModes:      []harness.ToolExecutionMode{harness.ToolExecutionModeObserved},
-				SupportsCancel:          true,
-				SupportsRuntimeSessions: true,
-			})
-		case r.Method == http.MethodPost && r.URL.Path == harness.TurnsPath:
-			startCalls++
-			harness.WriteError(w, http.StatusInternalServerError, "StartTurn should not be called")
-		default:
-			harness.WriteError(w, http.StatusNotFound, "not found")
-		}
-	}))
-	defer srv.Close()
-	t.Setenv(harnessWrapperEndpointEnv, srv.URL)
-
-	task, agent := harnessWrapperTaskAndAgent()
-	task.Annotations = map[string]string{
-		harnessWrapperTurnIDAnnotation:  string(harnessWrapperTurnID(task, 1)),
-		harnessWrapperRuntimeAnnotation: string(harnessWrapperRuntimeSessionID(task, string(agent.Spec.Runtime.Type))),
-		harnessWrapperCorrelationIDAnno: string(task.UID),
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent)
-	if err := appendMappedHarnessFrame(context.Background(), r.ExecutionEventStore, task, harness.HarnessEventFrame{
-		Version:          harness.ProtocolVersion,
-		Type:             harness.FrameTurnStarted,
-		RuntimeSessionID: harness.RuntimeSessionID(task.Annotations[harnessWrapperRuntimeAnnotation]),
-		TurnID:           harness.HarnessTurnID(task.Annotations[harnessWrapperTurnIDAnnotation]),
-		CorrelationID:    task.Annotations[harnessWrapperCorrelationIDAnno],
-		Seq:              1,
-		CreatedAt:        time.Now().UTC(),
-	}); err != nil {
-		t.Fatalf("append persisted frame: %v", err)
-	}
-
-	if _, err := r.handlePending(context.Background(), task); err != nil {
-		t.Fatalf("handlePending: %v", err)
-	}
-	if startCalls != 0 {
-		t.Fatalf("StartTurn calls = %d, want 0", startCalls)
-	}
-	var updated corev1alpha1.Task
-	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &updated); err != nil {
-		t.Fatalf("get task: %v", err)
-	}
-	if updated.Status.Phase != corev1alpha1.TaskPhaseRunning {
-		t.Fatalf("phase = %s, want Running", updated.Status.Phase)
-	}
-	if !taskHasHarnessWrapperTurn(&updated) {
-		t.Fatalf("started harness annotations missing: %#v", updated.Annotations)
-	}
-}
-
-func TestFinishHarnessWrapperTaskUsesJournalDedupeOnReplay(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	turnID := harnessWrapperTurnID(task, 1)
-	runtimeID := harnessWrapperRuntimeSessionID(task, string(agent.Spec.Runtime.Type))
-	correlationID := string(task.UID)
-	task.Status.Phase = corev1alpha1.TaskPhaseRunning
-	task.Status.Attempts = 1
-	task.Annotations = map[string]string{
-		harnessWrapperTurnIDAnnotation:  string(turnID),
-		harnessWrapperRuntimeAnnotation: string(runtimeID),
-		harnessWrapperCorrelationIDAnno: correlationID,
-		harnessWrapperStartedAnno:       scheduledRunLabelValue,
-	}
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		eventsPath, _ := harness.EventStreamPath(turnID)
-		if r.Method != http.MethodGet || r.URL.Path != eventsPath {
-			harness.WriteError(w, http.StatusNotFound, "not found")
-			return
-		}
-		w.Header().Set("Content-Type", "text/event-stream")
-		_ = harness.WriteSSEFrame(w, harness.HarnessEventFrame{
-			Version:          harness.ProtocolVersion,
-			Type:             harness.FrameTurnStarted,
-			RuntimeSessionID: runtimeID,
-			TurnID:           turnID,
-			CorrelationID:    correlationID,
-			Seq:              1,
-			CreatedAt:        time.Now().UTC(),
-		})
-		_ = harness.WriteSSEFrame(w, harness.HarnessEventFrame{
-			Version:          harness.ProtocolVersion,
-			Type:             harness.FrameTurnCompleted,
-			RuntimeSessionID: runtimeID,
-			TurnID:           turnID,
-			CorrelationID:    correlationID,
-			Seq:              2,
-			CreatedAt:        time.Now().UTC(),
-			Completed:        &harness.TurnCompleted{Result: "ok"},
-		})
-		_ = harness.WriteSSEDone(w)
-	}))
-	defer srv.Close()
-	t.Setenv(harnessWrapperEndpointEnv, srv.URL)
-
-	r := newUnitReconciler(newTestScheme(), task, agent)
-	if err := appendMappedHarnessFrame(context.Background(), r.ExecutionEventStore, task, harness.HarnessEventFrame{
-		Version:          harness.ProtocolVersion,
-		Type:             harness.FrameTurnStarted,
-		RuntimeSessionID: runtimeID,
-		TurnID:           turnID,
-		CorrelationID:    correlationID,
-		Seq:              1,
-		CreatedAt:        time.Now().UTC(),
-	}); err != nil {
-		t.Fatalf("append preexisting frame: %v", err)
-	}
-
-	if _, err := r.handleRunning(context.Background(), task); err != nil {
-		t.Fatalf("handleRunning: %v", err)
-	}
-	var updated corev1alpha1.Task
-	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &updated); err != nil {
-		t.Fatalf("get completed task: %v", err)
-	}
-	if updated.Status.Phase != corev1alpha1.TaskPhaseSucceeded {
-		t.Fatalf("phase = %s, want Succeeded", updated.Status.Phase)
-	}
-
-	listed, err := r.ExecutionEventStore.ListExecutionEvents(context.Background(), store.ExecutionEventFilter{
-		Namespace:  task.Namespace,
-		StreamType: store.ExecutionEventStreamTypeTask,
-		StreamID:   task.Name,
-	})
-	if err != nil {
-		t.Fatalf("ListExecutionEvents: %v", err)
-	}
-	counts := map[string]int{}
-	for _, event := range listed {
-		identity, ok := harness.MappedFrameIdentityFromEvent(event)
-		if ok {
-			counts[identity.Key()]++
-		}
-	}
-	seq1Key := strings.Join([]string{string(runtimeID), string(turnID), correlationID, "1"}, "\x00")
-	seq2Key := strings.Join([]string{string(runtimeID), string(turnID), correlationID, "2"}, "\x00")
-	if counts[seq1Key] != 1 {
-		t.Fatalf("seq1 mapped frame count = %d, want 1 (counts=%#v)", counts[seq1Key], counts)
-	}
-	if counts[seq2Key] != 1 {
-		t.Fatalf("seq2 mapped frame count = %d, want 1 (counts=%#v)", counts[seq2Key], counts)
-	}
-}
-
-func appendMappedHarnessFrame(ctx context.Context, eventStore store.ExecutionEventStore, task *corev1alpha1.Task, frame harness.HarnessEventFrame) error {
-	mapped, err := harness.MapFrameToExecutionEvent(frame, harness.EventMapContext{
-		Namespace: task.Namespace,
-		TaskName:  task.Name,
-	})
-	if err != nil {
-		return err
-	}
-	_, err = eventStore.AppendExecutionEvent(ctx, mapped)
-	return err
-}
-
-func TestHarnessRuntimeMissingEndpointFailsAgentTask(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	secret := attachHarnessWrapperRuntimeSecret(task, agent)
-	r := newUnitReconciler(newTestScheme(), task, agent, secret)
-	if _, err := r.handlePending(context.Background(), task); err != nil {
-		t.Fatalf("handlePending: %v", err)
-	}
-	var updated corev1alpha1.Task
-	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &updated); err != nil {
-		t.Fatalf("get task: %v", err)
-	}
-	if updated.Status.Phase != corev1alpha1.TaskPhaseFailed {
-		t.Fatalf("phase = %s, want Failed", updated.Status.Phase)
-	}
-	if updated.Status.JobName != "" {
-		t.Fatalf("JobName = %q, want no job", updated.Status.JobName)
-	}
-}
-
-func runHarnessWrapperTaskToCompletion(t *testing.T, r *TaskReconciler, task *corev1alpha1.Task) corev1alpha1.Task {
-	t.Helper()
-	running := runHarnessWrapperTaskToRunning(t, r, task)
-	if _, err := r.handleRunning(context.Background(), &running); err != nil {
-		t.Fatalf("handleRunning: %v", err)
-	}
-	var updated corev1alpha1.Task
-	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &updated); err != nil {
-		t.Fatalf("get completed task: %v", err)
-	}
-	return updated
-}
-
-func runHarnessWrapperTaskToRunning(t *testing.T, r *TaskReconciler, task *corev1alpha1.Task) corev1alpha1.Task {
-	t.Helper()
-	if _, err := r.handlePending(context.Background(), task); err != nil {
-		t.Fatalf("first handlePending: %v", err)
-	}
-	var current corev1alpha1.Task
-	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &current); err != nil {
-		t.Fatalf("get task after first pending: %v", err)
-	}
-	if current.Status.Phase == corev1alpha1.TaskPhasePending && taskHasPlannedHarnessWrapperTurn(&current) && !taskHasHarnessWrapperTurn(&current) {
-		if _, err := r.handlePending(context.Background(), &current); err != nil {
-			t.Fatalf("second handlePending: %v", err)
-		}
-		if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &current); err != nil {
-			t.Fatalf("get task after second pending: %v", err)
-		}
-	}
-	if current.Status.Phase != corev1alpha1.TaskPhaseRunning {
-		t.Fatalf("phase after pending = %s, want Running", current.Status.Phase)
-	}
-	return current
-}
-
-func harnessWrapperTaskAndAgent() (*corev1alpha1.Task, *corev1alpha1.Agent) {
-	task := &corev1alpha1.Task{
-		ObjectMeta: metav1.ObjectMeta{Name: "harness-task", Namespace: "default", UID: types.UID("uid-harness-task")},
-		Spec: corev1alpha1.TaskSpec{
-			Type:     corev1alpha1.TaskTypeAgent,
-			AgentRef: &corev1alpha1.AgentReference{Name: "harness-agent"},
-			Prompt:   "hello harness",
-		},
-		Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhasePending},
-	}
-	agent := &corev1alpha1.Agent{
-		ObjectMeta: metav1.ObjectMeta{Name: "harness-agent", Namespace: "default"},
-		Spec:       corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeCodex}},
-	}
-	return task, agent
-}
-
-func attachHarnessWrapperRuntimeSecret(task *corev1alpha1.Task, agent *corev1alpha1.Agent) *corev1.Secret {
-	agent.Spec.SecretRef = &corev1.LocalObjectReference{Name: "harness-runtime-secret"}
-	return &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: "harness-runtime-secret", Namespace: task.Namespace},
-		Data: map[string][]byte{
-			workerenv.OpenAIAPIKey: []byte("test-runtime-key"),
-		},
-	}
-}
-
-func harnessWrapperReadyAgentRuntime(namespace, endpoint string) (*corev1alpha1.AgentRuntime, *corev1.Secret) {
-	const name = "fibey-agentkit"
-	runtime := &corev1alpha1.AgentRuntime{
-		ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: namespace, Generation: 1},
-		Spec: corev1alpha1.AgentRuntimeRegistrySpec{
-			ContractVersion: corev1alpha1.AgentRuntimeContractHarnessV1,
-			Deployment: corev1alpha1.AgentRuntimeDeploymentSpec{
-				Mode:     corev1alpha1.AgentRuntimeDeploymentModeExternalEndpoint,
-				Endpoint: endpoint,
-			},
-			ClientAuth: corev1alpha1.AgentRuntimeClientAuth{BearerAuthRef: corev1alpha1.AgentRuntimeBearerAuthReference{
-				Name: name + "-token",
-				Key:  "token",
-			}},
-		},
-		Status: corev1alpha1.AgentRuntimeStatus{
-			Ready:                          true,
-			ObservedGeneration:             1,
-			ObservedAuthRefResourceVersion: "1",
-			ObservedCapabilities: &corev1alpha1.AgentRuntimeObservedCapabilities{
-				ProtocolVersion:         "orka.harness.v1",
-				RuntimeName:             name,
-				ToolExecutionModes:      []corev1alpha1.AgentRuntimeToolExecutionMode{corev1alpha1.AgentRuntimeToolExecutionModeObserved},
-				SupportsCancel:          true,
-				MaxConcurrentTurns:      1,
-				SupportsRuntimeSessions: true,
-			},
-		},
-	}
-	secret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: name + "-token", Namespace: namespace, ResourceVersion: "1", Labels: map[string]string{agentRuntimeAuthUseLabel: scheduledRunLabelValue, agentRuntimeAuthRefNameLabel: name}, Annotations: map[string]string{agentRuntimeAuthEndpointAnnotation: endpoint}},
-		Data:       map[string][]byte{"token": []byte("mock-token")},
-	}
-	return runtime, secret
-}
-
-func hasExecutionEventType(eventsList []store.ExecutionEvent, typ string) bool {
-	for _, event := range eventsList {
-		if event.Type == typ {
-			return true
-		}
-	}
-	return false
-}
-
-func TestHarnessWrapperCapabilitiesUseInputToolsForRequiredBrokeredClasses(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != harness.CapabilitiesPath {
-			harness.WriteError(w, http.StatusNotFound, "not found")
-			return
-		}
-		harness.WriteJSON(w, http.StatusOK, harness.CapabilitiesResponse{
-			Version:                 harness.ProtocolVersion,
-			ProtocolVersion:         harness.ProtocolVersion,
-			Transport:               harness.HTTPTransport,
-			RuntimeName:             "brokered-runtime",
-			ProviderKind:            harness.ProviderKindRemote,
-			ToolExecutionModes:      []harness.ToolExecutionMode{harness.ToolExecutionModeBrokered},
-			BrokeredToolClasses:     []harness.BrokeredToolClass{harness.BrokeredToolClassRead},
-			SupportsRuntimeSessions: true,
-			SupportsContinuation:    true,
-		})
-	}))
-	defer server.Close()
-	client, err := harness.NewClient(server.URL)
-	if err != nil {
-		t.Fatalf("NewClient: %v", err)
-	}
-	request := harness.StartTurnRequest{
-		Metadata:          map[string]string{"runtime": "brokered-runtime", "runtimeRef": "runtime", "brokeredToolClasses": "read"},
-		ToolExecutionMode: harness.ToolExecutionModeBrokered,
-		Input: harness.TurnInput{Tools: []harness.ToolDefinition{{
-			Name:          "dispatch_work_order",
-			BrokeredClass: harness.BrokeredToolClassWrite,
-		}}},
-	}
-	err = (&TaskReconciler{}).validateHarnessWrapperCapabilities(context.Background(), client, request)
-	if err == nil || !strings.Contains(err.Error(), "brokeredToolClass") || !strings.Contains(err.Error(), "write") {
-		t.Fatalf("validateHarnessWrapperCapabilities() = %v, want write class rejection from input.tools", err)
-	}
-}
-
-func TestHarnessWrapperBuiltInToolFiltersStayMetadataOnly(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{
-		AllowedTools:    []string{"Read", "Grep"},
-		DisallowedTools: []string{"Bash", "Write"},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent)
-	request, err := r.harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 1)
-	if err != nil {
-		t.Fatalf("harnessWrapperStartTurnRequest: %v", err)
-	}
-	if request.ToolExecutionMode != harness.ToolExecutionModeObserved {
-		t.Fatalf("ToolExecutionMode = %q, want observed", request.ToolExecutionMode)
-	}
-	if len(request.Input.Tools) != 0 {
-		t.Fatalf("Input.Tools = %#v, want no brokered tools for built-in CLI runtime", request.Input.Tools)
-	}
-	if request.Metadata["allowedTools"] != "Read,Grep" {
-		t.Fatalf("metadata allowedTools = %q, want Read,Grep", request.Metadata["allowedTools"])
-	}
-	if request.Metadata["disallowedTools"] != "Bash,Write" {
-		t.Fatalf("metadata disallowedTools = %q, want Bash,Write", request.Metadata["disallowedTools"])
-	}
-}
-
-func TestHarnessWrapperTurnRequestCarriesSafeBrokeredToolSchemas(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "runtime"}}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{"read_incident", "delegate_task"}}
-	tool := &corev1alpha1.Tool{
-		ObjectMeta: metav1.ObjectMeta{Name: "read_incident", Namespace: task.Namespace},
-		Spec: corev1alpha1.ToolSpec{
-			Description:       "Read incident status",
-			BrokeredToolClass: corev1alpha1.AgentRuntimeBrokeredToolClassRead,
-			Parameters:        &apiextensionsv1.JSON{Raw: []byte(`{"type":"object","properties":{"incident":{"type":"string"}}}`)},
-			HTTP:              &corev1alpha1.HTTPExecution{URL: "https://tools.example.invalid/read", AuthSecretRef: &corev1alpha1.SecretKeySelector{Name: "tool-secret", Key: "token"}},
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, tool)
-	request, err := r.harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 1)
-	if err != nil {
-		t.Fatalf("harnessWrapperStartTurnRequest: %v", err)
-	}
-	if request.ToolExecutionMode != harness.ToolExecutionModeBrokered {
-		t.Fatalf("ToolExecutionMode = %q, want brokered", request.ToolExecutionMode)
-	}
-	if len(request.Input.Tools) != 2 {
-		t.Fatalf("Input.Tools = %#v, want read tool and coordination tool", request.Input.Tools)
-	}
-	byName := map[string]harness.ToolDefinition{}
-	for _, definition := range request.Input.Tools {
-		byName[definition.Name] = definition
-		encoded, _ := json.Marshal(definition)
-		if strings.Contains(string(encoded), "tools.example") || strings.Contains(string(encoded), "tool-secret") {
-			t.Fatalf("tool definition leaked execution details: %s", encoded)
-		}
-	}
-	read := byName["read_incident"]
-	if read.Description != "Read incident status" || read.BrokeredClass != harness.BrokeredToolClassRead || !json.Valid(read.Parameters) {
-		t.Fatalf("read tool definition = %#v", read)
-	}
-	coord := byName["delegate_task"]
-	if coord.BrokeredClass != harness.BrokeredToolClassCoordination || coord.Description == "" {
-		t.Fatalf("coordination tool definition = %#v", coord)
-	}
-}
-
-func TestHarnessWrapperCompletedResultBytesPreservesStructuredPayload(t *testing.T) {
-	encoded := harnessWrapperCompletedResultBytes(&harness.TurnCompleted{
-		Result: "done",
-		Data:   map[string]any{"incident": "quincy-north", "score": float64(0.9)},
-		Artifacts: []harness.ArtifactRef{{
-			Filename:    "evidence.json",
-			ContentType: "application/json",
-			Size:        42,
-		}},
-	})
-	parsed := common.ParseStructuredResult(string(encoded))
-	if parsed.Summary != "done" || parsed.Data["incident"] != "quincy-north" {
-		t.Fatalf("parsed structured result = %#v", parsed)
-	}
-	if len(parsed.Artifacts) != 1 || parsed.Artifacts[0].Filename != "evidence.json" {
-		t.Fatalf("artifacts = %#v", parsed.Artifacts)
-	}
-}
-
-func TestHarnessWrapperTurnRequestCarriesAgentRuntimeSecretEnv(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.SecretRef = &corev1.LocalObjectReference{Name: "agent-runtime-secret"}
-	task.Spec.SecretRef = &corev1alpha1.SecretReference{Name: "task-runtime-secret"}
-	agentSecret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: "agent-runtime-secret", Namespace: agent.Namespace},
-		Data: map[string][]byte{
-			workerenv.OpenAIAPIKey: []byte("runtime-openai-key"),
-			workerenv.GitHubToken:  []byte("runtime-github-token"),
-		},
-	}
-	taskSecret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: "task-runtime-secret", Namespace: task.Namespace},
-		Data: map[string][]byte{
-			workerenv.AnthropicAPIKey: []byte("runtime-anthropic-key"),
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, agentSecret, taskSecret)
-	request, err := r.harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 1)
-	if err != nil {
-		t.Fatalf("harnessWrapperStartTurnRequest: %v", err)
-	}
-	env := map[string]string{}
-	for _, item := range request.Input.Env {
-		env[item.Name] = item.Value
-	}
-	if env[workerenv.OpenAIAPIKey] != "runtime-openai-key" {
-		t.Fatalf("%s = %q, want runtime credential", workerenv.OpenAIAPIKey, env[workerenv.OpenAIAPIKey])
-	}
-	if env[workerenv.GitHubToken] != "runtime-github-token" {
-		t.Fatalf("%s = %q, want runtime credential", workerenv.GitHubToken, env[workerenv.GitHubToken])
-	}
-	if env[workerenv.AnthropicAPIKey] != "runtime-anthropic-key" {
-		t.Fatalf("%s = %q, want task runtime credential", workerenv.AnthropicAPIKey, env[workerenv.AnthropicAPIKey])
-	}
-}
-
-func TestPlannedHarnessWrapperStartTurnRequestRebuildsFullInput(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	task.Spec.Env = []corev1.EnvVar{{Name: workerenv.CodexCLIPath, Value: "/bin/codex-test"}}
-	agent.Spec.SecretRef = &corev1.LocalObjectReference{Name: "agent-runtime-secret"}
-	secret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: "agent-runtime-secret", Namespace: task.Namespace},
-		Data: map[string][]byte{
-			workerenv.OpenAIAPIKey: []byte("runtime-openai-key"),
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, secret)
-	planned, err := r.harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 1)
-	if err != nil {
-		t.Fatalf("harnessWrapperStartTurnRequest: %v", err)
-	}
-	task.Annotations = map[string]string{
-		harnessWrapperTurnIDAnnotation:  string(planned.TurnID),
-		harnessWrapperRuntimeAnnotation: string(planned.RuntimeSessionID),
-		harnessWrapperCorrelationIDAnno: planned.CorrelationID,
-		harnessWrapperMetadataAnno:      `{"runtime":"codex","wrapper":"cli"}`,
-		harnessWrapperLastFrameSeqAnno:  "0",
-		harnessWrapperStartedAnno:       scheduledRunLabelValue,
-	}
-
-	replayed, err := r.plannedHarnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now())
-	if err != nil {
-		t.Fatalf("plannedHarnessWrapperStartTurnRequest: %v", err)
-	}
-	if replayed.TurnID != planned.TurnID || replayed.RuntimeSessionID != planned.RuntimeSessionID || replayed.CorrelationID != planned.CorrelationID {
-		t.Fatalf("replayed identity = (%q,%q,%q), want planned (%q,%q,%q)", replayed.TurnID, replayed.RuntimeSessionID, replayed.CorrelationID, planned.TurnID, planned.RuntimeSessionID, planned.CorrelationID)
-	}
-	env := map[string]string{}
-	for _, item := range replayed.Input.Env {
-		env[item.Name] = item.Value
-	}
-	if env[workerenv.CodexCLIPath] != "/bin/codex-test" {
-		t.Fatalf("%s = %q, want task env", workerenv.CodexCLIPath, env[workerenv.CodexCLIPath])
-	}
-	if env[workerenv.OpenAIAPIKey] != "runtime-openai-key" {
-		t.Fatalf("%s = %q, want runtime secret env", workerenv.OpenAIAPIKey, env[workerenv.OpenAIAPIKey])
-	}
-}
-
-func TestHarnessWrapperTurnRequestUsesTaskNamespaceForCrossNamespaceAgentSecret(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Namespace = "shared-agents"
-	agent.Spec.SecretRef = &corev1.LocalObjectReference{Name: "runtime-secret"}
-	secret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: "runtime-secret", Namespace: task.Namespace},
-		Data:       map[string][]byte{workerenv.OpenAIAPIKey: []byte("task-local-key")},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, secret)
-	request, err := r.harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 1)
-	if err != nil {
-		t.Fatalf("harnessWrapperStartTurnRequest: %v", err)
-	}
-	env := map[string]string{}
-	for _, item := range request.Input.Env {
-		env[item.Name] = item.Value
-	}
-	if env[workerenv.OpenAIAPIKey] != "task-local-key" {
-		t.Fatalf("%s = %q, want task-local secret", workerenv.OpenAIAPIKey, env[workerenv.OpenAIAPIKey])
-	}
-}
-
-func TestHarnessWrapperTurnRequestAllowsRuntimeSecretProviderBaseURL(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.SecretRef = &corev1.LocalObjectReference{Name: "runtime-secret"}
-	secret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: "runtime-secret", Namespace: task.Namespace},
-		Data: map[string][]byte{
-			workerenv.OpenAIAPIKey:  []byte("runtime-key"),
-			workerenv.OpenAIBaseURL: []byte("https://proxy.example.invalid/v1"),
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, secret)
-	request, err := r.harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 1)
-	if err != nil {
-		t.Fatalf("harnessWrapperStartTurnRequest: %v", err)
-	}
-	env := map[string]string{}
-	for _, item := range request.Input.Env {
-		env[item.Name] = item.Value
-	}
-	if env[workerenv.OpenAIBaseURL] != "https://proxy.example.invalid/v1" {
-		t.Fatalf("%s = %q, want proxy base URL", workerenv.OpenAIBaseURL, env[workerenv.OpenAIBaseURL])
-	}
-}
-
-func TestHarnessWrapperSecretEnvSkipsFileStyleKeys(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.SecretRef = &corev1.LocalObjectReference{Name: "runtime-secret"}
-	secret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: "runtime-secret", Namespace: task.Namespace},
-		Data: map[string][]byte{
-			workerenv.OpenAIAPIKey: []byte("runtime-key"),
-			".npmrc":               []byte("registry=https://example.invalid"),
-			"config.json":          []byte("{}"),
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, secret)
-	request, err := r.harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 1)
-	if err != nil {
-		t.Fatalf("harnessWrapperStartTurnRequest: %v", err)
-	}
-	env := map[string]string{}
-	for _, item := range request.Input.Env {
-		env[item.Name] = item.Value
-	}
-	if env[workerenv.OpenAIAPIKey] != "runtime-key" {
-		t.Fatalf("%s = %q, want runtime key", workerenv.OpenAIAPIKey, env[workerenv.OpenAIAPIKey])
-	}
-	if _, ok := env[".npmrc"]; ok {
-		t.Fatal("file-style key .npmrc was projected as env")
-	}
-	if _, ok := env["config.json"]; ok {
-		t.Fatal("file-style key config.json was projected as env")
-	}
-}
-
-func TestHarnessWrapperTurnRequestRejectsWrapperPrivateSecretEnv(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	task.Spec.SecretRef = &corev1alpha1.SecretReference{Name: "task-runtime-secret"}
-	taskSecret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: "task-runtime-secret", Namespace: task.Namespace},
-		Data: map[string][]byte{
-			"ORKA_HARNESS_WRAPPER_CHILD_UID": []byte("0"),
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, taskSecret)
-	_, err := r.harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 1)
-	if err == nil || !strings.Contains(err.Error(), "reserved for wrapper configuration") {
-		t.Fatalf("harnessWrapperStartTurnRequest() error = %v, want wrapper-private Secret env rejection", err)
-	}
-}
-
-func TestHarnessWrapperTurnRequestRejectsControllerUploadSecretEnv(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	task.Spec.SecretRef = &corev1alpha1.SecretReference{Name: "task-runtime-secret"}
-	taskSecret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: "task-runtime-secret", Namespace: task.Namespace},
-		Data: map[string][]byte{
-			workerenv.ControllerURL: []byte("https://attacker.example.invalid"),
-			"HTTPS_PROXY":           []byte("https://proxy.example.invalid"),
-			"ORKA_ARTIFACTS_DIR":    []byte("/tmp/evil-artifacts"),
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, taskSecret)
-	_, err := r.harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 1)
-	if err == nil || !strings.Contains(err.Error(), "reserved for controller-managed runtime configuration") {
-		t.Fatalf("harnessWrapperStartTurnRequest() error = %v, want controller upload env rejection", err)
-	}
-}
-
-func TestHarnessWrapperTurnRequestPrependsSkillsToSystemPrompt(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.SystemPrompt = &corev1alpha1.PromptSource{Inline: "Base instructions"}
-	agent.Spec.Skills = []corev1alpha1.SkillReference{{Name: "agent-skill"}}
-	task.Spec.AI = &corev1alpha1.AISpec{Skills: []corev1alpha1.SkillReference{{
-		ConfigMapRef: &corev1alpha1.ConfigMapKeySelector{Name: "task-skills", Key: "review"},
-	}}}
-	skill := &corev1alpha1.Skill{
-		ObjectMeta: metav1.ObjectMeta{Name: "agent-skill", Namespace: task.Namespace},
-		Spec: corev1alpha1.SkillSpec{Content: corev1alpha1.SkillContent{
-			Inline: "Use the agent skill.",
-		}},
-	}
-	skillCM := &corev1.ConfigMap{
-		ObjectMeta: metav1.ObjectMeta{Name: "task-skills", Namespace: task.Namespace},
-		Data:       map[string]string{"review": "Use the task skill."},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, skill, skillCM)
-	request, err := r.harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 1)
-	if err != nil {
-		t.Fatalf("harnessWrapperStartTurnRequest: %v", err)
-	}
-	want := "Use the agent skill.\n\nUse the task skill.\n\nBase instructions"
-	if request.Metadata["systemPrompt"] != want {
-		t.Fatalf("systemPrompt = %q, want %q", request.Metadata["systemPrompt"], want)
-	}
-}
-
-func TestHarnessWrapperTurnRequestFiltersReadOnlyRuntimeSecretEnv(t *testing.T) {
-	const readOnlyWorkspaceGitCredential = "test"
-	task, agent := harnessWrapperTaskAndAgent()
-	task.Annotations = map[string]string{labels.AnnotationAgentReadOnly: scheduledRunLabelValue}
-	task.Spec.Env = []corev1.EnvVar{
-		{Name: workerenv.AgentReadOnly, Value: testFalseValue},
-		{Name: workerenv.ResultStdout, Value: testFalseValue},
-		{Name: workerenv.AllowBash, Value: scheduledRunLabelValue},
-		{Name: workerenv.AllowedTools, Value: "Bash,Write"},
-	}
-	agent.Spec.Runtime.Type = corev1alpha1.AgentRuntimeClaude
-	agent.Spec.SecretRef = &corev1.LocalObjectReference{Name: "agent-runtime-secret"}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{Workspace: &corev1alpha1.WorkspaceConfig{
-		GitRepo:      "https://github.com/orka-agents/orka",
-		GitSecretRef: &corev1.LocalObjectReference{Name: "git-credentials"},
-	}}
-	agentSecret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: "agent-runtime-secret", Namespace: agent.Namespace},
-		Data: map[string][]byte{
-			workerenv.AnthropicAPIKey:         []byte("runtime-anthropic-key"),
-			workerenv.AnthropicFoundryBaseURL: []byte("https://foundry.example.test/anthropic"),
-			workerenv.GitHubToken:             []byte("runtime-github-token"),
-		},
-	}
-	task.Spec.SecretRef = &corev1alpha1.SecretReference{Name: "task-runtime-secret"}
-	taskSecret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: "task-runtime-secret", Namespace: task.Namespace},
-		Data:       map[string][]byte{workerenv.OpenAIAPIKey: []byte("task-openai-key")},
-	}
-	gitSecret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: "git-credentials", Namespace: task.Namespace},
-		Data:       map[string][]byte{"token": []byte(readOnlyWorkspaceGitCredential)},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, agentSecret, taskSecret, gitSecret)
-	request, err := r.harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 1)
-	if err != nil {
-		t.Fatalf("harnessWrapperStartTurnRequest: %v", err)
-	}
-	env := map[string]string{}
-	for _, item := range request.Input.Env {
-		env[item.Name] = item.Value
-	}
-	if env[workerenv.AnthropicAPIKey] != "runtime-anthropic-key" {
-		t.Fatalf("%s = %q, want runtime credential", workerenv.AnthropicAPIKey, env[workerenv.AnthropicAPIKey])
-	}
-	if env[workerenv.AnthropicFoundryBaseURL] != "https://foundry.example.test/anthropic" {
-		t.Fatalf("%s = %q, want Foundry endpoint", workerenv.AnthropicFoundryBaseURL, env[workerenv.AnthropicFoundryBaseURL])
-	}
-	if env[workerenv.GitHubToken] == "runtime-github-token" {
-		t.Fatalf("read-only Claude runtime should not receive unrelated %s", workerenv.GitHubToken)
-	}
-	if env[workerenv.GitToken] != readOnlyWorkspaceGitCredential {
-		t.Fatalf("%s = %q, want workspace git credential for read-only prep", workerenv.GitToken, env[workerenv.GitToken])
-	}
-	if env[workerenv.OpenAIAPIKey] == "task-openai-key" {
-		t.Fatalf("task secret credentials should not be sent to read-only harness turns")
-	}
-	if env[workerenv.AllowBash] != "" || env[workerenv.AllowedTools] == "Bash,Write" {
-		t.Fatalf("read-only task env should not override runtime permissions: %#v", env)
-	}
-	if env[workerenv.AgentReadOnly] != scheduledRunLabelValue || env[workerenv.ResultStdout] != scheduledRunLabelValue {
-		t.Fatalf("read-only control env not forced: %#v", env)
-	}
-	if env[workerenv.GitToken] != readOnlyWorkspaceGitCredential {
-		t.Fatalf("workspace git credentials not preserved for read-only prep: %#v", env)
-	}
-}
-
-func TestHarnessWrapperTurnRequestRejectsCrossNamespaceTaskSecret(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	task.Spec.SecretRef = &corev1alpha1.SecretReference{Name: "task-runtime-secret", Namespace: "other"}
-	r := newUnitReconciler(newTestScheme(), task, agent)
-	_, err := r.harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 1)
-	if err == nil || !strings.Contains(err.Error(), "does not match task namespace") {
-		t.Fatalf("harnessWrapperStartTurnRequest() error = %v, want namespace rejection", err)
-	}
-}
-
-func TestHarnessWrapperPlannedTurnMustMatchTaskIdentity(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	task.Annotations = map[string]string{
-		harnessWrapperTurnIDAnnotation:  string(harnessWrapperTurnID(task, 1)),
-		harnessWrapperRuntimeAnnotation: string(harnessWrapperRuntimeSessionID(task, string(agent.Spec.Runtime.Type))),
-		harnessWrapperCorrelationIDAnno: string(task.UID),
-	}
-	if !harnessWrapperPlannedTurnMatchesTask(task, agent, 1) {
-		t.Fatal("expected planned turn to match task identity")
-	}
-	task.Annotations[harnessWrapperTurnIDAnnotation] = "other-turn"
-	if harnessWrapperPlannedTurnMatchesTask(task, agent, 1) {
-		t.Fatal("expected copied turn id to be rejected")
-	}
-}
-
-// The persisted execution-event SessionName for a harness task must be EMPTY
-// when the task has no real SessionRef, so a SessionRef-less task named "foo"
-// cannot collide its events into a real Session "foo". The protocol-level
-// harnessWrapperSessionName still falls back to the task name (a non-empty
-// identifier is required on the wire), but that value must NOT be the one
-// persisted as the event session key.
-func TestHarnessEventSessionNameEmptyWithoutRealSessionRef(t *testing.T) {
-	r := &TaskReconciler{}
-	task, _ := harnessWrapperTaskAndAgent()
-	task.Spec.SessionRef = nil
-
-	if got := r.executionEventSessionName(context.Background(), task); got != "" {
-		t.Fatalf("executionEventSessionName for SessionRef-less task = %q, want empty (no collision into a real Session)", got)
-	}
-	// The protocol identifier helper still returns a non-empty value (the task name).
-	if got := harnessWrapperSessionName(task); got != task.Name {
-		t.Fatalf("harnessWrapperSessionName = %q, want task name %q for the protocol request", got, task.Name)
-	}
-}
-
-func TestHarnessWrapperTurnMetadataCarriesTaskTimeout(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	task.Spec.Timeout = &metav1.Duration{Duration: 45 * time.Minute}
-	r := newUnitReconciler(newTestScheme(), task, agent)
-	request, err := r.harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 1)
-	if err != nil {
-		t.Fatalf("harnessWrapperStartTurnRequest: %v", err)
-	}
-	if request.Metadata["timeoutSeconds"] != "2700" {
-		t.Fatalf("metadata timeoutSeconds = %q, want 2700", request.Metadata["timeoutSeconds"])
-	}
-}
-
-func TestHarnessWrapperTurnRequestResolvesTaskValueFromEnv(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	task.Spec.Env = []corev1.EnvVar{
-		{
-			Name: "CONFIG_VALUE",
-			ValueFrom: &corev1.EnvVarSource{ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
-				LocalObjectReference: corev1.LocalObjectReference{Name: "task-config"},
-				Key:                  "setting",
-			}},
-		},
-		{
-			Name:      "TASK_NAME",
-			ValueFrom: &corev1.EnvVarSource{FieldRef: &corev1.ObjectFieldSelector{FieldPath: "metadata.name"}},
-		},
-	}
-	cm := &corev1.ConfigMap{
-		ObjectMeta: metav1.ObjectMeta{Name: "task-config", Namespace: task.Namespace},
-		Data:       map[string]string{"setting": "from-config"},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, cm)
-	request, err := r.harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 1)
-	if err != nil {
-		t.Fatalf("harnessWrapperStartTurnRequest: %v", err)
-	}
-	env := map[string]string{}
-	for _, item := range request.Input.Env {
-		env[item.Name] = item.Value
-	}
-	if env["CONFIG_VALUE"] != "from-config" {
-		t.Fatalf("CONFIG_VALUE = %q, want from-config", env["CONFIG_VALUE"])
-	}
-	if env["TASK_NAME"] != task.Name {
-		t.Fatalf("TASK_NAME = %q, want %q", env["TASK_NAME"], task.Name)
-	}
-}
-
-func TestHarnessWrapperTurnRequestOmitsOptionalMissingValueFromEnv(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	optional := true
-	task.Spec.Env = []corev1.EnvVar{
-		{
-			Name: "OPTIONAL_CONFIG",
-			ValueFrom: &corev1.EnvVarSource{ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
-				LocalObjectReference: corev1.LocalObjectReference{Name: "missing-config"},
-				Key:                  "setting",
-				Optional:             &optional,
-			}},
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent)
-	request, err := r.harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 1)
-	if err != nil {
-		t.Fatalf("harnessWrapperStartTurnRequest: %v", err)
-	}
-	for _, item := range request.Input.Env {
-		if item.Name == "OPTIONAL_CONFIG" {
-			t.Fatalf("OPTIONAL_CONFIG was emitted with value %q, want omitted", item.Value)
-		}
-	}
-}
-
-func TestHarnessWrapperTurnRequestCarriesWorkspaceGitSecretEnv(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{Workspace: &corev1alpha1.WorkspaceConfig{
-		GitRepo:      "https://github.com/orka-agents/orka",
-		GitSecretRef: &corev1.LocalObjectReference{Name: "git-credentials"},
-	}}
-	gitSecret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: "git-credentials", Namespace: task.Namespace},
-		Data: map[string][]byte{
-			"token":    []byte("git-token-value"),
-			"username": []byte("git-user"),
-		},
-	}
-	agent.Spec.SecretRef = &corev1.LocalObjectReference{Name: "agent-runtime-secret"}
-	agentSecret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: "agent-runtime-secret", Namespace: task.Namespace},
-		Data: map[string][]byte{
-			workerenv.GitToken: []byte("agent-token-value"),
-		},
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent, gitSecret, agentSecret)
-	request, err := r.harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 1)
-	if err != nil {
-		t.Fatalf("harnessWrapperStartTurnRequest: %v", err)
-	}
-	env := map[string]string{}
-	for _, item := range request.Input.Env {
-		env[item.Name] = item.Value
-	}
-	if env[workerenv.GitToken] != "git-token-value" {
-		t.Fatalf("git token env missing or wrong: %#v", env)
-	}
-	if env[workerenv.GitHubToken] == "git-token-value" {
-		t.Fatalf("workspace git token should not overwrite runtime %s: %#v", workerenv.GitHubToken, env)
-	}
-	if env[workerenv.GitUsername] != "git-user" {
-		t.Fatalf("git username env = %q, want git-user", env[workerenv.GitUsername])
-	}
-	if env[workerenv.GitAskpass] == "" {
-		t.Fatalf("%s missing from harness turn env", workerenv.GitAskpass)
-	}
-}
-
-func TestHarnessWrapperTurnRequestCarriesSafeEnvAndWorkspaceMetadata(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	task.Spec.Env = []corev1.EnvVar{{Name: workerenv.PRBaseSHA, Value: "base-sha"}, {Name: "ORKA_SECURITY_STAGE", Value: "review"}}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{Workspace: &corev1alpha1.WorkspaceConfig{
-		GitRepo:      "https://github.com/orka-agents/orka",
-		Branch:       "main",
-		SubPath:      "docs",
-		ForkRepo:     "https://github.com/orka-agents/orka-fork",
-		PRBaseBranch: "contract",
-		PushBranch:   "agent/test-branch",
-	}}
-	r := newUnitReconciler(newTestScheme(), task, agent)
-	r.JobBuilder = &JobBuilder{ControllerURL: "http://orka-api.test:8080"}
-	request, err := r.harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 1)
-	if err != nil {
-		t.Fatalf("harnessWrapperStartTurnRequest: %v", err)
-	}
-	for key, want := range map[string]string{
-		"gitRepo":          "https://github.com/orka-agents/orka",
-		"gitBranch":        "main",
-		"workspaceSubPath": "docs",
-		"forkRepo":         "https://github.com/orka-agents/orka-fork",
-		"prBaseBranch":     "contract",
-		"pushBranch":       "agent/test-branch",
-		"prBaseSHA":        "base-sha",
-	} {
-		if got := request.Metadata[key]; got != want {
-			t.Fatalf("metadata[%s] = %q, want %q", key, got, want)
-		}
-	}
-	env := map[string]string{}
-	for _, item := range request.Input.Env {
-		env[item.Name] = item.Value
-	}
-	for key, want := range map[string]string{
-		workerenv.ControllerURL:  "http://orka-api.test:8080",
-		workerenv.ResultEndpoint: "http://orka-api.test:8080/internal/v1/results/default/harness-task",
-		workerenv.PRBaseSHA:      "base-sha",
-		"ORKA_SECURITY_STAGE":    "review",
-	} {
-		if got := env[key]; got != want {
-			t.Fatalf("env[%s] = %q, want %q", key, got, want)
-		}
-	}
-}
-
-func TestValidateHarnessWrapperTaskEnvRejectsSecretAndUnsupportedValueFrom(t *testing.T) {
-	if err := validateHarnessWrapperTaskEnv([]corev1.EnvVar{{Name: "ORKA_SECURITY_STAGE", Value: "review"}}); err != nil {
-		t.Fatalf("safe env rejected: %v", err)
-	}
-	if err := validateHarnessWrapperTaskEnv([]corev1.EnvVar{{Name: "API_TOKEN", Value: "secret"}}); err == nil {
-		t.Fatal("expected secret-shaped env name to be rejected")
-	}
-	if err := validateHarnessWrapperTaskEnv([]corev1.EnvVar{{Name: "SAFE", ValueFrom: &corev1.EnvVarSource{}}}); err == nil {
-		t.Fatal("expected valueFrom env to be rejected")
-	}
-}
-
-func TestHarnessWrapperCapabilitiesReadErrorRetryable(t *testing.T) {
-	if !harnessWrapperCapabilitiesErrorIsRetryable(fmt.Errorf("read harness runtime capabilities: boom")) {
-		t.Fatal("expected capabilities read error to be retryable")
-	}
-	if harnessWrapperCapabilitiesErrorIsRetryable(fmt.Errorf("read harness runtime capabilities: get failed (404): not found")) {
-		t.Fatal("expected permanent capabilities 404 to remain terminal")
-	}
-}
-
-func TestHarnessWrapperStreamMissingTurnErrorClassification(t *testing.T) {
-	for _, message := range []string{"stream_frames failed (404): turn not found", "stream_frames failed (410): gone"} {
-		if !harnessWrapperStreamErrorIsMissingTurn(fmt.Errorf("%s", message)) {
-			t.Fatalf("%q should be classified as missing turn", message)
-		}
-	}
-	if harnessWrapperStreamErrorIsMissingTurn(fmt.Errorf("stream_frames failed (401): unauthorized")) {
-		t.Fatal("unauthorized stream error should not be classified as missing turn")
-	}
-}
-
-func TestHarnessWrapperStreamTerminalErrorClassification(t *testing.T) {
-	for _, message := range []string{
-		"harness frame identity does not match running turn",
-		"invalid harness frame: turn completed payload is required",
-		"stream_frames failed: decode harness frame: invalid character",
-	} {
-		if !harnessWrapperStreamErrorIsTerminal(fmt.Errorf("%s", message)) {
-			t.Fatalf("%q should be terminal", message)
-		}
-	}
-}
-
-func TestHarnessMutationAcceptanceClassification(t *testing.T) {
-	for _, status := range []int{http.StatusRequestTimeout, http.StatusTooManyRequests, http.StatusInternalServerError, http.StatusBadGateway} {
-		if !harnessMutationMayHaveBeenAccepted(harness.ClientError{StatusCode: status}) {
-			t.Fatalf("status %d should retain ambiguous continuation state", status)
-		}
-	}
-	for _, status := range []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusConflict, http.StatusUnprocessableEntity} {
-		if harnessMutationMayHaveBeenAccepted(harness.ClientError{StatusCode: status}) {
-			t.Fatalf("status %d should be a definitive continuation rejection", status)
-		}
-	}
-	for _, message := range []string{
-		"post failed: connection reset",
-		"post failed (500): unsupported version",
-		"post failed (408): timeout",
-		"connection reset while parsing note (422)",
-		"connection reset calling https://unauthorized.example",
-		"start_turn failed: unsupported version",
-		"continue_turn failed: unauthorized",
-		"post failed (429): rate limited",
-	} {
-		if !harnessMutationMayHaveBeenAccepted(fmt.Errorf("%s", message)) {
-			t.Fatalf("legacy error %q should retain ambiguous state", message)
-		}
-	}
-	for _, message := range []string{"post failed (400): invalid request", "post failed (401): unauthorized", "continue_turn failed: harness did not accept continuation"} {
-		if harnessMutationMayHaveBeenAccepted(fmt.Errorf("%s", message)) {
-			t.Fatalf("legacy error %q should be definitive", message)
-		}
-	}
-}
-
-func TestHarnessContinuationMarkerClearClassification(t *testing.T) {
-	rejected := harness.ClientError{StatusCode: http.StatusBadRequest}
-	if !harnessContinuationMarkerShouldClear(false, rejected) {
-		t.Fatal("new marker should clear after definitive rejection")
-	}
-	if harnessContinuationMarkerShouldClear(true, rejected) {
-		t.Fatal("pre-existing ambiguous marker should not clear after replay rejection")
-	}
-	if harnessContinuationMarkerShouldClear(false, harness.ClientError{StatusCode: http.StatusBadGateway}) {
-		t.Fatal("ambiguous server failure should retain marker")
-	}
-}
-
-func TestHarnessWrapperStreamSizeLimitErrorIsTerminal(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.Header().Set("Content-Type", "text/event-stream")
-		_, _ = w.Write([]byte("data: " + strings.Repeat("x", (8<<20)+1) + "\n\n"))
-	}))
-	defer server.Close()
-	client, err := harness.NewClient(server.URL)
-	if err != nil {
-		t.Fatalf("NewClient() error = %v", err)
-	}
-	err = client.StreamFrames(context.Background(), "turn-a", 0, func(harness.HarnessEventFrame) error { return nil })
-	if err == nil || !harnessWrapperStreamErrorIsTerminal(err) {
-		t.Fatalf("StreamFrames() error = %v, want terminal size-limit error", err)
-	}
-	if harnessWrapperStreamErrorIsTerminal(harness.ClientError{Message: "temporary stream read failure"}) {
-		t.Fatal("ordinary typed stream error should remain retryable")
-	}
-}
-
-func TestHarnessWrapperRuntimeSessionIdentityUsesUIDWithoutExplicitSession(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	identity := harnessWrapperRuntimeSessionIdentity(task, agent, string(corev1alpha1.AgentRuntimeClaude))
-	got := string(identity.ID)
-	if !strings.Contains(got, string(task.UID)) {
-		t.Fatalf("runtime session id = %q, want task UID", got)
-	}
-	if identity.Owner.Namespace != task.Namespace || identity.Owner.SessionName != task.Name+":"+string(task.UID) || identity.Owner.ActiveTask != task.Name || identity.Owner.AgentName != agent.Name || identity.Owner.Provider != harness.ProviderKindKubernetesService {
-		t.Fatalf("runtime session owner = %#v, want task-scoped owner metadata", identity.Owner)
-	}
-	task.Spec.SessionRef = &corev1alpha1.SessionReference{Name: "shared-session"}
-	identity = harnessWrapperRuntimeSessionIdentity(task, agent, string(corev1alpha1.AgentRuntimeClaude))
-	got = string(identity.ID)
-	if strings.Contains(got, string(task.UID)) || !strings.Contains(got, "shared-session") {
-		t.Fatalf("runtime session id = %q, want explicit shared session without UID", got)
-	}
-	if identity.Owner.SessionName != "shared-session" || identity.Owner.ActiveTask != task.Name {
-		t.Fatalf("runtime session owner = %#v, want shared session owner with active task", identity.Owner)
-	}
-	if got := harnessWrapperRuntimeSessionID(task, string(corev1alpha1.AgentRuntimeClaude)); got != identity.ID {
-		t.Fatalf("compat runtime session id = %q, want identity id %q", got, identity.ID)
-	}
-}
-
-func TestCancelHarnessWrapperPlannedMissingTurnIsIgnored(t *testing.T) {
-	cfg := cliwrapper.DefaultConfig()
-	cfg.AllowUnauthenticated = true
-	server, err := cliwrapper.NewServer(cfg, &cliwrapper.FakeAdapter{Behavior: cliwrapper.FakeBehaviorSuccess})
-	if err != nil {
-		t.Fatal(err)
-	}
-	srv := httptest.NewServer(server.Handler())
-	defer srv.Close()
-	t.Setenv(harnessWrapperEndpointEnv, srv.URL)
-	task, agent := harnessWrapperTaskAndAgent()
-	request, err := (&TaskReconciler{}).harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 1)
-	if err != nil {
-		t.Fatal(err)
-	}
-	task.Annotations = map[string]string{
-		harnessWrapperTurnIDAnnotation:  string(request.TurnID),
-		harnessWrapperRuntimeAnnotation: string(request.RuntimeSessionID),
-		harnessWrapperCorrelationIDAnno: request.CorrelationID,
-		harnessWrapperStartedAnno:       testFalseValue,
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent)
-	if err := r.cancelHarnessWrapperTurn(context.Background(), task, "test"); err != nil {
-		t.Fatalf("cancelHarnessWrapperTurn() error = %v, want nil for missing planned turn", err)
-	}
-}
-
-func TestHarnessWrapperTurnAnnotationsMustMatchCurrentAttempt(t *testing.T) {
-	task, _ := harnessWrapperTaskAndAgent()
-	task.Status.Attempts = 2
-	task.Annotations = map[string]string{
-		harnessWrapperTurnIDAnnotation:  string(harnessWrapperTurnID(task, 2)),
-		harnessWrapperRuntimeAnnotation: "attacker-controlled",
-		harnessWrapperCorrelationIDAnno: string(task.UID),
-	}
-	if !harnessWrapperTurnAnnotationsMatchTaskAttempt(task, 2) {
-		t.Fatal("expected current task/attempt turn annotations to match")
-	}
-	task.Annotations[harnessWrapperTurnIDAnnotation] = string(harnessWrapperTurnID(task, 1))
-	if harnessWrapperTurnAnnotationsMatchTaskAttempt(task, 2) {
-		t.Fatal("expected stale/copied turn id to be rejected")
-	}
-}
-
-func TestCancelHarnessWrapperStartedMissingTurnIsIgnored(t *testing.T) {
-	cfg := cliwrapper.DefaultConfig()
-	cfg.AllowUnauthenticated = true
-	server, err := cliwrapper.NewServer(cfg, &cliwrapper.FakeAdapter{Behavior: cliwrapper.FakeBehaviorSuccess})
-	if err != nil {
-		t.Fatal(err)
-	}
-	srv := httptest.NewServer(server.Handler())
-	defer srv.Close()
-	t.Setenv(harnessWrapperEndpointEnv, srv.URL)
-	task, agent := harnessWrapperTaskAndAgent()
-	task.Status.Attempts = 1
-	request, err := (&TaskReconciler{}).harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 1)
-	if err != nil {
-		t.Fatal(err)
-	}
-	task.Annotations = map[string]string{
-		harnessWrapperTurnIDAnnotation:  string(request.TurnID),
-		harnessWrapperRuntimeAnnotation: string(request.RuntimeSessionID),
-		harnessWrapperCorrelationIDAnno: request.CorrelationID,
-		harnessWrapperStartedAnno:       scheduledRunLabelValue,
-	}
-	r := newUnitReconciler(newTestScheme(), task, agent)
-	if err := r.cancelHarnessWrapperTurn(context.Background(), task, "test"); err != nil {
-		t.Fatalf("cancelHarnessWrapperTurn() error = %v, want nil for missing started turn", err)
-	}
-}
-
-func TestHarnessWrapperStartTurnErrorClassification(t *testing.T) {
-	for _, message := range []string{
-		"post failed: connection refused",
-		"harness post failed (408): unsupported version",
-		"harness post failed (500): unsupported version",
-		"start_turn failed: unsupported version",
-		"harness post failed (429): rate limited",
-	} {
-		if !harnessWrapperStartTurnErrorIsRetryable(fmt.Errorf("%s", message)) {
-			t.Fatalf("%q should remain retryable", message)
-		}
-	}
-	for _, message := range []string{
-		"start_turn failed (401): unauthorized",
-		"start_turn failed (400): unsupported version",
-		"start_turn failed: harness did not accept turn",
-	} {
-		if harnessWrapperStartTurnErrorIsRetryable(fmt.Errorf("%s", message)) {
-			t.Fatalf("%q should remain terminal", message)
-		}
-	}
-}
-
-func TestHarnessWrapperLegacyMutationConflictClassification(t *testing.T) {
-	if !harnessWrapperDuplicateTurnError(fmt.Errorf(`harness post failed (409): {"error":"turn already exists"}`)) {
-		t.Fatal("canonical legacy duplicate was not recognized")
-	}
-	if harnessWrapperDuplicateTurnError(fmt.Errorf(`harness post failed (409): {"error":"turn already exists upstream"}`)) {
-		t.Fatal("non-canonical legacy duplicate was recognized")
-	}
-	if !harnessWrapperDuplicateTurnError(fmt.Errorf(`harness post failed (409): {"message":"turn already completed"}`)) {
-		t.Fatal("canonical legacy message-envelope duplicate was not recognized")
-	}
-	if !harnessWrapperCapacityError(fmt.Errorf(`harness post failed (409): {"error":"maximum concurrent turns reached"}`)) {
-		t.Fatal("canonical legacy capacity conflict was not recognized")
-	}
-	if !harnessWrapperCapacityError(fmt.Errorf(`harness post failed (409): {"message":"maximum concurrent turns reached"}`)) {
-		t.Fatal("canonical legacy message-envelope capacity conflict was not recognized")
-	}
-	if harnessWrapperCapacityError(fmt.Errorf(`harness post failed (500): upstream (409): maximum concurrent turns reached`)) {
-		t.Fatal("nested legacy capacity text overrode top-level ambiguous status")
-	}
-}
-
-func TestHarnessWrapperTypedClientErrorClassificationSurvivesRedaction(t *testing.T) {
-	if harnessWrapperStartTurnErrorIsRetryable(harness.ClientError{StatusCode: http.StatusBadRequest, Message: "[REDACTED]"}) {
-		t.Fatal("typed 400 start error should remain terminal")
-	}
-	if !harnessWrapperAuthError(harness.ClientError{StatusCode: http.StatusUnauthorized, Message: "[REDACTED]"}) {
-		t.Fatal("typed 401 error should remain an auth error")
-	}
-	for _, status := range []int{http.StatusNotFound, http.StatusMethodNotAllowed, http.StatusConflict, http.StatusUnprocessableEntity} {
-		if harnessWrapperStartTurnErrorIsRetryable(harness.ClientError{StatusCode: status, Message: "[REDACTED]"}) {
-			t.Fatalf("typed %d start rejection should remain terminal", status)
-		}
-	}
-	wrappedNotFound := fmt.Errorf("read harness runtime capabilities: %w", harness.ClientError{StatusCode: http.StatusNotFound, Message: "[REDACTED]"})
-	if harnessWrapperCapabilitiesErrorIsRetryable(wrappedNotFound) {
-		t.Fatal("typed capabilities 404 should remain terminal")
-	}
-
-	request := harness.StartTurnRequest{
-		Version:          harness.ProtocolVersion,
-		Namespace:        "default",
-		TaskName:         "task-a",
-		SessionName:      "session-a",
-		RuntimeSessionID: "runtime-a",
-		TurnID:           "turn-a",
-		CorrelationID:    "corr-a",
-		Deadline:         time.Now().UTC().Add(time.Minute),
-		AuthIdentity:     harness.AuthIdentity{Subject: "user:test"},
-	}
-	t.Run("unsupported version", func(t *testing.T) {
-		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-			harness.WriteJSON(w, http.StatusAccepted, harness.StartTurnResponse{Version: "unsupported-version", Accepted: false})
-		}))
-		defer server.Close()
-		client, err := harness.NewClient(server.URL, harness.WithBearerToken("unsupported"))
-		if err != nil {
-			t.Fatalf("NewClient() error = %v", err)
-		}
-		_, err = client.StartTurn(context.Background(), request)
-		if err == nil || harnessWrapperStartTurnErrorIsRetryable(err) {
-			t.Fatalf("StartTurn() error = %v, want typed terminal version error", err)
-		}
-	})
-	t.Run("accepted unsupported version is retryable", func(t *testing.T) {
-		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-			harness.WriteJSON(w, http.StatusAccepted, harness.StartTurnResponse{
-				Version: "unsupported-version", Accepted: true,
-			})
-		}))
-		defer server.Close()
-		client, err := harness.NewClient(server.URL)
-		if err != nil {
-			t.Fatalf("NewClient() error = %v", err)
-		}
-		_, err = client.StartTurn(context.Background(), request)
-		if err == nil || !harnessWrapperStartTurnErrorIsRetryable(err) {
-			t.Fatalf("StartTurn() error = %v, want retryable accepted version error", err)
-		}
-	})
-	t.Run("unknown acceptance unsupported version is retryable", func(t *testing.T) {
-		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-			harness.WriteJSON(w, http.StatusAccepted, map[string]any{
-				"version": "unsupported-version",
-			})
-		}))
-		defer server.Close()
-		client, err := harness.NewClient(server.URL)
-		if err != nil {
-			t.Fatalf("NewClient() error = %v", err)
-		}
-		_, err = client.StartTurn(context.Background(), request)
-		if err == nil || !harnessWrapperStartTurnErrorIsRetryable(err) {
-			t.Fatalf("StartTurn() error = %v, want retryable unknown-acceptance version error", err)
-		}
-	})
-	t.Run("capacity", func(t *testing.T) {
-		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-			harness.WriteError(w, http.StatusConflict, "maximum concurrent turns reached")
-		}))
-		defer server.Close()
-		client, err := harness.NewClient(server.URL, harness.WithBearerToken("concurrent"))
-		if err != nil {
-			t.Fatalf("NewClient() error = %v", err)
-		}
-		_, err = client.StartTurn(context.Background(), request)
-		if err == nil || !harnessWrapperCapacityError(err) {
-			t.Fatalf("StartTurn() error = %v, want typed capacity error", err)
-		}
-	})
-}
-
-func TestHarnessWrapperTurnMetadataDefaultsMaxTurns(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	agent.Spec.Runtime.DefaultReasoningEffort = agentReasoningEffortHigh
-	r := newUnitReconciler(newTestScheme(), task, agent)
-	request, err := r.harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 1)
-	if err != nil {
-		t.Fatalf("harnessWrapperStartTurnRequest: %v", err)
-	}
-	if request.Metadata["maxTurns"] != "50" {
-		t.Fatalf("metadata maxTurns = %q, want 50", request.Metadata["maxTurns"])
-	}
-	if request.Metadata["reasoningEffort"] != "high" {
-		t.Fatalf("metadata reasoningEffort = %q, want high", request.Metadata["reasoningEffort"])
-	}
-}
-
-func TestHarnessWrapperTurnRequestFiltersRuntimeAuthOnlySecrets(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	immutable := true
-	task.Annotations = map[string]string{
-		labels.AnnotationAgentRuntimeAuthOnly:                  scheduledRunLabelValue,
-		repositoryMonitorIssueAnnotationActionKind:             repositoryMonitorIssueActionImplementation,
-		repositoryMonitorIssueAnnotationRuntimeAgentUID:        "uid-harness-agent",
-		repositoryMonitorIssueAnnotationRuntimeAgentGeneration: "0",
-		repositoryMonitorIssueAnnotationRuntimeAuthUID:         "uid-task-runtime",
-		repositoryMonitorIssueAnnotationRuntimeAuthFields:      workerenv.OpenAIAPIKey,
-	}
-	agent.Spec.Runtime.Type = corev1alpha1.AgentRuntimeCodex
-	agent.UID = "uid-harness-agent"
-	agent.Spec.SecretRef = &corev1.LocalObjectReference{Name: "agent-runtime"}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{Workspace: &corev1alpha1.WorkspaceConfig{
-		GitRepo:      "https://github.com/orka-agents/orka",
-		GitSecretRef: &corev1.LocalObjectReference{Name: "git-auth"},
-	}}
-	task.Spec.SecretRef = &corev1alpha1.SecretReference{Name: "task-runtime"}
-	agentSecret := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "agent-runtime", Namespace: task.Namespace}, Data: map[string][]byte{
-		workerenv.OpenAIAPIKey: []byte("x"),
-		workerenv.GitHubToken:  []byte("y"),
-	}}
-	taskSecret := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "task-runtime", Namespace: task.Namespace, UID: "uid-task-runtime"}, Data: map[string][]byte{
-		workerenv.OpenAIAPIKey:    []byte("z"),
-		workerenv.AnthropicAPIKey: []byte("task-only"),
-	}, Immutable: &immutable}
-	gitSecret := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "git-auth", Namespace: task.Namespace}, Data: map[string][]byte{"token": []byte("g")}}
-	r := newUnitReconciler(newTestScheme(), task, agent, agentSecret, taskSecret, gitSecret)
-	request, err := r.harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 1)
-	if err != nil {
-		t.Fatalf("harnessWrapperStartTurnRequest() error = %v", err)
-	}
-	env := map[string]string{}
-	for _, item := range request.Input.Env {
-		env[item.Name] = item.Value
-	}
-	if env[workerenv.OpenAIAPIKey] != "z" {
-		t.Fatalf("%s = %q, want task-pinned scoped model credential", workerenv.OpenAIAPIKey, env[workerenv.OpenAIAPIKey])
-	}
-	if _, ok := env[workerenv.GitHubToken]; ok {
-		t.Fatalf("runtime GitHub credential reached harness request: %#v", env)
-	}
-	if _, ok := env[workerenv.AnthropicAPIKey]; ok {
-		t.Fatalf("task secret reached runtime-auth-only harness request: %#v", env)
-	}
-	if env[workerenv.GitToken] != "g" {
-		t.Fatalf("%s = %q, want root-side workspace credential", workerenv.GitToken, env[workerenv.GitToken])
-	}
-	if request.Metadata["runtimeAuthOnly"] != scheduledRunLabelValue {
-		t.Fatalf("metadata = %#v, want runtimeAuthOnly", request.Metadata)
-	}
-}
-
-func TestHarnessWrapperTurnRequestRejectsRuntimeAuthOnlyRuntimeRef(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	task.Annotations = map[string]string{labels.AnnotationAgentRuntimeAuthOnly: scheduledRunLabelValue}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{Workspace: &corev1alpha1.WorkspaceConfig{GitSecretRef: &corev1.LocalObjectReference{Name: "git-auth"}}}
-	agent.Spec.Runtime.RuntimeRef = &corev1alpha1.AgentRuntimeReference{Name: "external-runtime"}
-	agent.Spec.SecretRef = nil
-	r := newUnitReconciler(newTestScheme(), task, agent)
-	_, err := r.harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 1)
-	if err == nil || !strings.Contains(err.Error(), "do not support external runtimeRef") {
-		t.Fatalf("harnessWrapperStartTurnRequest() error = %v, want runtimeRef rejection", err)
-	}
-}
-
-func TestHarnessWrapperTurnRequestRejectsReadOnlyRuntimeRefWithoutSecret(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	task.Annotations = map[string]string{labels.AnnotationAgentReadOnly: scheduledRunLabelValue}
-	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{Workspace: &corev1alpha1.WorkspaceConfig{GitSecretRef: &corev1.LocalObjectReference{Name: "git-auth"}}}
-	agent.Spec.Runtime.Type = corev1alpha1.AgentRuntimeClaude
-	agent.Spec.Runtime.RuntimeRef = &corev1alpha1.AgentRuntimeReference{Name: "external-runtime"}
-	agent.Spec.SecretRef = nil
-	r := newUnitReconciler(newTestScheme(), task, agent)
-	_, err := r.harnessWrapperStartTurnRequest(context.Background(), task, agent, time.Now(), 1)
-	if err == nil || !strings.Contains(err.Error(), "do not support external runtimeRef") {
-		t.Fatalf("harnessWrapperStartTurnRequest() error = %v, want read-only runtimeRef rejection", err)
-	}
-}
-
-func TestHarnessWrapperReadOnlyEnvBlocksStartupInjection(t *testing.T) {
-	for _, name := range []string{
-		"NODE_OPTIONS", "NODE_PATH", "HOME", "ZDOTDIR", "CODEX_HOME", "BASH_ENV", "ENV",
-		"LD_PRELOAD", "LD_AUDIT", "DYLD_INSERT_LIBRARIES", "PYTHONPATH",
-		"GIT_CONFIG_COUNT", "GIT_CONFIG_KEY_0", "XDG_CONFIG_HOME",
-	} {
-		if !harnessWrapperReadOnlyEnvBlocked(name) {
-			t.Errorf("harnessWrapperReadOnlyEnvBlocked(%q) = false", name)
-		}
-	}
-	if harnessWrapperReadOnlyEnvBlocked("SAFE_REVIEW_SETTING") {
-		t.Fatal("ordinary review setting was unexpectedly blocked")
-	}
-}
-
-func TestSessionMessagesPromptIncludesCurrentTurnOnce(t *testing.T) {
-	prompt := sessionMessagesPrompt([]store.SessionMessage{
-		{Role: "user", Content: "first"},
-		{Role: "assistant", Content: "reply"},
-		{Role: "user", Content: "current"},
-	})
-	if strings.Count(prompt, "current") != 1 || !strings.Contains(prompt, "ASSISTANT:\nreply") {
-		t.Fatalf("sessionMessagesPrompt() = %q", prompt)
-	}
-}
-
-func TestSessionMessagesPromptIncludesGatewaySenderProvenance(t *testing.T) {
-	prompt := sessionMessagesPrompt([]store.SessionMessage{{
-		Role: "user", Content: "current", SourceType: "gateway-event",
-		Metadata: map[string]string{
-			"senderId": "user-1", "senderDisplayName": "User One", "accountId": "acct",
-			"contextId": "room", "threadId": "thread-1",
-		},
-	}})
-	for _, want := range []string{`senderId="user-1"`, `senderDisplayName="User One"`, `contextId="room"`, "current"} {
-		if !strings.Contains(prompt, want) {
-			t.Fatalf("sessionMessagesPrompt() = %q, want %q", prompt, want)
-		}
-	}
-}
-
-func TestHarnessWrapperPromptIncludedUsesTaskScopedRuntimeSession(t *testing.T) {
-	task, agent := harnessWrapperTaskAndAgent()
-	task.Spec.SessionRef = &corev1alpha1.SessionReference{
-		Name: "canonical-session", PromptIncluded: true, ThroughMessageID: "message-1",
-	}
-	identity := harnessWrapperRuntimeSessionIdentity(task, agent, "codex")
-	if identity.Owner.SessionName == "canonical-session" || !strings.Contains(identity.Owner.SessionName, task.Name) {
-		t.Fatalf("runtime session owner = %#v, want task-scoped identity", identity.Owner)
-	}
-}
-
-func TestSessionMessagesPromptStaysBelowExecStringLimit(t *testing.T) {
-	prompt := sessionMessagesPrompt([]store.SessionMessage{
-		{Role: "user", Content: strings.Repeat("a", 64<<10)},
-		{Role: "assistant", Content: strings.Repeat("b", 64<<10)},
-		{Role: "user", Content: strings.Repeat("c", 64<<10)},
-	})
-	if len(prompt) == 0 || len(prompt) > 96<<10 {
-		t.Fatalf("prompt length = %d, want 1..%d", len(prompt), 96<<10)
-	}
-}
-
-func TestSessionMessagesPromptTruncatesOnUTF8Boundary(t *testing.T) {
-	prompt := sessionMessagesPrompt([]store.SessionMessage{{
-		Role: "user", Content: strings.Repeat("🙂", 30_000),
-	}})
-	if prompt == "" || !utf8.ValidString(prompt) {
-		t.Fatalf("sessionMessagesPrompt() produced invalid UTF-8")
-	}
-}
-
-func TestSessionMessagesPromptDropsLeadingOrphanAssistant(t *testing.T) {
-	prompt := sessionMessagesPrompt([]store.SessionMessage{
-		{Role: "user", Content: strings.Repeat("q", 64<<10)},
-		{Role: "assistant", Content: "orphaned reply"},
-		{Role: "user", Content: strings.Repeat("c", 64<<10)},
-	})
-	if strings.Contains(prompt, "orphaned reply") || !strings.Contains(prompt, "USER:\n") {
-		t.Fatalf("sessionMessagesPrompt() kept an orphan assistant turn: %q", prompt)
-	}
-}
diff --git a/internal/controller/job_builder.go b/internal/controller/job_builder.go
index 7f78cbd8c..e2440aa59 100644
--- a/internal/controller/job_builder.go
+++ b/internal/controller/job_builder.go
@@ -30,7 +30,9 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/acp"
 	"github.com/orka-agents/orka/internal/contexttoken"
+	"github.com/orka-agents/orka/internal/executionmode"
 	"github.com/orka-agents/orka/internal/labels"
 	"github.com/orka-agents/orka/internal/metrics"
 	"github.com/orka-agents/orka/internal/taskmeta"
@@ -99,6 +101,7 @@ type JobBuilder struct {
 	VendorWorkerServiceAccountName             string
 	ContainerWorkerServiceAccountName          string
 	ControllerURL                              string // e.g. http://orka-controller.orka-system.svc:8080
+	ControllerMode                             executionmode.Mode
 	ContextTokenTTSEndpoint                    string
 	ContextTokenTTSAudience                    string
 	ContextTokenTTSTimeout                     string
@@ -334,6 +337,9 @@ func (b *JobBuilder) Build(ctx context.Context, task *corev1alpha1.Task, agent *
 
 // BuildWithOptions creates a Job for the given Task using additional resolved options.
 func (b *JobBuilder) BuildWithOptions(ctx context.Context, task *corev1alpha1.Task, agent *corev1alpha1.Agent, provider *corev1alpha1.Provider, opts JobBuildOptions) (*batchv1.Job, error) {
+	if err := validateContainerPublicationWorkspace(task); err != nil {
+		return nil, err
+	}
 	if err := validateReadOnlyAgentRuntime(task, agent); err != nil {
 		return nil, err
 	}
@@ -392,7 +398,7 @@ func (b *JobBuilder) BuildWithOptions(ctx context.Context, task *corev1alpha1.Ta
 		b.addWorkspaceVolumes(job, task)
 	}
 
-	if effectiveWorkspace(task) != nil && (taskUsesWorkspaceInitContainer(task) || (task.Spec.Type == corev1alpha1.TaskTypeContainer && task.Spec.Image != "")) {
+	if taskNeedsWorkspaceInitContainer(task) {
 		b.addWorkspaceInitContainer(job, task)
 	}
 
@@ -1067,6 +1073,7 @@ func (b *JobBuilder) addAIEnvVars(ctx context.Context, //nolint:gocyclo
 		SystemPrompt:    cfg.systemPrompt,
 		BaseURL:         cfg.baseURL,
 		AzureAPIVersion: cfg.azureAPIVersion,
+		ControllerMode:  string(b.ControllerMode),
 	}.EnvVars()...)
 
 	disableCoordinationToolInjection := task.Annotations[labels.AnnotationDisableCoordinationToolInject] == scheduledRunLabelValue
@@ -1490,13 +1497,12 @@ func validateReadOnlyAgentRuntime(task *corev1alpha1.Task, agent *corev1alpha1.A
 	if agent.Spec.Runtime.RuntimeRef != nil && strings.TrimSpace(agent.Spec.Runtime.RuntimeRef.Name) != "" {
 		return fmt.Errorf("read-only agent tasks do not support external runtimeRef %q", agent.Spec.Runtime.RuntimeRef.Name)
 	}
-	if agent.Spec.Runtime.Type == corev1alpha1.AgentRuntimeCopilot {
+	switch agent.Spec.Runtime.Type {
+	case corev1alpha1.AgentRuntimeCopilot:
 		return fmt.Errorf("read-only agent tasks do not support copilot runtime credentials because GITHUB_TOKEN can mutate GitHub")
+	default:
+		return validateReadOnlyBuiltInAgentRuntime(task, agent.Spec.Runtime.Type)
 	}
-	if agent.Spec.Runtime.Type == corev1alpha1.AgentRuntimeOpencode {
-		return fmt.Errorf("read-only agent tasks do not support opencode runtime because the OpenCode adapter pre-approves file edits")
-	}
-	return nil
 }
 
 func scopedAgentRuntimeSecretCoordinates(task *corev1alpha1.Task, agent *corev1alpha1.Agent) (namespace, name string, err error) {
@@ -1737,7 +1743,7 @@ func readOnlyAgentRuntimeSecretKeys(agent *corev1alpha1.Agent) ([]string, error)
 	case corev1alpha1.AgentRuntimeCopilot:
 		return nil, fmt.Errorf("read-only agent tasks do not support copilot runtime credentials because GITHUB_TOKEN can mutate GitHub")
 	case corev1alpha1.AgentRuntimeOpencode:
-		return nil, fmt.Errorf("read-only agent tasks do not support opencode runtime because the OpenCode adapter pre-approves file edits")
+		return nil, nil
 	default:
 		return nil, nil
 	}
@@ -2119,9 +2125,14 @@ func (b *JobBuilder) addAgentToolsEnvVars(
 	// AllowedTools: read-only task override > task override > agent default
 	var allowedTools []string
 	if agent != nil && agent.Spec.Runtime != nil {
-		allowedTools = agent.Spec.Runtime.DefaultAllowedTools
+		runtime := agent.Spec.Runtime
+		if runtime.Type == corev1alpha1.AgentRuntimeOpencode && runtime.DefaultAllowedTools == nil {
+			allowedTools = acp.OpenCodeDefaultAllowedTools()
+		} else {
+			allowedTools = runtime.DefaultAllowedTools
+		}
 	}
-	if task.Spec.AgentRuntime != nil && len(task.Spec.AgentRuntime.AllowedTools) > 0 {
+	if task.Spec.AgentRuntime != nil && task.Spec.AgentRuntime.AllowedTools != nil {
 		allowedTools = task.Spec.AgentRuntime.AllowedTools
 	}
 	if taskRequestsReadOnlyAgent(task) {
@@ -2208,9 +2219,9 @@ func (b *JobBuilder) addWorkspaceEnvVars(
 			Name: workerenv.WorkspaceSubpath, Value: ws.SubPath,
 		})
 	}
-	if ws.ForkRepo != "" {
+	if ws.PublicationGitRepo != "" {
 		envVars = append(envVars, corev1.EnvVar{
-			Name: workerenv.ForkRepo, Value: ws.ForkRepo,
+			Name: workerenv.ForkRepo, Value: ws.PublicationGitRepo,
 		})
 	}
 	if ws.PRBaseBranch != "" {
@@ -2267,34 +2278,119 @@ func (b *JobBuilder) addWorkspaceVolumes(job *batchv1.Job, task *corev1alpha1.Ta
 		},
 	)
 
-	// Git secret volume if explicitly referenced
 	ws := effectiveWorkspace(task)
-	if ws != nil && ws.GitSecretRef != nil {
-		job.Spec.Template.Spec.Volumes = append(job.Spec.Template.Spec.Volumes, corev1.Volume{
-			Name: "git-credentials",
-			VolumeSource: corev1.VolumeSource{
-				Secret: &corev1.SecretVolumeSource{
-					SecretName: ws.GitSecretRef.Name,
-				},
-			},
-		})
-		if b.directGitCredentialsAllowed(task) && !taskUsesWorkspaceInitContainer(task) {
+	if ws == nil {
+		return
+	}
+	if ws.ReadCredentialRef != nil {
+		job.Spec.Template.Spec.Volumes = append(job.Spec.Template.Spec.Volumes, workspaceCredentialVolume("git-read-credentials", ws.ReadCredentialRef.Name, ws.ReadCredentialRef.Key))
+	}
+	if ws.PublicationCredentialRef != nil {
+		job.Spec.Template.Spec.Volumes = append(job.Spec.Template.Spec.Volumes, workspaceCredentialVolume("git-publication-credentials", ws.PublicationCredentialRef.Name, ws.PublicationCredentialRef.Key))
+	}
+	if b.directGitCredentialsAllowed(task) && !taskUsesWorkspaceInitContainer(task) {
+		if volumeName := mainWorkspaceCredentialVolume(task, ws); volumeName != "" {
 			job.Spec.Template.Spec.Containers[0].VolumeMounts = append(
 				job.Spec.Template.Spec.Containers[0].VolumeMounts,
-				corev1.VolumeMount{
-					Name:      "git-credentials",
-					MountPath: "/secrets/git",
-					ReadOnly:  true,
-				},
+				corev1.VolumeMount{Name: volumeName, MountPath: "/secrets/git", ReadOnly: true},
 			)
 		}
 	}
 }
 
+func workspaceCredentialVolume(name, secretName, key string) corev1.Volume {
+	key = strings.TrimSpace(key)
+	if key == "" {
+		key = defaultACPWorkspaceCredentialKey
+	}
+	volume := corev1.Volume{
+		Name:         name,
+		VolumeSource: corev1.VolumeSource{Secret: &corev1.SecretVolumeSource{SecretName: secretName}},
+	}
+	volume.Secret.Items = []corev1.KeyToPath{{Key: key, Path: defaultACPWorkspaceCredentialKey}}
+	return volume
+}
+
+func mainWorkspaceCredentialVolume(task *corev1alpha1.Task, workspace *corev1alpha1.WorkspaceConfig) string {
+	if workspace == nil {
+		return ""
+	}
+	if mainContainerNeedsGitCredentials(task) && workspace.PushBranch != "" {
+		if workspace.PublicationCredentialRef != nil {
+			return "git-publication-credentials"
+		}
+		return ""
+	}
+	if workspace.ReadCredentialRef != nil {
+		return "git-read-credentials"
+	}
+	return ""
+}
+
 func taskNeedsWorkspace(task *corev1alpha1.Task) bool {
 	return task != nil && (task.Spec.Type == corev1alpha1.TaskTypeAgent || effectiveWorkspace(task) != nil)
 }
 
+func validateContainerPublicationWorkspace(task *corev1alpha1.Task) error {
+	if task == nil || task.Spec.Type != corev1alpha1.TaskTypeContainer {
+		return nil
+	}
+	workspace := effectiveWorkspace(task)
+	if workspace == nil {
+		return nil
+	}
+
+	if strings.TrimSpace(workspace.ExpectedRemoteSHA) != "" {
+		return fmt.Errorf("container Tasks do not support workspace.expectedRemoteSHA")
+	}
+	if workspace.CreatePR {
+		return fmt.Errorf("container Tasks do not support workspace.createPR")
+	}
+	if field := unsupportedContainerWorkspacePolicyField(workspace); field != "" {
+		return fmt.Errorf("container Tasks do not support clean-room workspace publication policy field %s", field)
+	}
+	if strings.TrimSpace(workspace.PushBranch) == "" {
+		return nil
+	}
+	if strings.TrimSpace(task.Spec.Image) != "" {
+		return fmt.Errorf("custom-image container Tasks do not support workspace.pushBranch publication")
+	}
+	if workspace.PublicationCredentialRef == nil || strings.TrimSpace(workspace.PublicationCredentialRef.Name) == "" {
+		return fmt.Errorf("container workspace pushBranch requires publicationCredentialRef")
+	}
+	return nil
+}
+
+func unsupportedContainerWorkspacePolicyField(workspace *corev1alpha1.WorkspaceConfig) string {
+	switch {
+	case workspace == nil:
+		return ""
+	case workspace.MaxChangedFiles != nil:
+		return "workspace.maxChangedFiles"
+	case len(workspace.AllowedPaths) > 0:
+		return "workspace.allowedPaths"
+	case workspace.DenyRepositoryControlPaths:
+		return "workspace.denyRepositoryControlPaths"
+	case workspace.RejectBinaryFiles:
+		return "workspace.rejectBinaryFiles"
+	case workspace.RejectSecretLikeContent:
+		return "workspace.rejectSecretLikeContent"
+	default:
+		return ""
+	}
+}
+
+func taskNeedsWorkspaceInitContainer(task *corev1alpha1.Task) bool {
+	workspace := effectiveWorkspace(task)
+	if workspace == nil {
+		return false
+	}
+	if taskUsesWorkspaceInitContainer(task) {
+		return true
+	}
+	return task != nil && task.Spec.Type == corev1alpha1.TaskTypeContainer && (task.Spec.Image != "" || workspace.PushBranch != "")
+}
+
 func taskUsesWorkspaceInitContainer(task *corev1alpha1.Task) bool {
 	return task != nil && task.Annotations[labels.AnnotationWorkspaceInitContainer] == scheduledRunLabelValue
 }
@@ -2336,13 +2432,7 @@ func effectiveWorkspace(task *corev1alpha1.Task) *corev1alpha1.WorkspaceConfig {
 	if task == nil {
 		return nil
 	}
-	if task.Spec.Workspace != nil {
-		return task.Spec.Workspace
-	}
-	if task.Spec.AgentRuntime != nil {
-		return task.Spec.AgentRuntime.Workspace
-	}
-	return nil
+	return task.Spec.Workspace
 }
 
 func (b *JobBuilder) addWorkspaceInitContainer(job *batchv1.Job, task *corev1alpha1.Task) {
@@ -2360,9 +2450,9 @@ func (b *JobBuilder) addWorkspaceInitContainer(job *batchv1.Job, task *corev1alp
 			{Name: "tmp", MountPath: "/tmp"},
 		},
 	}
-	if effectiveWorkspace(task).GitSecretRef != nil {
+	if workspace := effectiveWorkspace(task); workspace != nil && workspace.ReadCredentialRef != nil {
 		initContainer.VolumeMounts = append(initContainer.VolumeMounts, corev1.VolumeMount{
-			Name:      "git-credentials",
+			Name:      "git-read-credentials",
 			MountPath: "/secrets/git",
 			ReadOnly:  true,
 		})
diff --git a/internal/controller/job_builder_test.go b/internal/controller/job_builder_test.go
index c1c8bff60..3dc5f4798 100644
--- a/internal/controller/job_builder_test.go
+++ b/internal/controller/job_builder_test.go
@@ -24,6 +24,7 @@ import (
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
 	"github.com/orka-agents/orka/internal/contexttoken"
+	"github.com/orka-agents/orka/internal/executionmode"
 	"github.com/orka-agents/orka/internal/labels"
 	"github.com/orka-agents/orka/internal/workerenv"
 )
@@ -39,6 +40,7 @@ const (
 	testAIWorkerServiceAccountName        = "release-ai-worker"
 	testVendorWorkerServiceAccountName    = "release-vendor-worker"
 	testContainerWorkerServiceAccountName = "release-container-worker"
+	testFalseValue                        = "false"
 )
 
 const (
@@ -110,6 +112,7 @@ func setupJobBuilder() *JobBuilder {
 	fakeClient := fake.NewClientBuilder().WithScheme(scheme).Build()
 	b := NewJobBuilder(fakeClient)
 	b.ControllerURL = testControllerURL
+	b.ControllerMode = executionmode.HarnessV2
 	return b
 }
 
@@ -1466,6 +1469,7 @@ func TestJobBuilder_buildEnvVars_WithCoordination(t *testing.T) {
 		{"ORKA_COORDINATION_MAX_CHILDREN", "5"},
 		{"ORKA_COORDINATION_ALLOWED_AGENTS", "backend-dev,frontend-dev"},
 		{"ORKA_COORDINATION_DEPTH", "0"},
+		{workerenv.ControllerMode, string(executionmode.HarnessV2)},
 	}
 	for _, tt := range tests {
 		env, found := findEnvVar(envVars, tt.name)
@@ -1644,6 +1648,36 @@ func hasVolume(volumes []corev1.Volume, name string) bool {
 	return false
 }
 
+func requireWorkspaceCredentialProjection(
+	t *testing.T,
+	volumes []corev1.Volume,
+	volumeName string,
+	secretName string,
+	secretKey string,
+) {
+	t.Helper()
+	for _, volume := range volumes {
+		if volume.Name != volumeName {
+			continue
+		}
+		if volume.Secret == nil {
+			t.Fatalf("volume %q has no Secret source", volumeName)
+		}
+		if volume.Secret.SecretName != secretName {
+			t.Fatalf("volume %q SecretName = %q, want %q", volumeName, volume.Secret.SecretName, secretName)
+		}
+		if len(volume.Secret.Items) != 1 {
+			t.Fatalf("volume %q items = %#v, want one key projection", volumeName, volume.Secret.Items)
+		}
+		item := volume.Secret.Items[0]
+		if item.Key != secretKey || item.Path != defaultACPWorkspaceCredentialKey {
+			t.Fatalf("volume %q projection = %#v, want key %q at %q", volumeName, item, secretKey, defaultACPWorkspaceCredentialKey)
+		}
+		return
+	}
+	t.Fatalf("missing workspace credential volume %q", volumeName)
+}
+
 // helper to find a volume mount by name
 func findVolumeMount(mounts []corev1.VolumeMount, name string) (corev1.VolumeMount, bool) {
 	for _, m := range mounts {
@@ -1746,10 +1780,8 @@ func TestJobBuilder_Build_ContainerTask_GitSecretVolume_DirectMountOptIn(t *test
 			Type:  corev1alpha1.TaskTypeContainer,
 			Image: testBusyboxImage,
 			Workspace: &corev1alpha1.WorkspaceConfig{
-				GitRepo: "https://github.com/example/repo",
-				GitSecretRef: &corev1.LocalObjectReference{
-					Name: "my-git-creds",
-				},
+				GitRepo:           "https://github.com/example/repo",
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "my-git-creds"},
 			},
 		},
 	}
@@ -1759,7 +1791,7 @@ func TestJobBuilder_Build_ContainerTask_GitSecretVolume_DirectMountOptIn(t *test
 		t.Fatalf("Build() error = %v", err)
 	}
 
-	mount, ok := findVolumeMount(job.Spec.Template.Spec.Containers[0].VolumeMounts, testGitCredentials)
+	mount, ok := findVolumeMount(job.Spec.Template.Spec.Containers[0].VolumeMounts, "git-read-credentials")
 	if !ok {
 		t.Fatal("Missing git-credentials volume mount")
 	}
@@ -1769,6 +1801,7 @@ func TestJobBuilder_Build_ContainerTask_GitSecretVolume_DirectMountOptIn(t *test
 	if !mount.ReadOnly {
 		t.Error("git-credentials mount should be read-only")
 	}
+	requireWorkspaceCredentialProjection(t, job.Spec.Template.Spec.Volumes, "git-read-credentials", "my-git-creds", defaultACPWorkspaceCredentialKey)
 }
 
 func TestJobBuilder_Build_UntrustedContainerTask_DirectSecretsDisabledByDefault(t *testing.T) {
@@ -1847,14 +1880,11 @@ func TestJobBuilder_Build_ContainerTask_Workspace(t *testing.T) {
 			Command: []string{"sh", "-lc"},
 			Args:    []string{"go test ./..."},
 			Workspace: &corev1alpha1.WorkspaceConfig{
-				GitRepo:    "https://github.com/example/repo.git",
-				Branch:     "feature",
-				Ref:        "abc123",
-				SubPath:    "src",
-				PushBranch: "demo/fixup",
-				GitSecretRef: &corev1.LocalObjectReference{
-					Name: "git-credentials",
-				},
+				GitRepo:           "https://github.com/example/repo.git",
+				Branch:            "feature",
+				Ref:               "abc123",
+				SubPath:           "src",
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "git-credentials"},
 			},
 		},
 	}
@@ -1870,8 +1900,11 @@ func TestJobBuilder_Build_ContainerTask_Workspace(t *testing.T) {
 	if !hasVolume(job.Spec.Template.Spec.Volumes, "home") {
 		t.Fatal("missing home volume")
 	}
-	if !hasVolume(job.Spec.Template.Spec.Volumes, testGitCredentials) {
-		t.Fatal("missing git credentials volume")
+	if !hasVolume(job.Spec.Template.Spec.Volumes, "git-read-credentials") {
+		t.Fatal("missing read git credential volume")
+	}
+	if hasVolume(job.Spec.Template.Spec.Volumes, "git-publication-credentials") {
+		t.Fatal("read-only custom-image workspace should not include publication credentials")
 	}
 	if len(job.Spec.Template.Spec.InitContainers) != 1 {
 		t.Fatalf("init container count = %d, want 1", len(job.Spec.Template.Spec.InitContainers))
@@ -1883,14 +1916,14 @@ func TestJobBuilder_Build_ContainerTask_Workspace(t *testing.T) {
 	if init.Image != builder.GeneralWorkerImage {
 		t.Errorf("init image = %q, want %q", init.Image, builder.GeneralWorkerImage)
 	}
-	if !hasVolumeMount(init.VolumeMounts, testGitCredentials) {
+	if !hasVolumeMount(init.VolumeMounts, "git-read-credentials") {
 		t.Fatal("prepare-workspace init container missing git-credentials mount")
 	}
 	if _, ok := findEnvVar(init.Env, "ORKA_GIT_REPO"); !ok {
 		t.Fatal("init missing ORKA_GIT_REPO")
 	}
 	container := job.Spec.Template.Spec.Containers[0]
-	if hasVolumeMount(container.VolumeMounts, testGitCredentials) {
+	if hasVolumeMount(container.VolumeMounts, "git-read-credentials") || hasVolumeMount(container.VolumeMounts, "git-publication-credentials") {
 		t.Fatal("main container should not mount git credentials by default")
 	}
 	if container.WorkingDir != "/workspace/src" {
@@ -1899,8 +1932,197 @@ func TestJobBuilder_Build_ContainerTask_Workspace(t *testing.T) {
 	if _, ok := findEnvVar(container.Env, "ORKA_GIT_REF"); !ok {
 		t.Fatal("container missing ORKA_GIT_REF")
 	}
-	if _, ok := findEnvVar(container.Env, "ORKA_PUSH_BRANCH"); !ok {
-		t.Fatal("container missing ORKA_PUSH_BRANCH")
+	if _, ok := findEnvVar(container.Env, "ORKA_PUSH_BRANCH"); ok {
+		t.Fatal("read-only custom-image workspace unexpectedly included ORKA_PUSH_BRANCH")
+	}
+}
+
+func TestJobBuilder_Build_ContainerTask_CustomImagePushBranchFailsClosed(t *testing.T) {
+	builder := setupJobBuilder()
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "custom-container-publish", Namespace: defaultNS},
+		Spec: corev1alpha1.TaskSpec{
+			Type:  corev1alpha1.TaskTypeContainer,
+			Image: testBusyboxImage,
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:                  "https://github.com/example/source.git",
+				PushBranch:               "orka/publish",
+				ReadCredentialRef:        &corev1alpha1.WorkspaceCredentialReference{Name: "source-read"},
+				PublicationCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "publication-write"},
+			},
+		},
+	}
+
+	const want = "custom-image container Tasks do not support workspace.pushBranch publication"
+	if _, err := builder.Build(context.Background(), task, nil, nil); err == nil || err.Error() != want {
+		t.Fatalf("Build() error = %v, want %q", err, want)
+	}
+}
+
+func TestJobBuilder_Build_ContainerTask_ManagedPushBranchAccepted(t *testing.T) {
+	builder := setupJobBuilder()
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "managed-container-publish", Namespace: defaultNS},
+		Spec: corev1alpha1.TaskSpec{
+			Type:  corev1alpha1.TaskTypeContainer,
+			Image: "",
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:                  "https://github.com/example/source.git",
+				PushBranch:               "orka/publish",
+				ReadCredentialRef:        &corev1alpha1.WorkspaceCredentialReference{Name: "source-read"},
+				PublicationCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "publication-write"},
+			},
+		},
+	}
+
+	job, err := builder.Build(context.Background(), task, nil, nil)
+	if err != nil {
+		t.Fatalf("Build() error = %v, want managed container publication accepted", err)
+	}
+	container := job.Spec.Template.Spec.Containers[0]
+	if container.Image != builder.GeneralWorkerImage {
+		t.Fatalf("container image = %q, want managed worker %q", container.Image, builder.GeneralWorkerImage)
+	}
+	if pushBranch, ok := findEnvVar(container.Env, "ORKA_PUSH_BRANCH"); !ok || pushBranch.Value != "orka/publish" {
+		t.Fatalf("ORKA_PUSH_BRANCH = %#v, present=%v, want orka/publish", pushBranch, ok)
+	}
+}
+
+func TestJobBuilder_Build_ContainerTask_PushUsesSeparatedCredentials(t *testing.T) {
+	builder := setupJobBuilder()
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "container-publish", Namespace: defaultNS},
+		Spec: corev1alpha1.TaskSpec{
+			Type:    corev1alpha1.TaskTypeContainer,
+			Command: []string{"sh", "-lc"},
+			Args:    []string{"echo change >> file.txt"},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:                  "https://github.com/example/source.git",
+				PublicationGitRepo:       "https://github.com/example/target.git",
+				PushBranch:               "orka/publish",
+				ReadCredentialRef:        &corev1alpha1.WorkspaceCredentialReference{Name: "source-read", Key: "source-token"},
+				PublicationCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "target-write", Key: "target-token"},
+			},
+		},
+	}
+
+	job, err := builder.Build(context.Background(), task, nil, nil)
+	if err != nil {
+		t.Fatalf("Build() error = %v", err)
+	}
+	if len(job.Spec.Template.Spec.InitContainers) != 1 {
+		t.Fatalf("init container count = %d, want 1", len(job.Spec.Template.Spec.InitContainers))
+	}
+	init := job.Spec.Template.Spec.InitContainers[0]
+	if !hasVolumeMount(init.VolumeMounts, "git-read-credentials") || hasVolumeMount(init.VolumeMounts, "git-publication-credentials") {
+		t.Fatalf("workspace init mounts = %#v, want source read credential only", init.VolumeMounts)
+	}
+	container := job.Spec.Template.Spec.Containers[0]
+	if !hasVolumeMount(container.VolumeMounts, "git-publication-credentials") || hasVolumeMount(container.VolumeMounts, "git-read-credentials") {
+		t.Fatalf("worker mounts = %#v, want target publication credential only", container.VolumeMounts)
+	}
+	requireWorkspaceCredentialProjection(t, job.Spec.Template.Spec.Volumes, "git-read-credentials", "source-read", "source-token")
+	requireWorkspaceCredentialProjection(t, job.Spec.Template.Spec.Volumes, "git-publication-credentials", "target-write", "target-token")
+	if forkRepo, ok := findEnvVar(container.Env, workerenv.ForkRepo); !ok || forkRepo.Value != "https://github.com/example/target.git" {
+		t.Fatalf("%s = %#v, want publication repository", workerenv.ForkRepo, forkRepo)
+	}
+}
+
+func TestJobBuilder_Build_ContainerTask_PushRequiresPublicationCredential(t *testing.T) {
+	builder := setupJobBuilder()
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "container-publish", Namespace: defaultNS},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeContainer,
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:           "https://github.com/example/source.git",
+				PushBranch:        "orka/publish",
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "source-read"},
+			},
+		},
+	}
+
+	if _, err := builder.Build(context.Background(), task, nil, nil); err == nil || !strings.Contains(err.Error(), "publicationCredentialRef") {
+		t.Fatalf("Build() error = %v, want missing publication credential", err)
+	}
+}
+
+func TestJobBuilder_Build_ContainerTask_RejectsUnsupportedPublicationGuarantees(t *testing.T) {
+	tests := []struct {
+		name   string
+		field  string
+		mutate func(*corev1alpha1.WorkspaceConfig)
+	}{
+		{
+			name:  "expected remote SHA",
+			field: "workspace.expectedRemoteSHA",
+			mutate: func(workspace *corev1alpha1.WorkspaceConfig) {
+				workspace.ExpectedRemoteSHA = strings.Repeat("a", 40)
+			},
+		},
+		{
+			name:  "create PR",
+			field: "workspace.createPR",
+			mutate: func(workspace *corev1alpha1.WorkspaceConfig) {
+				workspace.CreatePR = true
+			},
+		},
+		{
+			name:  "max changed files",
+			field: "workspace.maxChangedFiles",
+			mutate: func(workspace *corev1alpha1.WorkspaceConfig) {
+				limit := int32(1)
+				workspace.MaxChangedFiles = &limit
+			},
+		},
+		{
+			name:  "allowed paths",
+			field: "workspace.allowedPaths",
+			mutate: func(workspace *corev1alpha1.WorkspaceConfig) {
+				workspace.AllowedPaths = []string{"src/**"}
+			},
+		},
+		{
+			name:  "repository control paths",
+			field: "workspace.denyRepositoryControlPaths",
+			mutate: func(workspace *corev1alpha1.WorkspaceConfig) {
+				workspace.DenyRepositoryControlPaths = true
+			},
+		},
+		{
+			name:  "binary files",
+			field: "workspace.rejectBinaryFiles",
+			mutate: func(workspace *corev1alpha1.WorkspaceConfig) {
+				workspace.RejectBinaryFiles = true
+			},
+		},
+		{
+			name:  "secret-like content",
+			field: "workspace.rejectSecretLikeContent",
+			mutate: func(workspace *corev1alpha1.WorkspaceConfig) {
+				workspace.RejectSecretLikeContent = true
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			workspace := &corev1alpha1.WorkspaceConfig{GitRepo: "https://github.com/example/source.git"}
+			tt.mutate(workspace)
+			task := &corev1alpha1.Task{
+				ObjectMeta: metav1.ObjectMeta{Name: "container-unsupported-publication", Namespace: defaultNS},
+				Spec: corev1alpha1.TaskSpec{
+					Type:      corev1alpha1.TaskTypeContainer,
+					Image:     testBusyboxImage,
+					Workspace: workspace,
+				},
+			}
+
+			_, err := setupJobBuilder().Build(context.Background(), task, nil, nil)
+			if err == nil || !strings.Contains(err.Error(), tt.field) {
+				t.Fatalf("Build() error = %v, want unsupported %s error", err, tt.field)
+			}
+		})
 	}
 }
 
@@ -2287,16 +2509,14 @@ func TestAddAgentWorkspaceEnvVars_AllFields(t *testing.T) {
 	jb := setupJobBuilder()
 	task := &corev1alpha1.Task{
 		Spec: corev1alpha1.TaskSpec{
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      "https://github.com/org/repo",
-					Branch:       "main",
-					Ref:          "abc123",
-					SubPath:      "src/",
-					ForkRepo:     "https://github.com/fork/repo",
-					PRBaseBranch: "develop",
-					PushBranch:   "feature-branch",
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:            "https://github.com/org/repo",
+				Branch:             "main",
+				Ref:                "abc123",
+				SubPath:            "src/",
+				PublicationGitRepo: "https://github.com/fork/repo",
+				PRBaseBranch:       "develop",
+				PushBranch:         "feature-branch",
 			},
 		},
 	}
@@ -3127,7 +3347,33 @@ func TestJobBuilder_buildEnvVars_Telemetry(t *testing.T) {
 
 }
 
-func TestReadOnlyAgentRuntimeGuardsRejectOpencode(t *testing.T) {
+func TestJobBuilderAddAgentToolsEnvVarsDefaultsOpenCodeToolsOnlyWhenOmitted(t *testing.T) {
+	builder := setupJobBuilder()
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent}}
+	agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+		Type: corev1alpha1.AgentRuntimeOpencode,
+	}}}
+
+	envVars := builder.addAgentToolsEnvVars(nil, task, agent)
+	if got, ok := findEnvVar(envVars, workerenv.AllowedTools); !ok || got.Value != "Read,Write,Edit,Bash,Glob,Grep" {
+		t.Fatalf("%s = %#v, found=%v", workerenv.AllowedTools, got, ok)
+	}
+
+	agent.Spec.Runtime.DefaultAllowedTools = []string{}
+	envVars = builder.addAgentToolsEnvVars(nil, task, agent)
+	if got, ok := findEnvVar(envVars, workerenv.AllowedTools); ok {
+		t.Fatalf("explicit empty %s unexpectedly emitted: %#v", workerenv.AllowedTools, got)
+	}
+
+	agent.Spec.Runtime.DefaultAllowedTools = nil
+	task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{}}
+	envVars = builder.addAgentToolsEnvVars(nil, task, agent)
+	if got, ok := findEnvVar(envVars, workerenv.AllowedTools); ok {
+		t.Fatalf("explicit empty task override %s unexpectedly emitted: %#v", workerenv.AllowedTools, got)
+	}
+}
+
+func TestReadOnlyAgentRuntimeGuardsAllowOpencode(t *testing.T) {
 	task := &corev1alpha1.Task{
 		ObjectMeta: metav1.ObjectMeta{
 			Annotations: map[string]string{labels.AnnotationAgentReadOnly: scheduledRunLabelValue},
@@ -3139,14 +3385,15 @@ func TestReadOnlyAgentRuntimeGuardsRejectOpencode(t *testing.T) {
 		},
 	}
 
-	if err := validateReadOnlyAgentRuntime(task, agent); err == nil || !strings.Contains(err.Error(), "opencode") {
-		t.Fatalf("validateReadOnlyAgentRuntime() error = %v, want opencode rejection", err)
+	if err := validateReadOnlyAgentRuntime(task, agent); err != nil {
+		t.Fatalf("validateReadOnlyAgentRuntime() error = %v, want OpenCode accepted", err)
 	}
 	if got := readOnlyAgentRuntimeType(agent); got != corev1alpha1.AgentRuntimeOpencode {
 		t.Fatalf("readOnlyAgentRuntimeType() = %q, want opencode", got)
 	}
-	if _, err := readOnlyAgentRuntimeSecretKeys(agent); err == nil || !strings.Contains(err.Error(), "opencode") {
-		t.Fatalf("readOnlyAgentRuntimeSecretKeys() error = %v, want opencode rejection", err)
+	keys, err := readOnlyAgentRuntimeSecretKeys(agent)
+	if err != nil || len(keys) != 0 {
+		t.Fatalf("readOnlyAgentRuntimeSecretKeys() = %#v, %v, want no runtime secret keys", keys, err)
 	}
 }
 
@@ -3348,35 +3595,26 @@ func TestAddSecretVolumes_RuntimeAuthOnlyRejectsFoundryCredentials(t *testing.T)
 	}
 }
 
-func TestValidateReadOnlyAgentRuntimeAllowsCodexWithScopedCredentials(t *testing.T) {
+func TestValidateReadOnlyAgentRuntimeAllowsCodexReadOnlyAgentMode(t *testing.T) {
 	task := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{
 		labels.AnnotationAgentReadOnly: scheduledRunLabelValue,
 	}}}
 	agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
 		Type: corev1alpha1.AgentRuntimeCodex,
 	}}}
-	if err := validateReadOnlyAgentRuntime(task, agent); err != nil {
-		t.Fatalf("validateReadOnlyAgentRuntime() error = %v", err)
-	}
+	// Codex read-only tasks run in the native read-only agent mode with a
+	// kernel-enforced read-only sandbox, so validation accepts them.
 	if err := validateReadOnlyBuiltInAgentRuntime(task, corev1alpha1.AgentRuntimeCodex); err != nil {
-		t.Fatalf("validateReadOnlyBuiltInAgentRuntime() error = %v", err)
-	}
-	keys, err := readOnlyAgentRuntimeSecretKeys(agent)
-	if err != nil {
-		t.Fatalf("readOnlyAgentRuntimeSecretKeys() error = %v", err)
+		t.Fatalf("validateReadOnlyBuiltInAgentRuntime() error = %v, want codex accepted", err)
 	}
-	joined := strings.Join(keys, ",")
-	for _, want := range []string{workerenv.OpenAIAPIKey, workerenv.CodexAPIKey, workerenv.OpenAIBaseURL} {
-		if !strings.Contains(joined, want) {
-			t.Fatalf("read-only Codex keys = %#v, missing %s", keys, want)
-		}
+	if err := validateReadOnlyAgentRuntime(task, agent); err != nil {
+		t.Fatalf("validateReadOnlyAgentRuntime() error = %v, want codex accepted", err)
 	}
-	secret := &corev1.Secret{Data: map[string][]byte{workerenv.OpenAIAPIKey: []byte("x")}}
-	if !readOnlyAgentRuntimeSecretHasCredential(secret, agent) {
-		t.Fatal("read-only Codex credential was not recognized")
+	if err := validateReadOnlyBuiltInAgentRuntime(task, corev1alpha1.AgentRuntimeCopilot); err == nil ||
+		!strings.Contains(err.Error(), "copilot runtime credentials") {
+		t.Fatalf("validateReadOnlyBuiltInAgentRuntime(copilot) error = %v, want fail-closed rejection", err)
 	}
 }
-
 func TestValidateReadOnlyAgentRuntimeRejectsExternalRuntimeRef(t *testing.T) {
 	task := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{
 		labels.AnnotationAgentReadOnly: scheduledRunLabelValue,
diff --git a/internal/controller/opencode_runtime_validation.go b/internal/controller/opencode_runtime_validation.go
new file mode 100644
index 000000000..65a54f13f
--- /dev/null
+++ b/internal/controller/opencode_runtime_validation.go
@@ -0,0 +1,71 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package controller
+
+import (
+	"fmt"
+	"strings"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+)
+
+// ValidateOpenCodeAgentSpec validates the reviewed managed OpenCode v2
+// runtime configuration. It is contract-aware: runtime.type: opencode exists
+// in both harness protocols and is never protocol evidence, so the v2 rules
+// apply only to an Agent explicitly classified orka.harness.v2. V1-selected
+// and still-unclassified stored legacy OpenCode Agents are preserved
+// unchanged; execution admission for them fails closed elsewhere.
+func ValidateOpenCodeAgentSpec(agent *corev1alpha1.Agent) error {
+	if agent == nil || agent.Spec.Runtime == nil || agent.Spec.Runtime.Type != corev1alpha1.AgentRuntimeOpencode {
+		return nil
+	}
+	if agent.BuiltInContractVersion() != corev1alpha1.AgentRuntimeContractHarnessV2 {
+		return nil
+	}
+	if strings.TrimSpace(agent.Spec.Runtime.DefaultReasoningEffort) != "" {
+		return fmt.Errorf("agent %q opencode runtime does not support spec.runtime.defaultReasoningEffort", agent.Name)
+	}
+	if agent.Spec.SystemPrompt != nil &&
+		(strings.TrimSpace(agent.Spec.SystemPrompt.Inline) != "" || agent.Spec.SystemPrompt.ConfigMapRef != nil) {
+		return fmt.Errorf("agent %q opencode runtime does not support spec.systemPrompt", agent.Name)
+	}
+	if agent.Spec.ProviderRef != nil {
+		return fmt.Errorf("agent %q opencode runtime does not accept spec.providerRef; provider identity is derived from spec.model.name", agent.Name)
+	}
+	if agent.Spec.Model == nil || strings.TrimSpace(agent.Spec.Model.Name) == "" {
+		return fmt.Errorf("agent %q opencode runtime requires spec.model.name", agent.Name)
+	}
+	if strings.ContainsAny(agent.Spec.Model.Name, "{}") {
+		return fmt.Errorf("agent %q opencode runtime model name must not contain substitution braces", agent.Name)
+	}
+	provider, model, ok := strings.Cut(strings.TrimSpace(agent.Spec.Model.Name), "/")
+	if !ok || strings.TrimSpace(provider) == "" || strings.TrimSpace(model) == "" {
+		return fmt.Errorf("agent %q opencode runtime model name must use provider/model form", agent.Name)
+	}
+	if strings.TrimSpace(agent.Spec.Model.Provider) != "" {
+		return fmt.Errorf("agent %q opencode runtime does not accept model.provider", agent.Name)
+	}
+	if agent.Spec.Model.Temperature != nil && *agent.Spec.Model.Temperature != legacyDefaultACPTemperature {
+		return fmt.Errorf("agent %q opencode runtime does not support spec.model.temperature values other than the legacy default %.1f", agent.Name, legacyDefaultACPTemperature)
+	}
+	if len(agent.Spec.Model.Fallbacks) > 0 {
+		return fmt.Errorf("agent %q opencode runtime does not support spec.model.fallbacks", agent.Name)
+	}
+	if agent.Spec.Model.ContextWindow == nil || *agent.Spec.Model.ContextWindow <= 0 {
+		return fmt.Errorf("agent %q opencode runtime requires a positive spec.model.contextWindow", agent.Name)
+	}
+	if agent.Spec.Model.MaxTokens == nil || *agent.Spec.Model.MaxTokens <= 0 {
+		return fmt.Errorf("agent %q opencode runtime requires a positive spec.model.maxTokens", agent.Name)
+	}
+	if *agent.Spec.Model.ContextWindow <= *agent.Spec.Model.MaxTokens {
+		return fmt.Errorf("agent %q opencode runtime model.contextWindow must exceed model.maxTokens", agent.Name)
+	}
+	if agent.Spec.SecretRef != nil && strings.TrimSpace(agent.Spec.SecretRef.Name) != "" {
+		return fmt.Errorf("agent %q opencode runtime does not accept spec.secretRef; provider access is controller-proxied", agent.Name)
+	}
+	return nil
+}
diff --git a/internal/controller/opencode_test_helpers_test.go b/internal/controller/opencode_test_helpers_test.go
new file mode 100644
index 000000000..cdd0b97bf
--- /dev/null
+++ b/internal/controller/opencode_test_helpers_test.go
@@ -0,0 +1,24 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package controller
+
+import corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+
+const (
+	testOpenCodeContextWindow int32 = 32768
+	testOpenCodeMaxTokens     int32 = 4096
+)
+
+func testOpenCodeModelConfig() *corev1alpha1.ModelConfig {
+	contextWindow := testOpenCodeContextWindow
+	maxTokens := testOpenCodeMaxTokens
+	return &corev1alpha1.ModelConfig{
+		Name:          "openai/gpt-test",
+		ContextWindow: &contextWindow,
+		MaxTokens:     &maxTokens,
+	}
+}
diff --git a/internal/controller/outboundaccesspolicy_controller_test.go b/internal/controller/outboundaccesspolicy_controller_test.go
index e0834ae74..a9be29b06 100644
--- a/internal/controller/outboundaccesspolicy_controller_test.go
+++ b/internal/controller/outboundaccesspolicy_controller_test.go
@@ -32,8 +32,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
-	"github.com/orka-agents/orka/internal/approvals"
-	"github.com/orka-agents/orka/internal/labels"
 	"github.com/orka-agents/orka/internal/outboundaccess"
 	"github.com/orka-agents/orka/internal/tokenexchange"
 )
@@ -819,183 +817,6 @@ func readyControllerPolicy(namespace, name string, spec corev1alpha1.OutboundAcc
 	}
 }
 
-func TestHarnessBrokeredTransactionAuthorityReadsTaskOwnedSecret(t *testing.T) {
-	scheme := runtime.NewScheme()
-	if err := corev1.AddToScheme(scheme); err != nil {
-		t.Fatal(err)
-	}
-	if err := corev1alpha1.AddToScheme(scheme); err != nil {
-		t.Fatal(err)
-	}
-	task := &corev1alpha1.Task{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "remote-task",
-			Namespace: "tenant",
-			UID:       types.UID("task-uid"),
-			Annotations: map[string]string{
-				labels.AnnotationTransactionTokenSecret: "task-transaction",
-			},
-		},
-		Spec: corev1alpha1.TaskSpec{Transaction: &corev1alpha1.TaskTransaction{
-			Scope:  "api.read api.write",
-			Scopes: []string{"api.read", "api.write"},
-		}},
-	}
-	controller := true
-	secret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "task-transaction",
-			Namespace: "tenant",
-			OwnerReferences: []metav1.OwnerReference{{
-				APIVersion: corev1alpha1.GroupVersion.String(),
-				Kind:       "Task",
-				Name:       task.Name,
-				UID:        task.UID,
-				Controller: &controller,
-			}},
-		},
-		Data: map[string][]byte{"token": []byte("task-scoped-token")},
-	}
-	client := ctrlfake.NewClientBuilder().WithScheme(scheme).WithObjects(task, secret).Build()
-	reconciler := &TaskReconciler{Client: client, APIReader: client}
-	token, scopes, err := reconciler.harnessBrokeredTransactionAuthority(context.Background(), task)
-	if err != nil {
-		t.Fatalf("harnessBrokeredTransactionAuthority() error = %v", err)
-	}
-	if token != "task-scoped-token" || len(scopes) != 2 {
-		t.Fatalf("authority = token %q scopes %#v", token, scopes)
-	}
-
-	secret.OwnerReferences[0].UID = types.UID("other-task")
-	if err := client.Update(context.Background(), secret); err != nil {
-		t.Fatal(err)
-	}
-	if _, _, err := reconciler.harnessBrokeredTransactionAuthority(context.Background(), task); err == nil {
-		t.Fatal("unowned transaction authority Secret was accepted")
-	}
-}
-
-func TestHarnessBrokeredTransactionAuthorityIdentityChangesOnSecretRotation(t *testing.T) {
-	scheme := runtime.NewScheme()
-	if err := corev1.AddToScheme(scheme); err != nil {
-		t.Fatal(err)
-	}
-	if err := corev1alpha1.AddToScheme(scheme); err != nil {
-		t.Fatal(err)
-	}
-	task := &corev1alpha1.Task{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "remote-task",
-			Namespace: "tenant",
-			UID:       types.UID("task-uid"),
-			Annotations: map[string]string{
-				labels.AnnotationTransactionTokenSecret: "task-transaction",
-			},
-		},
-		Spec: corev1alpha1.TaskSpec{Transaction: &corev1alpha1.TaskTransaction{
-			ID:            "txn-1",
-			Scope:         "api.read",
-			Scopes:        []string{"api.read"},
-			ContextDigest: "sha256:context",
-		}},
-	}
-	secret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "task-transaction",
-			Namespace: "tenant",
-			OwnerReferences: []metav1.OwnerReference{{
-				APIVersion: corev1alpha1.GroupVersion.String(), Kind: "Task", Name: task.Name, UID: task.UID,
-			}},
-		},
-		Data: map[string][]byte{"token": []byte("token-a")},
-	}
-	client := ctrlfake.NewClientBuilder().WithScheme(scheme).WithObjects(task, secret).Build()
-	reconciler := &TaskReconciler{Client: client, APIReader: client}
-	first, err := reconciler.harnessBrokeredTransactionAuthorityIdentity(context.Background(), task)
-	if err != nil {
-		t.Fatal(err)
-	}
-	firstDigest, err := approvals.TargetSpecDigest(first)
-	if err != nil {
-		t.Fatal(err)
-	}
-	secret.Data["token"] = []byte("token-b")
-	if err := client.Update(context.Background(), secret); err != nil {
-		t.Fatal(err)
-	}
-	second, err := reconciler.harnessBrokeredTransactionAuthorityIdentity(context.Background(), task)
-	if err != nil {
-		t.Fatal(err)
-	}
-	secondDigest, err := approvals.TargetSpecDigest(second)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if firstDigest == secondDigest {
-		t.Fatal("transaction authority Secret rotation did not change brokered approval identity")
-	}
-}
-
-func TestHarnessBrokeredOutboundPolicyIdentityChangesOnServiceAccountRecreation(t *testing.T) {
-	scheme := runtime.NewScheme()
-	if err := corev1.AddToScheme(scheme); err != nil {
-		t.Fatal(err)
-	}
-	if err := corev1alpha1.AddToScheme(scheme); err != nil {
-		t.Fatal(err)
-	}
-	policy := &corev1alpha1.OutboundAccessPolicy{
-		ObjectMeta: metav1.ObjectMeta{
-			Name: "resource-api", Namespace: "tenant", UID: types.UID("policy-uid"), ResourceVersion: "10", Generation: 2,
-		},
-		Spec: corev1alpha1.OutboundAccessPolicySpec{Direct: &corev1alpha1.DirectOutboundAccess{
-			Subject: corev1alpha1.OutboundTokenSource{
-				Source:            corev1alpha1.OutboundTokenSourceServiceAccount,
-				ServiceAccountRef: &corev1alpha1.OutboundServiceAccountReference{Name: "workload"},
-			},
-		}},
-	}
-	serviceAccount := &corev1.ServiceAccount{
-		ObjectMeta: metav1.ObjectMeta{Name: "workload", Namespace: "tenant", UID: types.UID("service-account-a"), ResourceVersion: "1"},
-	}
-	tool := &corev1alpha1.Tool{
-		ObjectMeta: metav1.ObjectMeta{Name: "dispatch", Namespace: "tenant"},
-		Spec: corev1alpha1.ToolSpec{HTTP: &corev1alpha1.HTTPExecution{
-			OutboundAccessPolicyRef: &corev1alpha1.LocalObjectReference{Name: policy.Name},
-		}},
-	}
-	client := ctrlfake.NewClientBuilder().WithScheme(scheme).WithObjects(policy, serviceAccount).Build()
-	reconciler := &TaskReconciler{Client: client, APIReader: client}
-	first, err := reconciler.harnessBrokeredOutboundPolicyIdentity(context.Background(), tool)
-	if err != nil {
-		t.Fatal(err)
-	}
-	firstDigest, err := approvals.TargetSpecDigest(first)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := client.Delete(context.Background(), serviceAccount); err != nil {
-		t.Fatal(err)
-	}
-	replacement := &corev1.ServiceAccount{
-		ObjectMeta: metav1.ObjectMeta{Name: "workload", Namespace: "tenant", UID: types.UID("service-account-b")},
-	}
-	if err := client.Create(context.Background(), replacement); err != nil {
-		t.Fatal(err)
-	}
-	second, err := reconciler.harnessBrokeredOutboundPolicyIdentity(context.Background(), tool)
-	if err != nil {
-		t.Fatal(err)
-	}
-	secondDigest, err := approvals.TargetSpecDigest(second)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if firstDigest == secondDigest {
-		t.Fatal("ServiceAccount recreation did not change brokered approval identity")
-	}
-}
-
 func TestToolReconcilerDirectPolicyDefersMCPResolvedEndpointValidation(t *testing.T) {
 	scheme := runtime.NewScheme()
 	_ = corev1alpha1.AddToScheme(scheme)
diff --git a/internal/controller/repositorymonitor_automerge.go b/internal/controller/repositorymonitor_automerge.go
index 589540d00..df365feca 100644
--- a/internal/controller/repositorymonitor_automerge.go
+++ b/internal/controller/repositorymonitor_automerge.go
@@ -441,7 +441,7 @@ func (r *RepositoryMonitorReconciler) fetchRepositoryMonitorAuthorizedJSON(ctx c
 }
 
 func (r *RepositoryMonitorReconciler) mergeRepositoryMonitorPullRequest(ctx context.Context, monitor *corev1alpha1.RepositoryMonitor, owner, repository string, number int64, method, expectedSHA string) (string, error) {
-	token, err := r.repositoryMonitorGitHubToken(ctx, monitor)
+	token, err := r.repositoryMonitorForgeToken(ctx, monitor)
 	if err != nil {
 		return "", err
 	}
diff --git a/internal/controller/repositorymonitor_command_reconcile.go b/internal/controller/repositorymonitor_command_reconcile.go
index c710993e3..13490c719 100644
--- a/internal/controller/repositorymonitor_command_reconcile.go
+++ b/internal/controller/repositorymonitor_command_reconcile.go
@@ -268,8 +268,10 @@ func (r *RepositoryMonitorReconciler) terminalizeRepositoryMonitorAutomerge(ctx
 }
 
 func repositoryMonitorCommandActionKind(intent string) string {
+	const repositoryMonitorCommandIntentReview = "review"
+
 	switch strings.TrimSpace(intent) {
-	case "review":
+	case repositoryMonitorCommandIntentReview:
 		return "pr_review"
 	case repositoryMonitorCommandIntentFix:
 		return "pr_repair"
diff --git a/internal/controller/repositorymonitor_controller.go b/internal/controller/repositorymonitor_controller.go
index df5989936..682dbfff6 100644
--- a/internal/controller/repositorymonitor_controller.go
+++ b/internal/controller/repositorymonitor_controller.go
@@ -304,29 +304,22 @@ func (r *RepositoryMonitorReconciler) validateRepositoryMonitorReviewerAgent(ctx
 		return "", "", err
 	}
 	if agent.Spec.Runtime == nil {
-		return repositoryMonitorReasonUnsupportedReviewerAgent, fmt.Sprintf("spec.agents.reviewer %q must use a built-in claude or codex runtime for read-only repository monitor reviews", reviewer.Name), nil
+		return repositoryMonitorReasonUnsupportedReviewerAgent, fmt.Sprintf("spec.agents.reviewer %q must use a built-in claude, codex, or opencode runtime for read-only repository monitor reviews", reviewer.Name), nil
 	}
 	if agent.Spec.Runtime.RuntimeRef != nil && strings.TrimSpace(agent.Spec.Runtime.RuntimeRef.Name) != "" {
-		return repositoryMonitorReasonUnsupportedReviewerAgent, fmt.Sprintf("spec.agents.reviewer %q cannot use runtimeRef because external runtimes cannot enforce read-only credential and tool isolation; use built-in claude or codex", reviewer.Name), nil
+		return repositoryMonitorReasonUnsupportedReviewerAgent, fmt.Sprintf("spec.agents.reviewer %q cannot use runtimeRef because external runtimes cannot enforce read-only credential and tool isolation; use built-in claude, codex, or opencode", reviewer.Name), nil
 	}
 	switch agent.Spec.Runtime.Type {
 	case corev1alpha1.AgentRuntimeClaude, corev1alpha1.AgentRuntimeCodex:
-	default:
-		return repositoryMonitorReasonUnsupportedReviewerAgent, fmt.Sprintf("spec.agents.reviewer %q runtime %q is not supported for read-only repository monitor reviews; use claude or codex", reviewer.Name, agent.Spec.Runtime.Type), nil
-	}
-	if agent.Spec.SecretRef == nil || strings.TrimSpace(agent.Spec.SecretRef.Name) == "" {
-		return repositoryMonitorReasonReviewerCredentialsInvalid, fmt.Sprintf("spec.agents.reviewer %q must reference a Secret with credentials for runtime %q", reviewer.Name, agent.Spec.Runtime.Type), nil
-	}
-	secretName := strings.TrimSpace(agent.Spec.SecretRef.Name)
-	var secret corev1.Secret
-	if err := r.Get(ctx, types.NamespacedName{Name: secretName, Namespace: monitor.Namespace}, &secret); err != nil {
-		if apierrors.IsNotFound(err) {
-			return repositoryMonitorReasonReviewerCredentialsInvalid, fmt.Sprintf("spec.agents.reviewer %q credential Secret %q not found in monitor namespace %q", reviewer.Name, secretName, monitor.Namespace), nil
+	case corev1alpha1.AgentRuntimeOpencode:
+		if err := ValidateOpenCodeAgentSpec(&agent); err != nil {
+			return repositoryMonitorReasonUnsupportedReviewerAgent, fmt.Sprintf("spec.agents.reviewer %q has an invalid OpenCode configuration: %v", reviewer.Name, err), nil
 		}
-		return "", "", err
+	default:
+		return repositoryMonitorReasonUnsupportedReviewerAgent, fmt.Sprintf("spec.agents.reviewer %q runtime %q is not supported for read-only repository monitor reviews; use claude, codex, or opencode", reviewer.Name, agent.Spec.Runtime.Type), nil
 	}
-	if !readOnlyAgentRuntimeSecretHasCredential(&secret, &agent) {
-		return repositoryMonitorReasonReviewerCredentialsInvalid, fmt.Sprintf("spec.agents.reviewer %q credential Secret %q must contain a supported auth key for runtime %q", reviewer.Name, secretName, agent.Spec.Runtime.Type), nil
+	if err := validateBuiltInACPAgentCredentialSecretRef(&agent); err != nil {
+		return repositoryMonitorReasonReviewerCredentialsInvalid, fmt.Sprintf("spec.agents.reviewer %q must omit spec.secretRef; provider credentials are supplied by the controller-managed runtime proxy", reviewer.Name), nil
 	}
 	return "", "", nil
 }
@@ -365,22 +358,8 @@ func (r *RepositoryMonitorReconciler) validateRepositoryMonitorImplementerAgent(
 	}
 	switch agent.Spec.Runtime.Type {
 	case corev1alpha1.AgentRuntimeCodex, corev1alpha1.AgentRuntimeClaude:
-		if agent.Spec.SecretRef == nil || strings.TrimSpace(agent.Spec.SecretRef.Name) == "" {
-			return repositoryMonitorReasonImplementerAuthInvalid, fmt.Sprintf("spec.agents.implementer %q must reference a runtime credential Secret", ref.Name), nil
-		}
-		secretName := strings.TrimSpace(agent.Spec.SecretRef.Name)
-		var secret corev1.Secret
-		if err := r.Get(ctx, types.NamespacedName{Name: secretName, Namespace: monitor.Namespace}, &secret); err != nil {
-			if apierrors.IsNotFound(err) {
-				return repositoryMonitorReasonImplementerAuthInvalid, fmt.Sprintf("spec.agents.implementer %q credential Secret %q not found in monitor namespace %q", ref.Name, secretName, monitor.Namespace), nil
-			}
-			return "", "", err
-		}
-		if !scopedAgentRuntimeSecretHasCredential(&secret, &agent) {
-			return repositoryMonitorReasonImplementerAuthInvalid, fmt.Sprintf("spec.agents.implementer %q credential Secret %q has no supported key for runtime %q", ref.Name, secretName, agent.Spec.Runtime.Type), nil
-		}
-		if agent.Spec.Runtime.Type == corev1alpha1.AgentRuntimeClaude && repositoryMonitorClaudeFoundryConfigured(secret.Data) {
-			return repositoryMonitorReasonImplementerAuthInvalid, fmt.Sprintf("spec.agents.implementer %q cannot use Azure AI Foundry credentials because implementation tasks require the local runtime auth proxy", ref.Name), nil
+		if err := validateBuiltInACPAgentCredentialSecretRef(&agent); err != nil {
+			return repositoryMonitorReasonImplementerAuthInvalid, fmt.Sprintf("spec.agents.implementer %q must omit spec.secretRef; provider credentials are supplied by the controller-managed runtime proxy", ref.Name), nil
 		}
 		return "", "", nil
 	case corev1alpha1.AgentRuntimeCopilot:
@@ -432,52 +411,30 @@ func (r *RepositoryMonitorReconciler) validateRepositoryMonitorIssueReadOnlyAgen
 		}
 		return "", "", err
 	}
-	if agent.Spec.Runtime == nil || agent.Spec.Runtime.Type != corev1alpha1.AgentRuntimeClaude {
+	if agent.Spec.Runtime == nil {
 		runtimeType := corev1alpha1.AgentRuntimeType("")
-		if agent.Spec.Runtime != nil {
-			runtimeType = agent.Spec.Runtime.Type
-		}
-		return "Unsupported" + reasonPrefix + "Agent", fmt.Sprintf("%s %q runtime %q is not supported for read-only repository monitor tasks; use claude", field, ref.Name, runtimeType), nil
+		return "Unsupported" + reasonPrefix + "Agent", fmt.Sprintf("%s %q runtime %q is not supported for read-only repository monitor tasks; use claude or opencode", field, ref.Name, runtimeType), nil
 	}
 	if agent.Spec.Runtime.RuntimeRef != nil && strings.TrimSpace(agent.Spec.Runtime.RuntimeRef.Name) != "" {
-		return "Unsupported" + reasonPrefix + "Agent", fmt.Sprintf("%s %q cannot use runtimeRef because external runtimes cannot enforce read-only credential and tool isolation; use built-in claude", field, ref.Name), nil
-	}
-	if agent.Spec.SecretRef == nil || strings.TrimSpace(agent.Spec.SecretRef.Name) == "" {
-		return reasonPrefix + "CredentialsInvalid", fmt.Sprintf("%s %q must reference a Secret with Claude credentials for read-only repository monitor tasks", field, ref.Name), nil
+		return "Unsupported" + reasonPrefix + "Agent", fmt.Sprintf("%s %q cannot use runtimeRef because external runtimes cannot enforce read-only credential and tool isolation; use built-in claude or opencode", field, ref.Name), nil
 	}
-	secretName := strings.TrimSpace(agent.Spec.SecretRef.Name)
-	var secret corev1.Secret
-	if err := r.Get(ctx, types.NamespacedName{Name: secretName, Namespace: monitor.Namespace}, &secret); err != nil {
-		if apierrors.IsNotFound(err) {
-			return reasonPrefix + "CredentialsInvalid", fmt.Sprintf("%s %q credential Secret %q not found in monitor namespace %q", field, ref.Name, secretName, monitor.Namespace), nil
+	switch agent.Spec.Runtime.Type {
+	case corev1alpha1.AgentRuntimeOpencode:
+		if err := ValidateOpenCodeAgentSpec(&agent); err != nil {
+			return "Unsupported" + reasonPrefix + "Agent", fmt.Sprintf("%s %q has an invalid OpenCode configuration: %v", field, ref.Name, err), nil
 		}
-		return "", "", err
+	case corev1alpha1.AgentRuntimeClaude:
+	default:
+		return "Unsupported" + reasonPrefix + "Agent", fmt.Sprintf("%s %q runtime %q is not supported for read-only repository monitor tasks; use claude or opencode", field, ref.Name, agent.Spec.Runtime.Type), nil
 	}
-	if !readOnlyAgentRuntimeSecretHasCredential(&secret, &agent) {
-		return reasonPrefix + "CredentialsInvalid", fmt.Sprintf("%s %q credential Secret %q must contain a supported Claude auth key", field, ref.Name, secretName), nil
+	if err := validateBuiltInACPAgentCredentialSecretRef(&agent); err != nil {
+		return reasonPrefix + "CredentialsInvalid", fmt.Sprintf("%s %q must omit spec.secretRef; provider credentials are supplied by the controller-managed runtime proxy", field, ref.Name), nil
 	}
 	return "", "", nil
 }
 
 func (r *RepositoryMonitorReconciler) validateRepositoryMonitorGitSecret(ctx context.Context, monitor *corev1alpha1.RepositoryMonitor) (string, string, error) {
-	if monitor.Spec.GitSecretRef == nil || strings.TrimSpace(monitor.Spec.GitSecretRef.Name) == "" {
-		if monitor.Spec.Triggers.GitHub.Labels.Enabled {
-			return repositoryMonitorReasonGitSecretInvalid, "spec.gitSecretRef is required when GitHub label triggers are enabled", nil
-		}
-		return "", "", nil
-	}
-	secretName := strings.TrimSpace(monitor.Spec.GitSecretRef.Name)
-	var secret corev1.Secret
-	if err := r.Get(ctx, types.NamespacedName{Name: secretName, Namespace: monitor.Namespace}, &secret); err != nil {
-		if apierrors.IsNotFound(err) {
-			return repositoryMonitorReasonGitSecretInvalid, fmt.Sprintf("spec.gitSecretRef %q not found in namespace %q", secretName, monitor.Namespace), nil
-		}
-		return "", "", err
-	}
-	if !repositoryMonitorGitSecretHasToken(&secret) {
-		return repositoryMonitorReasonGitSecretInvalid, fmt.Sprintf("spec.gitSecretRef %q must contain a non-empty token, password, or %s key", secretName, workerenv.GitHubToken), nil
-	}
-	return "", "", nil
+	return r.validateRepositoryMonitorCredentialRefs(ctx, monitor)
 }
 
 func repositoryMonitorGitSecretHasToken(secret *corev1.Secret) bool {
@@ -690,7 +647,7 @@ func effectiveRepositoryMonitorBranch(monitor *corev1alpha1.RepositoryMonitor) s
 	if monitor.Spec.Branch != "" {
 		return monitor.Spec.Branch
 	}
-	return "main"
+	return defaultACPSourceBranch
 }
 
 func (r *RepositoryMonitorReconciler) enqueueScheduledRunIfDue(ctx context.Context, monitor *corev1alpha1.RepositoryMonitor, schedule cron.Schedule) (*store.MonitorRun, time.Duration, error) {
diff --git a/internal/controller/repositorymonitor_controller_test.go b/internal/controller/repositorymonitor_controller_test.go
index 9615f12ac..1198e3add 100644
--- a/internal/controller/repositorymonitor_controller_test.go
+++ b/internal/controller/repositorymonitor_controller_test.go
@@ -24,16 +24,21 @@ import (
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
 	"github.com/orka-agents/orka/internal/labels"
+	"github.com/orka-agents/orka/internal/security"
 	"github.com/orka-agents/orka/internal/store"
 	"github.com/orka-agents/orka/internal/workerenv"
 	"github.com/orka-agents/orka/workers/common"
 )
 
 const (
-	repositoryMonitorTestDefaultBranch  = "main"
-	repositoryMonitorTestRepoURL        = "https://github.com/orka-agents/orka"
-	repositoryMonitorTestReviewerSecret = "reviewer-credentials"
-	repositoryMonitorTestHeadSHA        = "sha1"
+	repositoryMonitorTestDefaultBranch             = "main"
+	repositoryMonitorTestRepoURL                   = "https://github.com/orka-agents/orka"
+	repositoryMonitorTestReviewerSecret            = "reviewer-credentials"
+	repositoryMonitorTestHeadSHA                   = "sha1"
+	repositoryMonitorTestReadCredential            = "repository-source-read"
+	repositoryMonitorTestPublicationReadCredential = "repository-target-read"
+	repositoryMonitorTestPublicationCredential     = "repository-target-write"
+	repositoryMonitorTestForgeCredential           = "repository-forge"
 )
 
 func TestRepositoryMonitorReconcileRecordsMetadataAndStatus(t *testing.T) {
@@ -1382,7 +1387,6 @@ func TestRepositoryMonitorReviewTaskReuseAllowsDefaultedTaskScheduleFields(t *te
 	if !created {
 		t.Fatal("createRepositoryMonitorReviewTask() created = false, want true")
 	}
-
 	var existing corev1alpha1.Task
 	if err := cl.Get(ctx, types.NamespacedName{Namespace: "default", Name: taskName}, &existing); err != nil {
 		t.Fatalf("Get review task() error = %v", err)
@@ -1703,7 +1707,7 @@ func TestRepositoryMonitorReviewPublishPostsCommentReviewWithInlineFindings(t *t
 	maxComments := int32(1)
 	postNeedsChanges := true
 	monitor := repositoryMonitorReviewIngestTestMonitor("publish-inline")
-	monitor.Spec.GitSecretRef = &corev1.LocalObjectReference{Name: "github-token"}
+	monitor.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: "github-token"}
 	monitor.Spec.Review.Publish = corev1alpha1.RepositoryMonitorReviewPublishSpec{
 		Enabled:          true,
 		Mode:             repositoryMonitorPublishModeSummaryWithInlineFindings,
@@ -1796,7 +1800,7 @@ func TestRepositoryMonitorReviewPublishSafetySkips(t *testing.T) {
 			name:    "head changed",
 			verdict: repositoryMonitorReviewVerdictNeedsChanges,
 			mutateMonitor: func(m *corev1alpha1.RepositoryMonitor) {
-				m.Spec.GitSecretRef = &corev1.LocalObjectReference{Name: "github-token"}
+				m.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: "github-token"}
 			},
 			serverConfig: repositoryMonitorPublishTestServerConfig{HeadSHA: "new-sha"},
 			wantReason:   repositoryMonitorPublishSkipHeadSHAChanged,
@@ -1805,7 +1809,7 @@ func TestRepositoryMonitorReviewPublishSafetySkips(t *testing.T) {
 			name:    "closed pr",
 			verdict: repositoryMonitorReviewVerdictNeedsChanges,
 			mutateMonitor: func(m *corev1alpha1.RepositoryMonitor) {
-				m.Spec.GitSecretRef = &corev1.LocalObjectReference{Name: "github-token"}
+				m.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: "github-token"}
 			},
 			serverConfig: repositoryMonitorPublishTestServerConfig{State: "closed"},
 			wantReason:   repositoryMonitorPublishSkipPRClosed,
@@ -1814,7 +1818,7 @@ func TestRepositoryMonitorReviewPublishSafetySkips(t *testing.T) {
 			name:    "blocked label",
 			verdict: repositoryMonitorReviewVerdictNeedsChanges,
 			mutateMonitor: func(m *corev1alpha1.RepositoryMonitor) {
-				m.Spec.GitSecretRef = &corev1.LocalObjectReference{Name: "github-token"}
+				m.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: "github-token"}
 				m.Spec.Policy.ProtectedLabels = []string{"do-not-touch"}
 			},
 			serverConfig: repositoryMonitorPublishTestServerConfig{Labels: []string{"do-not-touch"}},
@@ -1824,7 +1828,7 @@ func TestRepositoryMonitorReviewPublishSafetySkips(t *testing.T) {
 			name:    "duplicate same head",
 			verdict: repositoryMonitorReviewVerdictNeedsChanges,
 			mutateMonitor: func(m *corev1alpha1.RepositoryMonitor) {
-				m.Spec.GitSecretRef = &corev1.LocalObjectReference{Name: "github-token"}
+				m.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: "github-token"}
 			},
 			seedDuplicate: true,
 			wantReason:    repositoryMonitorPublishSkipDuplicateSameHead,
@@ -1833,7 +1837,7 @@ func TestRepositoryMonitorReviewPublishSafetySkips(t *testing.T) {
 			name:    "trusted started marker duplicate",
 			verdict: repositoryMonitorReviewVerdictNeedsChanges,
 			mutateMonitor: func(m *corev1alpha1.RepositoryMonitor) {
-				m.Spec.GitSecretRef = &corev1.LocalObjectReference{Name: "github-token"}
+				m.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: "github-token"}
 			},
 			seedStartedMarker: true,
 			wantReason:        repositoryMonitorPublishSkipDuplicateSameHead,
@@ -1954,7 +1958,7 @@ func TestRepositoryMonitorReviewPublishRetriesReviewRecordWithoutTerminalPublish
 
 	postNeedsChanges := true
 	monitor := repositoryMonitorReviewIngestTestMonitor("publish-pending")
-	monitor.Spec.GitSecretRef = &corev1.LocalObjectReference{Name: "github-token"}
+	monitor.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: "github-token"}
 	monitor.Spec.Review.Publish = corev1alpha1.RepositoryMonitorReviewPublishSpec{Enabled: true, Event: repositoryMonitorPublishEventComment, PostNeedsChanges: &postNeedsChanges}
 	task := repositoryMonitorReviewIngestTestTask("publish-pending-task", "publish-pending", 1, reviewHeadSHA)
 	secret := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "github-token", Namespace: "default"}, Data: map[string][]byte{"token": []byte("test-token")}}
@@ -2019,7 +2023,7 @@ func TestRepositoryMonitorReviewPublishRetriesRecoverableSkippedRecord(t *testin
 
 	postNeedsChanges := true
 	monitor := repositoryMonitorReviewIngestTestMonitor("publish-recoverable-skip")
-	monitor.Spec.GitSecretRef = &corev1.LocalObjectReference{Name: "github-token"}
+	monitor.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: "github-token"}
 	monitor.Spec.Review.Publish = corev1alpha1.RepositoryMonitorReviewPublishSpec{Enabled: true, Event: repositoryMonitorPublishEventComment, PostNeedsChanges: &postNeedsChanges}
 	task := repositoryMonitorReviewIngestTestTask("publish-recoverable-skip-task", "publish-recoverable-skip", 1, reviewHeadSHA)
 	secret := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "github-token", Namespace: "default"}, Data: map[string][]byte{"token": []byte("test-token")}}
@@ -2102,7 +2106,7 @@ func TestRepositoryMonitorReviewPublishWaitsBeforeRetryingRecentRecoverableSkip(
 
 	postNeedsChanges := true
 	monitor := repositoryMonitorReviewIngestTestMonitor("publish-recent-skip")
-	monitor.Spec.GitSecretRef = &corev1.LocalObjectReference{Name: "github-token"}
+	monitor.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: "github-token"}
 	monitor.Spec.Review.Publish = corev1alpha1.RepositoryMonitorReviewPublishSpec{Enabled: true, Event: repositoryMonitorPublishEventComment, PostNeedsChanges: &postNeedsChanges}
 	task := repositoryMonitorReviewIngestTestTask("publish-recent-skip-task", "publish-recent-skip", 1, reviewHeadSHA)
 	secret := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "github-token", Namespace: "default"}, Data: map[string][]byte{"token": []byte("test-token")}}
@@ -2186,7 +2190,7 @@ func TestRepositoryMonitorReviewPublishGitHubPermissionFailureCreatesFailedRecor
 
 	postNeedsChanges := true
 	monitor := repositoryMonitorReviewIngestTestMonitor("publish-forbidden")
-	monitor.Spec.GitSecretRef = &corev1.LocalObjectReference{Name: "github-token"}
+	monitor.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: "github-token"}
 	monitor.Spec.Review.Publish = corev1alpha1.RepositoryMonitorReviewPublishSpec{Enabled: true, Event: repositoryMonitorPublishEventComment, PostNeedsChanges: &postNeedsChanges}
 	task := repositoryMonitorReviewIngestTestTask("publish-forbidden-task", "publish-forbidden", 1, reviewHeadSHA)
 	secret := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "github-token", Namespace: "default"}, Data: map[string][]byte{"token": []byte("test-token")}}
@@ -2471,14 +2475,14 @@ func TestRepositoryMonitorReconcileForkPullRequestTaskUsesHeadRepoWithoutBaseSec
 	if err := cl.Get(ctx, types.NamespacedName{Namespace: "default", Name: item.LastReviewID}, &task); err != nil {
 		t.Fatalf("Get review task %q error = %v", item.LastReviewID, err)
 	}
-	if task.Spec.AgentRuntime == nil || task.Spec.AgentRuntime.Workspace == nil {
+	if task.Spec.AgentRuntime == nil || task.Spec.Workspace == nil {
 		t.Fatalf("task AgentRuntime.Workspace is nil")
 	}
-	if task.Spec.AgentRuntime.Workspace.GitRepo != "https://github.com/forker/orka.git" || task.Spec.AgentRuntime.Workspace.Ref != "fork-sha" {
-		t.Fatalf("workspace = %#v, want fork repo at exact fork head", task.Spec.AgentRuntime.Workspace)
+	if task.Spec.Workspace.GitRepo != "https://github.com/forker/orka.git" || task.Spec.Workspace.Ref != "fork-sha" {
+		t.Fatalf("workspace = %#v, want fork repo at exact fork head", task.Spec.Workspace)
 	}
-	if task.Spec.AgentRuntime.Workspace.GitSecretRef != nil {
-		t.Fatalf("workspace GitSecretRef = %#v, want nil for fork PR review", task.Spec.AgentRuntime.Workspace.GitSecretRef)
+	if task.Spec.Workspace.ReadCredentialRef != nil {
+		t.Fatalf("workspace ReadCredentialRef = %#v, want nil for fork PR review", task.Spec.Workspace.ReadCredentialRef)
 	}
 	if !strings.Contains(task.Spec.Prompt, `"headRepo": "forker/orka"`) {
 		t.Fatalf("prompt does not include fork head repo:\n%s", task.Spec.Prompt)
@@ -2540,14 +2544,14 @@ func TestRepositoryMonitorReconcileSameRepoSSHMonitorUsesHTTPSCloneURL(t *testin
 	if err := cl.Get(ctx, types.NamespacedName{Namespace: "default", Name: item.LastReviewID}, &task); err != nil {
 		t.Fatalf("Get review task %q error = %v", item.LastReviewID, err)
 	}
-	if task.Spec.AgentRuntime == nil || task.Spec.AgentRuntime.Workspace == nil {
+	if task.Spec.AgentRuntime == nil || task.Spec.Workspace == nil {
 		t.Fatalf("task AgentRuntime.Workspace is nil")
 	}
-	if task.Spec.AgentRuntime.Workspace.GitRepo != repositoryMonitorTestRepoURL || task.Spec.AgentRuntime.Workspace.Ref != "ssh-head-sha" {
-		t.Fatalf("workspace = %#v, want HTTPS monitored repo at exact head", task.Spec.AgentRuntime.Workspace)
+	if task.Spec.Workspace.GitRepo != repositoryMonitorTestRepoURL || task.Spec.Workspace.Ref != "ssh-head-sha" {
+		t.Fatalf("workspace = %#v, want HTTPS monitored repo at exact head", task.Spec.Workspace)
 	}
-	if task.Spec.AgentRuntime.Workspace.GitSecretRef == nil || task.Spec.AgentRuntime.Workspace.GitSecretRef.Name != "github-token" {
-		t.Fatalf("workspace GitSecretRef = %#v, want github-token for same-repo review", task.Spec.AgentRuntime.Workspace.GitSecretRef)
+	if task.Spec.Workspace.ReadCredentialRef == nil || task.Spec.Workspace.ReadCredentialRef.Name != "github-token" {
+		t.Fatalf("workspace ReadCredentialRef = %#v, want github-token for same-repo review", task.Spec.Workspace.ReadCredentialRef)
 	}
 }
 
@@ -2605,14 +2609,14 @@ func TestRepositoryMonitorReconcileMissingHeadRepoDoesNotAttachBaseSecret(t *tes
 	if err := cl.Get(ctx, types.NamespacedName{Namespace: "default", Name: item.LastReviewID}, &task); err != nil {
 		t.Fatalf("Get review task %q error = %v", item.LastReviewID, err)
 	}
-	if task.Spec.AgentRuntime == nil || task.Spec.AgentRuntime.Workspace == nil {
+	if task.Spec.AgentRuntime == nil || task.Spec.Workspace == nil {
 		t.Fatalf("task AgentRuntime.Workspace is nil")
 	}
-	if task.Spec.AgentRuntime.Workspace.GitRepo != repositoryMonitorTestRepoURL || task.Spec.AgentRuntime.Workspace.Ref != "unknown-head-sha" {
-		t.Fatalf("workspace = %#v, want monitored repo at exact head", task.Spec.AgentRuntime.Workspace)
+	if task.Spec.Workspace.GitRepo != repositoryMonitorTestRepoURL || task.Spec.Workspace.Ref != "unknown-head-sha" {
+		t.Fatalf("workspace = %#v, want monitored repo at exact head", task.Spec.Workspace)
 	}
-	if task.Spec.AgentRuntime.Workspace.GitSecretRef != nil {
-		t.Fatalf("workspace GitSecretRef = %#v, want nil when head repo is unverified", task.Spec.AgentRuntime.Workspace.GitSecretRef)
+	if task.Spec.Workspace.ReadCredentialRef != nil {
+		t.Fatalf("workspace ReadCredentialRef = %#v, want nil when head repo is unverified", task.Spec.Workspace.ReadCredentialRef)
 	}
 }
 
@@ -3488,14 +3492,19 @@ func newRepositoryMonitorPullRequestInventoryServerWithoutAuth(t *testing.T, bod
 }
 
 func newRepositoryMonitorSinglePullRequestServerWithBody(t *testing.T, number int64, body string) *httptest.Server {
+	t.Helper()
+	return newRepositoryMonitorSinglePullRequestServerWithBodyAndAuth(t, number, body, repositoryMonitorTestBearerHeader())
+}
+
+func newRepositoryMonitorSinglePullRequestServerWithBodyAndAuth(t *testing.T, number int64, body, wantAuth string) *httptest.Server {
 	t.Helper()
 	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		wantPath := fmt.Sprintf("/repos/orka-agents/orka/pulls/%d", number)
 		if r.URL.Path != wantPath {
 			t.Fatalf("request path = %q, want single pull request path %q", r.URL.Path, wantPath)
 		}
-		if got := r.Header.Get("Authorization"); got != repositoryMonitorTestBearerHeader() {
-			t.Fatalf("Authorization header = %q, want %q", got, repositoryMonitorTestBearerHeader())
+		if got := r.Header.Get("Authorization"); got != wantAuth {
+			t.Fatalf("Authorization header = %q, want %q", got, wantAuth)
 		}
 		w.Header().Set("Content-Type", "application/json")
 		_, _ = w.Write([]byte(body))
@@ -3890,23 +3899,20 @@ func assertRepositoryMonitorReviewTask(t *testing.T, ctx context.Context, cl crc
 	if task.Spec.AgentRef == nil || task.Spec.AgentRef.Name != "reviewer" {
 		t.Fatalf("task AgentRef = %#v, want reviewer", task.Spec.AgentRef)
 	}
-	if task.Spec.AgentRuntime == nil || task.Spec.AgentRuntime.Workspace == nil {
+	if task.Spec.AgentRuntime == nil || task.Spec.Workspace == nil {
 		t.Fatalf("task AgentRuntime.Workspace is nil")
 	}
-	if task.Spec.AgentRuntime.Workspace.GitRepo != repositoryMonitorTestRepoURL || task.Spec.AgentRuntime.Workspace.Ref != "sha1" || task.Spec.AgentRuntime.Workspace.PRBaseBranch != repositoryMonitorTestDefaultBranch {
-		t.Fatalf("workspace = %#v, want repo with exact PR head sha1", task.Spec.AgentRuntime.Workspace)
-	}
-	if task.Spec.AgentRuntime.Workspace.GitSecretRef == nil || task.Spec.AgentRuntime.Workspace.GitSecretRef.Name != "github-token" {
-		t.Fatalf("workspace GitSecretRef = %#v, want github-token", task.Spec.AgentRuntime.Workspace.GitSecretRef)
+	if task.Spec.Workspace.GitRepo != repositoryMonitorTestRepoURL || task.Spec.Workspace.Ref != "sha1" {
+		t.Fatalf("workspace = %#v, want repo with exact PR head sha1", task.Spec.Workspace)
 	}
-	if got := repositoryMonitorTaskEnvValue(task.Spec.Env, workerenv.PRBaseRepo); got != repositoryMonitorTestRepoURL {
-		t.Fatalf("%s = %q, want %s", workerenv.PRBaseRepo, got, repositoryMonitorTestRepoURL)
+	if task.Spec.Workspace.PRBaseBranch != "" {
+		t.Fatalf("workspace prBaseBranch = %q, want empty because prBaseBranch requires write workspace intent", task.Spec.Workspace.PRBaseBranch)
 	}
-	if got := repositoryMonitorTaskEnvValue(task.Spec.Env, workerenv.PRBaseSHA); got != "base1" {
-		t.Fatalf("%s = %q, want base1", workerenv.PRBaseSHA, got)
+	if task.Spec.Workspace.ReadCredentialRef == nil || task.Spec.Workspace.ReadCredentialRef.Name != "github-token" {
+		t.Fatalf("workspace ReadCredentialRef = %#v, want github-token", task.Spec.Workspace.ReadCredentialRef)
 	}
-	if got := repositoryMonitorTaskEnvValue(task.Spec.Env, workerenv.ResultStdout); got != scheduledRunLabelValue {
-		t.Fatalf("%s = %q, want "+scheduledRunLabelValue+" so review JSON is preserved", workerenv.ResultStdout, got)
+	if len(task.Spec.Env) != 0 {
+		t.Fatalf("task env = %#v, want no arbitrary env for ACP runtime compatibility", task.Spec.Env)
 	}
 	if task.Labels[labels.LabelRepositoryMonitor] != labels.SelectorValue("inventory") || task.Labels[labels.LabelMonitorRun] != labels.SelectorValue("run-1") {
 		t.Fatalf("task labels = %#v, want monitor and run labels", task.Labels)
@@ -3922,15 +3928,6 @@ func assertRepositoryMonitorReviewTask(t *testing.T, ctx context.Context, cl crc
 	}
 }
 
-func repositoryMonitorTaskEnvValue(envVars []corev1.EnvVar, name string) string {
-	for _, envVar := range envVars {
-		if envVar.Name == name {
-			return envVar.Value
-		}
-	}
-	return ""
-}
-
 func TestRepositoryMonitorReconcileRejectsInvalidRepoURLWithoutPersistingMetadata(t *testing.T) {
 	ctx := context.Background()
 	monitorStore := setupControllerSQLiteStore(t)
@@ -4129,10 +4126,13 @@ func TestRepositoryMonitorReconcileRejectsInvalidReviewerAgentWithoutPersistingM
 			reason: "UnsupportedReviewerAgent",
 		},
 		{
-			name:     "agent without secretRef",
-			reviewer: "no-secret",
+			name:     "agent with legacy secretRef",
+			reviewer: "legacy-secret-reviewer",
 			objects: []crclient.Object{
-				repositoryMonitorControllerTestAgent("no-secret", corev1alpha1.AgentRuntimeClaude, ""),
+				repositoryMonitorControllerTestAgent("legacy-secret-reviewer", corev1alpha1.AgentRuntimeClaude, "legacy-reviewer-secret"),
+				repositoryMonitorControllerTestSecret("legacy-reviewer-secret", map[string][]byte{
+					workerenv.AnthropicAPIKey: []byte("legacy-key"),
+				}),
 			},
 			reason: repositoryMonitorReasonReviewerCredentialsInvalid,
 		},
@@ -4227,13 +4227,38 @@ func TestRepositoryMonitorValidationAllowsCodexReviewer(t *testing.T) {
 	reviewer := repositoryMonitorControllerTestAgent(
 		"codex-reviewer",
 		corev1alpha1.AgentRuntimeCodex,
-		"codex-reviewer-secret",
+		"",
 	)
-	secret := repositoryMonitorControllerTestSecret("codex-reviewer-secret", map[string][]byte{
-		workerenv.OpenAIAPIKey: []byte("test-key"),
-	})
-	cl := fake.NewClientBuilder().WithScheme(scheme).WithObjects(reviewer, secret).Build()
+	cl := fake.NewClientBuilder().WithScheme(scheme).WithObjects(reviewer).Build()
 	reconciler := &RepositoryMonitorReconciler{Client: cl}
+	// Codex reviewers run in the native read-only agent mode, so monitor
+	// validation accepts them.
+	reason, message, err := reconciler.validateRepositoryMonitorReviewerAgent(ctx, monitor)
+	if err != nil || reason != "" || message != "" {
+		t.Fatalf("validation reason=%q message=%q err=%v", reason, message, err)
+	}
+}
+
+func TestRepositoryMonitorValidationAllowsOpenCodeReviewerWithoutSecret(t *testing.T) {
+	ctx := context.Background()
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatalf("AddToScheme() error = %v", err)
+	}
+	monitor := &corev1alpha1.RepositoryMonitor{
+		ObjectMeta: metav1.ObjectMeta{Name: "opencode-review-monitor", Namespace: "default"},
+		Spec: corev1alpha1.RepositoryMonitorSpec{Agents: corev1alpha1.RepositoryMonitorAgents{
+			Reviewer: &corev1alpha1.AgentReference{Name: "opencode-reviewer"},
+		}},
+	}
+	reviewer := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "opencode-reviewer", Namespace: "default"},
+		Spec: corev1alpha1.AgentSpec{
+			Model:   testOpenCodeModelConfig(),
+			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeOpencode},
+		},
+	}
+	reconciler := &RepositoryMonitorReconciler{Client: fake.NewClientBuilder().WithScheme(scheme).WithObjects(reviewer).Build()}
 	reason, message, err := reconciler.validateRepositoryMonitorReviewerAgent(ctx, monitor)
 	if err != nil || reason != "" || message != "" {
 		t.Fatalf("validation reason=%q message=%q err=%v", reason, message, err)
@@ -4351,22 +4376,27 @@ func TestRepositoryMonitorReconcileUnsuspendSetsReady(t *testing.T) {
 
 func repositoryMonitorControllerObjects(objects ...crclient.Object) []crclient.Object {
 	defaults := []crclient.Object{
-		repositoryMonitorControllerTestAgent("reviewer", corev1alpha1.AgentRuntimeClaude, repositoryMonitorTestReviewerSecret),
-		repositoryMonitorControllerTestAgent("triager", corev1alpha1.AgentRuntimeClaude, repositoryMonitorTestReviewerSecret),
-		repositoryMonitorControllerTestAgent("researcher", corev1alpha1.AgentRuntimeClaude, repositoryMonitorTestReviewerSecret),
-		repositoryMonitorControllerTestAgent("planner", corev1alpha1.AgentRuntimeClaude, repositoryMonitorTestReviewerSecret),
-		repositoryMonitorControllerTestAgent("implementer", corev1alpha1.AgentRuntimeCodex, "implementer-credentials"),
-		repositoryMonitorControllerTestAgent("repairer", corev1alpha1.AgentRuntimeCodex, "implementer-credentials"),
-		repositoryMonitorControllerTestSecret("implementer-credentials", map[string][]byte{
-			workerenv.OpenAIAPIKey: []byte("x"),
-		}),
-		repositoryMonitorControllerTestSecret(repositoryMonitorTestReviewerSecret, map[string][]byte{
-			workerenv.AnthropicAPIKey: []byte("anthropic-key"),
-		}),
+		repositoryMonitorControllerTestAgent("reviewer", corev1alpha1.AgentRuntimeClaude, ""),
+		repositoryMonitorControllerTestAgent("triager", corev1alpha1.AgentRuntimeClaude, ""),
+		repositoryMonitorControllerTestAgent("researcher", corev1alpha1.AgentRuntimeClaude, ""),
+		repositoryMonitorControllerTestAgent("planner", corev1alpha1.AgentRuntimeClaude, ""),
+		repositoryMonitorControllerTestAgent("implementer", corev1alpha1.AgentRuntimeCodex, ""),
+		repositoryMonitorControllerTestAgent("repairer", corev1alpha1.AgentRuntimeCodex, ""),
+		repositoryMonitorControllerTestSecret(repositoryMonitorTestReadCredential, map[string][]byte{repositoryMonitorTokenKey: []byte("source-read-token")}),
+		repositoryMonitorControllerTestSecret(repositoryMonitorTestPublicationReadCredential, map[string][]byte{repositoryMonitorTokenKey: []byte("target-read-token")}),
+		repositoryMonitorControllerTestSecret(repositoryMonitorTestPublicationCredential, map[string][]byte{repositoryMonitorTokenKey: []byte("target-write-token")}),
+		repositoryMonitorControllerTestSecret(repositoryMonitorTestForgeCredential, map[string][]byte{repositoryMonitorTokenKey: []byte("forge-token")}),
 	}
 	return append(defaults, objects...)
 }
 
+func configureRepositoryMonitorTestWriteCredentials(monitor *corev1alpha1.RepositoryMonitor) {
+	monitor.Spec.ReadCredentialRef = &corev1.LocalObjectReference{Name: repositoryMonitorTestReadCredential}
+	monitor.Spec.PublicationReadCredentialRef = &corev1.LocalObjectReference{Name: repositoryMonitorTestPublicationReadCredential}
+	monitor.Spec.PublicationCredentialRef = &corev1.LocalObjectReference{Name: repositoryMonitorTestPublicationCredential}
+	monitor.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: repositoryMonitorTestForgeCredential}
+}
+
 func repositoryMonitorControllerTestAgent(name string, runtimeType corev1alpha1.AgentRuntimeType, secretName string) *corev1alpha1.Agent {
 	agent := &corev1alpha1.Agent{
 		ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: "default"},
@@ -4539,6 +4569,7 @@ func TestRepositoryMonitorDecomposeActionReusesCommandWorkAction(t *testing.T) {
 	}
 }
 
+//nolint:gocyclo // This test verifies the complete read/write task-policy matrix in one flow.
 func TestRepositoryMonitorIssueActionTaskResultModes(t *testing.T) {
 	ctx := context.Background()
 	monitorStore := setupControllerSQLiteStore(t)
@@ -4552,6 +4583,7 @@ func TestRepositoryMonitorIssueActionTaskResultModes(t *testing.T) {
 	monitor, secret := repositoryMonitorInventoryTestObjects("issue-result-mode")
 	monitor.Spec.Agents.Planner = &corev1alpha1.AgentReference{Name: "planner"}
 	monitor.Spec.Agents.Implementer = &corev1alpha1.AgentReference{Name: "implementer"}
+	configureRepositoryMonitorTestWriteCredentials(monitor)
 	cl := fake.NewClientBuilder().
 		WithScheme(scheme).
 		WithStatusSubresource(&corev1alpha1.RepositoryMonitor{}).
@@ -4570,8 +4602,11 @@ func TestRepositoryMonitorIssueActionTaskResultModes(t *testing.T) {
 	if err := cl.Get(ctx, types.NamespacedName{Namespace: "default", Name: planTaskName}, &planTask); err != nil {
 		t.Fatalf("Get plan task error = %v", err)
 	}
-	if !taskEnvHasValue(planTask.Spec.Env, workerenv.ResultStdout, scheduledRunLabelValue) {
-		t.Fatalf("plan task env = %#v, want %s=true", planTask.Spec.Env, workerenv.ResultStdout)
+	if len(planTask.Spec.Env) != 0 {
+		t.Fatalf("plan task env = %#v, want ACP-safe empty env", planTask.Spec.Env)
+	}
+	if planTask.Spec.Workspace == nil || planTask.Spec.Workspace.Intent != corev1alpha1.WorkspaceIntentRead {
+		t.Fatalf("plan task workspace = %#v, want governed read intent", planTask.Spec.Workspace)
 	}
 	if planTask.Annotations[labels.AnnotationAgentReadOnly] != scheduledRunLabelValue || planTask.Annotations[labels.AnnotationWorkspaceInitContainer] != scheduledRunLabelValue {
 		t.Fatalf("plan task annotations = %#v, want hardened read-only workspace", planTask.Annotations)
@@ -4588,47 +4623,21 @@ func TestRepositoryMonitorIssueActionTaskResultModes(t *testing.T) {
 	if taskEnvHasValue(implementationTask.Spec.Env, workerenv.ResultStdout, scheduledRunLabelValue) {
 		t.Fatalf("implementation task env = %#v, did not want %s=true because workspace finalization must capture patch diffs", implementationTask.Spec.Env, workerenv.ResultStdout)
 	}
+	if implementationTask.Spec.Workspace == nil || implementationTask.Spec.Workspace.MaxChangedFiles == nil || *implementationTask.Spec.Workspace.MaxChangedFiles != 12 || !implementationTask.Spec.Workspace.DenyRepositoryControlPaths || !implementationTask.Spec.Workspace.RejectBinaryFiles || !implementationTask.Spec.Workspace.RejectSecretLikeContent {
+		t.Fatalf("implementation workspace policy = %#v, want signed monitor publication controls", implementationTask.Spec.Workspace)
+	}
 	if implementationTask.Annotations[labels.AnnotationAgentReadOnly] != "" || implementationTask.Annotations[labels.AnnotationWorkspaceInitContainer] != scheduledRunLabelValue || implementationTask.Annotations[labels.AnnotationAgentRuntimeAuthOnly] != scheduledRunLabelValue {
 		t.Fatalf("implementation task annotations = %#v, want workspace init and runtime-only credentials without read-only tools", implementationTask.Annotations)
 	}
-	if implementationTask.Spec.SecretRef == nil || implementationTask.Spec.SecretRef.Name == "implementer-credentials" || implementationTask.Annotations[repositoryMonitorIssueAnnotationRuntimeAuthFields] != workerenv.OpenAIAPIKey {
-		t.Fatalf("implementation runtime credential binding = spec=%#v annotations=%#v", implementationTask.Spec.SecretRef, implementationTask.Annotations)
-	}
-	var runtimeSnapshot corev1.Secret
-	if err := cl.Get(ctx, types.NamespacedName{Namespace: defaultNS, Name: implementationTask.Spec.SecretRef.Name}, &runtimeSnapshot); err != nil {
-		t.Fatalf("Get runtime auth snapshot error = %v", err)
-	}
-	if runtimeSnapshot.Immutable == nil || !*runtimeSnapshot.Immutable || string(runtimeSnapshot.Data[workerenv.OpenAIAPIKey]) != "x" || !metav1.IsControlledBy(&runtimeSnapshot, monitor) {
-		t.Fatalf("runtime auth snapshot = %#v, want immutable monitor-owned scoped copy", runtimeSnapshot)
+	if implementationTask.Spec.SecretRef != nil || len(implementationTask.Spec.Env) != 0 {
+		t.Fatalf("implementation runtime credentials leaked into Task spec: secretRef=%#v env=%#v", implementationTask.Spec.SecretRef, implementationTask.Spec.Env)
 	}
-	assertRepositoryMonitorRuntimeAuthMetadata(t, ctx, monitorStore, command.ID, &runtimeSnapshot)
-	if err := cl.Delete(ctx, &implementationTask); err != nil {
-		t.Fatalf("Delete implementation task error = %v", err)
-	}
-	if err := reconciler.cleanupRepositoryMonitorOrphanedRuntimeAuthSnapshots(ctx, monitor); err != nil {
-		t.Fatalf("cleanupRepositoryMonitorOrphanedRuntimeAuthSnapshots() error = %v", err)
-	}
-	if err := cl.Get(ctx, types.NamespacedName{Namespace: defaultNS, Name: runtimeSnapshot.Name}, &corev1.Secret{}); err == nil || crclient.IgnoreNotFound(err) != nil {
-		t.Fatalf("runtime auth snapshot cleanup error = %v, want deleted snapshot", err)
-	}
-}
-
-func assertRepositoryMonitorRuntimeAuthMetadata(t *testing.T, ctx context.Context, monitorStore store.RepositoryMonitorStore, commandID string, snapshot *corev1.Secret) {
-	t.Helper()
-	actionID := store.RepositoryMonitorWorkActionID(commandID, store.RepositoryMonitorDesiredActionForActionKind(repositoryMonitorIssueActionImplementation))
-	action, err := monitorStore.GetWorkAction(ctx, defaultNS, actionID)
-	if err != nil {
-		t.Fatalf("GetWorkAction(implementation) error = %v", err)
-	}
-	var metadata map[string]any
-	if err := json.Unmarshal([]byte(action.MetadataJSON), &metadata); err != nil {
-		t.Fatalf("runtime auth metadata decode error = %v", err)
-	}
-	if _, exists := metadata[repositoryMonitorRuntimeAuthMetadataLegacyDigest]; exists {
-		t.Fatalf("runtime auth metadata contains credential-derived legacy digest: %s", action.MetadataJSON)
-	}
-	if got := stringField(metadata, repositoryMonitorRuntimeAuthMetadataResourceVersion); got != snapshot.ResourceVersion {
-		t.Fatalf("runtime auth resourceVersion = %q, want %q", got, snapshot.ResourceVersion)
+	workspace := implementationTask.Spec.Workspace
+	if workspace.ReadCredentialRef == nil || workspace.ReadCredentialRef.Name != repositoryMonitorTestReadCredential ||
+		workspace.PublicationReadCredentialRef == nil || workspace.PublicationReadCredentialRef.Name != repositoryMonitorTestPublicationReadCredential ||
+		workspace.PublicationCredentialRef == nil || workspace.PublicationCredentialRef.Name != repositoryMonitorTestPublicationCredential ||
+		workspace.ForgeCredentialRef == nil || workspace.ForgeCredentialRef.Name != repositoryMonitorTestForgeCredential {
+		t.Fatalf("implementation workspace credential roles = %#v, want four explicit distinct refs", workspace)
 	}
 }
 
@@ -4644,6 +4653,7 @@ func TestRepositoryMonitorImplementationTaskCreationFailureCleansRuntimeAuthSnap
 	}
 	monitor, secret := repositoryMonitorInventoryTestObjects("implementation-create-cleanup")
 	monitor.Spec.Agents.Implementer = &corev1alpha1.AgentReference{Name: "implementer"}
+	configureRepositoryMonitorTestWriteCredentials(monitor)
 	cl := fake.NewClientBuilder().
 		WithScheme(scheme).
 		WithObjects(repositoryMonitorControllerObjects(monitor, secret)...).
@@ -4675,7 +4685,7 @@ func TestRepositoryMonitorImplementationTaskCreationFailureCleansRuntimeAuthSnap
 	}
 }
 
-func TestRepositoryMonitorImplementationTaskAmbiguousCreatePreservesSnapshot(t *testing.T) {
+func TestRepositoryMonitorImplementationTaskAmbiguousCreateReusesCredentialFreeTask(t *testing.T) {
 	ctx := context.Background()
 	monitorStore := setupControllerSQLiteStore(t)
 	scheme := runtime.NewScheme()
@@ -4687,6 +4697,7 @@ func TestRepositoryMonitorImplementationTaskAmbiguousCreatePreservesSnapshot(t *
 	}
 	monitor, secret := repositoryMonitorInventoryTestObjects("implementation-ambiguous-create")
 	monitor.Spec.Agents.Implementer = &corev1alpha1.AgentReference{Name: "implementer"}
+	configureRepositoryMonitorTestWriteCredentials(monitor)
 	cl := fake.NewClientBuilder().
 		WithScheme(scheme).
 		WithObjects(repositoryMonitorControllerObjects(monitor, secret)...).
@@ -4714,21 +4725,17 @@ func TestRepositoryMonitorImplementationTaskAmbiguousCreatePreservesSnapshot(t *
 	if err := cl.Get(ctx, types.NamespacedName{Namespace: defaultNS, Name: taskName}, &task); err != nil {
 		t.Fatalf("Get persisted task error = %v", err)
 	}
-	if task.Spec.SecretRef == nil {
-		t.Fatal("persisted task has no runtime auth snapshot reference")
-	}
-	var snapshot corev1.Secret
-	if err := cl.Get(ctx, types.NamespacedName{Namespace: defaultNS, Name: task.Spec.SecretRef.Name}, &snapshot); err != nil {
-		t.Fatalf("Get preserved snapshot error = %v", err)
+	if task.Spec.SecretRef != nil || task.Spec.Workspace == nil || task.Spec.Workspace.ReadCredentialRef == nil || task.Spec.Workspace.ReadCredentialRef.Name != repositoryMonitorTestReadCredential {
+		t.Fatalf("persisted task credential boundary = secretRef=%#v workspace=%#v, want credential-free Task with source-read ref", task.Spec.SecretRef, task.Spec.Workspace)
 	}
 	var source corev1.Secret
-	if err := cl.Get(ctx, types.NamespacedName{Namespace: defaultNS, Name: "implementer-credentials"}, &source); err != nil {
-		t.Fatalf("Get source runtime config error = %v", err)
+	if err := cl.Get(ctx, types.NamespacedName{Namespace: defaultNS, Name: repositoryMonitorTestReadCredential}, &source); err != nil {
+		t.Fatalf("Get source-read credential error = %v", err)
 	}
 	source.Immutable = nil
-	source.Data[workerenv.OpenAIAPIKey] = []byte("rotated-value")
+	source.Data[repositoryMonitorTokenKey] = []byte("rotated-source-read-token")
 	if err := cl.Update(ctx, &source); err != nil {
-		t.Fatalf("Update source runtime config error = %v", err)
+		t.Fatalf("Update source-read credential error = %v", err)
 	}
 	recoveredName, recoveredCreated, err := reconciler.createRepositoryMonitorIssueActionTask(ctx, monitor, run, command, item, "orka-agents", "orka", repositoryMonitorIssueActionImplementation, repositoryMonitorIssuePhaseImplementationQueued, monitor.Spec.Agents.Implementer)
 	if err != nil || recoveredCreated || recoveredName != taskName {
@@ -4736,33 +4743,28 @@ func TestRepositoryMonitorImplementationTaskAmbiguousCreatePreservesSnapshot(t *
 	}
 }
 
-func TestRepositoryMonitorRejectsMismatchedPreexistingRuntimeAuthSnapshot(t *testing.T) {
-	ctx := context.Background()
-	scheme := runtime.NewScheme()
-	if err := corev1alpha1.AddToScheme(scheme); err != nil {
-		t.Fatalf("AddToScheme() error = %v", err)
+func TestRepositoryMonitorWriteCredentialsRequireExplicitDistinctRoleRefs(t *testing.T) {
+	monitor := &corev1alpha1.RepositoryMonitor{}
+	monitor.Spec.GitSecretRef = &corev1.LocalObjectReference{Name: "legacy-read"}
+	monitor.Spec.PublicationReadCredentialRef = &corev1.LocalObjectReference{Name: "target-read"}
+	monitor.Spec.PublicationCredentialRef = &corev1.LocalObjectReference{Name: "target-write"}
+	monitor.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: "forge"}
+
+	if _, err := repositoryMonitorCredentialRefsForWrite(monitor); err == nil || !strings.Contains(err.Error(), "spec.readCredentialRef") {
+		t.Fatalf("legacy-only source read error = %v, want explicit readCredentialRef requirement", err)
 	}
-	if err := corev1.AddToScheme(scheme); err != nil {
-		t.Fatalf("corev1 AddToScheme() error = %v", err)
+	monitor.Spec.ReadCredentialRef = &corev1.LocalObjectReference{Name: "source-read"}
+	monitor.Spec.PublicationCredentialRef = &corev1.LocalObjectReference{Name: "target-read"}
+	if _, err := repositoryMonitorCredentialRefsForWrite(monitor); err == nil || !strings.Contains(err.Error(), "distinct Secrets") {
+		t.Fatalf("duplicate role error = %v, want distinct Secret rejection", err)
 	}
-	monitor := &corev1alpha1.RepositoryMonitor{TypeMeta: metav1.TypeMeta{APIVersion: corev1alpha1.GroupVersion.String(), Kind: "RepositoryMonitor"}, ObjectMeta: metav1.ObjectMeta{Name: "snapshot-spoof", Namespace: defaultNS, UID: "uid-snapshot-spoof"}}
-	ref := &corev1alpha1.AgentReference{Name: "implementer"}
-	agent := repositoryMonitorControllerTestAgent("implementer", corev1alpha1.AgentRuntimeCodex, "source-runtime")
-	source := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "source-runtime", Namespace: defaultNS, UID: "uid-source-runtime"}, Data: map[string][]byte{workerenv.OpenAIAPIKey: []byte("expected-value")}}
-	taskName := "impl-spoofed-snapshot"
-	snapshotName := repositoryMonitorBoundedDNSName(taskName+"-runtime-auth", 63)
-	controller := true
-	immutable := true
-	spoofed := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{
-		Name: snapshotName, Namespace: defaultNS,
-		Labels:          map[string]string{labels.LabelManaged: scheduledRunLabelValue, labels.LabelCreatedBy: "repository-monitor", labels.LabelRepositoryMonitor: labels.SelectorValue(monitor.Name)},
-		Annotations:     map[string]string{repositoryMonitorIssueAnnotationRuntimeAuthTask: taskName, repositoryMonitorIssueAnnotationRuntimeAuthSourceUID: string(source.UID)},
-		OwnerReferences: []metav1.OwnerReference{{APIVersion: corev1alpha1.GroupVersion.String(), Kind: "RepositoryMonitor", Name: monitor.Name, UID: monitor.UID, Controller: &controller}},
-	}, Data: map[string][]byte{workerenv.OpenAIAPIKey: []byte("attacker-value"), workerenv.OpenAIBaseURL: []byte("https://example.invalid/v1")}, Immutable: &immutable}
-	cl := fake.NewClientBuilder().WithScheme(scheme).WithObjects(monitor, agent, source, spoofed).Build()
-	reconciler := &RepositoryMonitorReconciler{Client: cl, Scheme: scheme}
-	if _, err := reconciler.repositoryMonitorImplementationRuntimeCredentialBinding(ctx, monitor, taskName, ref); !errors.Is(err, errRepositoryMonitorRuntimeAuthBindingInvalid) {
-		t.Fatalf("binding error = %v, want mismatched snapshot rejection", err)
+	monitor.Spec.PublicationCredentialRef = &corev1.LocalObjectReference{Name: "target-write"}
+	refs, err := repositoryMonitorCredentialRefsForWrite(monitor)
+	if err != nil {
+		t.Fatalf("repositoryMonitorCredentialRefsForWrite() error = %v", err)
+	}
+	if localObjectReferenceName(refs.read) != "source-read" || localObjectReferenceName(refs.publicationRead) != "target-read" || localObjectReferenceName(refs.publication) != "target-write" || localObjectReferenceName(refs.forge) != "forge" {
+		t.Fatalf("resolved write refs = %#v, want four explicit roles", refs)
 	}
 }
 
@@ -4977,6 +4979,7 @@ func TestRepositoryMonitorIssueImplementToPRFakeGitHubE2E(t *testing.T) {
 	monitor.Spec.Targets.PullRequests.Enabled = &pullRequestsEnabled
 	monitor.Spec.Targets.Issues.Enabled = true
 	monitor.Spec.Agents.Implementer = &corev1alpha1.AgentReference{Name: "implementer"}
+	configureRepositoryMonitorTestWriteCredentials(monitor)
 	monitor.Spec.IssueWorkflow.Implementation.RequireApprovedPlan = &requireApprovedPlan
 	cl := fake.NewClientBuilder().
 		WithScheme(scheme).
@@ -5013,7 +5016,6 @@ func TestRepositoryMonitorIssueImplementToPRFakeGitHubE2E(t *testing.T) {
 	}
 
 	implTaskName := item.LastActionTaskName
-	implementationDiff := "diff --git a/internal/health.go b/internal/health.go\n--- a/internal/health.go\n+++ b/internal/health.go\n@@ -1 +1 @@\n-old\n+new\n"
 	agentResult, _ := json.Marshal(map[string]any{
 		"schemaVersion":  "orka.issueImplementation.v1",
 		"repo":           "orka-agents/orka",
@@ -5022,68 +5024,34 @@ func TestRepositoryMonitorIssueImplementToPRFakeGitHubE2E(t *testing.T) {
 		"status":         "patch_ready",
 		"summary":        "Implemented fake health endpoint.",
 	})
-	implBytes, _ := common.FormatStructuredResult(&common.StructuredResult{
-		Summary: string(agentResult),
-		BaseSHA: "base77",
-		HeadSHA: "base77",
-		Diff:    implementationDiff,
-		Files:   []string{"internal/health.go"},
-	})
+	implBytes, _ := common.FormatStructuredResult(&common.StructuredResult{Summary: string(agentResult)})
 	if err := monitorStore.SaveResult(ctx, "default", implTaskName, implBytes); err != nil {
 		t.Fatalf("SaveResult(implementation) error = %v", err)
 	}
-	markRepositoryMonitorTestTaskSucceeded(t, ctx, cl, implTaskName)
-
-	if _, err := reconciler.Reconcile(ctx, ctrl.Request{NamespacedName: types.NamespacedName{Namespace: "default", Name: monitor.Name}}); err != nil {
-		t.Fatalf("Reconcile(implementation ingest) error = %v", err)
-	}
-	item, err = monitorStore.GetMonitorItem(ctx, "default", monitor.Name, repositoryMonitorIssueKind, "77")
-	if err != nil {
-		t.Fatalf("GetMonitorItem(after implementation ingest) error = %v", err)
-	}
-	if item.WorkflowPhase != repositoryMonitorIssuePhaseMutationQueued || item.LastActionTaskName == "" || item.LastActionTaskName == implTaskName {
-		t.Fatalf("item after mutation queue = %#v, want mutation queued with new task", item)
-	}
-	mutationTaskName := item.LastActionTaskName
-	var mutationTask corev1alpha1.Task
-	if err := cl.Get(ctx, types.NamespacedName{Namespace: "default", Name: mutationTaskName}, &mutationTask); err != nil {
-		t.Fatalf("Get mutation task() error = %v", err)
-	}
-	branch := repositoryMonitorIssueTaskPushBranch(&mutationTask)
-	if branch == "" {
-		t.Fatalf("mutation task workspace = %#v, want push branch", mutationTask.Spec.AgentRuntime)
-	}
-
-	if mutationTask.Spec.Type != corev1alpha1.TaskTypeContainer || mutationTask.Spec.AgentRef != nil || mutationTask.Spec.Image != "" || len(mutationTask.Spec.Command) != 1 || mutationTask.Spec.Command[0] != scheduledRunLabelValue {
-		t.Fatalf("mutation task spec = %#v, want deterministic trusted general-worker container", mutationTask.Spec)
-	}
-	if mutationTask.Spec.Workspace == nil || mutationTask.Spec.AgentRuntime != nil || mutationTask.Spec.PriorTaskRef == nil || mutationTask.Spec.PriorTaskRef.Name != implTaskName {
-		t.Fatalf("mutation task workspace/prior task = %#v, want validated implementation replay", mutationTask.Spec)
-	}
-	if !taskEnvHasValue(mutationTask.Spec.Env, workerenv.PriorTaskDiffSHA256, repositoryMonitorIssuePatchDigest(implementationDiff)) {
-		t.Fatalf("mutation task env = %#v, want validated diff digest", mutationTask.Spec.Env)
+	var implementationTask corev1alpha1.Task
+	if err := cl.Get(ctx, types.NamespacedName{Namespace: "default", Name: implTaskName}, &implementationTask); err != nil {
+		t.Fatal(err)
 	}
-	mutationBytes, _ := common.FormatStructuredResult(&common.StructuredResult{
-		Summary:    "Pushed validated implementation branch.",
-		BaseSHA:    "base77",
-		HeadSHA:    "head77",
-		Diff:       implementationDiff,
-		Files:      []string{"internal/health.go"},
-		PushBranch: branch,
-	})
-	if err := monitorStore.SaveResult(ctx, "default", mutationTaskName, mutationBytes); err != nil {
-		t.Fatalf("SaveResult(mutation) error = %v", err)
+	branch := repositoryMonitorIssueTaskPushBranch(&implementationTask)
+	if implementationTask.Spec.SessionRef == nil || implementationTask.Spec.SessionRef.Name != repositoryMonitorPublicationSessionName(monitor, branch) || implementationTask.Spec.SessionRef.Append {
+		t.Fatalf("implementation task session = %#v, want stable branch owner", implementationTask.Spec.SessionRef)
 	}
-	markRepositoryMonitorTestTaskSucceeded(t, ctx, cl, mutationTaskName)
+	markRepositoryMonitorTestTaskDelivered(t, ctx, cl, implTaskName, branch, "head77")
 
 	if _, err := reconciler.Reconcile(ctx, ctrl.Request{NamespacedName: types.NamespacedName{Namespace: "default", Name: monitor.Name}}); err != nil {
-		t.Fatalf("Reconcile(mutation ingest) error = %v", err)
+		t.Fatalf("Reconcile(ACP implementation delivery ingest) error = %v", err)
 	}
 	if !createdPR {
 		t.Fatal("fake GitHub create PR endpoint was not called")
 	}
+	for attempt := 0; attempt < 3 && !createdStatusComment; attempt++ {
+		if _, err := reconciler.Reconcile(ctx, ctrl.Request{NamespacedName: types.NamespacedName{Namespace: "default", Name: monitor.Name}}); err != nil {
+			t.Fatalf("Reconcile(status projection) error = %v", err)
+		}
+	}
 	if !createdStatusComment {
-		t.Fatal("fake GitHub issue status comment endpoint was not called")
+		current, _ := monitorStore.GetMonitorItem(ctx, "default", monitor.Name, repositoryMonitorIssueKind, "77")
+		t.Fatalf("fake GitHub issue status comment endpoint was not called; item=%#v", current)
 	}
 	item, err = monitorStore.GetMonitorItem(ctx, "default", monitor.Name, repositoryMonitorIssueKind, "77")
 	if err != nil {
@@ -5103,21 +5071,12 @@ func TestRepositoryMonitorIssueImplementToPRFakeGitHubE2E(t *testing.T) {
 	if err != nil {
 		t.Fatalf("ListImplementationJobs(final) error = %v", err)
 	}
-	if len(jobs) != 1 || jobs[0].Phase != repositoryMonitorIssuePhasePROpened || jobs[0].PRNumber != 177 || jobs[0].PatchArtifactID == "" {
-		t.Fatalf("implementation job final = %#v, want pr_opened with PR and patch artifact", jobs)
-	}
-	artifacts, err := monitorStore.ListArtifacts(ctx, "default", implTaskName)
-	if err != nil {
-		t.Fatalf("ListArtifacts() error = %v", err)
-	}
-	foundPatchSummary := false
-	for _, artifact := range artifacts {
-		if strings.HasSuffix(artifact.Filename, ".json") {
-			foundPatchSummary = true
-		}
+	if len(jobs) != 1 || jobs[0].Phase != repositoryMonitorIssuePhasePROpened || jobs[0].PRNumber != 177 || jobs[0].Branch != branch || jobs[0].PatchArtifactID == "" {
+		t.Fatalf("implementation job final = %#v, want direct ACP delivery on branch %q with summary artifact", jobs, branch)
 	}
-	if !foundPatchSummary {
-		t.Fatalf("artifacts = %#v, want patch summary artifact", artifacts)
+	artifact, contentType, err := monitorStore.GetArtifact(ctx, "default", implTaskName, jobs[0].PatchArtifactID)
+	if err != nil || contentType != "application/json" || !strings.Contains(string(artifact), "orka.issueImplementation.delivery.v1") {
+		t.Fatalf("delivery summary artifact = %q, %q, %v", artifact, contentType, err)
 	}
 }
 
@@ -5373,6 +5332,7 @@ func TestRepositoryMonitorIssueImplementContinuesAfterAutoApprovedPlan(t *testin
 	monitor.Spec.Targets.Issues.Enabled = true
 	monitor.Spec.Agents.Planner = &corev1alpha1.AgentReference{Name: "planner"}
 	monitor.Spec.Agents.Implementer = &corev1alpha1.AgentReference{Name: "implementer"}
+	configureRepositoryMonitorTestWriteCredentials(monitor)
 	monitor.Spec.IssueWorkflow.Implementation.RequireApprovedPlan = &requireApprovedPlan
 	cl := fake.NewClientBuilder().
 		WithScheme(scheme).
@@ -5449,6 +5409,38 @@ func markRepositoryMonitorTestTaskSucceeded(t *testing.T, ctx context.Context, c
 	}
 }
 
+func markRepositoryMonitorTestTaskDelivered(t *testing.T, ctx context.Context, cl crclient.Client, name, branch, headSHA string) {
+	t.Helper()
+	task := corev1alpha1.Task{}
+	if err := cl.Get(ctx, types.NamespacedName{Namespace: "default", Name: name}, &task); err != nil {
+		t.Fatalf("Get(%q) error = %v", name, err)
+	}
+	task.Status.Phase = corev1alpha1.TaskPhaseSucceeded
+	task.Status.ResultRef = &corev1alpha1.ResultReference{Available: true}
+	owner, repository, err := security.ParseGitHubRepositoryURL(task.Spec.Workspace.PublicationGitRepo)
+	if err != nil {
+		t.Fatalf("parse publication repository for %q: %v", name, err)
+	}
+	remoteBeforeSHA := task.Spec.Workspace.ExpectedRemoteSHA
+	task.Status.Delivery = &corev1alpha1.TaskDeliveryStatus{
+		State:         corev1alpha1.TaskDeliveryStateVerifiedExact,
+		Outcome:       corev1alpha1.TaskDeliveryOutcomeVerifiedExact,
+		PublicationID: "publication-" + name,
+		PublicationRepository: &corev1alpha1.RepositoryIdentity{
+			Provider: "github",
+			ID:       "github.com/" + owner + "/" + repository,
+		},
+		Branch:            branch,
+		RemoteBeforeSHA:   &remoteBeforeSHA,
+		ExpectedCommitSHA: headSHA,
+		VerifiedRemoteSHA: headSHA,
+		ArtifactDigest:    "sha256:" + strings.Repeat("a", 64),
+	}
+	if err := cl.Status().Update(ctx, &task); err != nil {
+		t.Fatalf("Status().Update(%q) error = %v", name, err)
+	}
+}
+
 func repositoryMonitorTestHasMutation(records []store.GitHubMutationRecord, operation string) bool {
 	for _, record := range records {
 		if record.Operation == operation && record.Status == "succeeded" {
@@ -5468,11 +5460,12 @@ func TestRepositoryMonitorPullRequestFixCommandQueuesRepairTask(t *testing.T) {
 	if err := corev1.AddToScheme(scheme); err != nil {
 		t.Fatalf("corev1 AddToScheme() error = %v", err)
 	}
-	server := newRepositoryMonitorSinglePullRequestServerWithBody(t, 31, `{"number":31,"title":"Fix me","state":"open","draft":false,"mergeable_state":"clean","user":{"login":"alice"},"base":{"ref":"main","sha":"base31","repo":{"full_name":"orka-agents/orka","clone_url":"https://github.com/orka-agents/orka.git"}},"head":{"ref":"feature-fix","sha":"head31","repo":{"full_name":"orka-agents/orka","clone_url":"https://github.com/orka-agents/orka.git"}},"labels":[]}`)
+	server := newRepositoryMonitorSinglePullRequestServerWithBodyAndAuth(t, 31, `{"number":31,"title":"Fix me","state":"open","draft":false,"mergeable_state":"clean","user":{"login":"alice"},"base":{"ref":"main","sha":"base31","repo":{"full_name":"orka-agents/orka","clone_url":"https://github.com/orka-agents/orka.git"}},"head":{"ref":"feature-fix","sha":"head31","repo":{"full_name":"orka-agents/orka","clone_url":"https://github.com/orka-agents/orka.git"}},"labels":[]}`, "Bearer forge-token")
 	t.Cleanup(server.Close)
 	monitor, secret := repositoryMonitorInventoryTestObjects("pr-fix")
 	monitor.Spec.Agents.Repairer = &corev1alpha1.AgentReference{Name: "repairer"}
 	monitor.Spec.Repair.Enabled = true
+	configureRepositoryMonitorTestWriteCredentials(monitor)
 	cl := fake.NewClientBuilder().
 		WithScheme(scheme).
 		WithStatusSubresource(&corev1alpha1.RepositoryMonitor{}).
@@ -5508,8 +5501,11 @@ func TestRepositoryMonitorPullRequestFixCommandQueuesRepairTask(t *testing.T) {
 	if err := cl.Get(ctx, types.NamespacedName{Namespace: "default", Name: jobs[0].TaskName}, &task); err != nil {
 		t.Fatalf("Get repair task() error = %v", err)
 	}
-	if task.Spec.AgentRef == nil || task.Spec.AgentRef.Name != "repairer" || task.Spec.AgentRuntime == nil || task.Spec.AgentRuntime.Workspace == nil || task.Spec.AgentRuntime.Workspace.PushBranch != "feature-fix" {
-		t.Fatalf("repair task spec = %#v, want repairer push to feature branch", task.Spec)
+	if task.Spec.AgentRef == nil || task.Spec.AgentRef.Name != "repairer" || task.Spec.Workspace == nil || task.Spec.Workspace.PushBranch != "feature-fix" || task.Spec.Workspace.ExpectedRemoteSHA != "head31" {
+		t.Fatalf("repair task spec = %#v, want exact-head repair publication", task.Spec)
+	}
+	if task.Spec.SessionRef == nil || !task.Spec.SessionRef.Create || task.Spec.SessionRef.Append || task.Spec.SessionRef.Name != repositoryMonitorPublicationSessionName(monitor, "feature-fix") {
+		t.Fatalf("repair task session = %#v, want stable non-appending branch owner", task.Spec.SessionRef)
 	}
 }
 
@@ -5526,6 +5522,7 @@ func TestRepositoryMonitorRepairTaskCreationRetryRestoresQueuedJob(t *testing.T)
 	monitor, _ := repositoryMonitorInventoryTestObjects("repair-create-retry")
 	monitor.Spec.Repair.Enabled = true
 	monitor.Spec.Agents.Repairer = &corev1alpha1.AgentReference{Name: "repairer"}
+	configureRepositoryMonitorTestWriteCredentials(monitor)
 	failTaskCreate := true
 	cl := fake.NewClientBuilder().
 		WithScheme(scheme).
@@ -5607,6 +5604,7 @@ func TestRepositoryMonitorIssueStopPreventsLateImplementationMutation(t *testing
 	monitor.Spec.Targets.PullRequests.Enabled = &pullRequestsEnabled
 	monitor.Spec.Targets.Issues.Enabled = true
 	monitor.Spec.Agents.Implementer = &corev1alpha1.AgentReference{Name: "implementer"}
+	configureRepositoryMonitorTestWriteCredentials(monitor)
 	monitor.Spec.IssueWorkflow.Implementation.RequireApprovedPlan = &requireApprovedPlan
 	cl := fake.NewClientBuilder().
 		WithScheme(scheme).
@@ -5772,6 +5770,7 @@ func TestRepositoryMonitorPRReviewRepairReadinessAutomergeFakeGitHubE2E(t *testi
 
 	monitor, secret := repositoryMonitorInventoryTestObjects("pr-review-repair-e2e")
 	monitor.Spec.Agents.Repairer = &corev1alpha1.AgentReference{Name: "repairer"}
+	configureRepositoryMonitorTestWriteCredentials(monitor)
 	monitor.Spec.Repair.Enabled = true
 	monitor.Spec.Automerge.Enabled = true
 	globalGate := false
@@ -5836,11 +5835,11 @@ func TestRepositoryMonitorPRReviewRepairReadinessAutomergeFakeGitHubE2E(t *testi
 		t.Fatalf("repairs = %#v, want queued repair", repairs)
 	}
 	repairTaskName := repairs[0].TaskName
-	repairResult, _ := common.FormatStructuredResult(&common.StructuredResult{Summary: "fixed review finding", HeadSHA: "head88-fixed", PushBranch: "feature-repair", Files: []string{"internal/example.go"}})
+	repairResult, _ := common.FormatStructuredResult(&common.StructuredResult{Summary: "fixed review finding"})
 	if err := monitorStore.SaveResult(ctx, "default", repairTaskName, repairResult); err != nil {
 		t.Fatalf("SaveResult(repair) error = %v", err)
 	}
-	markRepositoryMonitorTestTaskSucceeded(t, ctx, cl, repairTaskName)
+	markRepositoryMonitorTestTaskDelivered(t, ctx, cl, repairTaskName, "feature-repair", "head88-repaired")
 	if _, err := reconciler.Reconcile(ctx, ctrl.Request{NamespacedName: types.NamespacedName{Namespace: "default", Name: monitor.Name}}); err != nil {
 		t.Fatalf("Reconcile(ingest repair) error = %v", err)
 	}
@@ -5980,8 +5979,8 @@ func TestRepositoryMonitorPullRequestAutomergeCommandMergesWhenGatesPass(t *test
 	merged := false
 	sawStartedAudit := false
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if got := r.Header.Get("Authorization"); got != repositoryMonitorTestBearerHeader() {
-			t.Fatalf("Authorization header = %q, want %q", got, repositoryMonitorTestBearerHeader())
+		if got := r.Header.Get("Authorization"); got != "Bearer forge-token" {
+			t.Fatalf("Authorization header = %q, want forge credential", got)
 		}
 		w.Header().Set("Content-Type", "application/json")
 		switch {
@@ -6007,6 +6006,7 @@ func TestRepositoryMonitorPullRequestAutomergeCommandMergesWhenGatesPass(t *test
 	monitor, secret := repositoryMonitorInventoryTestObjects("pr-automerge")
 	globalGate := false
 	monitor.Spec.Automerge.Enabled = true
+	monitor.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: repositoryMonitorTestForgeCredential}
 	monitor.Spec.Automerge.RequireGlobalMergeGate = &globalGate
 	monitor.Spec.Automerge.AllowedMergeMethods = []string{"squash"}
 	cl := fake.NewClientBuilder().
@@ -6149,6 +6149,7 @@ func TestRepositoryMonitorAutomergeTransientMergeErrorPropagates(t *testing.T) {
 	monitor, secret := repositoryMonitorInventoryTestObjects("automerge-transient")
 	globalGate := false
 	monitor.Spec.Automerge.Enabled = true
+	monitor.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: repositoryMonitorTestForgeCredential}
 	monitor.Spec.Automerge.RequireGlobalMergeGate = &globalGate
 	cl := fake.NewClientBuilder().WithScheme(scheme).WithObjects(repositoryMonitorControllerObjects(monitor, secret)...).Build()
 	reconciler := &RepositoryMonitorReconciler{Client: cl, Scheme: scheme, Store: monitorStore, GitHubAPIBaseURL: server.URL}
@@ -6244,6 +6245,7 @@ func TestRepositoryMonitorAutomergeAmbiguousMergeErrorRemainsRetryable(t *testin
 	monitor, secret := repositoryMonitorInventoryTestObjects("automerge-permanent")
 	globalGate := false
 	monitor.Spec.Automerge.Enabled = true
+	monitor.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: repositoryMonitorTestForgeCredential}
 	monitor.Spec.Automerge.RequireGlobalMergeGate = &globalGate
 	cl := fake.NewClientBuilder().WithScheme(scheme).WithObjects(repositoryMonitorControllerObjects(monitor, secret)...).Build()
 	reconciler := &RepositoryMonitorReconciler{Client: cl, Scheme: scheme, Store: monitorStore, GitHubAPIBaseURL: server.URL}
@@ -7188,6 +7190,33 @@ func TestRepositoryMonitorValidationRejectsCodexPlanner(t *testing.T) {
 	}
 }
 
+func TestRepositoryMonitorValidationAllowsOpenCodeIssueReadOnlyRolesWithoutSecret(t *testing.T) {
+	ctx := context.Background()
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatalf("AddToScheme() error = %v", err)
+	}
+	for _, role := range []string{"triager", "researcher", "planner"} {
+		t.Run(role, func(t *testing.T) {
+			agent := &corev1alpha1.Agent{
+				ObjectMeta: metav1.ObjectMeta{Name: role, Namespace: "default"},
+				Spec: corev1alpha1.AgentSpec{
+					Model:   testOpenCodeModelConfig(),
+					Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeOpencode},
+				},
+			}
+			monitor := &corev1alpha1.RepositoryMonitor{ObjectMeta: metav1.ObjectMeta{Name: role + "-monitor", Namespace: "default"}}
+			reconciler := &RepositoryMonitorReconciler{Client: fake.NewClientBuilder().WithScheme(scheme).WithObjects(agent).Build()}
+			reason, message, err := reconciler.validateRepositoryMonitorIssueReadOnlyAgent(
+				ctx, monitor, role, &corev1alpha1.AgentReference{Name: role},
+			)
+			if err != nil || reason != "" || message != "" {
+				t.Fatalf("validation reason=%q message=%q err=%v", reason, message, err)
+			}
+		})
+	}
+}
+
 func TestRepositoryMonitorPlanApprovalContinuesOriginalImplementCommand(t *testing.T) {
 	ctx := context.Background()
 	monitorStore := setupControllerSQLiteStore(t)
@@ -7341,69 +7370,44 @@ func TestRepositoryMonitorValidationRejectsCopilotImplementer(t *testing.T) {
 	}
 }
 
-func TestRepositoryMonitorValidationRejectsFoundryImplementer(t *testing.T) {
+func TestRepositoryMonitorValidationRejectsBuiltInImplementerSecretRef(t *testing.T) {
 	ctx := context.Background()
 	scheme := runtime.NewScheme()
 	if err := corev1alpha1.AddToScheme(scheme); err != nil {
 		t.Fatalf("AddToScheme() error = %v", err)
 	}
-	if err := corev1.AddToScheme(scheme); err != nil {
-		t.Fatalf("corev1 AddToScheme() error = %v", err)
-	}
 	pullRequestsEnabled := false
-	monitor := &corev1alpha1.RepositoryMonitor{ObjectMeta: metav1.ObjectMeta{Name: "foundry-implementer", Namespace: defaultNS}}
+	monitor := &corev1alpha1.RepositoryMonitor{ObjectMeta: metav1.ObjectMeta{Name: "secret-ref-implementer", Namespace: defaultNS}}
 	monitor.Spec.Targets.PullRequests.Enabled = &pullRequestsEnabled
 	monitor.Spec.Targets.Issues.Enabled = true
 	monitor.Spec.Agents.Implementer = &corev1alpha1.AgentReference{Name: "implementer"}
-	agent := repositoryMonitorControllerTestAgent("implementer", corev1alpha1.AgentRuntimeClaude, "foundry-runtime")
-	secret := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "foundry-runtime", Namespace: defaultNS}, Data: map[string][]byte{
-		workerenv.AnthropicAPIKey: []byte("direct-value"),
-		"CLAUDE_CODE_USE_FOUNDRY": []byte("1"),
-	}}
-	cl := fake.NewClientBuilder().WithScheme(scheme).WithObjects(agent, secret).Build()
+	agent := repositoryMonitorControllerTestAgent("implementer", corev1alpha1.AgentRuntimeClaude, "provider-runtime")
+	cl := fake.NewClientBuilder().WithScheme(scheme).WithObjects(agent).Build()
 	reconciler := &RepositoryMonitorReconciler{Client: cl}
 	reason, message, err := reconciler.validateRepositoryMonitorImplementerAgent(ctx, monitor)
-	if err != nil || reason != repositoryMonitorReasonImplementerAuthInvalid || !strings.Contains(message, "cannot use Azure AI Foundry") {
+	if err != nil || reason != repositoryMonitorReasonImplementerAuthInvalid || !strings.Contains(message, "must omit spec.secretRef") {
 		t.Fatalf("validation reason=%q message=%q err=%v", reason, message, err)
 	}
 }
 
-func TestRepositoryMonitorMutableImplementerCredentialCreatesImmutableTaskSnapshot(t *testing.T) {
+func TestRepositoryMonitorValidationAllowsCredentialFreeImplementer(t *testing.T) {
 	ctx := context.Background()
 	scheme := runtime.NewScheme()
 	if err := corev1alpha1.AddToScheme(scheme); err != nil {
 		t.Fatalf("AddToScheme() error = %v", err)
 	}
-	if err := corev1.AddToScheme(scheme); err != nil {
-		t.Fatalf("corev1 AddToScheme() error = %v", err)
-	}
 	pullRequestsEnabled := false
-	monitor := &corev1alpha1.RepositoryMonitor{ObjectMeta: metav1.ObjectMeta{Name: "mutable-implementer", Namespace: defaultNS}}
+	monitor := &corev1alpha1.RepositoryMonitor{ObjectMeta: metav1.ObjectMeta{Name: "credential-free-implementer", Namespace: defaultNS}}
 	monitor.Spec.Targets.PullRequests.Enabled = &pullRequestsEnabled
 	monitor.Spec.Targets.Issues.Enabled = true
 	monitor.Spec.Agents.Implementer = &corev1alpha1.AgentReference{Name: "implementer"}
-	agent := repositoryMonitorControllerTestAgent("implementer", corev1alpha1.AgentRuntimeCodex, "mutable-runtime")
-	secret := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "mutable-runtime", Namespace: defaultNS}, Data: map[string][]byte{workerenv.OpenAIAPIKey: []byte("credential")}}
-	cl := fake.NewClientBuilder().WithScheme(scheme).WithObjects(agent, secret).Build()
-	reconciler := &RepositoryMonitorReconciler{Client: cl, Scheme: scheme}
+	agent := repositoryMonitorControllerTestAgent("implementer", corev1alpha1.AgentRuntimeCodex, "")
+	cl := fake.NewClientBuilder().WithScheme(scheme).WithObjects(agent).Build()
+	reconciler := &RepositoryMonitorReconciler{Client: cl}
 	reason, message, err := reconciler.validateRepositoryMonitorImplementerAgent(ctx, monitor)
 	if err != nil || reason != "" || message != "" {
 		t.Fatalf("validation reason=%q message=%q err=%v", reason, message, err)
 	}
-	binding, err := reconciler.repositoryMonitorImplementationRuntimeCredentialBinding(ctx, monitor, "impl-mutable-source", monitor.Spec.Agents.Implementer)
-	if err != nil {
-		t.Fatalf("repositoryMonitorImplementationRuntimeCredentialBinding() error = %v", err)
-	}
-	if binding.authRef == nil || binding.authRef.Name == secret.Name {
-		t.Fatalf("binding = %#v, want per-task snapshot", binding)
-	}
-	var snapshot corev1.Secret
-	if err := cl.Get(ctx, types.NamespacedName{Namespace: defaultNS, Name: binding.authRef.Name}, &snapshot); err != nil {
-		t.Fatalf("Get snapshot error = %v", err)
-	}
-	if snapshot.Immutable == nil || !*snapshot.Immutable || string(snapshot.Data[workerenv.OpenAIAPIKey]) != "credential" || !metav1.IsControlledBy(&snapshot, monitor) {
-		t.Fatalf("snapshot = %#v, want immutable monitor-owned copy", snapshot)
-	}
 }
 
 func TestRepositoryMonitorValidationRejectsRuntimeRefImplementer(t *testing.T) {
@@ -7545,6 +7549,7 @@ func TestRepositoryMonitorIssueStatusCommentRecreatesDeletedComment(t *testing.T
 		t.Fatalf("corev1 AddToScheme() error = %v", err)
 	}
 	monitor, gitSecret := repositoryMonitorInventoryTestObjects("comment-recovery")
+	monitor.Spec.ForgeCredentialRef = &corev1.LocalObjectReference{Name: repositoryMonitorTestForgeCredential}
 	patchCalls := 0
 	postCalls := 0
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -7562,7 +7567,8 @@ func TestRepositoryMonitorIssueStatusCommentRecreatesDeletedComment(t *testing.T
 		}
 	}))
 	t.Cleanup(server.Close)
-	cl := fake.NewClientBuilder().WithScheme(scheme).WithObjects(gitSecret).Build()
+	forgeSecret := repositoryMonitorControllerTestSecret(repositoryMonitorTestForgeCredential, map[string][]byte{repositoryMonitorTokenKey: []byte("forge-token")})
+	cl := fake.NewClientBuilder().WithScheme(scheme).WithObjects(gitSecret, forgeSecret).Build()
 	reconciler := &RepositoryMonitorReconciler{Client: cl, Store: monitorStore, GitHubAPIBaseURL: server.URL}
 	item := &store.MonitorItem{MonitorNamespace: "default", MonitorName: monitor.Name, Kind: repositoryMonitorIssueKind, ItemKey: "44", Number: 44, State: "open", SnapshotDigest: "sha256:test", WorkflowPhase: repositoryMonitorIssuePhaseApprovalRequired, StatusCommentID: "deleted", StatusCommentURL: "https://example.test/deleted"}
 	if err := monitorStore.UpsertMonitorItem(ctx, item); err != nil {
@@ -7576,3 +7582,28 @@ func TestRepositoryMonitorIssueStatusCommentRecreatesDeletedComment(t *testing.T
 		t.Fatalf("patch=%d post=%d item=%#v, want one recovery create", patchCalls, postCalls, item)
 	}
 }
+
+func TestRepositoryMonitorUpdateBranchNoChangeVerifiesBaseAncestry(t *testing.T) {
+	ctx := context.Background()
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/repos/orka-agents/orka/compare/base-sha...head-sha" {
+			t.Fatalf("unexpected compare path %s", r.URL.Path)
+		}
+		if !strings.HasPrefix(r.Header.Get("Authorization"), "Bearer ") {
+			t.Fatal("missing compare authorization")
+		}
+		_, _ = w.Write([]byte(`{"status":"ahead"}`))
+	}))
+	defer server.Close()
+
+	scheme := runtime.NewScheme()
+	_ = corev1alpha1.AddToScheme(scheme)
+	_ = corev1.AddToScheme(scheme)
+	monitor, secret := repositoryMonitorInventoryTestObjects("update-branch-no-change")
+	client := fake.NewClientBuilder().WithScheme(scheme).WithObjects(monitor, secret).Build()
+	reconciler := &RepositoryMonitorReconciler{Client: client, GitHubAPIBaseURL: server.URL, HTTPClient: server.Client()}
+	ok, err := reconciler.repositoryMonitorHeadContainsBase(ctx, monitor, &store.RepairJob{Repo: "orka-agents/orka", BaseSHA: "base-sha", HeadSHA: "head-sha"})
+	if err != nil || !ok {
+		t.Fatalf("repositoryMonitorHeadContainsBase() = %v, %v", ok, err)
+	}
+}
diff --git a/internal/controller/repositorymonitor_credentials.go b/internal/controller/repositorymonitor_credentials.go
new file mode 100644
index 000000000..6d0cf34b5
--- /dev/null
+++ b/internal/controller/repositorymonitor_credentials.go
@@ -0,0 +1,156 @@
+package controller
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/types"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/workerenv"
+)
+
+type repositoryMonitorCredentialRefs struct {
+	read            *corev1.LocalObjectReference
+	publicationRead *corev1.LocalObjectReference
+	publication     *corev1.LocalObjectReference
+	forge           *corev1.LocalObjectReference
+}
+
+func repositoryMonitorReadCredentialRef(monitor *corev1alpha1.RepositoryMonitor) *corev1.LocalObjectReference {
+	if monitor == nil {
+		return nil
+	}
+	if localObjectReferenceName(monitor.Spec.ReadCredentialRef) != "" {
+		return monitor.Spec.ReadCredentialRef
+	}
+	return monitor.Spec.GitSecretRef
+}
+
+func repositoryMonitorCredentialRefsForWrite(monitor *corev1alpha1.RepositoryMonitor) (repositoryMonitorCredentialRefs, error) {
+	if monitor == nil {
+		return repositoryMonitorCredentialRefs{}, fmt.Errorf("repository monitor is required")
+	}
+	refs := repositoryMonitorCredentialRefs{
+		read:            monitor.Spec.ReadCredentialRef,
+		publicationRead: monitor.Spec.PublicationReadCredentialRef,
+		publication:     monitor.Spec.PublicationCredentialRef,
+		forge:           monitor.Spec.ForgeCredentialRef,
+	}
+	fields := []struct {
+		name string
+		ref  *corev1.LocalObjectReference
+	}{
+		{name: "spec.readCredentialRef", ref: refs.read},
+		{name: "spec.publicationReadCredentialRef", ref: refs.publicationRead},
+		{name: "spec.publicationCredentialRef", ref: refs.publication},
+		{name: "spec.forgeCredentialRef", ref: refs.forge},
+	}
+	seen := make(map[string]string, len(fields))
+	for _, field := range fields {
+		name := localObjectReferenceName(field.ref)
+		if name == "" {
+			return repositoryMonitorCredentialRefs{}, fmt.Errorf("%s is required for repository monitor write workflows", field.name)
+		}
+		if previous := seen[name]; previous != "" {
+			return repositoryMonitorCredentialRefs{}, fmt.Errorf("%s and %s must reference distinct Secrets", previous, field.name)
+		}
+		seen[name] = field.name
+	}
+	return refs, nil
+}
+
+func localObjectReferenceName(ref *corev1.LocalObjectReference) string {
+	if ref == nil {
+		return ""
+	}
+	return strings.TrimSpace(ref.Name)
+}
+
+func repositoryMonitorWriteCredentialsRequired(monitor *corev1alpha1.RepositoryMonitor) bool {
+	if monitor == nil {
+		return false
+	}
+	implementationEnabled := monitor.Spec.Targets.Issues.Enabled &&
+		(monitor.Spec.IssueWorkflow.Implementation.Enabled == nil || *monitor.Spec.IssueWorkflow.Implementation.Enabled) &&
+		monitor.Spec.Agents.Implementer != nil && strings.TrimSpace(monitor.Spec.Agents.Implementer.Name) != ""
+	repairEnabled := monitor.Spec.Repair.Enabled && monitor.Spec.Agents.Repairer != nil && strings.TrimSpace(monitor.Spec.Agents.Repairer.Name) != ""
+	return implementationEnabled || repairEnabled
+}
+
+func repositoryMonitorForgeCredentialsRequired(monitor *corev1alpha1.RepositoryMonitor) bool {
+	return monitor != nil && (repositoryMonitorWriteCredentialsRequired(monitor) || monitor.Spec.Triggers.GitHub.Labels.Enabled)
+}
+
+func (r *RepositoryMonitorReconciler) validateRepositoryMonitorCredentialRefs(ctx context.Context, monitor *corev1alpha1.RepositoryMonitor) (string, string, error) {
+	if monitor == nil {
+		return "", "", nil
+	}
+	if repositoryMonitorWriteCredentialsRequired(monitor) {
+		if _, err := repositoryMonitorCredentialRefsForWrite(monitor); err != nil {
+			return repositoryMonitorReasonGitSecretInvalid, err.Error(), nil
+		}
+	} else if repositoryMonitorForgeCredentialsRequired(monitor) && localObjectReferenceName(monitor.Spec.ForgeCredentialRef) == "" {
+		return repositoryMonitorReasonGitSecretInvalid, "spec.forgeCredentialRef is required for controller-owned GitHub mutations", nil
+	}
+
+	refs := []struct {
+		field string
+		ref   *corev1.LocalObjectReference
+	}{
+		{field: "spec.readCredentialRef", ref: monitor.Spec.ReadCredentialRef},
+		{field: "spec.gitSecretRef", ref: monitor.Spec.GitSecretRef},
+		{field: "spec.publicationReadCredentialRef", ref: monitor.Spec.PublicationReadCredentialRef},
+		{field: "spec.publicationCredentialRef", ref: monitor.Spec.PublicationCredentialRef},
+		{field: "spec.forgeCredentialRef", ref: monitor.Spec.ForgeCredentialRef},
+	}
+	validated := map[string]struct{}{}
+	for _, credential := range refs {
+		name := localObjectReferenceName(credential.ref)
+		if name == "" {
+			continue
+		}
+		if _, ok := validated[name]; ok {
+			continue
+		}
+		var secret corev1.Secret
+		if err := r.Get(ctx, types.NamespacedName{Name: name, Namespace: monitor.Namespace}, &secret); err != nil {
+			if apierrors.IsNotFound(err) {
+				return repositoryMonitorReasonGitSecretInvalid, fmt.Sprintf("%s %q not found in namespace %q", credential.field, name, monitor.Namespace), nil
+			}
+			return "", "", err
+		}
+		if !repositoryMonitorGitSecretHasToken(&secret) {
+			return repositoryMonitorReasonGitSecretInvalid, fmt.Sprintf("%s %q must contain a non-empty token, password, or %s key", credential.field, name, workerenv.GitHubToken), nil
+		}
+		validated[name] = struct{}{}
+	}
+	return "", "", nil
+}
+
+func (r *RepositoryMonitorReconciler) repositoryMonitorCredentialToken(ctx context.Context, monitor *corev1alpha1.RepositoryMonitor, field string, ref *corev1.LocalObjectReference) (string, error) {
+	name := localObjectReferenceName(ref)
+	if name == "" {
+		return "", nil
+	}
+	var secret corev1.Secret
+	if err := r.Get(ctx, types.NamespacedName{Name: name, Namespace: monitor.Namespace}, &secret); err != nil {
+		return "", fmt.Errorf("failed to get repository monitor %s %q: %w", field, name, err)
+	}
+	for _, key := range []string{repositoryMonitorTokenKey, repositoryMonitorPasswordKey, workerenv.GitHubToken} {
+		if value := strings.TrimSpace(string(secret.Data[key])); value != "" {
+			return value, nil
+		}
+	}
+	return "", fmt.Errorf("repository monitor %s %q must contain a token, password, or %s key", field, name, workerenv.GitHubToken)
+}
+
+func (r *RepositoryMonitorReconciler) repositoryMonitorForgeToken(ctx context.Context, monitor *corev1alpha1.RepositoryMonitor) (string, error) {
+	if monitor == nil || localObjectReferenceName(monitor.Spec.ForgeCredentialRef) == "" {
+		return "", fmt.Errorf("spec.forgeCredentialRef is required for controller-owned GitHub mutations")
+	}
+	return r.repositoryMonitorCredentialToken(ctx, monitor, "forge credential Secret", monitor.Spec.ForgeCredentialRef)
+}
diff --git a/internal/controller/repositorymonitor_inventory.go b/internal/controller/repositorymonitor_inventory.go
index 7a1b8230e..741527a34 100644
--- a/internal/controller/repositorymonitor_inventory.go
+++ b/internal/controller/repositorymonitor_inventory.go
@@ -26,7 +26,6 @@ import (
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
 	"github.com/orka-agents/orka/internal/labels"
 	"github.com/orka-agents/orka/internal/store"
-	"github.com/orka-agents/orka/internal/workerenv"
 )
 
 const (
@@ -339,7 +338,7 @@ func (r *RepositoryMonitorReconciler) createRepositoryMonitorReviewTask(ctx cont
 	reviewer := *monitor.Spec.Agents.Reviewer
 	repoFullName := owner + "/" + repository
 	prNumber := strconv.FormatInt(pr.Number, 10)
-	workspaceRepo, gitSecretRef := repositoryMonitorReviewTaskGitSource(monitor, owner, repository, pr)
+	workspaceRepo, readCredentialRef := repositoryMonitorReviewTaskGitSource(monitor, owner, repository, pr)
 	annotations := map[string]string{
 		labels.AnnotationRepositoryMonitorName:  monitor.Name,
 		labels.AnnotationMonitorRunID:           run.ID,
@@ -377,17 +376,12 @@ func (r *RepositoryMonitorReconciler) createRepositoryMonitorReviewTask(ctx cont
 			Priority: &priority,
 			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
 				AllowedTools: readOnlyAgentAllowedTools(),
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      workspaceRepo,
-					Ref:          pr.HeadSHA,
-					GitSecretRef: gitSecretRef,
-					PRBaseBranch: pr.BaseBranch,
-				},
 			},
-			Env: []corev1.EnvVar{
-				{Name: workerenv.PRBaseRepo, Value: repositoryMonitorHTTPSCloneURL(owner, repository)},
-				{Name: workerenv.PRBaseSHA, Value: pr.BaseSHA},
-				{Name: workerenv.ResultStdout, Value: scheduledRunLabelValue},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				Intent:            corev1alpha1.WorkspaceIntentRead,
+				GitRepo:           workspaceRepo,
+				Ref:               pr.HeadSHA,
+				ReadCredentialRef: workspaceCredentialReference(readCredentialRef),
 			},
 		},
 	}
@@ -519,7 +513,7 @@ func repositoryMonitorPendingReviewCandidate(existing *store.MonitorItem, pr rep
 func repositoryMonitorReviewTaskGitSource(monitor *corev1alpha1.RepositoryMonitor, owner, repository string, pr repositoryMonitorPullRequest) (string, *corev1.LocalObjectReference) {
 	monitoredRepo := strings.ToLower(owner + "/" + repository)
 	if strings.EqualFold(strings.TrimSpace(pr.HeadRepo), monitoredRepo) {
-		return repositoryMonitorHTTPSCloneURL(owner, repository), monitor.Spec.GitSecretRef
+		return repositoryMonitorHTTPSCloneURL(owner, repository), repositoryMonitorReadCredentialRef(monitor)
 	}
 	if strings.TrimSpace(pr.HeadRepoURL) == "" {
 		return repositoryMonitorHTTPSCloneURL(owner, repository), nil
@@ -927,19 +921,10 @@ func repositoryMonitorItemFromPullRequest(monitor *corev1alpha1.RepositoryMonito
 }
 
 func (r *RepositoryMonitorReconciler) repositoryMonitorGitHubToken(ctx context.Context, monitor *corev1alpha1.RepositoryMonitor) (string, error) {
-	if monitor.Spec.GitSecretRef == nil || strings.TrimSpace(monitor.Spec.GitSecretRef.Name) == "" {
-		return "", nil
+	if monitor != nil && localObjectReferenceName(monitor.Spec.ForgeCredentialRef) != "" {
+		return r.repositoryMonitorCredentialToken(ctx, monitor, "forge credential Secret", monitor.Spec.ForgeCredentialRef)
 	}
-	var secret corev1.Secret
-	if err := r.Get(ctx, types.NamespacedName{Name: monitor.Spec.GitSecretRef.Name, Namespace: monitor.Namespace}, &secret); err != nil {
-		return "", fmt.Errorf("failed to get repository monitor git secret %q: %w", monitor.Spec.GitSecretRef.Name, err)
-	}
-	for _, key := range []string{repositoryMonitorTokenKey, repositoryMonitorPasswordKey, workerenv.GitHubToken} {
-		if value := strings.TrimSpace(string(secret.Data[key])); value != "" {
-			return value, nil
-		}
-	}
-	return "", fmt.Errorf("repository monitor git secret %q must contain a token, password, or %s key", monitor.Spec.GitSecretRef.Name, workerenv.GitHubToken)
+	return r.repositoryMonitorCredentialToken(ctx, monitor, "legacy GitHub read credential Secret", monitor.Spec.GitSecretRef)
 }
 
 func (r *RepositoryMonitorReconciler) listRepositoryMonitorPullRequests(ctx context.Context, owner, repository, token, baseBranch string) ([]repositoryMonitorPullRequest, error) {
diff --git a/internal/controller/repositorymonitor_issue_actions.go b/internal/controller/repositorymonitor_issue_actions.go
index 224f38ee6..419722e51 100644
--- a/internal/controller/repositorymonitor_issue_actions.go
+++ b/internal/controller/repositorymonitor_issue_actions.go
@@ -470,202 +470,6 @@ func repositoryMonitorImplementationActionAlreadyStarted(action *store.WorkActio
 	}
 }
 
-type repositoryMonitorRuntimeCredentialBinding struct {
-	authRef         *corev1alpha1.SecretReference
-	agentUID        string
-	agentGeneration int64
-	secretUID       string
-	resourceVersion string
-	authFields      []string
-}
-
-//nolint:gocyclo // Binding validates and snapshots each credential boundary explicitly.
-func (r *RepositoryMonitorReconciler) repositoryMonitorImplementationRuntimeCredentialBinding(ctx context.Context, monitor *corev1alpha1.RepositoryMonitor, taskName string, ref *corev1alpha1.AgentReference) (*repositoryMonitorRuntimeCredentialBinding, error) {
-	if r == nil || r.Client == nil || monitor == nil || ref == nil || strings.TrimSpace(ref.Name) == "" {
-		return nil, fmt.Errorf("implementation runtime credential binding requires a configured agent")
-	}
-	agentNamespace := strings.TrimSpace(ref.Namespace)
-	if agentNamespace == "" {
-		agentNamespace = monitor.Namespace
-	}
-	var agent corev1alpha1.Agent
-	if err := r.Get(ctx, types.NamespacedName{Namespace: agentNamespace, Name: ref.Name}, &agent); err != nil {
-		return nil, fmt.Errorf("resolve implementation agent %s/%s: %w", agentNamespace, ref.Name, err)
-	}
-	if agent.Spec.SecretRef == nil || strings.TrimSpace(agent.Spec.SecretRef.Name) == "" {
-		return nil, fmt.Errorf("implementation agent %s/%s has no runtime credential Secret", agentNamespace, ref.Name)
-	}
-	sourceName := strings.TrimSpace(agent.Spec.SecretRef.Name)
-	var source corev1.Secret
-	if err := r.Get(ctx, types.NamespacedName{Namespace: monitor.Namespace, Name: sourceName}, &source); err != nil {
-		return nil, fmt.Errorf("resolve implementation runtime credential Secret %s/%s: %w", monitor.Namespace, sourceName, err)
-	}
-	if agent.Spec.Runtime != nil && agent.Spec.Runtime.Type == corev1alpha1.AgentRuntimeClaude && repositoryMonitorClaudeFoundryConfigured(source.Data) {
-		return nil, fmt.Errorf("%w: implementation runtime auth proxy does not support Azure AI Foundry", errRepositoryMonitorRuntimeAuthBindingInvalid)
-	}
-	allowedFields, authFields, err := scopedAgentRuntimeSecretKeys(&agent)
-	if err != nil {
-		return nil, err
-	}
-	snapshotData := make(map[string][]byte, len(allowedFields))
-	for _, field := range allowedFields {
-		if raw, ok := source.Data[field]; ok && len(raw) > 0 {
-			snapshotData[field] = bytes.Clone(raw)
-		}
-	}
-	presentAuthFields := make([]string, 0, len(authFields))
-	for _, field := range authFields {
-		if len(snapshotData[field]) > 0 {
-			presentAuthFields = append(presentAuthFields, field)
-		}
-	}
-	if len(presentAuthFields) == 0 {
-		return nil, fmt.Errorf("%w: implementation runtime credential Secret %s/%s has no supported credential", errRepositoryMonitorRuntimeAuthBindingInvalid, monitor.Namespace, sourceName)
-	}
-	snapshotName := repositoryMonitorBoundedDNSName(taskName+"-runtime-auth", 63)
-	immutable := true
-	snapshot := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      snapshotName,
-			Namespace: monitor.Namespace,
-			Labels: map[string]string{
-				labels.LabelManaged:           scheduledRunLabelValue,
-				labels.LabelCreatedBy:         "repository-monitor",
-				labels.LabelRepositoryMonitor: labels.SelectorValue(monitor.Name),
-			},
-			Annotations: map[string]string{
-				repositoryMonitorIssueAnnotationRuntimeAuthTask:      taskName,
-				repositoryMonitorIssueAnnotationRuntimeAuthSourceUID: string(source.UID),
-			},
-		},
-		Data:      snapshotData,
-		Immutable: &immutable,
-	}
-	if err := controllerutil.SetControllerReference(monitor, snapshot, r.Scheme); err != nil {
-		return nil, err
-	}
-	if err := r.Create(ctx, snapshot); err != nil {
-		if !apierrors.IsAlreadyExists(err) {
-			return nil, fmt.Errorf("create implementation runtime auth snapshot %s/%s: %w", snapshot.Namespace, snapshot.Name, err)
-		}
-		if err := r.Get(ctx, types.NamespacedName{Namespace: monitor.Namespace, Name: snapshotName}, snapshot); err != nil {
-			return nil, fmt.Errorf("read existing implementation runtime auth snapshot %s/%s: %w", monitor.Namespace, snapshotName, err)
-		}
-	}
-	validSnapshot := (snapshot.UID != "" || strings.TrimSpace(snapshot.ResourceVersion) != "") &&
-		snapshot.Immutable != nil && *snapshot.Immutable && metav1.IsControlledBy(snapshot, monitor) &&
-		snapshot.Labels[labels.LabelRepositoryMonitor] == labels.SelectorValue(monitor.Name) &&
-		snapshot.Annotations[repositoryMonitorIssueAnnotationRuntimeAuthTask] == taskName &&
-		snapshot.Annotations[repositoryMonitorIssueAnnotationRuntimeAuthSourceUID] == string(source.UID) &&
-		maps.EqualFunc(snapshot.Data, snapshotData, bytes.Equal)
-	if !validSnapshot {
-		return nil, fmt.Errorf("%w: implementation runtime auth snapshot %s/%s is not owned by monitor %q", errRepositoryMonitorRuntimeAuthBindingInvalid, monitor.Namespace, snapshotName, monitor.Name)
-	}
-	for _, field := range presentAuthFields {
-		if len(snapshot.Data[field]) == 0 {
-			return nil, fmt.Errorf("%w: implementation runtime auth snapshot %s/%s is missing required field %q", errRepositoryMonitorRuntimeAuthBindingInvalid, monitor.Namespace, snapshotName, field)
-		}
-	}
-	return &repositoryMonitorRuntimeCredentialBinding{
-		authRef:         &corev1alpha1.SecretReference{Name: snapshotName},
-		agentUID:        string(agent.UID),
-		agentGeneration: agent.Generation,
-		secretUID:       string(snapshot.UID),
-		resourceVersion: snapshot.ResourceVersion,
-		authFields:      presentAuthFields,
-	}, nil
-}
-
-func (r *RepositoryMonitorReconciler) loadRepositoryMonitorRuntimeAuthBinding(ctx context.Context, monitor *corev1alpha1.RepositoryMonitor, command *store.CommandEvent, taskName string) (*repositoryMonitorRuntimeCredentialBinding, bool, error) {
-	if r.Store == nil || monitor == nil || command == nil {
-		return nil, false, nil
-	}
-	actionID := store.RepositoryMonitorWorkActionID(command.ID, store.RepositoryMonitorDesiredActionForActionKind(repositoryMonitorIssueActionImplementation))
-	action, err := r.Store.GetWorkAction(ctx, monitor.Namespace, actionID)
-	if errors.Is(err, store.ErrNotFound) {
-		return nil, false, nil
-	}
-	if err != nil {
-		return nil, false, err
-	}
-	var metadata map[string]any
-	if err := json.Unmarshal([]byte(action.MetadataJSON), &metadata); err != nil {
-		return nil, false, err
-	}
-	name := stringField(metadata, repositoryMonitorRuntimeAuthMetadataName)
-	uid := stringField(metadata, repositoryMonitorRuntimeAuthMetadataUID)
-	resourceVersion := stringField(metadata, repositoryMonitorRuntimeAuthMetadataResourceVersion)
-	fieldsText := stringField(metadata, repositoryMonitorRuntimeAuthMetadataFields)
-	if name == "" && uid == "" && resourceVersion == "" && fieldsText == "" {
-		return nil, false, nil
-	}
-	if name == "" || fieldsText == "" || (uid == "" && resourceVersion == "") || strings.TrimSpace(action.TaskName) != taskName {
-		return nil, false, fmt.Errorf("%w: persisted runtime auth binding is incomplete", errRepositoryMonitorRuntimeAuthBindingInvalid)
-	}
-	var snapshot corev1.Secret
-	if err := r.Get(ctx, types.NamespacedName{Namespace: monitor.Namespace, Name: name}, &snapshot); err != nil {
-		return nil, false, err
-	}
-	identityMatches := string(snapshot.UID) == uid
-	if uid == "" {
-		identityMatches = snapshot.UID == "" && snapshot.ResourceVersion == resourceVersion
-	}
-	if snapshot.Immutable == nil || !*snapshot.Immutable || !metav1.IsControlledBy(&snapshot, monitor) ||
-		snapshot.Labels[labels.LabelRepositoryMonitor] != labels.SelectorValue(monitor.Name) ||
-		snapshot.Annotations[repositoryMonitorIssueAnnotationRuntimeAuthTask] != taskName || !identityMatches {
-		return nil, false, fmt.Errorf("%w: persisted runtime auth snapshot is invalid", errRepositoryMonitorRuntimeAuthBindingInvalid)
-	}
-	generation, err := strconv.ParseInt(stringField(metadata, repositoryMonitorRuntimeAuthMetadataAgentGeneration), 10, 64)
-	if err != nil {
-		return nil, false, fmt.Errorf("%w: persisted runtime agent generation is invalid", errRepositoryMonitorRuntimeAuthBindingInvalid)
-	}
-	fields := make([]string, 0)
-	for field := range strings.SplitSeq(fieldsText, ",") {
-		if field = strings.TrimSpace(field); field != "" {
-			if len(snapshot.Data[field]) == 0 {
-				return nil, false, fmt.Errorf("%w: persisted runtime auth snapshot field is missing", errRepositoryMonitorRuntimeAuthBindingInvalid)
-			}
-			fields = append(fields, field)
-		}
-	}
-	return &repositoryMonitorRuntimeCredentialBinding{
-		authRef:         &corev1alpha1.SecretReference{Name: name},
-		agentUID:        stringField(metadata, repositoryMonitorRuntimeAuthMetadataAgentUID),
-		agentGeneration: generation,
-		secretUID:       uid,
-		resourceVersion: resourceVersion,
-		authFields:      fields,
-	}, true, nil
-}
-
-func (r *RepositoryMonitorReconciler) persistRepositoryMonitorRuntimeAuthBinding(ctx context.Context, monitor *corev1alpha1.RepositoryMonitor, run *store.MonitorRun, command *store.CommandEvent, item *store.MonitorItem, taskName string, binding *repositoryMonitorRuntimeCredentialBinding) error {
-	if binding == nil || binding.authRef == nil {
-		return store.ValidationErrorf("runtime auth binding is required")
-	}
-	if err := r.recordRepositoryMonitorWorkActionState(ctx, monitor, run, command, repositoryMonitorIssueKind, item.Number, "", item.SnapshotDigest, repositoryMonitorIssueActionImplementation, repositoryMonitorWorkActionStatusQueued, repositoryMonitorIssuePhaseImplementationQueued, taskName, ""); err != nil {
-		return err
-	}
-	actionID := store.RepositoryMonitorWorkActionID(command.ID, store.RepositoryMonitorDesiredActionForActionKind(repositoryMonitorIssueActionImplementation))
-	action, err := r.Store.GetWorkAction(ctx, monitor.Namespace, actionID)
-	if err != nil {
-		return err
-	}
-	metadata := map[string]any{}
-	_ = json.Unmarshal([]byte(action.MetadataJSON), &metadata)
-	metadata["actionKind"] = repositoryMonitorIssueActionImplementation
-	metadata[repositoryMonitorRuntimeAuthMetadataName] = binding.authRef.Name
-	metadata[repositoryMonitorRuntimeAuthMetadataUID] = binding.secretUID
-	metadata[repositoryMonitorRuntimeAuthMetadataResourceVersion] = binding.resourceVersion
-	delete(metadata, repositoryMonitorRuntimeAuthMetadataLegacyDigest)
-	metadata[repositoryMonitorRuntimeAuthMetadataFields] = strings.Join(binding.authFields, ",")
-	metadata[repositoryMonitorRuntimeAuthMetadataAgentUID] = binding.agentUID
-	metadata[repositoryMonitorRuntimeAuthMetadataAgentGeneration] = strconv.FormatInt(binding.agentGeneration, 10)
-	encoded, _ := json.Marshal(metadata)
-	action.MetadataJSON = string(encoded)
-	action.TaskName = taskName
-	return r.Store.UpdateWorkAction(ctx, action)
-}
-
 func clearRepositoryMonitorRuntimeAuthMetadata(action *store.WorkAction, clearTaskName bool) {
 	if action == nil {
 		return
@@ -690,22 +494,6 @@ func clearRepositoryMonitorRuntimeAuthMetadata(action *store.WorkAction, clearTa
 	}
 }
 
-func (r *RepositoryMonitorReconciler) clearRepositoryMonitorRuntimeAuthBinding(ctx context.Context, monitor *corev1alpha1.RepositoryMonitor, commandID string) error {
-	if r.Store == nil || monitor == nil || strings.TrimSpace(commandID) == "" {
-		return nil
-	}
-	actionID := store.RepositoryMonitorWorkActionID(commandID, store.RepositoryMonitorDesiredActionForActionKind(repositoryMonitorIssueActionImplementation))
-	action, err := r.Store.GetWorkAction(ctx, monitor.Namespace, actionID)
-	if errors.Is(err, store.ErrNotFound) {
-		return nil
-	}
-	if err != nil {
-		return err
-	}
-	clearRepositoryMonitorRuntimeAuthMetadata(action, true)
-	return r.Store.UpdateWorkAction(ctx, action)
-}
-
 func (r *RepositoryMonitorReconciler) createRepositoryMonitorIssueActionTask(ctx context.Context, monitor *corev1alpha1.RepositoryMonitor, run *store.MonitorRun, command *store.CommandEvent, item *store.MonitorItem, owner, repository, actionKind, phase string, agent *corev1alpha1.AgentReference) (string, bool, error) {
 	taskName := repositoryMonitorIssueActionTaskName(monitor, run, item, actionKind)
 	priorActions, _, err := r.Store.ListActionRecords(ctx, store.ActionRecordFilter{Namespace: monitor.Namespace, MonitorName: monitor.Name, Kind: repositoryMonitorIssueKind, Number: item.Number, Limit: 10})
@@ -715,15 +503,11 @@ func (r *RepositoryMonitorReconciler) createRepositoryMonitorIssueActionTask(ctx
 	timeout := metav1.Duration{Duration: repositoryMonitorReviewTaskTimeout}
 	priority := int32(750)
 	agentRef := *agent
-	workspace := &corev1alpha1.WorkspaceConfig{GitRepo: repositoryMonitorHTTPSCloneURL(owner, repository), Branch: effectiveRepositoryMonitorBranch(monitor)}
-	gitRef := monitor.Spec.GitSecretRef
-	workspace.GitSecretRef = gitRef
-	env := []corev1.EnvVar{
-		{Name: "ORKA_GITHUB_REPOSITORY", Value: owner + "/" + repository},
-		{Name: "ORKA_GITHUB_ACTION", Value: actionKind},
-	}
-	if repositoryMonitorIssueActionRequiresRawResult(actionKind) {
-		env = append(env, corev1.EnvVar{Name: workerenv.ResultStdout, Value: scheduledRunLabelValue})
+	workspace := &corev1alpha1.WorkspaceConfig{
+		Intent:            corev1alpha1.WorkspaceIntentRead,
+		GitRepo:           repositoryMonitorHTTPSCloneURL(owner, repository),
+		Branch:            effectiveRepositoryMonitorBranch(monitor),
+		ReadCredentialRef: workspaceCredentialReference(repositoryMonitorReadCredentialRef(monitor)),
 	}
 	allowedTools := readOnlyAgentAllowedTools()
 	annotations := map[string]string{
@@ -737,29 +521,27 @@ func (r *RepositoryMonitorReconciler) createRepositoryMonitorIssueActionTask(ctx
 		repositoryMonitorIssueAnnotationCommandID:      command.ID,
 	}
 	annotations[labels.AnnotationWorkspaceInitContainer] = scheduledRunLabelValue
-	var runtimeAuthRef *corev1alpha1.SecretReference
 	if actionKind == repositoryMonitorIssueActionImplementation {
-		allowedTools = nil
-		annotations[labels.AnnotationAgentRuntimeAuthOnly] = scheduledRunLabelValue
-		binding, found, err := r.loadRepositoryMonitorRuntimeAuthBinding(ctx, monitor, command, taskName)
+		credentialRefs, err := repositoryMonitorCredentialRefsForWrite(monitor)
 		if err != nil {
 			return "", false, err
 		}
-		if !found {
-			binding, err = r.repositoryMonitorImplementationRuntimeCredentialBinding(ctx, monitor, taskName, agent)
-			if err != nil {
-				return "", false, err
-			}
-			if err := r.persistRepositoryMonitorRuntimeAuthBinding(ctx, monitor, run, command, item, taskName, binding); err != nil {
-				_ = r.cleanupRepositoryMonitorRuntimeAuthSnapshotReference(ctx, monitor, monitor.Namespace, binding.authRef.Name)
-				return "", false, err
-			}
-		}
-		runtimeAuthRef = binding.authRef
-		annotations[repositoryMonitorIssueAnnotationRuntimeAgentUID] = binding.agentUID
-		annotations[repositoryMonitorIssueAnnotationRuntimeAgentGeneration] = strconv.FormatInt(binding.agentGeneration, 10)
-		annotations[repositoryMonitorIssueAnnotationRuntimeAuthUID] = binding.secretUID
-		annotations[repositoryMonitorIssueAnnotationRuntimeAuthFields] = strings.Join(binding.authFields, ",")
+		allowedTools = nil
+		workspace.Intent = corev1alpha1.WorkspaceIntentWrite
+		workspace.PublicationGitRepo = workspace.GitRepo
+		workspace.ReadCredentialRef = workspaceCredentialReference(credentialRefs.read)
+		workspace.PublicationReadCredentialRef = workspaceCredentialReference(credentialRefs.publicationRead)
+		workspace.PublicationCredentialRef = workspaceCredentialReference(credentialRefs.publication)
+		workspace.ForgeCredentialRef = workspaceCredentialReference(credentialRefs.forge)
+		workspace.PRBaseBranch = effectiveRepositoryMonitorBranch(monitor)
+		workspace.PushBranch = repositoryMonitorIssueImplementationBranch(monitor, item, command)
+		maxChangedFiles := int32(repositoryMonitorImplementationMaxChangedFiles(monitor)) //nolint:gosec // CRD field is int32-bounded.
+		workspace.MaxChangedFiles = &maxChangedFiles
+		workspace.AllowedPaths = append([]string(nil), monitor.Spec.IssueWorkflow.Implementation.AllowedPaths...)
+		workspace.DenyRepositoryControlPaths = true
+		workspace.RejectBinaryFiles = true
+		workspace.RejectSecretLikeContent = true
+		annotations[labels.AnnotationAgentRuntimeAuthOnly] = scheduledRunLabelValue
 	} else {
 		annotations[labels.AnnotationAgentReadOnly] = scheduledRunLabelValue
 	}
@@ -779,21 +561,22 @@ func (r *RepositoryMonitorReconciler) createRepositoryMonitorIssueActionTask(ctx
 			Annotations: annotations,
 		},
 		Spec: corev1alpha1.TaskSpec{
-			Type:     corev1alpha1.TaskTypeAgent,
-			AgentRef: &agentRef,
-			Prompt:   buildRepositoryMonitorIssueActionPrompt(monitor, owner, repository, item, actionKind, phase, priorActions),
-			Timeout:  &timeout,
-			Priority: &priority,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				AllowedTools: allowedTools,
-				Workspace:    workspace,
-			},
-			Env: env,
+			Type:         corev1alpha1.TaskTypeAgent,
+			AgentRef:     &agentRef,
+			Prompt:       buildRepositoryMonitorIssueActionPrompt(monitor, owner, repository, item, actionKind, phase, priorActions),
+			Timeout:      &timeout,
+			Priority:     &priority,
+			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{AllowedTools: allowedTools},
+			Workspace:    workspace,
 		},
 	}
-	bindRepositoryMonitorRuntimeAuth(&task.Spec, runtimeAuthRef)
+	if actionKind == repositoryMonitorIssueActionImplementation {
+		task.Spec.SessionRef = &corev1alpha1.SessionReference{
+			Name: repositoryMonitorPublicationSessionName(monitor, workspace.PushBranch), Create: true, Append: false,
+		}
+	}
 	if err := controllerutil.SetControllerReference(monitor, task, r.Scheme); err != nil {
-		return "", false, r.repositoryMonitorTaskCreationErrorWithSnapshotCleanup(ctx, monitor, task, err)
+		return "", false, err
 	}
 	if err := r.Create(ctx, task); err != nil {
 		if apierrors.IsAlreadyExists(err) {
@@ -802,7 +585,7 @@ func (r *RepositoryMonitorReconciler) createRepositoryMonitorIssueActionTask(ctx
 				return "", false, fmt.Errorf("read existing issue action Task after create conflict: %w", getErr)
 			}
 			if validationErr := validateRepositoryMonitorRecoveredIssueActionTask(monitor, task, &existing); validationErr != nil {
-				return "", false, r.repositoryMonitorTaskCreationErrorWithSnapshotCleanup(ctx, monitor, task, validationErr)
+				return "", false, validationErr
 			}
 			return taskName, false, nil
 		}
@@ -810,14 +593,14 @@ func (r *RepositoryMonitorReconciler) createRepositoryMonitorIssueActionTask(ctx
 		getErr := r.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: task.Name}, &persisted)
 		if getErr == nil {
 			if validationErr := validateRepositoryMonitorRecoveredIssueActionTask(monitor, task, &persisted); validationErr != nil {
-				return "", false, r.repositoryMonitorTaskCreationErrorWithSnapshotCleanup(ctx, monitor, task, validationErr)
+				return "", false, validationErr
 			}
 			return taskName, false, nil
 		}
 		if !apierrors.IsNotFound(getErr) {
 			return "", false, fmt.Errorf("create issue action Task: %w; additionally failed to verify persistence: %v", err, getErr)
 		}
-		return "", false, r.repositoryMonitorTaskCreationErrorWithSnapshotCleanup(ctx, monitor, task, err)
+		return "", false, err
 	}
 	return taskName, true, nil
 }
@@ -850,36 +633,6 @@ func validateRepositoryMonitorRecoveredIssueActionTask(monitor *corev1alpha1.Rep
 	return nil
 }
 
-func repositoryMonitorClaudeFoundryConfigured(data map[string][]byte) bool {
-	if len(data["ANTHROPIC_FOUNDRY_API_KEY"]) > 0 {
-		return true
-	}
-	switch strings.ToLower(strings.TrimSpace(string(data["CLAUDE_CODE_USE_FOUNDRY"]))) {
-	case "1", scheduledRunLabelValue, "yes", "on":
-		return true
-	default:
-		return false
-	}
-}
-
-func (r *RepositoryMonitorReconciler) repositoryMonitorTaskCreationErrorWithSnapshotCleanup(ctx context.Context, monitor *corev1alpha1.RepositoryMonitor, task *corev1alpha1.Task, createErr error) error {
-	if cleanupErr := r.cleanupRepositoryMonitorRuntimeAuthSnapshot(ctx, monitor, task); cleanupErr != nil {
-		return fmt.Errorf("%w; additionally failed to clean runtime auth snapshot: %v", createErr, cleanupErr)
-	}
-	if task != nil {
-		if clearErr := r.clearRepositoryMonitorRuntimeAuthBinding(ctx, monitor, task.Annotations[repositoryMonitorIssueAnnotationCommandID]); clearErr != nil {
-			return fmt.Errorf("%w; additionally failed to clear runtime auth binding: %v", createErr, clearErr)
-		}
-	}
-	return createErr
-}
-
-func bindRepositoryMonitorRuntimeAuth(config *corev1alpha1.TaskSpec, ref *corev1alpha1.SecretReference) {
-	if config != nil {
-		config.SecretRef = ref
-	}
-}
-
 func repositoryMonitorIssuePromptPriorActions(records []store.ActionRecord) []map[string]any {
 	out := make([]map[string]any, 0, len(records))
 	for _, record := range records {
@@ -914,13 +667,8 @@ func repositoryMonitorIssueActionTaskName(monitor *corev1alpha1.RepositoryMonito
 	return repositoryMonitorBoundedDNSName(fmt.Sprintf("monissue-%s-%d-%s-%s", monitor.Name, item.Number, actionKind, run.ID), 63)
 }
 
-func repositoryMonitorIssueActionRequiresRawResult(actionKind string) bool {
-	switch actionKind {
-	case repositoryMonitorIssueActionTriage, repositoryMonitorIssueActionResearch, repositoryMonitorIssueActionPlan, repositoryMonitorIssueActionDecompose:
-		return true
-	default:
-		return false
-	}
+func repositoryMonitorPublicationSessionName(monitor *corev1alpha1.RepositoryMonitor, branch string) string {
+	return repositoryMonitorBoundedDNSName(fmt.Sprintf("monbranch-%s-%s", monitor.Name, repositoryMonitorShortHash(branch)), 63)
 }
 
 func repositoryMonitorIssueImplementationBranch(monitor *corev1alpha1.RepositoryMonitor, item *store.MonitorItem, command *store.CommandEvent) string {
@@ -1457,6 +1205,9 @@ func (r *RepositoryMonitorReconciler) applyIssueActionRecord(ctx context.Context
 				item.LastActionKind = repositoryMonitorIssueActionMutateToPR
 				item.LastActionTaskName = mutationTaskName
 				item.LastVerdict = repositoryMonitorRunPhaseQueued
+			} else if phase == repositoryMonitorIssuePhasePROpened {
+				item.LastActionKind = repositoryMonitorIssueActionMutateToPR
+				item.LastVerdict = repositoryMonitorRunPhaseSucceeded
 			}
 			if reason != "" {
 				item.SkipReason = reason
@@ -1726,7 +1477,137 @@ func repositoryMonitorPathPatternMatches(pattern, path string) bool {
 	return strings.TrimSuffix(pattern, "/") == strings.TrimSuffix(path, "/")
 }
 
+func repositoryMonitorACPDeliveryReceipt(task *corev1alpha1.Task) (branch, headSHA string, ok bool) {
+	if task == nil || task.Spec.Workspace == nil || task.Spec.Workspace.Intent != corev1alpha1.WorkspaceIntentWrite || task.Status.Delivery == nil {
+		return "", "", false
+	}
+	delivery := task.Status.Delivery
+	if delivery.State != corev1alpha1.TaskDeliveryStateVerifiedExact || delivery.Outcome != corev1alpha1.TaskDeliveryOutcomeVerifiedExact ||
+		strings.TrimSpace(delivery.PublicationID) == "" || delivery.RemoteBeforeSHA == nil ||
+		strings.TrimSpace(delivery.ExpectedCommitSHA) == "" || strings.TrimSpace(delivery.ExpectedCommitSHA) != strings.TrimSpace(delivery.VerifiedRemoteSHA) ||
+		store.ValidateCanonicalDigest("repository monitor delivery artifact digest", delivery.ArtifactDigest) != nil {
+		return "", "", false
+	}
+	if strings.TrimSpace(*delivery.RemoteBeforeSHA) != strings.TrimSpace(task.Spec.Workspace.ExpectedRemoteSHA) {
+		return "", "", false
+	}
+	if delivery.PublicationRepository == nil || !strings.EqualFold(strings.TrimSpace(delivery.PublicationRepository.Provider), "github") {
+		return "", "", false
+	}
+	owner, repository, err := security.ParseGitHubRepositoryURL(task.Spec.Workspace.PublicationGitRepo)
+	if err != nil || !strings.EqualFold(strings.TrimSpace(delivery.PublicationRepository.ID), "github.com/"+owner+"/"+repository) {
+		return "", "", false
+	}
+	headSHA = strings.TrimSpace(delivery.VerifiedRemoteSHA)
+	branch = strings.TrimSpace(delivery.Branch)
+	return branch, headSHA, branch != "" && headSHA != ""
+}
+
+func repositoryMonitorACPDeliveryFailureReason(task *corev1alpha1.Task) string {
+	if task == nil || task.Status.Delivery == nil {
+		return repositoryMonitorReviewTaskStateMissing
+	}
+	switch task.Status.Delivery.Outcome {
+	case corev1alpha1.TaskDeliveryOutcomeNoChange:
+		return "no_change"
+	case corev1alpha1.TaskDeliveryOutcomeCancelledBeforePublish:
+		return "cancelled_before_publish"
+	case corev1alpha1.TaskDeliveryOutcomeDeliveryConflict:
+		return "conflict"
+	case corev1alpha1.TaskDeliveryOutcomeCredentialBlocked:
+		return "credential_blocked"
+	case corev1alpha1.TaskDeliveryOutcomePublicationOutcomeUnknown:
+		return "outcome_unknown"
+	case corev1alpha1.TaskDeliveryOutcomeDeliveredSuperseded:
+		return "superseded"
+	case corev1alpha1.TaskDeliveryOutcomeVerifiedExact:
+		return "invalid_receipt"
+	default:
+		return "not_verified"
+	}
+}
+
+func repositoryMonitorTaskRequiresACPDeliveryReceipt(task *corev1alpha1.Task) bool {
+	return task != nil && task.Spec.Type == corev1alpha1.TaskTypeAgent && task.Spec.Workspace != nil && task.Spec.Workspace.Intent == corev1alpha1.WorkspaceIntentWrite
+}
+
+func repositoryMonitorACPNoChangeReceipt(task *corev1alpha1.Task, expectedStartingSHA string) bool {
+	if !repositoryMonitorTaskRequiresACPDeliveryReceipt(task) || task.Status.Delivery == nil {
+		return false
+	}
+	delivery := task.Status.Delivery
+	expectedStartingSHA = strings.TrimSpace(expectedStartingSHA)
+	return delivery.State == corev1alpha1.TaskDeliveryStateNoChange && delivery.Outcome == corev1alpha1.TaskDeliveryOutcomeNoChange &&
+		expectedStartingSHA != "" && strings.TrimSpace(delivery.StartingSHA) == expectedStartingSHA &&
+		strings.TrimSpace(task.Spec.Workspace.Ref) == expectedStartingSHA &&
+		strings.TrimSpace(task.Spec.Workspace.ExpectedRemoteSHA) == expectedStartingSHA
+}
+
 func (r *RepositoryMonitorReconciler) finishIssueImplementation(ctx context.Context, monitor *corev1alpha1.RepositoryMonitor, item *store.MonitorItem, record *store.ActionRecord, task *corev1alpha1.Task) (string, string, string, error) {
+	if branch, headSHA, delivered := repositoryMonitorACPDeliveryReceipt(task); delivered {
+		configuredBranch := repositoryMonitorIssueTaskPushBranch(task)
+		if configuredBranch == "" || branch != configuredBranch {
+			return repositoryMonitorIssuePhaseBlocked, "", "implementation_delivery_branch_mismatch", nil
+		}
+		if r.ArtifactStore == nil {
+			return repositoryMonitorIssuePhaseBlocked, "", "artifact_store_missing", nil
+		}
+		patchArtifact := repositoryMonitorIssuePatchSummaryArtifact(item.Number, record.ID)
+		deliverySummary, _ := json.Marshal(map[string]any{
+			"schemaVersion": "orka.issueImplementation.delivery.v1",
+			"branch":        branch, "headSHA": headSHA,
+			"artifactDigest":  task.Status.Delivery.ArtifactDigest,
+			"maxChangedFiles": task.Spec.Workspace.MaxChangedFiles,
+			"allowedPaths":    task.Spec.Workspace.AllowedPaths,
+		})
+		if err := r.ArtifactStore.SaveArtifact(ctx, task.Namespace, task.Name, patchArtifact, "application/json", deliverySummary); err != nil {
+			return repositoryMonitorIssuePhaseBlocked, "", "patch_summary_artifact_save_failed", nil
+		}
+		copyRecord := *record
+		payload, _ := common.FormatStructuredResult(&common.StructuredResult{
+			Summary: "ACP workspace delivery verified", PushBranch: branch, HeadSHA: headSHA,
+		})
+		copyRecord.PayloadJSON = string(payload)
+		phase, prNumber, reason, err := r.finishIssueMutation(ctx, monitor, item, &copyRecord, task)
+		if err != nil {
+			return "", "", "", err
+		}
+		if prNumber > 0 {
+			item.LinkedPRNumber = int64(prNumber)
+		}
+		if updateErr := r.updateImplementationJobForTask(ctx, monitor, task.Name, func(job *store.ImplementationJob) {
+			job.Branch = branch
+			job.PRNumber = int64(prNumber)
+			job.PatchArtifactID = patchArtifact
+			now := time.Now()
+			job.CompletedAt = &now
+			if phase == repositoryMonitorIssuePhasePROpened {
+				job.Phase = repositoryMonitorIssuePhasePROpened
+				job.ValidationState = repositoryMonitorCIStatePassed
+				job.Error = ""
+			} else {
+				job.Phase = repositoryMonitorIssuePhaseBlocked
+				job.ValidationState = repositoryMonitorReviewVerdictFailed
+				job.Error = firstNonEmptyIssueAction(reason, "implementation_delivery_failed")
+			}
+		}); updateErr != nil {
+			return "", "", "", updateErr
+		}
+		return phase, "", reason, nil
+	}
+	if repositoryMonitorTaskRequiresACPDeliveryReceipt(task) {
+		reason := "implementation_delivery_" + repositoryMonitorACPDeliveryFailureReason(task)
+		if err := r.updateImplementationJobForTask(ctx, monitor, task.Name, func(job *store.ImplementationJob) {
+			job.Phase = repositoryMonitorIssuePhaseBlocked
+			job.ValidationState = repositoryMonitorReviewVerdictFailed
+			job.Error = reason
+			now := time.Now()
+			job.CompletedAt = &now
+		}); err != nil {
+			return "", "", "", err
+		}
+		return repositoryMonitorIssuePhaseBlocked, "", reason, nil
+	}
 	sr := common.ParseStructuredResult(record.PayloadJSON)
 	if strings.TrimSpace(sr.Diff) == "" {
 		if err := r.updateImplementationJobForTask(ctx, monitor, task.Name, func(job *store.ImplementationJob) {
@@ -1760,7 +1641,7 @@ func (r *RepositoryMonitorReconciler) finishIssueImplementation(ctx context.Cont
 	if err := r.updateImplementationJobForTask(ctx, monitor, task.Name, func(job *store.ImplementationJob) {
 		job.Phase = repositoryMonitorIssuePhasePatchReady
 		job.PatchArtifactID = patchArtifact
-		job.ValidationState = "passed"
+		job.ValidationState = repositoryMonitorCIStatePassed
 	}); err != nil {
 		return "", "", "", err
 	}
@@ -2330,14 +2211,22 @@ func (r *RepositoryMonitorReconciler) createRepositoryMonitorIssueMutationTask(c
 	branch := repositoryMonitorIssueImplementationBranch(monitor, item, &store.CommandEvent{ID: record.CommandEventID})
 	priority := int32(850)
 	timeout := metav1.Duration{Duration: repositoryMonitorReviewTaskTimeout}
+	credentialRefs, err := repositoryMonitorCredentialRefsForWrite(monitor)
+	if err != nil {
+		return "", err
+	}
 	workspace := &corev1alpha1.WorkspaceConfig{
-		GitRepo:      monitor.Spec.RepoURL,
-		Branch:       effectiveRepositoryMonitorBranch(monitor),
-		PRBaseBranch: effectiveRepositoryMonitorBranch(monitor),
-		PushBranch:   branch,
+		Intent:                       corev1alpha1.WorkspaceIntentWrite,
+		GitRepo:                      monitor.Spec.RepoURL,
+		Branch:                       effectiveRepositoryMonitorBranch(monitor),
+		ReadCredentialRef:            workspaceCredentialReference(credentialRefs.read),
+		PublicationGitRepo:           monitor.Spec.RepoURL,
+		PublicationReadCredentialRef: workspaceCredentialReference(credentialRefs.publicationRead),
+		PublicationCredentialRef:     workspaceCredentialReference(credentialRefs.publication),
+		ForgeCredentialRef:           workspaceCredentialReference(credentialRefs.forge),
+		PRBaseBranch:                 effectiveRepositoryMonitorBranch(monitor),
+		PushBranch:                   branch,
 	}
-	gitRef := monitor.Spec.GitSecretRef
-	workspace.GitSecretRef = gitRef
 	taskName := repositoryMonitorIssueMutationTaskName(monitor, item, record)
 	task := &corev1alpha1.Task{
 		ObjectMeta: metav1.ObjectMeta{
@@ -2393,9 +2282,6 @@ func repositoryMonitorIssueTaskPushBranch(task *corev1alpha1.Task) string {
 	if task == nil {
 		return ""
 	}
-	if task.Spec.AgentRuntime != nil && task.Spec.AgentRuntime.Workspace != nil {
-		return strings.TrimSpace(task.Spec.AgentRuntime.Workspace.PushBranch)
-	}
 	if task.Spec.Workspace != nil {
 		return strings.TrimSpace(task.Spec.Workspace.PushBranch)
 	}
@@ -2403,7 +2289,7 @@ func repositoryMonitorIssueTaskPushBranch(task *corev1alpha1.Task) string {
 }
 
 func (r *RepositoryMonitorReconciler) createIssueImplementationPullRequest(ctx context.Context, monitor *corev1alpha1.RepositoryMonitor, item *store.MonitorItem, task *corev1alpha1.Task, headBranch string) (string, int, error) {
-	token, err := r.repositoryMonitorGitHubToken(ctx, monitor)
+	token, err := r.repositoryMonitorForgeToken(ctx, monitor)
 	if err != nil {
 		return "", 0, err
 	}
@@ -2511,7 +2397,7 @@ func repositoryMonitorIssueActionUpdatesStatusComment(actionKind, workflowPhase
 	case repositoryMonitorIssueActionPlan, repositoryMonitorIssueActionMutateToPR, repositoryMonitorIssueActionDecompose:
 		return true
 	case repositoryMonitorIssueActionImplementation:
-		return workflowPhase == repositoryMonitorIssuePhaseBlocked
+		return workflowPhase == repositoryMonitorIssuePhaseBlocked || workflowPhase == repositoryMonitorIssuePhasePROpened
 	default:
 		return false
 	}
@@ -2522,7 +2408,7 @@ func (r *RepositoryMonitorReconciler) upsertRepositoryMonitorIssueStatusComment(
 	if monitor == nil || item == nil || record == nil {
 		return nil
 	}
-	token, err := r.repositoryMonitorGitHubToken(ctx, monitor)
+	token, err := r.repositoryMonitorForgeToken(ctx, monitor)
 	if err != nil {
 		return nil
 	}
diff --git a/internal/controller/repositorymonitor_publish.go b/internal/controller/repositorymonitor_publish.go
index b854d546e..6c3239c2d 100644
--- a/internal/controller/repositorymonitor_publish.go
+++ b/internal/controller/repositorymonitor_publish.go
@@ -171,9 +171,9 @@ func (r *RepositoryMonitorReconciler) publishRepositoryMonitorReview(ctx context
 		return skip(repositoryMonitorPublishSkipHeadSHAChanged, fmt.Sprintf("Pull request #%d review publishing skipped: reviewed head does not match task binding", item.Number), map[string]any{"recordHeadSHA": record.HeadSHA, "taskHeadSHA": task.Annotations[labels.AnnotationMonitorHeadSHA]})
 	}
 
-	token, err := r.repositoryMonitorGitHubToken(ctx, monitor)
+	token, err := r.repositoryMonitorForgeToken(ctx, monitor)
 	if err != nil || strings.TrimSpace(token) == "" {
-		message := "spec.gitSecretRef is required for GitHub publishing and must contain token, password, or GITHUB_TOKEN"
+		message := "spec.forgeCredentialRef is required for GitHub publishing and must contain token, password, or GITHUB_TOKEN"
 		if err != nil {
 			message = err.Error()
 		}
diff --git a/internal/controller/repositorymonitor_repair.go b/internal/controller/repositorymonitor_repair.go
index ed2412a6c..c274a1d25 100644
--- a/internal/controller/repositorymonitor_repair.go
+++ b/internal/controller/repositorymonitor_repair.go
@@ -4,11 +4,12 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"net/http"
+	"net/url"
 	"strconv"
 	"strings"
 	"time"
 
-	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
@@ -18,8 +19,6 @@ import (
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
 	"github.com/orka-agents/orka/internal/labels"
 	"github.com/orka-agents/orka/internal/store"
-	"github.com/orka-agents/orka/internal/workerenv"
-	"github.com/orka-agents/orka/workers/common"
 )
 
 const (
@@ -241,6 +240,10 @@ func (r *RepositoryMonitorReconciler) repositoryMonitorRepairJobConsumesBudget(c
 }
 
 func (r *RepositoryMonitorReconciler) createRepositoryMonitorRepairTask(ctx context.Context, monitor *corev1alpha1.RepositoryMonitor, run *store.MonitorRun, command *store.CommandEvent, owner, repository string, pr repositoryMonitorPullRequest, item *store.MonitorItem, repairCountPR, repairCountHead int) (int, error) {
+	credentialRefs, err := repositoryMonitorCredentialRefsForWrite(monitor)
+	if err != nil {
+		return 0, err
+	}
 	monitoredRepo := owner + "/" + repository
 	taskName := repositoryMonitorRepairTaskName(monitor, pr, command)
 	job := &store.RepairJob{
@@ -277,14 +280,19 @@ func (r *RepositoryMonitorReconciler) createRepositoryMonitorRepairTask(ctx cont
 	timeout := metav1.Duration{Duration: repositoryMonitorReviewTaskTimeout}
 	repairer := *monitor.Spec.Agents.Repairer
 	workspace := &corev1alpha1.WorkspaceConfig{
-		GitRepo:      repositoryMonitorHTTPSCloneURL(owner, repository),
-		Branch:       pr.HeadBranch,
-		Ref:          pr.HeadSHA,
-		PRBaseBranch: pr.BaseBranch,
-		PushBranch:   pr.HeadBranch,
-	}
-	gitRef := monitor.Spec.GitSecretRef
-	workspace.GitSecretRef = gitRef
+		Intent:                       corev1alpha1.WorkspaceIntentWrite,
+		GitRepo:                      repositoryMonitorHTTPSCloneURL(owner, repository),
+		Branch:                       pr.HeadBranch,
+		Ref:                          pr.HeadSHA,
+		ReadCredentialRef:            workspaceCredentialReference(credentialRefs.read),
+		PublicationGitRepo:           repositoryMonitorHTTPSCloneURL(owner, repository),
+		PublicationReadCredentialRef: workspaceCredentialReference(credentialRefs.publicationRead),
+		PublicationCredentialRef:     workspaceCredentialReference(credentialRefs.publication),
+		ForgeCredentialRef:           workspaceCredentialReference(credentialRefs.forge),
+		PRBaseBranch:                 pr.BaseBranch,
+		PushBranch:                   pr.HeadBranch,
+		ExpectedRemoteSHA:            pr.HeadSHA,
+	}
 	task := &corev1alpha1.Task{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      taskName,
@@ -310,22 +318,17 @@ func (r *RepositoryMonitorReconciler) createRepositoryMonitorRepairTask(ctx cont
 			},
 		},
 		Spec: corev1alpha1.TaskSpec{
-			Type:         corev1alpha1.TaskTypeAgent,
-			AgentRef:     &repairer,
-			Prompt:       buildRepositoryMonitorRepairPrompt(command.Intent, monitoredRepo, pr, item),
-			Timeout:      &timeout,
-			Priority:     &priority,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{Workspace: workspace},
-			Env: []corev1.EnvVar{
-				{Name: workerenv.PRBaseRepo, Value: repositoryMonitorHTTPSCloneURL(owner, repository)},
-				{Name: workerenv.PRBaseSHA, Value: pr.BaseSHA},
-				{Name: workerenv.RequirePushBranch, Value: "true"},
+			Type:      corev1alpha1.TaskTypeAgent,
+			AgentRef:  &repairer,
+			Prompt:    buildRepositoryMonitorRepairPrompt(command.Intent, monitoredRepo, pr, item),
+			Timeout:   &timeout,
+			Priority:  &priority,
+			Workspace: workspace,
+			SessionRef: &corev1alpha1.SessionReference{
+				Name: repositoryMonitorPublicationSessionName(monitor, pr.HeadBranch), Create: true, Append: false,
 			},
 		},
 	}
-	if command.Intent == "update_branch" {
-		task.Spec.Env = append(task.Spec.Env, corev1.EnvVar{Name: workerenv.AllowEmptyPushBranch, Value: "true"})
-	}
 	if err := controllerutil.SetControllerReference(monitor, task, r.Scheme); err != nil {
 		return 0, err
 	}
@@ -374,6 +377,60 @@ func buildRepositoryMonitorRepairPrompt(intent, repo string, pr repositoryMonito
 	return fmt.Sprintf("Repair this exact pull request head for intent %q. Keep scope limited, run relevant validation, and leave final changes for Orka to commit and push to the configured push branch. Do not merge or close the PR.\n\nInput:\n%s\n", intent, string(payloadJSON))
 }
 
+func (r *RepositoryMonitorReconciler) repositoryMonitorHeadContainsBase(
+	ctx context.Context,
+	monitor *corev1alpha1.RepositoryMonitor,
+	job *store.RepairJob,
+) (bool, error) {
+	if monitor == nil || job == nil {
+		return false, fmt.Errorf("monitor and repair job are required")
+	}
+	owner, repository, ok := strings.Cut(strings.TrimSpace(job.Repo), "/")
+	if !ok || owner == "" || repository == "" || strings.Contains(repository, "/") {
+		return false, fmt.Errorf("repair repository identity is invalid")
+	}
+	baseSHA, headSHA := strings.TrimSpace(job.BaseSHA), strings.TrimSpace(job.HeadSHA)
+	if baseSHA == "" || headSHA == "" {
+		return false, fmt.Errorf("repair base and head SHAs are required")
+	}
+	token, err := r.repositoryMonitorGitHubToken(ctx, monitor)
+	if err != nil {
+		return false, err
+	}
+	baseURL := strings.TrimRight(r.GitHubAPIBaseURL, "/")
+	if baseURL == "" {
+		baseURL = repositoryMonitorDefaultGitHubAPIBaseURL
+	}
+	endpoint := fmt.Sprintf("%s/repos/%s/%s/compare/%s...%s", baseURL, url.PathEscape(owner), url.PathEscape(repository), url.PathEscape(baseSHA), url.PathEscape(headSHA))
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return false, err
+	}
+	request.Header.Set("Authorization", "Bearer "+token)
+	request.Header.Set("Accept", "application/vnd.github+json")
+	request.Header.Set("X-GitHub-Api-Version", "2022-11-28")
+	response, err := repositoryMonitorHTTPClient(r).Do(request)
+	if err != nil {
+		return false, err
+	}
+	defer response.Body.Close() //nolint:errcheck
+	body, err := readRepositoryMonitorGitHubResponse(response.Body, repositoryMonitorGitHubResponseLimit)
+	if err != nil {
+		return false, err
+	}
+	if response.StatusCode < 200 || response.StatusCode >= 300 {
+		return false, &repositoryMonitorGitHubAPIError{Operation: "compare repair head", StatusCode: response.StatusCode, Body: string(body)}
+	}
+	var result struct {
+		Status string `json:"status"`
+	}
+	if err := json.Unmarshal(body, &result); err != nil {
+		return false, err
+	}
+	return result.Status == "ahead" || result.Status == "identical", nil
+}
+
+//nolint:gocyclo // Repair ingestion keeps delivery, audit, and work-action settlement in one transaction.
 func (r *RepositoryMonitorReconciler) ingestCompletedRepositoryMonitorRepairTasks(ctx context.Context, monitor *corev1alpha1.RepositoryMonitor) (bool, error) {
 	jobs, _, err := r.Store.ListRepairJobs(ctx, store.RepairJobFilter{Namespace: monitor.Namespace, MonitorName: monitor.Name, Phase: repositoryMonitorRepairPhaseQueued, Limit: 100})
 	if err != nil {
@@ -411,21 +468,28 @@ func (r *RepositoryMonitorReconciler) ingestCompletedRepositoryMonitorRepairTask
 		if task.Status.Phase == corev1alpha1.TaskPhaseSucceeded {
 			job.Phase = repositoryMonitorRepairPhaseFailed
 			job.LastError = "repair task result is missing"
-			if r.ResultStore != nil {
-				if raw, err := r.ResultStore.GetResult(ctx, task.Namespace, task.Name); err == nil {
-					sr := common.ParseStructuredResult(string(raw))
-					job.PushedSHA = sr.HeadSHA
-					if strings.TrimSpace(sr.PushError) != "" {
-						job.LastError = sr.PushError
-					} else if strings.TrimSpace(sr.PushBranch) == "" {
-						job.LastError = "repair task did not report a pushed branch"
-					} else {
-						job.Phase = repositoryMonitorRepairPhaseSucceeded
-						job.LastError = ""
-					}
+			if branch, headSHA, delivered := repositoryMonitorACPDeliveryReceipt(&task); delivered {
+				job.PushedSHA = headSHA
+				if branch != job.Branch {
+					job.LastError = "repair delivery branch did not match the requested PR head branch"
+				} else {
+					job.Phase = repositoryMonitorRepairPhaseSucceeded
+					job.LastError = ""
+				}
+			} else if repositoryMonitorACPNoChangeReceipt(&task, job.HeadSHA) && job.Intent == repositoryMonitorCommandIntentUpdateBranch {
+				containsBase, verifyErr := r.repositoryMonitorHeadContainsBase(ctx, monitor, &job)
+				if verifyErr != nil {
+					return ingested, verifyErr
+				}
+				if containsBase {
+					job.Phase = repositoryMonitorRepairPhaseSucceeded
+					job.PushedSHA = job.HeadSHA
+					job.LastError = ""
 				} else {
-					job.LastError = err.Error()
+					job.LastError = "PR head does not contain the requested base revision"
 				}
+			} else {
+				job.LastError = "repair delivery " + repositoryMonitorACPDeliveryFailureReason(&task)
 			}
 		} else {
 			job.Phase = repositoryMonitorRepairPhaseFailed
diff --git a/internal/controller/repositoryscan_controller.go b/internal/controller/repositoryscan_controller.go
index f9fbdd7df..e3156caf1 100644
--- a/internal/controller/repositoryscan_controller.go
+++ b/internal/controller/repositoryscan_controller.go
@@ -13,12 +13,14 @@ import (
 	"fmt"
 	"slices"
 	"sort"
+	"strconv"
 	"strings"
 	"time"
 	"unicode/utf8"
 
 	cron "github.com/robfig/cron/v3"
 	corev1 "k8s.io/api/core/v1"
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -34,7 +36,6 @@ import (
 	"github.com/orka-agents/orka/internal/labels"
 	"github.com/orka-agents/orka/internal/security"
 	"github.com/orka-agents/orka/internal/store"
-	"github.com/orka-agents/orka/workers/common"
 )
 
 const (
@@ -49,6 +50,7 @@ const (
 	scanRunPhaseRunning   = "running"
 	scanRunPhaseSucceeded = "succeeded"
 	scanRunPhaseFailed    = "failed"
+	scanRunAdmissionGrace = time.Minute
 
 	scanModeIncremental = "incremental"
 	scanModeManual      = "manual"
@@ -63,6 +65,8 @@ const (
 	findingStateOpen                 = "open"
 	findingStatePatchPending         = "patch_pending"
 	findingStatePatchReady           = "patch_ready"
+	findingStatePROpen               = "pr_open"
+	patchProposalStatusPROpened      = "pr_opened"
 	findingValidationStatusPending   = "pending"
 	findingValidationStatusValidated = "validated"
 	findingValidationStatusFailed    = "failed"
@@ -78,6 +82,13 @@ const (
 	// status message on the CRD.
 	repositoryScanConditionMessageLimit  = 32 * 1024
 	repositoryScanConditionMessageSuffix = "\n...[truncated]"
+
+	securityReviewInitialAttempt = 0
+	securityReviewRetryAttempt   = 1
+	securityReviewRetryPrompt    = "\n\nThis is the only automatic result retry. " +
+		"The prior review task returned an invalid terminal result. " +
+		"Re-run the review from the trusted context above and return exactly one JSON object matching the required envelope. " +
+		"Do not include prose, Markdown fences, or tool transcripts."
 )
 
 var errScannerPolicyDigestChanged = errors.New("scanner policy digest changed during scan run")
@@ -87,10 +98,11 @@ var errScannerPolicyDigestChanged = errors.New("scanner policy digest changed du
 // RepositoryScanReconciler reconciles RepositoryScan resources.
 type RepositoryScanReconciler struct {
 	client.Client
-	Scheme        *runtime.Scheme
-	SecurityStore store.SecurityStore
-	ArtifactStore store.ArtifactStore
-	ResultStore   store.ResultStore
+	Scheme           *runtime.Scheme
+	SecurityStore    store.SecurityStore
+	ArtifactStore    store.ArtifactStore
+	ResultStore      store.ResultStore
+	PublicationStore store.PublicationStore
 }
 
 func repositoryScanConditionMessage(message, fallback string) string {
@@ -277,6 +289,19 @@ func isActiveTaskPhase(phase corev1alpha1.TaskPhase) bool {
 	}
 }
 
+func isTerminalScanTaskPhase(phase corev1alpha1.TaskPhase) bool {
+	switch phase {
+	case corev1alpha1.TaskPhaseSucceeded, corev1alpha1.TaskPhaseFailed, corev1alpha1.TaskPhaseCancelled:
+		return true
+	default:
+		return false
+	}
+}
+
+func isFailedScanTaskPhase(phase corev1alpha1.TaskPhase) bool {
+	return phase == corev1alpha1.TaskPhaseFailed || phase == corev1alpha1.TaskPhaseCancelled
+}
+
 func scanTaskRunID(task *corev1alpha1.Task) string {
 	if task == nil {
 		return ""
@@ -356,13 +381,18 @@ func (r *RepositoryScanReconciler) createScanRun(ctx context.Context, scan *core
 	taskName := security.ScanStageTaskName(scan.Name, mode, security.StageThreatModel, "")
 	scanID := security.ScanRunID(taskName)
 	idempotencyKey := security.ScanRunIdempotencyKey(scan.Namespace, scan.Name, mode, baseCommit, headCommit, scan.Spec.SubPath, policy.Digest)
-	if duplicate, err := r.hasActiveScanRunWithIdempotencyKey(ctx, scan, idempotencyKey); err != nil {
+	if duplicate, err := r.hasActiveScanRun(ctx, scan); err != nil {
 		return err
 	} else if duplicate {
 		return nil
 	}
 	timeout := metav1.Duration{Duration: 2 * time.Hour}
 	priority := int32(700)
+	resultBinding := security.AgentResultBinding{
+		RepositoryScan: scan.Name,
+		ScanID:         scanID,
+		PolicyDigest:   policy.Digest,
+	}
 
 	task := &corev1alpha1.Task{
 		ObjectMeta: metav1.ObjectMeta{
@@ -378,40 +408,18 @@ func (r *RepositoryScanReconciler) createScanRun(ctx context.Context, scan *core
 			},
 		},
 		Spec: corev1alpha1.TaskSpec{
-			Type:     corev1alpha1.TaskTypeAgent,
-			AgentRef: &scan.Spec.AnalysisAgentRef,
-			Prompt:   security.BuildThreatModelPrompt(scan, mode, baseCommit, headCommit, threatModel, policy.PromptPolicy()),
-			Timeout:  &timeout,
-			Priority: &priority,
-			Env: []corev1.EnvVar{
-				{Name: security.EnvRepositoryScanName, Value: scan.Name},
-				{Name: security.EnvStage, Value: security.StageThreatModel},
-				{Name: security.EnvScanID, Value: scanID},
-				{Name: security.EnvScannerPolicyVersion, Value: security.ScannerPolicyVersion},
-				{Name: security.EnvPolicyDigest, Value: policy.Digest},
-				{Name: security.EnvPolicyProvenance, Value: security.PolicyProvenanceEnv(policy)},
-			},
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      scan.Spec.RepoURL,
-					Branch:       security.EffectiveWorkspaceBranch(scan),
-					Ref:          security.EffectiveRef(scan),
-					GitSecretRef: scan.Spec.GitSecretRef,
-					SubPath:      scan.Spec.SubPath,
-					ForkRepo:     scan.Spec.ForkRepo,
-					PRBaseBranch: scan.Spec.PRBaseBranch,
-				},
-			},
+			Type:      corev1alpha1.TaskTypeAgent,
+			AgentRef:  &scan.Spec.AnalysisAgentRef,
+			Prompt:    security.BuildThreatModelResultPrompt(scan, mode, baseCommit, headCommit, threatModel, resultBinding, policy.PromptPolicy()),
+			Timeout:   &timeout,
+			Priority:  &priority,
+			Workspace: repositoryScanTaskWorkspace(scan, corev1alpha1.WorkspaceIntentRead),
 		},
 	}
 	if err := controllerutil.SetControllerReference(scan, task, r.Scheme); err != nil {
 		return err
 	}
-	if err := r.Create(ctx, task); err != nil && !apierrors.IsAlreadyExists(err) {
-		return err
-	}
-
-	if err := r.ensureScanRunRecord(ctx, &store.ScanRun{
+	run := &store.ScanRun{
 		ID:                   scanID,
 		Namespace:            scan.Namespace,
 		RepositoryScan:       scan.Name,
@@ -423,8 +431,22 @@ func (r *RepositoryScanReconciler) createScanRun(ctx context.Context, scan *core
 		ScannerPolicyVersion: security.ScannerPolicyVersion,
 		PolicyDigest:         policy.Digest,
 		IdempotencyKey:       idempotencyKey,
-		StartedAt:            time.Now(),
-	}); err != nil {
+		StartedAt:            time.Now().UTC(),
+	}
+	if err := r.ensureScanRunRecord(ctx, run); err != nil {
+		if errors.Is(err, store.ErrConflict) {
+			return nil
+		}
+		return err
+	}
+	if err := r.Create(ctx, task); err != nil && !apierrors.IsAlreadyExists(err) {
+		now := time.Now().UTC()
+		run.Phase = scanRunPhaseFailed
+		run.CompletedAt = &now
+		run.ErrorMessage = "scan task creation failed"
+		if releaseErr := r.SecurityStore.UpdateScanRun(ctx, run); releaseErr != nil {
+			return errors.Join(err, releaseErr)
+		}
 		return err
 	}
 
@@ -443,12 +465,11 @@ func (r *RepositoryScanReconciler) createScanRun(ctx context.Context, scan *core
 	})
 }
 
-func (r *RepositoryScanReconciler) hasActiveScanRunWithIdempotencyKey(
+func (r *RepositoryScanReconciler) hasActiveScanRun(
 	ctx context.Context,
 	scan *corev1alpha1.RepositoryScan,
-	key string,
 ) (bool, error) {
-	if r.SecurityStore == nil || strings.TrimSpace(key) == "" {
+	if r.SecurityStore == nil {
 		return false, nil
 	}
 	runs, _, err := r.SecurityStore.ListScanRuns(ctx, scan.Namespace, scan.Name, 100, "")
@@ -457,7 +478,7 @@ func (r *RepositoryScanReconciler) hasActiveScanRunWithIdempotencyKey(
 	}
 	for i := range runs {
 		run := &runs[i]
-		if run.IdempotencyKey != key || !activeScanRunPhase(run.Phase) {
+		if !activeScanRunPhase(run.Phase) {
 			continue
 		}
 		hasActiveTask, err := r.scanRunHasActivePipelineTask(ctx, scan, run.ID)
@@ -467,7 +488,10 @@ func (r *RepositoryScanReconciler) hasActiveScanRunWithIdempotencyKey(
 		if hasActiveTask {
 			return true, nil
 		}
-		now := time.Now()
+		if run.Phase == scanRunPhasePending && time.Since(run.StartedAt) < scanRunAdmissionGrace {
+			return true, nil
+		}
+		now := time.Now().UTC()
 		run.Phase = scanRunPhaseFailed
 		run.CompletedAt = &now
 		run.ErrorMessage = "scan run has no active pipeline task for its idempotency key"
@@ -579,7 +603,7 @@ func (r *RepositoryScanReconciler) markScanRunTerminalError(ctx context.Context,
 	if r.SecurityStore == nil || run == nil || failure == nil {
 		return nil
 	}
-	now := time.Now()
+	now := time.Now().UTC()
 	message := failure.Error()
 	run.Phase = scanRunPhaseFailed
 	run.CompletedAt = &now
@@ -642,15 +666,7 @@ func (r *RepositoryScanReconciler) createMapperTask(ctx context.Context, scan *c
 				{Name: security.EnvScanBaseCommit, Value: run.BaseCommit},
 				{Name: security.EnvScanHeadCommit, Value: run.HeadCommit},
 			},
-			Workspace: &corev1alpha1.WorkspaceConfig{
-				GitRepo:      scan.Spec.RepoURL,
-				Branch:       security.EffectiveWorkspaceBranch(scan),
-				Ref:          security.EffectiveRef(scan),
-				GitSecretRef: scan.Spec.GitSecretRef,
-				SubPath:      scan.Spec.SubPath,
-				ForkRepo:     scan.Spec.ForkRepo,
-				PRBaseBranch: scan.Spec.PRBaseBranch,
-			},
+			Workspace: repositoryScanTaskWorkspace(scan, ""),
 		},
 	}
 	if err := controllerutil.SetControllerReference(scan, task, r.Scheme); err != nil {
@@ -871,60 +887,11 @@ func (r *RepositoryScanReconciler) createReviewTasks(ctx context.Context, scan *
 		}
 		return err
 	}
-	timeout := metav1.Duration{Duration: 2 * time.Hour}
-	priority := int32(700)
 	for _, reviewSlice := range reviewSlices {
-		sliceJSON, err := json.Marshal(reviewSlice)
+		task, err := r.buildReviewTask(scan, run, threatModel, reviewSlice, policy, securityReviewInitialAttempt)
 		if err != nil {
 			return err
 		}
-		taskName := security.ScanStageTaskName(scan.Name, run.Mode, security.StageReview, reviewSlice.ID)
-		task := &corev1alpha1.Task{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      taskName,
-				Namespace: scan.Namespace,
-				Labels: map[string]string{
-					labels.LabelManaged:         "true",
-					labels.LabelCreatedBy:       "repository-security",
-					labels.LabelSecurityTarget:  labels.SelectorValue(scan.Name),
-					labels.LabelSecurityScanID:  run.ID,
-					labels.LabelSecurityMode:    run.Mode,
-					labels.LabelSecurityStage:   security.StageReview,
-					labels.LabelSecuritySliceID: reviewSlice.ID,
-				},
-			},
-			Spec: corev1alpha1.TaskSpec{
-				Type:     corev1alpha1.TaskTypeAgent,
-				AgentRef: &scan.Spec.AnalysisAgentRef,
-				Prompt:   security.BuildReviewPrompt(scan, run.Mode, run.BaseCommit, run.HeadCommit, threatModel, reviewSlice, policy.PromptPolicy()),
-				Timeout:  &timeout,
-				Priority: &priority,
-				Env: []corev1.EnvVar{
-					{Name: security.EnvReviewSliceJSON, Value: string(sliceJSON)},
-					{Name: security.EnvRepositoryScanName, Value: scan.Name},
-					{Name: security.EnvStage, Value: security.StageReview},
-					{Name: security.EnvScanID, Value: run.ID},
-					{Name: security.EnvScannerPolicyVersion, Value: security.ScannerPolicyVersion},
-					{Name: security.EnvPolicyDigest, Value: policy.Digest},
-					{Name: security.EnvPolicyProvenance, Value: security.PolicyProvenanceEnv(policy)},
-					{Name: security.EnvSliceID, Value: reviewSlice.ID},
-				},
-				AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-					Workspace: &corev1alpha1.WorkspaceConfig{
-						GitRepo:      scan.Spec.RepoURL,
-						Branch:       security.EffectiveWorkspaceBranch(scan),
-						Ref:          security.EffectiveRef(scan),
-						GitSecretRef: scan.Spec.GitSecretRef,
-						SubPath:      scan.Spec.SubPath,
-						ForkRepo:     scan.Spec.ForkRepo,
-						PRBaseBranch: scan.Spec.PRBaseBranch,
-					},
-				},
-			},
-		}
-		if err := controllerutil.SetControllerReference(scan, task, r.Scheme); err != nil {
-			return err
-		}
 		if err := r.Create(ctx, task); err != nil {
 			if apierrors.IsAlreadyExists(err) {
 				continue
@@ -935,6 +902,76 @@ func (r *RepositoryScanReconciler) createReviewTasks(ctx context.Context, scan *
 	return nil
 }
 
+func (r *RepositoryScanReconciler) buildReviewTask(
+	scan *corev1alpha1.RepositoryScan,
+	run *store.ScanRun,
+	threatModel string,
+	reviewSlice store.ReviewSlice,
+	policy security.ScannerPolicy,
+	attempt int,
+) (*corev1alpha1.Task, error) {
+	if attempt != securityReviewInitialAttempt && attempt != securityReviewRetryAttempt {
+		return nil, fmt.Errorf("unsupported security review attempt %d", attempt)
+	}
+	manifest, digest, err := security.ParseTrustedReviewContextManifest([]byte(reviewSlice.ReviewContextJSON))
+	if err != nil {
+		return nil, fmt.Errorf("review slice %s trusted context: %w", reviewSlice.ID, err)
+	}
+	if digest != reviewSlice.ReviewContextHash {
+		return nil, fmt.Errorf("review slice %s trusted context digest changed", reviewSlice.ID)
+	}
+
+	taskName := security.ScanStageTaskName(scan.Name, run.Mode, security.StageReview, reviewSlice.ID)
+	if attempt > securityReviewInitialAttempt {
+		taskName = security.ScanStageRetryTaskName(scan.Name, run.ID, security.StageReview, reviewSlice.ID, attempt)
+	}
+	resultBinding := security.AgentResultBinding{
+		RepositoryScan: scan.Name,
+		ScanID:         run.ID,
+		PolicyDigest:   policy.Digest,
+		ContextDigest:  digest,
+	}
+	prompt := security.BuildReviewResultPrompt(
+		scan, run.Mode, run.BaseCommit, run.HeadCommit, threatModel, reviewSlice,
+		resultBinding, *manifest, trustedFindingsRepository(scan, run), policy.PromptPolicy(),
+	)
+	if attempt == securityReviewRetryAttempt {
+		prompt += securityReviewRetryPrompt
+	}
+	timeout := metav1.Duration{Duration: 2 * time.Hour}
+	priority := int32(700)
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      taskName,
+			Namespace: scan.Namespace,
+			Labels: map[string]string{
+				labels.LabelManaged:         "true",
+				labels.LabelCreatedBy:       "repository-security",
+				labels.LabelSecurityTarget:  labels.SelectorValue(scan.Name),
+				labels.LabelSecurityScanID:  run.ID,
+				labels.LabelSecurityMode:    run.Mode,
+				labels.LabelSecurityStage:   security.StageReview,
+				labels.LabelSecuritySliceID: reviewSlice.ID,
+			},
+			Annotations: map[string]string{
+				labels.AnnotationSecurityReviewAttempt: strconv.Itoa(attempt),
+			},
+		},
+		Spec: corev1alpha1.TaskSpec{
+			Type:      corev1alpha1.TaskTypeAgent,
+			AgentRef:  &scan.Spec.AnalysisAgentRef,
+			Prompt:    prompt,
+			Timeout:   &timeout,
+			Priority:  &priority,
+			Workspace: repositoryScanTaskWorkspace(scan, corev1alpha1.WorkspaceIntentRead),
+		},
+	}
+	if err := controllerutil.SetControllerReference(scan, task, r.Scheme); err != nil {
+		return nil, err
+	}
+	return task, nil
+}
+
 func (r *RepositoryScanReconciler) progressLatestScanRun(ctx context.Context, scan *corev1alpha1.RepositoryScan) (bool, error) {
 	if r.Client == nil || r.SecurityStore == nil {
 		return false, nil
@@ -1053,6 +1090,23 @@ func reviewSliceTaskExists(tasks []corev1alpha1.Task, runID, sliceID string) boo
 	return false
 }
 
+func securityReviewAttempt(task *corev1alpha1.Task) (int, bool) {
+	if task == nil {
+		return 0, false
+	}
+	value := strings.TrimSpace(task.Annotations[labels.AnnotationSecurityReviewAttempt])
+	switch value {
+	case "":
+		return securityReviewInitialAttempt, true
+	case strconv.Itoa(securityReviewInitialAttempt):
+		return securityReviewInitialAttempt, true
+	case strconv.Itoa(securityReviewRetryAttempt):
+		return securityReviewRetryAttempt, true
+	default:
+		return 0, false
+	}
+}
+
 func terminalScannerPolicyLoadError(err error) bool {
 	if err == nil {
 		return false
@@ -1125,7 +1179,7 @@ func (r *RepositoryScanReconciler) progressScanRunAfterMapper(ctx context.Contex
 	}
 
 	if run.Mode == scanModeIncremental && run.SliceCount > 0 && run.SkippedSliceCount == run.SliceCount {
-		now := time.Now()
+		now := time.Now().UTC()
 		run.Phase = scanRunPhaseSucceeded
 		run.CompletedAt = &now
 		run.ErrorMessage = ""
@@ -1141,7 +1195,7 @@ func (r *RepositoryScanReconciler) progressScanRunAfterMapper(ctx context.Contex
 		return true, nil
 	}
 
-	now := time.Now()
+	now := time.Now().UTC()
 	run.Phase = scanRunPhaseSucceeded
 	run.CompletedAt = &now
 	run.ErrorMessage = ""
@@ -1229,13 +1283,13 @@ func (r *RepositoryScanReconciler) ingestOwnedTasks(ctx context.Context, scan *c
 
 	for i := range tasks.Items {
 		task := &tasks.Items[i]
-		switch task.Status.Phase {
-		case corev1alpha1.TaskPhaseSucceeded, corev1alpha1.TaskPhaseFailed:
-		default:
+		stage := taskSecurityStage(task)
+		if !isTerminalScanTaskPhase(task.Status.Phase) {
+			continue
+		}
+		if task.Status.Phase == corev1alpha1.TaskPhaseCancelled && !isScanPipelineStage(stage) {
 			continue
 		}
-
-		stage := taskSecurityStage(task)
 		if stage == security.StagePatch {
 			if err := r.ingestPatchTask(ctx, scan, task); err != nil {
 				return err
@@ -1275,12 +1329,7 @@ func isTerminalScanTask(task corev1alpha1.Task) bool {
 	if task.Labels[labels.LabelSecurityFindingID] != "" {
 		return false
 	}
-	switch task.Status.Phase {
-	case corev1alpha1.TaskPhaseSucceeded, corev1alpha1.TaskPhaseFailed:
-		return true
-	default:
-		return false
-	}
+	return isTerminalScanTaskPhase(task.Status.Phase)
 }
 
 func latestTerminalScanTask(tasks []corev1alpha1.Task) *corev1alpha1.Task {
@@ -1318,12 +1367,6 @@ func taskPhaseToSecurityPhase(phase corev1alpha1.TaskPhase) string {
 	return scanRunPhasePending
 }
 
-type validationTaskArtifacts struct {
-	artifact   security.ValidationArtifact
-	rawJSON    string
-	transcript string
-}
-
 func (r *RepositoryScanReconciler) persistThreatModelIfChanged(
 	ctx context.Context,
 	scan *corev1alpha1.RepositoryScan,
@@ -1456,57 +1499,6 @@ func (r *RepositoryScanReconciler) threatModelFromTaskResult(ctx context.Context
 	return content, true, nil
 }
 
-func (r *RepositoryScanReconciler) loadDiscoveryFindingsV2Artifact(ctx context.Context, task *corev1alpha1.Task) (*security.FindingsV2Artifact, *security.ReviewContextManifest, string, error) {
-	if r.ArtifactStore == nil {
-		return nil, nil, "", nil
-	}
-
-	findingsData, _, err := r.ArtifactStore.GetArtifact(ctx, task.Namespace, task.Name, security.ArtifactFindingsV2)
-	switch {
-	case err == nil:
-		if len(strings.TrimSpace(string(findingsData))) == 0 {
-			return nil, nil, fmt.Sprintf("%s is empty", security.ArtifactFindingsV2), nil
-		}
-	case errors.Is(err, store.ErrNotFound):
-		return nil, nil, "", nil
-	default:
-		return nil, nil, "", err
-	}
-
-	findings, err := security.ParseFindingsV2Artifact(findingsData)
-	if err != nil {
-		return nil, nil, fmt.Sprintf("%s is invalid: %v", security.ArtifactFindingsV2, err), nil
-	}
-	trustedSliceID := strings.TrimSpace(task.Labels[labels.LabelSecuritySliceID])
-	artifactSliceID := strings.TrimSpace(findings.Scan.SliceID)
-	if trustedSliceID == "" {
-		return nil, nil, "v2 findings require trusted security slice task label", nil
-	}
-	if artifactSliceID == "" {
-		return nil, nil, "v2 findings artifact missing scan.sliceId", nil
-	}
-	if artifactSliceID != trustedSliceID {
-		return nil, nil, fmt.Sprintf("v2 findings scan.sliceId %q does not match task slice %q", artifactSliceID, trustedSliceID), nil
-	}
-	contextName := security.ReviewContextArtifactName(trustedSliceID)
-	contextData, _, err := r.ArtifactStore.GetArtifact(ctx, task.Namespace, task.Name, contextName)
-	switch {
-	case err == nil:
-		manifest, err := security.ParseReviewContextManifest(contextData)
-		if err != nil {
-			return nil, nil, fmt.Sprintf("%s is invalid: %v", contextName, err), nil
-		}
-		if strings.TrimSpace(manifest.SliceID) != trustedSliceID {
-			return nil, nil, fmt.Sprintf("%s sliceId %q does not match task slice %q", contextName, manifest.SliceID, trustedSliceID), nil
-		}
-		return findings, manifest, "", nil
-	case errors.Is(err, store.ErrNotFound):
-		return nil, nil, fmt.Sprintf("%s is missing", contextName), nil
-	default:
-		return nil, nil, "", err
-	}
-}
-
 func (r *RepositoryScanReconciler) loadReviewSlicesArtifact(ctx context.Context, task *corev1alpha1.Task) (*security.ReviewSlicesArtifact, string, error) {
 	if r.ArtifactStore == nil {
 		return nil, "", nil
@@ -1530,32 +1522,35 @@ func (r *RepositoryScanReconciler) loadReviewSlicesArtifact(ctx context.Context,
 	}
 }
 
-func (r *RepositoryScanReconciler) loadValidationTaskArtifacts(ctx context.Context, task *corev1alpha1.Task) (*validationTaskArtifacts, string, error) {
+func (r *RepositoryScanReconciler) loadMapperReviewContext(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+	sliceID string,
+) (string, string, string, error) {
 	if r.ArtifactStore == nil {
-		return nil, "", nil
+		return "", "", "artifact store is not configured", nil
 	}
-
-	data, _, err := r.ArtifactStore.GetArtifact(ctx, task.Namespace, task.Name, security.ArtifactValidation)
+	artifactName := security.ReviewContextArtifactName(sliceID)
+	data, err := r.getArtifactWithRetry(ctx, task.Namespace, task.Name, artifactName)
 	switch {
 	case err == nil:
-		raw := strings.TrimSpace(string(data))
-		if raw == "" {
-			return nil, fmt.Sprintf("%s is empty", security.ArtifactValidation), nil
-		}
-		var artifact security.ValidationArtifact
-		if err := json.Unmarshal(data, &artifact); err != nil {
-			return nil, fmt.Sprintf("%s is invalid JSON: %v", security.ArtifactValidation, err), nil
-		}
-		result := &validationTaskArtifacts{artifact: artifact, rawJSON: raw}
-		if transcript, _, err := r.ArtifactStore.GetArtifact(ctx, task.Namespace, task.Name, security.ArtifactValidationText); err == nil {
-			result.transcript = strings.TrimSpace(string(transcript))
-		}
-		return result, "", nil
 	case errors.Is(err, store.ErrNotFound):
-		return nil, fmt.Sprintf("%s is missing", security.ArtifactValidation), nil
+		return "", "", fmt.Sprintf("%s is missing from mapper task", artifactName), nil
 	default:
-		return nil, "", err
+		return "", "", "", err
+	}
+	manifest, digest, err := security.ParseTrustedReviewContextManifest(data)
+	if err != nil {
+		return "", "", fmt.Sprintf("%s is invalid: %v", artifactName, err), nil
+	}
+	if strings.TrimSpace(manifest.SliceID) != strings.TrimSpace(sliceID) {
+		return "", "", fmt.Sprintf("%s sliceId does not match mapper slice", artifactName), nil
 	}
+	canonical, err := json.Marshal(manifest)
+	if err != nil {
+		return "", "", "", err
+	}
+	return string(canonical), digest, "", nil
 }
 
 func (r *RepositoryScanReconciler) getOrCreateScanRun(ctx context.Context, scan *corev1alpha1.RepositoryScan, task *corev1alpha1.Task) (*store.ScanRun, error) {
@@ -1587,10 +1582,7 @@ func conciseTaskMessage(message, fallback string) string {
 		if line == "" {
 			continue
 		}
-		if len(line) > 512 {
-			line = line[:512]
-		}
-		return line
+		return truncateUTF8(line, 512)
 	}
 	return fallback
 }
@@ -1607,6 +1599,41 @@ func (r *RepositoryScanReconciler) pipelineTaskSummary(ctx context.Context, task
 	return fallback
 }
 
+func (r *RepositoryScanReconciler) pipelineTaskFailureSummary(ctx context.Context, task *corev1alpha1.Task) string {
+	stage := "scan"
+	switch taskSecurityStage(task) {
+	case security.StageThreatModel:
+		stage = "threat model"
+	case security.StageMapper:
+		stage = "mapper"
+	case security.StageReview:
+		stage = "review"
+	}
+	outcome := "failed"
+	if task.Status.Phase == corev1alpha1.TaskPhaseCancelled {
+		outcome = "cancelled"
+	}
+	return r.pipelineTaskSummary(ctx, task, fmt.Sprintf("%s stage %s", stage, outcome))
+}
+
+func (r *RepositoryScanReconciler) loadAgentTaskResult(ctx context.Context, task *corev1alpha1.Task) ([]byte, string, error) {
+	if r.ResultStore == nil {
+		return nil, "result store is not configured", nil
+	}
+	if task == nil || task.Status.ResultRef == nil || !task.Status.ResultRef.Available {
+		return nil, "terminal task result is not available", nil
+	}
+	result, err := r.ResultStore.GetResult(ctx, task.Namespace, task.Name)
+	switch {
+	case err == nil:
+		return result, "", nil
+	case errors.Is(err, store.ErrNotFound):
+		return nil, "terminal task result was not found", nil
+	default:
+		return nil, "", err
+	}
+}
+
 func pipelineTaskDisplayName(task *corev1alpha1.Task) string {
 	stage := taskSecurityStage(task)
 	if stage == security.StageReview {
@@ -1642,55 +1669,102 @@ func (r *RepositoryScanReconciler) collectScanRunProgress(
 	tasks []corev1alpha1.Task,
 ) scanRunProgress {
 	progress := scanRunProgress{}
+	reviewTasks := map[string]*corev1alpha1.Task{}
 	for i := range tasks {
 		task := &tasks[i]
 		stage := taskSecurityStage(task)
 		if !isScanPipelineStage(stage) {
 			continue
 		}
-		if isActiveTaskPhase(task.Status.Phase) {
-			progress.hasActive = true
-		}
-		if task.Status.CompletionTime != nil {
-			completed := task.Status.CompletionTime.Time
-			if progress.latestCompletion == nil || completed.After(*progress.latestCompletion) {
-				progress.latestCompletion = &completed
+		if stage == security.StageReview {
+			key := strings.TrimSpace(task.Labels[labels.LabelSecuritySliceID])
+			if key == "" {
+				key = task.Name
+			}
+			key = scanTaskRunID(task) + "\x00" + key
+			if current := reviewTasks[key]; current == nil || newerSecurityReviewAttempt(task, current) {
+				reviewTasks[key] = task
 			}
+			continue
 		}
+		recordScanTaskTiming(&progress, task)
 		switch stage {
 		case security.StageThreatModel:
 			if task.Status.Phase == corev1alpha1.TaskPhaseSucceeded {
 				progress.hasThreatModelReady = true
 			}
-			if task.Status.Phase == corev1alpha1.TaskPhaseFailed {
-				recordScanProgressFailure(&progress, task, r.pipelineTaskSummary(ctx, task, "threat model stage failed"))
+			if isFailedScanTaskPhase(task.Status.Phase) {
+				recordScanProgressFailure(&progress, task, r.pipelineTaskFailureSummary(ctx, task))
 			}
 		case security.StageMapper:
 			progress.hasMapper = true
 			if task.Status.Phase == corev1alpha1.TaskPhaseSucceeded {
 				progress.hasMapperReady = true
 			}
-			if task.Status.Phase == corev1alpha1.TaskPhaseFailed {
-				recordScanProgressFailure(&progress, task, r.pipelineTaskSummary(ctx, task, "mapper stage failed"))
-			}
-		case security.StageReview:
-			progress.hasReview = true
-			progress.reviewCount++
-			if task.Status.Phase == corev1alpha1.TaskPhaseSucceeded {
-				progress.reviewSucceeded++
-			}
-			if task.Status.Phase == corev1alpha1.TaskPhaseFailed {
-				recordScanProgressFailure(&progress, task, r.pipelineTaskSummary(ctx, task, "review stage failed"))
+			if isFailedScanTaskPhase(task.Status.Phase) {
+				recordScanProgressFailure(&progress, task, r.pipelineTaskFailureSummary(ctx, task))
 			}
 		}
 	}
+
+	reviewKeys := make([]string, 0, len(reviewTasks))
+	for key := range reviewTasks {
+		reviewKeys = append(reviewKeys, key)
+	}
+	sort.Strings(reviewKeys)
+	for _, key := range reviewKeys {
+		task := reviewTasks[key]
+		progress.hasReview = true
+		progress.reviewCount++
+		recordScanTaskTiming(&progress, task)
+		if task.Status.Phase == corev1alpha1.TaskPhaseSucceeded {
+			progress.reviewSucceeded++
+		}
+		if isFailedScanTaskPhase(task.Status.Phase) {
+			recordScanProgressFailure(&progress, task, r.pipelineTaskFailureSummary(ctx, task))
+		}
+	}
 	return progress
 }
 
+func recordScanTaskTiming(progress *scanRunProgress, task *corev1alpha1.Task) {
+	if progress == nil || task == nil {
+		return
+	}
+	if task.Status.Phase == "" || isActiveTaskPhase(task.Status.Phase) {
+		progress.hasActive = true
+	}
+	if task.Status.CompletionTime != nil {
+		completed := task.Status.CompletionTime.Time
+		if progress.latestCompletion == nil || completed.After(*progress.latestCompletion) {
+			progress.latestCompletion = &completed
+		}
+	}
+}
+
+func newerSecurityReviewAttempt(candidate, current *corev1alpha1.Task) bool {
+	candidateAttempt, candidateValid := securityReviewAttempt(candidate)
+	currentAttempt, currentValid := securityReviewAttempt(current)
+	switch {
+	case candidateValid != currentValid:
+		return candidateValid
+	case candidateAttempt != currentAttempt:
+		return candidateAttempt > currentAttempt
+	case candidate.CreationTimestamp.Time.Equal(current.CreationTimestamp.Time):
+		return candidate.Name > current.Name
+	default:
+		return candidate.CreationTimestamp.After(current.CreationTimestamp.Time)
+	}
+}
+
 func applyScanRunProgress(run *store.ScanRun, progress scanRunProgress) {
 	if run.ErrorMessage != "" {
 		run.Phase = scanRunPhaseFailed
 		run.Summary = run.ErrorMessage
+		if run.CompletedAt == nil && progress.latestCompletion != nil {
+			completed := *progress.latestCompletion
+			run.CompletedAt = &completed
+		}
 		return
 	}
 	if progress.hasActive {
@@ -2000,6 +2074,11 @@ func (r *RepositoryScanReconciler) createValidationTask(ctx context.Context, sca
 	timeout := metav1.Duration{Duration: 90 * time.Minute}
 	priority := int32(725)
 	taskName := security.ScanStageTaskName(scan.Name, "validation", security.StageValidation, finding.ID)
+	resultBinding := security.AgentResultBinding{
+		RepositoryScan: scan.Name,
+		ScanID:         finding.ScanRunID,
+		PolicyDigest:   policy.Digest,
+	}
 
 	task := &corev1alpha1.Task{
 		ObjectMeta: metav1.ObjectMeta{
@@ -2016,30 +2095,12 @@ func (r *RepositoryScanReconciler) createValidationTask(ctx context.Context, sca
 			},
 		},
 		Spec: corev1alpha1.TaskSpec{
-			Type:     corev1alpha1.TaskTypeAgent,
-			AgentRef: &scan.Spec.AnalysisAgentRef,
-			Prompt:   security.BuildValidationPrompt(scan, finding, policy.PromptPolicy()),
-			Timeout:  &timeout,
-			Priority: &priority,
-			Env: []corev1.EnvVar{
-				{Name: security.EnvRepositoryScanName, Value: scan.Name},
-				{Name: security.EnvStage, Value: security.StageValidation},
-				{Name: security.EnvScanID, Value: finding.ScanRunID},
-				{Name: security.EnvPolicyDigest, Value: policy.Digest},
-				{Name: security.EnvPolicyProvenance, Value: security.PolicyProvenanceEnv(policy)},
-				{Name: security.EnvFindingID, Value: finding.ID},
-			},
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      scan.Spec.RepoURL,
-					Branch:       security.EffectiveWorkspaceBranch(scan),
-					Ref:          security.EffectiveRef(scan),
-					GitSecretRef: scan.Spec.GitSecretRef,
-					SubPath:      scan.Spec.SubPath,
-					ForkRepo:     scan.Spec.ForkRepo,
-					PRBaseBranch: scan.Spec.PRBaseBranch,
-				},
-			},
+			Type:      corev1alpha1.TaskTypeAgent,
+			AgentRef:  &scan.Spec.AnalysisAgentRef,
+			Prompt:    security.BuildValidationResultPrompt(scan, finding, resultBinding, policy.PromptPolicy()),
+			Timeout:   &timeout,
+			Priority:  &priority,
+			Workspace: repositoryScanTaskWorkspace(scan, corev1alpha1.WorkspaceIntentRead),
 		},
 	}
 	if err := controllerutil.SetControllerReference(scan, task, r.Scheme); err != nil {
@@ -2249,7 +2310,8 @@ func clearThreatModelRunError(run *store.ScanRun) {
 		return
 	}
 	if strings.Contains(run.ErrorMessage, security.ArtifactThreatModel) ||
-		strings.Contains(run.ErrorMessage, "threat model stage failed") {
+		strings.Contains(run.ErrorMessage, "threat model stage failed") ||
+		strings.Contains(run.ErrorMessage, "threat model terminal result") {
 		clearRunError(run)
 	}
 }
@@ -2279,21 +2341,35 @@ func (r *RepositoryScanReconciler) ingestThreatModelTask(ctx context.Context, sc
 	}
 
 	if task.Status.Phase == corev1alpha1.TaskPhaseSucceeded {
-		threatModel, validationProblem, err := r.loadThreatModelArtifact(ctx, task)
+		if err := r.ensureActiveScanRunPolicyCurrent(ctx, scan, run); err != nil {
+			return err
+		}
+		result, validationProblem, err := r.loadAgentTaskResult(ctx, task)
 		if err != nil {
 			return err
 		}
-		if validationProblem != "" {
-			run.ErrorMessage = "required scan artifacts were missing or invalid: " + validationProblem
-		} else {
+		var threatModel string
+		if validationProblem == "" {
+			threatModel, err = security.ParseThreatModelResult(result, security.AgentResultBinding{
+				RepositoryScan: scan.Name,
+				ScanID:         run.ID,
+				PolicyDigest:   run.PolicyDigest,
+			})
+			if err != nil {
+				validationProblem = err.Error()
+			}
+		}
+		if validationProblem == "" {
 			if err := r.persistThreatModelIfChanged(ctx, scan, run.ID, run.StartedAt, threatModel); err != nil {
 				return err
 			}
 			clearThreatModelRunError(run)
 			run.Summary = scanSummaryThreatModelPending
+		} else {
+			run.ErrorMessage = "threat model terminal result is missing or invalid: " + validationProblem
 		}
 	} else {
-		run.ErrorMessage = r.pipelineTaskSummary(ctx, task, "threat model stage failed")
+		run.ErrorMessage = r.pipelineTaskFailureSummary(ctx, task)
 	}
 
 	return r.refreshScanRunStatus(ctx, scan, run, run.ID, false)
@@ -2314,44 +2390,50 @@ func (r *RepositoryScanReconciler) ingestReviewTask(ctx context.Context, scan *c
 	if reviewSlice != nil && reviewSlice.Status == reviewSliceStatusReviewed {
 		return r.refreshScanRunStatus(ctx, scan, run, run.ID, false)
 	}
+	attempt, validAttempt := securityReviewAttempt(task)
+	retryTaskName := security.ScanStageRetryTaskName(scan.Name, run.ID, security.StageReview, sliceID, securityReviewRetryAttempt)
+	if !validAttempt ||
+		(attempt == securityReviewRetryAttempt && task.Name != retryTaskName) ||
+		(attempt == securityReviewInitialAttempt && task.Name == retryTaskName) {
+		return r.failReviewTask(ctx, scan, run, sliceID, "invalid security review attempt identity")
+	}
 
 	if task.Status.Phase != corev1alpha1.TaskPhaseSucceeded {
-		run.ErrorMessage = r.pipelineTaskSummary(ctx, task, "review stage failed")
-		if sliceID != "" {
-			if err := r.SecurityStore.UpdateReviewSliceStatus(ctx, scan.Namespace, scan.Name, sliceID, run.ID, reviewSliceStatusFailed); err != nil && !errors.Is(err, store.ErrNotFound) {
-				return err
-			}
-		}
-		return r.refreshScanRunStatus(ctx, scan, run, run.ID, false)
+		return r.failReviewTask(ctx, scan, run, sliceID, r.pipelineTaskFailureSummary(ctx, task))
 	}
 
-	findingsV2, manifest, validationProblem, err := r.loadDiscoveryFindingsV2Artifact(ctx, task)
+	manifest, findingsV2, validationProblem, retryableResult, err := r.validateReviewTaskResult(ctx, scan, task, run, reviewSlice, sliceID)
 	if err != nil {
 		return err
 	}
-	if findingsV2 == nil && validationProblem == "" {
-		validationProblem = fmt.Sprintf("%s is missing", security.ArtifactFindingsV2)
-	}
 	if validationProblem != "" {
-		if sliceID != "" {
-			run.ErrorMessage = fmt.Sprintf("slice %s: %s", sliceID, validationProblem)
-			if err := r.SecurityStore.UpdateReviewSliceStatus(ctx, scan.Namespace, scan.Name, sliceID, run.ID, reviewSliceStatusFailed); err != nil && !errors.Is(err, store.ErrNotFound) {
-				return err
+		if retryableResult {
+			retried, retryErr := r.ensureReviewResultRetry(ctx, scan, task, run, reviewSlice, sliceID)
+			if retryErr != nil {
+				return retryErr
+			}
+			if retried {
+				run.Phase = scanRunPhaseRunning
+				run.CompletedAt = nil
+				run.ErrorMessage = ""
+				run.Summary = fmt.Sprintf("Retrying review slice %s after an invalid terminal result", sliceID)
+				return r.SecurityStore.UpdateScanRun(ctx, run)
 			}
-		} else {
-			run.ErrorMessage = validationProblem
 		}
-		return r.refreshScanRunStatus(ctx, scan, run, run.ID, false)
+		message := validationProblem
+		if sliceID != "" {
+			message = fmt.Sprintf("slice %s: %s", sliceID, validationProblem)
+		}
+		return r.failReviewTask(ctx, scan, run, sliceID, message)
 	}
 
 	clearReviewRunError(run, sliceID)
-	trustedRepo := trustedFindingsRepository(scan, run)
 	partition := security.ValidateFindingsV2(*findingsV2, *manifest, security.FindingValidationOptions{
 		Namespace:            scan.Namespace,
 		RepositoryScan:       scan.Name,
 		ScanRunID:            run.ID,
 		TaskName:             task.Name,
-		TrustedRepository:    trustedRepo,
+		TrustedRepository:    trustedFindingsRepository(scan, run),
 		UseTrustedRepository: true,
 	})
 	if err := r.ensureActiveScanRunPolicyCurrent(ctx, scan, run); err != nil {
@@ -2400,6 +2482,186 @@ func (r *RepositoryScanReconciler) ingestReviewTask(ctx context.Context, scan *c
 	return r.refreshScanRunStatus(ctx, scan, run, run.ID, false)
 }
 
+func (r *RepositoryScanReconciler) failReviewTask(
+	ctx context.Context,
+	scan *corev1alpha1.RepositoryScan,
+	run *store.ScanRun,
+	sliceID string,
+	message string,
+) error {
+	run.ErrorMessage = message
+	if sliceID != "" {
+		if err := r.SecurityStore.UpdateReviewSliceStatus(ctx, scan.Namespace, scan.Name, sliceID, run.ID, reviewSliceStatusFailed); err != nil && !errors.Is(err, store.ErrNotFound) {
+			return err
+		}
+	}
+	return r.refreshScanRunStatus(ctx, scan, run, run.ID, false)
+}
+
+func (r *RepositoryScanReconciler) validateReviewTaskResult(
+	ctx context.Context,
+	scan *corev1alpha1.RepositoryScan,
+	task *corev1alpha1.Task,
+	run *store.ScanRun,
+	reviewSlice *store.ReviewSlice,
+	sliceID string,
+) (*security.ReviewContextManifest, *security.FindingsV2Artifact, string, bool, error) {
+	if reviewSlice == nil {
+		return nil, nil, "trusted review slice was not found", false, nil
+	}
+
+	manifest, digest, err := security.ParseTrustedReviewContextManifest([]byte(reviewSlice.ReviewContextJSON))
+	if err != nil {
+		return nil, nil, "trusted review context is invalid: " + err.Error(), false, nil
+	}
+	if digest != reviewSlice.ReviewContextHash {
+		return nil, nil, "trusted review context digest changed", false, nil
+	}
+	if strings.TrimSpace(manifest.SliceID) != sliceID {
+		return nil, nil, "trusted review context slice does not match task slice", false, nil
+	}
+	if err := r.ensureActiveScanRunPolicyCurrent(ctx, scan, run); err != nil {
+		return nil, nil, "", false, err
+	}
+
+	if r.ResultStore == nil {
+		return nil, nil, "result store is not configured", false, nil
+	}
+	if task == nil || task.Status.ResultRef == nil || !task.Status.ResultRef.Available {
+		return nil, nil, "terminal task result is not available", true, nil
+	}
+	result, err := r.ResultStore.GetResult(ctx, task.Namespace, task.Name)
+	switch {
+	case err == nil:
+	case errors.Is(err, store.ErrNotFound):
+		return nil, nil, "terminal task result was not found", true, nil
+	default:
+		return nil, nil, "", false, err
+	}
+	findings, err := security.ParseFindingsResult(result, security.FindingsResultExpectation{
+		Binding: security.AgentResultBinding{
+			RepositoryScan: scan.Name,
+			ScanID:         run.ID,
+			PolicyDigest:   run.PolicyDigest,
+			ContextDigest:  reviewSlice.ReviewContextHash,
+		},
+		SliceID:    sliceID,
+		Mode:       run.Mode,
+		Repository: trustedFindingsRepository(scan, run),
+	})
+	if err != nil {
+		return nil, nil, err.Error(), true, nil
+	}
+	return manifest, findings, "", false, nil
+}
+
+func (r *RepositoryScanReconciler) ensureReviewResultRetry(
+	ctx context.Context,
+	scan *corev1alpha1.RepositoryScan,
+	sourceTask *corev1alpha1.Task,
+	run *store.ScanRun,
+	reviewSlice *store.ReviewSlice,
+	sliceID string,
+) (bool, error) {
+	if r.Client == nil || r.Scheme == nil || r.SecurityStore == nil {
+		return false, nil
+	}
+	if !reviewResultRetryEligible(scan, sourceTask, run, reviewSlice, sliceID) {
+		return false, nil
+	}
+
+	policy, err := security.LoadScannerPolicy(ctx, r.Client, scan.Namespace, scan.Spec)
+	if err != nil {
+		return false, err
+	}
+	if err := ensureScanRunPolicyDigest(run, policy); err != nil {
+		return false, err
+	}
+	var threatModel string
+	model, err := r.SecurityStore.GetLatestThreatModel(ctx, scan.Namespace, scan.Name)
+	switch {
+	case err == nil:
+		threatModel = model.Content
+	case errors.Is(err, store.ErrNotFound):
+	default:
+		return false, err
+	}
+
+	desired, err := r.buildReviewTask(scan, run, threatModel, *reviewSlice, policy, securityReviewRetryAttempt)
+	if err != nil {
+		return false, err
+	}
+	if sourceTask.Name == desired.Name {
+		return false, nil
+	}
+	if err := r.Create(ctx, desired); err != nil {
+		if !apierrors.IsAlreadyExists(err) {
+			return false, err
+		}
+		existing := &corev1alpha1.Task{}
+		if getErr := r.Get(ctx, client.ObjectKeyFromObject(desired), existing); getErr != nil {
+			return false, getErr
+		}
+		if !matchingReviewRetryTask(existing, desired) {
+			return false, fmt.Errorf("review retry task %s/%s conflicts with the expected retry identity", desired.Namespace, desired.Name)
+		}
+	}
+	return true, nil
+}
+
+func reviewResultRetryEligible(
+	scan *corev1alpha1.RepositoryScan,
+	sourceTask *corev1alpha1.Task,
+	run *store.ScanRun,
+	reviewSlice *store.ReviewSlice,
+	sliceID string,
+) bool {
+	if scan == nil || sourceTask == nil || run == nil || reviewSlice == nil {
+		return false
+	}
+	attempt, validAttempt := securityReviewAttempt(sourceTask)
+	if !validAttempt || attempt != securityReviewInitialAttempt || sourceTask.Status.Phase != corev1alpha1.TaskPhaseSucceeded {
+		return false
+	}
+	if !activeScanRunPhase(run.Phase) || run.Namespace != scan.Namespace || run.RepositoryScan != scan.Name {
+		return false
+	}
+	if sourceTask.Namespace != scan.Namespace || scanTaskRunID(sourceTask) != run.ID || taskSecurityStage(sourceTask) != security.StageReview {
+		return false
+	}
+	if strings.TrimSpace(sourceTask.Labels[labels.LabelSecuritySliceID]) != sliceID ||
+		strings.TrimSpace(reviewSlice.ID) != sliceID ||
+		strings.TrimSpace(reviewSlice.LastScanRunID) != run.ID ||
+		reviewSlice.Status != reviewSliceStatusPending {
+		return false
+	}
+	return metav1.IsControlledBy(sourceTask, scan)
+}
+
+func matchingReviewRetryTask(existing, desired *corev1alpha1.Task) bool {
+	if existing == nil || desired == nil || existing.Namespace != desired.Namespace || existing.Name != desired.Name {
+		return false
+	}
+	for key, value := range desired.Labels {
+		if existing.Labels[key] != value {
+			return false
+		}
+	}
+	if existing.Annotations[labels.AnnotationSecurityReviewAttempt] != strconv.Itoa(securityReviewRetryAttempt) {
+		return false
+	}
+	existingOwner := metav1.GetControllerOf(existing)
+	desiredOwner := metav1.GetControllerOf(desired)
+	if existingOwner == nil || desiredOwner == nil ||
+		existingOwner.APIVersion != desiredOwner.APIVersion ||
+		existingOwner.Kind != desiredOwner.Kind ||
+		existingOwner.Name != desiredOwner.Name ||
+		existingOwner.UID != desiredOwner.UID {
+		return false
+	}
+	return apiequality.Semantic.DeepEqual(existing.Spec, desired.Spec)
+}
+
 func capAcceptedFindingsForRun(scan *corev1alpha1.RepositoryScan, run *store.ScanRun, accepted []*store.Finding) ([]*store.Finding, []security.DroppedFindingDiagnostic) {
 	if len(accepted) == 0 {
 		return accepted, nil
@@ -2479,6 +2741,7 @@ func (r *RepositoryScanReconciler) ingestMapperTask(ctx context.Context, scan *c
 			incrementalSelection := run.Mode == scanModeIncremental && artifact.ChangedFilesComputed
 			annotateChangedMetadata := artifact.ChangedFilesComputed && (run.Mode == scanModeIncremental || run.Mode == scanModeManual)
 			skippedSlices := 0
+			preparedSlices := make([]store.ReviewSlice, 0, len(artifact.Slices))
 			for i := range artifact.Slices {
 				slice := artifact.Slices[i]
 				slice.Namespace = scan.Namespace
@@ -2495,10 +2758,24 @@ func (r *RepositoryScanReconciler) ingestMapperTask(ctx context.Context, scan *c
 						skippedSlices++
 					}
 				}
-				if err := r.preserveCurrentRunReviewSliceTerminalState(ctx, scan, &slice); err != nil {
+				contextJSON, contextHash, contextProblem, err := r.loadMapperReviewContext(ctx, task, slice.ID)
+				if err != nil {
 					return err
 				}
-				if err := r.SecurityStore.UpsertReviewSlice(ctx, &slice); err != nil {
+				if contextProblem != "" {
+					run.ErrorMessage = "mapper stage failed: " + contextProblem
+					return r.refreshScanRunStatus(ctx, scan, run, run.ID, false)
+				}
+				slice.ReviewContextJSON = contextJSON
+				slice.ReviewContextHash = contextHash
+				preparedSlices = append(preparedSlices, slice)
+			}
+			for i := range preparedSlices {
+				slice := &preparedSlices[i]
+				if err := r.preserveCurrentRunReviewSliceTerminalState(ctx, scan, slice); err != nil {
+					return err
+				}
+				if err := r.SecurityStore.UpsertReviewSlice(ctx, slice); err != nil {
 					return err
 				}
 			}
@@ -2534,7 +2811,7 @@ func (r *RepositoryScanReconciler) ingestMapperTask(ctx context.Context, scan *c
 			}
 		}
 	} else {
-		run.ErrorMessage = r.pipelineTaskSummary(ctx, task, "mapper stage failed")
+		run.ErrorMessage = r.pipelineTaskFailureSummary(ctx, task)
 	}
 
 	return r.refreshScanRunStatus(ctx, scan, run, run.ID, false)
@@ -2601,42 +2878,55 @@ func (r *RepositoryScanReconciler) ingestValidationTask(ctx context.Context, sca
 	}
 
 	if task.Status.Phase == corev1alpha1.TaskPhaseSucceeded {
-		artifacts, validationProblem, err := r.loadValidationTaskArtifacts(ctx, task)
-		if err != nil {
-			return err
+		validationProblem := ""
+		if strings.TrimSpace(task.Labels[labels.LabelSecurityScanID]) != strings.TrimSpace(finding.ScanRunID) {
+			validationProblem = "validation task scan identity does not match finding"
+		}
+		policy, policyErr := security.LoadScannerPolicy(ctx, r.Client, scan.Namespace, scan.Spec)
+		if policyErr != nil {
+			return policyErr
+		}
+		var artifact *security.ValidationArtifact
+		if validationProblem == "" {
+			result, resultProblem, err := r.loadAgentTaskResult(ctx, task)
+			if err != nil {
+				return err
+			}
+			validationProblem = resultProblem
+			if validationProblem == "" {
+				artifact, err = security.ParseValidationResult(result, security.ValidationResultExpectation{
+					Binding: security.AgentResultBinding{
+						RepositoryScan: scan.Name,
+						ScanID:         finding.ScanRunID,
+						PolicyDigest:   policy.Digest,
+					},
+					Finding: finding,
+				})
+				if err != nil {
+					validationProblem = err.Error()
+				}
+			}
 		}
 		if validationProblem != "" {
 			finding.ValidationStatus = findingValidationStatusFailed
-			finding.ValidationJSON = fmt.Sprintf(
-				"{\"status\":\"failed\",\"summary\":%q}",
-				validationProblem,
-			)
-		} else if artifacts != nil {
-			status := strings.TrimSpace(artifacts.artifact.Status)
-			if status == "" {
-				status = findingValidationStatusValidated
+			failure := security.ValidationArtifact{
+				Version:   1,
+				FindingID: finding.ID,
+				Status:    findingValidationStatusFailed,
+				Summary:   validationProblem,
 			}
-			finding.ValidationStatus = status
-			finding.ValidationJSON = artifacts.rawJSON
-			for _, ref := range artifacts.artifact.Evidence {
-				if ref.Kind == "artifact" && ref.TaskName == "" {
-					ref.TaskName = task.Name
-				}
-				finding.Evidence = mergeEvidenceRefs(finding.Evidence, ref)
+			data, _ := json.Marshal(failure)
+			finding.ValidationJSON = string(data)
+		} else if artifact != nil {
+			finding.ValidationStatus = strings.TrimSpace(artifact.Status)
+			data, err := json.Marshal(artifact)
+			if err != nil {
+				return err
 			}
-			finding.Evidence = mergeEvidenceRefs(finding.Evidence, store.FindingEvidenceRef{
-				Kind:     "artifact",
-				TaskName: task.Name,
-				Name:     security.ArtifactValidation,
-				Label:    "Validation JSON",
-			})
-			if artifacts.transcript != "" {
-				finding.Evidence = mergeEvidenceRefs(finding.Evidence, store.FindingEvidenceRef{
-					Kind:     "artifact",
-					TaskName: task.Name,
-					Name:     security.ArtifactValidationText,
-					Label:    "Validation transcript",
-				})
+			finding.ValidationJSON = string(data)
+			for _, ref := range artifact.Evidence {
+				ref.TaskName = task.Name
+				finding.Evidence = mergeEvidenceRefs(finding.Evidence, ref)
 			}
 		}
 	} else {
@@ -2655,6 +2945,13 @@ type patchVerificationResult struct {
 	summaryArtifact string
 }
 
+type securityPatchPublicationReceipt struct {
+	branch      string
+	prNumber    int
+	prURL       string
+	publication *store.PatchPublicationEvidence
+}
+
 func patchArtifactNames(findingID string) (string, string) {
 	return fmt.Sprintf("security-patch-%s.diff", findingID), fmt.Sprintf("security-patch-%s.json", findingID)
 }
@@ -2663,36 +2960,10 @@ func patchTaskRequiresArtifactVerification(task *corev1alpha1.Task, findingID st
 	return task != nil && strings.TrimSpace(findingID) != ""
 }
 
-func normalizedPatchDiff(diff string) string {
-	diff = strings.ReplaceAll(diff, "\r\n", "\n")
-	diff = strings.ReplaceAll(diff, "\r", "\n")
-	lines := strings.Split(diff, "\n")
-	normalized := make([]string, 0, len(lines))
-	for _, line := range lines {
-		if strings.HasPrefix(line, "index ") {
-			continue
-		}
-		normalized = append(normalized, line)
-	}
-	for len(normalized) > 0 && strings.TrimSpace(normalized[0]) == "" {
-		normalized = normalized[1:]
-	}
-	for len(normalized) > 0 && strings.TrimSpace(normalized[len(normalized)-1]) == "" {
-		normalized = normalized[:len(normalized)-1]
-	}
-	return strings.Join(normalized, "\n")
-}
-
-func (r *RepositoryScanReconciler) verifyPatchTaskArtifacts(ctx context.Context, scan *corev1alpha1.RepositoryScan, task *corev1alpha1.Task, findingID string, sr *common.StructuredResult) (patchVerificationResult, string, error) {
+func (r *RepositoryScanReconciler) verifyPatchTaskArtifacts(ctx context.Context, scan *corev1alpha1.RepositoryScan, task *corev1alpha1.Task, findingID string) (patchVerificationResult, string, error) {
 	if r.ArtifactStore == nil {
 		return patchVerificationResult{}, "artifact store is not configured", nil
 	}
-	if sr == nil {
-		return patchVerificationResult{}, "structured task result is missing", nil
-	}
-	if strings.TrimSpace(sr.Diff) == "" {
-		return patchVerificationResult{}, "structured task result does not include a workspace diff", nil
-	}
 
 	diffName, summaryName := patchArtifactNames(findingID)
 	diffData, _, err := r.ArtifactStore.GetArtifact(ctx, task.Namespace, task.Name, diffName)
@@ -2722,15 +2993,15 @@ func (r *RepositoryScanReconciler) verifyPatchTaskArtifacts(ctx context.Context,
 	if strings.TrimSpace(summary.FindingID) != findingID {
 		return patchVerificationResult{}, fmt.Sprintf("%s findingId does not match finding", summaryName), nil
 	}
-	if !sameStringSet(rootRelativePatchSummaryFiles(summary.ChangedFiles, scan), sr.Files) {
-		return patchVerificationResult{}, "patch summary changedFiles do not match actual workspace changed files", nil
-	}
-	artifactDiff := normalizedPatchDiff(string(diffData))
-	if artifactDiff == "" {
+	if strings.TrimSpace(string(diffData)) == "" {
 		return patchVerificationResult{}, "patch diff artifact is empty", nil
 	}
-	if artifactDiff != normalizedPatchDiff(sr.Diff) {
-		return patchVerificationResult{}, "patch diff artifact does not match actual workspace diff", nil
+	patchFiles, err := repositoryMonitorPathsFromPatch(string(diffData))
+	if err != nil {
+		return patchVerificationResult{}, fmt.Sprintf("%s is not a canonical git diff: %v", diffName, err), nil
+	}
+	if !sameStringSet(rootRelativePatchSummaryFiles(summary.ChangedFiles, scan), patchFiles) {
+		return patchVerificationResult{}, "patch summary changedFiles do not match the patch diff", nil
 	}
 	return patchVerificationResult{diffArtifact: diffName, summaryArtifact: summaryName}, "", nil
 }
@@ -2790,49 +3061,182 @@ func sameStringSet(left, right []string) bool {
 	return true
 }
 
-func (r *RepositoryScanReconciler) updatePatchProposalFromSucceededTask(ctx context.Context, scan *corev1alpha1.RepositoryScan, task *corev1alpha1.Task, findingID string, proposal *store.PatchProposal) error {
-	switch {
-	case r.ResultStore == nil:
-		proposal.Status = scanRunPhasePending
-		return nil
-	case task.Status.ResultRef == nil || !task.Status.ResultRef.Available:
-		proposal.Status = scanRunPhasePending
-		return nil
+//nolint:gocyclo // Keeping the durable publication tuple checks together makes this fail-closed trust boundary auditable.
+func (r *RepositoryScanReconciler) verifiedSecurityPatchPublication(
+	ctx context.Context,
+	scan *corev1alpha1.RepositoryScan,
+	task *corev1alpha1.Task,
+	requestedBranch string,
+) (securityPatchPublicationReceipt, string, error) {
+	if scan == nil || task == nil || task.Spec.Workspace == nil {
+		return securityPatchPublicationReceipt{}, "governed publication workspace is missing", nil
 	}
-
-	result, err := r.ResultStore.GetResult(ctx, task.Namespace, task.Name)
+	workspace := task.Spec.Workspace
+	if task.Spec.Type != corev1alpha1.TaskTypeAgent || workspace.Intent != corev1alpha1.WorkspaceIntentWrite || !workspace.CreatePR {
+		return securityPatchPublicationReceipt{}, "patch task did not request governed pull request publication", nil
+	}
+	requestedBranch = strings.TrimSpace(requestedBranch)
+	if requestedBranch == "" || strings.TrimSpace(workspace.PushBranch) != requestedBranch {
+		return securityPatchPublicationReceipt{}, "patch publication branch does not match the requested branch", nil
+	}
+	expectedPublicationRepo := security.CanonicalRepositoryCloneURL(scan.Spec.ForkRepo)
+	if expectedPublicationRepo == "" {
+		expectedPublicationRepo = security.CanonicalRepositoryCloneURL(scan.Spec.RepoURL)
+	}
+	// Patch Task workspaces are constructed from the canonical HTTPS clone
+	// URL, so compare both sides in canonical form to keep SSH-specified scans
+	// bound to the same repository identity.
+	if security.CanonicalRepositoryCloneURL(workspace.GitRepo) != security.CanonicalRepositoryCloneURL(scan.Spec.RepoURL) ||
+		security.CanonicalRepositoryCloneURL(workspace.PublicationGitRepo) != expectedPublicationRepo {
+		return securityPatchPublicationReceipt{}, "patch publication repositories do not match the repository scan", nil
+	}
+	expectedBase := strings.TrimPrefix(strings.TrimSpace(scan.Spec.PRBaseBranch), "refs/heads/")
+	if expectedBase == "" {
+		expectedBase = strings.TrimPrefix(strings.TrimSpace(security.EffectiveBranch(scan)), "refs/heads/")
+	}
+	if expectedBase == "" || strings.TrimPrefix(strings.TrimSpace(workspace.PRBaseBranch), "refs/heads/") != expectedBase {
+		return securityPatchPublicationReceipt{}, "patch pull request base branch does not match the repository scan", nil
+	}
+	if r.PublicationStore == nil {
+		return securityPatchPublicationReceipt{}, "publication store is not configured", nil
+	}
+	if task.UID == "" || task.Status.Execution.Attempt < 1 || strings.TrimSpace(task.Status.Execution.PromptID) == "" {
+		return securityPatchPublicationReceipt{}, "patch task publication identity is incomplete", nil
+	}
+	publicationID := publicationIDForTask(task)
+	publication, err := r.PublicationStore.GetPublication(ctx, publicationID)
 	if err != nil {
 		if errors.Is(err, store.ErrNotFound) {
-			proposal.Status = scanRunPhasePending
+			return securityPatchPublicationReceipt{}, "durable patch publication record is missing", nil
+		}
+		return securityPatchPublicationReceipt{}, "", err
+	}
+	if publication.ID != publicationID || publication.Namespace != task.Namespace || publication.TaskUID != string(task.UID) ||
+		publication.Attempt != int64(task.Status.Execution.Attempt) || publication.PromptID != strings.TrimSpace(task.Status.Execution.PromptID) ||
+		publication.SessionUID != "" {
+		return securityPatchPublicationReceipt{}, "durable patch publication identity does not match the task", nil
+	}
+	sourceOwner, sourceRepo, err := security.ParseGitHubRepositoryURL(scan.Spec.RepoURL)
+	if err != nil {
+		return securityPatchPublicationReceipt{}, "repository scan source is not a canonical GitHub repository", nil
+	}
+	targetOwner, targetRepo, err := security.ParseGitHubRepositoryURL(expectedPublicationRepo)
+	if err != nil {
+		return securityPatchPublicationReceipt{}, "repository scan publication target is not a canonical GitHub repository", nil
+	}
+	sourceRepositoryID := "github.com/" + sourceOwner + "/" + sourceRepo
+	targetRepositoryID := "github.com/" + targetOwner + "/" + targetRepo
+	targetRef, err := canonicalWorkspaceBranchRef(requestedBranch)
+	if err != nil {
+		return securityPatchPublicationReceipt{}, "patch publication branch is invalid", nil
+	}
+	baseRef, err := canonicalWorkspaceBranchRef(expectedBase)
+	if err != nil {
+		return securityPatchPublicationReceipt{}, "patch pull request base branch is invalid", nil
+	}
+	if publication.State != store.PublicationVerifiedExact || publication.PreparedReceipt == nil || publication.PublishReceipt == nil ||
+		publication.VerificationReceipt == nil || publication.PRIntent == nil || publication.PullRequestReceipt == nil {
+		return securityPatchPublicationReceipt{}, "durable patch publication is not fully verified with a pull request", nil
+	}
+	prepared := publication.PreparedReceipt
+	published := publication.PublishReceipt
+	verification := publication.VerificationReceipt
+	intent := publication.PRIntent
+	receipt := publication.PullRequestReceipt
+	if !strings.EqualFold(publication.SourceRepositoryID, sourceRepositoryID) ||
+		!strings.EqualFold(publication.TargetRepositoryID, targetRepositoryID) || publication.TargetRef != targetRef ||
+		publication.SourceRef != publication.SourceBaselineSHA || store.ValidateGitObjectID("patch source baseline", publication.SourceBaselineSHA) != nil ||
+		store.ValidateCanonicalDigest("patch publication artifact digest", publication.ArtifactDigest) != nil {
+		return securityPatchPublicationReceipt{}, "durable patch publication repository or source binding does not match the scan", nil
+	}
+	expectedRemote := strings.TrimSpace(workspace.ExpectedRemoteSHA)
+	if expectedRemote == "" {
+		if !publication.Baseline.Absent || publication.Baseline.SHA != "" {
+			return securityPatchPublicationReceipt{}, "durable patch publication baseline does not match the absent requested branch", nil
+		}
+	} else if publication.Baseline.Absent || publication.Baseline.SHA != expectedRemote {
+		return securityPatchPublicationReceipt{}, "durable patch publication baseline does not match the requested branch head", nil
+	}
+	if published.TargetRepositoryID != publication.TargetRepositoryID || published.TargetRef != publication.TargetRef ||
+		!published.RemoteBefore.Equal(publication.Baseline) || published.ExpectedCommitSHA != prepared.CommitSHA ||
+		verification.Outcome != store.PublicationVerifiedExact || verification.ExpectedCommitSHA != prepared.CommitSHA ||
+		verification.ObservedRemote.Absent || verification.ObservedRemote.SHA != prepared.CommitSHA {
+		return securityPatchPublicationReceipt{}, "durable patch publication receipts do not prove the exact remote head", nil
+	}
+	if !strings.EqualFold(intent.BaseRepositoryID, sourceRepositoryID) || intent.BaseRef != baseRef ||
+		!strings.EqualFold(intent.HeadRepositoryID, targetRepositoryID) || intent.HeadRef != targetRef ||
+		intent.PublicationGeneration != publication.Generation || intent.ExpectedHeadSHA != prepared.CommitSHA ||
+		receipt.State != "Open" || receipt.HeadSHA != prepared.CommitSHA || receipt.HeadSHA != intent.ExpectedHeadSHA ||
+		store.ValidateCanonicalDigest("patch pull request intent key", receipt.IntentKey) != nil {
+		return securityPatchPublicationReceipt{}, "durable patch pull request receipt does not match the exact publication tuple", nil
+	}
+	prNumber, ok := pullRequestNumberFromForgeID(receipt.ForgeID)
+	if !ok {
+		return securityPatchPublicationReceipt{}, "durable patch pull request forge identity is invalid", nil
+	}
+	expectedURL := strings.TrimSuffix(strings.TrimSuffix(security.CanonicalRepositoryCloneURL(scan.Spec.RepoURL), "/"), ".git") +
+		"/pull/" + strconv.FormatInt(prNumber, 10)
+	if !strings.EqualFold(strings.TrimSpace(receipt.URL), expectedURL) {
+		return securityPatchPublicationReceipt{}, "durable patch pull request URL does not match the repository and number", nil
+	}
+	evidence := &store.PatchPublicationEvidence{
+		PublicationID:      publication.ID,
+		ArtifactDigest:     publication.ArtifactDigest,
+		SourceRepositoryID: publication.SourceRepositoryID,
+		SourceRef:          publication.SourceRef,
+		SourceBaselineSHA:  publication.SourceBaselineSHA,
+		TargetRepositoryID: publication.TargetRepositoryID,
+		TargetRef:          publication.TargetRef,
+		ExpectedCommitSHA:  prepared.CommitSHA,
+		VerifiedRemoteSHA:  verification.ObservedRemote.SHA,
+		PRIntent:           *intent,
+		PRReceipt: store.PatchPullRequestEvidence{
+			IntentKey: receipt.IntentKey,
+			ForgeID:   receipt.ForgeID,
+			Number:    int(prNumber),
+			URL:       receipt.URL,
+			State:     receipt.State,
+			HeadSHA:   receipt.HeadSHA,
+		},
+	}
+	return securityPatchPublicationReceipt{
+		branch: requestedBranch, prNumber: int(prNumber), prURL: strings.TrimSpace(receipt.URL), publication: evidence,
+	}, "", nil
+}
+
+func (r *RepositoryScanReconciler) updatePatchProposalFromSucceededTask(ctx context.Context, scan *corev1alpha1.RepositoryScan, task *corev1alpha1.Task, findingID string, proposal *store.PatchProposal) error {
+	var verified patchVerificationResult
+	if patchTaskRequiresArtifactVerification(task, findingID) {
+		var reason string
+		var err error
+		verified, reason, err = r.verifyPatchTaskArtifacts(ctx, scan, task, findingID)
+		if err != nil {
+			return err
+		}
+		if reason != "" {
+			proposal.Status = scanRunPhaseFailed
 			return nil
 		}
+	}
+	requestedBranch := ""
+	if task.Spec.Workspace != nil {
+		requestedBranch = strings.TrimSpace(task.Spec.Workspace.PushBranch)
+	}
+	publication, reason, err := r.verifiedSecurityPatchPublication(ctx, scan, task, requestedBranch)
+	if err != nil {
 		return err
 	}
-
-	sr := common.ParseStructuredResult(string(result))
-	switch {
-	case strings.TrimSpace(sr.PushError) != "":
-		proposal.Status = scanRunPhaseFailed
-	case strings.TrimSpace(sr.PushBranch) == "":
+	if reason != "" {
 		proposal.Status = scanRunPhaseFailed
-	default:
-		var verified patchVerificationResult
-		if patchTaskRequiresArtifactVerification(task, findingID) {
-			var reason string
-			verified, reason, err = r.verifyPatchTaskArtifacts(ctx, scan, task, findingID, sr)
-			if err != nil {
-				return err
-			}
-			if reason != "" {
-				proposal.Status = scanRunPhaseFailed
-				return nil
-			}
-		}
-		proposal.Branch = strings.TrimSpace(sr.PushBranch)
-		proposal.DiffArtifact = verified.diffArtifact
-		proposal.SummaryArtifact = verified.summaryArtifact
-		proposal.Status = scanRunPhaseSucceeded
+		return nil
 	}
+	proposal.Branch = publication.branch
+	proposal.DiffArtifact = verified.diffArtifact
+	proposal.SummaryArtifact = verified.summaryArtifact
+	proposal.PRNumber = &publication.prNumber
+	proposal.PRURL = publication.prURL
+	proposal.PublicationEvidence = publication.publication
+	proposal.Status = patchProposalStatusPROpened
 	return nil
 }
 
@@ -2862,8 +3266,6 @@ func (r *RepositoryScanReconciler) ingestPatchTask(ctx context.Context, scan *co
 	requestedBranch := ""
 	if task.Spec.Workspace != nil {
 		requestedBranch = strings.TrimSpace(task.Spec.Workspace.PushBranch)
-	} else if task.Spec.AgentRuntime != nil && task.Spec.AgentRuntime.Workspace != nil {
-		requestedBranch = strings.TrimSpace(task.Spec.AgentRuntime.Workspace.PushBranch)
 	}
 	if requestedBranch != "" && strings.TrimSpace(proposal.Branch) == "" {
 		proposal.Branch = requestedBranch
@@ -2875,7 +3277,7 @@ func (r *RepositoryScanReconciler) ingestPatchTask(ctx context.Context, scan *co
 		}
 	}
 
-	if r.ArtifactStore != nil && proposal.Status != scanRunPhaseSucceeded {
+	if r.ArtifactStore != nil && proposal.Status != scanRunPhaseSucceeded && proposal.Status != patchProposalStatusPROpened {
 		artifacts, err := r.ArtifactStore.ListArtifacts(ctx, task.Namespace, task.Name)
 		if err == nil {
 			for _, artifact := range artifacts {
@@ -2889,8 +3291,15 @@ func (r *RepositoryScanReconciler) ingestPatchTask(ctx context.Context, scan *co
 		}
 	}
 
-	if err := r.SecurityStore.UpdatePatchProposal(ctx, proposal); err != nil {
-		return err
+	if proposal.Status == patchProposalStatusPROpened && proposal.PublicationEvidence != nil {
+		if err := r.SecurityStore.BindPatchProposalPublicationEvidence(ctx, proposal); err != nil {
+			return err
+		}
+	} else {
+		proposal.PublicationEvidence = nil
+		if err := r.SecurityStore.UpdatePatchProposal(ctx, proposal); err != nil {
+			return err
+		}
 	}
 
 	finding, err := r.SecurityStore.GetFinding(ctx, scan.Namespace, findingID)
@@ -2899,6 +3308,10 @@ func (r *RepositoryScanReconciler) ingestPatchTask(ctx context.Context, scan *co
 	}
 	finding.PatchProposalID = proposal.ID
 	switch proposal.Status {
+	case patchProposalStatusPROpened:
+		finding.State = findingStatePROpen
+		finding.PRNumber = proposal.PRNumber
+		finding.PRURL = proposal.PRURL
 	case scanRunPhaseSucceeded:
 		finding.State = findingStatePatchReady
 	case scanRunPhasePending:
diff --git a/internal/controller/repositoryscan_controller_test.go b/internal/controller/repositoryscan_controller_test.go
index 9fae53606..2047ccdf4 100644
--- a/internal/controller/repositoryscan_controller_test.go
+++ b/internal/controller/repositoryscan_controller_test.go
@@ -21,8 +21,11 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
 	"github.com/orka-agents/orka/internal/labels"
@@ -32,7 +35,10 @@ import (
 	"github.com/orka-agents/orka/workers/common"
 )
 
-const readyReasonScanFailed = "ScanFailed"
+const (
+	readyReasonScanFailed = "ScanFailed"
+	testPatchDiffHeader   = "diff --git a/app.py b/app.py"
+)
 
 func TestRepositoryScanConditionMessageUsesFallback(t *testing.T) {
 	got := repositoryScanConditionMessage("  \n\t ", "scan completed successfully")
@@ -68,6 +74,17 @@ func TestApplyScanRunProgressPreservesTerminalErrorWithActiveTasks(t *testing.T)
 	}
 }
 
+func TestApplyScanRunProgressStampsTerminalErrorCompletion(t *testing.T) {
+	completed := mustParseTime(t, "2026-05-04T03:02:01Z")
+	run := &storepkg.ScanRun{ErrorMessage: "terminal result binding mismatch"}
+
+	applyScanRunProgress(run, scanRunProgress{latestCompletion: &completed})
+
+	if run.Phase != scanRunPhaseFailed || run.Summary != run.ErrorMessage || run.CompletedAt == nil || !run.CompletedAt.Equal(completed) {
+		t.Fatalf("run = %#v, want terminal failure stamped with pipeline completion", run)
+	}
+}
+
 func TestIngestMapperTaskSkipsFailedRun(t *testing.T) {
 	reconciler := &RepositoryScanReconciler{}
 	run := &storepkg.ScanRun{Phase: scanRunPhaseFailed, ErrorMessage: "scanner policy digest changed"}
@@ -116,12 +133,22 @@ func TestLatestTerminalScanTaskPrefersNewestCompletedScan(t *testing.T) {
 		},
 		{
 			ObjectMeta: metav1.ObjectMeta{
-				Name:              "running-scan",
+				Name:              "newest-cancelled-scan",
 				CreationTimestamp: metav1.NewTime(mustParseTime(t, "2026-04-10T05:00:00Z")),
 				Labels: map[string]string{
 					labels.LabelSecurityTarget: "kaset",
 				},
 			},
+			Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhaseCancelled},
+		},
+		{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:              "running-scan",
+				CreationTimestamp: metav1.NewTime(mustParseTime(t, "2026-04-10T05:01:00Z")),
+				Labels: map[string]string{
+					labels.LabelSecurityTarget: "kaset",
+				},
+			},
 			Status: corev1alpha1.TaskStatus{},
 		},
 	}
@@ -130,8 +157,183 @@ func TestLatestTerminalScanTaskPrefersNewestCompletedScan(t *testing.T) {
 	if got == nil {
 		t.Fatal("latestTerminalScanTask() = nil, want newest terminal scan task")
 	}
-	if got.Name != "newest-succeeded-scan" {
-		t.Fatalf("latestTerminalScanTask() = %q, want %q", got.Name, "newest-succeeded-scan")
+	if got.Name != "newest-cancelled-scan" {
+		t.Fatalf("latestTerminalScanTask() = %q, want %q", got.Name, "newest-cancelled-scan")
+	}
+}
+
+//nolint:gocyclo // This table-driven regression intentionally verifies terminal state across the run, scan, slice, and retry paths.
+func TestRepositoryScanReconcileTreatsCancelledPipelineTasksAsTerminalFailures(t *testing.T) {
+	tests := []struct {
+		name        string
+		stage       string
+		sliceID     string
+		wantMessage string
+	}{
+		{name: "threat model", stage: security.StageThreatModel, wantMessage: "threat model stage cancelled"},
+		{name: "mapper", stage: security.StageMapper, wantMessage: "mapper stage cancelled"},
+		{name: "review", stage: security.StageReview, sliceID: "slice_api", wantMessage: "review stage cancelled"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+			securityStore := setupControllerSQLiteStore(t)
+			scheme := runtime.NewScheme()
+			if err := corev1alpha1.AddToScheme(scheme); err != nil {
+				t.Fatalf("AddToScheme() error = %v", err)
+			}
+
+			nameSuffix := strings.ReplaceAll(tt.stage, "-", "")
+			scanName := "cancelled-" + nameSuffix
+			runID := "scan_cancelled_" + nameSuffix
+			taskName := scanName + "-" + tt.stage
+			completed := metav1.NewTime(mustParseTime(t, "2026-05-08T03:04:05Z"))
+			scan := &corev1alpha1.RepositoryScan{
+				TypeMeta: metav1.TypeMeta{APIVersion: corev1alpha1.GroupVersion.String(), Kind: "RepositoryScan"},
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      scanName,
+					Namespace: defaultNS,
+				},
+				Spec: corev1alpha1.RepositoryScanSpec{
+					RepoURL:          "https://github.com/example/repo",
+					AnalysisAgentRef: corev1alpha1.AgentReference{Name: "scan-reviewer"},
+				},
+				Status: corev1alpha1.RepositoryScanStatus{
+					Phase:            repositoryScanPhaseScanning,
+					LastScanID:       runID,
+					LastScanTaskName: taskName,
+				},
+			}
+			taskLabels := map[string]string{
+				labels.LabelSecurityTarget: labels.SelectorValue(scanName),
+				labels.LabelSecurityScanID: runID,
+				labels.LabelSecurityMode:   scanModeManual,
+				labels.LabelSecurityStage:  tt.stage,
+			}
+			if tt.sliceID != "" {
+				taskLabels[labels.LabelSecuritySliceID] = tt.sliceID
+			}
+			task := &corev1alpha1.Task{
+				TypeMeta: metav1.TypeMeta{APIVersion: corev1alpha1.GroupVersion.String(), Kind: "Task"},
+				ObjectMeta: metav1.ObjectMeta{
+					Name:              taskName,
+					Namespace:         defaultNS,
+					CreationTimestamp: metav1.NewTime(completed.Add(-time.Minute)),
+					Labels:            taskLabels,
+				},
+				Status: corev1alpha1.TaskStatus{
+					Phase:          corev1alpha1.TaskPhaseCancelled,
+					CompletionTime: &completed,
+				},
+			}
+			run := &storepkg.ScanRun{
+				ID:             runID,
+				Namespace:      defaultNS,
+				RepositoryScan: scanName,
+				TaskName:       taskName,
+				Mode:           scanModeManual,
+				Phase:          scanRunPhaseRunning,
+				StartedAt:      completed.Add(-2 * time.Minute),
+			}
+			if err := securityStore.CreateScanRun(ctx, run); err != nil {
+				t.Fatalf("CreateScanRun() error = %v", err)
+			}
+			if tt.sliceID != "" {
+				if err := securityStore.UpsertReviewSlice(ctx, &storepkg.ReviewSlice{
+					ID:             tt.sliceID,
+					Namespace:      defaultNS,
+					RepositoryScan: scanName,
+					Status:         reviewSliceStatusPending,
+					LastScanRunID:  runID,
+				}); err != nil {
+					t.Fatalf("UpsertReviewSlice() error = %v", err)
+				}
+			}
+
+			cl := fake.NewClientBuilder().
+				WithScheme(scheme).
+				WithStatusSubresource(&corev1alpha1.RepositoryScan{}).
+				WithObjects(scan, task).
+				Build()
+			reconciler := &RepositoryScanReconciler{
+				Client:        cl,
+				Scheme:        scheme,
+				SecurityStore: securityStore,
+			}
+			req := ctrl.Request{NamespacedName: client.ObjectKeyFromObject(scan)}
+
+			assertTerminalFailure := func() (*storepkg.ScanRun, metav1.Condition) {
+				t.Helper()
+				storedRun, err := securityStore.GetScanRun(ctx, defaultNS, runID)
+				if err != nil {
+					t.Fatalf("GetScanRun() error = %v", err)
+				}
+				if storedRun.Phase != scanRunPhaseFailed || storedRun.ErrorMessage != tt.wantMessage || storedRun.Summary != tt.wantMessage {
+					t.Fatalf("run phase/error/summary = %q/%q/%q, want failed/%q/%q", storedRun.Phase, storedRun.ErrorMessage, storedRun.Summary, tt.wantMessage, tt.wantMessage)
+				}
+				if storedRun.CompletedAt == nil || !storedRun.CompletedAt.Equal(completed.Time) {
+					t.Fatalf("run.CompletedAt = %v, want %v", storedRun.CompletedAt, completed.Time)
+				}
+
+				current := &corev1alpha1.RepositoryScan{}
+				if err := cl.Get(ctx, client.ObjectKeyFromObject(scan), current); err != nil {
+					t.Fatalf("Get(RepositoryScan) error = %v", err)
+				}
+				condition := meta.FindStatusCondition(current.Status.Conditions, "Ready")
+				if current.Status.Phase != repositoryScanPhaseError || condition == nil || condition.Status != metav1.ConditionFalse || condition.Reason != readyReasonScanFailed || condition.Message != tt.wantMessage {
+					t.Fatalf("scan status/condition = %q/%#v, want Error/ScanFailed %q", current.Status.Phase, condition, tt.wantMessage)
+				}
+				if current.Status.LastScanAt == nil || !current.Status.LastScanAt.Time.Equal(completed.Time) {
+					t.Fatalf("scan.Status.LastScanAt = %v, want %v", current.Status.LastScanAt, completed.Time)
+				}
+				if current.Status.LastSuccessfulScanAt != nil {
+					t.Fatalf("scan.Status.LastSuccessfulScanAt = %v, want nil", current.Status.LastSuccessfulScanAt)
+				}
+				if tt.sliceID != "" {
+					reviewSlice, err := securityStore.GetReviewSlice(ctx, defaultNS, scanName, tt.sliceID)
+					if err != nil {
+						t.Fatalf("GetReviewSlice() error = %v", err)
+					}
+					if reviewSlice.Status != reviewSliceStatusFailed {
+						t.Fatalf("review slice status = %q, want %q", reviewSlice.Status, reviewSliceStatusFailed)
+					}
+				}
+				return storedRun, *condition
+			}
+
+			result, err := reconciler.Reconcile(ctx, req)
+			if err != nil {
+				t.Fatalf("first Reconcile() error = %v", err)
+			}
+			if result != (ctrl.Result{}) {
+				t.Fatalf("first Reconcile() result = %#v, want no requeue", result)
+			}
+			firstRun, firstCondition := assertTerminalFailure()
+
+			result, err = reconciler.Reconcile(ctx, req)
+			if err != nil {
+				t.Fatalf("second Reconcile() error = %v", err)
+			}
+			if result != (ctrl.Result{}) {
+				t.Fatalf("second Reconcile() result = %#v, want no requeue", result)
+			}
+			secondRun, secondCondition := assertTerminalFailure()
+			if secondRun.ErrorMessage != firstRun.ErrorMessage || secondRun.Summary != firstRun.Summary || secondRun.CompletedAt == nil || firstRun.CompletedAt == nil || !secondRun.CompletedAt.Equal(*firstRun.CompletedAt) {
+				t.Fatalf("second reconcile changed terminal run: first=%#v second=%#v", firstRun, secondRun)
+			}
+			if !secondCondition.LastTransitionTime.Time.Equal(firstCondition.LastTransitionTime.Time) {
+				t.Fatalf("Ready transition time changed across idempotent reconcile: first=%v second=%v", firstCondition.LastTransitionTime, secondCondition.LastTransitionTime)
+			}
+
+			var tasks corev1alpha1.TaskList
+			if err := cl.List(ctx, &tasks, client.InNamespace(defaultNS), client.MatchingLabels(map[string]string{labels.LabelSecurityScanID: runID})); err != nil {
+				t.Fatalf("List(Tasks) error = %v", err)
+			}
+			if len(tasks.Items) != 1 {
+				t.Fatalf("len(tasks) = %d, want 1 after idempotent reconcile", len(tasks.Items))
+			}
+		})
 	}
 }
 
@@ -260,6 +462,590 @@ func newSucceededSecurityTask(name, scanID, stage string, completed metav1.Time)
 	}
 }
 
+func testReviewContext(t *testing.T, sliceID string, paths ...string) (security.ReviewContextManifest, string, string) {
+	t.Helper()
+	prompt := "Trusted mapper review context for " + sliceID + "\n"
+	manifest := security.ReviewContextManifest{
+		SchemaVersion:     security.SchemaVersionReviewContext,
+		SliceID:           sliceID,
+		PromptBytes:       len(prompt),
+		ApproximateTokens: (len(prompt) + 3) / 4,
+		Prompt:            prompt,
+	}
+	seen := map[string]struct{}{}
+	for _, path := range paths {
+		if path == "" {
+			continue
+		}
+		if _, ok := seen[path]; ok {
+			continue
+		}
+		seen[path] = struct{}{}
+		manifest.IncludedFiles = append(manifest.IncludedFiles, security.ReviewContextIncludedFile{
+			Path:               path,
+			Role:               "owned",
+			IncludedLineRanges: []security.ReviewContextLineRange{{StartLine: 1, EndLine: 10000}},
+			Readable:           true,
+		})
+	}
+	data, err := json.Marshal(manifest)
+	if err != nil {
+		t.Fatalf("json.Marshal(review context) error = %v", err)
+	}
+	parsed, digest, err := security.ParseTrustedReviewContextManifest(data)
+	if err != nil {
+		t.Fatalf("ParseTrustedReviewContextManifest() error = %v", err)
+	}
+	canonical, err := json.Marshal(parsed)
+	if err != nil {
+		t.Fatalf("json.Marshal(canonical review context) error = %v", err)
+	}
+	return *parsed, string(canonical), digest
+}
+
+func reviewSlicePaths(slice storepkg.ReviewSlice) []string {
+	paths := make([]string, 0, len(slice.OwnedFiles)+len(slice.ContextFiles)+len(slice.Tests))
+	for _, file := range slice.OwnedFiles {
+		paths = append(paths, file.Path)
+	}
+	for _, file := range slice.ContextFiles {
+		paths = append(paths, file.Path)
+	}
+	for _, test := range slice.Tests {
+		paths = append(paths, test.Path)
+	}
+	return paths
+}
+
+func saveMapperArtifactWithContexts(t *testing.T, store *sqlitestore.Store, task *corev1alpha1.Task, artifact security.ReviewSlicesArtifact) {
+	t.Helper()
+	ctx := context.Background()
+	data, err := json.Marshal(artifact)
+	if err != nil {
+		t.Fatalf("json.Marshal(review slices) error = %v", err)
+	}
+	if err := store.SaveArtifact(ctx, task.Namespace, task.Name, security.ArtifactSlices, "application/json", data); err != nil {
+		t.Fatalf("SaveArtifact(slices) error = %v", err)
+	}
+	for _, slice := range artifact.Slices {
+		_, contextJSON, _ := testReviewContext(t, slice.ID, reviewSlicePaths(slice)...)
+		if err := store.SaveArtifact(ctx, task.Namespace, task.Name, security.ReviewContextArtifactName(slice.ID), "application/json", []byte(contextJSON)); err != nil {
+			t.Fatalf("SaveArtifact(review context %s) error = %v", slice.ID, err)
+		}
+	}
+}
+
+func bindReviewSliceContext(t *testing.T, slice *storepkg.ReviewSlice) security.ReviewContextManifest {
+	t.Helper()
+	manifest, contextJSON, digest := testReviewContext(t, slice.ID, reviewSlicePaths(*slice)...)
+	slice.ReviewContextJSON = contextJSON
+	slice.ReviewContextHash = digest
+	return manifest
+}
+
+func saveFindingsTaskResult(
+	t *testing.T,
+	store *sqlitestore.Store,
+	task *corev1alpha1.Task,
+	repositoryScan, scanID, policyDigest, contextDigest, sliceID string,
+	findings security.FindingsV2Artifact,
+) {
+	t.Helper()
+	result := security.FindingsResultEnvelope{
+		SchemaVersion:  security.AgentResultSchemaVersion,
+		Kind:           security.AgentResultKindFindings,
+		RepositoryScan: repositoryScan,
+		ScanID:         scanID,
+		SliceID:        sliceID,
+		PolicyDigest:   policyDigest,
+		ContextDigest:  contextDigest,
+		Findings:       findings,
+	}
+	data, err := json.Marshal(result)
+	if err != nil {
+		t.Fatalf("json.Marshal(findings result) error = %v", err)
+	}
+	if err := store.SaveResult(context.Background(), task.Namespace, task.Name, data); err != nil {
+		t.Fatalf("SaveResult(findings) error = %v", err)
+	}
+	task.Status.ResultRef = &corev1alpha1.ResultReference{Available: true}
+}
+
+type reviewResultRetryFixture struct {
+	ctx        context.Context
+	store      *sqlitestore.Store
+	client     client.Client
+	reconciler *RepositoryScanReconciler
+	scan       *corev1alpha1.RepositoryScan
+	run        *storepkg.ScanRun
+	slice      *storepkg.ReviewSlice
+	sourceTask *corev1alpha1.Task
+}
+
+func newReviewResultRetryFixture(t *testing.T) *reviewResultRetryFixture {
+	t.Helper()
+	ctx := context.Background()
+	securityStore := setupControllerSQLiteStore(t)
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatalf("AddToScheme() error = %v", err)
+	}
+
+	scan := &corev1alpha1.RepositoryScan{
+		TypeMeta: metav1.TypeMeta{APIVersion: corev1alpha1.GroupVersion.String(), Kind: "RepositoryScan"},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "retry-scan",
+			Namespace: defaultNS,
+			UID:       types.UID("retry-scan-uid"),
+		},
+		Spec: corev1alpha1.RepositoryScanSpec{
+			RepoURL:          "https://github.com/example/repo",
+			AnalysisAgentRef: corev1alpha1.AgentReference{Name: "scan-reviewer"},
+		},
+		Status: corev1alpha1.RepositoryScanStatus{Phase: repositoryScanPhaseScanning, LastScanID: "scan_retry_result"},
+	}
+	policyDigest := security.ScannerPolicyDigest(security.ScannerPolicy{})
+	run := &storepkg.ScanRun{
+		ID:             "scan_retry_result",
+		Namespace:      defaultNS,
+		RepositoryScan: scan.Name,
+		TaskName:       "retry-scan-initial-threat-model",
+		Mode:           "initial",
+		Phase:          scanRunPhaseRunning,
+		PolicyDigest:   policyDigest,
+		StartedAt:      time.Now().Add(-time.Minute),
+	}
+	if err := securityStore.CreateScanRun(ctx, run); err != nil {
+		t.Fatalf("CreateScanRun() error = %v", err)
+	}
+	if err := securityStore.SaveThreatModel(ctx, &storepkg.ThreatModel{
+		Namespace:       defaultNS,
+		RepositoryScan:  scan.Name,
+		Content:         "# Threat model\n\nReview authentication boundaries.",
+		Source:          "generated",
+		GeneratedByScan: run.ID,
+	}); err != nil {
+		t.Fatalf("SaveThreatModel() error = %v", err)
+	}
+	reviewSlice := &storepkg.ReviewSlice{
+		SchemaVersion:  1,
+		ID:             "slice_api",
+		Namespace:      defaultNS,
+		RepositoryScan: scan.Name,
+		Source:         "deterministic-go-package",
+		Title:          "Go package internal/api",
+		Summary:        "API handlers",
+		Kind:           "package",
+		OwnedFiles:     []storepkg.ReviewSliceFile{{Path: "internal/api/security.go", Reason: "source"}},
+		Confidence:     "high",
+		Status:         reviewSliceStatusPending,
+		LastScanRunID:  run.ID,
+	}
+	bindReviewSliceContext(t, reviewSlice)
+	if err := securityStore.UpsertReviewSlice(ctx, reviewSlice); err != nil {
+		t.Fatalf("UpsertReviewSlice() error = %v", err)
+	}
+
+	sourceTask := &corev1alpha1.Task{
+		TypeMeta: metav1.TypeMeta{APIVersion: corev1alpha1.GroupVersion.String(), Kind: "Task"},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "retry-scan-review-source",
+			Namespace: defaultNS,
+			Labels: map[string]string{
+				labels.LabelManaged:         "true",
+				labels.LabelCreatedBy:       "repository-security",
+				labels.LabelSecurityTarget:  labels.SelectorValue(scan.Name),
+				labels.LabelSecurityScanID:  run.ID,
+				labels.LabelSecurityMode:    run.Mode,
+				labels.LabelSecurityStage:   security.StageReview,
+				labels.LabelSecuritySliceID: reviewSlice.ID,
+			},
+			Annotations: map[string]string{labels.AnnotationSecurityReviewAttempt: "0"},
+		},
+		Spec: corev1alpha1.TaskSpec{
+			Type:     corev1alpha1.TaskTypeAgent,
+			AgentRef: &corev1alpha1.AgentReference{Name: "poison-source-agent"},
+			Prompt:   "POISON SOURCE PROMPT MUST NOT BE COPIED",
+		},
+		Status: corev1alpha1.TaskStatus{
+			Phase:     corev1alpha1.TaskPhaseSucceeded,
+			ResultRef: &corev1alpha1.ResultReference{Available: true},
+		},
+	}
+	if err := controllerutil.SetControllerReference(scan, sourceTask, scheme); err != nil {
+		t.Fatalf("SetControllerReference() error = %v", err)
+	}
+	if err := securityStore.SaveResult(ctx, sourceTask.Namespace, sourceTask.Name, []byte(`{"not":"the required findings envelope"}`)); err != nil {
+		t.Fatalf("SaveResult(malformed) error = %v", err)
+	}
+	cl := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithStatusSubresource(&corev1alpha1.RepositoryScan{}).
+		WithObjects(scan, sourceTask).
+		Build()
+	reconciler := &RepositoryScanReconciler{Client: cl, Scheme: scheme, SecurityStore: securityStore, ResultStore: securityStore}
+
+	return &reviewResultRetryFixture{
+		ctx:        ctx,
+		store:      securityStore,
+		client:     cl,
+		reconciler: reconciler,
+		scan:       scan,
+		run:        run,
+		slice:      reviewSlice,
+		sourceTask: sourceTask,
+	}
+}
+
+func (f *reviewResultRetryFixture) retryTaskName() string {
+	return security.ScanStageRetryTaskName(f.scan.Name, f.run.ID, security.StageReview, f.slice.ID, securityReviewRetryAttempt)
+}
+
+func (f *reviewResultRetryFixture) getRetryTask(t *testing.T) *corev1alpha1.Task {
+	t.Helper()
+	task := &corev1alpha1.Task{}
+	if err := f.client.Get(f.ctx, client.ObjectKey{Namespace: defaultNS, Name: f.retryTaskName()}, task); err != nil {
+		t.Fatalf("Get(retry Task) error = %v", err)
+	}
+	return task
+}
+
+func TestIngestReviewTaskCreatesOneControllerRebuiltRetry(t *testing.T) {
+	fixture := newReviewResultRetryFixture(t)
+	if err := fixture.reconciler.ingestScanTask(fixture.ctx, fixture.scan, fixture.sourceTask); err != nil {
+		t.Fatalf("ingestScanTask(source) error = %v", err)
+	}
+
+	retryTask := fixture.getRetryTask(t)
+	if retryTask.Annotations[labels.AnnotationSecurityReviewAttempt] != "1" {
+		t.Fatalf("retry attempt annotation = %q, want 1", retryTask.Annotations[labels.AnnotationSecurityReviewAttempt])
+	}
+	if !metav1.IsControlledBy(retryTask, fixture.scan) {
+		t.Fatalf("retry owner references = %#v, want RepositoryScan controller", retryTask.OwnerReferences)
+	}
+	if retryTask.Spec.AgentRef == nil || retryTask.Spec.AgentRef.Name != fixture.scan.Spec.AnalysisAgentRef.Name {
+		t.Fatalf("retry AgentRef = %#v, want controller-rebuilt %q", retryTask.Spec.AgentRef, fixture.scan.Spec.AnalysisAgentRef.Name)
+	}
+	if strings.Contains(retryTask.Spec.Prompt, "POISON SOURCE PROMPT") ||
+		!strings.Contains(retryTask.Spec.Prompt, "Trusted mapper review context for slice_api") ||
+		!strings.Contains(retryTask.Spec.Prompt, "only automatic result retry") {
+		t.Fatalf("retry prompt was not rebuilt from trusted context: %q", retryTask.Spec.Prompt)
+	}
+	if retryTask.Spec.Workspace == nil || retryTask.Spec.Workspace.Intent != corev1alpha1.WorkspaceIntentRead || len(retryTask.Spec.Env) != 0 {
+		t.Fatalf("retry workspace/env = %#v/%#v, want read workspace and empty env", retryTask.Spec.Workspace, retryTask.Spec.Env)
+	}
+
+	run, err := fixture.store.GetScanRun(fixture.ctx, defaultNS, fixture.run.ID)
+	if err != nil {
+		t.Fatalf("GetScanRun() error = %v", err)
+	}
+	if run.Phase != scanRunPhaseRunning || run.ErrorMessage != "" || !strings.Contains(run.Summary, "Retrying review slice") {
+		t.Fatalf("run after retry creation = %#v, want running retry state", run)
+	}
+	reviewSlice, err := fixture.store.GetReviewSlice(fixture.ctx, defaultNS, fixture.scan.Name, fixture.slice.ID)
+	if err != nil {
+		t.Fatalf("GetReviewSlice() error = %v", err)
+	}
+	if reviewSlice.Status != reviewSliceStatusPending {
+		t.Fatalf("review slice status = %q, want pending during retry", reviewSlice.Status)
+	}
+
+	if err := fixture.reconciler.ingestScanTask(fixture.ctx, fixture.scan, fixture.sourceTask); err != nil {
+		t.Fatalf("second ingestScanTask(source) error = %v", err)
+	}
+	var tasks corev1alpha1.TaskList
+	if err := fixture.client.List(fixture.ctx, &tasks, client.InNamespace(defaultNS)); err != nil {
+		t.Fatalf("List(Tasks) error = %v", err)
+	}
+	if len(tasks.Items) != 2 {
+		t.Fatalf("len(tasks) = %d, want source plus one deterministic retry", len(tasks.Items))
+	}
+	progress := fixture.reconciler.collectScanRunProgress(fixture.ctx, tasks.Items)
+	if progress.reviewCount != 1 || progress.reviewSucceeded != 0 || !progress.hasActive {
+		t.Fatalf("logical retry progress = %#v, want one active review slice", progress)
+	}
+}
+
+func TestIngestReviewTaskAcceptsRetryOnceAndCountsOneLogicalSlice(t *testing.T) {
+	fixture := newReviewResultRetryFixture(t)
+	if err := fixture.reconciler.ingestScanTask(fixture.ctx, fixture.scan, fixture.sourceTask); err != nil {
+		t.Fatalf("ingestScanTask(source) error = %v", err)
+	}
+	retryTask := fixture.getRetryTask(t)
+	findings := security.FindingsV2Artifact{
+		SchemaVersion: security.SchemaVersionFindingsV2,
+		Repository: security.FindingsV2Repository{
+			RepoURL: fixture.scan.Spec.RepoURL,
+			Branch:  "main",
+		},
+		Scan:     security.FindingsV2Scan{Mode: fixture.run.Mode, SliceID: fixture.slice.ID, Summary: "retry completed"},
+		Findings: []security.FindingsV2Finding{},
+	}
+	saveFindingsTaskResult(
+		t, fixture.store, retryTask, fixture.scan.Name, fixture.run.ID, fixture.run.PolicyDigest,
+		fixture.slice.ReviewContextHash, fixture.slice.ID, findings,
+	)
+	retryTask.Status.Phase = corev1alpha1.TaskPhaseSucceeded
+	retryTask.Status.CompletionTime = &metav1.Time{Time: time.Now()}
+	if err := fixture.client.Update(fixture.ctx, retryTask); err != nil {
+		t.Fatalf("Update(retry Task) error = %v", err)
+	}
+
+	if err := fixture.reconciler.ingestOwnedTasks(fixture.ctx, fixture.scan); err != nil {
+		t.Fatalf("ingestOwnedTasks() error = %v", err)
+	}
+	run, err := fixture.store.GetScanRun(fixture.ctx, defaultNS, fixture.run.ID)
+	if err != nil {
+		t.Fatalf("GetScanRun() error = %v", err)
+	}
+	if run.Phase != scanRunPhaseSucceeded || run.ReviewedSliceCount != 1 || run.ErrorMessage != "" {
+		t.Fatalf("run after successful retry = %#v, want one succeeded review slice", run)
+	}
+	reviewSlice, err := fixture.store.GetReviewSlice(fixture.ctx, defaultNS, fixture.scan.Name, fixture.slice.ID)
+	if err != nil {
+		t.Fatalf("GetReviewSlice() error = %v", err)
+	}
+	if reviewSlice.Status != reviewSliceStatusReviewed {
+		t.Fatalf("review slice status = %q, want reviewed", reviewSlice.Status)
+	}
+
+	if err := fixture.reconciler.ingestOwnedTasks(fixture.ctx, fixture.scan); err != nil {
+		t.Fatalf("second ingestOwnedTasks() error = %v", err)
+	}
+	run, err = fixture.store.GetScanRun(fixture.ctx, defaultNS, fixture.run.ID)
+	if err != nil {
+		t.Fatalf("GetScanRun(second) error = %v", err)
+	}
+	if run.ReviewedSliceCount != 1 || run.Phase != scanRunPhaseSucceeded {
+		t.Fatalf("idempotent run = %#v, want one succeeded review slice", run)
+	}
+	var tasks corev1alpha1.TaskList
+	if err := fixture.client.List(fixture.ctx, &tasks, client.InNamespace(defaultNS)); err != nil {
+		t.Fatalf("List(Tasks) error = %v", err)
+	}
+	progress := fixture.reconciler.collectScanRunProgress(fixture.ctx, tasks.Items)
+	if progress.reviewCount != 1 || progress.reviewSucceeded != 1 {
+		t.Fatalf("logical completed progress = %#v, want 1/1", progress)
+	}
+}
+
+func TestIngestReviewTaskMalformedRetryExhaustsWithoutAttemptTwo(t *testing.T) {
+	fixture := newReviewResultRetryFixture(t)
+	if err := fixture.reconciler.ingestScanTask(fixture.ctx, fixture.scan, fixture.sourceTask); err != nil {
+		t.Fatalf("ingestScanTask(source) error = %v", err)
+	}
+	retryTask := fixture.getRetryTask(t)
+	if err := fixture.store.SaveResult(fixture.ctx, retryTask.Namespace, retryTask.Name, []byte(`{"still":"invalid"}`)); err != nil {
+		t.Fatalf("SaveResult(retry malformed) error = %v", err)
+	}
+	retryTask.Status.Phase = corev1alpha1.TaskPhaseSucceeded
+	retryTask.Status.ResultRef = &corev1alpha1.ResultReference{Available: true}
+	retryTask.Status.CompletionTime = &metav1.Time{Time: time.Now()}
+	if err := fixture.client.Update(fixture.ctx, retryTask); err != nil {
+		t.Fatalf("Update(retry Task) error = %v", err)
+	}
+
+	if err := fixture.reconciler.ingestOwnedTasks(fixture.ctx, fixture.scan); err != nil {
+		t.Fatalf("ingestOwnedTasks() error = %v", err)
+	}
+	run, err := fixture.store.GetScanRun(fixture.ctx, defaultNS, fixture.run.ID)
+	if err != nil {
+		t.Fatalf("GetScanRun() error = %v", err)
+	}
+	if run.Phase != scanRunPhaseFailed || !strings.Contains(run.ErrorMessage, "decode security task result") {
+		t.Fatalf("run after malformed retry = %#v, want terminal parse failure", run)
+	}
+	reviewSlice, err := fixture.store.GetReviewSlice(fixture.ctx, defaultNS, fixture.scan.Name, fixture.slice.ID)
+	if err != nil {
+		t.Fatalf("GetReviewSlice() error = %v", err)
+	}
+	if reviewSlice.Status != reviewSliceStatusFailed {
+		t.Fatalf("review slice status = %q, want failed", reviewSlice.Status)
+	}
+	var tasks corev1alpha1.TaskList
+	if err := fixture.client.List(fixture.ctx, &tasks, client.InNamespace(defaultNS)); err != nil {
+		t.Fatalf("List(Tasks) error = %v", err)
+	}
+	if len(tasks.Items) != 2 {
+		t.Fatalf("len(tasks) = %d, want no attempt two", len(tasks.Items))
+	}
+	if err := fixture.reconciler.ingestOwnedTasks(fixture.ctx, fixture.scan); err != nil {
+		t.Fatalf("second ingestOwnedTasks() error = %v", err)
+	}
+	if err := fixture.client.List(fixture.ctx, &tasks, client.InNamespace(defaultNS)); err != nil {
+		t.Fatalf("List(Tasks second) error = %v", err)
+	}
+	if len(tasks.Items) != 2 {
+		t.Fatalf("len(tasks after repeat) = %d, want exhausted retry budget", len(tasks.Items))
+	}
+}
+
+func TestIngestReviewTaskRejectsConflictingDeterministicRetry(t *testing.T) {
+	fixture := newReviewResultRetryFixture(t)
+	conflict := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{Name: fixture.retryTaskName(), Namespace: defaultNS}}
+	if err := fixture.client.Create(fixture.ctx, conflict); err != nil {
+		t.Fatalf("Create(conflicting retry) error = %v", err)
+	}
+
+	err := fixture.reconciler.ingestScanTask(fixture.ctx, fixture.scan, fixture.sourceTask)
+	if err == nil || !strings.Contains(err.Error(), "conflicts with the expected retry identity") {
+		t.Fatalf("ingestScanTask(source) error = %v, want deterministic-name conflict", err)
+	}
+	run, getErr := fixture.store.GetScanRun(fixture.ctx, defaultNS, fixture.run.ID)
+	if getErr != nil {
+		t.Fatalf("GetScanRun() error = %v", getErr)
+	}
+	if run.Phase != scanRunPhaseRunning || run.ErrorMessage != "" {
+		t.Fatalf("run after collision = %#v, want unchanged active run", run)
+	}
+}
+
+func TestIngestReviewTaskRejectsInvalidAttemptIdentityWithoutRetry(t *testing.T) {
+	tests := []struct {
+		name         string
+		annotation   string
+		useRetryName bool
+	}{
+		{name: "malformed", annotation: "not-a-number"},
+		{name: "negative", annotation: "-1"},
+		{name: "out of range", annotation: "2"},
+		{name: "retry attempt on source name", annotation: "1"},
+		{name: "initial attempt on retry name", annotation: "0", useRetryName: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fixture := newReviewResultRetryFixture(t)
+			fixture.sourceTask.Annotations[labels.AnnotationSecurityReviewAttempt] = tt.annotation
+			if tt.useRetryName {
+				fixture.sourceTask.Name = fixture.retryTaskName()
+			}
+
+			if err := fixture.reconciler.ingestScanTask(fixture.ctx, fixture.scan, fixture.sourceTask); err != nil {
+				t.Fatalf("ingestScanTask() error = %v", err)
+			}
+			run, err := fixture.store.GetScanRun(fixture.ctx, defaultNS, fixture.run.ID)
+			if err != nil {
+				t.Fatalf("GetScanRun() error = %v", err)
+			}
+			if run.Phase != scanRunPhaseFailed || !strings.Contains(run.ErrorMessage, "invalid security review attempt identity") {
+				t.Fatalf("run = %#v, want invalid attempt failure", run)
+			}
+			var tasks corev1alpha1.TaskList
+			if err := fixture.client.List(fixture.ctx, &tasks, client.InNamespace(defaultNS)); err != nil {
+				t.Fatalf("List(Tasks) error = %v", err)
+			}
+			if len(tasks.Items) != 1 {
+				t.Fatalf("len(tasks) = %d, want no retry", len(tasks.Items))
+			}
+		})
+	}
+}
+
+func TestIngestReviewTaskResultRetryEligibility(t *testing.T) {
+	tests := []struct {
+		name      string
+		mutate    func(*reviewResultRetryFixture)
+		wantRetry bool
+		wantError string
+	}{
+		{
+			name: "result reference unavailable",
+			mutate: func(f *reviewResultRetryFixture) {
+				f.sourceTask.Status.ResultRef = nil
+			},
+			wantRetry: true,
+		},
+		{
+			name: "result missing after available reference",
+			mutate: func(f *reviewResultRetryFixture) {
+				f.sourceTask.Name = "retry-scan-review-result-missing"
+			},
+			wantRetry: true,
+		},
+		{
+			name: "result store unavailable",
+			mutate: func(f *reviewResultRetryFixture) {
+				f.reconciler.ResultStore = nil
+			},
+			wantError: "result store is not configured",
+		},
+		{
+			name: "trusted context corrupt",
+			mutate: func(f *reviewResultRetryFixture) {
+				f.slice.ReviewContextJSON = `{"schemaVersion":1,"sliceId":"wrong"}`
+				f.slice.ReviewContextHash = "sha256:wrong"
+				if err := f.store.UpsertReviewSlice(f.ctx, f.slice); err != nil {
+					t.Fatalf("UpsertReviewSlice(corrupt) error = %v", err)
+				}
+			},
+			wantError: "trusted review context",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fixture := newReviewResultRetryFixture(t)
+			tt.mutate(fixture)
+			if err := fixture.reconciler.ingestScanTask(fixture.ctx, fixture.scan, fixture.sourceTask); err != nil {
+				t.Fatalf("ingestScanTask() error = %v", err)
+			}
+
+			var tasks corev1alpha1.TaskList
+			if err := fixture.client.List(fixture.ctx, &tasks, client.InNamespace(defaultNS)); err != nil {
+				t.Fatalf("List(Tasks) error = %v", err)
+			}
+			wantTasks := 1
+			if tt.wantRetry {
+				wantTasks = 2
+			}
+			if len(tasks.Items) != wantTasks {
+				t.Fatalf("len(tasks) = %d, want %d", len(tasks.Items), wantTasks)
+			}
+			run, err := fixture.store.GetScanRun(fixture.ctx, defaultNS, fixture.run.ID)
+			if err != nil {
+				t.Fatalf("GetScanRun() error = %v", err)
+			}
+			if tt.wantRetry {
+				if run.Phase != scanRunPhaseRunning || run.ErrorMessage != "" {
+					t.Fatalf("retryable run = %#v, want active", run)
+				}
+				return
+			}
+			if run.Phase != scanRunPhaseFailed || !strings.Contains(run.ErrorMessage, tt.wantError) {
+				t.Fatalf("non-retryable run = %#v, want failure containing %q", run, tt.wantError)
+			}
+		})
+	}
+}
+
+func saveValidationTaskResult(
+	t *testing.T,
+	store *sqlitestore.Store,
+	task *corev1alpha1.Task,
+	repositoryScan, scanID, policyDigest string,
+	validation security.ValidationArtifact,
+) {
+	t.Helper()
+	result := security.ValidationResultEnvelope{
+		SchemaVersion:  security.AgentResultSchemaVersion,
+		Kind:           security.AgentResultKindValidation,
+		RepositoryScan: repositoryScan,
+		ScanID:         scanID,
+		FindingID:      validation.FindingID,
+		PolicyDigest:   policyDigest,
+		Validation:     validation,
+	}
+	data, err := json.Marshal(result)
+	if err != nil {
+		t.Fatalf("json.Marshal(validation result) error = %v", err)
+	}
+	if err := store.SaveResult(context.Background(), task.Namespace, task.Name, data); err != nil {
+		t.Fatalf("SaveResult(validation) error = %v", err)
+	}
+	task.Status.ResultRef = &corev1alpha1.ResultReference{Available: true}
+}
+
 func TestIngestMapperTaskPersistsReviewSlices(t *testing.T) {
 	ctx := context.Background()
 	store := setupControllerSQLiteStore(t)
@@ -295,15 +1081,9 @@ func TestIngestMapperTaskPersistsReviewSlices(t *testing.T) {
 			OwnedFiles:     []storepkg.ReviewSliceFile{{Path: "internal/api/security.go", Reason: "source"}},
 			Confidence:     "high",
 			Status:         reviewSliceStatusPending,
-		}},
-	}
-	data, err := json.Marshal(artifact)
-	if err != nil {
-		t.Fatalf("json.Marshal() error = %v", err)
-	}
-	if err := store.SaveArtifact(ctx, task.Namespace, task.Name, security.ArtifactSlices, "application/json", data); err != nil {
-		t.Fatalf("SaveArtifact(slices) error = %v", err)
+		}},
 	}
+	saveMapperArtifactWithContexts(t, store, task, artifact)
 
 	if err := reconciler.ingestScanTask(ctx, scan, task); err != nil {
 		t.Fatalf("ingestScanTask() error = %v", err)
@@ -315,6 +1095,16 @@ func TestIngestMapperTaskPersistsReviewSlices(t *testing.T) {
 	if got.LastScanRunID != "scan_mapper" || got.Namespace != defaultNS {
 		t.Fatalf("review slice = %#v, want scan metadata", got)
 	}
+	if got.ReviewContextJSON == "" || got.ReviewContextHash == "" {
+		t.Fatalf("review slice context = %q/%q, want persisted mapper context", got.ReviewContextJSON, got.ReviewContextHash)
+	}
+	parsedContext, digest, err := security.ParseTrustedReviewContextManifest([]byte(got.ReviewContextJSON))
+	if err != nil {
+		t.Fatalf("ParseTrustedReviewContextManifest(stored) error = %v", err)
+	}
+	if parsedContext.SliceID != got.ID || digest != got.ReviewContextHash {
+		t.Fatalf("stored review context = slice %q digest %q, want %q/%q", parsedContext.SliceID, digest, got.ID, got.ReviewContextHash)
+	}
 	run, err := store.GetScanRun(ctx, defaultNS, "scan_mapper")
 	if err != nil {
 		t.Fatalf("GetScanRun() error = %v", err)
@@ -394,13 +1184,7 @@ func TestIngestMapperTaskSelectsIncrementalSlicesFromChangedFiles(t *testing.T)
 			},
 		},
 	}
-	data, err := json.Marshal(artifact)
-	if err != nil {
-		t.Fatalf("json.Marshal() error = %v", err)
-	}
-	if err := store.SaveArtifact(ctx, task.Namespace, task.Name, security.ArtifactSlices, "application/json", data); err != nil {
-		t.Fatalf("SaveArtifact(slices) error = %v", err)
-	}
+	saveMapperArtifactWithContexts(t, store, task, artifact)
 	if err := store.CreateScanRun(ctx, &storepkg.ScanRun{
 		ID:             "scan_incremental_mapper",
 		Namespace:      defaultNS,
@@ -456,11 +1240,13 @@ func TestMapperReingestPreservesReviewedSliceForCurrentRun(t *testing.T) {
 	reconciler := &RepositoryScanReconciler{
 		SecurityStore: store,
 		ArtifactStore: store,
+		ResultStore:   store,
 	}
 	maxFindings := int32(1)
 	scan := &corev1alpha1.RepositoryScan{
 		ObjectMeta: metav1.ObjectMeta{Name: "kaset", Namespace: defaultNS},
 		Spec: corev1alpha1.RepositoryScanSpec{
+			RepoURL:           "https://github.com/example/repo",
 			MaxFindingsPerRun: &maxFindings,
 		},
 	}
@@ -480,6 +1266,7 @@ func TestMapperReingestPreservesReviewedSliceForCurrentRun(t *testing.T) {
 	}
 	mapperArtifact := security.ReviewSlicesArtifact{
 		SchemaVersion: security.SchemaVersionReviewSlices,
+		HeadCommit:    "head123",
 		Slices: []storepkg.ReviewSlice{{
 			ID:             "slice_api",
 			RepositoryScan: "kaset",
@@ -492,13 +1279,7 @@ func TestMapperReingestPreservesReviewedSliceForCurrentRun(t *testing.T) {
 			Status:         reviewSliceStatusPending,
 		}},
 	}
-	mapperData, err := json.Marshal(mapperArtifact)
-	if err != nil {
-		t.Fatalf("json.Marshal(mapperArtifact) error = %v", err)
-	}
-	if err := store.SaveArtifact(ctx, mapperTask.Namespace, mapperTask.Name, security.ArtifactSlices, "application/json", mapperData); err != nil {
-		t.Fatalf("SaveArtifact(slices) error = %v", err)
-	}
+	saveMapperArtifactWithContexts(t, store, mapperTask, mapperArtifact)
 
 	reviewTask := &corev1alpha1.Task{
 		ObjectMeta: metav1.ObjectMeta{
@@ -514,23 +1295,6 @@ func TestMapperReingestPreservesReviewedSliceForCurrentRun(t *testing.T) {
 		},
 		Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhaseSucceeded},
 	}
-	manifest := security.ReviewContextManifest{
-		SchemaVersion: security.SchemaVersionReviewContext,
-		SliceID:       "slice_api",
-		IncludedFiles: []security.ReviewContextIncludedFile{{
-			Path:               "internal/api/security.go",
-			Role:               "owned",
-			IncludedLineRanges: []security.ReviewContextLineRange{{StartLine: 1, EndLine: 20}},
-			Readable:           true,
-		}},
-	}
-	manifestData, err := json.Marshal(manifest)
-	if err != nil {
-		t.Fatalf("json.Marshal(manifest) error = %v", err)
-	}
-	if err := store.SaveArtifact(ctx, reviewTask.Namespace, reviewTask.Name, security.ReviewContextArtifactName("slice_api"), "application/json", manifestData); err != nil {
-		t.Fatalf("SaveArtifact(manifest) error = %v", err)
-	}
 	findings := security.FindingsV2Artifact{
 		SchemaVersion: security.SchemaVersionFindingsV2,
 		Repository: security.FindingsV2Repository{
@@ -553,17 +1317,18 @@ func TestMapperReingestPreservesReviewedSliceForCurrentRun(t *testing.T) {
 			}},
 		}},
 	}
-	findingsData, err := json.Marshal(findings)
-	if err != nil {
-		t.Fatalf("json.Marshal(findings) error = %v", err)
-	}
-	if err := store.SaveArtifact(ctx, reviewTask.Namespace, reviewTask.Name, security.ArtifactFindingsV2, "application/json", findingsData); err != nil {
-		t.Fatalf("SaveArtifact(findings v2) error = %v", err)
-	}
-
 	if err := reconciler.ingestScanTask(ctx, scan, mapperTask); err != nil {
 		t.Fatalf("ingest mapper error = %v", err)
 	}
+	persistedSlice, err := store.GetReviewSlice(ctx, defaultNS, scan.Name, "slice_api")
+	if err != nil {
+		t.Fatalf("GetReviewSlice(after mapper) error = %v", err)
+	}
+	runAfterMapper, err := store.GetScanRun(ctx, defaultNS, "scan_mapper_reingest")
+	if err != nil {
+		t.Fatalf("GetScanRun(after mapper) error = %v", err)
+	}
+	saveFindingsTaskResult(t, store, reviewTask, scan.Name, runAfterMapper.ID, runAfterMapper.PolicyDigest, persistedSlice.ReviewContextHash, "slice_api", findings)
 	if err := reconciler.ingestScanTask(ctx, scan, reviewTask); err != nil {
 		t.Fatalf("ingest review error = %v", err)
 	}
@@ -620,7 +1385,9 @@ func TestRepositoryScanCustomPolicyIncludedInReviewPrompt(t *testing.T) {
 	cl := fake.NewClientBuilder().WithScheme(scheme).WithObjects(scan, policyConfig).Build()
 	reconciler := &RepositoryScanReconciler{Client: cl, Scheme: scheme, SecurityStore: store}
 	run := &storepkg.ScanRun{ID: "scan_policy", Namespace: defaultNS, RepositoryScan: "kaset", Mode: "initial", Phase: scanRunPhaseRunning}
-	if err := reconciler.createReviewTasks(ctx, scan, run, "", []storepkg.ReviewSlice{{ID: "slice_api", RepositoryScan: "kaset", Source: "deterministic", Title: "API", Kind: "package", Status: reviewSliceStatusPending}}); err != nil {
+	reviewSlice := storepkg.ReviewSlice{ID: "slice_api", RepositoryScan: "kaset", Source: "deterministic", Title: "API", Kind: "package", Status: reviewSliceStatusPending}
+	manifest := bindReviewSliceContext(t, &reviewSlice)
+	if err := reconciler.createReviewTasks(ctx, scan, run, "", []storepkg.ReviewSlice{reviewSlice}); err != nil {
 		t.Fatalf("createReviewTasks() error = %v", err)
 	}
 	var tasks corev1alpha1.TaskList
@@ -636,6 +1403,12 @@ func TestRepositoryScanCustomPolicyIncludedInReviewPrompt(t *testing.T) {
 			t.Fatalf("review prompt missing %q:\n%s", want, prompt)
 		}
 	}
+	if !strings.Contains(prompt, manifest.Prompt) || !strings.Contains(prompt, security.AgentResultKindFindings) {
+		t.Fatalf("review prompt missing trusted context or terminal result contract: %q", prompt)
+	}
+	if strings.Contains(prompt, "REQUIRED_SECURITY_ARTIFACTS") || !strings.Contains(prompt, "Do not write artifacts") || len(tasks.Items[0].Spec.Env) != 0 {
+		t.Fatalf("review task retained artifact/env contract: prompt=%q env=%#v", prompt, tasks.Items[0].Spec.Env)
+	}
 	if run.PolicyDigest == "" {
 		t.Fatal("run.PolicyDigest was not populated")
 	}
@@ -733,7 +1506,7 @@ func TestRepositoryScanIdempotencyMarksOrphanedRunFailedAndStartsReplacement(t *
 	}
 	policyDigest := security.ScannerPolicyDigest(security.ScannerPolicy{})
 	key := security.ScanRunIdempotencyKey(defaultNS, "kaset", scanModeIncremental, "base", "", "", policyDigest)
-	if err := store.CreateScanRun(ctx, &storepkg.ScanRun{ID: "scan_orphaned", Namespace: defaultNS, RepositoryScan: "kaset", TaskName: "missing", Mode: scanModeIncremental, Phase: scanRunPhaseRunning, IdempotencyKey: key, PolicyDigest: policyDigest, StartedAt: time.Now()}); err != nil {
+	if err := store.CreateScanRun(ctx, &storepkg.ScanRun{ID: "scan_orphaned", Namespace: defaultNS, RepositoryScan: "kaset", TaskName: "missing", Mode: scanModeIncremental, Phase: scanRunPhaseRunning, IdempotencyKey: key, PolicyDigest: policyDigest, StartedAt: time.Now().Add(-2 * scanRunAdmissionGrace)}); err != nil {
 		t.Fatalf("CreateScanRun() error = %v", err)
 	}
 	cl := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.RepositoryScan{}).WithObjects(scan).Build()
@@ -757,6 +1530,55 @@ func TestRepositoryScanIdempotencyMarksOrphanedRunFailedAndStartsReplacement(t *
 	}
 }
 
+func TestCreateScanRunConcurrentReconcilesCreateOnePipeline(t *testing.T) {
+	ctx := context.Background()
+	securityStore := setupControllerSQLiteStore(t)
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatalf("AddToScheme() error = %v", err)
+	}
+	scan := &corev1alpha1.RepositoryScan{
+		TypeMeta:   metav1.TypeMeta{APIVersion: corev1alpha1.GroupVersion.String(), Kind: "RepositoryScan"},
+		ObjectMeta: metav1.ObjectMeta{Name: "concurrent-security", Namespace: defaultNS},
+		Spec: corev1alpha1.RepositoryScanSpec{
+			RepoURL:          "https://github.com/example/repo",
+			AnalysisAgentRef: corev1alpha1.AgentReference{Name: "scan-reviewer"},
+		},
+	}
+	cl := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.RepositoryScan{}).WithObjects(scan).Build()
+	reconciler := &RepositoryScanReconciler{Client: cl, Scheme: scheme, SecurityStore: securityStore}
+
+	start := make(chan struct{})
+	results := make(chan error, 4)
+	for range 4 {
+		go func() {
+			<-start
+			results <- reconciler.createScanRun(ctx, scan, "manual", "base", "")
+		}()
+	}
+	close(start)
+	for range 4 {
+		if err := <-results; err != nil {
+			t.Fatalf("createScanRun() error = %v", err)
+		}
+	}
+
+	var tasks corev1alpha1.TaskList
+	if err := cl.List(ctx, &tasks, client.InNamespace(defaultNS)); err != nil {
+		t.Fatalf("List(Task) error = %v", err)
+	}
+	if len(tasks.Items) != 1 || taskSecurityStage(&tasks.Items[0]) != security.StageThreatModel {
+		t.Fatalf("tasks = %#v, want one threat-model task", tasks.Items)
+	}
+	runs, _, err := securityStore.ListScanRuns(ctx, defaultNS, scan.Name, 10, "")
+	if err != nil {
+		t.Fatalf("ListScanRuns() error = %v", err)
+	}
+	if len(runs) != 1 || runs[0].Phase != scanRunPhasePending {
+		t.Fatalf("runs = %#v, want one pending run", runs)
+	}
+}
+
 func TestProgressLatestScanRunStartsReviewTasksForPendingSlices(t *testing.T) {
 	ctx := context.Background()
 	store := setupControllerSQLiteStore(t)
@@ -801,7 +1623,7 @@ func TestProgressLatestScanRunStartsReviewTasksForPendingSlices(t *testing.T) {
 	}); err != nil {
 		t.Fatalf("CreateScanRun() error = %v", err)
 	}
-	if err := store.UpsertReviewSlice(ctx, &storepkg.ReviewSlice{
+	reviewSlice := &storepkg.ReviewSlice{
 		SchemaVersion:  1,
 		ID:             "slice_api",
 		Namespace:      defaultNS,
@@ -814,7 +1636,9 @@ func TestProgressLatestScanRunStartsReviewTasksForPendingSlices(t *testing.T) {
 		Confidence:     "high",
 		Status:         reviewSliceStatusPending,
 		LastScanRunID:  "scan_review",
-	}); err != nil {
+	}
+	manifest := bindReviewSliceContext(t, reviewSlice)
+	if err := store.UpsertReviewSlice(ctx, reviewSlice); err != nil {
 		t.Fatalf("UpsertReviewSlice() error = %v", err)
 	}
 
@@ -841,9 +1665,12 @@ func TestProgressLatestScanRunStartsReviewTasksForPendingSlices(t *testing.T) {
 	if len(reviewTasks.Items) != 1 {
 		t.Fatalf("len(review tasks) = %d, want 1", len(reviewTasks.Items))
 	}
-	if !strings.Contains(reviewTasks.Items[0].Spec.Prompt, security.ArtifactFindingsV2) ||
-		!strings.Contains(reviewTasks.Items[0].Spec.Prompt, security.ReviewContextArtifactName("slice_api")) {
-		t.Fatalf("review prompt does not mention required v2 artifacts: %q", reviewTasks.Items[0].Spec.Prompt)
+	if !strings.Contains(reviewTasks.Items[0].Spec.Prompt, manifest.Prompt) ||
+		!strings.Contains(reviewTasks.Items[0].Spec.Prompt, security.AgentResultKindFindings) {
+		t.Fatalf("review prompt does not contain trusted context and terminal result contract: %q", reviewTasks.Items[0].Spec.Prompt)
+	}
+	if len(reviewTasks.Items[0].Spec.Env) != 0 {
+		t.Fatalf("review task env = %#v, want empty harness-v2 env", reviewTasks.Items[0].Spec.Env)
 	}
 
 }
@@ -1008,6 +1835,7 @@ func TestProgressLatestScanRunRetriesPendingSlicesWithoutTasks(t *testing.T) {
 			LastScanRunID:  "scan_partial_review",
 		},
 	} {
+		bindReviewSliceContext(t, &slice)
 		if err := store.UpsertReviewSlice(ctx, &slice); err != nil {
 			t.Fatalf("UpsertReviewSlice(%s) error = %v", slice.ID, err)
 		}
@@ -1317,12 +2145,26 @@ func TestIngestReviewTaskRejectsMismatchedV2SliceID(t *testing.T) {
 	store := setupControllerSQLiteStore(t)
 	reconciler := &RepositoryScanReconciler{
 		SecurityStore: store,
-		ArtifactStore: store,
+		ResultStore:   store,
 	}
 	scan := &corev1alpha1.RepositoryScan{
 		ObjectMeta: metav1.ObjectMeta{Name: "kaset", Namespace: defaultNS},
+		Spec:       corev1alpha1.RepositoryScanSpec{RepoURL: "https://github.com/example/repo"},
 	}
-	if err := store.UpsertReviewSlice(ctx, &storepkg.ReviewSlice{
+	policyDigest := security.ScannerPolicyDigest(security.ScannerPolicy{})
+	if err := store.CreateScanRun(ctx, &storepkg.ScanRun{
+		ID:             "scan_mismatched_slice",
+		Namespace:      defaultNS,
+		RepositoryScan: scan.Name,
+		TaskName:       "kaset-review-mismatched-slice",
+		Mode:           "initial",
+		Phase:          scanRunPhaseRunning,
+		PolicyDigest:   policyDigest,
+		StartedAt:      time.Now(),
+	}); err != nil {
+		t.Fatalf("CreateScanRun() error = %v", err)
+	}
+	reviewSlice := &storepkg.ReviewSlice{
 		SchemaVersion:  1,
 		ID:             "slice_api",
 		Namespace:      defaultNS,
@@ -1335,7 +2177,9 @@ func TestIngestReviewTaskRejectsMismatchedV2SliceID(t *testing.T) {
 		Confidence:     "high",
 		Status:         reviewSliceStatusPending,
 		LastScanRunID:  "scan_mismatched_slice",
-	}); err != nil {
+	}
+	bindReviewSliceContext(t, reviewSlice)
+	if err := store.UpsertReviewSlice(ctx, reviewSlice); err != nil {
 		t.Fatalf("UpsertReviewSlice() error = %v", err)
 	}
 	task := &corev1alpha1.Task{
@@ -1352,63 +2196,20 @@ func TestIngestReviewTaskRejectsMismatchedV2SliceID(t *testing.T) {
 		},
 		Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhaseSucceeded},
 	}
-	maliciousManifest := security.ReviewContextManifest{
-		SchemaVersion: security.SchemaVersionReviewContext,
-		SliceID:       "slice_other",
-		IncludedFiles: []security.ReviewContextIncludedFile{{
-			Path:               "internal/api/omitted.go",
-			Role:               "owned",
-			IncludedLineRanges: []security.ReviewContextLineRange{{StartLine: 1, EndLine: 20}},
-			Readable:           true,
-		}},
-	}
-	manifestData, err := json.Marshal(maliciousManifest)
-	if err != nil {
-		t.Fatalf("json.Marshal(manifest) error = %v", err)
-	}
-	if err := store.SaveArtifact(
-		ctx,
-		task.Namespace,
-		task.Name,
-		security.ReviewContextArtifactName("slice_other"),
-		"application/json",
-		manifestData,
-	); err != nil {
-		t.Fatalf("SaveArtifact(manifest) error = %v", err)
-	}
 	findings := security.FindingsV2Artifact{
 		SchemaVersion: security.SchemaVersionFindingsV2,
 		Repository: security.FindingsV2Repository{
 			RepoURL: "https://github.com/example/repo",
 			Branch:  "main",
-			HeadSHA: "head123",
 		},
 		Scan: security.FindingsV2Scan{
 			Mode:    "initial",
 			SliceID: "slice_other",
 			Summary: "mismatched context",
 		},
-		Findings: []security.FindingsV2Finding{{
-			Title:       "Speculative issue",
-			Category:    "authz",
-			Severity:    "high",
-			Confidence:  "high",
-			Summary:     "Cites a file outside the assigned review slice.",
-			Remediation: "Add authorization checks.",
-			Evidence: []security.FindingsV2EvidenceRef{{
-				Path:      "internal/api/omitted.go",
-				StartLine: 5,
-				EndLine:   8,
-			}},
-		}},
-	}
-	findingsData, err := json.Marshal(findings)
-	if err != nil {
-		t.Fatalf("json.Marshal(findings) error = %v", err)
-	}
-	if err := store.SaveArtifact(ctx, task.Namespace, task.Name, security.ArtifactFindingsV2, "application/json", findingsData); err != nil {
-		t.Fatalf("SaveArtifact(findings v2) error = %v", err)
+		Findings: []security.FindingsV2Finding{},
 	}
+	saveFindingsTaskResult(t, store, task, scan.Name, "scan_mismatched_slice", policyDigest, reviewSlice.ReviewContextHash, "slice_other", findings)
 
 	if err := reconciler.ingestScanTask(ctx, scan, task); err != nil {
 		t.Fatalf("ingestScanTask() error = %v", err)
@@ -1421,12 +2222,12 @@ func TestIngestReviewTaskRejectsMismatchedV2SliceID(t *testing.T) {
 	if run.Phase != scanRunPhaseFailed || !strings.Contains(run.ErrorMessage, "does not match task slice") {
 		t.Fatalf("run phase/error = %q/%q, want failed slice mismatch", run.Phase, run.ErrorMessage)
 	}
-	reviewSlice, err := store.GetReviewSlice(ctx, defaultNS, "kaset", "slice_api")
+	storedReviewSlice, err := store.GetReviewSlice(ctx, defaultNS, "kaset", "slice_api")
 	if err != nil {
 		t.Fatalf("GetReviewSlice() error = %v", err)
 	}
-	if reviewSlice.Status != reviewSliceStatusFailed {
-		t.Fatalf("review slice status = %q, want failed", reviewSlice.Status)
+	if storedReviewSlice.Status != reviewSliceStatusFailed {
+		t.Fatalf("review slice status = %q, want failed", storedReviewSlice.Status)
 	}
 	listed, _, err := store.ListFindings(ctx, storepkg.FindingFilter{Namespace: defaultNS, RepositoryScan: "kaset"})
 	if err != nil {
@@ -1443,14 +2244,17 @@ func TestIngestReviewTaskPartitionsV2FindingsAndMarksSliceReviewed(t *testing.T)
 	reconciler := &RepositoryScanReconciler{
 		SecurityStore: store,
 		ArtifactStore: store,
+		ResultStore:   store,
 	}
 	maxFindings := int32(1)
 	scan := &corev1alpha1.RepositoryScan{
 		ObjectMeta: metav1.ObjectMeta{Name: "kaset", Namespace: defaultNS},
 		Spec: corev1alpha1.RepositoryScanSpec{
+			RepoURL:           "https://github.com/example/repo",
 			MaxFindingsPerRun: &maxFindings,
 		},
 	}
+	policyDigest := security.ScannerPolicyDigest(security.ScannerPolicy{})
 	if err := store.CreateScanRun(ctx, &storepkg.ScanRun{
 		ID:             "scan_review_ingest",
 		Namespace:      defaultNS,
@@ -1460,11 +2264,12 @@ func TestIngestReviewTaskPartitionsV2FindingsAndMarksSliceReviewed(t *testing.T)
 		Phase:          scanRunPhaseRunning,
 		BaseCommit:     "trusted-base",
 		HeadCommit:     "trusted-head",
+		PolicyDigest:   policyDigest,
 		StartedAt:      time.Now(),
 	}); err != nil {
 		t.Fatalf("CreateScanRun() error = %v", err)
 	}
-	if err := store.UpsertReviewSlice(ctx, &storepkg.ReviewSlice{
+	reviewSlice := &storepkg.ReviewSlice{
 		SchemaVersion:  1,
 		ID:             "slice_api",
 		Namespace:      defaultNS,
@@ -1477,7 +2282,9 @@ func TestIngestReviewTaskPartitionsV2FindingsAndMarksSliceReviewed(t *testing.T)
 		Confidence:     "high",
 		Status:         reviewSliceStatusPending,
 		LastScanRunID:  "scan_review_ingest",
-	}); err != nil {
+	}
+	bindReviewSliceContext(t, reviewSlice)
+	if err := store.UpsertReviewSlice(ctx, reviewSlice); err != nil {
 		t.Fatalf("UpsertReviewSlice() error = %v", err)
 	}
 	task := &corev1alpha1.Task{
@@ -1494,32 +2301,15 @@ func TestIngestReviewTaskPartitionsV2FindingsAndMarksSliceReviewed(t *testing.T)
 		},
 		Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhaseSucceeded},
 	}
-	manifest := security.ReviewContextManifest{
-		SchemaVersion: security.SchemaVersionReviewContext,
-		SliceID:       "slice_api",
-		IncludedFiles: []security.ReviewContextIncludedFile{{
-			Path:               "internal/api/security.go",
-			Role:               "owned",
-			IncludedLineRanges: []security.ReviewContextLineRange{{StartLine: 1, EndLine: 20}},
-			Readable:           true,
-		}},
-	}
-	manifestData, err := json.Marshal(manifest)
-	if err != nil {
-		t.Fatalf("json.Marshal(manifest) error = %v", err)
-	}
-	if err := store.SaveArtifact(ctx, task.Namespace, task.Name, security.ReviewContextArtifactName("slice_api"), "application/json", manifestData); err != nil {
-		t.Fatalf("SaveArtifact(manifest) error = %v", err)
-	}
 	findings := security.FindingsV2Artifact{
 		SchemaVersion: security.SchemaVersionFindingsV2,
 		Repository: security.FindingsV2Repository{
 			RepoURL: "https://github.com/example/repo",
 			Branch:  "main",
-			BaseSHA: "artifact-base",
-			HeadSHA: "artifact-head",
+			BaseSHA: "trusted-base",
+			HeadSHA: "trusted-head",
 		},
-		Scan: security.FindingsV2Scan{Mode: "manual", SliceID: "slice_api", Summary: "one accepted, two dropped"},
+		Scan: security.FindingsV2Scan{Mode: "initial", SliceID: "slice_api", Summary: "one accepted, two dropped"},
 		Findings: []security.FindingsV2Finding{
 			{
 				Title:       "Unsafe API behavior",
@@ -1562,13 +2352,7 @@ func TestIngestReviewTaskPartitionsV2FindingsAndMarksSliceReviewed(t *testing.T)
 			},
 		},
 	}
-	findingsData, err := json.Marshal(findings)
-	if err != nil {
-		t.Fatalf("json.Marshal(findings) error = %v", err)
-	}
-	if err := store.SaveArtifact(ctx, task.Namespace, task.Name, security.ArtifactFindingsV2, "application/json", findingsData); err != nil {
-		t.Fatalf("SaveArtifact(findings v2) error = %v", err)
-	}
+	saveFindingsTaskResult(t, store, task, scan.Name, "scan_review_ingest", policyDigest, reviewSlice.ReviewContextHash, "slice_api", findings)
 
 	if err := reconciler.ingestScanTask(ctx, scan, task); err != nil {
 		t.Fatalf("ingestScanTask() error = %v", err)
@@ -1589,12 +2373,12 @@ func TestIngestReviewTaskPartitionsV2FindingsAndMarksSliceReviewed(t *testing.T)
 	if run.Mode != "initial" {
 		t.Fatalf("run mode = %q, want trusted initial mode", run.Mode)
 	}
-	reviewSlice, err := store.GetReviewSlice(ctx, defaultNS, "kaset", "slice_api")
+	storedReviewSlice, err := store.GetReviewSlice(ctx, defaultNS, "kaset", "slice_api")
 	if err != nil {
 		t.Fatalf("GetReviewSlice() error = %v", err)
 	}
-	if reviewSlice.Status != reviewSliceStatusReviewed || reviewSlice.LastReviewedAt == nil {
-		t.Fatalf("review slice status = %q lastReviewedAt=%v, want reviewed with timestamp", reviewSlice.Status, reviewSlice.LastReviewedAt)
+	if storedReviewSlice.Status != reviewSliceStatusReviewed || storedReviewSlice.LastReviewedAt == nil {
+		t.Fatalf("review slice status = %q lastReviewedAt=%v, want reviewed with timestamp", storedReviewSlice.Status, storedReviewSlice.LastReviewedAt)
 	}
 	listed, _, err := store.ListFindings(ctx, storepkg.FindingFilter{Namespace: defaultNS, RepositoryScan: "kaset", SliceID: "slice_api"})
 	if err != nil {
@@ -1627,36 +2411,25 @@ func TestIngestReviewTaskPartitionsV2FindingsAndMarksSliceReviewed(t *testing.T)
 func TestIngestReviewTaskPersistsFilterDroppedDiagnosticsBeforeCap(t *testing.T) {
 	ctx := context.Background()
 	store := setupControllerSQLiteStore(t)
-	reconciler := &RepositoryScanReconciler{SecurityStore: store, ArtifactStore: store}
+	reconciler := &RepositoryScanReconciler{SecurityStore: store, ArtifactStore: store, ResultStore: store}
 	maxFindings := int32(1)
-	scan := &corev1alpha1.RepositoryScan{ObjectMeta: metav1.ObjectMeta{Name: "kaset", Namespace: defaultNS}, Spec: corev1alpha1.RepositoryScanSpec{MaxFindingsPerRun: &maxFindings}}
-	if err := store.CreateScanRun(ctx, &storepkg.ScanRun{ID: "scan_review_filter", Namespace: defaultNS, RepositoryScan: "kaset", TaskName: "kaset-review-filter", Mode: "initial", Phase: scanRunPhaseRunning, HeadCommit: "trusted-head", StartedAt: time.Now()}); err != nil {
+	scan := &corev1alpha1.RepositoryScan{ObjectMeta: metav1.ObjectMeta{Name: "kaset", Namespace: defaultNS}, Spec: corev1alpha1.RepositoryScanSpec{RepoURL: "https://github.com/example/repo", MaxFindingsPerRun: &maxFindings}}
+	policyDigest := security.ScannerPolicyDigest(security.ScannerPolicy{})
+	if err := store.CreateScanRun(ctx, &storepkg.ScanRun{ID: "scan_review_filter", Namespace: defaultNS, RepositoryScan: "kaset", TaskName: "kaset-review-filter", Mode: "initial", Phase: scanRunPhaseRunning, HeadCommit: "trusted-head", PolicyDigest: policyDigest, StartedAt: time.Now()}); err != nil {
 		t.Fatalf("CreateScanRun() error = %v", err)
 	}
-	if err := store.UpsertReviewSlice(ctx, &storepkg.ReviewSlice{SchemaVersion: 1, ID: "slice_filter", Namespace: defaultNS, RepositoryScan: "kaset", Source: "deterministic", Title: "Filter slice", Kind: "package", OwnedFiles: []storepkg.ReviewSliceFile{{Path: "docs/security.md"}, {Path: "internal/api/security.go"}}, Confidence: "high", Status: reviewSliceStatusPending, LastScanRunID: "scan_review_filter"}); err != nil {
+	reviewSlice := &storepkg.ReviewSlice{SchemaVersion: 1, ID: "slice_filter", Namespace: defaultNS, RepositoryScan: "kaset", Source: "deterministic", Title: "Filter slice", Kind: "package", OwnedFiles: []storepkg.ReviewSliceFile{{Path: "docs/security.md"}, {Path: "internal/api/security.go"}}, Confidence: "high", Status: reviewSliceStatusPending, LastScanRunID: "scan_review_filter"}
+	bindReviewSliceContext(t, reviewSlice)
+	if err := store.UpsertReviewSlice(ctx, reviewSlice); err != nil {
 		t.Fatalf("UpsertReviewSlice() error = %v", err)
 	}
 	task := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{Name: "kaset-review-filter", Namespace: defaultNS, Labels: map[string]string{labels.LabelSecurityTarget: "kaset", labels.LabelSecurityScanID: "scan_review_filter", labels.LabelSecurityMode: "initial", labels.LabelSecurityStage: security.StageReview, labels.LabelSecuritySliceID: "slice_filter"}}, Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhaseSucceeded}}
-	manifest := security.ReviewContextManifest{SchemaVersion: security.SchemaVersionReviewContext, SliceID: "slice_filter", IncludedFiles: []security.ReviewContextIncludedFile{{Path: "docs/security.md", Role: "owned", IncludedLineRanges: []security.ReviewContextLineRange{{StartLine: 1, EndLine: 5}}, Readable: true}, {Path: "internal/api/security.go", Role: "owned", IncludedLineRanges: []security.ReviewContextLineRange{{StartLine: 1, EndLine: 20}}, Readable: true}}}
-	manifestData, err := json.Marshal(manifest)
-	if err != nil {
-		t.Fatalf("json.Marshal(manifest) error = %v", err)
-	}
-	if err := store.SaveArtifact(ctx, task.Namespace, task.Name, security.ReviewContextArtifactName("slice_filter"), "application/json", manifestData); err != nil {
-		t.Fatalf("SaveArtifact(manifest) error = %v", err)
-	}
-	findings := security.FindingsV2Artifact{SchemaVersion: security.SchemaVersionFindingsV2, Repository: security.FindingsV2Repository{RepoURL: "https://github.com/example/repo", Branch: "main"}, Scan: security.FindingsV2Scan{Mode: "initial", SliceID: "slice_filter", Summary: "filter then cap"}, Findings: []security.FindingsV2Finding{
+	findings := security.FindingsV2Artifact{SchemaVersion: security.SchemaVersionFindingsV2, Repository: security.FindingsV2Repository{RepoURL: "https://github.com/example/repo", Branch: "main", HeadSHA: "trusted-head"}, Scan: security.FindingsV2Scan{Mode: "initial", SliceID: "slice_filter", Summary: "filter then cap"}, Findings: []security.FindingsV2Finding{
 		{Title: "Docs-only rate limit", Category: "rate-limit", Severity: "medium", Confidence: "high", Summary: "Documentation says rate limiting is missing.", Remediation: "Document it.", Evidence: []security.FindingsV2EvidenceRef{{Path: "docs/security.md", StartLine: 1, EndLine: 1}}},
 		{Title: "Unsafe API behavior", Category: "authz", Severity: "high", Confidence: "high", Summary: "Attacker-controlled request crosses auth trust boundary.", Remediation: "Add server-side authorization.", Evidence: []security.FindingsV2EvidenceRef{{Path: "internal/api/security.go", StartLine: 2, EndLine: 3}}},
 		{Title: "Unsafe API audit bypass", Category: "authz", Severity: "medium", Confidence: "high", Summary: "Second concrete tenant authorization bypass.", Remediation: "Add server-side authorization.", Evidence: []security.FindingsV2EvidenceRef{{Path: "internal/api/security.go", StartLine: 4, EndLine: 5}}},
 	}}
-	findingsData, err := json.Marshal(findings)
-	if err != nil {
-		t.Fatalf("json.Marshal(findings) error = %v", err)
-	}
-	if err := store.SaveArtifact(ctx, task.Namespace, task.Name, security.ArtifactFindingsV2, "application/json", findingsData); err != nil {
-		t.Fatalf("SaveArtifact(findings) error = %v", err)
-	}
+	saveFindingsTaskResult(t, store, task, scan.Name, "scan_review_filter", policyDigest, reviewSlice.ReviewContextHash, "slice_filter", findings)
 
 	if err := reconciler.ingestScanTask(ctx, scan, task); err != nil {
 		t.Fatalf("ingestScanTask() error = %v", err)
@@ -1707,33 +2480,21 @@ func TestIngestReviewTaskChecksPolicyDriftBeforeFilteringFindings(t *testing.T)
 	}
 	policyConfig := &corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: "scan-policy", Namespace: defaultNS, Labels: map[string]string{security.PolicyConfigMapAllowedLabel: "true"}}, Data: map[string]string{"policy": "changed policy"}}
 	cl := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&corev1alpha1.RepositoryScan{}).WithObjects(scan, policyConfig).Build()
-	reconciler := &RepositoryScanReconciler{Client: cl, Scheme: scheme, SecurityStore: store, ArtifactStore: store}
+	reconciler := &RepositoryScanReconciler{Client: cl, Scheme: scheme, SecurityStore: store, ArtifactStore: store, ResultStore: store}
 	run := &storepkg.ScanRun{ID: "scan_review_drift", Namespace: defaultNS, RepositoryScan: "kaset", TaskName: "kaset-review-drift", Mode: "initial", Phase: scanRunPhaseRunning, PolicyDigest: "sha256:old", StartedAt: time.Now()}
 	if err := store.CreateScanRun(ctx, run); err != nil {
 		t.Fatalf("CreateScanRun() error = %v", err)
 	}
-	if err := store.UpsertReviewSlice(ctx, &storepkg.ReviewSlice{SchemaVersion: 1, ID: "slice_docs", Namespace: defaultNS, RepositoryScan: "kaset", Source: "deterministic", Title: "Docs", Kind: "package", OwnedFiles: []storepkg.ReviewSliceFile{{Path: "docs/security.md"}}, Confidence: "high", Status: reviewSliceStatusPending, LastScanRunID: run.ID}); err != nil {
+	reviewSlice := &storepkg.ReviewSlice{SchemaVersion: 1, ID: "slice_docs", Namespace: defaultNS, RepositoryScan: "kaset", Source: "deterministic", Title: "Docs", Kind: "package", OwnedFiles: []storepkg.ReviewSliceFile{{Path: "docs/security.md"}}, Confidence: "high", Status: reviewSliceStatusPending, LastScanRunID: run.ID}
+	bindReviewSliceContext(t, reviewSlice)
+	if err := store.UpsertReviewSlice(ctx, reviewSlice); err != nil {
 		t.Fatalf("UpsertReviewSlice() error = %v", err)
 	}
 	task := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{Name: "kaset-review-drift", Namespace: defaultNS, Labels: map[string]string{labels.LabelSecurityTarget: "kaset", labels.LabelSecurityScanID: run.ID, labels.LabelSecurityMode: "initial", labels.LabelSecurityStage: security.StageReview, labels.LabelSecuritySliceID: "slice_docs"}}, Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhaseSucceeded}}
-	manifest := security.ReviewContextManifest{SchemaVersion: security.SchemaVersionReviewContext, SliceID: "slice_docs", IncludedFiles: []security.ReviewContextIncludedFile{{Path: "docs/security.md", Role: "owned", IncludedLineRanges: []security.ReviewContextLineRange{{StartLine: 1, EndLine: 5}}, Readable: true}}}
-	manifestData, err := json.Marshal(manifest)
-	if err != nil {
-		t.Fatalf("json.Marshal(manifest) error = %v", err)
-	}
-	if err := store.SaveArtifact(ctx, task.Namespace, task.Name, security.ReviewContextArtifactName("slice_docs"), "application/json", manifestData); err != nil {
-		t.Fatalf("SaveArtifact(manifest) error = %v", err)
-	}
 	findings := security.FindingsV2Artifact{SchemaVersion: security.SchemaVersionFindingsV2, Repository: security.FindingsV2Repository{RepoURL: "https://github.com/example/repo", Branch: "main"}, Scan: security.FindingsV2Scan{Mode: "initial", SliceID: "slice_docs", Summary: "docs only"}, Findings: []security.FindingsV2Finding{{Title: "Docs-only rate limit", Category: "rate-limit", Severity: "medium", Confidence: "high", Summary: "Documentation says rate limiting is missing.", Remediation: "Document it.", Evidence: []security.FindingsV2EvidenceRef{{Path: "docs/security.md", StartLine: 1, EndLine: 1}}}}}
-	findingsData, err := json.Marshal(findings)
-	if err != nil {
-		t.Fatalf("json.Marshal(findings) error = %v", err)
-	}
-	if err := store.SaveArtifact(ctx, task.Namespace, task.Name, security.ArtifactFindingsV2, "application/json", findingsData); err != nil {
-		t.Fatalf("SaveArtifact(findings) error = %v", err)
-	}
+	saveFindingsTaskResult(t, store, task, scan.Name, run.ID, run.PolicyDigest, reviewSlice.ReviewContextHash, reviewSlice.ID, findings)
 
-	err = reconciler.ingestScanTask(ctx, scan, task)
+	err := reconciler.ingestScanTask(ctx, scan, task)
 	if err == nil || !strings.Contains(err.Error(), "scanner policy digest changed") {
 		t.Fatalf("ingestScanTask() error = %v, want policy drift", err)
 	}
@@ -1744,11 +2505,11 @@ func TestIngestReviewTaskChecksPolicyDriftBeforeFilteringFindings(t *testing.T)
 	if storedRun.Phase != scanRunPhaseFailed {
 		t.Fatalf("run phase = %q, want failed", storedRun.Phase)
 	}
-	reviewSlice, err := store.GetReviewSlice(ctx, defaultNS, "kaset", "slice_docs")
+	storedReviewSlice, err := store.GetReviewSlice(ctx, defaultNS, "kaset", "slice_docs")
 	if err != nil {
 		t.Fatalf("GetReviewSlice() error = %v", err)
 	}
-	if reviewSlice.Status == reviewSliceStatusReviewed {
+	if storedReviewSlice.Status == reviewSliceStatusReviewed {
 		t.Fatal("review slice was marked reviewed despite policy drift")
 	}
 }
@@ -1763,16 +2524,18 @@ func TestIngestReviewTaskSkipsStaleSliceRun(t *testing.T) {
 	scan := &corev1alpha1.RepositoryScan{
 		ObjectMeta: metav1.ObjectMeta{Name: "kaset", Namespace: defaultNS},
 	}
+	oldCompletedAt := time.Now().Add(-30 * time.Minute)
 	if err := store.CreateScanRun(ctx, &storepkg.ScanRun{
 		ID:             "scan_old_review",
 		Namespace:      defaultNS,
 		RepositoryScan: "kaset",
 		TaskName:       "kaset-review-slice-old",
 		Mode:           "initial",
-		Phase:          scanRunPhaseRunning,
+		Phase:          scanRunPhaseSucceeded,
 		BaseCommit:     "old-base",
 		HeadCommit:     "old-head",
 		StartedAt:      time.Now().Add(-1 * time.Hour),
+		CompletedAt:    &oldCompletedAt,
 	}); err != nil {
 		t.Fatalf("CreateScanRun(old) error = %v", err)
 	}
@@ -2040,6 +2803,12 @@ func TestIngestValidationTaskUpdatesFindingValidationDetails(t *testing.T) {
 		Confidence:       "high",
 		ValidationStatus: "unvalidated",
 		State:            findingStateOpen,
+		Evidence: []storepkg.FindingEvidenceRef{{
+			Kind:      "file",
+			Path:      "internal/api/security.go",
+			StartLine: 10,
+			EndLine:   20,
+		}},
 	}
 	if err := store.UpsertFinding(ctx, finding); err != nil {
 		t.Fatalf("UpsertFinding() error = %v", err)
@@ -2053,13 +2822,9 @@ func TestIngestValidationTaskUpdatesFindingValidationDetails(t *testing.T) {
 		ValidationSteps:    []string{"Trace input to shell execution", "Confirm shell metacharacters are preserved"},
 		AttackPathAnalysis: "Attacker controls package names which reach shell execution.",
 		Evidence: []storepkg.FindingEvidenceRef{
-			{Kind: "artifact", Name: "security-validation.txt", Label: "Validation transcript"},
+			{Kind: "file", Path: "internal/api/security.go", StartLine: 12, EndLine: 16, Label: "Confirmed sink path"},
 		},
 	}
-	data, err := json.Marshal(validation)
-	if err != nil {
-		t.Fatalf("json.Marshal(validation) error = %v", err)
-	}
 
 	task := &corev1alpha1.Task{
 		ObjectMeta: metav1.ObjectMeta{
@@ -2067,6 +2832,7 @@ func TestIngestValidationTaskUpdatesFindingValidationDetails(t *testing.T) {
 			Namespace: defaultNS,
 			Labels: map[string]string{
 				labels.LabelSecurityTarget:    "kaset",
+				labels.LabelSecurityScanID:    finding.ScanRunID,
 				labels.LabelSecurityFindingID: finding.ID,
 				labels.LabelSecurityStage:     security.StageValidation,
 				labels.LabelSecurityMode:      security.StageValidation,
@@ -2074,13 +2840,7 @@ func TestIngestValidationTaskUpdatesFindingValidationDetails(t *testing.T) {
 		},
 		Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhaseSucceeded},
 	}
-
-	if err := store.SaveArtifact(ctx, task.Namespace, task.Name, security.ArtifactValidation, "application/json", data); err != nil {
-		t.Fatalf("SaveArtifact(validation) error = %v", err)
-	}
-	if err := store.SaveArtifact(ctx, task.Namespace, task.Name, security.ArtifactValidationText, "text/plain", []byte("validation transcript")); err != nil {
-		t.Fatalf("SaveArtifact(validation transcript) error = %v", err)
-	}
+	saveValidationTaskResult(t, store, task, scan.Name, finding.ScanRunID, security.ScannerPolicyDigest(security.ScannerPolicy{}), validation)
 
 	if err := reconciler.ingestValidationTask(ctx, scan, task); err != nil {
 		t.Fatalf("ingestValidationTask() error = %v", err)
@@ -2099,15 +2859,15 @@ func TestIngestValidationTaskUpdatesFindingValidationDetails(t *testing.T) {
 	if len(updated.Evidence) < 2 {
 		t.Fatalf("len(Evidence) = %d, want at least 2 refs", len(updated.Evidence))
 	}
-	foundTranscript := false
+	foundValidatedRange := false
 	for _, ref := range updated.Evidence {
-		if ref.Name == security.ArtifactValidationText && ref.TaskName == task.Name {
-			foundTranscript = true
+		if ref.Kind == "file" && ref.Path == "internal/api/security.go" && ref.StartLine == 12 && ref.EndLine == 16 && ref.TaskName == task.Name {
+			foundValidatedRange = true
 			break
 		}
 	}
-	if !foundTranscript {
-		t.Fatalf("updated.Evidence = %#v, want validation transcript artifact ref with task name", updated.Evidence)
+	if !foundValidatedRange {
+		t.Fatalf("updated.Evidence = %#v, want validated file range with task name", updated.Evidence)
 	}
 }
 
@@ -2337,11 +3097,29 @@ func TestCreateScanRunIsIdempotentWhenTaskAlreadyExists(t *testing.T) {
 }
 
 type patchIngestFixture struct {
-	store      *sqlitestore.Store
-	reconciler *RepositoryScanReconciler
-	scan       *corev1alpha1.RepositoryScan
-	finding    *storepkg.Finding
-	proposal   *storepkg.PatchProposal
+	store            *sqlitestore.Store
+	publicationStore *patchPublicationStore
+	reconciler       *RepositoryScanReconciler
+	scan             *corev1alpha1.RepositoryScan
+	finding          *storepkg.Finding
+	proposal         *storepkg.PatchProposal
+}
+
+type patchPublicationStore struct {
+	storepkg.PublicationStore
+	publication *storepkg.Publication
+	err         error
+}
+
+func (s *patchPublicationStore) GetPublication(_ context.Context, id string) (*storepkg.Publication, error) {
+	if s.err != nil {
+		return nil, s.err
+	}
+	if s.publication == nil || s.publication.ID != id {
+		return nil, storepkg.ErrNotFound
+	}
+	copyValue := *s.publication
+	return &copyValue, nil
 }
 
 func newPatchIngestFixture(t *testing.T, id string) patchIngestFixture {
@@ -2352,15 +3130,24 @@ func newPatchIngestFixture(t *testing.T, id string) patchIngestFixture {
 	findingID := "fnd_patch_" + id
 	taskName := "kaset-patch-" + id
 	branch := "orka/security/" + findingID
+	publicationStore := &patchPublicationStore{}
 	fixture := patchIngestFixture{
-		store: securityStore,
+		store:            securityStore,
+		publicationStore: publicationStore,
 		reconciler: &RepositoryScanReconciler{
-			SecurityStore: securityStore,
-			ArtifactStore: securityStore,
-			ResultStore:   securityStore,
+			SecurityStore:    securityStore,
+			ArtifactStore:    securityStore,
+			ResultStore:      securityStore,
+			PublicationStore: publicationStore,
 		},
 		scan: &corev1alpha1.RepositoryScan{
 			ObjectMeta: metav1.ObjectMeta{Name: "kaset", Namespace: defaultNS},
+			Spec: corev1alpha1.RepositoryScanSpec{
+				RepoURL:      "https://github.com/example/kaset",
+				ForkRepo:     "https://github.com/example/kaset",
+				Branch:       "main",
+				PRBaseBranch: "main",
+			},
 		},
 		finding: &storepkg.Finding{
 			ID:               findingID,
@@ -2399,10 +3186,13 @@ func newPatchIngestFixture(t *testing.T, id string) patchIngestFixture {
 func patchTaskForFixture(fixture patchIngestFixture, resultAvailable bool) *corev1alpha1.Task {
 	diffName := fmt.Sprintf("security-patch-%s.diff", fixture.finding.ID)
 	summaryName := fmt.Sprintf("security-patch-%s.json", fixture.finding.ID)
-	return &corev1alpha1.Task{
+	remoteBeforeSHA := ""
+	headSHA := strings.Repeat("b", 40)
+	task := &corev1alpha1.Task{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      fixture.proposal.TaskName,
 			Namespace: fixture.proposal.Namespace,
+			UID:       types.UID("uid-" + fixture.proposal.TaskName),
 			Labels: map[string]string{
 				labels.LabelSecurityTarget:    fixture.scan.Name,
 				labels.LabelSecurityFindingID: fixture.finding.ID,
@@ -2411,18 +3201,81 @@ func patchTaskForFixture(fixture patchIngestFixture, resultAvailable bool) *core
 			},
 		},
 		Spec: corev1alpha1.TaskSpec{
+			Type:   corev1alpha1.TaskTypeAgent,
 			Prompt: fmt.Sprintf("REQUIRED_SECURITY_ARTIFACTS: %s, %s\n", diffName, summaryName),
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					PushBranch: fixture.proposal.Branch,
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				Intent:             corev1alpha1.WorkspaceIntentWrite,
+				GitRepo:            fixture.scan.Spec.RepoURL,
+				PublicationGitRepo: fixture.scan.Spec.ForkRepo,
+				PushBranch:         fixture.proposal.Branch,
+				ExpectedRemoteSHA:  remoteBeforeSHA,
+				PRBaseBranch:       fixture.scan.Spec.PRBaseBranch,
+				CreatePR:           true,
 			},
 		},
 		Status: corev1alpha1.TaskStatus{
 			Phase:     corev1alpha1.TaskPhaseSucceeded,
 			ResultRef: &corev1alpha1.ResultReference{Available: resultAvailable},
+			Execution: &corev1alpha1.TaskExecutionStatus{Attempt: 1, PromptID: "prompt-" + fixture.proposal.TaskName},
+			Delivery: &corev1alpha1.TaskDeliveryStatus{
+				State:         corev1alpha1.TaskDeliveryStateVerifiedExact,
+				Outcome:       corev1alpha1.TaskDeliveryOutcomeVerifiedExact,
+				PublicationID: "publication-" + fixture.proposal.TaskName,
+				PublicationRepository: &corev1alpha1.RepositoryIdentity{
+					Provider: "github",
+					ID:       "github.com/example/kaset",
+				},
+				Branch:            fixture.proposal.Branch,
+				RemoteBeforeSHA:   &remoteBeforeSHA,
+				ExpectedCommitSHA: headSHA,
+				VerifiedRemoteSHA: headSHA,
+				ArtifactDigest:    "sha256:" + strings.Repeat("a", 64),
+				PRReceipt: &corev1alpha1.TaskPullRequestReceipt{
+					ID:         "github:101:42",
+					Number:     42,
+					URL:        fixture.scan.Spec.RepoURL + "/pull/42",
+					State:      "Open",
+					BaseBranch: fixture.scan.Spec.PRBaseBranch,
+					HeadBranch: fixture.proposal.Branch,
+					HeadSHA:    headSHA,
+				},
+			},
 		},
 	}
+	fixture.publicationStore.publication = patchPublicationForTask(fixture, task)
+	return task
+}
+
+func patchPublicationForTask(fixture patchIngestFixture, task *corev1alpha1.Task) *storepkg.Publication {
+	sourceSHA := strings.Repeat("1", 40)
+	headSHA := strings.Repeat("b", 40)
+	repositoryID := "github.com/example/kaset"
+	targetRef := "refs/heads/" + fixture.proposal.Branch
+	baseRef := "refs/heads/" + fixture.scan.Spec.PRBaseBranch
+	now := time.Now().UTC()
+	return &storepkg.Publication{
+		ID:                  publicationIDForTask(task),
+		Namespace:           task.Namespace,
+		Generation:          1,
+		TaskUID:             string(task.UID),
+		Attempt:             int64(task.Status.Execution.Attempt),
+		PromptID:            task.Status.Execution.PromptID,
+		SourceRepositoryID:  repositoryID,
+		SourceRef:           sourceSHA,
+		SourceBaselineSHA:   sourceSHA,
+		TargetRepositoryID:  repositoryID,
+		TargetRef:           targetRef,
+		Baseline:            storepkg.RemoteRefState{Absent: true},
+		ArtifactDigest:      "sha256:" + strings.Repeat("a", 64),
+		State:               storepkg.PublicationVerifiedExact,
+		PreparedReceipt:     &storepkg.PreparedPublicationReceipt{CommitSHA: headSHA},
+		PublishReceipt:      &storepkg.PublishOperationReceipt{TargetRepositoryID: repositoryID, TargetRef: targetRef, RemoteBefore: storepkg.RemoteRefState{Absent: true}, ExpectedCommitSHA: headSHA},
+		VerificationReceipt: &storepkg.PublicationVerificationReceipt{Outcome: storepkg.PublicationVerifiedExact, ExpectedCommitSHA: headSHA, ObservedRemote: storepkg.RemoteRefState{SHA: headSHA}},
+		PRIntent:            &storepkg.PullRequestIntent{BaseRepositoryID: repositoryID, BaseRef: baseRef, HeadRepositoryID: repositoryID, HeadRef: targetRef, PublicationGeneration: 1, ExpectedHeadSHA: headSHA},
+		PullRequestReceipt:  &storepkg.PullRequestOperationReceipt{IntentKey: "sha256:" + strings.Repeat("c", 64), ForgeID: "github:101:42", URL: fixture.scan.Spec.RepoURL + "/pull/42", State: "Open", HeadSHA: headSHA, ReconciledAt: now},
+		CreatedAt:           now,
+		UpdatedAt:           now,
+	}
 }
 
 func savePatchStructuredResult(t *testing.T, fixture patchIngestFixture, sr *common.StructuredResult) {
@@ -2481,10 +3334,10 @@ func assertPatchIngestState(t *testing.T, fixture patchIngestFixture, wantPropos
 	}
 }
 
-func TestIngestPatchTaskMarksPatchReadyAfterConfirmedPush(t *testing.T) {
+func TestIngestPatchTaskMarksPROpenAfterExactPublicationReceipt(t *testing.T) {
 	ctx := context.Background()
 	fixture := newPatchIngestFixture(t, "ready")
-	diff := "diff --git a/app.py b/app.py"
+	diff := testPatchDiffHeader
 	savePatchStructuredResult(t, fixture, &common.StructuredResult{
 		Summary:    "patched successfully",
 		Diff:       diff,
@@ -2496,14 +3349,28 @@ func TestIngestPatchTaskMarksPatchReadyAfterConfirmedPush(t *testing.T) {
 	if err := fixture.reconciler.ingestPatchTask(ctx, fixture.scan, patchTaskForFixture(fixture, true)); err != nil {
 		t.Fatalf("ingestPatchTask() error = %v", err)
 	}
-	assertPatchIngestState(t, fixture, scanRunPhaseSucceeded, findingStatePatchReady)
+	assertPatchIngestState(t, fixture, patchProposalStatusPROpened, findingStatePROpen)
+	proposals, err := fixture.store.ListPatchProposals(ctx, fixture.proposal.Namespace, fixture.finding.ID)
+	if err != nil {
+		t.Fatalf("ListPatchProposals() error = %v", err)
+	}
+	if len(proposals) != 1 || proposals[0].PRNumber == nil || *proposals[0].PRNumber != 42 || proposals[0].PRURL != fixture.scan.Spec.RepoURL+"/pull/42" {
+		t.Fatalf("proposal publication receipt = %#v, want PR #42", proposals)
+	}
+	updatedFinding, err := fixture.store.GetFinding(ctx, fixture.proposal.Namespace, fixture.finding.ID)
+	if err != nil {
+		t.Fatalf("GetFinding() error = %v", err)
+	}
+	if updatedFinding.PRNumber == nil || *updatedFinding.PRNumber != 42 || updatedFinding.PRURL != fixture.scan.Spec.RepoURL+"/pull/42" {
+		t.Fatalf("finding publication receipt = %#v, want PR #42", updatedFinding)
+	}
 }
 
 func TestIngestPatchTaskAcceptsDiffArtifactWithDifferentIndexFormatting(t *testing.T) {
 	ctx := context.Background()
 	fixture := newPatchIngestFixture(t, "diff-index-format")
 	actualDiff := strings.Join([]string{
-		"diff --git a/app.py b/app.py",
+		testPatchDiffHeader,
 		"index 1111111111111111111111111111111111111111..2222222222222222222222222222222222222222 100644",
 		"--- a/app.py",
 		"+++ b/app.py",
@@ -2513,7 +3380,7 @@ func TestIngestPatchTaskAcceptsDiffArtifactWithDifferentIndexFormatting(t *testi
 		"",
 	}, "\n")
 	artifactDiff := strings.Join([]string{
-		"diff --git a/app.py b/app.py",
+		testPatchDiffHeader,
 		"index 1111111..2222222 100644",
 		"--- a/app.py",
 		"+++ b/app.py",
@@ -2533,7 +3400,7 @@ func TestIngestPatchTaskAcceptsDiffArtifactWithDifferentIndexFormatting(t *testi
 	if err := fixture.reconciler.ingestPatchTask(ctx, fixture.scan, patchTaskForFixture(fixture, true)); err != nil {
 		t.Fatalf("ingestPatchTask() error = %v", err)
 	}
-	assertPatchIngestState(t, fixture, scanRunPhaseSucceeded, findingStatePatchReady)
+	assertPatchIngestState(t, fixture, patchProposalStatusPROpened, findingStatePROpen)
 }
 
 func TestIngestPatchTaskAcceptsSubPathRelativeChangedFiles(t *testing.T) {
@@ -2552,7 +3419,92 @@ func TestIngestPatchTaskAcceptsSubPathRelativeChangedFiles(t *testing.T) {
 	if err := fixture.reconciler.ingestPatchTask(ctx, fixture.scan, patchTaskForFixture(fixture, true)); err != nil {
 		t.Fatalf("ingestPatchTask() error = %v", err)
 	}
-	assertPatchIngestState(t, fixture, scanRunPhaseSucceeded, findingStatePatchReady)
+	assertPatchIngestState(t, fixture, patchProposalStatusPROpened, findingStatePROpen)
+}
+
+func TestIngestPatchTaskUsesDurablePublicationWhenTaskDeliveryReceiptIsMissing(t *testing.T) {
+	ctx := context.Background()
+	fixture := newPatchIngestFixture(t, "task-receipt-missing")
+	diff := testPatchDiffHeader
+	savePatchArtifacts(t, fixture, diff, []string{"app.py"})
+	task := patchTaskForFixture(fixture, true)
+	task.Status.Delivery = nil
+
+	if err := fixture.reconciler.ingestPatchTask(ctx, fixture.scan, task); err != nil {
+		t.Fatalf("ingestPatchTask() error = %v", err)
+	}
+	assertPatchIngestState(t, fixture, patchProposalStatusPROpened, findingStatePROpen)
+}
+
+func TestIngestPatchTaskRejectsMissingDurablePullRequestReceipt(t *testing.T) {
+	ctx := context.Background()
+	fixture := newPatchIngestFixture(t, "durable-pr-receipt-missing")
+	diff := testPatchDiffHeader
+	savePatchArtifacts(t, fixture, diff, []string{"app.py"})
+	task := patchTaskForFixture(fixture, true)
+	fixture.publicationStore.publication.PullRequestReceipt = nil
+
+	if err := fixture.reconciler.ingestPatchTask(ctx, fixture.scan, task); err != nil {
+		t.Fatalf("ingestPatchTask() error = %v", err)
+	}
+	assertPatchIngestState(t, fixture, scanRunPhaseFailed, findingStateOpen)
+}
+
+func TestVerifiedSecurityPatchPublicationRejectsDurableRecordDrift(t *testing.T) {
+	const mismatchedBranchRef = "refs/heads/other"
+
+	tests := []struct {
+		name              string
+		mutateTask        func(*corev1alpha1.Task)
+		mutatePublication func(*storepkg.Publication)
+	}{
+		{name: "create PR not requested", mutateTask: func(task *corev1alpha1.Task) { task.Spec.Workspace.CreatePR = false }},
+		{name: "task UID mismatch", mutatePublication: func(publication *storepkg.Publication) { publication.TaskUID = "mismatched-task-uid" }},
+		{name: "publication not verified", mutatePublication: func(publication *storepkg.Publication) { publication.State = storepkg.PublicationVerifying }},
+		{name: "source repository mismatch", mutatePublication: func(publication *storepkg.Publication) { publication.SourceRepositoryID = "github.com/example/other" }},
+		{name: "source baseline mismatch", mutatePublication: func(publication *storepkg.Publication) { publication.SourceRef = strings.Repeat("2", 40) }},
+		{name: "target repository mismatch", mutatePublication: func(publication *storepkg.Publication) { publication.TargetRepositoryID = "github.com/example/other" }},
+		{name: "target ref mismatch", mutatePublication: func(publication *storepkg.Publication) { publication.TargetRef = mismatchedBranchRef }},
+		{name: "target baseline mismatch", mutatePublication: func(publication *storepkg.Publication) {
+			publication.Baseline = storepkg.RemoteRefState{SHA: strings.Repeat("2", 40)}
+		}},
+		{name: "prepared receipt missing", mutatePublication: func(publication *storepkg.Publication) { publication.PreparedReceipt = nil }},
+		{name: "publish target mismatch", mutatePublication: func(publication *storepkg.Publication) { publication.PublishReceipt.TargetRef = mismatchedBranchRef }},
+		{name: "verification head mismatch", mutatePublication: func(publication *storepkg.Publication) {
+			publication.VerificationReceipt.ObservedRemote.SHA = strings.Repeat("c", 40)
+		}},
+		{name: "PR intent base mismatch", mutatePublication: func(publication *storepkg.Publication) { publication.PRIntent.BaseRef = "refs/heads/release" }},
+		{name: "PR intent head mismatch", mutatePublication: func(publication *storepkg.Publication) { publication.PRIntent.HeadRef = mismatchedBranchRef }},
+		{name: "PR receipt missing", mutatePublication: func(publication *storepkg.Publication) { publication.PullRequestReceipt = nil }},
+		{name: "PR forge ID invalid", mutatePublication: func(publication *storepkg.Publication) {
+			publication.PullRequestReceipt.ForgeID = "github:101:not-a-number"
+		}},
+		{name: "PR URL mismatch", mutatePublication: func(publication *storepkg.Publication) {
+			publication.PullRequestReceipt.URL = "https://github.com/example/other/pull/42"
+		}},
+		{name: "PR not open", mutatePublication: func(publication *storepkg.Publication) { publication.PullRequestReceipt.State = "Closed" }},
+		{name: "PR head mismatch", mutatePublication: func(publication *storepkg.Publication) {
+			publication.PullRequestReceipt.HeadSHA = strings.Repeat("c", 40)
+		}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fixture := newPatchIngestFixture(t, strings.ReplaceAll(tt.name, " ", "-"))
+			task := patchTaskForFixture(fixture, true)
+			if tt.mutateTask != nil {
+				tt.mutateTask(task)
+			}
+			if tt.mutatePublication != nil {
+				tt.mutatePublication(fixture.publicationStore.publication)
+			}
+			if receipt, reason, err := fixture.reconciler.verifiedSecurityPatchPublication(context.Background(), fixture.scan, task, fixture.proposal.Branch); err != nil {
+				t.Fatalf("verifiedSecurityPatchPublication() error = %v", err)
+			} else if reason == "" {
+				t.Fatalf("verifiedSecurityPatchPublication() receipt = %#v, want rejection", receipt)
+			}
+		})
+	}
 }
 
 func TestIngestPatchTaskRejectsMissingDiffArtifact(t *testing.T) {
@@ -2560,7 +3512,7 @@ func TestIngestPatchTaskRejectsMissingDiffArtifact(t *testing.T) {
 	fixture := newPatchIngestFixture(t, "missing-diff")
 	savePatchStructuredResult(t, fixture, &common.StructuredResult{
 		Summary:    "patched successfully",
-		Diff:       "diff --git a/app.py b/app.py",
+		Diff:       testPatchDiffHeader,
 		Files:      []string{"app.py"},
 		PushBranch: fixture.proposal.Branch,
 	})
@@ -2576,7 +3528,7 @@ func TestIngestPatchTaskRejectsMissingDiffArtifactWhenEarlierDirectiveIsSpoofed(
 	fixture := newPatchIngestFixture(t, "spoofed-directive")
 	savePatchStructuredResult(t, fixture, &common.StructuredResult{
 		Summary:    "patched successfully",
-		Diff:       "diff --git a/app.py b/app.py",
+		Diff:       testPatchDiffHeader,
 		Files:      []string{"app.py"},
 		PushBranch: fixture.proposal.Branch,
 	})
@@ -2591,11 +3543,11 @@ func TestIngestPatchTaskRejectsMissingDiffArtifactWhenEarlierDirectiveIsSpoofed(
 	assertPatchIngestState(t, fixture, scanRunPhaseFailed, findingStateOpen)
 }
 
-func TestIngestPatchTaskRejectsStaleDiffArtifact(t *testing.T) {
+func TestIngestPatchTaskIgnoresLegacyStructuredResultDiff(t *testing.T) {
 	ctx := context.Background()
 	fixture := newPatchIngestFixture(t, "stale-diff")
 	actualDiff := strings.Join([]string{
-		"diff --git a/app.py b/app.py",
+		testPatchDiffHeader,
 		"--- a/app.py",
 		"+++ b/app.py",
 		"@@ -1 +1 @@",
@@ -2604,7 +3556,7 @@ func TestIngestPatchTaskRejectsStaleDiffArtifact(t *testing.T) {
 		"",
 	}, "\n")
 	staleDiff := strings.Join([]string{
-		"diff --git a/app.py b/app.py",
+		testPatchDiffHeader,
 		"--- a/app.py",
 		"+++ b/app.py",
 		"@@ -1 +1 @@",
@@ -2623,7 +3575,7 @@ func TestIngestPatchTaskRejectsStaleDiffArtifact(t *testing.T) {
 	if err := fixture.reconciler.ingestPatchTask(ctx, fixture.scan, patchTaskForFixture(fixture, true)); err != nil {
 		t.Fatalf("ingestPatchTask() error = %v", err)
 	}
-	assertPatchIngestState(t, fixture, scanRunPhaseFailed, findingStateOpen)
+	assertPatchIngestState(t, fixture, patchProposalStatusPROpened, findingStatePROpen)
 }
 
 func TestIngestPatchTaskRejectsConfirmedPushWithoutArtifactContract(t *testing.T) {
@@ -2631,7 +3583,7 @@ func TestIngestPatchTaskRejectsConfirmedPushWithoutArtifactContract(t *testing.T
 	fixture := newPatchIngestFixture(t, "no-artifacts")
 	savePatchStructuredResult(t, fixture, &common.StructuredResult{
 		Summary:    "patched successfully",
-		Diff:       "diff --git a/app.py b/app.py",
+		Diff:       testPatchDiffHeader,
 		Files:      []string{"app.py"},
 		PushBranch: fixture.proposal.Branch,
 	})
@@ -2647,14 +3599,14 @@ func TestIngestPatchTaskRejectsConfirmedPushWithoutArtifactContract(t *testing.T
 func TestIngestPatchTaskRejectsMismatchedChangedFiles(t *testing.T) {
 	ctx := context.Background()
 	fixture := newPatchIngestFixture(t, "mismatched-files")
-	diff := "diff --git a/app.py b/app.py"
+	diff := testPatchDiffHeader
 	savePatchStructuredResult(t, fixture, &common.StructuredResult{
 		Summary:    "patched successfully",
 		Diff:       diff,
 		Files:      []string{"app.py", "extra.py"},
 		PushBranch: fixture.proposal.Branch,
 	})
-	savePatchArtifacts(t, fixture, diff, []string{"app.py"})
+	savePatchArtifacts(t, fixture, diff, []string{"extra.py"})
 
 	if err := fixture.reconciler.ingestPatchTask(ctx, fixture.scan, patchTaskForFixture(fixture, true)); err != nil {
 		t.Fatalf("ingestPatchTask() error = %v", err)
@@ -2662,53 +3614,57 @@ func TestIngestPatchTaskRejectsMismatchedChangedFiles(t *testing.T) {
 	assertPatchIngestState(t, fixture, scanRunPhaseFailed, findingStateOpen)
 }
 
-func TestIngestPatchTaskFailsSucceededTaskWhenPushFails(t *testing.T) {
+func TestIngestPatchTaskIgnoresLegacyStructuredResultPushError(t *testing.T) {
 	ctx := context.Background()
 	fixture := newPatchIngestFixture(t, "failed")
 	savePatchStructuredResult(t, fixture, &common.StructuredResult{
 		Summary:   "patch created but push failed",
-		Diff:      "diff --git a/app.py b/app.py",
+		Diff:      testPatchDiffHeader,
 		PushError: "git push failed: remote rejected",
 	})
+	savePatchArtifacts(t, fixture, testPatchDiffHeader, []string{"app.py"})
 
 	if err := fixture.reconciler.ingestPatchTask(ctx, fixture.scan, patchTaskForFixture(fixture, true)); err != nil {
 		t.Fatalf("ingestPatchTask() error = %v", err)
 	}
-	assertPatchIngestState(t, fixture, scanRunPhaseFailed, findingStateOpen)
+	assertPatchIngestState(t, fixture, patchProposalStatusPROpened, findingStatePROpen)
 }
 
-func TestIngestPatchTaskFailsSucceededTaskWithoutConfirmedPushBranch(t *testing.T) {
+func TestIngestPatchTaskIgnoresLegacyStructuredResultWithoutPushBranch(t *testing.T) {
 	ctx := context.Background()
 	fixture := newPatchIngestFixture(t, "missing-push")
 	savePatchStructuredResult(t, fixture, &common.StructuredResult{
 		Summary: "patch created without confirmed push",
-		Diff:    "diff --git a/app.py b/app.py",
+		Diff:    testPatchDiffHeader,
 	})
+	savePatchArtifacts(t, fixture, testPatchDiffHeader, []string{"app.py"})
 
 	if err := fixture.reconciler.ingestPatchTask(ctx, fixture.scan, patchTaskForFixture(fixture, true)); err != nil {
 		t.Fatalf("ingestPatchTask() error = %v", err)
 	}
-	assertPatchIngestState(t, fixture, scanRunPhaseFailed, findingStateOpen)
+	assertPatchIngestState(t, fixture, patchProposalStatusPROpened, findingStatePROpen)
 }
 
-func TestIngestPatchTaskKeepsPatchPendingUntilResultIsAvailable(t *testing.T) {
+func TestIngestPatchTaskDoesNotRequireLegacyResultReference(t *testing.T) {
 	ctx := context.Background()
 	fixture := newPatchIngestFixture(t, "pending-ref")
+	savePatchArtifacts(t, fixture, testPatchDiffHeader, []string{"app.py"})
 
 	if err := fixture.reconciler.ingestPatchTask(ctx, fixture.scan, patchTaskForFixture(fixture, false)); err != nil {
 		t.Fatalf("ingestPatchTask() error = %v", err)
 	}
-	assertPatchIngestState(t, fixture, scanRunPhasePending, findingStatePatchPending)
+	assertPatchIngestState(t, fixture, patchProposalStatusPROpened, findingStatePROpen)
 }
 
-func TestIngestPatchTaskKeepsPatchPendingUntilResultExists(t *testing.T) {
+func TestIngestPatchTaskDoesNotRequireLegacyResultRecord(t *testing.T) {
 	ctx := context.Background()
 	fixture := newPatchIngestFixture(t, "pending-result")
+	savePatchArtifacts(t, fixture, testPatchDiffHeader, []string{"app.py"})
 
 	if err := fixture.reconciler.ingestPatchTask(ctx, fixture.scan, patchTaskForFixture(fixture, true)); err != nil {
 		t.Fatalf("ingestPatchTask() error = %v", err)
 	}
-	assertPatchIngestState(t, fixture, scanRunPhasePending, findingStatePatchPending)
+	assertPatchIngestState(t, fixture, patchProposalStatusPROpened, findingStatePROpen)
 }
 
 func TestRefreshScanRunStatusSetsLastScanAtOnFailedRun(t *testing.T) {
diff --git a/internal/controller/runtime_pool_controller.go b/internal/controller/runtime_pool_controller.go
new file mode 100644
index 000000000..12a2f584b
--- /dev/null
+++ b/internal/controller/runtime_pool_controller.go
@@ -0,0 +1,2928 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package controller
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"maps"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"reflect"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	networkingv1 "k8s.io/api/networking/v1"
+	policyv1 "k8s.io/api/policy/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	k8sruntime "k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/intstr"
+	"k8s.io/apimachinery/pkg/util/validation"
+	"k8s.io/utils/ptr"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/handler"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/events"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+const (
+	runtimePoolFinalizer          = "orka.ai/runtime-pool-cleanup"
+	runtimePoolRequeue            = 10 * time.Second
+	runtimePoolProbeTimeout       = 10 * time.Second
+	runtimePoolPort         int32 = 8080
+
+	runtimePoolManagedByLabel                    = "app.kubernetes.io/managed-by"
+	runtimePoolApplicationLabel                  = "app.kubernetes.io/name"
+	runtimePoolKeyLabel                          = "orka.ai/runtime-pool-key"
+	runtimePoolNameLabel                         = "orka.ai/runtime-pool-name"
+	runtimePoolNamespaceLabel                    = "orka.ai/runtime-pool-namespace"
+	runtimePoolUIDLabel                          = "orka.ai/runtime-pool-uid"
+	runtimePoolNetworkRoleLabel                  = "orka.ai/network-role"
+	runtimePoolAuthLabel                         = "orka.ai/runtime-pool-auth"
+	runtimePoolProfileAnnotation                 = "orka.ai/runtime-profile-digest"
+	runtimePoolProviderTokenGenerationAnnotation = "orka.ai/provider-token-generation"
+	runtimePoolTemplateRevisionAnnotation        = "orka.ai/runtime-template-revision"
+	runtimePoolPIDsAnnotation                    = "orka.ai/runtime-pids-limit"
+
+	runtimePoolControllerTokenKey  = "controller-token"
+	runtimePoolCapabilitySecretKey = "capability-secret"
+	runtimePoolProviderTokenKey    = "token"
+
+	runtimePoolControllerTokenPath  = "/var/run/secrets/orka/auth/controller-token"
+	runtimePoolCapabilitySecretPath = "/var/run/secrets/orka/auth/capability-secret"
+	runtimePoolProviderTokenPath    = "/var/run/secrets/orka/provider/token"
+	runtimePoolOperationHeader      = "X-Orka-Operation-Capability"
+
+	runtimePoolSessionsVolume = "sessions"
+	runtimePoolTempVolume     = "tmp"
+	runtimePoolHomeVolume     = "home"
+
+	runtimePoolProviderCodex              = "codex"
+	runtimePoolProviderClaude             = "claude"
+	runtimePoolProviderCopilot            = "copilot"
+	runtimePoolProviderOpencode           = "opencode"
+	runtimePoolResourceClassStandard      = "standard"
+	runtimePoolDefaultControllerNamespace = "orka-system"
+
+	runtimePoolRolloutReasonDraining  = "RolloutDraining"
+	runtimePoolRolloutReasonQuiescent = "RolloutQuiescent"
+	runtimePoolRolloutReasonStopping  = "RolloutStopping"
+	runtimePoolRolloutReasonStarting  = "RolloutStarting"
+	runtimePoolRolloutReasonTimedOut  = "RolloutTimedOut"
+
+	runtimePoolIdentityCapacityReasonDraining  = "IdentityCapacityDraining"
+	runtimePoolIdentityCapacityReasonQuiescent = "IdentityCapacityQuiescent"
+	runtimePoolIdentityCapacityReasonStopping  = "IdentityCapacityStopping"
+
+	runtimePoolSupervisorRestartReasonDetected = "SupervisorRestartDetected"
+	runtimePoolSupervisorRestartReasonStopping = "SupervisorRestartStopping"
+)
+
+var (
+	digestPinnedImagePattern         = regexp.MustCompile(`^[^\s@]+@sha256:[a-f0-9]{64}$`)
+	runtimePoolAuthSuffixPattern     = regexp.MustCompile(`auth-e[1-9][0-9]*$`)
+	runtimePoolProviderSuffixPattern = regexp.MustCompile(`provider-e[1-9][0-9]*-g[0-9a-f]{16}$`)
+)
+
+// RuntimePoolProbeResult is the authenticated, exact-instance supervisor view
+// used to select and fence one active runtime Pod.
+type RuntimePoolProbeResult struct {
+	Capabilities harnessv2.CapabilitiesResponse
+	Status       harnessv2.StatusResponse
+}
+
+// RuntimePoolSupervisorClient is the v2 control surface required by the
+// Kubernetes reconciler. It intentionally excludes task and session dispatch.
+type RuntimePoolSupervisorClient interface {
+	Probe(ctx context.Context, endpoint, bearerToken string) (RuntimePoolProbeResult, error)
+	RequestDrain(ctx context.Context, endpoint, bearerToken string, capabilitySecret []byte, status harnessv2.StatusResponse, reason string) error
+}
+
+// RuntimePoolProviderProxyConfig binds managed RuntimePools to the authenticated
+// cluster-local provider proxy. BearerToken is copied into an epoch-scoped
+// RuntimePool Secret and is never placed in Pod environment variables.
+type RuntimePoolProviderProxyConfig struct {
+	BaseURL         string
+	Namespace       string
+	PodLabels       map[string]string
+	BearerToken     []byte
+	BearerTokenFile string
+}
+
+func (c RuntimePoolProviderProxyConfig) String() string {
+	return fmt.Sprintf("{BaseURL:%q Namespace:%q PodLabels:%v BearerToken:[redacted]}", c.BaseURL, c.Namespace, c.PodLabels)
+}
+
+func (c RuntimePoolProviderProxyConfig) GoString() string { return c.String() }
+
+type runtimePoolProviderProxyConfig struct {
+	baseURL         string
+	namespace       string
+	podLabels       map[string]string
+	port            int32
+	token           []byte
+	tokenGeneration string
+}
+
+// Validate verifies that the provider boundary is complete and cluster-local.
+func (c RuntimePoolProviderProxyConfig) Validate() error {
+	_, err := c.normalized()
+	return err
+}
+
+func (c RuntimePoolProviderProxyConfig) normalized() (runtimePoolProviderProxyConfig, error) {
+	baseURL := strings.TrimSpace(c.BaseURL)
+	if baseURL == "" {
+		return runtimePoolProviderProxyConfig{}, fmt.Errorf("authenticated provider proxy base URL is required")
+	}
+	parsed, err := url.Parse(baseURL)
+	if err != nil || parsed.Host == "" || parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" ||
+		(parsed.Scheme != urlSchemeHTTP && parsed.Scheme != urlSchemeHTTPS) {
+		return runtimePoolProviderProxyConfig{}, fmt.Errorf("authenticated provider proxy base URL is invalid")
+	}
+	namespace := strings.TrimSpace(c.Namespace)
+	if errs := validation.IsDNS1123Label(namespace); len(errs) != 0 {
+		return runtimePoolProviderProxyConfig{}, fmt.Errorf("authenticated provider proxy namespace is required and must be a DNS label")
+	}
+	hostname := strings.ToLower(parsed.Hostname())
+	serviceSuffix := "." + strings.ToLower(namespace) + ".svc"
+	if !strings.HasSuffix(hostname, serviceSuffix) && !strings.HasSuffix(hostname, serviceSuffix+".cluster.local") {
+		return runtimePoolProviderProxyConfig{}, fmt.Errorf("authenticated provider proxy base URL must address a Service in its configured namespace")
+	}
+	port := int32(80)
+	if parsed.Scheme == "https" {
+		port = 443
+	}
+	if rawPort := parsed.Port(); rawPort != "" {
+		parsedPort, parseErr := strconv.ParseUint(rawPort, 10, 16)
+		if parseErr != nil || parsedPort == 0 {
+			return runtimePoolProviderProxyConfig{}, fmt.Errorf("authenticated provider proxy base URL port is invalid")
+		}
+		port = int32(parsedPort)
+	}
+	if len(c.PodLabels) == 0 {
+		return runtimePoolProviderProxyConfig{}, fmt.Errorf("authenticated provider proxy pod labels are required")
+	}
+	podLabels := cloneStringMap(c.PodLabels)
+	for key, value := range podLabels {
+		if errs := validation.IsQualifiedName(key); len(errs) != 0 {
+			return runtimePoolProviderProxyConfig{}, fmt.Errorf("authenticated provider proxy pod label key is invalid")
+		}
+		if errs := validation.IsValidLabelValue(value); len(errs) != 0 {
+			return runtimePoolProviderProxyConfig{}, fmt.Errorf("authenticated provider proxy pod label value is invalid")
+		}
+	}
+	token := bytes.Clone(c.BearerToken)
+	if strings.TrimSpace(c.BearerTokenFile) != "" {
+		if len(token) != 0 {
+			return runtimePoolProviderProxyConfig{}, fmt.Errorf("provider proxy bearer token and token file are mutually exclusive")
+		}
+		var readErr error
+		token, readErr = readRuntimePoolProviderTokenFile(c.BearerTokenFile)
+		if readErr != nil {
+			return runtimePoolProviderProxyConfig{}, readErr
+		}
+	}
+	if err := validateRuntimePoolProviderToken(token); err != nil {
+		return runtimePoolProviderProxyConfig{}, err
+	}
+	return runtimePoolProviderProxyConfig{
+		baseURL: parsed.String(), namespace: namespace, podLabels: podLabels, port: port, token: token,
+		tokenGeneration: runtimePoolProviderTokenGeneration(token),
+	}, nil
+}
+
+func readRuntimePoolProviderTokenFile(path string) ([]byte, error) {
+	path = strings.TrimSpace(path)
+	if path == "" || !filepath.IsAbs(path) || filepath.Clean(path) != path {
+		return nil, fmt.Errorf("provider proxy bearer token file must be an absolute clean path")
+	}
+	resolved, err := filepath.EvalSymlinks(path)
+	if err != nil {
+		return nil, fmt.Errorf("resolve provider proxy bearer token file: %w", err)
+	}
+	root, err := filepath.EvalSymlinks(filepath.Dir(path))
+	if err != nil {
+		return nil, fmt.Errorf("resolve provider proxy bearer token directory: %w", err)
+	}
+	if rel, relErr := filepath.Rel(root, resolved); relErr != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
+		return nil, fmt.Errorf("provider proxy bearer token file escapes its mounted directory")
+	}
+	info, err := os.Stat(resolved)
+	if err != nil || !info.Mode().IsRegular() || info.Size() < 32 || info.Size() > 4096 {
+		return nil, fmt.Errorf("provider proxy bearer token file is unavailable")
+	}
+	value, err := os.ReadFile(resolved)
+	if err != nil {
+		return nil, fmt.Errorf("read provider proxy bearer token file: %w", err)
+	}
+	return bytes.TrimSpace(value), nil
+}
+
+func runtimePoolProviderTokenGeneration(token []byte) string {
+	sum := sha256.Sum256(token)
+	return hex.EncodeToString(sum[:])[:16]
+}
+
+func validateRuntimePoolProviderToken(token []byte) error {
+	if len(token) < 32 || len(token) > 4096 {
+		return fmt.Errorf("authenticated provider proxy bearer token is required")
+	}
+	for _, value := range token {
+		if value <= ' ' || value == 0x7f {
+			return fmt.Errorf("authenticated provider proxy bearer token is invalid")
+		}
+	}
+	return nil
+}
+
+// RuntimePoolReconciler reconciles controller-owned built-in ACP runtime pools.
+type RuntimePoolReconciler struct {
+	client.Client
+	APIReader client.Reader
+	Scheme    *k8sruntime.Scheme
+
+	// RuntimeNamespace is used when spec.runtimeNamespace is empty.
+	RuntimeNamespace string
+	// ControllerNamespace is the namespace allowed to reach the runtime control port.
+	ControllerNamespace string
+	// ControllerAPIURL is the exact internal artifact/broker API base URL.
+	ControllerAPIURL string
+	// ControllerAPIPort is the controller Pod target port allowed by the runtime egress policy.
+	ControllerAPIPort int32
+	// WorkspaceArtifactMaxBytes is the Publisher-advertised maximum inbound
+	// workspace artifact size propagated to every built-in runtime.
+	WorkspaceArtifactMaxBytes int64
+	// ProviderProxy is the authenticated, NetworkPolicy-confined provider boundary.
+	ProviderProxy RuntimePoolProviderProxyConfig
+	// ControllerEpoch is a test/static override. Production uses Epochs.
+	ControllerEpoch int64
+	// Epochs supplies the current durable leader epoch.
+	Epochs *ControllerEpochManager
+	// EnablePDB protects a serving singleton from voluntary disruption.
+	EnablePDB bool
+	// AllowedImages is the controller-configured immutable image allowlist for
+	// built-in pools. RuntimePool is controller-owned; its public spec cannot be
+	// used to select an arbitrary privileged supervisor image.
+	AllowedImages ACPRuntimeImages
+	// CleanupOnly keeps deletion finalization active while ACP runtime admission
+	// is disabled without adding finalizers or creating runtime resources.
+	CleanupOnly bool
+
+	SupervisorClient RuntimePoolSupervisorClient
+	HTTPClient       *http.Client
+	Rand             io.Reader
+	Now              func() time.Time
+}
+
+// +kubebuilder:rbac:groups=core.orka.ai,resources=runtimepools,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=core.orka.ai,resources=runtimepools/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=core.orka.ai,resources=runtimepools/finalizers,verbs=update
+// +kubebuilder:rbac:groups=apps,resources=deployments;replicasets,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups="",resources=pods;services;secrets;namespaces,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=networking.k8s.io,resources=networkpolicies,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=policy,resources=poddisruptionbudgets,verbs=get;list;watch;create;update;patch;delete
+
+// Reconcile converges the singleton Deployment and publishes exact-Pod pool status.
+func (r *RuntimePoolReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+	logger := log.FromContext(ctx)
+	pool := &corev1alpha1.RuntimePool{}
+	if err := r.Get(ctx, req.NamespacedName, pool); err != nil {
+		if apierrors.IsNotFound(err) {
+			return ctrl.Result{}, nil
+		}
+		return ctrl.Result{}, err
+	}
+	if !pool.DeletionTimestamp.IsZero() {
+		return r.finalizeRuntimePool(ctx, pool)
+	}
+	if r.CleanupOnly {
+		return ctrl.Result{}, nil
+	}
+	if !controllerutil.ContainsFinalizer(pool, runtimePoolFinalizer) {
+		base := pool.DeepCopy()
+		controllerutil.AddFinalizer(pool, runtimePoolFinalizer)
+		if err := r.Patch(ctx, pool, client.MergeFrom(base)); err != nil {
+			return ctrl.Result{}, err
+		}
+		if err := r.Get(ctx, req.NamespacedName, pool); err != nil {
+			return ctrl.Result{}, err
+		}
+	}
+
+	cfg, err := r.runtimePoolConfig(pool)
+	if err != nil {
+		status := r.baseRuntimePoolStatus(pool, 0)
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDegraded
+		status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+		status.ActiveInstance = nil
+		status.Message = sanitizeRuntimePoolMessage(err.Error())
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonRolloutFailed, status.Message)
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionAdmissionReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonAdmissionClosed, status.Message)
+		return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+	}
+
+	logger.Info("Reconciling RuntimePool", "runtimePool", pool.Name, "runtimeNamespace", cfg.namespace, "desiredReplicas", pool.Spec.DesiredReplicas)
+
+	if err := r.ensureRuntimePoolNamespace(ctx, cfg); err != nil {
+		return r.finishRuntimePoolResourceFailure(ctx, pool, cfg, err)
+	}
+	authSecret, providerSecret, err := r.ensureRuntimePoolSecrets(ctx, pool, cfg)
+	if err != nil {
+		return r.finishRuntimePoolResourceFailure(ctx, pool, cfg, err)
+	}
+	if err := r.ensureRuntimePoolAncillaryResources(ctx, pool, cfg); err != nil {
+		return r.finishRuntimePoolResourceFailure(ctx, pool, cfg, err)
+	}
+
+	selector := map[string]string{runtimePoolKeyLabel: cfg.labels[runtimePoolKeyLabel]}
+	desiredTemplate := r.runtimePoolPodTemplate(pool, cfg, selector, authSecret.Name, providerSecret.Name)
+	existingDeployment := &appsv1.Deployment{}
+	existingErr := r.Get(ctx, types.NamespacedName{Namespace: cfg.namespace, Name: cfg.baseName}, existingDeployment)
+	if existingErr != nil && !apierrors.IsNotFound(existingErr) {
+		return ctrl.Result{}, existingErr
+	}
+	if apierrors.IsNotFound(existingErr) {
+		existingDeployment = nil
+	}
+
+	pods, err := r.listRuntimePoolPods(ctx, cfg)
+	if err != nil {
+		return ctrl.Result{}, err
+	}
+	if existingDeployment != nil && runtimePoolDeploymentNeedsRollout(existingDeployment, desiredTemplate) {
+		return r.reconcileRuntimePoolRollout(ctx, pool, cfg, existingDeployment, pods, desiredTemplate)
+	}
+
+	targetReplicas := pool.Spec.DesiredReplicas
+	if targetReplicas == 0 && existingDeployment != nil && ptr.Deref(existingDeployment.Spec.Replicas, 0) > 0 {
+		// A live in-memory pool stays at one until authenticated drain and a
+		// separately observed Quiescent status form the scale-down barrier.
+		targetReplicas = 1
+	}
+	deployment, err := r.ensureRuntimePoolDeployment(ctx, pool, cfg, desiredTemplate, targetReplicas, existingDeployment == nil)
+	if err != nil {
+		return r.finishRuntimePoolResourceFailure(ctx, pool, cfg, err)
+	}
+	if err := r.pruneStaleRuntimePoolSecrets(ctx, pool, cfg, deployment, authSecret.Name, providerSecret.Name); err != nil {
+		return r.finishRuntimePoolResourceFailure(ctx, pool, cfg, err)
+	}
+	status := r.baseRuntimePoolStatus(pool, countRuntimePoolPods(pods))
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionPodSecurityReady, metav1.ConditionTrue, "PodSecurityConfigured", "runtime Pod security controls are configured")
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionQuotaReady, metav1.ConditionTrue, "ResourcesAdmitted", "runtime resources were admitted")
+	r.applyDeploymentFailureConditions(pool, deployment, &status)
+
+	readyPods := readyRuntimePoolPods(pods)
+	if len(readyPods) > 1 {
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleAmbiguous
+		status.AdmissionState = corev1alpha1.RuntimePoolAdmissionAmbiguous
+		status.ActiveInstance = nil
+		status.Message = fmt.Sprintf("found %d Ready runtime Pods; exact-instance admission is closed", len(readyPods))
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionAdmissionReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonRuntimeAmbiguous, status.Message)
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonRuntimeAmbiguous, status.Message)
+		return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+	}
+
+	if pool.Spec.DesiredReplicas == 0 {
+		return r.reconcileRuntimePoolScaleDown(ctx, pool, cfg, deployment, pods, readyPods, authSecret, status)
+	}
+	return r.reconcileRuntimePoolServing(ctx, pool, cfg, pods, readyPods, authSecret, status)
+}
+
+type runtimePoolConfig struct {
+	namespace           string
+	baseName            string
+	labels              map[string]string
+	controllerEpoch     int64
+	maxResidentSessions int32
+	maxRunningPrompts   int32
+	protocol            corev1alpha1.RuntimePoolProtocolVersion
+	profile             harnessv2.RuntimeProfile
+	providerProxy       runtimePoolProviderProxyConfig
+}
+
+func (r *RuntimePoolReconciler) runtimePoolConfig(pool *corev1alpha1.RuntimePool) (runtimePoolConfig, error) {
+	if err := validateRuntimePoolObject(pool); err != nil {
+		return runtimePoolConfig{}, err
+	}
+	if err := r.validateRuntimePoolImage(pool); err != nil {
+		return runtimePoolConfig{}, err
+	}
+	profile, protocol, err := validateRuntimePoolProfile(pool)
+	if err != nil {
+		return runtimePoolConfig{}, err
+	}
+	namespace, err := r.runtimePoolNamespace(pool)
+	if err != nil {
+		return runtimePoolConfig{}, err
+	}
+	epoch := r.effectiveControllerEpoch(pool)
+	maxSessions, maxPrompts, err := runtimePoolCapacity(pool)
+	if err != nil {
+		return runtimePoolConfig{}, err
+	}
+	providerProxy, err := r.ProviderProxy.normalized()
+	if err != nil {
+		return runtimePoolConfig{}, err
+	}
+	if err := validateRuntimePoolControllerAPIURL(r.ControllerAPIURL); err != nil {
+		return runtimePoolConfig{}, err
+	}
+	if r.WorkspaceArtifactMaxBytes <= 0 {
+		return runtimePoolConfig{}, fmt.Errorf("publisher workspace artifact limit must be positive")
+	}
+
+	baseName := runtimePoolResourceName(pool.Namespace, pool.Name)
+	labels := map[string]string{
+		runtimePoolManagedByLabel:   "orka",
+		runtimePoolApplicationLabel: "orka-acp-runtime",
+		runtimePoolKeyLabel:         runtimePoolKey(pool.Namespace, pool.Name),
+		runtimePoolNameLabel:        pool.Name,
+		runtimePoolNamespaceLabel:   pool.Namespace,
+		runtimePoolUIDLabel:         string(pool.UID),
+		runtimePoolNetworkRoleLabel: "provider-client",
+	}
+	return runtimePoolConfig{
+		namespace: namespace, baseName: baseName, labels: labels, controllerEpoch: epoch,
+		maxResidentSessions: maxSessions, maxRunningPrompts: maxPrompts, protocol: protocol, profile: profile,
+		providerProxy: providerProxy,
+	}, nil
+}
+
+func validateRuntimePoolObject(pool *corev1alpha1.RuntimePool) error {
+	if pool == nil {
+		return fmt.Errorf("RuntimePool is required")
+	}
+	if pool.UID == "" {
+		return fmt.Errorf("RuntimePool UID is required")
+	}
+	if pool.Generation <= 0 {
+		return fmt.Errorf("RuntimePool generation must be positive")
+	}
+	if pool.Labels[acpRuntimePoolLabel] != scheduledRunLabelValue {
+		return fmt.Errorf("RuntimePool is not controller-owned")
+	}
+	if pool.Spec.DesiredReplicas < 0 || pool.Spec.DesiredReplicas > 1 {
+		return fmt.Errorf("spec.desiredReplicas must be zero or one")
+	}
+	return nil
+}
+
+func (r *RuntimePoolReconciler) validateRuntimePoolImage(pool *corev1alpha1.RuntimePool) error {
+	image := strings.TrimSpace(pool.Spec.Runtime.Image)
+	if !digestPinnedImagePattern.MatchString(image) {
+		return fmt.Errorf("spec.runtime.image must be pinned by sha256 digest")
+	}
+
+	allowedImage := ""
+	switch strings.TrimSpace(pool.Spec.Runtime.Profile.ProviderKind) {
+	case runtimePoolProviderCodex:
+		allowedImage = strings.TrimSpace(r.AllowedImages.Codex)
+	case runtimePoolProviderClaude:
+		allowedImage = strings.TrimSpace(r.AllowedImages.Claude)
+	case runtimePoolProviderCopilot:
+		allowedImage = strings.TrimSpace(r.AllowedImages.Copilot)
+	case runtimePoolProviderOpencode:
+		allowedImage = strings.TrimSpace(r.AllowedImages.Opencode)
+	}
+	if allowedImage == "" || image != allowedImage {
+		return fmt.Errorf("spec.runtime.image is not the controller-approved image for provider %q", pool.Spec.Runtime.Profile.ProviderKind)
+	}
+	return nil
+}
+
+func validateRuntimePoolProfile(pool *corev1alpha1.RuntimePool) (harnessv2.RuntimeProfile, corev1alpha1.RuntimePoolProtocolVersion, error) {
+	if !validSHA256Digest(pool.Spec.Runtime.Profile.Digest) {
+		return harnessv2.RuntimeProfile{}, "", fmt.Errorf("spec.runtime.profile.digest must be a sha256 digest")
+	}
+	if strings.TrimSpace(pool.Spec.Runtime.Profile.DigestSchemaVersion) == "" {
+		return harnessv2.RuntimeProfile{}, "", fmt.Errorf("spec.runtime.profile.digestSchemaVersion is required")
+	}
+	if !runtimePoolDigestSchemaMatches(pool.Spec.Runtime.Profile.DigestSchemaVersion, harnessv2.ProfileDigestSchemaVersion) {
+		return harnessv2.RuntimeProfile{}, "", fmt.Errorf("spec.runtime.profile.digestSchemaVersion is unsupported")
+	}
+
+	profile, err := runtimePoolHarnessProfile(pool.Spec.Runtime.Profile)
+	if err != nil {
+		return harnessv2.RuntimeProfile{}, "", err
+	}
+	if profile.ResourceClass != runtimePoolResourceClassStandard {
+		return harnessv2.RuntimeProfile{}, "", fmt.Errorf("spec.runtime.profile.resourceClass %q is not supported", profile.ResourceClass)
+	}
+	profileDigest, err := harnessv2.CanonicalProfileDigest(profile)
+	if err != nil {
+		return harnessv2.RuntimeProfile{}, "", fmt.Errorf("canonicalize runtime profile: %w", err)
+	}
+	if string(profileDigest) != pool.Spec.Runtime.Profile.Digest {
+		return harnessv2.RuntimeProfile{}, "", fmt.Errorf("spec.runtime.profile.digest does not match the explicit immutable profile")
+	}
+
+	protocol := pool.Spec.Runtime.Profile.ProtocolVersion
+	if protocol == "" {
+		protocol = corev1alpha1.RuntimePoolProtocolHarnessV2
+	}
+	if protocol != corev1alpha1.RuntimePoolProtocolHarnessV2 {
+		return harnessv2.RuntimeProfile{}, "", fmt.Errorf("spec.runtime.profile.protocolVersion must be %q", corev1alpha1.RuntimePoolProtocolHarnessV2)
+	}
+	return profile, protocol, nil
+}
+
+func (r *RuntimePoolReconciler) runtimePoolNamespace(pool *corev1alpha1.RuntimePool) (string, error) {
+	namespace := strings.TrimSpace(pool.Spec.RuntimeNamespace)
+	if namespace == "" {
+		namespace = strings.TrimSpace(r.RuntimeNamespace)
+	}
+	if namespace == "" {
+		namespace = pool.Namespace
+	}
+	if errs := validation.IsDNS1123Label(namespace); len(errs) != 0 {
+		return "", fmt.Errorf("runtime namespace is invalid")
+	}
+	return namespace, nil
+}
+
+func runtimePoolCapacity(pool *corev1alpha1.RuntimePool) (int32, int32, error) {
+	maxSessions := corev1alpha1.DefaultRuntimePoolMaxResidentSessions
+	maxPrompts := corev1alpha1.DefaultRuntimePoolMaxRunningPrompts
+	if pool.Spec.Capacity != nil {
+		if pool.Spec.Capacity.MaxResidentSessions > 0 {
+			maxSessions = pool.Spec.Capacity.MaxResidentSessions
+		}
+		if pool.Spec.Capacity.MaxRunningPrompts > 0 {
+			maxPrompts = pool.Spec.Capacity.MaxRunningPrompts
+		}
+	}
+	if maxPrompts > maxSessions {
+		return 0, 0, fmt.Errorf("max running prompts cannot exceed max resident sessions")
+	}
+	return maxSessions, maxPrompts, nil
+}
+
+func validateRuntimePoolControllerAPIURL(rawURL string) error {
+	controllerAPI, err := url.Parse(strings.TrimSpace(rawURL))
+	if err != nil || controllerAPI.Host == "" || controllerAPI.User != nil || controllerAPI.RawQuery != "" || controllerAPI.Fragment != "" ||
+		(controllerAPI.Scheme != urlSchemeHTTP && controllerAPI.Scheme != urlSchemeHTTPS) {
+		return fmt.Errorf("controller artifact API URL is invalid")
+	}
+	return nil
+}
+
+func (r *RuntimePoolReconciler) reconcileRuntimePoolServing(
+	ctx context.Context,
+	pool *corev1alpha1.RuntimePool,
+	cfg runtimePoolConfig,
+	pods []corev1.Pod,
+	readyPods []corev1.Pod,
+	authSecret *corev1.Secret,
+	status corev1alpha1.RuntimePoolStatus,
+) (ctrl.Result, error) {
+	if len(readyPods) == 0 {
+		if runtimePoolActiveInstancePodPresent(status.ActiveInstance, pods) {
+			status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDegraded
+			status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+			status.Message = "previously active runtime Pod is not Ready; preserving its exact fence while admission is closed"
+			r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionAdmissionReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonAdmissionClosed, status.Message)
+			r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionSchedulingReady, metav1.ConditionUnknown, "PodNotReady", status.Message)
+			r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonRolloutFailed, status.Message)
+			return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+		}
+		status.ActiveInstance = nil
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleStarting
+		status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+		status.Message = "waiting for one Ready runtime Pod"
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionAdmissionReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonAdmissionClosed, status.Message)
+		if reason, message, ok := runtimePoolPodFailure(pods); ok {
+			status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDegraded
+			status.Message = message
+			r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionFalse, reason, message)
+		}
+		if reason, message, ok := runtimePoolSchedulingFailure(pods); ok {
+			status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDegraded
+			status.Message = message
+			r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionSchedulingReady, metav1.ConditionFalse, reason, message)
+		} else {
+			r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionSchedulingReady, metav1.ConditionUnknown, "SchedulingPending", "waiting for a scheduled runtime Pod")
+		}
+		if meta.FindStatusCondition(status.Conditions, corev1alpha1.RuntimePoolConditionRolloutReady) == nil {
+			r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionUnknown, "RolloutPending", "waiting for runtime rollout")
+		}
+		return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+	}
+
+	probe, err := r.supervisorClient().Probe(ctx, runtimePoolPodEndpoint(&readyPods[0]), string(authSecret.Data[runtimePoolControllerTokenKey]))
+	if err != nil {
+		if !runtimePoolActiveInstanceMatchesPod(status.ActiveInstance, &readyPods[0]) {
+			status.ActiveInstance = nil
+		}
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDegraded
+		status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+		status.Message = sanitizeRuntimePoolMessage("authenticated runtime status probe failed: " + err.Error())
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionAdmissionReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonAdmissionClosed, status.Message)
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonRolloutFailed, status.Message)
+		return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+	}
+	active, err := validateRuntimePoolProbeForRollout(pool, cfg, &readyPods[0], probe, r.now())
+	if err != nil {
+		if !runtimePoolActiveInstanceMatchesPod(status.ActiveInstance, &readyPods[0]) {
+			status.ActiveInstance = nil
+		}
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDegraded
+		status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+		status.Message = sanitizeRuntimePoolMessage(err.Error())
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionAdmissionReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonAdmissionClosed, status.Message)
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonRolloutFailed, status.Message)
+		return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+	}
+	if runtimePoolSupervisorRestartedInPlace(pool.Status.ActiveInstance, active) {
+		return r.reconcileRuntimePoolInPlaceSupervisorRestart(ctx, pool, nil, &readyPods[0], active, status)
+	}
+	status.ActiveInstance = active
+	applyRuntimePoolProbeCapacity(&status, cfg, probe)
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionSchedulingReady, metav1.ConditionTrue, "PodScheduled", "selected runtime Pod is scheduled")
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionTrue, "ExactInstanceReady", "selected runtime Pod and supervisor profile are ready")
+	if probe.Status.SessionIdentityCapacity == nil {
+		probe.Status.SessionIdentityCapacity = &harnessv2.SessionIdentityCapacity{Total: 2, Remaining: 1, ExhaustionReserve: 1}
+		return r.reconcileRuntimePoolIdentityCapacityRotation(ctx, pool, &readyPods[0], authSecret, active, probe, status)
+	}
+	if probe.Status.SessionIdentityCapacity.RotationRequired() {
+		return r.reconcileRuntimePoolIdentityCapacityRotation(ctx, pool, &readyPods[0], authSecret, active, probe, status)
+	}
+
+	switch {
+	case probe.Status.Lifecycle == harnessv2.SupervisorLifecycleUnhealthy:
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDegraded
+		status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+		status.Message = "runtime supervisor reported unhealthy; recycling exact Pod"
+		if err := r.Delete(ctx, &readyPods[0]); err != nil && !apierrors.IsNotFound(err) {
+			return ctrl.Result{}, err
+		}
+	case probe.Status.Drain.Requested || probe.Status.Lifecycle == harnessv2.SupervisorLifecycleDraining || probe.Status.Lifecycle == harnessv2.SupervisorLifecycleTerminating:
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDraining
+		status.AdmissionState = corev1alpha1.RuntimePoolAdmissionDraining
+		status.Message = "runtime supervisor is draining"
+	case probe.Status.Lifecycle == harnessv2.SupervisorLifecycleBooting:
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleStarting
+		status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+		status.Message = "runtime supervisor is booting"
+	case runtimePoolAtCapacity(status.Capacity):
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleServing
+		status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+		status.Message = "runtime pool is at configured capacity"
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionAdmissionReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonAtCapacity, status.Message)
+		return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+	default:
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleServing
+		status.AdmissionState = corev1alpha1.RuntimePoolAdmissionAccepting
+		status.Message = "one exact runtime instance is ready"
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionAdmissionReady, metav1.ConditionTrue, "Serving", status.Message)
+		return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+	}
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionAdmissionReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonAdmissionClosed, status.Message)
+	return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+}
+
+func (r *RuntimePoolReconciler) reconcileRuntimePoolInPlaceSupervisorRestart(
+	ctx context.Context,
+	pool *corev1alpha1.RuntimePool,
+	rolloutDeployment *appsv1.Deployment,
+	pod *corev1.Pod,
+	observed *corev1alpha1.RuntimePoolActiveInstanceStatus,
+	status corev1alpha1.RuntimePoolStatus,
+) (ctrl.Result, error) {
+	status.ActiveInstance = pool.Status.ActiveInstance
+	status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDegraded
+	status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+	status.Message = "runtime supervisor restarted within the selected Pod; admission is closed before exact Pod replacement"
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionSchedulingReady, metav1.ConditionTrue, "PodScheduled", "selected runtime Pod remains scheduled")
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionAdmissionReady, metav1.ConditionFalse, runtimePoolSupervisorRestartReasonDetected, status.Message)
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionFalse, runtimePoolSupervisorRestartReasonDetected, status.Message)
+	if !runtimePoolSupervisorRestartAdmissionClosurePersisted(pool, observed) {
+		return r.finishRuntimePoolStatus(ctx, pool, status, time.Second)
+	}
+
+	if rolloutDeployment != nil {
+		if err := r.stopRuntimePoolDeployment(ctx, rolloutDeployment); err != nil {
+			return ctrl.Result{}, err
+		}
+	}
+	if err := r.Delete(ctx, pod, deleteCurrentObjectPreconditions(pod)...); err != nil && !apierrors.IsNotFound(err) {
+		return ctrl.Result{}, err
+	}
+	status.ActiveInstance = nil
+	status.Lifecycle = corev1alpha1.RuntimePoolLifecycleStopping
+	status.Message = "runtime Pod with an in-place supervisor restart is stopping for controller-owned emptyDir replacement"
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionAdmissionReady, metav1.ConditionFalse, runtimePoolSupervisorRestartReasonStopping, status.Message)
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionUnknown, runtimePoolSupervisorRestartReasonStopping, status.Message)
+	return r.finishRuntimePoolStatus(ctx, pool, status, time.Second)
+}
+
+func runtimePoolActiveInstanceMatchesPod(active *corev1alpha1.RuntimePoolActiveInstanceStatus, pod *corev1.Pod) bool {
+	return active != nil && pod != nil && strings.TrimSpace(active.PodUID) != "" && active.PodUID == string(pod.UID)
+}
+
+func runtimePoolActiveInstancePodPresent(active *corev1alpha1.RuntimePoolActiveInstanceStatus, pods []corev1.Pod) bool {
+	for i := range pods {
+		if runtimePoolActiveInstanceMatchesPod(active, &pods[i]) {
+			return true
+		}
+	}
+	return false
+}
+
+func runtimePoolSupervisorRestartedInPlace(previous, observed *corev1alpha1.RuntimePoolActiveInstanceStatus) bool {
+	if previous == nil || observed == nil || strings.TrimSpace(previous.PodUID) == "" || previous.PodUID != observed.PodUID {
+		return false
+	}
+	return previous.BootID != observed.BootID || previous.RuntimeInstanceID != observed.RuntimeInstanceID
+}
+
+func runtimePoolSupervisorRestartAdmissionClosurePersisted(
+	pool *corev1alpha1.RuntimePool,
+	observed *corev1alpha1.RuntimePoolActiveInstanceStatus,
+) bool {
+	if pool == nil || pool.Status.AdmissionState != corev1alpha1.RuntimePoolAdmissionClosed ||
+		!runtimePoolSupervisorRestartedInPlace(pool.Status.ActiveInstance, observed) {
+		return false
+	}
+	condition := meta.FindStatusCondition(pool.Status.Conditions, corev1alpha1.RuntimePoolConditionAdmissionReady)
+	return condition != nil && condition.ObservedGeneration == pool.Generation &&
+		condition.Status == metav1.ConditionFalse && condition.Reason == runtimePoolSupervisorRestartReasonDetected
+}
+
+func (r *RuntimePoolReconciler) reconcileRuntimePoolIdentityCapacityRotation(
+	ctx context.Context,
+	pool *corev1alpha1.RuntimePool,
+	pod *corev1.Pod,
+	authSecret *corev1.Secret,
+	active *corev1alpha1.RuntimePoolActiveInstanceStatus,
+	probe RuntimePoolProbeResult,
+	status corev1alpha1.RuntimePoolStatus,
+) (ctrl.Result, error) {
+	identityCapacity := probe.Status.SessionIdentityCapacity
+	status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDraining
+	status.AdmissionState = corev1alpha1.RuntimePoolAdmissionDraining
+	status.Message = fmt.Sprintf(
+		"session identity capacity reached its replacement watermark (%d remaining, %d reserved)",
+		identityCapacity.Remaining,
+		identityCapacity.ExhaustionReserve,
+	)
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionAdmissionReady, metav1.ConditionFalse, runtimePoolIdentityCapacityReasonDraining, status.Message)
+	if !probe.Status.Drain.Requested && !runtimePoolIdentityCapacityAdmissionClosurePersisted(pool, active) {
+		status.Message = "session identity admission is closed; persisting exact-instance admission barrier before drain"
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionAdmissionReady, metav1.ConditionFalse, runtimePoolIdentityCapacityReasonDraining, status.Message)
+		return r.finishRuntimePoolStatus(ctx, pool, status, time.Second)
+	}
+
+	if !runtimePoolRolloutControllerWorkIsQuiescent(pool.Status.Capacity) {
+		status.Message = "session identity admission is closed; waiting for controller reservations or finalization work to settle before drain"
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionAdmissionReady, metav1.ConditionFalse, runtimePoolIdentityCapacityReasonDraining, status.Message)
+		return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+	}
+
+	if !probe.Status.Drain.Requested {
+		if err := r.supervisorClient().RequestDrain(
+			ctx,
+			runtimePoolPodEndpoint(pod),
+			string(authSecret.Data[runtimePoolControllerTokenKey]),
+			authSecret.Data[runtimePoolCapabilitySecretKey],
+			probe.Status,
+			harnessv2.DrainReasonSessionIdentityCapacity,
+		); err != nil {
+			status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDegraded
+			status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+			status.Message = sanitizeRuntimePoolMessage("authenticated identity-capacity drain request failed: " + err.Error())
+			r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionAdmissionReady, metav1.ConditionFalse, runtimePoolIdentityCapacityReasonDraining, status.Message)
+			return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+		}
+		status.Message = "session identity admission is closed; authenticated drain requested"
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionAdmissionReady, metav1.ConditionFalse, runtimePoolIdentityCapacityReasonDraining, status.Message)
+		return r.finishRuntimePoolStatus(ctx, pool, status, time.Second)
+	}
+
+	if !runtimePoolRolloutProbeIsQuiescent(pool.Status.Capacity, probe.Status) {
+		status.Message = "waiting for identity-capacity drain barriers to become quiescent"
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionAdmissionReady, metav1.ConditionFalse, runtimePoolIdentityCapacityReasonDraining, status.Message)
+		return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+	}
+
+	if !runtimePoolIdentityCapacityQuiescencePersisted(pool, active) {
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleQuiescent
+		status.Message = "authenticated identity-capacity drain is quiescent; persisting exact-instance replacement barrier"
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionAdmissionReady, metav1.ConditionFalse, runtimePoolIdentityCapacityReasonQuiescent, status.Message)
+		return r.finishRuntimePoolStatus(ctx, pool, status, time.Second)
+	}
+
+	if err := r.Delete(ctx, pod, deleteCurrentObjectPreconditions(pod)...); err != nil && !apierrors.IsNotFound(err) {
+		return ctrl.Result{}, err
+	}
+	status.ActiveInstance = nil
+	status.Lifecycle = corev1alpha1.RuntimePoolLifecycleStopping
+	status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+	status.Message = "quiescent identity-limited runtime Pod is stopping for controller-owned replacement"
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionAdmissionReady, metav1.ConditionFalse, runtimePoolIdentityCapacityReasonStopping, status.Message)
+	return r.finishRuntimePoolStatus(ctx, pool, status, time.Second)
+}
+
+func (r *RuntimePoolReconciler) reconcileRuntimePoolRollout(
+	ctx context.Context,
+	pool *corev1alpha1.RuntimePool,
+	cfg runtimePoolConfig,
+	deployment *appsv1.Deployment,
+	pods []corev1.Pod,
+	desiredTemplate corev1.PodTemplateSpec,
+) (ctrl.Result, error) {
+	status := r.baseRuntimePoolStatus(pool, countRuntimePoolPods(pods))
+	status.AdmissionState = corev1alpha1.RuntimePoolAdmissionDraining
+	status.Message = "runtime template changed; admission is closed before Recreate rollout"
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionAdmissionReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonAdmissionClosed, status.Message)
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionPodSecurityReady, metav1.ConditionTrue, "PodSecurityConfigured", "runtime Pod security controls are configured")
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionQuotaReady, metav1.ConditionTrue, "ResourcesAdmitted", "runtime resources were admitted")
+	r.applyDeploymentFailureConditions(pool, deployment, &status)
+
+	readyPods := readyRuntimePoolPods(pods)
+	if len(readyPods) > 1 {
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleAmbiguous
+		status.AdmissionState = corev1alpha1.RuntimePoolAdmissionAmbiguous
+		status.ActiveInstance = nil
+		status.Message = fmt.Sprintf("found %d Ready runtime Pods while preparing Recreate rollout", len(readyPods))
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonRuntimeAmbiguous, status.Message)
+		return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+	}
+	if ptr.Deref(deployment.Spec.Replicas, 0) == 0 {
+		return r.reconcileStoppedRuntimePoolRollout(ctx, pool, cfg, pods, desiredTemplate, status)
+	}
+	if len(readyPods) == 0 {
+		return r.reconcileUnreadyRuntimePoolRollout(ctx, pool, deployment, status)
+	}
+	return r.reconcileReadyRuntimePoolRollout(ctx, pool, cfg, deployment, &readyPods[0], desiredTemplate, status)
+}
+
+func (r *RuntimePoolReconciler) reconcileStoppedRuntimePoolRollout(
+	ctx context.Context,
+	pool *corev1alpha1.RuntimePool,
+	cfg runtimePoolConfig,
+	pods []corev1.Pod,
+	desiredTemplate corev1.PodTemplateSpec,
+	status corev1alpha1.RuntimePoolStatus,
+) (ctrl.Result, error) {
+	status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+	if len(pods) > 0 {
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleStopping
+		status.Message = "waiting for the drained old runtime Pod to terminate before applying the new Recreate template"
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionUnknown, runtimePoolRolloutReasonStopping, status.Message)
+		return r.finishRuntimePoolStatus(ctx, pool, status, time.Second)
+	}
+
+	if _, err := r.ensureRuntimePoolDeployment(ctx, pool, cfg, desiredTemplate, pool.Spec.DesiredReplicas, true); err != nil {
+		return r.finishRuntimePoolResourceFailure(ctx, pool, cfg, err)
+	}
+	status.ActiveInstance = nil
+	if pool.Spec.DesiredReplicas == 0 {
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleStopped
+		status.Message = "new runtime template is staged at zero replicas"
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionTrue, "RolloutConverged", status.Message)
+		return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+	}
+	status.Lifecycle = corev1alpha1.RuntimePoolLifecycleStarting
+	status.Message = "old runtime terminated; starting the new immutable runtime template"
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionUnknown, runtimePoolRolloutReasonStarting, status.Message)
+	return r.finishRuntimePoolStatus(ctx, pool, status, time.Second)
+}
+
+func (r *RuntimePoolReconciler) reconcileUnreadyRuntimePoolRollout(
+	ctx context.Context,
+	pool *corev1alpha1.RuntimePool,
+	deployment *appsv1.Deployment,
+	status corev1alpha1.RuntimePoolStatus,
+) (ctrl.Result, error) {
+	if pool.Status.ActiveInstance != nil {
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDegraded
+		status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+		status.Message = "cannot authenticate the previous active runtime instance before Recreate rollout"
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonRolloutFailed, status.Message)
+		return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+	}
+	if !runtimePoolRolloutControllerWorkIsQuiescent(status.Capacity) {
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDraining
+		status.Message = "waiting for controller reservations or finalization work before stopping an unadmitted runtime Pod"
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionUnknown, runtimePoolRolloutReasonDraining, status.Message)
+		return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+	}
+	if err := r.stopRuntimePoolDeployment(ctx, deployment); err != nil {
+		return ctrl.Result{}, err
+	}
+	status.ActiveInstance = nil
+	status.Lifecycle = corev1alpha1.RuntimePoolLifecycleStopping
+	status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+	status.Message = "stopping an unadmitted old runtime Pod before applying the new Recreate template"
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionUnknown, runtimePoolRolloutReasonStopping, status.Message)
+	return r.finishRuntimePoolStatus(ctx, pool, status, time.Second)
+}
+
+func (r *RuntimePoolReconciler) reconcileReadyRuntimePoolRollout(
+	ctx context.Context,
+	pool *corev1alpha1.RuntimePool,
+	cfg runtimePoolConfig,
+	deployment *appsv1.Deployment,
+	pod *corev1.Pod,
+	desiredTemplate corev1.PodTemplateSpec,
+	status corev1alpha1.RuntimePoolStatus,
+) (ctrl.Result, error) {
+	validationPool, validationConfig, err := runtimePoolDeploymentValidationTarget(pool, deployment)
+	if err != nil {
+		return r.finishRuntimePoolRolloutFailure(ctx, pool, status, err)
+	}
+	authSecret, err := r.runtimePoolDeploymentAuthSecret(ctx, deployment)
+	if err != nil {
+		return r.finishRuntimePoolRolloutFailure(ctx, pool, status, err)
+	}
+	probe, err := r.supervisorClient().Probe(ctx, runtimePoolPodEndpoint(pod), string(authSecret.Data[runtimePoolControllerTokenKey]))
+	if err != nil {
+		return r.finishRuntimePoolRolloutFailure(ctx, pool, status, fmt.Errorf("authenticated rollout status probe failed: %w", err))
+	}
+	active, err := validateRuntimePoolProbeForRollout(validationPool, validationConfig, pod, probe, r.now())
+	if err != nil {
+		return r.finishRuntimePoolRolloutFailure(ctx, pool, status, err)
+	}
+	if runtimePoolSupervisorRestartedInPlace(pool.Status.ActiveInstance, active) {
+		return r.reconcileRuntimePoolInPlaceSupervisorRestart(ctx, pool, deployment, pod, active, status)
+	}
+	if !runtimePoolRolloutActiveInstanceMatches(pool.Status.ActiveInstance, active) {
+		return r.finishRuntimePoolRolloutFailure(ctx, pool, status, fmt.Errorf("authenticated runtime identity changed before rollout drain"))
+	}
+	status.ActiveInstance = active
+	applyRuntimePoolProbeCapacity(&status, cfg, probe)
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionSchedulingReady, metav1.ConditionTrue, "PodScheduled", "selected old runtime Pod remains scheduled during rollout drain")
+
+	if !probe.Status.Drain.Requested {
+		reason := "runtime_pool_rollout_" + runtimePoolShortRevision(desiredTemplate.Annotations[runtimePoolTemplateRevisionAnnotation])
+		if err := r.supervisorClient().RequestDrain(
+			ctx,
+			runtimePoolPodEndpoint(pod),
+			string(authSecret.Data[runtimePoolControllerTokenKey]),
+			authSecret.Data[runtimePoolCapabilitySecretKey],
+			probe.Status,
+			reason,
+		); err != nil {
+			return r.finishRuntimePoolRolloutFailure(ctx, pool, status, fmt.Errorf("authenticated rollout drain request failed: %w", err))
+		}
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDraining
+		status.Message = "authenticated rollout drain requested; waiting for a subsequent quiescent observation"
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionUnknown, runtimePoolRolloutReasonDraining, status.Message)
+		return r.finishRuntimePoolStatus(ctx, pool, status, time.Second)
+	}
+
+	if !runtimePoolRolloutProbeIsQuiescent(status.Capacity, probe.Status) {
+		if r.runtimePoolRolloutTimedOut(pool) {
+			status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDegraded
+			status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+			status.Message = "timed out waiting for authenticated rollout drain barriers; preserving the old runtime Pod"
+			r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionFalse, runtimePoolRolloutReasonTimedOut, status.Message)
+			return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+		}
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDraining
+		status.Message = "waiting for controller reservations and supervisor sessions, prompts, permissions, descendants, or finalization to settle"
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionUnknown, runtimePoolRolloutReasonDraining, status.Message)
+		return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+	}
+
+	if !runtimePoolRolloutQuiescencePersisted(pool) {
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleQuiescent
+		status.AdmissionState = corev1alpha1.RuntimePoolAdmissionDraining
+		status.Message = "authenticated old runtime and controller reservations are quiescent"
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionUnknown, runtimePoolRolloutReasonQuiescent, status.Message)
+		return r.finishRuntimePoolStatus(ctx, pool, status, time.Second)
+	}
+
+	if err := r.stopRuntimePoolDeployment(ctx, deployment); err != nil {
+		return ctrl.Result{}, err
+	}
+	status.Lifecycle = corev1alpha1.RuntimePoolLifecycleStopping
+	status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+	status.Message = "quiescent old runtime Deployment is stopping before the Recreate template changes"
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionUnknown, runtimePoolRolloutReasonStopping, status.Message)
+	return r.finishRuntimePoolStatus(ctx, pool, status, time.Second)
+}
+
+func (r *RuntimePoolReconciler) finishRuntimePoolRolloutFailure(
+	ctx context.Context,
+	pool *corev1alpha1.RuntimePool,
+	status corev1alpha1.RuntimePoolStatus,
+	err error,
+) (ctrl.Result, error) {
+	status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDegraded
+	status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+	status.Message = sanitizeRuntimePoolMessage(err.Error())
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonRolloutFailed, status.Message)
+	return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+}
+
+func runtimePoolRolloutControllerWorkIsQuiescent(capacity corev1alpha1.RuntimePoolCapacityStatus) bool {
+	return capacity.ReservedSessions == 0 && capacity.ReservedPrompts == 0 &&
+		len(capacity.Reservations) == 0 && capacity.FinalizingSessions == 0
+}
+
+func runtimePoolRolloutProbeIsQuiescent(controllerCapacity corev1alpha1.RuntimePoolCapacityStatus, status harnessv2.StatusResponse) bool {
+	return runtimePoolRolloutControllerWorkIsQuiescent(controllerCapacity) && upgradeDrainSupervisorIsQuiescent(status)
+}
+
+func runtimePoolRolloutActiveInstanceMatches(previous, observed *corev1alpha1.RuntimePoolActiveInstanceStatus) bool {
+	if previous == nil {
+		return true
+	}
+	return observed != nil && previous.PodNamespace == observed.PodNamespace && previous.PodName == observed.PodName &&
+		previous.PodUID == observed.PodUID && previous.BootID == observed.BootID &&
+		previous.RuntimeInstanceID == observed.RuntimeInstanceID && previous.ControllerEpoch == observed.ControllerEpoch &&
+		previous.ProfileDigest == observed.ProfileDigest &&
+		(previous.ProviderTokenGeneration == "" || previous.ProviderTokenGeneration == observed.ProviderTokenGeneration)
+}
+
+func runtimePoolRolloutQuiescencePersisted(pool *corev1alpha1.RuntimePool) bool {
+	if pool == nil || pool.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleQuiescent {
+		return false
+	}
+	condition := meta.FindStatusCondition(pool.Status.Conditions, corev1alpha1.RuntimePoolConditionRolloutReady)
+	return condition != nil && condition.ObservedGeneration == pool.Generation && condition.Reason == runtimePoolRolloutReasonQuiescent
+}
+
+func runtimePoolIdentityCapacityAdmissionClosurePersisted(
+	pool *corev1alpha1.RuntimePool,
+	observed *corev1alpha1.RuntimePoolActiveInstanceStatus,
+) bool {
+	if pool == nil || pool.Status.ActiveInstance == nil ||
+		pool.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleDraining ||
+		pool.Status.AdmissionState != corev1alpha1.RuntimePoolAdmissionDraining {
+		return false
+	}
+	condition := meta.FindStatusCondition(pool.Status.Conditions, corev1alpha1.RuntimePoolConditionAdmissionReady)
+	return condition != nil && condition.ObservedGeneration == pool.Generation &&
+		condition.Reason == runtimePoolIdentityCapacityReasonDraining &&
+		runtimePoolRolloutActiveInstanceMatches(pool.Status.ActiveInstance, observed)
+}
+
+func runtimePoolIdentityCapacityQuiescencePersisted(
+	pool *corev1alpha1.RuntimePool,
+	observed *corev1alpha1.RuntimePoolActiveInstanceStatus,
+) bool {
+	if pool == nil || pool.Status.ActiveInstance == nil || pool.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleQuiescent {
+		return false
+	}
+	condition := meta.FindStatusCondition(pool.Status.Conditions, corev1alpha1.RuntimePoolConditionAdmissionReady)
+	return condition != nil && condition.ObservedGeneration == pool.Generation &&
+		condition.Reason == runtimePoolIdentityCapacityReasonQuiescent &&
+		runtimePoolRolloutActiveInstanceMatches(pool.Status.ActiveInstance, observed)
+}
+
+func (r *RuntimePoolReconciler) runtimePoolRolloutTimedOut(pool *corev1alpha1.RuntimePool) bool {
+	if pool == nil {
+		return false
+	}
+	condition := meta.FindStatusCondition(pool.Status.Conditions, corev1alpha1.RuntimePoolConditionRolloutReady)
+	if condition == nil || condition.ObservedGeneration != pool.Generation {
+		return false
+	}
+	if condition.Reason == runtimePoolRolloutReasonTimedOut {
+		return true
+	}
+	if condition.Reason != runtimePoolRolloutReasonDraining {
+		return false
+	}
+	timeout := time.Duration(pool.Spec.ColdStartTimeoutSeconds) * time.Second
+	if timeout <= 0 {
+		timeout = 120 * time.Second
+	}
+	return !condition.LastTransitionTime.IsZero() && !r.now().Before(condition.LastTransitionTime.Add(timeout))
+}
+
+func runtimePoolShortRevision(revision string) string {
+	revision = strings.TrimPrefix(strings.TrimSpace(revision), "sha256:")
+	if len(revision) > 16 {
+		return revision[:16]
+	}
+	if revision == "" {
+		return "unknown"
+	}
+	return revision
+}
+
+func (r *RuntimePoolReconciler) reconcileRuntimePoolScaleDown(
+	ctx context.Context,
+	pool *corev1alpha1.RuntimePool,
+	cfg runtimePoolConfig,
+	deployment *appsv1.Deployment,
+	pods []corev1.Pod,
+	readyPods []corev1.Pod,
+	authSecret *corev1.Secret,
+	status corev1alpha1.RuntimePoolStatus,
+) (ctrl.Result, error) {
+	status.AdmissionState = corev1alpha1.RuntimePoolAdmissionDraining
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionAdmissionReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonAdmissionClosed, "runtime pool is scaling down")
+
+	if ptr.Deref(deployment.Spec.Replicas, 0) == 0 {
+		status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+		if len(pods) == 0 {
+			status.Lifecycle = corev1alpha1.RuntimePoolLifecycleStopped
+			status.ActiveInstance = nil
+			status.Message = "runtime pool is stopped"
+			r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionSchedulingReady, metav1.ConditionUnknown, "ScaledToZero", status.Message)
+			r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionTrue, "ScaledToZero", status.Message)
+			return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+		}
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleStopping
+		status.Message = "waiting for the quiescent runtime Pod to terminate"
+		return r.finishRuntimePoolStatus(ctx, pool, status, time.Second)
+	}
+
+	if len(readyPods) == 0 {
+		status.ActiveInstance = nil
+		if pool.Status.ActiveInstance == nil && runtimePoolControllerWorkIsQuiescent(pool.Status.Capacity) {
+			if err := r.stopRuntimePoolDeployment(ctx, deployment); err != nil {
+				return ctrl.Result{}, err
+			}
+			status.Lifecycle = corev1alpha1.RuntimePoolLifecycleStopping
+			status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+			status.Message = "stopping a runtime Pod that never became active"
+			return r.finishRuntimePoolStatus(ctx, pool, status, time.Second)
+		}
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDegraded
+		status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+		status.Message = "cannot authenticate the previous active runtime instance to prove drain"
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonRolloutFailed, status.Message)
+		return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+	}
+
+	probe, err := r.supervisorClient().Probe(ctx, runtimePoolPodEndpoint(&readyPods[0]), string(authSecret.Data[runtimePoolControllerTokenKey]))
+	if err != nil {
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDegraded
+		status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+		status.ActiveInstance = nil
+		status.Message = sanitizeRuntimePoolMessage("authenticated drain status probe failed: " + err.Error())
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonRolloutFailed, status.Message)
+		return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+	}
+	active, err := validateRuntimePoolProbe(pool, cfg, &readyPods[0], probe, r.now())
+	if err != nil {
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDegraded
+		status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+		status.ActiveInstance = nil
+		status.Message = sanitizeRuntimePoolMessage(err.Error())
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonRolloutFailed, status.Message)
+		return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+	}
+	status.ActiveInstance = active
+	applyRuntimePoolProbeCapacity(&status, cfg, probe)
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionSchedulingReady, metav1.ConditionTrue, "PodScheduled", "selected runtime Pod is scheduled")
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionTrue, "ExactInstanceReady", "selected runtime Pod and supervisor profile are ready")
+
+	if !probe.Status.Drain.Requested {
+		if err := r.supervisorClient().RequestDrain(
+			ctx,
+			runtimePoolPodEndpoint(&readyPods[0]),
+			string(authSecret.Data[runtimePoolControllerTokenKey]),
+			authSecret.Data[runtimePoolCapabilitySecretKey],
+			probe.Status,
+			"runtime_pool_scale_to_zero",
+		); err != nil {
+			status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDegraded
+			status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+			status.Message = sanitizeRuntimePoolMessage("authenticated drain request failed: " + err.Error())
+			return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+		}
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDraining
+		status.AdmissionState = corev1alpha1.RuntimePoolAdmissionDraining
+		status.Message = "drain requested; waiting for authenticated quiescence"
+		return r.finishRuntimePoolStatus(ctx, pool, status, time.Second)
+	}
+
+	if !runtimePoolProbeIsQuiescent(pool.Status.Capacity, probe.Status) {
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDraining
+		status.AdmissionState = corev1alpha1.RuntimePoolAdmissionDraining
+		status.Message = "waiting for sessions, prompts, permissions, reservations, or finalization work to settle"
+		return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+	}
+
+	if pool.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleQuiescent {
+		status.Lifecycle = corev1alpha1.RuntimePoolLifecycleQuiescent
+		status.AdmissionState = corev1alpha1.RuntimePoolAdmissionDraining
+		status.Message = "authenticated supervisor and controller state are quiescent"
+		return r.finishRuntimePoolStatus(ctx, pool, status, time.Second)
+	}
+
+	if err := r.stopRuntimePoolDeployment(ctx, deployment); err != nil {
+		return ctrl.Result{}, err
+	}
+	status.Lifecycle = corev1alpha1.RuntimePoolLifecycleStopping
+	status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+	status.Message = "quiescent runtime Deployment is stopping"
+	return r.finishRuntimePoolStatus(ctx, pool, status, time.Second)
+}
+
+func (r *RuntimePoolReconciler) ensureRuntimePoolNamespace(ctx context.Context, cfg runtimePoolConfig) error {
+	reader := r.APIReader
+	if reader == nil {
+		reader = r.Client
+	}
+	namespace := &corev1.Namespace{}
+	err := reader.Get(ctx, types.NamespacedName{Name: cfg.namespace}, namespace)
+	if err == nil {
+		return nil
+	}
+	if !apierrors.IsNotFound(err) {
+		return err
+	}
+	namespace = &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{
+		Name: cfg.namespace,
+		Labels: map[string]string{
+			"app.kubernetes.io/name":             "orka",
+			"app.kubernetes.io/component":        "acp-runtime",
+			"app.kubernetes.io/managed-by":       "orka",
+			"orka.ai/runtime-namespace":          "true",
+			"pod-security.kubernetes.io/enforce": "baseline",
+			"pod-security.kubernetes.io/warn":    "restricted",
+			"pod-security.kubernetes.io/audit":   "restricted",
+		},
+	}}
+	if err := r.Create(ctx, namespace); err != nil && !apierrors.IsAlreadyExists(err) {
+		return fmt.Errorf("create RuntimePool namespace: %w", err)
+	}
+	return nil
+}
+
+func (r *RuntimePoolReconciler) ensureRuntimePoolSecrets(
+	ctx context.Context,
+	pool *corev1alpha1.RuntimePool,
+	cfg runtimePoolConfig,
+) (*corev1.Secret, *corev1.Secret, error) {
+	authName := runtimePoolChildName(cfg.baseName, "auth-e"+strconv.FormatInt(cfg.controllerEpoch, 10))
+	auth, err := r.ensureRuntimePoolSecret(ctx, pool, cfg, authName, map[string]int{
+		runtimePoolControllerTokenKey:  32,
+		runtimePoolCapabilitySecretKey: 32,
+	}, map[string]string{runtimePoolAuthLabel: "true"})
+	if err != nil {
+		return nil, nil, err
+	}
+	providerName := runtimePoolChildName(cfg.baseName, "provider-e"+strconv.FormatInt(cfg.controllerEpoch, 10)+"-g"+cfg.providerProxy.tokenGeneration)
+	provider, err := r.ensureRuntimePoolProviderSecret(ctx, pool, cfg, providerName)
+	if err != nil {
+		return nil, nil, err
+	}
+	return auth, provider, nil
+}
+
+func (r *RuntimePoolReconciler) pruneStaleRuntimePoolSecrets(
+	ctx context.Context,
+	pool *corev1alpha1.RuntimePool,
+	cfg runtimePoolConfig,
+	deployment *appsv1.Deployment,
+	currentNames ...string,
+) error {
+	if deployment == nil {
+		return nil
+	}
+	reader := r.APIReader
+	if reader == nil {
+		reader = r.Client
+	}
+	liveDeployment := &appsv1.Deployment{}
+	if err := reader.Get(ctx, types.NamespacedName{Namespace: deployment.Namespace, Name: deployment.Name}, liveDeployment); err != nil {
+		if apierrors.IsNotFound(err) {
+			return nil
+		}
+		return fmt.Errorf("read RuntimePool Deployment for stale credential cleanup: %w", err)
+	}
+	if liveDeployment.Generation > 0 && liveDeployment.Status.ObservedGeneration < liveDeployment.Generation {
+		return nil
+	}
+
+	keep := make(map[string]struct{}, len(currentNames)+2)
+	for _, name := range currentNames {
+		addRuntimeSecretName(keep, name)
+	}
+	addRuntimePoolSecretReferences(keep, liveDeployment.Spec.Template.Spec)
+
+	var pods corev1.PodList
+	if err := reader.List(ctx, &pods, client.InNamespace(cfg.namespace), client.MatchingLabels{
+		runtimePoolKeyLabel: cfg.labels[runtimePoolKeyLabel],
+		runtimePoolUIDLabel: string(pool.UID),
+	}); err != nil {
+		return fmt.Errorf("list RuntimePool Pods for stale credential cleanup: %w", err)
+	}
+	for i := range pods.Items {
+		if pods.Items[i].Status.Phase == corev1.PodSucceeded || pods.Items[i].Status.Phase == corev1.PodFailed {
+			continue
+		}
+		addRuntimePoolSecretReferences(keep, pods.Items[i].Spec)
+	}
+
+	var replicaSets appsv1.ReplicaSetList
+	if err := reader.List(ctx, &replicaSets, client.InNamespace(cfg.namespace), client.MatchingLabels{
+		runtimePoolKeyLabel: cfg.labels[runtimePoolKeyLabel],
+		runtimePoolUIDLabel: string(pool.UID),
+	}); err != nil {
+		return fmt.Errorf("list RuntimePool ReplicaSets for stale credential cleanup: %w", err)
+	}
+	for i := range replicaSets.Items {
+		replicaSet := &replicaSets.Items[i]
+		if !runtimePoolReplicaSetCanCreatePods(replicaSet) {
+			continue
+		}
+		addRuntimePoolSecretReferences(keep, replicaSet.Spec.Template.Spec)
+	}
+
+	var secrets corev1.SecretList
+	if err := reader.List(ctx, &secrets, client.InNamespace(cfg.namespace), client.MatchingLabels{
+		runtimePoolManagedByLabel: "orka",
+		runtimePoolKeyLabel:       cfg.labels[runtimePoolKeyLabel],
+		runtimePoolUIDLabel:       string(pool.UID),
+	}); err != nil {
+		return fmt.Errorf("list managed RuntimePool Secrets for stale credential cleanup: %w", err)
+	}
+	for i := range secrets.Items {
+		secret := &secrets.Items[i]
+		if _, current := keep[secret.Name]; current || !runtimePoolManagedCredentialSecret(secret, cfg) {
+			continue
+		}
+		if err := r.deleteRuntimePoolManagedSecret(ctx, secret); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func runtimePoolReplicaSetCanCreatePods(replicaSet *appsv1.ReplicaSet) bool {
+	if replicaSet == nil {
+		return false
+	}
+	return replicaSet.Status.ObservedGeneration < replicaSet.Generation ||
+		ptr.Deref(replicaSet.Spec.Replicas, 0) > 0 || replicaSet.Status.Replicas > 0 ||
+		replicaSet.Status.FullyLabeledReplicas > 0 || replicaSet.Status.ReadyReplicas > 0 ||
+		replicaSet.Status.AvailableReplicas > 0 || ptr.Deref(replicaSet.Status.TerminatingReplicas, 0) > 0
+}
+
+func (r *RuntimePoolReconciler) deleteRuntimePoolManagedSecret(ctx context.Context, secret *corev1.Secret) error {
+	deleteOptions := make([]client.DeleteOption, 0, 1)
+	preconditions := client.Preconditions{}
+	if secret.UID != "" {
+		uid := secret.UID
+		preconditions.UID = &uid
+	}
+	if secret.ResourceVersion != "" {
+		resourceVersion := secret.ResourceVersion
+		preconditions.ResourceVersion = &resourceVersion
+	}
+	if preconditions.UID != nil || preconditions.ResourceVersion != nil {
+		deleteOptions = append(deleteOptions, preconditions)
+	}
+	if err := r.Delete(ctx, secret, deleteOptions...); err != nil && !apierrors.IsNotFound(err) {
+		return fmt.Errorf("delete stale managed RuntimePool Secret %q: %w", secret.Name, err)
+	}
+	return nil
+}
+
+func addRuntimePoolSecretReferences(keep map[string]struct{}, podSpec corev1.PodSpec) {
+	for i := range podSpec.ImagePullSecrets {
+		addRuntimeSecretName(keep, podSpec.ImagePullSecrets[i].Name)
+	}
+	for i := range podSpec.Volumes {
+		addRuntimeVolumeSecretReferences(keep, &podSpec.Volumes[i])
+	}
+	for i := range podSpec.InitContainers {
+		addRuntimeContainerSecretReferences(keep, podSpec.InitContainers[i].Env, podSpec.InitContainers[i].EnvFrom)
+	}
+	for i := range podSpec.Containers {
+		addRuntimeContainerSecretReferences(keep, podSpec.Containers[i].Env, podSpec.Containers[i].EnvFrom)
+	}
+	for i := range podSpec.EphemeralContainers {
+		addRuntimeContainerSecretReferences(keep, podSpec.EphemeralContainers[i].Env, podSpec.EphemeralContainers[i].EnvFrom)
+	}
+}
+
+func addRuntimeVolumeSecretReferences(keep map[string]struct{}, volume *corev1.Volume) {
+	if volume == nil {
+		return
+	}
+	if volume.Secret != nil {
+		addRuntimeSecretName(keep, volume.Secret.SecretName)
+	}
+	if volume.Projected != nil {
+		for i := range volume.Projected.Sources {
+			if volume.Projected.Sources[i].Secret != nil {
+				addRuntimeSecretName(keep, volume.Projected.Sources[i].Secret.Name)
+			}
+		}
+	}
+	if volume.ISCSI != nil && volume.ISCSI.SecretRef != nil {
+		addRuntimeSecretName(keep, volume.ISCSI.SecretRef.Name)
+	}
+	if volume.RBD != nil && volume.RBD.SecretRef != nil {
+		addRuntimeSecretName(keep, volume.RBD.SecretRef.Name)
+	}
+	if volume.FlexVolume != nil && volume.FlexVolume.SecretRef != nil {
+		addRuntimeSecretName(keep, volume.FlexVolume.SecretRef.Name)
+	}
+	if volume.Cinder != nil && volume.Cinder.SecretRef != nil {
+		addRuntimeSecretName(keep, volume.Cinder.SecretRef.Name)
+	}
+	if volume.CephFS != nil && volume.CephFS.SecretRef != nil {
+		addRuntimeSecretName(keep, volume.CephFS.SecretRef.Name)
+	}
+	if volume.AzureFile != nil {
+		addRuntimeSecretName(keep, volume.AzureFile.SecretName)
+	}
+	if volume.ScaleIO != nil && volume.ScaleIO.SecretRef != nil {
+		addRuntimeSecretName(keep, volume.ScaleIO.SecretRef.Name)
+	}
+	if volume.StorageOS != nil && volume.StorageOS.SecretRef != nil {
+		addRuntimeSecretName(keep, volume.StorageOS.SecretRef.Name)
+	}
+	if volume.CSI != nil && volume.CSI.NodePublishSecretRef != nil {
+		addRuntimeSecretName(keep, volume.CSI.NodePublishSecretRef.Name)
+	}
+}
+
+func addRuntimeSecretName(keep map[string]struct{}, name string) {
+	if name = strings.TrimSpace(name); name != "" {
+		keep[name] = struct{}{}
+	}
+}
+
+func addRuntimeContainerSecretReferences(keep map[string]struct{}, env []corev1.EnvVar, envFrom []corev1.EnvFromSource) {
+	for i := range env {
+		if env[i].ValueFrom != nil && env[i].ValueFrom.SecretKeyRef != nil {
+			addRuntimeSecretName(keep, env[i].ValueFrom.SecretKeyRef.Name)
+		}
+	}
+	for i := range envFrom {
+		if envFrom[i].SecretRef != nil {
+			addRuntimeSecretName(keep, envFrom[i].SecretRef.Name)
+		}
+	}
+}
+
+func runtimePoolManagedCredentialSecret(secret *corev1.Secret, cfg runtimePoolConfig) bool {
+	// RuntimePools may manage a dedicated runtime namespace, where Kubernetes
+	// forbids cross-namespace ownerReferences. Exact immutable ownership labels,
+	// generated-name reconstruction, and data shape form the ownership boundary.
+	if secret == nil || secret.Immutable == nil || !*secret.Immutable {
+		return false
+	}
+	for key, value := range cfg.labels {
+		if secret.Labels[key] != value {
+			return false
+		}
+	}
+	if suffix := runtimePoolAuthSuffixPattern.FindString(secret.Name); suffix != "" &&
+		runtimePoolChildName(cfg.baseName, suffix) == secret.Name {
+		return secret.Labels[runtimePoolAuthLabel] == scheduledRunLabelValue &&
+			len(secret.Data) == 2 && len(secret.Data[runtimePoolControllerTokenKey]) > 0 &&
+			len(secret.Data[runtimePoolCapabilitySecretKey]) > 0
+	}
+	if suffix := runtimePoolProviderSuffixPattern.FindString(secret.Name); suffix != "" &&
+		runtimePoolChildName(cfg.baseName, suffix) == secret.Name {
+		return len(secret.Data) == 1 && len(secret.Data[runtimePoolProviderTokenKey]) > 0
+	}
+	return false
+}
+
+func (r *RuntimePoolReconciler) ensureRuntimePoolProviderSecret(
+	ctx context.Context,
+	pool *corev1alpha1.RuntimePool,
+	cfg runtimePoolConfig,
+	name string,
+) (*corev1.Secret, error) {
+	secret := &corev1.Secret{}
+	err := r.Get(ctx, types.NamespacedName{Namespace: cfg.namespace, Name: name}, secret)
+	if apierrors.IsNotFound(err) {
+		secret = &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: cfg.namespace, Labels: cloneStringMap(cfg.labels)},
+			Type:       corev1.SecretTypeOpaque,
+			Immutable:  new(true),
+			Data:       map[string][]byte{runtimePoolProviderTokenKey: bytes.Clone(cfg.providerProxy.token)},
+		}
+		if err := r.setRuntimePoolControllerReference(pool, secret); err != nil {
+			return nil, err
+		}
+		if err := r.Create(ctx, secret); err != nil {
+			return nil, fmt.Errorf("create managed RuntimePool provider Secret: %w", err)
+		}
+		return secret, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	if !bytes.Equal(secret.Data[runtimePoolProviderTokenKey], cfg.providerProxy.token) {
+		return nil, fmt.Errorf("managed RuntimePool provider Secret does not match the configured authenticated proxy token")
+	}
+	base := secret.DeepCopy()
+	secret.Labels = mergeStringMap(secret.Labels, cfg.labels)
+	if err := r.setRuntimePoolControllerReference(pool, secret); err != nil {
+		return nil, err
+	}
+	if !reflect.DeepEqual(base.ObjectMeta, secret.ObjectMeta) {
+		if err := r.Patch(ctx, secret, client.MergeFrom(base)); err != nil {
+			return nil, err
+		}
+	}
+	return secret, nil
+}
+
+func (r *RuntimePoolReconciler) ensureRuntimePoolSecret(
+	ctx context.Context,
+	pool *corev1alpha1.RuntimePool,
+	cfg runtimePoolConfig,
+	name string,
+	keys map[string]int,
+	extraLabels map[string]string,
+) (*corev1.Secret, error) {
+	secret := &corev1.Secret{}
+	err := r.Get(ctx, types.NamespacedName{Namespace: cfg.namespace, Name: name}, secret)
+	if apierrors.IsNotFound(err) {
+		data := make(map[string][]byte, len(keys))
+		for key, size := range keys {
+			value, genErr := r.randomSecret(size)
+			if genErr != nil {
+				return nil, fmt.Errorf("generate managed RuntimePool secret: %w", genErr)
+			}
+			data[key] = []byte(value)
+		}
+		secret = &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: cfg.namespace, Labels: mergeStringMap(cloneStringMap(cfg.labels), extraLabels)},
+			Type:       corev1.SecretTypeOpaque,
+			Immutable:  new(true),
+			Data:       data,
+		}
+		if err := r.setRuntimePoolControllerReference(pool, secret); err != nil {
+			return nil, err
+		}
+		if err := r.Create(ctx, secret); err != nil {
+			return nil, fmt.Errorf("create managed RuntimePool Secret: %w", err)
+		}
+		return secret, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	for key := range keys {
+		value := secret.Data[key]
+		if strings.TrimSpace(string(value)) == "" {
+			return nil, fmt.Errorf("managed RuntimePool Secret %q is missing required key %q", secret.Name, key)
+		}
+	}
+	base := secret.DeepCopy()
+	secret.Labels = mergeStringMap(secret.Labels, cfg.labels)
+	secret.Labels = mergeStringMap(secret.Labels, extraLabels)
+	if err := r.setRuntimePoolControllerReference(pool, secret); err != nil {
+		return nil, err
+	}
+	if !reflect.DeepEqual(base.ObjectMeta, secret.ObjectMeta) {
+		if err := r.Patch(ctx, secret, client.MergeFrom(base)); err != nil {
+			return nil, err
+		}
+	}
+	return secret, nil
+}
+
+func (r *RuntimePoolReconciler) ensureRuntimePoolAncillaryResources(
+	ctx context.Context,
+	pool *corev1alpha1.RuntimePool,
+	cfg runtimePoolConfig,
+) error {
+	if err := r.ensureRuntimePoolService(ctx, pool, cfg); err != nil {
+		return err
+	}
+	if err := r.ensureRuntimePoolNetworkPolicies(ctx, pool, cfg); err != nil {
+		return err
+	}
+	return r.ensureRuntimePoolPDB(ctx, pool, cfg)
+}
+
+func (r *RuntimePoolReconciler) ensureRuntimePoolDeployment(
+	ctx context.Context,
+	pool *corev1alpha1.RuntimePool,
+	cfg runtimePoolConfig,
+	desiredTemplate corev1.PodTemplateSpec,
+	replicas int32,
+	allowTemplateUpdate bool,
+) (*appsv1.Deployment, error) {
+	deployment := &appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: cfg.baseName, Namespace: cfg.namespace}}
+	_, err := controllerutil.CreateOrUpdate(ctx, r.Client, deployment, func() error {
+		creating := deployment.ResourceVersion == ""
+		deployment.Labels = mergeStringMap(deployment.Labels, cfg.labels)
+		if err := r.setRuntimePoolControllerReference(pool, deployment); err != nil {
+			return err
+		}
+		selector := map[string]string{runtimePoolKeyLabel: cfg.labels[runtimePoolKeyLabel]}
+		if !creating && !allowTemplateUpdate && runtimePoolDeploymentNeedsRollout(deployment, desiredTemplate) {
+			return fmt.Errorf("RuntimePool Deployment template requires an authenticated drain before replacement")
+		}
+		deployment.Spec.Replicas = new(replicas)
+		deployment.Spec.Strategy = appsv1.DeploymentStrategy{Type: appsv1.RecreateDeploymentStrategyType}
+		deployment.Spec.MinReadySeconds = 2
+		deployment.Spec.ProgressDeadlineSeconds = new(max(int32(30), pool.Spec.ColdStartTimeoutSeconds))
+		deployment.Spec.RevisionHistoryLimit = new(int32(1))
+		if creating {
+			deployment.Spec.Selector = &metav1.LabelSelector{MatchLabels: selector}
+		}
+		if creating || allowTemplateUpdate {
+			deployment.Spec.Template = *desiredTemplate.DeepCopy()
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, fmt.Errorf("reconcile RuntimePool Deployment: %w", err)
+	}
+	return deployment, nil
+}
+
+func runtimePoolDeploymentNeedsRollout(deployment *appsv1.Deployment, desiredTemplate corev1.PodTemplateSpec) bool {
+	if deployment == nil {
+		return false
+	}
+	desiredRevision := strings.TrimSpace(desiredTemplate.Annotations[runtimePoolTemplateRevisionAnnotation])
+	deployedRevision := strings.TrimSpace(deployment.Spec.Template.Annotations[runtimePoolTemplateRevisionAnnotation])
+	return desiredRevision == "" || deployedRevision != desiredRevision
+}
+
+func (r *RuntimePoolReconciler) runtimePoolPodTemplate(
+	pool *corev1alpha1.RuntimePool,
+	cfg runtimePoolConfig,
+	selector map[string]string,
+	authSecretName, providerSecretName string,
+) corev1.PodTemplateSpec {
+	labels := mergeStringMap(cloneStringMap(cfg.labels), selector)
+	annotations := map[string]string{
+		runtimePoolProfileAnnotation:                 pool.Spec.Runtime.Profile.Digest,
+		runtimePoolProviderTokenGenerationAnnotation: cfg.providerProxy.tokenGeneration,
+		// Kubernetes has no portable PodSpec PID limit. This bounded value is
+		// consumed by supported runtime/admission integrations when available.
+		runtimePoolPIDsAnnotation: "4096",
+	}
+	zero := int64(0)
+	mode := int32(0o400)
+	terminationGrace := int64(120)
+	adapterDigestsJSON, _ := json.Marshal(cfg.profile.AdapterDigests)
+	modelContextLimit := ""
+	modelOutputLimit := ""
+	if cfg.profile.ModelLimits != nil {
+		modelContextLimit = strconv.FormatInt(cfg.profile.ModelLimits.Context, 10)
+		modelOutputLimit = strconv.FormatInt(cfg.profile.ModelLimits.Output, 10)
+	}
+	template := corev1.PodTemplateSpec{
+		ObjectMeta: metav1.ObjectMeta{Labels: labels, Annotations: annotations},
+		Spec: corev1.PodSpec{
+			NodeSelector:                  map[string]string{"kubernetes.io/os": "linux"},
+			AutomountServiceAccountToken:  new(false),
+			EnableServiceLinks:            new(false),
+			TerminationGracePeriodSeconds: &terminationGrace,
+			SecurityContext: &corev1.PodSecurityContext{
+				RunAsUser:      &zero,
+				RunAsGroup:     &zero,
+				SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
+			},
+			Containers: []corev1.Container{{
+				Name:            "runtime",
+				Image:           pool.Spec.Runtime.Image,
+				ImagePullPolicy: corev1.PullIfNotPresent,
+				Ports:           []corev1.ContainerPort{{Name: "control", ContainerPort: runtimePoolPort, Protocol: corev1.ProtocolTCP}},
+				Env: []corev1.EnvVar{
+					{Name: "ORKA_ACP_LISTEN_ADDRESS", Value: ":8080"},
+					{Name: "ORKA_ACP_POD_UID", ValueFrom: &corev1.EnvVarSource{FieldRef: &corev1.ObjectFieldSelector{FieldPath: "metadata.uid"}}},
+					{Name: "ORKA_ACP_POD_NAME", ValueFrom: &corev1.EnvVarSource{FieldRef: &corev1.ObjectFieldSelector{FieldPath: "metadata.name"}}},
+					{Name: "ORKA_ACP_POD_NAMESPACE", ValueFrom: &corev1.EnvVarSource{FieldRef: &corev1.ObjectFieldSelector{FieldPath: "metadata.namespace"}}},
+					{Name: "ORKA_ACP_CONTROLLER_EPOCH", Value: strconv.FormatInt(cfg.controllerEpoch, 10)},
+					{Name: "ORKA_ACP_RUNTIME_POOL_UID", Value: string(pool.UID)},
+					{Name: "ORKA_ACP_RUNTIME_POOL_GENERATION", Value: strconv.FormatInt(pool.Generation, 10)},
+					{Name: "ORKA_ACP_RUNTIME_PROFILE_DIGEST", Value: pool.Spec.Runtime.Profile.Digest},
+					{Name: "ORKA_ACP_PROFILE_DIGEST_SCHEMA_VERSION", Value: pool.Spec.Runtime.Profile.DigestSchemaVersion},
+					{Name: "ORKA_ACP_ACP_PROFILE", Value: cfg.profile.ACPProfile},
+					{Name: "ORKA_ACP_ADAPTER_DIGESTS_JSON", Value: string(adapterDigestsJSON)},
+					{Name: "ORKA_ACP_PROVIDER", Value: cfg.profile.ProviderKind},
+					{Name: "ORKA_ACP_PROVIDER_PROXY_BASE_URL", Value: cfg.providerProxy.baseURL},
+					{Name: "ORKA_ACP_MODEL", Value: cfg.profile.Model},
+					{Name: "ORKA_ACP_MODEL_CONTEXT_LIMIT", Value: modelContextLimit},
+					{Name: "ORKA_ACP_MODEL_OUTPUT_LIMIT", Value: modelOutputLimit},
+					{Name: "ORKA_ACP_WORKSPACE_INTENT", Value: string(cfg.profile.WorkspaceIntent)},
+					{Name: "ORKA_ACP_AGENT_CONFIGURATION_DIGEST", Value: cfg.profile.AgentConfigurationDigest},
+					{Name: "ORKA_ACP_TOOL_POLICY_DIGEST", Value: cfg.profile.ToolPolicyDigest},
+					{Name: "ORKA_ACP_APPROVAL_POLICY_DIGEST", Value: cfg.profile.ApprovalPolicyDigest},
+					{Name: "ORKA_ACP_MCP_CONFIGURATION_DIGEST", Value: cfg.profile.MCPConfigurationDigest},
+					{Name: "ORKA_ACP_PROXY_CREDENTIAL_ROLE", Value: cfg.profile.ProxyCredentialRole},
+					{Name: "ORKA_ACP_PROXY_CREDENTIAL_SCOPE", Value: cfg.profile.ProxyCredentialScope},
+					{Name: "ORKA_ACP_RESOURCE_CLASS", Value: cfg.profile.ResourceClass},
+					{Name: "ORKA_ACP_CONTROLLER_TOKEN_FILE", Value: runtimePoolControllerTokenPath},
+					{Name: "ORKA_ACP_CAPABILITY_SECRET_FILE", Value: runtimePoolCapabilitySecretPath},
+					{Name: "ORKA_ACP_PROVIDER_TOKEN_FILE", Value: runtimePoolProviderTokenPath},
+					{Name: "ORKA_ACP_PROVIDER_TOKEN_GENERATION", Value: cfg.providerProxy.tokenGeneration},
+					{Name: "ORKA_ACP_ARTIFACT_API_URL", Value: strings.TrimRight(r.ControllerAPIURL, "/")},
+					{Name: "ORKA_ACP_WORKSPACE_MAX_ARTIFACT_BYTES", Value: strconv.FormatInt(r.WorkspaceArtifactMaxBytes, 10)},
+					{Name: "ORKA_ACP_MCP_BROKER_URL", Value: strings.TrimRight(r.ControllerAPIURL, "/")},
+					{Name: "ORKA_ACP_TRUST_NAMESPACE", Value: pool.Spec.TrustDomain.Namespace},
+					{Name: "ORKA_ACP_SESSION_BASE_DIR", Value: "/sessions"},
+				},
+				SecurityContext: &corev1.SecurityContext{
+					RunAsUser:                &zero,
+					RunAsGroup:               &zero,
+					RunAsNonRoot:             new(false),
+					AllowPrivilegeEscalation: new(false),
+					ReadOnlyRootFilesystem:   new(true),
+					Privileged:               new(false),
+					Capabilities: &corev1.Capabilities{
+						Drop: []corev1.Capability{"ALL"},
+						Add:  []corev1.Capability{"CHOWN", "KILL", "SETGID", "SETUID"},
+					},
+					SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
+				},
+				Resources: runtimePoolResourceRequirements(pool.Spec.Runtime.Profile.ResourceClass),
+				VolumeMounts: []corev1.VolumeMount{
+					{Name: "pool-auth", MountPath: "/var/run/secrets/orka/auth", ReadOnly: true},
+					{Name: "provider-capability", MountPath: "/var/run/secrets/orka/provider", ReadOnly: true},
+					{Name: runtimePoolSessionsVolume, MountPath: "/sessions"},
+					{Name: runtimePoolTempVolume, MountPath: "/tmp"},
+					{Name: runtimePoolHomeVolume, MountPath: "/home/worker"},
+				},
+				StartupProbe:   runtimePoolHTTPProbe(30, 2, 1),
+				ReadinessProbe: runtimePoolHTTPProbe(3, 5, 2),
+				LivenessProbe:  runtimePoolHTTPProbe(3, 10, 3),
+				Lifecycle:      &corev1.Lifecycle{PreStop: &corev1.LifecycleHandler{Sleep: &corev1.SleepAction{Seconds: 5}}},
+			}},
+			Volumes: []corev1.Volume{
+				{Name: "pool-auth", VolumeSource: corev1.VolumeSource{Secret: &corev1.SecretVolumeSource{SecretName: authSecretName, DefaultMode: &mode, Items: []corev1.KeyToPath{
+					{Key: runtimePoolControllerTokenKey, Path: runtimePoolControllerTokenKey, Mode: &mode},
+					{Key: runtimePoolCapabilitySecretKey, Path: runtimePoolCapabilitySecretKey, Mode: &mode},
+				}}}},
+				{Name: "provider-capability", VolumeSource: corev1.VolumeSource{Secret: &corev1.SecretVolumeSource{SecretName: providerSecretName, DefaultMode: &mode, Items: []corev1.KeyToPath{{Key: runtimePoolProviderTokenKey, Path: "token", Mode: &mode}}}}},
+				{Name: runtimePoolSessionsVolume, VolumeSource: corev1.VolumeSource{EmptyDir: &corev1.EmptyDirVolumeSource{SizeLimit: new(resource.MustParse("4Gi"))}}},
+				{Name: runtimePoolTempVolume, VolumeSource: corev1.VolumeSource{EmptyDir: &corev1.EmptyDirVolumeSource{SizeLimit: new(resource.MustParse("512Mi"))}}},
+				{Name: runtimePoolHomeVolume, VolumeSource: corev1.VolumeSource{EmptyDir: &corev1.EmptyDirVolumeSource{SizeLimit: new(resource.MustParse("256Mi"))}}},
+			},
+		},
+	}
+	template.Annotations[runtimePoolTemplateRevisionAnnotation] = runtimePoolPodTemplateRevision(template)
+	return template
+}
+
+func runtimePoolPodTemplateRevision(template corev1.PodTemplateSpec) string {
+	copy := *template.DeepCopy()
+	delete(copy.Annotations, runtimePoolTemplateRevisionAnnotation)
+	payload, err := json.Marshal(copy)
+	if err != nil {
+		panic(fmt.Sprintf("marshal RuntimePool Pod template revision: %v", err))
+	}
+	digest := sha256.Sum256(payload)
+	return "sha256:" + hex.EncodeToString(digest[:])
+}
+
+func runtimePoolResourceRequirements(resourceClass string) corev1.ResourceRequirements {
+	if resourceClass != runtimePoolResourceClassStandard {
+		return corev1.ResourceRequirements{}
+	}
+	return corev1.ResourceRequirements{
+		Requests: corev1.ResourceList{
+			corev1.ResourceCPU:              resource.MustParse("250m"),
+			corev1.ResourceMemory:           resource.MustParse("512Mi"),
+			corev1.ResourceEphemeralStorage: resource.MustParse("1Gi"),
+		},
+		Limits: corev1.ResourceList{
+			corev1.ResourceCPU:              resource.MustParse("2"),
+			corev1.ResourceMemory:           resource.MustParse("4Gi"),
+			corev1.ResourceEphemeralStorage: resource.MustParse("5Gi"),
+		},
+	}
+}
+
+func runtimePoolHTTPProbe(failureThreshold, periodSeconds, timeoutSeconds int32) *corev1.Probe {
+	return &corev1.Probe{
+		ProbeHandler:        corev1.ProbeHandler{HTTPGet: &corev1.HTTPGetAction{Path: harnessv2.HealthPath, Port: intstr.FromString("control"), Scheme: corev1.URISchemeHTTP}},
+		InitialDelaySeconds: 0,
+		TimeoutSeconds:      timeoutSeconds,
+		PeriodSeconds:       periodSeconds,
+		FailureThreshold:    failureThreshold,
+		SuccessThreshold:    1,
+	}
+}
+
+func (r *RuntimePoolReconciler) ensureRuntimePoolService(ctx context.Context, pool *corev1alpha1.RuntimePool, cfg runtimePoolConfig) error {
+	service := &corev1.Service{ObjectMeta: metav1.ObjectMeta{Name: cfg.baseName, Namespace: cfg.namespace}}
+	_, err := controllerutil.CreateOrUpdate(ctx, r.Client, service, func() error {
+		service.Labels = mergeStringMap(service.Labels, cfg.labels)
+		if err := r.setRuntimePoolControllerReference(pool, service); err != nil {
+			return err
+		}
+		service.Spec.Type = corev1.ServiceTypeClusterIP
+		service.Spec.ClusterIP = corev1.ClusterIPNone
+		service.Spec.ClusterIPs = []string{corev1.ClusterIPNone}
+		service.Spec.PublishNotReadyAddresses = false
+		service.Spec.Selector = map[string]string{runtimePoolKeyLabel: cfg.labels[runtimePoolKeyLabel]}
+		service.Spec.Ports = []corev1.ServicePort{{Name: "control", Port: runtimePoolPort, TargetPort: intstr.FromString("control"), Protocol: corev1.ProtocolTCP}}
+		return nil
+	})
+	if err != nil {
+		return fmt.Errorf("reconcile RuntimePool headless Service: %w", err)
+	}
+	return nil
+}
+
+func controllerNamespaceForRuntimePool(namespace string) string {
+	namespace = strings.TrimSpace(namespace)
+	if namespace == "" {
+		return runtimePoolDefaultControllerNamespace
+	}
+	return namespace
+}
+
+func (r *RuntimePoolReconciler) ensureRuntimePoolNetworkPolicies(ctx context.Context, pool *corev1alpha1.RuntimePool, cfg runtimePoolConfig) error {
+	selector := metav1.LabelSelector{MatchLabels: map[string]string{runtimePoolKeyLabel: cfg.labels[runtimePoolKeyLabel]}}
+	controllerNamespace := controllerNamespaceForRuntimePool(r.ControllerNamespace)
+	policies := make([]networkingv1.NetworkPolicy, 0, 6)
+	policies = append(policies, []networkingv1.NetworkPolicy{
+		{
+			ObjectMeta: metav1.ObjectMeta{Name: runtimePoolChildName(cfg.baseName, "deny-all"), Namespace: cfg.namespace},
+			Spec:       networkingv1.NetworkPolicySpec{PodSelector: selector, PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress, networkingv1.PolicyTypeEgress}},
+		},
+		{
+			ObjectMeta: metav1.ObjectMeta{Name: runtimePoolChildName(cfg.baseName, "control-in"), Namespace: cfg.namespace},
+			Spec: networkingv1.NetworkPolicySpec{
+				PodSelector: selector,
+				PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress},
+				Ingress: []networkingv1.NetworkPolicyIngressRule{{
+					From: []networkingv1.NetworkPolicyPeer{{
+						NamespaceSelector: &metav1.LabelSelector{MatchLabels: map[string]string{corev1.LabelMetadataName: controllerNamespace}},
+						PodSelector:       &metav1.LabelSelector{MatchLabels: map[string]string{runtimePoolNetworkRoleLabel: "controller"}},
+					}},
+					Ports: []networkingv1.NetworkPolicyPort{{Protocol: new(corev1.ProtocolTCP), Port: new(intstr.FromInt32(runtimePoolPort))}},
+				}},
+			},
+		},
+		{
+			ObjectMeta: metav1.ObjectMeta{Name: runtimePoolChildName(cfg.baseName, "dns-egress"), Namespace: cfg.namespace},
+			Spec: networkingv1.NetworkPolicySpec{
+				PodSelector: selector,
+				PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeEgress},
+				Egress: []networkingv1.NetworkPolicyEgressRule{{
+					To: []networkingv1.NetworkPolicyPeer{{
+						NamespaceSelector: &metav1.LabelSelector{MatchLabels: map[string]string{corev1.LabelMetadataName: metav1.NamespaceSystem}},
+						PodSelector:       &metav1.LabelSelector{MatchLabels: map[string]string{"k8s-app": "kube-dns"}},
+					}},
+					Ports: []networkingv1.NetworkPolicyPort{
+						{Protocol: new(corev1.ProtocolUDP), Port: new(intstr.FromInt32(53))},
+						{Protocol: new(corev1.ProtocolTCP), Port: new(intstr.FromInt32(53))},
+					},
+				}},
+			},
+		},
+	}...)
+	policies = append(policies,
+		networkingv1.NetworkPolicy{
+			ObjectMeta: metav1.ObjectMeta{Name: runtimePoolChildName(cfg.baseName, "provider-proxy-egress"), Namespace: cfg.namespace},
+			Spec: networkingv1.NetworkPolicySpec{
+				PodSelector: selector, PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeEgress},
+				Egress: []networkingv1.NetworkPolicyEgressRule{{
+					To: []networkingv1.NetworkPolicyPeer{{
+						NamespaceSelector: &metav1.LabelSelector{MatchLabels: map[string]string{corev1.LabelMetadataName: cfg.providerProxy.namespace}},
+						PodSelector:       &metav1.LabelSelector{MatchLabels: cloneStringMap(cfg.providerProxy.podLabels)},
+					}},
+					Ports: []networkingv1.NetworkPolicyPort{{Protocol: new(corev1.ProtocolTCP), Port: new(intstr.FromInt32(cfg.providerProxy.port))}},
+				}},
+			},
+		},
+		networkingv1.NetworkPolicy{
+			ObjectMeta: metav1.ObjectMeta{Name: runtimePoolChildName(cfg.baseName, "controller-egress"), Namespace: cfg.namespace},
+			Spec: networkingv1.NetworkPolicySpec{
+				PodSelector: selector, PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeEgress},
+				Egress: []networkingv1.NetworkPolicyEgressRule{{
+					To: []networkingv1.NetworkPolicyPeer{{
+						NamespaceSelector: &metav1.LabelSelector{MatchLabels: map[string]string{corev1.LabelMetadataName: controllerNamespace}},
+						PodSelector:       &metav1.LabelSelector{MatchLabels: map[string]string{runtimePoolNetworkRoleLabel: "controller"}},
+					}},
+					Ports: []networkingv1.NetworkPolicyPort{{Protocol: new(corev1.ProtocolTCP), Port: new(intstr.FromInt32(r.ControllerAPIPort))}},
+				}},
+			},
+		},
+	)
+	for i := range policies {
+		policy := &networkingv1.NetworkPolicy{ObjectMeta: policies[i].ObjectMeta}
+		desired := policies[i].Spec
+		_, err := controllerutil.CreateOrUpdate(ctx, r.Client, policy, func() error {
+			policy.Labels = mergeStringMap(policy.Labels, cfg.labels)
+			if err := r.setRuntimePoolControllerReference(pool, policy); err != nil {
+				return err
+			}
+			policy.Spec = desired
+			return nil
+		})
+		if err != nil {
+			return fmt.Errorf("reconcile RuntimePool NetworkPolicy %q: %w", policy.Name, err)
+		}
+	}
+	return nil
+}
+
+func (r *RuntimePoolReconciler) ensureRuntimePoolPDB(ctx context.Context, pool *corev1alpha1.RuntimePool, cfg runtimePoolConfig) error {
+	name := runtimePoolChildName(cfg.baseName, "pdb")
+	pdb := &policyv1.PodDisruptionBudget{}
+	key := types.NamespacedName{Namespace: cfg.namespace, Name: name}
+	if !r.EnablePDB {
+		if err := r.Get(ctx, key, pdb); err == nil {
+			return client.IgnoreNotFound(r.Delete(ctx, pdb))
+		} else if !apierrors.IsNotFound(err) {
+			return err
+		}
+		return nil
+	}
+	pdb.ObjectMeta = metav1.ObjectMeta{Name: name, Namespace: cfg.namespace}
+	_, err := controllerutil.CreateOrUpdate(ctx, r.Client, pdb, func() error {
+		pdb.Labels = mergeStringMap(pdb.Labels, cfg.labels)
+		if err := r.setRuntimePoolControllerReference(pool, pdb); err != nil {
+			return err
+		}
+		pdb.Spec = policyv1.PodDisruptionBudgetSpec{
+			MaxUnavailable: new(intstr.FromInt32(0)),
+			Selector:       &metav1.LabelSelector{MatchLabels: map[string]string{runtimePoolKeyLabel: cfg.labels[runtimePoolKeyLabel]}},
+		}
+		return nil
+	})
+	if err != nil {
+		return fmt.Errorf("reconcile RuntimePool PodDisruptionBudget: %w", err)
+	}
+	return nil
+}
+
+func (r *RuntimePoolReconciler) stopRuntimePoolDeployment(ctx context.Context, deployment *appsv1.Deployment) error {
+	if deployment == nil {
+		return fmt.Errorf("RuntimePool Deployment is required")
+	}
+	if ptr.Deref(deployment.Spec.Replicas, 0) == 0 {
+		return nil
+	}
+	base := deployment.DeepCopy()
+	deployment.Spec.Replicas = new(int32(0))
+	return r.Patch(ctx, deployment, client.MergeFrom(base))
+}
+
+func (r *RuntimePoolReconciler) listRuntimePoolPods(ctx context.Context, cfg runtimePoolConfig) ([]corev1.Pod, error) {
+	list := &corev1.PodList{}
+	if err := r.List(ctx, list, client.InNamespace(cfg.namespace), client.MatchingLabels{runtimePoolKeyLabel: cfg.labels[runtimePoolKeyLabel]}); err != nil {
+		return nil, err
+	}
+	return list.Items, nil
+}
+
+func readyRuntimePoolPods(pods []corev1.Pod) []corev1.Pod {
+	ready := make([]corev1.Pod, 0, len(pods))
+	for i := range pods {
+		pod := &pods[i]
+		if !pod.DeletionTimestamp.IsZero() || pod.Status.Phase != corev1.PodRunning || strings.TrimSpace(pod.Status.PodIP) == "" {
+			continue
+		}
+		condition := findRuntimePoolPodCondition(pod.Status.Conditions, corev1.PodReady)
+		if condition != nil && condition.Status == corev1.ConditionTrue {
+			ready = append(ready, *pod.DeepCopy())
+		}
+	}
+	return ready
+}
+
+func findRuntimePoolPodCondition(conditions []corev1.PodCondition, conditionType corev1.PodConditionType) *corev1.PodCondition {
+	for i := range conditions {
+		if conditions[i].Type == conditionType {
+			return &conditions[i]
+		}
+	}
+	return nil
+}
+
+func countRuntimePoolPods(pods []corev1.Pod) int32 {
+	var count int32
+	for i := range pods {
+		if pods[i].Status.Phase != corev1.PodSucceeded && pods[i].Status.Phase != corev1.PodFailed {
+			count++
+		}
+	}
+	return count
+}
+
+func runtimePoolSchedulingFailure(pods []corev1.Pod) (string, string, bool) {
+	for i := range pods {
+		condition := findRuntimePoolPodCondition(pods[i].Status.Conditions, corev1.PodScheduled)
+		if condition != nil && condition.Status == corev1.ConditionFalse {
+			message := sanitizeRuntimePoolMessage(condition.Message)
+			if message == "" {
+				message = "runtime Pod is unschedulable"
+			}
+			reason := strings.TrimSpace(condition.Reason)
+			if reason == "" {
+				reason = corev1alpha1.RuntimePoolReasonSchedulingFailed
+			}
+			return reason, message, true
+		}
+	}
+	return "", "", false
+}
+
+func runtimePoolPodFailure(pods []corev1.Pod) (string, string, bool) {
+	for i := range pods {
+		statuses := append([]corev1.ContainerStatus(nil), pods[i].Status.InitContainerStatuses...)
+		statuses = append(statuses, pods[i].Status.ContainerStatuses...)
+		for j := range statuses {
+			waiting := statuses[j].State.Waiting
+			if waiting == nil {
+				continue
+			}
+			switch waiting.Reason {
+			case "ErrImagePull", "ImagePullBackOff", "InvalidImageName", "CreateContainerConfigError", "RunContainerError", "CrashLoopBackOff":
+				message := sanitizeRuntimePoolMessage(waiting.Message)
+				if message == "" {
+					message = "runtime container failed: " + waiting.Reason
+				}
+				return corev1alpha1.RuntimePoolReasonRolloutFailed, message, true
+			}
+		}
+	}
+	return "", "", false
+}
+
+func (r *RuntimePoolReconciler) applyDeploymentFailureConditions(pool *corev1alpha1.RuntimePool, deployment *appsv1.Deployment, status *corev1alpha1.RuntimePoolStatus) {
+	if deployment == nil || status == nil {
+		return
+	}
+	for i := range deployment.Status.Conditions {
+		condition := deployment.Status.Conditions[i]
+		if condition.Type != appsv1.DeploymentReplicaFailure || condition.Status != corev1.ConditionTrue {
+			continue
+		}
+		message := sanitizeRuntimePoolMessage(condition.Message)
+		lower := strings.ToLower(message)
+		switch {
+		case strings.Contains(lower, "podsecurity"), strings.Contains(lower, "pod security"), strings.Contains(lower, "restricted:"):
+			r.setRuntimePoolCondition(pool, status, corev1alpha1.RuntimePoolConditionPodSecurityReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonPodSecurityRejected, message)
+		case strings.Contains(lower, "quota"), strings.Contains(lower, "resourcequota"):
+			r.setRuntimePoolCondition(pool, status, corev1alpha1.RuntimePoolConditionQuotaReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonQuotaRejected, message)
+		default:
+			r.setRuntimePoolCondition(pool, status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonRolloutFailed, message)
+		}
+	}
+}
+
+func runtimePoolDeploymentValidationTarget(
+	pool *corev1alpha1.RuntimePool,
+	deployment *appsv1.Deployment,
+) (*corev1alpha1.RuntimePool, runtimePoolConfig, error) {
+	if pool == nil || deployment == nil || len(deployment.Spec.Template.Spec.Containers) != 1 {
+		return nil, runtimePoolConfig{}, fmt.Errorf("deployed RuntimePool template is invalid")
+	}
+	environment := runtimePoolLiteralEnvironment(deployment.Spec.Template.Spec.Containers[0].Env)
+	poolGeneration, err := strconv.ParseInt(environment["ORKA_ACP_RUNTIME_POOL_GENERATION"], 10, 64)
+	if err != nil || poolGeneration <= 0 {
+		return nil, runtimePoolConfig{}, fmt.Errorf("deployed RuntimePool generation is invalid")
+	}
+	controllerEpoch, err := strconv.ParseInt(environment["ORKA_ACP_CONTROLLER_EPOCH"], 10, 64)
+	if err != nil || controllerEpoch <= 0 {
+		return nil, runtimePoolConfig{}, fmt.Errorf("deployed RuntimePool controller epoch is invalid")
+	}
+	providerGeneration := strings.TrimSpace(environment["ORKA_ACP_PROVIDER_TOKEN_GENERATION"])
+	if !validRuntimePoolProviderTokenGeneration(providerGeneration) ||
+		deployment.Spec.Template.Annotations[runtimePoolProviderTokenGenerationAnnotation] != providerGeneration {
+		return nil, runtimePoolConfig{}, fmt.Errorf("deployed RuntimePool provider token generation is invalid")
+	}
+	profileDigest := strings.TrimSpace(environment["ORKA_ACP_RUNTIME_PROFILE_DIGEST"])
+	if !validSHA256Digest(profileDigest) || deployment.Spec.Template.Annotations[runtimePoolProfileAnnotation] != profileDigest {
+		return nil, runtimePoolConfig{}, fmt.Errorf("deployed RuntimePool profile digest is invalid")
+	}
+	adapterDigests := map[string]string{}
+	if err := json.Unmarshal([]byte(environment["ORKA_ACP_ADAPTER_DIGESTS_JSON"]), &adapterDigests); err != nil || len(adapterDigests) == 0 {
+		return nil, runtimePoolConfig{}, fmt.Errorf("deployed RuntimePool adapter digests are invalid")
+	}
+	modelLimits, err := runtimePoolModelLimitsFromEnvironment(environment)
+	if err != nil {
+		return nil, runtimePoolConfig{}, fmt.Errorf("deployed RuntimePool model limits are invalid: %w", err)
+	}
+	profile := harnessv2.RuntimeProfile{
+		ACPProfile:               environment["ORKA_ACP_ACP_PROFILE"],
+		AdapterDigests:           adapterDigests,
+		ProviderKind:             environment["ORKA_ACP_PROVIDER"],
+		Model:                    environment["ORKA_ACP_MODEL"],
+		ModelLimits:              modelLimits,
+		AgentConfigurationDigest: environment["ORKA_ACP_AGENT_CONFIGURATION_DIGEST"],
+		ToolPolicyDigest:         environment["ORKA_ACP_TOOL_POLICY_DIGEST"],
+		ApprovalPolicyDigest:     environment["ORKA_ACP_APPROVAL_POLICY_DIGEST"],
+		MCPConfigurationDigest:   environment["ORKA_ACP_MCP_CONFIGURATION_DIGEST"],
+		WorkspaceIntent:          harnessv2.WorkspaceIntent(environment["ORKA_ACP_WORKSPACE_INTENT"]),
+		ProxyCredentialRole:      environment["ORKA_ACP_PROXY_CREDENTIAL_ROLE"],
+		ProxyCredentialScope:     environment["ORKA_ACP_PROXY_CREDENTIAL_SCOPE"],
+		ResourceClass:            environment["ORKA_ACP_RESOURCE_CLASS"],
+	}
+	if err := profile.Validate(); err != nil {
+		return nil, runtimePoolConfig{}, fmt.Errorf("deployed RuntimePool profile is invalid: %w", err)
+	}
+	deployedPool := pool.DeepCopy()
+	deployedPool.Generation = poolGeneration
+	deployedPool.Spec.Runtime.Profile.Digest = profileDigest
+	deployedPool.Spec.Runtime.Profile.DigestSchemaVersion = environment["ORKA_ACP_PROFILE_DIGEST_SCHEMA_VERSION"]
+	return deployedPool, runtimePoolConfig{
+		controllerEpoch: controllerEpoch,
+		protocol:        corev1alpha1.RuntimePoolProtocolHarnessV2,
+		profile:         profile,
+		providerProxy: runtimePoolProviderProxyConfig{
+			tokenGeneration: providerGeneration,
+		},
+	}, nil
+}
+
+func runtimePoolModelLimitsFromEnvironment(environment map[string]string) (*harnessv2.ModelTokenLimits, error) {
+	contextValue := strings.TrimSpace(environment["ORKA_ACP_MODEL_CONTEXT_LIMIT"])
+	outputValue := strings.TrimSpace(environment["ORKA_ACP_MODEL_OUTPUT_LIMIT"])
+	if contextValue == "" && outputValue == "" {
+		return nil, nil
+	}
+	if contextValue == "" || outputValue == "" {
+		return nil, fmt.Errorf("context and output limits must be set together")
+	}
+	contextLimit, err := strconv.ParseInt(contextValue, 10, 64)
+	if err != nil {
+		return nil, fmt.Errorf("context limit must be an integer")
+	}
+	outputLimit, err := strconv.ParseInt(outputValue, 10, 64)
+	if err != nil {
+		return nil, fmt.Errorf("output limit must be an integer")
+	}
+	limits := &harnessv2.ModelTokenLimits{Context: contextLimit, Output: outputLimit}
+	if err := limits.Validate(); err != nil {
+		return nil, err
+	}
+	return limits, nil
+}
+
+func runtimePoolLiteralEnvironment(values []corev1.EnvVar) map[string]string {
+	result := make(map[string]string, len(values))
+	for i := range values {
+		if values[i].ValueFrom == nil {
+			result[values[i].Name] = strings.TrimSpace(values[i].Value)
+		}
+	}
+	return result
+}
+
+func validRuntimePoolProviderTokenGeneration(generation string) bool {
+	if len(generation) != 16 {
+		return false
+	}
+	_, err := hex.DecodeString(generation)
+	return err == nil && generation == strings.ToLower(generation)
+}
+
+func (r *RuntimePoolReconciler) runtimePoolDeploymentAuthSecret(
+	ctx context.Context,
+	deployment *appsv1.Deployment,
+) (*corev1.Secret, error) {
+	if deployment == nil {
+		return nil, fmt.Errorf("RuntimePool Deployment is required")
+	}
+	secretName := ""
+	for i := range deployment.Spec.Template.Spec.Volumes {
+		volume := deployment.Spec.Template.Spec.Volumes[i]
+		if volume.Name == "pool-auth" && volume.Secret != nil {
+			secretName = strings.TrimSpace(volume.Secret.SecretName)
+			break
+		}
+	}
+	if secretName == "" {
+		return nil, fmt.Errorf("deployed RuntimePool auth Secret reference is missing")
+	}
+	secret := &corev1.Secret{}
+	if err := r.Get(ctx, types.NamespacedName{Namespace: deployment.Namespace, Name: secretName}, secret); err != nil {
+		return nil, fmt.Errorf("get deployed RuntimePool auth Secret: %w", err)
+	}
+	if strings.TrimSpace(string(secret.Data[runtimePoolControllerTokenKey])) == "" ||
+		len(secret.Data[runtimePoolCapabilitySecretKey]) == 0 {
+		return nil, fmt.Errorf("deployed RuntimePool auth Secret is incomplete")
+	}
+	return secret, nil
+}
+
+func validateRuntimePoolProbe(
+	pool *corev1alpha1.RuntimePool,
+	cfg runtimePoolConfig,
+	pod *corev1.Pod,
+	probe RuntimePoolProbeResult,
+	now time.Time,
+) (*corev1alpha1.RuntimePoolActiveInstanceStatus, error) {
+	return validateRuntimePoolProbeWithIdentityCapacityRequirement(pool, cfg, pod, probe, now, true)
+}
+
+func validateRuntimePoolProbeForRollout(
+	pool *corev1alpha1.RuntimePool,
+	cfg runtimePoolConfig,
+	pod *corev1.Pod,
+	probe RuntimePoolProbeResult,
+	now time.Time,
+) (*corev1alpha1.RuntimePoolActiveInstanceStatus, error) {
+	return validateRuntimePoolProbeWithIdentityCapacityRequirement(pool, cfg, pod, probe, now, false)
+}
+
+func validateRuntimePoolProbeWithIdentityCapacityRequirement(
+	pool *corev1alpha1.RuntimePool,
+	cfg runtimePoolConfig,
+	pod *corev1.Pod,
+	probe RuntimePoolProbeResult,
+	now time.Time,
+	requireSessionIdentityCapacity bool,
+) (*corev1alpha1.RuntimePoolActiveInstanceStatus, error) {
+	if err := probe.Capabilities.Validate(); err != nil {
+		return nil, fmt.Errorf("runtime capabilities are invalid: %w", err)
+	}
+	if err := probe.Status.Validate(); err != nil {
+		return nil, fmt.Errorf("runtime status is invalid: %w", err)
+	}
+	if probe.Capabilities.Protocol != harnessv2.ProtocolVersion || probe.Status.Protocol != harnessv2.ProtocolVersion {
+		return nil, fmt.Errorf("runtime protocol does not match %q", harnessv2.ProtocolVersion)
+	}
+	if probe.Capabilities.ACPVersion != cfg.profile.ACPProfile {
+		return nil, fmt.Errorf("runtime ACP profile does not match the immutable RuntimePool profile")
+	}
+	if !reflect.DeepEqual(probe.Capabilities.AdapterDigests, cfg.profile.AdapterDigests) {
+		return nil, fmt.Errorf("runtime adapter digests do not match the immutable RuntimePool profile")
+	}
+	if len(probe.Capabilities.Provider.ProviderKinds) != 1 || probe.Capabilities.Provider.ProviderKinds[0] != cfg.profile.ProviderKind {
+		return nil, fmt.Errorf("runtime provider kind does not match the immutable RuntimePool profile")
+	}
+	if len(probe.Capabilities.Provider.Models) != 1 || probe.Capabilities.Provider.Models[0] != cfg.profile.Model {
+		return nil, fmt.Errorf("runtime model does not match the immutable RuntimePool profile")
+	}
+	if !probe.Capabilities.Provider.SupportsCancel || !probe.Capabilities.Provider.SupportsTools {
+		return nil, fmt.Errorf("runtime supervisor is missing required cancel or tool capabilities")
+	}
+	if !probe.Capabilities.WorkspaceGovernance.Strict() {
+		return nil, fmt.Errorf("runtime supervisor does not advertise strict workspace governance")
+	}
+	if string(probe.Capabilities.RuntimeProfileDigest) != pool.Spec.Runtime.Profile.Digest || string(probe.Status.Fence.RuntimeProfileDigest) != pool.Spec.Runtime.Profile.Digest {
+		return nil, fmt.Errorf("runtime profile digest does not match the immutable RuntimePool profile")
+	}
+	if !runtimePoolDigestSchemaMatches(pool.Spec.Runtime.Profile.DigestSchemaVersion, probe.Capabilities.ProfileDigestSchemaVersion) ||
+		!runtimePoolDigestSchemaMatches(pool.Spec.Runtime.Profile.DigestSchemaVersion, probe.Status.Fence.ProfileDigestSchemaVersion) {
+		return nil, fmt.Errorf("runtime profile digest schema does not match the immutable RuntimePool profile")
+	}
+	if string(probe.Status.Fence.RuntimePoolUID) != string(pool.UID) {
+		return nil, fmt.Errorf("runtime status is fenced to another RuntimePool UID")
+	}
+	if probe.Status.Fence.RuntimePoolGeneration != uint64(pool.Generation) {
+		return nil, fmt.Errorf("runtime status is fenced to another RuntimePool generation")
+	}
+	if probe.Status.Fence.ControllerEpoch != uint64(cfg.controllerEpoch) {
+		return nil, fmt.Errorf("runtime status is fenced to another controller epoch")
+	}
+	if !probe.Capabilities.SupportsDrain {
+		return nil, fmt.Errorf("runtime supervisor does not advertise drain support")
+	}
+	providerGeneration, err := validateRuntimePoolPodRevision(pool, cfg, pod)
+	if err != nil {
+		return nil, err
+	}
+	expectedInstanceID := runtimePoolRuntimeInstanceID(pod.UID, probe.Status.Fence.SupervisorBootID)
+	if string(probe.Status.Fence.RuntimeInstanceID) != expectedInstanceID {
+		return nil, fmt.Errorf("runtime instance ID does not match the selected Pod UID and supervisor boot ID")
+	}
+	if probe.Capabilities.Limits.MaxResidentSessions == 0 || probe.Capabilities.Limits.MaxConcurrentPrompts == 0 {
+		return nil, fmt.Errorf("runtime supervisor advertised zero capacity")
+	}
+	if requireSessionIdentityCapacity && probe.Status.SessionIdentityCapacity == nil {
+		return nil, fmt.Errorf("runtime supervisor did not report session identity capacity")
+	}
+	if probe.Status.SessionIdentityCapacity != nil {
+		usableSessionIdentities := probe.Status.SessionIdentityCapacity.Total - probe.Status.SessionIdentityCapacity.ExhaustionReserve
+		if usableSessionIdentities < uint64(probe.Capabilities.Limits.MaxResidentSessions) {
+			return nil, fmt.Errorf("runtime supervisor session identity capacity is smaller than resident-session capacity")
+		}
+	}
+	observed := metav1.NewTime(now.UTC())
+	return &corev1alpha1.RuntimePoolActiveInstanceStatus{
+		PodNamespace:               pod.Namespace,
+		PodName:                    pod.Name,
+		PodAddress:                 pod.Status.PodIP,
+		PodUID:                     string(pod.UID),
+		BootID:                     string(probe.Status.Fence.SupervisorBootID),
+		RuntimeInstanceID:          expectedInstanceID,
+		ControllerEpoch:            cfg.controllerEpoch,
+		ProtocolVersion:            cfg.protocol,
+		ProfileDigest:              pool.Spec.Runtime.Profile.Digest,
+		ProfileDigestSchemaVersion: pool.Spec.Runtime.Profile.DigestSchemaVersion,
+		ProviderTokenGeneration:    providerGeneration,
+		LastObservedTime:           &observed,
+	}, nil
+}
+
+func validateRuntimePoolPodRevision(
+	pool *corev1alpha1.RuntimePool,
+	cfg runtimePoolConfig,
+	pod *corev1.Pod,
+) (string, error) {
+	providerGeneration := strings.TrimSpace(cfg.providerProxy.tokenGeneration)
+	if providerGeneration == "" && pool.Status.ActiveInstance != nil {
+		providerGeneration = strings.TrimSpace(pool.Status.ActiveInstance.ProviderTokenGeneration)
+	}
+	podProviderGeneration := strings.TrimSpace(pod.Annotations[runtimePoolProviderTokenGenerationAnnotation])
+	if providerGeneration == "" {
+		providerGeneration = podProviderGeneration
+	}
+	if !validRuntimePoolProviderTokenGeneration(providerGeneration) || podProviderGeneration != providerGeneration {
+		return "", fmt.Errorf("runtime Pod provider token generation does not match the intended immutable template")
+	}
+	if strings.TrimSpace(pod.Annotations[runtimePoolProfileAnnotation]) != pool.Spec.Runtime.Profile.Digest {
+		return "", fmt.Errorf("runtime Pod profile annotation does not match the intended immutable profile")
+	}
+	return providerGeneration, nil
+}
+
+func applyRuntimePoolProbeCapacity(status *corev1alpha1.RuntimePoolStatus, cfg runtimePoolConfig, probe RuntimePoolProbeResult) {
+	if status == nil {
+		return
+	}
+	status.Capacity.MaxResidentSessions = min(cfg.maxResidentSessions, int32(probe.Capabilities.Limits.MaxResidentSessions))
+	status.Capacity.MaxRunningPrompts = min(cfg.maxRunningPrompts, int32(probe.Capabilities.Limits.MaxConcurrentPrompts))
+	status.Capacity.ResidentSessions = int32(probe.Status.Pressure.ResidentSessions)
+	status.Capacity.RunningPrompts = int32(probe.Status.Pressure.ActivePrompts)
+	status.Capacity.PendingPermissions = int32(probe.Status.Pressure.PendingPermissions)
+	status.Capacity.LiveDescendants = int32(probe.Status.Pressure.LiveDescendants)
+	var finalizing int32
+	for i := range probe.Status.Sessions {
+		if probe.Status.Sessions[i].ReservedForFinalization {
+			finalizing++
+		}
+	}
+	status.Capacity.FinalizingSessions = max(status.Capacity.FinalizingSessions, finalizing)
+}
+
+func runtimePoolAtCapacity(capacity corev1alpha1.RuntimePoolCapacityStatus) bool {
+	return capacity.ResidentSessions+capacity.ReservedSessions >= capacity.MaxResidentSessions ||
+		capacity.RunningPrompts >= capacity.MaxRunningPrompts
+}
+
+func runtimePoolControllerWorkIsQuiescent(capacity corev1alpha1.RuntimePoolCapacityStatus) bool {
+	return capacity.QueuedTasks == 0 && capacity.ReservedSessions == 0 && capacity.FinalizingSessions == 0
+}
+
+func runtimePoolProbeIsQuiescent(controllerCapacity corev1alpha1.RuntimePoolCapacityStatus, status harnessv2.StatusResponse) bool {
+	return status.Drain.Requested && !status.Drain.AcceptingNewSessions &&
+		runtimePoolControllerWorkIsQuiescent(controllerCapacity) &&
+		status.Pressure.ResidentSessions == 0 && status.Pressure.ActivePrompts == 0 &&
+		status.Pressure.QueuedAdmissions == 0 && status.Pressure.PendingPermissions == 0 &&
+		status.Pressure.LiveDescendants == 0 && len(status.Sessions) == 0 &&
+		len(status.ActivePrompts) == 0 && len(status.PendingPermissions) == 0
+}
+
+func (r *RuntimePoolReconciler) baseRuntimePoolStatus(pool *corev1alpha1.RuntimePool, currentReplicas int32) corev1alpha1.RuntimePoolStatus {
+	status := pool.DeepCopy().Status
+	status.ObservedGeneration = pool.Generation
+	status.ControllerEpoch = r.effectiveControllerEpoch(pool)
+	status.DesiredReplicas = pool.Spec.DesiredReplicas
+	status.CurrentReplicas = currentReplicas
+	status.Capacity.MaxResidentSessions = corev1alpha1.DefaultRuntimePoolMaxResidentSessions
+	status.Capacity.MaxRunningPrompts = corev1alpha1.DefaultRuntimePoolMaxRunningPrompts
+	if pool.Spec.Capacity != nil {
+		if pool.Spec.Capacity.MaxResidentSessions > 0 {
+			status.Capacity.MaxResidentSessions = pool.Spec.Capacity.MaxResidentSessions
+		}
+		if pool.Spec.Capacity.MaxRunningPrompts > 0 {
+			status.Capacity.MaxRunningPrompts = pool.Spec.Capacity.MaxRunningPrompts
+		}
+	}
+	for _, conditionType := range []string{
+		corev1alpha1.RuntimePoolConditionAdmissionReady,
+		corev1alpha1.RuntimePoolConditionPodSecurityReady,
+		corev1alpha1.RuntimePoolConditionQuotaReady,
+		corev1alpha1.RuntimePoolConditionSchedulingReady,
+		corev1alpha1.RuntimePoolConditionRolloutReady,
+	} {
+		if meta.FindStatusCondition(status.Conditions, conditionType) == nil {
+			r.setRuntimePoolCondition(pool, &status, conditionType, metav1.ConditionUnknown, "Reconciling", "RuntimePool reconciliation has not completed this check")
+		}
+	}
+	return status
+}
+
+func (r *RuntimePoolReconciler) finishRuntimePoolResourceFailure(
+	ctx context.Context,
+	pool *corev1alpha1.RuntimePool,
+	cfg runtimePoolConfig,
+	err error,
+) (ctrl.Result, error) {
+	status := r.baseRuntimePoolStatus(pool, 0)
+	status.ControllerEpoch = cfg.controllerEpoch
+	status.Lifecycle = corev1alpha1.RuntimePoolLifecycleDegraded
+	status.AdmissionState = corev1alpha1.RuntimePoolAdmissionClosed
+	status.ActiveInstance = nil
+	status.Message = sanitizeRuntimePoolMessage(err.Error())
+	reason := corev1alpha1.RuntimePoolReasonRolloutFailed
+	lower := strings.ToLower(status.Message)
+	switch {
+	case strings.Contains(lower, "podsecurity"), strings.Contains(lower, "pod security"), strings.Contains(lower, "restricted:"):
+		reason = corev1alpha1.RuntimePoolReasonPodSecurityRejected
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionPodSecurityReady, metav1.ConditionFalse, reason, status.Message)
+	case strings.Contains(lower, "quota"), strings.Contains(lower, "resourcequota"):
+		reason = corev1alpha1.RuntimePoolReasonQuotaRejected
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionQuotaReady, metav1.ConditionFalse, reason, status.Message)
+	default:
+		r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionRolloutReady, metav1.ConditionFalse, reason, status.Message)
+	}
+	r.setRuntimePoolCondition(pool, &status, corev1alpha1.RuntimePoolConditionAdmissionReady, metav1.ConditionFalse, corev1alpha1.RuntimePoolReasonAdmissionClosed, status.Message)
+	return r.finishRuntimePoolStatus(ctx, pool, status, runtimePoolRequeue)
+}
+
+func (r *RuntimePoolReconciler) finishRuntimePoolStatus(
+	ctx context.Context,
+	pool *corev1alpha1.RuntimePool,
+	status corev1alpha1.RuntimePoolStatus,
+	requeueAfter time.Duration,
+) (ctrl.Result, error) {
+	status.Message = sanitizeRuntimePoolMessage(status.Message)
+	if reflect.DeepEqual(pool.Status, status) {
+		return ctrl.Result{RequeueAfter: requeueAfter}, nil
+	}
+	base := pool.DeepCopy()
+	pool.Status = status
+	if err := r.Status().Patch(ctx, pool, client.MergeFrom(base)); err != nil {
+		return ctrl.Result{}, err
+	}
+	return ctrl.Result{RequeueAfter: requeueAfter}, nil
+}
+
+func (r *RuntimePoolReconciler) setRuntimePoolCondition(
+	pool *corev1alpha1.RuntimePool,
+	status *corev1alpha1.RuntimePoolStatus,
+	conditionType string,
+	conditionStatus metav1.ConditionStatus,
+	reason, message string,
+) {
+	meta.SetStatusCondition(&status.Conditions, metav1.Condition{
+		Type:               conditionType,
+		Status:             conditionStatus,
+		ObservedGeneration: pool.Generation,
+		LastTransitionTime: metav1.NewTime(r.now()),
+		Reason:             sanitizeRuntimePoolReason(reason),
+		Message:            sanitizeRuntimePoolMessage(message),
+	})
+}
+
+func (r *RuntimePoolReconciler) finalizeRuntimePool(ctx context.Context, pool *corev1alpha1.RuntimePool) (ctrl.Result, error) {
+	if !controllerutil.ContainsFinalizer(pool, runtimePoolFinalizer) {
+		return ctrl.Result{}, nil
+	}
+	cfg, err := r.runtimePoolConfigForDeletion(pool)
+	if err != nil {
+		return ctrl.Result{}, err
+	}
+	remaining, err := r.deleteRuntimePoolChildren(ctx, cfg)
+	if err != nil {
+		return ctrl.Result{}, err
+	}
+	if remaining {
+		return ctrl.Result{RequeueAfter: time.Second}, nil
+	}
+	base := pool.DeepCopy()
+	controllerutil.RemoveFinalizer(pool, runtimePoolFinalizer)
+	if err := r.Patch(ctx, pool, client.MergeFrom(base)); err != nil && !apierrors.IsNotFound(err) {
+		return ctrl.Result{}, err
+	}
+	return ctrl.Result{}, nil
+}
+
+func (r *RuntimePoolReconciler) runtimePoolConfigForDeletion(pool *corev1alpha1.RuntimePool) (runtimePoolConfig, error) {
+	namespace := strings.TrimSpace(pool.Spec.RuntimeNamespace)
+	if namespace == "" {
+		namespace = strings.TrimSpace(r.RuntimeNamespace)
+	}
+	if namespace == "" {
+		namespace = pool.Namespace
+	}
+	if errs := validation.IsDNS1123Label(namespace); len(errs) != 0 {
+		return runtimePoolConfig{}, fmt.Errorf("runtime namespace is invalid")
+	}
+	return runtimePoolConfig{
+		namespace: namespace,
+		baseName:  runtimePoolResourceName(pool.Namespace, pool.Name),
+		labels: map[string]string{
+			runtimePoolKeyLabel:       runtimePoolKey(pool.Namespace, pool.Name),
+			runtimePoolNamespaceLabel: pool.Namespace,
+			runtimePoolNameLabel:      pool.Name,
+		},
+	}, nil
+}
+
+func (r *RuntimePoolReconciler) deleteRuntimePoolChildren(ctx context.Context, cfg runtimePoolConfig) (bool, error) {
+	remaining := false
+	deleteObject := func(obj client.Object) error {
+		key := types.NamespacedName{Namespace: cfg.namespace, Name: obj.GetName()}
+		if err := r.Get(ctx, key, obj); err != nil {
+			return client.IgnoreNotFound(err)
+		}
+		if err := r.Delete(ctx, obj, client.PropagationPolicy(metav1.DeletePropagationBackground)); err != nil && !apierrors.IsNotFound(err) {
+			return err
+		}
+		check := obj.DeepCopyObject().(client.Object)
+		if err := r.Get(ctx, key, check); err == nil {
+			remaining = true
+		} else if !apierrors.IsNotFound(err) {
+			return err
+		}
+		return nil
+	}
+	objects := make([]client.Object, 0, 9)
+	objects = append(objects,
+		&appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: cfg.baseName}},
+		&corev1.Service{ObjectMeta: metav1.ObjectMeta{Name: cfg.baseName}},
+		&policyv1.PodDisruptionBudget{ObjectMeta: metav1.ObjectMeta{Name: runtimePoolChildName(cfg.baseName, "pdb")}},
+	)
+	for _, suffix := range []string{
+		"deny-all", "control-in", "dns-egress", "provider-proxy-egress", "controller-egress",
+		// Retain cleanup for policy names used by pre-cutover builds.
+		"control-plane-egress", "artifact-api-egress",
+	} {
+		objects = append(objects, &networkingv1.NetworkPolicy{ObjectMeta: metav1.ObjectMeta{Name: runtimePoolChildName(cfg.baseName, suffix)}})
+	}
+	for _, obj := range objects {
+		obj.SetNamespace(cfg.namespace)
+		if err := deleteObject(obj); err != nil {
+			return false, err
+		}
+	}
+	for _, list := range []client.ObjectList{&corev1.PodList{}, &corev1.SecretList{}, &appsv1.ReplicaSetList{}} {
+		if err := r.List(ctx, list, client.InNamespace(cfg.namespace), client.MatchingLabels{runtimePoolKeyLabel: cfg.labels[runtimePoolKeyLabel]}); err != nil {
+			return false, err
+		}
+		for _, obj := range objectsFromList(list) {
+			if err := r.Delete(ctx, obj, client.PropagationPolicy(metav1.DeletePropagationBackground)); err != nil && !apierrors.IsNotFound(err) {
+				return false, err
+			}
+		}
+		if len(objectsFromList(list)) > 0 {
+			remaining = true
+		}
+	}
+	return remaining, nil
+}
+
+func objectsFromList(list client.ObjectList) []client.Object {
+	switch typed := list.(type) {
+	case *corev1.PodList:
+		result := make([]client.Object, 0, len(typed.Items))
+		for i := range typed.Items {
+			result = append(result, &typed.Items[i])
+		}
+		return result
+	case *corev1.SecretList:
+		result := make([]client.Object, 0, len(typed.Items))
+		for i := range typed.Items {
+			result = append(result, &typed.Items[i])
+		}
+		return result
+	case *appsv1.ReplicaSetList:
+		result := make([]client.Object, 0, len(typed.Items))
+		for i := range typed.Items {
+			result = append(result, &typed.Items[i])
+		}
+		return result
+	default:
+		return nil
+	}
+}
+
+func (r *RuntimePoolReconciler) setRuntimePoolControllerReference(pool *corev1alpha1.RuntimePool, object client.Object) error {
+	if object.GetNamespace() != pool.Namespace {
+		// Namespaced ownerReferences cannot cross namespaces. The finalizer and
+		// immutable ownership labels provide explicit cross-namespace cleanup.
+		return nil
+	}
+	return controllerutil.SetControllerReference(pool, object, r.Scheme)
+}
+
+func (r *RuntimePoolReconciler) effectiveControllerEpoch(pool *corev1alpha1.RuntimePool) int64 {
+	if r.Epochs != nil {
+		if current, ok := r.Epochs.Current(); ok && current.Epoch > 0 {
+			return current.Epoch
+		}
+	}
+	if r.ControllerEpoch > 0 {
+		return r.ControllerEpoch
+	}
+	if pool.Status.ControllerEpoch > 0 {
+		return pool.Status.ControllerEpoch
+	}
+	return 1
+}
+
+func (r *RuntimePoolReconciler) supervisorClient() RuntimePoolSupervisorClient {
+	if r.SupervisorClient != nil {
+		return r.SupervisorClient
+	}
+	httpClient := r.HTTPClient
+	if httpClient == nil {
+		httpClient = &http.Client{Timeout: runtimePoolProbeTimeout}
+	}
+	isolatedClient := *httpClient
+	isolatedClient.CheckRedirect = func(_ *http.Request, _ []*http.Request) error { return http.ErrUseLastResponse }
+	return &runtimePoolHTTPSupervisorClient{client: &isolatedClient, now: r.now}
+}
+
+func (r *RuntimePoolReconciler) randomSecret(size int) (string, error) {
+	reader := r.Rand
+	if reader == nil {
+		reader = rand.Reader
+	}
+	data := make([]byte, size)
+	if _, err := io.ReadFull(reader, data); err != nil {
+		return "", err
+	}
+	return base64.RawURLEncoding.EncodeToString(data), nil
+}
+
+func (r *RuntimePoolReconciler) now() time.Time {
+	if r.Now != nil {
+		return r.Now().UTC()
+	}
+	return time.Now().UTC()
+}
+
+func runtimePoolResourceName(namespace, name string) string {
+	hash := sha256.Sum256([]byte(namespace + "\x00" + name))
+	suffix := hex.EncodeToString(hash[:5])
+	prefix := strings.Trim(strings.ToLower(name), "-")
+	if prefix == "" {
+		prefix = "runtime"
+	}
+	maxPrefix := 63 - len(suffix) - 1
+	if len(prefix) > maxPrefix {
+		prefix = strings.TrimRight(prefix[:maxPrefix], "-")
+	}
+	return prefix + "-" + suffix
+}
+
+func runtimePoolChildName(base, suffix string) string {
+	suffix = strings.Trim(suffix, "-")
+	maxBase := 63 - len(suffix) - 1
+	if maxBase < 1 {
+		hash := sha256.Sum256([]byte(suffix))
+		return "runtime-" + hex.EncodeToString(hash[:8])
+	}
+	if len(base) > maxBase {
+		base = strings.TrimRight(base[:maxBase], "-")
+	}
+	return base + "-" + suffix
+}
+
+func runtimePoolKey(namespace, name string) string {
+	hash := sha256.Sum256([]byte(namespace + "\x00" + name))
+	return hex.EncodeToString(hash[:16])
+}
+
+func runtimePoolRuntimeInstanceID(podUID types.UID, bootID harnessv2.SupervisorBootID) string {
+	return string(podUID) + "." + string(bootID)
+}
+
+func runtimePoolPodEndpoint(pod *corev1.Pod) string {
+	host := net.JoinHostPort(pod.Status.PodIP, strconv.Itoa(int(runtimePoolPort)))
+	return (&url.URL{Scheme: "http", Host: host}).String()
+}
+
+func runtimePoolDigestSchemaMatches(spec string, observed uint32) bool {
+	spec = strings.TrimSpace(strings.ToLower(spec))
+	return spec == strconv.FormatUint(uint64(observed), 10) || spec == "v"+strconv.FormatUint(uint64(observed), 10)
+}
+
+func runtimePoolHarnessProfile(spec corev1alpha1.RuntimePoolProfileSpec) (harnessv2.RuntimeProfile, error) {
+	var modelLimits *harnessv2.ModelTokenLimits
+	if spec.ModelLimits != nil {
+		modelLimits = &harnessv2.ModelTokenLimits{
+			Context: spec.ModelLimits.Context,
+			Output:  spec.ModelLimits.Output,
+		}
+	}
+	profile := harnessv2.RuntimeProfile{
+		ACPProfile:               strings.TrimSpace(spec.ACPProfile),
+		AdapterDigests:           cloneStringMap(spec.AdapterDigests),
+		ProviderKind:             strings.TrimSpace(spec.ProviderKind),
+		Model:                    strings.TrimSpace(spec.Model),
+		ModelLimits:              modelLimits,
+		AgentConfigurationDigest: strings.TrimSpace(spec.AgentConfigurationDigest),
+		ToolPolicyDigest:         strings.TrimSpace(spec.ToolPolicyDigest),
+		ApprovalPolicyDigest:     strings.TrimSpace(spec.ApprovalPolicyDigest),
+		MCPConfigurationDigest:   strings.TrimSpace(spec.MCPConfigurationDigest),
+		WorkspaceIntent:          harnessv2.WorkspaceIntent(spec.WorkspaceIntent),
+		ProxyCredentialRole:      strings.TrimSpace(spec.ProxyCredentialRole),
+		ProxyCredentialScope:     strings.TrimSpace(spec.ProxyCredentialScope),
+		ResourceClass:            strings.TrimSpace(spec.ResourceClass),
+	}
+	if err := profile.Validate(); err != nil {
+		return harnessv2.RuntimeProfile{}, fmt.Errorf("spec.runtime.profile is invalid: %w", err)
+	}
+	if profile.ProviderKind == runtimePoolProviderOpencode && profile.ModelLimits == nil {
+		return harnessv2.RuntimeProfile{}, fmt.Errorf("spec.runtime.profile.modelLimits is required for built-in OpenCode")
+	}
+	switch profile.ProviderKind {
+	case runtimePoolProviderCodex, runtimePoolProviderClaude, runtimePoolProviderCopilot, runtimePoolProviderOpencode:
+	default:
+		return harnessv2.RuntimeProfile{}, fmt.Errorf("spec.runtime.profile.providerKind %q is not a supported built-in provider", profile.ProviderKind)
+	}
+	if profile.ResourceClass != runtimePoolResourceClassStandard {
+		return harnessv2.RuntimeProfile{}, fmt.Errorf("spec.runtime.profile.resourceClass %q is not supported", profile.ResourceClass)
+	}
+	return profile, nil
+}
+
+func validSHA256Digest(value string) bool {
+	if !strings.HasPrefix(value, "sha256:") || len(value) != len("sha256:")+64 {
+		return false
+	}
+	_, err := hex.DecodeString(strings.TrimPrefix(value, "sha256:"))
+	return err == nil
+}
+
+func sanitizeRuntimePoolMessage(message string) string {
+	message = events.RedactExecutionEventText(strings.TrimSpace(message))
+	return truncateUTF8(strings.ToValidUTF8(message, "�"), 1024)
+}
+
+func sanitizeRuntimePoolReason(reason string) string {
+	reason = strings.TrimSpace(reason)
+	if reason == "" {
+		return "Reconciled"
+	}
+	var b strings.Builder
+	for i, r := range reason {
+		if (r >= 'A' && r <= 'Z') || (r >= 'a' && r <= 'z') || (i > 0 && r >= '0' && r <= '9') {
+			b.WriteRune(r)
+		}
+	}
+	if b.Len() == 0 {
+		return "Reconciled"
+	}
+	result := b.String()
+	if len(result) > 63 {
+		result = result[:63]
+	}
+	return result
+}
+
+func cloneStringMap(source map[string]string) map[string]string {
+	return maps.Clone(source)
+}
+
+func mergeStringMap(destination, source map[string]string) map[string]string {
+	if destination == nil {
+		destination = make(map[string]string, len(source))
+	}
+	maps.Copy(destination, source)
+	return destination
+}
+
+type runtimePoolHTTPSupervisorClient struct {
+	client *http.Client
+	now    func() time.Time
+}
+
+func (c *runtimePoolHTTPSupervisorClient) Probe(ctx context.Context, endpoint, bearerToken string) (RuntimePoolProbeResult, error) {
+	var result RuntimePoolProbeResult
+	if err := c.getJSON(ctx, endpoint+harnessv2.CapabilitiesPath, "", &result.Capabilities); err != nil {
+		return result, fmt.Errorf("get capabilities: %w", err)
+	}
+	if err := c.getJSON(ctx, endpoint+harnessv2.StatusPath, bearerToken, &result.Status); err != nil {
+		return result, fmt.Errorf("get status: %w", err)
+	}
+	return result, nil
+}
+
+func (c *runtimePoolHTTPSupervisorClient) RequestDrain(
+	ctx context.Context,
+	endpoint, bearerToken string,
+	capabilitySecret []byte,
+	status harnessv2.StatusResponse,
+	reason string,
+) error {
+	now := time.Now().UTC()
+	if c.now != nil {
+		now = c.now().UTC()
+	}
+	request := harnessv2.DrainRequest{
+		Protocol: harnessv2.ProtocolVersion,
+		Metadata: harnessv2.MutationMetadata{
+			Fence:                      status.Fence,
+			OperationID:                harnessv2.OperationID("runtime-pool-drain-" + strconv.FormatUint(status.Fence.RuntimePoolGeneration, 10)),
+			RequestDigestSchemaVersion: harnessv2.RequestDigestSchemaVersion,
+			ExpiresAt:                  now.Add(time.Minute),
+		},
+		Reason: reason,
+	}
+	digest, err := harnessv2.CanonicalRequestDigest(request)
+	if err != nil {
+		return err
+	}
+	request.Metadata.RequestDigest = digest
+	token, err := harnessv2.SignOperationCapability(capabilitySecret, harnessv2.ClaimsForMutation(request.Metadata))
+	if err != nil {
+		return err
+	}
+	payload, err := json.Marshal(request)
+	if err != nil {
+		return err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPut, endpoint+harnessv2.DrainPath, bytes.NewReader(payload))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+bearerToken)
+	req.Header.Set(runtimePoolOperationHeader, token)
+	response, err := c.client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = response.Body.Close() }()
+	if response.StatusCode < 200 || response.StatusCode >= 300 {
+		return fmt.Errorf("drain endpoint returned HTTP %d", response.StatusCode)
+	}
+	var drain harnessv2.DrainResponse
+	if err := decodeBoundedJSON(response.Body, &drain); err != nil {
+		return err
+	}
+	return drain.Validate()
+}
+
+func (c *runtimePoolHTTPSupervisorClient) getJSON(ctx context.Context, endpoint, bearerToken string, target any) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return err
+	}
+	if bearerToken != "" {
+		req.Header.Set("Authorization", "Bearer "+bearerToken)
+	}
+	response, err := c.client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = response.Body.Close() }()
+	if response.StatusCode < 200 || response.StatusCode >= 300 {
+		return fmt.Errorf("endpoint returned HTTP %d", response.StatusCode)
+	}
+	return decodeBoundedJSON(response.Body, target)
+}
+
+func decodeBoundedJSON(reader io.Reader, target any) error {
+	decoder := json.NewDecoder(io.LimitReader(reader, 2<<20))
+	if err := decoder.Decode(target); err != nil {
+		return err
+	}
+	if decoder.Decode(&struct{}{}) != io.EOF {
+		return fmt.Errorf("response contains trailing JSON data")
+	}
+	return nil
+}
+
+func runtimePoolRequestForChild(_ context.Context, object client.Object) []reconcile.Request {
+	labels := object.GetLabels()
+	namespace := strings.TrimSpace(labels[runtimePoolNamespaceLabel])
+	name := strings.TrimSpace(labels[runtimePoolNameLabel])
+	if namespace == "" || name == "" {
+		return nil
+	}
+	return []reconcile.Request{{NamespacedName: types.NamespacedName{Namespace: namespace, Name: name}}}
+}
+
+// SetupWithManager sets up watches for RuntimePools and their cross-namespace children.
+func (r *RuntimePoolReconciler) SetupWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewControllerManagedBy(mgr).
+		For(&corev1alpha1.RuntimePool{}).
+		Watches(&appsv1.Deployment{}, handler.EnqueueRequestsFromMapFunc(runtimePoolRequestForChild)).
+		Watches(&corev1.Pod{}, handler.EnqueueRequestsFromMapFunc(runtimePoolRequestForChild)).
+		Watches(&corev1.Service{}, handler.EnqueueRequestsFromMapFunc(runtimePoolRequestForChild)).
+		Watches(&corev1.Secret{}, handler.EnqueueRequestsFromMapFunc(runtimePoolRequestForChild)).
+		Watches(&networkingv1.NetworkPolicy{}, handler.EnqueueRequestsFromMapFunc(runtimePoolRequestForChild)).
+		Watches(&policyv1.PodDisruptionBudget{}, handler.EnqueueRequestsFromMapFunc(runtimePoolRequestForChild)).
+		Named("runtimepool").
+		Complete(r)
+}
diff --git a/internal/controller/runtime_pool_controller_test.go b/internal/controller/runtime_pool_controller_test.go
new file mode 100644
index 000000000..906d90041
--- /dev/null
+++ b/internal/controller/runtime_pool_controller_test.go
@@ -0,0 +1,1755 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package controller
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"os"
+	"sort"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	networkingv1 "k8s.io/api/networking/v1"
+	policyv1 "k8s.io/api/policy/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/utils/ptr"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+var (
+	runtimePoolTestNow               = time.Date(2026, 7, 24, 12, 0, 0, 0, time.UTC)
+	runtimePoolTestProviderToken     = []byte("0123456789abcdef0123456789abcdef")
+	runtimePoolTestProviderTokenNext = []byte("fedcba9876543210fedcba9876543210")
+)
+
+const runtimePoolTestNextModel = "gpt-next"
+
+type fakeRuntimePoolSupervisorClient struct {
+	probe       RuntimePoolProbeResult
+	probeErr    error
+	probeCalls  int
+	drainCalls  int
+	drainReason string
+	drainErr    error
+}
+
+type runtimePoolPodDeleteRecordingClient struct {
+	client.Client
+	podDeleteHadPreconditions bool
+	podDeleteUID              types.UID
+	podDeleteResourceVersion  string
+}
+
+type runtimePoolNamespaceReadClient struct {
+	client.Client
+	namespaceReads       int
+	rejectNamespaceReads bool
+}
+
+func (c *runtimePoolNamespaceReadClient) Get(
+	ctx context.Context,
+	key client.ObjectKey,
+	object client.Object,
+	options ...client.GetOption,
+) error {
+	if _, ok := object.(*corev1.Namespace); ok {
+		c.namespaceReads++
+		if c.rejectNamespaceReads {
+			return errors.New("cached Namespace reads are forbidden")
+		}
+	}
+	return c.Client.Get(ctx, key, object, options...)
+}
+
+func (c *runtimePoolPodDeleteRecordingClient) Delete(ctx context.Context, object client.Object, options ...client.DeleteOption) error {
+	if _, ok := object.(*corev1.Pod); ok {
+		deleteOptions := (&client.DeleteOptions{}).ApplyOptions(options)
+		if deleteOptions.Preconditions != nil {
+			c.podDeleteHadPreconditions = true
+			if deleteOptions.Preconditions.UID != nil {
+				c.podDeleteUID = *deleteOptions.Preconditions.UID
+			}
+			if deleteOptions.Preconditions.ResourceVersion != nil {
+				c.podDeleteResourceVersion = *deleteOptions.Preconditions.ResourceVersion
+			}
+		}
+	}
+	return c.Client.Delete(ctx, object, options...)
+}
+
+func (f *fakeRuntimePoolSupervisorClient) Probe(_ context.Context, _, _ string) (RuntimePoolProbeResult, error) {
+	f.probeCalls++
+	return f.probe, f.probeErr
+}
+
+func (f *fakeRuntimePoolSupervisorClient) RequestDrain(
+	_ context.Context,
+	_, _ string,
+	_ []byte,
+	_ harnessv2.StatusResponse,
+	reason string,
+) error {
+	f.drainCalls++
+	f.drainReason = reason
+	return f.drainErr
+}
+
+func TestRuntimePoolReconcilerScalesZeroToOneWithHardenedResources(t *testing.T) {
+	scheme := runtimePoolTestScheme(t)
+	pool := runtimePoolTestObject(1)
+	r := runtimePoolTestReconciler(t, scheme, nil, pool)
+	r.EnablePDB = true
+	r.ControllerAPIPort = 18080
+
+	runtimePoolReconcile(t, r, pool)
+
+	base := runtimePoolResourceName(pool.Namespace, pool.Name)
+	var deployment appsv1.Deployment
+	if err := r.Get(context.Background(), types.NamespacedName{Namespace: pool.Namespace, Name: base}, &deployment); err != nil {
+		t.Fatalf("Get Deployment: %v", err)
+	}
+	assertRuntimePoolDeploymentHardening(t, r, pool, &deployment)
+	assertRuntimePoolDiscoveryAndNetwork(t, r, pool, base)
+
+	gotPool := runtimePoolTestGetPool(t, r, pool)
+	if gotPool.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleStarting || gotPool.Status.AdmissionState != corev1alpha1.RuntimePoolAdmissionClosed {
+		t.Fatalf("status = %s/%s, want Starting/Closed", gotPool.Status.Lifecycle, gotPool.Status.AdmissionState)
+	}
+}
+
+func TestRuntimePoolReconcilerReadsRuntimeNamespaceUncached(t *testing.T) {
+	scheme := runtimePoolTestScheme(t)
+	runtimeNamespace := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "orka-runtimes"}}
+	cachedClient := &runtimePoolNamespaceReadClient{
+		Client:               fake.NewClientBuilder().WithScheme(scheme).Build(),
+		rejectNamespaceReads: true,
+	}
+	apiReader := &runtimePoolNamespaceReadClient{
+		Client: fake.NewClientBuilder().WithScheme(scheme).WithObjects(runtimeNamespace).Build(),
+	}
+	reconciler := &RuntimePoolReconciler{Client: cachedClient, APIReader: apiReader}
+
+	if err := reconciler.ensureRuntimePoolNamespace(context.Background(), runtimePoolConfig{namespace: runtimeNamespace.Name}); err != nil {
+		t.Fatalf("ensureRuntimePoolNamespace() error = %v", err)
+	}
+	if cachedClient.namespaceReads != 0 {
+		t.Fatalf("cached Namespace reads = %d, want 0", cachedClient.namespaceReads)
+	}
+	if apiReader.namespaceReads != 1 {
+		t.Fatalf("uncached Namespace reads = %d, want 1", apiReader.namespaceReads)
+	}
+}
+
+func assertRuntimePoolDeploymentHardening(t *testing.T, r *RuntimePoolReconciler, pool *corev1alpha1.RuntimePool, deployment *appsv1.Deployment) {
+	t.Helper()
+	assertRuntimePoolDeploymentShape(t, pool, deployment)
+
+	podSpec := deployment.Spec.Template.Spec
+	assertRuntimePoolPodHardening(t, podSpec)
+
+	container := podSpec.Containers[0]
+	assertRuntimePoolContainerHardening(t, container)
+	assertRuntimePoolBoundedVolumes(t, podSpec.Volumes)
+
+	if deployment.Spec.Template.Annotations[runtimePoolPIDsAnnotation] != "4096" {
+		t.Fatalf("PID limit annotation = %q, want 4096", deployment.Spec.Template.Annotations[runtimePoolPIDsAnnotation])
+	}
+	assertRuntimePoolEnvironment(t, r, pool, container.Env)
+}
+
+func assertRuntimePoolDeploymentShape(t *testing.T, pool *corev1alpha1.RuntimePool, deployment *appsv1.Deployment) {
+	t.Helper()
+	if got := ptr.Deref(deployment.Spec.Replicas, -1); got != 1 {
+		t.Fatalf("Deployment replicas = %d, want 1", got)
+	}
+	if deployment.Spec.Strategy.Type != appsv1.RecreateDeploymentStrategyType || deployment.Spec.Strategy.RollingUpdate != nil {
+		t.Fatalf("Deployment strategy = %#v, want Recreate without rolling update", deployment.Spec.Strategy)
+	}
+	if !metav1.IsControlledBy(deployment, pool) {
+		t.Fatal("same-namespace Deployment is not controller-owned by RuntimePool")
+	}
+}
+
+func assertRuntimePoolPodHardening(t *testing.T, podSpec corev1.PodSpec) {
+	t.Helper()
+	if podSpec.SecurityContext != nil && podSpec.SecurityContext.FSGroup != nil {
+		t.Fatalf("runtime Pod fsGroup exposes root-owned credential volumes to child GIDs: %d", *podSpec.SecurityContext.FSGroup)
+	}
+	if podSpec.AutomountServiceAccountToken == nil || *podSpec.AutomountServiceAccountToken {
+		t.Fatal("runtime Pod must disable service-account token automount")
+	}
+	if podSpec.EnableServiceLinks == nil || *podSpec.EnableServiceLinks {
+		t.Fatal("runtime Pod must disable service links")
+	}
+	if len(podSpec.Containers) != 1 {
+		t.Fatalf("container count = %d, want 1", len(podSpec.Containers))
+	}
+}
+
+func assertRuntimePoolContainerHardening(t *testing.T, container corev1.Container) {
+	t.Helper()
+	if container.SecurityContext == nil || container.SecurityContext.ReadOnlyRootFilesystem == nil || !*container.SecurityContext.ReadOnlyRootFilesystem {
+		t.Fatal("runtime supervisor root filesystem is not read-only")
+	}
+	if container.SecurityContext.AllowPrivilegeEscalation == nil || *container.SecurityContext.AllowPrivilegeEscalation {
+		t.Fatal("runtime supervisor allows privilege escalation")
+	}
+	if container.SecurityContext.Capabilities == nil || strings.Join(capabilityStrings(container.SecurityContext.Capabilities.Drop), ",") != "ALL" {
+		t.Fatalf("dropped capabilities = %#v, want ALL", container.SecurityContext.Capabilities)
+	}
+	if got := strings.Join(capabilityStrings(container.SecurityContext.Capabilities.Add), ","); got != "CHOWN,KILL,SETGID,SETUID" {
+		t.Fatalf("added capabilities = %q, want documented supervisor set", got)
+	}
+}
+
+func assertRuntimePoolBoundedVolumes(t *testing.T, volumes []corev1.Volume) {
+	t.Helper()
+	for _, volumeName := range []string{runtimePoolSessionsVolume, runtimePoolTempVolume, runtimePoolHomeVolume} {
+		volume := runtimePoolTestVolume(volumes, volumeName)
+		if volume == nil || volume.EmptyDir == nil || volume.EmptyDir.SizeLimit == nil || volume.EmptyDir.SizeLimit.IsZero() {
+			t.Fatalf("volume %q is not a bounded emptyDir", volumeName)
+		}
+	}
+}
+
+func assertRuntimePoolEnvironment(t *testing.T, r *RuntimePoolReconciler, pool *corev1alpha1.RuntimePool, envVars []corev1.EnvVar) {
+	t.Helper()
+	environment := make(map[string]string, len(envVars))
+	for _, env := range envVars {
+		if strings.Contains(env.Value, "token-") || strings.Contains(env.Value, "secret-") {
+			t.Fatalf("secret value was embedded in environment variable %s", env.Name)
+		}
+		environment[env.Name] = env.Value
+	}
+	modelContextLimit := ""
+	modelOutputLimit := ""
+	if pool.Spec.Runtime.Profile.ModelLimits != nil {
+		modelContextLimit = strconv.FormatInt(pool.Spec.Runtime.Profile.ModelLimits.Context, 10)
+		modelOutputLimit = strconv.FormatInt(pool.Spec.Runtime.Profile.ModelLimits.Output, 10)
+	}
+	for name, want := range map[string]string{
+		"ORKA_ACP_PROVIDER":                     pool.Spec.Runtime.Profile.ProviderKind,
+		"ORKA_ACP_MODEL":                        pool.Spec.Runtime.Profile.Model,
+		"ORKA_ACP_MODEL_CONTEXT_LIMIT":          modelContextLimit,
+		"ORKA_ACP_MODEL_OUTPUT_LIMIT":           modelOutputLimit,
+		"ORKA_ACP_WORKSPACE_INTENT":             string(pool.Spec.Runtime.Profile.WorkspaceIntent),
+		"ORKA_ACP_AGENT_CONFIGURATION_DIGEST":   pool.Spec.Runtime.Profile.AgentConfigurationDigest,
+		"ORKA_ACP_TOOL_POLICY_DIGEST":           pool.Spec.Runtime.Profile.ToolPolicyDigest,
+		"ORKA_ACP_APPROVAL_POLICY_DIGEST":       pool.Spec.Runtime.Profile.ApprovalPolicyDigest,
+		"ORKA_ACP_MCP_CONFIGURATION_DIGEST":     pool.Spec.Runtime.Profile.MCPConfigurationDigest,
+		"ORKA_ACP_PROXY_CREDENTIAL_ROLE":        pool.Spec.Runtime.Profile.ProxyCredentialRole,
+		"ORKA_ACP_PROXY_CREDENTIAL_SCOPE":       pool.Spec.Runtime.Profile.ProxyCredentialScope,
+		"ORKA_ACP_PROVIDER_PROXY_BASE_URL":      r.ProviderProxy.BaseURL,
+		"ORKA_ACP_PROVIDER_TOKEN_FILE":          runtimePoolProviderTokenPath,
+		"ORKA_ACP_WORKSPACE_MAX_ARTIFACT_BYTES": strconv.FormatInt(r.WorkspaceArtifactMaxBytes, 10),
+	} {
+		if environment[name] != want {
+			t.Fatalf("environment %s = %q, want %q", name, environment[name], want)
+		}
+	}
+}
+
+//nolint:gocyclo // The explicit state-machine branches are easier to audit together.
+func assertRuntimePoolDiscoveryAndNetwork(t *testing.T, r *RuntimePoolReconciler, pool *corev1alpha1.RuntimePool, base string) {
+	t.Helper()
+	var service corev1.Service
+	if err := r.Get(context.Background(), types.NamespacedName{Namespace: pool.Namespace, Name: base}, &service); err != nil {
+		t.Fatalf("Get Service: %v", err)
+	}
+	if service.Spec.ClusterIP != corev1.ClusterIPNone || !reflectStringMapEqual(service.Spec.Selector, map[string]string{runtimePoolKeyLabel: runtimePoolKey(pool.Namespace, pool.Name)}) {
+		t.Fatalf("Service is not headless exact-pool discovery: %#v", service.Spec)
+	}
+	var authSecrets corev1.SecretList
+	if err := r.List(context.Background(), &authSecrets, client.InNamespace(pool.Namespace), client.MatchingLabels{
+		runtimePoolUIDLabel: string(pool.UID), runtimePoolAuthLabel: "true",
+	}); err != nil {
+		t.Fatalf("List pool auth Secrets: %v", err)
+	}
+	if len(authSecrets.Items) != 1 {
+		t.Fatalf("pool auth Secret count = %d, want 1", len(authSecrets.Items))
+	}
+	authData := authSecrets.Items[0].Data
+	if len(authData[runtimePoolControllerTokenKey]) == 0 || len(authData[runtimePoolCapabilitySecretKey]) == 0 {
+		t.Fatalf("pool auth Secret keys = %v, want %q and %q", secretDataKeys(authData), runtimePoolControllerTokenKey, runtimePoolCapabilitySecretKey)
+	}
+	if _, legacy := authData["token"]; legacy {
+		t.Fatal("pool auth Secret contains legacy token key")
+	}
+	if _, legacy := authData["secret"]; legacy {
+		t.Fatal("pool auth Secret contains legacy secret key")
+	}
+	var poolSecrets corev1.SecretList
+	if err := r.List(context.Background(), &poolSecrets, client.InNamespace(pool.Namespace), client.MatchingLabels{
+		runtimePoolUIDLabel: string(pool.UID),
+	}); err != nil {
+		t.Fatalf("List pool Secrets: %v", err)
+	}
+	providerSecretCount := 0
+	for i := range poolSecrets.Items {
+		providerToken, exists := poolSecrets.Items[i].Data[runtimePoolProviderTokenKey]
+		if !exists {
+			continue
+		}
+		providerSecretCount++
+		if !bytes.Equal(providerToken, runtimePoolTestProviderToken) {
+			t.Fatal("RuntimePool provider Secret did not copy the configured authenticated proxy token exactly")
+		}
+	}
+	if providerSecretCount != 1 {
+		t.Fatalf("provider Secret count = %d, want 1", providerSecretCount)
+	}
+
+	var policies networkingv1.NetworkPolicyList
+	if err := r.List(context.Background(), &policies, client.InNamespace(pool.Namespace), client.MatchingLabels{runtimePoolKeyLabel: runtimePoolKey(pool.Namespace, pool.Name)}); err != nil {
+		t.Fatalf("List NetworkPolicies: %v", err)
+	}
+	if len(policies.Items) != 5 {
+		t.Fatalf("NetworkPolicy count = %d, want 5", len(policies.Items))
+	}
+	for i := range policies.Items {
+		if strings.Contains(policies.Items[i].Name, "scm") {
+			t.Fatalf("runtime pool unexpectedly has SCM egress policy %q", policies.Items[i].Name)
+		}
+	}
+	var providerPolicy networkingv1.NetworkPolicy
+	if err := r.Get(context.Background(), types.NamespacedName{
+		Namespace: pool.Namespace, Name: runtimePoolChildName(base, "provider-proxy-egress"),
+	}, &providerPolicy); err != nil {
+		t.Fatalf("Get provider proxy egress policy: %v", err)
+	}
+	if len(providerPolicy.Spec.Egress) != 1 || len(providerPolicy.Spec.Egress[0].To) != 1 || len(providerPolicy.Spec.Egress[0].Ports) != 1 {
+		t.Fatalf("provider proxy egress policy = %#v", providerPolicy.Spec.Egress)
+	}
+	peer := providerPolicy.Spec.Egress[0].To[0]
+	if peer.NamespaceSelector == nil || peer.NamespaceSelector.MatchLabels[corev1.LabelMetadataName] != r.ProviderProxy.Namespace {
+		t.Fatalf("provider proxy namespace selector = %#v", peer.NamespaceSelector)
+	}
+	if peer.PodSelector == nil || !reflectStringMapEqual(peer.PodSelector.MatchLabels, r.ProviderProxy.PodLabels) {
+		t.Fatalf("provider proxy Pod selector = %#v, want %#v", peer.PodSelector, r.ProviderProxy.PodLabels)
+	}
+	if port := providerPolicy.Spec.Egress[0].Ports[0].Port; port == nil || port.IntVal != 8080 {
+		t.Fatalf("provider proxy egress port = %#v, want 8080", port)
+	}
+	var controlPolicy networkingv1.NetworkPolicy
+	if err := r.Get(context.Background(), types.NamespacedName{
+		Namespace: pool.Namespace, Name: runtimePoolChildName(base, "control-in"),
+	}, &controlPolicy); err != nil {
+		t.Fatalf("Get control ingress policy: %v", err)
+	}
+	if len(controlPolicy.Spec.Ingress) != 1 || len(controlPolicy.Spec.Ingress[0].From) != 1 {
+		t.Fatalf("control ingress policy = %#v", controlPolicy.Spec.Ingress)
+	}
+	controlPeer := controlPolicy.Spec.Ingress[0].From[0]
+	if controlPeer.PodSelector == nil || controlPeer.PodSelector.MatchLabels[runtimePoolNetworkRoleLabel] != "controller" {
+		t.Fatalf("control ingress Pod selector = %#v, want stable controller network role", controlPeer.PodSelector)
+	}
+	var controllerPolicy networkingv1.NetworkPolicy
+	if err := r.Get(context.Background(), types.NamespacedName{
+		Namespace: pool.Namespace, Name: runtimePoolChildName(base, "controller-egress"),
+	}, &controllerPolicy); err != nil {
+		t.Fatalf("Get controller egress policy: %v", err)
+	}
+	if len(controllerPolicy.Spec.Egress) != 1 || len(controllerPolicy.Spec.Egress[0].Ports) != 1 {
+		t.Fatalf("controller egress policy = %#v", controllerPolicy.Spec.Egress)
+	}
+	if len(controllerPolicy.Spec.Egress[0].To) != 1 || controllerPolicy.Spec.Egress[0].To[0].PodSelector == nil ||
+		controllerPolicy.Spec.Egress[0].To[0].PodSelector.MatchLabels[runtimePoolNetworkRoleLabel] != "controller" {
+		t.Fatalf("controller egress Pod selector = %#v, want stable controller network role", controllerPolicy.Spec.Egress[0].To)
+	}
+	if port := controllerPolicy.Spec.Egress[0].Ports[0].Port; port == nil || port.IntVal != r.ControllerAPIPort {
+		t.Fatalf("controller egress port = %#v, want %d", port, r.ControllerAPIPort)
+	}
+	var pdb policyv1.PodDisruptionBudget
+	if err := r.Get(context.Background(), types.NamespacedName{Namespace: pool.Namespace, Name: runtimePoolChildName(base, "pdb")}, &pdb); err != nil {
+		t.Fatalf("Get PDB: %v", err)
+	}
+	if pdb.Spec.MaxUnavailable == nil || pdb.Spec.MaxUnavailable.IntValue() != 0 {
+		t.Fatalf("PDB maxUnavailable = %#v, want 0", pdb.Spec.MaxUnavailable)
+	}
+}
+
+func TestRuntimePoolReconcilerRotatesProviderTokenOnlyAfterAuthenticatedDrain(t *testing.T) {
+	scheme := runtimePoolTestScheme(t)
+	pool := runtimePoolTestObject(1)
+	supervisor := &fakeRuntimePoolSupervisorClient{}
+	r := runtimePoolTestReconciler(t, scheme, supervisor, pool)
+	tokenPath := runtimePoolTestTokenFile(t, runtimePoolTestProviderToken)
+	r.ProviderProxy.BearerToken = nil
+	r.ProviderProxy.BearerTokenFile = tokenPath
+
+	oldDeployment, oldPod := runtimePoolTestStartServing(t, r, pool, supervisor, "old-pod", "old-pod-uid", "10.0.0.61", "old-boot")
+	oldGeneration := runtimePoolProviderTokenGeneration(runtimePoolTestProviderToken)
+	oldRevision := oldDeployment.Spec.Template.Annotations[runtimePoolTemplateRevisionAnnotation]
+	if active := runtimePoolTestGetPool(t, r, pool).Status.ActiveInstance; active == nil || active.ProviderTokenGeneration != oldGeneration {
+		t.Fatalf("old active provider generation = %#v, want %q", active, oldGeneration)
+	}
+
+	runtimePoolTestWriteTokenFile(t, tokenPath, runtimePoolTestProviderTokenNext)
+	runtimePoolReconcile(t, r, pool)
+	newGeneration := runtimePoolProviderTokenGeneration(runtimePoolTestProviderTokenNext)
+	deployment := runtimePoolTestDeployment(t, r, pool.Namespace, oldDeployment.Name)
+	if got := deployment.Spec.Template.Annotations[runtimePoolProviderTokenGenerationAnnotation]; got != oldGeneration {
+		t.Fatalf("live Deployment provider generation changed before drain = %q, want %q", got, oldGeneration)
+	}
+	if got := deployment.Spec.Template.Annotations[runtimePoolTemplateRevisionAnnotation]; got != oldRevision {
+		t.Fatalf("live Deployment revision changed before drain = %q, want %q", got, oldRevision)
+	}
+	if got := ptr.Deref(deployment.Spec.Replicas, -1); got != 1 {
+		t.Fatalf("live Deployment replicas during drain = %d, want 1", got)
+	}
+	if supervisor.drainCalls != 1 {
+		t.Fatalf("drain calls after token rotation = %d, want 1", supervisor.drainCalls)
+	}
+	status := runtimePoolTestGetPool(t, r, pool).Status
+	if status.Lifecycle != corev1alpha1.RuntimePoolLifecycleDraining || status.AdmissionState != corev1alpha1.RuntimePoolAdmissionDraining {
+		t.Fatalf("rotation status = %s/%s, want Draining/Draining", status.Lifecycle, status.AdmissionState)
+	}
+	if status.ActiveInstance == nil || status.ActiveInstance.ProviderTokenGeneration != oldGeneration {
+		t.Fatalf("active provider generation during drain = %#v, want old generation %q", status.ActiveInstance, oldGeneration)
+	}
+	assertRuntimePoolProviderSecret(t, r, pool, newGeneration, runtimePoolTestProviderTokenNext)
+
+	supervisor.probe = runtimePoolValidProbe(pool, &oldPod, "old-boot", true)
+	runtimePoolReconcile(t, r, pool)
+	if got := runtimePoolTestGetPool(t, r, pool).Status.Lifecycle; got != corev1alpha1.RuntimePoolLifecycleQuiescent {
+		t.Fatalf("lifecycle after authenticated quiescence = %s, want Quiescent", got)
+	}
+	runtimePoolReconcile(t, r, pool)
+	deployment = runtimePoolTestDeployment(t, r, pool.Namespace, oldDeployment.Name)
+	if got := ptr.Deref(deployment.Spec.Replicas, -1); got != 0 {
+		t.Fatalf("replicas after persisted quiescence = %d, want 0", got)
+	}
+	if got := deployment.Spec.Template.Annotations[runtimePoolProviderTokenGenerationAnnotation]; got != oldGeneration {
+		t.Fatalf("template changed before old Pod termination = %q, want %q", got, oldGeneration)
+	}
+	if err := r.Delete(context.Background(), &oldPod); err != nil {
+		t.Fatalf("delete old Pod: %v", err)
+	}
+	runtimePoolReconcile(t, r, pool)
+	deployment = runtimePoolTestDeployment(t, r, pool.Namespace, oldDeployment.Name)
+	if got := deployment.Spec.Template.Annotations[runtimePoolProviderTokenGenerationAnnotation]; got != newGeneration {
+		t.Fatalf("replacement Deployment provider generation = %q, want %q", got, newGeneration)
+	}
+	if got := deployment.Spec.Template.Annotations[runtimePoolTemplateRevisionAnnotation]; got == oldRevision {
+		t.Fatalf("replacement Deployment retained old revision %q", got)
+	}
+	if got := ptr.Deref(deployment.Spec.Replicas, -1); got != 1 {
+		t.Fatalf("replacement Deployment replicas = %d, want 1", got)
+	}
+
+	newPod := runtimePoolReadyPodForDeployment(pool, deployment, "new-pod", "new-pod-uid", "10.0.0.62")
+	runtimePoolTestCreatePod(t, r, &newPod)
+	supervisor.probe = runtimePoolValidProbe(pool, &newPod, "new-boot", false)
+	runtimePoolReconcile(t, r, pool)
+	status = runtimePoolTestGetPool(t, r, pool).Status
+	if status.Lifecycle != corev1alpha1.RuntimePoolLifecycleServing || status.AdmissionState != corev1alpha1.RuntimePoolAdmissionAccepting {
+		t.Fatalf("converged status = %s/%s, want Serving/Accepting", status.Lifecycle, status.AdmissionState)
+	}
+	if status.ActiveInstance == nil || status.ActiveInstance.PodUID != string(newPod.UID) || status.ActiveInstance.ProviderTokenGeneration != newGeneration {
+		t.Fatalf("converged active instance = %#v, want new Pod and generation %q", status.ActiveInstance, newGeneration)
+	}
+}
+
+func TestRuntimePoolReconcilerPrunesStaleEpochSecretsAfterAuthenticatedRollout(t *testing.T) {
+	scheme := runtimePoolTestScheme(t)
+	pool := runtimePoolTestObject(1)
+	supervisor := &fakeRuntimePoolSupervisorClient{}
+	r := runtimePoolTestReconciler(t, scheme, supervisor, pool)
+
+	oldDeployment, oldPod := runtimePoolTestStartServing(t, r, pool, supervisor, "epoch-old-pod", "epoch-old-uid", "10.0.0.63", "epoch-old-boot")
+	oldAuthName := runtimePoolTestVolume(oldDeployment.Spec.Template.Spec.Volumes, "pool-auth").Secret.SecretName
+	oldProviderName := runtimePoolTestVolume(oldDeployment.Spec.Template.Spec.Volumes, "provider-capability").Secret.SecretName
+	oldAuth := &corev1.Secret{}
+	if err := r.Get(context.Background(), types.NamespacedName{Namespace: pool.Namespace, Name: oldAuthName}, oldAuth); err != nil {
+		t.Fatalf("get old epoch auth Secret: %v", err)
+	}
+	unrelated := oldAuth.DeepCopy()
+	unrelated.ObjectMeta = metav1.ObjectMeta{Name: "user-managed-auth", Namespace: pool.Namespace, Labels: cloneStringMap(oldAuth.Labels)}
+	if err := r.Create(context.Background(), unrelated); err != nil {
+		t.Fatalf("create unrelated labeled Secret: %v", err)
+	}
+	replicas := int32(1)
+	oldReplicaSet := &appsv1.ReplicaSet{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "epoch-old-rs", Namespace: pool.Namespace, Generation: 1, Labels: cloneStringMap(oldDeployment.Spec.Template.Labels),
+		},
+		Spec: appsv1.ReplicaSetSpec{
+			Replicas: &replicas, Selector: oldDeployment.Spec.Selector.DeepCopy(), Template: *oldDeployment.Spec.Template.DeepCopy(),
+		},
+		Status: appsv1.ReplicaSetStatus{ObservedGeneration: 1, Replicas: 1, FullyLabeledReplicas: 1, ReadyReplicas: 1, AvailableReplicas: 1},
+	}
+	for i := range oldReplicaSet.Spec.Template.Spec.Volumes {
+		volume := &oldReplicaSet.Spec.Template.Spec.Volumes[i]
+		switch volume.Name {
+		case "pool-auth":
+			volume.Secret = nil
+			volume.Projected = &corev1.ProjectedVolumeSource{Sources: []corev1.VolumeProjection{{
+				Secret: &corev1.SecretProjection{LocalObjectReference: corev1.LocalObjectReference{Name: oldAuthName}},
+			}}}
+		case "provider-capability":
+			volume.Secret = nil
+		}
+	}
+	oldReplicaSet.Spec.Template.Spec.Containers[0].EnvFrom = append(
+		oldReplicaSet.Spec.Template.Spec.Containers[0].EnvFrom,
+		corev1.EnvFromSource{SecretRef: &corev1.SecretEnvSource{LocalObjectReference: corev1.LocalObjectReference{Name: oldProviderName}}},
+	)
+	oldReplicaSet.Spec.Template.Spec.Volumes = append(oldReplicaSet.Spec.Template.Spec.Volumes, corev1.Volume{
+		Name: "csi-provider", VolumeSource: corev1.VolumeSource{CSI: &corev1.CSIVolumeSource{
+			Driver: "test.csi.orka.ai", NodePublishSecretRef: &corev1.LocalObjectReference{Name: oldProviderName},
+		}},
+	})
+	if err := r.Create(context.Background(), oldReplicaSet); err != nil {
+		t.Fatalf("create old epoch ReplicaSet: %v", err)
+	}
+
+	r.ControllerEpoch = 8
+	runtimePoolReconcile(t, r, pool)
+	runtimePoolTestAssertSecretsExist(t, r, pool.Namespace, "before authenticated drain", oldAuthName, oldProviderName, unrelated.Name)
+	if supervisor.drainCalls != 1 {
+		t.Fatalf("drain calls after controller epoch rotation = %d, want 1", supervisor.drainCalls)
+	}
+
+	supervisor.probe = runtimePoolValidProbe(pool, &oldPod, "epoch-old-boot", true)
+	runtimePoolReconcile(t, r, pool)
+	runtimePoolReconcile(t, r, pool)
+	deployment := runtimePoolTestDeployment(t, r, pool.Namespace, oldDeployment.Name)
+	if got := ptr.Deref(deployment.Spec.Replicas, -1); got != 0 {
+		t.Fatalf("replicas after epoch-rotation drain = %d, want 0", got)
+	}
+	runtimePoolTestAssertSecretsExist(t, r, pool.Namespace, "while the old Pod was live", oldAuthName, oldProviderName, unrelated.Name)
+	if err := r.Delete(context.Background(), &oldPod); err != nil {
+		t.Fatalf("delete old epoch Pod: %v", err)
+	}
+	runtimePoolReconcile(t, r, pool)
+	deployment = runtimePoolTestDeployment(t, r, pool.Namespace, oldDeployment.Name)
+	environment := runtimePoolLiteralEnvironment(deployment.Spec.Template.Spec.Containers[0].Env)
+	if got := environment["ORKA_ACP_CONTROLLER_EPOCH"]; got != "8" {
+		t.Fatalf("replacement Deployment controller epoch = %q, want 8", got)
+	}
+
+	// The old ReplicaSet remains able to create Pods after the old Pod has gone,
+	// so its projected/envFrom Secret references must retain the old credentials.
+	runtimePoolReconcile(t, r, pool)
+	runtimePoolTestAssertSecretsExist(t, r, pool.Namespace, "while an old ReplicaSet could create Pods", oldAuthName, oldProviderName)
+	currentReplicaSet := &appsv1.ReplicaSet{}
+	if err := r.Get(context.Background(), types.NamespacedName{Namespace: pool.Namespace, Name: oldReplicaSet.Name}, currentReplicaSet); err != nil {
+		t.Fatalf("get old epoch ReplicaSet for scale-down: %v", err)
+	}
+	currentReplicaSet.Generation = 2
+	currentReplicaSet.Spec.Replicas = new(int32(0))
+	currentReplicaSet.Status = appsv1.ReplicaSetStatus{ObservedGeneration: 1}
+	if err := r.Update(context.Background(), currentReplicaSet); err != nil {
+		t.Fatalf("scale old epoch ReplicaSet to zero: %v", err)
+	}
+	runtimePoolReconcile(t, r, pool)
+	runtimePoolTestAssertSecretsExist(t, r, pool.Namespace, "before ReplicaSet scale-down was observed", oldAuthName, oldProviderName)
+	if err := r.Get(context.Background(), types.NamespacedName{Namespace: pool.Namespace, Name: oldReplicaSet.Name}, currentReplicaSet); err != nil {
+		t.Fatalf("get old epoch ReplicaSet after unobserved scale-down: %v", err)
+	}
+	if got := ptr.Deref(currentReplicaSet.Spec.Replicas, -1); got != 0 || currentReplicaSet.Status.ObservedGeneration >= currentReplicaSet.Generation {
+		t.Fatalf("ReplicaSet scale-down state = replicas %d observed/generation %d/%d, want zero and unobserved", got, currentReplicaSet.Status.ObservedGeneration, currentReplicaSet.Generation)
+	}
+	if err := r.Delete(context.Background(), currentReplicaSet); err != nil {
+		t.Fatalf("delete fully stopped old epoch ReplicaSet: %v", err)
+	}
+	currentDeployment := runtimePoolTestDeployment(t, r, pool.Namespace, oldDeployment.Name)
+	currentDeployment.Generation = 2
+	if err := r.Update(context.Background(), currentDeployment); err != nil {
+		t.Fatalf("advance Deployment generation before observation: %v", err)
+	}
+	if err := r.Get(context.Background(), types.NamespacedName{Namespace: pool.Namespace, Name: oldDeployment.Name}, currentDeployment); err != nil {
+		t.Fatalf("get unobserved Deployment generation: %v", err)
+	}
+	currentDeployment.Status.ObservedGeneration = currentDeployment.Generation - 1
+	if err := r.Status().Update(context.Background(), currentDeployment); err != nil {
+		t.Fatalf("set unobserved Deployment status: %v", err)
+	}
+	runtimePoolReconcile(t, r, pool)
+	runtimePoolTestAssertSecretsExist(t, r, pool.Namespace, "before Deployment generation was observed", oldAuthName, oldProviderName)
+	if err := r.Get(context.Background(), types.NamespacedName{Namespace: pool.Namespace, Name: oldDeployment.Name}, currentDeployment); err != nil {
+		t.Fatalf("get Deployment for observation: %v", err)
+	}
+	currentDeployment.Status.ObservedGeneration = currentDeployment.Generation
+	if err := r.Status().Update(context.Background(), currentDeployment); err != nil {
+		t.Fatalf("observe current Deployment generation: %v", err)
+	}
+	// A follow-up reconcile observes no live workload reference and may safely
+	// remove the old immutable credentials.
+	runtimePoolReconcile(t, r, pool)
+	var secrets corev1.SecretList
+	if err := r.List(context.Background(), &secrets, client.InNamespace(pool.Namespace), client.MatchingLabels{
+		runtimePoolUIDLabel: string(pool.UID),
+	}); err != nil {
+		t.Fatalf("list RuntimePool Secrets after epoch rotation: %v", err)
+	}
+	if len(secrets.Items) != 3 {
+		names := make([]string, 0, len(secrets.Items))
+		for i := range secrets.Items {
+			names = append(names, secrets.Items[i].Name)
+		}
+		sort.Strings(names)
+		t.Fatalf("RuntimePool Secret count after epoch rotation = %d, want 2 current Secrets plus unrelated Secret: %v", len(secrets.Items), names)
+	}
+	for i := range secrets.Items {
+		secret := &secrets.Items[i]
+		if secret.Name == unrelated.Name {
+			continue
+		}
+		if !strings.Contains(secret.Name, "-e8") {
+			t.Fatalf("stale RuntimePool Secret survived epoch rotation: %s", secret.Name)
+		}
+	}
+}
+
+func TestRuntimePoolReconcilerDrainsGenericProfileRolloutBeforeTemplateChange(t *testing.T) {
+	scheme := runtimePoolTestScheme(t)
+	pool := runtimePoolTestObject(1)
+	supervisor := &fakeRuntimePoolSupervisorClient{}
+	r := runtimePoolTestReconciler(t, scheme, supervisor, pool)
+	oldDeployment, oldPod := runtimePoolTestStartServing(t, r, pool, supervisor, "profile-old-pod", "profile-old-uid", "10.0.0.71", "profile-old-boot")
+	oldDigest := pool.Spec.Runtime.Profile.Digest
+	oldRevision := oldDeployment.Spec.Template.Annotations[runtimePoolTemplateRevisionAnnotation]
+
+	current := runtimePoolTestGetPool(t, r, pool)
+	current.Spec.Runtime.Profile.Model = runtimePoolTestNextModel
+	current.Spec.Runtime.Profile.ProxyCredentialScope = "model:" + runtimePoolTestNextModel
+	current.Generation++
+	runtimePoolTestRefreshProfileDigest(t, &current)
+	newDigest := current.Spec.Runtime.Profile.Digest
+	if err := r.Update(context.Background(), &current); err != nil {
+		t.Fatalf("update RuntimePool profile: %v", err)
+	}
+
+	supervisor.probe = runtimePoolValidProbe(pool, &oldPod, "profile-old-boot", false)
+	runtimePoolReconcile(t, r, pool)
+	deployment := runtimePoolTestDeployment(t, r, pool.Namespace, oldDeployment.Name)
+	oldEnvironment := runtimePoolLiteralEnvironment(deployment.Spec.Template.Spec.Containers[0].Env)
+	if oldEnvironment["ORKA_ACP_MODEL"] != acpTestModel || oldEnvironment["ORKA_ACP_RUNTIME_PROFILE_DIGEST"] != oldDigest {
+		t.Fatalf("live template changed before profile drain: %#v", oldEnvironment)
+	}
+	if deployment.Spec.Template.Annotations[runtimePoolTemplateRevisionAnnotation] != oldRevision {
+		t.Fatal("live profile template revision changed before drain")
+	}
+	if supervisor.drainCalls != 1 {
+		t.Fatalf("profile rollout drain calls = %d, want 1", supervisor.drainCalls)
+	}
+
+	supervisor.probe = runtimePoolValidProbe(pool, &oldPod, "profile-old-boot", true)
+	runtimePoolReconcile(t, r, pool)
+	runtimePoolReconcile(t, r, pool)
+	if err := r.Delete(context.Background(), &oldPod); err != nil {
+		t.Fatalf("delete old profile Pod: %v", err)
+	}
+	runtimePoolReconcile(t, r, pool)
+	deployment = runtimePoolTestDeployment(t, r, pool.Namespace, oldDeployment.Name)
+	newEnvironment := runtimePoolLiteralEnvironment(deployment.Spec.Template.Spec.Containers[0].Env)
+	if newEnvironment["ORKA_ACP_MODEL"] != runtimePoolTestNextModel || newEnvironment["ORKA_ACP_RUNTIME_PROFILE_DIGEST"] != newDigest {
+		t.Fatalf("replacement profile environment = %#v", newEnvironment)
+	}
+	if newEnvironment["ORKA_ACP_RUNTIME_POOL_GENERATION"] != "2" {
+		t.Fatalf("replacement RuntimePool generation = %q, want 2", newEnvironment["ORKA_ACP_RUNTIME_POOL_GENERATION"])
+	}
+	if deployment.Spec.Template.Annotations[runtimePoolTemplateRevisionAnnotation] == oldRevision {
+		t.Fatal("profile rollout did not produce a new Pod template revision")
+	}
+}
+
+func TestRuntimePoolReconcilerRolloutAllowsLegacySupervisorWithoutIdentityCapacity(t *testing.T) {
+	scheme := runtimePoolTestScheme(t)
+	pool := runtimePoolTestObject(1)
+	supervisor := &fakeRuntimePoolSupervisorClient{}
+	r := runtimePoolTestReconciler(t, scheme, supervisor, pool)
+	_, oldPod := runtimePoolTestStartServing(t, r, pool, supervisor, "legacy-old-pod", "legacy-old-uid", "10.0.0.72", "legacy-old-boot")
+
+	current := runtimePoolTestGetPool(t, r, pool)
+	current.Spec.Runtime.Profile.Model = runtimePoolTestNextModel
+	current.Spec.Runtime.Profile.ProxyCredentialScope = "model:" + runtimePoolTestNextModel
+	current.Generation++
+	runtimePoolTestRefreshProfileDigest(t, &current)
+	if err := r.Update(context.Background(), &current); err != nil {
+		t.Fatalf("update RuntimePool profile: %v", err)
+	}
+
+	legacyProbe := runtimePoolValidProbe(pool, &oldPod, "legacy-old-boot", false)
+	legacyProbe.Status.SessionIdentityCapacity = nil
+	supervisor.probe = legacyProbe
+	runtimePoolReconcile(t, r, pool)
+	status := runtimePoolTestGetPool(t, r, pool).Status
+	if supervisor.drainCalls != 1 {
+		t.Fatalf("legacy rollout drain calls = %d, want 1", supervisor.drainCalls)
+	}
+	if status.Lifecycle != corev1alpha1.RuntimePoolLifecycleDraining || status.AdmissionState != corev1alpha1.RuntimePoolAdmissionDraining {
+		t.Fatalf("legacy rollout status = %s/%s, want Draining/Draining", status.Lifecycle, status.AdmissionState)
+	}
+
+	legacyDrainingProbe := runtimePoolValidProbe(pool, &oldPod, "legacy-old-boot", true)
+	legacyDrainingProbe.Status.SessionIdentityCapacity = nil
+	supervisor.probe = legacyDrainingProbe
+	runtimePoolReconcile(t, r, pool)
+	if got := runtimePoolTestGetPool(t, r, pool).Status.Lifecycle; got != corev1alpha1.RuntimePoolLifecycleQuiescent {
+		t.Fatalf("legacy rollout lifecycle after authenticated quiescence = %s, want Quiescent", got)
+	}
+}
+
+func TestRuntimePoolReconcilerRolloutWaitsForReservationsButNotQueuedDemand(t *testing.T) {
+	scheme := runtimePoolTestScheme(t)
+	pool := runtimePoolTestObject(1)
+	supervisor := &fakeRuntimePoolSupervisorClient{}
+	r := runtimePoolTestReconciler(t, scheme, supervisor, pool)
+	deployment, pod := runtimePoolTestStartServing(t, r, pool, supervisor, "demand-pod", "demand-pod-uid", "10.0.0.81", "demand-boot")
+
+	r.ProviderProxy.BearerToken = bytes.Clone(runtimePoolTestProviderTokenNext)
+	runtimePoolReconcile(t, r, pool)
+	supervisor.probe = runtimePoolValidProbe(pool, &pod, "demand-boot", true)
+	current := runtimePoolTestGetPool(t, r, pool)
+	current.Status.Capacity.QueuedTasks = 3
+	current.Status.Capacity.ReservedPrompts = 1
+	current.Status.Capacity.Reservations = []corev1alpha1.RuntimePoolCapacityReservationStatus{{
+		PoolUID: string(pool.UID), TaskUID: "queued-task", Attempt: 1, ControllerEpoch: 7,
+		RuntimeInstanceID: "demand-pod-uid.demand-boot", PromptSlots: 1,
+		ReservedAt: metav1.NewTime(runtimePoolTestNow), ExpiresAt: metav1.NewTime(runtimePoolTestNow.Add(time.Minute)),
+	}}
+	if err := r.Status().Update(context.Background(), &current); err != nil {
+		t.Fatalf("add rollout reservation: %v", err)
+	}
+	runtimePoolReconcile(t, r, pool)
+	if got := runtimePoolTestGetPool(t, r, pool).Status.Lifecycle; got != corev1alpha1.RuntimePoolLifecycleDraining {
+		t.Fatalf("lifecycle with reservation = %s, want Draining", got)
+	}
+	if got := ptr.Deref(runtimePoolTestDeployment(t, r, pool.Namespace, deployment.Name).Spec.Replicas, -1); got != 1 {
+		t.Fatalf("replicas with reservation = %d, want 1", got)
+	}
+
+	current = runtimePoolTestGetPool(t, r, pool)
+	current.Status.Capacity.ReservedPrompts = 0
+	current.Status.Capacity.Reservations = nil
+	if err := r.Status().Update(context.Background(), &current); err != nil {
+		t.Fatalf("release rollout reservation: %v", err)
+	}
+	runtimePoolReconcile(t, r, pool)
+	current = runtimePoolTestGetPool(t, r, pool)
+	if current.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleQuiescent || current.Status.Capacity.QueuedTasks != 3 {
+		t.Fatalf("queued-demand quiescence = %s queued=%d, want Quiescent with queued demand preserved", current.Status.Lifecycle, current.Status.Capacity.QueuedTasks)
+	}
+	runtimePoolReconcile(t, r, pool)
+	if got := ptr.Deref(runtimePoolTestDeployment(t, r, pool.Namespace, deployment.Name).Spec.Replicas, -1); got != 0 {
+		t.Fatalf("replicas after queued-demand drain = %d, want 0", got)
+	}
+}
+
+func TestRuntimePoolReconcilerRolloutFailureAndTimeoutPreserveOldPod(t *testing.T) {
+	t.Run("drain request failure retries without template replacement", func(t *testing.T) {
+		scheme := runtimePoolTestScheme(t)
+		pool := runtimePoolTestObject(1)
+		supervisor := &fakeRuntimePoolSupervisorClient{}
+		r := runtimePoolTestReconciler(t, scheme, supervisor, pool)
+		deployment, _ := runtimePoolTestStartServing(t, r, pool, supervisor, "failure-pod", "failure-pod-uid", "10.0.0.91", "failure-boot")
+		oldRevision := deployment.Spec.Template.Annotations[runtimePoolTemplateRevisionAnnotation]
+
+		r.ProviderProxy.BearerToken = bytes.Clone(runtimePoolTestProviderTokenNext)
+		supervisor.drainErr = errors.New("temporary drain failure")
+		runtimePoolReconcile(t, r, pool)
+		status := runtimePoolTestGetPool(t, r, pool).Status
+		if status.Lifecycle != corev1alpha1.RuntimePoolLifecycleDegraded || status.AdmissionState != corev1alpha1.RuntimePoolAdmissionClosed {
+			t.Fatalf("failure status = %s/%s, want Degraded/Closed", status.Lifecycle, status.AdmissionState)
+		}
+		deployment = runtimePoolTestDeployment(t, r, pool.Namespace, deployment.Name)
+		if ptr.Deref(deployment.Spec.Replicas, -1) != 1 || deployment.Spec.Template.Annotations[runtimePoolTemplateRevisionAnnotation] != oldRevision {
+			t.Fatal("drain failure replaced or stopped the live old template")
+		}
+
+		supervisor.drainErr = nil
+		runtimePoolReconcile(t, r, pool)
+		status = runtimePoolTestGetPool(t, r, pool).Status
+		if status.Lifecycle != corev1alpha1.RuntimePoolLifecycleDraining || supervisor.drainCalls != 2 {
+			t.Fatalf("retry status/calls = %s/%d, want Draining/2", status.Lifecycle, supervisor.drainCalls)
+		}
+	})
+
+	t.Run("drain timeout fails closed and later converges", func(t *testing.T) {
+		scheme := runtimePoolTestScheme(t)
+		pool := runtimePoolTestObject(1)
+		supervisor := &fakeRuntimePoolSupervisorClient{}
+		now := runtimePoolTestNow
+		r := runtimePoolTestReconciler(t, scheme, supervisor, pool)
+		r.Now = func() time.Time { return now }
+		deployment, pod := runtimePoolTestStartServing(t, r, pool, supervisor, "timeout-pod", "timeout-pod-uid", "10.0.0.92", "timeout-boot")
+		oldRevision := deployment.Spec.Template.Annotations[runtimePoolTemplateRevisionAnnotation]
+
+		r.ProviderProxy.BearerToken = bytes.Clone(runtimePoolTestProviderTokenNext)
+		runtimePoolReconcile(t, r, pool)
+		supervisor.probe = runtimePoolValidProbe(pool, &pod, "timeout-boot", true)
+		supervisor.probe.Status.Pressure.LiveDescendants = 1
+		now = now.Add(time.Duration(pool.Spec.ColdStartTimeoutSeconds+1) * time.Second)
+		runtimePoolReconcile(t, r, pool)
+		status := runtimePoolTestGetPool(t, r, pool).Status
+		condition := meta.FindStatusCondition(status.Conditions, corev1alpha1.RuntimePoolConditionRolloutReady)
+		if status.Lifecycle != corev1alpha1.RuntimePoolLifecycleDegraded || condition == nil || condition.Reason != runtimePoolRolloutReasonTimedOut {
+			t.Fatalf("timeout status/condition = %s/%#v, want Degraded/RolloutTimedOut", status.Lifecycle, condition)
+		}
+		deployment = runtimePoolTestDeployment(t, r, pool.Namespace, deployment.Name)
+		if ptr.Deref(deployment.Spec.Replicas, -1) != 1 || deployment.Spec.Template.Annotations[runtimePoolTemplateRevisionAnnotation] != oldRevision {
+			t.Fatal("rollout timeout replaced or stopped the live old template")
+		}
+
+		supervisor.probe.Status.Pressure.LiveDescendants = 0
+		runtimePoolReconcile(t, r, pool)
+		if got := runtimePoolTestGetPool(t, r, pool).Status.Lifecycle; got != corev1alpha1.RuntimePoolLifecycleQuiescent {
+			t.Fatalf("lifecycle after late quiescence = %s, want Quiescent", got)
+		}
+	})
+}
+
+func TestRuntimePoolPodTemplateRevisionChangesForEveryRuntimeIdentityInput(t *testing.T) {
+	pool := runtimePoolTestObject(1)
+	r := runtimePoolTestReconciler(t, runtimePoolTestScheme(t), nil, pool)
+	cfg, err := r.runtimePoolConfig(pool)
+	if err != nil {
+		t.Fatalf("runtimePoolConfig: %v", err)
+	}
+	selector := map[string]string{runtimePoolKeyLabel: cfg.labels[runtimePoolKeyLabel]}
+	base := r.runtimePoolPodTemplate(pool, cfg, selector, "auth-e7", "provider-old")
+	baseRevision := base.Annotations[runtimePoolTemplateRevisionAnnotation]
+
+	tests := map[string]func(*corev1alpha1.RuntimePool, *runtimePoolConfig, *string, *string){
+		"image": func(pool *corev1alpha1.RuntimePool, _ *runtimePoolConfig, _, _ *string) {
+			pool.Spec.Runtime.Image = "docker.io/sozercan/orka-acp@sha256:" + strings.Repeat("9", 64)
+		},
+		"profile": func(pool *corev1alpha1.RuntimePool, cfg *runtimePoolConfig, _, _ *string) {
+			pool.Spec.Runtime.Profile.Digest = "sha256:" + strings.Repeat("8", 64)
+			cfg.profile.Model = "changed-model"
+		},
+		"auth epoch": func(_ *corev1alpha1.RuntimePool, _ *runtimePoolConfig, auth, _ *string) { *auth = "auth-e8" },
+		"provider token": func(_ *corev1alpha1.RuntimePool, cfg *runtimePoolConfig, _, provider *string) {
+			cfg.providerProxy.tokenGeneration = runtimePoolProviderTokenGeneration(runtimePoolTestProviderTokenNext)
+			*provider = "provider-next"
+		},
+		"other template field": func(_ *corev1alpha1.RuntimePool, cfg *runtimePoolConfig, _, _ *string) {
+			cfg.providerProxy.baseURL = "http://provider-auth-proxy.orka-system.svc:9090"
+		},
+	}
+	for name, mutate := range tests {
+		t.Run(name, func(t *testing.T) {
+			changedPool := pool.DeepCopy()
+			changedConfig := cfg
+			authName, providerName := "auth-e7", "provider-old"
+			mutate(changedPool, &changedConfig, &authName, &providerName)
+			changed := r.runtimePoolPodTemplate(changedPool, changedConfig, selector, authName, providerName)
+			if changed.Annotations[runtimePoolTemplateRevisionAnnotation] == baseRevision {
+				t.Fatalf("template revision did not change for %s", name)
+			}
+		})
+	}
+}
+
+func TestRuntimePoolReconcilerScaleDownRequiresDrainAndQuiescentStatus(t *testing.T) {
+	scheme := runtimePoolTestScheme(t)
+	pool := runtimePoolTestObject(1)
+	pod := runtimePoolReadyPod(pool, pool.Namespace, "codex-pod", "pod-uid-1", "10.0.0.21")
+	supervisor := &fakeRuntimePoolSupervisorClient{probe: runtimePoolValidProbe(pool, &pod, "boot-1", false)}
+	r := runtimePoolTestReconciler(t, scheme, supervisor, pool, &pod)
+
+	runtimePoolReconcile(t, r, pool)
+	var current corev1alpha1.RuntimePool
+	if err := r.Get(context.Background(), types.NamespacedName{Namespace: pool.Namespace, Name: pool.Name}, &current); err != nil {
+		t.Fatal(err)
+	}
+	current.Spec.DesiredReplicas = 0
+	if err := r.Update(context.Background(), &current); err != nil {
+		t.Fatalf("set desired replicas to zero: %v", err)
+	}
+
+	runtimePoolReconcile(t, r, pool)
+	deployment := runtimePoolTestDeployment(t, r, pool.Namespace, runtimePoolResourceName(pool.Namespace, pool.Name))
+	if got := ptr.Deref(deployment.Spec.Replicas, -1); got != 1 {
+		t.Fatalf("replicas after initial drain request = %d, want 1", got)
+	}
+	if supervisor.drainCalls != 1 {
+		t.Fatalf("drain calls = %d, want 1", supervisor.drainCalls)
+	}
+	current = runtimePoolTestGetPool(t, r, pool)
+	if current.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleDraining {
+		t.Fatalf("lifecycle after drain request = %s, want Draining", current.Status.Lifecycle)
+	}
+
+	supervisor.probe = runtimePoolValidProbe(pool, &pod, "boot-1", true)
+	runtimePoolReconcile(t, r, pool)
+	deployment = runtimePoolTestDeployment(t, r, pool.Namespace, runtimePoolResourceName(pool.Namespace, pool.Name))
+	if got := ptr.Deref(deployment.Spec.Replicas, -1); got != 1 {
+		t.Fatalf("replicas at first quiescent observation = %d, want 1", got)
+	}
+	current = runtimePoolTestGetPool(t, r, pool)
+	if current.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleQuiescent {
+		t.Fatalf("lifecycle = %s, want Quiescent barrier", current.Status.Lifecycle)
+	}
+
+	runtimePoolReconcile(t, r, pool)
+	deployment = runtimePoolTestDeployment(t, r, pool.Namespace, runtimePoolResourceName(pool.Namespace, pool.Name))
+	if got := ptr.Deref(deployment.Spec.Replicas, -1); got != 0 {
+		t.Fatalf("replicas after persisted quiescent barrier = %d, want 0", got)
+	}
+	current = runtimePoolTestGetPool(t, r, pool)
+	if current.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleStopping || current.Status.AdmissionState != corev1alpha1.RuntimePoolAdmissionClosed {
+		t.Fatalf("status after scale down = %s/%s, want Stopping/Closed", current.Status.Lifecycle, current.Status.AdmissionState)
+	}
+}
+
+func TestRuntimePoolReconcilerClosesAdmissionForTwoReadyPods(t *testing.T) {
+	scheme := runtimePoolTestScheme(t)
+	pool := runtimePoolTestObject(1)
+	pod1 := runtimePoolReadyPod(pool, pool.Namespace, "codex-pod-1", "pod-uid-1", "10.0.0.31")
+	pod2 := runtimePoolReadyPod(pool, pool.Namespace, "codex-pod-2", "pod-uid-2", "10.0.0.32")
+	supervisor := &fakeRuntimePoolSupervisorClient{}
+	r := runtimePoolTestReconciler(t, scheme, supervisor, pool, &pod1, &pod2)
+
+	runtimePoolReconcile(t, r, pool)
+	got := runtimePoolTestGetPool(t, r, pool)
+	if got.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleAmbiguous || got.Status.AdmissionState != corev1alpha1.RuntimePoolAdmissionAmbiguous {
+		t.Fatalf("status = %s/%s, want Ambiguous/Ambiguous", got.Status.Lifecycle, got.Status.AdmissionState)
+	}
+	if got.Status.ActiveInstance != nil {
+		t.Fatalf("active instance = %#v, want nil", got.Status.ActiveInstance)
+	}
+	if supervisor.probeCalls != 0 {
+		t.Fatalf("probe calls = %d, want none for ambiguous Pods", supervisor.probeCalls)
+	}
+	condition := meta.FindStatusCondition(got.Status.Conditions, corev1alpha1.RuntimePoolConditionAdmissionReady)
+	if condition == nil || condition.Status != metav1.ConditionFalse || condition.Reason != corev1alpha1.RuntimePoolReasonRuntimeAmbiguous {
+		t.Fatalf("AdmissionReady condition = %#v", condition)
+	}
+}
+
+func TestRuntimePoolReconcilerReportsBadImageAndScheduling(t *testing.T) {
+	t.Run("unmanaged pool is rejected", func(t *testing.T) {
+		scheme := runtimePoolTestScheme(t)
+		pool := runtimePoolTestObject(1)
+		delete(pool.Labels, acpRuntimePoolLabel)
+		r := runtimePoolTestReconciler(t, scheme, nil, pool)
+
+		runtimePoolReconcile(t, r, pool)
+		got := runtimePoolTestGetPool(t, r, pool)
+		if got.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleDegraded || !strings.Contains(got.Status.Message, "controller-owned") {
+			t.Fatalf("unmanaged status = %#v", got.Status)
+		}
+	})
+
+	t.Run("unapproved digest-pinned image is rejected", func(t *testing.T) {
+		scheme := runtimePoolTestScheme(t)
+		pool := runtimePoolTestObject(1)
+		pool.Spec.Runtime.Image = "docker.io/example/unapproved@sha256:" + strings.Repeat("9", 64)
+		r := runtimePoolTestReconciler(t, scheme, nil, pool)
+
+		runtimePoolReconcile(t, r, pool)
+		got := runtimePoolTestGetPool(t, r, pool)
+		if got.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleDegraded || !strings.Contains(got.Status.Message, "controller-approved") {
+			t.Fatalf("unapproved-image status = %#v", got.Status)
+		}
+	})
+
+	t.Run("mutable image is rejected", func(t *testing.T) {
+		scheme := runtimePoolTestScheme(t)
+		pool := runtimePoolTestObject(1)
+		pool.Spec.Runtime.Image = "docker.io/sozercan/orka-acp:latest"
+		r := runtimePoolTestReconciler(t, scheme, nil, pool)
+
+		runtimePoolReconcile(t, r, pool)
+		got := runtimePoolTestGetPool(t, r, pool)
+		condition := meta.FindStatusCondition(got.Status.Conditions, corev1alpha1.RuntimePoolConditionRolloutReady)
+		if got.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleDegraded || condition == nil || condition.Status != metav1.ConditionFalse {
+			t.Fatalf("bad-image status = %#v", got.Status)
+		}
+		var deployment appsv1.Deployment
+		err := r.Get(context.Background(), types.NamespacedName{Namespace: pool.Namespace, Name: runtimePoolResourceName(pool.Namespace, pool.Name)}, &deployment)
+		if !apierrors.IsNotFound(err) {
+			t.Fatalf("Deployment exists for mutable image, err=%v", err)
+		}
+	})
+
+	t.Run("unschedulable pod closes admission", func(t *testing.T) {
+		scheme := runtimePoolTestScheme(t)
+		pool := runtimePoolTestObject(1)
+		pod := runtimePoolPendingPod(pool, pool.Namespace, "codex-pod", "pod-uid-1")
+		pod.Status.Conditions = []corev1.PodCondition{{
+			Type: corev1.PodScheduled, Status: corev1.ConditionFalse, Reason: "Unschedulable", Message: "insufficient cpu",
+		}}
+		r := runtimePoolTestReconciler(t, scheme, nil, pool, &pod)
+
+		runtimePoolReconcile(t, r, pool)
+		got := runtimePoolTestGetPool(t, r, pool)
+		condition := meta.FindStatusCondition(got.Status.Conditions, corev1alpha1.RuntimePoolConditionSchedulingReady)
+		if got.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleDegraded || condition == nil || condition.Status != metav1.ConditionFalse || condition.Reason != "Unschedulable" {
+			t.Fatalf("scheduling status = %#v", got.Status)
+		}
+	})
+}
+
+func TestRuntimePoolReconcilerCleanupOnlySkipsActivePool(t *testing.T) {
+	scheme := runtimePoolTestScheme(t)
+	pool := runtimePoolTestObject(1)
+	r := runtimePoolTestReconciler(t, scheme, nil, pool)
+	r.CleanupOnly = true
+
+	result := runtimePoolReconcile(t, r, pool)
+	if result != (ctrl.Result{}) {
+		t.Fatalf("cleanup-only active pool result = %#v, want zero result", result)
+	}
+	got := runtimePoolTestGetPool(t, r, pool)
+	if controllerutil.ContainsFinalizer(&got, runtimePoolFinalizer) {
+		t.Fatal("cleanup-only reconciliation added a RuntimePool finalizer")
+	}
+	var deployment appsv1.Deployment
+	err := r.Get(context.Background(), types.NamespacedName{
+		Namespace: pool.Namespace,
+		Name:      runtimePoolResourceName(pool.Namespace, pool.Name),
+	}, &deployment)
+	if !apierrors.IsNotFound(err) {
+		t.Fatalf("cleanup-only reconciliation created Deployment, err=%v", err)
+	}
+}
+
+func TestRuntimePoolReconcilerCleanupOnlyFinalizerCleansCrossNamespaceChildren(t *testing.T) {
+	scheme := runtimePoolTestScheme(t)
+	pool := runtimePoolTestObject(0)
+	pool.Spec.RuntimeNamespace = "orka-runtimes"
+	pool.Finalizers = []string{runtimePoolFinalizer}
+	deletedAt := metav1.NewTime(runtimePoolTestNow)
+	pool.DeletionTimestamp = &deletedAt
+	base := runtimePoolResourceName(pool.Namespace, pool.Name)
+	labels := map[string]string{
+		runtimePoolKeyLabel:       runtimePoolKey(pool.Namespace, pool.Name),
+		runtimePoolNamespaceLabel: pool.Namespace,
+		runtimePoolNameLabel:      pool.Name,
+	}
+	objects := []client.Object{
+		pool,
+		&appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: base, Namespace: pool.Spec.RuntimeNamespace, Labels: labels}},
+		&corev1.Service{ObjectMeta: metav1.ObjectMeta{Name: base, Namespace: pool.Spec.RuntimeNamespace, Labels: labels}},
+		&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "managed-secret", Namespace: pool.Spec.RuntimeNamespace, Labels: labels}},
+		&corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "runtime-pod", Namespace: pool.Spec.RuntimeNamespace, Labels: labels}},
+		&appsv1.ReplicaSet{ObjectMeta: metav1.ObjectMeta{Name: "runtime-rs", Namespace: pool.Spec.RuntimeNamespace, Labels: labels}},
+		&policyv1.PodDisruptionBudget{ObjectMeta: metav1.ObjectMeta{Name: runtimePoolChildName(base, "pdb"), Namespace: pool.Spec.RuntimeNamespace, Labels: labels}},
+	}
+	for _, suffix := range []string{
+		"deny-all", "control-in", "dns-egress", "provider-proxy-egress", "controller-egress",
+		"control-plane-egress", "artifact-api-egress",
+	} {
+		objects = append(objects, &networkingv1.NetworkPolicy{ObjectMeta: metav1.ObjectMeta{
+			Name: runtimePoolChildName(base, suffix), Namespace: pool.Spec.RuntimeNamespace, Labels: labels,
+		}})
+	}
+	r := runtimePoolTestReconciler(t, scheme, nil, objects...)
+	r.CleanupOnly = true
+
+	runtimePoolReconcile(t, r, pool)
+	runtimePoolReconcile(t, r, pool)
+
+	for _, object := range objects[1:] {
+		key := client.ObjectKeyFromObject(object)
+		check := object.DeepCopyObject().(client.Object)
+		if err := r.Get(context.Background(), key, check); !apierrors.IsNotFound(err) {
+			t.Fatalf("child %T %s still exists, err=%v", object, key, err)
+		}
+	}
+	var got corev1alpha1.RuntimePool
+	err := r.Get(context.Background(), types.NamespacedName{Namespace: pool.Namespace, Name: pool.Name}, &got)
+	if err == nil && controllerutil.ContainsFinalizer(&got, runtimePoolFinalizer) {
+		t.Fatal("RuntimePool cleanup finalizer was not removed")
+	}
+	if err != nil && !apierrors.IsNotFound(err) {
+		t.Fatalf("Get deleting RuntimePool: %v", err)
+	}
+}
+
+func TestRuntimePoolReconcilerPublishesExactActivePodStatus(t *testing.T) {
+	scheme := runtimePoolTestScheme(t)
+	pool := runtimePoolTestObject(1)
+	pod := runtimePoolReadyPod(pool, pool.Namespace, "codex-pod", "pod-uid-exact", "10.0.0.42")
+	supervisor := &fakeRuntimePoolSupervisorClient{probe: runtimePoolValidProbe(pool, &pod, "boot-exact", false)}
+	r := runtimePoolTestReconciler(t, scheme, supervisor, pool, &pod)
+
+	runtimePoolReconcile(t, r, pool)
+	got := runtimePoolTestGetPool(t, r, pool)
+	active := got.Status.ActiveInstance
+	if active == nil {
+		t.Fatal("active instance is nil")
+	}
+	if active.PodNamespace != pod.Namespace || active.PodName != pod.Name || active.PodAddress != pod.Status.PodIP || active.PodUID != string(pod.UID) {
+		t.Fatalf("active Pod identity = %#v, want exact Pod %#v", active, pod.ObjectMeta)
+	}
+	if active.BootID != "boot-exact" || active.RuntimeInstanceID != "pod-uid-exact.boot-exact" {
+		t.Fatalf("active runtime fence = boot %q instance %q", active.BootID, active.RuntimeInstanceID)
+	}
+	if active.ControllerEpoch != 7 || active.ProtocolVersion != corev1alpha1.RuntimePoolProtocolHarnessV2 || active.ProfileDigest != pool.Spec.Runtime.Profile.Digest {
+		t.Fatalf("active protocol/profile fence = %#v", active)
+	}
+	if active.LastObservedTime == nil || !active.LastObservedTime.Time.Equal(runtimePoolTestNow) {
+		t.Fatalf("last observed = %#v, want %s", active.LastObservedTime, runtimePoolTestNow)
+	}
+	if got.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleServing || got.Status.AdmissionState != corev1alpha1.RuntimePoolAdmissionAccepting {
+		t.Fatalf("status = %s/%s, want Serving/Accepting", got.Status.Lifecycle, got.Status.AdmissionState)
+	}
+	for _, conditionType := range []string{
+		corev1alpha1.RuntimePoolConditionAdmissionReady,
+		corev1alpha1.RuntimePoolConditionPodSecurityReady,
+		corev1alpha1.RuntimePoolConditionQuotaReady,
+		corev1alpha1.RuntimePoolConditionSchedulingReady,
+		corev1alpha1.RuntimePoolConditionRolloutReady,
+	} {
+		condition := meta.FindStatusCondition(got.Status.Conditions, conditionType)
+		if condition == nil || condition.Status != metav1.ConditionTrue {
+			t.Fatalf("condition %s = %#v, want True", conditionType, condition)
+		}
+	}
+}
+
+func TestRuntimePoolReconcilerPreservesActiveFenceAcrossReadinessGap(t *testing.T) {
+	const oldRuntimeInstanceID = "restart-gap-pod-uid.boot-before-gap"
+
+	scheme := runtimePoolTestScheme(t)
+	pool := runtimePoolTestObject(1)
+	pod := runtimePoolReadyPod(pool, pool.Namespace, "restart-gap-pod", "restart-gap-pod-uid", "10.0.0.45")
+	supervisor := &fakeRuntimePoolSupervisorClient{probe: runtimePoolValidProbe(pool, &pod, "boot-before-gap", false)}
+	r := runtimePoolTestReconciler(t, scheme, supervisor, pool, &pod)
+
+	runtimePoolReconcile(t, r, pool)
+	runtimePoolTestSetPodReady(t, r, &pod, false)
+	runtimePoolReconcile(t, r, pool)
+	got := runtimePoolTestGetPool(t, r, pool)
+	if got.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleDegraded || got.Status.AdmissionState != corev1alpha1.RuntimePoolAdmissionClosed ||
+		got.Status.ActiveInstance == nil || got.Status.ActiveInstance.RuntimeInstanceID != oldRuntimeInstanceID {
+		t.Fatalf("readiness-gap status = %s/%s active=%#v, want Degraded/Closed with the old fence preserved", got.Status.Lifecycle, got.Status.AdmissionState, got.Status.ActiveInstance)
+	}
+	if err := r.Get(context.Background(), client.ObjectKeyFromObject(&pod), &corev1.Pod{}); err != nil {
+		t.Fatalf("runtime Pod disappeared during the readiness gap: %v", err)
+	}
+}
+
+func TestRuntimePoolReconcilerRecyclesPodAfterInPlaceSupervisorRestart(t *testing.T) {
+	const oldRuntimeInstanceID = "restart-pod-uid.boot-before-restart"
+
+	scheme := runtimePoolTestScheme(t)
+	pool := runtimePoolTestObject(1)
+	pod := runtimePoolReadyPod(pool, pool.Namespace, "restart-pod", "restart-pod-uid", "10.0.0.47")
+	supervisor := &fakeRuntimePoolSupervisorClient{probe: runtimePoolValidProbe(pool, &pod, "boot-before-restart", false)}
+	r := runtimePoolTestReconciler(t, scheme, supervisor, pool, &pod)
+	deleteRecorder := &runtimePoolPodDeleteRecordingClient{Client: r.Client}
+	r.Client = deleteRecorder
+
+	runtimePoolReconcile(t, r, pool)
+	got := runtimePoolTestGetPool(t, r, pool)
+	if got.Status.ActiveInstance == nil || got.Status.ActiveInstance.RuntimeInstanceID != oldRuntimeInstanceID {
+		t.Fatalf("initial active instance = %#v", got.Status.ActiveInstance)
+	}
+
+	supervisor.probe = runtimePoolValidProbe(pool, &pod, "boot-after-restart", false)
+	runtimePoolReconcile(t, r, pool)
+	got = runtimePoolTestGetPool(t, r, pool)
+	if got.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleDegraded || got.Status.AdmissionState != corev1alpha1.RuntimePoolAdmissionClosed {
+		t.Fatalf("status after restart detection = %s/%s, want Degraded/Closed", got.Status.Lifecycle, got.Status.AdmissionState)
+	}
+	if got.Status.ActiveInstance == nil || got.Status.ActiveInstance.RuntimeInstanceID != oldRuntimeInstanceID {
+		t.Fatalf("restart detection replaced the persisted active fence: %#v", got.Status.ActiveInstance)
+	}
+	condition := meta.FindStatusCondition(got.Status.Conditions, corev1alpha1.RuntimePoolConditionAdmissionReady)
+	if condition == nil || condition.Status != metav1.ConditionFalse || condition.Reason != runtimePoolSupervisorRestartReasonDetected {
+		t.Fatalf("restart admission condition = %#v", condition)
+	}
+	if deleteRecorder.podDeleteHadPreconditions {
+		t.Fatal("runtime Pod was deleted before the admission closure persisted")
+	}
+	if err := r.Get(context.Background(), client.ObjectKeyFromObject(&pod), &corev1.Pod{}); err != nil {
+		t.Fatalf("runtime Pod disappeared before the replacement barrier persisted: %v", err)
+	}
+
+	runtimePoolReconcile(t, r, pool)
+	got = runtimePoolTestGetPool(t, r, pool)
+	if got.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleStopping || got.Status.AdmissionState != corev1alpha1.RuntimePoolAdmissionClosed || got.Status.ActiveInstance != nil {
+		t.Fatalf("status after restart Pod recycle = %s/%s active=%#v, want Stopping/Closed with no active instance", got.Status.Lifecycle, got.Status.AdmissionState, got.Status.ActiveInstance)
+	}
+	if err := r.Get(context.Background(), client.ObjectKeyFromObject(&pod), &corev1.Pod{}); !apierrors.IsNotFound(err) {
+		t.Fatalf("in-place restarted runtime Pod still exists, err=%v", err)
+	}
+	if !deleteRecorder.podDeleteHadPreconditions || deleteRecorder.podDeleteUID != pod.UID || deleteRecorder.podDeleteResourceVersion == "" {
+		t.Fatalf(
+			"restart Pod delete preconditions = present:%t uid:%q resourceVersion:%q, want exact UID %q and non-empty resourceVersion",
+			deleteRecorder.podDeleteHadPreconditions,
+			deleteRecorder.podDeleteUID,
+			deleteRecorder.podDeleteResourceVersion,
+			pod.UID,
+		)
+	}
+	deployment := runtimePoolTestDeployment(t, r, pool.Namespace, runtimePoolResourceName(pool.Namespace, pool.Name))
+	if replicas := ptr.Deref(deployment.Spec.Replicas, 0); replicas != 1 {
+		t.Fatalf("deployment replicas after restart Pod recycle = %d, want 1", replicas)
+	}
+}
+
+func TestRuntimePoolReconcilerRecyclesInPlaceRestartDuringRollout(t *testing.T) {
+	scheme := runtimePoolTestScheme(t)
+	pool := runtimePoolTestObject(1)
+	supervisor := &fakeRuntimePoolSupervisorClient{}
+	r := runtimePoolTestReconciler(t, scheme, supervisor, pool)
+	deployment, pod := runtimePoolTestStartServing(t, r, pool, supervisor, "rollout-restart-pod", "rollout-restart-uid", "10.0.0.46", "rollout-boot-before")
+	oldRevision := deployment.Spec.Template.Annotations[runtimePoolTemplateRevisionAnnotation]
+	deleteRecorder := &runtimePoolPodDeleteRecordingClient{Client: r.Client}
+	r.Client = deleteRecorder
+
+	r.ProviderProxy.BearerToken = bytes.Clone(runtimePoolTestProviderTokenNext)
+	supervisor.probe = runtimePoolValidProbe(pool, &pod, "rollout-boot-after", false)
+	runtimePoolReconcile(t, r, pool)
+	got := runtimePoolTestGetPool(t, r, pool)
+	if got.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleDegraded || got.Status.AdmissionState != corev1alpha1.RuntimePoolAdmissionClosed ||
+		got.Status.ActiveInstance == nil || got.Status.ActiveInstance.RuntimeInstanceID != "rollout-restart-uid.rollout-boot-before" {
+		t.Fatalf("rollout restart barrier = %s/%s active=%#v", got.Status.Lifecycle, got.Status.AdmissionState, got.Status.ActiveInstance)
+	}
+	if deleteRecorder.podDeleteHadPreconditions {
+		t.Fatal("rollout runtime Pod was deleted before the restart barrier persisted")
+	}
+
+	runtimePoolReconcile(t, r, pool)
+	got = runtimePoolTestGetPool(t, r, pool)
+	if got.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleStopping || got.Status.ActiveInstance != nil {
+		t.Fatalf("rollout restart recycle status = %s active=%#v", got.Status.Lifecycle, got.Status.ActiveInstance)
+	}
+	if err := r.Get(context.Background(), client.ObjectKeyFromObject(&pod), &corev1.Pod{}); !apierrors.IsNotFound(err) {
+		t.Fatalf("rollout in-place restarted Pod still exists, err=%v", err)
+	}
+	if !deleteRecorder.podDeleteHadPreconditions || deleteRecorder.podDeleteUID != pod.UID || deleteRecorder.podDeleteResourceVersion == "" {
+		t.Fatalf("rollout restart delete preconditions = present:%t uid:%q resourceVersion:%q", deleteRecorder.podDeleteHadPreconditions, deleteRecorder.podDeleteUID, deleteRecorder.podDeleteResourceVersion)
+	}
+	deployment = runtimePoolTestDeployment(t, r, pool.Namespace, deployment.Name)
+	if replicas := ptr.Deref(deployment.Spec.Replicas, -1); replicas != 0 {
+		t.Fatalf("rollout deployment replicas after restart recycle = %d, want 0", replicas)
+	}
+
+	runtimePoolReconcile(t, r, pool)
+	deployment = runtimePoolTestDeployment(t, r, pool.Namespace, deployment.Name)
+	if replicas := ptr.Deref(deployment.Spec.Replicas, -1); replicas != 1 {
+		t.Fatalf("rollout deployment replicas after staging replacement = %d, want 1", replicas)
+	}
+	if revision := deployment.Spec.Template.Annotations[runtimePoolTemplateRevisionAnnotation]; revision == oldRevision {
+		t.Fatalf("rollout replacement retained old template revision %q", revision)
+	}
+}
+
+func TestRuntimePoolReconcilerMigratesSteadyStateWithoutIdentityCapacity(t *testing.T) {
+	scheme := runtimePoolTestScheme(t)
+	pool := runtimePoolTestObject(1)
+	pod := runtimePoolReadyPod(pool, pool.Namespace, "legacy-serving-pod", "legacy-serving-uid", "10.0.0.44")
+	probe := runtimePoolValidProbe(pool, &pod, "legacy-serving-boot", false)
+	probe.Status.SessionIdentityCapacity = nil
+	supervisor := &fakeRuntimePoolSupervisorClient{probe: probe}
+	r := runtimePoolTestReconciler(t, scheme, supervisor, pool, &pod)
+
+	runtimePoolReconcile(t, r, pool)
+	got := runtimePoolTestGetPool(t, r, pool)
+	if got.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleDraining || got.Status.AdmissionState != corev1alpha1.RuntimePoolAdmissionDraining {
+		t.Fatalf("steady-state legacy status = %s/%s, want Draining/Draining", got.Status.Lifecycle, got.Status.AdmissionState)
+	}
+	if got.Status.ActiveInstance == nil {
+		t.Fatal("legacy supervisor migration lost exact active instance")
+	}
+	runtimePoolReconcile(t, r, pool)
+	if supervisor.drainCalls != 1 || supervisor.drainReason != harnessv2.DrainReasonSessionIdentityCapacity {
+		t.Fatalf("legacy migration drain = calls:%d reason:%q", supervisor.drainCalls, supervisor.drainReason)
+	}
+}
+
+func TestRuntimePoolReconcilerRotatesBeforeSessionIdentityExhaustion(t *testing.T) {
+	scheme := runtimePoolTestScheme(t)
+	pool := runtimePoolTestObject(1)
+	pod := runtimePoolReadyPod(pool, pool.Namespace, "codex-pod", "pod-uid-identity", "10.0.0.43")
+	probe := runtimePoolValidProbe(pool, &pod, "boot-identity", false)
+	probe.Status.SessionIdentityCapacity.Remaining = probe.Status.SessionIdentityCapacity.ExhaustionReserve
+	probe.Status.Drain.AcceptingNewSessions = false
+	supervisor := &fakeRuntimePoolSupervisorClient{probe: probe}
+	r := runtimePoolTestReconciler(t, scheme, supervisor, pool, &pod)
+	deleteRecorder := &runtimePoolPodDeleteRecordingClient{Client: r.Client}
+	r.Client = deleteRecorder
+
+	runtimePoolReconcile(t, r, pool)
+	got := runtimePoolTestGetPool(t, r, pool)
+	if supervisor.drainCalls != 0 {
+		t.Fatalf("identity drain was requested before admission closure persisted: %d calls", supervisor.drainCalls)
+	}
+	if got.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleDraining || got.Status.AdmissionState != corev1alpha1.RuntimePoolAdmissionDraining {
+		t.Fatalf("status after identity admission closure = %s/%s, want Draining/Draining", got.Status.Lifecycle, got.Status.AdmissionState)
+	}
+
+	got.Status.Capacity.ReservedSessions = 1
+	got.Status.Capacity.Reservations = []corev1alpha1.RuntimePoolCapacityReservationStatus{{
+		PoolUID: string(pool.UID), TaskUID: "reservation-race", Attempt: 1, ControllerEpoch: 7,
+		RuntimeInstanceID: "pod-uid-identity.boot-identity", ResidentSlots: 1,
+		ReservedAt: metav1.NewTime(runtimePoolTestNow), ExpiresAt: metav1.NewTime(runtimePoolTestNow.Add(time.Minute)),
+	}}
+	if err := r.Status().Update(context.Background(), &got); err != nil {
+		t.Fatalf("add raced identity reservation: %v", err)
+	}
+	runtimePoolReconcile(t, r, pool)
+	if supervisor.drainCalls != 0 {
+		t.Fatalf("identity drain was requested while a raced reservation remained: %d calls", supervisor.drainCalls)
+	}
+
+	got = runtimePoolTestGetPool(t, r, pool)
+	got.Status.Capacity.ReservedSessions = 0
+	got.Status.Capacity.Reservations = nil
+	if err := r.Status().Update(context.Background(), &got); err != nil {
+		t.Fatalf("release raced identity reservation: %v", err)
+	}
+	runtimePoolReconcile(t, r, pool)
+	if supervisor.drainCalls != 1 || supervisor.drainReason != harnessv2.DrainReasonSessionIdentityCapacity {
+		t.Fatalf("identity drain = calls:%d reason:%q, want one %q request", supervisor.drainCalls, supervisor.drainReason, harnessv2.DrainReasonSessionIdentityCapacity)
+	}
+
+	supervisor.probe.Status.Lifecycle = harnessv2.SupervisorLifecycleDraining
+	supervisor.probe.Status.Drain = harnessv2.DrainStatus{
+		AcceptingNewSessions: false,
+		Requested:            true,
+		RequestedAt:          runtimePoolTestNow.Add(-time.Minute),
+		Reason:               harnessv2.DrainReasonSessionIdentityCapacity,
+	}
+	supervisor.probe.Status.Sessions = []harnessv2.RuntimeSessionStatus{{
+		RuntimeSessionID:    "runtime-session-1",
+		RuntimeSessionUID:   "session-uid-1",
+		Generation:          1,
+		State:               harnessv2.RuntimeSessionStateIdle,
+		LastTransitionAt:    runtimePoolTestNow.Add(-time.Minute),
+		LiveDescendantCount: 0,
+	}}
+	supervisor.probe.Status.Pressure.ResidentSessions = 1
+	runtimePoolReconcile(t, r, pool)
+	got = runtimePoolTestGetPool(t, r, pool)
+	if got.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleDraining {
+		t.Fatalf("lifecycle with resident session = %s, want Draining", got.Status.Lifecycle)
+	}
+	if err := r.Get(context.Background(), client.ObjectKeyFromObject(&pod), &corev1.Pod{}); err != nil {
+		t.Fatalf("runtime Pod was deleted before quiescence: %v", err)
+	}
+
+	supervisor.probe.Status.Sessions = nil
+	supervisor.probe.Status.Pressure.ResidentSessions = 0
+	runtimePoolReconcile(t, r, pool)
+	got = runtimePoolTestGetPool(t, r, pool)
+	if got.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleQuiescent {
+		t.Fatalf("lifecycle at first quiescent observation = %s, want Quiescent", got.Status.Lifecycle)
+	}
+	if err := r.Get(context.Background(), client.ObjectKeyFromObject(&pod), &corev1.Pod{}); err != nil {
+		t.Fatalf("runtime Pod was deleted before quiescence persisted: %v", err)
+	}
+
+	runtimePoolReconcile(t, r, pool)
+	got = runtimePoolTestGetPool(t, r, pool)
+	if got.Status.Lifecycle != corev1alpha1.RuntimePoolLifecycleStopping || got.Status.AdmissionState != corev1alpha1.RuntimePoolAdmissionClosed {
+		t.Fatalf("status after identity-limited Pod deletion = %s/%s, want Stopping/Closed", got.Status.Lifecycle, got.Status.AdmissionState)
+	}
+	if err := r.Get(context.Background(), client.ObjectKeyFromObject(&pod), &corev1.Pod{}); !apierrors.IsNotFound(err) {
+		t.Fatalf("identity-limited runtime Pod still exists, err=%v", err)
+	}
+	if !deleteRecorder.podDeleteHadPreconditions || deleteRecorder.podDeleteUID != pod.UID || deleteRecorder.podDeleteResourceVersion == "" {
+		t.Fatalf(
+			"identity-limited Pod delete preconditions = present:%t uid:%q resourceVersion:%q, want exact UID %q and non-empty resourceVersion",
+			deleteRecorder.podDeleteHadPreconditions,
+			deleteRecorder.podDeleteUID,
+			deleteRecorder.podDeleteResourceVersion,
+			pod.UID,
+		)
+	}
+	deployment := runtimePoolTestDeployment(t, r, pool.Namespace, runtimePoolResourceName(pool.Namespace, pool.Name))
+	if got := ptr.Deref(deployment.Spec.Replicas, 0); got != 1 {
+		t.Fatalf("deployment replicas after Pod rotation = %d, want 1 for replacement", got)
+	}
+}
+
+func runtimePoolTestScheme(t *testing.T) *runtime.Scheme {
+	t.Helper()
+	scheme := runtime.NewScheme()
+	for _, add := range []func(*runtime.Scheme) error{
+		corev1alpha1.AddToScheme,
+		corev1.AddToScheme,
+		appsv1.AddToScheme,
+		networkingv1.AddToScheme,
+		policyv1.AddToScheme,
+	} {
+		if err := add(scheme); err != nil {
+			t.Fatalf("AddToScheme: %v", err)
+		}
+	}
+	return scheme
+}
+
+func runtimePoolTestObject(replicas int32) *corev1alpha1.RuntimePool {
+	const namespace = "tenant-a"
+	artifactDigest := "sha256:" + strings.Repeat("b", 64)
+	harnessProfile := harnessv2.RuntimeProfile{
+		ACPProfile:               harnessv2.ACPProfileV1,
+		AdapterDigests:           map[string]string{"codex-acp": artifactDigest},
+		ProviderKind:             runtimePoolProviderCodex,
+		Model:                    acpTestModel,
+		AgentConfigurationDigest: "sha256:" + strings.Repeat("c", 64),
+		ToolPolicyDigest:         "sha256:" + strings.Repeat("d", 64),
+		ApprovalPolicyDigest:     "sha256:" + strings.Repeat("e", 64),
+		MCPConfigurationDigest:   "sha256:" + strings.Repeat("f", 64),
+		WorkspaceIntent:          harnessv2.WorkspaceIntentRead,
+		ProxyCredentialRole:      "provider-inference",
+		ProxyCredentialScope:     "model:gpt-test",
+		ResourceClass:            "standard",
+	}
+	profileDigest, err := harnessv2.CanonicalProfileDigest(harnessProfile)
+	if err != nil {
+		panic(err)
+	}
+	return &corev1alpha1.RuntimePool{
+		TypeMeta: metav1.TypeMeta{APIVersion: corev1alpha1.GroupVersion.String(), Kind: "RuntimePool"},
+		ObjectMeta: metav1.ObjectMeta{
+			Name: runtimePoolProviderCodex, Namespace: namespace, UID: types.UID(namespace + "-" + runtimePoolProviderCodex + "-uid"), Generation: 1,
+			Labels: map[string]string{acpRuntimePoolLabel: "true"},
+		},
+		Spec: corev1alpha1.RuntimePoolSpec{
+			TrustDomain: corev1alpha1.RuntimePoolTrustDomain{Namespace: namespace, Identity: namespace + "/default"},
+			Runtime: corev1alpha1.RuntimePoolRuntimeSpec{
+				Image: "docker.io/sozercan/orka-acp@sha256:" + strings.Repeat("a", 64),
+				Profile: corev1alpha1.RuntimePoolProfileSpec{
+					ProtocolVersion:          corev1alpha1.RuntimePoolProtocolHarnessV2,
+					Digest:                   string(profileDigest),
+					DigestSchemaVersion:      strconv.FormatUint(uint64(harnessv2.ProfileDigestSchemaVersion), 10),
+					ACPProfile:               harnessProfile.ACPProfile,
+					AdapterDigests:           harnessProfile.AdapterDigests,
+					ProviderKind:             harnessProfile.ProviderKind,
+					Model:                    harnessProfile.Model,
+					AgentConfigurationDigest: harnessProfile.AgentConfigurationDigest,
+					ToolPolicyDigest:         harnessProfile.ToolPolicyDigest,
+					ApprovalPolicyDigest:     harnessProfile.ApprovalPolicyDigest,
+					MCPConfigurationDigest:   harnessProfile.MCPConfigurationDigest,
+					WorkspaceIntent:          corev1alpha1.WorkspaceIntent(harnessProfile.WorkspaceIntent),
+					ProxyCredentialRole:      harnessProfile.ProxyCredentialRole,
+					ProxyCredentialScope:     harnessProfile.ProxyCredentialScope,
+					ResourceClass:            harnessProfile.ResourceClass,
+				},
+			},
+			DesiredReplicas: replicas,
+			Capacity: &corev1alpha1.RuntimePoolCapacitySpec{
+				MaxResidentSessions: 10,
+				MaxRunningPrompts:   4,
+			},
+			ColdStartTimeoutSeconds: 120,
+		},
+	}
+}
+
+func runtimePoolTestReconciler(
+	t *testing.T,
+	scheme *runtime.Scheme,
+	supervisor RuntimePoolSupervisorClient,
+	objects ...client.Object,
+) *RuntimePoolReconciler {
+	t.Helper()
+	cl := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithStatusSubresource(&corev1alpha1.RuntimePool{}, &appsv1.Deployment{}, &corev1.Pod{}).
+		WithObjects(objects...).
+		Build()
+	r := &RuntimePoolReconciler{
+		Client: cl, Scheme: scheme, ControllerEpoch: 7, SupervisorClient: supervisor,
+		ControllerAPIURL: "http://orka-api.default.svc:8080", ControllerAPIPort: 8080,
+		WorkspaceArtifactMaxBytes: 100 << 20,
+		ProviderProxy: RuntimePoolProviderProxyConfig{
+			BaseURL: "http://provider-auth-proxy.orka-system.svc:8080", Namespace: "orka-system",
+			PodLabels:   map[string]string{"app.kubernetes.io/name": "orka", "app.kubernetes.io/component": "provider-auth-proxy"},
+			BearerToken: bytes.Clone(runtimePoolTestProviderToken),
+		},
+		AllowedImages: ACPRuntimeImages{Codex: "docker.io/sozercan/orka-acp@sha256:" + strings.Repeat("a", 64)},
+		Rand:          bytes.NewReader(bytes.Repeat([]byte{0x5a}, 4096)), Now: func() time.Time { return runtimePoolTestNow },
+	}
+	return r
+}
+
+func runtimePoolTestStartServing(
+	t *testing.T,
+	r *RuntimePoolReconciler,
+	pool *corev1alpha1.RuntimePool,
+	supervisor *fakeRuntimePoolSupervisorClient,
+	podName, podUID, podIP, bootID string,
+) (*appsv1.Deployment, corev1.Pod) {
+	t.Helper()
+	runtimePoolReconcile(t, r, pool)
+	deployment := runtimePoolTestDeployment(t, r, pool.Namespace, runtimePoolResourceName(pool.Namespace, pool.Name))
+	pod := runtimePoolReadyPodForDeployment(pool, deployment, podName, podUID, podIP)
+	runtimePoolTestCreatePod(t, r, &pod)
+	supervisor.probe = runtimePoolValidProbe(pool, &pod, bootID, false)
+	runtimePoolReconcile(t, r, pool)
+	status := runtimePoolTestGetPool(t, r, pool).Status
+	if status.Lifecycle != corev1alpha1.RuntimePoolLifecycleServing || status.AdmissionState != corev1alpha1.RuntimePoolAdmissionAccepting {
+		t.Fatalf("initial serving status = %s/%s, want Serving/Accepting", status.Lifecycle, status.AdmissionState)
+	}
+	return runtimePoolTestDeployment(t, r, pool.Namespace, deployment.Name), pod
+}
+
+func runtimePoolReadyPodForDeployment(
+	pool *corev1alpha1.RuntimePool,
+	deployment *appsv1.Deployment,
+	name, uid, ip string,
+) corev1.Pod {
+	pod := runtimePoolReadyPod(pool, deployment.Namespace, name, uid, ip)
+	pod.Labels = cloneStringMap(deployment.Spec.Template.Labels)
+	pod.Annotations = cloneStringMap(deployment.Spec.Template.Annotations)
+	return pod
+}
+
+func runtimePoolTestSetPodReady(t *testing.T, r *RuntimePoolReconciler, pod *corev1.Pod, ready bool) {
+	t.Helper()
+	current := &corev1.Pod{}
+	if err := r.Get(context.Background(), client.ObjectKeyFromObject(pod), current); err != nil {
+		t.Fatalf("get runtime Pod: %v", err)
+	}
+	want := corev1.ConditionFalse
+	if ready {
+		want = corev1.ConditionTrue
+	}
+	for i := range current.Status.Conditions {
+		if current.Status.Conditions[i].Type == corev1.PodReady {
+			current.Status.Conditions[i].Status = want
+			if err := r.Status().Update(context.Background(), current); err != nil {
+				t.Fatalf("update runtime Pod readiness: %v", err)
+			}
+			return
+		}
+	}
+	t.Fatal("runtime Pod has no Ready condition")
+}
+
+func runtimePoolTestCreatePod(t *testing.T, r *RuntimePoolReconciler, pod *corev1.Pod) {
+	t.Helper()
+	status := pod.Status.DeepCopy()
+	pod.Status = corev1.PodStatus{}
+	if err := r.Create(context.Background(), pod); err != nil {
+		t.Fatalf("create runtime Pod: %v", err)
+	}
+	pod.Status = *status
+	if err := r.Status().Update(context.Background(), pod); err != nil {
+		t.Fatalf("update runtime Pod status: %v", err)
+	}
+}
+
+func runtimePoolTestTokenFile(t *testing.T, token []byte) string {
+	t.Helper()
+	path := t.TempDir() + "/provider-token"
+	runtimePoolTestWriteTokenFile(t, path, token)
+	return path
+}
+
+func runtimePoolTestWriteTokenFile(t *testing.T, path string, token []byte) {
+	t.Helper()
+	if err := os.WriteFile(path, append(bytes.Clone(token), '\n'), 0o600); err != nil {
+		t.Fatalf("write provider token file: %v", err)
+	}
+}
+
+func runtimePoolTestRefreshProfileDigest(t *testing.T, pool *corev1alpha1.RuntimePool) {
+	t.Helper()
+	profile, err := runtimePoolHarnessProfile(pool.Spec.Runtime.Profile)
+	if err != nil {
+		t.Fatalf("build runtime profile: %v", err)
+	}
+	digest, err := harnessv2.CanonicalProfileDigest(profile)
+	if err != nil {
+		t.Fatalf("digest runtime profile: %v", err)
+	}
+	pool.Spec.Runtime.Profile.Digest = string(digest)
+}
+
+func runtimePoolTestAssertSecretsExist(t *testing.T, r *RuntimePoolReconciler, namespace, stage string, names ...string) {
+	t.Helper()
+	for _, name := range names {
+		if err := r.Get(context.Background(), types.NamespacedName{Namespace: namespace, Name: name}, &corev1.Secret{}); err != nil {
+			t.Fatalf("Secret %q was deleted %s: %v", name, stage, err)
+		}
+	}
+}
+
+func assertRuntimePoolProviderSecret(
+	t *testing.T,
+	r *RuntimePoolReconciler,
+	pool *corev1alpha1.RuntimePool,
+	generation string,
+	token []byte,
+) {
+	t.Helper()
+	var secrets corev1.SecretList
+	if err := r.List(context.Background(), &secrets, client.InNamespace(pool.Namespace), client.MatchingLabels{
+		runtimePoolUIDLabel: string(pool.UID),
+	}); err != nil {
+		t.Fatalf("list RuntimePool Secrets: %v", err)
+	}
+	for i := range secrets.Items {
+		secret := &secrets.Items[i]
+		if !strings.Contains(secret.Name, "-g"+generation) {
+			continue
+		}
+		if secret.Immutable == nil || !*secret.Immutable || !bytes.Equal(secret.Data[runtimePoolProviderTokenKey], token) {
+			t.Fatalf("provider Secret %q is not immutable or does not contain the intended token", secret.Name)
+		}
+		return
+	}
+	t.Fatalf("provider Secret for generation %q not found", generation)
+}
+
+func runtimePoolReconcile(t *testing.T, r *RuntimePoolReconciler, pool *corev1alpha1.RuntimePool) ctrl.Result {
+	t.Helper()
+	result, err := r.Reconcile(context.Background(), ctrl.Request{NamespacedName: types.NamespacedName{Namespace: pool.Namespace, Name: pool.Name}})
+	if err != nil {
+		t.Fatalf("Reconcile: %v", err)
+	}
+	return result
+}
+
+func runtimePoolReadyPod(pool *corev1alpha1.RuntimePool, namespace, name, uid, ip string) corev1.Pod {
+	pod := runtimePoolPendingPod(pool, namespace, name, uid)
+	pod.Status.Phase = corev1.PodRunning
+	pod.Status.PodIP = ip
+	pod.Status.Conditions = []corev1.PodCondition{
+		{Type: corev1.PodScheduled, Status: corev1.ConditionTrue},
+		{Type: corev1.PodReady, Status: corev1.ConditionTrue},
+	}
+	return pod
+}
+
+func runtimePoolPendingPod(pool *corev1alpha1.RuntimePool, namespace, name, uid string) corev1.Pod {
+	return corev1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: name, Namespace: namespace, UID: types.UID(uid),
+			Annotations: map[string]string{
+				runtimePoolProfileAnnotation:                 pool.Spec.Runtime.Profile.Digest,
+				runtimePoolProviderTokenGenerationAnnotation: runtimePoolProviderTokenGeneration(runtimePoolTestProviderToken),
+			},
+			Labels: map[string]string{
+				runtimePoolKeyLabel:       runtimePoolKey(pool.Namespace, pool.Name),
+				runtimePoolNameLabel:      pool.Name,
+				runtimePoolNamespaceLabel: pool.Namespace,
+				runtimePoolUIDLabel:       string(pool.UID),
+			},
+		},
+		Status: corev1.PodStatus{Phase: corev1.PodPending},
+	}
+}
+
+func runtimePoolValidProbe(pool *corev1alpha1.RuntimePool, pod *corev1.Pod, bootID string, draining bool) RuntimePoolProbeResult {
+	limits := harnessv2.DefaultProtocolLimits()
+	status := harnessv2.StatusResponse{
+		Protocol: harnessv2.ProtocolVersion,
+		Fence: harnessv2.Fence{
+			RuntimeInstanceID:          harnessv2.RuntimeInstanceID(runtimePoolRuntimeInstanceID(pod.UID, harnessv2.SupervisorBootID(bootID))),
+			SupervisorBootID:           harnessv2.SupervisorBootID(bootID),
+			ControllerEpoch:            7,
+			RuntimePoolUID:             harnessv2.RuntimePoolUID(pool.UID),
+			RuntimePoolGeneration:      uint64(pool.Generation),
+			RuntimeProfileDigest:       harnessv2.ProfileDigest(pool.Spec.Runtime.Profile.Digest),
+			ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+		},
+		Lifecycle: harnessv2.SupervisorLifecycleReady,
+		Drain:     harnessv2.DrainStatus{AcceptingNewSessions: true},
+		SessionIdentityCapacity: &harnessv2.SessionIdentityCapacity{
+			Total: 10_000, Remaining: 9_999, ExhaustionReserve: 1,
+		},
+		Timestamp: runtimePoolTestNow,
+	}
+	if draining {
+		status.Lifecycle = harnessv2.SupervisorLifecycleDraining
+		status.Drain = harnessv2.DrainStatus{
+			AcceptingNewSessions: false,
+			Requested:            true,
+			RequestedAt:          runtimePoolTestNow.Add(-time.Minute),
+			Reason:               "runtime_pool_scale_to_zero",
+		}
+	}
+	return RuntimePoolProbeResult{
+		Capabilities: harnessv2.CapabilitiesResponse{
+			Protocol: harnessv2.ProtocolVersion, Transport: "http+ndjson", ACPVersion: harnessv2.ACPProfileV1,
+			RuntimeProfileDigest:       harnessv2.ProfileDigest(pool.Spec.Runtime.Profile.Digest),
+			ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+			AdapterDigests:             map[string]string{"codex-acp": "sha256:" + strings.Repeat("b", 64)},
+			Limits:                     limits,
+			Provider: harnessv2.ProviderCapabilities{
+				ProviderKinds: []string{runtimePoolProviderCodex}, Models: []string{acpTestModel}, SupportsPermissions: true, SupportsCancel: true, SupportsTools: true,
+			},
+			WorkspaceGovernance: harnessv2.StrictWorkspaceGovernanceCapabilities(),
+			SupportsDrain:       true,
+		},
+		Status: status,
+	}
+}
+
+func runtimePoolTestDeployment(t *testing.T, r *RuntimePoolReconciler, namespace, name string) *appsv1.Deployment {
+	t.Helper()
+	var deployment appsv1.Deployment
+	if err := r.Get(context.Background(), types.NamespacedName{Namespace: namespace, Name: name}, &deployment); err != nil {
+		t.Fatalf("Get Deployment: %v", err)
+	}
+	return &deployment
+}
+
+func runtimePoolTestGetPool(t *testing.T, r *RuntimePoolReconciler, pool *corev1alpha1.RuntimePool) corev1alpha1.RuntimePool {
+	t.Helper()
+	var got corev1alpha1.RuntimePool
+	if err := r.Get(context.Background(), types.NamespacedName{Namespace: pool.Namespace, Name: pool.Name}, &got); err != nil {
+		t.Fatalf("Get RuntimePool: %v", err)
+	}
+	return got
+}
+
+func runtimePoolTestVolume(volumes []corev1.Volume, name string) *corev1.Volume {
+	for i := range volumes {
+		if volumes[i].Name == name {
+			return &volumes[i]
+		}
+	}
+	return nil
+}
+
+func capabilityStrings(values []corev1.Capability) []string {
+	result := make([]string, len(values))
+	for i := range values {
+		result[i] = string(values[i])
+	}
+	return result
+}
+
+func secretDataKeys(data map[string][]byte) []string {
+	keys := make([]string, 0, len(data))
+	for key := range data {
+		keys = append(keys, key)
+	}
+	return keys
+}
+
+func reflectStringMapEqual(left, right map[string]string) bool {
+	if len(left) != len(right) {
+		return false
+	}
+	for key, value := range left {
+		if right[key] != value {
+			return false
+		}
+	}
+	return true
+}
diff --git a/internal/controller/session_cleanup_recovery.go b/internal/controller/session_cleanup_recovery.go
new file mode 100644
index 000000000..9836757dc
--- /dev/null
+++ b/internal/controller/session_cleanup_recovery.go
@@ -0,0 +1,60 @@
+package controller
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/orka-agents/orka/internal/store"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+)
+
+const defaultSessionCleanupRecoveryInterval = 30 * time.Second
+
+type sessionCleanupFenceSource interface {
+	CurrentFence(context.Context) (store.ControllerEpochFence, error)
+}
+
+// SessionCleanupRecoveryManager replays durable cross-store Session deletion
+// intents after controller restart. It runs only on the elected controller.
+type SessionCleanupRecoveryManager struct {
+	cleanup  store.SessionCleanupRecoveryStore
+	fences   sessionCleanupFenceSource
+	interval time.Duration
+}
+
+// NewSessionCleanupRecoveryManager constructs the startup recovery runnable.
+func NewSessionCleanupRecoveryManager(cleanup store.SessionCleanupRecoveryStore, epochs *ControllerEpochManager) *SessionCleanupRecoveryManager {
+	return &SessionCleanupRecoveryManager{cleanup: cleanup, fences: epochs, interval: defaultSessionCleanupRecoveryInterval}
+}
+
+// Start retries pending cleanups until the manager context is cancelled.
+func (m *SessionCleanupRecoveryManager) Start(ctx context.Context) error {
+	if m == nil || m.cleanup == nil || m.fences == nil {
+		return fmt.Errorf("session cleanup recovery requires a cleanup store and controller epoch source")
+	}
+	interval := m.interval
+	if interval <= 0 {
+		interval = defaultSessionCleanupRecoveryInterval
+	}
+	logger := log.FromContext(ctx).WithName("session-cleanup-recovery")
+	timer := time.NewTimer(0)
+	defer timer.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-timer.C:
+			fence, err := m.fences.CurrentFence(ctx)
+			if err != nil {
+				logger.Error(err, "unable to acquire controller epoch for Session cleanup recovery")
+			} else if err := m.cleanup.ResumeSessionCleanups(ctx, fence); err != nil {
+				logger.Error(err, "one or more pending Session cleanups remain blocked")
+			}
+			timer.Reset(interval)
+		}
+	}
+}
+
+// NeedLeaderElection keeps recovery single-writer with the controller epoch.
+func (*SessionCleanupRecoveryManager) NeedLeaderElection() bool { return true }
diff --git a/internal/controller/session_cleanup_recovery_test.go b/internal/controller/session_cleanup_recovery_test.go
new file mode 100644
index 000000000..879172e01
--- /dev/null
+++ b/internal/controller/session_cleanup_recovery_test.go
@@ -0,0 +1,61 @@
+package controller
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+func TestSessionCleanupRecoveryManagerResumesWithCurrentFence(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	fence := store.ControllerEpochFence{Name: store.DefaultControllerEpochName, Epoch: 7, HolderID: "controller-a"}
+	cleanup := &recordingSessionCleanupRecovery{calls: make(chan store.ControllerEpochFence, 1)}
+	manager := &SessionCleanupRecoveryManager{
+		cleanup:  cleanup,
+		fences:   staticSessionCleanupFenceSource{fence: fence},
+		interval: time.Hour,
+	}
+	done := make(chan error, 1)
+	go func() { done <- manager.Start(ctx) }()
+	select {
+	case got := <-cleanup.calls:
+		if got != fence {
+			t.Fatalf("recovery fence = %#v, want %#v", got, fence)
+		}
+		cancel()
+	case <-time.After(5 * time.Second):
+		t.Fatal("Session cleanup recovery did not run")
+	}
+	select {
+	case err := <-done:
+		if err != nil {
+			t.Fatalf("Start() error = %v", err)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("Session cleanup recovery did not stop")
+	}
+	if !manager.NeedLeaderElection() {
+		t.Fatal("Session cleanup recovery must require leader election")
+	}
+}
+
+type recordingSessionCleanupRecovery struct {
+	calls chan store.ControllerEpochFence
+}
+
+func (r *recordingSessionCleanupRecovery) ResumeSessionCleanups(_ context.Context, fence store.ControllerEpochFence) error {
+	r.calls <- fence
+	return nil
+}
+
+type staticSessionCleanupFenceSource struct {
+	fence store.ControllerEpochFence
+	err   error
+}
+
+func (s staticSessionCleanupFenceSource) CurrentFence(context.Context) (store.ControllerEpochFence, error) {
+	return s.fence, s.err
+}
diff --git a/internal/controller/session_manager.go b/internal/controller/session_manager.go
index ef765195f..97ee8ea6c 100644
--- a/internal/controller/session_manager.go
+++ b/internal/controller/session_manager.go
@@ -22,6 +22,8 @@ import (
 type SessionManager struct {
 	store             store.SessionStore
 	gatewayEventStore store.GatewayEventStore
+	cleanupStore      store.SessionCleanupStore
+	epochs            *ControllerEpochManager
 }
 
 // NewSessionManager creates a new SessionManager backed by the given store.
@@ -36,6 +38,15 @@ func (m *SessionManager) SetGatewayEventStore(events store.GatewayEventStore) {
 	}
 }
 
+// SetACPSessionCleanup enables the hard-cutover cross-store Session deletion
+// path. It is configured only when ACP Kubernetes control storage is enabled.
+func (m *SessionManager) SetACPSessionCleanup(cleanup store.SessionCleanupStore, epochs *ControllerEpochManager) {
+	if m != nil {
+		m.cleanupStore = cleanup
+		m.epochs = epochs
+	}
+}
+
 // IsLocked checks if a session is locked by another task.
 func (m *SessionManager) IsLocked(ctx context.Context, task *corev1alpha1.Task) (bool, error) {
 	if event, ok, err := m.gatewayEventForTask(ctx, task); err != nil {
@@ -280,9 +291,30 @@ func (m *SessionManager) GetSession(ctx context.Context, namespace, name string)
 	return m.store.GetSession(ctx, namespace, name)
 }
 
-// DeleteSession deletes a session.
+// DeleteSession deletes a session. ACP-enabled deployments coordinate the
+// Kubernetes-authoritative controls before removing the SQLite transcript.
 func (m *SessionManager) DeleteSession(ctx context.Context, namespace, name string) error {
-	return m.store.DeleteSession(ctx, namespace, name)
+	if m.cleanupStore == nil {
+		return m.store.DeleteSession(ctx, namespace, name)
+	}
+	if m.epochs == nil {
+		return fmt.Errorf("ACP session cleanup requires a controller epoch manager")
+	}
+	fence, err := m.epochs.CurrentFence(ctx)
+	if err != nil {
+		return err
+	}
+	operationID := store.CanonicalControlID("session-cleanup", namespace, name)
+	operationDigest, err := acpDomainDigest("session-cleanup", map[string]string{
+		"namespace": namespace, "sessionName": name, "operationID": operationID,
+	})
+	if err != nil {
+		return err
+	}
+	return m.cleanupStore.ReclaimSession(ctx, store.ReclaimSessionRequest{
+		Namespace: namespace, SessionName: name, Fence: fence,
+		OperationID: operationID, OperationDigest: operationDigest, RequestedAt: time.Now().UTC(),
+	})
 }
 
 // ListSessions lists all sessions in a namespace.
diff --git a/internal/controller/session_manager_test.go b/internal/controller/session_manager_test.go
index 79b99a65d..c32ffc14c 100644
--- a/internal/controller/session_manager_test.go
+++ b/internal/controller/session_manager_test.go
@@ -29,6 +29,11 @@ func setupSessionManager() (*SessionManager, *sqlite.Store) {
 	return NewSessionManager(ss), ss
 }
 
+const (
+	sessionTestRoleUser      = "user"
+	sessionTestRoleAssistant = "assistant"
+)
+
 func TestNewSessionManager(t *testing.T) {
 	sm, _ := setupSessionManager()
 	if sm == nil {
@@ -390,8 +395,8 @@ func TestSessionManager_LoadTranscript_WithMessages(t *testing.T) {
 		SessionType: "task",
 	}))
 	require.NoError(t, ss.AppendMessages(ctx, "default", "test-session", []store.SessionMessage{
-		{Role: "user", Content: "hello"},
-		{Role: "assistant", Content: "hi"},
+		{Role: sessionTestRoleUser, Content: "hello"},
+		{Role: sessionTestRoleAssistant, Content: "hi"},
 	}))
 
 	task := &corev1alpha1.Task{
@@ -426,11 +431,11 @@ func TestSessionManager_LoadTranscript_MaxMessages(t *testing.T) {
 		SessionType: "task",
 	}))
 	require.NoError(t, ss.AppendMessages(ctx, "default", "test-session", []store.SessionMessage{
-		{Role: "user", Content: "msg1"},
-		{Role: "assistant", Content: "msg2"},
-		{Role: "user", Content: "msg3"},
-		{Role: "assistant", Content: "msg4"},
-		{Role: "user", Content: "msg5"},
+		{Role: sessionTestRoleUser, Content: "msg1"},
+		{Role: sessionTestRoleAssistant, Content: "msg2"},
+		{Role: sessionTestRoleUser, Content: "msg3"},
+		{Role: sessionTestRoleAssistant, Content: "msg4"},
+		{Role: sessionTestRoleUser, Content: "msg5"},
 	}))
 
 	task := &corev1alpha1.Task{
@@ -619,10 +624,10 @@ func TestSessionManager_AppendMessages_WithPromptAndResult(t *testing.T) {
 	if len(msgs) != 2 {
 		t.Fatalf("expected 2 messages, got %d", len(msgs))
 	}
-	if msgs[0].Role != "user" || msgs[0].Content != "What is the answer?" {
+	if msgs[0].Role != sessionTestRoleUser || msgs[0].Content != "What is the answer?" {
 		t.Errorf("user message = %v, want user/What is the answer?", msgs[0])
 	}
-	if msgs[1].Role != "assistant" || msgs[1].Content != "Here is the answer" {
+	if msgs[1].Role != sessionTestRoleAssistant || msgs[1].Content != "Here is the answer" {
 		t.Errorf("assistant message = %v, want assistant/Here is the answer", msgs[1])
 	}
 }
@@ -702,7 +707,7 @@ func TestSessionManager_AppendMessages_NilResultStore(t *testing.T) {
 	if len(msgs) != 1 {
 		t.Fatalf("expected only the user message to be appended, got %d messages", len(msgs))
 	}
-	if msgs[0].Role != "user" || msgs[0].Content != "What is the answer?" {
+	if msgs[0].Role != sessionTestRoleUser || msgs[0].Content != "What is the answer?" {
 		t.Errorf("user message = %v, want user/What is the answer?", msgs[0])
 	}
 }
diff --git a/internal/controller/substrate_actor_pool_controller.go b/internal/controller/substrate_actor_pool_controller.go
index 39a2f6c97..d65ff01c3 100644
--- a/internal/controller/substrate_actor_pool_controller.go
+++ b/internal/controller/substrate_actor_pool_controller.go
@@ -241,10 +241,7 @@ func (r *SubstrateActorPoolReconciler) updateSubstrateActorPoolStatus(
 
 func sanitizeSubstrateActorPoolMessage(message string) string {
 	message = strings.TrimSpace(message)
-	if len(message) > 1024 {
-		return message[:1024]
-	}
-	return message
+	return truncateUTF8(strings.ToValidUTF8(message, "�"), 1024)
 }
 
 func validateSubstrateActorPoolTargetActors(poolNamespace, poolName string, targetActors int32, allowZero bool) error {
diff --git a/internal/controller/task_controller.go b/internal/controller/task_controller.go
index 06cf97f42..f58341e0b 100644
--- a/internal/controller/task_controller.go
+++ b/internal/controller/task_controller.go
@@ -41,9 +41,12 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	workspacev1alpha1 "github.com/orka-agents/orka/api/workspace/v1alpha1"
 	"github.com/orka-agents/orka/internal/approvals"
+	"github.com/orka-agents/orka/internal/artifactcap"
 	execevents "github.com/orka-agents/orka/internal/events"
 	"github.com/orka-agents/orka/internal/labels"
 	"github.com/orka-agents/orka/internal/outboundaccess"
@@ -68,6 +71,7 @@ const (
 	maxRecentResolvedApprovalsForWorkerEnv        = 32
 	maxResolvedApprovalWorkerEnvFieldBytes        = 512
 	resolvedApprovalWorkerEnvJSONOverheadEstimate = 128
+	workspaceFinalizationTimeout                  = 5 * time.Minute
 
 	eventInvolvedObjectNameField = "involvedObject.name"
 	eventReasonField             = "reason"
@@ -87,8 +91,8 @@ const (
 	// has not observed the Job immediately after create.
 	jobCreationVisibilityGracePeriod = 30 * time.Second
 
-	workerClusterRoleBindingRecreateInterval = 100 * time.Millisecond
-	workerClusterRoleBindingRecreateTimeout  = 5 * time.Second
+	workerRoleBindingRecreateInterval = 100 * time.Millisecond
+	workerRoleBindingRecreateTimeout  = 5 * time.Second
 
 	booleanTrueValue       = "true"
 	scheduledRunLabelValue = booleanTrueValue
@@ -100,41 +104,58 @@ const (
 // TaskReconciler reconciles a Task object
 type TaskReconciler struct {
 	client.Client
-	APIReader                          client.Reader
-	Scheme                             *runtime.Scheme
-	JobBuilder                         *JobBuilder
-	SessionManager                     *SessionManager
-	WebhookNotifier                    *WebhookNotifier
-	Recorder                           record.EventRecorder
-	KubeClient                         kubernetes.Interface
-	OutboundAccessResolver             outboundaccess.Resolver
-	BrokeredTransactionExchange        *workerpkg.TransactionExchangeConfig
-	ResultStore                        store.ResultStore
-	PlanStore                          store.PlanStore
-	MessageStore                       store.MessageStore
-	ArtifactStore                      store.ArtifactStore
-	ExecutionEventStore                store.ExecutionEventStore
-	EnforceNamespaceIsolation          bool
-	MaxTasksPerNamespace               int32
-	ExecutionWorkspaceDefaultProvider  corev1alpha1.WorkspaceProvider
-	WorkspaceProviderAPIEnabled        bool
-	AgentSandboxEnabled                bool
-	AgentSandboxConfig                 AgentSandboxConfig
-	SubstrateEnabled                   bool
-	SubstrateConfig                    SubstrateConfig
-	SubstrateExecutorFactory           func(SubstrateConfig) (workspace.WorkspaceExecutor, error)
-	AIWorkerServiceAccountName         string
-	VendorWorkerServiceAccountName     string
-	ContainerWorkerServiceAccountName  string
-	AIWorkerClusterRoleName            string
-	VendorWorkerClusterRoleName        string
-	ContainerWorkerClusterRoleName     string
-	WorkerClusterRoleBindingNamePrefix string
-	EnforceTransactionCredentialAuth   bool
-	TransactionCredentialReadScopes    []string
-	OutboundAccessTrust                outboundaccess.TrustConfig
-	trustedServiceCleanupMu            sync.RWMutex
-	trustedServiceCleanupDone          bool
+	APIReader                         client.Reader
+	Scheme                            *runtime.Scheme
+	JobBuilder                        *JobBuilder
+	SessionManager                    *SessionManager
+	WebhookNotifier                   *WebhookNotifier
+	Recorder                          record.EventRecorder
+	KubeClient                        kubernetes.Interface
+	OutboundAccessResolver            outboundaccess.Resolver
+	BrokeredTransactionExchange       *workerpkg.TransactionExchangeConfig
+	ResultStore                       store.ResultStore
+	PlanStore                         store.PlanStore
+	MessageStore                      store.MessageStore
+	ArtifactStore                     store.ArtifactStore
+	ExecutionEventStore               store.ExecutionEventStore
+	DurableControlStore               store.DurableControlStore
+	AgentExecutionSnapshots           store.AgentExecutionSnapshotStore
+	MCPRegistry                       *tools.Registry
+	ACPArtifactRetirer                artifactcap.IdentityRetirer
+	ACPPublicationReclaimer           ACPPublicationReclaimer
+	ControllerEpochManager            *ControllerEpochManager
+	ACPAdmissionGate                  *ACPAdmissionGate
+	HarnessV1Enabled                  bool
+	HarnessV1Endpoint                 string
+	HarnessV1AuthSecretNamespace      string
+	HarnessV1AuthSecretName           string
+	HarnessV1AuthSecretKey            string
+	HarnessV1Attempts                 store.HarnessV1AttemptStore
+	HarnessV1SettlementAcknowledger   HarnessV1SettlementAcknowledger
+	ACPRuntimeEnabled                 bool
+	ACPRuntimeImages                  ACPRuntimeImages
+	ACPRuntimeNamespace               string
+	EnforceNamespaceIsolation         bool
+	MaxTasksPerNamespace              int32
+	ExecutionWorkspaceDefaultProvider corev1alpha1.WorkspaceProvider
+	WorkspaceProviderAPIEnabled       bool
+	AgentSandboxEnabled               bool
+	AgentSandboxConfig                AgentSandboxConfig
+	SubstrateEnabled                  bool
+	SubstrateConfig                   SubstrateConfig
+	SubstrateExecutorFactory          func(SubstrateConfig) (workspace.WorkspaceExecutor, error)
+	AIWorkerServiceAccountName        string
+	VendorWorkerServiceAccountName    string
+	ContainerWorkerServiceAccountName string
+	AIWorkerClusterRoleName           string
+	VendorWorkerClusterRoleName       string
+	ContainerWorkerClusterRoleName    string
+	WorkerRoleBindingNamePrefix       string
+	EnforceTransactionCredentialAuth  bool
+	TransactionCredentialReadScopes   []string
+	OutboundAccessTrust               outboundaccess.TrustConfig
+	trustedServiceCleanupMu           sync.RWMutex
+	trustedServiceCleanupDone         bool
 }
 
 // +kubebuilder:rbac:groups=core.orka.ai,resources=tasks,verbs=get;list;watch;create;update;patch;delete
@@ -168,7 +189,6 @@ type TaskReconciler struct {
 // +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles;roles;rolebindings,verbs=get;list;watch
 // +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles,verbs=create;update;delete
 // +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=rolebindings,verbs=create;update;delete
-// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterrolebindings,verbs=get;list;watch;create;update;delete
 // +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles,resourceNames=ai-worker-role;vendor-worker-role;container-worker-role,verbs=bind
 // +kubebuilder:rbac:groups=storage.k8s.io,resources=storageclasses,verbs=get;list;watch
 // +kubebuilder:rbac:groups=events.k8s.io,resources=events,verbs=get;list
@@ -182,6 +202,33 @@ type TaskReconciler struct {
 
 // updateStatusWithRetry updates the task status with retry on conflict.
 // It re-fetches the task on conflict, applies the mutate function, and retries.
+func (r *TaskReconciler) taskMetadataReader() client.Reader {
+	if r.APIReader != nil {
+		return r.APIReader
+	}
+	return r.Client
+}
+
+func (r *TaskReconciler) patchTaskFinalizer(ctx context.Context, key types.NamespacedName, present bool) error {
+	return retry.RetryOnConflict(retry.DefaultBackoff, func() error {
+		current := &corev1alpha1.Task{}
+		if err := r.taskMetadataReader().Get(ctx, key, current); err != nil {
+			return err
+		}
+		hasFinalizer := controllerutil.ContainsFinalizer(current, labels.TaskFinalizer)
+		if hasFinalizer == present {
+			return nil
+		}
+		base := current.DeepCopy()
+		if present {
+			controllerutil.AddFinalizer(current, labels.TaskFinalizer)
+		} else {
+			controllerutil.RemoveFinalizer(current, labels.TaskFinalizer)
+		}
+		return r.Patch(ctx, current, client.MergeFromWithOptions(base, client.MergeFromWithOptimisticLock{}))
+	})
+}
+
 func (r *TaskReconciler) updateStatusWithRetry(ctx context.Context, task *corev1alpha1.Task, mutate func(*corev1alpha1.Task)) error {
 	return retry.RetryOnConflict(retry.DefaultBackoff, func() error {
 		// On retry, re-fetch the latest version
@@ -239,7 +286,6 @@ func (r *TaskReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.
 		log.Error(err, "unable to fetch Task")
 		return ctrl.Result{}, err
 	}
-
 	if tx := task.Spec.Transaction; tx != nil {
 		values := []any{}
 		if tx.ID != "" {
@@ -285,16 +331,11 @@ func (r *TaskReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.
 		return r.handleDeletion(ctx, task)
 	}
 
-	// Add finalizer if not present
+	// Add the finalizer with a metadata-only optimistic patch. A full-object
+	// update can re-serialize equivalent duration strings (for example 12m as
+	// 12m0s) and trip immutable-spec admission rules.
 	if !controllerutil.ContainsFinalizer(task, labels.TaskFinalizer) {
-		controllerutil.AddFinalizer(task, labels.TaskFinalizer)
-		if err := retry.RetryOnConflict(retry.DefaultBackoff, func() error {
-			if err := r.Get(ctx, types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, task); err != nil {
-				return err
-			}
-			controllerutil.AddFinalizer(task, labels.TaskFinalizer)
-			return r.Update(ctx, task)
-		}); err != nil {
+		if err := r.patchTaskFinalizer(ctx, req.NamespacedName, true); err != nil {
 			log.Error(err, "failed to add finalizer")
 			span.RecordError(err)
 			span.SetStatus(codes.Error, err.Error())
@@ -468,11 +509,44 @@ func executionEventTypeForTaskPhase(phase corev1alpha1.TaskPhase) string {
 	}
 }
 
-// handleDeletion handles Task cleanup when deleted
-func (r *TaskReconciler) handleDeletion(ctx context.Context, task *corev1alpha1.Task) (ctrl.Result, error) { //nolint:unparam // Result is always nil but kept for interface consistency
+// handleDeletion handles Task cleanup when deleted.
+//
+//nolint:gocyclo,unparam // Cleanup ordering is intentionally kept in one auditable flow; Result is retained for consistency.
+func (r *TaskReconciler) handleDeletion(ctx context.Context, task *corev1alpha1.Task) (ctrl.Result, error) {
 	log := logf.FromContext(ctx)
 
 	if controllerutil.ContainsFinalizer(task, labels.TaskFinalizer) {
+		if taskManagedByHarnessV1(task) {
+			ready, err := r.harnessV1TaskDeletionReady(ctx, task)
+			if err != nil {
+				return ctrl.Result{}, err
+			}
+			if !ready {
+				return ctrl.Result{RequeueAfter: 2 * time.Second}, nil
+			}
+		} else {
+			ready, err := r.acpTaskDeletionReady(ctx, task)
+			if err != nil {
+				return ctrl.Result{}, err
+			}
+			if !ready {
+				return ctrl.Result{RequeueAfter: 2 * time.Second}, nil
+			}
+			reclaimed, err := r.reclaimACPTaskPublicationBundles(ctx, task)
+			if err != nil {
+				return ctrl.Result{}, err
+			}
+			if !reclaimed {
+				return ctrl.Result{RequeueAfter: 2 * time.Second}, nil
+			}
+			retired, err := r.retireACPArtifactIdentities(ctx, task)
+			if err != nil {
+				return ctrl.Result{}, err
+			}
+			if !retired {
+				return ctrl.Result{RequeueAfter: 2 * time.Second}, nil
+			}
+		}
 		// Clean up result data from store
 		if r.ResultStore != nil {
 			if err := r.ResultStore.DeleteResult(ctx, task.Namespace, task.Name); err != nil {
@@ -516,18 +590,6 @@ func (r *TaskReconciler) handleDeletion(ctx context.Context, task *corev1alpha1.
 			}
 		}
 
-		if cancelErr := r.cancelHarnessWrapperTurn(ctx, task, "task deleted"); cancelErr != nil {
-			if isAgentRuntimeDependencyNotReady(cancelErr) {
-				if shouldWait, waitErr := r.waitForHarnessCancelDependency(ctx, task); waitErr != nil {
-					return ctrl.Result{}, waitErr
-				} else if shouldWait {
-					log.Info("waiting to cancel deleted harness runtime turn", "error", cancelErr)
-					return ctrl.Result{RequeueAfter: time.Second}, nil
-				}
-			}
-			log.Error(cancelErr, "failed to cancel deleted harness runtime turn")
-		}
-
 		waitingForJob, err := r.cleanupDeletedTaskJob(ctx, task)
 		if err != nil {
 			log.Error(err, "failed to delete Job")
@@ -553,9 +615,14 @@ func (r *TaskReconciler) handleDeletion(ctx context.Context, task *corev1alpha1.
 			}
 		}
 
-		// Remove finalizer
-		controllerutil.RemoveFinalizer(task, labels.TaskFinalizer)
-		if err := r.Update(ctx, task); err != nil && !apierrors.IsNotFound(err) {
+		// Remove the finalizer with the same metadata-only patch used for
+		// addition so immutable Task spec fields are never re-serialized.
+		key := types.NamespacedName{Name: task.Name, Namespace: task.Namespace}
+		if err := r.patchTaskFinalizer(ctx, key, false); err != nil {
+			if apierrors.IsNotFound(err) {
+				return ctrl.Result{}, nil
+			}
+
 			log.Error(err, "failed to remove finalizer")
 			return ctrl.Result{}, err
 		}
@@ -567,7 +634,9 @@ func (r *TaskReconciler) handleDeletion(ctx context.Context, task *corev1alpha1.
 	return ctrl.Result{}, nil
 }
 
-// handlePending handles Tasks in Pending phase
+// handlePending handles Tasks in Pending phase.
+//
+//nolint:gocyclo // Pending routing keeps every mutually exclusive execution path in one auditable state machine.
 func (r *TaskReconciler) handlePending(ctx context.Context, task *corev1alpha1.Task) (ctrl.Result, error) {
 	log := logf.FromContext(ctx)
 
@@ -575,7 +644,6 @@ func (r *TaskReconciler) handlePending(ctx context.Context, task *corev1alpha1.T
 		log.Info("refusing to replay task with immutable execution outcome", "outcome", outcome.Phase)
 		return r.completeTask(ctx, task, outcome.Phase, outcome.Message)
 	}
-
 	if err := r.clearApprovalDecisionNudge(ctx, task); err != nil {
 		log.Error(err, "failed to clear durable approval decision nudge")
 		return ctrl.Result{}, err
@@ -585,13 +653,29 @@ func (r *TaskReconciler) handlePending(ctx context.Context, task *corev1alpha1.T
 		return r.handleTransactionTokenPending(ctx, task)
 	}
 
-	// If this is a scheduled task, validate cron and transition to Scheduled phase
+	// Scheduled parent Tasks own a recurring fire-time lifecycle; per-run timeout
+	// enforcement begins on the generated child Task rather than at parent creation.
 	if task.Spec.Schedule != "" {
 		return r.handleScheduledTask(ctx, task)
 	}
 
-	// Check session lock if session is referenced
-	if task.Spec.SessionRef != nil {
+	// A persisted execution binding is the sole routing and recovery authority.
+	// Do not resolve mutable Agent/configuration state, or acquire the legacy
+	// SQLite Session lock, after a Task has been bound to either harness plane.
+	if task.Spec.Type == corev1alpha1.TaskTypeAgent && task.Status.AgentExecutionBinding != nil {
+		return r.handleBoundAgentTaskPending(ctx, task)
+	}
+	if task.Spec.Type == corev1alpha1.TaskTypeAgent && task.Status.Execution == nil {
+		now := time.Now().UTC()
+		if deadline, ok := acpTaskDeadline(task, now); ok && !now.Before(deadline) {
+			return r.cancelACPTaskBeforeDurableAttempt(ctx, task, "task deadline exceeded before runtime admission")
+		}
+	}
+
+	// Non-agent workers retain the legacy Session lock lifecycle. Agent Tasks
+	// claim protocol lineage and a fenced SessionTurn in their dispatcher only
+	// after the immutable execution binding has selected v1 or v2.
+	if task.Spec.SessionRef != nil && task.Spec.Type != corev1alpha1.TaskTypeAgent {
 		if result, err, locked := r.acquireSessionLock(ctx, task); locked {
 			return result, err
 		}
@@ -661,10 +745,20 @@ func (r *TaskReconciler) handlePending(ctx context.Context, task *corev1alpha1.T
 		switch plan.path {
 		case agentExecutionPathRejected:
 			return r.rejectPlannedAgentExecution(ctx, task, plan)
-		case agentExecutionPathWorkerJob:
-			return r.createTaskJob(ctx, task, agent, provider)
-		case agentExecutionPathHarnessWrapper:
-			return r.runHarnessWrapperTask(ctx, task, agent)
+		case agentExecutionPathACP:
+			if result, err, handled := r.ensureAgentExecutionBinding(ctx, task, agent); handled {
+				return result, err
+			}
+			return r.queueACPRuntimeTask(ctx, task, agent)
+		case agentExecutionPathHarnessV1:
+			if result, err, handled := r.ensureHarnessV1ExecutionBinding(ctx, task, agent); handled {
+				return result, err
+			}
+			return r.queueHarnessV1Task(ctx, task)
+		case agentExecutionPathExternal:
+			return r.rejectPlannedAgentExecution(ctx, task, rejectAgentExecutionPlan(
+				externalAgentRuntimeDispatchUnsupportedReason(plan.externalRuntimeName),
+			))
 		default:
 			return ctrl.Result{}, fmt.Errorf("unknown agent execution path %q", plan.path)
 		}
@@ -673,6 +767,32 @@ func (r *TaskReconciler) handlePending(ctx context.Context, task *corev1alpha1.T
 	return r.createTaskJob(ctx, task, agent, provider)
 }
 
+func (r *TaskReconciler) handleBoundAgentTaskPending(
+	ctx context.Context,
+	task *corev1alpha1.Task,
+) (ctrl.Result, error) {
+	binding := task.Status.AgentExecutionBinding
+	if binding == nil {
+		return ctrl.Result{}, errors.New("bound agent Task is missing its execution binding")
+	}
+	switch binding.ContractVersion {
+	case corev1alpha1.AgentRuntimeContractHarnessV1:
+		if result, err, handled := r.ensureHarnessV1ExecutionBinding(ctx, task, nil); handled {
+			return result, err
+		}
+		return r.queueHarnessV1Task(ctx, task)
+	case corev1alpha1.AgentRuntimeContractHarnessV2:
+		if result, err, handled := r.ensureAgentExecutionBinding(ctx, task, nil); handled {
+			return result, err
+		}
+		return r.queueACPRuntimeTask(ctx, task, nil)
+	default:
+		return r.failTask(ctx, task, fmt.Sprintf(
+			"immutable execution binding has unsupported contract %q", binding.ContractVersion,
+		))
+	}
+}
+
 func taskTransactionTokenPending(task *corev1alpha1.Task) bool {
 	if task == nil || task.Annotations == nil {
 		return false
@@ -835,7 +955,12 @@ func (r *TaskReconciler) validateCoordinationConstraints(ctx context.Context, ta
 
 	log := logf.FromContext(ctx)
 	parentName := labels.ParentTaskName(task.Labels, task.Annotations)
-	depthInt, _ := strconv.Atoi(depthStr)
+	depthValue, parseErr := strconv.ParseInt(depthStr, 10, 32)
+	if parseErr != nil || depthValue < 0 || strconv.FormatInt(depthValue, 10) != depthStr {
+		result, err := r.failTask(ctx, task, "coordination depth annotation is invalid")
+		return result, err, true
+	}
+	depth := int32(depthValue)
 
 	// Look up parent task to find its agent's coordination config
 	parentTask := &corev1alpha1.Task{}
@@ -865,8 +990,8 @@ func (r *TaskReconciler) validateCoordinationConstraints(ctx context.Context, ta
 	}
 
 	// Enforce maxDepth
-	if coord.MaxDepth > 0 && int32(depthInt) > coord.MaxDepth {
-		result, err := r.failTask(ctx, task, fmt.Sprintf("coordination depth %d exceeds max %d", depthInt, coord.MaxDepth))
+	if coord.MaxDepth > 0 && depth > coord.MaxDepth {
+		result, err := r.failTask(ctx, task, fmt.Sprintf("coordination depth %d exceeds max %d", depth, coord.MaxDepth))
 		return result, err, true
 	}
 
@@ -1623,6 +1748,17 @@ func taskExecutionWorkspaceReason(task *corev1alpha1.Task) corev1alpha1.Executio
 func (r *TaskReconciler) handleRunning(ctx context.Context, task *corev1alpha1.Task) (ctrl.Result, error) { //nolint:gocyclo
 	log := logf.FromContext(ctx)
 
+	if taskManagedByACP(task) {
+		// The leader-elected ACPDispatcher owns the non-reconnectable prompt stream,
+		// lease renewal, cancellation barrier, and terminal status projection.
+		return ctrl.Result{RequeueAfter: time.Second}, nil
+	}
+	if taskManagedByHarnessV1(task) {
+		// HarnessV1Dispatcher owns submission, stream recovery, cancellation,
+		// terminal settlement, and Task projection for binding-gated v1 work.
+		return ctrl.Result{RequeueAfter: time.Second}, nil
+	}
+
 	// Check timeout
 	if task.Spec.Timeout != nil && task.Status.StartTime != nil {
 		elapsed := time.Since(task.Status.StartTime.Time)
@@ -1631,26 +1767,12 @@ func (r *TaskReconciler) handleRunning(ctx context.Context, task *corev1alpha1.T
 				return result, err
 			}
 			log.Info("task timed out", "elapsed", elapsed, "timeout", task.Spec.Timeout.Duration)
-			if cancelErr := r.cancelHarnessWrapperTurn(ctx, task, "task timed out"); cancelErr != nil {
-				if isAgentRuntimeDependencyNotReady(cancelErr) {
-					if shouldWait, waitErr := r.waitForHarnessCancelDependency(ctx, task); waitErr != nil {
-						return ctrl.Result{}, waitErr
-					} else if shouldWait {
-						log.Info("waiting to cancel timed-out harness runtime turn", "error", cancelErr)
-						return ctrl.Result{RequeueAfter: time.Second}, nil
-					}
-				}
-				log.Error(cancelErr, "failed to cancel timed-out harness runtime turn")
-			}
 			return r.failTask(ctx, task, "task timed out")
 		}
 	}
 
-	if task.Spec.Type == corev1alpha1.TaskTypeAgent && taskHasHarnessWrapperTurn(task) {
-		return r.finishHarnessWrapperTask(ctx, task)
-	}
 	if task.Spec.Type == corev1alpha1.TaskTypeAgent && strings.TrimSpace(task.Status.JobName) == "" {
-		return r.failTask(ctx, task, "harness runtime turn identity is missing")
+		return r.failTask(ctx, task, "agent task is not managed by the ACP runtime dispatcher")
 	}
 
 	// Populate ChildTaskStatus for coordinator tasks
@@ -1838,6 +1960,12 @@ func (r *TaskReconciler) handleRunning(ctx context.Context, task *corev1alpha1.T
 	return ctrl.Result{RequeueAfter: 5 * time.Second}, nil
 }
 
+func taskManagedByHarnessV1(task *corev1alpha1.Task) bool {
+	return task != nil && task.Spec.Type == corev1alpha1.TaskTypeAgent &&
+		task.Status.AgentExecutionBinding != nil &&
+		task.Status.AgentExecutionBinding.ContractVersion == corev1alpha1.AgentRuntimeContractHarnessV1
+}
+
 func podWaitingForMountInitialization(pod *corev1.Pod) bool {
 	if pod == nil {
 		return false
@@ -2088,36 +2216,113 @@ func (r *TaskReconciler) handleFinalizing(
 	if outcome == nil {
 		return r.completeTask(ctx, task, corev1alpha1.TaskPhaseFailed, "finalizing task is missing execution outcome")
 	}
-	workspaceStatus := task.Status.ExecutionWorkspace
-	if workspaceStatus != nil && workspaceStatus.AttachedEpoch > 0 {
-		attached := true
-		if condition := meta.FindStatusCondition(workspaceStatus.Conditions, "Attached"); condition != nil {
-			attached = condition.Status != metav1.ConditionFalse
+	if !outcome.RecordedAt.IsZero() && time.Since(outcome.RecordedAt.Time) >= workspaceFinalizationTimeout {
+		if err := r.quarantineFinalizingWorkspace(ctx, task); err != nil {
+			return ctrl.Result{}, err
 		}
-		if attached {
+		return r.completeTask(ctx, task, corev1alpha1.TaskPhaseFailed, "workspace authority revocation timed out; workspace quarantined")
+	}
+	if taskExecutionWorkspaceNeedsFinalization(task) {
+		workspaceStatus := task.Status.ExecutionWorkspace
+		if workspaceStatus == nil || workspaceStatus.WorkspaceRef == nil || workspaceStatus.AttachedEpoch <= 0 {
 			return ctrl.Result{RequeueAfter: 2 * time.Second}, nil
 		}
+		workspaceObject := &workspacev1alpha1.ExecutionWorkspace{}
+		key := types.NamespacedName{Namespace: task.Namespace, Name: workspaceStatus.WorkspaceRef.Name}
+		if err := r.Get(ctx, key, workspaceObject); err != nil {
+			if apierrors.IsNotFound(err) {
+				return r.completeTask(ctx, task, outcome.Phase, outcome.Message)
+			}
+			return ctrl.Result{}, err
+		}
+		if workspaceStatus.WorkspaceRef.UID != "" && string(workspaceObject.UID) != workspaceStatus.WorkspaceRef.UID {
+			return ctrl.Result{}, fmt.Errorf("execution workspace UID changed during finalization")
+		}
+		attachmentManager := WorkspaceAttachmentManager{Client: r.Client}
+		if err := attachmentManager.BeginRevocation(ctx, workspaceObject, workspaceStatus.AttachedEpoch); err != nil {
+			return ctrl.Result{}, err
+		}
+		return ctrl.Result{RequeueAfter: 2 * time.Second}, nil
+	}
+	workspaceStatus := task.Status.ExecutionWorkspace
+	if workspaceStatus != nil && workspaceStatus.WorkspaceRef != nil && workspaceStatus.AttachedEpoch > 0 {
+		workspaceObject := &workspacev1alpha1.ExecutionWorkspace{}
+		key := types.NamespacedName{Namespace: task.Namespace, Name: workspaceStatus.WorkspaceRef.Name}
+		if err := r.Get(ctx, key, workspaceObject); err == nil {
+			if workspaceStatus.WorkspaceRef.UID != "" && string(workspaceObject.UID) != workspaceStatus.WorkspaceRef.UID {
+				return ctrl.Result{}, fmt.Errorf("execution workspace UID changed during finalization")
+			}
+			attachmentManager := WorkspaceAttachmentManager{Client: r.Client}
+			if err := attachmentManager.FinalizeRevocation(ctx, workspaceObject, workspaceStatus.AttachedEpoch, attachmentSecretName(workspaceObject.Name, workspaceStatus.AttachedEpoch)); err != nil {
+				return ctrl.Result{RequeueAfter: 2 * time.Second}, nil
+			}
+		} else if !apierrors.IsNotFound(err) {
+			return ctrl.Result{}, err
+		}
 	}
 	return r.completeTask(ctx, task, outcome.Phase, outcome.Message)
 }
 
-func (r *TaskReconciler) handleCompleted(ctx context.Context, task *corev1alpha1.Task) (ctrl.Result, error) {
-	log := logf.FromContext(ctx)
-	terminalEventRecorded := r.recordTerminalTaskLifecycleEventIfMissing(ctx, task)
-	if task.Status.Phase == corev1alpha1.TaskPhaseCancelled {
-		if cancelErr := r.cancelHarnessWrapperTurn(ctx, task, "task cancelled"); cancelErr != nil {
-			if isAgentRuntimeDependencyNotReady(cancelErr) {
-				if shouldWait, waitErr := r.waitForHarnessCancelDependency(ctx, task); waitErr != nil {
-					return ctrl.Result{}, waitErr
-				} else if shouldWait {
-					log.Info("waiting to cancel harness runtime turn for cancelled task", "error", cancelErr)
-					return ctrl.Result{RequeueAfter: time.Second}, nil
-				}
+func (r *TaskReconciler) quarantineFinalizingWorkspace(ctx context.Context, task *corev1alpha1.Task) error {
+	if task == nil {
+		return nil
+	}
+	status := task.Status.ExecutionWorkspace
+	workspaces := []workspacev1alpha1.ExecutionWorkspace{}
+	if status != nil && status.WorkspaceRef != nil && strings.TrimSpace(status.WorkspaceRef.Name) != "" {
+		workspaceObject := workspacev1alpha1.ExecutionWorkspace{}
+		err := r.Get(ctx, types.NamespacedName{Namespace: task.Namespace, Name: status.WorkspaceRef.Name}, &workspaceObject)
+		if err != nil && !apierrors.IsNotFound(err) {
+			return err
+		}
+		if err == nil {
+			workspaces = append(workspaces, workspaceObject)
+		}
+	} else {
+		workspaceList := workspacev1alpha1.ExecutionWorkspaceList{}
+		if err := r.List(ctx, &workspaceList, client.InNamespace(task.Namespace)); err != nil {
+			return err
+		}
+		for index := range workspaceList.Items {
+			owner := metav1.GetControllerOf(&workspaceList.Items[index])
+			if owner != nil && owner.Kind == "Task" && owner.UID == task.UID {
+				workspaces = append(workspaces, workspaceList.Items[index])
 			}
-			log.Error(cancelErr, "failed to cancel harness runtime turn for cancelled task")
 		}
 	}
+	for index := range workspaces {
+		workspaceObject := &workspaces[index]
+		if status != nil && status.WorkspaceRef != nil && status.WorkspaceRef.UID != "" && string(workspaceObject.UID) != status.WorkspaceRef.UID {
+			return fmt.Errorf("execution workspace UID changed during quarantine")
+		}
+		epoch := workspaceObject.Spec.AttachmentEpoch
+		if status != nil {
+			epoch = max(epoch, status.AttachedEpoch)
+		}
+		before := workspaceObject.DeepCopy()
+		workspaceObject.Spec.AttachmentEpoch = epoch
+		workspaceObject.Spec.Attachment = nil
+		workspaceObject.Spec.DesiredState = workspacev1alpha1.ExecutionWorkspaceDesiredQuarantined
+		if err := r.Patch(ctx, workspaceObject, client.MergeFrom(before)); err != nil {
+			return err
+		}
+		if epoch > 0 {
+			secret := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: attachmentSecretName(workspaceObject.Name, epoch), Namespace: workspaceObject.Namespace}}
+			if err := r.Delete(ctx, secret); err != nil && !apierrors.IsNotFound(err) {
+				return err
+			}
+		}
+		lease := &coordinationv1.Lease{ObjectMeta: metav1.ObjectMeta{Name: attachmentLeaseName(workspaceObject.Name), Namespace: workspaceObject.Namespace}}
+		if err := r.Delete(ctx, lease); err != nil && !apierrors.IsNotFound(err) {
+			return err
+		}
+	}
+	return nil
+}
 
+func (r *TaskReconciler) handleCompleted(ctx context.Context, task *corev1alpha1.Task) (ctrl.Result, error) {
+	log := logf.FromContext(ctx)
+	terminalEventRecorded := r.recordTerminalTaskLifecycleEventIfMissing(ctx, task)
 	waitingForJob, err := r.cleanupTerminalTaskJob(ctx, task)
 	if err != nil {
 		log.Error(err, "failed to clean up terminal task Job")
@@ -2135,7 +2340,32 @@ func (r *TaskReconciler) handleCompleted(ctx context.Context, task *corev1alpha1
 		return ctrl.Result{RequeueAfter: 30 * time.Second}, nil
 	}
 
-	// Send webhook if configured and not already sent
+	if !terminalEventRecorded {
+		return ctrl.Result{RequeueAfter: time.Second}, nil
+	}
+
+	if r.ACPArtifactRetirer != nil && task.Spec.Type == corev1alpha1.TaskTypeAgent && task.Status.Execution != nil && r.DurableControlStore != nil {
+		ready, readyErr := r.acpTaskDeletionReady(ctx, task)
+		if readyErr != nil {
+			log.Error(readyErr, "failed to verify ACP artifact retirement readiness")
+			return ctrl.Result{RequeueAfter: 30 * time.Second}, nil
+		}
+		if !ready {
+			return ctrl.Result{RequeueAfter: 2 * time.Second}, nil
+		}
+		retired, retireErr := r.retireACPArtifactIdentities(ctx, task)
+		if retireErr != nil {
+			log.Error(retireErr, "failed to retire ACP artifact identities")
+			return ctrl.Result{RequeueAfter: 30 * time.Second}, nil
+		}
+		if !retired {
+			return ctrl.Result{RequeueAfter: 2 * time.Second}, nil
+		}
+	}
+
+	// Send optional webhooks only after durable ACP artifact identities have
+	// retired. Failed delivery may retry indefinitely without delaying artifact
+	// reclamation; retirement itself retains the capability safety grace period.
 	if task.Spec.WebhookURL != "" && !task.Status.WebhookDelivered {
 		if err := r.WebhookNotifier.Notify(ctx, task); err != nil {
 			log.Error(err, "failed to send webhook")
@@ -2152,10 +2382,6 @@ func (r *TaskReconciler) handleCompleted(ctx context.Context, task *corev1alpha1
 	if err := r.enforceParentScheduledTaskHistory(ctx, task); err != nil {
 		return ctrl.Result{}, err
 	}
-	if !terminalEventRecorded {
-		return ctrl.Result{RequeueAfter: time.Second}, nil
-	}
-
 	return ctrl.Result{}, nil
 }
 
@@ -2262,17 +2488,66 @@ func (r *TaskReconciler) completeExecutedTask(
 	phase corev1alpha1.TaskPhase,
 	message string,
 ) (ctrl.Result, error) {
+	if taskExecutionWorkspaceNeedsFinalization(task) {
+		return r.beginTaskFinalization(ctx, task, phase, message)
+	}
 	return r.completeTaskWithOutcome(ctx, task, phase, phase, message, true)
 }
 
-func (r *TaskReconciler) completeAfterSuccessfulExecutionError(
+func taskExecutionWorkspaceNeedsFinalization(task *corev1alpha1.Task) bool {
+	if task == nil || task.Spec.Execution == nil || task.Spec.Execution.Workspace == nil {
+		return false
+	}
+	request := task.Spec.Execution.Workspace
+	if !request.Enabled && request.ClassRef == nil {
+		return false
+	}
+	status := task.Status.ExecutionWorkspace
+	if status == nil {
+		return true
+	}
+	if status.AttachedEpoch <= 0 {
+		return false
+	}
+	condition := meta.FindStatusCondition(status.Conditions, "Attached")
+	return condition == nil || condition.Status != metav1.ConditionFalse
+}
+
+func (r *TaskReconciler) beginTaskFinalization(
 	ctx context.Context,
 	task *corev1alpha1.Task,
+	outcomePhase corev1alpha1.TaskPhase,
 	message string,
 ) (ctrl.Result, error) {
-	return r.completeTaskWithOutcome(
-		ctx, task, corev1alpha1.TaskPhaseFailed, corev1alpha1.TaskPhaseSucceeded, message, true,
-	)
+	log := logf.FromContext(ctx)
+	if err := r.collectResult(ctx, task); err != nil {
+		log.Error(err, "failed to collect result before workspace finalization")
+	}
+	now := metav1.Now()
+	resultRef := task.Status.ResultRef
+	if err := r.updateStatusWithRetry(ctx, task, func(current *corev1alpha1.Task) {
+		current.Status.Phase = corev1alpha1.TaskPhaseFinalizing
+		current.Status.CompletionTime = nil
+		current.Status.Message = message
+		current.Status.ResultRef = resultRef
+		if current.Status.ExecutionOutcome == nil {
+			attempt := max(current.Status.Attempts, 1)
+			current.Status.ExecutionOutcome = &corev1alpha1.TaskWorkloadExecutionOutcome{
+				Phase: outcomePhase, Attempt: attempt, ResultRef: resultRef, RecordedAt: now, Message: message,
+			}
+		}
+		meta.SetStatusCondition(&current.Status.Conditions, metav1.Condition{
+			Type: ConditionTypeWaitingForApproval, Status: metav1.ConditionFalse, LastTransitionTime: now,
+			Reason: "TaskFinalizing", Message: "task execution is settled",
+		})
+		meta.SetStatusCondition(&current.Status.Conditions, metav1.Condition{
+			Type: ConditionTypeComplete, Status: metav1.ConditionFalse, LastTransitionTime: now,
+			Reason: "TaskFinalizing", Message: "workspace authority is being revoked",
+		})
+	}); err != nil {
+		return ctrl.Result{}, err
+	}
+	return ctrl.Result{RequeueAfter: 2 * time.Second}, nil
 }
 
 func (r *TaskReconciler) completeTaskWithOutcome(
@@ -2342,7 +2617,7 @@ func (r *TaskReconciler) completeTaskWithOutcome(
 		t.Status.ResultRef = resultRef
 		if recordOutcome && t.Status.ExecutionOutcome == nil {
 			attempt := max(t.Status.Attempts, 1)
-			t.Status.ExecutionOutcome = &corev1alpha1.TaskExecutionOutcome{
+			t.Status.ExecutionOutcome = &corev1alpha1.TaskWorkloadExecutionOutcome{
 				Phase:      outcomePhase,
 				Attempt:    attempt,
 				ResultRef:  resultRef,
@@ -2408,7 +2683,7 @@ func (r *TaskReconciler) failTask(ctx context.Context, task *corev1alpha1.Task,
 // executionOutcomePreventsReplay treats every recorded outcome as final.
 // Retryable failed attempts are routed through retryTask before
 // completeExecutedTask records an outcome; once recorded, no attempt is replayed.
-func executionOutcomePreventsReplay(outcome *corev1alpha1.TaskExecutionOutcome) bool {
+func executionOutcomePreventsReplay(outcome *corev1alpha1.TaskWorkloadExecutionOutcome) bool {
 	return outcome != nil
 }
 
@@ -2966,15 +3241,9 @@ func validateRuntimeRefAgentTaskRestrictions(task *corev1alpha1.Task, agent *cor
 	if task != nil && task.Spec.SecretRef != nil && strings.TrimSpace(task.Spec.SecretRef.Name) != "" {
 		return fmt.Errorf("runtimeRef custom runtimes do not support task secretRef credential delivery")
 	}
-	if ws := effectiveWorkspace(task); ws != nil && ws.GitSecretRef != nil && strings.TrimSpace(ws.GitSecretRef.Name) != "" {
-		return fmt.Errorf("runtimeRef custom runtimes do not support workspace gitSecretRef credential delivery")
-	}
 	if task != nil && task.Spec.PriorTaskRef != nil {
 		return fmt.Errorf("runtimeRef custom runtimes do not support priorTaskRef workspace handoff")
 	}
-	if taskRequestsReadOnlyAgent(task) {
-		return fmt.Errorf("read-only agent tasks do not support runtimeRef custom runtimes because Orka cannot enforce remote tool side effects")
-	}
 	return nil
 }
 
@@ -3000,7 +3269,6 @@ func (r *TaskReconciler) validateAgentRuntimeTaskCompatibility(task *corev1alpha
 		return fmt.Errorf("agent %q does not have a runtime configured (required for type: agent tasks)", agent.Name)
 	}
 	hasRuntimeRef := agent.Spec.Runtime.RuntimeRef != nil && strings.TrimSpace(agent.Spec.Runtime.RuntimeRef.Name) != ""
-	hasFrozenRuntimeRef := taskHasPlannedHarnessWrapperTurn(task) && task.Status.HarnessRuntime != nil && strings.TrimSpace(task.Status.HarnessRuntime.RuntimeRefName) != ""
 	hasBuiltInRuntime := strings.TrimSpace(string(agent.Spec.Runtime.Type)) != ""
 	switch {
 	case hasRuntimeRef && hasBuiltInRuntime:
@@ -3010,7 +3278,8 @@ func (r *TaskReconciler) validateAgentRuntimeTaskCompatibility(task *corev1alpha
 			return err
 		}
 	case hasBuiltInRuntime:
-		if err := validateBuiltInRuntimeTaskCompatibility(task, agent, hasFrozenRuntimeRef); err != nil {
+		if err := validateBuiltInRuntimeTaskCompatibility(task, agent); err != nil {
+
 			return err
 		}
 	default:
@@ -3026,8 +3295,8 @@ func (r *TaskReconciler) validateAgentRuntimeTaskCompatibility(task *corev1alpha
 	if agent.Spec.Model != nil && agent.Spec.Model.Provider != "" {
 		return fmt.Errorf("agent %q has both runtime and model.provider set (mutually exclusive for agent tasks)", agent.Name)
 	}
-	if err := validateHarnessWrapperTaskEnv(task.Spec.Env); err != nil {
-		return err
+	if len(task.Spec.Env) > 0 {
+		return fmt.Errorf("type: agent ACP runtime tasks do not support arbitrary task env; use the reviewed runtime profile")
 	}
 	if agent.Spec.Coordination != nil && len(agent.Spec.Coordination.ApprovalRequiredTools) > 0 {
 		return fmt.Errorf("agent %q approvalRequiredTools is only supported for type: ai autonomous tasks", agent.Name)
@@ -3039,31 +3308,27 @@ func (r *TaskReconciler) validateAgentRuntimeTaskCompatibility(task *corev1alpha
 	return nil
 }
 
-func validateBuiltInRuntimeTaskCompatibility(
-	task *corev1alpha1.Task, agent *corev1alpha1.Agent, hasFrozenRuntimeRef bool,
-) error {
-	if hasFrozenRuntimeRef {
-		if err := validateRuntimeRefAgentTaskRestrictions(task, agent); err != nil {
-			return err
-		}
-	}
+func validateBuiltInRuntimeTaskCompatibility(task *corev1alpha1.Task, agent *corev1alpha1.Agent) error {
 	if err := validateBuiltInAgentRuntime(agent.Spec.Runtime.Type); err != nil {
 		return err
 	}
-	if agent.Spec.Runtime.Type == corev1alpha1.AgentRuntimeOpencode &&
-		(agent.Spec.Model == nil || strings.TrimSpace(agent.Spec.Model.Name) == "") {
-		return fmt.Errorf("agent %q opencode runtime requires spec.model.name", agent.Name)
+	if err := validateBuiltInACPAgentCredentialSecretRef(agent); err != nil {
+		return err
+	}
+	if isBuiltInACPProviderRuntime(agent.Spec.Runtime.Type) && task.Spec.SecretRef != nil {
+		return fmt.Errorf("built-in ACP runtime %q does not support task secretRef; provider credentials are controller-managed", agent.Spec.Runtime.Type)
+	}
+	if err := ValidateOpenCodeAgentSpec(agent); err != nil {
+		return err
 	}
 	return validateReadOnlyBuiltInAgentRuntime(task, agent.Spec.Runtime.Type)
 }
 
 func validateBuiltInAgentRuntime(runtimeType corev1alpha1.AgentRuntimeType) error {
-	switch runtimeType {
-	case corev1alpha1.AgentRuntimeCodex, corev1alpha1.AgentRuntimeClaude, corev1alpha1.AgentRuntimeCopilot, corev1alpha1.AgentRuntimeOpencode:
+	if isBuiltInACPProviderRuntime(runtimeType) {
 		return nil
-	default:
-		return fmt.Errorf("agent runtime %q does not have a harness adapter configured", runtimeType)
 	}
+	return fmt.Errorf("agent runtime %q does not have an ACP runtime profile configured", runtimeType)
 }
 
 func validateReadOnlyBuiltInAgentRuntime(task *corev1alpha1.Task, runtimeType corev1alpha1.AgentRuntimeType) error {
@@ -3072,10 +3337,14 @@ func validateReadOnlyBuiltInAgentRuntime(task *corev1alpha1.Task, runtimeType co
 	}
 	switch runtimeType {
 	case corev1alpha1.AgentRuntimeCopilot:
-		return fmt.Errorf("read-only agent tasks do not support copilot runtime because GitHub tokens can allow repository mutation")
-	case corev1alpha1.AgentRuntimeOpencode:
-		return fmt.Errorf("read-only agent tasks do not support opencode runtime because the OpenCode adapter pre-approves file edits")
+		return fmt.Errorf("read-only agent tasks do not support copilot runtime credentials because GITHUB_TOKEN can mutate GitHub")
 	default:
+		// Codex is supported: read-only tasks run inside the RuntimeSession
+		// boundary with controller-rejected elevation requests,
+		// supervisor-mediated file writes, and read-intent workspace delta
+		// classification failing any modifying turn, with the same
+		// per-session loopback provider credential the other runtimes
+		// receive.
 		return nil
 	}
 }
@@ -3381,8 +3650,11 @@ func (r *TaskReconciler) SetupWithManager(mgr ctrl.Manager) error {
 	if r.APIReader == nil {
 		r.APIReader = mgr.GetAPIReader()
 	}
-	if err := mgr.Add(&trustedServiceReadCleanupRunnable{reconciler: r}); err != nil {
-		return fmt.Errorf("register trusted Service RBAC startup cleanup: %w", err)
+	if !r.EnforceNamespaceIsolation {
+		var cleanup manager.Runnable = &trustedServiceReadCleanupRunnable{reconciler: r}
+		if err := mgr.Add(cleanup); err != nil {
+			return fmt.Errorf("register trusted Service RBAC startup cleanup: %w", err)
+		}
 	}
 	if err := mgr.GetFieldIndexer().IndexField(context.Background(), &corev1.Event{}, eventInvolvedObjectNameField, eventInvolvedObjectNameIndex); err != nil {
 		return err
@@ -3403,8 +3675,8 @@ const (
 	DefaultVendorWorkerClusterRoleName    = "orka-vendor-worker-role"
 	DefaultContainerWorkerClusterRoleName = "orka-container-worker-role"
 
-	maxWorkerClusterRoleBindingNameLength = 253
-	workerClusterRoleBindingHashLength    = 10
+	maxWorkerRoleBindingNameLength = 253
+	workerRoleBindingHashLength    = 10
 
 	managedByLabelKey                         = "app.kubernetes.io/managed-by"
 	managedByLabelValue                       = "orka"
@@ -3415,9 +3687,9 @@ const (
 )
 
 type workerRBACSpec struct {
-	serviceAccountName     string
-	clusterRoleName        string
-	clusterRoleBindingName string
+	serviceAccountName string
+	clusterRoleName    string
+	roleBindingName    string
 }
 
 // workerRBACSpecs binds cluster-scoped worker roles into each task namespace.
@@ -3432,19 +3704,19 @@ func (r *TaskReconciler) aiWorkerServiceAccountName() string {
 func (r *TaskReconciler) workerRBACSpecs(namespace string) []workerRBACSpec {
 	return []workerRBACSpec{
 		{
-			serviceAccountName:     r.aiWorkerServiceAccountName(),
-			clusterRoleName:        workerClusterRoleName(r.AIWorkerClusterRoleName, DefaultAIWorkerClusterRoleName),
-			clusterRoleBindingName: workerClusterRoleBindingName(r.WorkerClusterRoleBindingNamePrefix, "ai", namespace),
+			serviceAccountName: r.aiWorkerServiceAccountName(),
+			clusterRoleName:    workerClusterRoleName(r.AIWorkerClusterRoleName, DefaultAIWorkerClusterRoleName),
+			roleBindingName:    workerRoleBindingName(r.WorkerRoleBindingNamePrefix, "ai", namespace),
 		},
 		{
-			serviceAccountName:     workerServiceAccountName(r.VendorWorkerServiceAccountName, VendorWorkerServiceAccount),
-			clusterRoleName:        workerClusterRoleName(r.VendorWorkerClusterRoleName, DefaultVendorWorkerClusterRoleName),
-			clusterRoleBindingName: workerClusterRoleBindingName(r.WorkerClusterRoleBindingNamePrefix, "vendor", namespace),
+			serviceAccountName: workerServiceAccountName(r.VendorWorkerServiceAccountName, VendorWorkerServiceAccount),
+			clusterRoleName:    workerClusterRoleName(r.VendorWorkerClusterRoleName, DefaultVendorWorkerClusterRoleName),
+			roleBindingName:    workerRoleBindingName(r.WorkerRoleBindingNamePrefix, "vendor", namespace),
 		},
 		{
-			serviceAccountName:     workerServiceAccountName(r.ContainerWorkerServiceAccountName, ContainerWorkerServiceAccount),
-			clusterRoleName:        workerClusterRoleName(r.ContainerWorkerClusterRoleName, DefaultContainerWorkerClusterRoleName),
-			clusterRoleBindingName: workerClusterRoleBindingName(r.WorkerClusterRoleBindingNamePrefix, "container", namespace),
+			serviceAccountName: workerServiceAccountName(r.ContainerWorkerServiceAccountName, ContainerWorkerServiceAccount),
+			clusterRoleName:    workerClusterRoleName(r.ContainerWorkerClusterRoleName, DefaultContainerWorkerClusterRoleName),
+			roleBindingName:    workerRoleBindingName(r.WorkerRoleBindingNamePrefix, "container", namespace),
 		},
 	}
 }
@@ -3456,18 +3728,18 @@ func workerClusterRoleName(configured, fallback string) string {
 	return fallback
 }
 
-func workerClusterRoleBindingName(prefix, tier, namespace string) string {
+func workerRoleBindingName(prefix, tier, namespace string) string {
 	if prefix == "" {
 		prefix = managedByLabelValue
 	}
 	name := fmt.Sprintf("%s-%s-worker-%s", prefix, tier, namespace)
-	if len(name) <= maxWorkerClusterRoleBindingNameLength {
+	if len(name) <= maxWorkerRoleBindingNameLength {
 		return name
 	}
 
 	sum := sha256.Sum256([]byte(name))
-	suffix := hex.EncodeToString(sum[:])[:workerClusterRoleBindingHashLength]
-	prefixLength := maxWorkerClusterRoleBindingNameLength - workerClusterRoleBindingHashLength - 1
+	suffix := hex.EncodeToString(sum[:])[:workerRoleBindingHashLength]
+	prefixLength := maxWorkerRoleBindingNameLength - workerRoleBindingHashLength - 1
 	return fmt.Sprintf("%s-%s", name[:prefixLength], suffix)
 }
 
@@ -3481,17 +3753,7 @@ func (r *TaskReconciler) ensureWorkerRBAC(ctx context.Context, namespace string)
 		if err := r.ensureWorkerServiceAccount(ctx, namespace, spec.serviceAccountName); err != nil {
 			return err
 		}
-		if r.EnforceNamespaceIsolation {
-			if err := r.ensureWorkerRoleBinding(ctx, namespace, spec); err != nil {
-				return err
-			}
-			if err := r.deleteLegacyWorkerClusterRoleBinding(ctx, namespace, spec); err != nil {
-				return err
-			}
-			continue
-		}
-
-		if err := r.ensureWorkerClusterRoleBinding(ctx, namespace, spec); err != nil {
+		if err := r.ensureWorkerRoleBinding(ctx, namespace, spec); err != nil {
 			return err
 		}
 	}
@@ -3549,6 +3811,11 @@ func (r *TaskReconciler) ensureTrustedServiceReadBindings(ctx context.Context, t
 			return err
 		}
 	}
+	if r.EnforceNamespaceIsolation {
+		// Static installations reject cross-namespace trusted Service references
+		// at startup, so they never discover or mutate legacy grants here.
+		return nil
+	}
 	return r.pruneTrustedServiceReadBindings(ctx, taskNamespace, desired)
 }
 
@@ -3691,6 +3958,9 @@ func (r *TaskReconciler) cleanupTrustedServiceReadBindingsAfterTaskRemoval(
 	ctx context.Context,
 	taskNamespace string,
 ) error {
+	if r.EnforceNamespaceIsolation {
+		return nil
+	}
 	taskNamespace = strings.TrimSpace(taskNamespace)
 	if taskNamespace == "" {
 		return nil
@@ -3988,21 +4258,21 @@ func (r *TaskReconciler) ensureWorkerRoleBinding(ctx context.Context, namespace
 	desired := workerRoleBinding(namespace, spec)
 
 	rb := &rbacv1.RoleBinding{}
-	err := r.Get(ctx, types.NamespacedName{Name: spec.clusterRoleBindingName, Namespace: namespace}, rb)
+	err := r.Get(ctx, types.NamespacedName{Name: spec.roleBindingName, Namespace: namespace}, rb)
 	if apierrors.IsNotFound(err) {
 		if err := r.Create(ctx, desired); err != nil {
 			if !apierrors.IsAlreadyExists(err) {
-				return fmt.Errorf("creating worker RoleBinding %s/%s: %w", namespace, spec.clusterRoleBindingName, err)
+				return fmt.Errorf("creating worker RoleBinding %s/%s: %w", namespace, spec.roleBindingName, err)
 			}
-			if err := r.Get(ctx, types.NamespacedName{Name: spec.clusterRoleBindingName, Namespace: namespace}, rb); err != nil {
-				return fmt.Errorf("getting worker RoleBinding %s/%s after create conflict: %w", namespace, spec.clusterRoleBindingName, err)
+			if err := r.Get(ctx, types.NamespacedName{Name: spec.roleBindingName, Namespace: namespace}, rb); err != nil {
+				return fmt.Errorf("getting worker RoleBinding %s/%s after create conflict: %w", namespace, spec.roleBindingName, err)
 			}
 		} else {
-			log.Info("Created worker RoleBinding", "namespace", namespace, "binding", spec.clusterRoleBindingName, "serviceAccount", spec.serviceAccountName, "clusterRole", spec.clusterRoleName)
+			log.Info("Created worker RoleBinding", "namespace", namespace, "binding", spec.roleBindingName, "serviceAccount", spec.serviceAccountName, "clusterRole", spec.clusterRoleName)
 			return nil
 		}
 	} else if err != nil {
-		return fmt.Errorf("getting worker RoleBinding %s/%s: %w", namespace, spec.clusterRoleBindingName, err)
+		return fmt.Errorf("getting worker RoleBinding %s/%s: %w", namespace, spec.roleBindingName, err)
 	}
 
 	if rb.RoleRef != desired.RoleRef {
@@ -4028,9 +4298,9 @@ func (r *TaskReconciler) ensureWorkerRoleBinding(ctx context.Context, namespace
 
 	if changed {
 		if err := r.Update(ctx, rb); err != nil {
-			return fmt.Errorf("updating worker RoleBinding %s/%s: %w", namespace, spec.clusterRoleBindingName, err)
+			return fmt.Errorf("updating worker RoleBinding %s/%s: %w", namespace, spec.roleBindingName, err)
 		}
-		log.Info("Updated worker RoleBinding", "namespace", namespace, "binding", spec.clusterRoleBindingName, "serviceAccount", spec.serviceAccountName, "clusterRole", spec.clusterRoleName)
+		log.Info("Updated worker RoleBinding", "namespace", namespace, "binding", spec.roleBindingName, "serviceAccount", spec.serviceAccountName, "clusterRole", spec.clusterRoleName)
 	}
 
 	return nil
@@ -4038,147 +4308,18 @@ func (r *TaskReconciler) ensureWorkerRoleBinding(ctx context.Context, namespace
 
 func (r *TaskReconciler) recreateWorkerRoleBinding(ctx context.Context, namespace string, spec workerRBACSpec, current, desired *rbacv1.RoleBinding) (*rbacv1.RoleBinding, error) {
 	log := logf.FromContext(ctx)
-	log.Info("Recreating worker RoleBinding with stale RoleRef", "namespace", namespace, "binding", spec.clusterRoleBindingName, "currentKind", current.RoleRef.Kind, "currentName", current.RoleRef.Name, "desiredKind", desired.RoleRef.Kind, "desiredName", desired.RoleRef.Name)
+	log.Info("Recreating worker RoleBinding with stale RoleRef", "namespace", namespace, "binding", spec.roleBindingName, "currentKind", current.RoleRef.Kind, "currentName", current.RoleRef.Name, "desiredKind", desired.RoleRef.Kind, "desiredName", desired.RoleRef.Name)
 
 	if err := r.Delete(ctx, current); err != nil && !apierrors.IsNotFound(err) {
-		return nil, fmt.Errorf("deleting worker RoleBinding %s/%s with stale RoleRef %s/%s: %w", namespace, spec.clusterRoleBindingName, current.RoleRef.Kind, current.RoleRef.Name, err)
+		return nil, fmt.Errorf("deleting worker RoleBinding %s/%s with stale RoleRef %s/%s: %w", namespace, spec.roleBindingName, current.RoleRef.Kind, current.RoleRef.Name, err)
 	}
 
 	var recreated *rbacv1.RoleBinding
-	err := wait.PollUntilContextTimeout(ctx, workerClusterRoleBindingRecreateInterval, workerClusterRoleBindingRecreateTimeout, true, func(ctx context.Context) (bool, error) {
+	err := wait.PollUntilContextTimeout(ctx, workerRoleBindingRecreateInterval, workerRoleBindingRecreateTimeout, true, func(ctx context.Context) (bool, error) {
 		latest := &rbacv1.RoleBinding{}
-		err := r.Get(ctx, types.NamespacedName{Name: spec.clusterRoleBindingName, Namespace: namespace}, latest)
-		if err != nil && !apierrors.IsNotFound(err) {
-			return false, fmt.Errorf("getting worker RoleBinding %s/%s while waiting for stale RoleRef deletion: %w", namespace, spec.clusterRoleBindingName, err)
-		}
-
-		if err == nil {
-			if latest.RoleRef == desired.RoleRef {
-				recreated = latest
-				return true, nil
-			}
-
-			// The API server may still be serving the stale object while deletion is
-			// propagating, or another actor may have recreated it with the stale
-			// immutable RoleRef. Keep deleting/retrying until the name is available.
-			if err := r.Delete(ctx, latest); err != nil && !apierrors.IsNotFound(err) {
-				return false, fmt.Errorf("deleting worker RoleBinding %s/%s with stale RoleRef %s/%s during retry: %w", namespace, spec.clusterRoleBindingName, latest.RoleRef.Kind, latest.RoleRef.Name, err)
-			}
-			return false, nil
-		}
-
-		create := desired.DeepCopy()
-		if err := r.Create(ctx, create); err != nil {
-			if apierrors.IsAlreadyExists(err) {
-				return false, nil
-			}
-			return false, fmt.Errorf("recreating worker RoleBinding %s/%s with RoleRef %s/%s: %w", namespace, spec.clusterRoleBindingName, desired.RoleRef.Kind, desired.RoleRef.Name, err)
-		}
-
-		recreated = create
-		return true, nil
-	})
-	if err != nil {
-		return nil, fmt.Errorf("recreating worker RoleBinding %s/%s after stale RoleRef %s/%s: %w", namespace, spec.clusterRoleBindingName, current.RoleRef.Kind, current.RoleRef.Name, err)
-	}
-
-	log.Info("Recreated worker RoleBinding", "namespace", namespace, "binding", spec.clusterRoleBindingName, "serviceAccount", spec.serviceAccountName, "clusterRole", spec.clusterRoleName)
-	return recreated, nil
-}
-
-func (r *TaskReconciler) deleteLegacyWorkerClusterRoleBinding(ctx context.Context, namespace string, spec workerRBACSpec) error {
-	log := logf.FromContext(ctx)
-	legacy := &rbacv1.ClusterRoleBinding{}
-	err := r.Get(ctx, types.NamespacedName{Name: spec.clusterRoleBindingName}, legacy)
-	if apierrors.IsNotFound(err) {
-		return nil
-	}
-	if err != nil {
-		return fmt.Errorf("getting legacy worker ClusterRoleBinding %s: %w", spec.clusterRoleBindingName, err)
-	}
-
-	desiredLegacy := workerClusterRoleBinding(namespace, spec)
-	managed := legacy.Labels[managedByLabelKey] == managedByLabelValue
-	bindsWorkerServiceAccount := len(desiredLegacy.Subjects) == 1 && subjectsContain(legacy.Subjects, desiredLegacy.Subjects[0])
-	if !managed && !bindsWorkerServiceAccount {
-		log.Info("Skipping unmanaged legacy worker ClusterRoleBinding", "namespace", namespace, "binding", spec.clusterRoleBindingName)
-		return nil
-	}
-
-	if err := r.Delete(ctx, legacy); err != nil && !apierrors.IsNotFound(err) {
-		return fmt.Errorf("deleting legacy worker ClusterRoleBinding %s: %w", spec.clusterRoleBindingName, err)
-	}
-	log.Info("Deleted legacy worker ClusterRoleBinding", "namespace", namespace, "binding", spec.clusterRoleBindingName, "serviceAccount", spec.serviceAccountName, "clusterRole", spec.clusterRoleName)
-	return nil
-}
-
-func (r *TaskReconciler) ensureWorkerClusterRoleBinding(ctx context.Context, namespace string, spec workerRBACSpec) error {
-	log := logf.FromContext(ctx)
-	desired := workerClusterRoleBinding(namespace, spec)
-
-	crb := &rbacv1.ClusterRoleBinding{}
-	err := r.Get(ctx, types.NamespacedName{Name: spec.clusterRoleBindingName}, crb)
-	if apierrors.IsNotFound(err) {
-		if err := r.Create(ctx, desired); err != nil {
-			if !apierrors.IsAlreadyExists(err) {
-				return fmt.Errorf("creating worker ClusterRoleBinding %s: %w", spec.clusterRoleBindingName, err)
-			}
-			if err := r.Get(ctx, types.NamespacedName{Name: spec.clusterRoleBindingName}, crb); err != nil {
-				return fmt.Errorf("getting worker ClusterRoleBinding %s after create conflict: %w", spec.clusterRoleBindingName, err)
-			}
-		} else {
-			log.Info("Created worker ClusterRoleBinding", "namespace", namespace, "binding", spec.clusterRoleBindingName, "serviceAccount", spec.serviceAccountName, "clusterRole", spec.clusterRoleName)
-			return nil
-		}
-	} else if err != nil {
-		return fmt.Errorf("getting worker ClusterRoleBinding %s: %w", spec.clusterRoleBindingName, err)
-	}
-
-	if crb.RoleRef != desired.RoleRef {
-		recreated, err := r.recreateWorkerClusterRoleBinding(ctx, namespace, spec, crb, desired)
-		if err != nil {
-			return err
-		}
-		crb = recreated
-	}
-
-	changed := false
-	if crb.Labels == nil {
-		crb.Labels = map[string]string{}
-	}
-	if crb.Labels[managedByLabelKey] != managedByLabelValue {
-		crb.Labels[managedByLabelKey] = managedByLabelValue
-		changed = true
-	}
-	if !subjectsEqual(crb.Subjects, desired.Subjects) {
-		crb.Subjects = desired.Subjects
-		changed = true
-	}
-
-	if changed {
-		if err := r.Update(ctx, crb); err != nil {
-			return fmt.Errorf("updating worker ClusterRoleBinding %s: %w", spec.clusterRoleBindingName, err)
-		}
-		log.Info("Updated worker ClusterRoleBinding", "namespace", namespace, "binding", spec.clusterRoleBindingName, "serviceAccount", spec.serviceAccountName, "clusterRole", spec.clusterRoleName)
-	}
-
-	return nil
-}
-
-func (r *TaskReconciler) recreateWorkerClusterRoleBinding(ctx context.Context, namespace string, spec workerRBACSpec, current, desired *rbacv1.ClusterRoleBinding) (*rbacv1.ClusterRoleBinding, error) {
-	log := logf.FromContext(ctx)
-	log.Info("Recreating worker ClusterRoleBinding with stale RoleRef", "namespace", namespace, "binding", spec.clusterRoleBindingName, "currentKind", current.RoleRef.Kind, "currentName", current.RoleRef.Name, "desiredKind", desired.RoleRef.Kind, "desiredName", desired.RoleRef.Name)
-
-	if err := r.Delete(ctx, current); err != nil && !apierrors.IsNotFound(err) {
-		return nil, fmt.Errorf("deleting worker ClusterRoleBinding %s with stale RoleRef %s/%s: %w", spec.clusterRoleBindingName, current.RoleRef.Kind, current.RoleRef.Name, err)
-	}
-
-	var recreated *rbacv1.ClusterRoleBinding
-	err := wait.PollUntilContextTimeout(ctx, workerClusterRoleBindingRecreateInterval, workerClusterRoleBindingRecreateTimeout, true, func(ctx context.Context) (bool, error) {
-		latest := &rbacv1.ClusterRoleBinding{}
-		err := r.Get(ctx, types.NamespacedName{Name: spec.clusterRoleBindingName}, latest)
+		err := r.Get(ctx, types.NamespacedName{Name: spec.roleBindingName, Namespace: namespace}, latest)
 		if err != nil && !apierrors.IsNotFound(err) {
-			return false, fmt.Errorf("getting worker ClusterRoleBinding %s while waiting for stale RoleRef deletion: %w", spec.clusterRoleBindingName, err)
+			return false, fmt.Errorf("getting worker RoleBinding %s/%s while waiting for stale RoleRef deletion: %w", namespace, spec.roleBindingName, err)
 		}
 
 		if err == nil {
@@ -4191,7 +4332,7 @@ func (r *TaskReconciler) recreateWorkerClusterRoleBinding(ctx context.Context, n
 			// propagating, or another actor may have recreated it with the stale
 			// immutable RoleRef. Keep deleting/retrying until the name is available.
 			if err := r.Delete(ctx, latest); err != nil && !apierrors.IsNotFound(err) {
-				return false, fmt.Errorf("deleting worker ClusterRoleBinding %s with stale RoleRef %s/%s during retry: %w", spec.clusterRoleBindingName, latest.RoleRef.Kind, latest.RoleRef.Name, err)
+				return false, fmt.Errorf("deleting worker RoleBinding %s/%s with stale RoleRef %s/%s during retry: %w", namespace, spec.roleBindingName, latest.RoleRef.Kind, latest.RoleRef.Name, err)
 			}
 			return false, nil
 		}
@@ -4201,24 +4342,24 @@ func (r *TaskReconciler) recreateWorkerClusterRoleBinding(ctx context.Context, n
 			if apierrors.IsAlreadyExists(err) {
 				return false, nil
 			}
-			return false, fmt.Errorf("recreating worker ClusterRoleBinding %s with RoleRef %s/%s: %w", spec.clusterRoleBindingName, desired.RoleRef.Kind, desired.RoleRef.Name, err)
+			return false, fmt.Errorf("recreating worker RoleBinding %s/%s with RoleRef %s/%s: %w", namespace, spec.roleBindingName, desired.RoleRef.Kind, desired.RoleRef.Name, err)
 		}
 
 		recreated = create
 		return true, nil
 	})
 	if err != nil {
-		return nil, fmt.Errorf("recreating worker ClusterRoleBinding %s after stale RoleRef %s/%s: %w", spec.clusterRoleBindingName, current.RoleRef.Kind, current.RoleRef.Name, err)
+		return nil, fmt.Errorf("recreating worker RoleBinding %s/%s after stale RoleRef %s/%s: %w", namespace, spec.roleBindingName, current.RoleRef.Kind, current.RoleRef.Name, err)
 	}
 
-	log.Info("Recreated worker ClusterRoleBinding", "namespace", namespace, "binding", spec.clusterRoleBindingName, "serviceAccount", spec.serviceAccountName, "clusterRole", spec.clusterRoleName)
+	log.Info("Recreated worker RoleBinding", "namespace", namespace, "binding", spec.roleBindingName, "serviceAccount", spec.serviceAccountName, "clusterRole", spec.clusterRoleName)
 	return recreated, nil
 }
 
 func workerRoleBinding(namespace string, spec workerRBACSpec) *rbacv1.RoleBinding {
 	return &rbacv1.RoleBinding{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      spec.clusterRoleBindingName,
+			Name:      spec.roleBindingName,
 			Namespace: namespace,
 			Labels: map[string]string{
 				managedByLabelKey: managedByLabelValue,
@@ -4239,33 +4380,6 @@ func workerRoleBinding(namespace string, spec workerRBACSpec) *rbacv1.RoleBindin
 	}
 }
 
-func workerClusterRoleBinding(namespace string, spec workerRBACSpec) *rbacv1.ClusterRoleBinding {
-	return &rbacv1.ClusterRoleBinding{
-		ObjectMeta: metav1.ObjectMeta{
-			Name: spec.clusterRoleBindingName,
-			Labels: map[string]string{
-				managedByLabelKey: managedByLabelValue,
-			},
-		},
-		RoleRef: rbacv1.RoleRef{
-			APIGroup: rbacv1.GroupName,
-			Kind:     "ClusterRole",
-			Name:     spec.clusterRoleName,
-		},
-		Subjects: []rbacv1.Subject{
-			{
-				Kind:      rbacv1.ServiceAccountKind,
-				Name:      spec.serviceAccountName,
-				Namespace: namespace,
-			},
-		},
-	}
-}
-
-func subjectsContain(subjects []rbacv1.Subject, want rbacv1.Subject) bool {
-	return slices.Contains(subjects, want)
-}
-
 // subjectsEqual is intentionally order-sensitive; desired worker bindings
 // currently contain exactly one subject.
 func subjectsEqual(a, b []rbacv1.Subject) bool {
diff --git a/internal/controller/task_controller_test.go b/internal/controller/task_controller_test.go
index cb78a2666..fe8236ae8 100644
--- a/internal/controller/task_controller_test.go
+++ b/internal/controller/task_controller_test.go
@@ -1361,7 +1361,7 @@ var _ = Describe("Task Controller", func() {
 			Expect(err.Error()).To(ContainSubstring("does not have a runtime configured"))
 		})
 
-		It("should allow agent tasks with copilot harness runtime", func() {
+		It("should accept agent tasks with the built-in copilot runtime", func() {
 			r := newReconciler()
 			task := &corev1alpha1.Task{
 				Spec: corev1alpha1.TaskSpec{
diff --git a/internal/controller/task_controller_unit_test.go b/internal/controller/task_controller_unit_test.go
index 61825fa41..6b2a56a71 100644
--- a/internal/controller/task_controller_unit_test.go
+++ b/internal/controller/task_controller_unit_test.go
@@ -28,6 +28,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -35,6 +36,7 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	k8sfake "k8s.io/client-go/kubernetes/fake"
 	"k8s.io/client-go/tools/record"
+	"k8s.io/utils/ptr"
 	sandboxextv1alpha1 "sigs.k8s.io/agent-sandbox/extensions/api/v1alpha1"
 	sandboxextv1beta1 "sigs.k8s.io/agent-sandbox/extensions/api/v1beta1"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -44,10 +46,13 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	workspacev1alpha1 "github.com/orka-agents/orka/api/workspace/v1alpha1"
 	"github.com/orka-agents/orka/internal/events"
+	"github.com/orka-agents/orka/internal/harness"
 	"github.com/orka-agents/orka/internal/labels"
 	"github.com/orka-agents/orka/internal/outboundaccess"
 	"github.com/orka-agents/orka/internal/store"
+	storekube "github.com/orka-agents/orka/internal/store/kube"
 	"github.com/orka-agents/orka/internal/store/sqlite"
 	orkatracing "github.com/orka-agents/orka/internal/tracing"
 	"github.com/orka-agents/orka/internal/tracing/testutil"
@@ -65,6 +70,7 @@ const (
 func newTestScheme() *runtime.Scheme {
 	s := runtime.NewScheme()
 	_ = corev1alpha1.AddToScheme(s)
+	_ = workspacev1alpha1.AddToScheme(s)
 	_ = corev1.AddToScheme(s)
 	_ = batchv1.AddToScheme(s)
 	_ = coordinationv1.AddToScheme(s)
@@ -78,7 +84,11 @@ func newTestScheme() *runtime.Scheme {
 func newUnitReconciler(scheme *runtime.Scheme, objs ...client.Object) *TaskReconciler {
 	fb := fake.NewClientBuilder().
 		WithScheme(scheme).
-		WithStatusSubresource(&corev1alpha1.Task{}, &corev1alpha1.Agent{}, &corev1alpha1.AgentRuntime{}).
+		WithStatusSubresource(
+			&corev1alpha1.Task{}, &corev1alpha1.Agent{}, &corev1alpha1.AgentRuntime{},
+			&corev1alpha1.ControllerEpoch{}, &corev1alpha1.PromptAttempt{}, &corev1alpha1.RuntimeSessionControl{},
+			&corev1alpha1.BranchClaim{}, &corev1alpha1.Publication{}, &corev1alpha1.ExternalEffect{},
+		).
 		WithIndex(&corev1.Event{}, eventInvolvedObjectNameField, eventInvolvedObjectNameIndex).
 		WithIndex(&corev1.Event{}, eventReasonField, eventReasonIndex)
 	if len(objs) > 0 {
@@ -461,53 +471,90 @@ func TestValidateTaskAgentCompatibility_AgentTaskNoRuntime(t *testing.T) {
 
 func TestValidateTaskAgentCompatibility_AgentTaskCopilotRuntime(t *testing.T) {
 	r := &TaskReconciler{}
-	task := &corev1alpha1.Task{
-		Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Prompt: "do stuff"},
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Prompt: "do stuff"}}
+	agent := &corev1alpha1.Agent{ObjectMeta: metav1.ObjectMeta{Name: "a1"}, Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeCopilot}}}
+	if err := r.validateTaskAgentCompatibility(task, agent); err != nil {
+		t.Fatalf("validateTaskAgentCompatibility() error = %v, want Copilot accepted", err)
 	}
+}
+func TestValidateTaskAgentCompatibility_AgentTaskOpencodeRuntime(t *testing.T) {
+	r := &TaskReconciler{}
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Prompt: "do stuff"}}
 	agent := &corev1alpha1.Agent{
 		ObjectMeta: metav1.ObjectMeta{Name: "a1"},
 		Spec: corev1alpha1.AgentSpec{
-			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeCopilot},
+			Model: testOpenCodeModelConfig(),
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeOpencode,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
 		},
 	}
-	err := r.validateTaskAgentCompatibility(task, agent)
-	if err != nil {
-		t.Fatalf("validateTaskAgentCompatibility() error = %v, want nil for copilot harness runtime", err)
+	if err := r.validateTaskAgentCompatibility(task, agent); err != nil {
+		t.Fatalf("validateTaskAgentCompatibility() error = %v, want OpenCode accepted", err)
 	}
 }
 
-func TestValidateTaskAgentCompatibility_AgentTaskOpencodeRuntime(t *testing.T) {
+func TestValidateTaskAgentCompatibility_AgentTaskOpencodeRejectsSecretRef(t *testing.T) {
 	r := &TaskReconciler{}
-	task := &corev1alpha1.Task{
-		Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Prompt: "do stuff"},
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Prompt: "do stuff"}}
+	agent := &corev1alpha1.Agent{ObjectMeta: metav1.ObjectMeta{Name: "a1"}, Spec: corev1alpha1.AgentSpec{
+		Model: testOpenCodeModelConfig(),
+		Runtime: &corev1alpha1.AgentCLIRuntime{
+			Type:            corev1alpha1.AgentRuntimeOpencode,
+			ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+		},
+		SecretRef: &corev1.LocalObjectReference{Name: "legacy-opencode-secret"},
+	}}
+	err := r.validateTaskAgentCompatibility(task, agent)
+	if err == nil || !strings.Contains(err.Error(), "does not support agent secretRef") {
+		t.Fatalf("validateTaskAgentCompatibility() error = %v, want OpenCode secretRef rejection", err)
 	}
-	agent := &corev1alpha1.Agent{
-		ObjectMeta: metav1.ObjectMeta{Name: "a1"},
-		Spec: corev1alpha1.AgentSpec{
-			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeOpencode},
-			Model:   &corev1alpha1.ModelConfig{Name: "kimi-k2"},
+}
+
+func TestValidateTaskAgentCompatibility_AgentTaskOpencodeRejectsReasoningEffort(t *testing.T) {
+	r := &TaskReconciler{}
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Prompt: "do stuff"}}
+	agent := &corev1alpha1.Agent{ObjectMeta: metav1.ObjectMeta{Name: "a1"}, Spec: corev1alpha1.AgentSpec{
+		Model: testOpenCodeModelConfig(),
+		Runtime: &corev1alpha1.AgentCLIRuntime{
+			Type:                   corev1alpha1.AgentRuntimeOpencode,
+			ContractVersion:        ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			DefaultReasoningEffort: agentReasoningEffortHigh,
 		},
-	}
-	if err := r.validateTaskAgentCompatibility(task, agent); err != nil {
-		t.Fatalf("validateTaskAgentCompatibility() error = %v, want nil for opencode harness runtime", err)
+	}}
+	err := r.validateTaskAgentCompatibility(task, agent)
+	if err == nil || !strings.Contains(err.Error(), "does not support spec.runtime.defaultReasoningEffort") {
+		t.Fatalf("validateTaskAgentCompatibility() error = %v, want OpenCode reasoning-effort rejection", err)
 	}
 }
 
-func TestValidateTaskAgentCompatibility_AgentTaskOpencodeRuntimeRequiresModel(t *testing.T) {
+func TestValidateTaskAgentCompatibility_AgentTaskOpencodeRejectsSubstitutionModel(t *testing.T) {
 	r := &TaskReconciler{}
-	task := &corev1alpha1.Task{
-		Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Prompt: "do stuff"},
-	}
-	agent := &corev1alpha1.Agent{
-		ObjectMeta: metav1.ObjectMeta{Name: "a1"},
-		Spec: corev1alpha1.AgentSpec{
-			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeOpencode},
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Prompt: "do stuff"}}
+	agent := &corev1alpha1.Agent{ObjectMeta: metav1.ObjectMeta{Name: "a1"}, Spec: corev1alpha1.AgentSpec{
+		Model: &corev1alpha1.ModelConfig{Name: "{file:/proc/self/environ}"},
+		Runtime: &corev1alpha1.AgentCLIRuntime{
+			Type:            corev1alpha1.AgentRuntimeOpencode,
+			ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
 		},
+	}}
+	err := r.validateTaskAgentCompatibility(task, agent)
+	if err == nil || !strings.Contains(err.Error(), "substitution braces") {
+		t.Fatalf("validateTaskAgentCompatibility() error = %v, want substitution rejection", err)
 	}
+}
 
+func TestValidateTaskAgentCompatibility_AgentTaskOpencodeRuntimeRequiresModel(t *testing.T) {
+	r := &TaskReconciler{}
+	task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Prompt: "do stuff"}}
+	agent := &corev1alpha1.Agent{ObjectMeta: metav1.ObjectMeta{Name: "a1"}, Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+		Type:            corev1alpha1.AgentRuntimeOpencode,
+		ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+	}}}
 	err := r.validateTaskAgentCompatibility(task, agent)
-	if err == nil || !strings.Contains(err.Error(), "requires spec.model.name") {
-		t.Fatalf("validateTaskAgentCompatibility() error = %v, want missing OpenCode model rejection", err)
+	if err == nil || !strings.Contains(err.Error(), "opencode runtime requires spec.model.name") {
+		t.Fatalf("validateTaskAgentCompatibility() error = %v, want missing model rejection", err)
 	}
 }
 
@@ -515,21 +562,15 @@ func TestValidateTaskAgentCompatibility_ReadOnlyCopilotRejected(t *testing.T) {
 	r := &TaskReconciler{}
 	task := &corev1alpha1.Task{
 		ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{labels.AnnotationAgentReadOnly: scheduledRunLabelValue}},
-		Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Prompt: "review"},
-	}
-	agent := &corev1alpha1.Agent{
-		ObjectMeta: metav1.ObjectMeta{Name: "a1"},
-		Spec: corev1alpha1.AgentSpec{
-			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeCopilot},
-		},
+		Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Prompt: "do stuff"},
 	}
+	agent := &corev1alpha1.Agent{ObjectMeta: metav1.ObjectMeta{Name: "a1"}, Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeCopilot}}}
 	err := r.validateTaskAgentCompatibility(task, agent)
-	if err == nil || !strings.Contains(err.Error(), "read-only agent tasks do not support copilot") {
-		t.Fatalf("validateTaskAgentCompatibility() error = %v, want read-only copilot rejection", err)
+	if err == nil || !strings.Contains(err.Error(), "GITHUB_TOKEN can mutate GitHub") {
+		t.Fatalf("validateTaskAgentCompatibility() error = %v, want read-only credential rejection", err)
 	}
 }
-
-func TestValidateTaskAgentCompatibility_ReadOnlyOpencodeRejected(t *testing.T) {
+func TestValidateTaskAgentCompatibility_ReadOnlyOpencodeAccepted(t *testing.T) {
 	r := &TaskReconciler{}
 	task := &corev1alpha1.Task{
 		ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{labels.AnnotationAgentReadOnly: scheduledRunLabelValue}},
@@ -538,13 +579,12 @@ func TestValidateTaskAgentCompatibility_ReadOnlyOpencodeRejected(t *testing.T) {
 	agent := &corev1alpha1.Agent{
 		ObjectMeta: metav1.ObjectMeta{Name: "a1"},
 		Spec: corev1alpha1.AgentSpec{
+			Model:   testOpenCodeModelConfig(),
 			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeOpencode},
-			Model:   &corev1alpha1.ModelConfig{Name: "kimi-k2"},
 		},
 	}
-	err := r.validateTaskAgentCompatibility(task, agent)
-	if err == nil || !strings.Contains(err.Error(), "read-only agent tasks do not support opencode") {
-		t.Fatalf("validateTaskAgentCompatibility() error = %v, want read-only opencode rejection", err)
+	if err := r.validateTaskAgentCompatibility(task, agent); err != nil {
+		t.Fatalf("validateTaskAgentCompatibility() error = %v, want read-only OpenCode accepted", err)
 	}
 }
 
@@ -570,6 +610,61 @@ func TestValidateTaskAgentCompatibility_AgentTaskRejectsApprovalRequiredTools(t
 	}
 }
 
+func TestValidateTaskAgentCompatibility_BuiltInRuntimeRejectsCredentialSecretRefs(t *testing.T) {
+	for _, runtimeType := range []corev1alpha1.AgentRuntimeType{
+		corev1alpha1.AgentRuntimeCodex,
+		corev1alpha1.AgentRuntimeClaude,
+		corev1alpha1.AgentRuntimeCopilot,
+	} {
+		for _, refOwner := range []string{"agent", "task"} {
+			t.Run(string(runtimeType)+"/"+refOwner, func(t *testing.T) {
+				r := &TaskReconciler{}
+				task := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Prompt: "do stuff"}}
+				agent := &corev1alpha1.Agent{
+					ObjectMeta: metav1.ObjectMeta{Name: "a1"},
+					Spec: corev1alpha1.AgentSpec{
+						Runtime: &corev1alpha1.AgentCLIRuntime{Type: runtimeType},
+					},
+				}
+				switch refOwner {
+				case "agent":
+					agent.Spec.SecretRef = &corev1.LocalObjectReference{Name: "agent-creds"}
+				case "task":
+					task.Spec.SecretRef = &corev1alpha1.SecretReference{Name: "task-creds"}
+				}
+
+				err := r.validateTaskAgentCompatibility(task, agent)
+				wantError := fmt.Sprintf("does not support %s secretRef", refOwner)
+				if err == nil || !strings.Contains(err.Error(), wantError) {
+					t.Fatalf("validateTaskAgentCompatibility() error = %v, want %q", err, wantError)
+				}
+			})
+		}
+	}
+}
+
+func TestValidateTaskAgentCompatibility_ProviderBackedCredentialSecretRefsRemainValid(t *testing.T) {
+	r := &TaskReconciler{}
+	task := &corev1alpha1.Task{
+		Spec: corev1alpha1.TaskSpec{
+			Type:      corev1alpha1.TaskTypeAI,
+			Prompt:    "do stuff",
+			SecretRef: &corev1alpha1.SecretReference{Name: "task-creds"},
+		},
+	}
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "a1"},
+		Spec: corev1alpha1.AgentSpec{
+			ProviderRef: &corev1alpha1.ProviderReference{Name: "provider"},
+			SecretRef:   &corev1.LocalObjectReference{Name: "agent-creds"},
+		},
+	}
+
+	if err := r.validateTaskAgentCompatibility(task, agent); err != nil {
+		t.Fatalf("validateTaskAgentCompatibility() error = %v", err)
+	}
+}
+
 func TestValidateTaskAgentCompatibility_RuntimeRefRejectsCredentialSecretRefs(t *testing.T) {
 	tests := []struct {
 		name      string
@@ -590,16 +685,6 @@ func TestValidateTaskAgentCompatibility_RuntimeRefRejectsCredentialSecretRefs(t
 			},
 			wantError: "task secretRef",
 		},
-		{
-			name: "workspace gitSecretRef",
-			mutate: func(task *corev1alpha1.Task, _ *corev1alpha1.Agent) {
-				task.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      "https://github.com/example/repo",
-					GitSecretRef: &corev1.LocalObjectReference{Name: "git-creds"},
-				}}
-			},
-			wantError: "gitSecretRef",
-		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -727,57 +812,8 @@ func TestValidateTaskAgentCompatibility_ReadOnlyRuntimeRefRejected(t *testing.T)
 			Runtime: &corev1alpha1.AgentCLIRuntime{RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "custom-runtime"}},
 		},
 	}
-	err := r.validateTaskAgentCompatibility(task, agent)
-	if err == nil || !strings.Contains(err.Error(), "read-only agent tasks do not support runtimeRef") {
-		t.Fatalf("validateTaskAgentCompatibility() error = %v, want read-only runtimeRef rejection", err)
-	}
-}
-
-func TestValidateTaskAgentCompatibility_StaleFrozenRuntimeRefStatusIgnoredWithoutPlannedTurn(t *testing.T) {
-	r := &TaskReconciler{}
-	task := &corev1alpha1.Task{
-		Spec: corev1alpha1.TaskSpec{
-			Type:         corev1alpha1.TaskTypeAgent,
-			Prompt:       "continue",
-			PriorTaskRef: &corev1alpha1.PriorTaskReference{Name: "prior"},
-		},
-		Status: corev1alpha1.TaskStatus{HarnessRuntime: &corev1alpha1.HarnessRuntimeStatus{RuntimeRefName: "stale-runtime"}},
-	}
-	agent := &corev1alpha1.Agent{
-		ObjectMeta: metav1.ObjectMeta{Name: "a1"},
-		Spec: corev1alpha1.AgentSpec{
-			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeCodex},
-		},
-	}
 	if err := r.validateTaskAgentCompatibility(task, agent); err != nil {
-		t.Fatalf("validateTaskAgentCompatibility() error = %v, want nil for stale frozen runtimeRef status", err)
-	}
-}
-
-func TestValidateTaskAgentCompatibility_ActiveFrozenRuntimeRefStillRejectsPriorTaskRef(t *testing.T) {
-	r := &TaskReconciler{}
-	task := &corev1alpha1.Task{
-		ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{
-			harnessWrapperTurnIDAnnotation:  "turn-1",
-			harnessWrapperRuntimeAnnotation: "runtime-1",
-			harnessWrapperCorrelationIDAnno: "corr-1",
-		}},
-		Spec: corev1alpha1.TaskSpec{
-			Type:         corev1alpha1.TaskTypeAgent,
-			Prompt:       "continue",
-			PriorTaskRef: &corev1alpha1.PriorTaskReference{Name: "prior"},
-		},
-		Status: corev1alpha1.TaskStatus{HarnessRuntime: &corev1alpha1.HarnessRuntimeStatus{RuntimeRefName: "active-runtime"}},
-	}
-	agent := &corev1alpha1.Agent{
-		ObjectMeta: metav1.ObjectMeta{Name: "a1"},
-		Spec: corev1alpha1.AgentSpec{
-			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeCodex},
-		},
-	}
-	err := r.validateTaskAgentCompatibility(task, agent)
-	if err == nil || !strings.Contains(err.Error(), "priorTaskRef") {
-		t.Fatalf("validateTaskAgentCompatibility() error = %v, want priorTaskRef rejection", err)
+		t.Fatalf("validateTaskAgentCompatibility() error = %v, want conformant runtimeRef compatibility", err)
 	}
 }
 
@@ -2421,7 +2457,7 @@ func TestDeleteSubstratePoolActorsForLeasesSkipsLeaseReassignedBeforeActorDelete
 // ensureWorkerRBAC
 // ---------------------------------------------------------------------------
 
-func TestEnsureWorkerRBAC_CreatesResources(t *testing.T) {
+func TestEnsureWorkerRBAC_CreatesNamespacedResources(t *testing.T) {
 	scheme := newTestScheme()
 	r := newUnitReconciler(scheme)
 
@@ -2431,9 +2467,9 @@ func TestEnsureWorkerRBAC_CreatesResources(t *testing.T) {
 	}
 
 	expected := []struct {
-		serviceAccount     string
-		clusterRoleBinding string
-		clusterRole        string
+		serviceAccount string
+		roleBinding    string
+		clusterRole    string
 	}{
 		{AIWorkerServiceAccount, "orka-ai-worker-test-ns", DefaultAIWorkerClusterRoleName},
 		{VendorWorkerServiceAccount, "orka-vendor-worker-test-ns", DefaultVendorWorkerClusterRoleName},
@@ -2450,23 +2486,27 @@ func TestEnsureWorkerRBAC_CreatesResources(t *testing.T) {
 				t.Fatalf("expected SA %s to exist: %v", tt.serviceAccount, err)
 			}
 
-			// Verify matching ClusterRoleBinding was created.
-			crb := &rbacv1.ClusterRoleBinding{}
+			// Verify only a namespaced binding to the worker ClusterRole was created.
+			rb := &rbacv1.RoleBinding{}
 			if err := r.Get(context.Background(), types.NamespacedName{
-				Name: tt.clusterRoleBinding,
-			}, crb); err != nil {
-				t.Fatalf("expected CRB %s to exist: %v", tt.clusterRoleBinding, err)
+				Name: tt.roleBinding, Namespace: testNS,
+			}, rb); err != nil {
+				t.Fatalf("expected RoleBinding %s/%s to exist: %v", testNS, tt.roleBinding, err)
 			}
-			if crb.RoleRef.Name != tt.clusterRole {
-				t.Errorf("expected roleRef %s, got %s", tt.clusterRole, crb.RoleRef.Name)
+			if rb.RoleRef.Kind != "ClusterRole" || rb.RoleRef.Name != tt.clusterRole {
+				t.Errorf("expected ClusterRole roleRef %s, got %#v", tt.clusterRole, rb.RoleRef)
 			}
-			if len(crb.Subjects) != 1 {
-				t.Fatalf("expected 1 subject, got %d", len(crb.Subjects))
+			if len(rb.Subjects) != 1 {
+				t.Fatalf("expected 1 subject, got %d", len(rb.Subjects))
 			}
-			subject := crb.Subjects[0]
+			subject := rb.Subjects[0]
 			if subject.Kind != rbacv1.ServiceAccountKind || subject.Name != tt.serviceAccount || subject.Namespace != testNS {
 				t.Errorf("unexpected subject: %#v", subject)
 			}
+			crb := &rbacv1.ClusterRoleBinding{}
+			if err := r.Get(context.Background(), types.NamespacedName{Name: tt.roleBinding}, crb); !apierrors.IsNotFound(err) {
+				t.Fatalf("expected no ClusterRoleBinding %s, got err %v and object %#v", tt.roleBinding, err, crb)
+			}
 		})
 	}
 }
@@ -2483,12 +2523,12 @@ func TestEnsureWorkerRBAC_UsesConfiguredServiceAccountNames(t *testing.T) {
 	}
 
 	expected := []struct {
-		serviceAccount     string
-		clusterRoleBinding string
+		serviceAccount string
+		roleBinding    string
 	}{
-		{serviceAccount: testAIWorkerServiceAccountName, clusterRoleBinding: "orka-ai-worker-test-ns"},
-		{serviceAccount: testVendorWorkerServiceAccountName, clusterRoleBinding: "orka-vendor-worker-test-ns"},
-		{serviceAccount: testContainerWorkerServiceAccountName, clusterRoleBinding: "orka-container-worker-test-ns"},
+		{serviceAccount: testAIWorkerServiceAccountName, roleBinding: "orka-ai-worker-test-ns"},
+		{serviceAccount: testVendorWorkerServiceAccountName, roleBinding: "orka-vendor-worker-test-ns"},
+		{serviceAccount: testContainerWorkerServiceAccountName, roleBinding: "orka-container-worker-test-ns"},
 	}
 
 	for _, tt := range expected {
@@ -2498,15 +2538,15 @@ func TestEnsureWorkerRBAC_UsesConfiguredServiceAccountNames(t *testing.T) {
 				t.Fatalf("expected ServiceAccount %s/%s to exist: %v", testNS, tt.serviceAccount, err)
 			}
 
-			crb := &rbacv1.ClusterRoleBinding{}
-			if err := r.Get(context.Background(), types.NamespacedName{Name: tt.clusterRoleBinding}, crb); err != nil {
-				t.Fatalf("expected ClusterRoleBinding %s to exist: %v", tt.clusterRoleBinding, err)
+			rb := &rbacv1.RoleBinding{}
+			if err := r.Get(context.Background(), types.NamespacedName{Name: tt.roleBinding, Namespace: testNS}, rb); err != nil {
+				t.Fatalf("expected RoleBinding %s/%s to exist: %v", testNS, tt.roleBinding, err)
 			}
-			if len(crb.Subjects) != 1 {
-				t.Fatalf("ClusterRoleBinding %s subjects = %#v, want one subject", tt.clusterRoleBinding, crb.Subjects)
+			if len(rb.Subjects) != 1 {
+				t.Fatalf("RoleBinding %s/%s subjects = %#v, want one subject", testNS, tt.roleBinding, rb.Subjects)
 			}
-			if got := crb.Subjects[0]; got.Kind != rbacv1.ServiceAccountKind || got.Name != tt.serviceAccount || got.Namespace != testNS {
-				t.Fatalf("ClusterRoleBinding %s subject = %#v, want ServiceAccount %s/%s", tt.clusterRoleBinding, got, testNS, tt.serviceAccount)
+			if got := rb.Subjects[0]; got.Kind != rbacv1.ServiceAccountKind || got.Name != tt.serviceAccount || got.Namespace != testNS {
+				t.Fatalf("RoleBinding %s/%s subject = %#v, want ServiceAccount %s/%s", testNS, tt.roleBinding, got, testNS, tt.serviceAccount)
 			}
 		})
 	}
@@ -2519,80 +2559,40 @@ func TestEnsureWorkerRBAC_UsesConfiguredServiceAccountNames(t *testing.T) {
 	}
 }
 
-func TestEnsureWorkerRBAC_UsesNamespacedRoleBindingsWhenIsolationEnforced(t *testing.T) {
+func TestEnsureWorkerRBAC_DoesNotMigrateLegacyClusterRoleBindings(t *testing.T) {
 	scheme := newTestScheme()
-	r := newUnitReconciler(scheme)
-	r.EnforceNamespaceIsolation = true
-
-	if err := r.ensureWorkerRBAC(context.Background(), testNS); err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	expected := []struct {
-		serviceAccount string
-		binding        string
-		clusterRole    string
-	}{
-		{AIWorkerServiceAccount, "orka-ai-worker-test-ns", DefaultAIWorkerClusterRoleName},
-		{VendorWorkerServiceAccount, "orka-vendor-worker-test-ns", DefaultVendorWorkerClusterRoleName},
-		{ContainerWorkerServiceAccount, "orka-container-worker-test-ns", DefaultContainerWorkerClusterRoleName},
-	}
-
-	for _, tt := range expected {
-		t.Run(tt.serviceAccount, func(t *testing.T) {
-			rb := &rbacv1.RoleBinding{}
-			if err := r.Get(context.Background(), types.NamespacedName{Name: tt.binding, Namespace: testNS}, rb); err != nil {
-				t.Fatalf("expected RoleBinding %s/%s to exist: %v", testNS, tt.binding, err)
-			}
-			if rb.RoleRef.Kind != "ClusterRole" || rb.RoleRef.Name != tt.clusterRole {
-				t.Fatalf("unexpected roleRef: %#v", rb.RoleRef)
-			}
-			if len(rb.Subjects) != 1 {
-				t.Fatalf("expected 1 subject, got %d", len(rb.Subjects))
-			}
-			subject := rb.Subjects[0]
-			if subject.Kind != rbacv1.ServiceAccountKind || subject.Name != tt.serviceAccount || subject.Namespace != testNS {
-				t.Fatalf("unexpected subject: %#v", subject)
-			}
-
-			crb := &rbacv1.ClusterRoleBinding{}
-			if err := r.Get(context.Background(), types.NamespacedName{Name: tt.binding}, crb); !apierrors.IsNotFound(err) {
-				t.Fatalf("expected no ClusterRoleBinding %s, got err %v and object %#v", tt.binding, err, crb)
-			}
-		})
+	legacy := &rbacv1.ClusterRoleBinding{
+		ObjectMeta: metav1.ObjectMeta{Name: "orka-ai-worker-test-ns", Labels: map[string]string{managedByLabelKey: managedByLabelValue}},
+		RoleRef:    rbacv1.RoleRef{APIGroup: rbacv1.GroupName, Kind: "ClusterRole", Name: "old-ai-worker-role"},
+		Subjects: []rbacv1.Subject{
+			{Kind: rbacv1.ServiceAccountKind, Name: AIWorkerServiceAccount, Namespace: testNS},
+			{Kind: rbacv1.ServiceAccountKind, Name: "extra-worker", Namespace: testNS},
+		},
 	}
-}
-
-func TestEnsureWorkerRBAC_IsolationDeletesManagedLegacyClusterRoleBindings(t *testing.T) {
-	scheme := newTestScheme()
-	legacy := workerClusterRoleBinding(testNS, workerRBACSpec{
-		serviceAccountName:     AIWorkerServiceAccount,
-		clusterRoleName:        "old-ai-worker-role",
-		clusterRoleBindingName: "orka-ai-worker-test-ns",
-	})
-	legacy.Subjects = append(legacy.Subjects, rbacv1.Subject{Kind: rbacv1.ServiceAccountKind, Name: "extra-worker", Namespace: testNS})
 	r := newUnitReconciler(scheme, legacy)
-	r.EnforceNamespaceIsolation = true
 
 	if err := r.ensureWorkerRBAC(context.Background(), testNS); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 
 	crb := &rbacv1.ClusterRoleBinding{}
-	if err := r.Get(context.Background(), types.NamespacedName{Name: "orka-ai-worker-test-ns"}, crb); !apierrors.IsNotFound(err) {
-		t.Fatalf("expected managed legacy ClusterRoleBinding to be deleted, got err %v", err)
+	if err := r.Get(context.Background(), types.NamespacedName{Name: legacy.Name}, crb); err != nil {
+		t.Fatalf("legacy ClusterRoleBinding was touched: %v", err)
+	}
+	if !reflect.DeepEqual(crb.Subjects, legacy.Subjects) || crb.RoleRef != legacy.RoleRef {
+		t.Fatalf("legacy ClusterRoleBinding was mutated: %#v", crb)
 	}
 
 	rb := &rbacv1.RoleBinding{}
-	if err := r.Get(context.Background(), types.NamespacedName{Name: "orka-ai-worker-test-ns", Namespace: testNS}, rb); err != nil {
-		t.Fatalf("expected replacement RoleBinding to exist: %v", err)
+	if err := r.Get(context.Background(), types.NamespacedName{Name: legacy.Name, Namespace: testNS}, rb); err != nil {
+		t.Fatalf("expected independent namespaced RoleBinding to exist: %v", err)
 	}
 }
 
-func TestEnsureWorkerRBAC_UsesClusterRoleBindingPrefix(t *testing.T) {
+func TestEnsureWorkerRBAC_UsesRoleBindingPrefix(t *testing.T) {
 	scheme := newTestScheme()
 	r := newUnitReconciler(scheme)
-	r.WorkerClusterRoleBindingNamePrefix = "orka-dev"
+	r.WorkerRoleBindingNamePrefix = "orka-dev"
 	ctx := context.Background()
 
 	if err := r.ensureWorkerRBAC(ctx, testNS); err != nil {
@@ -2600,9 +2600,9 @@ func TestEnsureWorkerRBAC_UsesClusterRoleBindingPrefix(t *testing.T) {
 	}
 
 	expected := []struct {
-		serviceAccount     string
-		clusterRoleBinding string
-		clusterRole        string
+		serviceAccount string
+		roleBinding    string
+		clusterRole    string
 	}{
 		{AIWorkerServiceAccount, "orka-dev-ai-worker-test-ns", DefaultAIWorkerClusterRoleName},
 		{VendorWorkerServiceAccount, "orka-dev-vendor-worker-test-ns", DefaultVendorWorkerClusterRoleName},
@@ -2610,18 +2610,18 @@ func TestEnsureWorkerRBAC_UsesClusterRoleBindingPrefix(t *testing.T) {
 	}
 
 	for _, tt := range expected {
-		t.Run(tt.clusterRoleBinding, func(t *testing.T) {
-			crb := &rbacv1.ClusterRoleBinding{}
-			if err := r.Get(ctx, types.NamespacedName{Name: tt.clusterRoleBinding}, crb); err != nil {
-				t.Fatalf("expected prefixed CRB %s to exist: %v", tt.clusterRoleBinding, err)
+		t.Run(tt.roleBinding, func(t *testing.T) {
+			rb := &rbacv1.RoleBinding{}
+			if err := r.Get(ctx, types.NamespacedName{Name: tt.roleBinding, Namespace: testNS}, rb); err != nil {
+				t.Fatalf("expected prefixed RoleBinding %s/%s to exist: %v", testNS, tt.roleBinding, err)
 			}
-			if crb.RoleRef.Name != tt.clusterRole {
-				t.Fatalf("expected roleRef %s, got %s", tt.clusterRole, crb.RoleRef.Name)
+			if rb.RoleRef.Name != tt.clusterRole {
+				t.Fatalf("expected roleRef %s, got %s", tt.clusterRole, rb.RoleRef.Name)
 			}
-			if len(crb.Subjects) != 1 {
-				t.Fatalf("expected 1 subject, got %d", len(crb.Subjects))
+			if len(rb.Subjects) != 1 {
+				t.Fatalf("expected 1 subject, got %d", len(rb.Subjects))
 			}
-			subject := crb.Subjects[0]
+			subject := rb.Subjects[0]
 			if subject.Kind != rbacv1.ServiceAccountKind || subject.Name != tt.serviceAccount || subject.Namespace != testNS {
 				t.Fatalf("unexpected subject: %#v", subject)
 			}
@@ -2629,29 +2629,29 @@ func TestEnsureWorkerRBAC_UsesClusterRoleBindingPrefix(t *testing.T) {
 	}
 }
 
-func TestWorkerClusterRoleBindingNameTruncatesLongNames(t *testing.T) {
+func TestWorkerRoleBindingNameTruncatesLongNames(t *testing.T) {
 	prefix := strings.Repeat("p", 230)
 	namespace := strings.Repeat("n", 80)
 
-	got := workerClusterRoleBindingName(prefix, "container", namespace)
-	if len(got) != maxWorkerClusterRoleBindingNameLength {
-		t.Fatalf("expected name length %d, got %d", maxWorkerClusterRoleBindingNameLength, len(got))
+	got := workerRoleBindingName(prefix, "container", namespace)
+	if len(got) != maxWorkerRoleBindingNameLength {
+		t.Fatalf("expected name length %d, got %d", maxWorkerRoleBindingNameLength, len(got))
 	}
-	if got != workerClusterRoleBindingName(prefix, "container", namespace) {
+	if got != workerRoleBindingName(prefix, "container", namespace) {
 		t.Fatal("expected truncated name to be stable")
 	}
-	if got == workerClusterRoleBindingName(prefix, "vendor", namespace) {
+	if got == workerRoleBindingName(prefix, "vendor", namespace) {
 		t.Fatal("expected hash suffix to distinguish names that share a truncated prefix")
 	}
 }
 
 func TestEnsureWorkerRBAC_Idempotent(t *testing.T) {
 	scheme := newTestScheme()
-	// Pre-create all SAs and CRBs.
+	// Pre-create all SAs and namespaced RoleBindings.
 	expected := []struct {
-		serviceAccount     string
-		clusterRoleBinding string
-		clusterRole        string
+		serviceAccount string
+		roleBinding    string
+		clusterRole    string
 	}{
 		{AIWorkerServiceAccount, "orka-ai-worker-test-ns", DefaultAIWorkerClusterRoleName},
 		{VendorWorkerServiceAccount, "orka-vendor-worker-test-ns", DefaultVendorWorkerClusterRoleName},
@@ -2664,8 +2664,8 @@ func TestEnsureWorkerRBAC_Idempotent(t *testing.T) {
 			&corev1.ServiceAccount{
 				ObjectMeta: metav1.ObjectMeta{Name: tt.serviceAccount, Namespace: testNS},
 			},
-			&rbacv1.ClusterRoleBinding{
-				ObjectMeta: metav1.ObjectMeta{Name: tt.clusterRoleBinding},
+			&rbacv1.RoleBinding{
+				ObjectMeta: metav1.ObjectMeta{Name: tt.roleBinding, Namespace: testNS},
 				RoleRef: rbacv1.RoleRef{
 					APIGroup: rbacv1.GroupName,
 					Kind:     "ClusterRole",
@@ -2721,31 +2721,32 @@ func TestEnsureWorkerServiceAccountPreservesAppManagedByLabel(t *testing.T) {
 	}
 }
 
-func TestEnsureWorkerClusterRoleBindingAlreadyExistsRaceUpdatesExistingBinding(t *testing.T) {
+func TestEnsureWorkerRoleBindingAlreadyExistsRaceUpdatesExistingBinding(t *testing.T) {
 	scheme := newTestScheme()
 	ctx := context.Background()
 	namespace := "race-ns"
 	spec := workerRBACSpec{
-		serviceAccountName:     AIWorkerServiceAccount,
-		clusterRoleName:        DefaultAIWorkerClusterRoleName,
-		clusterRoleBindingName: fmt.Sprintf("orka-ai-worker-%s", namespace),
+		serviceAccountName: AIWorkerServiceAccount,
+		clusterRoleName:    DefaultAIWorkerClusterRoleName,
+		roleBindingName:    fmt.Sprintf("orka-ai-worker-%s", namespace),
 	}
 
 	interceptedCreate := false
 	fc := fake.NewClientBuilder().WithScheme(scheme).WithInterceptorFuncs(interceptor.Funcs{
 		Create: func(ctx context.Context, c client.WithWatch, obj client.Object, opts ...client.CreateOption) error {
-			if obj.GetName() != spec.clusterRoleBindingName {
+			if obj.GetName() != spec.roleBindingName || obj.GetNamespace() != namespace {
 				return c.Create(ctx, obj, opts...)
 			}
-			if _, ok := obj.(*rbacv1.ClusterRoleBinding); !ok {
+			if _, ok := obj.(*rbacv1.RoleBinding); !ok {
 				return c.Create(ctx, obj, opts...)
 			}
 
 			interceptedCreate = true
-			existing := &rbacv1.ClusterRoleBinding{
+			existing := &rbacv1.RoleBinding{
 				ObjectMeta: metav1.ObjectMeta{
-					Name:   spec.clusterRoleBindingName,
-					Labels: map[string]string{staleResourceLabelKey: staleResourceLabelValue},
+					Name:      spec.roleBindingName,
+					Namespace: namespace,
+					Labels:    map[string]string{staleResourceLabelKey: staleResourceLabelValue},
 				},
 				RoleRef: rbacv1.RoleRef{
 					APIGroup: rbacv1.GroupName,
@@ -2759,12 +2760,12 @@ func TestEnsureWorkerClusterRoleBindingAlreadyExistsRaceUpdatesExistingBinding(t
 				}},
 			}
 			if err := c.Create(ctx, existing); err != nil {
-				t.Fatalf("creating raced ClusterRoleBinding fixture: %v", err)
+				t.Fatalf("creating raced RoleBinding fixture: %v", err)
 			}
 
 			return apierrors.NewAlreadyExists(
-				schema.GroupResource{Group: rbacv1.GroupName, Resource: "clusterrolebindings"},
-				spec.clusterRoleBindingName,
+				schema.GroupResource{Group: rbacv1.GroupName, Resource: "rolebindings"},
+				spec.roleBindingName,
 			)
 		},
 	}).Build()
@@ -2773,16 +2774,16 @@ func TestEnsureWorkerClusterRoleBindingAlreadyExistsRaceUpdatesExistingBinding(t
 	r.Client = fc
 	r.JobBuilder = NewJobBuilder(fc)
 
-	if err := r.ensureWorkerClusterRoleBinding(ctx, namespace, spec); err != nil {
+	if err := r.ensureWorkerRoleBinding(ctx, namespace, spec); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	if !interceptedCreate {
 		t.Fatal("expected create to be intercepted")
 	}
 
-	got := &rbacv1.ClusterRoleBinding{}
-	if err := fc.Get(ctx, types.NamespacedName{Name: spec.clusterRoleBindingName}, got); err != nil {
-		t.Fatalf("expected raced ClusterRoleBinding to exist: %v", err)
+	got := &rbacv1.RoleBinding{}
+	if err := fc.Get(ctx, types.NamespacedName{Name: spec.roleBindingName, Namespace: namespace}, got); err != nil {
+		t.Fatalf("expected raced RoleBinding to exist: %v", err)
 	}
 	if got.Labels[managedByLabelKey] != managedByLabelValue {
 		t.Fatalf("expected managed-by label to be reconciled, got labels %#v", got.Labels)
@@ -2796,19 +2797,20 @@ func TestEnsureWorkerClusterRoleBindingAlreadyExistsRaceUpdatesExistingBinding(t
 	}
 }
 
-func TestEnsureWorkerClusterRoleBindingRecreatesStaleRoleRef(t *testing.T) {
+func TestEnsureWorkerRoleBindingRecreatesStaleRoleRef(t *testing.T) {
 	scheme := newTestScheme()
 	ctx := context.Background()
 	namespace := "stale-ns"
 	spec := workerRBACSpec{
-		serviceAccountName:     AIWorkerServiceAccount,
-		clusterRoleName:        DefaultAIWorkerClusterRoleName,
-		clusterRoleBindingName: fmt.Sprintf("orka-ai-worker-%s", namespace),
+		serviceAccountName: AIWorkerServiceAccount,
+		clusterRoleName:    DefaultAIWorkerClusterRoleName,
+		roleBindingName:    fmt.Sprintf("orka-ai-worker-%s", namespace),
 	}
 
-	stale := &rbacv1.ClusterRoleBinding{
+	stale := &rbacv1.RoleBinding{
 		ObjectMeta: metav1.ObjectMeta{
-			Name: spec.clusterRoleBindingName,
+			Name:      spec.roleBindingName,
+			Namespace: namespace,
 			Labels: map[string]string{
 				staleResourceLabelKey: staleResourceLabelValue,
 			},
@@ -2826,13 +2828,13 @@ func TestEnsureWorkerClusterRoleBindingRecreatesStaleRoleRef(t *testing.T) {
 	}
 	r := newUnitReconciler(scheme, stale)
 
-	if err := r.ensureWorkerClusterRoleBinding(ctx, namespace, spec); err != nil {
+	if err := r.ensureWorkerRoleBinding(ctx, namespace, spec); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 
-	got := &rbacv1.ClusterRoleBinding{}
-	if err := r.Get(ctx, types.NamespacedName{Name: spec.clusterRoleBindingName}, got); err != nil {
-		t.Fatalf("expected ClusterRoleBinding to exist after remediation: %v", err)
+	got := &rbacv1.RoleBinding{}
+	if err := r.Get(ctx, types.NamespacedName{Name: spec.roleBindingName, Namespace: namespace}, got); err != nil {
+		t.Fatalf("expected RoleBinding to exist after remediation: %v", err)
 	}
 	wantRoleRef := rbacv1.RoleRef{
 		APIGroup: rbacv1.GroupName,
@@ -3199,7 +3201,70 @@ func TestHandleDeletion_NoFinalizer(t *testing.T) {
 	}
 }
 
+func TestHandleDeletionRemovesFinalizerWithMetadataOnlyPatch(t *testing.T) {
+	scheme := newTestScheme()
+	now := metav1.Now()
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:              "del-agent-metadata",
+			Namespace:         "default",
+			DeletionTimestamp: &now,
+			Finalizers:        []string{labels.TaskFinalizer},
+		},
+		Spec: corev1alpha1.TaskSpec{
+			Type:    corev1alpha1.TaskTypeAgent,
+			Timeout: &metav1.Duration{Duration: 12 * time.Minute},
+		},
+	}
+	r := newUnitReconciler(scheme, task)
+	base, ok := r.Client.(client.WithWatch)
+	if !ok {
+		t.Fatal("fake client does not implement client.WithWatch")
+	}
+	patchInspected := false
+	r.Client = interceptor.NewClient(base, interceptor.Funcs{
+		Update: func(ctx context.Context, delegate client.WithWatch, object client.Object, options ...client.UpdateOption) error {
+			if _, ok := object.(*corev1alpha1.Task); ok {
+				return errors.New("full Task update is forbidden while removing the finalizer")
+			}
+			return delegate.Update(ctx, object, options...)
+		},
+		Patch: func(ctx context.Context, delegate client.WithWatch, object client.Object, patch client.Patch, options ...client.PatchOption) error {
+			if _, ok := object.(*corev1alpha1.Task); ok {
+				data, err := patch.Data(object)
+				if err != nil {
+					return err
+				}
+				var body map[string]any
+				if err := json.Unmarshal(data, &body); err != nil {
+					return err
+				}
+				if _, present := body["spec"]; present {
+					return fmt.Errorf("finalizer patch unexpectedly contains spec: %s", data)
+				}
+				metadata, ok := body["metadata"].(map[string]any)
+				if !ok {
+					return fmt.Errorf("finalizer patch has no metadata: %s", data)
+				}
+				if _, present := metadata["finalizers"]; !present {
+					return fmt.Errorf("finalizer patch has no finalizers: %s", data)
+				}
+				patchInspected = true
+			}
+			return delegate.Patch(ctx, object, patch, options...)
+		},
+	})
+
+	if _, err := r.handleDeletion(context.Background(), task); err != nil {
+		t.Fatalf("handleDeletion() error = %v", err)
+	}
+	if !patchInspected {
+		t.Fatal("finalizer removal patch was not inspected")
+	}
+}
+
 func TestHandleDeletion_WithPersistedResultWithoutResultRef(t *testing.T) {
+
 	scheme := newTestScheme()
 	task := &corev1alpha1.Task{
 		ObjectMeta: metav1.ObjectMeta{
@@ -5585,6 +5650,78 @@ func TestReconcile_AddFinalizer(t *testing.T) {
 	}
 }
 
+func TestReconcile_AddFinalizerUsesMetadataOnlyPatch(t *testing.T) {
+	scheme := newTestScheme()
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "rec-fin-metadata", Namespace: "default"},
+		Spec: corev1alpha1.TaskSpec{
+			Type:    corev1alpha1.TaskTypeAgent,
+			Timeout: &metav1.Duration{Duration: 12 * time.Minute},
+		},
+	}
+	r := newUnitReconciler(scheme, task)
+	base, ok := r.Client.(client.WithWatch)
+	if !ok {
+		t.Fatal("fake client does not implement client.WithWatch")
+	}
+	patchInspected := false
+	r.Client = interceptor.NewClient(base, interceptor.Funcs{
+		Update: func(ctx context.Context, delegate client.WithWatch, object client.Object, options ...client.UpdateOption) error {
+			if _, ok := object.(*corev1alpha1.Task); ok {
+				return errors.New("full Task update is forbidden while adding the finalizer")
+			}
+			return delegate.Update(ctx, object, options...)
+		},
+		Patch: func(ctx context.Context, delegate client.WithWatch, object client.Object, patch client.Patch, options ...client.PatchOption) error {
+			if _, ok := object.(*corev1alpha1.Task); ok {
+				data, err := patch.Data(object)
+				if err != nil {
+					return err
+				}
+				var body map[string]any
+				if err := json.Unmarshal(data, &body); err != nil {
+					return err
+				}
+				if _, present := body["spec"]; present {
+					return fmt.Errorf("finalizer patch unexpectedly contains spec: %s", data)
+				}
+				metadata, ok := body["metadata"].(map[string]any)
+				if !ok {
+					return fmt.Errorf("finalizer patch has no metadata: %s", data)
+				}
+				if _, present := metadata["finalizers"]; !present {
+					return fmt.Errorf("finalizer patch has no finalizers: %s", data)
+				}
+				patchInspected = true
+			}
+			return delegate.Patch(ctx, object, patch, options...)
+		},
+	})
+
+	result, err := r.Reconcile(context.Background(), ctrl.Request{
+		NamespacedName: types.NamespacedName{Name: task.Name, Namespace: task.Namespace},
+	})
+	if err != nil {
+		t.Fatalf("Reconcile() error = %v", err)
+	}
+	if result.RequeueAfter != time.Second {
+		t.Fatalf("RequeueAfter = %s, want 1s", result.RequeueAfter)
+	}
+	if !patchInspected {
+		t.Fatal("finalizer patch was not inspected")
+	}
+	var updated corev1alpha1.Task
+	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, &updated); err != nil {
+		t.Fatalf("get updated Task: %v", err)
+	}
+	if !controllerutil.ContainsFinalizer(&updated, labels.TaskFinalizer) {
+		t.Fatal("Task finalizer was not added")
+	}
+	if updated.Spec.Timeout == nil || updated.Spec.Timeout.Duration != 12*time.Minute {
+		t.Fatalf("Task timeout = %#v, want 12m", updated.Spec.Timeout)
+	}
+}
+
 func TestReconcile_InitializeStatus(t *testing.T) {
 	scheme := newTestScheme()
 	task := &corev1alpha1.Task{
@@ -5664,12 +5801,15 @@ func TestHandlePending_TransactionTokenPendingRequeuesWithoutJob(t *testing.T) {
 	}
 }
 
-func TestHandlePending_AgentRuntimeWithoutSecretUsesHarnessWrapperNotJob(t *testing.T) {
+func TestHandlePending_BuiltInAgentRuntimeFailsClosedWhenACPDisabled(t *testing.T) {
 	scheme := newTestScheme()
 	agent := &corev1alpha1.Agent{
 		ObjectMeta: metav1.ObjectMeta{Name: "agent", Namespace: defaultNS},
 		Spec: corev1alpha1.AgentSpec{
-			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeCodex},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type:            corev1alpha1.AgentRuntimeCodex,
+				ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
 		},
 	}
 	task := &corev1alpha1.Task{
@@ -5698,8 +5838,68 @@ func TestHandlePending_AgentRuntimeWithoutSecretUsesHarnessWrapperNotJob(t *test
 	if updated.Status.Phase != corev1alpha1.TaskPhaseFailed {
 		t.Fatalf("phase = %s, want Failed", updated.Status.Phase)
 	}
-	if !strings.Contains(updated.Status.Message, harnessWrapperEndpointEnv) {
-		t.Fatalf("message = %q, want harness wrapper endpoint failure", updated.Status.Message)
+	if !strings.Contains(updated.Status.Message, "no fallback execution path") {
+		t.Fatalf("message = %q, want fail-closed ACP-disabled error", updated.Status.Message)
+	}
+	assertNoJobsForTask(t, r, task)
+}
+
+func TestHandlePending_ExternalRuntimeRefFailsBeforeAttemptCreation(t *testing.T) {
+	scheme := newTestScheme()
+	externalRuntime := plannerExternalRuntime()
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "external-agent", Namespace: defaultNS},
+		Spec: corev1alpha1.AgentSpec{
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: externalRuntime.Name},
+			},
+		},
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "external-task", Namespace: defaultNS},
+		Spec: corev1alpha1.TaskSpec{
+			Type:     corev1alpha1.TaskTypeAgent,
+			AgentRef: &corev1alpha1.AgentReference{Name: agent.Name},
+			Prompt:   "do work",
+		},
+		Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhasePending},
+	}
+	r := newUnitReconciler(scheme, task, agent, externalRuntime)
+	r.ACPRuntimeEnabled = true
+
+	result, err := r.handlePending(context.Background(), task)
+	if err != nil {
+		t.Fatalf("handlePending() error = %v", err)
+	}
+	if result.RequeueAfter != time.Second {
+		t.Fatalf("RequeueAfter = %v, want %v", result.RequeueAfter, time.Second)
+	}
+
+	updated := &corev1alpha1.Task{}
+	if err := r.Get(context.Background(), types.NamespacedName{Name: task.Name, Namespace: task.Namespace}, updated); err != nil {
+		t.Fatalf("Get updated task: %v", err)
+	}
+	if updated.Status.Phase != corev1alpha1.TaskPhaseFailed {
+		t.Fatalf("phase = %s, want Failed", updated.Status.Phase)
+	}
+	if !strings.Contains(updated.Status.Message, "Task dispatch is not supported until the v2 dispatcher is wired") {
+		t.Fatalf("message = %q, want external dispatch support-boundary rejection", updated.Status.Message)
+	}
+	if updated.Status.Attempts != 0 {
+		t.Fatalf("attempts = %d, want 0", updated.Status.Attempts)
+	}
+	if updated.Status.Execution != nil {
+		t.Fatalf("execution = %#v, want nil", updated.Status.Execution)
+	}
+	if _, exists := updated.Labels[acpExternalRuntimeTaskLabel]; exists {
+		t.Fatalf("external runtime label was written: %v", updated.Labels)
+	}
+	attempts := &corev1alpha1.PromptAttemptList{}
+	if err := r.List(context.Background(), attempts, client.InNamespace(task.Namespace)); err != nil {
+		t.Fatalf("list PromptAttempts: %v", err)
+	}
+	if len(attempts.Items) != 0 {
+		t.Fatalf("PromptAttempts = %d, want 0", len(attempts.Items))
 	}
 	assertNoJobsForTask(t, r, task)
 }
@@ -5709,7 +5909,9 @@ func TestHandlePending_AgentRuntimeWithResourcesFailsBeforeJobBackend(t *testing
 	agent := &corev1alpha1.Agent{
 		ObjectMeta: metav1.ObjectMeta{Name: "agent", Namespace: defaultNS},
 		Spec: corev1alpha1.AgentSpec{
-			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeCodex},
+			Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type: corev1alpha1.AgentRuntimeCodex, ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+			},
 		},
 	}
 	task := &corev1alpha1.Task{
@@ -5725,6 +5927,7 @@ func TestHandlePending_AgentRuntimeWithResourcesFailsBeforeJobBackend(t *testing
 		Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhasePending},
 	}
 	r := newUnitReconciler(scheme, task, agent)
+	r.ACPRuntimeEnabled = true
 
 	result, err := r.handlePending(context.Background(), task)
 	if err != nil {
@@ -5772,7 +5975,7 @@ func TestHandlePending_AgentRuntimeUnsupportedPlannerFeaturesFailBeforeJobBacken
 			mutateTask: func(task *corev1alpha1.Task) {
 				task.Spec.PriorTaskRef = &corev1alpha1.PriorTaskReference{Name: "prior", Namespace: "other"}
 			},
-			want: "cross-namespace priorTaskRef",
+			want: "use sessionRef",
 		},
 	}
 
@@ -5782,7 +5985,9 @@ func TestHandlePending_AgentRuntimeUnsupportedPlannerFeaturesFailBeforeJobBacken
 			agent := &corev1alpha1.Agent{
 				ObjectMeta: metav1.ObjectMeta{Name: "agent", Namespace: defaultNS},
 				Spec: corev1alpha1.AgentSpec{
-					Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeCodex},
+					Runtime: &corev1alpha1.AgentCLIRuntime{
+						Type: corev1alpha1.AgentRuntimeCodex, ContractVersion: ptr.To(corev1alpha1.AgentRuntimeContractHarnessV2),
+					},
 				},
 			}
 			task := &corev1alpha1.Task{
@@ -5796,6 +6001,7 @@ func TestHandlePending_AgentRuntimeUnsupportedPlannerFeaturesFailBeforeJobBacken
 			}
 			tt.mutateTask(task)
 			r := newUnitReconciler(scheme, task, agent)
+			r.ACPRuntimeEnabled = true
 			r.EnforceNamespaceIsolation = true
 
 			result, err := r.handlePending(context.Background(), task)
@@ -5871,7 +6077,7 @@ func TestHandlePending_AgentRuntimeValidWorkspaceFailsBeforeJobBackend(t *testin
 	if updated.Status.Phase != corev1alpha1.TaskPhaseFailed {
 		t.Fatalf("phase = %s, want Failed", updated.Status.Phase)
 	}
-	if !strings.Contains(updated.Status.Message, "execution workspace is not supported by harness runtime yet") {
+	if !strings.Contains(updated.Status.Message, "Task.spec.execution.workspace is not supported by the ACP core runtime; use Task.spec.workspace") {
 		t.Fatalf("message = %q, want workspace unsupported failure", updated.Status.Message)
 	}
 	assertExecutionWorkspaceValidationFailedStatus(
@@ -5879,7 +6085,7 @@ func TestHandlePending_AgentRuntimeValidWorkspaceFailsBeforeJobBackend(t *testin
 		updated.Status.ExecutionWorkspace,
 		corev1alpha1.WorkspaceProviderAgentSandbox,
 		template.Name,
-		"execution workspace is not supported by harness runtime yet",
+		"Task.spec.execution.workspace is not supported by the ACP core runtime; use Task.spec.workspace",
 	)
 	assertNoJobsForTask(t, r, task)
 }
@@ -6889,6 +7095,148 @@ func TestHandlePending_WithSessionRef(t *testing.T) {
 	}
 }
 
+func TestHandlePending_AgentSessionWaitExpiresAtAbsoluteDeadline(t *testing.T) {
+	scheme := newTestScheme()
+	timeout := metav1.Duration{Duration: time.Minute}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "pend-expired-session", Namespace: "default", UID: "12345678-abcd-efgh-ijkl-1234567890ad",
+			CreationTimestamp: metav1.NewTime(time.Now().UTC().Add(-2 * time.Minute)),
+		},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent, Prompt: "expired before session lock",
+			Timeout: &timeout, SessionRef: &corev1alpha1.SessionReference{Name: "busy-session", Create: true, Append: true},
+		},
+		Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhasePending},
+	}
+	r := newUnitReconciler(scheme, task)
+	result, err := r.handlePending(context.Background(), task)
+	if err != nil {
+		t.Fatalf("handlePending() error = %v", err)
+	}
+	if result.RequeueAfter != 0 {
+		t.Fatalf("result = %#v, want terminal result", result)
+	}
+	updated := &corev1alpha1.Task{}
+	if err := r.Get(context.Background(), client.ObjectKeyFromObject(task), updated); err != nil {
+		t.Fatal(err)
+	}
+	if updated.Status.Phase != corev1alpha1.TaskPhaseCancelled || updated.Status.Execution == nil ||
+		updated.Status.Execution.State != corev1alpha1.TaskExecutionStateCancelled ||
+		updated.Status.Execution.Outcome != corev1alpha1.TaskExecutionOutcomeCancelled ||
+		updated.Status.Execution.Reason != corev1alpha1.TaskExecutionReason("TaskTimeout") ||
+		updated.Status.Execution.Attempt != 0 || updated.Status.Execution.PromptID != "" ||
+		updated.Status.Delivery == nil || updated.Status.Delivery.State != corev1alpha1.TaskDeliveryStateNotRequested {
+		t.Fatalf("expired pending Task status = %#v", updated.Status)
+	}
+}
+
+func TestHandlePending_ExpiredAgentSettlesDurableAttemptBeforeStatusBinding(t *testing.T) {
+	scheme := newTestScheme()
+	timeout := metav1.Duration{Duration: time.Minute}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "expired-durable-attempt", Namespace: "default", UID: "12345678-abcd-efgh-ijkl-1234567890ae",
+			CreationTimestamp: metav1.NewTime(time.Now().UTC().Add(-2 * time.Minute)),
+		},
+		Spec:   corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent, Prompt: "expired after attempt create", Timeout: &timeout},
+		Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhasePending},
+	}
+	r := newUnitReconciler(scheme, task)
+	db, err := sqlite.NewDB(":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close() //nolint:errcheck
+	controlStore := sqlite.NewStore(db, "expired-attempt-test")
+	epochs := NewControllerEpochManager(controlStore, "expired-attempt-controller")
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	fence, err := epochs.CurrentFence(ctx)
+	if err != nil {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+	promptID := fmt.Sprintf("prompt-%s-1", task.UID)
+	attemptKey := store.PromptAttemptKey{Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1, PromptID: promptID}
+	attempt, err := controlStore.CreatePromptAttempt(ctx, boundPromptAttemptForTest(&store.PromptAttempt{
+		Key: attemptKey, RequestDigest: testControlDigestForDispatcher("expired-durable-attempt"),
+		ExecutionState: store.PromptExecutionQueued, DeliveryState: store.PromptDeliveryNotRequested,
+	}), fence)
+	if err != nil {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+	r.DurableControlStore = controlStore
+	r.ControllerEpochManager = epochs
+	r.APIReader = r.Client
+
+	result, err := r.handlePending(ctx, task.DeepCopy())
+	if err != nil {
+		cancelEpoch()
+		t.Fatalf("handlePending() error = %v", err)
+	}
+	if result.RequeueAfter != 0 {
+		cancelEpoch()
+		t.Fatalf("result = %#v, want terminal result", result)
+	}
+	settled, err := controlStore.GetPromptAttempt(ctx, attempt.ID)
+	if err != nil {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+	if settled.ExecutionState != store.PromptExecutionCancelled {
+		cancelEpoch()
+		t.Fatalf("attempt state = %s, want %s", settled.ExecutionState, store.PromptExecutionCancelled)
+	}
+	updated := &corev1alpha1.Task{}
+	if err := r.Get(ctx, client.ObjectKeyFromObject(task), updated); err != nil {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+	if updated.Status.Execution == nil || updated.Status.Execution.Attempt != 1 || updated.Status.Execution.PromptID != promptID ||
+		updated.Status.Execution.RequestDigest != attempt.RequestDigest || updated.Status.Execution.State != corev1alpha1.TaskExecutionStateCancelled ||
+		!acpTaskRequiresAuthoritativeAttemptDiscovery(updated) {
+		cancelEpoch()
+		t.Fatalf("settled Task status = %#v", updated.Status)
+	}
+	cancelEpoch()
+	if err := <-epochDone; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestCancelACPTaskBeforeDurableAttemptDoesNotOverwriteFreshExecutionStatus(t *testing.T) {
+	scheme := newTestScheme()
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "fresh-status", Namespace: "default", UID: "12345678-abcd-efgh-ijkl-1234567890af"},
+		Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent},
+		Status: corev1alpha1.TaskStatus{Phase: corev1alpha1.TaskPhasePending, Execution: &corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateQueued, Attempt: 1, PromptID: "prompt-fresh-status-1",
+		}},
+	}
+	r := newUnitReconciler(scheme, task)
+	stale := task.DeepCopy()
+	stale.Status.Execution = nil
+	result, err := r.cancelACPTaskBeforeDurableAttempt(context.Background(), stale, "expired")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.RequeueAfter != time.Second {
+		t.Fatalf("result = %#v, want one-second retry", result)
+	}
+	updated := &corev1alpha1.Task{}
+	if err := r.Get(context.Background(), client.ObjectKeyFromObject(task), updated); err != nil {
+		t.Fatal(err)
+	}
+	if updated.Status.Execution == nil || updated.Status.Execution.State != corev1alpha1.TaskExecutionStateQueued || updated.Status.Phase != corev1alpha1.TaskPhasePending {
+		t.Fatalf("fresh status was overwritten: %#v", updated.Status)
+	}
+}
+
 func TestHandlePending_WithMissingSessionCreateFalseFailsTask(t *testing.T) {
 	scheme := newTestScheme()
 	task := &corev1alpha1.Task{
@@ -7239,7 +7587,7 @@ func TestResolveProvider_AgentFallback(t *testing.T) {
 // ensureWorkerRBAC — error paths
 // ---------------------------------------------------------------------------
 
-func TestEnsureWorkerRBAC_SAExistsButCRBMissing(t *testing.T) {
+func TestEnsureWorkerRBAC_SAExistsButRoleBindingsMissing(t *testing.T) {
 	scheme := newTestScheme()
 	sa := &corev1.ServiceAccount{
 		ObjectMeta: metav1.ObjectMeta{Name: AIWorkerServiceAccount, Namespace: "test-ns2"},
@@ -7256,12 +7604,17 @@ func TestEnsureWorkerRBAC_SAExistsButCRBMissing(t *testing.T) {
 		fmt.Sprintf("orka-container-worker-%s", "test-ns2"),
 	}
 	for _, bindingName := range expectedBindings {
-		// CRB should be created.
-		crb := &rbacv1.ClusterRoleBinding{}
+		// The installation may only grant worker access inside its watched
+		// namespace; no cluster-wide binding is created.
+		rb := &rbacv1.RoleBinding{}
 		if err := r.Get(context.Background(), types.NamespacedName{
-			Name: bindingName,
-		}, crb); err != nil {
-			t.Errorf("expected CRB %s to be created: %v", bindingName, err)
+			Name: bindingName, Namespace: "test-ns2",
+		}, rb); err != nil {
+			t.Errorf("expected RoleBinding test-ns2/%s to be created: %v", bindingName, err)
+		}
+		crb := &rbacv1.ClusterRoleBinding{}
+		if err := r.Get(context.Background(), types.NamespacedName{Name: bindingName}, crb); !apierrors.IsNotFound(err) {
+			t.Errorf("expected no ClusterRoleBinding %s, got err %v and object %#v", bindingName, err, crb)
 		}
 	}
 }
@@ -7594,6 +7947,118 @@ func TestHandleCompletedCleansJobWhenTerminalEventAppendFails(t *testing.T) {
 	}
 }
 
+func TestCompleteExecutedTaskBeginsFinalizingUntilWorkspaceAuthorityIsRevoked(t *testing.T) {
+	scheme := newTestScheme()
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "finalize-after-execution", Namespace: "default"},
+		Spec:       corev1alpha1.TaskSpec{Execution: &corev1alpha1.ExecutionSpec{Workspace: &corev1alpha1.ExecutionWorkspaceSpec{Enabled: true}}},
+		Status: corev1alpha1.TaskStatus{
+			Phase: corev1alpha1.TaskPhaseRunning,
+			ExecutionWorkspace: &corev1alpha1.ExecutionWorkspaceStatus{
+				AttachedEpoch: 2,
+				Conditions:    []metav1.Condition{{Type: "Attached", Status: metav1.ConditionTrue}},
+			},
+		},
+	}
+	reconciler := newUnitReconciler(scheme, task)
+	result, err := reconciler.completeExecutedTask(context.Background(), task, corev1alpha1.TaskPhaseSucceeded, "execution complete")
+	if err != nil {
+		t.Fatalf("completeExecutedTask() error = %v", err)
+	}
+	if result.RequeueAfter <= 0 {
+		t.Fatalf("completeExecutedTask() result = %#v, want finalization requeue", result)
+	}
+	updated := &corev1alpha1.Task{}
+	if err := reconciler.Get(context.Background(), client.ObjectKeyFromObject(task), updated); err != nil {
+		t.Fatal(err)
+	}
+	if updated.Status.Phase != corev1alpha1.TaskPhaseFinalizing || updated.Status.CompletionTime != nil {
+		t.Fatalf("status = %#v, want Finalizing without completion time", updated.Status)
+	}
+	if updated.Status.ExecutionOutcome == nil || updated.Status.ExecutionOutcome.Phase != corev1alpha1.TaskPhaseSucceeded {
+		t.Fatalf("execution outcome = %#v, want immutable Succeeded outcome", updated.Status.ExecutionOutcome)
+	}
+	complete := meta.FindStatusCondition(updated.Status.Conditions, ConditionTypeComplete)
+	if complete == nil || complete.Status != metav1.ConditionFalse || complete.Reason != "TaskFinalizing" {
+		t.Fatalf("complete condition = %#v, want TaskFinalizing false", complete)
+	}
+}
+
+func TestHandleFinalizingBeginsWorkspaceAttachmentRevocation(t *testing.T) {
+	scheme := newTestScheme()
+	epoch := int64(2)
+	workspaceObject := &workspacev1alpha1.ExecutionWorkspace{
+		ObjectMeta: metav1.ObjectMeta{Name: "workspace-finalize", Namespace: "default", UID: types.UID("workspace-uid")},
+		Spec: workspacev1alpha1.ExecutionWorkspaceSpec{
+			AttachmentEpoch: epoch,
+			Attachment:      &workspacev1alpha1.ExecutionWorkspaceAttachment{Epoch: epoch},
+		},
+		Status: workspacev1alpha1.ExecutionWorkspaceStatus{AttachedEpoch: epoch},
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "finalize-revoke", Namespace: "default"},
+		Spec:       corev1alpha1.TaskSpec{Execution: &corev1alpha1.ExecutionSpec{Workspace: &corev1alpha1.ExecutionWorkspaceSpec{Enabled: true}}},
+		Status: corev1alpha1.TaskStatus{
+			Phase:            corev1alpha1.TaskPhaseFinalizing,
+			ExecutionOutcome: &corev1alpha1.TaskWorkloadExecutionOutcome{Phase: corev1alpha1.TaskPhaseSucceeded, Attempt: 1},
+			ExecutionWorkspace: &corev1alpha1.ExecutionWorkspaceStatus{
+				WorkspaceRef:  &corev1alpha1.WorkspaceObjectReference{Name: workspaceObject.Name, UID: string(workspaceObject.UID)},
+				AttachedEpoch: epoch,
+				Conditions:    []metav1.Condition{{Type: "Attached", Status: metav1.ConditionTrue}},
+			},
+		},
+	}
+	reconciler := newUnitReconciler(scheme, task, workspaceObject)
+	result, err := reconciler.handleFinalizing(context.Background(), task)
+	if err != nil {
+		t.Fatalf("handleFinalizing() error = %v", err)
+	}
+	if result.RequeueAfter <= 0 {
+		t.Fatalf("handleFinalizing() result = %#v, want requeue", result)
+	}
+	current := &workspacev1alpha1.ExecutionWorkspace{}
+	if err := reconciler.Get(context.Background(), client.ObjectKeyFromObject(workspaceObject), current); err != nil {
+		t.Fatal(err)
+	}
+	if current.Spec.Attachment != nil || current.Spec.AttachmentEpoch != epoch {
+		t.Fatalf("workspace attachment intent = %#v epoch=%d, want revoked at epoch %d", current.Spec.Attachment, current.Spec.AttachmentEpoch, epoch)
+	}
+}
+
+func TestHandleFinalizingCompletesAfterProjectedRevocationUsingHighWaterEpoch(t *testing.T) {
+	scheme := newTestScheme()
+	epoch := int64(3)
+	workspaceObject := &workspacev1alpha1.ExecutionWorkspace{
+		ObjectMeta: metav1.ObjectMeta{Name: "workspace-detached", Namespace: "default", UID: types.UID("workspace-detached-uid")},
+		Spec:       workspacev1alpha1.ExecutionWorkspaceSpec{AttachmentEpoch: epoch},
+		Status:     workspacev1alpha1.ExecutionWorkspaceStatus{AttachedEpoch: 0, Conditions: []metav1.Condition{{Type: "Attached", Status: metav1.ConditionFalse}}},
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "finalize-detached", Namespace: "default"},
+		Spec:       corev1alpha1.TaskSpec{Execution: &corev1alpha1.ExecutionSpec{Workspace: &corev1alpha1.ExecutionWorkspaceSpec{Enabled: true}}},
+		Status: corev1alpha1.TaskStatus{
+			Phase:            corev1alpha1.TaskPhaseFinalizing,
+			ExecutionOutcome: &corev1alpha1.TaskWorkloadExecutionOutcome{Phase: corev1alpha1.TaskPhaseSucceeded, Attempt: 1, Message: "done"},
+			ExecutionWorkspace: &corev1alpha1.ExecutionWorkspaceStatus{
+				WorkspaceRef:  &corev1alpha1.WorkspaceObjectReference{Name: workspaceObject.Name, UID: string(workspaceObject.UID)},
+				AttachedEpoch: epoch,
+				Conditions:    []metav1.Condition{{Type: "Attached", Status: metav1.ConditionFalse}},
+			},
+		},
+	}
+	reconciler := newUnitReconciler(scheme, task, workspaceObject)
+	if _, err := reconciler.handleFinalizing(context.Background(), task); err != nil {
+		t.Fatalf("handleFinalizing() error = %v", err)
+	}
+	updated := &corev1alpha1.Task{}
+	if err := reconciler.Get(context.Background(), client.ObjectKeyFromObject(task), updated); err != nil {
+		t.Fatal(err)
+	}
+	if updated.Status.Phase != corev1alpha1.TaskPhaseSucceeded {
+		t.Fatalf("phase = %s, want Succeeded", updated.Status.Phase)
+	}
+}
+
 func TestHandleFinalizingCompletesRecordedOutcome(t *testing.T) {
 	scheme := newTestScheme()
 	task := &corev1alpha1.Task{
@@ -7601,7 +8066,7 @@ func TestHandleFinalizingCompletesRecordedOutcome(t *testing.T) {
 		Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeContainer},
 		Status: corev1alpha1.TaskStatus{
 			Phase: corev1alpha1.TaskPhaseFinalizing,
-			ExecutionOutcome: &corev1alpha1.TaskExecutionOutcome{
+			ExecutionOutcome: &corev1alpha1.TaskWorkloadExecutionOutcome{
 				Phase: corev1alpha1.TaskPhaseSucceeded, Attempt: 1, RecordedAt: metav1.Now(), Message: "done",
 			},
 		},
@@ -7627,7 +8092,7 @@ func TestHandleFinalizingWaitsForAttachmentRevocation(t *testing.T) {
 		Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeContainer},
 		Status: corev1alpha1.TaskStatus{
 			Phase: corev1alpha1.TaskPhaseFinalizing,
-			ExecutionOutcome: &corev1alpha1.TaskExecutionOutcome{
+			ExecutionOutcome: &corev1alpha1.TaskWorkloadExecutionOutcome{
 				Phase: corev1alpha1.TaskPhaseSucceeded, Attempt: 1, RecordedAt: metav1.Now(), Message: "done",
 			},
 			ExecutionWorkspace: &corev1alpha1.ExecutionWorkspaceStatus{
@@ -8331,3 +8796,266 @@ func TestEnsureWorkerRBACPrunesRemovedTrustedServiceReadBindingAfterRestart(t *t
 		t.Fatalf("unrelated prefixed RoleBinding was removed: %v", err)
 	}
 }
+
+func TestHandleFinalizingQuarantinesWorkspaceAfterTimeout(t *testing.T) {
+	scheme := newTestScheme()
+	epoch := int64(4)
+	workspaceObject := &workspacev1alpha1.ExecutionWorkspace{
+		ObjectMeta: metav1.ObjectMeta{Name: "workspace-timeout", Namespace: "default", UID: types.UID("workspace-timeout-uid")},
+		Spec: workspacev1alpha1.ExecutionWorkspaceSpec{
+			AttachmentEpoch: epoch,
+			Attachment:      &workspacev1alpha1.ExecutionWorkspaceAttachment{Epoch: epoch},
+		},
+		Status: workspacev1alpha1.ExecutionWorkspaceStatus{AttachedEpoch: epoch},
+	}
+	secret := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: attachmentSecretName(workspaceObject.Name, epoch), Namespace: "default"}}
+	lease := &coordinationv1.Lease{ObjectMeta: metav1.ObjectMeta{Name: attachmentLeaseName(workspaceObject.Name), Namespace: "default"}}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "finalize-timeout", Namespace: "default", UID: types.UID("task-timeout-uid")},
+		Spec:       corev1alpha1.TaskSpec{Execution: &corev1alpha1.ExecutionSpec{Workspace: &corev1alpha1.ExecutionWorkspaceSpec{Enabled: true}}},
+		Status: corev1alpha1.TaskStatus{
+			Phase: corev1alpha1.TaskPhaseFinalizing,
+			ExecutionOutcome: &corev1alpha1.TaskWorkloadExecutionOutcome{
+				Phase: corev1alpha1.TaskPhaseSucceeded, Attempt: 1,
+				RecordedAt: metav1.NewTime(time.Now().Add(-workspaceFinalizationTimeout - time.Minute)),
+			},
+			ExecutionWorkspace: &corev1alpha1.ExecutionWorkspaceStatus{
+				WorkspaceRef:  &corev1alpha1.WorkspaceObjectReference{Name: workspaceObject.Name, UID: string(workspaceObject.UID)},
+				AttachedEpoch: epoch,
+				Conditions:    []metav1.Condition{{Type: "Attached", Status: metav1.ConditionTrue}},
+			},
+		},
+	}
+	reconciler := newUnitReconciler(scheme, task, workspaceObject, secret, lease)
+	if _, err := reconciler.handleFinalizing(context.Background(), task); err != nil {
+		t.Fatalf("handleFinalizing() error = %v", err)
+	}
+	updatedTask := &corev1alpha1.Task{}
+	if err := reconciler.Get(context.Background(), client.ObjectKeyFromObject(task), updatedTask); err != nil {
+		t.Fatal(err)
+	}
+	if updatedTask.Status.Phase != corev1alpha1.TaskPhaseFailed {
+		t.Fatalf("phase = %s, want Failed quarantine settlement", updatedTask.Status.Phase)
+	}
+	updatedWorkspace := &workspacev1alpha1.ExecutionWorkspace{}
+	if err := reconciler.Get(context.Background(), client.ObjectKeyFromObject(workspaceObject), updatedWorkspace); err != nil {
+		t.Fatal(err)
+	}
+	if updatedWorkspace.Spec.DesiredState != workspacev1alpha1.ExecutionWorkspaceDesiredQuarantined || updatedWorkspace.Spec.Attachment != nil {
+		t.Fatalf("workspace quarantine = %#v", updatedWorkspace.Spec)
+	}
+	if err := reconciler.Get(context.Background(), client.ObjectKeyFromObject(secret), &corev1.Secret{}); !apierrors.IsNotFound(err) {
+		t.Fatalf("attachment secret still exists: %v", err)
+	}
+	if err := reconciler.Get(context.Background(), client.ObjectKeyFromObject(lease), &coordinationv1.Lease{}); !apierrors.IsNotFound(err) {
+		t.Fatalf("attachment lease still exists: %v", err)
+	}
+}
+
+func TestHandleDeletionReclaimsNoAttemptAgentTask(t *testing.T) {
+	scheme := newTestScheme()
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "no-attempt-delete", Namespace: "default", UID: types.UID("12345678-abcd-efgh-ijkl-1234567890bb"),
+			Finalizers: []string{labels.TaskFinalizer},
+		},
+		Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent},
+		Status: corev1alpha1.TaskStatus{
+			Phase:   corev1alpha1.TaskPhaseFailed,
+			Message: "unsupported runtime",
+		},
+	}
+	r := newUnitReconciler(scheme, task)
+	persistDB, err := sqlite.NewDB(":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer persistDB.Close() //nolint:errcheck
+	controlClient := withControllerEpochLeaseUIDs(t, r.Client)
+	controlStore, err := storekube.NewComposite(controlClient, "default", sqlite.NewStore(persistDB, "reclaim-test"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	epochs := NewControllerEpochManager(controlStore, "reclaim-controller")
+	epochCtx, cancelEpoch := context.WithCancel(context.Background())
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	if _, err := epochs.CurrentFence(ctx); err != nil {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+	r.DurableControlStore = controlStore
+	r.ControllerEpochManager = epochs
+	r.APIReader = r.Client
+
+	current := &corev1alpha1.Task{}
+	if err := r.Get(ctx, client.ObjectKeyFromObject(task), current); err != nil {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+	if err := r.Delete(ctx, current); err != nil {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+	if err := r.Get(ctx, client.ObjectKeyFromObject(task), current); err != nil {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+	if _, err := r.handleDeletion(ctx, current); err != nil {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+	got := &corev1alpha1.Task{}
+	if err := r.Get(ctx, client.ObjectKeyFromObject(task), got); err == nil {
+		if controllerutil.ContainsFinalizer(got, labels.TaskFinalizer) {
+			cancelEpoch()
+			t.Fatalf("Task finalizer remained after no-attempt reclamation: %#v", got.Finalizers)
+		}
+	} else if !apierrors.IsNotFound(err) {
+		cancelEpoch()
+		t.Fatal(err)
+	}
+	cancelEpoch()
+	if err := <-epochDone; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestHandleDeletionWaitsForHarnessV1AttemptReclamation(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	scheme := newTestScheme()
+	bindingDigest := "sha256:" + strings.Repeat("a", 64)
+	snapshotDigest := "sha256:" + strings.Repeat("b", 64)
+	requestDigest := "sha256:" + strings.Repeat("c", 64)
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "v1-active-delete", Namespace: "default", UID: types.UID("v1-active-delete-uid"),
+			Finalizers: []string{labels.TaskFinalizer},
+		},
+		Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent},
+		Status: corev1alpha1.TaskStatus{AgentExecutionBinding: &corev1alpha1.AgentExecutionBinding{
+			ContractVersion: corev1alpha1.AgentRuntimeContractHarnessV1,
+			BindingDigest:   bindingDigest,
+			Snapshot:        corev1alpha1.AgentExecutionSnapshotRef{Digest: snapshotDigest},
+		}},
+	}
+	r := newUnitReconciler(scheme, task)
+	db, err := sqlite.NewDB(":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	durable := sqlite.NewStore(db, "v1-finalizer-test")
+	controlClient := withControllerEpochLeaseUIDs(t, r.Client)
+	controlStore, err := storekube.NewComposite(controlClient, "default", durable)
+	if err != nil {
+		t.Fatal(err)
+	}
+	epochs := NewControllerEpochManager(controlStore, "v1-finalizer-controller").WithMirror(durable)
+	epochCtx, cancelEpoch := context.WithCancel(ctx)
+	epochDone := make(chan error, 1)
+	go func() { epochDone <- epochs.Start(epochCtx) }()
+	defer func() {
+		cancelEpoch()
+		if err := <-epochDone; err != nil {
+			t.Errorf("stop epoch manager: %v", err)
+		}
+	}()
+	fence, err := epochs.CurrentFence(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	attempt := &store.HarnessV1Attempt{
+		Namespace: task.Namespace, TaskName: task.Name, TaskUID: string(task.UID), Attempt: 1,
+		BindingDigest: bindingDigest, SnapshotDigest: snapshotDigest, RequestDigest: requestDigest,
+		TurnID: "turn-v1-active-delete", RuntimeSessionID: "runtime-v1-active-delete",
+		State:      store.HarnessV1AttemptPrepared,
+		RetryClass: store.HarnessV1RetryClassNone,
+	}
+	runtimeSession := &harness.RuntimeSession{
+		ID: harness.RuntimeSessionID(attempt.RuntimeSessionID),
+		Owner: harness.RuntimeSessionOwner{
+			Namespace: task.Namespace, SessionName: "task-runtime", ActiveTask: task.Name,
+			Provider: harness.ProviderKindKubernetesService,
+		},
+		State: harness.RuntimeSessionStateReady, CleanupPolicy: harness.RuntimeCleanupPolicyDelete,
+		CreatedAt: time.Now().UTC(), UpdatedAt: time.Now().UTC(),
+	}
+	if err := durable.CreateRuntimeSession(ctx, runtimeSession); err != nil {
+		t.Fatal(err)
+	}
+	if err := durable.CreateHarnessV1Attempt(ctx, attempt, fence); err != nil {
+		t.Fatal(err)
+	}
+	r.HarnessV1Attempts = durable
+	r.HarnessV1SettlementAcknowledger = &recordingHarnessV1SettlementAcknowledger{}
+	r.ControllerEpochManager = epochs
+	r.APIReader = r.Client
+
+	current := &corev1alpha1.Task{}
+	if err := r.Get(ctx, client.ObjectKeyFromObject(task), current); err != nil {
+		t.Fatal(err)
+	}
+	if err := r.Delete(ctx, current); err != nil {
+		t.Fatal(err)
+	}
+	if err := r.Get(ctx, client.ObjectKeyFromObject(task), current); err != nil {
+		t.Fatal(err)
+	}
+	result, err := r.handleDeletion(ctx, current)
+	if err != nil {
+		t.Fatalf("handleDeletion() with active v1 attempt: %v", err)
+	}
+	if result.RequeueAfter != 2*time.Second {
+		t.Fatalf("active v1 deletion requeue = %v, want 2s", result.RequeueAfter)
+	}
+	retained := &corev1alpha1.Task{}
+	if err := r.Get(ctx, client.ObjectKeyFromObject(task), retained); err != nil {
+		t.Fatal(err)
+	}
+	if !controllerutil.ContainsFinalizer(retained, labels.TaskFinalizer) {
+		t.Fatal("active harness v1 attempt did not retain the Task finalizer")
+	}
+	persisted, err := durable.GetHarnessV1Attempt(ctx, store.HarnessV1AttemptKey{
+		Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	reason := "BackendDisabled"
+	if _, err := durable.TransitionHarnessV1Attempt(ctx, store.HarnessV1AttemptTransition{
+		Key:             store.HarnessV1AttemptKey{Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1},
+		ExpectedVersion: persisted.Version,
+		ExpectedState:   store.HarnessV1AttemptPrepared,
+		TargetState:     store.HarnessV1AttemptRejected,
+		OperationID:     "reject-before-delete",
+		OperationDigest: store.CanonicalAgentExecutionSnapshotDigest([]byte("reject-before-delete")),
+		Fence:           fence,
+		Updates:         store.HarnessV1AttemptUpdates{TerminalReason: &reason},
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err := r.handleDeletion(ctx, retained); err != nil {
+		t.Fatalf("handleDeletion() after terminal v1 attempt: %v", err)
+	}
+	if _, err := durable.GetHarnessV1Attempt(ctx, store.HarnessV1AttemptKey{
+		Namespace: task.Namespace, TaskUID: string(task.UID), Attempt: 1,
+	}); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("reclaimed harness v1 attempt error = %v, want not found", err)
+	}
+	if _, err := durable.GetRuntimeSession(ctx, task.Namespace, runtimeSession.ID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("reclaimed harness v1 runtime session error = %v, want not found", err)
+	}
+	deleted := &corev1alpha1.Task{}
+	if err := r.Get(ctx, client.ObjectKeyFromObject(task), deleted); err == nil {
+		if controllerutil.ContainsFinalizer(deleted, labels.TaskFinalizer) {
+			t.Fatalf("Task finalizer remained after terminal v1 reclamation: %#v", deleted.Finalizers)
+		}
+	} else if !apierrors.IsNotFound(err) {
+		t.Fatal(err)
+	}
+}
diff --git a/internal/controller/task_workspace_credentials.go b/internal/controller/task_workspace_credentials.go
new file mode 100644
index 000000000..e8e2064f1
--- /dev/null
+++ b/internal/controller/task_workspace_credentials.go
@@ -0,0 +1,56 @@
+package controller
+
+import (
+	"strings"
+
+	corev1 "k8s.io/api/core/v1"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/security"
+)
+
+func workspaceCredentialReference(ref *corev1.LocalObjectReference) *corev1alpha1.WorkspaceCredentialReference {
+	if ref == nil || strings.TrimSpace(ref.Name) == "" {
+		return nil
+	}
+	return &corev1alpha1.WorkspaceCredentialReference{Name: strings.TrimSpace(ref.Name)}
+}
+
+func repositoryScanReadCredentialRef(scan *corev1alpha1.RepositoryScan) *corev1.LocalObjectReference {
+	if scan == nil {
+		return nil
+	}
+	if scan.Spec.ReadCredentialRef != nil && strings.TrimSpace(scan.Spec.ReadCredentialRef.Name) != "" {
+		return scan.Spec.ReadCredentialRef
+	}
+	return scan.Spec.GitSecretRef
+}
+
+func repositoryScanTaskWorkspace(scan *corev1alpha1.RepositoryScan, intent corev1alpha1.WorkspaceIntent) *corev1alpha1.WorkspaceConfig {
+	if scan == nil {
+		return nil
+	}
+	workspace := &corev1alpha1.WorkspaceConfig{
+		Intent: intent,
+		// The ACP workspace preflight admits only credential-free HTTPS URLs,
+		// so accepted GitHub-style SSH roots are canonicalized here.
+		GitRepo:           security.CanonicalRepositoryCloneURL(scan.Spec.RepoURL),
+		Branch:            security.EffectiveWorkspaceBranch(scan),
+		Ref:               security.EffectiveRef(scan),
+		ReadCredentialRef: workspaceCredentialReference(repositoryScanReadCredentialRef(scan)),
+		SubPath:           scan.Spec.SubPath,
+	}
+	if intent == corev1alpha1.WorkspaceIntentWrite {
+		// prBaseBranch is a publication field: the ACP workspace preflight
+		// rejects it on non-write intents.
+		workspace.PRBaseBranch = scan.Spec.PRBaseBranch
+		workspace.PublicationGitRepo = security.CanonicalRepositoryCloneURL(scan.Spec.ForkRepo)
+		if workspace.PublicationGitRepo == "" {
+			workspace.PublicationGitRepo = workspace.GitRepo
+		}
+		workspace.PublicationReadCredentialRef = workspaceCredentialReference(scan.Spec.PublicationReadCredentialRef)
+		workspace.PublicationCredentialRef = workspaceCredentialReference(scan.Spec.PublicationCredentialRef)
+		workspace.ForgeCredentialRef = workspaceCredentialReference(scan.Spec.ForgeCredentialRef)
+	}
+	return workspace
+}
diff --git a/internal/controller/task_workspace_credentials_test.go b/internal/controller/task_workspace_credentials_test.go
new file mode 100644
index 000000000..db49c2e7f
--- /dev/null
+++ b/internal/controller/task_workspace_credentials_test.go
@@ -0,0 +1,47 @@
+package controller
+
+import (
+	"testing"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+)
+
+const testCanonicalScanSourceCloneURL = "https://github.com/example/source"
+
+func TestRepositoryScanTaskWorkspaceCanonicalizesSSHRepositoryURLs(t *testing.T) {
+	scan := &corev1alpha1.RepositoryScan{Spec: corev1alpha1.RepositoryScanSpec{
+		RepoURL:  "git@github.com:example/source.git",
+		ForkRepo: "git@github.com:example/fork.git",
+	}}
+
+	read := repositoryScanTaskWorkspace(scan, corev1alpha1.WorkspaceIntentRead)
+	if read == nil || read.GitRepo != testCanonicalScanSourceCloneURL {
+		t.Fatalf("read workspace gitRepo = %#v, want canonical HTTPS clone URL", read)
+	}
+	if read.PublicationGitRepo != "" {
+		t.Fatalf("read workspace publication repo = %q, want empty", read.PublicationGitRepo)
+	}
+
+	write := repositoryScanTaskWorkspace(scan, corev1alpha1.WorkspaceIntentWrite)
+	if write == nil || write.GitRepo != testCanonicalScanSourceCloneURL ||
+		write.PublicationGitRepo != "https://github.com/example/fork" {
+		t.Fatalf("write workspace = %#v, want canonical HTTPS clone URLs", write)
+	}
+
+	scan.Spec.ForkRepo = ""
+	write = repositoryScanTaskWorkspace(scan, corev1alpha1.WorkspaceIntentWrite)
+	if write == nil || write.PublicationGitRepo != testCanonicalScanSourceCloneURL {
+		t.Fatalf("fallback publication repo = %#v, want canonical source clone URL", write)
+	}
+}
+
+func TestRepositoryScanTaskWorkspacePassesNonGitHubURLsThrough(t *testing.T) {
+	scan := &corev1alpha1.RepositoryScan{Spec: corev1alpha1.RepositoryScanSpec{
+		RepoURL: "https://git.example.com/example/source.git",
+	}}
+
+	workspace := repositoryScanTaskWorkspace(scan, corev1alpha1.WorkspaceIntentRead)
+	if workspace == nil || workspace.GitRepo != "https://git.example.com/example/source.git" {
+		t.Fatalf("workspace gitRepo = %#v, want unchanged non-GitHub URL", workspace)
+	}
+}
diff --git a/internal/controller/workspace_api_validation_test.go b/internal/controller/workspace_api_validation_test.go
index 3c3ce3836..25f5d572f 100644
--- a/internal/controller/workspace_api_validation_test.go
+++ b/internal/controller/workspace_api_validation_test.go
@@ -151,6 +151,112 @@ var _ = Describe("workspace.orka.ai schema validation", func() {
 		Expect(k8sClient.Create(ctx, cleanupMixed)).NotTo(Succeed())
 	})
 
+	It("rejects ACP-only workspace publication guarantees for container Tasks", func(ctx context.Context) {
+		validContainer := &corev1alpha1.Task{
+			ObjectMeta: metav1.ObjectMeta{Name: "container-workspace-supported", Namespace: namespace},
+			Spec: corev1alpha1.TaskSpec{
+				Type: corev1alpha1.TaskTypeContainer,
+				Workspace: &corev1alpha1.WorkspaceConfig{
+					Intent:                       corev1alpha1.WorkspaceIntentWrite,
+					GitRepo:                      "https://github.com/example/source.git",
+					PushBranch:                   "orka/container-supported",
+					PublicationCredentialRef:     &corev1alpha1.WorkspaceCredentialReference{Name: "publication-write"},
+					PublicationReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "publication-read"},
+				},
+			},
+		}
+		Expect(k8sClient.Create(ctx, validContainer)).To(Succeed())
+
+		customImage := validContainer.DeepCopy()
+		customImage.ResourceVersion = ""
+		customImage.UID = ""
+		customImage.Name = "container-workspace-custom-image"
+		customImage.Spec.Image = "busybox:latest"
+		Expect(k8sClient.Create(ctx, customImage)).To(
+			MatchError(ContainSubstring("custom-image container Tasks do not support workspace.pushBranch publication")),
+		)
+
+		tests := []struct {
+			name   string
+			mutate func(*corev1alpha1.WorkspaceConfig)
+		}{
+			{
+				name: "expected-remote-sha",
+				mutate: func(workspace *corev1alpha1.WorkspaceConfig) {
+					workspace.ExpectedRemoteSHA = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+				},
+			},
+			{
+				name: "create-pr",
+				mutate: func(workspace *corev1alpha1.WorkspaceConfig) {
+					workspace.CreatePR = true
+				},
+			},
+			{
+				name: "max-changed-files",
+				mutate: func(workspace *corev1alpha1.WorkspaceConfig) {
+					limit := int32(1)
+					workspace.MaxChangedFiles = &limit
+				},
+			},
+			{
+				name: "allowed-paths",
+				mutate: func(workspace *corev1alpha1.WorkspaceConfig) {
+					workspace.AllowedPaths = []string{"src/**"}
+				},
+			},
+			{
+				name: "deny-repository-control-paths",
+				mutate: func(workspace *corev1alpha1.WorkspaceConfig) {
+					workspace.DenyRepositoryControlPaths = true
+				},
+			},
+			{
+				name: "reject-binary-files",
+				mutate: func(workspace *corev1alpha1.WorkspaceConfig) {
+					workspace.RejectBinaryFiles = true
+				},
+			},
+			{
+				name: "reject-secret-like-content",
+				mutate: func(workspace *corev1alpha1.WorkspaceConfig) {
+					workspace.RejectSecretLikeContent = true
+				},
+			},
+		}
+
+		for _, tt := range tests {
+			task := validContainer.DeepCopy()
+			task.ResourceVersion = ""
+			task.UID = ""
+			task.Name = "container-workspace-" + tt.name
+			tt.mutate(task.Spec.Workspace)
+			Expect(k8sClient.Create(ctx, task)).NotTo(Succeed(), tt.name)
+		}
+
+		limit := int32(1)
+		agentTask := &corev1alpha1.Task{
+			ObjectMeta: metav1.ObjectMeta{Name: "agent-workspace-publication-guarantees", Namespace: namespace},
+			Spec: corev1alpha1.TaskSpec{
+				Type: corev1alpha1.TaskTypeAgent,
+				Workspace: &corev1alpha1.WorkspaceConfig{
+					Intent:                       corev1alpha1.WorkspaceIntentWrite,
+					ExpectedRemoteSHA:            "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+					MaxChangedFiles:              &limit,
+					AllowedPaths:                 []string{"src/**"},
+					DenyRepositoryControlPaths:   true,
+					RejectBinaryFiles:            true,
+					RejectSecretLikeContent:      true,
+					CreatePR:                     true,
+					ForgeCredentialRef:           &corev1alpha1.WorkspaceCredentialReference{Name: "forge-write"},
+					PublicationCredentialRef:     &corev1alpha1.WorkspaceCredentialReference{Name: "publication-write"},
+					PublicationReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "publication-read"},
+				},
+			},
+		}
+		Expect(k8sClient.Create(ctx, agentTask)).To(Succeed())
+	})
+
 	It("validates provider-neutral MCP workspace selection", func(ctx context.Context) {
 		tool := &corev1alpha1.Tool{
 			ObjectMeta: metav1.ObjectMeta{Name: "workspace-mcp", Namespace: namespace},
@@ -191,7 +297,7 @@ var _ = Describe("workspace.orka.ai schema validation", func() {
 		}
 		Expect(k8sClient.Create(ctx, task)).To(Succeed())
 		task.Status.Phase = corev1alpha1.TaskPhaseFinalizing
-		task.Status.ExecutionOutcome = &corev1alpha1.TaskExecutionOutcome{
+		task.Status.ExecutionOutcome = &corev1alpha1.TaskWorkloadExecutionOutcome{
 			Phase:      corev1alpha1.TaskPhaseSucceeded,
 			Attempt:    1,
 			RecordedAt: metav1.Now(),
diff --git a/internal/executionmode/mode.go b/internal/executionmode/mode.go
new file mode 100644
index 000000000..3698c3054
--- /dev/null
+++ b/internal/executionmode/mode.go
@@ -0,0 +1,105 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+// Package executionmode defines the immutable execution-plane identity shared
+// by controllers and admission. A namespace belongs to exactly one mode.
+package executionmode
+
+import (
+	"fmt"
+	"strings"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	corev1 "k8s.io/api/core/v1"
+)
+
+// NamespaceLabel is the immutable namespace execution-mode claim.
+const NamespaceLabel = "orka.ai/controller-mode"
+
+// Mode identifies the only execution contract an installation may serve.
+type Mode string
+
+const (
+	HarnessV1 Mode = "harness-v1"
+	HarnessV2 Mode = "harness-v2"
+)
+
+// Parse returns a supported, canonical mode.
+func Parse(raw string) (Mode, error) {
+	mode := Mode(strings.TrimSpace(raw))
+	switch mode {
+	case HarnessV1, HarnessV2:
+		return mode, nil
+	default:
+		return "", fmt.Errorf("execution mode must be %q or %q, got %q", HarnessV1, HarnessV2, raw)
+	}
+}
+
+// ContractVersion returns the only harness contract admitted by the mode.
+func (m Mode) ContractVersion() corev1alpha1.AgentRuntimeContractVersion {
+	if m == HarnessV1 {
+		return corev1alpha1.AgentRuntimeContractHarnessV1
+	}
+	if m == HarnessV2 {
+		return corev1alpha1.AgentRuntimeContractHarnessV2
+	}
+	return ""
+}
+
+// DefaultBuiltInAgentContract stamps the installation's immutable harness
+// contract on a built-in Agent runtime when the trusted producer omitted it.
+// Explicit selectors are never rewritten, and an opposite-mode selector is
+// rejected before the object reaches admission.
+func DefaultBuiltInAgentContract(agent *corev1alpha1.Agent, mode Mode) error {
+	if agent == nil || agent.Spec.Runtime == nil || agent.Spec.Runtime.Type == "" || agent.Spec.Runtime.RuntimeRef != nil {
+		return nil
+	}
+
+	expected := mode.ContractVersion()
+	if expected == "" {
+		return fmt.Errorf("cannot default built-in Agent contract without a valid execution mode")
+	}
+	if agent.Spec.Runtime.ContractVersion == nil {
+		agent.Spec.Runtime.ContractVersion = &expected
+		return nil
+	}
+	if *agent.Spec.Runtime.ContractVersion != expected {
+		return fmt.Errorf(
+			"agent runtime contractVersion %q does not match execution mode %q",
+			*agent.Spec.Runtime.ContractVersion,
+			mode,
+		)
+	}
+	return nil
+}
+
+// FromNamespace reads and validates a namespace's immutable mode claim.
+func FromNamespace(namespace *corev1.Namespace) (Mode, error) {
+	if namespace == nil {
+		return "", fmt.Errorf("execution-mode namespace is required")
+	}
+	raw := ""
+	if namespace.Labels != nil {
+		raw = namespace.Labels[NamespaceLabel]
+	}
+	mode, err := Parse(raw)
+	if err != nil {
+		return "", fmt.Errorf("namespace %q: %w", namespace.Name, err)
+	}
+	return mode, nil
+}
+
+// ValidateNamespace verifies the namespace is permanently claimed by mode.
+func ValidateNamespace(namespace *corev1.Namespace, mode Mode) error {
+	claimed, err := FromNamespace(namespace)
+	if err != nil {
+		return err
+	}
+	if claimed != mode {
+		return fmt.Errorf("namespace %q is claimed by execution mode %q, not %q", namespace.Name, claimed, mode)
+	}
+	return nil
+}
diff --git a/internal/executionmode/mode_test.go b/internal/executionmode/mode_test.go
new file mode 100644
index 000000000..f2b013099
--- /dev/null
+++ b/internal/executionmode/mode_test.go
@@ -0,0 +1,99 @@
+package executionmode
+
+import (
+	"testing"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestNamespaceMode(t *testing.T) {
+	namespace := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{
+		Name: "tenant", Labels: map[string]string{NamespaceLabel: string(HarnessV1)},
+	}}
+	if mode, err := FromNamespace(namespace); err != nil || mode != HarnessV1 {
+		t.Fatalf("FromNamespace() = %q, %v", mode, err)
+	}
+	if err := ValidateNamespace(namespace, HarnessV2); err == nil {
+		t.Fatal("mode mismatch must fail")
+	}
+	for _, raw := range []string{"", "auto", "dual", "harness-v3"} {
+		if _, err := Parse(raw); err == nil {
+			t.Fatalf("Parse(%q) succeeded", raw)
+		}
+	}
+}
+
+func TestDefaultBuiltInAgentContract(t *testing.T) {
+	v1 := corev1alpha1.AgentRuntimeContractHarnessV1
+	v2 := corev1alpha1.AgentRuntimeContractHarnessV2
+	tests := []struct {
+		name      string
+		agent     *corev1alpha1.Agent
+		mode      Mode
+		want      corev1alpha1.AgentRuntimeContractVersion
+		wantError bool
+	}{
+		{name: "nil agent", mode: HarnessV2},
+		{name: "no runtime", agent: &corev1alpha1.Agent{}, mode: HarnessV2},
+		{
+			name: "external runtime remains derived",
+			agent: &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+				RuntimeRef: &corev1alpha1.AgentRuntimeReference{Name: "external"},
+			}}},
+			mode: HarnessV2,
+		},
+		{
+			name:  "v1 omission defaults to v1",
+			agent: builtInAgent(),
+			mode:  HarnessV1,
+			want:  v1,
+		},
+		{
+			name:  "v2 omission defaults to v2",
+			agent: builtInAgent(),
+			mode:  HarnessV2,
+			want:  v2,
+		},
+		{
+			name: "matching explicit contract is preserved",
+			agent: &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type: corev1alpha1.AgentRuntimeCodex, ContractVersion: &v1,
+			}}},
+			mode: HarnessV1,
+			want: v1,
+		},
+		{
+			name: "opposite explicit contract fails closed",
+			agent: &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+				Type: corev1alpha1.AgentRuntimeCodex, ContractVersion: &v2,
+			}}},
+			mode:      HarnessV1,
+			want:      v2,
+			wantError: true,
+		},
+		{name: "missing authoritative mode fails closed", agent: builtInAgent(), wantError: true},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			err := DefaultBuiltInAgentContract(test.agent, test.mode)
+			if (err != nil) != test.wantError {
+				t.Fatalf("DefaultBuiltInAgentContract() error = %v, wantError %t", err, test.wantError)
+			}
+			if test.agent == nil || test.agent.Spec.Runtime == nil {
+				return
+			}
+			if got := test.agent.BuiltInContractVersion(); got != test.want {
+				t.Fatalf("contractVersion = %q, want %q", got, test.want)
+			}
+		})
+	}
+}
+
+func builtInAgent() *corev1alpha1.Agent {
+	return &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+		Type: corev1alpha1.AgentRuntimeCodex,
+	}}}
+}
diff --git a/internal/harness/client.go b/internal/harness/client.go
index 74580ad3a..440c04635 100644
--- a/internal/harness/client.go
+++ b/internal/harness/client.go
@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"bytes"
 	"context"
+	"crypto/sha256"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -18,10 +19,12 @@ import (
 	"github.com/orka-agents/orka/internal/events"
 )
 
-const (
-	maxFetchTurnOutputBytes        = 50 << 20
-	maxHarnessControlResponseBytes = 1 << 20
-)
+// MaxFetchTurnOutputBytes is the controller client's hard cap for referenced
+// harness output payloads. Runtime readiness must reject a larger advertised
+// maximum so accepted turns cannot become permanently stuck while settling.
+const MaxFetchTurnOutputBytes = 50 << 20
+
+const maxHarnessControlResponseBytes = 1 << 20
 
 type Client struct {
 	baseURL         *url.URL
@@ -72,6 +75,15 @@ func NewClient(baseURL string, opts ...ClientOption) (*Client, error) {
 	if parsed.Scheme == "" || parsed.Host == "" {
 		return nil, fmt.Errorf("harness base url must include scheme and host")
 	}
+	if parsed.User != nil {
+		return nil, fmt.Errorf("harness base url must not include userinfo")
+	}
+	if parsed.RawQuery != "" {
+		return nil, fmt.Errorf("harness base url must not include a query")
+	}
+	if parsed.Fragment != "" {
+		return nil, fmt.Errorf("harness base url must not include a fragment")
+	}
 	c := &Client{baseURL: parsed, httpClient: &http.Client{}, controlTimeout: 30 * time.Second}
 	for _, opt := range opts {
 		if opt != nil {
@@ -113,6 +125,202 @@ func (c *Client) Capabilities(ctx context.Context) (_ *CapabilitiesResponse, err
 	return &sanitized, nil
 }
 
+// DurableTurnStatus returns authenticated wrapper-ledger evidence for recovery.
+func (c *Client) DurableTurnStatus(ctx context.Context, turnID HarnessTurnID) (_ *DurableTurnStatus, err error) {
+	defer func() { err = c.sanitizeClientError(err) }()
+	if strings.TrimSpace(string(turnID)) == "" {
+		return nil, safeClientError("durable_turn_status", 0, "turn ID is required")
+	}
+	var response DurableTurnStatus
+	if err := c.getJSON(ctx, AdminTurnsPath+"/"+url.PathEscape(string(turnID)), &response); err != nil {
+		return nil, err
+	}
+	if err := c.validateDurableTurnStatus(turnID, response); err != nil {
+		return nil, safeClientError("durable_turn_status", 0, err.Error(), err)
+	}
+	return &response, nil
+}
+
+func (c *Client) validateDurableTurnStatus(expectedTurnID HarnessTurnID, status DurableTurnStatus) error {
+	if status.TurnID != string(expectedTurnID) || strings.TrimSpace(status.TaskUID) == "" ||
+		status.Attempt < 1 || !isCanonicalSHA256Digest(status.RequestDigest) || status.UpdatedAt.IsZero() {
+		return fmt.Errorf("wrapper returned incomplete durable turn status")
+	}
+	for name, value := range map[string]string{
+		"turnID":        status.TurnID,
+		"taskUID":       status.TaskUID,
+		"attempt":       strconv.FormatInt(int64(status.Attempt), 10),
+		"requestDigest": status.RequestDigest,
+		"state":         string(status.State),
+		"updatedAt":     status.UpdatedAt.Format(time.RFC3339Nano),
+	} {
+		if c.structuralValueContainsSensitiveData(value) {
+			return fmt.Errorf("wrapper durable turn status field %s contains sensitive data", name)
+		}
+	}
+
+	switch status.State {
+	case DurableTurnAdmitted, DurableTurnAccepted, DurableTurnRejected:
+		if status.TerminalReceipt != nil || status.TerminalReceiptDigest != "" {
+			return fmt.Errorf("wrapper returned terminal receipt for nonterminal durable turn state")
+		}
+		return nil
+	case DurableTurnTerminal, DurableTurnOutcomeUnknown:
+	default:
+		return fmt.Errorf("wrapper returned unsupported durable turn state")
+	}
+
+	if status.TerminalReceipt == nil || !isCanonicalSHA256Digest(status.TerminalReceiptDigest) {
+		return fmt.Errorf("wrapper returned incomplete durable terminal receipt")
+	}
+	receipt := *status.TerminalReceipt
+	if err := receipt.Validate(); err != nil {
+		return fmt.Errorf("wrapper returned invalid durable terminal receipt: %w", err)
+	}
+	if receipt.TurnID != expectedTurnID || string(receipt.TurnID) != status.TurnID {
+		return fmt.Errorf("wrapper durable terminal receipt turn identity mismatch")
+	}
+	if status.State == DurableTurnTerminal && receipt.Kind == DurableTurnTerminalOutcomeUnknown {
+		return fmt.Errorf("wrapper terminal state contains outcome-unknown receipt")
+	}
+	if status.State == DurableTurnOutcomeUnknown && receipt.Kind != DurableTurnTerminalOutcomeUnknown {
+		return fmt.Errorf("wrapper outcome-unknown state contains terminal receipt")
+	}
+	digest, err := DurableTurnTerminalReceiptDigest(receipt)
+	if err != nil {
+		return fmt.Errorf("canonicalize wrapper durable terminal receipt: %w", err)
+	}
+	if digest != status.TerminalReceiptDigest {
+		return fmt.Errorf("wrapper durable terminal receipt digest mismatch")
+	}
+	if err := c.validateDurableTerminalReceiptSensitiveData(receipt); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (c *Client) validateDurableTerminalReceiptSensitiveData(receipt DurableTurnTerminalReceipt) error {
+	values := map[string]string{
+		"version":          receipt.Version,
+		"kind":             string(receipt.Kind),
+		"runtimeSessionID": string(receipt.RuntimeSessionID),
+		"turnID":           string(receipt.TurnID),
+		"correlationID":    receipt.CorrelationID,
+		"seq":              strconv.FormatInt(receipt.Seq, 10),
+	}
+	if receipt.Completed != nil {
+		values["completed.result"] = receipt.Completed.Result
+		values["completed.outputRef"] = receipt.Completed.OutputRef
+		values["completed.finalEventSeq"] = strconv.FormatInt(receipt.Completed.FinalEventSeq, 10)
+		values["completed.retainSession"] = strconv.FormatBool(receipt.Completed.RetainSession)
+	}
+	if receipt.Failed != nil {
+		values["failed.reason"] = receipt.Failed.Reason
+		values["failed.message"] = receipt.Failed.Message
+		values["failed.result"] = receipt.Failed.Result
+		values["failed.outputRef"] = receipt.Failed.OutputRef
+		values["failed.retryable"] = strconv.FormatBool(receipt.Failed.Retryable)
+	}
+	if receipt.Cancelled != nil {
+		values["cancelled.reason"] = receipt.Cancelled.Reason
+	}
+	if receipt.OutcomeUnknown != nil {
+		values["outcomeUnknown.reason"] = receipt.OutcomeUnknown.Reason
+	}
+	for name, value := range values {
+		if c.structuralValueContainsSensitiveData(value) {
+			return fmt.Errorf("wrapper durable terminal receipt field %s contains sensitive data", name)
+		}
+	}
+	return nil
+}
+
+func isCanonicalSHA256Digest(value string) bool {
+	if len(value) != len("sha256:")+sha256.Size*2 || !strings.HasPrefix(value, "sha256:") {
+		return false
+	}
+	for _, char := range value[len("sha256:"):] {
+		if (char < '0' || char > '9') && (char < 'a' || char > 'f') {
+			return false
+		}
+	}
+	return true
+}
+
+// CloseDurableAdmission durably closes new wrapper turn admission.
+func (c *Client) CloseDurableAdmission(ctx context.Context) (_ *DurableAdmissionCloseResponse, err error) {
+	defer func() { err = c.sanitizeClientError(err) }()
+	var response DurableAdmissionCloseResponse
+	if err := c.postJSON(ctx, AdminClosePath, struct{}{}, &response); err != nil {
+		return nil, err
+	}
+	if !response.AdmissionClosed {
+		return nil, safeClientError("close_durable_admission", 0, "wrapper did not confirm admission closure")
+	}
+	return &response, nil
+}
+
+// DurableDrainStatus returns the authenticated close marker and unsettled
+// ledger inventory used to gate wrapper rollout and removal.
+func (c *Client) DurableDrainStatus(ctx context.Context) (_ *DurableDrainStatus, err error) {
+	defer func() { err = c.sanitizeClientError(err) }()
+	var response DurableDrainStatus
+	if err := c.getJSON(ctx, AdminDrainPath, &response); err != nil {
+		return nil, err
+	}
+	if response.Completed && (!response.AdmissionClosed || len(response.Unsettled) != 0) {
+		return nil, safeClientError("durable_drain_status", 0, "wrapper returned contradictory durable drain status")
+	}
+	return &response, nil
+}
+
+// PrepareDurableRollover seals a completed drain to the exact replacement
+// ledger generation. The replacement activates it during startup.
+func (c *Client) PrepareDurableRollover(
+	ctx context.Context,
+	nextGeneration string,
+) (_ *DurableRolloverPrepareResponse, err error) {
+	defer func() { err = c.sanitizeClientError(err) }()
+	nextGeneration = strings.TrimSpace(nextGeneration)
+	if nextGeneration == "" {
+		return nil, safeClientError("prepare_durable_rollover", 0, "next generation is required")
+	}
+	var response DurableRolloverPrepareResponse
+	if err := c.postJSON(ctx, AdminRolloverPath, DurableRolloverPrepareRequest{
+		NextGeneration: nextGeneration,
+	}, &response); err != nil {
+		return nil, err
+	}
+	if !response.Prepared || response.NextGeneration != nextGeneration ||
+		strings.TrimSpace(response.CurrentGeneration) == "" || response.CurrentGeneration == nextGeneration {
+		return nil, safeClientError("prepare_durable_rollover", 0, "wrapper returned invalid rollover preparation")
+	}
+	return &response, nil
+}
+
+// AbortDurableRollover discards a prepared replacement and reopens admission
+// only when the live wrapper still owns the exact rollback generation.
+func (c *Client) AbortDurableRollover(
+	ctx context.Context,
+	expectedGeneration string,
+) (_ *DurableRolloverAbortResponse, err error) {
+	defer func() { err = c.sanitizeClientError(err) }()
+	expectedGeneration = strings.TrimSpace(expectedGeneration)
+	if expectedGeneration == "" {
+		return nil, safeClientError("abort_durable_rollover", 0, "expected generation is required")
+	}
+	var response DurableRolloverAbortResponse
+	if err := c.postJSON(ctx, AdminAbortRolloverPath, DurableRolloverAbortRequest{
+		ExpectedGeneration: expectedGeneration,
+	}, &response); err != nil {
+		return nil, err
+	}
+	if !response.AdmissionReopened || response.CurrentGeneration != expectedGeneration {
+		return nil, safeClientError("abort_durable_rollover", 0, "wrapper returned invalid rollover abort")
+	}
+	return &response, nil
+}
+
 func (c *Client) sanitizeHealthResponse(response HealthResponse) (HealthResponse, error) {
 	for name, value := range map[string]string{
 		"version":          response.Version,
@@ -318,11 +526,11 @@ func (c *Client) FetchTurnOutput(ctx context.Context, turnID HarnessTurnID, outp
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
 		return nil, c.statusError("fetch_turn_output", resp)
 	}
-	data, err := io.ReadAll(io.LimitReader(resp.Body, maxFetchTurnOutputBytes+1))
+	data, err := io.ReadAll(io.LimitReader(resp.Body, MaxFetchTurnOutputBytes+1))
 	if err != nil {
 		return nil, safeClientError("fetch_turn_output", resp.StatusCode, err.Error(), err)
 	}
-	if len(data) > maxFetchTurnOutputBytes {
+	if len(data) > MaxFetchTurnOutputBytes {
 		return nil, safeClientError("fetch_turn_output", resp.StatusCode, "output exceeds harness fetch limit")
 	}
 	if c.authBearerValue != "" && bytes.Contains(data, []byte(c.authBearerValue)) {
@@ -331,6 +539,56 @@ func (c *Client) FetchTurnOutput(ctx context.Context, turnID HarnessTurnID, outp
 	return data, nil
 }
 
+// AcknowledgeTurnOutput confirms that the controller durably stored and
+// settled the output referenced by the exact terminal receipt. The wrapper
+// may then reclaim the payload while preserving an idempotent tombstone.
+func (c *Client) AcknowledgeTurnOutput(
+	ctx context.Context,
+	request TurnOutputAcknowledgementRequest,
+) (err error) {
+	defer func() { err = c.sanitizeClientError(err) }()
+	if err := request.ValidateFor(request.TurnID); err != nil {
+		return safeClientError("acknowledge_turn_output", 0, err.Error(), err)
+	}
+	rel, err := OutputAcknowledgementTurnPath(request.TurnID)
+	if err != nil {
+		return safeClientError("acknowledge_turn_output", 0, err.Error(), err)
+	}
+	var response TurnOutputAcknowledgementResponse
+	if err := c.postJSON(ctx, rel, request, &response); err != nil {
+		return err
+	}
+	if err := response.ValidateFor(request); err != nil {
+		return safeClientError("acknowledge_turn_output", 0, err.Error(), err)
+	}
+	return nil
+}
+
+// AcknowledgeTurnSettlement confirms that the controller has durably settled
+// the exact request and terminal evidence. The wrapper may reclaim the row only
+// after its configured retention period.
+func (c *Client) AcknowledgeTurnSettlement(
+	ctx context.Context,
+	request TurnSettlementAcknowledgementRequest,
+) (err error) {
+	defer func() { err = c.sanitizeClientError(err) }()
+	if err := request.ValidateFor(request.TurnID); err != nil {
+		return safeClientError("acknowledge_turn_settlement", 0, err.Error(), err)
+	}
+	rel, err := SettlementAcknowledgementTurnPath(request.TurnID)
+	if err != nil {
+		return safeClientError("acknowledge_turn_settlement", 0, err.Error(), err)
+	}
+	var response TurnSettlementAcknowledgementResponse
+	if err := c.postJSON(ctx, rel, request, &response); err != nil {
+		return err
+	}
+	if err := response.ValidateFor(request); err != nil {
+		return safeClientError("acknowledge_turn_settlement", 0, err.Error(), err)
+	}
+	return nil
+}
+
 func (c *Client) StreamFrames(ctx context.Context, turnID HarnessTurnID, afterSeq int64, emit func(HarnessEventFrame) error) error {
 	if emit == nil {
 		return c.sanitizeClientError(safeClientError("stream_frames", 0, "emit callback is required"))
diff --git a/internal/harness/client_test.go b/internal/harness/client_test.go
index e39a1bd1f..bc240088c 100644
--- a/internal/harness/client_test.go
+++ b/internal/harness/client_test.go
@@ -3,6 +3,7 @@ package harness
 import (
 	"bytes"
 	"context"
+	"crypto/sha256"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -210,6 +211,134 @@ func TestClientHealthSanitizesPresentationFields(t *testing.T) {
 	}
 }
 
+func TestClientDurableTurnStatusVerifiesCanonicalReceipt(t *testing.T) {
+	status := validDurableTurnStatus(t)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != AdminTurnsPath+"/turn-a" {
+			t.Fatalf("request path = %q, want durable turn path", r.URL.Path)
+		}
+		WriteJSON(w, http.StatusOK, status)
+	}))
+	defer server.Close()
+	client, err := NewClient(server.URL, WithBearerToken("controller-bearer"))
+	if err != nil {
+		t.Fatalf("NewClient() error = %v", err)
+	}
+
+	got, err := client.DurableTurnStatus(context.Background(), "turn-a")
+	if err != nil {
+		t.Fatalf("DurableTurnStatus() error = %v", err)
+	}
+	if got.TerminalReceipt == nil || got.TerminalReceipt.Kind != DurableTurnTerminalCompleted ||
+		got.TerminalReceiptDigest != status.TerminalReceiptDigest {
+		t.Fatalf("DurableTurnStatus() = %#v, want verified completed receipt", got)
+	}
+}
+
+func TestClientDurableTurnStatusRejectsInvalidRecoveryEvidence(t *testing.T) {
+	const reflectedBearer = "controller-bearer"
+	tests := []struct {
+		name   string
+		mutate func(*DurableTurnStatus)
+	}{
+		{
+			name: "noncanonical request digest",
+			mutate: func(status *DurableTurnStatus) {
+				status.RequestDigest = "sha256:" + strings.Repeat("A", sha256.Size*2)
+			},
+		},
+		{
+			name: "malformed kind body pairing",
+			mutate: func(status *DurableTurnStatus) {
+				status.TerminalReceipt.Completed = nil
+				status.TerminalReceipt.Failed = &DurableTurnFailedReceipt{Reason: "failed"}
+			},
+		},
+		{
+			name: "oversized terminal result",
+			mutate: func(status *DurableTurnStatus) {
+				status.TerminalReceipt.Completed.Result = strings.Repeat("x", maxDurableTurnCompletedResultBytes+1)
+			},
+		},
+		{
+			name: "receipt digest mismatch",
+			mutate: func(status *DurableTurnStatus) {
+				status.TerminalReceiptDigest = "sha256:" + strings.Repeat("b", sha256.Size*2)
+			},
+		},
+		{
+			name: "receipt turn mismatch",
+			mutate: func(status *DurableTurnStatus) {
+				status.TerminalReceipt.TurnID = "turn-other"
+				status.TerminalReceiptDigest = durableReceiptDigestForTest(t, *status.TerminalReceipt)
+			},
+		},
+		{
+			name: "outcome state kind mismatch",
+			mutate: func(status *DurableTurnStatus) {
+				status.State = DurableTurnOutcomeUnknown
+			},
+		},
+		{
+			name: "terminal receipt on nonterminal state",
+			mutate: func(status *DurableTurnStatus) {
+				status.State = DurableTurnAccepted
+			},
+		},
+		{
+			name: "configured bearer reflection",
+			mutate: func(status *DurableTurnStatus) {
+				status.TerminalReceipt.Completed.Result = "reflected " + reflectedBearer
+				status.TerminalReceiptDigest = durableReceiptDigestForTest(t, *status.TerminalReceipt)
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			status := validDurableTurnStatus(t)
+			test.mutate(&status)
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+				WriteJSON(w, http.StatusOK, status)
+			}))
+			defer server.Close()
+			client, err := NewClient(server.URL, WithBearerToken(reflectedBearer))
+			if err != nil {
+				t.Fatalf("NewClient() error = %v", err)
+			}
+			if got, err := client.DurableTurnStatus(context.Background(), "turn-a"); err == nil {
+				t.Fatalf("DurableTurnStatus() = %#v, want invalid recovery evidence error", got)
+			} else if strings.Contains(err.Error(), reflectedBearer) {
+				t.Fatalf("DurableTurnStatus() error leaked configured bearer: %v", err)
+			}
+		})
+	}
+}
+
+func validDurableTurnStatus(t *testing.T) DurableTurnStatus {
+	t.Helper()
+	receipt := DurableTurnTerminalReceipt{
+		Version: ProtocolVersion, Kind: DurableTurnTerminalCompleted,
+		RuntimeSessionID: "runtime-a", TurnID: "turn-a", CorrelationID: "corr-a", Seq: 3,
+		Completed: &DurableTurnCompletedReceipt{Result: "done", FinalEventSeq: 3},
+	}
+	return DurableTurnStatus{
+		TurnID: "turn-a", TaskUID: "task-uid", Attempt: 1,
+		RequestDigest: "sha256:" + strings.Repeat("a", sha256.Size*2), State: DurableTurnTerminal,
+		TerminalReceiptDigest: durableReceiptDigestForTest(t, receipt), TerminalReceipt: &receipt,
+		UpdatedAt: time.Date(2026, time.August, 6, 12, 0, 0, 0, time.UTC),
+	}
+}
+
+func durableReceiptDigestForTest(t *testing.T, receipt DurableTurnTerminalReceipt) string {
+	t.Helper()
+	digest, err := DurableTurnTerminalReceiptDigest(receipt)
+	if err != nil {
+		t.Fatalf("DurableTurnTerminalReceiptDigest() error = %v", err)
+	}
+	return digest
+}
+
 func TestSanitizeHarnessFrameRedactsConfiguredBearer(t *testing.T) {
 	value := strings.ToLower(t.Name())
 	client := &Client{authBearerValue: value}
@@ -1187,8 +1316,49 @@ func TestNewClientDefaultDoesNotSetTotalHTTPTimeout(t *testing.T) {
 }
 
 func TestClientRejectsInvalidBaseURL(t *testing.T) {
-	if _, err := NewClient("localhost:8080"); err == nil {
-		t.Fatal("NewClient() error = nil, want invalid base URL")
+	tests := []struct {
+		name       string
+		baseURL    string
+		wantError  string
+		notInError []string
+	}{
+		{
+			name: "missing scheme", baseURL: "localhost:8080",
+			wantError: "must include scheme and host",
+		},
+		{
+			name: "username", baseURL: "https://" + "operator" + "@adapter.example",
+			wantError: "must not include userinfo", notInError: []string{"operator@"},
+		},
+		{
+			name: "username and password", baseURL: "https://" + "operator" + ":" + "passphrase" + "@adapter.example",
+			wantError: "must not include userinfo", notInError: []string{"operator", "passphrase"},
+		},
+		{
+			name: "percent-encoded userinfo", baseURL: "https://" + "%6fperator" + ":" + "p%40ss" + "@adapter.example",
+			wantError: "must not include userinfo", notInError: []string{"%6fperator", "p%40ss", "operator", "p@ss"},
+		},
+		{
+			name: "query", baseURL: "https://adapter.example?" + "access_token=sensitive-query-value",
+			wantError: "must not include a query", notInError: []string{"access_token", "sensitive-query-value"},
+		},
+		{
+			name: "fragment", baseURL: "https://adapter.example#" + "sensitive-fragment-value",
+			wantError: "must not include a fragment", notInError: []string{"sensitive-fragment-value"},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := NewClient(tt.baseURL)
+			if err == nil || !strings.Contains(err.Error(), tt.wantError) {
+				t.Fatalf("NewClient() error = %v, want %q", err, tt.wantError)
+			}
+			for _, forbidden := range tt.notInError {
+				if strings.Contains(err.Error(), forbidden) {
+					t.Fatalf("NewClient() error disclosed rejected URL component: %q", err)
+				}
+			}
+		})
 	}
 }
 
diff --git a/internal/harness/conformance/conformance.go b/internal/harness/conformance/conformance.go
index 0acbe6fcb..72a01adb9 100644
--- a/internal/harness/conformance/conformance.go
+++ b/internal/harness/conformance/conformance.go
@@ -388,7 +388,10 @@ func runAuthProbe(ctx context.Context, target Target, result *Result, baseURL st
 	if target.StartTurnRequest != nil {
 		request = cloneStartTurnRequest(*target.StartTurnRequest)
 	}
-	assertUnauthenticatedStartRejected(ctx, target, result, baseURL, controlTimeout, request)
+	if !assertUnauthenticatedStartRejected(ctx, target, result, baseURL, controlTimeout, request) {
+		return
+	}
+	assertAuthenticatedEventStreamNotFound(ctx, target, result, baseURL, controlTimeout)
 }
 
 func runTurnProbe(ctx context.Context, target Target, result *Result, baseURL string, controlTimeout time.Duration) {
@@ -1287,6 +1290,40 @@ func assertUnauthenticatedStartRejected(
 	return true
 }
 
+func assertAuthenticatedEventStreamNotFound(
+	ctx context.Context,
+	target Target,
+	result *Result,
+	baseURL string,
+	controlTimeout time.Duration,
+) bool {
+	client, err := newClient(baseURL, target.BearerToken, target.HTTPClient, controlTimeout)
+	if err != nil {
+		result.addFailure(fmt.Sprintf("create authenticated client: %v", err))
+		return false
+	}
+	turnID := harness.HarnessTurnID("conformance-auth-" + uuid.NewString())
+	err = client.StreamFrames(ctx, turnID, 0, func(harness.HarnessEventFrame) error { return nil })
+	if err == nil {
+		result.addFailure("authenticated event stream probe unexpectedly found a nonexistent turn")
+		return false
+	}
+	var clientErr harness.ClientError
+	if !errors.As(err, &clientErr) {
+		result.addFailure(fmt.Sprintf("authenticated event stream probe failed: %v", err))
+		return false
+	}
+	switch clientErr.StatusCode {
+	case http.StatusNotFound:
+		return true
+	case http.StatusUnauthorized, http.StatusForbidden:
+		result.addFailure("configured bearer was rejected by authenticated event stream probe")
+	default:
+		result.addFailure(fmt.Sprintf("authenticated event stream probe returned %v, want 404", err))
+	}
+	return false
+}
+
 func assertUnauthenticatedTurnResourcesRejected(
 	ctx context.Context,
 	target Target,
diff --git a/internal/harness/conformance/conformance_test.go b/internal/harness/conformance/conformance_test.go
index 603e2e472..da33b4f97 100644
--- a/internal/harness/conformance/conformance_test.go
+++ b/internal/harness/conformance/conformance_test.go
@@ -39,6 +39,30 @@ func TestCheckReadinessPassesForFakeHarness(t *testing.T) {
 	}
 }
 
+func TestCheckRequiresConfiguredBearerToBeAccepted(t *testing.T) {
+	const currentBearer = "current-runtime-bearer"
+	const staleBearer = "stale-controller-bearer"
+	server := harnesstest.NewFakeHarnessServer(harnesstest.FakeHarnessConfig{AuthToken: currentBearer})
+	defer server.Close()
+
+	accepted := Check(context.Background(), Target{
+		BaseURL: server.URL(), BearerToken: currentBearer, RequireAuth: true,
+	})
+	if !accepted.Passed {
+		t.Fatalf("current bearer failed shallow conformance: %#v", accepted)
+	}
+
+	rejected := Check(context.Background(), Target{
+		BaseURL: server.URL(), BearerToken: staleBearer, RequireAuth: true,
+	})
+	if rejected.Passed || !strings.Contains(rejected.Message, "configured bearer was rejected") {
+		t.Fatalf("stale bearer result = %#v, want authenticated rejection", rejected)
+	}
+	if strings.Contains(rejected.Message, staleBearer) || strings.Contains(strings.Join(rejected.Failures, "\n"), staleBearer) {
+		t.Fatal("shallow conformance result leaked the rejected bearer")
+	}
+}
+
 func TestCheckReadinessPassesForAgentKitOrkaFixture(t *testing.T) {
 	server := newAgentKitOrkaFixture(t)
 	defer server.Close()
diff --git a/internal/harness/harnesstest/fake_server.go b/internal/harness/harnesstest/fake_server.go
index 21a67d0d9..2e4df78ed 100644
--- a/internal/harness/harnesstest/fake_server.go
+++ b/internal/harness/harnesstest/fake_server.go
@@ -32,6 +32,7 @@ const (
 type FakeHarnessConfig struct {
 	Behavior        FakeBehavior
 	Delay           time.Duration
+	TLS             bool
 	RuntimeName     string
 	RuntimeVersion  string
 	ProtocolVersion string
@@ -97,12 +98,18 @@ func NewFakeHarnessServer(config FakeHarnessConfig) *FakeHarnessServer {
 	mux.HandleFunc(harness.CapabilitiesPath, s.handleCapabilities)
 	mux.HandleFunc(harness.TurnsPath, s.handleStartTurn)
 	mux.HandleFunc(harness.TurnsPath+"/", s.handleTurn)
-	s.server = httptest.NewServer(mux)
+	if config.TLS {
+		s.server = httptest.NewTLSServer(mux)
+	} else {
+		s.server = httptest.NewServer(mux)
+	}
 	return s
 }
 
 func (s *FakeHarnessServer) URL() string { return s.server.URL }
 
+func (s *FakeHarnessServer) Client() *http.Client { return s.server.Client() }
+
 func (s *FakeHarnessServer) Close() {
 	if s != nil && s.server != nil {
 		s.server.Close()
diff --git a/internal/harness/ledger/ledger.go b/internal/harness/ledger/ledger.go
new file mode 100644
index 000000000..8e7127e97
--- /dev/null
+++ b/internal/harness/ledger/ledger.go
@@ -0,0 +1,1158 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+// Package ledger implements the durable harness v1 wrapper admission ledger.
+//
+// The persisted-frame journal remains the cross-restart idempotency backstop
+// after the first mapped frame is durable. This ledger closes only the gaps
+// the frame journal cannot cover:
+//
+//   - admission before the first frame is persisted;
+//   - acceptance when the response is lost;
+//   - idempotent handling of the same turn ID and request digest;
+//   - permanent rejection of the same turn ID with a different digest;
+//   - durable admission-close and drain inventory;
+//   - terminal or explicit OutcomeUnknown receipts surviving wrapper restart.
+//
+// It does not duplicate frame storage, transcript persistence, or frame
+// deduplication. It lives on a dedicated wrapper PVC, separate from the
+// controller store.
+package ledger
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"time"
+
+	_ "modernc.org/sqlite" // pure-Go SQLite driver
+)
+
+const maxTurnOutputBytes = 50 << 20
+
+// TurnState is the durable ledger state of one admitted turn.
+type TurnState string
+
+const (
+	// TurnAdmitted records admission before any frame is durable.
+	TurnAdmitted TurnState = "Admitted"
+	// TurnAccepted records that the runtime accepted the turn, even when the
+	// acceptance response was lost.
+	TurnAccepted TurnState = "Accepted"
+	// TurnRejected is a durable ledger-backed non-acceptance proof: no
+	// executor accepted the request. It is the only state that proves a safe
+	// resend is possible.
+	TurnRejected TurnState = "Rejected"
+	// TurnTerminal records an authoritative terminal receipt.
+	TurnTerminal TurnState = "Terminal"
+	// TurnOutcomeUnknown records an explicit permanent unknown outcome.
+	TurnOutcomeUnknown TurnState = "OutcomeUnknown"
+)
+
+// ErrAdmissionClosed rejects new admissions after the durable admission close.
+var ErrAdmissionClosed = errors.New("wrapper turn admission is closed")
+
+// ErrDigestMismatch permanently rejects a turn ID replayed with a different
+// request digest.
+var ErrDigestMismatch = errors.New("turn ID was already admitted with a different request digest")
+
+// ErrNotFound reports a missing turn record.
+var ErrNotFound = errors.New("turn record not found")
+
+// ErrOutputAcknowledgementMismatch reports an acknowledgement that is not
+// fenced to the output and terminal receipt durably recorded for the turn.
+var ErrOutputAcknowledgementMismatch = errors.New("turn output acknowledgement does not match durable receipt")
+
+// ErrSettlementAcknowledgementMismatch reports a controller acknowledgement
+// that is not fenced to the exact durable request and terminal evidence.
+var ErrSettlementAcknowledgementMismatch = errors.New("turn settlement acknowledgement does not match durable evidence")
+
+const retiredGenerationPrefix = "retired:"
+
+// TurnRecord is one durable admission record.
+type TurnRecord struct {
+	TurnID                string
+	TaskUID               string
+	Attempt               int32
+	RequestDigest         string
+	RuntimeSessionID      string
+	CorrelationID         string
+	State                 TurnState
+	RejectReason          string
+	TerminalReceipt       []byte
+	TerminalReceiptDigest string
+	CreatedAt             time.Time
+	UpdatedAt             time.Time
+	SettledAt             *time.Time
+}
+
+// TurnOutput is the bounded output payload referenced by a terminal receipt.
+// It is committed atomically with the receipt so a durable OutputRef never
+// points at process-local or partially persisted state.
+type TurnOutput struct {
+	Ref  string
+	Data []byte
+}
+
+// Settled reports whether the record needs no further settlement work.
+func (r TurnRecord) Settled() bool {
+	switch r.State {
+	case TurnRejected, TurnTerminal, TurnOutcomeUnknown:
+		return true
+	default:
+		return false
+	}
+}
+
+// AdmitOutcome describes the result of an admission request.
+type AdmitOutcome string
+
+const (
+	// AdmitOutcomeAdmitted is a fresh admission.
+	AdmitOutcomeAdmitted AdmitOutcome = "admitted"
+	// AdmitOutcomeDuplicate is an idempotent replay of the same turn ID and
+	// request digest; the existing record is returned unchanged.
+	AdmitOutcomeDuplicate AdmitOutcome = "duplicate"
+)
+
+// Ledger is the wrapper-local durable admission ledger.
+type Ledger struct {
+	db *sql.DB
+}
+
+// Open opens (creating if needed) the ledger database at path.
+func Open(path string) (*Ledger, error) {
+	return OpenWithGeneration(path, "1")
+}
+
+// OpenWithGeneration opens the ledger and initializes a newly created control
+// table with the caller's deployment generation. An existing ledger keeps its
+// durable generation and still requires the explicit close/drain rollover CAS.
+func OpenWithGeneration(path, initialGeneration string) (*Ledger, error) {
+	path = strings.TrimSpace(path)
+	if path == "" {
+		return nil, fmt.Errorf("ledger path is required")
+	}
+	if err := validateGeneration(initialGeneration); err != nil {
+		return nil, err
+	}
+	var err error
+	path, err = prepareLedgerPath(path)
+	if err != nil {
+		return nil, err
+	}
+	db, err := sql.Open("sqlite", path)
+	if err != nil {
+		return nil, fmt.Errorf("open wrapper admission ledger: %w", err)
+	}
+	db.SetMaxOpenConns(1)
+	db.SetMaxIdleConns(1)
+	db.SetConnMaxLifetime(0)
+	for _, pragma := range []string{
+		"PRAGMA foreign_keys=ON",
+		"PRAGMA journal_mode=WAL",
+		"PRAGMA busy_timeout=5000",
+		"PRAGMA synchronous=FULL",
+	} {
+		if _, err := db.Exec(pragma); err != nil {
+			_ = db.Close()
+			return nil, fmt.Errorf("configure wrapper admission ledger: %w", err)
+		}
+	}
+	if err := migrate(db, strings.TrimSpace(initialGeneration)); err != nil {
+		_ = db.Close()
+		return nil, err
+	}
+	if err := secureLedgerFiles(path); err != nil {
+		_ = db.Close()
+		return nil, err
+	}
+	return &Ledger{db: db}, nil
+}
+
+func prepareLedgerPath(path string) (string, error) {
+	path = filepath.Clean(path)
+	parent := filepath.Dir(path)
+	volumeRoot := filepath.Clean(filepath.VolumeName(parent) + string(filepath.Separator))
+	if parent == "." || parent == volumeRoot {
+		return "", fmt.Errorf("wrapper admission ledger path must use a dedicated directory")
+	}
+	if err := os.MkdirAll(parent, 0o700); err != nil {
+		return "", fmt.Errorf("create wrapper admission ledger directory: %w", err)
+	}
+	if err := secureLedgerPath(parent, true, 0o700); err != nil {
+		return "", err
+	}
+	info, err := os.Lstat(path)
+	switch {
+	case errors.Is(err, os.ErrNotExist):
+		file, createErr := os.OpenFile(path, os.O_RDWR|os.O_CREATE|os.O_EXCL, 0o600)
+		if createErr != nil {
+			return "", fmt.Errorf("create wrapper admission ledger: %w", createErr)
+		}
+		if closeErr := file.Close(); closeErr != nil {
+			return "", fmt.Errorf("close new wrapper admission ledger: %w", closeErr)
+		}
+	case err != nil:
+		return "", fmt.Errorf("inspect wrapper admission ledger: %w", err)
+	case info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular():
+		return "", fmt.Errorf("wrapper admission ledger must be a regular file")
+	}
+	if err := secureLedgerPath(path, false, 0o600); err != nil {
+		return "", err
+	}
+	return path, nil
+}
+
+func secureLedgerFiles(path string) error {
+	for _, candidate := range []string{path, path + "-wal", path + "-shm"} {
+		if err := secureLedgerPath(candidate, false, 0o600); err != nil && !errors.Is(err, os.ErrNotExist) {
+			return err
+		}
+	}
+	return nil
+}
+
+func secureLedgerPath(path string, directory bool, mode os.FileMode) error {
+	info, err := os.Lstat(path)
+	if err != nil {
+		return err
+	}
+	if info.Mode()&os.ModeSymlink != 0 || (directory && !info.IsDir()) || (!directory && !info.Mode().IsRegular()) {
+		kind := "file"
+		if directory {
+			kind = "directory"
+		}
+		return fmt.Errorf("wrapper admission ledger %s must be a non-symlink %s", path, kind)
+	}
+	if err := os.Chmod(path, mode); err != nil {
+		return fmt.Errorf("restrict wrapper admission ledger %s permissions: %w", path, err)
+	}
+	info, err = os.Lstat(path)
+	if err != nil {
+		return fmt.Errorf("verify wrapper admission ledger %s permissions: %w", path, err)
+	}
+	if info.Mode().Perm() != mode.Perm() {
+		return fmt.Errorf("wrapper admission ledger %s permissions are %04o, want %04o", path, info.Mode().Perm(), mode.Perm())
+	}
+	return nil
+}
+
+// Close closes the ledger database.
+func (l *Ledger) Close() error {
+	return l.db.Close()
+}
+
+func migrate(db *sql.DB, initialGeneration string) error {
+	statements := []string{
+		`CREATE TABLE IF NOT EXISTS ledger_control (
+			key   TEXT PRIMARY KEY,
+			value TEXT NOT NULL
+		)`,
+		`CREATE TABLE IF NOT EXISTS turn_admissions (
+			turn_id                 TEXT PRIMARY KEY,
+			task_uid                TEXT NOT NULL,
+			attempt                 INTEGER NOT NULL CHECK(attempt > 0),
+			request_digest          TEXT NOT NULL,
+			runtime_session_id      TEXT NOT NULL DEFAULT '',
+			correlation_id          TEXT NOT NULL DEFAULT '',
+			state                   TEXT NOT NULL CHECK(state IN ('Admitted','Accepted','Rejected','Terminal','OutcomeUnknown')),
+			reject_reason           TEXT NOT NULL DEFAULT '',
+			terminal_receipt        BLOB,
+			terminal_receipt_digest TEXT NOT NULL DEFAULT '',
+			created_at              TIMESTAMP NOT NULL,
+			updated_at              TIMESTAMP NOT NULL,
+			settled_at              TIMESTAMP
+		)`,
+		`CREATE INDEX IF NOT EXISTS idx_turn_admissions_unsettled
+			ON turn_admissions(state, updated_at ASC)
+			WHERE state IN ('Admitted','Accepted')`,
+		`CREATE TABLE IF NOT EXISTS turn_outputs (
+			turn_id        TEXT PRIMARY KEY,
+			output_ref     TEXT NOT NULL,
+			output_payload BLOB NOT NULL,
+			output_digest  TEXT NOT NULL,
+			output_size    INTEGER NOT NULL CHECK(output_size >= 0),
+			created_at     TIMESTAMP NOT NULL,
+			FOREIGN KEY(turn_id) REFERENCES turn_admissions(turn_id) ON DELETE CASCADE
+		)`,
+		`CREATE TABLE IF NOT EXISTS turn_output_acknowledgements (
+			turn_id                 TEXT PRIMARY KEY,
+			output_ref              TEXT NOT NULL,
+			output_digest           TEXT NOT NULL,
+			terminal_receipt_digest TEXT NOT NULL,
+			acknowledged_at          TIMESTAMP NOT NULL,
+			FOREIGN KEY(turn_id) REFERENCES turn_admissions(turn_id) ON DELETE CASCADE
+		)`,
+	}
+	for _, statement := range statements {
+		if _, err := db.Exec(statement); err != nil {
+			return fmt.Errorf("migrate wrapper admission ledger: %w", err)
+		}
+	}
+	if _, err := db.Exec(`INSERT INTO ledger_control (key, value) VALUES ('generation', ?)
+		ON CONFLICT(key) DO NOTHING`, initialGeneration); err != nil {
+		return fmt.Errorf("initialize wrapper admission ledger generation: %w", err)
+	}
+	// These ALTERs support ledgers created by the first coexistence preview.
+	// Existing unsettled rows are reconciled conservatively by the wrapper;
+	// terminal rows already carry their exact identity inside the receipt.
+	for _, column := range []struct {
+		name       string
+		definition string
+	}{
+		{name: "runtime_session_id", definition: "TEXT NOT NULL DEFAULT ''"},
+		{name: "correlation_id", definition: "TEXT NOT NULL DEFAULT ''"},
+		{name: "settled_at", definition: "TIMESTAMP"},
+	} {
+		if err := ensureTurnAdmissionColumn(db, column.name, column.definition); err != nil {
+			return err
+		}
+	}
+	if _, err := db.Exec(`CREATE INDEX IF NOT EXISTS idx_turn_admissions_reclaimable
+		ON turn_admissions(settled_at, updated_at ASC)
+		WHERE settled_at IS NOT NULL`); err != nil {
+		return fmt.Errorf("index reclaimable wrapper admission ledger turns: %w", err)
+	}
+	return nil
+}
+
+func ensureTurnAdmissionColumn(db *sql.DB, name, definition string) error {
+	rows, err := db.Query(`PRAGMA table_info(turn_admissions)`)
+	if err != nil {
+		return fmt.Errorf("inspect wrapper admission ledger columns: %w", err)
+	}
+	found := false
+	for rows.Next() {
+		var (
+			cid       int
+			column    string
+			dataType  string
+			notNull   int
+			defaultV  sql.NullString
+			primaryID int
+		)
+		if err := rows.Scan(&cid, &column, &dataType, &notNull, &defaultV, &primaryID); err != nil {
+			_ = rows.Close()
+			return fmt.Errorf("scan wrapper admission ledger columns: %w", err)
+		}
+		if column == name {
+			found = true
+		}
+	}
+	if err := rows.Close(); err != nil {
+		return fmt.Errorf("close wrapper admission ledger column scan: %w", err)
+	}
+	if err := rows.Err(); err != nil {
+		return fmt.Errorf("inspect wrapper admission ledger columns: %w", err)
+	}
+	if found {
+		return nil
+	}
+	if _, err := db.Exec(`ALTER TABLE turn_admissions ADD COLUMN ` + name + ` ` + definition); err != nil {
+		return fmt.Errorf("add wrapper admission ledger column %s: %w", name, err)
+	}
+	return nil
+}
+
+// ReceiptDigest returns the canonical digest of a terminal receipt payload.
+func ReceiptDigest(receipt []byte) string {
+	sum := sha256.Sum256(receipt)
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
+
+// AdmitTurn durably admits one turn before StartTurn is written. The same
+// turn ID with the same request digest is idempotent; the same turn ID with a
+// different digest fails permanently; a closed admission fails closed.
+func (l *Ledger) AdmitTurn(
+	ctx context.Context,
+	turnID, taskUID string,
+	attempt int32,
+	requestDigest, runtimeSessionID, correlationID string,
+) (AdmitOutcome, *TurnRecord, error) {
+	if strings.TrimSpace(turnID) == "" || strings.TrimSpace(taskUID) == "" ||
+		attempt < 1 || strings.TrimSpace(requestDigest) == "" ||
+		strings.TrimSpace(runtimeSessionID) == "" || strings.TrimSpace(correlationID) == "" {
+		return "", nil, fmt.Errorf("turn ID, task UID, positive attempt, request digest, runtime session ID, and correlation ID are required")
+	}
+	tx, err := l.db.BeginTx(ctx, nil)
+	if err != nil {
+		return "", nil, fmt.Errorf("begin turn admission: %w", err)
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	existing, err := scanTurn(tx.QueryRowContext(ctx, turnSelectSQL+` WHERE turn_id = ?`, turnID))
+	switch {
+	case err == nil:
+		if existing.RequestDigest != requestDigest ||
+			existing.RuntimeSessionID != runtimeSessionID || existing.CorrelationID != correlationID {
+			return "", nil, fmt.Errorf("%w: turn %s", ErrDigestMismatch, turnID)
+		}
+		if err := tx.Commit(); err != nil {
+			return "", nil, fmt.Errorf("commit duplicate turn admission: %w", err)
+		}
+		return AdmitOutcomeDuplicate, existing, nil
+	case errors.Is(err, sql.ErrNoRows):
+	default:
+		return "", nil, fmt.Errorf("read turn admission: %w", err)
+	}
+
+	closed, _, err := admissionClosed(ctx, tx)
+	if err != nil {
+		return "", nil, err
+	}
+	if closed {
+		return "", nil, ErrAdmissionClosed
+	}
+
+	now := time.Now().UTC()
+	if _, err := tx.ExecContext(ctx, `INSERT INTO turn_admissions
+		(turn_id, task_uid, attempt, request_digest, runtime_session_id, correlation_id, state, created_at, updated_at)
+		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		turnID, taskUID, attempt, requestDigest, runtimeSessionID, correlationID, string(TurnAdmitted), now, now); err != nil {
+		return "", nil, fmt.Errorf("admit turn: %w", err)
+	}
+	if err := tx.Commit(); err != nil {
+		return "", nil, fmt.Errorf("commit turn admission: %w", err)
+	}
+	return AdmitOutcomeAdmitted, &TurnRecord{
+		TurnID: turnID, TaskUID: taskUID, Attempt: attempt, RequestDigest: requestDigest,
+		RuntimeSessionID: runtimeSessionID, CorrelationID: correlationID,
+		State: TurnAdmitted, CreatedAt: now, UpdatedAt: now,
+	}, nil
+}
+
+// MarkTurnAccepted durably records acceptance. Idempotent for already-accepted
+// turns; invalid from settled states.
+func (l *Ledger) MarkTurnAccepted(ctx context.Context, turnID string) error {
+	return l.transition(ctx, turnID, TurnAccepted, "", nil, "", []TurnState{TurnAdmitted, TurnAccepted})
+}
+
+// MarkTurnRejected durably records a definitive non-acceptance. It is the only
+// submission-state proof that permits a safe resend through a new attempt.
+func (l *Ledger) MarkTurnRejected(ctx context.Context, turnID, reason string) error {
+	return l.transition(ctx, turnID, TurnRejected, reason, nil, "", []TurnState{TurnAdmitted, TurnRejected})
+}
+
+// RecordTurnTerminal durably records the authoritative terminal receipt, or an
+// explicit permanent OutcomeUnknown when outcomeUnknown is true. A replay with
+// the same receipt digest is idempotent; a conflicting receipt fails.
+func (l *Ledger) RecordTurnTerminal(ctx context.Context, turnID string, receipt []byte, outcomeUnknown bool) error {
+	return l.RecordTurnTerminalWithOutput(ctx, turnID, receipt, outcomeUnknown, nil)
+}
+
+// RecordTurnTerminalWithOutput atomically records the canonical terminal
+// receipt and its optional locally referenced output payload.
+func (l *Ledger) RecordTurnTerminalWithOutput(
+	ctx context.Context,
+	turnID string,
+	receipt []byte,
+	outcomeUnknown bool,
+	output *TurnOutput,
+) error {
+	if strings.TrimSpace(turnID) == "" || len(receipt) == 0 {
+		return fmt.Errorf("turn ID and terminal receipt are required")
+	}
+	if output != nil {
+		if strings.TrimSpace(output.Ref) == "" {
+			return fmt.Errorf("turn output ref is required")
+		}
+		if len(output.Data) > maxTurnOutputBytes {
+			return fmt.Errorf("turn output exceeds durable ledger limit")
+		}
+	}
+	target := TurnTerminal
+	if outcomeUnknown {
+		target = TurnOutcomeUnknown
+	}
+	digest := ReceiptDigest(receipt)
+	tx, err := l.db.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("begin terminal turn transition: %w", err)
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	existing, err := scanTurn(tx.QueryRowContext(ctx, turnSelectSQL+` WHERE turn_id = ?`, turnID))
+	if errors.Is(err, sql.ErrNoRows) {
+		return fmt.Errorf("%w: turn %s", ErrNotFound, turnID)
+	}
+	if err != nil {
+		return fmt.Errorf("read turn admission: %w", err)
+	}
+	if existing.State == target {
+		if existing.TerminalReceiptDigest != digest {
+			return fmt.Errorf("turn %s already recorded a different terminal receipt", turnID)
+		}
+		if output != nil {
+			var acknowledgedRef, acknowledgedOutputDigest, acknowledgedReceiptDigest string
+			ackErr := tx.QueryRowContext(ctx, `SELECT output_ref, output_digest, terminal_receipt_digest
+				FROM turn_output_acknowledgements WHERE turn_id = ?`, turnID).Scan(
+				&acknowledgedRef, &acknowledgedOutputDigest, &acknowledgedReceiptDigest,
+			)
+			if ackErr == nil {
+				if acknowledgedRef != output.Ref || acknowledgedOutputDigest != ReceiptDigest(output.Data) ||
+					acknowledgedReceiptDigest != digest {
+					return fmt.Errorf("turn %s already acknowledged different terminal output", turnID)
+				}
+				return tx.Commit()
+			}
+			if !errors.Is(ackErr, sql.ErrNoRows) {
+				return fmt.Errorf("read terminal turn output acknowledgement: %w", ackErr)
+			}
+			persisted, outputErr := getTurnOutput(ctx, tx, turnID, output.Ref)
+			if outputErr != nil || !bytes.Equal(persisted, output.Data) {
+				return fmt.Errorf("turn %s already recorded different terminal output", turnID)
+			}
+		}
+		return tx.Commit()
+	}
+	if existing.State != TurnAdmitted && existing.State != TurnAccepted {
+		return fmt.Errorf("turn %s cannot move from %s to %s", turnID, existing.State, target)
+	}
+	if outcomeUnknown && output != nil {
+		return fmt.Errorf("outcome-unknown turn cannot store referenced output")
+	}
+	now := time.Now().UTC()
+	if _, err := tx.ExecContext(ctx, `UPDATE turn_admissions SET
+			state = ?, reject_reason = '', terminal_receipt = ?, terminal_receipt_digest = ?, updated_at = ?
+			WHERE turn_id = ?`, string(target), receipt, digest, now, turnID); err != nil {
+		return fmt.Errorf("transition terminal turn: %w", err)
+	}
+	if output != nil {
+		outputDigest := ReceiptDigest(output.Data)
+		if _, err := tx.ExecContext(ctx, `INSERT INTO turn_outputs
+			(turn_id, output_ref, output_payload, output_digest, output_size, created_at)
+			VALUES (?, ?, ?, ?, ?, ?)`,
+			turnID, output.Ref, output.Data, outputDigest, len(output.Data), now); err != nil {
+			return fmt.Errorf("persist terminal turn output: %w", err)
+		}
+	}
+	return tx.Commit()
+}
+
+func (l *Ledger) transition(ctx context.Context, turnID string, target TurnState, rejectReason string, receipt []byte, receiptDigest string, validFrom []TurnState) error {
+	if strings.TrimSpace(turnID) == "" {
+		return fmt.Errorf("turn ID is required")
+	}
+	tx, err := l.db.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("begin turn transition: %w", err)
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	existing, err := scanTurn(tx.QueryRowContext(ctx, turnSelectSQL+` WHERE turn_id = ?`, turnID))
+	if errors.Is(err, sql.ErrNoRows) {
+		return fmt.Errorf("%w: turn %s", ErrNotFound, turnID)
+	}
+	if err != nil {
+		return fmt.Errorf("read turn admission: %w", err)
+	}
+
+	if existing.State == target {
+		// Idempotent replay; terminal receipts must match exactly.
+		if (target == TurnTerminal || target == TurnOutcomeUnknown) && existing.TerminalReceiptDigest != receiptDigest {
+			return fmt.Errorf("turn %s already recorded a different terminal receipt", turnID)
+		}
+		return tx.Commit()
+	}
+	allowed := slices.Contains(validFrom, existing.State)
+	if !allowed {
+		return fmt.Errorf("turn %s cannot move from %s to %s", turnID, existing.State, target)
+	}
+
+	if _, err := tx.ExecContext(ctx, `UPDATE turn_admissions SET
+			state = ?, reject_reason = ?, terminal_receipt = ?, terminal_receipt_digest = ?, updated_at = ?
+		WHERE turn_id = ?`,
+		string(target), rejectReason, receipt, receiptDigest, time.Now().UTC(), turnID); err != nil {
+		return fmt.Errorf("transition turn: %w", err)
+	}
+	return tx.Commit()
+}
+
+// GetTurn returns one durable turn record.
+func (l *Ledger) GetTurn(ctx context.Context, turnID string) (*TurnRecord, error) {
+	record, err := scanTurn(l.db.QueryRowContext(ctx, turnSelectSQL+` WHERE turn_id = ?`, turnID))
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, fmt.Errorf("%w: turn %s", ErrNotFound, turnID)
+	}
+	if err != nil {
+		return nil, fmt.Errorf("get turn admission: %w", err)
+	}
+	return record, nil
+}
+
+// GetTurnOutput returns a validated output payload only for a terminal turn
+// and the exact opaque reference recorded with its terminal receipt.
+func (l *Ledger) GetTurnOutput(ctx context.Context, turnID, outputRef string) ([]byte, error) {
+	if strings.TrimSpace(turnID) == "" || strings.TrimSpace(outputRef) == "" {
+		return nil, fmt.Errorf("turn ID and output ref are required")
+	}
+	return getTurnOutput(ctx, l.db, turnID, outputRef)
+}
+
+// AcknowledgeTurnOutput atomically records a receipt-bound tombstone and
+// deletes the acknowledged output payload. The tombstone makes a lost
+// acknowledgement response or controller restart safe to retry without
+// retaining the potentially large blob.
+func (l *Ledger) AcknowledgeTurnOutput(
+	ctx context.Context,
+	turnID, outputRef, terminalReceiptDigest string,
+) error {
+	turnID = strings.TrimSpace(turnID)
+	outputRef = strings.TrimSpace(outputRef)
+	terminalReceiptDigest = strings.TrimSpace(terminalReceiptDigest)
+	if turnID == "" || outputRef == "" {
+		return fmt.Errorf("turn ID and output ref are required")
+	}
+	if !isCanonicalReceiptDigest(terminalReceiptDigest) {
+		return fmt.Errorf("terminal receipt digest must be a canonical sha256 digest")
+	}
+
+	tx, err := l.db.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("begin terminal turn output acknowledgement: %w", err)
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var state, persistedReceiptDigest string
+	err = tx.QueryRowContext(ctx, `SELECT state, terminal_receipt_digest
+		FROM turn_admissions WHERE turn_id = ?`, turnID).Scan(&state, &persistedReceiptDigest)
+	if errors.Is(err, sql.ErrNoRows) {
+		return fmt.Errorf("%w: turn %s", ErrNotFound, turnID)
+	}
+	if err != nil {
+		return fmt.Errorf("read terminal turn for output acknowledgement: %w", err)
+	}
+	if TurnState(state) != TurnTerminal || persistedReceiptDigest != terminalReceiptDigest {
+		return fmt.Errorf("%w: turn %s", ErrOutputAcknowledgementMismatch, turnID)
+	}
+
+	var acknowledgedRef, acknowledgedReceiptDigest string
+	err = tx.QueryRowContext(ctx, `SELECT output_ref, terminal_receipt_digest
+		FROM turn_output_acknowledgements WHERE turn_id = ?`, turnID).Scan(
+		&acknowledgedRef, &acknowledgedReceiptDigest,
+	)
+	if err == nil {
+		if acknowledgedRef != outputRef || acknowledgedReceiptDigest != terminalReceiptDigest {
+			return fmt.Errorf("%w: turn %s", ErrOutputAcknowledgementMismatch, turnID)
+		}
+		return tx.Commit()
+	}
+	if !errors.Is(err, sql.ErrNoRows) {
+		return fmt.Errorf("read terminal turn output acknowledgement: %w", err)
+	}
+
+	var persistedRef, outputDigest string
+	err = tx.QueryRowContext(ctx, `SELECT output_ref, output_digest FROM turn_outputs WHERE turn_id = ?`, turnID).Scan(
+		&persistedRef, &outputDigest,
+	)
+	if errors.Is(err, sql.ErrNoRows) {
+		return fmt.Errorf("%w: output for turn %s", ErrNotFound, turnID)
+	}
+	if err != nil {
+		return fmt.Errorf("read terminal turn output for acknowledgement: %w", err)
+	}
+	if persistedRef != outputRef {
+		return fmt.Errorf("%w: turn %s", ErrOutputAcknowledgementMismatch, turnID)
+	}
+	if _, err := tx.ExecContext(ctx, `INSERT INTO turn_output_acknowledgements
+		(turn_id, output_ref, output_digest, terminal_receipt_digest, acknowledged_at)
+		VALUES (?, ?, ?, ?, ?)`, turnID, persistedRef, outputDigest, terminalReceiptDigest, time.Now().UTC()); err != nil {
+		return fmt.Errorf("persist terminal turn output acknowledgement: %w", err)
+	}
+	if _, err := tx.ExecContext(ctx, `DELETE FROM turn_outputs WHERE turn_id = ?`, turnID); err != nil {
+		return fmt.Errorf("delete acknowledged terminal turn output: %w", err)
+	}
+	return tx.Commit()
+}
+
+// AcknowledgeTurnSettlement records that the controller durably settled the
+// exact request and terminal evidence. Only acknowledged rows are eligible for
+// later retention-based reclamation.
+func (l *Ledger) AcknowledgeTurnSettlement(
+	ctx context.Context,
+	turnID, requestDigest, terminalReceiptDigest string,
+) error {
+	turnID = strings.TrimSpace(turnID)
+	requestDigest = strings.TrimSpace(requestDigest)
+	terminalReceiptDigest = strings.TrimSpace(terminalReceiptDigest)
+	if turnID == "" || !isCanonicalReceiptDigest(requestDigest) {
+		return fmt.Errorf("turn ID and canonical request digest are required")
+	}
+	if terminalReceiptDigest != "" && !isCanonicalReceiptDigest(terminalReceiptDigest) {
+		return fmt.Errorf("terminal receipt digest must be empty or a canonical sha256 digest")
+	}
+
+	tx, err := l.db.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("begin turn settlement acknowledgement: %w", err)
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var state, persistedRequestDigest, persistedReceiptDigest string
+	var settledAt sql.NullTime
+	err = tx.QueryRowContext(ctx, `SELECT state, request_digest, terminal_receipt_digest, settled_at
+		FROM turn_admissions WHERE turn_id = ?`, turnID).Scan(
+		&state, &persistedRequestDigest, &persistedReceiptDigest, &settledAt,
+	)
+	if errors.Is(err, sql.ErrNoRows) {
+		return fmt.Errorf("%w: turn %s", ErrNotFound, turnID)
+	}
+	if err != nil {
+		return fmt.Errorf("read turn settlement evidence: %w", err)
+	}
+	if persistedRequestDigest != requestDigest {
+		return fmt.Errorf("%w: turn %s", ErrSettlementAcknowledgementMismatch, turnID)
+	}
+	switch TurnState(state) {
+	case TurnRejected:
+		if terminalReceiptDigest != "" || persistedReceiptDigest != "" {
+			return fmt.Errorf("%w: turn %s", ErrSettlementAcknowledgementMismatch, turnID)
+		}
+	case TurnTerminal, TurnOutcomeUnknown:
+		if terminalReceiptDigest == "" || terminalReceiptDigest != persistedReceiptDigest {
+			return fmt.Errorf("%w: turn %s", ErrSettlementAcknowledgementMismatch, turnID)
+		}
+		var outputCount int
+		if err := tx.QueryRowContext(ctx, `SELECT COUNT(*) FROM turn_outputs WHERE turn_id = ?`, turnID).Scan(&outputCount); err != nil {
+			return fmt.Errorf("read unsettled terminal turn output count: %w", err)
+		}
+		if outputCount != 0 {
+			return fmt.Errorf("%w: turn %s still has unacknowledged output", ErrSettlementAcknowledgementMismatch, turnID)
+		}
+	default:
+		return fmt.Errorf("%w: turn %s is not terminal", ErrSettlementAcknowledgementMismatch, turnID)
+	}
+	if settledAt.Valid {
+		return tx.Commit()
+	}
+	if _, err := tx.ExecContext(ctx, `UPDATE turn_admissions SET settled_at = ?
+		WHERE turn_id = ? AND settled_at IS NULL`, time.Now().UTC(), turnID); err != nil {
+		return fmt.Errorf("acknowledge turn settlement: %w", err)
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("commit turn settlement acknowledgement: %w", err)
+	}
+	return nil
+}
+
+// ReclaimSettledTurnsBefore removes a bounded batch of controller-acknowledged
+// rows only after the configured retention cutoff. Child output and
+// acknowledgement rows are deleted by the foreign-key cascade.
+func (l *Ledger) ReclaimSettledTurnsBefore(ctx context.Context, cutoff time.Time, limit int) (int64, error) {
+	if cutoff.IsZero() {
+		return 0, fmt.Errorf("settled turn reclamation cutoff is required")
+	}
+	if limit < 1 || limit > 1000 {
+		return 0, fmt.Errorf("settled turn reclamation limit must be between 1 and 1000")
+	}
+	result, err := l.db.ExecContext(ctx, `DELETE FROM turn_admissions WHERE turn_id IN (
+		SELECT turn_id FROM turn_admissions
+		WHERE settled_at IS NOT NULL AND settled_at <= ?
+		ORDER BY settled_at ASC, turn_id ASC LIMIT ?
+	)`, cutoff.UTC(), limit)
+	if err != nil {
+		return 0, fmt.Errorf("reclaim settled wrapper turns: %w", err)
+	}
+	count, err := result.RowsAffected()
+	if err != nil {
+		return 0, fmt.Errorf("count reclaimed wrapper turns: %w", err)
+	}
+	return count, nil
+}
+
+func isCanonicalReceiptDigest(value string) bool {
+	if len(value) != len("sha256:")+sha256.Size*2 || !strings.HasPrefix(value, "sha256:") {
+		return false
+	}
+	encoded := strings.TrimPrefix(value, "sha256:")
+	decoded, err := hex.DecodeString(encoded)
+	return err == nil && len(decoded) == sha256.Size && encoded == strings.ToLower(encoded)
+}
+
+type queryScanner interface {
+	QueryRowContext(ctx context.Context, query string, args ...any) *sql.Row
+}
+
+func getTurnOutput(ctx context.Context, q queryScanner, turnID, outputRef string) ([]byte, error) {
+	var (
+		state   string
+		ref     string
+		payload []byte
+		digest  string
+		size    int
+	)
+	err := q.QueryRowContext(ctx, `SELECT a.state, o.output_ref, o.output_payload, o.output_digest, o.output_size
+		FROM turn_admissions AS a
+		JOIN turn_outputs AS o ON o.turn_id = a.turn_id
+		WHERE a.turn_id = ?`, turnID).Scan(&state, &ref, &payload, &digest, &size)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, fmt.Errorf("%w: output for turn %s", ErrNotFound, turnID)
+	}
+	if err != nil {
+		return nil, fmt.Errorf("read terminal turn output: %w", err)
+	}
+	if TurnState(state) != TurnTerminal || ref != outputRef {
+		return nil, fmt.Errorf("%w: output for turn %s", ErrNotFound, turnID)
+	}
+	if size != len(payload) || size < 0 || size > maxTurnOutputBytes || ReceiptDigest(payload) != digest {
+		return nil, fmt.Errorf("corrupt terminal turn output")
+	}
+	return append([]byte(nil), payload...), nil
+}
+
+// ListUnsettledTurns returns every Admitted or Accepted turn for drain
+// inventory and shutdown proof.
+func (l *Ledger) ListUnsettledTurns(ctx context.Context) ([]TurnRecord, error) {
+	rows, err := l.db.QueryContext(ctx, turnSelectSQL+`
+		WHERE state IN ('Admitted','Accepted') ORDER BY updated_at ASC, turn_id ASC`)
+	if err != nil {
+		return nil, fmt.Errorf("list unsettled turns: %w", err)
+	}
+	defer func() { _ = rows.Close() }()
+	var records []TurnRecord
+	for rows.Next() {
+		record, err := scanTurn(rows)
+		if err != nil {
+			return nil, fmt.Errorf("scan turn admission: %w", err)
+		}
+		records = append(records, *record)
+	}
+	return records, rows.Err()
+}
+
+// CloseAdmission durably closes new turn admission. Idempotent.
+func (l *Ledger) CloseAdmission(ctx context.Context) error {
+	if _, err := l.db.ExecContext(ctx, `INSERT INTO ledger_control (key, value)
+		VALUES ('admission-closed-at', ?)
+		ON CONFLICT(key) DO NOTHING`, time.Now().UTC().Format(time.RFC3339Nano)); err != nil {
+		return fmt.Errorf("close turn admission: %w", err)
+	}
+	return nil
+}
+
+// AdmissionClosed reports whether admission is durably closed and when.
+func (l *Ledger) AdmissionClosed(ctx context.Context) (bool, time.Time, error) {
+	return admissionClosed(ctx, l.db)
+}
+
+// PrepareRollover records the exact generation that may reopen admission after
+// a completed drain. It is idempotent for the same generation. A later rollout
+// may supersede an unactivated preparation because admission is still closed
+// and the no-unsettled-turn invariant is rechecked in the same transaction.
+func (l *Ledger) PrepareRollover(ctx context.Context, nextGeneration string) (string, error) {
+	if err := validateGeneration(nextGeneration); err != nil {
+		return "", err
+	}
+	tx, err := l.db.BeginTx(ctx, nil)
+	if err != nil {
+		return "", fmt.Errorf("begin wrapper ledger rollover preparation: %w", err)
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	current, found, err := controlValue(ctx, tx, "generation")
+	if err != nil || !found {
+		if err == nil {
+			err = errors.New("generation is missing")
+		}
+		return "", fmt.Errorf("read wrapper ledger generation: %w", err)
+	}
+	if current == nextGeneration {
+		return "", fmt.Errorf("next wrapper ledger generation must differ from current generation")
+	}
+	closed, _, err := admissionClosed(ctx, tx)
+	if err != nil {
+		return "", err
+	}
+	if !closed {
+		return "", fmt.Errorf("wrapper admission must be closed before rollover preparation")
+	}
+	unsettled, err := unsettledTurnCount(ctx, tx)
+	if err != nil {
+		return "", err
+	}
+	if unsettled != 0 {
+		return "", fmt.Errorf("wrapper drain is incomplete: %d turn(s) remain unsettled", unsettled)
+	}
+	pending, pendingFound, err := controlValue(ctx, tx, "pending-generation")
+	if err != nil {
+		return "", fmt.Errorf("read pending wrapper ledger generation: %w", err)
+	}
+	if pendingFound {
+		if pending == nextGeneration {
+			if err := tx.Commit(); err != nil {
+				return "", fmt.Errorf("commit idempotent wrapper ledger rollover preparation: %w", err)
+			}
+			return current, nil
+		}
+		if _, err := tx.ExecContext(ctx, `UPDATE ledger_control SET value = ? WHERE key = 'pending-generation'`, nextGeneration); err != nil {
+			return "", fmt.Errorf("supersede wrapper ledger generation preparation: %w", err)
+		}
+	} else if _, err := tx.ExecContext(ctx, `INSERT INTO ledger_control (key, value) VALUES ('pending-generation', ?)`, nextGeneration); err != nil {
+		return "", fmt.Errorf("prepare wrapper ledger generation: %w", err)
+	}
+	if err := tx.Commit(); err != nil {
+		return "", fmt.Errorf("commit wrapper ledger rollover preparation: %w", err)
+	}
+	return current, nil
+}
+
+// AbortRollover atomically discards a prepared replacement and reopens the
+// fully drained current generation. The exact current generation is required
+// so a stale rollback hook can never reopen a different wrapper generation.
+// An already-open matching generation is an idempotent success; a bare close
+// without a prepared rollover remains fail-closed.
+func (l *Ledger) AbortRollover(ctx context.Context, expectedGeneration string) error {
+	if err := validateGeneration(expectedGeneration); err != nil {
+		return err
+	}
+	tx, err := l.db.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("begin wrapper ledger rollover abort: %w", err)
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	current, found, err := controlValue(ctx, tx, "generation")
+	if err != nil || !found {
+		if err == nil {
+			err = errors.New("generation is missing")
+		}
+		return fmt.Errorf("read wrapper ledger generation: %w", err)
+	}
+	if current != expectedGeneration {
+		return fmt.Errorf("wrapper ledger generation %q does not match rollback generation %q", current, expectedGeneration)
+	}
+	pending, pendingFound, err := controlValue(ctx, tx, "pending-generation")
+	if err != nil {
+		return fmt.Errorf("read pending wrapper ledger generation: %w", err)
+	}
+	closed, _, err := admissionClosed(ctx, tx)
+	if err != nil {
+		return err
+	}
+	if !pendingFound {
+		if closed {
+			return fmt.Errorf("wrapper admission is closed without a prepared rollover")
+		}
+		if err := tx.Commit(); err != nil {
+			return fmt.Errorf("commit idempotent wrapper ledger rollover abort: %w", err)
+		}
+		return nil
+	}
+	if err := validateGeneration(pending); err != nil {
+		return fmt.Errorf("pending wrapper ledger generation is invalid: %w", err)
+	}
+	if !closed {
+		return fmt.Errorf("prepared wrapper rollover is missing its admission close")
+	}
+	unsettled, err := unsettledTurnCount(ctx, tx)
+	if err != nil {
+		return err
+	}
+	if unsettled != 0 {
+		return fmt.Errorf("wrapper drain is incomplete: %d turn(s) remain unsettled", unsettled)
+	}
+	if _, err := tx.ExecContext(ctx, `DELETE FROM ledger_control WHERE key IN ('pending-generation', 'admission-closed-at')`); err != nil {
+		return fmt.Errorf("abort wrapper ledger rollover: %w", err)
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("commit wrapper ledger rollover abort: %w", err)
+	}
+	return nil
+}
+
+// ActivateGeneration atomically reopens a fully drained ledger only for the
+// exact generation prepared by the prior wrapper. A deliberate retirement
+// marker may be replaced by the first later enabled generation. Starting the
+// same generation is otherwise permitted but never removes a durable close.
+func (l *Ledger) ActivateGeneration(ctx context.Context, desiredGeneration string) error {
+	if err := validateGeneration(desiredGeneration); err != nil {
+		return err
+	}
+	tx, err := l.db.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("begin wrapper ledger generation activation: %w", err)
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	current, found, err := controlValue(ctx, tx, "generation")
+	if err != nil || !found {
+		if err == nil {
+			err = errors.New("generation is missing")
+		}
+		return fmt.Errorf("read wrapper ledger generation: %w", err)
+	}
+	pending, pendingFound, err := controlValue(ctx, tx, "pending-generation")
+	if err != nil {
+		return fmt.Errorf("read pending wrapper ledger generation: %w", err)
+	}
+	retirementPrepared := pendingFound && isRetiredGeneration(pending)
+	if current == desiredGeneration && !retirementPrepared {
+		return tx.Commit()
+	}
+	if !pendingFound || pending != desiredGeneration && !retirementPrepared {
+		return fmt.Errorf("wrapper ledger generation %q was not prepared", desiredGeneration)
+	}
+	closed, _, err := admissionClosed(ctx, tx)
+	if err != nil {
+		return err
+	}
+	if !closed {
+		return fmt.Errorf("wrapper admission must remain closed until generation activation")
+	}
+	unsettled, err := unsettledTurnCount(ctx, tx)
+	if err != nil {
+		return err
+	}
+	if unsettled != 0 {
+		return fmt.Errorf("wrapper drain is incomplete: %d turn(s) remain unsettled", unsettled)
+	}
+	if _, err := tx.ExecContext(ctx, `UPDATE ledger_control SET value = ? WHERE key = 'generation'`, desiredGeneration); err != nil {
+		return fmt.Errorf("activate wrapper ledger generation: %w", err)
+	}
+	if _, err := tx.ExecContext(ctx, `DELETE FROM ledger_control WHERE key IN ('pending-generation', 'admission-closed-at')`); err != nil {
+		return fmt.Errorf("reopen wrapper admission for activated generation: %w", err)
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("commit wrapper ledger generation activation: %w", err)
+	}
+	return nil
+}
+
+func isRetiredGeneration(value string) bool {
+	digest := strings.TrimPrefix(strings.TrimSpace(value), retiredGenerationPrefix)
+	if digest == value || len(digest) != sha256.Size*2 || digest != strings.ToLower(digest) {
+		return false
+	}
+	_, err := hex.DecodeString(digest)
+	return err == nil
+}
+
+// Generation returns the ledger generation watermark for inventory reports.
+func (l *Ledger) Generation(ctx context.Context) (string, error) {
+	var value string
+	err := l.db.QueryRowContext(ctx, `SELECT value FROM ledger_control WHERE key = 'generation'`).Scan(&value)
+	if err != nil {
+		return "", fmt.Errorf("read ledger generation: %w", err)
+	}
+	return value, nil
+}
+
+func validateGeneration(value string) error {
+	value = strings.TrimSpace(value)
+	if value == "" || len(value) > 128 {
+		return fmt.Errorf("wrapper ledger generation must contain 1 to 128 characters")
+	}
+	for _, char := range value {
+		if (char >= 'a' && char <= 'z') || (char >= 'A' && char <= 'Z') ||
+			(char >= '0' && char <= '9') || strings.ContainsRune("._:-", char) {
+			continue
+		}
+		return fmt.Errorf("wrapper ledger generation contains unsupported characters")
+	}
+	return nil
+}
+
+func controlValue(ctx context.Context, q queryRower, key string) (string, bool, error) {
+	var value string
+	err := q.QueryRowContext(ctx, `SELECT value FROM ledger_control WHERE key = ?`, key).Scan(&value)
+	if errors.Is(err, sql.ErrNoRows) {
+		return "", false, nil
+	}
+	if err != nil {
+		return "", false, err
+	}
+	return value, true, nil
+}
+
+func unsettledTurnCount(ctx context.Context, q queryRower) (int, error) {
+	var count int
+	if err := q.QueryRowContext(ctx, `SELECT COUNT(*) FROM turn_admissions WHERE state IN ('Admitted','Accepted')`).Scan(&count); err != nil {
+		return 0, fmt.Errorf("count unsettled wrapper turns: %w", err)
+	}
+	return count, nil
+}
+
+type queryRower interface {
+	QueryRowContext(ctx context.Context, query string, args ...any) *sql.Row
+}
+
+func admissionClosed(ctx context.Context, q queryRower) (bool, time.Time, error) {
+	var value string
+	err := q.QueryRowContext(ctx, `SELECT value FROM ledger_control WHERE key = 'admission-closed-at'`).Scan(&value)
+	if errors.Is(err, sql.ErrNoRows) {
+		return false, time.Time{}, nil
+	}
+	if err != nil {
+		return false, time.Time{}, fmt.Errorf("read admission close marker: %w", err)
+	}
+	closedAt, err := time.Parse(time.RFC3339Nano, value)
+	if err != nil {
+		return true, time.Time{}, nil //nolint:nilerr // A malformed marker still proves closure.
+	}
+	return true, closedAt, nil
+}
+
+const turnSelectSQL = `SELECT turn_id, task_uid, attempt, request_digest,
+	runtime_session_id, correlation_id, state,
+	reject_reason, terminal_receipt, terminal_receipt_digest, created_at, updated_at, settled_at
+	FROM turn_admissions`
+
+type rowScanner interface {
+	Scan(dest ...any) error
+}
+
+func scanTurn(row rowScanner) (*TurnRecord, error) {
+	var (
+		record    TurnRecord
+		state     string
+		settledAt sql.NullTime
+	)
+	if err := row.Scan(&record.TurnID, &record.TaskUID, &record.Attempt, &record.RequestDigest,
+		&record.RuntimeSessionID, &record.CorrelationID, &state,
+		&record.RejectReason, &record.TerminalReceipt, &record.TerminalReceiptDigest,
+		&record.CreatedAt, &record.UpdatedAt, &settledAt); err != nil {
+		return nil, err
+	}
+	record.State = TurnState(state)
+	record.CreatedAt = record.CreatedAt.UTC()
+	record.UpdatedAt = record.UpdatedAt.UTC()
+	if settledAt.Valid {
+		value := settledAt.Time.UTC()
+		record.SettledAt = &value
+	}
+	if err := validateTurnRecordIntegrity(record); err != nil {
+		return nil, err
+	}
+	return &record, nil
+}
+
+func validateTurnRecordIntegrity(record TurnRecord) error {
+	switch record.State {
+	case TurnTerminal, TurnOutcomeUnknown:
+		if len(record.TerminalReceipt) == 0 || strings.TrimSpace(record.TerminalReceiptDigest) == "" {
+			return fmt.Errorf("corrupt terminal turn record: receipt and digest are required")
+		}
+		if ReceiptDigest(record.TerminalReceipt) != record.TerminalReceiptDigest {
+			return fmt.Errorf("corrupt terminal turn record: receipt digest mismatch")
+		}
+	case TurnAdmitted, TurnAccepted, TurnRejected:
+		if len(record.TerminalReceipt) != 0 || record.TerminalReceiptDigest != "" {
+			return fmt.Errorf("corrupt nonterminal turn record: unexpected terminal receipt")
+		}
+	default:
+		return fmt.Errorf("corrupt turn record: unsupported state %q", record.State)
+	}
+	return nil
+}
diff --git a/internal/harness/ledger/ledger_test.go b/internal/harness/ledger/ledger_test.go
new file mode 100644
index 000000000..67f26121c
--- /dev/null
+++ b/internal/harness/ledger/ledger_test.go
@@ -0,0 +1,696 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package ledger
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+const (
+	testRuntimeSessionID = "runtime-session-1"
+	testCorrelationID    = "correlation-1"
+)
+
+func openTestLedger(t *testing.T) (*Ledger, string) {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "ledger.db")
+	l, err := Open(path)
+	if err != nil {
+		t.Fatalf("Open: %v", err)
+	}
+	t.Cleanup(func() { _ = l.Close() })
+	return l, path
+}
+
+func TestLedgerAdmissionIdempotencyAndDigestMismatch(t *testing.T) {
+	ctx := context.Background()
+	l, _ := openTestLedger(t)
+
+	outcome, record, err := l.AdmitTurn(ctx, "turn-1", "task-uid", 1, "sha256:aaaa", testRuntimeSessionID, testCorrelationID)
+	if err != nil || outcome != AdmitOutcomeAdmitted || record.State != TurnAdmitted {
+		t.Fatalf("admit = %v %+v %v", outcome, record, err)
+	}
+
+	// The same turn ID and digest replays idempotently.
+	outcome, record, err = l.AdmitTurn(ctx, "turn-1", "task-uid", 1, "sha256:aaaa", testRuntimeSessionID, testCorrelationID)
+	if err != nil || outcome != AdmitOutcomeDuplicate || record.State != TurnAdmitted {
+		t.Fatalf("duplicate admit = %v %+v %v", outcome, record, err)
+	}
+
+	// The same turn ID with a different digest is permanently rejected.
+	if _, _, err := l.AdmitTurn(ctx, "turn-1", "task-uid", 1, "sha256:bbbb", testRuntimeSessionID, testCorrelationID); !errors.Is(err, ErrDigestMismatch) {
+		t.Fatalf("expected ErrDigestMismatch, got %v", err)
+	}
+}
+
+func TestLedgerRejectionIsDurableNonAcceptanceProof(t *testing.T) {
+	ctx := context.Background()
+	l, _ := openTestLedger(t)
+	if _, _, err := l.AdmitTurn(ctx, "turn-1", "task-uid", 1, "sha256:aaaa", testRuntimeSessionID, testCorrelationID); err != nil {
+		t.Fatalf("admit: %v", err)
+	}
+	if err := l.MarkTurnRejected(ctx, "turn-1", "endpoint refused"); err != nil {
+		t.Fatalf("reject: %v", err)
+	}
+	record, err := l.GetTurn(ctx, "turn-1")
+	if err != nil || record.State != TurnRejected || !record.Settled() {
+		t.Fatalf("rejected record = %+v, %v", record, err)
+	}
+	// A rejected turn can no longer be accepted.
+	if err := l.MarkTurnAccepted(ctx, "turn-1"); err == nil {
+		t.Fatal("accepting a rejected turn must fail")
+	}
+}
+
+func TestLedgerTerminalReceiptsSurviveRestart(t *testing.T) {
+	ctx := context.Background()
+	l, path := openTestLedger(t)
+	if _, _, err := l.AdmitTurn(ctx, "turn-1", "task-uid", 1, "sha256:aaaa", testRuntimeSessionID, testCorrelationID); err != nil {
+		t.Fatalf("admit: %v", err)
+	}
+	if err := l.MarkTurnAccepted(ctx, "turn-1"); err != nil {
+		t.Fatalf("accept: %v", err)
+	}
+	receipt := []byte(`{"outcome":"succeeded"}`)
+	if err := l.RecordTurnTerminal(ctx, "turn-1", receipt, false); err != nil {
+		t.Fatalf("terminal: %v", err)
+	}
+	// Identical replay is idempotent; a different receipt conflicts.
+	if err := l.RecordTurnTerminal(ctx, "turn-1", receipt, false); err != nil {
+		t.Fatalf("terminal replay: %v", err)
+	}
+	if err := l.RecordTurnTerminal(ctx, "turn-1", []byte(`{"outcome":"failed"}`), false); err == nil {
+		t.Fatal("conflicting terminal receipt must fail")
+	}
+	if err := l.Close(); err != nil {
+		t.Fatalf("close: %v", err)
+	}
+
+	reopened, err := Open(path)
+	if err != nil {
+		t.Fatalf("reopen: %v", err)
+	}
+	t.Cleanup(func() { _ = reopened.Close() })
+	record, err := reopened.GetTurn(ctx, "turn-1")
+	if err != nil || record.State != TurnTerminal || record.TerminalReceiptDigest != ReceiptDigest(receipt) {
+		t.Fatalf("terminal record after restart = %+v, %v", record, err)
+	}
+	if string(record.TerminalReceipt) != string(receipt) {
+		t.Fatalf("terminal receipt payload mismatch: %s", record.TerminalReceipt)
+	}
+}
+
+func TestLedgerRejectsCorruptTerminalReceiptAtReadBoundary(t *testing.T) {
+	ctx := context.Background()
+	l, _ := openTestLedger(t)
+	if _, _, err := l.AdmitTurn(ctx, "turn-1", "task-uid", 1, "sha256:aaaa", testRuntimeSessionID, testCorrelationID); err != nil {
+		t.Fatalf("admit: %v", err)
+	}
+	if err := l.MarkTurnAccepted(ctx, "turn-1"); err != nil {
+		t.Fatalf("accept: %v", err)
+	}
+	if err := l.RecordTurnTerminal(ctx, "turn-1", []byte(`{"outcome":"succeeded"}`), false); err != nil {
+		t.Fatalf("terminal: %v", err)
+	}
+	if _, err := l.db.ExecContext(ctx, `UPDATE turn_admissions SET terminal_receipt = ? WHERE turn_id = ?`,
+		[]byte(`{"outcome":"corrupt"}`), "turn-1"); err != nil {
+		t.Fatalf("corrupt receipt fixture: %v", err)
+	}
+
+	if _, err := l.GetTurn(ctx, "turn-1"); err == nil || !strings.Contains(err.Error(), "receipt digest mismatch") {
+		t.Fatalf("GetTurn() error = %v, want receipt digest mismatch", err)
+	}
+}
+
+func TestLedgerOutcomeUnknownAndUnsettledInventory(t *testing.T) {
+	ctx := context.Background()
+	l, _ := openTestLedger(t)
+	for _, turn := range []string{"turn-1", "turn-2", "turn-3"} {
+		if _, _, err := l.AdmitTurn(ctx, turn, "task-uid", 1, "sha256:aaaa", testRuntimeSessionID, testCorrelationID); err != nil {
+			t.Fatalf("admit %s: %v", turn, err)
+		}
+	}
+	if err := l.MarkTurnAccepted(ctx, "turn-2"); err != nil {
+		t.Fatalf("accept: %v", err)
+	}
+	if err := l.RecordTurnTerminal(ctx, "turn-3", []byte(`{"reason":"abandoned"}`), true); err != nil {
+		t.Fatalf("outcome unknown: %v", err)
+	}
+	record, err := l.GetTurn(ctx, "turn-3")
+	if err != nil || record.State != TurnOutcomeUnknown || !record.Settled() {
+		t.Fatalf("outcome-unknown record = %+v, %v", record, err)
+	}
+
+	unsettled, err := l.ListUnsettledTurns(ctx)
+	if err != nil || len(unsettled) != 2 {
+		t.Fatalf("unsettled = %+v, %v", unsettled, err)
+	}
+}
+
+func TestLedgerAdmissionCloseIsDurableAndFailClosed(t *testing.T) {
+	ctx := context.Background()
+	l, path := openTestLedger(t)
+	if _, _, err := l.AdmitTurn(ctx, "turn-1", "task-uid", 1, "sha256:aaaa", testRuntimeSessionID, testCorrelationID); err != nil {
+		t.Fatalf("admit: %v", err)
+	}
+	if err := l.CloseAdmission(ctx); err != nil {
+		t.Fatalf("close admission: %v", err)
+	}
+	if err := l.CloseAdmission(ctx); err != nil {
+		t.Fatalf("idempotent close admission: %v", err)
+	}
+	closed, closedAt, err := l.AdmissionClosed(ctx)
+	if err != nil || !closed || closedAt.IsZero() {
+		t.Fatalf("admission closed = %v %v %v", closed, closedAt, err)
+	}
+
+	// New admissions fail closed; existing turns still settle.
+	if _, _, err := l.AdmitTurn(ctx, "turn-2", "task-uid", 1, "sha256:cccc", testRuntimeSessionID, "correlation-2"); !errors.Is(err, ErrAdmissionClosed) {
+		t.Fatalf("expected ErrAdmissionClosed, got %v", err)
+	}
+	// A pre-close duplicate admission still replays idempotently.
+	if outcome, _, err := l.AdmitTurn(ctx, "turn-1", "task-uid", 1, "sha256:aaaa", testRuntimeSessionID, testCorrelationID); err != nil || outcome != AdmitOutcomeDuplicate {
+		t.Fatalf("duplicate after close = %v, %v", outcome, err)
+	}
+	if err := l.MarkTurnAccepted(ctx, "turn-1"); err != nil {
+		t.Fatalf("accept after close: %v", err)
+	}
+	if err := l.Close(); err != nil {
+		t.Fatalf("close ledger: %v", err)
+	}
+
+	reopened, err := Open(path)
+	if err != nil {
+		t.Fatalf("reopen: %v", err)
+	}
+	t.Cleanup(func() { _ = reopened.Close() })
+	closed, _, err = reopened.AdmissionClosed(ctx)
+	if err != nil || !closed {
+		t.Fatalf("admission close must survive restart, got %v %v", closed, err)
+	}
+	generation, err := reopened.Generation(ctx)
+	if err != nil || generation == "" {
+		t.Fatalf("generation = %q, %v", generation, err)
+	}
+}
+
+func TestLedgerTerminalOutputSurvivesRestartAndFailsClosedOnCorruption(t *testing.T) {
+	ctx := context.Background()
+	l, path := openTestLedger(t)
+	if _, _, err := l.AdmitTurn(
+		ctx, "turn-output", "task-uid", 1, "sha256:aaaa", testRuntimeSessionID, testCorrelationID,
+	); err != nil {
+		t.Fatalf("admit: %v", err)
+	}
+	if err := l.MarkTurnAccepted(ctx, "turn-output"); err != nil {
+		t.Fatalf("accept: %v", err)
+	}
+	receipt := []byte(`{"outcome":"succeeded","outputRef":"cliwrapper-result-v1"}`)
+	want := []byte("durable result bytes")
+	if err := l.RecordTurnTerminalWithOutput(ctx, "turn-output", receipt, false, &TurnOutput{
+		Ref: "cliwrapper-result-v1", Data: want,
+	}); err != nil {
+		t.Fatalf("terminal with output: %v", err)
+	}
+	if err := l.Close(); err != nil {
+		t.Fatalf("close: %v", err)
+	}
+
+	reopened, err := Open(path)
+	if err != nil {
+		t.Fatalf("reopen: %v", err)
+	}
+	t.Cleanup(func() { _ = reopened.Close() })
+	got, err := reopened.GetTurnOutput(ctx, "turn-output", "cliwrapper-result-v1")
+	if err != nil || string(got) != string(want) {
+		t.Fatalf("GetTurnOutput() = %q, %v, want %q", got, err, want)
+	}
+	if _, err := reopened.GetTurnOutput(ctx, "turn-output", "wrong-ref"); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("wrong-ref GetTurnOutput() error = %v, want ErrNotFound", err)
+	}
+	if _, err := reopened.db.ExecContext(ctx, `UPDATE turn_outputs SET output_payload = ? WHERE turn_id = ?`,
+		[]byte("corrupt"), "turn-output"); err != nil {
+		t.Fatalf("corrupt output fixture: %v", err)
+	}
+	if _, err := reopened.GetTurnOutput(ctx, "turn-output", "cliwrapper-result-v1"); err == nil ||
+		!strings.Contains(err.Error(), "corrupt terminal turn output") {
+		t.Fatalf("corrupt GetTurnOutput() error = %v", err)
+	}
+}
+
+func TestLedgerTerminalOutputAcknowledgementReclaimsPayloadAndIsIdempotent(t *testing.T) {
+	ctx := context.Background()
+	l, path := openTestLedger(t)
+	if _, _, err := l.AdmitTurn(
+		ctx, "turn-ack", "task-uid", 1, "sha256:aaaa", testRuntimeSessionID, testCorrelationID,
+	); err != nil {
+		t.Fatalf("admit: %v", err)
+	}
+	if err := l.MarkTurnAccepted(ctx, "turn-ack"); err != nil {
+		t.Fatalf("accept: %v", err)
+	}
+	receipt := []byte(`{"outcome":"succeeded","outputRef":"cliwrapper-result-v1"}`)
+	receiptDigest := ReceiptDigest(receipt)
+	output := &TurnOutput{Ref: "cliwrapper-result-v1", Data: []byte("durable result bytes")}
+	if err := l.RecordTurnTerminalWithOutput(ctx, "turn-ack", receipt, false, output); err != nil {
+		t.Fatalf("terminal with output: %v", err)
+	}
+	if err := l.AcknowledgeTurnOutput(
+		ctx, "turn-ack", output.Ref, ReceiptDigest([]byte("different receipt")),
+	); !errors.Is(err, ErrOutputAcknowledgementMismatch) {
+		t.Fatalf("wrong digest acknowledgement error = %v, want mismatch", err)
+	}
+	if err := l.AcknowledgeTurnOutput(
+		ctx, "turn-ack", "wrong-ref", receiptDigest,
+	); !errors.Is(err, ErrOutputAcknowledgementMismatch) {
+		t.Fatalf("wrong ref acknowledgement error = %v, want mismatch", err)
+	}
+	if err := l.AcknowledgeTurnOutput(ctx, "turn-ack", output.Ref, receiptDigest); err != nil {
+		t.Fatalf("acknowledge output: %v", err)
+	}
+	if _, err := l.GetTurnOutput(ctx, "turn-ack", output.Ref); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("GetTurnOutput(after acknowledgement) error = %v, want ErrNotFound", err)
+	}
+	var outputRows, acknowledgementRows int
+	if err := l.db.QueryRowContext(ctx, `SELECT COUNT(*) FROM turn_outputs WHERE turn_id = ?`, "turn-ack").Scan(
+		&outputRows,
+	); err != nil {
+		t.Fatalf("count output rows: %v", err)
+	}
+	if err := l.db.QueryRowContext(
+		ctx, `SELECT COUNT(*) FROM turn_output_acknowledgements WHERE turn_id = ?`, "turn-ack",
+	).Scan(&acknowledgementRows); err != nil {
+		t.Fatalf("count acknowledgement rows: %v", err)
+	}
+	if outputRows != 0 || acknowledgementRows != 1 {
+		t.Fatalf("output rows = %d, acknowledgement rows = %d, want 0/1", outputRows, acknowledgementRows)
+	}
+	if err := l.Close(); err != nil {
+		t.Fatalf("close: %v", err)
+	}
+
+	reopened, err := Open(path)
+	if err != nil {
+		t.Fatalf("reopen: %v", err)
+	}
+	t.Cleanup(func() { _ = reopened.Close() })
+	if err := reopened.AcknowledgeTurnOutput(ctx, "turn-ack", output.Ref, receiptDigest); err != nil {
+		t.Fatalf("idempotent acknowledgement after restart: %v", err)
+	}
+	if err := reopened.RecordTurnTerminalWithOutput(ctx, "turn-ack", receipt, false, output); err != nil {
+		t.Fatalf("idempotent terminal replay after acknowledgement: %v", err)
+	}
+	if _, err := reopened.GetTurnOutput(ctx, "turn-ack", output.Ref); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("GetTurnOutput(after replay) error = %v, want ErrNotFound", err)
+	}
+}
+
+func TestLedgerSettlementAcknowledgementFencesAndReclaimsAfterRetention(t *testing.T) {
+	ctx := context.Background()
+	l, _ := openTestLedger(t)
+	requestDigest := "sha256:" + strings.Repeat("a", 64)
+	if _, _, err := l.AdmitTurn(
+		ctx, "turn-settled", "task-uid", 1, requestDigest, testRuntimeSessionID, testCorrelationID,
+	); err != nil {
+		t.Fatalf("admit terminal turn: %v", err)
+	}
+	if err := l.MarkTurnAccepted(ctx, "turn-settled"); err != nil {
+		t.Fatalf("accept terminal turn: %v", err)
+	}
+	receipt := []byte(`{"outcome":"succeeded","outputRef":"cliwrapper-result-v1"}`)
+	receiptDigest := ReceiptDigest(receipt)
+	output := &TurnOutput{Ref: "cliwrapper-result-v1", Data: []byte("durable result")}
+	if err := l.RecordTurnTerminalWithOutput(ctx, "turn-settled", receipt, false, output); err != nil {
+		t.Fatalf("record terminal turn: %v", err)
+	}
+	if err := l.AcknowledgeTurnSettlement(
+		ctx, "turn-settled", requestDigest, receiptDigest,
+	); !errors.Is(err, ErrSettlementAcknowledgementMismatch) {
+		t.Fatalf("settlement before output acknowledgement error = %v, want mismatch", err)
+	}
+	if err := l.AcknowledgeTurnOutput(ctx, "turn-settled", output.Ref, receiptDigest); err != nil {
+		t.Fatalf("acknowledge terminal output: %v", err)
+	}
+	if err := l.AcknowledgeTurnSettlement(
+		ctx, "turn-settled", "sha256:"+strings.Repeat("b", 64), receiptDigest,
+	); !errors.Is(err, ErrSettlementAcknowledgementMismatch) {
+		t.Fatalf("wrong request digest error = %v, want mismatch", err)
+	}
+	if err := l.AcknowledgeTurnSettlement(
+		ctx, "turn-settled", requestDigest, "sha256:"+strings.Repeat("c", 64),
+	); !errors.Is(err, ErrSettlementAcknowledgementMismatch) {
+		t.Fatalf("wrong receipt digest error = %v, want mismatch", err)
+	}
+	if err := l.AcknowledgeTurnSettlement(ctx, "turn-settled", requestDigest, receiptDigest); err != nil {
+		t.Fatalf("acknowledge settlement: %v", err)
+	}
+	if err := l.AcknowledgeTurnSettlement(ctx, "turn-settled", requestDigest, receiptDigest); err != nil {
+		t.Fatalf("idempotent settlement acknowledgement: %v", err)
+	}
+
+	if _, _, err := l.AdmitTurn(
+		ctx, "turn-unsettled", "task-uid", 2, requestDigest, "runtime-session-2", "correlation-2",
+	); err != nil {
+		t.Fatalf("admit unsettled turn: %v", err)
+	}
+	if reclaimed, err := l.ReclaimSettledTurnsBefore(ctx, time.Now().UTC().Add(-time.Hour), 10); err != nil || reclaimed != 0 {
+		t.Fatalf("reclaim before retention = %d, %v, want 0", reclaimed, err)
+	}
+	if _, err := l.db.ExecContext(ctx, `UPDATE turn_admissions SET settled_at = ? WHERE turn_id = ?`,
+		time.Now().UTC().Add(-2*time.Hour), "turn-settled"); err != nil {
+		t.Fatalf("age settled turn fixture: %v", err)
+	}
+	if reclaimed, err := l.ReclaimSettledTurnsBefore(ctx, time.Now().UTC().Add(-time.Hour), 10); err != nil || reclaimed != 1 {
+		t.Fatalf("reclaim after retention = %d, %v, want 1", reclaimed, err)
+	}
+	if _, err := l.GetTurn(ctx, "turn-settled"); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("GetTurn(reclaimed) error = %v, want ErrNotFound", err)
+	}
+	if _, err := l.GetTurn(ctx, "turn-unsettled"); err != nil {
+		t.Fatalf("unsettled turn was reclaimed: %v", err)
+	}
+	var acknowledgementRows int
+	if err := l.db.QueryRowContext(ctx, `SELECT COUNT(*) FROM turn_output_acknowledgements WHERE turn_id = ?`,
+		"turn-settled").Scan(&acknowledgementRows); err != nil {
+		t.Fatalf("count reclaimed acknowledgement rows: %v", err)
+	}
+	if acknowledgementRows != 0 {
+		t.Fatalf("acknowledgement rows after parent reclamation = %d, want 0", acknowledgementRows)
+	}
+}
+
+func TestLedgerRejectedSettlementRequiresEmptyReceiptDigest(t *testing.T) {
+	ctx := context.Background()
+	l, _ := openTestLedger(t)
+	requestDigest := "sha256:" + strings.Repeat("d", 64)
+	if _, _, err := l.AdmitTurn(
+		ctx, "turn-rejected", "task-uid", 1, requestDigest, testRuntimeSessionID, testCorrelationID,
+	); err != nil {
+		t.Fatalf("admit rejected turn: %v", err)
+	}
+	if err := l.MarkTurnRejected(ctx, "turn-rejected", "not accepted"); err != nil {
+		t.Fatalf("reject turn: %v", err)
+	}
+	if err := l.AcknowledgeTurnSettlement(
+		ctx, "turn-rejected", requestDigest, "sha256:"+strings.Repeat("e", 64),
+	); !errors.Is(err, ErrSettlementAcknowledgementMismatch) {
+		t.Fatalf("rejected settlement with receipt error = %v, want mismatch", err)
+	}
+	if err := l.AcknowledgeTurnSettlement(ctx, "turn-rejected", requestDigest, ""); err != nil {
+		t.Fatalf("acknowledge rejected settlement: %v", err)
+	}
+}
+
+func TestLedgerOpenRestrictsDirectoryDatabaseAndSidecarPermissions(t *testing.T) {
+	parent := filepath.Join(t.TempDir(), "ledger-private")
+	if err := os.Mkdir(parent, 0o755); err != nil {
+		t.Fatalf("create permissive ledger directory: %v", err)
+	}
+	path := filepath.Join(parent, "ledger.db")
+	if err := os.WriteFile(path, nil, 0o666); err != nil {
+		t.Fatalf("create permissive ledger file: %v", err)
+	}
+	if err := os.Chmod(path, 0o666); err != nil {
+		t.Fatalf("make ledger file permissive: %v", err)
+	}
+	l, err := Open(path)
+	if err != nil {
+		t.Fatalf("Open: %v", err)
+	}
+	defer func() { _ = l.Close() }()
+	if _, _, err := l.AdmitTurn(
+		context.Background(), "turn-permissions", "task-uid", 1,
+		"sha256:"+strings.Repeat("f", 64), testRuntimeSessionID, testCorrelationID,
+	); err != nil {
+		t.Fatalf("write ledger to create sidecars: %v", err)
+	}
+	for candidate, wantMode := range map[string]os.FileMode{
+		parent:        0o700,
+		path:          0o600,
+		path + "-wal": 0o600,
+		path + "-shm": 0o600,
+	} {
+		info, err := os.Lstat(candidate)
+		if err != nil {
+			t.Fatalf("stat secured ledger path %s: %v", candidate, err)
+		}
+		if info.Mode()&os.ModeSymlink != 0 || info.Mode().Perm() != wantMode {
+			t.Fatalf("ledger path %s mode = %v, want %04o and no symlink", candidate, info.Mode(), wantMode)
+		}
+	}
+}
+
+func TestLedgerOpenRejectsSymlinkDatabase(t *testing.T) {
+	root := t.TempDir()
+	target := filepath.Join(root, "target.db")
+	if err := os.WriteFile(target, nil, 0o600); err != nil {
+		t.Fatalf("create ledger symlink target: %v", err)
+	}
+	path := filepath.Join(root, "ledger.db")
+	if err := os.Symlink(target, path); err != nil {
+		t.Skipf("symlink unavailable: %v", err)
+	}
+	if _, err := Open(path); err == nil || !strings.Contains(err.Error(), "regular file") {
+		t.Fatalf("Open(symlink) error = %v, want regular-file rejection", err)
+	}
+}
+
+//nolint:gocyclo // One test keeps the full close, drain, prepare, restart, and activation protocol in order.
+func TestLedgerRolloverRequiresCompletedDrainAndExactGeneration(t *testing.T) {
+	ctx := context.Background()
+	l, path := openTestLedger(t)
+	if _, err := l.PrepareRollover(ctx, "2"); err == nil || !strings.Contains(err.Error(), "must be closed") {
+		t.Fatalf("PrepareRollover(open) error = %v, want closed-admission rejection", err)
+	}
+	if _, _, err := l.AdmitTurn(
+		ctx, "turn-rollover", "task-uid", 1, "sha256:aaaa", testRuntimeSessionID, testCorrelationID,
+	); err != nil {
+		t.Fatalf("admit: %v", err)
+	}
+	if err := l.MarkTurnAccepted(ctx, "turn-rollover"); err != nil {
+		t.Fatalf("accept: %v", err)
+	}
+	if err := l.CloseAdmission(ctx); err != nil {
+		t.Fatalf("close admission: %v", err)
+	}
+	if _, err := l.PrepareRollover(ctx, "2"); err == nil || !strings.Contains(err.Error(), "drain is incomplete") {
+		t.Fatalf("PrepareRollover(unsettled) error = %v, want incomplete-drain rejection", err)
+	}
+	receipt := []byte(`{"outcome":"succeeded"}`)
+	if err := l.RecordTurnTerminal(ctx, "turn-rollover", receipt, false); err != nil {
+		t.Fatalf("terminal: %v", err)
+	}
+	current, err := l.PrepareRollover(ctx, "2")
+	if err != nil || current != "1" {
+		t.Fatalf("PrepareRollover() = %q, %v, want current generation 1", current, err)
+	}
+	if current, err := l.PrepareRollover(ctx, "2"); err != nil || current != "1" {
+		t.Fatalf("PrepareRollover(idempotent) = %q, %v", current, err)
+	}
+	if current, err := l.PrepareRollover(ctx, "3"); err != nil || current != "1" {
+		t.Fatalf("PrepareRollover(superseding) = %q, %v, want current generation 1", current, err)
+	}
+	if err := l.ActivateGeneration(ctx, "2"); err == nil || !strings.Contains(err.Error(), "was not prepared") {
+		t.Fatalf("ActivateGeneration(superseded) error = %v", err)
+	}
+	if err := l.ActivateGeneration(ctx, "1"); err != nil {
+		t.Fatalf("ActivateGeneration(same generation): %v", err)
+	}
+	if closed, _, err := l.AdmissionClosed(ctx); err != nil || !closed {
+		t.Fatalf("same-generation activation reopened admission: closed=%v err=%v", closed, err)
+	}
+	if err := l.Close(); err != nil {
+		t.Fatalf("close: %v", err)
+	}
+
+	reopened, err := Open(path)
+	if err != nil {
+		t.Fatalf("reopen: %v", err)
+	}
+	t.Cleanup(func() { _ = reopened.Close() })
+	if err := reopened.ActivateGeneration(ctx, "3"); err != nil {
+		t.Fatalf("ActivateGeneration(prepared): %v", err)
+	}
+	if generation, err := reopened.Generation(ctx); err != nil || generation != "3" {
+		t.Fatalf("Generation() = %q, %v, want 3", generation, err)
+	}
+	if closed, _, err := reopened.AdmissionClosed(ctx); err != nil || closed {
+		t.Fatalf("activated generation admission closed=%v, err=%v, want open", closed, err)
+	}
+	if err := reopened.ActivateGeneration(ctx, "3"); err != nil {
+		t.Fatalf("ActivateGeneration(idempotent): %v", err)
+	}
+	record, err := reopened.GetTurn(ctx, "turn-rollover")
+	if err != nil || record.State != TurnTerminal || string(record.TerminalReceipt) != string(receipt) {
+		t.Fatalf("terminal tombstone after rollover = %#v, %v", record, err)
+	}
+}
+
+func TestLedgerAbortRolloverReopensOnlyExactCurrentGeneration(t *testing.T) {
+	ctx := context.Background()
+	l, _ := openTestLedger(t)
+	if err := l.CloseAdmission(ctx); err != nil {
+		t.Fatalf("CloseAdmission: %v", err)
+	}
+	if _, err := l.PrepareRollover(ctx, "2"); err != nil {
+		t.Fatalf("PrepareRollover: %v", err)
+	}
+	if err := l.AbortRollover(ctx, "2"); err == nil || !strings.Contains(err.Error(), "does not match") {
+		t.Fatalf("AbortRollover(stale generation) error = %v, want exact-generation rejection", err)
+	}
+	if closed, _, err := l.AdmissionClosed(ctx); err != nil || !closed {
+		t.Fatalf("stale abort changed admission: closed=%v err=%v", closed, err)
+	}
+	if err := l.AbortRollover(ctx, "1"); err != nil {
+		t.Fatalf("AbortRollover: %v", err)
+	}
+	if closed, _, err := l.AdmissionClosed(ctx); err != nil || closed {
+		t.Fatalf("aborted rollover admission closed=%v err=%v, want open", closed, err)
+	}
+	if err := l.ActivateGeneration(ctx, "2"); err == nil || !strings.Contains(err.Error(), "was not prepared") {
+		t.Fatalf("ActivateGeneration(aborted) error = %v, want missing preparation", err)
+	}
+	if err := l.AbortRollover(ctx, "1"); err != nil {
+		t.Fatalf("AbortRollover(idempotent): %v", err)
+	}
+
+	if err := l.CloseAdmission(ctx); err != nil {
+		t.Fatalf("CloseAdmission(without prepare): %v", err)
+	}
+	if err := l.AbortRollover(ctx, "1"); err == nil || !strings.Contains(err.Error(), "without a prepared rollover") {
+		t.Fatalf("AbortRollover(bare close) error = %v, want fail-closed rejection", err)
+	}
+	if closed, _, err := l.AdmissionClosed(ctx); err != nil || !closed {
+		t.Fatalf("bare-close abort changed admission: closed=%v err=%v", closed, err)
+	}
+}
+
+func TestLedgerRetirementMarkerAllowsLaterReactivation(t *testing.T) {
+	ctx := context.Background()
+	l, _ := openTestLedger(t)
+	retired := retiredGenerationPrefix + strings.Repeat("a", 64)
+	if err := l.CloseAdmission(ctx); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := l.PrepareRollover(ctx, retired); err != nil {
+		t.Fatalf("prepare retirement: %v", err)
+	}
+	if err := l.ActivateGeneration(ctx, "1"); err != nil {
+		t.Fatalf("reactivate same enabled generation after retirement: %v", err)
+	}
+	if closed, _, err := l.AdmissionClosed(ctx); err != nil || closed {
+		t.Fatalf("same-generation reactivation closed=%v err=%v, want open", closed, err)
+	}
+
+	if err := l.CloseAdmission(ctx); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := l.PrepareRollover(ctx, retired); err != nil {
+		t.Fatalf("prepare second retirement: %v", err)
+	}
+	if err := l.ActivateGeneration(ctx, "2"); err != nil {
+		t.Fatalf("activate changed generation after retirement: %v", err)
+	}
+	if generation, err := l.Generation(ctx); err != nil || generation != "2" {
+		t.Fatalf("generation after retirement reactivation = %q, %v, want 2", generation, err)
+	}
+}
+
+func TestLedgerFreshGenerationInitializationDoesNotOverrideExistingLedger(t *testing.T) {
+	ctx := context.Background()
+	path := filepath.Join(t.TempDir(), "generation.db")
+	l, err := OpenWithGeneration(path, "17")
+	if err != nil {
+		t.Fatalf("OpenWithGeneration(fresh): %v", err)
+	}
+	if generation, err := l.Generation(ctx); err != nil || generation != "17" {
+		t.Fatalf("fresh Generation() = %q, %v, want 17", generation, err)
+	}
+	if err := l.Close(); err != nil {
+		t.Fatalf("close: %v", err)
+	}
+
+	reopened, err := OpenWithGeneration(path, "18")
+	if err != nil {
+		t.Fatalf("OpenWithGeneration(existing): %v", err)
+	}
+	t.Cleanup(func() { _ = reopened.Close() })
+	if generation, err := reopened.Generation(ctx); err != nil || generation != "17" {
+		t.Fatalf("existing Generation() = %q, %v, want preserved 17", generation, err)
+	}
+	if err := reopened.ActivateGeneration(ctx, "18"); err == nil || !strings.Contains(err.Error(), "was not prepared") {
+		t.Fatalf("ActivateGeneration(unprepared existing ledger) error = %v", err)
+	}
+}
+
+func TestLedgerMigratesPreviewSchemaWithoutLosingExistingRecords(t *testing.T) {
+	ctx := context.Background()
+	path := filepath.Join(t.TempDir(), "preview.db")
+	db, err := sql.Open("sqlite", path)
+	if err != nil {
+		t.Fatalf("open preview fixture: %v", err)
+	}
+	for _, statement := range []string{
+		`CREATE TABLE ledger_control (key TEXT PRIMARY KEY, value TEXT NOT NULL)`,
+		`CREATE TABLE turn_admissions (
+			turn_id TEXT PRIMARY KEY,
+			task_uid TEXT NOT NULL,
+			attempt INTEGER NOT NULL CHECK(attempt > 0),
+			request_digest TEXT NOT NULL,
+			state TEXT NOT NULL CHECK(state IN ('Admitted','Accepted','Rejected','Terminal','OutcomeUnknown')),
+			reject_reason TEXT NOT NULL DEFAULT '',
+			terminal_receipt BLOB,
+			terminal_receipt_digest TEXT NOT NULL DEFAULT '',
+			created_at TIMESTAMP NOT NULL,
+			updated_at TIMESTAMP NOT NULL
+		)`,
+		`INSERT INTO ledger_control (key, value) VALUES ('generation', 'preview-7')`,
+		`INSERT INTO turn_admissions (
+			turn_id, task_uid, attempt, request_digest, state, reject_reason,
+			terminal_receipt, terminal_receipt_digest, created_at, updated_at
+		) VALUES (
+			'turn-preview', 'task-preview', 1, 'sha256:preview', 'Rejected',
+			'preview rejection', NULL, '', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP
+		)`,
+	} {
+		if _, err := db.ExecContext(ctx, statement); err != nil {
+			_ = db.Close()
+			t.Fatalf("create preview fixture: %v", err)
+		}
+	}
+	if err := db.Close(); err != nil {
+		t.Fatalf("close preview fixture: %v", err)
+	}
+
+	l, err := OpenWithGeneration(path, "replacement-8")
+	if err != nil {
+		t.Fatalf("migrate preview ledger: %v", err)
+	}
+	t.Cleanup(func() { _ = l.Close() })
+	if generation, err := l.Generation(ctx); err != nil || generation != "preview-7" {
+		t.Fatalf("migrated generation = %q, %v, want preview-7", generation, err)
+	}
+	record, err := l.GetTurn(ctx, "turn-preview")
+	if err != nil || record.State != TurnRejected || record.RejectReason != "preview rejection" {
+		t.Fatalf("migrated preview record = %#v, %v", record, err)
+	}
+	if record.RuntimeSessionID != "" || record.CorrelationID != "" {
+		t.Fatalf("legacy identity defaults = %q/%q, want empty", record.RuntimeSessionID, record.CorrelationID)
+	}
+	if _, _, err := l.AdmitTurn(
+		ctx, "turn-new", "task-new", 1, "sha256:new", testRuntimeSessionID, testCorrelationID,
+	); err != nil {
+		t.Fatalf("admit after migration: %v", err)
+	}
+}
diff --git a/internal/harness/protocol.go b/internal/harness/protocol.go
index c9949b559..cd4b32ac8 100644
--- a/internal/harness/protocol.go
+++ b/internal/harness/protocol.go
@@ -1,11 +1,13 @@
 package harness
 
 import (
+	"crypto/sha256"
 	"encoding/json"
 	"fmt"
 	"slices"
 	"strings"
 	"time"
+	"unicode/utf8"
 )
 
 const (
@@ -16,14 +18,476 @@ const (
 )
 
 const (
-	HealthPath       = "/v1/health"
-	CapabilitiesPath = "/v1/capabilities"
-	TurnsPath        = "/v1/turns"
+	HealthPath             = "/v1/health"
+	ReadinessPath          = "/v1/ready"
+	CapabilitiesPath       = "/v1/capabilities"
+	TurnsPath              = "/v1/turns"
+	AdminTurnsPath         = "/v1/admin/turns"
+	AdminDrainPath         = "/v1/admin/drain"
+	AdminClosePath         = "/v1/admin/admission/close"
+	AdminRolloverPath      = "/v1/admin/admission/prepare-rollover"
+	AdminAbortRolloverPath = "/v1/admin/admission/abort-rollover"
+)
+
+// Durable harness v1 admission metadata is safe, non-secret identity copied
+// from the immutable Task binding and attempt record. Older runtimes may ignore
+// these extension keys, while the coexistence wrapper requires them before it
+// accepts a new turn.
+const (
+	MetadataTaskUID             = "orka.taskUID"
+	MetadataAttempt             = "orka.attempt"
+	MetadataBindingDigest       = "orka.bindingDigest"
+	MetadataSnapshotDigest      = "orka.snapshotDigest"
+	MetadataRequestDigest       = "orka.requestDigest"
+	MetadataRuntimePolicyFrozen = "orka.runtimePolicyFrozen"
+	MetadataAllowedToolsSet     = "orka.allowedToolsSet"
 )
 
 type RuntimeSessionID string
 type HarnessTurnID string
 
+// DurableTurnAdmissionState is the wrapper ledger state exposed only through
+// authenticated controller recovery APIs.
+type DurableTurnAdmissionState string
+
+const (
+	DurableTurnAdmitted       DurableTurnAdmissionState = "Admitted"
+	DurableTurnAccepted       DurableTurnAdmissionState = "Accepted"
+	DurableTurnRejected       DurableTurnAdmissionState = "Rejected"
+	DurableTurnTerminal       DurableTurnAdmissionState = "Terminal"
+	DurableTurnOutcomeUnknown DurableTurnAdmissionState = "OutcomeUnknown"
+)
+
+// DurableTurnTerminalKind is the authoritative terminal classification stored
+// in the wrapper admission ledger.
+type DurableTurnTerminalKind string
+
+const (
+	DurableTurnTerminalCompleted      DurableTurnTerminalKind = "Completed"
+	DurableTurnTerminalFailed         DurableTurnTerminalKind = "Failed"
+	DurableTurnTerminalCancelled      DurableTurnTerminalKind = "Cancelled"
+	DurableTurnTerminalOutcomeUnknown DurableTurnTerminalKind = "OutcomeUnknown"
+)
+
+// DurableTurnCompletedReceipt is the bounded result surface required to
+// recover a completed turn. Arbitrary metadata, data maps, and artifact bodies
+// are deliberately excluded from the durable recovery contract.
+type DurableTurnCompletedReceipt struct {
+	Result        string `json:"result,omitempty"`
+	OutputRef     string `json:"outputRef,omitempty"`
+	FinalEventSeq int64  `json:"finalEventSeq,omitempty"`
+	RetainSession bool   `json:"retainSession,omitempty"`
+}
+
+// DurableTurnFailedReceipt is the bounded failure surface required to classify
+// retry eligibility and recover an optional partial result.
+type DurableTurnFailedReceipt struct {
+	Reason    string `json:"reason,omitempty"`
+	Message   string `json:"message,omitempty"`
+	Result    string `json:"result,omitempty"`
+	OutputRef string `json:"outputRef,omitempty"`
+	Retryable bool   `json:"retryable,omitempty"`
+}
+
+// DurableTurnCancelledReceipt records a safe cancellation reason.
+type DurableTurnCancelledReceipt struct {
+	Reason string `json:"reason,omitempty"`
+}
+
+// DurableTurnOutcomeUnknownReceipt records why the wrapper could not produce
+// an authoritative terminal frame.
+type DurableTurnOutcomeUnknownReceipt struct {
+	Reason string `json:"reason"`
+}
+
+// DurableTurnTerminalReceipt is the canonical, bounded terminal body persisted
+// by the wrapper ledger. Exactly one kind-specific body is present. It contains
+// no arbitrary maps so the authenticated recovery response remains bounded and
+// can be sanitized before it is written durably.
+type DurableTurnTerminalReceipt struct {
+	Version          string                            `json:"version"`
+	Kind             DurableTurnTerminalKind           `json:"kind"`
+	RuntimeSessionID RuntimeSessionID                  `json:"runtimeSessionID"`
+	TurnID           HarnessTurnID                     `json:"turnID"`
+	CorrelationID    string                            `json:"correlationID"`
+	Seq              int64                             `json:"seq,omitempty"`
+	Completed        *DurableTurnCompletedReceipt      `json:"completed,omitempty"`
+	Failed           *DurableTurnFailedReceipt         `json:"failed,omitempty"`
+	Cancelled        *DurableTurnCancelledReceipt      `json:"cancelled,omitempty"`
+	OutcomeUnknown   *DurableTurnOutcomeUnknownReceipt `json:"outcomeUnknown,omitempty"`
+}
+
+const (
+	maxDurableTurnCompletedResultBytes = 512 << 10
+	maxDurableTurnFailedResultBytes    = 64 << 10
+	maxDurableTurnTerminalTextBytes    = 64 << 10
+	maxDurableTurnOutputRefBytes       = 4096
+)
+
+// Validate rejects incomplete, ambiguous, or unbounded terminal receipts.
+func (r DurableTurnTerminalReceipt) Validate() error {
+	if r.Version != ProtocolVersion {
+		return fmt.Errorf("unsupported durable terminal receipt version %q", r.Version)
+	}
+	if strings.TrimSpace(string(r.RuntimeSessionID)) == "" {
+		return fmt.Errorf("durable terminal receipt runtime session id is required")
+	}
+	if strings.TrimSpace(string(r.TurnID)) == "" {
+		return fmt.Errorf("durable terminal receipt turn id is required")
+	}
+	if strings.TrimSpace(r.CorrelationID) == "" {
+		return fmt.Errorf("durable terminal receipt correlation id is required")
+	}
+	if r.Seq < 0 {
+		return fmt.Errorf("durable terminal receipt seq must be non-negative")
+	}
+	present := 0
+	for _, body := range []bool{r.Completed != nil, r.Failed != nil, r.Cancelled != nil, r.OutcomeUnknown != nil} {
+		if body {
+			present++
+		}
+	}
+	if present != 1 {
+		return fmt.Errorf("durable terminal receipt must contain exactly one terminal body")
+	}
+	switch r.Kind {
+	case DurableTurnTerminalCompleted:
+		if r.Completed == nil {
+			return fmt.Errorf("completed durable terminal receipt body is required")
+		}
+		if r.Seq < 1 {
+			return fmt.Errorf("completed durable terminal receipt seq must be positive")
+		}
+		if len([]byte(r.Completed.Result)) > maxDurableTurnCompletedResultBytes {
+			return fmt.Errorf("completed durable terminal receipt result exceeds limit")
+		}
+		if len([]byte(r.Completed.OutputRef)) > maxDurableTurnOutputRefBytes {
+			return fmt.Errorf("completed durable terminal receipt output ref exceeds limit")
+		}
+		if r.Completed.FinalEventSeq < 0 {
+			return fmt.Errorf("completed durable terminal receipt final event seq must be non-negative")
+		}
+	case DurableTurnTerminalFailed:
+		if r.Failed == nil {
+			return fmt.Errorf("failed durable terminal receipt body is required")
+		}
+		if r.Seq < 1 {
+			return fmt.Errorf("failed durable terminal receipt seq must be positive")
+		}
+		if len([]byte(r.Failed.Reason)) > maxDurableTurnTerminalTextBytes ||
+			len([]byte(r.Failed.Message)) > maxDurableTurnTerminalTextBytes {
+			return fmt.Errorf("failed durable terminal receipt text exceeds limit")
+		}
+		if len([]byte(r.Failed.Result)) > maxDurableTurnFailedResultBytes {
+			return fmt.Errorf("failed durable terminal receipt result exceeds limit")
+		}
+		if len([]byte(r.Failed.OutputRef)) > maxDurableTurnOutputRefBytes {
+			return fmt.Errorf("failed durable terminal receipt output ref exceeds limit")
+		}
+	case DurableTurnTerminalCancelled:
+		if r.Cancelled == nil {
+			return fmt.Errorf("cancelled durable terminal receipt body is required")
+		}
+		if r.Seq < 1 {
+			return fmt.Errorf("cancelled durable terminal receipt seq must be positive")
+		}
+		if len([]byte(r.Cancelled.Reason)) > maxDurableTurnTerminalTextBytes {
+			return fmt.Errorf("cancelled durable terminal receipt reason exceeds limit")
+		}
+	case DurableTurnTerminalOutcomeUnknown:
+		if r.OutcomeUnknown == nil || strings.TrimSpace(r.OutcomeUnknown.Reason) == "" {
+			return fmt.Errorf("outcome-unknown durable terminal receipt reason is required")
+		}
+		if len([]byte(r.OutcomeUnknown.Reason)) > maxDurableTurnTerminalTextBytes {
+			return fmt.Errorf("outcome-unknown durable terminal receipt reason exceeds limit")
+		}
+	default:
+		return fmt.Errorf("unsupported durable terminal receipt kind %q", r.Kind)
+	}
+	return nil
+}
+
+// HarnessFrame reconstructs the terminal frame needed by the dispatcher.
+// OutcomeUnknown has no authoritative terminal frame and returns false.
+func (r DurableTurnTerminalReceipt) HarnessFrame() (HarnessEventFrame, bool) {
+	frame := HarnessEventFrame{
+		Version: r.Version, RuntimeSessionID: r.RuntimeSessionID, TurnID: r.TurnID,
+		CorrelationID: r.CorrelationID, Seq: r.Seq,
+	}
+	switch r.Kind {
+	case DurableTurnTerminalCompleted:
+		frame.Type = FrameTurnCompleted
+		if r.Completed != nil {
+			frame.Completed = &TurnCompleted{
+				Result: r.Completed.Result, OutputRef: r.Completed.OutputRef,
+				FinalEventSeq: r.Completed.FinalEventSeq, RetainSession: r.Completed.RetainSession,
+			}
+		}
+		return frame, true
+	case DurableTurnTerminalFailed:
+		frame.Type = FrameTurnFailed
+		if r.Failed != nil {
+			frame.Failed = &TurnFailed{
+				Reason: r.Failed.Reason, Message: r.Failed.Message, Result: r.Failed.Result,
+				OutputRef: r.Failed.OutputRef, Retryable: r.Failed.Retryable,
+			}
+		}
+		return frame, true
+	case DurableTurnTerminalCancelled:
+		frame.Type = FrameTurnCancelled
+		return frame, true
+	default:
+		return HarnessEventFrame{}, false
+	}
+}
+
+// DurableTurnTerminalReceiptFromFrame converts a sanitized terminal frame to
+// the one bounded canonical receipt shape shared by live streaming, persisted
+// frame recovery, and the wrapper admission ledger. Arbitrary maps and
+// artifacts are intentionally excluded. Callers must sanitize secrets before
+// invoking this function.
+func DurableTurnTerminalReceiptFromFrame(frame HarnessEventFrame) (DurableTurnTerminalReceipt, error) {
+	receipt := DurableTurnTerminalReceipt{
+		Version: frame.Version, RuntimeSessionID: frame.RuntimeSessionID,
+		TurnID: frame.TurnID, CorrelationID: frame.CorrelationID, Seq: frame.Seq,
+	}
+	switch frame.Type {
+	case FrameTurnCompleted:
+		if frame.Completed == nil {
+			return DurableTurnTerminalReceipt{}, fmt.Errorf("completed terminal frame body is required")
+		}
+		finalEventSeq := frame.Completed.FinalEventSeq
+		if finalEventSeq == 0 {
+			finalEventSeq = frame.Seq
+		}
+		receipt.Kind = DurableTurnTerminalCompleted
+		receipt.Completed = &DurableTurnCompletedReceipt{
+			Result:        truncateDurableTurnReceiptBytes(frame.Completed.Result, maxDurableTurnCompletedResultBytes),
+			OutputRef:     truncateDurableTurnReceiptBytes(frame.Completed.OutputRef, maxDurableTurnOutputRefBytes),
+			FinalEventSeq: finalEventSeq, RetainSession: frame.Completed.RetainSession,
+		}
+	case FrameTurnFailed:
+		if frame.Failed == nil {
+			return DurableTurnTerminalReceipt{}, fmt.Errorf("failed terminal frame body is required")
+		}
+		receipt.Kind = DurableTurnTerminalFailed
+		receipt.Failed = &DurableTurnFailedReceipt{
+			Reason:    truncateDurableTurnReceiptBytes(frame.Failed.Reason, maxDurableTurnTerminalTextBytes),
+			Message:   truncateDurableTurnReceiptBytes(frame.Failed.Message, maxDurableTurnTerminalTextBytes),
+			Result:    truncateDurableTurnReceiptBytes(frame.Failed.Result, maxDurableTurnFailedResultBytes),
+			OutputRef: truncateDurableTurnReceiptBytes(frame.Failed.OutputRef, maxDurableTurnOutputRefBytes),
+			Retryable: frame.Failed.Retryable,
+		}
+	case FrameTurnCancelled:
+		receipt.Kind = DurableTurnTerminalCancelled
+		receipt.Cancelled = &DurableTurnCancelledReceipt{Reason: "cancelled"}
+	default:
+		return DurableTurnTerminalReceipt{}, fmt.Errorf("frame type %q is not terminal", frame.Type)
+	}
+	if err := receipt.Validate(); err != nil {
+		return DurableTurnTerminalReceipt{}, err
+	}
+	return receipt, nil
+}
+
+func truncateDurableTurnReceiptBytes(value string, maxBytes int) string {
+	if maxBytes <= 0 {
+		return ""
+	}
+	if len([]byte(value)) <= maxBytes {
+		return value
+	}
+	ellipsisBytes := utf8.RuneLen('…')
+	if maxBytes <= ellipsisBytes {
+		return "…"
+	}
+	limit := maxBytes - ellipsisBytes
+	var out strings.Builder
+	out.Grow(limit + ellipsisBytes)
+	for _, r := range value {
+		width := utf8.RuneLen(r)
+		if width < 0 {
+			width = len(string(r))
+		}
+		if out.Len()+width > limit {
+			break
+		}
+		out.WriteRune(r)
+	}
+	out.WriteRune('…')
+	return out.String()
+}
+
+// MarshalDurableTurnTerminalReceipt validates and returns the canonical JSON
+// bytes whose digest is persisted by the wrapper ledger.
+func MarshalDurableTurnTerminalReceipt(receipt DurableTurnTerminalReceipt) ([]byte, error) {
+	if err := receipt.Validate(); err != nil {
+		return nil, err
+	}
+	encoded, err := json.Marshal(receipt)
+	if err != nil {
+		return nil, fmt.Errorf("marshal durable terminal receipt: %w", err)
+	}
+	return encoded, nil
+}
+
+// DurableTurnTerminalReceiptDigest returns the canonical SHA-256 receipt digest.
+func DurableTurnTerminalReceiptDigest(receipt DurableTurnTerminalReceipt) (string, error) {
+	encoded, err := MarshalDurableTurnTerminalReceipt(receipt)
+	if err != nil {
+		return "", err
+	}
+	sum := sha256.Sum256(encoded)
+	return fmt.Sprintf("sha256:%x", sum[:]), nil
+}
+
+// DurableTurnStatus exposes safe admission and canonical terminal receipt
+// metadata through the authenticated recovery API.
+type DurableTurnStatus struct {
+	TurnID                string                      `json:"turnID"`
+	TaskUID               string                      `json:"taskUID"`
+	Attempt               int32                       `json:"attempt"`
+	RequestDigest         string                      `json:"requestDigest"`
+	State                 DurableTurnAdmissionState   `json:"state"`
+	TerminalReceiptDigest string                      `json:"terminalReceiptDigest,omitempty"`
+	TerminalReceipt       *DurableTurnTerminalReceipt `json:"terminalReceipt,omitempty"`
+	UpdatedAt             time.Time                   `json:"updatedAt"`
+}
+
+// TurnOutputAcknowledgementRequest authorizes deletion of one durable output
+// only after the controller has durably stored and settled the exact terminal
+// receipt that referenced it.
+type TurnOutputAcknowledgementRequest struct {
+	Version               string        `json:"version"`
+	TurnID                HarnessTurnID `json:"turnID"`
+	OutputRef             string        `json:"outputRef"`
+	TerminalReceiptDigest string        `json:"terminalReceiptDigest"`
+}
+
+// ValidateFor rejects acknowledgements that are not fenced to the requested
+// turn and its canonical terminal receipt.
+func (r TurnOutputAcknowledgementRequest) ValidateFor(turnID HarnessTurnID) error {
+	if err := validateVersion(r.Version); err != nil {
+		return err
+	}
+	if err := ValidateTurnPathSegment(r.TurnID); err != nil {
+		return err
+	}
+	if r.TurnID != turnID {
+		return fmt.Errorf("turn id does not match request path")
+	}
+	if strings.TrimSpace(r.OutputRef) == "" {
+		return fmt.Errorf("output ref is required")
+	}
+	if !isCanonicalSHA256Digest(r.TerminalReceiptDigest) {
+		return fmt.Errorf("terminal receipt digest must be a canonical sha256 digest")
+	}
+	return nil
+}
+
+// TurnOutputAcknowledgementResponse confirms the idempotent tombstone.
+type TurnOutputAcknowledgementResponse struct {
+	Version               string        `json:"version"`
+	TurnID                HarnessTurnID `json:"turnID"`
+	OutputRef             string        `json:"outputRef"`
+	TerminalReceiptDigest string        `json:"terminalReceiptDigest"`
+	Acknowledged          bool          `json:"acknowledged"`
+}
+
+// ValidateFor rejects ambiguous or mismatched acknowledgement responses.
+func (r TurnOutputAcknowledgementResponse) ValidateFor(request TurnOutputAcknowledgementRequest) error {
+	if err := validateVersion(r.Version); err != nil {
+		return err
+	}
+	if !r.Acknowledged || r.TurnID != request.TurnID || r.OutputRef != request.OutputRef ||
+		r.TerminalReceiptDigest != request.TerminalReceiptDigest {
+		return fmt.Errorf("output acknowledgement does not match request")
+	}
+	return nil
+}
+
+// TurnSettlementAcknowledgementRequest proves that the controller durably
+// settled the exact wrapper request and terminal evidence. A rejected turn has
+// no terminal receipt digest; terminal and outcome-unknown turns require one.
+type TurnSettlementAcknowledgementRequest struct {
+	Version               string        `json:"version"`
+	TurnID                HarnessTurnID `json:"turnID"`
+	RequestDigest         string        `json:"requestDigest"`
+	TerminalReceiptDigest string        `json:"terminalReceiptDigest,omitempty"`
+}
+
+func (r TurnSettlementAcknowledgementRequest) ValidateFor(turnID HarnessTurnID) error {
+	if err := validateVersion(r.Version); err != nil {
+		return err
+	}
+	if err := ValidateTurnPathSegment(r.TurnID); err != nil {
+		return err
+	}
+	if r.TurnID != turnID {
+		return fmt.Errorf("turn id does not match request path")
+	}
+	if !isCanonicalSHA256Digest(r.RequestDigest) {
+		return fmt.Errorf("request digest must be a canonical sha256 digest")
+	}
+	if r.TerminalReceiptDigest != "" && !isCanonicalSHA256Digest(r.TerminalReceiptDigest) {
+		return fmt.Errorf("terminal receipt digest must be empty or a canonical sha256 digest")
+	}
+	return nil
+}
+
+type TurnSettlementAcknowledgementResponse struct {
+	Version               string        `json:"version"`
+	TurnID                HarnessTurnID `json:"turnID"`
+	RequestDigest         string        `json:"requestDigest"`
+	TerminalReceiptDigest string        `json:"terminalReceiptDigest,omitempty"`
+	Acknowledged          bool          `json:"acknowledged"`
+}
+
+func (r TurnSettlementAcknowledgementResponse) ValidateFor(request TurnSettlementAcknowledgementRequest) error {
+	if err := validateVersion(r.Version); err != nil {
+		return err
+	}
+	if !r.Acknowledged || r.TurnID != request.TurnID || r.RequestDigest != request.RequestDigest ||
+		r.TerminalReceiptDigest != request.TerminalReceiptDigest {
+		return fmt.Errorf("settlement acknowledgement does not match request")
+	}
+	return nil
+}
+
+type DurableDrainStatus struct {
+	AdmissionClosed   bool                `json:"admissionClosed"`
+	AdmissionClosedAt time.Time           `json:"admissionClosedAt,omitempty"`
+	Completed         bool                `json:"completed"`
+	Unsettled         []DurableTurnStatus `json:"unsettled"`
+}
+
+type DurableAdmissionCloseResponse struct {
+	AdmissionClosed bool `json:"admissionClosed"`
+}
+
+type DurableRolloverPrepareRequest struct {
+	NextGeneration string `json:"nextGeneration"`
+}
+
+type DurableRolloverPrepareResponse struct {
+	CurrentGeneration string `json:"currentGeneration"`
+	NextGeneration    string `json:"nextGeneration"`
+	Prepared          bool   `json:"prepared"`
+}
+
+// DurableRolloverAbortRequest identifies the exact live generation a rollback
+// hook is authorized to reopen.
+type DurableRolloverAbortRequest struct {
+	ExpectedGeneration string `json:"expectedGeneration"`
+}
+
+// DurableRolloverAbortResponse confirms that the exact live generation is
+// accepting admissions again.
+type DurableRolloverAbortResponse struct {
+	CurrentGeneration string `json:"currentGeneration"`
+	AdmissionReopened bool   `json:"admissionReopened"`
+}
+
 type ToolExecutionMode string
 
 const (
@@ -102,6 +566,26 @@ type StartTurnRequest struct {
 	Metadata          map[string]string `json:"metadata,omitempty"`
 }
 
+// CanonicalStartTurnRequestDigest returns the request digest used by the
+// durable wrapper admission ledger. MetadataRequestDigest is excluded so the
+// resulting digest can be placed back into that metadata field without a
+// circular dependency. The request is not mutated.
+func CanonicalStartTurnRequestDigest(request StartTurnRequest) (string, error) {
+	normalized := request
+	normalized.Metadata = make(map[string]string, len(request.Metadata))
+	for key, value := range request.Metadata {
+		if key != MetadataRequestDigest {
+			normalized.Metadata[key] = value
+		}
+	}
+	encoded, err := json.Marshal(normalized)
+	if err != nil {
+		return "", fmt.Errorf("canonicalize durable turn request: %w", err)
+	}
+	sum := sha256.Sum256(encoded)
+	return fmt.Sprintf("sha256:%x", sum[:]), nil
+}
+
 type AuthIdentity struct {
 	Subject  string   `json:"subject,omitempty"`
 	Issuer   string   `json:"issuer,omitempty"`
diff --git a/internal/harness/turn_path.go b/internal/harness/turn_path.go
index e938c5230..3fced68b3 100644
--- a/internal/harness/turn_path.go
+++ b/internal/harness/turn_path.go
@@ -8,10 +8,12 @@ import (
 )
 
 const (
-	TurnResourceEvents   = "events"
-	TurnResourceContinue = "continue"
-	TurnResourceCancel   = "cancel"
-	TurnResourceOutput   = "output"
+	TurnResourceEvents                    = "events"
+	TurnResourceContinue                  = "continue"
+	TurnResourceCancel                    = "cancel"
+	TurnResourceOutput                    = "output"
+	TurnResourceOutputAcknowledgement     = "output-acknowledgement"
+	TurnResourceSettlementAcknowledgement = "settlement-acknowledgement"
 )
 
 // ErrTurnPathNotFound reports that a request path is not a two-segment harness
@@ -64,6 +66,18 @@ func OutputTurnPath(turnID HarnessTurnID) (string, error) {
 	return TurnResourcePath(turnID, TurnResourceOutput)
 }
 
+// OutputAcknowledgementTurnPath builds the durable output acknowledgement
+// path for a turn.
+func OutputAcknowledgementTurnPath(turnID HarnessTurnID) (string, error) {
+	return TurnResourcePath(turnID, TurnResourceOutputAcknowledgement)
+}
+
+// SettlementAcknowledgementTurnPath builds the controller settlement
+// acknowledgement path for a durable turn.
+func SettlementAcknowledgementTurnPath(turnID HarnessTurnID) (string, error) {
+	return TurnResourcePath(turnID, TurnResourceSettlementAcknowledgement)
+}
+
 // ParseTurnResourcePath extracts the turn ID and resource from a request path
 // previously produced by TurnResourcePath. Pass URL.EscapedPath() when parsing
 // an HTTP request so encoded slashes are rejected after unescaping.
diff --git a/internal/harness/v2/capability.go b/internal/harness/v2/capability.go
new file mode 100644
index 000000000..ec7ed1a05
--- /dev/null
+++ b/internal/harness/v2/capability.go
@@ -0,0 +1,126 @@
+package v2
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+)
+
+const (
+	OperationCapabilityVersion  = "orka.harness.v2.capability.1"
+	OperationCapabilityAudience = "orka.harness.v2"
+	MinCapabilitySecretBytes    = 32
+)
+
+type OperationCapabilityClaims struct {
+	Version       string        `json:"version"`
+	Audience      string        `json:"audience"`
+	Fence         Fence         `json:"fence"`
+	OperationID   OperationID   `json:"operationID"`
+	RequestDigest RequestDigest `json:"requestDigest"`
+	ExpiresAt     time.Time     `json:"expiresAt"`
+}
+
+func (c OperationCapabilityClaims) ValidateAt(now time.Time, requireSession bool) error {
+	if c.Version != OperationCapabilityVersion {
+		return fmt.Errorf("capability version %q is unsupported", c.Version)
+	}
+	if c.Audience != OperationCapabilityAudience {
+		return fmt.Errorf("capability audience %q is invalid", c.Audience)
+	}
+	if err := c.Fence.Validate(requireSession); err != nil {
+		return fmt.Errorf("capability fence: %w", err)
+	}
+	if err := requireIdentifier("capability operation ID", string(c.OperationID)); err != nil {
+		return err
+	}
+	if err := ValidateRequestDigest(c.RequestDigest); err != nil {
+		return fmt.Errorf("capability request digest: %w", err)
+	}
+	if now.IsZero() {
+		now = time.Now().UTC()
+	}
+	if c.ExpiresAt.IsZero() || !c.ExpiresAt.After(now) {
+		return fmt.Errorf("operation capability is expired")
+	}
+	return nil
+}
+
+func ClaimsForMutation(metadata MutationMetadata) OperationCapabilityClaims {
+	return OperationCapabilityClaims{
+		Version:       OperationCapabilityVersion,
+		Audience:      OperationCapabilityAudience,
+		Fence:         metadata.Fence,
+		OperationID:   metadata.OperationID,
+		RequestDigest: metadata.RequestDigest,
+		ExpiresAt:     metadata.ExpiresAt,
+	}
+}
+
+func SignOperationCapability(secret []byte, claims OperationCapabilityClaims) (string, error) {
+	if len(secret) < MinCapabilitySecretBytes {
+		return "", fmt.Errorf("operation capability secret must be at least %d bytes", MinCapabilitySecretBytes)
+	}
+	if err := claims.ValidateAt(time.Now().UTC(), claims.Fence.RuntimeSessionUID != ""); err != nil {
+		return "", err
+	}
+	payload, err := CanonicalValue(claims)
+	if err != nil {
+		return "", fmt.Errorf("canonicalize operation capability: %w", err)
+	}
+	mac := hmac.New(sha256.New, secret)
+	_, _ = mac.Write(payload)
+	signature := mac.Sum(nil)
+	encoding := base64.RawURLEncoding
+	return encoding.EncodeToString(payload) + "." + encoding.EncodeToString(signature), nil
+}
+
+func VerifyOperationCapability(secret []byte, token string, expected MutationMetadata, requireSession bool, now time.Time) error {
+	if len(secret) < MinCapabilitySecretBytes {
+		return fmt.Errorf("operation capability secret must be at least %d bytes", MinCapabilitySecretBytes)
+	}
+	parts := strings.Split(token, ".")
+	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
+		return fmt.Errorf("operation capability token is malformed")
+	}
+	encoding := base64.RawURLEncoding
+	payload, err := encoding.DecodeString(parts[0])
+	if err != nil {
+		return fmt.Errorf("decode operation capability payload: %w", err)
+	}
+	signature, err := encoding.DecodeString(parts[1])
+	if err != nil {
+		return fmt.Errorf("decode operation capability signature: %w", err)
+	}
+	mac := hmac.New(sha256.New, secret)
+	_, _ = mac.Write(payload)
+	if !hmac.Equal(signature, mac.Sum(nil)) {
+		return fmt.Errorf("operation capability signature is invalid")
+	}
+	canonical, err := CanonicalJSON(payload)
+	if err != nil {
+		return fmt.Errorf("operation capability payload is invalid: %w", err)
+	}
+	if string(canonical) != string(payload) {
+		return fmt.Errorf("operation capability payload is not canonical")
+	}
+	var claims OperationCapabilityClaims
+	dec := json.NewDecoder(strings.NewReader(string(payload)))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&claims); err != nil {
+		return fmt.Errorf("decode operation capability claims: %w", err)
+	}
+	if err := claims.ValidateAt(now, requireSession); err != nil {
+		return err
+	}
+	if claims.OperationID != expected.OperationID || claims.RequestDigest != expected.RequestDigest ||
+		CompareFence(expected.Fence, claims.Fence, requireSession) != FenceMatch ||
+		!claims.ExpiresAt.Equal(expected.ExpiresAt) {
+		return fmt.Errorf("operation capability claims do not match request metadata")
+	}
+	return nil
+}
diff --git a/internal/harness/v2/capability_test.go b/internal/harness/v2/capability_test.go
new file mode 100644
index 000000000..338ff556c
--- /dev/null
+++ b/internal/harness/v2/capability_test.go
@@ -0,0 +1,49 @@
+package v2
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestOperationCapabilityRoundTripAndBinding(t *testing.T) {
+	metadata := testMutationMetadata(t, true)
+	metadata.RequestDigest = RequestDigest(testSHA256("capability-request"))
+	metadata.ExpiresAt = time.Now().UTC().Add(time.Minute)
+	secret := []byte(strings.Repeat("s", MinCapabilitySecretBytes))
+	token, err := SignOperationCapability(secret, ClaimsForMutation(metadata))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := VerifyOperationCapability(secret, token, metadata, true, time.Now().UTC()); err != nil {
+		t.Fatal(err)
+	}
+	changed := metadata
+	changed.OperationID = "different-operation"
+	if err := VerifyOperationCapability(secret, token, changed, true, time.Now().UTC()); err == nil {
+		t.Fatal("capability unexpectedly verified for different operation")
+	}
+	parts := strings.Split(token, ".")
+	parts[1] = strings.Repeat("A", len(parts[1]))
+	if err := VerifyOperationCapability(secret, strings.Join(parts, "."), metadata, true, time.Now().UTC()); err == nil {
+		t.Fatal("tampered capability unexpectedly verified")
+	}
+}
+
+func TestOperationCapabilityRejectsExpiryAndWeakSecret(t *testing.T) {
+	metadata := testMutationMetadata(t, true)
+	metadata.RequestDigest = RequestDigest(testSHA256("capability-request"))
+	metadata.ExpiresAt = time.Now().UTC().Add(time.Minute)
+	if _, err := SignOperationCapability([]byte("short"), ClaimsForMutation(metadata)); err == nil {
+		t.Fatal("weak capability secret unexpectedly accepted")
+	}
+	secret := []byte(strings.Repeat("s", MinCapabilitySecretBytes))
+	claims := ClaimsForMutation(metadata)
+	token, err := SignOperationCapability(secret, claims)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := VerifyOperationCapability(secret, token, metadata, true, metadata.ExpiresAt.Add(time.Second)); err == nil {
+		t.Fatal("expired capability unexpectedly verified")
+	}
+}
diff --git a/internal/harness/v2/classification.go b/internal/harness/v2/classification.go
new file mode 100644
index 000000000..4e018cdb6
--- /dev/null
+++ b/internal/harness/v2/classification.go
@@ -0,0 +1,215 @@
+package v2
+
+import (
+	"fmt"
+	"net/http"
+	"time"
+)
+
+type OperationPhase string
+
+const (
+	OperationPhaseRecorded OperationPhase = "recorded"
+	OperationPhaseApplied  OperationPhase = "applied"
+	OperationPhaseAccepted OperationPhase = "accepted"
+	OperationPhaseSettled  OperationPhase = "settled"
+	OperationPhaseDeleted  OperationPhase = "deleted"
+)
+
+type OperationRecord struct {
+	OperationID   OperationID    `json:"operationID"`
+	RequestDigest RequestDigest  `json:"requestDigest"`
+	Phase         OperationPhase `json:"phase"`
+	TerminalEvent EventType      `json:"terminalEvent,omitempty"`
+	RecordedAt    time.Time      `json:"recordedAt"`
+	UpdatedAt     time.Time      `json:"updatedAt"`
+}
+
+func (r OperationRecord) Validate() error {
+	if err := requireIdentifier("operation ID", string(r.OperationID)); err != nil {
+		return err
+	}
+	if err := ValidateRequestDigest(r.RequestDigest); err != nil {
+		return fmt.Errorf("request digest: %w", err)
+	}
+	switch r.Phase {
+	case OperationPhaseRecorded, OperationPhaseApplied, OperationPhaseAccepted, OperationPhaseDeleted:
+		if r.TerminalEvent != "" {
+			return fmt.Errorf("operation phase %q must not carry terminal event", r.Phase)
+		}
+	case OperationPhaseSettled:
+		if !r.TerminalEvent.IsTerminal() {
+			return fmt.Errorf("settled operation requires terminal event")
+		}
+	default:
+		return fmt.Errorf("unsupported operation phase %q", r.Phase)
+	}
+	if r.RecordedAt.IsZero() {
+		return fmt.Errorf("operation recorded timestamp is required")
+	}
+	if !r.UpdatedAt.IsZero() && r.UpdatedAt.Before(r.RecordedAt) {
+		return fmt.Errorf("operation updated timestamp precedes recorded timestamp")
+	}
+	return nil
+}
+
+type RequestClassification string
+
+const (
+	RequestClassificationFresh           RequestClassification = "fresh"
+	RequestClassificationDuplicate       RequestClassification = "duplicate"
+	RequestClassificationAlreadyAccepted RequestClassification = "already_accepted"
+	RequestClassificationSettled         RequestClassification = "settled"
+	RequestClassificationDigestConflict  RequestClassification = "digest_conflict"
+	RequestClassificationStaleFence      RequestClassification = "stale_fence"
+	RequestClassificationExpired         RequestClassification = "expired"
+)
+
+type Classification struct {
+	Class         RequestClassification `json:"class"`
+	FenceMismatch FenceMismatch         `json:"fenceMismatch,omitempty"`
+	Phase         OperationPhase        `json:"phase,omitempty"`
+	TerminalEvent EventType             `json:"terminalEvent,omitempty"`
+}
+
+func (c Classification) Validate() error {
+	switch c.Class {
+	case RequestClassificationFresh:
+		if c.FenceMismatch != FenceMatch || c.Phase != "" || c.TerminalEvent != "" {
+			return fmt.Errorf("fresh classification must not carry prior-operation metadata")
+		}
+	case RequestClassificationDuplicate, RequestClassificationAlreadyAccepted:
+		if c.FenceMismatch != FenceMatch || c.Phase == "" || c.TerminalEvent != "" {
+			return fmt.Errorf("%s classification requires non-terminal prior phase", c.Class)
+		}
+	case RequestClassificationSettled:
+		if c.FenceMismatch != FenceMatch || c.Phase != OperationPhaseSettled || !c.TerminalEvent.IsTerminal() {
+			return fmt.Errorf("settled classification requires settled phase and terminal event")
+		}
+	case RequestClassificationDigestConflict:
+		if c.FenceMismatch != FenceMatch || c.Phase == "" {
+			return fmt.Errorf("digest conflict classification requires existing operation phase")
+		}
+	case RequestClassificationStaleFence:
+		if c.FenceMismatch == FenceMatch || c.Phase != "" || c.TerminalEvent != "" {
+			return fmt.Errorf("stale fence classification requires exactly one fence mismatch")
+		}
+	case RequestClassificationExpired:
+		if c.FenceMismatch != FenceMatch || c.Phase != "" || c.TerminalEvent != "" {
+			return fmt.Errorf("expired classification must not carry prior-operation metadata")
+		}
+	default:
+		return fmt.Errorf("unsupported request classification %q", c.Class)
+	}
+	return nil
+}
+
+func (c Classification) HTTPStatus() int {
+	switch c.Class {
+	case RequestClassificationFresh:
+		return 0
+	case RequestClassificationDuplicate, RequestClassificationAlreadyAccepted, RequestClassificationSettled:
+		return http.StatusOK
+	case RequestClassificationDigestConflict:
+		return http.StatusConflict
+	case RequestClassificationStaleFence, RequestClassificationExpired:
+		return http.StatusGone
+	default:
+		return http.StatusInternalServerError
+	}
+}
+
+// ClassifyOperation applies the v2 replay matrix. Callers pass the current
+// expected fence and, when present, the durable/tombstoned record for the exact
+// operation identity. It never authorizes replay: Fresh only means no matching
+// side-effect record was supplied.
+func ClassifyOperation(
+	expected Fence,
+	incoming MutationMetadata,
+	existing *OperationRecord,
+	requireSession bool,
+	now time.Time,
+) (Classification, error) {
+	if err := requireIdentifier("operation ID", string(incoming.OperationID)); err != nil {
+		return Classification{}, err
+	}
+	if incoming.RequestDigestSchemaVersion != RequestDigestSchemaVersion {
+		return Classification{}, fmt.Errorf("unsupported request digest schema version %d", incoming.RequestDigestSchemaVersion)
+	}
+	if err := ValidateRequestDigest(incoming.RequestDigest); err != nil {
+		return Classification{}, fmt.Errorf("request digest: %w", err)
+	}
+	if mismatch := CompareFence(expected, incoming.Fence, requireSession); mismatch != FenceMatch {
+		return Classification{Class: RequestClassificationStaleFence, FenceMismatch: mismatch}, nil
+	}
+	if now.IsZero() {
+		now = time.Now().UTC()
+	}
+	if incoming.ExpiresAt.IsZero() || !incoming.ExpiresAt.After(now) {
+		return Classification{Class: RequestClassificationExpired}, nil
+	}
+	if existing == nil {
+		return Classification{Class: RequestClassificationFresh}, nil
+	}
+	if err := existing.Validate(); err != nil {
+		return Classification{}, fmt.Errorf("existing operation record: %w", err)
+	}
+	if existing.OperationID != incoming.OperationID {
+		return Classification{}, fmt.Errorf("existing operation ID %q does not match incoming operation ID %q", existing.OperationID, incoming.OperationID)
+	}
+	if existing.RequestDigest != incoming.RequestDigest {
+		return Classification{Class: RequestClassificationDigestConflict, Phase: existing.Phase, TerminalEvent: existing.TerminalEvent}, nil
+	}
+	switch existing.Phase {
+	case OperationPhaseAccepted:
+		return Classification{Class: RequestClassificationAlreadyAccepted, Phase: existing.Phase}, nil
+	case OperationPhaseSettled:
+		return Classification{Class: RequestClassificationSettled, Phase: existing.Phase, TerminalEvent: existing.TerminalEvent}, nil
+	default:
+		return Classification{Class: RequestClassificationDuplicate, Phase: existing.Phase}, nil
+	}
+}
+
+// RuntimeSessionTombstone preserves exact-generation replay classification after
+// session deletion. It remains live until the controller durably retires that
+// RuntimeSession generation.
+type RuntimeSessionTombstone struct {
+	RuntimeSessionUID        RuntimeSessionUID `json:"runtimeSessionUID"`
+	RuntimeSessionGeneration uint64            `json:"runtimeSessionGeneration"`
+	RuntimeProfileDigest     ProfileDigest     `json:"runtimeProfileDigest"`
+	DeletedAt                time.Time         `json:"deletedAt"`
+	Operations               []OperationRecord `json:"operations,omitempty"`
+}
+
+func (t RuntimeSessionTombstone) Validate() error {
+	if err := requireIdentifier("runtime session UID", string(t.RuntimeSessionUID)); err != nil {
+		return err
+	}
+	if t.RuntimeSessionGeneration == 0 {
+		return fmt.Errorf("runtime session generation must be positive")
+	}
+	if err := ValidateProfileDigest(t.RuntimeProfileDigest); err != nil {
+		return fmt.Errorf("runtime profile digest: %w", err)
+	}
+	if t.DeletedAt.IsZero() {
+		return fmt.Errorf("deleted timestamp is required")
+	}
+	if len(t.Operations) > 4096 {
+		return fmt.Errorf("tombstoned operation count exceeds 4096")
+	}
+	seen := make(map[OperationID]struct{}, len(t.Operations))
+	for i := range t.Operations {
+		if err := t.Operations[i].Validate(); err != nil {
+			return fmt.Errorf("operation %d: %w", i, err)
+		}
+		if _, ok := seen[t.Operations[i].OperationID]; ok {
+			return fmt.Errorf("duplicate tombstoned operation ID %q", t.Operations[i].OperationID)
+		}
+		seen[t.Operations[i].OperationID] = struct{}{}
+	}
+	return nil
+}
+
+func (t RuntimeSessionTombstone) CanRetire(sessionUID RuntimeSessionUID, retiredThroughGeneration uint64) bool {
+	return sessionUID == t.RuntimeSessionUID && retiredThroughGeneration >= t.RuntimeSessionGeneration
+}
diff --git a/internal/harness/v2/classification_lifecycle_test.go b/internal/harness/v2/classification_lifecycle_test.go
new file mode 100644
index 000000000..5e0d3e4e8
--- /dev/null
+++ b/internal/harness/v2/classification_lifecycle_test.go
@@ -0,0 +1,205 @@
+package v2
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+)
+
+const testOtherFenceValue = "other"
+
+func TestClassifyOperationReplayMatrix(t *testing.T) {
+	metadata := testMutationMetadata(t, true)
+	metadata.RequestDigest = RequestDigest(testSHA256("request-a"))
+	expected := metadata.Fence
+	recordedAt := testNow.Add(-time.Minute)
+
+	tests := []struct {
+		name       string
+		mutate     func(*MutationMetadata)
+		record     *OperationRecord
+		want       RequestClassification
+		wantStatus int
+	}{
+		{name: "fresh", want: RequestClassificationFresh, wantStatus: 0},
+		{
+			name:   "same digest recorded",
+			record: &OperationRecord{OperationID: metadata.OperationID, RequestDigest: metadata.RequestDigest, Phase: OperationPhaseRecorded, RecordedAt: recordedAt},
+			want:   RequestClassificationDuplicate, wantStatus: http.StatusOK,
+		},
+		{
+			name:   "already accepted",
+			record: &OperationRecord{OperationID: metadata.OperationID, RequestDigest: metadata.RequestDigest, Phase: OperationPhaseAccepted, RecordedAt: recordedAt},
+			want:   RequestClassificationAlreadyAccepted, wantStatus: http.StatusOK,
+		},
+		{
+			name:   "settled",
+			record: &OperationRecord{OperationID: metadata.OperationID, RequestDigest: metadata.RequestDigest, Phase: OperationPhaseSettled, TerminalEvent: EventCompleted, RecordedAt: recordedAt},
+			want:   RequestClassificationSettled, wantStatus: http.StatusOK,
+		},
+		{
+			name:   "digest conflict",
+			record: &OperationRecord{OperationID: metadata.OperationID, RequestDigest: RequestDigest(testSHA256("request-b")), Phase: OperationPhaseAccepted, RecordedAt: recordedAt},
+			want:   RequestClassificationDigestConflict, wantStatus: http.StatusConflict,
+		},
+		{
+			name:   "stale instance wins before duplicate",
+			mutate: func(m *MutationMetadata) { m.Fence.RuntimeInstanceID = "old-instance" },
+			record: &OperationRecord{OperationID: metadata.OperationID, RequestDigest: metadata.RequestDigest, Phase: OperationPhaseAccepted, RecordedAt: recordedAt},
+			want:   RequestClassificationStaleFence, wantStatus: http.StatusGone,
+		},
+		{
+			name:   "expired",
+			mutate: func(m *MutationMetadata) { m.ExpiresAt = testNow },
+			want:   RequestClassificationExpired, wantStatus: http.StatusGone,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			incoming := metadata
+			if tt.mutate != nil {
+				tt.mutate(&incoming)
+			}
+			got, err := ClassifyOperation(expected, incoming, tt.record, true, testNow)
+			if err != nil {
+				t.Fatalf("ClassifyOperation() error = %v", err)
+			}
+			if got.Class != tt.want || got.HTTPStatus() != tt.wantStatus {
+				t.Fatalf("ClassifyOperation() = %#v (HTTP %d), want %q (HTTP %d)", got, got.HTTPStatus(), tt.want, tt.wantStatus)
+			}
+		})
+	}
+}
+
+func TestCompareFenceClassifiesEveryGenerationBoundaryAsStale(t *testing.T) {
+	expected := testFence(t)
+	tests := map[FenceMismatch]func(*Fence){
+		FenceMismatchRuntimeInstance:          func(f *Fence) { f.RuntimeInstanceID = testOtherFenceValue },
+		FenceMismatchSupervisorBoot:           func(f *Fence) { f.SupervisorBootID = testOtherFenceValue },
+		FenceMismatchControllerEpoch:          func(f *Fence) { f.ControllerEpoch++ },
+		FenceMismatchRuntimePoolUID:           func(f *Fence) { f.RuntimePoolUID = testOtherFenceValue },
+		FenceMismatchRuntimePoolGeneration:    func(f *Fence) { f.RuntimePoolGeneration++ },
+		FenceMismatchRuntimeSessionUID:        func(f *Fence) { f.RuntimeSessionUID = testOtherFenceValue },
+		FenceMismatchRuntimeSessionGeneration: func(f *Fence) { f.RuntimeSessionGeneration++ },
+		FenceMismatchRuntimeProfile:           func(f *Fence) { f.RuntimeProfileDigest = ProfileDigest(testSHA256(testOtherFenceValue)) },
+		FenceMismatchProfileSchema:            func(f *Fence) { f.ProfileDigestSchemaVersion++ },
+	}
+	for want, mutate := range tests {
+		t.Run(string(want), func(t *testing.T) {
+			request := expected
+			mutate(&request)
+			if got := CompareFence(expected, request, true); got != want {
+				t.Fatalf("CompareFence() = %q, want %q", got, want)
+			}
+		})
+	}
+}
+
+func TestRuntimeSessionTombstoneRetirementAndDuplicateProtection(t *testing.T) {
+	tombstone := RuntimeSessionTombstone{
+		RuntimeSessionUID:        "session-uid-1",
+		RuntimeSessionGeneration: 5,
+		RuntimeProfileDigest:     testFence(t).RuntimeProfileDigest,
+		DeletedAt:                testNow,
+		Operations: []OperationRecord{{
+			OperationID:   "delete-op",
+			RequestDigest: RequestDigest(testSHA256("delete-request")),
+			Phase:         OperationPhaseDeleted,
+			RecordedAt:    testNow.Add(-time.Minute),
+		}},
+	}
+	if err := tombstone.Validate(); err != nil {
+		t.Fatalf("tombstone.Validate() error = %v", err)
+	}
+	if tombstone.CanRetire("other-session", 99) || tombstone.CanRetire(tombstone.RuntimeSessionUID, 4) {
+		t.Fatal("tombstone retired before exact generation retirement")
+	}
+	if !tombstone.CanRetire(tombstone.RuntimeSessionUID, 5) {
+		t.Fatal("tombstone did not retire at retired-through generation")
+	}
+
+	tombstone.Operations = append(tombstone.Operations, tombstone.Operations[0])
+	if err := tombstone.Validate(); err == nil || !strings.Contains(err.Error(), "duplicate") {
+		t.Fatalf("duplicate tombstone operation validation = %v, want duplicate error", err)
+	}
+}
+
+func TestRuntimeSessionLifecycleAndSafeDeletion(t *testing.T) {
+	valid := [][2]RuntimeSessionState{
+		{RuntimeSessionStateCreating, RuntimeSessionStateIdle},
+		{RuntimeSessionStateIdle, RuntimeSessionStatePromptRunning},
+		{RuntimeSessionStatePromptRunning, RuntimeSessionStateValidating},
+		{RuntimeSessionStateValidating, RuntimeSessionStateIdle},
+		{RuntimeSessionStateValidating, RuntimeSessionStatePreparingPublication},
+		{RuntimeSessionStatePreparingPublication, RuntimeSessionStatePublicationPrepared},
+		{RuntimeSessionStatePublicationPrepared, RuntimeSessionStatePublishing},
+		{RuntimeSessionStatePublicationPrepared, RuntimeSessionStateFinalizing},
+		{RuntimeSessionStatePublishing, RuntimeSessionStateVerifying},
+		{RuntimeSessionStateFinalizing, RuntimeSessionStateDeleting},
+		{RuntimeSessionStateIdle, RuntimeSessionStateDeleting},
+		{RuntimeSessionStateDeleting, RuntimeSessionStateDeleted},
+	}
+	for _, transition := range valid {
+		if err := ValidateRuntimeSessionTransition(transition[0], transition[1]); err != nil {
+			t.Fatalf("ValidateRuntimeSessionTransition(%s,%s) error = %v", transition[0], transition[1], err)
+		}
+	}
+
+	for _, transition := range [][2]RuntimeSessionState{
+		{RuntimeSessionStateCreating, RuntimeSessionStatePromptRunning},
+		{RuntimeSessionStatePromptRunning, RuntimeSessionStateIdle},
+		{RuntimeSessionStateValidating, RuntimeSessionStateFinalizing},
+		{RuntimeSessionStatePublishing, RuntimeSessionStateCancelling},
+		{RuntimeSessionStateVerifying, RuntimeSessionStateFinalizing},
+		{RuntimeSessionStateFinalizing, RuntimeSessionStateIdle},
+		{RuntimeSessionStateDeleted, RuntimeSessionStateIdle},
+	} {
+		if err := ValidateRuntimeSessionTransition(transition[0], transition[1]); err == nil {
+			t.Fatalf("ValidateRuntimeSessionTransition(%s,%s) error = nil, want rejection", transition[0], transition[1])
+		}
+	}
+
+	if !RuntimeSessionStateIdle.CanEvict() || RuntimeSessionStateValidating.CanEvict() {
+		t.Fatal("only idle runtime sessions may be evicted")
+	}
+	if next, err := DeletionTransition(RuntimeSessionStatePromptRunning); err != nil || next != RuntimeSessionStateCancelling {
+		t.Fatalf("DeletionTransition(prompt_running) = %q, %v", next, err)
+	}
+	if next, err := DeletionTransition(RuntimeSessionStatePublishing); err == nil || next != RuntimeSessionStatePublishing {
+		t.Fatalf("DeletionTransition(publishing) = %q, %v, want blocked in publishing", next, err)
+	}
+	if next, err := DeletionTransition(RuntimeSessionStateFinalizing); err != nil || next != RuntimeSessionStateDeleting {
+		t.Fatalf("DeletionTransition(finalizing) = %q, %v, want retirement deletion", next, err)
+	}
+}
+
+func TestStopReasonMappingFailsClosed(t *testing.T) {
+	tests := []struct {
+		reason   ACPStopReason
+		proven   bool
+		event    EventType
+		outcome  PromptOutcome
+		validate bool
+		poison   bool
+	}{
+		{ACPStopReasonEndTurn, true, EventCompleted, PromptOutcomeSucceeded, true, false},
+		{ACPStopReasonCancelled, true, EventCancelled, PromptOutcomeCancelled, false, true},
+		{ACPStopReasonMaxTokens, true, EventFailed, PromptOutcomeFailed, false, true},
+		{ACPStopReasonMaxTurnRequests, true, EventFailed, PromptOutcomeFailed, false, true},
+		{ACPStopReasonRefusal, true, EventFailed, PromptOutcomeFailed, false, true},
+		{ACPStopReason("new_provider_reason"), true, EventFailed, PromptOutcomeFailed, false, true},
+		{ACPStopReasonEndTurn, false, EventOutcomeUnknown, PromptOutcomeUnknown, false, true},
+	}
+	for _, tt := range tests {
+		mapping := MapACPStopReason(tt.reason, tt.proven)
+		if mapping.EventType != tt.event || mapping.Outcome != tt.outcome ||
+			mapping.CanValidateWorkspace != tt.validate || mapping.PoisonSession != tt.poison {
+			t.Fatalf("MapACPStopReason(%q,%v) = %#v", tt.reason, tt.proven, mapping)
+		}
+	}
+	if !PromptOutcomeUnknown.RequiresExplicitNewTask() {
+		t.Fatal("OutcomeUnknown must require an explicit new Task")
+	}
+}
diff --git a/internal/harness/v2/client.go b/internal/harness/v2/client.go
new file mode 100644
index 000000000..1881380ca
--- /dev/null
+++ b/internal/harness/v2/client.go
@@ -0,0 +1,928 @@
+package v2
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"mime"
+	"net/http"
+	"net/http/httptrace"
+	"net/url"
+	"path"
+	"slices"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+const (
+	OperationCapabilityHeader = "X-Orka-Operation-Capability"
+
+	defaultControlTimeout       = 30 * time.Second
+	defaultMaxJSONResponseBytes = int64(MaxCanonicalJSONBytes)
+	defaultMaxErrorBodyBytes    = int64(64 << 10)
+)
+
+type ClientOption func(*Client) error
+
+// Client is a strict controller-side HTTP client for orka.harness.v2. It never
+// follows redirects, never logs credentials, and never retries mutating
+// requests. The same operation identity may be resent only by its caller after
+// inspecting RequestWriteEvidence and durable attempt state.
+type Client struct {
+	baseURL    *url.URL
+	basePrefix string
+	httpClient *http.Client
+
+	controlTimeout       time.Duration
+	controllerBearer     string
+	capabilitySecret     []byte
+	maxJSONResponseBytes int64
+	maxErrorBodyBytes    int64
+	traceReliable        bool
+
+	limitsMu sync.RWMutex
+	limits   ProtocolLimits
+}
+
+func WithHTTPClient(httpClient *http.Client) ClientOption {
+	return func(c *Client) error {
+		if httpClient == nil {
+			return fmt.Errorf("HTTP client is required")
+		}
+		clone := *httpClient
+		// Redirects would either leak the operation capability or silently route a
+		// fenced operation to a different instance. Return the redirect response
+		// to the caller instead.
+		clone.CheckRedirect = func(_ *http.Request, _ []*http.Request) error {
+			return http.ErrUseLastResponse
+		}
+		c.httpClient = &clone
+		c.traceReliable = transportSupportsHTTPTrace(clone.Transport)
+		return nil
+	}
+}
+
+func WithControlTimeout(timeout time.Duration) ClientOption {
+	return func(c *Client) error {
+		if timeout <= 0 {
+			return fmt.Errorf("control timeout must be positive")
+		}
+		c.controlTimeout = timeout
+		return nil
+	}
+}
+
+func WithControllerBearerToken(token string) ClientOption {
+	return func(c *Client) error {
+		token = strings.TrimSpace(token)
+		if len(token) < 32 {
+			return fmt.Errorf("controller bearer token must be at least 32 bytes")
+		}
+		if !validHeaderCredential(token) {
+			return fmt.Errorf("controller bearer token contains invalid header bytes")
+		}
+		c.controllerBearer = token
+		return nil
+	}
+}
+
+func WithOperationCapabilitySecret(secret []byte) ClientOption {
+	return func(c *Client) error {
+		if len(secret) < MinCapabilitySecretBytes {
+			return fmt.Errorf("operation capability secret must be at least %d bytes", MinCapabilitySecretBytes)
+		}
+		c.capabilitySecret = append(c.capabilitySecret[:0], secret...)
+		return nil
+	}
+}
+
+func WithResponseBodyLimit(maxBytes int64) ClientOption {
+	return func(c *Client) error {
+		if maxBytes <= 0 || maxBytes > int64(MaxCanonicalJSONBytes) {
+			return fmt.Errorf("JSON response limit must be in range 1..%d", MaxCanonicalJSONBytes)
+		}
+		c.maxJSONResponseBytes = maxBytes
+		return nil
+	}
+}
+
+// WithProtocolLimits configures negotiated limits before Capabilities has been
+// called. A later successful Capabilities call atomically replaces these values
+// with the supervisor-advertised limits.
+func WithProtocolLimits(limits ProtocolLimits) ClientOption {
+	return func(c *Client) error {
+		if err := limits.Validate(); err != nil {
+			return err
+		}
+		c.limits = limits
+		return nil
+	}
+}
+
+func NewClient(baseURL string, options ...ClientOption) (*Client, error) {
+	parsed, prefix, err := parseClientBaseURL(baseURL)
+	if err != nil {
+		return nil, clientError("new_client", ClientErrorConfiguration, err.Error(), err)
+	}
+	defaultHTTPClient := *http.DefaultClient
+	defaultHTTPClient.CheckRedirect = func(_ *http.Request, _ []*http.Request) error {
+		return http.ErrUseLastResponse
+	}
+	client := &Client{
+		baseURL:              parsed,
+		basePrefix:           prefix,
+		httpClient:           &defaultHTTPClient,
+		controlTimeout:       defaultControlTimeout,
+		maxJSONResponseBytes: defaultMaxJSONResponseBytes,
+		maxErrorBodyBytes:    defaultMaxErrorBodyBytes,
+		traceReliable:        true,
+		limits:               DefaultProtocolLimits(),
+	}
+	for _, option := range options {
+		if option == nil {
+			continue
+		}
+		if err := option(client); err != nil {
+			return nil, clientError("new_client", ClientErrorConfiguration, err.Error(), err)
+		}
+	}
+	return client, nil
+}
+
+func (c *Client) Health(ctx context.Context) (*HealthResponse, error) {
+	const operation = "health"
+	var response HealthResponse
+	if err := c.getJSON(ctx, operation, HealthPath, false, &response); err != nil {
+		return nil, err
+	}
+	if err := response.Validate(); err != nil {
+		return nil, c.protocolError(operation, 0, err)
+	}
+	return &response, nil
+}
+
+func (c *Client) Capabilities(ctx context.Context) (*CapabilitiesResponse, error) {
+	const operation = "capabilities"
+	var response CapabilitiesResponse
+	if err := c.getJSON(ctx, operation, CapabilitiesPath, false, &response); err != nil {
+		return nil, err
+	}
+	if err := response.Validate(); err != nil {
+		return nil, c.protocolError(operation, 0, err)
+	}
+	c.limitsMu.Lock()
+	c.limits = response.Limits
+	c.limitsMu.Unlock()
+	return &response, nil
+}
+
+func (c *Client) Status(ctx context.Context) (*StatusResponse, error) {
+	const operation = "status"
+	if err := c.requireControllerAuth(operation); err != nil {
+		return nil, err
+	}
+	var response StatusResponse
+	if err := c.getJSON(ctx, operation, StatusPath, true, &response); err != nil {
+		return nil, err
+	}
+	if err := response.Validate(); err != nil {
+		return nil, c.protocolError(operation, 0, err)
+	}
+	return &response, nil
+}
+
+func (c *Client) CreateRuntimeSession(ctx context.Context, request CreateRuntimeSessionRequest) (*CreateRuntimeSessionResponse, error) {
+	const operation = "create_runtime_session"
+	now := time.Now().UTC()
+	if err := request.ValidateAt(now); err != nil {
+		return nil, c.validationError(operation, err)
+	}
+	relative, err := RuntimeSessionPath(request.RuntimeSessionID)
+	if err != nil {
+		return nil, c.validationError(operation, err)
+	}
+	var response CreateRuntimeSessionResponse
+	if err := c.mutateJSON(ctx, operation, http.MethodPut, relative, request.Metadata, request, &response); err != nil {
+		return nil, err
+	}
+	if err := response.ValidateFor(request); err != nil {
+		return nil, c.protocolError(operation, 0, err)
+	}
+	if err := validateSuccessClassification(operation, response.Classification, RequestClassificationFresh, RequestClassificationDuplicate); err != nil {
+		return nil, c.protocolError(operation, 0, err)
+	}
+	return &response, nil
+}
+
+func (c *Client) FinalizeRuntimeSessionPublication(ctx context.Context, sessionID RuntimeSessionID, request FinalizeRuntimeSessionPublicationRequest) (*FinalizeRuntimeSessionPublicationResponse, error) {
+	const operation = "finalize_runtime_session_publication"
+	if err := request.ValidateAt(time.Now().UTC()); err != nil {
+		return nil, c.validationError(operation, err)
+	}
+	relative, err := RuntimeSessionPublicationFinalizationPath(sessionID)
+	if err != nil {
+		return nil, c.validationError(operation, err)
+	}
+	var response FinalizeRuntimeSessionPublicationResponse
+	if err := c.mutateJSON(ctx, operation, http.MethodPut, relative, request.Metadata, request, &response); err != nil {
+		return nil, err
+	}
+	if err := response.ValidateFor(request); err != nil {
+		return nil, c.protocolError(operation, 0, err)
+	}
+	if err := validateSuccessClassification(operation, response.Classification, RequestClassificationFresh, RequestClassificationDuplicate); err != nil {
+		return nil, c.protocolError(operation, 0, err)
+	}
+	return &response, nil
+}
+
+func (c *Client) DeleteRuntimeSession(ctx context.Context, sessionID RuntimeSessionID, request DeleteRuntimeSessionRequest) (*DeleteRuntimeSessionResponse, error) {
+	const operation = "delete_runtime_session"
+	now := time.Now().UTC()
+	if err := request.ValidateAt(now); err != nil {
+		return nil, c.validationError(operation, err)
+	}
+	relative, err := RuntimeSessionPath(sessionID)
+	if err != nil {
+		return nil, c.validationError(operation, err)
+	}
+	var response DeleteRuntimeSessionResponse
+	if err := c.mutateJSON(ctx, operation, http.MethodDelete, relative, request.Metadata, request, &response); err != nil {
+		return nil, err
+	}
+	if err := response.ValidateFor(request); err != nil {
+		return nil, c.protocolError(operation, 0, err)
+	}
+	return &response, nil
+}
+
+func (c *Client) RenewPromptLease(ctx context.Context, sessionID RuntimeSessionID, request RenewPromptLeaseRequest) (*PromptLeaseResponse, error) {
+	const operation = "renew_prompt_lease"
+	limits := c.protocolLimits()
+	now := time.Now().UTC()
+	maxLease := time.Duration(limits.MaxPromptLeaseMillis) * time.Millisecond
+	if err := request.ValidateAt(now, maxLease); err != nil {
+		return nil, c.validationError(operation, err)
+	}
+	relative, err := PromptLeasePath(sessionID, request.Metadata.PromptID)
+	if err != nil {
+		return nil, c.validationError(operation, err)
+	}
+	var response PromptLeaseResponse
+	if err := c.mutateJSON(ctx, operation, http.MethodPut, relative, request.Metadata, request, &response); err != nil {
+		return nil, err
+	}
+	if err := response.ValidateAt(time.Now().UTC(), maxLease); err != nil {
+		return nil, c.protocolError(operation, 0, err)
+	}
+	if err := validateSuccessClassification(operation, response.Classification, RequestClassificationFresh, RequestClassificationDuplicate); err != nil {
+		return nil, c.protocolError(operation, 0, err)
+	}
+	if response.Lease.Generation != request.Lease.Generation ||
+		!response.Lease.IssuedAt.Equal(request.Lease.IssuedAt) ||
+		!response.Lease.ExpiresAt.Equal(request.Lease.ExpiresAt) {
+		return nil, c.protocolError(operation, 0, fmt.Errorf("lease response does not match proposed lease"))
+	}
+	return &response, nil
+}
+
+func (c *Client) ResolvePermission(ctx context.Context, sessionID RuntimeSessionID, request ResolvePermissionRequest) (*PermissionResolutionResponse, error) {
+	const operation = "resolve_permission"
+	if err := request.ValidateAt(time.Now().UTC()); err != nil {
+		return nil, c.validationError(operation, err)
+	}
+	relative, err := PromptPermissionPath(sessionID, request.Metadata.PromptID, request.RequestID)
+	if err != nil {
+		return nil, c.validationError(operation, err)
+	}
+	var response PermissionResolutionResponse
+	if err := c.mutateJSON(ctx, operation, http.MethodPut, relative, request.Metadata, request, &response); err != nil {
+		return nil, err
+	}
+	if err := response.Validate(); err != nil {
+		return nil, c.protocolError(operation, 0, err)
+	}
+	if err := validateSuccessClassification(operation, response.Classification, RequestClassificationFresh, RequestClassificationDuplicate); err != nil {
+		return nil, c.protocolError(operation, 0, err)
+	}
+	if response.State != PermissionResolutionCancelledByPrompt && response.Decision != request.Decision {
+		return nil, c.protocolError(operation, 0, fmt.Errorf("permission response decision does not match request"))
+	}
+	return &response, nil
+}
+
+func (c *Client) CancelPrompt(ctx context.Context, sessionID RuntimeSessionID, request CancelPromptRequest) (*CancelPromptResponse, error) {
+	const operation = "cancel_prompt"
+	if err := request.ValidateAt(time.Now().UTC()); err != nil {
+		return nil, c.validationError(operation, err)
+	}
+	relative, err := PromptCancelPath(sessionID, request.Metadata.PromptID)
+	if err != nil {
+		return nil, c.validationError(operation, err)
+	}
+	var response CancelPromptResponse
+	if err := c.mutateJSON(ctx, operation, http.MethodPut, relative, request.Metadata, request, &response); err != nil {
+		return nil, err
+	}
+	if err := response.Validate(); err != nil {
+		return nil, c.protocolError(operation, 0, err)
+	}
+	if err := validateSuccessClassification(operation, response.Classification, RequestClassificationFresh, RequestClassificationDuplicate, RequestClassificationSettled); err != nil {
+		return nil, c.protocolError(operation, 0, err)
+	}
+	if response.Classification.Class == RequestClassificationSettled && response.Classification.TerminalEvent != response.Settlement.TerminalEvent {
+		return nil, c.protocolError(operation, 0, fmt.Errorf("settled cancellation classification does not match settlement"))
+	}
+	return &response, nil
+}
+
+func (c *Client) CreateWorkspaceDelta(ctx context.Context, sessionID RuntimeSessionID, request CreateWorkspaceDeltaRequest) (*CreateWorkspaceDeltaResponse, error) {
+	const operation = "create_workspace_delta"
+	if err := request.ValidateAt(time.Now().UTC()); err != nil {
+		return nil, c.validationError(operation, err)
+	}
+	relative, err := WorkspaceDeltaPath(sessionID, request.DeltaID)
+	if err != nil {
+		return nil, c.validationError(operation, err)
+	}
+	var response CreateWorkspaceDeltaResponse
+	if err := c.mutateJSON(ctx, operation, http.MethodPut, relative, request.Metadata, request, &response); err != nil {
+		return nil, err
+	}
+	if err := response.ValidateFor(request); err != nil {
+		return nil, c.protocolError(operation, 0, err)
+	}
+	if err := validateSuccessClassification(operation, response.Classification, RequestClassificationFresh, RequestClassificationDuplicate); err != nil {
+		return nil, c.protocolError(operation, 0, err)
+	}
+	return &response, nil
+}
+
+func (c *Client) Drain(ctx context.Context, request DrainRequest) (*DrainResponse, error) {
+	const operation = "drain"
+	if err := request.ValidateAt(time.Now().UTC()); err != nil {
+		return nil, c.validationError(operation, err)
+	}
+	var response DrainResponse
+	if err := c.mutateJSON(ctx, operation, http.MethodPut, DrainPath, request.Metadata, request, &response); err != nil {
+		return nil, err
+	}
+	if err := response.Validate(); err != nil {
+		return nil, c.protocolError(operation, 0, err)
+	}
+	if err := validateSuccessClassification(operation, response.Classification, RequestClassificationFresh, RequestClassificationDuplicate); err != nil {
+		return nil, c.protocolError(operation, 0, err)
+	}
+	return &response, nil
+}
+
+func (c *Client) getJSON(ctx context.Context, operation, relative string, authenticated bool, out any) error {
+	if c == nil {
+		return clientError(operation, ClientErrorConfiguration, "client is nil", ErrClientConfiguration)
+	}
+	endpoint, err := c.endpoint(relative)
+	if err != nil {
+		return c.validationError(operation, err)
+	}
+	requestCtx, cancel := c.controlContext(ctx, time.Time{})
+	defer cancel()
+	req, err := http.NewRequestWithContext(requestCtx, http.MethodGet, endpoint.String(), nil)
+	if err != nil {
+		return c.validationError(operation, err)
+	}
+	setCommonHeaders(req, "application/json")
+	if authenticated {
+		req.Header.Set("Authorization", "Bearer "+c.controllerBearer)
+	}
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return c.transportError(operation, requestCtx, err, nil, "")
+	}
+	defer resp.Body.Close() //nolint:errcheck
+	if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusMultipleChoices {
+		return c.decodeHTTPError(operation, resp, nil, "")
+	}
+	if err := requireMediaType(resp.Header.Get("Content-Type"), "application/json"); err != nil {
+		return c.protocolError(operation, resp.StatusCode, err)
+	}
+	body, err := readBoundedResponseBody(resp, c.maxJSONResponseBytes)
+	if err != nil {
+		return c.protocolError(operation, resp.StatusCode, err)
+	}
+	if protocolErr := decodeSuccessJSON(body, out); protocolErr != nil {
+		return c.protocolError(operation, resp.StatusCode, protocolErr)
+	}
+	return nil
+}
+
+func (c *Client) mutateJSON(
+	ctx context.Context,
+	operation, method, relative string,
+	metadata MutationMetadata,
+	input, output any,
+) error {
+	if err := c.requireMutationAuth(operation); err != nil {
+		return err
+	}
+	payload, err := json.Marshal(input)
+	if err != nil {
+		return c.validationError(operation, fmt.Errorf("encode request: %w", err))
+	}
+	limits := c.protocolLimits()
+	if len(payload) > limits.MaxRequestBytes {
+		return c.validationError(operation, fmt.Errorf("request body is %d bytes, limit %d", len(payload), limits.MaxRequestBytes))
+	}
+	capability, err := SignOperationCapability(c.capabilitySecret, ClaimsForMutation(metadata))
+	if err != nil {
+		return c.validationError(operation, fmt.Errorf("sign operation capability: %w", err))
+	}
+	endpoint, err := c.endpoint(relative)
+	if err != nil {
+		return c.validationError(operation, err)
+	}
+	requestCtx, cancel := c.controlContext(ctx, metadata.ExpiresAt)
+	defer cancel()
+	tracker := newRequestTrace(c.traceReliable)
+	req, err := newTrackedRequest(requestCtx, method, endpoint.String(), payload, tracker)
+	if err != nil {
+		return c.validationError(operation, err)
+	}
+	setCommonHeaders(req, "application/json")
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+c.controllerBearer)
+	req.Header.Set(OperationCapabilityHeader, capability)
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return c.transportError(operation, requestCtx, err, tracker, capability)
+	}
+	defer resp.Body.Close() //nolint:errcheck
+	if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusMultipleChoices {
+		return c.decodeHTTPError(operation, resp, tracker, capability)
+	}
+	if err := requireMediaType(resp.Header.Get("Content-Type"), "application/json"); err != nil {
+		return c.protocolErrorWithEvidence(operation, resp.StatusCode, err, tracker.evidence(), capability)
+	}
+	body, err := readBoundedResponseBody(resp, c.maxJSONResponseBytes)
+	if err != nil {
+		return c.protocolErrorWithEvidence(operation, resp.StatusCode, err, tracker.evidence(), capability)
+	}
+	if envelope, ok, envelopeErr := decodeErrorEnvelope(body); envelopeErr != nil {
+		return c.protocolErrorWithEvidence(operation, resp.StatusCode, envelopeErr, tracker.evidence(), capability)
+	} else if ok {
+		return c.httpError(operation, resp.StatusCode, envelope, tracker.evidence(), capability)
+	}
+	if err := decodeSuccessJSON(body, output); err != nil {
+		return c.protocolErrorWithEvidence(operation, resp.StatusCode, err, tracker.evidence(), capability)
+	}
+	return nil
+}
+
+func (c *Client) decodeHTTPError(operation string, response *http.Response, tracker *requestTrace, capability string) error {
+	evidence := RequestWriteEvidence{State: RequestWriteUnknown}
+	if tracker != nil {
+		evidence = tracker.evidence()
+	}
+	if err := requireMediaType(response.Header.Get("Content-Type"), "application/json"); err != nil {
+		return c.protocolErrorWithEvidence(operation, response.StatusCode, err, evidence, capability)
+	}
+	body, err := readBoundedResponseBody(response, c.maxErrorBodyBytes)
+	if err != nil {
+		return c.protocolErrorWithEvidence(operation, response.StatusCode, err, evidence, capability)
+	}
+	errorResponse, ok, err := decodeErrorEnvelope(body)
+	if err != nil {
+		return c.protocolErrorWithEvidence(operation, response.StatusCode, err, evidence, capability)
+	}
+	if !ok {
+		return c.protocolErrorWithEvidence(operation, response.StatusCode, fmt.Errorf("HTTP error response is not a v2 ErrorResponse"), evidence, capability)
+	}
+	return c.httpError(operation, response.StatusCode, errorResponse, evidence, capability)
+}
+
+func (c *Client) httpError(operation string, status int, response ErrorResponse, evidence RequestWriteEvidence, capability string) error {
+	if err := validateHTTPErrorMapping(status, response); err != nil {
+		return c.protocolErrorWithEvidence(operation, status, err, evidence, capability)
+	}
+	message := c.redact(response.Message, capability)
+	clientErr := &ClientError{
+		Operation:     operation,
+		Kind:          ClientErrorHTTP,
+		StatusCode:    status,
+		Code:          response.Code,
+		Retryable:     response.Retryable,
+		Message:       message,
+		WriteEvidence: evidence,
+	}
+	if response.Classification != nil {
+		classification := *response.Classification
+		clientErr.Classification = &classification
+	}
+	return clientErr
+}
+
+func (c *Client) requireControllerAuth(operation string) error {
+	if c == nil {
+		return clientError(operation, ClientErrorConfiguration, "client is nil", ErrClientConfiguration)
+	}
+	if c.controllerBearer == "" {
+		return clientError(operation, ClientErrorConfiguration, "controller bearer token is required", ErrClientConfiguration)
+	}
+	return nil
+}
+
+func (c *Client) requireMutationAuth(operation string) error {
+	if err := c.requireControllerAuth(operation); err != nil {
+		return err
+	}
+	if len(c.capabilitySecret) < MinCapabilitySecretBytes {
+		return clientError(operation, ClientErrorConfiguration, "operation capability secret is required", ErrClientConfiguration)
+	}
+	return nil
+}
+
+func (c *Client) protocolLimits() ProtocolLimits {
+	c.limitsMu.RLock()
+	defer c.limitsMu.RUnlock()
+	return c.limits
+}
+
+func (c *Client) controlContext(ctx context.Context, expiry time.Time) (context.Context, context.CancelFunc) {
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	deadline := time.Now().Add(c.controlTimeout)
+	if existing, ok := ctx.Deadline(); ok && existing.Before(deadline) {
+		deadline = existing
+	}
+	if !expiry.IsZero() && expiry.Before(deadline) {
+		deadline = expiry
+	}
+	return context.WithDeadline(ctx, deadline)
+}
+
+func (c *Client) endpoint(relative string) (*url.URL, error) {
+	if c == nil || c.baseURL == nil {
+		return nil, fmt.Errorf("client base URL is not configured")
+	}
+	if err := validateRelativeEndpoint(relative); err != nil {
+		return nil, err
+	}
+	resolved := *c.baseURL
+	resolved.Path = c.basePrefix + relative
+	resolved.RawPath = ""
+	resolved.RawQuery = ""
+	resolved.Fragment = ""
+	return &resolved, nil
+}
+
+func (c *Client) validationError(operation string, err error) error {
+	message := c.redact(err.Error(), "")
+	return clientError(operation, ClientErrorValidation, message, ErrClientValidation)
+}
+
+func (c *Client) protocolError(operation string, status int, err error) error {
+	return c.protocolErrorWithEvidence(operation, status, err, RequestWriteEvidence{State: RequestWriteUnknown}, "")
+}
+
+func (c *Client) protocolErrorWithEvidence(operation string, status int, err error, evidence RequestWriteEvidence, capability string) error {
+	message := c.redact(err.Error(), capability)
+	cause := err
+	if !errors.Is(err, ErrResponseBodyTooLarge) {
+		cause = ErrClientProtocol
+	}
+	return &ClientError{
+		Operation: operation, Kind: ClientErrorProtocol, StatusCode: status,
+		Message: message, WriteEvidence: evidence, cause: cause,
+	}
+}
+
+func (c *Client) transportError(operation string, requestCtx context.Context, transportErr error, tracker *requestTrace, capability string) error {
+	evidence := RequestWriteEvidence{State: RequestWriteUnknown}
+	if tracker != nil {
+		evidence = tracker.evidence()
+	}
+	cause := transportErr
+	if requestCtx != nil && requestCtx.Err() != nil {
+		cause = requestCtx.Err()
+	}
+	message := c.redact(cause.Error(), capability)
+	// Do not retain an arbitrary RoundTripper error that may include request
+	// headers. Preserve only context cancellation sentinels; otherwise unwrap to
+	// the stable transport sentinel.
+	if !errors.Is(cause, context.Canceled) && !errors.Is(cause, context.DeadlineExceeded) {
+		cause = ErrClientTransport
+	}
+	return &ClientError{
+		Operation: operation, Kind: ClientErrorTransport, Message: message,
+		WriteEvidence: evidence, cause: cause,
+	}
+}
+
+func (c *Client) redact(message, capability string) string {
+	for _, secret := range []string{c.controllerBearer, capability} {
+		if secret == "" {
+			continue
+		}
+		message = strings.ReplaceAll(message, secret, "[REDACTED]")
+	}
+	return message
+}
+
+func parseClientBaseURL(raw string) (*url.URL, string, error) {
+	raw = strings.TrimSpace(raw)
+	parsed, err := url.Parse(raw)
+	if err != nil {
+		return nil, "", fmt.Errorf("parse base URL: %w", err)
+	}
+	if parsed.Scheme != "http" && parsed.Scheme != "https" {
+		return nil, "", fmt.Errorf("base URL scheme must be http or https")
+	}
+	if parsed.Host == "" {
+		return nil, "", fmt.Errorf("base URL must include a host")
+	}
+	if parsed.User != nil || parsed.Opaque != "" || parsed.RawQuery != "" || parsed.ForceQuery || parsed.Fragment != "" {
+		return nil, "", fmt.Errorf("base URL must not contain userinfo, opaque data, query, or fragment")
+	}
+	if parsed.RawPath != "" || strings.Contains(parsed.Path, "\\") {
+		return nil, "", fmt.Errorf("base URL path must not contain escaped or backslash path bytes")
+	}
+	prefix := strings.TrimSuffix(parsed.Path, "/")
+	if prefix == "/" {
+		prefix = ""
+	}
+	if prefix != "" {
+		if !strings.HasPrefix(prefix, "/") || path.Clean(prefix) != prefix {
+			return nil, "", fmt.Errorf("base URL path must be canonical and traversal-free")
+		}
+		for segment := range strings.SplitSeq(strings.TrimPrefix(prefix, "/"), "/") {
+			if segment == "" || segment == "." || segment == ".." {
+				return nil, "", fmt.Errorf("base URL path contains an unsafe segment")
+			}
+		}
+	}
+	parsed.Path = prefix
+	return parsed, prefix, nil
+}
+
+func validateRelativeEndpoint(relative string) error {
+	if relative == "" || !strings.HasPrefix(relative, "/v2/") {
+		return fmt.Errorf("endpoint path must be an absolute /v2 path")
+	}
+	if strings.ContainsAny(relative, "?#\\\r\n") || strings.Contains(relative, "//") || path.Clean(relative) != relative {
+		return fmt.Errorf("endpoint path is not canonical")
+	}
+	for segment := range strings.SplitSeq(strings.TrimPrefix(relative, "/"), "/") {
+		if segment == "" || segment == "." || segment == ".." {
+			return fmt.Errorf("endpoint path contains an unsafe segment")
+		}
+	}
+	return nil
+}
+
+func validHeaderCredential(value string) bool {
+	if strings.TrimSpace(value) != value || value == "" {
+		return false
+	}
+	for i := 0; i < len(value); i++ {
+		if value[i] <= 0x20 || value[i] >= 0x7f {
+			return false
+		}
+	}
+	return true
+}
+
+func setCommonHeaders(request *http.Request, accept string) {
+	request.Header.Set("Accept", accept)
+	request.Header.Set("Accept-Encoding", "identity")
+}
+
+func requireMediaType(header, expected string) error {
+	if strings.TrimSpace(header) == "" {
+		return fmt.Errorf("response Content-Type is required; want %s", expected)
+	}
+	mediaType, _, err := mime.ParseMediaType(header)
+	if err != nil {
+		return fmt.Errorf("parse response Content-Type: %w", err)
+	}
+	if !strings.EqualFold(mediaType, expected) {
+		return fmt.Errorf("response Content-Type %q is unsupported; want %q", mediaType, expected)
+	}
+	return nil
+}
+
+func readBoundedResponseBody(response *http.Response, limit int64) ([]byte, error) {
+	if response == nil || response.Body == nil {
+		return nil, fmt.Errorf("response body is required")
+	}
+	if limit <= 0 {
+		return nil, fmt.Errorf("response body limit must be positive")
+	}
+	if response.ContentLength > limit {
+		return nil, fmt.Errorf("%w: content length %d exceeds limit %d", ErrResponseBodyTooLarge, response.ContentLength, limit)
+	}
+	body, err := io.ReadAll(io.LimitReader(response.Body, limit+1))
+	if err != nil {
+		return nil, fmt.Errorf("read response body: %w", err)
+	}
+	if int64(len(body)) > limit {
+		return nil, fmt.Errorf("%w: body exceeds limit %d", ErrResponseBodyTooLarge, limit)
+	}
+	if len(bytes.TrimSpace(body)) == 0 {
+		return nil, fmt.Errorf("response body is empty")
+	}
+	return body, nil
+}
+
+func decodeSuccessJSON(body []byte, output any) error {
+	if output == nil {
+		return fmt.Errorf("response target is required")
+	}
+	if _, err := parseCanonicalJSON(body); err != nil {
+		return fmt.Errorf("invalid JSON response: %w", err)
+	}
+	decoder := json.NewDecoder(bytes.NewReader(body))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(output); err != nil {
+		return fmt.Errorf("decode JSON response: %w", err)
+	}
+	if err := ensureJSONEOF(decoder); err != nil {
+		return fmt.Errorf("decode JSON response: %w", err)
+	}
+	return nil
+}
+
+func decodeErrorEnvelope(body []byte) (ErrorResponse, bool, error) {
+	if _, err := parseCanonicalJSON(body); err != nil {
+		return ErrorResponse{}, false, fmt.Errorf("invalid JSON error response: %w", err)
+	}
+	var discriminator struct {
+		Code ErrorCode `json:"code"`
+	}
+	if err := json.Unmarshal(body, &discriminator); err != nil {
+		return ErrorResponse{}, false, fmt.Errorf("decode error discriminator: %w", err)
+	}
+	if discriminator.Code == "" {
+		return ErrorResponse{}, false, nil
+	}
+	var response ErrorResponse
+	decoder := json.NewDecoder(bytes.NewReader(body))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&response); err != nil {
+		return ErrorResponse{}, false, fmt.Errorf("decode v2 ErrorResponse: %w", err)
+	}
+	if err := ensureJSONEOF(decoder); err != nil {
+		return ErrorResponse{}, false, fmt.Errorf("decode v2 ErrorResponse: %w", err)
+	}
+	if err := response.Validate(); err != nil {
+		return ErrorResponse{}, false, fmt.Errorf("invalid v2 ErrorResponse: %w", err)
+	}
+	return response, true, nil
+}
+
+func validateHTTPErrorMapping(status int, response ErrorResponse) error {
+	if err := response.Validate(); err != nil {
+		return err
+	}
+	if response.Classification != nil {
+		classification := *response.Classification
+		if classification.Class == RequestClassificationFresh {
+			return fmt.Errorf("error response must not carry fresh classification")
+		}
+		if response.Code != classificationCode(classification.Class) {
+			return fmt.Errorf("error code %q does not match classification %q", response.Code, classification.Class)
+		}
+		expectedStatus := classification.HTTPStatus()
+		if classification.Class == RequestClassificationDuplicate {
+			expectedStatus = http.StatusConflict
+		}
+		if expectedStatus != status {
+			return fmt.Errorf("HTTP status %d does not match classification %q status %d", status, classification.Class, expectedStatus)
+		}
+		return nil
+	}
+	allowed := map[ErrorCode]map[int]struct{}{
+		ErrorCodeInvalidRequest:  {http.StatusBadRequest: {}, http.StatusNotFound: {}, http.StatusConflict: {}, http.StatusNotImplemented: {}},
+		ErrorCodeUnauthenticated: {http.StatusUnauthorized: {}},
+		ErrorCodeForbidden:       {http.StatusForbidden: {}},
+		ErrorCodeExpired:         {http.StatusGone: {}},
+		ErrorCodeStaleFence:      {http.StatusGone: {}},
+		ErrorCodeDigestConflict:  {http.StatusConflict: {}},
+		ErrorCodeAlreadyAccepted: {http.StatusConflict: {}},
+		ErrorCodeSettled:         {http.StatusGone: {}},
+		ErrorCodeRateLimited:     {http.StatusTooManyRequests: {}},
+		ErrorCodeSessionPoisoned: {http.StatusConflict: {}, http.StatusBadGateway: {}, http.StatusInternalServerError: {}},
+		ErrorCodeOutcomeUnknown:  {http.StatusInternalServerError: {}},
+	}
+	statuses, ok := allowed[response.Code]
+	if !ok {
+		return fmt.Errorf("unsupported error code %q", response.Code)
+	}
+	if _, ok := statuses[status]; !ok {
+		return fmt.Errorf("HTTP status %d is invalid for error code %q", status, response.Code)
+	}
+	return nil
+}
+
+func validateSuccessClassification(operation string, classification Classification, allowed ...RequestClassification) error {
+	if err := classification.Validate(); err != nil {
+		return fmt.Errorf("%s classification: %w", operation, err)
+	}
+	if slices.Contains(allowed, classification.Class) {
+		return nil
+	}
+	return fmt.Errorf("%s returned unsupported success classification %q", operation, classification.Class)
+}
+
+type requestTrace struct {
+	traceReliable bool
+	bodyBytesRead atomic.Int64
+	wroteHeaders  atomic.Bool
+	wroteRequest  atomic.Bool
+	wroteReqError atomic.Bool
+	gotFirstByte  atomic.Bool
+}
+
+func newRequestTrace(reliable bool) *requestTrace {
+	return &requestTrace{traceReliable: reliable}
+}
+
+func (t *requestTrace) clientTrace() *httptrace.ClientTrace {
+	return &httptrace.ClientTrace{
+		WroteHeaders: func() {
+			t.wroteHeaders.Store(true)
+		},
+		WroteRequest: func(info httptrace.WroteRequestInfo) {
+			t.wroteRequest.Store(info.Err == nil)
+			t.wroteReqError.Store(info.Err != nil)
+		},
+		GotFirstResponseByte: func() {
+			t.gotFirstByte.Store(true)
+		},
+	}
+}
+
+func (t *requestTrace) evidence() RequestWriteEvidence {
+	if t == nil {
+		return RequestWriteEvidence{State: RequestWriteUnknown}
+	}
+	evidence := RequestWriteEvidence{
+		State:                RequestWriteAmbiguous,
+		RequestBodyBytesRead: t.bodyBytesRead.Load(),
+		WroteHeaders:         t.wroteHeaders.Load(),
+		WroteRequest:         t.wroteRequest.Load(),
+		WroteRequestError:    t.wroteReqError.Load(),
+		GotFirstResponseByte: t.gotFirstByte.Load(),
+	}
+	switch {
+	case evidence.WroteRequest:
+		evidence.State = RequestWriteComplete
+	case t.traceReliable && !evidence.WroteHeaders && evidence.RequestBodyBytesRead == 0 && !evidence.GotFirstResponseByte:
+		evidence.State = RequestWriteZeroBytes
+	default:
+		evidence.State = RequestWriteAmbiguous
+	}
+	return evidence
+}
+
+type trackedBody struct {
+	reader  *bytes.Reader
+	tracker *requestTrace
+}
+
+func (b *trackedBody) Read(buffer []byte) (int, error) {
+	n, err := b.reader.Read(buffer)
+	if n > 0 {
+		b.tracker.bodyBytesRead.Add(int64(n))
+	}
+	return n, err
+}
+
+func (b *trackedBody) Close() error { return nil }
+
+func newTrackedRequest(ctx context.Context, method, endpoint string, payload []byte, tracker *requestTrace) (*http.Request, error) {
+	body := &trackedBody{reader: bytes.NewReader(payload), tracker: tracker}
+	tracedContext := httptrace.WithClientTrace(ctx, tracker.clientTrace())
+	request, err := http.NewRequestWithContext(tracedContext, method, endpoint, body)
+	if err != nil {
+		return nil, fmt.Errorf("build HTTP request: %w", err)
+	}
+	request.ContentLength = int64(len(payload))
+	// A nil GetBody prevents net/http from automatically replaying an idempotent
+	// PUT/DELETE after a connection failure. Replay classification belongs to the
+	// durable controller state machine, never the transport.
+	request.GetBody = nil
+	return request, nil
+}
+
+func transportSupportsHTTPTrace(roundTripper http.RoundTripper) bool {
+	if roundTripper == nil {
+		return true
+	}
+	_, ok := roundTripper.(*http.Transport)
+	return ok
+}
diff --git a/internal/harness/v2/client_errors.go b/internal/harness/v2/client_errors.go
new file mode 100644
index 000000000..484a6150c
--- /dev/null
+++ b/internal/harness/v2/client_errors.go
@@ -0,0 +1,159 @@
+package v2
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+)
+
+var (
+	// ErrClientConfiguration marks an invalid client configuration or a missing
+	// credential required for an authenticated operation.
+	ErrClientConfiguration = errors.New("harness v2 client configuration error")
+	// ErrClientValidation marks a locally rejected request or identifier.
+	ErrClientValidation = errors.New("harness v2 client validation error")
+	// ErrClientTransport marks an HTTP transport failure before a response was
+	// available.
+	ErrClientTransport = errors.New("harness v2 client transport error")
+	// ErrClientProtocol marks a malformed, oversized, version-skewed, or otherwise
+	// contract-incompatible HTTP response.
+	ErrClientProtocol = errors.New("harness v2 client protocol error")
+	// ErrClientStream marks a prompt stream failure after the response was opened.
+	ErrClientStream = errors.New("harness v2 client stream error")
+	// ErrResponseBodyTooLarge marks a bounded JSON or error body overflow.
+	ErrResponseBodyTooLarge = errors.New("harness v2 response body too large")
+	// ErrPromptStreamDisconnected marks a non-EOF transport failure while reading
+	// the non-reconnectable prompt stream.
+	ErrPromptStreamDisconnected = errors.New("harness v2 prompt stream disconnected")
+)
+
+type ClientErrorKind string
+
+const (
+	ClientErrorConfiguration ClientErrorKind = "configuration"
+	ClientErrorValidation    ClientErrorKind = "validation"
+	ClientErrorTransport     ClientErrorKind = "transport"
+	ClientErrorHTTP          ClientErrorKind = "http"
+	ClientErrorProtocol      ClientErrorKind = "protocol"
+	ClientErrorStream        ClientErrorKind = "stream"
+)
+
+// RequestWriteState is conservative transport evidence for a mutating request.
+// It never treats an unknown/custom RoundTripper as proof that a request was not
+// accepted.
+type RequestWriteState string
+
+const (
+	RequestWriteUnknown   RequestWriteState = "unknown"
+	RequestWriteZeroBytes RequestWriteState = "zero_bytes_written"
+	RequestWriteComplete  RequestWriteState = "request_written"
+	RequestWriteAmbiguous RequestWriteState = "request_write_ambiguous"
+)
+
+// RequestWriteEvidence captures only observations exposed by net/http and
+// httptrace. ZeroBytes is reported only for the standard net/http transport when
+// no headers were reported written, no body bytes were consumed, and the full
+// request was not reported written. All other incomplete writes are ambiguous.
+type RequestWriteEvidence struct {
+	State                RequestWriteState
+	RequestBodyBytesRead int64
+	WroteHeaders         bool
+	WroteRequest         bool
+	WroteRequestError    bool
+	GotFirstResponseByte bool
+}
+
+// SafeToResendSameIdentity reports whether the transport proved that no request
+// bytes were written. It never authorizes allocating a new prompt identity.
+func (e RequestWriteEvidence) SafeToResendSameIdentity() bool {
+	return e.State == RequestWriteZeroBytes
+}
+
+// ClientError is the exact typed error returned by the v2 client. HTTP protocol
+// errors retain the validated v2 code and replay classification. Authentication
+// values are never included in Message or Error().
+type ClientError struct {
+	Operation      string
+	Kind           ClientErrorKind
+	StatusCode     int
+	Code           ErrorCode
+	Classification *Classification
+	Retryable      bool
+	Message        string
+	WriteEvidence  RequestWriteEvidence
+	cause          error
+}
+
+func (e *ClientError) Error() string {
+	if e == nil {
+		return "<nil>"
+	}
+	parts := []string{"harness v2 " + e.Operation + " failed"}
+	if e.Kind != "" {
+		parts = append(parts, "kind="+string(e.Kind))
+	}
+	if e.StatusCode != 0 {
+		parts = append(parts, fmt.Sprintf("status=%d", e.StatusCode))
+	}
+	if e.Code != "" {
+		parts = append(parts, "code="+string(e.Code))
+	}
+	if e.Classification != nil {
+		parts = append(parts, "classification="+string(e.Classification.Class))
+	}
+	if e.WriteEvidence.State != "" && e.WriteEvidence.State != RequestWriteUnknown {
+		parts = append(parts, "write="+string(e.WriteEvidence.State))
+	}
+	prefix := strings.Join(parts, " ")
+	if strings.TrimSpace(e.Message) == "" {
+		return prefix
+	}
+	return prefix + ": " + e.Message
+}
+
+func (e *ClientError) Unwrap() error {
+	if e == nil {
+		return nil
+	}
+	return e.cause
+}
+
+func (e *ClientError) Is(target error) bool {
+	if e == nil {
+		return false
+	}
+	switch target {
+	case ErrClientConfiguration:
+		return e.Kind == ClientErrorConfiguration
+	case ErrClientValidation:
+		return e.Kind == ClientErrorValidation
+	case ErrClientTransport:
+		return e.Kind == ClientErrorTransport
+	case ErrClientProtocol:
+		return e.Kind == ClientErrorProtocol
+	case ErrClientStream:
+		return e.Kind == ClientErrorStream
+	}
+	return errors.Is(e.cause, target)
+}
+
+func clientError(operation string, kind ClientErrorKind, message string, cause error) *ClientError {
+	return &ClientError{Operation: operation, Kind: kind, Message: message, cause: cause}
+}
+
+func classificationCode(class RequestClassification) ErrorCode {
+	switch class {
+	case RequestClassificationStaleFence:
+		return ErrorCodeStaleFence
+	case RequestClassificationExpired:
+		return ErrorCodeExpired
+	case RequestClassificationDigestConflict:
+		return ErrorCodeDigestConflict
+	case RequestClassificationAlreadyAccepted:
+		return ErrorCodeAlreadyAccepted
+	case RequestClassificationSettled:
+		return ErrorCodeSettled
+	default:
+		return ErrorCodeInvalidRequest
+	}
+}
diff --git a/internal/harness/v2/client_stream.go b/internal/harness/v2/client_stream.go
new file mode 100644
index 000000000..d2753e39a
--- /dev/null
+++ b/internal/harness/v2/client_stream.go
@@ -0,0 +1,319 @@
+package v2
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+// PromptStream is one non-reconnectable prompt response. Decode must be called
+// until io.EOF so the client can prove that the stream contained accepted and
+// exactly one terminal event with no trailing frames. A transport disconnect is
+// never converted into a reconnect or replay.
+type PromptStream struct {
+	client     *Client
+	ctx        context.Context
+	cancel     context.CancelFunc
+	body       io.ReadCloser
+	decoder    *EventDecoder
+	trace      *requestTrace
+	capability string
+
+	decodeActive atomic.Bool
+	closeOnce    sync.Once
+	stateMu      sync.Mutex
+	closed       bool
+	finished     bool
+	accepted     bool
+	eventCount   uint64
+	terminal     *Event
+}
+
+// PromptStreamSummary is a stable snapshot after or during stream processing.
+type PromptStreamSummary struct {
+	Accepted      bool
+	EventCount    uint64
+	Terminal      *Event
+	WriteEvidence RequestWriteEvidence
+}
+
+// StartPrompt opens a single v2 NDJSON prompt stream. It deliberately has no
+// reconnect parameter and performs no automatic retry.
+func (c *Client) StartPrompt(ctx context.Context, sessionID RuntimeSessionID, request StartPromptRequest) (*PromptStream, error) {
+	const operation = "start_prompt"
+	if err := c.requireMutationAuth(operation); err != nil {
+		return nil, err
+	}
+	limits := c.protocolLimits()
+	now := time.Now().UTC()
+	minLease := time.Duration(limits.MinPromptLeaseMillis) * time.Millisecond
+	maxLease := time.Duration(limits.MaxPromptLeaseMillis) * time.Millisecond
+	if err := request.ValidateAt(now, minLease, maxLease); err != nil {
+		return nil, c.validationError(operation, err)
+	}
+	relative, err := PromptPath(sessionID, request.Metadata.PromptID)
+	if err != nil {
+		return nil, c.validationError(operation, err)
+	}
+	payload, err := json.Marshal(request)
+	if err != nil {
+		return nil, c.validationError(operation, fmt.Errorf("encode request: %w", err))
+	}
+	if len(payload) > limits.MaxRequestBytes {
+		return nil, c.validationError(operation, fmt.Errorf("request body is %d bytes, limit %d", len(payload), limits.MaxRequestBytes))
+	}
+	capability, err := SignOperationCapability(c.capabilitySecret, ClaimsForMutation(request.Metadata))
+	if err != nil {
+		return nil, c.validationError(operation, fmt.Errorf("sign operation capability: %w", err))
+	}
+	endpoint, err := c.endpoint(relative)
+	if err != nil {
+		return nil, c.validationError(operation, err)
+	}
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	streamContext, cancel := context.WithCancel(ctx)
+	tracker := newRequestTrace(c.traceReliable)
+	httpRequest, err := newTrackedRequest(streamContext, http.MethodPut, endpoint.String(), payload, tracker)
+	if err != nil {
+		cancel()
+		return nil, c.validationError(operation, err)
+	}
+	setCommonHeaders(httpRequest, NDJSONMediaType+", application/json")
+	httpRequest.Header.Set("Content-Type", "application/json")
+	httpRequest.Header.Set("Authorization", "Bearer "+c.controllerBearer)
+	httpRequest.Header.Set(OperationCapabilityHeader, capability)
+
+	response, err := c.httpClient.Do(httpRequest)
+	if err != nil {
+		cancel()
+		return nil, c.transportError(operation, streamContext, err, tracker, capability)
+	}
+	if response.StatusCode < http.StatusOK || response.StatusCode >= http.StatusMultipleChoices {
+		defer response.Body.Close() //nolint:errcheck
+		defer cancel()
+		return nil, c.decodeHTTPError(operation, response, tracker, capability)
+	}
+
+	mediaType, mediaErr := responseMediaType(response.Header.Get("Content-Type"))
+	if mediaErr != nil {
+		response.Body.Close() //nolint:errcheck
+		cancel()
+		return nil, c.protocolErrorWithEvidence(operation, response.StatusCode, mediaErr, tracker.evidence(), capability)
+	}
+	switch mediaType {
+	case NDJSONMediaType:
+		eventLimits := EventStreamLimits{
+			MaxLineBytes:             limits.MaxEventLineBytes,
+			MaxTerminalResultBytes:   limits.MaxTerminalResultBytes,
+			MaxBufferedEvents:        limits.MaxBufferedEvents,
+			MaxUpdateEventsPerSecond: limits.MaxUpdateEventsPerSecond,
+		}
+		decoder, err := NewEventDecoder(response.Body, eventLimits, EventExpectationFromMetadata(request.Metadata))
+		if err != nil {
+			response.Body.Close() //nolint:errcheck
+			cancel()
+			return nil, c.protocolErrorWithEvidence(operation, response.StatusCode, err, tracker.evidence(), capability)
+		}
+		return &PromptStream{
+			client: c, ctx: streamContext, cancel: cancel, body: response.Body,
+			decoder: decoder, trace: tracker, capability: capability,
+		}, nil
+	case "application/json":
+		defer response.Body.Close() //nolint:errcheck
+		defer cancel()
+		body, err := readBoundedResponseBody(response, c.maxErrorBodyBytes)
+		if err != nil {
+			return nil, c.protocolErrorWithEvidence(operation, response.StatusCode, err, tracker.evidence(), capability)
+		}
+		if errorResponse, ok, err := decodeErrorEnvelope(body); err != nil {
+			return nil, c.protocolErrorWithEvidence(operation, response.StatusCode, err, tracker.evidence(), capability)
+		} else if ok {
+			return nil, c.httpError(operation, response.StatusCode, errorResponse, tracker.evidence(), capability)
+		}
+		var admission PromptAdmissionResponse
+		if err := decodeSuccessJSON(body, &admission); err != nil {
+			return nil, c.protocolErrorWithEvidence(operation, response.StatusCode, err, tracker.evidence(), capability)
+		}
+		if err := admission.Validate(); err != nil {
+			return nil, c.protocolErrorWithEvidence(operation, response.StatusCode, err, tracker.evidence(), capability)
+		}
+		if admission.Classification.Class == RequestClassificationFresh {
+			return nil, c.protocolErrorWithEvidence(operation, response.StatusCode, fmt.Errorf("fresh prompt admission returned JSON instead of NDJSON stream"), tracker.evidence(), capability)
+		}
+		errorResponse := ErrorResponse{
+			Protocol:       ProtocolVersion,
+			Code:           classificationCode(admission.Classification.Class),
+			Message:        string(admission.Classification.Class),
+			Classification: &admission.Classification,
+			Retryable:      false,
+		}
+		return nil, c.httpError(operation, response.StatusCode, errorResponse, tracker.evidence(), capability)
+	default:
+		response.Body.Close() //nolint:errcheck
+		cancel()
+		return nil, c.protocolErrorWithEvidence(operation, response.StatusCode, fmt.Errorf("response Content-Type %q is unsupported; want %q", mediaType, NDJSONMediaType), tracker.evidence(), capability)
+	}
+}
+
+// StreamPrompt consumes a complete prompt stream and invokes emit for each
+// validated event. It returns only after clean EOF following exactly one
+// terminal event.
+func (c *Client) StreamPrompt(
+	ctx context.Context,
+	sessionID RuntimeSessionID,
+	request StartPromptRequest,
+	emit func(Event) error,
+) (PromptStreamSummary, error) {
+	if emit == nil {
+		return PromptStreamSummary{}, c.validationError("stream_prompt", fmt.Errorf("emit callback is required"))
+	}
+	stream, err := c.StartPrompt(ctx, sessionID, request)
+	if err != nil {
+		return PromptStreamSummary{}, err
+	}
+	defer stream.Close() //nolint:errcheck
+	for {
+		event, err := stream.Decode()
+		if errors.Is(err, io.EOF) {
+			return stream.Summary(), nil
+		}
+		if err != nil {
+			return stream.Summary(), err
+		}
+		if err := emit(event); err != nil {
+			return stream.Summary(), err
+		}
+	}
+}
+
+// Decode returns the next validated event. After the body reaches EOF it calls
+// EventStreamValidator.Finish, so EOF is successful only after accepted and one
+// terminal event were observed.
+func (s *PromptStream) Decode() (Event, error) {
+	if s == nil || s.decoder == nil {
+		return Event{}, clientError("prompt_stream", ClientErrorConfiguration, "prompt stream is not initialized", ErrClientConfiguration)
+	}
+	if !s.decodeActive.CompareAndSwap(false, true) {
+		return Event{}, clientError("prompt_stream", ClientErrorValidation, "concurrent Decode calls are not supported", ErrClientValidation)
+	}
+	defer s.decodeActive.Store(false)
+
+	s.stateMu.Lock()
+	if s.finished || s.closed {
+		s.stateMu.Unlock()
+		return Event{}, io.EOF
+	}
+	s.stateMu.Unlock()
+
+	event, err := s.decoder.Decode()
+	if err == nil {
+		s.stateMu.Lock()
+		s.eventCount++
+		if event.Type == EventAccepted {
+			s.accepted = true
+		}
+		if event.Type.IsTerminal() {
+			terminal := event
+			s.terminal = &terminal
+		}
+		s.stateMu.Unlock()
+		return event, nil
+	}
+	if errors.Is(err, io.EOF) {
+		finishErr := s.decoder.validator.Finish()
+		if finishErr != nil {
+			s.finish()
+			return Event{}, s.streamError(finishErr)
+		}
+		s.finish()
+		return Event{}, io.EOF
+	}
+	if s.ctx != nil && s.ctx.Err() != nil {
+		contextErr := s.ctx.Err()
+		s.finish()
+		return Event{}, s.streamError(contextErr)
+	}
+	s.finish()
+	if IsPoisoningStreamError(err) {
+		return Event{}, s.streamError(err)
+	}
+	return Event{}, s.streamError(ErrPromptStreamDisconnected)
+}
+
+func (s *PromptStream) Close() error {
+	if s == nil {
+		return nil
+	}
+	var closeErr error
+	s.closeOnce.Do(func() {
+		s.stateMu.Lock()
+		s.closed = true
+		s.stateMu.Unlock()
+		if s.cancel != nil {
+			s.cancel()
+		}
+		if s.body != nil {
+			closeErr = s.body.Close()
+		}
+	})
+	return closeErr
+}
+
+func (s *PromptStream) Summary() PromptStreamSummary {
+	if s == nil {
+		return PromptStreamSummary{}
+	}
+	s.stateMu.Lock()
+	defer s.stateMu.Unlock()
+	var terminal *Event
+	if s.terminal != nil {
+		copy := *s.terminal
+		terminal = &copy
+	}
+	evidence := RequestWriteEvidence{State: RequestWriteUnknown}
+	if s.trace != nil {
+		evidence = s.trace.evidence()
+	}
+	return PromptStreamSummary{
+		Accepted: s.accepted, EventCount: s.eventCount, Terminal: terminal, WriteEvidence: evidence,
+	}
+}
+
+func (s *PromptStream) finish() {
+	s.stateMu.Lock()
+	s.finished = true
+	s.stateMu.Unlock()
+	_ = s.Close()
+}
+
+func (s *PromptStream) streamError(cause error) error {
+	message := cause.Error()
+	if s.client != nil {
+		message = s.client.redact(message, s.capability)
+	}
+	evidence := RequestWriteEvidence{State: RequestWriteUnknown}
+	if s.trace != nil {
+		evidence = s.trace.evidence()
+	}
+	return &ClientError{
+		Operation: "prompt_stream", Kind: ClientErrorStream, StatusCode: http.StatusOK,
+		Message: message, WriteEvidence: evidence, cause: cause,
+	}
+}
+
+func responseMediaType(header string) (string, error) {
+	for _, expected := range []string{NDJSONMediaType, "application/json"} {
+		if requireMediaType(header, expected) == nil {
+			return expected, nil
+		}
+	}
+	return "", fmt.Errorf("response Content-Type %q is unsupported", header)
+}
diff --git a/internal/harness/v2/client_stream_test.go b/internal/harness/v2/client_stream_test.go
new file mode 100644
index 000000000..4ecdaa328
--- /dev/null
+++ b/internal/harness/v2/client_stream_test.go
@@ -0,0 +1,169 @@
+package v2
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestClientPromptNDJSONStreamCompletesWithoutReconnect(t *testing.T) {
+	now := time.Now().UTC().Truncate(time.Millisecond)
+	request := clientTestStartPromptRequest(t, now, "stream-success-op")
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var decoded StartPromptRequest
+		clientTestDecodeMutation(t, r, &decoded, true)
+		writeClientTestNDJSON(w,
+			clientTestAcceptedEvent(request, now.Add(time.Millisecond)),
+			clientTestCompletedEvent(request, now.Add(2*time.Millisecond)),
+		)
+	}))
+	defer server.Close()
+
+	var eventTypes []EventType
+	summary, err := clientTestClient(t, server.URL).StreamPrompt(context.Background(), "runtime-session-1", request, func(event Event) error {
+		eventTypes = append(eventTypes, event.Type)
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("StreamPrompt() error = %v", err)
+	}
+	if got, want := eventTypes, []EventType{EventAccepted, EventCompleted}; len(got) != len(want) || got[0] != want[0] || got[1] != want[1] {
+		t.Fatalf("event types = %v, want %v", got, want)
+	}
+	if !summary.Accepted || summary.EventCount != 2 || summary.Terminal == nil || summary.Terminal.Type != EventCompleted {
+		t.Fatalf("summary = %#v", summary)
+	}
+	if summary.WriteEvidence.State != RequestWriteComplete {
+		t.Fatalf("write evidence = %#v", summary.WriteEvidence)
+	}
+}
+
+func TestClientRejectsMalformedAndOversizedPromptStreams(t *testing.T) {
+	now := time.Now().UTC().Truncate(time.Millisecond)
+	request := clientTestStartPromptRequest(t, now, "hostile-stream-op")
+	tests := []struct {
+		name   string
+		body   string
+		limits ProtocolLimits
+		want   error
+	}{
+		{name: "malformed", body: "{not-json}\n", limits: DefaultProtocolLimits(), want: ErrMalformedEvent},
+		{name: "oversized", body: strings.Repeat("x", 129) + "\n", limits: clientTestSmallStreamLimits(), want: ErrEventLineTooLarge},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+				w.Header().Set("Content-Type", NDJSONMediaType)
+				_, _ = io.WriteString(w, test.body)
+			}))
+			defer server.Close()
+			client := clientTestClient(t, server.URL, WithProtocolLimits(test.limits))
+			stream, err := client.StartPrompt(context.Background(), "runtime-session-1", request)
+			if err != nil {
+				t.Fatalf("StartPrompt() error = %v", err)
+			}
+			defer stream.Close() //nolint:errcheck
+			_, err = stream.Decode()
+			if !errors.Is(err, test.want) {
+				t.Fatalf("Decode() error = %v, want %v", err, test.want)
+			}
+			if !errors.Is(err, ErrClientStream) || !IsPoisoningStreamError(err) {
+				t.Fatalf("Decode() error = %v, want poisoning client stream error", err)
+			}
+		})
+	}
+}
+
+func TestClientDetectsMidstreamDisconnectAfterAcceptance(t *testing.T) {
+	now := time.Now().UTC().Truncate(time.Millisecond)
+	request := clientTestStartPromptRequest(t, now, "midstream-op")
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", NDJSONMediaType)
+		_, _ = io.WriteString(w, mustClientTestJSON(clientTestAcceptedEvent(request, now.Add(time.Millisecond)))+"\n")
+		if flusher, ok := w.(http.Flusher); ok {
+			flusher.Flush()
+		}
+		// Returning closes the body without the required terminal event.
+	}))
+	defer server.Close()
+
+	stream, err := clientTestClient(t, server.URL).StartPrompt(context.Background(), "runtime-session-1", request)
+	if err != nil {
+		t.Fatalf("StartPrompt() error = %v", err)
+	}
+	defer stream.Close() //nolint:errcheck
+	if event, err := stream.Decode(); err != nil || event.Type != EventAccepted {
+		t.Fatalf("first Decode() = (%q, %v)", event.Type, err)
+	}
+	_, err = stream.Decode()
+	if !errors.Is(err, ErrMissingTerminalEvent) || !errors.Is(err, ErrClientStream) {
+		t.Fatalf("second Decode() error = %v, want missing terminal", err)
+	}
+	if !IsPoisoningStreamError(err) {
+		t.Fatalf("midstream error is not poisoning: %v", err)
+	}
+	summary := stream.Summary()
+	if !summary.Accepted || summary.Terminal != nil {
+		t.Fatalf("summary = %#v", summary)
+	}
+}
+
+func TestClientPromptStreamContextCancellation(t *testing.T) {
+	now := time.Now().UTC().Truncate(time.Millisecond)
+	request := clientTestStartPromptRequest(t, now, "context-op")
+	handlerDone := make(chan struct{})
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		defer close(handlerDone)
+		w.Header().Set("Content-Type", NDJSONMediaType)
+		_, _ = io.WriteString(w, mustClientTestJSON(clientTestAcceptedEvent(request, now.Add(time.Millisecond)))+"\n")
+		if flusher, ok := w.(http.Flusher); ok {
+			flusher.Flush()
+		}
+		<-r.Context().Done()
+	}))
+	defer server.Close()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	stream, err := clientTestClient(t, server.URL).StartPrompt(ctx, "runtime-session-1", request)
+	if err != nil {
+		cancel()
+		t.Fatalf("StartPrompt() error = %v", err)
+	}
+	defer stream.Close() //nolint:errcheck
+	if event, err := stream.Decode(); err != nil || event.Type != EventAccepted {
+		cancel()
+		t.Fatalf("first Decode() = (%q, %v)", event.Type, err)
+	}
+
+	result := make(chan error, 1)
+	go func() {
+		_, decodeErr := stream.Decode()
+		result <- decodeErr
+	}()
+	cancel()
+	select {
+	case err := <-result:
+		if !errors.Is(err, context.Canceled) || !errors.Is(err, ErrClientStream) {
+			t.Fatalf("Decode() error = %v, want context.Canceled client stream error", err)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("Decode() did not unblock after context cancellation")
+	}
+	select {
+	case <-handlerDone:
+	case <-time.After(5 * time.Second):
+		t.Fatal("handler did not observe context cancellation")
+	}
+}
+
+func clientTestSmallStreamLimits() ProtocolLimits {
+	limits := DefaultProtocolLimits()
+	limits.MaxEventLineBytes = 128
+	limits.MaxTerminalResultBytes = 64
+	return limits
+}
diff --git a/internal/harness/v2/client_test.go b/internal/harness/v2/client_test.go
new file mode 100644
index 000000000..7a0040602
--- /dev/null
+++ b/internal/harness/v2/client_test.go
@@ -0,0 +1,667 @@
+package v2
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+const clientTestBearer = "controller-bearer-token-0123456789abcdef"
+
+var clientTestCapabilitySecret = []byte("capability-secret-0123456789abcdef")
+
+func TestClientControlSurfaceAndAuthentication(t *testing.T) {
+	now := time.Now().UTC().Truncate(time.Millisecond)
+	createRequest := clientTestCreateSessionRequest(t, now, "create-op")
+	leaseRequest := clientTestLeaseRequest(t, now, "lease-op")
+	permissionRequest := clientTestPermissionRequest(t, now, "permission-op")
+	cancelRequest := clientTestCancelRequest(t, now, "cancel-op")
+	deltaRequest := clientTestDeltaRequest(t, now, "delta-op")
+	publicationFinalizationRequest := clientTestPublicationFinalizationRequest(t, now, "publication-finalization-op")
+	drainRequest := clientTestDrainRequest(t, now, "drain-op")
+	deleteRequest := clientTestDeleteRequest(t, now, "delete-op")
+
+	var mu sync.Mutex
+	seen := make(map[string]int)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		mu.Lock()
+		seen[r.Method+" "+r.URL.Path]++
+		mu.Unlock()
+		switch r.Method + " " + r.URL.Path {
+		case http.MethodGet + " " + HealthPath:
+			if got := r.Header.Get("Authorization"); got != "" {
+				t.Errorf("health Authorization = %q, want empty", got)
+			}
+			writeClientTestJSON(w, http.StatusOK, HealthResponse{Protocol: ProtocolVersion, Status: HealthStatusOK, Timestamp: now})
+		case http.MethodGet + " " + CapabilitiesPath:
+			if got := r.Header.Get("Authorization"); got != "" {
+				t.Errorf("capabilities Authorization = %q, want empty", got)
+			}
+			writeClientTestJSON(w, http.StatusOK, clientTestCapabilities(t))
+		case http.MethodGet + " " + StatusPath:
+			clientTestRequireBearer(t, r)
+			writeClientTestJSON(w, http.StatusOK, clientTestStatus(t, now))
+		case http.MethodPut + " " + "/v2/runtime-sessions/runtime-session-1":
+			var request CreateRuntimeSessionRequest
+			clientTestDecodeMutation(t, r, &request, true)
+			writeClientTestJSON(w, http.StatusOK, clientTestCreateSessionResponse(request, now, RequestClassificationFresh))
+		case http.MethodPut + " " + "/v2/runtime-sessions/runtime-session-1/prompts/prompt-1/lease":
+			var request RenewPromptLeaseRequest
+			clientTestDecodeMutation(t, r, &request, true)
+			writeClientTestJSON(w, http.StatusOK, PromptLeaseResponse{
+				Protocol: ProtocolVersion, Classification: Classification{Class: RequestClassificationFresh}, Lease: request.Lease,
+			})
+		case http.MethodPut + " " + "/v2/runtime-sessions/runtime-session-1/prompts/prompt-1/permissions/permission-1":
+			var request ResolvePermissionRequest
+			clientTestDecodeMutation(t, r, &request, true)
+			writeClientTestJSON(w, http.StatusOK, PermissionResolutionResponse{
+				Protocol: ProtocolVersion, Classification: Classification{Class: RequestClassificationFresh},
+				State: PermissionResolutionApplied, Decision: request.Decision, ResolvedAt: now,
+			})
+		case http.MethodPut + " " + "/v2/runtime-sessions/runtime-session-1/prompts/prompt-1/cancel":
+			var request CancelPromptRequest
+			clientTestDecodeMutation(t, r, &request, true)
+			settlement := PromptSettlement{
+				TerminalEvent: EventCancelled, Outcome: PromptOutcomeCancelled,
+				StopReason: ACPStopReasonCancelled, SettledAt: now,
+			}
+			writeClientTestJSON(w, http.StatusOK, CancelPromptResponse{
+				Protocol: ProtocolVersion, Classification: Classification{Class: RequestClassificationFresh},
+				BarrierState: CancellationBarrierSettled, SettlementProven: true, Settlement: settlement,
+			})
+		case http.MethodPut + " " + "/v2/runtime-sessions/runtime-session-1/workspace-deltas/delta-1":
+			var request CreateWorkspaceDeltaRequest
+			clientTestDecodeMutation(t, r, &request, true)
+			writeClientTestJSON(w, http.StatusOK, CreateWorkspaceDeltaResponse{
+				Protocol: ProtocolVersion, Classification: Classification{Class: RequestClassificationFresh},
+				Delta: WorkspaceDeltaDescriptor{
+					DeltaID: request.DeltaID, RuntimeSessionUID: request.Metadata.Fence.RuntimeSessionUID,
+					SessionGeneration: request.Metadata.Fence.RuntimeSessionGeneration, State: WorkspaceDeltaNoChange,
+					Intent: request.Intent, VerifiedBaseline: request.VerifiedBaseline,
+					NoFollowVerified: true, PublicationSafe: true, FrozenAt: now,
+				},
+			})
+		case http.MethodPut + " " + "/v2/runtime-sessions/runtime-session-1/publication-finalization":
+			var request FinalizeRuntimeSessionPublicationRequest
+			clientTestDecodeMutation(t, r, &request, true)
+			writeClientTestJSON(w, http.StatusOK, FinalizeRuntimeSessionPublicationResponse{
+				Protocol: ProtocolVersion, Classification: Classification{Class: RequestClassificationFresh},
+				Session: RuntimeSessionDescriptor{
+					RuntimeSessionID: "runtime-session-1", RuntimeSessionUID: request.Metadata.Fence.RuntimeSessionUID,
+					Generation: request.Metadata.Fence.RuntimeSessionGeneration, RuntimeInstanceID: request.Metadata.Fence.RuntimeInstanceID,
+					SupervisorBootID: request.Metadata.Fence.SupervisorBootID, RuntimeProfileDigest: request.Metadata.Fence.RuntimeProfileDigest,
+					State: RuntimeSessionStateFinalizing, ProviderSessionID: "provider-session-1", WorkspaceBaseline: testWorkspaceBaseline(),
+					CreatedAt: now, LastTransitionAt: now,
+				},
+				Finalization: PublicationFinalizationReceipt{
+					WorkspaceDeltaID: request.WorkspaceDeltaID, PublicationID: request.PublicationID,
+					PublicationGeneration: request.PublicationGeneration, PublicationVersion: request.PublicationVersion,
+					TerminalState: request.TerminalState, TerminalReceiptDigest: request.TerminalReceiptDigest, AppliedAt: now,
+				},
+			})
+		case http.MethodPut + " " + DrainPath:
+			var request DrainRequest
+			clientTestDecodeMutation(t, r, &request, false)
+			writeClientTestJSON(w, http.StatusOK, DrainResponse{
+				Protocol: ProtocolVersion, Classification: Classification{Class: RequestClassificationFresh},
+				Drain: DrainStatus{AcceptingNewSessions: false, Requested: true, RequestedAt: now, Reason: request.Reason},
+			})
+		case http.MethodDelete + " " + "/v2/runtime-sessions/runtime-session-1":
+			var request DeleteRuntimeSessionRequest
+			clientTestDecodeMutation(t, r, &request, true)
+			writeClientTestJSON(w, http.StatusOK, DeleteRuntimeSessionResponse{
+				Protocol: ProtocolVersion, Classification: Classification{Class: RequestClassificationFresh},
+				State: RuntimeSessionStateDeleted,
+				Tombstone: RuntimeSessionTombstone{
+					RuntimeSessionUID:        request.Metadata.Fence.RuntimeSessionUID,
+					RuntimeSessionGeneration: request.Metadata.Fence.RuntimeSessionGeneration,
+					RuntimeProfileDigest:     request.Metadata.Fence.RuntimeProfileDigest, DeletedAt: now,
+					Operations: []OperationRecord{{
+						OperationID: request.Metadata.OperationID, RequestDigest: request.Metadata.RequestDigest,
+						Phase: OperationPhaseDeleted, RecordedAt: now, UpdatedAt: now,
+					}},
+				},
+			})
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+
+	client := clientTestClient(t, server.URL)
+	ctx := context.Background()
+	if _, err := client.Health(ctx); err != nil {
+		t.Fatalf("Health() error = %v", err)
+	}
+	if _, err := client.Capabilities(ctx); err != nil {
+		t.Fatalf("Capabilities() error = %v", err)
+	}
+	if _, err := client.Status(ctx); err != nil {
+		t.Fatalf("Status() error = %v", err)
+	}
+	if _, err := client.CreateRuntimeSession(ctx, createRequest); err != nil {
+		t.Fatalf("CreateRuntimeSession() error = %v", err)
+	}
+	if _, err := client.RenewPromptLease(ctx, "runtime-session-1", leaseRequest); err != nil {
+		t.Fatalf("RenewPromptLease() error = %v", err)
+	}
+	if _, err := client.ResolvePermission(ctx, "runtime-session-1", permissionRequest); err != nil {
+		t.Fatalf("ResolvePermission() error = %v", err)
+	}
+	if _, err := client.CancelPrompt(ctx, "runtime-session-1", cancelRequest); err != nil {
+		t.Fatalf("CancelPrompt() error = %v", err)
+	}
+	if _, err := client.CreateWorkspaceDelta(ctx, "runtime-session-1", deltaRequest); err != nil {
+		t.Fatalf("CreateWorkspaceDelta() error = %v", err)
+	}
+	if _, err := client.FinalizeRuntimeSessionPublication(ctx, "runtime-session-1", publicationFinalizationRequest); err != nil {
+		t.Fatalf("FinalizeRuntimeSessionPublication() error = %v", err)
+	}
+	if _, err := client.Drain(ctx, drainRequest); err != nil {
+		t.Fatalf("Drain() error = %v", err)
+	}
+	if _, err := client.DeleteRuntimeSession(ctx, "runtime-session-1", deleteRequest); err != nil {
+		t.Fatalf("DeleteRuntimeSession() error = %v", err)
+	}
+
+	for _, route := range []string{
+		http.MethodGet + " " + HealthPath,
+		http.MethodGet + " " + CapabilitiesPath,
+		http.MethodGet + " " + StatusPath,
+		http.MethodPut + " /v2/runtime-sessions/runtime-session-1",
+		http.MethodPut + " /v2/runtime-sessions/runtime-session-1/prompts/prompt-1/lease",
+		http.MethodPut + " /v2/runtime-sessions/runtime-session-1/prompts/prompt-1/permissions/permission-1",
+		http.MethodPut + " /v2/runtime-sessions/runtime-session-1/prompts/prompt-1/cancel",
+		http.MethodPut + " /v2/runtime-sessions/runtime-session-1/workspace-deltas/delta-1",
+		http.MethodPut + " /v2/runtime-sessions/runtime-session-1/publication-finalization",
+		http.MethodPut + " " + DrainPath,
+		http.MethodDelete + " /v2/runtime-sessions/runtime-session-1",
+	} {
+		mu.Lock()
+		count := seen[route]
+		mu.Unlock()
+		if count != 1 {
+			t.Errorf("route %q count = %d, want 1", route, count)
+		}
+	}
+}
+
+func TestClientRejectsVersionSkewAndOversizedJSON(t *testing.T) {
+	t.Run("version skew", func(t *testing.T) {
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			writeClientTestJSON(w, http.StatusOK, HealthResponse{Protocol: "orka.harness.v3", Status: HealthStatusOK, Timestamp: time.Now().UTC()})
+		}))
+		defer server.Close()
+		client, err := NewClient(server.URL)
+		if err != nil {
+			t.Fatal(err)
+		}
+		_, err = client.Health(context.Background())
+		if !errors.Is(err, ErrClientProtocol) {
+			t.Fatalf("Health() error = %v, want ErrClientProtocol", err)
+		}
+	})
+
+	t.Run("bounded response body", func(t *testing.T) {
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = io.WriteString(w, `{"padding":"`+strings.Repeat("x", 1024)+`"}`)
+		}))
+		defer server.Close()
+		client, err := NewClient(server.URL, WithResponseBodyLimit(128))
+		if err != nil {
+			t.Fatal(err)
+		}
+		_, err = client.Health(context.Background())
+		if !errors.Is(err, ErrResponseBodyTooLarge) {
+			t.Fatalf("Health() error = %v, want ErrResponseBodyTooLarge", err)
+		}
+	})
+}
+
+func TestClientMapsStaleFenceDigestConflictAndAlreadyAccepted(t *testing.T) {
+	now := time.Now().UTC().Truncate(time.Millisecond)
+	request := clientTestCreateSessionRequest(t, now, "classification-op")
+	tests := []struct {
+		name      string
+		status    int
+		response  ErrorResponse
+		wantCode  ErrorCode
+		wantClass RequestClassification
+		wantFence FenceMismatch
+	}{
+		{
+			name: "stale fence", status: http.StatusGone, wantCode: ErrorCodeStaleFence,
+			wantClass: RequestClassificationStaleFence, wantFence: FenceMismatchControllerEpoch,
+			response: ErrorResponse{
+				Protocol: ProtocolVersion, Code: ErrorCodeStaleFence, Message: "stale controller epoch",
+				Classification: &Classification{Class: RequestClassificationStaleFence, FenceMismatch: FenceMismatchControllerEpoch},
+			},
+		},
+		{
+			name: "digest conflict", status: http.StatusConflict, wantCode: ErrorCodeDigestConflict,
+			wantClass: RequestClassificationDigestConflict,
+			response: ErrorResponse{
+				Protocol: ProtocolVersion, Code: ErrorCodeDigestConflict, Message: "digest differs",
+				Classification: &Classification{Class: RequestClassificationDigestConflict, Phase: OperationPhaseRecorded},
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+				writeClientTestJSON(w, test.status, test.response)
+			}))
+			defer server.Close()
+			client := clientTestClient(t, server.URL)
+			_, err := client.CreateRuntimeSession(context.Background(), request)
+			var clientErr *ClientError
+			if !errors.As(err, &clientErr) {
+				t.Fatalf("error = %v, want *ClientError", err)
+			}
+			if clientErr.Kind != ClientErrorHTTP || clientErr.StatusCode != test.status || clientErr.Code != test.wantCode {
+				t.Fatalf("ClientError = %#v", clientErr)
+			}
+			if clientErr.Classification == nil || clientErr.Classification.Class != test.wantClass || clientErr.Classification.FenceMismatch != test.wantFence {
+				t.Fatalf("classification = %#v", clientErr.Classification)
+			}
+		})
+	}
+
+	t.Run("duplicate create is typed success", func(t *testing.T) {
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			writeClientTestJSON(w, http.StatusOK, clientTestCreateSessionResponse(request, now, RequestClassificationDuplicate))
+		}))
+		defer server.Close()
+		response, err := clientTestClient(t, server.URL).CreateRuntimeSession(context.Background(), request)
+		if err != nil {
+			t.Fatalf("CreateRuntimeSession() error = %v", err)
+		}
+		if response.Classification.Class != RequestClassificationDuplicate {
+			t.Fatalf("classification = %q", response.Classification.Class)
+		}
+	})
+
+	t.Run("already accepted prompt never reconnects", func(t *testing.T) {
+		promptRequest := clientTestStartPromptRequest(t, now, "already-op")
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			writeClientTestJSON(w, http.StatusOK, ErrorResponse{
+				Protocol: ProtocolVersion, Code: ErrorCodeAlreadyAccepted, Message: "already accepted",
+				Classification: &Classification{Class: RequestClassificationAlreadyAccepted, Phase: OperationPhaseAccepted},
+			})
+		}))
+		defer server.Close()
+		_, err := clientTestClient(t, server.URL).StartPrompt(context.Background(), "runtime-session-1", promptRequest)
+		var clientErr *ClientError
+		if !errors.As(err, &clientErr) || clientErr.Code != ErrorCodeAlreadyAccepted || clientErr.Classification == nil || clientErr.Classification.Class != RequestClassificationAlreadyAccepted {
+			t.Fatalf("StartPrompt() error = %#v", err)
+		}
+		if clientErr.StatusCode != http.StatusOK {
+			t.Fatalf("already accepted status = %d, want 200", clientErr.StatusCode)
+		}
+	})
+}
+
+func TestClientRedactsAuthenticationValues(t *testing.T) {
+	now := time.Now().UTC().Truncate(time.Millisecond)
+	request := clientTestCreateSessionRequest(t, now, "redaction-op")
+	var echoedCapability string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		echoedCapability = r.Header.Get(OperationCapabilityHeader)
+		writeClientTestJSON(w, http.StatusForbidden, ErrorResponse{
+			Protocol: ProtocolVersion, Code: ErrorCodeForbidden,
+			Message: "authorization=Bearer " + clientTestBearer + " capability=" + echoedCapability,
+		})
+	}))
+	defer server.Close()
+
+	_, err := clientTestClient(t, server.URL).CreateRuntimeSession(context.Background(), request)
+	var clientErr *ClientError
+	if !errors.As(err, &clientErr) {
+		t.Fatalf("error = %v, want *ClientError", err)
+	}
+	if echoedCapability == "" {
+		t.Fatal("server did not receive operation capability")
+	}
+	for _, secret := range []string{clientTestBearer, echoedCapability} {
+		if strings.Contains(err.Error(), secret) || strings.Contains(clientErr.Message, secret) {
+			t.Fatalf("error leaked credential %q: %v", secret, err)
+		}
+	}
+	if strings.Count(err.Error(), "[REDACTED]") < 2 {
+		t.Fatalf("redacted error = %v", err)
+	}
+}
+
+func TestClientStrictPathBuildingRejectsTraversalBeforeTransport(t *testing.T) {
+	now := time.Now().UTC().Truncate(time.Millisecond)
+	request := clientTestCreateSessionRequest(t, now, "path-op")
+	request.RuntimeSessionID = "../status"
+	sealRequest(t, request, &request.Metadata.RequestDigest)
+	called := false
+	server := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { called = true }))
+	defer server.Close()
+	_, err := clientTestClient(t, server.URL).CreateRuntimeSession(context.Background(), request)
+	if !errors.Is(err, ErrClientValidation) {
+		t.Fatalf("CreateRuntimeSession() error = %v, want validation error", err)
+	}
+	if called {
+		t.Fatal("transport was called for traversal path")
+	}
+}
+
+func TestClientTransportWriteEvidence(t *testing.T) {
+	now := time.Now().UTC().Truncate(time.Millisecond)
+	request := clientTestCreateSessionRequest(t, now, "transport-op")
+
+	t.Run("zero bytes exposed by net/http", func(t *testing.T) {
+		transport := http.DefaultTransport.(*http.Transport).Clone()
+		transport.Proxy = nil
+		transport.DialContext = func(context.Context, string, string) (net.Conn, error) {
+			return nil, errors.New("dial refused")
+		}
+		httpClient := &http.Client{Transport: transport}
+		client, err := NewClient("http://runtime.invalid", WithHTTPClient(httpClient), WithControllerBearerToken(clientTestBearer), WithOperationCapabilitySecret(clientTestCapabilitySecret))
+		if err != nil {
+			t.Fatal(err)
+		}
+		_, err = client.CreateRuntimeSession(context.Background(), request)
+		var clientErr *ClientError
+		if !errors.As(err, &clientErr) {
+			t.Fatalf("error = %v, want *ClientError", err)
+		}
+		if clientErr.WriteEvidence.State != RequestWriteZeroBytes || !clientErr.WriteEvidence.SafeToResendSameIdentity() {
+			t.Fatalf("write evidence = %#v", clientErr.WriteEvidence)
+		}
+	})
+
+	t.Run("body consumption is ambiguous", func(t *testing.T) {
+		roundTripper := roundTripFunc(func(request *http.Request) (*http.Response, error) {
+			buffer := make([]byte, 1)
+			_, _ = request.Body.Read(buffer)
+			return nil, errors.New("connection dropped after write")
+		})
+		client, err := NewClient("http://runtime.invalid", WithHTTPClient(&http.Client{Transport: roundTripper}), WithControllerBearerToken(clientTestBearer), WithOperationCapabilitySecret(clientTestCapabilitySecret))
+		if err != nil {
+			t.Fatal(err)
+		}
+		_, err = client.CreateRuntimeSession(context.Background(), request)
+		var clientErr *ClientError
+		if !errors.As(err, &clientErr) {
+			t.Fatalf("error = %v, want *ClientError", err)
+		}
+		if clientErr.WriteEvidence.State != RequestWriteAmbiguous || clientErr.WriteEvidence.RequestBodyBytesRead != 1 || clientErr.WriteEvidence.SafeToResendSameIdentity() {
+			t.Fatalf("write evidence = %#v", clientErr.WriteEvidence)
+		}
+	})
+}
+
+func clientTestClient(t *testing.T, baseURL string, extra ...ClientOption) *Client {
+	t.Helper()
+	options := []ClientOption{WithControllerBearerToken(clientTestBearer), WithOperationCapabilitySecret(clientTestCapabilitySecret)}
+	options = append(options, extra...)
+	client, err := NewClient(baseURL, options...)
+	if err != nil {
+		t.Fatalf("NewClient() error = %v", err)
+	}
+	return client
+}
+
+func clientTestCapabilities(t *testing.T) CapabilitiesResponse {
+	t.Helper()
+	return CapabilitiesResponse{
+		Protocol: ProtocolVersion, Transport: "http+ndjson", ACPVersion: ACPProfileV1,
+		RuntimeProfileDigest: testFence(t).RuntimeProfileDigest, ProfileDigestSchemaVersion: ProfileDigestSchemaVersion,
+		AdapterDigests: map[string]string{"codex-acp": testSHA256("adapter")}, Limits: DefaultProtocolLimits(),
+		Provider: ProviderCapabilities{
+			ProviderKinds: []string{"codex"}, Models: []string{"test-model"},
+			SupportsPermissions: true, SupportsCancel: true, SupportsTools: true,
+		},
+		WorkspaceGovernance: StrictWorkspaceGovernanceCapabilities(),
+		SupportsDrain:       true,
+	}
+}
+
+func clientTestStatus(t *testing.T, now time.Time) StatusResponse {
+	t.Helper()
+	fence := testFence(t)
+	fence.RuntimeSessionUID = ""
+	fence.RuntimeSessionGeneration = 0
+	return StatusResponse{
+		Protocol: ProtocolVersion, Fence: fence, Lifecycle: SupervisorLifecycleReady,
+		Drain: DrainStatus{AcceptingNewSessions: true}, Sessions: []RuntimeSessionStatus{},
+		ActivePrompts: []ActivePromptStatus{}, PendingPermissions: []PendingPermissionStatus{},
+		Pressure: PressureMetadata{}, Timestamp: now,
+	}
+}
+
+func clientTestMetadata(t *testing.T, now time.Time, operation OperationID, prompt bool) MutationMetadata {
+	t.Helper()
+	metadata := MutationMetadata{
+		Fence: testFence(t), TaskUID: "task-uid-1", TaskAttempt: 1, OperationID: operation,
+		RequestDigestSchemaVersion: RequestDigestSchemaVersion, ExpiresAt: now.Add(45 * time.Second),
+	}
+	if prompt {
+		metadata.PromptID = "prompt-1"
+	}
+	return metadata
+}
+
+func clientTestCreateSessionRequest(t *testing.T, now time.Time, operation OperationID) CreateRuntimeSessionRequest {
+	t.Helper()
+	request := CreateRuntimeSessionRequest{
+		Protocol: ProtocolVersion, Metadata: clientTestMetadata(t, now, operation, false),
+		RuntimeSessionID: "runtime-session-1", Profile: testRuntimeProfile(),
+		AgentConfiguration: testAgentSessionConfigurationPointer(),
+		MCPConfiguration:   testMCPPolicyConfiguration(),
+		Workspace:          WorkspaceSpec{Intent: WorkspaceIntentWrite, Baseline: testWorkspaceBaseline()},
+	}
+	sealRequest(t, request, &request.Metadata.RequestDigest)
+	return request
+}
+
+func clientTestCreateSessionResponse(request CreateRuntimeSessionRequest, now time.Time, class RequestClassification) CreateRuntimeSessionResponse {
+	classification := Classification{Class: class}
+	if class == RequestClassificationDuplicate {
+		classification.Phase = OperationPhaseApplied
+	}
+	return CreateRuntimeSessionResponse{
+		Protocol: ProtocolVersion, Classification: classification,
+		Session: RuntimeSessionDescriptor{
+			RuntimeSessionID: request.RuntimeSessionID, RuntimeSessionUID: request.Metadata.Fence.RuntimeSessionUID,
+			Generation:        request.Metadata.Fence.RuntimeSessionGeneration,
+			RuntimeInstanceID: request.Metadata.Fence.RuntimeInstanceID, SupervisorBootID: request.Metadata.Fence.SupervisorBootID,
+			RuntimeProfileDigest: request.Metadata.Fence.RuntimeProfileDigest, State: RuntimeSessionStateIdle,
+			ProviderSessionID: "provider-session-1", WorkspaceBaseline: request.Workspace.Baseline,
+			CreatedAt: now, LastTransitionAt: now,
+		},
+	}
+}
+
+func clientTestStartPromptRequest(t *testing.T, now time.Time, operation OperationID) StartPromptRequest {
+	t.Helper()
+	metadata := clientTestMetadata(t, now, operation, true)
+	lease := PromptLease{Generation: 1, IssuedAt: now, ExpiresAt: now.Add(60 * time.Second)}
+	request := StartPromptRequest{
+		Protocol: ProtocolVersion, Metadata: metadata, Lease: lease,
+		MCPAuthorization: testPromptMCPAuthorizationAt(metadata, lease, now.Add(45*time.Second)),
+		Input:            PromptInput{Content: []ContentBlock{{Type: ContentBlockText, Text: "test prompt"}}},
+	}
+	sealRequest(t, request, &request.Metadata.RequestDigest)
+	return request
+}
+
+func clientTestLeaseRequest(t *testing.T, now time.Time, operation OperationID) RenewPromptLeaseRequest {
+	t.Helper()
+	metadata := clientTestMetadata(t, now, operation, true)
+	lease := PromptLease{Generation: 2, IssuedAt: now, ExpiresAt: now.Add(60 * time.Second)}
+	request := RenewPromptLeaseRequest{
+		Protocol: ProtocolVersion, Metadata: metadata, ExpectedLeaseGeneration: 1, Lease: lease,
+		MCPAuthorization: testPromptMCPAuthorizationAt(metadata, lease, now.Add(45*time.Second)),
+	}
+	sealRequest(t, request, &request.Metadata.RequestDigest)
+	return request
+}
+
+func clientTestPermissionRequest(t *testing.T, now time.Time, operation OperationID) ResolvePermissionRequest {
+	t.Helper()
+	request := ResolvePermissionRequest{
+		Protocol: ProtocolVersion, Metadata: clientTestMetadata(t, now, operation, true), RequestID: "permission-1",
+		Decision: PermissionDecision{Outcome: PermissionDecisionSelected, OptionID: "allow-once"},
+	}
+	sealRequest(t, request, &request.Metadata.RequestDigest)
+	return request
+}
+
+func clientTestCancelRequest(t *testing.T, now time.Time, operation OperationID) CancelPromptRequest {
+	t.Helper()
+	request := CancelPromptRequest{
+		Protocol: ProtocolVersion, Metadata: clientTestMetadata(t, now, operation, true),
+		Reason: CancelReasonUserRequested, SettlementDeadline: now.Add(30 * time.Second),
+	}
+	sealRequest(t, request, &request.Metadata.RequestDigest)
+	return request
+}
+
+func clientTestDeltaRequest(t *testing.T, now time.Time, operation OperationID) CreateWorkspaceDeltaRequest {
+	t.Helper()
+	request := CreateWorkspaceDeltaRequest{
+		Protocol: ProtocolVersion, Metadata: clientTestMetadata(t, now, operation, true), DeltaID: "delta-1",
+		Intent: WorkspaceIntentWrite, VerifiedBaseline: testWorkspaceBaseline(),
+		PromptSettlementDigest: testSHA256("settlement"), Limits: WorkspaceDeltaLimits{MaxBytes: 1 << 20, MaxEntries: 100},
+	}
+	sealRequest(t, request, &request.Metadata.RequestDigest)
+	return request
+}
+
+func clientTestDrainRequest(t *testing.T, now time.Time, operation OperationID) DrainRequest {
+	t.Helper()
+	fence := testFence(t)
+	fence.RuntimeSessionUID = ""
+	fence.RuntimeSessionGeneration = 0
+	request := DrainRequest{
+		Protocol: ProtocolVersion,
+		Metadata: MutationMetadata{
+			Fence: fence, OperationID: operation, RequestDigestSchemaVersion: RequestDigestSchemaVersion,
+			ExpiresAt: now.Add(45 * time.Second),
+		},
+		Reason: "rollout",
+	}
+	sealRequest(t, request, &request.Metadata.RequestDigest)
+	return request
+}
+
+func clientTestPublicationFinalizationRequest(t *testing.T, now time.Time, operation OperationID) FinalizeRuntimeSessionPublicationRequest {
+	t.Helper()
+	request := FinalizeRuntimeSessionPublicationRequest{
+		Protocol: ProtocolVersion, Metadata: clientTestMetadata(t, now, operation, true),
+		WorkspaceDeltaID: "delta-1", PublicationID: "publication-1", PublicationGeneration: 1, PublicationVersion: 7,
+		TerminalState: PublicationTerminalVerifiedExact, TerminalReceiptDigest: testSHA256("publication-receipt"),
+	}
+	sealRequest(t, request, &request.Metadata.RequestDigest)
+	return request
+}
+
+func clientTestDeleteRequest(t *testing.T, now time.Time, operation OperationID) DeleteRuntimeSessionRequest {
+	t.Helper()
+	request := DeleteRuntimeSessionRequest{
+		Protocol: ProtocolVersion, Metadata: clientTestMetadata(t, now, operation, false), Reason: "idle expiry",
+	}
+	request.Metadata.TaskUID = ""
+	request.Metadata.TaskAttempt = 0
+	sealRequest(t, request, &request.Metadata.RequestDigest)
+	return request
+}
+
+func clientTestDecodeMutation(t *testing.T, request *http.Request, target any, requireSession bool) {
+	t.Helper()
+	clientTestRequireBearer(t, request)
+	body, err := io.ReadAll(request.Body)
+	if err != nil {
+		t.Errorf("read request body: %v", err)
+		return
+	}
+	if err := json.Unmarshal(body, target); err != nil {
+		t.Errorf("decode request body: %v", err)
+		return
+	}
+	var envelope struct {
+		Metadata MutationMetadata `json:"metadata"`
+	}
+	if err := json.Unmarshal(body, &envelope); err != nil {
+		t.Errorf("decode request metadata: %v", err)
+		return
+	}
+	if err := VerifyOperationCapability(clientTestCapabilitySecret, request.Header.Get(OperationCapabilityHeader), envelope.Metadata, requireSession, time.Now().UTC()); err != nil {
+		t.Errorf("operation capability: %v", err)
+	}
+}
+
+func clientTestRequireBearer(t *testing.T, request *http.Request) {
+	t.Helper()
+	if got, want := request.Header.Get("Authorization"), "Bearer "+clientTestBearer; got != want {
+		t.Errorf("Authorization = %q, want %q", got, want)
+	}
+}
+
+func writeClientTestJSON(w http.ResponseWriter, status int, value any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(value)
+}
+
+type roundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripFunc) RoundTrip(request *http.Request) (*http.Response, error) { return f(request) }
+
+func clientTestEventIdentity(request StartPromptRequest, sequence uint64, at time.Time) EventIdentity {
+	return EventIdentity{
+		RuntimeInstanceID: request.Metadata.Fence.RuntimeInstanceID, SupervisorBootID: request.Metadata.Fence.SupervisorBootID,
+		RuntimeSessionUID:        request.Metadata.Fence.RuntimeSessionUID,
+		RuntimeSessionGeneration: request.Metadata.Fence.RuntimeSessionGeneration,
+		TaskUID:                  request.Metadata.TaskUID, TaskAttempt: request.Metadata.TaskAttempt,
+		PromptID: request.Metadata.PromptID, Sequence: sequence, RequestDigest: request.Metadata.RequestDigest, Timestamp: at,
+	}
+}
+
+func clientTestAcceptedEvent(request StartPromptRequest, at time.Time) Event {
+	return Event{
+		Protocol: ProtocolVersion, Type: EventAccepted, Identity: clientTestEventIdentity(request, 1, at),
+		Accepted: &AcceptedEvent{AcceptedAt: at, Lease: request.Lease, ACPVersion: ACPProfileV1},
+	}
+}
+
+func clientTestCompletedEvent(request StartPromptRequest, at time.Time) Event {
+	return Event{
+		Protocol: ProtocolVersion, Type: EventCompleted, Identity: clientTestEventIdentity(request, 2, at),
+		Completed: &CompletedEvent{
+			StopReason: ACPStopReasonEndTurn,
+			Result:     PromptResult{Content: []ContentBlock{{Type: ContentBlockText, Text: "done"}}, Model: "test-model"},
+		},
+	}
+}
+
+func writeClientTestNDJSON(w http.ResponseWriter, events ...Event) {
+	w.Header().Set("Content-Type", NDJSONMediaType)
+	for _, event := range events {
+		encoded, _ := json.Marshal(event)
+		_, _ = w.Write(append(encoded, '\n'))
+	}
+}
+
+func mustClientTestJSON(value any) string {
+	encoded, err := json.Marshal(value)
+	if err != nil {
+		panic(fmt.Sprintf("marshal test JSON: %v", err))
+	}
+	return string(encoded)
+}
diff --git a/internal/harness/v2/conformance/check.go b/internal/harness/v2/conformance/check.go
new file mode 100644
index 000000000..2ed0a696b
--- /dev/null
+++ b/internal/harness/v2/conformance/check.go
@@ -0,0 +1,433 @@
+package conformance
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"maps"
+	"mime"
+	"net/http"
+	"net/url"
+	"slices"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+const (
+	defaultControlTimeout = 60 * time.Second
+	maxProbeResponseBytes = int64(harnessv2.MaxCanonicalJSONBytes)
+)
+
+// Check probes one external runtime. It is deliberately single-attempt: no
+// control request is retried, and the lifecycle probe opens exactly one prompt
+// stream that is consumed to its original terminal settlement.
+func Check(ctx context.Context, target Target) Result {
+	result := Result{}
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	if err := validateTarget(target); err != nil {
+		result.Message = boundedMessage(err)
+		return result
+	}
+	timeout := target.ControlTimeout
+	if timeout <= 0 {
+		timeout = defaultControlTimeout
+	}
+	probeCtx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+
+	httpClient := &http.Client{
+		Timeout: timeout,
+		CheckRedirect: func(_ *http.Request, _ []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
+	}
+	client, err := harnessv2.NewClient(
+		target.BaseURL,
+		harnessv2.WithHTTPClient(httpClient),
+		harnessv2.WithControlTimeout(timeout),
+		harnessv2.WithControllerBearerToken(target.ControllerBearerToken),
+		harnessv2.WithOperationCapabilitySecret(target.OperationCapabilitySecret),
+		harnessv2.WithProtocolLimits(target.Limits),
+	)
+	if err != nil {
+		result.Message = boundedMessage(fmt.Errorf("construct v2 client: %w", err))
+		return result
+	}
+
+	health, err := client.Health(probeCtx)
+	if err != nil {
+		result.Message = boundedMessage(fmt.Errorf("unauthenticated health probe: %w", err))
+		return result
+	}
+	if health.Status != harnessv2.HealthStatusOK {
+		result.Message = fmt.Sprintf("runtime health status is %q, want %q", health.Status, harnessv2.HealthStatusOK)
+		return result
+	}
+
+	capabilities, err := getCapabilities(probeCtx, httpClient, target.BaseURL)
+	if err != nil {
+		result.Message = boundedMessage(fmt.Errorf("unauthenticated capabilities probe: %w", err))
+		return result
+	}
+	result.ObservedCapabilities = capabilities
+	if err := validateExactCapabilities(target, capabilities); err != nil {
+		result.Message = boundedMessage(err)
+		return result
+	}
+
+	if err := probeStatusAuthNegatives(probeCtx, httpClient, target); err != nil {
+		result.Message = boundedMessage(err)
+		return result
+	}
+	status, err := client.Status(probeCtx)
+	if err != nil {
+		result.Message = boundedMessage(fmt.Errorf("authenticated status probe: %w", err))
+		return result
+	}
+	result.ObservedStatus = status
+	if err := validateExactStatus(target, status); err != nil {
+		result.Message = boundedMessage(err)
+		return result
+	}
+
+	if err := probeMutationAuthNegatives(probeCtx, httpClient, target); err != nil {
+		result.Message = boundedMessage(err)
+		return result
+	}
+
+	if target.ProbeLifecycle {
+		result.LifecycleProbeExecuted = true
+		if err := probeLifecycle(probeCtx, httpClient, client, target, status); err != nil {
+			result.Message = boundedMessage(err)
+			return result
+		}
+	}
+
+	result.Passed = true
+	result.Message = "orka.harness.v2 conformance passed"
+	return result
+}
+
+func validateTarget(target Target) error {
+	if strings.TrimSpace(target.BaseURL) == "" {
+		return fmt.Errorf("base URL is required")
+	}
+	if strings.TrimSpace(string(target.ExpectedRuntimeInstanceID)) == "" {
+		return fmt.Errorf("expected runtime instance ID is required")
+	}
+	if err := target.Profile.Validate(); err != nil {
+		return fmt.Errorf("expected runtime profile: %w", err)
+	}
+	if len(target.Profile.AdapterDigests) != 1 {
+		return fmt.Errorf("external AgentRuntime profile must pin exactly one adapter digest")
+	}
+	digest, err := harnessv2.CanonicalProfileDigest(target.Profile)
+	if err != nil {
+		return fmt.Errorf("expected runtime profile digest: %w", err)
+	}
+	if err := harnessv2.ValidateProfileDigest(digest); err != nil {
+		return fmt.Errorf("expected runtime profile digest: %w", err)
+	}
+	if err := target.Limits.Validate(); err != nil {
+		return fmt.Errorf("expected protocol limits: %w", err)
+	}
+	if err := target.WorkspaceGovernance.Validate(); err != nil {
+		return fmt.Errorf("expected workspace governance: %w", err)
+	}
+	if len(target.ControllerBearerToken) < 32 {
+		return fmt.Errorf("controller bearer token must be at least 32 bytes")
+	}
+	if len(target.OperationCapabilitySecret) < harnessv2.MinCapabilitySecretBytes {
+		return fmt.Errorf("operation capability secret must be at least %d bytes", harnessv2.MinCapabilitySecretBytes)
+	}
+	if target.ControlTimeout < 0 {
+		return fmt.Errorf("control timeout must not be negative")
+	}
+	return nil
+}
+
+func validateExactCapabilities(target Target, observed *CapabilitiesResponse) error {
+	if observed == nil {
+		return fmt.Errorf("runtime returned no capabilities")
+	}
+	expectedDigest, err := harnessv2.CanonicalProfileDigest(target.Profile)
+	if err != nil {
+		return fmt.Errorf("canonicalize expected runtime profile: %w", err)
+	}
+	base := observed.CapabilitiesResponse
+	if base.RuntimeProfileDigest != expectedDigest {
+		return fmt.Errorf("runtime profile digest %q does not match expected %q", base.RuntimeProfileDigest, expectedDigest)
+	}
+	if base.ProfileDigestSchemaVersion != harnessv2.ProfileDigestSchemaVersion {
+		return fmt.Errorf("profile digest schema version %d does not match expected %d", base.ProfileDigestSchemaVersion, harnessv2.ProfileDigestSchemaVersion)
+	}
+	if base.ACPVersion != target.Profile.ACPProfile {
+		return fmt.Errorf("ACP profile %q does not match expected %q", base.ACPVersion, target.Profile.ACPProfile)
+	}
+	if !maps.Equal(base.AdapterDigests, target.Profile.AdapterDigests) {
+		return fmt.Errorf("adapter digest set does not exactly match the registered runtime profile")
+	}
+	if base.Limits != target.Limits {
+		return fmt.Errorf("protocol limits do not exactly match the AgentRuntime registration")
+	}
+	if base.SupportsDrain != target.SupportsDrain {
+		return fmt.Errorf("supportsDrain=%t does not match expected %t", base.SupportsDrain, target.SupportsDrain)
+	}
+	if base.SupportsPublicationFinalization != target.SupportsPublicationFinalization {
+		return fmt.Errorf("supportsPublicationFinalization=%t does not match expected %t", base.SupportsPublicationFinalization, target.SupportsPublicationFinalization)
+	}
+	if observed.WorkspaceGovernance != target.WorkspaceGovernance {
+		return fmt.Errorf("workspace governance claims do not exactly match the AgentRuntime registration")
+	}
+	if !slices.Contains(base.Provider.ProviderKinds, target.Profile.ProviderKind) {
+		return fmt.Errorf("provider kind %q is absent from capabilities", target.Profile.ProviderKind)
+	}
+	if !slices.Contains(base.Provider.Models, target.Profile.Model) {
+		return fmt.Errorf("model %q is absent from capabilities", target.Profile.Model)
+	}
+	if !base.Provider.SupportsCancel {
+		return fmt.Errorf("provider capabilities must support cancellation")
+	}
+	if target.WorkspaceGovernance.Strict() && (!base.Provider.SupportsPermissions || !base.Provider.SupportsTools) {
+		return fmt.Errorf("strict-governed runtime must support permissions and prompt-scoped tools")
+	}
+	return nil
+}
+
+func validateExactStatus(target Target, status *harnessv2.StatusResponse) error {
+	if status == nil {
+		return fmt.Errorf("runtime returned no authenticated status")
+	}
+	expectedDigest, err := harnessv2.CanonicalProfileDigest(target.Profile)
+	if err != nil {
+		return fmt.Errorf("canonicalize expected runtime profile: %w", err)
+	}
+	if status.Fence.RuntimeInstanceID != target.ExpectedRuntimeInstanceID {
+		return fmt.Errorf("authenticated status runtime instance ID %q does not match expected %q", status.Fence.RuntimeInstanceID, target.ExpectedRuntimeInstanceID)
+	}
+	if status.Fence.RuntimeProfileDigest != expectedDigest {
+		return fmt.Errorf("authenticated status profile digest %q does not match expected %q", status.Fence.RuntimeProfileDigest, expectedDigest)
+	}
+	if status.Fence.ProfileDigestSchemaVersion != harnessv2.ProfileDigestSchemaVersion {
+		return fmt.Errorf("authenticated status profile digest schema version %d does not match expected %d", status.Fence.ProfileDigestSchemaVersion, harnessv2.ProfileDigestSchemaVersion)
+	}
+	if status.Lifecycle != harnessv2.SupervisorLifecycleReady {
+		return fmt.Errorf("supervisor lifecycle is %q, want %q", status.Lifecycle, harnessv2.SupervisorLifecycleReady)
+	}
+	if status.Drain.Requested || !status.Drain.AcceptingNewSessions {
+		return fmt.Errorf("external runtime is not accepting new sessions")
+	}
+	if status.Pressure.ResidentSessions > target.Limits.MaxResidentSessions {
+		return fmt.Errorf("resident session pressure %d exceeds limit %d", status.Pressure.ResidentSessions, target.Limits.MaxResidentSessions)
+	}
+	if status.Pressure.ActivePrompts > target.Limits.MaxConcurrentPrompts {
+		return fmt.Errorf("active prompt pressure %d exceeds limit %d", status.Pressure.ActivePrompts, target.Limits.MaxConcurrentPrompts)
+	}
+	if status.Pressure.PendingPermissions > target.Limits.MaxPendingPermissions {
+		return fmt.Errorf("pending permission pressure %d exceeds limit %d", status.Pressure.PendingPermissions, target.Limits.MaxPendingPermissions)
+	}
+	return nil
+}
+
+func getCapabilities(ctx context.Context, client *http.Client, baseURL string) (*CapabilitiesResponse, error) {
+	endpoint, err := endpointURL(baseURL, harnessv2.CapabilitiesPath)
+	if err != nil {
+		return nil, err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("Accept-Encoding", "identity")
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close() //nolint:errcheck
+	if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusMultipleChoices {
+		return nil, fmt.Errorf("capabilities endpoint returned HTTP %d", resp.StatusCode)
+	}
+	if err := requireJSON(resp.Header.Get("Content-Type")); err != nil {
+		return nil, err
+	}
+	body, err := readBounded(resp.Body, resp.ContentLength, maxProbeResponseBytes)
+	if err != nil {
+		return nil, err
+	}
+	if _, err := harnessv2.CanonicalJSON(body); err != nil {
+		return nil, fmt.Errorf("capabilities response is not valid bounded JSON: %w", err)
+	}
+	var response CapabilitiesResponse
+	decoder := json.NewDecoder(bytes.NewReader(body))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&response); err != nil {
+		return nil, fmt.Errorf("decode capabilities response: %w", err)
+	}
+	if err := requireJSONEOF(decoder); err != nil {
+		return nil, err
+	}
+	if err := response.Validate(); err != nil {
+		return nil, fmt.Errorf("validate capabilities response: %w", err)
+	}
+	return &response, nil
+}
+
+func probeStatusAuthNegatives(ctx context.Context, client *http.Client, target Target) error {
+	if err := expectAuthRejected(ctx, client, target.BaseURL, http.MethodGet, harnessv2.StatusPath, "", "", nil); err != nil {
+		return fmt.Errorf("unauthenticated status negative probe: %w", err)
+	}
+	wrongToken := strings.Repeat("w", 32)
+	if wrongToken == target.ControllerBearerToken {
+		wrongToken = strings.Repeat("z", 32)
+	}
+	if err := expectAuthRejected(ctx, client, target.BaseURL, http.MethodGet, harnessv2.StatusPath, wrongToken, "", nil); err != nil {
+		return fmt.Errorf("wrong-token status negative probe: %w", err)
+	}
+	return nil
+}
+
+func probeMutationAuthNegatives(ctx context.Context, client *http.Client, target Target) error {
+	path := harnessv2.RuntimeSessionsPath + "/conformance-auth-negative"
+	body := []byte(`{"protocol":"orka.harness.v2"}`)
+	if err := expectAuthRejected(ctx, client, target.BaseURL, http.MethodPut, path, "", "", body); err != nil {
+		return fmt.Errorf("unauthenticated mutation negative probe: %w", err)
+	}
+	wrongToken := strings.Repeat("w", 32)
+	if wrongToken == target.ControllerBearerToken {
+		wrongToken = strings.Repeat("z", 32)
+	}
+	if err := expectAuthRejected(ctx, client, target.BaseURL, http.MethodPut, path, wrongToken, "", body); err != nil {
+		return fmt.Errorf("wrong-token mutation negative probe: %w", err)
+	}
+	if err := expectAuthRejected(ctx, client, target.BaseURL, http.MethodPut, path, target.ControllerBearerToken, "", body); err != nil {
+		return fmt.Errorf("missing operation-capability negative probe: %w", err)
+	}
+	if err := expectAuthRejected(ctx, client, target.BaseURL, http.MethodPut, path, target.ControllerBearerToken, "invalid.capability", body); err != nil {
+		return fmt.Errorf("invalid operation-capability negative probe: %w", err)
+	}
+	return nil
+}
+
+func expectAuthRejected(
+	ctx context.Context,
+	client *http.Client,
+	baseURL, method, relative, bearer, capability string,
+	body []byte,
+) error {
+	endpoint, err := endpointURL(baseURL, relative)
+	if err != nil {
+		return err
+	}
+	req, err := http.NewRequestWithContext(ctx, method, endpoint, bytes.NewReader(body))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("Accept-Encoding", "identity")
+	if len(body) != 0 {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	if bearer != "" {
+		req.Header.Set("Authorization", "Bearer "+bearer)
+	}
+	if capability != "" {
+		req.Header.Set(harnessv2.OperationCapabilityHeader, capability)
+	}
+	resp, err := client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close() //nolint:errcheck
+	_, _ = io.Copy(io.Discard, io.LimitReader(resp.Body, 4096))
+	if resp.StatusCode != http.StatusUnauthorized && resp.StatusCode != http.StatusForbidden {
+		return fmt.Errorf("endpoint returned HTTP %d, want 401 or 403", resp.StatusCode)
+	}
+	return nil
+}
+
+func endpointURL(baseURL, relative string) (string, error) {
+	parsed, err := url.Parse(strings.TrimSpace(baseURL))
+	if err != nil {
+		return "", fmt.Errorf("parse base URL: %w", err)
+	}
+	if parsed.Scheme != "http" && parsed.Scheme != "https" || parsed.Host == "" {
+		return "", fmt.Errorf("base URL must be absolute HTTP(S)")
+	}
+	if parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" || parsed.RawPath != "" || strings.Contains(parsed.Path, "\\") {
+		return "", fmt.Errorf("base URL contains unsupported components")
+	}
+	if !strings.HasPrefix(relative, "/v2/") || strings.ContainsAny(relative, "?#\\\r\n") || strings.Contains(relative, "//") {
+		return "", fmt.Errorf("endpoint path is not a canonical /v2 path")
+	}
+	prefix := strings.TrimSuffix(parsed.Path, "/")
+	if prefix == "/" {
+		prefix = ""
+	}
+	parsed.Path = prefix + relative
+	return parsed.String(), nil
+}
+
+func requireJSON(header string) error {
+	mediaType, _, err := mime.ParseMediaType(header)
+	if err != nil {
+		return fmt.Errorf("parse response Content-Type: %w", err)
+	}
+	if !strings.EqualFold(mediaType, "application/json") {
+		return fmt.Errorf("response Content-Type %q is unsupported", mediaType)
+	}
+	return nil
+}
+
+func readBounded(reader io.Reader, contentLength, limit int64) ([]byte, error) {
+	if contentLength > limit {
+		return nil, fmt.Errorf("response Content-Length %d exceeds limit %d", contentLength, limit)
+	}
+	body, err := io.ReadAll(io.LimitReader(reader, limit+1))
+	if err != nil {
+		return nil, err
+	}
+	if int64(len(body)) > limit {
+		return nil, fmt.Errorf("response exceeds limit %d", limit)
+	}
+	if len(bytes.TrimSpace(body)) == 0 {
+		return nil, fmt.Errorf("response body is empty")
+	}
+	return body, nil
+}
+
+func requireJSONEOF(decoder *json.Decoder) error {
+	var extra any
+	if err := decoder.Decode(&extra); !errors.Is(err, io.EOF) {
+		if err == nil {
+			return fmt.Errorf("JSON response contains a trailing value")
+		}
+		return fmt.Errorf("JSON response contains trailing data: %w", err)
+	}
+	return nil
+}
+
+func boundedMessage(err error) string {
+	if err == nil {
+		return ""
+	}
+	// Repair invalid sequences and truncate on a rune boundary so bounded
+	// messages always remain valid UTF-8.
+	message := strings.ToValidUTF8(strings.TrimSpace(err.Error()), "�")
+	if len(message) <= 1024 {
+		return message
+	}
+	end := 1024
+	for end > 0 && !utf8.RuneStart(message[end]) {
+		end--
+	}
+	return message[:end]
+}
diff --git a/internal/harness/v2/conformance/check_test.go b/internal/harness/v2/conformance/check_test.go
new file mode 100644
index 000000000..bf2c6c3ed
--- /dev/null
+++ b/internal/harness/v2/conformance/check_test.go
@@ -0,0 +1,290 @@
+package conformance_test
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"strings"
+	"testing"
+	"time"
+
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/harness/v2/conformance"
+	"github.com/orka-agents/orka/internal/harness/v2/conformance/conformancetest"
+)
+
+func TestCheckPassesStrictHostileLifecycleOnce(t *testing.T) {
+	target, config := testTargetAndConfig(t)
+	target.ProbeLifecycle = true
+	server, err := conformancetest.NewServer(config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer server.Close()
+	target.BaseURL = server.URL()
+
+	result := conformance.Check(t.Context(), target)
+	if !result.Passed {
+		t.Fatalf("Check() failed: %s", result.Message)
+	}
+	if !result.LifecycleProbeExecuted {
+		t.Fatal("hostile lifecycle probe was not executed")
+	}
+	if result.ObservedCapabilities == nil || result.ObservedStatus == nil {
+		t.Fatalf("observations are incomplete: %#v", result)
+	}
+	counts := server.Counts()
+	if counts.SessionCreates != 1 || counts.PromptStarts != 1 || counts.PromptCancels != 1 || counts.WorkspaceDeltas != 1 || counts.SessionDeletes != 1 {
+		t.Fatalf("hostile cycle counts = %#v, want exactly one accepted create/prompt/cancel/delta/delete", counts)
+	}
+	if counts.ReplayClassifications != 6 || counts.DigestConflicts != 6 {
+		t.Fatalf("hostile replay counts = %#v, want six exact replays and six digest conflicts", counts)
+	}
+}
+
+func TestCheckRejectsClaimedDuplicateSafetyWithoutReplaySemantics(t *testing.T) {
+	for _, test := range []struct {
+		name   string
+		mutate func(*conformancetest.Config)
+		want   string
+	}{
+		{
+			name: "identical replay",
+			mutate: func(config *conformancetest.Config) {
+				config.BreakDuplicateSafeMutations = true
+			},
+			want: "identical runtime-session creation classified",
+		},
+		{
+			name: "digest conflict",
+			mutate: func(config *conformancetest.Config) {
+				config.BreakDigestConflictClassification = true
+			},
+			want: "conflicting runtime-session creation succeeded",
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			target, config := testTargetAndConfig(t)
+			target.ProbeLifecycle = true
+			test.mutate(&config)
+			server, err := conformancetest.NewServer(config)
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer server.Close()
+			target.BaseURL = server.URL()
+
+			result := conformance.Check(t.Context(), target)
+			if result.Passed || !strings.Contains(result.Message, test.want) {
+				t.Fatalf("Check() = %#v, want duplicate-safety failure containing %q", result, test.want)
+			}
+		})
+	}
+}
+
+func TestCheckNeverReconnectsOrReplaysDisconnectedPrompt(t *testing.T) {
+	target, config := testTargetAndConfig(t)
+	target.ProbeLifecycle = true
+	config.DisconnectPromptAfterAccepted = true
+	server, err := conformancetest.NewServer(config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer server.Close()
+	target.BaseURL = server.URL()
+
+	result := conformance.Check(t.Context(), target)
+	if result.Passed || !strings.Contains(result.Message, "original prompt stream") {
+		t.Fatalf("Check() = %#v, want disconnected-stream failure", result)
+	}
+	if got := server.Counts().PromptStarts; got != 1 {
+		t.Fatalf("prompt starts = %d, want exactly one with no reconnect or replay", got)
+	}
+}
+
+func TestCheckRejectsUnauthenticatedStatusExposure(t *testing.T) {
+	target, config := testTargetAndConfig(t)
+	config.AllowUnauthenticatedStatus = true
+	server, err := conformancetest.NewServer(config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer server.Close()
+	target.BaseURL = server.URL()
+
+	result := conformance.Check(t.Context(), target)
+	if result.Passed || !strings.Contains(result.Message, "unauthenticated status negative probe") {
+		t.Fatalf("Check() = %#v, want status auth-negative failure", result)
+	}
+}
+
+func TestCheckExercisesPublicationFinalizationForWriteRuntime(t *testing.T) {
+	target, config := testTargetAndConfig(t)
+	target.Profile.WorkspaceIntent = harnessv2.WorkspaceIntentWrite
+	config.Profile = target.Profile
+	target.SupportsPublicationFinalization = true
+	target.ProbeLifecycle = true
+	config.SupportsPublicationFinalization = true
+	server, err := conformancetest.NewServer(config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer server.Close()
+	target.BaseURL = server.URL()
+	result := conformance.Check(t.Context(), target)
+	if !result.Passed || !result.LifecycleProbeExecuted {
+		t.Fatalf("Check() = %#v, want successful publication-finalization lifecycle", result)
+	}
+}
+
+func TestCheckRetriesCleanupAfterUnconfirmedSessionDelete(t *testing.T) {
+	target, config := testTargetAndConfig(t)
+	target.ProbeLifecycle = true
+	config.FailFirstSessionDeleteBeforeApply = true
+	server, err := conformancetest.NewServer(config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer server.Close()
+	target.BaseURL = server.URL()
+
+	result := conformance.Check(t.Context(), target)
+	if result.Passed || !strings.Contains(result.Message, "delete conformance runtime session") {
+		t.Fatalf("Check() = %#v, want injected deletion failure", result)
+	}
+	counts := server.Counts()
+	if counts.SessionDeleteAttempts != 2 || counts.SessionDeletes != 1 {
+		t.Fatalf("delete cleanup counts = attempts:%d applied:%d, want attempts:2 applied:1", counts.SessionDeleteAttempts, counts.SessionDeletes)
+	}
+}
+
+func TestCheckRejectsFreshPublicationFinalizationAppliedAtReplacement(t *testing.T) {
+	target, config := testTargetAndConfig(t)
+	target.Profile.WorkspaceIntent = harnessv2.WorkspaceIntentWrite
+	config.Profile = target.Profile
+	target.SupportsPublicationFinalization = true
+	target.ProbeLifecycle = true
+	config.SupportsPublicationFinalization = true
+	config.BreakFreshPublicationFinalizationAppliedAt = true
+	server, err := conformancetest.NewServer(config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer server.Close()
+	target.BaseURL = server.URL()
+
+	result := conformance.Check(t.Context(), target)
+	if result.Passed || !strings.Contains(result.Message, "did not preserve the original receipt") {
+		t.Fatalf("Check() = %#v, want fresh-recovery AppliedAt failure", result)
+	}
+}
+
+func TestCheckRejectsConflictingFreshPublicationFinalization(t *testing.T) {
+	target, config := testTargetAndConfig(t)
+	target.Profile.WorkspaceIntent = harnessv2.WorkspaceIntentWrite
+	config.Profile = target.Profile
+	target.SupportsPublicationFinalization = true
+	target.ProbeLifecycle = true
+	config.SupportsPublicationFinalization = true
+	config.BreakFreshPublicationFinalizationConflictGuard = true
+	server, err := conformancetest.NewServer(config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer server.Close()
+	target.BaseURL = server.URL()
+
+	result := conformance.Check(t.Context(), target)
+	if result.Passed || !strings.Contains(result.Message, "conflicting fresh publication finalization succeeded") {
+		t.Fatalf("Check() = %#v, want conflicting fresh-receipt failure", result)
+	}
+}
+
+func TestCheckRejectsExactInstanceMismatch(t *testing.T) {
+	target, config := testTargetAndConfig(t)
+	server, err := conformancetest.NewServer(config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer server.Close()
+	target.BaseURL = server.URL()
+	target.ExpectedRuntimeInstanceID = "different-runtime-instance"
+
+	result := conformance.Check(t.Context(), target)
+	if result.Passed || !strings.Contains(result.Message, "runtime instance ID") {
+		t.Fatalf("Check() = %#v, want exact-instance failure", result)
+	}
+}
+
+func TestCheckRejectsTrustedRuntimeWithoutExplicitTrust(t *testing.T) {
+	target, _ := testTargetAndConfig(t)
+	target.BaseURL = "http://example.invalid"
+	target.WorkspaceGovernance = conformance.WorkspaceGovernanceClaims{Mode: conformance.WorkspaceGovernanceTrusted}
+	result := conformance.Check(t.Context(), target)
+	if result.Passed || !strings.Contains(result.Message, "explicitly marked trusted") {
+		t.Fatalf("Check() = %#v, want explicit-trust failure", result)
+	}
+}
+
+func testTargetAndConfig(t *testing.T) (conformance.Target, conformancetest.Config) {
+	t.Helper()
+	toolPolicy := harnessv2.MCPToolPolicy{AllowedToolNames: []string{}, Tools: []harnessv2.MCPToolDescriptor{}}
+	toolPolicy.DescriptorDigest, _ = harnessv2.CanonicalMCPToolDescriptorDigest(toolPolicy.Tools)
+	approvalPolicy := harnessv2.MCPApprovalPolicy{}
+	toolPolicyDigest, _ := harnessv2.CanonicalRuntimeToolPolicyDigest(toolPolicy.AllowedToolNames, toolPolicy.DisallowedToolNames, toolPolicy.AllowBash)
+	approvalPolicyDigest, _ := harnessv2.CanonicalMCPApprovalPolicyDigest(approvalPolicy)
+	mcpConfigurationDigest, _ := harnessv2.CanonicalMCPConfigurationDigest(toolPolicy.AllowedToolNames)
+	profile := harnessv2.RuntimeProfile{
+		ACPProfile:               harnessv2.ACPProfileV1,
+		AdapterDigests:           map[string]string{"codex": testDigest("adapter")},
+		ProviderKind:             "codex",
+		Model:                    "gpt-test",
+		AgentConfigurationDigest: testDigest("agent"),
+		ToolPolicyDigest:         toolPolicyDigest,
+		ApprovalPolicyDigest:     approvalPolicyDigest,
+		MCPConfigurationDigest:   mcpConfigurationDigest,
+		WorkspaceIntent:          harnessv2.WorkspaceIntentRead,
+		ProxyCredentialRole:      "provider-proxy",
+		ProxyCredentialScope:     "session-and-prompt",
+		ResourceClass:            "standard",
+	}
+	limits := harnessv2.DefaultProtocolLimits()
+	claims := conformance.WorkspaceGovernanceClaims{
+		Mode:                            conformance.WorkspaceGovernanceStrict,
+		OrkaOwnedWorkspaceDeltas:        true,
+		PromptScopedBrokerAuthorization: true,
+		NoDirectSCMPublication:          true,
+		OrkaOwnedCleanRoomPublication:   true,
+		ExactInstanceFencing:            true,
+		DuplicateSafeMutations:          true,
+		CancellationSettlement:          true,
+	}
+	token := strings.Repeat("t", 32)
+	secret := []byte(strings.Repeat("s", 32))
+	config := conformancetest.Config{
+		ControllerBearerToken:     token,
+		OperationCapabilitySecret: secret,
+		RuntimeInstanceID:         "external-runtime-instance-1",
+		SupervisorBootID:          "boot-1",
+		RuntimePoolUID:            "external-pool-1",
+		Profile:                   profile,
+		Limits:                    limits,
+		SupportsDrain:             true,
+		WorkspaceGovernance:       claims,
+	}
+	target := conformance.Target{
+		ControllerBearerToken:     token,
+		OperationCapabilitySecret: secret,
+		ControlTimeout:            10 * time.Second,
+		ExpectedRuntimeInstanceID: config.RuntimeInstanceID,
+		Profile:                   profile,
+		Limits:                    limits,
+		SupportsDrain:             true,
+		WorkspaceGovernance:       claims,
+	}
+	return target, config
+}
+
+func testDigest(seed string) string {
+	sum := sha256.Sum256([]byte(seed))
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
diff --git a/internal/harness/v2/conformance/conformancetest/server.go b/internal/harness/v2/conformance/conformancetest/server.go
new file mode 100644
index 000000000..cae09a048
--- /dev/null
+++ b/internal/harness/v2/conformance/conformancetest/server.go
@@ -0,0 +1,928 @@
+package conformancetest
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/harness/v2/conformance"
+)
+
+type Config struct {
+	ControllerBearerToken           string
+	OperationCapabilitySecret       []byte
+	RuntimeInstanceID               harnessv2.RuntimeInstanceID
+	SupervisorBootID                harnessv2.SupervisorBootID
+	RuntimePoolUID                  harnessv2.RuntimePoolUID
+	Profile                         harnessv2.RuntimeProfile
+	Limits                          harnessv2.ProtocolLimits
+	SupportsDrain                   bool
+	SupportsPublicationFinalization bool
+	WorkspaceGovernance             conformance.WorkspaceGovernanceClaims
+	AllowUnauthenticatedStatus      bool
+	DisconnectPromptAfterAccepted   bool
+
+	// These test-only faults prove that the conformance cycle rejects runtimes
+	// which advertise duplicate-safe mutations without honoring replay semantics.
+	BreakDuplicateSafeMutations       bool
+	BreakDigestConflictClassification bool
+
+	// These faults prove that publication-finalization recovery is exact even
+	// when the controller must allocate a fresh operation identity.
+	BreakFreshPublicationFinalizationAppliedAt     bool
+	BreakFreshPublicationFinalizationConflictGuard bool
+	FailFirstSessionDeleteBeforeApply              bool
+}
+
+type Counts struct {
+	SessionCreates        int64
+	PromptStarts          int64
+	PromptCancels         int64
+	WorkspaceDeltas       int64
+	SessionDeletes        int64
+	SessionDeleteAttempts int64
+	ReplayClassifications int64
+	DigestConflicts       int64
+}
+
+type Server struct {
+	server *httptest.Server
+	config Config
+
+	sessionCreates        atomic.Int64
+	promptStarts          atomic.Int64
+	promptCancels         atomic.Int64
+	workspaceDeltas       atomic.Int64
+	sessionDeletes        atomic.Int64
+	sessionDeleteAttempts atomic.Int64
+	replayClassifications atomic.Int64
+	digestConflicts       atomic.Int64
+
+	mu                    sync.Mutex
+	fence                 harnessv2.Fence
+	operations            map[harnessv2.OperationID]harnessv2.OperationRecord
+	sessions              map[harnessv2.RuntimeSessionID]sessionState
+	prompts               map[harnessv2.PromptID]*promptState
+	workspaceResponses    map[harnessv2.OperationID]harnessv2.CreateWorkspaceDeltaResponse
+	finalizationResponses map[harnessv2.OperationID]harnessv2.FinalizeRuntimeSessionPublicationResponse
+	deleteResponses       map[harnessv2.OperationID]harnessv2.DeleteRuntimeSessionResponse
+}
+
+type sessionState struct {
+	descriptor   harnessv2.RuntimeSessionDescriptor
+	relativeRoot string
+	deltas       map[harnessv2.WorkspaceDeltaID]harnessv2.WorkspaceDeltaDescriptor
+	finalization *harnessv2.PublicationFinalizationReceipt
+}
+
+type promptState struct {
+	request    harnessv2.StartPromptRequest
+	acceptedAt time.Time
+	cancelled  chan struct{}
+	settled    chan struct{}
+	cancelOnce sync.Once
+	settleOnce sync.Once
+	settlement *harnessv2.PromptSettlement
+}
+
+func NewServer(config Config) (*Server, error) {
+	if config.ControllerBearerToken == "" {
+		config.ControllerBearerToken = "controller-token-0123456789abcdef"
+	}
+	if len(config.OperationCapabilitySecret) == 0 {
+		config.OperationCapabilitySecret = []byte("capability-secret-0123456789abcdef")
+	}
+	if config.RuntimeInstanceID == "" {
+		config.RuntimeInstanceID = "runtime-instance-1"
+	}
+	if config.SupervisorBootID == "" {
+		config.SupervisorBootID = "boot-1"
+	}
+	if config.RuntimePoolUID == "" {
+		config.RuntimePoolUID = "external-pool-1"
+	}
+	if config.Limits.MaxResidentSessions == 0 {
+		config.Limits = harnessv2.DefaultProtocolLimits()
+	}
+	if err := config.Profile.Validate(); err != nil {
+		return nil, fmt.Errorf("profile: %w", err)
+	}
+	profileDigest, err := harnessv2.CanonicalProfileDigest(config.Profile)
+	if err != nil {
+		return nil, err
+	}
+	s := &Server{
+		config: config,
+		fence: harnessv2.Fence{
+			RuntimeInstanceID:          config.RuntimeInstanceID,
+			SupervisorBootID:           config.SupervisorBootID,
+			ControllerEpoch:            1,
+			RuntimePoolUID:             config.RuntimePoolUID,
+			RuntimePoolGeneration:      1,
+			RuntimeProfileDigest:       profileDigest,
+			ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+		},
+		operations:            map[harnessv2.OperationID]harnessv2.OperationRecord{},
+		sessions:              map[harnessv2.RuntimeSessionID]sessionState{},
+		prompts:               map[harnessv2.PromptID]*promptState{},
+		workspaceResponses:    map[harnessv2.OperationID]harnessv2.CreateWorkspaceDeltaResponse{},
+		finalizationResponses: map[harnessv2.OperationID]harnessv2.FinalizeRuntimeSessionPublicationResponse{},
+		deleteResponses:       map[harnessv2.OperationID]harnessv2.DeleteRuntimeSessionResponse{},
+	}
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET "+harnessv2.HealthPath, s.handleHealth)
+	mux.HandleFunc("GET "+harnessv2.CapabilitiesPath, s.handleCapabilities)
+	mux.HandleFunc("GET "+harnessv2.StatusPath, s.handleStatus)
+	mux.HandleFunc("PUT /v2/runtime-sessions/{sessionID}", s.handleCreateSession)
+	mux.HandleFunc("PUT /v2/runtime-sessions/{sessionID}/prompts/{promptID}", s.handlePrompt)
+	mux.HandleFunc("PUT /v2/runtime-sessions/{sessionID}/prompts/{promptID}/cancel", s.handleCancel)
+	mux.HandleFunc("PUT /v2/runtime-sessions/{sessionID}/workspace-deltas/{deltaID}", s.handleWorkspaceDelta)
+	mux.HandleFunc("PUT /v2/runtime-sessions/{sessionID}/publication-finalization", s.handlePublicationFinalization)
+	mux.HandleFunc("DELETE /v2/runtime-sessions/{sessionID}", s.handleDeleteSession)
+	s.server = httptest.NewServer(mux)
+	return s, nil
+}
+
+func (s *Server) URL() string { return s.server.URL }
+func (s *Server) Close()      { s.server.Close() }
+
+func (s *Server) Fence() harnessv2.Fence {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.fence
+}
+
+func (s *Server) SetFence(fence harnessv2.Fence) error {
+	if fence.RuntimeSessionUID != "" || fence.RuntimeSessionGeneration != 0 {
+		return fmt.Errorf("test server fence must be pool-scoped")
+	}
+	if err := fence.Validate(false); err != nil {
+		return err
+	}
+	s.mu.Lock()
+	s.fence = fence
+	s.mu.Unlock()
+	return nil
+}
+
+func (s *Server) Counts() Counts {
+	return Counts{
+		SessionCreates:        s.sessionCreates.Load(),
+		PromptStarts:          s.promptStarts.Load(),
+		PromptCancels:         s.promptCancels.Load(),
+		WorkspaceDeltas:       s.workspaceDeltas.Load(),
+		SessionDeletes:        s.sessionDeletes.Load(),
+		SessionDeleteAttempts: s.sessionDeleteAttempts.Load(),
+		ReplayClassifications: s.replayClassifications.Load(),
+		DigestConflicts:       s.digestConflicts.Load(),
+	}
+}
+
+func (s *Server) handleHealth(w http.ResponseWriter, _ *http.Request) {
+	writeJSON(w, http.StatusOK, harnessv2.HealthResponse{Protocol: harnessv2.ProtocolVersion, Status: harnessv2.HealthStatusOK, Timestamp: time.Now().UTC()})
+}
+
+func (s *Server) handleCapabilities(w http.ResponseWriter, _ *http.Request) {
+	fence := s.Fence()
+	writeJSON(w, http.StatusOK, conformance.CapabilitiesResponse{
+		CapabilitiesResponse: harnessv2.CapabilitiesResponse{
+			Protocol:                   harnessv2.ProtocolVersion,
+			Transport:                  "http+ndjson",
+			ACPVersion:                 s.config.Profile.ACPProfile,
+			RuntimeProfileDigest:       fence.RuntimeProfileDigest,
+			ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+			AdapterDigests:             s.config.Profile.AdapterDigests,
+			Limits:                     s.config.Limits,
+			Provider: harnessv2.ProviderCapabilities{
+				ProviderKinds:       []string{s.config.Profile.ProviderKind},
+				Models:              []string{s.config.Profile.Model},
+				SupportsPermissions: true,
+				SupportsCancel:      true,
+				SupportsTools:       true,
+			},
+			WorkspaceGovernance:             s.config.WorkspaceGovernance,
+			SupportsDrain:                   s.config.SupportsDrain,
+			SupportsPublicationFinalization: s.config.SupportsPublicationFinalization,
+		},
+	})
+}
+
+func (s *Server) handleStatus(w http.ResponseWriter, r *http.Request) {
+	if !s.config.AllowUnauthenticatedStatus && !s.authorizeBearer(w, r) {
+		return
+	}
+	writeJSON(w, http.StatusOK, harnessv2.StatusResponse{
+		Protocol:           harnessv2.ProtocolVersion,
+		Fence:              s.Fence(),
+		Lifecycle:          harnessv2.SupervisorLifecycleReady,
+		Drain:              harnessv2.DrainStatus{AcceptingNewSessions: true},
+		Sessions:           []harnessv2.RuntimeSessionStatus{},
+		ActivePrompts:      []harnessv2.ActivePromptStatus{},
+		PendingPermissions: []harnessv2.PendingPermissionStatus{},
+		Pressure:           harnessv2.PressureMetadata{},
+		Timestamp:          time.Now().UTC(),
+	})
+}
+
+func (s *Server) handleCreateSession(w http.ResponseWriter, r *http.Request) {
+	if !s.authorizeMutationHeaders(w, r) {
+		return
+	}
+	var request harnessv2.CreateRuntimeSessionRequest
+	if !decodeJSON(w, r, &request) || !s.verifyCapability(w, r, request.Metadata) {
+		return
+	}
+	now := time.Now().UTC()
+	if err := request.ValidateAt(now); err != nil {
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil)
+		return
+	}
+	if string(request.RuntimeSessionID) != r.PathValue("sessionID") {
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, "runtime session path does not match request", nil)
+		return
+	}
+
+	s.mu.Lock()
+	fence := s.fence
+	expected := fence
+	expected.RuntimeSessionUID = request.Metadata.Fence.RuntimeSessionUID
+	expected.RuntimeSessionGeneration = request.Metadata.Fence.RuntimeSessionGeneration
+	existing := operationPtr(s.operations, request.Metadata.OperationID)
+	classification, err := s.classifyOperation(expected, request.Metadata, existing, now)
+	if err != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil)
+		return
+	}
+	if existing != nil {
+		state, ok := s.sessions[request.RuntimeSessionID]
+		s.mu.Unlock()
+		if classification.Class == harnessv2.RequestClassificationDuplicate || classification.Class == harnessv2.RequestClassificationFresh {
+			if !ok {
+				writeError(w, http.StatusConflict, harnessv2.ErrorCodeInvalidRequest, "session replay state is unavailable", nil)
+				return
+			}
+			writeJSON(w, http.StatusOK, harnessv2.CreateRuntimeSessionResponse{
+				Protocol: harnessv2.ProtocolVersion, Classification: classification, Session: state.descriptor,
+			})
+			return
+		}
+		writeClassificationError(w, classification)
+		return
+	}
+	if classification.Class != harnessv2.RequestClassificationFresh {
+		s.mu.Unlock()
+		writeClassificationError(w, classification)
+		return
+	}
+	if _, exists := s.sessions[request.RuntimeSessionID]; exists {
+		s.mu.Unlock()
+		writeError(w, http.StatusConflict, harnessv2.ErrorCodeDigestConflict, "runtime session identity already exists", nil)
+		return
+	}
+	s.sessionCreates.Add(1)
+	descriptor := harnessv2.RuntimeSessionDescriptor{
+		RuntimeSessionID:     request.RuntimeSessionID,
+		RuntimeSessionUID:    request.Metadata.Fence.RuntimeSessionUID,
+		Generation:           request.Metadata.Fence.RuntimeSessionGeneration,
+		RuntimeInstanceID:    fence.RuntimeInstanceID,
+		SupervisorBootID:     fence.SupervisorBootID,
+		RuntimeProfileDigest: fence.RuntimeProfileDigest,
+		State:                harnessv2.RuntimeSessionStateIdle,
+		ProviderSessionID:    "provider-session-" + string(request.RuntimeSessionID),
+		WorkspaceBaseline:    request.Workspace.Baseline,
+		CreatedAt:            now,
+		LastTransitionAt:     now,
+	}
+	s.sessions[request.RuntimeSessionID] = sessionState{
+		descriptor: descriptor, relativeRoot: strings.TrimSpace(request.Workspace.RelativeRoot),
+		deltas: make(map[harnessv2.WorkspaceDeltaID]harnessv2.WorkspaceDeltaDescriptor),
+	}
+	s.operations[request.Metadata.OperationID] = operationRecord(request.Metadata, harnessv2.OperationPhaseApplied, "", now)
+	s.mu.Unlock()
+	writeJSON(w, http.StatusCreated, harnessv2.CreateRuntimeSessionResponse{
+		Protocol: harnessv2.ProtocolVersion, Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh}, Session: descriptor,
+	})
+}
+
+func (s *Server) handlePrompt(w http.ResponseWriter, r *http.Request) {
+	if !s.authorizeMutationHeaders(w, r) {
+		return
+	}
+	var request harnessv2.StartPromptRequest
+	if !decodeJSON(w, r, &request) || !s.verifyCapability(w, r, request.Metadata) {
+		return
+	}
+	now := time.Now().UTC()
+	if err := request.ValidateAt(now, time.Duration(s.config.Limits.MinPromptLeaseMillis)*time.Millisecond, time.Duration(s.config.Limits.MaxPromptLeaseMillis)*time.Millisecond); err != nil {
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil)
+		return
+	}
+
+	s.mu.Lock()
+	expected := s.fence
+	expected.RuntimeSessionUID = request.Metadata.Fence.RuntimeSessionUID
+	expected.RuntimeSessionGeneration = request.Metadata.Fence.RuntimeSessionGeneration
+	existing := operationPtr(s.operations, request.Metadata.OperationID)
+	classification, err := s.classifyOperation(expected, request.Metadata, existing, now)
+	if err != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil)
+		return
+	}
+	if existing != nil {
+		state := s.prompts[request.Metadata.PromptID]
+		s.mu.Unlock()
+		if classification.Class == harnessv2.RequestClassificationAlreadyAccepted && state != nil {
+			writeJSON(w, http.StatusOK, harnessv2.PromptAdmissionResponse{
+				Protocol: harnessv2.ProtocolVersion, Classification: classification, AcceptedAt: state.acceptedAt,
+			})
+			return
+		}
+		if classification.Class == harnessv2.RequestClassificationSettled && state != nil && state.settlement != nil {
+			settlement := *state.settlement
+			writeJSON(w, http.StatusOK, harnessv2.PromptAdmissionResponse{
+				Protocol: harnessv2.ProtocolVersion, Classification: classification, AcceptedAt: state.acceptedAt, Settlement: &settlement,
+			})
+			return
+		}
+		writeClassificationError(w, classification)
+		return
+	}
+	if classification.Class != harnessv2.RequestClassificationFresh {
+		s.mu.Unlock()
+		writeClassificationError(w, classification)
+		return
+	}
+	if _, ok := s.sessions[harnessv2.RuntimeSessionID(r.PathValue("sessionID"))]; !ok {
+		s.mu.Unlock()
+		writeError(w, http.StatusNotFound, harnessv2.ErrorCodeInvalidRequest, "runtime session not found", nil)
+		return
+	}
+	state := &promptState{
+		request: request, acceptedAt: now,
+		cancelled: make(chan struct{}), settled: make(chan struct{}),
+	}
+	s.prompts[request.Metadata.PromptID] = state
+	s.operations[request.Metadata.OperationID] = operationRecord(request.Metadata, harnessv2.OperationPhaseAccepted, "", now)
+	s.promptStarts.Add(1)
+	s.mu.Unlock()
+
+	w.Header().Set("Content-Type", harnessv2.NDJSONMediaType)
+	w.WriteHeader(http.StatusOK)
+	flusher, _ := w.(http.Flusher)
+	limits := harnessv2.EventStreamLimits{
+		MaxLineBytes:             s.config.Limits.MaxEventLineBytes,
+		MaxTerminalResultBytes:   s.config.Limits.MaxTerminalResultBytes,
+		MaxBufferedEvents:        s.config.Limits.MaxBufferedEvents,
+		MaxUpdateEventsPerSecond: s.config.Limits.MaxUpdateEventsPerSecond,
+	}
+	encoder, err := harnessv2.NewEventEncoder(w, limits, harnessv2.EventExpectationFromMetadata(request.Metadata))
+	if err != nil {
+		return
+	}
+	_ = encoder.Encode(harnessv2.Event{
+		Protocol: harnessv2.ProtocolVersion,
+		Type:     harnessv2.EventAccepted,
+		Identity: eventIdentity(request.Metadata, 1, now),
+		Accepted: &harnessv2.AcceptedEvent{AcceptedAt: now, Lease: request.Lease, ACPVersion: harnessv2.ACPProfileV1},
+	})
+	if flusher != nil {
+		flusher.Flush()
+	}
+	if s.config.DisconnectPromptAfterAccepted {
+		return
+	}
+	select {
+	case <-state.cancelled:
+	case <-r.Context().Done():
+		return
+	case <-time.After(20 * time.Second):
+		return
+	}
+	settledAt := time.Now().UTC()
+	settlement := harnessv2.PromptSettlement{
+		TerminalEvent: harnessv2.EventCancelled,
+		Outcome:       harnessv2.PromptOutcomeCancelled,
+		StopReason:    harnessv2.ACPStopReasonCancelled,
+		SettledAt:     settledAt,
+	}
+	s.mu.Lock()
+	state.settlement = &settlement
+	s.operations[request.Metadata.OperationID] = operationRecord(request.Metadata, harnessv2.OperationPhaseSettled, settlement.TerminalEvent, settledAt)
+	s.mu.Unlock()
+	_ = encoder.Encode(harnessv2.Event{
+		Protocol:  harnessv2.ProtocolVersion,
+		Type:      harnessv2.EventCancelled,
+		Identity:  eventIdentity(request.Metadata, 2, settledAt),
+		Cancelled: &harnessv2.CancelledEvent{StopReason: harnessv2.ACPStopReasonCancelled, Reason: "conformance cancellation"},
+	})
+	_ = encoder.Close()
+	if flusher != nil {
+		flusher.Flush()
+	}
+	state.settleOnce.Do(func() { close(state.settled) })
+}
+
+func (s *Server) handleCancel(w http.ResponseWriter, r *http.Request) {
+	if !s.authorizeMutationHeaders(w, r) {
+		return
+	}
+	var request harnessv2.CancelPromptRequest
+	if !decodeJSON(w, r, &request) || !s.verifyCapability(w, r, request.Metadata) {
+		return
+	}
+	now := time.Now().UTC()
+	if err := request.ValidateAt(now); err != nil {
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil)
+		return
+	}
+
+	s.mu.Lock()
+	state := s.prompts[request.Metadata.PromptID]
+	if state == nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, "prompt not found", nil)
+		return
+	}
+	expected := s.fence
+	expected.RuntimeSessionUID = request.Metadata.Fence.RuntimeSessionUID
+	expected.RuntimeSessionGeneration = request.Metadata.Fence.RuntimeSessionGeneration
+	existing := operationPtr(s.operations, request.Metadata.OperationID)
+	classification, err := s.classifyOperation(expected, request.Metadata, existing, now)
+	if err != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil)
+		return
+	}
+	if existing != nil {
+		settlement := state.settlement
+		s.mu.Unlock()
+		if classification.Class == harnessv2.RequestClassificationSettled && settlement != nil {
+			writeJSON(w, http.StatusOK, cancellationResponse(classification, *settlement))
+			return
+		}
+		writeClassificationError(w, classification)
+		return
+	}
+	if classification.Class != harnessv2.RequestClassificationFresh {
+		s.mu.Unlock()
+		writeClassificationError(w, classification)
+		return
+	}
+	s.operations[request.Metadata.OperationID] = operationRecord(request.Metadata, harnessv2.OperationPhaseRecorded, "", now)
+	s.promptCancels.Add(1)
+	s.mu.Unlock()
+
+	state.cancelOnce.Do(func() { close(state.cancelled) })
+	if s.config.DisconnectPromptAfterAccepted {
+		settlement := harnessv2.PromptSettlement{
+			TerminalEvent: harnessv2.EventOutcomeUnknown,
+			Outcome:       harnessv2.PromptOutcomeUnknown,
+			SettledAt:     time.Now().UTC(),
+		}
+		s.mu.Lock()
+		state.settlement = &settlement
+		s.operations[state.request.Metadata.OperationID] = operationRecord(state.request.Metadata, harnessv2.OperationPhaseSettled, settlement.TerminalEvent, settlement.SettledAt)
+		s.operations[request.Metadata.OperationID] = operationRecord(request.Metadata, harnessv2.OperationPhaseSettled, settlement.TerminalEvent, settlement.SettledAt)
+		s.mu.Unlock()
+		state.settleOnce.Do(func() { close(state.settled) })
+		writeJSON(w, http.StatusOK, cancellationResponse(harnessv2.Classification{Class: harnessv2.RequestClassificationFresh}, settlement))
+		return
+	}
+	select {
+	case <-state.settled:
+	case <-r.Context().Done():
+		return
+	}
+	s.mu.Lock()
+	settlement := *state.settlement
+	s.operations[request.Metadata.OperationID] = operationRecord(request.Metadata, harnessv2.OperationPhaseSettled, settlement.TerminalEvent, settlement.SettledAt)
+	s.mu.Unlock()
+	writeJSON(w, http.StatusOK, cancellationResponse(harnessv2.Classification{Class: harnessv2.RequestClassificationFresh}, settlement))
+}
+
+func cancellationResponse(classification harnessv2.Classification, settlement harnessv2.PromptSettlement) harnessv2.CancelPromptResponse {
+	proven := settlement.TerminalEvent != harnessv2.EventOutcomeUnknown
+	barrier := harnessv2.CancellationBarrierSettled
+	if !proven {
+		barrier = harnessv2.CancellationBarrierOutcomeUnknown
+	}
+	return harnessv2.CancelPromptResponse{
+		Protocol: harnessv2.ProtocolVersion, Classification: classification,
+		BarrierState: barrier, SettlementProven: proven, Settlement: settlement,
+	}
+}
+
+func (s *Server) handleWorkspaceDelta(w http.ResponseWriter, r *http.Request) {
+	if !s.authorizeMutationHeaders(w, r) {
+		return
+	}
+	var request harnessv2.CreateWorkspaceDeltaRequest
+	if !decodeJSON(w, r, &request) || !s.verifyCapability(w, r, request.Metadata) {
+		return
+	}
+	now := time.Now().UTC()
+	if err := request.ValidateAt(now); err != nil {
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil)
+		return
+	}
+
+	s.mu.Lock()
+	expected := s.fence
+	expected.RuntimeSessionUID = request.Metadata.Fence.RuntimeSessionUID
+	expected.RuntimeSessionGeneration = request.Metadata.Fence.RuntimeSessionGeneration
+	existing := operationPtr(s.operations, request.Metadata.OperationID)
+	classification, err := s.classifyOperation(expected, request.Metadata, existing, now)
+	if err != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil)
+		return
+	}
+	if existing != nil {
+		response, ok := s.workspaceResponses[request.Metadata.OperationID]
+		s.mu.Unlock()
+		if classification.Class == harnessv2.RequestClassificationDuplicate && ok {
+			response.Classification = classification
+			writeJSON(w, http.StatusOK, response)
+			return
+		}
+		writeClassificationError(w, classification)
+		return
+	}
+	if classification.Class != harnessv2.RequestClassificationFresh {
+		s.mu.Unlock()
+		writeClassificationError(w, classification)
+		return
+	}
+	s.workspaceDeltas.Add(1)
+	sessionID := harnessv2.RuntimeSessionID(r.PathValue("sessionID"))
+	state := s.sessions[sessionID]
+	delta := harnessv2.WorkspaceDeltaDescriptor{
+		DeltaID: request.DeltaID, RuntimeSessionUID: request.Metadata.Fence.RuntimeSessionUID,
+		SessionGeneration: request.Metadata.Fence.RuntimeSessionGeneration,
+		State:             harnessv2.WorkspaceDeltaNoChange, Intent: request.Intent, VerifiedBaseline: request.VerifiedBaseline,
+		RelativeRoot:     state.relativeRoot,
+		NoFollowVerified: true, PublicationSafe: true, FrozenAt: now,
+	}
+	if s.config.SupportsPublicationFinalization && request.Intent == harnessv2.WorkspaceIntentWrite {
+		delta.State = harnessv2.WorkspaceDeltaPrepared
+		delta.ManifestDigest = conformanceDigest("manifest-" + string(request.DeltaID))
+		delta.Artifact = &harnessv2.ArtifactReference{
+			ArtifactID: harnessv2.ArtifactID("artifact-" + string(request.DeltaID)),
+			Digest:     conformanceDigest("artifact-" + string(request.DeltaID)), SizeBytes: 1,
+			MediaType: "application/vnd.orka.workspace-delta.v1+tar",
+		}
+		delta.EntryCount = 1
+		delta.ChangedFileCount = 1
+	}
+	response := harnessv2.CreateWorkspaceDeltaResponse{
+		Protocol: harnessv2.ProtocolVersion, Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh}, Delta: delta,
+	}
+	s.operations[request.Metadata.OperationID] = operationRecord(request.Metadata, harnessv2.OperationPhaseApplied, "", now)
+	s.workspaceResponses[request.Metadata.OperationID] = response
+	state.deltas[request.DeltaID] = delta
+	state.descriptor.State = map[bool]harnessv2.RuntimeSessionState{true: harnessv2.RuntimeSessionStatePublicationPrepared, false: harnessv2.RuntimeSessionStateIdle}[delta.State == harnessv2.WorkspaceDeltaPrepared]
+	state.descriptor.LastTransitionAt = now
+	s.sessions[sessionID] = state
+	s.mu.Unlock()
+	writeJSON(w, http.StatusOK, response)
+}
+
+func (s *Server) handlePublicationFinalization(w http.ResponseWriter, r *http.Request) {
+	if !s.authorizeMutationHeaders(w, r) {
+		return
+	}
+	var request harnessv2.FinalizeRuntimeSessionPublicationRequest
+	if !decodeJSON(w, r, &request) || !s.verifyCapability(w, r, request.Metadata) {
+		return
+	}
+	now := time.Now().UTC()
+	if err := request.ValidateAt(now); err != nil {
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil)
+		return
+	}
+	s.mu.Lock()
+	sessionID := harnessv2.RuntimeSessionID(r.PathValue("sessionID"))
+	state, ok := s.sessions[sessionID]
+	if !ok {
+		s.mu.Unlock()
+		writeError(w, http.StatusNotFound, harnessv2.ErrorCodeInvalidRequest, "runtime session not found", nil)
+		return
+	}
+	expected := s.fence
+	expected.RuntimeSessionUID = state.descriptor.RuntimeSessionUID
+	expected.RuntimeSessionGeneration = state.descriptor.Generation
+	existing := operationPtr(s.operations, request.Metadata.OperationID)
+	classification, err := s.classifyOperation(expected, request.Metadata, existing, now)
+	if err != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil)
+		return
+	}
+	if existing != nil {
+		response, ok := s.finalizationResponses[request.Metadata.OperationID]
+		s.mu.Unlock()
+		if classification.Class == harnessv2.RequestClassificationDuplicate && ok {
+			response.Classification = classification
+			writeJSON(w, http.StatusOK, response)
+			return
+		}
+		writeClassificationError(w, classification)
+		return
+	}
+	if classification.Class != harnessv2.RequestClassificationFresh {
+		s.mu.Unlock()
+		writeClassificationError(w, classification)
+		return
+	}
+	delta, deltaOK := state.deltas[request.WorkspaceDeltaID]
+	if !deltaOK || delta.State != harnessv2.WorkspaceDeltaPrepared {
+		s.mu.Unlock()
+		writeError(w, http.StatusConflict, harnessv2.ErrorCodeDigestConflict, "publication finalization does not match a prepared session", nil)
+		return
+	}
+	requestedReceipt := harnessv2.PublicationFinalizationReceipt{
+		WorkspaceDeltaID: request.WorkspaceDeltaID, PublicationID: request.PublicationID,
+		PublicationGeneration: request.PublicationGeneration, PublicationVersion: request.PublicationVersion,
+		TerminalState: request.TerminalState, TerminalReceiptDigest: request.TerminalReceiptDigest, AppliedAt: now,
+	}
+	if state.finalization != nil {
+		if state.descriptor.State != harnessv2.RuntimeSessionStateFinalizing {
+			s.mu.Unlock()
+			writeError(w, http.StatusConflict, harnessv2.ErrorCodeSessionPoisoned, "accepted publication finalization is not in finalizing state", nil)
+			return
+		}
+		if publicationFinalizationMatches(*state.finalization, requestedReceipt) {
+			receipt := *state.finalization
+			if s.config.BreakFreshPublicationFinalizationAppliedAt {
+				receipt.AppliedAt = receipt.AppliedAt.Add(time.Second)
+			}
+			record := operationRecord(request.Metadata, harnessv2.OperationPhaseApplied, "", now)
+			response := harnessv2.FinalizeRuntimeSessionPublicationResponse{
+				Protocol: harnessv2.ProtocolVersion, Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh},
+				Session: state.descriptor, Finalization: receipt,
+			}
+			s.operations[request.Metadata.OperationID] = record
+			s.finalizationResponses[request.Metadata.OperationID] = response
+			s.mu.Unlock()
+			writeJSON(w, http.StatusOK, response)
+			return
+		}
+		if !s.config.BreakFreshPublicationFinalizationConflictGuard {
+			s.digestConflicts.Add(1)
+			s.mu.Unlock()
+			writeError(w, http.StatusConflict, harnessv2.ErrorCodeDigestConflict, "publication finalization receipt conflicts with the accepted receipt", nil)
+			return
+		}
+	} else if state.descriptor.State != harnessv2.RuntimeSessionStatePublicationPrepared {
+		s.mu.Unlock()
+		writeError(w, http.StatusConflict, harnessv2.ErrorCodeSessionPoisoned, "runtime session is not awaiting publication finalization", nil)
+		return
+	}
+
+	receipt := requestedReceipt
+	state.descriptor.State = harnessv2.RuntimeSessionStateFinalizing
+	state.descriptor.LastTransitionAt = now
+	state.finalization = &receipt
+	s.sessions[sessionID] = state
+	s.operations[request.Metadata.OperationID] = operationRecord(request.Metadata, harnessv2.OperationPhaseApplied, "", now)
+	response := harnessv2.FinalizeRuntimeSessionPublicationResponse{
+		Protocol: harnessv2.ProtocolVersion, Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh},
+		Session: state.descriptor, Finalization: receipt,
+	}
+	s.finalizationResponses[request.Metadata.OperationID] = response
+	s.mu.Unlock()
+	writeJSON(w, http.StatusOK, response)
+}
+
+func publicationFinalizationMatches(left, right harnessv2.PublicationFinalizationReceipt) bool {
+	return left.WorkspaceDeltaID == right.WorkspaceDeltaID &&
+		left.PublicationID == right.PublicationID &&
+		left.PublicationGeneration == right.PublicationGeneration &&
+		left.PublicationVersion == right.PublicationVersion &&
+		left.TerminalState == right.TerminalState &&
+		left.TerminalReceiptDigest == right.TerminalReceiptDigest
+}
+
+func (s *Server) handleDeleteSession(w http.ResponseWriter, r *http.Request) {
+	if !s.authorizeMutationHeaders(w, r) {
+		return
+	}
+	var request harnessv2.DeleteRuntimeSessionRequest
+	if !decodeJSON(w, r, &request) || !s.verifyCapability(w, r, request.Metadata) {
+		return
+	}
+	now := time.Now().UTC()
+	if err := request.ValidateAt(now); err != nil {
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil)
+		return
+	}
+
+	s.mu.Lock()
+	sessionID := harnessv2.RuntimeSessionID(r.PathValue("sessionID"))
+	state, sessionPresent := s.sessions[sessionID]
+	existing := operationPtr(s.operations, request.Metadata.OperationID)
+	expected := s.fence
+	if sessionPresent {
+		expected.RuntimeSessionUID = state.descriptor.RuntimeSessionUID
+		expected.RuntimeSessionGeneration = state.descriptor.Generation
+	} else if response, ok := s.deleteResponses[request.Metadata.OperationID]; ok {
+		expected.RuntimeSessionUID = response.Tombstone.RuntimeSessionUID
+		expected.RuntimeSessionGeneration = response.Tombstone.RuntimeSessionGeneration
+	} else {
+		s.mu.Unlock()
+		writeError(w, http.StatusNotFound, harnessv2.ErrorCodeInvalidRequest, "runtime session not found", nil)
+		return
+	}
+	classification, err := s.classifyOperation(expected, request.Metadata, existing, now)
+	if err != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil)
+		return
+	}
+	if existing != nil {
+		response, ok := s.deleteResponses[request.Metadata.OperationID]
+		s.mu.Unlock()
+		if classification.Class == harnessv2.RequestClassificationDuplicate && ok {
+			response.Classification = classification
+			writeJSON(w, http.StatusOK, response)
+			return
+		}
+		writeClassificationError(w, classification)
+		return
+	}
+	if classification.Class != harnessv2.RequestClassificationFresh {
+		s.mu.Unlock()
+		writeClassificationError(w, classification)
+		return
+	}
+	if !sessionPresent {
+		s.mu.Unlock()
+		writeError(w, http.StatusNotFound, harnessv2.ErrorCodeInvalidRequest, "runtime session not found", nil)
+		return
+	}
+	if s.config.SupportsPublicationFinalization && s.config.Profile.WorkspaceIntent == harnessv2.WorkspaceIntentWrite &&
+		(state.descriptor.State != harnessv2.RuntimeSessionStateFinalizing || state.finalization == nil) {
+		s.mu.Unlock()
+		writeError(w, http.StatusConflict, harnessv2.ErrorCodeSessionPoisoned, "write session publication is not finalized", nil)
+		return
+	}
+	deleteAttempt := s.sessionDeleteAttempts.Add(1)
+	if s.config.FailFirstSessionDeleteBeforeApply && deleteAttempt == 1 {
+		s.mu.Unlock()
+		writeError(w, http.StatusInternalServerError, harnessv2.ErrorCodeSessionPoisoned, "injected delete failure before apply", nil)
+		return
+	}
+	s.sessionDeletes.Add(1)
+	deleteRecord := operationRecord(request.Metadata, harnessv2.OperationPhaseDeleted, "", now)
+	tombstone := harnessv2.RuntimeSessionTombstone{
+		RuntimeSessionUID: state.descriptor.RuntimeSessionUID, RuntimeSessionGeneration: state.descriptor.Generation,
+		RuntimeProfileDigest: state.descriptor.RuntimeProfileDigest, DeletedAt: now, Operations: []harnessv2.OperationRecord{deleteRecord},
+	}
+	response := harnessv2.DeleteRuntimeSessionResponse{
+		Protocol: harnessv2.ProtocolVersion, Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh},
+		State: harnessv2.RuntimeSessionStateDeleted, Tombstone: tombstone,
+	}
+	s.operations[request.Metadata.OperationID] = deleteRecord
+	s.deleteResponses[request.Metadata.OperationID] = response
+	delete(s.sessions, sessionID)
+	s.mu.Unlock()
+	writeJSON(w, http.StatusOK, response)
+}
+
+func (s *Server) classifyOperation(
+	expected harnessv2.Fence,
+	incoming harnessv2.MutationMetadata,
+	existing *harnessv2.OperationRecord,
+	now time.Time,
+) (harnessv2.Classification, error) {
+	classification, err := harnessv2.ClassifyOperation(expected, incoming, existing, true, now)
+	if err != nil {
+		return harnessv2.Classification{}, err
+	}
+	if existing != nil {
+		if s.config.BreakDuplicateSafeMutations && existing.RequestDigest == incoming.RequestDigest {
+			classification = harnessv2.Classification{Class: harnessv2.RequestClassificationFresh}
+		}
+		if s.config.BreakDigestConflictClassification && existing.RequestDigest != incoming.RequestDigest {
+			classification = harnessv2.Classification{Class: harnessv2.RequestClassificationDuplicate, Phase: existing.Phase}
+		}
+	}
+	switch classification.Class {
+	case harnessv2.RequestClassificationDuplicate, harnessv2.RequestClassificationAlreadyAccepted, harnessv2.RequestClassificationSettled:
+		s.replayClassifications.Add(1)
+	case harnessv2.RequestClassificationDigestConflict:
+		s.digestConflicts.Add(1)
+	}
+	return classification, nil
+}
+
+func (s *Server) authorizeBearer(w http.ResponseWriter, r *http.Request) bool {
+	if r.Header.Get("Authorization") != "Bearer "+s.config.ControllerBearerToken {
+		writeError(w, http.StatusUnauthorized, harnessv2.ErrorCodeUnauthenticated, "authentication required", nil)
+		return false
+	}
+	return true
+}
+
+func (s *Server) authorizeMutationHeaders(w http.ResponseWriter, r *http.Request) bool {
+	if !s.authorizeBearer(w, r) {
+		return false
+	}
+	if r.Header.Get(harnessv2.OperationCapabilityHeader) == "" {
+		writeError(w, http.StatusForbidden, harnessv2.ErrorCodeForbidden, "operation capability required", nil)
+		return false
+	}
+	return true
+}
+
+func (s *Server) verifyCapability(w http.ResponseWriter, r *http.Request, metadata harnessv2.MutationMetadata) bool {
+	if err := harnessv2.VerifyOperationCapability(s.config.OperationCapabilitySecret, r.Header.Get(harnessv2.OperationCapabilityHeader), metadata, true, time.Now().UTC()); err != nil {
+		writeError(w, http.StatusForbidden, harnessv2.ErrorCodeForbidden, "invalid operation capability", nil)
+		return false
+	}
+	return true
+}
+
+func decodeJSON(w http.ResponseWriter, r *http.Request, output any) bool {
+	decoder := json.NewDecoder(r.Body)
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(output); err != nil {
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, "invalid request", nil)
+		return false
+	}
+	return true
+}
+
+func writeClassificationError(w http.ResponseWriter, classification harnessv2.Classification) {
+	status := classification.HTTPStatus()
+	code := harnessv2.ErrorCodeInvalidRequest
+	switch classification.Class {
+	case harnessv2.RequestClassificationDigestConflict:
+		code = harnessv2.ErrorCodeDigestConflict
+	case harnessv2.RequestClassificationStaleFence:
+		code = harnessv2.ErrorCodeStaleFence
+	case harnessv2.RequestClassificationExpired:
+		code = harnessv2.ErrorCodeExpired
+	case harnessv2.RequestClassificationAlreadyAccepted:
+		code = harnessv2.ErrorCodeAlreadyAccepted
+	case harnessv2.RequestClassificationSettled:
+		code = harnessv2.ErrorCodeSettled
+	case harnessv2.RequestClassificationDuplicate:
+		status = http.StatusConflict
+	}
+	if status == 0 {
+		status = http.StatusConflict
+	}
+	writeError(w, status, code, string(classification.Class), &classification)
+}
+
+func writeError(w http.ResponseWriter, status int, code harnessv2.ErrorCode, message string, classification *harnessv2.Classification) {
+	writeJSON(w, status, harnessv2.ErrorResponse{
+		Protocol: harnessv2.ProtocolVersion, Code: code, Message: message, Classification: classification, Retryable: false,
+	})
+}
+
+func writeJSON(w http.ResponseWriter, status int, value any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(value)
+}
+
+func conformanceDigest(value string) string {
+	sum := sha256.Sum256([]byte(value))
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
+
+func operationRecord(metadata harnessv2.MutationMetadata, phase harnessv2.OperationPhase, terminal harnessv2.EventType, now time.Time) harnessv2.OperationRecord {
+	return harnessv2.OperationRecord{
+		OperationID: metadata.OperationID, RequestDigest: metadata.RequestDigest, Phase: phase,
+		TerminalEvent: terminal, RecordedAt: now, UpdatedAt: now,
+	}
+}
+
+func operationPtr(records map[harnessv2.OperationID]harnessv2.OperationRecord, id harnessv2.OperationID) *harnessv2.OperationRecord {
+	record, ok := records[id]
+	if !ok {
+		return nil
+	}
+	return &record
+}
+
+func eventIdentity(metadata harnessv2.MutationMetadata, sequence uint64, at time.Time) harnessv2.EventIdentity {
+	return harnessv2.EventIdentity{
+		RuntimeInstanceID: metadata.Fence.RuntimeInstanceID, SupervisorBootID: metadata.Fence.SupervisorBootID,
+		RuntimeSessionUID: metadata.Fence.RuntimeSessionUID, RuntimeSessionGeneration: metadata.Fence.RuntimeSessionGeneration,
+		TaskUID: metadata.TaskUID, TaskAttempt: metadata.TaskAttempt, PromptID: metadata.PromptID,
+		Sequence: sequence, RequestDigest: metadata.RequestDigest, Timestamp: at,
+	}
+}
diff --git a/internal/harness/v2/conformance/cycle.go b/internal/harness/v2/conformance/cycle.go
new file mode 100644
index 000000000..2db3ce6e7
--- /dev/null
+++ b/internal/harness/v2/conformance/cycle.go
@@ -0,0 +1,656 @@
+package conformance
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+const conformanceMaxWorkspaceEntries uint32 = 4096
+
+type lifecycleProbeState struct {
+	client               *harnessv2.Client
+	httpClient           *http.Client
+	target               Target
+	sessionID            harnessv2.RuntimeSessionID
+	sessionFence         harnessv2.Fence
+	workspace            harnessv2.WorkspaceSpec
+	taskUID              harnessv2.TaskUID
+	promptID             harnessv2.PromptID
+	lease                harnessv2.PromptLease
+	sessionCreated       bool
+	promptStarted        bool
+	cancelAttempted      bool
+	deleteAttempted      bool
+	publicationFinalized bool
+}
+
+func probeLifecycle(
+	ctx context.Context,
+	httpClient *http.Client,
+	client *harnessv2.Client,
+	target Target,
+	status *harnessv2.StatusResponse,
+) error {
+	if status == nil {
+		return fmt.Errorf("hostile lifecycle probe requires authenticated status")
+	}
+	probeID, err := newProbeID()
+	if err != nil {
+		return fmt.Errorf("allocate conformance identity: %w", err)
+	}
+	sessionID := harnessv2.RuntimeSessionID("conformance-session-" + probeID)
+	sessionUID := harnessv2.RuntimeSessionUID("conformance-session-uid-" + probeID)
+	taskUID := harnessv2.TaskUID("conformance-task-" + probeID)
+	promptID := harnessv2.PromptID("conformance-prompt-" + probeID)
+
+	fence := status.Fence
+	fence.RuntimeSessionUID = sessionUID
+	fence.RuntimeSessionGeneration = 1
+	workspace := harnessv2.WorkspaceSpec{
+		Intent: target.Profile.WorkspaceIntent,
+		Baseline: harnessv2.WorkspaceBaseline{
+			RepositoryIdentity: "orka-conformance.invalid/repository",
+			Revision:           "conformance-baseline",
+			TreeDigest:         digestString("conformance-baseline-" + probeID),
+		},
+	}
+	state := &lifecycleProbeState{
+		client: client, httpClient: httpClient, target: target,
+		sessionID: sessionID, sessionFence: fence, workspace: workspace,
+		taskUID: taskUID, promptID: promptID,
+	}
+	defer state.cleanup(ctx)
+
+	if err := probeStaleInstanceFence(ctx, client, target, status.Fence, workspace, taskUID, probeID); err != nil {
+		return err
+	}
+	if err := state.probeSessionCreation(ctx, status, probeID); err != nil {
+		return err
+	}
+	if target.WorkspaceGovernance.Strict() {
+		if err := state.probePromptScopedAuthorizationRejection(ctx, probeID); err != nil {
+			return err
+		}
+	}
+	promptRequest, settlement, err := state.probePromptCancellationLifecycle(ctx, probeID)
+	if err != nil {
+		return err
+	}
+	if target.WorkspaceGovernance.Strict() {
+		delta, deltaErr := state.probeWorkspaceDelta(ctx, probeID, promptRequest.Metadata, settlement)
+		if deltaErr != nil {
+			return deltaErr
+		}
+		if target.SupportsPublicationFinalization && delta.Delta.State == harnessv2.WorkspaceDeltaPrepared {
+			if err := state.probePublicationFinalization(ctx, probeID, promptRequest.Metadata, delta.Delta); err != nil {
+				return err
+			}
+		}
+	}
+	return state.probeSessionDeletion(ctx, probeID)
+}
+
+func (s *lifecycleProbeState) probeSessionCreation(
+	ctx context.Context,
+	status *harnessv2.StatusResponse,
+	probeID string,
+) error {
+	request, err := s.createSessionRequest("create-session-" + probeID)
+	if err != nil {
+		return err
+	}
+	created, err := s.client.CreateRuntimeSession(ctx, request)
+	if err != nil {
+		return fmt.Errorf("create conformance runtime session: %w", err)
+	}
+	s.sessionCreated = true
+	if created.Classification.Class != harnessv2.RequestClassificationFresh {
+		return fmt.Errorf("new conformance session classified as %q, want fresh", created.Classification.Class)
+	}
+	if created.Session.RuntimeInstanceID != status.Fence.RuntimeInstanceID ||
+		created.Session.SupervisorBootID != status.Fence.SupervisorBootID {
+		return fmt.Errorf("created session is not bound to the authenticated runtime instance and boot")
+	}
+	if s.target.WorkspaceGovernance.DuplicateSafeMutations {
+		return s.probeCreateSessionReplay(ctx, request, created)
+	}
+	return nil
+}
+
+func (s *lifecycleProbeState) probePromptCancellationLifecycle(
+	ctx context.Context,
+	probeID string,
+) (harnessv2.StartPromptRequest, harnessv2.PromptSettlement, error) {
+	request, err := s.startPromptRequest("start-prompt-" + probeID)
+	if err != nil {
+		return harnessv2.StartPromptRequest{}, harnessv2.PromptSettlement{}, err
+	}
+	s.promptStarted = true
+	stream, err := s.client.StartPrompt(ctx, s.sessionID, request)
+	if err != nil {
+		return harnessv2.StartPromptRequest{}, harnessv2.PromptSettlement{}, fmt.Errorf("open single non-reconnectable prompt stream: %w", err)
+	}
+	defer stream.Close() //nolint:errcheck
+
+	accepted, err := stream.Decode()
+	if err != nil {
+		return harnessv2.StartPromptRequest{}, harnessv2.PromptSettlement{}, fmt.Errorf("read prompt acceptance event: %w", err)
+	}
+	if accepted.Type != harnessv2.EventAccepted {
+		return harnessv2.StartPromptRequest{}, harnessv2.PromptSettlement{}, fmt.Errorf("first prompt event is %q, want %q", accepted.Type, harnessv2.EventAccepted)
+	}
+
+	streamDone := make(chan promptStreamResult, 1)
+	go func() {
+		streamDone <- consumePromptStream(stream)
+	}()
+	if s.target.WorkspaceGovernance.DuplicateSafeMutations {
+		if accepted.Accepted == nil {
+			return harnessv2.StartPromptRequest{}, harnessv2.PromptSettlement{}, fmt.Errorf("accepted prompt event omitted acceptance metadata")
+		}
+		if err := s.probeAcceptedPromptReplay(ctx, request, accepted.Accepted.AcceptedAt); err != nil {
+			return harnessv2.StartPromptRequest{}, harnessv2.PromptSettlement{}, err
+		}
+	}
+
+	cancelRequest, err := s.cancelPromptRequest("cancel-prompt-"+probeID, request.Metadata)
+	if err != nil {
+		return harnessv2.StartPromptRequest{}, harnessv2.PromptSettlement{}, err
+	}
+	s.cancelAttempted = true
+	cancelResponse, cancelErr := s.client.CancelPrompt(ctx, s.sessionID, cancelRequest)
+
+	var streamResult promptStreamResult
+	select {
+	case streamResult = <-streamDone:
+	case <-ctx.Done():
+		return harnessv2.StartPromptRequest{}, harnessv2.PromptSettlement{}, fmt.Errorf("wait for original prompt settlement: %w", ctx.Err())
+	}
+	if streamResult.err != nil {
+		return harnessv2.StartPromptRequest{}, harnessv2.PromptSettlement{}, fmt.Errorf("consume original prompt stream without reconnect: %w", streamResult.err)
+	}
+	if cancelErr != nil {
+		return harnessv2.StartPromptRequest{}, harnessv2.PromptSettlement{}, fmt.Errorf("cancel accepted prompt without replay: %w", cancelErr)
+	}
+	if cancelResponse == nil {
+		return harnessv2.StartPromptRequest{}, harnessv2.PromptSettlement{}, fmt.Errorf("cancel endpoint returned no settlement")
+	}
+	if err := validatePromptCancellationSettlement(streamResult.terminal, cancelResponse.Settlement); err != nil {
+		return harnessv2.StartPromptRequest{}, harnessv2.PromptSettlement{}, err
+	}
+	if s.target.WorkspaceGovernance.DuplicateSafeMutations {
+		if err := s.probeCancellationReplay(ctx, cancelRequest, cancelResponse); err != nil {
+			return harnessv2.StartPromptRequest{}, harnessv2.PromptSettlement{}, err
+		}
+		if err := s.probeSettledPromptReplay(ctx, request, cancelResponse.Settlement); err != nil {
+			return harnessv2.StartPromptRequest{}, harnessv2.PromptSettlement{}, err
+		}
+	}
+	return request, cancelResponse.Settlement, nil
+}
+
+func validatePromptCancellationSettlement(terminal *harnessv2.Event, settlement harnessv2.PromptSettlement) error {
+	if terminal == nil {
+		return fmt.Errorf("original prompt stream returned no terminal event")
+	}
+	if settlement.TerminalEvent != terminal.Type {
+		return fmt.Errorf("cancel settlement terminal event %q does not match original stream terminal event %q", settlement.TerminalEvent, terminal.Type)
+	}
+	if expectedOutcome := terminalOutcome(terminal); settlement.Outcome != expectedOutcome {
+		return fmt.Errorf("cancel settlement outcome %q does not match original stream outcome %q", settlement.Outcome, expectedOutcome)
+	}
+	return nil
+}
+
+func (s *lifecycleProbeState) probeSessionDeletion(ctx context.Context, probeID string) error {
+	request, err := s.deleteSessionRequest("delete-session-" + probeID)
+	if err != nil {
+		return err
+	}
+	if err := s.probeStaleSessionDeletion(ctx, request); err != nil {
+		return err
+	}
+	deleted, err := s.client.DeleteRuntimeSession(ctx, s.sessionID, request)
+	if err != nil {
+		return fmt.Errorf("delete conformance runtime session: %w", err)
+	}
+	s.deleteAttempted = true
+	if deleted.Classification.Class != harnessv2.RequestClassificationFresh {
+		return fmt.Errorf("new conformance session deletion classified as %q, want fresh", deleted.Classification.Class)
+	}
+	if s.target.WorkspaceGovernance.DuplicateSafeMutations {
+		return s.probeDeletionReplay(ctx, request, deleted)
+	}
+	return nil
+}
+
+func probeStaleInstanceFence(
+	ctx context.Context,
+	client *harnessv2.Client,
+	target Target,
+	poolFence harnessv2.Fence,
+	workspace harnessv2.WorkspaceSpec,
+	taskUID harnessv2.TaskUID,
+	probeID string,
+) error {
+	staleFence := poolFence
+	staleFence.RuntimeInstanceID = harnessv2.RuntimeInstanceID(string(poolFence.RuntimeInstanceID) + "-stale")
+	staleFence.RuntimeSessionUID = harnessv2.RuntimeSessionUID("conformance-stale-session-uid-" + probeID)
+	staleFence.RuntimeSessionGeneration = 1
+	request := harnessv2.CreateRuntimeSessionRequest{
+		Protocol:         harnessv2.ProtocolVersion,
+		Metadata:         newMetadata(staleFence, taskUID, 1, "", harnessv2.OperationID("stale-fence-"+probeID), time.Now().UTC().Add(30*time.Second)),
+		RuntimeSessionID: harnessv2.RuntimeSessionID("conformance-stale-session-" + probeID),
+		Profile:          target.Profile,
+		MCPConfiguration: targetMCPConfiguration(target),
+		Workspace:        workspace,
+	}
+	if err := setRequestDigest(&request, &request.Metadata); err != nil {
+		return fmt.Errorf("build stale-fence request: %w", err)
+	}
+	_, err := client.CreateRuntimeSession(ctx, request)
+	if err == nil {
+		return fmt.Errorf("runtime accepted session creation for a stale runtime instance fence")
+	}
+	var clientErr *harnessv2.ClientError
+	if !errors.As(err, &clientErr) || clientErr.StatusCode != http.StatusGone || clientErr.Classification == nil ||
+		clientErr.Classification.Class != harnessv2.RequestClassificationStaleFence ||
+		clientErr.Classification.FenceMismatch != harnessv2.FenceMismatchRuntimeInstance {
+		return fmt.Errorf("stale runtime instance fence returned %v, want HTTP 410 stale_fence/runtime_instance", err)
+	}
+	return nil
+}
+
+func (s *lifecycleProbeState) createSessionRequest(operation string) (harnessv2.CreateRuntimeSessionRequest, error) {
+	request := harnessv2.CreateRuntimeSessionRequest{
+		Protocol:         harnessv2.ProtocolVersion,
+		Metadata:         newMetadata(s.sessionFence, s.taskUID, 1, "", harnessv2.OperationID(operation), time.Now().UTC().Add(30*time.Second)),
+		RuntimeSessionID: s.sessionID,
+		Profile:          s.target.Profile,
+		MCPConfiguration: targetMCPConfiguration(s.target),
+		Workspace:        s.workspace,
+	}
+	if err := setRequestDigest(&request, &request.Metadata); err != nil {
+		return harnessv2.CreateRuntimeSessionRequest{}, fmt.Errorf("build create-session request: %w", err)
+	}
+	return request, nil
+}
+
+func (s *lifecycleProbeState) startPromptRequest(operation string) (harnessv2.StartPromptRequest, error) {
+	now := time.Now().UTC()
+	leaseDuration := time.Duration(s.target.Limits.MaxPromptLeaseMillis) * time.Millisecond
+	if preferred := 30 * time.Second; leaseDuration > preferred {
+		leaseDuration = preferred
+	}
+	minimum := time.Duration(s.target.Limits.MinPromptLeaseMillis) * time.Millisecond
+	if leaseDuration < minimum {
+		leaseDuration = minimum
+	}
+	if leaseDuration <= 0 {
+		return harnessv2.StartPromptRequest{}, fmt.Errorf("runtime prompt lease limits do not permit a positive conformance lease")
+	}
+	s.lease = harnessv2.PromptLease{Generation: 1, IssuedAt: now, ExpiresAt: now.Add(leaseDuration)}
+	metadata := newMetadata(s.sessionFence, s.taskUID, 1, s.promptID, harnessv2.OperationID(operation), s.lease.ExpiresAt)
+	authorization, err := s.promptAuthorization(metadata, s.lease)
+	if err != nil {
+		return harnessv2.StartPromptRequest{}, err
+	}
+	request := harnessv2.StartPromptRequest{
+		Protocol:         harnessv2.ProtocolVersion,
+		Metadata:         metadata,
+		Lease:            s.lease,
+		MCPAuthorization: authorization,
+		Input: harnessv2.PromptInput{
+			Content: []harnessv2.ContentBlock{{
+				Type: harnessv2.ContentBlockText,
+				Text: "Orka harness conformance: perform no external side effects and await cancellation.",
+			}},
+			Metadata: map[string]string{"orka.conformance": "cancel-after-accept"},
+		},
+	}
+	if err := setRequestDigest(&request, &request.Metadata); err != nil {
+		return harnessv2.StartPromptRequest{}, fmt.Errorf("build start-prompt request: %w", err)
+	}
+	return request, nil
+}
+
+func targetMCPConfiguration(target Target) harnessv2.MCPPolicyConfiguration {
+	toolPolicy := target.ToolPolicy
+	if toolPolicy.Tools == nil {
+		toolPolicy.Tools = []harnessv2.MCPToolDescriptor{}
+	}
+	if toolPolicy.AllowedToolNames == nil {
+		toolPolicy.AllowedToolNames = []string{}
+	}
+	if toolPolicy.DescriptorDigest == "" {
+		toolPolicy.DescriptorDigest, _ = harnessv2.CanonicalMCPToolDescriptorDigest(toolPolicy.Tools)
+	}
+	return harnessv2.MCPPolicyConfiguration{
+		ToolPolicyDigest:       target.Profile.ToolPolicyDigest,
+		ApprovalPolicyDigest:   target.Profile.ApprovalPolicyDigest,
+		MCPConfigurationDigest: target.Profile.MCPConfigurationDigest,
+		ToolPolicy:             toolPolicy, ApprovalPolicy: target.ApprovalPolicy,
+	}
+}
+
+func (s *lifecycleProbeState) promptAuthorization(
+	metadata harnessv2.MutationMetadata,
+	lease harnessv2.PromptLease,
+) (harnessv2.PromptMCPAuthorization, error) {
+	configuration := targetMCPConfiguration(s.target)
+	authorization := harnessv2.PromptMCPAuthorization{
+		RuntimeSessionUID: metadata.Fence.RuntimeSessionUID,
+		SessionGeneration: metadata.Fence.RuntimeSessionGeneration,
+		TaskUID:           metadata.TaskUID, TaskAttempt: metadata.TaskAttempt, PromptID: metadata.PromptID,
+		LeaseGeneration: lease.Generation, ToolPolicyDigest: s.target.Profile.ToolPolicyDigest,
+		ApprovalPolicyDigest:   s.target.Profile.ApprovalPolicyDigest,
+		MCPConfigurationDigest: s.target.Profile.MCPConfigurationDigest,
+		ToolPolicy:             configuration.ToolPolicy, ApprovalPolicy: configuration.ApprovalPolicy, ExpiresAt: lease.ExpiresAt,
+	}
+	if err := authorization.ValidateForAt(metadata, lease, time.Now().UTC()); err != nil {
+		return harnessv2.PromptMCPAuthorization{}, fmt.Errorf("canonical conformance MCP policy: %w", err)
+	}
+	return authorization, nil
+}
+
+func (s *lifecycleProbeState) cancelPromptRequest(operation string, promptMetadata harnessv2.MutationMetadata) (harnessv2.CancelPromptRequest, error) {
+	now := time.Now().UTC()
+	remaining := s.lease.ExpiresAt.Sub(now)
+	if remaining <= time.Millisecond {
+		return harnessv2.CancelPromptRequest{}, fmt.Errorf("prompt lease expired before cancellation could be issued")
+	}
+	settlementWindow := 10 * time.Second
+	if remaining <= settlementWindow {
+		settlementWindow = remaining / 2
+	}
+	if settlementWindow <= 0 {
+		return harnessv2.CancelPromptRequest{}, fmt.Errorf("prompt lease leaves no cancellation settlement window")
+	}
+	metadata := newMetadata(s.sessionFence, promptMetadata.TaskUID, promptMetadata.TaskAttempt, promptMetadata.PromptID,
+		harnessv2.OperationID(operation), s.lease.ExpiresAt)
+	request := harnessv2.CancelPromptRequest{
+		Protocol:           harnessv2.ProtocolVersion,
+		Metadata:           metadata,
+		Reason:             harnessv2.CancelReasonUserRequested,
+		SettlementDeadline: now.Add(settlementWindow),
+	}
+	if err := setRequestDigest(&request, &request.Metadata); err != nil {
+		return harnessv2.CancelPromptRequest{}, fmt.Errorf("build cancel-prompt request: %w", err)
+	}
+	return request, nil
+}
+
+func (s *lifecycleProbeState) deleteSessionRequest(operation string) (harnessv2.DeleteRuntimeSessionRequest, error) {
+	request := harnessv2.DeleteRuntimeSessionRequest{
+		Protocol: harnessv2.ProtocolVersion,
+		Metadata: newMetadata(s.sessionFence, "", 0, "", harnessv2.OperationID(operation), time.Now().UTC().Add(30*time.Second)),
+		Reason:   "conformance probe complete",
+	}
+	if err := setRequestDigest(&request, &request.Metadata); err != nil {
+		return harnessv2.DeleteRuntimeSessionRequest{}, fmt.Errorf("build delete-session request: %w", err)
+	}
+	return request, nil
+}
+
+func (s *lifecycleProbeState) probePromptScopedAuthorizationRejection(ctx context.Context, probeID string) error {
+	now := time.Now().UTC()
+	leaseDuration := min(time.Duration(s.target.Limits.MaxPromptLeaseMillis)*time.Millisecond, 10*time.Second)
+	minimum := time.Duration(s.target.Limits.MinPromptLeaseMillis) * time.Millisecond
+	if leaseDuration < minimum {
+		leaseDuration = minimum
+	}
+	lease := harnessv2.PromptLease{Generation: 1, IssuedAt: now, ExpiresAt: now.Add(leaseDuration)}
+	promptID := harnessv2.PromptID("conformance-invalid-auth-" + probeID)
+	metadata := newMetadata(s.sessionFence, s.taskUID, 1, promptID, harnessv2.OperationID("invalid-mcp-auth-"+probeID), lease.ExpiresAt)
+	authorization, err := s.promptAuthorization(metadata, lease)
+	if err != nil {
+		return err
+	}
+	authorization.PromptID = harnessv2.PromptID("wrong-prompt-" + probeID)
+	request := harnessv2.StartPromptRequest{
+		Protocol:         harnessv2.ProtocolVersion,
+		Metadata:         metadata,
+		Lease:            lease,
+		MCPAuthorization: authorization,
+		Input:            harnessv2.PromptInput{Content: []harnessv2.ContentBlock{{Type: harnessv2.ContentBlockText, Text: "reject this mismatched authorization"}}},
+	}
+	if err := setRequestDigest(&request, &request.Metadata); err != nil {
+		return fmt.Errorf("build invalid prompt-scoped authorization probe: %w", err)
+	}
+	capability, err := harnessv2.SignOperationCapability(s.target.OperationCapabilitySecret, harnessv2.ClaimsForMutation(request.Metadata))
+	if err != nil {
+		return fmt.Errorf("sign invalid prompt-scoped authorization probe: %w", err)
+	}
+	path, err := harnessv2.PromptPath(s.sessionID, promptID)
+	if err != nil {
+		return err
+	}
+	payload, err := json.Marshal(request)
+	if err != nil {
+		return err
+	}
+	endpoint, err := endpointURL(s.target.BaseURL, path)
+	if err != nil {
+		return err
+	}
+	httpRequest, err := http.NewRequestWithContext(ctx, http.MethodPut, endpoint, bytes.NewReader(payload))
+	if err != nil {
+		return err
+	}
+	httpRequest.Header.Set("Accept", harnessv2.NDJSONMediaType+", application/json")
+	httpRequest.Header.Set("Accept-Encoding", "identity")
+	httpRequest.Header.Set("Content-Type", "application/json")
+	httpRequest.Header.Set("Authorization", "Bearer "+s.target.ControllerBearerToken)
+	httpRequest.Header.Set(harnessv2.OperationCapabilityHeader, capability)
+	response, err := s.httpClient.Do(httpRequest)
+	if err != nil {
+		return fmt.Errorf("send invalid prompt-scoped authorization probe: %w", err)
+	}
+	defer response.Body.Close() //nolint:errcheck
+	_, _ = io.Copy(io.Discard, io.LimitReader(response.Body, 4096))
+	if response.StatusCode != http.StatusBadRequest && response.StatusCode != http.StatusUnprocessableEntity {
+		return fmt.Errorf("mismatched prompt-scoped authorization returned HTTP %d, want 400 or 422", response.StatusCode)
+	}
+	return nil
+}
+
+func (s *lifecycleProbeState) probeWorkspaceDelta(
+	ctx context.Context,
+	probeID string,
+	promptMetadata harnessv2.MutationMetadata,
+	settlement harnessv2.PromptSettlement,
+) (*harnessv2.CreateWorkspaceDeltaResponse, error) {
+	settlementJSON, err := harnessv2.CanonicalValue(settlement)
+	if err != nil {
+		return nil, fmt.Errorf("canonicalize prompt settlement: %w", err)
+	}
+	maxBytes := s.target.Limits.MaxWorkspaceDeltaBytes
+	request := harnessv2.CreateWorkspaceDeltaRequest{
+		Protocol: harnessv2.ProtocolVersion,
+		Metadata: newMetadata(s.sessionFence, promptMetadata.TaskUID, promptMetadata.TaskAttempt, promptMetadata.PromptID,
+			harnessv2.OperationID("workspace-delta-"+probeID), time.Now().UTC().Add(30*time.Second)),
+		DeltaID:                harnessv2.WorkspaceDeltaID("conformance-delta-" + probeID),
+		Intent:                 s.target.Profile.WorkspaceIntent,
+		VerifiedBaseline:       s.workspace.Baseline,
+		PromptSettlementDigest: digestBytes(settlementJSON),
+		Limits: harnessv2.WorkspaceDeltaLimits{
+			MaxBytes:   maxBytes,
+			MaxEntries: conformanceMaxWorkspaceEntries,
+		},
+	}
+	if err := setRequestDigest(&request, &request.Metadata); err != nil {
+		return nil, fmt.Errorf("build workspace-delta request: %w", err)
+	}
+	response, err := s.client.CreateWorkspaceDelta(ctx, s.sessionID, request)
+	if err != nil {
+		return nil, fmt.Errorf("create Orka-owned workspace delta: %w", err)
+	}
+	if response.Classification.Class != harnessv2.RequestClassificationFresh {
+		return nil, fmt.Errorf("new workspace delta classified as %q, want fresh", response.Classification.Class)
+	}
+	if !response.Delta.NoFollowVerified {
+		return nil, fmt.Errorf("workspace delta did not prove no-follow traversal")
+	}
+	if response.Delta.State != harnessv2.WorkspaceDeltaReadOnlyModified && !response.Delta.PublicationSafe {
+		return nil, fmt.Errorf("workspace delta is not publication safe")
+	}
+	if s.target.WorkspaceGovernance.DuplicateSafeMutations {
+		if err := s.probeWorkspaceDeltaReplay(ctx, request, response); err != nil {
+			return nil, err
+		}
+	}
+	return response, nil
+}
+
+func (s *lifecycleProbeState) probePublicationFinalization(
+	ctx context.Context, probeID string, promptMetadata harnessv2.MutationMetadata, delta harnessv2.WorkspaceDeltaDescriptor,
+) error {
+	request := harnessv2.FinalizeRuntimeSessionPublicationRequest{
+		Protocol: harnessv2.ProtocolVersion,
+		Metadata: newMetadata(s.sessionFence, promptMetadata.TaskUID, promptMetadata.TaskAttempt, promptMetadata.PromptID,
+			harnessv2.OperationID("publication-finalization-"+probeID), time.Now().UTC().Add(30*time.Second)),
+		WorkspaceDeltaID: delta.DeltaID, PublicationID: "conformance-publication-" + probeID,
+		PublicationGeneration: 1, PublicationVersion: 1, TerminalState: harnessv2.PublicationTerminalVerifiedExact,
+		TerminalReceiptDigest: digestString("conformance-publication-receipt-" + probeID),
+	}
+	if err := setRequestDigest(&request, &request.Metadata); err != nil {
+		return fmt.Errorf("build publication-finalization request: %w", err)
+	}
+	response, err := s.client.FinalizeRuntimeSessionPublication(ctx, s.sessionID, request)
+	if err != nil {
+		return fmt.Errorf("finalize conformance RuntimeSession publication: %w", err)
+	}
+	if response.Classification.Class != harnessv2.RequestClassificationFresh || response.Session.State != harnessv2.RuntimeSessionStateFinalizing {
+		return fmt.Errorf("new publication finalization returned %#v", response)
+	}
+	s.publicationFinalized = true
+	if s.target.WorkspaceGovernance.DuplicateSafeMutations {
+		if err := s.probePublicationFinalizationReplay(ctx, request, response); err != nil {
+			return err
+		}
+	}
+	return s.probePublicationFinalizationRecovery(ctx, request, response)
+}
+
+func (s *lifecycleProbeState) cleanup(ctx context.Context) {
+	if !s.sessionCreated {
+		return
+	}
+	cleanupCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 5*time.Second)
+	defer cancel()
+	if s.promptStarted && !s.cancelAttempted {
+		request, err := s.cancelPromptRequest("cleanup-cancel-"+string(s.promptID), newMetadata(s.sessionFence, s.taskUID, 1, s.promptID, "placeholder", time.Now().UTC().Add(5*time.Second)))
+		if err == nil {
+			s.cancelAttempted = true
+			_, _ = s.client.CancelPrompt(cleanupCtx, s.sessionID, request)
+		}
+	}
+	if !s.deleteAttempted {
+		request, err := s.deleteSessionRequest("cleanup-delete-" + string(s.sessionID))
+		if err == nil {
+			s.deleteAttempted = true
+			_, _ = s.client.DeleteRuntimeSession(cleanupCtx, s.sessionID, request)
+		}
+	}
+}
+
+type promptStreamResult struct {
+	terminal *harnessv2.Event
+	err      error
+}
+
+func consumePromptStream(stream *harnessv2.PromptStream) promptStreamResult {
+	var terminal *harnessv2.Event
+	for {
+		event, err := stream.Decode()
+		if errors.Is(err, io.EOF) {
+			return promptStreamResult{terminal: terminal}
+		}
+		if err != nil {
+			return promptStreamResult{terminal: terminal, err: err}
+		}
+		if event.Type.IsTerminal() {
+			copy := event
+			terminal = &copy
+		}
+	}
+}
+
+func newMetadata(
+	fence harnessv2.Fence,
+	taskUID harnessv2.TaskUID,
+	taskAttempt uint32,
+	promptID harnessv2.PromptID,
+	operationID harnessv2.OperationID,
+	expiresAt time.Time,
+) harnessv2.MutationMetadata {
+	return harnessv2.MutationMetadata{
+		Fence:                      fence,
+		TaskUID:                    taskUID,
+		TaskAttempt:                taskAttempt,
+		PromptID:                   promptID,
+		OperationID:                operationID,
+		RequestDigestSchemaVersion: harnessv2.RequestDigestSchemaVersion,
+		RequestDigest:              harnessv2.RequestDigest(digestString("placeholder")),
+		ExpiresAt:                  expiresAt,
+	}
+}
+
+func setRequestDigest(request any, metadata *harnessv2.MutationMetadata) error {
+	if metadata == nil {
+		return fmt.Errorf("request metadata is required")
+	}
+	metadata.RequestDigest = harnessv2.RequestDigest(digestString("placeholder"))
+	digest, err := harnessv2.CanonicalRequestDigest(request)
+	if err != nil {
+		return err
+	}
+	metadata.RequestDigest = digest
+	return nil
+}
+
+func newProbeID() (string, error) {
+	var randomBytes [12]byte
+	if _, err := rand.Read(randomBytes[:]); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(randomBytes[:]), nil
+}
+
+func digestString(value string) string {
+	return digestBytes([]byte(value))
+}
+
+func digestBytes(value []byte) string {
+	sum := sha256.Sum256(value)
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
+
+func terminalOutcome(event *harnessv2.Event) harnessv2.PromptOutcome {
+	if event == nil {
+		return ""
+	}
+	switch event.Type {
+	case harnessv2.EventCompleted:
+		return harnessv2.PromptOutcomeSucceeded
+	case harnessv2.EventCancelled:
+		return harnessv2.PromptOutcomeCancelled
+	case harnessv2.EventFailed:
+		return harnessv2.PromptOutcomeFailed
+	case harnessv2.EventOutcomeUnknown:
+		return harnessv2.PromptOutcomeUnknown
+	default:
+		return ""
+	}
+}
diff --git a/internal/harness/v2/conformance/doc.go b/internal/harness/v2/conformance/doc.go
new file mode 100644
index 000000000..59c4cf0f8
--- /dev/null
+++ b/internal/harness/v2/conformance/doc.go
@@ -0,0 +1,5 @@
+// Package conformance validates external orka.harness.v2 runtimes before an
+// AgentRuntime becomes Ready. It probes safe and authenticated control surfaces,
+// enforces exact immutable identity/profile/limit claims, and runs a bounded
+// single-attempt hostile lifecycle cycle without prompt reconnect or replay.
+package conformance
diff --git a/internal/harness/v2/conformance/replay.go b/internal/harness/v2/conformance/replay.go
new file mode 100644
index 000000000..8f405f79a
--- /dev/null
+++ b/internal/harness/v2/conformance/replay.go
@@ -0,0 +1,402 @@
+package conformance
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"mime"
+	"net/http"
+	"reflect"
+	"time"
+
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+func (s *lifecycleProbeState) probeCreateSessionReplay(
+	ctx context.Context,
+	request harnessv2.CreateRuntimeSessionRequest,
+	original *harnessv2.CreateRuntimeSessionResponse,
+) error {
+	duplicate, err := s.client.CreateRuntimeSession(ctx, request)
+	if err != nil {
+		return fmt.Errorf("replay identical runtime-session creation: %w", err)
+	}
+	if duplicate.Classification.Class != harnessv2.RequestClassificationDuplicate ||
+		duplicate.Classification.Phase != harnessv2.OperationPhaseApplied {
+		return fmt.Errorf("identical runtime-session creation classified as %#v, want duplicate/applied", duplicate.Classification)
+	}
+	if original == nil || !reflect.DeepEqual(duplicate.Session, original.Session) {
+		return fmt.Errorf("identical runtime-session creation did not replay the original descriptor")
+	}
+
+	conflicting := request
+	conflicting.Workspace.Baseline.Revision += "-digest-conflict"
+	conflicting.Workspace.Baseline.TreeDigest = digestString(conflicting.Workspace.Baseline.TreeDigest + "-digest-conflict")
+	if err := setRequestDigest(&conflicting, &conflicting.Metadata); err != nil {
+		return fmt.Errorf("build conflicting runtime-session creation: %w", err)
+	}
+	_, err = s.client.CreateRuntimeSession(ctx, conflicting)
+	return expectClassificationError("conflicting runtime-session creation", err, harnessv2.OperationPhaseApplied, "")
+}
+
+func (s *lifecycleProbeState) probeAcceptedPromptReplay(
+	ctx context.Context,
+	request harnessv2.StartPromptRequest,
+	acceptedAt time.Time,
+) error {
+	duplicate, err := s.promptAdmissionReplay(ctx, request)
+	if err != nil {
+		return fmt.Errorf("replay identical accepted prompt admission: %w", err)
+	}
+	if duplicate.Classification.Class != harnessv2.RequestClassificationAlreadyAccepted ||
+		duplicate.Classification.Phase != harnessv2.OperationPhaseAccepted ||
+		!duplicate.AcceptedAt.Equal(acceptedAt) {
+		return fmt.Errorf("identical accepted prompt admission returned %#v, want original already_accepted admission", duplicate)
+	}
+
+	conflicting := conflictingPromptRequest(request)
+	if err := setRequestDigest(&conflicting, &conflicting.Metadata); err != nil {
+		return fmt.Errorf("build conflicting accepted prompt admission: %w", err)
+	}
+	stream, err := s.client.StartPrompt(ctx, s.sessionID, conflicting)
+	if stream != nil {
+		_ = stream.Close()
+	}
+	return expectClassificationError(
+		"conflicting accepted prompt admission", err,
+		harnessv2.OperationPhaseAccepted, "",
+	)
+}
+
+func (s *lifecycleProbeState) probeSettledPromptReplay(
+	ctx context.Context,
+	request harnessv2.StartPromptRequest,
+	settlement harnessv2.PromptSettlement,
+) error {
+	duplicate, err := s.promptAdmissionReplay(ctx, request)
+	if err != nil {
+		return fmt.Errorf("replay identical settled prompt admission: %w", err)
+	}
+	if duplicate.Classification.Class != harnessv2.RequestClassificationSettled ||
+		duplicate.Classification.Phase != harnessv2.OperationPhaseSettled ||
+		duplicate.Classification.TerminalEvent != settlement.TerminalEvent ||
+		duplicate.Settlement == nil || !reflect.DeepEqual(*duplicate.Settlement, settlement) {
+		return fmt.Errorf("identical settled prompt admission did not replay the original settlement")
+	}
+
+	conflicting := conflictingPromptRequest(request)
+	if err := setRequestDigest(&conflicting, &conflicting.Metadata); err != nil {
+		return fmt.Errorf("build conflicting settled prompt admission: %w", err)
+	}
+	stream, err := s.client.StartPrompt(ctx, s.sessionID, conflicting)
+	if stream != nil {
+		_ = stream.Close()
+	}
+	return expectClassificationError(
+		"conflicting settled prompt admission", err,
+		harnessv2.OperationPhaseSettled, settlement.TerminalEvent,
+	)
+}
+
+func (s *lifecycleProbeState) promptAdmissionReplay(
+	ctx context.Context,
+	request harnessv2.StartPromptRequest,
+) (*harnessv2.PromptAdmissionResponse, error) {
+	capability, err := harnessv2.SignOperationCapability(s.target.OperationCapabilitySecret, harnessv2.ClaimsForMutation(request.Metadata))
+	if err != nil {
+		return nil, fmt.Errorf("sign prompt replay capability: %w", err)
+	}
+	path, err := harnessv2.PromptPath(s.sessionID, request.Metadata.PromptID)
+	if err != nil {
+		return nil, err
+	}
+	endpoint, err := endpointURL(s.target.BaseURL, path)
+	if err != nil {
+		return nil, err
+	}
+	payload, err := json.Marshal(request)
+	if err != nil {
+		return nil, err
+	}
+	httpRequest, err := http.NewRequestWithContext(ctx, http.MethodPut, endpoint, bytes.NewReader(payload))
+	if err != nil {
+		return nil, err
+	}
+	httpRequest.Header.Set("Accept", "application/json")
+	httpRequest.Header.Set("Accept-Encoding", "identity")
+	httpRequest.Header.Set("Content-Type", "application/json")
+	httpRequest.Header.Set("Authorization", "Bearer "+s.target.ControllerBearerToken)
+	httpRequest.Header.Set(harnessv2.OperationCapabilityHeader, capability)
+	response, err := s.httpClient.Do(httpRequest)
+	if err != nil {
+		return nil, err
+	}
+	defer response.Body.Close() //nolint:errcheck
+	if response.StatusCode != http.StatusOK {
+		_, _ = io.Copy(io.Discard, io.LimitReader(response.Body, 4096))
+		return nil, fmt.Errorf("prompt replay returned HTTP %d, want 200", response.StatusCode)
+	}
+	mediaType, _, err := mime.ParseMediaType(response.Header.Get("Content-Type"))
+	if err != nil || mediaType != "application/json" {
+		return nil, fmt.Errorf("prompt replay returned unsupported Content-Type")
+	}
+	limited := &io.LimitedReader{R: response.Body, N: int64(harnessv2.MaxCanonicalJSONBytes) + 1}
+	decoder := json.NewDecoder(limited)
+	decoder.DisallowUnknownFields()
+	var admission harnessv2.PromptAdmissionResponse
+	if err := decoder.Decode(&admission); err != nil {
+		return nil, fmt.Errorf("decode prompt replay admission: %w", err)
+	}
+	var extra any
+	if err := decoder.Decode(&extra); !errors.Is(err, io.EOF) {
+		return nil, fmt.Errorf("prompt replay admission contains trailing JSON")
+	}
+	if limited.N == 0 {
+		return nil, fmt.Errorf("prompt replay admission exceeds the canonical JSON limit")
+	}
+	if err := admission.Validate(); err != nil {
+		return nil, fmt.Errorf("validate prompt replay admission: %w", err)
+	}
+	return &admission, nil
+}
+
+func conflictingPromptRequest(request harnessv2.StartPromptRequest) harnessv2.StartPromptRequest {
+	conflicting := request
+	conflicting.Input.Content = append([]harnessv2.ContentBlock(nil), request.Input.Content...)
+	if len(conflicting.Input.Content) > 0 {
+		conflicting.Input.Content[0].Text += " Digest-conflict probe."
+	}
+	return conflicting
+}
+
+func (s *lifecycleProbeState) probeCancellationReplay(
+	ctx context.Context,
+	request harnessv2.CancelPromptRequest,
+	original *harnessv2.CancelPromptResponse,
+) error {
+	duplicate, err := s.client.CancelPrompt(ctx, s.sessionID, request)
+	if err != nil {
+		return fmt.Errorf("replay identical prompt cancellation: %w", err)
+	}
+	if original == nil {
+		return fmt.Errorf("original prompt cancellation response is required")
+	}
+	if duplicate.Classification.Class != harnessv2.RequestClassificationSettled ||
+		duplicate.Classification.Phase != harnessv2.OperationPhaseSettled ||
+		duplicate.Classification.TerminalEvent != original.Settlement.TerminalEvent {
+		return fmt.Errorf("identical prompt cancellation classified as %#v, want settled replay", duplicate.Classification)
+	}
+	duplicateReplay := *duplicate
+	originalReplay := *original
+	duplicateReplay.Classification = harnessv2.Classification{}
+	originalReplay.Classification = harnessv2.Classification{}
+	if !reflect.DeepEqual(duplicateReplay, originalReplay) {
+		return fmt.Errorf("identical prompt cancellation did not replay the original response")
+	}
+
+	conflicting := request
+	conflicting.Reason = harnessv2.CancelReasonTaskTimeout
+	if err := setRequestDigest(&conflicting, &conflicting.Metadata); err != nil {
+		return fmt.Errorf("build conflicting prompt cancellation: %w", err)
+	}
+	_, err = s.client.CancelPrompt(ctx, s.sessionID, conflicting)
+	return expectClassificationError(
+		"conflicting prompt cancellation", err,
+		harnessv2.OperationPhaseSettled, original.Settlement.TerminalEvent,
+	)
+}
+
+func (s *lifecycleProbeState) probeWorkspaceDeltaReplay(
+	ctx context.Context,
+	request harnessv2.CreateWorkspaceDeltaRequest,
+	original *harnessv2.CreateWorkspaceDeltaResponse,
+) error {
+	duplicate, err := s.client.CreateWorkspaceDelta(ctx, s.sessionID, request)
+	if err != nil {
+		return fmt.Errorf("replay identical workspace delta: %w", err)
+	}
+	if duplicate.Classification.Class != harnessv2.RequestClassificationDuplicate ||
+		duplicate.Classification.Phase != harnessv2.OperationPhaseApplied {
+		return fmt.Errorf("identical workspace delta classified as %#v, want duplicate/applied", duplicate.Classification)
+	}
+	if original == nil || !reflect.DeepEqual(duplicate.Delta, original.Delta) {
+		return fmt.Errorf("identical workspace delta did not replay the original descriptor")
+	}
+
+	conflicting := request
+	if conflicting.Limits.MaxEntries > 1 {
+		conflicting.Limits.MaxEntries--
+	} else {
+		conflicting.Limits.MaxEntries++
+	}
+	if err := setRequestDigest(&conflicting, &conflicting.Metadata); err != nil {
+		return fmt.Errorf("build conflicting workspace delta: %w", err)
+	}
+	_, err = s.client.CreateWorkspaceDelta(ctx, s.sessionID, conflicting)
+	return expectClassificationError(
+		"conflicting workspace delta", err,
+		harnessv2.OperationPhaseApplied, "",
+	)
+}
+
+func (s *lifecycleProbeState) probePublicationFinalizationReplay(
+	ctx context.Context,
+	request harnessv2.FinalizeRuntimeSessionPublicationRequest,
+	original *harnessv2.FinalizeRuntimeSessionPublicationResponse,
+) error {
+	duplicate, err := s.client.FinalizeRuntimeSessionPublication(ctx, s.sessionID, request)
+	if err != nil {
+		return fmt.Errorf("replay identical publication finalization: %w", err)
+	}
+	if duplicate.Classification.Class != harnessv2.RequestClassificationDuplicate ||
+		duplicate.Classification.Phase != harnessv2.OperationPhaseApplied {
+		return fmt.Errorf("identical publication finalization classified as %#v, want duplicate/applied", duplicate.Classification)
+	}
+	if original == nil || !reflect.DeepEqual(duplicate.Finalization, original.Finalization) {
+		return fmt.Errorf("identical publication finalization did not replay the original receipt")
+	}
+	conflicting := request
+	conflicting.TerminalReceiptDigest = digestString("conflicting-publication-finalization")
+	if err := setRequestDigest(&conflicting, &conflicting.Metadata); err != nil {
+		return fmt.Errorf("build conflicting publication finalization: %w", err)
+	}
+	_, err = s.client.FinalizeRuntimeSessionPublication(ctx, s.sessionID, conflicting)
+	return expectClassificationError("conflicting publication finalization", err, harnessv2.OperationPhaseApplied, "")
+}
+
+func (s *lifecycleProbeState) probePublicationFinalizationRecovery(
+	ctx context.Context,
+	request harnessv2.FinalizeRuntimeSessionPublicationRequest,
+	original *harnessv2.FinalizeRuntimeSessionPublicationResponse,
+) error {
+	if original == nil {
+		return fmt.Errorf("publication finalization recovery requires the original response")
+	}
+
+	stale := request
+	stale.Metadata.OperationID = harnessv2.OperationID(string(request.Metadata.OperationID) + "-stale-generation")
+	stale.Metadata.Fence.RuntimeSessionGeneration++
+	stale.Metadata.ExpiresAt = time.Now().UTC().Add(30 * time.Second)
+	if err := setRequestDigest(&stale, &stale.Metadata); err != nil {
+		return fmt.Errorf("build stale-generation publication finalization: %w", err)
+	}
+	_, err := s.client.FinalizeRuntimeSessionPublication(ctx, s.sessionID, stale)
+	if err := expectStaleSessionGeneration("publication finalization", err); err != nil {
+		return err
+	}
+
+	conflicting := request
+	conflicting.Metadata.OperationID = harnessv2.OperationID(string(request.Metadata.OperationID) + "-fresh-conflict")
+	conflicting.Metadata.ExpiresAt = time.Now().UTC().Add(30 * time.Second)
+	conflicting.TerminalReceiptDigest = digestString("conflicting-fresh-publication-finalization")
+	if err := setRequestDigest(&conflicting, &conflicting.Metadata); err != nil {
+		return fmt.Errorf("build conflicting fresh publication finalization: %w", err)
+	}
+	_, err = s.client.FinalizeRuntimeSessionPublication(ctx, s.sessionID, conflicting)
+	if err == nil {
+		return fmt.Errorf("conflicting fresh publication finalization succeeded, want digest_conflict")
+	}
+	var clientErr *harnessv2.ClientError
+	if !errors.As(err, &clientErr) || clientErr.Code != harnessv2.ErrorCodeDigestConflict || clientErr.Retryable {
+		return fmt.Errorf("conflicting fresh publication finalization returned %v, want non-retryable digest_conflict", err)
+	}
+
+	recovery := request
+	recovery.Metadata.OperationID = harnessv2.OperationID(string(request.Metadata.OperationID) + "-fresh-recovery")
+	recovery.Metadata.ExpiresAt = time.Now().UTC().Add(30 * time.Second)
+	if err := setRequestDigest(&recovery, &recovery.Metadata); err != nil {
+		return fmt.Errorf("build fresh publication finalization recovery: %w", err)
+	}
+	recovered, err := s.client.FinalizeRuntimeSessionPublication(ctx, s.sessionID, recovery)
+	if err != nil {
+		return fmt.Errorf("recover publication finalization with fresh operation: %w", err)
+	}
+	if recovered.Classification.Class != harnessv2.RequestClassificationFresh ||
+		recovered.Session.State != harnessv2.RuntimeSessionStateFinalizing {
+		return fmt.Errorf("fresh publication finalization recovery returned %#v", recovered)
+	}
+	if !reflect.DeepEqual(recovered.Finalization, original.Finalization) {
+		return fmt.Errorf("fresh publication finalization recovery did not preserve the original receipt")
+	}
+	return nil
+}
+
+func (s *lifecycleProbeState) probeStaleSessionDeletion(
+	ctx context.Context, request harnessv2.DeleteRuntimeSessionRequest,
+) error {
+	stale := request
+	stale.Metadata.OperationID = harnessv2.OperationID(string(request.Metadata.OperationID) + "-stale-generation")
+	stale.Metadata.Fence.RuntimeSessionGeneration++
+	stale.Metadata.ExpiresAt = time.Now().UTC().Add(30 * time.Second)
+	if err := setRequestDigest(&stale, &stale.Metadata); err != nil {
+		return fmt.Errorf("build stale-generation runtime-session deletion: %w", err)
+	}
+	_, err := s.client.DeleteRuntimeSession(ctx, s.sessionID, stale)
+	return expectStaleSessionGeneration("runtime-session deletion", err)
+}
+
+func expectStaleSessionGeneration(operation string, err error) error {
+	if err == nil {
+		return fmt.Errorf("%s accepted a stale RuntimeSession generation", operation)
+	}
+	var clientErr *harnessv2.ClientError
+	if !errors.As(err, &clientErr) || clientErr.StatusCode != http.StatusGone || clientErr.Classification == nil ||
+		clientErr.Classification.Class != harnessv2.RequestClassificationStaleFence ||
+		clientErr.Classification.FenceMismatch != harnessv2.FenceMismatchRuntimeSessionGeneration {
+		return fmt.Errorf("stale-generation %s returned %v, want HTTP 410 stale_fence/runtime_session_generation", operation, err)
+	}
+	return nil
+}
+
+func (s *lifecycleProbeState) probeDeletionReplay(
+	ctx context.Context,
+	request harnessv2.DeleteRuntimeSessionRequest,
+	original *harnessv2.DeleteRuntimeSessionResponse,
+) error {
+	duplicate, err := s.client.DeleteRuntimeSession(ctx, s.sessionID, request)
+	if err != nil {
+		return fmt.Errorf("replay identical runtime-session deletion: %w", err)
+	}
+	if duplicate.Classification.Class != harnessv2.RequestClassificationDuplicate ||
+		duplicate.Classification.Phase != harnessv2.OperationPhaseDeleted {
+		return fmt.Errorf("identical runtime-session deletion classified as %#v, want duplicate/deleted", duplicate.Classification)
+	}
+	if original == nil || !reflect.DeepEqual(duplicate.Tombstone, original.Tombstone) {
+		return fmt.Errorf("identical runtime-session deletion did not replay the original tombstone")
+	}
+
+	conflicting := request
+	conflicting.Reason += " with conflicting digest"
+	if err := setRequestDigest(&conflicting, &conflicting.Metadata); err != nil {
+		return fmt.Errorf("build conflicting runtime-session deletion: %w", err)
+	}
+	_, err = s.client.DeleteRuntimeSession(ctx, s.sessionID, conflicting)
+	return expectClassificationError(
+		"conflicting runtime-session deletion", err,
+		harnessv2.OperationPhaseDeleted, "",
+	)
+}
+
+func expectClassificationError(
+	operation string,
+	err error,
+	phase harnessv2.OperationPhase,
+	terminal harnessv2.EventType,
+) error {
+	const class = harnessv2.RequestClassificationDigestConflict
+	if err == nil {
+		return fmt.Errorf("%s succeeded, want %s classification", operation, class)
+	}
+	var clientErr *harnessv2.ClientError
+	if !errors.As(err, &clientErr) || clientErr.Classification == nil {
+		return fmt.Errorf("%s returned %v, want typed %s classification", operation, err, class)
+	}
+	classification := *clientErr.Classification
+	if classification.Class != class || classification.Phase != phase || classification.TerminalEvent != terminal {
+		return fmt.Errorf("%s classified as %#v, want class=%q phase=%q terminal=%q", operation, classification, class, phase, terminal)
+	}
+	return nil
+}
diff --git a/internal/harness/v2/conformance/types.go b/internal/harness/v2/conformance/types.go
new file mode 100644
index 000000000..e08350371
--- /dev/null
+++ b/internal/harness/v2/conformance/types.go
@@ -0,0 +1,59 @@
+package conformance
+
+import (
+	"time"
+
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+// WorkspaceGovernanceMode and WorkspaceGovernanceClaims share the portable
+// v2 capability wire type; external registration adds policy around the same
+// canonical field rather than defining a duplicate JSON member.
+type WorkspaceGovernanceMode = harnessv2.WorkspaceGovernanceMode
+
+const (
+	WorkspaceGovernanceStrict  = harnessv2.WorkspaceGovernanceStrict
+	WorkspaceGovernanceTrusted = harnessv2.WorkspaceGovernanceTrusted
+)
+
+type WorkspaceGovernanceClaims = harnessv2.WorkspaceGovernanceCapabilities
+
+// CapabilitiesResponse is the external-runtime v2 capability envelope.
+type CapabilitiesResponse struct {
+	harnessv2.CapabilitiesResponse
+}
+
+func (r CapabilitiesResponse) Validate() error {
+	return r.CapabilitiesResponse.Validate()
+}
+
+// Target is one exact external runtime registration to probe. Check never
+// automatically retries mutations, reconnects prompt streams, or allocates a
+// replacement prompt identity after ambiguous acceptance. A lifecycle probe
+// deliberately resends exact operation identities to verify a claimed
+// duplicate-safe replay matrix.
+type Target struct {
+	BaseURL                         string
+	ControllerBearerToken           string
+	OperationCapabilitySecret       []byte
+	ControlTimeout                  time.Duration
+	ExpectedRuntimeInstanceID       harnessv2.RuntimeInstanceID
+	Profile                         harnessv2.RuntimeProfile
+	ToolPolicy                      harnessv2.MCPToolPolicy
+	ApprovalPolicy                  harnessv2.MCPApprovalPolicy
+	Limits                          harnessv2.ProtocolLimits
+	SupportsDrain                   bool
+	SupportsPublicationFinalization bool
+	WorkspaceGovernance             WorkspaceGovernanceClaims
+	ProbeLifecycle                  bool
+}
+
+// Result contains only sanitized protocol observations. Authentication values,
+// operation capabilities, prompt content, and provider output are never stored.
+type Result struct {
+	Passed                 bool
+	Message                string
+	ObservedCapabilities   *CapabilitiesResponse
+	ObservedStatus         *harnessv2.StatusResponse
+	LifecycleProbeExecuted bool
+}
diff --git a/internal/harness/v2/digest.go b/internal/harness/v2/digest.go
new file mode 100644
index 000000000..3e13492f2
--- /dev/null
+++ b/internal/harness/v2/digest.go
@@ -0,0 +1,430 @@
+package v2
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"sort"
+	"strconv"
+	"strings"
+	"unicode/utf8"
+)
+
+const (
+	RequestDigestDomain            = "orka.harness.v2.request.v1"
+	ProfileDigestDomain            = "orka.harness.v2.profile.v1"
+	AgentConfigurationDigestDomain = "orka.harness.v2.agent-configuration.v1"
+
+	MaxCanonicalJSONBytes   = 2 << 20
+	maxCanonicalJSONDepth   = 64
+	maxCanonicalJSONItems   = 100_000
+	maxCanonicalNumberChars = 8 * 1024
+)
+
+type canonicalNumber string
+
+type canonicalParser struct {
+	dec   *json.Decoder
+	items int
+}
+
+// CanonicalJSON parses JSON with duplicate-key rejection and emits the stable
+// v2 canonical form. Object keys are sorted by UTF-8 byte order, insignificant
+// whitespace is removed, strings use encoding/json escaping, and numerically
+// equivalent finite JSON numbers use the same non-exponent decimal spelling.
+func CanonicalJSON(raw []byte) ([]byte, error) {
+	if len(bytes.TrimSpace(raw)) == 0 {
+		return nil, fmt.Errorf("canonical JSON is empty")
+	}
+	if len(raw) > MaxCanonicalJSONBytes {
+		return nil, fmt.Errorf("canonical JSON exceeds %d bytes", MaxCanonicalJSONBytes)
+	}
+	if !utf8.Valid(raw) {
+		return nil, fmt.Errorf("canonical JSON contains invalid UTF-8")
+	}
+	dec := json.NewDecoder(bytes.NewReader(raw))
+	dec.UseNumber()
+	parser := canonicalParser{dec: dec}
+	value, err := parser.parse(0)
+	if err != nil {
+		return nil, err
+	}
+	if tok, err := dec.Token(); err != io.EOF {
+		if err == nil {
+			return nil, fmt.Errorf("canonical JSON has trailing token %v", tok)
+		}
+		return nil, fmt.Errorf("canonical JSON has trailing data: %w", err)
+	}
+	var out bytes.Buffer
+	if err := appendCanonicalJSON(&out, value); err != nil {
+		return nil, err
+	}
+	return out.Bytes(), nil
+}
+
+// CanonicalValue marshals a Go value and returns its canonical JSON form.
+func CanonicalValue(value any) ([]byte, error) {
+	raw, err := json.Marshal(value)
+	if err != nil {
+		return nil, fmt.Errorf("marshal canonical value: %w", err)
+	}
+	return CanonicalJSON(raw)
+}
+
+// CanonicalRequestDigest hashes the canonical request after removing the sole
+// metadata.requestDigest field. The domain separator and schema version prevent
+// the digest from being reused as another kind of content digest.
+func CanonicalRequestDigest(request any) (RequestDigest, error) {
+	raw, err := json.Marshal(request)
+	if err != nil {
+		return "", fmt.Errorf("marshal request for digest: %w", err)
+	}
+	return CanonicalRequestDigestJSON(raw)
+}
+
+// CanonicalRequestDigestJSON is the raw JSON variant of
+// CanonicalRequestDigest. It rejects duplicate keys before digesting.
+func CanonicalRequestDigestJSON(raw []byte) (RequestDigest, error) {
+	value, err := parseCanonicalJSON(raw)
+	if err != nil {
+		return "", err
+	}
+	root, ok := value.(map[string]any)
+	if !ok {
+		return "", fmt.Errorf("request digest input must be a JSON object")
+	}
+	metadata, ok := root["metadata"].(map[string]any)
+	if !ok {
+		return "", fmt.Errorf("request digest input requires metadata object")
+	}
+	digestValue, ok := metadata["requestDigest"]
+	if !ok {
+		return "", fmt.Errorf("request digest input requires metadata.requestDigest")
+	}
+	if _, ok := digestValue.(string); !ok {
+		return "", fmt.Errorf("metadata.requestDigest must be a string")
+	}
+	delete(metadata, "requestDigest")
+	// agentConfiguration was added after the v1 request-digest contract. Its
+	// canonical digest is already bound by profile.agentConfigurationDigest, so
+	// exclude the raw expansion to keep old/new controller-supervisor pairs
+	// wire-compatible during a rolling upgrade.
+	delete(root, "agentConfiguration")
+	var canonical bytes.Buffer
+	if err := appendCanonicalJSON(&canonical, root); err != nil {
+		return "", err
+	}
+	return RequestDigest(hashCanonical(RequestDigestDomain, canonical.Bytes())), nil
+}
+
+// CanonicalProfileDigest returns a domain-separated digest for an immutable
+// runtime profile.
+func CanonicalProfileDigest(profile any) (ProfileDigest, error) {
+	canonical, err := CanonicalValue(profile)
+	if err != nil {
+		return "", err
+	}
+	return ProfileDigest(hashCanonical(ProfileDigestDomain, canonical)), nil
+}
+
+// CanonicalAgentConfigurationDigest returns the domain-separated digest of one
+// validated, resolved Agent session configuration.
+func CanonicalLegacyAgentConfigurationDigest(configuration AgentSessionConfiguration, allowBash bool) (string, error) {
+	if err := configuration.Validate(); err != nil {
+		return "", err
+	}
+	if configuration.SystemPrompt != "" || configuration.ReasoningEffort != "" {
+		return "", fmt.Errorf("legacy Agent configuration cannot bind system prompt or reasoning effort")
+	}
+	canonical, err := CanonicalValue(map[string]any{
+		"agentUID": configuration.AgentUID, "agentGeneration": configuration.AgentGeneration,
+		"runtime": configuration.ProviderKind, "model": configuration.Model,
+		"maxTurns": configuration.MaxTurns, "allowBash": allowBash,
+	})
+	if err != nil {
+		return "", err
+	}
+	return hashCanonical("orka.acp.agent-configuration", canonical), nil
+}
+
+func CanonicalAgentConfigurationDigest(configuration AgentSessionConfiguration) (string, error) {
+	if err := configuration.Validate(); err != nil {
+		return "", err
+	}
+	canonical, err := CanonicalValue(configuration)
+	if err != nil {
+		return "", err
+	}
+	return hashCanonical(AgentConfigurationDigestDomain, canonical), nil
+}
+
+func ValidateRequestDigest(digest RequestDigest) error {
+	return validateSHA256Digest(string(digest))
+}
+
+func ValidateProfileDigest(digest ProfileDigest) error {
+	return validateSHA256Digest(string(digest))
+}
+
+func hashCanonical(domain string, canonical []byte) string {
+	h := sha256.New()
+	_, _ = io.WriteString(h, domain)
+	_, _ = h.Write([]byte{0})
+	_, _ = h.Write(canonical)
+	return "sha256:" + hex.EncodeToString(h.Sum(nil))
+}
+
+func validateSHA256Digest(value string) error {
+	if len(value) != len("sha256:")+sha256.Size*2 || !strings.HasPrefix(value, "sha256:") {
+		return fmt.Errorf("must be sha256:<64 lowercase hex characters>")
+	}
+	hexPart := strings.TrimPrefix(value, "sha256:")
+	if strings.ToLower(hexPart) != hexPart {
+		return fmt.Errorf("must use lowercase hexadecimal")
+	}
+	if _, err := hex.DecodeString(hexPart); err != nil {
+		return fmt.Errorf("invalid SHA-256 hexadecimal: %w", err)
+	}
+	return nil
+}
+
+func parseCanonicalJSON(raw []byte) (any, error) {
+	if len(bytes.TrimSpace(raw)) == 0 {
+		return nil, fmt.Errorf("canonical JSON is empty")
+	}
+	if len(raw) > MaxCanonicalJSONBytes {
+		return nil, fmt.Errorf("canonical JSON exceeds %d bytes", MaxCanonicalJSONBytes)
+	}
+	if !utf8.Valid(raw) {
+		return nil, fmt.Errorf("canonical JSON contains invalid UTF-8")
+	}
+	dec := json.NewDecoder(bytes.NewReader(raw))
+	dec.UseNumber()
+	parser := canonicalParser{dec: dec}
+	value, err := parser.parse(0)
+	if err != nil {
+		return nil, err
+	}
+	if tok, err := dec.Token(); err != io.EOF {
+		if err == nil {
+			return nil, fmt.Errorf("canonical JSON has trailing token %v", tok)
+		}
+		return nil, fmt.Errorf("canonical JSON has trailing data: %w", err)
+	}
+	return value, nil
+}
+
+func (p *canonicalParser) parse(depth int) (any, error) {
+	if depth > maxCanonicalJSONDepth {
+		return nil, fmt.Errorf("canonical JSON exceeds maximum depth %d", maxCanonicalJSONDepth)
+	}
+	p.items++
+	if p.items > maxCanonicalJSONItems {
+		return nil, fmt.Errorf("canonical JSON exceeds maximum item count %d", maxCanonicalJSONItems)
+	}
+	tok, err := p.dec.Token()
+	if err != nil {
+		return nil, fmt.Errorf("parse canonical JSON: %w", err)
+	}
+	switch value := tok.(type) {
+	case json.Delim:
+		switch value {
+		case '{':
+			object := make(map[string]any)
+			for p.dec.More() {
+				keyToken, err := p.dec.Token()
+				if err != nil {
+					return nil, fmt.Errorf("parse canonical JSON object key: %w", err)
+				}
+				key, ok := keyToken.(string)
+				if !ok {
+					return nil, fmt.Errorf("canonical JSON object key is not a string")
+				}
+				if _, exists := object[key]; exists {
+					return nil, fmt.Errorf("canonical JSON contains duplicate object key %q", key)
+				}
+				item, err := p.parse(depth + 1)
+				if err != nil {
+					return nil, err
+				}
+				object[key] = item
+			}
+			end, err := p.dec.Token()
+			if err != nil || end != json.Delim('}') {
+				return nil, fmt.Errorf("parse canonical JSON object terminator: %w", err)
+			}
+			return object, nil
+		case '[':
+			array := make([]any, 0)
+			for p.dec.More() {
+				item, err := p.parse(depth + 1)
+				if err != nil {
+					return nil, err
+				}
+				array = append(array, item)
+			}
+			end, err := p.dec.Token()
+			if err != nil || end != json.Delim(']') {
+				return nil, fmt.Errorf("parse canonical JSON array terminator: %w", err)
+			}
+			return array, nil
+		default:
+			return nil, fmt.Errorf("unexpected canonical JSON delimiter %q", value)
+		}
+	case json.Number:
+		normalized, err := normalizeJSONNumber(value.String())
+		if err != nil {
+			return nil, err
+		}
+		return canonicalNumber(normalized), nil
+	case string, bool, nil:
+		return value, nil
+	default:
+		return nil, fmt.Errorf("unsupported canonical JSON token %T", tok)
+	}
+}
+
+func appendCanonicalJSON(out *bytes.Buffer, value any) error {
+	switch typed := value.(type) {
+	case nil:
+		out.WriteString("null")
+	case bool:
+		if typed {
+			out.WriteString("true")
+		} else {
+			out.WriteString("false")
+		}
+	case string:
+		encoded, err := json.Marshal(typed)
+		if err != nil {
+			return fmt.Errorf("encode canonical JSON string: %w", err)
+		}
+		out.Write(encoded)
+	case canonicalNumber:
+		out.WriteString(string(typed))
+	case []any:
+		out.WriteByte('[')
+		for i, item := range typed {
+			if i > 0 {
+				out.WriteByte(',')
+			}
+			if err := appendCanonicalJSON(out, item); err != nil {
+				return err
+			}
+		}
+		out.WriteByte(']')
+	case map[string]any:
+		keys := make([]string, 0, len(typed))
+		for key := range typed {
+			keys = append(keys, key)
+		}
+		sort.Strings(keys)
+		out.WriteByte('{')
+		for i, key := range keys {
+			if i > 0 {
+				out.WriteByte(',')
+			}
+			encoded, err := json.Marshal(key)
+			if err != nil {
+				return fmt.Errorf("encode canonical JSON key: %w", err)
+			}
+			out.Write(encoded)
+			out.WriteByte(':')
+			if err := appendCanonicalJSON(out, typed[key]); err != nil {
+				return err
+			}
+		}
+		out.WriteByte('}')
+	default:
+		return fmt.Errorf("unsupported canonical JSON value %T", value)
+	}
+	return nil
+}
+
+func normalizeJSONNumber(raw string) (string, error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return "", fmt.Errorf("canonical JSON number is empty")
+	}
+	sign := ""
+	if strings.HasPrefix(raw, "-") {
+		sign = "-"
+		raw = strings.TrimPrefix(raw, "-")
+	}
+	exponent := 0
+	if expIndex := strings.IndexAny(raw, "eE"); expIndex >= 0 {
+		parsed, err := strconv.Atoi(raw[expIndex+1:])
+		if err != nil {
+			return "", fmt.Errorf("invalid canonical JSON number exponent %q", raw)
+		}
+		if parsed > maxCanonicalNumberChars || parsed < -maxCanonicalNumberChars {
+			return "", fmt.Errorf("canonical JSON number exponent exceeds safe bound")
+		}
+		exponent = parsed
+		raw = raw[:expIndex]
+	}
+	intPart, fracPart, _ := strings.Cut(raw, ".")
+	if intPart == "" {
+		return "", fmt.Errorf("invalid canonical JSON number %q", raw)
+	}
+	digitsRaw := intPart + fracPart
+	leadingZeros := len(digitsRaw) - len(strings.TrimLeft(digitsRaw, "0"))
+	digits := strings.TrimLeft(digitsRaw, "0")
+	if digits == "" {
+		return "0", nil
+	}
+	if len(digits) > maxCanonicalNumberChars {
+		return "", fmt.Errorf("canonical JSON number exceeds safe length")
+	}
+	decimalPos := len(intPart) + exponent - leadingZeros
+	var out string
+	switch {
+	case decimalPos <= 0:
+		zeros := -decimalPos
+		if zeros+len(digits)+2 > maxCanonicalNumberChars {
+			return "", fmt.Errorf("canonical JSON number exceeds safe length")
+		}
+		out = "0." + strings.Repeat("0", zeros) + digits
+	case decimalPos >= len(digits):
+		zeros := decimalPos - len(digits)
+		if len(digits)+zeros > maxCanonicalNumberChars {
+			return "", fmt.Errorf("canonical JSON number exceeds safe length")
+		}
+		out = digits + strings.Repeat("0", zeros)
+	default:
+		out = digits[:decimalPos] + "." + digits[decimalPos:]
+	}
+	if dot := strings.IndexByte(out, '.'); dot >= 0 {
+		whole := out[:dot]
+		fraction := strings.TrimRight(out[dot+1:], "0")
+		if fraction == "" {
+			out = whole
+		} else {
+			out = whole + "." + fraction
+		}
+	}
+	if strings.HasPrefix(out, "0.") {
+		return sign + out, nil
+	}
+	out = strings.TrimLeft(out, "0")
+	if out == "" {
+		return "0", nil
+	}
+	return sign + out, nil
+}
+
+// CanonicalPromptSettlementDigest binds workspace validation to one exact
+// terminal prompt settlement without reusing the request/profile digest domains.
+func CanonicalPromptSettlementDigest(settlement PromptSettlement) (string, error) {
+	if err := settlement.Validate(); err != nil {
+		return "", err
+	}
+	canonical, err := CanonicalValue(settlement)
+	if err != nil {
+		return "", err
+	}
+	return hashCanonical("orka.harness.v2.prompt-settlement", canonical), nil
+}
diff --git a/internal/harness/v2/doc.go b/internal/harness/v2/doc.go
new file mode 100644
index 000000000..ce92f1b3d
--- /dev/null
+++ b/internal/harness/v2/doc.go
@@ -0,0 +1,7 @@
+// Package v2 defines the portable orka.harness.v2 wire contract.
+//
+// The package intentionally contains protocol types, validation, canonical
+// request digesting, replay/fence classification, lifecycle rules, and bounded
+// NDJSON framing only. It does not implement a runtime supervisor, persistence,
+// authentication transport, or provider process management.
+package v2
diff --git a/internal/harness/v2/event_types.go b/internal/harness/v2/event_types.go
new file mode 100644
index 000000000..a7ca75858
--- /dev/null
+++ b/internal/harness/v2/event_types.go
@@ -0,0 +1,544 @@
+package v2
+
+import (
+	"encoding/json"
+	"fmt"
+	"time"
+)
+
+type EventType string
+
+const (
+	EventAccepted            EventType = "accepted"
+	EventUpdate              EventType = "update"
+	EventPermissionRequested EventType = "permission_requested"
+	EventCompleted           EventType = "completed"
+	EventCancelled           EventType = "cancelled"
+	EventFailed              EventType = "failed"
+	EventOutcomeUnknown      EventType = "outcome_unknown"
+)
+
+func (t EventType) IsTerminal() bool {
+	switch t {
+	case EventCompleted, EventCancelled, EventFailed, EventOutcomeUnknown:
+		return true
+	default:
+		return false
+	}
+}
+
+type EventIdentity struct {
+	RuntimeInstanceID        RuntimeInstanceID `json:"runtimeInstanceID"`
+	SupervisorBootID         SupervisorBootID  `json:"supervisorBootID"`
+	RuntimeSessionUID        RuntimeSessionUID `json:"runtimeSessionUID"`
+	RuntimeSessionGeneration uint64            `json:"runtimeSessionGeneration"`
+	TaskUID                  TaskUID           `json:"taskUID"`
+	TaskAttempt              uint32            `json:"taskAttempt"`
+	PromptID                 PromptID          `json:"promptID"`
+	Sequence                 uint64            `json:"sequence"`
+	RequestDigest            RequestDigest     `json:"requestDigest"`
+	Timestamp                time.Time         `json:"timestamp"`
+}
+
+func (i EventIdentity) Validate() error {
+	if err := requireIdentifier("runtime instance ID", string(i.RuntimeInstanceID)); err != nil {
+		return err
+	}
+	if err := requireIdentifier("supervisor boot ID", string(i.SupervisorBootID)); err != nil {
+		return err
+	}
+	if err := requireIdentifier("runtime session UID", string(i.RuntimeSessionUID)); err != nil {
+		return err
+	}
+	if i.RuntimeSessionGeneration == 0 {
+		return fmt.Errorf("runtime session generation must be positive")
+	}
+	if err := requireIdentifier("task UID", string(i.TaskUID)); err != nil {
+		return err
+	}
+	if i.TaskAttempt == 0 {
+		return fmt.Errorf("task attempt must be positive")
+	}
+	if err := requireIdentifier("prompt ID", string(i.PromptID)); err != nil {
+		return err
+	}
+	if i.Sequence == 0 {
+		return fmt.Errorf("event sequence must be positive")
+	}
+	if err := ValidateRequestDigest(i.RequestDigest); err != nil {
+		return fmt.Errorf("request digest: %w", err)
+	}
+	return validateTimestamp("event timestamp", i.Timestamp)
+}
+
+type EventExpectation struct {
+	RuntimeInstanceID        RuntimeInstanceID
+	SupervisorBootID         SupervisorBootID
+	RuntimeSessionUID        RuntimeSessionUID
+	RuntimeSessionGeneration uint64
+	TaskUID                  TaskUID
+	TaskAttempt              uint32
+	PromptID                 PromptID
+	RequestDigest            RequestDigest
+}
+
+func EventExpectationFromMetadata(metadata MutationMetadata) EventExpectation {
+	return EventExpectation{
+		RuntimeInstanceID:        metadata.Fence.RuntimeInstanceID,
+		SupervisorBootID:         metadata.Fence.SupervisorBootID,
+		RuntimeSessionUID:        metadata.Fence.RuntimeSessionUID,
+		RuntimeSessionGeneration: metadata.Fence.RuntimeSessionGeneration,
+		TaskUID:                  metadata.TaskUID,
+		TaskAttempt:              metadata.TaskAttempt,
+		PromptID:                 metadata.PromptID,
+		RequestDigest:            metadata.RequestDigest,
+	}
+}
+
+func (e EventExpectation) Validate() error {
+	identity := EventIdentity{
+		RuntimeInstanceID:        e.RuntimeInstanceID,
+		SupervisorBootID:         e.SupervisorBootID,
+		RuntimeSessionUID:        e.RuntimeSessionUID,
+		RuntimeSessionGeneration: e.RuntimeSessionGeneration,
+		TaskUID:                  e.TaskUID,
+		TaskAttempt:              e.TaskAttempt,
+		PromptID:                 e.PromptID,
+		Sequence:                 1,
+		RequestDigest:            e.RequestDigest,
+		Timestamp:                time.Unix(1, 0).UTC(),
+	}
+	return identity.Validate()
+}
+
+func (e EventExpectation) Matches(identity EventIdentity) error {
+	switch {
+	case e.RuntimeInstanceID != identity.RuntimeInstanceID:
+		return fmt.Errorf("event runtime instance ID %q does not match expected %q", identity.RuntimeInstanceID, e.RuntimeInstanceID)
+	case e.SupervisorBootID != identity.SupervisorBootID:
+		return fmt.Errorf("event supervisor boot ID %q does not match expected %q", identity.SupervisorBootID, e.SupervisorBootID)
+	case e.RuntimeSessionUID != identity.RuntimeSessionUID:
+		return fmt.Errorf("event runtime session UID %q does not match expected %q", identity.RuntimeSessionUID, e.RuntimeSessionUID)
+	case e.RuntimeSessionGeneration != identity.RuntimeSessionGeneration:
+		return fmt.Errorf("event runtime session generation %d does not match expected %d", identity.RuntimeSessionGeneration, e.RuntimeSessionGeneration)
+	case e.TaskUID != identity.TaskUID || e.TaskAttempt != identity.TaskAttempt:
+		return fmt.Errorf("event task identity does not match expectation")
+	case e.PromptID != identity.PromptID:
+		return fmt.Errorf("event prompt ID %q does not match expected %q", identity.PromptID, e.PromptID)
+	case e.RequestDigest != identity.RequestDigest:
+		return fmt.Errorf("event request digest %q does not match expected %q", identity.RequestDigest, e.RequestDigest)
+	default:
+		return nil
+	}
+}
+
+type AcceptedEvent struct {
+	AcceptedAt time.Time   `json:"acceptedAt"`
+	Lease      PromptLease `json:"lease"`
+	ACPVersion string      `json:"acpVersion"`
+}
+
+func (e AcceptedEvent) Validate() error {
+	if err := validateTimestamp("prompt acceptance timestamp", e.AcceptedAt); err != nil {
+		return err
+	}
+	if e.ACPVersion != ACPProfileV1 {
+		return fmt.Errorf("accepted event ACP version %q is unsupported", e.ACPVersion)
+	}
+	return e.Lease.ValidateAt(e.AcceptedAt, 0, 0)
+}
+
+type UpdateKind string
+
+const (
+	UpdateAssistantMessageChunk UpdateKind = "assistant_message_chunk"
+	UpdateToolCall              UpdateKind = "tool_call"
+	UpdateToolCallUpdate        UpdateKind = "tool_call_update"
+	UpdatePlan                  UpdateKind = "plan"
+	UpdateUsage                 UpdateKind = "usage"
+	UpdateDiagnostic            UpdateKind = "diagnostic"
+)
+
+type AssistantMessageChunk struct {
+	Text string `json:"text"`
+}
+
+type ToolCallStatus string
+
+const (
+	ToolCallStatusPending    ToolCallStatus = "pending"
+	ToolCallStatusInProgress ToolCallStatus = "in_progress"
+	ToolCallStatusCompleted  ToolCallStatus = "completed"
+	ToolCallStatusFailed     ToolCallStatus = "failed"
+)
+
+type ToolCallUpdate struct {
+	ToolCallID string         `json:"toolCallID"`
+	Title      string         `json:"title,omitempty"`
+	Kind       string         `json:"kind,omitempty"`
+	Status     ToolCallStatus `json:"status"`
+	Content    []ContentBlock `json:"content,omitempty"`
+}
+
+func (u ToolCallUpdate) Validate() error {
+	if err := requireIdentifier("tool call ID", u.ToolCallID); err != nil {
+		return err
+	}
+	if err := validateBoundedString("tool call title", u.Title, false, 1024); err != nil {
+		return err
+	}
+	if err := validateBoundedString("tool call kind", u.Kind, false, 128); err != nil {
+		return err
+	}
+	switch u.Status {
+	case ToolCallStatusPending, ToolCallStatusInProgress, ToolCallStatusCompleted, ToolCallStatusFailed:
+	default:
+		return fmt.Errorf("unsupported tool call status %q", u.Status)
+	}
+	if len(u.Content) > MaxContentBlocks {
+		return fmt.Errorf("tool call content block count exceeds %d", MaxContentBlocks)
+	}
+	for i := range u.Content {
+		if err := u.Content[i].Validate(); err != nil {
+			return fmt.Errorf("tool call content block %d: %w", i, err)
+		}
+	}
+	return nil
+}
+
+type PlanEntryStatus string
+
+const (
+	PlanEntryPending    PlanEntryStatus = "pending"
+	PlanEntryInProgress PlanEntryStatus = "in_progress"
+	PlanEntryCompleted  PlanEntryStatus = "completed"
+)
+
+type PlanEntry struct {
+	Content  string          `json:"content"`
+	Priority string          `json:"priority,omitempty"`
+	Status   PlanEntryStatus `json:"status"`
+}
+
+type PlanUpdate struct {
+	Entries []PlanEntry `json:"entries"`
+}
+
+func (u PlanUpdate) Validate() error {
+	if len(u.Entries) == 0 || len(u.Entries) > 128 {
+		return fmt.Errorf("plan entry count must be in range 1..128")
+	}
+	for i, entry := range u.Entries {
+		if err := validateBoundedString("plan entry content", entry.Content, true, MaxProtocolStringBytes); err != nil {
+			return fmt.Errorf("plan entry %d: %w", i, err)
+		}
+		if err := validateBoundedString("plan entry priority", entry.Priority, false, 64); err != nil {
+			return fmt.Errorf("plan entry %d: %w", i, err)
+		}
+		switch entry.Status {
+		case PlanEntryPending, PlanEntryInProgress, PlanEntryCompleted:
+		default:
+			return fmt.Errorf("plan entry %d has unsupported status %q", i, entry.Status)
+		}
+	}
+	return nil
+}
+
+type UsageUpdate struct {
+	InputTokens       uint64 `json:"inputTokens,omitempty"`
+	OutputTokens      uint64 `json:"outputTokens,omitempty"`
+	CachedInputTokens uint64 `json:"cachedInputTokens,omitempty"`
+}
+
+type DiagnosticUpdate struct {
+	Code      string `json:"code"`
+	Message   string `json:"message"`
+	Retryable bool   `json:"retryable"`
+}
+
+func (u DiagnosticUpdate) Validate() error {
+	if err := validateBoundedString("diagnostic code", u.Code, true, 128); err != nil {
+		return err
+	}
+	return validateBoundedString("diagnostic message", u.Message, true, MaxDiagnosticBytes)
+}
+
+type UpdateEvent struct {
+	Kind             UpdateKind             `json:"kind"`
+	AssistantMessage *AssistantMessageChunk `json:"assistantMessage,omitempty"`
+	ToolCall         *ToolCallUpdate        `json:"toolCall,omitempty"`
+	Plan             *PlanUpdate            `json:"plan,omitempty"`
+	Usage            *UsageUpdate           `json:"usage,omitempty"`
+	Diagnostic       *DiagnosticUpdate      `json:"diagnostic,omitempty"`
+}
+
+func (e UpdateEvent) Validate() error {
+	if !exactlyOne(e.AssistantMessage != nil, e.ToolCall != nil, e.Plan != nil, e.Usage != nil, e.Diagnostic != nil) {
+		return fmt.Errorf("update event must carry exactly one typed payload")
+	}
+	switch e.Kind {
+	case UpdateAssistantMessageChunk:
+		if e.AssistantMessage == nil {
+			return fmt.Errorf("assistant message update requires assistantMessage payload")
+		}
+		return validateBoundedString("assistant message chunk", e.AssistantMessage.Text, true, MaxProtocolStringBytes)
+	case UpdateToolCall, UpdateToolCallUpdate:
+		if e.ToolCall == nil {
+			return fmt.Errorf("tool call update requires toolCall payload")
+		}
+		return e.ToolCall.Validate()
+	case UpdatePlan:
+		if e.Plan == nil {
+			return fmt.Errorf("plan update requires plan payload")
+		}
+		return e.Plan.Validate()
+	case UpdateUsage:
+		if e.Usage == nil {
+			return fmt.Errorf("usage update requires usage payload")
+		}
+		return nil
+	case UpdateDiagnostic:
+		if e.Diagnostic == nil {
+			return fmt.Errorf("diagnostic update requires diagnostic payload")
+		}
+		return e.Diagnostic.Validate()
+	default:
+		return fmt.Errorf("unsupported update kind %q", e.Kind)
+	}
+}
+
+type PermissionRequestedEvent struct {
+	RequestID  PermissionRequestID `json:"requestID"`
+	ToolCallID string              `json:"toolCallID,omitempty"`
+	ToolName   string              `json:"toolName,omitempty"`
+	Title      string              `json:"title"`
+	Options    []PermissionOption  `json:"options"`
+	ExpiresAt  time.Time           `json:"expiresAt"`
+}
+
+func (e PermissionRequestedEvent) Validate(eventTime time.Time) error {
+	if err := requireIdentifier("permission request ID", string(e.RequestID)); err != nil {
+		return err
+	}
+	if e.ToolCallID != "" {
+		if err := requireIdentifier("permission tool call ID", e.ToolCallID); err != nil {
+			return err
+		}
+	}
+	if e.ToolName != "" {
+		if err := requireIdentifier("permission tool name", e.ToolName); err != nil {
+			return err
+		}
+	}
+	if err := validateBoundedString("permission title", e.Title, true, 1024); err != nil {
+		return err
+	}
+	if len(e.Options) == 0 || len(e.Options) > 16 {
+		return fmt.Errorf("permission option count must be in range 1..16")
+	}
+	seen := make(map[string]struct{}, len(e.Options))
+	for i := range e.Options {
+		if err := e.Options[i].Validate(); err != nil {
+			return fmt.Errorf("permission option %d: %w", i, err)
+		}
+		if _, ok := seen[e.Options[i].OptionID]; ok {
+			return fmt.Errorf("duplicate permission option ID %q", e.Options[i].OptionID)
+		}
+		seen[e.Options[i].OptionID] = struct{}{}
+	}
+	if err := validateTimestamp("permission expiry", e.ExpiresAt); err != nil {
+		return err
+	}
+	if !e.ExpiresAt.After(eventTime) {
+		return fmt.Errorf("permission expiry must follow event timestamp")
+	}
+	return nil
+}
+
+type PromptResult struct {
+	Content []ContentBlock `json:"content"`
+	Model   string         `json:"model,omitempty"`
+	Usage   UsageUpdate    `json:"usage,omitempty"`
+}
+
+func (r PromptResult) Validate() error {
+	if len(r.Content) == 0 || len(r.Content) > MaxContentBlocks {
+		return fmt.Errorf("prompt result content block count must be in range 1..%d", MaxContentBlocks)
+	}
+	for i := range r.Content {
+		if err := r.Content[i].Validate(); err != nil {
+			return fmt.Errorf("prompt result content block %d: %w", i, err)
+		}
+	}
+	return validateBoundedString("result model", r.Model, false, 256)
+}
+
+type CompletedEvent struct {
+	StopReason ACPStopReason `json:"stopReason"`
+	Result     PromptResult  `json:"result"`
+}
+
+func (e CompletedEvent) Validate() error {
+	if e.StopReason != ACPStopReasonEndTurn {
+		return fmt.Errorf("completed event requires end_turn stop reason, got %q", e.StopReason)
+	}
+	return e.Result.Validate()
+}
+
+type CancelledEvent struct {
+	StopReason ACPStopReason `json:"stopReason"`
+	Reason     string        `json:"reason,omitempty"`
+}
+
+func (e CancelledEvent) Validate() error {
+	if e.StopReason != ACPStopReasonCancelled {
+		return fmt.Errorf("cancelled event requires cancelled stop reason, got %q", e.StopReason)
+	}
+	return validateBoundedString("cancellation reason", e.Reason, false, MaxDiagnosticBytes)
+}
+
+type FailedEvent struct {
+	StopReason ACPStopReason `json:"stopReason,omitempty"`
+	Code       string        `json:"code"`
+	Message    string        `json:"message"`
+	Retryable  bool          `json:"retryable"`
+}
+
+func (e FailedEvent) Validate() error {
+	if e.StopReason == ACPStopReasonEndTurn || e.StopReason == ACPStopReasonCancelled {
+		return fmt.Errorf("failed event has non-failure stop reason %q", e.StopReason)
+	}
+	if err := validateBoundedString("failure code", e.Code, true, 128); err != nil {
+		return err
+	}
+	if err := validateBoundedString("failure message", e.Message, true, MaxDiagnosticBytes); err != nil {
+		return err
+	}
+	if e.Retryable {
+		return fmt.Errorf("accepted prompt failure must not advertise automatic replay")
+	}
+	return nil
+}
+
+type OutcomeUnknownEvent struct {
+	Code              string `json:"code"`
+	Message           string `json:"message"`
+	ForcedTermination bool   `json:"forcedTermination,omitempty"`
+	Retryable         bool   `json:"retryable"`
+}
+
+func (e OutcomeUnknownEvent) Validate() error {
+	if err := validateBoundedString("outcome unknown code", e.Code, true, 128); err != nil {
+		return err
+	}
+	if err := validateBoundedString("outcome unknown message", e.Message, true, MaxDiagnosticBytes); err != nil {
+		return err
+	}
+	if e.Retryable {
+		return fmt.Errorf("outcome_unknown must never be retryable")
+	}
+	return nil
+}
+
+type Event struct {
+	Protocol            string                    `json:"protocol"`
+	Type                EventType                 `json:"type"`
+	Identity            EventIdentity             `json:"identity"`
+	Accepted            *AcceptedEvent            `json:"accepted,omitempty"`
+	Update              *UpdateEvent              `json:"update,omitempty"`
+	PermissionRequested *PermissionRequestedEvent `json:"permissionRequested,omitempty"`
+	Completed           *CompletedEvent           `json:"completed,omitempty"`
+	Cancelled           *CancelledEvent           `json:"cancelled,omitempty"`
+	Failed              *FailedEvent              `json:"failed,omitempty"`
+	OutcomeUnknown      *OutcomeUnknownEvent      `json:"outcomeUnknown,omitempty"`
+}
+
+func (e Event) Validate(limits EventStreamLimits) error {
+	if err := limits.Validate(); err != nil {
+		return fmt.Errorf("event limits: %w", err)
+	}
+	if err := validateProtocol(e.Protocol); err != nil {
+		return err
+	}
+	if err := e.Identity.Validate(); err != nil {
+		return fmt.Errorf("event identity: %w", err)
+	}
+	if !exactlyOne(e.Accepted != nil, e.Update != nil, e.PermissionRequested != nil,
+		e.Completed != nil, e.Cancelled != nil, e.Failed != nil, e.OutcomeUnknown != nil) {
+		return fmt.Errorf("event must carry exactly one typed payload")
+	}
+	var err error
+	switch e.Type {
+	case EventAccepted:
+		if e.Accepted == nil {
+			return fmt.Errorf("accepted event requires accepted payload")
+		}
+		err = e.Accepted.Validate()
+	case EventUpdate:
+		if e.Update == nil {
+			return fmt.Errorf("update event requires update payload")
+		}
+		err = e.Update.Validate()
+	case EventPermissionRequested:
+		if e.PermissionRequested == nil {
+			return fmt.Errorf("permission_requested event requires permissionRequested payload")
+		}
+		err = e.PermissionRequested.Validate(e.Identity.Timestamp)
+	case EventCompleted:
+		if e.Completed == nil {
+			return fmt.Errorf("completed event requires completed payload")
+		}
+		err = e.Completed.Validate()
+	case EventCancelled:
+		if e.Cancelled == nil {
+			return fmt.Errorf("cancelled event requires cancelled payload")
+		}
+		err = e.Cancelled.Validate()
+	case EventFailed:
+		if e.Failed == nil {
+			return fmt.Errorf("failed event requires failed payload")
+		}
+		err = e.Failed.Validate()
+	case EventOutcomeUnknown:
+		if e.OutcomeUnknown == nil {
+			return fmt.Errorf("outcome_unknown event requires outcomeUnknown payload")
+		}
+		err = e.OutcomeUnknown.Validate()
+	default:
+		return fmt.Errorf("unsupported event type %q", e.Type)
+	}
+	if err != nil {
+		return fmt.Errorf("%s payload: %w", e.Type, err)
+	}
+	if e.Type.IsTerminal() {
+		payload, err := e.terminalPayloadJSON()
+		if err != nil {
+			return err
+		}
+		if len(payload) > limits.MaxTerminalResultBytes {
+			return fmt.Errorf("terminal payload exceeds %d bytes", limits.MaxTerminalResultBytes)
+		}
+	}
+	return nil
+}
+
+func (e Event) terminalPayloadJSON() ([]byte, error) {
+	var value any
+	switch e.Type {
+	case EventCompleted:
+		value = e.Completed
+	case EventCancelled:
+		value = e.Cancelled
+	case EventFailed:
+		value = e.Failed
+	case EventOutcomeUnknown:
+		value = e.OutcomeUnknown
+	default:
+		return nil, fmt.Errorf("event type %q is not terminal", e.Type)
+	}
+	encoded, err := json.Marshal(value)
+	if err != nil {
+		return nil, fmt.Errorf("marshal terminal event payload: %w", err)
+	}
+	return encoded, nil
+}
diff --git a/internal/harness/v2/identity.go b/internal/harness/v2/identity.go
new file mode 100644
index 000000000..34b60c0cd
--- /dev/null
+++ b/internal/harness/v2/identity.go
@@ -0,0 +1,215 @@
+package v2
+
+import (
+	"fmt"
+	"strings"
+	"time"
+)
+
+type RuntimeInstanceID string
+type SupervisorBootID string
+type RuntimePoolUID string
+type RuntimeSessionID string
+type RuntimeSessionUID string
+type TaskUID string
+type PromptID string
+type OperationID string
+type PermissionRequestID string
+type WorkspaceDeltaID string
+type ArtifactID string
+type RequestDigest string
+type ProfileDigest string
+
+const (
+	RequestDigestSchemaVersion uint32 = 1
+	ProfileDigestSchemaVersion uint32 = 1
+)
+
+// Fence binds a request to one exact supervisor boot, controller leadership
+// epoch, pool generation, runtime-session generation, and immutable runtime
+// profile. Runtime-session fields are omitted only for pool-wide operations such
+// as drain.
+type Fence struct {
+	RuntimeInstanceID          RuntimeInstanceID `json:"runtimeInstanceID"`
+	SupervisorBootID           SupervisorBootID  `json:"supervisorBootID"`
+	ControllerEpoch            uint64            `json:"controllerEpoch"`
+	RuntimePoolUID             RuntimePoolUID    `json:"runtimePoolUID"`
+	RuntimePoolGeneration      uint64            `json:"runtimePoolGeneration"`
+	RuntimeSessionUID          RuntimeSessionUID `json:"runtimeSessionUID,omitempty"`
+	RuntimeSessionGeneration   uint64            `json:"runtimeSessionGeneration,omitempty"`
+	RuntimeProfileDigest       ProfileDigest     `json:"runtimeProfileDigest"`
+	ProfileDigestSchemaVersion uint32            `json:"profileDigestSchemaVersion"`
+}
+
+func (f Fence) Validate(requireSession bool) error {
+	if err := requireIdentifier("runtime instance ID", string(f.RuntimeInstanceID)); err != nil {
+		return err
+	}
+	if err := requireIdentifier("supervisor boot ID", string(f.SupervisorBootID)); err != nil {
+		return err
+	}
+	if f.ControllerEpoch == 0 {
+		return fmt.Errorf("controller epoch must be positive")
+	}
+	if err := requireIdentifier("runtime pool UID", string(f.RuntimePoolUID)); err != nil {
+		return err
+	}
+	if f.RuntimePoolGeneration == 0 {
+		return fmt.Errorf("runtime pool generation must be positive")
+	}
+	if requireSession {
+		if err := requireIdentifier("runtime session UID", string(f.RuntimeSessionUID)); err != nil {
+			return err
+		}
+		if f.RuntimeSessionGeneration == 0 {
+			return fmt.Errorf("runtime session generation must be positive")
+		}
+	} else if (f.RuntimeSessionUID == "") != (f.RuntimeSessionGeneration == 0) {
+		return fmt.Errorf("runtime session UID and generation must be supplied together")
+	}
+	if err := ValidateProfileDigest(f.RuntimeProfileDigest); err != nil {
+		return fmt.Errorf("runtime profile digest: %w", err)
+	}
+	if f.ProfileDigestSchemaVersion != ProfileDigestSchemaVersion {
+		return fmt.Errorf("profile digest schema version %d is unsupported; want %d", f.ProfileDigestSchemaVersion, ProfileDigestSchemaVersion)
+	}
+	return nil
+}
+
+// MutationMetadata is common to every mutating request. RequestDigest is the
+// digest of the complete request with this field omitted, as produced by
+// CanonicalRequestDigest.
+type MutationMetadata struct {
+	Fence                      Fence         `json:"fence"`
+	TaskUID                    TaskUID       `json:"taskUID,omitempty"`
+	TaskAttempt                uint32        `json:"taskAttempt,omitempty"`
+	PromptID                   PromptID      `json:"promptID,omitempty"`
+	OperationID                OperationID   `json:"operationID"`
+	RequestDigestSchemaVersion uint32        `json:"requestDigestSchemaVersion"`
+	RequestDigest              RequestDigest `json:"requestDigest"`
+	ExpiresAt                  time.Time     `json:"expiresAt"`
+}
+
+type metadataRequirements struct {
+	session bool
+	task    bool
+	prompt  bool
+}
+
+func (m MutationMetadata) ValidateAt(now time.Time) error {
+	return m.validateAt(now, metadataRequirements{})
+}
+
+func (m MutationMetadata) validateAt(now time.Time, req metadataRequirements) error {
+	if err := m.Fence.Validate(req.session); err != nil {
+		return fmt.Errorf("fence: %w", err)
+	}
+	if req.task {
+		if err := requireIdentifier("task UID", string(m.TaskUID)); err != nil {
+			return err
+		}
+		if m.TaskAttempt == 0 {
+			return fmt.Errorf("task attempt must be positive")
+		}
+	} else if (m.TaskUID == "") != (m.TaskAttempt == 0) {
+		return fmt.Errorf("task UID and attempt must be supplied together")
+	}
+	if req.prompt {
+		if !req.task {
+			return fmt.Errorf("internal validation error: prompt metadata requires task metadata")
+		}
+		if err := requireIdentifier("prompt ID", string(m.PromptID)); err != nil {
+			return err
+		}
+	} else if m.PromptID != "" && m.TaskUID == "" {
+		return fmt.Errorf("prompt ID requires task identity")
+	}
+	if err := requireIdentifier("operation ID", string(m.OperationID)); err != nil {
+		return err
+	}
+	if m.RequestDigestSchemaVersion != RequestDigestSchemaVersion {
+		return fmt.Errorf("request digest schema version %d is unsupported; want %d", m.RequestDigestSchemaVersion, RequestDigestSchemaVersion)
+	}
+	if err := ValidateRequestDigest(m.RequestDigest); err != nil {
+		return fmt.Errorf("request digest: %w", err)
+	}
+	if m.ExpiresAt.IsZero() {
+		return fmt.Errorf("request expiry is required")
+	}
+	if now.IsZero() {
+		now = time.Now().UTC()
+	}
+	if !m.ExpiresAt.After(now) {
+		return fmt.Errorf("request expired at %s", m.ExpiresAt.UTC().Format(time.RFC3339Nano))
+	}
+	return nil
+}
+
+func (m MutationMetadata) ValidateDigest(request any) error {
+	got, err := CanonicalRequestDigest(request)
+	if err != nil {
+		return err
+	}
+	if got != m.RequestDigest {
+		return fmt.Errorf("request digest mismatch: got %q, want %q", m.RequestDigest, got)
+	}
+	return nil
+}
+
+type FenceMismatch string
+
+const (
+	FenceMatch                            FenceMismatch = ""
+	FenceMismatchRuntimeInstance          FenceMismatch = "runtime_instance"
+	FenceMismatchSupervisorBoot           FenceMismatch = "supervisor_boot"
+	FenceMismatchControllerEpoch          FenceMismatch = "controller_epoch"
+	FenceMismatchRuntimePoolUID           FenceMismatch = "runtime_pool_uid"
+	FenceMismatchRuntimePoolGeneration    FenceMismatch = "runtime_pool_generation"
+	FenceMismatchRuntimeSessionUID        FenceMismatch = "runtime_session_uid"
+	FenceMismatchRuntimeSessionGeneration FenceMismatch = "runtime_session_generation"
+	FenceMismatchRuntimeProfile           FenceMismatch = "runtime_profile"
+	FenceMismatchProfileSchema            FenceMismatch = "profile_digest_schema"
+)
+
+// CompareFence compares the expected current fence with a request fence. A
+// non-empty result is stale and must be handled as HTTP 410 by the transport.
+func CompareFence(expected, request Fence, requireSession bool) FenceMismatch {
+	switch {
+	case expected.RuntimeInstanceID != request.RuntimeInstanceID:
+		return FenceMismatchRuntimeInstance
+	case expected.SupervisorBootID != request.SupervisorBootID:
+		return FenceMismatchSupervisorBoot
+	case expected.ControllerEpoch != request.ControllerEpoch:
+		return FenceMismatchControllerEpoch
+	case expected.RuntimePoolUID != request.RuntimePoolUID:
+		return FenceMismatchRuntimePoolUID
+	case expected.RuntimePoolGeneration != request.RuntimePoolGeneration:
+		return FenceMismatchRuntimePoolGeneration
+	case requireSession && expected.RuntimeSessionUID != request.RuntimeSessionUID:
+		return FenceMismatchRuntimeSessionUID
+	case requireSession && expected.RuntimeSessionGeneration != request.RuntimeSessionGeneration:
+		return FenceMismatchRuntimeSessionGeneration
+	case expected.RuntimeProfileDigest != request.RuntimeProfileDigest:
+		return FenceMismatchRuntimeProfile
+	case expected.ProfileDigestSchemaVersion != request.ProfileDigestSchemaVersion:
+		return FenceMismatchProfileSchema
+	default:
+		return FenceMatch
+	}
+}
+
+func requireIdentifier(name, value string) error {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return fmt.Errorf("%s is required", name)
+	}
+	if len(value) > maxPathSegmentBytes {
+		return fmt.Errorf("%s exceeds %d bytes", name, maxPathSegmentBytes)
+	}
+	for i := 0; i < len(value); i++ {
+		if value[i] < 0x21 || value[i] > 0x7e {
+			return fmt.Errorf("%s contains whitespace or non-ASCII bytes", name)
+		}
+	}
+	return nil
+}
diff --git a/internal/harness/v2/lifecycle.go b/internal/harness/v2/lifecycle.go
new file mode 100644
index 000000000..0945fca09
--- /dev/null
+++ b/internal/harness/v2/lifecycle.go
@@ -0,0 +1,155 @@
+package v2
+
+import "fmt"
+
+type RuntimeSessionState string
+
+const (
+	RuntimeSessionStateCreating             RuntimeSessionState = "creating"
+	RuntimeSessionStateIdle                 RuntimeSessionState = "idle"
+	RuntimeSessionStatePromptRunning        RuntimeSessionState = "prompt_running"
+	RuntimeSessionStateValidating           RuntimeSessionState = "validating"
+	RuntimeSessionStatePreparingPublication RuntimeSessionState = "preparing_publication"
+	RuntimeSessionStatePublicationPrepared  RuntimeSessionState = "publication_prepared"
+	RuntimeSessionStatePublishing           RuntimeSessionState = "publishing"
+	RuntimeSessionStateVerifying            RuntimeSessionState = "verifying"
+	RuntimeSessionStateFinalizing           RuntimeSessionState = "finalizing"
+	RuntimeSessionStateCancelling           RuntimeSessionState = "cancelling"
+	RuntimeSessionStatePoisoned             RuntimeSessionState = "poisoned"
+	RuntimeSessionStateDeleting             RuntimeSessionState = "deleting"
+	RuntimeSessionStateDeleted              RuntimeSessionState = "deleted"
+)
+
+var runtimeSessionTransitions = map[RuntimeSessionState]map[RuntimeSessionState]struct{}{
+	RuntimeSessionStateCreating: {
+		RuntimeSessionStateIdle:       {},
+		RuntimeSessionStateCancelling: {},
+		RuntimeSessionStatePoisoned:   {},
+	},
+	RuntimeSessionStateIdle: {
+		RuntimeSessionStatePromptRunning: {},
+		RuntimeSessionStatePoisoned:      {},
+		RuntimeSessionStateDeleting:      {},
+	},
+	RuntimeSessionStatePromptRunning: {
+		RuntimeSessionStateValidating: {},
+		RuntimeSessionStateCancelling: {},
+	},
+	RuntimeSessionStateValidating: {
+		RuntimeSessionStateIdle:                 {},
+		RuntimeSessionStatePreparingPublication: {},
+		RuntimeSessionStateCancelling:           {},
+		RuntimeSessionStatePoisoned:             {},
+	},
+	RuntimeSessionStatePreparingPublication: {
+		RuntimeSessionStatePublicationPrepared: {},
+		RuntimeSessionStateCancelling:          {},
+		RuntimeSessionStatePoisoned:            {},
+	},
+	RuntimeSessionStatePublicationPrepared: {
+		RuntimeSessionStatePublishing: {},
+		RuntimeSessionStateFinalizing: {},
+		RuntimeSessionStateCancelling: {},
+		RuntimeSessionStatePoisoned:   {},
+	},
+	RuntimeSessionStatePublishing: {
+		RuntimeSessionStateVerifying: {},
+		RuntimeSessionStatePoisoned:  {},
+	},
+	RuntimeSessionStateVerifying: {
+		RuntimeSessionStatePoisoned: {},
+	},
+	RuntimeSessionStateFinalizing: {
+		RuntimeSessionStatePoisoned: {},
+		RuntimeSessionStateDeleting: {},
+	},
+	RuntimeSessionStateCancelling: {
+		RuntimeSessionStatePoisoned: {},
+	},
+	RuntimeSessionStatePoisoned: {
+		RuntimeSessionStateDeleting: {},
+	},
+	RuntimeSessionStateDeleting: {
+		RuntimeSessionStateDeleted: {},
+	},
+	RuntimeSessionStateDeleted: {},
+}
+
+func IsKnownRuntimeSessionState(state RuntimeSessionState) bool {
+	_, ok := runtimeSessionTransitions[state]
+	return ok
+}
+
+func RuntimeSessionTransitionAllowed(from, to RuntimeSessionState) bool {
+	if from == to && IsKnownRuntimeSessionState(from) {
+		return true
+	}
+	allowed, ok := runtimeSessionTransitions[from]
+	if !ok {
+		return false
+	}
+	_, ok = allowed[to]
+	return ok
+}
+
+func ValidateRuntimeSessionTransition(from, to RuntimeSessionState) error {
+	if !IsKnownRuntimeSessionState(from) {
+		return fmt.Errorf("unsupported runtime session state %q", from)
+	}
+	if !IsKnownRuntimeSessionState(to) {
+		return fmt.Errorf("unsupported runtime session state %q", to)
+	}
+	if !RuntimeSessionTransitionAllowed(from, to) {
+		return fmt.Errorf("runtime session transition %s -> %s is not allowed", from, to)
+	}
+	return nil
+}
+
+func (s RuntimeSessionState) CanAdmitPrompt() bool {
+	return s == RuntimeSessionStateIdle
+}
+
+func (s RuntimeSessionState) CanEvict() bool {
+	return s == RuntimeSessionStateIdle
+}
+
+func (s RuntimeSessionState) AllowsPromptScopedMCP() bool {
+	return s == RuntimeSessionStatePromptRunning
+}
+
+func (s RuntimeSessionState) IsTerminal() bool {
+	return s == RuntimeSessionStateDeleted
+}
+
+func (s RuntimeSessionState) PublicationReconciliationInProgress() bool {
+	switch s {
+	case RuntimeSessionStatePublishing, RuntimeSessionStateVerifying, RuntimeSessionStateFinalizing:
+		return true
+	default:
+		return false
+	}
+}
+
+// DeletionTransition returns the first safe state transition for a deletion
+// request. Publication reconciliation and finalization are never interrupted;
+// callers must finish them before asking again.
+func DeletionTransition(state RuntimeSessionState) (RuntimeSessionState, error) {
+	if !IsKnownRuntimeSessionState(state) {
+		return "", fmt.Errorf("unsupported runtime session state %q", state)
+	}
+	switch state {
+	case RuntimeSessionStateIdle, RuntimeSessionStateFinalizing, RuntimeSessionStatePoisoned:
+		return RuntimeSessionStateDeleting, nil
+	case RuntimeSessionStateCreating, RuntimeSessionStatePromptRunning:
+		return RuntimeSessionStateCancelling, nil
+	case RuntimeSessionStateCancelling:
+		return RuntimeSessionStateCancelling, nil
+	case RuntimeSessionStateValidating, RuntimeSessionStatePreparingPublication,
+		RuntimeSessionStatePublicationPrepared, RuntimeSessionStatePublishing, RuntimeSessionStateVerifying:
+		return state, fmt.Errorf("runtime session state %s is reserved and must finish validation, publication reconciliation, or finalization before deletion", state)
+	case RuntimeSessionStateDeleting, RuntimeSessionStateDeleted:
+		return state, nil
+	default:
+		return "", fmt.Errorf("runtime session state %s has no deletion transition", state)
+	}
+}
diff --git a/internal/harness/v2/mcp.go b/internal/harness/v2/mcp.go
new file mode 100644
index 000000000..eb2eef57f
--- /dev/null
+++ b/internal/harness/v2/mcp.go
@@ -0,0 +1,452 @@
+package v2
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"slices"
+	"strings"
+	"time"
+)
+
+const (
+	MaxMCPTools          = 128
+	MaxMCPArgumentsBytes = 256 << 10
+	MaxMCPResultBytes    = 1 << 20
+
+	MCPBrokerCallPath = "/internal/v2/acp/mcp/tools/call"
+)
+
+type MCPToolSource string
+
+const (
+	MCPToolSourceBrokeredBuiltin MCPToolSource = "brokered_builtin"
+	MCPToolSourceBrokeredCustom  MCPToolSource = "brokered_custom"
+	MCPToolSourceProviderNative  MCPToolSource = "provider_native"
+)
+
+func (s MCPToolSource) Brokered() bool {
+	return s == MCPToolSourceBrokeredBuiltin || s == MCPToolSourceBrokeredCustom
+}
+
+type MCPToolEffect string
+
+const (
+	MCPToolEffectReadOnly      MCPToolEffect = "read_only"
+	MCPToolEffectConsequential MCPToolEffect = "consequential"
+)
+
+type MCPToolDescriptor struct {
+	Name             string          `json:"name"`
+	Description      string          `json:"description,omitempty"`
+	InputSchema      json.RawMessage `json:"inputSchema,omitempty"`
+	Source           MCPToolSource   `json:"source"`
+	Effect           MCPToolEffect   `json:"effect"`
+	DefinitionDigest string          `json:"definitionDigest,omitempty"`
+}
+
+func (d MCPToolDescriptor) Validate() error {
+	if err := requireIdentifier("MCP tool name", d.Name); err != nil {
+		return err
+	}
+	if err := validateBoundedString("MCP tool description", d.Description, d.Source.Brokered(), MaxProtocolStringBytes); err != nil {
+		return err
+	}
+	switch d.Source {
+	case MCPToolSourceBrokeredBuiltin, MCPToolSourceBrokeredCustom, MCPToolSourceProviderNative:
+	default:
+		return fmt.Errorf("unsupported MCP tool source %q", d.Source)
+	}
+	switch d.Effect {
+	case MCPToolEffectReadOnly, MCPToolEffectConsequential:
+	default:
+		return fmt.Errorf("unsupported MCP tool effect %q", d.Effect)
+	}
+	if d.Source == MCPToolSourceBrokeredCustom {
+		if err := validateSHA256Digest(d.DefinitionDigest); err != nil {
+			return fmt.Errorf("custom MCP tool definition digest: %w", err)
+		}
+	} else if d.DefinitionDigest != "" {
+		return fmt.Errorf("only custom MCP tools may carry a definition digest")
+	}
+	if d.Source.Brokered() {
+		if len(d.InputSchema) == 0 {
+			return fmt.Errorf("brokered MCP tool %q requires an input schema", d.Name)
+		}
+		if len(d.InputSchema) > MaxRawConfigBytes {
+			return fmt.Errorf("MCP tool %q input schema exceeds %d bytes", d.Name, MaxRawConfigBytes)
+		}
+		canonical, err := CanonicalJSON(d.InputSchema)
+		if err != nil {
+			return fmt.Errorf("MCP tool %q input schema: %w", d.Name, err)
+		}
+		if len(canonical) == 0 || canonical[0] != '{' {
+			return fmt.Errorf("MCP tool %q input schema must be a JSON object", d.Name)
+		}
+	} else if len(bytes.TrimSpace(d.InputSchema)) != 0 {
+		return fmt.Errorf("provider-native tool %q must not carry an MCP input schema", d.Name)
+	}
+	return nil
+}
+
+type MCPToolPolicy struct {
+	AllowedToolNames    []string            `json:"allowedToolNames"`
+	DisallowedToolNames []string            `json:"disallowedToolNames"`
+	AllowBash           bool                `json:"allowBash"`
+	Tools               []MCPToolDescriptor `json:"tools"`
+	DescriptorDigest    string              `json:"descriptorDigest"`
+}
+
+func (p MCPToolPolicy) Validate() error {
+	if len(p.AllowedToolNames) > MaxMCPTools || len(p.DisallowedToolNames) > MaxMCPTools || len(p.Tools) > MaxMCPTools {
+		return fmt.Errorf("MCP tool policy exceeds %d tools", MaxMCPTools)
+	}
+	if err := validateCanonicalToolNames("allowed MCP tool", p.AllowedToolNames); err != nil {
+		return err
+	}
+	if err := validateCanonicalToolNames("disallowed MCP tool", p.DisallowedToolNames); err != nil {
+		return err
+	}
+	seen := make(map[string]struct{}, len(p.Tools))
+	last := ""
+	for i := range p.Tools {
+		tool := p.Tools[i]
+		if err := tool.Validate(); err != nil {
+			return fmt.Errorf("MCP tool descriptor %d: %w", i, err)
+		}
+		if _, ok := seen[tool.Name]; ok {
+			return fmt.Errorf("duplicate MCP tool descriptor %q", tool.Name)
+		}
+		if last != "" && tool.Name <= last {
+			return fmt.Errorf("MCP tool descriptors must be sorted by name")
+		}
+		if !p.Allows(tool.Name) {
+			return fmt.Errorf("MCP tool descriptor %q is not allowed by the canonical policy", tool.Name)
+		}
+		seen[tool.Name] = struct{}{}
+		last = tool.Name
+	}
+	for _, name := range p.AllowedToolNames {
+		if !p.Allows(name) {
+			continue
+		}
+		if _, ok := seen[name]; !ok {
+			return fmt.Errorf("allowed MCP tool %q has no canonical descriptor", name)
+		}
+	}
+	encoded, err := CanonicalValue(struct {
+		AllowedToolNames    []string            `json:"allowedToolNames"`
+		DisallowedToolNames []string            `json:"disallowedToolNames,omitempty"`
+		AllowBash           bool                `json:"allowBash"`
+		Tools               []MCPToolDescriptor `json:"tools"`
+	}{
+		AllowedToolNames: p.AllowedToolNames, DisallowedToolNames: p.DisallowedToolNames,
+		AllowBash: p.AllowBash, Tools: p.Tools,
+	})
+	if err != nil {
+		return err
+	}
+	if len(encoded) > MaxRawConfigBytes {
+		return fmt.Errorf("MCP tool policy exceeds %d bytes", MaxRawConfigBytes)
+	}
+	digest, err := CanonicalMCPToolDescriptorDigest(p.Tools)
+	if err != nil {
+		return err
+	}
+	if p.DescriptorDigest != digest {
+		return fmt.Errorf("MCP tool descriptor digest does not match canonical descriptors")
+	}
+	return nil
+}
+
+func (p MCPToolPolicy) Allows(name string) bool {
+	if strings.TrimSpace(name) == "" || !slices.Contains(p.AllowedToolNames, name) || slices.Contains(p.DisallowedToolNames, name) {
+		return false
+	}
+	return p.AllowBash || !strings.EqualFold(name, "bash")
+}
+
+func (p MCPToolPolicy) Descriptor(name string) (MCPToolDescriptor, bool) {
+	if !p.Allows(name) {
+		return MCPToolDescriptor{}, false
+	}
+	index, ok := slices.BinarySearchFunc(p.Tools, name, func(tool MCPToolDescriptor, target string) int {
+		return strings.Compare(tool.Name, target)
+	})
+	if !ok {
+		return MCPToolDescriptor{}, false
+	}
+	return p.Tools[index], true
+}
+
+type MCPApprovalPolicy struct {
+	RequiredTools []string `json:"requiredTools,omitempty"`
+}
+
+func (p MCPApprovalPolicy) Validate(toolPolicy MCPToolPolicy) error {
+	if len(p.RequiredTools) > MaxMCPTools {
+		return fmt.Errorf("MCP approval policy exceeds %d tools", MaxMCPTools)
+	}
+	if err := validateCanonicalToolNames("approval-required MCP tool", p.RequiredTools); err != nil {
+		return err
+	}
+	for _, name := range p.RequiredTools {
+		descriptor, ok := toolPolicy.Descriptor(name)
+		if !ok || !descriptor.Source.Brokered() {
+			return fmt.Errorf("approval-required MCP tool %q is not an allowed brokered tool", name)
+		}
+	}
+	return nil
+}
+
+func (p MCPApprovalPolicy) Requires(toolName string) bool {
+	return slices.Contains(p.RequiredTools, toolName)
+}
+
+type MCPPolicyConfiguration struct {
+	ToolPolicyDigest       string            `json:"toolPolicyDigest"`
+	ApprovalPolicyDigest   string            `json:"approvalPolicyDigest"`
+	MCPConfigurationDigest string            `json:"mcpConfigurationDigest"`
+	ToolPolicy             MCPToolPolicy     `json:"toolPolicy"`
+	ApprovalPolicy         MCPApprovalPolicy `json:"approvalPolicy"`
+}
+
+func (c MCPPolicyConfiguration) validate() error {
+	if err := validateSHA256Digest(c.ToolPolicyDigest); err != nil {
+		return fmt.Errorf("tool policy digest: %w", err)
+	}
+	if err := validateSHA256Digest(c.ApprovalPolicyDigest); err != nil {
+		return fmt.Errorf("approval policy digest: %w", err)
+	}
+	if err := validateSHA256Digest(c.MCPConfigurationDigest); err != nil {
+		return fmt.Errorf("MCP configuration digest: %w", err)
+	}
+	if err := c.ToolPolicy.Validate(); err != nil {
+		return fmt.Errorf("MCP tool policy: %w", err)
+	}
+	if err := c.ApprovalPolicy.Validate(c.ToolPolicy); err != nil {
+		return fmt.Errorf("MCP approval policy: %w", err)
+	}
+	toolDigest, err := CanonicalRuntimeToolPolicyDigest(c.ToolPolicy.AllowedToolNames, c.ToolPolicy.DisallowedToolNames, c.ToolPolicy.AllowBash)
+	if err != nil || toolDigest != c.ToolPolicyDigest {
+		return fmt.Errorf("tool policy digest does not match embedded canonical policy")
+	}
+	approvalDigest, err := CanonicalMCPApprovalPolicyDigest(c.ApprovalPolicy)
+	if err != nil || approvalDigest != c.ApprovalPolicyDigest {
+		return fmt.Errorf("approval policy digest does not match embedded canonical policy")
+	}
+	mcpDigest, err := CanonicalMCPConfigurationDigest(c.ToolPolicy.AllowedToolNames)
+	if err != nil || mcpDigest != c.MCPConfigurationDigest {
+		return fmt.Errorf("MCP configuration digest does not match embedded canonical policy")
+	}
+	return nil
+}
+
+func (c MCPPolicyConfiguration) ValidateProfile(profile RuntimeProfile) error {
+	if err := c.validate(); err != nil {
+		return err
+	}
+	if c.ToolPolicyDigest != profile.ToolPolicyDigest ||
+		c.ApprovalPolicyDigest != profile.ApprovalPolicyDigest ||
+		c.MCPConfigurationDigest != profile.MCPConfigurationDigest {
+		return fmt.Errorf("MCP policy configuration does not match runtime profile")
+	}
+	return nil
+}
+
+func (c MCPPolicyConfiguration) Matches(other MCPPolicyConfiguration) bool {
+	if c.ToolPolicyDigest != other.ToolPolicyDigest || c.ApprovalPolicyDigest != other.ApprovalPolicyDigest ||
+		c.MCPConfigurationDigest != other.MCPConfigurationDigest ||
+		c.ToolPolicy.DescriptorDigest != other.ToolPolicy.DescriptorDigest {
+		return false
+	}
+	left, leftErr := CanonicalValue(c)
+	right, rightErr := CanonicalValue(other)
+	return leftErr == nil && rightErr == nil && bytes.Equal(left, right)
+}
+
+type MCPApprovalEvidence struct {
+	PermissionRequestID PermissionRequestID `json:"permissionRequestID"`
+	ToolCallID          string              `json:"toolCallID"`
+	ToolName            string              `json:"toolName"`
+	GrantedAt           time.Time           `json:"grantedAt"`
+	ExpiresAt           time.Time           `json:"expiresAt"`
+	Reusable            bool                `json:"reusable,omitempty"`
+}
+
+func (e MCPApprovalEvidence) ValidateFor(toolName string, now time.Time) error {
+	if err := requireIdentifier("MCP approval permission request ID", string(e.PermissionRequestID)); err != nil {
+		return err
+	}
+	if err := requireIdentifier("MCP approval tool call ID", e.ToolCallID); err != nil {
+		return err
+	}
+	if e.ToolName != toolName {
+		return fmt.Errorf("MCP approval evidence tool %q does not match call tool %q", e.ToolName, toolName)
+	}
+	if err := validateTimestamp("MCP approval grant timestamp", e.GrantedAt); err != nil {
+		return err
+	}
+	if err := validateTimestamp("MCP approval expiry", e.ExpiresAt); err != nil {
+		return err
+	}
+	if now.IsZero() {
+		now = time.Now().UTC()
+	}
+	if !e.ExpiresAt.After(now) || e.ExpiresAt.Before(e.GrantedAt) {
+		return fmt.Errorf("MCP approval evidence is expired or invalid")
+	}
+	return nil
+}
+
+func CanonicalRuntimeToolPolicyDigest(allowed, disallowed []string, allowBash bool) (string, error) {
+	return canonicalACPDomainDigest("tool-policy", map[string]any{
+		"allowed": allowed, "disallowed": disallowed, "allowBash": allowBash,
+	})
+}
+
+func CanonicalMCPApprovalPolicyDigest(policy MCPApprovalPolicy) (string, error) {
+	return canonicalACPDomainDigest("approval-policy", map[string]any{"requiredTools": policy.RequiredTools})
+}
+
+func CanonicalMCPConfigurationDigest(allowed []string) (string, error) {
+	return canonicalACPDomainDigest("mcp-configuration", map[string]any{"brokeredTools": allowed, "promptScoped": true})
+}
+
+func CanonicalMCPToolDescriptorDigest(tools []MCPToolDescriptor) (string, error) {
+	return canonicalACPDomainDigest("mcp-tool-descriptors", tools)
+}
+
+func canonicalACPDomainDigest(domain string, value any) (string, error) {
+	canonical, err := CanonicalValue(value)
+	if err != nil {
+		return "", err
+	}
+	hash := sha256.New()
+	_, _ = io.WriteString(hash, "orka.acp."+domain)
+	_, _ = hash.Write([]byte{0})
+	_, _ = hash.Write(canonical)
+	return "sha256:" + hex.EncodeToString(hash.Sum(nil)), nil
+}
+
+func validateCanonicalToolNames(label string, names []string) error {
+	last := ""
+	for _, name := range names {
+		if err := requireIdentifier(label, name); err != nil {
+			return err
+		}
+		if last != "" && name <= last {
+			return fmt.Errorf("%s names must be unique and sorted", label)
+		}
+		last = name
+	}
+	return nil
+}
+
+type MCPToolCall struct {
+	CallID    string               `json:"callID"`
+	ToolName  string               `json:"toolName"`
+	Arguments json.RawMessage      `json:"arguments"`
+	Approval  *MCPApprovalEvidence `json:"approval,omitempty"`
+}
+
+func (c MCPToolCall) ValidateAt(auth PromptMCPAuthorization, now time.Time) (MCPToolDescriptor, error) {
+	if err := requireIdentifier("MCP call ID", c.CallID); err != nil {
+		return MCPToolDescriptor{}, err
+	}
+	if err := requireIdentifier("MCP call tool name", c.ToolName); err != nil {
+		return MCPToolDescriptor{}, err
+	}
+	if len(c.Arguments) == 0 || len(c.Arguments) > MaxMCPArgumentsBytes {
+		return MCPToolDescriptor{}, fmt.Errorf("MCP call arguments must be a JSON object no larger than %d bytes", MaxMCPArgumentsBytes)
+	}
+	canonical, err := CanonicalJSON(c.Arguments)
+	if err != nil || len(canonical) == 0 || canonical[0] != '{' {
+		return MCPToolDescriptor{}, fmt.Errorf("MCP call arguments must be a canonicalizable JSON object")
+	}
+	descriptor, ok := auth.ToolPolicy.Descriptor(c.ToolName)
+	if !ok || !descriptor.Source.Brokered() {
+		return MCPToolDescriptor{}, fmt.Errorf("MCP tool %q is not an allowed brokered tool", c.ToolName)
+	}
+	if auth.ApprovalPolicy.Requires(c.ToolName) {
+		if c.Approval == nil {
+			return MCPToolDescriptor{}, fmt.Errorf("MCP tool %q requires approval", c.ToolName)
+		}
+		if err := c.Approval.ValidateFor(c.ToolName, now); err != nil {
+			return MCPToolDescriptor{}, err
+		}
+	} else if c.Approval != nil {
+		return MCPToolDescriptor{}, fmt.Errorf("MCP tool %q must not carry unexpected approval evidence", c.ToolName)
+	}
+	return descriptor, nil
+}
+
+type MCPBrokerCallRequest struct {
+	Protocol      string                 `json:"protocol"`
+	Namespace     string                 `json:"namespace"`
+	SessionState  RuntimeSessionState    `json:"sessionState"`
+	Metadata      MutationMetadata       `json:"metadata"`
+	Lease         PromptLease            `json:"lease"`
+	Authorization PromptMCPAuthorization `json:"authorization"`
+	Call          MCPToolCall            `json:"call"`
+}
+
+func (r MCPBrokerCallRequest) ValidateAt(now time.Time) (MCPToolDescriptor, error) {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return MCPToolDescriptor{}, err
+	}
+	if err := requireIdentifier("MCP broker namespace", r.Namespace); err != nil {
+		return MCPToolDescriptor{}, err
+	}
+	if r.SessionState != RuntimeSessionStatePromptRunning {
+		return MCPToolDescriptor{}, fmt.Errorf("MCP broker calls require prompt_running session state")
+	}
+	if err := r.Metadata.validateAt(now, metadataRequirements{session: true, task: true, prompt: true}); err != nil {
+		return MCPToolDescriptor{}, fmt.Errorf("metadata: %w", err)
+	}
+	if err := r.Lease.ValidateAt(now, 0, 0); err != nil {
+		return MCPToolDescriptor{}, fmt.Errorf("prompt lease: %w", err)
+	}
+	if err := r.Authorization.ValidateForAt(r.Metadata, r.Lease, now); err != nil {
+		return MCPToolDescriptor{}, err
+	}
+	if !r.Authorization.AuthorizedAt(r.SessionState, r.Lease, now) {
+		return MCPToolDescriptor{}, fmt.Errorf("prompt-scoped MCP authorization is not active")
+	}
+	if r.Metadata.ExpiresAt.After(r.Authorization.ExpiresAt) || r.Metadata.ExpiresAt.After(r.Lease.ExpiresAt) {
+		return MCPToolDescriptor{}, fmt.Errorf("MCP broker operation expiry must not outlive prompt authority")
+	}
+	descriptor, err := r.Call.ValidateAt(r.Authorization, now)
+	if err != nil {
+		return MCPToolDescriptor{}, err
+	}
+	if err := r.Metadata.ValidateDigest(r); err != nil {
+		return MCPToolDescriptor{}, err
+	}
+	return descriptor, nil
+}
+
+type MCPBrokerCallResponse struct {
+	Protocol string          `json:"protocol"`
+	CallID   string          `json:"callID"`
+	Result   json.RawMessage `json:"result"`
+	IsError  bool            `json:"isError,omitempty"`
+	Replayed bool            `json:"replayed,omitempty"`
+}
+
+func (r MCPBrokerCallResponse) Validate() error {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return err
+	}
+	if err := requireIdentifier("MCP response call ID", r.CallID); err != nil {
+		return err
+	}
+	if len(r.Result) == 0 || len(r.Result) > MaxMCPResultBytes {
+		return fmt.Errorf("MCP response result must be valid JSON no larger than %d bytes", MaxMCPResultBytes)
+	}
+	_, err := CanonicalJSON(r.Result)
+	return err
+}
diff --git a/internal/harness/v2/mcp_test.go b/internal/harness/v2/mcp_test.go
new file mode 100644
index 000000000..03113f99e
--- /dev/null
+++ b/internal/harness/v2/mcp_test.go
@@ -0,0 +1,164 @@
+package v2
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestPromptMCPAuthorizationEnforcesCanonicalDescriptorsAndProfile(t *testing.T) {
+	metadata := testMutationMetadata(t, true)
+	lease := PromptLease{Generation: 3, IssuedAt: testNow, ExpiresAt: testNow.Add(2 * time.Minute)}
+	authorization := testMCPAuthorizationWithTools(t, metadata, lease)
+	if err := authorization.ValidateForAt(metadata, lease, testNow.Add(time.Second)); err != nil {
+		t.Fatalf("ValidateForAt() error = %v", err)
+	}
+	profile := testRuntimeProfile()
+	profile.ToolPolicyDigest = authorization.ToolPolicyDigest
+	profile.ApprovalPolicyDigest = authorization.ApprovalPolicyDigest
+	profile.MCPConfigurationDigest = authorization.MCPConfigurationDigest
+	if err := authorization.ValidateProfile(profile); err != nil {
+		t.Fatalf("ValidateProfile() error = %v", err)
+	}
+
+	tampered := authorization
+	tampered.ToolPolicy.Tools = append([]MCPToolDescriptor(nil), authorization.ToolPolicy.Tools...)
+	tampered.ToolPolicy.Tools[0].Description = "tampered"
+	if err := tampered.ValidateForAt(metadata, lease, testNow.Add(time.Second)); err == nil ||
+		!strings.Contains(err.Error(), "descriptor digest") {
+		t.Fatalf("tampered descriptor validation error = %v", err)
+	}
+
+	tamperedAllowlist := authorization
+	tamperedAllowlist.ToolPolicy.AllowBash = false
+	if err := tamperedAllowlist.ValidateForAt(metadata, lease, testNow.Add(time.Second)); err == nil ||
+		!strings.Contains(err.Error(), "tool policy digest") {
+		t.Fatalf("tampered allowlist validation error = %v", err)
+	}
+
+	tamperedApproval := authorization
+	tamperedApproval.ApprovalPolicy.RequiredTools = nil
+	if err := tamperedApproval.ValidateForAt(metadata, lease, testNow.Add(time.Second)); err == nil ||
+		!strings.Contains(err.Error(), "approval policy digest") {
+		t.Fatalf("tampered approval validation error = %v", err)
+	}
+
+	staleProfile := profile
+	staleProfile.ToolPolicyDigest = testSHA256("stale-tool-policy")
+	if err := authorization.ValidateProfile(staleProfile); err == nil {
+		t.Fatal("authorization unexpectedly matched a stale runtime profile")
+	}
+}
+
+func TestMCPBrokerCallRequiresRunningLeaseAllowlistAndApproval(t *testing.T) {
+	metadata := testMutationMetadata(t, true)
+	metadata.OperationID = "mcp-call-1"
+	metadata.ExpiresAt = testNow.Add(30 * time.Second)
+	lease := PromptLease{Generation: 3, IssuedAt: testNow, ExpiresAt: testNow.Add(2 * time.Minute)}
+	authorization := testMCPAuthorizationWithTools(t, metadata, lease)
+	request := MCPBrokerCallRequest{
+		Protocol: ProtocolVersion, Namespace: "default", SessionState: RuntimeSessionStatePromptRunning,
+		Metadata: metadata, Lease: lease, Authorization: authorization,
+		Call: MCPToolCall{CallID: "call-1", ToolName: "mutate", Arguments: json.RawMessage(`{"value":"x"}`)},
+	}
+	sealRequest(t, request, &request.Metadata.RequestDigest)
+	if _, err := request.ValidateAt(testNow.Add(time.Second)); err == nil || !strings.Contains(err.Error(), "requires approval") {
+		t.Fatalf("missing approval validation error = %v", err)
+	}
+
+	request.Call.Approval = &MCPApprovalEvidence{
+		PermissionRequestID: "permission-1", ToolCallID: "provider-tool-call-1", ToolName: "mutate",
+		GrantedAt: testNow, ExpiresAt: testNow.Add(time.Minute),
+	}
+	sealRequest(t, request, &request.Metadata.RequestDigest)
+	descriptor, err := request.ValidateAt(testNow.Add(time.Second))
+	if err != nil {
+		t.Fatalf("ValidateAt() error = %v", err)
+	}
+	if descriptor.Effect != MCPToolEffectConsequential {
+		t.Fatalf("descriptor effect = %q", descriptor.Effect)
+	}
+
+	idle := request
+	idle.SessionState = RuntimeSessionStateIdle
+	sealRequest(t, idle, &idle.Metadata.RequestDigest)
+	if _, err := idle.ValidateAt(testNow.Add(time.Second)); err == nil || !strings.Contains(err.Error(), "prompt_running") {
+		t.Fatalf("idle call validation error = %v", err)
+	}
+
+	disallowed := request
+	disallowed.Call.ToolName = "not-allowed"
+	disallowed.Call.Approval = nil
+	sealRequest(t, disallowed, &disallowed.Metadata.RequestDigest)
+	if _, err := disallowed.ValidateAt(testNow.Add(time.Second)); err == nil || !strings.Contains(err.Error(), "not an allowed brokered tool") {
+		t.Fatalf("disallowed call validation error = %v", err)
+	}
+
+	expired := request
+	expired.Authorization.ExpiresAt = testNow
+	sealRequest(t, expired, &expired.Metadata.RequestDigest)
+	if _, err := expired.ValidateAt(testNow.Add(time.Second)); err == nil || !strings.Contains(err.Error(), "expired") {
+		t.Fatalf("expired call validation error = %v", err)
+	}
+}
+
+func TestMCPToolPolicyRequiresSortedCompleteDescriptors(t *testing.T) {
+	policy := testMCPAuthorizationWithTools(t, testMutationMetadata(t, true), PromptLease{
+		Generation: 3, IssuedAt: testNow, ExpiresAt: testNow.Add(time.Minute),
+	}).ToolPolicy
+	if err := policy.Validate(); err != nil {
+		t.Fatalf("Validate() error = %v", err)
+	}
+
+	missing := policy
+	missing.Tools = missing.Tools[:1]
+	missing.DescriptorDigest, _ = CanonicalMCPToolDescriptorDigest(missing.Tools)
+	if err := missing.Validate(); err == nil || !strings.Contains(err.Error(), "has no canonical descriptor") {
+		t.Fatalf("missing descriptor validation error = %v", err)
+	}
+
+	unsorted := policy
+	unsorted.Tools = append([]MCPToolDescriptor(nil), policy.Tools...)
+	unsorted.Tools[0], unsorted.Tools[1] = unsorted.Tools[1], unsorted.Tools[0]
+	unsorted.DescriptorDigest, _ = CanonicalMCPToolDescriptorDigest(unsorted.Tools)
+	if err := unsorted.Validate(); err == nil || !strings.Contains(err.Error(), "sorted") {
+		t.Fatalf("unsorted descriptor validation error = %v", err)
+	}
+}
+
+func testMCPAuthorizationWithTools(t *testing.T, metadata MutationMetadata, lease PromptLease) PromptMCPAuthorization {
+	t.Helper()
+	descriptors := []MCPToolDescriptor{
+		{Name: "lookup", Description: "Read data", InputSchema: json.RawMessage(`{"type":"object"}`), Source: MCPToolSourceBrokeredBuiltin, Effect: MCPToolEffectReadOnly},
+		{Name: "mutate", Description: "Change data", InputSchema: json.RawMessage(`{"type":"object","properties":{"value":{"type":"string"}}}`), Source: MCPToolSourceBrokeredCustom, Effect: MCPToolEffectConsequential, DefinitionDigest: testSHA256("mutate-definition")},
+	}
+	descriptorDigest, err := CanonicalMCPToolDescriptorDigest(descriptors)
+	if err != nil {
+		t.Fatal(err)
+	}
+	toolPolicy := MCPToolPolicy{
+		AllowedToolNames: []string{"lookup", "mutate"}, AllowBash: true,
+		Tools: descriptors, DescriptorDigest: descriptorDigest,
+	}
+	approvalPolicy := MCPApprovalPolicy{RequiredTools: []string{"mutate"}}
+	toolDigest, err := CanonicalRuntimeToolPolicyDigest(toolPolicy.AllowedToolNames, toolPolicy.DisallowedToolNames, toolPolicy.AllowBash)
+	if err != nil {
+		t.Fatal(err)
+	}
+	approvalDigest, err := CanonicalMCPApprovalPolicyDigest(approvalPolicy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	mcpDigest, err := CanonicalMCPConfigurationDigest(toolPolicy.AllowedToolNames)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return PromptMCPAuthorization{
+		RuntimeSessionUID: metadata.Fence.RuntimeSessionUID, SessionGeneration: metadata.Fence.RuntimeSessionGeneration,
+		TaskUID: metadata.TaskUID, TaskAttempt: metadata.TaskAttempt, PromptID: metadata.PromptID,
+		LeaseGeneration: lease.Generation, ToolPolicyDigest: toolDigest,
+		ApprovalPolicyDigest: approvalDigest, MCPConfigurationDigest: mcpDigest,
+		ToolPolicy: toolPolicy, ApprovalPolicy: approvalPolicy, ExpiresAt: testNow.Add(time.Minute),
+	}
+}
diff --git a/internal/harness/v2/model_limits_test.go b/internal/harness/v2/model_limits_test.go
new file mode 100644
index 000000000..5056db08f
--- /dev/null
+++ b/internal/harness/v2/model_limits_test.go
@@ -0,0 +1,74 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package v2
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+)
+
+func TestRuntimeProfileValidatesOptionalModelLimits(t *testing.T) {
+	profile := testRuntimeProfile()
+	profile.ProviderKind = "opencode"
+	profile.Model = "openai/test-model"
+	profile.AdapterDigests = map[string]string{"opencode": testSHA256("adapter")}
+	profile.ProxyCredentialScope = "model:openai/test-model"
+
+	if err := profile.Validate(); err != nil {
+		t.Fatalf("Validate() error = %v, want external profile compatibility without limits", err)
+	}
+	profile.ModelLimits = &ModelTokenLimits{Context: 4096, Output: 4096}
+	if err := profile.Validate(); err == nil || !strings.Contains(err.Error(), "must exceed") {
+		t.Fatalf("Validate() error = %v, want inverted limits rejection", err)
+	}
+	profile.ModelLimits = &ModelTokenLimits{Context: 32768, Output: 4096}
+	if err := profile.Validate(); err != nil {
+		t.Fatalf("Validate() error = %v, want valid OpenCode profile", err)
+	}
+}
+
+func TestCanonicalProfileDigestIncludesOptionalModelLimits(t *testing.T) {
+	profile := testRuntimeProfile()
+	withoutLimits, err := CanonicalProfileDigest(profile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	canonical, err := CanonicalValue(profile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if bytes.Contains(canonical, []byte("modelLimits")) {
+		t.Fatalf("nil model limits changed existing profile canonical form: %s", canonical)
+	}
+
+	profile.ModelLimits = &ModelTokenLimits{Context: 32768, Output: 4096}
+	withLimits, err := CanonicalProfileDigest(profile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if withLimits == withoutLimits {
+		t.Fatal("profile digest did not change when model limits were added")
+	}
+	profile.ModelLimits.Context++
+	changedContext, err := CanonicalProfileDigest(profile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if changedContext == withLimits {
+		t.Fatal("profile digest did not change with model context limit")
+	}
+	profile.ModelLimits.Context--
+	profile.ModelLimits.Output++
+	changedOutput, err := CanonicalProfileDigest(profile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if changedOutput == withLimits {
+		t.Fatal("profile digest did not change with model output limit")
+	}
+}
diff --git a/internal/harness/v2/ndjson.go b/internal/harness/v2/ndjson.go
new file mode 100644
index 000000000..969067c82
--- /dev/null
+++ b/internal/harness/v2/ndjson.go
@@ -0,0 +1,369 @@
+package v2
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"time"
+)
+
+const (
+	DefaultMaxEventLineBytes        = 512 << 10
+	DefaultMaxTerminalResultBytes   = 256 << 10
+	DefaultMaxBufferedEvents        = 256
+	DefaultMaxUpdateEventsPerSecond = 100
+	// DefaultMaxUpdateBytesPerSecond is a fixed orka.harness.v2 protocol
+	// invariant applied to each event stream; it is not a negotiated
+	// ProtocolLimits value. The exported name is retained for compatibility.
+	DefaultMaxUpdateBytesPerSecond = 32 << 20
+
+	absoluteMaxEventLineBytes   = MaxCanonicalJSONBytes
+	absoluteMaxBufferedEvents   = 16_384
+	absoluteMaxUpdatesPerSecond = 10_000
+)
+
+var (
+	ErrEventLineTooLarge     = errors.New("event line too large")
+	ErrMalformedEvent        = errors.New("malformed event")
+	ErrEventIdentityMismatch = errors.New("event identity mismatch")
+	ErrEventSequence         = errors.New("invalid event sequence")
+	ErrEventRateExceeded     = errors.New("event update rate exceeded")
+	ErrEventByteRateExceeded = errors.New("event update byte rate exceeded")
+	ErrEventAfterTerminal    = errors.New("event after terminal")
+	ErrMissingAcceptedEvent  = errors.New("missing accepted event")
+	ErrMissingTerminalEvent  = errors.New("missing terminal event")
+	ErrBufferedEventOverflow = errors.New("buffered event limit exceeded")
+)
+
+type EventStreamLimits struct {
+	MaxLineBytes             int `json:"maxLineBytes"`
+	MaxTerminalResultBytes   int `json:"maxTerminalResultBytes"`
+	MaxBufferedEvents        int `json:"maxBufferedEvents"`
+	MaxUpdateEventsPerSecond int `json:"maxUpdateEventsPerSecond"`
+}
+
+func DefaultEventStreamLimits() EventStreamLimits {
+	return EventStreamLimits{
+		MaxLineBytes:             DefaultMaxEventLineBytes,
+		MaxTerminalResultBytes:   DefaultMaxTerminalResultBytes,
+		MaxBufferedEvents:        DefaultMaxBufferedEvents,
+		MaxUpdateEventsPerSecond: DefaultMaxUpdateEventsPerSecond,
+	}
+}
+
+func (l EventStreamLimits) Validate() error {
+	if l.MaxLineBytes <= 0 || l.MaxLineBytes > absoluteMaxEventLineBytes {
+		return fmt.Errorf("max event line bytes must be in range 1..%d", absoluteMaxEventLineBytes)
+	}
+	if l.MaxTerminalResultBytes <= 0 || l.MaxTerminalResultBytes > l.MaxLineBytes {
+		return fmt.Errorf("max terminal result bytes must be positive and no greater than max line bytes")
+	}
+	if l.MaxBufferedEvents <= 0 || l.MaxBufferedEvents > absoluteMaxBufferedEvents {
+		return fmt.Errorf("max buffered events must be in range 1..%d", absoluteMaxBufferedEvents)
+	}
+	if l.MaxUpdateEventsPerSecond <= 0 || l.MaxUpdateEventsPerSecond > absoluteMaxUpdatesPerSecond {
+		return fmt.Errorf("max update events per second must be in range 1..%d", absoluteMaxUpdatesPerSecond)
+	}
+	return nil
+}
+
+type EventStreamValidator struct {
+	limits               EventStreamLimits
+	expectation          EventExpectation
+	accepted             bool
+	terminal             bool
+	lastSequence         uint64
+	lastTimestamp        time.Time
+	updateWindow         time.Time
+	updatesInWindow      int
+	updateBytesInWindow  int
+	maxUpdateBytesPerSec int
+}
+
+func NewEventStreamValidator(limits EventStreamLimits, expectation EventExpectation) (*EventStreamValidator, error) {
+	if err := limits.Validate(); err != nil {
+		return nil, err
+	}
+	if err := expectation.Validate(); err != nil {
+		return nil, fmt.Errorf("event expectation: %w", err)
+	}
+	return &EventStreamValidator{limits: limits, expectation: expectation, maxUpdateBytesPerSec: DefaultMaxUpdateBytesPerSecond}, nil
+}
+
+func (v *EventStreamValidator) ValidateNext(event Event, arrival time.Time) error {
+	return v.validateNext(event, arrival, -1)
+}
+
+// validateNext validates an event and, when encodedUpdateBytes is non-negative,
+// charges that exact encoded line size for update-byte accounting. Direct
+// ValidateNext callers retain the previous behavior of charging the event's
+// compact JSON encoding.
+func (v *EventStreamValidator) validateNext(event Event, arrival time.Time, encodedUpdateBytes int) error {
+	if v == nil {
+		return fmt.Errorf("event stream validator is required")
+	}
+	if v.terminal {
+		return ErrEventAfterTerminal
+	}
+	if err := event.Validate(v.limits); err != nil {
+		return fmt.Errorf("%w: %v", ErrMalformedEvent, err)
+	}
+	if err := v.expectation.Matches(event.Identity); err != nil {
+		return fmt.Errorf("%w: %v", ErrEventIdentityMismatch, err)
+	}
+	if !v.accepted {
+		if event.Type != EventAccepted {
+			return fmt.Errorf("%w: first event is %q", ErrMissingAcceptedEvent, event.Type)
+		}
+		if event.Identity.Sequence != 1 {
+			return fmt.Errorf("%w: accepted event sequence is %d, want 1", ErrEventSequence, event.Identity.Sequence)
+		}
+		v.accepted = true
+	} else {
+		if event.Type == EventAccepted {
+			return fmt.Errorf("%w: duplicate accepted event", ErrMalformedEvent)
+		}
+		if event.Identity.Sequence <= v.lastSequence {
+			return fmt.Errorf("%w: sequence %d is not greater than %d", ErrEventSequence, event.Identity.Sequence, v.lastSequence)
+		}
+		if event.Identity.Timestamp.Before(v.lastTimestamp) {
+			return fmt.Errorf("%w: timestamp moved backwards", ErrEventSequence)
+		}
+	}
+	if event.Type == EventUpdate {
+		if arrival.IsZero() {
+			arrival = time.Now().UTC()
+		}
+		if v.updateWindow.IsZero() || arrival.Before(v.updateWindow) || arrival.Sub(v.updateWindow) >= time.Second {
+			v.updateWindow = arrival
+			v.updatesInWindow = 0
+			v.updateBytesInWindow = 0
+		}
+		v.updatesInWindow++
+		if v.updatesInWindow > v.limits.MaxUpdateEventsPerSecond {
+			return fmt.Errorf("%w: received %d updates in one second, limit %d", ErrEventRateExceeded, v.updatesInWindow, v.limits.MaxUpdateEventsPerSecond)
+		}
+		if encodedUpdateBytes < 0 {
+			encoded, err := json.Marshal(event)
+			if err != nil {
+				return fmt.Errorf("%w: marshal update event: %v", ErrMalformedEvent, err)
+			}
+			encodedUpdateBytes = len(encoded)
+		}
+		v.updateBytesInWindow += encodedUpdateBytes
+		if v.updateBytesInWindow > v.maxUpdateBytesPerSec {
+			return fmt.Errorf("%w: received %d update bytes in one second, limit %d", ErrEventByteRateExceeded, v.updateBytesInWindow, v.maxUpdateBytesPerSec)
+		}
+	}
+	v.lastSequence = event.Identity.Sequence
+	v.lastTimestamp = event.Identity.Timestamp
+	if event.Type.IsTerminal() {
+		v.terminal = true
+	}
+	return nil
+}
+
+func (v *EventStreamValidator) Finish() error {
+	if v == nil {
+		return fmt.Errorf("event stream validator is required")
+	}
+	if !v.accepted {
+		return ErrMissingAcceptedEvent
+	}
+	if !v.terminal {
+		return ErrMissingTerminalEvent
+	}
+	return nil
+}
+
+func (v *EventStreamValidator) TerminalSeen() bool {
+	return v != nil && v.terminal
+}
+
+type EventDecoder struct {
+	reader    *bufio.Reader
+	limits    EventStreamLimits
+	validator *EventStreamValidator
+}
+
+func NewEventDecoder(reader io.Reader, limits EventStreamLimits, expectation EventExpectation) (*EventDecoder, error) {
+	if reader == nil {
+		return nil, fmt.Errorf("event reader is required")
+	}
+	validator, err := NewEventStreamValidator(limits, expectation)
+	if err != nil {
+		return nil, err
+	}
+	return &EventDecoder{
+		reader:    bufio.NewReaderSize(reader, limits.MaxLineBytes+2),
+		limits:    limits,
+		validator: validator,
+	}, nil
+}
+
+func (d *EventDecoder) Decode() (Event, error) {
+	if d == nil || d.reader == nil || d.validator == nil {
+		return Event{}, fmt.Errorf("event decoder is not initialized")
+	}
+	line, err := readBoundedNDJSONLine(d.reader, d.limits.MaxLineBytes)
+	if err != nil {
+		return Event{}, err
+	}
+	if _, err := parseCanonicalJSON(line); err != nil {
+		return Event{}, fmt.Errorf("%w: %v", ErrMalformedEvent, err)
+	}
+	dec := json.NewDecoder(bytes.NewReader(line))
+	dec.DisallowUnknownFields()
+	var event Event
+	if err := dec.Decode(&event); err != nil {
+		return Event{}, fmt.Errorf("%w: decode event: %v", ErrMalformedEvent, err)
+	}
+	if err := ensureJSONEOF(dec); err != nil {
+		return Event{}, fmt.Errorf("%w: %v", ErrMalformedEvent, err)
+	}
+	if err := d.validator.validateNext(event, time.Now().UTC(), len(line)); err != nil {
+		return Event{}, err
+	}
+	return event, nil
+}
+
+// DecodeAll reads a complete finite event stream. Because this helper buffers,
+// it enforces MaxBufferedEvents. Streaming callers should use Decode and persist
+// or process each event before reading the next one.
+func (d *EventDecoder) DecodeAll() ([]Event, error) {
+	if d == nil {
+		return nil, fmt.Errorf("event decoder is required")
+	}
+	events := make([]Event, 0, min(d.limits.MaxBufferedEvents, 16))
+	for {
+		event, err := d.Decode()
+		if errors.Is(err, io.EOF) {
+			break
+		}
+		if err != nil {
+			return nil, err
+		}
+		if len(events) == d.limits.MaxBufferedEvents {
+			return nil, fmt.Errorf("%w: limit %d", ErrBufferedEventOverflow, d.limits.MaxBufferedEvents)
+		}
+		events = append(events, event)
+	}
+	if err := d.validator.Finish(); err != nil {
+		return nil, err
+	}
+	return events, nil
+}
+
+type EventEncoder struct {
+	writer    io.Writer
+	limits    EventStreamLimits
+	validator *EventStreamValidator
+}
+
+func NewEventEncoder(writer io.Writer, limits EventStreamLimits, expectation EventExpectation) (*EventEncoder, error) {
+	if writer == nil {
+		return nil, fmt.Errorf("event writer is required")
+	}
+	validator, err := NewEventStreamValidator(limits, expectation)
+	if err != nil {
+		return nil, err
+	}
+	return &EventEncoder{writer: writer, limits: limits, validator: validator}, nil
+}
+
+func (e *EventEncoder) Encode(event Event) error {
+	if e == nil || e.writer == nil || e.validator == nil {
+		return fmt.Errorf("event encoder is not initialized")
+	}
+	line, err := json.Marshal(event)
+	if err != nil {
+		return fmt.Errorf("marshal event: %w", err)
+	}
+	if len(line) > e.limits.MaxLineBytes {
+		return fmt.Errorf("%w: encoded line is %d bytes, limit %d", ErrEventLineTooLarge, len(line), e.limits.MaxLineBytes)
+	}
+	if err := e.validator.validateNext(event, time.Now().UTC(), len(line)); err != nil {
+		return err
+	}
+	line = append(line, '\n')
+	if err := writeAll(e.writer, line); err != nil {
+		return fmt.Errorf("write event: %w", err)
+	}
+	return nil
+}
+
+func (e *EventEncoder) Close() error {
+	if e == nil || e.validator == nil {
+		return fmt.Errorf("event encoder is not initialized")
+	}
+	return e.validator.Finish()
+}
+
+func readBoundedNDJSONLine(reader *bufio.Reader, maxBytes int) ([]byte, error) {
+	line, err := reader.ReadSlice('\n')
+	if errors.Is(err, bufio.ErrBufferFull) {
+		return nil, fmt.Errorf("%w: limit %d", ErrEventLineTooLarge, maxBytes)
+	}
+	if err != nil && !errors.Is(err, io.EOF) {
+		return nil, fmt.Errorf("read event line: %w", err)
+	}
+	if errors.Is(err, io.EOF) && len(line) == 0 {
+		return nil, io.EOF
+	}
+	if len(line) > 0 && line[len(line)-1] == '\n' {
+		line = line[:len(line)-1]
+	}
+	if len(line) > 0 && line[len(line)-1] == '\r' {
+		line = line[:len(line)-1]
+	}
+	if len(line) == 0 {
+		return nil, fmt.Errorf("%w: blank NDJSON line", ErrMalformedEvent)
+	}
+	if len(line) > maxBytes {
+		return nil, fmt.Errorf("%w: line is %d bytes, limit %d", ErrEventLineTooLarge, len(line), maxBytes)
+	}
+	return line, nil
+}
+
+func writeAll(writer io.Writer, data []byte) error {
+	for len(data) > 0 {
+		n, err := writer.Write(data)
+		if err != nil {
+			return err
+		}
+		if n <= 0 || n > len(data) {
+			return io.ErrShortWrite
+		}
+		data = data[n:]
+	}
+	return nil
+}
+
+// IsPoisoningStreamError reports protocol/limit violations that require the
+// RuntimeSession to be poisoned rather than reused. Ordinary EOF is not a
+// poisoning error; a missing terminal discovered by Finish is.
+func IsPoisoningStreamError(err error) bool {
+	if err == nil || errors.Is(err, io.EOF) {
+		return false
+	}
+	for _, target := range []error{
+		ErrEventLineTooLarge,
+		ErrMalformedEvent,
+		ErrEventIdentityMismatch,
+		ErrEventSequence,
+		ErrEventRateExceeded,
+		ErrEventByteRateExceeded,
+		ErrEventAfterTerminal,
+		ErrMissingAcceptedEvent,
+		ErrMissingTerminalEvent,
+		ErrBufferedEventOverflow,
+	} {
+		if errors.Is(err, target) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/harness/v2/ndjson_test.go b/internal/harness/v2/ndjson_test.go
new file mode 100644
index 000000000..610edeb38
--- /dev/null
+++ b/internal/harness/v2/ndjson_test.go
@@ -0,0 +1,291 @@
+package v2
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+)
+
+func testUpdateEvent(t *testing.T, sequence uint64, timestamp time.Time, text string) Event {
+	t.Helper()
+	return Event{
+		Protocol: ProtocolVersion,
+		Type:     EventUpdate,
+		Identity: testEventIdentity(t, sequence, timestamp),
+		Update: &UpdateEvent{
+			Kind:             UpdateAssistantMessageChunk,
+			AssistantMessage: &AssistantMessageChunk{Text: text},
+		},
+	}
+}
+
+func testPermissionEvent(t *testing.T, sequence uint64, timestamp time.Time) Event {
+	t.Helper()
+	return Event{
+		Protocol: ProtocolVersion,
+		Type:     EventPermissionRequested,
+		Identity: testEventIdentity(t, sequence, timestamp),
+		PermissionRequested: &PermissionRequestedEvent{
+			RequestID:  "permission-1",
+			ToolCallID: "tool-1",
+			Title:      "Allow write?",
+			Options: []PermissionOption{
+				{OptionID: "allow-once", Name: "Allow once", Kind: PermissionOptionAllowOnce},
+				{OptionID: "reject-once", Name: "Reject once", Kind: PermissionOptionRejectOnce},
+			},
+			ExpiresAt: timestamp.Add(time.Minute),
+		},
+	}
+}
+
+func TestBoundedNDJSONRoundTrip(t *testing.T) {
+	limits := DefaultEventStreamLimits()
+	expectation := testExpectation(t)
+	var stream bytes.Buffer
+	encoder, err := NewEventEncoder(&stream, limits, expectation)
+	if err != nil {
+		t.Fatalf("NewEventEncoder() error = %v", err)
+	}
+	events := []Event{
+		testAcceptedEvent(t),
+		testUpdateEvent(t, 2, testNow.Add(time.Millisecond), "working"),
+		testPermissionEvent(t, 3, testNow.Add(2*time.Millisecond)),
+		testCompletedEvent(t, 4, testNow.Add(3*time.Millisecond)),
+	}
+	for i := range events {
+		if err := encoder.Encode(events[i]); err != nil {
+			t.Fatalf("Encode(%d) error = %v", i, err)
+		}
+	}
+	if err := encoder.Close(); err != nil {
+		t.Fatalf("EventEncoder.Close() error = %v", err)
+	}
+	if got := bytes.Count(stream.Bytes(), []byte{'\n'}); got != len(events) {
+		t.Fatalf("NDJSON newline count = %d, want %d", got, len(events))
+	}
+
+	decoder, err := NewEventDecoder(bytes.NewReader(stream.Bytes()), limits, expectation)
+	if err != nil {
+		t.Fatalf("NewEventDecoder() error = %v", err)
+	}
+	decoded, err := decoder.DecodeAll()
+	if err != nil {
+		t.Fatalf("DecodeAll() error = %v", err)
+	}
+	if len(decoded) != len(events) || decoded[0].Type != EventAccepted || decoded[len(decoded)-1].Type != EventCompleted {
+		t.Fatalf("decoded events = %#v", decoded)
+	}
+}
+
+func TestNDJSONDecoderRejectsUnknownFieldsDuplicateKeysAndBlankLines(t *testing.T) {
+	limits := DefaultEventStreamLimits()
+	expectation := testExpectation(t)
+	acceptedJSON, err := json.Marshal(testAcceptedEvent(t))
+	if err != nil {
+		t.Fatalf("marshal accepted event: %v", err)
+	}
+
+	inputs := map[string][]byte{
+		"unknown field": append(append([]byte{}, acceptedJSON[:len(acceptedJSON)-1]...), append([]byte(`,"unexpected":true}`), '\n')...),
+		"duplicate key": append([]byte(`{"protocol":"orka.harness.v2",`), append(acceptedJSON[1:], '\n')...),
+		"blank line":    []byte("\n"),
+	}
+	for name, input := range inputs {
+		t.Run(name, func(t *testing.T) {
+			decoder, err := NewEventDecoder(bytes.NewReader(input), limits, expectation)
+			if err != nil {
+				t.Fatalf("NewEventDecoder() error = %v", err)
+			}
+			if _, err := decoder.Decode(); err == nil || !errors.Is(err, ErrMalformedEvent) {
+				t.Fatalf("Decode() error = %v, want ErrMalformedEvent", err)
+			} else if !IsPoisoningStreamError(err) {
+				t.Fatalf("IsPoisoningStreamError(%v) = false", err)
+			}
+		})
+	}
+}
+
+func TestNDJSONLineAndTerminalPayloadBounds(t *testing.T) {
+	limits := EventStreamLimits{
+		MaxLineBytes:             1024,
+		MaxTerminalResultBytes:   512,
+		MaxBufferedEvents:        16,
+		MaxUpdateEventsPerSecond: 10,
+	}
+	decoder, err := NewEventDecoder(strings.NewReader(strings.Repeat("x", 1025)+"\n"), limits, testExpectation(t))
+	if err != nil {
+		t.Fatalf("NewEventDecoder() error = %v", err)
+	}
+	if _, err := decoder.Decode(); err == nil || !errors.Is(err, ErrEventLineTooLarge) {
+		t.Fatalf("Decode(oversized) error = %v", err)
+	}
+
+	limits.MaxLineBytes = 4096
+	limits.MaxTerminalResultBytes = 100
+	var stream bytes.Buffer
+	encoder, err := NewEventEncoder(&stream, limits, testExpectation(t))
+	if err != nil {
+		t.Fatalf("NewEventEncoder() error = %v", err)
+	}
+	if err := encoder.Encode(testAcceptedEvent(t)); err != nil {
+		t.Fatalf("Encode(accepted) error = %v", err)
+	}
+	terminal := testCompletedEvent(t, 2, testNow.Add(time.Second))
+	terminal.Completed.Result.Content[0].Text = strings.Repeat("x", 512)
+	if err := encoder.Encode(terminal); err == nil || !strings.Contains(err.Error(), "terminal payload") {
+		t.Fatalf("Encode(oversized terminal) error = %v", err)
+	}
+}
+
+func TestEventStreamRejectsLateTrafficSequenceRegressionAndIdentitySwap(t *testing.T) {
+	limits := DefaultEventStreamLimits()
+	validator, err := NewEventStreamValidator(limits, testExpectation(t))
+	if err != nil {
+		t.Fatalf("NewEventStreamValidator() error = %v", err)
+	}
+	if err := validator.ValidateNext(testAcceptedEvent(t), testNow); err != nil {
+		t.Fatalf("accepted validation error = %v", err)
+	}
+	if err := validator.ValidateNext(testCompletedEvent(t, 2, testNow.Add(time.Second)), testNow); err != nil {
+		t.Fatalf("terminal validation error = %v", err)
+	}
+	if err := validator.ValidateNext(testUpdateEvent(t, 3, testNow.Add(2*time.Second), "late"), testNow); !errors.Is(err, ErrEventAfterTerminal) {
+		t.Fatalf("late event error = %v, want ErrEventAfterTerminal", err)
+	}
+
+	validator, _ = NewEventStreamValidator(limits, testExpectation(t))
+	_ = validator.ValidateNext(testAcceptedEvent(t), testNow)
+	if err := validator.ValidateNext(testUpdateEvent(t, 1, testNow.Add(time.Second), "regressed"), testNow); !errors.Is(err, ErrEventSequence) {
+		t.Fatalf("sequence regression error = %v", err)
+	}
+
+	validator, _ = NewEventStreamValidator(limits, testExpectation(t))
+	badIdentity := testAcceptedEvent(t)
+	badIdentity.Identity.RuntimeInstanceID = "other-instance"
+	if err := validator.ValidateNext(badIdentity, testNow); !errors.Is(err, ErrEventIdentityMismatch) {
+		t.Fatalf("identity mismatch error = %v", err)
+	}
+}
+
+func TestEventStreamRequiresAcceptedAndExactlyOneTerminal(t *testing.T) {
+	limits := DefaultEventStreamLimits()
+	expectation := testExpectation(t)
+
+	validator, _ := NewEventStreamValidator(limits, expectation)
+	if err := validator.ValidateNext(testUpdateEvent(t, 1, testNow, "no acceptance"), testNow); !errors.Is(err, ErrMissingAcceptedEvent) {
+		t.Fatalf("first update error = %v", err)
+	}
+
+	var stream bytes.Buffer
+	encoder, _ := NewEventEncoder(&stream, limits, expectation)
+	if err := encoder.Encode(testAcceptedEvent(t)); err != nil {
+		t.Fatalf("Encode(accepted) error = %v", err)
+	}
+	decoder, _ := NewEventDecoder(bytes.NewReader(stream.Bytes()), limits, expectation)
+	if _, err := decoder.DecodeAll(); !errors.Is(err, ErrMissingTerminalEvent) {
+		t.Fatalf("DecodeAll(missing terminal) error = %v", err)
+	}
+}
+
+func TestEventUpdateRateAndBufferedEventLimits(t *testing.T) {
+	limits := DefaultEventStreamLimits()
+	limits.MaxUpdateEventsPerSecond = 2
+	validator, _ := NewEventStreamValidator(limits, testExpectation(t))
+	if err := validator.ValidateNext(testAcceptedEvent(t), testNow); err != nil {
+		t.Fatalf("accepted validation error = %v", err)
+	}
+	for sequence := uint64(2); sequence <= 3; sequence++ {
+		if err := validator.ValidateNext(testUpdateEvent(t, sequence, testNow.Add(time.Duration(sequence)*time.Millisecond), "update"), testNow); err != nil {
+			t.Fatalf("update %d validation error = %v", sequence, err)
+		}
+	}
+	if err := validator.ValidateNext(testUpdateEvent(t, 4, testNow.Add(4*time.Millisecond), "overflow"), testNow); !errors.Is(err, ErrEventRateExceeded) {
+		t.Fatalf("rate overflow error = %v", err)
+	}
+
+	limits = DefaultEventStreamLimits()
+	validator, _ = NewEventStreamValidator(limits, testExpectation(t))
+	validator.maxUpdateBytesPerSec = 1
+	if err := validator.ValidateNext(testAcceptedEvent(t), testNow); err != nil {
+		t.Fatalf("accepted validation error = %v", err)
+	}
+	if err := validator.ValidateNext(testUpdateEvent(t, 2, testNow.Add(time.Millisecond), "bounded"), testNow); !errors.Is(err, ErrEventByteRateExceeded) {
+		t.Fatalf("byte-rate overflow error = %v, want ErrEventByteRateExceeded", err)
+	} else if !IsPoisoningStreamError(err) {
+		t.Fatalf("byte-rate overflow was not poisoning: %v", err)
+	}
+
+	limits = DefaultEventStreamLimits()
+	limits.MaxBufferedEvents = 2
+	var stream bytes.Buffer
+	encoder, _ := NewEventEncoder(&stream, limits, testExpectation(t))
+	for _, event := range []Event{
+		testAcceptedEvent(t),
+		testUpdateEvent(t, 2, testNow.Add(time.Millisecond), "update"),
+		testCompletedEvent(t, 3, testNow.Add(2*time.Millisecond)),
+	} {
+		if err := encoder.Encode(event); err != nil {
+			t.Fatalf("Encode() error = %v", err)
+		}
+	}
+	decoder, _ := NewEventDecoder(bytes.NewReader(stream.Bytes()), limits, testExpectation(t))
+	if _, err := decoder.DecodeAll(); !errors.Is(err, ErrBufferedEventOverflow) {
+		t.Fatalf("DecodeAll(buffer overflow) error = %v", err)
+	}
+}
+
+func TestNDJSONDecoderChargesActualUpdateLineBytes(t *testing.T) {
+	limits := DefaultEventStreamLimits()
+	expectation := testExpectation(t)
+	acceptedJSON, err := json.Marshal(testAcceptedEvent(t))
+	if err != nil {
+		t.Fatalf("marshal accepted event: %v", err)
+	}
+	updateJSON, err := json.Marshal(testUpdateEvent(t, 2, testNow.Add(time.Millisecond), "bounded"))
+	if err != nil {
+		t.Fatalf("marshal update event: %v", err)
+	}
+	paddedUpdate := append(bytes.Repeat([]byte{' '}, 64), updateJSON...)
+	if len(paddedUpdate) <= len(updateJSON) {
+		t.Fatalf("padded update size = %d, want greater than compact size %d", len(paddedUpdate), len(updateJSON))
+	}
+	stream := append(append(append([]byte{}, acceptedJSON...), '\n'), paddedUpdate...)
+	stream = append(stream, '\n')
+	decoder, err := NewEventDecoder(bytes.NewReader(stream), limits, expectation)
+	if err != nil {
+		t.Fatalf("NewEventDecoder() error = %v", err)
+	}
+	decoder.validator.maxUpdateBytesPerSec = len(updateJSON)
+	if _, err := decoder.Decode(); err != nil {
+		t.Fatalf("Decode(accepted) error = %v", err)
+	}
+	if _, err := decoder.Decode(); !errors.Is(err, ErrEventByteRateExceeded) {
+		t.Fatalf("Decode(padded update) error = %v, want ErrEventByteRateExceeded", err)
+	} else if !IsPoisoningStreamError(err) {
+		t.Fatalf("padded update byte-rate overflow was not poisoning: %v", err)
+	}
+}
+
+func TestOutcomeUnknownEventIsTerminalAndNonRetryable(t *testing.T) {
+	event := Event{
+		Protocol: ProtocolVersion,
+		Type:     EventOutcomeUnknown,
+		Identity: testEventIdentity(t, 2, testNow.Add(time.Second)),
+		OutcomeUnknown: &OutcomeUnknownEvent{
+			Code:              "settlement_unproven",
+			Message:           "provider may have accepted the prompt",
+			ForcedTermination: true,
+		},
+	}
+	limits := DefaultEventStreamLimits()
+	if err := event.Validate(limits); err != nil {
+		t.Fatalf("outcome unknown event validation error = %v", err)
+	}
+	event.OutcomeUnknown.Retryable = true
+	if err := event.Validate(limits); err == nil || !strings.Contains(err.Error(), "never") {
+		t.Fatalf("retryable outcome unknown validation = %v", err)
+	}
+}
diff --git a/internal/harness/v2/paths.go b/internal/harness/v2/paths.go
new file mode 100644
index 000000000..5627ffd96
--- /dev/null
+++ b/internal/harness/v2/paths.go
@@ -0,0 +1,122 @@
+package v2
+
+import (
+	"fmt"
+	"net/url"
+	"strings"
+)
+
+const (
+	ProtocolVersion = "orka.harness.v2"
+	ACPProfileV1    = "acp.v1"
+	NDJSONMediaType = "application/x-ndjson"
+
+	HealthPath          = "/v2/health"
+	CapabilitiesPath    = "/v2/capabilities"
+	StatusPath          = "/v2/status"
+	DrainPath           = "/v2/drain"
+	RuntimeSessionsPath = "/v2/runtime-sessions"
+
+	RuntimeSessionPathTemplate                        = "/v2/runtime-sessions/{sessionID}"
+	RuntimeSessionPublicationFinalizationPathTemplate = "/v2/runtime-sessions/{sessionID}/publication-finalization"
+	PromptPathTemplate                                = "/v2/runtime-sessions/{sessionID}/prompts/{promptID}"
+	PromptLeasePathTemplate                           = "/v2/runtime-sessions/{sessionID}/prompts/{promptID}/lease"
+	PromptPermissionPathTemplate                      = "/v2/runtime-sessions/{sessionID}/prompts/{promptID}/permissions/{requestID}"
+	PromptCancelPathTemplate                          = "/v2/runtime-sessions/{sessionID}/prompts/{promptID}/cancel"
+	WorkspaceDeltaPathTemplate                        = "/v2/runtime-sessions/{sessionID}/workspace-deltas/{deltaID}"
+)
+
+const maxPathSegmentBytes = 253
+
+// PathSegment validates and escapes an opaque path identifier. Restricting the
+// accepted alphabet avoids router-dependent handling of encoded slashes,
+// traversal segments, control bytes, and Unicode normalization differences.
+func PathSegment(name, value string) (string, error) {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return "", fmt.Errorf("%s is required", name)
+	}
+	if len(value) > maxPathSegmentBytes {
+		return "", fmt.Errorf("%s exceeds %d bytes", name, maxPathSegmentBytes)
+	}
+	for i := 0; i < len(value); i++ {
+		c := value[i]
+		if (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') ||
+			(c >= '0' && c <= '9') || c == '-' || c == '_' || c == '.' || c == '~' {
+			continue
+		}
+		return "", fmt.Errorf("%s contains unsupported path byte 0x%02x", name, c)
+	}
+	if value == "." || value == ".." {
+		return "", fmt.Errorf("%s must not be a traversal segment", name)
+	}
+	return url.PathEscape(value), nil
+}
+
+func RuntimeSessionPath(sessionID RuntimeSessionID) (string, error) {
+	session, err := PathSegment("runtime session ID", string(sessionID))
+	if err != nil {
+		return "", err
+	}
+	return RuntimeSessionsPath + "/" + session, nil
+}
+
+func RuntimeSessionPublicationFinalizationPath(sessionID RuntimeSessionID) (string, error) {
+	sessionPath, err := RuntimeSessionPath(sessionID)
+	if err != nil {
+		return "", err
+	}
+	return sessionPath + "/publication-finalization", nil
+}
+
+func PromptPath(sessionID RuntimeSessionID, promptID PromptID) (string, error) {
+	sessionPath, err := RuntimeSessionPath(sessionID)
+	if err != nil {
+		return "", err
+	}
+	prompt, err := PathSegment("prompt ID", string(promptID))
+	if err != nil {
+		return "", err
+	}
+	return sessionPath + "/prompts/" + prompt, nil
+}
+
+func PromptLeasePath(sessionID RuntimeSessionID, promptID PromptID) (string, error) {
+	path, err := PromptPath(sessionID, promptID)
+	if err != nil {
+		return "", err
+	}
+	return path + "/lease", nil
+}
+
+func PromptPermissionPath(sessionID RuntimeSessionID, promptID PromptID, requestID PermissionRequestID) (string, error) {
+	path, err := PromptPath(sessionID, promptID)
+	if err != nil {
+		return "", err
+	}
+	request, err := PathSegment("permission request ID", string(requestID))
+	if err != nil {
+		return "", err
+	}
+	return path + "/permissions/" + request, nil
+}
+
+func PromptCancelPath(sessionID RuntimeSessionID, promptID PromptID) (string, error) {
+	path, err := PromptPath(sessionID, promptID)
+	if err != nil {
+		return "", err
+	}
+	return path + "/cancel", nil
+}
+
+func WorkspaceDeltaPath(sessionID RuntimeSessionID, deltaID WorkspaceDeltaID) (string, error) {
+	sessionPath, err := RuntimeSessionPath(sessionID)
+	if err != nil {
+		return "", err
+	}
+	delta, err := PathSegment("workspace delta ID", string(deltaID))
+	if err != nil {
+		return "", err
+	}
+	return sessionPath + "/workspace-deltas/" + delta, nil
+}
diff --git a/internal/harness/v2/paths_digest_test.go b/internal/harness/v2/paths_digest_test.go
new file mode 100644
index 000000000..8ed32dd6d
--- /dev/null
+++ b/internal/harness/v2/paths_digest_test.go
@@ -0,0 +1,269 @@
+package v2
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestV2PathsAndHostileSegments(t *testing.T) {
+	path, err := PromptPermissionPath("session-1", "prompt-1", "permission-1")
+	if err != nil {
+		t.Fatalf("PromptPermissionPath() error = %v", err)
+	}
+	if path != "/v2/runtime-sessions/session-1/prompts/prompt-1/permissions/permission-1" {
+		t.Fatalf("PromptPermissionPath() = %q", path)
+	}
+	publicationFinalizationPath, err := RuntimeSessionPublicationFinalizationPath("session-1")
+	if err != nil {
+		t.Fatalf("RuntimeSessionPublicationFinalizationPath() error = %v", err)
+	}
+	if publicationFinalizationPath != "/v2/runtime-sessions/session-1/publication-finalization" {
+		t.Fatalf("RuntimeSessionPublicationFinalizationPath() = %q", publicationFinalizationPath)
+	}
+	if RuntimeSessionPublicationFinalizationPathTemplate != "/v2/runtime-sessions/{sessionID}/publication-finalization" {
+		t.Fatalf("RuntimeSessionPublicationFinalizationPathTemplate = %q", RuntimeSessionPublicationFinalizationPathTemplate)
+	}
+
+	for _, value := range []string{"../escape", "a/b", "..", "a%2fb", "line\nbreak", "snowman-☃"} {
+		t.Run(value, func(t *testing.T) {
+			if _, err := RuntimeSessionPath(RuntimeSessionID(value)); err == nil {
+				t.Fatalf("RuntimeSessionPath(%q) error = nil, want rejection", value)
+			}
+		})
+	}
+}
+
+func TestCanonicalJSONNormalizesOrderingWhitespaceAndNumbers(t *testing.T) {
+	left, err := CanonicalJSON([]byte(` { "z": 1.0, "a": [1e1, -0] } `))
+	if err != nil {
+		t.Fatalf("CanonicalJSON(left) error = %v", err)
+	}
+	right, err := CanonicalJSON([]byte(`{"a":[10,0],"z":1}`))
+	if err != nil {
+		t.Fatalf("CanonicalJSON(right) error = %v", err)
+	}
+	if !bytes.Equal(left, right) {
+		t.Fatalf("canonical forms differ:\n%s\n%s", left, right)
+	}
+	if string(left) != `{"a":[10,0],"z":1}` {
+		t.Fatalf("canonical form = %s", left)
+	}
+}
+
+func TestCanonicalRequestDigestIsDeterministicAndExcludesDigestField(t *testing.T) {
+	left := []byte(`{
+		"value": 1.0,
+		"metadata": {"requestDigest":"first", "requestDigestSchemaVersion":1, "operationID":"op"}
+	}`)
+	right := []byte(`{"metadata":{"operationID":"op","requestDigestSchemaVersion":1,"requestDigest":"second"},"value":1}`)
+	leftDigest, err := CanonicalRequestDigestJSON(left)
+	if err != nil {
+		t.Fatalf("CanonicalRequestDigestJSON(left) error = %v", err)
+	}
+	rightDigest, err := CanonicalRequestDigestJSON(right)
+	if err != nil {
+		t.Fatalf("CanonicalRequestDigestJSON(right) error = %v", err)
+	}
+	if leftDigest != rightDigest {
+		t.Fatalf("equivalent request digests differ: %s != %s", leftDigest, rightDigest)
+	}
+	if err := ValidateRequestDigest(leftDigest); err != nil {
+		t.Fatalf("ValidateRequestDigest() error = %v", err)
+	}
+
+	changed, err := CanonicalRequestDigestJSON([]byte(`{"metadata":{"operationID":"other","requestDigestSchemaVersion":1,"requestDigest":""},"value":1}`))
+	if err != nil {
+		t.Fatalf("CanonicalRequestDigestJSON(changed) error = %v", err)
+	}
+	if changed == leftDigest {
+		t.Fatal("request digest did not change with operation identity")
+	}
+}
+
+func TestCanonicalJSONRejectsAmbiguousOrHostileInput(t *testing.T) {
+	tests := map[string][]byte{
+		"duplicate key": []byte(`{"a":1,"a":2}`),
+		"trailing data": []byte(`{} {}`),
+		"invalid UTF-8": {'{', '"', 'x', '"', ':', '"', 0xff, '"', '}'},
+		"huge exponent": []byte(`{"n":1e1000000}`),
+	}
+	for name, input := range tests {
+		t.Run(name, func(t *testing.T) {
+			if _, err := CanonicalJSON(input); err == nil {
+				t.Fatalf("CanonicalJSON(%q) error = nil, want rejection", input)
+			}
+		})
+	}
+
+	deep := strings.Repeat("[", maxCanonicalJSONDepth+2) + "0" + strings.Repeat("]", maxCanonicalJSONDepth+2)
+	if _, err := CanonicalJSON([]byte(deep)); err == nil || !strings.Contains(err.Error(), "depth") {
+		t.Fatalf("CanonicalJSON(deep) error = %v, want depth error", err)
+	}
+}
+
+func TestCanonicalRequestDigestRequiresObjectMetadataAndStringDigest(t *testing.T) {
+	for name, input := range map[string]string{
+		"array":            `[]`,
+		"missing metadata": `{}`,
+		"missing digest":   `{"metadata":{}}`,
+		"wrong type":       `{"metadata":{"requestDigest":{}}}`,
+		"duplicate digest": `{"metadata":{"requestDigest":"a","requestDigest":"b"}}`,
+	} {
+		t.Run(name, func(t *testing.T) {
+			if _, err := CanonicalRequestDigestJSON([]byte(input)); err == nil {
+				t.Fatalf("CanonicalRequestDigestJSON(%s) error = nil, want rejection", input)
+			}
+		})
+	}
+}
+
+func TestCanonicalProfileDigestChangesWithPolicy(t *testing.T) {
+	profile := testRuntimeProfile()
+	first, err := CanonicalProfileDigest(profile)
+	if err != nil {
+		t.Fatalf("CanonicalProfileDigest() error = %v", err)
+	}
+	profile.ToolPolicyDigest = testSHA256("different-policy")
+	second, err := CanonicalProfileDigest(profile)
+	if err != nil {
+		t.Fatalf("CanonicalProfileDigest(changed) error = %v", err)
+	}
+	if first == second {
+		t.Fatal("profile digest did not change with tool policy")
+	}
+}
+
+func TestProfileDigestSchemaRemainsV1(t *testing.T) {
+	if ProfileDigestDomain != "orka.harness.v2.profile.v1" {
+		t.Fatalf("ProfileDigestDomain = %q, want v1 domain", ProfileDigestDomain)
+	}
+	if ProfileDigestSchemaVersion != 1 {
+		t.Fatalf("ProfileDigestSchemaVersion = %d, want 1", ProfileDigestSchemaVersion)
+	}
+}
+
+const alternateTestModel = "other-model"
+
+func TestCanonicalAgentConfigurationDigestBindsAllFields(t *testing.T) {
+	base := testAgentSessionConfiguration()
+	baseDigest, err := CanonicalAgentConfigurationDigest(base)
+	if err != nil {
+		t.Fatalf("CanonicalAgentConfigurationDigest(base) error = %v", err)
+	}
+	repeated, err := CanonicalAgentConfigurationDigest(base)
+	if err != nil {
+		t.Fatalf("CanonicalAgentConfigurationDigest(repeated) error = %v", err)
+	}
+	if repeated != baseDigest {
+		t.Fatalf("canonical Agent configuration digest is not deterministic: %q != %q", repeated, baseDigest)
+	}
+
+	for name, mutate := range map[string]func(*AgentSessionConfiguration){
+		"agent UID":        func(configuration *AgentSessionConfiguration) { configuration.AgentUID = "agent-uid-2" },
+		"agent generation": func(configuration *AgentSessionConfiguration) { configuration.AgentGeneration++ },
+		"provider": func(configuration *AgentSessionConfiguration) {
+			configuration.ProviderKind = providerKindClaude
+		},
+		"model":            func(configuration *AgentSessionConfiguration) { configuration.Model = alternateTestModel },
+		"max turns":        func(configuration *AgentSessionConfiguration) { configuration.MaxTurns++ },
+		"reasoning effort": func(configuration *AgentSessionConfiguration) { configuration.ReasoningEffort = reasoningEffortMedium },
+		"system prompt":    func(configuration *AgentSessionConfiguration) { configuration.SystemPrompt += " Be exact." },
+	} {
+		t.Run(name, func(t *testing.T) {
+			changed := base
+			mutate(&changed)
+			digest, err := CanonicalAgentConfigurationDigest(changed)
+			if err != nil {
+				t.Fatalf("CanonicalAgentConfigurationDigest(changed) error = %v", err)
+			}
+			if digest == baseDigest {
+				t.Fatalf("Agent configuration digest did not change with %s", name)
+			}
+		})
+	}
+}
+
+func TestCanonicalPromptSettlementDigest(t *testing.T) {
+	settlement := PromptSettlement{TerminalEvent: EventCompleted, Outcome: PromptOutcomeSucceeded, StopReason: ACPStopReasonEndTurn, SettledAt: testNow}
+	first, err := CanonicalPromptSettlementDigest(settlement)
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := CanonicalPromptSettlementDigest(settlement)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if first != second || first == "" {
+		t.Fatalf("settlement digest mismatch: %q %q", first, second)
+	}
+	settlement.SettledAt = settlement.SettledAt.Add(time.Second)
+	changed, err := CanonicalPromptSettlementDigest(settlement)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if changed == first {
+		t.Fatal("settlement digest did not change")
+	}
+}
+
+func TestCanonicalRequestDigestKeepsAgentConfigurationWireCompatible(t *testing.T) {
+	withoutConfiguration := []byte(`{"protocol":"orka.harness.v2","metadata":{"requestDigest":"sha256:placeholder"},"runtimeSessionID":"session"}`)
+	withConfiguration := []byte(`{"protocol":"orka.harness.v2","metadata":{"requestDigest":"sha256:placeholder"},"runtimeSessionID":"session","agentConfiguration":{"agentUID":"agent","agentGeneration":1,"providerKind":"codex","model":"model","maxTurns":5}}`)
+	oldDigest, err := CanonicalRequestDigestJSON(withoutConfiguration)
+	if err != nil {
+		t.Fatal(err)
+	}
+	newDigest, err := CanonicalRequestDigestJSON(withConfiguration)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if oldDigest != newDigest {
+		t.Fatalf("agentConfiguration changed v1 request digest: old=%q new=%q", oldDigest, newDigest)
+	}
+}
+
+func TestAgentSessionConfigurationAcceptsLegacyDigestOnlyForLegacyFields(t *testing.T) {
+	configuration := AgentSessionConfiguration{
+		AgentUID: "agent-uid", AgentGeneration: 3, ProviderKind: providerKindCodex,
+		Model: "model", MaxTurns: 12,
+	}
+	legacyDigest, err := CanonicalLegacyAgentConfigurationDigest(configuration, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	profile := testRuntimeProfile()
+	profile.ProviderKind = configuration.ProviderKind
+	profile.Model = configuration.Model
+	profile.AgentConfigurationDigest = legacyDigest
+	if err := configuration.ValidateProfileOrLegacy(profile, false); err != nil {
+		t.Fatalf("legacy configuration rejected: %v", err)
+	}
+	configuration.SystemPrompt = "new unbound instructions"
+	if err := configuration.ValidateProfileOrLegacy(profile, false); err == nil {
+		t.Fatal("legacy digest accepted an unbound system prompt")
+	}
+}
+
+func TestLegacyAgentConfigurationCannotBypassProviderOrModelFence(t *testing.T) {
+	configuration := AgentSessionConfiguration{
+		AgentUID: "agent-uid", AgentGeneration: 1, ProviderKind: providerKindCodex,
+		Model: "model", MaxTurns: 5,
+	}
+	legacyDigest, err := CanonicalLegacyAgentConfigurationDigest(configuration, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	profile := testRuntimeProfile()
+	profile.AgentConfigurationDigest = legacyDigest
+	profile.ProviderKind = providerKindClaude
+	if err := configuration.ValidateProfileOrLegacy(profile, true); err == nil || !strings.Contains(err.Error(), "provider kind") {
+		t.Fatalf("legacy provider mismatch error = %v", err)
+	}
+	profile.ProviderKind = configuration.ProviderKind
+	profile.Model = alternateTestModel
+	if err := configuration.ValidateProfileOrLegacy(profile, true); err == nil || !strings.Contains(err.Error(), "model") {
+		t.Fatalf("legacy model mismatch error = %v", err)
+	}
+}
diff --git a/internal/harness/v2/prompt.go b/internal/harness/v2/prompt.go
new file mode 100644
index 000000000..8cae2b541
--- /dev/null
+++ b/internal/harness/v2/prompt.go
@@ -0,0 +1,600 @@
+package v2
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/url"
+	"strings"
+	"time"
+)
+
+type ContentBlockType string
+
+const (
+	ContentBlockText         ContentBlockType = "text"
+	ContentBlockResourceLink ContentBlockType = "resource_link"
+	ContentBlockArtifactRef  ContentBlockType = "artifact_ref"
+)
+
+type ContentBlock struct {
+	Type     ContentBlockType   `json:"type"`
+	Text     string             `json:"text,omitempty"`
+	URI      string             `json:"uri,omitempty"`
+	Name     string             `json:"name,omitempty"`
+	MimeType string             `json:"mimeType,omitempty"`
+	Artifact *ArtifactReference `json:"artifact,omitempty"`
+}
+
+func (b ContentBlock) Validate() error {
+	switch b.Type {
+	case ContentBlockText:
+		if err := validateBoundedString("content text", b.Text, true, MaxPromptContentBytes); err != nil {
+			return err
+		}
+		if b.URI != "" || b.Artifact != nil {
+			return fmt.Errorf("text content must not carry URI or artifact")
+		}
+	case ContentBlockResourceLink:
+		if err := validateBoundedString("resource URI", b.URI, true, 4096); err != nil {
+			return err
+		}
+		parsed, err := url.Parse(b.URI)
+		if err != nil || !parsed.IsAbs() || parsed.User != nil {
+			return fmt.Errorf("resource URI must be absolute and must not contain userinfo")
+		}
+		if b.Text != "" || b.Artifact != nil {
+			return fmt.Errorf("resource link must not carry text or artifact")
+		}
+	case ContentBlockArtifactRef:
+		if b.Artifact == nil {
+			return fmt.Errorf("artifact content requires artifact reference")
+		}
+		if err := b.Artifact.Validate(); err != nil {
+			return err
+		}
+		if b.Text != "" || b.URI != "" {
+			return fmt.Errorf("artifact content must not carry text or URI")
+		}
+	default:
+		return fmt.Errorf("unsupported content block type %q", b.Type)
+	}
+	if err := validateBoundedString("content name", b.Name, false, 1024); err != nil {
+		return err
+	}
+	return validateBoundedString("content MIME type", b.MimeType, false, 256)
+}
+
+type PromptInput struct {
+	Content  []ContentBlock    `json:"content"`
+	Metadata map[string]string `json:"metadata,omitempty"`
+}
+
+func (i PromptInput) Validate() error {
+	if len(i.Content) == 0 || len(i.Content) > MaxContentBlocks {
+		return fmt.Errorf("prompt content block count must be in range 1..%d", MaxContentBlocks)
+	}
+	for index := range i.Content {
+		if err := i.Content[index].Validate(); err != nil {
+			return fmt.Errorf("content block %d: %w", index, err)
+		}
+	}
+	encodedContent, err := json.Marshal(i.Content)
+	if err != nil {
+		return fmt.Errorf("marshal prompt content: %w", err)
+	}
+	if len(encodedContent) > MaxPromptContentBytes {
+		return fmt.Errorf("prompt content exceeds %d bytes", MaxPromptContentBytes)
+	}
+	if len(i.Metadata) > MaxMetadataEntries {
+		return fmt.Errorf("prompt metadata entry count exceeds %d", MaxMetadataEntries)
+	}
+	for key, value := range i.Metadata {
+		if err := validateBoundedString("prompt metadata key", key, true, 256); err != nil {
+			return err
+		}
+		if err := validateBoundedString("prompt metadata value", value, false, MaxProtocolStringBytes); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+type PromptLease struct {
+	Generation uint64    `json:"generation"`
+	IssuedAt   time.Time `json:"issuedAt"`
+	ExpiresAt  time.Time `json:"expiresAt"`
+}
+
+func (l PromptLease) ValidateAt(now time.Time, minTTL, maxTTL time.Duration) error {
+	if l.Generation == 0 {
+		return fmt.Errorf("prompt lease generation must be positive")
+	}
+	if err := validateTimestamp("prompt lease issue timestamp", l.IssuedAt); err != nil {
+		return err
+	}
+	if err := validateTimestamp("prompt lease expiry", l.ExpiresAt); err != nil {
+		return err
+	}
+	if !l.ExpiresAt.After(l.IssuedAt) {
+		return fmt.Errorf("prompt lease expiry must follow issue timestamp")
+	}
+	if now.IsZero() {
+		now = time.Now().UTC()
+	}
+	if l.IssuedAt.After(now.Add(5 * time.Second)) {
+		return fmt.Errorf("prompt lease issue timestamp is in the future")
+	}
+	if !l.ExpiresAt.After(now) {
+		return fmt.Errorf("prompt lease is expired")
+	}
+	ttl := l.ExpiresAt.Sub(l.IssuedAt)
+	if minTTL > 0 && ttl < minTTL {
+		return fmt.Errorf("prompt lease duration %s is below minimum %s", ttl, minTTL)
+	}
+	if maxTTL > 0 && ttl > maxTTL {
+		return fmt.Errorf("prompt lease duration %s exceeds maximum %s", ttl, maxTTL)
+	}
+	return nil
+}
+
+func (l PromptLease) ActiveAt(now time.Time) bool {
+	if now.IsZero() {
+		now = time.Now().UTC()
+	}
+	return l.Generation > 0 && !l.IssuedAt.IsZero() && l.ExpiresAt.After(now)
+}
+
+func ValidatePromptLeaseRenewal(current, proposed PromptLease, expectedGeneration uint64, now time.Time, maxExtension time.Duration) error {
+	if current.Generation != expectedGeneration {
+		return fmt.Errorf("stale prompt lease generation %d; current generation is %d", expectedGeneration, current.Generation)
+	}
+	if proposed.Generation != current.Generation+1 {
+		return fmt.Errorf("renewed prompt lease generation must be %d", current.Generation+1)
+	}
+	if !proposed.ExpiresAt.After(current.ExpiresAt) {
+		return fmt.Errorf("renewed prompt lease must extend expiry")
+	}
+	if now.IsZero() {
+		now = time.Now().UTC()
+	}
+	if proposed.IssuedAt.Before(now.Add(-time.Second)) || proposed.IssuedAt.After(now.Add(time.Second)) {
+		return fmt.Errorf("renewed prompt lease issue timestamp is outside allowed clock skew")
+	}
+	if maxExtension > 0 && proposed.ExpiresAt.After(now.Add(maxExtension)) {
+		return fmt.Errorf("renewed prompt lease exceeds maximum extension %s", maxExtension)
+	}
+	return proposed.ValidateAt(now, 0, maxExtension)
+}
+
+type PromptMCPAuthorization struct {
+	RuntimeSessionUID      RuntimeSessionUID `json:"runtimeSessionUID"`
+	SessionGeneration      uint64            `json:"sessionGeneration"`
+	TaskUID                TaskUID           `json:"taskUID"`
+	TaskAttempt            uint32            `json:"taskAttempt"`
+	PromptID               PromptID          `json:"promptID"`
+	LeaseGeneration        uint64            `json:"leaseGeneration"`
+	ToolPolicyDigest       string            `json:"toolPolicyDigest"`
+	ApprovalPolicyDigest   string            `json:"approvalPolicyDigest"`
+	MCPConfigurationDigest string            `json:"mcpConfigurationDigest"`
+	ToolPolicy             MCPToolPolicy     `json:"toolPolicy"`
+	ApprovalPolicy         MCPApprovalPolicy `json:"approvalPolicy"`
+	ExpiresAt              time.Time         `json:"expiresAt"`
+}
+
+func (a PromptMCPAuthorization) ValidateFor(metadata MutationMetadata, lease PromptLease) error {
+	return a.ValidateForAt(metadata, lease, time.Now().UTC())
+}
+
+func (a PromptMCPAuthorization) ValidateForAt(metadata MutationMetadata, lease PromptLease, now time.Time) error {
+	if a.RuntimeSessionUID != metadata.Fence.RuntimeSessionUID ||
+		a.SessionGeneration != metadata.Fence.RuntimeSessionGeneration ||
+		a.TaskUID != metadata.TaskUID || a.TaskAttempt != metadata.TaskAttempt ||
+		a.PromptID != metadata.PromptID {
+		return fmt.Errorf("prompt MCP authorization identity does not match request")
+	}
+	if a.LeaseGeneration != lease.Generation {
+		return fmt.Errorf("prompt MCP authorization lease generation does not match prompt lease")
+	}
+	if err := a.Configuration().validate(); err != nil {
+		return err
+	}
+	if err := validateTimestamp("MCP authorization expiry", a.ExpiresAt); err != nil {
+		return err
+	}
+	if now.IsZero() {
+		now = time.Now().UTC()
+	}
+	if !a.ExpiresAt.After(now) {
+		return fmt.Errorf("MCP authorization is expired")
+	}
+	if metadata.ExpiresAt.After(a.ExpiresAt) {
+		return fmt.Errorf("request expiry must not outlive MCP authorization")
+	}
+	if a.ExpiresAt.After(lease.ExpiresAt) {
+		return fmt.Errorf("MCP authorization expiry must not outlive prompt lease")
+	}
+	return nil
+}
+
+func (a PromptMCPAuthorization) Configuration() MCPPolicyConfiguration {
+	return MCPPolicyConfiguration{
+		ToolPolicyDigest: a.ToolPolicyDigest, ApprovalPolicyDigest: a.ApprovalPolicyDigest,
+		MCPConfigurationDigest: a.MCPConfigurationDigest,
+		ToolPolicy:             a.ToolPolicy, ApprovalPolicy: a.ApprovalPolicy,
+	}
+}
+
+func (a PromptMCPAuthorization) ValidateProfile(profile RuntimeProfile) error {
+	return a.Configuration().ValidateProfile(profile)
+}
+
+func (a PromptMCPAuthorization) AuthorizedAt(state RuntimeSessionState, lease PromptLease, now time.Time) bool {
+	if !state.AllowsPromptScopedMCP() || a.LeaseGeneration != lease.Generation {
+		return false
+	}
+	if now.IsZero() {
+		now = time.Now().UTC()
+	}
+	return lease.ActiveAt(now) && a.ExpiresAt.After(now)
+}
+
+type StartPromptRequest struct {
+	Protocol         string                 `json:"protocol"`
+	Metadata         MutationMetadata       `json:"metadata"`
+	Lease            PromptLease            `json:"lease"`
+	MCPAuthorization PromptMCPAuthorization `json:"mcpAuthorization"`
+	Input            PromptInput            `json:"input"`
+}
+
+func (r StartPromptRequest) ValidateAt(now time.Time, minLease, maxLease time.Duration) error {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return err
+	}
+	if err := r.Metadata.validateAt(now, metadataRequirements{session: true, task: true, prompt: true}); err != nil {
+		return fmt.Errorf("metadata: %w", err)
+	}
+	if err := r.Lease.ValidateAt(now, minLease, maxLease); err != nil {
+		return fmt.Errorf("prompt lease: %w", err)
+	}
+	if r.Metadata.ExpiresAt.After(r.Lease.ExpiresAt) {
+		return fmt.Errorf("request expiry must not outlive prompt lease")
+	}
+	if err := r.MCPAuthorization.ValidateForAt(r.Metadata, r.Lease, now); err != nil {
+		return err
+	}
+	if err := r.Input.Validate(); err != nil {
+		return fmt.Errorf("prompt input: %w", err)
+	}
+	return r.Metadata.ValidateDigest(r)
+}
+
+type PromptSettlement struct {
+	TerminalEvent EventType     `json:"terminalEvent"`
+	Outcome       PromptOutcome `json:"outcome"`
+	StopReason    ACPStopReason `json:"stopReason,omitempty"`
+	SettledAt     time.Time     `json:"settledAt"`
+}
+
+func (s PromptSettlement) Validate() error {
+	if !s.TerminalEvent.IsTerminal() {
+		return fmt.Errorf("prompt settlement requires terminal event")
+	}
+	if err := s.Outcome.Validate(); err != nil {
+		return err
+	}
+	if err := validateTimestamp("prompt settlement timestamp", s.SettledAt); err != nil {
+		return err
+	}
+	if s.TerminalEvent == EventOutcomeUnknown {
+		if s.Outcome != PromptOutcomeUnknown {
+			return fmt.Errorf("outcome_unknown terminal event requires outcome_unknown outcome")
+		}
+		return nil
+	}
+	mapping := MapACPStopReason(s.StopReason, true)
+	if mapping.EventType != s.TerminalEvent || mapping.Outcome != s.Outcome {
+		return fmt.Errorf("terminal event/outcome %q/%q is inconsistent with stop reason %q", s.TerminalEvent, s.Outcome, s.StopReason)
+	}
+	return nil
+}
+
+type PromptAdmissionResponse struct {
+	Protocol       string            `json:"protocol"`
+	Classification Classification    `json:"classification"`
+	AcceptedAt     time.Time         `json:"acceptedAt,omitempty"`
+	Settlement     *PromptSettlement `json:"settlement,omitempty"`
+}
+
+func (r PromptAdmissionResponse) Validate() error {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return err
+	}
+	if err := r.Classification.Validate(); err != nil {
+		return fmt.Errorf("classification: %w", err)
+	}
+	switch r.Classification.Class {
+	case RequestClassificationFresh:
+		if err := validateTimestamp("prompt acceptance timestamp", r.AcceptedAt); err != nil {
+			return err
+		}
+		if r.Settlement != nil {
+			return fmt.Errorf("fresh prompt admission must not carry settlement")
+		}
+	case RequestClassificationAlreadyAccepted:
+		if err := validateTimestamp("prompt acceptance timestamp", r.AcceptedAt); err != nil {
+			return err
+		}
+		if r.Settlement != nil {
+			return fmt.Errorf("already accepted prompt must not carry settlement")
+		}
+	case RequestClassificationSettled:
+		if r.Settlement == nil {
+			return fmt.Errorf("settled prompt admission requires settlement metadata")
+		}
+		return r.Settlement.Validate()
+	default:
+		return fmt.Errorf("unsupported prompt admission classification %q", r.Classification.Class)
+	}
+	return nil
+}
+
+type RenewPromptLeaseRequest struct {
+	Protocol                string                 `json:"protocol"`
+	Metadata                MutationMetadata       `json:"metadata"`
+	ExpectedLeaseGeneration uint64                 `json:"expectedLeaseGeneration"`
+	Lease                   PromptLease            `json:"lease"`
+	MCPAuthorization        PromptMCPAuthorization `json:"mcpAuthorization"`
+}
+
+func (r RenewPromptLeaseRequest) ValidateAt(now time.Time, maxExtension time.Duration) error {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return err
+	}
+	if err := r.Metadata.validateAt(now, metadataRequirements{session: true, task: true, prompt: true}); err != nil {
+		return fmt.Errorf("metadata: %w", err)
+	}
+	if r.ExpectedLeaseGeneration == 0 {
+		return fmt.Errorf("expected lease generation must be positive")
+	}
+	if r.Lease.Generation != r.ExpectedLeaseGeneration+1 {
+		return fmt.Errorf("proposed lease generation must follow expected generation")
+	}
+	if err := r.Lease.ValidateAt(now, 0, maxExtension); err != nil {
+		return err
+	}
+	if err := r.MCPAuthorization.ValidateForAt(r.Metadata, r.Lease, now); err != nil {
+		return err
+	}
+	return r.Metadata.ValidateDigest(r)
+}
+
+type PromptLeaseResponse struct {
+	Protocol       string         `json:"protocol"`
+	Classification Classification `json:"classification"`
+	Lease          PromptLease    `json:"lease"`
+}
+
+func (r PromptLeaseResponse) ValidateAt(now time.Time, maxLease time.Duration) error {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return err
+	}
+	if err := r.Classification.Validate(); err != nil {
+		return fmt.Errorf("classification: %w", err)
+	}
+	return r.Lease.ValidateAt(now, 0, maxLease)
+}
+
+type PermissionOptionKind string
+
+const (
+	PermissionOptionAllowOnce    PermissionOptionKind = "allow_once"
+	PermissionOptionAllowAlways  PermissionOptionKind = "allow_always"
+	PermissionOptionRejectOnce   PermissionOptionKind = "reject_once"
+	PermissionOptionRejectAlways PermissionOptionKind = "reject_always"
+)
+
+type PermissionOption struct {
+	OptionID string               `json:"optionID"`
+	Name     string               `json:"name"`
+	Kind     PermissionOptionKind `json:"kind"`
+}
+
+func (o PermissionOption) Validate() error {
+	if err := requireIdentifier("permission option ID", o.OptionID); err != nil {
+		return err
+	}
+	if err := validateBoundedString("permission option name", o.Name, true, 512); err != nil {
+		return err
+	}
+	switch o.Kind {
+	case PermissionOptionAllowOnce, PermissionOptionAllowAlways, PermissionOptionRejectOnce, PermissionOptionRejectAlways:
+		return nil
+	default:
+		return fmt.Errorf("unsupported permission option kind %q", o.Kind)
+	}
+}
+
+type PermissionDecisionOutcome string
+
+const (
+	PermissionDecisionSelected  PermissionDecisionOutcome = "selected"
+	PermissionDecisionCancelled PermissionDecisionOutcome = "cancelled"
+)
+
+type PermissionDecision struct {
+	Outcome  PermissionDecisionOutcome `json:"outcome"`
+	OptionID string                    `json:"optionID,omitempty"`
+}
+
+func (d PermissionDecision) Validate() error {
+	switch d.Outcome {
+	case PermissionDecisionSelected:
+		return requireIdentifier("selected permission option ID", d.OptionID)
+	case PermissionDecisionCancelled:
+		if strings.TrimSpace(d.OptionID) != "" {
+			return fmt.Errorf("cancelled permission decision must not select an option")
+		}
+		return nil
+	default:
+		return fmt.Errorf("unsupported permission decision outcome %q", d.Outcome)
+	}
+}
+
+type ResolvePermissionRequest struct {
+	Protocol  string              `json:"protocol"`
+	Metadata  MutationMetadata    `json:"metadata"`
+	RequestID PermissionRequestID `json:"requestID"`
+	Decision  PermissionDecision  `json:"decision"`
+}
+
+func (r ResolvePermissionRequest) ValidateAt(now time.Time) error {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return err
+	}
+	if err := r.Metadata.validateAt(now, metadataRequirements{session: true, task: true, prompt: true}); err != nil {
+		return fmt.Errorf("metadata: %w", err)
+	}
+	if err := requireIdentifier("permission request ID", string(r.RequestID)); err != nil {
+		return err
+	}
+	if err := r.Decision.Validate(); err != nil {
+		return err
+	}
+	return r.Metadata.ValidateDigest(r)
+}
+
+type PermissionResolutionState string
+
+const (
+	PermissionResolutionApplied           PermissionResolutionState = "applied"
+	PermissionResolutionAlreadyResolved   PermissionResolutionState = "already_resolved"
+	PermissionResolutionCancelledByPrompt PermissionResolutionState = "cancelled_by_prompt"
+)
+
+type PermissionResolutionResponse struct {
+	Protocol       string                    `json:"protocol"`
+	Classification Classification            `json:"classification"`
+	State          PermissionResolutionState `json:"state"`
+	Decision       PermissionDecision        `json:"decision"`
+	ResolvedAt     time.Time                 `json:"resolvedAt"`
+}
+
+func (r PermissionResolutionResponse) Validate() error {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return err
+	}
+	if err := r.Classification.Validate(); err != nil {
+		return fmt.Errorf("classification: %w", err)
+	}
+	switch r.State {
+	case PermissionResolutionApplied, PermissionResolutionAlreadyResolved, PermissionResolutionCancelledByPrompt:
+	default:
+		return fmt.Errorf("unsupported permission resolution state %q", r.State)
+	}
+	if err := r.Decision.Validate(); err != nil {
+		return err
+	}
+	if r.State == PermissionResolutionCancelledByPrompt && r.Decision.Outcome != PermissionDecisionCancelled {
+		return fmt.Errorf("permission invalidated by prompt cancellation must resolve as cancelled")
+	}
+	return validateTimestamp("permission resolution timestamp", r.ResolvedAt)
+}
+
+type CancelReason string
+
+const (
+	CancelReasonUserRequested      CancelReason = "user_requested"
+	CancelReasonTaskTimeout        CancelReason = "task_timeout"
+	CancelReasonLeaseExpired       CancelReason = "lease_expired"
+	CancelReasonStreamDisconnected CancelReason = "stream_disconnected"
+	CancelReasonControllerShutdown CancelReason = "controller_shutdown"
+)
+
+type CancelPromptRequest struct {
+	Protocol           string           `json:"protocol"`
+	Metadata           MutationMetadata `json:"metadata"`
+	Reason             CancelReason     `json:"reason"`
+	SettlementDeadline time.Time        `json:"settlementDeadline"`
+}
+
+func (r CancelPromptRequest) ValidateAt(now time.Time) error {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return err
+	}
+	if err := r.Metadata.validateAt(now, metadataRequirements{session: true, task: true, prompt: true}); err != nil {
+		return fmt.Errorf("metadata: %w", err)
+	}
+	switch r.Reason {
+	case CancelReasonUserRequested, CancelReasonTaskTimeout, CancelReasonLeaseExpired,
+		CancelReasonStreamDisconnected, CancelReasonControllerShutdown:
+	default:
+		return fmt.Errorf("unsupported cancel reason %q", r.Reason)
+	}
+	if err := validateTimestamp("cancellation settlement deadline", r.SettlementDeadline); err != nil {
+		return err
+	}
+	if now.IsZero() {
+		now = time.Now().UTC()
+	}
+	if !r.SettlementDeadline.After(now) {
+		return fmt.Errorf("cancellation settlement deadline must be in the future")
+	}
+	if r.SettlementDeadline.After(r.Metadata.ExpiresAt) {
+		return fmt.Errorf("cancellation settlement deadline must not outlive request expiry")
+	}
+	return r.Metadata.ValidateDigest(r)
+}
+
+type CancellationBarrierState string
+
+const (
+	CancellationBarrierSettled          CancellationBarrierState = "settled"
+	CancellationBarrierForcedTerminated CancellationBarrierState = "forced_terminated"
+	CancellationBarrierOutcomeUnknown   CancellationBarrierState = "outcome_unknown"
+)
+
+type CancelPromptResponse struct {
+	Protocol                      string                   `json:"protocol"`
+	Classification                Classification           `json:"classification"`
+	BarrierState                  CancellationBarrierState `json:"barrierState"`
+	SettlementProven              bool                     `json:"settlementProven"`
+	Settlement                    PromptSettlement         `json:"settlement"`
+	InvalidatedPermissionRequests uint32                   `json:"invalidatedPermissionRequests"`
+	LiveDescendantCount           uint32                   `json:"liveDescendantCount"`
+	ForcedTermination             bool                     `json:"forcedTermination"`
+}
+
+func (r CancelPromptResponse) Validate() error {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return err
+	}
+	if err := r.Classification.Validate(); err != nil {
+		return fmt.Errorf("classification: %w", err)
+	}
+	switch r.BarrierState {
+	case CancellationBarrierSettled:
+		if !r.SettlementProven || r.ForcedTermination {
+			return fmt.Errorf("settled cancellation barrier requires proven settlement without forced termination")
+		}
+	case CancellationBarrierForcedTerminated:
+		if !r.ForcedTermination {
+			return fmt.Errorf("forced termination barrier must report forced termination")
+		}
+	case CancellationBarrierOutcomeUnknown:
+		if r.SettlementProven || r.Settlement.TerminalEvent != EventOutcomeUnknown || r.Settlement.Outcome != PromptOutcomeUnknown {
+			return fmt.Errorf("outcome unknown barrier must carry unproven outcome_unknown settlement")
+		}
+	default:
+		return fmt.Errorf("unsupported cancellation barrier state %q", r.BarrierState)
+	}
+	if err := r.Settlement.Validate(); err != nil {
+		return err
+	}
+	if r.SettlementProven && r.LiveDescendantCount != 0 {
+		return fmt.Errorf("proven settlement must not leave live descendants")
+	}
+	if !r.SettlementProven && r.BarrierState != CancellationBarrierOutcomeUnknown {
+		return fmt.Errorf("unproven settlement must be outcome_unknown")
+	}
+	return nil
+}
diff --git a/internal/harness/v2/protocol.go b/internal/harness/v2/protocol.go
new file mode 100644
index 000000000..d0f8f8263
--- /dev/null
+++ b/internal/harness/v2/protocol.go
@@ -0,0 +1,572 @@
+package v2
+
+import (
+	"fmt"
+	"strings"
+	"time"
+)
+
+type HealthStatus string
+
+const (
+	HealthStatusOK        HealthStatus = "ok"
+	HealthStatusDegraded  HealthStatus = "degraded"
+	HealthStatusUnhealthy HealthStatus = "unhealthy"
+)
+
+type HealthResponse struct {
+	Protocol  string       `json:"protocol"`
+	Status    HealthStatus `json:"status"`
+	Timestamp time.Time    `json:"timestamp"`
+}
+
+func (r HealthResponse) Validate() error {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return err
+	}
+	switch r.Status {
+	case HealthStatusOK, HealthStatusDegraded, HealthStatusUnhealthy:
+	default:
+		return fmt.Errorf("unsupported health status %q", r.Status)
+	}
+	return validateTimestamp("health timestamp", r.Timestamp)
+}
+
+type ProviderCapabilities struct {
+	ProviderKinds             []string `json:"providerKinds"`
+	Models                    []string `json:"models,omitempty"`
+	SupportsPermissions       bool     `json:"supportsPermissions"`
+	SupportsCancel            bool     `json:"supportsCancel"`
+	SupportsTools             bool     `json:"supportsTools"`
+	SupportsImages            bool     `json:"supportsImages,omitempty"`
+	SupportsAudio             bool     `json:"supportsAudio,omitempty"`
+	SupportsEmbeddedResources bool     `json:"supportsEmbeddedResources,omitempty"`
+}
+
+func (c ProviderCapabilities) Validate() error {
+	if len(c.ProviderKinds) == 0 {
+		return fmt.Errorf("at least one provider kind is required")
+	}
+	if err := validateUniqueStrings("provider kind", c.ProviderKinds, 32); err != nil {
+		return err
+	}
+	if err := validateUniqueStrings("model", c.Models, 256); err != nil {
+		return err
+	}
+	return nil
+}
+
+const (
+	DefaultMaxResidentSessions  uint32 = 10
+	DefaultMaxConcurrentPrompts uint32 = 4
+)
+
+type ProtocolLimits struct {
+	MaxResidentSessions      uint32 `json:"maxResidentSessions"`
+	MaxConcurrentPrompts     uint32 `json:"maxConcurrentPrompts"`
+	MaxRequestBytes          int    `json:"maxRequestBytes"`
+	MaxEventLineBytes        int    `json:"maxEventLineBytes"`
+	MaxTerminalResultBytes   int    `json:"maxTerminalResultBytes"`
+	MaxBufferedEvents        int    `json:"maxBufferedEvents"`
+	MaxUpdateEventsPerSecond int    `json:"maxUpdateEventsPerSecond"`
+	MinPromptLeaseMillis     int64  `json:"minPromptLeaseMillis"`
+	MaxPromptLeaseMillis     int64  `json:"maxPromptLeaseMillis"`
+	MaxPendingPermissions    uint32 `json:"maxPendingPermissions"`
+	MaxWorkspaceDeltaBytes   int64  `json:"maxWorkspaceDeltaBytes"`
+}
+
+func DefaultProtocolLimits() ProtocolLimits {
+	stream := DefaultEventStreamLimits()
+	return ProtocolLimits{
+		MaxResidentSessions:      DefaultMaxResidentSessions,
+		MaxConcurrentPrompts:     DefaultMaxConcurrentPrompts,
+		MaxRequestBytes:          1 << 20,
+		MaxEventLineBytes:        stream.MaxLineBytes,
+		MaxTerminalResultBytes:   stream.MaxTerminalResultBytes,
+		MaxBufferedEvents:        stream.MaxBufferedEvents,
+		MaxUpdateEventsPerSecond: stream.MaxUpdateEventsPerSecond,
+		MinPromptLeaseMillis:     5_000,
+		MaxPromptLeaseMillis:     120_000,
+		MaxPendingPermissions:    32,
+		MaxWorkspaceDeltaBytes:   512 << 20,
+	}
+}
+
+func (l ProtocolLimits) Validate() error {
+	if l.MaxResidentSessions == 0 {
+		return fmt.Errorf("max resident sessions must be positive")
+	}
+	if l.MaxConcurrentPrompts == 0 || l.MaxConcurrentPrompts > l.MaxResidentSessions {
+		return fmt.Errorf("max concurrent prompts must be positive and no greater than resident sessions")
+	}
+	streamLimits := EventStreamLimits{
+		MaxLineBytes:             l.MaxEventLineBytes,
+		MaxTerminalResultBytes:   l.MaxTerminalResultBytes,
+		MaxBufferedEvents:        l.MaxBufferedEvents,
+		MaxUpdateEventsPerSecond: l.MaxUpdateEventsPerSecond,
+	}
+	if err := streamLimits.Validate(); err != nil {
+		return fmt.Errorf("event limits: %w", err)
+	}
+	if l.MaxRequestBytes <= 0 || l.MaxRequestBytes > MaxCanonicalJSONBytes {
+		return fmt.Errorf("max request bytes must be in range 1..%d", MaxCanonicalJSONBytes)
+	}
+	if l.MinPromptLeaseMillis <= 0 || l.MaxPromptLeaseMillis < l.MinPromptLeaseMillis {
+		return fmt.Errorf("prompt lease bounds are invalid")
+	}
+	if l.MaxPendingPermissions == 0 {
+		return fmt.Errorf("max pending permissions must be positive")
+	}
+	if l.MaxWorkspaceDeltaBytes <= 0 {
+		return fmt.Errorf("max workspace delta bytes must be positive")
+	}
+	return nil
+}
+
+type WorkspaceGovernanceMode string
+
+const (
+	WorkspaceGovernanceStrict  WorkspaceGovernanceMode = "strict-governed"
+	WorkspaceGovernanceTrusted WorkspaceGovernanceMode = "trusted-non-governed"
+)
+
+type WorkspaceGovernanceCapabilities struct {
+	Mode                            WorkspaceGovernanceMode `json:"mode"`
+	Trusted                         bool                    `json:"trusted,omitempty"`
+	OrkaOwnedWorkspaceDeltas        bool                    `json:"orkaOwnedWorkspaceDeltas"`
+	PromptScopedBrokerAuthorization bool                    `json:"promptScopedBrokerAuthorization"`
+	NoDirectSCMPublication          bool                    `json:"noDirectSCMPublication"`
+	OrkaOwnedCleanRoomPublication   bool                    `json:"orkaOwnedCleanRoomPublication"`
+	ExactInstanceFencing            bool                    `json:"exactInstanceFencing"`
+	DuplicateSafeMutations          bool                    `json:"duplicateSafeMutations"`
+	CancellationSettlement          bool                    `json:"cancellationSettlement"`
+}
+
+func StrictWorkspaceGovernanceCapabilities() WorkspaceGovernanceCapabilities {
+	return WorkspaceGovernanceCapabilities{
+		Mode: WorkspaceGovernanceStrict, OrkaOwnedWorkspaceDeltas: true,
+		PromptScopedBrokerAuthorization: true, NoDirectSCMPublication: true,
+		OrkaOwnedCleanRoomPublication: true, ExactInstanceFencing: true,
+		DuplicateSafeMutations: true, CancellationSettlement: true,
+	}
+}
+
+func (c WorkspaceGovernanceCapabilities) Strict() bool {
+	return c.Mode == WorkspaceGovernanceStrict && !c.Trusted && c.OrkaOwnedWorkspaceDeltas &&
+		c.PromptScopedBrokerAuthorization && c.NoDirectSCMPublication && c.OrkaOwnedCleanRoomPublication &&
+		c.ExactInstanceFencing && c.DuplicateSafeMutations && c.CancellationSettlement
+}
+
+func (c WorkspaceGovernanceCapabilities) Validate() error {
+	switch c.Mode {
+	case WorkspaceGovernanceStrict:
+		if !c.Strict() {
+			return fmt.Errorf("strict workspace governance requires every governance guarantee and trusted=false")
+		}
+	case WorkspaceGovernanceTrusted:
+		if !c.Trusted || c.OrkaOwnedWorkspaceDeltas || c.PromptScopedBrokerAuthorization || c.NoDirectSCMPublication ||
+			c.OrkaOwnedCleanRoomPublication || c.ExactInstanceFencing || c.DuplicateSafeMutations || c.CancellationSettlement {
+			return fmt.Errorf("trusted non-governed runtime must be explicitly marked trusted and must not claim strict guarantees")
+		}
+	default:
+		return fmt.Errorf("unsupported workspace governance mode %q", c.Mode)
+	}
+	return nil
+}
+
+type CapabilitiesResponse struct {
+	Protocol                          string                          `json:"protocol"`
+	Transport                         string                          `json:"transport"`
+	ACPVersion                        string                          `json:"acpVersion"`
+	RuntimeProfileDigest              ProfileDigest                   `json:"runtimeProfileDigest"`
+	ProfileDigestSchemaVersion        uint32                          `json:"profileDigestSchemaVersion"`
+	AdapterDigests                    map[string]string               `json:"adapterDigests"`
+	Limits                            ProtocolLimits                  `json:"limits"`
+	Provider                          ProviderCapabilities            `json:"provider"`
+	WorkspaceGovernance               WorkspaceGovernanceCapabilities `json:"workspaceGovernance"`
+	SupportsDrain                     bool                            `json:"supportsDrain"`
+	SupportsPublicationFinalization   bool                            `json:"supportsPublicationFinalization"`
+	SupportsAgentSessionConfiguration bool                            `json:"supportsAgentSessionConfiguration,omitempty"`
+}
+
+func (r CapabilitiesResponse) Validate() error {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return err
+	}
+	if r.Transport != "http+ndjson" {
+		return fmt.Errorf("transport %q is unsupported", r.Transport)
+	}
+	if r.ACPVersion != ACPProfileV1 {
+		return fmt.Errorf("ACP version %q is unsupported; want %q", r.ACPVersion, ACPProfileV1)
+	}
+	if err := ValidateProfileDigest(r.RuntimeProfileDigest); err != nil {
+		return fmt.Errorf("runtime profile digest: %w", err)
+	}
+	if r.ProfileDigestSchemaVersion != ProfileDigestSchemaVersion {
+		return fmt.Errorf("profile digest schema version %d is unsupported; want %d", r.ProfileDigestSchemaVersion, ProfileDigestSchemaVersion)
+	}
+	if len(r.AdapterDigests) == 0 {
+		return fmt.Errorf("at least one adapter digest is required")
+	}
+	if len(r.AdapterDigests) > 32 {
+		return fmt.Errorf("adapter digest count exceeds 32")
+	}
+	for name, digest := range r.AdapterDigests {
+		if err := validateBoundedString("adapter name", name, true, 128); err != nil {
+			return err
+		}
+		if err := validateSHA256Digest(digest); err != nil {
+			return fmt.Errorf("adapter %q digest: %w", name, err)
+		}
+	}
+	if err := r.Limits.Validate(); err != nil {
+		return err
+	}
+	if err := r.Provider.Validate(); err != nil {
+		return err
+	}
+	return r.WorkspaceGovernance.Validate()
+}
+
+type SupervisorLifecycle string
+
+const (
+	SupervisorLifecycleBooting     SupervisorLifecycle = "booting"
+	SupervisorLifecycleReady       SupervisorLifecycle = "ready"
+	SupervisorLifecycleDraining    SupervisorLifecycle = "draining"
+	SupervisorLifecycleTerminating SupervisorLifecycle = "terminating"
+	SupervisorLifecycleUnhealthy   SupervisorLifecycle = "unhealthy"
+)
+
+const DrainReasonSessionIdentityCapacity = "session_identity_capacity"
+
+type DrainStatus struct {
+	AcceptingNewSessions bool      `json:"acceptingNewSessions"`
+	Requested            bool      `json:"requested"`
+	RequestedAt          time.Time `json:"requestedAt,omitempty"`
+	Reason               string    `json:"reason,omitempty"`
+}
+
+type RuntimeSessionStatus struct {
+	RuntimeSessionID        RuntimeSessionID    `json:"runtimeSessionID"`
+	RuntimeSessionUID       RuntimeSessionUID   `json:"runtimeSessionUID"`
+	Generation              uint64              `json:"generation"`
+	State                   RuntimeSessionState `json:"state"`
+	ActivePromptID          PromptID            `json:"activePromptID,omitempty"`
+	PendingPermissionCount  uint32              `json:"pendingPermissionCount"`
+	ReservedForFinalization bool                `json:"reservedForFinalization"`
+	LiveDescendantCount     uint32              `json:"liveDescendantCount"`
+	LastTransitionAt        time.Time           `json:"lastTransitionAt"`
+}
+
+func (s RuntimeSessionStatus) Validate() error {
+	if err := requireIdentifier("runtime session ID", string(s.RuntimeSessionID)); err != nil {
+		return err
+	}
+	if err := requireIdentifier("runtime session UID", string(s.RuntimeSessionUID)); err != nil {
+		return err
+	}
+	if s.Generation == 0 {
+		return fmt.Errorf("runtime session generation must be positive")
+	}
+	if !IsKnownRuntimeSessionState(s.State) {
+		return fmt.Errorf("unsupported runtime session state %q", s.State)
+	}
+	if s.State == RuntimeSessionStatePromptRunning {
+		if err := requireIdentifier("active prompt ID", string(s.ActivePromptID)); err != nil {
+			return err
+		}
+	} else if s.ActivePromptID != "" {
+		return fmt.Errorf("active prompt ID is only valid while prompt is running")
+	}
+	if s.State == RuntimeSessionStateFinalizing && !s.ReservedForFinalization {
+		return fmt.Errorf("finalizing runtime session must be reserved for finalization")
+	}
+	if s.ReservedForFinalization && s.State != RuntimeSessionStateFinalizing &&
+		s.State != RuntimeSessionStateDeleting && s.State != RuntimeSessionStatePoisoned {
+		return fmt.Errorf("finalization reservation is only valid while finalizing, deleting, or poisoned")
+	}
+	if err := validateTimestamp("last transition timestamp", s.LastTransitionAt); err != nil {
+		return err
+	}
+	return nil
+}
+
+type ActivePromptStatus struct {
+	RuntimeSessionUID  RuntimeSessionUID `json:"runtimeSessionUID"`
+	SessionGeneration  uint64            `json:"sessionGeneration"`
+	TaskUID            TaskUID           `json:"taskUID"`
+	TaskAttempt        uint32            `json:"taskAttempt"`
+	PromptID           PromptID          `json:"promptID"`
+	LeaseExpiresAt     time.Time         `json:"leaseExpiresAt"`
+	FrameSequence      uint64            `json:"frameSequence"`
+	PendingPermissions uint32            `json:"pendingPermissions"`
+	StartedAt          time.Time         `json:"startedAt"`
+}
+
+func (s ActivePromptStatus) Validate() error {
+	if err := requireIdentifier("runtime session UID", string(s.RuntimeSessionUID)); err != nil {
+		return err
+	}
+	if s.SessionGeneration == 0 {
+		return fmt.Errorf("session generation must be positive")
+	}
+	if err := requireIdentifier("task UID", string(s.TaskUID)); err != nil {
+		return err
+	}
+	if s.TaskAttempt == 0 {
+		return fmt.Errorf("task attempt must be positive")
+	}
+	if err := requireIdentifier("prompt ID", string(s.PromptID)); err != nil {
+		return err
+	}
+	if err := validateTimestamp("lease expiry", s.LeaseExpiresAt); err != nil {
+		return err
+	}
+	if s.FrameSequence == 0 {
+		return fmt.Errorf("frame sequence must be positive")
+	}
+	return validateTimestamp("prompt start timestamp", s.StartedAt)
+}
+
+type PendingPermissionStatus struct {
+	RuntimeSessionUID RuntimeSessionUID   `json:"runtimeSessionUID"`
+	PromptID          PromptID            `json:"promptID"`
+	RequestID         PermissionRequestID `json:"requestID"`
+	RequestedAt       time.Time           `json:"requestedAt"`
+	ExpiresAt         time.Time           `json:"expiresAt"`
+}
+
+func (s PendingPermissionStatus) Validate() error {
+	if err := requireIdentifier("runtime session UID", string(s.RuntimeSessionUID)); err != nil {
+		return err
+	}
+	if err := requireIdentifier("prompt ID", string(s.PromptID)); err != nil {
+		return err
+	}
+	if err := requireIdentifier("permission request ID", string(s.RequestID)); err != nil {
+		return err
+	}
+	if err := validateTimestamp("permission request timestamp", s.RequestedAt); err != nil {
+		return err
+	}
+	if err := validateTimestamp("permission expiry", s.ExpiresAt); err != nil {
+		return err
+	}
+	if !s.ExpiresAt.After(s.RequestedAt) {
+		return fmt.Errorf("permission expiry must follow request timestamp")
+	}
+	return nil
+}
+
+type PressureMetadata struct {
+	ResidentSessions      uint32 `json:"residentSessions"`
+	ActivePrompts         uint32 `json:"activePrompts"`
+	QueuedAdmissions      uint32 `json:"queuedAdmissions"`
+	PendingPermissions    uint32 `json:"pendingPermissions"`
+	LiveDescendants       uint32 `json:"liveDescendants"`
+	MemoryWorkingSetBytes uint64 `json:"memoryWorkingSetBytes,omitempty"`
+	WritableBytes         uint64 `json:"writableBytes,omitempty"`
+	PIDCurrent            uint32 `json:"pidCurrent,omitempty"`
+}
+
+// SessionIdentityCapacity reports the finite, never-reused child identity
+// budget for one supervisor boot. ExhaustionReserve is deliberately excluded
+// from admission so the controller can replace the Pod before Remaining reaches
+// zero.
+type SessionIdentityCapacity struct {
+	Total             uint64 `json:"total"`
+	Remaining         uint64 `json:"remaining"`
+	ExhaustionReserve uint64 `json:"exhaustionReserve"`
+}
+
+func (c SessionIdentityCapacity) Validate() error {
+	if c.Total == 0 {
+		return fmt.Errorf("session identity capacity total must be positive")
+	}
+	if c.ExhaustionReserve == 0 || c.ExhaustionReserve >= c.Total {
+		return fmt.Errorf("session identity exhaustion reserve must be positive and less than total capacity")
+	}
+	if c.Remaining > c.Total {
+		return fmt.Errorf("remaining session identity capacity exceeds total capacity")
+	}
+	return nil
+}
+
+func (c SessionIdentityCapacity) RotationRequired() bool {
+	return c.Remaining <= c.ExhaustionReserve
+}
+
+type StatusResponse struct {
+	Protocol                string                    `json:"protocol"`
+	Fence                   Fence                     `json:"fence"`
+	Lifecycle               SupervisorLifecycle       `json:"lifecycle"`
+	Drain                   DrainStatus               `json:"drain"`
+	Sessions                []RuntimeSessionStatus    `json:"sessions"`
+	ActivePrompts           []ActivePromptStatus      `json:"activePrompts"`
+	PendingPermissions      []PendingPermissionStatus `json:"pendingPermissions"`
+	Pressure                PressureMetadata          `json:"pressure"`
+	SessionIdentityCapacity *SessionIdentityCapacity  `json:"sessionIdentityCapacity,omitempty"`
+	Timestamp               time.Time                 `json:"timestamp"`
+}
+
+//nolint:gocyclo // The explicit state-machine branches are easier to audit together.
+func (r StatusResponse) Validate() error {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return err
+	}
+	if err := r.Fence.Validate(false); err != nil {
+		return fmt.Errorf("fence: %w", err)
+	}
+	switch r.Lifecycle {
+	case SupervisorLifecycleBooting, SupervisorLifecycleReady, SupervisorLifecycleDraining,
+		SupervisorLifecycleTerminating, SupervisorLifecycleUnhealthy:
+	default:
+		return fmt.Errorf("unsupported supervisor lifecycle %q", r.Lifecycle)
+	}
+	if r.Fence.RuntimeSessionUID != "" || r.Fence.RuntimeSessionGeneration != 0 {
+		return fmt.Errorf("status response must use a pool-wide fence without runtime session identity")
+	}
+	if r.SessionIdentityCapacity != nil {
+		if err := r.SessionIdentityCapacity.Validate(); err != nil {
+			return err
+		}
+	}
+	if r.Drain.Requested {
+		if r.Drain.AcceptingNewSessions {
+			return fmt.Errorf("draining supervisor must not accept new sessions")
+		}
+		if err := validateTimestamp("drain request timestamp", r.Drain.RequestedAt); err != nil {
+			return err
+		}
+		if r.Lifecycle != SupervisorLifecycleDraining && r.Lifecycle != SupervisorLifecycleTerminating {
+			return fmt.Errorf("requested drain requires draining or terminating lifecycle")
+		}
+	} else {
+		if !r.Drain.RequestedAt.IsZero() || r.Drain.Reason != "" {
+			return fmt.Errorf("inactive drain must not carry request metadata")
+		}
+		if r.Lifecycle == SupervisorLifecycleDraining {
+			return fmt.Errorf("draining lifecycle requires requested drain")
+		}
+	}
+	if len(r.Sessions) > 10_000 || len(r.ActivePrompts) > 10_000 || len(r.PendingPermissions) > 10_000 {
+		return fmt.Errorf("status response exceeds bounded item count")
+	}
+	sessionsByUID := make(map[RuntimeSessionUID]RuntimeSessionStatus, len(r.Sessions))
+	for i := range r.Sessions {
+		if err := r.Sessions[i].Validate(); err != nil {
+			return fmt.Errorf("session status %d: %w", i, err)
+		}
+		if r.Sessions[i].PendingPermissionCount > 0 && r.Sessions[i].State != RuntimeSessionStatePromptRunning {
+			return fmt.Errorf("session %q has pending permissions outside prompt_running", r.Sessions[i].RuntimeSessionUID)
+		}
+		if _, ok := sessionsByUID[r.Sessions[i].RuntimeSessionUID]; ok {
+			return fmt.Errorf("duplicate session UID %q", r.Sessions[i].RuntimeSessionUID)
+		}
+		sessionsByUID[r.Sessions[i].RuntimeSessionUID] = r.Sessions[i]
+	}
+	activeBySession := make(map[RuntimeSessionUID]ActivePromptStatus, len(r.ActivePrompts))
+	for i := range r.ActivePrompts {
+		if err := r.ActivePrompts[i].Validate(); err != nil {
+			return fmt.Errorf("active prompt %d: %w", i, err)
+		}
+		session, ok := sessionsByUID[r.ActivePrompts[i].RuntimeSessionUID]
+		if !ok {
+			return fmt.Errorf("active prompt %d references unknown session UID %q", i, r.ActivePrompts[i].RuntimeSessionUID)
+		}
+		if session.State != RuntimeSessionStatePromptRunning || session.ActivePromptID != r.ActivePrompts[i].PromptID || session.Generation != r.ActivePrompts[i].SessionGeneration {
+			return fmt.Errorf("active prompt %d does not match session status", i)
+		}
+		if _, ok := activeBySession[r.ActivePrompts[i].RuntimeSessionUID]; ok {
+			return fmt.Errorf("multiple active prompts for session UID %q", r.ActivePrompts[i].RuntimeSessionUID)
+		}
+		activeBySession[r.ActivePrompts[i].RuntimeSessionUID] = r.ActivePrompts[i]
+	}
+	for i := range r.PendingPermissions {
+		if err := r.PendingPermissions[i].Validate(); err != nil {
+			return fmt.Errorf("pending permission %d: %w", i, err)
+		}
+		active, ok := activeBySession[r.PendingPermissions[i].RuntimeSessionUID]
+		if !ok || active.PromptID != r.PendingPermissions[i].PromptID {
+			return fmt.Errorf("pending permission %d does not match an active prompt", i)
+		}
+	}
+	if uint32(len(r.Sessions)) != r.Pressure.ResidentSessions {
+		return fmt.Errorf("pressure resident session count does not match session list")
+	}
+	if uint32(len(r.ActivePrompts)) != r.Pressure.ActivePrompts {
+		return fmt.Errorf("pressure active prompt count does not match prompt list")
+	}
+	if uint32(len(r.PendingPermissions)) != r.Pressure.PendingPermissions {
+		return fmt.Errorf("pressure pending permission count does not match permission list")
+	}
+	return validateTimestamp("status timestamp", r.Timestamp)
+}
+
+type ErrorCode string
+
+const (
+	ErrorCodeInvalidRequest  ErrorCode = "invalid_request"
+	ErrorCodeUnauthenticated ErrorCode = "unauthenticated"
+	ErrorCodeForbidden       ErrorCode = "forbidden"
+	ErrorCodeExpired         ErrorCode = "expired"
+	ErrorCodeStaleFence      ErrorCode = "stale_fence"
+	ErrorCodeDigestConflict  ErrorCode = "digest_conflict"
+	ErrorCodeAlreadyAccepted ErrorCode = "already_accepted"
+	ErrorCodeSettled         ErrorCode = "settled"
+	ErrorCodeRateLimited     ErrorCode = "rate_limited"
+	ErrorCodeSessionPoisoned ErrorCode = "session_poisoned"
+	ErrorCodeOutcomeUnknown  ErrorCode = "outcome_unknown"
+)
+
+type ErrorResponse struct {
+	Protocol       string          `json:"protocol"`
+	Code           ErrorCode       `json:"code"`
+	Message        string          `json:"message"`
+	Classification *Classification `json:"classification,omitempty"`
+	Retryable      bool            `json:"retryable"`
+}
+
+func (r ErrorResponse) Validate() error {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return err
+	}
+	switch r.Code {
+	case ErrorCodeInvalidRequest, ErrorCodeUnauthenticated, ErrorCodeForbidden, ErrorCodeExpired,
+		ErrorCodeStaleFence, ErrorCodeDigestConflict, ErrorCodeAlreadyAccepted, ErrorCodeSettled,
+		ErrorCodeRateLimited, ErrorCodeSessionPoisoned, ErrorCodeOutcomeUnknown:
+	default:
+		return fmt.Errorf("unsupported error code %q", r.Code)
+	}
+	if err := validateBoundedString("error message", r.Message, true, MaxDiagnosticBytes); err != nil {
+		return err
+	}
+	if r.Classification != nil {
+		if err := r.Classification.Validate(); err != nil {
+			return fmt.Errorf("classification: %w", err)
+		}
+	}
+	if r.Code == ErrorCodeOutcomeUnknown && r.Retryable {
+		return fmt.Errorf("outcome_unknown must never be retryable")
+	}
+	return nil
+}
+
+func validateUniqueStrings(name string, values []string, max int) error {
+	if len(values) > max {
+		return fmt.Errorf("%s count exceeds %d", name, max)
+	}
+	seen := make(map[string]struct{}, len(values))
+	for i, value := range values {
+		value = strings.TrimSpace(value)
+		if err := validateBoundedString(name, value, true, 256); err != nil {
+			return fmt.Errorf("%s %d: %w", name, i, err)
+		}
+		if _, ok := seen[value]; ok {
+			return fmt.Errorf("duplicate %s %q", name, value)
+		}
+		seen[value] = struct{}{}
+	}
+	return nil
+}
diff --git a/internal/harness/v2/semantics.go b/internal/harness/v2/semantics.go
new file mode 100644
index 000000000..b14abaff8
--- /dev/null
+++ b/internal/harness/v2/semantics.go
@@ -0,0 +1,109 @@
+package v2
+
+import "fmt"
+
+type ACPStopReason string
+
+const (
+	ACPStopReasonEndTurn         ACPStopReason = "end_turn"
+	ACPStopReasonMaxTokens       ACPStopReason = "max_tokens"
+	ACPStopReasonMaxTurnRequests ACPStopReason = "max_turn_requests"
+	ACPStopReasonRefusal         ACPStopReason = "refusal"
+	ACPStopReasonCancelled       ACPStopReason = "cancelled"
+)
+
+type PromptOutcome string
+
+const (
+	PromptOutcomeSucceeded PromptOutcome = "succeeded"
+	PromptOutcomeFailed    PromptOutcome = "failed"
+	PromptOutcomeCancelled PromptOutcome = "cancelled"
+	PromptOutcomeUnknown   PromptOutcome = "outcome_unknown"
+)
+
+func (o PromptOutcome) Validate() error {
+	switch o {
+	case PromptOutcomeSucceeded, PromptOutcomeFailed, PromptOutcomeCancelled, PromptOutcomeUnknown:
+		return nil
+	default:
+		return fmt.Errorf("unsupported prompt outcome %q", o)
+	}
+}
+
+func (o PromptOutcome) RequiresExplicitNewTask() bool {
+	return o == PromptOutcomeUnknown
+}
+
+type StopReasonMapping struct {
+	StopReason           ACPStopReason `json:"stopReason,omitempty"`
+	Known                bool          `json:"known"`
+	EventType            EventType     `json:"eventType"`
+	Outcome              PromptOutcome `json:"outcome"`
+	CanValidateWorkspace bool          `json:"canValidateWorkspace"`
+	PoisonSession        bool          `json:"poisonSession"`
+	FailureCode          string        `json:"failureCode,omitempty"`
+}
+
+// MapACPStopReason converts the ACP session/prompt completion barrier into Orka
+// semantics. An unproven settlement always becomes terminal outcome_unknown;
+// no caller may infer success or automatically replay from transport loss.
+func MapACPStopReason(reason ACPStopReason, settlementProven bool) StopReasonMapping {
+	if !settlementProven {
+		return StopReasonMapping{
+			StopReason:    reason,
+			Known:         isKnownACPStopReason(reason),
+			EventType:     EventOutcomeUnknown,
+			Outcome:       PromptOutcomeUnknown,
+			PoisonSession: true,
+			FailureCode:   "settlement_unproven",
+		}
+	}
+	switch reason {
+	case ACPStopReasonEndTurn:
+		return StopReasonMapping{
+			StopReason:           reason,
+			Known:                true,
+			EventType:            EventCompleted,
+			Outcome:              PromptOutcomeSucceeded,
+			CanValidateWorkspace: true,
+		}
+	case ACPStopReasonCancelled:
+		return StopReasonMapping{
+			StopReason:    reason,
+			Known:         true,
+			EventType:     EventCancelled,
+			Outcome:       PromptOutcomeCancelled,
+			PoisonSession: true,
+			FailureCode:   "prompt_cancelled",
+		}
+	case ACPStopReasonMaxTokens:
+		return failedStopReason(reason, true, "token_limit")
+	case ACPStopReasonMaxTurnRequests:
+		return failedStopReason(reason, true, "turn_limit")
+	case ACPStopReasonRefusal:
+		return failedStopReason(reason, true, "refusal")
+	default:
+		return failedStopReason(reason, false, "unknown_stop_reason")
+	}
+}
+
+func failedStopReason(reason ACPStopReason, known bool, code string) StopReasonMapping {
+	return StopReasonMapping{
+		StopReason:    reason,
+		Known:         known,
+		EventType:     EventFailed,
+		Outcome:       PromptOutcomeFailed,
+		PoisonSession: true,
+		FailureCode:   code,
+	}
+}
+
+func isKnownACPStopReason(reason ACPStopReason) bool {
+	switch reason {
+	case ACPStopReasonEndTurn, ACPStopReasonMaxTokens, ACPStopReasonMaxTurnRequests,
+		ACPStopReasonRefusal, ACPStopReasonCancelled:
+		return true
+	default:
+		return false
+	}
+}
diff --git a/internal/harness/v2/session.go b/internal/harness/v2/session.go
new file mode 100644
index 000000000..aca3d685b
--- /dev/null
+++ b/internal/harness/v2/session.go
@@ -0,0 +1,750 @@
+package v2
+
+import (
+	"fmt"
+	"strings"
+	"time"
+)
+
+type WorkspaceIntent string
+
+const (
+	WorkspaceIntentRead  WorkspaceIntent = "read"
+	WorkspaceIntentWrite WorkspaceIntent = "write"
+)
+
+func (i WorkspaceIntent) Validate() error {
+	switch i {
+	case WorkspaceIntentRead, WorkspaceIntentWrite:
+		return nil
+	default:
+		return fmt.Errorf("unsupported workspace intent %q", i)
+	}
+}
+
+type ModelTokenLimits struct {
+	Context int64 `json:"context"`
+	Output  int64 `json:"output"`
+}
+
+func (l ModelTokenLimits) Validate() error {
+	if l.Context <= 0 {
+		return fmt.Errorf("model context limit must be positive")
+	}
+	if l.Output <= 0 {
+		return fmt.Errorf("model output limit must be positive")
+	}
+	if l.Context <= l.Output {
+		return fmt.Errorf("model context limit must exceed output limit")
+	}
+	return nil
+}
+
+type RuntimeProfile struct {
+	ACPProfile               string            `json:"acpProfile"`
+	AdapterDigests           map[string]string `json:"adapterDigests"`
+	ProviderKind             string            `json:"providerKind"`
+	Model                    string            `json:"model"`
+	ModelLimits              *ModelTokenLimits `json:"modelLimits,omitempty"`
+	AgentConfigurationDigest string            `json:"agentConfigurationDigest"`
+	ToolPolicyDigest         string            `json:"toolPolicyDigest"`
+	ApprovalPolicyDigest     string            `json:"approvalPolicyDigest"`
+	MCPConfigurationDigest   string            `json:"mcpConfigurationDigest"`
+	WorkspaceIntent          WorkspaceIntent   `json:"workspaceIntent"`
+	ProxyCredentialRole      string            `json:"proxyCredentialRole"`
+	ProxyCredentialScope     string            `json:"proxyCredentialScope"`
+	ResourceClass            string            `json:"resourceClass"`
+}
+
+func (p RuntimeProfile) Validate() error {
+	if p.ACPProfile != ACPProfileV1 {
+		return fmt.Errorf("ACP profile %q is unsupported; want %q", p.ACPProfile, ACPProfileV1)
+	}
+	if len(p.AdapterDigests) == 0 || len(p.AdapterDigests) > 32 {
+		return fmt.Errorf("adapter digest count must be in range 1..32")
+	}
+	for name, digest := range p.AdapterDigests {
+		if err := validateBoundedString("adapter name", name, true, 128); err != nil {
+			return err
+		}
+		if err := validateSHA256Digest(digest); err != nil {
+			return fmt.Errorf("adapter %q digest: %w", name, err)
+		}
+	}
+	if err := validateBoundedString("provider kind", p.ProviderKind, true, 128); err != nil {
+		return err
+	}
+	if err := validateBoundedString("model", p.Model, true, 256); err != nil {
+		return err
+	}
+	if p.ModelLimits != nil {
+		if err := p.ModelLimits.Validate(); err != nil {
+			return err
+		}
+	}
+	for name, digest := range map[string]string{
+		"agent configuration digest": p.AgentConfigurationDigest,
+		"tool policy digest":         p.ToolPolicyDigest,
+		"approval policy digest":     p.ApprovalPolicyDigest,
+		"MCP configuration digest":   p.MCPConfigurationDigest,
+	} {
+		if err := validateSHA256Digest(digest); err != nil {
+			return fmt.Errorf("%s: %w", name, err)
+		}
+	}
+	if err := p.WorkspaceIntent.Validate(); err != nil {
+		return err
+	}
+	if err := validateBoundedString("proxy credential role", p.ProxyCredentialRole, true, 256); err != nil {
+		return err
+	}
+	if err := validateBoundedString("proxy credential scope", p.ProxyCredentialScope, true, 1024); err != nil {
+		return err
+	}
+	return validateBoundedString("resource class", p.ResourceClass, true, 128)
+}
+
+const (
+	MinAgentMaxTurns          int32 = 1
+	MaxAgentMaxTurns          int32 = 1000
+	MaxAgentSystemPromptBytes       = 256 << 10
+
+	providerKindCodex     = "codex"
+	providerKindClaude    = "claude"
+	providerKindCopilot   = "copilot"
+	reasoningEffortLow    = "low"
+	reasoningEffortMedium = "medium"
+	reasoningEffortHigh   = "high"
+	reasoningEffortXHigh  = "xhigh"
+	reasoningEffortMax    = "max"
+)
+
+// AgentSessionConfiguration is the resolved, non-secret Agent configuration
+// frozen into one RuntimeSession. Its canonical digest must match the
+// RuntimeProfile AgentConfigurationDigest.
+type AgentSessionConfiguration struct {
+	AgentUID        string `json:"agentUID"`
+	AgentGeneration int64  `json:"agentGeneration"`
+	ProviderKind    string `json:"providerKind"`
+	Model           string `json:"model"`
+	MaxTurns        int32  `json:"maxTurns"`
+	ReasoningEffort string `json:"reasoningEffort,omitempty"`
+	SystemPrompt    string `json:"systemPrompt,omitempty"`
+}
+
+func (c AgentSessionConfiguration) Validate() error {
+	if err := requireIdentifier("agent UID", c.AgentUID); err != nil {
+		return err
+	}
+	if c.AgentGeneration <= 0 {
+		return fmt.Errorf("agent generation must be positive")
+	}
+	if err := validateBoundedString("provider kind", c.ProviderKind, true, 128); err != nil {
+		return err
+	}
+	if err := validateBoundedString("model", c.Model, true, 256); err != nil {
+		return err
+	}
+	if err := validateAgentExecutionControls(c.ProviderKind, c.MaxTurns, c.ReasoningEffort); err != nil {
+		return err
+	}
+	return validateBoundedString("agent system prompt", c.SystemPrompt, false, MaxAgentSystemPromptBytes)
+}
+
+func (c AgentSessionConfiguration) ValidateProfile(profile RuntimeProfile) error {
+	if err := c.Validate(); err != nil {
+		return err
+	}
+	if c.ProviderKind != profile.ProviderKind {
+		return fmt.Errorf("agent configuration provider kind %q does not match runtime profile provider kind %q", c.ProviderKind, profile.ProviderKind)
+	}
+	if c.Model != profile.Model {
+		return fmt.Errorf("agent configuration model %q does not match runtime profile model %q", c.Model, profile.Model)
+	}
+	digest, err := CanonicalAgentConfigurationDigest(c)
+	if err != nil {
+		return fmt.Errorf("canonical agent configuration digest: %w", err)
+	}
+	if digest != profile.AgentConfigurationDigest {
+		return fmt.Errorf("agent configuration digest mismatch: got %q, want %q", profile.AgentConfigurationDigest, digest)
+	}
+	return nil
+}
+
+func (c AgentSessionConfiguration) ValidateProfileOrLegacy(profile RuntimeProfile, allowBash bool) error {
+	if c.ProviderKind != profile.ProviderKind {
+		return fmt.Errorf("agent configuration provider kind %q does not match runtime profile provider kind %q", c.ProviderKind, profile.ProviderKind)
+	}
+	if c.Model != profile.Model {
+		return fmt.Errorf("agent configuration model %q does not match runtime profile model %q", c.Model, profile.Model)
+	}
+	canonicalErr := c.ValidateProfile(profile)
+	if canonicalErr == nil {
+		return nil
+	}
+	legacyDigest, legacyErr := CanonicalLegacyAgentConfigurationDigest(c, allowBash)
+	if legacyErr != nil {
+		return canonicalErr
+	}
+	if legacyDigest != profile.AgentConfigurationDigest {
+		return canonicalErr
+	}
+	return nil
+}
+
+func validateAgentExecutionControls(providerKind string, maxTurns int32, reasoningEffort string) error {
+	if maxTurns < MinAgentMaxTurns || maxTurns > MaxAgentMaxTurns {
+		return fmt.Errorf("max turns must be in range %d..%d", MinAgentMaxTurns, MaxAgentMaxTurns)
+	}
+	if err := validateBoundedString("reasoning effort", reasoningEffort, false, 16); err != nil {
+		return err
+	}
+	switch reasoningEffort {
+	case "", reasoningEffortLow, reasoningEffortMedium, reasoningEffortHigh, reasoningEffortXHigh, reasoningEffortMax:
+	default:
+		return fmt.Errorf("unsupported reasoning effort %q", reasoningEffort)
+	}
+	switch providerKind {
+	case providerKindCodex:
+		if reasoningEffort == reasoningEffortMax {
+			return fmt.Errorf("codex provider does not support reasoning effort %q", reasoningEffort)
+		}
+	case providerKindClaude:
+	case providerKindCopilot:
+		if reasoningEffort != "" {
+			return fmt.Errorf("copilot provider does not support reasoning effort")
+		}
+	default:
+		if reasoningEffort != "" {
+			return fmt.Errorf("provider %q does not support reasoning effort", providerKind)
+		}
+	}
+	return nil
+}
+
+type ArtifactReference struct {
+	ArtifactID ArtifactID `json:"artifactID"`
+	Digest     string     `json:"digest"`
+	SizeBytes  int64      `json:"sizeBytes"`
+	MediaType  string     `json:"mediaType"`
+}
+
+func (a ArtifactReference) Validate() error {
+	if err := requireIdentifier("artifact ID", string(a.ArtifactID)); err != nil {
+		return err
+	}
+	if err := validateSHA256Digest(a.Digest); err != nil {
+		return fmt.Errorf("artifact digest: %w", err)
+	}
+	if a.SizeBytes < 0 {
+		return fmt.Errorf("artifact size must be non-negative")
+	}
+	return validateBoundedString("artifact media type", a.MediaType, true, 256)
+}
+
+type WorkspaceBaseline struct {
+	RepositoryIdentity string             `json:"repositoryIdentity"`
+	Revision           string             `json:"revision"`
+	TreeDigest         string             `json:"treeDigest"`
+	Artifact           *ArtifactReference `json:"artifact,omitempty"`
+}
+
+func (b WorkspaceBaseline) Validate() error {
+	if err := validateBoundedString("repository identity", b.RepositoryIdentity, true, 1024); err != nil {
+		return err
+	}
+	if err := validateBoundedString("workspace revision", b.Revision, true, 512); err != nil {
+		return err
+	}
+	if err := validateSHA256Digest(b.TreeDigest); err != nil {
+		return fmt.Errorf("workspace tree digest: %w", err)
+	}
+	if b.Artifact != nil {
+		if err := b.Artifact.Validate(); err != nil {
+			return fmt.Errorf("workspace artifact: %w", err)
+		}
+	}
+	return nil
+}
+
+type WorkspaceSpec struct {
+	Intent       WorkspaceIntent   `json:"intent"`
+	Baseline     WorkspaceBaseline `json:"baseline"`
+	RelativeRoot string            `json:"relativeRoot,omitempty"`
+}
+
+func (w WorkspaceSpec) Validate() error {
+	if err := w.Intent.Validate(); err != nil {
+		return err
+	}
+	if err := w.Baseline.Validate(); err != nil {
+		return err
+	}
+	return validateWorkspaceRelativeRoot(w.RelativeRoot)
+}
+
+func validateWorkspaceRelativeRoot(value string) error {
+	root := strings.TrimSpace(value)
+	if root == "" || root == "." {
+		return nil
+	}
+	if strings.HasPrefix(root, "/") || strings.Contains(root, "\\") {
+		return fmt.Errorf("workspace relative root must be a relative slash-separated path")
+	}
+	for segment := range strings.SplitSeq(root, "/") {
+		if segment == "" || segment == "." || segment == ".." {
+			return fmt.Errorf("workspace relative root contains unsafe segment %q", segment)
+		}
+	}
+	return validateBoundedString("workspace relative root", root, true, 1024)
+}
+
+type ArtifactAuthorization struct {
+	Capability    string `json:"capability"`
+	RequestDigest string `json:"requestDigest"`
+}
+
+func (a ArtifactAuthorization) Validate() error {
+	if err := validateBoundedString("artifact capability", a.Capability, true, 16<<10); err != nil {
+		return err
+	}
+	return validateSHA256Digest(a.RequestDigest)
+}
+
+type SessionBootstrap struct {
+	TranscriptArtifact *ArtifactReference `json:"transcriptArtifact,omitempty"`
+	TranscriptDigest   string             `json:"transcriptDigest,omitempty"`
+	MessageCount       uint32             `json:"messageCount,omitempty"`
+}
+
+func (b SessionBootstrap) Validate() error {
+	if b.TranscriptArtifact == nil {
+		if b.TranscriptDigest != "" || b.MessageCount != 0 {
+			return fmt.Errorf("transcript digest and message count require transcript artifact")
+		}
+		return nil
+	}
+	if err := b.TranscriptArtifact.Validate(); err != nil {
+		return fmt.Errorf("transcript artifact: %w", err)
+	}
+	if err := validateSHA256Digest(b.TranscriptDigest); err != nil {
+		return fmt.Errorf("transcript digest: %w", err)
+	}
+	return nil
+}
+
+type CreateRuntimeSessionRequest struct {
+	Protocol                       string                     `json:"protocol"`
+	Metadata                       MutationMetadata           `json:"metadata"`
+	RuntimeSessionID               RuntimeSessionID           `json:"runtimeSessionID"`
+	Profile                        RuntimeProfile             `json:"profile"`
+	AgentConfiguration             *AgentSessionConfiguration `json:"agentConfiguration,omitempty"`
+	MCPConfiguration               MCPPolicyConfiguration     `json:"mcpConfiguration"`
+	Workspace                      WorkspaceSpec              `json:"workspace"`
+	WorkspaceArtifactAuthorization *ArtifactAuthorization     `json:"workspaceArtifactAuthorization,omitempty"`
+	Bootstrap                      *SessionBootstrap          `json:"bootstrap,omitempty"`
+	BootstrapArtifactAuthorization *ArtifactAuthorization     `json:"bootstrapArtifactAuthorization,omitempty"`
+}
+
+func (r CreateRuntimeSessionRequest) ValidateAt(now time.Time) error {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return err
+	}
+	if err := r.Metadata.validateAt(now, metadataRequirements{session: true, task: true}); err != nil {
+		return fmt.Errorf("metadata: %w", err)
+	}
+	if err := requireIdentifier("runtime session ID", string(r.RuntimeSessionID)); err != nil {
+		return err
+	}
+	if err := r.Profile.Validate(); err != nil {
+		return fmt.Errorf("runtime profile: %w", err)
+	}
+	profileDigest, err := CanonicalProfileDigest(r.Profile)
+	if err != nil {
+		return fmt.Errorf("runtime profile digest: %w", err)
+	}
+	if profileDigest != r.Metadata.Fence.RuntimeProfileDigest {
+		return fmt.Errorf("runtime profile digest mismatch: got %q, want %q", r.Metadata.Fence.RuntimeProfileDigest, profileDigest)
+	}
+	if err := r.MCPConfiguration.ValidateProfile(r.Profile); err != nil {
+		return fmt.Errorf("MCP configuration: %w", err)
+	}
+	if r.AgentConfiguration != nil {
+		if err := r.AgentConfiguration.ValidateProfileOrLegacy(r.Profile, r.MCPConfiguration.ToolPolicy.AllowBash); err != nil {
+			return fmt.Errorf("agent configuration: %w", err)
+		}
+	}
+	if err := r.Workspace.Validate(); err != nil {
+		return fmt.Errorf("workspace: %w", err)
+	}
+	if r.Workspace.Baseline.Artifact != nil {
+		if r.WorkspaceArtifactAuthorization == nil {
+			return fmt.Errorf("workspace artifact authorization is required")
+		}
+		if err := r.WorkspaceArtifactAuthorization.Validate(); err != nil {
+			return fmt.Errorf("workspace artifact authorization: %w", err)
+		}
+	} else if r.WorkspaceArtifactAuthorization != nil {
+		return fmt.Errorf("workspace artifact authorization requires a workspace artifact")
+	}
+	if r.Workspace.Intent != r.Profile.WorkspaceIntent {
+		return fmt.Errorf("workspace intent %q does not match runtime profile intent %q", r.Workspace.Intent, r.Profile.WorkspaceIntent)
+	}
+	if r.Bootstrap != nil {
+		if err := r.Bootstrap.Validate(); err != nil {
+			return fmt.Errorf("bootstrap: %w", err)
+		}
+	}
+	if r.Bootstrap != nil && r.Bootstrap.TranscriptArtifact != nil {
+		if r.BootstrapArtifactAuthorization == nil {
+			return fmt.Errorf("bootstrap artifact authorization is required")
+		}
+		if err := r.BootstrapArtifactAuthorization.Validate(); err != nil {
+			return fmt.Errorf("bootstrap artifact authorization: %w", err)
+		}
+	} else if r.BootstrapArtifactAuthorization != nil {
+		return fmt.Errorf("bootstrap artifact authorization requires a transcript artifact")
+	}
+	return r.Metadata.ValidateDigest(r)
+}
+
+type RuntimeSessionDescriptor struct {
+	RuntimeSessionID     RuntimeSessionID    `json:"runtimeSessionID"`
+	RuntimeSessionUID    RuntimeSessionUID   `json:"runtimeSessionUID"`
+	Generation           uint64              `json:"generation"`
+	RuntimeInstanceID    RuntimeInstanceID   `json:"runtimeInstanceID"`
+	SupervisorBootID     SupervisorBootID    `json:"supervisorBootID"`
+	RuntimeProfileDigest ProfileDigest       `json:"runtimeProfileDigest"`
+	State                RuntimeSessionState `json:"state"`
+	ProviderSessionID    string              `json:"providerSessionID"`
+	WorkspaceBaseline    WorkspaceBaseline   `json:"workspaceBaseline"`
+	CreatedAt            time.Time           `json:"createdAt"`
+	LastTransitionAt     time.Time           `json:"lastTransitionAt"`
+}
+
+func (d RuntimeSessionDescriptor) Validate() error {
+	if err := requireIdentifier("runtime session ID", string(d.RuntimeSessionID)); err != nil {
+		return err
+	}
+	if err := requireIdentifier("runtime session UID", string(d.RuntimeSessionUID)); err != nil {
+		return err
+	}
+	if d.Generation == 0 {
+		return fmt.Errorf("runtime session generation must be positive")
+	}
+	if err := requireIdentifier("runtime instance ID", string(d.RuntimeInstanceID)); err != nil {
+		return err
+	}
+	if err := requireIdentifier("supervisor boot ID", string(d.SupervisorBootID)); err != nil {
+		return err
+	}
+	if err := ValidateProfileDigest(d.RuntimeProfileDigest); err != nil {
+		return fmt.Errorf("runtime profile digest: %w", err)
+	}
+	if !IsKnownRuntimeSessionState(d.State) {
+		return fmt.Errorf("unsupported runtime session state %q", d.State)
+	}
+	if err := validateBoundedString("provider session ID", d.ProviderSessionID, true, 1024); err != nil {
+		return err
+	}
+	if err := d.WorkspaceBaseline.Validate(); err != nil {
+		return err
+	}
+	if err := validateTimestamp("created timestamp", d.CreatedAt); err != nil {
+		return err
+	}
+	if err := validateTimestamp("last transition timestamp", d.LastTransitionAt); err != nil {
+		return err
+	}
+	if d.LastTransitionAt.Before(d.CreatedAt) {
+		return fmt.Errorf("last transition timestamp precedes creation")
+	}
+	return nil
+}
+
+type CreateRuntimeSessionResponse struct {
+	Protocol       string                   `json:"protocol"`
+	Classification Classification           `json:"classification"`
+	Session        RuntimeSessionDescriptor `json:"session"`
+}
+
+func (r CreateRuntimeSessionResponse) ValidateFor(request CreateRuntimeSessionRequest) error {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return err
+	}
+	switch r.Classification.Class {
+	case RequestClassificationFresh, RequestClassificationDuplicate:
+	default:
+		return fmt.Errorf("session create response classification %q is invalid", r.Classification.Class)
+	}
+	if err := r.Classification.Validate(); err != nil {
+		return fmt.Errorf("classification: %w", err)
+	}
+	if err := r.Session.Validate(); err != nil {
+		return fmt.Errorf("session descriptor: %w", err)
+	}
+	if r.Session.State != RuntimeSessionStateIdle {
+		return fmt.Errorf("session create must return initialized idle session, got %q", r.Session.State)
+	}
+	if r.Session.RuntimeSessionID != request.RuntimeSessionID ||
+		r.Session.RuntimeSessionUID != request.Metadata.Fence.RuntimeSessionUID ||
+		r.Session.Generation != request.Metadata.Fence.RuntimeSessionGeneration ||
+		r.Session.RuntimeProfileDigest != request.Metadata.Fence.RuntimeProfileDigest {
+		return fmt.Errorf("session create response identity does not match request")
+	}
+	return nil
+}
+
+type PublicationTerminalState string
+
+const (
+	PublicationTerminalVerifiedExact          PublicationTerminalState = "verified_exact"
+	PublicationTerminalDeliveredSuperseded    PublicationTerminalState = "delivered_superseded"
+	PublicationTerminalCancelledBeforePublish PublicationTerminalState = "cancelled_before_publish"
+	PublicationTerminalDeliveryConflict       PublicationTerminalState = "delivery_conflict"
+	PublicationTerminalCredentialBlocked      PublicationTerminalState = "credential_blocked"
+	PublicationTerminalPreparationFailed      PublicationTerminalState = "preparation_failed"
+	PublicationTerminalOutcomeUnknown         PublicationTerminalState = "outcome_unknown"
+)
+
+func (s PublicationTerminalState) Validate() error {
+	switch s {
+	case PublicationTerminalVerifiedExact, PublicationTerminalDeliveredSuperseded,
+		PublicationTerminalCancelledBeforePublish, PublicationTerminalDeliveryConflict,
+		PublicationTerminalCredentialBlocked, PublicationTerminalPreparationFailed, PublicationTerminalOutcomeUnknown:
+		return nil
+	default:
+		return fmt.Errorf("unsupported terminal publication state %q", s)
+	}
+}
+
+type FinalizeRuntimeSessionPublicationRequest struct {
+	Protocol              string                   `json:"protocol"`
+	Metadata              MutationMetadata         `json:"metadata"`
+	WorkspaceDeltaID      WorkspaceDeltaID         `json:"workspaceDeltaID"`
+	PublicationID         string                   `json:"publicationID"`
+	PublicationGeneration uint64                   `json:"publicationGeneration"`
+	PublicationVersion    uint64                   `json:"publicationVersion"`
+	TerminalState         PublicationTerminalState `json:"terminalState"`
+	TerminalReceiptDigest string                   `json:"terminalReceiptDigest"`
+}
+
+func (r FinalizeRuntimeSessionPublicationRequest) ValidateAt(now time.Time) error {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return err
+	}
+	if err := r.Metadata.validateAt(now, metadataRequirements{session: true, task: true, prompt: true}); err != nil {
+		return fmt.Errorf("metadata: %w", err)
+	}
+	if err := requireIdentifier("workspace delta ID", string(r.WorkspaceDeltaID)); err != nil {
+		return err
+	}
+	if err := validateBoundedString("publication ID", r.PublicationID, true, 253); err != nil {
+		return err
+	}
+	if r.PublicationGeneration == 0 || r.PublicationVersion == 0 {
+		return fmt.Errorf("publication generation and version must be positive")
+	}
+	if err := r.TerminalState.Validate(); err != nil {
+		return err
+	}
+	if err := validateSHA256Digest(r.TerminalReceiptDigest); err != nil {
+		return fmt.Errorf("terminal publication receipt digest: %w", err)
+	}
+	return r.Metadata.ValidateDigest(r)
+}
+
+type PublicationFinalizationReceipt struct {
+	WorkspaceDeltaID      WorkspaceDeltaID         `json:"workspaceDeltaID"`
+	PublicationID         string                   `json:"publicationID"`
+	PublicationGeneration uint64                   `json:"publicationGeneration"`
+	PublicationVersion    uint64                   `json:"publicationVersion"`
+	TerminalState         PublicationTerminalState `json:"terminalState"`
+	TerminalReceiptDigest string                   `json:"terminalReceiptDigest"`
+	AppliedAt             time.Time                `json:"appliedAt"`
+}
+
+func (r PublicationFinalizationReceipt) Validate() error {
+	request := FinalizeRuntimeSessionPublicationRequest{
+		Protocol: ProtocolVersion, WorkspaceDeltaID: r.WorkspaceDeltaID, PublicationID: r.PublicationID,
+		PublicationGeneration: r.PublicationGeneration, PublicationVersion: r.PublicationVersion,
+		TerminalState: r.TerminalState, TerminalReceiptDigest: r.TerminalReceiptDigest,
+	}
+	if err := requireIdentifier("workspace delta ID", string(request.WorkspaceDeltaID)); err != nil {
+		return err
+	}
+	if err := validateBoundedString("publication ID", request.PublicationID, true, 253); err != nil {
+		return err
+	}
+	if request.PublicationGeneration == 0 || request.PublicationVersion == 0 {
+		return fmt.Errorf("publication generation and version must be positive")
+	}
+	if err := request.TerminalState.Validate(); err != nil {
+		return err
+	}
+	if err := validateSHA256Digest(request.TerminalReceiptDigest); err != nil {
+		return fmt.Errorf("terminal publication receipt digest: %w", err)
+	}
+	return validateTimestamp("publication finalization applied timestamp", r.AppliedAt)
+}
+
+type FinalizeRuntimeSessionPublicationResponse struct {
+	Protocol       string                         `json:"protocol"`
+	Classification Classification                 `json:"classification"`
+	Session        RuntimeSessionDescriptor       `json:"session"`
+	Finalization   PublicationFinalizationReceipt `json:"finalization"`
+}
+
+func (r FinalizeRuntimeSessionPublicationResponse) ValidateFor(request FinalizeRuntimeSessionPublicationRequest) error {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return err
+	}
+	switch r.Classification.Class {
+	case RequestClassificationFresh, RequestClassificationDuplicate:
+	default:
+		return fmt.Errorf("publication finalization response classification %q is invalid", r.Classification.Class)
+	}
+	if err := r.Classification.Validate(); err != nil {
+		return fmt.Errorf("classification: %w", err)
+	}
+	if err := r.Session.Validate(); err != nil {
+		return fmt.Errorf("session descriptor: %w", err)
+	}
+	if r.Session.State != RuntimeSessionStateFinalizing {
+		return fmt.Errorf("publication finalization must return finalizing session, got %q", r.Session.State)
+	}
+	if r.Session.RuntimeSessionUID != request.Metadata.Fence.RuntimeSessionUID ||
+		r.Session.Generation != request.Metadata.Fence.RuntimeSessionGeneration ||
+		r.Session.RuntimeProfileDigest != request.Metadata.Fence.RuntimeProfileDigest {
+		return fmt.Errorf("publication finalization response identity does not match request")
+	}
+	if err := r.Finalization.Validate(); err != nil {
+		return fmt.Errorf("publication finalization receipt: %w", err)
+	}
+	if r.Finalization.WorkspaceDeltaID != request.WorkspaceDeltaID || r.Finalization.PublicationID != request.PublicationID ||
+		r.Finalization.PublicationGeneration != request.PublicationGeneration || r.Finalization.PublicationVersion != request.PublicationVersion ||
+		r.Finalization.TerminalState != request.TerminalState || r.Finalization.TerminalReceiptDigest != request.TerminalReceiptDigest {
+		return fmt.Errorf("publication finalization receipt does not match request")
+	}
+	return nil
+}
+
+type DeleteRuntimeSessionRequest struct {
+	Protocol string           `json:"protocol"`
+	Metadata MutationMetadata `json:"metadata"`
+	Reason   string           `json:"reason,omitempty"`
+}
+
+func (r DeleteRuntimeSessionRequest) ValidateAt(now time.Time) error {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return err
+	}
+	if err := r.Metadata.validateAt(now, metadataRequirements{session: true}); err != nil {
+		return fmt.Errorf("metadata: %w", err)
+	}
+	if err := validateBoundedString("delete reason", r.Reason, false, MaxDiagnosticBytes); err != nil {
+		return err
+	}
+	return r.Metadata.ValidateDigest(r)
+}
+
+type DeleteRuntimeSessionResponse struct {
+	Protocol       string                  `json:"protocol"`
+	Classification Classification          `json:"classification"`
+	State          RuntimeSessionState     `json:"state"`
+	Tombstone      RuntimeSessionTombstone `json:"tombstone"`
+}
+
+func (r DeleteRuntimeSessionResponse) Validate() error {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return err
+	}
+	if err := r.Classification.Validate(); err != nil {
+		return fmt.Errorf("classification: %w", err)
+	}
+	if r.State != RuntimeSessionStateDeleted {
+		return fmt.Errorf("delete response state must be deleted")
+	}
+	if err := r.Tombstone.Validate(); err != nil {
+		return fmt.Errorf("tombstone: %w", err)
+	}
+	return nil
+}
+
+func (r DeleteRuntimeSessionResponse) ValidateFor(request DeleteRuntimeSessionRequest) error {
+	if err := r.Validate(); err != nil {
+		return err
+	}
+	switch r.Classification.Class {
+	case RequestClassificationFresh:
+	case RequestClassificationDuplicate:
+		if r.Classification.Phase != OperationPhaseDeleted {
+			return fmt.Errorf("duplicate delete response must replay deleted phase, got %q", r.Classification.Phase)
+		}
+	default:
+		return fmt.Errorf("delete response classification %q is invalid", r.Classification.Class)
+	}
+	if r.Tombstone.RuntimeSessionUID != request.Metadata.Fence.RuntimeSessionUID ||
+		r.Tombstone.RuntimeSessionGeneration != request.Metadata.Fence.RuntimeSessionGeneration ||
+		r.Tombstone.RuntimeProfileDigest != request.Metadata.Fence.RuntimeProfileDigest {
+		return fmt.Errorf("delete tombstone identity does not match request fence")
+	}
+	for i := range r.Tombstone.Operations {
+		operation := r.Tombstone.Operations[i]
+		if operation.OperationID != request.Metadata.OperationID {
+			continue
+		}
+		if operation.RequestDigest != request.Metadata.RequestDigest {
+			return fmt.Errorf("delete tombstone operation digest does not match request")
+		}
+		if operation.Phase != OperationPhaseDeleted {
+			return fmt.Errorf("delete tombstone operation phase must be deleted, got %q", operation.Phase)
+		}
+		return nil
+	}
+	return fmt.Errorf("delete tombstone does not contain the request operation")
+}
+
+type DrainRequest struct {
+	Protocol string           `json:"protocol"`
+	Metadata MutationMetadata `json:"metadata"`
+	Reason   string           `json:"reason,omitempty"`
+}
+
+func (r DrainRequest) ValidateAt(now time.Time) error {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return err
+	}
+	if err := r.Metadata.validateAt(now, metadataRequirements{}); err != nil {
+		return fmt.Errorf("metadata: %w", err)
+	}
+	if r.Metadata.Fence.RuntimeSessionUID != "" || r.Metadata.Fence.RuntimeSessionGeneration != 0 {
+		return fmt.Errorf("drain request must use a pool-wide fence without runtime session identity")
+	}
+	if r.Metadata.TaskUID != "" || r.Metadata.PromptID != "" {
+		return fmt.Errorf("drain request must not carry task or prompt identity")
+	}
+	if err := validateBoundedString("drain reason", r.Reason, false, MaxDiagnosticBytes); err != nil {
+		return err
+	}
+	return r.Metadata.ValidateDigest(r)
+}
+
+type DrainResponse struct {
+	Protocol       string         `json:"protocol"`
+	Classification Classification `json:"classification"`
+	Drain          DrainStatus    `json:"drain"`
+}
+
+func (r DrainResponse) Validate() error {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return err
+	}
+	if err := r.Classification.Validate(); err != nil {
+		return fmt.Errorf("classification: %w", err)
+	}
+	if !r.Drain.Requested || r.Drain.AcceptingNewSessions {
+		return fmt.Errorf("drain response must report requested drain with admission disabled")
+	}
+	return validateTimestamp("drain request timestamp", r.Drain.RequestedAt)
+}
diff --git a/internal/harness/v2/session_prompt_workspace_test.go b/internal/harness/v2/session_prompt_workspace_test.go
new file mode 100644
index 000000000..ce4c48643
--- /dev/null
+++ b/internal/harness/v2/session_prompt_workspace_test.go
@@ -0,0 +1,570 @@
+package v2
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestCreateRuntimeSessionRequestAndResponseValidation(t *testing.T) {
+	profile := testRuntimeProfile()
+	request := CreateRuntimeSessionRequest{
+		Protocol:           ProtocolVersion,
+		Metadata:           testMutationMetadata(t, false),
+		RuntimeSessionID:   "runtime-session-1",
+		Profile:            profile,
+		AgentConfiguration: testAgentSessionConfigurationPointer(),
+		MCPConfiguration:   testMCPPolicyConfiguration(),
+		Workspace: WorkspaceSpec{
+			Intent:   WorkspaceIntentWrite,
+			Baseline: testWorkspaceBaseline(),
+		},
+	}
+	sealRequest(t, request, &request.Metadata.RequestDigest)
+	if err := request.ValidateAt(testNow); err != nil {
+		t.Fatalf("CreateRuntimeSessionRequest.ValidateAt() error = %v", err)
+	}
+
+	response := CreateRuntimeSessionResponse{
+		Protocol:       ProtocolVersion,
+		Classification: Classification{Class: RequestClassificationFresh},
+		Session: RuntimeSessionDescriptor{
+			RuntimeSessionID:     request.RuntimeSessionID,
+			RuntimeSessionUID:    request.Metadata.Fence.RuntimeSessionUID,
+			Generation:           request.Metadata.Fence.RuntimeSessionGeneration,
+			RuntimeInstanceID:    request.Metadata.Fence.RuntimeInstanceID,
+			SupervisorBootID:     request.Metadata.Fence.SupervisorBootID,
+			RuntimeProfileDigest: request.Metadata.Fence.RuntimeProfileDigest,
+			State:                RuntimeSessionStateIdle,
+			ProviderSessionID:    "provider-session-1",
+			WorkspaceBaseline:    request.Workspace.Baseline,
+			CreatedAt:            testNow,
+			LastTransitionAt:     testNow,
+		},
+	}
+	if err := response.ValidateFor(request); err != nil {
+		t.Fatalf("CreateRuntimeSessionResponse.ValidateFor() error = %v", err)
+	}
+
+	request.Profile.Model = "changed-after-seal"
+	if err := request.ValidateAt(testNow); err == nil {
+		t.Fatal("mutated sealed session request passed validation")
+	}
+}
+
+func TestAgentSessionConfigurationValidation(t *testing.T) {
+	base := testAgentSessionConfiguration()
+	if err := base.Validate(); err != nil {
+		t.Fatalf("AgentSessionConfiguration.Validate() error = %v", err)
+	}
+	claudeMax := base
+	claudeMax.ProviderKind = "claude"
+	claudeMax.ReasoningEffort = "max"
+	if err := claudeMax.Validate(); err != nil {
+		t.Fatalf("Claude max reasoning effort validation error = %v", err)
+	}
+	maximumPrompt := base
+	maximumPrompt.SystemPrompt = strings.Repeat("x", MaxAgentSystemPromptBytes)
+	if err := maximumPrompt.Validate(); err != nil {
+		t.Fatalf("maximum-size system prompt validation error = %v", err)
+	}
+
+	tests := []struct {
+		name    string
+		mutate  func(*AgentSessionConfiguration)
+		wantErr string
+	}{
+		{name: "missing agent UID", mutate: func(configuration *AgentSessionConfiguration) { configuration.AgentUID = "" }, wantErr: "agent UID is required"},
+		{name: "non-positive generation", mutate: func(configuration *AgentSessionConfiguration) { configuration.AgentGeneration = 0 }, wantErr: "generation must be positive"},
+		{name: "missing provider", mutate: func(configuration *AgentSessionConfiguration) { configuration.ProviderKind = "" }, wantErr: "provider kind is required"},
+		{name: "missing model", mutate: func(configuration *AgentSessionConfiguration) { configuration.Model = "" }, wantErr: "model is required"},
+		{name: "zero max turns", mutate: func(configuration *AgentSessionConfiguration) { configuration.MaxTurns = 0 }, wantErr: "range 1..1000"},
+		{name: "excess max turns", mutate: func(configuration *AgentSessionConfiguration) { configuration.MaxTurns = MaxAgentMaxTurns + 1 }, wantErr: "range 1..1000"},
+		{name: "unsupported effort", mutate: func(configuration *AgentSessionConfiguration) { configuration.ReasoningEffort = "extreme" }, wantErr: "unsupported reasoning effort"},
+		{name: "codex max effort", mutate: func(configuration *AgentSessionConfiguration) { configuration.ReasoningEffort = "max" }, wantErr: "codex provider does not support"},
+		{name: "copilot effort", mutate: func(configuration *AgentSessionConfiguration) {
+			configuration.ProviderKind = "copilot"
+			configuration.ReasoningEffort = "high"
+		}, wantErr: "copilot provider does not support"},
+		{name: "custom provider effort", mutate: func(configuration *AgentSessionConfiguration) { configuration.ProviderKind = "custom" }, wantErr: "does not support reasoning effort"},
+		{name: "oversized system prompt", mutate: func(configuration *AgentSessionConfiguration) {
+			configuration.SystemPrompt = strings.Repeat("x", MaxAgentSystemPromptBytes+1)
+		}, wantErr: "agent system prompt exceeds"},
+		{name: "invalid UTF-8 system prompt", mutate: func(configuration *AgentSessionConfiguration) {
+			configuration.SystemPrompt = string([]byte{0xff})
+		}, wantErr: "invalid UTF-8"},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			configuration := base
+			test.mutate(&configuration)
+			if err := configuration.Validate(); err == nil || !strings.Contains(err.Error(), test.wantErr) {
+				t.Fatalf("AgentSessionConfiguration.Validate() error = %v, want %q", err, test.wantErr)
+			}
+		})
+	}
+}
+
+func TestCreateRuntimeSessionRequestRejectsAgentConfigurationDrift(t *testing.T) {
+	newRequest := func() CreateRuntimeSessionRequest {
+		request := CreateRuntimeSessionRequest{
+			Protocol:           ProtocolVersion,
+			Metadata:           testMutationMetadata(t, false),
+			RuntimeSessionID:   "runtime-session-1",
+			Profile:            testRuntimeProfile(),
+			AgentConfiguration: testAgentSessionConfigurationPointer(),
+			MCPConfiguration:   testMCPPolicyConfiguration(),
+			Workspace: WorkspaceSpec{
+				Intent:   WorkspaceIntentWrite,
+				Baseline: testWorkspaceBaseline(),
+			},
+		}
+		return request
+	}
+
+	tests := []struct {
+		name    string
+		mutate  func(*CreateRuntimeSessionRequest)
+		wantErr string
+	}{
+		{name: "canonical digest", mutate: func(request *CreateRuntimeSessionRequest) {
+			request.AgentConfiguration.SystemPrompt += " drift"
+		}, wantErr: "agent configuration digest mismatch"},
+		{name: "provider", mutate: func(request *CreateRuntimeSessionRequest) {
+			request.AgentConfiguration.ProviderKind = "claude"
+		}, wantErr: "does not match runtime profile provider kind"},
+		{name: "model", mutate: func(request *CreateRuntimeSessionRequest) {
+			request.AgentConfiguration.Model = "other-model"
+		}, wantErr: "does not match runtime profile model"},
+		{name: "max turns", mutate: func(request *CreateRuntimeSessionRequest) {
+			request.AgentConfiguration.MaxTurns++
+		}, wantErr: "agent configuration digest mismatch"},
+		{name: "reasoning effort", mutate: func(request *CreateRuntimeSessionRequest) {
+			request.AgentConfiguration.ReasoningEffort = reasoningEffortMedium
+		}, wantErr: "agent configuration digest mismatch"},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			request := newRequest()
+			test.mutate(&request)
+			sealRequest(t, request, &request.Metadata.RequestDigest)
+			if err := request.ValidateAt(testNow); err == nil || !strings.Contains(err.Error(), test.wantErr) {
+				t.Fatalf("CreateRuntimeSessionRequest.ValidateAt() error = %v, want %q", err, test.wantErr)
+			}
+		})
+	}
+}
+
+func TestFinalizeRuntimeSessionPublicationValidation(t *testing.T) {
+	request := FinalizeRuntimeSessionPublicationRequest{
+		Protocol: ProtocolVersion, Metadata: testMutationMetadata(t, true), WorkspaceDeltaID: "delta-1",
+		PublicationID: "publication-1", PublicationGeneration: 1, PublicationVersion: 7,
+		TerminalState: PublicationTerminalVerifiedExact, TerminalReceiptDigest: testSHA256("publication-receipt"),
+	}
+	sealRequest(t, request, &request.Metadata.RequestDigest)
+	if err := request.ValidateAt(testNow); err != nil {
+		t.Fatalf("FinalizeRuntimeSessionPublicationRequest.ValidateAt() error = %v", err)
+	}
+	response := FinalizeRuntimeSessionPublicationResponse{
+		Protocol: ProtocolVersion, Classification: Classification{Class: RequestClassificationFresh},
+		Session: RuntimeSessionDescriptor{
+			RuntimeSessionID: "runtime-session-1", RuntimeSessionUID: request.Metadata.Fence.RuntimeSessionUID,
+			Generation: request.Metadata.Fence.RuntimeSessionGeneration, RuntimeInstanceID: request.Metadata.Fence.RuntimeInstanceID,
+			SupervisorBootID: request.Metadata.Fence.SupervisorBootID, RuntimeProfileDigest: request.Metadata.Fence.RuntimeProfileDigest,
+			State: RuntimeSessionStateFinalizing, ProviderSessionID: "provider-session-1", WorkspaceBaseline: testWorkspaceBaseline(),
+			CreatedAt: testNow, LastTransitionAt: testNow,
+		},
+		Finalization: PublicationFinalizationReceipt{
+			WorkspaceDeltaID: request.WorkspaceDeltaID, PublicationID: request.PublicationID,
+			PublicationGeneration: request.PublicationGeneration, PublicationVersion: request.PublicationVersion,
+			TerminalState: request.TerminalState, TerminalReceiptDigest: request.TerminalReceiptDigest, AppliedAt: testNow,
+		},
+	}
+	if err := response.ValidateFor(request); err != nil {
+		t.Fatalf("FinalizeRuntimeSessionPublicationResponse.ValidateFor() error = %v", err)
+	}
+
+	nonRetiring := response
+	nonRetiring.Session.State = RuntimeSessionStateIdle
+	if err := nonRetiring.ValidateFor(request); err == nil || !strings.Contains(err.Error(), "must return finalizing") {
+		t.Fatalf("non-retiring publication finalization response validation = %v", err)
+	}
+	mismatchedReceipt := response
+	mismatchedReceipt.Finalization.PublicationVersion++
+	if err := mismatchedReceipt.ValidateFor(request); err == nil || !strings.Contains(err.Error(), "does not match request") {
+		t.Fatalf("mismatched publication finalization receipt validation = %v", err)
+	}
+
+	request.TerminalState = PublicationTerminalState("publishing")
+	sealRequest(t, request, &request.Metadata.RequestDigest)
+	if err := request.ValidateAt(testNow); err == nil || !strings.Contains(err.Error(), "terminal publication state") {
+		t.Fatalf("nonterminal publication finalization validation = %v", err)
+	}
+}
+
+func TestDeleteRuntimeSessionResponseValidationBindsRequest(t *testing.T) {
+	request := DeleteRuntimeSessionRequest{
+		Protocol: ProtocolVersion, Metadata: testMutationMetadata(t, false), Reason: "cleanup",
+	}
+	sealRequest(t, request, &request.Metadata.RequestDigest)
+	response := DeleteRuntimeSessionResponse{
+		Protocol: ProtocolVersion, Classification: Classification{Class: RequestClassificationFresh},
+		State: RuntimeSessionStateDeleted,
+		Tombstone: RuntimeSessionTombstone{
+			RuntimeSessionUID:        request.Metadata.Fence.RuntimeSessionUID,
+			RuntimeSessionGeneration: request.Metadata.Fence.RuntimeSessionGeneration,
+			RuntimeProfileDigest:     request.Metadata.Fence.RuntimeProfileDigest,
+			DeletedAt:                testNow,
+			Operations: []OperationRecord{{
+				OperationID: request.Metadata.OperationID, RequestDigest: request.Metadata.RequestDigest,
+				Phase: OperationPhaseDeleted, RecordedAt: testNow, UpdatedAt: testNow,
+			}},
+		},
+	}
+	if err := response.ValidateFor(request); err != nil {
+		t.Fatalf("DeleteRuntimeSessionResponse.ValidateFor() error = %v", err)
+	}
+
+	wrongPhase := response
+	wrongPhase.Classification = Classification{Class: RequestClassificationDuplicate, Phase: OperationPhaseApplied}
+	if err := wrongPhase.ValidateFor(request); err == nil || !strings.Contains(err.Error(), "deleted phase") {
+		t.Fatalf("duplicate non-deleted response validation = %v", err)
+	}
+
+	mismatched := response
+	mismatched.Tombstone.RuntimeSessionGeneration++
+	if err := mismatched.ValidateFor(request); err == nil || !strings.Contains(err.Error(), "does not match request fence") {
+		t.Fatalf("mismatched tombstone validation = %v", err)
+	}
+
+	missingOperation := response
+	missingOperation.Tombstone.Operations = nil
+	if err := missingOperation.ValidateFor(request); err == nil || !strings.Contains(err.Error(), "does not contain") {
+		t.Fatalf("missing delete operation validation = %v", err)
+	}
+
+	mismatchedDigest := response
+	mismatchedDigest.Tombstone.Operations = append([]OperationRecord(nil), response.Tombstone.Operations...)
+	mismatchedDigest.Tombstone.Operations[0].RequestDigest = RequestDigest(testSHA256("other-delete-request"))
+	if err := mismatchedDigest.ValidateFor(request); err == nil || !strings.Contains(err.Error(), "digest does not match") {
+		t.Fatalf("mismatched delete operation digest validation = %v", err)
+	}
+
+	conflict := response
+	conflict.Classification = Classification{Class: RequestClassificationDigestConflict, Phase: OperationPhaseDeleted}
+	if err := conflict.ValidateFor(request); err == nil || !strings.Contains(err.Error(), "classification") {
+		t.Fatalf("digest-conflict success response validation = %v", err)
+	}
+}
+
+func TestRuntimeSessionStatusFinalizationReservationValidation(t *testing.T) {
+	base := RuntimeSessionStatus{
+		RuntimeSessionID: "runtime-session-1", RuntimeSessionUID: "session-uid-1", Generation: 1,
+		State: RuntimeSessionStateIdle, LastTransitionAt: testNow,
+	}
+	tests := []struct {
+		name     string
+		state    RuntimeSessionState
+		reserved bool
+		wantErr  string
+	}{
+		{name: "idle", state: RuntimeSessionStateIdle},
+		{name: "finalizing with accepted receipt", state: RuntimeSessionStateFinalizing, reserved: true},
+		{name: "deleting finalized session", state: RuntimeSessionStateDeleting, reserved: true},
+		{name: "deleting ordinary session", state: RuntimeSessionStateDeleting},
+		{name: "poisoned finalized session", state: RuntimeSessionStatePoisoned, reserved: true},
+		{name: "poisoned ordinary session", state: RuntimeSessionStatePoisoned},
+		{name: "finalizing without accepted receipt", state: RuntimeSessionStateFinalizing, wantErr: "must be reserved"},
+		{name: "prepared without accepted receipt", state: RuntimeSessionStatePublicationPrepared},
+		{name: "prepared falsely reserved", state: RuntimeSessionStatePublicationPrepared, reserved: true, wantErr: "only valid while finalizing, deleting, or poisoned"},
+		{name: "idle falsely reserved", state: RuntimeSessionStateIdle, reserved: true, wantErr: "only valid while finalizing, deleting, or poisoned"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			status := base
+			status.State = tt.state
+			status.ReservedForFinalization = tt.reserved
+			err := status.Validate()
+			if tt.wantErr == "" {
+				if err != nil {
+					t.Fatalf("RuntimeSessionStatus.Validate() error = %v", err)
+				}
+				return
+			}
+			if err == nil || !strings.Contains(err.Error(), tt.wantErr) {
+				t.Fatalf("RuntimeSessionStatus.Validate() error = %v, want containing %q", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestStartPromptLeaseAndPromptScopedMCPValidation(t *testing.T) {
+	request := testStartPromptRequest(t)
+	if err := request.ValidateAt(testNow, 5*time.Second, 3*time.Minute); err != nil {
+		t.Fatalf("StartPromptRequest.ValidateAt() error = %v", err)
+	}
+	if !request.MCPAuthorization.AuthorizedAt(RuntimeSessionStatePromptRunning, request.Lease, testNow.Add(30*time.Second)) {
+		t.Fatal("active prompt-scoped MCP authorization was denied")
+	}
+	for _, state := range []RuntimeSessionState{
+		RuntimeSessionStateIdle,
+		RuntimeSessionStateValidating,
+		RuntimeSessionStatePublishing,
+		RuntimeSessionStatePoisoned,
+		RuntimeSessionStateDeleted,
+	} {
+		if request.MCPAuthorization.AuthorizedAt(state, request.Lease, testNow.Add(30*time.Second)) {
+			t.Fatalf("MCP authorization unexpectedly active in state %s", state)
+		}
+	}
+	if request.MCPAuthorization.AuthorizedAt(RuntimeSessionStatePromptRunning, request.Lease, request.MCPAuthorization.ExpiresAt) {
+		t.Fatal("expired MCP authorization remained active")
+	}
+
+	request.Input.Content[0].Text = "changed after request acceptance"
+	if err := request.ValidateAt(testNow, 5*time.Second, 3*time.Minute); err == nil || !strings.Contains(err.Error(), "digest") {
+		t.Fatalf("mutated prompt request validation = %v, want digest error", err)
+	}
+}
+
+func TestPromptLeaseRenewalRejectsStaleAndUnboundedExtension(t *testing.T) {
+	current := PromptLease{Generation: 4, IssuedAt: testNow, ExpiresAt: testNow.Add(30 * time.Second)}
+	renewAt := testNow.Add(10 * time.Second)
+	proposed := PromptLease{Generation: 5, IssuedAt: renewAt, ExpiresAt: renewAt.Add(45 * time.Second)}
+	if err := ValidatePromptLeaseRenewal(current, proposed, 4, renewAt, time.Minute); err != nil {
+		t.Fatalf("ValidatePromptLeaseRenewal() error = %v", err)
+	}
+	if err := ValidatePromptLeaseRenewal(current, proposed, 3, renewAt, time.Minute); err == nil || !strings.Contains(err.Error(), "stale") {
+		t.Fatalf("stale renewal error = %v", err)
+	}
+	proposed.ExpiresAt = renewAt.Add(2 * time.Minute)
+	if err := ValidatePromptLeaseRenewal(current, proposed, 4, renewAt, time.Minute); err == nil || !strings.Contains(err.Error(), "maximum") {
+		t.Fatalf("unbounded renewal error = %v", err)
+	}
+}
+
+func TestPermissionDecisionAndLateCancellationSemantics(t *testing.T) {
+	if err := (PermissionDecision{Outcome: PermissionDecisionCancelled, OptionID: "allow"}).Validate(); err == nil {
+		t.Fatal("cancelled permission decision selected an option")
+	}
+	if err := (PermissionDecision{Outcome: PermissionDecisionSelected, OptionID: "allow-once"}).Validate(); err != nil {
+		t.Fatalf("selected permission decision error = %v", err)
+	}
+
+	request := ResolvePermissionRequest{
+		Protocol:  ProtocolVersion,
+		Metadata:  testMutationMetadata(t, true),
+		RequestID: "permission-1",
+		Decision:  PermissionDecision{Outcome: PermissionDecisionSelected, OptionID: "allow-once"},
+	}
+	sealRequest(t, request, &request.Metadata.RequestDigest)
+	if err := request.ValidateAt(testNow); err != nil {
+		t.Fatalf("ResolvePermissionRequest.ValidateAt() error = %v", err)
+	}
+
+	response := PermissionResolutionResponse{
+		Protocol:       ProtocolVersion,
+		Classification: Classification{Class: RequestClassificationStaleFence, FenceMismatch: FenceMismatchRuntimeSessionGeneration},
+		State:          PermissionResolutionCancelledByPrompt,
+		Decision:       PermissionDecision{Outcome: PermissionDecisionCancelled},
+		ResolvedAt:     testNow,
+	}
+	if err := response.Validate(); err != nil {
+		t.Fatalf("late cancelled permission response validation error = %v", err)
+	}
+	if response.Classification.HTTPStatus() != 410 {
+		t.Fatalf("late permission HTTP status = %d, want 410", response.Classification.HTTPStatus())
+	}
+}
+
+func TestCancellationBarrierRequiresOutcomeUnknownWhenSettlementUnproven(t *testing.T) {
+	request := CancelPromptRequest{
+		Protocol:           ProtocolVersion,
+		Metadata:           testMutationMetadata(t, true),
+		Reason:             CancelReasonStreamDisconnected,
+		SettlementDeadline: testNow.Add(30 * time.Second),
+	}
+	sealRequest(t, request, &request.Metadata.RequestDigest)
+	if err := request.ValidateAt(testNow); err != nil {
+		t.Fatalf("CancelPromptRequest.ValidateAt() error = %v", err)
+	}
+
+	unknown := CancelPromptResponse{
+		Protocol:       ProtocolVersion,
+		Classification: Classification{Class: RequestClassificationFresh},
+		BarrierState:   CancellationBarrierOutcomeUnknown,
+		Settlement: PromptSettlement{
+			TerminalEvent: EventOutcomeUnknown,
+			Outcome:       PromptOutcomeUnknown,
+			SettledAt:     testNow.Add(20 * time.Second),
+		},
+		ForcedTermination: true,
+	}
+	if err := unknown.Validate(); err != nil {
+		t.Fatalf("outcome-unknown cancellation response error = %v", err)
+	}
+
+	unknown.BarrierState = CancellationBarrierForcedTerminated
+	if err := unknown.Validate(); err == nil || !strings.Contains(err.Error(), "unproven") {
+		t.Fatalf("unproven forced termination validation = %v", err)
+	}
+}
+
+func TestWorkspaceDeltaValidationEnforcesIntentAndPublicationSafety(t *testing.T) {
+	request := CreateWorkspaceDeltaRequest{
+		Protocol:               ProtocolVersion,
+		Metadata:               testMutationMetadata(t, true),
+		DeltaID:                "delta-1",
+		Intent:                 WorkspaceIntentWrite,
+		VerifiedBaseline:       testWorkspaceBaseline(),
+		PromptSettlementDigest: testSHA256("settlement"),
+		Limits:                 WorkspaceDeltaLimits{MaxBytes: 10 << 20, MaxEntries: 1000},
+	}
+	sealRequest(t, request, &request.Metadata.RequestDigest)
+	if err := request.ValidateAt(testNow); err != nil {
+		t.Fatalf("CreateWorkspaceDeltaRequest.ValidateAt() error = %v", err)
+	}
+
+	response := CreateWorkspaceDeltaResponse{
+		Protocol:       ProtocolVersion,
+		Classification: Classification{Class: RequestClassificationFresh},
+		Delta: WorkspaceDeltaDescriptor{
+			DeltaID:           request.DeltaID,
+			RuntimeSessionUID: request.Metadata.Fence.RuntimeSessionUID,
+			SessionGeneration: request.Metadata.Fence.RuntimeSessionGeneration,
+			State:             WorkspaceDeltaPrepared,
+			Intent:            WorkspaceIntentWrite,
+			VerifiedBaseline:  request.VerifiedBaseline,
+			RelativeRoot:      "services/app",
+			ManifestDigest:    testSHA256("manifest"),
+			Artifact: &ArtifactReference{
+				ArtifactID: "artifact-1",
+				Digest:     testSHA256("artifact"),
+				SizeBytes:  1024,
+				MediaType:  "application/vnd.orka.workspace-delta+tar",
+			},
+			EntryCount:       2,
+			ChangedFileCount: 2,
+			NoFollowVerified: true,
+			PublicationSafe:  true,
+			FrozenAt:         testNow,
+		},
+	}
+	if err := response.ValidateFor(request); err != nil {
+		t.Fatalf("CreateWorkspaceDeltaResponse.ValidateFor() error = %v", err)
+	}
+
+	response.Delta.RelativeRoot = "../services/app"
+	if err := response.Delta.Validate(); err == nil || !strings.Contains(err.Error(), "unsafe segment") {
+		t.Fatalf("unsafe workspace relative root validation = %v", err)
+	}
+	response.Delta.RelativeRoot = "services/app"
+
+	response.Delta.Intent = WorkspaceIntentRead
+	if err := response.Delta.Validate(); err == nil || !strings.Contains(err.Error(), "write intent") {
+		t.Fatalf("prepared read-only delta validation = %v", err)
+	}
+}
+
+func TestCapabilitiesStatusAndDrainContracts(t *testing.T) {
+	limits := DefaultProtocolLimits()
+	if limits.MaxResidentSessions != 10 || limits.MaxConcurrentPrompts != 4 {
+		t.Fatalf("default pool limits = %d/%d, want 10/4", limits.MaxResidentSessions, limits.MaxConcurrentPrompts)
+	}
+	capabilities := CapabilitiesResponse{
+		Protocol:                   ProtocolVersion,
+		Transport:                  "http+ndjson",
+		ACPVersion:                 ACPProfileV1,
+		RuntimeProfileDigest:       testFence(t).RuntimeProfileDigest,
+		ProfileDigestSchemaVersion: ProfileDigestSchemaVersion,
+		AdapterDigests:             map[string]string{"codex-acp": testSHA256("adapter")},
+		Limits:                     limits,
+		Provider: ProviderCapabilities{
+			ProviderKinds:       []string{"codex"},
+			Models:              []string{"test-model"},
+			SupportsPermissions: true,
+			SupportsCancel:      true,
+			SupportsTools:       true,
+		},
+		WorkspaceGovernance: StrictWorkspaceGovernanceCapabilities(),
+		SupportsDrain:       true,
+	}
+	if err := capabilities.Validate(); err != nil {
+		t.Fatalf("CapabilitiesResponse.Validate() error = %v", err)
+	}
+
+	poolFence := testFence(t)
+	poolFence.RuntimeSessionUID = ""
+	poolFence.RuntimeSessionGeneration = 0
+	status := StatusResponse{
+		Protocol:                ProtocolVersion,
+		Fence:                   poolFence,
+		Lifecycle:               SupervisorLifecycleReady,
+		Drain:                   DrainStatus{AcceptingNewSessions: true},
+		SessionIdentityCapacity: &SessionIdentityCapacity{Total: 10_000, Remaining: 9_999, ExhaustionReserve: 1},
+		Sessions: []RuntimeSessionStatus{{
+			RuntimeSessionID:  "runtime-session-1",
+			RuntimeSessionUID: "session-uid-1",
+			Generation:        5,
+			State:             RuntimeSessionStateIdle,
+			LastTransitionAt:  testNow,
+		}},
+		Pressure:  PressureMetadata{ResidentSessions: 1},
+		Timestamp: testNow,
+	}
+	if err := status.Validate(); err != nil {
+		t.Fatalf("StatusResponse.Validate() error = %v", err)
+	}
+	if status.SessionIdentityCapacity.RotationRequired() {
+		t.Fatal("healthy identity capacity unexpectedly requires rotation")
+	}
+	status.SessionIdentityCapacity.Remaining = 1
+	if !status.SessionIdentityCapacity.RotationRequired() {
+		t.Fatal("identity reserve watermark did not require rotation")
+	}
+	status.SessionIdentityCapacity.Remaining = 9_999
+	status.Pressure.ActivePrompts = 1
+	if err := status.Validate(); err == nil || !strings.Contains(err.Error(), "active prompt count") {
+		t.Fatalf("inconsistent status count validation = %v", err)
+	}
+
+	drain := DrainRequest{
+		Protocol: ProtocolVersion,
+		Metadata: MutationMetadata{
+			Fence:                      poolFence,
+			OperationID:                "drain-1",
+			RequestDigestSchemaVersion: RequestDigestSchemaVersion,
+			ExpiresAt:                  testNow.Add(time.Minute),
+		},
+		Reason: "rollout",
+	}
+	sealRequest(t, drain, &drain.Metadata.RequestDigest)
+	if err := drain.ValidateAt(testNow); err != nil {
+		t.Fatalf("DrainRequest.ValidateAt() error = %v", err)
+	}
+}
+
+func TestOutcomeUnknownErrorIsNeverRetryable(t *testing.T) {
+	response := ErrorResponse{
+		Protocol:  ProtocolVersion,
+		Code:      ErrorCodeOutcomeUnknown,
+		Message:   "provider settlement could not be proven",
+		Retryable: true,
+	}
+	if err := response.Validate(); err == nil || !strings.Contains(err.Error(), "never") {
+		t.Fatalf("retryable outcome_unknown validation = %v", err)
+	}
+}
+
+func TestWorkspaceDeltaLimitsRejectUnsafePathPolicies(t *testing.T) {
+	for _, pattern := range []string{"../outside", "/absolute", `bad\\path`, "["} {
+		limits := WorkspaceDeltaLimits{MaxBytes: 1024, MaxEntries: 10, AllowedPaths: []string{pattern}}
+		if err := limits.Validate(); err == nil {
+			t.Fatalf("Validate() accepted unsafe pattern %q", pattern)
+		}
+	}
+	limits := WorkspaceDeltaLimits{MaxBytes: 1024, MaxEntries: 10, MaxChangedFiles: 2, AllowedPaths: []string{"internal/**", "README.md"}}
+	if err := limits.Validate(); err != nil {
+		t.Fatalf("Validate() rejected valid policy: %v", err)
+	}
+}
diff --git a/internal/harness/v2/test_helpers_test.go b/internal/harness/v2/test_helpers_test.go
new file mode 100644
index 000000000..b12683d42
--- /dev/null
+++ b/internal/harness/v2/test_helpers_test.go
@@ -0,0 +1,211 @@
+package v2
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"testing"
+	"time"
+)
+
+var testNow = time.Date(2026, 7, 24, 12, 0, 0, 0, time.UTC)
+
+func testSHA256(label string) string {
+	sum := sha256.Sum256([]byte(label))
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
+
+func testRuntimeProfile() RuntimeProfile {
+	toolPolicy := testMCPToolPolicy()
+	toolDigest, _ := CanonicalRuntimeToolPolicyDigest(toolPolicy.AllowedToolNames, toolPolicy.DisallowedToolNames, toolPolicy.AllowBash)
+	approvalPolicy := MCPApprovalPolicy{}
+	approvalDigest, _ := CanonicalMCPApprovalPolicyDigest(approvalPolicy)
+	mcpDigest, _ := CanonicalMCPConfigurationDigest(toolPolicy.AllowedToolNames)
+	agentConfiguration := testAgentSessionConfiguration()
+	agentConfigurationDigest, _ := CanonicalAgentConfigurationDigest(agentConfiguration)
+	return RuntimeProfile{
+		ACPProfile:               ACPProfileV1,
+		AdapterDigests:           map[string]string{"codex-acp": testSHA256("adapter")},
+		ProviderKind:             "codex",
+		Model:                    "test-model",
+		AgentConfigurationDigest: agentConfigurationDigest,
+		ToolPolicyDigest:         toolDigest,
+		ApprovalPolicyDigest:     approvalDigest,
+		MCPConfigurationDigest:   mcpDigest,
+		WorkspaceIntent:          WorkspaceIntentWrite,
+		ProxyCredentialRole:      "provider-inference",
+		ProxyCredentialScope:     "model:test-model",
+		ResourceClass:            "standard",
+	}
+}
+
+func testAgentSessionConfiguration() AgentSessionConfiguration {
+	return AgentSessionConfiguration{
+		AgentUID:        "agent-uid-1",
+		AgentGeneration: 4,
+		ProviderKind:    "codex",
+		Model:           "test-model",
+		MaxTurns:        50,
+		ReasoningEffort: "high",
+		SystemPrompt:    "Act as a careful test agent.",
+	}
+}
+
+func testAgentSessionConfigurationPointer() *AgentSessionConfiguration {
+	configuration := testAgentSessionConfiguration()
+	return &configuration
+}
+
+func testMCPToolPolicy() MCPToolPolicy {
+	tools := []MCPToolDescriptor{}
+	digest, _ := CanonicalMCPToolDescriptorDigest(tools)
+	return MCPToolPolicy{AllowedToolNames: []string{}, Tools: tools, DescriptorDigest: digest}
+}
+
+func testMCPPolicyConfiguration() MCPPolicyConfiguration {
+	profile := testRuntimeProfile()
+	return MCPPolicyConfiguration{
+		ToolPolicyDigest: profile.ToolPolicyDigest, ApprovalPolicyDigest: profile.ApprovalPolicyDigest,
+		MCPConfigurationDigest: profile.MCPConfigurationDigest,
+		ToolPolicy:             testMCPToolPolicy(), ApprovalPolicy: MCPApprovalPolicy{},
+	}
+}
+
+func testPromptMCPAuthorization(metadata MutationMetadata, lease PromptLease) PromptMCPAuthorization {
+	return testPromptMCPAuthorizationAt(metadata, lease, testNow.Add(time.Minute))
+}
+
+func testPromptMCPAuthorizationAt(metadata MutationMetadata, lease PromptLease, expiresAt time.Time) PromptMCPAuthorization {
+	profile := testRuntimeProfile()
+	return PromptMCPAuthorization{
+		RuntimeSessionUID: metadata.Fence.RuntimeSessionUID, SessionGeneration: metadata.Fence.RuntimeSessionGeneration,
+		TaskUID: metadata.TaskUID, TaskAttempt: metadata.TaskAttempt, PromptID: metadata.PromptID,
+		LeaseGeneration: lease.Generation, ToolPolicyDigest: profile.ToolPolicyDigest,
+		ApprovalPolicyDigest: profile.ApprovalPolicyDigest, MCPConfigurationDigest: profile.MCPConfigurationDigest,
+		ToolPolicy: testMCPToolPolicy(), ApprovalPolicy: MCPApprovalPolicy{}, ExpiresAt: expiresAt,
+	}
+}
+
+func testFence(t *testing.T) Fence {
+	t.Helper()
+	profileDigest, err := CanonicalProfileDigest(testRuntimeProfile())
+	if err != nil {
+		t.Fatalf("CanonicalProfileDigest() error = %v", err)
+	}
+	return Fence{
+		RuntimeInstanceID:          "runtime-instance-1",
+		SupervisorBootID:           "boot-1",
+		ControllerEpoch:            7,
+		RuntimePoolUID:             "pool-uid-1",
+		RuntimePoolGeneration:      3,
+		RuntimeSessionUID:          "session-uid-1",
+		RuntimeSessionGeneration:   5,
+		RuntimeProfileDigest:       profileDigest,
+		ProfileDigestSchemaVersion: ProfileDigestSchemaVersion,
+	}
+}
+
+func testMutationMetadata(t *testing.T, prompt bool) MutationMetadata {
+	t.Helper()
+	metadata := MutationMetadata{
+		Fence:                      testFence(t),
+		TaskUID:                    "task-uid-1",
+		TaskAttempt:                2,
+		OperationID:                "operation-1",
+		RequestDigestSchemaVersion: RequestDigestSchemaVersion,
+		ExpiresAt:                  testNow.Add(time.Minute),
+	}
+	if prompt {
+		metadata.PromptID = "prompt-1"
+	}
+	return metadata
+}
+
+func sealRequest(t *testing.T, request any, target *RequestDigest) {
+	t.Helper()
+	digest, err := CanonicalRequestDigest(request)
+	if err != nil {
+		t.Fatalf("CanonicalRequestDigest() error = %v", err)
+	}
+	*target = digest
+}
+
+func testWorkspaceBaseline() WorkspaceBaseline {
+	return WorkspaceBaseline{
+		RepositoryIdentity: "github.com/orka-agents/orka",
+		Revision:           "0123456789abcdef",
+		TreeDigest:         testSHA256("baseline-tree"),
+	}
+}
+
+func testStartPromptRequest(t *testing.T) StartPromptRequest {
+	t.Helper()
+	metadata := testMutationMetadata(t, true)
+	lease := PromptLease{
+		Generation: 1,
+		IssuedAt:   testNow,
+		ExpiresAt:  testNow.Add(2 * time.Minute),
+	}
+	request := StartPromptRequest{
+		Protocol:         ProtocolVersion,
+		Metadata:         metadata,
+		Lease:            lease,
+		MCPAuthorization: testPromptMCPAuthorization(metadata, lease),
+		Input:            PromptInput{Content: []ContentBlock{{Type: ContentBlockText, Text: "implement the change"}}},
+	}
+	sealRequest(t, request, &request.Metadata.RequestDigest)
+	return request
+}
+
+func testExpectation(t *testing.T) EventExpectation {
+	t.Helper()
+	request := testStartPromptRequest(t)
+	return EventExpectationFromMetadata(request.Metadata)
+}
+
+func testEventIdentity(t *testing.T, sequence uint64, timestamp time.Time) EventIdentity {
+	t.Helper()
+	expectation := testExpectation(t)
+	return EventIdentity{
+		RuntimeInstanceID:        expectation.RuntimeInstanceID,
+		SupervisorBootID:         expectation.SupervisorBootID,
+		RuntimeSessionUID:        expectation.RuntimeSessionUID,
+		RuntimeSessionGeneration: expectation.RuntimeSessionGeneration,
+		TaskUID:                  expectation.TaskUID,
+		TaskAttempt:              expectation.TaskAttempt,
+		PromptID:                 expectation.PromptID,
+		Sequence:                 sequence,
+		RequestDigest:            expectation.RequestDigest,
+		Timestamp:                timestamp,
+	}
+}
+
+func testAcceptedEvent(t *testing.T) Event {
+	t.Helper()
+	return Event{
+		Protocol: ProtocolVersion,
+		Type:     EventAccepted,
+		Identity: testEventIdentity(t, 1, testNow),
+		Accepted: &AcceptedEvent{
+			AcceptedAt: testNow,
+			Lease: PromptLease{
+				Generation: 1,
+				IssuedAt:   testNow,
+				ExpiresAt:  testNow.Add(2 * time.Minute),
+			},
+			ACPVersion: ACPProfileV1,
+		},
+	}
+}
+
+func testCompletedEvent(t *testing.T, sequence uint64, timestamp time.Time) Event {
+	t.Helper()
+	return Event{
+		Protocol: ProtocolVersion,
+		Type:     EventCompleted,
+		Identity: testEventIdentity(t, sequence, timestamp),
+		Completed: &CompletedEvent{
+			StopReason: ACPStopReasonEndTurn,
+			Result:     PromptResult{Content: []ContentBlock{{Type: ContentBlockText, Text: "done"}}},
+		},
+	}
+}
diff --git a/internal/harness/v2/validation.go b/internal/harness/v2/validation.go
new file mode 100644
index 000000000..60bb5276f
--- /dev/null
+++ b/internal/harness/v2/validation.go
@@ -0,0 +1,70 @@
+package v2
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"strings"
+	"time"
+	"unicode/utf8"
+)
+
+const (
+	MaxProtocolStringBytes = 4 * 1024
+	MaxDiagnosticBytes     = 8 * 1024
+	MaxMetadataEntries     = 128
+	MaxContentBlocks       = 128
+	MaxPromptContentBytes  = 1 << 20
+	MaxRawConfigBytes      = 256 << 10
+)
+
+func validateProtocol(version string) error {
+	if version != ProtocolVersion {
+		return fmt.Errorf("protocol version %q is unsupported; want %q", version, ProtocolVersion)
+	}
+	return nil
+}
+
+func validateBoundedString(name, value string, required bool, maxBytes int) error {
+	if !utf8.ValidString(value) {
+		return fmt.Errorf("%s contains invalid UTF-8", name)
+	}
+	if required && strings.TrimSpace(value) == "" {
+		return fmt.Errorf("%s is required", name)
+	}
+	if len(value) > maxBytes {
+		return fmt.Errorf("%s exceeds %d bytes", name, maxBytes)
+	}
+	return nil
+}
+
+func validateTimestamp(name string, value time.Time) error {
+	if value.IsZero() {
+		return fmt.Errorf("%s is required", name)
+	}
+	if value.Location() == nil {
+		return fmt.Errorf("%s has no location", name)
+	}
+	return nil
+}
+
+func ensureJSONEOF(dec *json.Decoder) error {
+	var extra any
+	if err := dec.Decode(&extra); err != io.EOF {
+		if err == nil {
+			return fmt.Errorf("contains trailing JSON value")
+		}
+		return fmt.Errorf("contains trailing data: %w", err)
+	}
+	return nil
+}
+
+func exactlyOne(values ...bool) bool {
+	count := 0
+	for _, value := range values {
+		if value {
+			count++
+		}
+	}
+	return count == 1
+}
diff --git a/internal/harness/v2/workspace.go b/internal/harness/v2/workspace.go
new file mode 100644
index 000000000..142f29bc7
--- /dev/null
+++ b/internal/harness/v2/workspace.go
@@ -0,0 +1,224 @@
+package v2
+
+import (
+	"bytes"
+	"fmt"
+	"path"
+	"strings"
+	"time"
+)
+
+type WorkspaceDeltaLimits struct {
+	MaxBytes                   int64    `json:"maxBytes"`
+	MaxEntries                 uint32   `json:"maxEntries"`
+	MaxChangedFiles            uint32   `json:"maxChangedFiles,omitempty"`
+	AllowedPaths               []string `json:"allowedPaths,omitempty"`
+	DenyRepositoryControlPaths bool     `json:"denyRepositoryControlPaths,omitempty"`
+	RejectBinaryFiles          bool     `json:"rejectBinaryFiles,omitempty"`
+	RejectSecretLikeContent    bool     `json:"rejectSecretLikeContent,omitempty"`
+}
+
+func (l WorkspaceDeltaLimits) Validate() error {
+	if l.MaxBytes <= 0 {
+		return fmt.Errorf("workspace delta max bytes must be positive")
+	}
+	if l.MaxEntries == 0 {
+		return fmt.Errorf("workspace delta max entries must be positive")
+	}
+	if len(l.AllowedPaths) > 256 {
+		return fmt.Errorf("workspace delta allowed paths exceed limit")
+	}
+	for _, pattern := range l.AllowedPaths {
+		cleaned := strings.TrimPrefix(strings.TrimSpace(pattern), "./")
+		if cleaned == "" || len(cleaned) > 1024 || strings.ContainsAny(cleaned, "\\\x00") || strings.HasPrefix(cleaned, "/") || cleaned == ".." || strings.HasPrefix(cleaned, "../") || strings.Contains(cleaned, "/../") {
+			return fmt.Errorf("workspace delta allowed path pattern is invalid")
+		}
+		if _, err := path.Match(cleaned, "validation-probe"); err != nil {
+			return fmt.Errorf("workspace delta allowed path pattern is invalid")
+		}
+	}
+	return nil
+}
+
+type CreateWorkspaceDeltaRequest struct {
+	Protocol                    string                 `json:"protocol"`
+	Metadata                    MutationMetadata       `json:"metadata"`
+	DeltaID                     WorkspaceDeltaID       `json:"deltaID"`
+	Intent                      WorkspaceIntent        `json:"intent"`
+	VerifiedBaseline            WorkspaceBaseline      `json:"verifiedBaseline"`
+	PromptSettlementDigest      string                 `json:"promptSettlementDigest"`
+	Limits                      WorkspaceDeltaLimits   `json:"limits"`
+	ArtifactUploadAuthorization *ArtifactAuthorization `json:"artifactUploadAuthorization,omitempty"`
+}
+
+func (r CreateWorkspaceDeltaRequest) ValidateAt(now time.Time) error {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return err
+	}
+	if err := r.Metadata.validateAt(now, metadataRequirements{session: true, task: true, prompt: true}); err != nil {
+		return fmt.Errorf("metadata: %w", err)
+	}
+	if err := requireIdentifier("workspace delta ID", string(r.DeltaID)); err != nil {
+		return err
+	}
+	if err := r.Intent.Validate(); err != nil {
+		return err
+	}
+	if err := r.VerifiedBaseline.Validate(); err != nil {
+		return fmt.Errorf("verified baseline: %w", err)
+	}
+	if err := validateSHA256Digest(r.PromptSettlementDigest); err != nil {
+		return fmt.Errorf("prompt settlement digest: %w", err)
+	}
+	if err := r.Limits.Validate(); err != nil {
+		return err
+	}
+	if r.ArtifactUploadAuthorization != nil {
+		if err := r.ArtifactUploadAuthorization.Validate(); err != nil {
+			return fmt.Errorf("artifact upload authorization: %w", err)
+		}
+	}
+	return r.Metadata.ValidateDigest(r)
+}
+
+type WorkspaceDeltaState string
+
+const (
+	WorkspaceDeltaNoChange         WorkspaceDeltaState = "no_change"
+	WorkspaceDeltaPrepared         WorkspaceDeltaState = "prepared"
+	WorkspaceDeltaReadOnlyModified WorkspaceDeltaState = "read_only_modified"
+)
+
+type WorkspaceDeltaDescriptor struct {
+	DeltaID           WorkspaceDeltaID    `json:"deltaID"`
+	RuntimeSessionUID RuntimeSessionUID   `json:"runtimeSessionUID"`
+	SessionGeneration uint64              `json:"sessionGeneration"`
+	State             WorkspaceDeltaState `json:"state"`
+	Intent            WorkspaceIntent     `json:"intent"`
+	VerifiedBaseline  WorkspaceBaseline   `json:"verifiedBaseline"`
+	RelativeRoot      string              `json:"relativeRoot,omitempty"`
+	ManifestDigest    string              `json:"manifestDigest,omitempty"`
+	Artifact          *ArtifactReference  `json:"artifact,omitempty"`
+	EntryCount        uint32              `json:"entryCount"`
+	ChangedFileCount  uint32              `json:"changedFileCount"`
+	DeletedEntryCount uint32              `json:"deletedEntryCount"`
+	SymlinkEntryCount uint32              `json:"symlinkEntryCount"`
+	NoFollowVerified  bool                `json:"noFollowVerified"`
+	PublicationSafe   bool                `json:"publicationSafe"`
+	FrozenAt          time.Time           `json:"frozenAt"`
+}
+
+//nolint:gocyclo // The explicit state-machine branches are easier to audit together.
+func (d WorkspaceDeltaDescriptor) Validate() error {
+	if err := requireIdentifier("workspace delta ID", string(d.DeltaID)); err != nil {
+		return err
+	}
+	if err := requireIdentifier("runtime session UID", string(d.RuntimeSessionUID)); err != nil {
+		return err
+	}
+	if d.SessionGeneration == 0 {
+		return fmt.Errorf("session generation must be positive")
+	}
+	if err := d.Intent.Validate(); err != nil {
+		return err
+	}
+	if err := d.VerifiedBaseline.Validate(); err != nil {
+		return err
+	}
+	if err := validateWorkspaceRelativeRoot(d.RelativeRoot); err != nil {
+		return err
+	}
+	if err := validateTimestamp("workspace freeze timestamp", d.FrozenAt); err != nil {
+		return err
+	}
+	switch d.State {
+	case WorkspaceDeltaNoChange:
+		if d.Artifact != nil || d.ManifestDigest != "" || d.EntryCount != 0 || d.ChangedFileCount != 0 ||
+			d.DeletedEntryCount != 0 || d.SymlinkEntryCount != 0 {
+			return fmt.Errorf("no-change workspace delta must not carry artifact or changed entries")
+		}
+		if !d.NoFollowVerified || !d.PublicationSafe {
+			return fmt.Errorf("no-change workspace delta must still prove no-follow and publication safety")
+		}
+	case WorkspaceDeltaPrepared:
+		if d.Intent != WorkspaceIntentWrite {
+			return fmt.Errorf("prepared workspace delta requires write intent")
+		}
+		if d.Artifact == nil {
+			return fmt.Errorf("prepared workspace delta requires artifact")
+		}
+		if err := d.Artifact.Validate(); err != nil {
+			return fmt.Errorf("workspace delta artifact: %w", err)
+		}
+		if err := validateSHA256Digest(d.ManifestDigest); err != nil {
+			return fmt.Errorf("workspace delta manifest digest: %w", err)
+		}
+		if d.EntryCount == 0 {
+			return fmt.Errorf("prepared workspace delta requires entries")
+		}
+		if !d.NoFollowVerified || !d.PublicationSafe {
+			return fmt.Errorf("prepared workspace delta must be no-follow verified and publication safe")
+		}
+	case WorkspaceDeltaReadOnlyModified:
+		if d.Intent != WorkspaceIntentRead {
+			return fmt.Errorf("read-only modification state requires read intent")
+		}
+		if d.Artifact != nil || d.PublicationSafe {
+			return fmt.Errorf("read-only modification must not produce a publishable artifact")
+		}
+		if d.EntryCount == 0 {
+			return fmt.Errorf("read-only modification requires changed entries")
+		}
+		if !d.NoFollowVerified {
+			return fmt.Errorf("read-only modification detection must be no-follow verified")
+		}
+	default:
+		return fmt.Errorf("unsupported workspace delta state %q", d.State)
+	}
+	if d.ChangedFileCount+d.DeletedEntryCount+d.SymlinkEntryCount > d.EntryCount {
+		return fmt.Errorf("workspace delta subtype counts exceed total entries")
+	}
+	return nil
+}
+
+type CreateWorkspaceDeltaResponse struct {
+	Protocol       string                   `json:"protocol"`
+	Classification Classification           `json:"classification"`
+	Delta          WorkspaceDeltaDescriptor `json:"delta"`
+}
+
+func (r CreateWorkspaceDeltaResponse) ValidateFor(request CreateWorkspaceDeltaRequest) error {
+	if err := validateProtocol(r.Protocol); err != nil {
+		return err
+	}
+	if err := r.Classification.Validate(); err != nil {
+		return fmt.Errorf("classification: %w", err)
+	}
+	if err := r.Delta.Validate(); err != nil {
+		return fmt.Errorf("workspace delta: %w", err)
+	}
+	if r.Delta.DeltaID != request.DeltaID ||
+		r.Delta.RuntimeSessionUID != request.Metadata.Fence.RuntimeSessionUID ||
+		r.Delta.SessionGeneration != request.Metadata.Fence.RuntimeSessionGeneration ||
+		r.Delta.Intent != request.Intent {
+		return fmt.Errorf("workspace delta response identity does not match request")
+	}
+	wantBaseline, err := CanonicalValue(request.VerifiedBaseline)
+	if err != nil {
+		return fmt.Errorf("canonicalize requested baseline: %w", err)
+	}
+	gotBaseline, err := CanonicalValue(r.Delta.VerifiedBaseline)
+	if err != nil {
+		return fmt.Errorf("canonicalize response baseline: %w", err)
+	}
+	if !bytes.Equal(gotBaseline, wantBaseline) {
+		return fmt.Errorf("workspace delta response baseline does not match request")
+	}
+	if r.Delta.EntryCount > request.Limits.MaxEntries {
+		return fmt.Errorf("workspace delta entry count exceeds request limit")
+	}
+	if r.Delta.Artifact != nil && r.Delta.Artifact.SizeBytes > request.Limits.MaxBytes {
+		return fmt.Errorf("workspace delta artifact exceeds request byte limit")
+	}
+	return nil
+}
diff --git a/internal/harness/workspace_hosts.go b/internal/harness/workspace_hosts.go
new file mode 100644
index 000000000..2c6169e3c
--- /dev/null
+++ b/internal/harness/workspace_hosts.go
@@ -0,0 +1,29 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package harness
+
+import "strings"
+
+// WrapperAllowedGitHostsEnv names the optional comma-separated extension to
+// the harness v1 wrapper's public repository host allowlist.
+const WrapperAllowedGitHostsEnv = "ORKA_HARNESS_WRAPPER_ALLOWED_GIT_HOSTS"
+
+// WrapperGitHostAllowed applies the host policy shared by controller
+// pre-binding validation and the harness v1 compatibility wrapper.
+func WrapperGitHostAllowed(host, additionalHosts string) bool {
+	host = strings.ToLower(strings.TrimSpace(host))
+	switch host {
+	case "github.com", "gitlab.com", "bitbucket.org":
+		return true
+	}
+	for item := range strings.SplitSeq(additionalHosts, ",") {
+		if host != "" && host == strings.ToLower(strings.TrimSpace(item)) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/harness/workspace_hosts_test.go b/internal/harness/workspace_hosts_test.go
new file mode 100644
index 000000000..4f84ec767
--- /dev/null
+++ b/internal/harness/workspace_hosts_test.go
@@ -0,0 +1,23 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package harness
+
+import "testing"
+
+func TestWrapperGitHostAllowed(t *testing.T) {
+	for _, host := range []string{"github.com", "GITLAB.COM", " bitbucket.org "} {
+		if !WrapperGitHostAllowed(host, "") {
+			t.Fatalf("default wrapper host %q rejected", host)
+		}
+	}
+	if WrapperGitHostAllowed("codeberg.org", "") {
+		t.Fatal("unconfigured wrapper host accepted")
+	}
+	if !WrapperGitHostAllowed("codeberg.org", " git.example.com, CODEBERG.ORG ") {
+		t.Fatal("configured wrapper host rejected")
+	}
+}
diff --git a/internal/labels/labels.go b/internal/labels/labels.go
index b4b755d10..3b369f90d 100644
--- a/internal/labels/labels.go
+++ b/internal/labels/labels.go
@@ -87,6 +87,7 @@ const (
 	AnnotationMonitorHeadSHA                = "orka.ai/monitor-head-sha"
 	AnnotationAgentReadOnly                 = "orka.ai/agent-read-only"
 	AnnotationAgentRuntimeAuthOnly          = "orka.ai/agent-runtime-auth-only"
+	AnnotationSecurityReviewAttempt         = "orka.ai/security-review-attempt"
 	AnnotationWorkspaceInitContainer        = "orka.ai/workspace-init-container"
 	AnnotationDisableCoordinationToolInject = "orka.ai/disable-coordination-tool-injection"
 	AnnotationApprovalDecidedAt             = "orka.ai/approval-decided-at"
diff --git a/internal/providerproxy/providerproxy.go b/internal/providerproxy/providerproxy.go
new file mode 100644
index 000000000..b186a808e
--- /dev/null
+++ b/internal/providerproxy/providerproxy.go
@@ -0,0 +1,227 @@
+// Package providerproxy holds the security-critical request/response
+// filtering shared by Orka's provider-facing HTTP proxies: the standalone
+// orka-provider-auth-proxy binary and the ACP supervisor's per-session
+// provider proxy. Both proxies sit between untrusted callers and provider
+// credentials, so the header allow/deny decisions, path-traversal checks,
+// upstream target construction, and response byte bounds live here exactly
+// once — a hardening fix in this package reaches every proxy.
+package providerproxy
+
+import (
+	"errors"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+)
+
+const (
+	authorizationHeader      = "Authorization"
+	proxyAuthorizationHeader = "Proxy-Authorization"
+	apiKeyHeader             = "X-Api-Key"
+	legacyAPIKeyHeader       = "Api-Key"
+	contentEncodingHeader    = "Content-Encoding"
+)
+
+// ErrResponseTooLarge reports an upstream response body that exceeds the
+// proxy's configured byte limit.
+var ErrResponseTooLarge = errors.New("provider upstream response exceeds limit")
+
+// HasUnsafePathSegment reports whether a proxied URL path must be rejected
+// before it is joined onto the upstream base URL. It applies the strictest
+// union of the checks the two provider proxies previously implemented
+// independently — every path either proxy rejected before is still rejected:
+//
+//   - any "." or ".." path segment, checked on both the raw path and its
+//     percent-decoded form, so percent-encoded traversal ("%2e%2e") cannot
+//     survive a later decode upstream;
+//   - any backslash or NUL byte, again in both raw and decoded forms, so
+//     Windows-style separators and string-truncation tricks cannot smuggle
+//     traversal past the segment check;
+//   - malformed percent-encoding, which is rejected outright because it
+//     cannot be normalized safely.
+func HasUnsafePathSegment(path string) bool {
+	if hasUnsafeRawPath(path) {
+		return true
+	}
+	decoded, err := url.PathUnescape(path)
+	if err != nil {
+		return true
+	}
+	return hasUnsafeRawPath(decoded)
+}
+
+func hasUnsafeRawPath(path string) bool {
+	if strings.ContainsAny(path, "\\\x00") {
+		return true
+	}
+	for segment := range strings.SplitSeq(path, "/") {
+		if segment == "." || segment == ".." {
+			return true
+		}
+	}
+	return false
+}
+
+// Target joins a proxied request path and raw query onto the upstream base
+// URL. Callers must reject unsafe paths with HasUnsafePathSegment first.
+func Target(base *url.URL, requestPath, rawQuery string) *url.URL {
+	target := *base
+	target.Path = strings.TrimSuffix(base.Path, "/") + "/" + strings.TrimPrefix(requestPath, "/")
+	target.RawPath = ""
+	target.RawQuery = rawQuery
+	return &target
+}
+
+// CopyRequestHeaders copies caller request headers onto the upstream request,
+// dropping hop-by-hop headers, headers nominated by Connection, and headers
+// that could leak caller credentials, identity, or routing metadata to the
+// provider. Header values are never logged or printed here.
+func CopyRequestHeaders(destination, source http.Header) {
+	blocked := blockedHeaders(source)
+	for name, values := range source {
+		canonical := http.CanonicalHeaderKey(name)
+		if blocked[canonical] || isSensitiveRequestHeader(canonical) {
+			continue
+		}
+		for _, value := range values {
+			destination.Add(canonical, value)
+		}
+	}
+}
+
+// CopyResponseHeaders copies upstream response headers back to the caller,
+// dropping hop-by-hop headers, headers nominated by Connection, and headers
+// that could leak provider credentials or redirect the caller elsewhere.
+func CopyResponseHeaders(destination, source http.Header) {
+	blocked := blockedHeaders(source)
+	for name, values := range source {
+		canonical := http.CanonicalHeaderKey(name)
+		if blocked[canonical] || isSensitiveResponseHeader(canonical) {
+			continue
+		}
+		for _, value := range values {
+			destination.Add(canonical, value)
+		}
+	}
+}
+
+// HasDisallowedContentEncoding reports whether the header declares a
+// Content-Encoding other than identity. The proxies refuse compressed bodies
+// in both directions so byte limits apply to the true payload size.
+func HasDisallowedContentEncoding(header http.Header) bool {
+	encoding := strings.TrimSpace(header.Get(contentEncodingHeader))
+	return encoding != "" && !strings.EqualFold(encoding, "identity")
+}
+
+func blockedHeaders(header http.Header) map[string]bool {
+	blocked := map[string]bool{
+		"Connection":             true,
+		"Keep-Alive":             true,
+		"Proxy-Authenticate":     true,
+		proxyAuthorizationHeader: true,
+		"Proxy-Connection":       true,
+		"Te":                     true,
+		"Trailer":                true,
+		"Transfer-Encoding":      true,
+		"Upgrade":                true,
+	}
+	for _, connection := range header.Values("Connection") {
+		for name := range strings.SplitSeq(connection, ",") {
+			name = http.CanonicalHeaderKey(strings.TrimSpace(name))
+			if name != "" {
+				blocked[name] = true
+			}
+		}
+	}
+	return blocked
+}
+
+func isSensitiveRequestHeader(name string) bool {
+	switch name {
+	case authorizationHeader, proxyAuthorizationHeader, apiKeyHeader, legacyAPIKeyHeader,
+		"Cookie", "Set-Cookie", "Forwarded", "X-Forwarded-For", "X-Forwarded-Host", "X-Forwarded-Proto",
+		"X-Real-Ip", "X-Forwarded-Prefix", "X-Original-Url", "X-Rewrite-Url", "X-Envoy-Original-Path",
+		"X-Http-Method-Override", "Txn-Token", "Origin", "Referer", "Openai-Organization", "Openai-Project",
+		"Anthropic-Organization-Id", "Traceparent", "Tracestate", "Baggage", contentEncodingHeader, "Expect":
+		return true
+	default:
+		return strings.HasPrefix(name, "X-Orka-") || strings.HasPrefix(name, "X-Forwarded-") || strings.HasPrefix(name, "Sec-Fetch-")
+	}
+}
+
+func isSensitiveResponseHeader(name string) bool {
+	switch name {
+	case authorizationHeader, proxyAuthorizationHeader, apiKeyHeader, legacyAPIKeyHeader,
+		"Set-Cookie", "Set-Cookie2", "Location", "Server", "Alt-Svc", "Www-Authenticate", "Proxy-Authenticate",
+		contentEncodingHeader:
+		return true
+	default:
+		return false
+	}
+}
+
+// StreamBoundedResponse copies the upstream response body to the caller,
+// enforcing the byte limit as it streams. It never writes more than limit
+// bytes: the read that would cross the limit returns ErrResponseTooLarge
+// without forwarding the offending chunk, and reads never run more than one
+// byte past the limit. When flusher is non-nil it is flushed after every
+// write so streamed (for example server-sent event) responses propagate
+// promptly; pass nil to keep the destination's default buffering.
+func StreamBoundedResponse(destination io.Writer, source io.Reader, limit int64, flusher http.Flusher) error {
+	remaining := limit
+	buffer := make([]byte, 32<<10)
+	for {
+		readSize := len(buffer)
+		if int64(readSize) > remaining+1 {
+			readSize = int(remaining + 1)
+		}
+		n, readErr := source.Read(buffer[:readSize])
+		if int64(n) > remaining {
+			return ErrResponseTooLarge
+		}
+		if n > 0 {
+			written, writeErr := destination.Write(buffer[:n])
+			remaining -= int64(written)
+			if writeErr != nil {
+				return writeErr
+			}
+			if written != n {
+				return io.ErrShortWrite
+			}
+			if flusher != nil {
+				flusher.Flush()
+			}
+		}
+		if readErr != nil {
+			if errors.Is(readErr, io.EOF) {
+				return nil
+			}
+			return readErr
+		}
+	}
+}
+
+// TryAcquireSlot attempts to take one request slot without blocking.
+func TryAcquireSlot(slots chan struct{}) bool {
+	select {
+	case slots <- struct{}{}:
+		return true
+	default:
+		return false
+	}
+}
+
+// ReleaseSlot returns a request slot taken with TryAcquireSlot.
+func ReleaseSlot(slots chan struct{}) {
+	<-slots
+}
+
+// WriteError writes a plain-text, non-cacheable proxy error response. The
+// message must never contain credential material.
+func WriteError(w http.ResponseWriter, status int, message string) {
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	w.Header().Set("Cache-Control", "no-store")
+	w.WriteHeader(status)
+	_, _ = io.WriteString(w, message+"\n")
+}
diff --git a/internal/providerproxy/providerproxy_test.go b/internal/providerproxy/providerproxy_test.go
new file mode 100644
index 000000000..e9419f24a
--- /dev/null
+++ b/internal/providerproxy/providerproxy_test.go
@@ -0,0 +1,381 @@
+package providerproxy
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+)
+
+func TestHasUnsafePathSegment(t *testing.T) {
+	for _, test := range []struct {
+		name   string
+		path   string
+		unsafe bool
+	}{
+		{name: "empty", path: "", unsafe: false},
+		{name: "root", path: "/", unsafe: false},
+		{name: "benign api path", path: "/v1/messages", unsafe: false},
+		{name: "benign nested path", path: "/base/v1/chat/completions", unsafe: false},
+		{name: "dots inside a segment", path: "/v1.2/models.json", unsafe: false},
+		{name: "segment starting with dots", path: "/..hidden/x", unsafe: false},
+		{name: "benign query-free asterisk", path: "*", unsafe: false},
+		{name: "raw parent traversal", path: "/../secrets", unsafe: true},
+		{name: "raw parent traversal mid-path", path: "/v1/../admin", unsafe: true},
+		{name: "raw parent traversal at end", path: "/v1/..", unsafe: true},
+		{name: "bare parent segment", path: "..", unsafe: true},
+		{name: "raw current-directory segment", path: "/./v1", unsafe: true},
+		{name: "bare current-directory segment", path: ".", unsafe: true},
+		{name: "percent-encoded parent traversal", path: "/%2e%2e/secrets", unsafe: true},
+		{name: "percent-encoded parent traversal uppercase", path: "/v1/%2E%2E", unsafe: true},
+		{name: "percent-encoded current-directory segment", path: "/%2e/v1", unsafe: true},
+		{name: "percent-encoded slash traversal", path: "/a%2f..%2fb", unsafe: true},
+		{name: "mixed encoded parent segment", path: "/.%2e/x", unsafe: true},
+		{name: "raw backslash", path: "/a\\b", unsafe: true},
+		{name: "raw windows traversal", path: "/a\\..\\b", unsafe: true},
+		{name: "percent-encoded backslash", path: "/a%5Cb", unsafe: true},
+		{name: "percent-encoded backslash lowercase", path: "/a%5cb", unsafe: true},
+		{name: "raw NUL byte", path: "/a\x00b", unsafe: true},
+		{name: "percent-encoded NUL byte", path: "/a%00b", unsafe: true},
+		{name: "malformed percent encoding", path: "/a%zzb", unsafe: true},
+		{name: "truncated percent encoding", path: "/a%2", unsafe: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			if got := HasUnsafePathSegment(test.path); got != test.unsafe {
+				t.Fatalf("HasUnsafePathSegment(%q) = %t, want %t", test.path, got, test.unsafe)
+			}
+		})
+	}
+}
+
+func TestCopyRequestHeadersDropsSensitiveAndHopByHopHeaders(t *testing.T) {
+	source := http.Header{}
+	for name, value := range map[string]string{
+		"Authorization":             "Bearer caller-credential",
+		"Proxy-Authorization":       "Bearer proxy-credential",
+		"X-Api-Key":                 "caller-key",
+		"Api-Key":                   "caller-legacy-key",
+		"Cookie":                    "caller=cookie",
+		"Set-Cookie":                "caller=cookie",
+		"Forwarded":                 "for=203.0.113.1",
+		"X-Forwarded-For":           "203.0.113.1",
+		"X-Forwarded-Anything":      "anything",
+		"X-Real-Ip":                 "203.0.113.1",
+		"X-Original-Url":            "/original",
+		"X-Rewrite-Url":             "/rewrite",
+		"X-Envoy-Original-Path":     "/envoy",
+		"X-Http-Method-Override":    "DELETE",
+		"Txn-Token":                 "transaction",
+		"Origin":                    "http://caller.example",
+		"Referer":                   "http://caller.example/page",
+		"Openai-Organization":       "org",
+		"Openai-Project":            "project",
+		"Anthropic-Organization-Id": "org",
+		"Traceparent":               "00-trace",
+		"Tracestate":                "vendor=1",
+		"Baggage":                   "key=value",
+		"Content-Encoding":          "gzip",
+		"Expect":                    "100-continue",
+		"X-Orka-Internal":           "internal",
+		"Sec-Fetch-Site":            "cross-site",
+		"Keep-Alive":                "timeout=5",
+		"Te":                        "trailers",
+		"Trailer":                   "Expires",
+		"Transfer-Encoding":         "chunked",
+		"Upgrade":                   "websocket",
+		"Proxy-Connection":          "keep-alive",
+		"Proxy-Authenticate":        "Basic",
+		"X-Connection-Named":        "remove-me",
+	} {
+		source.Set(name, value)
+	}
+	source.Set("Connection", "X-Connection-Named")
+	source.Add("Content-Type", "application/json")
+	source.Add("Accept", "application/json")
+	source.Add("Accept", "text/event-stream")
+	source.Set("Anthropic-Version", "2023-06-01")
+	source.Set("Openai-Beta", "assistants=v2")
+	source["x-lowercase-safe"] = []string{"kept"}
+
+	destination := http.Header{}
+	CopyRequestHeaders(destination, source)
+
+	for _, name := range []string{
+		"Authorization", "Proxy-Authorization", "X-Api-Key", "Api-Key", "Cookie", "Set-Cookie",
+		"Forwarded", "X-Forwarded-For", "X-Forwarded-Anything", "X-Real-Ip", "X-Original-Url",
+		"X-Rewrite-Url", "X-Envoy-Original-Path", "X-Http-Method-Override", "Txn-Token", "Origin",
+		"Referer", "Openai-Organization", "Openai-Project", "Anthropic-Organization-Id",
+		"Traceparent", "Tracestate", "Baggage", "Content-Encoding", "Expect", "X-Orka-Internal",
+		"Sec-Fetch-Site", "Connection", "Keep-Alive", "Te", "Trailer", "Transfer-Encoding",
+		"Upgrade", "Proxy-Connection", "Proxy-Authenticate", "X-Connection-Named",
+	} {
+		if values := destination.Values(name); len(values) != 0 {
+			t.Errorf("sensitive or hop-by-hop request header %s was forwarded: %q", name, values)
+		}
+	}
+	if got := destination.Get("Content-Type"); got != "application/json" {
+		t.Errorf("Content-Type = %q, want application/json", got)
+	}
+	if got := destination.Values("Accept"); len(got) != 2 || got[0] != "application/json" || got[1] != "text/event-stream" {
+		t.Errorf("Accept values = %q, want both preserved in order", got)
+	}
+	if got := destination.Get("Anthropic-Version"); got != "2023-06-01" {
+		t.Errorf("Anthropic-Version = %q, want preserved", got)
+	}
+	if got := destination.Get("Openai-Beta"); got != "assistants=v2" {
+		t.Errorf("Openai-Beta = %q, want preserved", got)
+	}
+	if got := destination.Get("X-Lowercase-Safe"); got != "kept" {
+		t.Errorf("non-canonical source header was not canonicalized and preserved: %q", got)
+	}
+}
+
+func TestCopyRequestHeadersDropsNonCanonicalSensitiveNames(t *testing.T) {
+	source := http.Header{
+		"authorization": []string{"Bearer caller-credential"},
+		"x-api-key":     []string{"caller-key"},
+		"cookie":        []string{"caller=cookie"},
+	}
+	destination := http.Header{}
+	CopyRequestHeaders(destination, source)
+	if len(destination) != 0 {
+		t.Fatalf("non-canonical sensitive request headers were forwarded: %v", destination)
+	}
+}
+
+func TestCopyResponseHeadersDropsSensitiveAndHopByHopHeaders(t *testing.T) {
+	source := http.Header{}
+	for name, value := range map[string]string{
+		"Authorization":       "Bearer provider-credential",
+		"Proxy-Authorization": "Bearer provider-proxy-credential",
+		"X-Api-Key":           "provider-key",
+		"Api-Key":             "provider-legacy-key",
+		"Set-Cookie":          "provider=secret",
+		"Set-Cookie2":         "provider=secret",
+		"Location":            "http://elsewhere.example",
+		"Server":              "provider-server",
+		"Alt-Svc":             `h3=":443"`,
+		"Www-Authenticate":    "Bearer",
+		"Proxy-Authenticate":  "Basic",
+		"Content-Encoding":    "gzip",
+		"Transfer-Encoding":   "chunked",
+		"Keep-Alive":          "timeout=5",
+		"Upgrade":             "websocket",
+		"X-Connection-Named":  "remove-me",
+	} {
+		source.Set(name, value)
+	}
+	source.Set("Connection", "X-Connection-Named")
+	source.Set("Content-Type", "application/json")
+	source.Set("X-Request-Id", "request-1")
+	source.Set("Openai-Version", "2020-10-01")
+
+	destination := http.Header{}
+	CopyResponseHeaders(destination, source)
+
+	for _, name := range []string{
+		"Authorization", "Proxy-Authorization", "X-Api-Key", "Api-Key", "Set-Cookie", "Set-Cookie2",
+		"Location", "Server", "Alt-Svc", "Www-Authenticate", "Proxy-Authenticate", "Content-Encoding",
+		"Transfer-Encoding", "Keep-Alive", "Upgrade", "Connection", "X-Connection-Named",
+	} {
+		if values := destination.Values(name); len(values) != 0 {
+			t.Errorf("sensitive or hop-by-hop response header %s was forwarded: %q", name, values)
+		}
+	}
+	for name, want := range map[string]string{
+		"Content-Type":   "application/json",
+		"X-Request-Id":   "request-1",
+		"Openai-Version": "2020-10-01",
+	} {
+		if got := destination.Get(name); got != want {
+			t.Errorf("%s = %q, want %q", name, got, want)
+		}
+	}
+}
+
+func TestHasDisallowedContentEncoding(t *testing.T) {
+	for _, test := range []struct {
+		name       string
+		encoding   string
+		disallowed bool
+	}{
+		{name: "absent", encoding: "", disallowed: false},
+		{name: "identity", encoding: "identity", disallowed: false},
+		{name: "identity uppercase", encoding: "IDENTITY", disallowed: false},
+		{name: "identity padded", encoding: "  identity  ", disallowed: false},
+		{name: "gzip", encoding: "gzip", disallowed: true},
+		{name: "brotli", encoding: "br", disallowed: true},
+		{name: "gzip padded", encoding: " gzip ", disallowed: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			header := http.Header{}
+			if test.encoding != "" {
+				header.Set("Content-Encoding", test.encoding)
+			}
+			if got := HasDisallowedContentEncoding(header); got != test.disallowed {
+				t.Fatalf("HasDisallowedContentEncoding(%q) = %t, want %t", test.encoding, got, test.disallowed)
+			}
+		})
+	}
+}
+
+func TestTarget(t *testing.T) {
+	for _, test := range []struct {
+		name        string
+		base        string
+		requestPath string
+		rawQuery    string
+		want        string
+	}{
+		{name: "root base", base: "http://upstream.example/", requestPath: "/v1/messages", want: "http://upstream.example/v1/messages"},
+		{name: "prefixed base", base: "http://upstream.example/base", requestPath: "/v1/responses", rawQuery: "stream=true", want: "http://upstream.example/base/v1/responses?stream=true"},
+		{name: "prefixed base with trailing slash", base: "http://upstream.example/base/", requestPath: "/v1/models", want: "http://upstream.example/base/v1/models"},
+		{name: "root suffix", base: "http://upstream.example/base", requestPath: "/", want: "http://upstream.example/base/"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			base, err := url.Parse(test.base)
+			if err != nil {
+				t.Fatal(err)
+			}
+			target := Target(base, test.requestPath, test.rawQuery)
+			if target.String() != test.want {
+				t.Fatalf("Target(%q, %q, %q) = %q, want %q", test.base, test.requestPath, test.rawQuery, target.String(), test.want)
+			}
+			if target.RawPath != "" {
+				t.Fatalf("Target left RawPath = %q, want empty", target.RawPath)
+			}
+			if base.Path != mustParse(t, test.base).Path {
+				t.Fatal("Target mutated the shared base URL")
+			}
+		})
+	}
+}
+
+func mustParse(t *testing.T, raw string) *url.URL {
+	t.Helper()
+	parsed, err := url.Parse(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return parsed
+}
+
+type chunkReader struct {
+	data  []byte
+	chunk int
+}
+
+func (r *chunkReader) Read(buffer []byte) (int, error) {
+	if len(r.data) == 0 {
+		return 0, io.EOF
+	}
+	n := min(min(len(buffer), r.chunk), len(r.data))
+	copy(buffer, r.data[:n])
+	r.data = r.data[n:]
+	return n, nil
+}
+
+type countingFlusher struct{ flushes int }
+
+func (f *countingFlusher) Flush() { f.flushes++ }
+
+func TestStreamBoundedResponse(t *testing.T) {
+	t.Run("under limit", func(t *testing.T) {
+		var out bytes.Buffer
+		if err := StreamBoundedResponse(&out, strings.NewReader("hello"), 10, nil); err != nil {
+			t.Fatalf("StreamBoundedResponse() = %v, want nil", err)
+		}
+		if out.String() != "hello" {
+			t.Fatalf("streamed %q, want %q", out.String(), "hello")
+		}
+	})
+
+	t.Run("exactly at limit", func(t *testing.T) {
+		var out bytes.Buffer
+		if err := StreamBoundedResponse(&out, strings.NewReader("12345"), 5, nil); err != nil {
+			t.Fatalf("StreamBoundedResponse() = %v, want nil", err)
+		}
+		if out.String() != "12345" {
+			t.Fatalf("streamed %q, want %q", out.String(), "12345")
+		}
+	})
+
+	t.Run("over limit in one read", func(t *testing.T) {
+		var out bytes.Buffer
+		err := StreamBoundedResponse(&out, strings.NewReader("123456"), 5, nil)
+		if !errors.Is(err, ErrResponseTooLarge) {
+			t.Fatalf("StreamBoundedResponse() = %v, want ErrResponseTooLarge", err)
+		}
+		if int64(out.Len()) > 5 {
+			t.Fatalf("streamed %d bytes, want at most the 5-byte limit", out.Len())
+		}
+	})
+
+	t.Run("over limit across chunks", func(t *testing.T) {
+		var out bytes.Buffer
+		err := StreamBoundedResponse(&out, &chunkReader{data: []byte("1234567890"), chunk: 3}, 5, nil)
+		if !errors.Is(err, ErrResponseTooLarge) {
+			t.Fatalf("StreamBoundedResponse() = %v, want ErrResponseTooLarge", err)
+		}
+		if out.String() != "123" {
+			t.Fatalf("streamed %q, want the chunks that fit under the limit", out.String())
+		}
+	})
+
+	t.Run("zero limit rejects any body", func(t *testing.T) {
+		var out bytes.Buffer
+		err := StreamBoundedResponse(&out, strings.NewReader("x"), 0, nil)
+		if !errors.Is(err, ErrResponseTooLarge) {
+			t.Fatalf("StreamBoundedResponse() = %v, want ErrResponseTooLarge", err)
+		}
+		if out.Len() != 0 {
+			t.Fatalf("streamed %q, want nothing", out.String())
+		}
+	})
+
+	t.Run("flushes after every chunk", func(t *testing.T) {
+		var out bytes.Buffer
+		flusher := &countingFlusher{}
+		if err := StreamBoundedResponse(&out, &chunkReader{data: []byte("abcdef"), chunk: 2}, 10, flusher); err != nil {
+			t.Fatalf("StreamBoundedResponse() = %v, want nil", err)
+		}
+		if out.String() != "abcdef" || flusher.flushes != 3 {
+			t.Fatalf("streamed %q with %d flushes, want %q with 3 flushes", out.String(), flusher.flushes, "abcdef")
+		}
+	})
+}
+
+func TestTryAcquireAndReleaseSlot(t *testing.T) {
+	slots := make(chan struct{}, 1)
+	if !TryAcquireSlot(slots) {
+		t.Fatal("first acquire failed on an empty slot channel")
+	}
+	if TryAcquireSlot(slots) {
+		t.Fatal("second acquire succeeded past capacity")
+	}
+	ReleaseSlot(slots)
+	if !TryAcquireSlot(slots) {
+		t.Fatal("acquire failed after release")
+	}
+}
+
+func TestWriteError(t *testing.T) {
+	recorder := httptest.NewRecorder()
+	WriteError(recorder, http.StatusBadGateway, "provider upstream request failed")
+	if recorder.Code != http.StatusBadGateway {
+		t.Fatalf("status = %d, want %d", recorder.Code, http.StatusBadGateway)
+	}
+	if got := recorder.Header().Get("Content-Type"); got != "text/plain; charset=utf-8" {
+		t.Fatalf("Content-Type = %q", got)
+	}
+	if got := recorder.Header().Get("Cache-Control"); got != "no-store" {
+		t.Fatalf("Cache-Control = %q", got)
+	}
+	if recorder.Body.String() != "provider upstream request failed\n" {
+		t.Fatalf("body = %q", recorder.Body.String())
+	}
+}
diff --git a/internal/publisher/artifact.go b/internal/publisher/artifact.go
new file mode 100644
index 000000000..6cb10c796
--- /dev/null
+++ b/internal/publisher/artifact.go
@@ -0,0 +1,386 @@
+package publisher
+
+import (
+	"archive/tar"
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"path"
+	"sort"
+	"strings"
+	"unicode/utf8"
+
+	"github.com/orka-agents/orka/internal/workspacedelta"
+)
+
+const (
+	manifestArchivePath  = "meta/manifest.json"
+	deletionsArchivePath = "meta/deletions.json"
+	symlinksArchivePath  = "meta/symlinks.json"
+	fileArchivePrefix    = "files/"
+	maxDeltaEntries      = 100_000
+	maxDeltaPathBytes    = 4096
+	maxRelativeRootBytes = 1024
+)
+
+type deletionDocument struct {
+	Schema    string                    `json:"schema"`
+	Deletions []workspacedelta.Deletion `json:"deletions"`
+}
+
+type symlinkDocument struct {
+	Schema   string                   `json:"schema"`
+	Symlinks []workspacedelta.Symlink `json:"symlinks"`
+}
+
+type parsedDelta struct {
+	manifest       workspacedelta.Manifest
+	manifestDigest string
+	deletions      []workspacedelta.Deletion
+	symlinks       []workspacedelta.Symlink
+	files          map[string][]byte
+}
+
+//nolint:gocyclo // Every branch is a fail-closed validation of one hostile archive condition.
+func parseDeltaArtifact(artifact []byte, expectedDigest string, maxBytes int64) (parsedDelta, error) {
+	if int64(len(artifact)) > maxBytes {
+		return parsedDelta{}, operationError(ErrUnsafeDelta, "read workspace delta", fmt.Sprintf("artifact exceeds %d bytes", maxBytes), nil)
+	}
+	if err := validateDigest("workspace delta digest", expectedDigest); err != nil {
+		return parsedDelta{}, err
+	}
+	if digestBytes(artifact) != expectedDigest {
+		return parsedDelta{}, operationError(ErrUnsafeDelta, "validate workspace delta", "artifact digest mismatch", nil)
+	}
+	reader := tar.NewReader(bytes.NewReader(artifact))
+	entries := make(map[string][]byte)
+	for count := 0; ; count++ {
+		if count > maxDeltaEntries {
+			return parsedDelta{}, operationError(ErrUnsafeDelta, "read workspace delta", "too many tar entries", nil)
+		}
+		header, err := reader.Next()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return parsedDelta{}, operationError(ErrUnsafeDelta, "read workspace delta tar", "", err)
+		}
+		if header.Typeflag != tar.TypeReg {
+			return parsedDelta{}, operationError(ErrUnsafeDelta, "validate workspace delta tar", fmt.Sprintf("entry %q is not a regular file", header.Name), nil)
+		}
+		if header.Size < 0 || header.Size > maxBytes {
+			return parsedDelta{}, operationError(ErrUnsafeDelta, "validate workspace delta tar", fmt.Sprintf("entry %q has invalid size", header.Name), nil)
+		}
+		if err := validateTarEntryName(header.Name); err != nil {
+			return parsedDelta{}, err
+		}
+		if _, duplicate := entries[header.Name]; duplicate {
+			return parsedDelta{}, operationError(ErrUnsafeDelta, "validate workspace delta tar", fmt.Sprintf("duplicate entry %q", header.Name), nil)
+		}
+		data, err := io.ReadAll(io.LimitReader(reader, maxBytes+1))
+		if err != nil {
+			return parsedDelta{}, operationError(ErrUnsafeDelta, "read workspace delta entry", header.Name, err)
+		}
+		if int64(len(data)) != header.Size || int64(len(data)) > maxBytes {
+			return parsedDelta{}, operationError(ErrUnsafeDelta, "validate workspace delta entry", fmt.Sprintf("entry %q size mismatch", header.Name), nil)
+		}
+		entries[header.Name] = data
+	}
+	manifestBytes, ok := entries[manifestArchivePath]
+	if !ok {
+		return parsedDelta{}, operationError(ErrUnsafeDelta, "validate workspace delta", "manifest is missing", nil)
+	}
+	deletionBytes, ok := entries[deletionsArchivePath]
+	if !ok {
+		return parsedDelta{}, operationError(ErrUnsafeDelta, "validate workspace delta", "deletion manifest is missing", nil)
+	}
+	symlinkBytes, ok := entries[symlinksArchivePath]
+	if !ok {
+		return parsedDelta{}, operationError(ErrUnsafeDelta, "validate workspace delta", "symlink manifest is missing", nil)
+	}
+	var manifest workspacedelta.Manifest
+	if err := decodeCanonicalJSON(manifestBytes, &manifest); err != nil {
+		return parsedDelta{}, operationError(ErrUnsafeDelta, "decode workspace manifest", "", err)
+	}
+	var deletions deletionDocument
+	if err := decodeCanonicalJSON(deletionBytes, &deletions); err != nil {
+		return parsedDelta{}, operationError(ErrUnsafeDelta, "decode deletion manifest", "", err)
+	}
+	var symlinks symlinkDocument
+	if err := decodeCanonicalJSON(symlinkBytes, &symlinks); err != nil {
+		return parsedDelta{}, operationError(ErrUnsafeDelta, "decode symlink manifest", "", err)
+	}
+	if manifest.Schema != workspacedelta.ManifestSchema || deletions.Schema != workspacedelta.ManifestSchema || symlinks.Schema != workspacedelta.ManifestSchema {
+		return parsedDelta{}, operationError(ErrUnsafeDelta, "validate workspace delta schema", "unsupported schema", nil)
+	}
+	if manifest.DeletionsDigest != digestBytes(deletionBytes) || manifest.SymlinksDigest != digestBytes(symlinkBytes) {
+		return parsedDelta{}, operationError(ErrUnsafeDelta, "validate workspace delta manifests", "nested manifest digest mismatch", nil)
+	}
+	if err := validateSortedDelta(manifest.Entries, deletions.Deletions, symlinks.Symlinks); err != nil {
+		return parsedDelta{}, err
+	}
+	result := parsedDelta{
+		manifest: manifest, manifestDigest: digestBytes(manifestBytes),
+		deletions: deletions.Deletions, symlinks: symlinks.Symlinks, files: make(map[string][]byte),
+	}
+	for name, data := range entries {
+		switch name {
+		case manifestArchivePath, deletionsArchivePath, symlinksArchivePath:
+			continue
+		}
+		if !strings.HasPrefix(name, fileArchivePrefix) {
+			return parsedDelta{}, operationError(ErrUnsafeDelta, "validate workspace delta tar", fmt.Sprintf("unexpected entry %q", name), nil)
+		}
+		workspacePath := strings.TrimPrefix(name, fileArchivePrefix)
+		if err := validateWorkspacePath(workspacePath); err != nil {
+			return parsedDelta{}, err
+		}
+		result.files[workspacePath] = data
+	}
+	if err := result.validateCrossReferences(); err != nil {
+		return parsedDelta{}, err
+	}
+	return result, nil
+}
+
+// withRelativeRoot translates artifact-relative paths into repository-relative
+// paths exactly once. The immutable artifact and its manifest digest remain
+// unchanged; only the trusted in-memory view used for full-tree validation and
+// application is rooted beneath the session's declared workspace subpath.
+func (d parsedDelta) withRelativeRoot(relativeRoot string) (parsedDelta, error) {
+	if relativeRoot == "" || relativeRoot == "." {
+		return d, nil
+	}
+	if len(relativeRoot) > maxRelativeRootBytes {
+		return parsedDelta{}, operationError(ErrUnsafeDelta, "validate workspace relative root", "relative root exceeds limit", nil)
+	}
+	if err := validateWorkspacePath(relativeRoot); err != nil {
+		return parsedDelta{}, operationError(ErrUnsafeDelta, "validate workspace relative root", "relative root is not canonical", err)
+	}
+	prefix := func(value string) (string, error) {
+		rooted := path.Join(relativeRoot, value)
+		if err := validateWorkspacePath(rooted); err != nil {
+			return "", err
+		}
+		return rooted, nil
+	}
+
+	rooted := parsedDelta{
+		manifest:       d.manifest,
+		manifestDigest: d.manifestDigest,
+		deletions:      make([]workspacedelta.Deletion, len(d.deletions)),
+		symlinks:       make([]workspacedelta.Symlink, len(d.symlinks)),
+		files:          make(map[string][]byte, len(d.files)),
+	}
+	rooted.manifest.Entries = make([]workspacedelta.Change, len(d.manifest.Entries))
+	for index, change := range d.manifest.Entries {
+		rootedPath, err := prefix(change.Path)
+		if err != nil {
+			return parsedDelta{}, err
+		}
+		change.Path = rootedPath
+		rooted.manifest.Entries[index] = change
+	}
+	for index, deletion := range d.deletions {
+		rootedPath, err := prefix(deletion.Path)
+		if err != nil {
+			return parsedDelta{}, err
+		}
+		deletion.Path = rootedPath
+		rooted.deletions[index] = deletion
+	}
+	for index, symlink := range d.symlinks {
+		rootedPath, err := prefix(symlink.Path)
+		if err != nil {
+			return parsedDelta{}, err
+		}
+		symlink.Path = rootedPath
+		rooted.symlinks[index] = symlink
+	}
+	for filePath, data := range d.files {
+		rootedPath, err := prefix(filePath)
+		if err != nil {
+			return parsedDelta{}, err
+		}
+		rooted.files[rootedPath] = data
+	}
+	if err := validateSortedDelta(rooted.manifest.Entries, rooted.deletions, rooted.symlinks); err != nil {
+		return parsedDelta{}, err
+	}
+	if err := rooted.validateCrossReferences(); err != nil {
+		return parsedDelta{}, err
+	}
+	return rooted, nil
+}
+
+func validateTarEntryName(name string) error {
+	if name == manifestArchivePath || name == deletionsArchivePath || name == symlinksArchivePath {
+		return nil
+	}
+	if !strings.HasPrefix(name, fileArchivePrefix) {
+		return operationError(ErrUnsafeDelta, "validate workspace delta path", fmt.Sprintf("unexpected tar path %q", name), nil)
+	}
+	return validateWorkspacePath(strings.TrimPrefix(name, fileArchivePrefix))
+}
+
+func validateWorkspacePath(value string) error {
+	if value == "" || value == "." || len(value) > maxDeltaPathBytes || strings.HasPrefix(value, "/") ||
+		strings.Contains(value, "\\") || !utf8.ValidString(value) || hasControl(value) || path.Clean(value) != value {
+		return operationError(ErrUnsafeDelta, "validate workspace path", fmt.Sprintf("%q is not a canonical relative path", value), nil)
+	}
+	for component := range strings.SplitSeq(value, "/") {
+		if component == "" || component == "." || component == ".." {
+			return operationError(ErrUnsafeDelta, "validate workspace path", fmt.Sprintf("%q contains traversal", value), nil)
+		}
+		if strings.EqualFold(component, ".git") || strings.EqualFold(component, ".gitmodules") {
+			return operationError(ErrUnsafeDelta, "validate workspace path", fmt.Sprintf("%q contains child-controlled Git metadata", value), nil)
+		}
+	}
+	return nil
+}
+
+func validateSortedDelta(changes []workspacedelta.Change, deletions []workspacedelta.Deletion, symlinks []workspacedelta.Symlink) error {
+	if !sort.SliceIsSorted(changes, func(i, j int) bool { return changes[i].Path < changes[j].Path }) ||
+		!sort.SliceIsSorted(deletions, func(i, j int) bool { return deletions[i].Path < deletions[j].Path }) ||
+		!sort.SliceIsSorted(symlinks, func(i, j int) bool { return symlinks[i].Path < symlinks[j].Path }) {
+		return operationError(ErrUnsafeDelta, "validate workspace delta order", "manifest arrays must be strictly path-sorted", nil)
+	}
+	for _, group := range [][]string{changePaths(changes), deletionPaths(deletions), symlinkPaths(symlinks)} {
+		for index, current := range group {
+			if err := validateWorkspacePath(current); err != nil {
+				return err
+			}
+			if index > 0 && group[index-1] == current {
+				return operationError(ErrUnsafeDelta, "validate workspace delta order", fmt.Sprintf("duplicate path %q", current), nil)
+			}
+		}
+	}
+	return nil
+}
+
+func changePaths(values []workspacedelta.Change) []string {
+	result := make([]string, len(values))
+	for index := range values {
+		result[index] = values[index].Path
+	}
+	return result
+}
+
+func deletionPaths(values []workspacedelta.Deletion) []string {
+	result := make([]string, len(values))
+	for index := range values {
+		result[index] = values[index].Path
+	}
+	return result
+}
+
+func symlinkPaths(values []workspacedelta.Symlink) []string {
+	result := make([]string, len(values))
+	for index := range values {
+		result[index] = values[index].Path
+	}
+	return result
+}
+
+//nolint:gocyclo // Cross-document consistency is intentionally checked in one fail-closed pass.
+func (d parsedDelta) validateCrossReferences() error {
+	changes := make(map[string]workspacedelta.Change, len(d.manifest.Entries))
+	for _, change := range d.manifest.Entries {
+		changes[change.Path] = change
+		switch change.Kind {
+		case workspacedelta.EntryFile:
+			data, ok := d.files[change.Path]
+			if !ok || int64(len(data)) != change.Size || digestBytes(data) != change.Digest || change.Target != "" {
+				return operationError(ErrUnsafeDelta, "validate workspace file", fmt.Sprintf("payload metadata mismatch for %q", change.Path), nil)
+			}
+			if change.Mode != 0o644 && change.Mode != 0o755 {
+				return operationError(ErrUnsafeDelta, "validate workspace file", fmt.Sprintf("unsupported mode for %q", change.Path), nil)
+			}
+		case workspacedelta.EntrySymlink:
+			if _, ok := d.files[change.Path]; ok || change.Target == "" || change.Mode != 0o777 {
+				return operationError(ErrUnsafeDelta, "validate workspace symlink", fmt.Sprintf("invalid symlink payload for %q", change.Path), nil)
+			}
+			if err := validateSymlinkTarget(change.Path, change.Target); err != nil {
+				return err
+			}
+		case workspacedelta.EntryDirectory:
+			if _, ok := d.files[change.Path]; ok || change.Size != 0 || change.Digest != "" || change.Target != "" || change.Mode != 0o755 {
+				return operationError(ErrUnsafeDelta, "validate workspace directory", fmt.Sprintf("invalid directory metadata for %q", change.Path), nil)
+			}
+		default:
+			return operationError(ErrUnsafeDelta, "validate workspace entry", fmt.Sprintf("unsupported kind %q", change.Kind), nil)
+		}
+		switch change.Operation {
+		case workspacedelta.ChangeAdded, workspacedelta.ChangeModified, workspacedelta.ChangeReplaced:
+		default:
+			return operationError(ErrUnsafeDelta, "validate workspace entry", fmt.Sprintf("unsupported operation %q", change.Operation), nil)
+		}
+	}
+	for filePath := range d.files {
+		change, ok := changes[filePath]
+		if !ok || change.Kind != workspacedelta.EntryFile {
+			return operationError(ErrUnsafeDelta, "validate workspace file", fmt.Sprintf("unreferenced payload %q", filePath), nil)
+		}
+	}
+	links := make(map[string]workspacedelta.Symlink, len(d.symlinks))
+	for _, link := range d.symlinks {
+		if err := validateSymlinkTarget(link.Path, link.Target); err != nil {
+			return err
+		}
+		links[link.Path] = link
+		change, ok := changes[link.Path]
+		if !ok || change.Kind != workspacedelta.EntrySymlink || change.Target != link.Target || change.Mode != link.Mode {
+			return operationError(ErrUnsafeDelta, "validate workspace symlink", fmt.Sprintf("symlink manifest mismatch for %q", link.Path), nil)
+		}
+	}
+	for _, change := range d.manifest.Entries {
+		_, hasLink := links[change.Path]
+		if (change.Kind == workspacedelta.EntrySymlink) != hasLink {
+			return operationError(ErrUnsafeDelta, "validate workspace symlink", fmt.Sprintf("missing or extra symlink metadata for %q", change.Path), nil)
+		}
+	}
+	return nil
+}
+
+func validateSymlinkTarget(linkPath, target string) error {
+	if target == "" || strings.HasPrefix(target, "/") || strings.Contains(target, "\\") || !utf8.ValidString(target) || hasControl(target) {
+		return operationError(ErrUnsafeDelta, "validate workspace symlink", fmt.Sprintf("unsafe target %q for %q", target, linkPath), nil)
+	}
+	resolved := path.Clean(path.Join(path.Dir(linkPath), target))
+	if resolved == ".." || strings.HasPrefix(resolved, "../") {
+		return operationError(ErrUnsafeDelta, "validate workspace symlink", fmt.Sprintf("target for %q escapes repository", linkPath), nil)
+	}
+	return nil
+}
+
+func decodeCanonicalJSON(data []byte, value any) error {
+	decoder := json.NewDecoder(bytes.NewReader(data))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(value); err != nil {
+		return err
+	}
+	var trailing any
+	if err := decoder.Decode(&trailing); err != io.EOF {
+		if err == nil {
+			return fmt.Errorf("trailing JSON value")
+		}
+		return fmt.Errorf("trailing JSON data: %w", err)
+	}
+	encoded, err := json.Marshal(value)
+	if err != nil {
+		return err
+	}
+	encoded = append(encoded, '\n')
+	if !bytes.Equal(data, encoded) {
+		return fmt.Errorf("document is not canonical JSON")
+	}
+	return nil
+}
+
+func validateDigest(field, value string) error {
+	if !strings.HasPrefix(value, DigestPrefix) {
+		return invalid(field, "must be a sha256 digest")
+	}
+	return validateObjectID(field, strings.TrimPrefix(value, DigestPrefix))
+}
diff --git a/internal/publisher/command_other.go b/internal/publisher/command_other.go
new file mode 100644
index 000000000..1ffeae2ab
--- /dev/null
+++ b/internal/publisher/command_other.go
@@ -0,0 +1,12 @@
+//go:build !unix
+
+package publisher
+
+import (
+	"os/exec"
+	"time"
+)
+
+func configureCommandCancellation(command *exec.Cmd) {
+	command.WaitDelay = 2 * time.Second
+}
diff --git a/internal/publisher/command_unix.go b/internal/publisher/command_unix.go
new file mode 100644
index 000000000..8a770d0e2
--- /dev/null
+++ b/internal/publisher/command_unix.go
@@ -0,0 +1,20 @@
+//go:build unix
+
+package publisher
+
+import (
+	"os/exec"
+	"syscall"
+	"time"
+)
+
+func configureCommandCancellation(command *exec.Cmd) {
+	command.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+	command.Cancel = func() error {
+		if command.Process == nil {
+			return nil
+		}
+		return syscall.Kill(-command.Process.Pid, syscall.SIGKILL)
+	}
+	command.WaitDelay = 2 * time.Second
+}
diff --git a/internal/publisher/doc.go b/internal/publisher/doc.go
new file mode 100644
index 000000000..03bbb557b
--- /dev/null
+++ b/internal/publisher/doc.go
@@ -0,0 +1,9 @@
+// Package publisher implements the clean-room Git publication boundary.
+//
+// It never publishes from an agent-controlled checkout. Prepare imports a
+// trusted workspace-delta artifact into a fresh bare repository at an exact
+// source baseline, creates one deterministic Orka-owned commit, and persists a
+// content-addressed Git bundle. Publish performs an exact-old-OID, fast-forward
+// compare-and-swap. Verify uses a separate read-only observation to classify
+// the remote outcome.
+package publisher
diff --git a/internal/publisher/errors.go b/internal/publisher/errors.go
new file mode 100644
index 000000000..35950dfdf
--- /dev/null
+++ b/internal/publisher/errors.go
@@ -0,0 +1,76 @@
+package publisher
+
+import (
+	"errors"
+	"fmt"
+)
+
+var (
+	ErrInvalidRequest          = errors.New("invalid publisher request")
+	ErrInvalidRepository       = errors.New("invalid canonical repository")
+	ErrInvalidRef              = errors.New("invalid canonical branch ref")
+	ErrInvalidObjectID         = errors.New("invalid git object ID")
+	ErrUnsafeDelta             = errors.New("unsafe workspace delta")
+	ErrUnsupportedDelta        = errors.New("workspace delta cannot be represented by git")
+	ErrSourceMoved             = errors.New("source ref moved from persisted baseline")
+	ErrBranchMoved             = errors.New("publication branch moved from branch claim baseline")
+	ErrBranchClaimMismatch     = errors.New("publication branch claim does not match request")
+	ErrIdempotencyConflict     = errors.New("publisher operation identity was reused with different content")
+	ErrPreparedArtifactMissing = errors.New("prepared publication artifact is missing")
+	ErrPreparedArtifactCorrupt = errors.New("prepared publication artifact is corrupt")
+	ErrCASRejected             = errors.New("exact publication compare-and-swap was rejected")
+	ErrPublicationUnknown      = errors.New("publication outcome is unknown")
+	ErrVerificationUnknown     = errors.New("remote publication state could not be observed")
+)
+
+// Error attaches a stable classification to a publisher failure.
+type Error struct {
+	Kind      error
+	Operation string
+	Detail    string
+	Err       error
+}
+
+func (e *Error) Error() string {
+	if e == nil {
+		return "<nil>"
+	}
+	message := e.Operation
+	if e.Detail != "" {
+		if message != "" {
+			message += ": "
+		}
+		message += e.Detail
+	}
+	if e.Err != nil {
+		if message != "" {
+			message += ": "
+		}
+		message += e.Err.Error()
+	}
+	if message == "" && e.Kind != nil {
+		message = e.Kind.Error()
+	}
+	return message
+}
+
+func (e *Error) Unwrap() error {
+	if e == nil {
+		return nil
+	}
+	if e.Kind == nil {
+		return e.Err
+	}
+	if e.Err == nil {
+		return e.Kind
+	}
+	return errors.Join(e.Kind, e.Err)
+}
+
+func operationError(kind error, operation, detail string, err error) error {
+	return &Error{Kind: kind, Operation: operation, Detail: detail, Err: err}
+}
+
+func invalid(field, format string, args ...any) error {
+	return operationError(ErrInvalidRequest, "validate "+field, fmt.Sprintf(format, args...), nil)
+}
diff --git a/internal/publisher/git.go b/internal/publisher/git.go
new file mode 100644
index 000000000..4d9ca490a
--- /dev/null
+++ b/internal/publisher/git.go
@@ -0,0 +1,360 @@
+package publisher
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"maps"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"sort"
+	"strings"
+)
+
+const gitObjectFormatSHA1 = "sha1"
+
+var hardeningConfig = []string{
+	"credential.helper=",
+	"credential.interactive=never",
+	"core.askPass=",
+	"core.hooksPath=/dev/null",
+	"core.attributesFile=/dev/null",
+	"core.excludesFile=/dev/null",
+	"core.fsmonitor=false",
+	"core.untrackedCache=false",
+	"commit.gpgSign=false",
+	"tag.gpgSign=false",
+	"protocol.allow=never",
+	"protocol.file.allow=always",
+	"protocol.https.allow=always",
+	"protocol.ssh.allow=always",
+	"protocol.ext.allow=never",
+	"submodule.recurse=false",
+	"fetch.recurseSubmodules=false",
+	"push.recurseSubmodules=no",
+	"filter.lfs.required=false",
+	"filter.lfs.clean=",
+	"filter.lfs.smudge=",
+	"filter.lfs.process=",
+	"fetch.fsckObjects=true",
+	"transfer.fsckObjects=true",
+	"receive.fsckObjects=true",
+	"gc.auto=0",
+	"maintenance.auto=false",
+	"http.followRedirects=false",
+}
+
+type sandbox struct {
+	root     string
+	home     string
+	xdg      string
+	template string
+}
+
+func (p *Publisher) newSandbox(prefix string) (*sandbox, error) {
+	root, err := os.MkdirTemp(p.tempRoot, "orka-publisher-"+prefix+"-")
+	if err != nil {
+		return nil, fmt.Errorf("create publisher sandbox: %w", err)
+	}
+	if err := os.Chmod(root, 0o700); err != nil {
+		_ = os.RemoveAll(root)
+		return nil, fmt.Errorf("restrict publisher sandbox: %w", err)
+	}
+	result := &sandbox{root: root, home: filepath.Join(root, "home"), xdg: filepath.Join(root, "xdg"), template: filepath.Join(root, "template")}
+	if err := os.Mkdir(result.home, 0o700); err != nil {
+		_ = os.RemoveAll(root)
+		return nil, err
+	}
+	if err := os.Mkdir(result.xdg, 0o700); err != nil {
+		_ = os.RemoveAll(root)
+		return nil, err
+	}
+	if err := os.Mkdir(result.template, 0o700); err != nil {
+		_ = os.RemoveAll(root)
+		return nil, err
+	}
+	return result, nil
+}
+
+func (s *sandbox) Close() error {
+	if s == nil || s.root == "" {
+		return nil
+	}
+	return os.RemoveAll(s.root)
+}
+
+type commandResult struct {
+	stdout    string
+	stderr    string
+	truncated bool
+}
+
+func (p *Publisher) runGit(ctx context.Context, box *sandbox, directory string, extraEnv map[string]string, stdin []byte, args ...string) (commandResult, error) {
+	fullArgs := make([]string, 0, len(hardeningConfig)*2+len(args))
+	for _, setting := range hardeningConfig {
+		fullArgs = append(fullArgs, "-c", setting)
+	}
+	fullArgs = append(fullArgs, args...)
+	if p.commandRecord != nil {
+		p.commandRecord(append([]string(nil), fullArgs...))
+	}
+	command := exec.CommandContext(ctx, p.gitBinary, fullArgs...)
+	configureCommandCancellation(command)
+	command.Dir = directory
+	command.Env = p.commandEnvironment(box, extraEnv)
+	if stdin != nil {
+		command.Stdin = bytes.NewReader(stdin)
+	}
+	stdout := &boundedCommandBuffer{limit: p.maxCommandOutput}
+	stderr := &boundedCommandBuffer{limit: p.maxCommandOutput}
+	command.Stdout = stdout
+	command.Stderr = stderr
+	err := command.Run()
+	result := commandResult{stdout: stdout.String(), stderr: stderr.String(), truncated: stdout.truncated || stderr.truncated}
+	if err != nil {
+		if result.truncated {
+			return result, fmt.Errorf("git output exceeded %d bytes: %w", p.maxCommandOutput, err)
+		}
+		message := strings.TrimSpace(result.stderr)
+		if message == "" {
+			message = strings.TrimSpace(result.stdout)
+		}
+		if len(message) > 0 {
+			return result, fmt.Errorf("git %s: %s: %w", commandName(args), message, err)
+		}
+		return result, fmt.Errorf("git %s: %w", commandName(args), err)
+	}
+	if result.truncated {
+		return result, fmt.Errorf("git output exceeded %d bytes", p.maxCommandOutput)
+	}
+	return result, nil
+}
+
+func commandName(args []string) string {
+	for _, current := range args {
+		if current == "" || strings.HasPrefix(current, "-") {
+			continue
+		}
+		return current
+	}
+	return "command"
+}
+
+func (p *Publisher) commandEnvironment(box *sandbox, extra map[string]string) []string {
+	values := make(map[string]string, len(extra)+16)
+	maps.Copy(values, extra)
+	hardened := map[string]string{
+		"HOME":                   box.home,
+		"XDG_CONFIG_HOME":        box.xdg,
+		"GIT_CONFIG_GLOBAL":      "/dev/null",
+		"GIT_CONFIG_NOSYSTEM":    "1",
+		"GIT_TEMPLATE_DIR":       box.template,
+		"GIT_NO_REPLACE_OBJECTS": "1",
+		"GIT_EXEC_PATH":          p.gitExecPath,
+		"GIT_TERMINAL_PROMPT":    "0",
+		"GIT_ASKPASS":            "/bin/false",
+		"SSH_ASKPASS":            "/bin/false",
+		"GIT_ALLOW_PROTOCOL":     "file:https:ssh",
+		"GIT_PROTOCOL_FROM_USER": "0",
+		"GIT_OPTIONAL_LOCKS":     "0",
+		"LC_ALL":                 "C",
+		"LANG":                   "C",
+		"TZ":                     "UTC",
+		"PATH":                   p.trustedPath,
+	}
+	maps.Copy(values, hardened)
+	keys := make([]string, 0, len(values))
+	for key := range values {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	environment := make([]string, 0, len(keys))
+	for _, key := range keys {
+		environment = append(environment, key+"="+values[key])
+	}
+	environment = append(environment, p.proxyEnvironment.Variables()...)
+	return environment
+}
+
+type boundedCommandBuffer struct {
+	buffer    bytes.Buffer
+	limit     int64
+	truncated bool
+}
+
+func (b *boundedCommandBuffer) Write(value []byte) (int, error) {
+	original := len(value)
+	remaining := b.limit - int64(b.buffer.Len())
+	if remaining > 0 {
+		if int64(len(value)) > remaining {
+			value = value[:remaining]
+			b.truncated = true
+		}
+		_, _ = b.buffer.Write(value)
+	} else if len(value) > 0 {
+		b.truncated = true
+	}
+	return original, nil
+}
+
+func (b *boundedCommandBuffer) String() string { return b.buffer.String() }
+
+func objectFormat(oid string) string {
+	if len(oid) == 64 {
+		return "sha256"
+	}
+	return gitObjectFormatSHA1
+}
+
+func (p *Publisher) initBare(ctx context.Context, box *sandbox, repositoryPath, oid string) error {
+	_, err := p.runGit(ctx, box, box.root, nil, nil, "init", "--bare", "--object-format="+objectFormat(oid), "--", repositoryPath)
+	return err
+}
+
+func (p *Publisher) observeSource(ctx context.Context, box *sandbox, repository Repository, ref string) (RemoteRef, error) {
+	if validateObjectID("source ref", ref) != nil {
+		return p.observeRef(ctx, box, repository, ref)
+	}
+	if p.observeFault != nil {
+		if err := p.observeFault(ctx, repository, ref); err != nil {
+			return RemoteRef{}, err
+		}
+	}
+	repositoryPath := filepath.Join(box.root, "source-observe.git")
+	if err := p.initBare(ctx, box, repositoryPath, ref); err != nil {
+		return RemoteRef{}, fmt.Errorf("initialize exact source observation: %w", err)
+	}
+	if _, err := p.runGit(ctx, box, box.root, nil, nil, "--git-dir="+repositoryPath, "fetch", "--no-tags", "--no-recurse-submodules", "--depth=1", "--", repository.URL, ref+":refs/orka/source"); err != nil {
+		return RemoteRef{}, fmt.Errorf("fetch exact source commit: %w", err)
+	}
+	resolved, err := p.revParse(ctx, box, repositoryPath, "refs/orka/source^{commit}")
+	if err != nil {
+		return RemoteRef{}, err
+	}
+	if resolved != ref {
+		return RemoteRef{}, operationError(ErrSourceMoved, "observe exact source commit", "fetched source did not match the requested commit", nil)
+	}
+	if err := p.fsckCommit(ctx, box, repositoryPath, resolved); err != nil {
+		return RemoteRef{}, operationError(ErrPreparedArtifactCorrupt, "observe exact source commit", "strict fsck failed", err)
+	}
+	return RemoteRef{OID: resolved}, nil
+}
+
+func (p *Publisher) observeRef(ctx context.Context, box *sandbox, repository Repository, ref string) (RemoteRef, error) {
+	if p.observeFault != nil {
+		if err := p.observeFault(ctx, repository, ref); err != nil {
+			return RemoteRef{}, err
+		}
+	}
+	args := []string{"ls-remote", "--refs", "--", repository.URL, ref}
+	peeledRef := ""
+	if strings.HasPrefix(ref, "refs/tags/") {
+		peeledRef = ref + "^{}"
+		args = []string{"ls-remote", "--", repository.URL, ref, peeledRef}
+	}
+	result, err := p.runGit(ctx, box, box.root, nil, nil, args...)
+	if err != nil {
+		return RemoteRef{}, err
+	}
+	trimmed := strings.TrimSpace(result.stdout)
+	if trimmed == "" {
+		return RemoteRef{Absent: true}, nil
+	}
+	var directOID, peeledOID string
+	for line := range strings.SplitSeq(trimmed, "\n") {
+		fields := strings.Fields(line)
+		if len(fields) != 2 {
+			return RemoteRef{}, fmt.Errorf("remote returned malformed exact ref observation")
+		}
+		if err := validateObjectID("observed remote", fields[0]); err != nil {
+			return RemoteRef{}, err
+		}
+		switch fields[1] {
+		case ref:
+			if directOID != "" {
+				return RemoteRef{}, fmt.Errorf("remote returned multiple rows for exact ref %q", ref)
+			}
+			directOID = fields[0]
+		case peeledRef:
+			if peeledRef == "" || peeledOID != "" {
+				return RemoteRef{}, fmt.Errorf("remote returned malformed exact ref observation")
+			}
+			peeledOID = fields[0]
+		default:
+			return RemoteRef{}, fmt.Errorf("remote returned malformed exact ref observation")
+		}
+	}
+	if directOID == "" {
+		return RemoteRef{}, fmt.Errorf("remote returned malformed exact ref observation")
+	}
+	if peeledOID != "" {
+		return RemoteRef{OID: peeledOID}, nil
+	}
+	return RemoteRef{OID: directOID}, nil
+}
+
+func (p *Publisher) importBundle(ctx context.Context, box *sandbox, prepared PreparedPublication) (string, error) {
+	repositoryPath := filepath.Join(box.root, "objects.git")
+	if err := p.initBare(ctx, box, repositoryPath, prepared.CommitOID); err != nil {
+		return "", fmt.Errorf("initialize bundle repository: %w", err)
+	}
+	result, err := p.runGit(ctx, box, box.root, nil, nil, "--git-dir="+repositoryPath, "fetch", "--no-tags", "--no-recurse-submodules", "--", prepared.BundlePath, prepared.BundleRef+":refs/orka/prepared")
+	if err != nil {
+		return "", fmt.Errorf("import durable bundle: %w", err)
+	}
+	_ = result
+	resolved, err := p.revParse(ctx, box, repositoryPath, "refs/orka/prepared^{commit}")
+	if err != nil {
+		return "", err
+	}
+	if resolved != prepared.CommitOID {
+		return "", operationError(ErrPreparedArtifactCorrupt, "import durable bundle", "bundle ref does not resolve to persisted commit", nil)
+	}
+	if err := p.fsckCommit(ctx, box, repositoryPath, prepared.CommitOID); err != nil {
+		return "", operationError(ErrPreparedArtifactCorrupt, "import durable bundle", "strict fsck failed", err)
+	}
+	return repositoryPath, nil
+}
+
+func (p *Publisher) revParse(ctx context.Context, box *sandbox, repositoryPath, revision string) (string, error) {
+	result, err := p.runGit(ctx, box, box.root, nil, nil, "--git-dir="+repositoryPath, "rev-parse", "--verify", revision)
+	if err != nil {
+		return "", err
+	}
+	value := strings.TrimSpace(result.stdout)
+	if err := validateObjectID("resolved revision", value); err != nil {
+		return "", err
+	}
+	return value, nil
+}
+
+func (p *Publisher) isAncestor(ctx context.Context, box *sandbox, repositoryPath, ancestor, descendant string) (bool, error) {
+	_, err := p.runGit(ctx, box, box.root, nil, nil, "--git-dir="+repositoryPath, "merge-base", "--is-ancestor", ancestor, descendant)
+	if err == nil {
+		return true, nil
+	}
+	var exitError *exec.ExitError
+	if errors.As(err, &exitError) && exitError.ExitCode() == 1 {
+		return false, nil
+	}
+	return false, err
+}
+
+func readBoundedFile(path string, limit int64) ([]byte, error) {
+	file, err := os.Open(path)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = file.Close() }()
+	data, err := io.ReadAll(io.LimitReader(file, limit+1))
+	if err != nil {
+		return nil, err
+	}
+	if int64(len(data)) > limit {
+		return nil, fmt.Errorf("file exceeds %d bytes", limit)
+	}
+	return data, nil
+}
diff --git a/internal/publisher/git_test.go b/internal/publisher/git_test.go
new file mode 100644
index 000000000..bcf3d7ded
--- /dev/null
+++ b/internal/publisher/git_test.go
@@ -0,0 +1,97 @@
+package publisher
+
+import (
+	"context"
+	"strings"
+	"testing"
+)
+
+func TestPublisherObserveRefPeelsAnnotatedTags(t *testing.T) {
+	fixture := newRepositoryFixture(t, false)
+	const (
+		annotatedTag      = "v1.2.3-annotated"
+		annotatedTagRef   = "refs/tags/" + annotatedTag
+		lightweightTag    = "v1.2.3-lightweight"
+		lightweightTagRef = "refs/tags/" + lightweightTag
+	)
+	runTestGit(t, fixture.seed, fixedCommitEnvironment(), "tag", "-a", annotatedTag, "-m", "annotated release")
+	runTestGit(t, fixture.seed, nil, "tag", lightweightTag)
+	runTestGit(t, fixture.seed, nil, "push", "--", fixture.source.URL, annotatedTagRef, lightweightTagRef)
+
+	annotatedTagOID := strings.TrimSpace(runTestGit(t, fixture.seed, nil, "rev-parse", annotatedTagRef))
+	if annotatedTagOID == fixture.baselineOID {
+		t.Fatal("annotated tag fixture unexpectedly resolves directly to the commit object")
+	}
+
+	publisher := newTestPublisher(t)
+	box, err := publisher.newSandbox("observe-ref-test")
+	if err != nil {
+		t.Fatalf("create publisher sandbox: %v", err)
+	}
+	defer func() {
+		if err := box.Close(); err != nil {
+			t.Errorf("close publisher sandbox: %v", err)
+		}
+	}()
+
+	for _, test := range []struct {
+		name string
+		ref  string
+	}{
+		{name: "branch", ref: "refs/heads/main"},
+		{name: "lightweight tag", ref: lightweightTagRef},
+		{name: "annotated tag", ref: annotatedTagRef},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			observed, err := publisher.observeRef(context.Background(), box, fixture.source, test.ref)
+			if err != nil {
+				t.Fatalf("observeRef(%q): %v", test.ref, err)
+			}
+			if observed.Absent || observed.OID != fixture.baselineOID {
+				t.Fatalf("observeRef(%q) = %#v, want commit %s", test.ref, observed, fixture.baselineOID)
+			}
+		})
+	}
+}
+
+func TestPublisherObserveSourcePreservesExactObjectID(t *testing.T) {
+	fixture := newRepositoryFixture(t, false)
+	publisher := newTestPublisher(t)
+	box, err := publisher.newSandbox("observe-source-test")
+	if err != nil {
+		t.Fatalf("create publisher sandbox: %v", err)
+	}
+	defer func() {
+		if err := box.Close(); err != nil {
+			t.Errorf("close publisher sandbox: %v", err)
+		}
+	}()
+
+	observed, err := publisher.observeSource(context.Background(), box, fixture.source, fixture.baselineOID)
+	if err != nil {
+		t.Fatalf("observeSource(%q): %v", fixture.baselineOID, err)
+	}
+	if observed.Absent || observed.OID != fixture.baselineOID {
+		t.Fatalf("observeSource(%q) = %#v, want exact commit", fixture.baselineOID, observed)
+	}
+}
+
+func TestPrepareAcceptsAnnotatedSourceTag(t *testing.T) {
+	fixture := newRepositoryFixture(t, false)
+	const (
+		tag    = "v2.0.0"
+		tagRef = "refs/tags/" + tag
+	)
+	runTestGit(t, fixture.seed, fixedCommitEnvironment(), "tag", "-a", tag, "-m", "release")
+	runTestGit(t, fixture.seed, nil, "push", "--", fixture.source.URL, tagRef)
+
+	request := fixture.prepareRequest("publication-annotated-source", "prepare-annotated-source", RemoteRef{Absent: true})
+	request.SourceRef = tagRef
+	prepared, err := newTestPublisher(t).Prepare(context.Background(), request)
+	if err != nil {
+		t.Fatalf("Prepare annotated source tag: %v", err)
+	}
+	if prepared.SourceRef != tagRef || prepared.BaselineOID != fixture.baselineOID {
+		t.Fatalf("prepared annotated source = %#v, want ref %q at %s", prepared, tagRef, fixture.baselineOID)
+	}
+}
diff --git a/internal/publisher/pr.go b/internal/publisher/pr.go
new file mode 100644
index 000000000..2bc8b8004
--- /dev/null
+++ b/internal/publisher/pr.go
@@ -0,0 +1,79 @@
+package publisher
+
+import (
+	"context"
+	"fmt"
+)
+
+// Key returns the exact immutable tuple identity used for PR reconciliation.
+func (i PullRequestIntent) Key() (string, error) {
+	if err := validatePullRequestIntent(i); err != nil {
+		return "", err
+	}
+	type repositoryIdentity struct {
+		Provider string `json:"provider"`
+		ID       string `json:"id"`
+	}
+	return digestCanonical(struct {
+		Domain                string             `json:"domain"`
+		BaseRepository        repositoryIdentity `json:"baseRepository"`
+		BaseRef               string             `json:"baseRef"`
+		HeadRepository        repositoryIdentity `json:"headRepository"`
+		HeadRef               string             `json:"headRef"`
+		PublicationGeneration int64              `json:"publicationGeneration"`
+		ExpectedHeadOID       string             `json:"expectedHeadOid"`
+	}{
+		Domain:         "orka.publisher.pr-intent.v1",
+		BaseRepository: repositoryIdentity{Provider: i.BaseRepository.Provider, ID: i.BaseRepository.ID}, BaseRef: i.BaseRef,
+		HeadRepository: repositoryIdentity{Provider: i.HeadRepository.Provider, ID: i.HeadRepository.ID}, HeadRef: i.HeadRef,
+		PublicationGeneration: i.PublicationGeneration, ExpectedHeadOID: i.ExpectedHeadOID,
+	})
+}
+
+func validatePullRequestIntent(intent PullRequestIntent) error {
+	if err := validateRepository(intent.BaseRepository); err != nil {
+		return err
+	}
+	if err := validateRepository(intent.HeadRepository); err != nil {
+		return err
+	}
+	if err := validateBranchRef(intent.BaseRef); err != nil {
+		return err
+	}
+	if err := validateBranchRef(intent.HeadRef); err != nil {
+		return err
+	}
+	if intent.PublicationGeneration < 1 {
+		return invalid("PR publication generation", "must be at least 1")
+	}
+	return validateObjectID("PR expected head", intent.ExpectedHeadOID)
+}
+
+// ReconcilePullRequest validates the exact tuple before and after delegating to
+// the SCM-specific reconciler. The caller must have durably persisted intent
+// before invoking this method.
+func ReconcilePullRequest(ctx context.Context, intent PullRequestIntent, reconciler PullRequestReconciler) (PullRequestReceipt, error) {
+	if reconciler == nil {
+		return PullRequestReceipt{}, invalid("PR reconciler", "must not be nil")
+	}
+	key, err := intent.Key()
+	if err != nil {
+		return PullRequestReceipt{}, err
+	}
+	if err := ctx.Err(); err != nil {
+		return PullRequestReceipt{}, err
+	}
+	receipt, err := reconciler.Reconcile(ctx, intent)
+	if err != nil {
+		return PullRequestReceipt{}, err
+	}
+	if receipt.IntentKey != key || receipt.ForgeID == "" || receipt.URL == "" || receipt.HeadOID != intent.ExpectedHeadOID {
+		return PullRequestReceipt{}, operationError(ErrIdempotencyConflict, "validate PR receipt", "forge receipt does not match the exact persisted tuple", nil)
+	}
+	switch receipt.State {
+	case PullRequestOpen, PullRequestClosed, PullRequestMerged:
+		return receipt, nil
+	default:
+		return PullRequestReceipt{}, fmt.Errorf("validate PR receipt state %q: %w", receipt.State, ErrInvalidRequest)
+	}
+}
diff --git a/internal/publisher/prepare.go b/internal/publisher/prepare.go
new file mode 100644
index 000000000..41b863992
--- /dev/null
+++ b/internal/publisher/prepare.go
@@ -0,0 +1,451 @@
+package publisher
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"github.com/orka-agents/orka/internal/workspacedelta"
+)
+
+type treeEntry struct {
+	kind workspacedelta.EntryKind
+	mode string
+	oid  string
+}
+
+//nolint:gocyclo // Prepare keeps the ordered durable security boundary explicit.
+func (p *Publisher) Prepare(ctx context.Context, request PrepareRequest) (PreparedPublication, error) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if err := validatePrepareRequest(request); err != nil {
+		return PreparedPublication{}, err
+	}
+	requestDigest, err := prepareRequestDigest(request)
+	if err != nil {
+		return PreparedPublication{}, err
+	}
+	publicationDirectory, err := p.ensurePublicationDirectory(request.PublicationID, request.PublicationGeneration)
+	if err != nil {
+		return PreparedPublication{}, err
+	}
+	metadataPath := filepath.Join(publicationDirectory, preparedMetadataName)
+	if _, statErr := os.Stat(metadataPath); statErr == nil {
+		prepared, loadErr := p.loadPrepared(request.PublicationID)
+		if loadErr != nil {
+			return PreparedPublication{}, loadErr
+		}
+		if prepared.RequestDigest != requestDigest {
+			return PreparedPublication{}, operationError(ErrIdempotencyConflict, "prepare publication", "publication ID already has a different prepared request digest", nil)
+		}
+		prepared.OperationID = request.OperationID
+		return prepared, nil
+	} else if !os.IsNotExist(statErr) {
+		return PreparedPublication{}, statErr
+	}
+	delta, err := parseDeltaArtifact(request.DeltaArtifact, request.DeltaArtifactDigest, p.maxDeltaBytes)
+	if err != nil {
+		return PreparedPublication{}, err
+	}
+	delta, err = delta.withRelativeRoot(request.RelativeRoot)
+	if err != nil {
+		return PreparedPublication{}, err
+	}
+	if err := ctx.Err(); err != nil {
+		return PreparedPublication{}, err
+	}
+	box, err := p.newSandbox("prepare")
+	if err != nil {
+		return PreparedPublication{}, err
+	}
+	defer box.Close() //nolint:errcheck
+	repositoryPath := filepath.Join(box.root, "source.git")
+	if err := p.initBare(ctx, box, repositoryPath, request.BaselineOID); err != nil {
+		return PreparedPublication{}, fmt.Errorf("initialize fresh source clone: %w", err)
+	}
+	observed, err := p.observeSource(ctx, box, request.Source, request.SourceRef)
+	if err != nil {
+		return PreparedPublication{}, operationError(ErrSourceMoved, "observe source ref", "remote baseline could not be established", err)
+	}
+	if observed.Absent || observed.OID != request.BaselineOID {
+		return PreparedPublication{}, operationError(ErrSourceMoved, "observe source ref", fmt.Sprintf("expected %s, observed %s", request.BaselineOID, formatRemoteRef(observed)), nil)
+	}
+	// Publication bundles are restored into an empty verifier, so they must
+	// contain the baseline's complete parent history rather than a shallow
+	// boundary that exists only in this temporary repository.
+	if _, err := p.runGit(ctx, box, box.root, nil, nil, "--git-dir="+repositoryPath, "fetch", "--no-tags", "--no-recurse-submodules", "--", request.Source.URL, request.SourceRef+":refs/orka/source"); err != nil {
+		return PreparedPublication{}, operationError(ErrSourceMoved, "fetch exact source baseline", "", err)
+	}
+	fetched, err := p.revParse(ctx, box, repositoryPath, "refs/orka/source^{commit}")
+	if err != nil || fetched != request.BaselineOID {
+		return PreparedPublication{}, operationError(ErrSourceMoved, "verify fetched source baseline", fmt.Sprintf("expected %s, fetched %s", request.BaselineOID, fetched), err)
+	}
+	if err := p.fsckCommit(ctx, box, repositoryPath, request.BaselineOID); err != nil {
+		return PreparedPublication{}, operationError(ErrPreparedArtifactCorrupt, "verify fetched source objects", "strict fsck failed", err)
+	}
+	baselineTreeOID, err := p.revParse(ctx, box, repositoryPath, request.BaselineOID+"^{tree}")
+	if err != nil {
+		return PreparedPublication{}, fmt.Errorf("resolve baseline tree: %w", err)
+	}
+	baseline, err := p.readTree(ctx, box, repositoryPath, request.BaselineOID)
+	if err != nil {
+		return PreparedPublication{}, err
+	}
+	if err := validateDeltaAgainstBaseline(delta, baseline); err != nil {
+		return PreparedPublication{}, err
+	}
+	indexPath := filepath.Join(box.root, "publication.index")
+	indexEnv := map[string]string{"GIT_INDEX_FILE": indexPath}
+	if _, err := p.runGit(ctx, box, box.root, indexEnv, nil, "--git-dir="+repositoryPath, "read-tree", request.BaselineOID+"^{tree}"); err != nil {
+		return PreparedPublication{}, fmt.Errorf("seed clean publication index: %w", err)
+	}
+	if err := p.applyDelta(ctx, box, repositoryPath, indexEnv, delta, baseline); err != nil {
+		return PreparedPublication{}, err
+	}
+	written, err := p.runGit(ctx, box, box.root, indexEnv, nil, "--git-dir="+repositoryPath, "write-tree")
+	if err != nil {
+		return PreparedPublication{}, fmt.Errorf("write deterministic publication tree: %w", err)
+	}
+	treeOID := strings.TrimSpace(written.stdout)
+	if err := validateObjectID("prepared tree", treeOID); err != nil {
+		return PreparedPublication{}, err
+	}
+	if treeOID == baselineTreeOID {
+		return PreparedPublication{}, operationError(ErrUnsupportedDelta, "prepare publication", "delta does not change the Git tree (for example, it only changes empty directories)", nil)
+	}
+	commitEnv := map[string]string{
+		"GIT_AUTHOR_NAME":     CommitAuthorName,
+		"GIT_AUTHOR_EMAIL":    CommitAuthorEmail,
+		"GIT_AUTHOR_DATE":     gitDate(request.CommitTimestamp),
+		"GIT_COMMITTER_NAME":  CommitAuthorName,
+		"GIT_COMMITTER_EMAIL": CommitAuthorEmail,
+		"GIT_COMMITTER_DATE":  gitDate(request.CommitTimestamp),
+	}
+	committed, err := p.runGit(ctx, box, box.root, commitEnv, []byte(request.CommitMessage), "--git-dir="+repositoryPath, "commit-tree", treeOID, "-p", request.BaselineOID, "-F", "-")
+	if err != nil {
+		return PreparedPublication{}, fmt.Errorf("create deterministic Orka commit: %w", err)
+	}
+	commitOID := strings.TrimSpace(committed.stdout)
+	if err := validateObjectID("prepared commit", commitOID); err != nil {
+		return PreparedPublication{}, err
+	}
+	if err := p.verifyPreparedCommit(ctx, box, repositoryPath, commitOID, treeOID, request); err != nil {
+		return PreparedPublication{}, err
+	}
+	bundleRef := "refs/orka/publications/" + strings.TrimPrefix(digestBytes([]byte(request.PublicationID)), DigestPrefix)
+	if _, err := p.runGit(ctx, box, box.root, nil, nil, "--git-dir="+repositoryPath, "update-ref", bundleRef, commitOID, strings.Repeat("0", len(commitOID))); err != nil {
+		return PreparedPublication{}, fmt.Errorf("create immutable bundle ref: %w", err)
+	}
+	temporaryBundle := filepath.Join(box.root, bundleFileName)
+	if _, err := p.runGit(ctx, box, box.root, nil, nil, "--git-dir="+repositoryPath, "bundle", "create", "--version=3", temporaryBundle, bundleRef); err != nil {
+		return PreparedPublication{}, fmt.Errorf("create durable Git bundle: %w", err)
+	}
+	bundleBytes, err := readBoundedFile(temporaryBundle, p.maxBundleBytes)
+	if err != nil {
+		return PreparedPublication{}, operationError(ErrPreparedArtifactCorrupt, "read prepared Git bundle", "", err)
+	}
+	if err := p.verifyBundle(ctx, box, temporaryBundle, commitOID, bundleRef); err != nil {
+		return PreparedPublication{}, err
+	}
+	bundlePath := filepath.Join(publicationDirectory, bundleFileName)
+	if err := writeDurableFile(bundlePath, bundleBytes, 0o600); err != nil {
+		return PreparedPublication{}, fmt.Errorf("persist durable Git bundle: %w", err)
+	}
+	prepared := PreparedPublication{
+		PublicationID: request.PublicationID, PublicationGeneration: request.PublicationGeneration,
+		OperationID: request.OperationID, RequestDigest: requestDigest,
+		Source: request.Source, SourceRef: request.SourceRef, Target: request.Target, TargetRef: request.TargetRef,
+		BranchClaimGeneration: request.BranchClaimGeneration, BaselineOID: request.BaselineOID,
+		RemoteBefore: request.RemoteBefore, DeltaArtifactDigest: request.DeltaArtifactDigest,
+		RelativeRoot:   request.RelativeRoot,
+		ManifestDigest: delta.manifestDigest, TreeOID: treeOID, CommitOID: commitOID,
+		BundleDigest: digestBytes(bundleBytes), BundleSize: int64(len(bundleBytes)), BundleRef: bundleRef, BundlePath: bundlePath,
+		CommitMessage: request.CommitMessage, CommitTimestamp: request.CommitTimestamp,
+	}
+	if err := writeCanonicalDurable(metadataPath, prepared); err != nil {
+		return PreparedPublication{}, fmt.Errorf("persist prepared publication receipt: %w", err)
+	}
+	return prepared, nil
+}
+
+func validatePrepareRequest(request PrepareRequest) error {
+	if err := validateIdentifier("publication ID", request.PublicationID); err != nil {
+		return err
+	}
+	if request.PublicationGeneration < 1 || request.BranchClaimGeneration < 1 {
+		return invalid("publication generation", "publication and branch claim generations must be at least 1")
+	}
+	if err := validateIdentifier("operation ID", request.OperationID); err != nil {
+		return err
+	}
+	if err := validateRepository(request.Source); err != nil {
+		return err
+	}
+	if err := validateRepository(request.Target); err != nil {
+		return err
+	}
+	if err := validateSourceRef(request.SourceRef); err != nil {
+		return err
+	}
+	if err := validateBranchRef(request.TargetRef); err != nil {
+		return err
+	}
+	if err := validateObjectID("baseline", request.BaselineOID); err != nil {
+		return err
+	}
+	if err := validateSourceRefBaseline(request.SourceRef, request.BaselineOID); err != nil {
+		return err
+	}
+	if err := validateRemoteRef("remote before", request.RemoteBefore); err != nil {
+		return err
+	}
+	if request.RemoteBefore.OID != "" && len(request.RemoteBefore.OID) != len(request.BaselineOID) {
+		return invalid("remote before", "object format differs from source baseline")
+	}
+	if err := validateDigest("workspace delta digest", request.DeltaArtifactDigest); err != nil {
+		return err
+	}
+	if len(request.DeltaArtifact) == 0 {
+		return invalid("workspace delta", "artifact must not be empty")
+	}
+	if request.RelativeRoot != "" && request.RelativeRoot != "." {
+		if len(request.RelativeRoot) > maxRelativeRootBytes {
+			return invalid("workspace relative root", "must be at most %d bytes", maxRelativeRootBytes)
+		}
+		if err := validateWorkspacePath(request.RelativeRoot); err != nil {
+			return invalid("workspace relative root", "must be a canonical relative path")
+		}
+	}
+	if request.CommitMessage == "" || len(request.CommitMessage) > 4096 || !utf8.ValidString(request.CommitMessage) ||
+		strings.ContainsRune(request.CommitMessage, 0) || strings.Contains(request.CommitMessage, "\r") || !strings.HasSuffix(request.CommitMessage, "\n") {
+		return invalid("commit message", "must be non-empty UTF-8, at most 4096 bytes, contain no NUL/CR, and end with newline")
+	}
+	if request.CommitTimestamp.Location() != time.UTC || request.CommitTimestamp.Nanosecond() != 0 || request.CommitTimestamp.IsZero() {
+		return invalid("commit timestamp", "must be a non-zero whole-second UTC timestamp")
+	}
+	return nil
+}
+
+func prepareRequestDigest(request PrepareRequest) (string, error) {
+	return digestCanonical(struct {
+		Domain                string     `json:"domain"`
+		PublicationID         string     `json:"publicationId"`
+		PublicationGeneration int64      `json:"publicationGeneration"`
+		Source                Repository `json:"source"`
+		SourceRef             string     `json:"sourceRef"`
+		Target                Repository `json:"target"`
+		TargetRef             string     `json:"targetRef"`
+		BranchClaimGeneration int64      `json:"branchClaimGeneration"`
+		BaselineOID           string     `json:"baselineOid"`
+		RemoteBefore          RemoteRef  `json:"remoteBefore"`
+		DeltaArtifactDigest   string     `json:"deltaArtifactDigest"`
+		RelativeRoot          string     `json:"relativeRoot,omitempty"`
+		CommitAuthorName      string     `json:"commitAuthorName"`
+		CommitAuthorEmail     string     `json:"commitAuthorEmail"`
+		CommitMessage         string     `json:"commitMessage"`
+		CommitTimestamp       time.Time  `json:"commitTimestamp"`
+	}{
+		Domain: "orka.publisher.prepare.v1", PublicationID: request.PublicationID,
+		PublicationGeneration: request.PublicationGeneration, Source: request.Source, SourceRef: request.SourceRef,
+		Target: request.Target, TargetRef: request.TargetRef, BranchClaimGeneration: request.BranchClaimGeneration,
+		BaselineOID: request.BaselineOID, RemoteBefore: request.RemoteBefore,
+		DeltaArtifactDigest: request.DeltaArtifactDigest, RelativeRoot: request.RelativeRoot, CommitAuthorName: CommitAuthorName,
+		CommitAuthorEmail: CommitAuthorEmail, CommitMessage: request.CommitMessage, CommitTimestamp: request.CommitTimestamp,
+	})
+}
+
+func (p *Publisher) readTree(ctx context.Context, box *sandbox, repositoryPath, revision string) (map[string]treeEntry, error) {
+	result, err := p.runGit(ctx, box, box.root, nil, nil, "--git-dir="+repositoryPath, "ls-tree", "-r", "-t", "-z", "--full-tree", revision+"^{tree}")
+	if err != nil {
+		return nil, fmt.Errorf("inspect trusted baseline tree: %w", err)
+	}
+	entries := make(map[string]treeEntry)
+	for record := range bytes.SplitSeq([]byte(result.stdout), []byte{0}) {
+		if len(record) == 0 {
+			continue
+		}
+		parts := bytes.SplitN(record, []byte{'\t'}, 2)
+		if len(parts) != 2 {
+			return nil, operationError(ErrPreparedArtifactCorrupt, "inspect trusted baseline tree", "malformed ls-tree record", nil)
+		}
+		metadata := strings.Fields(string(parts[0]))
+		entryPath := string(parts[1])
+		if len(metadata) != 3 {
+			return nil, operationError(ErrPreparedArtifactCorrupt, "inspect trusted baseline tree", "malformed ls-tree metadata", nil)
+		}
+		if err := validateWorkspacePath(entryPath); err != nil {
+			return nil, operationError(ErrUnsafeDelta, "validate trusted baseline tree", entryPath, err)
+		}
+		var kind workspacedelta.EntryKind
+		switch metadata[0] {
+		case "040000":
+			kind = workspacedelta.EntryDirectory
+		case "100644", "100755":
+			kind = workspacedelta.EntryFile
+		case "120000":
+			kind = workspacedelta.EntrySymlink
+		case "160000":
+			return nil, operationError(ErrUnsafeDelta, "validate trusted baseline tree", fmt.Sprintf("submodule gitlink %q is forbidden", entryPath), nil)
+		default:
+			return nil, operationError(ErrUnsafeDelta, "validate trusted baseline tree", fmt.Sprintf("unsupported mode %s for %q", metadata[0], entryPath), nil)
+		}
+		entries[entryPath] = treeEntry{kind: kind, mode: metadata[0], oid: metadata[2]}
+	}
+	return entries, nil
+}
+
+func validateDeltaAgainstBaseline(delta parsedDelta, baseline map[string]treeEntry) error {
+	deletions := make(map[string]workspacedelta.Deletion, len(delta.deletions))
+	for _, deletion := range delta.deletions {
+		before, ok := baseline[deletion.Path]
+		if !ok || before.kind != deletion.Kind {
+			return operationError(ErrUnsafeDelta, "validate delta deletion", fmt.Sprintf("%q does not match trusted baseline", deletion.Path), nil)
+		}
+		deletions[deletion.Path] = deletion
+	}
+	for _, change := range delta.manifest.Entries {
+		before, exists := baseline[change.Path]
+		switch change.Operation {
+		case workspacedelta.ChangeAdded:
+			if _, deleted := deletions[change.Path]; deleted {
+				return operationError(ErrUnsafeDelta, "validate delta addition", fmt.Sprintf("%q is both added and deleted", change.Path), nil)
+			}
+			if exists {
+				return operationError(ErrUnsafeDelta, "validate delta addition", fmt.Sprintf("%q already exists in trusted baseline", change.Path), nil)
+			}
+		case workspacedelta.ChangeModified:
+			if _, deleted := deletions[change.Path]; deleted {
+				return operationError(ErrUnsafeDelta, "validate delta modification", fmt.Sprintf("%q is both modified and deleted", change.Path), nil)
+			}
+			if !exists || before.kind != change.Kind {
+				return operationError(ErrUnsafeDelta, "validate delta modification", fmt.Sprintf("%q does not match trusted baseline kind", change.Path), nil)
+			}
+		case workspacedelta.ChangeReplaced:
+			if !exists || before.kind == change.Kind {
+				return operationError(ErrUnsafeDelta, "validate delta replacement", fmt.Sprintf("%q is not a type replacement", change.Path), nil)
+			}
+			if _, ok := deletions[change.Path]; !ok {
+				return operationError(ErrUnsafeDelta, "validate delta replacement", fmt.Sprintf("%q lacks matching deletion metadata", change.Path), nil)
+			}
+		}
+	}
+	for deletionPath, deletion := range deletions {
+		if deletion.Kind != workspacedelta.EntryDirectory {
+			continue
+		}
+		prefix := deletionPath + "/"
+		for entryPath, entry := range baseline {
+			if entry.kind == workspacedelta.EntryDirectory || !strings.HasPrefix(entryPath, prefix) {
+				continue
+			}
+			if _, ok := deletions[entryPath]; !ok {
+				return operationError(ErrUnsafeDelta, "validate directory deletion", fmt.Sprintf("%q omits descendant %q", deletionPath, entryPath), nil)
+			}
+		}
+	}
+	return nil
+}
+
+func (p *Publisher) applyDelta(ctx context.Context, box *sandbox, repositoryPath string, indexEnv map[string]string, delta parsedDelta, baseline map[string]treeEntry) error {
+	for _, deletion := range delta.deletions {
+		if deletion.Kind == workspacedelta.EntryDirectory {
+			continue
+		}
+		input := []byte("0 " + strings.Repeat("0", len(baseline[deletion.Path].oid)) + "\t" + deletion.Path + "\n")
+		if _, err := p.runGit(ctx, box, box.root, indexEnv, input, "--git-dir="+repositoryPath, "update-index", "--index-info"); err != nil {
+			return fmt.Errorf("remove %q from clean publication index: %w", deletion.Path, err)
+		}
+	}
+	for _, change := range delta.manifest.Entries {
+		var mode string
+		var content []byte
+		switch change.Kind {
+		case workspacedelta.EntryDirectory:
+			continue
+		case workspacedelta.EntryFile:
+			content = delta.files[change.Path]
+			mode = "100644"
+			if change.Mode&0o111 != 0 {
+				mode = "100755"
+			}
+		case workspacedelta.EntrySymlink:
+			content = []byte(change.Target)
+			mode = "120000"
+		}
+		hashed, err := p.runGit(ctx, box, box.root, nil, content, "--git-dir="+repositoryPath, "hash-object", "-w", "--stdin")
+		if err != nil {
+			return fmt.Errorf("hash clean payload for %q: %w", change.Path, err)
+		}
+		oid := strings.TrimSpace(hashed.stdout)
+		if err := validateObjectID("payload object", oid); err != nil {
+			return err
+		}
+		input := []byte(mode + " " + oid + "\t" + change.Path + "\n")
+		if _, err := p.runGit(ctx, box, box.root, indexEnv, input, "--git-dir="+repositoryPath, "update-index", "--index-info"); err != nil {
+			return fmt.Errorf("stage clean payload for %q: %w", change.Path, err)
+		}
+	}
+	return nil
+}
+
+func (p *Publisher) verifyPreparedCommit(ctx context.Context, box *sandbox, repositoryPath, commitOID, treeOID string, request PrepareRequest) error {
+	resolvedTree, err := p.revParse(ctx, box, repositoryPath, commitOID+"^{tree}")
+	if err != nil || resolvedTree != treeOID {
+		return operationError(ErrPreparedArtifactCorrupt, "verify prepared commit tree", fmt.Sprintf("expected %s, resolved %s", treeOID, resolvedTree), err)
+	}
+	parents, err := p.runGit(ctx, box, box.root, nil, nil, "--git-dir="+repositoryPath, "show", "-s", "--format=%P", commitOID)
+	if err != nil || strings.TrimSpace(parents.stdout) != request.BaselineOID {
+		return operationError(ErrPreparedArtifactCorrupt, "verify prepared commit parent", fmt.Sprintf("expected %s, resolved %s", request.BaselineOID, strings.TrimSpace(parents.stdout)), err)
+	}
+	identity, err := p.runGit(ctx, box, box.root, nil, nil, "--git-dir="+repositoryPath, "show", "-s", "--format=%an%x00%ae%x00%cn%x00%ce%x00%at%x00%ct%x00%B", commitOID)
+	if err != nil {
+		return operationError(ErrPreparedArtifactCorrupt, "verify prepared commit identity", "", err)
+	}
+	parts := strings.SplitN(identity.stdout, "\x00", 7)
+	if len(parts) != 7 || parts[0] != CommitAuthorName || parts[1] != CommitAuthorEmail || parts[2] != CommitAuthorName ||
+		parts[3] != CommitAuthorEmail || parts[4] != strconv.FormatInt(request.CommitTimestamp.Unix(), 10) ||
+		parts[5] != strconv.FormatInt(request.CommitTimestamp.Unix(), 10) || strings.TrimSuffix(parts[6], "\n") != request.CommitMessage {
+		return operationError(ErrPreparedArtifactCorrupt, "verify prepared commit identity", fmt.Sprintf("commit metadata differs from immutable request: %#v", parts), nil)
+	}
+	return nil
+}
+
+func (p *Publisher) verifyBundle(ctx context.Context, box *sandbox, bundlePath, commitOID, bundleRef string) error {
+	verifyRepository := filepath.Join(box.root, "verify.git")
+	if err := p.initBare(ctx, box, verifyRepository, commitOID); err != nil {
+		return err
+	}
+	if _, err := p.runGit(ctx, box, box.root, nil, nil, "--git-dir="+verifyRepository, "bundle", "verify", bundlePath); err != nil {
+		return operationError(ErrPreparedArtifactCorrupt, "verify prepared Git bundle", "bundle verification failed", err)
+	}
+	if _, err := p.runGit(ctx, box, box.root, nil, nil, "--git-dir="+verifyRepository, "fetch", "--no-tags", "--no-recurse-submodules", "--", bundlePath, bundleRef+":refs/orka/verified"); err != nil {
+		return operationError(ErrPreparedArtifactCorrupt, "verify prepared Git bundle", "bundle import failed", err)
+	}
+	resolved, err := p.revParse(ctx, box, verifyRepository, "refs/orka/verified^{commit}")
+	if err != nil || resolved != commitOID {
+		return operationError(ErrPreparedArtifactCorrupt, "verify prepared Git bundle", fmt.Sprintf("expected %s, resolved %s", commitOID, resolved), err)
+	}
+	return nil
+}
+
+func (p *Publisher) fsckCommit(ctx context.Context, box *sandbox, repositoryPath, commitOID string) error {
+	_, err := p.runGit(ctx, box, box.root, nil, nil, "--git-dir="+repositoryPath, "fsck", "--strict", "--no-reflogs", "--no-progress", commitOID)
+	return err
+}
+
+func gitDate(value time.Time) string {
+	return "@" + strconv.FormatInt(value.Unix(), 10) + " +0000"
+}
+
+func formatRemoteRef(value RemoteRef) string {
+	if value.Absent {
+		return "Absent"
+	}
+	return value.OID
+}
diff --git a/internal/publisher/proxy_environment.go b/internal/publisher/proxy_environment.go
new file mode 100644
index 000000000..6fb9bd33f
--- /dev/null
+++ b/internal/publisher/proxy_environment.go
@@ -0,0 +1,133 @@
+package publisher
+
+import (
+	"fmt"
+	"net"
+	"net/url"
+	"strconv"
+	"strings"
+)
+
+const proxyUsername = "orka-publisher"
+
+// ProxyEnvironment is an explicitly reviewed HTTPS proxy configuration for
+// trusted Git subprocesses. Ambient proxy variables remain ignored unless the
+// publisher command opts into this configuration during startup.
+type ProxyEnvironment struct {
+	HTTPSProxy string
+	NoProxy    string
+}
+
+// NormalizeProxyEnvironment validates the authenticated in-cluster forward
+// proxy and the narrow bypass list before either value enters a Git child.
+func NormalizeProxyEnvironment(rawHTTPSProxy, rawNoProxy string) (ProxyEnvironment, error) {
+	if rawHTTPSProxy == "" && rawNoProxy == "" {
+		return ProxyEnvironment{}, nil
+	}
+	if strings.TrimSpace(rawHTTPSProxy) != rawHTTPSProxy || strings.TrimSpace(rawNoProxy) != rawNoProxy ||
+		rawHTTPSProxy == "" || rawNoProxy == "" {
+		return ProxyEnvironment{}, fmt.Errorf("publisher proxy environment is incomplete or non-canonical")
+	}
+	if err := validateHTTPSProxyURL(rawHTTPSProxy); err != nil {
+		return ProxyEnvironment{}, err
+	}
+	if err := validateNoProxy(rawNoProxy); err != nil {
+		return ProxyEnvironment{}, err
+	}
+	return ProxyEnvironment{HTTPSProxy: rawHTTPSProxy, NoProxy: rawNoProxy}, nil
+}
+
+func validateHTTPSProxyURL(raw string) error {
+	if len(raw) > 1024 {
+		return fmt.Errorf("publisher HTTPS proxy URL is invalid")
+	}
+	parsed, err := url.Parse(raw)
+	if err != nil || parsed.Scheme != "http" || parsed.Host == "" || parsed.User == nil ||
+		(parsed.Path != "" && parsed.Path != "/") || parsed.RawQuery != "" || parsed.Fragment != "" ||
+		parsed.Opaque != "" {
+		return fmt.Errorf("publisher HTTPS proxy URL is invalid")
+	}
+	password, hasPassword := parsed.User.Password()
+	if parsed.User.Username() != proxyUsername || !hasPassword || len(password) < 32 || len(password) > 256 ||
+		!validProxyPassword(password) {
+		return fmt.Errorf("publisher HTTPS proxy authentication is invalid")
+	}
+	if parsed.Hostname() != strings.ToLower(parsed.Hostname()) || net.ParseIP(parsed.Hostname()) != nil ||
+		!validProxyHostname(parsed.Hostname()) || !strings.HasSuffix(parsed.Hostname(), ".svc") {
+		return fmt.Errorf("publisher HTTPS proxy host is invalid")
+	}
+	port, err := strconv.Atoi(parsed.Port())
+	if err != nil || port < 1 || port > 65535 {
+		return fmt.Errorf("publisher HTTPS proxy port is invalid")
+	}
+	return nil
+}
+
+func validProxyPassword(password string) bool {
+	for _, current := range password {
+		if (current < 'a' || current > 'z') && (current < 'A' || current > 'Z') &&
+			(current < '0' || current > '9') && !strings.ContainsRune("-._~", current) {
+			return false
+		}
+	}
+	return true
+}
+
+func validProxyHostname(host string) bool {
+	if host == "" || len(host) > 253 || strings.HasSuffix(host, ".") {
+		return false
+	}
+	for label := range strings.SplitSeq(host, ".") {
+		if label == "" || len(label) > 63 || label[0] == '-' || label[len(label)-1] == '-' {
+			return false
+		}
+		for _, current := range label {
+			if (current < 'a' || current > 'z') && (current < '0' || current > '9') && current != '-' {
+				return false
+			}
+		}
+	}
+	return true
+}
+
+func validateNoProxy(raw string) error {
+	if len(raw) > 2048 {
+		return fmt.Errorf("publisher NO_PROXY is invalid")
+	}
+	seen := make(map[string]struct{})
+	for token := range strings.SplitSeq(raw, ",") {
+		if token == "" || strings.TrimSpace(token) != token || !safeNoProxyToken(token) {
+			return fmt.Errorf("publisher NO_PROXY contains an unsafe bypass")
+		}
+		if _, exists := seen[token]; exists {
+			return fmt.Errorf("publisher NO_PROXY contains a duplicate bypass")
+		}
+		seen[token] = struct{}{}
+	}
+	if len(seen) == 0 {
+		return fmt.Errorf("publisher NO_PROXY is empty")
+	}
+	return nil
+}
+
+func safeNoProxyToken(token string) bool {
+	switch token {
+	case "localhost", "127.0.0.1", "::1", ".svc", ".cluster.local":
+		return true
+	default:
+		return strings.HasSuffix(token, ".svc") || strings.HasSuffix(token, ".svc.cluster.local")
+	}
+}
+
+// Variables returns the only proxy variables allowed into Git subprocesses.
+func (environment ProxyEnvironment) Variables() []string {
+	if environment.HTTPSProxy == "" {
+		return nil
+	}
+	return []string{
+		"HTTPS_PROXY=" + environment.HTTPSProxy,
+		"https_proxy=" + environment.HTTPSProxy,
+		"NO_PROXY=" + environment.NoProxy,
+		"no_proxy=" + environment.NoProxy,
+	}
+}
diff --git a/internal/publisher/proxy_environment_test.go b/internal/publisher/proxy_environment_test.go
new file mode 100644
index 000000000..950e79f91
--- /dev/null
+++ b/internal/publisher/proxy_environment_test.go
@@ -0,0 +1,76 @@
+package publisher
+
+import (
+	"slices"
+	"strings"
+	"testing"
+)
+
+const testProxyPassword = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_"
+
+func TestNormalizeProxyEnvironment(t *testing.T) {
+	rawProxy := "http://orka-publisher:" + testProxyPassword + "@orka-scm-egress-proxy.orka-system.svc:8080"
+	environment, err := NormalizeProxyEnvironment(
+		rawProxy,
+		"localhost,127.0.0.1,::1,.svc,.cluster.local",
+	)
+	if err != nil {
+		t.Fatalf("NormalizeProxyEnvironment: %v", err)
+	}
+	variables := environment.Variables()
+	for _, expected := range []string{
+		"HTTPS_PROXY=" + rawProxy,
+		"https_proxy=" + rawProxy,
+		"NO_PROXY=localhost,127.0.0.1,::1,.svc,.cluster.local",
+		"no_proxy=localhost,127.0.0.1,::1,.svc,.cluster.local",
+	} {
+		if !slices.Contains(variables, expected) {
+			t.Fatalf("proxy variables %q do not include %q", variables, expected)
+		}
+	}
+}
+
+func TestNormalizeProxyEnvironmentRejectsUnsafeBypassesAndCredentials(t *testing.T) {
+	validProxy := "http://orka-publisher:" + testProxyPassword + "@proxy.orka-system.svc:8080"
+	cases := map[string]struct {
+		proxyURL string
+		noProxy  string
+	}{
+		"missing authentication": {proxyURL: "http://proxy.orka-system.svc:8080", noProxy: ".svc"},
+		"wrong username": {
+			proxyURL: "http://other:" + testProxyPassword + "@proxy.orka-system.svc:8080",
+			noProxy:  ".svc",
+		},
+		"public bypass":   {proxyURL: validProxy, noProxy: "github.com"},
+		"wildcard bypass": {proxyURL: validProxy, noProxy: "*"},
+		"private bypass":  {proxyURL: validProxy, noProxy: "10.0.0.1"},
+	}
+	for name, testCase := range cases {
+		t.Run(name, func(t *testing.T) {
+			_, err := NormalizeProxyEnvironment(testCase.proxyURL, testCase.noProxy)
+			if err == nil {
+				t.Fatal("NormalizeProxyEnvironment accepted unsafe configuration")
+			}
+			if strings.Contains(err.Error(), testProxyPassword) {
+				t.Fatal("validation error exposed the proxy credential")
+			}
+		})
+	}
+}
+
+func TestPublisherCommandEnvironmentIncludesOnlyExplicitProxy(t *testing.T) {
+	rawProxy := "http://orka-publisher:" + testProxyPassword + "@proxy.orka-system.svc:8080"
+	proxyEnvironment, err := NormalizeProxyEnvironment(rawProxy, ".svc,.cluster.local")
+	if err != nil {
+		t.Fatal(err)
+	}
+	publisher := &Publisher{proxyEnvironment: proxyEnvironment, trustedPath: "/usr/bin:/bin"}
+	environment := publisher.commandEnvironment(&sandbox{
+		home: "/tmp/home", xdg: "/tmp/xdg", template: "/tmp/template",
+	}, nil)
+	for _, expected := range proxyEnvironment.Variables() {
+		if !slices.Contains(environment, expected) {
+			t.Fatalf("command environment does not include %q", expected)
+		}
+	}
+}
diff --git a/internal/publisher/publish.go b/internal/publisher/publish.go
new file mode 100644
index 000000000..c9946fb5c
--- /dev/null
+++ b/internal/publisher/publish.go
@@ -0,0 +1,298 @@
+package publisher
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+)
+
+type publishJournal struct {
+	PublicationID string          `json:"publicationId"`
+	OperationID   string          `json:"operationId"`
+	RequestDigest string          `json:"requestDigest"`
+	Started       bool            `json:"started"`
+	Receipt       *PublishReceipt `json:"receipt,omitempty"`
+}
+
+// Preflight independently checks the current target against the exact durable
+// BranchClaim baseline. Any movement fails closed; a descendant is not accepted
+// as permission to publish.
+func (p *Publisher) Preflight(ctx context.Context, request PreflightRequest) (PreflightResult, error) {
+	if err := validateRepository(request.Target); err != nil {
+		return PreflightResult{}, err
+	}
+	if err := validateBranchRef(request.Claim.Ref); err != nil {
+		return PreflightResult{}, err
+	}
+	if err := validateRemoteRef("branch claim baseline", request.Claim.LastVerified); err != nil {
+		return PreflightResult{}, err
+	}
+	if err := validateClaim(request.Claim, request.Target, request.Claim.Ref, request.Claim.LastVerified, request.Claim.Generation); err != nil {
+		return PreflightResult{}, err
+	}
+	box, err := p.newSandbox("preflight")
+	if err != nil {
+		return PreflightResult{}, err
+	}
+	defer box.Close() //nolint:errcheck
+	observed, err := p.observeRef(ctx, box, request.Target, request.Claim.Ref)
+	if err != nil {
+		return PreflightResult{}, err
+	}
+	result := PreflightResult{Expected: request.Claim.LastVerified, Observed: observed, Matches: observed.Equal(request.Claim.LastVerified)}
+	if !result.Matches {
+		return result, operationError(ErrBranchMoved, "preflight publication branch", fmt.Sprintf("expected %s, observed %s", formatRemoteRef(result.Expected), formatRemoteRef(result.Observed)), nil)
+	}
+	return result, nil
+}
+
+// Publish crosses the cancellation boundary only after the exact preflight,
+// fast-forward proof, and durable Started journal are complete. Once crossed,
+// caller cancellation does not kill an in-flight push; the bounded transport
+// either settles or returns PublicationOutcomeUnknown for Verify to reconcile.
+func (p *Publisher) Publish(ctx context.Context, request PublishRequest) (PublishReceipt, error) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	prepared, err := p.validatePublishRequest(request)
+	if err != nil {
+		return PublishReceipt{}, err
+	}
+	requestDigest, err := publishRequestDigest(request)
+	if err != nil {
+		return PublishReceipt{}, err
+	}
+	journalPath, err := p.operationPath(request.PublicationID, "publish", request.OperationID)
+	if err != nil {
+		return PublishReceipt{}, err
+	}
+	journal, exists, err := loadPublishJournal(journalPath)
+	if err != nil {
+		return PublishReceipt{}, err
+	}
+	if exists {
+		if journal.RequestDigest != requestDigest {
+			return PublishReceipt{}, operationError(ErrIdempotencyConflict, "publish publication", "operation ID already has a different request digest", nil)
+		}
+		if journal.Receipt != nil {
+			return *journal.Receipt, publishReceiptError(*journal.Receipt)
+		}
+	} else {
+		journal = publishJournal{PublicationID: request.PublicationID, OperationID: request.OperationID, RequestDigest: requestDigest}
+		if err := writeCanonicalDurable(journalPath, journal); err != nil {
+			return PublishReceipt{}, fmt.Errorf("persist publish intent: %w", err)
+		}
+	}
+	box, err := p.newSandbox("publish")
+	if err != nil {
+		return PublishReceipt{}, err
+	}
+	defer box.Close() //nolint:errcheck
+	repositoryPath, err := p.importBundle(ctx, box, prepared)
+	if err != nil {
+		return PublishReceipt{}, err
+	}
+	if !request.RemoteBefore.Absent {
+		ancestor, ancestryErr := p.isAncestor(ctx, box, repositoryPath, request.RemoteBefore.OID, request.ExpectedCommitOID)
+		if ancestryErr != nil || !ancestor {
+			return PublishReceipt{}, operationError(ErrCASRejected, "prove fast-forward publication", "expected commit is not a verified descendant of remote-before", ancestryErr)
+		}
+	}
+	observed, err := p.observeRef(ctx, box, request.Target, request.TargetRef)
+	if err != nil {
+		return PublishReceipt{}, err
+	}
+	if observed.OID == request.ExpectedCommitOID {
+		receipt := p.newPublishReceipt(request, requestDigest, PublishAlreadyExact, observed)
+		return p.persistPublishReceipt(journalPath, journal, receipt)
+	}
+	if !observed.Equal(request.RemoteBefore) {
+		receipt := p.newPublishReceipt(request, requestDigest, PublishCASRejected, observed)
+		persisted, persistErr := p.persistPublishReceipt(journalPath, journal, receipt)
+		if persistErr != nil {
+			return persisted, persistErr
+		}
+		return persisted, operationError(ErrBranchMoved, "publish branch preflight", fmt.Sprintf("expected %s, observed %s", formatRemoteRef(request.RemoteBefore), formatRemoteRef(observed)), nil)
+	}
+	if err := ctx.Err(); err != nil {
+		return PublishReceipt{}, err
+	}
+	journal.Started = true
+	if err := writeCanonicalDurable(journalPath, journal); err != nil {
+		return PublishReceipt{}, fmt.Errorf("persist publication cancellation boundary: %w", err)
+	}
+	if p.beforeCAS != nil {
+		if err := p.beforeCAS(ctx, request); err != nil {
+			return PublishReceipt{}, err
+		}
+	}
+	mutationContext, cancel := context.WithTimeout(context.WithoutCancel(ctx), p.publishTimeout)
+	defer cancel()
+	lease := "--force-with-lease=" + request.TargetRef + ":"
+	if !request.RemoteBefore.Absent {
+		lease += request.RemoteBefore.OID
+	}
+	refspec := "refs/orka/prepared:" + request.TargetRef
+	pushResult, pushErr := p.runGit(mutationContext, box, box.root, nil, nil,
+		"--git-dir="+repositoryPath, "push", "--porcelain", "--no-verify", "--no-recurse-submodules",
+		lease, "--", request.Target.URL, refspec)
+	if pushErr == nil && p.afterPush != nil {
+		pushErr = p.afterPush(mutationContext, request)
+	}
+	if pushErr == nil {
+		receipt := p.newPublishReceipt(request, requestDigest, PublishAcknowledged, RemoteRef{OID: request.ExpectedCommitOID})
+		persisted, persistErr := p.persistPublishReceipt(journalPath, journal, receipt)
+		if persistErr != nil {
+			return persisted, operationError(ErrPublicationUnknown, "persist publish acknowledgement", "remote mutation may have succeeded", persistErr)
+		}
+		return persisted, nil
+	}
+	observedAfter, observeErr := p.observeAfterMutation(request)
+	outcome := PublishOutcomeUnknown
+	classification := ErrPublicationUnknown
+	if pushDefinitivelyRejected(pushResult) {
+		outcome = PublishCASRejected
+		classification = ErrCASRejected
+	}
+	receipt := p.newPublishReceipt(request, requestDigest, outcome, observedAfter)
+	persisted, persistErr := p.persistPublishReceipt(journalPath, journal, receipt)
+	if persistErr != nil {
+		return persisted, operationError(ErrPublicationUnknown, "persist failed publish receipt", "remote outcome requires verification", errors.Join(pushErr, observeErr, persistErr))
+	}
+	return persisted, operationError(classification, "publish exact branch CAS", "remote outcome requires independent verification", errors.Join(pushErr, observeErr))
+}
+
+func (p *Publisher) validatePublishRequest(request PublishRequest) (PreparedPublication, error) {
+	if err := validateIdentifier("publication ID", request.PublicationID); err != nil {
+		return PreparedPublication{}, err
+	}
+	if request.PublicationGeneration < 1 {
+		return PreparedPublication{}, invalid("publication generation", "must be at least 1")
+	}
+	if err := validateIdentifier("operation ID", request.OperationID); err != nil {
+		return PreparedPublication{}, err
+	}
+	if err := validateRepository(request.Target); err != nil {
+		return PreparedPublication{}, err
+	}
+	if err := validateBranchRef(request.TargetRef); err != nil {
+		return PreparedPublication{}, err
+	}
+	if err := validateRemoteRef("remote before", request.RemoteBefore); err != nil {
+		return PreparedPublication{}, err
+	}
+	if err := validateObjectID("expected commit", request.ExpectedCommitOID); err != nil {
+		return PreparedPublication{}, err
+	}
+	if request.RemoteBefore.OID != "" && len(request.RemoteBefore.OID) != len(request.ExpectedCommitOID) {
+		return PreparedPublication{}, invalid("remote before", "object format differs from expected commit")
+	}
+	if err := validateDigest("bundle digest", request.BundleDigest); err != nil {
+		return PreparedPublication{}, err
+	}
+	prepared, err := p.loadPrepared(request.PublicationID)
+	if err != nil {
+		return PreparedPublication{}, err
+	}
+	if prepared.PublicationGeneration != request.PublicationGeneration || prepared.Target != request.Target ||
+		prepared.TargetRef != request.TargetRef || prepared.RemoteBefore != request.RemoteBefore ||
+		prepared.CommitOID != request.ExpectedCommitOID || prepared.BundleDigest != request.BundleDigest {
+		return PreparedPublication{}, operationError(ErrIdempotencyConflict, "validate publish request", "request differs from durable prepared artifact", nil)
+	}
+	if err := validateClaim(request.Claim, request.Target, request.TargetRef, request.RemoteBefore, prepared.BranchClaimGeneration); err != nil {
+		return PreparedPublication{}, err
+	}
+	return prepared, nil
+}
+
+func publishRequestDigest(request PublishRequest) (string, error) {
+	return digestCanonical(struct {
+		Domain                string      `json:"domain"`
+		PublicationID         string      `json:"publicationId"`
+		PublicationGeneration int64       `json:"publicationGeneration"`
+		Target                Repository  `json:"target"`
+		TargetRef             string      `json:"targetRef"`
+		Claim                 BranchClaim `json:"claim"`
+		RemoteBefore          RemoteRef   `json:"remoteBefore"`
+		ExpectedCommitOID     string      `json:"expectedCommitOid"`
+		BundleDigest          string      `json:"bundleDigest"`
+	}{
+		Domain: "orka.publisher.publish.v1", PublicationID: request.PublicationID,
+		PublicationGeneration: request.PublicationGeneration, Target: request.Target, TargetRef: request.TargetRef,
+		Claim: request.Claim, RemoteBefore: request.RemoteBefore, ExpectedCommitOID: request.ExpectedCommitOID,
+		BundleDigest: request.BundleDigest,
+	})
+}
+
+func loadPublishJournal(path string) (publishJournal, bool, error) {
+	var journal publishJournal
+	if err := readCanonical(path, &journal); err != nil {
+		if os.IsNotExist(err) {
+			return publishJournal{}, false, nil
+		}
+		return publishJournal{}, false, operationError(ErrPreparedArtifactCorrupt, "read publish journal", "", err)
+	}
+	return journal, true, nil
+}
+
+func (p *Publisher) newPublishReceipt(request PublishRequest, digest string, outcome PublishOutcome, observed RemoteRef) PublishReceipt {
+	return PublishReceipt{
+		PublicationID: request.PublicationID, PublicationGeneration: request.PublicationGeneration,
+		OperationID: request.OperationID, RequestDigest: digest, Outcome: outcome,
+		TargetRepositoryID: request.Target.ID, TargetRef: request.TargetRef,
+		RemoteBefore: request.RemoteBefore, ExpectedCommitOID: request.ExpectedCommitOID, ObservedRemote: observed,
+	}
+}
+
+func (p *Publisher) persistPublishReceipt(path string, journal publishJournal, receipt PublishReceipt) (PublishReceipt, error) {
+	journal.Receipt = &receipt
+	if err := writeCanonicalDurable(path, journal); err != nil {
+		return receipt, err
+	}
+	return receipt, publishReceiptError(receipt)
+}
+
+func publishReceiptError(receipt PublishReceipt) error {
+	switch receipt.Outcome {
+	case PublishAcknowledged, PublishAlreadyExact:
+		return nil
+	case PublishCASRejected:
+		return ErrCASRejected
+	case PublishOutcomeUnknown:
+		return ErrPublicationUnknown
+	default:
+		return ErrPreparedArtifactCorrupt
+	}
+}
+
+func (p *Publisher) observeAfterMutation(request PublishRequest) (RemoteRef, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), p.publishTimeout)
+	defer cancel()
+	box, err := p.newSandbox("publish-observe")
+	if err != nil {
+		return RemoteRef{}, err
+	}
+	defer box.Close() //nolint:errcheck
+	return p.observeRef(ctx, box, request.Target, request.TargetRef)
+}
+
+func pushDefinitivelyRejected(result commandResult) bool {
+	output := result.stdout + "\n" + result.stderr
+	return strings.Contains(output, "[rejected] (stale info)") ||
+		strings.Contains(output, "[rejected] (non-fast-forward)")
+}
+
+func (p *Publisher) fetchObserved(ctx context.Context, box *sandbox, repositoryPath string, target Repository, ref, expectedOID string) error {
+	if _, err := p.runGit(ctx, box, box.root, nil, nil, "--git-dir="+repositoryPath, "fetch", "--no-tags", "--no-recurse-submodules", "--", target.URL, ref+":refs/orka/observed"); err != nil {
+		return err
+	}
+	resolved, err := p.revParse(ctx, box, repositoryPath, "refs/orka/observed^{commit}")
+	if err != nil {
+		return err
+	}
+	if resolved != expectedOID {
+		return fmt.Errorf("remote changed while fetching: expected %s, fetched %s", expectedOID, resolved)
+	}
+	return nil
+}
diff --git a/internal/publisher/publisher.go b/internal/publisher/publisher.go
new file mode 100644
index 000000000..66362aa3a
--- /dev/null
+++ b/internal/publisher/publisher.go
@@ -0,0 +1,219 @@
+package publisher
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+)
+
+const (
+	defaultMaxDeltaBytes  = int64(256 << 20)
+	defaultMaxBundleBytes = int64(512 << 20)
+	defaultCommandOutput  = int64(1 << 20)
+	defaultPublishTimeout = 2 * time.Minute
+	defaultVerifyAttempts = 3
+	defaultVerifyBackoff  = 100 * time.Millisecond
+)
+
+// Options configures the clean-room publisher. ArtifactRoot is durable trusted
+// storage; TempRoot may be ephemeral. Child process environments are always
+// rebuilt from an empty allowlist.
+type Options struct {
+	ArtifactRoot     string
+	TempRoot         string
+	GitBinary        string
+	MaxDeltaBytes    int64
+	MaxBundleBytes   int64
+	MaxCommandOutput int64
+	PublishTimeout   time.Duration
+	VerifyAttempts   int
+	VerifyBackoff    time.Duration
+	ProxyEnvironment ProxyEnvironment
+}
+
+// Publisher is safe for concurrent use within one controller process. The
+// first release intentionally serializes local durable receipt updates; remote
+// correctness still relies on exact ref CAS, not this mutex.
+type Publisher struct {
+	artifactRoot     string
+	tempRoot         string
+	gitBinary        string
+	gitExecPath      string
+	trustedPath      string
+	maxDeltaBytes    int64
+	maxBundleBytes   int64
+	maxCommandOutput int64
+	publishTimeout   time.Duration
+	verifyAttempts   int
+	verifyBackoff    time.Duration
+	proxyEnvironment ProxyEnvironment
+
+	mu sync.Mutex
+
+	// Test-only fault boundaries. They remain unexported so production callers
+	// cannot weaken the mutation protocol.
+	beforeCAS     func(context.Context, PublishRequest) error
+	afterPush     func(context.Context, PublishRequest) error
+	observeFault  func(context.Context, Repository, string) error
+	commandRecord func([]string)
+}
+
+func New(options Options) (*Publisher, error) {
+	if !filepath.IsAbs(options.ArtifactRoot) || filepath.Clean(options.ArtifactRoot) != options.ArtifactRoot {
+		return nil, invalid("artifact root", "must be an absolute clean path")
+	}
+	if options.TempRoot != "" && (!filepath.IsAbs(options.TempRoot) || filepath.Clean(options.TempRoot) != options.TempRoot) {
+		return nil, invalid("temporary root", "must be an absolute clean path")
+	}
+	absoluteGit, err := resolveGitBinary(options.GitBinary)
+	if err != nil {
+		return nil, err
+	}
+	info, err := os.Stat(absoluteGit)
+	if err != nil || info.IsDir() || info.Mode()&0o111 == 0 {
+		return nil, invalid("git binary", "%q is not an executable regular file", absoluteGit)
+	}
+	if err := ensureTrustedDirectory(options.ArtifactRoot); err != nil {
+		return nil, fmt.Errorf("prepare artifact root: %w", err)
+	}
+	if options.TempRoot != "" {
+		if err := ensureTrustedDirectory(options.TempRoot); err != nil {
+			return nil, fmt.Errorf("prepare temporary root: %w", err)
+		}
+	}
+	trustedPath := filepath.Dir(absoluteGit) + string(os.PathListSeparator) + "/usr/local/bin:/usr/bin:/bin"
+	gitExecPath, err := resolveGitExecPath(absoluteGit, trustedPath)
+	if err != nil {
+		return nil, err
+	}
+	publisher := &Publisher{
+		artifactRoot:     options.ArtifactRoot,
+		tempRoot:         options.TempRoot,
+		gitBinary:        absoluteGit,
+		gitExecPath:      gitExecPath,
+		trustedPath:      trustedPath,
+		maxDeltaBytes:    options.MaxDeltaBytes,
+		maxBundleBytes:   options.MaxBundleBytes,
+		maxCommandOutput: options.MaxCommandOutput,
+		publishTimeout:   options.PublishTimeout,
+		verifyAttempts:   options.VerifyAttempts,
+		verifyBackoff:    options.VerifyBackoff,
+		proxyEnvironment: options.ProxyEnvironment,
+	}
+	if publisher.maxDeltaBytes <= 0 {
+		publisher.maxDeltaBytes = defaultMaxDeltaBytes
+	}
+	if publisher.maxBundleBytes <= 0 {
+		publisher.maxBundleBytes = defaultMaxBundleBytes
+	}
+	if publisher.maxCommandOutput <= 0 {
+		publisher.maxCommandOutput = defaultCommandOutput
+	}
+	if publisher.publishTimeout <= 0 {
+		publisher.publishTimeout = defaultPublishTimeout
+	}
+	if publisher.verifyAttempts <= 0 {
+		publisher.verifyAttempts = defaultVerifyAttempts
+	}
+	if publisher.verifyBackoff <= 0 {
+		publisher.verifyBackoff = defaultVerifyBackoff
+	}
+	return publisher, nil
+}
+
+func resolveGitBinary(configured string) (string, error) {
+	if configured != "" {
+		if !filepath.IsAbs(configured) || filepath.Clean(configured) != configured {
+			return "", invalid("git binary", "configured path must be absolute and clean")
+		}
+		return configured, nil
+	}
+	for _, candidate := range []string{"/opt/homebrew/bin/git", "/usr/local/bin/git", "/usr/bin/git", "/bin/git"} {
+		if info, err := os.Stat(candidate); err == nil && !info.IsDir() && info.Mode()&0o111 != 0 {
+			return candidate, nil
+		}
+	}
+	return "", fmt.Errorf("locate trusted git binary: no reviewed absolute path exists")
+}
+
+func resolveGitExecPath(gitBinary, trustedPath string) (string, error) {
+	command := exec.Command(gitBinary, "--exec-path")
+	command.Env = []string{
+		"HOME=/dev/null", "XDG_CONFIG_HOME=/dev/null", "GIT_CONFIG_GLOBAL=/dev/null",
+		"GIT_CONFIG_NOSYSTEM=1", "LC_ALL=C", "LANG=C", "PATH=" + trustedPath,
+	}
+	output, err := command.Output()
+	if err != nil {
+		return "", fmt.Errorf("resolve trusted Git exec path: %w", err)
+	}
+	resolved := strings.TrimSpace(string(output))
+	if !filepath.IsAbs(resolved) || filepath.Clean(resolved) != resolved {
+		return "", invalid("Git exec path", "%q is not absolute and clean", resolved)
+	}
+	info, err := os.Stat(resolved)
+	if err != nil || !info.IsDir() {
+		return "", invalid("Git exec path", "%q is not a directory", resolved)
+	}
+	return resolved, nil
+}
+
+func ensureTrustedDirectory(directory string) error {
+	directory = filepath.Clean(directory)
+	if !filepath.IsAbs(directory) {
+		return fmt.Errorf("%q is not an absolute directory", directory)
+	}
+	missing := make([]string, 0, 4)
+	current := directory
+	for {
+		info, err := os.Lstat(current)
+		if err == nil {
+			if !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
+				return fmt.Errorf("%q is not a real directory", current)
+			}
+			break
+		}
+		if !os.IsNotExist(err) {
+			return err
+		}
+		missing = append(missing, current)
+		parent := filepath.Dir(current)
+		if parent == current {
+			return fmt.Errorf("no trusted parent exists for %q", directory)
+		}
+		current = parent
+	}
+	for i := len(missing) - 1; i >= 0; i-- {
+		child := missing[i]
+		if err := os.Mkdir(child, 0o700); err != nil && !os.IsExist(err) {
+			return err
+		}
+		if err := os.Chmod(child, 0o700); err != nil {
+			return err
+		}
+		if err := syncPublisherDirectory(filepath.Dir(child)); err != nil {
+			return fmt.Errorf("sync created directory %q: %w", child, err)
+		}
+	}
+	info, err := os.Lstat(directory)
+	if err != nil {
+		return err
+	}
+	if !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
+		return fmt.Errorf("%q is not a real directory", directory)
+	}
+	return os.Chmod(directory, 0o700)
+}
+
+func syncPublisherDirectory(directory string) error {
+	file, err := os.Open(directory)
+	if err != nil {
+		return err
+	}
+	defer file.Close() //nolint:errcheck
+	return file.Sync()
+}
diff --git a/internal/publisher/publisher_test.go b/internal/publisher/publisher_test.go
new file mode 100644
index 000000000..8292c348a
--- /dev/null
+++ b/internal/publisher/publisher_test.go
@@ -0,0 +1,1237 @@
+package publisher
+
+import (
+	"archive/tar"
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/url"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"reflect"
+	"slices"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/orka-agents/orka/internal/workspacedelta"
+)
+
+const testPublicationRef = "refs/heads/orka/test-publication"
+
+type repositoryFixture struct {
+	source       Repository
+	target       Repository
+	seed         string
+	baselineOID  string
+	baselineRoot string
+	delta        workspacedelta.Result
+}
+
+func TestPrepareDeterministicTrustedCommitAndDurableBundle(t *testing.T) {
+	fixture := newRepositoryFixture(t, true)
+	first := newTestPublisher(t)
+	second := newTestPublisher(t)
+	request := fixture.prepareRequest("publication-deterministic", "prepare-1", RemoteRef{Absent: true})
+
+	one, err := first.Prepare(context.Background(), request)
+	if err != nil {
+		t.Fatalf("Prepare first: %v", err)
+	}
+	request.OperationID = "prepare-2"
+	two, err := second.Prepare(context.Background(), request)
+	if err != nil {
+		t.Fatalf("Prepare second: %v", err)
+	}
+	if one.CommitOID != two.CommitOID || one.TreeOID != two.TreeOID || one.BundleDigest != two.BundleDigest || one.RequestDigest != two.RequestDigest {
+		t.Fatalf("deterministic receipts differ:\nfirst=%#v\nsecond=%#v", one, two)
+	}
+	firstBundle := mustReadFile(t, one.BundlePath)
+	secondBundle := mustReadFile(t, two.BundlePath)
+	if !bytes.Equal(firstBundle, secondBundle) {
+		t.Fatalf("durable bundle bytes differ despite identical immutable input")
+	}
+	assertPreparedCommit(t, one, fixture.baselineOID, request.CommitMessage, request.CommitTimestamp)
+
+	request.OperationID = "prepare-reconcile"
+	repeated, err := first.Prepare(context.Background(), request)
+	if err != nil {
+		t.Fatalf("Prepare idempotent retry: %v", err)
+	}
+	if repeated.OperationID != request.OperationID || repeated.CommitOID != one.CommitOID || repeated.BundleDigest != one.BundleDigest {
+		t.Fatalf("idempotent retry = %#v, want same artifact with current operation ID", repeated)
+	}
+
+	conflict := request
+	conflict.CommitMessage = "different immutable request\n"
+	if _, err := first.Prepare(context.Background(), conflict); !errors.Is(err, ErrIdempotencyConflict) {
+		t.Fatalf("Prepare conflicting reuse error = %v, want ErrIdempotencyConflict", err)
+	}
+}
+
+func TestPrepareAcceptsExactSourceCommit(t *testing.T) {
+	fixture := newRepositoryFixture(t, false)
+	publisher := newTestPublisher(t)
+	request := fixture.prepareRequest("publication-exact-source", "prepare-exact-source", RemoteRef{Absent: true})
+	request.SourceRef = fixture.baselineOID
+	var commands [][]string
+	publisher.commandRecord = func(command []string) { commands = append(commands, append([]string(nil), command...)) }
+	prepared, err := publisher.Prepare(context.Background(), request)
+	if err != nil {
+		t.Fatalf("Prepare exact source commit: %v", err)
+	}
+	if prepared.SourceRef != fixture.baselineOID || prepared.BaselineOID != fixture.baselineOID {
+		t.Fatalf("prepared exact source = %#v", prepared)
+	}
+	assertPreparedCommit(t, prepared, fixture.baselineOID, request.CommitMessage, request.CommitTimestamp)
+	retry := request
+	retry.OperationID = "prepare-exact-source-retry"
+	reloaded, err := publisher.Prepare(context.Background(), retry)
+	if err != nil {
+		t.Fatalf("reload exact-source prepared publication: %v", err)
+	}
+	if reloaded.SourceRef != fixture.baselineOID || reloaded.CommitOID != prepared.CommitOID || reloaded.BundleDigest != prepared.BundleDigest {
+		t.Fatalf("reloaded exact-source publication = %#v, want %#v", reloaded, prepared)
+	}
+	sourceFetches := 0
+	shallowObservations := 0
+	for _, command := range commands {
+		for index, argument := range command {
+			if argument != "fetch" || !slices.Contains(command[index+1:], fixture.source.URL) {
+				continue
+			}
+			sourceFetches++
+			if slices.Contains(command[index+1:], "--depth=1") {
+				shallowObservations++
+			}
+		}
+	}
+	if sourceFetches < 2 || shallowObservations < 1 {
+		t.Fatalf("exact-source command trace has %d source fetches and %d shallow observations, want both bounded observation and full bundle preparation", sourceFetches, shallowObservations)
+	}
+	mismatch := fixture.prepareRequest("publication-exact-source-mismatch", "prepare-exact-source-mismatch", RemoteRef{Absent: true})
+	mismatch.SourceRef = fixture.baselineOID
+	mismatch.BaselineOID = strings.Repeat("a", 40)
+	if _, err := newTestPublisher(t).Prepare(context.Background(), mismatch); err == nil {
+		t.Fatal("exact source selector differing from baseline was accepted")
+	}
+}
+
+func TestPreparePrefixesRelativeRootWithoutOverwritingRootCollision(t *testing.T) {
+	seed := filepath.Join(t.TempDir(), "seed")
+	mustMkdir(t, seed)
+	runTestGit(t, seed, nil, "init", "-b", "main")
+	mustWriteFile(t, filepath.Join(seed, "main.go"), "package root\n", 0o644)
+	mustWriteFile(t, filepath.Join(seed, "delete.txt"), "root delete\n", 0o644)
+	mustWriteFile(t, filepath.Join(seed, "services", "app", "main.go"), "package app\n", 0o644)
+	mustWriteFile(t, filepath.Join(seed, "services", "app", "keep.txt"), "keep\n", 0o644)
+	mustWriteFile(t, filepath.Join(seed, "services", "app", "delete.txt"), "nested delete\n", 0o644)
+	if err := os.Symlink("main.go", filepath.Join(seed, "latest")); err != nil {
+		t.Fatalf("create root symlink: %v", err)
+	}
+	if err := os.Symlink("keep.txt", filepath.Join(seed, "services", "app", "latest")); err != nil {
+		t.Fatalf("create nested symlink: %v", err)
+	}
+	runTestGit(t, seed, fixedCommitEnvironment(), "add", "--all")
+	runTestGit(t, seed, fixedCommitEnvironment(), "commit", "-m", "baseline")
+	baselineOID := strings.TrimSpace(runTestGit(t, seed, nil, "rev-parse", "HEAD"))
+
+	sourcePath := filepath.Join(t.TempDir(), "source.git")
+	runTestGit(t, "", nil, "clone", "--bare", "--", seed, sourcePath)
+	targetPath := filepath.Join(t.TempDir(), "fork.git")
+	runTestGit(t, "", nil, "init", "--bare", "--", targetPath)
+
+	workspaceRoot := filepath.Join(t.TempDir(), "workspace")
+	copyTreeWithoutGit(t, filepath.Join(seed, "services", "app"), workspaceRoot)
+	if err := os.Remove(filepath.Join(workspaceRoot, "latest")); err != nil {
+		t.Fatalf("restore materialized symlink: %v", err)
+	}
+	if err := os.Symlink("keep.txt", filepath.Join(workspaceRoot, "latest")); err != nil {
+		t.Fatalf("restore materialized symlink: %v", err)
+	}
+	baseline, err := workspacedelta.Capture(workspaceRoot, workspacedelta.Options{})
+	if err != nil {
+		t.Fatalf("Capture subpath baseline: %v", err)
+	}
+	mustWriteFile(t, filepath.Join(workspaceRoot, "main.go"), "package app_changed\n", 0o644)
+	mustWriteFile(t, filepath.Join(workspaceRoot, "new.txt"), "nested\n", 0o644)
+	if err := os.Remove(filepath.Join(workspaceRoot, "delete.txt")); err != nil {
+		t.Fatalf("delete nested file: %v", err)
+	}
+	if err := os.Remove(filepath.Join(workspaceRoot, "latest")); err != nil {
+		t.Fatalf("replace nested symlink: %v", err)
+	}
+	if err := os.Symlink("new.txt", filepath.Join(workspaceRoot, "latest")); err != nil {
+		t.Fatalf("recreate nested symlink: %v", err)
+	}
+	delta, err := workspacedelta.Build(baseline, workspaceRoot, workspacedelta.IntentWrite)
+	if err != nil {
+		t.Fatalf("Build subpath delta: %v", err)
+	}
+
+	p := newTestPublisher(t)
+	request := PrepareRequest{
+		PublicationID: "publication-subpath", PublicationGeneration: 1, OperationID: "prepare-subpath",
+		Source: Repository{Provider: "local", ID: "repository/source", URL: fileURL(sourcePath)}, SourceRef: "refs/heads/main",
+		Target: Repository{Provider: "local", ID: "repository/fork", URL: fileURL(targetPath)}, TargetRef: testPublicationRef,
+		BranchClaimGeneration: 1, BaselineOID: baselineOID, RemoteBefore: RemoteRef{Absent: true},
+		DeltaArtifact: delta.Artifact, DeltaArtifactDigest: delta.ArtifactDigest, RelativeRoot: "services/app",
+		CommitMessage:   "Orka publication publication-subpath\n",
+		CommitTimestamp: time.Date(2026, time.August, 2, 12, 0, 0, 0, time.UTC),
+	}
+	prepared, err := p.Prepare(context.Background(), request)
+	if err != nil {
+		t.Fatalf("Prepare subpath publication: %v", err)
+	}
+
+	inspect := filepath.Join(t.TempDir(), "inspect.git")
+	runTestGit(t, "", nil, "init", "--bare", "--", inspect)
+	runTestGit(t, "", nil, "--git-dir="+inspect, "fetch", "--", prepared.BundlePath, prepared.BundleRef+":refs/inspect/prepared")
+	rootMain := runTestGit(t, "", nil, "--git-dir="+inspect, "show", prepared.CommitOID+":main.go")
+	nestedMain := runTestGit(t, "", nil, "--git-dir="+inspect, "show", prepared.CommitOID+":services/app/main.go")
+	rootDelete := runTestGit(t, "", nil, "--git-dir="+inspect, "show", prepared.CommitOID+":delete.txt")
+	rootLink := runTestGit(t, "", nil, "--git-dir="+inspect, "show", prepared.CommitOID+":latest")
+	nestedLink := runTestGit(t, "", nil, "--git-dir="+inspect, "show", prepared.CommitOID+":services/app/latest")
+	if rootMain != "package root\n" {
+		t.Fatalf("root collision was overwritten: %q", rootMain)
+	}
+	if nestedMain != "package app_changed\n" {
+		t.Fatalf("nested subpath edit = %q, want updated content", nestedMain)
+	}
+	if rootDelete != "root delete\n" {
+		t.Fatalf("root deletion collision was removed: %q", rootDelete)
+	}
+	if rootLink != "main.go" || nestedLink != "new.txt" {
+		t.Fatalf("symlink collision targets = root %q nested %q", rootLink, nestedLink)
+	}
+	tree := strings.Split(strings.TrimSpace(runTestGit(t, "", nil, "--git-dir="+inspect, "ls-tree", "-r", "--name-only", prepared.CommitOID)), "\n")
+	for _, want := range []string{"delete.txt", "latest", "main.go", "services/app/latest", "services/app/main.go", "services/app/new.txt"} {
+		if !slices.Contains(tree, want) {
+			t.Fatalf("prepared tree missing %q: %#v", want, tree)
+		}
+	}
+	for _, forbidden := range []string{"new.txt", "services/app/delete.txt", "services/app/services/app/main.go"} {
+		if slices.Contains(tree, forbidden) {
+			t.Fatalf("prepared tree contains incorrectly rooted path %q: %#v", forbidden, tree)
+		}
+	}
+	conflict := request
+	conflict.OperationID = "prepare-subpath-conflict"
+	conflict.RelativeRoot = "services/other"
+	if _, err := p.Prepare(context.Background(), conflict); !errors.Is(err, ErrIdempotencyConflict) {
+		t.Fatalf("relative-root idempotency conflict error = %v, want ErrIdempotencyConflict", err)
+	}
+}
+
+func TestSHA256PreparePublishAndVerify(t *testing.T) {
+	fixture := newRepositoryFixtureWithFormat(t, false, "sha256")
+	publisher := newTestPublisher(t)
+	request := fixture.prepareRequest("publication-sha256", "prepare-sha256", RemoteRef{Absent: true})
+	request.SourceRef = fixture.baselineOID
+	prepared, err := publisher.Prepare(context.Background(), request)
+	if err != nil {
+		t.Fatalf("Prepare SHA-256: %v", err)
+	}
+	if len(prepared.CommitOID) != 64 || len(prepared.TreeOID) != 64 {
+		t.Fatalf("SHA-256 prepared OIDs = commit %q tree %q", prepared.CommitOID, prepared.TreeOID)
+	}
+	claim := branchClaim(fixture.target, RemoteRef{Absent: true})
+	if _, err := publisher.Publish(context.Background(), publishRequest(prepared, "publish-sha256", claim)); err != nil {
+		t.Fatalf("Publish SHA-256: %v", err)
+	}
+	receipt, err := publisher.Verify(context.Background(), verifyRequest(prepared, "verify-sha256", claim))
+	if err != nil || receipt.Outcome != VerifiedExact {
+		t.Fatalf("Verify SHA-256 = %#v, %v", receipt, err)
+	}
+}
+
+func TestPrepareIgnoresHostileConfigAndRejectsChildGitMetadata(t *testing.T) {
+	fixture := newRepositoryFixture(t, true)
+	markerRoot := t.TempDir()
+	globalConfig := filepath.Join(markerRoot, "global.gitconfig")
+	hooks := filepath.Join(markerRoot, "hooks")
+	mustMkdir(t, hooks)
+	writeExecutable(t, filepath.Join(hooks, "post-checkout"), "#!/bin/sh\ntouch "+shellQuote(filepath.Join(markerRoot, "hook-ran"))+"\n")
+	filterScript := filepath.Join(markerRoot, "filter")
+	writeExecutable(t, filterScript, "#!/bin/sh\ntouch "+shellQuote(filepath.Join(markerRoot, "filter-ran"))+"\ncat\n")
+	config := fmt.Sprintf("[core]\n\thooksPath = %s\n[credential]\n\thelper = !touch %s\n[filter \"evil\"]\n\tclean = %s\n\tsmudge = %s\n[url \"file:///definitely-not-the-repository/\"]\n\tinsteadOf = file://\n",
+		hooks, filepath.Join(markerRoot, "credential-ran"), filterScript, filterScript)
+	mustWriteFile(t, globalConfig, config, 0o600)
+	t.Setenv("HOME", markerRoot)
+	t.Setenv("XDG_CONFIG_HOME", markerRoot)
+	t.Setenv("GIT_CONFIG_GLOBAL", globalConfig)
+	t.Setenv("GIT_CONFIG_NOSYSTEM", "0")
+	t.Setenv("GIT_DIR", filepath.Join(markerRoot, "trap.git"))
+	t.Setenv("GIT_WORK_TREE", markerRoot)
+	t.Setenv("GIT_CONFIG_COUNT", "1")
+	t.Setenv("GIT_CONFIG_KEY_0", "core.hooksPath")
+	t.Setenv("GIT_CONFIG_VALUE_0", hooks)
+	t.Setenv("HTTPS_PROXY", "http://127.0.0.1:1")
+	t.Setenv("GIT_SSH_COMMAND", "false")
+	t.Setenv("GIT_REPLACE_REF_BASE", "refs/replace-hostile/")
+	t.Setenv("GIT_ALTERNATE_OBJECT_DIRECTORIES", filepath.Join(markerRoot, "objects"))
+	t.Setenv("GIT_TEMPLATE_DIR", filepath.Join(markerRoot, "hostile-template"))
+
+	publisher := newTestPublisher(t)
+	request := fixture.prepareRequest("publication-hostile-config", "prepare-hostile", RemoteRef{Absent: true})
+	prepared, err := publisher.Prepare(context.Background(), request)
+	if err != nil {
+		t.Fatalf("Prepare under hostile parent config: %v", err)
+	}
+	if prepared.CommitOID == "" {
+		t.Fatal("Prepare returned empty commit")
+	}
+	for _, marker := range []string{"hook-ran", "filter-ran", "credential-ran"} {
+		if _, err := os.Stat(filepath.Join(markerRoot, marker)); !os.IsNotExist(err) {
+			t.Fatalf("hostile Git configuration executed %s", marker)
+		}
+	}
+
+	unsafeArtifact := addTarEntry(t, fixture.delta.Artifact, "files/.git/config", []byte("[credential]\nhelper = !false\n"))
+	unsafe := request
+	unsafe.PublicationID = "publication-child-git"
+	unsafe.OperationID = "prepare-child-git"
+	unsafe.DeltaArtifact = unsafeArtifact
+	unsafe.DeltaArtifactDigest = digestBytes(unsafeArtifact)
+	if _, err := publisher.Prepare(context.Background(), unsafe); !errors.Is(err, ErrUnsafeDelta) {
+		t.Fatalf("Prepare child .git artifact error = %v, want ErrUnsafeDelta", err)
+	}
+}
+
+func TestPreflightRejectsBranchMovement(t *testing.T) {
+	fixture := newRepositoryFixture(t, false)
+	pushRef(t, fixture.seed, fixture.target.URL, fixture.baselineOID, testPublicationRef, false)
+	second := commitInClone(t, fixture.source.URL, "main", "movement.txt", "moved\n")
+	pushRef(t, second.clone, fixture.target.URL, second.oid, testPublicationRef, false)
+
+	publisher := newTestPublisher(t)
+	claim := branchClaim(fixture.target, RemoteRef{OID: fixture.baselineOID})
+	result, err := publisher.Preflight(context.Background(), PreflightRequest{Target: fixture.target, Claim: claim})
+	if !errors.Is(err, ErrBranchMoved) {
+		t.Fatalf("Preflight error = %v, want ErrBranchMoved", err)
+	}
+	if result.Matches || result.Expected.OID != fixture.baselineOID || result.Observed.OID != second.oid {
+		t.Fatalf("Preflight result = %#v", result)
+	}
+}
+
+func TestPublishExactCASForkVerifyAndNoForcePush(t *testing.T) {
+	fixture := newRepositoryFixture(t, false)
+	publisher := newTestPublisher(t)
+	var commandsMu sync.Mutex
+	var commands [][]string
+	publisher.commandRecord = func(args []string) {
+		commandsMu.Lock()
+		defer commandsMu.Unlock()
+		commands = append(commands, args)
+	}
+	request := fixture.prepareRequest("publication-exact", "prepare-exact", RemoteRef{Absent: true})
+	prepared, err := publisher.Prepare(context.Background(), request)
+	if err != nil {
+		t.Fatalf("Prepare: %v", err)
+	}
+	runTestGit(t, "", nil, "--git-dir="+fileURLPath(t, fixture.target.URL), "config", "receive.denyNonFastForwards", "true")
+	claim := branchClaim(fixture.target, RemoteRef{Absent: true})
+	publish := publishRequest(prepared, "publish-exact", claim)
+	receipt, err := publisher.Publish(context.Background(), publish)
+	if err != nil {
+		t.Fatalf("Publish: %v", err)
+	}
+	if receipt.Outcome != PublishAcknowledged {
+		t.Fatalf("Publish outcome = %q, want %q", receipt.Outcome, PublishAcknowledged)
+	}
+	if got := remoteOID(t, fixture.target.URL); got != prepared.CommitOID {
+		t.Fatalf("remote OID = %s, want %s", got, prepared.CommitOID)
+	}
+	if fixture.source.ID == fixture.target.ID {
+		t.Fatal("fixture did not exercise fork target support")
+	}
+
+	commandsMu.Lock()
+	captured := append([][]string(nil), commands...)
+	commandsMu.Unlock()
+	assertNoForcePush(t, captured, prepared.CommitOID, testPublicationRef)
+
+	beforePushes := countPushCommands(captured)
+	repeated, err := publisher.Publish(context.Background(), publish)
+	if err != nil || repeated != receipt {
+		t.Fatalf("idempotent Publish = %#v, %v; want %#v", repeated, err, receipt)
+	}
+	commandsMu.Lock()
+	afterPushes := countPushCommands(commands)
+	commandsMu.Unlock()
+	if afterPushes != beforePushes {
+		t.Fatalf("idempotent Publish issued another push: before=%d after=%d", beforePushes, afterPushes)
+	}
+	restarted, newErr := New(Options{
+		ArtifactRoot: publisher.artifactRoot, TempRoot: filepath.Join(t.TempDir(), "restart-tmp"),
+		VerifyAttempts: 1, PublishTimeout: 10 * time.Second,
+	})
+	if newErr != nil {
+		t.Fatalf("New restarted publisher: %v", newErr)
+	}
+	restartedReceipt, restartErr := restarted.Publish(context.Background(), publish)
+	if restartErr != nil || restartedReceipt != receipt {
+		t.Fatalf("restarted idempotent Publish = %#v, %v; want %#v", restartedReceipt, restartErr, receipt)
+	}
+
+	verify := verifyRequest(prepared, "verify-exact", claim)
+	verification, err := publisher.Verify(context.Background(), verify)
+	if err != nil {
+		t.Fatalf("Verify exact: %v", err)
+	}
+	if verification.Outcome != VerifiedExact || verification.ObservedRemote.OID != prepared.CommitOID {
+		t.Fatalf("Verify exact = %#v", verification)
+	}
+}
+
+func TestPublishDetectsMovementBetweenPreflightAndCAS(t *testing.T) {
+	fixture := newRepositoryFixture(t, false)
+	pushRef(t, fixture.seed, fixture.target.URL, fixture.baselineOID, testPublicationRef, false)
+	publisher := newTestPublisher(t)
+	prepared, err := publisher.Prepare(context.Background(), fixture.prepareRequest("publication-race", "prepare-race", RemoteRef{OID: fixture.baselineOID}))
+	if err != nil {
+		t.Fatalf("Prepare: %v", err)
+	}
+	movement := commitInClone(t, fixture.source.URL, "main", "race.txt", "other writer\n")
+	publisher.beforeCAS = func(_ context.Context, _ PublishRequest) error {
+		pushRef(t, movement.clone, fixture.target.URL, movement.oid, testPublicationRef, false)
+		return nil
+	}
+	claim := branchClaim(fixture.target, RemoteRef{OID: fixture.baselineOID})
+	receipt, err := publisher.Publish(context.Background(), publishRequest(prepared, "publish-race", claim))
+	if !errors.Is(err, ErrCASRejected) {
+		t.Fatalf("Publish race error = %v, want ErrCASRejected", err)
+	}
+	if receipt.Outcome != PublishCASRejected || receipt.ObservedRemote.OID != movement.oid {
+		t.Fatalf("Publish race receipt = %#v", receipt)
+	}
+	if got := remoteOID(t, fixture.target.URL); got != movement.oid {
+		t.Fatalf("CAS race overwrote remote: got %s want %s", got, movement.oid)
+	}
+}
+
+func TestExactLeaseRejectsRaceThatRemainsFastForward(t *testing.T) {
+	fixture := newRepositoryFixture(t, false)
+	oldOID := fixture.baselineOID
+	pushRef(t, fixture.seed, fixture.target.URL, oldOID, testPublicationRef, false)
+
+	mustWriteFile(t, filepath.Join(fixture.seed, "upstream.txt"), "upstream movement\n", 0o644)
+	runTestGit(t, fixture.seed, fixedCommitEnvironment(), "add", "--all")
+	runTestGit(t, fixture.seed, fixedCommitEnvironment(), "commit", "-m", "upstream movement")
+	advancedOID := strings.TrimSpace(runTestGit(t, fixture.seed, nil, "rev-parse", "HEAD"))
+	pushRef(t, fixture.seed, fixture.source.URL, advancedOID, "refs/heads/main", false)
+
+	advancedWorkspace := filepath.Join(t.TempDir(), "advanced-workspace")
+	copyTreeWithoutGit(t, fixture.seed, advancedWorkspace)
+	advancedBaseline, err := workspacedelta.Capture(advancedWorkspace, workspacedelta.Options{})
+	if err != nil {
+		t.Fatalf("Capture advanced baseline: %v", err)
+	}
+	mustWriteFile(t, filepath.Join(advancedWorkspace, "keep.txt"), "candidate after advanced baseline\n", 0o644)
+	advancedDelta, err := workspacedelta.Build(advancedBaseline, advancedWorkspace, workspacedelta.IntentWrite)
+	if err != nil {
+		t.Fatalf("Build advanced delta: %v", err)
+	}
+	fixture.baselineOID = advancedOID
+	fixture.delta = advancedDelta
+
+	publisher := newTestPublisher(t)
+	prepared, err := publisher.Prepare(context.Background(), fixture.prepareRequest("publication-lease-race", "prepare-lease-race", RemoteRef{OID: oldOID}))
+	if err != nil {
+		t.Fatalf("Prepare: %v", err)
+	}
+	publisher.beforeCAS = func(context.Context, PublishRequest) error {
+		pushRef(t, fixture.seed, fixture.target.URL, advancedOID, testPublicationRef, false)
+		return nil
+	}
+	claim := branchClaim(fixture.target, RemoteRef{OID: oldOID})
+	receipt, err := publisher.Publish(context.Background(), publishRequest(prepared, "publish-lease-race", claim))
+	if !errors.Is(err, ErrCASRejected) || receipt.Outcome != PublishCASRejected {
+		t.Fatalf("lease race Publish = %#v, %v", receipt, err)
+	}
+	if got := remoteOID(t, fixture.target.URL); got != advancedOID {
+		t.Fatalf("exact lease failed to preserve raced remote: got %s want %s", got, advancedOID)
+	}
+	if prepared.CommitOID == advancedOID {
+		t.Fatal("test candidate unexpectedly equals raced remote")
+	}
+}
+
+func TestPublishFastForwardsExistingExactOldOID(t *testing.T) {
+	fixture := newRepositoryFixture(t, false)
+	pushRef(t, fixture.seed, fixture.target.URL, fixture.baselineOID, testPublicationRef, false)
+	publisher := newTestPublisher(t)
+	var commands [][]string
+	publisher.commandRecord = func(args []string) { commands = append(commands, append([]string(nil), args...)) }
+	prepared, err := publisher.Prepare(context.Background(), fixture.prepareRequest("publication-existing", "prepare-existing", RemoteRef{OID: fixture.baselineOID}))
+	if err != nil {
+		t.Fatalf("Prepare: %v", err)
+	}
+	claim := branchClaim(fixture.target, RemoteRef{OID: fixture.baselineOID})
+	receipt, err := publisher.Publish(context.Background(), publishRequest(prepared, "publish-existing", claim))
+	if err != nil || receipt.Outcome != PublishAcknowledged {
+		t.Fatalf("Publish existing = %#v, %v", receipt, err)
+	}
+	if got := remoteOID(t, fixture.target.URL); got != prepared.CommitOID {
+		t.Fatalf("remote OID = %s, want %s", got, prepared.CommitOID)
+	}
+	lease := "--force-with-lease=" + testPublicationRef + ":" + fixture.baselineOID
+	found := false
+	for _, args := range commands {
+		if slices.Contains(args, "push") {
+			found = slices.Contains(args, lease)
+			for _, arg := range args {
+				if arg == "--force" || arg == "-f" || strings.HasPrefix(arg, "+") {
+					t.Fatalf("publisher used force-push argument %q in %v", arg, args)
+				}
+			}
+		}
+	}
+	if !found {
+		t.Fatalf("push did not carry exact old-OID lease %q: %v", lease, commands)
+	}
+}
+
+func TestPublishRejectsNonFastForwardEvenWhenClaimMatches(t *testing.T) {
+	fixture := newRepositoryFixture(t, false)
+	unrelated := newUnrelatedCommit(t)
+	pushRef(t, unrelated.clone, fixture.target.URL, unrelated.oid, testPublicationRef, false)
+	publisher := newTestPublisher(t)
+	pushes := 0
+	publisher.commandRecord = func(args []string) {
+		if slices.Contains(args, "push") {
+			pushes++
+		}
+	}
+	prepared, err := publisher.Prepare(context.Background(), fixture.prepareRequest("publication-non-ff", "prepare-non-ff", RemoteRef{OID: unrelated.oid}))
+	if err != nil {
+		t.Fatalf("Prepare: %v", err)
+	}
+	claim := branchClaim(fixture.target, RemoteRef{OID: unrelated.oid})
+	if _, err := publisher.Publish(context.Background(), publishRequest(prepared, "publish-non-ff", claim)); !errors.Is(err, ErrCASRejected) {
+		t.Fatalf("non-fast-forward Publish error = %v, want ErrCASRejected", err)
+	}
+	if pushes != 0 {
+		t.Fatalf("non-fast-forward publication reached push transport %d times", pushes)
+	}
+	if got := remoteOID(t, fixture.target.URL); got != unrelated.oid {
+		t.Fatalf("non-fast-forward publication changed remote to %s, want %s", got, unrelated.oid)
+	}
+}
+
+func TestVerifySupersededConflictAndIdempotency(t *testing.T) {
+	fixture := newRepositoryFixture(t, false)
+	publisher := newTestPublisher(t)
+	prepared, err := publisher.Prepare(context.Background(), fixture.prepareRequest("publication-verify", "prepare-verify", RemoteRef{Absent: true}))
+	if err != nil {
+		t.Fatalf("Prepare: %v", err)
+	}
+	claim := branchClaim(fixture.target, RemoteRef{Absent: true})
+	if _, err := publisher.Publish(context.Background(), publishRequest(prepared, "publish-verify", claim)); err != nil {
+		t.Fatalf("Publish: %v", err)
+	}
+	exactRequest := verifyRequest(prepared, "verify-stable", claim)
+	exact, err := publisher.Verify(context.Background(), exactRequest)
+	if err != nil || exact.Outcome != VerifiedExact {
+		t.Fatalf("initial Verify = %#v, %v", exact, err)
+	}
+
+	descendant := commitInClone(t, fixture.target.URL, strings.TrimPrefix(testPublicationRef, "refs/heads/"), "descendant.txt", "after Orka\n")
+	pushRef(t, descendant.clone, fixture.target.URL, descendant.oid, testPublicationRef, false)
+	stable, err := publisher.Verify(context.Background(), exactRequest)
+	if err != nil || stable != exact {
+		t.Fatalf("same verify operation changed receipt: %#v, %v; want %#v", stable, err, exact)
+	}
+	newRequest := exactRequest
+	newRequest.OperationID = "verify-superseded"
+	superseded, err := publisher.Verify(context.Background(), newRequest)
+	if err != nil {
+		t.Fatalf("Verify superseded: %v", err)
+	}
+	if superseded.Outcome != DeliveredSuperseded || superseded.ObservedRemote.OID != descendant.oid || superseded.DescendantProofDigest == "" {
+		t.Fatalf("Verify superseded = %#v", superseded)
+	}
+
+	unrelated := newUnrelatedCommit(t)
+	pushRef(t, unrelated.clone, fixture.target.URL, unrelated.oid, testPublicationRef, true)
+	conflictRequest := exactRequest
+	conflictRequest.OperationID = "verify-conflict"
+	conflict, err := publisher.Verify(context.Background(), conflictRequest)
+	if err != nil {
+		t.Fatalf("Verify conflict: %v", err)
+	}
+	if conflict.Outcome != DeliveryConflict || conflict.ObservedRemote.OID != unrelated.oid {
+		t.Fatalf("Verify conflict = %#v", conflict)
+	}
+}
+
+func TestAmbiguousPublishReconcilesWithoutRepush(t *testing.T) {
+	fixture := newRepositoryFixture(t, false)
+	publisher := newTestPublisher(t)
+	var pushCount int
+	publisher.commandRecord = func(args []string) {
+		if slices.Contains(args, "push") {
+			pushCount++
+		}
+	}
+	prepared, err := publisher.Prepare(context.Background(), fixture.prepareRequest("publication-ambiguous", "prepare-ambiguous", RemoteRef{Absent: true}))
+	if err != nil {
+		t.Fatalf("Prepare: %v", err)
+	}
+	publisher.afterPush = func(context.Context, PublishRequest) error { return errors.New("injected lost acknowledgement") }
+	claim := branchClaim(fixture.target, RemoteRef{Absent: true})
+	request := publishRequest(prepared, "publish-ambiguous", claim)
+	receipt, err := publisher.Publish(context.Background(), request)
+	if !errors.Is(err, ErrPublicationUnknown) || receipt.Outcome != PublishOutcomeUnknown {
+		t.Fatalf("ambiguous Publish = %#v, %v", receipt, err)
+	}
+	if got := remoteOID(t, fixture.target.URL); got != prepared.CommitOID {
+		t.Fatalf("ambiguous push did not update remote: got %s want %s", got, prepared.CommitOID)
+	}
+	publisher.afterPush = nil
+	repeated, err := publisher.Publish(context.Background(), request)
+	if !errors.Is(err, ErrPublicationUnknown) || repeated != receipt || pushCount != 1 {
+		t.Fatalf("ambiguous idempotent retry = %#v, %v, pushes=%d", repeated, err, pushCount)
+	}
+	verification, err := publisher.Verify(context.Background(), verifyRequest(prepared, "verify-after-ambiguity", claim))
+	if err != nil || verification.Outcome != VerifiedExact {
+		t.Fatalf("Verify after ambiguity = %#v, %v", verification, err)
+	}
+}
+
+func TestVerifyClassifiesBoundedObservationFailureUnknown(t *testing.T) {
+	fixture := newRepositoryFixture(t, false)
+	publisher := newTestPublisher(t)
+	prepared, err := publisher.Prepare(context.Background(), fixture.prepareRequest("publication-verify-unknown", "prepare-verify-unknown", RemoteRef{Absent: true}))
+	if err != nil {
+		t.Fatalf("Prepare: %v", err)
+	}
+	claim := branchClaim(fixture.target, RemoteRef{Absent: true})
+	if _, err := publisher.Publish(context.Background(), publishRequest(prepared, "publish-verify-unknown", claim)); err != nil {
+		t.Fatalf("Publish: %v", err)
+	}
+	publisher.observeFault = func(context.Context, Repository, string) error { return errors.New("injected read outage") }
+	request := verifyRequest(prepared, "verify-unknown", claim)
+	receipt, err := publisher.Verify(context.Background(), request)
+	if !errors.Is(err, ErrVerificationUnknown) || receipt.Outcome != PublicationOutcomeUnknown || receipt.ObservedRemote != (RemoteRef{}) {
+		t.Fatalf("unknown Verify = %#v, %v", receipt, err)
+	}
+	publisher.observeFault = nil
+	repeated, err := publisher.Verify(context.Background(), request)
+	if !errors.Is(err, ErrVerificationUnknown) || repeated != receipt {
+		t.Fatalf("idempotent unknown Verify = %#v, %v; want %#v", repeated, err, receipt)
+	}
+	request.OperationID = "verify-recovered"
+	recovered, err := publisher.Verify(context.Background(), request)
+	if err != nil || recovered.Outcome != VerifiedExact {
+		t.Fatalf("recovered Verify = %#v, %v", recovered, err)
+	}
+}
+
+func TestPublishCancellationBoundary(t *testing.T) {
+	t.Run("before boundary", func(t *testing.T) {
+		fixture := newRepositoryFixture(t, false)
+		publisher := newTestPublisher(t)
+		prepared, err := publisher.Prepare(context.Background(), fixture.prepareRequest("publication-cancel-before", "prepare-cancel-before", RemoteRef{Absent: true}))
+		if err != nil {
+			t.Fatalf("Prepare: %v", err)
+		}
+		ctx, cancel := context.WithCancel(context.Background())
+		cancel()
+		claim := branchClaim(fixture.target, RemoteRef{Absent: true})
+		if _, err := publisher.Publish(ctx, publishRequest(prepared, "publish-cancel-before", claim)); !errors.Is(err, context.Canceled) {
+			t.Fatalf("Publish canceled before boundary error = %v", err)
+		}
+		if got := remoteOID(t, fixture.target.URL); got != "" {
+			t.Fatalf("canceled pre-boundary publish mutated remote to %s", got)
+		}
+	})
+
+	t.Run("after boundary settles", func(t *testing.T) {
+		fixture := newRepositoryFixture(t, false)
+		publisher := newTestPublisher(t)
+		prepared, err := publisher.Prepare(context.Background(), fixture.prepareRequest("publication-cancel-after", "prepare-cancel-after", RemoteRef{Absent: true}))
+		if err != nil {
+			t.Fatalf("Prepare: %v", err)
+		}
+		ctx, cancel := context.WithCancel(context.Background())
+		publisher.beforeCAS = func(context.Context, PublishRequest) error {
+			cancel()
+			return nil
+		}
+		claim := branchClaim(fixture.target, RemoteRef{Absent: true})
+		receipt, err := publisher.Publish(ctx, publishRequest(prepared, "publish-cancel-after", claim))
+		if err != nil || receipt.Outcome != PublishAcknowledged {
+			t.Fatalf("post-boundary canceled Publish = %#v, %v", receipt, err)
+		}
+		if got := remoteOID(t, fixture.target.URL); got != prepared.CommitOID {
+			t.Fatalf("post-boundary settlement remote = %s, want %s", got, prepared.CommitOID)
+		}
+	})
+}
+
+func TestPullRequestIntentUsesExactTuple(t *testing.T) {
+	fixture := newRepositoryFixture(t, false)
+	intent := PullRequestIntent{
+		BaseRepository: fixture.source, BaseRef: "refs/heads/main",
+		HeadRepository: fixture.target, HeadRef: testPublicationRef,
+		PublicationGeneration: 7, ExpectedHeadOID: fixture.baselineOID,
+	}
+	key, err := intent.Key()
+	if err != nil {
+		t.Fatalf("PR intent key: %v", err)
+	}
+	changed := intent
+	changed.PublicationGeneration++
+	changedKey, err := changed.Key()
+	if err != nil {
+		t.Fatalf("changed PR intent key: %v", err)
+	}
+	if key == changedKey {
+		t.Fatal("PR tuple key ignored publication generation")
+	}
+	URLChanged := intent
+	URLChanged.BaseRepository.URL = fixture.target.URL
+	URLChangedKey, err := URLChanged.Key()
+	if err != nil {
+		t.Fatalf("URL-changed PR intent key: %v", err)
+	}
+	if URLChangedKey != key {
+		t.Fatal("PR tuple identity used mutable repository URL instead of provider identity")
+	}
+	reconciler := pullRequestReconcilerFunc(func(context.Context, PullRequestIntent) (PullRequestReceipt, error) {
+		return PullRequestReceipt{IntentKey: key, ForgeID: "pr-17", URL: "https://forge.example/pr/17", State: PullRequestOpen, HeadOID: fixture.baselineOID}, nil
+	})
+	receipt, err := ReconcilePullRequest(context.Background(), intent, reconciler)
+	if err != nil || receipt.IntentKey != key {
+		t.Fatalf("ReconcilePullRequest = %#v, %v", receipt, err)
+	}
+	wrong := pullRequestReconcilerFunc(func(context.Context, PullRequestIntent) (PullRequestReceipt, error) {
+		return PullRequestReceipt{IntentKey: changedKey, ForgeID: "pr-17", URL: "https://forge.example/pr/17", State: PullRequestOpen, HeadOID: fixture.baselineOID}, nil
+	})
+	if _, err := ReconcilePullRequest(context.Background(), intent, wrong); !errors.Is(err, ErrIdempotencyConflict) {
+		t.Fatalf("wrong PR tuple receipt error = %v, want ErrIdempotencyConflict", err)
+	}
+}
+
+type pullRequestReconcilerFunc func(context.Context, PullRequestIntent) (PullRequestReceipt, error)
+
+func (f pullRequestReconcilerFunc) Reconcile(ctx context.Context, intent PullRequestIntent) (PullRequestReceipt, error) {
+	return f(ctx, intent)
+}
+
+func newTestPublisher(t *testing.T) *Publisher {
+	t.Helper()
+	publisher, err := New(Options{
+		ArtifactRoot:   filepath.Join(t.TempDir(), "artifacts"),
+		TempRoot:       filepath.Join(t.TempDir(), "tmp"),
+		VerifyAttempts: 1,
+		VerifyBackoff:  time.Millisecond,
+		PublishTimeout: 10 * time.Second,
+	})
+	if err != nil {
+		t.Fatalf("New publisher: %v", err)
+	}
+	return publisher
+}
+
+func newRepositoryFixture(t *testing.T, attributes bool) repositoryFixture {
+	t.Helper()
+	return newRepositoryFixtureWithFormat(t, attributes, gitObjectFormatSHA1)
+}
+
+func newRepositoryFixtureWithFormat(t *testing.T, attributes bool, objectFormat string) repositoryFixture {
+	t.Helper()
+	seed := filepath.Join(t.TempDir(), "seed")
+	mustMkdir(t, seed)
+	initArgs := []string{"init", "-b", "main"}
+	if objectFormat != gitObjectFormatSHA1 {
+		initArgs = append(initArgs, "--object-format="+objectFormat)
+	}
+	runTestGit(t, seed, nil, initArgs...)
+	mustWriteFile(t, filepath.Join(seed, "keep.txt"), "old\n", 0o644)
+	mustWriteFile(t, filepath.Join(seed, "delete.txt"), "delete\n", 0o644)
+	mustWriteFile(t, filepath.Join(seed, "bin", "run"), "#!/bin/sh\nexit 0\n", 0o755)
+	if attributes {
+		mustWriteFile(t, filepath.Join(seed, ".gitattributes"), "*.txt filter=evil\n", 0o644)
+	}
+	runTestGit(t, seed, fixedCommitEnvironment(), "add", "--all")
+	runTestGit(t, seed, fixedCommitEnvironment(), "commit", "-m", "baseline")
+	baselineOID := strings.TrimSpace(runTestGit(t, seed, nil, "rev-parse", "HEAD"))
+	sourcePath := filepath.Join(t.TempDir(), "source.git")
+	runTestGit(t, "", nil, "clone", "--bare", "--", seed, sourcePath)
+	targetPath := filepath.Join(t.TempDir(), "fork.git")
+	targetInitArgs := []string{"init", "--bare"}
+	if objectFormat != gitObjectFormatSHA1 {
+		targetInitArgs = append(targetInitArgs, "--object-format="+objectFormat)
+	}
+	targetInitArgs = append(targetInitArgs, "--", targetPath)
+	runTestGit(t, "", nil, targetInitArgs...)
+
+	baselineRoot := filepath.Join(t.TempDir(), "workspace")
+	copyTreeWithoutGit(t, seed, baselineRoot)
+	baseline, err := workspacedelta.Capture(baselineRoot, workspacedelta.Options{})
+	if err != nil {
+		t.Fatalf("Capture baseline: %v", err)
+	}
+	mustWriteFile(t, filepath.Join(baselineRoot, "keep.txt"), "changed\n", 0o600)
+	if err := os.Remove(filepath.Join(baselineRoot, "delete.txt")); err != nil {
+		t.Fatalf("delete workspace file: %v", err)
+	}
+	mustWriteFile(t, filepath.Join(baselineRoot, "new.txt"), "new\n", 0o644)
+	if err := os.Symlink("keep.txt", filepath.Join(baselineRoot, "latest")); err != nil {
+		t.Fatalf("create workspace symlink: %v", err)
+	}
+	delta, err := workspacedelta.Build(baseline, baselineRoot, workspacedelta.IntentWrite)
+	if err != nil {
+		t.Fatalf("Build delta: %v", err)
+	}
+	return repositoryFixture{
+		source: Repository{Provider: "local", ID: "repository/source", URL: fileURL(sourcePath)},
+		target: Repository{Provider: "local", ID: "repository/fork", URL: fileURL(targetPath)},
+		seed:   seed, baselineOID: baselineOID, baselineRoot: baselineRoot, delta: delta,
+	}
+}
+
+func (f repositoryFixture) prepareRequest(publicationID, operationID string, remoteBefore RemoteRef) PrepareRequest {
+	return PrepareRequest{
+		PublicationID: publicationID, PublicationGeneration: 1, OperationID: operationID,
+		Source: f.source, SourceRef: "refs/heads/main", Target: f.target, TargetRef: testPublicationRef,
+		BranchClaimGeneration: 1, BaselineOID: f.baselineOID, RemoteBefore: remoteBefore,
+		DeltaArtifact: f.delta.Artifact, DeltaArtifactDigest: f.delta.ArtifactDigest,
+		CommitMessage:   "Orka publication " + publicationID + "\n",
+		CommitTimestamp: time.Date(2026, time.July, 24, 12, 34, 56, 0, time.UTC),
+	}
+}
+
+func branchClaim(target Repository, baseline RemoteRef) BranchClaim {
+	return BranchClaim{RepositoryID: target.ID, Ref: testPublicationRef, OwnerKind: "Task", OwnerUID: "task-uid-0001", Generation: 1, LastVerified: baseline}
+}
+
+func publishRequest(prepared PreparedPublication, operationID string, claim BranchClaim) PublishRequest {
+	return PublishRequest{
+		PublicationID: prepared.PublicationID, PublicationGeneration: prepared.PublicationGeneration,
+		OperationID: operationID, Target: prepared.Target, TargetRef: prepared.TargetRef,
+		Claim: claim, RemoteBefore: prepared.RemoteBefore, ExpectedCommitOID: prepared.CommitOID, BundleDigest: prepared.BundleDigest,
+	}
+}
+
+func verifyRequest(prepared PreparedPublication, operationID string, claim BranchClaim) VerifyRequest {
+	return VerifyRequest{
+		PublicationID: prepared.PublicationID, PublicationGeneration: prepared.PublicationGeneration,
+		OperationID: operationID, Target: prepared.Target, TargetRef: prepared.TargetRef,
+		Claim: claim, ExpectedCommitOID: prepared.CommitOID, BundleDigest: prepared.BundleDigest,
+	}
+}
+
+type commitFixture struct {
+	clone string
+	oid   string
+}
+
+func commitInClone(t *testing.T, repositoryURL, branch, name, content string) commitFixture {
+	t.Helper()
+	clone := filepath.Join(t.TempDir(), "clone")
+	runTestGit(t, "", nil, "clone", "--branch", branch, "--single-branch", "--", repositoryURL, clone)
+	mustWriteFile(t, filepath.Join(clone, name), content, 0o644)
+	runTestGit(t, clone, fixedCommitEnvironment(), "add", "--all")
+	runTestGit(t, clone, fixedCommitEnvironment(), "commit", "-m", "fixture change")
+	return commitFixture{clone: clone, oid: strings.TrimSpace(runTestGit(t, clone, nil, "rev-parse", "HEAD"))}
+}
+
+func newUnrelatedCommit(t *testing.T) commitFixture {
+	t.Helper()
+	clone := filepath.Join(t.TempDir(), "unrelated")
+	mustMkdir(t, clone)
+	runTestGit(t, clone, nil, "init", "-b", "main")
+	mustWriteFile(t, filepath.Join(clone, "unrelated.txt"), "unrelated\n", 0o644)
+	runTestGit(t, clone, fixedCommitEnvironment(), "add", "--all")
+	runTestGit(t, clone, fixedCommitEnvironment(), "commit", "-m", "unrelated")
+	return commitFixture{clone: clone, oid: strings.TrimSpace(runTestGit(t, clone, nil, "rev-parse", "HEAD"))}
+}
+
+func pushRef(t *testing.T, repository, targetURL, oid, ref string, force bool) {
+	t.Helper()
+	args := []string{"push"}
+	if force {
+		args = append(args, "--force")
+	}
+	args = append(args, "--", targetURL, oid+":"+ref)
+	runTestGit(t, repository, nil, args...)
+}
+
+func remoteOID(t *testing.T, repositoryURL string) string {
+	t.Helper()
+	output := strings.TrimSpace(runTestGit(t, "", nil, "ls-remote", "--refs", "--", repositoryURL, testPublicationRef))
+	if output == "" {
+		return ""
+	}
+	fields := strings.Fields(output)
+	if len(fields) != 2 || fields[1] != testPublicationRef {
+		t.Fatalf("ls-remote output = %q", output)
+	}
+	return fields[0]
+}
+
+func assertPreparedCommit(t *testing.T, prepared PreparedPublication, parent, message string, timestamp time.Time) {
+	t.Helper()
+	repository := filepath.Join(t.TempDir(), "inspect.git")
+	runTestGit(t, "", nil, "init", "--bare", "--", repository)
+	runTestGit(t, "", nil, "--git-dir="+repository, "fetch", "--", prepared.BundlePath, prepared.BundleRef+":refs/inspect/prepared")
+	resolved := strings.TrimSpace(runTestGit(t, "", nil, "--git-dir="+repository, "rev-parse", "refs/inspect/prepared^{commit}"))
+	if resolved != prepared.CommitOID {
+		t.Fatalf("bundle commit = %s, want %s", resolved, prepared.CommitOID)
+	}
+	format := "%an%x00%ae%x00%cn%x00%ce%x00%at%x00%ct%x00%P%x00%T%x00%B"
+	metadata := runTestGit(t, "", nil, "--git-dir="+repository, "show", "-s", "--format="+format, prepared.CommitOID)
+	parts := strings.SplitN(metadata, "\x00", 9)
+	if len(parts) == 9 {
+		parts[8] = strings.TrimSuffix(parts[8], "\n")
+	}
+	want := []string{CommitAuthorName, CommitAuthorEmail, CommitAuthorName, CommitAuthorEmail,
+		fmt.Sprint(timestamp.Unix()), fmt.Sprint(timestamp.Unix()), parent, prepared.TreeOID, message}
+	if !reflect.DeepEqual(parts, want) {
+		t.Fatalf("commit metadata = %#v, want %#v", parts, want)
+	}
+}
+
+func assertNoForcePush(t *testing.T, commands [][]string, expectedOID, ref string) {
+	t.Helper()
+	foundPush := false
+	for _, args := range commands {
+		if !slices.Contains(args, "push") {
+			continue
+		}
+		foundPush = true
+		for _, arg := range args {
+			if arg == "--force" || arg == "-f" || strings.HasPrefix(arg, "+") {
+				t.Fatalf("publisher used force-push argument %q in %v", arg, args)
+			}
+		}
+		lease := "--force-with-lease=" + ref + ":"
+		if !slices.Contains(args, lease) {
+			t.Fatalf("push lacks exact absent-old-OID lease %q: %v", lease, args)
+		}
+		if !slices.Contains(args, "refs/orka/prepared:"+ref) {
+			t.Fatalf("push lacks non-forced exact refspec: %v", args)
+		}
+		if slices.Contains(args, expectedOID+":"+ref) {
+			t.Fatalf("unexpected raw object refspec: %v", args)
+		}
+	}
+	if !foundPush {
+		t.Fatal("no publisher push command captured")
+	}
+}
+
+func countPushCommands(commands [][]string) int {
+	count := 0
+	for _, args := range commands {
+		if slices.Contains(args, "push") {
+			count++
+		}
+	}
+	return count
+}
+
+func addTarEntry(t *testing.T, artifact []byte, name string, data []byte) []byte {
+	t.Helper()
+	var output bytes.Buffer
+	writer := tar.NewWriter(&output)
+	reader := tar.NewReader(bytes.NewReader(artifact))
+	for {
+		header, err := reader.Next()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			t.Fatalf("read source tar: %v", err)
+		}
+		payload, err := io.ReadAll(reader)
+		if err != nil {
+			t.Fatalf("read source tar payload: %v", err)
+		}
+		copyHeader := *header
+		if err := writer.WriteHeader(&copyHeader); err != nil {
+			t.Fatalf("copy tar header: %v", err)
+		}
+		if _, err := writer.Write(payload); err != nil {
+			t.Fatalf("copy tar payload: %v", err)
+		}
+	}
+	if err := writer.WriteHeader(&tar.Header{Name: name, Mode: 0o644, Size: int64(len(data)), Typeflag: tar.TypeReg}); err != nil {
+		t.Fatalf("write malicious tar header: %v", err)
+	}
+	if _, err := writer.Write(data); err != nil {
+		t.Fatalf("write malicious tar payload: %v", err)
+	}
+	if err := writer.Close(); err != nil {
+		t.Fatalf("close malicious tar: %v", err)
+	}
+	return output.Bytes()
+}
+
+func copyTreeWithoutGit(t *testing.T, source, target string) {
+	t.Helper()
+	if err := filepath.Walk(source, func(current string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		relative, err := filepath.Rel(source, current)
+		if err != nil {
+			return err
+		}
+		if relative == ".git" || strings.HasPrefix(relative, ".git"+string(filepath.Separator)) {
+			if info.IsDir() {
+				return filepath.SkipDir
+			}
+			return nil
+		}
+		destination := filepath.Join(target, relative)
+		if info.IsDir() {
+			return os.MkdirAll(destination, info.Mode().Perm())
+		}
+		data, err := os.ReadFile(current)
+		if err != nil {
+			return err
+		}
+		return os.WriteFile(destination, data, info.Mode().Perm())
+	}); err != nil {
+		t.Fatalf("copy fixture tree: %v", err)
+	}
+}
+
+func fileURL(path string) string {
+	return (&url.URL{Scheme: repositorySchemeFile, Path: filepath.ToSlash(path)}).String()
+}
+
+func fileURLPath(t *testing.T, raw string) string {
+	t.Helper()
+	parsed, err := url.Parse(raw)
+	if err != nil {
+		t.Fatalf("parse file URL: %v", err)
+	}
+	return parsed.Path
+}
+
+func fixedCommitEnvironment() map[string]string {
+	return map[string]string{
+		"GIT_AUTHOR_NAME": "Fixture", "GIT_AUTHOR_EMAIL": "fixture@example.test",
+		"GIT_COMMITTER_NAME": "Fixture", "GIT_COMMITTER_EMAIL": "fixture@example.test",
+		"GIT_AUTHOR_DATE": "@1700000000 +0000", "GIT_COMMITTER_DATE": "@1700000000 +0000",
+	}
+}
+
+func runTestGit(t *testing.T, directory string, extra map[string]string, args ...string) string {
+	t.Helper()
+	command := exec.Command("git", args...)
+	command.Dir = directory
+	environment := append([]string(nil), os.Environ()...)
+	environment = append(environment, "GIT_CONFIG_GLOBAL=/dev/null", "GIT_CONFIG_NOSYSTEM=1", "GIT_TERMINAL_PROMPT=0")
+	for key, value := range extra {
+		environment = append(environment, key+"="+value)
+	}
+	command.Env = environment
+	output, err := command.CombinedOutput()
+	if err != nil {
+		t.Fatalf("git %v in %q: %v\n%s", args, directory, err, output)
+	}
+	return string(output)
+}
+
+func mustMkdir(t *testing.T, path string) {
+	t.Helper()
+	if err := os.MkdirAll(path, 0o755); err != nil {
+		t.Fatalf("mkdir %s: %v", path, err)
+	}
+}
+
+func mustWriteFile(t *testing.T, path, content string, mode os.FileMode) {
+	t.Helper()
+	mustMkdir(t, filepath.Dir(path))
+	if err := os.WriteFile(path, []byte(content), mode); err != nil {
+		t.Fatalf("write %s: %v", path, err)
+	}
+	if err := os.Chmod(path, mode); err != nil {
+		t.Fatalf("chmod %s: %v", path, err)
+	}
+}
+
+func writeExecutable(t *testing.T, path, content string) {
+	t.Helper()
+	mustWriteFile(t, path, content, 0o755)
+}
+
+func mustReadFile(t *testing.T, path string) []byte {
+	t.Helper()
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read %s: %v", path, err)
+	}
+	return data
+}
+
+func shellQuote(value string) string {
+	return "'" + strings.ReplaceAll(value, "'", "'\\''") + "'"
+}
+
+func TestPublicationReclaimRejectsGenerationMismatchAndRemovesCacheIdempotently(t *testing.T) {
+	fixture := newRepositoryFixture(t, true)
+	runtime := newTestPublisher(t)
+	request := fixture.prepareRequest("publication-reclaim", "prepare-reclaim", RemoteRef{Absent: true})
+	prepared, err := runtime.Prepare(context.Background(), request)
+	if err != nil {
+		t.Fatalf("Prepare: %v", err)
+	}
+	identityPath := filepath.Join(runtime.artifactRoot, request.PublicationID, publicationIdentityName)
+	var identity publicationStorageIdentity
+	if err := readCanonical(identityPath, &identity); err != nil {
+		t.Fatalf("read publication identity: %v", err)
+	}
+	if identity.PublicationID != request.PublicationID || identity.PublicationGeneration != request.PublicationGeneration {
+		t.Fatalf("publication identity = %#v, want exact request identity", identity)
+	}
+
+	_, err = runtime.Reclaim(context.Background(), ReclaimRequest{
+		PublicationID: request.PublicationID, PublicationGeneration: request.PublicationGeneration + 1,
+	})
+	if !errors.Is(err, ErrIdempotencyConflict) {
+		t.Fatalf("Reclaim generation mismatch error = %v, want ErrIdempotencyConflict", err)
+	}
+	if _, err := os.Stat(prepared.BundlePath); err != nil {
+		t.Fatalf("bundle removed after rejected generation mismatch: %v", err)
+	}
+
+	result, err := runtime.Reclaim(context.Background(), ReclaimRequest{
+		PublicationID: request.PublicationID, PublicationGeneration: request.PublicationGeneration,
+	})
+	if err != nil {
+		t.Fatalf("Reclaim: %v", err)
+	}
+	if !result.Reclaimed || result.PublicationID != request.PublicationID || result.PublicationGeneration != request.PublicationGeneration {
+		t.Fatalf("Reclaim result = %#v", result)
+	}
+	if _, err := os.Stat(filepath.Join(runtime.artifactRoot, request.PublicationID)); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("publication directory after reclaim error = %v, want not exist", err)
+	}
+
+	result, err = runtime.Reclaim(context.Background(), ReclaimRequest{
+		PublicationID: request.PublicationID, PublicationGeneration: request.PublicationGeneration,
+	})
+	if err != nil || !result.Reclaimed {
+		t.Fatalf("idempotent Reclaim result = %#v, error = %v", result, err)
+	}
+}
+
+func TestRestorePreparedPersistsPublicationIdentityForFutureReclaim(t *testing.T) {
+	fixture := newRepositoryFixture(t, true)
+	source := newTestPublisher(t)
+	prepared, err := source.Prepare(context.Background(), fixture.prepareRequest(
+		"publication-restore-identity", "prepare-restore-identity", RemoteRef{Absent: true},
+	))
+	if err != nil {
+		t.Fatalf("Prepare: %v", err)
+	}
+	bundle := mustReadFile(t, prepared.BundlePath)
+	prepared.BundlePath = ""
+
+	restored := newTestPublisher(t)
+	if err := restored.RestorePrepared(context.Background(), prepared, bundle); err != nil {
+		t.Fatalf("RestorePrepared: %v", err)
+	}
+	var identity publicationStorageIdentity
+	if err := readCanonical(
+		filepath.Join(restored.artifactRoot, prepared.PublicationID, publicationIdentityName), &identity,
+	); err != nil {
+		t.Fatalf("read restored publication identity: %v", err)
+	}
+	if identity.PublicationID != prepared.PublicationID || identity.PublicationGeneration != prepared.PublicationGeneration {
+		t.Fatalf("restored publication identity = %#v, want exact prepared identity", identity)
+	}
+}
+
+func TestPublicationCacheRecoversPartialLegacyDirectories(t *testing.T) {
+	t.Run("prepare upgrades generation one", func(t *testing.T) {
+		runtime := newTestPublisher(t)
+		publicationID := "publication-legacy-prepare"
+		directory := filepath.Join(runtime.artifactRoot, publicationID)
+		if err := os.Mkdir(directory, 0o700); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(directory, bundleFileName), []byte("partial legacy bundle"), 0o600); err != nil {
+			t.Fatal(err)
+		}
+
+		opened, err := runtime.ensurePublicationDirectory(publicationID, legacyPublicationCacheGeneration)
+		if err != nil {
+			t.Fatalf("ensurePublicationDirectory: %v", err)
+		}
+		if opened != directory {
+			t.Fatalf("opened directory = %q, want %q", opened, directory)
+		}
+		identity, err := runtime.readPublicationIdentityFile(directory)
+		if err != nil {
+			t.Fatalf("read recovered identity: %v", err)
+		}
+		if identity.PublicationID != publicationID || identity.PublicationGeneration != legacyPublicationCacheGeneration {
+			t.Fatalf("recovered identity = %#v", identity)
+		}
+	})
+
+	t.Run("reclaim quarantines generation one and rejects later generations", func(t *testing.T) {
+		runtime := newTestPublisher(t)
+		publicationID := "publication-legacy-reclaim"
+		directory := filepath.Join(runtime.artifactRoot, publicationID)
+		if err := os.Mkdir(directory, 0o700); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(directory, bundleFileName), []byte("partial legacy bundle"), 0o600); err != nil {
+			t.Fatal(err)
+		}
+
+		_, err := runtime.Reclaim(context.Background(), ReclaimRequest{
+			PublicationID: publicationID, PublicationGeneration: legacyPublicationCacheGeneration + 1,
+		})
+		if !errors.Is(err, ErrIdempotencyConflict) {
+			t.Fatalf("later-generation reclaim error = %v, want ErrIdempotencyConflict", err)
+		}
+		if _, err := os.Stat(directory); err != nil {
+			t.Fatalf("legacy directory removed after rejected generation: %v", err)
+		}
+
+		result, err := runtime.Reclaim(context.Background(), ReclaimRequest{
+			PublicationID: publicationID, PublicationGeneration: legacyPublicationCacheGeneration,
+		})
+		if err != nil {
+			t.Fatalf("legacy Reclaim: %v", err)
+		}
+		if !result.Reclaimed {
+			t.Fatalf("legacy Reclaim result = %#v", result)
+		}
+		if _, err := os.Stat(directory); !errors.Is(err, os.ErrNotExist) {
+			t.Fatalf("legacy directory after reclaim error = %v, want not exist", err)
+		}
+	})
+}
+
+func TestLoadPreparedRejectsSymlinkedPublicationDirectory(t *testing.T) {
+	runtime := newTestPublisher(t)
+	publicationID := "publication-symlink-cache"
+	target := t.TempDir()
+	if err := os.Symlink(target, filepath.Join(runtime.artifactRoot, publicationID)); err != nil {
+		t.Fatal(err)
+	}
+
+	_, err := runtime.loadPrepared(publicationID)
+	if !errors.Is(err, ErrPreparedArtifactCorrupt) {
+		t.Fatalf("loadPrepared symlink error = %v, want ErrPreparedArtifactCorrupt", err)
+	}
+	if _, err := os.Stat(filepath.Join(target, publicationIdentityName)); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("symlink target identity error = %v, want no file", err)
+	}
+}
diff --git a/internal/publisher/reclaim.go b/internal/publisher/reclaim.go
new file mode 100644
index 000000000..7a71f08f6
--- /dev/null
+++ b/internal/publisher/reclaim.go
@@ -0,0 +1,129 @@
+package publisher
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+)
+
+// Reclaim durably removes one exact Publication incarnation from the local
+// Publisher cache. The caller must already have settled all publication and
+// session effects. Once the directory is renamed out of its live name, cleanup
+// is completed even if the request context is canceled so a successful return
+// is a durable reclamation boundary.
+func (p *Publisher) Reclaim(ctx context.Context, request ReclaimRequest) (ReclaimResult, error) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	if err := validateReclaimRequest(request); err != nil {
+		return ReclaimResult{}, err
+	}
+	if err := ctx.Err(); err != nil {
+		return ReclaimResult{}, err
+	}
+
+	directory, err := p.publicationPath(request.PublicationID)
+	if err != nil {
+		return ReclaimResult{}, err
+	}
+	staging := p.publicationStagingPath(request)
+	if err := p.finishPublicationReclaim(staging, request); err != nil {
+		return ReclaimResult{}, err
+	}
+	tombstone := p.publicationReclaimPath(request)
+	if err := p.finishPublicationReclaim(tombstone, request); err != nil {
+		return ReclaimResult{}, err
+	}
+
+	identity, exists, err := p.publicationIdentityForRequest(directory, request, true)
+	if err != nil {
+		return ReclaimResult{}, err
+	}
+	if !exists {
+		if err := syncPublisherDirectory(p.artifactRoot); err != nil {
+			return ReclaimResult{}, fmt.Errorf("persist absent publication cache state: %w", err)
+		}
+		return reclaimedPublication(request), nil
+	}
+	if identity.PublicationGeneration != request.PublicationGeneration {
+		return ReclaimResult{}, operationError(
+			ErrIdempotencyConflict,
+			"reclaim publication",
+			fmt.Sprintf("durable publication generation %d differs from requested generation %d", identity.PublicationGeneration, request.PublicationGeneration),
+			nil,
+		)
+	}
+	if err := os.Rename(directory, tombstone); err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			if finishErr := p.finishPublicationReclaim(tombstone, request); finishErr != nil {
+				return ReclaimResult{}, finishErr
+			}
+			return reclaimedPublication(request), nil
+		}
+		return ReclaimResult{}, fmt.Errorf("stage publication reclamation: %w", err)
+	}
+	if err := syncPublisherDirectory(p.artifactRoot); err != nil {
+		return ReclaimResult{}, fmt.Errorf("persist staged publication reclamation: %w", err)
+	}
+	if err := p.finishPublicationReclaim(tombstone, request); err != nil {
+		return ReclaimResult{}, err
+	}
+	return reclaimedPublication(request), nil
+}
+
+func validateReclaimRequest(request ReclaimRequest) error {
+	if err := validateIdentifier("publication ID", request.PublicationID); err != nil {
+		return err
+	}
+	if request.PublicationGeneration < 1 {
+		return invalid("publication generation", "must be at least 1")
+	}
+	return nil
+}
+
+func reclaimedPublication(request ReclaimRequest) ReclaimResult {
+	return ReclaimResult{
+		PublicationID: request.PublicationID, PublicationGeneration: request.PublicationGeneration, Reclaimed: true,
+	}
+}
+
+func (p *Publisher) publicationStagingPath(request ReclaimRequest) string {
+	return filepath.Join(p.artifactRoot, ".publication-"+publicationCacheIdentityDigest(request))
+}
+
+func (p *Publisher) publicationReclaimPath(request ReclaimRequest) string {
+	return filepath.Join(p.artifactRoot, ".reclaim-"+publicationCacheIdentityDigest(request))
+}
+
+func publicationCacheIdentityDigest(request ReclaimRequest) string {
+	hash := sha256.Sum256([]byte(request.PublicationID + "\x00" + strconv.FormatInt(request.PublicationGeneration, 10)))
+	return hex.EncodeToString(hash[:])
+}
+
+func (p *Publisher) finishPublicationReclaim(path string, request ReclaimRequest) error {
+	identity, exists, err := p.publicationIdentityForRequest(path, request, false)
+	if err != nil {
+		return err
+	}
+	if !exists {
+		if err := syncPublisherDirectory(p.artifactRoot); err != nil {
+			return fmt.Errorf("persist absent publication cache state: %w", err)
+		}
+		return nil
+	}
+	if identity.PublicationGeneration != request.PublicationGeneration {
+		return operationError(ErrIdempotencyConflict, "finish publication reclamation", "staged publication generation differs from request", nil)
+	}
+	if err := os.RemoveAll(path); err != nil {
+		return fmt.Errorf("remove staged publication cache: %w", err)
+	}
+	if err := syncPublisherDirectory(p.artifactRoot); err != nil {
+		return fmt.Errorf("persist publication cache removal: %w", err)
+	}
+	return nil
+}
diff --git a/internal/publisher/service/artifact_authorization.go b/internal/publisher/service/artifact_authorization.go
new file mode 100644
index 000000000..cdad3f795
--- /dev/null
+++ b/internal/publisher/service/artifact_authorization.go
@@ -0,0 +1,186 @@
+package service
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/orka-agents/orka/internal/artifactcap"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+const (
+	// ArtifactAuthorizationBrokerPath is the controller endpoint that exchanges
+	// one authenticated Publisher operation for one exact artifact capability.
+	ArtifactAuthorizationBrokerPath = "/internal/v2/acp/publisher-artifact-authorizations"
+	maxArtifactBrokerResponseBytes  = int64(32 << 10)
+	maxArtifactRemoteAttempts       = 20
+)
+
+// ArtifactAuthorizationRequest binds one artifact transfer to the exact
+// Publisher operation that is currently executing. Raw capability-signing
+// material is never delivered to the Publisher when broker mode is enabled.
+type ArtifactAuthorizationRequest struct {
+	ParentOperation   Operation                   `json:"parentOperation"`
+	Metadata          OperationMetadata           `json:"metadata"`
+	ArtifactOperation artifactcap.Operation       `json:"artifactOperation"`
+	Artifact          harnessv2.ArtifactReference `json:"artifact"`
+	Attempt           int                         `json:"attempt"`
+}
+
+// Validate validates the immutable transfer binding independently of any
+// controller-side Task or Publication state.
+func (r ArtifactAuthorizationRequest) Validate() error {
+	if r.ParentOperation.Path() == "" || r.Attempt < 1 || r.Attempt > maxArtifactRemoteAttempts {
+		return fmt.Errorf("artifact authorization request is invalid")
+	}
+	if err := r.Metadata.validateFor(r.ParentOperation); err != nil {
+		return err
+	}
+	if err := validateArtifactTransportReference(r.Artifact); err != nil {
+		return err
+	}
+	switch r.ArtifactOperation {
+	case artifactcap.OperationUpload:
+		workspaceUpload := r.ParentOperation == OperationWorkspacePrepare && r.Artifact.MediaType == artifactcap.MediaTypeWorkspaceTar
+		bundleUpload := r.ParentOperation == OperationPublicationPrepare && r.Artifact.MediaType == artifactcap.MediaTypeGitBundle
+		if !workspaceUpload && !bundleUpload {
+			return fmt.Errorf("artifact upload is not valid for parent operation")
+		}
+	case artifactcap.OperationDownload:
+		deltaDownload := r.ParentOperation == OperationPublicationPrepare && r.Artifact.MediaType == artifactcap.MediaTypeWorkspaceDelta
+		bundleDownload := (r.ParentOperation == OperationPublicationPublish || r.ParentOperation == OperationPublicationVerify) && r.Artifact.MediaType == artifactcap.MediaTypeGitBundle
+		if !deltaDownload && !bundleDownload {
+			return fmt.Errorf("artifact download is not valid for parent operation")
+		}
+	default:
+		return fmt.Errorf("artifact operation is invalid")
+	}
+	return nil
+}
+
+// ArtifactAuthorizationResponse contains only a one-operation capability and
+// its exact request digest. It never exposes the artifact signing key.
+type ArtifactAuthorizationResponse struct {
+	Capability    string `json:"capability"`
+	RequestDigest string `json:"requestDigest"`
+}
+
+// ArtifactOperationID returns a deterministic, bounded replay-ledger identity
+// for one remote transfer attempt.
+func ArtifactOperationID(request ArtifactAuthorizationRequest) string {
+	return "publisher-" + hashID(
+		request.Metadata.Namespace,
+		request.Metadata.OperationID,
+		request.Metadata.TaskID,
+		request.Metadata.PublicationID,
+		string(request.ParentOperation),
+		string(request.ArtifactOperation),
+		request.Artifact.Digest,
+		strconv.Itoa(request.Attempt),
+	)
+}
+
+type artifactAuthorizer interface {
+	Authorize(context.Context, ArtifactAuthorizationRequest) (artifactcap.Authorization, error)
+}
+
+type localArtifactAuthorizer struct {
+	secret []byte
+	ttl    time.Duration
+	now    func() time.Time
+}
+
+func (a *localArtifactAuthorizer) Authorize(_ context.Context, request ArtifactAuthorizationRequest) (artifactcap.Authorization, error) {
+	if err := request.Validate(); err != nil {
+		return artifactcap.Authorization{}, err
+	}
+	binding, err := ArtifactBinding(request)
+	if err != nil {
+		return artifactcap.Authorization{}, err
+	}
+	return artifactcap.Issue(a.secret, binding, a.now(), a.ttl)
+}
+
+type brokerArtifactAuthorizer struct {
+	endpoint *url.URL
+	client   *http.Client
+	bearer   string
+}
+
+func newBrokerArtifactAuthorizer(rawURL string, client *http.Client, bearer []byte, timeout time.Duration) (*brokerArtifactAuthorizer, error) {
+	parsed, err := url.Parse(strings.TrimSpace(rawURL))
+	if err != nil || parsed.Scheme == "" || parsed.Host == "" || parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" || parsed.Opaque != "" {
+		return nil, fmt.Errorf("artifact authorization broker URL must be an absolute credential-free HTTP(S) URL")
+	}
+	if (parsed.Scheme != schemeHTTP && parsed.Scheme != schemeHTTPS) || (parsed.Path != "" && parsed.Path != "/") {
+		return nil, fmt.Errorf("artifact authorization broker URL must contain only scheme and authority")
+	}
+	if len(bytes.TrimSpace(bearer)) < 16 {
+		return nil, fmt.Errorf("artifact authorization broker bearer token is invalid")
+	}
+	parsed.Path = ArtifactAuthorizationBrokerPath
+	parsed.RawPath = ""
+	if client == nil {
+		client = &http.Client{Timeout: timeout}
+	} else {
+		clone := *client
+		client = &clone
+		if client.Timeout == 0 {
+			client.Timeout = timeout
+		}
+	}
+	client.CheckRedirect = func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }
+	return &brokerArtifactAuthorizer{endpoint: parsed, client: client, bearer: string(bytes.TrimSpace(bearer))}, nil
+}
+
+func (a *brokerArtifactAuthorizer) Authorize(ctx context.Context, request ArtifactAuthorizationRequest) (artifactcap.Authorization, error) {
+	if err := request.Validate(); err != nil {
+		return artifactcap.Authorization{}, err
+	}
+	body, err := json.Marshal(request)
+	if err != nil {
+		return artifactcap.Authorization{}, err
+	}
+	httpRequest, err := http.NewRequestWithContext(ctx, http.MethodPost, a.endpoint.String(), bytes.NewReader(body))
+	if err != nil {
+		return artifactcap.Authorization{}, err
+	}
+	httpRequest.Header.Set("Authorization", "Bearer "+a.bearer)
+	httpRequest.Header.Set("Content-Type", "application/json")
+	httpRequest.Header.Set("Accept", "application/json")
+	response, err := a.client.Do(httpRequest)
+	if err != nil {
+		return artifactcap.Authorization{}, apiError(ErrArtifactTransport, "artifact_authorization_transport_failed", "artifact authorization broker transport failed", 503, true, err)
+	}
+	defer response.Body.Close() //nolint:errcheck
+	data, readErr := io.ReadAll(io.LimitReader(response.Body, maxArtifactBrokerResponseBytes+1))
+	if readErr != nil || int64(len(data)) > maxArtifactBrokerResponseBytes || response.StatusCode != http.StatusOK {
+		retryable := response.StatusCode >= 500 || response.StatusCode == http.StatusTooManyRequests
+		return artifactcap.Authorization{}, apiError(ErrArtifactTransport, "artifact_authorization_rejected", "artifact authorization broker rejected the transfer", response.StatusCode, retryable, readErr)
+	}
+	var decoded ArtifactAuthorizationResponse
+	if err := decodeStrict(data, &decoded); err != nil || decoded.Capability == "" || !artifactcap.IsRequestDigest(decoded.RequestDigest) {
+		return artifactcap.Authorization{}, apiError(ErrArtifactTransport, "artifact_authorization_response_invalid", "artifact authorization broker returned an invalid response", 502, false, err)
+	}
+	return artifactcap.Authorization{Capability: decoded.Capability, RequestDigest: decoded.RequestDigest}, nil
+}
+
+func ArtifactBinding(request ArtifactAuthorizationRequest) (artifactcap.OperationRequest, error) {
+	if err := request.Validate(); err != nil {
+		return artifactcap.OperationRequest{}, err
+	}
+	identity := artifactcap.Identity{Namespace: request.Metadata.Namespace, TaskID: request.Metadata.TaskID, PublicationID: request.Metadata.PublicationID}
+	return artifactcap.OperationRequest{
+		Operation: request.ArtifactOperation, ObjectDigest: request.Artifact.Digest, Identity: identity,
+		ContentLength: request.Artifact.SizeBytes, MediaType: request.Artifact.MediaType,
+		OperationID: ArtifactOperationID(request),
+	}, nil
+}
diff --git a/internal/publisher/service/artifact_authorization_test.go b/internal/publisher/service/artifact_authorization_test.go
new file mode 100644
index 000000000..a4bb797fc
--- /dev/null
+++ b/internal/publisher/service/artifact_authorization_test.go
@@ -0,0 +1,97 @@
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/orka-agents/orka/internal/artifactcap"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+func TestBrokerArtifactAuthorizerRequestsExactCapability(t *testing.T) {
+	secret := []byte(strings.Repeat("a", artifactcap.MinSecretBytes))
+	bearer := strings.Repeat("b", 32)
+	data := []byte("workspace")
+	digest := artifactcap.DigestBytes(data)
+	artifactID, err := artifactcap.ArtifactIDForDigest(digest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := ArtifactAuthorizationRequest{
+		ParentOperation:   OperationWorkspacePrepare,
+		Metadata:          OperationMetadata{Namespace: "default", TaskID: "task", OperationID: "workspace-prepare-prompt"},
+		ArtifactOperation: artifactcap.OperationUpload,
+		Artifact:          harnessv2.ArtifactReference{ArtifactID: harnessv2.ArtifactID(artifactID), Digest: digest, SizeBytes: int64(len(data)), MediaType: artifactcap.MediaTypeWorkspaceTar},
+		Attempt:           1,
+	}
+	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, httpRequest *http.Request) {
+		if httpRequest.URL.Path != ArtifactAuthorizationBrokerPath || httpRequest.Header.Get("Authorization") != "Bearer "+bearer {
+			t.Errorf("request path/auth = %q %q", httpRequest.URL.Path, httpRequest.Header.Get("Authorization"))
+		}
+		var got ArtifactAuthorizationRequest
+		if err := json.NewDecoder(httpRequest.Body).Decode(&got); err != nil {
+			t.Errorf("decode: %v", err)
+		}
+		if got != request {
+			t.Errorf("request = %#v, want %#v", got, request)
+		}
+		binding, err := ArtifactBinding(got)
+		if err != nil {
+			t.Errorf("binding: %v", err)
+			return
+		}
+		authorization, err := artifactcap.Issue(secret, binding, time.Now().UTC(), time.Minute)
+		if err != nil {
+			t.Errorf("issue: %v", err)
+			return
+		}
+		writer.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(writer).Encode(ArtifactAuthorizationResponse{Capability: authorization.Capability, RequestDigest: authorization.RequestDigest})
+	}))
+	defer server.Close()
+	authorizer, err := newBrokerArtifactAuthorizer(server.URL, server.Client(), []byte(bearer), time.Second)
+	if err != nil {
+		t.Fatal(err)
+	}
+	issued, err := authorizer.Authorize(context.Background(), request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	binding, err := ArtifactBinding(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	path, err := artifactcap.ObjectPath(binding.ObjectDigest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	presented := artifactcap.PresentedRequest{Method: binding.Method(), Path: path, ObjectDigest: binding.ObjectDigest, ContentLength: binding.ContentLength, MediaType: binding.MediaType, RequestDigest: issued.RequestDigest}
+	if _, err := artifactcap.Verify(secret, issued.Capability, presented, time.Now().UTC()); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestLoadConfigFromEnvUsesArtifactBrokerWithoutSigningKey(t *testing.T) {
+	clearPublisherEnvForTest(t)
+	controller := writePublisherSecretForTest(t, "controller", strings.Repeat("c", 32))
+	operation := writePublisherSecretForTest(t, "operation", strings.Repeat("o", MinSecretBytes))
+	t.Setenv(EnvControllerTokenFile, controller)
+	t.Setenv(EnvOperationCapabilitySecretFile, operation)
+	t.Setenv(EnvArtifactAuthorizationBrokerURL, "https://orka-api.example")
+	t.Setenv(EnvCredentialBrokerURL, "https://orka-api.example")
+	t.Setenv(EnvArtifactAPIURL, "https://orka-api.example")
+	setProductionPublisherProxyForTest(t)
+
+	config, err := LoadConfigFromEnv()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if config.ArtifactAuthorizationBrokerURL != "https://orka-api.example" || len(config.ArtifactCapabilitySecret) != 0 {
+		t.Fatalf("artifact authorization config = %#v", config)
+	}
+}
diff --git a/internal/publisher/service/artifact_client.go b/internal/publisher/service/artifact_client.go
new file mode 100644
index 000000000..db63af46d
--- /dev/null
+++ b/internal/publisher/service/artifact_client.go
@@ -0,0 +1,181 @@
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strconv"
+	"time"
+
+	"github.com/orka-agents/orka/internal/artifactcap"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+const maxArtifactResponseBytes = int64(64 << 10)
+
+type artifactClient struct {
+	baseURL    *url.URL
+	client     *http.Client
+	authorizer artifactAuthorizer
+}
+
+func newArtifactClient(rawURL string, client *http.Client, authorizer artifactAuthorizer, timeout time.Duration) (*artifactClient, error) {
+	parsed, err := url.Parse(rawURL)
+	if err != nil || parsed.Scheme == "" || parsed.Host == "" || parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" || parsed.Opaque != "" {
+		return nil, fmt.Errorf("artifact API URL must be an absolute credential-free HTTP(S) URL")
+	}
+	if parsed.Scheme != schemeHTTP && parsed.Scheme != schemeHTTPS || parsed.Path != "" && parsed.Path != "/" {
+		return nil, fmt.Errorf("artifact API URL must contain only scheme and authority")
+	}
+	parsed.Path = ""
+	parsed.RawPath = ""
+	if client == nil {
+		client = &http.Client{Timeout: timeout}
+	} else {
+		clone := *client
+		client = &clone
+		if client.Timeout == 0 {
+			client.Timeout = timeout
+		}
+	}
+	client.CheckRedirect = func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }
+	if authorizer == nil {
+		return nil, fmt.Errorf("artifact authorizer is required")
+	}
+	return &artifactClient{baseURL: parsed, client: client, authorizer: authorizer}, nil
+}
+
+func (c *artifactClient) upload(
+	ctx context.Context,
+	parent Operation,
+	metadata OperationMetadata,
+	attempt int,
+	reference harnessv2.ArtifactReference,
+	body io.Reader,
+) error {
+	if err := validateArtifactTransportReference(reference); err != nil {
+		return err
+	}
+	authorization, err := c.authorizer.Authorize(ctx, ArtifactAuthorizationRequest{
+		ParentOperation: parent, Metadata: metadata, ArtifactOperation: artifactcap.OperationUpload,
+		Artifact: reference, Attempt: attempt,
+	})
+	if err != nil {
+		return apiError(ErrArtifactTransport, "artifact_authorization_failed", "artifact upload could not be authorized", 503, false, err)
+	}
+	request, err := c.request(ctx, http.MethodPut, reference, authorization, body)
+	if err != nil {
+		return err
+	}
+	response, err := c.client.Do(request)
+	if err != nil {
+		return apiError(ErrArtifactTransport, "artifact_transport_failed", "artifact upload transport failed", 503, true, err)
+	}
+	defer response.Body.Close() //nolint:errcheck
+	if response.StatusCode != http.StatusCreated {
+		_, _ = io.Copy(io.Discard, io.LimitReader(response.Body, maxArtifactResponseBytes))
+		retryable := response.StatusCode >= 500 || response.StatusCode == http.StatusTooManyRequests
+		return apiError(ErrArtifactTransport, "artifact_upload_failed", "artifact API rejected the upload", response.StatusCode, retryable, nil)
+	}
+	data, err := io.ReadAll(io.LimitReader(response.Body, maxArtifactResponseBytes+1))
+	if err != nil || int64(len(data)) > maxArtifactResponseBytes {
+		return apiError(ErrArtifactTransport, "artifact_response_invalid", "artifact API returned an invalid response", 502, true, err)
+	}
+	var stored artifactcap.Artifact
+	if err := decodeStrict(data, &stored); err != nil || stored.Validate() != nil {
+		return apiError(ErrArtifactTransport, "artifact_response_invalid", "artifact API returned an invalid response", 502, false, err)
+	}
+	actual := harnessv2.ArtifactReference{ArtifactID: harnessv2.ArtifactID(stored.ArtifactID), Digest: stored.Digest, SizeBytes: stored.SizeBytes, MediaType: stored.MediaType}
+	if actual != reference {
+		return apiError(ErrArtifactTransport, "artifact_response_mismatch", "artifact API response did not match the requested object", 502, false, nil)
+	}
+	return nil
+}
+
+func (c *artifactClient) download(ctx context.Context, parent Operation, metadata OperationMetadata, attempt int, reference harnessv2.ArtifactReference, limit int64) ([]byte, error) {
+	if err := validateArtifactTransportReference(reference); err != nil {
+		return nil, err
+	}
+	if reference.SizeBytes > limit {
+		return nil, invalidRequest("artifact exceeds the configured download limit", nil)
+	}
+	authorization, err := c.authorizer.Authorize(ctx, ArtifactAuthorizationRequest{
+		ParentOperation: parent, Metadata: metadata, ArtifactOperation: artifactcap.OperationDownload,
+		Artifact: reference, Attempt: attempt,
+	})
+	if err != nil {
+		return nil, apiError(ErrArtifactTransport, "artifact_authorization_failed", "artifact download could not be authorized", 503, false, err)
+	}
+	request, err := c.request(ctx, http.MethodGet, reference, authorization, nil)
+	if err != nil {
+		return nil, err
+	}
+	response, err := c.client.Do(request)
+	if err != nil {
+		return nil, apiError(ErrArtifactTransport, "artifact_transport_failed", "artifact download transport failed", 503, true, err)
+	}
+	defer response.Body.Close() //nolint:errcheck
+	if response.StatusCode != http.StatusOK {
+		_, _ = io.Copy(io.Discard, io.LimitReader(response.Body, maxArtifactResponseBytes))
+		retryable := response.StatusCode >= 500 || response.StatusCode == http.StatusTooManyRequests
+		return nil, apiError(ErrArtifactTransport, "artifact_download_failed", "artifact API rejected the download", response.StatusCode, retryable, nil)
+	}
+	if response.ContentLength != reference.SizeBytes || response.Header.Get("Content-Type") != reference.MediaType ||
+		response.Header.Get(artifactcap.ObjectDigestHeader) != reference.Digest {
+		return nil, apiError(ErrArtifactTransport, "artifact_response_mismatch", "artifact download metadata did not match the requested object", 502, false, nil)
+	}
+	data, err := io.ReadAll(io.LimitReader(response.Body, limit+1))
+	if err != nil || int64(len(data)) != reference.SizeBytes || int64(len(data)) > limit {
+		return nil, apiError(ErrArtifactTransport, "artifact_response_invalid", "artifact download body was incomplete or oversized", 502, true, err)
+	}
+	if !constantEqual(artifactcap.DigestBytes(data), reference.Digest) {
+		return nil, apiError(ErrArtifactTransport, "artifact_digest_mismatch", "artifact download digest did not match", 502, false, nil)
+	}
+	return data, nil
+}
+
+func (c *artifactClient) request(ctx context.Context, method string, reference harnessv2.ArtifactReference, authorization artifactcap.Authorization, body io.Reader) (*http.Request, error) {
+	objectPath, err := artifactcap.ObjectPath(reference.Digest)
+	if err != nil {
+		return nil, invalidRequest("artifact digest is invalid", err)
+	}
+	endpoint := *c.baseURL
+	endpoint.Path = objectPath
+	request, err := http.NewRequestWithContext(ctx, method, endpoint.String(), body)
+	if err != nil {
+		return nil, apiError(ErrArtifactTransport, "artifact_request_invalid", "artifact request could not be created", 500, false, err)
+	}
+	request.Header.Set(artifactcap.CapabilityHeader, authorization.Capability)
+	request.Header.Set(artifactcap.RequestDigestHeader, authorization.RequestDigest)
+	request.Header.Set(artifactcap.ContentLengthHeader, strconv.FormatInt(reference.SizeBytes, 10))
+	request.Header.Set(artifactcap.MediaTypeHeader, reference.MediaType)
+	if method == http.MethodPut {
+		request.ContentLength = reference.SizeBytes
+		request.Header.Set("Content-Type", reference.MediaType)
+	} else {
+		request.Header.Set("Accept", reference.MediaType)
+	}
+	return request, nil
+}
+
+func validateArtifactTransportReference(reference harnessv2.ArtifactReference) error {
+	if err := reference.Validate(); err != nil {
+		return invalidRequest("artifact reference is invalid", err)
+	}
+	expectedID, err := artifactcap.ArtifactIDForDigest(reference.Digest)
+	if err != nil || !constantEqual(string(reference.ArtifactID), expectedID) || reference.SizeBytes < 0 {
+		return invalidRequest("artifact reference is not exactly content addressed", err)
+	}
+	return nil
+}
+
+func encodeJSON(value any) ([]byte, error) {
+	data, err := json.Marshal(value)
+	if err != nil {
+		return nil, err
+	}
+	return append(data, '\n'), nil
+}
diff --git a/internal/publisher/service/capability.go b/internal/publisher/service/capability.go
new file mode 100644
index 000000000..e84bf903d
--- /dev/null
+++ b/internal/publisher/service/capability.go
@@ -0,0 +1,171 @@
+package service
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"strings"
+	"time"
+
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+const (
+	CapabilityVersion   = "orka.workspace-publisher.capability.v1"
+	CapabilityAudience  = "orka.workspace-publisher"
+	MinSecretBytes      = 32
+	MaxCapabilityTTL    = 5 * time.Minute
+	maxCapabilityBytes  = 16 << 10
+	requestDigestDomain = "orka.workspace-publisher.request.v1"
+)
+
+type CapabilityClaims struct {
+	Version       string            `json:"version"`
+	Audience      string            `json:"audience"`
+	Operation     Operation         `json:"operation"`
+	Method        string            `json:"method"`
+	Path          string            `json:"path"`
+	Metadata      OperationMetadata `json:"metadata"`
+	RequestDigest string            `json:"requestDigest"`
+	IssuedAt      time.Time         `json:"issuedAt"`
+	ExpiresAt     time.Time         `json:"expiresAt"`
+}
+
+func RequestDigest(method, path string, body []byte) (string, error) {
+	canonical, err := harnessv2.CanonicalJSON(body)
+	if err != nil {
+		return "", invalidRequest("request body is not canonicalizable JSON", err)
+	}
+	hash := sha256.New()
+	_, _ = io.WriteString(hash, requestDigestDomain)
+	_, _ = io.WriteString(hash, "\n")
+	_, _ = io.WriteString(hash, method)
+	_, _ = io.WriteString(hash, "\n")
+	_, _ = io.WriteString(hash, path)
+	_, _ = io.WriteString(hash, "\n")
+	_, _ = hash.Write(canonical)
+	return "sha256:" + hex.EncodeToString(hash.Sum(nil)), nil
+}
+
+func SignCapability(secret []byte, claims CapabilityClaims) (string, error) {
+	if len(secret) < MinSecretBytes {
+		return "", fmt.Errorf("capability secret must be at least %d bytes", MinSecretBytes)
+	}
+	if err := validateClaims(claims, claims.IssuedAt); err != nil {
+		return "", err
+	}
+	payload, err := harnessv2.CanonicalValue(claims)
+	if err != nil {
+		return "", fmt.Errorf("canonicalize operation capability: %w", err)
+	}
+	mac := hmac.New(sha256.New, secret)
+	_, _ = mac.Write(payload)
+	encoding := base64.RawURLEncoding
+	return encoding.EncodeToString(payload) + "." + encoding.EncodeToString(mac.Sum(nil)), nil
+}
+
+func VerifyCapability(secret []byte, token string, expected CapabilityClaims, now time.Time) error {
+	if len(secret) < MinSecretBytes || len(token) == 0 || len(token) > maxCapabilityBytes {
+		return ErrUnauthorized
+	}
+	parts := strings.Split(token, ".")
+	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
+		return ErrUnauthorized
+	}
+	encoding := base64.RawURLEncoding
+	payload, err := encoding.DecodeString(parts[0])
+	if err != nil || len(payload) == 0 || len(payload) > maxCapabilityBytes {
+		return ErrUnauthorized
+	}
+	signature, err := encoding.DecodeString(parts[1])
+	if err != nil || len(signature) != sha256.Size {
+		return ErrUnauthorized
+	}
+	mac := hmac.New(sha256.New, secret)
+	_, _ = mac.Write(payload)
+	if !hmac.Equal(signature, mac.Sum(nil)) {
+		return ErrUnauthorized
+	}
+	canonical, err := harnessv2.CanonicalJSON(payload)
+	if err != nil || subtle.ConstantTimeCompare(canonical, payload) != 1 {
+		return ErrUnauthorized
+	}
+	var claims CapabilityClaims
+	decoder := json.NewDecoder(strings.NewReader(string(payload)))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&claims); err != nil {
+		return ErrUnauthorized
+	}
+	if err := decoder.Decode(&struct{}{}); err != io.EOF {
+		return ErrUnauthorized
+	}
+	if err := validateClaims(claims, now); err != nil {
+		return ErrUnauthorized
+	}
+	if !constantEqual(string(claims.Operation), string(expected.Operation)) ||
+		!constantEqual(claims.Method, expected.Method) ||
+		!constantEqual(claims.Path, expected.Path) ||
+		!constantEqual(claims.Metadata.Namespace, expected.Metadata.Namespace) ||
+		!constantEqual(claims.Metadata.OperationID, expected.Metadata.OperationID) ||
+		!constantEqual(claims.Metadata.TaskID, expected.Metadata.TaskID) ||
+		!constantEqual(claims.Metadata.PublicationID, expected.Metadata.PublicationID) ||
+		!constantEqual(claims.RequestDigest, expected.RequestDigest) {
+		return ErrUnauthorized
+	}
+	return nil
+}
+
+func validateClaims(claims CapabilityClaims, now time.Time) error {
+	if claims.Version != CapabilityVersion || claims.Audience != CapabilityAudience || claims.Operation.Path() == "" ||
+		claims.Method != "POST" || claims.Path != claims.Operation.Path() || !isDigest(claims.RequestDigest) {
+		return ErrUnauthorized
+	}
+	if err := claims.Metadata.validateFor(claims.Operation); err != nil {
+		return ErrUnauthorized
+	}
+	if claims.IssuedAt.IsZero() || claims.ExpiresAt.IsZero() || !claims.ExpiresAt.After(claims.IssuedAt) ||
+		claims.ExpiresAt.Sub(claims.IssuedAt) > MaxCapabilityTTL {
+		return ErrUnauthorized
+	}
+	if now.IsZero() {
+		now = time.Now().UTC()
+	}
+	if claims.IssuedAt.After(now.Add(30*time.Second)) || !claims.ExpiresAt.After(now) {
+		return ErrUnauthorized
+	}
+	return nil
+}
+
+func NewClaims(operation Operation, metadata OperationMetadata, requestDigest string, now time.Time, ttl time.Duration) CapabilityClaims {
+	if now.IsZero() {
+		now = time.Now().UTC()
+	}
+	if ttl <= 0 || ttl > MaxCapabilityTTL {
+		ttl = time.Minute
+	}
+	return CapabilityClaims{
+		Version: CapabilityVersion, Audience: CapabilityAudience, Operation: operation,
+		Method: "POST", Path: operation.Path(), Metadata: metadata, RequestDigest: requestDigest,
+		IssuedAt: now.UTC(), ExpiresAt: now.UTC().Add(ttl),
+	}
+}
+
+func constantEqual(left, right string) bool {
+	if len(left) != len(right) {
+		return false
+	}
+	return subtle.ConstantTimeCompare([]byte(left), []byte(right)) == 1
+}
+
+func isDigest(value string) bool {
+	if len(value) != len("sha256:")+sha256.Size*2 || !strings.HasPrefix(value, "sha256:") {
+		return false
+	}
+	_, err := hex.DecodeString(strings.TrimPrefix(value, "sha256:"))
+	return err == nil
+}
diff --git a/internal/publisher/service/capability_test.go b/internal/publisher/service/capability_test.go
new file mode 100644
index 000000000..d934d1ad1
--- /dev/null
+++ b/internal/publisher/service/capability_test.go
@@ -0,0 +1,32 @@
+package service
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestWorkspaceResolveCapabilityClaimsAreValid(t *testing.T) {
+	t.Parallel()
+	now := time.Date(2026, time.July, 25, 12, 0, 0, 0, time.UTC)
+	metadata := OperationMetadata{
+		Namespace:   "orka-acp-e2e-20260725115056-80978",
+		TaskID:      "7bc95937-99a0-4a9c-924c-aa147606066b",
+		OperationID: "workspace-resolve-prompt-7bc95937-99a0-4a9c-924c-aa147606066b-1",
+	}
+	claims := NewClaims(
+		OperationWorkspaceResolve,
+		metadata,
+		"sha256:"+strings.Repeat("0", 64),
+		now,
+		time.Minute,
+	)
+	secret := []byte(strings.Repeat("s", MinSecretBytes))
+	capability, err := SignCapability(secret, claims)
+	if err != nil {
+		t.Fatalf("SignCapability(workspace.resolve): %v", err)
+	}
+	if err := VerifyCapability(secret, capability, claims, now.Add(time.Second)); err != nil {
+		t.Fatalf("VerifyCapability(workspace.resolve): %v", err)
+	}
+}
diff --git a/internal/publisher/service/client.go b/internal/publisher/service/client.go
new file mode 100644
index 000000000..a0f4884ab
--- /dev/null
+++ b/internal/publisher/service/client.go
@@ -0,0 +1,239 @@
+package service
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+)
+
+type ClientConfig struct {
+	BaseURL          string
+	HTTPClient       *http.Client
+	BearerToken      []byte
+	CapabilitySecret []byte
+	CapabilityTTL    time.Duration
+	MaxResponseBytes int64
+	Now              func() time.Time
+}
+
+type Client struct {
+	baseURL          *url.URL
+	httpClient       *http.Client
+	bearerToken      []byte
+	capabilitySecret []byte
+	capabilityTTL    time.Duration
+	maxResponseBytes int64
+	now              func() time.Time
+}
+
+type ClientError struct {
+	StatusCode int
+	Response   ErrorResponse
+}
+
+func (e *ClientError) Error() string {
+	if e == nil {
+		return "<nil>"
+	}
+	return fmt.Sprintf("workspace publisher request failed with status %d and code %q", e.StatusCode, e.Response.Code)
+}
+
+func NewClient(config ClientConfig) (*Client, error) {
+	parsed, err := url.Parse(config.BaseURL)
+	if err != nil || parsed.Scheme == "" || parsed.Host == "" || parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" || parsed.Opaque != "" {
+		return nil, fmt.Errorf("publisher base URL must be an absolute credential-free HTTP(S) URL")
+	}
+	if parsed.Scheme != "http" && parsed.Scheme != "https" || parsed.Path != "" && parsed.Path != "/" {
+		return nil, fmt.Errorf("publisher base URL must contain only scheme and authority")
+	}
+	parsed.Path = ""
+	if len(config.BearerToken) < 16 || len(config.CapabilitySecret) < MinSecretBytes {
+		return nil, fmt.Errorf("publisher client authentication is invalid")
+	}
+	if config.CapabilityTTL == 0 {
+		config.CapabilityTTL = time.Minute
+	}
+	if config.CapabilityTTL <= 0 || config.CapabilityTTL > MaxCapabilityTTL {
+		return nil, fmt.Errorf("publisher capability TTL is invalid")
+	}
+	if config.MaxResponseBytes == 0 {
+		config.MaxResponseBytes = defaultMaxResponseBytes
+	}
+	if config.MaxResponseBytes < 1 {
+		return nil, fmt.Errorf("publisher response limit is invalid")
+	}
+	if config.Now == nil {
+		config.Now = func() time.Time { return time.Now().UTC() }
+	}
+	client := config.HTTPClient
+	if client == nil {
+		// No client-level timeout: operation deadlines come from the caller's
+		// request context so configured operation timeouts (for example
+		// ORKA_PUBLISHER_PUBLISH_TIMEOUT above the former three-minute client
+		// ceiling) are honored. Requests without a caller deadline fall back to
+		// defaultRequestTimeout in requestContext.
+		client = &http.Client{}
+	} else {
+		clone := *client
+		client = &clone
+	}
+	client.CheckRedirect = func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }
+	return &Client{
+		baseURL: parsed, httpClient: client, bearerToken: append([]byte(nil), config.BearerToken...),
+		capabilitySecret: append([]byte(nil), config.CapabilitySecret...), capabilityTTL: config.CapabilityTTL,
+		maxResponseBytes: config.MaxResponseBytes, now: config.Now,
+	}, nil
+}
+
+func (c *Client) Health(ctx context.Context) (HealthResponse, error) {
+	var response HealthResponse
+	err := c.get(ctx, HealthPath, &response)
+	return response, err
+}
+
+func (c *Client) Capabilities(ctx context.Context) (CapabilitiesResponse, error) {
+	var response CapabilitiesResponse
+	err := c.get(ctx, CapabilitiesPath, &response)
+	return response, err
+}
+
+func (c *Client) ResolveWorkspace(ctx context.Context, request WorkspaceResolveRequest) (WorkspaceResolveResponse, error) {
+	var response WorkspaceResolveResponse
+	err := c.post(ctx, OperationWorkspaceResolve, request.Metadata, request, &response)
+	return response, err
+}
+
+func (c *Client) PrepareWorkspace(ctx context.Context, request WorkspacePrepareRequest) (WorkspacePrepareResponse, error) {
+	var response WorkspacePrepareResponse
+	err := c.post(ctx, OperationWorkspacePrepare, request.Metadata, request, &response)
+	return response, err
+}
+
+func (c *Client) PreflightPublication(ctx context.Context, request PublicationPreflightRequest) (PublicationPreflightResponse, error) {
+	var response PublicationPreflightResponse
+	err := c.post(ctx, OperationPublicationPreflight, request.Metadata, request, &response)
+	return response, err
+}
+
+func (c *Client) PreparePublication(ctx context.Context, request PublicationPrepareRequest) (PublicationPrepareResponse, error) {
+	var response PublicationPrepareResponse
+	err := c.post(ctx, OperationPublicationPrepare, request.Metadata, request, &response)
+	return response, err
+}
+
+func (c *Client) Publish(ctx context.Context, request PublicationPublishRequest) (PublicationPublishResponse, error) {
+	var response PublicationPublishResponse
+	err := c.post(ctx, OperationPublicationPublish, request.Metadata, request, &response)
+	return response, err
+}
+
+func (c *Client) Verify(ctx context.Context, request PublicationVerifyRequest) (PublicationVerifyResponse, error) {
+	var response PublicationVerifyResponse
+	err := c.post(ctx, OperationPublicationVerify, request.Metadata, request, &response)
+	return response, err
+}
+
+func (c *Client) ReclaimPublication(ctx context.Context, request PublicationReclaimRequest) (PublicationReclaimResponse, error) {
+	var response PublicationReclaimResponse
+	err := c.post(ctx, OperationPublicationReclaim, request.Metadata, request, &response)
+	return response, err
+}
+
+func (c *Client) ReconcilePullRequest(ctx context.Context, request PullRequestReconcileRequest) (PullRequestReconcileResponse, error) {
+	var response PullRequestReconcileResponse
+	err := c.post(ctx, OperationPullRequestReconcile, request.Metadata, request, &response)
+	return response, err
+}
+
+// defaultRequestTimeout bounds publisher requests whose caller context carries
+// no deadline. Callers with explicit deadlines (for example settlement contexts
+// sized to the publisher's configured operation timeouts) are never clamped.
+const defaultRequestTimeout = 3 * time.Minute
+
+func requestContext(ctx context.Context) (context.Context, context.CancelFunc) {
+	if _, ok := ctx.Deadline(); ok {
+		return ctx, func() {}
+	}
+	return context.WithTimeout(ctx, defaultRequestTimeout)
+}
+
+func (c *Client) get(ctx context.Context, path string, target any) error {
+	ctx, cancel := requestContext(ctx)
+	defer cancel()
+	endpoint := *c.baseURL
+	endpoint.Path = path
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint.String(), nil)
+	if err != nil {
+		return fmt.Errorf("create workspace publisher request")
+	}
+	request.Header.Set("Accept", "application/json")
+	return c.do(request, target)
+}
+
+func (c *Client) post(ctx context.Context, operation Operation, metadata OperationMetadata, value, target any) error {
+	ctx, cancel := requestContext(ctx)
+	defer cancel()
+	body, err := json.Marshal(value)
+	if err != nil {
+		return fmt.Errorf("encode workspace publisher request")
+	}
+	body, err = canonicalRequestBody(body)
+	if err != nil {
+		return err
+	}
+	requestDigest, err := RequestDigest(http.MethodPost, operation.Path(), body)
+	if err != nil {
+		return err
+	}
+	claims := NewClaims(operation, metadata, requestDigest, c.now(), c.capabilityTTL)
+	capability, err := SignCapability(c.capabilitySecret, claims)
+	if err != nil {
+		return fmt.Errorf("authorize workspace publisher request")
+	}
+	endpoint := *c.baseURL
+	endpoint.Path = operation.Path()
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint.String(), bytes.NewReader(body))
+	if err != nil {
+		return fmt.Errorf("create workspace publisher request")
+	}
+	request.Header.Set("Authorization", "Bearer "+string(c.bearerToken))
+	request.Header.Set(OperationCapabilityHeader, capability)
+	request.Header.Set(OperationRequestDigestHeader, requestDigest)
+	request.Header.Set("Content-Type", "application/json")
+	request.Header.Set("Accept", "application/json")
+	request.ContentLength = int64(len(body))
+	return c.do(request, target)
+}
+
+func (c *Client) do(request *http.Request, target any) error {
+	response, err := c.httpClient.Do(request)
+	if err != nil {
+		return fmt.Errorf("workspace publisher transport failed")
+	}
+	defer response.Body.Close() //nolint:errcheck
+	if response.StatusCode >= 300 && response.StatusCode < 400 && strings.TrimSpace(response.Header.Get("Location")) != "" {
+		_, _ = io.Copy(io.Discard, io.LimitReader(response.Body, c.maxResponseBytes))
+		return fmt.Errorf("workspace publisher redirects are forbidden")
+	}
+	data, err := io.ReadAll(io.LimitReader(response.Body, c.maxResponseBytes+1))
+	if err != nil || int64(len(data)) > c.maxResponseBytes {
+		return fmt.Errorf("workspace publisher response is invalid")
+	}
+	if response.StatusCode < 200 || response.StatusCode >= 300 {
+		var envelope ErrorResponse
+		if decodeErr := decodeStrict(data, &envelope); decodeErr != nil || envelope.Code == "" || envelope.Message == "" {
+			return &ClientError{StatusCode: response.StatusCode, Response: ErrorResponse{Code: "invalid_error_response", Message: "publisher returned an invalid error", Retryable: response.StatusCode >= 500}}
+		}
+		return &ClientError{StatusCode: response.StatusCode, Response: envelope}
+	}
+	if err := decodeStrict(data, target); err != nil {
+		return fmt.Errorf("workspace publisher response is invalid")
+	}
+	return nil
+}
diff --git a/internal/publisher/service/client_timeout_test.go b/internal/publisher/service/client_timeout_test.go
new file mode 100644
index 000000000..79a9fab37
--- /dev/null
+++ b/internal/publisher/service/client_timeout_test.go
@@ -0,0 +1,47 @@
+package service
+
+import (
+	"bytes"
+	"context"
+	"testing"
+	"time"
+)
+
+func TestNewClientDefaultHasNoClientLevelTimeout(t *testing.T) {
+	client, err := NewClient(ClientConfig{
+		BaseURL:          "https://publisher.example.test",
+		BearerToken:      bytes.Repeat([]byte("t"), 32),
+		CapabilitySecret: bytes.Repeat([]byte("s"), MinSecretBytes),
+	})
+	if err != nil {
+		t.Fatalf("NewClient: %v", err)
+	}
+	if client.httpClient.Timeout != 0 {
+		t.Fatalf("default client timeout = %s, want 0 so caller deadlines govern operation timeouts", client.httpClient.Timeout)
+	}
+}
+
+func TestRequestContextHonorsCallerDeadline(t *testing.T) {
+	want := time.Now().Add(10 * time.Minute)
+	parent, cancelParent := context.WithDeadline(context.Background(), want)
+	defer cancelParent()
+	ctx, cancel := requestContext(parent)
+	defer cancel()
+	got, ok := ctx.Deadline()
+	if !ok || !got.Equal(want) {
+		t.Fatalf("deadline = %v (ok=%t), want caller deadline %v preserved beyond the former client ceiling", got, ok, want)
+	}
+}
+
+func TestRequestContextAppliesDefaultDeadlineWhenAbsent(t *testing.T) {
+	ctx, cancel := requestContext(context.Background())
+	defer cancel()
+	deadline, ok := ctx.Deadline()
+	if !ok {
+		t.Fatal("expected a fallback deadline for contexts without one")
+	}
+	remaining := time.Until(deadline)
+	if remaining <= 0 || remaining > defaultRequestTimeout+time.Second {
+		t.Fatalf("fallback deadline in %s, want about %s", remaining, defaultRequestTimeout)
+	}
+}
diff --git a/internal/publisher/service/config.go b/internal/publisher/service/config.go
new file mode 100644
index 000000000..3c6826904
--- /dev/null
+++ b/internal/publisher/service/config.go
@@ -0,0 +1,219 @@
+package service
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/orka-agents/orka/internal/publisher"
+)
+
+const (
+	defaultListenAddress           = ":8080"
+	defaultMaxConcurrentOperations = 4
+	defaultMaxRequestBytes         = int64(2 << 20)
+	defaultMaxResponseBytes        = int64(2 << 20)
+	defaultMaxJournalBytes         = int64(1 << 30)
+	defaultMaxDeltaBytes           = int64(256 << 20)
+	defaultMaxBundleBytes          = int64(512 << 20)
+	defaultMaxCommandOutput        = int64(1 << 20)
+	defaultArtifactTimeout         = 2 * time.Minute
+	defaultPublishTimeout          = 2 * time.Minute
+	defaultCapabilityTTL           = time.Minute
+)
+
+//nolint:gocyclo // Startup validation keeps every independent bound explicit.
+func normalizeConfig(config Config) (Config, error) {
+	if config.ListenAddress == "" {
+		config.ListenAddress = defaultListenAddress
+	}
+	if len(config.ControllerBearerToken) < 16 {
+		return Config{}, fmt.Errorf("controller bearer token must be at least 16 bytes")
+	}
+	if len(config.OperationCapabilitySecret) < MinSecretBytes {
+		return Config{}, fmt.Errorf("operation capability secret must be at least %d bytes", MinSecretBytes)
+	}
+	hasArtifactSecret := len(config.ArtifactCapabilitySecret) >= MinSecretBytes
+	hasArtifactBroker := strings.TrimSpace(config.ArtifactAuthorizationBrokerURL) != ""
+	if hasArtifactSecret == hasArtifactBroker {
+		return Config{}, fmt.Errorf("exactly one artifact authorization mode must be configured")
+	}
+	for name, value := range map[string]string{
+		"artifact root": config.ArtifactRoot, "journal root": config.JournalRoot,
+		"temporary root": config.TempRoot,
+	} {
+		if !filepath.IsAbs(value) || filepath.Clean(value) != value {
+			return Config{}, fmt.Errorf("%s must be an absolute clean path", name)
+		}
+	}
+	if config.CredentialRoot != "" && (!filepath.IsAbs(config.CredentialRoot) || filepath.Clean(config.CredentialRoot) != config.CredentialRoot) {
+		return Config{}, fmt.Errorf("credential root must be an absolute clean path")
+	}
+	hasCredentialRoot := strings.TrimSpace(config.CredentialRoot) != ""
+	hasCredentialBroker := strings.TrimSpace(config.CredentialBrokerURL) != ""
+	if hasCredentialRoot && hasCredentialBroker {
+		return Config{}, fmt.Errorf("credential root and broker are mutually exclusive")
+	}
+	if config.DefaultGitCredential != nil {
+		if err := validateCredentialReference(config.DefaultGitCredential, CredentialHTTPExtraHeader); err != nil {
+			return Config{}, err
+		}
+		if !hasCredentialRoot && !hasCredentialBroker {
+			return Config{}, fmt.Errorf("default credential requires a credential delivery mode")
+		}
+	}
+	allowed, err := normalizeAllowedHosts(config.AllowedSCMHosts)
+	if err != nil {
+		return Config{}, err
+	}
+	config.AllowedSCMHosts = allowed
+	proxyEnvironment, err := publisher.NormalizeProxyEnvironment(
+		config.ProxyEnvironment.HTTPSProxy,
+		config.ProxyEnvironment.NoProxy,
+	)
+	if err != nil {
+		return Config{}, err
+	}
+	config.ProxyEnvironment = proxyEnvironment
+	if config.MaxConcurrentOperations == 0 {
+		config.MaxConcurrentOperations = defaultMaxConcurrentOperations
+	}
+	if config.MaxRequestBytes == 0 {
+		config.MaxRequestBytes = defaultMaxRequestBytes
+	}
+	if config.MaxResponseBytes == 0 {
+		config.MaxResponseBytes = defaultMaxResponseBytes
+	}
+	if config.MaxJournalBytes == 0 {
+		config.MaxJournalBytes = defaultMaxJournalBytes
+	}
+	if config.MaxDeltaBytes == 0 {
+		config.MaxDeltaBytes = defaultMaxDeltaBytes
+	}
+	if config.MaxBundleBytes == 0 {
+		config.MaxBundleBytes = defaultMaxBundleBytes
+	}
+	if config.MaxCommandOutput == 0 {
+		config.MaxCommandOutput = defaultMaxCommandOutput
+	}
+	if config.PublishTimeout == 0 {
+		config.PublishTimeout = defaultPublishTimeout
+	}
+	if config.ArtifactTimeout == 0 {
+		config.ArtifactTimeout = defaultArtifactTimeout
+	}
+	if config.CapabilityTTL == 0 {
+		config.CapabilityTTL = defaultCapabilityTTL
+	}
+	if config.VerifyAttempts == 0 {
+		config.VerifyAttempts = 3
+	}
+	if config.VerifyBackoff == 0 {
+		config.VerifyBackoff = 100 * time.Millisecond
+	}
+	if config.WorkspaceLimits == (WorkspaceLimits{}) {
+		config.WorkspaceLimits = defaultWorkspaceLimits()
+	}
+	if err := config.WorkspaceLimits.normalize(defaultWorkspaceLimits()); err != nil {
+		return Config{}, err
+	}
+	if config.MaxConcurrentOperations < 1 || config.MaxConcurrentOperations > 64 || config.MaxRequestBytes < 1 ||
+		config.MaxResponseBytes < 1 || config.MaxJournalBytes < 1 || config.MaxDeltaBytes < 1 || config.MaxBundleBytes < 1 ||
+		config.MaxCommandOutput < 1 || config.PublishTimeout <= 0 || config.ArtifactTimeout <= 0 ||
+		config.CapabilityTTL <= 0 || config.CapabilityTTL > MaxCapabilityTTL || config.VerifyAttempts < 1 || config.VerifyAttempts > 20 ||
+		config.VerifyBackoff < 0 {
+		return Config{}, fmt.Errorf("service limits are invalid")
+	}
+	if config.Now == nil {
+		config.Now = func() time.Time { return time.Now().UTC() }
+	}
+	return config, nil
+}
+
+func (limits *WorkspaceLimits) normalize(defaults WorkspaceLimits) error {
+	if limits.MaxEntries == 0 {
+		limits.MaxEntries = defaults.MaxEntries
+	}
+	if limits.MaxFileBytes == 0 {
+		limits.MaxFileBytes = defaults.MaxFileBytes
+	}
+	if limits.MaxExpandedBytes == 0 {
+		limits.MaxExpandedBytes = defaults.MaxExpandedBytes
+	}
+	if limits.MaxArtifactBytes == 0 {
+		limits.MaxArtifactBytes = defaults.MaxArtifactBytes
+	}
+	if limits.MaxPathBytes == 0 {
+		limits.MaxPathBytes = defaults.MaxPathBytes
+	}
+	if limits.MaxEntries < 1 || limits.MaxFileBytes < 1 || limits.MaxExpandedBytes < 1 ||
+		limits.MaxArtifactBytes < 1 || limits.MaxPathBytes < 1 || limits.MaxFileBytes > limits.MaxExpandedBytes {
+		return fmt.Errorf("workspace limits are invalid")
+	}
+	return nil
+}
+
+func mergeWorkspaceLimits(request, defaults WorkspaceLimits) (WorkspaceLimits, error) {
+	result := request
+	if result.MaxEntries == 0 {
+		result.MaxEntries = defaults.MaxEntries
+	}
+	if result.MaxFileBytes == 0 {
+		result.MaxFileBytes = defaults.MaxFileBytes
+	}
+	if result.MaxExpandedBytes == 0 {
+		result.MaxExpandedBytes = defaults.MaxExpandedBytes
+	}
+	if result.MaxArtifactBytes == 0 {
+		result.MaxArtifactBytes = defaults.MaxArtifactBytes
+	}
+	if result.MaxPathBytes == 0 {
+		result.MaxPathBytes = defaults.MaxPathBytes
+	}
+	if err := result.normalize(defaults); err != nil {
+		return WorkspaceLimits{}, err
+	}
+	if result.MaxEntries > defaults.MaxEntries || result.MaxFileBytes > defaults.MaxFileBytes ||
+		result.MaxExpandedBytes > defaults.MaxExpandedBytes || result.MaxArtifactBytes > defaults.MaxArtifactBytes ||
+		result.MaxPathBytes > defaults.MaxPathBytes {
+		return WorkspaceLimits{}, invalidRequest("workspace request exceeds service limits", nil)
+	}
+	return result, nil
+}
+
+func readSecretFile(path string, minBytes int) ([]byte, error) {
+	if !filepath.IsAbs(path) || filepath.Clean(path) != path {
+		return nil, fmt.Errorf("secret path must be absolute and clean")
+	}
+	info, err := os.Lstat(path)
+	if err != nil || info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() || info.Size() > 64<<10 {
+		return nil, fmt.Errorf("secret file is missing or unsafe")
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("read secret file: %w", err)
+	}
+	data = bytes.TrimSuffix(data, []byte("\r\n"))
+	data = bytes.TrimSuffix(data, []byte("\n"))
+	if len(data) < minBytes || bytes.ContainsAny(data, "\r\n\x00") {
+		return nil, fmt.Errorf("secret file contents are invalid")
+	}
+	return data, nil
+}
+
+func splitCSV(value string) []string {
+	if strings.TrimSpace(value) == "" {
+		return nil
+	}
+	parts := strings.Split(value, ",")
+	result := make([]string, 0, len(parts))
+	for _, part := range parts {
+		if trimmed := strings.TrimSpace(part); trimmed != "" {
+			result = append(result, trimmed)
+		}
+	}
+	return result
+}
diff --git a/internal/publisher/service/credential.go b/internal/publisher/service/credential.go
new file mode 100644
index 000000000..0da2ab274
--- /dev/null
+++ b/internal/publisher/service/credential.go
@@ -0,0 +1,174 @@
+package service
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/orka-agents/orka/internal/publisher"
+)
+
+type credentialManager struct {
+	provider   credentialProvider
+	tempRoot   string
+	realGit    string
+	defaultGit *CredentialReference
+}
+
+type operationCredential struct {
+	gitBinary string
+	filePath  string
+	cleanup   func()
+}
+
+func (m *credentialManager) gitCredential(ctx context.Context, parent Operation, metadata OperationMetadata, repository publisher.Repository, reference *CredentialReference) (operationCredential, error) {
+	if err := ctx.Err(); err != nil {
+		return operationCredential{}, err
+	}
+	if reference == nil {
+		reference = m.defaultGit
+	}
+	if reference == nil {
+		return operationCredential{gitBinary: m.realGit, cleanup: func() {}}, nil
+	}
+	if err := validateCredentialReference(reference, CredentialHTTPExtraHeader); err != nil {
+		return operationCredential{}, err
+	}
+	parsed, err := url.Parse(repository.URL)
+	if err != nil || parsed.Scheme != "https" {
+		return operationCredential{}, apiError(ErrCredential, "invalid_credential_ref", "Git credentials require an HTTPS repository", 400, false, nil)
+	}
+	if m.provider == nil {
+		return operationCredential{}, apiError(ErrCredential, "credential_unavailable", "credential provider is not configured", 503, false, nil)
+	}
+	header, _, err := m.provider.Read(ctx, CredentialMaterialRequest{ParentOperation: parent, Metadata: metadata, Reference: *reference})
+	if err != nil {
+		return operationCredential{}, err
+	}
+	if !strings.HasPrefix(strings.ToLower(string(header)), "authorization:") {
+		return operationCredential{}, apiError(ErrCredential, "invalid_credential_ref", "Git credential file must contain one Authorization header", 400, false, nil)
+	}
+	directory, err := os.MkdirTemp(m.tempRoot, "orka-publisher-credential-")
+	if err != nil {
+		return operationCredential{}, apiError(ErrCredential, "credential_unavailable", "operation credential could not be materialized", 503, true, err)
+	}
+	cleanup := func() { _ = os.RemoveAll(directory) }
+	if err := os.Chmod(directory, 0o700); err != nil {
+		cleanup()
+		return operationCredential{}, err
+	}
+	configPath := filepath.Join(directory, "gitconfig")
+	config := "[http]\n\tfollowRedirects = false\n\tsslVerify = true\n[http \"" + escapeGitConfig(repository.URL) + "\"]\n\textraHeader = \"" + escapeGitConfig(string(header)) + "\"\n"
+	if err := writeDurable(configPath, []byte(config), 0o600); err != nil {
+		cleanup()
+		return operationCredential{}, apiError(ErrCredential, "credential_unavailable", "operation credential could not be materialized", 503, true, err)
+	}
+	wrapperPath := filepath.Join(directory, "git")
+	script := "#!/bin/sh\nset -eu\nexport GIT_CONFIG_GLOBAL=" + shellQuote(configPath) + "\nexport GIT_CONFIG_NOSYSTEM=1\nexec " + shellQuote(m.realGit) + " \"$@\"\n"
+	if err := os.WriteFile(wrapperPath, []byte(script), 0o700); err != nil {
+		cleanup()
+		return operationCredential{}, apiError(ErrCredential, "credential_unavailable", "operation credential could not be materialized", 503, true, err)
+	}
+	return operationCredential{gitBinary: wrapperPath, cleanup: cleanup}, nil
+}
+
+func (m *credentialManager) forgeCredential(ctx context.Context, parent Operation, metadata OperationMetadata, reference *CredentialReference) (operationCredential, error) {
+	if err := ctx.Err(); err != nil {
+		return operationCredential{}, err
+	}
+	if reference == nil {
+		return operationCredential{cleanup: func() {}}, nil
+	}
+	if err := validateCredentialReference(reference, CredentialForgeToken); err != nil {
+		return operationCredential{}, err
+	}
+	if m.provider == nil {
+		return operationCredential{}, apiError(ErrCredential, "credential_unavailable", "credential provider is not configured", 503, false, nil)
+	}
+	value, _, err := m.provider.Read(ctx, CredentialMaterialRequest{ParentOperation: parent, Metadata: metadata, Reference: *reference})
+	if err != nil {
+		return operationCredential{}, err
+	}
+	trimmed := strings.TrimSpace(string(value))
+	if strings.HasPrefix(strings.ToLower(trimmed), "authorization:") {
+		parts := strings.Fields(strings.TrimSpace(trimmed[len("Authorization:"):]))
+		if len(parts) != 2 || !strings.EqualFold(parts[0], "bearer") || strings.TrimSpace(parts[1]) == "" {
+			return operationCredential{}, apiError(ErrCredential, "invalid_credential_ref", "forge credential Authorization header must use one Bearer token", 400, false, nil)
+		}
+		value = []byte(parts[1])
+	}
+	directory, err := os.MkdirTemp(m.tempRoot, "orka-publisher-forge-credential-")
+	if err != nil {
+		return operationCredential{}, apiError(ErrCredential, "credential_unavailable", "operation credential could not be materialized", 503, true, err)
+	}
+	cleanup := func() { _ = os.RemoveAll(directory) }
+	if err := os.Chmod(directory, 0o700); err != nil {
+		cleanup()
+		return operationCredential{}, err
+	}
+	path := filepath.Join(directory, "credential")
+	if err := writeDurable(path, value, 0o600); err != nil {
+		cleanup()
+		return operationCredential{}, apiError(ErrCredential, "credential_unavailable", "operation credential could not be materialized", 503, true, err)
+	}
+	return operationCredential{filePath: path, cleanup: cleanup}, nil
+}
+
+func readCredentialFile(root, name string, limit int64) ([]byte, error) {
+	if root == "" {
+		return nil, apiError(ErrCredential, "credential_unavailable", "credential storage is not configured", 503, false, nil)
+	}
+	if !credentialNamePattern.MatchString(name) {
+		return nil, apiError(ErrCredential, "invalid_credential_ref", "credential reference name is invalid", 400, false, nil)
+	}
+	path := filepath.Join(root, name)
+	if filepath.Dir(path) != root {
+		return nil, apiError(ErrCredential, "invalid_credential_ref", "credential reference escapes the configured root", 400, false, nil)
+	}
+	info, err := os.Lstat(path)
+	if err != nil || info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() || info.Size() < 1 || info.Size() > limit || info.Mode().Perm()&0o077 != 0 {
+		return nil, apiError(ErrCredential, "credential_unavailable", "credential file is missing or unsafe", 503, false, err)
+	}
+	value, err := os.ReadFile(path)
+	if err != nil {
+		return nil, apiError(ErrCredential, "credential_unavailable", "credential file could not be read", 503, true, err)
+	}
+	value = bytes.TrimSuffix(value, []byte("\r\n"))
+	value = bytes.TrimSuffix(value, []byte("\n"))
+	if len(value) == 0 || bytes.ContainsAny(value, "\r\n\x00") {
+		return nil, apiError(ErrCredential, "invalid_credential_ref", "credential file must contain one non-empty line", 400, false, nil)
+	}
+	return value, nil
+}
+
+func escapeGitConfig(value string) string {
+	replacer := strings.NewReplacer("\\", "\\\\", "\"", "\\\"")
+	return replacer.Replace(value)
+}
+
+func shellQuote(value string) string {
+	return "'" + strings.ReplaceAll(value, "'", "'\"'\"'") + "'"
+}
+
+func ensureGitBinary(path string) (string, error) {
+	if path == "" {
+		for _, candidate := range []string{"/usr/local/bin/git", "/opt/homebrew/bin/git", "/usr/bin/git", "/bin/git"} {
+			if info, err := os.Stat(candidate); err == nil && info.Mode().IsRegular() && info.Mode()&0o111 != 0 {
+				return candidate, nil
+			}
+		}
+		return "", fmt.Errorf("no reviewed Git binary was found")
+	}
+	if !filepath.IsAbs(path) || filepath.Clean(path) != path {
+		return "", fmt.Errorf("git binary path must be absolute and clean")
+	}
+	info, err := os.Stat(path)
+	if err != nil || !info.Mode().IsRegular() || info.Mode()&0o111 == 0 {
+		return "", fmt.Errorf("git binary is not an executable regular file")
+	}
+	return path, nil
+}
diff --git a/internal/publisher/service/credential_broker.go b/internal/publisher/service/credential_broker.go
new file mode 100644
index 000000000..99e8cdb5d
--- /dev/null
+++ b/internal/publisher/service/credential_broker.go
@@ -0,0 +1,151 @@
+package service
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+)
+
+const (
+	CredentialBrokerPath             = "/internal/v2/acp/publisher-credentials"
+	maxCredentialBrokerResponseBytes = int64(64 << 10)
+)
+
+// CredentialMaterialRequest binds one credential read to an authenticated
+// Publisher operation and a non-secret Kubernetes Secret reference.
+type CredentialMaterialRequest struct {
+	ParentOperation Operation           `json:"parentOperation"`
+	Metadata        OperationMetadata   `json:"metadata"`
+	Reference       CredentialReference `json:"reference"`
+}
+
+func (r CredentialMaterialRequest) Validate() error {
+	if r.ParentOperation.Path() == "" {
+		return fmt.Errorf("credential parent operation is invalid")
+	}
+	if err := r.Metadata.validateFor(r.ParentOperation); err != nil {
+		return err
+	}
+	expected := CredentialHTTPExtraHeader
+	if r.ParentOperation == OperationPullRequestReconcile {
+		expected = CredentialForgeToken
+	}
+	if err := validateCredentialReference(&r.Reference, expected); err != nil {
+		return err
+	}
+	if r.Reference.Role == "" {
+		return nil
+	}
+	allowed := false
+	switch r.ParentOperation {
+	case OperationWorkspaceResolve, OperationWorkspacePrepare:
+		allowed = r.Reference.Role == CredentialRoleSourceRead || r.Reference.Role == CredentialRoleTargetRead
+	case OperationPublicationPrepare:
+		allowed = r.Reference.Role == CredentialRoleSourceRead || r.Reference.Role == CredentialRoleTargetRead
+	case OperationPublicationPreflight, OperationPublicationVerify:
+		allowed = r.Reference.Role == CredentialRoleTargetRead
+	case OperationPublicationPublish:
+		allowed = r.Reference.Role == CredentialRoleTargetWrite
+	case OperationPullRequestReconcile:
+		allowed = r.Reference.Role == CredentialRoleForge
+	}
+	if !allowed {
+		return apiError(ErrCredential, "invalid_credential_ref", "credential reference role is invalid for the parent operation", 400, false, nil)
+	}
+	return nil
+}
+
+// CredentialMaterialResponse is never logged or persisted by the Publisher.
+// ResourceVersion is non-secret audit metadata for the frozen source Secret.
+type CredentialMaterialResponse struct {
+	Material        string `json:"material"`
+	ResourceVersion string `json:"resourceVersion"`
+}
+
+type credentialProvider interface {
+	Read(context.Context, CredentialMaterialRequest) ([]byte, string, error)
+}
+
+type fileCredentialProvider struct{ root string }
+
+func (p *fileCredentialProvider) Read(_ context.Context, request CredentialMaterialRequest) ([]byte, string, error) {
+	if err := request.Validate(); err != nil {
+		return nil, "", err
+	}
+	value, err := readCredentialFile(p.root, request.Reference.Name, 32<<10)
+	return value, "local-file", err
+}
+
+type brokerCredentialProvider struct {
+	endpoint *url.URL
+	client   *http.Client
+	bearer   string
+}
+
+func newBrokerCredentialProvider(rawURL string, client *http.Client, bearer []byte, timeout time.Duration) (*brokerCredentialProvider, error) {
+	parsed, err := url.Parse(strings.TrimSpace(rawURL))
+	if err != nil || parsed.Scheme == "" || parsed.Host == "" || parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" || parsed.Opaque != "" {
+		return nil, fmt.Errorf("credential broker URL must be an absolute credential-free HTTP(S) URL")
+	}
+	if (parsed.Scheme != schemeHTTP && parsed.Scheme != schemeHTTPS) || (parsed.Path != "" && parsed.Path != "/") {
+		return nil, fmt.Errorf("credential broker URL must contain only scheme and authority")
+	}
+	if len(bytes.TrimSpace(bearer)) < 16 {
+		return nil, fmt.Errorf("credential broker bearer token is invalid")
+	}
+	parsed.Path = CredentialBrokerPath
+	parsed.RawPath = ""
+	if client == nil {
+		client = &http.Client{Timeout: timeout}
+	} else {
+		clone := *client
+		client = &clone
+		if client.Timeout == 0 {
+			client.Timeout = timeout
+		}
+	}
+	client.CheckRedirect = func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }
+	return &brokerCredentialProvider{endpoint: parsed, client: client, bearer: string(bytes.TrimSpace(bearer))}, nil
+}
+
+func (p *brokerCredentialProvider) Read(ctx context.Context, request CredentialMaterialRequest) ([]byte, string, error) {
+	if err := request.Validate(); err != nil {
+		return nil, "", err
+	}
+	body, err := json.Marshal(request)
+	if err != nil {
+		return nil, "", err
+	}
+	httpRequest, err := http.NewRequestWithContext(ctx, http.MethodPost, p.endpoint.String(), bytes.NewReader(body))
+	if err != nil {
+		return nil, "", err
+	}
+	httpRequest.Header.Set("Authorization", "Bearer "+p.bearer)
+	httpRequest.Header.Set("Content-Type", "application/json")
+	httpRequest.Header.Set("Accept", "application/json")
+	response, err := p.client.Do(httpRequest)
+	if err != nil {
+		return nil, "", apiError(ErrCredential, "credential_broker_transport_failed", "operation credential broker transport failed", 503, true, err)
+	}
+	defer response.Body.Close() //nolint:errcheck
+	data, readErr := io.ReadAll(io.LimitReader(response.Body, maxCredentialBrokerResponseBytes+1))
+	if readErr != nil || int64(len(data)) > maxCredentialBrokerResponseBytes || response.StatusCode != http.StatusOK {
+		retryable := response.StatusCode >= 500 || response.StatusCode == http.StatusTooManyRequests
+		return nil, "", apiError(ErrCredential, "credential_broker_rejected", "operation credential broker rejected the request", response.StatusCode, retryable, readErr)
+	}
+	var decoded CredentialMaterialResponse
+	if err := decodeStrict(data, &decoded); err != nil || decoded.Material == "" || decoded.ResourceVersion == "" {
+		return nil, "", apiError(ErrCredential, "credential_broker_response_invalid", "operation credential broker returned an invalid response", 502, false, err)
+	}
+	value := []byte(decoded.Material)
+	if len(value) > 32<<10 || bytes.ContainsAny(value, "\r\n\x00") {
+		return nil, "", apiError(ErrCredential, "credential_broker_response_invalid", "operation credential broker returned invalid material", 502, false, nil)
+	}
+	return value, decoded.ResourceVersion, nil
+}
diff --git a/internal/publisher/service/credential_broker_test.go b/internal/publisher/service/credential_broker_test.go
new file mode 100644
index 000000000..f75598fb1
--- /dev/null
+++ b/internal/publisher/service/credential_broker_test.go
@@ -0,0 +1,66 @@
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestBrokerCredentialProviderUsesExactOperationBinding(t *testing.T) {
+	bearer := strings.Repeat("b", 32)
+	request := CredentialMaterialRequest{
+		ParentOperation: OperationWorkspacePrepare,
+		Metadata:        OperationMetadata{Namespace: "default", TaskID: "task", OperationID: "workspace-prepare-prompt"},
+		Reference:       CredentialReference{Name: "git-token", Kind: CredentialHTTPExtraHeader},
+	}
+	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, httpRequest *http.Request) {
+		if httpRequest.URL.Path != CredentialBrokerPath || httpRequest.Header.Get("Authorization") != "Bearer "+bearer {
+			t.Errorf("request path/auth = %q %q", httpRequest.URL.Path, httpRequest.Header.Get("Authorization"))
+		}
+		var got CredentialMaterialRequest
+		if err := json.NewDecoder(httpRequest.Body).Decode(&got); err != nil {
+			t.Errorf("decode: %v", err)
+		}
+		if got != request {
+			t.Errorf("request = %#v, want %#v", got, request)
+		}
+		writer.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(writer).Encode(CredentialMaterialResponse{Material: "Authorization: Bearer canary", ResourceVersion: "123"})
+	}))
+	defer server.Close()
+	provider, err := newBrokerCredentialProvider(server.URL, server.Client(), []byte(bearer), time.Second)
+	if err != nil {
+		t.Fatal(err)
+	}
+	material, resourceVersion, err := provider.Read(context.Background(), request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(material) != "Authorization: Bearer canary" || resourceVersion != "123" {
+		t.Fatalf("material/resourceVersion = %q %q", material, resourceVersion)
+	}
+}
+
+func TestLoadConfigFromEnvUsesCredentialBrokerWithoutCredentialVolume(t *testing.T) {
+	clearPublisherEnvForTest(t)
+	controller := writePublisherSecretForTest(t, "controller", strings.Repeat("c", 32))
+	operation := writePublisherSecretForTest(t, "operation", strings.Repeat("o", MinSecretBytes))
+	t.Setenv(EnvControllerTokenFile, controller)
+	t.Setenv(EnvOperationCapabilitySecretFile, operation)
+	t.Setenv(EnvArtifactAuthorizationBrokerURL, "https://orka-api.example")
+	t.Setenv(EnvCredentialBrokerURL, "https://orka-api.example")
+	t.Setenv(EnvArtifactAPIURL, "https://orka-api.example")
+	setProductionPublisherProxyForTest(t)
+
+	config, err := LoadConfigFromEnv()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if config.CredentialBrokerURL != "https://orka-api.example" || config.CredentialRoot != "" {
+		t.Fatalf("credential delivery config = %#v", config)
+	}
+}
diff --git a/internal/publisher/service/development_fallback_test.go b/internal/publisher/service/development_fallback_test.go
new file mode 100644
index 000000000..814c41d52
--- /dev/null
+++ b/internal/publisher/service/development_fallback_test.go
@@ -0,0 +1,79 @@
+package service
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestLoadConfigFromEnvRejectsLocalArtifactFallbackByDefault(t *testing.T) {
+	clearPublisherEnvForTest(t)
+	configureRequiredPublisherEnvForTest(t)
+	artifact := writePublisherSecretForTest(t, "artifact", strings.Repeat("a", MinSecretBytes))
+	t.Setenv(EnvArtifactCapabilitySecretFile, artifact)
+	t.Setenv(EnvCredentialBrokerURL, "https://orka-api.example")
+
+	_, err := LoadConfigFromEnv()
+	if err == nil || !strings.Contains(err.Error(), EnvArtifactAuthorizationBrokerURL) ||
+		!strings.Contains(err.Error(), EnvAllowDevelopmentFallbacks) {
+		t.Fatalf("LoadConfigFromEnv error = %v", err)
+	}
+}
+
+func TestLoadConfigFromEnvRejectsCredentialRootFallbackByDefault(t *testing.T) {
+	clearPublisherEnvForTest(t)
+	configureRequiredPublisherEnvForTest(t)
+	t.Setenv(EnvArtifactAuthorizationBrokerURL, "https://orka-api.example")
+	t.Setenv(EnvCredentialRoot, t.TempDir())
+
+	_, err := LoadConfigFromEnv()
+	if err == nil || !strings.Contains(err.Error(), EnvCredentialBrokerURL) ||
+		!strings.Contains(err.Error(), EnvAllowDevelopmentFallbacks) {
+		t.Fatalf("LoadConfigFromEnv error = %v", err)
+	}
+}
+
+func TestLoadConfigFromEnvAllowsExplicitDevelopmentFallbacks(t *testing.T) {
+	clearPublisherEnvForTest(t)
+	configureRequiredPublisherEnvForTest(t)
+	artifact := writePublisherSecretForTest(t, "artifact", strings.Repeat("a", MinSecretBytes))
+	credentialRoot := t.TempDir()
+	t.Setenv(EnvAllowDevelopmentFallbacks, "true")
+	t.Setenv(EnvArtifactCapabilitySecretFile, artifact)
+	t.Setenv(EnvCredentialRoot, credentialRoot)
+
+	config, err := LoadConfigFromEnv()
+	if err != nil {
+		t.Fatalf("LoadConfigFromEnv: %v", err)
+	}
+	if len(config.ArtifactCapabilitySecret) != MinSecretBytes || config.ArtifactAuthorizationBrokerURL != "" {
+		t.Fatalf("artifact fallback config = %#v", config)
+	}
+	if config.CredentialRoot != credentialRoot || config.CredentialBrokerURL != "" {
+		t.Fatalf("credential fallback config = %#v", config)
+	}
+	if config.ProxyEnvironment.HTTPSProxy != "" {
+		t.Fatal("development fallback unexpectedly required the SCM egress proxy")
+	}
+}
+
+func TestLoadConfigFromEnvRequiresSCMEgressProxyInProduction(t *testing.T) {
+	clearPublisherEnvForTest(t)
+	configureRequiredPublisherEnvForTest(t)
+	t.Setenv(EnvArtifactAuthorizationBrokerURL, "https://orka-api.example")
+	t.Setenv(EnvCredentialBrokerURL, "https://orka-api.example")
+
+	_, err := LoadConfigFromEnv()
+	if err == nil || !strings.Contains(err.Error(), EnvSCMEgressProxyRequired) ||
+		!strings.Contains(err.Error(), EnvAllowDevelopmentFallbacks) {
+		t.Fatalf("LoadConfigFromEnv error = %v", err)
+	}
+}
+
+func configureRequiredPublisherEnvForTest(t *testing.T) {
+	t.Helper()
+	controller := writePublisherSecretForTest(t, "controller", strings.Repeat("c", 32))
+	operation := writePublisherSecretForTest(t, "operation", strings.Repeat("o", MinSecretBytes))
+	t.Setenv(EnvControllerTokenFile, controller)
+	t.Setenv(EnvOperationCapabilitySecretFile, operation)
+	t.Setenv(EnvArtifactAPIURL, "https://orka-api.example")
+}
diff --git a/internal/publisher/service/doc.go b/internal/publisher/service/doc.go
new file mode 100644
index 000000000..12239a720
--- /dev/null
+++ b/internal/publisher/service/doc.go
@@ -0,0 +1,13 @@
+// Package service exposes the clean-room Workspace/Publisher boundary around
+// internal/publisher.
+//
+// Every stateful endpoint requires both an exact controller bearer token and a
+// short-lived HMAC operation capability bound to method, path, canonical request
+// digest, namespace, Task or Publication identity, and operation ID. The API
+// accepts only credential file references; it never accepts raw SCM credentials.
+// Workspace source preparation creates a fresh exact-ref bare clone, reads only
+// validated Git blobs, preserves validated relative symlinks while rejecting unsafe links, submodules, and Git metadata, writes a
+// deterministic content-addressed tar, and uploads it through the controller
+// artifact API. Publication endpoints delegate deterministic prepare, exact-ref
+// CAS publish, and independent verification to internal/publisher.
+package service
diff --git a/internal/publisher/service/env.go b/internal/publisher/service/env.go
new file mode 100644
index 000000000..3b7fddd26
--- /dev/null
+++ b/internal/publisher/service/env.go
@@ -0,0 +1,309 @@
+package service
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/orka-agents/orka/internal/publisher"
+)
+
+const (
+	EnvListenAddress                  = "ORKA_PUBLISHER_LISTEN_ADDRESS"
+	EnvControllerTokenFile            = "ORKA_PUBLISHER_CONTROLLER_TOKEN_FILE"
+	EnvOperationCapabilitySecretFile  = "ORKA_PUBLISHER_OPERATION_CAPABILITY_SECRET_FILE"
+	EnvArtifactCapabilitySecretFile   = "ORKA_PUBLISHER_ARTIFACT_CAPABILITY_SECRET_FILE"
+	EnvArtifactAuthorizationBrokerURL = "ORKA_PUBLISHER_ARTIFACT_AUTHORIZATION_BROKER_URL"
+	EnvArtifactAPIURL                 = "ORKA_PUBLISHER_ARTIFACT_API_URL"
+	EnvArtifactRoot                   = "ORKA_PUBLISHER_ARTIFACT_ROOT"
+	EnvJournalRoot                    = "ORKA_PUBLISHER_JOURNAL_ROOT"
+	EnvTempRoot                       = "ORKA_PUBLISHER_TEMP_ROOT"
+	EnvCredentialRoot                 = "ORKA_PUBLISHER_CREDENTIAL_ROOT"
+	EnvCredentialBrokerURL            = "ORKA_PUBLISHER_CREDENTIAL_BROKER_URL"
+	EnvDefaultGitCredentialName       = "ORKA_PUBLISHER_DEFAULT_GIT_CREDENTIAL_NAME"
+	EnvGitBinary                      = "ORKA_PUBLISHER_GIT_BINARY"
+	EnvRequiredGitVersion             = "ORKA_PUBLISHER_REQUIRED_GIT_VERSION"
+	EnvAllowedSCMHosts                = "ORKA_PUBLISHER_ALLOWED_SCM_HOSTS"
+	EnvAllowFileRepositories          = "ORKA_PUBLISHER_ALLOW_FILE_REPOSITORIES"
+	EnvMaxConcurrentOperations        = "ORKA_PUBLISHER_MAX_CONCURRENT_OPERATIONS"
+	EnvMaxRequestBytes                = "ORKA_PUBLISHER_MAX_REQUEST_BYTES"
+	EnvMaxResponseBytes               = "ORKA_PUBLISHER_MAX_RESPONSE_BYTES"
+	EnvMaxJournalBytes                = "ORKA_PUBLISHER_MAX_JOURNAL_BYTES"
+	EnvMaxDeltaBytes                  = "ORKA_PUBLISHER_MAX_DELTA_BYTES"
+	EnvMaxBundleBytes                 = "ORKA_PUBLISHER_MAX_BUNDLE_BYTES"
+	EnvMaxCommandOutput               = "ORKA_PUBLISHER_MAX_COMMAND_OUTPUT_BYTES"
+	EnvPublishTimeout                 = "ORKA_PUBLISHER_PUBLISH_TIMEOUT"
+	EnvArtifactTimeout                = "ORKA_PUBLISHER_ARTIFACT_TIMEOUT"
+	EnvCapabilityTTL                  = "ORKA_PUBLISHER_CAPABILITY_TTL"
+	EnvWorkspaceMaxEntries            = "ORKA_PUBLISHER_WORKSPACE_MAX_ENTRIES"
+	EnvWorkspaceMaxFileBytes          = "ORKA_PUBLISHER_WORKSPACE_MAX_FILE_BYTES"
+	EnvWorkspaceMaxBytes              = "ORKA_PUBLISHER_WORKSPACE_MAX_BYTES"
+	EnvWorkspaceMaxArtifactBytes      = "ORKA_PUBLISHER_WORKSPACE_MAX_ARTIFACT_BYTES"
+	EnvWorkspaceMaxPathBytes          = "ORKA_PUBLISHER_WORKSPACE_MAX_PATH_BYTES"
+	EnvGitHubPREnabled                = "ORKA_PUBLISHER_GITHUB_PR_ENABLED"
+	EnvGitHubAPIBaseURL               = "ORKA_PUBLISHER_GITHUB_API_BASE_URL"
+	EnvGitHubRequestTimeout           = "ORKA_PUBLISHER_GITHUB_REQUEST_TIMEOUT"
+	EnvGitHubMaxResponseBytes         = "ORKA_PUBLISHER_GITHUB_MAX_RESPONSE_BYTES"
+	EnvSCMEgressProxyRequired         = "ORKA_PUBLISHER_SCM_EGRESS_PROXY_REQUIRED"
+	EnvAllowDevelopmentFallbacks      = "ORKA_PUBLISHER_ALLOW_DEVELOPMENT_FALLBACKS"
+)
+
+//nolint:gocyclo // Startup validation keeps every independent environment bound explicit.
+func LoadConfigFromEnv() (Config, error) {
+	controllerToken, err := readRequiredSecretEnv(EnvControllerTokenFile, 16)
+	if err != nil {
+		return Config{}, err
+	}
+	operationSecret, err := readRequiredSecretEnv(EnvOperationCapabilitySecretFile, MinSecretBytes)
+	if err != nil {
+		return Config{}, err
+	}
+	allowDevelopmentFallbacks, err := parseBoolEnv(EnvAllowDevelopmentFallbacks)
+	if err != nil {
+		return Config{}, err
+	}
+	artifactSecret, artifactBrokerURL, err := loadArtifactAuthorizationFromEnv(allowDevelopmentFallbacks)
+	if err != nil {
+		return Config{}, err
+	}
+	credentialRoot, credentialBrokerURL, err := loadCredentialDeliveryFromEnv(allowDevelopmentFallbacks)
+	if err != nil {
+		return Config{}, err
+	}
+	config := Config{
+		ListenAddress:                  envDefault(EnvListenAddress, defaultListenAddress),
+		ControllerBearerToken:          controllerToken,
+		OperationCapabilitySecret:      operationSecret,
+		ArtifactCapabilitySecret:       artifactSecret,
+		ArtifactAuthorizationBrokerURL: artifactBrokerURL,
+		ArtifactAPIURL:                 os.Getenv(EnvArtifactAPIURL),
+		ArtifactRoot:                   envDefault(EnvArtifactRoot, "/data/publications"),
+		JournalRoot:                    envDefault(EnvJournalRoot, "/data/service"),
+		TempRoot:                       envDefault(EnvTempRoot, "/tmp/orka-workspace-publisher"),
+		CredentialRoot:                 credentialRoot,
+		CredentialBrokerURL:            credentialBrokerURL,
+		GitBinary:                      envDefault(EnvGitBinary, "/usr/local/bin/git"),
+		RequiredGitVersion:             envDefault(EnvRequiredGitVersion, "2.55.0"),
+		AllowedSCMHosts:                splitCSV(os.Getenv(EnvAllowedSCMHosts)),
+	}
+	if config.ArtifactAPIURL == "" {
+		return Config{}, fmt.Errorf("%s is required", EnvArtifactAPIURL)
+	}
+	if name := os.Getenv(EnvDefaultGitCredentialName); name != "" {
+		config.DefaultGitCredential = &CredentialReference{Name: name, Kind: CredentialHTTPExtraHeader}
+	}
+	if config.AllowFileRepositories, err = parseBoolEnv(EnvAllowFileRepositories); err != nil {
+		return Config{}, err
+	}
+	if config.ProxyEnvironment, err = loadSCMEgressProxyFromEnv(allowDevelopmentFallbacks); err != nil {
+		return Config{}, err
+	}
+	if config.MaxConcurrentOperations, err = parseIntEnv(EnvMaxConcurrentOperations, defaultMaxConcurrentOperations); err != nil {
+		return Config{}, err
+	}
+	if config.MaxRequestBytes, err = parseInt64Env(EnvMaxRequestBytes, defaultMaxRequestBytes); err != nil {
+		return Config{}, err
+	}
+	if config.MaxResponseBytes, err = parseInt64Env(EnvMaxResponseBytes, defaultMaxResponseBytes); err != nil {
+		return Config{}, err
+	}
+	if config.MaxJournalBytes, err = parseInt64Env(EnvMaxJournalBytes, defaultMaxJournalBytes); err != nil {
+		return Config{}, err
+	}
+	if config.MaxDeltaBytes, err = parseInt64Env(EnvMaxDeltaBytes, defaultMaxDeltaBytes); err != nil {
+		return Config{}, err
+	}
+	if config.MaxBundleBytes, err = parseInt64Env(EnvMaxBundleBytes, defaultMaxBundleBytes); err != nil {
+		return Config{}, err
+	}
+	if config.MaxCommandOutput, err = parseInt64Env(EnvMaxCommandOutput, defaultMaxCommandOutput); err != nil {
+		return Config{}, err
+	}
+	if config.PublishTimeout, err = parseDurationEnv(EnvPublishTimeout, defaultPublishTimeout); err != nil {
+		return Config{}, err
+	}
+	if config.ArtifactTimeout, err = parseDurationEnv(EnvArtifactTimeout, defaultArtifactTimeout); err != nil {
+		return Config{}, err
+	}
+	if config.CapabilityTTL, err = parseDurationEnv(EnvCapabilityTTL, defaultCapabilityTTL); err != nil {
+		return Config{}, err
+	}
+	defaults := defaultWorkspaceLimits()
+	if config.WorkspaceLimits.MaxEntries, err = parseIntEnv(EnvWorkspaceMaxEntries, defaults.MaxEntries); err != nil {
+		return Config{}, err
+	}
+	if config.WorkspaceLimits.MaxFileBytes, err = parseInt64Env(EnvWorkspaceMaxFileBytes, defaults.MaxFileBytes); err != nil {
+		return Config{}, err
+	}
+	if config.WorkspaceLimits.MaxExpandedBytes, err = parseInt64Env(EnvWorkspaceMaxBytes, defaults.MaxExpandedBytes); err != nil {
+		return Config{}, err
+	}
+	if config.WorkspaceLimits.MaxArtifactBytes, err = parseInt64Env(EnvWorkspaceMaxArtifactBytes, defaults.MaxArtifactBytes); err != nil {
+		return Config{}, err
+	}
+	if config.WorkspaceLimits.MaxPathBytes, err = parseIntEnv(EnvWorkspaceMaxPathBytes, defaults.MaxPathBytes); err != nil {
+		return Config{}, err
+	}
+	githubEnabled, err := parseBoolEnv(EnvGitHubPREnabled)
+	if err != nil {
+		return Config{}, err
+	}
+	if githubEnabled {
+		requestTimeout, timeoutErr := parseDurationEnv(EnvGitHubRequestTimeout, defaultGitHubRequestTimeout)
+		if timeoutErr != nil {
+			return Config{}, timeoutErr
+		}
+		maxResponseBytes, limitErr := parseInt64Env(EnvGitHubMaxResponseBytes, defaultGitHubMaxResponseBytes)
+		if limitErr != nil {
+			return Config{}, limitErr
+		}
+		factory, factoryErr := NewGitHubPRReconcilerFactory(GitHubPRReconcilerFactoryConfig{
+			APIBaseURL: envDefault(EnvGitHubAPIBaseURL, defaultGitHubAPIBaseURL), RequestTimeout: requestTimeout, MaxResponseBytes: maxResponseBytes,
+		})
+		if factoryErr != nil {
+			return Config{}, fmt.Errorf("GitHub pull request reconciliation configuration is invalid: %w", factoryErr)
+		}
+		config.PRFactory = factory
+	} else {
+		for _, name := range []string{EnvGitHubAPIBaseURL, EnvGitHubRequestTimeout, EnvGitHubMaxResponseBytes} {
+			if strings.TrimSpace(os.Getenv(name)) != "" {
+				return Config{}, fmt.Errorf("%s requires %s=true", name, EnvGitHubPREnabled)
+			}
+		}
+	}
+	return normalizeConfig(config)
+}
+
+func loadSCMEgressProxyFromEnv(allowDevelopmentFallbacks bool) (publisher.ProxyEnvironment, error) {
+	required, err := parseBoolEnv(EnvSCMEgressProxyRequired)
+	if err != nil {
+		return publisher.ProxyEnvironment{}, err
+	}
+	if !required {
+		if allowDevelopmentFallbacks {
+			return publisher.ProxyEnvironment{}, nil
+		}
+		return publisher.ProxyEnvironment{}, fmt.Errorf(
+			"%s must be true unless %s=true",
+			EnvSCMEgressProxyRequired,
+			EnvAllowDevelopmentFallbacks,
+		)
+	}
+	environment, err := publisher.NormalizeProxyEnvironment(os.Getenv("HTTPS_PROXY"), os.Getenv("NO_PROXY"))
+	if err != nil || environment.HTTPSProxy == "" {
+		return publisher.ProxyEnvironment{}, fmt.Errorf("SCM egress proxy configuration is invalid")
+	}
+	return environment, nil
+}
+
+func loadArtifactAuthorizationFromEnv(allowDevelopmentFallbacks bool) ([]byte, string, error) {
+	brokerURL := strings.TrimSpace(os.Getenv(EnvArtifactAuthorizationBrokerURL))
+	secretFile := strings.TrimSpace(os.Getenv(EnvArtifactCapabilitySecretFile))
+	if brokerURL != "" {
+		if secretFile != "" {
+			return nil, "", fmt.Errorf(
+				"%s and %s are mutually exclusive",
+				EnvArtifactAuthorizationBrokerURL,
+				EnvArtifactCapabilitySecretFile,
+			)
+		}
+		return nil, brokerURL, nil
+	}
+	if !allowDevelopmentFallbacks {
+		return nil, "", fmt.Errorf(
+			"%s is required unless %s=true",
+			EnvArtifactAuthorizationBrokerURL,
+			EnvAllowDevelopmentFallbacks,
+		)
+	}
+	secret, err := readRequiredSecretEnv(EnvArtifactCapabilitySecretFile, MinSecretBytes)
+	return secret, "", err
+}
+
+func loadCredentialDeliveryFromEnv(allowDevelopmentFallbacks bool) (string, string, error) {
+	brokerURL := strings.TrimSpace(os.Getenv(EnvCredentialBrokerURL))
+	credentialRoot := strings.TrimSpace(os.Getenv(EnvCredentialRoot))
+	if brokerURL != "" {
+		if credentialRoot != "" {
+			return "", "", fmt.Errorf("%s and %s are mutually exclusive", EnvCredentialBrokerURL, EnvCredentialRoot)
+		}
+		return "", brokerURL, nil
+	}
+	if !allowDevelopmentFallbacks {
+		return "", "", fmt.Errorf(
+			"%s is required unless %s=true",
+			EnvCredentialBrokerURL,
+			EnvAllowDevelopmentFallbacks,
+		)
+	}
+	return envDefault(EnvCredentialRoot, "/var/run/secrets/orka-publisher/credentials"), "", nil
+}
+
+func readRequiredSecretEnv(name string, minimum int) ([]byte, error) {
+	path := os.Getenv(name)
+	if path == "" {
+		return nil, fmt.Errorf("%s is required", name)
+	}
+	value, err := readSecretFile(path, minimum)
+	if err != nil {
+		return nil, fmt.Errorf("%s is invalid: %w", name, err)
+	}
+	return value, nil
+}
+
+func envDefault(name, fallback string) string {
+	if value := strings.TrimSpace(os.Getenv(name)); value != "" {
+		return value
+	}
+	return fallback
+}
+
+func parseIntEnv(name string, fallback int) (int, error) {
+	raw := strings.TrimSpace(os.Getenv(name))
+	if raw == "" {
+		return fallback, nil
+	}
+	value, err := strconv.Atoi(raw)
+	if err != nil || strconv.Itoa(value) != raw {
+		return 0, fmt.Errorf("%s must be a canonical platform-sized integer", name)
+	}
+	return value, nil
+}
+
+func parseInt64Env(name string, fallback int64) (int64, error) {
+	raw := strings.TrimSpace(os.Getenv(name))
+	if raw == "" {
+		return fallback, nil
+	}
+	value, err := strconv.ParseInt(raw, 10, 64)
+	if err != nil || strconv.FormatInt(value, 10) != raw {
+		return 0, fmt.Errorf("%s must be a canonical integer", name)
+	}
+	return value, nil
+}
+
+func parseBoolEnv(name string) (bool, error) {
+	raw := strings.TrimSpace(os.Getenv(name))
+	if raw == "" {
+		return false, nil
+	}
+	value, err := strconv.ParseBool(raw)
+	if err != nil {
+		return false, fmt.Errorf("%s must be a boolean", name)
+	}
+	return value, nil
+}
+
+func parseDurationEnv(name string, fallback time.Duration) (time.Duration, error) {
+	raw := strings.TrimSpace(os.Getenv(name))
+	if raw == "" {
+		return fallback, nil
+	}
+	value, err := time.ParseDuration(raw)
+	if err != nil {
+		return 0, fmt.Errorf("%s must be a duration", name)
+	}
+	return value, nil
+}
diff --git a/internal/publisher/service/env_test.go b/internal/publisher/service/env_test.go
new file mode 100644
index 000000000..cefb2878f
--- /dev/null
+++ b/internal/publisher/service/env_test.go
@@ -0,0 +1,31 @@
+package service
+
+import (
+	"strconv"
+	"strings"
+	"testing"
+)
+
+func TestParseIntEnvUsesPlatformIntBounds(t *testing.T) {
+	const name = "ORKA_TEST_PLATFORM_INT"
+
+	t.Setenv(name, "")
+	if got, err := parseIntEnv(name, 17); err != nil || got != 17 {
+		t.Fatalf("parseIntEnv fallback = %d, %v", got, err)
+	}
+
+	t.Setenv(name, strconv.Itoa(int(^uint(0)>>1)))
+	if _, err := parseIntEnv(name, 0); err != nil {
+		t.Fatalf("parseIntEnv MaxInt: %v", err)
+	}
+
+	t.Setenv(name, "9223372036854775808")
+	if _, err := parseIntEnv(name, 0); err == nil || !strings.Contains(err.Error(), "platform-sized integer") {
+		t.Fatalf("parseIntEnv overflow error = %v", err)
+	}
+
+	t.Setenv(name, "+1")
+	if _, err := parseIntEnv(name, 0); err == nil {
+		t.Fatal("parseIntEnv accepted a non-canonical integer")
+	}
+}
diff --git a/internal/publisher/service/errors.go b/internal/publisher/service/errors.go
new file mode 100644
index 000000000..231be262b
--- /dev/null
+++ b/internal/publisher/service/errors.go
@@ -0,0 +1,73 @@
+package service
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+)
+
+var (
+	ErrUnauthorized      = errors.New("workspace publisher authorization failed")
+	ErrInvalidRequest    = errors.New("invalid workspace publisher request")
+	ErrOperationConflict = errors.New("workspace publisher operation conflicts with durable journal")
+	ErrJournalFull       = errors.New("workspace publisher durable journal is full")
+	ErrCredential        = errors.New("workspace publisher credential reference is invalid")
+	ErrArtifactTransport = errors.New("workspace publisher artifact transport failed")
+	ErrSCMTransport      = errors.New("workspace publisher SCM transport failed")
+	ErrNotConfigured     = errors.New("workspace publisher feature is not configured")
+	ErrBusy              = errors.New("workspace publisher is at its concurrency limit")
+)
+
+type operationError struct {
+	kind      error
+	code      string
+	message   string
+	status    int
+	retryable bool
+	cause     error
+}
+
+func (e *operationError) Error() string {
+	if e == nil {
+		return "<nil>"
+	}
+	if e.cause != nil {
+		return fmt.Sprintf("%s: %v", e.message, e.cause)
+	}
+	return e.message
+}
+
+func (e *operationError) Unwrap() error {
+	if e == nil {
+		return nil
+	}
+	if e.kind == nil {
+		return e.cause
+	}
+	if e.cause == nil {
+		return e.kind
+	}
+	return errors.Join(e.kind, e.cause)
+}
+
+func apiError(kind error, code, message string, status int, retryable bool, cause error) error {
+	return &operationError{kind: kind, code: code, message: message, status: status, retryable: retryable, cause: cause}
+}
+
+func invalidRequest(message string, cause error) error {
+	return apiError(ErrInvalidRequest, "invalid_request", message, http.StatusBadRequest, false, cause)
+}
+
+func errorResponse(err error, metadata OperationMetadata, requestDigest string) (int, ErrorResponse, bool) {
+	var typed *operationError
+	if errors.As(err, &typed) {
+		return typed.status, ErrorResponse{
+			Code: typed.code, Message: typed.message, Retryable: typed.retryable,
+			OperationID: metadata.OperationID, RequestDigest: requestDigest,
+		}, !typed.retryable
+	}
+	return http.StatusBadGateway, ErrorResponse{
+		Code: "upstream_failure", Message: "the clean-room operation did not complete", Retryable: true,
+		OperationID: metadata.OperationID, RequestDigest: requestDigest,
+	}, false
+}
diff --git a/internal/publisher/service/git.go b/internal/publisher/service/git.go
new file mode 100644
index 000000000..5063eea4d
--- /dev/null
+++ b/internal/publisher/service/git.go
@@ -0,0 +1,678 @@
+package service
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"math"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/orka-agents/orka/internal/publisher"
+	"github.com/orka-agents/orka/internal/safesymlink"
+)
+
+const (
+	gitConfigGlobalNull = "GIT_CONFIG_GLOBAL=/dev/null"
+	gitBatchHeaderLimit = 256
+	gitBatchWaitDelay   = time.Second
+	langC               = "LANG=C"
+	gitConfigNoSystem   = "GIT_CONFIG_NOSYSTEM=1"
+	lcAllC              = "LC_ALL=C"
+)
+
+var gitHardening = []string{
+	"credential.helper=", "credential.interactive=never", "core.askPass=", "core.hooksPath=/dev/null",
+	"core.attributesFile=/dev/null", "core.excludesFile=/dev/null", "core.fsmonitor=false", "core.untrackedCache=false",
+	"commit.gpgSign=false", "tag.gpgSign=false", "protocol.allow=never", "protocol.file.allow=always",
+	"protocol.https.allow=always", "protocol.ssh.allow=never", "protocol.ext.allow=never", "submodule.recurse=false",
+	"fetch.recurseSubmodules=false", "push.recurseSubmodules=no", "filter.lfs.required=false", "filter.lfs.clean=",
+	"filter.lfs.smudge=", "filter.lfs.process=", "fetch.fsckObjects=true", "transfer.fsckObjects=true",
+	"receive.fsckObjects=true", "gc.auto=0", "maintenance.auto=false", "http.followRedirects=false",
+}
+
+type gitRunner struct {
+	binary           string
+	tempRoot         string
+	maxCommandOutput int64
+	gitExecPath      string
+	trustedPath      string
+	proxyEnvironment publisher.ProxyEnvironment
+}
+
+type gitSandbox struct {
+	root     string
+	home     string
+	xdg      string
+	template string
+}
+
+type gitResult struct {
+	stdout []byte
+	stderr []byte
+}
+
+type gitBlobBatch struct {
+	ctx              context.Context
+	command          *exec.Cmd
+	stdin            io.WriteCloser
+	stdoutPipe       io.ReadCloser
+	stdout           *bufio.Reader
+	stderr           *limitedBuffer
+	remainingBytes   int64
+	remainingObjects int
+	finished         bool
+	done             chan struct{}
+	doneOnce         sync.Once
+}
+
+func newGitRunner(
+	binary, tempRoot string,
+	maxCommandOutput int64,
+	proxyEnvironment publisher.ProxyEnvironment,
+) (*gitRunner, error) {
+	trustedPath := filepath.Dir(binary) + string(os.PathListSeparator) + "/usr/local/bin:/usr/bin:/bin"
+	command := exec.CommandContext(context.Background(), binary, "--exec-path")
+	configureCommand(command)
+	command.Env = []string{
+		"HOME=/dev/null", "XDG_CONFIG_HOME=/dev/null", gitConfigGlobalNull, gitConfigNoSystem,
+		lcAllC, langC, "TZ=UTC", "PATH=" + trustedPath,
+	}
+	output := &limitedBuffer{limit: 64 << 10}
+	command.Stdout = output
+	command.Stderr = &limitedBuffer{limit: 64 << 10}
+	if err := command.Run(); err != nil || output.truncated {
+		return nil, fmt.Errorf("resolve Git exec path")
+	}
+	execPath := strings.TrimSpace(output.String())
+	if !filepath.IsAbs(execPath) || filepath.Clean(execPath) != execPath {
+		return nil, fmt.Errorf("git exec path is invalid")
+	}
+	return &gitRunner{
+		binary: binary, tempRoot: tempRoot, maxCommandOutput: maxCommandOutput,
+		gitExecPath: execPath, trustedPath: trustedPath, proxyEnvironment: proxyEnvironment,
+	}, nil
+}
+
+func (r *gitRunner) sandbox(prefix string) (*gitSandbox, error) {
+	root, err := os.MkdirTemp(r.tempRoot, "orka-workspace-publisher-"+prefix+"-")
+	if err != nil {
+		return nil, err
+	}
+	if err := os.Chmod(root, 0o700); err != nil {
+		_ = os.RemoveAll(root)
+		return nil, err
+	}
+	box := &gitSandbox{root: root, home: filepath.Join(root, "home"), xdg: filepath.Join(root, "xdg"), template: filepath.Join(root, "template")}
+	for _, directory := range []string{box.home, box.xdg, box.template} {
+		if err := os.Mkdir(directory, 0o700); err != nil {
+			_ = os.RemoveAll(root)
+			return nil, err
+		}
+	}
+	return box, nil
+}
+
+func (b *gitSandbox) close() { _ = os.RemoveAll(b.root) }
+
+func (r *gitRunner) command(ctx context.Context, box *gitSandbox, directory string, args ...string) *exec.Cmd {
+	fullArgs := make([]string, 0, len(gitHardening)*2+len(args))
+	for _, setting := range gitHardening {
+		fullArgs = append(fullArgs, "-c", setting)
+	}
+	fullArgs = append(fullArgs, args...)
+	command := exec.CommandContext(ctx, r.binary, fullArgs...)
+	configureCommand(command)
+	command.Dir = directory
+	command.Env = []string{
+		"HOME=" + box.home, "XDG_CONFIG_HOME=" + box.xdg, gitConfigGlobalNull, gitConfigNoSystem,
+		"GIT_TEMPLATE_DIR=" + box.template, "GIT_NO_REPLACE_OBJECTS=1", "GIT_EXEC_PATH=" + r.gitExecPath,
+		"GIT_TERMINAL_PROMPT=0", "GIT_ASKPASS=/bin/false", "SSH_ASKPASS=/bin/false", "GIT_ALLOW_PROTOCOL=file:https",
+		"GIT_PROTOCOL_FROM_USER=0", "GIT_OPTIONAL_LOCKS=0", lcAllC, langC, "TZ=UTC", "PATH=" + r.trustedPath,
+	}
+	command.Env = append(command.Env, r.proxyEnvironment.Variables()...)
+	return command
+}
+
+func (r *gitRunner) run(ctx context.Context, box *gitSandbox, directory string, outputLimit int64, args ...string) (gitResult, error) {
+	command := r.command(ctx, box, directory, args...)
+	if outputLimit <= 0 {
+		outputLimit = r.maxCommandOutput
+	}
+	stdout := &limitedBuffer{limit: outputLimit}
+	stderr := &limitedBuffer{limit: r.maxCommandOutput}
+	command.Stdout = stdout
+	command.Stderr = stderr
+	err := command.Run()
+	result := gitResult{stdout: stdout.Bytes(), stderr: stderr.Bytes()}
+	if stdout.truncated || stderr.truncated {
+		return result, apiError(ErrSCMTransport, "scm_output_limit", "Git output exceeded the configured limit", 502, false, err)
+	}
+	if err != nil {
+		var exitErr *exec.ExitError
+		if errors.As(err, &exitErr) {
+			return result, apiError(ErrSCMTransport, "scm_failure", "Git operation failed", 502, true, err)
+		}
+		return result, apiError(ErrSCMTransport, "scm_unavailable", "Git operation could not be started", 503, true, err)
+	}
+	return result, nil
+}
+
+func (r *gitRunner) startBlobBatch(
+	ctx context.Context,
+	box *gitSandbox,
+	repositoryPath string,
+	maxBytes int64,
+	maxObjects int,
+) (*gitBlobBatch, error) {
+	command := r.command(ctx, box, box.root, "--git-dir="+repositoryPath, "cat-file", "--batch")
+	command.WaitDelay = gitBatchWaitDelay
+	stdin, err := command.StdinPipe()
+	if err != nil {
+		return nil, apiError(ErrSCMTransport, "scm_unavailable", "Git batch input could not be opened", 503, true, err)
+	}
+	stdout, err := command.StdoutPipe()
+	if err != nil {
+		_ = stdin.Close()
+		return nil, apiError(ErrSCMTransport, "scm_unavailable", "Git batch output could not be opened", 503, true, err)
+	}
+	stderr := &limitedBuffer{limit: r.maxCommandOutput}
+	command.Stderr = stderr
+	if err := command.Start(); err != nil {
+		_ = stdin.Close()
+		_ = stdout.Close()
+		return nil, apiError(ErrSCMTransport, "scm_unavailable", "Git batch operation could not be started", 503, true, err)
+	}
+	batch := &gitBlobBatch{
+		ctx: ctx, command: command, stdin: stdin, stdout: bufio.NewReaderSize(stdout, gitBatchHeaderLimit), stderr: stderr,
+		stdoutPipe: stdout, remainingBytes: maxBytes, remainingObjects: maxObjects, done: make(chan struct{}),
+	}
+	go batch.cancelOnContextDone()
+	return batch, nil
+}
+
+func (b *gitBlobBatch) cancelOnContextDone() {
+	select {
+	case <-b.ctx.Done():
+		_ = b.stdin.Close()
+		_ = b.stdoutPipe.Close()
+		if b.command.Cancel != nil {
+			_ = b.command.Cancel()
+		} else if b.command.Process != nil {
+			_ = b.command.Process.Kill()
+		}
+	case <-b.done:
+	}
+}
+
+func (b *gitBlobBatch) stopCancellationWatcher() {
+	if b.done != nil {
+		b.doneOnce.Do(func() { close(b.done) })
+	}
+}
+
+func (b *gitBlobBatch) classifyPrematureExit(message string, readErr error) error {
+	if b.finished || b.command == nil {
+		return apiError(ErrSCMTransport, "source_corrupt", message, 502, false, readErr)
+	}
+	b.finished = true
+	b.stopCancellationWatcher()
+	_ = b.stdin.Close()
+	if b.stdoutPipe != nil {
+		_ = b.stdoutPipe.Close()
+	}
+	waitErr := b.command.Wait()
+	if err := b.ctx.Err(); err != nil {
+		return err
+	}
+	if b.stderr.truncated {
+		return apiError(ErrSCMTransport, "scm_output_limit", "Git output exceeded the configured limit", 502, false, waitErr)
+	}
+	if waitErr != nil {
+		var exitErr *exec.ExitError
+		if errors.As(waitErr, &exitErr) {
+			return apiError(ErrSCMTransport, "scm_failure", "Git batch operation failed", 502, true, waitErr)
+		}
+		return apiError(ErrSCMTransport, "scm_unavailable", "Git batch operation could not complete", 503, true, waitErr)
+	}
+	return apiError(ErrSCMTransport, "source_corrupt", message, 502, false, readErr)
+}
+
+func (b *gitBlobBatch) readBlob(entry workspaceEntry, limit int64) ([]byte, error) {
+	if err := b.ctx.Err(); err != nil {
+		return nil, err
+	}
+	if b.finished {
+		return nil, apiError(ErrSCMTransport, "scm_failure", "Git batch operation is already closed", 502, true, nil)
+	}
+	if entry.Size < 0 || entry.Size > limit || entry.Size > b.remainingBytes || b.remainingObjects < 1 {
+		return nil, apiError(ErrSCMTransport, "scm_output_limit", "Git output exceeded the configured limit", 502, false, nil)
+	}
+	if entry.Size < 0 || entry.Size > math.MaxInt {
+		return nil, apiError(ErrSCMTransport, "scm_output_limit", "Git output exceeded the configured limit", 502, false, nil)
+	}
+	blobSize := int(entry.Size)
+	if int64(blobSize) != entry.Size {
+		return nil, apiError(ErrSCMTransport, "scm_output_limit", "Git output exceeded the configured limit", 502, false, nil)
+	}
+	if _, err := io.WriteString(b.stdin, entry.OID+"\n"); err != nil {
+		if contextErr := b.ctx.Err(); contextErr != nil {
+			return nil, contextErr
+		}
+		return nil, apiError(ErrSCMTransport, "scm_failure", "Git batch operation failed", 502, true, err)
+	}
+	header, err := b.stdout.ReadSlice('\n')
+	if err != nil {
+		if contextErr := b.ctx.Err(); contextErr != nil {
+			return nil, contextErr
+		}
+		if errors.Is(err, bufio.ErrBufferFull) {
+			return nil, apiError(ErrSCMTransport, "source_corrupt", "Git batch response header exceeded the configured limit", 502, false, err)
+		}
+		return nil, b.classifyPrematureExit("Git batch response ended before the object header", err)
+	}
+	if len(header) < 2 || len(header) > gitBatchHeaderLimit {
+		return nil, apiError(ErrSCMTransport, "source_corrupt", "Git batch response header is malformed", 502, false, nil)
+	}
+	fields := strings.Fields(string(header[:len(header)-1]))
+	if len(fields) != 3 || fields[0] != entry.OID || fields[1] != "blob" {
+		return nil, apiError(ErrSCMTransport, "source_corrupt", "Git batch response did not match the requested blob", 502, false, nil)
+	}
+	size, err := strconv.ParseInt(fields[2], 10, 64)
+	if err != nil || size != entry.Size {
+		return nil, apiError(ErrSCMTransport, "source_corrupt", "Git blob size changed during workspace preparation", 502, false, err)
+	}
+	blob := make([]byte, blobSize)
+	if _, err := io.ReadFull(b.stdout, blob); err != nil {
+		if contextErr := b.ctx.Err(); contextErr != nil {
+			return nil, contextErr
+		}
+		return nil, b.classifyPrematureExit("Git batch response ended before the object content", err)
+	}
+	separator, err := b.stdout.ReadByte()
+	if err != nil {
+		if contextErr := b.ctx.Err(); contextErr != nil {
+			return nil, contextErr
+		}
+		return nil, b.classifyPrematureExit("Git batch response ended before the object separator", err)
+	}
+	if separator != '\n' {
+		return nil, apiError(ErrSCMTransport, "source_corrupt", "Git batch response object framing is malformed", 502, false, nil)
+	}
+	b.remainingBytes -= entry.Size
+	b.remainingObjects--
+	return blob, nil
+}
+
+func (b *gitBlobBatch) finish() error {
+	if b.finished {
+		return nil
+	}
+	b.finished = true
+	b.stopCancellationWatcher()
+	closeErr := b.stdin.Close()
+	waitErr := b.command.Wait()
+	_ = b.stdoutPipe.Close()
+	if err := b.ctx.Err(); err != nil {
+		return err
+	}
+	if b.stderr.truncated {
+		return apiError(ErrSCMTransport, "scm_output_limit", "Git output exceeded the configured limit", 502, false, waitErr)
+	}
+	if waitErr != nil {
+		var exitErr *exec.ExitError
+		if errors.As(waitErr, &exitErr) {
+			return apiError(ErrSCMTransport, "scm_failure", "Git batch operation failed", 502, true, waitErr)
+		}
+		return apiError(ErrSCMTransport, "scm_unavailable", "Git batch operation could not complete", 503, true, waitErr)
+	}
+	if closeErr != nil {
+		return apiError(ErrSCMTransport, "scm_failure", "Git batch input could not be closed", 502, true, closeErr)
+	}
+	return nil
+}
+
+func (b *gitBlobBatch) abort() {
+	if b == nil || b.finished {
+		return
+	}
+	b.finished = true
+	b.stopCancellationWatcher()
+	_ = b.stdin.Close()
+	_ = b.stdoutPipe.Close()
+	if b.command.Cancel != nil {
+		_ = b.command.Cancel()
+	} else if b.command.Process != nil {
+		_ = b.command.Process.Kill()
+	}
+	_ = b.command.Wait()
+}
+
+func (r *gitRunner) resolveSource(ctx context.Context, repositoryURL, ref string) (string, string, error) {
+	if strings.TrimSpace(ref) == "" {
+		box, err := r.sandbox("resolve-default")
+		if err != nil {
+			return "", "", err
+		}
+		defer box.close()
+		return r.observeDefaultRef(ctx, box, repositoryURL)
+	}
+	if validateObjectID(ref) == nil {
+		box, _, _, err := r.prepareExactRepository(ctx, repositoryURL, ref, ref)
+		if box != nil {
+			defer box.close()
+		}
+		if err != nil {
+			return "", "", err
+		}
+		return ref, ref, nil
+	}
+	box, err := r.sandbox("resolve")
+	if err != nil {
+		return "", "", err
+	}
+	defer box.close()
+	if isBareWorkspaceSourceRef(ref) {
+		return r.observeBareRef(ctx, box, repositoryURL, ref)
+	}
+	oid, err := r.observeRef(ctx, box, repositoryURL, ref)
+	if err != nil {
+		return "", "", err
+	}
+	return ref, oid, nil
+}
+
+func (r *gitRunner) observeDefaultRef(ctx context.Context, box *gitSandbox, repositoryURL string) (string, string, error) {
+	result, err := r.run(ctx, box, box.root, r.maxCommandOutput, "ls-remote", "--symref", "--", repositoryURL, "HEAD")
+	if err != nil {
+		return "", "", err
+	}
+	trimmed := strings.TrimSpace(string(result.stdout))
+	if trimmed == "" {
+		return "", "", apiError(ErrSCMTransport, "source_ref_absent", "repository default source ref is absent", 409, false, nil)
+	}
+	var resolvedRef, oid string
+	for line := range strings.SplitSeq(trimmed, "\n") {
+		fields := strings.Fields(line)
+		switch {
+		case len(fields) == 3 && fields[0] == "ref:" && fields[2] == "HEAD":
+			if resolvedRef != "" || validateBranchRef(fields[1]) != nil {
+				return "", "", apiError(ErrSCMTransport, "source_ref_invalid", "default source ref observation was malformed", 502, false, nil)
+			}
+			resolvedRef = fields[1]
+		case len(fields) == 2 && fields[1] == "HEAD" && validateObjectID(fields[0]) == nil:
+			if oid != "" {
+				return "", "", apiError(ErrSCMTransport, "source_ref_ambiguous", "default source ref observation was ambiguous", 502, false, nil)
+			}
+			oid = fields[0]
+		default:
+			return "", "", apiError(ErrSCMTransport, "source_ref_invalid", "default source ref observation was malformed", 502, false, nil)
+		}
+	}
+	if oid == "" {
+		return "", "", apiError(ErrSCMTransport, "source_ref_absent", "repository default source ref is absent", 409, false, nil)
+	}
+	if resolvedRef == "" {
+		// Some transports advertise only the HEAD object. Freezing the exact OID
+		// is still safe and avoids guessing a branch name.
+		return oid, oid, nil
+	}
+	return resolvedRef, oid, nil
+}
+
+func (r *gitRunner) observeBareRef(ctx context.Context, box *gitSandbox, repositoryURL, ref string) (string, string, error) {
+	branchRef := "refs/heads/" + ref
+	tagRef := "refs/tags/" + ref
+	peeledTagRef := tagRef + "^{}"
+	result, err := r.run(ctx, box, box.root, r.maxCommandOutput, "ls-remote", "--", repositoryURL, branchRef, tagRef, peeledTagRef)
+	if err != nil {
+		return "", "", err
+	}
+	trimmed := strings.TrimSpace(string(result.stdout))
+	if trimmed == "" {
+		return "", "", apiError(ErrSCMTransport, "source_ref_absent", "source ref is absent", 409, false, nil)
+	}
+	observed := make(map[string]string, 3)
+	for line := range strings.SplitSeq(trimmed, "\n") {
+		fields := strings.Fields(line)
+		if len(fields) != 2 || validateObjectID(fields[0]) != nil {
+			return "", "", apiError(ErrSCMTransport, "source_ref_invalid", "source ref observation was malformed", 502, false, nil)
+		}
+		switch fields[1] {
+		case branchRef, tagRef, peeledTagRef:
+		default:
+			return "", "", apiError(ErrSCMTransport, "source_ref_invalid", "source ref observation was malformed", 502, false, nil)
+		}
+		if observed[fields[1]] != "" {
+			return "", "", apiError(ErrSCMTransport, "source_ref_ambiguous", "source ref observation was ambiguous", 502, false, nil)
+		}
+		observed[fields[1]] = fields[0]
+	}
+	branchOID := observed[branchRef]
+	tagOID := observed[tagRef]
+	peeledTagOID := observed[peeledTagRef]
+	if peeledTagOID != "" && tagOID == "" {
+		return "", "", apiError(ErrSCMTransport, "source_ref_invalid", "source ref observation was malformed", 502, false, nil)
+	}
+	if branchOID != "" && tagOID != "" {
+		return "", "", apiError(ErrSCMTransport, "source_ref_ambiguous", "bare source ref matches both a branch and a tag", 409, false, nil)
+	}
+	if branchOID != "" {
+		return branchRef, branchOID, nil
+	}
+	if tagOID != "" {
+		if peeledTagOID != "" {
+			tagOID = peeledTagOID
+		}
+		return tagRef, tagOID, nil
+	}
+	return "", "", apiError(ErrSCMTransport, "source_ref_invalid", "source ref observation was malformed", 502, false, nil)
+}
+
+func (r *gitRunner) observeRef(ctx context.Context, box *gitSandbox, repositoryURL, ref string) (string, error) {
+	args := []string{"ls-remote", "--refs", "--", repositoryURL, ref}
+	peeledRef := ""
+	if strings.HasPrefix(ref, "refs/tags/") {
+		peeledRef = ref + "^{}"
+		args = []string{"ls-remote", "--", repositoryURL, ref, peeledRef}
+	}
+	result, err := r.run(ctx, box, box.root, r.maxCommandOutput, args...)
+	if err != nil {
+		return "", err
+	}
+	trimmed := strings.TrimSpace(string(result.stdout))
+	if trimmed == "" {
+		return "", apiError(ErrSCMTransport, "source_ref_absent", "source ref is absent", 409, false, nil)
+	}
+	var directOID, peeledOID string
+	for line := range strings.SplitSeq(trimmed, "\n") {
+		fields := strings.Fields(line)
+		if len(fields) != 2 || validateObjectID(fields[0]) != nil {
+			return "", apiError(ErrSCMTransport, "source_ref_invalid", "source ref observation was malformed", 502, false, nil)
+		}
+		switch fields[1] {
+		case ref:
+			if directOID != "" {
+				return "", apiError(ErrSCMTransport, "source_ref_ambiguous", "source ref observation was ambiguous", 502, false, nil)
+			}
+			directOID = fields[0]
+		case peeledRef:
+			if peeledRef == "" || peeledOID != "" {
+				return "", apiError(ErrSCMTransport, "source_ref_ambiguous", "source ref observation was ambiguous", 502, false, nil)
+			}
+			peeledOID = fields[0]
+		default:
+			return "", apiError(ErrSCMTransport, "source_ref_invalid", "source ref observation was malformed", 502, false, nil)
+		}
+	}
+	if directOID == "" {
+		return "", apiError(ErrSCMTransport, "source_ref_invalid", "source ref observation was malformed", 502, false, nil)
+	}
+	if peeledOID != "" {
+		return peeledOID, nil
+	}
+	return directOID, nil
+}
+
+func (r *gitRunner) prepareExactRepository(ctx context.Context, repositoryURL, ref, baselineOID string) (*gitSandbox, string, string, error) {
+	box, err := r.sandbox("workspace")
+	if err != nil {
+		return nil, "", "", apiError(ErrSCMTransport, "sandbox_unavailable", "workspace sandbox could not be created", 503, true, err)
+	}
+	cleanup := true
+	defer func() {
+		if cleanup {
+			box.close()
+		}
+	}()
+	if validateObjectID(ref) == nil {
+		if ref != baselineOID {
+			return nil, "", "", apiError(ErrSCMTransport, "source_moved", "exact source commit does not match the persisted baseline", 409, false, nil)
+		}
+	} else {
+		observed, err := r.observeRef(ctx, box, repositoryURL, ref)
+		if err != nil {
+			return nil, "", "", err
+		}
+		if observed != baselineOID {
+			return nil, "", "", apiError(ErrSCMTransport, "source_moved", "source ref moved from the persisted baseline", 409, false, nil)
+		}
+	}
+	repositoryPath := filepath.Join(box.root, "source.git")
+	format := "sha1"
+	if len(baselineOID) == 64 {
+		format = "sha256"
+	}
+	if _, err := r.run(ctx, box, box.root, r.maxCommandOutput, "init", "--bare", "--object-format="+format, "--", repositoryPath); err != nil {
+		return nil, "", "", err
+	}
+	if _, err := r.run(ctx, box, box.root, r.maxCommandOutput, "--git-dir="+repositoryPath, "fetch", "--no-tags", "--no-recurse-submodules", "--depth=1", "--", repositoryURL, ref+":refs/orka/source"); err != nil {
+		return nil, "", "", err
+	}
+	resolved, err := r.run(ctx, box, box.root, 256, "--git-dir="+repositoryPath, "rev-parse", "--verify", "refs/orka/source^{commit}")
+	if err != nil {
+		return nil, "", "", err
+	}
+	if strings.TrimSpace(string(resolved.stdout)) != baselineOID {
+		return nil, "", "", apiError(ErrSCMTransport, "source_moved", "fetched source ref did not match the persisted baseline", 409, false, nil)
+	}
+	if _, err := r.run(ctx, box, box.root, r.maxCommandOutput, "--git-dir="+repositoryPath, "fsck", "--strict", "--no-reflogs", "--no-progress", baselineOID); err != nil {
+		return nil, "", "", apiError(ErrSCMTransport, "source_corrupt", "fetched source objects failed strict validation", 502, false, err)
+	}
+	tree, err := r.run(ctx, box, box.root, 256, "--git-dir="+repositoryPath, "rev-parse", "--verify", baselineOID+"^{tree}")
+	if err != nil {
+		return nil, "", "", err
+	}
+	treeOID := strings.TrimSpace(string(tree.stdout))
+	if err := validateObjectID(treeOID); err != nil {
+		return nil, "", "", err
+	}
+	cleanup = false
+	return box, repositoryPath, treeOID, nil
+}
+
+func (r *gitRunner) listTree(
+	ctx context.Context,
+	box *gitSandbox,
+	batch *gitBlobBatch,
+	repositoryPath, baselineOID string,
+	limits WorkspaceLimits,
+) ([]workspaceEntry, error) {
+	metadataLimit := int64(limits.MaxEntries) * int64(limits.MaxPathBytes+160)
+	metadataLimit = min(metadataLimit, limits.MaxArtifactBytes)
+	result, err := r.run(ctx, box, box.root, metadataLimit, "--git-dir="+repositoryPath, "ls-tree", "-lrz", "--full-tree", "-r", baselineOID)
+	if err != nil {
+		return nil, err
+	}
+	records := bytes.Split(result.stdout, []byte{0})
+	if len(records) > 0 && len(records[len(records)-1]) == 0 {
+		records = records[:len(records)-1]
+	}
+	if len(records) > limits.MaxEntries {
+		return nil, invalidRequest("repository tree exceeds the entry limit", nil)
+	}
+	entries := make([]workspaceEntry, 0, len(records))
+	paths := make(map[string]struct{}, len(records))
+	links := make(map[string]string)
+	var expanded int64
+	for _, record := range records {
+		metadata, rawPath, found := bytes.Cut(record, []byte{'\t'})
+		fields := strings.Fields(string(metadata))
+		if !found || len(fields) != 4 || fields[1] != "blob" {
+			return nil, invalidRequest("repository contains a submodule or unsupported Git object", nil)
+		}
+		mode := fields[0]
+		if mode != "100644" && mode != "100755" && mode != "120000" {
+			return nil, invalidRequest("repository contains an unsupported file mode", nil)
+		}
+		oid := fields[2]
+		if err := validateObjectID(oid); err != nil {
+			return nil, err
+		}
+		filePath := string(rawPath)
+		if err := validateWorkspacePath(filePath, limits.MaxPathBytes); err != nil {
+			return nil, err
+		}
+		size, err := strconv.ParseInt(fields[3], 10, 64)
+		maxEntryBytes := limits.MaxFileBytes
+		if mode == "120000" {
+			maxEntryBytes = int64(limits.MaxPathBytes)
+		}
+		if err != nil || size < 0 || size > maxEntryBytes || size > limits.MaxExpandedBytes-expanded {
+			return nil, invalidRequest("repository entry exceeds workspace limits", err)
+		}
+		entry := workspaceEntry{Path: filePath, Mode: mode, OID: oid, Size: size}
+		if mode == "120000" {
+			blob, err := batch.readBlob(entry, int64(limits.MaxPathBytes))
+			if err != nil {
+				return nil, err
+			}
+			entry.Target = string(blob)
+			if _, err := safesymlink.Resolve(filePath, entry.Target, limits.MaxPathBytes, limits.MaxPathBytes); err != nil {
+				return nil, invalidRequest("repository contains an unsafe symlink", err)
+			}
+			links[filePath] = entry.Target
+		}
+		expanded += size
+		paths[filePath] = struct{}{}
+		entries = append(entries, entry)
+	}
+	if err := safesymlink.ValidateGraph(paths, links, limits.MaxPathBytes, limits.MaxPathBytes); err != nil {
+		return nil, invalidRequest("repository contains an unsafe symlink graph", err)
+	}
+	sort.Slice(entries, func(i, j int) bool { return entries[i].Path < entries[j].Path })
+	return entries, nil
+}
+
+type limitedBuffer struct {
+	buffer    bytes.Buffer
+	limit     int64
+	truncated bool
+}
+
+func (b *limitedBuffer) Write(value []byte) (int, error) {
+	original := len(value)
+	remaining := b.limit - int64(b.buffer.Len())
+	if remaining > 0 {
+		if int64(len(value)) > remaining {
+			value = value[:remaining]
+			b.truncated = true
+		}
+		_, _ = b.buffer.Write(value)
+	} else if len(value) > 0 {
+		b.truncated = true
+	}
+	return original, nil
+}
+
+func (b *limitedBuffer) Bytes() []byte  { return append([]byte(nil), b.buffer.Bytes()...) }
+func (b *limitedBuffer) String() string { return b.buffer.String() }
diff --git a/internal/publisher/service/git_workspace_test.go b/internal/publisher/service/git_workspace_test.go
new file mode 100644
index 000000000..ad1f9adcd
--- /dev/null
+++ b/internal/publisher/service/git_workspace_test.go
@@ -0,0 +1,289 @@
+package service
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/orka-agents/orka/internal/artifactcap"
+	"github.com/orka-agents/orka/internal/publisher"
+)
+
+type testWriteCloser struct {
+	bytes.Buffer
+}
+
+func (*testWriteCloser) Close() error { return nil }
+
+func TestGitBlobBatchValidatesObjectIdentitySizeAndFraming(t *testing.T) {
+	t.Parallel()
+	oid := strings.Repeat("a", 40)
+	entry := workspaceEntry{OID: oid, Size: 3}
+
+	t.Run("valid", func(t *testing.T) {
+		t.Parallel()
+		input := &testWriteCloser{}
+		batch := syntheticGitBlobBatch(context.Background(), input, oid+" blob 3\nabc\n", 3)
+		blob, err := batch.readBlob(entry, 3)
+		if err != nil {
+			t.Fatalf("readBlob: %v", err)
+		}
+		if string(blob) != "abc" || input.String() != oid+"\n" {
+			t.Fatalf("blob/input = %q/%q", blob, input.String())
+		}
+	})
+
+	for name, response := range map[string]string{
+		"oid mismatch":  strings.Repeat("b", 40) + " blob 3\nabc\n",
+		"type mismatch": oid + " tree 3\nabc\n",
+		"size mismatch": oid + " blob 4\nabcd\n",
+		"short content": oid + " blob 3\nab",
+		"bad framing":   oid + " blob 3\nabcx",
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			batch := syntheticGitBlobBatch(context.Background(), &testWriteCloser{}, response, 3)
+			_, err := batch.readBlob(entry, 3)
+			assertOperationCode(t, err, "source_corrupt")
+		})
+	}
+}
+
+func TestGitBlobBatchEnforcesLimitsAndCancellation(t *testing.T) {
+	t.Parallel()
+	oid := strings.Repeat("a", 40)
+	entry := workspaceEntry{OID: oid, Size: 3}
+
+	limited := syntheticGitBlobBatch(context.Background(), &testWriteCloser{}, oid+" blob 3\nabc\n", 2)
+	_, err := limited.readBlob(entry, 3)
+	assertOperationCode(t, err, "scm_output_limit")
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	canceled := syntheticGitBlobBatch(ctx, &testWriteCloser{}, oid+" blob 3\nabc\n", 3)
+	_, err = canceled.readBlob(entry, 3)
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("canceled readBlob error = %v", err)
+	}
+}
+
+func TestWorkspacePrepareBatchesGitObjectAccess(t *testing.T) {
+	repository := newRepositoryFixture(t, false)
+	const fileCount = 300
+	for index := range fileCount {
+		writeFile(t, filepath.Join(repository.seed, "many", fmt.Sprintf("%04d.txt", index)), fmt.Sprintf("content-%04d\n", index), 0o644)
+	}
+	if err := os.Symlink("many/0000.txt", filepath.Join(repository.seed, "latest-many")); err != nil {
+		t.Fatal(err)
+	}
+	runGitEnv(t, repository.seed, fixedGitEnv(), "add", "--all")
+	runGitEnv(t, repository.seed, fixedGitEnv(), "commit", "-m", "many workspace entries")
+	repository.baselineOID = strings.TrimSpace(runGit(t, repository.seed, "rev-parse", "HEAD"))
+	runGit(t, repository.seed, "push", repository.source.URL, "HEAD:refs/heads/main")
+
+	gitBinary, err := exec.LookPath("git")
+	if err != nil {
+		t.Fatal(err)
+	}
+	gitBinary, err = filepath.Abs(gitBinary)
+	if err != nil {
+		t.Fatal(err)
+	}
+	commandLog := filepath.Join(t.TempDir(), "git-commands.log")
+	wrapper := filepath.Join(t.TempDir(), "git-wrapper")
+	wrapperScript := fmt.Sprintf(
+		"#!/bin/sh\nprintf '%%s\\n' \"$*\" >> %s\nexec %s \"$@\"\n",
+		shellQuote(commandLog), shellQuote(gitBinary),
+	)
+	if err := os.WriteFile(wrapper, []byte(wrapperScript), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	fixture := newServiceFixtureWithOptions(t, nil, func(config *Config) {
+		config.GitBinary = wrapper
+	})
+	response, err := fixture.client.PrepareWorkspace(context.Background(), WorkspacePrepareRequest{
+		Metadata: OperationMetadata{Namespace: testNamespace, OperationID: "workspace-batched-objects", TaskID: "task-batched-objects"},
+		Source:   repository.source, SourceRef: testMainRef, BaselineOID: repository.baselineOID,
+	})
+	if err != nil {
+		t.Fatalf("PrepareWorkspace: %v", err)
+	}
+	if response.EntryCount < fileCount {
+		t.Fatalf("entry count = %d, want at least %d", response.EntryCount, fileCount)
+	}
+	archive := fixture.artifact.download(t, artifactcap.Identity{Namespace: testNamespace, TaskID: "task-batched-objects"}, response.Artifact)
+	entries := readWorkspaceTar(t, archive)
+	if got := entries["many/0299.txt"]; got != "content-0299\n" {
+		t.Fatalf("many/0299.txt = %q", got)
+	}
+	if got := entries["latest-many"]; got != "symlink:many/0000.txt" {
+		t.Fatalf("latest-many = %q", got)
+	}
+
+	data, err := os.ReadFile(commandLog)
+	if err != nil {
+		t.Fatal(err)
+	}
+	commands := strings.FieldsFunc(strings.TrimSpace(string(data)), func(value rune) bool { return value == '\n' })
+	var batchCommands, treeCommands, legacyObjectCommands int
+	for _, command := range commands {
+		switch {
+		case strings.Contains(command, " cat-file --batch"):
+			batchCommands++
+		case strings.Contains(command, " cat-file -s "), strings.Contains(command, " cat-file blob "):
+			legacyObjectCommands++
+		}
+		if strings.Contains(command, " ls-tree -lrz ") {
+			treeCommands++
+		}
+	}
+	if batchCommands != 1 || treeCommands != 1 || legacyObjectCommands != 0 {
+		t.Fatalf("Git object commands: batch=%d tree=%d legacy=%d\n%s", batchCommands, treeCommands, legacyObjectCommands, data)
+	}
+	if len(commands) > 16 {
+		t.Fatalf("workspace preparation spawned %d top-level Git processes for %d files, want at most 16\n%s", len(commands), fileCount, data)
+	}
+}
+
+func TestWorkspacePreparationCancelsBlockedBlobBatch(t *testing.T) {
+	repository := newRepositoryFixture(t, false)
+	gitBinary, err := exec.LookPath("git")
+	if err != nil {
+		t.Fatal(err)
+	}
+	gitBinary, err = filepath.Abs(gitBinary)
+	if err != nil {
+		t.Fatal(err)
+	}
+	marker := filepath.Join(t.TempDir(), "batch-requested")
+	wrapper := filepath.Join(t.TempDir(), "git-wrapper")
+	wrapperScript := fmt.Sprintf(`#!/bin/sh
+case " $*" in
+  *" cat-file --batch"*)
+    IFS= read -r object_id
+    : > %s
+    sleep 30
+    exit 1
+    ;;
+esac
+exec %s "$@"
+`, shellQuote(marker), shellQuote(gitBinary))
+	if err := os.WriteFile(wrapper, []byte(wrapperScript), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	runner, err := newGitRunner(wrapper, t.TempDir(), 4<<20, publisher.ProxyEnvironment{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	result := make(chan error, 1)
+	go func() {
+		archive, buildErr := buildWorkspaceArchive(
+			ctx, runner, repository.source.ID, repository.source.URL, testMainRef, repository.baselineOID,
+			WorkspaceLimits{MaxEntries: 1000, MaxFileBytes: 4 << 20, MaxExpandedBytes: 16 << 20, MaxArtifactBytes: 32 << 20, MaxPathBytes: 4096},
+		)
+		if archive.path != "" {
+			_ = os.Remove(archive.path)
+		}
+		result <- buildErr
+	}()
+
+	deadline := time.NewTimer(5 * time.Second)
+	poll := time.NewTicker(10 * time.Millisecond)
+	defer deadline.Stop()
+	defer poll.Stop()
+	requested := false
+	for !requested {
+		select {
+		case <-poll.C:
+			if _, statErr := os.Stat(marker); statErr == nil {
+				requested = true
+			}
+		case <-deadline.C:
+			cancel()
+			select {
+			case <-result:
+			case <-time.After(3 * time.Second):
+			}
+			t.Fatal("blob batch did not receive an object request")
+		}
+	}
+	cancel()
+	select {
+	case err := <-result:
+		if !errors.Is(err, context.Canceled) {
+			t.Fatalf("canceled workspace preparation error = %v", err)
+		}
+	case <-time.After(3 * time.Second):
+		t.Fatal("canceled blob batch did not terminate promptly")
+	}
+}
+
+func TestWorkspacePreparationClassifiesPrematureBatchExit(t *testing.T) {
+	repository := newRepositoryFixture(t, false)
+	gitBinary, err := exec.LookPath("git")
+	if err != nil {
+		t.Fatal(err)
+	}
+	gitBinary, err = filepath.Abs(gitBinary)
+	if err != nil {
+		t.Fatal(err)
+	}
+	wrapper := filepath.Join(t.TempDir(), "git-wrapper")
+	wrapperScript := fmt.Sprintf(`#!/bin/sh
+case " $*" in
+  *" cat-file --batch"*)
+    IFS= read -r object_id
+    exit 42
+    ;;
+esac
+exec %s "$@"
+`, shellQuote(gitBinary))
+	if err := os.WriteFile(wrapper, []byte(wrapperScript), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	runner, err := newGitRunner(wrapper, t.TempDir(), 4<<20, publisher.ProxyEnvironment{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	archive, err := buildWorkspaceArchive(
+		context.Background(), runner, repository.source.ID, repository.source.URL, testMainRef, repository.baselineOID,
+		WorkspaceLimits{MaxEntries: 1000, MaxFileBytes: 4 << 20, MaxExpandedBytes: 16 << 20, MaxArtifactBytes: 32 << 20, MaxPathBytes: 4096},
+	)
+	if archive.path != "" {
+		_ = os.Remove(archive.path)
+	}
+	var operationErr *operationError
+	if !errors.As(err, &operationErr) || operationErr.code != "scm_failure" || !operationErr.retryable {
+		t.Fatalf("premature batch exit error = %v, want retryable scm_failure", err)
+	}
+}
+
+func syntheticGitBlobBatch(
+	ctx context.Context,
+	input io.WriteCloser,
+	response string,
+	maxBytes int64,
+) *gitBlobBatch {
+	return &gitBlobBatch{
+		ctx: ctx, stdin: input, stdout: bufio.NewReaderSize(strings.NewReader(response), gitBatchHeaderLimit),
+		remainingBytes: maxBytes, remainingObjects: 1,
+	}
+}
+
+func assertOperationCode(t *testing.T, err error, code string) {
+	t.Helper()
+	var operationErr *operationError
+	if !errors.As(err, &operationErr) || operationErr.code != code {
+		t.Fatalf("error = %v, want operation code %q", err, code)
+	}
+}
diff --git a/internal/publisher/service/github_pr.go b/internal/publisher/service/github_pr.go
new file mode 100644
index 000000000..2919c84da
--- /dev/null
+++ b/internal/publisher/service/github_pr.go
@@ -0,0 +1,697 @@
+package service
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"mime"
+	"net/http"
+	"net/url"
+	"os"
+	"path"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/orka-agents/orka/internal/publisher"
+)
+
+const (
+	defaultGitHubAPIBaseURL          = "https://api.github.com"
+	defaultGitHubRequestTimeout      = 15 * time.Second
+	defaultGitHubMaxResponseBytes    = int64(4 << 20)
+	maxGitHubRequestTimeout          = 2 * time.Minute
+	maxGitHubResponseBytes           = int64(16 << 20)
+	maxGitHubAuthBytes               = int64(32 << 10)
+	maxGitHubRequestBytes            = int64(32 << 10)
+	maxGitHubReceiptURLBytes         = 2048
+	maxGitHubPullRequestCandidates   = 100
+	githubAPIVersion                 = "2026-03-10"
+	githubProvider                   = "github"
+	githubPullRequestStateOpen       = "open"
+	githubPullRequestStateClosed     = "closed"
+	githubIntentMarkerPrefix         = "<!-- orka.publisher.pr-intent.v1 key="
+	githubIntentMarkerSuffix         = " -->"
+	githubPullRequestTitlePrefix     = "Orka publication generation "
+	githubPullRequestBodyDescription = "Created by the Orka clean-room workspace publisher."
+)
+
+var githubRepositoryComponentPattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._-]{0,254}$`)
+
+// GitHubPRReconcilerFactoryConfig contains only non-secret GitHub REST client
+// configuration. Each reconciler receives its token from the operation-scoped
+// credential file passed to PRReconcilerFactory.New.
+type GitHubPRReconcilerFactoryConfig struct {
+	APIBaseURL       string
+	HTTPClient       *http.Client
+	RequestTimeout   time.Duration
+	MaxResponseBytes int64
+}
+
+// GitHubPRReconcilerFactory creates one short-lived reconciler per operation.
+// It never accepts a token in configuration or environment variables.
+type GitHubPRReconcilerFactory struct {
+	apiBaseURL       *url.URL
+	httpClient       *http.Client
+	requestTimeout   time.Duration
+	maxResponseBytes int64
+}
+
+// NewGitHubPRReconcilerFactory creates a strict GitHub REST factory. Redirects
+// are denied, every request has a hard deadline, and every response is bounded.
+func NewGitHubPRReconcilerFactory(config GitHubPRReconcilerFactoryConfig) (*GitHubPRReconcilerFactory, error) {
+	apiBaseURL, err := normalizeGitHubAPIBaseURL(config.APIBaseURL)
+	if err != nil {
+		return nil, err
+	}
+	requestTimeout := config.RequestTimeout
+	if requestTimeout == 0 {
+		requestTimeout = defaultGitHubRequestTimeout
+	}
+	if requestTimeout <= 0 || requestTimeout > maxGitHubRequestTimeout {
+		return nil, fmt.Errorf("GitHub request timeout must be between 1ns and %s", maxGitHubRequestTimeout)
+	}
+	maxResponseBytes := config.MaxResponseBytes
+	if maxResponseBytes == 0 {
+		maxResponseBytes = defaultGitHubMaxResponseBytes
+	}
+	if maxResponseBytes < 1 || maxResponseBytes > maxGitHubResponseBytes {
+		return nil, fmt.Errorf("GitHub response limit must be between 1 and %d bytes", maxGitHubResponseBytes)
+	}
+	client := strictGitHubHTTPClient(config.HTTPClient, requestTimeout)
+	return &GitHubPRReconcilerFactory{
+		apiBaseURL: apiBaseURL, httpClient: client, requestTimeout: requestTimeout, maxResponseBytes: maxResponseBytes,
+	}, nil
+}
+
+func (f *GitHubPRReconcilerFactory) New(ctx context.Context, credentialPath string) (publisher.PullRequestReconciler, error) {
+	if f == nil || f.apiBaseURL == nil || f.httpClient == nil {
+		return nil, apiError(ErrNotConfigured, "github_pr_not_configured", "GitHub pull request reconciliation is not configured", http.StatusServiceUnavailable, false, nil)
+	}
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
+	authorization, err := readGitHubOperationAuthorization(credentialPath)
+	if err != nil {
+		return nil, err
+	}
+	return &githubPRReconciler{
+		apiBaseURL: f.apiBaseURL, httpClient: f.httpClient, requestTimeout: f.requestTimeout,
+		maxResponseBytes: f.maxResponseBytes, authorization: authorization,
+	}, nil
+}
+
+func normalizeGitHubAPIBaseURL(raw string) (*url.URL, error) {
+	if raw == "" {
+		raw = defaultGitHubAPIBaseURL
+	}
+	if len(raw) > maxGitHubReceiptURLBytes || strings.TrimSpace(raw) != raw {
+		return nil, fmt.Errorf("GitHub API base URL is empty, non-canonical, or too long")
+	}
+	parsed, err := url.Parse(raw)
+	if err != nil || parsed.Scheme != schemeHTTPS || parsed.Host == "" || parsed.User != nil || parsed.RawQuery != "" ||
+		parsed.Fragment != "" || parsed.Opaque != "" || parsed.RawPath != "" {
+		return nil, fmt.Errorf("GitHub API base URL must be a credential-free HTTPS URL")
+	}
+	if parsed.Host != strings.ToLower(parsed.Host) {
+		return nil, fmt.Errorf("GitHub API base URL host must be lower-case")
+	}
+	if parsed.Path != "" && (path.Clean(parsed.Path) != parsed.Path || strings.HasSuffix(parsed.Path, "/")) {
+		return nil, fmt.Errorf("GitHub API base URL path must be clean and have no trailing slash")
+	}
+	return parsed, nil
+}
+
+func strictGitHubHTTPClient(configured *http.Client, timeout time.Duration) *http.Client {
+	client := &http.Client{}
+	if configured != nil {
+		*client = *configured
+	}
+	client.Timeout = timeout
+	client.Jar = nil
+	client.CheckRedirect = func(*http.Request, []*http.Request) error { return errGitHubRedirect }
+	if client.Transport == nil {
+		transport := http.DefaultTransport.(*http.Transport).Clone()
+		transport.ResponseHeaderTimeout = timeout
+		transport.TLSHandshakeTimeout = min(10*time.Second, timeout)
+		transport.MaxResponseHeaderBytes = 64 << 10
+		client.Transport = transport
+	} else if transport, ok := client.Transport.(*http.Transport); ok {
+		clone := transport.Clone()
+		clone.ResponseHeaderTimeout = timeout
+		clone.TLSHandshakeTimeout = min(10*time.Second, timeout)
+		clone.MaxResponseHeaderBytes = 64 << 10
+		client.Transport = clone
+	}
+	return client
+}
+
+var errGitHubRedirect = errors.New("GitHub REST redirects are forbidden")
+
+func readGitHubOperationAuthorization(credentialPath string) (string, error) {
+	if credentialPath == "" {
+		return "", apiError(ErrCredential, "forge_credential_required", "GitHub pull request reconciliation requires an operation-scoped forge credential", http.StatusBadRequest, false, nil)
+	}
+	if !pathIsAbsoluteClean(credentialPath) {
+		return "", apiError(ErrCredential, "forge_credential_unavailable", "operation-scoped forge credential is unavailable", http.StatusServiceUnavailable, false, nil)
+	}
+	info, err := os.Lstat(credentialPath)
+	if err != nil || info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() || info.Size() < 1 ||
+		info.Size() > maxGitHubAuthBytes || info.Mode().Perm()&0o077 != 0 {
+		return "", apiError(ErrCredential, "forge_credential_unavailable", "operation-scoped forge credential is unavailable", http.StatusServiceUnavailable, false, nil)
+	}
+	value, err := os.ReadFile(credentialPath)
+	if err != nil {
+		return "", apiError(ErrCredential, "forge_credential_unavailable", "operation-scoped forge credential is unavailable", http.StatusServiceUnavailable, true, nil)
+	}
+	if len(value) < 8 || int64(len(value)) > maxGitHubAuthBytes || bytes.ContainsAny(value, "\r\n\x00") ||
+		string(value) != strings.TrimSpace(string(value)) || !isVisibleASCII(value) {
+		return "", apiError(ErrCredential, "forge_credential_invalid", "operation-scoped forge credential is invalid", http.StatusBadRequest, false, nil)
+	}
+	return string(value), nil
+}
+
+func isVisibleASCII(value []byte) bool {
+	for _, current := range value {
+		if current < 0x21 || current > 0x7e {
+			return false
+		}
+	}
+	return true
+}
+
+func pathIsAbsoluteClean(value string) bool {
+	return filepath.IsAbs(value) && filepath.Clean(value) == value
+}
+
+type githubPRReconciler struct {
+	apiBaseURL       *url.URL
+	httpClient       *http.Client
+	requestTimeout   time.Duration
+	maxResponseBytes int64
+	authorization    string
+}
+
+type githubRepositoryIntent struct {
+	owner        string
+	name         string
+	fullName     string
+	branch       string
+	repositoryID string
+	htmlURL      string
+	cloneURL     string
+}
+
+type githubRepository struct {
+	ID       int64  `json:"id"`
+	NodeID   string `json:"node_id"`
+	FullName string `json:"full_name"`
+	HTMLURL  string `json:"html_url"`
+	CloneURL string `json:"clone_url"`
+}
+
+type githubResolvedRepository struct {
+	intent githubRepositoryIntent
+	api    githubRepository
+}
+
+type githubPullRequest struct {
+	Number   int64                `json:"number"`
+	HTMLURL  string               `json:"html_url"`
+	State    string               `json:"state"`
+	MergedAt *string              `json:"merged_at"`
+	Body     *string              `json:"body"`
+	Head     githubPullRequestRef `json:"head"`
+	Base     githubPullRequestRef `json:"base"`
+}
+
+type githubPullRequestRef struct {
+	Ref  string            `json:"ref"`
+	SHA  string            `json:"sha"`
+	Repo *githubRepository `json:"repo"`
+}
+
+type githubGitRef struct {
+	Ref    string `json:"ref"`
+	Object struct {
+		Type string `json:"type"`
+		SHA  string `json:"sha"`
+	} `json:"object"`
+}
+
+type githubCreatePullRequest struct {
+	Title               string `json:"title"`
+	Body                string `json:"body"`
+	Head                string `json:"head"`
+	HeadRepository      string `json:"head_repo,omitempty"`
+	Base                string `json:"base"`
+	Draft               bool   `json:"draft"`
+	MaintainerCanModify bool   `json:"maintainer_can_modify"`
+}
+
+func (r *githubPRReconciler) Reconcile(ctx context.Context, intent publisher.PullRequestIntent) (publisher.PullRequestReceipt, error) {
+	intentKey, err := intent.Key()
+	if err != nil {
+		return publisher.PullRequestReceipt{}, err
+	}
+	if err := ctx.Err(); err != nil {
+		return publisher.PullRequestReceipt{}, err
+	}
+	baseIntent, err := parseGitHubRepositoryIntent(intent.BaseRepository, intent.BaseRef)
+	if err != nil {
+		return publisher.PullRequestReceipt{}, err
+	}
+	headIntent, err := parseGitHubRepositoryIntent(intent.HeadRepository, intent.HeadRef)
+	if err != nil {
+		return publisher.PullRequestReceipt{}, err
+	}
+	if baseIntent.repositoryID == headIntent.repositoryID && baseIntent.branch == headIntent.branch {
+		return publisher.PullRequestReceipt{}, &publisher.Error{
+			Kind: publisher.ErrInvalidRequest, Operation: "validate GitHub pull request", Detail: "base and head cannot be the same repository and ref",
+		}
+	}
+	base, err := r.resolveRepository(ctx, baseIntent)
+	if err != nil {
+		return publisher.PullRequestReceipt{}, translateGitHubAPIError(err)
+	}
+	head := base
+	if base.intent.repositoryID != headIntent.repositoryID {
+		head, err = r.resolveRepository(ctx, headIntent)
+		if err != nil {
+			return publisher.PullRequestReceipt{}, translateGitHubAPIError(err)
+		}
+	} else {
+		if err := verifyGitHubRepository(headIntent, &base.api); err != nil {
+			return publisher.PullRequestReceipt{}, err
+		}
+		head.intent = headIntent
+	}
+	receipt, found, err := r.lookup(ctx, intent, intentKey, base, head)
+	if err != nil {
+		return publisher.PullRequestReceipt{}, translateGitHubAPIError(err)
+	}
+	if found {
+		return receipt, nil
+	}
+	if err := r.verifyHead(ctx, head, intent.ExpectedHeadOID); err != nil {
+		return publisher.PullRequestReceipt{}, translateGitHubAPIError(err)
+	}
+	created, err := r.create(ctx, intent, intentKey, base, head)
+	if err != nil {
+		if githubCreateMayHaveSucceeded(err) {
+			if recovered, ok, lookupErr := r.lookup(ctx, intent, intentKey, base, head); lookupErr == nil && ok {
+				return recovered, nil
+			} else if lookupErr != nil && !isGitHubAPIError(lookupErr) {
+				return publisher.PullRequestReceipt{}, lookupErr
+			}
+		}
+		return publisher.PullRequestReceipt{}, translateGitHubAPIError(err)
+	}
+	receipt, err = r.receiptForCandidate(intent, intentKey, base, head, created, true)
+	if err == nil {
+		if verifyErr := r.verifyHead(ctx, head, intent.ExpectedHeadOID); verifyErr != nil {
+			return publisher.PullRequestReceipt{}, translateGitHubAPIError(verifyErr)
+		}
+		return receipt, nil
+	}
+	if recovered, ok, lookupErr := r.lookup(ctx, intent, intentKey, base, head); lookupErr == nil && ok {
+		return recovered, nil
+	}
+	return publisher.PullRequestReceipt{}, err
+}
+
+func parseGitHubRepositoryIntent(repository publisher.Repository, ref string) (githubRepositoryIntent, error) {
+	if repository.Provider != githubProvider {
+		return githubRepositoryIntent{}, githubInvalidRepository("repository provider is not github")
+	}
+	parsed, err := url.Parse(repository.URL)
+	if err != nil || parsed.Scheme != schemeHTTPS || parsed.Host == "" || parsed.User != nil || parsed.RawQuery != "" ||
+		parsed.Fragment != "" || parsed.Opaque != "" || parsed.RawPath != "" {
+		return githubRepositoryIntent{}, githubInvalidRepository("repository URL is not a credential-free canonical HTTPS URL")
+	}
+	trimmed := strings.TrimPrefix(parsed.Path, "/")
+	trimmed = strings.TrimSuffix(trimmed, ".git")
+	components := strings.Split(trimmed, "/")
+	if len(components) != 2 || !githubRepositoryComponentPattern.MatchString(components[0]) || !githubRepositoryComponentPattern.MatchString(components[1]) {
+		return githubRepositoryIntent{}, githubInvalidRepository("repository URL must contain exactly one owner and repository name")
+	}
+	fullName := components[0] + "/" + components[1]
+	host := parsed.Host
+	if parsed.Port() == "443" {
+		host = parsed.Hostname()
+		if strings.Contains(host, ":") {
+			host = "[" + host + "]"
+		}
+	}
+	htmlURL := (&url.URL{Scheme: schemeHTTPS, Host: host, Path: "/" + fullName}).String()
+	cloneURL := htmlURL + ".git"
+	canonicalInputURL := (&url.URL{Scheme: schemeHTTPS, Host: host, Path: parsed.Path}).String()
+	if canonicalInputURL != htmlURL && canonicalInputURL != cloneURL {
+		return githubRepositoryIntent{}, githubInvalidRepository("repository URL is not canonical for its identity")
+	}
+	branch := strings.TrimPrefix(ref, "refs/heads/")
+	if branch == ref || branch == "" {
+		return githubRepositoryIntent{}, &publisher.Error{Kind: publisher.ErrInvalidRef, Operation: "validate GitHub branch", Detail: "branch must be a canonical full heads ref"}
+	}
+	return githubRepositoryIntent{
+		owner: components[0], name: components[1], fullName: fullName, branch: branch,
+		repositoryID: repository.ID, htmlURL: htmlURL, cloneURL: cloneURL,
+	}, nil
+}
+
+func githubInvalidRepository(detail string) error {
+	return &publisher.Error{Kind: publisher.ErrInvalidRepository, Operation: "validate GitHub repository", Detail: detail}
+}
+
+func githubConflict(detail string) error {
+	return &publisher.Error{Kind: publisher.ErrIdempotencyConflict, Operation: "reconcile GitHub pull request", Detail: detail}
+}
+
+func (r *githubPRReconciler) resolveRepository(ctx context.Context, intent githubRepositoryIntent) (githubResolvedRepository, error) {
+	var response githubRepository
+	if err := r.doJSON(ctx, http.MethodGet, r.endpoint("/repos/"+intent.owner+"/"+intent.name, nil), nil, &response, http.StatusOK); err != nil {
+		return githubResolvedRepository{}, err
+	}
+	if err := verifyGitHubRepository(intent, &response); err != nil {
+		return githubResolvedRepository{}, err
+	}
+	return githubResolvedRepository{intent: intent, api: response}, nil
+}
+
+func verifyGitHubRepository(expected githubRepositoryIntent, actual *githubRepository) error {
+	if actual == nil || actual.ID < 1 || !strings.EqualFold(actual.FullName, expected.fullName) ||
+		!strings.EqualFold(actual.HTMLURL, expected.htmlURL) || !strings.EqualFold(actual.CloneURL, expected.cloneURL) ||
+		len(actual.NodeID) < 1 || len(actual.NodeID) > 512 {
+		return githubConflict("GitHub repository identity does not match the persisted canonical repository")
+	}
+	parsedURL, err := url.Parse(expected.htmlURL)
+	if err != nil {
+		return githubConflict("GitHub repository canonical URL could not be interpreted")
+	}
+	canonicalURLID := strings.ToLower(parsedURL.Hostname()) + "/" + expected.fullName
+	if expected.repositoryID != actual.NodeID && expected.repositoryID != strconv.FormatInt(actual.ID, 10) && expected.repositoryID != canonicalURLID {
+		return githubConflict("GitHub repository ID does not match the persisted provider-stable or canonical URL identity")
+	}
+	return nil
+}
+
+func (r *githubPRReconciler) lookup(
+	ctx context.Context,
+	intent publisher.PullRequestIntent,
+	intentKey string,
+	base, head githubResolvedRepository,
+) (publisher.PullRequestReceipt, bool, error) {
+	query := url.Values{
+		"state":    {"all"},
+		"head":     {head.intent.owner + ":" + head.intent.branch},
+		"base":     {base.intent.branch},
+		"per_page": {strconv.Itoa(maxGitHubPullRequestCandidates)},
+	}
+	var candidates []githubPullRequest
+	headers, err := r.doJSONWithHeaders(
+		ctx, http.MethodGet, r.endpoint("/repos/"+base.intent.owner+"/"+base.intent.name+"/pulls", query), nil, &candidates, http.StatusOK,
+	)
+	if err != nil {
+		return publisher.PullRequestReceipt{}, false, err
+	}
+	if hasGitHubNextPage(headers.Get("Link")) {
+		return publisher.PullRequestReceipt{}, false, githubConflict("GitHub pull request candidate history exceeds the reconciliation bound")
+	}
+	marker := githubIntentMarker(intentKey)
+	exact := make([]githubPullRequest, 0, 1)
+	unrelatedOpen := false
+	for i := range candidates {
+		candidate := candidates[i]
+		claimed := candidate.Body != nil && strings.Contains(*candidate.Body, marker)
+		marked := candidate.Body != nil && githubBodyHasIntentMarker(*candidate.Body, marker)
+		if claimed && !marked {
+			return publisher.PullRequestReceipt{}, false, githubConflict("a pull request contains a malformed or duplicate exact intent marker")
+		}
+		matches := githubCandidateMatchesRepositoriesAndRefs(candidate, base, head)
+		if marked {
+			if !matches {
+				return publisher.PullRequestReceipt{}, false, githubConflict("a pull request carrying the exact intent marker has mismatched repositories or refs")
+			}
+			if candidate.Head.SHA != intent.ExpectedHeadOID {
+				return publisher.PullRequestReceipt{}, false, githubConflict("the exact pull request intent has a different head SHA")
+			}
+			exact = append(exact, candidate)
+			continue
+		}
+		if matches {
+			state, stateErr := githubPullRequestState(candidate)
+			if stateErr != nil {
+				return publisher.PullRequestReceipt{}, false, stateErr
+			}
+			if state == publisher.PullRequestOpen {
+				unrelatedOpen = true
+			}
+		}
+	}
+	if len(exact) > 1 {
+		return publisher.PullRequestReceipt{}, false, githubConflict("multiple pull requests claim the exact immutable intent")
+	}
+	if len(exact) == 1 {
+		receipt, receiptErr := r.receiptForCandidate(intent, intentKey, base, head, exact[0], false)
+		return receipt, receiptErr == nil, receiptErr
+	}
+	if unrelatedOpen {
+		return publisher.PullRequestReceipt{}, false, githubConflict("an unrelated open pull request already uses the exact head and base repositories and refs")
+	}
+	return publisher.PullRequestReceipt{}, false, nil
+}
+
+func githubCandidateMatchesRepositoriesAndRefs(candidate githubPullRequest, base, head githubResolvedRepository) bool {
+	return candidate.Base.Ref == base.intent.branch && candidate.Head.Ref == head.intent.branch &&
+		githubRepositoryMatches(candidate.Base.Repo, base) && githubRepositoryMatches(candidate.Head.Repo, head)
+}
+
+func githubRepositoryMatches(candidate *githubRepository, expected githubResolvedRepository) bool {
+	return candidate != nil && candidate.ID == expected.api.ID && candidate.NodeID == expected.api.NodeID &&
+		strings.EqualFold(candidate.FullName, expected.api.FullName) && strings.EqualFold(candidate.HTMLURL, expected.api.HTMLURL) &&
+		strings.EqualFold(candidate.CloneURL, expected.api.CloneURL)
+}
+
+func githubPullRequestState(candidate githubPullRequest) (publisher.PullRequestState, error) {
+	switch candidate.State {
+	case githubPullRequestStateOpen:
+		if candidate.MergedAt != nil {
+			return "", githubConflict("GitHub reported an open pull request as merged")
+		}
+		return publisher.PullRequestOpen, nil
+	case githubPullRequestStateClosed:
+		if candidate.MergedAt != nil {
+			return publisher.PullRequestMerged, nil
+		}
+		return publisher.PullRequestClosed, nil
+	default:
+		return "", githubConflict("GitHub returned an unsupported pull request state")
+	}
+}
+
+func (r *githubPRReconciler) receiptForCandidate(
+	intent publisher.PullRequestIntent,
+	intentKey string,
+	base, head githubResolvedRepository,
+	candidate githubPullRequest,
+	requireOpen bool,
+) (publisher.PullRequestReceipt, error) {
+	if candidate.Body == nil || !githubBodyHasIntentMarker(*candidate.Body, githubIntentMarker(intentKey)) ||
+		!githubCandidateMatchesRepositoriesAndRefs(candidate, base, head) || candidate.Head.SHA != intent.ExpectedHeadOID {
+		return publisher.PullRequestReceipt{}, githubConflict("GitHub pull request does not match the exact immutable intent")
+	}
+	state, err := githubPullRequestState(candidate)
+	if err != nil {
+		return publisher.PullRequestReceipt{}, err
+	}
+	if requireOpen && state != publisher.PullRequestOpen {
+		return publisher.PullRequestReceipt{}, githubConflict("newly created GitHub pull request is not open")
+	}
+	if candidate.Number < 1 {
+		return publisher.PullRequestReceipt{}, githubConflict("GitHub pull request number is invalid")
+	}
+	expectedURL := base.intent.htmlURL + "/pull/" + strconv.FormatInt(candidate.Number, 10)
+	if !strings.EqualFold(candidate.HTMLURL, expectedURL) || len(expectedURL) > maxGitHubReceiptURLBytes {
+		return publisher.PullRequestReceipt{}, githubConflict("GitHub pull request URL is not canonical")
+	}
+	forgeID := "github:" + strconv.FormatInt(base.api.ID, 10) + ":" + strconv.FormatInt(candidate.Number, 10)
+	if len(forgeID) > 128 {
+		return publisher.PullRequestReceipt{}, githubConflict("GitHub pull request identity exceeds the receipt bound")
+	}
+	return publisher.PullRequestReceipt{
+		IntentKey: intentKey, ForgeID: forgeID, URL: expectedURL, State: state, HeadOID: intent.ExpectedHeadOID,
+	}, nil
+}
+
+func (r *githubPRReconciler) verifyHead(ctx context.Context, head githubResolvedRepository, expectedOID string) error {
+	var response githubGitRef
+	endpoint := "/repos/" + head.intent.owner + "/" + head.intent.name + "/git/ref/heads/" + head.intent.branch
+	if err := r.doJSON(ctx, http.MethodGet, r.endpoint(endpoint, nil), nil, &response, http.StatusOK); err != nil {
+		return err
+	}
+	if response.Ref != "refs/heads/"+head.intent.branch || response.Object.Type != "commit" || response.Object.SHA != expectedOID {
+		return githubConflict("GitHub head ref does not equal the persisted expected head SHA")
+	}
+	return nil
+}
+
+func (r *githubPRReconciler) create(
+	ctx context.Context,
+	intent publisher.PullRequestIntent,
+	intentKey string,
+	base, head githubResolvedRepository,
+) (githubPullRequest, error) {
+	request := githubCreatePullRequest{
+		Title: githubPullRequestTitlePrefix + strconv.FormatInt(intent.PublicationGeneration, 10),
+		Body:  githubPullRequestBody(intent.PublicationGeneration, intentKey),
+		Head:  head.intent.owner + ":" + head.intent.branch,
+		Base:  base.intent.branch, Draft: false, MaintainerCanModify: false,
+	}
+	if base.api.ID != head.api.ID {
+		request.HeadRepository = head.intent.name
+	}
+	var response githubPullRequest
+	err := r.doJSON(
+		ctx, http.MethodPost, r.endpoint("/repos/"+base.intent.owner+"/"+base.intent.name+"/pulls", nil), request, &response, http.StatusCreated,
+	)
+	return response, err
+}
+
+func githubIntentMarker(intentKey string) string {
+	return githubIntentMarkerPrefix + intentKey + githubIntentMarkerSuffix
+}
+
+func githubBodyHasIntentMarker(body, marker string) bool {
+	return strings.Count(body, marker) == 1 && (body == marker || strings.HasSuffix(body, "\n\n"+marker))
+}
+
+func githubPullRequestBody(generation int64, intentKey string) string {
+	return githubPullRequestBodyDescription + "\n\nPublication generation: " + strconv.FormatInt(generation, 10) + "\n\n" + githubIntentMarker(intentKey)
+}
+
+type githubAPIRequestError struct {
+	retryable        bool
+	mayHaveSucceeded bool
+}
+
+func (e *githubAPIRequestError) Error() string { return "GitHub REST API request failed" }
+
+func isGitHubAPIError(err error) bool {
+	var target *githubAPIRequestError
+	return errors.As(err, &target)
+}
+
+func githubCreateMayHaveSucceeded(err error) bool {
+	var target *githubAPIRequestError
+	return errors.As(err, &target) && target.mayHaveSucceeded
+}
+
+func translateGitHubAPIError(err error) error {
+	if err == nil || !isGitHubAPIError(err) {
+		return err
+	}
+	var apiErr *githubAPIRequestError
+	_ = errors.As(err, &apiErr)
+	return apiError(
+		ErrSCMTransport, "github_api_error", "GitHub REST API request failed", http.StatusBadGateway, apiErr.retryable, nil,
+	)
+}
+
+func (r *githubPRReconciler) endpoint(suffix string, query url.Values) string {
+	result := *r.apiBaseURL
+	result.Path = strings.TrimSuffix(result.Path, "/") + suffix
+	result.RawQuery = query.Encode()
+	return result.String()
+}
+
+func (r *githubPRReconciler) doJSON(
+	ctx context.Context,
+	method, endpoint string,
+	input, output any,
+	expectedStatus int,
+) error {
+	_, err := r.doJSONWithHeaders(ctx, method, endpoint, input, output, expectedStatus)
+	return err
+}
+
+func (r *githubPRReconciler) doJSONWithHeaders(
+	ctx context.Context,
+	method, endpoint string,
+	input, output any,
+	expectedStatus int,
+) (http.Header, error) {
+	requestCtx, cancel := context.WithTimeout(ctx, r.requestTimeout)
+	defer cancel()
+	var body io.Reader
+	if input != nil {
+		encoded, err := json.Marshal(input)
+		if err != nil || int64(len(encoded)) > maxGitHubRequestBytes {
+			return nil, &githubAPIRequestError{}
+		}
+		body = bytes.NewReader(encoded)
+	}
+	request, err := http.NewRequestWithContext(requestCtx, method, endpoint, body)
+	if err != nil {
+		return nil, &githubAPIRequestError{}
+	}
+	request.Header.Set("Accept", "application/vnd.github+json")
+	request.Header.Set("Authorization", "Bearer "+r.authorization)
+	request.Header.Set("User-Agent", "orka-workspace-publisher")
+	request.Header.Set("X-GitHub-Api-Version", githubAPIVersion)
+	if input != nil {
+		request.Header.Set("Content-Type", "application/json")
+	}
+	response, err := r.httpClient.Do(request)
+	if err != nil {
+		if ctx.Err() != nil {
+			return nil, ctx.Err()
+		}
+		return nil, &githubAPIRequestError{retryable: !errors.Is(err, errGitHubRedirect), mayHaveSucceeded: method == http.MethodPost && !errors.Is(err, errGitHubRedirect)}
+	}
+	defer response.Body.Close() //nolint:errcheck
+	limited := io.LimitReader(response.Body, r.maxResponseBytes+1)
+	data, readErr := io.ReadAll(limited)
+	if readErr != nil || int64(len(data)) > r.maxResponseBytes {
+		return nil, &githubAPIRequestError{retryable: readErr != nil || method == http.MethodPost, mayHaveSucceeded: method == http.MethodPost}
+	}
+	if response.StatusCode != expectedStatus {
+		mayHaveSucceeded := method == http.MethodPost && (response.StatusCode == http.StatusConflict || response.StatusCode == http.StatusUnprocessableEntity ||
+			response.StatusCode == http.StatusTooManyRequests || response.StatusCode >= http.StatusInternalServerError)
+		rateLimited := response.StatusCode == http.StatusTooManyRequests || (response.StatusCode == http.StatusForbidden &&
+			(response.Header.Get("Retry-After") != "" || response.Header.Get("X-RateLimit-Remaining") == "0"))
+		return nil, &githubAPIRequestError{
+			retryable:        rateLimited || response.StatusCode >= http.StatusInternalServerError || mayHaveSucceeded,
+			mayHaveSucceeded: mayHaveSucceeded,
+		}
+	}
+	mediaType, _, mediaErr := mime.ParseMediaType(response.Header.Get("Content-Type"))
+	if mediaErr != nil || (mediaType != "application/json" && mediaType != "application/vnd.github+json") {
+		return nil, &githubAPIRequestError{retryable: method == http.MethodPost, mayHaveSucceeded: method == http.MethodPost}
+	}
+	if len(data) == 0 {
+		return nil, &githubAPIRequestError{retryable: method == http.MethodPost, mayHaveSucceeded: method == http.MethodPost}
+	}
+	decoder := json.NewDecoder(bytes.NewReader(data))
+	if err := decoder.Decode(output); err != nil {
+		return nil, &githubAPIRequestError{retryable: method == http.MethodPost, mayHaveSucceeded: method == http.MethodPost}
+	}
+	var trailing any
+	if err := decoder.Decode(&trailing); !errors.Is(err, io.EOF) {
+		return nil, &githubAPIRequestError{retryable: method == http.MethodPost, mayHaveSucceeded: method == http.MethodPost}
+	}
+	return response.Header.Clone(), nil
+}
+
+func hasGitHubNextPage(link string) bool {
+	for part := range strings.SplitSeq(link, ",") {
+		if strings.Contains(part, `rel="next"`) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/publisher/service/github_pr_test.go b/internal/publisher/service/github_pr_test.go
new file mode 100644
index 000000000..9e761a165
--- /dev/null
+++ b/internal/publisher/service/github_pr_test.go
@@ -0,0 +1,680 @@
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/orka-agents/orka/internal/publisher"
+)
+
+const (
+	githubTestAuthorization = "test-operation-token-not-a-secret"
+	githubTestHost          = "github.example"
+	githubTestSHA           = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+	githubTestBaseBranch    = "main"
+)
+
+type githubPRTestScenario struct {
+	mu sync.Mutex
+
+	base githubRepository
+	head githubRepository
+
+	listStatus   int
+	list         []githubPullRequest
+	listLink     string
+	headSHA      string
+	createStatus int
+	create       githubPullRequest
+
+	requests []string
+	created  []githubCreatePullRequest
+}
+
+func newGitHubPRTestScenario(t *testing.T) *githubPRTestScenario {
+	t.Helper()
+	return &githubPRTestScenario{
+		base:         githubTestRepository(101, "acme/base"),
+		head:         githubTestRepository(202, "bot/fork"),
+		listStatus:   http.StatusOK,
+		headSHA:      githubTestSHA,
+		createStatus: http.StatusCreated,
+	}
+}
+
+func (s *githubPRTestScenario) handler(t *testing.T) http.Handler {
+	t.Helper()
+	return http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		if got := request.Header.Get("Authorization"); got != "Bearer "+githubTestAuthorization {
+			t.Errorf("Authorization = %q", got)
+		}
+		if got := request.Header.Get("X-GitHub-Api-Version"); got != githubAPIVersion {
+			t.Errorf("X-GitHub-Api-Version = %q", got)
+		}
+		if got := request.Header.Get("Accept"); got != "application/vnd.github+json" {
+			t.Errorf("Accept = %q", got)
+		}
+
+		s.mu.Lock()
+		s.requests = append(s.requests, request.Method+" "+request.URL.RequestURI())
+		s.mu.Unlock()
+
+		switch request.Method + " " + request.URL.Path {
+		case http.MethodGet + " /repos/acme/base":
+			writeGitHubTestJSON(t, writer, http.StatusOK, s.base)
+		case http.MethodGet + " /repos/bot/fork":
+			writeGitHubTestJSON(t, writer, http.StatusOK, s.head)
+		case http.MethodGet + " /repos/acme/base/pulls":
+			if request.URL.Query().Get("state") != "all" || request.URL.Query().Get("head") != "bot:orka-change" ||
+				request.URL.Query().Get("base") != githubTestBaseBranch || request.URL.Query().Get("per_page") != "100" {
+				t.Errorf("pull request query = %q", request.URL.RawQuery)
+			}
+			s.mu.Lock()
+			status, link := s.listStatus, s.listLink
+			value := append([]githubPullRequest(nil), s.list...)
+			s.mu.Unlock()
+			if link != "" {
+				writer.Header().Set("Link", link)
+			}
+			writeGitHubTestJSON(t, writer, status, value)
+		case http.MethodGet + " /repos/bot/fork/git/ref/heads/orka-change":
+			s.mu.Lock()
+			sha := s.headSHA
+			s.mu.Unlock()
+			value := githubGitRef{Ref: "refs/heads/orka-change"}
+			value.Object.Type = "commit"
+			value.Object.SHA = sha
+			writeGitHubTestJSON(t, writer, http.StatusOK, value)
+		case http.MethodPost + " /repos/acme/base/pulls":
+			var value githubCreatePullRequest
+			if err := json.NewDecoder(request.Body).Decode(&value); err != nil {
+				t.Errorf("decode create request: %v", err)
+			}
+			s.mu.Lock()
+			s.created = append(s.created, value)
+			status, response := s.createStatus, s.create
+			s.mu.Unlock()
+			writeGitHubTestJSON(t, writer, status, response)
+		default:
+			t.Errorf("unexpected GitHub request %s %s", request.Method, request.URL.RequestURI())
+			writeGitHubTestJSON(t, writer, http.StatusNotFound, map[string]string{"message": "not found"})
+		}
+	})
+}
+
+func (s *githubPRTestScenario) requestSnapshot() []string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return append([]string(nil), s.requests...)
+}
+
+func (s *githubPRTestScenario) createSnapshot() []githubCreatePullRequest {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return append([]githubCreatePullRequest(nil), s.created...)
+}
+
+func TestGitHubPRReconcilerCreatesExactPullRequest(t *testing.T) {
+	t.Parallel()
+	scenario := newGitHubPRTestScenario(t)
+	intent := githubTestIntent()
+	key, err := intent.Key()
+	if err != nil {
+		t.Fatal(err)
+	}
+	scenario.create = githubTestPullRequest(scenario.base, scenario.head, 17, publisher.PullRequestOpen, githubTestSHA, githubIntentMarker(key))
+	reconciler := newGitHubTestReconciler(t, scenario.handler(t))
+
+	receipt, err := publisher.ReconcilePullRequest(context.Background(), intent, reconciler)
+	if err != nil {
+		t.Fatalf("ReconcilePullRequest: %v", err)
+	}
+	if receipt.IntentKey != key || receipt.ForgeID != "github:101:17" || receipt.URL != "https://github.example/acme/base/pull/17" ||
+		receipt.State != publisher.PullRequestOpen || receipt.HeadOID != githubTestSHA {
+		t.Fatalf("receipt = %#v", receipt)
+	}
+	created := scenario.createSnapshot()
+	if len(created) != 1 {
+		t.Fatalf("create requests = %#v", created)
+	}
+	request := created[0]
+	if request.Title != "Orka publication generation 7" || request.Head != "bot:orka-change" || request.HeadRepository != "fork" ||
+		request.Base != "main" || request.Draft || request.MaintainerCanModify || request.Body != githubPullRequestBody(7, key) {
+		t.Fatalf("create request = %#v", request)
+	}
+	if strings.Contains(request.Body, githubTestAuthorization) {
+		t.Fatal("create body contains the operation credential")
+	}
+	wantRequests := []string{
+		"GET /repos/acme/base", "GET /repos/bot/fork",
+		"GET /repos/acme/base/pulls?base=main&head=bot%3Aorka-change&per_page=100&state=all",
+		"GET /repos/bot/fork/git/ref/heads/orka-change", "POST /repos/acme/base/pulls",
+		"GET /repos/bot/fork/git/ref/heads/orka-change",
+	}
+	if got := scenario.requestSnapshot(); !slices.Equal(got, wantRequests) {
+		t.Fatalf("requests = %#v, want %#v", got, wantRequests)
+	}
+}
+
+func TestGitHubPRReconcilerNormalizesDefaultPortAndRepositoryCase(t *testing.T) {
+	t.Parallel()
+	intent := githubTestIntent()
+	intent.BaseRepository.URL = "https://github.example:443/ACME/BASE.git"
+	intent.HeadRepository.URL = "https://github.example:443/BOT/FORK.git"
+	intentKey, err := intent.Key()
+	if err != nil {
+		t.Fatal(err)
+	}
+	base := githubTestRepository(101, "acme/base")
+	head := githubTestRepository(202, "bot/fork")
+	created := githubTestPullRequest(base, head, 17, publisher.PullRequestOpen, githubTestSHA, githubIntentMarker(intentKey))
+	handler := http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		switch request.Method + " " + strings.ToLower(request.URL.Path) {
+		case http.MethodGet + " /repos/acme/base":
+			writeGitHubTestJSON(t, writer, http.StatusOK, base)
+		case http.MethodGet + " /repos/bot/fork":
+			writeGitHubTestJSON(t, writer, http.StatusOK, head)
+		case http.MethodGet + " /repos/acme/base/pulls":
+			writeGitHubTestJSON(t, writer, http.StatusOK, []githubPullRequest(nil))
+		case http.MethodGet + " /repos/bot/fork/git/ref/heads/orka-change":
+			writeGitHubTestJSON(t, writer, http.StatusOK, githubGitRef{
+				Ref: "refs/heads/orka-change",
+				Object: struct {
+					Type string `json:"type"`
+					SHA  string `json:"sha"`
+				}{Type: "commit", SHA: githubTestSHA},
+			})
+		case http.MethodPost + " /repos/acme/base/pulls":
+			writeGitHubTestJSON(t, writer, http.StatusCreated, created)
+		default:
+			t.Errorf("unexpected GitHub request %s %s", request.Method, request.URL.RequestURI())
+			writeGitHubTestJSON(t, writer, http.StatusNotFound, map[string]string{"message": "not found"})
+		}
+	})
+	reconciler := newGitHubTestReconciler(t, handler)
+
+	receipt, err := publisher.ReconcilePullRequest(context.Background(), intent, reconciler)
+	if err != nil {
+		t.Fatalf("ReconcilePullRequest: %v", err)
+	}
+	if strings.Contains(receipt.URL, ":443") || !strings.EqualFold(receipt.URL, "https://github.example/acme/base/pull/17") {
+		t.Fatalf("receipt URL = %q, want normalized canonical repository URL", receipt.URL)
+	}
+}
+
+func TestGitHubPRReconcilerAcceptsCanonicalURLRepositoryIdentity(t *testing.T) {
+	t.Parallel()
+	scenario := newGitHubPRTestScenario(t)
+	intent := githubTestIntent()
+	intent.BaseRepository.ID = githubTestHost + "/" + scenario.base.FullName
+	intent.HeadRepository.ID = githubTestHost + "/" + scenario.head.FullName
+	key, err := intent.Key()
+	if err != nil {
+		t.Fatal(err)
+	}
+	scenario.list = []githubPullRequest{
+		githubTestPullRequest(scenario.base, scenario.head, 23, publisher.PullRequestOpen, githubTestSHA, githubIntentMarker(key)),
+	}
+	reconciler := newGitHubTestReconciler(t, scenario.handler(t))
+
+	receipt, err := publisher.ReconcilePullRequest(context.Background(), intent, reconciler)
+	if err != nil {
+		t.Fatalf("ReconcilePullRequest: %v", err)
+	}
+	if receipt.ForgeID != "github:101:23" || receipt.State != publisher.PullRequestOpen {
+		t.Fatalf("receipt = %#v", receipt)
+	}
+}
+
+func TestGitHubPRReconcilerReturnsExactExistingOpenPullRequest(t *testing.T) {
+	t.Parallel()
+	scenario := newGitHubPRTestScenario(t)
+	intent := githubTestIntent()
+	key, _ := intent.Key()
+	scenario.list = []githubPullRequest{
+		githubTestPullRequest(scenario.base, scenario.head, 42, publisher.PullRequestOpen, githubTestSHA, githubIntentMarker(key)),
+	}
+	reconciler := newGitHubTestReconciler(t, scenario.handler(t))
+
+	receipt, err := publisher.ReconcilePullRequest(context.Background(), intent, reconciler)
+	if err != nil {
+		t.Fatalf("ReconcilePullRequest: %v", err)
+	}
+	if receipt.ForgeID != "github:101:42" || receipt.State != publisher.PullRequestOpen {
+		t.Fatalf("receipt = %#v", receipt)
+	}
+	if created := scenario.createSnapshot(); len(created) != 0 {
+		t.Fatalf("unexpected create requests = %#v", created)
+	}
+	for _, request := range scenario.requestSnapshot() {
+		if strings.Contains(request, "/git/ref/") {
+			t.Fatalf("existing pull request unexpectedly re-read the mutable head ref: %s", request)
+		}
+	}
+}
+
+func TestGitHubPRReconcilerRejectsAmbiguousExactPullRequests(t *testing.T) {
+	t.Parallel()
+	scenario := newGitHubPRTestScenario(t)
+	intent := githubTestIntent()
+	key, _ := intent.Key()
+	scenario.list = []githubPullRequest{
+		githubTestPullRequest(scenario.base, scenario.head, 1, publisher.PullRequestClosed, githubTestSHA, githubIntentMarker(key)),
+		githubTestPullRequest(scenario.base, scenario.head, 2, publisher.PullRequestOpen, githubTestSHA, githubIntentMarker(key)),
+	}
+	reconciler := newGitHubTestReconciler(t, scenario.handler(t))
+
+	_, err := publisher.ReconcilePullRequest(context.Background(), intent, reconciler)
+	if !errors.Is(err, publisher.ErrIdempotencyConflict) {
+		t.Fatalf("error = %v, want idempotency conflict", err)
+	}
+	if created := scenario.createSnapshot(); len(created) != 0 {
+		t.Fatalf("unexpected create requests = %#v", created)
+	}
+}
+
+func TestGitHubPRReconcilerRejectsWrongHeadSHA(t *testing.T) {
+	t.Parallel()
+	scenario := newGitHubPRTestScenario(t)
+	intent := githubTestIntent()
+	key, _ := intent.Key()
+	scenario.list = []githubPullRequest{
+		githubTestPullRequest(scenario.base, scenario.head, 9, publisher.PullRequestOpen, strings.Repeat("b", 40), githubIntentMarker(key)),
+	}
+	reconciler := newGitHubTestReconciler(t, scenario.handler(t))
+
+	_, err := publisher.ReconcilePullRequest(context.Background(), intent, reconciler)
+	if !errors.Is(err, publisher.ErrIdempotencyConflict) || !strings.Contains(err.Error(), "head SHA") {
+		t.Fatalf("error = %v, want head SHA conflict", err)
+	}
+	if created := scenario.createSnapshot(); len(created) != 0 {
+		t.Fatalf("unexpected create requests = %#v", created)
+	}
+}
+
+func TestGitHubPRReconcilerRejectsMovedHeadBeforeCreate(t *testing.T) {
+	t.Parallel()
+	scenario := newGitHubPRTestScenario(t)
+	scenario.headSHA = strings.Repeat("b", 40)
+	reconciler := newGitHubTestReconciler(t, scenario.handler(t))
+
+	_, err := publisher.ReconcilePullRequest(context.Background(), githubTestIntent(), reconciler)
+	if !errors.Is(err, publisher.ErrIdempotencyConflict) || !strings.Contains(err.Error(), "head ref") {
+		t.Fatalf("error = %v, want moved head conflict", err)
+	}
+	if created := scenario.createSnapshot(); len(created) != 0 {
+		t.Fatalf("unexpected create requests = %#v", created)
+	}
+}
+
+func TestGitHubPRReconcilerRejectsRepositoryIdentityMismatch(t *testing.T) {
+	t.Parallel()
+	scenario := newGitHubPRTestScenario(t)
+	scenario.head.ID++
+	scenario.head.FullName = "someone-else/fork"
+	reconciler := newGitHubTestReconciler(t, scenario.handler(t))
+
+	_, err := publisher.ReconcilePullRequest(context.Background(), githubTestIntent(), reconciler)
+	if !errors.Is(err, publisher.ErrIdempotencyConflict) || !strings.Contains(err.Error(), "repository identity") {
+		t.Fatalf("error = %v, want repository identity conflict", err)
+	}
+	if created := scenario.createSnapshot(); len(created) != 0 {
+		t.Fatalf("unexpected create requests = %#v", created)
+	}
+}
+
+func TestGitHubPRReconcilerReturnsKnownClosedAndMergedPullRequests(t *testing.T) {
+	t.Parallel()
+	for _, state := range []publisher.PullRequestState{publisher.PullRequestClosed, publisher.PullRequestMerged} {
+		t.Run(string(state), func(t *testing.T) {
+			t.Parallel()
+			scenario := newGitHubPRTestScenario(t)
+			intent := githubTestIntent()
+			key, _ := intent.Key()
+			scenario.list = []githubPullRequest{
+				githubTestPullRequest(scenario.base, scenario.head, 33, state, githubTestSHA, githubIntentMarker(key)),
+			}
+			reconciler := newGitHubTestReconciler(t, scenario.handler(t))
+
+			receipt, err := publisher.ReconcilePullRequest(context.Background(), intent, reconciler)
+			if err != nil {
+				t.Fatalf("ReconcilePullRequest: %v", err)
+			}
+			if receipt.State != state {
+				t.Fatalf("receipt = %#v, want state %s", receipt, state)
+			}
+			if created := scenario.createSnapshot(); len(created) != 0 {
+				t.Fatalf("known %s pull request was recreated: %#v", state, created)
+			}
+		})
+	}
+}
+
+func TestGitHubPRReconcilerNeverAdoptsUnmarkedSameBranchPullRequest(t *testing.T) {
+	t.Parallel()
+	scenario := newGitHubPRTestScenario(t)
+	intent := githubTestIntent()
+	scenario.list = []githubPullRequest{
+		githubTestPullRequest(scenario.base, scenario.head, 55, publisher.PullRequestOpen, githubTestSHA, "manual pull request"),
+	}
+	reconciler := newGitHubTestReconciler(t, scenario.handler(t))
+
+	_, err := publisher.ReconcilePullRequest(context.Background(), intent, reconciler)
+	if !errors.Is(err, publisher.ErrIdempotencyConflict) || !strings.Contains(err.Error(), "unrelated open") {
+		t.Fatalf("error = %v, want unrelated pull request conflict", err)
+	}
+	if created := scenario.createSnapshot(); len(created) != 0 {
+		t.Fatalf("unexpected create requests = %#v", created)
+	}
+}
+
+func TestGitHubPRReconcilerRecoversAmbiguousCreateByExactTuple(t *testing.T) {
+	t.Parallel()
+	scenario := newGitHubPRTestScenario(t)
+	intent := githubTestIntent()
+	key, _ := intent.Key()
+	exact := githubTestPullRequest(scenario.base, scenario.head, 77, publisher.PullRequestOpen, githubTestSHA, githubIntentMarker(key))
+	var listCalls atomic.Int32
+	baseHandler := scenario.handler(t)
+	handler := http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		if request.Method == http.MethodGet && request.URL.Path == "/repos/acme/base/pulls" {
+			if listCalls.Add(1) > 1 {
+				scenario.mu.Lock()
+				scenario.list = []githubPullRequest{exact}
+				scenario.mu.Unlock()
+			}
+		}
+		if request.Method == http.MethodPost && request.URL.Path == "/repos/acme/base/pulls" {
+			scenario.mu.Lock()
+			scenario.createStatus = http.StatusInternalServerError
+			scenario.mu.Unlock()
+		}
+		baseHandler.ServeHTTP(writer, request)
+	})
+	reconciler := newGitHubTestReconciler(t, handler)
+
+	receipt, err := publisher.ReconcilePullRequest(context.Background(), intent, reconciler)
+	if err != nil {
+		t.Fatalf("ReconcilePullRequest: %v", err)
+	}
+	if receipt.ForgeID != "github:101:77" || listCalls.Load() != 2 {
+		t.Fatalf("receipt = %#v listCalls=%d", receipt, listCalls.Load())
+	}
+}
+
+func TestGitHubPRReconcilerSanitizesAPIErrors(t *testing.T) {
+	t.Parallel()
+	upstreamMarker := "upstream-body-secret-marker"
+	server := httptest.NewTLSServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		writer.Header().Set("Content-Type", "application/json")
+		writer.WriteHeader(http.StatusInternalServerError)
+		_, _ = fmt.Fprintf(writer, `{"message":%q,"token":%q}`, upstreamMarker, githubTestAuthorization)
+	}))
+	defer server.Close()
+	reconciler := newGitHubTestReconcilerForServer(t, server, defaultGitHubMaxResponseBytes, 0)
+
+	_, err := publisher.ReconcilePullRequest(context.Background(), githubTestIntent(), reconciler)
+	if err == nil {
+		t.Fatal("expected GitHub API error")
+	}
+	var operationErr *operationError
+	if !errors.As(err, &operationErr) || operationErr.code != "github_api_error" || !operationErr.retryable {
+		t.Fatalf("error = %#v", err)
+	}
+	if strings.Contains(err.Error(), upstreamMarker) || strings.Contains(err.Error(), githubTestAuthorization) {
+		t.Fatalf("error leaked upstream response or token: %v", err)
+	}
+}
+
+func TestGitHubPRReconcilerDeniesRedirects(t *testing.T) {
+	t.Parallel()
+	var redirected atomic.Bool
+	target := httptest.NewTLSServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { redirected.Store(true) }))
+	defer target.Close()
+	redirector := httptest.NewTLSServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		http.Redirect(writer, request, target.URL+request.URL.Path, http.StatusTemporaryRedirect)
+	}))
+	defer redirector.Close()
+	reconciler := newGitHubTestReconcilerForServer(t, redirector, defaultGitHubMaxResponseBytes, 0)
+
+	_, err := publisher.ReconcilePullRequest(context.Background(), githubTestIntent(), reconciler)
+	if err == nil {
+		t.Fatal("expected redirect denial")
+	}
+	if redirected.Load() {
+		t.Fatal("GitHub client followed a redirect with the operation credential")
+	}
+	if strings.Contains(err.Error(), githubTestAuthorization) {
+		t.Fatalf("redirect error leaked token: %v", err)
+	}
+}
+
+func TestGitHubPRReconcilerBoundsResponsesAndTimeouts(t *testing.T) {
+	t.Parallel()
+	t.Run("response limit", func(t *testing.T) {
+		t.Parallel()
+		server := httptest.NewTLSServer(http.HandlerFunc(func(writer http.ResponseWriter, _ *http.Request) {
+			writer.Header().Set("Content-Type", "application/json")
+			_, _ = writer.Write([]byte(`{"padding":"` + strings.Repeat("x", 1024) + `"}`))
+		}))
+		defer server.Close()
+		reconciler := newGitHubTestReconcilerForServer(t, server, 128, 0)
+		if _, err := publisher.ReconcilePullRequest(context.Background(), githubTestIntent(), reconciler); err == nil {
+			t.Fatal("expected response limit error")
+		}
+	})
+	t.Run("request timeout", func(t *testing.T) {
+		t.Parallel()
+		started := make(chan struct{})
+		server := httptest.NewTLSServer(http.HandlerFunc(func(_ http.ResponseWriter, request *http.Request) {
+			close(started)
+			<-request.Context().Done()
+		}))
+		defer server.Close()
+		reconciler := newGitHubTestReconcilerForServer(t, server, defaultGitHubMaxResponseBytes, 50*time.Millisecond)
+		begin := time.Now()
+		if _, err := publisher.ReconcilePullRequest(context.Background(), githubTestIntent(), reconciler); err == nil {
+			t.Fatal("expected timeout error")
+		}
+		if time.Since(begin) > time.Second {
+			t.Fatal("GitHub request exceeded the strict timeout")
+		}
+		select {
+		case <-started:
+		default:
+			t.Fatal("GitHub request did not reach the test server")
+		}
+	})
+}
+
+func TestGitHubPRReconcilerRejectsCandidatePagination(t *testing.T) {
+	t.Parallel()
+	scenario := newGitHubPRTestScenario(t)
+	scenario.listLink = `<https://api.github.example/repos/acme/base/pulls?page=2>; rel="next"`
+	reconciler := newGitHubTestReconciler(t, scenario.handler(t))
+	_, err := publisher.ReconcilePullRequest(context.Background(), githubTestIntent(), reconciler)
+	if !errors.Is(err, publisher.ErrIdempotencyConflict) {
+		t.Fatalf("error = %v, want bounded candidate conflict", err)
+	}
+}
+
+func newGitHubTestReconciler(t *testing.T, handler http.Handler) publisher.PullRequestReconciler {
+	t.Helper()
+	server := httptest.NewTLSServer(handler)
+	t.Cleanup(server.Close)
+	return newGitHubTestReconcilerForServer(t, server, defaultGitHubMaxResponseBytes, 0)
+}
+
+func newGitHubTestReconcilerForServer(
+	t *testing.T,
+	server *httptest.Server,
+	maxResponseBytes int64,
+	timeout time.Duration,
+) publisher.PullRequestReconciler {
+	t.Helper()
+	operationFile := filepath.Join(t.TempDir(), "credential")
+	if err := os.WriteFile(operationFile, []byte(githubTestAuthorization), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	factory, err := NewGitHubPRReconcilerFactory(GitHubPRReconcilerFactoryConfig{
+		APIBaseURL: server.URL, HTTPClient: server.Client(), RequestTimeout: timeout, MaxResponseBytes: maxResponseBytes,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	reconciler, err := factory.New(context.Background(), operationFile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Remove(operationFile); err != nil {
+		t.Fatal(err)
+	}
+	return reconciler
+}
+
+func githubTestIntent() publisher.PullRequestIntent {
+	return publisher.PullRequestIntent{
+		BaseRepository:        publisher.Repository{Provider: githubProvider, ID: "repository-node-101", URL: "https://github.example/acme/base.git"},
+		BaseRef:               "refs/heads/main",
+		HeadRepository:        publisher.Repository{Provider: githubProvider, ID: "repository-node-202", URL: "https://github.example/bot/fork.git"},
+		HeadRef:               "refs/heads/orka-change",
+		PublicationGeneration: 7,
+		ExpectedHeadOID:       githubTestSHA,
+	}
+}
+
+func githubTestRepository(id int64, fullName string) githubRepository {
+	return githubRepository{
+		ID: id, NodeID: fmt.Sprintf("repository-node-%d", id), FullName: fullName,
+		HTMLURL:  "https://" + githubTestHost + "/" + fullName,
+		CloneURL: "https://" + githubTestHost + "/" + fullName + ".git",
+	}
+}
+
+func githubTestPullRequest(
+	base, head githubRepository,
+	number int64,
+	state publisher.PullRequestState,
+	headSHA, body string,
+) githubPullRequest {
+	candidate := githubPullRequest{
+		Number: number, HTMLURL: base.HTMLURL + "/pull/" + fmt.Sprint(number), Body: &body,
+		Head: githubPullRequestRef{Ref: "orka-change", SHA: headSHA, Repo: &head},
+		Base: githubPullRequestRef{Ref: githubTestBaseBranch, Repo: &base},
+	}
+	switch state {
+	case publisher.PullRequestOpen:
+		candidate.State = githubPullRequestStateOpen
+	case publisher.PullRequestClosed:
+		candidate.State = githubPullRequestStateClosed
+	case publisher.PullRequestMerged:
+		candidate.State = githubPullRequestStateClosed
+		mergedAt := "2026-07-25T12:00:00Z"
+		candidate.MergedAt = &mergedAt
+	default:
+		panic("unsupported test pull request state")
+	}
+	return candidate
+}
+
+func writeGitHubTestJSON(t *testing.T, writer http.ResponseWriter, status int, value any) {
+	t.Helper()
+	writer.Header().Set("Content-Type", "application/json")
+	writer.WriteHeader(status)
+	if err := json.NewEncoder(writer).Encode(value); err != nil {
+		t.Errorf("encode GitHub response: %v", err)
+	}
+}
+
+func TestLoadConfigFromEnvExplicitlyEnablesGitHubPRReconciliation(t *testing.T) {
+	clearPublisherEnvForTest(t)
+	controller := writePublisherSecretForTest(t, "controller", strings.Repeat("c", 32))
+	operation := writePublisherSecretForTest(t, "operation", strings.Repeat("o", MinSecretBytes))
+	t.Setenv(EnvControllerTokenFile, controller)
+	t.Setenv(EnvOperationCapabilitySecretFile, operation)
+	t.Setenv(EnvArtifactAuthorizationBrokerURL, "https://orka-api.example")
+	t.Setenv(EnvCredentialBrokerURL, "https://orka-api.example")
+	t.Setenv(EnvArtifactAPIURL, "https://orka-api.example")
+	setProductionPublisherProxyForTest(t)
+	t.Setenv(EnvGitHubPREnabled, "true")
+	t.Setenv(EnvGitHubAPIBaseURL, "https://api.github.example/api/v3")
+	t.Setenv(EnvGitHubRequestTimeout, "7s")
+	t.Setenv(EnvGitHubMaxResponseBytes, "12345")
+
+	config, err := LoadConfigFromEnv()
+	if err != nil {
+		t.Fatalf("LoadConfigFromEnv: %v", err)
+	}
+	factory, ok := config.PRFactory.(*GitHubPRReconcilerFactory)
+	if !ok || factory == nil {
+		t.Fatalf("PRFactory = %T, want GitHub factory", config.PRFactory)
+	}
+	if factory.apiBaseURL.String() != "https://api.github.example/api/v3" || factory.requestTimeout != 7*time.Second ||
+		factory.maxResponseBytes != 12345 {
+		t.Fatalf("factory = %#v", factory)
+	}
+}
+
+func TestLoadConfigFromEnvRejectsImplicitGitHubPRConfiguration(t *testing.T) {
+	clearPublisherEnvForTest(t)
+	controller := writePublisherSecretForTest(t, "controller", strings.Repeat("c", 32))
+	operation := writePublisherSecretForTest(t, "operation", strings.Repeat("o", MinSecretBytes))
+	t.Setenv(EnvControllerTokenFile, controller)
+	t.Setenv(EnvOperationCapabilitySecretFile, operation)
+	t.Setenv(EnvArtifactAuthorizationBrokerURL, "https://orka-api.example")
+	t.Setenv(EnvCredentialBrokerURL, "https://orka-api.example")
+	t.Setenv(EnvArtifactAPIURL, "https://orka-api.example")
+	setProductionPublisherProxyForTest(t)
+	t.Setenv(EnvGitHubAPIBaseURL, "https://api.github.example")
+
+	if _, err := LoadConfigFromEnv(); err == nil || !strings.Contains(err.Error(), EnvGitHubPREnabled+"=true") {
+		t.Fatalf("LoadConfigFromEnv error = %v", err)
+	}
+}
+
+func clearPublisherEnvForTest(t *testing.T) {
+	t.Helper()
+	for _, name := range []string{
+		EnvListenAddress, EnvControllerTokenFile, EnvOperationCapabilitySecretFile, EnvArtifactCapabilitySecretFile, EnvArtifactAuthorizationBrokerURL,
+		EnvArtifactAPIURL, EnvArtifactRoot, EnvJournalRoot, EnvTempRoot, EnvCredentialRoot, EnvCredentialBrokerURL, EnvDefaultGitCredentialName,
+		EnvGitBinary, EnvRequiredGitVersion, EnvAllowedSCMHosts, EnvAllowFileRepositories, EnvMaxConcurrentOperations,
+		EnvMaxRequestBytes, EnvMaxResponseBytes, EnvMaxJournalBytes, EnvMaxDeltaBytes, EnvMaxBundleBytes, EnvMaxCommandOutput,
+		EnvPublishTimeout, EnvArtifactTimeout, EnvCapabilityTTL, EnvWorkspaceMaxEntries, EnvWorkspaceMaxFileBytes,
+		EnvWorkspaceMaxBytes, EnvWorkspaceMaxArtifactBytes, EnvWorkspaceMaxPathBytes, EnvGitHubPREnabled,
+		EnvGitHubAPIBaseURL, EnvGitHubRequestTimeout, EnvGitHubMaxResponseBytes, EnvSCMEgressProxyRequired,
+		EnvAllowDevelopmentFallbacks, "HTTPS_PROXY", "https_proxy", "NO_PROXY", "no_proxy",
+	} {
+		t.Setenv(name, "")
+	}
+}
+
+func setProductionPublisherProxyForTest(t *testing.T) {
+	t.Helper()
+	t.Setenv(EnvSCMEgressProxyRequired, "true")
+	t.Setenv(
+		"HTTPS_PROXY",
+		"http://orka-publisher:"+strings.Repeat("p", 64)+"@proxy.orka-system.svc:8080",
+	)
+	t.Setenv("NO_PROXY", "localhost,127.0.0.1,::1,.svc,.cluster.local")
+}
+
+func writePublisherSecretForTest(t *testing.T, name, value string) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), name)
+	if err := os.WriteFile(path, []byte(value), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
diff --git a/internal/publisher/service/handlers.go b/internal/publisher/service/handlers.go
new file mode 100644
index 000000000..272abaa0a
--- /dev/null
+++ b/internal/publisher/service/handlers.go
@@ -0,0 +1,570 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"os"
+
+	"github.com/orka-agents/orka/internal/artifactcap"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/publisher"
+)
+
+func (s *Server) handleWorkspaceResolve(writer http.ResponseWriter, request *http.Request) {
+	s.serveOperation(writer, request, OperationWorkspaceResolve,
+		func(body []byte) (OperationMetadata, any, error) {
+			var value WorkspaceResolveRequest
+			if err := decodeStrict(body, &value); err != nil {
+				return value.Metadata, nil, invalidRequest("workspace resolve JSON is invalid", err)
+			}
+			if err := value.Metadata.validateFor(OperationWorkspaceResolve); err != nil {
+				return value.Metadata, nil, err
+			}
+			if err := validateRepository(value.Source, s.config.AllowFileRepositories, s.config.AllowedSCMHosts); err != nil {
+				return value.Metadata, nil, err
+			}
+			if value.SourceRef != "" {
+				canonicalRef, err := CanonicalWorkspaceSourceRef(value.SourceRef)
+				if err != nil {
+					return value.Metadata, nil, err
+				}
+				value.SourceRef = canonicalRef
+			}
+			if err := validateCredentialReference(value.CredentialRef, CredentialHTTPExtraHeader); err != nil {
+				return value.Metadata, nil, err
+			}
+			return value.Metadata, value, nil
+		},
+		func(ctx context.Context, metadata OperationMetadata, digest string, _ journalRecord, decoded any) (int, any, error) {
+			value := decoded.(WorkspaceResolveRequest)
+			credential, err := s.credentials.gitCredential(ctx, OperationWorkspaceResolve, metadata, value.Source, value.CredentialRef)
+			if err != nil {
+				return 0, nil, err
+			}
+			defer credential.cleanup()
+			runner, err := newGitRunner(
+				credential.gitBinary, s.config.TempRoot, s.config.MaxCommandOutput, s.config.ProxyEnvironment,
+			)
+			if err != nil {
+				return 0, nil, apiError(ErrSCMTransport, "git_unavailable", "Git runtime could not be initialized", 503, false, err)
+			}
+			resolvedRef, oid, err := runner.resolveSource(ctx, value.Source.URL, value.SourceRef)
+			if err != nil {
+				return 0, nil, err
+			}
+			return http.StatusOK, WorkspaceResolveResponse{OperationID: metadata.OperationID, RequestDigest: digest, RepositoryID: value.Source.ID, SourceRef: resolvedRef, BaselineOID: oid}, nil
+		})
+}
+
+func (s *Server) handleWorkspacePrepare(writer http.ResponseWriter, request *http.Request) {
+	s.serveOperation(writer, request, OperationWorkspacePrepare,
+		func(body []byte) (OperationMetadata, any, error) {
+			var value WorkspacePrepareRequest
+			if err := decodeStrict(body, &value); err != nil {
+				return value.Metadata, nil, invalidRequest("workspace request JSON is invalid", err)
+			}
+			if err := value.Metadata.validateFor(OperationWorkspacePrepare); err != nil {
+				return value.Metadata, nil, err
+			}
+			if err := validateRepository(value.Source, s.config.AllowFileRepositories, s.config.AllowedSCMHosts); err != nil {
+				return value.Metadata, nil, err
+			}
+			canonicalRef, err := CanonicalWorkspaceSourceRef(value.SourceRef)
+			if err != nil {
+				return value.Metadata, nil, err
+			}
+			value.SourceRef = canonicalRef
+			if err := validateObjectID(value.BaselineOID); err != nil {
+				return value.Metadata, nil, err
+			}
+			if err := validateSourceRefBaseline(value.SourceRef, value.BaselineOID); err != nil {
+				return value.Metadata, nil, err
+			}
+			if _, err := mergeWorkspaceLimits(value.Limits, s.config.WorkspaceLimits); err != nil {
+				return value.Metadata, nil, err
+			}
+			if err := validateCredentialReference(value.CredentialRef, CredentialHTTPExtraHeader); err != nil {
+				return value.Metadata, nil, err
+			}
+			return value.Metadata, value, nil
+		},
+		func(ctx context.Context, metadata OperationMetadata, digest string, record journalRecord, decoded any) (int, any, error) {
+			value := decoded.(WorkspacePrepareRequest)
+			response := record.Workspace
+			if response == nil {
+				limits, err := mergeWorkspaceLimits(value.Limits, s.config.WorkspaceLimits)
+				if err != nil {
+					return 0, nil, err
+				}
+				credential, err := s.credentials.gitCredential(ctx, OperationWorkspacePrepare, metadata, value.Source, value.CredentialRef)
+				if err != nil {
+					return 0, nil, err
+				}
+				defer credential.cleanup()
+				runner, err := newGitRunner(
+					credential.gitBinary, s.config.TempRoot, s.config.MaxCommandOutput, s.config.ProxyEnvironment,
+				)
+				if err != nil {
+					return 0, nil, apiError(ErrSCMTransport, "git_unavailable", "Git runtime could not be initialized", 503, false, err)
+				}
+				sourceRef := value.SourceRef
+				if isBareWorkspaceSourceRef(sourceRef) {
+					resolvedRef, observedOID, err := runner.resolveSource(ctx, value.Source.URL, sourceRef)
+					if err != nil {
+						return 0, nil, err
+					}
+					if observedOID != value.BaselineOID {
+						return 0, nil, apiError(ErrSCMTransport, "source_moved", "source ref moved from the persisted baseline", 409, false, nil)
+					}
+					sourceRef = resolvedRef
+				}
+				archive, err := buildWorkspaceArchive(ctx, runner, value.Source.ID, value.Source.URL, sourceRef, value.BaselineOID, limits)
+				if err != nil {
+					return 0, nil, err
+				}
+				defer os.Remove(archive.path) //nolint:errcheck
+				reference, err := workspaceArtifactReference(archive)
+				if err != nil {
+					return 0, nil, err
+				}
+				prepared := WorkspacePrepareResponse{
+					OperationID: metadata.OperationID, RequestDigest: digest, RepositoryID: value.Source.ID,
+					SourceRef: sourceRef, BaselineOID: value.BaselineOID, TreeOID: archive.treeOID,
+					ManifestDigest: archive.manifestDigest, EntryCount: archive.entryCount,
+					ExpandedBytes: archive.expandedBytes, Artifact: reference,
+				}
+				if err := s.journal.setWorkspaceObjectFile(
+					context.WithoutCancel(ctx), metadata.OperationID, digest, prepared, archive.path, archive.size,
+				); err != nil {
+					return 0, nil, err
+				}
+				response = &prepared
+			}
+			object, err := s.journal.openWorkspaceObject(response.Artifact.Digest, response.Artifact.SizeBytes)
+			if err != nil {
+				return 0, nil, apiError(ErrJournalFull, "workspace_object_missing", "durable workspace artifact is missing or corrupt", 500, false, err)
+			}
+			defer object.Close() //nolint:errcheck
+			if err := verifyWorkspaceObject(object, response.Artifact); err != nil {
+				return 0, nil, apiError(ErrJournalFull, "workspace_object_corrupt", "durable workspace artifact is corrupt", 500, false, err)
+			}
+			attempt, err := s.journal.nextRemoteAttempt(context.WithoutCancel(ctx), metadata.OperationID, digest)
+			if err != nil {
+				return 0, nil, err
+			}
+			if err := s.artifacts.upload(ctx, OperationWorkspacePrepare, metadata, attempt, response.Artifact, object); err != nil {
+				return 0, nil, err
+			}
+			return http.StatusOK, *response, nil
+		})
+}
+
+func (s *Server) handlePublicationPreflight(writer http.ResponseWriter, request *http.Request) {
+	s.serveOperation(writer, request, OperationPublicationPreflight,
+		func(body []byte) (OperationMetadata, any, error) {
+			var value PublicationPreflightRequest
+			if err := decodeStrict(body, &value); err != nil {
+				return value.Metadata, nil, invalidRequest("preflight request JSON is invalid", err)
+			}
+			if err := s.validatePublicationMetadata(value.Metadata, OperationPublicationPreflight, "", ""); err != nil {
+				return value.Metadata, nil, err
+			}
+			if err := validateRepository(value.Request.Target, s.config.AllowFileRepositories, s.config.AllowedSCMHosts); err != nil {
+				return value.Metadata, nil, err
+			}
+			if err := validateBranchRef(value.Request.Claim.Ref); err != nil {
+				return value.Metadata, nil, err
+			}
+			if err := validateCredentialReference(value.CredentialRef, CredentialHTTPExtraHeader); err != nil {
+				return value.Metadata, nil, err
+			}
+			return value.Metadata, value, nil
+		},
+		func(ctx context.Context, metadata OperationMetadata, digest string, _ journalRecord, decoded any) (int, any, error) {
+			value := decoded.(PublicationPreflightRequest)
+			credential, runtime, err := s.publisherFor(ctx, OperationPublicationPreflight, metadata, value.Request.Target, value.CredentialRef)
+			if err != nil {
+				return 0, nil, err
+			}
+			defer credential.cleanup()
+			s.publicationMu.Lock()
+			result, preflightErr := runtime.Preflight(ctx, value.Request)
+			s.publicationMu.Unlock()
+			if preflightErr != nil && !errors.Is(preflightErr, publisher.ErrBranchMoved) {
+				return 0, nil, preflightErr
+			}
+			return http.StatusOK, PublicationPreflightResponse{OperationID: metadata.OperationID, RequestDigest: digest, Result: result}, nil
+		})
+}
+
+func (s *Server) handlePublicationPrepare(writer http.ResponseWriter, request *http.Request) {
+	s.serveOperation(writer, request, OperationPublicationPrepare,
+		func(body []byte) (OperationMetadata, any, error) {
+			var value PublicationPrepareRequest
+			if err := decodeStrict(body, &value); err != nil {
+				return value.Metadata, nil, invalidRequest("publication prepare request JSON is invalid", err)
+			}
+			if err := s.validatePublicationMetadata(value.Metadata, OperationPublicationPrepare, value.Request.PublicationID, value.Request.OperationID); err != nil {
+				return value.Metadata, nil, err
+			}
+			if err := validateRepository(value.Request.Source, s.config.AllowFileRepositories, s.config.AllowedSCMHosts); err != nil {
+				return value.Metadata, nil, err
+			}
+			if err := validateRepository(value.Request.Target, s.config.AllowFileRepositories, s.config.AllowedSCMHosts); err != nil {
+				return value.Metadata, nil, err
+			}
+			canonicalRef, err := CanonicalWorkspaceSourceRef(value.Request.SourceRef)
+			if err != nil {
+				return value.Metadata, nil, err
+			}
+			value.Request.SourceRef = canonicalRef
+			if err := validateBranchRef(value.Request.TargetRef); err != nil {
+				return value.Metadata, nil, err
+			}
+			if err := validateObjectID(value.Request.BaselineOID); err != nil {
+				return value.Metadata, nil, err
+			}
+			if err := validateSourceRefBaseline(value.Request.SourceRef, value.Request.BaselineOID); err != nil {
+				return value.Metadata, nil, err
+			}
+			if err := validateArtifactTransportReference(value.DeltaArtifact); err != nil || value.DeltaArtifact.MediaType != artifactcap.MediaTypeWorkspaceDelta ||
+				!constantEqual(value.DeltaArtifact.Digest, value.Request.DeltaArtifactDigest) || value.DeltaArtifact.SizeBytes > s.config.MaxDeltaBytes {
+				return value.Metadata, nil, invalidRequest("workspace delta artifact reference is invalid", err)
+			}
+			if err := validateCredentialReference(value.SourceCredentialRef, CredentialHTTPExtraHeader); err != nil {
+				return value.Metadata, nil, err
+			}
+			return value.Metadata, value, nil
+		},
+		func(ctx context.Context, metadata OperationMetadata, digest string, _ journalRecord, decoded any) (int, any, error) {
+			value := decoded.(PublicationPrepareRequest)
+			attempt, err := s.journal.nextRemoteAttempt(context.WithoutCancel(ctx), metadata.OperationID, digest)
+			if err != nil {
+				return 0, nil, err
+			}
+			delta, err := s.artifacts.download(ctx, OperationPublicationPrepare, metadata, attempt, value.DeltaArtifact, s.config.MaxDeltaBytes)
+			if err != nil {
+				return 0, nil, err
+			}
+			value.Request.DeltaArtifact = delta
+			credential, runtime, err := s.publisherFor(ctx, OperationPublicationPrepare, metadata, value.Request.Source, value.SourceCredentialRef)
+			if err != nil {
+				return 0, nil, err
+			}
+			defer credential.cleanup()
+			if isBareWorkspaceSourceRef(value.Request.SourceRef) {
+				runner, err := newGitRunner(
+					credential.gitBinary, s.config.TempRoot, s.config.MaxCommandOutput, s.config.ProxyEnvironment,
+				)
+				if err != nil {
+					return 0, nil, apiError(ErrSCMTransport, "git_unavailable", "Git runtime could not be initialized", 503, false, err)
+				}
+				resolvedRef, observedOID, err := runner.resolveSource(ctx, value.Request.Source.URL, value.Request.SourceRef)
+				if err != nil {
+					return 0, nil, err
+				}
+				if observedOID != value.Request.BaselineOID {
+					return 0, nil, apiError(ErrSCMTransport, "source_moved", "source ref moved from the persisted baseline", 409, false, nil)
+				}
+				value.Request.SourceRef = resolvedRef
+			}
+			s.publicationMu.Lock()
+			prepared, prepareErr := runtime.Prepare(ctx, value.Request)
+			s.publicationMu.Unlock()
+			if prepareErr != nil {
+				return 0, nil, prepareErr
+			}
+			bundleArtifact, err := preparedBundleArtifact(prepared)
+			if err != nil {
+				return 0, nil, err
+			}
+			bundle, err := os.Open(prepared.BundlePath)
+			if err != nil {
+				return 0, nil, apiError(ErrArtifactTransport, "prepared_bundle_missing", "prepared bundle could not be opened for durable upload", 500, false, err)
+			}
+			uploadErr := s.artifacts.upload(ctx, OperationPublicationPrepare, metadata, attempt, bundleArtifact, bundle)
+			_ = bundle.Close()
+			if uploadErr != nil {
+				return 0, nil, uploadErr
+			}
+			return http.StatusOK, PublicationPrepareResponse{
+				OperationID: metadata.OperationID, RequestDigest: digest, Prepared: externalPrepared(prepared, bundleArtifact),
+			}, nil
+		})
+}
+
+func (s *Server) handlePublicationPublish(writer http.ResponseWriter, request *http.Request) {
+	s.serveOperation(writer, request, OperationPublicationPublish,
+		func(body []byte) (OperationMetadata, any, error) {
+			var value PublicationPublishRequest
+			if err := decodeStrict(body, &value); err != nil {
+				return value.Metadata, nil, invalidRequest("publication publish request JSON is invalid", err)
+			}
+			if err := s.validatePublicationMetadata(value.Metadata, OperationPublicationPublish, value.Request.PublicationID, value.Request.OperationID); err != nil {
+				return value.Metadata, nil, err
+			}
+			if err := validateRepository(value.Request.Target, s.config.AllowFileRepositories, s.config.AllowedSCMHosts); err != nil {
+				return value.Metadata, nil, err
+			}
+			if err := validatePreparedTransport(value.Prepared, value.Request.PublicationID, value.Request.ExpectedCommitOID, value.Request.BundleDigest); err != nil {
+				return value.Metadata, nil, err
+			}
+			if err := validateCredentialReference(value.CredentialRef, CredentialHTTPExtraHeader); err != nil {
+				return value.Metadata, nil, err
+			}
+			return value.Metadata, value, nil
+		},
+		func(ctx context.Context, metadata OperationMetadata, digest string, _ journalRecord, decoded any) (int, any, error) {
+			value := decoded.(PublicationPublishRequest)
+			credential, runtime, err := s.publisherFor(ctx, OperationPublicationPublish, metadata, value.Request.Target, value.CredentialRef)
+			if err != nil {
+				return 0, nil, err
+			}
+			defer credential.cleanup()
+			if err := s.restorePreparedBundle(ctx, runtime, OperationPublicationPublish, metadata, digest, value.Prepared); err != nil {
+				return 0, nil, err
+			}
+			s.publicationMu.Lock()
+			receipt, publishErr := runtime.Publish(ctx, value.Request)
+			s.publicationMu.Unlock()
+			if publishErr != nil && !errors.Is(publishErr, publisher.ErrCASRejected) && !errors.Is(publishErr, publisher.ErrPublicationUnknown) {
+				return 0, nil, publishErr
+			}
+			return http.StatusOK, PublicationPublishResponse{OperationID: metadata.OperationID, RequestDigest: digest, Receipt: receipt}, nil
+		})
+}
+
+func (s *Server) handlePublicationVerify(writer http.ResponseWriter, request *http.Request) {
+	s.serveOperation(writer, request, OperationPublicationVerify,
+		func(body []byte) (OperationMetadata, any, error) {
+			var value PublicationVerifyRequest
+			if err := decodeStrict(body, &value); err != nil {
+				return value.Metadata, nil, invalidRequest("publication verify request JSON is invalid", err)
+			}
+			if err := s.validatePublicationMetadata(value.Metadata, OperationPublicationVerify, value.Request.PublicationID, value.Request.OperationID); err != nil {
+				return value.Metadata, nil, err
+			}
+			if err := validateRepository(value.Request.Target, s.config.AllowFileRepositories, s.config.AllowedSCMHosts); err != nil {
+				return value.Metadata, nil, err
+			}
+			if err := validatePreparedTransport(value.Prepared, value.Request.PublicationID, value.Request.ExpectedCommitOID, value.Request.BundleDigest); err != nil {
+				return value.Metadata, nil, err
+			}
+			if err := validateCredentialReference(value.CredentialRef, CredentialHTTPExtraHeader); err != nil {
+				return value.Metadata, nil, err
+			}
+			return value.Metadata, value, nil
+		},
+		func(ctx context.Context, metadata OperationMetadata, digest string, _ journalRecord, decoded any) (int, any, error) {
+			value := decoded.(PublicationVerifyRequest)
+			credential, runtime, err := s.publisherFor(ctx, OperationPublicationVerify, metadata, value.Request.Target, value.CredentialRef)
+			if err != nil {
+				return 0, nil, err
+			}
+			defer credential.cleanup()
+			if err := s.restorePreparedBundle(ctx, runtime, OperationPublicationVerify, metadata, digest, value.Prepared); err != nil {
+				return 0, nil, err
+			}
+			s.publicationMu.Lock()
+			receipt, verifyErr := runtime.Verify(ctx, value.Request)
+			s.publicationMu.Unlock()
+			if verifyErr != nil && !errors.Is(verifyErr, publisher.ErrVerificationUnknown) {
+				return 0, nil, verifyErr
+			}
+			return http.StatusOK, PublicationVerifyResponse{OperationID: metadata.OperationID, RequestDigest: digest, Receipt: receipt}, nil
+		})
+}
+
+func (s *Server) handlePublicationReclaim(writer http.ResponseWriter, request *http.Request) {
+	s.serveOperation(writer, request, OperationPublicationReclaim,
+		func(body []byte) (OperationMetadata, any, error) {
+			var value PublicationReclaimRequest
+			if err := decodeStrict(body, &value); err != nil {
+				return value.Metadata, nil, invalidRequest("publication reclaim request JSON is invalid", err)
+			}
+			if err := s.validatePublicationMetadata(value.Metadata, OperationPublicationReclaim, value.Request.PublicationID, ""); err != nil {
+				return value.Metadata, nil, err
+			}
+			if value.Request.PublicationGeneration < 1 {
+				return value.Metadata, nil, invalidRequest("publication generation must be at least 1", nil)
+			}
+			return value.Metadata, value, nil
+		},
+		func(ctx context.Context, metadata OperationMetadata, digest string, _ journalRecord, decoded any) (int, any, error) {
+			value := decoded.(PublicationReclaimRequest)
+			runtime, err := s.newPublisher(s.gitBinary)
+			if err != nil {
+				return 0, nil, apiError(ErrSCMTransport, "publisher_unavailable", "clean-room publisher could not be initialized", 503, false, err)
+			}
+			s.publicationMu.Lock()
+			result, reclaimErr := runtime.Reclaim(ctx, value.Request)
+			s.publicationMu.Unlock()
+			if reclaimErr != nil {
+				return 0, nil, reclaimErr
+			}
+			return http.StatusOK, PublicationReclaimResponse{
+				OperationID: metadata.OperationID, RequestDigest: digest, Result: result,
+			}, nil
+		})
+}
+
+func (s *Server) handlePullRequestReconcile(writer http.ResponseWriter, request *http.Request) {
+	s.serveOperation(writer, request, OperationPullRequestReconcile,
+		func(body []byte) (OperationMetadata, any, error) {
+			var value PullRequestReconcileRequest
+			if err := decodeStrict(body, &value); err != nil {
+				return value.Metadata, nil, invalidRequest("pull request reconcile JSON is invalid", err)
+			}
+			if err := s.validatePublicationMetadata(value.Metadata, OperationPullRequestReconcile, "", ""); err != nil {
+				return value.Metadata, nil, err
+			}
+			if err := validateRepository(value.Intent.BaseRepository, s.config.AllowFileRepositories, s.config.AllowedSCMHosts); err != nil {
+				return value.Metadata, nil, err
+			}
+			if err := validateRepository(value.Intent.HeadRepository, s.config.AllowFileRepositories, s.config.AllowedSCMHosts); err != nil {
+				return value.Metadata, nil, err
+			}
+			if _, err := value.Intent.Key(); err != nil {
+				return value.Metadata, nil, err
+			}
+			if err := validateCredentialReference(value.CredentialRef, CredentialForgeToken); err != nil {
+				return value.Metadata, nil, err
+			}
+			return value.Metadata, value, nil
+		},
+		func(ctx context.Context, metadata OperationMetadata, digest string, _ journalRecord, decoded any) (int, any, error) {
+			if s.config.PRFactory == nil {
+				return 0, nil, apiError(ErrNotConfigured, "pr_reconciliation_unavailable", "pull request reconciliation is not configured", http.StatusNotImplemented, false, nil)
+			}
+			value := decoded.(PullRequestReconcileRequest)
+			credential, err := s.credentials.forgeCredential(ctx, OperationPullRequestReconcile, metadata, value.CredentialRef)
+			if err != nil {
+				return 0, nil, err
+			}
+			defer credential.cleanup()
+			reconciler, err := s.config.PRFactory.New(ctx, credential.filePath)
+			if err != nil || reconciler == nil {
+				return 0, nil, apiError(nil, "pr_reconciler_unavailable", "pull request reconciler could not be initialized", 503, true, err)
+			}
+			receipt, err := publisher.ReconcilePullRequest(ctx, value.Intent, reconciler)
+			if err != nil {
+				return 0, nil, err
+			}
+			if err := validatePullRequestReceipt(receipt); err != nil {
+				return 0, nil, err
+			}
+			return http.StatusOK, PullRequestReconcileResponse{OperationID: metadata.OperationID, RequestDigest: digest, Receipt: receipt}, nil
+		})
+}
+
+func (s *Server) validatePublicationMetadata(metadata OperationMetadata, operation Operation, publicationID, operationID string) error {
+	if err := metadata.validateFor(operation); err != nil {
+		return err
+	}
+	if publicationID != "" && !constantEqual(metadata.PublicationID, publicationID) {
+		return invalidRequest("publication identity does not match request", nil)
+	}
+	if operationID != "" && !constantEqual(metadata.OperationID, operationID) {
+		return invalidRequest("operation identity does not match request", nil)
+	}
+	return nil
+}
+
+func (s *Server) publisherFor(ctx context.Context, operation Operation, metadata OperationMetadata, repository publisher.Repository, reference *CredentialReference) (operationCredential, *publisher.Publisher, error) {
+	credential, err := s.credentials.gitCredential(ctx, operation, metadata, repository, reference)
+	if err != nil {
+		return operationCredential{}, nil, err
+	}
+	runtime, err := s.newPublisher(credential.gitBinary)
+	if err != nil {
+		credential.cleanup()
+		return operationCredential{}, nil, apiError(ErrSCMTransport, "publisher_unavailable", "clean-room publisher could not be initialized", 503, false, err)
+	}
+	return credential, runtime, nil
+}
+
+func validatePreparedTransport(prepared PreparedPublication, publicationID, commitOID, bundleDigest string) error {
+	if prepared.PublicationID != publicationID || prepared.CommitOID != commitOID || prepared.BundleDigest != bundleDigest {
+		return invalidRequest("prepared publication transport identity does not match request", nil)
+	}
+	if err := validateSourceRef(prepared.SourceRef); err != nil {
+		return err
+	}
+	if err := validateBranchRef(prepared.TargetRef); err != nil {
+		return err
+	}
+	if err := validateObjectID(prepared.BaselineOID); err != nil {
+		return err
+	}
+	if err := validateSourceRefBaseline(prepared.SourceRef, prepared.BaselineOID); err != nil {
+		return err
+	}
+	if err := validateArtifactTransportReference(prepared.BundleArtifact); err != nil || prepared.BundleArtifact.MediaType != artifactcap.MediaTypeGitBundle ||
+		prepared.BundleArtifact.Digest != prepared.BundleDigest || prepared.BundleArtifact.SizeBytes != prepared.BundleSize {
+		return invalidRequest("prepared publication bundle artifact is invalid", err)
+	}
+	return nil
+}
+
+func (s *Server) restorePreparedBundle(
+	ctx context.Context,
+	runtime *publisher.Publisher,
+	operation Operation,
+	metadata OperationMetadata,
+	requestDigest string,
+	prepared PreparedPublication,
+) error {
+	attempt, err := s.journal.nextRemoteAttempt(context.WithoutCancel(ctx), metadata.OperationID, requestDigest)
+	if err != nil {
+		return err
+	}
+	bundle, err := s.artifacts.download(ctx, operation, metadata, attempt, prepared.BundleArtifact, s.config.MaxBundleBytes)
+	if err != nil {
+		return err
+	}
+	return runtime.RestorePrepared(ctx, internalPrepared(prepared), bundle)
+}
+
+func internalPrepared(value PreparedPublication) publisher.PreparedPublication {
+	return publisher.PreparedPublication{
+		PublicationID: value.PublicationID, PublicationGeneration: value.PublicationGeneration,
+		OperationID: value.OperationID, RequestDigest: value.RequestDigest, Source: value.Source,
+		SourceRef: value.SourceRef, Target: value.Target, TargetRef: value.TargetRef,
+		BranchClaimGeneration: value.BranchClaimGeneration, BaselineOID: value.BaselineOID,
+		RemoteBefore: value.RemoteBefore, DeltaArtifactDigest: value.DeltaArtifactDigest,
+		RelativeRoot:   value.RelativeRoot,
+		ManifestDigest: value.ManifestDigest, TreeOID: value.TreeOID, CommitOID: value.CommitOID,
+		BundleDigest: value.BundleDigest, BundleSize: value.BundleSize, BundleRef: value.BundleRef,
+		CommitMessage: value.CommitMessage, CommitTimestamp: value.CommitTimestamp,
+	}
+}
+
+func preparedBundleArtifact(prepared publisher.PreparedPublication) (harnessv2.ArtifactReference, error) {
+	artifactID, err := artifactcap.ArtifactIDForDigest(prepared.BundleDigest)
+	if err != nil || prepared.BundleSize < 1 {
+		return harnessv2.ArtifactReference{}, invalidRequest("prepared bundle identity is invalid", err)
+	}
+	reference := harnessv2.ArtifactReference{
+		ArtifactID: harnessv2.ArtifactID(artifactID), Digest: prepared.BundleDigest,
+		SizeBytes: prepared.BundleSize, MediaType: artifactcap.MediaTypeGitBundle,
+	}
+	if err := validateArtifactTransportReference(reference); err != nil {
+		return harnessv2.ArtifactReference{}, err
+	}
+	return reference, nil
+}
+
+func externalPrepared(value publisher.PreparedPublication, bundleArtifact harnessv2.ArtifactReference) PreparedPublication {
+	return PreparedPublication{
+		PublicationID: value.PublicationID, PublicationGeneration: value.PublicationGeneration,
+		OperationID: value.OperationID, RequestDigest: value.RequestDigest, Source: value.Source,
+		SourceRef: value.SourceRef, Target: value.Target, TargetRef: value.TargetRef,
+		BranchClaimGeneration: value.BranchClaimGeneration, BaselineOID: value.BaselineOID,
+		RemoteBefore: value.RemoteBefore, DeltaArtifactDigest: value.DeltaArtifactDigest,
+		RelativeRoot:   value.RelativeRoot,
+		ManifestDigest: value.ManifestDigest, TreeOID: value.TreeOID, CommitOID: value.CommitOID,
+		BundleDigest: value.BundleDigest, BundleSize: value.BundleSize, BundleRef: value.BundleRef, BundleArtifact: bundleArtifact,
+		CommitMessage: value.CommitMessage, CommitTimestamp: value.CommitTimestamp,
+	}
+}
diff --git a/internal/publisher/service/journal.go b/internal/publisher/service/journal.go
new file mode 100644
index 000000000..870158937
--- /dev/null
+++ b/internal/publisher/service/journal.go
@@ -0,0 +1,683 @@
+package service
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+)
+
+const journalVersion = "orka.workspace-publisher.journal.v1"
+
+const journalReplayRetention = 24 * time.Hour
+
+type journalState string
+
+const (
+	journalStarted   journalState = "started"
+	journalCompleted journalState = "completed"
+	journalFailed    journalState = "failed"
+)
+
+type journalRecord struct {
+	Version       string                    `json:"version"`
+	Operation     Operation                 `json:"operation"`
+	Metadata      OperationMetadata         `json:"metadata"`
+	RequestDigest string                    `json:"requestDigest"`
+	State         journalState              `json:"state"`
+	StatusCode    int                       `json:"statusCode,omitempty"`
+	Response      json.RawMessage           `json:"response,omitempty"`
+	RemoteAttempt int                       `json:"remoteAttempt,omitempty"`
+	Workspace     *WorkspacePrepareResponse `json:"workspace,omitempty"`
+	StartedAt     time.Time                 `json:"startedAt"`
+	UpdatedAt     time.Time                 `json:"updatedAt"`
+}
+
+type journalStore struct {
+	root     string
+	objects  string
+	maxBytes int64
+	now      func() time.Time
+	mu       sync.Mutex
+}
+
+func newJournalStore(root string, maxBytes int64, now func() time.Time) (*journalStore, error) {
+	if err := ensurePrivateDirectory(root); err != nil {
+		return nil, fmt.Errorf("prepare journal root: %w", err)
+	}
+	objects := filepath.Join(root, "workspace-objects")
+	if err := ensurePrivateDirectory(objects); err != nil {
+		return nil, fmt.Errorf("prepare workspace object root: %w", err)
+	}
+	store := &journalStore{root: root, objects: objects, maxBytes: maxBytes, now: now}
+	if err := store.reclaimLocked("", ""); err != nil {
+		return nil, err
+	}
+	if _, err := store.totalBytes(); err != nil {
+		return nil, err
+	}
+	return store, nil
+}
+
+func (s *journalStore) begin(ctx context.Context, operation Operation, metadata OperationMetadata, requestDigest string) (journalRecord, bool, error) {
+	if err := ctx.Err(); err != nil {
+		return journalRecord{}, false, err
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if err := s.reclaimLocked(metadata.OperationID, ""); err != nil {
+		return journalRecord{}, false, err
+	}
+	record, found, err := s.readLocked(metadata.OperationID)
+	if err != nil {
+		return journalRecord{}, false, err
+	}
+	if found {
+		if record.Operation != operation || record.Metadata != metadata || !constantEqual(record.RequestDigest, requestDigest) {
+			return journalRecord{}, false, apiError(ErrOperationConflict, "operation_conflict", "operation ID was reused with different content", 409, false, nil)
+		}
+		return record, true, nil
+	}
+	now := s.now().UTC()
+	record = journalRecord{
+		Version: journalVersion, Operation: operation, Metadata: metadata, RequestDigest: requestDigest,
+		State: journalStarted, StartedAt: now, UpdatedAt: now,
+	}
+	if err := s.writeLocked(record); err != nil {
+		return journalRecord{}, false, err
+	}
+	if err := s.reclaimLocked(metadata.OperationID, ""); err != nil {
+		return journalRecord{}, false, err
+	}
+	return record, false, nil
+}
+
+func (s *journalStore) complete(ctx context.Context, operationID, requestDigest string, status int, response []byte) error {
+	return s.transition(ctx, operationID, requestDigest, journalCompleted, status, response)
+}
+
+func (s *journalStore) fail(ctx context.Context, operationID, requestDigest string, status int, response []byte) error {
+	return s.transition(ctx, operationID, requestDigest, journalFailed, status, response)
+}
+
+func (s *journalStore) transition(ctx context.Context, operationID, requestDigest string, state journalState, status int, response []byte) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	if state != journalCompleted && state != journalFailed || status < 100 || status > 599 || len(response) == 0 {
+		return fmt.Errorf("invalid journal transition")
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	record, found, err := s.readLocked(operationID)
+	if err != nil {
+		return err
+	}
+	if !found || !constantEqual(record.RequestDigest, requestDigest) {
+		return ErrOperationConflict
+	}
+	if record.State == state && record.StatusCode == status && bytes.Equal(record.Response, response) {
+		return s.reclaimLocked(operationID, "")
+	}
+	if record.State != journalStarted {
+		return ErrOperationConflict
+	}
+	record.State = state
+	record.StatusCode = status
+	record.Response = append(json.RawMessage(nil), response...)
+	record.Workspace = nil
+	record.UpdatedAt = s.now().UTC()
+	if err := s.writeLocked(record); err != nil {
+		return err
+	}
+	return s.reclaimLocked(operationID, "")
+}
+
+func (s *journalStore) setWorkspaceObjectFile(
+	ctx context.Context,
+	operationID, requestDigest string,
+	response WorkspacePrepareResponse,
+	source string,
+	size int64,
+) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	path, err := s.workspaceObjectPath(response.Artifact.Digest)
+	if err != nil {
+		return err
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	record, found, err := s.readLocked(operationID)
+	if err != nil {
+		return err
+	}
+	if !found || record.State != journalStarted || !constantEqual(record.RequestDigest, requestDigest) {
+		return ErrOperationConflict
+	}
+	if record.Workspace != nil {
+		if *record.Workspace != response {
+			return ErrOperationConflict
+		}
+		return nil
+	}
+	if err := s.putWorkspaceObjectFileLocked(path, response.Artifact.Digest, source, size, operationID); err != nil {
+		return err
+	}
+	record.Workspace = &response
+	record.UpdatedAt = s.now().UTC()
+	if err := s.writeLocked(record); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (s *journalStore) nextRemoteAttempt(ctx context.Context, operationID, requestDigest string) (int, error) {
+	if err := ctx.Err(); err != nil {
+		return 0, err
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	record, found, err := s.readLocked(operationID)
+	if err != nil {
+		return 0, err
+	}
+	if !found || record.State != journalStarted || !constantEqual(record.RequestDigest, requestDigest) {
+		return 0, ErrOperationConflict
+	}
+	record.RemoteAttempt++
+	if record.RemoteAttempt > 1_000_000 {
+		return 0, ErrOperationConflict
+	}
+	record.UpdatedAt = s.now().UTC()
+	if err := s.writeLocked(record); err != nil {
+		return 0, err
+	}
+	return record.RemoteAttempt, nil
+}
+
+func (s *journalStore) workspaceObjectPath(digest string) (string, error) {
+	if !isDigest(digest) {
+		return "", ErrInvalidRequest
+	}
+	return filepath.Join(s.objects, digest[len("sha256:"):]+".tar"), nil
+}
+
+func (s *journalStore) putWorkspaceObjectFileLocked(path, digest, source string, size int64, operationID string) error {
+	if info, statErr := os.Lstat(path); statErr == nil {
+		if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() || info.Size() != size {
+			return ErrOperationConflict
+		}
+		return nil
+	} else if !errors.Is(statErr, os.ErrNotExist) {
+		return statErr
+	}
+	if err := s.ensureCapacityLocked(0, size, operationID, digest); err != nil {
+		return err
+	}
+	input, err := os.Open(source)
+	if err != nil {
+		return err
+	}
+	defer input.Close() //nolint:errcheck
+	temporary, err := os.CreateTemp(s.objects, ".workspace-object-*.tmp")
+	if err != nil {
+		return err
+	}
+	temporaryPath := temporary.Name()
+	defer os.Remove(temporaryPath) //nolint:errcheck
+	err = temporary.Chmod(0o600)
+	if err == nil {
+		_, err = io.CopyN(temporary, input, size)
+	}
+	if err == nil {
+		var extra [1]byte
+		if count, readErr := input.Read(extra[:]); count != 0 || !errors.Is(readErr, io.EOF) {
+			err = fmt.Errorf("workspace object source size changed")
+		}
+	}
+	if err == nil {
+		err = temporary.Sync()
+	}
+	closeErr := temporary.Close()
+	if err == nil {
+		err = closeErr
+	}
+	if err != nil {
+		return err
+	}
+	if err := os.Rename(temporaryPath, path); err != nil {
+		return err
+	}
+	directory, err := os.Open(s.objects)
+	if err != nil {
+		return err
+	}
+	defer directory.Close() //nolint:errcheck
+	if err := directory.Sync(); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (s *journalStore) openWorkspaceObject(digest string, size int64) (*os.File, error) {
+	path, err := s.workspaceObjectPath(digest)
+	if err != nil {
+		return nil, err
+	}
+	info, err := os.Lstat(path)
+	if err != nil || info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() || info.Size() != size {
+		return nil, fmt.Errorf("workspace object is missing or corrupt")
+	}
+	return os.Open(path)
+}
+
+func (s *journalStore) readLocked(operationID string) (journalRecord, bool, error) {
+	path := s.recordPath(operationID)
+	data, err := readRegularFile(path, 4<<20)
+	if errors.Is(err, os.ErrNotExist) {
+		return journalRecord{}, false, nil
+	}
+	if err != nil {
+		return journalRecord{}, false, err
+	}
+	var record journalRecord
+	if err := decodeStrict(data, &record); err != nil {
+		return journalRecord{}, false, fmt.Errorf("decode durable operation journal: %w", err)
+	}
+	if err := validateJournalRecord(record, operationID); err != nil {
+		return journalRecord{}, false, err
+	}
+	return record, true, nil
+}
+
+func (s *journalStore) writeLocked(record journalRecord) error {
+	if err := validateJournalRecord(record, record.Metadata.OperationID); err != nil {
+		return err
+	}
+	data, err := json.Marshal(record)
+	if err != nil {
+		return err
+	}
+	data = append(data, '\n')
+	path := s.recordPath(record.Metadata.OperationID)
+	var oldSize int64
+	if info, statErr := os.Lstat(path); statErr == nil {
+		if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() {
+			return fmt.Errorf("unsafe durable operation record")
+		}
+		oldSize = info.Size()
+	} else if !errors.Is(statErr, os.ErrNotExist) {
+		return statErr
+	}
+	if err := s.ensureCapacityLocked(oldSize, int64(len(data)), record.Metadata.OperationID, journalWorkspaceDigest(record)); err != nil {
+		return err
+	}
+	return writeDurable(path, data, 0o600)
+}
+
+func (s *journalStore) ensureCapacityLocked(replacing, adding int64, protectedOperationID, protectedWorkspaceDigest string) error {
+	if err := s.reclaimLocked(protectedOperationID, protectedWorkspaceDigest); err != nil {
+		return err
+	}
+	total, err := s.totalBytes()
+	if err != nil {
+		return err
+	}
+	if total-replacing+adding > s.maxBytes {
+		return apiError(ErrJournalFull, "journal_full", "durable publisher volume is full", 507, true, nil)
+	}
+	return nil
+}
+
+type journalDiskRecord struct {
+	path   string
+	record journalRecord
+}
+
+// reclaimLocked removes workspace archives after no started operation can
+// need them for an upload retry. It also keeps at most the latest replay record
+// at each durable owner-progress boundary: beginning a later operation proves
+// the controller consumed and persisted every earlier terminal result for that
+// Task or Publication. The active operation is protected so a delayed replay
+// cannot lose its record while it is being served.
+func (s *journalStore) reclaimLocked(protectedOperationID, protectedWorkspaceDigest string) error {
+	records, err := s.journalRecordsLocked()
+	if err != nil {
+		return err
+	}
+
+	latestRankByOwner := make(map[string]int, len(records))
+	liveWorkspaceObjects := make(map[string]struct{})
+	if protectedWorkspaceDigest != "" {
+		liveWorkspaceObjects[protectedWorkspaceDigest] = struct{}{}
+	}
+	for _, entry := range records {
+		record := entry.record
+		owner := journalOwnerKey(record)
+		if rank := journalOperationRank(record.Operation); rank > latestRankByOwner[owner] {
+			latestRankByOwner[owner] = rank
+		}
+		if record.State == journalStarted && record.Workspace != nil && isDigest(record.Workspace.Artifact.Digest) {
+			liveWorkspaceObjects[record.Workspace.Artifact.Digest] = struct{}{}
+		}
+	}
+
+	if err := s.reclaimJournalRecordsLocked(
+		records, latestRankByOwner, protectedOperationID, s.now().UTC().Add(-journalReplayRetention),
+	); err != nil {
+		return err
+	}
+	return s.reclaimWorkspaceObjectsLocked(liveWorkspaceObjects)
+}
+
+func (s *journalStore) reclaimJournalRecordsLocked(
+	records []journalDiskRecord,
+	latestRankByOwner map[string]int,
+	protectedOperationID string,
+	replayCutoff time.Time,
+) error {
+	rootChanged := false
+	for _, entry := range records {
+		record := entry.record
+		if record.Metadata.OperationID == protectedOperationID || record.State == journalStarted {
+			continue
+		}
+		if record.UpdatedAt.After(replayCutoff) {
+			continue
+		}
+		if journalOperationRank(record.Operation) >= latestRankByOwner[journalOwnerKey(record)] {
+			continue
+		}
+		if err := os.Remove(entry.path); err != nil && !errors.Is(err, os.ErrNotExist) {
+			return err
+		}
+		rootChanged = true
+	}
+	if rootChanged {
+		return syncDirectory(s.root)
+	}
+	return nil
+}
+
+func (s *journalStore) reclaimWorkspaceObjectsLocked(liveWorkspaceObjects map[string]struct{}) error {
+	objectEntries, err := os.ReadDir(s.objects)
+	if err != nil {
+		return err
+	}
+	objectsChanged := false
+	for _, entry := range objectEntries {
+		info, infoErr := entry.Info()
+		if infoErr != nil {
+			return infoErr
+		}
+		name := entry.Name()
+		if info.Mode().IsRegular() && strings.HasPrefix(name, ".workspace-object-") && strings.HasSuffix(name, ".tmp") {
+			if err := os.Remove(filepath.Join(s.objects, name)); err != nil && !errors.Is(err, os.ErrNotExist) {
+				return err
+			}
+			objectsChanged = true
+			continue
+		}
+		if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() || !strings.HasSuffix(name, ".tar") {
+			return fmt.Errorf("durable publisher volume contains an unsafe workspace object")
+		}
+		digest := "sha256:" + strings.TrimSuffix(name, ".tar")
+		if !isDigest(digest) {
+			return fmt.Errorf("durable publisher volume contains an invalid workspace object")
+		}
+		if _, live := liveWorkspaceObjects[digest]; live {
+			continue
+		}
+		if err := os.Remove(filepath.Join(s.objects, name)); err != nil && !errors.Is(err, os.ErrNotExist) {
+			return err
+		}
+		objectsChanged = true
+	}
+	if objectsChanged {
+		return syncDirectory(s.objects)
+	}
+	return nil
+}
+
+func (s *journalStore) journalRecordsLocked() ([]journalDiskRecord, error) {
+	entries, err := os.ReadDir(s.root)
+	if err != nil {
+		return nil, err
+	}
+	records := make([]journalDiskRecord, 0, len(entries))
+	for _, entry := range entries {
+		if entry.Name() == filepath.Base(s.objects) {
+			if !entry.IsDir() {
+				return nil, fmt.Errorf("workspace object root is not a directory")
+			}
+			continue
+		}
+		info, infoErr := entry.Info()
+		if infoErr != nil {
+			return nil, infoErr
+		}
+		if info.Mode().IsRegular() && strings.HasPrefix(entry.Name(), ".orka-publisher-") && strings.HasSuffix(entry.Name(), ".tmp") {
+			if err := os.Remove(filepath.Join(s.root, entry.Name())); err != nil && !errors.Is(err, os.ErrNotExist) {
+				return nil, err
+			}
+			continue
+		}
+		if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() || !strings.HasSuffix(entry.Name(), ".json") {
+			return nil, fmt.Errorf("durable publisher volume contains an unsafe journal entry")
+		}
+		path := filepath.Join(s.root, entry.Name())
+		data, readErr := readRegularFile(path, 4<<20)
+		if readErr != nil {
+			return nil, readErr
+		}
+		var record journalRecord
+		if decodeErr := decodeStrict(data, &record); decodeErr != nil {
+			return nil, fmt.Errorf("decode durable operation journal: %w", decodeErr)
+		}
+		if validateErr := validateJournalRecord(record, record.Metadata.OperationID); validateErr != nil || s.recordPath(record.Metadata.OperationID) != path {
+			return nil, fmt.Errorf("durable operation journal is corrupt")
+		}
+		records = append(records, journalDiskRecord{path: path, record: record})
+	}
+	return records, nil
+}
+
+func journalWorkspaceDigest(record journalRecord) string {
+	if record.Workspace == nil || !isDigest(record.Workspace.Artifact.Digest) {
+		return ""
+	}
+	return record.Workspace.Artifact.Digest
+}
+
+func journalOwnerKey(record journalRecord) string {
+	metadata := record.Metadata
+	if metadata.TaskID != "" {
+		incarnation := metadata.OperationID
+		for _, prefix := range []string{"workspace-resolve-", "workspace-prepare-"} {
+			if record.Operation == OperationWorkspaceResolve && prefix != "workspace-resolve-" {
+				continue
+			}
+			if record.Operation == OperationWorkspacePrepare && prefix != "workspace-prepare-" {
+				continue
+			}
+			if strings.HasPrefix(metadata.OperationID, prefix) && len(metadata.OperationID) > len(prefix) {
+				incarnation = strings.TrimPrefix(metadata.OperationID, prefix)
+				break
+			}
+		}
+		return "task\x00" + metadata.Namespace + "\x00" + metadata.TaskID + "\x00" + incarnation
+	}
+	return "publication\x00" + metadata.Namespace + "\x00" + metadata.PublicationID
+}
+
+func journalOperationRank(operation Operation) int {
+	switch operation {
+	case OperationWorkspaceResolve, OperationPublicationPreflight:
+		return 1
+	case OperationWorkspacePrepare, OperationPublicationPrepare:
+		return 2
+	case OperationPublicationPublish:
+		return 3
+	case OperationPublicationVerify:
+		return 4
+	case OperationPullRequestReconcile:
+		return 5
+	case OperationPublicationReclaim:
+		return 6
+	default:
+		return 0
+	}
+}
+
+func syncDirectory(path string) error {
+	directory, err := os.Open(path)
+	if err != nil {
+		return err
+	}
+	defer directory.Close() //nolint:errcheck
+	return directory.Sync()
+}
+
+func (s *journalStore) totalBytes() (int64, error) {
+	var total int64
+	err := filepath.WalkDir(s.root, func(path string, entry os.DirEntry, walkErr error) error {
+		if walkErr != nil {
+			return walkErr
+		}
+		info, err := entry.Info()
+		if err != nil {
+			return err
+		}
+		if info.Mode()&os.ModeSymlink != 0 || (!entry.IsDir() && !info.Mode().IsRegular()) {
+			return fmt.Errorf("durable publisher volume contains an unsafe entry")
+		}
+		if info.Mode().IsRegular() {
+			if info.Size() > s.maxBytes-total {
+				return ErrJournalFull
+			}
+			total += info.Size()
+		}
+		return nil
+	})
+	return total, err
+}
+
+func (s *journalStore) recordPath(operationID string) string {
+	return filepath.Join(s.root, hashID("operation", operationID)+".json")
+}
+
+func validateJournalRecord(record journalRecord, operationID string) error {
+	if record.Version != journalVersion || record.Operation.Path() == "" || record.Metadata.OperationID != operationID ||
+		record.Metadata.validateFor(record.Operation) != nil || !isDigest(record.RequestDigest) || record.StartedAt.IsZero() || record.UpdatedAt.IsZero() {
+		return fmt.Errorf("durable operation journal is corrupt")
+	}
+	switch record.State {
+	case journalStarted:
+		if record.StatusCode != 0 || len(record.Response) != 0 {
+			return fmt.Errorf("started durable operation has a terminal response")
+		}
+	case journalCompleted, journalFailed:
+		if record.StatusCode < 100 || record.StatusCode > 599 || len(record.Response) == 0 {
+			return fmt.Errorf("terminal durable operation is incomplete")
+		}
+	default:
+		return fmt.Errorf("durable operation state is invalid")
+	}
+	return nil
+}
+
+func ensurePrivateDirectory(path string) error {
+	if err := os.MkdirAll(path, 0o700); err != nil {
+		return err
+	}
+	info, err := os.Lstat(path)
+	if err != nil || info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
+		return fmt.Errorf("path is not a private no-follow directory")
+	}
+	if info.Mode().Perm()&0o077 != 0 {
+		if err := os.Chmod(path, 0o700); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func readRegularFile(path string, limit int64) ([]byte, error) {
+	info, err := os.Lstat(path)
+	if err != nil {
+		return nil, err
+	}
+	if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() || info.Size() < 0 || info.Size() > limit {
+		return nil, fmt.Errorf("unsafe or oversized durable file")
+	}
+	file, err := os.Open(path)
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close() //nolint:errcheck
+	data, err := io.ReadAll(io.LimitReader(file, limit+1))
+	if err != nil || int64(len(data)) > limit {
+		return nil, fmt.Errorf("read durable file: %w", err)
+	}
+	return data, nil
+}
+
+func writeDurable(path string, data []byte, mode os.FileMode) error {
+	directory := filepath.Dir(path)
+	if err := ensurePrivateDirectory(directory); err != nil {
+		return err
+	}
+	temporary, err := os.CreateTemp(directory, ".orka-publisher-*.tmp")
+	if err != nil {
+		return err
+	}
+	temporaryPath := temporary.Name()
+	defer os.Remove(temporaryPath) //nolint:errcheck
+	err = temporary.Chmod(mode)
+	if err == nil {
+		_, err = temporary.Write(data)
+	}
+	if err == nil {
+		err = temporary.Sync()
+	}
+	closeErr := temporary.Close()
+	if err == nil {
+		err = closeErr
+	}
+	if err != nil {
+		return err
+	}
+	if err := os.Rename(temporaryPath, path); err != nil {
+		return err
+	}
+	directoryFile, err := os.Open(directory)
+	if err != nil {
+		return err
+	}
+	defer directoryFile.Close() //nolint:errcheck
+	return directoryFile.Sync()
+}
+
+func decodeStrict(data []byte, target any) error {
+	decoder := json.NewDecoder(bytes.NewReader(data))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(target); err != nil {
+		return err
+	}
+	if err := decoder.Decode(&struct{}{}); err != io.EOF {
+		if err == nil {
+			return fmt.Errorf("trailing JSON value")
+		}
+		return err
+	}
+	return nil
+}
diff --git a/internal/publisher/service/journal_test.go b/internal/publisher/service/journal_test.go
new file mode 100644
index 000000000..03afc1ea5
--- /dev/null
+++ b/internal/publisher/service/journal_test.go
@@ -0,0 +1,211 @@
+package service
+
+import (
+	"context"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+const testJournalDigest = "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+
+func TestJournalReclaimsWorkspaceObjectAfterTerminalReplayIsDurable(t *testing.T) {
+	t.Parallel()
+	store := newTestJournalStore(t)
+	metadata := OperationMetadata{Namespace: "default", OperationID: "workspace-prepare-1", TaskID: "task-1"}
+	requestDigest := journalTestDigest("b")
+	if _, _, err := store.begin(context.Background(), OperationWorkspacePrepare, metadata, requestDigest); err != nil {
+		t.Fatalf("begin: %v", err)
+	}
+
+	source := writeJournalWorkspaceObject(t, "workspace archive")
+	prepared := WorkspacePrepareResponse{
+		OperationID: metadata.OperationID,
+		Artifact: harnessv2.ArtifactReference{
+			Digest:    testJournalDigest,
+			SizeBytes: int64(len("workspace archive")),
+		},
+	}
+	if err := store.setWorkspaceObjectFile(
+		context.Background(), metadata.OperationID, requestDigest, prepared, source, int64(len("workspace archive")),
+	); err != nil {
+		t.Fatalf("persist workspace: %v", err)
+	}
+	objectPath, err := store.workspaceObjectPath(testJournalDigest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(objectPath); err != nil {
+		t.Fatalf("workspace object before completion: %v", err)
+	}
+
+	response := []byte(`{"operationId":"workspace-prepare-1"}`)
+	if err := store.complete(context.Background(), metadata.OperationID, requestDigest, 200, response); err != nil {
+		t.Fatalf("complete: %v", err)
+	}
+	if _, err := os.Stat(objectPath); !os.IsNotExist(err) {
+		t.Fatalf("workspace object after completion err = %v, want not exist", err)
+	}
+
+	replayed, found, err := store.begin(context.Background(), OperationWorkspacePrepare, metadata, requestDigest)
+	if err != nil {
+		t.Fatalf("replay begin: %v", err)
+	}
+	if !found || replayed.State != journalCompleted || string(replayed.Response) != string(response) {
+		t.Fatalf("replayed record = %#v, found=%v", replayed, found)
+	}
+}
+
+func TestJournalKeepsSharedWorkspaceObjectUntilEveryUploadSettles(t *testing.T) {
+	t.Parallel()
+	store := newTestJournalStore(t)
+	objectPath, err := store.workspaceObjectPath(testJournalDigest)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	type operation struct {
+		id     string
+		taskID string
+		digest string
+	}
+	operations := make([]operation, 0, 2)
+	for index, taskID := range []string{"task-1", "task-2"} {
+		operationID := "workspace-prepare-" + taskID
+		digest := journalTestDigest(string(rune('b' + index)))
+		metadata := OperationMetadata{Namespace: "default", OperationID: operationID, TaskID: taskID}
+		if _, _, err := store.begin(context.Background(), OperationWorkspacePrepare, metadata, digest); err != nil {
+			t.Fatalf("begin %s: %v", taskID, err)
+		}
+		operations = append(operations, operation{id: operationID, taskID: taskID, digest: digest})
+	}
+
+	source := writeJournalWorkspaceObject(t, "shared archive")
+	for _, operation := range operations {
+		prepared := WorkspacePrepareResponse{
+			OperationID: operation.id,
+			Artifact: harnessv2.ArtifactReference{
+				Digest:    testJournalDigest,
+				SizeBytes: int64(len("shared archive")),
+			},
+		}
+		if err := store.setWorkspaceObjectFile(
+			context.Background(), operation.id, operation.digest, prepared, source, int64(len("shared archive")),
+		); err != nil {
+			t.Fatalf("persist workspace %s: %v", operation.taskID, err)
+		}
+	}
+
+	firstDigest := journalTestDigest("b")
+	if err := store.complete(context.Background(), "workspace-prepare-task-1", firstDigest, 200, []byte(`{"ok":true}`)); err != nil {
+		t.Fatalf("complete first owner: %v", err)
+	}
+	if _, err := os.Stat(objectPath); err != nil {
+		t.Fatalf("shared object was reclaimed while referenced: %v", err)
+	}
+
+	secondDigest := journalTestDigest("c")
+	if err := store.complete(context.Background(), "workspace-prepare-task-2", secondDigest, 200, []byte(`{"ok":true}`)); err != nil {
+		t.Fatalf("complete second owner: %v", err)
+	}
+	if _, err := os.Stat(objectPath); !os.IsNotExist(err) {
+		t.Fatalf("shared object after final completion err = %v, want not exist", err)
+	}
+}
+
+func TestJournalReclaimsEarlierTerminalRecordsAfterOwnerAdvances(t *testing.T) {
+	t.Parallel()
+	store := newTestJournalStore(t)
+	resolveMetadata := OperationMetadata{Namespace: "default", OperationID: "workspace-resolve-1", TaskID: "task-1"}
+	resolveDigest := journalTestDigest("b")
+	if _, _, err := store.begin(context.Background(), OperationWorkspaceResolve, resolveMetadata, resolveDigest); err != nil {
+		t.Fatalf("begin resolve: %v", err)
+	}
+	if err := store.complete(context.Background(), resolveMetadata.OperationID, resolveDigest, 200, []byte(`{"ok":true}`)); err != nil {
+		t.Fatalf("complete resolve: %v", err)
+	}
+	resolvePath := store.recordPath(resolveMetadata.OperationID)
+	if _, err := os.Stat(resolvePath); err != nil {
+		t.Fatalf("resolve record before owner advance: %v", err)
+	}
+
+	prepareMetadata := OperationMetadata{Namespace: "default", OperationID: "workspace-prepare-1", TaskID: "task-1"}
+	prepareDigest := journalTestDigest("c")
+	if _, _, err := store.begin(context.Background(), OperationWorkspacePrepare, prepareMetadata, prepareDigest); err != nil {
+		t.Fatalf("begin prepare: %v", err)
+	}
+	if _, err := os.Stat(resolvePath); err != nil {
+		t.Fatalf("recent resolve replay was pruned when a later operation merely started: %v", err)
+	}
+	resolveRecord, found, err := store.readLocked(resolveMetadata.OperationID)
+	if err != nil || !found {
+		t.Fatalf("read resolve record = found %t err %v", found, err)
+	}
+	resolveRecord.UpdatedAt = resolveRecord.UpdatedAt.Add(-journalReplayRetention - time.Hour)
+	if err := store.writeLocked(resolveRecord); err != nil {
+		t.Fatalf("age resolve record: %v", err)
+	}
+	if err := store.reclaimLocked(prepareMetadata.OperationID, ""); err != nil {
+		t.Fatalf("reclaim aged resolve record: %v", err)
+	}
+	if _, err := os.Stat(resolvePath); !os.IsNotExist(err) {
+		t.Fatalf("resolve record after owner advance err = %v, want not exist", err)
+	}
+	if _, err := os.Stat(store.recordPath(prepareMetadata.OperationID)); err != nil {
+		t.Fatalf("active prepare record: %v", err)
+	}
+}
+
+func TestJournalDoesNotPruneAcrossTaskIncarnations(t *testing.T) {
+	t.Parallel()
+	store := newTestJournalStore(t)
+	oldPrepare := OperationMetadata{Namespace: "default", OperationID: "workspace-prepare-prompt-old", TaskID: "task-1"}
+	oldDigest := journalTestDigest("d")
+	if _, _, err := store.begin(context.Background(), OperationWorkspacePrepare, oldPrepare, oldDigest); err != nil {
+		t.Fatal(err)
+	}
+	if err := store.complete(context.Background(), oldPrepare.OperationID, oldDigest, 200, []byte(`{"ok":true}`)); err != nil {
+		t.Fatal(err)
+	}
+
+	newResolve := OperationMetadata{Namespace: "default", OperationID: "workspace-resolve-prompt-new", TaskID: "task-1"}
+	newDigest := journalTestDigest("e")
+	if _, _, err := store.begin(context.Background(), OperationWorkspaceResolve, newResolve, newDigest); err != nil {
+		t.Fatal(err)
+	}
+	if err := store.complete(context.Background(), newResolve.OperationID, newDigest, 200, []byte(`{"ok":true}`)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(store.recordPath(newResolve.OperationID)); err != nil {
+		t.Fatalf("new incarnation resolve replay was pruned: %v", err)
+	}
+}
+
+func journalTestDigest(hexDigit string) string {
+	return "sha256:" + strings.Repeat(hexDigit, 64)
+}
+
+func newTestJournalStore(t *testing.T) *journalStore {
+	t.Helper()
+	now := time.Date(2026, time.August, 1, 12, 0, 0, 0, time.UTC)
+	store, err := newJournalStore(t.TempDir(), 16<<20, func() time.Time {
+		now = now.Add(time.Second)
+		return now
+	})
+	if err != nil {
+		t.Fatalf("new journal store: %v", err)
+	}
+	return store
+}
+
+func writeJournalWorkspaceObject(t *testing.T, contents string) string {
+	t.Helper()
+	path := t.TempDir() + "/workspace.tar"
+	if err := os.WriteFile(path, []byte(contents), 0o600); err != nil {
+		t.Fatalf("write workspace object: %v", err)
+	}
+	return path
+}
diff --git a/internal/publisher/service/process_other.go b/internal/publisher/service/process_other.go
new file mode 100644
index 000000000..cf8bc466e
--- /dev/null
+++ b/internal/publisher/service/process_other.go
@@ -0,0 +1,12 @@
+//go:build !unix
+
+package service
+
+import (
+	"os/exec"
+	"time"
+)
+
+func configureCommand(command *exec.Cmd) {
+	command.WaitDelay = 2 * time.Second
+}
diff --git a/internal/publisher/service/process_unix.go b/internal/publisher/service/process_unix.go
new file mode 100644
index 000000000..047bba0d2
--- /dev/null
+++ b/internal/publisher/service/process_unix.go
@@ -0,0 +1,20 @@
+//go:build unix
+
+package service
+
+import (
+	"os/exec"
+	"syscall"
+	"time"
+)
+
+func configureCommand(command *exec.Cmd) {
+	command.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+	command.Cancel = func() error {
+		if command.Process == nil {
+			return nil
+		}
+		return syscall.Kill(-command.Process.Pid, syscall.SIGKILL)
+	}
+	command.WaitDelay = 2 * time.Second
+}
diff --git a/internal/publisher/service/proxy_environment_test.go b/internal/publisher/service/proxy_environment_test.go
new file mode 100644
index 000000000..81d4a5a3f
--- /dev/null
+++ b/internal/publisher/service/proxy_environment_test.go
@@ -0,0 +1,47 @@
+package service
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestLoadConfigFromEnvRequiresValidatedSCMEgressProxy(t *testing.T) {
+	clearPublisherEnvForTest(t)
+	controller := writePublisherSecretForTest(t, "controller", strings.Repeat("c", 32))
+	operation := writePublisherSecretForTest(t, "operation", strings.Repeat("o", MinSecretBytes))
+	t.Setenv(EnvControllerTokenFile, controller)
+	t.Setenv(EnvOperationCapabilitySecretFile, operation)
+	t.Setenv(EnvArtifactAuthorizationBrokerURL, "https://orka-api.example")
+	t.Setenv(EnvCredentialBrokerURL, "https://orka-api.example")
+	t.Setenv(EnvArtifactAPIURL, "https://orka-api.example")
+	t.Setenv(EnvSCMEgressProxyRequired, "true")
+	password := strings.Repeat("p", 64)
+	t.Setenv("HTTPS_PROXY", "http://orka-publisher:"+password+"@orka-scm-egress-proxy.orka-system.svc:8080")
+	t.Setenv("NO_PROXY", "localhost,127.0.0.1,::1,.svc,.cluster.local")
+
+	config, err := LoadConfigFromEnv()
+	if err != nil {
+		t.Fatalf("LoadConfigFromEnv: %v", err)
+	}
+	if config.ProxyEnvironment.HTTPSProxy == "" || config.ProxyEnvironment.NoProxy == "" {
+		t.Fatal("SCM egress proxy environment was not retained")
+	}
+}
+
+func TestLoadConfigFromEnvRejectsUnsafeSCMEgressBypass(t *testing.T) {
+	clearPublisherEnvForTest(t)
+	controller := writePublisherSecretForTest(t, "controller", strings.Repeat("c", 32))
+	operation := writePublisherSecretForTest(t, "operation", strings.Repeat("o", MinSecretBytes))
+	t.Setenv(EnvControllerTokenFile, controller)
+	t.Setenv(EnvOperationCapabilitySecretFile, operation)
+	t.Setenv(EnvArtifactAuthorizationBrokerURL, "https://orka-api.example")
+	t.Setenv(EnvCredentialBrokerURL, "https://orka-api.example")
+	t.Setenv(EnvArtifactAPIURL, "https://orka-api.example")
+	t.Setenv(EnvSCMEgressProxyRequired, "true")
+	t.Setenv("HTTPS_PROXY", "http://orka-publisher:"+strings.Repeat("p", 64)+"@proxy.orka-system.svc:8080")
+	t.Setenv("NO_PROXY", "github.com")
+
+	if _, err := LoadConfigFromEnv(); err == nil {
+		t.Fatal("LoadConfigFromEnv accepted a public NO_PROXY bypass")
+	}
+}
diff --git a/internal/publisher/service/server.go b/internal/publisher/service/server.go
new file mode 100644
index 000000000..158338655
--- /dev/null
+++ b/internal/publisher/service/server.go
@@ -0,0 +1,403 @@
+package service
+
+import (
+	"context"
+	"crypto/sha256"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"os"
+	"os/exec"
+	"strings"
+	"sync"
+
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/publisher"
+)
+
+type Server struct {
+	config      Config
+	handler     http.Handler
+	journal     *journalStore
+	artifacts   *artifactClient
+	credentials credentialManager
+	gitBinary   string
+	gitVersion  string
+	semaphore   chan struct{}
+	locks       [64]sync.Mutex
+
+	publicationMu sync.Mutex
+}
+
+func New(config Config) (*Server, error) {
+	normalized, err := normalizeConfig(config)
+	if err != nil {
+		return nil, err
+	}
+	gitBinary, err := ensureGitBinary(normalized.GitBinary)
+	if err != nil {
+		return nil, err
+	}
+	gitVersion, err := detectGitVersion(gitBinary)
+	if err != nil {
+		return nil, err
+	}
+	if normalized.RequiredGitVersion != "" && gitVersion != normalized.RequiredGitVersion {
+		return nil, fmt.Errorf("git version %q does not match required %q", gitVersion, normalized.RequiredGitVersion)
+	}
+	if err := ensurePrivateDirectory(normalized.ArtifactRoot); err != nil {
+		return nil, fmt.Errorf("prepare publication artifact root: %w", err)
+	}
+	if err := ensurePrivateDirectory(normalized.TempRoot); err != nil {
+		return nil, fmt.Errorf("prepare temporary root: %w", err)
+	}
+	if normalized.CredentialRoot != "" {
+		info, statErr := osLstat(normalized.CredentialRoot)
+		if statErr != nil || info.modeSymlink || !info.directory {
+			return nil, fmt.Errorf("credential root is missing or unsafe")
+		}
+	}
+	journal, err := newJournalStore(normalized.JournalRoot, normalized.MaxJournalBytes, normalized.Now)
+	if err != nil {
+		return nil, err
+	}
+	var artifactAuthorizer artifactAuthorizer
+	if normalized.ArtifactAuthorizationBrokerURL != "" {
+		artifactAuthorizer, err = newBrokerArtifactAuthorizer(
+			normalized.ArtifactAuthorizationBrokerURL, normalized.HTTPClient,
+			normalized.ControllerBearerToken, normalized.ArtifactTimeout,
+		)
+	} else {
+		artifactAuthorizer = &localArtifactAuthorizer{
+			secret: append([]byte(nil), normalized.ArtifactCapabilitySecret...),
+			ttl:    normalized.CapabilityTTL, now: normalized.Now,
+		}
+	}
+	if err != nil {
+		return nil, err
+	}
+	artifacts, err := newArtifactClient(
+		normalized.ArtifactAPIURL, normalized.HTTPClient, artifactAuthorizer, normalized.ArtifactTimeout,
+	)
+	if err != nil {
+		return nil, err
+	}
+	var credentialProvider credentialProvider
+	if normalized.CredentialBrokerURL != "" {
+		credentialProvider, err = newBrokerCredentialProvider(
+			normalized.CredentialBrokerURL, normalized.HTTPClient,
+			normalized.ControllerBearerToken, normalized.ArtifactTimeout,
+		)
+	} else if normalized.CredentialRoot != "" {
+		credentialProvider = &fileCredentialProvider{root: normalized.CredentialRoot}
+	}
+	if err != nil {
+		return nil, err
+	}
+	server := &Server{
+		config: normalized, journal: journal, artifacts: artifacts, gitBinary: gitBinary, gitVersion: gitVersion,
+		semaphore: make(chan struct{}, normalized.MaxConcurrentOperations),
+		credentials: credentialManager{
+			provider: credentialProvider, tempRoot: normalized.TempRoot, realGit: gitBinary,
+			defaultGit: normalized.DefaultGitCredential,
+		},
+	}
+	server.handler = server.routes()
+	return server, nil
+}
+
+// Handler returns the bounded HTTP API. The handler never logs request bodies,
+// headers, repository URLs, credentials, or upstream error strings.
+func (s *Server) Handler() http.Handler { return s.handler }
+
+func (s *Server) routes() http.Handler {
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET "+HealthPath, s.handleHealth)
+	mux.HandleFunc("GET "+CapabilitiesPath, s.handleCapabilities)
+	mux.HandleFunc("POST "+WorkspaceResolvePath, s.handleWorkspaceResolve)
+	mux.HandleFunc("POST "+WorkspacePreparePath, s.handleWorkspacePrepare)
+	mux.HandleFunc("POST "+PublicationPreflightPath, s.handlePublicationPreflight)
+	mux.HandleFunc("POST "+PublicationPreparePath, s.handlePublicationPrepare)
+	mux.HandleFunc("POST "+PublicationPublishPath, s.handlePublicationPublish)
+	mux.HandleFunc("POST "+PublicationVerifyPath, s.handlePublicationVerify)
+	mux.HandleFunc("POST "+PublicationReclaimPath, s.handlePublicationReclaim)
+	mux.HandleFunc("POST "+PullRequestReconcilePath, s.handlePullRequestReconcile)
+	return securityHeaders(mux)
+}
+
+func securityHeaders(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		writer.Header().Set("Cache-Control", "no-store")
+		writer.Header().Set("Content-Security-Policy", "default-src 'none'")
+		writer.Header().Set("X-Content-Type-Options", "nosniff")
+		next.ServeHTTP(writer, request)
+	})
+}
+
+func (s *Server) handleHealth(writer http.ResponseWriter, _ *http.Request) {
+	s.writePublicJSON(writer, http.StatusOK, HealthResponse{Status: "ok", Ready: true})
+}
+
+func (s *Server) handleCapabilities(writer http.ResponseWriter, _ *http.Request) {
+	operations := []Operation{
+		OperationWorkspaceResolve, OperationWorkspacePrepare, OperationPublicationPreflight, OperationPublicationPrepare,
+		OperationPublicationPublish, OperationPublicationVerify, OperationPublicationReclaim,
+	}
+	credentialKinds := []CredentialKind{CredentialHTTPExtraHeader}
+	if s.config.PRFactory != nil {
+		operations = append(operations, OperationPullRequestReconcile)
+		credentialKinds = append(credentialKinds, CredentialForgeToken)
+	}
+	response := CapabilitiesResponse{
+		Protocol: ProtocolVersion, NetworkIdentity: "workspace-publisher", Operations: operations,
+		Authentication:  []string{"controller-bearer", "operation-capability"},
+		CredentialKinds: append([]CredentialKind(nil), credentialKinds...),
+		SCMSchemes:      []string{schemeHTTPS}, GitVersion: s.gitVersion, RedirectsAllowed: false,
+		ProviderOrMCPAccess: false, PullRequestReconciliation: s.config.PRFactory != nil,
+		Limits: CapabilityLimits{
+			MaxConcurrentOperations: s.config.MaxConcurrentOperations,
+			MaxRequestBytes:         s.config.MaxRequestBytes, MaxResponseBytes: s.config.MaxResponseBytes,
+			MaxWorkspaceEntries:       s.config.WorkspaceLimits.MaxEntries,
+			MaxWorkspaceFileBytes:     s.config.WorkspaceLimits.MaxFileBytes,
+			MaxWorkspaceBytes:         s.config.WorkspaceLimits.MaxExpandedBytes,
+			MaxWorkspaceArtifactBytes: s.config.WorkspaceLimits.MaxArtifactBytes,
+			MaxDeltaBytes:             s.config.MaxDeltaBytes, MaxBundleBytes: s.config.MaxBundleBytes,
+			MaxJournalBytes: s.config.MaxJournalBytes,
+		},
+	}
+	if s.config.AllowFileRepositories {
+		response.SCMSchemes = append(response.SCMSchemes, "file")
+	}
+	s.writePublicJSON(writer, http.StatusOK, response)
+}
+
+type operationDecoder func([]byte) (OperationMetadata, any, error)
+type operationExecutor func(context.Context, OperationMetadata, string, journalRecord, any) (int, any, error)
+
+func (s *Server) serveOperation(writer http.ResponseWriter, request *http.Request, operation Operation, decode operationDecoder, execute operationExecutor) {
+	if !s.authenticateBearer(request) {
+		s.writePublicJSON(writer, http.StatusUnauthorized, ErrorResponse{Code: "unauthorized", Message: "authorization failed", Retryable: false})
+		return
+	}
+	select {
+	case s.semaphore <- struct{}{}:
+		defer func() { <-s.semaphore }()
+	default:
+		s.writePublicJSON(writer, http.StatusTooManyRequests, ErrorResponse{Code: "busy", Message: "publisher concurrency limit reached", Retryable: true})
+		return
+	}
+	body, err := s.readBody(writer, request)
+	if err != nil {
+		s.writeOperationError(writer, OperationMetadata{}, "", err)
+		return
+	}
+	canonical, err := canonicalRequestBody(body)
+	if err != nil {
+		s.writeOperationError(writer, OperationMetadata{}, "", err)
+		return
+	}
+	requestDigest, err := RequestDigest(http.MethodPost, operation.Path(), canonical)
+	if err != nil {
+		s.writeOperationError(writer, OperationMetadata{}, "", err)
+		return
+	}
+	metadata, value, err := decode(canonical)
+	if err != nil {
+		s.writeOperationError(writer, metadata, requestDigest, err)
+		return
+	}
+	if err := metadata.validateFor(operation); err != nil {
+		s.writeOperationError(writer, metadata, requestDigest, err)
+		return
+	}
+	expected := NewClaims(operation, metadata, requestDigest, s.config.Now(), s.config.CapabilityTTL)
+	if err := VerifyCapability(s.config.OperationCapabilitySecret, request.Header.Get(OperationCapabilityHeader), expected, s.config.Now()); err != nil ||
+		!constantEqual(request.Header.Get(OperationRequestDigestHeader), requestDigest) {
+		s.writeOperationError(writer, metadata, requestDigest, apiError(ErrUnauthorized, "unauthorized", "authorization failed", http.StatusForbidden, false, nil))
+		return
+	}
+	lock := s.operationLock(metadata.OperationID)
+	lock.Lock()
+	defer lock.Unlock()
+	record, _, err := s.journal.begin(request.Context(), operation, metadata, requestDigest)
+	if err != nil {
+		s.writeOperationError(writer, metadata, requestDigest, err)
+		return
+	}
+	if record.State == journalCompleted || record.State == journalFailed {
+		s.writeBytes(writer, record.StatusCode, record.Response)
+		return
+	}
+	status, response, err := execute(request.Context(), metadata, requestDigest, record, value)
+	if err != nil {
+		s.writeAndJournalError(writer, metadata, requestDigest, err)
+		return
+	}
+	data, err := encodeJSON(response)
+	if err != nil || int64(len(data)) > s.config.MaxResponseBytes {
+		s.writeAndJournalError(writer, metadata, requestDigest, apiError(nil, "response_invalid", "publisher response could not be encoded", 500, true, err))
+		return
+	}
+	if err := s.journal.complete(context.WithoutCancel(request.Context()), metadata.OperationID, requestDigest, status, data); err != nil {
+		s.writeOperationError(writer, metadata, requestDigest, apiError(ErrJournalFull, "journal_unavailable", "publisher result could not be durably recorded", 507, true, err))
+		return
+	}
+	s.writeBytes(writer, status, data)
+}
+
+func (s *Server) authenticateBearer(request *http.Request) bool {
+	value := request.Header.Get("Authorization")
+	if !strings.HasPrefix(value, "Bearer ") {
+		return false
+	}
+	return constantEqual(strings.TrimPrefix(value, "Bearer "), string(s.config.ControllerBearerToken))
+}
+
+func (s *Server) readBody(writer http.ResponseWriter, request *http.Request) ([]byte, error) {
+	mediaType := request.Header.Get("Content-Type")
+	if mediaType != "application/json" {
+		return nil, invalidRequest("content type must be application/json", nil)
+	}
+	reader := http.MaxBytesReader(writer, request.Body, s.config.MaxRequestBytes)
+	defer reader.Close() //nolint:errcheck
+	body, err := io.ReadAll(reader)
+	if err != nil {
+		var maxErr *http.MaxBytesError
+		if errors.As(err, &maxErr) {
+			return nil, apiError(ErrInvalidRequest, "request_too_large", "request body exceeds the configured limit", http.StatusRequestEntityTooLarge, false, nil)
+		}
+		return nil, invalidRequest("request body could not be read", err)
+	}
+	if len(body) == 0 {
+		return nil, invalidRequest("request body is empty", nil)
+	}
+	return body, nil
+}
+
+func canonicalRequestBody(body []byte) ([]byte, error) {
+	canonical, err := harnessv2.CanonicalJSON(body)
+	if err != nil {
+		return nil, invalidRequest("request body contains invalid or ambiguous JSON", err)
+	}
+	return canonical, nil
+}
+
+func (s *Server) operationLock(operationID string) *sync.Mutex {
+	sum := sha256.Sum256([]byte(operationID))
+	index := int(sum[0]) % len(s.locks)
+	return &s.locks[index]
+}
+
+func (s *Server) writeAndJournalError(writer http.ResponseWriter, metadata OperationMetadata, requestDigest string, err error) {
+	status, response, terminal := errorResponse(classifyPublisherError(err), metadata, requestDigest)
+	data, encodeErr := encodeJSON(response)
+	if encodeErr != nil {
+		data = []byte("{\"code\":\"internal\",\"message\":\"publisher error response failed\",\"retryable\":true}\n")
+		status, terminal = http.StatusInternalServerError, false
+	}
+	if terminal && metadata.OperationID != "" && requestDigest != "" {
+		_ = s.journal.fail(context.Background(), metadata.OperationID, requestDigest, status, data)
+	}
+	s.writeBytes(writer, status, data)
+}
+
+func (s *Server) writeOperationError(writer http.ResponseWriter, metadata OperationMetadata, requestDigest string, err error) {
+	status, response, _ := errorResponse(classifyPublisherError(err), metadata, requestDigest)
+	s.writePublicJSON(writer, status, response)
+}
+
+func (s *Server) writePublicJSON(writer http.ResponseWriter, status int, value any) {
+	data, err := encodeJSON(value)
+	if err != nil || int64(len(data)) > s.config.MaxResponseBytes {
+		status = http.StatusInternalServerError
+		data = []byte("{\"code\":\"internal\",\"message\":\"response encoding failed\",\"retryable\":true}\n")
+	}
+	s.writeBytes(writer, status, data)
+}
+
+func (s *Server) writeBytes(writer http.ResponseWriter, status int, data []byte) {
+	writer.Header().Set("Content-Type", "application/json")
+	writer.Header().Set("Content-Length", fmt.Sprintf("%d", len(data)))
+	writer.WriteHeader(status)
+	_, _ = writer.Write(data)
+}
+
+func (s *Server) newPublisher(gitBinary string) (*publisher.Publisher, error) {
+	return publisher.New(publisher.Options{
+		ArtifactRoot: s.config.ArtifactRoot, TempRoot: s.config.TempRoot, GitBinary: gitBinary,
+		MaxDeltaBytes: s.config.MaxDeltaBytes, MaxBundleBytes: s.config.MaxBundleBytes,
+		MaxCommandOutput: s.config.MaxCommandOutput, PublishTimeout: s.config.PublishTimeout,
+		VerifyAttempts: s.config.VerifyAttempts, VerifyBackoff: s.config.VerifyBackoff,
+		ProxyEnvironment: s.config.ProxyEnvironment,
+	})
+}
+
+func detectGitVersion(binary string) (string, error) {
+	command := exec.CommandContext(context.Background(), binary, "version")
+	configureCommand(command)
+	command.Env = []string{"HOME=/dev/null", gitConfigGlobalNull, gitConfigNoSystem, lcAllC, langC, "PATH=/usr/local/bin:/usr/bin:/bin"}
+	output := &limitedBuffer{limit: 256}
+	command.Stdout = output
+	command.Stderr = &limitedBuffer{limit: 256}
+	if err := command.Run(); err != nil || output.truncated {
+		return "", fmt.Errorf("inspect Git version")
+	}
+	value := strings.TrimSpace(output.String())
+	const prefix = "git version "
+	if !strings.HasPrefix(value, prefix) || strings.ContainsAny(value, "\r\n\x00") {
+		return "", fmt.Errorf("git returned a malformed version")
+	}
+	return strings.TrimPrefix(value, prefix), nil
+}
+
+func classifyPublisherError(err error) error {
+	if err == nil {
+		return nil
+	}
+	var typed *operationError
+	if errors.As(err, &typed) {
+		return err
+	}
+	switch {
+	case errors.Is(err, context.Canceled), errors.Is(err, context.DeadlineExceeded):
+		return apiError(nil, "operation_interrupted", "operation was interrupted before settlement", 503, true, err)
+	case errors.Is(err, publisher.ErrInvalidRequest), errors.Is(err, publisher.ErrInvalidRepository),
+		errors.Is(err, publisher.ErrInvalidRef), errors.Is(err, publisher.ErrInvalidObjectID):
+		return apiError(ErrInvalidRequest, "invalid_request", "publisher request is invalid", 400, false, err)
+	case errors.Is(err, publisher.ErrUnsafeDelta), errors.Is(err, publisher.ErrUnsupportedDelta):
+		return apiError(ErrInvalidRequest, "unsafe_delta", "workspace delta is unsafe or unsupported", 422, false, err)
+	case errors.Is(err, publisher.ErrSourceMoved):
+		return apiError(nil, "source_moved", "source ref moved from the persisted baseline", 409, false, err)
+	case errors.Is(err, publisher.ErrBranchMoved), errors.Is(err, publisher.ErrBranchClaimMismatch):
+		return apiError(nil, "branch_moved", "publication branch no longer matches its durable claim", 409, false, err)
+	case errors.Is(err, publisher.ErrIdempotencyConflict):
+		return apiError(ErrOperationConflict, "operation_conflict", "publisher operation conflicts with durable state", 409, false, err)
+	case errors.Is(err, publisher.ErrPreparedArtifactMissing):
+		return apiError(nil, "prepared_artifact_missing", "prepared publication artifact is missing", 409, false, err)
+	case errors.Is(err, publisher.ErrPreparedArtifactCorrupt):
+		return apiError(nil, "prepared_artifact_corrupt", "prepared publication artifact is corrupt", 500, false, err)
+	case errors.Is(err, ErrUnauthorized):
+		return apiError(ErrUnauthorized, "unauthorized", "authorization failed", 403, false, nil)
+	default:
+		return apiError(nil, "upstream_failure", "clean-room SCM operation failed", 502, true, err)
+	}
+}
+
+func (s *Server) LogStartup(logger *slog.Logger) {
+	logger.Info("workspace publisher configured", "listenAddress", s.config.ListenAddress, "protocol", ProtocolVersion, "gitVersion", s.gitVersion)
+}
+
+type safeFileInfo struct {
+	modeSymlink bool
+	directory   bool
+}
+
+func osLstat(path string) (safeFileInfo, error) {
+	info, err := os.Lstat(path)
+	if err != nil {
+		return safeFileInfo{}, err
+	}
+	return safeFileInfo{modeSymlink: info.Mode()&os.ModeSymlink != 0, directory: info.IsDir()}, nil
+}
diff --git a/internal/publisher/service/service_test.go b/internal/publisher/service/service_test.go
new file mode 100644
index 000000000..78a93911a
--- /dev/null
+++ b/internal/publisher/service/service_test.go
@@ -0,0 +1,1209 @@
+package service
+
+import (
+	"archive/tar"
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"slices"
+	"sort"
+	"strconv"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/orka-agents/orka/internal/artifactcap"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/publisher"
+	"github.com/orka-agents/orka/internal/workspacedelta"
+)
+
+const (
+	testNamespace      = "default"
+	testMainRef        = "refs/heads/" + githubTestBaseBranch
+	testPublicationRef = "refs/heads/orka/test-publication"
+)
+
+type serviceFixture struct {
+	server          *Server
+	httpServer      *httptest.Server
+	client          *Client
+	artifact        *artifactFixture
+	bearer          []byte
+	operationSecret []byte
+	artifactSecret  []byte
+	config          Config
+}
+
+type artifactFixture struct {
+	service *artifactcap.Service
+	server  *httptest.Server
+	secret  []byte
+	root    string
+	calls   atomic.Int64
+}
+
+func TestWorkspaceResolveAndPrepareAcceptExactCommit(t *testing.T) {
+	t.Parallel()
+	repository := newRepositoryFixture(t, false)
+	fixture := newServiceFixture(t)
+	resolve, err := fixture.client.ResolveWorkspace(context.Background(), WorkspaceResolveRequest{
+		Metadata: OperationMetadata{Namespace: testNamespace, OperationID: "workspace-resolve-exact", TaskID: "task-exact"},
+		Source:   repository.source, SourceRef: repository.baselineOID,
+	})
+	if err != nil {
+		t.Fatalf("ResolveWorkspace exact commit: %v", err)
+	}
+	if resolve.SourceRef != repository.baselineOID || resolve.BaselineOID != repository.baselineOID {
+		t.Fatalf("exact resolve = %#v, want baseline %s", resolve, repository.baselineOID)
+	}
+	prepared, err := fixture.client.PrepareWorkspace(context.Background(), WorkspacePrepareRequest{
+		Metadata: OperationMetadata{Namespace: testNamespace, OperationID: "workspace-prepare-exact", TaskID: "task-exact"},
+		Source:   repository.source, SourceRef: repository.baselineOID, BaselineOID: repository.baselineOID,
+	})
+	if err != nil {
+		t.Fatalf("PrepareWorkspace exact commit: %v", err)
+	}
+	if prepared.SourceRef != repository.baselineOID || prepared.BaselineOID != repository.baselineOID || prepared.Artifact.Digest == "" {
+		t.Fatalf("exact prepared workspace = %#v", prepared)
+	}
+	_, err = fixture.client.PrepareWorkspace(context.Background(), WorkspacePrepareRequest{
+		Metadata: OperationMetadata{Namespace: testNamespace, OperationID: "workspace-prepare-exact-mismatch", TaskID: "task-exact"},
+		Source:   repository.source, SourceRef: repository.baselineOID, BaselineOID: strings.Repeat("a", 40),
+	})
+	assertClientCode(t, err, "invalid_request")
+}
+
+func TestWorkspaceResolveFreezesAdvertisedDefaultBranch(t *testing.T) {
+	t.Parallel()
+	repository := newRepositoryFixture(t, false)
+	fixture := newServiceFixture(t)
+	resolved, err := fixture.client.ResolveWorkspace(context.Background(), WorkspaceResolveRequest{
+		Metadata: OperationMetadata{Namespace: testNamespace, OperationID: "workspace-resolve-default", TaskID: "task-default"},
+		Source:   repository.source,
+	})
+	if err != nil {
+		t.Fatalf("ResolveWorkspace default branch: %v", err)
+	}
+	if resolved.SourceRef != "refs/heads/main" || resolved.BaselineOID != repository.baselineOID {
+		t.Fatalf("default resolve = %#v, want refs/heads/main at %s", resolved, repository.baselineOID)
+	}
+}
+
+func TestWorkspaceResolveRejectsUnbornDefaultBranchAsAbsent(t *testing.T) {
+	t.Parallel()
+	repository := newRepositoryFixture(t, false)
+	fixture := newServiceFixture(t)
+	_, err := fixture.client.ResolveWorkspace(context.Background(), WorkspaceResolveRequest{
+		Metadata: OperationMetadata{Namespace: testNamespace, OperationID: "workspace-resolve-unborn", TaskID: "task-unborn"},
+		Source:   repository.target,
+	})
+	assertClientCode(t, err, "source_ref_absent")
+}
+
+func TestWorkspaceResolveAndPrepareAcceptBranches(t *testing.T) {
+	t.Parallel()
+	repository := newRepositoryFixture(t, false)
+	fixture := newServiceFixture(t)
+
+	var effectManifestDigest, effectArtifactDigest string
+	for index, test := range []struct {
+		name      string
+		sourceRef string
+	}{
+		{name: "short", sourceRef: githubTestBaseBranch},
+		{name: "fully-qualified", sourceRef: testMainRef},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			resolve, err := fixture.client.ResolveWorkspace(context.Background(), WorkspaceResolveRequest{
+				Metadata: OperationMetadata{
+					Namespace: testNamespace, OperationID: fmt.Sprintf("workspace-resolve-branch-%d", index),
+					TaskID: fmt.Sprintf("task-resolve-branch-%d", index),
+				},
+				Source: repository.source, SourceRef: test.sourceRef,
+			})
+			if err != nil {
+				t.Fatalf("ResolveWorkspace branch %q: %v", test.sourceRef, err)
+			}
+			if resolve.SourceRef != testMainRef || resolve.BaselineOID != repository.baselineOID {
+				t.Fatalf("branch resolve = %#v, want ref %q at %s", resolve, testMainRef, repository.baselineOID)
+			}
+
+			prepared, err := fixture.client.PrepareWorkspace(context.Background(), WorkspacePrepareRequest{
+				Metadata: OperationMetadata{
+					Namespace: testNamespace, OperationID: fmt.Sprintf("workspace-prepare-branch-%d", index),
+					TaskID: fmt.Sprintf("task-prepare-branch-%d", index),
+				},
+				Source: repository.source, SourceRef: test.sourceRef, BaselineOID: resolve.BaselineOID,
+			})
+			if err != nil {
+				t.Fatalf("PrepareWorkspace branch %q: %v", test.sourceRef, err)
+			}
+			if prepared.SourceRef != testMainRef || prepared.BaselineOID != repository.baselineOID || prepared.Artifact.Digest == "" {
+				t.Fatalf("branch prepared workspace = %#v", prepared)
+			}
+			if index == 0 {
+				effectManifestDigest = prepared.ManifestDigest
+				effectArtifactDigest = prepared.Artifact.Digest
+				return
+			}
+			if prepared.ManifestDigest != effectManifestDigest || prepared.Artifact.Digest != effectArtifactDigest {
+				t.Fatalf("equivalent branch inputs produced different effects: manifest %q vs %q, artifact %q vs %q",
+					prepared.ManifestDigest, effectManifestDigest, prepared.Artifact.Digest, effectArtifactDigest)
+			}
+		})
+	}
+}
+
+func TestWorkspaceResolveAndPrepareAcceptTags(t *testing.T) {
+	t.Parallel()
+	repository := newRepositoryFixture(t, false)
+	fixture := newServiceFixture(t)
+	const shortTag = "v1.2.3"
+	canonicalTag := "refs/tags/" + shortTag
+	runGitEnv(t, repository.seed, fixedGitEnv(), "tag", "-a", shortTag, "-m", "release")
+	runGit(t, repository.seed, "push", repository.source.URL, canonicalTag)
+
+	var effectManifestDigest, effectArtifactDigest string
+	for index, test := range []struct {
+		name      string
+		sourceRef string
+	}{
+		{name: "short", sourceRef: shortTag},
+		{name: "fully-qualified", sourceRef: canonicalTag},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			resolve, err := fixture.client.ResolveWorkspace(context.Background(), WorkspaceResolveRequest{
+				Metadata: OperationMetadata{
+					Namespace: testNamespace, OperationID: fmt.Sprintf("workspace-resolve-tag-%d", index),
+					TaskID: fmt.Sprintf("task-resolve-tag-%d", index),
+				},
+				Source: repository.source, SourceRef: test.sourceRef,
+			})
+			if err != nil {
+				t.Fatalf("ResolveWorkspace tag %q: %v", test.sourceRef, err)
+			}
+			if resolve.SourceRef != canonicalTag || resolve.BaselineOID != repository.baselineOID {
+				t.Fatalf("tag resolve = %#v, want ref %q at %s", resolve, canonicalTag, repository.baselineOID)
+			}
+
+			prepared, err := fixture.client.PrepareWorkspace(context.Background(), WorkspacePrepareRequest{
+				Metadata: OperationMetadata{
+					Namespace: testNamespace, OperationID: fmt.Sprintf("workspace-prepare-tag-%d", index),
+					TaskID: fmt.Sprintf("task-prepare-tag-%d", index),
+				},
+				Source: repository.source, SourceRef: test.sourceRef, BaselineOID: resolve.BaselineOID,
+			})
+			if err != nil {
+				t.Fatalf("PrepareWorkspace tag %q: %v", test.sourceRef, err)
+			}
+			if prepared.SourceRef != canonicalTag || prepared.BaselineOID != repository.baselineOID || prepared.Artifact.Digest == "" {
+				t.Fatalf("tag prepared workspace = %#v", prepared)
+			}
+			if index == 0 {
+				effectManifestDigest = prepared.ManifestDigest
+				effectArtifactDigest = prepared.Artifact.Digest
+				return
+			}
+			if prepared.ManifestDigest != effectManifestDigest || prepared.Artifact.Digest != effectArtifactDigest {
+				t.Fatalf("equivalent tag inputs produced different effects: manifest %q vs %q, artifact %q vs %q",
+					prepared.ManifestDigest, effectManifestDigest, prepared.Artifact.Digest, effectArtifactDigest)
+			}
+		})
+	}
+}
+
+func TestWorkspaceResolveAndPrepareRejectAmbiguousBareRef(t *testing.T) {
+	t.Parallel()
+	repository := newRepositoryFixture(t, false)
+	fixture := newServiceFixture(t)
+	runGitEnv(t, repository.seed, fixedGitEnv(), "tag", "-a", githubTestBaseBranch, "-m", "ambiguous")
+	runGit(t, repository.seed, "push", repository.source.URL, "refs/tags/"+githubTestBaseBranch)
+
+	for index, sourceRef := range []string{testMainRef, "refs/tags/main"} {
+		resolved, err := fixture.client.ResolveWorkspace(context.Background(), WorkspaceResolveRequest{
+			Metadata: OperationMetadata{
+				Namespace: testNamespace, OperationID: fmt.Sprintf("workspace-resolve-explicit-%d", index),
+				TaskID: fmt.Sprintf("task-resolve-explicit-%d", index),
+			},
+			Source: repository.source, SourceRef: sourceRef,
+		})
+		if err != nil {
+			t.Fatalf("ResolveWorkspace explicit ref %q: %v", sourceRef, err)
+		}
+		if resolved.SourceRef != sourceRef || resolved.BaselineOID != repository.baselineOID {
+			t.Fatalf("explicit ref resolve = %#v, want %q at %s", resolved, sourceRef, repository.baselineOID)
+		}
+	}
+
+	_, err := fixture.client.ResolveWorkspace(context.Background(), WorkspaceResolveRequest{
+		Metadata: OperationMetadata{Namespace: testNamespace, OperationID: "workspace-resolve-ambiguous", TaskID: "task-resolve-ambiguous"},
+		Source:   repository.source, SourceRef: githubTestBaseBranch,
+	})
+	assertClientCode(t, err, "source_ref_ambiguous")
+
+	_, err = fixture.client.PrepareWorkspace(context.Background(), WorkspacePrepareRequest{
+		Metadata: OperationMetadata{Namespace: testNamespace, OperationID: "workspace-prepare-ambiguous", TaskID: "task-prepare-ambiguous"},
+		Source:   repository.source, SourceRef: githubTestBaseBranch, BaselineOID: repository.baselineOID,
+	})
+	assertClientCode(t, err, "source_ref_ambiguous")
+}
+
+func TestWorkspaceResolveAndPrepareRejectInvalidSourceRefs(t *testing.T) {
+	t.Parallel()
+	repository := newRepositoryFixture(t, false)
+	fixture := newServiceFixture(t)
+	for index, test := range []struct {
+		name      string
+		sourceRef string
+	}{
+		{name: "empty-canonical-tag", sourceRef: "refs/tags/"},
+		{name: "canonical-forbidden-sequence", sourceRef: "refs/tags/release..candidate"},
+		{name: "canonical-forbidden-component", sourceRef: "refs/tags/.hidden"},
+		{name: "short-forbidden-sequence", sourceRef: "release@{candidate"},
+		{name: "short-leading-dash", sourceRef: "-release"},
+		{name: "unsupported-ref-namespace", sourceRef: "refs/remotes/origin/main"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			_, err := fixture.client.ResolveWorkspace(context.Background(), WorkspaceResolveRequest{
+				Metadata: OperationMetadata{
+					Namespace: testNamespace, OperationID: fmt.Sprintf("workspace-resolve-invalid-tag-%d", index),
+					TaskID: fmt.Sprintf("task-resolve-invalid-tag-%d", index),
+				},
+				Source: repository.source, SourceRef: test.sourceRef,
+			})
+			assertClientCode(t, err, "invalid_request")
+
+			_, err = fixture.client.PrepareWorkspace(context.Background(), WorkspacePrepareRequest{
+				Metadata: OperationMetadata{
+					Namespace: testNamespace, OperationID: fmt.Sprintf("workspace-prepare-invalid-tag-%d", index),
+					TaskID: fmt.Sprintf("task-prepare-invalid-tag-%d", index),
+				},
+				Source: repository.source, SourceRef: test.sourceRef, BaselineOID: repository.baselineOID,
+			})
+			assertClientCode(t, err, "invalid_request")
+		})
+	}
+}
+
+func TestWorkspacePrepareUploadsDeterministicSanitizedArtifact(t *testing.T) {
+	t.Parallel()
+	repository := newRepositoryFixture(t, false)
+	fixture := newServiceFixture(t)
+	request := WorkspacePrepareRequest{
+		Metadata: OperationMetadata{Namespace: testNamespace, OperationID: "workspace-prepare-1", TaskID: "task-uid-1"},
+		Source:   repository.source, SourceRef: testMainRef, BaselineOID: repository.baselineOID,
+	}
+	response, err := fixture.client.PrepareWorkspace(context.Background(), request)
+	if err != nil {
+		t.Fatalf("PrepareWorkspace: %v", err)
+	}
+	if response.RepositoryID != repository.source.ID || response.BaselineOID != repository.baselineOID ||
+		response.Artifact.MediaType != artifactcap.MediaTypeWorkspaceTar || response.EntryCount < 3 {
+		t.Fatalf("unexpected response: %#v", response)
+	}
+	calls := fixture.artifact.calls.Load()
+	repeated, err := fixture.client.PrepareWorkspace(context.Background(), request)
+	if err != nil {
+		t.Fatalf("repeat PrepareWorkspace: %v", err)
+	}
+	if repeated != response {
+		t.Fatalf("replayed response changed:\nfirst=%#v\nsecond=%#v", response, repeated)
+	}
+	if fixture.artifact.calls.Load() != calls {
+		t.Fatal("journal replay repeated the artifact upload")
+	}
+	archive := fixture.artifact.download(t, artifactcap.Identity{Namespace: testNamespace, TaskID: "task-uid-1"}, response.Artifact)
+	entries := readWorkspaceTar(t, archive)
+	if got := entries["keep.txt"]; got != "old\n" {
+		t.Fatalf("keep.txt = %q", got)
+	}
+	if got := entries["bin/run"]; got != "#!/bin/sh\nexit 0\n" {
+		t.Fatalf("bin/run = %q", got)
+	}
+	secondRequest := request
+	secondRequest.Metadata.OperationID = "workspace-prepare-2"
+	second, err := fixture.client.PrepareWorkspace(context.Background(), secondRequest)
+	if err != nil {
+		t.Fatalf("second PrepareWorkspace: %v", err)
+	}
+	if second.Artifact.Digest != response.Artifact.Digest || second.ManifestDigest != response.ManifestDigest {
+		t.Fatalf("workspace preparation is not deterministic: %#v vs %#v", response, second)
+	}
+}
+
+func TestWorkspacePreparePreservesSafeSymlink(t *testing.T) {
+	t.Parallel()
+	repository := newRepositoryFixture(t, true)
+	fixture := newServiceFixture(t)
+	response, err := fixture.client.PrepareWorkspace(context.Background(), WorkspacePrepareRequest{
+		Metadata: OperationMetadata{Namespace: testNamespace, OperationID: "workspace-safe-symlink", TaskID: "task-safe-symlink"},
+		Source:   repository.source, SourceRef: testMainRef, BaselineOID: repository.baselineOID,
+	})
+	if err != nil {
+		t.Fatalf("PrepareWorkspace safe symlink: %v", err)
+	}
+	archive := fixture.artifact.download(t, artifactcap.Identity{Namespace: testNamespace, TaskID: "task-safe-symlink"}, response.Artifact)
+	entries := readWorkspaceTar(t, archive)
+	if got := entries["latest"]; got != "symlink:keep.txt" {
+		t.Fatalf("materialized symlink metadata = %q, want %q", got, "symlink:keep.txt")
+	}
+}
+
+func TestWorkspacePrepareRejectsUnsafeSymlinkAndSourceMovement(t *testing.T) {
+	t.Parallel()
+	repository := newRepositoryFixture(t, false)
+	fixture := newServiceFixture(t)
+	if err := os.Symlink("../../outside", filepath.Join(repository.seed, "escape")); err != nil {
+		t.Fatal(err)
+	}
+	runGitEnv(t, repository.seed, fixedGitEnv(), "add", "--all")
+	runGitEnv(t, repository.seed, fixedGitEnv(), "commit", "-m", "unsafe symlink")
+	repository.baselineOID = strings.TrimSpace(runGit(t, repository.seed, "rev-parse", "HEAD"))
+	runGit(t, repository.seed, "push", repository.source.URL, "HEAD:refs/heads/main")
+	request := WorkspacePrepareRequest{
+		Metadata: OperationMetadata{Namespace: testNamespace, OperationID: "workspace-symlink", TaskID: "task-symlink"},
+		Source:   repository.source, SourceRef: testMainRef, BaselineOID: repository.baselineOID,
+	}
+	_, err := fixture.client.PrepareWorkspace(context.Background(), request)
+	assertClientCode(t, err, "invalid_request")
+
+	moved := newRepositoryFixture(t, false)
+	commitFile(t, moved.seed, "moved.txt", "moved\n")
+	runGit(t, moved.seed, "push", moved.source.URL, "HEAD:refs/heads/main")
+	request.Metadata = OperationMetadata{Namespace: testNamespace, OperationID: "workspace-moved", TaskID: "task-moved"}
+	request.Source = moved.source
+	request.BaselineOID = moved.baselineOID
+	_, err = fixture.client.PrepareWorkspace(context.Background(), request)
+	assertClientCode(t, err, "source_moved")
+}
+
+func TestOperationAuthorizationBodyBindingAndNoSecretEcho(t *testing.T) {
+	t.Parallel()
+	repository := newRepositoryFixture(t, false)
+	fixture := newServiceFixture(t)
+	request := WorkspacePrepareRequest{
+		Metadata: OperationMetadata{Namespace: testNamespace, OperationID: "workspace-auth", TaskID: "task-auth"},
+		Source:   repository.source, SourceRef: testMainRef, BaselineOID: repository.baselineOID,
+	}
+	body, err := json.Marshal(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	canonical, err := canonicalRequestBody(body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	digest, err := RequestDigest(http.MethodPost, WorkspacePreparePath, canonical)
+	if err != nil {
+		t.Fatal(err)
+	}
+	capability, err := SignCapability(fixture.operationSecret, NewClaims(OperationWorkspacePrepare, request.Metadata, digest, time.Now().UTC(), time.Minute))
+	if err != nil {
+		t.Fatal(err)
+	}
+	mutated := bytes.Replace(canonical, []byte(testMainRef), []byte("refs/heads/evil"), 1)
+	httpRequest, err := http.NewRequest(http.MethodPost, fixture.httpServer.URL+WorkspacePreparePath, bytes.NewReader(mutated))
+	if err != nil {
+		t.Fatal(err)
+	}
+	httpRequest.Header.Set("Content-Type", "application/json")
+	httpRequest.Header.Set("Authorization", "Bearer "+string(fixture.bearer))
+	httpRequest.Header.Set(OperationCapabilityHeader, capability)
+	httpRequest.Header.Set(OperationRequestDigestHeader, digest)
+	response, err := fixture.httpServer.Client().Do(httpRequest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	data, _ := io.ReadAll(response.Body)
+	_ = response.Body.Close()
+	if response.StatusCode != http.StatusForbidden {
+		t.Fatalf("status = %d, body=%s", response.StatusCode, data)
+	}
+	for _, secret := range [][]byte{fixture.bearer, fixture.operationSecret, fixture.artifactSecret, []byte(capability)} {
+		if bytes.Contains(data, secret) {
+			t.Fatalf("response echoed secret material: %q", data)
+		}
+	}
+
+	duplicate := strings.Replace(string(canonical), `"sourceRef":`, `"sourceRef":testMainRef,"sourceRef":`, 1)
+	httpRequest, _ = http.NewRequest(http.MethodPost, fixture.httpServer.URL+WorkspacePreparePath, strings.NewReader(duplicate))
+	httpRequest.Header.Set("Content-Type", "application/json")
+	httpRequest.Header.Set("Authorization", "Bearer "+string(fixture.bearer))
+	response, err = fixture.httpServer.Client().Do(httpRequest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer response.Body.Close() //nolint:errcheck
+	if response.StatusCode != http.StatusBadRequest {
+		t.Fatalf("duplicate-key status = %d", response.StatusCode)
+	}
+}
+
+func TestOperationJournalRejectsConflictingReuse(t *testing.T) {
+	t.Parallel()
+	repository := newRepositoryFixture(t, false)
+	fixture := newServiceFixture(t)
+	request := WorkspacePrepareRequest{
+		Metadata: OperationMetadata{Namespace: testNamespace, OperationID: "workspace-conflict", TaskID: "task-conflict"},
+		Source:   repository.source, SourceRef: testMainRef, BaselineOID: repository.baselineOID,
+	}
+	if _, err := fixture.client.PrepareWorkspace(context.Background(), request); err != nil {
+		t.Fatal(err)
+	}
+	request.Limits.MaxEntries = 50
+	_, err := fixture.client.PrepareWorkspace(context.Background(), request)
+	assertClientCode(t, err, "operation_conflict")
+}
+
+func TestPublicationPreparePublishVerifyLocalBareRepository(t *testing.T) {
+	t.Parallel()
+	repository := newRepositoryFixture(t, false)
+	fixture := newServiceFixture(t)
+	delta := buildDelta(t, repository.seed)
+	publicationID := "publication-uid-1"
+	deltaReference := fixture.artifact.upload(t, artifactcap.Identity{Namespace: testNamespace, PublicationID: publicationID}, "seed-delta", artifactcap.MediaTypeWorkspaceDelta, delta.Artifact)
+
+	prepareMetadata := OperationMetadata{Namespace: testNamespace, OperationID: "publication-prepare-1", PublicationID: publicationID}
+	prepareRequest := publisher.PrepareRequest{
+		PublicationID: publicationID, PublicationGeneration: 1, OperationID: prepareMetadata.OperationID,
+		Source: repository.source, SourceRef: githubTestBaseBranch, Target: repository.target, TargetRef: testPublicationRef,
+		BranchClaimGeneration: 1, BaselineOID: repository.baselineOID, RemoteBefore: publisher.RemoteRef{Absent: true},
+		DeltaArtifactDigest: delta.ArtifactDigest, CommitMessage: "Orka publication publication-uid-1\n",
+		CommitTimestamp: time.Date(2026, time.July, 24, 12, 34, 56, 0, time.UTC),
+	}
+	preparedResponse, err := fixture.client.PreparePublication(context.Background(), PublicationPrepareRequest{
+		Metadata: prepareMetadata, DeltaArtifact: deltaReference, Request: prepareRequest,
+	})
+	if err != nil {
+		t.Fatalf("PreparePublication: %v", err)
+	}
+	prepared := preparedResponse.Prepared
+	if prepared.SourceRef != testMainRef || prepared.CommitOID == "" || prepared.BundleDigest == "" {
+		t.Fatalf("incomplete or non-canonical prepared publication: %#v", prepared)
+	}
+	encoded, _ := json.Marshal(preparedResponse)
+	if bytes.Contains(encoded, []byte("bundlePath")) || bytes.Contains(encoded, []byte(fixture.config.ArtifactRoot)) {
+		t.Fatalf("response exposed local durable path: %s", encoded)
+	}
+	// Simulate complete loss of the Publisher-local prepared cache. Publish and
+	// Verify must recover exclusively from the controller artifact API receipt.
+	if err := os.RemoveAll(filepath.Join(fixture.config.ArtifactRoot, publicationID)); err != nil {
+		t.Fatal(err)
+	}
+	claim := publisher.BranchClaim{
+		RepositoryID: repository.target.ID, Ref: testPublicationRef, OwnerKind: "Task", OwnerUID: "task-uid-publish",
+		Generation: 1, LastVerified: publisher.RemoteRef{Absent: true},
+	}
+	preflight, err := fixture.client.PreflightPublication(context.Background(), PublicationPreflightRequest{
+		Metadata: OperationMetadata{Namespace: testNamespace, OperationID: "publication-preflight-1", PublicationID: publicationID},
+		Request:  publisher.PreflightRequest{Target: repository.target, Claim: claim},
+	})
+	if err != nil || !preflight.Result.Matches || !preflight.Result.Observed.Absent {
+		t.Fatalf("PreflightPublication = %#v, %v", preflight, err)
+	}
+	publishRequest := publisher.PublishRequest{
+		PublicationID: publicationID, PublicationGeneration: 1, OperationID: "publication-publish-1",
+		Target: repository.target, TargetRef: testPublicationRef, Claim: claim, RemoteBefore: publisher.RemoteRef{Absent: true},
+		ExpectedCommitOID: prepared.CommitOID, BundleDigest: prepared.BundleDigest,
+	}
+	published, err := fixture.client.Publish(context.Background(), PublicationPublishRequest{
+		Metadata: OperationMetadata{Namespace: testNamespace, OperationID: publishRequest.OperationID, PublicationID: publicationID},
+		Prepared: prepared, Request: publishRequest,
+	})
+	if err != nil || published.Receipt.Outcome != publisher.PublishAcknowledged {
+		t.Fatalf("Publish = %#v, %v", published, err)
+	}
+	verifyRequest := publisher.VerifyRequest{
+		PublicationID: publicationID, PublicationGeneration: 1, OperationID: "publication-verify-1",
+		Target: repository.target, TargetRef: testPublicationRef, Claim: claim,
+		ExpectedCommitOID: prepared.CommitOID, BundleDigest: prepared.BundleDigest,
+	}
+	verified, err := fixture.client.Verify(context.Background(), PublicationVerifyRequest{
+		Metadata: OperationMetadata{Namespace: testNamespace, OperationID: verifyRequest.OperationID, PublicationID: publicationID},
+		Prepared: prepared, Request: verifyRequest,
+	})
+	if err != nil || verified.Receipt.Outcome != publisher.VerifiedExact {
+		t.Fatalf("Verify = %#v, %v", verified, err)
+	}
+	observed := strings.TrimSpace(runGit(t, "", "ls-remote", "--refs", repository.target.URL, testPublicationRef))
+	if !strings.HasPrefix(observed, prepared.CommitOID+"\t") {
+		t.Fatalf("target ref = %q, want %s", observed, prepared.CommitOID)
+	}
+}
+
+func TestExactPullRequestIntentAndCredentialFileBoundary(t *testing.T) {
+	t.Parallel()
+	repository := newRepositoryFixture(t, false)
+	credentialRoot := t.TempDir()
+	if err := os.Chmod(credentialRoot, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	credentialPath := filepath.Join(credentialRoot, "forge-token")
+	if err := os.WriteFile(credentialPath, []byte("Authorization: Bearer forge-secret-marker"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	var ephemeralCredentialPath string
+	factory := PRReconcilerFactoryFunc(func(_ context.Context, path string) (publisher.PullRequestReconciler, error) {
+		ephemeralCredentialPath = path
+		if path == "" || path == credentialPath {
+			t.Fatalf("factory received non-ephemeral credential path %q", path)
+		}
+		value, err := os.ReadFile(path)
+		if err != nil || string(value) != "forge-secret-marker" {
+			t.Fatalf("ephemeral credential = %q, %v", value, err)
+		}
+		return pullRequestReconcilerFunc(func(_ context.Context, intent publisher.PullRequestIntent) (publisher.PullRequestReceipt, error) {
+			key, err := intent.Key()
+			if err != nil {
+				return publisher.PullRequestReceipt{}, err
+			}
+			return publisher.PullRequestReceipt{IntentKey: key, ForgeID: "pr-42", URL: "https://forge.example/pr/42", State: publisher.PullRequestOpen, HeadOID: intent.ExpectedHeadOID}, nil
+		}), nil
+	})
+	fixture := newServiceFixtureWithOptions(t, factory, func(config *Config) { config.CredentialRoot = credentialRoot })
+	intent := publisher.PullRequestIntent{
+		BaseRepository: repository.source, BaseRef: testMainRef, HeadRepository: repository.target,
+		HeadRef: testPublicationRef, PublicationGeneration: 1, ExpectedHeadOID: repository.baselineOID,
+	}
+	response, err := fixture.client.ReconcilePullRequest(context.Background(), PullRequestReconcileRequest{
+		Metadata:      OperationMetadata{Namespace: testNamespace, OperationID: "pr-reconcile-1", PublicationID: "publication-pr-1"},
+		CredentialRef: &CredentialReference{Name: "forge-token", Kind: CredentialForgeToken}, Intent: intent,
+	})
+	if err != nil || response.Receipt.ForgeID != "pr-42" {
+		t.Fatalf("ReconcilePullRequest = %#v, %v", response, err)
+	}
+	if ephemeralCredentialPath == "" {
+		t.Fatal("factory did not receive an ephemeral credential")
+	}
+	if _, err := os.Stat(ephemeralCredentialPath); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("ephemeral credential still exists: %v", err)
+	}
+}
+
+func TestCredentialTraversalAndSymlinkAreRejected(t *testing.T) {
+	t.Parallel()
+	repository := newRepositoryFixture(t, false)
+	credentialRoot := t.TempDir()
+	if err := os.Chmod(credentialRoot, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	outside := filepath.Join(t.TempDir(), "token")
+	if err := os.WriteFile(outside, []byte("Authorization: Bearer secret"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(outside, filepath.Join(credentialRoot, "linked")); err != nil {
+		t.Fatal(err)
+	}
+	fixture := newServiceFixtureWithOptions(t, nil, func(config *Config) { config.CredentialRoot = credentialRoot })
+	httpsSource := repository.source
+	httpsSource.URL = "https://example.invalid/repository.git"
+	base := WorkspacePrepareRequest{
+		Metadata: OperationMetadata{Namespace: testNamespace, OperationID: "credential-linked", TaskID: "task-credential"},
+		Source:   httpsSource, SourceRef: testMainRef, BaselineOID: repository.baselineOID,
+		CredentialRef: &CredentialReference{Name: "linked", Kind: CredentialHTTPExtraHeader},
+	}
+	_, err := fixture.client.PrepareWorkspace(context.Background(), base)
+	assertClientCode(t, err, "credential_unavailable")
+	base.Metadata.OperationID = "credential-traversal"
+	base.CredentialRef.Name = "../token"
+	_, err = fixture.client.PrepareWorkspace(context.Background(), base)
+	assertClientCode(t, err, "invalid_credential_ref")
+}
+
+func TestCapabilitiesDeclareSeparateNoProviderIdentity(t *testing.T) {
+	t.Parallel()
+	fixture := newServiceFixture(t)
+	capabilities, err := fixture.client.Capabilities(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if capabilities.NetworkIdentity != "workspace-publisher" || capabilities.ProviderOrMCPAccess || capabilities.RedirectsAllowed ||
+		capabilities.Protocol != ProtocolVersion || capabilities.GitVersion == "" || capabilities.PullRequestReconciliation ||
+		slices.Contains(capabilities.Operations, OperationPullRequestReconcile) || slices.Contains(capabilities.CredentialKinds, CredentialForgeToken) {
+		t.Fatalf("capabilities = %#v", capabilities)
+	}
+}
+
+func TestCapabilitiesAdvertiseConfiguredPullRequestReconciliation(t *testing.T) {
+	t.Parallel()
+	factory := PRReconcilerFactoryFunc(func(context.Context, string) (publisher.PullRequestReconciler, error) {
+		return nil, errors.New("not invoked by capability discovery")
+	})
+	fixture := newServiceFixtureWithOptions(t, factory, nil)
+	capabilities, err := fixture.client.Capabilities(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !capabilities.PullRequestReconciliation || !slices.Contains(capabilities.Operations, OperationPullRequestReconcile) ||
+		!slices.Contains(capabilities.CredentialKinds, CredentialForgeToken) {
+		t.Fatalf("capabilities = %#v", capabilities)
+	}
+}
+
+func newServiceFixture(t *testing.T) *serviceFixture {
+	t.Helper()
+	return newServiceFixtureWithOptions(t, nil, nil)
+}
+
+func newServiceFixtureWithOptions(t *testing.T, factory PRReconcilerFactory, edit func(*Config)) *serviceFixture {
+	t.Helper()
+	artifactSecret := []byte(strings.Repeat("a", artifactcap.MinSecretBytes))
+	artifact := newArtifactFixture(t, artifactSecret)
+	bearer := []byte("controller-bearer-token-for-tests")
+	operationSecret := []byte(strings.Repeat("o", MinSecretBytes))
+	gitBinary, err := exec.LookPath("git")
+	if err != nil {
+		t.Fatal(err)
+	}
+	gitBinary, err = filepath.Abs(gitBinary)
+	if err != nil {
+		t.Fatal(err)
+	}
+	config := Config{
+		ControllerBearerToken: bearer, OperationCapabilitySecret: operationSecret,
+		ArtifactCapabilitySecret: artifactSecret, ArtifactAPIURL: artifact.server.URL,
+		ArtifactRoot: filepath.Join(t.TempDir(), "publication-artifacts"), JournalRoot: filepath.Join(t.TempDir(), "journal"),
+		TempRoot: filepath.Join(t.TempDir(), "tmp"), GitBinary: gitBinary, AllowFileRepositories: true,
+		MaxConcurrentOperations: 4, MaxRequestBytes: 2 << 20, MaxResponseBytes: 2 << 20,
+		MaxJournalBytes: 512 << 20, MaxDeltaBytes: 32 << 20, MaxBundleBytes: 64 << 20,
+		MaxCommandOutput: 4 << 20, PublishTimeout: 10 * time.Second, VerifyAttempts: 1,
+		VerifyBackoff: time.Millisecond, ArtifactTimeout: 10 * time.Second, CapabilityTTL: time.Minute,
+		WorkspaceLimits: WorkspaceLimits{MaxEntries: 1000, MaxFileBytes: 4 << 20, MaxExpandedBytes: 16 << 20, MaxArtifactBytes: 32 << 20, MaxPathBytes: 4096},
+		PRFactory:       factory, HTTPClient: artifact.server.Client(),
+	}
+	if edit != nil {
+		edit(&config)
+	}
+	server, err := New(config)
+	if err != nil {
+		t.Fatalf("New service: %v", err)
+	}
+	httpServer := httptest.NewServer(server.Handler())
+	t.Cleanup(httpServer.Close)
+	client, err := NewClient(ClientConfig{
+		BaseURL: httpServer.URL, HTTPClient: httpServer.Client(), BearerToken: bearer,
+		CapabilitySecret: operationSecret, CapabilityTTL: time.Minute,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return &serviceFixture{
+		server: server, httpServer: httpServer, client: client, artifact: artifact,
+		bearer: bearer, operationSecret: operationSecret, artifactSecret: artifactSecret, config: config,
+	}
+}
+
+func newArtifactFixture(t *testing.T, secret []byte) *artifactFixture {
+	t.Helper()
+	root := t.TempDir()
+	service, err := artifactcap.NewService(artifactcap.ServiceConfig{Root: root, Secret: secret, MaxObjectBytes: 128 << 20})
+	if err != nil {
+		t.Fatal(err)
+	}
+	fixture := &artifactFixture{service: service, secret: secret, root: root}
+	fixture.server = httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		fixture.calls.Add(1)
+		presented, token, err := presentedArtifactRequest(request)
+		if err != nil {
+			http.Error(writer, "invalid", http.StatusBadRequest)
+			return
+		}
+		switch request.Method {
+		case http.MethodPut:
+			artifact, err := service.Upload(request.Context(), token, presented, request.Body)
+			if err != nil {
+				http.Error(writer, "rejected", artifactErrorStatus(err))
+				return
+			}
+			writer.Header().Set("Content-Type", "application/json")
+			writer.WriteHeader(http.StatusCreated)
+			_ = json.NewEncoder(writer).Encode(artifact)
+		case http.MethodGet:
+			download, err := service.OpenDownload(request.Context(), token, presented)
+			if err != nil {
+				http.Error(writer, "rejected", artifactErrorStatus(err))
+				return
+			}
+			writer.Header().Set("Content-Type", download.Artifact.MediaType)
+			writer.Header().Set("Content-Length", strconv.FormatInt(download.Artifact.SizeBytes, 10))
+			writer.Header().Set(artifactcap.ObjectDigestHeader, download.Artifact.Digest)
+			writer.WriteHeader(http.StatusOK)
+			_, _ = io.Copy(writer, download)
+		default:
+			writer.WriteHeader(http.StatusMethodNotAllowed)
+		}
+	}))
+	t.Cleanup(fixture.server.Close)
+	return fixture
+}
+
+func presentedArtifactRequest(request *http.Request) (artifactcap.PresentedRequest, string, error) {
+	digestHex := filepath.Base(request.URL.Path)
+	if len(digestHex) != 64 {
+		return artifactcap.PresentedRequest{}, "", fmt.Errorf("digest")
+	}
+	length, err := strconv.ParseInt(request.Header.Get(artifactcap.ContentLengthHeader), 10, 64)
+	if err != nil {
+		return artifactcap.PresentedRequest{}, "", err
+	}
+	presented := artifactcap.PresentedRequest{
+		Method: request.Method, Path: request.URL.Path, ObjectDigest: "sha256:" + digestHex,
+		ContentLength: length, MediaType: request.Header.Get(artifactcap.MediaTypeHeader),
+		RequestDigest: request.Header.Get(artifactcap.RequestDigestHeader),
+	}
+	if err := presented.Validate(); err != nil {
+		return artifactcap.PresentedRequest{}, "", err
+	}
+	return presented, request.Header.Get(artifactcap.CapabilityHeader), nil
+}
+
+func artifactErrorStatus(err error) int {
+	switch {
+	case errors.Is(err, artifactcap.ErrReplay), errors.Is(err, artifactcap.ErrOperationConflict):
+		return http.StatusConflict
+	case errors.Is(err, artifactcap.ErrNotFound):
+		return http.StatusNotFound
+	case errors.Is(err, artifactcap.ErrUnauthorized), errors.Is(err, artifactcap.ErrExpired):
+		return http.StatusForbidden
+	default:
+		return http.StatusBadRequest
+	}
+}
+
+func (f *artifactFixture) upload(t *testing.T, identity artifactcap.Identity, operationID, mediaType string, data []byte) harnessv2.ArtifactReference {
+	t.Helper()
+	digest := artifactcap.DigestBytes(data)
+	artifactID, err := artifactcap.ArtifactIDForDigest(digest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	binding := artifactcap.OperationRequest{Operation: artifactcap.OperationUpload, ObjectDigest: digest, Identity: identity, ContentLength: int64(len(data)), MediaType: mediaType, OperationID: operationID}
+	authorization, err := artifactcap.Issue(f.secret, binding, time.Now().UTC(), time.Minute)
+	if err != nil {
+		t.Fatal(err)
+	}
+	endpoint, _ := artifactcap.ObjectPath(digest)
+	request, _ := http.NewRequest(http.MethodPut, f.server.URL+endpoint, bytes.NewReader(data))
+	request.ContentLength = int64(len(data))
+	request.Header.Set("Content-Type", mediaType)
+	request.Header.Set(artifactcap.CapabilityHeader, authorization.Capability)
+	request.Header.Set(artifactcap.RequestDigestHeader, authorization.RequestDigest)
+	request.Header.Set(artifactcap.ContentLengthHeader, strconv.Itoa(len(data)))
+	request.Header.Set(artifactcap.MediaTypeHeader, mediaType)
+	response, err := f.server.Client().Do(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer response.Body.Close() //nolint:errcheck
+	if response.StatusCode != http.StatusCreated {
+		t.Fatalf("artifact upload status = %d", response.StatusCode)
+	}
+	return harnessv2.ArtifactReference{ArtifactID: harnessv2.ArtifactID(artifactID), Digest: digest, SizeBytes: int64(len(data)), MediaType: mediaType}
+}
+
+func (f *artifactFixture) download(t *testing.T, identity artifactcap.Identity, reference harnessv2.ArtifactReference) []byte {
+	t.Helper()
+	binding := artifactcap.OperationRequest{Operation: artifactcap.OperationDownload, ObjectDigest: reference.Digest, Identity: identity, ContentLength: reference.SizeBytes, MediaType: reference.MediaType, OperationID: "download-" + hashID(string(reference.ArtifactID), identity.TaskID, identity.PublicationID)}
+	authorization, err := artifactcap.Issue(f.secret, binding, time.Now().UTC(), time.Minute)
+	if err != nil {
+		t.Fatal(err)
+	}
+	endpoint, _ := artifactcap.ObjectPath(reference.Digest)
+	request, _ := http.NewRequest(http.MethodGet, f.server.URL+endpoint, nil)
+	request.Header.Set(artifactcap.CapabilityHeader, authorization.Capability)
+	request.Header.Set(artifactcap.RequestDigestHeader, authorization.RequestDigest)
+	request.Header.Set(artifactcap.ContentLengthHeader, strconv.FormatInt(reference.SizeBytes, 10))
+	request.Header.Set(artifactcap.MediaTypeHeader, reference.MediaType)
+	response, err := f.server.Client().Do(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer response.Body.Close() //nolint:errcheck
+	data, err := io.ReadAll(response.Body)
+	if err != nil || response.StatusCode != http.StatusOK {
+		t.Fatalf("artifact download = %d, %v", response.StatusCode, err)
+	}
+	return data
+}
+
+type repositoryFixture struct {
+	source      publisher.Repository
+	target      publisher.Repository
+	seed        string
+	baselineOID string
+}
+
+func newRepositoryFixture(t *testing.T, symlink bool) repositoryFixture {
+	t.Helper()
+	seed := filepath.Join(t.TempDir(), "seed")
+	if err := os.Mkdir(seed, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	runGit(t, seed, "init", "-b", "main")
+	writeFile(t, filepath.Join(seed, "keep.txt"), "old\n", 0o644)
+	writeFile(t, filepath.Join(seed, "bin", "run"), "#!/bin/sh\nexit 0\n", 0o755)
+	if symlink {
+		if err := os.Symlink("keep.txt", filepath.Join(seed, "latest")); err != nil {
+			t.Fatal(err)
+		}
+	}
+	runGitEnv(t, seed, fixedGitEnv(), "add", "--all")
+	runGitEnv(t, seed, fixedGitEnv(), "commit", "-m", "baseline")
+	baselineOID := strings.TrimSpace(runGit(t, seed, "rev-parse", "HEAD"))
+	sourcePath := filepath.Join(t.TempDir(), "source.git")
+	runGit(t, "", "clone", "--bare", "--", seed, sourcePath)
+	targetPath := filepath.Join(t.TempDir(), "target.git")
+	runGit(t, "", "init", "--bare", "--", targetPath)
+	return repositoryFixture{
+		source: publisher.Repository{Provider: "local", ID: "repository/source", URL: fileURL(sourcePath)},
+		target: publisher.Repository{Provider: "local", ID: "repository/target", URL: fileURL(targetPath)},
+		seed:   seed, baselineOID: baselineOID,
+	}
+}
+
+func buildDelta(t *testing.T, seed string) workspacedelta.Result {
+	t.Helper()
+	workspace := filepath.Join(t.TempDir(), "workspace")
+	copyTreeWithoutGit(t, seed, workspace)
+	baseline, err := workspacedelta.Capture(workspace, workspacedelta.Options{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	writeFile(t, filepath.Join(workspace, "keep.txt"), "changed\n", 0o644)
+	writeFile(t, filepath.Join(workspace, "new.txt"), "new\n", 0o644)
+	result, err := workspacedelta.Build(baseline, workspace, workspacedelta.IntentWrite)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return result
+}
+
+func readWorkspaceTar(t *testing.T, data []byte) map[string]string {
+	t.Helper()
+	reader := tar.NewReader(bytes.NewReader(data))
+	entries := map[string]string{}
+	var names []string
+	for {
+		header, err := reader.Next()
+		if errors.Is(err, io.EOF) {
+			break
+		}
+		if err != nil {
+			t.Fatal(err)
+		}
+		if header.Typeflag != tar.TypeDir && header.Typeflag != tar.TypeReg && header.Typeflag != tar.TypeSymlink {
+			t.Fatalf("unsupported tar type %d", header.Typeflag)
+		}
+		if !header.ModTime.Equal(normalizedArchiveTime) || header.Uid != 0 || header.Gid != 0 {
+			t.Fatalf("non-normalized tar header: %#v", header)
+		}
+		names = append(names, header.Name)
+		switch header.Typeflag {
+		case tar.TypeReg:
+			content, err := io.ReadAll(reader)
+			if err != nil {
+				t.Fatal(err)
+			}
+			entries[header.Name] = string(content)
+		case tar.TypeSymlink:
+			entries[header.Name] = "symlink:" + header.Linkname
+		}
+	}
+	if !sort.StringsAreSorted(names) {
+		// Parent directories are deliberately emitted before descendants; within
+		// each depth and for files, ordering is deterministic rather than globally lexical.
+		seen := append([]string(nil), names...)
+		if len(seen) == 0 {
+			t.Fatal("empty workspace tar")
+		}
+	}
+	return entries
+}
+
+func assertClientCode(t *testing.T, err error, code string) {
+	t.Helper()
+	var clientErr *ClientError
+	if !errors.As(err, &clientErr) || clientErr.Response.Code != code {
+		t.Fatalf("error = %v, want client code %q", err, code)
+	}
+}
+
+type pullRequestReconcilerFunc func(context.Context, publisher.PullRequestIntent) (publisher.PullRequestReceipt, error)
+
+func (f pullRequestReconcilerFunc) Reconcile(ctx context.Context, intent publisher.PullRequestIntent) (publisher.PullRequestReceipt, error) {
+	return f(ctx, intent)
+}
+
+func fixedGitEnv() []string {
+	return []string{
+		"GIT_AUTHOR_NAME=Test", "GIT_AUTHOR_EMAIL=test@example.com", "GIT_COMMITTER_NAME=Test", "GIT_COMMITTER_EMAIL=test@example.com",
+		"GIT_AUTHOR_DATE=2026-07-24T12:00:00Z", "GIT_COMMITTER_DATE=2026-07-24T12:00:00Z",
+	}
+}
+
+func commitFile(t *testing.T, directory, name, content string) string {
+	t.Helper()
+	writeFile(t, filepath.Join(directory, name), content, 0o644)
+	runGitEnv(t, directory, fixedGitEnv(), "add", "--all")
+	runGitEnv(t, directory, fixedGitEnv(), "commit", "-m", name)
+	return strings.TrimSpace(runGit(t, directory, "rev-parse", "HEAD"))
+}
+
+func runGit(t *testing.T, directory string, args ...string) string {
+	t.Helper()
+	return runGitEnv(t, directory, nil, args...)
+}
+
+func runGitEnv(t *testing.T, directory string, extra []string, args ...string) string {
+	t.Helper()
+	command := exec.Command("git", args...)
+	command.Dir = directory
+	command.Env = append(os.Environ(), extra...)
+	output, err := command.CombinedOutput()
+	if err != nil {
+		t.Fatalf("git %v: %v\n%s", args, err, output)
+	}
+	return string(output)
+}
+
+func writeFile(t *testing.T, path, content string, mode os.FileMode) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, []byte(content), mode); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func copyTreeWithoutGit(t *testing.T, source, target string) {
+	t.Helper()
+	if err := os.MkdirAll(target, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	entries, err := os.ReadDir(source)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, entry := range entries {
+		if entry.Name() == ".git" {
+			continue
+		}
+		sourcePath := filepath.Join(source, entry.Name())
+		targetPath := filepath.Join(target, entry.Name())
+		info, err := entry.Info()
+		if err != nil {
+			t.Fatal(err)
+		}
+		if entry.IsDir() {
+			copyTreeWithoutGit(t, sourcePath, targetPath)
+			continue
+		}
+		data, err := os.ReadFile(sourcePath)
+		if err != nil {
+			t.Fatal(err)
+		}
+		writeFile(t, targetPath, string(data), info.Mode().Perm())
+	}
+}
+
+func fileURL(path string) string {
+	return (&url.URL{Scheme: "file", Path: filepath.ToSlash(path)}).String()
+}
+
+func TestWorkspaceJournalSurvivesServiceRestart(t *testing.T) {
+	t.Parallel()
+	repository := newRepositoryFixture(t, false)
+	artifactSecret := []byte(strings.Repeat("r", artifactcap.MinSecretBytes))
+	artifact := newArtifactFixture(t, artifactSecret)
+	bearer := []byte("restart-controller-bearer-token")
+	operationSecret := []byte(strings.Repeat("p", MinSecretBytes))
+	gitBinary, err := exec.LookPath("git")
+	if err != nil {
+		t.Fatal(err)
+	}
+	gitBinary, _ = filepath.Abs(gitBinary)
+	config := Config{
+		ControllerBearerToken: bearer, OperationCapabilitySecret: operationSecret,
+		ArtifactCapabilitySecret: artifactSecret, ArtifactAPIURL: artifact.server.URL,
+		ArtifactRoot: filepath.Join(t.TempDir(), "publication-artifacts"), JournalRoot: filepath.Join(t.TempDir(), "journal"),
+		TempRoot: filepath.Join(t.TempDir(), "tmp"), GitBinary: gitBinary, AllowFileRepositories: true,
+		MaxJournalBytes: 128 << 20, MaxDeltaBytes: 16 << 20, MaxBundleBytes: 32 << 20,
+		WorkspaceLimits: WorkspaceLimits{MaxEntries: 1000, MaxFileBytes: 4 << 20, MaxExpandedBytes: 16 << 20, MaxArtifactBytes: 32 << 20, MaxPathBytes: 4096},
+		ArtifactTimeout: 10 * time.Second, CapabilityTTL: time.Minute, HTTPClient: artifact.server.Client(),
+	}
+	request := WorkspacePrepareRequest{
+		Metadata: OperationMetadata{Namespace: testNamespace, OperationID: "workspace-restart", TaskID: "task-restart"},
+		Source:   repository.source, SourceRef: testMainRef, BaselineOID: repository.baselineOID,
+	}
+	invoke := func() WorkspacePrepareResponse {
+		service, err := New(config)
+		if err != nil {
+			t.Fatal(err)
+		}
+		httpServer := httptest.NewServer(service.Handler())
+		defer httpServer.Close()
+		client, err := NewClient(ClientConfig{BaseURL: httpServer.URL, HTTPClient: httpServer.Client(), BearerToken: bearer, CapabilitySecret: operationSecret})
+		if err != nil {
+			t.Fatal(err)
+		}
+		response, err := client.PrepareWorkspace(context.Background(), request)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return response
+	}
+	first := invoke()
+	calls := artifact.calls.Load()
+	second := invoke()
+	if second != first || artifact.calls.Load() != calls {
+		t.Fatalf("restart replay changed response or repeated upload: first=%#v second=%#v calls=%d/%d", first, second, calls, artifact.calls.Load())
+	}
+}
+
+func TestBoundedConcurrencyAndRequestBody(t *testing.T) {
+	t.Parallel()
+	repository := newRepositoryFixture(t, false)
+	entered := make(chan struct{})
+	release := make(chan struct{})
+	factory := PRReconcilerFactoryFunc(func(context.Context, string) (publisher.PullRequestReconciler, error) {
+		return pullRequestReconcilerFunc(func(_ context.Context, intent publisher.PullRequestIntent) (publisher.PullRequestReceipt, error) {
+			close(entered)
+			<-release
+			key, _ := intent.Key()
+			return publisher.PullRequestReceipt{IntentKey: key, ForgeID: "pr-block", URL: "https://forge.example/pr/block", State: publisher.PullRequestOpen, HeadOID: intent.ExpectedHeadOID}, nil
+		}), nil
+	})
+	fixture := newServiceFixtureWithOptions(t, factory, func(config *Config) {
+		config.MaxConcurrentOperations = 1
+		config.MaxRequestBytes = 1024
+	})
+	intent := publisher.PullRequestIntent{
+		BaseRepository: repository.source, BaseRef: testMainRef, HeadRepository: repository.target,
+		HeadRef: testPublicationRef, PublicationGeneration: 1, ExpectedHeadOID: repository.baselineOID,
+	}
+	firstDone := make(chan error, 1)
+	go func() {
+		_, err := fixture.client.ReconcilePullRequest(context.Background(), PullRequestReconcileRequest{
+			Metadata: OperationMetadata{Namespace: testNamespace, OperationID: "pr-blocking", PublicationID: "publication-blocking"}, Intent: intent,
+		})
+		firstDone <- err
+	}()
+	select {
+	case <-entered:
+	case <-time.After(5 * time.Second):
+		t.Fatal("PR reconciler did not block")
+	}
+	_, err := fixture.client.PrepareWorkspace(context.Background(), WorkspacePrepareRequest{
+		Metadata: OperationMetadata{Namespace: testNamespace, OperationID: "busy-request", TaskID: "task-busy"},
+		Source:   repository.source, SourceRef: testMainRef, BaselineOID: repository.baselineOID,
+	})
+	assertClientCode(t, err, "busy")
+	close(release)
+	if err := <-firstDone; err != nil {
+		t.Fatalf("blocked operation failed: %v", err)
+	}
+
+	oversized := strings.Repeat("x", 2048)
+	httpRequest, _ := http.NewRequest(http.MethodPost, fixture.httpServer.URL+WorkspacePreparePath, strings.NewReader(oversized))
+	httpRequest.Header.Set("Content-Type", "application/json")
+	httpRequest.Header.Set("Authorization", "Bearer "+string(fixture.bearer))
+	response, err := fixture.httpServer.Client().Do(httpRequest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer response.Body.Close() //nolint:errcheck
+	if response.StatusCode != http.StatusRequestEntityTooLarge {
+		data, _ := io.ReadAll(response.Body)
+		t.Fatalf("oversized status = %d body=%s", response.StatusCode, data)
+	}
+}
+
+func TestClientRefusesRedirectsWithoutForwardingAuthentication(t *testing.T) {
+	t.Parallel()
+	var redirected atomic.Bool
+	target := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { redirected.Store(true) }))
+	defer target.Close()
+	redirector := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		http.Redirect(writer, request, target.URL, http.StatusTemporaryRedirect)
+	}))
+	defer redirector.Close()
+	client, err := NewClient(ClientConfig{
+		BaseURL: redirector.URL, HTTPClient: redirector.Client(), BearerToken: []byte("redirect-bearer-token"),
+		CapabilitySecret: []byte(strings.Repeat("z", MinSecretBytes)),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := client.Capabilities(context.Background()); err == nil || !strings.Contains(err.Error(), "redirect") {
+		t.Fatalf("redirect error = %v", err)
+	}
+	if redirected.Load() {
+		t.Fatal("client followed redirect and could have leaked authentication")
+	}
+}
+
+func TestPublicationReclaimIsCapabilityProtectedAndIdempotent(t *testing.T) {
+	t.Parallel()
+	fixture := newServiceFixture(t)
+	request := PublicationReclaimRequest{
+		Metadata: OperationMetadata{
+			Namespace: testNamespace, OperationID: "publication-reclaim-absent", PublicationID: "publication-reclaim-absent",
+		},
+		Request: publisher.ReclaimRequest{PublicationID: "publication-reclaim-absent", PublicationGeneration: 1},
+	}
+	first, err := fixture.client.ReclaimPublication(context.Background(), request)
+	if err != nil {
+		t.Fatalf("ReclaimPublication absent: %v", err)
+	}
+	if !first.Result.Reclaimed || first.Result.PublicationID != request.Request.PublicationID ||
+		first.Result.PublicationGeneration != request.Request.PublicationGeneration {
+		t.Fatalf("first reclaim = %#v, want exact reclaimed identity", first)
+	}
+	second, err := fixture.client.ReclaimPublication(context.Background(), request)
+	if err != nil || second != first {
+		t.Fatalf("idempotent reclaim = %#v, %v; want %#v", second, err, first)
+	}
+
+	mismatch := request
+	mismatch.Metadata.OperationID = "publication-reclaim-metadata-mismatch"
+	mismatch.Metadata.PublicationID = "publication-other"
+	_, err = fixture.client.ReclaimPublication(context.Background(), mismatch)
+	assertClientCode(t, err, "invalid_request")
+
+	body, err := json.Marshal(PublicationReclaimRequest{
+		Metadata: OperationMetadata{
+			Namespace: testNamespace, OperationID: "publication-reclaim-unauthorized", PublicationID: "publication-reclaim-unauthorized",
+		},
+		Request: publisher.ReclaimRequest{PublicationID: "publication-reclaim-unauthorized", PublicationGeneration: 1},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	httpRequest, err := http.NewRequest(http.MethodPost, fixture.httpServer.URL+PublicationReclaimPath, bytes.NewReader(body))
+	if err != nil {
+		t.Fatal(err)
+	}
+	httpRequest.Header.Set("Authorization", "Bearer "+string(fixture.bearer))
+	httpRequest.Header.Set("Content-Type", "application/json")
+	response, err := fixture.httpServer.Client().Do(httpRequest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer response.Body.Close() //nolint:errcheck
+	if response.StatusCode != http.StatusForbidden {
+		data, _ := io.ReadAll(response.Body)
+		t.Fatalf("reclaim without operation capability status = %d, body = %s", response.StatusCode, data)
+	}
+}
diff --git a/internal/publisher/service/types.go b/internal/publisher/service/types.go
new file mode 100644
index 000000000..2b5cff98a
--- /dev/null
+++ b/internal/publisher/service/types.go
@@ -0,0 +1,347 @@
+package service
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/orka-agents/orka/internal/artifactcap"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/publisher"
+	"github.com/orka-agents/orka/internal/workspacedelta"
+)
+
+const (
+	ProtocolVersion = "orka.workspace-publisher.v1"
+
+	HealthPath                   = "/v1/health"
+	CapabilitiesPath             = "/v1/capabilities"
+	WorkspaceResolvePath         = "/v1/workspaces/resolve"
+	WorkspacePreparePath         = "/v1/workspaces/prepare"
+	PublicationPreflightPath     = "/v1/publications/preflight"
+	PublicationPreparePath       = "/v1/publications/prepare"
+	PublicationPublishPath       = "/v1/publications/publish"
+	PublicationVerifyPath        = "/v1/publications/verify"
+	PublicationReclaimPath       = "/v1/publications/reclaim"
+	PullRequestReconcilePath     = "/v1/pull-requests/reconcile"
+	OperationCapabilityHeader    = "X-Orka-Publisher-Operation-Capability"
+	OperationRequestDigestHeader = "X-Orka-Publisher-Request-Digest"
+)
+
+type Operation string
+
+const (
+	OperationWorkspaceResolve     Operation = "workspace.resolve"
+	OperationWorkspacePrepare     Operation = "workspace.prepare"
+	OperationPublicationPreflight Operation = "publication.preflight"
+	OperationPublicationPrepare   Operation = "publication.prepare"
+	OperationPublicationPublish   Operation = "publication.publish"
+	OperationPublicationVerify    Operation = "publication.verify"
+	OperationPublicationReclaim   Operation = "publication.reclaim"
+	OperationPullRequestReconcile Operation = "pull-request.reconcile"
+)
+
+func (o Operation) Path() string {
+	switch o {
+	case OperationWorkspaceResolve:
+		return WorkspaceResolvePath
+	case OperationWorkspacePrepare:
+		return WorkspacePreparePath
+	case OperationPublicationPreflight:
+		return PublicationPreflightPath
+	case OperationPublicationPrepare:
+		return PublicationPreparePath
+	case OperationPublicationPublish:
+		return PublicationPublishPath
+	case OperationPublicationVerify:
+		return PublicationVerifyPath
+	case OperationPublicationReclaim:
+		return PublicationReclaimPath
+	case OperationPullRequestReconcile:
+		return PullRequestReconcilePath
+	default:
+		return ""
+	}
+}
+
+// OperationMetadata is the durable caller identity bound by the operation
+// capability. Workspace preparation is Task-scoped; publication and PR
+// operations are Publication-scoped.
+type OperationMetadata struct {
+	Namespace     string `json:"namespace"`
+	OperationID   string `json:"operationId"`
+	TaskID        string `json:"taskId,omitempty"`
+	PublicationID string `json:"publicationId,omitempty"`
+}
+
+type CredentialKind string
+
+type CredentialRole string
+
+const (
+	CredentialHTTPExtraHeader CredentialKind = "http-extra-header"
+	CredentialForgeToken      CredentialKind = "forge-token"
+
+	CredentialRoleSourceRead  CredentialRole = "SourceRead"
+	CredentialRoleTargetRead  CredentialRole = "TargetRead"
+	CredentialRoleTargetWrite CredentialRole = "TargetWrite"
+	CredentialRoleForge       CredentialRole = "Forge"
+)
+
+// CredentialReference names a mounted file below the configured credential
+// root. Raw credentials are never accepted in API requests. Role binds brokered
+// requests to one frozen prompt-credential purpose.
+type CredentialReference struct {
+	Name string         `json:"name"`
+	Kind CredentialKind `json:"kind"`
+	Role CredentialRole `json:"role,omitempty"`
+}
+
+type WorkspaceLimits struct {
+	MaxEntries       int   `json:"maxEntries,omitempty"`
+	MaxFileBytes     int64 `json:"maxFileBytes,omitempty"`
+	MaxExpandedBytes int64 `json:"maxExpandedBytes,omitempty"`
+	MaxArtifactBytes int64 `json:"maxArtifactBytes,omitempty"`
+	MaxPathBytes     int   `json:"maxPathBytes,omitempty"`
+}
+
+type WorkspaceResolveRequest struct {
+	Metadata      OperationMetadata    `json:"metadata"`
+	Source        publisher.Repository `json:"source"`
+	SourceRef     string               `json:"sourceRef"`
+	CredentialRef *CredentialReference `json:"credentialRef,omitempty"`
+}
+
+type WorkspaceResolveResponse struct {
+	OperationID   string `json:"operationId"`
+	RequestDigest string `json:"requestDigest"`
+	RepositoryID  string `json:"repositoryId"`
+	SourceRef     string `json:"sourceRef"`
+	BaselineOID   string `json:"baselineOid"`
+}
+
+type WorkspacePrepareRequest struct {
+	Metadata      OperationMetadata    `json:"metadata"`
+	Source        publisher.Repository `json:"source"`
+	SourceRef     string               `json:"sourceRef"`
+	BaselineOID   string               `json:"baselineOid"`
+	CredentialRef *CredentialReference `json:"credentialRef,omitempty"`
+	Limits        WorkspaceLimits      `json:"limits,omitempty"`
+}
+
+type WorkspacePrepareResponse struct {
+	OperationID    string                      `json:"operationId"`
+	RequestDigest  string                      `json:"requestDigest"`
+	RepositoryID   string                      `json:"repositoryId"`
+	SourceRef      string                      `json:"sourceRef"`
+	BaselineOID    string                      `json:"baselineOid"`
+	TreeOID        string                      `json:"treeOid"`
+	ManifestDigest string                      `json:"manifestDigest"`
+	EntryCount     int                         `json:"entryCount"`
+	ExpandedBytes  int64                       `json:"expandedBytes"`
+	Artifact       harnessv2.ArtifactReference `json:"artifact"`
+}
+
+type PublicationPreflightRequest struct {
+	Metadata      OperationMetadata          `json:"metadata"`
+	CredentialRef *CredentialReference       `json:"credentialRef,omitempty"`
+	Request       publisher.PreflightRequest `json:"request"`
+}
+
+type PublicationPreflightResponse struct {
+	OperationID   string                    `json:"operationId"`
+	RequestDigest string                    `json:"requestDigest"`
+	Result        publisher.PreflightResult `json:"result"`
+}
+
+type PublicationPrepareRequest struct {
+	Metadata            OperationMetadata           `json:"metadata"`
+	SourceCredentialRef *CredentialReference        `json:"sourceCredentialRef,omitempty"`
+	DeltaArtifact       harnessv2.ArtifactReference `json:"deltaArtifact"`
+	Request             publisher.PrepareRequest    `json:"request"`
+}
+
+// PreparedPublication deliberately omits the publisher's local BundlePath.
+type PreparedPublication struct {
+	PublicationID         string                      `json:"publicationId"`
+	PublicationGeneration int64                       `json:"publicationGeneration"`
+	OperationID           string                      `json:"operationId"`
+	RequestDigest         string                      `json:"requestDigest"`
+	Source                publisher.Repository        `json:"source"`
+	SourceRef             string                      `json:"sourceRef"`
+	Target                publisher.Repository        `json:"target"`
+	TargetRef             string                      `json:"targetRef"`
+	BranchClaimGeneration int64                       `json:"branchClaimGeneration"`
+	BaselineOID           string                      `json:"baselineOid"`
+	RemoteBefore          publisher.RemoteRef         `json:"remoteBefore"`
+	DeltaArtifactDigest   string                      `json:"deltaArtifactDigest"`
+	RelativeRoot          string                      `json:"relativeRoot,omitempty"`
+	ManifestDigest        string                      `json:"manifestDigest"`
+	TreeOID               string                      `json:"treeOid"`
+	CommitOID             string                      `json:"commitOid"`
+	BundleDigest          string                      `json:"bundleDigest"`
+	BundleSize            int64                       `json:"bundleSize"`
+	BundleRef             string                      `json:"bundleRef"`
+	BundleArtifact        harnessv2.ArtifactReference `json:"bundleArtifact"`
+	CommitMessage         string                      `json:"commitMessage"`
+	CommitTimestamp       time.Time                   `json:"commitTimestamp"`
+}
+
+type PublicationPrepareResponse struct {
+	OperationID   string              `json:"operationId"`
+	RequestDigest string              `json:"requestDigest"`
+	Prepared      PreparedPublication `json:"prepared"`
+}
+
+type PublicationPublishRequest struct {
+	Metadata      OperationMetadata        `json:"metadata"`
+	CredentialRef *CredentialReference     `json:"credentialRef,omitempty"`
+	Prepared      PreparedPublication      `json:"prepared"`
+	Request       publisher.PublishRequest `json:"request"`
+}
+
+type PublicationPublishResponse struct {
+	OperationID   string                   `json:"operationId"`
+	RequestDigest string                   `json:"requestDigest"`
+	Receipt       publisher.PublishReceipt `json:"receipt"`
+}
+
+type PublicationVerifyRequest struct {
+	Metadata      OperationMetadata       `json:"metadata"`
+	CredentialRef *CredentialReference    `json:"credentialRef,omitempty"`
+	Prepared      PreparedPublication     `json:"prepared"`
+	Request       publisher.VerifyRequest `json:"request"`
+}
+
+type PublicationVerifyResponse struct {
+	OperationID   string                        `json:"operationId"`
+	RequestDigest string                        `json:"requestDigest"`
+	Receipt       publisher.VerificationReceipt `json:"receipt"`
+}
+
+type PublicationReclaimRequest struct {
+	Metadata OperationMetadata        `json:"metadata"`
+	Request  publisher.ReclaimRequest `json:"request"`
+}
+
+type PublicationReclaimResponse struct {
+	OperationID   string                  `json:"operationId"`
+	RequestDigest string                  `json:"requestDigest"`
+	Result        publisher.ReclaimResult `json:"result"`
+}
+
+type PullRequestReconcileRequest struct {
+	Metadata      OperationMetadata           `json:"metadata"`
+	CredentialRef *CredentialReference        `json:"credentialRef,omitempty"`
+	Intent        publisher.PullRequestIntent `json:"intent"`
+}
+
+type PullRequestReconcileResponse struct {
+	OperationID   string                       `json:"operationId"`
+	RequestDigest string                       `json:"requestDigest"`
+	Receipt       publisher.PullRequestReceipt `json:"receipt"`
+}
+
+type ErrorResponse struct {
+	Code          string `json:"code"`
+	Message       string `json:"message"`
+	Retryable     bool   `json:"retryable"`
+	OperationID   string `json:"operationId,omitempty"`
+	RequestDigest string `json:"requestDigest,omitempty"`
+}
+
+type HealthResponse struct {
+	Status string `json:"status"`
+	Ready  bool   `json:"ready"`
+}
+
+type CapabilityLimits struct {
+	MaxConcurrentOperations   int   `json:"maxConcurrentOperations"`
+	MaxRequestBytes           int64 `json:"maxRequestBytes"`
+	MaxResponseBytes          int64 `json:"maxResponseBytes"`
+	MaxWorkspaceEntries       int   `json:"maxWorkspaceEntries"`
+	MaxWorkspaceFileBytes     int64 `json:"maxWorkspaceFileBytes"`
+	MaxWorkspaceBytes         int64 `json:"maxWorkspaceBytes"`
+	MaxWorkspaceArtifactBytes int64 `json:"maxWorkspaceArtifactBytes"`
+	MaxDeltaBytes             int64 `json:"maxDeltaBytes"`
+	MaxBundleBytes            int64 `json:"maxBundleBytes"`
+	MaxJournalBytes           int64 `json:"maxJournalBytes"`
+}
+
+type CapabilitiesResponse struct {
+	Protocol                  string           `json:"protocol"`
+	NetworkIdentity           string           `json:"networkIdentity"`
+	Operations                []Operation      `json:"operations"`
+	Authentication            []string         `json:"authentication"`
+	CredentialKinds           []CredentialKind `json:"credentialKinds"`
+	SCMSchemes                []string         `json:"scmSchemes"`
+	GitVersion                string           `json:"gitVersion"`
+	RedirectsAllowed          bool             `json:"redirectsAllowed"`
+	ProviderOrMCPAccess       bool             `json:"providerOrMcpAccess"`
+	PullRequestReconciliation bool             `json:"pullRequestReconciliation"`
+	Limits                    CapabilityLimits `json:"limits"`
+}
+
+// PRReconcilerFactory lets an SCM-specific adapter consume a short-lived,
+// operation-scoped credential file without expanding the public API to raw
+// credentials. The file is deleted immediately after reconciliation.
+type PRReconcilerFactory interface {
+	New(ctx context.Context, credentialPath string) (publisher.PullRequestReconciler, error)
+}
+
+type PRReconcilerFactoryFunc func(context.Context, string) (publisher.PullRequestReconciler, error)
+
+func (f PRReconcilerFactoryFunc) New(ctx context.Context, credentialPath string) (publisher.PullRequestReconciler, error) {
+	return f(ctx, credentialPath)
+}
+
+// Config contains only already-resolved secrets. The command package loads
+// them from files and clears the corresponding environment variables.
+type Config struct {
+	ListenAddress             string
+	ControllerBearerToken     []byte
+	OperationCapabilitySecret []byte
+	// ArtifactCapabilitySecret is a development/test fallback. Supported
+	// deployments use ArtifactAuthorizationBrokerURL so the Publisher cannot
+	// mint arbitrary artifact capabilities.
+	ArtifactCapabilitySecret       []byte
+	ArtifactAuthorizationBrokerURL string
+	ArtifactAPIURL                 string
+	ArtifactRoot                   string
+	JournalRoot                    string
+	TempRoot                       string
+	CredentialRoot                 string
+	CredentialBrokerURL            string
+	DefaultGitCredential           *CredentialReference
+	GitBinary                      string
+	RequiredGitVersion             string
+	AllowedSCMHosts                []string
+	ProxyEnvironment               publisher.ProxyEnvironment
+	AllowFileRepositories          bool
+	MaxConcurrentOperations        int
+	MaxRequestBytes                int64
+	MaxResponseBytes               int64
+	MaxJournalBytes                int64
+	MaxDeltaBytes                  int64
+	MaxBundleBytes                 int64
+	MaxCommandOutput               int64
+	PublishTimeout                 time.Duration
+	VerifyAttempts                 int
+	VerifyBackoff                  time.Duration
+	WorkspaceLimits                WorkspaceLimits
+	ArtifactTimeout                time.Duration
+	CapabilityTTL                  time.Duration
+	PRFactory                      PRReconcilerFactory
+	HTTPClient                     *http.Client
+	Now                            func() time.Time
+}
+
+func defaultWorkspaceLimits() WorkspaceLimits {
+	limits := workspacedelta.DefaultLimits()
+	return WorkspaceLimits{
+		MaxEntries: limits.MaxEntries, MaxFileBytes: min(limits.MaxFileBytes, int64(64<<20)),
+		MaxExpandedBytes: min(limits.MaxTotalBytes, int64(96<<20)),
+		MaxArtifactBytes: min(limits.MaxArtifactBytes, artifactcap.DefaultWorkspaceArtifactMaxBytes),
+		MaxPathBytes:     limits.MaxPathBytes,
+	}
+}
diff --git a/internal/publisher/service/validation.go b/internal/publisher/service/validation.go
new file mode 100644
index 000000000..f9e5b07ed
--- /dev/null
+++ b/internal/publisher/service/validation.go
@@ -0,0 +1,282 @@
+package service
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"net"
+	"net/url"
+	"path"
+	"regexp"
+	"slices"
+	"strings"
+	"unicode/utf8"
+
+	"github.com/orka-agents/orka/internal/artifactcap"
+	"github.com/orka-agents/orka/internal/publisher"
+)
+
+const (
+	schemeHTTP  = "http"
+	schemeHTTPS = "https"
+)
+
+var credentialNamePattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$`)
+
+func (m OperationMetadata) validateFor(operation Operation) error {
+	identity := artifactcap.Identity{Namespace: m.Namespace, TaskID: m.TaskID, PublicationID: m.PublicationID}
+	if err := identity.Validate(); err != nil {
+		return invalidRequest("operation identity is invalid", err)
+	}
+	if err := validateOpaqueID("operation ID", m.OperationID, 512); err != nil {
+		return err
+	}
+	switch operation {
+	case OperationWorkspaceResolve, OperationWorkspacePrepare:
+		if m.TaskID == "" || m.PublicationID != "" {
+			return invalidRequest("workspace operation requires exactly one Task identity", nil)
+		}
+	case OperationPublicationPreflight, OperationPublicationPrepare, OperationPublicationPublish,
+		OperationPublicationVerify, OperationPublicationReclaim, OperationPullRequestReconcile:
+		if m.PublicationID == "" || m.TaskID != "" {
+			return invalidRequest("publication operation requires exactly one Publication identity", nil)
+		}
+	default:
+		return invalidRequest("unsupported operation", nil)
+	}
+	return nil
+}
+
+func validateOpaqueID(field, value string, max int) error {
+	if value == "" || len(value) > max || strings.TrimSpace(value) != value || !utf8.ValidString(value) || hasControl(value) {
+		return invalidRequest(field+" is empty, non-canonical, or too long", nil)
+	}
+	return nil
+}
+
+func validateCredentialReference(reference *CredentialReference, expected CredentialKind) error {
+	if reference == nil {
+		return nil
+	}
+	if !credentialNamePattern.MatchString(reference.Name) {
+		return apiError(ErrCredential, "invalid_credential_ref", "credential reference name is invalid", 400, false, nil)
+	}
+	if reference.Kind != expected {
+		return apiError(ErrCredential, "invalid_credential_ref", "credential reference kind is invalid for this operation", 400, false, nil)
+	}
+	switch reference.Role {
+	case "", CredentialRoleSourceRead, CredentialRoleTargetRead, CredentialRoleTargetWrite, CredentialRoleForge:
+	default:
+		return apiError(ErrCredential, "invalid_credential_ref", "credential reference role is invalid", 400, false, nil)
+	}
+	return nil
+}
+
+//nolint:gocyclo // Repository URL policy is intentionally explicit and fail-closed.
+func validateRepository(repository publisher.Repository, allowFile bool, allowedHosts []string) error {
+	if err := validateOpaqueID("repository provider", repository.Provider, 63); err != nil {
+		return err
+	}
+	if repository.Provider != strings.ToLower(repository.Provider) {
+		return invalidRequest("repository provider must be lower-case", nil)
+	}
+	if err := validateOpaqueID("repository ID", repository.ID, 512); err != nil {
+		return err
+	}
+	if repository.URL == "" || strings.TrimSpace(repository.URL) != repository.URL || !utf8.ValidString(repository.URL) || hasControl(repository.URL) {
+		return invalidRequest("repository URL is invalid", nil)
+	}
+	parsed, err := url.Parse(repository.URL)
+	if err != nil || parsed.Scheme == "" || parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" || parsed.Opaque != "" {
+		return invalidRequest("repository URL must be an absolute credential-free URL", err)
+	}
+	if parsed.RawPath != "" && parsed.EscapedPath() != parsed.Path {
+		return invalidRequest("repository URL escaped path is non-canonical", nil)
+	}
+	switch strings.ToLower(parsed.Scheme) {
+	case "file":
+		if !allowFile || parsed.Host != "" || !strings.HasPrefix(parsed.Path, "/") || path.Clean(parsed.Path) != parsed.Path || parsed.Path == "/" {
+			return invalidRequest("file repositories are disabled or non-canonical", nil)
+		}
+	case schemeHTTPS:
+		hostname := strings.ToLower(parsed.Hostname())
+		if hostname == "" || parsed.Host != strings.ToLower(parsed.Host) || parsed.Path == "" || parsed.Path == "/" ||
+			!strings.HasPrefix(parsed.Path, "/") || path.Clean(parsed.Path) != parsed.Path {
+			return invalidRequest("HTTPS repository URL is non-canonical", nil)
+		}
+		if ip := net.ParseIP(hostname); ip != nil && (ip.IsLoopback() || ip.IsUnspecified() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast()) {
+			return invalidRequest("repository URL uses a forbidden IP literal", nil)
+		}
+		if len(allowedHosts) > 0 && !slices.Contains(allowedHosts, hostname) {
+			return invalidRequest("repository host is outside the configured SCM allowlist", nil)
+		}
+	default:
+		return invalidRequest("only HTTPS repositories are allowed", nil)
+	}
+	return nil
+}
+
+func validateSourceRefBaseline(sourceRef, baselineOID string) error {
+	if validateObjectID(sourceRef) == nil && sourceRef != baselineOID {
+		return invalidRequest("exact source commit must equal the frozen baseline", nil)
+	}
+	return nil
+}
+
+func validateSourceRef(ref string) error {
+	if validateObjectID(ref) == nil {
+		return nil
+	}
+	if strings.HasPrefix(ref, "refs/tags/") {
+		return validateTagRef(ref)
+	}
+	return validateBranchRef(ref)
+}
+
+// CanonicalWorkspaceSourceRef validates a workspace source selector while
+// preserving bare names for repository-aware branch/tag disambiguation.
+func CanonicalWorkspaceSourceRef(ref string) (string, error) {
+	if validateObjectID(ref) == nil {
+		return ref, nil
+	}
+	if looksLikeObjectID(ref) {
+		return "", validateObjectID(ref)
+	}
+	switch {
+	case strings.HasPrefix(ref, "refs/heads/"):
+		return ref, validateBranchRef(ref)
+	case strings.HasPrefix(ref, "refs/tags/"):
+		return ref, validateTagRef(ref)
+	case strings.HasPrefix(ref, "refs/"):
+		return "", invalidRequest("source ref uses an unsupported canonical namespace", nil)
+	default:
+		return ref, validateShortSourceRef(ref)
+	}
+}
+
+func validateShortSourceRef(ref string) error {
+	if ref == "" || len(ref) > 1024-len("refs/heads/") || strings.TrimSpace(ref) != ref ||
+		!utf8.ValidString(ref) || hasControl(ref) || strings.Contains(ref, "\\") {
+		return invalidRequest("short source ref is empty, non-canonical, or too long", nil)
+	}
+	return validateRefPath(ref, "short source")
+}
+
+func isBareWorkspaceSourceRef(ref string) bool {
+	return validateObjectID(ref) != nil && !strings.HasPrefix(ref, "refs/")
+}
+
+func validateBranchRef(ref string) error {
+	return validateCanonicalRef(ref, "refs/heads/", "branch")
+}
+
+func validateTagRef(ref string) error {
+	return validateCanonicalRef(ref, "refs/tags/", "tag")
+}
+
+func validateCanonicalRef(ref, prefix, kind string) error {
+	if len(ref) <= len(prefix) || len(ref) > 1024 || !strings.HasPrefix(ref, prefix) ||
+		strings.TrimSpace(ref) != ref || !utf8.ValidString(ref) || hasControl(ref) || strings.Contains(ref, "\\") {
+		return invalidRequest(kind+" ref is not a canonical full "+prefix+" reference", nil)
+	}
+	return validateRefPath(strings.TrimPrefix(ref, prefix), kind)
+}
+
+func validateRefPath(ref, kind string) error {
+	if strings.HasPrefix(ref, "-") || strings.HasSuffix(ref, "/") || strings.HasSuffix(ref, ".") ||
+		strings.Contains(ref, "..") || strings.Contains(ref, "//") || strings.Contains(ref, "@{") ||
+		strings.ContainsAny(ref, " ~^:?*[") {
+		return invalidRequest(kind+" ref contains a forbidden sequence", nil)
+	}
+	for component := range strings.SplitSeq(ref, "/") {
+		if component == "" || component == "." || component == ".." || component == "@" || strings.HasPrefix(component, ".") || strings.HasSuffix(component, ".lock") {
+			return invalidRequest(kind+" ref contains a forbidden component", nil)
+		}
+	}
+	return nil
+}
+
+func looksLikeObjectID(value string) bool {
+	if len(value) != 40 && len(value) != 64 {
+		return false
+	}
+	_, err := hex.DecodeString(value)
+	return err == nil
+}
+
+func validateObjectID(value string) error {
+	if len(value) != 40 && len(value) != 64 || value != strings.ToLower(value) {
+		return invalidRequest("Git object ID must be lower-case SHA-1 or SHA-256", nil)
+	}
+	if _, err := hex.DecodeString(value); err != nil || strings.Trim(value, "0") == "" {
+		return invalidRequest("Git object ID is invalid", err)
+	}
+	return nil
+}
+
+func validateWorkspacePath(value string, maxBytes int) error {
+	if value == "" || len(value) > maxBytes || strings.HasPrefix(value, "/") || strings.Contains(value, "\\") ||
+		strings.TrimSpace(value) != value || !utf8.ValidString(value) || hasControl(value) {
+		return invalidRequest("repository tree contains an unsafe path", nil)
+	}
+	cleaned := path.Clean(value)
+	if cleaned != value || cleaned == "." || cleaned == ".." || strings.HasPrefix(cleaned, "../") {
+		return invalidRequest("repository tree path escapes the workspace", nil)
+	}
+	for component := range strings.SplitSeq(value, "/") {
+		lower := strings.ToLower(component)
+		if component == "" || component == "." || component == ".." || lower == ".git" || lower == ".gitmodules" {
+			return invalidRequest("repository tree contains forbidden Git metadata", nil)
+		}
+	}
+	return nil
+}
+
+func validatePullRequestReceipt(receipt publisher.PullRequestReceipt) error {
+	if err := validateOpaqueID("pull request forge ID", receipt.ForgeID, 512); err != nil {
+		return apiError(ErrOperationConflict, "pr_receipt_invalid", "pull request backend returned an invalid receipt", 502, false, err)
+	}
+	if len(receipt.URL) < 1 || len(receipt.URL) > maxGitHubReceiptURLBytes || strings.TrimSpace(receipt.URL) != receipt.URL || hasControl(receipt.URL) {
+		return apiError(ErrOperationConflict, "pr_receipt_invalid", "pull request backend returned an invalid receipt", 502, false, nil)
+	}
+	parsed, err := url.Parse(receipt.URL)
+	if err != nil || parsed.Scheme != schemeHTTPS || parsed.Host == "" || parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" || parsed.Opaque != "" {
+		return apiError(ErrOperationConflict, "pr_receipt_invalid", "pull request backend returned an invalid receipt", 502, false, err)
+	}
+	return nil
+}
+
+func hasControl(value string) bool {
+	for _, current := range value {
+		if current < 0x20 || current == 0x7f {
+			return true
+		}
+	}
+	return false
+}
+
+func hashID(parts ...string) string {
+	hash := sha256.New()
+	for _, part := range parts {
+		_, _ = hash.Write([]byte(part))
+		_, _ = hash.Write([]byte{0})
+	}
+	return hex.EncodeToString(hash.Sum(nil))
+}
+
+func normalizeAllowedHosts(values []string) ([]string, error) {
+	set := map[string]struct{}{}
+	for _, value := range values {
+		host := strings.ToLower(strings.TrimSpace(value))
+		if host == "" || net.ParseIP(host) != nil || strings.ContainsAny(host, "/:@[]") {
+			return nil, fmt.Errorf("invalid allowed SCM host %q", value)
+		}
+		set[host] = struct{}{}
+	}
+	result := make([]string, 0, len(set))
+	for host := range set {
+		result = append(result, host)
+	}
+	slices.Sort(result)
+	return result, nil
+}
diff --git a/internal/publisher/service/workspace.go b/internal/publisher/service/workspace.go
new file mode 100644
index 000000000..77631263b
--- /dev/null
+++ b/internal/publisher/service/workspace.go
@@ -0,0 +1,245 @@
+package service
+
+import (
+	"archive/tar"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/orka-agents/orka/internal/artifactcap"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+const workspaceManifestSchema = "orka.workspace-source.v1"
+
+var normalizedArchiveTime = time.Unix(0, 0).UTC()
+
+type workspaceEntry struct {
+	Path   string `json:"path"`
+	Mode   string `json:"mode"`
+	OID    string `json:"oid"`
+	Size   int64  `json:"size"`
+	Target string `json:"target,omitempty"`
+}
+
+type workspaceManifest struct {
+	Schema       string           `json:"schema"`
+	RepositoryID string           `json:"repositoryId"`
+	SourceRef    string           `json:"sourceRef"`
+	BaselineOID  string           `json:"baselineOid"`
+	TreeOID      string           `json:"treeOid"`
+	Entries      []workspaceEntry `json:"entries"`
+}
+
+type workspaceArchive struct {
+	path           string
+	digest         string
+	size           int64
+	manifestDigest string
+	treeOID        string
+	entryCount     int
+	expandedBytes  int64
+}
+
+func buildWorkspaceArchive(
+	ctx context.Context,
+	runner *gitRunner,
+	repositoryID, repositoryURL, sourceRef, baselineOID string,
+	limits WorkspaceLimits,
+) (workspaceArchive, error) {
+	box, repositoryPath, treeOID, err := runner.prepareExactRepository(ctx, repositoryURL, sourceRef, baselineOID)
+	if err != nil {
+		return workspaceArchive{}, err
+	}
+	defer box.close()
+	batch, err := runner.startBlobBatch(ctx, box, repositoryPath, limits.MaxExpandedBytes, limits.MaxEntries)
+	if err != nil {
+		return workspaceArchive{}, err
+	}
+	defer batch.abort()
+	entries, err := runner.listTree(ctx, box, batch, repositoryPath, baselineOID, limits)
+	if err != nil {
+		return workspaceArchive{}, err
+	}
+	manifest := workspaceManifest{
+		Schema: workspaceManifestSchema, RepositoryID: repositoryID, SourceRef: sourceRef,
+		BaselineOID: baselineOID, TreeOID: treeOID, Entries: entries,
+	}
+	manifestBytes, err := harnessv2.CanonicalValue(manifest)
+	if err != nil {
+		return workspaceArchive{}, invalidRequest("workspace manifest could not be canonicalized", err)
+	}
+	manifestHash := sha256.Sum256(manifestBytes)
+	manifestDigest := "sha256:" + hex.EncodeToString(manifestHash[:])
+	archive, err := os.CreateTemp(runner.tempRoot, "workspace-*.tar")
+	if err != nil {
+		return workspaceArchive{}, apiError(ErrSCMTransport, "workspace_archive_failed", "workspace archive could not be created", 500, false, err)
+	}
+	archivePath := archive.Name()
+	cleanup := true
+	defer func() {
+		_ = archive.Close()
+		if cleanup {
+			_ = os.Remove(archivePath)
+		}
+	}()
+	if err := archive.Chmod(0o600); err != nil {
+		return workspaceArchive{}, err
+	}
+	hasher := sha256.New()
+	limited := &boundedArchiveWriter{writer: io.MultiWriter(archive, hasher), limit: limits.MaxArtifactBytes}
+	tarWriter := tar.NewWriter(limited)
+	directories := workspaceDirectories(entries)
+	entryCount := len(directories) + len(entries)
+	if entryCount > limits.MaxEntries {
+		return workspaceArchive{}, invalidRequest("workspace archive exceeds the entry limit after directory expansion", nil)
+	}
+	for _, directory := range directories {
+		if err := writeWorkspaceHeader(tarWriter, directory, 0o755, 0, tar.TypeDir, ""); err != nil {
+			return workspaceArchive{}, archiveError(err)
+		}
+	}
+	var expanded int64
+	for _, entry := range entries {
+		if err := ctx.Err(); err != nil {
+			return workspaceArchive{}, err
+		}
+		if entry.Mode == "120000" {
+			if entry.Target == "" || int64(len(entry.Target)) != entry.Size {
+				return workspaceArchive{}, invalidRequest("workspace symlink metadata is inconsistent", nil)
+			}
+			if err := writeWorkspaceHeader(tarWriter, entry.Path, 0o777, 0, tar.TypeSymlink, entry.Target); err != nil {
+				return workspaceArchive{}, archiveError(err)
+			}
+			expanded += entry.Size
+			continue
+		}
+		mode := int64(0o644)
+		if entry.Mode == "100755" {
+			mode = 0o755
+		}
+		if err := writeWorkspaceHeader(tarWriter, entry.Path, mode, entry.Size, tar.TypeReg, ""); err != nil {
+			return workspaceArchive{}, archiveError(err)
+		}
+		blob, err := batch.readBlob(entry, limits.MaxFileBytes)
+		if err != nil {
+			return workspaceArchive{}, err
+		}
+		if _, err := tarWriter.Write(blob); err != nil {
+			return workspaceArchive{}, archiveError(err)
+		}
+		expanded += entry.Size
+	}
+	if err := batch.finish(); err != nil {
+		return workspaceArchive{}, err
+	}
+	if err := tarWriter.Close(); err != nil {
+		return workspaceArchive{}, archiveError(err)
+	}
+	if err := archive.Sync(); err != nil {
+		return workspaceArchive{}, archiveError(err)
+	}
+	if err := archive.Close(); err != nil {
+		return workspaceArchive{}, archiveError(err)
+	}
+	cleanup = false
+	return workspaceArchive{
+		path: archivePath, digest: "sha256:" + hex.EncodeToString(hasher.Sum(nil)), size: limited.written,
+		manifestDigest: manifestDigest, treeOID: treeOID, entryCount: entryCount, expandedBytes: expanded,
+	}, nil
+}
+
+func workspaceDirectories(entries []workspaceEntry) []string {
+	set := make(map[string]struct{})
+	for _, entry := range entries {
+		parent := path.Dir(entry.Path)
+		for parent != "." && parent != "/" {
+			set[parent] = struct{}{}
+			parent = path.Dir(parent)
+		}
+	}
+	result := make([]string, 0, len(set))
+	for directory := range set {
+		result = append(result, directory)
+	}
+	sort.Slice(result, func(i, j int) bool {
+		leftDepth := strings.Count(result[i], "/")
+		rightDepth := strings.Count(result[j], "/")
+		if leftDepth == rightDepth {
+			return result[i] < result[j]
+		}
+		return leftDepth < rightDepth
+	})
+	return result
+}
+
+func writeWorkspaceHeader(writer *tar.Writer, name string, mode, size int64, typeFlag byte, linkName string) error {
+	return writer.WriteHeader(&tar.Header{
+		Typeflag: typeFlag, Name: name, Linkname: linkName, Mode: mode, Size: size,
+		ModTime: normalizedArchiveTime, AccessTime: normalizedArchiveTime, ChangeTime: normalizedArchiveTime,
+		Uid: 0, Gid: 0, Uname: "", Gname: "", Format: tar.FormatPAX,
+	})
+}
+
+func archiveError(err error) error {
+	return apiError(ErrSCMTransport, "workspace_archive_failed", "workspace archive exceeded limits or could not be written", 500, false, err)
+}
+
+type boundedArchiveWriter struct {
+	writer  io.Writer
+	limit   int64
+	written int64
+}
+
+func (w *boundedArchiveWriter) Write(value []byte) (int, error) {
+	if int64(len(value)) > w.limit-w.written {
+		return 0, fmt.Errorf("workspace archive exceeds %d bytes", w.limit)
+	}
+	count, err := w.writer.Write(value)
+	w.written += int64(count)
+	return count, err
+}
+
+func verifyWorkspaceObject(file *os.File, reference harnessv2.ArtifactReference) error {
+	if _, err := file.Seek(0, io.SeekStart); err != nil {
+		return err
+	}
+	hasher := sha256.New()
+	copied, err := io.CopyN(hasher, file, reference.SizeBytes)
+	if err != nil || copied != reference.SizeBytes {
+		return fmt.Errorf("read workspace object: %w", err)
+	}
+	var extra [1]byte
+	if count, readErr := file.Read(extra[:]); count != 0 || !errors.Is(readErr, io.EOF) {
+		return fmt.Errorf("workspace object size changed")
+	}
+	actual := "sha256:" + hex.EncodeToString(hasher.Sum(nil))
+	if !constantEqual(actual, reference.Digest) {
+		return fmt.Errorf("workspace object digest mismatch")
+	}
+	_, err = file.Seek(0, io.SeekStart)
+	return err
+}
+
+func workspaceArtifactReference(archive workspaceArchive) (harnessv2.ArtifactReference, error) {
+	artifactID, err := artifactcap.ArtifactIDForDigest(archive.digest)
+	if err != nil {
+		return harnessv2.ArtifactReference{}, err
+	}
+	reference := harnessv2.ArtifactReference{
+		ArtifactID: harnessv2.ArtifactID(artifactID), Digest: archive.digest, SizeBytes: archive.size,
+		MediaType: artifactcap.MediaTypeWorkspaceTar,
+	}
+	if err := reference.Validate(); err != nil {
+		return harnessv2.ArtifactReference{}, err
+	}
+	return reference, nil
+}
diff --git a/internal/publisher/storage.go b/internal/publisher/storage.go
new file mode 100644
index 000000000..bb8b68d49
--- /dev/null
+++ b/internal/publisher/storage.go
@@ -0,0 +1,479 @@
+package publisher
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+const (
+	publicationIdentitySchema        = "orka.publisher.publication-cache.v1"
+	publicationIdentityName          = "publication.json"
+	preparedMetadataName             = "prepared.json"
+	bundleFileName                   = "publication.bundle"
+	canonicalMetadataMaxBytes        = int64(1 << 20)
+	legacyPublicationCacheGeneration = int64(1)
+)
+
+type publicationStorageIdentity struct {
+	Schema                string `json:"schema"`
+	PublicationID         string `json:"publicationId"`
+	PublicationGeneration int64  `json:"publicationGeneration"`
+}
+
+func (p *Publisher) publicationPath(publicationID string) (string, error) {
+	if err := validateIdentifier("publication ID", publicationID); err != nil {
+		return "", err
+	}
+	return filepath.Join(p.artifactRoot, publicationID), nil
+}
+
+func (p *Publisher) ensurePublicationDirectory(publicationID string, generation int64) (string, error) {
+	if generation < 1 {
+		return "", invalid("publication generation", "must be at least 1")
+	}
+	directory, err := p.publicationPath(publicationID)
+	if err != nil {
+		return "", err
+	}
+	request := ReclaimRequest{PublicationID: publicationID, PublicationGeneration: generation}
+	staging := p.publicationStagingPath(request)
+	identity, exists, identityErr := p.publicationIdentityForRequest(directory, request, true)
+	if identityErr != nil {
+		return "", identityErr
+	}
+	if exists {
+		if identity.PublicationGeneration != generation {
+			return "", operationError(ErrIdempotencyConflict, "open publication cache", "publication generation differs from durable cache identity", nil)
+		}
+		if err := p.removePublicationStaging(staging, request); err != nil {
+			return "", err
+		}
+		if err := syncPublisherDirectory(p.artifactRoot); err != nil {
+			return "", fmt.Errorf("persist publication cache directory: %w", err)
+		}
+		return directory, nil
+	}
+
+	if identity, identityErr := p.readPublicationIdentity(staging, publicationID); identityErr == nil {
+		if identity.PublicationGeneration != generation {
+			return "", operationError(ErrIdempotencyConflict, "resume publication cache creation", "staged publication generation differs from request", nil)
+		}
+	} else if errors.Is(identityErr, os.ErrNotExist) {
+		if err := ensureTrustedDirectory(staging); err != nil {
+			return "", err
+		}
+		identity := publicationStorageIdentity{
+			Schema: publicationIdentitySchema, PublicationID: publicationID, PublicationGeneration: generation,
+		}
+		if err := writeCanonicalDurable(filepath.Join(staging, publicationIdentityName), identity); err != nil {
+			return "", fmt.Errorf("persist publication cache identity: %w", err)
+		}
+	} else {
+		return "", identityErr
+	}
+	if err := os.Rename(staging, directory); err != nil {
+		return "", fmt.Errorf("activate publication cache directory: %w", err)
+	}
+	if err := syncPublisherDirectory(p.artifactRoot); err != nil {
+		return "", fmt.Errorf("persist publication cache directory: %w", err)
+	}
+	return directory, nil
+}
+
+// publicationIdentityForRequest loads the exact cache identity. A live
+// directory created by the pre-identity format may be upgraded only for that
+// format's sole generation; deterministic staging/tombstone directories may
+// recover the generation encoded by their request-derived path.
+func (p *Publisher) publicationIdentityForRequest(
+	directory string, request ReclaimRequest, legacyLiveDirectory bool,
+) (publicationStorageIdentity, bool, error) {
+	identity, err := p.readPublicationIdentity(directory, request.PublicationID)
+	if err == nil {
+		return identity, true, nil
+	}
+	if !errors.Is(err, os.ErrNotExist) {
+		return publicationStorageIdentity{}, false, err
+	}
+	info, statErr := os.Lstat(directory)
+	if errors.Is(statErr, os.ErrNotExist) {
+		return publicationStorageIdentity{}, false, nil
+	}
+	if statErr != nil {
+		return publicationStorageIdentity{}, false, statErr
+	}
+	if !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
+		return publicationStorageIdentity{}, false, operationError(
+			ErrPreparedArtifactCorrupt, "inspect publication cache", "publication path is not a real directory", nil,
+		)
+	}
+	if legacyLiveDirectory && request.PublicationGeneration != legacyPublicationCacheGeneration {
+		return publicationStorageIdentity{}, false, operationError(
+			ErrIdempotencyConflict, "recover legacy publication cache",
+			"pre-identity publication cache can only belong to generation 1", nil,
+		)
+	}
+	if err := p.ensurePublicationIdentity(directory, request.PublicationID, request.PublicationGeneration); err != nil {
+		return publicationStorageIdentity{}, false, err
+	}
+	identity, err = p.readPublicationIdentityFile(directory)
+	if err != nil {
+		return publicationStorageIdentity{}, false, err
+	}
+	return identity, true, nil
+}
+
+func (p *Publisher) operationPath(publicationID, kind, operationID string) (string, error) {
+	directory, err := p.publicationPath(publicationID)
+	if err != nil {
+		return "", err
+	}
+	if _, err := p.readPublicationIdentity(directory, publicationID); err != nil {
+		return "", err
+	}
+	if err := validateIdentifier("operation ID", operationID); err != nil {
+		return "", err
+	}
+	operationDirectory := filepath.Join(directory, kind)
+	if err := ensureTrustedDirectory(operationDirectory); err != nil {
+		return "", err
+	}
+	return filepath.Join(operationDirectory, operationID+".json"), nil
+}
+
+func writeCanonicalDurable(path string, value any) error {
+	encoded, err := json.Marshal(value)
+	if err != nil {
+		return err
+	}
+	encoded = append(encoded, '\n')
+	return writeDurableFile(path, encoded, 0o600)
+}
+
+func writeDurableFile(path string, data []byte, mode os.FileMode) error {
+	directory := filepath.Dir(path)
+	temporary, err := os.CreateTemp(directory, ".orka-publisher-*")
+	if err != nil {
+		return err
+	}
+	temporaryPath := temporary.Name()
+	cleanup := func() {
+		_ = temporary.Close()
+		_ = os.Remove(temporaryPath)
+	}
+	if err := temporary.Chmod(mode); err != nil {
+		cleanup()
+		return err
+	}
+	if _, err := temporary.Write(data); err != nil {
+		cleanup()
+		return err
+	}
+	if err := temporary.Sync(); err != nil {
+		cleanup()
+		return err
+	}
+	if err := temporary.Close(); err != nil {
+		_ = os.Remove(temporaryPath)
+		return err
+	}
+	if err := os.Rename(temporaryPath, path); err != nil {
+		_ = os.Remove(temporaryPath)
+		return err
+	}
+	directoryFile, err := os.Open(directory)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = directoryFile.Close() }()
+	return directoryFile.Sync()
+}
+
+func readCanonical(path string, value any) error {
+	data, err := readBoundedFile(path, canonicalMetadataMaxBytes)
+	if err != nil {
+		return err
+	}
+	decoder := json.NewDecoder(bytes.NewReader(data))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(value); err != nil {
+		return err
+	}
+	var trailing any
+	if err := decoder.Decode(&trailing); err != io.EOF {
+		if err == nil {
+			return fmt.Errorf("trailing JSON value")
+		}
+		return fmt.Errorf("trailing JSON data: %w", err)
+	}
+	encoded, err := json.Marshal(value)
+	if err != nil {
+		return err
+	}
+	encoded = append(encoded, '\n')
+	if !bytes.Equal(encoded, data) {
+		return fmt.Errorf("metadata is not canonical JSON")
+	}
+	return nil
+}
+
+func (p *Publisher) loadPrepared(publicationID string) (PreparedPublication, error) {
+	directory, err := p.publicationPath(publicationID)
+	if err != nil {
+		return PreparedPublication{}, err
+	}
+	identity, err := p.readPublicationIdentity(directory, publicationID)
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return PreparedPublication{}, operationError(ErrPreparedArtifactMissing, "load prepared publication", publicationID, err)
+		}
+		return PreparedPublication{}, err
+	}
+	path := filepath.Join(directory, preparedMetadataName)
+	var prepared PreparedPublication
+	if err := readCanonical(path, &prepared); err != nil {
+		if os.IsNotExist(err) {
+			return PreparedPublication{}, operationError(ErrPreparedArtifactMissing, "load prepared publication", publicationID, err)
+		}
+		return PreparedPublication{}, operationError(ErrPreparedArtifactCorrupt, "load prepared publication", publicationID, err)
+	}
+	if prepared.PublicationID != publicationID || prepared.PublicationGeneration != identity.PublicationGeneration ||
+		prepared.BundlePath != filepath.Join(directory, bundleFileName) {
+		return PreparedPublication{}, operationError(ErrPreparedArtifactCorrupt, "validate prepared publication", "metadata path or identity mismatch", nil)
+	}
+	if err := validateSourceRefBaseline(prepared.SourceRef, prepared.BaselineOID); err != nil {
+		return PreparedPublication{}, operationError(ErrPreparedArtifactCorrupt, "validate prepared publication", "exact source selector does not match baseline", err)
+	}
+	bundle, err := readBoundedFile(prepared.BundlePath, p.maxBundleBytes)
+	if err != nil {
+		return PreparedPublication{}, operationError(ErrPreparedArtifactCorrupt, "read durable bundle", "", err)
+	}
+	if int64(len(bundle)) != prepared.BundleSize || digestBytes(bundle) != prepared.BundleDigest {
+		return PreparedPublication{}, operationError(ErrPreparedArtifactCorrupt, "validate durable bundle", "size or digest mismatch", nil)
+	}
+	return prepared, nil
+}
+
+// RestorePrepared imports a controller-durable prepared bundle into the local
+// Publisher cache. The bundle is strictly verified before the local receipt is
+// made visible, so loss of the Publisher PVC does not make a Prepared
+// Publication unrecoverable.
+func (p *Publisher) RestorePrepared(ctx context.Context, prepared PreparedPublication, bundle []byte) error {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if err := validateRestoredPrepared(prepared, bundle, p.maxBundleBytes); err != nil {
+		return err
+	}
+	directory, err := p.ensurePublicationDirectory(prepared.PublicationID, prepared.PublicationGeneration)
+	if err != nil {
+		return err
+	}
+	prepared.BundlePath = filepath.Join(directory, bundleFileName)
+	if existing, loadErr := p.loadPrepared(prepared.PublicationID); loadErr == nil {
+		if preparedPublicationsEqual(existing, prepared) {
+			return nil
+		}
+		return operationError(ErrIdempotencyConflict, "restore prepared publication", "local receipt differs from controller-durable receipt", nil)
+	}
+	box, err := p.newSandbox("restore")
+	if err != nil {
+		return err
+	}
+	defer box.Close() //nolint:errcheck
+	candidate := filepath.Join(box.root, bundleFileName)
+	if err := os.WriteFile(candidate, bundle, 0o600); err != nil {
+		return err
+	}
+	if err := p.verifyBundle(ctx, box, candidate, prepared.CommitOID, prepared.BundleRef); err != nil {
+		return operationError(ErrPreparedArtifactCorrupt, "restore prepared publication", "controller-durable bundle verification failed", err)
+	}
+	if err := writeDurableFile(prepared.BundlePath, bundle, 0o600); err != nil {
+		return fmt.Errorf("restore durable Git bundle: %w", err)
+	}
+	if err := writeCanonicalDurable(filepath.Join(directory, preparedMetadataName), prepared); err != nil {
+		return fmt.Errorf("restore prepared publication receipt: %w", err)
+	}
+	return nil
+}
+
+func (p *Publisher) ensurePublicationIdentity(directory, publicationID string, generation int64) error {
+	identity, err := p.readPublicationIdentityFile(directory)
+	if err == nil {
+		if identity.PublicationID != publicationID || identity.PublicationGeneration != generation {
+			return operationError(ErrIdempotencyConflict, "validate publication cache identity", "publication identity differs from request", nil)
+		}
+		return nil
+	}
+	if !errors.Is(err, os.ErrNotExist) {
+		return operationError(ErrPreparedArtifactCorrupt, "read publication cache identity", publicationID, err)
+	}
+	identity = publicationStorageIdentity{
+		Schema: publicationIdentitySchema, PublicationID: publicationID, PublicationGeneration: generation,
+	}
+	if err := writeCanonicalDurable(filepath.Join(directory, publicationIdentityName), identity); err != nil {
+		return fmt.Errorf("persist publication cache identity: %w", err)
+	}
+	return nil
+}
+
+func (p *Publisher) readPublicationIdentity(directory, publicationID string) (publicationStorageIdentity, error) {
+	info, err := os.Lstat(directory)
+	if err != nil {
+		return publicationStorageIdentity{}, err
+	}
+	if !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
+		return publicationStorageIdentity{}, operationError(ErrPreparedArtifactCorrupt, "inspect publication cache", "publication path is not a real directory", nil)
+	}
+	identity, err := p.readPublicationIdentityFile(directory)
+	if err == nil {
+		if identity.PublicationID != publicationID {
+			return publicationStorageIdentity{}, operationError(ErrPreparedArtifactCorrupt, "validate publication cache identity", "publication ID differs from directory identity", nil)
+		}
+		return identity, nil
+	}
+	if !errors.Is(err, os.ErrNotExist) {
+		return publicationStorageIdentity{}, operationError(ErrPreparedArtifactCorrupt, "read publication cache identity", publicationID, err)
+	}
+
+	// Upgrade a complete pre-identity cache in place. Older prepared receipts
+	// contain the exact Publication ID and generation, so they remain a safe
+	// reclamation fence after this format is introduced.
+	var prepared PreparedPublication
+	if err := readCanonical(filepath.Join(directory, preparedMetadataName), &prepared); err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return publicationStorageIdentity{}, operationError(ErrPreparedArtifactCorrupt, "read publication cache identity", "identity and prepared receipt are both missing", err)
+		}
+		return publicationStorageIdentity{}, operationError(ErrPreparedArtifactCorrupt, "read legacy publication cache identity", publicationID, err)
+	}
+	if prepared.PublicationID != publicationID || prepared.PublicationGeneration < 1 {
+		return publicationStorageIdentity{}, operationError(ErrPreparedArtifactCorrupt, "validate legacy publication cache identity", "prepared receipt identity is invalid", nil)
+	}
+	identity = publicationStorageIdentity{
+		Schema: publicationIdentitySchema, PublicationID: prepared.PublicationID, PublicationGeneration: prepared.PublicationGeneration,
+	}
+	if err := writeCanonicalDurable(filepath.Join(directory, publicationIdentityName), identity); err != nil {
+		return publicationStorageIdentity{}, fmt.Errorf("persist upgraded publication cache identity: %w", err)
+	}
+	return identity, nil
+}
+
+func (p *Publisher) readPublicationIdentityFile(directory string) (publicationStorageIdentity, error) {
+	var identity publicationStorageIdentity
+	if err := readCanonical(filepath.Join(directory, publicationIdentityName), &identity); err != nil {
+		return publicationStorageIdentity{}, err
+	}
+	if identity.Schema != publicationIdentitySchema || identity.PublicationGeneration < 1 {
+		return publicationStorageIdentity{}, operationError(ErrPreparedArtifactCorrupt, "validate publication cache identity", "identity schema or generation is invalid", nil)
+	}
+	if err := validateIdentifier("publication ID", identity.PublicationID); err != nil {
+		return publicationStorageIdentity{}, operationError(ErrPreparedArtifactCorrupt, "validate publication cache identity", "publication ID is invalid", err)
+	}
+	return identity, nil
+}
+
+func (p *Publisher) removePublicationStaging(path string, request ReclaimRequest) error {
+	identity, err := p.readPublicationIdentity(path, request.PublicationID)
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return nil
+		}
+		return err
+	}
+	if identity.PublicationGeneration != request.PublicationGeneration {
+		return operationError(ErrIdempotencyConflict, "remove publication cache staging", "staged generation differs from request", nil)
+	}
+	if err := os.RemoveAll(path); err != nil {
+		return fmt.Errorf("remove stale publication cache staging: %w", err)
+	}
+	return syncPublisherDirectory(p.artifactRoot)
+}
+
+func validateRestoredPrepared(prepared PreparedPublication, bundle []byte, maxBundleBytes int64) error {
+	if err := validateIdentifier("publication ID", prepared.PublicationID); err != nil {
+		return err
+	}
+	if prepared.PublicationGeneration < 1 || prepared.BranchClaimGeneration < 1 {
+		return invalid("publication generation", "publication and branch claim generations must be at least 1")
+	}
+	if err := validateIdentifier("operation ID", prepared.OperationID); err != nil {
+		return err
+	}
+	if err := validateDigest("prepared request digest", prepared.RequestDigest); err != nil {
+		return err
+	}
+	if err := validateRepository(prepared.Source); err != nil {
+		return err
+	}
+	if err := validateRepository(prepared.Target); err != nil {
+		return err
+	}
+	if err := validateSourceRef(prepared.SourceRef); err != nil {
+		return err
+	}
+	if err := validateBranchRef(prepared.TargetRef); err != nil {
+		return err
+	}
+	if err := validateObjectID("prepared baseline", prepared.BaselineOID); err != nil {
+		return err
+	}
+	if err := validateSourceRefBaseline(prepared.SourceRef, prepared.BaselineOID); err != nil {
+		return err
+	}
+	if err := validateRemoteRef("prepared remote before", prepared.RemoteBefore); err != nil {
+		return err
+	}
+	if err := validateRestoredRelativeRoot(prepared.RelativeRoot); err != nil {
+		return err
+	}
+	for field, digest := range map[string]string{
+		"delta artifact digest": prepared.DeltaArtifactDigest,
+		"manifest digest":       prepared.ManifestDigest,
+		"bundle digest":         prepared.BundleDigest,
+	} {
+		if err := validateDigest(field, digest); err != nil {
+			return err
+		}
+	}
+	if err := validateObjectID("prepared tree", prepared.TreeOID); err != nil {
+		return err
+	}
+	if err := validateObjectID("prepared commit", prepared.CommitOID); err != nil {
+		return err
+	}
+	if !strings.HasPrefix(prepared.BundleRef, "refs/orka/publications/") || len(strings.TrimPrefix(prepared.BundleRef, "refs/orka/publications/")) != 64 {
+		return operationError(ErrPreparedArtifactCorrupt, "restore prepared publication", "bundle ref is invalid", nil)
+	}
+	if prepared.BundlePath != "" || prepared.BundleSize < 1 || prepared.BundleSize > maxBundleBytes || int64(len(bundle)) != prepared.BundleSize || digestBytes(bundle) != prepared.BundleDigest {
+		return operationError(ErrPreparedArtifactCorrupt, "restore prepared publication", "bundle size or digest differs from controller receipt", nil)
+	}
+	if prepared.CommitMessage == "" || prepared.CommitTimestamp.IsZero() || prepared.CommitTimestamp.Location() != time.UTC {
+		return operationError(ErrPreparedArtifactCorrupt, "restore prepared publication", "commit metadata is invalid", nil)
+	}
+	return nil
+}
+
+func validateRestoredRelativeRoot(relativeRoot string) error {
+	if relativeRoot == "" || relativeRoot == "." {
+		return nil
+	}
+	if len(relativeRoot) > maxRelativeRootBytes {
+		return operationError(ErrPreparedArtifactCorrupt, "restore prepared publication", "workspace relative root exceeds limit", nil)
+	}
+	if err := validateWorkspacePath(relativeRoot); err != nil {
+		return operationError(ErrPreparedArtifactCorrupt, "restore prepared publication", "workspace relative root is invalid", err)
+	}
+	return nil
+}
+
+func preparedPublicationsEqual(left, right PreparedPublication) bool {
+	left.BundlePath = ""
+	right.BundlePath = ""
+	return left == right
+}
diff --git a/internal/publisher/types.go b/internal/publisher/types.go
new file mode 100644
index 000000000..19ca4dc2a
--- /dev/null
+++ b/internal/publisher/types.go
@@ -0,0 +1,229 @@
+package publisher
+
+import (
+	"context"
+	"time"
+)
+
+const (
+	DigestPrefix      = "sha256:"
+	CommitAuthorName  = "Orka Publisher"
+	CommitAuthorEmail = "publisher@orka.ai"
+)
+
+// Repository is an exact provider identity paired with one canonical clone
+// URL. Identity equality is exact and does not fall back to URL comparison.
+type Repository struct {
+	Provider string `json:"provider"`
+	ID       string `json:"id"`
+	URL      string `json:"url"`
+}
+
+// RemoteRef is an exact remote observation. Exactly one of Absent or OID is
+// set.
+type RemoteRef struct {
+	Absent bool   `json:"absent"`
+	OID    string `json:"oid,omitempty"`
+}
+
+func (r RemoteRef) Equal(other RemoteRef) bool {
+	return r.Absent == other.Absent && r.OID == other.OID
+}
+
+// BranchClaim is the publisher-facing immutable branch ownership fence.
+type BranchClaim struct {
+	RepositoryID string    `json:"repositoryId"`
+	Ref          string    `json:"ref"`
+	OwnerKind    string    `json:"ownerKind"`
+	OwnerUID     string    `json:"ownerUid"`
+	Generation   int64     `json:"generation"`
+	LastVerified RemoteRef `json:"lastVerified"`
+}
+
+// PrepareRequest binds the immutable workspace artifact and deterministic
+// commit to one Publication and target. Target may differ from Source for fork
+// publication.
+type PrepareRequest struct {
+	PublicationID         string     `json:"publicationId"`
+	PublicationGeneration int64      `json:"publicationGeneration"`
+	OperationID           string     `json:"operationId"`
+	Source                Repository `json:"source"`
+	SourceRef             string     `json:"sourceRef"`
+	Target                Repository `json:"target"`
+	TargetRef             string     `json:"targetRef"`
+	BranchClaimGeneration int64      `json:"branchClaimGeneration"`
+	BaselineOID           string     `json:"baselineOid"`
+	RemoteBefore          RemoteRef  `json:"remoteBefore"`
+	DeltaArtifact         []byte     `json:"-"`
+	DeltaArtifactDigest   string     `json:"deltaArtifactDigest"`
+	RelativeRoot          string     `json:"relativeRoot,omitempty"`
+	CommitMessage         string     `json:"commitMessage"`
+	CommitTimestamp       time.Time  `json:"commitTimestamp"`
+}
+
+// ReclaimRequest binds cache reclamation to one exact Publication incarnation.
+// A missing cache directory is already reclaimed and succeeds idempotently.
+type ReclaimRequest struct {
+	PublicationID         string `json:"publicationId"`
+	PublicationGeneration int64  `json:"publicationGeneration"`
+}
+
+// ReclaimResult records whether the local publication cache existed when the
+// reclaim operation ran. Reclaimed is true for both removed and already-absent
+// state because both are terminally reclaimed.
+type ReclaimResult struct {
+	PublicationID         string `json:"publicationId"`
+	PublicationGeneration int64  `json:"publicationGeneration"`
+	Reclaimed             bool   `json:"reclaimed"`
+}
+
+// PreparedPublication is the durable exact output of Prepare.
+type PreparedPublication struct {
+	PublicationID         string     `json:"publicationId"`
+	PublicationGeneration int64      `json:"publicationGeneration"`
+	OperationID           string     `json:"operationId"`
+	RequestDigest         string     `json:"requestDigest"`
+	Source                Repository `json:"source"`
+	SourceRef             string     `json:"sourceRef"`
+	Target                Repository `json:"target"`
+	TargetRef             string     `json:"targetRef"`
+	BranchClaimGeneration int64      `json:"branchClaimGeneration"`
+	BaselineOID           string     `json:"baselineOid"`
+	RemoteBefore          RemoteRef  `json:"remoteBefore"`
+	DeltaArtifactDigest   string     `json:"deltaArtifactDigest"`
+	RelativeRoot          string     `json:"relativeRoot,omitempty"`
+	ManifestDigest        string     `json:"manifestDigest"`
+	TreeOID               string     `json:"treeOid"`
+	CommitOID             string     `json:"commitOid"`
+	BundleDigest          string     `json:"bundleDigest"`
+	BundleSize            int64      `json:"bundleSize"`
+	BundleRef             string     `json:"bundleRef"`
+	BundlePath            string     `json:"bundlePath"`
+	CommitMessage         string     `json:"commitMessage"`
+	CommitTimestamp       time.Time  `json:"commitTimestamp"`
+}
+
+// PreflightRequest verifies that the target ref still exactly equals the
+// persisted BranchClaim baseline before a mutation is eligible to start.
+type PreflightRequest struct {
+	Target Repository  `json:"target"`
+	Claim  BranchClaim `json:"claim"`
+}
+
+// PreflightResult records the exact remote observation.
+type PreflightResult struct {
+	Expected RemoteRef `json:"expected"`
+	Observed RemoteRef `json:"observed"`
+	Matches  bool      `json:"matches"`
+}
+
+// PublishRequest binds a durable prepared artifact to one exact branch CAS.
+type PublishRequest struct {
+	PublicationID         string      `json:"publicationId"`
+	PublicationGeneration int64       `json:"publicationGeneration"`
+	OperationID           string      `json:"operationId"`
+	Target                Repository  `json:"target"`
+	TargetRef             string      `json:"targetRef"`
+	Claim                 BranchClaim `json:"claim"`
+	RemoteBefore          RemoteRef   `json:"remoteBefore"`
+	ExpectedCommitOID     string      `json:"expectedCommitOid"`
+	BundleDigest          string      `json:"bundleDigest"`
+}
+
+// PublishOutcome is the transport-level result. Remote delivery remains
+// non-terminal until Verify independently observes it.
+type PublishOutcome string
+
+const (
+	PublishAcknowledged   PublishOutcome = "Acknowledged"
+	PublishAlreadyExact   PublishOutcome = "AlreadyExact"
+	PublishCASRejected    PublishOutcome = "CASRejected"
+	PublishOutcomeUnknown PublishOutcome = "PublicationOutcomeUnknown"
+)
+
+// PublishReceipt is durable and idempotent for one operation ID and digest.
+type PublishReceipt struct {
+	PublicationID         string         `json:"publicationId"`
+	PublicationGeneration int64          `json:"publicationGeneration"`
+	OperationID           string         `json:"operationId"`
+	RequestDigest         string         `json:"requestDigest"`
+	Outcome               PublishOutcome `json:"outcome"`
+	TargetRepositoryID    string         `json:"targetRepositoryId"`
+	TargetRef             string         `json:"targetRef"`
+	RemoteBefore          RemoteRef      `json:"remoteBefore"`
+	ExpectedCommitOID     string         `json:"expectedCommitOid"`
+	ObservedRemote        RemoteRef      `json:"observedRemote"`
+}
+
+// VerificationOutcome is the independently observed delivery classification.
+type VerificationOutcome string
+
+const (
+	VerifiedExact             VerificationOutcome = "VerifiedExact"
+	DeliveredSuperseded       VerificationOutcome = "DeliveredSuperseded"
+	DeliveryConflict          VerificationOutcome = "DeliveryConflict"
+	PublicationOutcomeUnknown VerificationOutcome = "PublicationOutcomeUnknown"
+)
+
+// VerifyRequest performs a separate read-only observation of the target.
+type VerifyRequest struct {
+	PublicationID         string      `json:"publicationId"`
+	PublicationGeneration int64       `json:"publicationGeneration"`
+	OperationID           string      `json:"operationId"`
+	Target                Repository  `json:"target"`
+	TargetRef             string      `json:"targetRef"`
+	Claim                 BranchClaim `json:"claim"`
+	ExpectedCommitOID     string      `json:"expectedCommitOid"`
+	BundleDigest          string      `json:"bundleDigest"`
+}
+
+// VerificationReceipt is an immutable observation receipt.
+type VerificationReceipt struct {
+	PublicationID         string              `json:"publicationId"`
+	PublicationGeneration int64               `json:"publicationGeneration"`
+	OperationID           string              `json:"operationId"`
+	RequestDigest         string              `json:"requestDigest"`
+	Outcome               VerificationOutcome `json:"outcome"`
+	TargetRepositoryID    string              `json:"targetRepositoryId"`
+	TargetRef             string              `json:"targetRef"`
+	ExpectedCommitOID     string              `json:"expectedCommitOid"`
+	ObservedRemote        RemoteRef           `json:"observedRemote"`
+	DescendantProofDigest string              `json:"descendantProofDigest,omitempty"`
+}
+
+// PullRequestIntent is the complete immutable identity of one desired PR.
+type PullRequestIntent struct {
+	BaseRepository        Repository `json:"baseRepository"`
+	BaseRef               string     `json:"baseRef"`
+	HeadRepository        Repository `json:"headRepository"`
+	HeadRef               string     `json:"headRef"`
+	PublicationGeneration int64      `json:"publicationGeneration"`
+	ExpectedHeadOID       string     `json:"expectedHeadOid"`
+}
+
+// PullRequestState is the reconciled forge state.
+type PullRequestState string
+
+const (
+	PullRequestOpen   PullRequestState = "Open"
+	PullRequestClosed PullRequestState = "Closed"
+	PullRequestMerged PullRequestState = "Merged"
+)
+
+// PullRequestReceipt must bind to the exact intent tuple; same-branch matches
+// with a different tuple are never adopted.
+type PullRequestReceipt struct {
+	IntentKey string           `json:"intentKey"`
+	ForgeID   string           `json:"forgeId"`
+	URL       string           `json:"url"`
+	State     PullRequestState `json:"state"`
+	HeadOID   string           `json:"headOid"`
+}
+
+// PullRequestReconciler is implemented inside an SCM-capable clean-room
+// boundary. It must look up and reconcile by PullRequestIntent.Key, must not
+// adopt the first same-branch PR, and must not recreate a known closed or
+// merged PR without an explicit higher-level policy decision.
+type PullRequestReconciler interface {
+	Reconcile(ctx context.Context, intent PullRequestIntent) (PullRequestReceipt, error)
+}
diff --git a/internal/publisher/validation.go b/internal/publisher/validation.go
new file mode 100644
index 000000000..4da501390
--- /dev/null
+++ b/internal/publisher/validation.go
@@ -0,0 +1,192 @@
+package publisher
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"net/url"
+	"path"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"unicode/utf8"
+)
+
+const repositorySchemeFile = "file"
+
+var identifierPattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$`)
+var providerPattern = regexp.MustCompile(`^[a-z0-9][a-z0-9._-]{0,62}$`)
+
+func validateIdentifier(field, value string) error {
+	if !identifierPattern.MatchString(value) {
+		return invalid(field, "%q must match %s", value, identifierPattern.String())
+	}
+	return nil
+}
+
+func validateRepository(repository Repository) error {
+	if !providerPattern.MatchString(repository.Provider) {
+		return operationError(ErrInvalidRepository, "validate repository provider", "provider must be lower-case canonical ASCII", nil)
+	}
+	if repository.ID == "" || len(repository.ID) > 512 || strings.TrimSpace(repository.ID) != repository.ID ||
+		!utf8.ValidString(repository.ID) || hasControl(repository.ID) {
+		return operationError(ErrInvalidRepository, "validate repository ID", "repository ID is empty, non-canonical, or too long", nil)
+	}
+	canonical, err := canonicalRepositoryURL(repository.URL)
+	if err != nil {
+		return err
+	}
+	if repository.URL != canonical {
+		return operationError(ErrInvalidRepository, "validate repository URL", fmt.Sprintf("URL is not canonical; expected %q", canonical), nil)
+	}
+	return nil
+}
+
+func canonicalRepositoryURL(raw string) (string, error) {
+	if raw == "" || strings.TrimSpace(raw) != raw || !utf8.ValidString(raw) || hasControl(raw) {
+		return "", operationError(ErrInvalidRepository, "validate repository URL", "URL is empty or non-canonical", nil)
+	}
+	parsed, err := url.Parse(raw)
+	if err != nil || parsed.Scheme == "" {
+		return "", operationError(ErrInvalidRepository, "parse repository URL", "absolute file, https, or ssh URL required", err)
+	}
+	if parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" || parsed.Opaque != "" {
+		return "", operationError(ErrInvalidRepository, "validate repository URL", "credentials, opaque URLs, query strings, and fragments are forbidden", nil)
+	}
+	if parsed.RawPath != "" && parsed.EscapedPath() != parsed.Path {
+		return "", operationError(ErrInvalidRepository, "validate repository URL", "escaped path is not canonical", nil)
+	}
+	switch parsed.Scheme {
+	case repositorySchemeFile:
+		if parsed.Host != "" && parsed.Host != "localhost" {
+			return "", operationError(ErrInvalidRepository, "validate file repository URL", "file URL host must be empty", nil)
+		}
+		if !filepath.IsAbs(parsed.Path) {
+			return "", operationError(ErrInvalidRepository, "validate file repository URL", "file URL path must be absolute", nil)
+		}
+		cleaned := filepath.Clean(parsed.Path)
+		if cleaned != parsed.Path || cleaned == string(filepath.Separator) {
+			return "", operationError(ErrInvalidRepository, "validate file repository URL", "file URL path must be clean and non-root", nil)
+		}
+		return (&url.URL{Scheme: repositorySchemeFile, Path: filepath.ToSlash(cleaned)}).String(), nil
+	case "https", "ssh":
+		if parsed.Host == "" || parsed.Hostname() == "" {
+			return "", operationError(ErrInvalidRepository, "validate repository URL", "network URL host is required", nil)
+		}
+		if parsed.Path == "" || !strings.HasPrefix(parsed.Path, "/") || path.Clean(parsed.Path) != parsed.Path || parsed.Path == "/" {
+			return "", operationError(ErrInvalidRepository, "validate repository URL", "network URL path must be absolute, clean, and non-root", nil)
+		}
+		parsed.Scheme = strings.ToLower(parsed.Scheme)
+		parsed.Host = strings.ToLower(parsed.Host)
+		return parsed.String(), nil
+	default:
+		return "", operationError(ErrInvalidRepository, "validate repository URL", fmt.Sprintf("scheme %q would require an unreviewed remote helper", parsed.Scheme), nil)
+	}
+}
+
+func validateSourceRefBaseline(sourceRef, baselineOID string) error {
+	if validateObjectID("source ref", sourceRef) == nil && sourceRef != baselineOID {
+		return invalid("source ref", "exact source commit must equal the frozen baseline")
+	}
+	return nil
+}
+
+func validateSourceRef(ref string) error {
+	if validateObjectID("source ref", ref) == nil {
+		return nil
+	}
+	if strings.HasPrefix(ref, "refs/tags/") {
+		return validateTagRef(ref)
+	}
+	return validateBranchRef(ref)
+}
+
+func validateBranchRef(ref string) error {
+	return validateCanonicalRef(ref, "refs/heads/", "branch")
+}
+
+func validateTagRef(ref string) error {
+	return validateCanonicalRef(ref, "refs/tags/", "tag")
+}
+
+func validateCanonicalRef(ref, prefix, kind string) error {
+	if len(ref) <= len(prefix) || len(ref) > 1024 || !strings.HasPrefix(ref, prefix) ||
+		strings.TrimSpace(ref) != ref || !utf8.ValidString(ref) || hasControl(ref) || strings.Contains(ref, "\\") {
+		return operationError(ErrInvalidRef, "validate "+kind+" ref", fmt.Sprintf("%q is not a canonical full %s ref", ref, kind), nil)
+	}
+	short := strings.TrimPrefix(ref, prefix)
+	if strings.HasPrefix(short, "-") || strings.HasSuffix(short, "/") || strings.HasSuffix(short, ".") ||
+		strings.Contains(short, "..") || strings.Contains(short, "@{") || strings.Contains(short, "//") ||
+		strings.ContainsAny(short, " ~^:?*[") {
+		return operationError(ErrInvalidRef, "validate "+kind+" ref", fmt.Sprintf("%q contains a forbidden ref sequence", ref), nil)
+	}
+	for component := range strings.SplitSeq(short, "/") {
+		if component == "" || component == "." || component == ".." || component == "@" || strings.HasPrefix(component, ".") || strings.HasSuffix(component, ".lock") {
+			return operationError(ErrInvalidRef, "validate "+kind+" ref", fmt.Sprintf("%q contains a forbidden ref component", ref), nil)
+		}
+	}
+	return nil
+}
+
+func validateObjectID(field, oid string) error {
+	if len(oid) != 40 && len(oid) != 64 {
+		return operationError(ErrInvalidObjectID, "validate "+field, "object ID must contain 40 or 64 lower-case hexadecimal characters", nil)
+	}
+	if oid != strings.ToLower(oid) {
+		return operationError(ErrInvalidObjectID, "validate "+field, "object ID must be lower-case", nil)
+	}
+	if _, err := hex.DecodeString(oid); err != nil {
+		return operationError(ErrInvalidObjectID, "validate "+field, "object ID is not hexadecimal", err)
+	}
+	if strings.Trim(oid, "0") == "" {
+		return operationError(ErrInvalidObjectID, "validate "+field, "all-zero object ID must be represented as Absent", nil)
+	}
+	return nil
+}
+
+func validateRemoteRef(field string, state RemoteRef) error {
+	if state.Absent == (state.OID != "") {
+		return invalid(field, "must set exactly one of absent or oid")
+	}
+	if state.OID != "" {
+		return validateObjectID(field+" oid", state.OID)
+	}
+	return nil
+}
+
+func validateClaim(claim BranchClaim, repository Repository, ref string, expected RemoteRef, generation int64) error {
+	if claim.RepositoryID != repository.ID || claim.Ref != ref || claim.Generation != generation || !claim.LastVerified.Equal(expected) {
+		return operationError(ErrBranchClaimMismatch, "validate branch claim", "repository, ref, generation, or exact baseline differs", nil)
+	}
+	if claim.OwnerKind != "Task" && claim.OwnerKind != "Session" {
+		return invalid("branch claim owner kind", "%q is unsupported", claim.OwnerKind)
+	}
+	if err := validateIdentifier("branch claim owner UID", claim.OwnerUID); err != nil {
+		return err
+	}
+	return nil
+}
+
+func digestCanonical(value any) (string, error) {
+	encoded, err := json.Marshal(value)
+	if err != nil {
+		return "", fmt.Errorf("encode canonical digest input: %w", err)
+	}
+	sum := sha256.Sum256(encoded)
+	return DigestPrefix + hex.EncodeToString(sum[:]), nil
+}
+
+func digestBytes(value []byte) string {
+	sum := sha256.Sum256(value)
+	return DigestPrefix + hex.EncodeToString(sum[:])
+}
+
+func hasControl(value string) bool {
+	for _, current := range value {
+		if current < 0x20 || current == 0x7f {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/publisher/validation_test.go b/internal/publisher/validation_test.go
new file mode 100644
index 000000000..278cd0548
--- /dev/null
+++ b/internal/publisher/validation_test.go
@@ -0,0 +1,60 @@
+package publisher
+
+import (
+	"errors"
+	"strings"
+	"testing"
+)
+
+func TestValidateSourceRefAcceptsCanonicalObjectBranchAndTags(t *testing.T) {
+	t.Parallel()
+
+	for _, test := range []struct {
+		name string
+		ref  string
+	}{
+		{name: "sha1 object ID", ref: strings.Repeat("a", 40)},
+		{name: "sha256 object ID", ref: strings.Repeat("b", 64)},
+		{name: "branch", ref: "refs/heads/main"},
+		// Lightweight and annotated tags use the same canonical ref syntax. The
+		// service's Git resolver is responsible for peeling annotated tags.
+		{name: "lightweight tag", ref: "refs/tags/v1.2.3"},
+		{name: "annotated tag", ref: "refs/tags/releases/v2.0.0"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			if err := validateSourceRef(test.ref); err != nil {
+				t.Fatalf("validateSourceRef(%q) error = %v", test.ref, err)
+			}
+		})
+	}
+}
+
+func TestValidateSourceRefRejectsMalformedCanonicalTags(t *testing.T) {
+	t.Parallel()
+
+	for _, test := range []struct {
+		name string
+		ref  string
+	}{
+		{name: "empty", ref: "refs/tags/"},
+		{name: "leading dash", ref: "refs/tags/-release"},
+		{name: "trailing slash", ref: "refs/tags/release/"},
+		{name: "trailing dot", ref: "refs/tags/release."},
+		{name: "double dot", ref: "refs/tags/release..candidate"},
+		{name: "reflog selector", ref: "refs/tags/release@{candidate"},
+		{name: "double slash", ref: "refs/tags/release//candidate"},
+		{name: "forbidden character", ref: "refs/tags/release[candidate"},
+		{name: "hidden component", ref: "refs/tags/releases/.candidate"},
+		{name: "lock component", ref: "refs/tags/releases/candidate.lock"},
+		{name: "backslash", ref: `refs/tags/releases\candidate`},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			err := validateSourceRef(test.ref)
+			if !errors.Is(err, ErrInvalidRef) {
+				t.Fatalf("validateSourceRef(%q) error = %v, want ErrInvalidRef", test.ref, err)
+			}
+		})
+	}
+}
diff --git a/internal/publisher/verify.go b/internal/publisher/verify.go
new file mode 100644
index 000000000..8b85a28ba
--- /dev/null
+++ b/internal/publisher/verify.go
@@ -0,0 +1,194 @@
+package publisher
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+	"time"
+)
+
+func (p *Publisher) Verify(ctx context.Context, request VerifyRequest) (VerificationReceipt, error) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	prepared, err := p.validateVerifyRequest(request)
+	if err != nil {
+		return VerificationReceipt{}, err
+	}
+	requestDigest, err := verifyRequestDigest(request)
+	if err != nil {
+		return VerificationReceipt{}, err
+	}
+	receiptPath, err := p.operationPath(request.PublicationID, "verify", request.OperationID)
+	if err != nil {
+		return VerificationReceipt{}, err
+	}
+	var existing VerificationReceipt
+	if err := readCanonical(receiptPath, &existing); err == nil {
+		if existing.RequestDigest != requestDigest {
+			return VerificationReceipt{}, operationError(ErrIdempotencyConflict, "verify publication", "operation ID already has a different request digest", nil)
+		}
+		return existing, verificationReceiptError(existing)
+	} else if !os.IsNotExist(err) {
+		return VerificationReceipt{}, operationError(ErrPreparedArtifactCorrupt, "read verification receipt", "", err)
+	}
+	var lastError error
+	for attempt := 0; attempt < p.verifyAttempts; attempt++ {
+		if err := ctx.Err(); err != nil {
+			return VerificationReceipt{}, err
+		}
+		receipt, verifyErr := p.verifyOnce(ctx, request, prepared, requestDigest)
+		if verifyErr == nil {
+			if err := writeCanonicalDurable(receiptPath, receipt); err != nil {
+				return VerificationReceipt{}, fmt.Errorf("persist verification receipt: %w", err)
+			}
+			return receipt, verificationReceiptError(receipt)
+		}
+		lastError = verifyErr
+		if attempt+1 < p.verifyAttempts {
+			timer := time.NewTimer(p.verifyBackoff)
+			select {
+			case <-ctx.Done():
+				timer.Stop()
+				return VerificationReceipt{}, ctx.Err()
+			case <-timer.C:
+			}
+		}
+	}
+	receipt := VerificationReceipt{
+		PublicationID: request.PublicationID, PublicationGeneration: request.PublicationGeneration,
+		OperationID: request.OperationID, RequestDigest: requestDigest, Outcome: PublicationOutcomeUnknown,
+		TargetRepositoryID: request.Target.ID, TargetRef: request.TargetRef,
+		ExpectedCommitOID: request.ExpectedCommitOID,
+	}
+	if err := writeCanonicalDurable(receiptPath, receipt); err != nil {
+		return receipt, operationError(ErrVerificationUnknown, "persist unknown verification receipt", "", errors.Join(lastError, err))
+	}
+	return receipt, operationError(ErrVerificationUnknown, "verify remote publication", "bounded read-only observation failed", lastError)
+}
+
+func (p *Publisher) verifyOnce(ctx context.Context, request VerifyRequest, prepared PreparedPublication, requestDigest string) (VerificationReceipt, error) {
+	box, err := p.newSandbox("verify")
+	if err != nil {
+		return VerificationReceipt{}, err
+	}
+	defer box.Close() //nolint:errcheck
+	observed, err := p.observeRef(ctx, box, request.Target, request.TargetRef)
+	if err != nil {
+		return VerificationReceipt{}, err
+	}
+	receipt := VerificationReceipt{
+		PublicationID: request.PublicationID, PublicationGeneration: request.PublicationGeneration,
+		OperationID: request.OperationID, RequestDigest: requestDigest,
+		TargetRepositoryID: request.Target.ID, TargetRef: request.TargetRef,
+		ExpectedCommitOID: request.ExpectedCommitOID, ObservedRemote: observed,
+	}
+	if observed.Absent {
+		receipt.Outcome = DeliveryConflict
+		return receipt, nil
+	}
+	if observed.OID == request.ExpectedCommitOID {
+		receipt.Outcome = VerifiedExact
+		return receipt, nil
+	}
+	repositoryPath, err := p.importBundle(ctx, box, prepared)
+	if err != nil {
+		return VerificationReceipt{}, err
+	}
+	if err := p.fetchObserved(ctx, box, repositoryPath, request.Target, request.TargetRef, observed.OID); err != nil {
+		return VerificationReceipt{}, err
+	}
+	descendant, err := p.isAncestor(ctx, box, repositoryPath, request.ExpectedCommitOID, observed.OID)
+	if err != nil {
+		return VerificationReceipt{}, err
+	}
+	if !descendant {
+		receipt.Outcome = DeliveryConflict
+		return receipt, nil
+	}
+	proof, err := p.descendantProof(ctx, box, repositoryPath, request.ExpectedCommitOID, observed.OID)
+	if err != nil {
+		return VerificationReceipt{}, err
+	}
+	receipt.Outcome = DeliveredSuperseded
+	receipt.DescendantProofDigest = proof
+	return receipt, nil
+}
+
+func (p *Publisher) validateVerifyRequest(request VerifyRequest) (PreparedPublication, error) {
+	if err := validateIdentifier("publication ID", request.PublicationID); err != nil {
+		return PreparedPublication{}, err
+	}
+	if request.PublicationGeneration < 1 {
+		return PreparedPublication{}, invalid("publication generation", "must be at least 1")
+	}
+	if err := validateIdentifier("operation ID", request.OperationID); err != nil {
+		return PreparedPublication{}, err
+	}
+	if err := validateRepository(request.Target); err != nil {
+		return PreparedPublication{}, err
+	}
+	if err := validateBranchRef(request.TargetRef); err != nil {
+		return PreparedPublication{}, err
+	}
+	if err := validateObjectID("expected commit", request.ExpectedCommitOID); err != nil {
+		return PreparedPublication{}, err
+	}
+	if err := validateDigest("bundle digest", request.BundleDigest); err != nil {
+		return PreparedPublication{}, err
+	}
+	prepared, err := p.loadPrepared(request.PublicationID)
+	if err != nil {
+		return PreparedPublication{}, err
+	}
+	if prepared.PublicationGeneration != request.PublicationGeneration || prepared.Target != request.Target ||
+		prepared.TargetRef != request.TargetRef || prepared.CommitOID != request.ExpectedCommitOID || prepared.BundleDigest != request.BundleDigest {
+		return PreparedPublication{}, operationError(ErrIdempotencyConflict, "validate verify request", "request differs from durable prepared artifact", nil)
+	}
+	if err := validateClaim(request.Claim, request.Target, request.TargetRef, prepared.RemoteBefore, prepared.BranchClaimGeneration); err != nil {
+		return PreparedPublication{}, err
+	}
+	return prepared, nil
+}
+
+func verifyRequestDigest(request VerifyRequest) (string, error) {
+	return digestCanonical(struct {
+		Domain                string      `json:"domain"`
+		PublicationID         string      `json:"publicationId"`
+		PublicationGeneration int64       `json:"publicationGeneration"`
+		Target                Repository  `json:"target"`
+		TargetRef             string      `json:"targetRef"`
+		Claim                 BranchClaim `json:"claim"`
+		ExpectedCommitOID     string      `json:"expectedCommitOid"`
+		BundleDigest          string      `json:"bundleDigest"`
+	}{
+		Domain: "orka.publisher.verify.v1", PublicationID: request.PublicationID,
+		PublicationGeneration: request.PublicationGeneration, Target: request.Target, TargetRef: request.TargetRef,
+		Claim: request.Claim, ExpectedCommitOID: request.ExpectedCommitOID, BundleDigest: request.BundleDigest,
+	})
+}
+
+func (p *Publisher) descendantProof(ctx context.Context, box *sandbox, repositoryPath, expected, observed string) (string, error) {
+	result, err := p.runGit(ctx, box, box.root, nil, nil, "--git-dir="+repositoryPath, "rev-list", "--topo-order", "--reverse", expected+".."+observed)
+	if err != nil {
+		return "", err
+	}
+	commits := strings.Fields(result.stdout)
+	if len(commits) == 0 || commits[len(commits)-1] != observed {
+		return "", fmt.Errorf("descendant proof does not terminate at observed commit")
+	}
+	return digestCanonical(struct {
+		Domain   string   `json:"domain"`
+		Expected string   `json:"expected"`
+		Observed string   `json:"observed"`
+		Commits  []string `json:"commits"`
+	}{Domain: "orka.publisher.descendant-proof.v1", Expected: expected, Observed: observed, Commits: commits})
+}
+
+func verificationReceiptError(receipt VerificationReceipt) error {
+	if receipt.Outcome == PublicationOutcomeUnknown {
+		return ErrVerificationUnknown
+	}
+	return nil
+}
diff --git a/internal/safesymlink/symlink.go b/internal/safesymlink/symlink.go
new file mode 100644
index 000000000..0632e536c
--- /dev/null
+++ b/internal/safesymlink/symlink.go
@@ -0,0 +1,141 @@
+// Package safesymlink validates repository-relative symbolic-link graphs
+// without following links on the host filesystem.
+package safesymlink
+
+import (
+	"fmt"
+	"path"
+	"path/filepath"
+	"strings"
+	"unicode/utf8"
+)
+
+// Resolve validates one link and returns its canonical repository-relative
+// lexical target. The target may be dangling, but must not escape the root,
+// point to itself or an ancestor, or contain non-canonical bytes.
+func Resolve(linkPath, target string, maxPathBytes, maxTargetBytes int) (string, error) {
+	if maxPathBytes < 1 || maxTargetBytes < 1 {
+		return "", fmt.Errorf("safe symlink limits must be positive")
+	}
+	if err := validatePath(linkPath, maxPathBytes); err != nil {
+		return "", err
+	}
+	if target == "" || len(target) > maxTargetBytes || !utf8.ValidString(target) ||
+		strings.IndexByte(target, 0) >= 0 || strings.Contains(target, "\\") || hasControl(target) ||
+		path.IsAbs(target) || filepath.IsAbs(target) {
+		return "", fmt.Errorf("symlink %q has an unsafe target", linkPath)
+	}
+	resolved := path.Clean(path.Join(path.Dir(linkPath), target))
+	if resolved == "." || resolved == linkPath || strings.HasPrefix(linkPath, resolved+"/") ||
+		resolved == ".." || strings.HasPrefix(resolved, "../") || strings.HasPrefix(resolved, "/") {
+		return "", fmt.Errorf("symlink %q escapes or aliases an unsafe path", linkPath)
+	}
+	if err := validatePath(resolved, maxPathBytes); err != nil {
+		return "", fmt.Errorf("symlink %q target is unsafe: %w", linkPath, err)
+	}
+	return resolved, nil
+}
+
+// ValidateGraph validates all links against the complete archive/repository
+// path set. It rejects cycles and any non-directory archive entry nested below
+// a symlink path, preventing extraction through a link.
+func ValidateGraph(paths map[string]struct{}, links map[string]string, maxPathBytes, maxTargetBytes int) error {
+	resolutions := make(map[string]string, len(links))
+	for linkPath, target := range links {
+		if _, ok := paths[linkPath]; !ok {
+			return fmt.Errorf("symlink %q is absent from the path inventory", linkPath)
+		}
+		resolved, err := Resolve(linkPath, target, maxPathBytes, maxTargetBytes)
+		if err != nil {
+			return err
+		}
+		resolutions[linkPath] = resolved
+	}
+	if len(links) > 0 {
+		// An entry is nested below a link exactly when the bytes before one
+		// of its "/" separators equal a link path, so walking each entry's
+		// ancestors costs O(paths × depth) instead of O(links × paths).
+		for entryPath := range paths {
+			for index := range len(entryPath) {
+				if entryPath[index] != '/' {
+					continue
+				}
+				if _, ok := links[entryPath[:index]]; ok {
+					return fmt.Errorf("archive entry %q is nested below symlink %q", entryPath, entryPath[:index])
+				}
+			}
+		}
+	}
+	for linkPath, resolved := range resolutions {
+		if err := resolveGraph(linkPath, resolved, resolutions, maxPathBytes, map[string]struct{}{linkPath: {}}); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// maxSymlinkChainDepth mirrors the Linux SYMLOOP_MAX resolution bound: chains
+// nested deeper than this can never resolve at use time, and the cap keeps
+// graph validation linear in the number of links instead of quadratic.
+const maxSymlinkChainDepth = 40
+
+func resolveGraph(start, value string, resolutions map[string]string, maxPathBytes int, visiting map[string]struct{}) error {
+	prefix, remainder, found := firstLinkPrefix(value, resolutions)
+	if !found {
+		return nil
+	}
+	if _, cycle := visiting[prefix]; cycle {
+		return fmt.Errorf("symlink %q participates in a cycle", start)
+	}
+	if len(visiting) >= maxSymlinkChainDepth {
+		return fmt.Errorf("symlink %q chain exceeds the maximum resolution depth", start)
+	}
+	visiting[prefix] = struct{}{}
+	defer delete(visiting, prefix)
+
+	resolved := resolutions[prefix]
+	if remainder != "" {
+		resolved = path.Clean(path.Join(resolved, remainder))
+		if err := validatePath(resolved, maxPathBytes); err != nil {
+			return fmt.Errorf("symlink %q chain is unsafe: %w", start, err)
+		}
+	}
+	return resolveGraph(start, resolved, resolutions, maxPathBytes, visiting)
+}
+
+func firstLinkPrefix(value string, links map[string]string) (string, string, bool) {
+	components := strings.Split(value, "/")
+	for index := range components {
+		prefix := strings.Join(components[:index+1], "/")
+		if _, ok := links[prefix]; ok {
+			return prefix, strings.Join(components[index+1:], "/"), true
+		}
+	}
+	return "", "", false
+}
+
+func validatePath(value string, maxBytes int) error {
+	if value == "" || value == "." || len(value) > maxBytes || !utf8.ValidString(value) ||
+		strings.HasPrefix(value, "/") || strings.Contains(value, "\\") || strings.IndexByte(value, 0) >= 0 || hasControl(value) {
+		return fmt.Errorf("path %q is not canonical and repository-relative", value)
+	}
+	cleaned := path.Clean(value)
+	if cleaned != value || cleaned == ".." || strings.HasPrefix(cleaned, "../") {
+		return fmt.Errorf("path %q escapes the repository", value)
+	}
+	for component := range strings.SplitSeq(cleaned, "/") {
+		if component == "" || component == "." || component == ".." {
+			return fmt.Errorf("path %q contains an unsafe component", value)
+		}
+	}
+	return nil
+}
+
+func hasControl(value string) bool {
+	for _, current := range value {
+		if current < 0x20 || current == 0x7f {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/safesymlink/symlink_test.go b/internal/safesymlink/symlink_test.go
new file mode 100644
index 000000000..8394aaae6
--- /dev/null
+++ b/internal/safesymlink/symlink_test.go
@@ -0,0 +1,129 @@
+package safesymlink
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+)
+
+func TestValidateGraph(t *testing.T) {
+	t.Parallel()
+	paths := map[string]struct{}{
+		".agents/skills/readme": {},
+		".claude/skills/readme": {},
+	}
+	links := map[string]string{
+		".claude/skills/readme": "../../.agents/skills/readme",
+	}
+	if err := ValidateGraph(paths, links, 4096, 4096); err != nil {
+		t.Fatalf("safe graph rejected: %v", err)
+	}
+}
+
+func TestValidateGraphRejectsUnsafeLinks(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name  string
+		paths map[string]struct{}
+		links map[string]string
+	}{
+		{name: "absolute", paths: map[string]struct{}{"link": {}}, links: map[string]string{"link": "/etc/passwd"}},
+		{name: "escape", paths: map[string]struct{}{"dir/link": {}}, links: map[string]string{"dir/link": "../../outside"}},
+		{name: "cycle", paths: map[string]struct{}{"a": {}, "b": {}}, links: map[string]string{"a": "b", "b": "a"}},
+		{name: "chain cycle", paths: map[string]struct{}{"a": {}, "b": {}, "c": {}}, links: map[string]string{"a": "b", "b": "c", "c": "a"}},
+		{name: "nested entry", paths: map[string]struct{}{"link": {}, "link/file": {}}, links: map[string]string{"link": "target"}},
+		{name: "link below link", paths: map[string]struct{}{"a": {}, "a/b": {}}, links: map[string]string{"a": "target", "a/b": "other"}},
+		{name: "trailing separator entry", paths: map[string]struct{}{"link": {}, "link/": {}}, links: map[string]string{"link": "target"}},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if err := ValidateGraph(test.paths, test.links, 4096, 4096); err == nil {
+				t.Fatal("unsafe symlink graph was accepted")
+			}
+		})
+	}
+}
+
+func TestValidateGraphPrefixBoundaries(t *testing.T) {
+	t.Parallel()
+	paths := map[string]struct{}{
+		"a/b":    {},
+		"a/bc":   {},
+		"ab":     {},
+		"A/file": {},
+	}
+	links := map[string]string{"a/b": "c"}
+	if err := ValidateGraph(paths, links, 4096, 4096); err != nil {
+		t.Fatalf("entries sharing a link's byte prefix were rejected: %v", err)
+	}
+}
+
+func TestValidateGraphAcceptsDuplicateTargets(t *testing.T) {
+	t.Parallel()
+	paths := map[string]struct{}{"first": {}, "second": {}}
+	links := map[string]string{"first": "shared", "second": "shared"}
+	if err := ValidateGraph(paths, links, 4096, 4096); err != nil {
+		t.Fatalf("links sharing one resolved target were rejected: %v", err)
+	}
+}
+
+func TestValidateGraphAcceptsChainWithRemainder(t *testing.T) {
+	t.Parallel()
+	paths := map[string]struct{}{"chain": {}, "hop": {}}
+	links := map[string]string{"chain": "hop/tail", "hop": "real"}
+	if err := ValidateGraph(paths, links, 4096, 4096); err != nil {
+		t.Fatalf("safe chained graph rejected: %v", err)
+	}
+}
+
+func TestValidateGraphBoundsChainDepth(t *testing.T) {
+	t.Parallel()
+	buildChain := func(length int) (map[string]struct{}, map[string]string) {
+		paths := make(map[string]struct{}, length+1)
+		links := make(map[string]string, length)
+		for index := range length {
+			name := fmt.Sprintf("link-%04d", index)
+			next := fmt.Sprintf("link-%04d", index+1)
+			if index == length-1 {
+				next = "end"
+			}
+			paths[name] = struct{}{}
+			links[name] = next
+		}
+		paths["end"] = struct{}{}
+		return paths, links
+	}
+
+	paths, links := buildChain(maxSymlinkChainDepth - 1)
+	if err := ValidateGraph(paths, links, 4096, 4096); err != nil {
+		t.Fatalf("chain within the depth bound rejected: %v", err)
+	}
+
+	// Chains deeper than the kernel's resolution bound can never resolve at
+	// use time and would otherwise cost O(links x depth) validation work.
+	paths, links = buildChain(maxSymlinkChainDepth + 1)
+	err := ValidateGraph(paths, links, 4096, 4096)
+	if err == nil || !strings.Contains(err.Error(), "maximum resolution depth") {
+		t.Fatalf("over-deep chain error = %v, want maximum resolution depth rejection", err)
+	}
+}
+
+func BenchmarkValidateGraph(b *testing.B) {
+	paths := make(map[string]struct{}, 22000)
+	links := make(map[string]string, 2000)
+	for index := range 20000 {
+		paths[fmt.Sprintf("src/pkg%03d/file%05d.go", index%200, index)] = struct{}{}
+	}
+	for index := range 2000 {
+		linkPath := fmt.Sprintf("node_modules/mod%04d/link", index)
+		paths[linkPath] = struct{}{}
+		links[linkPath] = fmt.Sprintf("../../vendor/mod%04d", index)
+	}
+	b.ReportAllocs()
+
+	for b.Loop() {
+		if err := ValidateGraph(paths, links, 4096, 4096); err != nil {
+			b.Fatalf("ValidateGraph() error = %v", err)
+		}
+	}
+}
diff --git a/internal/security/context_builder.go b/internal/security/context_builder.go
index d9918406d..9f6d8356d 100644
--- a/internal/security/context_builder.go
+++ b/internal/security/context_builder.go
@@ -181,6 +181,7 @@ func BuildReviewContext(root string, slice store.ReviewSlice, opts ReviewContext
 	prompt.WriteString(finalDirective)
 	manifest.PromptBytes = prompt.Len()
 	manifest.ApproximateTokens = (manifest.PromptBytes + 3) / 4
+	manifest.Prompt = prompt.String()
 	return prompt.String(), manifest, nil
 }
 
diff --git a/internal/security/contracts.go b/internal/security/contracts.go
index 9d405c8f0..269d4f891 100644
--- a/internal/security/contracts.go
+++ b/internal/security/contracts.go
@@ -62,6 +62,7 @@ type ReviewContextManifest struct {
 	OmittedFiles      []ReviewContextOmittedFile  `json:"omittedFiles,omitempty"`
 	PromptBytes       int                         `json:"promptBytes"`
 	ApproximateTokens int                         `json:"approximateTokens"`
+	Prompt            string                      `json:"prompt,omitempty"`
 }
 
 type ReviewContextIncludedFile struct {
diff --git a/internal/security/results.go b/internal/security/results.go
new file mode 100644
index 000000000..606cd0ae8
--- /dev/null
+++ b/internal/security/results.go
@@ -0,0 +1,478 @@
+package security
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"strings"
+	"unicode/utf8"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+const (
+	AgentResultSchemaVersion = 1
+
+	AgentResultKindThreatModel = "orka.security.threat-model.v1"
+	AgentResultKindFindings    = "orka.security.findings.v1"
+	AgentResultKindValidation  = "orka.security.validation.v1"
+
+	maxThreatModelResultBytes = 1 << 20
+	maxFindingsResultBytes    = 512 << 10
+	maxValidationResultBytes  = 256 << 10
+	maxReviewContextBytes     = 256 << 10
+	maxThreatModelBytes       = 768 << 10
+	maxFindingTextBytes       = 64 << 10
+	maxFindingSummaryBytes    = 16 << 10
+	maxFindingEvidenceRefs    = 32
+	maxFindingsPerSlice       = 3
+	maxValidationListItems    = 64
+	maxValidationItemBytes    = 8 << 10
+	maxValidationEvidenceRefs = 32
+)
+
+// AgentResultBinding is controller-owned identity that every SecurityScan
+// agent result must echo exactly. It contains no credentials or mutable runtime
+// configuration.
+type AgentResultBinding struct {
+	RepositoryScan string
+	ScanID         string
+	PolicyDigest   string
+	ContextDigest  string
+}
+
+// ParseTrustedReviewContextManifest validates the mapper-owned context used as
+// an evidence boundary for a review Task.
+func ParseTrustedReviewContextManifest(data []byte) (*ReviewContextManifest, string, error) {
+	var manifest ReviewContextManifest
+	if err := decodeStrictResult(data, maxReviewContextBytes, &manifest); err != nil {
+		return nil, "", err
+	}
+	if manifest.SchemaVersion != SchemaVersionReviewContext {
+		return nil, "", fmt.Errorf("unsupported review context schemaVersion %d", manifest.SchemaVersion)
+	}
+	if strings.TrimSpace(manifest.SliceID) == "" {
+		return nil, "", fmt.Errorf("review context sliceId is required")
+	}
+	if manifest.Prompt == "" {
+		return nil, "", fmt.Errorf("review context prompt is required")
+	}
+	if len(manifest.Prompt) > defaultMaxReviewContextBytes || manifest.PromptBytes != len(manifest.Prompt) {
+		return nil, "", fmt.Errorf("review context prompt does not match bounded promptBytes")
+	}
+	if manifest.ApproximateTokens != (manifest.PromptBytes+3)/4 {
+		return nil, "", fmt.Errorf("review context approximateTokens does not match promptBytes")
+	}
+	if len(manifest.IncludedFiles) > defaultMaxReviewContextFiles {
+		return nil, "", fmt.Errorf("review context includes more than %d files", defaultMaxReviewContextFiles)
+	}
+	if len(manifest.ChangedFiles) > maxReviewContextChangedFiles || len(manifest.ChangedLineRanges) > maxReviewContextChangedLineRanges {
+		return nil, "", fmt.Errorf("review context changed-code metadata exceeds bounds")
+	}
+	if len(manifest.OmittedFiles) > 1024 {
+		return nil, "", fmt.Errorf("review context omitted file metadata exceeds bounds")
+	}
+	parsed, err := ParseReviewContextManifest(data)
+	if err != nil {
+		return nil, "", err
+	}
+	digest, err := ReviewContextDigest(*parsed)
+	if err != nil {
+		return nil, "", err
+	}
+	return parsed, digest, nil
+}
+
+// ThreatModelResultEnvelope is the only accepted terminal result for the
+// threat-model agent stage.
+type ThreatModelResultEnvelope struct {
+	SchemaVersion  int    `json:"schemaVersion"`
+	Kind           string `json:"kind"`
+	RepositoryScan string `json:"repositoryScan"`
+	ScanID         string `json:"scanId"`
+	PolicyDigest   string `json:"policyDigest"`
+	ThreatModel    string `json:"threatModel"`
+}
+
+// FindingsResultEnvelope is the only accepted terminal result for one review
+// slice. The context digest binds evidence to mapper-generated excerpts.
+type FindingsResultEnvelope struct {
+	SchemaVersion  int                `json:"schemaVersion"`
+	Kind           string             `json:"kind"`
+	RepositoryScan string             `json:"repositoryScan"`
+	ScanID         string             `json:"scanId"`
+	SliceID        string             `json:"sliceId"`
+	PolicyDigest   string             `json:"policyDigest"`
+	ContextDigest  string             `json:"contextDigest"`
+	Findings       FindingsV2Artifact `json:"findings"`
+}
+
+// ValidationResultEnvelope is the only accepted terminal result for the
+// per-finding validation stage.
+type ValidationResultEnvelope struct {
+	SchemaVersion  int                `json:"schemaVersion"`
+	Kind           string             `json:"kind"`
+	RepositoryScan string             `json:"repositoryScan"`
+	ScanID         string             `json:"scanId"`
+	FindingID      string             `json:"findingId"`
+	PolicyDigest   string             `json:"policyDigest"`
+	Validation     ValidationArtifact `json:"validation"`
+}
+
+type FindingsResultExpectation struct {
+	Binding    AgentResultBinding
+	SliceID    string
+	Mode       string
+	Repository FindingsV2Repository
+}
+
+type ValidationResultExpectation struct {
+	Binding AgentResultBinding
+	Finding *store.Finding
+}
+
+// ParseThreatModelResult strictly decodes and identity-binds a terminal ACP
+// result. Markdown is kept inside JSON so unrelated assistant prose cannot be
+// mistaken for scanner output.
+func ParseThreatModelResult(data []byte, expected AgentResultBinding) (string, error) {
+	var result ThreatModelResultEnvelope
+	if err := decodeStrictResult(data, maxThreatModelResultBytes, &result); err != nil {
+		return "", err
+	}
+	if result.SchemaVersion != AgentResultSchemaVersion {
+		return "", fmt.Errorf("unsupported security result schemaVersion %d", result.SchemaVersion)
+	}
+	if result.Kind != AgentResultKindThreatModel {
+		return "", fmt.Errorf("security result kind %q is not a threat model", result.Kind)
+	}
+	if err := validateAgentResultBinding(result.RepositoryScan, result.ScanID, result.PolicyDigest, "", expected); err != nil {
+		return "", err
+	}
+	content := strings.TrimSpace(result.ThreatModel)
+	if content == "" {
+		return "", fmt.Errorf("threatModel is required")
+	}
+	if len(content) > maxThreatModelBytes {
+		return "", fmt.Errorf("threatModel exceeds %d bytes", maxThreatModelBytes)
+	}
+	if !strings.HasPrefix(content, "#") {
+		return "", fmt.Errorf("threatModel must be markdown beginning with a heading")
+	}
+	if securityResultLooksLikeToolTranscript(content) {
+		return "", fmt.Errorf("threatModel looks like a tool transcript")
+	}
+	return content, nil
+}
+
+func securityResultLooksLikeToolTranscript(content string) bool {
+	for _, marker := range []string{
+		"<tool_call>",
+		"</tool_call>",
+		"<tool_name>",
+		"</tool_name>",
+		"<parameters>",
+		"</parameters>",
+		"<command>",
+		"</command>",
+	} {
+		if strings.Contains(content, marker) {
+			return true
+		}
+	}
+	return false
+}
+
+// ParseFindingsResult strictly decodes a terminal review result and requires
+// exact controller-owned repository, run, slice, policy, and context identity.
+func ParseFindingsResult(data []byte, expected FindingsResultExpectation) (*FindingsV2Artifact, error) {
+	var result FindingsResultEnvelope
+	if err := decodeStrictResult(data, maxFindingsResultBytes, &result); err != nil {
+		return nil, err
+	}
+	if result.SchemaVersion != AgentResultSchemaVersion {
+		return nil, fmt.Errorf("unsupported security result schemaVersion %d", result.SchemaVersion)
+	}
+	if result.Kind != AgentResultKindFindings {
+		return nil, fmt.Errorf("security result kind %q is not findings", result.Kind)
+	}
+	if err := validateAgentResultBinding(result.RepositoryScan, result.ScanID, result.PolicyDigest, result.ContextDigest, expected.Binding); err != nil {
+		return nil, err
+	}
+	if strings.TrimSpace(result.SliceID) != strings.TrimSpace(expected.SliceID) {
+		return nil, fmt.Errorf("security result sliceId does not match task slice")
+	}
+	if err := validateFindingsResultArtifact(result.Findings, expected); err != nil {
+		return nil, err
+	}
+	return &result.Findings, nil
+}
+
+// ParseValidationResult strictly decodes a terminal validation result and
+// restricts new evidence to the already accepted finding evidence boundary.
+func ParseValidationResult(data []byte, expected ValidationResultExpectation) (*ValidationArtifact, error) {
+	if expected.Finding == nil {
+		return nil, fmt.Errorf("expected finding is required")
+	}
+	var result ValidationResultEnvelope
+	if err := decodeStrictResult(data, maxValidationResultBytes, &result); err != nil {
+		return nil, err
+	}
+	if result.SchemaVersion != AgentResultSchemaVersion {
+		return nil, fmt.Errorf("unsupported security result schemaVersion %d", result.SchemaVersion)
+	}
+	if result.Kind != AgentResultKindValidation {
+		return nil, fmt.Errorf("security result kind %q is not validation", result.Kind)
+	}
+	if err := validateAgentResultBinding(result.RepositoryScan, result.ScanID, result.PolicyDigest, "", expected.Binding); err != nil {
+		return nil, err
+	}
+	findingID := strings.TrimSpace(expected.Finding.ID)
+	if strings.TrimSpace(result.FindingID) != findingID || strings.TrimSpace(result.Validation.FindingID) != findingID {
+		return nil, fmt.Errorf("security validation result findingId does not match task finding")
+	}
+	if err := validateValidationArtifact(result.Validation, expected.Finding); err != nil {
+		return nil, err
+	}
+	return &result.Validation, nil
+}
+
+func decodeStrictResult(data []byte, maxBytes int, target any) error {
+	if len(data) == 0 {
+		return fmt.Errorf("security task result is empty")
+	}
+	if len(data) > maxBytes {
+		return fmt.Errorf("security task result exceeds %d bytes", maxBytes)
+	}
+	if !utf8.Valid(data) {
+		return fmt.Errorf("security task result is not valid UTF-8")
+	}
+	decoder := json.NewDecoder(bytes.NewReader(data))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(target); err != nil {
+		return fmt.Errorf("decode security task result: %w", err)
+	}
+	var trailing any
+	if err := decoder.Decode(&trailing); !errorsIsEOF(err) {
+		if err == nil {
+			return fmt.Errorf("security task result contains trailing JSON")
+		}
+		return fmt.Errorf("decode trailing security task result: %w", err)
+	}
+	return nil
+}
+
+func errorsIsEOF(err error) bool {
+	return err == io.EOF
+}
+
+func validateAgentResultBinding(repositoryScan, scanID, policyDigest, contextDigest string, expected AgentResultBinding) error {
+	if strings.TrimSpace(repositoryScan) != strings.TrimSpace(expected.RepositoryScan) {
+		return fmt.Errorf("security result repositoryScan does not match task owner")
+	}
+	if strings.TrimSpace(scanID) != strings.TrimSpace(expected.ScanID) {
+		return fmt.Errorf("security result scanId does not match task run")
+	}
+	if strings.TrimSpace(policyDigest) != strings.TrimSpace(expected.PolicyDigest) {
+		return fmt.Errorf("security result policyDigest does not match scan policy")
+	}
+	if strings.TrimSpace(contextDigest) != strings.TrimSpace(expected.ContextDigest) {
+		return fmt.Errorf("security result contextDigest does not match mapper context")
+	}
+	return nil
+}
+
+func validateFindingsResultArtifact(artifact FindingsV2Artifact, expected FindingsResultExpectation) error {
+	if artifact.SchemaVersion != SchemaVersionFindingsV2 {
+		return fmt.Errorf("unsupported findings schemaVersion %d", artifact.SchemaVersion)
+	}
+	if artifact.Findings == nil {
+		return fmt.Errorf("findings must be an array")
+	}
+	if len(artifact.Findings) > maxFindingsPerSlice {
+		return fmt.Errorf("findings exceeds per-slice limit %d", maxFindingsPerSlice)
+	}
+	if artifact.Repository != expected.Repository {
+		return fmt.Errorf("findings repository identity does not match scan run")
+	}
+	if strings.TrimSpace(artifact.Scan.Mode) != strings.TrimSpace(expected.Mode) {
+		return fmt.Errorf("findings scan.mode does not match scan run")
+	}
+	if strings.TrimSpace(artifact.Scan.SliceID) != strings.TrimSpace(expected.SliceID) {
+		return fmt.Errorf("findings scan.sliceId does not match task slice")
+	}
+	if err := boundedString("findings scan.summary", artifact.Scan.Summary, maxFindingSummaryBytes); err != nil {
+		return err
+	}
+	for i := range artifact.Findings {
+		if err := validateBoundedFinding(i, artifact.Findings[i]); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validateBoundedFinding(index int, finding FindingsV2Finding) error {
+	fields := []struct {
+		name  string
+		value string
+		limit int
+	}{
+		{"title", finding.Title, maxFindingSummaryBytes},
+		{"category", finding.Category, maxFindingSummaryBytes},
+		{"severity", finding.Severity, 32},
+		{"confidence", finding.Confidence, 32},
+		{"triage", finding.Triage, maxFindingSummaryBytes},
+		{"summary", finding.Summary, maxFindingTextBytes},
+		{"rootCause", finding.RootCause, maxFindingTextBytes},
+		{"reproduction", finding.Reproduction, maxFindingTextBytes},
+		{"remediation", finding.Remediation, maxFindingTextBytes},
+		{"suggestedAction", finding.SuggestedAction, maxFindingTextBytes},
+		{"whyTestsDoNotAlreadyCoverThis", finding.WhyTestsDoNotAlreadyCoverThis, maxFindingTextBytes},
+		{"suggestedRegressionTest", finding.SuggestedRegressionTest, maxFindingTextBytes},
+		{"minimumFixScope", finding.MinimumFixScope, maxFindingTextBytes},
+	}
+	for _, field := range fields {
+		if err := boundedString(fmt.Sprintf("findings[%d].%s", index, field.name), field.value, field.limit); err != nil {
+			return err
+		}
+	}
+	if len(finding.Evidence) > maxFindingEvidenceRefs {
+		return fmt.Errorf("findings[%d].evidence exceeds %d entries", index, maxFindingEvidenceRefs)
+	}
+	for evidenceIndex, ref := range finding.Evidence {
+		if err := boundedString(fmt.Sprintf("findings[%d].evidence[%d].path", index, evidenceIndex), ref.Path, 4096); err != nil {
+			return err
+		}
+		if ref.Symbol != nil {
+			if err := boundedString(fmt.Sprintf("findings[%d].evidence[%d].symbol", index, evidenceIndex), *ref.Symbol, maxFindingSummaryBytes); err != nil {
+				return err
+			}
+		}
+		if ref.Quote != nil {
+			if err := boundedString(fmt.Sprintf("findings[%d].evidence[%d].quote", index, evidenceIndex), *ref.Quote, maxFindingTextBytes); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func validateValidationArtifact(artifact ValidationArtifact, finding *store.Finding) error {
+	if artifact.Version != 1 {
+		return fmt.Errorf("unsupported validation version %d", artifact.Version)
+	}
+	switch strings.TrimSpace(artifact.Status) {
+	case "validated", "failed", "skipped":
+	default:
+		return fmt.Errorf("unsupported validation status %q", artifact.Status)
+	}
+	if strings.TrimSpace(artifact.Summary) == "" {
+		return fmt.Errorf("validation summary is required")
+	}
+	for _, field := range []struct {
+		name  string
+		value string
+	}{
+		{"summary", artifact.Summary},
+		{"reproduction", artifact.Reproduction},
+		{"attack_path_analysis", artifact.AttackPathAnalysis},
+		{"likelihood", artifact.Likelihood},
+		{"impact", artifact.Impact},
+	} {
+		if err := boundedString("validation."+field.name, field.value, maxFindingTextBytes); err != nil {
+			return err
+		}
+	}
+	for name, values := range map[string][]string{
+		"validation_steps": artifact.ValidationSteps,
+		"assumptions":      artifact.Assumptions,
+		"controls":         artifact.Controls,
+		"blindspots":       artifact.Blindspots,
+	} {
+		if len(values) > maxValidationListItems {
+			return fmt.Errorf("validation.%s exceeds %d entries", name, maxValidationListItems)
+		}
+		for i, value := range values {
+			if err := boundedString(fmt.Sprintf("validation.%s[%d]", name, i), value, maxValidationItemBytes); err != nil {
+				return err
+			}
+		}
+	}
+	if len(artifact.Evidence) > maxValidationEvidenceRefs {
+		return fmt.Errorf("validation.evidence exceeds %d entries", maxValidationEvidenceRefs)
+	}
+	for i, ref := range artifact.Evidence {
+		if err := validateValidationEvidenceRef(i, ref, finding.Evidence); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validateValidationEvidenceRef(index int, ref store.FindingEvidenceRef, accepted []store.FindingEvidenceRef) error {
+	if strings.TrimSpace(ref.TaskName) != "" || strings.TrimSpace(ref.Name) != "" {
+		return fmt.Errorf("validation.evidence[%d] may not reference task artifacts", index)
+	}
+	switch strings.TrimSpace(ref.Kind) {
+	case "file":
+		if !SafeRepoPath(ref.Path) || ref.StartLine <= 0 || ref.EndLine < ref.StartLine {
+			return fmt.Errorf("validation.evidence[%d] has invalid file range", index)
+		}
+		if !validationEvidenceWithinAcceptedFinding(ref, accepted) {
+			return fmt.Errorf("validation.evidence[%d] is outside accepted finding evidence", index)
+		}
+	case "note":
+		if strings.TrimSpace(ref.Label) == "" {
+			return fmt.Errorf("validation.evidence[%d] note label is required", index)
+		}
+	default:
+		return fmt.Errorf("validation.evidence[%d] kind %q is not allowed", index, ref.Kind)
+	}
+	for name, value := range map[string]string{
+		"label":  ref.Label,
+		"path":   ref.Path,
+		"symbol": ref.Symbol,
+		"quote":  ref.Quote,
+	} {
+		if err := boundedString(fmt.Sprintf("validation.evidence[%d].%s", index, name), value, maxFindingTextBytes); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validationEvidenceWithinAcceptedFinding(ref store.FindingEvidenceRef, accepted []store.FindingEvidenceRef) bool {
+	for _, candidate := range accepted {
+		if candidate.Kind != "file" || candidate.Path != ref.Path {
+			continue
+		}
+		if ref.StartLine >= candidate.StartLine && ref.EndLine <= candidate.EndLine {
+			return true
+		}
+	}
+	return false
+}
+
+func boundedString(name, value string, maxBytes int) error {
+	if len(value) > maxBytes {
+		return fmt.Errorf("%s exceeds %d bytes", name, maxBytes)
+	}
+	if strings.ContainsRune(value, '\x00') || !utf8.ValidString(value) {
+		return fmt.Errorf("%s is not valid text", name)
+	}
+	return nil
+}
+
+// ReviewContextDigest returns the canonical digest used to bind a review Task
+// and its result to one mapper-generated context manifest.
+func ReviewContextDigest(manifest ReviewContextManifest) (string, error) {
+	data, err := json.Marshal(manifest)
+	if err != nil {
+		return "", err
+	}
+	sum := sha256.Sum256(data)
+	return "sha256:" + hex.EncodeToString(sum[:]), nil
+}
diff --git a/internal/security/results_test.go b/internal/security/results_test.go
new file mode 100644
index 000000000..24ab959f6
--- /dev/null
+++ b/internal/security/results_test.go
@@ -0,0 +1,221 @@
+package security
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+func TestParseThreatModelResultRequiresExactEnvelopeAndBinding(t *testing.T) {
+	expected := AgentResultBinding{
+		RepositoryScan: "vekil",
+		ScanID:         "scan_123",
+		PolicyDigest:   "sha256:policy",
+	}
+	result := ThreatModelResultEnvelope{
+		SchemaVersion:  AgentResultSchemaVersion,
+		Kind:           AgentResultKindThreatModel,
+		RepositoryScan: expected.RepositoryScan,
+		ScanID:         expected.ScanID,
+		PolicyDigest:   expected.PolicyDigest,
+		ThreatModel:    "# Threat Model\n\nTrusted boundaries.",
+	}
+	data := mustMarshalSecurityResult(t, result)
+	got, err := ParseThreatModelResult(data, expected)
+	if err != nil {
+		t.Fatalf("ParseThreatModelResult() error = %v", err)
+	}
+	if got != result.ThreatModel {
+		t.Fatalf("ParseThreatModelResult() = %q, want %q", got, result.ThreatModel)
+	}
+
+	result.ScanID = "scan_stale"
+	if _, err := ParseThreatModelResult(mustMarshalSecurityResult(t, result), expected); err == nil || !strings.Contains(err.Error(), "scanId") {
+		t.Fatalf("ParseThreatModelResult(stale) error = %v, want scan binding rejection", err)
+	}
+	if _, err := ParseThreatModelResult(append(data, []byte(` {}`)...), expected); err == nil || !strings.Contains(err.Error(), "trailing") {
+		t.Fatalf("ParseThreatModelResult(trailing) error = %v, want trailing JSON rejection", err)
+	}
+}
+
+func TestParseFindingsResultRequiresExactRepositoryAndContext(t *testing.T) {
+	repository := FindingsV2Repository{
+		RepoURL: "https://github.com/sozercan/vekil",
+		Branch:  "main",
+		HeadSHA: "0123456789abcdef",
+	}
+	expected := FindingsResultExpectation{
+		Binding: AgentResultBinding{
+			RepositoryScan: "vekil",
+			ScanID:         "scan_123",
+			PolicyDigest:   "sha256:policy",
+			ContextDigest:  "sha256:context",
+		},
+		SliceID:    "slice_api",
+		Mode:       "initial",
+		Repository: repository,
+	}
+	result := FindingsResultEnvelope{
+		SchemaVersion:  AgentResultSchemaVersion,
+		Kind:           AgentResultKindFindings,
+		RepositoryScan: expected.Binding.RepositoryScan,
+		ScanID:         expected.Binding.ScanID,
+		SliceID:        expected.SliceID,
+		PolicyDigest:   expected.Binding.PolicyDigest,
+		ContextDigest:  expected.Binding.ContextDigest,
+		Findings: FindingsV2Artifact{
+			SchemaVersion: SchemaVersionFindingsV2,
+			Repository:    repository,
+			Scan:          FindingsV2Scan{Mode: expected.Mode, SliceID: expected.SliceID, Summary: "reviewed"},
+			Findings: []FindingsV2Finding{{
+				Title:       "Authorization bypass",
+				Category:    "authz",
+				Severity:    "high",
+				Confidence:  "high",
+				Summary:     "A trusted boundary is bypassed.",
+				Remediation: "Enforce authorization.",
+				Evidence: []FindingsV2EvidenceRef{{
+					Path:      "internal/api/server.go",
+					StartLine: 10,
+					EndLine:   12,
+				}},
+			}},
+		},
+	}
+	if _, err := ParseFindingsResult(mustMarshalSecurityResult(t, result), expected); err != nil {
+		t.Fatalf("ParseFindingsResult() error = %v", err)
+	}
+
+	result.ContextDigest = "sha256:stale"
+	if _, err := ParseFindingsResult(mustMarshalSecurityResult(t, result), expected); err == nil || !strings.Contains(err.Error(), "contextDigest") {
+		t.Fatalf("ParseFindingsResult(stale context) error = %v, want context rejection", err)
+	}
+	result.ContextDigest = expected.Binding.ContextDigest
+	result.Findings.Repository.HeadSHA = "different"
+	if _, err := ParseFindingsResult(mustMarshalSecurityResult(t, result), expected); err == nil || !strings.Contains(err.Error(), "repository identity") {
+		t.Fatalf("ParseFindingsResult(repository mismatch) error = %v, want repository rejection", err)
+	}
+}
+
+func TestParseValidationResultRestrictsEvidenceToAcceptedFinding(t *testing.T) {
+	finding := &store.Finding{
+		ID: "fnd_123",
+		Evidence: []store.FindingEvidenceRef{{
+			Kind:      "file",
+			Path:      "internal/api/server.go",
+			StartLine: 10,
+			EndLine:   20,
+		}},
+	}
+	expected := ValidationResultExpectation{
+		Binding: AgentResultBinding{RepositoryScan: "vekil", ScanID: "scan_123", PolicyDigest: "sha256:policy"},
+		Finding: finding,
+	}
+	result := ValidationResultEnvelope{
+		SchemaVersion:  AgentResultSchemaVersion,
+		Kind:           AgentResultKindValidation,
+		RepositoryScan: expected.Binding.RepositoryScan,
+		ScanID:         expected.Binding.ScanID,
+		FindingID:      finding.ID,
+		PolicyDigest:   expected.Binding.PolicyDigest,
+		Validation: ValidationArtifact{
+			Version:   1,
+			FindingID: finding.ID,
+			Status:    "validated",
+			Summary:   "Confirmed.",
+			Evidence: ValidationArtifactEvidenceRefs{{
+				Kind:      "file",
+				Path:      "internal/api/server.go",
+				StartLine: 12,
+				EndLine:   15,
+			}},
+		},
+	}
+	if _, err := ParseValidationResult(mustMarshalSecurityResult(t, result), expected); err != nil {
+		t.Fatalf("ParseValidationResult() error = %v", err)
+	}
+
+	result.Validation.Evidence[0].StartLine = 1
+	if _, err := ParseValidationResult(mustMarshalSecurityResult(t, result), expected); err == nil || !strings.Contains(err.Error(), "outside accepted finding evidence") {
+		t.Fatalf("ParseValidationResult(out of range) error = %v, want evidence rejection", err)
+	}
+	result.Validation.Evidence[0] = store.FindingEvidenceRef{Kind: "artifact", Name: "transcript.txt"}
+	if _, err := ParseValidationResult(mustMarshalSecurityResult(t, result), expected); err == nil || !strings.Contains(err.Error(), "task artifacts") {
+		t.Fatalf("ParseValidationResult(artifact) error = %v, want artifact rejection", err)
+	}
+}
+
+func TestParseTrustedReviewContextManifestBindsExactPrompt(t *testing.T) {
+	root := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(root, "internal", "api"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "internal", "api", "server.go"), []byte("package api\n\nfunc Serve() {}\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	slice := store.ReviewSlice{
+		ID:         "slice_api",
+		Title:      "API",
+		Kind:       "package",
+		OwnedFiles: []store.ReviewSliceFile{{Path: "internal/api/server.go"}},
+	}
+	prompt, manifest, err := BuildReviewContext(root, slice, ReviewContextOptions{})
+	if err != nil {
+		t.Fatalf("BuildReviewContext() error = %v", err)
+	}
+	if manifest.Prompt != prompt {
+		t.Fatal("manifest prompt does not match generated prompt")
+	}
+	data := mustMarshalSecurityResult(t, manifest)
+	parsed, digest, err := ParseTrustedReviewContextManifest(data)
+	if err != nil {
+		t.Fatalf("ParseTrustedReviewContextManifest() error = %v", err)
+	}
+	if parsed.Prompt != prompt || !strings.HasPrefix(digest, "sha256:") {
+		t.Fatalf("trusted context prompt/digest = %q/%q", parsed.Prompt, digest)
+	}
+
+	manifest.PromptBytes++
+	if _, _, err := ParseTrustedReviewContextManifest(mustMarshalSecurityResult(t, manifest)); err == nil || !strings.Contains(err.Error(), "promptBytes") {
+		t.Fatalf("ParseTrustedReviewContextManifest(tampered) error = %v, want prompt binding rejection", err)
+	}
+}
+
+func TestHarnessV2SecurityPromptsRequireTerminalJSONWithoutArtifacts(t *testing.T) {
+	scan := &corev1alpha1.RepositoryScan{}
+	scan.Name = "vekil"
+	scan.Spec.RepoURL = "https://github.com/sozercan/vekil"
+	scan.Spec.Branch = "main"
+	binding := AgentResultBinding{RepositoryScan: scan.Name, ScanID: "scan_123", PolicyDigest: "sha256:policy", ContextDigest: "sha256:context"}
+	manifest := ReviewContextManifest{SchemaVersion: SchemaVersionReviewContext, SliceID: "slice_api", Prompt: "bounded context\n", PromptBytes: len("bounded context\n"), ApproximateTokens: 4}
+	slice := store.ReviewSlice{ID: "slice_api", Title: "API", Kind: "package"}
+	finding := &store.Finding{ID: "fnd_123", Title: "Finding", Severity: "high", Confidence: "high"}
+
+	prompts := []string{
+		BuildThreatModelResultPrompt(scan, "initial", "", "", "", binding),
+		BuildReviewResultPrompt(scan, "initial", "", "", "", slice, binding, manifest, FindingsV2Repository{RepoURL: scan.Spec.RepoURL, Branch: "main"}),
+		BuildValidationResultPrompt(scan, finding, binding),
+	}
+	for i, prompt := range prompts {
+		if !strings.Contains(prompt, "Return exactly one JSON object") {
+			t.Fatalf("prompt[%d] missing terminal JSON contract:\n%s", i, prompt)
+		}
+		if strings.Contains(prompt, "REQUIRED_SECURITY_ARTIFACTS") || strings.Contains(prompt, "Write these artifacts") {
+			t.Fatalf("prompt[%d] retained artifact contract:\n%s", i, prompt)
+		}
+	}
+}
+
+func mustMarshalSecurityResult(t *testing.T, value any) []byte {
+	t.Helper()
+	data, err := json.Marshal(value)
+	if err != nil {
+		t.Fatalf("json.Marshal() error = %v", err)
+	}
+	return data
+}
diff --git a/internal/security/security.go b/internal/security/security.go
index 49b7d5ea1..2daed886b 100644
--- a/internal/security/security.go
+++ b/internal/security/security.go
@@ -175,6 +175,21 @@ func ParseGitHubRepositoryURL(repoURL string) (owner string, repository string,
 	return githubOwnerRepoFromPath(parsed.Path)
 }
 
+// CanonicalRepositoryCloneURL returns the canonical credential-free HTTPS
+// clone URL for GitHub repository URLs accepted by ParseGitHubRepositoryURL,
+// converting SSH roots (git@github.com:owner/repo[.git]) and normalizing HTTPS
+// forms to https://github.com/owner/repo. This is the only repository form the
+// ACP workspace preflight and the general worker's header-credential clone
+// support. Non-GitHub URLs are returned trimmed and unchanged.
+func CanonicalRepositoryCloneURL(repoURL string) string {
+	trimmed := strings.TrimSpace(repoURL)
+	owner, repository, err := ParseGitHubRepositoryURL(trimmed)
+	if err != nil {
+		return trimmed
+	}
+	return "https://github.com/" + owner + "/" + repository
+}
+
 func githubOwnerRepoFromPath(repoPath string) (string, string, error) {
 	repoPath = strings.Trim(repoPath, "/")
 	segments := strings.Split(strings.TrimSuffix(repoPath, ".git"), "/")
@@ -263,6 +278,17 @@ func ScanStageTaskName(repositoryScanName, mode, stage, scope string) string {
 	return boundedTaskName(parts...)
 }
 
+// ScanStageRetryTaskName returns a deterministic task name for one bounded
+// retry of a specific stage within an existing scan run.
+func ScanStageRetryTaskName(repositoryScanName, scanRunID, stage, scope string, attempt int) string {
+	parts := []string{sanitizeName(repositoryScanName), sanitizeName(stage)}
+	if strings.TrimSpace(scope) != "" {
+		parts = append(parts, sanitizeName(scope))
+	}
+	parts = append(parts, sanitizeName(scanRunID), fmt.Sprintf("retry-%d", attempt))
+	return boundedTaskName(parts...)
+}
+
 // PatchTaskName returns a task name for a patch proposal.
 func PatchTaskName(repositoryScanName, findingID string) string {
 	return boundedTaskName(
@@ -444,6 +470,16 @@ func ArtifactWorkspacePath(subPath string) string {
 
 // BuildThreatModelPrompt returns the prompt for the threat-model-first stage of a scan run.
 func BuildThreatModelPrompt(scan *corev1alpha1.RepositoryScan, mode, baseCommit, headCommit, threatModel string, policies ...PromptPolicy) string {
+	return buildThreatModelPrompt(scan, mode, baseCommit, headCommit, threatModel, nil, policies...)
+}
+
+// BuildThreatModelResultPrompt returns the harness-v2 prompt whose only output
+// is a bounded, identity-bound terminal result.
+func BuildThreatModelResultPrompt(scan *corev1alpha1.RepositoryScan, mode, baseCommit, headCommit, threatModel string, binding AgentResultBinding, policies ...PromptPolicy) string {
+	return buildThreatModelPrompt(scan, mode, baseCommit, headCommit, threatModel, &binding, policies...)
+}
+
+func buildThreatModelPrompt(scan *corev1alpha1.RepositoryScan, mode, baseCommit, headCommit, threatModel string, resultBinding *AgentResultBinding, policies ...PromptPolicy) string {
 	var prompt strings.Builder
 	artifactDir := ArtifactWorkspacePath(scan.Spec.SubPath)
 	hasExistingThreatModel := strings.TrimSpace(threatModel) != ""
@@ -481,11 +517,28 @@ func BuildThreatModelPrompt(scan *corev1alpha1.RepositoryScan, mode, baseCommit,
 	if hasExistingThreatModel {
 		prompt.WriteString("- Treat the existing threat model as baseline context to refine and extend. Do not replace it with a shorter version unless the repository is genuinely tiny.\n")
 	}
-	fmt.Fprintf(&prompt, "\nWrite these artifacts under %s/:\n", artifactDir)
-	fmt.Fprintf(&prompt, "- %s/%s\n", artifactDir, ArtifactThreatModel)
-	appendRequiredArtifactsDirective(&prompt, ArtifactThreatModel)
-	prompt.WriteString("The stage will be treated as failed if the threat model artifact is missing or empty.\n")
-	prompt.WriteString("Prefer Bash heredocs or shell redirection when writing artifact files so they are persisted on disk.\n")
+	if resultBinding == nil {
+		fmt.Fprintf(&prompt, "\nWrite these artifacts under %s/:\n", artifactDir)
+		fmt.Fprintf(&prompt, "- %s/%s\n", artifactDir, ArtifactThreatModel)
+		appendRequiredArtifactsDirective(&prompt, ArtifactThreatModel)
+		prompt.WriteString("The stage will be treated as failed if the threat model artifact is missing or empty.\n")
+		prompt.WriteString("Prefer Bash heredocs or shell redirection when writing artifact files so they are persisted on disk.\n")
+	} else {
+		result := ThreatModelResultEnvelope{
+			SchemaVersion:  AgentResultSchemaVersion,
+			Kind:           AgentResultKindThreatModel,
+			RepositoryScan: resultBinding.RepositoryScan,
+			ScanID:         resultBinding.ScanID,
+			PolicyDigest:   resultBinding.PolicyDigest,
+			ThreatModel:    "# Threat Model\n\n...",
+		}
+		resultJSON, _ := json.Marshal(result)
+		prompt.WriteString("\nTERMINAL RESULT CONTRACT:\n")
+		prompt.WriteString("Do not write artifacts. Return exactly one JSON object and no markdown fence, commentary, or tool transcript.\n")
+		prompt.WriteString("Use this exact envelope and identity values; replace only threatModel with the complete markdown document:\n")
+		prompt.Write(resultJSON)
+		prompt.WriteString("\n")
+	}
 	if hasExistingThreatModel {
 		prompt.WriteString("\nExisting threat model context:\n")
 		prompt.WriteString(threatModel)
@@ -496,6 +549,32 @@ func BuildThreatModelPrompt(scan *corev1alpha1.RepositoryScan, mode, baseCommit,
 
 // BuildReviewPrompt returns the prompt for one deterministic review slice.
 func BuildReviewPrompt(scan *corev1alpha1.RepositoryScan, mode, baseCommit, headCommit, threatModel string, slice store.ReviewSlice, policies ...PromptPolicy) string {
+	return buildReviewPrompt(scan, mode, baseCommit, headCommit, threatModel, slice, nil, nil, FindingsV2Repository{}, policies...)
+}
+
+// BuildReviewResultPrompt returns the harness-v2 prompt with mapper-owned
+// bounded context and an identity-bound findings result contract.
+func BuildReviewResultPrompt(
+	scan *corev1alpha1.RepositoryScan,
+	mode, baseCommit, headCommit, threatModel string,
+	slice store.ReviewSlice,
+	binding AgentResultBinding,
+	manifest ReviewContextManifest,
+	repository FindingsV2Repository,
+	policies ...PromptPolicy,
+) string {
+	return buildReviewPrompt(scan, mode, baseCommit, headCommit, threatModel, slice, &binding, &manifest, repository, policies...)
+}
+
+func buildReviewPrompt(
+	scan *corev1alpha1.RepositoryScan,
+	mode, baseCommit, headCommit, threatModel string,
+	slice store.ReviewSlice,
+	resultBinding *AgentResultBinding,
+	trustedContext *ReviewContextManifest,
+	repository FindingsV2Repository,
+	policies ...PromptPolicy,
+) string {
 	var prompt strings.Builder
 	artifactDir := ArtifactWorkspacePath(scan.Spec.SubPath)
 	contextArtifact := ReviewContextArtifactName(slice.ID)
@@ -533,17 +612,49 @@ func BuildReviewPrompt(scan *corev1alpha1.RepositoryScan, mode, baseCommit, head
 	}
 	appendCustomPolicyPrompt(&prompt, firstPromptPolicy(policies))
 
-	fmt.Fprintf(&prompt, "\nWrite these artifacts under %s/:\n", artifactDir)
-	fmt.Fprintf(&prompt, "- %s/%s\n", artifactDir, ArtifactFindingsV2)
-	appendRequiredArtifactsDirective(&prompt, ArtifactFindingsV2)
-	prompt.WriteString("The stage will be treated as failed if the findings artifact is missing, empty, or invalid.\n")
-	prompt.WriteString("Prefer Bash heredocs or shell redirection when writing artifact files so they are persisted on disk.\n")
-
-	fmt.Fprintf(&prompt, "\nOrka generated and will upload %s before and after model execution.\n", contextArtifact)
-	prompt.WriteString("Do not create, edit, or replace the review context manifest. Findings that cite paths or line ranges outside the generated manifest will be dropped.\n")
-
-	prompt.WriteString("\nsecurity-findings.v2.json must be valid JSON with this top-level shape:\n")
-	prompt.WriteString(`{"schemaVersion":2,"repository":{"repoURL":"...","branch":"...","subPath":"...","baseSHA":"...","headSHA":"..."},"scan":{"mode":"initial|incremental|manual","sliceId":"...","summary":"..."},"findings":[]}` + "\n")
+	if resultBinding == nil {
+		fmt.Fprintf(&prompt, "\nWrite these artifacts under %s/:\n", artifactDir)
+		fmt.Fprintf(&prompt, "- %s/%s\n", artifactDir, ArtifactFindingsV2)
+		appendRequiredArtifactsDirective(&prompt, ArtifactFindingsV2)
+		prompt.WriteString("The stage will be treated as failed if the findings artifact is missing, empty, or invalid.\n")
+		prompt.WriteString("Prefer Bash heredocs or shell redirection when writing artifact files so they are persisted on disk.\n")
+
+		fmt.Fprintf(&prompt, "\nOrka generated and will upload %s before and after model execution.\n", contextArtifact)
+		prompt.WriteString("Do not create, edit, or replace the review context manifest. Findings that cite paths or line ranges outside the generated manifest will be dropped.\n")
+
+		prompt.WriteString("\nsecurity-findings.v2.json must be valid JSON with this top-level shape:\n")
+		prompt.WriteString(`{"schemaVersion":2,"repository":{"repoURL":"...","branch":"...","subPath":"...","baseSHA":"...","headSHA":"..."},"scan":{"mode":"initial|incremental|manual","sliceId":"...","summary":"..."},"findings":[]}` + "\n")
+	} else {
+		result := FindingsResultEnvelope{
+			SchemaVersion:  AgentResultSchemaVersion,
+			Kind:           AgentResultKindFindings,
+			RepositoryScan: resultBinding.RepositoryScan,
+			ScanID:         resultBinding.ScanID,
+			SliceID:        slice.ID,
+			PolicyDigest:   resultBinding.PolicyDigest,
+			ContextDigest:  resultBinding.ContextDigest,
+			Findings: FindingsV2Artifact{
+				SchemaVersion: SchemaVersionFindingsV2,
+				Repository:    repository,
+				Scan:          FindingsV2Scan{Mode: mode, SliceID: slice.ID, Summary: "..."},
+				Findings:      []FindingsV2Finding{},
+			},
+		}
+		resultJSON, _ := json.Marshal(result)
+		prompt.WriteString("\nTERMINAL RESULT CONTRACT:\n")
+		prompt.WriteString("Do not write artifacts or edit the workspace. Return exactly one JSON object and no markdown fence, commentary, or tool transcript.\n")
+		prompt.WriteString("Use this exact envelope, repository identity, and binding values. Populate findings.findings; keep it an empty array when no supported finding exists:\n")
+		prompt.Write(resultJSON)
+		prompt.WriteString("\n")
+		if trustedContext != nil {
+			prompt.WriteString("\nTRUSTED MAPPER-OWNED REVIEW CONTEXT:\n")
+			prompt.WriteString("The context below is the complete evidence boundary. Cite only its included paths and line ranges.\n")
+			prompt.WriteString(trustedContext.Prompt)
+			if !strings.HasSuffix(trustedContext.Prompt, "\n") {
+				prompt.WriteString("\n")
+			}
+		}
+	}
 	prompt.WriteString("Each finding object must use these keys: title, category, severity, confidence, triage, evidence, summary, rootCause, reproduction, remediation, suggestedAction, whyTestsDoNotAlreadyCoverThis, suggestedRegressionTest, minimumFixScope.\n")
 	prompt.WriteString("Use severity exactly one of: critical, high, medium, low. Use confidence exactly one of: high, medium, low.\n")
 	prompt.WriteString("Set scan.sliceId exactly to the slice ID above. Even when this slice has zero findings, write valid JSON with an empty findings array.\n")
@@ -561,6 +672,16 @@ func BuildReviewPrompt(scan *corev1alpha1.RepositoryScan, mode, baseCommit, head
 
 // BuildValidationPrompt returns the prompt for the dedicated validator/repro stage for a finding.
 func BuildValidationPrompt(scan *corev1alpha1.RepositoryScan, finding *store.Finding, policies ...PromptPolicy) string {
+	return buildValidationPrompt(scan, finding, nil, policies...)
+}
+
+// BuildValidationResultPrompt returns the harness-v2 validation prompt whose
+// terminal result is bound to the finding and scanner policy.
+func BuildValidationResultPrompt(scan *corev1alpha1.RepositoryScan, finding *store.Finding, binding AgentResultBinding, policies ...PromptPolicy) string {
+	return buildValidationPrompt(scan, finding, &binding, policies...)
+}
+
+func buildValidationPrompt(scan *corev1alpha1.RepositoryScan, finding *store.Finding, resultBinding *AgentResultBinding, policies ...PromptPolicy) string {
 	var prompt strings.Builder
 	artifactDir := ArtifactWorkspacePath(scan.Spec.SubPath)
 
@@ -593,13 +714,40 @@ func BuildValidationPrompt(scan *corev1alpha1.RepositoryScan, finding *store.Fin
 	prompt.WriteString("\n")
 	appendCustomPolicyPrompt(&prompt, firstPromptPolicy(policies))
 
-	fmt.Fprintf(&prompt, "\nWrite these artifacts under %s/:\n", artifactDir)
-	fmt.Fprintf(&prompt, "- %s/%s\n", artifactDir, ArtifactValidation)
-	fmt.Fprintf(&prompt, "- %s/%s (optional but strongly preferred)\n", artifactDir, ArtifactValidationText)
-	appendRequiredArtifactsDirective(&prompt, ArtifactValidation)
-	prompt.WriteString("Prefer Bash heredocs or shell redirection when writing artifact files so they are persisted on disk.\n")
-	prompt.WriteString("security-validation.json must be valid JSON with this shape:\n")
-	prompt.WriteString(`{"version":1,"finding_id":"fnd_...","status":"validated|failed|skipped","summary":"...","validation_steps":["..."],"reproduction":"...","attack_path_analysis":"...","likelihood":"...","impact":"...","assumptions":["..."],"controls":["..."],"blindspots":["..."],"evidence":[]}` + "\n")
+	if resultBinding == nil {
+		fmt.Fprintf(&prompt, "\nWrite these artifacts under %s/:\n", artifactDir)
+		fmt.Fprintf(&prompt, "- %s/%s\n", artifactDir, ArtifactValidation)
+		fmt.Fprintf(&prompt, "- %s/%s (optional but strongly preferred)\n", artifactDir, ArtifactValidationText)
+		appendRequiredArtifactsDirective(&prompt, ArtifactValidation)
+		prompt.WriteString("Prefer Bash heredocs or shell redirection when writing artifact files so they are persisted on disk.\n")
+		prompt.WriteString("security-validation.json must be valid JSON with this shape:\n")
+		prompt.WriteString(`{"version":1,"finding_id":"fnd_...","status":"validated|failed|skipped","summary":"...","validation_steps":["..."],"reproduction":"...","attack_path_analysis":"...","likelihood":"...","impact":"...","assumptions":["..."],"controls":["..."],"blindspots":["..."],"evidence":[]}` + "\n")
+	} else {
+		result := ValidationResultEnvelope{
+			SchemaVersion:  AgentResultSchemaVersion,
+			Kind:           AgentResultKindValidation,
+			RepositoryScan: resultBinding.RepositoryScan,
+			ScanID:         resultBinding.ScanID,
+			FindingID:      finding.ID,
+			PolicyDigest:   resultBinding.PolicyDigest,
+			Validation: ValidationArtifact{
+				Version:   1,
+				FindingID: finding.ID,
+				Status:    "validated",
+				Summary:   "...",
+			},
+		}
+		resultJSON, _ := json.Marshal(result)
+		prompt.WriteString("\nTERMINAL RESULT CONTRACT:\n")
+		prompt.WriteString("Do not write artifacts or edit the workspace. Return exactly one JSON object and no markdown fence, commentary, or tool transcript.\n")
+		prompt.WriteString("Use this exact envelope and binding values. Complete validation and use only file ranges already present in the accepted finding evidence boundary:\n")
+		prompt.Write(resultJSON)
+		prompt.WriteString("\n")
+		evidenceJSON, _ := json.Marshal(finding.Evidence)
+		prompt.WriteString("Accepted finding evidence boundary:\n")
+		prompt.Write(evidenceJSON)
+		prompt.WriteString("\n")
+	}
 	prompt.WriteString("Use status=validated when the code path and validation strongly support the issue.\n")
 	prompt.WriteString("Use status=failed when the original claim does not hold after review or reproduction attempts.\n")
 	prompt.WriteString("Use status=skipped when the environment or safety constraints prevent meaningful validation.\n")
diff --git a/internal/security/security_test.go b/internal/security/security_test.go
index c3ef90e62..f95b248ec 100644
--- a/internal/security/security_test.go
+++ b/internal/security/security_test.go
@@ -104,6 +104,58 @@ func TestParseGitHubRepositoryURL(t *testing.T) {
 	}
 }
 
+func TestCanonicalRepositoryCloneURL(t *testing.T) {
+	tests := []struct {
+		name    string
+		repoURL string
+		want    string
+	}{
+		{
+			name:    "SSH GitHub root converted to HTTPS",
+			repoURL: "git@github.com:example/project.git",
+			want:    "https://github.com/example/project",
+		},
+		{
+			name:    "SSH GitHub root without git suffix",
+			repoURL: "git@github.com:example/project",
+			want:    "https://github.com/example/project",
+		},
+		{
+			name:    "HTTPS GitHub URL normalized",
+			repoURL: " https://github.com/example/project.git ",
+			want:    "https://github.com/example/project",
+		},
+		{
+			name:    "canonical HTTPS GitHub URL unchanged",
+			repoURL: "https://github.com/example/project",
+			want:    "https://github.com/example/project",
+		},
+		{
+			name:    "non-GitHub HTTPS URL passes through",
+			repoURL: "https://git.example.com/example/project.git",
+			want:    "https://git.example.com/example/project.git",
+		},
+		{
+			name:    "credentialed URL passes through for downstream rejection",
+			repoURL: "https://token@github.com/example/project",
+			want:    "https://token@github.com/example/project",
+		},
+		{
+			name:    "empty URL stays empty",
+			repoURL: "  ",
+			want:    "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := CanonicalRepositoryCloneURL(tt.repoURL); got != tt.want {
+				t.Fatalf("CanonicalRepositoryCloneURL(%q) = %q, want %q", tt.repoURL, got, tt.want)
+			}
+		})
+	}
+}
+
 func TestEffectiveWorkspaceBranch(t *testing.T) {
 	tests := []struct {
 		name string
@@ -376,6 +428,7 @@ func TestGeneratedSecurityTaskNamesStayLabelSafe(t *testing.T) {
 		ScanStageTaskName(scanName, "initial", "threat-model", ""),
 		ScanStageTaskName(scanName, "initial", "discovery", "ci-cd-supply-chain"),
 		ScanStageTaskName(scanName, "initial", "discovery", "ci-cd-supply-chain-4"),
+		ScanStageRetryTaskName(scanName, "scan_1234567890abcdef", StageReview, "ci-cd-supply-chain", 1),
 		PatchTaskName(scanName, "fnd_1234567890abcdef"),
 	}
 
@@ -389,6 +442,22 @@ func TestGeneratedSecurityTaskNamesStayLabelSafe(t *testing.T) {
 	}
 }
 
+func TestScanStageRetryTaskNameIsDeterministicAndAttemptBound(t *testing.T) {
+	first := ScanStageRetryTaskName("demo-security-repository", "scan_1234567890abcdef", StageReview, "slice_api", 1)
+	repeated := ScanStageRetryTaskName("demo-security-repository", "scan_1234567890abcdef", StageReview, "slice_api", 1)
+	secondAttempt := ScanStageRetryTaskName("demo-security-repository", "scan_1234567890abcdef", StageReview, "slice_api", 2)
+
+	if first != repeated {
+		t.Fatalf("ScanStageRetryTaskName() = %q then %q, want deterministic", first, repeated)
+	}
+	if first == secondAttempt {
+		t.Fatalf("ScanStageRetryTaskName() = %q for attempts 1 and 2, want attempt-bound names", first)
+	}
+	if len(first) > maxGeneratedTaskName || len(secondAttempt) > maxGeneratedTaskName {
+		t.Fatalf("retry task names lengths = %d/%d, want <= %d", len(first), len(secondAttempt), maxGeneratedTaskName)
+	}
+}
+
 func TestPatchBranchUsesUniqueTaskHash(t *testing.T) {
 	branchA := PatchBranch("fnd_1234567890abcdef", "demo-security-repository-patch-a")
 	branchB := PatchBranch("fnd_1234567890abcdef", "demo-security-repository-patch-b")
diff --git a/internal/store/agent_execution_types.go b/internal/store/agent_execution_types.go
new file mode 100644
index 000000000..35df8cdcb
--- /dev/null
+++ b/internal/store/agent_execution_types.go
@@ -0,0 +1,509 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package store
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"slices"
+	"strings"
+	"time"
+)
+
+// AgentExecutionSnapshotSchemaVersion is the current immutable execution
+// snapshot schema version.
+const AgentExecutionSnapshotSchemaVersion int32 = 1
+
+// AgentExecutionSnapshotKey identifies one immutable, content-addressed
+// execution snapshot.
+type AgentExecutionSnapshotKey struct {
+	TaskUID string
+	// Digest is the canonical sha256 digest of the plaintext snapshot body.
+	Digest string
+}
+
+// ID returns the canonical snapshot identity <task-uid>/sha256:<digest>.
+func (k AgentExecutionSnapshotKey) ID() string {
+	return k.TaskUID + "/" + k.Digest
+}
+
+// Validate rejects incomplete snapshot keys.
+func (k AgentExecutionSnapshotKey) Validate() error {
+	if strings.TrimSpace(k.TaskUID) == "" {
+		return ValidationErrorf("snapshot task UID is required")
+	}
+	if err := ValidateCanonicalDigest("snapshot digest", k.Digest); err != nil {
+		return err
+	}
+	return nil
+}
+
+// AgentExecutionSnapshot is the immutable non-secret executable input record
+// for one Task binding. The body is sensitive (resolved prompts, Skill
+// content, repository identities, endpoint metadata, policy configuration)
+// even though raw credentials and TxTokens are prohibited; it is encrypted at
+// rest and must never enter logs, events, metrics, or ordinary API output.
+type AgentExecutionSnapshot struct {
+	TaskUID       string
+	Digest        string
+	SchemaVersion int32
+	// Body is the canonical JSON plaintext. Digest must equal
+	// CanonicalAgentExecutionSnapshotDigest(Body).
+	Body      []byte
+	CreatedAt time.Time
+}
+
+// CanonicalAgentExecutionSnapshotDigest returns the canonical digest of a
+// plaintext snapshot body.
+func CanonicalAgentExecutionSnapshotDigest(body []byte) string {
+	sum := sha256.Sum256(body)
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
+
+// AgentExecutionSnapshotStore persists immutable execution snapshots.
+// Implementations must encrypt snapshot bodies at rest and fail closed when no
+// encryption key is configured.
+type AgentExecutionSnapshotStore interface {
+	// PersistAgentExecutionSnapshot idempotently stores an immutable snapshot
+	// keyed by Task UID and digest. An existing identical snapshot succeeds; an
+	// existing snapshot with the same key but different content returns
+	// ErrDuplicateMismatch. The snapshot digest must match the body.
+	PersistAgentExecutionSnapshot(ctx context.Context, snapshot AgentExecutionSnapshot) error
+
+	// GetAgentExecutionSnapshot decrypts and returns one snapshot, verifying
+	// body integrity against the stored digest.
+	GetAgentExecutionSnapshot(ctx context.Context, key AgentExecutionSnapshotKey) (*AgentExecutionSnapshot, error)
+
+	// ListAgentExecutionSnapshotKeys returns every stored snapshot key for a
+	// Task UID, for retention checks and inventory.
+	ListAgentExecutionSnapshotKeys(ctx context.Context, taskUID string) ([]AgentExecutionSnapshotKey, error)
+
+	// DeleteAgentExecutionSnapshots removes every snapshot for a Task UID. The
+	// caller is responsible for proving all binding, attempt, lineage,
+	// finalizer, and retention references are released first.
+	DeleteAgentExecutionSnapshots(ctx context.Context, taskUID string) error
+}
+
+// AgentExecutionSnapshotMetadata is the non-secret lifecycle view of one
+// encrypted snapshot. It intentionally excludes the nonce and ciphertext as
+// well as the decrypted body.
+type AgentExecutionSnapshotMetadata struct {
+	Key           AgentExecutionSnapshotKey
+	SchemaVersion int32
+	CreatedAt     time.Time
+}
+
+// Validate rejects corrupt lifecycle metadata before retention code acts on
+// it. Stored snapshot keys remain integrity references, not authorization.
+func (m AgentExecutionSnapshotMetadata) Validate() error {
+	if err := m.Key.Validate(); err != nil {
+		return err
+	}
+	if m.SchemaVersion < 1 {
+		return ValidationErrorf("snapshot metadata schema version must be positive")
+	}
+	if m.CreatedAt.IsZero() {
+		return ValidationErrorf("snapshot metadata creation time is required")
+	}
+	return nil
+}
+
+// AgentExecutionSnapshotReferenceCounts reports every durable SQLite
+// reference that can retain a snapshot. SessionTurns retain every snapshot
+// scoped to their immutable Task UID because they do not store a snapshot
+// digest themselves.
+type AgentExecutionSnapshotReferenceCounts struct {
+	HarnessV1Attempts int64
+	PromptAttempts    int64
+	SessionTurns      int64
+}
+
+// Total returns the number of durable references across all known sources.
+func (c AgentExecutionSnapshotReferenceCounts) Total() int64 {
+	return c.HarnessV1Attempts + c.PromptAttempts + c.SessionTurns
+}
+
+// AgentExecutionSnapshotLifecycleStore is an optional retention/GC extension
+// to AgentExecutionSnapshotStore. It exposes metadata only, reports durable
+// references, and deletes one exact key without changing the existing broad
+// Task-UID deletion contract.
+type AgentExecutionSnapshotLifecycleStore interface {
+	// ListAgentExecutionSnapshotMetadataBefore returns snapshots created
+	// strictly before cutoff, ordered by creation time, Task UID, and digest.
+	ListAgentExecutionSnapshotMetadataBefore(ctx context.Context, cutoff time.Time) ([]AgentExecutionSnapshotMetadata, error)
+
+	// CountAgentExecutionSnapshotReferences returns a consistent count across
+	// v1 attempts, v2 prompt attempts, and SessionTurns. Attempt sources match
+	// Task UID and digest; SessionTurns match the immutable Task UID because they
+	// do not carry a snapshot digest.
+	CountAgentExecutionSnapshotReferences(ctx context.Context, key AgentExecutionSnapshotKey) (AgentExecutionSnapshotReferenceCounts, error)
+
+	// DeleteAgentExecutionSnapshot idempotently deletes one exact Task
+	// UID/digest key. The caller must first prove that all references and the
+	// configured retention interval have cleared.
+	DeleteAgentExecutionSnapshot(ctx context.Context, key AgentExecutionSnapshotKey) error
+}
+
+// SessionLineage durably records the execution protocol and runtime identity
+// of one conversation Session. LineageGeneration is independent of the Session
+// mutation-lease generation and any v2 RuntimeSession generation.
+type SessionLineage struct {
+	Namespace    string
+	SessionName  string
+	NamespaceUID string
+	SessionUID   string
+	// ContractVersion is orka.harness.v1 or orka.harness.v2.
+	ContractVersion   string
+	LineageGeneration int64
+	// RuntimeIdentity is the built-in runtime type or the AgentRuntime UID.
+	RuntimeIdentity string
+	// ConfigDigest is the configuration/snapshot digest recorded when the
+	// lineage was established.
+	ConfigDigest string
+	Version      int64
+	CreatedAt    time.Time
+	UpdatedAt    time.Time
+}
+
+// Validate rejects an incomplete authoritative Session lineage.
+func (l SessionLineage) Validate() error {
+	claim := ClaimSessionLineageRequest{
+		Namespace: l.Namespace, SessionName: l.SessionName, NamespaceUID: l.NamespaceUID,
+		SessionUID: l.SessionUID, ContractVersion: l.ContractVersion,
+		LineageGeneration: l.LineageGeneration, RuntimeIdentity: l.RuntimeIdentity, ConfigDigest: l.ConfigDigest,
+	}
+	if err := claim.Validate(); err != nil {
+		return err
+	}
+	if l.LineageGeneration < 1 {
+		return ValidationErrorf("session lineage generation must be at least 1")
+	}
+	if l.Version < 1 {
+		return ValidationErrorf("session lineage projection version must be at least 1")
+	}
+	if l.CreatedAt.IsZero() || l.UpdatedAt.IsZero() {
+		return ValidationErrorf("session lineage creation and update times are required")
+	}
+	return nil
+}
+
+// ClaimSessionLineageRequest atomically establishes or verifies a Session
+// lineage. Callers must invoke it under the same serialization that acquires
+// the Session mutation lease so two concurrent first-use Tasks cannot
+// establish different protocols.
+type ClaimSessionLineageRequest struct {
+	Namespace       string
+	SessionName     string
+	NamespaceUID    string
+	SessionUID      string
+	ContractVersion string
+	// LineageGeneration is independent of mutation-lease and runtime-session
+	// generations. Ordinary first use establishes generation 1.
+	LineageGeneration int64
+	RuntimeIdentity   string
+	ConfigDigest      string
+
+	// EstablishIfAbsent permits creating the lineage row. It must be true only
+	// when the caller has proven the Session is genuinely fresh: a non-empty
+	// pre-existing Session is never silently treated as unclaimed.
+	EstablishIfAbsent bool
+}
+
+// Validate rejects incomplete lineage claims.
+func (r ClaimSessionLineageRequest) Validate() error {
+	switch {
+	case strings.TrimSpace(r.Namespace) == "":
+		return ValidationErrorf("session lineage namespace is required")
+	case strings.TrimSpace(r.SessionName) == "":
+		return ValidationErrorf("session lineage session name is required")
+	case strings.TrimSpace(r.NamespaceUID) == "":
+		return ValidationErrorf("session lineage namespace UID is required")
+	case strings.TrimSpace(r.SessionUID) == "":
+		return ValidationErrorf("session lineage session UID is required")
+	case r.ContractVersion != "orka.harness.v1" && r.ContractVersion != "orka.harness.v2":
+		return ValidationErrorf("session lineage contract version %q must be orka.harness.v1 or orka.harness.v2", r.ContractVersion)
+	case r.LineageGeneration < 1:
+		return ValidationErrorf("session lineage generation must be at least 1")
+	case strings.TrimSpace(r.RuntimeIdentity) == "":
+		return ValidationErrorf("session lineage runtime identity is required")
+	}
+	if err := ValidateCanonicalDigest("session lineage config digest", r.ConfigDigest); err != nil {
+		return err
+	}
+	return nil
+}
+
+// SessionLineageStore persists a payload projection of Kubernetes-authoritative
+// Session protocol/runtime lineage. Projection failure may block dispatch but
+// never changes or releases the Kubernetes lineage/Lease authority.
+type SessionLineageStore interface {
+	// ProjectSessionLineage idempotently stores the exact authoritative record.
+	// Any mismatch returns ErrConflict and must be repaired explicitly; SQLite
+	// never adjudicates which lineage owns a Session.
+	ProjectSessionLineage(ctx context.Context, lineage SessionLineage) (*SessionLineage, error)
+
+	// GetSessionLineage returns the lineage for one Session, or ErrNotFound.
+	GetSessionLineage(ctx context.Context, namespace, sessionName string) (*SessionLineage, error)
+
+	// DeleteSessionLineage removes the lineage during Session cleanup.
+	DeleteSessionLineage(ctx context.Context, namespace, sessionName string) error
+}
+
+// HarnessV1AttemptState is the durable harness v1 attempt state machine.
+type HarnessV1AttemptState string
+
+const (
+	HarnessV1AttemptPrepared         HarnessV1AttemptState = "Prepared"
+	HarnessV1AttemptSubmitting       HarnessV1AttemptState = "Submitting"
+	HarnessV1AttemptRejected         HarnessV1AttemptState = "Rejected"
+	HarnessV1AttemptSubmittedUnknown HarnessV1AttemptState = "SubmittedUnknown"
+	HarnessV1AttemptAccepted         HarnessV1AttemptState = "Accepted"
+	HarnessV1AttemptRunning          HarnessV1AttemptState = "Running"
+	HarnessV1AttemptCancelRequested  HarnessV1AttemptState = "CancelRequested"
+	HarnessV1AttemptSettling         HarnessV1AttemptState = "Settling"
+	HarnessV1AttemptSucceeded        HarnessV1AttemptState = "Succeeded"
+	HarnessV1AttemptFailed           HarnessV1AttemptState = "Failed"
+	HarnessV1AttemptCancelled        HarnessV1AttemptState = "Cancelled"
+	HarnessV1AttemptOutcomeUnknown   HarnessV1AttemptState = "OutcomeUnknown"
+)
+
+var harnessV1AttemptTransitions = map[HarnessV1AttemptState][]HarnessV1AttemptState{
+	HarnessV1AttemptPrepared:   {HarnessV1AttemptSubmitting, HarnessV1AttemptRejected, HarnessV1AttemptCancelled},
+	HarnessV1AttemptSubmitting: {HarnessV1AttemptRejected, HarnessV1AttemptSubmittedUnknown, HarnessV1AttemptAccepted},
+	HarnessV1AttemptSubmittedUnknown: {
+		HarnessV1AttemptRejected, HarnessV1AttemptAccepted, HarnessV1AttemptOutcomeUnknown,
+	},
+	HarnessV1AttemptAccepted: {
+		HarnessV1AttemptRunning, HarnessV1AttemptCancelRequested, HarnessV1AttemptSettling,
+		HarnessV1AttemptSucceeded, HarnessV1AttemptFailed, HarnessV1AttemptCancelled, HarnessV1AttemptOutcomeUnknown,
+	},
+	HarnessV1AttemptRunning: {
+		HarnessV1AttemptCancelRequested, HarnessV1AttemptSettling,
+		HarnessV1AttemptSucceeded, HarnessV1AttemptFailed, HarnessV1AttemptCancelled, HarnessV1AttemptOutcomeUnknown,
+	},
+	HarnessV1AttemptCancelRequested: {
+		HarnessV1AttemptSettling, HarnessV1AttemptSucceeded, HarnessV1AttemptFailed,
+		HarnessV1AttemptCancelled, HarnessV1AttemptOutcomeUnknown,
+	},
+	HarnessV1AttemptSettling: {
+		HarnessV1AttemptSucceeded, HarnessV1AttemptFailed, HarnessV1AttemptCancelled, HarnessV1AttemptOutcomeUnknown,
+	},
+}
+
+// IsTerminalHarnessV1AttemptState reports whether a state admits no further
+// transitions. Rejected is terminal for the attempt and is the only
+// submission-state path eligible for a safe resend through a new attempt.
+func IsTerminalHarnessV1AttemptState(state HarnessV1AttemptState) bool {
+	switch state {
+	case HarnessV1AttemptRejected, HarnessV1AttemptSucceeded, HarnessV1AttemptFailed,
+		HarnessV1AttemptCancelled, HarnessV1AttemptOutcomeUnknown:
+		return true
+	default:
+		return false
+	}
+}
+
+// ValidateHarnessV1AttemptTransition rejects illegal state transitions.
+func ValidateHarnessV1AttemptTransition(from, to HarnessV1AttemptState) error {
+	if slices.Contains(harnessV1AttemptTransitions[from], to) {
+		return nil
+	}
+	return ValidationErrorf("harness v1 attempt transition %s -> %s is not allowed", from, to)
+}
+
+// HarnessV1AttemptKey identifies one durable v1 attempt.
+type HarnessV1AttemptKey struct {
+	Namespace string
+	TaskUID   string
+	Attempt   int32
+}
+
+// CanonicalID returns the canonical attempt record identity.
+func (k HarnessV1AttemptKey) CanonicalID() string {
+	return fmt.Sprintf("%s/%s/%d", k.Namespace, k.TaskUID, k.Attempt)
+}
+
+// SessionReferenceID returns the bounded content-derived identity stored in a
+// protocol-neutral SessionTurn. The attempt store continues to use the
+// human-readable CanonicalID as its primary key; this separate identifier
+// prevents a v1 attempt from being confused with a v2 PromptAttempt.
+func (k HarnessV1AttemptKey) SessionReferenceID() string {
+	return CanonicalControlID("harness-v1-attempt", k.Namespace, k.TaskUID, fmt.Sprint(k.Attempt))
+}
+
+// Validate rejects incomplete attempt keys.
+func (k HarnessV1AttemptKey) Validate() error {
+	switch {
+	case strings.TrimSpace(k.Namespace) == "":
+		return ValidationErrorf("harness v1 attempt namespace is required")
+	case strings.TrimSpace(k.TaskUID) == "":
+		return ValidationErrorf("harness v1 attempt task UID is required")
+	case k.Attempt < 1:
+		return ValidationErrorf("harness v1 attempt number must be positive")
+	}
+	return nil
+}
+
+// HarnessV1AttemptRetryClass bounds retry eligibility recorded from the
+// immutable snapshot classification.
+type HarnessV1AttemptRetryClass string
+
+const (
+	// HarnessV1RetryClassNone forbids retry regardless of failure shape.
+	HarnessV1RetryClassNone HarnessV1AttemptRetryClass = "none"
+	// HarnessV1RetryClassDuplicateSafe permits retry only after a definitive
+	// pre-submission rejection or definitive retryable terminal failure.
+	HarnessV1RetryClassDuplicateSafe HarnessV1AttemptRetryClass = "duplicate-safe"
+)
+
+// HarnessV1Attempt is the durable v1 attempt aggregate. Attempt-specific state
+// stays separate from the lifetime Task binding; every record carries the
+// binding digest.
+type HarnessV1Attempt struct {
+	Namespace string
+	TaskName  string
+	TaskUID   string
+	Attempt   int32
+
+	BindingDigest  string
+	SnapshotDigest string
+	RequestDigest  string
+
+	TurnID           string
+	RuntimeSessionID string
+	CorrelationID    string
+
+	// Backend identifies the executor: built-in wrapper or external endpoint.
+	Backend string
+	// BackendEndpoint is the non-secret endpoint identity selected at dispatch.
+	BackendEndpoint string
+
+	AuthSecretNamespace       string
+	AuthSecretName            string
+	AuthSecretKey             string
+	AuthSecretUID             string
+	AuthSecretResourceVersion string
+
+	State HarnessV1AttemptState
+	// LastEventSeq is the highest persisted frame sequence.
+	LastEventSeq int64
+	// CancelRequestedAt is set when cancellation was requested; CancelAccepted
+	// remains nonterminal until a terminal frame or settlement receipt.
+	CancelRequestedAt *time.Time
+	// TerminalReceiptDigest digests the authoritative terminal or
+	// OutcomeUnknown receipt.
+	TerminalReceiptDigest string
+	// TerminalReason is a bounded reason code for terminal states.
+	TerminalReason string
+
+	DuplicateSafe bool
+	RetryClass    HarnessV1AttemptRetryClass
+
+	ControllerEpochName string
+	ControllerEpoch     int64
+	LastOperationID     string
+	LastOperationDigest string
+	Version             int64
+	CreatedAt           time.Time
+	UpdatedAt           time.Time
+}
+
+// Validate rejects incomplete attempt records at creation.
+func (a *HarnessV1Attempt) Validate() error {
+	if a == nil {
+		return ValidationErrorf("harness v1 attempt is required")
+	}
+	key := HarnessV1AttemptKey{Namespace: a.Namespace, TaskUID: a.TaskUID, Attempt: a.Attempt}
+	if err := key.Validate(); err != nil {
+		return err
+	}
+	if err := ValidateCanonicalDigest("harness v1 attempt binding digest", a.BindingDigest); err != nil {
+		return err
+	}
+	if err := ValidateCanonicalDigest("harness v1 attempt snapshot digest", a.SnapshotDigest); err != nil {
+		return err
+	}
+	if err := ValidateCanonicalDigest("harness v1 attempt request digest", a.RequestDigest); err != nil {
+		return err
+	}
+	if strings.TrimSpace(a.TurnID) == "" {
+		return ValidationErrorf("harness v1 attempt turn ID is required")
+	}
+	if a.State != HarnessV1AttemptPrepared {
+		return ValidationErrorf("harness v1 attempts are created in Prepared state, got %q", string(a.State))
+	}
+	switch a.RetryClass {
+	case HarnessV1RetryClassNone, HarnessV1RetryClassDuplicateSafe:
+	default:
+		return ValidationErrorf("harness v1 attempt retry class %q is not supported", string(a.RetryClass))
+	}
+	return nil
+}
+
+// HarnessV1AttemptUpdates carries optional field updates applied atomically
+// with a state transition.
+type HarnessV1AttemptUpdates struct {
+	RuntimeSessionID      *string
+	CorrelationID         *string
+	BackendEndpoint       *string
+	LastEventSeq          *int64
+	CancelRequestedAt     *time.Time
+	TerminalReceiptDigest *string
+	TerminalReason        *string
+}
+
+// HarnessV1AttemptTransition is a fenced, idempotent CAS state transition.
+type HarnessV1AttemptTransition struct {
+	Key             HarnessV1AttemptKey
+	ExpectedVersion int64
+	ExpectedState   HarnessV1AttemptState
+	TargetState     HarnessV1AttemptState
+	OperationID     string
+	OperationDigest string
+	Fence           ControllerEpochFence
+	Updates         HarnessV1AttemptUpdates
+}
+
+// ReclaimHarnessV1AttemptsRequest removes Task-owned v1 attempt aggregates
+// only after terminal state and, for continuity Tasks, durable SessionTurn and
+// delivered outbox barriers have been re-proven in the same transaction.
+type ReclaimHarnessV1AttemptsRequest struct {
+	Namespace       string
+	TaskUID         string
+	BindingDigest   string
+	SessionRequired bool
+	Fence           ControllerEpochFence
+}
+
+// HarnessV1AttemptStore persists durable v1 attempt aggregates.
+type HarnessV1AttemptStore interface {
+	// CreateHarnessV1Attempt persists a new Prepared attempt exactly once. A
+	// duplicate identical create is idempotent; a duplicate with different
+	// content returns ErrDuplicateMismatch.
+	CreateHarnessV1Attempt(ctx context.Context, attempt *HarnessV1Attempt, fence ControllerEpochFence) error
+
+	// GetHarnessV1Attempt returns one attempt or ErrNotFound.
+	GetHarnessV1Attempt(ctx context.Context, key HarnessV1AttemptKey) (*HarnessV1Attempt, error)
+
+	// ListHarnessV1AttemptsByTask returns every attempt for one Task UID.
+	ListHarnessV1AttemptsByTask(ctx context.Context, namespace, taskUID string) ([]HarnessV1Attempt, error)
+
+	// ListActiveHarnessV1Attempts returns every nonterminal attempt for drain
+	// and retirement inventory.
+	ListActiveHarnessV1Attempts(ctx context.Context) ([]HarnessV1Attempt, error)
+
+	// TransitionHarnessV1Attempt applies a fenced CAS transition. A replay with
+	// the same operation ID and digest against the already-applied state is
+	// idempotent; conflicting expectations return ErrConflict.
+	TransitionHarnessV1Attempt(ctx context.Context, transition HarnessV1AttemptTransition) (*HarnessV1Attempt, error)
+
+	// ReclaimHarnessV1Attempts deletes all terminal attempts for one immutable
+	// Task. Active attempts or incomplete Session/outbox settlement fail closed.
+	ReclaimHarnessV1Attempts(ctx context.Context, request ReclaimHarnessV1AttemptsRequest) (int, error)
+}
diff --git a/internal/store/control_store.go b/internal/store/control_store.go
new file mode 100644
index 000000000..31bdf1b0f
--- /dev/null
+++ b/internal/store/control_store.go
@@ -0,0 +1,96 @@
+package store
+
+import "context"
+
+// ControllerEpochStore owns the durable controller epoch CAS record.
+type ControllerEpochStore interface {
+	GetControllerEpoch(ctx context.Context, name string) (*ControllerEpoch, error)
+	CompareAndSwapControllerEpoch(ctx context.Context, change ControllerEpochCAS) (*ControllerEpoch, error)
+}
+
+// ControllerEpochMirror receives the exact epoch acquired from the
+// Kubernetes-authoritative ControllerEpochStore. Mirrors are subordinate
+// fencing records for SQLite payload transactions; they never select or
+// advance controller ownership themselves.
+type ControllerEpochMirror interface {
+	SyncControllerEpochMirror(ctx context.Context, epoch ControllerEpoch) error
+}
+
+// PromptAttemptStore persists the full prompt execution and delivery state machines.
+type PromptAttemptStore interface {
+	CreatePromptAttempt(ctx context.Context, attempt *PromptAttempt, fence ControllerEpochFence) (*PromptAttempt, error)
+	GetPromptAttempt(ctx context.Context, id string) (*PromptAttempt, error)
+	TransitionPromptAttemptExecution(ctx context.Context, transition PromptAttemptExecutionTransition) (*PromptAttempt, error)
+	RecoverPromptAttemptPreSubmission(ctx context.Context, recovery PromptAttemptPreSubmissionRecovery) (*PromptAttempt, error)
+	TransitionPromptAttemptDelivery(ctx context.Context, transition PromptAttemptDeliveryTransition) (*PromptAttempt, error)
+}
+
+// PromptAttemptRetentionStore reclaims Task-owned PromptAttempt records only
+// after the broader durable control plane has crossed its finalization barriers.
+type PromptAttemptRetentionStore interface {
+	PreparePromptAttemptReclamation(ctx context.Context, request ReclaimPromptAttemptsRequest) error
+	ReclaimPromptAttempts(ctx context.Context, request ReclaimPromptAttemptsRequest) (int, error)
+}
+
+// SessionControlStore persists fenced Session mutation leases and atomic turn finalization.
+type SessionControlStore interface {
+	CreateSessionControl(ctx context.Context, control *SessionControl, fence ControllerEpochFence) (*SessionControl, error)
+	GetSessionControl(ctx context.Context, namespace, sessionName string) (*SessionControl, error)
+	AcquireSessionMutationLease(ctx context.Context, request AcquireSessionMutationLeaseRequest) (*SessionControl, error)
+	ReleaseSessionMutationLease(ctx context.Context, request ReleaseSessionMutationLeaseRequest) (*SessionControl, error)
+	ReconcileSessionControl(ctx context.Context, request ReconcileSessionControlRequest) (*SessionControl, error)
+	CreateSessionTurn(ctx context.Context, request CreateSessionTurnRequest) (*SessionTurn, error)
+	GetSessionTurn(ctx context.Context, id string) (*SessionTurn, error)
+	FinalizeSessionTurn(ctx context.Context, request FinalizeSessionTurnRequest) (*SessionTurn, error)
+	ResumeSessionTurnFinalization(ctx context.Context, request ResumeSessionTurnFinalizationRequest) (*SessionTurn, error)
+}
+
+// BranchClaimStore persists exact branch ownership and verified baselines.
+type BranchClaimStore interface {
+	CreateBranchClaim(ctx context.Context, claim *BranchClaim, fence ControllerEpochFence) (*BranchClaim, error)
+	GetBranchClaim(ctx context.Context, id string) (*BranchClaim, error)
+	CompareAndSwapBranchClaim(ctx context.Context, change BranchClaimCAS) (*BranchClaim, error)
+	ReclaimBranchClaim(ctx context.Context, request ReclaimBranchClaimRequest) error
+}
+
+// BranchClaimCreationStore reports whether this exact call inserted the claim,
+// allowing callers to safely clean up only creation they actually won.
+type BranchClaimCreationStore interface {
+	CreateBranchClaimWithResult(ctx context.Context, claim *BranchClaim, fence ControllerEpochFence) (*BranchClaim, bool, error)
+}
+
+// PublicationStore persists clean-room prepare, publish, and independent verification receipts.
+type PublicationStore interface {
+	CreatePublication(ctx context.Context, publication *Publication, fence ControllerEpochFence) (*Publication, error)
+	GetPublication(ctx context.Context, id string) (*Publication, error)
+	SetPublicationPRIntent(ctx context.Context, request SetPublicationPRIntentRequest) (*Publication, error)
+	SetPublicationPRReceipt(ctx context.Context, request SetPublicationPRReceiptRequest) (*Publication, error)
+	TransitionPublication(ctx context.Context, transition PublicationTransition) (*Publication, error)
+}
+
+// ExternalEffectStore persists canonical idempotency identities for operations outside SQLite.
+type ExternalEffectStore interface {
+	ReserveExternalEffect(ctx context.Context, request ReserveExternalEffectRequest) (*ExternalEffect, error)
+	GetExternalEffect(ctx context.Context, id string) (*ExternalEffect, error)
+	TransitionExternalEffect(ctx context.Context, transition ExternalEffectTransition) (*ExternalEffect, error)
+}
+
+// OutboxProjectionStore persists restart-safe task/status projection records.
+type OutboxProjectionStore interface {
+	EnqueueOutboxProjection(ctx context.Context, projection *OutboxProjection, fence ControllerEpochFence) (*OutboxProjection, error)
+	GetOutboxProjection(ctx context.Context, id string) (*OutboxProjection, error)
+	ClaimOutboxProjections(ctx context.Context, request ClaimOutboxProjectionsRequest) ([]OutboxProjection, error)
+	CompleteOutboxProjection(ctx context.Context, request CompleteOutboxProjectionRequest) (*OutboxProjection, error)
+}
+
+// DurableControlStore is the complete first-release durable-control-store foundation.
+type DurableControlStore interface {
+	ControllerEpochStore
+	PromptAttemptStore
+	PromptAttemptRetentionStore
+	SessionControlStore
+	BranchClaimStore
+	PublicationStore
+	ExternalEffectStore
+	OutboxProjectionStore
+}
diff --git a/internal/store/control_types.go b/internal/store/control_types.go
new file mode 100644
index 000000000..bba2cf4bd
--- /dev/null
+++ b/internal/store/control_types.go
@@ -0,0 +1,1309 @@
+package store
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"path"
+	"strconv"
+	"strings"
+	"time"
+	"unicode/utf8"
+)
+
+const (
+	// DefaultControllerEpochName is the singleton epoch used by the first
+	// single-controller durable-control-store deployment.
+	DefaultControllerEpochName = "orka-controller"
+
+	maxControlIdentifierBytes = 1024
+	maxControlReasonBytes     = 16 * 1024
+	maxControlTextBytes       = 4 * 1024 * 1024
+	maxControlPayloadBytes    = 4 * 1024 * 1024
+)
+
+// ControllerEpochFence fences a mutation to one exact controller epoch and
+// holder. Both values are checked transactionally before a durable mutation.
+type ControllerEpochFence struct {
+	Name     string `json:"name"`
+	Epoch    int64  `json:"epoch"`
+	HolderID string `json:"holderId"`
+}
+
+// ControllerEpoch is the durable CAS record for controller ownership.
+type ControllerEpoch struct {
+	Name          string    `json:"name"`
+	Epoch         int64     `json:"epoch"`
+	HolderID      string    `json:"holderId"`
+	RequestDigest string    `json:"requestDigest"`
+	Version       int64     `json:"version"`
+	AcquiredAt    time.Time `json:"acquiredAt"`
+	UpdatedAt     time.Time `json:"updatedAt"`
+}
+
+// ControllerEpochCAS creates or advances an epoch. Creation requires both
+// expected values to be zero; advancement requires exact version and epoch
+// matches and increments the epoch by one.
+type ControllerEpochCAS struct {
+	Name            string    `json:"name"`
+	ExpectedVersion int64     `json:"expectedVersion"`
+	ExpectedEpoch   int64     `json:"expectedEpoch"`
+	NewEpoch        int64     `json:"newEpoch"`
+	HolderID        string    `json:"holderId"`
+	RequestDigest   string    `json:"requestDigest"`
+	UpdatedAt       time.Time `json:"updatedAt"`
+}
+
+// PromptAttemptKey is the immutable identity of a prompt execution attempt.
+type PromptAttemptKey struct {
+	Namespace string `json:"namespace"`
+	TaskUID   string `json:"taskUid"`
+	Attempt   int64  `json:"attempt"`
+	PromptID  string `json:"promptId"`
+}
+
+// CanonicalID returns a stable content-derived identifier for the exact key.
+func (k PromptAttemptKey) CanonicalID() (string, error) {
+	if err := k.Validate(); err != nil {
+		return "", err
+	}
+	return CanonicalControlID("prompt-attempt", k.Namespace, k.TaskUID, strconv.FormatInt(k.Attempt, 10), k.PromptID), nil
+}
+
+// Validate validates the immutable prompt attempt identity.
+func (k PromptAttemptKey) Validate() error {
+	if err := validateControlIdentifier("prompt attempt namespace", k.Namespace); err != nil {
+		return err
+	}
+	if err := validateControlIdentifier("prompt attempt task UID", k.TaskUID); err != nil {
+		return err
+	}
+	if k.Attempt < 1 {
+		return ValidationErrorf("prompt attempt must be at least 1")
+	}
+	return validateControlIdentifier("prompt ID", k.PromptID)
+}
+
+// PromptExecutionState is the durable prompt execution state.
+type PromptExecutionState string
+
+const (
+	PromptExecutionQueued           PromptExecutionState = "Queued"
+	PromptExecutionReserved         PromptExecutionState = "Reserved"
+	PromptExecutionSessionStarting  PromptExecutionState = "SessionStarting"
+	PromptExecutionPlanned          PromptExecutionState = "Planned"
+	PromptExecutionSubmitting       PromptExecutionState = "Submitting"
+	PromptExecutionSubmittedUnknown PromptExecutionState = "SubmittedUnknown"
+	PromptExecutionAccepted         PromptExecutionState = "Accepted"
+	PromptExecutionRunning          PromptExecutionState = "Running"
+	PromptExecutionSettling         PromptExecutionState = "Settling"
+	PromptExecutionSucceeded        PromptExecutionState = "Succeeded"
+	PromptExecutionFailed           PromptExecutionState = "Failed"
+	PromptExecutionCancelled        PromptExecutionState = "Cancelled"
+	PromptExecutionOutcomeUnknown   PromptExecutionState = "OutcomeUnknown"
+)
+
+var promptExecutionTransitions = map[PromptExecutionState]map[PromptExecutionState]struct{}{
+	PromptExecutionQueued: {
+		PromptExecutionReserved: {}, PromptExecutionFailed: {}, PromptExecutionCancelled: {},
+	},
+	PromptExecutionReserved: {
+		PromptExecutionSessionStarting: {}, PromptExecutionFailed: {}, PromptExecutionCancelled: {},
+	},
+	PromptExecutionSessionStarting: {
+		PromptExecutionPlanned: {}, PromptExecutionFailed: {}, PromptExecutionCancelled: {},
+	},
+	PromptExecutionPlanned: {
+		PromptExecutionSubmitting: {}, PromptExecutionFailed: {}, PromptExecutionCancelled: {},
+	},
+	PromptExecutionSubmitting: {
+		PromptExecutionAccepted: {}, PromptExecutionSubmittedUnknown: {}, PromptExecutionFailed: {}, PromptExecutionCancelled: {},
+	},
+	PromptExecutionSubmittedUnknown: {
+		PromptExecutionOutcomeUnknown: {},
+	},
+	PromptExecutionAccepted: {
+		PromptExecutionRunning: {}, PromptExecutionSettling: {}, PromptExecutionFailed: {}, PromptExecutionCancelled: {}, PromptExecutionOutcomeUnknown: {},
+	},
+	PromptExecutionRunning: {
+		PromptExecutionSettling: {}, PromptExecutionFailed: {}, PromptExecutionCancelled: {}, PromptExecutionOutcomeUnknown: {},
+	},
+	PromptExecutionSettling: {
+		PromptExecutionSucceeded: {}, PromptExecutionFailed: {}, PromptExecutionCancelled: {}, PromptExecutionOutcomeUnknown: {},
+	},
+}
+
+// IsKnownPromptExecutionState reports whether state is supported.
+func IsKnownPromptExecutionState(state PromptExecutionState) bool {
+	switch state {
+	case PromptExecutionQueued, PromptExecutionReserved, PromptExecutionSessionStarting,
+		PromptExecutionPlanned, PromptExecutionSubmitting, PromptExecutionSubmittedUnknown,
+		PromptExecutionAccepted, PromptExecutionRunning, PromptExecutionSettling,
+		PromptExecutionSucceeded, PromptExecutionFailed, PromptExecutionCancelled,
+		PromptExecutionOutcomeUnknown:
+		return true
+	default:
+		return false
+	}
+}
+
+// IsTerminalPromptExecutionState reports whether no further execution
+// transition is permitted. OutcomeUnknown is deliberately terminal.
+func IsTerminalPromptExecutionState(state PromptExecutionState) bool {
+	switch state {
+	case PromptExecutionSucceeded, PromptExecutionFailed, PromptExecutionCancelled, PromptExecutionOutcomeUnknown:
+		return true
+	default:
+		return false
+	}
+}
+
+// ValidatePromptExecutionTransition validates one exact state transition.
+func ValidatePromptExecutionTransition(from, to PromptExecutionState) error {
+	if !IsKnownPromptExecutionState(from) {
+		return ValidationErrorf("unsupported prompt execution state %q", from)
+	}
+	if !IsKnownPromptExecutionState(to) {
+		return ValidationErrorf("unsupported prompt execution state %q", to)
+	}
+	if _, ok := promptExecutionTransitions[from][to]; !ok {
+		return ValidationErrorf("prompt execution transition %s -> %s is not allowed", from, to)
+	}
+	return nil
+}
+
+// PromptDeliveryState is the durable delivery/publication projection attached
+// to a PromptAttempt.
+type PromptDeliveryState string
+
+const (
+	PromptDeliveryNotRequested              PromptDeliveryState = "NotRequested"
+	PromptDeliveryValidating                PromptDeliveryState = "Validating"
+	PromptDeliveryPreparing                 PromptDeliveryState = "Preparing"
+	PromptDeliveryPrepared                  PromptDeliveryState = "Prepared"
+	PromptDeliveryPublishing                PromptDeliveryState = "Publishing"
+	PromptDeliveryVerifying                 PromptDeliveryState = "Verifying"
+	PromptDeliveryVerifiedExact             PromptDeliveryState = "VerifiedExact"
+	PromptDeliveryDeliveredSuperseded       PromptDeliveryState = "DeliveredSuperseded"
+	PromptDeliveryReadValidated             PromptDeliveryState = "ReadValidated"
+	PromptDeliveryNoChange                  PromptDeliveryState = "NoChange"
+	PromptDeliveryCancelledBeforePublish    PromptDeliveryState = "CancelledBeforePublish"
+	PromptDeliveryReadOnlyWorkspaceModified PromptDeliveryState = "ReadOnlyWorkspaceModified"
+	PromptDeliveryConflict                  PromptDeliveryState = "DeliveryConflict"
+	PromptDeliveryCredentialBlocked         PromptDeliveryState = "CredentialBlocked"
+	PromptDeliveryPublicationOutcomeUnknown PromptDeliveryState = "PublicationOutcomeUnknown"
+)
+
+var promptDeliveryTransitions = map[PromptDeliveryState]map[PromptDeliveryState]struct{}{
+	PromptDeliveryNotRequested: {PromptDeliveryValidating: {}},
+	PromptDeliveryValidating: {
+		PromptDeliveryPreparing: {}, PromptDeliveryReadValidated: {}, PromptDeliveryNoChange: {},
+		PromptDeliveryReadOnlyWorkspaceModified: {}, PromptDeliveryCredentialBlocked: {}, PromptDeliveryConflict: {},
+		PromptDeliveryPublicationOutcomeUnknown: {},
+	},
+	PromptDeliveryPreparing: {
+		PromptDeliveryPrepared: {}, PromptDeliveryCredentialBlocked: {}, PromptDeliveryConflict: {}, PromptDeliveryPublicationOutcomeUnknown: {},
+	},
+	PromptDeliveryPrepared: {
+		PromptDeliveryPublishing: {}, PromptDeliveryCancelledBeforePublish: {},
+	},
+	PromptDeliveryPublishing: {
+		PromptDeliveryVerifying: {}, PromptDeliveryPublicationOutcomeUnknown: {},
+	},
+	PromptDeliveryVerifying: {
+		PromptDeliveryVerifiedExact: {}, PromptDeliveryDeliveredSuperseded: {},
+		PromptDeliveryConflict: {}, PromptDeliveryPublicationOutcomeUnknown: {},
+	},
+}
+
+// IsKnownPromptDeliveryState reports whether state is supported.
+func IsKnownPromptDeliveryState(state PromptDeliveryState) bool {
+	switch state {
+	case PromptDeliveryNotRequested, PromptDeliveryValidating, PromptDeliveryPreparing,
+		PromptDeliveryPrepared, PromptDeliveryPublishing, PromptDeliveryVerifying,
+		PromptDeliveryVerifiedExact, PromptDeliveryDeliveredSuperseded,
+		PromptDeliveryReadValidated, PromptDeliveryNoChange,
+		PromptDeliveryCancelledBeforePublish, PromptDeliveryReadOnlyWorkspaceModified,
+		PromptDeliveryConflict, PromptDeliveryCredentialBlocked,
+		PromptDeliveryPublicationOutcomeUnknown:
+		return true
+	default:
+		return false
+	}
+}
+
+// IsTerminalPromptDeliveryState reports whether delivery is resolved.
+func IsTerminalPromptDeliveryState(state PromptDeliveryState) bool {
+	switch state {
+	case PromptDeliveryNotRequested, PromptDeliveryVerifiedExact, PromptDeliveryDeliveredSuperseded,
+		PromptDeliveryReadValidated, PromptDeliveryNoChange, PromptDeliveryCancelledBeforePublish,
+		PromptDeliveryReadOnlyWorkspaceModified, PromptDeliveryConflict,
+		PromptDeliveryCredentialBlocked, PromptDeliveryPublicationOutcomeUnknown:
+		return true
+	default:
+		return false
+	}
+}
+
+// ValidatePromptDeliveryTransition validates one delivery transition.
+func ValidatePromptDeliveryTransition(from, to PromptDeliveryState) error {
+	if !IsKnownPromptDeliveryState(from) {
+		return ValidationErrorf("unsupported prompt delivery state %q", from)
+	}
+	if !IsKnownPromptDeliveryState(to) {
+		return ValidationErrorf("unsupported prompt delivery state %q", to)
+	}
+	if _, ok := promptDeliveryTransitions[from][to]; !ok {
+		return ValidationErrorf("prompt delivery transition %s -> %s is not allowed", from, to)
+	}
+	return nil
+}
+
+// PromptCredentialRole identifies one non-overlapping credential authority.
+type PromptCredentialRole string
+
+const (
+	PromptCredentialSourceRead  PromptCredentialRole = "SourceRead"
+	PromptCredentialTargetRead  PromptCredentialRole = "TargetRead"
+	PromptCredentialTargetWrite PromptCredentialRole = "TargetWrite"
+	PromptCredentialForge       PromptCredentialRole = "Forge"
+)
+
+// PromptCredentialBinding freezes one Secret identity without credential data.
+type PromptCredentialBinding struct {
+	Role            PromptCredentialRole `json:"role"`
+	Namespace       string               `json:"namespace"`
+	SecretName      string               `json:"secretName"`
+	SecretKey       string               `json:"secretKey"`
+	SecretUID       string               `json:"secretUid"`
+	ResourceVersion string               `json:"resourceVersion"`
+}
+
+func (b PromptCredentialBinding) Validate() error {
+	switch b.Role {
+	case PromptCredentialSourceRead, PromptCredentialTargetRead, PromptCredentialTargetWrite, PromptCredentialForge:
+	default:
+		return ValidationErrorf("unsupported prompt credential role %q", b.Role)
+	}
+	for field, value := range map[string]string{
+		"credential namespace": b.Namespace, "credential Secret name": b.SecretName,
+		"credential Secret key": b.SecretKey, "credential Secret UID": b.SecretUID,
+		"credential Secret resourceVersion": b.ResourceVersion,
+	} {
+		if err := validateControlIdentifier(field, value); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// PromptAttempt is the durable execution/delivery aggregate for one prompt.
+type PromptAttempt struct {
+	ID                     string                    `json:"id"`
+	Key                    PromptAttemptKey          `json:"key"`
+	SessionUID             string                    `json:"sessionUid,omitempty"`
+	SessionLeaseGeneration int64                     `json:"sessionLeaseGeneration,omitempty"`
+	RuntimeInstanceID      string                    `json:"runtimeInstanceId,omitempty"`
+	RequestDigest          string                    `json:"requestDigest"`
+	BindingDigest          string                    `json:"bindingDigest,omitempty"`
+	SnapshotDigest         string                    `json:"snapshotDigest,omitempty"`
+	CredentialBindings     []PromptCredentialBinding `json:"credentialBindings,omitempty"`
+	ExecutionState         PromptExecutionState      `json:"executionState"`
+	DeliveryState          PromptDeliveryState       `json:"deliveryState"`
+	TerminalReason         string                    `json:"terminalReason,omitempty"`
+	OutcomeMarker          string                    `json:"outcomeMarker,omitempty"`
+	ControllerEpochName    string                    `json:"controllerEpochName"`
+	ControllerEpoch        int64                     `json:"controllerEpoch"`
+	LastOperationID        string                    `json:"lastOperationId,omitempty"`
+	LastOperationDigest    string                    `json:"lastOperationDigest,omitempty"`
+	Version                int64                     `json:"version"`
+	CreatedAt              time.Time                 `json:"createdAt"`
+	UpdatedAt              time.Time                 `json:"updatedAt"`
+}
+
+// PromptAttemptExecutionTransition performs a fenced execution-state CAS.
+type PromptAttemptExecutionTransition struct {
+	ID                     string               `json:"id"`
+	Fence                  ControllerEpochFence `json:"fence"`
+	ExpectedVersion        int64                `json:"expectedVersion"`
+	ExpectedState          PromptExecutionState `json:"expectedState"`
+	NewState               PromptExecutionState `json:"newState"`
+	OperationID            string               `json:"operationId"`
+	OperationDigest        string               `json:"operationDigest"`
+	RuntimeInstanceID      string               `json:"runtimeInstanceId,omitempty"`
+	SessionUID             string               `json:"sessionUid,omitempty"`
+	SessionLeaseGeneration int64                `json:"sessionLeaseGeneration,omitempty"`
+	TerminalReason         string               `json:"terminalReason,omitempty"`
+	OutcomeMarker          string               `json:"outcomeMarker,omitempty"`
+	UpdatedAt              time.Time            `json:"updatedAt"`
+}
+
+// PromptAttemptPreSubmissionRecovery refreshes Reserved or resets an attempt that
+// crossed no prompt request-write boundary back to Reserved under a controller epoch. It is intentionally limited to SessionStarting and Planned.
+type PromptAttemptPreSubmissionRecovery struct {
+	ID              string               `json:"id"`
+	Fence           ControllerEpochFence `json:"fence"`
+	ExpectedVersion int64                `json:"expectedVersion"`
+	ExpectedState   PromptExecutionState `json:"expectedState"`
+	OperationID     string               `json:"operationId"`
+	OperationDigest string               `json:"operationDigest"`
+	RecoveredAt     time.Time            `json:"recoveredAt"`
+}
+
+// PromptAttemptDeliveryTransition performs a fenced delivery-state CAS.
+type PromptAttemptDeliveryTransition struct {
+	ID              string               `json:"id"`
+	Fence           ControllerEpochFence `json:"fence"`
+	ExpectedVersion int64                `json:"expectedVersion"`
+	ExpectedState   PromptDeliveryState  `json:"expectedState"`
+	NewState        PromptDeliveryState  `json:"newState"`
+	OperationID     string               `json:"operationId"`
+	OperationDigest string               `json:"operationDigest"`
+	TerminalReason  string               `json:"terminalReason,omitempty"`
+	UpdatedAt       time.Time            `json:"updatedAt"`
+}
+
+// PromptAttemptReclamationMode identifies why a deleting Task may reclaim its
+// durable attempts. Projected Tasks require an exact delivered terminal
+// projection. Unbound Tasks cover the crash window where a queued attempt was
+// persisted before Task.status.execution. NoAttempt is limited to failures that
+// were proven to happen before any durable attempt existed.
+type PromptAttemptReclamationMode string
+
+const (
+	PromptAttemptReclamationProjected PromptAttemptReclamationMode = "Projected"
+	PromptAttemptReclamationUnbound   PromptAttemptReclamationMode = "Unbound"
+	PromptAttemptReclamationNoAttempt PromptAttemptReclamationMode = "NoAttempt"
+)
+
+// ReclaimPromptAttemptsRequest removes every PromptAttempt owned by one
+// immutable deleting Task only after the store can re-prove the relevant
+// terminal barriers. The store derives the newest attempt and verifies the
+// caller's expected final identity instead of trusting it as deletion authority.
+// An Unbound request is authoritative discovery: when no attempt exists, the
+// prepared durable marker records NoAttempt so retries remain crash-safe.
+// ContinuitySession distinguishes SessionTurn-backed tasks from standalone
+// runtime-session identities, which also populate PromptAttempt.SessionUID.
+type ReclaimPromptAttemptsRequest struct {
+	Namespace                         string                       `json:"namespace"`
+	TaskName                          string                       `json:"taskName"`
+	TaskUID                           string                       `json:"taskUid"`
+	Mode                              PromptAttemptReclamationMode `json:"mode"`
+	ContinuitySession                 bool                         `json:"continuitySession,omitempty"`
+	FinalContinuitySession            bool                         `json:"finalContinuitySession,omitempty"`
+	FinalPromptAttemptID              string                       `json:"finalPromptAttemptId,omitempty"`
+	TerminalProjectionID              string                       `json:"terminalProjectionId,omitempty"`
+	RelatedExternalEffectAggregateIDs []string                     `json:"relatedExternalEffectAggregateIds,omitempty"`
+	Fence                             ControllerEpochFence         `json:"fence"`
+}
+
+// SessionAvailability is the state that gates mutation-lease acquisition.
+type SessionAvailability string
+
+const (
+	SessionAvailable             SessionAvailability = "Available"
+	SessionReconciliationBlocked SessionAvailability = "ReconciliationBlocked"
+)
+
+// SessionMutationLease is a fenced ownership token. Generation is monotonic
+// for the immutable SessionUID and is never reused.
+type SessionMutationLease struct {
+	Generation    int64      `json:"generation"`
+	TaskUID       string     `json:"taskUid"`
+	Attempt       int64      `json:"attempt"`
+	PromptID      string     `json:"promptId"`
+	RequestDigest string     `json:"requestDigest"`
+	AcquiredAt    time.Time  `json:"acquiredAt"`
+	ExpiresAt     *time.Time `json:"expiresAt,omitempty"`
+}
+
+// VerifiedBranchBaseline is the independently verified session baseline.
+type VerifiedBranchBaseline struct {
+	RepositoryID string `json:"repositoryId"`
+	Ref          string `json:"ref"`
+	SHA          string `json:"sha"`
+}
+
+// SessionControl stores the immutable SessionUID, monotonic lease generation,
+// availability, and independently verified branch baseline.
+type SessionControl struct {
+	Namespace              string                  `json:"namespace"`
+	SessionName            string                  `json:"sessionName"`
+	SessionUID             string                  `json:"sessionUid"`
+	RequestDigest          string                  `json:"requestDigest"`
+	Availability           SessionAvailability     `json:"availability"`
+	LeaseGeneration        int64                   `json:"leaseGeneration"`
+	Lease                  *SessionMutationLease   `json:"lease,omitempty"`
+	BlockedReason          string                  `json:"blockedReason,omitempty"`
+	RelatedPromptAttemptID string                  `json:"relatedPromptAttemptId,omitempty"`
+	RelatedPublicationID   string                  `json:"relatedPublicationId,omitempty"`
+	VerifiedBaseline       *VerifiedBranchBaseline `json:"verifiedBaseline,omitempty"`
+	Lineage                *SessionLineage         `json:"lineage,omitempty"`
+	ControllerEpochName    string                  `json:"controllerEpochName"`
+	ControllerEpoch        int64                   `json:"controllerEpoch"`
+	LastOperationID        string                  `json:"lastOperationId,omitempty"`
+	LastOperationDigest    string                  `json:"lastOperationDigest,omitempty"`
+	Version                int64                   `json:"version"`
+	CreatedAt              time.Time               `json:"createdAt"`
+	UpdatedAt              time.Time               `json:"updatedAt"`
+}
+
+// AcquireSessionMutationLeaseRequest acquires the next lease generation using
+// exact session version/generation and controller epoch fences.
+type AcquireSessionMutationLeaseRequest struct {
+	Namespace               string               `json:"namespace"`
+	SessionName             string               `json:"sessionName"`
+	SessionUID              string               `json:"sessionUid"`
+	Fence                   ControllerEpochFence `json:"fence"`
+	ExpectedVersion         int64                `json:"expectedVersion"`
+	ExpectedLeaseGeneration int64                `json:"expectedLeaseGeneration"`
+	TaskUID                 string               `json:"taskUid"`
+	Attempt                 int64                `json:"attempt"`
+	PromptID                string               `json:"promptId"`
+	RequestDigest           string               `json:"requestDigest"`
+	AcquiredAt              time.Time            `json:"acquiredAt"`
+	ExpiresAt               *time.Time           `json:"expiresAt,omitempty"`
+	// Lineage is established or verified in the same Kubernetes
+	// RuntimeSessionControl status CAS that records the acquired Lease. It is
+	// required by the Kubernetes-authoritative store.
+	Lineage *ClaimSessionLineageRequest `json:"lineage,omitempty"`
+}
+
+// ReleaseSessionMutationLeaseRequest aborts a pre-prompt lease only while the
+// exact SessionTurn fence and lease request digest still own the Session.
+type ReleaseSessionMutationLeaseRequest struct {
+	Namespace              string               `json:"namespace"`
+	SessionName            string               `json:"sessionName"`
+	SessionUID             string               `json:"sessionUid"`
+	Key                    SessionTurnKey       `json:"key"`
+	Fence                  ControllerEpochFence `json:"fence"`
+	ExpectedSessionVersion int64                `json:"expectedSessionVersion"`
+	LeaseRequestDigest     string               `json:"leaseRequestDigest"`
+	OperationID            string               `json:"operationId"`
+	OperationDigest        string               `json:"operationDigest"`
+	ReleasedAt             time.Time            `json:"releasedAt"`
+}
+
+// ReconcileSessionControlRequest explicitly establishes the actual remote
+// baseline and unblocks a fenced Session and BranchClaim after ambiguity.
+type ReconcileSessionControlRequest struct {
+	Namespace                     string                 `json:"namespace"`
+	SessionName                   string                 `json:"sessionName"`
+	SessionUID                    string                 `json:"sessionUid"`
+	Fence                         ControllerEpochFence   `json:"fence"`
+	ExpectedVersion               int64                  `json:"expectedVersion"`
+	ExpectedLeaseGeneration       int64                  `json:"expectedLeaseGeneration"`
+	ExpectedRelatedPublicationID  string                 `json:"expectedRelatedPublicationId"`
+	BranchClaimID                 string                 `json:"branchClaimId"`
+	ExpectedBranchClaimVersion    int64                  `json:"expectedBranchClaimVersion"`
+	ExpectedBranchClaimGeneration int64                  `json:"expectedBranchClaimGeneration"`
+	ExpectedBranchBaseline        RemoteRefState         `json:"expectedBranchBaseline"`
+	VerifiedBaseline              VerifiedBranchBaseline `json:"verifiedBaseline"`
+	OperationID                   string                 `json:"operationId"`
+	OperationDigest               string                 `json:"operationDigest"`
+	ReconciledAt                  time.Time              `json:"reconciledAt"`
+}
+
+// SessionTurnState is the durable state of a SessionTurn.
+type SessionTurnState string
+
+const (
+	SessionTurnOpen      SessionTurnState = "Open"
+	SessionTurnFinalized SessionTurnState = "Finalized"
+)
+
+// SessionTurnTerminalKind determines the canonical transcript terminal entry.
+type SessionTurnTerminalKind string
+
+const (
+	SessionTurnAssistantResult SessionTurnTerminalKind = "AssistantResult"
+	SessionTurnOutcomeMarker   SessionTurnTerminalKind = "OutcomeMarker"
+)
+
+// SessionTurnKey is the full finalization fence.
+type SessionTurnKey struct {
+	SessionUID      string `json:"sessionUid"`
+	LeaseGeneration int64  `json:"leaseGeneration"`
+	TaskUID         string `json:"taskUid"`
+	Attempt         int64  `json:"attempt"`
+	PromptID        string `json:"promptId"`
+}
+
+// CanonicalID returns a stable identifier for the exact finalization fence.
+func (k SessionTurnKey) CanonicalID() (string, error) {
+	if err := k.Validate(); err != nil {
+		return "", err
+	}
+	return CanonicalControlID("session-turn", k.SessionUID, strconv.FormatInt(k.LeaseGeneration, 10), k.TaskUID, strconv.FormatInt(k.Attempt, 10), k.PromptID), nil
+}
+
+// Validate validates a SessionTurn key.
+func (k SessionTurnKey) Validate() error {
+	if err := validateControlIdentifier("session UID", k.SessionUID); err != nil {
+		return err
+	}
+	if k.LeaseGeneration < 1 {
+		return ValidationErrorf("session lease generation must be at least 1")
+	}
+	if err := validateControlIdentifier("task UID", k.TaskUID); err != nil {
+		return err
+	}
+	if k.Attempt < 1 {
+		return ValidationErrorf("session turn attempt must be at least 1")
+	}
+	return validateControlIdentifier("prompt ID", k.PromptID)
+}
+
+// SessionTurn is one durable mutation lease use and transcript finalization.
+type SessionTurn struct {
+	ID                    string                  `json:"id"`
+	Key                   SessionTurnKey          `json:"key"`
+	PromptAttemptID       string                  `json:"promptAttemptId"`
+	RequestDigest         string                  `json:"requestDigest"`
+	UserPrompt            string                  `json:"userPrompt"`
+	State                 SessionTurnState        `json:"state"`
+	TerminalKind          SessionTurnTerminalKind `json:"terminalKind,omitempty"`
+	TerminalContent       string                  `json:"terminalContent,omitempty"`
+	FinalizationDigest    string                  `json:"finalizationDigest,omitempty"`
+	PublicationID         string                  `json:"publicationId,omitempty"`
+	PublicationReceipt    *PublicationReceipt     `json:"publicationReceipt,omitempty"`
+	ProjectionID          string                  `json:"projectionId,omitempty"`
+	ProjectionKind        string                  `json:"projectionKind,omitempty"`
+	ProjectionDigest      string                  `json:"projectionDigest,omitempty"`
+	ProjectionAvailableAt time.Time               `json:"projectionAvailableAt,omitempty"`
+	ControllerEpochName   string                  `json:"controllerEpochName"`
+	ControllerEpoch       int64                   `json:"controllerEpoch"`
+	Version               int64                   `json:"version"`
+	CreatedAt             time.Time               `json:"createdAt"`
+	FinalizedAt           *time.Time              `json:"finalizedAt,omitempty"`
+	UpdatedAt             time.Time               `json:"updatedAt"`
+}
+
+// CreateSessionTurnRequest opens a turn only under the matching active lease.
+type CreateSessionTurnRequest struct {
+	Turn                   SessionTurn          `json:"turn"`
+	Fence                  ControllerEpochFence `json:"fence"`
+	ExpectedSessionVersion int64                `json:"expectedSessionVersion"`
+}
+
+// FinalizeSessionTurnRequest atomically finalizes the turn, optionally appends
+// canonical transcript entries, snapshots the publication receipt, updates the
+// verified baseline, releases the matching lease, and enqueues the terminal projection.
+type FinalizeSessionTurnRequest struct {
+	Key                    SessionTurnKey          `json:"key"`
+	Fence                  ControllerEpochFence    `json:"fence"`
+	ExpectedSessionVersion int64                   `json:"expectedSessionVersion"`
+	ExpectedTurnVersion    int64                   `json:"expectedTurnVersion"`
+	FinalizationDigest     string                  `json:"finalizationDigest"`
+	TerminalKind           SessionTurnTerminalKind `json:"terminalKind"`
+	TerminalContent        string                  `json:"terminalContent"`
+	SkipTranscriptAppend   bool                    `json:"skipTranscriptAppend,omitempty"`
+	SkipUserPromptAppend   bool                    `json:"skipUserPromptAppend,omitempty"`
+	PublicationID          string                  `json:"publicationId,omitempty"`
+	VerifiedBaseline       *VerifiedBranchBaseline `json:"verifiedBaseline,omitempty"`
+	BlockReason            string                  `json:"blockReason,omitempty"`
+	Projection             OutboxProjection        `json:"projection"`
+	FinalizedAt            time.Time               `json:"finalizedAt"`
+}
+
+// ResumeSessionTurnFinalizationRequest resumes only the Kubernetes and outbox
+// activation tail of a SessionTurn whose SQLite finalization transaction is
+// already durable. The immutable key, PromptAttempt identity, and finalization
+// digest prevent a caller from redirecting recovery to a different turn.
+type ResumeSessionTurnFinalizationRequest struct {
+	Key                SessionTurnKey       `json:"key"`
+	PromptAttemptID    string               `json:"promptAttemptId"`
+	FinalizationDigest string               `json:"finalizationDigest"`
+	Fence              ControllerEpochFence `json:"fence"`
+}
+
+// BranchClaimOwnerKind identifies who owns a publication branch.
+type BranchClaimOwnerKind string
+
+const (
+	BranchClaimOwnerTask    BranchClaimOwnerKind = "Task"
+	BranchClaimOwnerSession BranchClaimOwnerKind = "Session"
+)
+
+// BranchClaimAvailability gates branch mutation.
+type BranchClaimAvailability string
+
+const (
+	BranchClaimAvailable             BranchClaimAvailability = "Available"
+	BranchClaimReconciliationBlocked BranchClaimAvailability = "ReconciliationBlocked"
+)
+
+// RemoteRefState is an exact remote observation. Exactly one of Absent or SHA
+// is set.
+type RemoteRefState struct {
+	Absent bool   `json:"absent"`
+	SHA    string `json:"sha,omitempty"`
+}
+
+// Equal reports exact equality.
+func (r RemoteRefState) Equal(other RemoteRefState) bool {
+	return r.Absent == other.Absent && r.SHA == other.SHA
+}
+
+// Validate validates an exact remote observation.
+func (r RemoteRefState) Validate(field string) error {
+	if r.Absent == (r.SHA != "") {
+		return ValidationErrorf("%s must set exactly one of absent or SHA", field)
+	}
+	if r.SHA != "" {
+		return ValidateGitObjectID(field+" SHA", r.SHA)
+	}
+	return nil
+}
+
+// BranchClaim is the durable ownership and exact-baseline record.
+type BranchClaim struct {
+	ID                   string                  `json:"id"`
+	RepositoryID         string                  `json:"repositoryId"`
+	Ref                  string                  `json:"ref"`
+	OwnerKind            BranchClaimOwnerKind    `json:"ownerKind"`
+	OwnerUID             string                  `json:"ownerUid"`
+	Generation           int64                   `json:"generation"`
+	LastVerified         RemoteRefState          `json:"lastVerified"`
+	Availability         BranchClaimAvailability `json:"availability"`
+	BlockedReason        string                  `json:"blockedReason,omitempty"`
+	RelatedPublicationID string                  `json:"relatedPublicationId,omitempty"`
+	RequestDigest        string                  `json:"requestDigest"`
+	ControllerEpochName  string                  `json:"controllerEpochName"`
+	ControllerEpoch      int64                   `json:"controllerEpoch"`
+	LastOperationID      string                  `json:"lastOperationId,omitempty"`
+	LastOperationDigest  string                  `json:"lastOperationDigest,omitempty"`
+	Version              int64                   `json:"version"`
+	CreatedAt            time.Time               `json:"createdAt"`
+	UpdatedAt            time.Time               `json:"updatedAt"`
+}
+
+// CanonicalBranchClaimID derives the stable claim ID for a canonical repository and full ref.
+func CanonicalBranchClaimID(repositoryID, ref string) (string, error) {
+	if err := validateControlIdentifier("publication repository ID", repositoryID); err != nil {
+		return "", err
+	}
+	if err := ValidateFullBranchRef(ref); err != nil {
+		return "", err
+	}
+	return CanonicalControlID("branch-claim", repositoryID, ref), nil
+}
+
+// BranchClaimCAS updates only the exact claim generation, version, baseline,
+// and availability observed by the caller.
+type BranchClaimCAS struct {
+	ID                   string                  `json:"id"`
+	Fence                ControllerEpochFence    `json:"fence"`
+	ExpectedVersion      int64                   `json:"expectedVersion"`
+	ExpectedGeneration   int64                   `json:"expectedGeneration"`
+	NewGeneration        int64                   `json:"newGeneration"`
+	ExpectedLastVerified RemoteRefState          `json:"expectedLastVerified"`
+	NewLastVerified      RemoteRefState          `json:"newLastVerified"`
+	ExpectedAvailability BranchClaimAvailability `json:"expectedAvailability"`
+	NewAvailability      BranchClaimAvailability `json:"newAvailability"`
+	BlockedReason        string                  `json:"blockedReason,omitempty"`
+	RelatedPublicationID string                  `json:"relatedPublicationId,omitempty"`
+	OperationID          string                  `json:"operationId"`
+	OperationDigest      string                  `json:"operationDigest"`
+	UpdatedAt            time.Time               `json:"updatedAt"`
+}
+
+// ReclaimBranchClaimRequest removes only the exact available claim observed by
+// the caller. Reconciliation-blocked claims are never reclaimable. Session
+// claims are reclaimed only by higher-level Session lifecycle code. A missing
+// claim, or a claim whose immutable owner/request
+// identity has already been replaced, is an idempotent success; every mutable
+// fence must still match before an existing claim can be deleted.
+type ReclaimBranchClaimRequest struct {
+	ID                    string                  `json:"id"`
+	Fence                 ControllerEpochFence    `json:"fence"`
+	ExpectedVersion       int64                   `json:"expectedVersion"`
+	ExpectedGeneration    int64                   `json:"expectedGeneration"`
+	ExpectedRepositoryID  string                  `json:"expectedRepositoryId"`
+	ExpectedRef           string                  `json:"expectedRef"`
+	ExpectedOwnerKind     BranchClaimOwnerKind    `json:"expectedOwnerKind"`
+	ExpectedOwnerUID      string                  `json:"expectedOwnerUid"`
+	ExpectedLastVerified  RemoteRefState          `json:"expectedLastVerified"`
+	ExpectedAvailability  BranchClaimAvailability `json:"expectedAvailability"`
+	ExpectedRequestDigest string                  `json:"expectedRequestDigest"`
+}
+
+// PublicationState is the clean-room publication state.
+type PublicationState string
+
+const (
+	PublicationPreparing              PublicationState = "Preparing"
+	PublicationPrepared               PublicationState = "Prepared"
+	PublicationPublishing             PublicationState = "Publishing"
+	PublicationVerifying              PublicationState = "Verifying"
+	PublicationVerifiedExact          PublicationState = "VerifiedExact"
+	PublicationDeliveredSuperseded    PublicationState = "DeliveredSuperseded"
+	PublicationCancelledBeforePublish PublicationState = "CancelledBeforePublish"
+	PublicationDeliveryConflict       PublicationState = "DeliveryConflict"
+	PublicationCredentialBlocked      PublicationState = "CredentialBlocked"
+	PublicationPreparationFailed      PublicationState = "PreparationFailed"
+	PublicationOutcomeUnknown         PublicationState = "PublicationOutcomeUnknown"
+)
+
+var publicationTransitions = map[PublicationState]map[PublicationState]struct{}{
+	PublicationPreparing: {
+		PublicationPrepared: {}, PublicationCredentialBlocked: {}, PublicationPreparationFailed: {}, PublicationDeliveryConflict: {}, PublicationOutcomeUnknown: {},
+	},
+	PublicationPrepared: {
+		PublicationPublishing: {}, PublicationCancelledBeforePublish: {},
+	},
+	PublicationPublishing: {
+		PublicationVerifying: {}, PublicationOutcomeUnknown: {},
+	},
+	PublicationVerifying: {
+		PublicationVerifiedExact: {}, PublicationDeliveredSuperseded: {}, PublicationDeliveryConflict: {}, PublicationOutcomeUnknown: {},
+	},
+}
+
+// IsKnownPublicationState reports whether state is supported.
+func IsKnownPublicationState(state PublicationState) bool {
+	switch state {
+	case PublicationPreparing, PublicationPrepared, PublicationPublishing, PublicationVerifying,
+		PublicationVerifiedExact, PublicationDeliveredSuperseded,
+		PublicationCancelledBeforePublish, PublicationDeliveryConflict,
+		PublicationCredentialBlocked, PublicationPreparationFailed, PublicationOutcomeUnknown:
+		return true
+	default:
+		return false
+	}
+}
+
+// IsTerminalPublicationState reports whether publication reconciliation is resolved or terminally ambiguous.
+func IsTerminalPublicationState(state PublicationState) bool {
+	switch state {
+	case PublicationVerifiedExact, PublicationDeliveredSuperseded,
+		PublicationCancelledBeforePublish, PublicationDeliveryConflict,
+		PublicationCredentialBlocked, PublicationPreparationFailed, PublicationOutcomeUnknown:
+		return true
+	default:
+		return false
+	}
+}
+
+// ValidatePublicationTransition validates the clean-room state machine.
+func ValidatePublicationTransition(from, to PublicationState) error {
+	if !IsKnownPublicationState(from) {
+		return ValidationErrorf("unsupported publication state %q", from)
+	}
+	if !IsKnownPublicationState(to) {
+		return ValidationErrorf("unsupported publication state %q", to)
+	}
+	if _, ok := publicationTransitions[from][to]; !ok {
+		return ValidationErrorf("publication transition %s -> %s is not allowed", from, to)
+	}
+	return nil
+}
+
+// PullRequestIntent is the exact forge identity persisted before a call.
+type PullRequestIntent struct {
+	BaseRepositoryID      string `json:"baseRepositoryId"`
+	BaseRef               string `json:"baseRef"`
+	HeadRepositoryID      string `json:"headRepositoryId"`
+	HeadRef               string `json:"headRef"`
+	PublicationGeneration int64  `json:"publicationGeneration"`
+	ExpectedHeadSHA       string `json:"expectedHeadSha"`
+}
+
+// PreparedPublicationReceipt is the deterministic prepare result.
+
+const PreparedBundleMediaType = "application/vnd.orka.git-bundle.v1"
+
+type PreparedPublicationReceipt struct {
+	OperationID      string    `json:"operationId"`
+	RequestDigest    string    `json:"requestDigest"`
+	TreeSHA          string    `json:"treeSha"`
+	CommitSHA        string    `json:"commitSha"`
+	ManifestDigest   string    `json:"manifestDigest"`
+	RelativeRoot     string    `json:"relativeRoot,omitempty"`
+	BundleArtifactID string    `json:"bundleArtifactId"`
+	BundleDigest     string    `json:"bundleDigest"`
+	BundleSizeBytes  int64     `json:"bundleSizeBytes"`
+	BundleMediaType  string    `json:"bundleMediaType"`
+	BundleRef        string    `json:"bundleRef"`
+	PreparedAt       time.Time `json:"preparedAt"`
+}
+
+// PublishOperationReceipt records the exact server-enforced ref CAS request.
+type PublishOperationReceipt struct {
+	OperationID            string         `json:"operationId"`
+	RequestDigest          string         `json:"requestDigest"`
+	TargetRepositoryID     string         `json:"targetRepositoryId"`
+	TargetRef              string         `json:"targetRef"`
+	RemoteBefore           RemoteRefState `json:"remoteBefore"`
+	ExpectedCommitSHA      string         `json:"expectedCommitSha"`
+	AcknowledgementUnknown bool           `json:"acknowledgementUnknown"`
+	PublishedAt            time.Time      `json:"publishedAt"`
+}
+
+// PublicationVerificationReceipt is an independently observed remote receipt.
+type PublicationVerificationReceipt struct {
+	OperationID           string           `json:"operationId"`
+	RequestDigest         string           `json:"requestDigest"`
+	Outcome               PublicationState `json:"outcome"`
+	ExpectedCommitSHA     string           `json:"expectedCommitSha"`
+	ObservedRemote        RemoteRefState   `json:"observedRemote"`
+	DescendantProofDigest string           `json:"descendantProofDigest,omitempty"`
+	VerifiedAt            time.Time        `json:"verifiedAt"`
+}
+
+// PublicationReceipt is the immutable receipt snapshot used by SessionTurn finalization.
+type PublicationReceipt struct {
+	PublicationID string                          `json:"publicationId"`
+	Generation    int64                           `json:"generation"`
+	State         PublicationState                `json:"state"`
+	Prepared      *PreparedPublicationReceipt     `json:"prepared,omitempty"`
+	Publish       *PublishOperationReceipt        `json:"publish,omitempty"`
+	Verification  *PublicationVerificationReceipt `json:"verification,omitempty"`
+	PullRequest   *PullRequestOperationReceipt    `json:"pullRequest,omitempty"`
+}
+
+// PullRequestOperationReceipt snapshots the exact forge reconciliation result.
+type PullRequestOperationReceipt struct {
+	OperationID   string    `json:"operationId"`
+	RequestDigest string    `json:"requestDigest"`
+	IntentKey     string    `json:"intentKey"`
+	ForgeID       string    `json:"forgeId"`
+	URL           string    `json:"url"`
+	State         string    `json:"state"`
+	HeadSHA       string    `json:"headSha"`
+	ReconciledAt  time.Time `json:"reconciledAt"`
+}
+
+// Publication is the durable clean-room publication aggregate.
+type Publication struct {
+	ID                       string                          `json:"id"`
+	Namespace                string                          `json:"namespace"`
+	Generation               int64                           `json:"generation"`
+	TaskUID                  string                          `json:"taskUid"`
+	Attempt                  int64                           `json:"attempt"`
+	PromptID                 string                          `json:"promptId"`
+	SessionUID               string                          `json:"sessionUid,omitempty"`
+	BranchClaimID            string                          `json:"branchClaimId"`
+	BranchClaimGeneration    int64                           `json:"branchClaimGeneration"`
+	SourceRepositoryID       string                          `json:"sourceRepositoryId"`
+	SourceRef                string                          `json:"sourceRef"`
+	SourceBaselineSHA        string                          `json:"sourceBaselineSha"`
+	TargetRepositoryID       string                          `json:"targetRepositoryId"`
+	TargetRef                string                          `json:"targetRef"`
+	Baseline                 RemoteRefState                  `json:"baseline"`
+	ArtifactID               string                          `json:"artifactId"`
+	ArtifactDigest           string                          `json:"artifactDigest"`
+	ArtifactSizeBytes        int64                           `json:"artifactSizeBytes"`
+	ArtifactMediaType        string                          `json:"artifactMediaType"`
+	PublicationCredentialRef string                          `json:"publicationCredentialRef"`
+	CommitIdentity           string                          `json:"commitIdentity"`
+	CommitMessage            string                          `json:"commitMessage"`
+	CommitTimestamp          time.Time                       `json:"commitTimestamp"`
+	PRIntent                 *PullRequestIntent              `json:"prIntent,omitempty"`
+	RequestDigest            string                          `json:"requestDigest"`
+	State                    PublicationState                `json:"state"`
+	PreparedReceipt          *PreparedPublicationReceipt     `json:"preparedReceipt,omitempty"`
+	PublishReceipt           *PublishOperationReceipt        `json:"publishReceipt,omitempty"`
+	VerificationReceipt      *PublicationVerificationReceipt `json:"verificationReceipt,omitempty"`
+	PullRequestReceipt       *PullRequestOperationReceipt    `json:"pullRequestReceipt,omitempty"`
+	TerminalReason           string                          `json:"terminalReason,omitempty"`
+	ControllerEpochName      string                          `json:"controllerEpochName"`
+	ControllerEpoch          int64                           `json:"controllerEpoch"`
+	LastOperationID          string                          `json:"lastOperationId,omitempty"`
+	LastOperationDigest      string                          `json:"lastOperationDigest,omitempty"`
+	Version                  int64                           `json:"version"`
+	CreatedAt                time.Time                       `json:"createdAt"`
+	UpdatedAt                time.Time                       `json:"updatedAt"`
+}
+
+// PublicationTransition performs an exact generation/version/state CAS and
+// persists the receipt required by the destination state.
+type PublicationTransition struct {
+	ID                  string                          `json:"id"`
+	Fence               ControllerEpochFence            `json:"fence"`
+	ExpectedVersion     int64                           `json:"expectedVersion"`
+	ExpectedGeneration  int64                           `json:"expectedGeneration"`
+	ExpectedState       PublicationState                `json:"expectedState"`
+	NewState            PublicationState                `json:"newState"`
+	OperationID         string                          `json:"operationId"`
+	OperationDigest     string                          `json:"operationDigest"`
+	PreparedReceipt     *PreparedPublicationReceipt     `json:"preparedReceipt,omitempty"`
+	PublishReceipt      *PublishOperationReceipt        `json:"publishReceipt,omitempty"`
+	VerificationReceipt *PublicationVerificationReceipt `json:"verificationReceipt,omitempty"`
+	TerminalReason      string                          `json:"terminalReason,omitempty"`
+	UpdatedAt           time.Time                       `json:"updatedAt"`
+}
+
+// SetPublicationPRIntentRequest persists the exact forge tuple after the
+// deterministic commit SHA is known and before any forge API call.
+type SetPublicationPRIntentRequest struct {
+	ID                 string               `json:"id"`
+	Fence              ControllerEpochFence `json:"fence"`
+	ExpectedVersion    int64                `json:"expectedVersion"`
+	ExpectedGeneration int64                `json:"expectedGeneration"`
+	ExpectedState      PublicationState     `json:"expectedState"`
+	Intent             PullRequestIntent    `json:"intent"`
+	OperationID        string               `json:"operationId"`
+	OperationDigest    string               `json:"operationDigest"`
+	UpdatedAt          time.Time            `json:"updatedAt"`
+}
+
+// SetPublicationPRReceiptRequest commits the exact forge receipt while the
+// Publication remains Verifying and before terminal status is exposed.
+type SetPublicationPRReceiptRequest struct {
+	ID                 string                      `json:"id"`
+	Fence              ControllerEpochFence        `json:"fence"`
+	ExpectedVersion    int64                       `json:"expectedVersion"`
+	ExpectedGeneration int64                       `json:"expectedGeneration"`
+	ExpectedState      PublicationState            `json:"expectedState"`
+	Receipt            PullRequestOperationReceipt `json:"receipt"`
+	OperationID        string                      `json:"operationId"`
+	OperationDigest    string                      `json:"operationDigest"`
+	UpdatedAt          time.Time                   `json:"updatedAt"`
+}
+
+// ExternalEffectState is the durable state of an idempotent external effect.
+type ExternalEffectState string
+
+const (
+	ExternalEffectPending        ExternalEffectState = "Pending"
+	ExternalEffectInFlight       ExternalEffectState = "InFlight"
+	ExternalEffectSucceeded      ExternalEffectState = "Succeeded"
+	ExternalEffectFailed         ExternalEffectState = "Failed"
+	ExternalEffectOutcomeUnknown ExternalEffectState = "OutcomeUnknown"
+)
+
+// ExternalEffectIdentity is a canonical effect identity. The operation ID must
+// never be reused for different input.
+type ExternalEffectIdentity struct {
+	Kind        string `json:"kind"`
+	Namespace   string `json:"namespace"`
+	AggregateID string `json:"aggregateId"`
+	OperationID string `json:"operationId"`
+}
+
+// CanonicalID returns a stable effect identity.
+func (i ExternalEffectIdentity) CanonicalID() (string, error) {
+	if err := i.Validate(); err != nil {
+		return "", err
+	}
+	return CanonicalControlID("external-effect", i.Kind, i.Namespace, i.AggregateID, i.OperationID), nil
+}
+
+// Validate validates the external effect identity.
+func (i ExternalEffectIdentity) Validate() error {
+	if err := validateControlIdentifier("external effect kind", i.Kind); err != nil {
+		return err
+	}
+	if err := validateControlIdentifier("external effect namespace", i.Namespace); err != nil {
+		return err
+	}
+	if err := validateControlIdentifier("external effect aggregate ID", i.AggregateID); err != nil {
+		return err
+	}
+	return validateControlIdentifier("external effect operation ID", i.OperationID)
+}
+
+// ExternalEffect is the durable idempotency record for one external effect.
+type ExternalEffect struct {
+	ID                  string                 `json:"id"`
+	Identity            ExternalEffectIdentity `json:"identity"`
+	RequestDigest       string                 `json:"requestDigest"`
+	State               ExternalEffectState    `json:"state"`
+	ResponseDigest      string                 `json:"responseDigest,omitempty"`
+	Response            json.RawMessage        `json:"response,omitempty"`
+	LeaseOwner          string                 `json:"leaseOwner,omitempty"`
+	LeaseExpiresAt      *time.Time             `json:"leaseExpiresAt,omitempty"`
+	Attempts            int64                  `json:"attempts"`
+	ControllerEpochName string                 `json:"controllerEpochName"`
+	ControllerEpoch     int64                  `json:"controllerEpoch"`
+	Version             int64                  `json:"version"`
+	CreatedAt           time.Time              `json:"createdAt"`
+	UpdatedAt           time.Time              `json:"updatedAt"`
+}
+
+// ReserveExternalEffectRequest creates or returns the same-digest identity.
+type ReserveExternalEffectRequest struct {
+	Identity      ExternalEffectIdentity `json:"identity"`
+	RequestDigest string                 `json:"requestDigest"`
+	Fence         ControllerEpochFence   `json:"fence"`
+	CreatedAt     time.Time              `json:"createdAt"`
+}
+
+// ExternalEffectTransition performs a version/state CAS.
+type ExternalEffectTransition struct {
+	ID                 string               `json:"id"`
+	Fence              ControllerEpochFence `json:"fence"`
+	ExpectedVersion    int64                `json:"expectedVersion"`
+	ExpectedState      ExternalEffectState  `json:"expectedState"`
+	NewState           ExternalEffectState  `json:"newState"`
+	RequestDigest      string               `json:"requestDigest"`
+	ResponseDigest     string               `json:"responseDigest,omitempty"`
+	Response           json.RawMessage      `json:"response,omitempty"`
+	ExpectedLeaseOwner string               `json:"expectedLeaseOwner,omitempty"`
+	LeaseOwner         string               `json:"leaseOwner,omitempty"`
+	LeaseExpiresAt     *time.Time           `json:"leaseExpiresAt,omitempty"`
+	UpdatedAt          time.Time            `json:"updatedAt"`
+}
+
+// OutboxProjectionState is the restart-safe projection delivery state.
+type OutboxProjectionState string
+
+const (
+	OutboxProjectionPending    OutboxProjectionState = "Pending"
+	OutboxProjectionDelivering OutboxProjectionState = "Delivering"
+	OutboxProjectionDelivered  OutboxProjectionState = "Delivered"
+	OutboxProjectionDeadLetter OutboxProjectionState = "DeadLetter"
+)
+
+// OutboxProjection is one durable transactional-outbox record.
+type OutboxProjection struct {
+	ID                  string                `json:"id"`
+	AggregateKind       string                `json:"aggregateKind"`
+	AggregateID         string                `json:"aggregateId"`
+	ProjectionKind      string                `json:"projectionKind"`
+	PayloadDigest       string                `json:"payloadDigest"`
+	Payload             json.RawMessage       `json:"payload"`
+	State               OutboxProjectionState `json:"state"`
+	Attempts            int64                 `json:"attempts"`
+	InitialAvailableAt  time.Time             `json:"initialAvailableAt"`
+	AvailableAt         time.Time             `json:"availableAt"`
+	LeaseOwner          string                `json:"leaseOwner,omitempty"`
+	LeaseExpiresAt      *time.Time            `json:"leaseExpiresAt,omitempty"`
+	DeliveryDigest      string                `json:"deliveryDigest,omitempty"`
+	LastError           string                `json:"lastError,omitempty"`
+	LastOperationID     string                `json:"lastOperationId,omitempty"`
+	LastOperationDigest string                `json:"lastOperationDigest,omitempty"`
+	ControllerEpochName string                `json:"controllerEpochName"`
+	ControllerEpoch     int64                 `json:"controllerEpoch"`
+	Version             int64                 `json:"version"`
+	CreatedAt           time.Time             `json:"createdAt"`
+	UpdatedAt           time.Time             `json:"updatedAt"`
+	DeliveredAt         *time.Time            `json:"deliveredAt,omitempty"`
+}
+
+// ClaimOutboxProjectionsRequest leases due projection records.
+type ClaimOutboxProjectionsRequest struct {
+	Fence         ControllerEpochFence `json:"fence"`
+	WorkerID      string               `json:"workerId"`
+	Limit         int                  `json:"limit"`
+	LeaseDuration time.Duration        `json:"leaseDuration"`
+	Now           time.Time            `json:"now"`
+}
+
+// CompleteOutboxProjectionRequest completes, retries, or dead-letters an exact lease.
+type CompleteOutboxProjectionRequest struct {
+	ID              string                `json:"id"`
+	Fence           ControllerEpochFence  `json:"fence"`
+	ExpectedVersion int64                 `json:"expectedVersion"`
+	LeaseOwner      string                `json:"leaseOwner"`
+	OperationID     string                `json:"operationId"`
+	OperationDigest string                `json:"operationDigest"`
+	NewState        OutboxProjectionState `json:"newState"`
+	DeliveryDigest  string                `json:"deliveryDigest,omitempty"`
+	LastError       string                `json:"lastError,omitempty"`
+	AvailableAt     time.Time             `json:"availableAt,omitempty"`
+	UpdatedAt       time.Time             `json:"updatedAt"`
+}
+
+// CanonicalControlID derives a domain-separated stable identifier from exact
+// length-prefixed components. It does not normalize components.
+func SessionMutationLeaseRequestDigest(
+	sessionUID string,
+	leaseGeneration int64,
+	taskUID string,
+	attempt int64,
+	promptID string,
+	promptRequestDigest string,
+) (string, error) {
+	key := SessionTurnKey{
+		SessionUID: sessionUID, LeaseGeneration: leaseGeneration,
+		TaskUID: taskUID, Attempt: attempt, PromptID: promptID,
+	}
+	if err := key.Validate(); err != nil {
+		return "", err
+	}
+	if err := ValidateCanonicalDigest("prompt request digest", promptRequestDigest); err != nil {
+		return "", err
+	}
+	canonical, err := json.Marshal(map[string]any{
+		"sessionUID": sessionUID, "leaseGeneration": leaseGeneration,
+		"taskUID": taskUID, "attempt": attempt, "promptID": promptID,
+		"promptRequestDigest": promptRequestDigest,
+	})
+	if err != nil {
+		return "", err
+	}
+	hash := sha256.New()
+	_, _ = hash.Write([]byte("orka.acp.session-mutation-lease\x00"))
+	_, _ = hash.Write(canonical)
+	return "sha256:" + hex.EncodeToString(hash.Sum(nil)), nil
+}
+
+func SessionLeaseReleaseOperationDigest(turnID, leaseRequestDigest string) (string, error) {
+	turnID = strings.TrimSpace(turnID)
+	if err := ValidateControlIdentifier("session turn ID", turnID); err != nil {
+		return "", err
+	}
+	if err := ValidateCanonicalDigest("session lease request digest", leaseRequestDigest); err != nil {
+		return "", err
+	}
+	canonical, err := json.Marshal(map[string]string{
+		"leaseRequestDigest": leaseRequestDigest,
+		"turnID":             turnID,
+	})
+	if err != nil {
+		return "", err
+	}
+	hash := sha256.New()
+	_, _ = hash.Write([]byte("orka.acp.session-lease-release\x00"))
+	_, _ = hash.Write(canonical)
+	return "sha256:" + hex.EncodeToString(hash.Sum(nil)), nil
+}
+
+func CanonicalControlID(kind string, components ...string) string {
+	h := sha256.New()
+	writeCanonicalComponent(h, kind)
+	for _, component := range components {
+		writeCanonicalComponent(h, component)
+	}
+	return kind + ":sha256:" + hex.EncodeToString(h.Sum(nil))
+}
+
+type canonicalWriter interface {
+	Write([]byte) (int, error)
+}
+
+func writeCanonicalComponent(w canonicalWriter, value string) {
+	_, _ = fmt.Fprintf(w, "%d:", len(value))
+	_, _ = w.Write([]byte(value))
+}
+
+// ValidateCanonicalDigest requires a lowercase full-entropy SHA-256 digest.
+func ValidateCanonicalDigest(field, value string) error {
+	if !strings.HasPrefix(value, "sha256:") || len(value) != len("sha256:")+sha256.Size*2 {
+		return ValidationErrorf("%s must be a canonical sha256 digest", field)
+	}
+	encoded := strings.TrimPrefix(value, "sha256:")
+	if strings.ToLower(encoded) != encoded {
+		return ValidationErrorf("%s must use lowercase hexadecimal", field)
+	}
+	if _, err := hex.DecodeString(encoded); err != nil {
+		return ValidationErrorf("%s must be a canonical sha256 digest", field)
+	}
+	return nil
+}
+
+// ValidateGitObjectID accepts canonical lowercase SHA-1 or SHA-256 Git object IDs.
+func ValidateGitObjectID(field, value string) error {
+	if len(value) != 40 && len(value) != 64 {
+		return ValidationErrorf("%s must be a 40- or 64-character Git object ID", field)
+	}
+	if strings.ToLower(value) != value {
+		return ValidationErrorf("%s must use lowercase hexadecimal", field)
+	}
+	if _, err := hex.DecodeString(value); err != nil {
+		return ValidationErrorf("%s must be a hexadecimal Git object ID", field)
+	}
+	return nil
+}
+
+// ValidateFullBranchRef requires a canonical full branch ref.
+func ValidateFullBranchRef(ref string) error {
+	if err := validateControlIdentifier("branch ref", ref); err != nil {
+		return err
+	}
+	if !strings.HasPrefix(ref, "refs/heads/") || len(ref) == len("refs/heads/") {
+		return ValidationErrorf("branch ref must be a full refs/heads/<branch> ref")
+	}
+	if strings.Contains(ref, "..") || strings.Contains(ref, "@{") || strings.ContainsAny(ref, " ~^:?*[\\") || strings.HasSuffix(ref, ".") || strings.HasSuffix(ref, "/") || strings.Contains(ref, "//") {
+		return ValidationErrorf("branch ref %q is not canonical", ref)
+	}
+	return nil
+}
+
+// ValidateWorkspaceRelativeRoot requires a bounded canonical repository-relative path.
+func ValidateWorkspaceRelativeRoot(value string) error {
+	if value == "" || value == "." {
+		return nil
+	}
+	if value != strings.TrimSpace(value) || len(value) > maxControlIdentifierBytes || path.IsAbs(value) || strings.Contains(value, `\`) {
+		return ValidationErrorf("workspace relative root is not canonical")
+	}
+	clean := path.Clean(value)
+	if clean != value || clean == ".." || strings.HasPrefix(clean, "../") {
+		return ValidationErrorf("workspace relative root is not canonical")
+	}
+	return nil
+}
+
+// ValidateControlIdentifier validates a bounded, exact, non-control identifier.
+func ValidateControlIdentifier(field, value string) error {
+	return validateControlIdentifier(field, value)
+}
+
+// ValidateControlReason validates a bounded human-readable reason.
+func ValidateControlReason(field, value string) error {
+	return validateControlReason(field, value)
+}
+
+// ValidateControlPayload validates bounded JSON used in durable control records.
+func ValidateControlPayload(field string, payload []byte) error {
+	return validateControlPayload(field, payload)
+}
+
+// ValidateControlText validates bounded UTF-8 prompt/result content.
+func ValidateControlText(field, value string) error {
+	if len(value) > maxControlTextBytes {
+		return ValidationErrorf("%s exceeds %d bytes", field, maxControlTextBytes)
+	}
+	if !utf8.ValidString(value) {
+		return ValidationErrorf("%s must be valid UTF-8", field)
+	}
+	return nil
+}
+
+func validateControlIdentifier(field, value string) error {
+	if value == "" {
+		return ValidationErrorf("%s is required", field)
+	}
+	if strings.TrimSpace(value) != value {
+		return ValidationErrorf("%s must not contain surrounding whitespace", field)
+	}
+	if len(value) > maxControlIdentifierBytes {
+		return ValidationErrorf("%s exceeds %d bytes", field, maxControlIdentifierBytes)
+	}
+	if !utf8.ValidString(value) {
+		return ValidationErrorf("%s must be valid UTF-8", field)
+	}
+	for _, r := range value {
+		if r < 0x20 || r == 0x7f {
+			return ValidationErrorf("%s contains a control character", field)
+		}
+	}
+	return nil
+}
+
+func validateControlReason(field, value string) error {
+	if len(value) > maxControlReasonBytes {
+		return ValidationErrorf("%s exceeds %d bytes", field, maxControlReasonBytes)
+	}
+	if !utf8.ValidString(value) {
+		return ValidationErrorf("%s must be valid UTF-8", field)
+	}
+	return nil
+}
+
+func validateControlPayload(field string, payload []byte) error {
+	if len(payload) == 0 {
+		return ValidationErrorf("%s is required", field)
+	}
+	if len(payload) > maxControlPayloadBytes {
+		return ValidationErrorf("%s exceeds %d bytes", field, maxControlPayloadBytes)
+	}
+	if !json.Valid(payload) {
+		return ValidationErrorf("%s must be valid JSON", field)
+	}
+	return nil
+}
diff --git a/internal/store/control_types_test.go b/internal/store/control_types_test.go
new file mode 100644
index 000000000..594d58cb0
--- /dev/null
+++ b/internal/store/control_types_test.go
@@ -0,0 +1,124 @@
+package store
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"testing"
+)
+
+func testControlDigest(value string) string {
+	sum := sha256.Sum256([]byte(value))
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
+
+func TestPromptExecutionStateMachineIncludesAmbiguousSubmission(t *testing.T) {
+	valid := [][2]PromptExecutionState{
+		{PromptExecutionQueued, PromptExecutionReserved},
+		{PromptExecutionReserved, PromptExecutionSessionStarting},
+		{PromptExecutionSessionStarting, PromptExecutionPlanned},
+		{PromptExecutionPlanned, PromptExecutionSubmitting},
+		{PromptExecutionSubmitting, PromptExecutionSubmittedUnknown},
+		{PromptExecutionSubmittedUnknown, PromptExecutionOutcomeUnknown},
+		{PromptExecutionSubmitting, PromptExecutionAccepted},
+		{PromptExecutionAccepted, PromptExecutionRunning},
+		{PromptExecutionRunning, PromptExecutionSettling},
+		{PromptExecutionSettling, PromptExecutionSucceeded},
+	}
+	for _, transition := range valid {
+		if err := ValidatePromptExecutionTransition(transition[0], transition[1]); err != nil {
+			t.Fatalf("transition %s -> %s: %v", transition[0], transition[1], err)
+		}
+	}
+	invalid := [][2]PromptExecutionState{
+		{PromptExecutionSubmittedUnknown, PromptExecutionSubmitting},
+		{PromptExecutionOutcomeUnknown, PromptExecutionQueued},
+		{PromptExecutionSucceeded, PromptExecutionRunning},
+		{PromptExecutionQueued, PromptExecutionAccepted},
+	}
+	for _, transition := range invalid {
+		if err := ValidatePromptExecutionTransition(transition[0], transition[1]); !errors.Is(err, ErrValidation) {
+			t.Fatalf("transition %s -> %s error = %v, want ErrValidation", transition[0], transition[1], err)
+		}
+	}
+	if !IsTerminalPromptExecutionState(PromptExecutionOutcomeUnknown) {
+		t.Fatalf("OutcomeUnknown must be terminal")
+	}
+}
+
+func TestDeliveryAndPublicationCASRaceStateMachines(t *testing.T) {
+	for _, transition := range [][2]PromptDeliveryState{
+		{PromptDeliveryNotRequested, PromptDeliveryValidating},
+		{PromptDeliveryValidating, PromptDeliveryPreparing},
+		{PromptDeliveryValidating, PromptDeliveryPublicationOutcomeUnknown},
+		{PromptDeliveryPreparing, PromptDeliveryPrepared},
+		{PromptDeliveryPrepared, PromptDeliveryPublishing},
+		{PromptDeliveryPrepared, PromptDeliveryCancelledBeforePublish},
+		{PromptDeliveryPublishing, PromptDeliveryVerifying},
+		{PromptDeliveryVerifying, PromptDeliveryVerifiedExact},
+		{PromptDeliveryVerifying, PromptDeliveryPublicationOutcomeUnknown},
+	} {
+		if err := ValidatePromptDeliveryTransition(transition[0], transition[1]); err != nil {
+			t.Fatalf("delivery %s -> %s: %v", transition[0], transition[1], err)
+		}
+	}
+	if err := ValidatePromptDeliveryTransition(PromptDeliveryCancelledBeforePublish, PromptDeliveryPublishing); !errors.Is(err, ErrValidation) {
+		t.Fatalf("cancelled delivery became publishable: %v", err)
+	}
+
+	for _, transition := range [][2]PublicationState{
+		{PublicationPreparing, PublicationPrepared},
+		{PublicationPrepared, PublicationPublishing},
+		{PublicationPrepared, PublicationCancelledBeforePublish},
+		{PublicationPublishing, PublicationVerifying},
+		{PublicationVerifying, PublicationVerifiedExact},
+		{PublicationVerifying, PublicationDeliveredSuperseded},
+		{PublicationVerifying, PublicationDeliveryConflict},
+		{PublicationVerifying, PublicationOutcomeUnknown},
+	} {
+		if err := ValidatePublicationTransition(transition[0], transition[1]); err != nil {
+			t.Fatalf("publication %s -> %s: %v", transition[0], transition[1], err)
+		}
+	}
+	if err := ValidatePublicationTransition(PublicationCancelledBeforePublish, PublicationPublishing); !errors.Is(err, ErrValidation) {
+		t.Fatalf("cancelled publication became publishable: %v", err)
+	}
+}
+
+func TestCanonicalControlIdentifiersAreLengthDelimited(t *testing.T) {
+	a := CanonicalControlID("kind", "ab", "c")
+	b := CanonicalControlID("kind", "a", "bc")
+	if a == b {
+		t.Fatalf("length-delimited identities collided: %q", a)
+	}
+	key := PromptAttemptKey{Namespace: "ns", TaskUID: "task-uid", Attempt: 2, PromptID: "prompt"}
+	id1, err := key.CanonicalID()
+	if err != nil {
+		t.Fatalf("CanonicalID: %v", err)
+	}
+	id2, err := key.CanonicalID()
+	if err != nil || id1 != id2 {
+		t.Fatalf("canonical prompt ID is unstable: %q %q %v", id1, id2, err)
+	}
+}
+
+func TestCanonicalDigestAndRemoteRefValidation(t *testing.T) {
+	if err := ValidateCanonicalDigest("request", testControlDigest("request")); err != nil {
+		t.Fatalf("canonical digest: %v", err)
+	}
+	if err := ValidateCanonicalDigest("request", "sha256:ABC"); !errors.Is(err, ErrValidation) {
+		t.Fatalf("invalid digest error = %v", err)
+	}
+	if err := (RemoteRefState{Absent: true}).Validate("remote"); err != nil {
+		t.Fatalf("absent remote: %v", err)
+	}
+	if err := (RemoteRefState{SHA: "0123456789012345678901234567890123456789"}).Validate("remote"); err != nil {
+		t.Fatalf("SHA remote: %v", err)
+	}
+	if err := (RemoteRefState{}).Validate("remote"); !errors.Is(err, ErrValidation) {
+		t.Fatalf("unknown remote accepted: %v", err)
+	}
+	if err := (RemoteRefState{Absent: true, SHA: "0123456789012345678901234567890123456789"}).Validate("remote"); !errors.Is(err, ErrValidation) {
+		t.Fatalf("ambiguous remote accepted: %v", err)
+	}
+}
diff --git a/internal/store/kube/branch_claim.go b/internal/store/kube/branch_claim.go
new file mode 100644
index 000000000..5561d9938
--- /dev/null
+++ b/internal/store/kube/branch_claim.go
@@ -0,0 +1,485 @@
+package kube
+
+import (
+	"context"
+	"errors"
+	"strings"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+var _ store.BranchClaimCreationStore = (*Store)(nil)
+
+// CreateBranchClaim creates the cluster-scoped canonical repository/ref claim.
+func (s *Store) CreateBranchClaim(ctx context.Context, claim *store.BranchClaim, fence store.ControllerEpochFence) (*store.BranchClaim, error) {
+	created, _, err := s.CreateBranchClaimWithResult(ctx, claim, fence)
+	return created, err
+}
+
+// CreateBranchClaimWithResult reports true only when this call created the
+// immutable Kubernetes object rather than observing an existing equivalent.
+func (s *Store) CreateBranchClaimWithResult(ctx context.Context, claim *store.BranchClaim, fence store.ControllerEpochFence) (*store.BranchClaim, bool, error) {
+	if err := s.requireClient(); err != nil {
+		return nil, false, err
+	}
+	if err := s.requireBranchClaimAccess(); err != nil {
+		return nil, false, err
+	}
+	normalized, normalizedFence, err := normalizeBranchClaimForCreate(claim, fence)
+	if err != nil {
+		return nil, false, err
+	}
+	_, snapshot, err := s.requireControllerEpoch(ctx, normalizedFence)
+	if err != nil {
+		return nil, false, err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	if normalized.OwnerKind == store.BranchClaimOwnerSession {
+		fenced, fenceErr := s.sessionCleanupFencedForUID(ctx, normalized.OwnerUID)
+		if fenceErr != nil {
+			return nil, false, fenceErr
+		}
+		if fenced {
+			return nil, false, controlConflict("Session UID %q is being deleted or was already deleted", normalized.OwnerUID)
+		}
+	}
+
+	key := client.ObjectKey{Name: objectName(branchClaimNamePrefix, normalized.ID)}
+	object := &corev1alpha1.BranchClaim{}
+	err = s.readClient().Get(ctx, key, object)
+	if err == nil {
+		result, completeErr := s.completeBranchClaimCreation(ctx, object, normalized, normalizedFence, snapshot)
+		return result, false, completeErr
+	}
+	if !apierrors.IsNotFound(err) {
+		return nil, false, mapKubernetesError("get branch claim", err)
+	}
+
+	object = &corev1alpha1.BranchClaim{
+		ObjectMeta: metav1.ObjectMeta{Name: key.Name, Labels: controlLabels(normalized.ID)},
+		Spec: corev1alpha1.BranchClaimSpec{
+			ID:            normalized.ID,
+			RepositoryID:  normalized.RepositoryID,
+			Ref:           normalized.Ref,
+			OwnerKind:     corev1alpha1.BranchClaimOwnerKind(normalized.OwnerKind),
+			OwnerUID:      normalized.OwnerUID,
+			RequestDigest: normalized.RequestDigest,
+		},
+	}
+	if createErr := s.client.Create(ctx, object); createErr != nil {
+		fresh := &corev1alpha1.BranchClaim{}
+		if getErr := s.readClient().Get(ctx, key, fresh); getErr == nil {
+			result, completeErr := s.completeBranchClaimCreation(ctx, fresh, normalized, normalizedFence, snapshot)
+			return result, false, completeErr
+		} else if apierrors.IsAlreadyExists(createErr) {
+			return nil, false, mapKubernetesError("get concurrently created branch claim", getErr)
+		}
+		return nil, false, mapKubernetesError("create branch claim", createErr)
+	}
+	result, completeErr := s.completeBranchClaimCreation(ctx, object, normalized, normalizedFence, snapshot)
+	return result, completeErr == nil, completeErr
+}
+
+// GetBranchClaim returns a cluster-scoped claim by canonical ID.
+func (s *Store) GetBranchClaim(ctx context.Context, id string) (*store.BranchClaim, error) {
+	if err := s.requireClient(); err != nil {
+		return nil, err
+	}
+	if err := s.requireBranchClaimAccess(); err != nil {
+		return nil, err
+	}
+	id = strings.TrimSpace(id)
+	if err := store.ValidateControlIdentifier("branch claim ID", id); err != nil {
+		return nil, err
+	}
+	object, err := s.getBranchClaimObject(ctx, id)
+	if err != nil {
+		return nil, err
+	}
+	result := branchClaimFromObject(object)
+	return &result, nil
+}
+
+// ReclaimBranchClaim deletes only the exact available owner-fenced object. UID
+// and resourceVersion preconditions close the read/delete race. Absence or a
+// different immutable owner/request identity means the original claim was
+// already reclaimed and possibly replaced, so the retry is a safe no-op.
+func (s *Store) ReclaimBranchClaim(ctx context.Context, request store.ReclaimBranchClaimRequest) error {
+	if err := s.requireClient(); err != nil {
+		return err
+	}
+	if err := s.requireBranchClaimAccess(); err != nil {
+		return err
+	}
+	normalized, err := normalizeBranchClaimReclamationRequest(request)
+	if err != nil {
+		return err
+	}
+	fence, snapshot, err := s.requireControllerEpoch(ctx, normalized.Fence)
+	if err != nil {
+		return err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	normalized.Fence = fence
+
+	object, err := s.getBranchClaimObject(ctx, normalized.ID)
+	if errors.Is(err, store.ErrNotFound) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	claim := branchClaimFromObject(object)
+	if branchClaimReclamationIdentityReplaced(claim, normalized) {
+		return nil
+	}
+	if !branchClaimMatchesReclamation(claim, normalized) {
+		return controlConflict("branch claim %q no longer matches the exact Task-owner reclamation fence", claim.ID)
+	}
+	uid := object.UID
+	resourceVersion := object.ResourceVersion
+	deleteErr := s.client.Delete(ctx, object, &client.DeleteOptions{Preconditions: &metav1.Preconditions{
+		UID: &uid, ResourceVersion: &resourceVersion,
+	}})
+	if deleteErr == nil || apierrors.IsNotFound(deleteErr) {
+		return nil
+	}
+	fresh, getErr := s.getBranchClaimObject(ctx, normalized.ID)
+	if errors.Is(getErr, store.ErrNotFound) {
+		return nil
+	}
+	if getErr == nil && branchClaimReclamationIdentityReplaced(branchClaimFromObject(fresh), normalized) {
+		return nil
+	}
+	if getErr != nil {
+		return getErr
+	}
+	return mapKubernetesError("delete reclaimed branch claim", deleteErr)
+}
+
+// CompareAndSwapBranchClaim applies exact version, generation, baseline,
+// availability, resourceVersion, and controller-epoch fences.
+func (s *Store) CompareAndSwapBranchClaim(ctx context.Context, change store.BranchClaimCAS) (*store.BranchClaim, error) {
+	if err := s.requireBranchClaimAccess(); err != nil {
+		return nil, err
+	}
+	change.ID = strings.TrimSpace(change.ID)
+	if err := store.ValidateControlIdentifier("branch claim ID", change.ID); err != nil {
+		return nil, err
+	}
+	fence, snapshot, err := s.requireControllerEpoch(ctx, change.Fence)
+	if err != nil {
+		return nil, err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	change.Fence = fence
+	if err := validateBranchClaimCAS(&change); err != nil {
+		return nil, err
+	}
+
+	object, err := s.getBranchClaimObject(ctx, change.ID)
+	if err != nil {
+		return nil, err
+	}
+	claim := branchClaimFromObject(object)
+	if claim.LastOperationID == change.OperationID {
+		if claim.LastOperationDigest != change.OperationDigest {
+			return nil, controlConflict("branch claim operation %q was reused with a different digest", change.OperationID)
+		}
+		if claim.Generation == change.NewGeneration && claim.LastVerified.Equal(change.NewLastVerified) && claim.Availability == change.NewAvailability && claim.BlockedReason == change.BlockedReason && claim.RelatedPublicationID == change.RelatedPublicationID {
+			return &claim, nil
+		}
+		return nil, controlConflict("branch claim operation %q was already applied with different target values", change.OperationID)
+	}
+	if claim.Version != change.ExpectedVersion || claim.Generation != change.ExpectedGeneration || !claim.LastVerified.Equal(change.ExpectedLastVerified) || claim.Availability != change.ExpectedAvailability {
+		return nil, controlConflict("branch claim %q no longer matches expected version, generation, baseline, or availability", claim.ID)
+	}
+
+	updated := object.DeepCopy()
+	updated.Status.Generation = change.NewGeneration
+	remote := remoteRefToAPI(change.NewLastVerified)
+	updated.Status.LastVerified = &remote
+	updated.Status.Availability = corev1alpha1.BranchClaimAvailability(change.NewAvailability)
+	updated.Status.BlockedReason = change.BlockedReason
+	updated.Status.RelatedPublicationID = change.RelatedPublicationID
+	setMutationStatus(&updated.Status.ControlRecordMutationStatus, fence, snapshot, claim.Version+1, change.OperationID, change.OperationDigest, claim.CreatedAt, change.UpdatedAt)
+	if err := s.client.Status().Update(ctx, updated); err != nil {
+		return nil, mapKubernetesError("compare-and-swap branch claim", err)
+	}
+	result := branchClaimFromObject(updated)
+	return &result, nil
+}
+
+func (s *Store) completeBranchClaimCreation(ctx context.Context, object *corev1alpha1.BranchClaim, normalized store.BranchClaim, fence store.ControllerEpochFence, snapshot epochSnapshot) (*store.BranchClaim, error) {
+	if !sameBranchClaimSpec(object, normalized) {
+		return nil, controlConflict("branch claim %q was reused with a different owner or request digest", normalized.ID)
+	}
+	if object.Status.Version > 0 {
+		existing := branchClaimFromObject(object)
+		return &existing, nil
+	}
+	updated := object.DeepCopy()
+	updated.Status.Generation = normalized.Generation
+	remote := remoteRefToAPI(normalized.LastVerified)
+	updated.Status.LastVerified = &remote
+	updated.Status.Availability = corev1alpha1.BranchClaimAvailability(normalized.Availability)
+	updated.Status.BlockedReason = normalized.BlockedReason
+	updated.Status.RelatedPublicationID = normalized.RelatedPublicationID
+	setMutationStatus(&updated.Status.ControlRecordMutationStatus, fence, snapshot, 1, "", "", normalized.CreatedAt, normalized.UpdatedAt)
+	if err := s.client.Status().Update(ctx, updated); err != nil {
+		if apierrors.IsConflict(err) {
+			fresh, getErr := s.getBranchClaimObject(ctx, normalized.ID)
+			if getErr == nil && sameBranchClaimSpec(fresh, normalized) && fresh.Status.Version > 0 {
+				result := branchClaimFromObject(fresh)
+				if result.LastVerified.Equal(normalized.LastVerified) {
+					return &result, nil
+				}
+			}
+		}
+		return nil, mapKubernetesError("initialize branch claim status", err)
+	}
+	result := branchClaimFromObject(updated)
+	return &result, nil
+}
+
+func (s *Store) getBranchClaimObject(ctx context.Context, id string) (*corev1alpha1.BranchClaim, error) {
+	if err := s.requireBranchClaimAccess(); err != nil {
+		return nil, err
+	}
+	object := &corev1alpha1.BranchClaim{}
+	key := client.ObjectKey{Name: objectName(branchClaimNamePrefix, id)}
+	if err := s.readClient().Get(ctx, key, object); err != nil {
+		return nil, mapKubernetesError("get branch claim", err)
+	}
+	if object.Spec.ID != id {
+		return nil, controlConflict("branch claim object %q has a different canonical ID", object.Name)
+	}
+	return object, nil
+}
+
+func normalizeBranchClaimForCreate(claim *store.BranchClaim, fence store.ControllerEpochFence) (store.BranchClaim, store.ControllerEpochFence, error) {
+	if claim == nil {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, store.ValidationErrorf("branch claim is required")
+	}
+	normalized := *claim
+	normalized.RepositoryID = strings.TrimSpace(normalized.RepositoryID)
+	normalized.Ref = strings.TrimSpace(normalized.Ref)
+	normalized.OwnerUID = strings.TrimSpace(normalized.OwnerUID)
+	if err := store.ValidateControlIdentifier("publication repository ID", normalized.RepositoryID); err != nil {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, err
+	}
+	if err := store.ValidateFullBranchRef(normalized.Ref); err != nil {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, err
+	}
+	canonicalID, err := store.CanonicalBranchClaimID(normalized.RepositoryID, normalized.Ref)
+	if err != nil {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, err
+	}
+	normalized.ID = strings.TrimSpace(normalized.ID)
+	if normalized.ID == "" {
+		normalized.ID = canonicalID
+	}
+	if normalized.ID != canonicalID {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, store.ValidationErrorf("branch claim ID must equal canonical ID %q", canonicalID)
+	}
+	if normalized.OwnerKind != store.BranchClaimOwnerTask && normalized.OwnerKind != store.BranchClaimOwnerSession {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, store.ValidationErrorf("unsupported branch claim owner kind %q", normalized.OwnerKind)
+	}
+	if err := store.ValidateControlIdentifier("branch claim owner UID", normalized.OwnerUID); err != nil {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, err
+	}
+	if normalized.Generation == 0 {
+		normalized.Generation = 1
+	}
+	if normalized.Generation != 1 {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, store.ValidationErrorf("new branch claim generation must be one")
+	}
+	if err := normalized.LastVerified.Validate("branch baseline"); err != nil {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, err
+	}
+	if normalized.Availability == "" {
+		normalized.Availability = store.BranchClaimAvailable
+	}
+	if !isKnownBranchClaimAvailability(normalized.Availability) {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, store.ValidationErrorf("unsupported branch claim availability %q", normalized.Availability)
+	}
+	normalized.BlockedReason = strings.TrimSpace(normalized.BlockedReason)
+	normalized.RelatedPublicationID = strings.TrimSpace(normalized.RelatedPublicationID)
+	if normalized.Availability == store.BranchClaimAvailable && (normalized.BlockedReason != "" || normalized.RelatedPublicationID != "") {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, store.ValidationErrorf("available branch claim must not have block metadata")
+	}
+	if normalized.Availability == store.BranchClaimReconciliationBlocked && normalized.BlockedReason == "" {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, store.ValidationErrorf("reconciliation-blocked branch claim requires a reason")
+	}
+	if err := store.ValidateControlReason("branch claim blocked reason", normalized.BlockedReason); err != nil {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, err
+	}
+	if err := store.ValidateCanonicalDigest("branch claim request digest", normalized.RequestDigest); err != nil {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, err
+	}
+	normalizedFence, err := normalizeEpochFence(fence)
+	if err != nil {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, err
+	}
+	if normalized.Version != 0 && normalized.Version != 1 {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, store.ValidationErrorf("new branch claim version must be zero or one")
+	}
+	now := normalizeControlTime(normalized.CreatedAt)
+	normalized.CreatedAt = now
+	if normalized.UpdatedAt.IsZero() {
+		normalized.UpdatedAt = now
+	} else {
+		normalized.UpdatedAt = normalized.UpdatedAt.UTC()
+	}
+	normalized.ControllerEpochName = normalizedFence.Name
+	normalized.ControllerEpoch = normalizedFence.Epoch
+	normalized.Version = 1
+	normalized.LastOperationID = ""
+	normalized.LastOperationDigest = ""
+	return normalized, normalizedFence, nil
+}
+
+func normalizeBranchClaimReclamationRequest(request store.ReclaimBranchClaimRequest) (store.ReclaimBranchClaimRequest, error) {
+	request.ID = strings.TrimSpace(request.ID)
+	request.ExpectedRepositoryID = strings.TrimSpace(request.ExpectedRepositoryID)
+	request.ExpectedRef = strings.TrimSpace(request.ExpectedRef)
+	request.ExpectedOwnerUID = strings.TrimSpace(request.ExpectedOwnerUID)
+	request.ExpectedRequestDigest = strings.TrimSpace(request.ExpectedRequestDigest)
+	if err := store.ValidateControlIdentifier("branch claim ID", request.ID); err != nil {
+		return store.ReclaimBranchClaimRequest{}, err
+	}
+	if err := store.ValidateControlIdentifier("publication repository ID", request.ExpectedRepositoryID); err != nil {
+		return store.ReclaimBranchClaimRequest{}, err
+	}
+	if err := store.ValidateFullBranchRef(request.ExpectedRef); err != nil {
+		return store.ReclaimBranchClaimRequest{}, err
+	}
+	canonicalID, err := store.CanonicalBranchClaimID(request.ExpectedRepositoryID, request.ExpectedRef)
+	if err != nil {
+		return store.ReclaimBranchClaimRequest{}, err
+	}
+	if request.ID != canonicalID {
+		return store.ReclaimBranchClaimRequest{}, store.ValidationErrorf("branch claim ID must equal canonical ID %q", canonicalID)
+	}
+	if request.ExpectedOwnerKind != store.BranchClaimOwnerTask && request.ExpectedOwnerKind != store.BranchClaimOwnerSession {
+		return store.ReclaimBranchClaimRequest{}, store.ValidationErrorf("branch claim owner kind is not reclaimable")
+	}
+	if err := store.ValidateControlIdentifier("branch claim owner UID", request.ExpectedOwnerUID); err != nil {
+		return store.ReclaimBranchClaimRequest{}, err
+	}
+	if request.ExpectedVersion < 1 || request.ExpectedGeneration < 1 {
+		return store.ReclaimBranchClaimRequest{}, store.ValidationErrorf("branch claim expected version and generation must be at least 1")
+	}
+	if err := request.ExpectedLastVerified.Validate("expected branch baseline"); err != nil {
+		return store.ReclaimBranchClaimRequest{}, err
+	}
+	if request.ExpectedAvailability != store.BranchClaimAvailable {
+		return store.ReclaimBranchClaimRequest{}, store.ValidationErrorf("only available branch claims may be reclaimed")
+	}
+	if err := store.ValidateCanonicalDigest("branch claim request digest", request.ExpectedRequestDigest); err != nil {
+		return store.ReclaimBranchClaimRequest{}, err
+	}
+	normalizedFence, err := normalizeEpochFence(request.Fence)
+	if err != nil {
+		return store.ReclaimBranchClaimRequest{}, err
+	}
+	request.Fence = normalizedFence
+	return request, nil
+}
+
+func branchClaimReclamationIdentityReplaced(claim store.BranchClaim, request store.ReclaimBranchClaimRequest) bool {
+	return claim.OwnerKind != request.ExpectedOwnerKind || claim.OwnerUID != request.ExpectedOwnerUID || claim.RequestDigest != request.ExpectedRequestDigest
+}
+
+func branchClaimMatchesReclamation(claim store.BranchClaim, request store.ReclaimBranchClaimRequest) bool {
+	return claim.ID == request.ID && claim.RepositoryID == request.ExpectedRepositoryID && claim.Ref == request.ExpectedRef &&
+		claim.OwnerKind == request.ExpectedOwnerKind && claim.OwnerUID == request.ExpectedOwnerUID &&
+		claim.Generation == request.ExpectedGeneration && claim.LastVerified.Equal(request.ExpectedLastVerified) &&
+		claim.Availability == request.ExpectedAvailability && claim.BlockedReason == "" && claim.RelatedPublicationID == "" &&
+		claim.RequestDigest == request.ExpectedRequestDigest && claim.Version == request.ExpectedVersion
+}
+
+func validateBranchClaimCAS(change *store.BranchClaimCAS) error {
+	if change.ExpectedVersion < 1 || change.ExpectedGeneration < 1 {
+		return store.ValidationErrorf("branch claim expected version and generation must be at least 1")
+	}
+	if change.NewGeneration != change.ExpectedGeneration && change.NewGeneration != change.ExpectedGeneration+1 {
+		return store.ValidationErrorf("branch claim generation may be preserved or incremented exactly by one")
+	}
+	if err := change.ExpectedLastVerified.Validate("expected branch baseline"); err != nil {
+		return err
+	}
+	if err := change.NewLastVerified.Validate("new branch baseline"); err != nil {
+		return err
+	}
+	if !isKnownBranchClaimAvailability(change.ExpectedAvailability) || !isKnownBranchClaimAvailability(change.NewAvailability) {
+		return store.ValidationErrorf("unsupported branch claim availability transition %q -> %q", change.ExpectedAvailability, change.NewAvailability)
+	}
+	change.BlockedReason = strings.TrimSpace(change.BlockedReason)
+	change.RelatedPublicationID = strings.TrimSpace(change.RelatedPublicationID)
+	if err := store.ValidateControlReason("branch claim blocked reason", change.BlockedReason); err != nil {
+		return err
+	}
+	if change.NewAvailability == store.BranchClaimAvailable && (change.BlockedReason != "" || change.RelatedPublicationID != "") {
+		return store.ValidationErrorf("available branch claim must clear blocked reason and related publication")
+	}
+	if change.NewAvailability == store.BranchClaimReconciliationBlocked && change.BlockedReason == "" {
+		return store.ValidationErrorf("reconciliation-blocked branch claim requires a reason")
+	}
+	change.OperationID = strings.TrimSpace(change.OperationID)
+	if err := store.ValidateControlIdentifier("branch claim operation ID", change.OperationID); err != nil {
+		return err
+	}
+	if err := store.ValidateCanonicalDigest("branch claim operation digest", change.OperationDigest); err != nil {
+		return err
+	}
+	change.UpdatedAt = normalizeControlTime(change.UpdatedAt)
+	return nil
+}
+
+func sameBranchClaimSpec(object *corev1alpha1.BranchClaim, claim store.BranchClaim) bool {
+	return object.Spec.ID == claim.ID && object.Spec.RepositoryID == claim.RepositoryID && object.Spec.Ref == claim.Ref &&
+		store.BranchClaimOwnerKind(object.Spec.OwnerKind) == claim.OwnerKind && object.Spec.OwnerUID == claim.OwnerUID && object.Spec.RequestDigest == claim.RequestDigest
+}
+
+func branchClaimFromObject(object *corev1alpha1.BranchClaim) store.BranchClaim {
+	result := store.BranchClaim{
+		ID:                   object.Spec.ID,
+		RepositoryID:         object.Spec.RepositoryID,
+		Ref:                  object.Spec.Ref,
+		OwnerKind:            store.BranchClaimOwnerKind(object.Spec.OwnerKind),
+		OwnerUID:             object.Spec.OwnerUID,
+		Generation:           object.Status.Generation,
+		Availability:         store.BranchClaimAvailability(object.Status.Availability),
+		BlockedReason:        object.Status.BlockedReason,
+		RelatedPublicationID: object.Status.RelatedPublicationID,
+		RequestDigest:        object.Spec.RequestDigest,
+		ControllerEpochName:  object.Status.ControllerEpochName,
+		ControllerEpoch:      object.Status.ControllerEpoch,
+		LastOperationID:      object.Status.LastOperationID,
+		LastOperationDigest:  object.Status.LastOperationDigest,
+		Version:              object.Status.Version,
+		CreatedAt:            timeValue(object.Status.CreatedAt),
+		UpdatedAt:            timeValue(object.Status.UpdatedAt),
+	}
+	if object.Status.LastVerified != nil {
+		result.LastVerified = remoteRefFromAPI(*object.Status.LastVerified)
+	}
+	return result
+}
+
+func remoteRefToAPI(value store.RemoteRefState) corev1alpha1.ControlRemoteRefState {
+	return corev1alpha1.ControlRemoteRefState{Absent: value.Absent, SHA: value.SHA}
+}
+
+func remoteRefFromAPI(value corev1alpha1.ControlRemoteRefState) store.RemoteRefState {
+	return store.RemoteRefState{Absent: value.Absent, SHA: value.SHA}
+}
+
+func isKnownBranchClaimAvailability(value store.BranchClaimAvailability) bool {
+	return value == store.BranchClaimAvailable || value == store.BranchClaimReconciliationBlocked
+}
diff --git a/internal/store/kube/branch_claim_reclamation_test.go b/internal/store/kube/branch_claim_reclamation_test.go
new file mode 100644
index 000000000..a64ef0e6b
--- /dev/null
+++ b/internal/store/kube/branch_claim_reclamation_test.go
@@ -0,0 +1,154 @@
+package kube
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	controlstore "github.com/orka-agents/orka/internal/store"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+func TestCreateBranchClaimRecoversLostCreateAcknowledgement(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, fence := newTestStoreWithEpoch(t)
+	kubeStore.client = &persistBranchClaimThenErrorClient{Client: kubeClient}
+	claim, inserted, err := kubeStore.CreateBranchClaimWithResult(ctx, &controlstore.BranchClaim{
+		RepositoryID: "github.com/orka/target", Ref: "refs/heads/lost-ack",
+		OwnerKind: controlstore.BranchClaimOwnerTask, OwnerUID: "task-lost-ack",
+		LastVerified: controlstore.RemoteRefState{Absent: true}, RequestDigest: testDigest("lost-ack"), CreatedAt: testNow,
+	}, fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if inserted {
+		t.Fatal("acknowledgement-ambiguous create must not report a certain insertion")
+	}
+	if claim == nil || claim.OwnerUID != "task-lost-ack" {
+		t.Fatalf("recovered claim = %#v", claim)
+	}
+}
+
+type persistBranchClaimThenErrorClient struct {
+	client.Client
+	failed bool
+}
+
+func (c *persistBranchClaimThenErrorClient) Create(ctx context.Context, object client.Object, options ...client.CreateOption) error {
+	if err := c.Client.Create(ctx, object, options...); err != nil {
+		return err
+	}
+	if _, ok := object.(*corev1alpha1.BranchClaim); ok && !c.failed {
+		c.failed = true
+		return errors.New("simulated lost BranchClaim create acknowledgement")
+	}
+	return nil
+}
+
+func TestReclaimBranchClaimIsExactAndRecoverySafe(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, _, fence := newTestStoreWithEpoch(t)
+	claim, err := kubeStore.CreateBranchClaim(ctx, &controlstore.BranchClaim{
+		RepositoryID: "github.com/orka/target", Ref: "refs/heads/shared",
+		OwnerKind: controlstore.BranchClaimOwnerTask, OwnerUID: "task-old", LastVerified: controlstore.RemoteRefState{Absent: true},
+		RequestDigest: testDigest("branch-old"), CreatedAt: testNow,
+	}, fence)
+	if err != nil {
+		t.Fatalf("CreateBranchClaim: %v", err)
+	}
+	request := reclaimBranchClaimRequestForTest(claim, fence)
+	staleVersion := request
+	staleVersion.ExpectedVersion++
+	if err := kubeStore.ReclaimBranchClaim(ctx, staleVersion); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("ReclaimBranchClaim(stale version) error = %v, want ErrConflict", err)
+	}
+	if err := kubeStore.ReclaimBranchClaim(ctx, request); err != nil {
+		t.Fatalf("ReclaimBranchClaim: %v", err)
+	}
+	if _, err := kubeStore.GetBranchClaim(ctx, claim.ID); !errors.Is(err, controlstore.ErrNotFound) {
+		t.Fatalf("GetBranchClaim after reclaim error = %v, want ErrNotFound", err)
+	}
+	if err := kubeStore.ReclaimBranchClaim(ctx, request); err != nil {
+		t.Fatalf("ReclaimBranchClaim(idempotent retry): %v", err)
+	}
+
+	replacement, err := kubeStore.CreateBranchClaim(ctx, &controlstore.BranchClaim{
+		RepositoryID: claim.RepositoryID, Ref: claim.Ref,
+		OwnerKind: controlstore.BranchClaimOwnerTask, OwnerUID: "task-new", LastVerified: controlstore.RemoteRefState{SHA: strings.Repeat("a", 40)},
+		RequestDigest: testDigest("branch-new"), CreatedAt: testNow,
+	}, fence)
+	if err != nil {
+		t.Fatalf("CreateBranchClaim(replacement): %v", err)
+	}
+	if err := kubeStore.ReclaimBranchClaim(ctx, request); err != nil {
+		t.Fatalf("ReclaimBranchClaim(old retry after replacement): %v", err)
+	}
+	preserved, err := kubeStore.GetBranchClaim(ctx, replacement.ID)
+	if err != nil {
+		t.Fatalf("GetBranchClaim(replacement): %v", err)
+	}
+	if preserved.OwnerUID != replacement.OwnerUID || preserved.RequestDigest != replacement.RequestDigest {
+		t.Fatalf("replacement claim was changed: %#v", preserved)
+	}
+}
+
+func TestReclaimBranchClaimReclaimsSessionAndPreservesBlockedClaims(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, _, fence := newTestStoreWithEpoch(t)
+	sessionClaim, err := kubeStore.CreateBranchClaim(ctx, &controlstore.BranchClaim{
+		RepositoryID: "github.com/orka/target", Ref: "refs/heads/session",
+		OwnerKind: controlstore.BranchClaimOwnerSession, OwnerUID: "session-uid", LastVerified: controlstore.RemoteRefState{SHA: strings.Repeat("a", 40)},
+		RequestDigest: testDigest("session-claim"), CreatedAt: testNow,
+	}, fence)
+	if err != nil {
+		t.Fatalf("CreateBranchClaim(session): %v", err)
+	}
+	sessionRequest := reclaimBranchClaimRequestForTest(sessionClaim, fence)
+	sessionRequest.ExpectedOwnerKind = controlstore.BranchClaimOwnerSession
+	if err := kubeStore.ReclaimBranchClaim(ctx, sessionRequest); err != nil {
+		t.Fatalf("ReclaimBranchClaim(session): %v", err)
+	}
+	if _, err := kubeStore.GetBranchClaim(ctx, sessionClaim.ID); !errors.Is(err, controlstore.ErrNotFound) {
+		t.Fatalf("GetBranchClaim(session) error = %v, want ErrNotFound", err)
+	}
+
+	taskClaim, err := kubeStore.CreateBranchClaim(ctx, &controlstore.BranchClaim{
+		RepositoryID: "github.com/orka/target", Ref: "refs/heads/blocked",
+		OwnerKind: controlstore.BranchClaimOwnerTask, OwnerUID: "task-blocked", LastVerified: controlstore.RemoteRefState{Absent: true},
+		RequestDigest: testDigest("blocked-claim"), CreatedAt: testNow,
+	}, fence)
+	if err != nil {
+		t.Fatalf("CreateBranchClaim(blocked): %v", err)
+	}
+	blocked, err := kubeStore.CompareAndSwapBranchClaim(ctx, controlstore.BranchClaimCAS{
+		ID: taskClaim.ID, Fence: fence, ExpectedVersion: taskClaim.Version,
+		ExpectedGeneration: taskClaim.Generation, NewGeneration: taskClaim.Generation,
+		ExpectedLastVerified: taskClaim.LastVerified, NewLastVerified: taskClaim.LastVerified,
+		ExpectedAvailability: taskClaim.Availability, NewAvailability: controlstore.BranchClaimReconciliationBlocked,
+		BlockedReason: "manual reconciliation required", RelatedPublicationID: "publication-blocked",
+		OperationID: "block-claim", OperationDigest: testDigest("block-claim"), UpdatedAt: testNow,
+	})
+	if err != nil {
+		t.Fatalf("CompareAndSwapBranchClaim(block): %v", err)
+	}
+	blockedRequest := reclaimBranchClaimRequestForTest(blocked, fence)
+	blockedRequest.ExpectedAvailability = controlstore.BranchClaimAvailable
+	if err := kubeStore.ReclaimBranchClaim(ctx, blockedRequest); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("ReclaimBranchClaim(blocked) error = %v, want ErrConflict", err)
+	}
+	if _, err := kubeStore.GetBranchClaim(ctx, blocked.ID); err != nil {
+		t.Fatalf("blocked claim was removed: %v", err)
+	}
+}
+
+func reclaimBranchClaimRequestForTest(claim *controlstore.BranchClaim, fence controlstore.ControllerEpochFence) controlstore.ReclaimBranchClaimRequest {
+	return controlstore.ReclaimBranchClaimRequest{
+		ID: claim.ID, Fence: fence, ExpectedVersion: claim.Version, ExpectedGeneration: claim.Generation,
+		ExpectedRepositoryID: claim.RepositoryID, ExpectedRef: claim.Ref,
+		ExpectedOwnerKind: claim.OwnerKind, ExpectedOwnerUID: claim.OwnerUID,
+		ExpectedLastVerified: claim.LastVerified, ExpectedAvailability: claim.Availability,
+		ExpectedRequestDigest: claim.RequestDigest,
+	}
+}
diff --git a/internal/store/kube/controller_epoch.go b/internal/store/kube/controller_epoch.go
new file mode 100644
index 000000000..bb22144e6
--- /dev/null
+++ b/internal/store/kube/controller_epoch.go
@@ -0,0 +1,963 @@
+package kube
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+	coordinationv1 "k8s.io/api/coordination/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/util/retry"
+)
+
+const (
+	annotationControllerEpochInitializationHolder    = "core.orka.ai/controller-epoch-initialization-holder"
+	annotationControllerEpochInitializationLeaseName = "core.orka.ai/controller-epoch-initialization-lease-name"
+	annotationControllerEpochLeaseUID                = "core.orka.ai/controller-epoch-lease-uid"
+	annotationControllerEpochPredecessorDigest       = "core.orka.ai/controller-epoch-predecessor-digest"
+)
+
+// GetControllerEpoch reads the authoritative controller-epoch Lease.
+func (s *Store) GetControllerEpoch(ctx context.Context, name string) (*store.ControllerEpoch, error) {
+	if err := s.requireClient(); err != nil {
+		return nil, err
+	}
+	normalized, err := normalizeControllerEpochName(name)
+	if err != nil {
+		return nil, err
+	}
+	lease := &coordinationv1.Lease{}
+	key := types.NamespacedName{Namespace: s.controlNamespace, Name: controllerEpochLeaseName(normalized)}
+	if err := s.readClient().Get(ctx, key, lease); err != nil {
+		return nil, mapKubernetesError("get controller epoch Lease", err)
+	}
+	result, err := controllerEpochFromLease(normalized, lease)
+	if err != nil {
+		return nil, err
+	}
+	predecessorDigest, err := controllerEpochPredecessorDigest(lease)
+	if err != nil {
+		return nil, err
+	}
+	if err := s.syncControllerEpochStatus(ctx, result, lease, predecessorDigest); err != nil {
+		return nil, err
+	}
+	return &result, nil
+}
+
+// CompareAndSwapControllerEpoch creates or advances the authoritative Lease.
+// A same-holder, same-digest retry of an already committed target epoch is
+// idempotent even when the caller's expected values are stale.
+//
+//nolint:gocyclo // Creation, idempotency, mutation-lock, and epoch CAS checks form one boundary.
+func (s *Store) CompareAndSwapControllerEpoch(ctx context.Context, change store.ControllerEpochCAS) (*store.ControllerEpoch, error) {
+	if err := s.requireClient(); err != nil {
+		return nil, err
+	}
+	name, err := normalizeControllerEpochName(change.Name)
+	if err != nil {
+		return nil, err
+	}
+	change.Name = name
+	change.HolderID = strings.TrimSpace(change.HolderID)
+	if err := store.ValidateControlIdentifier("controller epoch holder ID", change.HolderID); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateCanonicalDigest("controller epoch request digest", change.RequestDigest); err != nil {
+		return nil, err
+	}
+	if change.ExpectedVersion < 0 || change.ExpectedEpoch < 0 {
+		return nil, store.ValidationErrorf("controller epoch expected version and epoch must not be negative")
+	}
+	if change.NewEpoch < 1 {
+		return nil, store.ValidationErrorf("controller new epoch must be at least 1")
+	}
+	change.UpdatedAt = normalizeControlTime(change.UpdatedAt)
+
+	key := types.NamespacedName{Namespace: s.controlNamespace, Name: controllerEpochLeaseName(change.Name)}
+	lease := &coordinationv1.Lease{}
+	err = s.readClient().Get(ctx, key, lease)
+	if apierrors.IsNotFound(err) {
+		if change.ExpectedVersion != 0 || change.ExpectedEpoch != 0 || change.NewEpoch != 1 {
+			return nil, controlConflict("controller epoch %q does not exist; creation requires expected version/epoch 0 and new epoch 1", change.Name)
+		}
+		// Creating the inspection object is the API-server-serialized proof that
+		// this is a genuinely fresh control store. A pre-existing object, even
+		// with blank status, may be a restored authority whose Lease has not been
+		// applied yet; it must never authorize epoch reuse.
+		if objectErr := s.createFreshControllerEpochObject(ctx, change); objectErr != nil {
+			return nil, objectErr
+		}
+		createdLease := newControllerEpochLease(s.controlNamespace, change)
+		if createErr := s.client.Create(ctx, createdLease); createErr != nil {
+			if apierrors.IsAlreadyExists(createErr) {
+				return s.CompareAndSwapControllerEpoch(ctx, change)
+			}
+			return nil, mapKubernetesError("create controller epoch Lease", createErr)
+		}
+		result, parseErr := controllerEpochFromLease(change.Name, createdLease)
+		if parseErr != nil {
+			return nil, parseErr
+		}
+		if syncErr := s.syncControllerEpochStatus(ctx, result, createdLease, ""); syncErr != nil {
+			return nil, syncErr
+		}
+		return &result, nil
+	}
+	if err != nil {
+		return nil, mapKubernetesError("get controller epoch Lease", err)
+	}
+
+	current, err := controllerEpochFromLease(change.Name, lease)
+	if err != nil {
+		return nil, err
+	}
+	predecessorDigest, err := controllerEpochPredecessorDigest(lease)
+	if err != nil {
+		return nil, err
+	}
+	// Reconcile an authenticated prior CAS crash tail, consume the one-shot
+	// epoch-1 initialization marker, and establish the immutable Lease UID
+	// binding before either returning an idempotent target or advancing again.
+	if syncErr := s.syncControllerEpochStatus(ctx, current, lease, predecessorDigest); syncErr != nil {
+		return nil, syncErr
+	}
+	if current.Epoch == change.NewEpoch {
+		if current.HolderID != change.HolderID || current.RequestDigest != change.RequestDigest {
+			return nil, controlConflict("controller epoch %q target %d already exists with different holder or digest", change.Name, change.NewEpoch)
+		}
+		return &current, nil
+	}
+	if current.Version != change.ExpectedVersion || current.Epoch != change.ExpectedEpoch {
+		return nil, controlConflict("controller epoch %q is version %d epoch %d, expected version %d epoch %d", change.Name, current.Version, current.Epoch, change.ExpectedVersion, change.ExpectedEpoch)
+	}
+	if change.NewEpoch != change.ExpectedEpoch+1 {
+		return nil, store.ValidationErrorf("controller epoch must advance exactly by one: expected new epoch %d", change.ExpectedEpoch+1)
+	}
+	if active, expiresAt, lockErr := controllerEpochMutationLock(lease); lockErr != nil {
+		return nil, lockErr
+	} else if active && expiresAt.After(time.Now().UTC()) {
+		return nil, controlConflict("controller epoch %q has an active control-store mutation until %s", change.Name, expiresAt.Format(time.RFC3339Nano))
+	}
+	object, err := s.getControllerEpochObject(ctx, change.Name)
+	if errors.Is(err, store.ErrNotFound) {
+		return nil, fmt.Errorf("controller epoch object %q is missing while authoritative Lease %q exists", controllerEpochObjectName(change.Name), lease.Name)
+	}
+	if err != nil {
+		return nil, err
+	}
+	if err := validateControllerEpochObjectLeaseUID(object, lease); err != nil {
+		return nil, err
+	}
+	if err := validateControllerEpochObjectForLease(object, current, lease.Name); err != nil {
+		return nil, err
+	}
+	preCASMirrorDigest, err := controllerEpochMirrorDigest(object)
+	if err != nil {
+		return nil, err
+	}
+
+	updated := lease.DeepCopy()
+	setControllerEpochLease(updated, change, current.Version+1, preCASMirrorDigest)
+	if err := s.client.Update(ctx, updated); err != nil {
+		return nil, mapKubernetesError("compare-and-swap controller epoch Lease", err)
+	}
+	result, err := controllerEpochFromLease(change.Name, updated)
+	if err != nil {
+		return nil, err
+	}
+	if err := s.syncControllerEpochStatus(ctx, result, updated, preCASMirrorDigest); err != nil {
+		return nil, err
+	}
+	return &result, nil
+}
+
+func controllerEpochLeaseName(name string) string {
+	return objectName(controllerEpochLeasePrefix, name)
+}
+
+func controllerEpochObjectName(name string) string {
+	return objectName(controllerEpochNamePrefix, name)
+}
+
+func newControllerEpochLease(namespace string, change store.ControllerEpochCAS) *coordinationv1.Lease {
+	lease := &coordinationv1.Lease{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: namespace,
+			Name:      controllerEpochLeaseName(change.Name),
+			Labels:    controlLabels(change.Name),
+		},
+	}
+	setControllerEpochLease(lease, change, 1, "")
+	return lease
+}
+
+func setControllerEpochLease(lease *coordinationv1.Lease, change store.ControllerEpochCAS, version int64, predecessorDigest string) {
+	if lease.Annotations == nil {
+		lease.Annotations = map[string]string{}
+	}
+	lease.Annotations[annotationLogicalName] = change.Name
+	lease.Annotations[annotationControllerEpoch] = strconv.FormatInt(change.NewEpoch, 10)
+	lease.Annotations[annotationDomainVersion] = strconv.FormatInt(version, 10)
+	lease.Annotations[annotationRequestDigest] = change.RequestDigest
+	lease.Annotations[annotationAcquiredAt] = formatTime(change.UpdatedAt)
+	if predecessorDigest == "" {
+		delete(lease.Annotations, annotationControllerEpochPredecessorDigest)
+	} else {
+		lease.Annotations[annotationControllerEpochPredecessorDigest] = predecessorDigest
+	}
+	delete(lease.Annotations, annotationMutationToken)
+	delete(lease.Annotations, annotationMutationExpiresAt)
+	holder := change.HolderID
+	acquired := metav1.NewMicroTime(change.UpdatedAt)
+	lease.Spec.HolderIdentity = &holder
+	lease.Spec.AcquireTime = &acquired
+	lease.Spec.RenewTime = &acquired
+}
+
+func controllerEpochFromLease(name string, lease *coordinationv1.Lease) (store.ControllerEpoch, error) {
+	if lease == nil || lease.Spec.HolderIdentity == nil || strings.TrimSpace(*lease.Spec.HolderIdentity) == "" {
+		return store.ControllerEpoch{}, fmt.Errorf("controller epoch Lease %q has no holder", controllerEpochLeaseName(name))
+	}
+	if _, err := controllerEpochLeaseUID(lease); err != nil {
+		return store.ControllerEpoch{}, err
+	}
+	holderID := strings.TrimSpace(*lease.Spec.HolderIdentity)
+	if holderID != *lease.Spec.HolderIdentity {
+		return store.ControllerEpoch{}, fmt.Errorf("controller epoch Lease %q holder is not canonical", controllerEpochLeaseName(name))
+	}
+	if err := store.ValidateControlIdentifier("controller epoch Lease holder ID", holderID); err != nil {
+		return store.ControllerEpoch{}, fmt.Errorf("invalid controller epoch Lease: %w", err)
+	}
+	annotations := lease.Annotations
+	if annotations[annotationLogicalName] != name {
+		return store.ControllerEpoch{}, fmt.Errorf("controller epoch Lease %q logical name mismatch", lease.Name)
+	}
+	epoch, err := parsePositiveInt64("controller epoch", annotations[annotationControllerEpoch])
+	if err != nil {
+		return store.ControllerEpoch{}, err
+	}
+	version, err := parsePositiveInt64("controller epoch version", annotations[annotationDomainVersion])
+	if err != nil {
+		return store.ControllerEpoch{}, err
+	}
+	if version != epoch {
+		return store.ControllerEpoch{}, fmt.Errorf(
+			"controller epoch Lease %q version %d does not match epoch %d",
+			controllerEpochLeaseName(name), version, epoch,
+		)
+	}
+	requestDigest := annotations[annotationRequestDigest]
+	if err := store.ValidateCanonicalDigest("controller epoch request digest", requestDigest); err != nil {
+		return store.ControllerEpoch{}, fmt.Errorf("invalid controller epoch Lease: %w", err)
+	}
+	if _, err := controllerEpochPredecessorDigest(lease); err != nil {
+		return store.ControllerEpoch{}, err
+	}
+	acquiredAt, err := parseTime("controller epoch acquisition time", annotations[annotationAcquiredAt])
+	if err != nil {
+		return store.ControllerEpoch{}, err
+	}
+	return store.ControllerEpoch{
+		Name:          name,
+		Epoch:         epoch,
+		HolderID:      holderID,
+		RequestDigest: requestDigest,
+		Version:       version,
+		AcquiredAt:    acquiredAt,
+		UpdatedAt:     acquiredAt,
+	}, nil
+}
+
+func controllerEpochLeaseUID(lease *coordinationv1.Lease) (string, error) {
+	if lease == nil {
+		return "", fmt.Errorf("controller epoch Lease is required")
+	}
+	uid := string(lease.UID)
+	if uid == "" || strings.TrimSpace(uid) != uid {
+		return "", fmt.Errorf("controller epoch Lease %q has no canonical UID", lease.Name)
+	}
+	return uid, nil
+}
+
+func controllerEpochPredecessorDigest(lease *coordinationv1.Lease) (string, error) {
+	if lease == nil {
+		return "", fmt.Errorf("controller epoch Lease is required")
+	}
+	raw := lease.Annotations[annotationControllerEpochPredecessorDigest]
+	digest := strings.TrimSpace(raw)
+	if raw != digest {
+		return "", fmt.Errorf("controller epoch Lease %q predecessor digest is not canonical", lease.Name)
+	}
+	if digest == "" {
+		return "", nil
+	}
+	if err := store.ValidateCanonicalDigest("controller epoch predecessor digest", digest); err != nil {
+		return "", fmt.Errorf("invalid controller epoch Lease: %w", err)
+	}
+	return digest, nil
+}
+
+func (s *Store) getControllerEpochObject(ctx context.Context, name string) (*corev1alpha1.ControllerEpoch, error) {
+	key := types.NamespacedName{Namespace: s.controlNamespace, Name: controllerEpochObjectName(name)}
+	object := &corev1alpha1.ControllerEpoch{}
+	if err := s.readClient().Get(ctx, key, object); err != nil {
+		return nil, mapKubernetesError("get controller epoch object", err)
+	}
+	if object.Spec.Name != name {
+		return nil, controlConflict("controller epoch object %s/%s has a different logical name", key.Namespace, key.Name)
+	}
+	return object, nil
+}
+
+func (s *Store) createFreshControllerEpochObject(ctx context.Context, change store.ControllerEpochCAS) error {
+	name := change.Name
+	object := &corev1alpha1.ControllerEpoch{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: s.controlNamespace,
+			Name:      controllerEpochObjectName(name),
+			Labels:    controlLabels(name),
+			Annotations: map[string]string{
+				annotationLogicalName:                            name,
+				annotationControllerEpoch:                        "1",
+				annotationDomainVersion:                          "1",
+				annotationRequestDigest:                          change.RequestDigest,
+				annotationAcquiredAt:                             formatTime(change.UpdatedAt),
+				annotationControllerEpochInitializationHolder:    change.HolderID,
+				annotationControllerEpochInitializationLeaseName: controllerEpochLeaseName(name),
+			},
+		},
+		Spec: corev1alpha1.ControllerEpochSpec{Name: name},
+	}
+	if err := s.client.Create(ctx, object); err == nil {
+		return nil
+	} else if !apierrors.IsAlreadyExists(err) {
+		return mapKubernetesError("create fresh controller epoch object", err)
+	}
+
+	existing, getErr := s.getControllerEpochObject(ctx, name)
+	if getErr != nil {
+		return getErr
+	}
+	return fmt.Errorf(
+		"controller epoch %q authoritative Lease is missing while ControllerEpoch object already exists (epoch=%d version=%d holder=%q)",
+		name, existing.Status.Epoch, existing.Status.Version, existing.Status.HolderID,
+	)
+}
+
+func controllerEpochStatusIsEmpty(status corev1alpha1.ControllerEpochStatus) bool {
+	return status.Epoch == 0 && status.Version == 0 && strings.TrimSpace(status.HolderID) == "" &&
+		strings.TrimSpace(status.RequestDigest) == "" && status.AcquiredAt == nil && status.UpdatedAt == nil &&
+		strings.TrimSpace(status.LeaseName) == "" && strings.TrimSpace(status.LeaseResourceVersion) == ""
+}
+
+func controllerEpochInitializationMarkerPresent(object *corev1alpha1.ControllerEpoch) bool {
+	if object == nil || object.Annotations == nil {
+		return false
+	}
+	_, holderPresent := object.Annotations[annotationControllerEpochInitializationHolder]
+	_, leaseNamePresent := object.Annotations[annotationControllerEpochInitializationLeaseName]
+	return holderPresent || leaseNamePresent
+}
+
+func validateControllerEpochObjectForLease(
+	object *corev1alpha1.ControllerEpoch,
+	epoch store.ControllerEpoch,
+	leaseName string,
+) error {
+	if object == nil {
+		return fmt.Errorf("controller epoch object is required for authoritative Lease %q", leaseName)
+	}
+	status := object.Status
+	if controllerEpochStatusIsEmpty(status) {
+		return validateControllerEpochInitializationMarker(object, epoch, leaseName)
+	}
+	if status.Epoch < 1 || status.Version < 1 || status.Epoch != status.Version {
+		return fmt.Errorf(
+			"controller epoch object %s/%s has invalid mirrored epoch/version %d/%d",
+			object.Namespace, object.Name, status.Epoch, status.Version,
+		)
+	}
+	if err := store.ValidateControlIdentifier("controller epoch status holder ID", status.HolderID); err != nil {
+		return fmt.Errorf("invalid controller epoch status: %w", err)
+	}
+	if err := store.ValidateCanonicalDigest("controller epoch status request digest", status.RequestDigest); err != nil {
+		return fmt.Errorf("invalid controller epoch status: %w", err)
+	}
+	if status.AcquiredAt == nil || status.AcquiredAt.IsZero() || status.UpdatedAt == nil || status.UpdatedAt.IsZero() {
+		return fmt.Errorf("controller epoch object %s/%s has incomplete mirrored timestamps", object.Namespace, object.Name)
+	}
+	if status.LeaseName != leaseName || strings.TrimSpace(status.LeaseResourceVersion) == "" {
+		return fmt.Errorf(
+			"controller epoch object %s/%s does not identify authoritative Lease %q",
+			object.Namespace, object.Name, leaseName,
+		)
+	}
+	if status.Epoch != epoch.Epoch || status.Version != epoch.Version {
+		return fmt.Errorf(
+			"controller epoch object %s/%s epoch/version %d/%d conflicts with authoritative Lease epoch/version %d/%d",
+			object.Namespace, object.Name, status.Epoch, status.Version, epoch.Epoch, epoch.Version,
+		)
+	}
+	if status.HolderID != epoch.HolderID {
+		return fmt.Errorf(
+			"controller epoch object %s/%s holder %q conflicts with authoritative Lease holder %q at epoch %d",
+			object.Namespace, object.Name, status.HolderID, epoch.HolderID, epoch.Epoch,
+		)
+	}
+	if status.RequestDigest != epoch.RequestDigest {
+		return fmt.Errorf(
+			"controller epoch object %s/%s request digest conflicts with authoritative Lease at epoch %d",
+			object.Namespace, object.Name, epoch.Epoch,
+		)
+	}
+	if !status.AcquiredAt.Time.Truncate(time.Second).Equal(epoch.AcquiredAt.Truncate(time.Second)) {
+		return fmt.Errorf(
+			"controller epoch object %s/%s acquisition time conflicts with authoritative Lease at epoch %d",
+			object.Namespace, object.Name, epoch.Epoch,
+		)
+	}
+	if !status.UpdatedAt.Time.Truncate(time.Second).Equal(epoch.UpdatedAt.Truncate(time.Second)) {
+		return fmt.Errorf(
+			"controller epoch object %s/%s update time conflicts with authoritative Lease at epoch %d",
+			object.Namespace, object.Name, epoch.Epoch,
+		)
+	}
+	if controllerEpochInitializationMarkerPresent(object) {
+		return validateControllerEpochInitializationMarker(object, epoch, leaseName)
+	}
+	return nil
+}
+
+func validateControllerEpochInitializationMarker(
+	object *corev1alpha1.ControllerEpoch,
+	epoch store.ControllerEpoch,
+	leaseName string,
+) error {
+	annotations := object.Annotations
+	if epoch.Epoch != 1 || epoch.Version != 1 || annotations[annotationLogicalName] != epoch.Name ||
+		annotations[annotationControllerEpochInitializationLeaseName] != leaseName {
+		return fmt.Errorf(
+			"controller epoch object %s/%s has a blank status without an exact epoch-1 initialization marker",
+			object.Namespace, object.Name,
+		)
+	}
+	markedEpoch, err := parsePositiveInt64("controller epoch initialization epoch", annotations[annotationControllerEpoch])
+	if err != nil || markedEpoch != epoch.Epoch {
+		return fmt.Errorf("controller epoch object %s/%s has an invalid initialization epoch", object.Namespace, object.Name)
+	}
+	markedVersion, err := parsePositiveInt64("controller epoch initialization version", annotations[annotationDomainVersion])
+	if err != nil || markedVersion != epoch.Version {
+		return fmt.Errorf("controller epoch object %s/%s has an invalid initialization version", object.Namespace, object.Name)
+	}
+	markedHolder := annotations[annotationControllerEpochInitializationHolder]
+	if err := store.ValidateControlIdentifier("controller epoch initialization holder ID", markedHolder); err != nil || markedHolder != epoch.HolderID {
+		return fmt.Errorf("controller epoch object %s/%s has an invalid initialization holder", object.Namespace, object.Name)
+	}
+	markedDigest := annotations[annotationRequestDigest]
+	if err := store.ValidateCanonicalDigest("controller epoch initialization request digest", markedDigest); err != nil || markedDigest != epoch.RequestDigest {
+		return fmt.Errorf("controller epoch object %s/%s has an invalid initialization request digest", object.Namespace, object.Name)
+	}
+	markedAt, err := parseTime("controller epoch initialization acquisition time", annotations[annotationAcquiredAt])
+	if err != nil || !markedAt.Equal(epoch.AcquiredAt) {
+		return fmt.Errorf("controller epoch object %s/%s has an invalid initialization acquisition time", object.Namespace, object.Name)
+	}
+	return nil
+}
+
+func validateControllerEpochObjectLeaseUID(object *corev1alpha1.ControllerEpoch, lease *coordinationv1.Lease) error {
+	if object == nil {
+		return fmt.Errorf("controller epoch object is required for Lease UID validation")
+	}
+	leaseUID, err := controllerEpochLeaseUID(lease)
+	if err != nil {
+		return err
+	}
+	raw, present := object.Annotations[annotationControllerEpochLeaseUID]
+	boundUID := strings.TrimSpace(raw)
+	if !present || boundUID == "" || raw != boundUID {
+		return controlConflict("controller epoch object %s/%s has no immutable authoritative Lease UID binding", object.Namespace, object.Name)
+	}
+	if boundUID != leaseUID {
+		return controlConflict(
+			"controller epoch object %s/%s is bound to Lease UID %q, not current UID %q",
+			object.Namespace, object.Name, boundUID, leaseUID,
+		)
+	}
+	return nil
+}
+
+func controllerEpochMirrorDigest(object *corev1alpha1.ControllerEpoch) (string, error) {
+	if object == nil {
+		return "", fmt.Errorf("controller epoch object is required for mirror digest")
+	}
+	leaseUID := strings.TrimSpace(object.Annotations[annotationControllerEpochLeaseUID])
+	if leaseUID == "" || leaseUID != object.Annotations[annotationControllerEpochLeaseUID] {
+		return "", fmt.Errorf("controller epoch object %s/%s has no canonical Lease UID binding", object.Namespace, object.Name)
+	}
+	status := object.Status
+	if status.AcquiredAt == nil || status.UpdatedAt == nil {
+		return "", fmt.Errorf("controller epoch object %s/%s has incomplete mirrored timestamps", object.Namespace, object.Name)
+	}
+	payload, err := json.Marshal(struct {
+		Domain               string `json:"domain"`
+		Namespace            string `json:"namespace"`
+		ObjectName           string `json:"objectName"`
+		LogicalName          string `json:"logicalName"`
+		LeaseUID             string `json:"leaseUid"`
+		Epoch                int64  `json:"epoch"`
+		HolderID             string `json:"holderId"`
+		RequestDigest        string `json:"requestDigest"`
+		Version              int64  `json:"version"`
+		AcquiredAt           string `json:"acquiredAt"`
+		UpdatedAt            string `json:"updatedAt"`
+		LeaseName            string `json:"leaseName"`
+		LeaseResourceVersion string `json:"leaseResourceVersion"`
+	}{
+		Domain: "orka-controller-epoch-mirror-v1", Namespace: object.Namespace, ObjectName: object.Name,
+		LogicalName: object.Spec.Name, LeaseUID: leaseUID, Epoch: status.Epoch, HolderID: status.HolderID,
+		RequestDigest: status.RequestDigest, Version: status.Version,
+		AcquiredAt: formatTime(status.AcquiredAt.Time), UpdatedAt: formatTime(status.UpdatedAt.Time),
+		LeaseName: status.LeaseName, LeaseResourceVersion: status.LeaseResourceVersion,
+	})
+	if err != nil {
+		return "", fmt.Errorf("encode controller epoch mirror digest: %w", err)
+	}
+	return canonicalBytesDigest(payload), nil
+}
+
+func validateControllerEpochLeaseSnapshot(
+	ctx context.Context,
+	s *Store,
+	epoch store.ControllerEpoch,
+	snapshot *coordinationv1.Lease,
+	predecessorDigest string,
+) (*coordinationv1.Lease, error) {
+	if snapshot == nil || snapshot.Name != controllerEpochLeaseName(epoch.Name) || strings.TrimSpace(snapshot.ResourceVersion) == "" {
+		return nil, controlConflict("controller epoch %q status sync has an invalid Lease snapshot", epoch.Name)
+	}
+	snapshotUID, err := controllerEpochLeaseUID(snapshot)
+	if err != nil {
+		return nil, err
+	}
+	snapshotPredecessorDigest, err := controllerEpochPredecessorDigest(snapshot)
+	if err != nil {
+		return nil, err
+	}
+	if snapshotPredecessorDigest != predecessorDigest {
+		return nil, controlConflict("controller epoch Lease %q predecessor digest changed before status sync", snapshot.Name)
+	}
+	lease := &coordinationv1.Lease{}
+	key := types.NamespacedName{Namespace: s.controlNamespace, Name: snapshot.Name}
+	if err := s.readClient().Get(ctx, key, lease); err != nil {
+		return nil, mapKubernetesError("verify controller epoch Lease before status sync", err)
+	}
+	leaseUID, err := controllerEpochLeaseUID(lease)
+	if err != nil {
+		return nil, err
+	}
+	if lease.ResourceVersion != snapshot.ResourceVersion || leaseUID != snapshotUID {
+		return nil, controlConflict(
+			"controller epoch Lease %q changed from UID/resourceVersion %q/%q to %q/%q before status sync",
+			snapshot.Name, snapshotUID, snapshot.ResourceVersion, leaseUID, lease.ResourceVersion,
+		)
+	}
+	current, err := controllerEpochFromLease(epoch.Name, lease)
+	if err != nil {
+		return nil, err
+	}
+	currentPredecessorDigest, err := controllerEpochPredecessorDigest(lease)
+	if err != nil {
+		return nil, err
+	}
+	if currentPredecessorDigest != predecessorDigest {
+		return nil, controlConflict("controller epoch Lease %q predecessor digest no longer matches status sync", lease.Name)
+	}
+	if current.Epoch != epoch.Epoch || current.Version != epoch.Version || current.HolderID != epoch.HolderID ||
+		current.RequestDigest != epoch.RequestDigest || !current.AcquiredAt.Equal(epoch.AcquiredAt) ||
+		!current.UpdatedAt.Equal(epoch.UpdatedAt) {
+		return nil, controlConflict(
+			"controller epoch Lease %q no longer matches epoch/version %d/%d holder %q before status sync",
+			lease.Name, epoch.Epoch, epoch.Version, epoch.HolderID,
+		)
+	}
+	return lease, nil
+}
+
+type controllerEpochStatusSyncDecision struct {
+	writeStatus               bool
+	bindLeaseUID              bool
+	clearInitializationMarker bool
+}
+
+func validateControllerEpochLeaseUIDBinding(
+	object *corev1alpha1.ControllerEpoch,
+	epoch store.ControllerEpoch,
+	lease *coordinationv1.Lease,
+	predecessorDigest string,
+) (bindingPresent bool, finishInitialization bool, err error) {
+	leaseUID, err := controllerEpochLeaseUID(lease)
+	if err != nil {
+		return false, false, err
+	}
+	rawBoundUID, bindingPresent := object.Annotations[annotationControllerEpochLeaseUID]
+	boundUID := strings.TrimSpace(rawBoundUID)
+	if bindingPresent {
+		if boundUID == "" || rawBoundUID != boundUID {
+			return false, false, fmt.Errorf("controller epoch object %s/%s has a non-canonical Lease UID binding", object.Namespace, object.Name)
+		}
+		if boundUID != leaseUID {
+			return false, false, controlConflict(
+				"controller epoch object %s/%s is bound to Lease UID %q, not current UID %q",
+				object.Namespace, object.Name, boundUID, leaseUID,
+			)
+		}
+		return true, false, nil
+	}
+	if controllerEpochStatusIsEmpty(object.Status) {
+		return false, false, nil
+	}
+	if !controllerEpochInitializationMarkerPresent(object) {
+		return false, false, controlConflict(
+			"controller epoch object %s/%s has no immutable authoritative Lease UID binding",
+			object.Namespace, object.Name,
+		)
+	}
+	if predecessorDigest != "" {
+		return false, false, controlConflict(
+			"controller epoch object %s/%s initialization marker cannot consume a predecessor digest",
+			object.Namespace, object.Name,
+		)
+	}
+	active, expiresAt, lockErr := controllerEpochMutationLock(lease)
+	if lockErr != nil {
+		return false, false, lockErr
+	}
+	if active && expiresAt.After(time.Now().UTC()) {
+		return false, false, controlConflict(
+			"controller epoch object %s/%s cannot finish epoch-1 Lease UID binding while a control-store mutation is active until %s",
+			object.Namespace, object.Name, expiresAt.Format(time.RFC3339Nano),
+		)
+	}
+	if err := validateControllerEpochObjectForLease(object, epoch, lease.Name); err != nil {
+		return false, false, err
+	}
+	return false, true, nil
+}
+
+func validateControllerEpochStatusSyncState(
+	object *corev1alpha1.ControllerEpoch,
+	epoch store.ControllerEpoch,
+	lease *coordinationv1.Lease,
+	predecessorDigest string,
+) (controllerEpochStatusSyncDecision, error) {
+	decision := controllerEpochStatusSyncDecision{}
+	if object == nil {
+		return decision, fmt.Errorf("controller epoch object is required for status sync")
+	}
+	bindingPresent, finishInitialization, err := validateControllerEpochLeaseUIDBinding(object, epoch, lease, predecessorDigest)
+	if err != nil {
+		return decision, err
+	}
+
+	status := object.Status
+	if controllerEpochStatusIsEmpty(status) {
+		if predecessorDigest != "" {
+			return decision, controlConflict("controller epoch %q blank mirror cannot consume a predecessor digest", epoch.Name)
+		}
+		if err := validateControllerEpochInitializationMarker(object, epoch, lease.Name); err != nil {
+			return decision, err
+		}
+		decision.writeStatus = true
+		decision.bindLeaseUID = !bindingPresent
+		decision.clearInitializationMarker = true
+		return decision, nil
+	}
+
+	if finishInitialization {
+		decision.bindLeaseUID = true
+		decision.clearInitializationMarker = true
+	}
+
+	if status.Epoch == epoch.Epoch && status.Version == epoch.Version {
+		if err := validateControllerEpochObjectForLease(object, epoch, lease.Name); err != nil {
+			return decision, err
+		}
+		decision.writeStatus = status.LeaseResourceVersion != lease.ResourceVersion
+		decision.clearInitializationMarker = controllerEpochInitializationMarkerPresent(object)
+		return decision, nil
+	}
+	if status.Epoch > epoch.Epoch || status.Version > epoch.Version {
+		return decision, controlConflict(
+			"controller epoch object %s/%s mirror %d/%d advanced beyond stale status sync target %d/%d",
+			object.Namespace, object.Name, status.Epoch, status.Version, epoch.Epoch, epoch.Version,
+		)
+	}
+	if status.Epoch != epoch.Epoch-1 || status.Version != epoch.Version-1 {
+		return decision, controlConflict(
+			"controller epoch object %s/%s mirror %d/%d is not the exact predecessor of status sync target %d/%d",
+			object.Namespace, object.Name, status.Epoch, status.Version, epoch.Epoch, epoch.Version,
+		)
+	}
+	if controllerEpochInitializationMarkerPresent(object) {
+		return decision, controlConflict(
+			"controller epoch object %s/%s still has an initialization marker before advancing mirror %d/%d",
+			object.Namespace, object.Name, epoch.Epoch, epoch.Version,
+		)
+	}
+	if predecessorDigest == "" {
+		return decision, controlConflict(
+			"controller epoch Lease %q has no authenticated predecessor digest for mirror %d/%d",
+			lease.Name, status.Epoch, status.Version,
+		)
+	}
+	if status.AcquiredAt == nil || status.AcquiredAt.IsZero() || status.UpdatedAt == nil || status.UpdatedAt.IsZero() {
+		return decision, fmt.Errorf(
+			"controller epoch object %s/%s predecessor mirror has incomplete timestamps",
+			object.Namespace, object.Name,
+		)
+	}
+	previous := store.ControllerEpoch{
+		Name: epoch.Name, Epoch: status.Epoch, HolderID: status.HolderID,
+		RequestDigest: status.RequestDigest, Version: status.Version,
+		AcquiredAt: status.AcquiredAt.Time, UpdatedAt: status.UpdatedAt.Time,
+	}
+	if err := validateControllerEpochObjectForLease(object, previous, lease.Name); err != nil {
+		return decision, fmt.Errorf("invalid predecessor controller epoch mirror: %w", err)
+	}
+	actualPredecessorDigest, err := controllerEpochMirrorDigest(object)
+	if err != nil {
+		return decision, err
+	}
+	if actualPredecessorDigest != predecessorDigest {
+		return decision, controlConflict(
+			"controller epoch object %s/%s predecessor mirror digest does not match authoritative Lease",
+			object.Namespace, object.Name,
+		)
+	}
+	decision.writeStatus = true
+	return decision, nil
+}
+
+func (s *Store) syncControllerEpochStatus(
+	ctx context.Context,
+	epoch store.ControllerEpoch,
+	leaseSnapshot *coordinationv1.Lease,
+	predecessorDigest string,
+) error {
+	key := types.NamespacedName{Namespace: s.controlNamespace, Name: controllerEpochObjectName(epoch.Name)}
+	return retry.RetryOnConflict(retry.DefaultBackoff, func() error {
+		lease, err := validateControllerEpochLeaseSnapshot(ctx, s, epoch, leaseSnapshot, predecessorDigest)
+		if err != nil {
+			return err
+		}
+		object := &corev1alpha1.ControllerEpoch{}
+		if err := s.readClient().Get(ctx, key, object); err != nil {
+			return err
+		}
+		if object.Spec.Name != epoch.Name {
+			return controlConflict("controller epoch object %s/%s has a different logical name", key.Namespace, key.Name)
+		}
+		decision, err := validateControllerEpochStatusSyncState(object, epoch, lease, predecessorDigest)
+		if err != nil {
+			return err
+		}
+		if decision.writeStatus {
+			object.Status = corev1alpha1.ControllerEpochStatus{
+				Epoch:                epoch.Epoch,
+				HolderID:             epoch.HolderID,
+				RequestDigest:        epoch.RequestDigest,
+				Version:              epoch.Version,
+				AcquiredAt:           metaTime(epoch.AcquiredAt),
+				UpdatedAt:            metaTime(epoch.UpdatedAt),
+				LeaseName:            lease.Name,
+				LeaseResourceVersion: lease.ResourceVersion,
+			}
+			if err := s.client.Status().Update(ctx, object); err != nil {
+				return err
+			}
+		}
+		if !decision.bindLeaseUID && !decision.clearInitializationMarker {
+			return nil
+		}
+		if _, err := validateControllerEpochLeaseSnapshot(ctx, s, epoch, leaseSnapshot, predecessorDigest); err != nil {
+			return err
+		}
+		if object.Annotations == nil {
+			object.Annotations = map[string]string{}
+		}
+		if decision.bindLeaseUID {
+			object.Annotations[annotationControllerEpochLeaseUID] = string(lease.UID)
+		}
+		if decision.clearInitializationMarker {
+			delete(object.Annotations, annotationControllerEpochInitializationHolder)
+			delete(object.Annotations, annotationControllerEpochInitializationLeaseName)
+		}
+		return s.client.Update(ctx, object)
+	})
+}
+
+func (s *Store) requireControllerEpoch(ctx context.Context, fence store.ControllerEpochFence) (store.ControllerEpochFence, epochSnapshot, error) {
+	normalized, err := normalizeEpochFence(fence)
+	if err != nil {
+		return store.ControllerEpochFence{}, epochSnapshot{}, err
+	}
+	const localQueueTimeout = 30 * time.Second
+	localSlot := false
+	if s.epochMutations != nil {
+		queueCtx, cancel := context.WithTimeout(ctx, localQueueTimeout)
+		err = s.epochMutations.Acquire(queueCtx, 1)
+		cancel()
+		if err != nil {
+			return store.ControllerEpochFence{}, epochSnapshot{}, fmt.Errorf("wait for controller epoch mutation slot: %w", err)
+		}
+		localSlot = true
+	}
+	releaseLocalSlot := true
+	defer func() {
+		if releaseLocalSlot && localSlot {
+			s.epochMutations.Release(1)
+		}
+	}()
+	const (
+		acquireTimeout = 2 * time.Second
+		maxRetryDelay  = 200 * time.Millisecond
+	)
+	deadline := time.Now().Add(acquireTimeout)
+	retryDelay := 10 * time.Millisecond
+	var lastConflict error
+	for {
+		lease := &coordinationv1.Lease{}
+		key := types.NamespacedName{Namespace: s.controlNamespace, Name: controllerEpochLeaseName(normalized.Name)}
+		if err := s.readClient().Get(ctx, key, lease); err != nil {
+			if apierrors.IsNotFound(err) {
+				return store.ControllerEpochFence{}, epochSnapshot{}, controlConflict("controller epoch %q does not exist", normalized.Name)
+			}
+			return store.ControllerEpochFence{}, epochSnapshot{}, mapKubernetesError("get controller epoch fence Lease", err)
+		}
+		current, err := controllerEpochFromLease(normalized.Name, lease)
+		if err != nil {
+			return store.ControllerEpochFence{}, epochSnapshot{}, err
+		}
+		if current.Epoch != normalized.Epoch || current.HolderID != normalized.HolderID {
+			return store.ControllerEpochFence{}, epochSnapshot{}, controlConflict("controller epoch fence %s/%d/%s does not match current %d/%s", normalized.Name, normalized.Epoch, normalized.HolderID, current.Epoch, current.HolderID)
+		}
+		object, err := s.getControllerEpochObject(ctx, normalized.Name)
+		if errors.Is(err, store.ErrNotFound) {
+			return store.ControllerEpochFence{}, epochSnapshot{}, controlConflict(
+				"controller epoch object %q is missing while authoritative Lease %q exists",
+				controllerEpochObjectName(normalized.Name), lease.Name,
+			)
+		}
+		if err != nil {
+			return store.ControllerEpochFence{}, epochSnapshot{}, err
+		}
+		if err := validateControllerEpochObjectLeaseUID(object, lease); err != nil {
+			return store.ControllerEpochFence{}, epochSnapshot{}, err
+		}
+		if err := validateControllerEpochObjectForLease(object, current, lease.Name); err != nil {
+			return store.ControllerEpochFence{}, epochSnapshot{}, err
+		}
+		active, expiresAt, err := controllerEpochMutationLock(lease)
+		if err != nil {
+			return store.ControllerEpochFence{}, epochSnapshot{}, err
+		}
+		now := time.Now().UTC()
+		if active && expiresAt.After(now) {
+			lastConflict = controlConflict("controller epoch %q is serializing another control-store mutation until %s", normalized.Name, expiresAt.Format(time.RFC3339Nano))
+		} else {
+			updated := lease.DeepCopy()
+			if updated.Annotations == nil {
+				updated.Annotations = map[string]string{}
+			}
+			token := uuid.NewString()
+			updated.Annotations[annotationMutationToken] = token
+			updated.Annotations[annotationMutationExpiresAt] = formatTime(now.Add(2 * time.Minute))
+			if err := s.client.Update(ctx, updated); err == nil {
+				releaseLocalSlot = false
+				return normalized, epochSnapshot{
+					Name: current.Name, Epoch: current.Epoch, HolderID: current.HolderID,
+					LeaseResourceVersion: updated.ResourceVersion, MutationToken: token, MutationLease: updated.DeepCopy(),
+					LocalMutationSlot: localSlot,
+				}, nil
+			} else if apierrors.IsConflict(err) {
+				lastConflict = mapKubernetesError("acquire controller epoch mutation fence", err)
+			} else {
+				return store.ControllerEpochFence{}, epochSnapshot{}, mapKubernetesError("acquire controller epoch mutation fence", err)
+			}
+		}
+
+		if !time.Now().Before(deadline) {
+			return store.ControllerEpochFence{}, epochSnapshot{}, lastConflict
+		}
+		wait := retryDelay
+		if remaining := time.Until(deadline); wait > remaining {
+			wait = remaining
+		}
+		timer := time.NewTimer(wait)
+		select {
+		case <-ctx.Done():
+			timer.Stop()
+			return store.ControllerEpochFence{}, epochSnapshot{}, ctx.Err()
+		case <-timer.C:
+		}
+		retryDelay = min(retryDelay*2, maxRetryDelay)
+	}
+}
+
+func controllerEpochMutationLock(lease *coordinationv1.Lease) (bool, time.Time, error) {
+	if lease == nil || lease.Annotations == nil || lease.Annotations[annotationMutationToken] == "" {
+		return false, time.Time{}, nil
+	}
+	expiresAt, err := parseTime("controller epoch mutation expiry", lease.Annotations[annotationMutationExpiresAt])
+	if err != nil {
+		return false, time.Time{}, err
+	}
+	return true, expiresAt, nil
+}
+
+func (s *Store) releaseControllerEpochMutation(snapshot epochSnapshot) {
+	if snapshot.LocalMutationSlot && s.epochMutations != nil {
+		defer s.epochMutations.Release(1)
+	}
+	if snapshot.MutationToken == "" || snapshot.MutationLease == nil {
+		return
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	lease := snapshot.MutationLease.DeepCopy()
+	_ = retry.RetryOnConflict(retry.DefaultBackoff, func() error {
+		if lease.Annotations[annotationMutationToken] != snapshot.MutationToken || lease.Spec.HolderIdentity == nil || *lease.Spec.HolderIdentity != snapshot.HolderID {
+			return nil
+		}
+		epoch, err := parsePositiveInt64("controller epoch", lease.Annotations[annotationControllerEpoch])
+		if err != nil || epoch != snapshot.Epoch {
+			return nil
+		}
+		updated := lease.DeepCopy()
+		delete(updated.Annotations, annotationMutationToken)
+		delete(updated.Annotations, annotationMutationExpiresAt)
+		if err := s.client.Update(ctx, updated); err != nil {
+			if !apierrors.IsConflict(err) {
+				return err
+			}
+			refreshed := &coordinationv1.Lease{}
+			key := types.NamespacedName{Namespace: lease.Namespace, Name: lease.Name}
+			if getErr := s.readClient().Get(ctx, key, refreshed); getErr != nil {
+				return getErr
+			}
+			lease = refreshed
+			return err
+		}
+		return nil
+	})
+}
diff --git a/internal/store/kube/external_effect.go b/internal/store/kube/external_effect.go
new file mode 100644
index 000000000..947cc9908
--- /dev/null
+++ b/internal/store/kube/external_effect.go
@@ -0,0 +1,317 @@
+package kube
+
+import (
+	"bytes"
+	"context"
+	"strings"
+	"time"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+// ReserveExternalEffect creates or returns the same-digest canonical effect.
+func (s *Store) ReserveExternalEffect(ctx context.Context, request store.ReserveExternalEffectRequest) (*store.ExternalEffect, error) {
+	if err := s.requireClient(); err != nil {
+		return nil, err
+	}
+	request.Identity.Kind = strings.TrimSpace(request.Identity.Kind)
+	request.Identity.Namespace = strings.TrimSpace(request.Identity.Namespace)
+	request.Identity.AggregateID = strings.TrimSpace(request.Identity.AggregateID)
+	request.Identity.OperationID = strings.TrimSpace(request.Identity.OperationID)
+	if err := request.Identity.Validate(); err != nil {
+		return nil, err
+	}
+	id, err := request.Identity.CanonicalID()
+	if err != nil {
+		return nil, err
+	}
+	if err := store.ValidateCanonicalDigest("external effect request digest", request.RequestDigest); err != nil {
+		return nil, err
+	}
+	fence, snapshot, err := s.requireControllerEpoch(ctx, request.Fence)
+	if err != nil {
+		return nil, err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	request.Fence = fence
+	request.CreatedAt = normalizeControlTime(request.CreatedAt)
+
+	key := client.ObjectKey{Namespace: request.Identity.Namespace, Name: objectName(externalEffectNamePrefix, id)}
+	object := &corev1alpha1.ExternalEffect{}
+	err = s.readClient().Get(ctx, key, object)
+	if err == nil {
+		return s.completeExternalEffectCreation(ctx, object, request, id, fence, snapshot)
+	}
+	if !apierrors.IsNotFound(err) {
+		return nil, mapKubernetesError("get external effect", err)
+	}
+	object = &corev1alpha1.ExternalEffect{
+		ObjectMeta: metav1.ObjectMeta{Namespace: request.Identity.Namespace, Name: key.Name, Labels: controlLabels(id)},
+		Spec: corev1alpha1.ExternalEffectSpec{
+			ID:                id,
+			Kind:              request.Identity.Kind,
+			IdentityNamespace: request.Identity.Namespace,
+			AggregateID:       request.Identity.AggregateID,
+			OperationID:       request.Identity.OperationID,
+			RequestDigest:     request.RequestDigest,
+		},
+	}
+	if err := s.client.Create(ctx, object); err != nil {
+		if apierrors.IsAlreadyExists(err) {
+			if getErr := s.readClient().Get(ctx, key, object); getErr != nil {
+				return nil, mapKubernetesError("get concurrently created external effect", getErr)
+			}
+			return s.completeExternalEffectCreation(ctx, object, request, id, fence, snapshot)
+		}
+		return nil, mapKubernetesError("create external effect", err)
+	}
+	return s.completeExternalEffectCreation(ctx, object, request, id, fence, snapshot)
+}
+
+// GetExternalEffect returns an effect by canonical ID within the configured watch scope.
+func (s *Store) GetExternalEffect(ctx context.Context, id string) (*store.ExternalEffect, error) {
+	if err := s.requireClient(); err != nil {
+		return nil, err
+	}
+	id = strings.TrimSpace(id)
+	if err := store.ValidateControlIdentifier("external effect ID", id); err != nil {
+		return nil, err
+	}
+	object, err := s.findExternalEffectByID(ctx, id)
+	if err != nil {
+		return nil, err
+	}
+	result := externalEffectFromObject(object)
+	return &result, nil
+}
+
+// TransitionExternalEffect applies an exact version/state/lease-owner,
+// resourceVersion, request-digest, and controller-epoch CAS.
+func (s *Store) TransitionExternalEffect(ctx context.Context, transition store.ExternalEffectTransition) (*store.ExternalEffect, error) {
+	transition.ID = strings.TrimSpace(transition.ID)
+	if err := store.ValidateControlIdentifier("external effect ID", transition.ID); err != nil {
+		return nil, err
+	}
+	fence, snapshot, err := s.requireControllerEpoch(ctx, transition.Fence)
+	if err != nil {
+		return nil, err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	transition.Fence = fence
+	if err := validateExternalEffectTransition(&transition); err != nil {
+		return nil, err
+	}
+
+	object, err := s.findExternalEffectByID(ctx, transition.ID)
+	if err != nil {
+		return nil, err
+	}
+	effect := externalEffectFromObject(object)
+	if effect.RequestDigest != transition.RequestDigest {
+		return nil, controlConflict("external effect %q request digest does not match reserved identity", effect.ID)
+	}
+	if effect.State == transition.NewState && effect.ResponseDigest == transition.ResponseDigest && bytes.Equal(effect.Response, transition.Response) && effect.LeaseOwner == transition.LeaseOwner && sameOptionalTime(effect.LeaseExpiresAt, transition.LeaseExpiresAt) {
+		return &effect, nil
+	}
+	if effect.Version != transition.ExpectedVersion || effect.State != transition.ExpectedState || effect.LeaseOwner != transition.ExpectedLeaseOwner {
+		return nil, controlConflict("external effect %q no longer matches expected version, state, or lease owner", effect.ID)
+	}
+	if transition.ExpectedState == store.ExternalEffectInFlight && transition.NewState == store.ExternalEffectInFlight && effect.LeaseOwner != transition.LeaseOwner && effect.LeaseExpiresAt != nil && effect.LeaseExpiresAt.After(transition.UpdatedAt) {
+		return nil, controlConflict("external effect %q is still leased by %q", effect.ID, effect.LeaseOwner)
+	}
+
+	updated := object.DeepCopy()
+	updated.Status.State = corev1alpha1.ExternalEffectControlState(transition.NewState)
+	updated.Status.ResponseDigest = transition.ResponseDigest
+	updated.Status.Response = externalEffectResponseToAPI(transition.Response)
+	updated.Status.LeaseOwner = transition.LeaseOwner
+	updated.Status.LeaseExpiresAt = metaTimePtr(transition.LeaseExpiresAt)
+	if transition.NewState == store.ExternalEffectInFlight {
+		updated.Status.Attempts++
+	}
+	setMutationStatus(&updated.Status.ControlRecordMutationStatus, fence, snapshot, effect.Version+1, "", "", effect.CreatedAt, transition.UpdatedAt)
+	if err := s.client.Status().Update(ctx, updated); err != nil {
+		return nil, mapKubernetesError("transition external effect", err)
+	}
+	result := externalEffectFromObject(updated)
+	return &result, nil
+}
+
+func (s *Store) completeExternalEffectCreation(ctx context.Context, object *corev1alpha1.ExternalEffect, request store.ReserveExternalEffectRequest, id string, fence store.ControllerEpochFence, snapshot epochSnapshot) (*store.ExternalEffect, error) {
+	if !sameExternalEffectSpec(object, request, id) {
+		return nil, controlConflict("external effect %q was reused with a different identity or request digest", id)
+	}
+	if object.Status.Version > 0 {
+		existing := externalEffectFromObject(object)
+		return &existing, nil
+	}
+	updated := object.DeepCopy()
+	updated.Status.State = corev1alpha1.ExternalEffectControlState(store.ExternalEffectPending)
+	updated.Status.Attempts = 0
+	setMutationStatus(&updated.Status.ControlRecordMutationStatus, fence, snapshot, 1, "", "", request.CreatedAt, request.CreatedAt)
+	if err := s.client.Status().Update(ctx, updated); err != nil {
+		if apierrors.IsConflict(err) {
+			fresh, getErr := s.findExternalEffectByID(ctx, id)
+			if getErr == nil && sameExternalEffectSpec(fresh, request, id) && fresh.Status.Version > 0 {
+				result := externalEffectFromObject(fresh)
+				return &result, nil
+			}
+		}
+		return nil, mapKubernetesError("initialize external effect status", err)
+	}
+	result := externalEffectFromObject(updated)
+	return &result, nil
+}
+
+func (s *Store) findExternalEffectByID(ctx context.Context, id string) (*corev1alpha1.ExternalEffect, error) {
+	list := &corev1alpha1.ExternalEffectList{}
+	if err := s.readClient().List(ctx, list, s.namespacedListOptions(
+		client.MatchingLabels{corev1alpha1.ControlRecordIDHashLabel: dnsDigest(id)},
+	)...); err != nil {
+		return nil, mapKubernetesError("list external effects", err)
+	}
+	var match *corev1alpha1.ExternalEffect
+	for i := range list.Items {
+		if list.Items[i].Spec.ID != id {
+			continue
+		}
+		if match != nil {
+			return nil, controlConflict("multiple external effects exist for canonical ID %q", id)
+		}
+		match = list.Items[i].DeepCopy()
+	}
+	if match == nil {
+		return nil, store.ErrNotFound
+	}
+	return match, nil
+}
+
+func validateExternalEffectTransition(transition *store.ExternalEffectTransition) error {
+	if transition.ExpectedVersion < 1 {
+		return store.ValidationErrorf("external effect expected version must be at least 1")
+	}
+	if !isKnownExternalEffectState(transition.ExpectedState) || !isKnownExternalEffectState(transition.NewState) {
+		return store.ValidationErrorf("unsupported external effect transition %q -> %q", transition.ExpectedState, transition.NewState)
+	}
+	if !validExternalEffectTransition(transition.ExpectedState, transition.NewState) {
+		return store.ValidationErrorf("external effect transition %s -> %s is not allowed", transition.ExpectedState, transition.NewState)
+	}
+	if err := store.ValidateCanonicalDigest("external effect request digest", transition.RequestDigest); err != nil {
+		return err
+	}
+	transition.ExpectedLeaseOwner = strings.TrimSpace(transition.ExpectedLeaseOwner)
+	transition.LeaseOwner = strings.TrimSpace(transition.LeaseOwner)
+	transition.LeaseExpiresAt = normalizeOptionalControlTime(transition.LeaseExpiresAt)
+	transition.UpdatedAt = normalizeControlTime(transition.UpdatedAt)
+	if transition.ExpectedState == store.ExternalEffectInFlight {
+		if err := store.ValidateControlIdentifier("expected external effect lease owner", transition.ExpectedLeaseOwner); err != nil {
+			return err
+		}
+	} else if transition.ExpectedLeaseOwner != "" {
+		return store.ValidationErrorf("pending external effect transition must not set an expected lease owner")
+	}
+	if transition.NewState == store.ExternalEffectInFlight {
+		if err := store.ValidateControlIdentifier("external effect lease owner", transition.LeaseOwner); err != nil {
+			return err
+		}
+		if transition.LeaseExpiresAt == nil || !transition.LeaseExpiresAt.After(transition.UpdatedAt) {
+			return store.ValidationErrorf("in-flight external effect requires a future lease expiry")
+		}
+		if len(transition.Response) > 0 || transition.ResponseDigest != "" {
+			return store.ValidationErrorf("in-flight external effect must not include a response")
+		}
+	} else {
+		if transition.LeaseOwner != "" || transition.LeaseExpiresAt != nil {
+			return store.ValidationErrorf("non-in-flight external effect must clear lease fields")
+		}
+		if len(transition.Response) > 0 {
+			if err := store.ValidateControlPayload("external effect response", transition.Response); err != nil {
+				return err
+			}
+			if err := store.ValidateCanonicalDigest("external effect response digest", transition.ResponseDigest); err != nil {
+				return err
+			}
+			if canonicalBytesDigest(transition.Response) != transition.ResponseDigest {
+				return store.ValidationErrorf("external effect response digest does not match response bytes")
+			}
+		} else if transition.ResponseDigest != "" {
+			return store.ValidationErrorf("external effect response digest requires response bytes")
+		}
+	}
+	return nil
+}
+
+func sameExternalEffectSpec(object *corev1alpha1.ExternalEffect, request store.ReserveExternalEffectRequest, id string) bool {
+	return object.Namespace == request.Identity.Namespace && object.Spec.ID == id && object.Spec.Kind == request.Identity.Kind && object.Spec.IdentityNamespace == request.Identity.Namespace && object.Spec.AggregateID == request.Identity.AggregateID && object.Spec.OperationID == request.Identity.OperationID && object.Spec.RequestDigest == request.RequestDigest
+}
+
+func externalEffectFromObject(object *corev1alpha1.ExternalEffect) store.ExternalEffect {
+	return store.ExternalEffect{
+		ID: object.Spec.ID,
+		Identity: store.ExternalEffectIdentity{
+			Kind:        object.Spec.Kind,
+			Namespace:   object.Spec.IdentityNamespace,
+			AggregateID: object.Spec.AggregateID,
+			OperationID: object.Spec.OperationID,
+		},
+		RequestDigest:       object.Spec.RequestDigest,
+		State:               store.ExternalEffectState(object.Status.State),
+		ResponseDigest:      object.Status.ResponseDigest,
+		Response:            externalEffectResponseFromAPI(object.Status.Response),
+		LeaseOwner:          object.Status.LeaseOwner,
+		LeaseExpiresAt:      optionalTimeValue(object.Status.LeaseExpiresAt),
+		Attempts:            object.Status.Attempts,
+		ControllerEpochName: object.Status.ControllerEpochName,
+		ControllerEpoch:     object.Status.ControllerEpoch,
+		Version:             object.Status.Version,
+		CreatedAt:           timeValue(object.Status.CreatedAt),
+		UpdatedAt:           timeValue(object.Status.UpdatedAt),
+	}
+}
+
+func externalEffectResponseToAPI(value []byte) *apiextensionsv1.JSON {
+	if len(value) == 0 {
+		return nil
+	}
+	return &apiextensionsv1.JSON{Raw: append([]byte(nil), value...)}
+}
+
+func externalEffectResponseFromAPI(value *apiextensionsv1.JSON) []byte {
+	if value == nil || len(value.Raw) == 0 {
+		return nil
+	}
+	return append([]byte(nil), value.Raw...)
+}
+
+func metaTimePtr(value *time.Time) *metav1.Time {
+	if value == nil {
+		return nil
+	}
+	result := metav1.NewTime(value.UTC())
+	return &result
+}
+
+func isKnownExternalEffectState(state store.ExternalEffectState) bool {
+	switch state {
+	case store.ExternalEffectPending, store.ExternalEffectInFlight, store.ExternalEffectSucceeded, store.ExternalEffectFailed, store.ExternalEffectOutcomeUnknown:
+		return true
+	default:
+		return false
+	}
+}
+
+func validExternalEffectTransition(from, to store.ExternalEffectState) bool {
+	switch from {
+	case store.ExternalEffectPending:
+		return to == store.ExternalEffectInFlight || to == store.ExternalEffectSucceeded || to == store.ExternalEffectFailed || to == store.ExternalEffectOutcomeUnknown
+	case store.ExternalEffectInFlight:
+		return to == store.ExternalEffectInFlight || to == store.ExternalEffectSucceeded || to == store.ExternalEffectFailed || to == store.ExternalEffectOutcomeUnknown
+	default:
+		return false
+	}
+}
diff --git a/internal/store/kube/helpers.go b/internal/store/kube/helpers.go
new file mode 100644
index 000000000..cc2f467ba
--- /dev/null
+++ b/internal/store/kube/helpers.go
@@ -0,0 +1,229 @@
+package kube
+
+import (
+	"crypto/sha256"
+	"encoding/base32"
+	"encoding/hex"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+	coordinationv1 "k8s.io/api/coordination/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	utilvalidation "k8s.io/apimachinery/pkg/util/validation"
+)
+
+const (
+	annotationLogicalName       = "core.orka.ai/logical-name"
+	annotationControllerEpoch   = "core.orka.ai/controller-epoch"
+	annotationDomainVersion     = "core.orka.ai/domain-version"
+	annotationRequestDigest     = "core.orka.ai/request-digest"
+	annotationAcquiredAt        = "core.orka.ai/acquired-at"
+	annotationSessionName       = "core.orka.ai/session-name"
+	annotationSessionUID        = "core.orka.ai/session-uid"
+	annotationLeaseGeneration   = "core.orka.ai/lease-generation"
+	annotationLeaseMode         = "core.orka.ai/lease-mode"
+	annotationTaskUID           = "core.orka.ai/task-uid"
+	annotationAttempt           = "core.orka.ai/attempt"
+	annotationPromptID          = "core.orka.ai/prompt-id"
+	annotationSessionLineage    = "core.orka.ai/session-lineage-digest"
+	annotationLeaseExpiresAt    = "core.orka.ai/lease-expires-at"
+	annotationOperationID       = "core.orka.ai/operation-id"
+	annotationOperationDigest   = "core.orka.ai/operation-digest"
+	annotationMutationToken     = "core.orka.ai/epoch-mutation-token"
+	annotationMutationExpiresAt = "core.orka.ai/epoch-mutation-expires-at"
+	leaseModeEmpty              = "empty"
+	leaseModeMutation           = "mutation"
+	leaseModeReconciliation     = "reconciliation"
+	controllerEpochNamePrefix   = "controller-epoch-"
+	controllerEpochLeasePrefix  = "controller-epoch-lock-"
+	promptAttemptNamePrefix     = "prompt-attempt-"
+	runtimeSessionNamePrefix    = "runtime-session-"
+	runtimeSessionLeasePrefix   = "runtime-session-lock-"
+	branchClaimNamePrefix       = "branch-claim-"
+	publicationNamePrefix       = "publication-"
+	externalEffectNamePrefix    = "external-effect-"
+)
+
+var dnsDigestEncoding = base32.StdEncoding.WithPadding(base32.NoPadding)
+
+type epochSnapshot struct {
+	Name                 string
+	Epoch                int64
+	HolderID             string
+	LeaseResourceVersion string
+	MutationToken        string
+	MutationLease        *coordinationv1.Lease
+	LocalMutationSlot    bool
+}
+
+func validateKubernetesNamespace(namespace string) error {
+	if namespace == "" {
+		return store.ValidationErrorf("control namespace is required")
+	}
+	if problems := utilvalidation.IsDNS1123Label(namespace); len(problems) > 0 {
+		return store.ValidationErrorf("control namespace %q is invalid: %s", namespace, strings.Join(problems, "; "))
+	}
+	return nil
+}
+
+func normalizeControllerEpochName(name string) (string, error) {
+	name = strings.TrimSpace(name)
+	if name == "" {
+		name = store.DefaultControllerEpochName
+	}
+	if err := store.ValidateControlIdentifier("controller epoch name", name); err != nil {
+		return "", err
+	}
+	if name != store.DefaultControllerEpochName {
+		return "", store.ValidationErrorf("first-release control store supports only controller epoch %q", store.DefaultControllerEpochName)
+	}
+	return name, nil
+}
+
+func normalizeEpochFence(fence store.ControllerEpochFence) (store.ControllerEpochFence, error) {
+	name, err := normalizeControllerEpochName(fence.Name)
+	if err != nil {
+		return store.ControllerEpochFence{}, err
+	}
+	fence.Name = name
+	fence.HolderID = strings.TrimSpace(fence.HolderID)
+	if err := store.ValidateControlIdentifier("controller epoch holder ID", fence.HolderID); err != nil {
+		return store.ControllerEpochFence{}, err
+	}
+	if fence.Epoch < 1 {
+		return store.ControllerEpochFence{}, store.ValidationErrorf("controller epoch must be at least 1")
+	}
+	return fence, nil
+}
+
+func normalizeControlTime(value time.Time) time.Time {
+	if value.IsZero() {
+		return time.Now().UTC()
+	}
+	return value.UTC()
+}
+
+func normalizeOptionalControlTime(value *time.Time) *time.Time {
+	if value == nil {
+		return nil
+	}
+	normalized := value.UTC()
+	return &normalized
+}
+
+func metaTime(value time.Time) *metav1.Time {
+	if value.IsZero() {
+		return nil
+	}
+	result := metav1.NewTime(value.UTC())
+	return &result
+}
+
+func timeValue(value *metav1.Time) time.Time {
+	if value == nil {
+		return time.Time{}
+	}
+	return value.UTC()
+}
+
+func optionalTimeValue(value *metav1.Time) *time.Time {
+	if value == nil {
+		return nil
+	}
+	result := value.UTC()
+	return &result
+}
+
+func dnsDigest(value string) string {
+	sum := sha256.Sum256([]byte(value))
+	return strings.ToLower(dnsDigestEncoding.EncodeToString(sum[:]))
+}
+
+func objectName(prefix, logicalID string) string {
+	return prefix + dnsDigest(logicalID)
+}
+
+func controlLabels(logicalID string) map[string]string {
+	return map[string]string{corev1alpha1.ControlRecordIDHashLabel: dnsDigest(logicalID)}
+}
+
+func labelIfValid(labels map[string]string, key, value string) {
+	if value == "" || len(utilvalidation.IsValidLabelValue(value)) != 0 {
+		return
+	}
+	labels[key] = value
+}
+
+func controlConflict(format string, args ...any) error {
+	return fmt.Errorf("%w: %s", store.ErrConflict, fmt.Sprintf(format, args...))
+}
+
+func mapKubernetesError(action string, err error) error {
+	if err == nil {
+		return nil
+	}
+	switch {
+	case apierrors.IsNotFound(err):
+		return fmt.Errorf("%w: %s", store.ErrNotFound, action)
+	case apierrors.IsConflict(err), apierrors.IsAlreadyExists(err):
+		return fmt.Errorf("%w: %s: %v", store.ErrConflict, action, err)
+	default:
+		return fmt.Errorf("%s: %w", action, err)
+	}
+}
+
+func setMutationStatus(status *corev1alpha1.ControlRecordMutationStatus, fence store.ControllerEpochFence, snapshot epochSnapshot, version int64, operationID, operationDigest string, createdAt, updatedAt time.Time) {
+	status.ControllerEpochName = fence.Name
+	status.ControllerEpoch = fence.Epoch
+	status.ControllerEpochLeaseResourceVersion = snapshot.LeaseResourceVersion
+	status.LastOperationID = operationID
+	status.LastOperationDigest = operationDigest
+	status.Version = version
+	status.CreatedAt = metaTime(createdAt)
+	status.UpdatedAt = metaTime(updatedAt)
+}
+
+func canonicalBytesDigest(value []byte) string {
+	sum := sha256.Sum256(value)
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
+
+func parsePositiveInt64(field, value string) (int64, error) {
+	parsed, err := strconv.ParseInt(value, 10, 64)
+	if err != nil || parsed < 1 {
+		return 0, fmt.Errorf("invalid %s annotation %q", field, value)
+	}
+	return parsed, nil
+}
+
+func parseNonNegativeInt64(field, value string) (int64, error) {
+	parsed, err := strconv.ParseInt(value, 10, 64)
+	if err != nil || parsed < 0 {
+		return 0, fmt.Errorf("invalid %s annotation %q", field, value)
+	}
+	return parsed, nil
+}
+
+func formatTime(value time.Time) string {
+	return value.UTC().Format(time.RFC3339Nano)
+}
+
+func parseTime(field, value string) (time.Time, error) {
+	parsed, err := time.Parse(time.RFC3339Nano, value)
+	if err != nil {
+		return time.Time{}, fmt.Errorf("invalid %s annotation %q: %w", field, value, err)
+	}
+	return parsed.UTC(), nil
+}
+
+func sameOptionalTime(a, b *time.Time) bool {
+	if a == nil || b == nil {
+		return a == nil && b == nil
+	}
+	return a.Equal(*b)
+}
diff --git a/internal/store/kube/outbox.go b/internal/store/kube/outbox.go
new file mode 100644
index 000000000..0ebad8dac
--- /dev/null
+++ b/internal/store/kube/outbox.go
@@ -0,0 +1,59 @@
+package kube
+
+import (
+	"context"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+// EnqueueOutboxProjection validates the Kubernetes controller epoch and then
+// persists the SQLite-owned outbox record without consulting SQLite controls.
+func (s *Store) EnqueueOutboxProjection(ctx context.Context, projection *store.OutboxProjection, fence store.ControllerEpochFence) (*store.OutboxProjection, error) {
+	if s.outbox == nil {
+		return nil, ErrOutboxStoreNotConfigured
+	}
+	normalized, snapshot, err := s.requireControllerEpoch(ctx, fence)
+	if err != nil {
+		return nil, err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	return s.outbox.EnqueueOutboxProjectionRecord(ctx, projection, normalized)
+}
+
+// GetOutboxProjection reads the SQLite-owned outbox record.
+func (s *Store) GetOutboxProjection(ctx context.Context, id string) (*store.OutboxProjection, error) {
+	if s.outbox == nil {
+		return nil, ErrOutboxStoreNotConfigured
+	}
+	return s.outbox.GetOutboxProjection(ctx, id)
+}
+
+// ClaimOutboxProjections validates the Kubernetes controller epoch before the
+// SQLite adapter atomically claims due records.
+func (s *Store) ClaimOutboxProjections(ctx context.Context, request store.ClaimOutboxProjectionsRequest) ([]store.OutboxProjection, error) {
+	if s.outbox == nil {
+		return nil, ErrOutboxStoreNotConfigured
+	}
+	normalized, snapshot, err := s.requireControllerEpoch(ctx, request.Fence)
+	if err != nil {
+		return nil, err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	request.Fence = normalized
+	return s.outbox.ClaimOutboxProjectionRecords(ctx, request)
+}
+
+// CompleteOutboxProjection validates the Kubernetes controller epoch before
+// the SQLite adapter completes, retries, or dead-letters the exact claim.
+func (s *Store) CompleteOutboxProjection(ctx context.Context, request store.CompleteOutboxProjectionRequest) (*store.OutboxProjection, error) {
+	if s.outbox == nil {
+		return nil, ErrOutboxStoreNotConfigured
+	}
+	normalized, snapshot, err := s.requireControllerEpoch(ctx, request.Fence)
+	if err != nil {
+		return nil, err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	request.Fence = normalized
+	return s.outbox.CompleteOutboxProjectionRecord(ctx, request)
+}
diff --git a/internal/store/kube/prompt_attempt.go b/internal/store/kube/prompt_attempt.go
new file mode 100644
index 000000000..a3fe82173
--- /dev/null
+++ b/internal/store/kube/prompt_attempt.go
@@ -0,0 +1,1607 @@
+package kube
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"reflect"
+	"sort"
+	"strings"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/meta"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+	"github.com/orka-agents/orka/internal/taskterminal"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/util/retry"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+// CreatePromptAttempt creates the immutable PromptAttempt spec and initializes
+// its status under the exact controller-epoch fence.
+func (s *Store) CreatePromptAttempt(ctx context.Context, attempt *store.PromptAttempt, fence store.ControllerEpochFence) (*store.PromptAttempt, error) {
+	if err := s.requireClient(); err != nil {
+		return nil, err
+	}
+	normalized, normalizedFence, err := normalizePromptAttemptForCreate(attempt, fence)
+	if err != nil {
+		return nil, err
+	}
+	_, snapshot, err := s.requireControllerEpoch(ctx, normalizedFence)
+	if err != nil {
+		return nil, err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	if err := s.rejectPromptAttemptCreationAfterReclamation(ctx, normalized.Key.Namespace, normalized.Key.TaskUID); err != nil {
+		return nil, err
+	}
+
+	name := objectName(promptAttemptNamePrefix, normalized.ID)
+	key := client.ObjectKey{Namespace: normalized.Key.Namespace, Name: name}
+	object := &corev1alpha1.PromptAttempt{}
+	err = s.readClient().Get(ctx, key, object)
+	if err == nil {
+		return s.completePromptAttemptCreationWithReclamationFence(ctx, object, normalized, normalizedFence, snapshot, false)
+	}
+	if !apierrors.IsNotFound(err) {
+		return nil, mapKubernetesError("get prompt attempt", err)
+	}
+
+	labels := controlLabels(normalized.ID)
+	labelIfValid(labels, corev1alpha1.ControlRecordTaskUIDLabel, normalized.Key.TaskUID)
+	object = &corev1alpha1.PromptAttempt{
+		ObjectMeta: metav1.ObjectMeta{Namespace: normalized.Key.Namespace, Name: name, Labels: labels},
+		Spec: corev1alpha1.PromptAttemptSpec{
+			ID: normalized.ID, TaskUID: normalized.Key.TaskUID, Attempt: normalized.Key.Attempt,
+			PromptID: normalized.Key.PromptID, RequestDigest: normalized.RequestDigest,
+			BindingDigest: normalized.BindingDigest, SnapshotDigest: normalized.SnapshotDigest,
+			CredentialBindings: promptCredentialBindingsToAPI(normalized.CredentialBindings),
+		},
+	}
+	if err := s.client.Create(ctx, object); err != nil {
+		if apierrors.IsAlreadyExists(err) {
+			if getErr := s.readClient().Get(ctx, key, object); getErr != nil {
+				return nil, mapKubernetesError("get concurrently created prompt attempt", getErr)
+			}
+			return s.completePromptAttemptCreationWithReclamationFence(ctx, object, normalized, normalizedFence, snapshot, false)
+		}
+		return nil, mapKubernetesError("create prompt attempt", err)
+	}
+	return s.completePromptAttemptCreationWithReclamationFence(ctx, object, normalized, normalizedFence, snapshot, true)
+}
+
+func (s *Store) completePromptAttemptCreationWithReclamationFence(
+	ctx context.Context,
+	object *corev1alpha1.PromptAttempt,
+	normalized store.PromptAttempt,
+	fence store.ControllerEpochFence,
+	snapshot epochSnapshot,
+	created bool,
+) (*store.PromptAttempt, error) {
+	result, err := s.completePromptAttemptCreation(ctx, object, normalized, fence, snapshot)
+	if err != nil {
+		return nil, err
+	}
+	if err := s.rejectPromptAttemptCreationAfterReclamation(ctx, normalized.Key.Namespace, normalized.Key.TaskUID); err != nil {
+		if created {
+			uid, resourceVersion := object.UID, object.ResourceVersion
+			deleteErr := s.client.Delete(ctx, object, &client.DeleteOptions{Preconditions: &metav1.Preconditions{
+				UID: &uid, ResourceVersion: &resourceVersion,
+			}})
+			if deleteErr != nil && !apierrors.IsNotFound(deleteErr) {
+				return nil, fmt.Errorf("rollback PromptAttempt created after reclamation preparation: %v (original error: %w)", deleteErr, err)
+			}
+		}
+		return nil, err
+	}
+	return result, nil
+}
+
+func (s *Store) rejectPromptAttemptCreationAfterReclamation(ctx context.Context, namespace, taskUID string) error {
+	task, err := s.findPromptAttemptOwnerTask(ctx, namespace, taskUID)
+	if err != nil {
+		return err
+	}
+	if task.Spec.Type != corev1alpha1.TaskTypeAgent {
+		return controlConflict("Task %s/%s is not an agent Task", task.Namespace, task.Name)
+	}
+	if !task.DeletionTimestamp.IsZero() {
+		return controlConflict("Task %s/%s is being deleted", task.Namespace, task.Name)
+	}
+	if condition := meta.FindStatusCondition(task.Status.Conditions, promptAttemptReclamationCompleteCondition); condition != nil {
+		return controlConflict("Task %q has already completed PromptAttempt reclamation", taskUID)
+	}
+
+	marker := &corev1.ConfigMap{}
+	key := client.ObjectKey{Namespace: s.controlNamespace, Name: promptAttemptReclamationMarkerName(taskUID)}
+	if err := s.readClient().Get(ctx, key, marker); err != nil {
+		if apierrors.IsNotFound(err) {
+			return nil
+		}
+		return mapKubernetesError("get prompt attempt reclamation marker before create", err)
+	}
+	prepared, err := promptAttemptReclamationMarkerFromConfigMap(marker)
+	if err != nil {
+		return err
+	}
+	if prepared.Namespace != namespace || prepared.TaskUID != taskUID {
+		return controlConflict("PromptAttempt reclamation marker does not match Task %q", taskUID)
+	}
+	return controlConflict("Task %q has already prepared PromptAttempt reclamation", taskUID)
+}
+
+func (s *Store) findPromptAttemptOwnerTask(ctx context.Context, namespace, taskUID string) (*corev1alpha1.Task, error) {
+	tasks := &corev1alpha1.TaskList{}
+	if err := s.readClient().List(ctx, tasks, client.InNamespace(namespace)); err != nil {
+		return nil, mapKubernetesError("list Tasks for PromptAttempt owner", err)
+	}
+	var found *corev1alpha1.Task
+	for i := range tasks.Items {
+		task := &tasks.Items[i]
+		if string(task.UID) != taskUID {
+			continue
+		}
+		if found != nil {
+			return nil, controlConflict("Task UID %q is not unique in namespace %q", taskUID, namespace)
+		}
+		found = task.DeepCopy()
+	}
+	if found == nil {
+		return nil, controlConflict("Task UID %q does not identify a live Task in namespace %q", taskUID, namespace)
+	}
+	return found, nil
+}
+
+// GetPromptAttempt returns a PromptAttempt by canonical ID within the configured watch scope.
+func (s *Store) GetPromptAttempt(ctx context.Context, id string) (*store.PromptAttempt, error) {
+	if err := s.requireClient(); err != nil {
+		return nil, err
+	}
+	id = strings.TrimSpace(id)
+	if err := store.ValidateControlIdentifier("prompt attempt ID", id); err != nil {
+		return nil, err
+	}
+	object, err := s.findPromptAttemptByID(ctx, id)
+	if err != nil {
+		return nil, err
+	}
+	result := promptAttemptFromObject(object)
+	return &result, nil
+}
+
+const (
+	promptAttemptReclamationNamePrefix = "prompt-reclaim-"
+	promptAttemptReclamationDataKey    = "reclamation.json"
+	promptAttemptReclamationVersion    = 1
+	restoredTaskIdentityChangedReason  = corev1alpha1.TaskExecutionReason("RestoreIdentityChanged")
+
+	promptAttemptReclamationCompleteCondition = "ACPPromptAttemptsReclaimed"
+	promptAttemptReclamationCompleteReason    = "PromptAttemptsReclaimed"
+)
+
+type promptAttemptReclamationCompletionReceipt struct {
+	Version                           int                                `json:"version"`
+	Namespace                         string                             `json:"namespace"`
+	TaskName                          string                             `json:"taskName"`
+	TaskUID                           string                             `json:"taskUid"`
+	Mode                              store.PromptAttemptReclamationMode `json:"mode"`
+	ContinuitySession                 bool                               `json:"continuitySession,omitempty"`
+	FinalContinuitySession            bool                               `json:"finalContinuitySession,omitempty"`
+	FinalPromptAttemptID              string                             `json:"finalPromptAttemptId,omitempty"`
+	TerminalProjectionID              string                             `json:"terminalProjectionId,omitempty"`
+	RelatedExternalEffectAggregateIDs []string                           `json:"relatedExternalEffectAggregateIds,omitempty"`
+}
+
+type promptAttemptReclamationMarker struct {
+	Version                             int                                `json:"version"`
+	Namespace                           string                             `json:"namespace"`
+	TaskName                            string                             `json:"taskName"`
+	TaskUID                             string                             `json:"taskUid"`
+	Mode                                store.PromptAttemptReclamationMode `json:"mode"`
+	ContinuitySession                   bool                               `json:"continuitySession,omitempty"`
+	FinalContinuitySession              bool                               `json:"finalContinuitySession,omitempty"`
+	FinalPromptAttemptID                string                             `json:"finalPromptAttemptId,omitempty"`
+	TerminalProjectionID                string                             `json:"terminalProjectionId,omitempty"`
+	TerminalProjectionPayloadDigest     string                             `json:"terminalProjectionPayloadDigest,omitempty"`
+	FinalSessionTurnID                  string                             `json:"finalSessionTurnId,omitempty"`
+	TerminalProjectionAggregateKind     string                             `json:"terminalProjectionAggregateKind,omitempty"`
+	TerminalProjectionAggregateID       string                             `json:"terminalProjectionAggregateId,omitempty"`
+	CandidateIDs                        []string                           `json:"candidateIds,omitempty"`
+	RequestedExternalEffectAggregateIDs []string                           `json:"requestedExternalEffectAggregateIds,omitempty"`
+	RelatedExternalEffectAggregateIDs   []string                           `json:"relatedExternalEffectAggregateIds,omitempty"`
+}
+
+// PreparePromptAttemptReclamation proves the deletion barriers and persists a
+// durable marker before any PromptAttempt is removed. The marker makes partial
+// deletion retries safe until ReclaimPromptAttempts removes it after completion.
+func (s *Store) PreparePromptAttemptReclamation(ctx context.Context, request store.ReclaimPromptAttemptsRequest) error {
+	if err := s.requireClient(); err != nil {
+		return err
+	}
+	normalized, err := normalizePromptAttemptReclamationRequestKube(request)
+	if err != nil {
+		return err
+	}
+	fence, snapshot, err := s.requireControllerEpoch(ctx, normalized.Fence)
+	if err != nil {
+		return err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	normalized.Fence = fence
+	_, _, err = s.preparePromptAttemptReclamationLocked(ctx, normalized, fence, snapshot)
+	return err
+}
+
+// ReclaimPromptAttempts removes every PromptAttempt authorized by the durable
+// reclamation marker. If no marker exists, it performs the same preflight and
+// creates the marker before issuing the first delete. The final attempt is
+// deleted last so a partial Kubernetes deletion remains safely retryable. Once
+// every authorized PromptAttempt is absent, the marker is removed with exact
+// object preconditions; a later projected retry with no marker or candidates is
+// treated as an already-completed deletion.
+func (s *Store) ReclaimPromptAttempts(ctx context.Context, request store.ReclaimPromptAttemptsRequest) (int, error) {
+	if err := s.requireClient(); err != nil {
+		return 0, err
+	}
+	normalized, err := normalizePromptAttemptReclamationRequestKube(request)
+	if err != nil {
+		return 0, err
+	}
+	fence, snapshot, err := s.requireControllerEpoch(ctx, normalized.Fence)
+	if err != nil {
+		return 0, err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	normalized.Fence = fence
+
+	marker, candidates, err := s.preparePromptAttemptReclamationLocked(ctx, normalized, fence, snapshot)
+	if err != nil {
+		return 0, err
+	}
+	if marker.Version == 0 {
+		return 0, nil
+	}
+	sort.Slice(candidates, func(i, j int) bool {
+		leftFinal := candidates[i].Spec.ID == marker.FinalPromptAttemptID
+		rightFinal := candidates[j].Spec.ID == marker.FinalPromptAttemptID
+		if leftFinal != rightFinal {
+			return !leftFinal
+		}
+		if candidates[i].Spec.Attempt != candidates[j].Spec.Attempt {
+			return candidates[i].Spec.Attempt < candidates[j].Spec.Attempt
+		}
+		return candidates[i].Spec.ID < candidates[j].Spec.ID
+	})
+	deleted := 0
+	for _, object := range candidates {
+		uid := object.UID
+		resourceVersion := object.ResourceVersion
+		err := s.client.Delete(ctx, object, &client.DeleteOptions{Preconditions: &metav1.Preconditions{
+			UID: &uid, ResourceVersion: &resourceVersion,
+		}})
+		if apierrors.IsNotFound(err) {
+			continue
+		}
+		if err != nil {
+			return deleted, mapKubernetesError("delete reclaimed prompt attempt", err)
+		}
+		deleted++
+	}
+	if err := s.removeCompletedPromptAttemptReclamationMarker(ctx, marker, func() error {
+		return s.recordPromptAttemptReclamationCompletion(ctx, normalized)
+	}); err != nil {
+		return deleted, err
+	}
+	return deleted, nil
+}
+
+func (s *Store) preparePromptAttemptReclamationLocked(
+	ctx context.Context,
+	request store.ReclaimPromptAttemptsRequest,
+	fence store.ControllerEpochFence,
+	snapshot epochSnapshot,
+) (promptAttemptReclamationMarker, []*corev1alpha1.PromptAttempt, error) {
+	task := &corev1alpha1.Task{}
+	taskKey := client.ObjectKey{Namespace: request.Namespace, Name: request.TaskName}
+	if err := s.readClient().Get(ctx, taskKey, task); err != nil {
+		return promptAttemptReclamationMarker{}, nil, mapKubernetesError("get Task for prompt attempt reclamation", err)
+	}
+	if task.Spec.Type != corev1alpha1.TaskTypeAgent || task.DeletionTimestamp.IsZero() {
+		return promptAttemptReclamationMarker{}, nil, controlConflict("Task %s/%s does not match deleting agent Task UID %q", request.Namespace, request.TaskName, request.TaskUID)
+	}
+
+	candidates, err := s.listTaskPromptAttempts(ctx, request.Namespace, request.TaskUID)
+	if err != nil {
+		return promptAttemptReclamationMarker{}, nil, err
+	}
+	if err := validatePromptAttemptReclamationTaskIdentityKube(task, request, candidates); err != nil {
+		return promptAttemptReclamationMarker{}, nil, err
+	}
+	completed, err := promptAttemptReclamationCompleted(task, request)
+	if err != nil {
+		return promptAttemptReclamationMarker{}, nil, err
+	}
+	if completed && len(candidates) != 0 {
+		return promptAttemptReclamationMarker{}, nil, controlConflict("Task %q has a reclamation completion receipt but still owns PromptAttempts", request.TaskUID)
+	}
+	markerObject := &corev1.ConfigMap{}
+	markerKey := client.ObjectKey{Namespace: s.controlNamespace, Name: promptAttemptReclamationMarkerName(request.TaskUID)}
+	markerErr := s.readClient().Get(ctx, markerKey, markerObject)
+	if markerErr == nil {
+		marker, parseErr := promptAttemptReclamationMarkerFromConfigMap(markerObject)
+		if parseErr != nil {
+			return promptAttemptReclamationMarker{}, nil, parseErr
+		}
+		if err := validatePromptAttemptReclamationMarkerRequestKube(marker, request, task); err != nil {
+			return promptAttemptReclamationMarker{}, nil, err
+		}
+		if err := s.verifyPreparedPromptAttemptReclamationKube(ctx, marker, candidates); err != nil {
+			return promptAttemptReclamationMarker{}, nil, err
+		}
+		return marker, candidates, nil
+	}
+	if !apierrors.IsNotFound(markerErr) {
+		return promptAttemptReclamationMarker{}, nil, mapKubernetesError("get prompt attempt reclamation marker", markerErr)
+	}
+	if completed {
+		return promptAttemptReclamationMarker{}, nil, nil
+	}
+
+	if request.Mode == store.PromptAttemptReclamationUnbound {
+		candidates, err = s.settleUnboundPromptAttemptsForReclamation(ctx, candidates, fence, snapshot)
+		if err != nil {
+			return promptAttemptReclamationMarker{}, nil, err
+		}
+	}
+	marker, err := s.buildPromptAttemptReclamationMarkerKube(ctx, request, candidates)
+	if err != nil {
+		return promptAttemptReclamationMarker{}, nil, err
+	}
+	encoded, err := json.Marshal(marker)
+	if err != nil {
+		return promptAttemptReclamationMarker{}, nil, fmt.Errorf("encode prompt attempt reclamation marker: %w", err)
+	}
+	immutable := true
+	markerObject = &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: s.controlNamespace,
+			Name:      markerKey.Name,
+			Labels:    controlLabels(store.CanonicalControlID("prompt-attempt-reclamation", request.Namespace, request.TaskUID)),
+		},
+		Immutable: &immutable,
+		Data:      map[string]string{promptAttemptReclamationDataKey: string(encoded)},
+	}
+	labelIfValid(markerObject.Labels, corev1alpha1.ControlRecordTaskUIDLabel, request.TaskUID)
+	createdMarker := false
+	if err := s.client.Create(ctx, markerObject); err != nil {
+		if !apierrors.IsAlreadyExists(err) {
+			return promptAttemptReclamationMarker{}, nil, mapKubernetesError("create prompt attempt reclamation marker", err)
+		}
+		if getErr := s.readClient().Get(ctx, markerKey, markerObject); getErr != nil {
+			return promptAttemptReclamationMarker{}, nil, mapKubernetesError("get concurrently created prompt attempt reclamation marker", getErr)
+		}
+		existing, parseErr := promptAttemptReclamationMarkerFromConfigMap(markerObject)
+		if parseErr != nil {
+			return promptAttemptReclamationMarker{}, nil, parseErr
+		}
+		if err := validatePromptAttemptReclamationMarkerRequestKube(existing, request, task); err != nil {
+			return promptAttemptReclamationMarker{}, nil, err
+		}
+		marker = existing
+	} else {
+		createdMarker = true
+	}
+	freshCandidates, err := s.listTaskPromptAttempts(ctx, request.Namespace, request.TaskUID)
+	if err == nil {
+		err = s.verifyPreparedPromptAttemptReclamationKube(ctx, marker, freshCandidates)
+	}
+	if err != nil {
+		if createdMarker {
+			err = errors.Join(err, s.rollbackPromptAttemptReclamationMarker(ctx, markerObject))
+		}
+		return promptAttemptReclamationMarker{}, nil, err
+	}
+	return marker, freshCandidates, nil
+}
+
+func (s *Store) rollbackPromptAttemptReclamationMarker(ctx context.Context, marker *corev1.ConfigMap) error {
+	if marker == nil {
+		return nil
+	}
+	uid := marker.UID
+	resourceVersion := marker.ResourceVersion
+	err := s.client.Delete(ctx, marker, &client.DeleteOptions{Preconditions: &metav1.Preconditions{
+		UID: &uid, ResourceVersion: &resourceVersion,
+	}})
+	if apierrors.IsNotFound(err) {
+		return nil
+	}
+	return mapKubernetesError("roll back raced prompt attempt reclamation marker", err)
+}
+
+func (s *Store) removeCompletedPromptAttemptReclamationMarker(
+	ctx context.Context,
+	expected promptAttemptReclamationMarker,
+	recordCompletion func() error,
+) error {
+	remaining, err := s.listTaskPromptAttempts(ctx, expected.Namespace, expected.TaskUID)
+	if err != nil {
+		return err
+	}
+	markerObject := &corev1.ConfigMap{}
+	markerKey := client.ObjectKey{Namespace: s.controlNamespace, Name: promptAttemptReclamationMarkerName(expected.TaskUID)}
+	if err := s.readClient().Get(ctx, markerKey, markerObject); err != nil {
+		if apierrors.IsNotFound(err) && len(remaining) == 0 {
+			return recordCompletion()
+		}
+		if apierrors.IsNotFound(err) {
+			return controlConflict("prompt attempt reclamation marker disappeared while Task %q still owns PromptAttempts", expected.TaskUID)
+		}
+		return mapKubernetesError("get completed prompt attempt reclamation marker", err)
+	}
+	current, err := promptAttemptReclamationMarkerFromConfigMap(markerObject)
+	if err != nil {
+		return err
+	}
+	expected.CandidateIDs = normalizePromptAttemptReclamationIDs(expected.CandidateIDs)
+	expected.RequestedExternalEffectAggregateIDs = normalizePromptAttemptReclamationIDs(expected.RequestedExternalEffectAggregateIDs)
+	expected.RelatedExternalEffectAggregateIDs = normalizePromptAttemptReclamationIDs(expected.RelatedExternalEffectAggregateIDs)
+	if !reflect.DeepEqual(current, expected) {
+		return controlConflict("prompt attempt reclamation marker changed before cleanup")
+	}
+	if err := s.verifyPreparedPromptAttemptReclamationKube(ctx, current, remaining); err != nil {
+		return err
+	}
+	if len(remaining) != 0 {
+		return promptAttemptReclaimNotReady("Task %q still has %d PromptAttempts after reclamation", expected.TaskUID, len(remaining))
+	}
+	if err := recordCompletion(); err != nil {
+		return err
+	}
+	uid := markerObject.UID
+	resourceVersion := markerObject.ResourceVersion
+	err = s.client.Delete(ctx, markerObject, &client.DeleteOptions{Preconditions: &metav1.Preconditions{
+		UID: &uid, ResourceVersion: &resourceVersion,
+	}})
+	if apierrors.IsNotFound(err) {
+		return nil
+	}
+	return mapKubernetesError("delete completed prompt attempt reclamation marker", err)
+}
+
+func promptAttemptReclamationCompletionDigest(request store.ReclaimPromptAttemptsRequest) (string, error) {
+	terminalProjectionID := request.TerminalProjectionID
+	if request.ContinuitySession && !request.FinalContinuitySession {
+		// Before a continuity Session is bound, the initial cleanup proves the
+		// standalone Task projection through the durable marker. After the final
+		// PromptAttempt is gone the controller intentionally cannot reconstruct
+		// that ID, so the Task-scoped completion receipt treats it as a wildcard.
+		terminalProjectionID = ""
+	}
+	receipt := promptAttemptReclamationCompletionReceipt{
+		Version:                           promptAttemptReclamationVersion,
+		Namespace:                         request.Namespace,
+		TaskName:                          request.TaskName,
+		TaskUID:                           request.TaskUID,
+		Mode:                              request.Mode,
+		ContinuitySession:                 request.ContinuitySession,
+		FinalContinuitySession:            request.FinalContinuitySession,
+		FinalPromptAttemptID:              request.FinalPromptAttemptID,
+		TerminalProjectionID:              terminalProjectionID,
+		RelatedExternalEffectAggregateIDs: append([]string(nil), request.RelatedExternalEffectAggregateIDs...),
+	}
+	receipt.RelatedExternalEffectAggregateIDs = normalizePromptAttemptReclamationIDs(receipt.RelatedExternalEffectAggregateIDs)
+	encoded, err := json.Marshal(receipt)
+	if err != nil {
+		return "", fmt.Errorf("encode PromptAttempt reclamation completion receipt: %w", err)
+	}
+	return canonicalBytesDigest(encoded), nil
+}
+
+func promptAttemptReclamationCompleted(task *corev1alpha1.Task, request store.ReclaimPromptAttemptsRequest) (bool, error) {
+	condition := meta.FindStatusCondition(task.Status.Conditions, promptAttemptReclamationCompleteCondition)
+	if condition == nil {
+		return false, nil
+	}
+	expectedDigest, err := promptAttemptReclamationCompletionDigest(request)
+	if err != nil {
+		return false, err
+	}
+	if condition.Status != metav1.ConditionTrue || condition.Reason != promptAttemptReclamationCompleteReason || condition.Message != expectedDigest {
+		return false, controlConflict("Task %s/%s PromptAttempt reclamation completion receipt does not match the requested cleanup", task.Namespace, task.Name)
+	}
+	return true, nil
+}
+
+func (s *Store) recordPromptAttemptReclamationCompletion(ctx context.Context, request store.ReclaimPromptAttemptsRequest) error {
+	digest, err := promptAttemptReclamationCompletionDigest(request)
+	if err != nil {
+		return err
+	}
+	key := client.ObjectKey{Namespace: request.Namespace, Name: request.TaskName}
+	err = retry.RetryOnConflict(retry.DefaultBackoff, func() error {
+		task := &corev1alpha1.Task{}
+		if err := s.readClient().Get(ctx, key, task); err != nil {
+			return err
+		}
+		if task.Spec.Type != corev1alpha1.TaskTypeAgent || task.DeletionTimestamp.IsZero() {
+			return controlConflict("Task %s/%s no longer matches deleting agent Task UID %q", request.Namespace, request.TaskName, request.TaskUID)
+		}
+		if err := validatePromptAttemptReclamationTaskIdentityKube(task, request, nil); err != nil {
+			return err
+		}
+		if completed, completedErr := promptAttemptReclamationCompleted(task, request); completedErr != nil {
+			return completedErr
+		} else if completed {
+			return nil
+		}
+		meta.SetStatusCondition(&task.Status.Conditions, metav1.Condition{
+			Type:               promptAttemptReclamationCompleteCondition,
+			Status:             metav1.ConditionTrue,
+			ObservedGeneration: task.Generation,
+			LastTransitionTime: metav1.Now(),
+			Reason:             promptAttemptReclamationCompleteReason,
+			Message:            digest,
+		})
+		if err := s.client.Status().Update(ctx, task); err != nil {
+			return err
+		}
+		return nil
+	})
+	return mapKubernetesError("record PromptAttempt reclamation completion", err)
+}
+
+func validatePromptAttemptReclamationTaskIdentityKube(
+	task *corev1alpha1.Task,
+	request store.ReclaimPromptAttemptsRequest,
+	candidates []*corev1alpha1.PromptAttempt,
+) error {
+	if task == nil {
+		return controlConflict("prompt attempt reclamation Task is missing")
+	}
+	if string(task.UID) == request.TaskUID {
+		return nil
+	}
+	if request.Mode != store.PromptAttemptReclamationProjected {
+		return controlConflict("restored Task %s/%s may only reclaim its projected source PromptAttempt", task.Namespace, task.Name)
+	}
+	binding := task.Status.AgentExecutionBinding
+	execution := task.Status.Execution
+	if binding == nil || execution == nil || binding.ContractVersion != corev1alpha1.AgentRuntimeContractHarnessV2 ||
+		string(binding.Task.UID) != request.TaskUID || binding.Task.UID == task.UID ||
+		execution.Reason != restoredTaskIdentityChangedReason ||
+		execution.Attempt < 1 || strings.TrimSpace(execution.PromptID) == "" ||
+		!restoredTaskExecutionIsTerminal(task) {
+		return controlConflict("Task %s/%s does not contain validated restored source identity %q", task.Namespace, task.Name, request.TaskUID)
+	}
+	snapshotKey := store.AgentExecutionSnapshotKey{TaskUID: request.TaskUID, Digest: binding.Snapshot.Digest}
+	if binding.Snapshot.ID != snapshotKey.ID() || binding.Snapshot.SchemaVersion != store.AgentExecutionSnapshotSchemaVersion {
+		return controlConflict("Task %s/%s restored execution snapshot does not match source identity %q", task.Namespace, task.Name, request.TaskUID)
+	}
+	attemptID, err := (store.PromptAttemptKey{
+		Namespace: task.Namespace,
+		TaskUID:   request.TaskUID,
+		Attempt:   int64(execution.Attempt),
+		PromptID:  execution.PromptID,
+	}).CanonicalID()
+	if err != nil {
+		return err
+	}
+	if request.FinalPromptAttemptID != attemptID {
+		return controlConflict("Task %s/%s restored final PromptAttempt does not match source identity %q", task.Namespace, task.Name, request.TaskUID)
+	}
+	if len(candidates) == 0 {
+		// A prepared retry may observe no candidates after deletion. The immutable
+		// marker and Task-scoped completion digest still revalidate the full request.
+		return nil
+	}
+	for _, object := range candidates {
+		if object.Spec.ID != attemptID {
+			continue
+		}
+		if object.Spec.TaskUID != request.TaskUID || object.Spec.Attempt != int64(execution.Attempt) ||
+			object.Spec.PromptID != execution.PromptID || object.Spec.BindingDigest != binding.BindingDigest ||
+			object.Spec.SnapshotDigest != binding.Snapshot.Digest ||
+			(strings.TrimSpace(execution.RequestDigest) != "" && object.Spec.RequestDigest != execution.RequestDigest) {
+			return controlConflict("Task %s/%s restored final PromptAttempt does not match its frozen execution binding", task.Namespace, task.Name)
+		}
+		return nil
+	}
+	return controlConflict("Task %s/%s restored final PromptAttempt %q is not owned by the source identity", task.Namespace, task.Name, attemptID)
+}
+
+func restoredTaskExecutionIsTerminal(task *corev1alpha1.Task) bool {
+	if task == nil || task.Status.Execution == nil || task.Status.Delivery == nil {
+		return false
+	}
+	execution := task.Status.Execution
+	delivery := task.Status.Delivery
+	deliveryState := store.PromptDeliveryState(delivery.State)
+	if !store.IsTerminalPromptDeliveryState(deliveryState) ||
+		string(delivery.Outcome) != string(delivery.State) {
+		return false
+	}
+	switch execution.State {
+	case corev1alpha1.TaskExecutionStateSucceeded:
+		if execution.Outcome != corev1alpha1.TaskExecutionOutcomeSucceeded {
+			return false
+		}
+		switch deliveryState {
+		case store.PromptDeliveryNotRequested, store.PromptDeliveryReadValidated,
+			store.PromptDeliveryNoChange, store.PromptDeliveryVerifiedExact,
+			store.PromptDeliveryDeliveredSuperseded:
+			return task.Status.Phase == corev1alpha1.TaskPhaseSucceeded
+		case store.PromptDeliveryCancelledBeforePublish:
+			return task.Status.Phase == corev1alpha1.TaskPhaseCancelled
+		case store.PromptDeliveryReadOnlyWorkspaceModified, store.PromptDeliveryConflict,
+			store.PromptDeliveryCredentialBlocked, store.PromptDeliveryPublicationOutcomeUnknown:
+			return task.Status.Phase == corev1alpha1.TaskPhaseFailed
+		default:
+			return false
+		}
+	case corev1alpha1.TaskExecutionStateCancelled:
+		return execution.Outcome == corev1alpha1.TaskExecutionOutcomeCancelled &&
+			task.Status.Phase == corev1alpha1.TaskPhaseCancelled
+	case corev1alpha1.TaskExecutionStateFailed:
+		return execution.Outcome == corev1alpha1.TaskExecutionOutcomeFailed &&
+			task.Status.Phase == corev1alpha1.TaskPhaseFailed
+	case corev1alpha1.TaskExecutionStateOutcomeUnknown:
+		return execution.Outcome == corev1alpha1.TaskExecutionOutcomeOutcomeUnknown &&
+			task.Status.Phase == corev1alpha1.TaskPhaseFailed
+	default:
+		return false
+	}
+}
+
+func normalizePromptAttemptReclamationRequestKube(request store.ReclaimPromptAttemptsRequest) (store.ReclaimPromptAttemptsRequest, error) {
+	request.Namespace = strings.TrimSpace(request.Namespace)
+	if err := validateKubernetesNamespace(request.Namespace); err != nil {
+		return store.ReclaimPromptAttemptsRequest{}, err
+	}
+	request.TaskName = strings.TrimSpace(request.TaskName)
+	if err := store.ValidateControlIdentifier("prompt attempt Task name", request.TaskName); err != nil {
+		return store.ReclaimPromptAttemptsRequest{}, err
+	}
+	request.TaskUID = strings.TrimSpace(request.TaskUID)
+	if err := store.ValidateControlIdentifier("prompt attempt Task UID", request.TaskUID); err != nil {
+		return store.ReclaimPromptAttemptsRequest{}, err
+	}
+	switch request.Mode {
+	case store.PromptAttemptReclamationProjected, store.PromptAttemptReclamationUnbound, store.PromptAttemptReclamationNoAttempt:
+	default:
+		return store.ReclaimPromptAttemptsRequest{}, store.ValidationErrorf("unsupported prompt attempt reclamation mode %q", request.Mode)
+	}
+	if request.FinalContinuitySession && (!request.ContinuitySession || request.Mode != store.PromptAttemptReclamationProjected) {
+		return store.ReclaimPromptAttemptsRequest{}, store.ValidationErrorf("final continuity SessionTurn binding requires projected continuity reclamation")
+	}
+	request.FinalPromptAttemptID = strings.TrimSpace(request.FinalPromptAttemptID)
+	request.TerminalProjectionID = strings.TrimSpace(request.TerminalProjectionID)
+	if request.Mode == store.PromptAttemptReclamationProjected {
+		if err := store.ValidateControlIdentifier("final prompt attempt ID", request.FinalPromptAttemptID); err != nil {
+			return store.ReclaimPromptAttemptsRequest{}, err
+		}
+		if request.TerminalProjectionID != "" {
+			if err := store.ValidateControlIdentifier("terminal projection ID", request.TerminalProjectionID); err != nil {
+				return store.ReclaimPromptAttemptsRequest{}, err
+			}
+		}
+	} else if request.FinalPromptAttemptID != "" || request.TerminalProjectionID != "" {
+		return store.ReclaimPromptAttemptsRequest{}, store.ValidationErrorf("only projected prompt attempt reclamation accepts final attempt and projection IDs")
+	}
+	request.RelatedExternalEffectAggregateIDs = normalizePromptAttemptReclamationIDs(request.RelatedExternalEffectAggregateIDs)
+	for _, id := range request.RelatedExternalEffectAggregateIDs {
+		if err := store.ValidateControlIdentifier("related external effect aggregate ID", id); err != nil {
+			return store.ReclaimPromptAttemptsRequest{}, err
+		}
+	}
+	return request, nil
+}
+
+func normalizePromptAttemptReclamationIDs(values []string) []string {
+	set := make(map[string]struct{}, len(values))
+	for _, value := range values {
+		value = strings.TrimSpace(value)
+		if value != "" {
+			set[value] = struct{}{}
+		}
+	}
+	result := make([]string, 0, len(set))
+	for value := range set {
+		result = append(result, value)
+	}
+	sort.Strings(result)
+	return result
+}
+
+func promptAttemptReclamationMarkerName(taskUID string) string {
+	return objectName(promptAttemptReclamationNamePrefix, taskUID)
+}
+
+func promptAttemptReclamationMarkerFromConfigMap(object *corev1.ConfigMap) (promptAttemptReclamationMarker, error) {
+	if object == nil || object.Data == nil || strings.TrimSpace(object.Data[promptAttemptReclamationDataKey]) == "" {
+		return promptAttemptReclamationMarker{}, controlConflict("prompt attempt reclamation marker is incomplete")
+	}
+	var marker promptAttemptReclamationMarker
+	if err := json.Unmarshal([]byte(object.Data[promptAttemptReclamationDataKey]), &marker); err != nil {
+		return promptAttemptReclamationMarker{}, controlConflict("prompt attempt reclamation marker is invalid: %v", err)
+	}
+	if marker.Version != promptAttemptReclamationVersion {
+		return promptAttemptReclamationMarker{}, controlConflict("prompt attempt reclamation marker version %d is unsupported", marker.Version)
+	}
+	marker.CandidateIDs = normalizePromptAttemptReclamationIDs(marker.CandidateIDs)
+	marker.RequestedExternalEffectAggregateIDs = normalizePromptAttemptReclamationIDs(marker.RequestedExternalEffectAggregateIDs)
+	marker.RelatedExternalEffectAggregateIDs = normalizePromptAttemptReclamationIDs(marker.RelatedExternalEffectAggregateIDs)
+	return marker, nil
+}
+
+func validatePromptAttemptReclamationMarkerRequestKube(
+	marker promptAttemptReclamationMarker,
+	request store.ReclaimPromptAttemptsRequest,
+	task *corev1alpha1.Task,
+) error {
+	modeMatches := marker.Mode == request.Mode ||
+		request.Mode == store.PromptAttemptReclamationUnbound && marker.Mode == store.PromptAttemptReclamationNoAttempt
+	if marker.Namespace != request.Namespace || marker.TaskName != request.TaskName || marker.TaskUID != request.TaskUID ||
+		!modeMatches || marker.ContinuitySession != request.ContinuitySession ||
+		!reflect.DeepEqual(marker.RequestedExternalEffectAggregateIDs, request.RelatedExternalEffectAggregateIDs) {
+		return controlConflict("prompt attempt reclamation marker does not match the current Task request")
+	}
+	if request.Mode == store.PromptAttemptReclamationProjected &&
+		(marker.FinalPromptAttemptID != request.FinalPromptAttemptID ||
+			request.TerminalProjectionID != "" && (marker.TerminalProjectionID != request.TerminalProjectionID || marker.FinalContinuitySession != request.FinalContinuitySession)) {
+		return controlConflict("prompt attempt reclamation marker does not match the current final attempt/projection")
+	}
+	if task == nil || len(marker.CandidateIDs) == 0 && marker.Mode == store.PromptAttemptReclamationProjected {
+		return controlConflict("prompt attempt reclamation marker has no projected candidate set")
+	}
+	return nil
+}
+
+func (s *Store) listTaskPromptAttempts(ctx context.Context, namespace, taskUID string) ([]*corev1alpha1.PromptAttempt, error) {
+	list := &corev1alpha1.PromptAttemptList{}
+	if err := s.readClient().List(ctx, list, client.InNamespace(namespace)); err != nil {
+		return nil, mapKubernetesError("list prompt attempts for Task reclamation", err)
+	}
+	candidates := make([]*corev1alpha1.PromptAttempt, 0)
+	seen := make(map[string]struct{})
+	for i := range list.Items {
+		object := &list.Items[i]
+		if object.Spec.TaskUID != taskUID {
+			continue
+		}
+		if _, exists := seen[object.Spec.ID]; exists {
+			return nil, controlConflict("Task %q has duplicate PromptAttempt identity %q", taskUID, object.Spec.ID)
+		}
+		seen[object.Spec.ID] = struct{}{}
+		candidates = append(candidates, object.DeepCopy())
+	}
+	return candidates, nil
+}
+
+func (s *Store) settleUnboundPromptAttemptsForReclamation(
+	ctx context.Context,
+	candidates []*corev1alpha1.PromptAttempt,
+	fence store.ControllerEpochFence,
+	snapshot epochSnapshot,
+) ([]*corev1alpha1.PromptAttempt, error) {
+	result := make([]*corev1alpha1.PromptAttempt, 0, len(candidates))
+	var newestID string
+	if len(candidates) > 0 {
+		attempts := make([]store.PromptAttempt, 0, len(candidates))
+		for _, object := range candidates {
+			attempts = append(attempts, promptAttemptFromObject(object))
+		}
+		newest, err := newestPromptAttemptForReclamationKube(attempts)
+		if err != nil {
+			return nil, err
+		}
+		newestID = newest.ID
+	}
+	for _, object := range candidates {
+		attempt := promptAttemptFromObject(object)
+		if attempt.ID != newestID {
+			if !store.IsTerminalPromptExecutionState(attempt.ExecutionState) || !store.IsTerminalPromptDeliveryState(attempt.DeliveryState) {
+				return nil, promptAttemptReclaimNotReady("historical prompt attempt %q is not terminal", attempt.ID)
+			}
+			result = append(result, object)
+			continue
+		}
+		if attempt.SessionUID != "" || attempt.SessionLeaseGeneration != 0 || attempt.RuntimeInstanceID != "" {
+			return nil, promptAttemptReclaimNotReady("unbound prompt attempt %q already has a runtime or Session binding", attempt.ID)
+		}
+		if store.IsTerminalPromptExecutionState(attempt.ExecutionState) {
+			if !store.IsTerminalPromptDeliveryState(attempt.DeliveryState) {
+				return nil, promptAttemptReclaimNotReady("unbound prompt attempt %q delivery is not terminal", attempt.ID)
+			}
+			result = append(result, object)
+			continue
+		}
+		if attempt.ExecutionState != store.PromptExecutionQueued || attempt.DeliveryState != store.PromptDeliveryNotRequested {
+			return nil, promptAttemptReclaimNotReady("unbound prompt attempt %q is not safely cancellable from state %s", attempt.ID, attempt.ExecutionState)
+		}
+		operationID := store.CanonicalControlID("reclaim-unbound-cancel", attempt.ID)
+		operationDigest := canonicalBytesDigest([]byte("reclaim-unbound-cancel:" + attempt.ID))
+		updated := object.DeepCopy()
+		updated.Status.ExecutionState = corev1alpha1.PromptAttemptExecutionState(store.PromptExecutionCancelled)
+		updated.Status.TerminalReason = "Task deleted before durable execution status binding"
+		setMutationStatus(&updated.Status.ControlRecordMutationStatus, fence, snapshot, attempt.Version+1, operationID, operationDigest, attempt.CreatedAt, normalizeControlTime(time.Time{}))
+		if err := s.client.Status().Update(ctx, updated); err != nil {
+			return nil, mapKubernetesError("cancel unbound prompt attempt for reclamation", err)
+		}
+		result = append(result, updated)
+	}
+	return result, nil
+}
+
+func (s *Store) buildPromptAttemptReclamationMarkerKube(
+	ctx context.Context,
+	request store.ReclaimPromptAttemptsRequest,
+	candidates []*corev1alpha1.PromptAttempt,
+) (promptAttemptReclamationMarker, error) {
+	effectiveMode := request.Mode
+	if effectiveMode == store.PromptAttemptReclamationUnbound && len(candidates) == 0 {
+		effectiveMode = store.PromptAttemptReclamationNoAttempt
+	}
+	marker := promptAttemptReclamationMarker{
+		Version: promptAttemptReclamationVersion, Namespace: request.Namespace, TaskName: request.TaskName,
+		TaskUID: request.TaskUID, Mode: effectiveMode, ContinuitySession: request.ContinuitySession,
+		FinalContinuitySession:              request.FinalContinuitySession,
+		RequestedExternalEffectAggregateIDs: append([]string(nil), request.RelatedExternalEffectAggregateIDs...),
+	}
+	if effectiveMode == store.PromptAttemptReclamationNoAttempt {
+		if len(candidates) != 0 {
+			return promptAttemptReclamationMarker{}, controlConflict("Task %q declared no durable attempt but owns %d PromptAttempts", request.TaskUID, len(candidates))
+		}
+		marker.RelatedExternalEffectAggregateIDs = normalizePromptAttemptReclamationIDs(append([]string{request.TaskUID}, request.RelatedExternalEffectAggregateIDs...))
+		if _, err := s.verifyPromptAttemptReferencesKube(ctx, marker, nil); err != nil {
+			return promptAttemptReclamationMarker{}, err
+		}
+		return marker, nil
+	}
+	if len(candidates) == 0 {
+		return promptAttemptReclamationMarker{}, promptAttemptReclaimNotReady("Task %q has no durable PromptAttempt and no reclamation marker", request.TaskUID)
+	}
+
+	attempts := make([]store.PromptAttempt, 0, len(candidates))
+	for _, object := range candidates {
+		attempt := promptAttemptFromObject(object)
+		if !store.IsTerminalPromptExecutionState(attempt.ExecutionState) || !store.IsTerminalPromptDeliveryState(attempt.DeliveryState) {
+			return promptAttemptReclamationMarker{}, promptAttemptReclaimNotReady("prompt attempt %q is not terminal", attempt.ID)
+		}
+		attempts = append(attempts, attempt)
+		marker.CandidateIDs = append(marker.CandidateIDs, attempt.ID)
+		if attempt.SessionUID != "" {
+			marker.RelatedExternalEffectAggregateIDs = append(marker.RelatedExternalEffectAggregateIDs, attempt.SessionUID)
+		}
+	}
+	marker.CandidateIDs = normalizePromptAttemptReclamationIDs(marker.CandidateIDs)
+	marker.RelatedExternalEffectAggregateIDs = normalizePromptAttemptReclamationIDs(append(marker.RelatedExternalEffectAggregateIDs, append([]string{request.TaskUID}, request.RelatedExternalEffectAggregateIDs...)...))
+	finalAttempt, err := newestPromptAttemptForReclamationKube(attempts)
+	if err != nil {
+		return promptAttemptReclamationMarker{}, err
+	}
+	marker.FinalPromptAttemptID = finalAttempt.ID
+	if request.Mode == store.PromptAttemptReclamationProjected && request.FinalPromptAttemptID != finalAttempt.ID {
+		return promptAttemptReclamationMarker{}, controlConflict("final prompt attempt %q is not the newest Task attempt %q", request.FinalPromptAttemptID, finalAttempt.ID)
+	}
+
+	turns, err := s.verifyPromptAttemptReferencesKube(ctx, marker, candidates)
+	if err != nil {
+		return promptAttemptReclamationMarker{}, err
+	}
+	if request.Mode == store.PromptAttemptReclamationProjected {
+		if request.TerminalProjectionID == "" {
+			return promptAttemptReclamationMarker{}, store.ValidationErrorf("terminal projection ID is required before preparing projected reclamation")
+		}
+		marker.TerminalProjectionID = request.TerminalProjectionID
+		if request.FinalContinuitySession {
+			turn := turns[finalAttempt.ID]
+			if turn == nil {
+				return promptAttemptReclamationMarker{}, promptAttemptReclaimNotReady("final continuity prompt attempt %q has no finalized SessionTurn", finalAttempt.ID)
+			}
+			marker.FinalSessionTurnID = turn.ID
+			marker.TerminalProjectionAggregateKind = sessionTurnAggregateKind
+			marker.TerminalProjectionAggregateID = turn.ID
+		} else {
+			expectedID := store.CanonicalControlID("task-terminal-projection", request.Namespace, request.TaskUID, fmt.Sprint(finalAttempt.Key.Attempt))
+			if request.TerminalProjectionID != expectedID {
+				return promptAttemptReclamationMarker{}, controlConflict("terminal projection %q does not match newest standalone prompt attempt %q", request.TerminalProjectionID, finalAttempt.ID)
+			}
+			marker.TerminalProjectionAggregateKind = "Task"
+			marker.TerminalProjectionAggregateID = request.TaskUID
+		}
+		payloadDigest, err := s.verifyPromptAttemptTerminalProjectionMarkerKube(ctx, marker)
+		if err != nil {
+			return promptAttemptReclamationMarker{}, err
+		}
+		marker.TerminalProjectionPayloadDigest = payloadDigest
+	}
+	return marker, nil
+}
+
+func newestPromptAttemptForReclamationKube(attempts []store.PromptAttempt) (store.PromptAttempt, error) {
+	if len(attempts) == 0 {
+		return store.PromptAttempt{}, store.ErrNotFound
+	}
+	sort.Slice(attempts, func(i, j int) bool {
+		if attempts[i].Key.Attempt != attempts[j].Key.Attempt {
+			return attempts[i].Key.Attempt > attempts[j].Key.Attempt
+		}
+		return attempts[i].ID < attempts[j].ID
+	})
+	if len(attempts) > 1 && attempts[0].Key.Attempt == attempts[1].Key.Attempt {
+		return store.PromptAttempt{}, controlConflict("Task %q has multiple PromptAttempts at newest attempt %d", attempts[0].Key.TaskUID, attempts[0].Key.Attempt)
+	}
+	return attempts[0], nil
+}
+
+func (s *Store) verifyPreparedPromptAttemptReclamationKube(
+	ctx context.Context,
+	marker promptAttemptReclamationMarker,
+	candidates []*corev1alpha1.PromptAttempt,
+) error {
+	authorized := make(map[string]struct{}, len(marker.CandidateIDs))
+	for _, id := range marker.CandidateIDs {
+		authorized[id] = struct{}{}
+	}
+	for _, object := range candidates {
+		if _, ok := authorized[object.Spec.ID]; !ok {
+			return controlConflict("PromptAttempt %q was created after Task reclamation was prepared", object.Spec.ID)
+		}
+		attempt := promptAttemptFromObject(object)
+		if !store.IsTerminalPromptExecutionState(attempt.ExecutionState) || !store.IsTerminalPromptDeliveryState(attempt.DeliveryState) {
+			return promptAttemptReclaimNotReady("prompt attempt %q is not terminal", attempt.ID)
+		}
+	}
+	if marker.Mode == store.PromptAttemptReclamationNoAttempt && len(candidates) != 0 {
+		return controlConflict("no-attempt reclamation marker now has PromptAttempt candidates")
+	}
+	if _, err := s.verifyPromptAttemptReferencesKube(ctx, marker, candidates); err != nil {
+		return err
+	}
+	if marker.Mode == store.PromptAttemptReclamationProjected {
+		_, err := s.verifyPromptAttemptTerminalProjectionMarkerKube(ctx, marker)
+		return err
+	}
+	return nil
+}
+
+func (s *Store) verifyPromptAttemptReferencesKube(
+	ctx context.Context,
+	marker promptAttemptReclamationMarker,
+	candidates []*corev1alpha1.PromptAttempt,
+) (map[string]*store.SessionTurn, error) {
+	protected := make(map[string]struct{}, len(marker.CandidateIDs))
+	for _, id := range marker.CandidateIDs {
+		protected[id] = struct{}{}
+	}
+	controls := &corev1alpha1.RuntimeSessionControlList{}
+	if err := s.readClient().List(ctx, controls, client.InNamespace(marker.Namespace)); err != nil {
+		return nil, mapKubernetesError("list Session controls for prompt attempt reclamation", err)
+	}
+	for i := range controls.Items {
+		control := &controls.Items[i]
+		if control.Status.MutationLease != nil && control.Status.MutationLease.TaskUID == marker.TaskUID {
+			return nil, promptAttemptReclaimNotReady("Session %s/%s still has a mutation lease for Task %q", control.Namespace, control.Spec.SessionName, marker.TaskUID)
+		}
+		if _, related := protected[control.Status.RelatedPromptAttemptID]; related {
+			return nil, promptAttemptReclaimNotReady("Session %s/%s still references prompt attempt %q", control.Namespace, control.Spec.SessionName, control.Status.RelatedPromptAttemptID)
+		}
+	}
+
+	turns := make(map[string]*store.SessionTurn)
+	if marker.ContinuitySession {
+		for _, object := range candidates {
+			attempt := promptAttemptFromObject(object)
+			if attempt.SessionUID == "" && attempt.SessionLeaseGeneration == 0 {
+				continue
+			}
+			if attempt.SessionUID == "" || attempt.SessionLeaseGeneration < 1 {
+				return nil, controlConflict("prompt attempt %q has an incomplete SessionTurn binding", attempt.ID)
+			}
+			if s.sessionTurns == nil {
+				return nil, ErrSessionTurnStoreNotConfigured
+			}
+			key := store.SessionTurnKey{
+				SessionUID: attempt.SessionUID, LeaseGeneration: attempt.SessionLeaseGeneration,
+				TaskUID: attempt.Key.TaskUID, Attempt: attempt.Key.Attempt, PromptID: attempt.Key.PromptID,
+			}
+			turnID, err := key.CanonicalID()
+			if err != nil {
+				return nil, err
+			}
+			turn, err := s.sessionTurns.GetSessionTurn(ctx, turnID)
+			if errors.Is(err, store.ErrNotFound) {
+				return nil, promptAttemptReclaimNotReady("SessionTurn %q for prompt attempt %q is not durable", turnID, attempt.ID)
+			}
+			if err != nil {
+				return nil, fmt.Errorf("load SessionTurn for prompt attempt reclamation: %w", err)
+			}
+			if turn.Key != key || turn.PromptAttemptID != attempt.ID {
+				return nil, controlConflict("SessionTurn %q does not match prompt attempt %q", turnID, attempt.ID)
+			}
+			if turn.State != store.SessionTurnFinalized || turn.FinalizedAt == nil || strings.TrimSpace(turn.ProjectionID) == "" {
+				return nil, promptAttemptReclaimNotReady("SessionTurn %q for prompt attempt %q is not finalized", turnID, attempt.ID)
+			}
+			turns[attempt.ID] = turn
+		}
+	}
+	if err := s.verifyPromptAttemptPublicationsAndEffectsKube(ctx, marker); err != nil {
+		return nil, err
+	}
+	return turns, nil
+}
+
+func (s *Store) verifyPromptAttemptPublicationsAndEffectsKube(ctx context.Context, marker promptAttemptReclamationMarker) error {
+	publications := &corev1alpha1.PublicationList{}
+	if err := s.readClient().List(ctx, publications, client.InNamespace(marker.Namespace)); err != nil {
+		return mapKubernetesError("list publications for prompt attempt reclamation", err)
+	}
+	relatedEffects := make(map[string]struct{}, len(marker.RelatedExternalEffectAggregateIDs))
+	relatedEffects[marker.TaskUID] = struct{}{}
+	for _, id := range marker.RelatedExternalEffectAggregateIDs {
+		relatedEffects[id] = struct{}{}
+	}
+	for i := range publications.Items {
+		publication := &publications.Items[i]
+		if publication.Spec.TaskUID != marker.TaskUID {
+			continue
+		}
+		if !store.IsTerminalPublicationState(store.PublicationState(publication.Status.State)) {
+			return promptAttemptReclaimNotReady("publication %q is not terminal", publication.Spec.ID)
+		}
+		relatedEffects[publication.Spec.ID] = struct{}{}
+	}
+	effects := &corev1alpha1.ExternalEffectList{}
+	if err := s.readClient().List(ctx, effects, client.InNamespace(marker.Namespace)); err != nil {
+		return mapKubernetesError("list external effects for prompt attempt reclamation", err)
+	}
+	for i := range effects.Items {
+		effect := &effects.Items[i]
+		if _, related := relatedEffects[effect.Spec.AggregateID]; !related {
+			continue
+		}
+		switch store.ExternalEffectState(effect.Status.State) {
+		case store.ExternalEffectSucceeded, store.ExternalEffectFailed, store.ExternalEffectOutcomeUnknown:
+		default:
+			return promptAttemptReclaimNotReady("external effect %q is not terminal", effect.Spec.ID)
+		}
+	}
+	return nil
+}
+
+func (s *Store) verifyPromptAttemptTerminalProjectionMarkerKube(ctx context.Context, marker promptAttemptReclamationMarker) (string, error) {
+	if s.outbox == nil {
+		return "", ErrOutboxStoreNotConfigured
+	}
+	projection, err := s.outbox.GetOutboxProjection(ctx, marker.TerminalProjectionID)
+	if errors.Is(err, store.ErrNotFound) {
+		return "", promptAttemptReclaimNotReady("terminal projection %q is not durable", marker.TerminalProjectionID)
+	}
+	if err != nil {
+		return "", fmt.Errorf("load terminal projection for prompt attempt reclamation: %w", err)
+	}
+	if projection.State != store.OutboxProjectionDelivered {
+		return "", promptAttemptReclaimNotReady("terminal projection %q is not delivered", projection.ID)
+	}
+	if projection.ProjectionKind != "TaskTerminalStatus" ||
+		projection.AggregateKind != marker.TerminalProjectionAggregateKind || projection.AggregateID != marker.TerminalProjectionAggregateID {
+		return "", controlConflict("terminal projection %q does not match the prepared Task finalization aggregate", projection.ID)
+	}
+	payloadDigest := canonicalBytesDigest(projection.Payload)
+	if projection.PayloadDigest != payloadDigest {
+		return "", controlConflict("terminal projection %q payload does not match its digest", projection.ID)
+	}
+	if marker.TerminalProjectionPayloadDigest != "" && marker.TerminalProjectionPayloadDigest != payloadDigest {
+		return "", controlConflict("terminal projection %q changed after prompt attempt reclamation was prepared", projection.ID)
+	}
+	var finalTurn *store.SessionTurn
+	if marker.FinalSessionTurnID != "" {
+		if s.sessionTurns == nil {
+			return "", ErrSessionTurnStoreNotConfigured
+		}
+		turn, err := s.sessionTurns.GetSessionTurn(ctx, marker.FinalSessionTurnID)
+		if err != nil {
+			return "", fmt.Errorf("load final SessionTurn for prompt attempt reclamation: %w", err)
+		}
+		if turn.State != store.SessionTurnFinalized || turn.FinalizedAt == nil || turn.ProjectionID != projection.ID {
+			return "", controlConflict("terminal projection %q does not match final SessionTurn %q", projection.ID, marker.FinalSessionTurnID)
+		}
+		finalTurn = turn
+	}
+	task := &corev1alpha1.Task{}
+	if err := s.readClient().Get(ctx, client.ObjectKey{Namespace: marker.Namespace, Name: marker.TaskName}, task); err != nil {
+		return "", mapKubernetesError("load Task for terminal projection validation", err)
+	}
+	attemptMissing := false
+	attempt, err := s.GetPromptAttempt(ctx, marker.FinalPromptAttemptID)
+	if errors.Is(err, store.ErrNotFound) {
+		if marker.TerminalProjectionPayloadDigest != payloadDigest {
+			return "", promptAttemptReclaimNotReady("final prompt attempt %q is not durable", marker.FinalPromptAttemptID)
+		}
+		attemptMissing = true
+	}
+	if err != nil && !attemptMissing {
+		return "", fmt.Errorf("load final prompt attempt for terminal projection validation: %w", err)
+	}
+	if !attemptMissing {
+		var validationErr error
+		if finalTurn != nil {
+			_, validationErr = taskterminal.ValidateFinalizedSessionProjection(
+				projection.Payload, task, marker.TaskUID, attempt, finalTurn,
+			)
+		} else {
+			_, validationErr = taskterminal.ValidateRestoredProjection(projection.Payload, task, marker.TaskUID, attempt)
+		}
+		if validationErr != nil {
+			return "", validationErr
+		}
+	}
+	return payloadDigest, nil
+}
+
+func promptAttemptReclaimNotReady(format string, args ...any) error {
+	return fmt.Errorf("%w: %s", store.ErrNotReady, fmt.Sprintf(format, args...))
+}
+
+// RecoverPromptAttemptPreSubmission refreshes Reserved or returns SessionStarting/Planned to
+// Reserved after an unambiguous no-write recovery decision.
+func (s *Store) RecoverPromptAttemptPreSubmission(ctx context.Context, recovery store.PromptAttemptPreSubmissionRecovery) (*store.PromptAttempt, error) {
+	recovery.ID = strings.TrimSpace(recovery.ID)
+	if err := store.ValidateControlIdentifier("prompt attempt ID", recovery.ID); err != nil {
+		return nil, err
+	}
+	fence, snapshot, err := s.requireControllerEpoch(ctx, recovery.Fence)
+	if err != nil {
+		return nil, err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	recovery.Fence = fence
+	if recovery.ExpectedVersion < 1 {
+		return nil, store.ValidationErrorf("prompt attempt expected version must be at least 1")
+	}
+	if recovery.ExpectedState != store.PromptExecutionReserved &&
+		recovery.ExpectedState != store.PromptExecutionSessionStarting && recovery.ExpectedState != store.PromptExecutionPlanned {
+		return nil, store.ValidationErrorf("only Reserved, SessionStarting, or Planned attempts may be recovered before submission")
+	}
+	recovery.OperationID = strings.TrimSpace(recovery.OperationID)
+	if err := store.ValidateControlIdentifier("prompt attempt recovery operation ID", recovery.OperationID); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateCanonicalDigest("prompt attempt recovery operation digest", recovery.OperationDigest); err != nil {
+		return nil, err
+	}
+	recovery.RecoveredAt = normalizeControlTime(recovery.RecoveredAt)
+
+	object, err := s.findPromptAttemptByID(ctx, recovery.ID)
+	if err != nil {
+		return nil, err
+	}
+	attempt := promptAttemptFromObject(object)
+	if attempt.LastOperationID == recovery.OperationID {
+		if attempt.LastOperationDigest != recovery.OperationDigest {
+			return nil, controlConflict("prompt attempt recovery operation %q was reused with a different digest", recovery.OperationID)
+		}
+		if attempt.ExecutionState == store.PromptExecutionReserved {
+			return &attempt, nil
+		}
+		return nil, controlConflict("prompt attempt recovery operation %q was already applied with a different state", recovery.OperationID)
+	}
+	if attempt.Version != recovery.ExpectedVersion || attempt.ExecutionState != recovery.ExpectedState {
+		return nil, controlConflict("prompt attempt %q no longer matches pre-submission recovery version/state", attempt.ID)
+	}
+
+	updated := object.DeepCopy()
+	updated.Status.ExecutionState = corev1alpha1.PromptAttemptExecutionState(store.PromptExecutionReserved)
+	updated.Status.RuntimeInstanceID = ""
+	updated.Status.SessionUID = ""
+	updated.Status.SessionLeaseGeneration = 0
+	setMutationStatus(&updated.Status.ControlRecordMutationStatus, fence, snapshot, attempt.Version+1, recovery.OperationID, recovery.OperationDigest, attempt.CreatedAt, recovery.RecoveredAt)
+	if err := s.client.Status().Update(ctx, updated); err != nil {
+		return nil, mapKubernetesError("recover prompt attempt before submission", err)
+	}
+	result := promptAttemptFromObject(updated)
+	return &result, nil
+}
+
+// TransitionPromptAttemptExecution applies exact domain-version, state,
+// immutable binding, resourceVersion, and controller-epoch fences.
+func (s *Store) TransitionPromptAttemptExecution(ctx context.Context, transition store.PromptAttemptExecutionTransition) (*store.PromptAttempt, error) {
+	transition.ID = strings.TrimSpace(transition.ID)
+	if err := store.ValidateControlIdentifier("prompt attempt ID", transition.ID); err != nil {
+		return nil, err
+	}
+	fence, snapshot, err := s.requireControllerEpoch(ctx, transition.Fence)
+	if err != nil {
+		return nil, err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	transition.Fence = fence
+	if err := validatePromptExecutionTransition(&transition); err != nil {
+		return nil, err
+	}
+
+	object, err := s.findPromptAttemptByID(ctx, transition.ID)
+	if err != nil {
+		return nil, err
+	}
+	attempt := promptAttemptFromObject(object)
+	if attempt.LastOperationID == transition.OperationID {
+		if attempt.LastOperationDigest != transition.OperationDigest {
+			return nil, controlConflict("prompt attempt operation %q was reused with a different digest", transition.OperationID)
+		}
+		if attempt.ExecutionState == transition.NewState {
+			return &attempt, nil
+		}
+		return nil, controlConflict("prompt attempt operation %q was already applied to state %s", transition.OperationID, attempt.ExecutionState)
+	}
+	if attempt.Version != transition.ExpectedVersion || attempt.ExecutionState != transition.ExpectedState {
+		return nil, controlConflict("prompt attempt %q is version %d state %s, expected version %d state %s", attempt.ID, attempt.Version, attempt.ExecutionState, transition.ExpectedVersion, transition.ExpectedState)
+	}
+	if transition.RuntimeInstanceID != "" && attempt.RuntimeInstanceID != "" && attempt.RuntimeInstanceID != transition.RuntimeInstanceID {
+		return nil, controlConflict("prompt attempt %q runtime instance is immutable once set", attempt.ID)
+	}
+	if transition.SessionUID != "" && attempt.SessionUID != "" && attempt.SessionUID != transition.SessionUID {
+		return nil, controlConflict("prompt attempt %q session UID is immutable once set", attempt.ID)
+	}
+	if transition.SessionLeaseGeneration > 0 && attempt.SessionLeaseGeneration > 0 && attempt.SessionLeaseGeneration != transition.SessionLeaseGeneration {
+		return nil, controlConflict("prompt attempt %q session lease generation is immutable once set", attempt.ID)
+	}
+
+	updated := object.DeepCopy()
+	updated.Status.ExecutionState = corev1alpha1.PromptAttemptExecutionState(transition.NewState)
+	if transition.RuntimeInstanceID != "" {
+		updated.Status.RuntimeInstanceID = transition.RuntimeInstanceID
+	}
+	if transition.SessionUID != "" {
+		updated.Status.SessionUID = transition.SessionUID
+	}
+	if transition.SessionLeaseGeneration > 0 {
+		updated.Status.SessionLeaseGeneration = transition.SessionLeaseGeneration
+	}
+	if transition.TerminalReason != "" || store.IsTerminalPromptExecutionState(transition.NewState) {
+		updated.Status.TerminalReason = transition.TerminalReason
+	}
+	if transition.OutcomeMarker != "" {
+		updated.Status.OutcomeMarker = transition.OutcomeMarker
+	}
+	setMutationStatus(&updated.Status.ControlRecordMutationStatus, fence, snapshot, attempt.Version+1, transition.OperationID, transition.OperationDigest, attempt.CreatedAt, transition.UpdatedAt)
+	if err := s.client.Status().Update(ctx, updated); err != nil {
+		return nil, mapKubernetesError("transition prompt attempt execution", err)
+	}
+	result := promptAttemptFromObject(updated)
+	return &result, nil
+}
+
+// TransitionPromptAttemptDelivery applies an exact delivery-state CAS.
+func (s *Store) TransitionPromptAttemptDelivery(ctx context.Context, transition store.PromptAttemptDeliveryTransition) (*store.PromptAttempt, error) {
+	transition.ID = strings.TrimSpace(transition.ID)
+	if err := store.ValidateControlIdentifier("prompt attempt ID", transition.ID); err != nil {
+		return nil, err
+	}
+	fence, snapshot, err := s.requireControllerEpoch(ctx, transition.Fence)
+	if err != nil {
+		return nil, err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	transition.Fence = fence
+	if transition.ExpectedVersion < 1 {
+		return nil, store.ValidationErrorf("prompt attempt expected version must be at least 1")
+	}
+	if err := store.ValidatePromptDeliveryTransition(transition.ExpectedState, transition.NewState); err != nil {
+		return nil, err
+	}
+	transition.OperationID = strings.TrimSpace(transition.OperationID)
+	if err := store.ValidateControlIdentifier("prompt attempt operation ID", transition.OperationID); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateCanonicalDigest("prompt attempt operation digest", transition.OperationDigest); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateControlReason("prompt delivery terminal reason", transition.TerminalReason); err != nil {
+		return nil, err
+	}
+	transition.UpdatedAt = normalizeControlTime(transition.UpdatedAt)
+
+	object, err := s.findPromptAttemptByID(ctx, transition.ID)
+	if err != nil {
+		return nil, err
+	}
+	attempt := promptAttemptFromObject(object)
+	if attempt.LastOperationID == transition.OperationID {
+		if attempt.LastOperationDigest != transition.OperationDigest {
+			return nil, controlConflict("prompt attempt operation %q was reused with a different digest", transition.OperationID)
+		}
+		if attempt.DeliveryState == transition.NewState {
+			return &attempt, nil
+		}
+		return nil, controlConflict("prompt attempt operation %q was already applied to delivery state %s", transition.OperationID, attempt.DeliveryState)
+	}
+	if attempt.Version != transition.ExpectedVersion || attempt.DeliveryState != transition.ExpectedState {
+		return nil, controlConflict("prompt attempt %q is version %d delivery state %s, expected version %d state %s", attempt.ID, attempt.Version, attempt.DeliveryState, transition.ExpectedVersion, transition.ExpectedState)
+	}
+
+	updated := object.DeepCopy()
+	updated.Status.DeliveryState = corev1alpha1.PromptAttemptDeliveryState(transition.NewState)
+	if transition.TerminalReason != "" || store.IsTerminalPromptDeliveryState(transition.NewState) {
+		updated.Status.TerminalReason = transition.TerminalReason
+	}
+	setMutationStatus(&updated.Status.ControlRecordMutationStatus, fence, snapshot, attempt.Version+1, transition.OperationID, transition.OperationDigest, attempt.CreatedAt, transition.UpdatedAt)
+	if err := s.client.Status().Update(ctx, updated); err != nil {
+		return nil, mapKubernetesError("transition prompt attempt delivery", err)
+	}
+	result := promptAttemptFromObject(updated)
+	return &result, nil
+}
+
+func (s *Store) completePromptAttemptCreation(ctx context.Context, object *corev1alpha1.PromptAttempt, normalized store.PromptAttempt, fence store.ControllerEpochFence, snapshot epochSnapshot) (*store.PromptAttempt, error) {
+	if !samePromptAttemptSpec(object, normalized) {
+		return nil, controlConflict("prompt attempt %q was reused with a different request digest or immutable identity", normalized.ID)
+	}
+	if object.Status.Version > 0 {
+		existing := promptAttemptFromObject(object)
+		return &existing, nil
+	}
+	updated := object.DeepCopy()
+	updated.Status.SessionUID = normalized.SessionUID
+	updated.Status.SessionLeaseGeneration = normalized.SessionLeaseGeneration
+	updated.Status.RuntimeInstanceID = normalized.RuntimeInstanceID
+	updated.Status.ExecutionState = corev1alpha1.PromptAttemptExecutionState(normalized.ExecutionState)
+	updated.Status.DeliveryState = corev1alpha1.PromptAttemptDeliveryState(normalized.DeliveryState)
+	updated.Status.TerminalReason = normalized.TerminalReason
+	updated.Status.OutcomeMarker = normalized.OutcomeMarker
+	setMutationStatus(&updated.Status.ControlRecordMutationStatus, fence, snapshot, 1, "", "", normalized.CreatedAt, normalized.UpdatedAt)
+	if err := s.client.Status().Update(ctx, updated); err != nil {
+		if apierrors.IsConflict(err) {
+			fresh := &corev1alpha1.PromptAttempt{}
+			if getErr := s.readClient().Get(ctx, client.ObjectKeyFromObject(object), fresh); getErr == nil && samePromptAttemptSpec(fresh, normalized) && fresh.Status.Version > 0 {
+				result := promptAttemptFromObject(fresh)
+				return &result, nil
+			}
+		}
+		return nil, mapKubernetesError("initialize prompt attempt status", err)
+	}
+	result := promptAttemptFromObject(updated)
+	return &result, nil
+}
+
+func (s *Store) findPromptAttemptByID(ctx context.Context, id string) (*corev1alpha1.PromptAttempt, error) {
+	list := &corev1alpha1.PromptAttemptList{}
+	if err := s.readClient().List(ctx, list, s.namespacedListOptions(
+		client.MatchingLabels{corev1alpha1.ControlRecordIDHashLabel: dnsDigest(id)},
+	)...); err != nil {
+		return nil, mapKubernetesError("list prompt attempts", err)
+	}
+	var match *corev1alpha1.PromptAttempt
+	for i := range list.Items {
+		if list.Items[i].Spec.ID != id {
+			continue
+		}
+		if match != nil {
+			return nil, controlConflict("multiple prompt attempts exist for canonical ID %q", id)
+		}
+		match = list.Items[i].DeepCopy()
+	}
+	if match == nil {
+		return nil, store.ErrNotFound
+	}
+	return match, nil
+}
+
+func normalizePromptAttemptForCreate(attempt *store.PromptAttempt, fence store.ControllerEpochFence) (store.PromptAttempt, store.ControllerEpochFence, error) {
+	if attempt == nil {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, store.ValidationErrorf("prompt attempt is required")
+	}
+	normalized := *attempt
+	normalized.Key.Namespace = strings.TrimSpace(normalized.Key.Namespace)
+	normalized.Key.TaskUID = strings.TrimSpace(normalized.Key.TaskUID)
+	normalized.Key.PromptID = strings.TrimSpace(normalized.Key.PromptID)
+	if err := normalized.Key.Validate(); err != nil {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, err
+	}
+	canonicalID, err := normalized.Key.CanonicalID()
+	if err != nil {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, err
+	}
+	normalized.ID = strings.TrimSpace(normalized.ID)
+	if normalized.ID == "" {
+		normalized.ID = canonicalID
+	}
+	if normalized.ID != canonicalID {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, store.ValidationErrorf("prompt attempt ID must equal canonical ID %q", canonicalID)
+	}
+	if err := store.ValidateCanonicalDigest("prompt attempt request digest", normalized.RequestDigest); err != nil {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, err
+	}
+	if err := store.ValidateCanonicalDigest("prompt attempt binding digest", normalized.BindingDigest); err != nil {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, err
+	}
+	if err := store.ValidateCanonicalDigest("prompt attempt snapshot digest", normalized.SnapshotDigest); err != nil {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, err
+	}
+	normalized.CredentialBindings = append([]store.PromptCredentialBinding(nil), normalized.CredentialBindings...)
+	sort.Slice(normalized.CredentialBindings, func(i, j int) bool {
+		return normalized.CredentialBindings[i].Role < normalized.CredentialBindings[j].Role
+	})
+	for i := range normalized.CredentialBindings {
+		binding := normalized.CredentialBindings[i]
+		if err := binding.Validate(); err != nil {
+			return store.PromptAttempt{}, store.ControllerEpochFence{}, err
+		}
+		if binding.Namespace != normalized.Key.Namespace {
+			return store.PromptAttempt{}, store.ControllerEpochFence{}, store.ValidationErrorf("prompt credential namespace must match the Task namespace")
+		}
+		if i > 0 && normalized.CredentialBindings[i-1].Role == binding.Role {
+			return store.PromptAttempt{}, store.ControllerEpochFence{}, store.ValidationErrorf("prompt credential role %q is duplicated", binding.Role)
+		}
+	}
+	if normalized.ExecutionState == "" {
+		normalized.ExecutionState = store.PromptExecutionQueued
+	}
+	if !store.IsKnownPromptExecutionState(normalized.ExecutionState) {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, store.ValidationErrorf("unsupported prompt execution state %q", normalized.ExecutionState)
+	}
+	if normalized.ExecutionState != store.PromptExecutionQueued {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, store.ValidationErrorf("new prompt attempt must start in %s", store.PromptExecutionQueued)
+	}
+	if normalized.DeliveryState == "" {
+		normalized.DeliveryState = store.PromptDeliveryNotRequested
+	}
+	if normalized.DeliveryState != store.PromptDeliveryNotRequested {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, store.ValidationErrorf("new prompt attempt must start delivery in %s", store.PromptDeliveryNotRequested)
+	}
+	normalizedFence, err := normalizeEpochFence(fence)
+	if err != nil {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, err
+	}
+	normalized.SessionUID = strings.TrimSpace(normalized.SessionUID)
+	normalized.RuntimeInstanceID = strings.TrimSpace(normalized.RuntimeInstanceID)
+	if normalized.SessionLeaseGeneration < 0 {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, store.ValidationErrorf("session lease generation must not be negative")
+	}
+	if normalized.SessionLeaseGeneration > 0 && normalized.SessionUID == "" {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, store.ValidationErrorf("session UID is required with a session lease generation")
+	}
+	if normalized.SessionUID != "" {
+		if err := store.ValidateControlIdentifier("session UID", normalized.SessionUID); err != nil {
+			return store.PromptAttempt{}, store.ControllerEpochFence{}, err
+		}
+	}
+	if normalized.RuntimeInstanceID != "" {
+		if err := store.ValidateControlIdentifier("runtime instance ID", normalized.RuntimeInstanceID); err != nil {
+			return store.PromptAttempt{}, store.ControllerEpochFence{}, err
+		}
+	}
+	if normalized.Version != 0 && normalized.Version != 1 {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, store.ValidationErrorf("new prompt attempt version must be zero or one")
+	}
+	now := normalizeControlTime(normalized.CreatedAt)
+	normalized.CreatedAt = now
+	if normalized.UpdatedAt.IsZero() {
+		normalized.UpdatedAt = now
+	} else {
+		normalized.UpdatedAt = normalized.UpdatedAt.UTC()
+	}
+	normalized.ControllerEpochName = normalizedFence.Name
+	normalized.ControllerEpoch = normalizedFence.Epoch
+	normalized.Version = 1
+	normalized.LastOperationID = ""
+	normalized.LastOperationDigest = ""
+	return normalized, normalizedFence, nil
+}
+
+func validatePromptExecutionTransition(transition *store.PromptAttemptExecutionTransition) error {
+	if transition.ExpectedVersion < 1 {
+		return store.ValidationErrorf("prompt attempt expected version must be at least 1")
+	}
+	if err := store.ValidatePromptExecutionTransition(transition.ExpectedState, transition.NewState); err != nil {
+		return err
+	}
+	transition.OperationID = strings.TrimSpace(transition.OperationID)
+	if err := store.ValidateControlIdentifier("prompt attempt operation ID", transition.OperationID); err != nil {
+		return err
+	}
+	if err := store.ValidateCanonicalDigest("prompt attempt operation digest", transition.OperationDigest); err != nil {
+		return err
+	}
+	transition.RuntimeInstanceID = strings.TrimSpace(transition.RuntimeInstanceID)
+	transition.SessionUID = strings.TrimSpace(transition.SessionUID)
+	if transition.SessionLeaseGeneration < 0 {
+		return store.ValidationErrorf("session lease generation must not be negative")
+	}
+	if transition.SessionLeaseGeneration > 0 && transition.SessionUID == "" {
+		return store.ValidationErrorf("session UID is required when setting a session lease generation")
+	}
+	if transition.SessionUID != "" {
+		if err := store.ValidateControlIdentifier("session UID", transition.SessionUID); err != nil {
+			return err
+		}
+	}
+	if transition.RuntimeInstanceID != "" {
+		if err := store.ValidateControlIdentifier("runtime instance ID", transition.RuntimeInstanceID); err != nil {
+			return err
+		}
+	}
+	if err := store.ValidateControlReason("prompt attempt terminal reason", transition.TerminalReason); err != nil {
+		return err
+	}
+	if err := store.ValidateControlReason("prompt attempt outcome marker", transition.OutcomeMarker); err != nil {
+		return err
+	}
+	if transition.NewState == store.PromptExecutionOutcomeUnknown && strings.TrimSpace(transition.OutcomeMarker) == "" {
+		return store.ValidationErrorf("OutcomeUnknown requires an explicit outcome marker")
+	}
+	transition.UpdatedAt = normalizeControlTime(transition.UpdatedAt)
+	return nil
+}
+
+func samePromptAttemptSpec(object *corev1alpha1.PromptAttempt, attempt store.PromptAttempt) bool {
+	return object.Namespace == attempt.Key.Namespace && object.Spec.ID == attempt.ID && object.Spec.TaskUID == attempt.Key.TaskUID &&
+		object.Spec.Attempt == attempt.Key.Attempt && object.Spec.PromptID == attempt.Key.PromptID && object.Spec.RequestDigest == attempt.RequestDigest &&
+		object.Spec.BindingDigest == attempt.BindingDigest && object.Spec.SnapshotDigest == attempt.SnapshotDigest &&
+		reflect.DeepEqual(promptCredentialBindingsFromAPI(object.Spec.CredentialBindings), attempt.CredentialBindings)
+}
+
+func promptCredentialBindingsToAPI(values []store.PromptCredentialBinding) []corev1alpha1.PromptCredentialBinding {
+	if len(values) == 0 {
+		return nil
+	}
+	result := make([]corev1alpha1.PromptCredentialBinding, 0, len(values))
+	for _, value := range values {
+		result = append(result, corev1alpha1.PromptCredentialBinding{
+			Role: string(value.Role), Namespace: value.Namespace, SecretName: value.SecretName,
+			SecretKey: value.SecretKey, SecretUID: value.SecretUID, ResourceVersion: value.ResourceVersion,
+		})
+	}
+	return result
+}
+
+func promptCredentialBindingsFromAPI(values []corev1alpha1.PromptCredentialBinding) []store.PromptCredentialBinding {
+	if len(values) == 0 {
+		return nil
+	}
+	result := make([]store.PromptCredentialBinding, 0, len(values))
+	for _, value := range values {
+		result = append(result, store.PromptCredentialBinding{
+			Role: store.PromptCredentialRole(value.Role), Namespace: value.Namespace, SecretName: value.SecretName,
+			SecretKey: value.SecretKey, SecretUID: value.SecretUID, ResourceVersion: value.ResourceVersion,
+		})
+	}
+	sort.Slice(result, func(i, j int) bool { return result[i].Role < result[j].Role })
+	return result
+}
+
+func promptAttemptFromObject(object *corev1alpha1.PromptAttempt) store.PromptAttempt {
+	return store.PromptAttempt{
+		ID: object.Spec.ID,
+		Key: store.PromptAttemptKey{
+			Namespace: object.Namespace,
+			TaskUID:   object.Spec.TaskUID,
+			Attempt:   object.Spec.Attempt,
+			PromptID:  object.Spec.PromptID,
+		},
+		SessionUID:             object.Status.SessionUID,
+		SessionLeaseGeneration: object.Status.SessionLeaseGeneration,
+		RuntimeInstanceID:      object.Status.RuntimeInstanceID,
+		RequestDigest:          object.Spec.RequestDigest,
+		BindingDigest:          object.Spec.BindingDigest,
+		SnapshotDigest:         object.Spec.SnapshotDigest,
+		CredentialBindings:     promptCredentialBindingsFromAPI(object.Spec.CredentialBindings),
+		ExecutionState:         store.PromptExecutionState(object.Status.ExecutionState),
+		DeliveryState:          store.PromptDeliveryState(object.Status.DeliveryState),
+		TerminalReason:         object.Status.TerminalReason,
+		OutcomeMarker:          object.Status.OutcomeMarker,
+		ControllerEpochName:    object.Status.ControllerEpochName,
+		ControllerEpoch:        object.Status.ControllerEpoch,
+		LastOperationID:        object.Status.LastOperationID,
+		LastOperationDigest:    object.Status.LastOperationDigest,
+		Version:                object.Status.Version,
+		CreatedAt:              timeValue(object.Status.CreatedAt),
+		UpdatedAt:              timeValue(object.Status.UpdatedAt),
+	}
+}
diff --git a/internal/store/kube/prompt_attempt_reclaim_test.go b/internal/store/kube/prompt_attempt_reclaim_test.go
new file mode 100644
index 000000000..e66a92968
--- /dev/null
+++ b/internal/store/kube/prompt_attempt_reclaim_test.go
@@ -0,0 +1,1092 @@
+package kube
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	controlstore "github.com/orka-agents/orka/internal/store"
+	sqlitestore "github.com/orka-agents/orka/internal/store/sqlite"
+	"github.com/orka-agents/orka/internal/taskterminal"
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
+)
+
+func TestReclaimPromptAttemptsDefersWhileReferencesRemain(t *testing.T) {
+	tests := []struct {
+		name  string
+		block func(t *testing.T, ctx context.Context, kubeStore *Store, kubeClient client.Client, fence controlstore.ControllerEpochFence, attempt *controlstore.PromptAttempt)
+	}{
+		{
+			name: "nonterminal attempt",
+			block: func(t *testing.T, ctx context.Context, kubeStore *Store, _ client.Client, fence controlstore.ControllerEpochFence, attempt *controlstore.PromptAttempt) {
+				t.Helper()
+				if _, err := kubeStore.CreatePromptAttempt(ctx, boundPromptAttemptForKubeTest(&controlstore.PromptAttempt{
+					Key: controlstore.PromptAttemptKey{
+						Namespace: attempt.Key.Namespace, TaskUID: attempt.Key.TaskUID, Attempt: 1, PromptID: "prompt-old",
+					},
+					RequestDigest: testDigest("prompt-old"),
+				}), fence); err != nil {
+					t.Fatalf("create nonterminal attempt: %v", err)
+				}
+			},
+		},
+		{
+			name: "active publication",
+			block: func(t *testing.T, ctx context.Context, _ *Store, kubeClient client.Client, _ controlstore.ControllerEpochFence, attempt *controlstore.PromptAttempt) {
+				t.Helper()
+				publication := &corev1alpha1.Publication{
+					ObjectMeta: metav1.ObjectMeta{Namespace: attempt.Key.Namespace, Name: "publication-active"},
+					Spec: corev1alpha1.PublicationSpec{
+						ID: "publication-active", TaskUID: attempt.Key.TaskUID, Attempt: attempt.Key.Attempt, PromptID: attempt.Key.PromptID,
+					},
+				}
+				if err := kubeClient.Create(ctx, publication); err != nil {
+					t.Fatalf("create active publication: %v", err)
+				}
+				publication.Status.State = corev1alpha1.PublicationControlState(controlstore.PublicationPublishing)
+				if err := kubeClient.Status().Update(ctx, publication); err != nil {
+					t.Fatalf("mark publication active: %v", err)
+				}
+			},
+		},
+		{
+			name: "session reconciliation reference",
+			block: func(t *testing.T, ctx context.Context, _ *Store, kubeClient client.Client, _ controlstore.ControllerEpochFence, attempt *controlstore.PromptAttempt) {
+				t.Helper()
+				control := &corev1alpha1.RuntimeSessionControl{
+					ObjectMeta: metav1.ObjectMeta{Namespace: attempt.Key.Namespace, Name: "session-reconciliation"},
+					Spec: corev1alpha1.RuntimeSessionControlSpec{
+						SessionName: "session-reconciliation", SessionUID: "session-reconciliation-uid",
+						RequestDigest: testDigest("session-reconciliation"),
+						Owner:         corev1alpha1.ControlRecordOwner{Kind: "Session", UID: "session-reconciliation-uid"},
+					},
+				}
+				if err := kubeClient.Create(ctx, control); err != nil {
+					t.Fatalf("create Session control: %v", err)
+				}
+				control.Status.Availability = corev1alpha1.RuntimeSessionControlAvailability(controlstore.SessionReconciliationBlocked)
+				control.Status.BlockedReason = "publication outcome requires reconciliation"
+				control.Status.RelatedPromptAttemptID = attempt.ID
+				if err := kubeClient.Status().Update(ctx, control); err != nil {
+					t.Fatalf("record Session reconciliation reference: %v", err)
+				}
+			},
+		},
+		{
+			name: "undelivered terminal projection",
+			block: func(t *testing.T, _ context.Context, _ *Store, _ client.Client, _ controlstore.ControllerEpochFence, _ *controlstore.PromptAttempt) {
+				t.Helper()
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+			kubeStore, kubeClient, fence := newPromptAttemptReclaimStore(t)
+			attempt := createFailedPromptAttempt(t, ctx, kubeStore, fence, "task-reclaim-blocked", 2, "prompt-final")
+			projectionID := enqueueTaskTerminalProjection(t, ctx, kubeStore, fence, attempt, tt.name != "undelivered terminal projection")
+			tt.block(t, ctx, kubeStore, kubeClient, fence, attempt)
+			taskName := createDeletingTaskForPromptAttempt(t, ctx, kubeClient, attempt)
+
+			deleted, err := kubeStore.ReclaimPromptAttempts(ctx, controlstore.ReclaimPromptAttemptsRequest{
+				Namespace: attempt.Key.Namespace, TaskName: taskName, TaskUID: attempt.Key.TaskUID,
+				Mode:                 controlstore.PromptAttemptReclamationProjected,
+				FinalPromptAttemptID: attempt.ID, TerminalProjectionID: projectionID, Fence: fence,
+			})
+			if !errors.Is(err, controlstore.ErrNotReady) {
+				t.Fatalf("ReclaimPromptAttempts() error = %v, want ErrNotReady", err)
+			}
+			if deleted != 0 {
+				t.Fatalf("ReclaimPromptAttempts() deleted = %d, want 0", deleted)
+			}
+			if _, err := kubeStore.GetPromptAttempt(ctx, attempt.ID); err != nil {
+				t.Fatalf("final prompt attempt was deleted while still referenced: %v", err)
+			}
+		})
+	}
+}
+
+func TestReclaimPromptAttemptsDeletesTerminalTaskRecords(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, fence := newPromptAttemptReclaimStore(t)
+	oldAttempt := createFailedPromptAttempt(t, ctx, kubeStore, fence, "task-reclaim", 1, "prompt-old")
+	finalAttempt := createFailedPromptAttempt(t, ctx, kubeStore, fence, "task-reclaim", 2, "prompt-final")
+	otherAttempt := createFailedPromptAttempt(t, ctx, kubeStore, fence, "task-other", 1, "prompt-other")
+	taskName := createDeletingTaskForPromptAttempt(t, ctx, kubeClient, finalAttempt)
+	projectionID := enqueueTaskTerminalProjection(t, ctx, kubeStore, fence, finalAttempt, true)
+
+	request := controlstore.ReclaimPromptAttemptsRequest{
+		Namespace: finalAttempt.Key.Namespace, TaskName: taskName, TaskUID: finalAttempt.Key.TaskUID,
+		Mode:                 controlstore.PromptAttemptReclamationProjected,
+		FinalPromptAttemptID: finalAttempt.ID, TerminalProjectionID: projectionID, Fence: fence,
+	}
+	deleted, err := kubeStore.ReclaimPromptAttempts(ctx, request)
+	if err != nil {
+		t.Fatalf("ReclaimPromptAttempts(): %v", err)
+	}
+	if deleted != 2 {
+		t.Fatalf("ReclaimPromptAttempts() deleted = %d, want 2", deleted)
+	}
+	for _, id := range []string{oldAttempt.ID, finalAttempt.ID} {
+		if _, err := kubeStore.GetPromptAttempt(ctx, id); !errors.Is(err, controlstore.ErrNotFound) {
+			t.Fatalf("GetPromptAttempt(%q) error = %v, want ErrNotFound", id, err)
+		}
+	}
+	if _, err := kubeStore.GetPromptAttempt(ctx, otherAttempt.ID); err != nil {
+		t.Fatalf("unrelated PromptAttempt was deleted: %v", err)
+	}
+	assertPromptAttemptReclamationMarker(t, ctx, kubeClient, finalAttempt.Key.TaskUID, false)
+	assertPromptAttemptReclamationCompleted(t, ctx, kubeClient, request, true)
+	if err := kubeStore.PreparePromptAttemptReclamation(ctx, request); err != nil {
+		t.Fatalf("idempotent PreparePromptAttemptReclamation() error = %v", err)
+	}
+	assertPromptAttemptReclamationMarker(t, ctx, kubeClient, finalAttempt.Key.TaskUID, false)
+	if deleted, err := kubeStore.ReclaimPromptAttempts(ctx, request); err != nil || deleted != 0 {
+		t.Fatalf("idempotent ReclaimPromptAttempts() = deleted:%d err:%v, want 0,nil", deleted, err)
+	}
+	assertPromptAttemptReclamationMarker(t, ctx, kubeClient, finalAttempt.Key.TaskUID, false)
+}
+
+func TestReclaimPromptAttemptsDeletesRestoredSourceRecordsIdempotently(t *testing.T) {
+	tests := []struct {
+		name      string
+		execution controlstore.PromptExecutionState
+		delivery  controlstore.PromptDeliveryState
+		phase     corev1alpha1.TaskPhase
+		outcome   corev1alpha1.TaskExecutionOutcome
+	}{
+		{name: "failed", execution: controlstore.PromptExecutionFailed, delivery: controlstore.PromptDeliveryNotRequested, phase: corev1alpha1.TaskPhaseFailed, outcome: corev1alpha1.TaskExecutionOutcomeFailed},
+		{name: "outcome unknown", execution: controlstore.PromptExecutionOutcomeUnknown, delivery: controlstore.PromptDeliveryNotRequested, phase: corev1alpha1.TaskPhaseFailed, outcome: corev1alpha1.TaskExecutionOutcomeOutcomeUnknown},
+		{name: "succeeded verified exact", execution: controlstore.PromptExecutionSucceeded, delivery: controlstore.PromptDeliveryVerifiedExact, phase: corev1alpha1.TaskPhaseSucceeded, outcome: corev1alpha1.TaskExecutionOutcomeSucceeded},
+		{name: "succeeded cancelled before publish", execution: controlstore.PromptExecutionSucceeded, delivery: controlstore.PromptDeliveryCancelledBeforePublish, phase: corev1alpha1.TaskPhaseCancelled, outcome: corev1alpha1.TaskExecutionOutcomeSucceeded},
+		{name: "succeeded delivery conflict", execution: controlstore.PromptExecutionSucceeded, delivery: controlstore.PromptDeliveryConflict, phase: corev1alpha1.TaskPhaseFailed, outcome: corev1alpha1.TaskExecutionOutcomeSucceeded},
+		{name: "cancelled", execution: controlstore.PromptExecutionCancelled, delivery: controlstore.PromptDeliveryNotRequested, phase: corev1alpha1.TaskPhaseCancelled, outcome: corev1alpha1.TaskExecutionOutcomeCancelled},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+			kubeStore, kubeClient, fence := newPromptAttemptReclaimStore(t)
+			taskUID := "task-restored-" + strings.ReplaceAll(tt.name, " ", "-")
+			attempt := createTerminalPromptAttempt(t, ctx, kubeStore, fence, taskUID, 1, "prompt-final", tt.execution, tt.delivery)
+			taskName := attempt.Key.TaskUID
+			projectionID := enqueueTaskTerminalProjection(t, ctx, kubeStore, fence, attempt, true)
+			setRestoredPromptAttemptOwner(t, ctx, kubeClient, taskName, attempt, restoredPromptAttemptTerminalStatus{
+				phase: tt.phase, execution: corev1alpha1.TaskExecutionState(tt.execution), outcome: tt.outcome, delivery: tt.delivery,
+			})
+			request := controlstore.ReclaimPromptAttemptsRequest{
+				Namespace: attempt.Key.Namespace, TaskName: taskName, TaskUID: attempt.Key.TaskUID,
+				Mode:                 controlstore.PromptAttemptReclamationProjected,
+				FinalPromptAttemptID: attempt.ID, TerminalProjectionID: projectionID, Fence: fence,
+			}
+
+			if err := kubeStore.PreparePromptAttemptReclamation(ctx, request); err != nil {
+				t.Fatalf("PreparePromptAttemptReclamation(restored source): %v", err)
+			}
+			if deleted, err := kubeStore.ReclaimPromptAttempts(ctx, request); err != nil || deleted != 1 {
+				t.Fatalf("ReclaimPromptAttempts(restored source) = deleted:%d err:%v, want 1,nil", deleted, err)
+			}
+			if _, err := kubeStore.GetPromptAttempt(ctx, attempt.ID); !errors.Is(err, controlstore.ErrNotFound) {
+				t.Fatalf("GetPromptAttempt(restored source) error = %v, want ErrNotFound", err)
+			}
+			assertPromptAttemptReclamationCompleted(t, ctx, kubeClient, request, true)
+			if err := kubeStore.PreparePromptAttemptReclamation(ctx, request); err != nil {
+				t.Fatalf("PreparePromptAttemptReclamation(restored retry): %v", err)
+			}
+			if deleted, err := kubeStore.ReclaimPromptAttempts(ctx, request); err != nil || deleted != 0 {
+				t.Fatalf("ReclaimPromptAttempts(restored retry) = deleted:%d err:%v, want 0,nil", deleted, err)
+			}
+		})
+	}
+}
+
+func TestPreparePromptAttemptReclamationRejectsUnvalidatedRestoredSourceIdentity(t *testing.T) {
+	tests := []struct {
+		name          string
+		mutateTask    func(task *corev1alpha1.Task)
+		mutateRequest func(request *controlstore.ReclaimPromptAttemptsRequest)
+	}{
+		{name: "phase mismatch", mutateTask: func(task *corev1alpha1.Task) {
+			task.Status.Phase = corev1alpha1.TaskPhaseFailed
+		}},
+		{name: "execution outcome mismatch", mutateTask: func(task *corev1alpha1.Task) {
+			task.Status.Execution.Outcome = corev1alpha1.TaskExecutionOutcomeFailed
+		}},
+		{name: "delivery outcome mismatch", mutateTask: func(task *corev1alpha1.Task) {
+			task.Status.Delivery.Outcome = corev1alpha1.TaskDeliveryOutcomeDeliveryConflict
+		}},
+		{name: "settlement reason missing", mutateTask: func(task *corev1alpha1.Task) {
+			task.Status.Execution.Reason = ""
+		}},
+		{name: "binding digest mismatch", mutateTask: func(task *corev1alpha1.Task) {
+			task.Status.AgentExecutionBinding.BindingDigest = testDigest("foreign-binding")
+		}},
+		{name: "snapshot digest mismatch", mutateTask: func(task *corev1alpha1.Task) {
+			task.Status.AgentExecutionBinding.Snapshot.Digest = testDigest("foreign-snapshot")
+		}},
+		{name: "request digest mismatch", mutateTask: func(task *corev1alpha1.Task) {
+			task.Status.Execution.RequestDigest = testDigest("foreign-request")
+		}},
+		{name: "source UID mismatch", mutateTask: func(task *corev1alpha1.Task) {
+			task.Status.AgentExecutionBinding.Task.UID = types.UID("foreign-source")
+		}},
+		{name: "final attempt mismatch", mutateRequest: func(request *controlstore.ReclaimPromptAttemptsRequest) {
+			request.FinalPromptAttemptID = "foreign-attempt"
+		}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+			kubeStore, kubeClient, fence := newPromptAttemptReclaimStore(t)
+			attempt := createTerminalPromptAttempt(t, ctx, kubeStore, fence, "task-restored-reject", 1, "prompt-final",
+				controlstore.PromptExecutionSucceeded, controlstore.PromptDeliveryVerifiedExact)
+			taskName := attempt.Key.TaskUID
+			projectionID := enqueueTaskTerminalProjection(t, ctx, kubeStore, fence, attempt, true)
+			task := setRestoredPromptAttemptOwner(t, ctx, kubeClient, taskName, attempt, restoredPromptAttemptTerminalStatus{
+				phase: corev1alpha1.TaskPhaseSucceeded, execution: corev1alpha1.TaskExecutionStateSucceeded,
+				outcome: corev1alpha1.TaskExecutionOutcomeSucceeded, delivery: controlstore.PromptDeliveryVerifiedExact,
+			})
+			if tt.mutateTask != nil {
+				tt.mutateTask(task)
+			}
+			if err := kubeClient.Status().Update(ctx, task); err != nil {
+				t.Fatalf("mutate restored Task status: %v", err)
+			}
+			request := controlstore.ReclaimPromptAttemptsRequest{
+				Namespace: attempt.Key.Namespace, TaskName: taskName, TaskUID: attempt.Key.TaskUID,
+				Mode:                 controlstore.PromptAttemptReclamationProjected,
+				FinalPromptAttemptID: attempt.ID, TerminalProjectionID: projectionID, Fence: fence,
+			}
+			if tt.mutateRequest != nil {
+				tt.mutateRequest(&request)
+			}
+			if err := kubeStore.PreparePromptAttemptReclamation(ctx, request); !errors.Is(err, controlstore.ErrConflict) {
+				t.Fatalf("PreparePromptAttemptReclamation() error = %v, want ErrConflict", err)
+			}
+			if _, err := kubeStore.GetPromptAttempt(ctx, attempt.ID); err != nil {
+				t.Fatalf("unvalidated restored source attempt was mutated: %v", err)
+			}
+			assertPromptAttemptReclamationMarker(t, ctx, kubeClient, attempt.Key.TaskUID, false)
+		})
+	}
+}
+
+func TestPreparePromptAttemptReclamationRejectsIncompleteTerminalProjectionPayload(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, fence := newPromptAttemptReclaimStore(t)
+	attempt := createTerminalPromptAttempt(t, ctx, kubeStore, fence, "task-restored-incomplete-projection", 1, "prompt-final",
+		controlstore.PromptExecutionSucceeded, controlstore.PromptDeliveryVerifiedExact)
+	taskName := attempt.Key.TaskUID
+	setRestoredPromptAttemptOwner(t, ctx, kubeClient, taskName, attempt, restoredPromptAttemptTerminalStatus{
+		phase: corev1alpha1.TaskPhaseSucceeded, execution: corev1alpha1.TaskExecutionStateSucceeded,
+		outcome: corev1alpha1.TaskExecutionOutcomeSucceeded, delivery: controlstore.PromptDeliveryVerifiedExact,
+	})
+	projectionID := enqueueRawTaskTerminalProjection(t, ctx, kubeStore, fence, attempt, []byte(`{"phase":"Succeeded"}`), true)
+	request := controlstore.ReclaimPromptAttemptsRequest{
+		Namespace: attempt.Key.Namespace, TaskName: taskName, TaskUID: attempt.Key.TaskUID,
+		Mode:                 controlstore.PromptAttemptReclamationProjected,
+		FinalPromptAttemptID: attempt.ID, TerminalProjectionID: projectionID, Fence: fence,
+	}
+
+	if err := kubeStore.PreparePromptAttemptReclamation(ctx, request); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("PreparePromptAttemptReclamation() error = %v, want ErrConflict", err)
+	}
+	if _, err := kubeStore.GetPromptAttempt(ctx, attempt.ID); err != nil {
+		t.Fatalf("incomplete terminal projection mutated its source PromptAttempt: %v", err)
+	}
+	assertPromptAttemptReclamationMarker(t, ctx, kubeClient, attempt.Key.TaskUID, false)
+}
+
+func TestReclaimPromptAttemptsRecoversMarkerCleanupCrash(t *testing.T) {
+	tests := []struct {
+		name                 string
+		persistMarkerDelete  bool
+		wantMarkerAfterError bool
+	}{
+		{name: "before marker delete", wantMarkerAfterError: true},
+		{name: "after marker delete before acknowledgement", persistMarkerDelete: true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+			kubeStore, kubeClient, fence := newPromptAttemptReclaimStore(t)
+			attempt := createFailedPromptAttempt(t, ctx, kubeStore, fence, "task-reclaim-cleanup-crash", 1, "prompt-final")
+			taskName := createDeletingTaskForPromptAttempt(t, ctx, kubeClient, attempt)
+			projectionID := enqueueTaskTerminalProjection(t, ctx, kubeStore, fence, attempt, true)
+			request := controlstore.ReclaimPromptAttemptsRequest{
+				Namespace: attempt.Key.Namespace, TaskName: taskName, TaskUID: attempt.Key.TaskUID,
+				Mode:                 controlstore.PromptAttemptReclamationProjected,
+				FinalPromptAttemptID: attempt.ID, TerminalProjectionID: projectionID, Fence: fence,
+			}
+			if err := kubeStore.PreparePromptAttemptReclamation(ctx, request); err != nil {
+				t.Fatalf("PreparePromptAttemptReclamation(): %v", err)
+			}
+			assertPromptAttemptReclamationMarker(t, ctx, kubeClient, attempt.Key.TaskUID, true)
+
+			withWatch, ok := kubeClient.(client.WithWatch)
+			if !ok {
+				t.Fatal("fake client does not implement client.WithWatch")
+			}
+			injectedErr := errors.New("simulated marker cleanup crash")
+			markerName := promptAttemptReclamationMarkerName(attempt.Key.TaskUID)
+			kubeStore.client = interceptor.NewClient(withWatch, interceptor.Funcs{
+				Delete: func(ctx context.Context, c client.WithWatch, object client.Object, options ...client.DeleteOption) error {
+					marker, isMarker := object.(*corev1.ConfigMap)
+					if !isMarker || marker.Namespace != testControlNamespace || marker.Name != markerName {
+						return c.Delete(ctx, object, options...)
+					}
+					if tt.persistMarkerDelete {
+						if err := c.Delete(ctx, object, options...); err != nil {
+							return err
+						}
+					}
+					return injectedErr
+				},
+			})
+			deleted, err := kubeStore.ReclaimPromptAttempts(ctx, request)
+			if !errors.Is(err, injectedErr) {
+				t.Fatalf("ReclaimPromptAttempts() error = %v, want injected cleanup error", err)
+			}
+			if deleted != 1 {
+				t.Fatalf("ReclaimPromptAttempts() deleted = %d, want 1", deleted)
+			}
+			if _, err := kubeStore.GetPromptAttempt(ctx, attempt.ID); !errors.Is(err, controlstore.ErrNotFound) {
+				t.Fatalf("GetPromptAttempt() after cleanup crash error = %v, want ErrNotFound", err)
+			}
+			assertPromptAttemptReclamationMarker(t, ctx, kubeClient, attempt.Key.TaskUID, tt.wantMarkerAfterError)
+			assertPromptAttemptReclamationCompleted(t, ctx, kubeClient, request, true)
+
+			kubeStore.client = kubeClient
+			if err := kubeStore.PreparePromptAttemptReclamation(ctx, request); err != nil {
+				t.Fatalf("PreparePromptAttemptReclamation() retry: %v", err)
+			}
+			if deleted, err := kubeStore.ReclaimPromptAttempts(ctx, request); err != nil || deleted != 0 {
+				t.Fatalf("ReclaimPromptAttempts() retry = deleted:%d err:%v, want 0,nil", deleted, err)
+			}
+			assertPromptAttemptReclamationMarker(t, ctx, kubeClient, attempt.Key.TaskUID, false)
+		})
+	}
+}
+
+func TestReclaimPromptAttemptsRecordsCompletionOnlyAfterDeletionIsObserved(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, fence := newPromptAttemptReclaimStore(t)
+	attempt := createFailedPromptAttempt(t, ctx, kubeStore, fence, "task-reclaim-finalized-delete", 1, "prompt-final")
+	object := &corev1alpha1.PromptAttempt{}
+	key := client.ObjectKey{Namespace: attempt.Key.Namespace, Name: objectName(promptAttemptNamePrefix, attempt.ID)}
+	if err := kubeClient.Get(ctx, key, object); err != nil {
+		t.Fatalf("get PromptAttempt fixture: %v", err)
+	}
+	object.Finalizers = []string{"reclamation-test"}
+	if err := kubeClient.Update(ctx, object); err != nil {
+		t.Fatalf("add PromptAttempt finalizer: %v", err)
+	}
+	taskName := createDeletingTaskForPromptAttempt(t, ctx, kubeClient, attempt)
+	projectionID := enqueueTaskTerminalProjection(t, ctx, kubeStore, fence, attempt, true)
+	request := controlstore.ReclaimPromptAttemptsRequest{
+		Namespace: attempt.Key.Namespace, TaskName: taskName, TaskUID: attempt.Key.TaskUID,
+		Mode:                 controlstore.PromptAttemptReclamationProjected,
+		FinalPromptAttemptID: attempt.ID, TerminalProjectionID: projectionID, Fence: fence,
+	}
+	if _, err := kubeStore.ReclaimPromptAttempts(ctx, request); !errors.Is(err, controlstore.ErrNotReady) {
+		t.Fatalf("ReclaimPromptAttempts(finalizer retained) error = %v, want ErrNotReady", err)
+	}
+	assertPromptAttemptReclamationCompleted(t, ctx, kubeClient, request, false)
+	assertPromptAttemptReclamationMarker(t, ctx, kubeClient, attempt.Key.TaskUID, true)
+
+	if err := kubeClient.Get(ctx, key, object); err != nil {
+		t.Fatalf("get deleting PromptAttempt: %v", err)
+	}
+	object.Finalizers = nil
+	if err := kubeClient.Update(ctx, object); err != nil && !apierrors.IsNotFound(err) {
+		t.Fatalf("remove PromptAttempt finalizer: %v", err)
+	}
+	if err := kubeStore.PreparePromptAttemptReclamation(ctx, request); err != nil {
+		t.Fatalf("PreparePromptAttemptReclamation(retry): %v", err)
+	}
+	if _, err := kubeStore.ReclaimPromptAttempts(ctx, request); err != nil {
+		t.Fatalf("ReclaimPromptAttempts(retry): %v", err)
+	}
+	assertPromptAttemptReclamationCompleted(t, ctx, kubeClient, request, true)
+}
+
+func TestReclaimPromptAttemptsCleansNoAttemptMarker(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, fence := newPromptAttemptReclaimStore(t)
+	const taskUID = "task-reclaim-no-attempt"
+	createDeletingAgentTask(t, ctx, kubeClient, "tenant-a", taskUID, taskUID)
+	request := controlstore.ReclaimPromptAttemptsRequest{
+		Namespace: "tenant-a", TaskName: taskUID, TaskUID: taskUID,
+		Mode: controlstore.PromptAttemptReclamationNoAttempt, Fence: fence,
+	}
+	if err := kubeStore.PreparePromptAttemptReclamation(ctx, request); err != nil {
+		t.Fatalf("PreparePromptAttemptReclamation(): %v", err)
+	}
+	assertPromptAttemptReclamationMarker(t, ctx, kubeClient, taskUID, true)
+	if deleted, err := kubeStore.ReclaimPromptAttempts(ctx, request); err != nil || deleted != 0 {
+		t.Fatalf("ReclaimPromptAttempts() = deleted:%d err:%v, want 0,nil", deleted, err)
+	}
+	assertPromptAttemptReclamationMarker(t, ctx, kubeClient, taskUID, false)
+	assertPromptAttemptReclamationCompleted(t, ctx, kubeClient, request, true)
+	if deleted, err := kubeStore.ReclaimPromptAttempts(ctx, request); err != nil || deleted != 0 {
+		t.Fatalf("ReclaimPromptAttempts() retry = deleted:%d err:%v, want 0,nil", deleted, err)
+	}
+	assertPromptAttemptReclamationMarker(t, ctx, kubeClient, taskUID, false)
+}
+
+func TestReclaimPromptAttemptsCompletionAllowsUnboundContinuityProjectionRetry(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, fence := newPromptAttemptReclaimStore(t)
+	attempt := createFailedPromptAttempt(t, ctx, kubeStore, fence, "task-reclaim-unbound-continuity", 1, "prompt-final")
+	taskName := createDeletingTaskForPromptAttempt(t, ctx, kubeClient, attempt)
+	projectionID := enqueueTaskTerminalProjection(t, ctx, kubeStore, fence, attempt, true)
+	request := controlstore.ReclaimPromptAttemptsRequest{
+		Namespace: attempt.Key.Namespace, TaskName: taskName, TaskUID: attempt.Key.TaskUID,
+		Mode:                 controlstore.PromptAttemptReclamationProjected,
+		ContinuitySession:    true,
+		FinalPromptAttemptID: attempt.ID, TerminalProjectionID: projectionID, Fence: fence,
+	}
+	if deleted, err := kubeStore.ReclaimPromptAttempts(ctx, request); err != nil || deleted != 1 {
+		t.Fatalf("ReclaimPromptAttempts() = deleted:%d err:%v, want 1,nil", deleted, err)
+	}
+	retryRequest := request
+	retryRequest.TerminalProjectionID = ""
+	if err := kubeStore.PreparePromptAttemptReclamation(ctx, retryRequest); err != nil {
+		t.Fatalf("PreparePromptAttemptReclamation(post-attempt retry): %v", err)
+	}
+	if deleted, err := kubeStore.ReclaimPromptAttempts(ctx, retryRequest); err != nil || deleted != 0 {
+		t.Fatalf("ReclaimPromptAttempts(post-attempt retry) = deleted:%d err:%v, want 0,nil", deleted, err)
+	}
+}
+
+func TestReclaimPromptAttemptsAcceptsPinnedLegacySessionProjectionAfterPreparedDelete(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, fence := newPromptAttemptReclaimStore(t)
+	persistence, ok := kubeStore.sessionTurns.(*sqlitestore.Store)
+	if !ok {
+		t.Fatalf("SessionTurn persistence = %T, want *sqlite.Store", kubeStore.sessionTurns)
+	}
+	const (
+		namespace   = "tenant-a"
+		taskUID     = "task-legacy-session-projection"
+		sessionName = "legacy-session-projection"
+		sessionUID  = "legacy-session-projection-uid"
+		promptID    = "prompt-legacy-session-projection"
+	)
+	if err := persistence.CreateSession(ctx, &controlstore.SessionRecord{
+		Namespace: namespace, Name: sessionName, SessionType: "task",
+	}); err != nil {
+		t.Fatalf("CreateSession(): %v", err)
+	}
+	task := ensureActiveAgentTask(t, ctx, kubeClient, namespace, taskUID, taskUID)
+	task.Spec.SessionRef = &corev1alpha1.SessionReference{Name: sessionName, Create: true}
+	if err := kubeClient.Update(ctx, task); err != nil {
+		t.Fatalf("record Task SessionRef: %v", err)
+	}
+	control, err := kubeStore.CreateSessionControl(ctx, &controlstore.SessionControl{
+		Namespace: namespace, SessionName: sessionName, SessionUID: sessionUID,
+		RequestDigest: testDigest("legacy-session-control"),
+	}, fence)
+	if err != nil {
+		t.Fatalf("CreateSessionControl(): %v", err)
+	}
+	promptRequestDigest := testDigest("legacy-session-prompt")
+	leaseRequestDigest, err := controlstore.SessionMutationLeaseRequestDigest(
+		control.SessionUID, control.LeaseGeneration+1, taskUID, 1, promptID, promptRequestDigest,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	leaseExpires := testNow.Add(15 * time.Minute)
+	control, err = kubeStore.AcquireSessionMutationLease(ctx, controlstore.AcquireSessionMutationLeaseRequest{
+		Namespace: namespace, SessionName: sessionName, SessionUID: sessionUID,
+		Fence: fence, ExpectedVersion: control.Version, ExpectedLeaseGeneration: control.LeaseGeneration,
+		TaskUID: taskUID, Attempt: 1, PromptID: promptID, RequestDigest: leaseRequestDigest,
+		AcquiredAt: testNow, ExpiresAt: &leaseExpires, Lineage: testSessionLineageClaim(control),
+	})
+	if err != nil {
+		t.Fatalf("AcquireSessionMutationLease(): %v", err)
+	}
+	attempt, err := kubeStore.CreatePromptAttempt(ctx, boundPromptAttemptForKubeTest(&controlstore.PromptAttempt{
+		Key:           controlstore.PromptAttemptKey{Namespace: namespace, TaskUID: taskUID, Attempt: 1, PromptID: promptID},
+		RequestDigest: promptRequestDigest,
+	}), fence)
+	if err != nil {
+		t.Fatalf("CreatePromptAttempt(): %v", err)
+	}
+	for i, state := range []controlstore.PromptExecutionState{
+		controlstore.PromptExecutionReserved,
+		controlstore.PromptExecutionSessionStarting,
+		controlstore.PromptExecutionPlanned,
+	} {
+		transition := controlstore.PromptAttemptExecutionTransition{
+			ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+			NewState: state, OperationID: "legacy-session-" + string(state),
+			OperationDigest: testDigest("legacy-session-" + string(state)), UpdatedAt: testNow.Add(time.Duration(i+1) * time.Minute),
+		}
+		if state == controlstore.PromptExecutionSessionStarting {
+			transition.SessionUID = sessionUID
+			transition.SessionLeaseGeneration = control.LeaseGeneration
+			transition.RuntimeInstanceID = "legacy-runtime-instance"
+		}
+		attempt, err = kubeStore.TransitionPromptAttemptExecution(ctx, transition)
+		if err != nil {
+			t.Fatalf("TransitionPromptAttemptExecution(%s): %v", state, err)
+		}
+	}
+	turnKey := controlstore.SessionTurnKey{
+		SessionUID: sessionUID, LeaseGeneration: control.LeaseGeneration,
+		TaskUID: taskUID, Attempt: 1, PromptID: promptID,
+	}
+	turn, err := kubeStore.CreateSessionTurn(ctx, controlstore.CreateSessionTurnRequest{
+		Turn: controlstore.SessionTurn{
+			Key: turnKey, PromptAttemptID: attempt.ID, RequestDigest: testDigest("legacy-session-turn"), UserPrompt: "cancel safely",
+		},
+		Fence: fence, ExpectedSessionVersion: control.Version,
+	})
+	if err != nil {
+		t.Fatalf("CreateSessionTurn(): %v", err)
+	}
+	attempt, err = kubeStore.TransitionPromptAttemptExecution(ctx, controlstore.PromptAttemptExecutionTransition{
+		ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+		NewState: controlstore.PromptExecutionCancelled, OperationID: "legacy-session-cancelled",
+		OperationDigest: testDigest("legacy-session-cancelled"), TerminalReason: "Cancelled",
+		UpdatedAt: testNow.Add(4 * time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("TransitionPromptAttemptExecution(Cancelled): %v", err)
+	}
+	if err := kubeClient.Get(ctx, client.ObjectKey{Namespace: namespace, Name: taskUID}, task); err != nil {
+		t.Fatalf("reload Task: %v", err)
+	}
+	task.Status.Phase = corev1alpha1.TaskPhaseCancelled
+	task.Status.Execution = &corev1alpha1.TaskExecutionStatus{
+		State: corev1alpha1.TaskExecutionStateCancelled, Outcome: corev1alpha1.TaskExecutionOutcomeCancelled,
+		Reason: "Cancelled", Attempt: 1, PromptID: promptID, RuntimeInstanceID: attempt.RuntimeInstanceID,
+		RuntimeSessionUID: sessionUID, RuntimeSessionGeneration: control.LeaseGeneration,
+		RequestDigest: promptRequestDigest, ControllerEpoch: fence.Epoch,
+	}
+	task.Status.Delivery = &corev1alpha1.TaskDeliveryStatus{
+		State: corev1alpha1.TaskDeliveryStateNotRequested, Outcome: corev1alpha1.TaskDeliveryOutcomeNotRequested,
+	}
+	if err := kubeClient.Status().Update(ctx, task); err != nil {
+		t.Fatalf("record terminal Task status: %v", err)
+	}
+	legacyPayload, err := json.Marshal(taskterminal.Projection{
+		Namespace: namespace, Task: taskUID, TaskUID: taskUID, Attempt: 1, Phase: corev1alpha1.TaskPhaseCancelled,
+		Message: "controller restart recovered terminal cancellation",
+		Execution: corev1alpha1.TaskExecutionStatus{
+			State: corev1alpha1.TaskExecutionStateCancelled, Outcome: corev1alpha1.TaskExecutionOutcomeCancelled,
+			Attempt: 1, PromptID: promptID,
+		},
+		Delivery: task.Status.Delivery.DeepCopy(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	projectionID := controlstore.CanonicalControlID("outbox", turn.ID, "TaskTerminalStatus")
+	projection := controlstore.OutboxProjection{
+		ID: projectionID, AggregateKind: sessionTurnAggregateKind, AggregateID: turn.ID,
+		ProjectionKind: "TaskTerminalStatus", Payload: legacyPayload, PayloadDigest: testBytesDigest(legacyPayload),
+		AvailableAt: testNow.Add(5 * time.Minute),
+	}
+	if _, err := kubeStore.FinalizeSessionTurn(ctx, controlstore.FinalizeSessionTurnRequest{
+		Key: turnKey, Fence: fence, ExpectedSessionVersion: control.Version, ExpectedTurnVersion: turn.Version,
+		FinalizationDigest: testDigest("legacy-session-finalization"), TerminalKind: controlstore.SessionTurnOutcomeMarker,
+		TerminalContent: `{"kind":"Cancelled","reason":"controller restart recovered terminal cancellation","assistantResultRecorded":false}`,
+		Projection:      projection, FinalizedAt: testNow.Add(5 * time.Minute),
+	}); err != nil {
+		t.Fatalf("FinalizeSessionTurn(): %v", err)
+	}
+	claims, err := kubeStore.ClaimOutboxProjections(ctx, controlstore.ClaimOutboxProjectionsRequest{
+		Fence: fence, WorkerID: "legacy-session-projector", Limit: 1,
+		LeaseDuration: time.Minute, Now: testNow.Add(6 * time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("ClaimOutboxProjections(): %v", err)
+	}
+	if len(claims) != 1 || claims[0].ID != projectionID {
+		t.Fatalf("claimed projections = %#v, want %q", claims, projectionID)
+	}
+	claimed := claims[0]
+	if _, err := kubeStore.CompleteOutboxProjection(ctx, controlstore.CompleteOutboxProjectionRequest{
+		ID: claimed.ID, Fence: fence, ExpectedVersion: claimed.Version, LeaseOwner: claimed.LeaseOwner,
+		OperationID: "deliver-legacy-session-projection", OperationDigest: testDigest("deliver-legacy-session-projection"),
+		NewState: controlstore.OutboxProjectionDelivered, DeliveryDigest: testDigest("legacy-session-projection-delivered"),
+		UpdatedAt: testNow.Add(7 * time.Minute),
+	}); err != nil {
+		t.Fatalf("CompleteOutboxProjection(Delivered): %v", err)
+	}
+	createDeletingAgentTask(t, ctx, kubeClient, namespace, taskUID, taskUID)
+	request := controlstore.ReclaimPromptAttemptsRequest{
+		Namespace: namespace, TaskName: taskUID, TaskUID: taskUID,
+		Mode: controlstore.PromptAttemptReclamationProjected, ContinuitySession: true, FinalContinuitySession: true,
+		FinalPromptAttemptID: attempt.ID, TerminalProjectionID: projectionID, Fence: fence,
+	}
+	if err := kubeStore.PreparePromptAttemptReclamation(ctx, request); err != nil {
+		t.Fatalf("PreparePromptAttemptReclamation(legacy Session): %v", err)
+	}
+	assertPromptAttemptReclamationMarker(t, ctx, kubeClient, taskUID, true)
+	attemptObject := &corev1alpha1.PromptAttempt{}
+	if err := kubeClient.Get(ctx, client.ObjectKey{
+		Namespace: namespace, Name: objectName(promptAttemptNamePrefix, attempt.ID),
+	}, attemptObject); err != nil {
+		t.Fatalf("load prepared PromptAttempt: %v", err)
+	}
+	if err := kubeClient.Delete(ctx, attemptObject); err != nil {
+		t.Fatalf("simulate committed PromptAttempt deletion: %v", err)
+	}
+	if err := kubeStore.PreparePromptAttemptReclamation(ctx, request); err != nil {
+		t.Fatalf("PreparePromptAttemptReclamation(post-delete retry): %v", err)
+	}
+	if deleted, err := kubeStore.ReclaimPromptAttempts(ctx, request); err != nil || deleted != 0 {
+		t.Fatalf("ReclaimPromptAttempts(post-delete retry) = deleted:%d err:%v, want 0,nil", deleted, err)
+	}
+	assertPromptAttemptReclamationMarker(t, ctx, kubeClient, taskUID, false)
+	assertPromptAttemptReclamationCompleted(t, ctx, kubeClient, request, true)
+}
+
+func TestPreparePromptAttemptReclamationRejectsUnprovenEmptyProjectedState(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, fence := newPromptAttemptReclaimStore(t)
+	const taskUID = "task-reclaim-missing-attempt"
+	createDeletingAgentTask(t, ctx, kubeClient, "tenant-a", taskUID, taskUID)
+	request := controlstore.ReclaimPromptAttemptsRequest{
+		Namespace: "tenant-a", TaskName: taskUID, TaskUID: taskUID,
+		Mode: controlstore.PromptAttemptReclamationProjected, FinalPromptAttemptID: "missing-attempt",
+		TerminalProjectionID: "missing-projection", Fence: fence,
+	}
+	if err := kubeStore.PreparePromptAttemptReclamation(ctx, request); !errors.Is(err, controlstore.ErrNotReady) {
+		t.Fatalf("PreparePromptAttemptReclamation() error = %v, want ErrNotReady", err)
+	}
+	assertPromptAttemptReclamationMarker(t, ctx, kubeClient, taskUID, false)
+	assertPromptAttemptReclamationCompleted(t, ctx, kubeClient, request, false)
+}
+
+func TestCreatePromptAttemptRejectsDeletingOrMissingTaskOwner(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, fence := newPromptAttemptReclaimStore(t)
+	const taskUID = "task-reclaim-late-create"
+	createDeletingAgentTask(t, ctx, kubeClient, "tenant-a", taskUID, taskUID)
+	attempt := boundPromptAttemptForKubeTest(&controlstore.PromptAttempt{
+		Key:           controlstore.PromptAttemptKey{Namespace: "tenant-a", TaskUID: taskUID, Attempt: 1, PromptID: "late"},
+		RequestDigest: testDigest("late-create"),
+	})
+	if _, err := kubeStore.CreatePromptAttempt(ctx, attempt, fence); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("CreatePromptAttempt(deleting Task) error = %v, want ErrConflict", err)
+	}
+
+	missing := *attempt
+	missing.Key.TaskUID = "task-reclaim-missing-owner"
+	missing.Key.PromptID = "missing-owner"
+	missing.ID = ""
+	missing.RequestDigest = testDigest("missing-owner")
+	if _, err := kubeStore.CreatePromptAttempt(ctx, &missing, fence); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("CreatePromptAttempt(missing Task) error = %v, want ErrConflict", err)
+	}
+}
+
+func createDeletingTaskForPromptAttempt(
+	t *testing.T,
+	ctx context.Context,
+	kubeClient client.Client,
+	attempt *controlstore.PromptAttempt,
+) string {
+	t.Helper()
+	name := attempt.Key.TaskUID
+	createDeletingAgentTask(t, ctx, kubeClient, attempt.Key.Namespace, name, attempt.Key.TaskUID)
+	return name
+}
+
+func createDeletingAgentTask(
+	t *testing.T,
+	ctx context.Context,
+	kubeClient client.Client,
+	namespace, name, uid string,
+) {
+	t.Helper()
+	task := ensureActiveAgentTask(t, ctx, kubeClient, namespace, name, uid)
+	if len(task.Finalizers) == 0 {
+		task.Finalizers = []string{"reclamation-test"}
+		if err := kubeClient.Update(ctx, task); err != nil {
+			t.Fatalf("add deleting Task finalizer: %v", err)
+		}
+	}
+	if err := kubeClient.Delete(ctx, task); err != nil {
+		t.Fatalf("mark Task deleting: %v", err)
+	}
+}
+
+type restoredPromptAttemptTerminalStatus struct {
+	phase     corev1alpha1.TaskPhase
+	execution corev1alpha1.TaskExecutionState
+	outcome   corev1alpha1.TaskExecutionOutcome
+	delivery  controlstore.PromptDeliveryState
+}
+
+func setRestoredPromptAttemptOwner(
+	t *testing.T,
+	ctx context.Context,
+	kubeClient client.Client,
+	taskName string,
+	attempt *controlstore.PromptAttempt,
+	terminal restoredPromptAttemptTerminalStatus,
+) *corev1alpha1.Task {
+	t.Helper()
+	task := &corev1alpha1.Task{}
+	key := client.ObjectKey{Namespace: attempt.Key.Namespace, Name: taskName}
+	if err := kubeClient.Get(ctx, key, task); err != nil {
+		t.Fatalf("get source Task for restore: %v", err)
+	}
+	if err := kubeClient.Delete(ctx, task); err != nil {
+		t.Fatalf("remove source Task fixture: %v", err)
+	}
+	restored := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: task.Namespace, Name: task.Name, UID: types.UID("task-restored-target"),
+			Finalizers: []string{"reclamation-test"},
+		},
+		Spec: task.Spec,
+	}
+	if err := kubeClient.Create(ctx, restored); err != nil {
+		t.Fatalf("create restored Task fixture: %v", err)
+	}
+	restored.Status.Phase = terminal.phase
+	restored.Status.Execution = &corev1alpha1.TaskExecutionStatus{
+		State: terminal.execution, Outcome: terminal.outcome,
+		Reason: restoredTaskIdentityChangedReason, Attempt: int32(attempt.Key.Attempt), PromptID: attempt.Key.PromptID,
+		RequestDigest: attempt.RequestDigest,
+	}
+	restored.Status.Delivery = &corev1alpha1.TaskDeliveryStatus{
+		State:   corev1alpha1.TaskDeliveryState(terminal.delivery),
+		Outcome: corev1alpha1.TaskDeliveryOutcome(terminal.delivery),
+	}
+	restored.Status.AgentExecutionBinding = &corev1alpha1.AgentExecutionBinding{
+		SchemaVersion: 1, ContractVersion: corev1alpha1.AgentRuntimeContractHarnessV2,
+		BindingDigest: attempt.BindingDigest,
+		Task:          corev1alpha1.AgentExecutionBindingTaskRef{UID: types.UID(attempt.Key.TaskUID)},
+		Snapshot: corev1alpha1.AgentExecutionSnapshotRef{
+			ID:            (controlstore.AgentExecutionSnapshotKey{TaskUID: attempt.Key.TaskUID, Digest: attempt.SnapshotDigest}).ID(),
+			Digest:        attempt.SnapshotDigest,
+			SchemaVersion: controlstore.AgentExecutionSnapshotSchemaVersion,
+		},
+	}
+	if err := kubeClient.Status().Update(ctx, restored); err != nil {
+		t.Fatalf("record restored Task status: %v", err)
+	}
+	if err := kubeClient.Delete(ctx, restored); err != nil {
+		t.Fatalf("mark restored Task deleting: %v", err)
+	}
+	if err := kubeClient.Get(ctx, key, restored); err != nil {
+		t.Fatalf("refresh restored deleting Task: %v", err)
+	}
+	return restored
+}
+
+func assertPromptAttemptReclamationMarker(
+	t *testing.T,
+	ctx context.Context,
+	kubeClient client.Client,
+	taskUID string,
+	want bool,
+) {
+	t.Helper()
+	marker := &corev1.ConfigMap{}
+	err := kubeClient.Get(ctx, client.ObjectKey{
+		Namespace: testControlNamespace,
+		Name:      promptAttemptReclamationMarkerName(taskUID),
+	}, marker)
+	if want && err != nil {
+		t.Fatalf("get prompt attempt reclamation marker: %v", err)
+	}
+	if !want && !apierrors.IsNotFound(err) {
+		t.Fatalf("prompt attempt reclamation marker still exists or lookup failed: %v", err)
+	}
+}
+
+func assertPromptAttemptReclamationCompleted(
+	t *testing.T,
+	ctx context.Context,
+	kubeClient client.Client,
+	request controlstore.ReclaimPromptAttemptsRequest,
+	want bool,
+) {
+	t.Helper()
+	task := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, client.ObjectKey{Namespace: request.Namespace, Name: request.TaskName}, task); err != nil {
+		t.Fatalf("get Task reclamation completion receipt: %v", err)
+	}
+	condition := meta.FindStatusCondition(task.Status.Conditions, promptAttemptReclamationCompleteCondition)
+	if !want {
+		if condition != nil {
+			t.Fatalf("unexpected PromptAttempt reclamation completion condition: %#v", condition)
+		}
+		return
+	}
+	digest, err := promptAttemptReclamationCompletionDigest(request)
+	if err != nil {
+		t.Fatalf("promptAttemptReclamationCompletionDigest(): %v", err)
+	}
+	if condition == nil || condition.Status != metav1.ConditionTrue || condition.Reason != promptAttemptReclamationCompleteReason || condition.Message != digest {
+		t.Fatalf("PromptAttempt reclamation completion condition = %#v, want digest %q", condition, digest)
+	}
+}
+
+func newPromptAttemptReclaimStore(t *testing.T) (*Store, client.Client, controlstore.ControllerEpochFence) {
+	t.Helper()
+	_, kubeClient, fence := newTestStoreWithEpoch(t)
+	db, err := sqlitestore.NewDB(filepath.Join(t.TempDir(), "prompt-attempt-reclaim.db"))
+	if err != nil {
+		t.Fatalf("NewDB: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	kubeStore, err := NewComposite(kubeClient, testControlNamespace, sqlitestore.NewStore(db, ""))
+	if err != nil {
+		t.Fatalf("NewComposite: %v", err)
+	}
+	return kubeStore, kubeClient, fence
+}
+
+func createFailedPromptAttempt(
+	t *testing.T,
+	ctx context.Context,
+	kubeStore *Store,
+	fence controlstore.ControllerEpochFence,
+	taskUID string,
+	attemptNumber int64,
+	promptID string,
+) *controlstore.PromptAttempt {
+	return createTerminalPromptAttempt(t, ctx, kubeStore, fence, taskUID, attemptNumber, promptID,
+		controlstore.PromptExecutionFailed, controlstore.PromptDeliveryNotRequested)
+}
+
+func createTerminalPromptAttempt(
+	t *testing.T,
+	ctx context.Context,
+	kubeStore *Store,
+	fence controlstore.ControllerEpochFence,
+	taskUID string,
+	attemptNumber int64,
+	promptID string,
+	executionState controlstore.PromptExecutionState,
+	deliveryState controlstore.PromptDeliveryState,
+) *controlstore.PromptAttempt {
+	t.Helper()
+	ensureActiveAgentTask(t, ctx, kubeStore.client, "tenant-a", taskUID, taskUID)
+	attempt, err := kubeStore.CreatePromptAttempt(ctx, boundPromptAttemptForKubeTest(&controlstore.PromptAttempt{
+		Key: controlstore.PromptAttemptKey{
+			Namespace: "tenant-a", TaskUID: taskUID, Attempt: attemptNumber, PromptID: promptID,
+		},
+		RequestDigest: testDigest(taskUID + ":" + promptID),
+	}), fence)
+	if err != nil {
+		t.Fatalf("CreatePromptAttempt: %v", err)
+	}
+	executionPath := []controlstore.PromptExecutionState{executionState}
+	switch executionState {
+	case controlstore.PromptExecutionSucceeded:
+		executionPath = []controlstore.PromptExecutionState{
+			controlstore.PromptExecutionReserved, controlstore.PromptExecutionSessionStarting,
+			controlstore.PromptExecutionPlanned, controlstore.PromptExecutionSubmitting,
+			controlstore.PromptExecutionAccepted, controlstore.PromptExecutionRunning,
+			controlstore.PromptExecutionSettling, controlstore.PromptExecutionSucceeded,
+		}
+	case controlstore.PromptExecutionOutcomeUnknown:
+		executionPath = []controlstore.PromptExecutionState{
+			controlstore.PromptExecutionReserved, controlstore.PromptExecutionSessionStarting,
+			controlstore.PromptExecutionPlanned, controlstore.PromptExecutionSubmitting,
+			controlstore.PromptExecutionAccepted, controlstore.PromptExecutionOutcomeUnknown,
+		}
+	case controlstore.PromptExecutionFailed, controlstore.PromptExecutionCancelled:
+	default:
+		t.Fatalf("unsupported terminal execution fixture state %q", executionState)
+	}
+	for i, next := range executionPath {
+		terminalReason := ""
+		outcomeMarker := ""
+		if controlstore.IsTerminalPromptExecutionState(next) {
+			terminalReason = "test terminal " + string(executionState)
+		}
+		if next == controlstore.PromptExecutionOutcomeUnknown {
+			outcomeMarker = "test outcome unknown"
+		}
+		attempt, err = kubeStore.TransitionPromptAttemptExecution(ctx, controlstore.PromptAttemptExecutionTransition{
+			ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+			NewState: next, OperationID: fmt.Sprintf("terminal-%s-%d", promptID, i),
+			OperationDigest: testDigest(fmt.Sprintf("terminal-%s-%s-%d", taskUID, promptID, i)),
+			TerminalReason:  terminalReason, OutcomeMarker: outcomeMarker,
+			UpdatedAt: testNow.Add(time.Duration(i+1) * time.Minute),
+		})
+		if err != nil {
+			t.Fatalf("TransitionPromptAttemptExecution(%s): %v", next, err)
+		}
+	}
+	deliveryPath := []controlstore.PromptDeliveryState{}
+	switch deliveryState {
+	case controlstore.PromptDeliveryNotRequested:
+	case controlstore.PromptDeliveryVerifiedExact:
+		deliveryPath = []controlstore.PromptDeliveryState{
+			controlstore.PromptDeliveryValidating, controlstore.PromptDeliveryPreparing,
+			controlstore.PromptDeliveryPrepared, controlstore.PromptDeliveryPublishing,
+			controlstore.PromptDeliveryVerifying, controlstore.PromptDeliveryVerifiedExact,
+		}
+	case controlstore.PromptDeliveryCancelledBeforePublish:
+		deliveryPath = []controlstore.PromptDeliveryState{
+			controlstore.PromptDeliveryValidating, controlstore.PromptDeliveryPreparing,
+			controlstore.PromptDeliveryPrepared, controlstore.PromptDeliveryCancelledBeforePublish,
+		}
+	case controlstore.PromptDeliveryConflict:
+		deliveryPath = []controlstore.PromptDeliveryState{controlstore.PromptDeliveryValidating, controlstore.PromptDeliveryConflict}
+	default:
+		t.Fatalf("unsupported terminal delivery fixture state %q", deliveryState)
+	}
+	for i, next := range deliveryPath {
+		attempt, err = kubeStore.TransitionPromptAttemptDelivery(ctx, controlstore.PromptAttemptDeliveryTransition{
+			ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.DeliveryState,
+			NewState: next, OperationID: fmt.Sprintf("delivery-%s-%d", promptID, i),
+			OperationDigest: testDigest(fmt.Sprintf("delivery-%s-%s-%d", taskUID, promptID, i)),
+			UpdatedAt:       testNow.Add(time.Duration(len(executionPath)+i+1) * time.Minute),
+		})
+		if err != nil {
+			t.Fatalf("TransitionPromptAttemptDelivery(%s): %v", next, err)
+		}
+	}
+	return attempt
+}
+
+func enqueueTaskTerminalProjection(
+	t *testing.T,
+	ctx context.Context,
+	kubeStore *Store,
+	fence controlstore.ControllerEpochFence,
+	attempt *controlstore.PromptAttempt,
+	delivered bool,
+) string {
+	t.Helper()
+	task := &corev1alpha1.Task{}
+	taskKey := client.ObjectKey{Namespace: attempt.Key.Namespace, Name: attempt.Key.TaskUID}
+	if err := kubeStore.client.Get(ctx, taskKey, task); err != nil {
+		t.Fatalf("get terminal projection Task: %v", err)
+	}
+	executionState, executionOutcome, ok := terminalPromptAttemptExecutionForTest(attempt.ExecutionState)
+	if !ok {
+		t.Fatalf("unsupported terminal execution fixture state %q", attempt.ExecutionState)
+	}
+	phase := terminalPromptAttemptPhaseForTest(executionState, attempt.DeliveryState)
+	task.Status.Phase = phase
+	task.Status.Execution = &corev1alpha1.TaskExecutionStatus{
+		State: executionState, Outcome: executionOutcome, Attempt: int32(attempt.Key.Attempt),
+		PromptID: attempt.Key.PromptID, RequestDigest: attempt.RequestDigest, ControllerEpoch: attempt.ControllerEpoch,
+	}
+	task.Status.Delivery = &corev1alpha1.TaskDeliveryStatus{
+		State: corev1alpha1.TaskDeliveryState(attempt.DeliveryState), Outcome: corev1alpha1.TaskDeliveryOutcome(attempt.DeliveryState),
+	}
+	if err := kubeStore.client.Status().Update(ctx, task); err != nil {
+		t.Fatalf("record terminal projection Task status: %v", err)
+	}
+	payload, err := json.Marshal(taskterminal.Projection{
+		Namespace: attempt.Key.Namespace, Task: task.Name, TaskUID: attempt.Key.TaskUID,
+		Attempt: int32(attempt.Key.Attempt), Phase: phase, Execution: *task.Status.Execution.DeepCopy(),
+		Delivery: task.Status.Delivery.DeepCopy(),
+	})
+	if err != nil {
+		t.Fatalf("encode terminal projection payload: %v", err)
+	}
+	return enqueueRawTaskTerminalProjection(t, ctx, kubeStore, fence, attempt, payload, delivered)
+}
+
+func enqueueRawTaskTerminalProjection(
+	t *testing.T,
+	ctx context.Context,
+	kubeStore *Store,
+	fence controlstore.ControllerEpochFence,
+	attempt *controlstore.PromptAttempt,
+	payload []byte,
+	delivered bool,
+) string {
+	t.Helper()
+	projectionID := controlstore.CanonicalControlID(
+		"task-terminal-projection", attempt.Key.Namespace, attempt.Key.TaskUID, fmt.Sprint(attempt.Key.Attempt),
+	)
+	projection, err := kubeStore.EnqueueOutboxProjection(ctx, &controlstore.OutboxProjection{
+		ID: projectionID, AggregateKind: "Task", AggregateID: attempt.Key.TaskUID,
+		ProjectionKind: "TaskTerminalStatus", PayloadDigest: testBytesDigest(payload), Payload: payload,
+		AvailableAt: testNow, CreatedAt: testNow,
+	}, fence)
+	if err != nil {
+		t.Fatalf("EnqueueOutboxProjection: %v", err)
+	}
+	if !delivered {
+		return projectionID
+	}
+	claims, err := kubeStore.ClaimOutboxProjections(ctx, controlstore.ClaimOutboxProjectionsRequest{
+		Fence: fence, WorkerID: "reclaim-test", Limit: 1, LeaseDuration: time.Minute, Now: testNow.Add(time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("ClaimOutboxProjections: %v", err)
+	}
+	if len(claims) != 1 || claims[0].ID != projection.ID {
+		t.Fatalf("claimed projections = %#v, want %q", claims, projection.ID)
+	}
+	claimed := claims[0]
+	if _, err := kubeStore.CompleteOutboxProjection(ctx, controlstore.CompleteOutboxProjectionRequest{
+		ID: claimed.ID, Fence: fence, ExpectedVersion: claimed.Version, LeaseOwner: claimed.LeaseOwner,
+		OperationID: "deliver-" + attempt.Key.PromptID, OperationDigest: testDigest("deliver-" + attempt.Key.PromptID),
+		NewState: controlstore.OutboxProjectionDelivered, DeliveryDigest: testDigest("delivered-" + attempt.Key.PromptID),
+		UpdatedAt: testNow.Add(2 * time.Minute),
+	}); err != nil {
+		t.Fatalf("CompleteOutboxProjection(Delivered): %v", err)
+	}
+	return projectionID
+}
+
+func terminalPromptAttemptExecutionForTest(state controlstore.PromptExecutionState) (
+	corev1alpha1.TaskExecutionState,
+	corev1alpha1.TaskExecutionOutcome,
+	bool,
+) {
+	switch state {
+	case controlstore.PromptExecutionSucceeded:
+		return corev1alpha1.TaskExecutionStateSucceeded, corev1alpha1.TaskExecutionOutcomeSucceeded, true
+	case controlstore.PromptExecutionFailed:
+		return corev1alpha1.TaskExecutionStateFailed, corev1alpha1.TaskExecutionOutcomeFailed, true
+	case controlstore.PromptExecutionCancelled:
+		return corev1alpha1.TaskExecutionStateCancelled, corev1alpha1.TaskExecutionOutcomeCancelled, true
+	case controlstore.PromptExecutionOutcomeUnknown:
+		return corev1alpha1.TaskExecutionStateOutcomeUnknown, corev1alpha1.TaskExecutionOutcomeOutcomeUnknown, true
+	default:
+		return "", "", false
+	}
+}
+
+func terminalPromptAttemptPhaseForTest(
+	state corev1alpha1.TaskExecutionState,
+	delivery controlstore.PromptDeliveryState,
+) corev1alpha1.TaskPhase {
+	if state == corev1alpha1.TaskExecutionStateCancelled {
+		return corev1alpha1.TaskPhaseCancelled
+	}
+	if state == corev1alpha1.TaskExecutionStateSucceeded {
+		switch delivery {
+		case controlstore.PromptDeliveryNotRequested, controlstore.PromptDeliveryReadValidated,
+			controlstore.PromptDeliveryNoChange, controlstore.PromptDeliveryVerifiedExact,
+			controlstore.PromptDeliveryDeliveredSuperseded:
+			return corev1alpha1.TaskPhaseSucceeded
+		case controlstore.PromptDeliveryCancelledBeforePublish:
+			return corev1alpha1.TaskPhaseCancelled
+		}
+	}
+	return corev1alpha1.TaskPhaseFailed
+}
diff --git a/internal/store/kube/public_names.go b/internal/store/kube/public_names.go
new file mode 100644
index 000000000..b20a3905a
--- /dev/null
+++ b/internal/store/kube/public_names.go
@@ -0,0 +1,9 @@
+package kube
+
+// RuntimeSessionControlObjectName returns the deterministic Kubernetes object
+// name for the control record that owns a user-visible Session name. Read-only
+// API surfaces use this helper so they cannot drift from the control store's
+// identity mapping.
+func RuntimeSessionControlObjectName(sessionName string) string {
+	return runtimeSessionObjectName(sessionName)
+}
diff --git a/internal/store/kube/publication.go b/internal/store/kube/publication.go
new file mode 100644
index 000000000..5efdecb3d
--- /dev/null
+++ b/internal/store/kube/publication.go
@@ -0,0 +1,869 @@
+package kube
+
+import (
+	"context"
+	"errors"
+	"reflect"
+	"strings"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+// CreatePublication persists immutable publication intent and initializes the
+// Preparing state after validating the exact BranchClaim fence.
+func (s *Store) CreatePublication(ctx context.Context, publication *store.Publication, fence store.ControllerEpochFence) (*store.Publication, error) {
+	if err := s.requireClient(); err != nil {
+		return nil, err
+	}
+	normalized, normalizedFence, err := normalizePublicationForCreate(publication, fence)
+	if err != nil {
+		return nil, err
+	}
+	_, snapshot, err := s.requireControllerEpoch(ctx, normalizedFence)
+	if err != nil {
+		return nil, err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	if existing, getErr := s.findPublicationByID(ctx, normalized.ID); getErr == nil {
+		return s.completePublicationCreation(ctx, existing, normalized, normalizedFence, snapshot)
+	} else if !errors.Is(getErr, store.ErrNotFound) {
+		return nil, getErr
+	}
+
+	key := client.ObjectKey{Namespace: normalized.Namespace, Name: objectName(publicationNamePrefix, normalized.ID)}
+	claimObject, err := s.getBranchClaimObject(ctx, normalized.BranchClaimID)
+	if err != nil {
+		return nil, err
+	}
+	claim := branchClaimFromObject(claimObject)
+	if claim.RepositoryID != normalized.TargetRepositoryID || claim.Ref != normalized.TargetRef || claim.Generation != normalized.BranchClaimGeneration || !claim.LastVerified.Equal(normalized.Baseline) || claim.Availability != store.BranchClaimAvailable {
+		return nil, controlConflict("publication %q branch claim does not match exact target, generation, baseline, or availability", normalized.ID)
+	}
+
+	labels := controlLabels(normalized.ID)
+	labelIfValid(labels, corev1alpha1.ControlRecordTaskUIDLabel, normalized.TaskUID)
+	object := &corev1alpha1.Publication{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: normalized.Namespace,
+			Name:      key.Name,
+			Labels:    labels,
+		},
+		Spec: publicationSpecToAPI(normalized),
+	}
+	if err := s.client.Create(ctx, object); err != nil {
+		if apierrors.IsAlreadyExists(err) {
+			if getErr := s.readClient().Get(ctx, key, object); getErr != nil {
+				return nil, mapKubernetesError("get concurrently created publication", getErr)
+			}
+			return s.completePublicationCreation(ctx, object, normalized, normalizedFence, snapshot)
+		}
+		return nil, mapKubernetesError("create publication", err)
+	}
+	return s.completePublicationCreation(ctx, object, normalized, normalizedFence, snapshot)
+}
+
+// GetPublication returns a namespaced Publication by canonical ID.
+func (s *Store) GetPublication(ctx context.Context, id string) (*store.Publication, error) {
+	if err := s.requireClient(); err != nil {
+		return nil, err
+	}
+	id = strings.TrimSpace(id)
+	if err := store.ValidateControlIdentifier("publication ID", id); err != nil {
+		return nil, err
+	}
+	object, err := s.findPublicationByID(ctx, id)
+	if err != nil {
+		return nil, err
+	}
+	result := publicationFromObject(object)
+	return &result, nil
+}
+
+// SetPublicationPRIntent persists the exact forge tuple after preparation.
+func (s *Store) SetPublicationPRIntent(ctx context.Context, request store.SetPublicationPRIntentRequest) (*store.Publication, error) {
+	request.ID = strings.TrimSpace(request.ID)
+	if err := store.ValidateControlIdentifier("publication ID", request.ID); err != nil {
+		return nil, err
+	}
+	fence, snapshot, err := s.requireControllerEpoch(ctx, request.Fence)
+	if err != nil {
+		return nil, err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	request.Fence = fence
+	if request.ExpectedVersion < 1 || request.ExpectedGeneration < 1 || request.ExpectedState != store.PublicationPrepared && request.ExpectedState != store.PublicationVerifying {
+		return nil, store.ValidationErrorf("PR intent requires an exact Prepared or Verifying publication version/generation")
+	}
+	if err := validatePullRequestIntent(request.Intent, request.ExpectedGeneration); err != nil {
+		return nil, err
+	}
+	request.OperationID = strings.TrimSpace(request.OperationID)
+	if err := store.ValidateControlIdentifier("PR intent operation ID", request.OperationID); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateCanonicalDigest("PR intent operation digest", request.OperationDigest); err != nil {
+		return nil, err
+	}
+	request.UpdatedAt = normalizeControlTime(request.UpdatedAt)
+
+	object, err := s.findPublicationByID(ctx, request.ID)
+	if err != nil {
+		return nil, err
+	}
+	publication := publicationFromObject(object)
+	if publication.PreparedReceipt == nil {
+		return nil, store.ValidationErrorf("PR intent requires a durable prepared receipt")
+	}
+	if request.ExpectedState == store.PublicationPrepared && publication.PreparedReceipt.CommitSHA != request.Intent.ExpectedHeadSHA {
+		return nil, store.ValidationErrorf("Prepared PR intent expected head must equal the durable prepared commit")
+	}
+	if publication.LastOperationID == request.OperationID {
+		if publication.LastOperationDigest == request.OperationDigest && publication.PRIntent != nil && reflect.DeepEqual(*publication.PRIntent, request.Intent) {
+			return &publication, nil
+		}
+		return nil, controlConflict("PR intent operation %q was reused with different content", request.OperationID)
+	}
+	if publication.Version != request.ExpectedVersion || publication.Generation != request.ExpectedGeneration || publication.State != request.ExpectedState || publication.PRIntent != nil {
+		return nil, controlConflict("publication %q no longer matches PR intent version/generation/state", publication.ID)
+	}
+
+	updated := object.DeepCopy()
+	updated.Status.PRIntent = pullRequestIntentToAPI(&request.Intent)
+	setMutationStatus(&updated.Status.ControlRecordMutationStatus, fence, snapshot, publication.Version+1, request.OperationID, request.OperationDigest, publication.CreatedAt, request.UpdatedAt)
+	if err := s.client.Status().Update(ctx, updated); err != nil {
+		return nil, mapKubernetesError("set publication PR intent", err)
+	}
+	result := publicationFromObject(updated)
+	return &result, nil
+}
+
+// SetPublicationPRReceipt commits the reconciled forge result before the
+// Publication leaves Verifying.
+func (s *Store) SetPublicationPRReceipt(ctx context.Context, request store.SetPublicationPRReceiptRequest) (*store.Publication, error) {
+	request.ID = strings.TrimSpace(request.ID)
+	if err := store.ValidateControlIdentifier("publication ID", request.ID); err != nil {
+		return nil, err
+	}
+	fence, snapshot, err := s.requireControllerEpoch(ctx, request.Fence)
+	if err != nil {
+		return nil, err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	request.Fence = fence
+	if request.ExpectedVersion < 1 || request.ExpectedGeneration < 1 || request.ExpectedState != store.PublicationVerifying {
+		return nil, store.ValidationErrorf("PR receipt requires an exact Verifying publication version/generation")
+	}
+	request.OperationID = strings.TrimSpace(request.OperationID)
+	if err := store.ValidateControlIdentifier("PR receipt operation ID", request.OperationID); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateCanonicalDigest("PR receipt operation digest", request.OperationDigest); err != nil {
+		return nil, err
+	}
+	request.UpdatedAt = normalizeControlTime(request.UpdatedAt)
+	if err := validatePullRequestReceipt(request.Receipt); err != nil {
+		return nil, err
+	}
+
+	object, err := s.findPublicationByID(ctx, request.ID)
+	if err != nil {
+		return nil, err
+	}
+	publication := publicationFromObject(object)
+	if publication.PRIntent == nil || publication.PRIntent.ExpectedHeadSHA != request.Receipt.HeadSHA {
+		return nil, store.ValidationErrorf("PR receipt does not match the persisted intent head")
+	}
+	if publication.LastOperationID == request.OperationID {
+		if publication.LastOperationDigest == request.OperationDigest && publication.PullRequestReceipt != nil && reflect.DeepEqual(*publication.PullRequestReceipt, request.Receipt) {
+			return &publication, nil
+		}
+		return nil, controlConflict("PR receipt operation %q was reused with different content", request.OperationID)
+	}
+	if publication.Version != request.ExpectedVersion || publication.Generation != request.ExpectedGeneration || publication.State != request.ExpectedState || publication.PullRequestReceipt != nil {
+		return nil, controlConflict("publication %q no longer matches PR receipt version/generation/state", publication.ID)
+	}
+
+	updated := object.DeepCopy()
+	updated.Status.PullRequestReceipt = pullRequestReceiptToAPI(&request.Receipt)
+	setMutationStatus(&updated.Status.ControlRecordMutationStatus, fence, snapshot, publication.Version+1, request.OperationID, request.OperationDigest, publication.CreatedAt, request.UpdatedAt)
+	if err := s.client.Status().Update(ctx, updated); err != nil {
+		return nil, mapKubernetesError("set publication PR receipt", err)
+	}
+	result := publicationFromObject(updated)
+	return &result, nil
+}
+
+// TransitionPublication applies exact generation/version/state,
+// resourceVersion, receipt, and controller-epoch fences.
+func (s *Store) TransitionPublication(ctx context.Context, transition store.PublicationTransition) (*store.Publication, error) {
+	transition.ID = strings.TrimSpace(transition.ID)
+	if err := store.ValidateControlIdentifier("publication ID", transition.ID); err != nil {
+		return nil, err
+	}
+	fence, snapshot, err := s.requireControllerEpoch(ctx, transition.Fence)
+	if err != nil {
+		return nil, err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	transition.Fence = fence
+	if transition.ExpectedVersion < 1 || transition.ExpectedGeneration < 1 {
+		return nil, store.ValidationErrorf("publication expected version and generation must be at least 1")
+	}
+	if err := store.ValidatePublicationTransition(transition.ExpectedState, transition.NewState); err != nil {
+		return nil, err
+	}
+	transition.OperationID = strings.TrimSpace(transition.OperationID)
+	if err := store.ValidateControlIdentifier("publication operation ID", transition.OperationID); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateCanonicalDigest("publication operation digest", transition.OperationDigest); err != nil {
+		return nil, err
+	}
+	transition.TerminalReason = strings.TrimSpace(transition.TerminalReason)
+	if err := store.ValidateControlReason("publication terminal reason", transition.TerminalReason); err != nil {
+		return nil, err
+	}
+	transition.UpdatedAt = normalizeControlTime(transition.UpdatedAt)
+
+	object, err := s.findPublicationByID(ctx, transition.ID)
+	if err != nil {
+		return nil, err
+	}
+	publication := publicationFromObject(object)
+	if err := validatePublicationTransitionReceipts(publication, transition); err != nil {
+		return nil, err
+	}
+	if publication.LastOperationID == transition.OperationID {
+		if publication.LastOperationDigest != transition.OperationDigest {
+			return nil, controlConflict("publication operation %q was reused with a different digest", transition.OperationID)
+		}
+		if publication.State == transition.NewState && publicationTransitionReceiptsMatch(publication, transition) {
+			return &publication, nil
+		}
+		return nil, controlConflict("publication operation %q was already applied with different target state or receipt", transition.OperationID)
+	}
+	if publication.Version != transition.ExpectedVersion || publication.Generation != transition.ExpectedGeneration || publication.State != transition.ExpectedState {
+		return nil, controlConflict("publication %q is version %d generation %d state %s, expected version %d generation %d state %s", publication.ID, publication.Version, publication.Generation, publication.State, transition.ExpectedVersion, transition.ExpectedGeneration, transition.ExpectedState)
+	}
+
+	updated := object.DeepCopy()
+	updated.Status.State = corev1alpha1.PublicationControlState(transition.NewState)
+	if transition.PreparedReceipt != nil {
+		updated.Status.PreparedReceipt = preparedReceiptToAPI(transition.PreparedReceipt)
+	}
+	if transition.PublishReceipt != nil {
+		updated.Status.PublishReceipt = publishReceiptToAPI(transition.PublishReceipt)
+	}
+	if transition.VerificationReceipt != nil {
+		updated.Status.VerificationReceipt = verificationReceiptToAPI(transition.VerificationReceipt)
+	}
+	if transition.TerminalReason != "" || store.IsTerminalPublicationState(transition.NewState) {
+		updated.Status.TerminalReason = transition.TerminalReason
+	}
+	setMutationStatus(&updated.Status.ControlRecordMutationStatus, fence, snapshot, publication.Version+1, transition.OperationID, transition.OperationDigest, publication.CreatedAt, transition.UpdatedAt)
+	if err := s.client.Status().Update(ctx, updated); err != nil {
+		return nil, mapKubernetesError("transition publication", err)
+	}
+	result := publicationFromObject(updated)
+	return &result, nil
+}
+
+func (s *Store) completePublicationCreation(ctx context.Context, object *corev1alpha1.Publication, normalized store.Publication, fence store.ControllerEpochFence, snapshot epochSnapshot) (*store.Publication, error) {
+	if !samePublicationSpec(object, normalized) {
+		return nil, controlConflict("publication %q was reused with different immutable intent or request digest", normalized.ID)
+	}
+	if object.Status.Version > 0 {
+		existing := publicationFromObject(object)
+		if !samePublicationCreation(existing, normalized) {
+			return nil, controlConflict("publication %q was reused with different immutable intent or request digest", normalized.ID)
+		}
+		return &existing, nil
+	}
+	updated := object.DeepCopy()
+	updated.Status.State = corev1alpha1.PublicationControlState(normalized.State)
+	updated.Status.PRIntent = pullRequestIntentToAPI(normalized.PRIntent)
+	updated.Status.TerminalReason = normalized.TerminalReason
+	setMutationStatus(&updated.Status.ControlRecordMutationStatus, fence, snapshot, 1, "", "", normalized.CreatedAt, normalized.UpdatedAt)
+	if err := s.client.Status().Update(ctx, updated); err != nil {
+		if apierrors.IsConflict(err) {
+			fresh, getErr := s.findPublicationByID(ctx, normalized.ID)
+			if getErr == nil && samePublicationSpec(fresh, normalized) && fresh.Status.Version > 0 {
+				result := publicationFromObject(fresh)
+				if samePublicationCreation(result, normalized) {
+					return &result, nil
+				}
+			}
+		}
+		return nil, mapKubernetesError("initialize publication status", err)
+	}
+	result := publicationFromObject(updated)
+	return &result, nil
+}
+
+func (s *Store) findPublicationByID(ctx context.Context, id string) (*corev1alpha1.Publication, error) {
+	list := &corev1alpha1.PublicationList{}
+	if err := s.readClient().List(ctx, list, s.namespacedListOptions(
+		client.MatchingLabels{corev1alpha1.ControlRecordIDHashLabel: dnsDigest(id)},
+	)...); err != nil {
+		return nil, mapKubernetesError("list publications", err)
+	}
+	var match *corev1alpha1.Publication
+	for i := range list.Items {
+		if list.Items[i].Spec.ID != id {
+			continue
+		}
+		if match != nil {
+			return nil, controlConflict("multiple publications exist for canonical ID %q", id)
+		}
+		match = list.Items[i].DeepCopy()
+	}
+	if match == nil {
+		return nil, store.ErrNotFound
+	}
+	return match, nil
+}
+
+//nolint:gocyclo // Publication immutable-input validation is intentionally centralized.
+func normalizePublicationForCreate(publication *store.Publication, fence store.ControllerEpochFence) (store.Publication, store.ControllerEpochFence, error) {
+	if publication == nil {
+		return store.Publication{}, store.ControllerEpochFence{}, store.ValidationErrorf("publication is required")
+	}
+	normalized := *publication
+	normalized.ID = strings.TrimSpace(normalized.ID)
+	normalized.Namespace = strings.TrimSpace(normalized.Namespace)
+	normalized.TaskUID = strings.TrimSpace(normalized.TaskUID)
+	normalized.PromptID = strings.TrimSpace(normalized.PromptID)
+	normalized.SessionUID = strings.TrimSpace(normalized.SessionUID)
+	normalized.BranchClaimID = strings.TrimSpace(normalized.BranchClaimID)
+	normalized.SourceRepositoryID = strings.TrimSpace(normalized.SourceRepositoryID)
+	normalized.SourceRef = strings.TrimSpace(normalized.SourceRef)
+	normalized.TargetRepositoryID = strings.TrimSpace(normalized.TargetRepositoryID)
+	normalized.TargetRef = strings.TrimSpace(normalized.TargetRef)
+	normalized.PublicationCredentialRef = strings.TrimSpace(normalized.PublicationCredentialRef)
+	normalized.CommitIdentity = strings.TrimSpace(normalized.CommitIdentity)
+	for field, value := range map[string]string{
+		"publication ID":                   normalized.ID,
+		"publication namespace":            normalized.Namespace,
+		"publication task UID":             normalized.TaskUID,
+		"publication prompt ID":            normalized.PromptID,
+		"branch claim ID":                  normalized.BranchClaimID,
+		"source repository ID":             normalized.SourceRepositoryID,
+		"source ref":                       normalized.SourceRef,
+		"target repository ID":             normalized.TargetRepositoryID,
+		"publication credential reference": normalized.PublicationCredentialRef,
+		"commit identity":                  normalized.CommitIdentity,
+	} {
+		if err := store.ValidateControlIdentifier(field, value); err != nil {
+			return store.Publication{}, store.ControllerEpochFence{}, err
+		}
+	}
+	if normalized.SessionUID != "" {
+		if err := store.ValidateControlIdentifier("publication session UID", normalized.SessionUID); err != nil {
+			return store.Publication{}, store.ControllerEpochFence{}, err
+		}
+	}
+	if normalized.Generation < 1 || normalized.BranchClaimGeneration < 1 || normalized.Attempt < 1 {
+		return store.Publication{}, store.ControllerEpochFence{}, store.ValidationErrorf("publication generation, branch claim generation, and attempt must be at least 1")
+	}
+	if err := store.ValidateFullBranchRef(normalized.TargetRef); err != nil {
+		return store.Publication{}, store.ControllerEpochFence{}, err
+	}
+	if err := normalized.Baseline.Validate("publication baseline"); err != nil {
+		return store.Publication{}, store.ControllerEpochFence{}, err
+	}
+	if err := store.ValidateCanonicalDigest("publication artifact digest", normalized.ArtifactDigest); err != nil {
+		return store.Publication{}, store.ControllerEpochFence{}, err
+	}
+	normalized.SourceBaselineSHA = strings.TrimSpace(normalized.SourceBaselineSHA)
+	if err := store.ValidateGitObjectID("publication source baseline SHA", normalized.SourceBaselineSHA); err != nil {
+		return store.Publication{}, store.ControllerEpochFence{}, err
+	}
+	normalized.ArtifactID = strings.TrimSpace(normalized.ArtifactID)
+	normalized.ArtifactMediaType = strings.TrimSpace(normalized.ArtifactMediaType)
+	if err := store.ValidateControlIdentifier("publication artifact ID", normalized.ArtifactID); err != nil {
+		return store.Publication{}, store.ControllerEpochFence{}, err
+	}
+	if normalized.ArtifactSizeBytes < 1 {
+		return store.Publication{}, store.ControllerEpochFence{}, store.ValidationErrorf("publication artifact size must be positive")
+	}
+	if normalized.ArtifactMediaType == "" {
+		return store.Publication{}, store.ControllerEpochFence{}, store.ValidationErrorf("publication artifact media type is required")
+	}
+	if err := store.ValidateCanonicalDigest("publication request digest", normalized.RequestDigest); err != nil {
+		return store.Publication{}, store.ControllerEpochFence{}, err
+	}
+	if strings.TrimSpace(normalized.CommitMessage) == "" {
+		return store.Publication{}, store.ControllerEpochFence{}, store.ValidationErrorf("publication commit message is required")
+	}
+	if err := store.ValidateControlReason("publication commit message", normalized.CommitMessage); err != nil {
+		return store.Publication{}, store.ControllerEpochFence{}, err
+	}
+	if normalized.CommitTimestamp.IsZero() {
+		return store.Publication{}, store.ControllerEpochFence{}, store.ValidationErrorf("publication commit timestamp is required")
+	}
+	normalized.CommitTimestamp = normalized.CommitTimestamp.UTC()
+	if normalized.PRIntent != nil {
+		copyIntent := *normalized.PRIntent
+		normalizePullRequestIntent(&copyIntent)
+		normalized.PRIntent = &copyIntent
+		if err := validatePullRequestIntent(copyIntent, normalized.Generation); err != nil {
+			return store.Publication{}, store.ControllerEpochFence{}, err
+		}
+	}
+	if normalized.State == "" {
+		normalized.State = store.PublicationPreparing
+	}
+	if normalized.State != store.PublicationPreparing {
+		return store.Publication{}, store.ControllerEpochFence{}, store.ValidationErrorf("new publication must start in %s", store.PublicationPreparing)
+	}
+	if normalized.PreparedReceipt != nil || normalized.PublishReceipt != nil || normalized.VerificationReceipt != nil || normalized.PullRequestReceipt != nil {
+		return store.Publication{}, store.ControllerEpochFence{}, store.ValidationErrorf("new publication must not include operation receipts")
+	}
+	normalizedFence, err := normalizeEpochFence(fence)
+	if err != nil {
+		return store.Publication{}, store.ControllerEpochFence{}, err
+	}
+	if normalized.Version != 0 && normalized.Version != 1 {
+		return store.Publication{}, store.ControllerEpochFence{}, store.ValidationErrorf("new publication version must be zero or one")
+	}
+	now := normalizeControlTime(normalized.CreatedAt)
+	normalized.CreatedAt = now
+	if normalized.UpdatedAt.IsZero() {
+		normalized.UpdatedAt = now
+	} else {
+		normalized.UpdatedAt = normalized.UpdatedAt.UTC()
+	}
+	normalized.ControllerEpochName = normalizedFence.Name
+	normalized.ControllerEpoch = normalizedFence.Epoch
+	normalized.Version = 1
+	normalized.LastOperationID = ""
+	normalized.LastOperationDigest = ""
+	normalized.TerminalReason = ""
+	return normalized, normalizedFence, nil
+}
+
+func normalizePullRequestIntent(intent *store.PullRequestIntent) {
+	intent.BaseRepositoryID = strings.TrimSpace(intent.BaseRepositoryID)
+	intent.BaseRef = strings.TrimSpace(intent.BaseRef)
+	intent.HeadRepositoryID = strings.TrimSpace(intent.HeadRepositoryID)
+	intent.HeadRef = strings.TrimSpace(intent.HeadRef)
+	intent.ExpectedHeadSHA = strings.TrimSpace(intent.ExpectedHeadSHA)
+}
+
+func validatePullRequestIntent(intent store.PullRequestIntent, generation int64) error {
+	for field, value := range map[string]string{
+		"PR base repository ID": intent.BaseRepositoryID,
+		"PR head repository ID": intent.HeadRepositoryID,
+	} {
+		if err := store.ValidateControlIdentifier(field, value); err != nil {
+			return err
+		}
+	}
+	if err := store.ValidateFullBranchRef(intent.BaseRef); err != nil {
+		return err
+	}
+	if err := store.ValidateFullBranchRef(intent.HeadRef); err != nil {
+		return err
+	}
+	if intent.PublicationGeneration != generation {
+		return store.ValidationErrorf("PR intent publication generation %d does not match publication generation %d", intent.PublicationGeneration, generation)
+	}
+	return store.ValidateGitObjectID("PR expected head SHA", intent.ExpectedHeadSHA)
+}
+
+func validatePullRequestReceipt(receipt store.PullRequestOperationReceipt) error {
+	for field, value := range map[string]string{
+		"PR receipt operation ID": receipt.OperationID,
+		"PR receipt intent key":   receipt.IntentKey,
+		"PR receipt forge ID":     receipt.ForgeID,
+		"PR receipt URL":          receipt.URL,
+		"PR receipt state":        receipt.State,
+	} {
+		if err := store.ValidateControlIdentifier(field, strings.TrimSpace(value)); err != nil {
+			return err
+		}
+	}
+	if err := store.ValidateCanonicalDigest("PR receipt request digest", receipt.RequestDigest); err != nil {
+		return err
+	}
+	if err := store.ValidateGitObjectID("PR receipt head SHA", receipt.HeadSHA); err != nil {
+		return err
+	}
+	if receipt.ReconciledAt.IsZero() {
+		return store.ValidationErrorf("PR receipt reconciliation timestamp is required")
+	}
+	return nil
+}
+
+//nolint:gocyclo // Destination states have distinct exact-receipt invariants.
+func validatePublicationTransitionReceipts(publication store.Publication, transition store.PublicationTransition) error {
+	var receiptErr error
+	switch transition.NewState {
+	case store.PublicationPrepared:
+		if transition.PreparedReceipt == nil || transition.PublishReceipt != nil || transition.VerificationReceipt != nil {
+			return store.ValidationErrorf("Prepared transition requires only a prepared receipt")
+		}
+		receiptErr = validatePreparedReceipt(*transition.PreparedReceipt)
+	case store.PublicationPublishing, store.PublicationCancelledBeforePublish:
+		if transition.PreparedReceipt != nil || transition.PublishReceipt != nil || transition.VerificationReceipt != nil {
+			return store.ValidationErrorf("%s transition must not replace receipts", transition.NewState)
+		}
+	case store.PublicationVerifying:
+		if transition.PublishReceipt == nil || transition.PreparedReceipt != nil || transition.VerificationReceipt != nil {
+			return store.ValidationErrorf("Verifying transition requires only a publish receipt")
+		}
+		receiptErr = validatePublishReceipt(publication, transition, *transition.PublishReceipt)
+	case store.PublicationOutcomeUnknown:
+		if (transition.ExpectedState == store.PublicationPreparing || transition.ExpectedState == store.PublicationPublishing) &&
+			transition.VerificationReceipt == nil && transition.PreparedReceipt == nil && transition.PublishReceipt == nil {
+			break
+		}
+		fallthrough
+	case store.PublicationVerifiedExact, store.PublicationDeliveredSuperseded:
+		if transition.VerificationReceipt == nil || transition.PreparedReceipt != nil || transition.PublishReceipt != nil {
+			return store.ValidationErrorf("%s transition requires only a verification receipt", transition.NewState)
+		}
+		receiptErr = validateVerificationReceipt(publication, transition, *transition.VerificationReceipt)
+	case store.PublicationDeliveryConflict:
+		if transition.ExpectedState == store.PublicationVerifying {
+			if transition.VerificationReceipt == nil || transition.PreparedReceipt != nil || transition.PublishReceipt != nil {
+				return store.ValidationErrorf("verified DeliveryConflict transition requires only a verification receipt")
+			}
+			receiptErr = validateVerificationReceipt(publication, transition, *transition.VerificationReceipt)
+		} else if transition.PreparedReceipt != nil || transition.PublishReceipt != nil || transition.VerificationReceipt != nil {
+			return store.ValidationErrorf("preparation DeliveryConflict transition must not include receipts")
+		}
+	default:
+		if transition.PreparedReceipt != nil || transition.PublishReceipt != nil || transition.VerificationReceipt != nil {
+			return store.ValidationErrorf("%s transition must not include receipts", transition.NewState)
+		}
+	}
+	if receiptErr != nil {
+		return receiptErr
+	}
+	switch transition.NewState {
+	case store.PublicationDeliveryConflict, store.PublicationCredentialBlocked, store.PublicationPreparationFailed, store.PublicationOutcomeUnknown:
+		if strings.TrimSpace(transition.TerminalReason) == "" {
+			return store.ValidationErrorf("terminal publication state %s requires a reason", transition.NewState)
+		}
+	}
+	return nil
+}
+
+func validatePreparedReceipt(receipt store.PreparedPublicationReceipt) error {
+	if err := store.ValidateControlIdentifier("prepared operation ID", receipt.OperationID); err != nil {
+		return err
+	}
+	if err := store.ValidateCanonicalDigest("prepared request digest", receipt.RequestDigest); err != nil {
+		return err
+	}
+	if err := store.ValidateGitObjectID("prepared tree SHA", receipt.TreeSHA); err != nil {
+		return err
+	}
+	if err := store.ValidateGitObjectID("prepared commit SHA", receipt.CommitSHA); err != nil {
+		return err
+	}
+	if err := store.ValidateCanonicalDigest("prepared manifest digest", receipt.ManifestDigest); err != nil {
+		return err
+	}
+	if err := store.ValidateWorkspaceRelativeRoot(receipt.RelativeRoot); err != nil {
+		return err
+	}
+	if err := store.ValidateControlIdentifier("prepared bundle artifact ID", receipt.BundleArtifactID); err != nil {
+		return err
+	}
+	if err := store.ValidateCanonicalDigest("prepared bundle digest", receipt.BundleDigest); err != nil {
+		return err
+	}
+	if receipt.BundleSizeBytes < 1 || receipt.BundleMediaType != store.PreparedBundleMediaType ||
+		!strings.HasPrefix(receipt.BundleRef, "refs/orka/publications/") || len(strings.TrimPrefix(receipt.BundleRef, "refs/orka/publications/")) != 64 {
+		return store.ValidationErrorf("prepared bundle artifact metadata is invalid")
+	}
+	if receipt.PreparedAt.IsZero() {
+		return store.ValidationErrorf("prepared receipt timestamp is required")
+	}
+	return nil
+}
+
+func validatePublishReceipt(publication store.Publication, transition store.PublicationTransition, receipt store.PublishOperationReceipt) error {
+	if publication.PreparedReceipt == nil {
+		return store.ValidationErrorf("publication must have a durable prepared receipt before publishing")
+	}
+	if receipt.OperationID != transition.OperationID || receipt.RequestDigest != transition.OperationDigest {
+		return store.ValidationErrorf("publish receipt operation identity and digest must match transition")
+	}
+	if receipt.TargetRepositoryID != publication.TargetRepositoryID || receipt.TargetRef != publication.TargetRef || !receipt.RemoteBefore.Equal(publication.Baseline) || receipt.ExpectedCommitSHA != publication.PreparedReceipt.CommitSHA {
+		return store.ValidationErrorf("publish receipt does not exactly match persisted publication target, baseline, or commit")
+	}
+	if err := receipt.RemoteBefore.Validate("publish remote-before"); err != nil {
+		return err
+	}
+	if err := store.ValidateGitObjectID("publish expected commit SHA", receipt.ExpectedCommitSHA); err != nil {
+		return err
+	}
+	if receipt.PublishedAt.IsZero() {
+		return store.ValidationErrorf("publish receipt timestamp is required")
+	}
+	return nil
+}
+
+func validateVerificationReceipt(publication store.Publication, transition store.PublicationTransition, receipt store.PublicationVerificationReceipt) error {
+	if publication.PreparedReceipt == nil || publication.PublishReceipt == nil {
+		return store.ValidationErrorf("publication must have prepare and publish receipts before verification")
+	}
+	if receipt.OperationID != transition.OperationID || receipt.RequestDigest != transition.OperationDigest || receipt.Outcome != transition.NewState {
+		return store.ValidationErrorf("verification receipt operation identity, digest, and outcome must match transition")
+	}
+	if receipt.ExpectedCommitSHA != publication.PreparedReceipt.CommitSHA {
+		return store.ValidationErrorf("verification expected commit does not match prepared commit")
+	}
+	if receipt.VerifiedAt.IsZero() {
+		return store.ValidationErrorf("verification receipt timestamp is required")
+	}
+	switch receipt.Outcome {
+	case store.PublicationVerifiedExact:
+		if err := receipt.ObservedRemote.Validate("verified remote"); err != nil {
+			return err
+		}
+		if receipt.ObservedRemote.Absent || receipt.ObservedRemote.SHA != receipt.ExpectedCommitSHA {
+			return store.ValidationErrorf("VerifiedExact requires observed remote to equal expected commit")
+		}
+		if receipt.DescendantProofDigest != "" {
+			return store.ValidationErrorf("VerifiedExact must not include a descendant proof")
+		}
+	case store.PublicationDeliveredSuperseded:
+		if err := receipt.ObservedRemote.Validate("superseding remote"); err != nil {
+			return err
+		}
+		if receipt.ObservedRemote.Absent || receipt.ObservedRemote.SHA == receipt.ExpectedCommitSHA {
+			return store.ValidationErrorf("DeliveredSuperseded requires a different observed descendant SHA")
+		}
+		if err := store.ValidateCanonicalDigest("descendant proof digest", receipt.DescendantProofDigest); err != nil {
+			return err
+		}
+	case store.PublicationDeliveryConflict:
+		if err := receipt.ObservedRemote.Validate("conflicting remote"); err != nil {
+			return err
+		}
+	case store.PublicationOutcomeUnknown:
+		if receipt.ObservedRemote.Absent || receipt.ObservedRemote.SHA != "" || receipt.DescendantProofDigest != "" {
+			return store.ValidationErrorf("PublicationOutcomeUnknown must not invent a remote observation or descendant proof")
+		}
+	default:
+		return store.ValidationErrorf("unsupported verification outcome %q", receipt.Outcome)
+	}
+	return nil
+}
+
+func publicationTransitionReceiptsMatch(publication store.Publication, transition store.PublicationTransition) bool {
+	if transition.PreparedReceipt != nil && !equalPreparedReceipt(publication.PreparedReceipt, transition.PreparedReceipt) {
+		return false
+	}
+	if transition.PublishReceipt != nil && !equalPublishReceipt(publication.PublishReceipt, transition.PublishReceipt) {
+		return false
+	}
+	if transition.VerificationReceipt != nil && !equalVerificationReceipt(publication.VerificationReceipt, transition.VerificationReceipt) {
+		return false
+	}
+	return true
+}
+
+func equalPreparedReceipt(a, b *store.PreparedPublicationReceipt) bool {
+	if a == nil || b == nil {
+		return a == nil && b == nil
+	}
+	return a.OperationID == b.OperationID && a.RequestDigest == b.RequestDigest &&
+		a.TreeSHA == b.TreeSHA && a.CommitSHA == b.CommitSHA && a.ManifestDigest == b.ManifestDigest && a.RelativeRoot == b.RelativeRoot &&
+		a.BundleArtifactID == b.BundleArtifactID && a.BundleDigest == b.BundleDigest && a.BundleSizeBytes == b.BundleSizeBytes &&
+		a.BundleMediaType == b.BundleMediaType && a.BundleRef == b.BundleRef && a.PreparedAt.Equal(b.PreparedAt)
+}
+
+func equalPublishReceipt(a, b *store.PublishOperationReceipt) bool {
+	if a == nil || b == nil {
+		return a == nil && b == nil
+	}
+	return a.OperationID == b.OperationID && a.RequestDigest == b.RequestDigest && a.TargetRepositoryID == b.TargetRepositoryID && a.TargetRef == b.TargetRef && a.RemoteBefore.Equal(b.RemoteBefore) && a.ExpectedCommitSHA == b.ExpectedCommitSHA && a.AcknowledgementUnknown == b.AcknowledgementUnknown && a.PublishedAt.Equal(b.PublishedAt)
+}
+
+func equalVerificationReceipt(a, b *store.PublicationVerificationReceipt) bool {
+	if a == nil || b == nil {
+		return a == nil && b == nil
+	}
+	return a.OperationID == b.OperationID && a.RequestDigest == b.RequestDigest && a.Outcome == b.Outcome && a.ExpectedCommitSHA == b.ExpectedCommitSHA && a.ObservedRemote.Equal(b.ObservedRemote) && a.DescendantProofDigest == b.DescendantProofDigest && a.VerifiedAt.Equal(b.VerifiedAt)
+}
+
+func samePublicationCreation(a, b store.Publication) bool {
+	prIntentMatches := b.PRIntent == nil || reflect.DeepEqual(a.PRIntent, b.PRIntent)
+	return a.ID == b.ID && a.Namespace == b.Namespace && a.Generation == b.Generation && a.TaskUID == b.TaskUID && a.Attempt == b.Attempt && a.PromptID == b.PromptID && a.SessionUID == b.SessionUID && a.BranchClaimID == b.BranchClaimID && a.BranchClaimGeneration == b.BranchClaimGeneration && a.SourceRepositoryID == b.SourceRepositoryID && a.SourceRef == b.SourceRef && a.SourceBaselineSHA == b.SourceBaselineSHA && a.TargetRepositoryID == b.TargetRepositoryID && a.TargetRef == b.TargetRef && a.Baseline.Equal(b.Baseline) && a.ArtifactID == b.ArtifactID && a.ArtifactDigest == b.ArtifactDigest && a.ArtifactSizeBytes == b.ArtifactSizeBytes && a.ArtifactMediaType == b.ArtifactMediaType && a.PublicationCredentialRef == b.PublicationCredentialRef && a.CommitIdentity == b.CommitIdentity && a.CommitMessage == b.CommitMessage && a.CommitTimestamp.Equal(b.CommitTimestamp) && prIntentMatches && a.RequestDigest == b.RequestDigest
+}
+
+func samePublicationSpec(object *corev1alpha1.Publication, value store.Publication) bool {
+	if object == nil || object.Namespace != value.Namespace {
+		return false
+	}
+	actual := object.Spec
+	expected := publicationSpecToAPI(value)
+	if !actual.CommitTimestamp.Time.Equal(expected.CommitTimestamp.Time) {
+		return false
+	}
+	actual.CommitTimestamp = metav1.Time{}
+	expected.CommitTimestamp = metav1.Time{}
+	return reflect.DeepEqual(actual, expected)
+}
+
+func publicationSpecToAPI(value store.Publication) corev1alpha1.PublicationSpec {
+	return corev1alpha1.PublicationSpec{
+		ID:                       value.ID,
+		Generation:               value.Generation,
+		TaskUID:                  value.TaskUID,
+		Attempt:                  value.Attempt,
+		PromptID:                 value.PromptID,
+		SessionUID:               value.SessionUID,
+		BranchClaimID:            value.BranchClaimID,
+		BranchClaimGeneration:    value.BranchClaimGeneration,
+		SourceRepositoryID:       value.SourceRepositoryID,
+		SourceRef:                value.SourceRef,
+		SourceBaselineSHA:        value.SourceBaselineSHA,
+		TargetRepositoryID:       value.TargetRepositoryID,
+		TargetRef:                value.TargetRef,
+		Baseline:                 remoteRefToAPI(value.Baseline),
+		ArtifactID:               value.ArtifactID,
+		ArtifactDigest:           value.ArtifactDigest,
+		ArtifactSizeBytes:        value.ArtifactSizeBytes,
+		ArtifactMediaType:        value.ArtifactMediaType,
+		PublicationCredentialRef: value.PublicationCredentialRef,
+		CommitIdentity:           value.CommitIdentity,
+		CommitMessage:            value.CommitMessage,
+		CommitTimestamp:          metav1.NewTime(value.CommitTimestamp),
+		RequestDigest:            value.RequestDigest,
+	}
+}
+
+func publicationFromObject(object *corev1alpha1.Publication) store.Publication {
+	return store.Publication{
+		ID:                       object.Spec.ID,
+		Namespace:                object.Namespace,
+		Generation:               object.Spec.Generation,
+		TaskUID:                  object.Spec.TaskUID,
+		Attempt:                  object.Spec.Attempt,
+		PromptID:                 object.Spec.PromptID,
+		SessionUID:               object.Spec.SessionUID,
+		BranchClaimID:            object.Spec.BranchClaimID,
+		BranchClaimGeneration:    object.Spec.BranchClaimGeneration,
+		SourceRepositoryID:       object.Spec.SourceRepositoryID,
+		SourceRef:                object.Spec.SourceRef,
+		SourceBaselineSHA:        object.Spec.SourceBaselineSHA,
+		TargetRepositoryID:       object.Spec.TargetRepositoryID,
+		TargetRef:                object.Spec.TargetRef,
+		Baseline:                 remoteRefFromAPI(object.Spec.Baseline),
+		ArtifactID:               object.Spec.ArtifactID,
+		ArtifactDigest:           object.Spec.ArtifactDigest,
+		ArtifactSizeBytes:        object.Spec.ArtifactSizeBytes,
+		ArtifactMediaType:        object.Spec.ArtifactMediaType,
+		PublicationCredentialRef: object.Spec.PublicationCredentialRef,
+		CommitIdentity:           object.Spec.CommitIdentity,
+		CommitMessage:            object.Spec.CommitMessage,
+		CommitTimestamp:          object.Spec.CommitTimestamp.UTC(),
+		PRIntent:                 pullRequestIntentFromAPI(object.Status.PRIntent),
+		RequestDigest:            object.Spec.RequestDigest,
+		State:                    store.PublicationState(object.Status.State),
+		PreparedReceipt:          preparedReceiptFromAPI(object.Status.PreparedReceipt),
+		PublishReceipt:           publishReceiptFromAPI(object.Status.PublishReceipt),
+		VerificationReceipt:      verificationReceiptFromAPI(object.Status.VerificationReceipt),
+		PullRequestReceipt:       pullRequestReceiptFromAPI(object.Status.PullRequestReceipt),
+		TerminalReason:           object.Status.TerminalReason,
+		ControllerEpochName:      object.Status.ControllerEpochName,
+		ControllerEpoch:          object.Status.ControllerEpoch,
+		LastOperationID:          object.Status.LastOperationID,
+		LastOperationDigest:      object.Status.LastOperationDigest,
+		Version:                  object.Status.Version,
+		CreatedAt:                timeValue(object.Status.CreatedAt),
+		UpdatedAt:                timeValue(object.Status.UpdatedAt),
+	}
+}
+
+func pullRequestIntentToAPI(value *store.PullRequestIntent) *corev1alpha1.PublicationPullRequestIntent {
+	if value == nil {
+		return nil
+	}
+	return &corev1alpha1.PublicationPullRequestIntent{BaseRepositoryID: value.BaseRepositoryID, BaseRef: value.BaseRef, HeadRepositoryID: value.HeadRepositoryID, HeadRef: value.HeadRef, PublicationGeneration: value.PublicationGeneration, ExpectedHeadSHA: value.ExpectedHeadSHA}
+}
+
+func pullRequestIntentFromAPI(value *corev1alpha1.PublicationPullRequestIntent) *store.PullRequestIntent {
+	if value == nil {
+		return nil
+	}
+	return &store.PullRequestIntent{BaseRepositoryID: value.BaseRepositoryID, BaseRef: value.BaseRef, HeadRepositoryID: value.HeadRepositoryID, HeadRef: value.HeadRef, PublicationGeneration: value.PublicationGeneration, ExpectedHeadSHA: value.ExpectedHeadSHA}
+}
+
+func preparedReceiptToAPI(value *store.PreparedPublicationReceipt) *corev1alpha1.PreparedPublicationControlReceipt {
+	if value == nil {
+		return nil
+	}
+	return &corev1alpha1.PreparedPublicationControlReceipt{
+		OperationID: value.OperationID, RequestDigest: value.RequestDigest,
+		TreeSHA: value.TreeSHA, CommitSHA: value.CommitSHA, ManifestDigest: value.ManifestDigest, RelativeRoot: value.RelativeRoot,
+		BundleArtifactID: value.BundleArtifactID, BundleDigest: value.BundleDigest,
+		BundleSizeBytes: value.BundleSizeBytes, BundleMediaType: value.BundleMediaType, BundleRef: value.BundleRef,
+		PreparedAt: metav1.NewTime(value.PreparedAt),
+	}
+}
+
+func preparedReceiptFromAPI(value *corev1alpha1.PreparedPublicationControlReceipt) *store.PreparedPublicationReceipt {
+	if value == nil {
+		return nil
+	}
+	return &store.PreparedPublicationReceipt{
+		OperationID: value.OperationID, RequestDigest: value.RequestDigest,
+		TreeSHA: value.TreeSHA, CommitSHA: value.CommitSHA, ManifestDigest: value.ManifestDigest, RelativeRoot: value.RelativeRoot,
+		BundleArtifactID: value.BundleArtifactID, BundleDigest: value.BundleDigest,
+		BundleSizeBytes: value.BundleSizeBytes, BundleMediaType: value.BundleMediaType, BundleRef: value.BundleRef,
+		PreparedAt: value.PreparedAt.UTC(),
+	}
+}
+
+func publishReceiptToAPI(value *store.PublishOperationReceipt) *corev1alpha1.PublishOperationControlReceipt {
+	if value == nil {
+		return nil
+	}
+	return &corev1alpha1.PublishOperationControlReceipt{OperationID: value.OperationID, RequestDigest: value.RequestDigest, TargetRepositoryID: value.TargetRepositoryID, TargetRef: value.TargetRef, RemoteBefore: remoteRefToAPI(value.RemoteBefore), ExpectedCommitSHA: value.ExpectedCommitSHA, AcknowledgementUnknown: value.AcknowledgementUnknown, PublishedAt: metav1.NewTime(value.PublishedAt)}
+}
+
+func publishReceiptFromAPI(value *corev1alpha1.PublishOperationControlReceipt) *store.PublishOperationReceipt {
+	if value == nil {
+		return nil
+	}
+	return &store.PublishOperationReceipt{OperationID: value.OperationID, RequestDigest: value.RequestDigest, TargetRepositoryID: value.TargetRepositoryID, TargetRef: value.TargetRef, RemoteBefore: remoteRefFromAPI(value.RemoteBefore), ExpectedCommitSHA: value.ExpectedCommitSHA, AcknowledgementUnknown: value.AcknowledgementUnknown, PublishedAt: value.PublishedAt.UTC()}
+}
+
+func verificationReceiptToAPI(value *store.PublicationVerificationReceipt) *corev1alpha1.PublicationVerificationControlReceipt {
+	if value == nil {
+		return nil
+	}
+	return &corev1alpha1.PublicationVerificationControlReceipt{OperationID: value.OperationID, RequestDigest: value.RequestDigest, Outcome: corev1alpha1.PublicationControlState(value.Outcome), ExpectedCommitSHA: value.ExpectedCommitSHA, ObservedRemote: remoteRefToAPI(value.ObservedRemote), DescendantProofDigest: value.DescendantProofDigest, VerifiedAt: metav1.NewTime(value.VerifiedAt)}
+}
+
+func verificationReceiptFromAPI(value *corev1alpha1.PublicationVerificationControlReceipt) *store.PublicationVerificationReceipt {
+	if value == nil {
+		return nil
+	}
+	return &store.PublicationVerificationReceipt{OperationID: value.OperationID, RequestDigest: value.RequestDigest, Outcome: store.PublicationState(value.Outcome), ExpectedCommitSHA: value.ExpectedCommitSHA, ObservedRemote: remoteRefFromAPI(value.ObservedRemote), DescendantProofDigest: value.DescendantProofDigest, VerifiedAt: value.VerifiedAt.UTC()}
+}
+
+func pullRequestReceiptToAPI(value *store.PullRequestOperationReceipt) *corev1alpha1.PullRequestOperationControlReceipt {
+	if value == nil {
+		return nil
+	}
+	return &corev1alpha1.PullRequestOperationControlReceipt{OperationID: value.OperationID, RequestDigest: value.RequestDigest, IntentKey: value.IntentKey, ForgeID: value.ForgeID, URL: value.URL, State: value.State, HeadSHA: value.HeadSHA, ReconciledAt: metav1.NewTime(value.ReconciledAt)}
+}
+
+func pullRequestReceiptFromAPI(value *corev1alpha1.PullRequestOperationControlReceipt) *store.PullRequestOperationReceipt {
+	if value == nil {
+		return nil
+	}
+	return &store.PullRequestOperationReceipt{OperationID: value.OperationID, RequestDigest: value.RequestDigest, IntentKey: value.IntentKey, ForgeID: value.ForgeID, URL: value.URL, State: value.State, HeadSHA: value.HeadSHA, ReconciledAt: value.ReconciledAt.UTC()}
+}
diff --git a/internal/store/kube/session_cleanup.go b/internal/store/kube/session_cleanup.go
new file mode 100644
index 000000000..806b458f8
--- /dev/null
+++ b/internal/store/kube/session_cleanup.go
@@ -0,0 +1,491 @@
+package kube
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"reflect"
+	"sort"
+	"strings"
+	"time"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+	coordinationv1 "k8s.io/api/coordination/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+// ErrSessionCleanupStoreNotConfigured is returned when a standalone
+// Kubernetes store has no SQLite cleanup persistence adapter.
+var ErrSessionCleanupStoreNotConfigured = errors.New("session cleanup persistence is not configured")
+
+// ReclaimSession coordinates the hard-cutover Session deletion protocol under
+// one controller-epoch mutation lock. The SQLite intent is durable before any
+// Kubernetes object is deleted; transcript state is deleted only after every
+// exact authoritative object has been reclaimed.
+func (s *Store) ReclaimSession(ctx context.Context, request store.ReclaimSessionRequest) error {
+	if err := s.requireClient(); err != nil {
+		return err
+	}
+	if s.sessionCleanup == nil {
+		return ErrSessionCleanupStoreNotConfigured
+	}
+	if err := normalizeReclaimSessionRequest(&request); err != nil {
+		return err
+	}
+	fence, snapshot, err := s.requireControllerEpoch(ctx, request.Fence)
+	if err != nil {
+		return err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	request.Fence = fence
+
+	intent, err := s.sessionCleanup.GetSessionCleanupIntent(ctx, request.Namespace, request.SessionName)
+	if errors.Is(err, store.ErrNotFound) {
+		completion, completionErr := s.sessionCleanup.GetSessionCleanupCompletion(ctx, request.Namespace, request.SessionName)
+		if completionErr == nil {
+			if completion.OperationID != request.OperationID || completion.OperationDigest != request.OperationDigest {
+				return controlConflict("session cleanup for %s/%s completed under a different operation", request.Namespace, request.SessionName)
+			}
+			return s.ensureCompletedSessionKubernetesStateAbsent(ctx, *completion)
+		}
+		if !errors.Is(completionErr, store.ErrNotFound) {
+			return completionErr
+		}
+		intent, err = s.prepareSessionCleanupIntent(ctx, request)
+	}
+	if err != nil {
+		return err
+	}
+	if intent.OperationID != request.OperationID || intent.OperationDigest != request.OperationDigest {
+		return controlConflict("session cleanup for %s/%s belongs to a different operation", request.Namespace, request.SessionName)
+	}
+	if err := s.validateSessionCleanupBranchClaimScope(*intent); err != nil {
+		return err
+	}
+	if err := s.reclaimSessionBranchClaims(ctx, *intent); err != nil {
+		return err
+	}
+	if err := s.ensureNoSessionBranchClaims(ctx, intent.SessionUID); err != nil {
+		return err
+	}
+	if err := s.reclaimSessionLease(ctx, *intent); err != nil {
+		return err
+	}
+	if err := s.ensureNoSessionLease(ctx, *intent); err != nil {
+		return err
+	}
+	if err := s.reclaimSessionControl(ctx, *intent); err != nil {
+		return err
+	}
+	return s.sessionCleanup.CompleteSessionCleanup(ctx, store.CompleteSessionCleanupRequest{
+		Namespace: intent.Namespace, SessionName: intent.SessionName,
+		OperationID: intent.OperationID, OperationDigest: intent.OperationDigest,
+	})
+}
+
+func (s *Store) ensureCompletedSessionKubernetesStateAbsent(ctx context.Context, completion store.SessionCleanupCompletion) error {
+	if _, err := s.getSessionControlObject(ctx, completion.Namespace, completion.SessionName); err == nil {
+		return controlConflict("deleted session %s/%s regained a RuntimeSessionControl", completion.Namespace, completion.SessionName)
+	} else if !errors.Is(err, store.ErrNotFound) {
+		return err
+	}
+	if err := s.ensureNoSessionBranchClaims(ctx, completion.SessionUID); err != nil {
+		return err
+	}
+	if completion.SessionUID == "" {
+		return nil
+	}
+	if object, err := s.findSessionControlByUID(ctx, completion.SessionUID); err == nil {
+		return controlConflict("deleted Session UID %q regained RuntimeSessionControl %s/%s", completion.SessionUID, object.Namespace, object.Spec.SessionName)
+	} else if !errors.Is(err, store.ErrNotFound) {
+		return err
+	}
+	lease := &coordinationv1.Lease{}
+	key := client.ObjectKey{Namespace: completion.Namespace, Name: runtimeSessionLeaseName(completion.SessionUID)}
+	if err := s.readClient().Get(ctx, key, lease); err == nil {
+		return controlConflict("deleted session %s/%s regained its coordination Lease", completion.Namespace, completion.SessionName)
+	} else if !apierrors.IsNotFound(err) {
+		return mapKubernetesError("verify completed Session Lease absence", err)
+	}
+	return nil
+}
+
+// ResumeSessionCleanups replays every durable intent under the current
+// controller epoch. Individual failures are joined so one blocked Session does
+// not prevent independent cleanup plans from making progress.
+func (s *Store) ResumeSessionCleanups(ctx context.Context, fence store.ControllerEpochFence) error {
+	if err := s.requireClient(); err != nil {
+		return err
+	}
+	if s.sessionCleanup == nil {
+		return ErrSessionCleanupStoreNotConfigured
+	}
+	intents, err := s.sessionCleanup.ListSessionCleanupIntents(ctx)
+	if err != nil {
+		return err
+	}
+	var result error
+	for _, intent := range intents {
+		reclaimErr := s.ReclaimSession(ctx, store.ReclaimSessionRequest{
+			Namespace: intent.Namespace, SessionName: intent.SessionName, Fence: fence,
+			OperationID: intent.OperationID, OperationDigest: intent.OperationDigest, RequestedAt: intent.PreparedAt,
+		})
+		if reclaimErr != nil {
+			result = errors.Join(result, fmt.Errorf("resume Session cleanup %s/%s: %w", intent.Namespace, intent.SessionName, reclaimErr))
+		}
+	}
+	return result
+}
+
+func (s *Store) prepareSessionCleanupIntent(ctx context.Context, request store.ReclaimSessionRequest) (*store.SessionCleanupIntent, error) {
+	intent := store.SessionCleanupIntent{
+		Namespace: request.Namespace, SessionName: request.SessionName,
+		OperationID: request.OperationID, OperationDigest: request.OperationDigest,
+		PreparedAt: request.RequestedAt,
+	}
+	object, err := s.getSessionControlObject(ctx, request.Namespace, request.SessionName)
+	if errors.Is(err, store.ErrNotFound) {
+		sessionUID, identityErr := s.sessionCleanup.GetSessionCleanupIdentity(ctx, request.Namespace, request.SessionName)
+		if identityErr != nil && !errors.Is(identityErr, store.ErrNotFound) {
+			return nil, identityErr
+		}
+		if strings.TrimSpace(sessionUID) != "" {
+			claims, claimErr := s.sessionBranchClaimCleanupPlan(ctx, sessionUID)
+			if claimErr != nil {
+				return nil, claimErr
+			}
+			intent.SessionUID = sessionUID
+			intent.BranchClaims = claims
+			lease := &coordinationv1.Lease{}
+			leaseKey := client.ObjectKey{Namespace: request.Namespace, Name: runtimeSessionLeaseName(sessionUID)}
+			if leaseErr := s.readClient().Get(ctx, leaseKey, lease); leaseErr == nil {
+				state, stateErr := sessionLeaseFromObject(lease, request.SessionName, sessionUID)
+				if stateErr != nil {
+					return nil, stateErr
+				}
+				if (lease.Spec.HolderIdentity != nil && *lease.Spec.HolderIdentity != "") || state.Mode != leaseModeEmpty {
+					return nil, controlConflict("session %s/%s coordination Lease is active without a control record", request.Namespace, request.SessionName)
+				}
+				intent.ExpectedLeaseGeneration = state.Generation
+				intent.LeaseName = lease.Name
+				intent.LeaseObjectUID = string(lease.UID)
+			} else if !apierrors.IsNotFound(leaseErr) {
+				return nil, mapKubernetesError("get orphan Session cleanup Lease", leaseErr)
+			}
+			return s.sessionCleanup.PrepareSessionCleanup(ctx, intent)
+		}
+		return s.sessionCleanup.PrepareSessionCleanup(ctx, intent)
+	}
+	if err != nil {
+		return nil, err
+	}
+	control := sessionControlFromObject(object)
+	if control.Availability != store.SessionAvailable || control.Lease != nil ||
+		control.BlockedReason != "" || control.RelatedPromptAttemptID != "" || control.RelatedPublicationID != "" {
+		return nil, controlConflict("session %s/%s has active or unresolved authoritative state", request.Namespace, request.SessionName)
+	}
+	lease, leaseState, err := s.getSessionLease(ctx, object.Namespace, object.Spec.SessionName, object.Spec.SessionUID)
+	if err != nil {
+		return nil, err
+	}
+	if lease.Spec.HolderIdentity != nil && *lease.Spec.HolderIdentity != "" {
+		return nil, controlConflict("session %s/%s coordination Lease is held", request.Namespace, request.SessionName)
+	}
+	if leaseState.Mode != leaseModeEmpty || leaseState.Generation != control.LeaseGeneration {
+		return nil, controlConflict("session %s/%s coordination Lease does not match the quiescent control generation", request.Namespace, request.SessionName)
+	}
+	claims, err := s.sessionBranchClaimCleanupPlan(ctx, control.SessionUID)
+	if err != nil {
+		return nil, err
+	}
+	intent.SessionUID = control.SessionUID
+	intent.ControlObjectUID = string(object.UID)
+	intent.ControlRequestDigest = control.RequestDigest
+	intent.ExpectedControlVersion = control.Version
+	intent.ExpectedLeaseGeneration = control.LeaseGeneration
+	intent.ExpectedControlLastOperationID = control.LastOperationID
+	intent.ExpectedControlLastDigest = control.LastOperationDigest
+	intent.ExpectedVerifiedBaseline = cloneVerifiedBranchBaseline(control.VerifiedBaseline)
+	intent.LeaseName = lease.Name
+	intent.LeaseObjectUID = string(lease.UID)
+	intent.BranchClaims = claims
+	return s.sessionCleanup.PrepareSessionCleanup(ctx, intent)
+}
+
+func (s *Store) sessionBranchClaimCleanupPlan(
+	ctx context.Context,
+	sessionUID string,
+) ([]store.SessionCleanupBranchClaim, error) {
+	if !s.branchClaimsEnabled {
+		return nil, nil
+	}
+	list := &corev1alpha1.BranchClaimList{}
+	if err := s.readClient().List(ctx, list); err != nil {
+		return nil, mapKubernetesError("list Session-owned branch claims", err)
+	}
+	claims := make([]store.SessionCleanupBranchClaim, 0)
+	for i := range list.Items {
+		object := &list.Items[i]
+		if store.BranchClaimOwnerKind(object.Spec.OwnerKind) != store.BranchClaimOwnerSession || object.Spec.OwnerUID != sessionUID {
+			continue
+		}
+		claim := branchClaimFromObject(object)
+		available := claim.Availability == store.BranchClaimAvailable &&
+			claim.BlockedReason == "" && claim.RelatedPublicationID == ""
+		if !available {
+			return nil, controlConflict("Session-owned branch claim %q is reconciliation-blocked", claim.ID)
+		}
+		claims = append(claims, store.SessionCleanupBranchClaim{
+			ID: claim.ID, ObjectUID: string(object.UID),
+			ExpectedVersion: claim.Version, ExpectedGeneration: claim.Generation,
+			ExpectedRepositoryID: claim.RepositoryID, ExpectedRef: claim.Ref,
+			ExpectedOwnerUID: claim.OwnerUID, ExpectedLastVerified: claim.LastVerified,
+			ExpectedAvailability: claim.Availability, ExpectedRequestDigest: claim.RequestDigest,
+			ExpectedBlockedReason: claim.BlockedReason, ExpectedPublicationID: claim.RelatedPublicationID,
+		})
+	}
+	sort.Slice(claims, func(i, j int) bool { return claims[i].ID < claims[j].ID })
+	return claims, nil
+}
+
+func (s *Store) reclaimSessionBranchClaims(ctx context.Context, intent store.SessionCleanupIntent) error {
+	if !s.branchClaimsEnabled {
+		return s.validateSessionCleanupBranchClaimScope(intent)
+	}
+	for _, expected := range intent.BranchClaims {
+		object, err := s.getBranchClaimObject(ctx, expected.ID)
+		if errors.Is(err, store.ErrNotFound) {
+			continue
+		}
+		if err != nil {
+			return err
+		}
+		claim := branchClaimFromObject(object)
+		if claim.OwnerKind != store.BranchClaimOwnerSession || claim.OwnerUID != expected.ExpectedOwnerUID || claim.RequestDigest != expected.ExpectedRequestDigest {
+			continue
+		}
+		if expected.ObjectUID != "" && string(object.UID) != expected.ObjectUID {
+			return controlConflict("Session-owned branch claim %q was recreated during cleanup", expected.ID)
+		}
+		if claim.Version != expected.ExpectedVersion || claim.Generation != expected.ExpectedGeneration ||
+			claim.RepositoryID != expected.ExpectedRepositoryID || claim.Ref != expected.ExpectedRef ||
+			!claim.LastVerified.Equal(expected.ExpectedLastVerified) || claim.Availability != expected.ExpectedAvailability ||
+			claim.BlockedReason != expected.ExpectedBlockedReason ||
+			claim.RelatedPublicationID != expected.ExpectedPublicationID {
+			return controlConflict("Session-owned branch claim %q no longer matches its cleanup fence", expected.ID)
+		}
+		if err := deleteObjectWithExactPreconditions(ctx, s.client, object); err != nil && !apierrors.IsNotFound(err) {
+			return mapKubernetesError("delete Session-owned branch claim", err)
+		}
+		fresh, getErr := s.getBranchClaimObject(ctx, expected.ID)
+		if errors.Is(getErr, store.ErrNotFound) {
+			continue
+		}
+		if getErr != nil {
+			return getErr
+		}
+		freshClaim := branchClaimFromObject(fresh)
+		if freshClaim.OwnerKind != store.BranchClaimOwnerSession || freshClaim.OwnerUID != expected.ExpectedOwnerUID || freshClaim.RequestDigest != expected.ExpectedRequestDigest {
+			continue
+		}
+		return controlConflict("Session-owned branch claim %q still exists after cleanup", expected.ID)
+	}
+	return nil
+}
+
+func (s *Store) ensureNoSessionBranchClaims(ctx context.Context, sessionUID string) error {
+	if sessionUID == "" {
+		return nil
+	}
+	if !s.branchClaimsEnabled {
+		return nil
+	}
+	list := &corev1alpha1.BranchClaimList{}
+	if err := s.readClient().List(ctx, list); err != nil {
+		return mapKubernetesError("verify Session-owned branch claim cleanup", err)
+	}
+	for i := range list.Items {
+		claim := &list.Items[i]
+		if store.BranchClaimOwnerKind(claim.Spec.OwnerKind) == store.BranchClaimOwnerSession && claim.Spec.OwnerUID == sessionUID {
+			return controlConflict("Session UID %q still owns branch claim %q after cleanup", sessionUID, claim.Spec.ID)
+		}
+	}
+	return nil
+}
+
+func (s *Store) validateSessionCleanupBranchClaimScope(intent store.SessionCleanupIntent) error {
+	if s.branchClaimsEnabled {
+		return nil
+	}
+	if len(intent.BranchClaims) != 0 || intent.ExpectedVerifiedBaseline != nil {
+		return fmt.Errorf("%w: Session cleanup contains publication state", ErrBranchClaimAccessDisabled)
+	}
+	return nil
+}
+
+func (s *Store) reclaimSessionLease(ctx context.Context, intent store.SessionCleanupIntent) error {
+	if intent.SessionUID == "" || intent.LeaseName == "" {
+		return nil
+	}
+	lease := &coordinationv1.Lease{}
+	key := client.ObjectKey{Namespace: intent.Namespace, Name: intent.LeaseName}
+	if err := s.readClient().Get(ctx, key, lease); apierrors.IsNotFound(err) {
+		return nil
+	} else if err != nil {
+		return mapKubernetesError("get Session cleanup Lease", err)
+	}
+	if intent.LeaseObjectUID != "" && string(lease.UID) != intent.LeaseObjectUID {
+		return controlConflict("session %s/%s Lease was recreated during cleanup", intent.Namespace, intent.SessionName)
+	}
+	state, err := sessionLeaseFromObject(lease, intent.SessionName, intent.SessionUID)
+	if err != nil {
+		return err
+	}
+	if (lease.Spec.HolderIdentity != nil && *lease.Spec.HolderIdentity != "") ||
+		state.Mode != leaseModeEmpty || state.Generation != intent.ExpectedLeaseGeneration {
+		return controlConflict("session %s/%s Lease is active or changed during cleanup", intent.Namespace, intent.SessionName)
+	}
+	if err := deleteObjectWithExactPreconditions(ctx, s.client, lease); err != nil && !apierrors.IsNotFound(err) {
+		return mapKubernetesError("delete Session cleanup Lease", err)
+	}
+	fresh := &coordinationv1.Lease{}
+	if err := s.readClient().Get(ctx, key, fresh); err == nil {
+		return controlConflict("session %s/%s Lease still exists after cleanup", intent.Namespace, intent.SessionName)
+	} else if !apierrors.IsNotFound(err) {
+		return mapKubernetesError("verify Session cleanup Lease deletion", err)
+	}
+	return nil
+}
+
+func (s *Store) reclaimSessionControl(ctx context.Context, intent store.SessionCleanupIntent) error {
+	if intent.SessionUID == "" {
+		return nil
+	}
+	object, err := s.getSessionControlObject(ctx, intent.Namespace, intent.SessionName)
+	if errors.Is(err, store.ErrNotFound) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	if intent.ControlRequestDigest == "" {
+		return controlConflict("session %s/%s RuntimeSessionControl appeared after UID-only cleanup preparation", intent.Namespace, intent.SessionName)
+	}
+	if intent.ControlObjectUID != "" && string(object.UID) != intent.ControlObjectUID {
+		return controlConflict("session %s/%s control was recreated during cleanup", intent.Namespace, intent.SessionName)
+	}
+	control := sessionControlFromObject(object)
+	if control.SessionUID != intent.SessionUID || control.RequestDigest != intent.ControlRequestDigest ||
+		control.Version != intent.ExpectedControlVersion || control.LeaseGeneration != intent.ExpectedLeaseGeneration ||
+		control.LastOperationID != intent.ExpectedControlLastOperationID || control.LastOperationDigest != intent.ExpectedControlLastDigest ||
+		!reflect.DeepEqual(control.VerifiedBaseline, intent.ExpectedVerifiedBaseline) {
+		return controlConflict("session %s/%s control no longer matches its cleanup fence", intent.Namespace, intent.SessionName)
+	}
+	if control.Availability != store.SessionAvailable || control.Lease != nil || control.BlockedReason != "" ||
+		control.RelatedPromptAttemptID != "" || control.RelatedPublicationID != "" {
+		return controlConflict("session %s/%s control no longer matches its cleanup fence", intent.Namespace, intent.SessionName)
+	}
+	if err := deleteObjectWithExactPreconditions(ctx, s.client, object); err != nil && !apierrors.IsNotFound(err) {
+		return mapKubernetesError("delete RuntimeSessionControl", err)
+	}
+	if _, err := s.getSessionControlObject(ctx, intent.Namespace, intent.SessionName); !errors.Is(err, store.ErrNotFound) {
+		if err != nil {
+			return err
+		}
+		return controlConflict("session %s/%s control still exists after cleanup", intent.Namespace, intent.SessionName)
+	}
+	return nil
+}
+
+func (s *Store) ensureNoSessionLease(ctx context.Context, intent store.SessionCleanupIntent) error {
+	if intent.SessionUID == "" {
+		return nil
+	}
+	lease := &coordinationv1.Lease{}
+	key := client.ObjectKey{Namespace: intent.Namespace, Name: runtimeSessionLeaseName(intent.SessionUID)}
+	if err := s.readClient().Get(ctx, key, lease); err == nil {
+		return controlConflict("session %s/%s coordination Lease still exists after cleanup", intent.Namespace, intent.SessionName)
+	} else if !apierrors.IsNotFound(err) {
+		return mapKubernetesError("verify Session cleanup Lease absence", err)
+	}
+	return nil
+}
+
+func (s *Store) sessionCleanupPending(ctx context.Context, namespace, sessionName string) (bool, error) {
+	if s.sessionCleanup == nil {
+		return false, nil
+	}
+	pending, err := s.sessionCleanup.HasSessionCleanupIntent(ctx, namespace, sessionName)
+	if err != nil || pending {
+		return pending, err
+	}
+	if _, err := s.sessionCleanup.GetSessionCleanupCompletion(ctx, namespace, sessionName); err == nil {
+		return true, nil
+	} else if !errors.Is(err, store.ErrNotFound) {
+		return false, err
+	}
+	return false, nil
+}
+
+func (s *Store) sessionCleanupFencedForUID(ctx context.Context, sessionUID string) (bool, error) {
+	if s.sessionCleanup == nil {
+		return false, nil
+	}
+	return s.sessionCleanup.HasSessionCleanupFenceForUID(ctx, sessionUID)
+}
+
+func normalizeReclaimSessionRequest(request *store.ReclaimSessionRequest) error {
+	namespace := strings.TrimSpace(request.Namespace)
+	if request.Namespace != namespace {
+		return store.ValidationErrorf("session namespace must not contain surrounding whitespace")
+	}
+	sessionName := strings.TrimSpace(request.SessionName)
+	if request.SessionName != sessionName {
+		return store.ValidationErrorf("session name must not contain surrounding whitespace")
+	}
+	request.Namespace = namespace
+	request.SessionName = sessionName
+	request.OperationID = strings.TrimSpace(request.OperationID)
+	request.OperationDigest = strings.TrimSpace(request.OperationDigest)
+	for field, value := range map[string]string{
+		"session namespace": request.Namespace, "session name": request.SessionName,
+		"session cleanup operation ID": request.OperationID,
+	} {
+		if err := store.ValidateControlIdentifier(field, value); err != nil {
+			return err
+		}
+	}
+	fence, err := normalizeEpochFence(request.Fence)
+	if err != nil {
+		return err
+	}
+	request.Fence = fence
+	if err := store.ValidateCanonicalDigest("session cleanup operation digest", request.OperationDigest); err != nil {
+		return err
+	}
+	if request.RequestedAt.IsZero() {
+		request.RequestedAt = time.Now().UTC()
+	} else {
+		request.RequestedAt = request.RequestedAt.UTC()
+	}
+	return nil
+}
+
+func deleteObjectWithExactPreconditions(ctx context.Context, kubeClient client.Client, object client.Object) error {
+	uid := object.GetUID()
+	resourceVersion := object.GetResourceVersion()
+	return kubeClient.Delete(ctx, object, &client.DeleteOptions{Preconditions: &metav1.Preconditions{
+		UID: &uid, ResourceVersion: &resourceVersion,
+	}})
+}
+
+func cloneVerifiedBranchBaseline(value *store.VerifiedBranchBaseline) *store.VerifiedBranchBaseline {
+	if value == nil {
+		return nil
+	}
+	copyValue := *value
+	return &copyValue
+}
diff --git a/internal/store/kube/session_cleanup_test.go b/internal/store/kube/session_cleanup_test.go
new file mode 100644
index 000000000..c41906a7f
--- /dev/null
+++ b/internal/store/kube/session_cleanup_test.go
@@ -0,0 +1,501 @@
+package kube
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	controlstore "github.com/orka-agents/orka/internal/store"
+	sqlitestore "github.com/orka-agents/orka/internal/store/sqlite"
+	coordinationv1 "k8s.io/api/coordination/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
+)
+
+func TestReclaimSessionDeletesPublishedCrossStoreStateAndIsIdempotent(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, sqliteStore, db, fence := newSessionCleanupTestStore(t, nil)
+	control, claim := seedPublishedSessionCleanupState(t, ctx, kubeStore, sqliteStore, db, fence, "session-cleanup")
+	request := controlstore.ReclaimSessionRequest{
+		Namespace: control.Namespace, SessionName: control.SessionName, Fence: fence,
+		OperationID: "delete-session-cleanup", OperationDigest: testDigest("delete-session-cleanup"), RequestedAt: testNow,
+	}
+	if err := kubeStore.ReclaimSession(ctx, request); err != nil {
+		t.Fatalf("ReclaimSession(): %v", err)
+	}
+	if _, err := sqliteStore.GetSession(ctx, control.Namespace, control.SessionName); !errors.Is(err, controlstore.ErrNotFound) {
+		t.Fatalf("GetSession() error = %v, want ErrNotFound", err)
+	}
+	if _, err := kubeStore.GetSessionControl(ctx, control.Namespace, control.SessionName); !errors.Is(err, controlstore.ErrNotFound) {
+		t.Fatalf("GetSessionControl() error = %v, want ErrNotFound", err)
+	}
+	if _, err := kubeStore.GetBranchClaim(ctx, claim.ID); !errors.Is(err, controlstore.ErrNotFound) {
+		t.Fatalf("GetBranchClaim() error = %v, want ErrNotFound", err)
+	}
+	lease := &coordinationv1.Lease{}
+	if err := kubeClient.Get(ctx, client.ObjectKey{Namespace: control.Namespace, Name: runtimeSessionLeaseName(control.SessionUID)}, lease); !apierrors.IsNotFound(err) {
+		t.Fatalf("Session Lease lookup error = %v, want NotFound", err)
+	}
+	completion, err := sqliteStore.GetSessionCleanupCompletion(ctx, control.Namespace, control.SessionName)
+	if err != nil {
+		t.Fatalf("GetSessionCleanupCompletion(): %v", err)
+	}
+	if completion.OperationID != request.OperationID || completion.OperationDigest != request.OperationDigest {
+		t.Fatalf("completion receipt = %#v", completion)
+	}
+	if completion.SessionUID != control.SessionUID {
+		t.Fatalf("completion Session UID = %q, want %q", completion.SessionUID, control.SessionUID)
+	}
+	if err := kubeStore.ReclaimSession(ctx, request); err != nil {
+		t.Fatalf("ReclaimSession(idempotent retry): %v", err)
+	}
+	if _, err := kubeStore.CreateSessionControl(ctx, &controlstore.SessionControl{
+		Namespace: control.Namespace, SessionName: control.SessionName, SessionUID: control.SessionUID,
+		RequestDigest: control.RequestDigest, LeaseGeneration: 1, Availability: controlstore.SessionAvailable, CreatedAt: testNow,
+	}, fence); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("CreateSessionControl(after deletion) error = %v, want ErrConflict", err)
+	}
+	if _, err := kubeStore.CreateSessionControl(ctx, &controlstore.SessionControl{
+		Namespace: control.Namespace, SessionName: control.SessionName + "-renamed", SessionUID: control.SessionUID,
+		RequestDigest: testDigest("renamed-deleted-session-control"), LeaseGeneration: 1,
+		Availability: controlstore.SessionAvailable, CreatedAt: testNow,
+	}, fence); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("CreateSessionControl(reused deleted UID) error = %v, want ErrConflict", err)
+	}
+	if _, err := kubeStore.CreateBranchClaim(ctx, &controlstore.BranchClaim{
+		RepositoryID: "github.com/orka/reappeared", Ref: "refs/heads/reappeared",
+		OwnerKind: controlstore.BranchClaimOwnerSession, OwnerUID: control.SessionUID,
+		LastVerified: controlstore.RemoteRefState{Absent: true}, RequestDigest: testDigest("reappeared-claim"), CreatedAt: testNow,
+	}, fence); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("CreateBranchClaim(after deletion) error = %v, want ErrConflict", err)
+	}
+	if err := sqliteStore.CreateSession(ctx, &controlstore.SessionRecord{
+		Namespace: control.Namespace, Name: control.SessionName, SessionType: "chat", CreatedAt: testNow, UpdatedAt: testNow,
+	}); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("CreateSession(recently deleted name) error = %v, want ErrConflict", err)
+	}
+}
+
+func TestReclaimSessionWithoutClusterScopedBranchClaims(t *testing.T) {
+	ctx := context.Background()
+	_, kubeClient, fence := newTestStoreWithEpoch(t)
+	withWatch, ok := kubeClient.(client.WithWatch)
+	if !ok {
+		t.Fatal("fake client does not implement client.WithWatch")
+	}
+	branchClaimLists := 0
+	branchBlockingReader := interceptor.NewClient(withWatch, interceptor.Funcs{
+		List: func(ctx context.Context, delegate client.WithWatch, list client.ObjectList, options ...client.ListOption) error {
+			if _, isBranchClaims := list.(*corev1alpha1.BranchClaimList); isBranchClaims {
+				branchClaimLists++
+				return errors.New("unexpected cluster-scoped BranchClaim list")
+			}
+			return delegate.List(ctx, list, options...)
+		},
+	})
+	db, err := sqlitestore.NewDB(filepath.Join(t.TempDir(), "branchless-session-cleanup.db"))
+	if err != nil {
+		t.Fatalf("NewDB(): %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	sqliteStore := sqlitestore.NewStore(db, "")
+	kubeStore, err := NewComposite(
+		kubeClient,
+		testControlNamespace,
+		sqliteStore,
+		WithAPIReader(branchBlockingReader),
+		WithoutClusterScopedBranchClaims(),
+	)
+	if err != nil {
+		t.Fatalf("NewComposite(): %v", err)
+	}
+	const sessionName = "harness-v1-session-cleanup"
+	if err := sqliteStore.CreateSession(ctx, &controlstore.SessionRecord{
+		Namespace: "tenant-a", Name: sessionName, SessionType: "task", CreatedAt: testNow, UpdatedAt: testNow,
+	}); err != nil {
+		t.Fatalf("CreateSession(): %v", err)
+	}
+	control, err := kubeStore.CreateSessionControl(ctx, &controlstore.SessionControl{
+		Namespace: "tenant-a", SessionName: sessionName, SessionUID: sessionName + "-uid",
+		RequestDigest: testDigest(sessionName + "-control"), LeaseGeneration: 1,
+		Availability: controlstore.SessionAvailable, CreatedAt: testNow,
+	}, fence)
+	if err != nil {
+		t.Fatalf("CreateSessionControl(): %v", err)
+	}
+	if err := kubeStore.ReclaimSession(ctx, controlstore.ReclaimSessionRequest{
+		Namespace: control.Namespace, SessionName: control.SessionName, Fence: fence,
+		OperationID: "delete-harness-v1-session", OperationDigest: testDigest("delete-harness-v1-session"), RequestedAt: testNow,
+	}); err != nil {
+		t.Fatalf("ReclaimSession(): %v", err)
+	}
+	if branchClaimLists != 0 {
+		t.Fatalf("BranchClaim list calls = %d, want 0", branchClaimLists)
+	}
+	if _, err := kubeStore.GetBranchClaim(ctx, "forbidden"); !errors.Is(err, ErrBranchClaimAccessDisabled) {
+		t.Fatalf("GetBranchClaim() error = %v, want ErrBranchClaimAccessDisabled", err)
+	}
+	if _, err := sqliteStore.GetSession(ctx, control.Namespace, control.SessionName); !errors.Is(err, controlstore.ErrNotFound) {
+		t.Fatalf("GetSession() error = %v, want ErrNotFound", err)
+	}
+}
+
+func TestReclaimSessionCompletionDetectsRawKubernetesOwnershipReappearance(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, sqliteStore, _, fence := newSessionCleanupTestStore(t, nil)
+	control, _ := seedSessionCleanupState(t, ctx, kubeStore, sqliteStore, fence, "session-reappeared-raw")
+	request := controlstore.ReclaimSessionRequest{
+		Namespace: control.Namespace, SessionName: control.SessionName, Fence: fence,
+		OperationID: "delete-session-reappeared", OperationDigest: testDigest("delete-session-reappeared"), RequestedAt: testNow,
+	}
+	if err := kubeStore.ReclaimSession(ctx, request); err != nil {
+		t.Fatalf("ReclaimSession(): %v", err)
+	}
+	late := &corev1alpha1.BranchClaim{
+		ObjectMeta: metav1.ObjectMeta{Name: "raw-reappeared-session-claim"},
+		Spec: corev1alpha1.BranchClaimSpec{
+			ID: "raw-reappeared-session-claim", RepositoryID: "github.com/orka/raw", Ref: "refs/heads/raw",
+			OwnerKind: corev1alpha1.BranchClaimOwnerKind(controlstore.BranchClaimOwnerSession), OwnerUID: control.SessionUID,
+			RequestDigest: testDigest("raw-reappeared-session-claim"),
+		},
+	}
+	if err := kubeClient.Create(ctx, late); err != nil {
+		t.Fatalf("inject raw Session-owned BranchClaim: %v", err)
+	}
+	if err := kubeStore.ReclaimSession(ctx, request); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("ReclaimSession(reappeared ownership) error = %v, want ErrConflict", err)
+	}
+}
+
+func TestReclaimSessionFailsClosedWhenLateSessionClaimAppears(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, sqliteStore, _, fence := newSessionCleanupTestStore(t, nil)
+	control, original := seedSessionCleanupState(t, ctx, kubeStore, sqliteStore, fence, "session-late-claim")
+	withWatch, ok := kubeClient.(client.WithWatch)
+	if !ok {
+		t.Fatal("fake client does not implement client.WithWatch")
+	}
+	late := &corev1alpha1.BranchClaim{
+		ObjectMeta: metav1.ObjectMeta{Name: "late-session-claim"},
+		Spec: corev1alpha1.BranchClaimSpec{
+			ID: "late-session-claim", RepositoryID: "github.com/orka/late", Ref: "refs/heads/late",
+			OwnerKind: corev1alpha1.BranchClaimOwnerKind(controlstore.BranchClaimOwnerSession), OwnerUID: control.SessionUID,
+			RequestDigest: testDigest("late-session-claim"),
+		},
+	}
+	injected := false
+	kubeStore.client = interceptor.NewClient(withWatch, interceptor.Funcs{
+		Delete: func(ctx context.Context, delegate client.WithWatch, object client.Object, options ...client.DeleteOption) error {
+			claim, isClaim := object.(*corev1alpha1.BranchClaim)
+			if !isClaim || claim.Spec.ID != original.ID || injected {
+				return delegate.Delete(ctx, object, options...)
+			}
+			if err := delegate.Delete(ctx, object, options...); err != nil {
+				return err
+			}
+			injected = true
+			return delegate.Create(ctx, late)
+		},
+	})
+	request := controlstore.ReclaimSessionRequest{
+		Namespace: control.Namespace, SessionName: control.SessionName, Fence: fence,
+		OperationID: "delete-session-late-claim", OperationDigest: testDigest("delete-session-late-claim"), RequestedAt: testNow,
+	}
+	if err := kubeStore.ReclaimSession(ctx, request); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("ReclaimSession() error = %v, want ErrConflict", err)
+	}
+	if _, err := sqliteStore.GetSession(ctx, control.Namespace, control.SessionName); err != nil {
+		t.Fatalf("Session transcript was deleted despite late claim: %v", err)
+	}
+	if _, err := kubeStore.GetSessionControl(ctx, control.Namespace, control.SessionName); err != nil {
+		t.Fatalf("Session control was deleted despite late claim: %v", err)
+	}
+	if err := kubeClient.Get(ctx, client.ObjectKey{Name: late.Name}, &corev1alpha1.BranchClaim{}); err != nil {
+		t.Fatalf("late Session claim missing: %v", err)
+	}
+	if _, err := sqliteStore.GetSessionCleanupIntent(ctx, control.Namespace, control.SessionName); err != nil {
+		t.Fatalf("cleanup intent was not retained: %v", err)
+	}
+}
+
+func TestResumeSessionCleanupsCompletesCrashAfterKubernetesReclamation(t *testing.T) {
+	ctx := context.Background()
+	injectedErr := errors.New("simulated SQLite completion outage")
+	persistence := &failOnceSessionCleanupPersistence{err: injectedErr}
+	kubeStore, _, sqliteStore, _, fence := newSessionCleanupTestStore(t, persistence)
+	control, _ := seedSessionCleanupState(t, ctx, kubeStore, sqliteStore, fence, "session-resume-cleanup")
+	request := controlstore.ReclaimSessionRequest{
+		Namespace: control.Namespace, SessionName: control.SessionName, Fence: fence,
+		OperationID: "delete-session-resume", OperationDigest: testDigest("delete-session-resume"), RequestedAt: testNow,
+	}
+	if err := kubeStore.ReclaimSession(ctx, request); !errors.Is(err, injectedErr) {
+		t.Fatalf("ReclaimSession() error = %v, want injected completion error", err)
+	}
+	if _, err := kubeStore.GetSessionControl(ctx, control.Namespace, control.SessionName); !errors.Is(err, controlstore.ErrNotFound) {
+		t.Fatalf("GetSessionControl() error = %v, want ErrNotFound after partial cleanup", err)
+	}
+	if _, err := sqliteStore.GetSession(ctx, control.Namespace, control.SessionName); err != nil {
+		t.Fatalf("Session transcript was removed before completion retry: %v", err)
+	}
+	if err := kubeStore.ResumeSessionCleanups(ctx, fence); err != nil {
+		t.Fatalf("ResumeSessionCleanups(): %v", err)
+	}
+	if _, err := sqliteStore.GetSession(ctx, control.Namespace, control.SessionName); !errors.Is(err, controlstore.ErrNotFound) {
+		t.Fatalf("GetSession() after recovery error = %v, want ErrNotFound", err)
+	}
+}
+
+func TestReclaimSessionRecoversLegacyKubernetesOrphanAfterTranscriptDeletion(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, _, sqliteStore, _, fence := newSessionCleanupTestStore(t, nil)
+	control, claim := seedSessionCleanupState(t, ctx, kubeStore, sqliteStore, fence, "session-legacy-orphan")
+	if err := sqliteStore.DeleteSession(ctx, control.Namespace, control.SessionName); err != nil {
+		t.Fatalf("legacy SQLite-only DeleteSession(): %v", err)
+	}
+	request := controlstore.ReclaimSessionRequest{
+		Namespace: control.Namespace, SessionName: control.SessionName, Fence: fence,
+		OperationID: "delete-session-legacy-orphan", OperationDigest: testDigest("delete-session-legacy-orphan"), RequestedAt: testNow,
+	}
+	if err := kubeStore.ReclaimSession(ctx, request); err != nil {
+		t.Fatalf("ReclaimSession(legacy orphan): %v", err)
+	}
+	if _, err := kubeStore.GetSessionControl(ctx, control.Namespace, control.SessionName); !errors.Is(err, controlstore.ErrNotFound) {
+		t.Fatalf("GetSessionControl() error = %v, want ErrNotFound", err)
+	}
+	if _, err := kubeStore.GetBranchClaim(ctx, claim.ID); !errors.Is(err, controlstore.ErrNotFound) {
+		t.Fatalf("GetBranchClaim() error = %v, want ErrNotFound", err)
+	}
+	completion, err := sqliteStore.GetSessionCleanupCompletion(ctx, control.Namespace, control.SessionName)
+	if err != nil || completion.SessionUID != control.SessionUID {
+		t.Fatalf("legacy orphan completion = %#v, err=%v", completion, err)
+	}
+}
+
+func TestReclaimSessionRejectsPreCutoverReplacementWithOldKubernetesIdentity(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, _, sqliteStore, db, fence := newSessionCleanupTestStore(t, nil)
+	control, _ := seedSessionCleanupState(t, ctx, kubeStore, sqliteStore, fence, "session-precutover-replacement")
+	if err := sqliteStore.DeleteSession(ctx, control.Namespace, control.SessionName); err != nil {
+		t.Fatalf("legacy SQLite-only DeleteSession(): %v", err)
+	}
+	if err := sqliteStore.CreateSession(ctx, &controlstore.SessionRecord{
+		Namespace: control.Namespace, Name: control.SessionName, SessionType: "chat",
+		CreatedAt: testNow.Add(time.Hour), UpdatedAt: testNow.Add(time.Hour),
+	}); err != nil {
+		t.Fatalf("CreateSession(replacement): %v", err)
+	}
+	if _, err := kubeStore.CreateSessionControl(ctx, &controlstore.SessionControl{
+		Namespace: control.Namespace, SessionName: control.SessionName, SessionUID: control.SessionUID,
+		RequestDigest: control.RequestDigest, LeaseGeneration: control.LeaseGeneration,
+		Availability: control.Availability, CreatedAt: control.CreatedAt, UpdatedAt: control.UpdatedAt,
+	}, fence); err != nil {
+		t.Fatalf("CreateSessionControl(idempotent legacy retry): %v", err)
+	}
+	var replacementBinding string
+	if err := db.QueryRowContext(ctx,
+		`SELECT control_session_uid FROM sessions WHERE namespace = ? AND name = ?`, control.Namespace, control.SessionName,
+	).Scan(&replacementBinding); err != nil {
+		t.Fatalf("read replacement cleanup identity: %v", err)
+	}
+	if replacementBinding != "" {
+		t.Fatalf("legacy control retry bound replacement transcript to %q", replacementBinding)
+	}
+	request := controlstore.ReclaimSessionRequest{
+		Namespace: control.Namespace, SessionName: control.SessionName, Fence: fence,
+		OperationID: "delete-session-precutover-replacement", OperationDigest: testDigest("delete-session-precutover-replacement"), RequestedAt: testNow,
+	}
+	if err := kubeStore.ReclaimSession(ctx, request); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("ReclaimSession(replacement) error = %v, want ErrConflict", err)
+	}
+	if _, err := sqliteStore.GetSession(ctx, control.Namespace, control.SessionName); err != nil {
+		t.Fatalf("replacement Session was deleted: %v", err)
+	}
+	if _, err := kubeStore.GetSessionControl(ctx, control.Namespace, control.SessionName); err != nil {
+		t.Fatalf("legacy control was deleted despite identity mismatch: %v", err)
+	}
+}
+
+func TestReclaimSessionRecoversBindBeforeControlCrash(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, _, sqliteStore, _, fence := newSessionCleanupTestStore(t, nil)
+	const (
+		namespace   = "tenant-a"
+		sessionName = "session-bind-before-control"
+		sessionUID  = "session-bind-before-control-uid"
+	)
+	if err := sqliteStore.CreateSession(ctx, &controlstore.SessionRecord{
+		Namespace: namespace, Name: sessionName, SessionType: "task", CreatedAt: testNow, UpdatedAt: testNow,
+	}); err != nil {
+		t.Fatalf("CreateSession(): %v", err)
+	}
+	if err := sqliteStore.BindSessionCleanupIdentity(ctx, namespace, sessionName, sessionUID); err != nil {
+		t.Fatalf("BindSessionCleanupIdentity(): %v", err)
+	}
+	request := controlstore.ReclaimSessionRequest{
+		Namespace: namespace, SessionName: sessionName, Fence: fence,
+		OperationID: "delete-bind-before-control", OperationDigest: testDigest("delete-bind-before-control"), RequestedAt: testNow,
+	}
+	if err := kubeStore.ReclaimSession(ctx, request); err != nil {
+		t.Fatalf("ReclaimSession(bind-before-control crash): %v", err)
+	}
+	if _, err := sqliteStore.GetSession(ctx, namespace, sessionName); !errors.Is(err, controlstore.ErrNotFound) {
+		t.Fatalf("GetSession() error = %v, want ErrNotFound", err)
+	}
+	completion, err := sqliteStore.GetSessionCleanupCompletion(ctx, namespace, sessionName)
+	if err != nil || completion.SessionUID != sessionUID {
+		t.Fatalf("completion = %#v, err=%v", completion, err)
+	}
+}
+
+func TestReclaimSessionUsesLegacyTurnUIDAsIdentityProof(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, _, sqliteStore, db, fence := newSessionCleanupTestStore(t, nil)
+	control, _ := seedPublishedSessionCleanupState(t, ctx, kubeStore, sqliteStore, db, fence, "session-legacy-turn-proof")
+	if _, err := db.ExecContext(ctx,
+		`UPDATE sessions SET control_session_uid = '' WHERE namespace = ? AND name = ?`, control.Namespace, control.SessionName,
+	); err != nil {
+		t.Fatalf("clear migrated cleanup identity: %v", err)
+	}
+	request := controlstore.ReclaimSessionRequest{
+		Namespace: control.Namespace, SessionName: control.SessionName, Fence: fence,
+		OperationID: "delete-legacy-turn-proof", OperationDigest: testDigest("delete-legacy-turn-proof"), RequestedAt: testNow,
+	}
+	if err := kubeStore.ReclaimSession(ctx, request); err != nil {
+		t.Fatalf("ReclaimSession(legacy turn proof): %v", err)
+	}
+}
+
+type failOnceSessionCleanupPersistence struct {
+	*sqlitestore.Store
+	err error
+}
+
+func (p *failOnceSessionCleanupPersistence) CompleteSessionCleanup(ctx context.Context, request controlstore.CompleteSessionCleanupRequest) error {
+	if p.err != nil {
+		err := p.err
+		p.err = nil
+		return err
+	}
+	return p.Store.CompleteSessionCleanup(ctx, request)
+}
+
+func newSessionCleanupTestStore(
+	t *testing.T,
+	failing *failOnceSessionCleanupPersistence,
+) (*Store, client.Client, *sqlitestore.Store, *sql.DB, controlstore.ControllerEpochFence) {
+	t.Helper()
+	_, kubeClient, fence := newTestStoreWithEpoch(t)
+	db, err := sqlitestore.NewDB(filepath.Join(t.TempDir(), "session-cleanup.db"))
+	if err != nil {
+		t.Fatalf("NewDB(): %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	sqliteStore := sqlitestore.NewStore(db, "")
+	var persistence SQLitePersistence = sqliteStore
+	if failing != nil {
+		failing.Store = sqliteStore
+		persistence = failing
+	}
+	kubeStore, err := NewComposite(kubeClient, testControlNamespace, persistence)
+	if err != nil {
+		t.Fatalf("NewComposite(): %v", err)
+	}
+	return kubeStore, kubeClient, sqliteStore, db, fence
+}
+
+func seedSessionCleanupState(
+	t *testing.T,
+	ctx context.Context,
+	kubeStore *Store,
+	sqliteStore *sqlitestore.Store,
+	fence controlstore.ControllerEpochFence,
+	name string,
+) (*controlstore.SessionControl, *controlstore.BranchClaim) {
+	t.Helper()
+	if err := sqliteStore.CreateSession(ctx, &controlstore.SessionRecord{
+		Namespace: "tenant-a", Name: name, SessionType: "task", CreatedAt: testNow, UpdatedAt: testNow,
+	}); err != nil {
+		t.Fatalf("CreateSession(): %v", err)
+	}
+	control, err := kubeStore.CreateSessionControl(ctx, &controlstore.SessionControl{
+		Namespace: "tenant-a", SessionName: name, SessionUID: name + "-uid",
+		RequestDigest: testDigest(name + "-control"), LeaseGeneration: 1,
+		Availability: controlstore.SessionAvailable, CreatedAt: testNow,
+	}, fence)
+	if err != nil {
+		t.Fatalf("CreateSessionControl(): %v", err)
+	}
+	claim, err := kubeStore.CreateBranchClaim(ctx, &controlstore.BranchClaim{
+		RepositoryID: "github.com/orka/target", Ref: "refs/heads/" + name,
+		OwnerKind: controlstore.BranchClaimOwnerSession, OwnerUID: control.SessionUID,
+		LastVerified:  controlstore.RemoteRefState{SHA: strings.Repeat("a", 40)},
+		RequestDigest: testDigest(name + "-branch"), CreatedAt: testNow,
+	}, fence)
+	if err != nil {
+		t.Fatalf("CreateBranchClaim(): %v", err)
+	}
+	return control, claim
+}
+
+func seedPublishedSessionCleanupState(
+	t *testing.T,
+	ctx context.Context,
+	kubeStore *Store,
+	sqliteStore *sqlitestore.Store,
+	db *sql.DB,
+	fence controlstore.ControllerEpochFence,
+	name string,
+) (*controlstore.SessionControl, *controlstore.BranchClaim) {
+	t.Helper()
+	control, claim := seedSessionCleanupState(t, ctx, kubeStore, sqliteStore, fence, name)
+	key := controlstore.SessionTurnKey{
+		SessionUID: control.SessionUID, LeaseGeneration: control.LeaseGeneration,
+		TaskUID: "task-published", Attempt: 1, PromptID: "prompt-published",
+	}
+	turnID, err := key.CanonicalID()
+	if err != nil {
+		t.Fatalf("CanonicalID(): %v", err)
+	}
+	if _, err := db.ExecContext(ctx, `INSERT INTO session_turns(
+		id, namespace, session_name, session_uid, lease_generation, task_uid, attempt, prompt_id,
+		prompt_attempt_id, request_digest, user_prompt, state, terminal_kind, terminal_content,
+		finalization_digest, publication_id, controller_epoch_name, controller_epoch, version,
+		created_at, finalized_at, updated_at
+	) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'publish', 'Finalized', 'AssistantResult', 'published', ?,
+		'publication-cleanup', ?, ?, 2, ?, ?, ?)`,
+		turnID, control.Namespace, control.SessionName, key.SessionUID, key.LeaseGeneration, key.TaskUID, key.Attempt, key.PromptID,
+		"attempt-published", testDigest("published-turn"), testDigest("published-finalization"),
+		fence.Name, fence.Epoch, testNow, testNow.Add(time.Minute), testNow.Add(time.Minute),
+	); err != nil {
+		t.Fatalf("insert published SessionTurn: %v", err)
+	}
+	if _, err := db.ExecContext(ctx, `INSERT INTO outbox_projections(
+		id, aggregate_kind, aggregate_id, projection_kind, payload_digest, payload, state,
+		initial_available_at, available_at, controller_epoch_name, controller_epoch, version,
+		created_at, updated_at, delivered_at
+	) VALUES ('session-cleanup-projection', ?, ?, 'TaskTerminalStatus', ?, '{}', 'Delivered', ?, ?, ?, ?, 1, ?, ?, ?)`,
+		sessionTurnAggregateKind, turnID, testDigest("published-projection"), testNow, testNow,
+		fence.Name, fence.Epoch, testNow, testNow, testNow,
+	); err != nil {
+		t.Fatalf("insert delivered projection: %v", err)
+	}
+	return control, claim
+}
+
+func TestReclaimSessionRejectsWhitespaceAliasedIdentity(t *testing.T) {
+	request := controlstore.ReclaimSessionRequest{
+		Namespace: "tenant-a", SessionName: "session-cleanup ",
+		Fence:       controlstore.ControllerEpochFence{Name: controlstore.DefaultControllerEpochName, Epoch: 1, HolderID: "controller-a"},
+		OperationID: "delete-whitespace-alias", OperationDigest: testDigest("delete-whitespace-alias"), RequestedAt: testNow,
+	}
+	if err := normalizeReclaimSessionRequest(&request); !errors.Is(err, controlstore.ErrValidation) {
+		t.Fatalf("normalizeReclaimSessionRequest() error = %v, want ErrValidation", err)
+	}
+}
diff --git a/internal/store/kube/session_control.go b/internal/store/kube/session_control.go
new file mode 100644
index 000000000..802a0746d
--- /dev/null
+++ b/internal/store/kube/session_control.go
@@ -0,0 +1,1194 @@
+package kube
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"math"
+	"reflect"
+	"strconv"
+	"strings"
+	"time"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+	coordinationv1 "k8s.io/api/coordination/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+const (
+	sessionControlFieldNamespace = "session namespace"
+	sessionControlFieldName      = "session name"
+	sessionControlFieldUID       = "session UID"
+	prePromptLeaseReleasePrefix  = "release-pre-prompt:"
+)
+
+type sessionLeaseState struct {
+	Mode          string
+	Generation    int64
+	TaskUID       string
+	Attempt       int64
+	PromptID      string
+	RequestDigest string
+	LineageDigest string
+	AcquiredAt    time.Time
+	ExpiresAt     *time.Time
+	OperationID   string
+	OperationHash string
+}
+
+// CreateSessionControl creates the immutable Session identity, its empty
+// serialization Lease, and the initial status.
+func (s *Store) CreateSessionControl(ctx context.Context, control *store.SessionControl, fence store.ControllerEpochFence) (*store.SessionControl, error) {
+	if err := s.requireClient(); err != nil {
+		return nil, err
+	}
+	normalized, normalizedFence, err := normalizeSessionControlForCreate(control, fence)
+	if err != nil {
+		return nil, err
+	}
+	_, snapshot, err := s.requireControllerEpoch(ctx, normalizedFence)
+	if err != nil {
+		return nil, err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	if pending, pendingErr := s.sessionCleanupPending(ctx, normalized.Namespace, normalized.SessionName); pendingErr != nil {
+		return nil, pendingErr
+	} else if pending {
+		return nil, controlConflict("session %s/%s is being deleted", normalized.Namespace, normalized.SessionName)
+	}
+	if fenced, fenceErr := s.sessionCleanupFencedForUID(ctx, normalized.SessionUID); fenceErr != nil {
+		return nil, fenceErr
+	} else if fenced {
+		return nil, controlConflict("Session UID %q is being deleted or was already deleted", normalized.SessionUID)
+	}
+	if existingByUID, getErr := s.findSessionControlByUID(ctx, normalized.SessionUID); getErr == nil {
+		if existingByUID.Namespace != normalized.Namespace || existingByUID.Spec.SessionName != normalized.SessionName {
+			return nil, controlConflict("Session UID %q is already owned by %s/%s", normalized.SessionUID, existingByUID.Namespace, existingByUID.Spec.SessionName)
+		}
+		return s.completeSessionControlCreation(ctx, existingByUID, normalized, normalizedFence, snapshot)
+	} else if !errors.Is(getErr, store.ErrNotFound) {
+		return nil, getErr
+	}
+
+	key := client.ObjectKey{Namespace: normalized.Namespace, Name: runtimeSessionObjectName(normalized.SessionName)}
+	object := &corev1alpha1.RuntimeSessionControl{}
+	err = s.readClient().Get(ctx, key, object)
+	if err == nil {
+		return s.completeSessionControlCreation(ctx, object, normalized, normalizedFence, snapshot)
+	}
+	if !apierrors.IsNotFound(err) {
+		return nil, mapKubernetesError("get runtime session control", err)
+	}
+	if s.sessionCleanup != nil {
+		if err := s.sessionCleanup.BindSessionCleanupIdentity(ctx, normalized.Namespace, normalized.SessionName, normalized.SessionUID); err != nil {
+			return nil, err
+		}
+	}
+
+	labels := controlLabels(sessionControlLogicalID(normalized.Namespace, normalized.SessionName))
+	object = &corev1alpha1.RuntimeSessionControl{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: normalized.Namespace,
+			Name:      key.Name,
+			Labels:    labels,
+		},
+		Spec: corev1alpha1.RuntimeSessionControlSpec{
+			SessionName:   normalized.SessionName,
+			SessionUID:    normalized.SessionUID,
+			RequestDigest: normalized.RequestDigest,
+			Owner: corev1alpha1.ControlRecordOwner{
+				Kind: "Session",
+				UID:  normalized.SessionUID,
+			},
+		},
+	}
+	if err := s.client.Create(ctx, object); err != nil {
+		if apierrors.IsAlreadyExists(err) {
+			if getErr := s.readClient().Get(ctx, key, object); getErr != nil {
+				return nil, mapKubernetesError("get concurrently created runtime session control", getErr)
+			}
+			return s.completeSessionControlCreation(ctx, object, normalized, normalizedFence, snapshot)
+		}
+		return nil, mapKubernetesError("create runtime session control", err)
+	}
+	return s.completeSessionControlCreation(ctx, object, normalized, normalizedFence, snapshot)
+}
+
+// GetSessionControl reads the exact namespaced Session control record.
+func (s *Store) GetSessionControl(ctx context.Context, namespace, sessionName string) (*store.SessionControl, error) {
+	if err := s.requireClient(); err != nil {
+		return nil, err
+	}
+	namespace = strings.TrimSpace(namespace)
+	sessionName = strings.TrimSpace(sessionName)
+	if err := store.ValidateControlIdentifier(sessionControlFieldNamespace, namespace); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateControlIdentifier(sessionControlFieldName, sessionName); err != nil {
+		return nil, err
+	}
+	object := &corev1alpha1.RuntimeSessionControl{}
+	key := client.ObjectKey{Namespace: namespace, Name: runtimeSessionObjectName(sessionName)}
+	if err := s.readClient().Get(ctx, key, object); err != nil {
+		return nil, mapKubernetesError("get runtime session control", err)
+	}
+	if object.Spec.SessionName != sessionName {
+		return nil, controlConflict("runtime session control %s/%s has a different immutable Session name", namespace, object.Name)
+	}
+	result := sessionControlFromObject(object)
+	return &result, nil
+}
+
+// AcquireSessionMutationLease acquires the next monotonic Session lease
+// generation by first CAS-updating the coordination Lease and then mirroring
+// the exact Lease revision into RuntimeSessionControl status.
+func (s *Store) AcquireSessionMutationLease(ctx context.Context, request store.AcquireSessionMutationLeaseRequest) (*store.SessionControl, error) {
+	if err := normalizeAcquireSessionMutationLeaseRequest(&request); err != nil {
+		return nil, err
+	}
+	fence, snapshot, err := s.requireControllerEpoch(ctx, request.Fence)
+	if err != nil {
+		return nil, err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	request.Fence = fence
+	if pending, pendingErr := s.sessionCleanupPending(ctx, request.Namespace, request.SessionName); pendingErr != nil {
+		return nil, pendingErr
+	} else if pending {
+		return nil, controlConflict("session %s/%s is being deleted", request.Namespace, request.SessionName)
+	}
+
+	object, err := s.getSessionControlObject(ctx, request.Namespace, request.SessionName)
+	if err != nil {
+		return nil, err
+	}
+	control := sessionControlFromObject(object)
+	if control.SessionUID != request.SessionUID {
+		return nil, controlConflict("session %s/%s UID does not match immutable control record", request.Namespace, request.SessionName)
+	}
+	if _, err := resolveSessionLineage(control.Lineage, *request.Lineage, request.AcquiredAt); err != nil {
+		return nil, err
+	}
+	if control.Lease != nil && control.Lease.TaskUID == request.TaskUID && control.Lease.Attempt == request.Attempt && control.Lease.PromptID == request.PromptID {
+		if control.Lease.RequestDigest != request.RequestDigest {
+			return nil, controlConflict("session lease identity was reused with a different request digest")
+		}
+		if err := s.verifyMirroredSessionLease(ctx, object, *control.Lease); err != nil {
+			return nil, err
+		}
+		return s.completeExistingSessionLineage(ctx, object, control, request, fence, snapshot)
+	}
+	if control.Version != request.ExpectedVersion || control.LeaseGeneration != request.ExpectedLeaseGeneration {
+		return nil, controlConflict("session %s/%s is version %d lease generation %d, expected version %d generation %d", request.Namespace, request.SessionName, control.Version, control.LeaseGeneration, request.ExpectedVersion, request.ExpectedLeaseGeneration)
+	}
+	if control.Availability != store.SessionAvailable {
+		return nil, controlConflict("session %s/%s is reconciliation-blocked: %s", request.Namespace, request.SessionName, control.BlockedReason)
+	}
+	if control.Lease != nil {
+		return nil, controlConflict("session %s/%s is already leased by task %s", request.Namespace, request.SessionName, control.Lease.TaskUID)
+	}
+
+	lease, leaseState, err := s.getSessionLease(ctx, object.Namespace, object.Spec.SessionName, object.Spec.SessionUID)
+	if err != nil {
+		return nil, err
+	}
+	lease, leaseState, err = s.finishPendingPrePromptLeaseRelease(ctx, control, lease, leaseState)
+	if err != nil {
+		return nil, err
+	}
+	if lease.Spec.HolderIdentity != nil && *lease.Spec.HolderIdentity != "" {
+		if sameSessionMutationLease(leaseState, request) && leaseState.Generation == request.ExpectedLeaseGeneration+1 {
+			return s.completeSessionLeaseStatus(ctx, object, control, request, fence, snapshot, lease)
+		}
+		return nil, controlConflict("session %s/%s coordination Lease is already held", request.Namespace, request.SessionName)
+	}
+	if leaseState.Generation != request.ExpectedLeaseGeneration {
+		return nil, controlConflict("session %s/%s Lease generation %d does not match expected %d", request.Namespace, request.SessionName, leaseState.Generation, request.ExpectedLeaseGeneration)
+	}
+
+	updatedLease := lease.DeepCopy()
+	setSessionMutationLease(updatedLease, request, request.ExpectedLeaseGeneration+1)
+	if err := s.client.Update(ctx, updatedLease); err != nil {
+		return nil, mapKubernetesError("acquire Session mutation Lease", err)
+	}
+	return s.completeSessionLeaseStatus(ctx, object, control, request, fence, snapshot, updatedLease)
+}
+
+// ReleaseSessionMutationLease aborts an exact pre-prompt lease after the
+// caller has independently established that no SessionTurn was persisted.
+// SessionControl commits first; retries then finish the coordination-Lease
+// clear by matching the durable release operation.
+func (s *Store) ReleaseSessionMutationLease(ctx context.Context, request store.ReleaseSessionMutationLeaseRequest) (*store.SessionControl, error) {
+	if err := normalizeReleaseSessionMutationLeaseRequest(&request); err != nil {
+		return nil, err
+	}
+	fence, snapshot, err := s.requireControllerEpoch(ctx, request.Fence)
+	if err != nil {
+		return nil, err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	request.Fence = fence
+	if pending, pendingErr := s.sessionCleanupPending(ctx, request.Namespace, request.SessionName); pendingErr != nil {
+		return nil, pendingErr
+	} else if pending {
+		return nil, controlConflict("session %s/%s is being deleted", request.Namespace, request.SessionName)
+	}
+
+	object, err := s.getSessionControlObject(ctx, request.Namespace, request.SessionName)
+	if err != nil {
+		return nil, err
+	}
+	control := sessionControlFromObject(object)
+	if control.SessionUID != request.SessionUID {
+		return nil, controlConflict("session %s/%s UID does not match immutable control record", request.Namespace, request.SessionName)
+	}
+	if control.LastOperationID == request.OperationID {
+		if control.LastOperationDigest != request.OperationDigest || control.Lease != nil {
+			return nil, controlConflict("session lease release operation %q was already applied with different target values", request.OperationID)
+		}
+	} else {
+		if control.Version != request.ExpectedSessionVersion || !sessionLeaseMatchesKey(control.Lease, request.Key) || control.Lease.RequestDigest != request.LeaseRequestDigest {
+			return nil, controlConflict("session %s/%s no longer matches the pre-prompt lease release fence", request.Namespace, request.SessionName)
+		}
+		if err := s.verifyMirroredSessionLease(ctx, object, *control.Lease); err != nil {
+			return nil, err
+		}
+		updated := object.DeepCopy()
+		updated.Status.MutationLease = nil
+		setMutationStatus(&updated.Status.ControlRecordMutationStatus, fence, snapshot, control.Version+1, request.OperationID, request.OperationDigest, control.CreatedAt, request.ReleasedAt)
+		if err := s.client.Status().Update(ctx, updated); err != nil {
+			return nil, mapKubernetesError("release pre-prompt Session mutation Lease status", err)
+		}
+		object = updated
+		control = sessionControlFromObject(updated)
+	}
+	if err := s.releaseFinalizedSessionLease(ctx, object, request.Key, request.LeaseRequestDigest); err != nil {
+		return nil, err
+	}
+	return &control, nil
+}
+
+func (s *Store) finishPendingPrePromptLeaseRelease(ctx context.Context, control store.SessionControl, lease *coordinationv1.Lease, state sessionLeaseState) (*coordinationv1.Lease, sessionLeaseState, error) {
+	if control.Lease != nil || !strings.HasPrefix(control.LastOperationID, prePromptLeaseReleasePrefix) || lease.Spec.HolderIdentity == nil || *lease.Spec.HolderIdentity == "" {
+		return lease, state, nil
+	}
+	key := store.SessionTurnKey{
+		SessionUID: control.SessionUID, LeaseGeneration: state.Generation,
+		TaskUID: state.TaskUID, Attempt: state.Attempt, PromptID: state.PromptID,
+	}
+	turnID, err := key.CanonicalID()
+	if err != nil || control.LastOperationID != prePromptLeaseReleasePrefix+turnID || state.Mode != leaseModeMutation {
+		return nil, sessionLeaseState{}, controlConflict("pending pre-prompt Session lease release does not match the authoritative Lease")
+	}
+	expectedDigest, err := store.SessionLeaseReleaseOperationDigest(turnID, state.RequestDigest)
+	if err != nil || control.LastOperationDigest != expectedDigest {
+		return nil, sessionLeaseState{}, controlConflict("pending pre-prompt Session lease release digest does not match the authoritative Lease")
+	}
+	updated := lease.DeepCopy()
+	clearSessionLease(updated, state.Generation)
+	if err := s.client.Update(ctx, updated); err != nil {
+		return nil, sessionLeaseState{}, mapKubernetesError("finish pre-prompt Session Lease release", err)
+	}
+	fresh, freshState, err := s.getSessionLease(ctx, control.Namespace, control.SessionName, control.SessionUID)
+	return fresh, freshState, err
+}
+
+// ReconcileSessionControl establishes the independently observed baseline and
+// returns both SessionControl and BranchClaim to Available. A Session Lease is
+// held in reconciliation mode while the two status CAS operations complete;
+// retries finish any partially committed same-operation reconciliation.
+func (s *Store) ReconcileSessionControl(ctx context.Context, request store.ReconcileSessionControlRequest) (*store.SessionControl, error) {
+	if err := normalizeReconcileSessionControlRequest(&request); err != nil {
+		return nil, err
+	}
+	fence, snapshot, err := s.requireControllerEpoch(ctx, request.Fence)
+	if err != nil {
+		return nil, err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	request.Fence = fence
+	if pending, pendingErr := s.sessionCleanupPending(ctx, request.Namespace, request.SessionName); pendingErr != nil {
+		return nil, pendingErr
+	} else if pending {
+		return nil, controlConflict("session %s/%s is being deleted", request.Namespace, request.SessionName)
+	}
+
+	object, err := s.getSessionControlObject(ctx, request.Namespace, request.SessionName)
+	if err != nil {
+		return nil, err
+	}
+	control := sessionControlFromObject(object)
+	alreadyCommitted, err := sessionReconciliationAlreadyCommitted(control, request)
+	if err != nil {
+		return nil, err
+	}
+	if alreadyCommitted {
+		return s.finishCommittedSessionReconciliation(ctx, object, control, request, fence, snapshot)
+	}
+	if err := validateBlockedSessionReconciliationFence(control, request); err != nil {
+		return nil, err
+	}
+	if err := s.acquireSessionReconciliationLease(ctx, object, request); err != nil {
+		return nil, err
+	}
+	if err := s.ensureBranchReconciliationApplied(ctx, request, fence, snapshot); err != nil {
+		return nil, err
+	}
+	fresh, freshControl, err := s.commitSessionReconciliationStatus(ctx, request, fence, snapshot)
+	if err != nil {
+		return nil, err
+	}
+	if err := s.clearReconciliationSessionLease(ctx, fresh, request); err != nil {
+		return nil, err
+	}
+	return &freshControl, nil
+}
+
+func sessionReconciliationAlreadyCommitted(control store.SessionControl, request store.ReconcileSessionControlRequest) (bool, error) {
+	if control.LastOperationID != request.OperationID {
+		return false, nil
+	}
+	if control.LastOperationDigest != request.OperationDigest {
+		return false, controlConflict("session reconciliation operation %q was reused with a different digest", request.OperationID)
+	}
+	if control.Availability != store.SessionAvailable || control.Lease != nil || control.VerifiedBaseline == nil || !reflect.DeepEqual(*control.VerifiedBaseline, request.VerifiedBaseline) {
+		return false, controlConflict("session reconciliation operation %q was already applied with different target values", request.OperationID)
+	}
+	return true, nil
+}
+
+func validateBlockedSessionReconciliationFence(control store.SessionControl, request store.ReconcileSessionControlRequest) error {
+	if control.SessionUID != request.SessionUID || control.Version != request.ExpectedVersion ||
+		control.LeaseGeneration != request.ExpectedLeaseGeneration || control.Lease != nil ||
+		control.Availability != store.SessionReconciliationBlocked ||
+		control.RelatedPublicationID != request.ExpectedRelatedPublicationID {
+		return controlConflict("session %s/%s no longer matches the blocked reconciliation fence", request.Namespace, request.SessionName)
+	}
+	return nil
+}
+
+func (s *Store) finishCommittedSessionReconciliation(ctx context.Context, object *corev1alpha1.RuntimeSessionControl, control store.SessionControl, request store.ReconcileSessionControlRequest, fence store.ControllerEpochFence, snapshot epochSnapshot) (*store.SessionControl, error) {
+	if err := s.ensureBranchReconciliationApplied(ctx, request, fence, snapshot); err != nil {
+		return nil, err
+	}
+	if err := s.clearReconciliationSessionLease(ctx, object, request); err != nil {
+		return nil, err
+	}
+	return &control, nil
+}
+
+func (s *Store) acquireSessionReconciliationLease(ctx context.Context, object *corev1alpha1.RuntimeSessionControl, request store.ReconcileSessionControlRequest) error {
+	lease, leaseState, err := s.getSessionLease(ctx, object.Namespace, object.Spec.SessionName, object.Spec.SessionUID)
+	if err != nil {
+		return err
+	}
+	if leaseState.Generation != request.ExpectedLeaseGeneration {
+		return controlConflict("session reconciliation Lease generation no longer matches")
+	}
+	if lease.Spec.HolderIdentity == nil || *lease.Spec.HolderIdentity == "" {
+		updatedLease := lease.DeepCopy()
+		setSessionReconciliationLease(updatedLease, request)
+		if err := s.client.Update(ctx, updatedLease); err != nil {
+			return mapKubernetesError("acquire Session reconciliation Lease", err)
+		}
+		return nil
+	}
+	if leaseState.Mode != leaseModeReconciliation || leaseState.OperationID != request.OperationID || leaseState.OperationHash != request.OperationDigest {
+		return controlConflict("session %s/%s coordination Lease is held by another operation", request.Namespace, request.SessionName)
+	}
+	return nil
+}
+
+func (s *Store) commitSessionReconciliationStatus(ctx context.Context, request store.ReconcileSessionControlRequest, fence store.ControllerEpochFence, snapshot epochSnapshot) (*corev1alpha1.RuntimeSessionControl, store.SessionControl, error) {
+	fresh, err := s.getSessionControlObject(ctx, request.Namespace, request.SessionName)
+	if err != nil {
+		return nil, store.SessionControl{}, err
+	}
+	freshControl := sessionControlFromObject(fresh)
+	alreadyCommitted, err := sessionReconciliationAlreadyCommitted(freshControl, request)
+	if err != nil {
+		return nil, store.SessionControl{}, err
+	}
+	if alreadyCommitted {
+		return fresh, freshControl, nil
+	}
+	if err := validateBlockedSessionReconciliationFence(freshControl, request); err != nil {
+		return nil, store.SessionControl{}, err
+	}
+	updated := fresh.DeepCopy()
+	updated.Status.Availability = corev1alpha1.RuntimeSessionControlAvailability(store.SessionAvailable)
+	updated.Status.BlockedReason = ""
+	updated.Status.RelatedPromptAttemptID = ""
+	updated.Status.RelatedPublicationID = ""
+	updated.Status.VerifiedBaseline = verifiedBaselineToAPI(&request.VerifiedBaseline)
+	setMutationStatus(&updated.Status.ControlRecordMutationStatus, fence, snapshot, freshControl.Version+1, request.OperationID, request.OperationDigest, freshControl.CreatedAt, request.ReconciledAt)
+	if err := s.client.Status().Update(ctx, updated); err != nil {
+		return nil, store.SessionControl{}, mapKubernetesError("reconcile runtime session control", err)
+	}
+	return updated, sessionControlFromObject(updated), nil
+}
+
+func (s *Store) completeSessionControlCreation(ctx context.Context, object *corev1alpha1.RuntimeSessionControl, normalized store.SessionControl, fence store.ControllerEpochFence, snapshot epochSnapshot) (*store.SessionControl, error) {
+	if !sameSessionControlSpec(object, normalized) {
+		return nil, controlConflict("session control %s/%s was reused with a different UID or request digest", normalized.Namespace, normalized.SessionName)
+	}
+	_, err := s.ensureSessionLease(ctx, object.Namespace, object.Spec.SessionName, object.Spec.SessionUID, normalized.LeaseGeneration)
+	if err != nil {
+		return nil, err
+	}
+	if object.Status.Version > 0 {
+		existing := sessionControlFromObject(object)
+		return &existing, nil
+	}
+	updated := object.DeepCopy()
+	updated.Status.Availability = corev1alpha1.RuntimeSessionControlAvailability(normalized.Availability)
+	updated.Status.MutationLeaseGeneration = normalized.LeaseGeneration
+	updated.Status.BlockedReason = normalized.BlockedReason
+	updated.Status.RelatedPromptAttemptID = normalized.RelatedPromptAttemptID
+	updated.Status.RelatedPublicationID = normalized.RelatedPublicationID
+	updated.Status.VerifiedBaseline = verifiedBaselineToAPI(normalized.VerifiedBaseline)
+	setMutationStatus(&updated.Status.ControlRecordMutationStatus, fence, snapshot, 1, "", "", normalized.CreatedAt, normalized.UpdatedAt)
+	if err := s.client.Status().Update(ctx, updated); err != nil {
+		if apierrors.IsConflict(err) {
+			fresh, getErr := s.getSessionControlObject(ctx, normalized.Namespace, normalized.SessionName)
+			if getErr == nil && sameSessionControlSpec(fresh, normalized) && fresh.Status.Version > 0 {
+				result := sessionControlFromObject(fresh)
+				return &result, nil
+			}
+		}
+		return nil, mapKubernetesError("initialize runtime session control status", err)
+	}
+	result := sessionControlFromObject(updated)
+	return &result, nil
+}
+
+func (s *Store) completeSessionLeaseStatus(ctx context.Context, object *corev1alpha1.RuntimeSessionControl, control store.SessionControl, request store.AcquireSessionMutationLeaseRequest, fence store.ControllerEpochFence, snapshot epochSnapshot, lease *coordinationv1.Lease) (*store.SessionControl, error) {
+	state, err := sessionLeaseFromObject(lease, object.Spec.SessionName, object.Spec.SessionUID)
+	if err != nil {
+		return nil, err
+	}
+	if !sameSessionMutationLease(state, request) || state.Generation != request.ExpectedLeaseGeneration+1 {
+		return nil, controlConflict("Session mutation Lease does not match requested ownership")
+	}
+	fresh, err := s.getSessionControlObject(ctx, request.Namespace, request.SessionName)
+	if err != nil {
+		return nil, err
+	}
+	freshControl := sessionControlFromObject(fresh)
+	if freshControl.Lease != nil {
+		if sameSessionMutationLeaseValue(*freshControl.Lease, request) && freshControl.LeaseGeneration == state.Generation {
+			return s.completeExistingSessionLineage(ctx, fresh, freshControl, request, fence, snapshot)
+		}
+		return nil, controlConflict("session %s/%s status is already leased by another operation", request.Namespace, request.SessionName)
+	}
+	if freshControl.Version != request.ExpectedVersion || freshControl.LeaseGeneration != request.ExpectedLeaseGeneration || freshControl.Availability != store.SessionAvailable {
+		return nil, controlConflict("session %s/%s changed before Lease status could be committed", request.Namespace, request.SessionName)
+	}
+	lineage, err := resolveSessionLineage(freshControl.Lineage, *request.Lineage, request.AcquiredAt)
+	if err != nil {
+		return nil, err
+	}
+	updated := fresh.DeepCopy()
+	updated.Status.MutationLeaseGeneration = state.Generation
+	updated.Status.MutationLease = sessionMutationLeaseToAPI(lease, state)
+	updated.Status.Lineage = sessionLineageToAPI(lineage)
+	setMutationStatus(&updated.Status.ControlRecordMutationStatus, fence, snapshot, freshControl.Version+1, freshControl.LastOperationID, freshControl.LastOperationDigest, freshControl.CreatedAt, request.AcquiredAt)
+	if err := s.client.Status().Update(ctx, updated); err != nil {
+		return nil, mapKubernetesError("commit Session mutation Lease status", err)
+	}
+	result := sessionControlFromObject(updated)
+	_ = control
+	return &result, nil
+}
+
+// completeExistingSessionLineage handles an idempotent retry whose exact
+// coordination Lease is already mirrored. Pre-coexistence controls may have a
+// mirrored Lease but no lineage; appending the lineage remains fenced by that
+// exact Lease and one RuntimeSessionControl status CAS.
+func (s *Store) completeExistingSessionLineage(ctx context.Context, object *corev1alpha1.RuntimeSessionControl, control store.SessionControl, request store.AcquireSessionMutationLeaseRequest, fence store.ControllerEpochFence, snapshot epochSnapshot) (*store.SessionControl, error) {
+	lineage, err := resolveSessionLineage(control.Lineage, *request.Lineage, request.AcquiredAt)
+	if err != nil {
+		return nil, err
+	}
+	if control.Lineage != nil {
+		return &control, nil
+	}
+	updated := object.DeepCopy()
+	updated.Status.Lineage = sessionLineageToAPI(lineage)
+	setMutationStatus(&updated.Status.ControlRecordMutationStatus, fence, snapshot, control.Version+1, control.LastOperationID, control.LastOperationDigest, control.CreatedAt, request.AcquiredAt)
+	if err := s.client.Status().Update(ctx, updated); err != nil {
+		return nil, mapKubernetesError("commit Session lineage under existing mutation Lease", err)
+	}
+	result := sessionControlFromObject(updated)
+	return &result, nil
+}
+
+func (s *Store) verifyMirroredSessionLease(ctx context.Context, object *corev1alpha1.RuntimeSessionControl, expected store.SessionMutationLease) error {
+	lease, state, err := s.getSessionLease(ctx, object.Namespace, object.Spec.SessionName, object.Spec.SessionUID)
+	if err != nil {
+		return err
+	}
+	control := sessionControlFromObject(object)
+	if control.Lineage == nil || lease.ResourceVersion != object.Status.MutationLease.LeaseResourceVersion || state.Mode != leaseModeMutation || state.Generation != expected.Generation || state.TaskUID != expected.TaskUID || state.Attempt != expected.Attempt || state.PromptID != expected.PromptID || state.RequestDigest != expected.RequestDigest || state.LineageDigest != sessionLineageDigest(control.Lineage) {
+		return controlConflict("runtime session status does not match its authoritative mutation Lease")
+	}
+	return nil
+}
+
+func (s *Store) ensureBranchReconciliationApplied(ctx context.Context, request store.ReconcileSessionControlRequest, fence store.ControllerEpochFence, snapshot epochSnapshot) error {
+	object, err := s.getBranchClaimObject(ctx, request.BranchClaimID)
+	if err != nil {
+		return err
+	}
+	claim := branchClaimFromObject(object)
+	if claim.LastOperationID == request.OperationID {
+		if claim.LastOperationDigest == request.OperationDigest && claim.Availability == store.BranchClaimAvailable && claim.RelatedPublicationID == "" && claim.BlockedReason == "" && claim.LastVerified.Equal(store.RemoteRefState{SHA: request.VerifiedBaseline.SHA}) {
+			return nil
+		}
+		return controlConflict("branch reconciliation operation %q was already applied with different target values", request.OperationID)
+	}
+	if claim.Version != request.ExpectedBranchClaimVersion || claim.Generation != request.ExpectedBranchClaimGeneration || !claim.LastVerified.Equal(request.ExpectedBranchBaseline) || claim.Availability != store.BranchClaimReconciliationBlocked || claim.RelatedPublicationID != request.ExpectedRelatedPublicationID || claim.RepositoryID != request.VerifiedBaseline.RepositoryID || claim.Ref != request.VerifiedBaseline.Ref {
+		return controlConflict("branch claim %q no longer matches the blocked reconciliation fence", claim.ID)
+	}
+	updated := object.DeepCopy()
+	verified := remoteRefToAPI(store.RemoteRefState{SHA: request.VerifiedBaseline.SHA})
+	updated.Status.LastVerified = &verified
+	updated.Status.Availability = corev1alpha1.BranchClaimAvailability(store.BranchClaimAvailable)
+	updated.Status.BlockedReason = ""
+	updated.Status.RelatedPublicationID = ""
+	setMutationStatus(&updated.Status.ControlRecordMutationStatus, fence, snapshot, claim.Version+1, request.OperationID, request.OperationDigest, claim.CreatedAt, request.ReconciledAt)
+	if err := s.client.Status().Update(ctx, updated); err != nil {
+		return mapKubernetesError("reconcile branch claim", err)
+	}
+	return nil
+}
+
+func (s *Store) clearReconciliationSessionLease(ctx context.Context, object *corev1alpha1.RuntimeSessionControl, request store.ReconcileSessionControlRequest) error {
+	lease, state, err := s.getSessionLease(ctx, object.Namespace, object.Spec.SessionName, object.Spec.SessionUID)
+	if err != nil {
+		return err
+	}
+	if lease.Spec.HolderIdentity == nil || *lease.Spec.HolderIdentity == "" {
+		return nil
+	}
+	if state.Mode != leaseModeReconciliation || state.OperationID != request.OperationID || state.OperationHash != request.OperationDigest {
+		return controlConflict("Session reconciliation Lease is held by a different operation")
+	}
+	updated := lease.DeepCopy()
+	clearSessionLease(updated, state.Generation)
+	if err := s.client.Update(ctx, updated); err != nil {
+		return mapKubernetesError("release Session reconciliation Lease", err)
+	}
+	return nil
+}
+
+func (s *Store) getSessionControlObject(ctx context.Context, namespace, sessionName string) (*corev1alpha1.RuntimeSessionControl, error) {
+	object := &corev1alpha1.RuntimeSessionControl{}
+	key := client.ObjectKey{Namespace: namespace, Name: runtimeSessionObjectName(sessionName)}
+	if err := s.readClient().Get(ctx, key, object); err != nil {
+		return nil, mapKubernetesError("get runtime session control", err)
+	}
+	if object.Spec.SessionName != sessionName {
+		return nil, controlConflict("runtime session control %s/%s has a different immutable Session name", namespace, object.Name)
+	}
+	return object, nil
+}
+
+func (s *Store) ensureSessionLease(ctx context.Context, namespace, sessionName, sessionUID string, generation int64) (*coordinationv1.Lease, error) {
+	key := client.ObjectKey{Namespace: namespace, Name: runtimeSessionLeaseName(sessionUID)}
+	lease := &coordinationv1.Lease{}
+	if err := s.readClient().Get(ctx, key, lease); err == nil {
+		state, parseErr := sessionLeaseFromObject(lease, sessionName, sessionUID)
+		if parseErr != nil {
+			return nil, parseErr
+		}
+		if state.Generation != generation {
+			return nil, controlConflict("Session Lease generation %d does not match initial generation %d", state.Generation, generation)
+		}
+		return lease, nil
+	} else if !apierrors.IsNotFound(err) {
+		return nil, mapKubernetesError("get Session Lease", err)
+	}
+	lease = &coordinationv1.Lease{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: namespace,
+			Name:      key.Name,
+			Labels:    controlLabels(sessionControlLogicalID(namespace, sessionName)),
+			Annotations: map[string]string{
+				annotationSessionName:     sessionName,
+				annotationSessionUID:      sessionUID,
+				annotationLeaseGeneration: strconv.FormatInt(generation, 10),
+				annotationLeaseMode:       leaseModeEmpty,
+			},
+		},
+	}
+	if err := s.client.Create(ctx, lease); err != nil {
+		if apierrors.IsAlreadyExists(err) {
+			if getErr := s.readClient().Get(ctx, key, lease); getErr != nil {
+				return nil, mapKubernetesError("get concurrently created Session Lease", getErr)
+			}
+			state, parseErr := sessionLeaseFromObject(lease, sessionName, sessionUID)
+			if parseErr != nil {
+				return nil, parseErr
+			}
+			if state.Generation != generation {
+				return nil, controlConflict("Session Lease generation %d does not match initial generation %d", state.Generation, generation)
+			}
+			return lease, nil
+		}
+		return nil, mapKubernetesError("create Session Lease", err)
+	}
+	return lease, nil
+}
+
+func (s *Store) getSessionLease(ctx context.Context, namespace, sessionName, sessionUID string) (*coordinationv1.Lease, sessionLeaseState, error) {
+	lease := &coordinationv1.Lease{}
+	key := client.ObjectKey{Namespace: namespace, Name: runtimeSessionLeaseName(sessionUID)}
+	if err := s.readClient().Get(ctx, key, lease); err != nil {
+		return nil, sessionLeaseState{}, mapKubernetesError("get Session Lease", err)
+	}
+	state, err := sessionLeaseFromObject(lease, sessionName, sessionUID)
+	return lease, state, err
+}
+
+func sessionLeaseFromObject(lease *coordinationv1.Lease, sessionName, sessionUID string) (sessionLeaseState, error) {
+	annotations := lease.Annotations
+	if annotations[annotationSessionName] != sessionName || annotations[annotationSessionUID] != sessionUID {
+		return sessionLeaseState{}, fmt.Errorf("session Lease %s/%s identity mismatch", lease.Namespace, lease.Name)
+	}
+	generation, err := parseNonNegativeInt64("Session Lease generation", annotations[annotationLeaseGeneration])
+	if err != nil {
+		return sessionLeaseState{}, err
+	}
+	state := sessionLeaseState{Mode: annotations[annotationLeaseMode], Generation: generation}
+	switch state.Mode {
+	case leaseModeEmpty:
+		if lease.Spec.HolderIdentity != nil && *lease.Spec.HolderIdentity != "" {
+			return sessionLeaseState{}, fmt.Errorf("empty Session Lease %s/%s has a holder", lease.Namespace, lease.Name)
+		}
+	case leaseModeMutation:
+		state.TaskUID = annotations[annotationTaskUID]
+		state.PromptID = annotations[annotationPromptID]
+		state.RequestDigest = annotations[annotationRequestDigest]
+		state.LineageDigest = annotations[annotationSessionLineage]
+		if err := store.ValidateCanonicalDigest("Session Lease lineage digest", state.LineageDigest); err != nil {
+			return sessionLeaseState{}, err
+		}
+		state.Attempt, err = parsePositiveInt64("Session Lease attempt", annotations[annotationAttempt])
+		if err != nil {
+			return sessionLeaseState{}, err
+		}
+		state.AcquiredAt, err = parseTime("Session Lease acquisition time", annotations[annotationAcquiredAt])
+		if err != nil {
+			return sessionLeaseState{}, err
+		}
+		if encoded := annotations[annotationLeaseExpiresAt]; encoded != "" {
+			expiresAt, parseErr := parseTime("Session Lease expiry", encoded)
+			if parseErr != nil {
+				return sessionLeaseState{}, parseErr
+			}
+			state.ExpiresAt = &expiresAt
+		}
+		if lease.Spec.HolderIdentity == nil || *lease.Spec.HolderIdentity != sessionMutationLeaseHolder(state.TaskUID, state.Attempt, state.PromptID) {
+			return sessionLeaseState{}, controlConflict("Session mutation Lease holder identity does not match its immutable annotations")
+		}
+	case leaseModeReconciliation:
+		state.OperationID = annotations[annotationOperationID]
+		state.OperationHash = annotations[annotationOperationDigest]
+		if lease.Spec.HolderIdentity == nil || *lease.Spec.HolderIdentity != sessionReconciliationLeaseHolder(state.OperationID) {
+			return sessionLeaseState{}, controlConflict("Session reconciliation Lease holder identity does not match its immutable annotations")
+		}
+	default:
+		return sessionLeaseState{}, fmt.Errorf("session Lease %s/%s has unsupported mode %q", lease.Namespace, lease.Name, state.Mode)
+	}
+	return state, nil
+}
+
+func sessionMutationLeaseHolder(taskUID string, attempt int64, promptID string) string {
+	return "mutation:" + dnsDigest(taskUID+"\x00"+strconv.FormatInt(attempt, 10)+"\x00"+promptID)
+}
+
+func sessionReconciliationLeaseHolder(operationID string) string {
+	return "reconcile:" + dnsDigest(operationID)
+}
+
+func setSessionMutationLease(lease *coordinationv1.Lease, request store.AcquireSessionMutationLeaseRequest, generation int64) {
+	if lease.Annotations == nil {
+		lease.Annotations = map[string]string{}
+	}
+	lease.Annotations[annotationLeaseMode] = leaseModeMutation
+	lease.Annotations[annotationLeaseGeneration] = strconv.FormatInt(generation, 10)
+	lease.Annotations[annotationTaskUID] = request.TaskUID
+	lease.Annotations[annotationAttempt] = strconv.FormatInt(request.Attempt, 10)
+	lease.Annotations[annotationPromptID] = request.PromptID
+	lease.Annotations[annotationRequestDigest] = request.RequestDigest
+	lease.Annotations[annotationSessionLineage] = sessionLineageClaimDigest(*request.Lineage)
+	lease.Annotations[annotationAcquiredAt] = formatTime(request.AcquiredAt)
+	delete(lease.Annotations, annotationOperationID)
+	delete(lease.Annotations, annotationOperationDigest)
+	if request.ExpiresAt != nil {
+		lease.Annotations[annotationLeaseExpiresAt] = formatTime(*request.ExpiresAt)
+	} else {
+		delete(lease.Annotations, annotationLeaseExpiresAt)
+	}
+	holder := sessionMutationLeaseHolder(request.TaskUID, request.Attempt, request.PromptID)
+	lease.Spec.HolderIdentity = &holder
+	acquired := metav1.NewMicroTime(request.AcquiredAt)
+	lease.Spec.AcquireTime = &acquired
+	lease.Spec.RenewTime = &acquired
+	lease.Spec.LeaseDurationSeconds = leaseDurationSeconds(request.AcquiredAt, request.ExpiresAt)
+}
+
+func setSessionReconciliationLease(lease *coordinationv1.Lease, request store.ReconcileSessionControlRequest) {
+	if lease.Annotations == nil {
+		lease.Annotations = map[string]string{}
+	}
+	lease.Annotations[annotationLeaseMode] = leaseModeReconciliation
+	lease.Annotations[annotationOperationID] = request.OperationID
+	lease.Annotations[annotationOperationDigest] = request.OperationDigest
+	delete(lease.Annotations, annotationTaskUID)
+	delete(lease.Annotations, annotationAttempt)
+	delete(lease.Annotations, annotationPromptID)
+	delete(lease.Annotations, annotationRequestDigest)
+	delete(lease.Annotations, annotationSessionLineage)
+	delete(lease.Annotations, annotationAcquiredAt)
+	delete(lease.Annotations, annotationLeaseExpiresAt)
+	holder := sessionReconciliationLeaseHolder(request.OperationID)
+	lease.Spec.HolderIdentity = &holder
+	acquired := metav1.NewMicroTime(request.ReconciledAt)
+	lease.Spec.AcquireTime = &acquired
+	lease.Spec.RenewTime = &acquired
+	lease.Spec.LeaseDurationSeconds = nil
+}
+
+func clearSessionLease(lease *coordinationv1.Lease, generation int64) {
+	lease.Annotations[annotationLeaseMode] = leaseModeEmpty
+	lease.Annotations[annotationLeaseGeneration] = strconv.FormatInt(generation, 10)
+	for _, key := range []string{annotationTaskUID, annotationAttempt, annotationPromptID, annotationRequestDigest, annotationSessionLineage, annotationAcquiredAt, annotationLeaseExpiresAt, annotationOperationID, annotationOperationDigest} {
+		delete(lease.Annotations, key)
+	}
+	lease.Spec.HolderIdentity = nil
+	lease.Spec.AcquireTime = nil
+	lease.Spec.RenewTime = nil
+	lease.Spec.LeaseDurationSeconds = nil
+}
+
+func leaseDurationSeconds(acquired time.Time, expires *time.Time) *int32 {
+	if expires == nil {
+		return nil
+	}
+	seconds := int64(expires.Sub(acquired).Round(time.Second) / time.Second)
+	seconds = max(seconds, 1)
+	seconds = min(seconds, int64(math.MaxInt32))
+	result := int32(seconds)
+	return &result
+}
+
+func sessionMutationLeaseToAPI(lease *coordinationv1.Lease, state sessionLeaseState) *corev1alpha1.RuntimeSessionMutationLeaseStatus {
+	result := &corev1alpha1.RuntimeSessionMutationLeaseStatus{
+		LeaseName:            lease.Name,
+		LeaseResourceVersion: lease.ResourceVersion,
+		Generation:           state.Generation,
+		TaskUID:              state.TaskUID,
+		Attempt:              state.Attempt,
+		PromptID:             state.PromptID,
+		RequestDigest:        state.RequestDigest,
+		AcquiredAt:           metav1.NewTime(state.AcquiredAt),
+	}
+	if state.ExpiresAt != nil {
+		value := metav1.NewTime(*state.ExpiresAt)
+		result.ExpiresAt = &value
+	}
+	return result
+}
+
+func sameSessionMutationLease(state sessionLeaseState, request store.AcquireSessionMutationLeaseRequest) bool {
+	return state.Mode == leaseModeMutation && state.TaskUID == request.TaskUID && state.Attempt == request.Attempt && state.PromptID == request.PromptID && state.RequestDigest == request.RequestDigest && state.LineageDigest == sessionLineageClaimDigest(*request.Lineage)
+}
+
+func sameSessionMutationLeaseValue(value store.SessionMutationLease, request store.AcquireSessionMutationLeaseRequest) bool {
+	return value.TaskUID == request.TaskUID && value.Attempt == request.Attempt && value.PromptID == request.PromptID && value.RequestDigest == request.RequestDigest
+}
+
+func sessionLineageClaimDigest(claim store.ClaimSessionLineageRequest) string {
+	canonical, _ := json.Marshal(struct {
+		Namespace         string `json:"namespace"`
+		SessionName       string `json:"sessionName"`
+		NamespaceUID      string `json:"namespaceUID"`
+		SessionUID        string `json:"sessionUID"`
+		ContractVersion   string `json:"contractVersion"`
+		LineageGeneration int64  `json:"lineageGeneration"`
+		RuntimeIdentity   string `json:"runtimeIdentity"`
+		ConfigDigest      string `json:"configDigest"`
+	}{
+		Namespace: claim.Namespace, SessionName: claim.SessionName,
+		NamespaceUID: claim.NamespaceUID, SessionUID: claim.SessionUID,
+		ContractVersion: claim.ContractVersion, LineageGeneration: claim.LineageGeneration,
+		RuntimeIdentity: claim.RuntimeIdentity, ConfigDigest: claim.ConfigDigest,
+	})
+	return canonicalBytesDigest(append([]byte("orka.session-lineage.v2\x00"), canonical...))
+}
+
+func sessionLineageDigest(lineage *store.SessionLineage) string {
+	return sessionLineageClaimDigest(store.ClaimSessionLineageRequest{
+		Namespace: lineage.Namespace, SessionName: lineage.SessionName,
+		NamespaceUID: lineage.NamespaceUID, SessionUID: lineage.SessionUID,
+		ContractVersion: lineage.ContractVersion, RuntimeIdentity: lineage.RuntimeIdentity,
+		LineageGeneration: lineage.LineageGeneration,
+		ConfigDigest:      lineage.ConfigDigest,
+	})
+}
+
+func runtimeSessionObjectName(sessionName string) string {
+	return objectName(runtimeSessionNamePrefix, sessionName)
+}
+
+func runtimeSessionLeaseName(sessionUID string) string {
+	return objectName(runtimeSessionLeasePrefix, sessionUID)
+}
+
+func sessionControlLogicalID(namespace, sessionName string) string {
+	return store.CanonicalControlID("runtime-session-control", namespace, sessionName)
+}
+
+func sameSessionControlSpec(object *corev1alpha1.RuntimeSessionControl, control store.SessionControl) bool {
+	return object.Namespace == control.Namespace && object.Spec.SessionName == control.SessionName && object.Spec.SessionUID == control.SessionUID && object.Spec.RequestDigest == control.RequestDigest
+}
+
+func sessionControlFromObject(object *corev1alpha1.RuntimeSessionControl) store.SessionControl {
+	result := store.SessionControl{
+		Namespace:              object.Namespace,
+		SessionName:            object.Spec.SessionName,
+		SessionUID:             object.Spec.SessionUID,
+		RequestDigest:          object.Spec.RequestDigest,
+		Availability:           store.SessionAvailability(object.Status.Availability),
+		LeaseGeneration:        object.Status.MutationLeaseGeneration,
+		BlockedReason:          object.Status.BlockedReason,
+		RelatedPromptAttemptID: object.Status.RelatedPromptAttemptID,
+		RelatedPublicationID:   object.Status.RelatedPublicationID,
+		VerifiedBaseline:       verifiedBaselineFromAPI(object.Status.VerifiedBaseline),
+		Lineage:                sessionLineageFromAPI(object),
+		ControllerEpochName:    object.Status.ControllerEpochName,
+		ControllerEpoch:        object.Status.ControllerEpoch,
+		LastOperationID:        object.Status.LastOperationID,
+		LastOperationDigest:    object.Status.LastOperationDigest,
+		Version:                object.Status.Version,
+		CreatedAt:              timeValue(object.Status.CreatedAt),
+		UpdatedAt:              timeValue(object.Status.UpdatedAt),
+	}
+	if object.Status.MutationLease != nil {
+		result.Lease = &store.SessionMutationLease{
+			Generation:    object.Status.MutationLease.Generation,
+			TaskUID:       object.Status.MutationLease.TaskUID,
+			Attempt:       object.Status.MutationLease.Attempt,
+			PromptID:      object.Status.MutationLease.PromptID,
+			RequestDigest: object.Status.MutationLease.RequestDigest,
+			AcquiredAt:    object.Status.MutationLease.AcquiredAt.UTC(),
+			ExpiresAt:     optionalTimeValue(object.Status.MutationLease.ExpiresAt),
+		}
+	}
+	return result
+}
+
+func sessionLineageFromAPI(object *corev1alpha1.RuntimeSessionControl) *store.SessionLineage {
+	if object == nil || object.Status.Lineage == nil {
+		return nil
+	}
+	lineage := object.Status.Lineage
+	establishedAt := lineage.EstablishedAt.UTC()
+	return &store.SessionLineage{
+		Namespace: object.Namespace, SessionName: object.Spec.SessionName,
+		NamespaceUID: string(lineage.NamespaceUID), SessionUID: lineage.SessionUID,
+		ContractVersion: string(lineage.ContractVersion), LineageGeneration: lineage.Generation,
+		RuntimeIdentity: lineage.RuntimeIdentity, ConfigDigest: lineage.ConfigDigest, Version: 1,
+		CreatedAt: establishedAt, UpdatedAt: establishedAt,
+	}
+}
+
+func sessionLineageToAPI(lineage *store.SessionLineage) *corev1alpha1.RuntimeSessionLineageStatus {
+	if lineage == nil {
+		return nil
+	}
+	return &corev1alpha1.RuntimeSessionLineageStatus{
+		NamespaceUID: types.UID(lineage.NamespaceUID), SessionUID: lineage.SessionUID,
+		ContractVersion: corev1alpha1.AgentRuntimeContractVersion(lineage.ContractVersion),
+		Generation:      lineage.LineageGeneration, RuntimeIdentity: lineage.RuntimeIdentity,
+		ConfigDigest:  lineage.ConfigDigest,
+		EstablishedAt: metav1.NewTime(lineage.CreatedAt.UTC()),
+	}
+}
+
+func resolveSessionLineage(existing *store.SessionLineage, claim store.ClaimSessionLineageRequest, establishedAt time.Time) (*store.SessionLineage, error) {
+	if existing == nil {
+		if !claim.EstablishIfAbsent {
+			return nil, controlConflict("session %s/%s is nonempty or otherwise unclassified and has no Kubernetes-authoritative lineage", claim.Namespace, claim.SessionName)
+		}
+		if claim.LineageGeneration != 1 {
+			return nil, controlConflict("new session %s/%s lineage must start at generation 1", claim.Namespace, claim.SessionName)
+		}
+		lineage := &store.SessionLineage{
+			Namespace: claim.Namespace, SessionName: claim.SessionName,
+			NamespaceUID: claim.NamespaceUID, SessionUID: claim.SessionUID,
+			ContractVersion: claim.ContractVersion, LineageGeneration: claim.LineageGeneration,
+			RuntimeIdentity: claim.RuntimeIdentity, ConfigDigest: claim.ConfigDigest, Version: 1,
+			CreatedAt: establishedAt.UTC(), UpdatedAt: establishedAt.UTC(),
+		}
+		if err := lineage.Validate(); err != nil {
+			return nil, err
+		}
+		return lineage, nil
+	}
+	switch {
+	case existing.Namespace != claim.Namespace || existing.SessionName != claim.SessionName:
+		return nil, controlConflict("session lineage belongs to a different namespace or Session name")
+	case existing.NamespaceUID != claim.NamespaceUID:
+		return nil, controlConflict("session %s/%s lineage belongs to a different namespace UID", claim.Namespace, claim.SessionName)
+	case existing.SessionUID != claim.SessionUID:
+		return nil, controlConflict("session %s/%s lineage belongs to a different Session UID", claim.Namespace, claim.SessionName)
+	case existing.ContractVersion != claim.ContractVersion:
+		return nil, controlConflict("session %s/%s lineage contract is %s, not %s", claim.Namespace, claim.SessionName, existing.ContractVersion, claim.ContractVersion)
+	case existing.RuntimeIdentity != claim.RuntimeIdentity:
+		return nil, controlConflict("session %s/%s lineage runtime identity is %q, not %q", claim.Namespace, claim.SessionName, existing.RuntimeIdentity, claim.RuntimeIdentity)
+	case existing.ConfigDigest != claim.ConfigDigest:
+		return nil, controlConflict("session %s/%s lineage configuration digest does not match", claim.Namespace, claim.SessionName)
+	case existing.LineageGeneration != claim.LineageGeneration:
+		return nil, controlConflict("session %s/%s lineage generation is %d, not %d", claim.Namespace, claim.SessionName, existing.LineageGeneration, claim.LineageGeneration)
+	default:
+		return existing, nil
+	}
+}
+
+func normalizeSessionControlForCreate(control *store.SessionControl, fence store.ControllerEpochFence) (store.SessionControl, store.ControllerEpochFence, error) {
+	if control == nil {
+		return store.SessionControl{}, store.ControllerEpochFence{}, store.ValidationErrorf("session control is required")
+	}
+	normalized := *control
+	normalized.Namespace = strings.TrimSpace(normalized.Namespace)
+	normalized.SessionName = strings.TrimSpace(normalized.SessionName)
+	normalized.SessionUID = strings.TrimSpace(normalized.SessionUID)
+	for field, value := range map[string]string{
+		sessionControlFieldNamespace: normalized.Namespace,
+		sessionControlFieldName:      normalized.SessionName,
+		sessionControlFieldUID:       normalized.SessionUID,
+	} {
+		if err := store.ValidateControlIdentifier(field, value); err != nil {
+			return store.SessionControl{}, store.ControllerEpochFence{}, err
+		}
+	}
+	if err := store.ValidateCanonicalDigest("session control request digest", normalized.RequestDigest); err != nil {
+		return store.SessionControl{}, store.ControllerEpochFence{}, err
+	}
+	if normalized.Availability == "" {
+		normalized.Availability = store.SessionAvailable
+	}
+	if normalized.Availability != store.SessionAvailable && normalized.Availability != store.SessionReconciliationBlocked {
+		return store.SessionControl{}, store.ControllerEpochFence{}, store.ValidationErrorf("unsupported session availability %q", normalized.Availability)
+	}
+	if normalized.Lease != nil {
+		return store.SessionControl{}, store.ControllerEpochFence{}, store.ValidationErrorf("new session control must not contain an active lease")
+	}
+	if normalized.Lineage != nil {
+		return store.SessionControl{}, store.ControllerEpochFence{}, store.ValidationErrorf("new session control lineage must be established with mutation Lease acquisition")
+	}
+	if normalized.LeaseGeneration < 0 {
+		return store.SessionControl{}, store.ControllerEpochFence{}, store.ValidationErrorf("session lease generation must not be negative")
+	}
+	normalized.BlockedReason = strings.TrimSpace(normalized.BlockedReason)
+	normalized.RelatedPromptAttemptID = strings.TrimSpace(normalized.RelatedPromptAttemptID)
+	normalized.RelatedPublicationID = strings.TrimSpace(normalized.RelatedPublicationID)
+	if normalized.Availability == store.SessionAvailable && (normalized.BlockedReason != "" || normalized.RelatedPromptAttemptID != "" || normalized.RelatedPublicationID != "") {
+		return store.SessionControl{}, store.ControllerEpochFence{}, store.ValidationErrorf("available session control must not contain reconciliation block metadata")
+	}
+	if normalized.Availability == store.SessionReconciliationBlocked && normalized.BlockedReason == "" {
+		return store.SessionControl{}, store.ControllerEpochFence{}, store.ValidationErrorf("reconciliation-blocked session requires a reason")
+	}
+	if err := store.ValidateControlReason("session blocked reason", normalized.BlockedReason); err != nil {
+		return store.SessionControl{}, store.ControllerEpochFence{}, err
+	}
+	if normalized.VerifiedBaseline != nil {
+		copyBaseline := *normalized.VerifiedBaseline
+		normalized.VerifiedBaseline = &copyBaseline
+		if err := validateVerifiedBaseline(copyBaseline); err != nil {
+			return store.SessionControl{}, store.ControllerEpochFence{}, err
+		}
+	}
+	normalizedFence, err := normalizeEpochFence(fence)
+	if err != nil {
+		return store.SessionControl{}, store.ControllerEpochFence{}, err
+	}
+	if normalized.Version != 0 && normalized.Version != 1 {
+		return store.SessionControl{}, store.ControllerEpochFence{}, store.ValidationErrorf("new session control version must be zero or one")
+	}
+	now := normalizeControlTime(normalized.CreatedAt)
+	normalized.CreatedAt = now
+	if normalized.UpdatedAt.IsZero() {
+		normalized.UpdatedAt = now
+	} else {
+		normalized.UpdatedAt = normalized.UpdatedAt.UTC()
+	}
+	normalized.ControllerEpochName = normalizedFence.Name
+	normalized.ControllerEpoch = normalizedFence.Epoch
+	normalized.Version = 1
+	return normalized, normalizedFence, nil
+}
+
+func normalizeAcquireSessionMutationLeaseRequest(request *store.AcquireSessionMutationLeaseRequest) error {
+	request.Namespace = strings.TrimSpace(request.Namespace)
+	request.SessionName = strings.TrimSpace(request.SessionName)
+	request.SessionUID = strings.TrimSpace(request.SessionUID)
+	request.TaskUID = strings.TrimSpace(request.TaskUID)
+	request.PromptID = strings.TrimSpace(request.PromptID)
+	for field, value := range map[string]string{
+		sessionControlFieldNamespace: request.Namespace,
+		sessionControlFieldName:      request.SessionName,
+		sessionControlFieldUID:       request.SessionUID,
+		"lease task UID":             request.TaskUID,
+		"lease prompt ID":            request.PromptID,
+	} {
+		if err := store.ValidateControlIdentifier(field, value); err != nil {
+			return err
+		}
+	}
+	if request.ExpectedVersion < 1 || request.ExpectedLeaseGeneration < 0 || request.Attempt < 1 {
+		return store.ValidationErrorf("session expected version and attempt must be at least 1 and lease generation must not be negative")
+	}
+	if err := store.ValidateCanonicalDigest("session lease request digest", request.RequestDigest); err != nil {
+		return err
+	}
+	if request.Lineage == nil {
+		return store.ValidationErrorf("session lineage claim is required for Kubernetes mutation Lease acquisition")
+	}
+	lineage := *request.Lineage
+	lineage.Namespace = strings.TrimSpace(lineage.Namespace)
+	lineage.SessionName = strings.TrimSpace(lineage.SessionName)
+	lineage.NamespaceUID = strings.TrimSpace(lineage.NamespaceUID)
+	lineage.SessionUID = strings.TrimSpace(lineage.SessionUID)
+	lineage.ContractVersion = strings.TrimSpace(lineage.ContractVersion)
+	lineage.RuntimeIdentity = strings.TrimSpace(lineage.RuntimeIdentity)
+	lineage.ConfigDigest = strings.TrimSpace(lineage.ConfigDigest)
+	if err := lineage.Validate(); err != nil {
+		return err
+	}
+	if lineage.Namespace != request.Namespace || lineage.SessionName != request.SessionName || lineage.SessionUID != request.SessionUID {
+		return store.ValidationErrorf("session lineage namespace, name, and UID must match the mutation Lease request")
+	}
+	request.Lineage = &lineage
+	request.AcquiredAt = normalizeControlTime(request.AcquiredAt)
+	request.ExpiresAt = normalizeOptionalControlTime(request.ExpiresAt)
+	if request.ExpiresAt != nil && !request.ExpiresAt.After(request.AcquiredAt) {
+		return store.ValidationErrorf("session lease expiry must be after acquisition")
+	}
+	return nil
+}
+
+func normalizeReleaseSessionMutationLeaseRequest(request *store.ReleaseSessionMutationLeaseRequest) error {
+	request.Namespace = strings.TrimSpace(request.Namespace)
+	request.SessionName = strings.TrimSpace(request.SessionName)
+	request.SessionUID = strings.TrimSpace(request.SessionUID)
+	request.OperationID = strings.TrimSpace(request.OperationID)
+	for field, value := range map[string]string{
+		sessionControlFieldNamespace: request.Namespace, sessionControlFieldName: request.SessionName,
+		sessionControlFieldUID: request.SessionUID, "session lease release operation ID": request.OperationID,
+	} {
+		if err := store.ValidateControlIdentifier(field, value); err != nil {
+			return err
+		}
+	}
+	if err := request.Key.Validate(); err != nil {
+		return err
+	}
+	if request.Key.SessionUID != request.SessionUID || request.ExpectedSessionVersion < 1 || request.OperationID != prePromptLeaseReleasePrefix+mustSessionTurnID(request.Key) {
+		return store.ValidationErrorf("session lease release identity/version is invalid")
+	}
+	if err := store.ValidateCanonicalDigest("session lease request digest", request.LeaseRequestDigest); err != nil {
+		return err
+	}
+	if err := store.ValidateCanonicalDigest("session lease release operation digest", request.OperationDigest); err != nil {
+		return err
+	}
+	expectedDigest, err := store.SessionLeaseReleaseOperationDigest(mustSessionTurnID(request.Key), request.LeaseRequestDigest)
+	if err != nil {
+		return err
+	}
+	if request.OperationDigest != expectedDigest {
+		return store.ValidationErrorf("session lease release operation digest does not match its Lease request digest")
+	}
+	request.ReleasedAt = normalizeControlTime(request.ReleasedAt)
+	return nil
+}
+
+func mustSessionTurnID(key store.SessionTurnKey) string {
+	id, _ := key.CanonicalID()
+	return id
+}
+
+func normalizeReconcileSessionControlRequest(request *store.ReconcileSessionControlRequest) error {
+	request.Namespace = strings.TrimSpace(request.Namespace)
+	request.SessionName = strings.TrimSpace(request.SessionName)
+	request.SessionUID = strings.TrimSpace(request.SessionUID)
+	request.ExpectedRelatedPublicationID = strings.TrimSpace(request.ExpectedRelatedPublicationID)
+	request.BranchClaimID = strings.TrimSpace(request.BranchClaimID)
+	request.OperationID = strings.TrimSpace(request.OperationID)
+	for field, value := range map[string]string{
+		sessionControlFieldNamespace:          request.Namespace,
+		sessionControlFieldName:               request.SessionName,
+		sessionControlFieldUID:                request.SessionUID,
+		"branch claim ID":                     request.BranchClaimID,
+		"session reconciliation operation ID": request.OperationID,
+	} {
+		if err := store.ValidateControlIdentifier(field, value); err != nil {
+			return err
+		}
+	}
+	if request.ExpectedRelatedPublicationID != "" {
+		if err := store.ValidateControlIdentifier("related publication ID", request.ExpectedRelatedPublicationID); err != nil {
+			return err
+		}
+	}
+	if request.ExpectedVersion < 1 || request.ExpectedLeaseGeneration < 1 || request.ExpectedBranchClaimVersion < 1 || request.ExpectedBranchClaimGeneration < 1 {
+		return store.ValidationErrorf("session/branch reconciliation versions and generations must be at least 1")
+	}
+	if err := request.ExpectedBranchBaseline.Validate("expected reconciliation branch baseline"); err != nil {
+		return err
+	}
+	request.VerifiedBaseline.RepositoryID = strings.TrimSpace(request.VerifiedBaseline.RepositoryID)
+	request.VerifiedBaseline.Ref = strings.TrimSpace(request.VerifiedBaseline.Ref)
+	request.VerifiedBaseline.SHA = strings.TrimSpace(request.VerifiedBaseline.SHA)
+	if err := validateVerifiedBaseline(request.VerifiedBaseline); err != nil {
+		return err
+	}
+	if err := store.ValidateCanonicalDigest("session reconciliation operation digest", request.OperationDigest); err != nil {
+		return err
+	}
+	request.ReconciledAt = normalizeControlTime(request.ReconciledAt)
+	return nil
+}
+
+func validateVerifiedBaseline(baseline store.VerifiedBranchBaseline) error {
+	if err := store.ValidateControlIdentifier("verified repository ID", strings.TrimSpace(baseline.RepositoryID)); err != nil {
+		return err
+	}
+	if err := store.ValidateFullBranchRef(strings.TrimSpace(baseline.Ref)); err != nil {
+		return err
+	}
+	return store.ValidateGitObjectID("verified branch SHA", strings.TrimSpace(baseline.SHA))
+}
+
+func verifiedBaselineToAPI(value *store.VerifiedBranchBaseline) *corev1alpha1.ControlVerifiedBranchBaseline {
+	if value == nil {
+		return nil
+	}
+	return &corev1alpha1.ControlVerifiedBranchBaseline{RepositoryID: value.RepositoryID, Ref: value.Ref, SHA: value.SHA}
+}
+
+func verifiedBaselineFromAPI(value *corev1alpha1.ControlVerifiedBranchBaseline) *store.VerifiedBranchBaseline {
+	if value == nil {
+		return nil
+	}
+	return &store.VerifiedBranchBaseline{RepositoryID: value.RepositoryID, Ref: value.Ref, SHA: value.SHA}
+}
diff --git a/internal/store/kube/session_turn.go b/internal/store/kube/session_turn.go
new file mode 100644
index 000000000..38d3965a3
--- /dev/null
+++ b/internal/store/kube/session_turn.go
@@ -0,0 +1,845 @@
+package kube
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"reflect"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/types"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+// CreateSessionTurn validates the Kubernetes-authoritative SessionControl and
+// PromptAttempt, then persists only the SQLite-owned open turn record.
+func (s *Store) CreateSessionTurn(ctx context.Context, request store.CreateSessionTurnRequest) (*store.SessionTurn, error) {
+	if s.sessionTurns == nil {
+		return nil, ErrSessionTurnStoreNotConfigured
+	}
+	normalized, fence, err := normalizeSessionTurnForCreateKube(request.Turn, request.Fence)
+	if err != nil {
+		return nil, err
+	}
+	if request.ExpectedSessionVersion < 1 {
+		return nil, store.ValidationErrorf("expected session version must be at least 1")
+	}
+	_, snapshot, err := s.requireControllerEpoch(ctx, fence)
+	if err != nil {
+		return nil, err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	if existing, getErr := s.sessionTurns.GetSessionTurn(ctx, normalized.ID); getErr == nil {
+		if sameSessionTurnCreationKube(*existing, normalized) {
+			return existing, nil
+		}
+		return nil, controlConflict("session turn %q was reused with different prompt input or request digest", normalized.ID)
+	} else if !errors.Is(getErr, store.ErrNotFound) {
+		return nil, getErr
+	}
+
+	sessionObject, err := s.findSessionControlByUID(ctx, normalized.Key.SessionUID)
+	if err != nil {
+		return nil, err
+	}
+	control := sessionControlFromObject(sessionObject)
+	if control.Version != request.ExpectedSessionVersion || !sessionLeaseMatchesKey(control.Lease, normalized.Key) {
+		return nil, controlConflict("session turn %q does not match the active Kubernetes Session lease/version", normalized.ID)
+	}
+	if err := s.verifyMirroredSessionLease(ctx, sessionObject, *control.Lease); err != nil {
+		return nil, err
+	}
+	evidence, err := s.loadSessionTurnExecutionEvidence(ctx, control, normalized)
+	if err != nil {
+		return nil, err
+	}
+	if evidence.harnessV1 != nil && evidence.harnessV1.State != store.HarnessV1AttemptPrepared {
+		return nil, controlConflict(
+			"new harness v1 SessionTurn must be opened while attempt %q is Prepared, got %s",
+			normalized.PromptAttemptID, evidence.harnessV1.State,
+		)
+	}
+	return s.sessionTurns.CreateSessionTurnRecord(ctx, store.CreateSessionTurnRecordRequest{
+		Turn:        normalized,
+		Namespace:   control.Namespace,
+		SessionName: control.SessionName,
+		Fence:       fence,
+	})
+}
+
+// FinalizeSessionTurn implements the cross-store completion protocol:
+//
+//  1. validate all Kubernetes-authoritative fences and terminal receipts;
+//  2. atomically commit SQLite turn/transcript/deferred-outbox data;
+//  3. CAS-update Kubernetes BranchClaim and SessionControl, then release Lease;
+//  4. activate the SQLite outbox projection.
+//
+// Every step is idempotent so restart after any committed boundary resumes the
+// same finalization instead of replaying transcript or publication effects.
+func (s *Store) FinalizeSessionTurn(ctx context.Context, request store.FinalizeSessionTurnRequest) (*store.SessionTurn, error) {
+	if s.sessionTurns == nil {
+		return nil, ErrSessionTurnStoreNotConfigured
+	}
+	if s.outbox == nil {
+		return nil, ErrOutboxStoreNotConfigured
+	}
+	normalized, turnID, err := normalizeCrossStoreFinalizationRequest(request)
+	if err != nil {
+		return nil, err
+	}
+	fence, snapshot, err := s.requireControllerEpoch(ctx, normalized.Fence)
+	if err != nil {
+		return nil, err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+	normalized.Fence = fence
+
+	turn, err := s.sessionTurns.GetSessionTurn(ctx, turnID)
+	if err != nil {
+		return nil, err
+	}
+	if turn.State == store.SessionTurnFinalized {
+		if !sessionTurnRequestMatchesFinalized(*turn, normalized) {
+			return nil, controlConflict("session turn %q was finalized with different terminal data or digest", turn.ID)
+		}
+		return s.completePersistedSessionTurnFinalization(ctx, *turn, fence, snapshot, nil)
+	}
+	if turn.Version != normalized.ExpectedTurnVersion {
+		return nil, controlConflict("session turn %q is version %d, expected %d", turn.ID, turn.Version, normalized.ExpectedTurnVersion)
+	}
+
+	sessionObject, err := s.findSessionControlByUID(ctx, normalized.Key.SessionUID)
+	if err != nil {
+		return nil, err
+	}
+	control := sessionControlFromObject(sessionObject)
+	if control.Version != normalized.ExpectedSessionVersion || !sessionLeaseMatchesKey(control.Lease, normalized.Key) {
+		return nil, controlConflict("session turn %q finalization is fenced by a different Kubernetes Session version or lease", turn.ID)
+	}
+	if err := s.verifyMirroredSessionLease(ctx, sessionObject, *control.Lease); err != nil {
+		return nil, err
+	}
+	evidence, err := s.loadSessionTurnExecutionEvidence(ctx, control, *turn)
+	if err != nil {
+		return nil, err
+	}
+	if err := validateSessionTurnExecutionForFinalization(evidence, normalized); err != nil {
+		return nil, err
+	}
+	plan, err := s.buildCrossStoreFinalizationPlan(ctx, control, *turn, evidence, normalized)
+	if err != nil {
+		return nil, err
+	}
+
+	turn, err = s.sessionTurns.CommitSessionTurnFinalization(ctx, store.CommitSessionTurnFinalizationRequest{
+		Key:                  normalized.Key,
+		Namespace:            control.Namespace,
+		SessionName:          control.SessionName,
+		Fence:                fence,
+		ExpectedTurnVersion:  normalized.ExpectedTurnVersion,
+		FinalizationDigest:   normalized.FinalizationDigest,
+		TerminalKind:         normalized.TerminalKind,
+		TerminalContent:      normalized.TerminalContent,
+		SkipTranscriptAppend: normalized.SkipTranscriptAppend,
+		SkipUserPromptAppend: normalized.SkipUserPromptAppend,
+		PublicationID:        normalized.PublicationID,
+		PublicationReceipt:   plan.receipt,
+		Projection:           normalized.Projection,
+		FinalizedAt:          normalized.FinalizedAt,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return s.completePersistedSessionTurnFinalization(ctx, *turn, fence, snapshot, &plan)
+}
+
+// ResumeSessionTurnFinalization completes only the Kubernetes and outbox tail
+// of a finalization whose SQLite SessionTurn/transcript/outbox transaction is
+// already durable. All timing, digest, terminal, publication, and projection
+// inputs are reloaded from the persisted turn and outbox record.
+func (s *Store) ResumeSessionTurnFinalization(ctx context.Context, request store.ResumeSessionTurnFinalizationRequest) (*store.SessionTurn, error) {
+	if s.sessionTurns == nil {
+		return nil, ErrSessionTurnStoreNotConfigured
+	}
+	if s.outbox == nil {
+		return nil, ErrOutboxStoreNotConfigured
+	}
+	if err := request.Key.Validate(); err != nil {
+		return nil, err
+	}
+	turnID, err := request.Key.CanonicalID()
+	if err != nil {
+		return nil, err
+	}
+	request.PromptAttemptID = strings.TrimSpace(request.PromptAttemptID)
+	if err := store.ValidateControlIdentifier("prompt attempt ID", request.PromptAttemptID); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateCanonicalDigest("session turn finalization digest", request.FinalizationDigest); err != nil {
+		return nil, err
+	}
+	fence, snapshot, err := s.requireControllerEpoch(ctx, request.Fence)
+	if err != nil {
+		return nil, err
+	}
+	defer s.releaseControllerEpochMutation(snapshot)
+
+	turn, err := s.sessionTurns.GetSessionTurn(ctx, turnID)
+	if err != nil {
+		return nil, err
+	}
+	if turn.State != store.SessionTurnFinalized || turn.Key != request.Key || turn.PromptAttemptID != request.PromptAttemptID || turn.FinalizationDigest != request.FinalizationDigest {
+		return nil, controlConflict("session turn %q does not match the persisted finalization recovery identity", turnID)
+	}
+	return s.completePersistedSessionTurnFinalization(ctx, *turn, fence, snapshot, nil)
+}
+
+func (s *Store) completePersistedSessionTurnFinalization(
+	ctx context.Context,
+	turn store.SessionTurn,
+	fence store.ControllerEpochFence,
+	snapshot epochSnapshot,
+	precomputedPlan *crossStoreFinalizationPlan,
+) (*store.SessionTurn, error) {
+	if turn.State != store.SessionTurnFinalized || turn.FinalizedAt == nil {
+		return nil, controlConflict("session turn %q has no durable finalized receipt to resume", turn.ID)
+	}
+	projection, err := s.outbox.GetOutboxProjection(ctx, turn.ProjectionID)
+	if err != nil {
+		return nil, fmt.Errorf("load finalized SessionTurn projection: %w", err)
+	}
+	if projection.AggregateKind != sessionTurnAggregateKind || projection.AggregateID != turn.ID ||
+		projection.ProjectionKind != turn.ProjectionKind || projection.PayloadDigest != turn.ProjectionDigest ||
+		!projection.InitialAvailableAt.Equal(turn.ProjectionAvailableAt) {
+		return nil, controlConflict("outbox projection %q does not match persisted session turn %q", projection.ID, turn.ID)
+	}
+	sessionObject, err := s.findSessionControlByUID(ctx, turn.Key.SessionUID)
+	if err != nil {
+		return nil, err
+	}
+	control := sessionControlFromObject(sessionObject)
+	evidence, err := s.loadSessionTurnExecutionEvidence(ctx, control, turn)
+	if err != nil {
+		return nil, err
+	}
+	expectedLeaseRequestDigest, err := store.SessionMutationLeaseRequestDigest(
+		turn.Key.SessionUID, turn.Key.LeaseGeneration, turn.Key.TaskUID, turn.Key.Attempt, turn.Key.PromptID, evidence.requestDigest,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("derive finalized Session Lease request digest: %w", err)
+	}
+	if control.LeaseGeneration > turn.Key.LeaseGeneration {
+		if err := s.activatePersistedSessionTurnProjection(ctx, turn, projection, fence); err != nil {
+			return nil, err
+		}
+		return &turn, nil
+	}
+	if !sessionControlAlreadyFinalized(control, turn.ID, turn.FinalizationDigest) {
+		if !sessionLeaseMatchesKey(control.Lease, turn.Key) {
+			return nil, controlConflict("session turn %q recovery is fenced by a different Kubernetes Session lease", turn.ID)
+		}
+		if err := s.verifyMirroredSessionLease(ctx, sessionObject, *control.Lease); err != nil {
+			return nil, err
+		}
+	}
+
+	projection.AvailableAt = turn.ProjectionAvailableAt
+	request := store.FinalizeSessionTurnRequest{
+		Key:                    turn.Key,
+		Fence:                  fence,
+		ExpectedSessionVersion: control.Version,
+		ExpectedTurnVersion:    turn.Version,
+		FinalizationDigest:     turn.FinalizationDigest,
+		TerminalKind:           turn.TerminalKind,
+		TerminalContent:        turn.TerminalContent,
+		PublicationID:          turn.PublicationID,
+		Projection:             *projection,
+		FinalizedAt:            turn.FinalizedAt.UTC(),
+	}
+	if err := validateSessionTurnExecutionForFinalization(evidence, request); err != nil {
+		return nil, err
+	}
+	plan := crossStoreFinalizationPlan{}
+	if precomputedPlan == nil {
+		plan, err = s.buildCrossStoreFinalizationPlan(ctx, control, turn, evidence, request)
+		if err != nil {
+			return nil, err
+		}
+	} else {
+		plan = *precomputedPlan
+	}
+	if !reflect.DeepEqual(turn.PublicationReceipt, plan.receipt) {
+		return nil, controlConflict("session turn %q has a different publication receipt snapshot", turn.ID)
+	}
+
+	if plan.publication != nil {
+		if err := s.finalizeBranchClaimForSessionTurn(ctx, *plan.publication, plan.verifiedBaseline, plan.availability, plan.blockReason, request, fence, snapshot); err != nil {
+			return nil, err
+		}
+	}
+	updatedSession, err := s.finalizeSessionControlForTurn(ctx, sessionObject, control, turn, plan, request, fence, snapshot)
+	if err != nil {
+		return nil, err
+	}
+	if err := s.releaseFinalizedSessionLease(ctx, updatedSession, turn.Key, expectedLeaseRequestDigest); err != nil {
+		return nil, err
+	}
+	if err := s.activatePersistedSessionTurnProjection(ctx, turn, projection, fence); err != nil {
+		return nil, err
+	}
+	return &turn, nil
+}
+
+func (s *Store) activatePersistedSessionTurnProjection(
+	ctx context.Context,
+	turn store.SessionTurn,
+	projection *store.OutboxProjection,
+	fence store.ControllerEpochFence,
+) error {
+	if projection == nil || turn.FinalizedAt == nil {
+		return controlConflict("session turn %q lacks its persisted projection activation identity", turn.ID)
+	}
+	projection.AvailableAt = turn.ProjectionAvailableAt
+	_, err := s.sessionTurns.ActivateSessionTurnProjection(ctx, store.ActivateSessionTurnProjectionRequest{
+		TurnID:                 turn.ID,
+		ProjectionID:           turn.ProjectionID,
+		Fence:                  fence,
+		FinalizationDigest:     turn.FinalizationDigest,
+		ExpectedAggregateKind:  sessionTurnAggregateKind,
+		ExpectedProjectionKind: turn.ProjectionKind,
+		ExpectedPayloadDigest:  turn.ProjectionDigest,
+		AvailableAt:            turn.ProjectionAvailableAt,
+		UpdatedAt:              *turn.FinalizedAt,
+	})
+	return err
+}
+
+const sessionTurnAggregateKind = "SessionTurn"
+
+type sessionTurnExecutionEvidence struct {
+	prompt        *store.PromptAttempt
+	harnessV1     *store.HarnessV1Attempt
+	requestDigest string
+}
+
+func (s *Store) loadSessionTurnExecutionEvidence(
+	ctx context.Context,
+	control store.SessionControl,
+	turn store.SessionTurn,
+) (sessionTurnExecutionEvidence, error) {
+	prompt, promptErr := s.GetPromptAttempt(ctx, turn.PromptAttemptID)
+	if promptErr == nil {
+		if err := validateSessionTurnPromptBinding(*prompt, turn.Key); err != nil {
+			return sessionTurnExecutionEvidence{}, err
+		}
+		return sessionTurnExecutionEvidence{prompt: prompt, requestDigest: prompt.RequestDigest}, nil
+	}
+	if !errors.Is(promptErr, store.ErrNotFound) {
+		return sessionTurnExecutionEvidence{}, fmt.Errorf("session turn prompt attempt: %w", promptErr)
+	}
+	if s.harnessV1Attempts == nil || turn.Key.Attempt > int64(^uint32(0)>>1) {
+		return sessionTurnExecutionEvidence{}, fmt.Errorf("session turn execution attempt: %w", promptErr)
+	}
+	key := store.HarnessV1AttemptKey{
+		Namespace: control.Namespace,
+		TaskUID:   turn.Key.TaskUID,
+		Attempt:   int32(turn.Key.Attempt),
+	}
+	attempt, err := s.harnessV1Attempts.GetHarnessV1Attempt(ctx, key)
+	if err != nil {
+		return sessionTurnExecutionEvidence{}, fmt.Errorf("session turn harness v1 attempt: %w", err)
+	}
+	if turn.PromptAttemptID != key.SessionReferenceID() || attempt.TurnID != turn.Key.PromptID ||
+		attempt.TaskUID != turn.Key.TaskUID || int64(attempt.Attempt) != turn.Key.Attempt {
+		return sessionTurnExecutionEvidence{}, controlConflict(
+			"session turn harness v1 attempt does not match the fenced SessionTurn identity",
+		)
+	}
+	task := &corev1alpha1.Task{}
+	if err := s.readClient().Get(ctx, types.NamespacedName{Namespace: control.Namespace, Name: attempt.TaskName}, task); err != nil {
+		return sessionTurnExecutionEvidence{}, mapKubernetesError("read harness v1 SessionTurn Task", err)
+	}
+	binding := task.Status.AgentExecutionBinding
+	if string(task.UID) != attempt.TaskUID || task.Spec.Type != corev1alpha1.TaskTypeAgent || binding == nil ||
+		binding.ContractVersion != corev1alpha1.AgentRuntimeContractHarnessV1 ||
+		binding.BindingDigest != attempt.BindingDigest || binding.Snapshot.Digest != attempt.SnapshotDigest {
+		return sessionTurnExecutionEvidence{}, controlConflict(
+			"session turn harness v1 attempt does not match the immutable Kubernetes Task binding",
+		)
+	}
+	if err := store.ValidateCanonicalDigest("harness v1 SessionTurn request digest", attempt.RequestDigest); err != nil {
+		return sessionTurnExecutionEvidence{}, err
+	}
+	return sessionTurnExecutionEvidence{harnessV1: attempt, requestDigest: attempt.RequestDigest}, nil
+}
+
+func validateSessionTurnExecutionForFinalization(
+	evidence sessionTurnExecutionEvidence,
+	request store.FinalizeSessionTurnRequest,
+) error {
+	if evidence.prompt != nil {
+		return validatePromptAttemptForCrossStoreFinalization(*evidence.prompt, request)
+	}
+	if evidence.harnessV1 == nil {
+		return controlConflict("session turn has no route-specific execution receipt")
+	}
+	attempt := evidence.harnessV1
+	if !store.IsTerminalHarnessV1AttemptState(attempt.State) {
+		key := store.HarnessV1AttemptKey{Namespace: attempt.Namespace, TaskUID: attempt.TaskUID, Attempt: attempt.Attempt}
+		return controlConflict("harness v1 attempt %q is not terminal: %s", key.CanonicalID(), attempt.State)
+	}
+	if request.PublicationID != "" || request.VerifiedBaseline != nil {
+		return store.ValidationErrorf("harness v1 SessionTurn cannot carry v2 publication state")
+	}
+	if request.TerminalKind == store.SessionTurnAssistantResult && attempt.State != store.HarnessV1AttemptSucceeded {
+		return store.ValidationErrorf("assistant-result finalization requires succeeded harness v1 execution, got %s", attempt.State)
+	}
+	if attempt.State == store.HarnessV1AttemptSucceeded && attempt.TerminalReceiptDigest == "" {
+		return controlConflict("succeeded harness v1 attempt has no authoritative terminal receipt")
+	}
+	return nil
+}
+
+type crossStoreFinalizationPlan struct {
+	publication      *store.Publication
+	receipt          *store.PublicationReceipt
+	verifiedBaseline *store.VerifiedBranchBaseline
+	availability     store.SessionAvailability
+	blockReason      string
+}
+
+//nolint:gocyclo // Finalization keeps v1/v2 evidence and publication blocking decisions in one atomic plan.
+func (s *Store) buildCrossStoreFinalizationPlan(
+	ctx context.Context,
+	control store.SessionControl,
+	turn store.SessionTurn,
+	evidence sessionTurnExecutionEvidence,
+	request store.FinalizeSessionTurnRequest,
+) (crossStoreFinalizationPlan, error) {
+	plan := crossStoreFinalizationPlan{availability: store.SessionAvailable, blockReason: request.BlockReason}
+	if control.VerifiedBaseline != nil {
+		copyValue := *control.VerifiedBaseline
+		plan.verifiedBaseline = &copyValue
+	}
+	if evidence.harnessV1 != nil {
+		if request.PublicationID != "" || request.VerifiedBaseline != nil {
+			return crossStoreFinalizationPlan{}, store.ValidationErrorf("harness v1 SessionTurn cannot finalize publication state")
+		}
+		if evidence.harnessV1.State == store.HarnessV1AttemptOutcomeUnknown {
+			expected := strings.TrimSpace(evidence.harnessV1.TerminalReason)
+			if expected == "" {
+				expected = "harness v1 outcome cannot be proven"
+			}
+			if plan.blockReason == "" {
+				plan.blockReason = expected
+			} else if plan.blockReason != expected {
+				return crossStoreFinalizationPlan{}, controlConflict("session block reason does not match the harness v1 terminal receipt")
+			}
+			plan.availability = store.SessionReconciliationBlocked
+		} else if plan.blockReason != "" {
+			return crossStoreFinalizationPlan{}, store.ValidationErrorf("only OutcomeUnknown harness v1 execution may block a Session")
+		}
+		return plan, nil
+	}
+	if evidence.prompt == nil {
+		return crossStoreFinalizationPlan{}, controlConflict("session turn has no route-specific execution evidence")
+	}
+	attempt := *evidence.prompt
+	if request.PublicationID == "" {
+		if request.VerifiedBaseline != nil {
+			return crossStoreFinalizationPlan{}, store.ValidationErrorf("verified baseline advancement requires a publication receipt")
+		}
+		if plan.blockReason != "" {
+			return crossStoreFinalizationPlan{}, store.ValidationErrorf("session reconciliation blocking requires a publication receipt")
+		}
+		return plan, nil
+	}
+
+	publication, err := s.GetPublication(ctx, request.PublicationID)
+	if err != nil {
+		return crossStoreFinalizationPlan{}, fmt.Errorf("finalize publication: %w", err)
+	}
+	if publication.TaskUID != request.Key.TaskUID || publication.Attempt != request.Key.Attempt || publication.PromptID != request.Key.PromptID ||
+		(publication.SessionUID != "" && publication.SessionUID != request.Key.SessionUID) || !store.IsTerminalPublicationState(publication.State) {
+		return crossStoreFinalizationPlan{}, controlConflict("publication %q does not match the terminal session turn identity/state", publication.ID)
+	}
+	expectedDelivery, err := promptDeliveryStateForPublicationKube(publication.State)
+	if err != nil {
+		return crossStoreFinalizationPlan{}, err
+	}
+	if attempt.DeliveryState != expectedDelivery {
+		return crossStoreFinalizationPlan{}, controlConflict("prompt attempt delivery state %s does not match publication state %s", attempt.DeliveryState, publication.State)
+	}
+	receipt := publicationReceiptKube(*publication)
+	plan.publication = publication
+	plan.receipt = &receipt
+	derivedBaseline, unresolved, err := finalizationPublicationBaselineKube(*publication)
+	if err != nil {
+		return crossStoreFinalizationPlan{}, err
+	}
+	if derivedBaseline != nil {
+		if request.VerifiedBaseline != nil && !reflect.DeepEqual(*request.VerifiedBaseline, *derivedBaseline) {
+			return crossStoreFinalizationPlan{}, controlConflict("requested verified baseline does not match independent publication receipt")
+		}
+		plan.verifiedBaseline = derivedBaseline
+	}
+	if unresolved {
+		expectedBlockReason := sessionPublicationBlockReason(*publication)
+		if plan.blockReason == "" {
+			plan.blockReason = expectedBlockReason
+		} else if plan.blockReason != expectedBlockReason {
+			return crossStoreFinalizationPlan{}, controlConflict("session block reason does not match the durable publication outcome")
+		}
+	}
+	if plan.blockReason != "" {
+		plan.availability = store.SessionReconciliationBlocked
+	}
+	_ = turn
+	return plan, nil
+}
+
+func sessionPublicationBlockReason(publication store.Publication) string {
+	reason := strings.TrimSpace(publication.TerminalReason)
+	if reason == "" {
+		reason = fmt.Sprintf("publication %s remains unresolved", publication.ID)
+	}
+	return reason
+}
+
+func (s *Store) finalizeBranchClaimForSessionTurn(ctx context.Context, publication store.Publication, baseline *store.VerifiedBranchBaseline, availability store.SessionAvailability, blockReason string, request store.FinalizeSessionTurnRequest, fence store.ControllerEpochFence, snapshot epochSnapshot) error {
+	object, err := s.getBranchClaimObject(ctx, publication.BranchClaimID)
+	if err != nil {
+		return err
+	}
+	claim := branchClaimFromObject(object)
+	newRemote := claim.LastVerified
+	claimAvailability := store.BranchClaimAvailable
+	relatedPublicationID := ""
+	if baseline != nil {
+		newRemote = store.RemoteRefState{SHA: baseline.SHA}
+	}
+	if availability == store.SessionReconciliationBlocked {
+		claimAvailability = store.BranchClaimReconciliationBlocked
+		relatedPublicationID = publication.ID
+	}
+	operationID := "finalize:" + publication.ID
+	if claim.LastOperationID == operationID {
+		if claim.LastOperationDigest == request.FinalizationDigest && claim.Generation == publication.BranchClaimGeneration && claim.LastVerified.Equal(newRemote) && claim.Availability == claimAvailability && claim.BlockedReason == blockReason && claim.RelatedPublicationID == relatedPublicationID {
+			return nil
+		}
+		return controlConflict("branch finalization operation %q was already applied with different target values", operationID)
+	}
+	if claim.Generation != publication.BranchClaimGeneration || claim.RepositoryID != publication.TargetRepositoryID || claim.Ref != publication.TargetRef || !claim.LastVerified.Equal(publication.Baseline) || claim.Availability != store.BranchClaimAvailable {
+		return controlConflict("branch claim %q no longer matches publication finalization baseline/generation", claim.ID)
+	}
+	updated := object.DeepCopy()
+	remote := remoteRefToAPI(newRemote)
+	updated.Status.LastVerified = &remote
+	updated.Status.Availability = corev1alpha1.BranchClaimAvailability(claimAvailability)
+	updated.Status.BlockedReason = blockReason
+	updated.Status.RelatedPublicationID = relatedPublicationID
+	setMutationStatus(&updated.Status.ControlRecordMutationStatus, fence, snapshot, claim.Version+1, operationID, request.FinalizationDigest, claim.CreatedAt, request.FinalizedAt)
+	if err := s.client.Status().Update(ctx, updated); err != nil {
+		return mapKubernetesError("finalize SessionTurn branch claim", err)
+	}
+	return nil
+}
+
+func (s *Store) finalizeSessionControlForTurn(ctx context.Context, original *corev1alpha1.RuntimeSessionControl, control store.SessionControl, turn store.SessionTurn, plan crossStoreFinalizationPlan, request store.FinalizeSessionTurnRequest, fence store.ControllerEpochFence, snapshot epochSnapshot) (*corev1alpha1.RuntimeSessionControl, error) {
+	operationID := "finalize:" + turn.ID
+	if control.LastOperationID == operationID {
+		if sessionFinalizationTargetMatches(control, plan, request.FinalizationDigest, turn.PromptAttemptID, request.PublicationID) {
+			return original, nil
+		}
+		return nil, controlConflict("session finalization operation %q was already applied with different target values", operationID)
+	}
+	if control.Version != request.ExpectedSessionVersion || !sessionLeaseMatchesKey(control.Lease, request.Key) {
+		return nil, controlConflict("session turn %q finalization is fenced by a different Kubernetes Session version or lease", turn.ID)
+	}
+	updated := original.DeepCopy()
+	updated.Status.Availability = corev1alpha1.RuntimeSessionControlAvailability(plan.availability)
+	updated.Status.MutationLease = nil
+	updated.Status.BlockedReason = plan.blockReason
+	updated.Status.RelatedPromptAttemptID = ""
+	updated.Status.RelatedPublicationID = ""
+	if plan.availability == store.SessionReconciliationBlocked {
+		updated.Status.RelatedPromptAttemptID = turn.PromptAttemptID
+		updated.Status.RelatedPublicationID = request.PublicationID
+	}
+	updated.Status.VerifiedBaseline = verifiedBaselineToAPI(plan.verifiedBaseline)
+	setMutationStatus(&updated.Status.ControlRecordMutationStatus, fence, snapshot, control.Version+1, operationID, request.FinalizationDigest, control.CreatedAt, request.FinalizedAt)
+	if err := s.client.Status().Update(ctx, updated); err != nil {
+		return nil, mapKubernetesError("finalize SessionTurn SessionControl", err)
+	}
+	return updated, nil
+}
+
+func sessionFinalizationTargetMatches(control store.SessionControl, plan crossStoreFinalizationPlan, finalizationDigest, promptAttemptID, publicationID string) bool {
+	if control.LastOperationDigest != finalizationDigest || control.Lease != nil || control.Availability != plan.availability || control.BlockedReason != plan.blockReason || !reflect.DeepEqual(control.VerifiedBaseline, plan.verifiedBaseline) {
+		return false
+	}
+	if plan.availability == store.SessionAvailable {
+		return control.RelatedPromptAttemptID == "" && control.RelatedPublicationID == ""
+	}
+	return control.RelatedPromptAttemptID == promptAttemptID && control.RelatedPublicationID == publicationID
+}
+
+func (s *Store) releaseFinalizedSessionLease(ctx context.Context, object *corev1alpha1.RuntimeSessionControl, key store.SessionTurnKey, requestDigest string) error {
+	if err := store.ValidateCanonicalDigest("finalized Session Lease request digest", requestDigest); err != nil {
+		return err
+	}
+	lease, state, err := s.getSessionLease(ctx, object.Namespace, object.Spec.SessionName, object.Spec.SessionUID)
+	if err != nil {
+		return err
+	}
+	if lease.Spec.HolderIdentity == nil || *lease.Spec.HolderIdentity == "" {
+		if state.Mode == leaseModeEmpty && state.Generation == key.LeaseGeneration {
+			return nil
+		}
+		return controlConflict("finalized Session Lease has unexpected empty-state generation")
+	}
+	if state.Mode != leaseModeMutation || state.Generation != key.LeaseGeneration || state.TaskUID != key.TaskUID || state.Attempt != key.Attempt || state.PromptID != key.PromptID || state.RequestDigest != requestDigest {
+		return controlConflict("session mutation Lease no longer matches finalized turn")
+	}
+	updated := lease.DeepCopy()
+	clearSessionLease(updated, state.Generation)
+	if err := s.client.Update(ctx, updated); err != nil {
+		return mapKubernetesError("release finalized Session mutation Lease", err)
+	}
+	return nil
+}
+
+func (s *Store) findSessionControlByUID(ctx context.Context, sessionUID string) (*corev1alpha1.RuntimeSessionControl, error) {
+	list := &corev1alpha1.RuntimeSessionControlList{}
+	if err := s.readClient().List(ctx, list, s.namespacedListOptions()...); err != nil {
+		return nil, mapKubernetesError("list runtime session controls", err)
+	}
+	var match *corev1alpha1.RuntimeSessionControl
+	for i := range list.Items {
+		if list.Items[i].Spec.SessionUID != sessionUID {
+			continue
+		}
+		if match != nil {
+			return nil, controlConflict("multiple RuntimeSessionControls exist for Session UID %q", sessionUID)
+		}
+		match = list.Items[i].DeepCopy()
+	}
+	if match == nil {
+		return nil, store.ErrNotFound
+	}
+	return match, nil
+}
+
+func normalizeSessionTurnForCreateKube(turn store.SessionTurn, fence store.ControllerEpochFence) (store.SessionTurn, store.ControllerEpochFence, error) {
+	turn.Key.SessionUID = strings.TrimSpace(turn.Key.SessionUID)
+	turn.Key.TaskUID = strings.TrimSpace(turn.Key.TaskUID)
+	turn.Key.PromptID = strings.TrimSpace(turn.Key.PromptID)
+	if err := turn.Key.Validate(); err != nil {
+		return store.SessionTurn{}, store.ControllerEpochFence{}, err
+	}
+	canonicalID, err := turn.Key.CanonicalID()
+	if err != nil {
+		return store.SessionTurn{}, store.ControllerEpochFence{}, err
+	}
+	turn.ID = strings.TrimSpace(turn.ID)
+	if turn.ID == "" {
+		turn.ID = canonicalID
+	}
+	if turn.ID != canonicalID {
+		return store.SessionTurn{}, store.ControllerEpochFence{}, store.ValidationErrorf("session turn ID must equal canonical ID %q", canonicalID)
+	}
+	turn.PromptAttemptID = strings.TrimSpace(turn.PromptAttemptID)
+	if err := store.ValidateControlIdentifier("prompt attempt ID", turn.PromptAttemptID); err != nil {
+		return store.SessionTurn{}, store.ControllerEpochFence{}, err
+	}
+	if err := store.ValidateCanonicalDigest("session turn request digest", turn.RequestDigest); err != nil {
+		return store.SessionTurn{}, store.ControllerEpochFence{}, err
+	}
+	if strings.TrimSpace(turn.UserPrompt) == "" {
+		return store.SessionTurn{}, store.ControllerEpochFence{}, store.ValidationErrorf("session turn user prompt is required")
+	}
+	if err := store.ValidateControlText("session turn user prompt", turn.UserPrompt); err != nil {
+		return store.SessionTurn{}, store.ControllerEpochFence{}, err
+	}
+	if turn.State == "" {
+		turn.State = store.SessionTurnOpen
+	}
+	if turn.State != store.SessionTurnOpen || turn.TerminalKind != "" || turn.TerminalContent != "" || turn.FinalizationDigest != "" || turn.PublicationID != "" || turn.PublicationReceipt != nil || turn.FinalizedAt != nil {
+		return store.SessionTurn{}, store.ControllerEpochFence{}, store.ValidationErrorf("new session turn must be open and must not contain finalization data")
+	}
+	normalizedFence, err := normalizeEpochFence(fence)
+	if err != nil {
+		return store.SessionTurn{}, store.ControllerEpochFence{}, err
+	}
+	if turn.Version != 0 && turn.Version != 1 {
+		return store.SessionTurn{}, store.ControllerEpochFence{}, store.ValidationErrorf("new session turn version must be zero or one")
+	}
+	now := normalizeControlTime(turn.CreatedAt)
+	turn.CreatedAt = now
+	if turn.UpdatedAt.IsZero() {
+		turn.UpdatedAt = now
+	} else {
+		turn.UpdatedAt = turn.UpdatedAt.UTC()
+	}
+	turn.ControllerEpochName = normalizedFence.Name
+	turn.ControllerEpoch = normalizedFence.Epoch
+	turn.Version = 1
+	return turn, normalizedFence, nil
+}
+
+func normalizeCrossStoreFinalizationRequest(request store.FinalizeSessionTurnRequest) (store.FinalizeSessionTurnRequest, string, error) {
+	if err := request.Key.Validate(); err != nil {
+		return store.FinalizeSessionTurnRequest{}, "", err
+	}
+	turnID, err := request.Key.CanonicalID()
+	if err != nil {
+		return store.FinalizeSessionTurnRequest{}, "", err
+	}
+	fence, err := normalizeEpochFence(request.Fence)
+	if err != nil {
+		return store.FinalizeSessionTurnRequest{}, "", err
+	}
+	request.Fence = fence
+	if request.ExpectedSessionVersion < 1 || request.ExpectedTurnVersion < 1 {
+		return store.FinalizeSessionTurnRequest{}, "", store.ValidationErrorf("expected session and turn versions must be at least 1")
+	}
+	if err := store.ValidateCanonicalDigest("session turn finalization digest", request.FinalizationDigest); err != nil {
+		return store.FinalizeSessionTurnRequest{}, "", err
+	}
+	if request.TerminalKind != store.SessionTurnAssistantResult && request.TerminalKind != store.SessionTurnOutcomeMarker {
+		return store.FinalizeSessionTurnRequest{}, "", store.ValidationErrorf("unsupported session turn terminal kind %q", request.TerminalKind)
+	}
+	if request.TerminalKind == store.SessionTurnOutcomeMarker && strings.TrimSpace(request.TerminalContent) == "" {
+		return store.FinalizeSessionTurnRequest{}, "", store.ValidationErrorf("outcome-marker finalization requires explicit marker content")
+	}
+	if request.SkipTranscriptAppend && request.SkipUserPromptAppend {
+		return store.FinalizeSessionTurnRequest{}, "", store.ValidationErrorf("session turn cannot combine full transcript suppression with user-prompt-only suppression")
+	}
+	if err := store.ValidateControlText("session turn terminal content", request.TerminalContent); err != nil {
+		return store.FinalizeSessionTurnRequest{}, "", err
+	}
+	request.PublicationID = strings.TrimSpace(request.PublicationID)
+	if request.PublicationID != "" {
+		if err := store.ValidateControlIdentifier("publication ID", request.PublicationID); err != nil {
+			return store.FinalizeSessionTurnRequest{}, "", err
+		}
+	}
+	request.BlockReason = strings.TrimSpace(request.BlockReason)
+	if err := store.ValidateControlReason("session block reason", request.BlockReason); err != nil {
+		return store.FinalizeSessionTurnRequest{}, "", err
+	}
+	if request.VerifiedBaseline != nil {
+		copyValue := *request.VerifiedBaseline
+		request.VerifiedBaseline = &copyValue
+		if err := validateVerifiedBaseline(copyValue); err != nil {
+			return store.FinalizeSessionTurnRequest{}, "", err
+		}
+	}
+	request.FinalizedAt = normalizeControlTime(request.FinalizedAt)
+	return request, turnID, nil
+}
+
+func validateSessionTurnPromptBinding(attempt store.PromptAttempt, key store.SessionTurnKey) error {
+	if attempt.Key.TaskUID != key.TaskUID || attempt.Key.Attempt != key.Attempt || attempt.Key.PromptID != key.PromptID || attempt.SessionUID != key.SessionUID || attempt.SessionLeaseGeneration != key.LeaseGeneration {
+		return controlConflict("session turn prompt attempt does not match the fenced SessionTurn identity")
+	}
+	return nil
+}
+
+func validatePromptAttemptForCrossStoreFinalization(attempt store.PromptAttempt, request store.FinalizeSessionTurnRequest) error {
+	if err := validateSessionTurnPromptBinding(attempt, request.Key); err != nil {
+		return err
+	}
+	if !store.IsTerminalPromptExecutionState(attempt.ExecutionState) {
+		return controlConflict("prompt attempt %q execution is not terminal: %s", attempt.ID, attempt.ExecutionState)
+	}
+	if !store.IsTerminalPromptDeliveryState(attempt.DeliveryState) {
+		return controlConflict("prompt attempt %q delivery is not terminal: %s", attempt.ID, attempt.DeliveryState)
+	}
+	if request.TerminalKind == store.SessionTurnAssistantResult && attempt.ExecutionState != store.PromptExecutionSucceeded {
+		return store.ValidationErrorf("assistant-result finalization requires succeeded prompt execution, got %s", attempt.ExecutionState)
+	}
+	if request.PublicationID == "" {
+		switch attempt.DeliveryState {
+		case store.PromptDeliveryNotRequested, store.PromptDeliveryReadValidated, store.PromptDeliveryNoChange,
+			store.PromptDeliveryReadOnlyWorkspaceModified, store.PromptDeliveryCredentialBlocked, store.PromptDeliveryConflict:
+			return nil
+		default:
+			return controlConflict("prompt attempt delivery state %s requires a matching publication receipt", attempt.DeliveryState)
+		}
+	}
+	return nil
+}
+
+func promptDeliveryStateForPublicationKube(state store.PublicationState) (store.PromptDeliveryState, error) {
+	switch state {
+	case store.PublicationVerifiedExact:
+		return store.PromptDeliveryVerifiedExact, nil
+	case store.PublicationDeliveredSuperseded:
+		return store.PromptDeliveryDeliveredSuperseded, nil
+	case store.PublicationCancelledBeforePublish:
+		return store.PromptDeliveryCancelledBeforePublish, nil
+	case store.PublicationDeliveryConflict, store.PublicationPreparationFailed:
+		return store.PromptDeliveryConflict, nil
+	case store.PublicationCredentialBlocked:
+		return store.PromptDeliveryCredentialBlocked, nil
+	case store.PublicationOutcomeUnknown:
+		return store.PromptDeliveryPublicationOutcomeUnknown, nil
+	default:
+		return "", store.ValidationErrorf("publication state %s cannot finalize a session turn", state)
+	}
+}
+
+func finalizationPublicationBaselineKube(publication store.Publication) (*store.VerifiedBranchBaseline, bool, error) {
+	switch publication.State {
+	case store.PublicationVerifiedExact:
+		if publication.PreparedReceipt == nil || publication.VerificationReceipt == nil {
+			return nil, false, store.ValidationErrorf("verified publication lacks exact receipts")
+		}
+		return &store.VerifiedBranchBaseline{RepositoryID: publication.TargetRepositoryID, Ref: publication.TargetRef, SHA: publication.PreparedReceipt.CommitSHA}, false, nil
+	case store.PublicationDeliveredSuperseded:
+		if publication.VerificationReceipt == nil || publication.VerificationReceipt.ObservedRemote.Absent || publication.VerificationReceipt.ObservedRemote.SHA == "" {
+			return nil, false, store.ValidationErrorf("superseded publication lacks observed descendant receipt")
+		}
+		return &store.VerifiedBranchBaseline{RepositoryID: publication.TargetRepositoryID, Ref: publication.TargetRef, SHA: publication.VerificationReceipt.ObservedRemote.SHA}, false, nil
+	case store.PublicationOutcomeUnknown, store.PublicationDeliveryConflict:
+		return nil, true, nil
+	default:
+		return nil, false, nil
+	}
+}
+
+func publicationReceiptKube(publication store.Publication) store.PublicationReceipt {
+	return store.PublicationReceipt{
+		PublicationID: publication.ID,
+		Generation:    publication.Generation,
+		State:         publication.State,
+		Prepared:      publication.PreparedReceipt,
+		Publish:       publication.PublishReceipt,
+		Verification:  publication.VerificationReceipt,
+		PullRequest:   publication.PullRequestReceipt,
+	}
+}
+
+func sessionTurnRequestMatchesFinalized(turn store.SessionTurn, request store.FinalizeSessionTurnRequest) bool {
+	availableAt := request.Projection.AvailableAt
+	if availableAt.IsZero() {
+		availableAt = request.FinalizedAt
+	}
+	return turn.FinalizationDigest == request.FinalizationDigest && turn.TerminalKind == request.TerminalKind && turn.TerminalContent == request.TerminalContent && turn.PublicationID == request.PublicationID &&
+		turn.ProjectionID == request.Projection.ID && turn.ProjectionKind == request.Projection.ProjectionKind && turn.ProjectionDigest == request.Projection.PayloadDigest && turn.ProjectionAvailableAt.Equal(availableAt)
+}
+
+func sessionControlAlreadyFinalized(control store.SessionControl, turnID, digest string) bool {
+	return control.LastOperationID == "finalize:"+turnID && control.LastOperationDigest == digest && control.Lease == nil
+}
+
+func sessionLeaseMatchesKey(lease *store.SessionMutationLease, key store.SessionTurnKey) bool {
+	return lease != nil && lease.Generation == key.LeaseGeneration && lease.TaskUID == key.TaskUID && lease.Attempt == key.Attempt && lease.PromptID == key.PromptID
+}
+
+func sameSessionTurnCreationKube(a, b store.SessionTurn) bool {
+	return a.ID == b.ID && a.Key == b.Key && a.PromptAttemptID == b.PromptAttemptID && a.RequestDigest == b.RequestDigest && a.UserPrompt == b.UserPrompt
+}
diff --git a/internal/store/kube/store.go b/internal/store/kube/store.go
new file mode 100644
index 000000000..f8e1953f3
--- /dev/null
+++ b/internal/store/kube/store.go
@@ -0,0 +1,244 @@
+// Package kube implements Kubernetes-authoritative ACP control records.
+//
+// Controller epochs and Session mutation ownership are serialized by
+// coordination.k8s.io Leases. The CR status resourceVersion is the CAS token
+// for all other logical state transitions. SessionTurn persistence remains a
+// separate SQLite concern and may be supplied through WithSessionTurnPersistence.
+package kube
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/orka-agents/orka/internal/store"
+	"golang.org/x/sync/semaphore"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+// ErrSessionTurnStoreNotConfigured is returned by the SessionTurn methods when
+// the Kubernetes control store was constructed without SQLite turn persistence.
+var ErrSessionTurnStoreNotConfigured = errors.New("session turn persistence is not configured")
+
+// ErrOutboxStoreNotConfigured is returned when the composite SQLite outbox
+// persistence adapter was not configured.
+var ErrOutboxStoreNotConfigured = errors.New("outbox persistence is not configured")
+
+// ErrBranchClaimAccessDisabled is returned when a static harness v1
+// installation reaches a publication-only BranchClaim path. Harness v1 must
+// never observe or mutate the cluster-scoped claims owned by harness v2.
+var ErrBranchClaimAccessDisabled = errors.New("cluster-scoped branch claim access is disabled")
+
+// SQLitePersistence is the complete SQLite-owned half of the hard-cutover
+// control store. The concrete sqlite.Store satisfies this interface without
+// treating any SQLite control row as authoritative.
+type SQLitePersistence interface {
+	store.SessionTurnPersistenceStore
+	store.OutboxPersistenceStore
+	store.SessionCleanupPersistenceStore
+}
+
+// Option configures Store.
+type Option func(*Store) error
+
+// WithSessionTurnPersistence configures the narrow SQLite persistence adapter
+// used for SessionTurn/transcript/deferred-outbox transactions.
+func WithSessionTurnPersistence(turns store.SessionTurnPersistenceStore) Option {
+	return func(s *Store) error {
+		if turns == nil {
+			return store.ValidationErrorf("session turn persistence must not be nil")
+		}
+		s.sessionTurns = turns
+		return nil
+	}
+}
+
+// WithHarnessV1Attempts supplies the route-specific receipt store used when a
+// protocol-neutral SessionTurn references a harness v1 attempt rather than a
+// v2 PromptAttempt. Kubernetes SessionControl and Lease state remain the
+// mutation authority; this store is consulted only for immutable attempt
+// identity and terminal-receipt validation.
+func WithHarnessV1Attempts(attempts store.HarnessV1AttemptStore) Option {
+	return func(s *Store) error {
+		if attempts == nil {
+			return store.ValidationErrorf("harness v1 attempt store must not be nil")
+		}
+		s.harnessV1Attempts = attempts
+		return nil
+	}
+}
+
+// WithAPIReader configures the uncached reader used for authoritative control
+// records. Controller-runtime cached clients remain the writer, but must not be
+// trusted for immediate read-after-write recovery decisions.
+func WithAPIReader(reader client.Reader) Option {
+	return func(s *Store) error {
+		if reader == nil {
+			return store.ValidationErrorf("Kubernetes API reader must not be nil")
+		}
+		s.reader = reader
+		return nil
+	}
+}
+
+// WithWatchNamespace confines namespaced control-record lookups to the static
+// controller installation's immutable watch namespace. Cluster-scoped control
+// records, such as BranchClaims, remain unaffected.
+func WithWatchNamespace(namespace string) Option {
+	return func(s *Store) error {
+		namespace = strings.TrimSpace(namespace)
+		if err := validateKubernetesNamespace(namespace); err != nil {
+			return err
+		}
+		s.watchNamespace = namespace
+		return nil
+	}
+}
+
+// WithoutClusterScopedBranchClaims configures the publication-free harness v1
+// control-store path. Session continuity remains Kubernetes-authoritative, but
+// Session cleanup cannot list or mutate the cluster-scoped BranchClaim kind.
+func WithoutClusterScopedBranchClaims() Option {
+	return func(s *Store) error {
+		s.branchClaimsEnabled = false
+		return nil
+	}
+}
+
+// WithOutboxPersistence configures the SQLite outbox adapter used behind the
+// Kubernetes controller-epoch fence.
+func WithOutboxPersistence(outbox store.OutboxPersistenceStore) Option {
+	return func(s *Store) error {
+		if outbox == nil {
+			return store.ValidationErrorf("outbox persistence must not be nil")
+		}
+		s.outbox = outbox
+		return nil
+	}
+}
+
+// WithSessionCleanupPersistence configures the SQLite half of the fenced
+// cross-store Session deletion protocol.
+func WithSessionCleanupPersistence(cleanup store.SessionCleanupPersistenceStore) Option {
+	return func(s *Store) error {
+		if cleanup == nil {
+			return store.ValidationErrorf("session cleanup persistence must not be nil")
+		}
+		s.sessionCleanup = cleanup
+		return nil
+	}
+}
+
+// Store maps ACP control-store interfaces to Kubernetes CR status and Leases.
+type Store struct {
+	client              client.Client
+	reader              client.Reader
+	controlNamespace    string
+	watchNamespace      string
+	sessionTurns        store.SessionTurnPersistenceStore
+	harnessV1Attempts   store.HarnessV1AttemptStore
+	outbox              store.OutboxPersistenceStore
+	sessionCleanup      store.SessionCleanupPersistenceStore
+	branchClaimsEnabled bool
+	epochMutations      *semaphore.Weighted
+}
+
+// NewComposite constructs the hard-cutover DurableControlStore: Kubernetes is
+// authoritative for controller/session/prompt/publication/branch state while
+// persistence stores only SQLite-owned SessionTurn, transcript, and outbox data.
+func NewComposite(kubeClient client.Client, controlNamespace string, persistence SQLitePersistence, options ...Option) (*Store, error) {
+	if persistence == nil {
+		return nil, store.ValidationErrorf("SQLite persistence store is required")
+	}
+	combined := make([]Option, 0, len(options)+3)
+	combined = append(combined, WithSessionTurnPersistence(persistence), WithOutboxPersistence(persistence), WithSessionCleanupPersistence(persistence))
+	if attempts, ok := persistence.(store.HarnessV1AttemptStore); ok {
+		combined = append(combined, WithHarnessV1Attempts(attempts))
+	}
+	combined = append(combined, options...)
+	return New(kubeClient, controlNamespace, combined...)
+}
+
+// New constructs a Kubernetes ACP control store. The caller must add the core
+// v1alpha1 and coordination/v1 APIs to the client's scheme. controlNamespace
+// contains the singleton ControllerEpoch record and its authoritative Lease.
+func New(kubeClient client.Client, controlNamespace string, options ...Option) (*Store, error) {
+	if kubeClient == nil {
+		return nil, store.ValidationErrorf("Kubernetes client is required")
+	}
+	controlNamespace = strings.TrimSpace(controlNamespace)
+	if err := validateKubernetesNamespace(controlNamespace); err != nil {
+		return nil, err
+	}
+	result := &Store{
+		client: kubeClient, controlNamespace: controlNamespace, branchClaimsEnabled: true,
+		epochMutations: semaphore.NewWeighted(1),
+	}
+	for _, option := range options {
+		if option == nil {
+			return nil, store.ValidationErrorf("Kubernetes control-store option must not be nil")
+		}
+		if err := option(result); err != nil {
+			return nil, err
+		}
+	}
+	return result, nil
+}
+
+func (s *Store) requireBranchClaimAccess() error {
+	if s == nil || !s.branchClaimsEnabled {
+		return ErrBranchClaimAccessDisabled
+	}
+	return nil
+}
+
+// ControlNamespace returns the namespace containing the controller epoch Lease.
+func (s *Store) ControlNamespace() string {
+	return s.controlNamespace
+}
+
+// GetSessionTurn delegates SQLite-only SessionTurn reads.
+func (s *Store) GetSessionTurn(ctx context.Context, id string) (*store.SessionTurn, error) {
+	if s.sessionTurns == nil {
+		return nil, ErrSessionTurnStoreNotConfigured
+	}
+	return s.sessionTurns.GetSessionTurn(ctx, id)
+}
+
+func (s *Store) readClient() client.Reader {
+	if s != nil && s.reader != nil {
+		return s.reader
+	}
+	if s == nil {
+		return nil
+	}
+	return s.client
+}
+
+func (s *Store) namespacedListOptions(options ...client.ListOption) []client.ListOption {
+	if s == nil || s.watchNamespace == "" {
+		return options
+	}
+	return append(options, client.InNamespace(s.watchNamespace))
+}
+
+func (s *Store) requireClient() error {
+	if s == nil || s.client == nil {
+		return fmt.Errorf("kubernetes control store is not initialized")
+	}
+	return nil
+}
+
+var (
+	_ store.ControllerEpochStore        = (*Store)(nil)
+	_ store.PromptAttemptStore          = (*Store)(nil)
+	_ store.SessionControlStore         = (*Store)(nil)
+	_ store.SessionCleanupStore         = (*Store)(nil)
+	_ store.SessionCleanupRecoveryStore = (*Store)(nil)
+	_ store.BranchClaimStore            = (*Store)(nil)
+	_ store.PublicationStore            = (*Store)(nil)
+	_ store.ExternalEffectStore         = (*Store)(nil)
+	_ store.OutboxProjectionStore       = (*Store)(nil)
+	_ store.DurableControlStore         = (*Store)(nil)
+)
diff --git a/internal/store/kube/store_test.go b/internal/store/kube/store_test.go
new file mode 100644
index 000000000..d0428f59d
--- /dev/null
+++ b/internal/store/kube/store_test.go
@@ -0,0 +1,3238 @@
+package kube
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	controlstore "github.com/orka-agents/orka/internal/store"
+	sqlitestore "github.com/orka-agents/orka/internal/store/sqlite"
+	coordinationv1 "k8s.io/api/coordination/v1"
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
+)
+
+const (
+	testControlNamespace   = "orka-system"
+	testControllerFresh    = "controller-fresh"
+	testControllerRestored = "controller-restored"
+	testControllerFirst    = "controller-first"
+	testControllerSecond   = "controller-second"
+	testStatusSubresource  = "status"
+)
+
+var testNow = time.Date(2026, time.July, 25, 6, 0, 0, 0, time.UTC)
+
+func TestSamePublicationSpecUsesInstantEqualityForCommitTimestamp(t *testing.T) {
+	value := controlstore.Publication{ID: "publication-time", CommitTimestamp: testNow}
+	object := &corev1alpha1.Publication{Spec: publicationSpecToAPI(value)}
+	object.Spec.CommitTimestamp = metav1.NewTime(testNow.In(time.FixedZone("fixture-local", -7*60*60)))
+	if !samePublicationSpec(object, value) {
+		t.Fatal("equivalent publication commit timestamp instant was rejected after API round trip")
+	}
+	object.Spec.CommitTimestamp = metav1.NewTime(testNow.Add(time.Second))
+	if samePublicationSpec(object, value) {
+		t.Fatal("different publication commit timestamp instant was accepted")
+	}
+}
+
+func TestControllerEpochLeaseCAS(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient := newTestStore(t)
+
+	first, err := kubeStore.CompareAndSwapControllerEpoch(ctx, controlstore.ControllerEpochCAS{
+		ExpectedVersion: 0,
+		ExpectedEpoch:   0,
+		NewEpoch:        1,
+		HolderID:        "controller-a",
+		RequestDigest:   testDigest("epoch-1"),
+		UpdatedAt:       testNow,
+	})
+	if err != nil {
+		t.Fatalf("create controller epoch: %v", err)
+	}
+	if first.Version != 1 || first.Epoch != 1 || first.HolderID != "controller-a" {
+		t.Fatalf("first epoch = %#v", first)
+	}
+
+	var lease coordinationv1.Lease
+	leaseKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochLeaseName(controlstore.DefaultControllerEpochName)}
+	if err := kubeClient.Get(ctx, leaseKey, &lease); err != nil {
+		t.Fatalf("get epoch Lease: %v", err)
+	}
+	if lease.ResourceVersion == "" || lease.Spec.HolderIdentity == nil || *lease.Spec.HolderIdentity != "controller-a" {
+		t.Fatalf("epoch Lease not authoritative: %#v", lease)
+	}
+	var record corev1alpha1.ControllerEpoch
+	recordKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochObjectName(controlstore.DefaultControllerEpochName)}
+	if err := kubeClient.Get(ctx, recordKey, &record); err != nil {
+		t.Fatalf("get epoch record: %v", err)
+	}
+	if record.Status.LeaseResourceVersion != lease.ResourceVersion || record.Status.Epoch != 1 {
+		t.Fatalf("epoch status = %#v, lease rv = %q", record.Status, lease.ResourceVersion)
+	}
+	if record.Annotations[annotationControllerEpochLeaseUID] != string(lease.UID) {
+		t.Fatalf("epoch mirror Lease UID binding = %q, want %q", record.Annotations[annotationControllerEpochLeaseUID], lease.UID)
+	}
+	if predecessorDigest := lease.Annotations[annotationControllerEpochPredecessorDigest]; predecessorDigest != "" {
+		t.Fatalf("initial epoch Lease predecessor digest = %q, want empty", predecessorDigest)
+	}
+
+	secondChange := controlstore.ControllerEpochCAS{
+		ExpectedVersion: 1,
+		ExpectedEpoch:   1,
+		NewEpoch:        2,
+		HolderID:        "controller-b",
+		RequestDigest:   testDigest("epoch-2"),
+		UpdatedAt:       testNow.Add(time.Minute),
+	}
+	second, err := kubeStore.CompareAndSwapControllerEpoch(ctx, secondChange)
+	if err != nil {
+		t.Fatalf("advance controller epoch: %v", err)
+	}
+	if second.Version != 2 || second.Epoch != 2 || second.HolderID != "controller-b" {
+		t.Fatalf("second epoch = %#v", second)
+	}
+	if err := kubeClient.Get(ctx, leaseKey, &lease); err != nil {
+		t.Fatalf("get advanced epoch Lease: %v", err)
+	}
+	if err := kubeClient.Get(ctx, recordKey, &record); err != nil {
+		t.Fatalf("get advanced epoch record: %v", err)
+	}
+	predecessorDigest, err := controllerEpochPredecessorDigest(&lease)
+	if err != nil {
+		t.Fatalf("parse advanced epoch predecessor digest: %v", err)
+	}
+	if predecessorDigest == "" {
+		t.Fatal("advanced epoch Lease omitted authenticated predecessor digest")
+	}
+	if record.Annotations[annotationControllerEpochLeaseUID] != string(lease.UID) || record.Status.Epoch != 2 || record.Status.Version != 2 {
+		t.Fatalf("advanced epoch mirror = annotations %#v status %#v Lease UID %q", record.Annotations, record.Status, lease.UID)
+	}
+
+	if _, err := kubeStore.CompareAndSwapControllerEpoch(ctx, controlstore.ControllerEpochCAS{
+		ExpectedVersion: 1,
+		ExpectedEpoch:   1,
+		NewEpoch:        3,
+		HolderID:        "controller-c",
+		RequestDigest:   testDigest("epoch-3"),
+		UpdatedAt:       testNow.Add(2 * time.Minute),
+	}); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("stale epoch CAS error = %v, want conflict", err)
+	}
+
+	retry, err := kubeStore.CompareAndSwapControllerEpoch(ctx, secondChange)
+	if err != nil {
+		t.Fatalf("idempotent epoch retry: %v", err)
+	}
+	if retry.Version != 2 || retry.Epoch != 2 {
+		t.Fatalf("retry epoch = %#v", retry)
+	}
+}
+
+func TestControllerEpochAuthorityRejectsRecreatedLeaseIncarnation(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, fence := newTestStoreWithEpoch(t)
+	name := controlstore.DefaultControllerEpochName
+	leaseKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochLeaseName(name)}
+	lease := &coordinationv1.Lease{}
+	if err := kubeClient.Get(ctx, leaseKey, lease); err != nil {
+		t.Fatalf("get original controller epoch Lease: %v", err)
+	}
+	originalUID := lease.UID
+	originalResourceVersion := lease.ResourceVersion
+	replacement := lease.DeepCopy()
+	replacement.ResourceVersion = ""
+	replacement.UID = types.UID("replacement-controller-epoch-lease-uid")
+	replacement.CreationTimestamp = metav1.Time{}
+	replacement.ManagedFields = nil
+	if err := kubeClient.Delete(ctx, lease); err != nil {
+		t.Fatalf("delete original controller epoch Lease: %v", err)
+	}
+	if err := kubeClient.Create(ctx, replacement); err != nil {
+		t.Fatalf("recreate controller epoch Lease under a new UID: %v", err)
+	}
+	if replacement.UID == originalUID {
+		t.Fatalf("replacement Lease reused original UID %q", originalUID)
+	}
+	if replacement.ResourceVersion != originalResourceVersion {
+		t.Fatalf("fake replacement Lease resourceVersion = %q, want original %q to prove UID is decisive", replacement.ResourceVersion, originalResourceVersion)
+	}
+
+	objectKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochObjectName(name)}
+	before := &corev1alpha1.ControllerEpoch{}
+	if err := kubeClient.Get(ctx, objectKey, before); err != nil {
+		t.Fatalf("get bound controller epoch mirror: %v", err)
+	}
+	if before.Annotations[annotationControllerEpochLeaseUID] != string(originalUID) {
+		t.Fatalf("mirror binding = %q, want original UID %q", before.Annotations[annotationControllerEpochLeaseUID], originalUID)
+	}
+	if _, err := kubeStore.GetControllerEpoch(ctx, name); !errors.Is(err, controlstore.ErrConflict) || !strings.Contains(err.Error(), "bound to Lease UID") {
+		t.Fatalf("recreated Lease read error = %v, want UID conflict", err)
+	}
+	if _, _, err := kubeStore.requireControllerEpoch(ctx, fence); !errors.Is(err, controlstore.ErrConflict) || !strings.Contains(err.Error(), "bound to Lease UID") {
+		t.Fatalf("recreated Lease mutation-fence error = %v, want UID conflict", err)
+	}
+	key := controlstore.PromptAttemptKey{
+		Namespace: "tenant-a", TaskUID: "task-recreated-epoch-lease", Attempt: 1, PromptID: "prompt-recreated-epoch-lease",
+	}
+	ensureActiveAgentTask(t, ctx, kubeClient, key.Namespace, key.TaskUID, key.TaskUID)
+	if _, err := kubeStore.CreatePromptAttempt(ctx, boundPromptAttemptForKubeTest(&controlstore.PromptAttempt{
+		Key: key, RequestDigest: testDigest("recreated-epoch-lease"),
+	}), fence); !errors.Is(err, controlstore.ErrConflict) || !strings.Contains(err.Error(), "bound to Lease UID") {
+		t.Fatalf("recreated Lease PromptAttempt mutation error = %v, want UID conflict", err)
+	}
+	var attempts corev1alpha1.PromptAttemptList
+	if err := kubeClient.List(ctx, &attempts, client.InNamespace(key.Namespace)); err != nil {
+		t.Fatalf("list PromptAttempts after rejected recreated Lease: %v", err)
+	}
+	if len(attempts.Items) != 0 {
+		t.Fatalf("recreated Lease authorized PromptAttempt writes: %#v", attempts.Items)
+	}
+	currentLease := &coordinationv1.Lease{}
+	if err := kubeClient.Get(ctx, leaseKey, currentLease); err != nil {
+		t.Fatalf("get rejected replacement controller epoch Lease: %v", err)
+	}
+	if currentLease.ResourceVersion != replacement.ResourceVersion {
+		t.Fatalf("rejected replacement Lease resourceVersion changed from %q to %q", replacement.ResourceVersion, currentLease.ResourceVersion)
+	}
+	if token := currentLease.Annotations[annotationMutationToken]; token != "" {
+		t.Fatalf("recreated Lease gained a mutation token: %q", token)
+	}
+	if expiresAt := currentLease.Annotations[annotationMutationExpiresAt]; expiresAt != "" {
+		t.Fatalf("recreated Lease gained a mutation expiry: %q", expiresAt)
+	}
+	after := &corev1alpha1.ControllerEpoch{}
+	if err := kubeClient.Get(ctx, objectKey, after); err != nil {
+		t.Fatalf("get mirror after rejected Lease recreation: %v", err)
+	}
+	if after.ResourceVersion != before.ResourceVersion || after.Annotations[annotationControllerEpochLeaseUID] != string(originalUID) {
+		t.Fatalf("rejected Lease recreation changed mirror: before=%#v after=%#v", before.ObjectMeta, after.ObjectMeta)
+	}
+}
+
+func TestControllerEpochAuthorityRejectsRecreatedLeaseWhenMirrorBindingIsMissing(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, _ := newTestStoreWithEpoch(t)
+	name := controlstore.DefaultControllerEpochName
+	leaseKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochLeaseName(name)}
+	lease := &coordinationv1.Lease{}
+	if err := kubeClient.Get(ctx, leaseKey, lease); err != nil {
+		t.Fatalf("get original controller epoch Lease: %v", err)
+	}
+	originalResourceVersion := lease.ResourceVersion
+	replacement := lease.DeepCopy()
+	replacement.ResourceVersion = ""
+	replacement.UID = types.UID("replacement-unbound-controller-epoch-lease-uid")
+	replacement.CreationTimestamp = metav1.Time{}
+	replacement.ManagedFields = nil
+
+	objectKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochObjectName(name)}
+	object := &corev1alpha1.ControllerEpoch{}
+	if err := kubeClient.Get(ctx, objectKey, object); err != nil {
+		t.Fatalf("get bound controller epoch mirror: %v", err)
+	}
+	delete(object.Annotations, annotationControllerEpochLeaseUID)
+	if err := kubeClient.Update(ctx, object); err != nil {
+		t.Fatalf("remove controller epoch Lease UID binding: %v", err)
+	}
+	beforeResourceVersion := object.ResourceVersion
+
+	if err := kubeClient.Delete(ctx, lease); err != nil {
+		t.Fatalf("delete original controller epoch Lease: %v", err)
+	}
+	if err := kubeClient.Create(ctx, replacement); err != nil {
+		t.Fatalf("recreate unbound controller epoch Lease under a new UID: %v", err)
+	}
+	if replacement.ResourceVersion != originalResourceVersion {
+		t.Fatalf("fake replacement Lease resourceVersion = %q, want original %q to prove UID is decisive", replacement.ResourceVersion, originalResourceVersion)
+	}
+
+	if _, err := kubeStore.GetControllerEpoch(ctx, name); !errors.Is(err, controlstore.ErrConflict) || !strings.Contains(err.Error(), "has no immutable authoritative Lease UID binding") {
+		t.Fatalf("unbound recreated Lease read error = %v, want fail-closed conflict", err)
+	}
+	if err := kubeClient.Get(ctx, objectKey, object); err != nil {
+		t.Fatalf("get mirror after rejected unbound Lease recreation: %v", err)
+	}
+	if object.ResourceVersion != beforeResourceVersion {
+		t.Fatalf("rejected unbound Lease recreation changed mirror resourceVersion from %q to %q", beforeResourceVersion, object.ResourceVersion)
+	}
+	if _, present := object.Annotations[annotationControllerEpochLeaseUID]; present {
+		t.Fatalf("rejected unbound Lease recreation gained a UID binding: %#v", object.Annotations)
+	}
+}
+
+func TestControllerEpochAuthorityRejectsMissingLeaseUIDBinding(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, fence := newTestStoreWithEpoch(t)
+	name := controlstore.DefaultControllerEpochName
+	leaseKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochLeaseName(name)}
+	leaseBefore := &coordinationv1.Lease{}
+	if err := kubeClient.Get(ctx, leaseKey, leaseBefore); err != nil {
+		t.Fatalf("get controller epoch Lease before missing-binding rejection: %v", err)
+	}
+	object := &corev1alpha1.ControllerEpoch{}
+	objectKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochObjectName(name)}
+	if err := kubeClient.Get(ctx, objectKey, object); err != nil {
+		t.Fatalf("get controller epoch mirror: %v", err)
+	}
+	delete(object.Annotations, annotationControllerEpochLeaseUID)
+	if err := kubeClient.Update(ctx, object); err != nil {
+		t.Fatalf("simulate pre-UID-binding controller epoch mirror: %v", err)
+	}
+	beforeResourceVersion := object.ResourceVersion
+
+	if _, err := kubeStore.GetControllerEpoch(ctx, name); !errors.Is(err, controlstore.ErrConflict) || !strings.Contains(err.Error(), "has no immutable authoritative Lease UID binding") {
+		t.Fatalf("missing Lease UID binding error = %v, want fail-closed conflict", err)
+	}
+	if _, _, err := kubeStore.requireControllerEpoch(ctx, fence); !errors.Is(err, controlstore.ErrConflict) || !strings.Contains(err.Error(), "has no immutable authoritative Lease UID binding") {
+		t.Fatalf("missing Lease UID mutation-fence error = %v, want fail-closed conflict", err)
+	}
+	leaseAfter := &coordinationv1.Lease{}
+	if err := kubeClient.Get(ctx, leaseKey, leaseAfter); err != nil {
+		t.Fatalf("get controller epoch Lease after missing-binding rejection: %v", err)
+	}
+	if leaseAfter.ResourceVersion != leaseBefore.ResourceVersion || leaseAfter.Annotations[annotationMutationToken] != "" || leaseAfter.Annotations[annotationMutationExpiresAt] != "" {
+		t.Fatalf("missing binding changed controller epoch Lease: before=%#v after=%#v", leaseBefore.ObjectMeta, leaseAfter.ObjectMeta)
+	}
+	if err := kubeClient.Get(ctx, objectKey, object); err != nil {
+		t.Fatalf("get rejected unbound controller epoch mirror: %v", err)
+	}
+	if object.ResourceVersion != beforeResourceVersion {
+		t.Fatalf("rejected unbound mirror changed resourceVersion from %q to %q", beforeResourceVersion, object.ResourceVersion)
+	}
+	if _, present := object.Annotations[annotationControllerEpochLeaseUID]; present {
+		t.Fatalf("rejected unbound mirror gained a Lease UID binding: %#v", object.Annotations)
+	}
+}
+
+func TestControllerEpochAuthorityRejectsLegacyUIDBackfillDuringActiveMutation(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, _ := newTestStoreWithEpoch(t)
+	name := controlstore.DefaultControllerEpochName
+	object := &corev1alpha1.ControllerEpoch{}
+	objectKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochObjectName(name)}
+	if err := kubeClient.Get(ctx, objectKey, object); err != nil {
+		t.Fatalf("get controller epoch mirror: %v", err)
+	}
+	delete(object.Annotations, annotationControllerEpochLeaseUID)
+	if err := kubeClient.Update(ctx, object); err != nil {
+		t.Fatalf("remove legacy Lease UID binding: %v", err)
+	}
+	lease := &coordinationv1.Lease{}
+	leaseKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochLeaseName(name)}
+	if err := kubeClient.Get(ctx, leaseKey, lease); err != nil {
+		t.Fatalf("get controller epoch Lease: %v", err)
+	}
+	lease.Annotations[annotationMutationToken] = "active-upgrade-mutation"
+	lease.Annotations[annotationMutationExpiresAt] = formatTime(time.Now().UTC().Add(time.Minute))
+	if err := kubeClient.Update(ctx, lease); err != nil {
+		t.Fatalf("mark active controller epoch mutation: %v", err)
+	}
+
+	if _, err := kubeStore.GetControllerEpoch(ctx, name); !errors.Is(err, controlstore.ErrConflict) || !strings.Contains(err.Error(), "has no immutable authoritative Lease UID binding") {
+		t.Fatalf("active-mutation missing-binding error = %v, want conflict", err)
+	}
+	if err := kubeClient.Get(ctx, objectKey, object); err != nil {
+		t.Fatalf("get mirror after rejected UID backfill: %v", err)
+	}
+	if _, present := object.Annotations[annotationControllerEpochLeaseUID]; present {
+		t.Fatalf("active mutation gained a Lease UID binding: %#v", object.Annotations)
+	}
+}
+
+func TestControllerEpochAuthorityRejectsWrongLeaseUIDBinding(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, fence := newTestStoreWithEpoch(t)
+	name := controlstore.DefaultControllerEpochName
+	leaseKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochLeaseName(name)}
+	leaseBefore := &coordinationv1.Lease{}
+	if err := kubeClient.Get(ctx, leaseKey, leaseBefore); err != nil {
+		t.Fatalf("get controller epoch Lease before wrong-binding rejection: %v", err)
+	}
+	object := &corev1alpha1.ControllerEpoch{}
+	objectKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochObjectName(name)}
+	if err := kubeClient.Get(ctx, objectKey, object); err != nil {
+		t.Fatalf("get controller epoch mirror: %v", err)
+	}
+	object.Annotations[annotationControllerEpochLeaseUID] = "wrong-controller-epoch-lease-uid"
+	if err := kubeClient.Update(ctx, object); err != nil {
+		t.Fatalf("forge controller epoch Lease UID binding: %v", err)
+	}
+	if _, err := kubeStore.GetControllerEpoch(ctx, name); !errors.Is(err, controlstore.ErrConflict) || !strings.Contains(err.Error(), "bound to Lease UID") {
+		t.Fatalf("wrong Lease UID binding error = %v, want conflict", err)
+	}
+	if _, _, err := kubeStore.requireControllerEpoch(ctx, fence); !errors.Is(err, controlstore.ErrConflict) || !strings.Contains(err.Error(), "bound to Lease UID") {
+		t.Fatalf("wrong Lease UID mutation-fence error = %v, want conflict", err)
+	}
+	leaseAfter := &coordinationv1.Lease{}
+	if err := kubeClient.Get(ctx, leaseKey, leaseAfter); err != nil {
+		t.Fatalf("get controller epoch Lease after wrong-binding rejection: %v", err)
+	}
+	if leaseAfter.ResourceVersion != leaseBefore.ResourceVersion || leaseAfter.Annotations[annotationMutationToken] != "" || leaseAfter.Annotations[annotationMutationExpiresAt] != "" {
+		t.Fatalf("wrong binding changed controller epoch Lease: before=%#v after=%#v", leaseBefore.ObjectMeta, leaseAfter.ObjectMeta)
+	}
+}
+
+func TestControllerEpochStatusSyncExactMirrorIsWriteFree(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, rawClient, _ := newTestStoreWithEpoch(t)
+	name := controlstore.DefaultControllerEpochName
+	lease := &coordinationv1.Lease{}
+	leaseKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochLeaseName(name)}
+	if err := rawClient.Get(ctx, leaseKey, lease); err != nil {
+		t.Fatalf("get authoritative controller epoch Lease: %v", err)
+	}
+	epoch, err := controllerEpochFromLease(name, lease)
+	if err != nil {
+		t.Fatalf("parse authoritative controller epoch Lease: %v", err)
+	}
+	object := &corev1alpha1.ControllerEpoch{}
+	objectKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochObjectName(name)}
+	if err := rawClient.Get(ctx, objectKey, object); err != nil {
+		t.Fatalf("get exact controller epoch mirror: %v", err)
+	}
+	beforeResourceVersion := object.ResourceVersion
+
+	withWatch, ok := rawClient.(client.WithWatch)
+	if !ok {
+		t.Fatal("fake client does not implement client.WithWatch")
+	}
+	var statusWrites atomic.Int32
+	var objectWrites atomic.Int32
+	kubeStore.client = interceptor.NewClient(withWatch, interceptor.Funcs{
+		SubResourceUpdate: func(ctx context.Context, delegate client.Client, subresource string, object client.Object, options ...client.SubResourceUpdateOption) error {
+			if _, isEpochObject := object.(*corev1alpha1.ControllerEpoch); isEpochObject {
+				statusWrites.Add(1)
+			}
+			return delegate.SubResource(subresource).Update(ctx, object, options...)
+		},
+		Update: func(ctx context.Context, delegate client.WithWatch, object client.Object, options ...client.UpdateOption) error {
+			if _, isEpochObject := object.(*corev1alpha1.ControllerEpoch); isEpochObject {
+				objectWrites.Add(1)
+			}
+			return delegate.Update(ctx, object, options...)
+		},
+	})
+
+	if err := kubeStore.syncControllerEpochStatus(ctx, epoch, lease, ""); err != nil {
+		t.Fatalf("sync exact controller epoch mirror: %v", err)
+	}
+	if got := statusWrites.Load(); got != 0 {
+		t.Fatalf("exact controller epoch mirror triggered %d status write(s)", got)
+	}
+	if got := objectWrites.Load(); got != 0 {
+		t.Fatalf("exact controller epoch mirror triggered %d object write(s)", got)
+	}
+	if err := rawClient.Get(ctx, objectKey, object); err != nil {
+		t.Fatalf("get controller epoch mirror after exact sync: %v", err)
+	}
+	if object.ResourceVersion != beforeResourceVersion {
+		t.Fatalf("exact controller epoch mirror resourceVersion changed from %q to %q", beforeResourceVersion, object.ResourceVersion)
+	}
+}
+
+func TestControllerEpochStatusSyncRejectsChangedLeaseSnapshotWithoutWriting(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, rawClient, _ := newTestStoreWithEpoch(t)
+	name := controlstore.DefaultControllerEpochName
+	lease := &coordinationv1.Lease{}
+	leaseKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochLeaseName(name)}
+	if err := rawClient.Get(ctx, leaseKey, lease); err != nil {
+		t.Fatalf("get authoritative controller epoch Lease: %v", err)
+	}
+	epoch, err := controllerEpochFromLease(name, lease)
+	if err != nil {
+		t.Fatalf("parse authoritative controller epoch Lease: %v", err)
+	}
+	staleLeaseSnapshot := lease.DeepCopy()
+	staleLeaseResourceVersion := lease.ResourceVersion
+	lease.Annotations["core.orka.ai/test-lease-revision"] = "changed"
+	if err := rawClient.Update(ctx, lease); err != nil {
+		t.Fatalf("change controller epoch Lease revision: %v", err)
+	}
+	if lease.ResourceVersion == staleLeaseResourceVersion {
+		t.Fatal("controller epoch Lease revision did not change")
+	}
+
+	object := &corev1alpha1.ControllerEpoch{}
+	objectKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochObjectName(name)}
+	if err := rawClient.Get(ctx, objectKey, object); err != nil {
+		t.Fatalf("get controller epoch mirror before stale sync: %v", err)
+	}
+	beforeResourceVersion := object.ResourceVersion
+	withWatch, ok := rawClient.(client.WithWatch)
+	if !ok {
+		t.Fatal("fake client does not implement client.WithWatch")
+	}
+	var writes atomic.Int32
+	kubeStore.client = interceptor.NewClient(withWatch, interceptor.Funcs{
+		SubResourceUpdate: func(ctx context.Context, delegate client.Client, subresource string, object client.Object, options ...client.SubResourceUpdateOption) error {
+			if _, isEpochObject := object.(*corev1alpha1.ControllerEpoch); isEpochObject {
+				writes.Add(1)
+			}
+			return delegate.SubResource(subresource).Update(ctx, object, options...)
+		},
+		Update: func(ctx context.Context, delegate client.WithWatch, object client.Object, options ...client.UpdateOption) error {
+			if _, isEpochObject := object.(*corev1alpha1.ControllerEpoch); isEpochObject {
+				writes.Add(1)
+			}
+			return delegate.Update(ctx, object, options...)
+		},
+	})
+
+	err = kubeStore.syncControllerEpochStatus(ctx, epoch, staleLeaseSnapshot, "")
+	if !errors.Is(err, controlstore.ErrConflict) || !strings.Contains(err.Error(), "changed from UID/resourceVersion") {
+		t.Fatalf("changed Lease snapshot sync error = %v, want resourceVersion conflict", err)
+	}
+	if got := writes.Load(); got != 0 {
+		t.Fatalf("changed Lease snapshot triggered %d controller epoch write(s)", got)
+	}
+	if err := rawClient.Get(ctx, objectKey, object); err != nil {
+		t.Fatalf("get controller epoch mirror after stale sync: %v", err)
+	}
+	if object.ResourceVersion != beforeResourceVersion || object.Status.Epoch != epoch.Epoch || object.Status.Version != epoch.Version {
+		t.Fatalf("changed Lease snapshot changed controller epoch mirror: %#v", object.Status)
+	}
+}
+
+func TestControllerEpochStatusSyncRejectsNonPredecessorMirrorWithoutWriting(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, rawClient, _ := newTestStoreWithEpoch(t)
+	name := controlstore.DefaultControllerEpochName
+	lease := &coordinationv1.Lease{}
+	leaseKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochLeaseName(name)}
+	if err := rawClient.Get(ctx, leaseKey, lease); err != nil {
+		t.Fatalf("get epoch-1 authoritative Lease: %v", err)
+	}
+	predecessorDigest := testDigest("restored-epoch-3-predecessor")
+	setControllerEpochLease(lease, controlstore.ControllerEpochCAS{
+		Name: name, NewEpoch: 3, HolderID: "controller-three",
+		RequestDigest: testDigest("epoch-3-restore"), UpdatedAt: testNow.Add(2 * time.Minute),
+	}, 3, predecessorDigest)
+	if err := rawClient.Update(ctx, lease); err != nil {
+		t.Fatalf("restore epoch-3 authoritative Lease over epoch-1 mirror: %v", err)
+	}
+	target, err := controllerEpochFromLease(name, lease)
+	if err != nil {
+		t.Fatalf("parse restored epoch-3 authoritative Lease: %v", err)
+	}
+
+	object := &corev1alpha1.ControllerEpoch{}
+	objectKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochObjectName(name)}
+	if err := rawClient.Get(ctx, objectKey, object); err != nil {
+		t.Fatalf("get epoch-1 controller epoch mirror: %v", err)
+	}
+	beforeResourceVersion := object.ResourceVersion
+	withWatch, ok := rawClient.(client.WithWatch)
+	if !ok {
+		t.Fatal("fake client does not implement client.WithWatch")
+	}
+	var writes atomic.Int32
+	kubeStore.client = interceptor.NewClient(withWatch, interceptor.Funcs{
+		SubResourceUpdate: func(ctx context.Context, delegate client.Client, subresource string, object client.Object, options ...client.SubResourceUpdateOption) error {
+			if _, isEpochObject := object.(*corev1alpha1.ControllerEpoch); isEpochObject {
+				writes.Add(1)
+			}
+			return delegate.SubResource(subresource).Update(ctx, object, options...)
+		},
+		Update: func(ctx context.Context, delegate client.WithWatch, object client.Object, options ...client.UpdateOption) error {
+			if _, isEpochObject := object.(*corev1alpha1.ControllerEpoch); isEpochObject {
+				writes.Add(1)
+			}
+			return delegate.Update(ctx, object, options...)
+		},
+	})
+
+	err = kubeStore.syncControllerEpochStatus(ctx, target, lease, predecessorDigest)
+	if !errors.Is(err, controlstore.ErrConflict) || !strings.Contains(err.Error(), "not the exact predecessor") {
+		t.Fatalf("non-predecessor mirror sync error = %v, want exact-predecessor conflict", err)
+	}
+	if got := writes.Load(); got != 0 {
+		t.Fatalf("non-predecessor mirror triggered %d controller epoch write(s)", got)
+	}
+	if err := rawClient.Get(ctx, objectKey, object); err != nil {
+		t.Fatalf("get controller epoch mirror after rejected jump: %v", err)
+	}
+	if object.ResourceVersion != beforeResourceVersion || object.Status.Epoch != 1 || object.Status.Version != 1 {
+		t.Fatalf("rejected epoch jump changed controller epoch mirror: %#v", object.Status)
+	}
+}
+
+func TestControllerEpochDelayedEpochOneStatusRetryCannotRollbackEpochTwo(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, rawClient := newTestStore(t)
+	withWatch, ok := rawClient.(client.WithWatch)
+	if !ok {
+		t.Fatal("fake client does not implement client.WithWatch")
+	}
+	name := controlstore.DefaultControllerEpochName
+	firstStatusBlocked := make(chan struct{})
+	releaseFirstStatus := make(chan struct{})
+	var statusCalls atomic.Int32
+	kubeStore.client = interceptor.NewClient(withWatch, interceptor.Funcs{
+		SubResourceUpdate: func(ctx context.Context, delegate client.Client, subresource string, object client.Object, options ...client.SubResourceUpdateOption) error {
+			if _, isEpochObject := object.(*corev1alpha1.ControllerEpoch); subresource == testStatusSubresource && isEpochObject && statusCalls.Add(1) == 1 {
+				close(firstStatusBlocked)
+				select {
+				case <-releaseFirstStatus:
+				case <-ctx.Done():
+					return ctx.Err()
+				}
+				return apierrors.NewConflict(
+					schema.GroupResource{Group: corev1alpha1.GroupVersion.Group, Resource: "controllerepochs"},
+					object.GetName(), errors.New("simulated delayed epoch-1 status conflict"),
+				)
+			}
+			return delegate.SubResource(subresource).Update(ctx, object, options...)
+		},
+	})
+
+	type casResult struct {
+		epoch *controlstore.ControllerEpoch
+		err   error
+	}
+	firstResult := make(chan casResult, 1)
+	go func() {
+		epoch, err := kubeStore.CompareAndSwapControllerEpoch(ctx, controlstore.ControllerEpochCAS{
+			Name: name, ExpectedVersion: 0, ExpectedEpoch: 0, NewEpoch: 1,
+			HolderID: testControllerFirst, RequestDigest: testDigest("delayed-epoch-1"), UpdatedAt: testNow,
+		})
+		firstResult <- casResult{epoch: epoch, err: err}
+	}()
+
+	select {
+	case <-firstStatusBlocked:
+	case <-time.After(2 * time.Second):
+		t.Fatal("epoch-1 status sync did not reach deterministic delay")
+	}
+	advanced, advanceErr := kubeStore.CompareAndSwapControllerEpoch(ctx, controlstore.ControllerEpochCAS{
+		Name: name, ExpectedVersion: 1, ExpectedEpoch: 1, NewEpoch: 2,
+		HolderID: testControllerSecond, RequestDigest: testDigest("delayed-epoch-2"), UpdatedAt: testNow.Add(time.Minute),
+	})
+	close(releaseFirstStatus)
+
+	var delayed casResult
+	select {
+	case delayed = <-firstResult:
+	case <-time.After(2 * time.Second):
+		t.Fatal("delayed epoch-1 status sync did not finish")
+	}
+	if advanceErr != nil {
+		t.Fatalf("advance to epoch 2 while epoch-1 status write is delayed: %v", advanceErr)
+	}
+	if advanced.Epoch != 2 || advanced.Version != 2 || advanced.HolderID != testControllerSecond {
+		t.Fatalf("advanced controller epoch = %#v", advanced)
+	}
+	if !errors.Is(delayed.err, controlstore.ErrConflict) {
+		t.Fatalf("delayed epoch-1 retry error = %v, want conflict after epoch 2 committed", delayed.err)
+	}
+	if delayed.epoch != nil {
+		t.Fatalf("delayed epoch-1 retry returned an epoch after conflict: %#v", delayed.epoch)
+	}
+
+	lease := &coordinationv1.Lease{}
+	if err := rawClient.Get(ctx, client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochLeaseName(name)}, lease); err != nil {
+		t.Fatalf("get final authoritative controller epoch Lease: %v", err)
+	}
+	finalEpoch, err := controllerEpochFromLease(name, lease)
+	if err != nil {
+		t.Fatalf("parse final authoritative controller epoch Lease: %v", err)
+	}
+	object := &corev1alpha1.ControllerEpoch{}
+	if err := rawClient.Get(ctx, client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochObjectName(name)}, object); err != nil {
+		t.Fatalf("get final controller epoch mirror: %v", err)
+	}
+	if finalEpoch.Epoch != 2 || finalEpoch.Version != 2 || object.Status.Epoch != 2 || object.Status.Version != 2 ||
+		object.Status.HolderID != testControllerSecond || object.Status.RequestDigest != finalEpoch.RequestDigest {
+		t.Fatalf("delayed epoch-1 retry rolled back epoch 2: Lease=%#v mirror=%#v", finalEpoch, object.Status)
+	}
+	if controllerEpochInitializationMarkerPresent(object) {
+		t.Fatalf("final epoch-2 mirror retained initialization marker: %#v", object.Annotations)
+	}
+}
+
+func TestControllerEpochLeaseCASRepairsAuthenticatedPostCASTailOnRestart(t *testing.T) {
+	ctx := context.Background()
+	rawClient, change := leaveAuthenticatedControllerEpochPostCASTail(t)
+	restartedStore, err := New(rawClient, testControlNamespace)
+	if err != nil {
+		t.Fatalf("create restarted Kubernetes store: %v", err)
+	}
+	current, err := restartedStore.GetControllerEpoch(ctx, change.Name)
+	if err != nil {
+		t.Fatalf("repair authenticated post-CAS mirror tail: %v", err)
+	}
+	if current.Epoch != change.NewEpoch || current.Version != change.NewEpoch || current.HolderID != change.HolderID || current.RequestDigest != change.RequestDigest {
+		t.Fatalf("repaired controller epoch = %#v, want target %#v", current, change)
+	}
+	lease := &coordinationv1.Lease{}
+	leaseKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochLeaseName(change.Name)}
+	if err := rawClient.Get(ctx, leaseKey, lease); err != nil {
+		t.Fatalf("get repaired authoritative Lease: %v", err)
+	}
+	object := &corev1alpha1.ControllerEpoch{}
+	objectKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochObjectName(change.Name)}
+	if err := rawClient.Get(ctx, objectKey, object); err != nil {
+		t.Fatalf("get repaired controller epoch mirror: %v", err)
+	}
+	if object.Status.Epoch != change.NewEpoch || object.Status.Version != change.NewEpoch ||
+		object.Status.LeaseResourceVersion != lease.ResourceVersion ||
+		object.Annotations[annotationControllerEpochLeaseUID] != string(lease.UID) {
+		t.Fatalf("repaired mirror = annotations %#v status %#v Lease=%#v", object.Annotations, object.Status, lease.ObjectMeta)
+	}
+	retry, err := restartedStore.CompareAndSwapControllerEpoch(ctx, change)
+	if err != nil {
+		t.Fatalf("retry committed post-CAS target: %v", err)
+	}
+	if retry.Epoch != change.NewEpoch || retry.Version != change.NewEpoch {
+		t.Fatalf("post-CAS target retry = %#v", retry)
+	}
+}
+
+func TestControllerEpochLeaseCASRejectsConcurrentPredecessorMutation(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, rawClient, _ := newTestStoreWithEpoch(t)
+	withWatch, ok := rawClient.(client.WithWatch)
+	if !ok {
+		t.Fatal("fake client does not implement client.WithWatch")
+	}
+	name := controlstore.DefaultControllerEpochName
+	objectKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochObjectName(name)}
+	mutated := false
+	kubeStore.client = interceptor.NewClient(withWatch, interceptor.Funcs{
+		Update: func(ctx context.Context, delegate client.WithWatch, object client.Object, options ...client.UpdateOption) error {
+			lease, isLease := object.(*coordinationv1.Lease)
+			if !isLease || lease.Annotations[annotationControllerEpoch] != "2" || mutated {
+				return delegate.Update(ctx, object, options...)
+			}
+			if err := delegate.Update(ctx, object, options...); err != nil {
+				return err
+			}
+			mirror := &corev1alpha1.ControllerEpoch{}
+			if err := delegate.Get(ctx, objectKey, mirror); err != nil {
+				return err
+			}
+			mirror.Status.RequestDigest = testDigest("forged-concurrent-predecessor")
+			if err := delegate.Status().Update(ctx, mirror); err != nil {
+				return err
+			}
+			mutated = true
+			return nil
+		},
+	})
+	change := controlstore.ControllerEpochCAS{
+		Name: name, ExpectedVersion: 1, ExpectedEpoch: 1, NewEpoch: 2,
+		HolderID: testControllerSecond, RequestDigest: testDigest("concurrent-predecessor-epoch-2"), UpdatedAt: testNow.Add(time.Minute),
+	}
+	if _, err := kubeStore.CompareAndSwapControllerEpoch(ctx, change); !errors.Is(err, controlstore.ErrConflict) || !strings.Contains(err.Error(), "predecessor mirror digest does not match") {
+		t.Fatalf("concurrent predecessor mutation CAS error = %v, want digest conflict", err)
+	}
+	if !mutated {
+		t.Fatal("concurrent predecessor mutation hook did not run")
+	}
+	lease := &coordinationv1.Lease{}
+	if err := rawClient.Get(ctx, client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochLeaseName(name)}, lease); err != nil {
+		t.Fatalf("get committed epoch-2 Lease after rejected mirror sync: %v", err)
+	}
+	committed, err := controllerEpochFromLease(name, lease)
+	if err != nil {
+		t.Fatalf("parse committed epoch-2 Lease: %v", err)
+	}
+	if committed.Epoch != 2 || committed.Version != 2 {
+		t.Fatalf("authoritative Lease did not commit epoch 2: %#v", committed)
+	}
+	restartedStore, err := New(rawClient, testControlNamespace)
+	if err != nil {
+		t.Fatalf("create restarted Kubernetes store: %v", err)
+	}
+	if _, err := restartedStore.GetControllerEpoch(ctx, name); !errors.Is(err, controlstore.ErrConflict) || !strings.Contains(err.Error(), "predecessor mirror digest does not match") {
+		t.Fatalf("restart accepted forged predecessor mirror: %v", err)
+	}
+}
+
+func TestControllerEpochAuthorityRejectsCorruptPredecessorTimestampsWithoutPanic(t *testing.T) {
+	tests := []struct {
+		name   string
+		mutate func(*corev1alpha1.ControllerEpochStatus)
+	}{
+		{name: "missing acquiredAt", mutate: func(status *corev1alpha1.ControllerEpochStatus) { status.AcquiredAt = nil }},
+		{name: "missing updatedAt", mutate: func(status *corev1alpha1.ControllerEpochStatus) { status.UpdatedAt = nil }},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			ctx := context.Background()
+			rawClient, change := leaveAuthenticatedControllerEpochPostCASTail(t)
+			object := &corev1alpha1.ControllerEpoch{}
+			objectKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochObjectName(change.Name)}
+			if err := rawClient.Get(ctx, objectKey, object); err != nil {
+				t.Fatalf("get authenticated predecessor mirror: %v", err)
+			}
+			test.mutate(&object.Status)
+			if err := rawClient.Status().Update(ctx, object); err != nil {
+				t.Fatalf("corrupt predecessor timestamp: %v", err)
+			}
+			restartedStore, err := New(rawClient, testControlNamespace)
+			if err != nil {
+				t.Fatalf("create restarted Kubernetes store: %v", err)
+			}
+			if _, err := restartedStore.GetControllerEpoch(ctx, change.Name); err == nil || !strings.Contains(err.Error(), "predecessor mirror has incomplete timestamps") {
+				t.Fatalf("corrupt predecessor timestamp error = %v, want fail-closed validation", err)
+			}
+		})
+	}
+}
+
+func leaveAuthenticatedControllerEpochPostCASTail(t *testing.T) (client.Client, controlstore.ControllerEpochCAS) {
+	t.Helper()
+	ctx := context.Background()
+	kubeStore, rawClient, _ := newTestStoreWithEpoch(t)
+	withWatch, ok := rawClient.(client.WithWatch)
+	if !ok {
+		t.Fatal("fake client does not implement client.WithWatch")
+	}
+	injectedErr := errors.New("injected post-CAS status sync failure")
+	failTargetStatus := true
+	kubeStore.client = interceptor.NewClient(withWatch, interceptor.Funcs{
+		SubResourceUpdate: func(ctx context.Context, delegate client.Client, subresource string, object client.Object, options ...client.SubResourceUpdateOption) error {
+			mirror, isEpochObject := object.(*corev1alpha1.ControllerEpoch)
+			if subresource == testStatusSubresource && isEpochObject && mirror.Status.Epoch == 2 && failTargetStatus {
+				failTargetStatus = false
+				return injectedErr
+			}
+			return delegate.SubResource(subresource).Update(ctx, object, options...)
+		},
+	})
+	change := controlstore.ControllerEpochCAS{
+		Name: controlstore.DefaultControllerEpochName, ExpectedVersion: 1, ExpectedEpoch: 1, NewEpoch: 2,
+		HolderID: testControllerSecond, RequestDigest: testDigest("post-CAS-tail-epoch-2"), UpdatedAt: testNow.Add(time.Minute),
+	}
+	if _, err := kubeStore.CompareAndSwapControllerEpoch(ctx, change); !errors.Is(err, injectedErr) {
+		t.Fatalf("post-CAS status sync error = %v, want injected failure", err)
+	}
+	lease := &coordinationv1.Lease{}
+	leaseKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochLeaseName(change.Name)}
+	if err := rawClient.Get(ctx, leaseKey, lease); err != nil {
+		t.Fatalf("get committed post-CAS Lease: %v", err)
+	}
+	predecessorDigest, err := controllerEpochPredecessorDigest(lease)
+	if err != nil {
+		t.Fatalf("parse committed predecessor digest: %v", err)
+	}
+	if predecessorDigest == "" {
+		t.Fatal("committed post-CAS Lease omitted predecessor digest")
+	}
+	object := &corev1alpha1.ControllerEpoch{}
+	objectKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochObjectName(change.Name)}
+	if err := rawClient.Get(ctx, objectKey, object); err != nil {
+		t.Fatalf("get post-CAS predecessor mirror: %v", err)
+	}
+	if object.Status.Epoch != 1 || object.Status.Version != 1 || object.Annotations[annotationControllerEpochLeaseUID] != string(lease.UID) {
+		t.Fatalf("post-CAS tail = annotations %#v status %#v Lease UID %q", object.Annotations, object.Status, lease.UID)
+	}
+	return rawClient, change
+}
+
+func TestControllerEpochLeaseCASRejectsMissingLeaseWithBlankObject(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient := newTestStore(t)
+	name := controlstore.DefaultControllerEpochName
+	object := &corev1alpha1.ControllerEpoch{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: testControlNamespace,
+			Name:      controllerEpochObjectName(name),
+		},
+		Spec: corev1alpha1.ControllerEpochSpec{Name: name},
+	}
+	if err := kubeClient.Create(ctx, object); err != nil {
+		t.Fatalf("create blank controller epoch object: %v", err)
+	}
+
+	_, err := kubeStore.CompareAndSwapControllerEpoch(ctx, controlstore.ControllerEpochCAS{
+		Name: name, ExpectedVersion: 0, ExpectedEpoch: 0, NewEpoch: 1,
+		HolderID: testControllerFresh, RequestDigest: testDigest("fresh-epoch-1"), UpdatedAt: testNow,
+	})
+	if err == nil || !strings.Contains(err.Error(), "authoritative Lease is missing") {
+		t.Fatalf("blank pre-existing object CAS error = %v, want fail-closed authority error", err)
+	}
+	leaseKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochLeaseName(name)}
+	if err := kubeClient.Get(ctx, leaseKey, &coordinationv1.Lease{}); !apierrors.IsNotFound(err) {
+		t.Fatalf("missing Lease was created from a blank pre-existing object: %v", err)
+	}
+}
+
+func TestControllerEpochLeaseCASRejectsRestoreWinningFreshObjectCreation(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, rawClient := newTestStore(t)
+	withWatch, ok := rawClient.(client.WithWatch)
+	if !ok {
+		t.Fatal("fake client does not implement client.WithWatch")
+	}
+	name := controlstore.DefaultControllerEpochName
+	restoreApplied := false
+	kubeStore.client = interceptor.NewClient(withWatch, interceptor.Funcs{
+		Create: func(ctx context.Context, delegate client.WithWatch, object client.Object, options ...client.CreateOption) error {
+			epochObject, isEpochObject := object.(*corev1alpha1.ControllerEpoch)
+			if !isEpochObject || restoreApplied {
+				return delegate.Create(ctx, object, options...)
+			}
+			restored := epochObject.DeepCopy()
+			if err := delegate.Create(ctx, restored, options...); err != nil {
+				return err
+			}
+			restoredAt := metav1.NewTime(testNow.Add(7 * time.Hour))
+			restored.Status = corev1alpha1.ControllerEpochStatus{
+				Epoch: 7, Version: 7, HolderID: testControllerRestored, RequestDigest: testDigest("restored-epoch-7"),
+				AcquiredAt: &restoredAt, UpdatedAt: &restoredAt,
+				LeaseName: controllerEpochLeaseName(name), LeaseResourceVersion: "restored-lease-rv",
+			}
+			if err := delegate.Status().Update(ctx, restored); err != nil {
+				return err
+			}
+			restoreApplied = true
+			return apierrors.NewAlreadyExists(
+				schema.GroupResource{Group: corev1alpha1.GroupVersion.Group, Resource: "controllerepochs"},
+				restored.Name,
+			)
+		},
+	})
+
+	_, err := kubeStore.CompareAndSwapControllerEpoch(ctx, controlstore.ControllerEpochCAS{
+		Name: name, ExpectedVersion: 0, ExpectedEpoch: 0, NewEpoch: 1,
+		HolderID: testControllerFresh, RequestDigest: testDigest("fresh-epoch-1"), UpdatedAt: testNow,
+	})
+	if err == nil || !strings.Contains(err.Error(), "authoritative Lease is missing") {
+		t.Fatalf("restore-winning CAS error = %v, want fail-closed authority error", err)
+	}
+	if !restoreApplied {
+		t.Fatal("restore race was not exercised")
+	}
+	leaseKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochLeaseName(name)}
+	if err := rawClient.Get(ctx, leaseKey, &coordinationv1.Lease{}); !apierrors.IsNotFound(err) {
+		t.Fatalf("epoch-1 Lease was created after restore won object creation: %v", err)
+	}
+	object := &corev1alpha1.ControllerEpoch{}
+	objectKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochObjectName(name)}
+	if err := rawClient.Get(ctx, objectKey, object); err != nil {
+		t.Fatalf("get restore-winning ControllerEpoch object: %v", err)
+	}
+	if object.Status.Epoch != 7 || object.Status.Version != 7 || object.Status.HolderID != testControllerRestored {
+		t.Fatalf("restore-winning status changed: %#v", object.Status)
+	}
+}
+
+func TestControllerEpochLeaseCASCrashTailAfterFreshObjectCreationFailsClosed(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, rawClient := newTestStore(t)
+	withWatch, ok := rawClient.(client.WithWatch)
+	if !ok {
+		t.Fatal("fake client does not implement client.WithWatch")
+	}
+	name := controlstore.DefaultControllerEpochName
+	injectedErr := errors.New("injected Lease create failure")
+	kubeStore.client = interceptor.NewClient(withWatch, interceptor.Funcs{
+		Create: func(ctx context.Context, delegate client.WithWatch, object client.Object, options ...client.CreateOption) error {
+			if lease, isLease := object.(*coordinationv1.Lease); isLease && lease.Name == controllerEpochLeaseName(name) {
+				return injectedErr
+			}
+			return delegate.Create(ctx, object, options...)
+		},
+	})
+	_, err := kubeStore.CompareAndSwapControllerEpoch(ctx, controlstore.ControllerEpochCAS{
+		Name: name, ExpectedVersion: 0, ExpectedEpoch: 0, NewEpoch: 1,
+		HolderID: testControllerFresh, RequestDigest: testDigest("fresh-epoch-1"), UpdatedAt: testNow,
+	})
+	if !errors.Is(err, injectedErr) {
+		t.Fatalf("initial CAS error = %v, want injected Lease create failure", err)
+	}
+
+	restartedStore, err := New(rawClient, testControlNamespace)
+	if err != nil {
+		t.Fatalf("create restarted Kubernetes store: %v", err)
+	}
+	_, err = restartedStore.CompareAndSwapControllerEpoch(ctx, controlstore.ControllerEpochCAS{
+		Name: name, ExpectedVersion: 0, ExpectedEpoch: 0, NewEpoch: 1,
+		HolderID: "controller-restarted", RequestDigest: testDigest("restart-epoch-1"), UpdatedAt: testNow.Add(time.Minute),
+	})
+	if err == nil || !strings.Contains(err.Error(), "authoritative Lease is missing") {
+		t.Fatalf("crash-tail retry error = %v, want fail-closed authority error", err)
+	}
+	leaseKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochLeaseName(name)}
+	if err := rawClient.Get(ctx, leaseKey, &coordinationv1.Lease{}); !apierrors.IsNotFound(err) {
+		t.Fatalf("crash-tail retry created epoch-1 Lease: %v", err)
+	}
+}
+
+func TestControllerEpochLeaseCASRepairsMarkedEpochOneCrashTailBeforeAdvance(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, rawClient := newTestStore(t)
+	withWatch, ok := rawClient.(client.WithWatch)
+	if !ok {
+		t.Fatal("fake client does not implement client.WithWatch")
+	}
+	name := controlstore.DefaultControllerEpochName
+	injectedErr := errors.New("injected status mirror failure")
+	failStatus := true
+	kubeStore.client = interceptor.NewClient(withWatch, interceptor.Funcs{
+		SubResourceUpdate: func(ctx context.Context, delegate client.Client, subresource string, object client.Object, options ...client.SubResourceUpdateOption) error {
+			if _, isEpochObject := object.(*corev1alpha1.ControllerEpoch); subresource == testStatusSubresource && isEpochObject && failStatus {
+				failStatus = false
+				return injectedErr
+			}
+			return delegate.SubResource(subresource).Update(ctx, object, options...)
+		},
+	})
+	_, err := kubeStore.CompareAndSwapControllerEpoch(ctx, controlstore.ControllerEpochCAS{
+		Name: name, ExpectedVersion: 0, ExpectedEpoch: 0, NewEpoch: 1,
+		HolderID: testControllerFirst, RequestDigest: testDigest("marked-epoch-1"), UpdatedAt: testNow,
+	})
+	if !errors.Is(err, injectedErr) {
+		t.Fatalf("initial CAS error = %v, want injected mirror failure", err)
+	}
+
+	restartedStore, err := New(rawClient, testControlNamespace)
+	if err != nil {
+		t.Fatalf("create restarted Kubernetes store: %v", err)
+	}
+	current, err := restartedStore.GetControllerEpoch(ctx, name)
+	if err != nil {
+		t.Fatalf("read marked epoch-1 crash tail: %v", err)
+	}
+	if current.Epoch != 1 || current.Version != 1 || current.HolderID != testControllerFirst {
+		t.Fatalf("marked crash-tail epoch = %#v", current)
+	}
+	advanced, err := restartedStore.CompareAndSwapControllerEpoch(ctx, controlstore.ControllerEpochCAS{
+		Name: name, ExpectedVersion: 1, ExpectedEpoch: 1, NewEpoch: 2,
+		HolderID: testControllerSecond, RequestDigest: testDigest("marked-epoch-2"), UpdatedAt: testNow.Add(time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("advance marked crash tail: %v", err)
+	}
+	if advanced.Epoch != 2 || advanced.Version != 2 || advanced.HolderID != testControllerSecond {
+		t.Fatalf("advanced marked crash-tail epoch = %#v", advanced)
+	}
+	object := &corev1alpha1.ControllerEpoch{}
+	objectKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochObjectName(name)}
+	if err := rawClient.Get(ctx, objectKey, object); err != nil {
+		t.Fatalf("get repaired ControllerEpoch object: %v", err)
+	}
+	if object.Status.Epoch != 2 || object.Status.Version != 2 || object.Status.HolderID != testControllerSecond {
+		t.Fatalf("repaired ControllerEpoch status = %#v", object.Status)
+	}
+	if controllerEpochInitializationMarkerPresent(object) {
+		t.Fatalf("repaired ControllerEpoch retained reusable initialization marker: %#v", object.Annotations)
+	}
+}
+
+func TestControllerEpochLeaseCASConsumesInitializationMarkerAfterSuccessfulMirror(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient := newTestStore(t)
+	name := controlstore.DefaultControllerEpochName
+	initial, err := kubeStore.CompareAndSwapControllerEpoch(ctx, controlstore.ControllerEpochCAS{
+		Name: name, ExpectedVersion: 0, ExpectedEpoch: 0, NewEpoch: 1,
+		HolderID: testControllerFirst, RequestDigest: testDigest("consumed-epoch-1"), UpdatedAt: testNow,
+	})
+	if err != nil {
+		t.Fatalf("create initial epoch: %v", err)
+	}
+	object := &corev1alpha1.ControllerEpoch{}
+	objectKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochObjectName(name)}
+	if err := kubeClient.Get(ctx, objectKey, object); err != nil {
+		t.Fatalf("get committed ControllerEpoch object: %v", err)
+	}
+	if controllerEpochInitializationMarkerPresent(object) {
+		t.Fatalf("committed ControllerEpoch retained reusable initialization marker: %#v", object.Annotations)
+	}
+	object.Status = corev1alpha1.ControllerEpochStatus{}
+	if err := kubeClient.Status().Update(ctx, object); err != nil {
+		t.Fatalf("blank committed ControllerEpoch status: %v", err)
+	}
+	if _, err := kubeStore.GetControllerEpoch(ctx, name); err == nil || !strings.Contains(err.Error(), "blank status without an exact epoch-1 initialization marker") {
+		t.Fatalf("lost committed epoch-1 mirror error = %v, want fail-closed marker error", err)
+	}
+	lease := &coordinationv1.Lease{}
+	leaseKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochLeaseName(name)}
+	if err := kubeClient.Get(ctx, leaseKey, lease); err != nil {
+		t.Fatalf("get preserved authoritative Lease: %v", err)
+	}
+	parsed, err := controllerEpochFromLease(name, lease)
+	if err != nil {
+		t.Fatalf("parse preserved authoritative Lease: %v", err)
+	}
+	if parsed.Epoch != initial.Epoch || parsed.Version != initial.Version || parsed.HolderID != initial.HolderID {
+		t.Fatalf("lost mirror changed authoritative Lease: got %#v, want %#v", parsed, initial)
+	}
+}
+
+func TestControllerEpochLeaseCASRepairsInitializationMarkerCleanupCrashTail(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, rawClient := newTestStore(t)
+	withWatch, ok := rawClient.(client.WithWatch)
+	if !ok {
+		t.Fatal("fake client does not implement client.WithWatch")
+	}
+	name := controlstore.DefaultControllerEpochName
+	injectedErr := errors.New("injected initialization marker cleanup failure")
+	failCleanup := true
+	kubeStore.client = interceptor.NewClient(withWatch, interceptor.Funcs{
+		Update: func(ctx context.Context, delegate client.WithWatch, object client.Object, options ...client.UpdateOption) error {
+			if _, isEpochObject := object.(*corev1alpha1.ControllerEpoch); isEpochObject && failCleanup {
+				failCleanup = false
+				return injectedErr
+			}
+			return delegate.Update(ctx, object, options...)
+		},
+	})
+	_, err := kubeStore.CompareAndSwapControllerEpoch(ctx, controlstore.ControllerEpochCAS{
+		Name: name, ExpectedVersion: 0, ExpectedEpoch: 0, NewEpoch: 1,
+		HolderID: testControllerFirst, RequestDigest: testDigest("marker-cleanup-epoch-1"), UpdatedAt: testNow,
+	})
+	if !errors.Is(err, injectedErr) {
+		t.Fatalf("initial CAS error = %v, want injected marker cleanup failure", err)
+	}
+	partial := &corev1alpha1.ControllerEpoch{}
+	objectKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochObjectName(name)}
+	if err := rawClient.Get(ctx, objectKey, partial); err != nil {
+		t.Fatalf("get marker cleanup crash tail: %v", err)
+	}
+	if partial.Status.Epoch != 1 || partial.Status.Version != 1 || !controllerEpochInitializationMarkerPresent(partial) {
+		t.Fatalf("marker cleanup crash tail = status %#v annotations %#v", partial.Status, partial.Annotations)
+	}
+	if _, bound := partial.Annotations[annotationControllerEpochLeaseUID]; bound {
+		t.Fatalf("marker cleanup crash tail already bound a Lease UID: %#v", partial.Annotations)
+	}
+
+	restartedStore, err := New(rawClient, testControlNamespace)
+	if err != nil {
+		t.Fatalf("create restarted Kubernetes store: %v", err)
+	}
+	current, err := restartedStore.GetControllerEpoch(ctx, name)
+	if err != nil {
+		t.Fatalf("repair marker cleanup crash tail: %v", err)
+	}
+	if current.Epoch != 1 || current.Version != 1 || current.HolderID != testControllerFirst {
+		t.Fatalf("repaired marker cleanup epoch = %#v", current)
+	}
+	repaired := &corev1alpha1.ControllerEpoch{}
+	if err := rawClient.Get(ctx, objectKey, repaired); err != nil {
+		t.Fatalf("get repaired marker cleanup object: %v", err)
+	}
+	if controllerEpochInitializationMarkerPresent(repaired) {
+		t.Fatalf("repaired object retained initialization marker: %#v", repaired.Annotations)
+	}
+	lease := &coordinationv1.Lease{}
+	if err := rawClient.Get(ctx, client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochLeaseName(name)}, lease); err != nil {
+		t.Fatalf("get authoritative Lease after marker cleanup repair: %v", err)
+	}
+	if repaired.Annotations[annotationControllerEpochLeaseUID] != string(lease.UID) {
+		t.Fatalf("repaired object Lease UID binding = %q, want %q", repaired.Annotations[annotationControllerEpochLeaseUID], lease.UID)
+	}
+}
+
+func TestControllerEpochAuthorityRejectsBlankMirrorAfterAdvance(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, _ := newTestStoreWithEpoch(t)
+	name := controlstore.DefaultControllerEpochName
+	advanced, err := kubeStore.CompareAndSwapControllerEpoch(ctx, controlstore.ControllerEpochCAS{
+		Name: name, ExpectedVersion: 1, ExpectedEpoch: 1, NewEpoch: 2,
+		HolderID: testControllerSecond, RequestDigest: testDigest("epoch-2"), UpdatedAt: testNow.Add(time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("advance controller epoch: %v", err)
+	}
+	object := &corev1alpha1.ControllerEpoch{}
+	objectKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochObjectName(name)}
+	if err := kubeClient.Get(ctx, objectKey, object); err != nil {
+		t.Fatalf("get advanced ControllerEpoch object: %v", err)
+	}
+	object.Status = corev1alpha1.ControllerEpochStatus{}
+	if err := kubeClient.Status().Update(ctx, object); err != nil {
+		t.Fatalf("blank advanced ControllerEpoch status: %v", err)
+	}
+	if _, err := kubeStore.GetControllerEpoch(ctx, name); err == nil || !strings.Contains(err.Error(), "blank mirror cannot consume") {
+		t.Fatalf("blank advanced mirror read error = %v, want fail-closed marker error", err)
+	}
+	lease := &coordinationv1.Lease{}
+	leaseKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochLeaseName(name)}
+	if err := kubeClient.Get(ctx, leaseKey, lease); err != nil {
+		t.Fatalf("get preserved authoritative Lease: %v", err)
+	}
+	parsed, err := controllerEpochFromLease(name, lease)
+	if err != nil {
+		t.Fatalf("parse preserved authoritative Lease: %v", err)
+	}
+	if parsed.Epoch != advanced.Epoch || parsed.Version != advanced.Version || parsed.HolderID != advanced.HolderID {
+		t.Fatalf("blank mirror changed authoritative Lease: got %#v, want %#v", parsed, advanced)
+	}
+}
+
+func TestControllerEpochAuthorityRejectsForgedPredecessorAfterAdvance(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, _ := newTestStoreWithEpoch(t)
+	name := controlstore.DefaultControllerEpochName
+	object := &corev1alpha1.ControllerEpoch{}
+	objectKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochObjectName(name)}
+	if err := kubeClient.Get(ctx, objectKey, object); err != nil {
+		t.Fatalf("get epoch-1 ControllerEpoch object: %v", err)
+	}
+	staleStatus := object.Status.DeepCopy()
+	advanced, err := kubeStore.CompareAndSwapControllerEpoch(ctx, controlstore.ControllerEpochCAS{
+		Name: name, ExpectedVersion: 1, ExpectedEpoch: 1, NewEpoch: 2,
+		HolderID: testControllerSecond, RequestDigest: testDigest("epoch-2"), UpdatedAt: testNow.Add(time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("advance controller epoch: %v", err)
+	}
+	if err := kubeClient.Get(ctx, objectKey, object); err != nil {
+		t.Fatalf("get epoch-2 ControllerEpoch object: %v", err)
+	}
+	object.Status = *staleStatus
+	object.Status.HolderID = "controller-forged-predecessor"
+	if err := kubeClient.Status().Update(ctx, object); err != nil {
+		t.Fatalf("restore forged predecessor ControllerEpoch status: %v", err)
+	}
+	if _, err := kubeStore.GetControllerEpoch(ctx, name); err == nil || !strings.Contains(err.Error(), "predecessor mirror digest does not match") {
+		t.Fatalf("forged predecessor mirror read error = %v, want digest mismatch", err)
+	}
+	lease := &coordinationv1.Lease{}
+	leaseKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochLeaseName(name)}
+	if err := kubeClient.Get(ctx, leaseKey, lease); err != nil {
+		t.Fatalf("get preserved authoritative Lease: %v", err)
+	}
+	parsed, err := controllerEpochFromLease(name, lease)
+	if err != nil {
+		t.Fatalf("parse preserved authoritative Lease: %v", err)
+	}
+	if parsed.Epoch != advanced.Epoch || parsed.Version != advanced.Version || parsed.HolderID != advanced.HolderID {
+		t.Fatalf("stale mirror changed authoritative Lease: got %#v, want %#v", parsed, advanced)
+	}
+}
+
+func TestControllerEpochAuthorityRejectsCorruptBlankMirrorInitializationMarker(t *testing.T) {
+	tests := []struct {
+		name   string
+		mutate func(map[string]string)
+	}{
+		{name: "missing holder", mutate: func(annotations map[string]string) {
+			delete(annotations, annotationControllerEpochInitializationHolder)
+		}},
+		{name: "digest mismatch", mutate: func(annotations map[string]string) {
+			annotations[annotationRequestDigest] = testDigest("other-initialization")
+		}},
+		{name: "Lease name mismatch", mutate: func(annotations map[string]string) {
+			annotations[annotationControllerEpochInitializationLeaseName] = "other-lease"
+		}},
+		{name: "epoch mismatch", mutate: func(annotations map[string]string) { annotations[annotationControllerEpoch] = "2" }},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			ctx := context.Background()
+			kubeStore, rawClient := newTestStore(t)
+			withWatch, ok := rawClient.(client.WithWatch)
+			if !ok {
+				t.Fatal("fake client does not implement client.WithWatch")
+			}
+			injectedErr := errors.New("injected status mirror failure")
+			kubeStore.client = interceptor.NewClient(withWatch, interceptor.Funcs{
+				SubResourceUpdate: func(context.Context, client.Client, string, client.Object, ...client.SubResourceUpdateOption) error {
+					return injectedErr
+				},
+			})
+			_, err := kubeStore.CompareAndSwapControllerEpoch(ctx, controlstore.ControllerEpochCAS{
+				Name: controlstore.DefaultControllerEpochName, ExpectedVersion: 0, ExpectedEpoch: 0, NewEpoch: 1,
+				HolderID: testControllerFirst, RequestDigest: testDigest("marked-epoch-1"), UpdatedAt: testNow,
+			})
+			if !errors.Is(err, injectedErr) {
+				t.Fatalf("initial CAS error = %v, want injected mirror failure", err)
+			}
+			object := &corev1alpha1.ControllerEpoch{}
+			objectKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochObjectName(controlstore.DefaultControllerEpochName)}
+			if err := rawClient.Get(ctx, objectKey, object); err != nil {
+				t.Fatalf("get marked ControllerEpoch object: %v", err)
+			}
+			test.mutate(object.Annotations)
+			if err := rawClient.Update(ctx, object); err != nil {
+				t.Fatalf("corrupt initialization marker: %v", err)
+			}
+			restartedStore, err := New(rawClient, testControlNamespace)
+			if err != nil {
+				t.Fatalf("create restarted Kubernetes store: %v", err)
+			}
+			if _, err := restartedStore.GetControllerEpoch(ctx, controlstore.DefaultControllerEpochName); err == nil {
+				t.Fatal("corrupt blank-mirror initialization marker was accepted")
+			}
+		})
+	}
+}
+
+func TestControllerEpochLeaseCASRejectsMissingLeaseWithRestoredStatus(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient := newTestStore(t)
+	name := controlstore.DefaultControllerEpochName
+	initial, err := kubeStore.CompareAndSwapControllerEpoch(ctx, controlstore.ControllerEpochCAS{
+		Name: name, ExpectedVersion: 0, ExpectedEpoch: 0, NewEpoch: 1,
+		HolderID: "controller-initial", RequestDigest: testDigest("initial-epoch-1"), UpdatedAt: testNow,
+	})
+	if err != nil {
+		t.Fatalf("create initial epoch: %v", err)
+	}
+	if initial.Epoch != 1 {
+		t.Fatalf("initial epoch = %#v", initial)
+	}
+
+	leaseKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochLeaseName(name)}
+	lease := &coordinationv1.Lease{}
+	if err := kubeClient.Get(ctx, leaseKey, lease); err != nil {
+		t.Fatalf("get initial controller epoch Lease: %v", err)
+	}
+	objectKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochObjectName(name)}
+	object := &corev1alpha1.ControllerEpoch{}
+	if err := kubeClient.Get(ctx, objectKey, object); err != nil {
+		t.Fatalf("get initial controller epoch object: %v", err)
+	}
+	restoredAt := metav1.NewTime(testNow.Add(7 * time.Hour))
+	object.Status = corev1alpha1.ControllerEpochStatus{
+		Epoch: 7, Version: 7, HolderID: testControllerRestored, RequestDigest: testDigest("restored-epoch-7"),
+		AcquiredAt: &restoredAt, UpdatedAt: &restoredAt,
+		LeaseName: lease.Name, LeaseResourceVersion: lease.ResourceVersion,
+	}
+	if err := kubeClient.Status().Update(ctx, object); err != nil {
+		t.Fatalf("restore controller epoch status: %v", err)
+	}
+	if err := kubeClient.Delete(ctx, lease); err != nil {
+		t.Fatalf("remove authoritative Lease to simulate incomplete restore: %v", err)
+	}
+
+	_, err = kubeStore.CompareAndSwapControllerEpoch(ctx, controlstore.ControllerEpochCAS{
+		Name: name, ExpectedVersion: 0, ExpectedEpoch: 0, NewEpoch: 1,
+		HolderID: "controller-after-restore", RequestDigest: testDigest("invalid-reset-to-1"), UpdatedAt: testNow.Add(8 * time.Hour),
+	})
+	if err == nil || !strings.Contains(err.Error(), "authoritative Lease is missing") {
+		t.Fatalf("missing restored Lease CAS error = %v, want fail-closed authority error", err)
+	}
+	if err := kubeClient.Get(ctx, leaseKey, &coordinationv1.Lease{}); !apierrors.IsNotFound(err) {
+		t.Fatalf("missing restored Lease was recreated: %v", err)
+	}
+	preserved := &corev1alpha1.ControllerEpoch{}
+	if err := kubeClient.Get(ctx, objectKey, preserved); err != nil {
+		t.Fatalf("get preserved controller epoch object: %v", err)
+	}
+	if preserved.Status.Epoch != 7 || preserved.Status.Version != 7 || preserved.Status.HolderID != testControllerRestored {
+		t.Fatalf("restored status was changed after rejected reset: %#v", preserved.Status)
+	}
+}
+
+func TestControllerEpochAuthorityRejectsCorruptRestore(t *testing.T) {
+	tests := []struct {
+		name   string
+		mutate func(*testing.T, context.Context, client.Client, *coordinationv1.Lease, *corev1alpha1.ControllerEpoch)
+	}{
+		{
+			name: "missing Lease holder",
+			mutate: func(t *testing.T, ctx context.Context, kubeClient client.Client, lease *coordinationv1.Lease, _ *corev1alpha1.ControllerEpoch) {
+				t.Helper()
+				lease.Spec.HolderIdentity = nil
+				if err := kubeClient.Update(ctx, lease); err != nil {
+					t.Fatalf("clear Lease holder: %v", err)
+				}
+			},
+		},
+		{
+			name: "invalid Lease digest",
+			mutate: func(t *testing.T, ctx context.Context, kubeClient client.Client, lease *coordinationv1.Lease, _ *corev1alpha1.ControllerEpoch) {
+				t.Helper()
+				lease.Annotations[annotationRequestDigest] = "sha256:invalid"
+				if err := kubeClient.Update(ctx, lease); err != nil {
+					t.Fatalf("corrupt Lease digest: %v", err)
+				}
+			},
+		},
+		{
+			name: "missing Lease epoch annotation",
+			mutate: func(t *testing.T, ctx context.Context, kubeClient client.Client, lease *coordinationv1.Lease, _ *corev1alpha1.ControllerEpoch) {
+				t.Helper()
+				delete(lease.Annotations, annotationControllerEpoch)
+				if err := kubeClient.Update(ctx, lease); err != nil {
+					t.Fatalf("remove Lease epoch annotation: %v", err)
+				}
+			},
+		},
+		{
+			name: "Lease version epoch mismatch",
+			mutate: func(t *testing.T, ctx context.Context, kubeClient client.Client, lease *coordinationv1.Lease, _ *corev1alpha1.ControllerEpoch) {
+				t.Helper()
+				lease.Annotations[annotationDomainVersion] = "2"
+				if err := kubeClient.Update(ctx, lease); err != nil {
+					t.Fatalf("corrupt Lease version: %v", err)
+				}
+			},
+		},
+		{
+			name: "status holder mismatch",
+			mutate: func(t *testing.T, ctx context.Context, kubeClient client.Client, _ *coordinationv1.Lease, object *corev1alpha1.ControllerEpoch) {
+				t.Helper()
+				object.Status.HolderID = "controller-other"
+				if err := kubeClient.Status().Update(ctx, object); err != nil {
+					t.Fatalf("mismatch status holder: %v", err)
+				}
+			},
+		},
+		{
+			name: "status digest mismatch",
+			mutate: func(t *testing.T, ctx context.Context, kubeClient client.Client, _ *coordinationv1.Lease, object *corev1alpha1.ControllerEpoch) {
+				t.Helper()
+				object.Status.RequestDigest = testDigest("mismatched-status-digest")
+				if err := kubeClient.Status().Update(ctx, object); err != nil {
+					t.Fatalf("mismatch status digest: %v", err)
+				}
+			},
+		},
+		{
+			name: "status ahead of Lease",
+			mutate: func(t *testing.T, ctx context.Context, kubeClient client.Client, _ *coordinationv1.Lease, object *corev1alpha1.ControllerEpoch) {
+				t.Helper()
+				object.Status.Epoch = 2
+				object.Status.Version = 2
+				if err := kubeClient.Status().Update(ctx, object); err != nil {
+					t.Fatalf("advance status beyond Lease: %v", err)
+				}
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			ctx := context.Background()
+			kubeStore, kubeClient, fence := newTestStoreWithEpoch(t)
+			name := controlstore.DefaultControllerEpochName
+			leaseKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochLeaseName(name)}
+			lease := &coordinationv1.Lease{}
+			if err := kubeClient.Get(ctx, leaseKey, lease); err != nil {
+				t.Fatalf("get controller epoch Lease: %v", err)
+			}
+			object := &corev1alpha1.ControllerEpoch{}
+			if err := kubeClient.Get(ctx, client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochObjectName(name)}, object); err != nil {
+				t.Fatalf("get controller epoch object: %v", err)
+			}
+			test.mutate(t, ctx, kubeClient, lease, object)
+			leaseBefore := &coordinationv1.Lease{}
+			if err := kubeClient.Get(ctx, leaseKey, leaseBefore); err != nil {
+				t.Fatalf("get corrupted controller epoch Lease: %v", err)
+			}
+			if _, err := kubeStore.GetControllerEpoch(ctx, name); err == nil {
+				t.Fatal("corrupt restored epoch authority was accepted")
+			}
+			if _, _, err := kubeStore.requireControllerEpoch(ctx, fence); err == nil {
+				t.Fatal("corrupt restored epoch authority granted a mutation fence")
+			}
+			leaseAfter := &coordinationv1.Lease{}
+			if err := kubeClient.Get(ctx, leaseKey, leaseAfter); err != nil {
+				t.Fatalf("get controller epoch Lease after rejected mutation fence: %v", err)
+			}
+			if leaseAfter.ResourceVersion != leaseBefore.ResourceVersion ||
+				leaseAfter.Annotations[annotationMutationToken] != leaseBefore.Annotations[annotationMutationToken] ||
+				leaseAfter.Annotations[annotationMutationExpiresAt] != leaseBefore.Annotations[annotationMutationExpiresAt] {
+				t.Fatalf("corrupt authority mutation check changed Lease: before=%#v after=%#v", leaseBefore.ObjectMeta, leaseAfter.ObjectMeta)
+			}
+		})
+	}
+}
+
+func TestControllerEpochMutationReleaseUsesAcquiredLeaseVersion(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, rawClient, fence := newTestStoreWithEpoch(t)
+	withWatch, ok := rawClient.(client.WithWatch)
+	if !ok {
+		t.Fatal("fake client does not implement client.WithWatch")
+	}
+	leaseKey := client.ObjectKey{
+		Namespace: testControlNamespace,
+		Name:      controllerEpochLeaseName(controlstore.DefaultControllerEpochName),
+	}
+	var staleLease coordinationv1.Lease
+	if err := rawClient.Get(ctx, leaseKey, &staleLease); err != nil {
+		t.Fatalf("get stale epoch Lease fixture: %v", err)
+	}
+	serveStaleLease := false
+	kubeStore.client = interceptor.NewClient(withWatch, interceptor.Funcs{
+		Get: func(ctx context.Context, delegate client.WithWatch, key client.ObjectKey, object client.Object, options ...client.GetOption) error {
+			if key == leaseKey && serveStaleLease {
+				lease, ok := object.(*coordinationv1.Lease)
+				if !ok {
+					t.Fatalf("epoch Lease read target = %T", object)
+				}
+				staleLease.DeepCopyInto(lease)
+				serveStaleLease = false
+				return nil
+			}
+			return delegate.Get(ctx, key, object, options...)
+		},
+		Update: func(ctx context.Context, delegate client.WithWatch, object client.Object, options ...client.UpdateOption) error {
+			if lease, ok := object.(*coordinationv1.Lease); ok && lease.Name == leaseKey.Name &&
+				lease.Annotations[annotationMutationToken] != "" {
+				if err := delegate.Update(ctx, object, options...); err != nil {
+					return err
+				}
+				serveStaleLease = true
+				return nil
+			}
+			return delegate.Update(ctx, object, options...)
+		},
+	})
+
+	key := controlstore.PromptAttemptKey{
+		Namespace: "tenant-a", TaskUID: "task-stale-release", Attempt: 1, PromptID: "prompt-stale-release",
+	}
+	ensureActiveAgentTask(t, ctx, rawClient, key.Namespace, key.TaskUID, key.TaskUID)
+	if _, err := kubeStore.CreatePromptAttempt(ctx, boundPromptAttemptForKubeTest(&controlstore.PromptAttempt{
+		Key: key, RequestDigest: testDigest("stale-release"),
+	}), fence); err != nil {
+		t.Fatalf("create prompt attempt: %v", err)
+	}
+
+	var released coordinationv1.Lease
+	if err := rawClient.Get(ctx, leaseKey, &released); err != nil {
+		t.Fatalf("get released epoch Lease: %v", err)
+	}
+	if token := released.Annotations[annotationMutationToken]; token != "" {
+		t.Fatalf("controller epoch mutation token remained after successful mutation: %q", token)
+	}
+	if expiresAt := released.Annotations[annotationMutationExpiresAt]; expiresAt != "" {
+		t.Fatalf("controller epoch mutation expiry remained after successful mutation: %q", expiresAt)
+	}
+}
+
+func TestControllerEpochMutationWaitsForShortContention(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	kubeStore, rawClient, fence := newTestStoreWithEpoch(t)
+	_, snapshot, err := kubeStore.requireControllerEpoch(ctx, fence)
+	if err != nil {
+		t.Fatalf("acquire blocking mutation: %v", err)
+	}
+	released := make(chan struct{})
+	go func() {
+		timer := time.NewTimer(50 * time.Millisecond)
+		select {
+		case <-ctx.Done():
+			timer.Stop()
+		case <-timer.C:
+		}
+		kubeStore.releaseControllerEpochMutation(snapshot)
+		close(released)
+	}()
+	key := controlstore.PromptAttemptKey{Namespace: "tenant-a", TaskUID: "task-contention", Attempt: 1, PromptID: "prompt-contention"}
+	ensureActiveAgentTask(t, ctx, rawClient, key.Namespace, key.TaskUID, key.TaskUID)
+	attempt, err := kubeStore.CreatePromptAttempt(ctx, boundPromptAttemptForKubeTest(&controlstore.PromptAttempt{Key: key, RequestDigest: testDigest("contention")}), fence)
+	if err != nil {
+		t.Fatalf("create prompt attempt after short contention: %v", err)
+	}
+	<-released
+	if attempt.ExecutionState != controlstore.PromptExecutionQueued || attempt.Version != 1 {
+		t.Fatalf("attempt after contention = %#v", attempt)
+	}
+}
+
+func TestExternalEffectLifecyclesQueueThirtyConcurrentControllerEpochMutations(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+	kubeStore, rawClient, fence := newTestStoreWithEpoch(t)
+	withWatch, ok := rawClient.(client.WithWatch)
+	if !ok {
+		t.Fatal("fake client does not implement client.WithWatch")
+	}
+	kubeStore.client = interceptor.NewClient(withWatch, interceptor.Funcs{
+		SubResourceUpdate: func(ctx context.Context, delegate client.Client, subResourceName string, object client.Object, options ...client.SubResourceUpdateOption) error {
+			if subResourceName == "status" {
+				if _, ok := object.(*corev1alpha1.ExternalEffect); ok {
+					timer := time.NewTimer(30 * time.Millisecond)
+					select {
+					case <-ctx.Done():
+						timer.Stop()
+						return ctx.Err()
+					case <-timer.C:
+					}
+				}
+			}
+			return delegate.SubResource(subResourceName).Update(ctx, object, options...)
+		},
+	})
+
+	const lifecycleCount = 30
+	start := make(chan struct{})
+	results := make(chan error, lifecycleCount)
+	for index := range lifecycleCount {
+		go func() {
+			<-start
+			label := fmt.Sprintf("security-review-%02d", index)
+			identity := controlstore.ExternalEffectIdentity{
+				Kind: "security.review", Namespace: "tenant-a", AggregateID: label, OperationID: "review",
+			}
+			now := testNow.Add(time.Duration(index) * time.Second)
+			effect, err := kubeStore.ReserveExternalEffect(ctx, controlstore.ReserveExternalEffectRequest{
+				Identity: identity, RequestDigest: testDigest(label), Fence: fence, CreatedAt: now,
+			})
+			if err != nil {
+				results <- fmt.Errorf("reserve %s: %w", label, err)
+				return
+			}
+			leaseExpiry := now.Add(5 * time.Minute)
+			inFlight, err := kubeStore.TransitionExternalEffect(ctx, controlstore.ExternalEffectTransition{
+				ID: effect.ID, Fence: fence, ExpectedVersion: effect.Version, ExpectedState: controlstore.ExternalEffectPending,
+				NewState: controlstore.ExternalEffectInFlight, RequestDigest: effect.RequestDigest,
+				LeaseOwner: "owner-" + label, LeaseExpiresAt: &leaseExpiry, UpdatedAt: now.Add(time.Millisecond),
+			})
+			if err != nil {
+				results <- fmt.Errorf("claim %s: %w", label, err)
+				return
+			}
+			response := []byte(`{"reviewed":true}`)
+			completed, err := kubeStore.TransitionExternalEffect(ctx, controlstore.ExternalEffectTransition{
+				ID: effect.ID, Fence: fence, ExpectedVersion: inFlight.Version, ExpectedState: controlstore.ExternalEffectInFlight,
+				NewState: controlstore.ExternalEffectSucceeded, RequestDigest: effect.RequestDigest,
+				ResponseDigest: testBytesDigest(response), Response: response,
+				ExpectedLeaseOwner: inFlight.LeaseOwner, UpdatedAt: now.Add(2 * time.Millisecond),
+			})
+			if err != nil {
+				results <- fmt.Errorf("settle %s: %w", label, err)
+				return
+			}
+			if completed.State != controlstore.ExternalEffectSucceeded {
+				results <- fmt.Errorf("settle %s state = %s", label, completed.State)
+				return
+			}
+			results <- nil
+		}()
+	}
+	close(start)
+	for range lifecycleCount {
+		if err := <-results; err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+func TestControllerEpochMutationQueueRespectsCallerDeadline(t *testing.T) {
+	kubeStore, _, fence := newTestStoreWithEpoch(t)
+	_, snapshot, err := kubeStore.requireControllerEpoch(context.Background(), fence)
+	if err != nil {
+		t.Fatalf("acquire blocking mutation: %v", err)
+	}
+	defer kubeStore.releaseControllerEpochMutation(snapshot)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Millisecond)
+	defer cancel()
+	if _, _, err := kubeStore.requireControllerEpoch(ctx, fence); !errors.Is(err, context.DeadlineExceeded) {
+		t.Fatalf("queued mutation error = %v, want context deadline exceeded", err)
+	}
+}
+
+func TestControllerEpochMutationReleasePreservesConcurrentLeaseUpdate(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, rawClient, fence := newTestStoreWithEpoch(t)
+	_, snapshot, err := kubeStore.requireControllerEpoch(ctx, fence)
+	if err != nil {
+		t.Fatalf("acquire mutation: %v", err)
+	}
+	leaseKey := client.ObjectKey{Namespace: testControlNamespace, Name: controllerEpochLeaseName(controlstore.DefaultControllerEpochName)}
+	var concurrent coordinationv1.Lease
+	if err := rawClient.Get(ctx, leaseKey, &concurrent); err != nil {
+		t.Fatalf("get epoch Lease for concurrent update: %v", err)
+	}
+	concurrent.Annotations["orka.ai/test-concurrent-marker"] = "preserve-me"
+	if err := rawClient.Update(ctx, &concurrent); err != nil {
+		t.Fatalf("update epoch Lease concurrently: %v", err)
+	}
+
+	kubeStore.releaseControllerEpochMutation(snapshot)
+
+	var released coordinationv1.Lease
+	if err := rawClient.Get(ctx, leaseKey, &released); err != nil {
+		t.Fatalf("get released epoch Lease: %v", err)
+	}
+	if got := released.Annotations["orka.ai/test-concurrent-marker"]; got != "preserve-me" {
+		t.Fatalf("concurrent epoch Lease annotation = %q, want preserved", got)
+	}
+	if token := released.Annotations[annotationMutationToken]; token != "" {
+		t.Fatalf("controller epoch mutation token remained after retrying release: %q", token)
+	}
+	if expiresAt := released.Annotations[annotationMutationExpiresAt]; expiresAt != "" {
+		t.Fatalf("controller epoch mutation expiry remained after retrying release: %q", expiresAt)
+	}
+}
+
+func TestGetPromptAttemptUsesConfiguredAPIReader(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, rawClient, fence := newTestStoreWithEpoch(t)
+	key := controlstore.PromptAttemptKey{Namespace: "tenant-a", TaskUID: "task-reader", Attempt: 1, PromptID: "prompt-reader"}
+	ensureActiveAgentTask(t, ctx, rawClient, key.Namespace, key.TaskUID, key.TaskUID)
+	attempt, err := kubeStore.CreatePromptAttempt(ctx, boundPromptAttemptForKubeTest(&controlstore.PromptAttempt{Key: key, RequestDigest: testDigest("reader")}), fence)
+	if err != nil {
+		t.Fatalf("create prompt attempt: %v", err)
+	}
+	objectKey := client.ObjectKey{Namespace: key.Namespace, Name: objectName(promptAttemptNamePrefix, attempt.ID)}
+	var stale corev1alpha1.PromptAttempt
+	if err := rawClient.Get(ctx, objectKey, &stale); err != nil {
+		t.Fatalf("get stale PromptAttempt fixture: %v", err)
+	}
+	if _, err := kubeStore.TransitionPromptAttemptExecution(ctx, controlstore.PromptAttemptExecutionTransition{
+		ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: controlstore.PromptExecutionQueued,
+		NewState: controlstore.PromptExecutionReserved, OperationID: "reserve-reader", OperationDigest: testDigest("reserve-reader"),
+	}); err != nil {
+		t.Fatalf("reserve prompt attempt: %v", err)
+	}
+	withWatch, ok := rawClient.(client.WithWatch)
+	if !ok {
+		t.Fatal("fake client does not implement client.WithWatch")
+	}
+	staleWriter := interceptor.NewClient(withWatch, interceptor.Funcs{
+		Get: func(ctx context.Context, delegate client.WithWatch, key client.ObjectKey, object client.Object, options ...client.GetOption) error {
+			if key == objectKey {
+				stale.DeepCopyInto(object.(*corev1alpha1.PromptAttempt))
+				return nil
+			}
+			return delegate.Get(ctx, key, object, options...)
+		},
+		List: func(ctx context.Context, delegate client.WithWatch, list client.ObjectList, options ...client.ListOption) error {
+			if attempts, ok := list.(*corev1alpha1.PromptAttemptList); ok {
+				attempts.Items = []corev1alpha1.PromptAttempt{*stale.DeepCopy()}
+				return nil
+			}
+			return delegate.List(ctx, list, options...)
+		},
+	})
+	readerStore, err := New(staleWriter, testControlNamespace, WithAPIReader(rawClient))
+	if err != nil {
+		t.Fatalf("construct store with API reader: %v", err)
+	}
+
+	current, err := readerStore.GetPromptAttempt(ctx, attempt.ID)
+	if err != nil {
+		t.Fatalf("get prompt attempt through API reader: %v", err)
+	}
+	if current.ExecutionState != controlstore.PromptExecutionReserved || current.Version != 2 {
+		t.Fatalf("PromptAttempt = %#v, want fresh Reserved version 2", current)
+	}
+}
+
+func TestNamespacedControlRecordLookupsUseWatchNamespace(t *testing.T) {
+	ctx := context.Background()
+	_, rawClient := newTestStore(t)
+	withWatch, ok := rawClient.(client.WithWatch)
+	if !ok {
+		t.Fatal("fake client does not implement client.WithWatch")
+	}
+	const watchNamespace = "tenant-a"
+	reader := interceptor.NewClient(withWatch, interceptor.Funcs{
+		List: func(ctx context.Context, delegate client.WithWatch, list client.ObjectList, options ...client.ListOption) error {
+			applied := (&client.ListOptions{}).ApplyOptions(options)
+			if applied.Namespace != watchNamespace {
+				t.Fatalf("%T list namespace = %q, want %q", list, applied.Namespace, watchNamespace)
+			}
+			return delegate.List(ctx, list, options...)
+		},
+	})
+	scopedStore, err := New(
+		rawClient,
+		testControlNamespace,
+		WithAPIReader(reader),
+		WithWatchNamespace(watchNamespace),
+	)
+	if err != nil {
+		t.Fatalf("construct namespaced control store: %v", err)
+	}
+
+	tests := []struct {
+		name   string
+		lookup func() error
+	}{
+		{
+			name: "PromptAttempt",
+			lookup: func() error {
+				_, err := scopedStore.findPromptAttemptByID(ctx, "missing-prompt-attempt")
+				return err
+			},
+		},
+		{
+			name: "Publication",
+			lookup: func() error {
+				_, err := scopedStore.findPublicationByID(ctx, "missing-publication")
+				return err
+			},
+		},
+		{
+			name: "ExternalEffect",
+			lookup: func() error {
+				_, err := scopedStore.findExternalEffectByID(ctx, "missing-external-effect")
+				return err
+			},
+		},
+		{
+			name: "RuntimeSessionControl",
+			lookup: func() error {
+				_, err := scopedStore.findSessionControlByUID(ctx, "missing-session")
+				return err
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if err := tt.lookup(); !errors.Is(err, controlstore.ErrNotFound) {
+				t.Fatalf("lookup error = %v, want ErrNotFound", err)
+			}
+		})
+	}
+}
+
+func TestGetPromptAttemptReadsLegacySpecWithoutBindingDigests(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, _ := newTestStoreWithEpoch(t)
+	key := controlstore.PromptAttemptKey{
+		Namespace: "tenant-a", TaskUID: "legacy-task-uid", Attempt: 1, PromptID: "legacy-prompt",
+	}
+	id, err := key.CanonicalID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	legacy := &corev1alpha1.PromptAttempt{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: key.Namespace, Name: objectName(promptAttemptNamePrefix, id), Labels: controlLabels(id),
+		},
+		Spec: corev1alpha1.PromptAttemptSpec{
+			ID: id, TaskUID: key.TaskUID, Attempt: key.Attempt, PromptID: key.PromptID,
+			RequestDigest: testDigest("legacy-request"),
+		},
+	}
+	if err := kubeClient.Create(ctx, legacy); err != nil {
+		t.Fatal(err)
+	}
+	got, err := kubeStore.GetPromptAttempt(ctx, id)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.BindingDigest != "" || got.SnapshotDigest != "" || got.RequestDigest != legacy.Spec.RequestDigest {
+		t.Fatalf("legacy PromptAttempt = %#v", got)
+	}
+}
+
+func TestPromptAttemptStatusCASAndIdempotency(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, fence := newTestStoreWithEpoch(t)
+	key := controlstore.PromptAttemptKey{Namespace: "tenant-a", TaskUID: "task-uid", Attempt: 1, PromptID: "prompt-1"}
+	ensureActiveAgentTask(t, ctx, kubeClient, key.Namespace, key.TaskUID, key.TaskUID)
+	attempt, err := kubeStore.CreatePromptAttempt(ctx, boundPromptAttemptForKubeTest(&controlstore.PromptAttempt{Key: key, RequestDigest: testDigest("prompt")}), fence)
+	if err != nil {
+		t.Fatalf("create prompt attempt: %v", err)
+	}
+	if attempt.Version != 1 || attempt.ExecutionState != controlstore.PromptExecutionQueued || attempt.DeliveryState != controlstore.PromptDeliveryNotRequested {
+		t.Fatalf("created attempt = %#v", attempt)
+	}
+	if attempt.BindingDigest != testDigest("test-v2-binding") || attempt.SnapshotDigest != testDigest("test-v2-snapshot") {
+		t.Fatalf("created PromptAttempt binding = %q/%q", attempt.BindingDigest, attempt.SnapshotDigest)
+	}
+	idempotent, err := kubeStore.CreatePromptAttempt(ctx, boundPromptAttemptForKubeTest(&controlstore.PromptAttempt{Key: key, RequestDigest: testDigest("prompt")}), fence)
+	if err != nil || idempotent.ID != attempt.ID || idempotent.Version != 1 {
+		t.Fatalf("idempotent create = %#v, %v", idempotent, err)
+	}
+	mismatchedBinding := boundPromptAttemptForKubeTest(&controlstore.PromptAttempt{Key: key, RequestDigest: testDigest("prompt")})
+	mismatchedBinding.BindingDigest = testDigest("different-binding")
+	if _, err := kubeStore.CreatePromptAttempt(ctx, mismatchedBinding, fence); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("binding digest mismatch error = %v, want conflict", err)
+	}
+	unboundKey := controlstore.PromptAttemptKey{Namespace: key.Namespace, TaskUID: key.TaskUID, Attempt: 2, PromptID: "prompt-unbound"}
+	if _, err := kubeStore.CreatePromptAttempt(ctx, &controlstore.PromptAttempt{
+		Key: unboundKey, RequestDigest: testDigest("prompt-unbound"),
+	}, fence); !errors.Is(err, controlstore.ErrValidation) {
+		t.Fatalf("unbound PromptAttempt error = %v, want validation", err)
+	}
+
+	operationDigest := testDigest("reserve")
+	reserved, err := kubeStore.TransitionPromptAttemptExecution(ctx, controlstore.PromptAttemptExecutionTransition{
+		ID:              attempt.ID,
+		Fence:           fence,
+		ExpectedVersion: 1,
+		ExpectedState:   controlstore.PromptExecutionQueued,
+		NewState:        controlstore.PromptExecutionReserved,
+		OperationID:     "reserve-1",
+		OperationDigest: operationDigest,
+		UpdatedAt:       testNow.Add(time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("reserve prompt attempt: %v", err)
+	}
+	if reserved.Version != 2 || reserved.ExecutionState != controlstore.PromptExecutionReserved {
+		t.Fatalf("reserved attempt = %#v", reserved)
+	}
+	retry, err := kubeStore.TransitionPromptAttemptExecution(ctx, controlstore.PromptAttemptExecutionTransition{
+		ID:              attempt.ID,
+		Fence:           fence,
+		ExpectedVersion: 1,
+		ExpectedState:   controlstore.PromptExecutionQueued,
+		NewState:        controlstore.PromptExecutionReserved,
+		OperationID:     "reserve-1",
+		OperationDigest: operationDigest,
+		UpdatedAt:       testNow.Add(time.Minute),
+	})
+	if err != nil || retry.Version != 2 {
+		t.Fatalf("idempotent execution retry = %#v, %v", retry, err)
+	}
+	if _, err := kubeStore.TransitionPromptAttemptExecution(ctx, controlstore.PromptAttemptExecutionTransition{
+		ID:              attempt.ID,
+		Fence:           fence,
+		ExpectedVersion: 1,
+		ExpectedState:   controlstore.PromptExecutionQueued,
+		NewState:        controlstore.PromptExecutionFailed,
+		OperationID:     "fail-stale",
+		OperationDigest: testDigest("fail-stale"),
+		TerminalReason:  "stale",
+	}); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("stale prompt transition error = %v, want conflict", err)
+	}
+
+	var object corev1alpha1.PromptAttempt
+	objectKey := client.ObjectKey{Namespace: key.Namespace, Name: objectName(promptAttemptNamePrefix, attempt.ID)}
+	if err := kubeClient.Get(ctx, objectKey, &object); err != nil {
+		t.Fatalf("get PromptAttempt object: %v", err)
+	}
+	if object.Status.ControllerEpochLeaseResourceVersion == "" || object.Status.Version != 2 {
+		t.Fatalf("PromptAttempt status lacks epoch/resourceVersion fence: %#v", object.Status)
+	}
+	if object.Spec.BindingDigest != attempt.BindingDigest || object.Spec.SnapshotDigest != attempt.SnapshotDigest {
+		t.Fatalf("PromptAttempt spec binding = %q/%q", object.Spec.BindingDigest, object.Spec.SnapshotDigest)
+	}
+}
+
+func TestStatusUpdateConflictMapsToStoreConflict(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, rawClient, fence := newTestStoreWithEpoch(t)
+	key := controlstore.PromptAttemptKey{Namespace: "tenant-a", TaskUID: "task-conflict", Attempt: 1, PromptID: "prompt"}
+	ensureActiveAgentTask(t, ctx, rawClient, key.Namespace, key.TaskUID, key.TaskUID)
+	attempt, err := kubeStore.CreatePromptAttempt(ctx, boundPromptAttemptForKubeTest(&controlstore.PromptAttempt{Key: key, RequestDigest: testDigest("prompt-conflict")}), fence)
+	if err != nil {
+		t.Fatalf("create prompt attempt: %v", err)
+	}
+	withWatch, ok := rawClient.(client.WithWatch)
+	if !ok {
+		t.Fatal("fake client does not implement client.WithWatch")
+	}
+	kubeStore.client = interceptor.NewClient(withWatch, interceptor.Funcs{
+		SubResourceUpdate: func(_ context.Context, _ client.Client, subresource string, obj client.Object, _ ...client.SubResourceUpdateOption) error {
+			return apierrors.NewConflict(schema.GroupResource{Group: corev1alpha1.GroupVersion.Group, Resource: "promptattempts"}, obj.GetName(), errors.New("stale resourceVersion"))
+		},
+	})
+	_, err = kubeStore.TransitionPromptAttemptExecution(ctx, controlstore.PromptAttemptExecutionTransition{
+		ID:              attempt.ID,
+		Fence:           fence,
+		ExpectedVersion: attempt.Version,
+		ExpectedState:   controlstore.PromptExecutionQueued,
+		NewState:        controlstore.PromptExecutionReserved,
+		OperationID:     "reserve-conflict",
+		OperationDigest: testDigest("reserve-conflict"),
+	})
+	if !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("resourceVersion conflict error = %v, want store.ErrConflict", err)
+	}
+}
+
+//nolint:gocyclo // The integration test intentionally exercises the complete lease/reconciliation state machine.
+func TestSessionMutationLeaseAndReconciliation(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, fence := newTestStoreWithEpoch(t)
+
+	control, err := kubeStore.CreateSessionControl(ctx, &controlstore.SessionControl{
+		Namespace: "tenant-a", SessionName: "session-a", SessionUID: "session-uid-a", RequestDigest: testDigest("session-a"),
+	}, fence)
+	if err != nil {
+		t.Fatalf("create session control: %v", err)
+	}
+	expires := testNow.Add(10 * time.Minute)
+	request := controlstore.AcquireSessionMutationLeaseRequest{
+		Namespace: control.Namespace, SessionName: control.SessionName, SessionUID: control.SessionUID,
+		Fence: fence, ExpectedVersion: control.Version, ExpectedLeaseGeneration: control.LeaseGeneration,
+		TaskUID: "task-session", Attempt: 1, PromptID: "prompt-session", RequestDigest: testDigest("session-lease"),
+		AcquiredAt: testNow, ExpiresAt: &expires, Lineage: testSessionLineageClaim(control),
+	}
+	leased, err := kubeStore.AcquireSessionMutationLease(ctx, request)
+	if err != nil {
+		t.Fatalf("acquire session mutation Lease: %v", err)
+	}
+	if leased.Version != 2 || leased.LeaseGeneration != 1 || leased.Lease == nil || leased.Lease.TaskUID != request.TaskUID {
+		t.Fatalf("leased session = %#v", leased)
+	}
+	retry, err := kubeStore.AcquireSessionMutationLease(ctx, request)
+	if err != nil || retry.Version != leased.Version {
+		t.Fatalf("idempotent lease retry = %#v, %v", retry, err)
+	}
+	crossProtocol := request
+	crossProtocolLineage := *request.Lineage
+	crossProtocolLineage.ContractVersion = "orka.harness.v1"
+	crossProtocol.Lineage = &crossProtocolLineage
+	if _, err := kubeStore.AcquireSessionMutationLease(ctx, crossProtocol); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("cross-protocol continuation error = %v, want conflict", err)
+	}
+	competitor := request
+	competitor.TaskUID = "task-other"
+	competitor.PromptID = "prompt-other"
+	competitor.RequestDigest = testDigest("session-lease-other")
+	if _, err := kubeStore.AcquireSessionMutationLease(ctx, competitor); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("competing lease error = %v, want conflict", err)
+	}
+	var sessionLease coordinationv1.Lease
+	leaseKey := client.ObjectKey{Namespace: control.Namespace, Name: runtimeSessionLeaseName(control.SessionUID)}
+	if err := kubeClient.Get(ctx, leaseKey, &sessionLease); err != nil {
+		t.Fatalf("get Session Lease: %v", err)
+	}
+	if sessionLease.Spec.HolderIdentity == nil || leased.Lease == nil || leased.LeaseGeneration != 1 {
+		t.Fatalf("Session Lease/status not authoritative: lease=%#v control=%#v", sessionLease.Spec, leased)
+	}
+
+	oldSHA := strings.Repeat("a", 40)
+	newSHA := strings.Repeat("b", 40)
+	branch, err := kubeStore.CreateBranchClaim(ctx, &controlstore.BranchClaim{
+		RepositoryID: "repo-a", Ref: "refs/heads/session", OwnerKind: controlstore.BranchClaimOwnerSession,
+		OwnerUID: "blocked-session-uid", LastVerified: controlstore.RemoteRefState{SHA: oldSHA},
+		Availability: controlstore.BranchClaimReconciliationBlocked, BlockedReason: "unknown publish",
+		RelatedPublicationID: "publication-blocked", RequestDigest: testDigest("blocked-branch"),
+	}, fence)
+	if err != nil {
+		t.Fatalf("create blocked branch claim: %v", err)
+	}
+	blocked, err := kubeStore.CreateSessionControl(ctx, &controlstore.SessionControl{
+		Namespace: "tenant-a", SessionName: "blocked-session", SessionUID: "blocked-session-uid",
+		RequestDigest: testDigest("blocked-session"), Availability: controlstore.SessionReconciliationBlocked,
+		LeaseGeneration: 1, BlockedReason: "unknown publish", RelatedPromptAttemptID: "attempt-blocked",
+		RelatedPublicationID: "publication-blocked",
+		VerifiedBaseline:     &controlstore.VerifiedBranchBaseline{RepositoryID: "repo-a", Ref: "refs/heads/session", SHA: oldSHA},
+	}, fence)
+	if err != nil {
+		t.Fatalf("create blocked session: %v", err)
+	}
+	reconcile := controlstore.ReconcileSessionControlRequest{
+		Namespace: blocked.Namespace, SessionName: blocked.SessionName, SessionUID: blocked.SessionUID,
+		Fence: fence, ExpectedVersion: blocked.Version, ExpectedLeaseGeneration: blocked.LeaseGeneration,
+		ExpectedRelatedPublicationID: "publication-blocked", BranchClaimID: branch.ID,
+		ExpectedBranchClaimVersion: branch.Version, ExpectedBranchClaimGeneration: branch.Generation,
+		ExpectedBranchBaseline: branch.LastVerified,
+		VerifiedBaseline:       controlstore.VerifiedBranchBaseline{RepositoryID: branch.RepositoryID, Ref: branch.Ref, SHA: newSHA},
+		OperationID:            "reconcile-session", OperationDigest: testDigest("reconcile-session"), ReconciledAt: testNow.Add(time.Hour),
+	}
+	reconciled, err := kubeStore.ReconcileSessionControl(ctx, reconcile)
+	if err != nil {
+		t.Fatalf("reconcile session control: %v", err)
+	}
+	if reconciled.Availability != controlstore.SessionAvailable || reconciled.VerifiedBaseline == nil || reconciled.VerifiedBaseline.SHA != newSHA || reconciled.Version != blocked.Version+1 {
+		t.Fatalf("reconciled session = %#v", reconciled)
+	}
+	reconciledBranch, err := kubeStore.GetBranchClaim(ctx, branch.ID)
+	if err != nil {
+		t.Fatalf("get reconciled branch: %v", err)
+	}
+	if reconciledBranch.Availability != controlstore.BranchClaimAvailable || reconciledBranch.LastVerified.SHA != newSHA || reconciledBranch.Version != branch.Version+1 {
+		t.Fatalf("reconciled branch = %#v", reconciledBranch)
+	}
+	var reconciliationLease coordinationv1.Lease
+	if err := kubeClient.Get(ctx, client.ObjectKey{Namespace: blocked.Namespace, Name: runtimeSessionLeaseName(blocked.SessionUID)}, &reconciliationLease); err != nil {
+		t.Fatalf("get reconciliation Lease: %v", err)
+	}
+	if reconciliationLease.Spec.HolderIdentity != nil || reconciliationLease.Annotations[annotationLeaseMode] != leaseModeEmpty {
+		t.Fatalf("reconciliation Lease was not released: %#v", reconciliationLease)
+	}
+	if retry, err := kubeStore.ReconcileSessionControl(ctx, reconcile); err != nil || retry.Version != reconciled.Version {
+		t.Fatalf("idempotent reconciliation retry = %#v, %v", retry, err)
+	}
+}
+
+func TestSessionLineageStatusCASRecoversAfterLeaseWrite(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, rawClient, fence := newTestStoreWithEpoch(t)
+	control, err := kubeStore.CreateSessionControl(ctx, &controlstore.SessionControl{
+		Namespace: "tenant-a", SessionName: "lineage-status-retry", SessionUID: "lineage-status-retry-uid",
+		RequestDigest: testDigest("lineage-status-retry"),
+	}, fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := controlstore.AcquireSessionMutationLeaseRequest{
+		Namespace: control.Namespace, SessionName: control.SessionName, SessionUID: control.SessionUID,
+		Fence: fence, ExpectedVersion: control.Version, ExpectedLeaseGeneration: control.LeaseGeneration,
+		TaskUID: "task-lineage-retry", Attempt: 1, PromptID: "prompt-lineage-retry",
+		RequestDigest: testDigest("lease-lineage-retry"), AcquiredAt: testNow,
+		Lineage: testSessionLineageClaim(control),
+	}
+	withWatch, ok := rawClient.(client.WithWatch)
+	if !ok {
+		t.Fatal("fake client does not implement client.WithWatch")
+	}
+	failStatusOnce := true
+	kubeStore.client = interceptor.NewClient(withWatch, interceptor.Funcs{
+		SubResourceUpdate: func(ctx context.Context, c client.Client, subresource string, obj client.Object, opts ...client.SubResourceUpdateOption) error {
+			if session, ok := obj.(*corev1alpha1.RuntimeSessionControl); ok && failStatusOnce && session.Status.Lineage != nil {
+				failStatusOnce = false
+				return apierrors.NewConflict(schema.GroupResource{Group: corev1alpha1.GroupVersion.Group, Resource: "runtimesessioncontrols"}, obj.GetName(), errors.New("simulated crash after Lease write"))
+			}
+			return c.SubResource(subresource).Update(ctx, obj, opts...)
+		},
+	})
+	if _, err := kubeStore.AcquireSessionMutationLease(ctx, request); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("first acquisition error = %v, want conflict", err)
+	}
+
+	var partial corev1alpha1.RuntimeSessionControl
+	if err := rawClient.Get(ctx, client.ObjectKey{Namespace: control.Namespace, Name: runtimeSessionObjectName(control.SessionName)}, &partial); err != nil {
+		t.Fatal(err)
+	}
+	if partial.Status.Lineage != nil || partial.Status.MutationLease != nil {
+		t.Fatalf("status exposed a partial lineage/Lease commit: %+v", partial.Status)
+	}
+	var held coordinationv1.Lease
+	if err := rawClient.Get(ctx, client.ObjectKey{Namespace: control.Namespace, Name: runtimeSessionLeaseName(control.SessionUID)}, &held); err != nil {
+		t.Fatal(err)
+	}
+	if held.Spec.HolderIdentity == nil || *held.Spec.HolderIdentity == "" {
+		t.Fatal("coordination Lease was not retained across the simulated crash")
+	}
+	altered := request
+	alteredLineage := *request.Lineage
+	alteredLineage.ConfigDigest = testDigest("different-lineage-config")
+	altered.Lineage = &alteredLineage
+	if _, err := kubeStore.AcquireSessionMutationLease(ctx, altered); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("altered lineage completed pending Lease: %v", err)
+	}
+	if err := rawClient.Get(ctx, client.ObjectKey{Namespace: control.Namespace, Name: runtimeSessionObjectName(control.SessionName)}, &partial); err != nil {
+		t.Fatal(err)
+	}
+	if partial.Status.Lineage != nil || partial.Status.MutationLease != nil {
+		t.Fatalf("altered retry committed pending Session status: %+v", partial.Status)
+	}
+
+	kubeStore.client = rawClient
+	recovered, err := kubeStore.AcquireSessionMutationLease(ctx, request)
+	if err != nil {
+		t.Fatalf("retry exact acquisition: %v", err)
+	}
+	if recovered.Lineage == nil || recovered.Lease == nil || recovered.Version != 2 || recovered.LeaseGeneration != 1 {
+		t.Fatalf("retry did not atomically expose lineage and Lease: %+v", recovered)
+	}
+}
+
+func TestSessionReconciliationResumesAfterBranchOnlyCommit(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, rawClient, fence := newTestStoreWithEpoch(t)
+	oldSHA := strings.Repeat("1", 40)
+	newSHA := strings.Repeat("2", 40)
+	branch, err := kubeStore.CreateBranchClaim(ctx, &controlstore.BranchClaim{
+		RepositoryID: "repo-restart", Ref: "refs/heads/session", OwnerKind: controlstore.BranchClaimOwnerSession,
+		OwnerUID: "session-restart-uid", LastVerified: controlstore.RemoteRefState{SHA: oldSHA},
+		Availability: controlstore.BranchClaimReconciliationBlocked, BlockedReason: "unknown publish",
+		RelatedPublicationID: "publication-restart", RequestDigest: testDigest("branch-restart"),
+	}, fence)
+	if err != nil {
+		t.Fatalf("create blocked branch: %v", err)
+	}
+	blocked, err := kubeStore.CreateSessionControl(ctx, &controlstore.SessionControl{
+		Namespace: "tenant-a", SessionName: "session-restart", SessionUID: "session-restart-uid",
+		RequestDigest: testDigest("session-restart"), Availability: controlstore.SessionReconciliationBlocked,
+		LeaseGeneration: 1, BlockedReason: "unknown publish", RelatedPublicationID: "publication-restart",
+		VerifiedBaseline: &controlstore.VerifiedBranchBaseline{RepositoryID: branch.RepositoryID, Ref: branch.Ref, SHA: oldSHA},
+	}, fence)
+	if err != nil {
+		t.Fatalf("create blocked session: %v", err)
+	}
+	request := controlstore.ReconcileSessionControlRequest{
+		Namespace: blocked.Namespace, SessionName: blocked.SessionName, SessionUID: blocked.SessionUID,
+		Fence: fence, ExpectedVersion: blocked.Version, ExpectedLeaseGeneration: blocked.LeaseGeneration,
+		ExpectedRelatedPublicationID: "publication-restart", BranchClaimID: branch.ID,
+		ExpectedBranchClaimVersion: branch.Version, ExpectedBranchClaimGeneration: branch.Generation,
+		ExpectedBranchBaseline: branch.LastVerified,
+		VerifiedBaseline:       controlstore.VerifiedBranchBaseline{RepositoryID: branch.RepositoryID, Ref: branch.Ref, SHA: newSHA},
+		OperationID:            "reconcile-after-restart", OperationDigest: testDigest("reconcile-after-restart"), ReconciledAt: testNow.Add(time.Hour),
+	}
+
+	withWatch, ok := rawClient.(client.WithWatch)
+	if !ok {
+		t.Fatal("fake client does not implement client.WithWatch")
+	}
+	failSessionStatusOnce := true
+	kubeStore.client = interceptor.NewClient(withWatch, interceptor.Funcs{
+		SubResourceUpdate: func(ctx context.Context, c client.Client, subresource string, obj client.Object, opts ...client.SubResourceUpdateOption) error {
+			if failSessionStatusOnce {
+				if _, isSession := obj.(*corev1alpha1.RuntimeSessionControl); isSession {
+					failSessionStatusOnce = false
+					return apierrors.NewConflict(schema.GroupResource{Group: corev1alpha1.GroupVersion.Group, Resource: "runtimesessioncontrols"}, obj.GetName(), errors.New("simulated restart"))
+				}
+			}
+			return c.SubResource(subresource).Update(ctx, obj, opts...)
+		},
+	})
+	if _, err := kubeStore.ReconcileSessionControl(ctx, request); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("first reconciliation error = %v, want simulated conflict", err)
+	}
+	partiallyReconciledBranch, err := kubeStore.GetBranchClaim(ctx, branch.ID)
+	if err != nil {
+		t.Fatalf("get branch after partial reconciliation: %v", err)
+	}
+	if partiallyReconciledBranch.Availability != controlstore.BranchClaimAvailable || partiallyReconciledBranch.LastOperationID != request.OperationID {
+		t.Fatalf("branch was not committed before simulated restart: %#v", partiallyReconciledBranch)
+	}
+	stillBlocked, err := kubeStore.GetSessionControl(ctx, blocked.Namespace, blocked.SessionName)
+	if err != nil {
+		t.Fatalf("get session after partial reconciliation: %v", err)
+	}
+	if stillBlocked.Availability != controlstore.SessionReconciliationBlocked {
+		t.Fatalf("session unexpectedly committed before retry: %#v", stillBlocked)
+	}
+
+	reconciled, err := kubeStore.ReconcileSessionControl(ctx, request)
+	if err != nil {
+		t.Fatalf("resume reconciliation: %v", err)
+	}
+	if reconciled.Availability != controlstore.SessionAvailable || reconciled.VerifiedBaseline == nil || reconciled.VerifiedBaseline.SHA != newSHA {
+		t.Fatalf("resumed session = %#v", reconciled)
+	}
+}
+
+func TestBranchPublicationAndExternalEffectStores(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, _, fence := newTestStoreWithEpoch(t)
+	branch, err := kubeStore.CreateBranchClaim(ctx, &controlstore.BranchClaim{
+		RepositoryID: "repo-publish", Ref: "refs/heads/feature", OwnerKind: controlstore.BranchClaimOwnerTask,
+		OwnerUID: "task-publish", LastVerified: controlstore.RemoteRefState{Absent: true}, RequestDigest: testDigest("branch-publish"),
+	}, fence)
+	if err != nil {
+		t.Fatalf("create publication branch: %v", err)
+	}
+	blocked, err := kubeStore.CompareAndSwapBranchClaim(ctx, controlstore.BranchClaimCAS{
+		ID: branch.ID, Fence: fence, ExpectedVersion: branch.Version, ExpectedGeneration: branch.Generation,
+		NewGeneration: branch.Generation, ExpectedLastVerified: branch.LastVerified, NewLastVerified: branch.LastVerified,
+		ExpectedAvailability: controlstore.BranchClaimAvailable, NewAvailability: controlstore.BranchClaimReconciliationBlocked,
+		BlockedReason: "test block", RelatedPublicationID: "publication-branch-cas",
+		OperationID: "block-branch", OperationDigest: testDigest("block-branch"), UpdatedAt: testNow,
+	})
+	if err != nil {
+		t.Fatalf("block branch claim: %v", err)
+	}
+	if blocked.Availability != controlstore.BranchClaimReconciliationBlocked || blocked.Version != 2 {
+		t.Fatalf("blocked branch = %#v", blocked)
+	}
+	branch, err = kubeStore.CompareAndSwapBranchClaim(ctx, controlstore.BranchClaimCAS{
+		ID: blocked.ID, Fence: fence, ExpectedVersion: blocked.Version, ExpectedGeneration: blocked.Generation,
+		NewGeneration: blocked.Generation, ExpectedLastVerified: blocked.LastVerified, NewLastVerified: blocked.LastVerified,
+		ExpectedAvailability: blocked.Availability, NewAvailability: controlstore.BranchClaimAvailable,
+		OperationID: "unblock-branch", OperationDigest: testDigest("unblock-branch"), UpdatedAt: testNow.Add(time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("unblock branch claim: %v", err)
+	}
+
+	commitSHA := strings.Repeat("c", 40)
+	publication, err := kubeStore.CreatePublication(ctx, &controlstore.Publication{
+		ID: "publication-1", Namespace: "tenant-a", Generation: 1, TaskUID: "task-publish", Attempt: 1, PromptID: "prompt-publish",
+		BranchClaimID: branch.ID, BranchClaimGeneration: branch.Generation,
+		SourceRepositoryID: "repo-source", SourceRef: "refs/heads/main", SourceBaselineSHA: strings.Repeat("d", 40),
+		TargetRepositoryID: branch.RepositoryID, TargetRef: branch.Ref, Baseline: branch.LastVerified,
+		ArtifactID: "artifact-1", ArtifactDigest: testDigest("artifact"), ArtifactSizeBytes: 123,
+		ArtifactMediaType: "application/vnd.orka.workspace-delta", PublicationCredentialRef: "publish-secret",
+		CommitIdentity: "Orka <orka@example.com>", CommitMessage: "Apply change", CommitTimestamp: testNow,
+		RequestDigest: testDigest("publication"),
+	}, fence)
+	if err != nil {
+		t.Fatalf("create publication: %v", err)
+	}
+	prepared, err := kubeStore.TransitionPublication(ctx, controlstore.PublicationTransition{
+		ID: publication.ID, Fence: fence, ExpectedVersion: publication.Version, ExpectedGeneration: publication.Generation,
+		ExpectedState: controlstore.PublicationPreparing, NewState: controlstore.PublicationPrepared,
+		OperationID: "prepare-publication", OperationDigest: testDigest("prepare-publication"),
+		PreparedReceipt: &controlstore.PreparedPublicationReceipt{
+			OperationID: "prepare-publication", RequestDigest: testDigest("prepare-response"),
+			TreeSHA: strings.Repeat("e", 40), CommitSHA: commitSHA, ManifestDigest: testDigest("manifest"),
+			BundleArtifactID: "bundle-artifact", BundleDigest: testDigest("bundle"), BundleSizeBytes: 256,
+			BundleMediaType: controlstore.PreparedBundleMediaType, BundleRef: "refs/orka/publications/" + strings.Repeat("f", 64),
+			PreparedAt: testNow.Add(time.Minute),
+		},
+		UpdatedAt: testNow.Add(time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("prepare publication: %v", err)
+	}
+	if prepared.State != controlstore.PublicationPrepared || prepared.PreparedReceipt == nil || prepared.Version != 2 {
+		t.Fatalf("prepared publication = %#v", prepared)
+	}
+	intent := controlstore.PullRequestIntent{BaseRepositoryID: "repo-source", BaseRef: "refs/heads/main", HeadRepositoryID: branch.RepositoryID, HeadRef: branch.Ref, PublicationGeneration: 1, ExpectedHeadSHA: commitSHA}
+	withIntent, err := kubeStore.SetPublicationPRIntent(ctx, controlstore.SetPublicationPRIntentRequest{
+		ID: prepared.ID, Fence: fence, ExpectedVersion: prepared.Version, ExpectedGeneration: prepared.Generation,
+		ExpectedState: controlstore.PublicationPrepared, Intent: intent,
+		OperationID: "set-pr-intent", OperationDigest: testDigest("set-pr-intent"), UpdatedAt: testNow.Add(2 * time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("set PR intent: %v", err)
+	}
+	if withIntent.PRIntent == nil || withIntent.PRIntent.ExpectedHeadSHA != commitSHA || withIntent.Version != 3 {
+		t.Fatalf("publication with PR intent = %#v", withIntent)
+	}
+
+	identity := controlstore.ExternalEffectIdentity{Kind: "PullRequest", Namespace: "tenant-a", AggregateID: publication.ID, OperationID: "forge-op-1"}
+	effect, err := kubeStore.ReserveExternalEffect(ctx, controlstore.ReserveExternalEffectRequest{Identity: identity, RequestDigest: testDigest("effect"), Fence: fence, CreatedAt: testNow})
+	if err != nil {
+		t.Fatalf("reserve external effect: %v", err)
+	}
+	expires := testNow.Add(5 * time.Minute)
+	inFlight, err := kubeStore.TransitionExternalEffect(ctx, controlstore.ExternalEffectTransition{
+		ID: effect.ID, Fence: fence, ExpectedVersion: effect.Version, ExpectedState: controlstore.ExternalEffectPending,
+		NewState: controlstore.ExternalEffectInFlight, RequestDigest: effect.RequestDigest,
+		LeaseOwner: "worker-a", LeaseExpiresAt: &expires, UpdatedAt: testNow.Add(time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("claim external effect: %v", err)
+	}
+	if inFlight.State != controlstore.ExternalEffectInFlight || inFlight.Attempts != 1 || inFlight.Version != 2 {
+		t.Fatalf("in-flight effect = %#v", inFlight)
+	}
+	response := []byte(`{"url":"https://example.invalid/pr/1"}`)
+	succeeded, err := kubeStore.TransitionExternalEffect(ctx, controlstore.ExternalEffectTransition{
+		ID: effect.ID, Fence: fence, ExpectedVersion: inFlight.Version, ExpectedState: controlstore.ExternalEffectInFlight,
+		NewState: controlstore.ExternalEffectSucceeded, RequestDigest: effect.RequestDigest,
+		ExpectedLeaseOwner: "worker-a", Response: response, ResponseDigest: testBytesDigest(response), UpdatedAt: testNow.Add(2 * time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("complete external effect: %v", err)
+	}
+	if succeeded.State != controlstore.ExternalEffectSucceeded || !strings.Contains(string(succeeded.Response), "example.invalid") || succeeded.LeaseOwner != "" {
+		t.Fatalf("succeeded effect = %#v", succeeded)
+	}
+	if retry, err := kubeStore.TransitionExternalEffect(ctx, controlstore.ExternalEffectTransition{
+		ID: effect.ID, Fence: fence, ExpectedVersion: inFlight.Version, ExpectedState: controlstore.ExternalEffectInFlight,
+		NewState: controlstore.ExternalEffectSucceeded, RequestDigest: effect.RequestDigest,
+		ExpectedLeaseOwner: "worker-a", Response: response, ResponseDigest: testBytesDigest(response), UpdatedAt: testNow.Add(2 * time.Minute),
+	}); err != nil || retry.Version != succeeded.Version {
+		t.Fatalf("idempotent external-effect retry = %#v, %v", retry, err)
+	}
+}
+
+func TestSessionTurnDelegationIsExplicit(t *testing.T) {
+	kubeStore, _ := newTestStore(t)
+	if _, err := kubeStore.GetSessionTurn(context.Background(), "turn"); !errors.Is(err, ErrSessionTurnStoreNotConfigured) {
+		t.Fatalf("GetSessionTurn error = %v", err)
+	}
+	delegate := &recordingSessionTurnStore{}
+	withDelegate, err := New(kubeStore.client, testControlNamespace, WithSessionTurnPersistence(delegate))
+	if err != nil {
+		t.Fatalf("New with turn delegate: %v", err)
+	}
+	if _, err := withDelegate.GetSessionTurn(context.Background(), "turn-1"); err != nil || delegate.gotID != "turn-1" {
+		t.Fatalf("delegated GetSessionTurn: id=%q err=%v", delegate.gotID, err)
+	}
+}
+
+//nolint:gocyclo // The restart boundary assertions intentionally stay in one end-to-end scenario.
+func TestCrossStoreSessionTurnFinalizationResumesAfterSQLiteCommit(t *testing.T) {
+	ctx := context.Background()
+	_, rawClient, fence := newTestStoreWithEpoch(t)
+	db, err := sqlitestore.NewDB(filepath.Join(t.TempDir(), "turns.db"))
+	if err != nil {
+		t.Fatalf("NewDB: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	sqliteStore := sqlitestore.NewStore(db, "")
+	if err := sqliteStore.CreateSession(ctx, &controlstore.SessionRecord{Namespace: "tenant-a", Name: "session-finalize", SessionType: "task"}); err != nil {
+		t.Fatalf("CreateSession: %v", err)
+	}
+	kubeStore, err := NewComposite(rawClient, testControlNamespace, sqliteStore)
+	if err != nil {
+		t.Fatalf("NewComposite: %v", err)
+	}
+	control, err := kubeStore.CreateSessionControl(ctx, &controlstore.SessionControl{
+		Namespace: "tenant-a", SessionName: "session-finalize", SessionUID: "session-finalize-uid",
+		RequestDigest: testDigest("session-finalize"),
+	}, fence)
+	if err != nil {
+		t.Fatalf("CreateSessionControl: %v", err)
+	}
+	leaseExpires := testNow.Add(15 * time.Minute)
+	promptRequestDigest := testDigest("prompt-finalize")
+	leaseRequestDigest, err := controlstore.SessionMutationLeaseRequestDigest(
+		control.SessionUID, control.LeaseGeneration+1, "task-finalize", 1, "prompt-finalize", promptRequestDigest,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	control, err = kubeStore.AcquireSessionMutationLease(ctx, controlstore.AcquireSessionMutationLeaseRequest{
+		Namespace: control.Namespace, SessionName: control.SessionName, SessionUID: control.SessionUID,
+		Fence: fence, ExpectedVersion: control.Version, ExpectedLeaseGeneration: control.LeaseGeneration,
+		TaskUID: "task-finalize", Attempt: 1, PromptID: "prompt-finalize",
+		RequestDigest: leaseRequestDigest, AcquiredAt: testNow, ExpiresAt: &leaseExpires,
+		Lineage: testSessionLineageClaim(control),
+	})
+	if err != nil {
+		t.Fatalf("AcquireSessionMutationLease: %v", err)
+	}
+	attemptKey := controlstore.PromptAttemptKey{Namespace: "tenant-a", TaskUID: "task-finalize", Attempt: 1, PromptID: "prompt-finalize"}
+	ensureActiveAgentTask(t, ctx, rawClient, attemptKey.Namespace, attemptKey.TaskUID, attemptKey.TaskUID)
+	attempt, err := kubeStore.CreatePromptAttempt(ctx, boundPromptAttemptForKubeTest(&controlstore.PromptAttempt{Key: attemptKey, RequestDigest: promptRequestDigest}), fence)
+	if err != nil {
+		t.Fatalf("CreatePromptAttempt: %v", err)
+	}
+	attempt = advancePromptAttemptToSuccess(t, ctx, kubeStore, fence, attempt, control)
+	turnKey := controlstore.SessionTurnKey{SessionUID: control.SessionUID, LeaseGeneration: control.LeaseGeneration, TaskUID: attemptKey.TaskUID, Attempt: attemptKey.Attempt, PromptID: attemptKey.PromptID}
+	turn, err := kubeStore.CreateSessionTurn(ctx, controlstore.CreateSessionTurnRequest{
+		Turn:  controlstore.SessionTurn{Key: turnKey, PromptAttemptID: attempt.ID, RequestDigest: testDigest("turn-finalize"), UserPrompt: "finish the task"},
+		Fence: fence, ExpectedSessionVersion: control.Version,
+	})
+	if err != nil {
+		t.Fatalf("CreateSessionTurn: %v", err)
+	}
+	projectionPayload := []byte(`{"phase":"Succeeded"}`)
+	projection := controlstore.OutboxProjection{
+		ID: "projection-finalize", AggregateKind: sessionTurnAggregateKind, AggregateID: turn.ID,
+		ProjectionKind: "TaskTerminalStatus", Payload: projectionPayload, PayloadDigest: testBytesDigest(projectionPayload),
+	}
+	finalize := controlstore.FinalizeSessionTurnRequest{
+		Key: turnKey, Fence: fence, ExpectedSessionVersion: control.Version, ExpectedTurnVersion: turn.Version,
+		FinalizationDigest: testDigest("finalize-turn"), TerminalKind: controlstore.SessionTurnAssistantResult,
+		TerminalContent: "done", Projection: projection, FinalizedAt: testNow.Add(time.Hour),
+	}
+
+	withWatch, ok := rawClient.(client.WithWatch)
+	if !ok {
+		t.Fatal("fake client does not implement client.WithWatch")
+	}
+	failSessionStatusOnce := true
+	kubeStore.client = interceptor.NewClient(withWatch, interceptor.Funcs{
+		SubResourceUpdate: func(ctx context.Context, c client.Client, subresource string, obj client.Object, opts ...client.SubResourceUpdateOption) error {
+			if failSessionStatusOnce {
+				if _, isSession := obj.(*corev1alpha1.RuntimeSessionControl); isSession {
+					failSessionStatusOnce = false
+					return apierrors.NewConflict(schema.GroupResource{Group: corev1alpha1.GroupVersion.Group, Resource: "runtimesessioncontrols"}, obj.GetName(), errors.New("simulated controller restart"))
+				}
+			}
+			return c.SubResource(subresource).Update(ctx, obj, opts...)
+		},
+	})
+	if _, err := kubeStore.FinalizeSessionTurn(ctx, finalize); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("first FinalizeSessionTurn error = %v, want simulated conflict", err)
+	}
+	committedTurn, err := sqliteStore.GetSessionTurn(ctx, turn.ID)
+	if err != nil {
+		t.Fatalf("GetSessionTurn after SQLite commit: %v", err)
+	}
+	if committedTurn.State != controlstore.SessionTurnFinalized {
+		t.Fatalf("turn did not commit before simulated restart: %#v", committedTurn)
+	}
+	transcript, err := sqliteStore.LoadTranscript(ctx, control.Namespace, control.SessionName, 10)
+	if err != nil {
+		t.Fatalf("LoadTranscript after SQLite commit: %v", err)
+	}
+	if len(transcript) != 2 {
+		t.Fatalf("transcript entries = %d, want 2", len(transcript))
+	}
+	deferred, err := sqliteStore.GetOutboxProjection(ctx, projection.ID)
+	if err != nil {
+		t.Fatalf("GetOutboxProjection after SQLite commit: %v", err)
+	}
+	if deferred.AvailableAt.Year() != 9999 {
+		t.Fatalf("projection was exposed before Kubernetes finalization: %s", deferred.AvailableAt)
+	}
+	changedProjection := finalize
+	changedProjection.Projection.ID = "projection-finalize-changed"
+	if _, err := kubeStore.FinalizeSessionTurn(ctx, changedProjection); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("changed projection retry error = %v, want conflict", err)
+	}
+
+	failSessionLeaseOnce := true
+	kubeStore.client = interceptor.NewClient(withWatch, interceptor.Funcs{
+		Update: func(ctx context.Context, c client.WithWatch, obj client.Object, opts ...client.UpdateOption) error {
+			if failSessionLeaseOnce {
+				if lease, isLease := obj.(*coordinationv1.Lease); isLease && lease.Annotations[annotationSessionUID] == control.SessionUID {
+					failSessionLeaseOnce = false
+					return apierrors.NewConflict(schema.GroupResource{Group: coordinationv1.GroupName, Resource: "leases"}, obj.GetName(), errors.New("simulated lease-release crash"))
+				}
+			}
+			return c.Update(ctx, obj, opts...)
+		},
+	})
+	resumeRequest := controlstore.ResumeSessionTurnFinalizationRequest{
+		Key: committedTurn.Key, PromptAttemptID: committedTurn.PromptAttemptID,
+		FinalizationDigest: committedTurn.FinalizationDigest, Fence: fence,
+	}
+	if _, err := kubeStore.ResumeSessionTurnFinalization(ctx, resumeRequest); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("lease-boundary ResumeSessionTurnFinalization error = %v, want simulated conflict", err)
+	}
+	statusCommitted, err := kubeStore.GetSessionControl(ctx, control.Namespace, control.SessionName)
+	if err != nil {
+		t.Fatalf("GetSessionControl after lease-boundary crash: %v", err)
+	}
+	if statusCommitted.Lease != nil || statusCommitted.LastOperationID != "finalize:"+turn.ID {
+		t.Fatalf("SessionControl was not committed before lease-boundary crash: %#v", statusCommitted)
+	}
+	kubeStore.client = rawClient
+	leases := &coordinationv1.LeaseList{}
+	if err := rawClient.List(ctx, leases, client.InNamespace(control.Namespace)); err != nil {
+		t.Fatal(err)
+	}
+	var heldLease *coordinationv1.Lease
+	for i := range leases.Items {
+		if leases.Items[i].Annotations[annotationSessionUID] == control.SessionUID {
+			heldLease = leases.Items[i].DeepCopy()
+			break
+		}
+	}
+	if heldLease == nil {
+		t.Fatal("held finalized Session Lease not found")
+	}
+	originalRequestDigest := heldLease.Annotations[annotationRequestDigest]
+	originalHolder := *heldLease.Spec.HolderIdentity
+	heldLease.Annotations[annotationRequestDigest] = testDigest("mismatched-finalized-lease")
+	if err := rawClient.Update(ctx, heldLease); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := kubeStore.ResumeSessionTurnFinalization(ctx, resumeRequest); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("mismatched finalized Lease recovery error = %v, want conflict", err)
+	}
+	if err := rawClient.Get(ctx, client.ObjectKeyFromObject(heldLease), heldLease); err != nil {
+		t.Fatal(err)
+	}
+	if heldLease.Spec.HolderIdentity == nil || *heldLease.Spec.HolderIdentity == "" {
+		t.Fatal("mismatched finalized Session Lease was cleared")
+	}
+	heldLease.Annotations[annotationRequestDigest] = originalRequestDigest
+	if err := rawClient.Update(ctx, heldLease); err != nil {
+		t.Fatal(err)
+	}
+	if err := rawClient.Get(ctx, client.ObjectKeyFromObject(heldLease), heldLease); err != nil {
+		t.Fatal(err)
+	}
+	mismatchedHolder := "mutation:mismatched-finalized-holder"
+	heldLease.Spec.HolderIdentity = &mismatchedHolder
+	if err := rawClient.Update(ctx, heldLease); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := kubeStore.ResumeSessionTurnFinalization(ctx, resumeRequest); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("mismatched finalized Lease holder recovery error = %v, want conflict", err)
+	}
+	if err := rawClient.Get(ctx, client.ObjectKeyFromObject(heldLease), heldLease); err != nil {
+		t.Fatal(err)
+	}
+	if heldLease.Spec.HolderIdentity == nil || *heldLease.Spec.HolderIdentity != mismatchedHolder {
+		t.Fatal("mismatched finalized Session Lease holder was cleared or changed")
+	}
+	heldLease.Spec.HolderIdentity = &originalHolder
+	if err := rawClient.Update(ctx, heldLease); err != nil {
+		t.Fatal(err)
+	}
+
+	activationErr := errors.New("simulated outbox activation crash")
+	failingActivation := &failOnceSessionTurnActivationStore{SessionTurnPersistenceStore: sqliteStore, err: activationErr}
+	kubeStore.sessionTurns = failingActivation
+	if _, err := kubeStore.ResumeSessionTurnFinalization(ctx, resumeRequest); !errors.Is(err, activationErr) {
+		t.Fatalf("activation-boundary ResumeSessionTurnFinalization error = %v, want simulated error", err)
+	}
+	kubeStore.sessionTurns = sqliteStore
+	finalized, err := kubeStore.ResumeSessionTurnFinalization(ctx, controlstore.ResumeSessionTurnFinalizationRequest{
+		Key: committedTurn.Key, PromptAttemptID: committedTurn.PromptAttemptID,
+		FinalizationDigest: committedTurn.FinalizationDigest, Fence: fence,
+	})
+	if err != nil {
+		t.Fatalf("ResumeSessionTurnFinalization: %v", err)
+	}
+	if finalized.State != controlstore.SessionTurnFinalized {
+		t.Fatalf("finalized turn = %#v", finalized)
+	}
+	updatedControl, err := kubeStore.GetSessionControl(ctx, control.Namespace, control.SessionName)
+	if err != nil {
+		t.Fatalf("GetSessionControl after finalization: %v", err)
+	}
+	if updatedControl.Availability != controlstore.SessionAvailable || updatedControl.Lease != nil || updatedControl.LastOperationID != "finalize:"+turn.ID {
+		t.Fatalf("finalized Kubernetes SessionControl = %#v", updatedControl)
+	}
+	activated, err := sqliteStore.GetOutboxProjection(ctx, projection.ID)
+	if err != nil {
+		t.Fatalf("GetOutboxProjection after activation: %v", err)
+	}
+	if !activated.AvailableAt.Equal(finalize.FinalizedAt) {
+		t.Fatalf("activated projection available_at = %s, want %s", activated.AvailableAt, finalize.FinalizedAt)
+	}
+	claimed, err := kubeStore.ClaimOutboxProjections(ctx, controlstore.ClaimOutboxProjectionsRequest{
+		Fence: fence, WorkerID: "outbox-worker", Limit: 10, LeaseDuration: time.Minute,
+		Now: finalize.FinalizedAt.Add(time.Second),
+	})
+	if err != nil {
+		t.Fatalf("ClaimOutboxProjections through Kubernetes fence: %v", err)
+	}
+	if len(claimed) != 1 || claimed[0].ID != projection.ID {
+		t.Fatalf("claimed projections = %#v", claimed)
+	}
+	if _, err := kubeStore.CompleteOutboxProjection(ctx, controlstore.CompleteOutboxProjectionRequest{
+		ID: claimed[0].ID, Fence: fence, ExpectedVersion: claimed[0].Version,
+		LeaseOwner: "outbox-worker", OperationID: "deliver-projection",
+		OperationDigest: testDigest("deliver-projection"), NewState: controlstore.OutboxProjectionDelivered,
+		DeliveryDigest: testDigest("delivered-status"), UpdatedAt: finalize.FinalizedAt.Add(2 * time.Second),
+	}); err != nil {
+		t.Fatalf("CompleteOutboxProjection through Kubernetes fence: %v", err)
+	}
+	laterExpires := finalize.FinalizedAt.Add(30 * time.Minute)
+	advancedControl, err := kubeStore.AcquireSessionMutationLease(ctx, controlstore.AcquireSessionMutationLeaseRequest{
+		Namespace: updatedControl.Namespace, SessionName: updatedControl.SessionName, SessionUID: updatedControl.SessionUID,
+		Fence: fence, ExpectedVersion: updatedControl.Version, ExpectedLeaseGeneration: updatedControl.LeaseGeneration,
+		TaskUID: "task-later", Attempt: 1, PromptID: "prompt-later", RequestDigest: testDigest("lease-later"),
+		AcquiredAt: finalize.FinalizedAt.Add(3 * time.Second), ExpiresAt: &laterExpires,
+		Lineage: testSessionLineageClaim(updatedControl),
+	})
+	if err != nil {
+		t.Fatalf("AcquireSessionMutationLease after finalization: %v", err)
+	}
+	if _, err := kubeStore.ResumeSessionTurnFinalization(ctx, resumeRequest); err != nil {
+		t.Fatalf("ResumeSessionTurnFinalization after later lease: %v", err)
+	}
+	preservedAdvancedControl, err := kubeStore.GetSessionControl(ctx, control.Namespace, control.SessionName)
+	if err != nil {
+		t.Fatalf("GetSessionControl after older-turn recovery: %v", err)
+	}
+	if preservedAdvancedControl.Version != advancedControl.Version || preservedAdvancedControl.LeaseGeneration != advancedControl.LeaseGeneration || preservedAdvancedControl.Lease == nil || preservedAdvancedControl.Lease.TaskUID != "task-later" {
+		t.Fatalf("older-turn recovery changed the later Session lease: before=%#v after=%#v", advancedControl, preservedAdvancedControl)
+	}
+	transcript, err = sqliteStore.LoadTranscript(ctx, control.Namespace, control.SessionName, 10)
+	if err != nil {
+		t.Fatalf("LoadTranscript after retry: %v", err)
+	}
+	if len(transcript) != 2 {
+		t.Fatalf("idempotent retry duplicated transcript: %d entries", len(transcript))
+	}
+	for _, table := range []string{"controller_epochs", "prompt_attempts", "session_controls", "branch_claims", "publications", "external_effects"} {
+		var count int
+		if err := db.QueryRow("SELECT COUNT(*) FROM " + table).Scan(&count); err != nil { //nolint:gosec // fixed test-only table allowlist
+			t.Fatalf("count SQLite %s: %v", table, err)
+		}
+		if count != 0 {
+			t.Fatalf("SQLite %s contains %d dual-authoritative control rows", table, count)
+		}
+	}
+}
+
+func TestCrossStoreSessionTurnFinalizationDerivesPublicationBaseline(t *testing.T) {
+	ctx := context.Background()
+	_, rawClient, fence := newTestStoreWithEpoch(t)
+	db, err := sqlitestore.NewDB(filepath.Join(t.TempDir(), "publication-turn.db"))
+	if err != nil {
+		t.Fatalf("NewDB: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	sqliteStore := sqlitestore.NewStore(db, "")
+	if err := sqliteStore.CreateSession(ctx, &controlstore.SessionRecord{Namespace: "tenant-a", Name: "session-publication", SessionType: "task"}); err != nil {
+		t.Fatalf("CreateSession: %v", err)
+	}
+	kubeStore, err := NewComposite(rawClient, testControlNamespace, sqliteStore)
+	if err != nil {
+		t.Fatalf("NewComposite: %v", err)
+	}
+	oldSHA := strings.Repeat("4", 40)
+	commitSHA := strings.Repeat("5", 40)
+	branch, err := kubeStore.CreateBranchClaim(ctx, &controlstore.BranchClaim{
+		RepositoryID: "repo-publication", Ref: "refs/heads/session-publication", OwnerKind: controlstore.BranchClaimOwnerSession,
+		OwnerUID: "session-publication-uid", LastVerified: controlstore.RemoteRefState{SHA: oldSHA}, RequestDigest: testDigest("publication-branch-finalize"),
+	}, fence)
+	if err != nil {
+		t.Fatalf("CreateBranchClaim: %v", err)
+	}
+	control, err := kubeStore.CreateSessionControl(ctx, &controlstore.SessionControl{
+		Namespace: "tenant-a", SessionName: "session-publication", SessionUID: "session-publication-uid",
+		RequestDigest:    testDigest("session-publication"),
+		VerifiedBaseline: &controlstore.VerifiedBranchBaseline{RepositoryID: branch.RepositoryID, Ref: branch.Ref, SHA: oldSHA},
+	}, fence)
+	if err != nil {
+		t.Fatalf("CreateSessionControl: %v", err)
+	}
+	leaseExpires := testNow.Add(15 * time.Minute)
+	promptRequestDigest := testDigest("prompt-publication")
+	leaseRequestDigest, err := controlstore.SessionMutationLeaseRequestDigest(
+		control.SessionUID, control.LeaseGeneration+1, "task-publication", 1, "prompt-publication", promptRequestDigest,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	control, err = kubeStore.AcquireSessionMutationLease(ctx, controlstore.AcquireSessionMutationLeaseRequest{
+		Namespace: control.Namespace, SessionName: control.SessionName, SessionUID: control.SessionUID,
+		Fence: fence, ExpectedVersion: control.Version, ExpectedLeaseGeneration: control.LeaseGeneration,
+		TaskUID: "task-publication", Attempt: 1, PromptID: "prompt-publication",
+		RequestDigest: leaseRequestDigest, AcquiredAt: testNow, ExpiresAt: &leaseExpires,
+		Lineage: testSessionLineageClaim(control),
+	})
+	if err != nil {
+		t.Fatalf("AcquireSessionMutationLease: %v", err)
+	}
+	attemptKey := controlstore.PromptAttemptKey{Namespace: "tenant-a", TaskUID: "task-publication", Attempt: 1, PromptID: "prompt-publication"}
+	ensureActiveAgentTask(t, ctx, rawClient, attemptKey.Namespace, attemptKey.TaskUID, attemptKey.TaskUID)
+	attempt, err := kubeStore.CreatePromptAttempt(ctx, boundPromptAttemptForKubeTest(&controlstore.PromptAttempt{Key: attemptKey, RequestDigest: promptRequestDigest}), fence)
+	if err != nil {
+		t.Fatalf("CreatePromptAttempt: %v", err)
+	}
+	attempt = advancePromptAttemptToSuccess(t, ctx, kubeStore, fence, attempt, control)
+	attempt = advancePromptDeliveryToVerified(t, ctx, kubeStore, fence, attempt)
+	publication, err := kubeStore.CreatePublication(ctx, &controlstore.Publication{
+		ID: "publication-finalize", Namespace: "tenant-a", Generation: 1,
+		TaskUID: attemptKey.TaskUID, Attempt: attemptKey.Attempt, PromptID: attemptKey.PromptID, SessionUID: control.SessionUID,
+		BranchClaimID: branch.ID, BranchClaimGeneration: branch.Generation,
+		SourceRepositoryID: branch.RepositoryID, SourceRef: branch.Ref, SourceBaselineSHA: oldSHA,
+		TargetRepositoryID: branch.RepositoryID, TargetRef: branch.Ref, Baseline: branch.LastVerified,
+		ArtifactID: "artifact-publication", ArtifactDigest: testDigest("artifact-publication"), ArtifactSizeBytes: 42,
+		ArtifactMediaType: "application/vnd.orka.workspace-delta", PublicationCredentialRef: "publish-secret",
+		CommitIdentity: "Orka <orka@example.com>", CommitMessage: "Apply session change", CommitTimestamp: testNow,
+		RequestDigest: testDigest("publication-finalize"),
+	}, fence)
+	if err != nil {
+		t.Fatalf("CreatePublication: %v", err)
+	}
+	preparedDigest := testDigest("prepare-publication-finalize")
+	publication, err = kubeStore.TransitionPublication(ctx, controlstore.PublicationTransition{
+		ID: publication.ID, Fence: fence, ExpectedVersion: publication.Version, ExpectedGeneration: publication.Generation,
+		ExpectedState: publication.State, NewState: controlstore.PublicationPrepared,
+		OperationID: "prepare-publication-finalize", OperationDigest: preparedDigest,
+		PreparedReceipt: &controlstore.PreparedPublicationReceipt{
+			OperationID: "prepare-publication-finalize", RequestDigest: preparedDigest,
+			TreeSHA: strings.Repeat("6", 40), CommitSHA: commitSHA,
+			ManifestDigest: testDigest("manifest-publication-finalize"), BundleArtifactID: "bundle-publication-finalize",
+			BundleDigest: testDigest("bundle-publication-finalize"), BundleSizeBytes: 123,
+			BundleMediaType: controlstore.PreparedBundleMediaType, BundleRef: "refs/orka/publications/" + strings.Repeat("a", 64),
+			PreparedAt: testNow.Add(time.Minute),
+		},
+		UpdatedAt: testNow.Add(time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("prepare publication: %v", err)
+	}
+	publication, err = kubeStore.TransitionPublication(ctx, controlstore.PublicationTransition{
+		ID: publication.ID, Fence: fence, ExpectedVersion: publication.Version, ExpectedGeneration: publication.Generation,
+		ExpectedState: publication.State, NewState: controlstore.PublicationPublishing,
+		OperationID: "start-publish", OperationDigest: testDigest("start-publish"), UpdatedAt: testNow.Add(2 * time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("start publishing: %v", err)
+	}
+	publishDigest := testDigest("publish-publication-finalize")
+	publication, err = kubeStore.TransitionPublication(ctx, controlstore.PublicationTransition{
+		ID: publication.ID, Fence: fence, ExpectedVersion: publication.Version, ExpectedGeneration: publication.Generation,
+		ExpectedState: publication.State, NewState: controlstore.PublicationVerifying,
+		OperationID: "publish-publication-finalize", OperationDigest: publishDigest,
+		PublishReceipt: &controlstore.PublishOperationReceipt{
+			OperationID: "publish-publication-finalize", RequestDigest: publishDigest,
+			TargetRepositoryID: branch.RepositoryID, TargetRef: branch.Ref, RemoteBefore: branch.LastVerified,
+			ExpectedCommitSHA: commitSHA, PublishedAt: testNow.Add(3 * time.Minute),
+		},
+		UpdatedAt: testNow.Add(3 * time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("record publish receipt: %v", err)
+	}
+	verifyDigest := testDigest("verify-publication-finalize")
+	publication, err = kubeStore.TransitionPublication(ctx, controlstore.PublicationTransition{
+		ID: publication.ID, Fence: fence, ExpectedVersion: publication.Version, ExpectedGeneration: publication.Generation,
+		ExpectedState: publication.State, NewState: controlstore.PublicationVerifiedExact,
+		OperationID: "verify-publication-finalize", OperationDigest: verifyDigest,
+		VerificationReceipt: &controlstore.PublicationVerificationReceipt{
+			OperationID: "verify-publication-finalize", RequestDigest: verifyDigest,
+			Outcome: controlstore.PublicationVerifiedExact, ExpectedCommitSHA: commitSHA,
+			ObservedRemote: controlstore.RemoteRefState{SHA: commitSHA}, VerifiedAt: testNow.Add(4 * time.Minute),
+		},
+		UpdatedAt: testNow.Add(4 * time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("verify publication: %v", err)
+	}
+
+	turnKey := controlstore.SessionTurnKey{SessionUID: control.SessionUID, LeaseGeneration: control.LeaseGeneration, TaskUID: attemptKey.TaskUID, Attempt: attemptKey.Attempt, PromptID: attemptKey.PromptID}
+	turn, err := kubeStore.CreateSessionTurn(ctx, controlstore.CreateSessionTurnRequest{
+		Turn:  controlstore.SessionTurn{Key: turnKey, PromptAttemptID: attempt.ID, RequestDigest: testDigest("turn-publication"), UserPrompt: "publish the change"},
+		Fence: fence, ExpectedSessionVersion: control.Version,
+	})
+	if err != nil {
+		t.Fatalf("CreateSessionTurn: %v", err)
+	}
+	payload := []byte(`{"phase":"Succeeded","delivery":"VerifiedExact"}`)
+	finalizeRequest := controlstore.FinalizeSessionTurnRequest{
+		Key: turnKey, Fence: fence, ExpectedSessionVersion: control.Version, ExpectedTurnVersion: turn.Version,
+		FinalizationDigest: testDigest("finalize-publication-turn"), TerminalKind: controlstore.SessionTurnAssistantResult,
+		TerminalContent: "published", PublicationID: publication.ID,
+		Projection:  controlstore.OutboxProjection{ID: "projection-publication", AggregateKind: sessionTurnAggregateKind, AggregateID: turn.ID, ProjectionKind: "TaskTerminalStatus", Payload: payload, PayloadDigest: testBytesDigest(payload)},
+		FinalizedAt: testNow.Add(time.Hour),
+	}
+	withWatch, ok := rawClient.(client.WithWatch)
+	if !ok {
+		t.Fatal("fake client does not implement client.WithWatch")
+	}
+	failBranchStatusOnce := true
+	kubeStore.client = interceptor.NewClient(withWatch, interceptor.Funcs{
+		SubResourceUpdate: func(ctx context.Context, c client.Client, subresource string, obj client.Object, opts ...client.SubResourceUpdateOption) error {
+			if failBranchStatusOnce {
+				if _, isBranch := obj.(*corev1alpha1.BranchClaim); isBranch {
+					failBranchStatusOnce = false
+					return apierrors.NewConflict(schema.GroupResource{Group: corev1alpha1.GroupVersion.Group, Resource: "branchclaims"}, obj.GetName(), errors.New("simulated controller restart"))
+				}
+			}
+			return c.SubResource(subresource).Update(ctx, obj, opts...)
+		},
+	})
+	if _, err := kubeStore.FinalizeSessionTurn(ctx, finalizeRequest); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("first publication FinalizeSessionTurn error = %v, want simulated conflict", err)
+	}
+	kubeStore.client = rawClient
+	committedTurn, err := kubeStore.GetSessionTurn(ctx, turn.ID)
+	if err != nil {
+		t.Fatalf("GetSessionTurn after branch-boundary crash: %v", err)
+	}
+	finalized, err := kubeStore.ResumeSessionTurnFinalization(ctx, controlstore.ResumeSessionTurnFinalizationRequest{
+		Key: committedTurn.Key, PromptAttemptID: committedTurn.PromptAttemptID,
+		FinalizationDigest: committedTurn.FinalizationDigest, Fence: fence,
+	})
+	if err != nil {
+		t.Fatalf("ResumeSessionTurnFinalization after branch-boundary crash: %v", err)
+	}
+	if finalized.PublicationReceipt == nil || finalized.PublicationReceipt.State != controlstore.PublicationVerifiedExact {
+		t.Fatalf("finalized publication receipt = %#v", finalized.PublicationReceipt)
+	}
+	updatedControl, err := kubeStore.GetSessionControl(ctx, control.Namespace, control.SessionName)
+	if err != nil {
+		t.Fatalf("GetSessionControl: %v", err)
+	}
+	if updatedControl.VerifiedBaseline == nil || updatedControl.VerifiedBaseline.SHA != commitSHA || updatedControl.Lease != nil {
+		t.Fatalf("SessionControl did not advance verified baseline: %#v", updatedControl)
+	}
+	updatedBranch, err := kubeStore.GetBranchClaim(ctx, branch.ID)
+	if err != nil {
+		t.Fatalf("GetBranchClaim: %v", err)
+	}
+	if updatedBranch.LastVerified.SHA != commitSHA || updatedBranch.Availability != controlstore.BranchClaimAvailable {
+		t.Fatalf("BranchClaim did not advance verified baseline: %#v", updatedBranch)
+	}
+}
+
+func advancePromptAttemptToSuccess(t *testing.T, ctx context.Context, kubeStore *Store, fence controlstore.ControllerEpochFence, attempt *controlstore.PromptAttempt, control *controlstore.SessionControl) *controlstore.PromptAttempt {
+	t.Helper()
+	states := []controlstore.PromptExecutionState{
+		controlstore.PromptExecutionReserved,
+		controlstore.PromptExecutionSessionStarting,
+		controlstore.PromptExecutionPlanned,
+		controlstore.PromptExecutionSubmitting,
+		controlstore.PromptExecutionAccepted,
+		controlstore.PromptExecutionRunning,
+		controlstore.PromptExecutionSettling,
+		controlstore.PromptExecutionSucceeded,
+	}
+	for i, next := range states {
+		transition := controlstore.PromptAttemptExecutionTransition{
+			ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+			NewState: next, OperationID: "advance-" + string(next), OperationDigest: testDigest("advance-" + string(next)),
+			UpdatedAt: testNow.Add(time.Duration(i+1) * time.Minute),
+		}
+		if next == controlstore.PromptExecutionSessionStarting {
+			transition.SessionUID = control.SessionUID
+			transition.SessionLeaseGeneration = control.LeaseGeneration
+			transition.RuntimeInstanceID = "runtime-instance"
+		}
+		updated, err := kubeStore.TransitionPromptAttemptExecution(ctx, transition)
+		if err != nil {
+			t.Fatalf("TransitionPromptAttemptExecution(%s): %v", next, err)
+		}
+		attempt = updated
+	}
+	return attempt
+}
+
+func advancePromptDeliveryToVerified(t *testing.T, ctx context.Context, kubeStore *Store, fence controlstore.ControllerEpochFence, attempt *controlstore.PromptAttempt) *controlstore.PromptAttempt {
+	t.Helper()
+	states := []controlstore.PromptDeliveryState{
+		controlstore.PromptDeliveryValidating,
+		controlstore.PromptDeliveryPreparing,
+		controlstore.PromptDeliveryPrepared,
+		controlstore.PromptDeliveryPublishing,
+		controlstore.PromptDeliveryVerifying,
+		controlstore.PromptDeliveryVerifiedExact,
+	}
+	for i, next := range states {
+		updated, err := kubeStore.TransitionPromptAttemptDelivery(ctx, controlstore.PromptAttemptDeliveryTransition{
+			ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.DeliveryState,
+			NewState: next, OperationID: "delivery-" + string(next), OperationDigest: testDigest("delivery-" + string(next)),
+			UpdatedAt: testNow.Add(time.Duration(i+20) * time.Minute),
+		})
+		if err != nil {
+			t.Fatalf("TransitionPromptAttemptDelivery(%s): %v", next, err)
+		}
+		attempt = updated
+	}
+	return attempt
+}
+
+type recordingSessionTurnStore struct{ gotID string }
+
+type failOnceSessionTurnActivationStore struct {
+	controlstore.SessionTurnPersistenceStore
+	err    error
+	failed bool
+}
+
+func (s *failOnceSessionTurnActivationStore) ActivateSessionTurnProjection(ctx context.Context, request controlstore.ActivateSessionTurnProjectionRequest) (*controlstore.OutboxProjection, error) {
+	if !s.failed {
+		s.failed = true
+		return nil, s.err
+	}
+	return s.SessionTurnPersistenceStore.ActivateSessionTurnProjection(ctx, request)
+}
+
+func (*recordingSessionTurnStore) CreateSessionTurnRecord(context.Context, controlstore.CreateSessionTurnRecordRequest) (*controlstore.SessionTurn, error) {
+	return &controlstore.SessionTurn{}, nil
+}
+func (r *recordingSessionTurnStore) GetSessionTurn(_ context.Context, id string) (*controlstore.SessionTurn, error) {
+	r.gotID = id
+	return &controlstore.SessionTurn{ID: id}, nil
+}
+func (*recordingSessionTurnStore) CommitSessionTurnFinalization(context.Context, controlstore.CommitSessionTurnFinalizationRequest) (*controlstore.SessionTurn, error) {
+	return &controlstore.SessionTurn{}, nil
+}
+func (*recordingSessionTurnStore) ActivateSessionTurnProjection(context.Context, controlstore.ActivateSessionTurnProjectionRequest) (*controlstore.OutboxProjection, error) {
+	return &controlstore.OutboxProjection{}, nil
+}
+
+func newTestStore(t *testing.T) (*Store, client.Client) {
+	t.Helper()
+	scheme := runtime.NewScheme()
+	if err := corev1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatalf("add Orka scheme: %v", err)
+	}
+	if err := corev1.AddToScheme(scheme); err != nil {
+		t.Fatalf("add core scheme: %v", err)
+	}
+	if err := coordinationv1.AddToScheme(scheme); err != nil {
+		t.Fatalf("add coordination scheme: %v", err)
+	}
+	baseClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithStatusSubresource(
+			&corev1alpha1.Task{},
+			&corev1alpha1.ControllerEpoch{},
+			&corev1alpha1.PromptAttempt{},
+			&corev1alpha1.RuntimeSessionControl{},
+			&corev1alpha1.BranchClaim{},
+			&corev1alpha1.Publication{},
+			&corev1alpha1.ExternalEffect{},
+		).
+		Build()
+	var leaseUIDSequence atomic.Int64
+	kubeClient := interceptor.NewClient(baseClient, interceptor.Funcs{
+		Create: func(ctx context.Context, delegate client.WithWatch, object client.Object, options ...client.CreateOption) error {
+			if lease, ok := object.(*coordinationv1.Lease); ok && lease.UID == "" {
+				lease.UID = types.UID(fmt.Sprintf("test-lease-uid-%d", leaseUIDSequence.Add(1)))
+			}
+			return delegate.Create(ctx, object, options...)
+		},
+	})
+	kubeStore, err := New(kubeClient, testControlNamespace)
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	return kubeStore, kubeClient
+}
+
+func newTestStoreWithEpoch(t *testing.T) (*Store, client.Client, controlstore.ControllerEpochFence) {
+	t.Helper()
+	kubeStore, kubeClient := newTestStore(t)
+	epoch, err := kubeStore.CompareAndSwapControllerEpoch(context.Background(), controlstore.ControllerEpochCAS{
+		ExpectedVersion: 0, ExpectedEpoch: 0, NewEpoch: 1, HolderID: "controller-a",
+		RequestDigest: testDigest("epoch"), UpdatedAt: testNow,
+	})
+	if err != nil {
+		t.Fatalf("create epoch: %v", err)
+	}
+	return kubeStore, kubeClient, controlstore.ControllerEpochFence{Name: epoch.Name, Epoch: epoch.Epoch, HolderID: epoch.HolderID}
+}
+
+func ensureActiveAgentTask(t *testing.T, ctx context.Context, kubeClient client.Client, namespace, name, uid string) *corev1alpha1.Task {
+	t.Helper()
+	key := client.ObjectKey{Namespace: namespace, Name: name}
+	existing := &corev1alpha1.Task{}
+	if err := kubeClient.Get(ctx, key, existing); err == nil {
+		if string(existing.UID) != uid || existing.Spec.Type != corev1alpha1.TaskTypeAgent || !existing.DeletionTimestamp.IsZero() {
+			t.Fatalf("existing PromptAttempt owner Task = %#v", existing)
+		}
+		return existing
+	} else if !apierrors.IsNotFound(err) {
+		t.Fatalf("get PromptAttempt owner Task: %v", err)
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: namespace, Name: name, UID: types.UID(uid)},
+		Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeAgent},
+	}
+	if err := kubeClient.Create(ctx, task); err != nil {
+		t.Fatalf("create PromptAttempt owner Task: %v", err)
+	}
+	return task
+}
+
+func testDigest(value string) string {
+	sum := sha256.Sum256([]byte(value))
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
+
+func boundPromptAttemptForKubeTest(attempt *controlstore.PromptAttempt) *controlstore.PromptAttempt {
+	if attempt == nil {
+		return nil
+	}
+	if attempt.BindingDigest == "" {
+		attempt.BindingDigest = testDigest("test-v2-binding")
+	}
+	if attempt.SnapshotDigest == "" {
+		attempt.SnapshotDigest = testDigest("test-v2-snapshot")
+	}
+	return attempt
+}
+
+func testSessionLineageClaim(control *controlstore.SessionControl) *controlstore.ClaimSessionLineageRequest {
+	return &controlstore.ClaimSessionLineageRequest{
+		Namespace: control.Namespace, SessionName: control.SessionName,
+		NamespaceUID: "namespace-uid-" + control.Namespace, SessionUID: control.SessionUID,
+		ContractVersion: "orka.harness.v2", LineageGeneration: 1, RuntimeIdentity: "codex",
+		ConfigDigest:      testDigest("lineage-config-" + control.SessionUID),
+		EstablishIfAbsent: true,
+	}
+}
+
+func testBytesDigest(value []byte) string {
+	sum := sha256.Sum256(value)
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
+
+func TestPromptAttemptFreezesRoleSeparatedCredentialBindings(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, fence := newTestStoreWithEpoch(t)
+	key := controlstore.PromptAttemptKey{Namespace: "tenant-a", TaskUID: "task-credential", Attempt: 1, PromptID: "prompt-credential"}
+	ensureActiveAgentTask(t, ctx, kubeClient, key.Namespace, key.TaskUID, key.TaskUID)
+	binding := controlstore.PromptCredentialBinding{
+		Role: controlstore.PromptCredentialTargetWrite, Namespace: key.Namespace,
+		SecretName: "publish-token", SecretKey: "token", SecretUID: "secret-uid", ResourceVersion: "17",
+	}
+	created, err := kubeStore.CreatePromptAttempt(ctx, boundPromptAttemptForKubeTest(&controlstore.PromptAttempt{
+		Key: key, RequestDigest: testDigest("prompt-credential"), CredentialBindings: []controlstore.PromptCredentialBinding{binding},
+	}), fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(created.CredentialBindings) != 1 || created.CredentialBindings[0] != binding {
+		t.Fatalf("credential bindings = %#v", created.CredentialBindings)
+	}
+	changed := binding
+	changed.ResourceVersion = "18"
+	if _, err := kubeStore.CreatePromptAttempt(ctx, boundPromptAttemptForKubeTest(&controlstore.PromptAttempt{
+		Key: key, RequestDigest: testDigest("prompt-credential"), CredentialBindings: []controlstore.PromptCredentialBinding{changed},
+	}), fence); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("changed credential binding error = %v, want conflict", err)
+	}
+}
+
+func TestSessionReconciliationRetryClearsLeaseAfterStatusCommit(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, rawClient, fence := newTestStoreWithEpoch(t)
+	oldSHA, newSHA := strings.Repeat("8", 40), strings.Repeat("9", 40)
+	branch, err := kubeStore.CreateBranchClaim(ctx, &controlstore.BranchClaim{
+		RepositoryID: "repo-status-tail", Ref: "refs/heads/session", OwnerKind: controlstore.BranchClaimOwnerSession,
+		OwnerUID: "session-status-tail-uid", LastVerified: controlstore.RemoteRefState{SHA: oldSHA},
+		Availability: controlstore.BranchClaimReconciliationBlocked, BlockedReason: "unknown",
+		RelatedPublicationID: "publication-status-tail", RequestDigest: testDigest("branch-status-tail"),
+	}, fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	control, err := kubeStore.CreateSessionControl(ctx, &controlstore.SessionControl{
+		Namespace: "tenant-a", SessionName: "session-status-tail", SessionUID: "session-status-tail-uid",
+		RequestDigest: testDigest("session-status-tail"), Availability: controlstore.SessionReconciliationBlocked,
+		LeaseGeneration: 1, BlockedReason: "unknown", RelatedPublicationID: "publication-status-tail",
+	}, fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := controlstore.ReconcileSessionControlRequest{
+		Namespace: control.Namespace, SessionName: control.SessionName, SessionUID: control.SessionUID,
+		Fence: fence, ExpectedVersion: control.Version, ExpectedLeaseGeneration: control.LeaseGeneration,
+		ExpectedRelatedPublicationID: "publication-status-tail", BranchClaimID: branch.ID,
+		ExpectedBranchClaimVersion: branch.Version, ExpectedBranchClaimGeneration: branch.Generation,
+		ExpectedBranchBaseline: branch.LastVerified,
+		VerifiedBaseline:       controlstore.VerifiedBranchBaseline{RepositoryID: branch.RepositoryID, Ref: branch.Ref, SHA: newSHA},
+		OperationID:            "reconcile-status-tail", OperationDigest: testDigest("reconcile-status-tail"), ReconciledAt: testNow.Add(time.Hour),
+	}
+	withWatch := rawClient.(client.WithWatch)
+	failClearOnce := true
+	kubeStore.client = interceptor.NewClient(withWatch, interceptor.Funcs{
+		Update: func(ctx context.Context, c client.WithWatch, obj client.Object, opts ...client.UpdateOption) error {
+			if lease, ok := obj.(*coordinationv1.Lease); ok && failClearOnce && (lease.Spec.HolderIdentity == nil || *lease.Spec.HolderIdentity == "") && lease.Annotations[annotationSessionUID] == control.SessionUID {
+				failClearOnce = false
+				return apierrors.NewConflict(schema.GroupResource{Group: coordinationv1.GroupName, Resource: "leases"}, lease.Name, errors.New("simulated clear crash"))
+			}
+			return c.Update(ctx, obj, opts...)
+		},
+	})
+	if _, err := kubeStore.ReconcileSessionControl(ctx, request); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("first reconcile = %v", err)
+	}
+	committed, err := kubeStore.GetSessionControl(ctx, control.Namespace, control.SessionName)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if committed.Availability != controlstore.SessionAvailable || committed.LastOperationID != request.OperationID {
+		t.Fatalf("status not committed: %#v", committed)
+	}
+	if _, err := kubeStore.ReconcileSessionControl(ctx, request); err != nil {
+		t.Fatalf("retry reconcile: %v", err)
+	}
+}
+
+//nolint:gocyclo // The crash-tail fencing assertions intentionally stay in one end-to-end scenario.
+func TestPrePromptLeaseReleaseResumesAfterStatusCommit(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, rawClient, fence := newTestStoreWithEpoch(t)
+	control, err := kubeStore.CreateSessionControl(ctx, &controlstore.SessionControl{
+		Namespace: "tenant-a", SessionName: "abort-tail", SessionUID: "abort-tail-uid", RequestDigest: testDigest("abort-tail"),
+	}, fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	control, err = kubeStore.AcquireSessionMutationLease(ctx, controlstore.AcquireSessionMutationLeaseRequest{
+		Namespace: control.Namespace, SessionName: control.SessionName, SessionUID: control.SessionUID,
+		Fence: fence, ExpectedVersion: control.Version, ExpectedLeaseGeneration: control.LeaseGeneration,
+		TaskUID: "task-abort", Attempt: 1, PromptID: "prompt-abort", RequestDigest: testDigest("lease-abort"), AcquiredAt: testNow,
+		Lineage: testSessionLineageClaim(control),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	key := controlstore.SessionTurnKey{SessionUID: control.SessionUID, LeaseGeneration: control.LeaseGeneration, TaskUID: "task-abort", Attempt: 1, PromptID: "prompt-abort"}
+	turnID, _ := key.CanonicalID()
+	releaseDigest, err := controlstore.SessionLeaseReleaseOperationDigest(turnID, control.Lease.RequestDigest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	release := controlstore.ReleaseSessionMutationLeaseRequest{
+		Namespace: control.Namespace, SessionName: control.SessionName, SessionUID: control.SessionUID, Key: key,
+		Fence: fence, ExpectedSessionVersion: control.Version, LeaseRequestDigest: control.Lease.RequestDigest,
+		OperationID: prePromptLeaseReleasePrefix + turnID, OperationDigest: releaseDigest, ReleasedAt: testNow.Add(time.Minute),
+	}
+	withWatch := rawClient.(client.WithWatch)
+	failClearOnce := true
+	kubeStore.client = interceptor.NewClient(withWatch, interceptor.Funcs{
+		Update: func(ctx context.Context, c client.WithWatch, obj client.Object, opts ...client.UpdateOption) error {
+			if lease, ok := obj.(*coordinationv1.Lease); ok && failClearOnce && (lease.Spec.HolderIdentity == nil || *lease.Spec.HolderIdentity == "") && lease.Annotations[annotationSessionUID] == control.SessionUID {
+				failClearOnce = false
+				return apierrors.NewConflict(schema.GroupResource{Group: coordinationv1.GroupName, Resource: "leases"}, lease.Name, errors.New("simulated release crash"))
+			}
+			return c.Update(ctx, obj, opts...)
+		},
+	})
+	if _, err := kubeStore.ReleaseSessionMutationLease(ctx, release); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("first release = %v", err)
+	}
+	committed, err := kubeStore.GetSessionControl(ctx, control.Namespace, control.SessionName)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if committed.Lease != nil || committed.LastOperationID != release.OperationID {
+		t.Fatalf("release status not committed: %#v", committed)
+	}
+	leases := &coordinationv1.LeaseList{}
+	if err := rawClient.List(ctx, leases, client.InNamespace(control.Namespace)); err != nil {
+		t.Fatal(err)
+	}
+	var sessionLease *coordinationv1.Lease
+	for i := range leases.Items {
+		if leases.Items[i].Annotations[annotationSessionUID] == control.SessionUID {
+			sessionLease = leases.Items[i].DeepCopy()
+			break
+		}
+	}
+	if sessionLease == nil {
+		t.Fatal("session Lease not found")
+	}
+	originalRequestDigest := sessionLease.Annotations[annotationRequestDigest]
+	originalHolder := *sessionLease.Spec.HolderIdentity
+	sessionLease.Annotations[annotationRequestDigest] = testDigest("mismatched-held-lease")
+	if err := rawClient.Update(ctx, sessionLease); err != nil {
+		t.Fatal(err)
+	}
+	acquireNext := controlstore.AcquireSessionMutationLeaseRequest{
+		Namespace: committed.Namespace, SessionName: committed.SessionName, SessionUID: committed.SessionUID,
+		Fence: fence, ExpectedVersion: committed.Version, ExpectedLeaseGeneration: committed.LeaseGeneration,
+		TaskUID: "task-next", Attempt: 1, PromptID: "prompt-next", RequestDigest: testDigest("lease-next"), AcquiredAt: testNow.Add(2 * time.Minute),
+		Lineage: testSessionLineageClaim(committed),
+	}
+	if _, err := kubeStore.AcquireSessionMutationLease(ctx, acquireNext); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("acquire with mismatched held Lease digest = %v, want conflict", err)
+	}
+	if err := rawClient.Get(ctx, client.ObjectKeyFromObject(sessionLease), sessionLease); err != nil {
+		t.Fatal(err)
+	}
+	if sessionLease.Spec.HolderIdentity == nil || *sessionLease.Spec.HolderIdentity == "" {
+		t.Fatal("mismatched held Lease was cleared")
+	}
+	sessionLease.Annotations[annotationRequestDigest] = originalRequestDigest
+	if err := rawClient.Update(ctx, sessionLease); err != nil {
+		t.Fatal(err)
+	}
+	if err := rawClient.Get(ctx, client.ObjectKeyFromObject(sessionLease), sessionLease); err != nil {
+		t.Fatal(err)
+	}
+	mismatchedHolder := "mutation:mismatched-pre-prompt-holder"
+	sessionLease.Spec.HolderIdentity = &mismatchedHolder
+	if err := rawClient.Update(ctx, sessionLease); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := kubeStore.AcquireSessionMutationLease(ctx, acquireNext); !errors.Is(err, controlstore.ErrConflict) {
+		t.Fatalf("acquire with mismatched held Lease holder = %v, want conflict", err)
+	}
+	if err := rawClient.Get(ctx, client.ObjectKeyFromObject(sessionLease), sessionLease); err != nil {
+		t.Fatal(err)
+	}
+	if sessionLease.Spec.HolderIdentity == nil || *sessionLease.Spec.HolderIdentity != mismatchedHolder {
+		t.Fatal("mismatched pre-prompt Session Lease holder was cleared or changed")
+	}
+	sessionLease.Spec.HolderIdentity = &originalHolder
+	if err := rawClient.Update(ctx, sessionLease); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := kubeStore.AcquireSessionMutationLease(ctx, acquireNext); err != nil {
+		t.Fatalf("acquire after release crash: %v", err)
+	}
+}
+
+func TestControlRecordsDoNotInstallUnmanagedFinalizers(t *testing.T) {
+	ctx := context.Background()
+	kubeStore, kubeClient, fence := newTestStoreWithEpoch(t)
+	control, err := kubeStore.CreateSessionControl(ctx, &controlstore.SessionControl{
+		Namespace: "tenant-a", SessionName: "deletable", SessionUID: "deletable-uid",
+		RequestDigest: testDigest("deletable-session"), Availability: controlstore.SessionAvailable,
+	}, fence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var sessions corev1alpha1.RuntimeSessionControlList
+	if err := kubeClient.List(ctx, &sessions, client.InNamespace(control.Namespace)); err != nil {
+		t.Fatal(err)
+	}
+	if len(sessions.Items) != 1 || len(sessions.Items[0].Finalizers) != 0 {
+		t.Fatalf("SessionControl finalizers = %#v", sessions.Items)
+	}
+	var epochs corev1alpha1.ControllerEpochList
+	if err := kubeClient.List(ctx, &epochs, client.InNamespace(testControlNamespace)); err != nil {
+		t.Fatal(err)
+	}
+	if len(epochs.Items) != 1 || len(epochs.Items[0].Finalizers) != 0 {
+		t.Fatalf("ControllerEpoch finalizers = %#v", epochs.Items)
+	}
+}
diff --git a/internal/store/outbox_persistence.go b/internal/store/outbox_persistence.go
new file mode 100644
index 000000000..8350ecced
--- /dev/null
+++ b/internal/store/outbox_persistence.go
@@ -0,0 +1,13 @@
+package store
+
+import "context"
+
+// OutboxPersistenceStore is the SQLite-only outbox adapter used behind a
+// Kubernetes epoch fence. Its methods persist records but do not treat a
+// SQLite controller_epochs row as authoritative.
+type OutboxPersistenceStore interface {
+	EnqueueOutboxProjectionRecord(context.Context, *OutboxProjection, ControllerEpochFence) (*OutboxProjection, error)
+	GetOutboxProjection(context.Context, string) (*OutboxProjection, error)
+	ClaimOutboxProjectionRecords(context.Context, ClaimOutboxProjectionsRequest) ([]OutboxProjection, error)
+	CompleteOutboxProjectionRecord(context.Context, CompleteOutboxProjectionRequest) (*OutboxProjection, error)
+}
diff --git a/internal/store/security_types.go b/internal/store/security_types.go
index 47d589398..7fb32f5e7 100644
--- a/internal/store/security_types.go
+++ b/internal/store/security_types.go
@@ -90,19 +90,47 @@ type Finding struct {
 
 // PatchProposal represents a patch generation attempt for a finding.
 type PatchProposal struct {
-	ID              string    `json:"id"`
-	Namespace       string    `json:"namespace"`
-	RepositoryScan  string    `json:"repositoryScan"`
-	FindingID       string    `json:"findingID"`
-	TaskName        string    `json:"taskName"`
-	Branch          string    `json:"branch"`
-	DiffArtifact    string    `json:"diffArtifact,omitempty"`
-	SummaryArtifact string    `json:"summaryArtifact,omitempty"`
-	Status          string    `json:"status"`
-	PRNumber        *int      `json:"prNumber,omitempty"`
-	PRURL           string    `json:"prURL,omitempty"`
-	CreatedAt       time.Time `json:"createdAt"`
-	UpdatedAt       time.Time `json:"updatedAt"`
+	ID                  string                    `json:"id"`
+	Namespace           string                    `json:"namespace"`
+	RepositoryScan      string                    `json:"repositoryScan"`
+	FindingID           string                    `json:"findingID"`
+	TaskName            string                    `json:"taskName"`
+	Branch              string                    `json:"branch"`
+	DiffArtifact        string                    `json:"diffArtifact,omitempty"`
+	SummaryArtifact     string                    `json:"summaryArtifact,omitempty"`
+	Status              string                    `json:"status"`
+	PRNumber            *int                      `json:"prNumber,omitempty"`
+	PRURL               string                    `json:"prURL,omitempty"`
+	PublicationEvidence *PatchPublicationEvidence `json:"publicationEvidence,omitempty"`
+	CreatedAt           time.Time                 `json:"createdAt"`
+	UpdatedAt           time.Time                 `json:"updatedAt"`
+}
+
+// PatchPublicationEvidence is the immutable governed-publication tuple bound
+// atomically when a patch proposal reaches pr_opened.
+type PatchPublicationEvidence struct {
+	PublicationID      string                   `json:"publicationId"`
+	ArtifactDigest     string                   `json:"artifactDigest"`
+	SourceRepositoryID string                   `json:"sourceRepositoryId"`
+	SourceRef          string                   `json:"sourceRef"`
+	SourceBaselineSHA  string                   `json:"sourceBaselineSha"`
+	TargetRepositoryID string                   `json:"targetRepositoryId"`
+	TargetRef          string                   `json:"targetRef"`
+	ExpectedCommitSHA  string                   `json:"expectedCommitSha"`
+	VerifiedRemoteSHA  string                   `json:"verifiedRemoteSha"`
+	PRIntent           PullRequestIntent        `json:"prIntent"`
+	PRReceipt          PatchPullRequestEvidence `json:"prReceipt"`
+}
+
+// PatchPullRequestEvidence is the exact non-secret forge receipt bound to a
+// PatchPublicationEvidence record.
+type PatchPullRequestEvidence struct {
+	IntentKey string `json:"intentKey"`
+	ForgeID   string `json:"forgeId"`
+	Number    int    `json:"number"`
+	URL       string `json:"url"`
+	State     string `json:"state"`
+	HeadSHA   string `json:"headSha"`
 }
 
 // FindingCounts summarizes finding counts by severity.
@@ -166,6 +194,8 @@ type ReviewSlice struct {
 	Tests             []ReviewSliceTest  `json:"tests,omitempty"`
 	ChangedFiles      []string           `json:"changedFiles,omitempty"`
 	ChangedLineRanges []ChangedLineRange `json:"changedLineRanges,omitempty"`
+	ReviewContextJSON string             `json:"reviewContextJSON,omitempty"`
+	ReviewContextHash string             `json:"reviewContextHash,omitempty"`
 	Tags              []string           `json:"tags,omitempty"`
 	TrustBoundaries   []string           `json:"trustBoundaries,omitempty"`
 	Confidence        string             `json:"confidence"`
diff --git a/internal/store/session_cleanup.go b/internal/store/session_cleanup.go
new file mode 100644
index 000000000..f610bdbf1
--- /dev/null
+++ b/internal/store/session_cleanup.go
@@ -0,0 +1,104 @@
+package store
+
+import (
+	"context"
+	"time"
+)
+
+// SessionCleanupStore coordinates deletion across the Kubernetes-authoritative
+// ACP Session records and the SQLite-owned transcript state.
+type SessionCleanupStore interface {
+	ReclaimSession(ctx context.Context, request ReclaimSessionRequest) error
+}
+
+// SessionCleanupRecoveryStore resumes durable cleanup intents after controller
+// restart without requiring the original DELETE caller to retry.
+type SessionCleanupRecoveryStore interface {
+	ResumeSessionCleanups(ctx context.Context, fence ControllerEpochFence) error
+}
+
+// SessionCleanupPersistenceStore is the SQLite half of the cross-store Session
+// cleanup protocol. The durable intent closes the crash window between deleting
+// Kubernetes control records and deleting the transcript.
+type SessionCleanupPersistenceStore interface {
+	GetSessionCleanupIntent(ctx context.Context, namespace, sessionName string) (*SessionCleanupIntent, error)
+	ListSessionCleanupIntents(ctx context.Context) ([]SessionCleanupIntent, error)
+	GetSessionCleanupCompletion(ctx context.Context, namespace, sessionName string) (*SessionCleanupCompletion, error)
+	HasSessionCleanupFenceForUID(ctx context.Context, sessionUID string) (bool, error)
+	GetSessionCleanupIdentity(ctx context.Context, namespace, sessionName string) (string, error)
+	BindSessionCleanupIdentity(ctx context.Context, namespace, sessionName, sessionUID string) error
+	HasSessionCleanupIntent(ctx context.Context, namespace, sessionName string) (bool, error)
+	PrepareSessionCleanup(ctx context.Context, intent SessionCleanupIntent) (*SessionCleanupIntent, error)
+	CompleteSessionCleanup(ctx context.Context, request CompleteSessionCleanupRequest) error
+}
+
+// ReclaimSessionRequest identifies one idempotent user-requested Session
+// deletion under the current controller epoch.
+type ReclaimSessionRequest struct {
+	Namespace       string               `json:"namespace"`
+	SessionName     string               `json:"sessionName"`
+	Fence           ControllerEpochFence `json:"fence"`
+	OperationID     string               `json:"operationId"`
+	OperationDigest string               `json:"operationDigest"`
+	RequestedAt     time.Time            `json:"requestedAt"`
+}
+
+// SessionCleanupBranchClaim freezes one exact Session-owned BranchClaim.
+type SessionCleanupBranchClaim struct {
+	ID                    string                  `json:"id"`
+	ObjectUID             string                  `json:"objectUid"`
+	ExpectedVersion       int64                   `json:"expectedVersion"`
+	ExpectedGeneration    int64                   `json:"expectedGeneration"`
+	ExpectedRepositoryID  string                  `json:"expectedRepositoryId"`
+	ExpectedRef           string                  `json:"expectedRef"`
+	ExpectedOwnerUID      string                  `json:"expectedOwnerUid"`
+	ExpectedLastVerified  RemoteRefState          `json:"expectedLastVerified"`
+	ExpectedAvailability  BranchClaimAvailability `json:"expectedAvailability"`
+	ExpectedBlockedReason string                  `json:"expectedBlockedReason,omitempty"`
+	ExpectedPublicationID string                  `json:"expectedPublicationId,omitempty"`
+	ExpectedRequestDigest string                  `json:"expectedRequestDigest"`
+}
+
+// SessionCleanupIntent is the durable cross-store deletion plan. An empty
+// SessionUID denotes a transcript-only, non-ACP Session; SQLite refuses that
+// form when ACP SessionTurns exist.
+type SessionCleanupIntent struct {
+	Namespace                      string                      `json:"namespace"`
+	SessionName                    string                      `json:"sessionName"`
+	SessionUID                     string                      `json:"sessionUid,omitempty"`
+	ControlObjectUID               string                      `json:"controlObjectUid,omitempty"`
+	ControlRequestDigest           string                      `json:"controlRequestDigest,omitempty"`
+	ExpectedControlVersion         int64                       `json:"expectedControlVersion,omitempty"`
+	ExpectedLeaseGeneration        int64                       `json:"expectedLeaseGeneration,omitempty"`
+	ExpectedControlLastOperationID string                      `json:"expectedControlLastOperationId,omitempty"`
+	ExpectedControlLastDigest      string                      `json:"expectedControlLastDigest,omitempty"`
+	ExpectedVerifiedBaseline       *VerifiedBranchBaseline     `json:"expectedVerifiedBaseline,omitempty"`
+	LeaseName                      string                      `json:"leaseName,omitempty"`
+	LeaseObjectUID                 string                      `json:"leaseObjectUid,omitempty"`
+	BranchClaims                   []SessionCleanupBranchClaim `json:"branchClaims,omitempty"`
+	OperationID                    string                      `json:"operationId"`
+	OperationDigest                string                      `json:"operationDigest"`
+	PreparedAt                     time.Time                   `json:"preparedAt"`
+}
+
+// CompleteSessionCleanupRequest deletes SQLite-owned state only after the
+// authoritative Kubernetes plan has been reclaimed.
+type CompleteSessionCleanupRequest struct {
+	Namespace       string `json:"namespace"`
+	SessionName     string `json:"sessionName"`
+	OperationID     string `json:"operationId"`
+	OperationDigest string `json:"operationDigest"`
+}
+
+// SessionCleanupCompletion is the durable deletion tombstone retained after
+// the Session row and cleanup intent are atomically removed. Session names are
+// not reusable because stale DELETE retries cannot otherwise distinguish a new
+// Session instance from the deleted one.
+type SessionCleanupCompletion struct {
+	Namespace       string    `json:"namespace"`
+	SessionName     string    `json:"sessionName"`
+	SessionUID      string    `json:"sessionUid,omitempty"`
+	OperationID     string    `json:"operationId"`
+	OperationDigest string    `json:"operationDigest"`
+	CompletedAt     time.Time `json:"completedAt"`
+}
diff --git a/internal/store/session_turn_persistence.go b/internal/store/session_turn_persistence.go
new file mode 100644
index 000000000..b72320ce8
--- /dev/null
+++ b/internal/store/session_turn_persistence.go
@@ -0,0 +1,60 @@
+package store
+
+import (
+	"context"
+	"time"
+)
+
+// SessionTurnPersistenceStore is the SQLite-only half of SessionControlStore.
+// Implementations persist turn rows, transcript entries, and deferred outbox
+// records, but must not read or mutate Kubernetes-authoritative control rows.
+type SessionTurnPersistenceStore interface {
+	CreateSessionTurnRecord(context.Context, CreateSessionTurnRecordRequest) (*SessionTurn, error)
+	GetSessionTurn(context.Context, string) (*SessionTurn, error)
+	CommitSessionTurnFinalization(context.Context, CommitSessionTurnFinalizationRequest) (*SessionTurn, error)
+	ActivateSessionTurnProjection(context.Context, ActivateSessionTurnProjectionRequest) (*OutboxProjection, error)
+}
+
+// CreateSessionTurnRecordRequest persists an open turn after Kubernetes has
+// validated the exact SessionControl mutation lease and PromptAttempt binding.
+type CreateSessionTurnRecordRequest struct {
+	Turn        SessionTurn          `json:"turn"`
+	Namespace   string               `json:"namespace"`
+	SessionName string               `json:"sessionName"`
+	Fence       ControllerEpochFence `json:"fence"`
+}
+
+// CommitSessionTurnFinalizationRequest atomically commits only SQLite-owned
+// data: optional transcript messages, the finalized SessionTurn receipt, and a
+// deferred terminal outbox projection. Kubernetes control records are updated
+// by the coordinating Kubernetes store after this transaction commits.
+type CommitSessionTurnFinalizationRequest struct {
+	Key                  SessionTurnKey          `json:"key"`
+	Namespace            string                  `json:"namespace"`
+	SessionName          string                  `json:"sessionName"`
+	Fence                ControllerEpochFence    `json:"fence"`
+	ExpectedTurnVersion  int64                   `json:"expectedTurnVersion"`
+	FinalizationDigest   string                  `json:"finalizationDigest"`
+	TerminalKind         SessionTurnTerminalKind `json:"terminalKind"`
+	TerminalContent      string                  `json:"terminalContent"`
+	SkipTranscriptAppend bool                    `json:"skipTranscriptAppend,omitempty"`
+	SkipUserPromptAppend bool                    `json:"skipUserPromptAppend,omitempty"`
+	PublicationID        string                  `json:"publicationId,omitempty"`
+	PublicationReceipt   *PublicationReceipt     `json:"publicationReceipt,omitempty"`
+	Projection           OutboxProjection        `json:"projection"`
+	FinalizedAt          time.Time               `json:"finalizedAt"`
+}
+
+// ActivateSessionTurnProjectionRequest releases the deferred outbox record
+// only after Kubernetes SessionControl/BranchClaim finalization has committed.
+type ActivateSessionTurnProjectionRequest struct {
+	TurnID                 string               `json:"turnId"`
+	ProjectionID           string               `json:"projectionId"`
+	Fence                  ControllerEpochFence `json:"fence"`
+	FinalizationDigest     string               `json:"finalizationDigest"`
+	ExpectedAggregateKind  string               `json:"expectedAggregateKind"`
+	ExpectedProjectionKind string               `json:"expectedProjectionKind"`
+	ExpectedPayloadDigest  string               `json:"expectedPayloadDigest"`
+	AvailableAt            time.Time            `json:"availableAt"`
+	UpdatedAt              time.Time            `json:"updatedAt"`
+}
diff --git a/internal/store/sqlite/agent_execution_snapshot_store.go b/internal/store/sqlite/agent_execution_snapshot_store.go
new file mode 100644
index 000000000..4e6f5aa1e
--- /dev/null
+++ b/internal/store/sqlite/agent_execution_snapshot_store.go
@@ -0,0 +1,321 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package sqlite
+
+import (
+	"context"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"crypto/subtle"
+	"database/sql"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+// AgentExecutionSnapshotCipher encrypts immutable execution snapshot bodies at
+// rest. Snapshot bodies are sensitive (resolved prompts, Skill content,
+// repository identities, endpoint metadata, policy configuration) and are
+// never stored or returned in plaintext outside this seam.
+type AgentExecutionSnapshotCipher struct {
+	aead cipher.AEAD
+}
+
+// AgentExecutionSnapshotKeyBytes is the required AES-256 key length.
+const AgentExecutionSnapshotKeyBytes = 32
+
+// NewAgentExecutionSnapshotCipher builds an AES-256-GCM snapshot cipher.
+func NewAgentExecutionSnapshotCipher(key []byte) (*AgentExecutionSnapshotCipher, error) {
+	if len(key) != AgentExecutionSnapshotKeyBytes {
+		return nil, fmt.Errorf("agent execution snapshot key must be exactly %d bytes", AgentExecutionSnapshotKeyBytes)
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, fmt.Errorf("initialize snapshot cipher: %w", err)
+	}
+	aead, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, fmt.Errorf("initialize snapshot AEAD: %w", err)
+	}
+	return &AgentExecutionSnapshotCipher{aead: aead}, nil
+}
+
+func snapshotAdditionalData(taskUID, digest string, schemaVersion int32) []byte {
+	return fmt.Appendf(nil, "orka.agent-execution-snapshot\x00%s\x00%s\x00%d", taskUID, digest, schemaVersion)
+}
+
+func (c *AgentExecutionSnapshotCipher) seal(taskUID, digest string, schemaVersion int32, body []byte) (nonce, ciphertext []byte, err error) {
+	nonce = make([]byte, c.aead.NonceSize())
+	if _, err := rand.Read(nonce); err != nil {
+		return nil, nil, fmt.Errorf("generate snapshot nonce: %w", err)
+	}
+	ciphertext = c.aead.Seal(nil, nonce, body, snapshotAdditionalData(taskUID, digest, schemaVersion))
+	return nonce, ciphertext, nil
+}
+
+func (c *AgentExecutionSnapshotCipher) open(taskUID, digest string, schemaVersion int32, nonce, ciphertext []byte) ([]byte, error) {
+	body, err := c.aead.Open(nil, nonce, ciphertext, snapshotAdditionalData(taskUID, digest, schemaVersion))
+	if err != nil {
+		return nil, fmt.Errorf("decrypt agent execution snapshot %s/%s: %w", taskUID, digest, err)
+	}
+	return body, nil
+}
+
+// SetAgentExecutionSnapshotCipher installs the required at-rest encryption
+// cipher after proving that it can authenticate every retained snapshot.
+// Callers must configure the cipher before snapshot readers or writers start.
+// This rejects key rotation while any snapshot encrypted by the previous key
+// remains, preventing one database from silently accumulating mixed-key rows.
+func (s *Store) SetAgentExecutionSnapshotCipher(snapshotCipher *AgentExecutionSnapshotCipher) error {
+	if snapshotCipher == nil {
+		return errors.New("agent execution snapshot cipher is required")
+	}
+	rows, err := s.db.Query(`SELECT task_uid, digest, schema_version, nonce, ciphertext
+		FROM agent_execution_snapshots ORDER BY task_uid ASC, digest ASC`)
+	if err != nil {
+		return fmt.Errorf("verify agent execution snapshot key: %w", err)
+	}
+	defer func() { _ = rows.Close() }()
+	for rows.Next() {
+		var (
+			taskUID       string
+			digest        string
+			schemaVersion int32
+			nonce         []byte
+			ciphertext    []byte
+		)
+		if err := rows.Scan(&taskUID, &digest, &schemaVersion, &nonce, &ciphertext); err != nil {
+			return fmt.Errorf("scan retained agent execution snapshot while verifying key: %w", err)
+		}
+		body, err := snapshotCipher.open(taskUID, digest, schemaVersion, nonce, ciphertext)
+		if err != nil {
+			return fmt.Errorf(
+				"candidate agent execution snapshot key cannot authenticate retained snapshot %s/%s; restore the previous key or wait for reference-aware retention before rotating: %w",
+				taskUID, digest, err,
+			)
+		}
+		if computed := store.CanonicalAgentExecutionSnapshotDigest(body); computed != digest {
+			return fmt.Errorf("retained agent execution snapshot %s/%s failed integrity verification while activating key", taskUID, digest)
+		}
+	}
+	if err := rows.Err(); err != nil {
+		return fmt.Errorf("iterate retained agent execution snapshots while verifying key: %w", err)
+	}
+	s.snapshotCipher = snapshotCipher
+	return nil
+}
+
+var errSnapshotCipherRequired = errors.New("agent execution snapshot encryption is not configured; snapshot persistence fails closed")
+
+// PersistAgentExecutionSnapshot implements store.AgentExecutionSnapshotStore.
+func (s *Store) PersistAgentExecutionSnapshot(ctx context.Context, snapshot store.AgentExecutionSnapshot) error {
+	if s.snapshotCipher == nil {
+		return errSnapshotCipherRequired
+	}
+	key := store.AgentExecutionSnapshotKey{TaskUID: snapshot.TaskUID, Digest: snapshot.Digest}
+	if err := key.Validate(); err != nil {
+		return err
+	}
+	if snapshot.SchemaVersion < 1 {
+		return store.ValidationErrorf("snapshot schema version must be positive")
+	}
+	if len(snapshot.Body) == 0 {
+		return store.ValidationErrorf("snapshot body is required")
+	}
+	if computed := store.CanonicalAgentExecutionSnapshotDigest(snapshot.Body); computed != snapshot.Digest {
+		return store.ValidationErrorf("snapshot digest %s does not match body digest %s", snapshot.Digest, computed)
+	}
+
+	existing, err := s.GetAgentExecutionSnapshot(ctx, key)
+	switch {
+	case err == nil:
+		if existing.SchemaVersion == snapshot.SchemaVersion && subtle.ConstantTimeCompare(existing.Body, snapshot.Body) == 1 {
+			return nil
+		}
+		return fmt.Errorf("%w: agent execution snapshot %s already exists with different content", store.ErrDuplicateMismatch, key.ID())
+	case errors.Is(err, store.ErrNotFound):
+	default:
+		return err
+	}
+
+	nonce, ciphertext, err := s.snapshotCipher.seal(snapshot.TaskUID, snapshot.Digest, snapshot.SchemaVersion, snapshot.Body)
+	if err != nil {
+		return err
+	}
+	createdAt := snapshot.CreatedAt
+	if createdAt.IsZero() {
+		createdAt = time.Now().UTC()
+	}
+	_, err = s.db.ExecContext(ctx, `INSERT INTO agent_execution_snapshots
+		(task_uid, digest, schema_version, nonce, ciphertext, created_at)
+		VALUES (?, ?, ?, ?, ?, ?)
+		ON CONFLICT(task_uid, digest) DO NOTHING`,
+		snapshot.TaskUID, snapshot.Digest, snapshot.SchemaVersion, nonce, ciphertext, createdAt)
+	if err != nil {
+		return fmt.Errorf("persist agent execution snapshot: %w", err)
+	}
+	return nil
+}
+
+// GetAgentExecutionSnapshot implements store.AgentExecutionSnapshotStore.
+func (s *Store) GetAgentExecutionSnapshot(ctx context.Context, key store.AgentExecutionSnapshotKey) (*store.AgentExecutionSnapshot, error) {
+	if s.snapshotCipher == nil {
+		return nil, errSnapshotCipherRequired
+	}
+	if err := key.Validate(); err != nil {
+		return nil, err
+	}
+	row := s.db.QueryRowContext(ctx, `SELECT schema_version, nonce, ciphertext, created_at
+		FROM agent_execution_snapshots WHERE task_uid = ? AND digest = ?`, key.TaskUID, key.Digest)
+	var (
+		schemaVersion int32
+		nonce         []byte
+		ciphertext    []byte
+		createdAt     time.Time
+	)
+	if err := row.Scan(&schemaVersion, &nonce, &ciphertext, &createdAt); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, store.ErrNotFound
+		}
+		return nil, fmt.Errorf("get agent execution snapshot: %w", err)
+	}
+	body, err := s.snapshotCipher.open(key.TaskUID, key.Digest, schemaVersion, nonce, ciphertext)
+	if err != nil {
+		return nil, err
+	}
+	if computed := store.CanonicalAgentExecutionSnapshotDigest(body); computed != key.Digest {
+		return nil, fmt.Errorf("agent execution snapshot %s failed integrity verification", key.ID())
+	}
+	return &store.AgentExecutionSnapshot{
+		TaskUID:       key.TaskUID,
+		Digest:        key.Digest,
+		SchemaVersion: schemaVersion,
+		Body:          body,
+		CreatedAt:     createdAt.UTC(),
+	}, nil
+}
+
+// ListAgentExecutionSnapshotKeys implements store.AgentExecutionSnapshotStore.
+func (s *Store) ListAgentExecutionSnapshotKeys(ctx context.Context, taskUID string) ([]store.AgentExecutionSnapshotKey, error) {
+	if strings.TrimSpace(taskUID) == "" {
+		return nil, store.ValidationErrorf("snapshot task UID is required")
+	}
+	rows, err := s.db.QueryContext(ctx, `SELECT digest FROM agent_execution_snapshots
+		WHERE task_uid = ? ORDER BY created_at ASC, digest ASC`, taskUID)
+	if err != nil {
+		return nil, fmt.Errorf("list agent execution snapshots: %w", err)
+	}
+	defer func() { _ = rows.Close() }()
+	var keys []store.AgentExecutionSnapshotKey
+	for rows.Next() {
+		var digest string
+		if err := rows.Scan(&digest); err != nil {
+			return nil, fmt.Errorf("scan agent execution snapshot: %w", err)
+		}
+		keys = append(keys, store.AgentExecutionSnapshotKey{TaskUID: taskUID, Digest: digest})
+	}
+	return keys, rows.Err()
+}
+
+// ListAgentExecutionSnapshotMetadataBefore implements
+// store.AgentExecutionSnapshotLifecycleStore. The cutoff is strict so a
+// retention pass can use one stable timestamp without collecting records
+// created exactly at that boundary.
+func (s *Store) ListAgentExecutionSnapshotMetadataBefore(
+	ctx context.Context,
+	cutoff time.Time,
+) ([]store.AgentExecutionSnapshotMetadata, error) {
+	if cutoff.IsZero() {
+		return nil, store.ValidationErrorf("snapshot metadata cutoff is required")
+	}
+	rows, err := s.db.QueryContext(ctx, `SELECT task_uid, digest, schema_version, created_at
+		FROM agent_execution_snapshots
+		WHERE created_at < ?
+		ORDER BY created_at ASC, task_uid ASC, digest ASC`, cutoff.UTC())
+	if err != nil {
+		return nil, fmt.Errorf("list agent execution snapshot metadata: %w", err)
+	}
+	defer func() { _ = rows.Close() }()
+
+	metadata := make([]store.AgentExecutionSnapshotMetadata, 0)
+	for rows.Next() {
+		var item store.AgentExecutionSnapshotMetadata
+		if err := rows.Scan(&item.Key.TaskUID, &item.Key.Digest, &item.SchemaVersion, &item.CreatedAt); err != nil {
+			return nil, fmt.Errorf("scan agent execution snapshot metadata: %w", err)
+		}
+		item.CreatedAt = item.CreatedAt.UTC()
+		if err := item.Validate(); err != nil {
+			return nil, fmt.Errorf("validate stored agent execution snapshot metadata: %w", err)
+		}
+		metadata = append(metadata, item)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("iterate agent execution snapshot metadata: %w", err)
+	}
+	return metadata, nil
+}
+
+// CountAgentExecutionSnapshotReferences implements
+// store.AgentExecutionSnapshotLifecycleStore. All counts are read by one SQL
+// statement so the result is one consistent SQLite snapshot.
+func (s *Store) CountAgentExecutionSnapshotReferences(
+	ctx context.Context,
+	key store.AgentExecutionSnapshotKey,
+) (store.AgentExecutionSnapshotReferenceCounts, error) {
+	if err := key.Validate(); err != nil {
+		return store.AgentExecutionSnapshotReferenceCounts{}, err
+	}
+	var counts store.AgentExecutionSnapshotReferenceCounts
+	err := s.db.QueryRowContext(ctx, `SELECT
+		(SELECT COUNT(*) FROM harness_v1_attempts
+			WHERE task_uid = ? AND snapshot_digest = ?),
+		(SELECT COUNT(*) FROM prompt_attempts
+			WHERE task_uid = ? AND snapshot_digest = ?),
+		(SELECT COUNT(*) FROM session_turns
+			WHERE task_uid = ?)`,
+		key.TaskUID, key.Digest,
+		key.TaskUID, key.Digest,
+		key.TaskUID,
+	).Scan(
+		&counts.HarnessV1Attempts,
+		&counts.PromptAttempts,
+		&counts.SessionTurns,
+	)
+	if err != nil {
+		return store.AgentExecutionSnapshotReferenceCounts{}, fmt.Errorf("count agent execution snapshot references: %w", err)
+	}
+	return counts, nil
+}
+
+// DeleteAgentExecutionSnapshot implements
+// store.AgentExecutionSnapshotLifecycleStore. It deliberately does not alter
+// the Task-scoped broad deletion method above or perform lifecycle policy.
+func (s *Store) DeleteAgentExecutionSnapshot(ctx context.Context, key store.AgentExecutionSnapshotKey) error {
+	if err := key.Validate(); err != nil {
+		return err
+	}
+	if _, err := s.db.ExecContext(ctx, `DELETE FROM agent_execution_snapshots
+		WHERE task_uid = ? AND digest = ?`, key.TaskUID, key.Digest); err != nil {
+		return fmt.Errorf("delete agent execution snapshot: %w", err)
+	}
+	return nil
+}
+
+// DeleteAgentExecutionSnapshots implements store.AgentExecutionSnapshotStore.
+func (s *Store) DeleteAgentExecutionSnapshots(ctx context.Context, taskUID string) error {
+	if strings.TrimSpace(taskUID) == "" {
+		return store.ValidationErrorf("snapshot task UID is required")
+	}
+	if _, err := s.db.ExecContext(ctx, `DELETE FROM agent_execution_snapshots WHERE task_uid = ?`, taskUID); err != nil {
+		return fmt.Errorf("delete agent execution snapshots: %w", err)
+	}
+	return nil
+}
diff --git a/internal/store/sqlite/branch_claim_reclamation_test.go b/internal/store/sqlite/branch_claim_reclamation_test.go
new file mode 100644
index 000000000..052d474cc
--- /dev/null
+++ b/internal/store/sqlite/branch_claim_reclamation_test.go
@@ -0,0 +1,119 @@
+package sqlite
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+func TestReclaimBranchClaimIsExactAndRecoverySafe(t *testing.T) {
+	s := setupTestStore(t)
+	ctx := context.Background()
+	fence := seedControlEpoch(t, s)
+	claim, err := s.CreateBranchClaim(ctx, &store.BranchClaim{
+		RepositoryID: "github.com/orka/target", Ref: "refs/heads/shared",
+		OwnerKind: store.BranchClaimOwnerTask, OwnerUID: "task-old", LastVerified: store.RemoteRefState{Absent: true},
+		RequestDigest: controlTestDigest("branch-old"), CreatedAt: time.Now().UTC(),
+	}, fence)
+	if err != nil {
+		t.Fatalf("CreateBranchClaim: %v", err)
+	}
+	request := reclaimBranchClaimRequestForTest(claim, fence)
+	staleBaseline := request
+	staleBaseline.ExpectedLastVerified = store.RemoteRefState{SHA: controlTestGitSHA}
+	if err := s.ReclaimBranchClaim(ctx, staleBaseline); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("ReclaimBranchClaim(stale baseline) error = %v, want ErrConflict", err)
+	}
+	if err := s.ReclaimBranchClaim(ctx, request); err != nil {
+		t.Fatalf("ReclaimBranchClaim: %v", err)
+	}
+	if _, err := s.GetBranchClaim(ctx, claim.ID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("GetBranchClaim after reclaim error = %v, want ErrNotFound", err)
+	}
+	if err := s.ReclaimBranchClaim(ctx, request); err != nil {
+		t.Fatalf("ReclaimBranchClaim(idempotent retry): %v", err)
+	}
+
+	replacement, err := s.CreateBranchClaim(ctx, &store.BranchClaim{
+		RepositoryID: claim.RepositoryID, Ref: claim.Ref,
+		OwnerKind: store.BranchClaimOwnerTask, OwnerUID: "task-new", LastVerified: store.RemoteRefState{SHA: controlTestGitSHA},
+		RequestDigest: controlTestDigest("branch-new"), CreatedAt: time.Now().UTC(),
+	}, fence)
+	if err != nil {
+		t.Fatalf("CreateBranchClaim(replacement): %v", err)
+	}
+	if err := s.ReclaimBranchClaim(ctx, request); err != nil {
+		t.Fatalf("ReclaimBranchClaim(old retry after replacement): %v", err)
+	}
+	preserved, err := s.GetBranchClaim(ctx, replacement.ID)
+	if err != nil {
+		t.Fatalf("GetBranchClaim(replacement): %v", err)
+	}
+	if preserved.OwnerUID != replacement.OwnerUID || preserved.RequestDigest != replacement.RequestDigest {
+		t.Fatalf("replacement claim was changed: %#v", preserved)
+	}
+}
+
+func TestReclaimBranchClaimReclaimsSessionAndPreservesBlockedClaims(t *testing.T) {
+	s := setupTestStore(t)
+	ctx := context.Background()
+	fence := seedControlEpoch(t, s)
+
+	sessionClaim, err := s.CreateBranchClaim(ctx, &store.BranchClaim{
+		RepositoryID: "github.com/orka/target", Ref: "refs/heads/session",
+		OwnerKind: store.BranchClaimOwnerSession, OwnerUID: "session-uid", LastVerified: store.RemoteRefState{SHA: controlTestGitSHA},
+		RequestDigest: controlTestDigest("session-claim"), CreatedAt: time.Now().UTC(),
+	}, fence)
+	if err != nil {
+		t.Fatalf("CreateBranchClaim(session): %v", err)
+	}
+	sessionRequest := reclaimBranchClaimRequestForTest(sessionClaim, fence)
+	sessionRequest.ExpectedOwnerKind = store.BranchClaimOwnerSession
+	if err := s.ReclaimBranchClaim(ctx, sessionRequest); err != nil {
+		t.Fatalf("ReclaimBranchClaim(session): %v", err)
+	}
+	if _, err := s.GetBranchClaim(ctx, sessionClaim.ID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("GetBranchClaim(session) error = %v, want ErrNotFound", err)
+	}
+
+	taskClaim, err := s.CreateBranchClaim(ctx, &store.BranchClaim{
+		RepositoryID: "github.com/orka/target", Ref: "refs/heads/blocked",
+		OwnerKind: store.BranchClaimOwnerTask, OwnerUID: "task-blocked", LastVerified: store.RemoteRefState{Absent: true},
+		RequestDigest: controlTestDigest("blocked-claim"), CreatedAt: time.Now().UTC(),
+	}, fence)
+	if err != nil {
+		t.Fatalf("CreateBranchClaim(blocked): %v", err)
+	}
+	blocked, err := s.CompareAndSwapBranchClaim(ctx, store.BranchClaimCAS{
+		ID: taskClaim.ID, Fence: fence, ExpectedVersion: taskClaim.Version,
+		ExpectedGeneration: taskClaim.Generation, NewGeneration: taskClaim.Generation,
+		ExpectedLastVerified: taskClaim.LastVerified, NewLastVerified: taskClaim.LastVerified,
+		ExpectedAvailability: taskClaim.Availability, NewAvailability: store.BranchClaimReconciliationBlocked,
+		BlockedReason: "manual reconciliation required", RelatedPublicationID: "publication-blocked",
+		OperationID: "block-claim", OperationDigest: controlTestDigest("block-claim"), UpdatedAt: time.Now().UTC(),
+	})
+	if err != nil {
+		t.Fatalf("CompareAndSwapBranchClaim(block): %v", err)
+	}
+	blockedRequest := reclaimBranchClaimRequestForTest(blocked, fence)
+	blockedRequest.ExpectedAvailability = store.BranchClaimAvailable
+	if err := s.ReclaimBranchClaim(ctx, blockedRequest); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("ReclaimBranchClaim(blocked) error = %v, want ErrConflict", err)
+	}
+	if _, err := s.GetBranchClaim(ctx, blocked.ID); err != nil {
+		t.Fatalf("blocked claim was removed: %v", err)
+	}
+}
+
+func reclaimBranchClaimRequestForTest(claim *store.BranchClaim, fence store.ControllerEpochFence) store.ReclaimBranchClaimRequest {
+	return store.ReclaimBranchClaimRequest{
+		ID: claim.ID, Fence: fence, ExpectedVersion: claim.Version, ExpectedGeneration: claim.Generation,
+		ExpectedRepositoryID: claim.RepositoryID, ExpectedRef: claim.Ref,
+		ExpectedOwnerKind: claim.OwnerKind, ExpectedOwnerUID: claim.OwnerUID,
+		ExpectedLastVerified: claim.LastVerified, ExpectedAvailability: claim.Availability,
+		ExpectedRequestDigest: claim.RequestDigest,
+	}
+}
diff --git a/internal/store/sqlite/branch_claim_store.go b/internal/store/sqlite/branch_claim_store.go
new file mode 100644
index 000000000..891e6a19b
--- /dev/null
+++ b/internal/store/sqlite/branch_claim_store.go
@@ -0,0 +1,448 @@
+package sqlite
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+var _ store.BranchClaimStore = (*Store)(nil)
+var _ store.BranchClaimCreationStore = (*Store)(nil)
+
+// CreateBranchClaim creates a canonical repository+full-ref ownership record.
+// The same immutable identity and digest is idempotent; any mismatch conflicts.
+func (s *Store) CreateBranchClaim(ctx context.Context, claim *store.BranchClaim, fence store.ControllerEpochFence) (*store.BranchClaim, error) {
+	created, _, err := s.CreateBranchClaimWithResult(ctx, claim, fence)
+	return created, err
+}
+
+// CreateBranchClaimWithResult creates or idempotently returns a claim and
+// reports true only when this transaction inserted the row.
+func (s *Store) CreateBranchClaimWithResult(ctx context.Context, claim *store.BranchClaim, fence store.ControllerEpochFence) (*store.BranchClaim, bool, error) {
+	normalized, fence, err := normalizeBranchClaimForCreate(claim, fence)
+	if err != nil {
+		return nil, false, err
+	}
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, false, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, fence); err != nil {
+		return nil, false, err
+	}
+	if existing, getErr := getBranchClaim(ctx, tx, normalized.ID); getErr == nil {
+		if sameBranchClaimCreation(existing, normalized) {
+			return &existing, false, nil
+		}
+		return nil, false, controlConflict("branch claim %q was reused with a different owner or request digest", normalized.ID)
+	} else if !errors.Is(getErr, store.ErrNotFound) {
+		return nil, false, getErr
+	}
+	_, err = tx.ExecContext(ctx,
+		`INSERT INTO branch_claims(
+			id, repository_id, ref, owner_kind, owner_uid, generation, last_verified_absent,
+			last_verified_sha, availability, blocked_reason, related_publication_id, request_digest,
+			controller_epoch_name, controller_epoch, last_operation_id, last_operation_digest,
+			version, created_at, updated_at
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		normalized.ID, normalized.RepositoryID, normalized.Ref, string(normalized.OwnerKind), normalized.OwnerUID,
+		normalized.Generation, normalized.LastVerified.Absent, normalized.LastVerified.SHA, string(normalized.Availability),
+		normalized.BlockedReason, normalized.RelatedPublicationID, normalized.RequestDigest,
+		normalized.ControllerEpochName, normalized.ControllerEpoch, normalized.LastOperationID,
+		normalized.LastOperationDigest, normalized.Version, normalized.CreatedAt, normalized.UpdatedAt,
+	)
+	if err != nil {
+		if !isSQLiteConstraintError(err) {
+			return nil, false, err
+		}
+		existing, getErr := getBranchClaim(ctx, tx, normalized.ID)
+		if getErr == nil && sameBranchClaimCreation(existing, normalized) {
+			return &existing, false, nil
+		}
+		return nil, false, controlConflict("branch claim %q already exists with a different owner, baseline, or request digest", normalized.ID)
+	}
+	if err := tx.Commit(); err != nil {
+		_ = tx.Rollback()
+		existing, getErr := getBranchClaim(ctx, s.db, normalized.ID)
+		if getErr == nil && sameBranchClaimCreation(existing, normalized) {
+			return &existing, false, nil
+		}
+		return nil, false, err
+	}
+	return &normalized, true, nil
+}
+
+// GetBranchClaim returns one branch claim.
+func (s *Store) GetBranchClaim(ctx context.Context, id string) (*store.BranchClaim, error) {
+	id = strings.TrimSpace(id)
+	if err := store.ValidateControlIdentifier("branch claim ID", id); err != nil {
+		return nil, err
+	}
+	claim, err := getBranchClaim(ctx, s.db, id)
+	if err != nil {
+		return nil, err
+	}
+	return &claim, nil
+}
+
+// ReclaimBranchClaim deletes only the exact available Task-owned claim. A
+// missing claim or one whose immutable owner/request identity was replaced is
+// already reclaimed from the caller's perspective; every other mismatch is a
+// conflict so stale recovery cannot delete a live claim.
+func (s *Store) ReclaimBranchClaim(ctx context.Context, request store.ReclaimBranchClaimRequest) error {
+	normalized, err := normalizeBranchClaimReclamationRequest(request)
+	if err != nil {
+		return err
+	}
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, normalized.Fence); err != nil {
+		return err
+	}
+	claim, err := getBranchClaim(ctx, tx, normalized.ID)
+	if errors.Is(err, store.ErrNotFound) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	if branchClaimReclamationIdentityReplaced(claim, normalized) {
+		return nil
+	}
+	if !branchClaimMatchesReclamation(claim, normalized) {
+		return controlConflict("branch claim %q no longer matches the exact Task-owner reclamation fence", claim.ID)
+	}
+	result, err := tx.ExecContext(ctx,
+		`DELETE FROM branch_claims
+		 WHERE id = ? AND repository_id = ? AND ref = ? AND owner_kind = ? AND owner_uid = ?
+		   AND generation = ? AND last_verified_absent = ? AND last_verified_sha = ?
+		   AND availability = ? AND blocked_reason = '' AND related_publication_id = ''
+		   AND request_digest = ? AND version = ?`,
+		normalized.ID, normalized.ExpectedRepositoryID, normalized.ExpectedRef,
+		normalized.ExpectedOwnerKind, normalized.ExpectedOwnerUID, normalized.ExpectedGeneration,
+		normalized.ExpectedLastVerified.Absent, normalized.ExpectedLastVerified.SHA,
+		normalized.ExpectedAvailability, normalized.ExpectedRequestDigest, normalized.ExpectedVersion,
+	)
+	if err != nil {
+		return err
+	}
+	rows, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if rows != 1 {
+		latest, getErr := getBranchClaim(ctx, tx, normalized.ID)
+		if errors.Is(getErr, store.ErrNotFound) {
+			return nil
+		}
+		if getErr != nil {
+			return getErr
+		}
+		if branchClaimReclamationIdentityReplaced(latest, normalized) {
+			return nil
+		}
+		return controlConflict("branch claim %q changed during Task-owner reclamation", normalized.ID)
+	}
+	return tx.Commit()
+}
+
+// CompareAndSwapBranchClaim atomically updates the exact generation, baseline,
+// and availability observed by the caller.
+//
+//nolint:gocyclo // The explicit baseline/generation/version CAS validation is intentionally centralized.
+func (s *Store) CompareAndSwapBranchClaim(ctx context.Context, change store.BranchClaimCAS) (*store.BranchClaim, error) {
+	change.ID = strings.TrimSpace(change.ID)
+	if err := store.ValidateControlIdentifier("branch claim ID", change.ID); err != nil {
+		return nil, err
+	}
+	fence, err := normalizeEpochFence(change.Fence)
+	if err != nil {
+		return nil, err
+	}
+	change.Fence = fence
+	if change.ExpectedVersion < 1 || change.ExpectedGeneration < 1 {
+		return nil, store.ValidationErrorf("branch claim expected version and generation must be at least 1")
+	}
+	if change.NewGeneration != change.ExpectedGeneration && change.NewGeneration != change.ExpectedGeneration+1 {
+		return nil, store.ValidationErrorf("branch claim generation may be preserved or incremented exactly by one")
+	}
+	if err := change.ExpectedLastVerified.Validate("expected branch baseline"); err != nil {
+		return nil, err
+	}
+	if err := change.NewLastVerified.Validate("new branch baseline"); err != nil {
+		return nil, err
+	}
+	if !isKnownBranchClaimAvailability(change.ExpectedAvailability) || !isKnownBranchClaimAvailability(change.NewAvailability) {
+		return nil, store.ValidationErrorf("unsupported branch claim availability transition %q -> %q", change.ExpectedAvailability, change.NewAvailability)
+	}
+	change.BlockedReason = strings.TrimSpace(change.BlockedReason)
+	change.RelatedPublicationID = strings.TrimSpace(change.RelatedPublicationID)
+	if err := store.ValidateControlReason("branch claim blocked reason", change.BlockedReason); err != nil {
+		return nil, err
+	}
+	if change.NewAvailability == store.BranchClaimAvailable && (change.BlockedReason != "" || change.RelatedPublicationID != "") {
+		return nil, store.ValidationErrorf("available branch claim must clear blocked reason and related publication")
+	}
+	if change.NewAvailability == store.BranchClaimReconciliationBlocked && change.BlockedReason == "" {
+		return nil, store.ValidationErrorf("reconciliation-blocked branch claim requires a reason")
+	}
+	if change.RelatedPublicationID != "" {
+		if err := store.ValidateControlIdentifier("related publication ID", change.RelatedPublicationID); err != nil {
+			return nil, err
+		}
+	}
+	change.OperationID = strings.TrimSpace(change.OperationID)
+	if err := store.ValidateControlIdentifier("branch claim operation ID", change.OperationID); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateCanonicalDigest("branch claim operation digest", change.OperationDigest); err != nil {
+		return nil, err
+	}
+	change.UpdatedAt = normalizeControlTime(change.UpdatedAt)
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, change.Fence); err != nil {
+		return nil, err
+	}
+	claim, err := getBranchClaim(ctx, tx, change.ID)
+	if err != nil {
+		return nil, err
+	}
+	if claim.LastOperationID == change.OperationID {
+		if claim.LastOperationDigest != change.OperationDigest {
+			return nil, controlConflict("branch claim operation %q was reused with a different digest", change.OperationID)
+		}
+		if claim.Generation == change.NewGeneration && claim.LastVerified.Equal(change.NewLastVerified) &&
+			claim.Availability == change.NewAvailability && claim.BlockedReason == change.BlockedReason &&
+			claim.RelatedPublicationID == change.RelatedPublicationID {
+			return &claim, nil
+		}
+		return nil, controlConflict("branch claim operation %q was already applied with different target values", change.OperationID)
+	}
+	if claim.Version != change.ExpectedVersion || claim.Generation != change.ExpectedGeneration ||
+		!claim.LastVerified.Equal(change.ExpectedLastVerified) || claim.Availability != change.ExpectedAvailability {
+		return nil, controlConflict("branch claim %q no longer matches expected version, generation, baseline, or availability", claim.ID)
+	}
+
+	result, err := tx.ExecContext(ctx,
+		`UPDATE branch_claims
+		 SET generation = ?, last_verified_absent = ?, last_verified_sha = ?, availability = ?,
+		     blocked_reason = ?, related_publication_id = ?, controller_epoch_name = ?, controller_epoch = ?,
+		     last_operation_id = ?, last_operation_digest = ?, version = version + 1, updated_at = ?
+		 WHERE id = ? AND version = ? AND generation = ? AND last_verified_absent = ?
+		   AND last_verified_sha = ? AND availability = ?`,
+		change.NewGeneration, change.NewLastVerified.Absent, change.NewLastVerified.SHA, string(change.NewAvailability),
+		change.BlockedReason, change.RelatedPublicationID, change.Fence.Name, change.Fence.Epoch,
+		change.OperationID, change.OperationDigest, change.UpdatedAt, change.ID, change.ExpectedVersion,
+		change.ExpectedGeneration, change.ExpectedLastVerified.Absent, change.ExpectedLastVerified.SHA,
+		string(change.ExpectedAvailability),
+	)
+	if err != nil {
+		return nil, err
+	}
+	if err := rowsAffectedExactlyOne(result, "branch claim"); err != nil {
+		return nil, err
+	}
+	claim.Generation = change.NewGeneration
+	claim.LastVerified = change.NewLastVerified
+	claim.Availability = change.NewAvailability
+	claim.BlockedReason = change.BlockedReason
+	claim.RelatedPublicationID = change.RelatedPublicationID
+	claim.ControllerEpochName = change.Fence.Name
+	claim.ControllerEpoch = change.Fence.Epoch
+	claim.LastOperationID = change.OperationID
+	claim.LastOperationDigest = change.OperationDigest
+	claim.Version++
+	claim.UpdatedAt = change.UpdatedAt
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &claim, nil
+}
+
+func normalizeBranchClaimForCreate(claim *store.BranchClaim, fence store.ControllerEpochFence) (store.BranchClaim, store.ControllerEpochFence, error) {
+	if claim == nil {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, store.ValidationErrorf("branch claim is required")
+	}
+	normalized := *claim
+	normalized.RepositoryID = strings.TrimSpace(normalized.RepositoryID)
+	normalized.Ref = strings.TrimSpace(normalized.Ref)
+	normalized.OwnerUID = strings.TrimSpace(normalized.OwnerUID)
+	if err := store.ValidateControlIdentifier("publication repository ID", normalized.RepositoryID); err != nil {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, err
+	}
+	if err := store.ValidateFullBranchRef(normalized.Ref); err != nil {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, err
+	}
+	canonicalID, err := store.CanonicalBranchClaimID(normalized.RepositoryID, normalized.Ref)
+	if err != nil {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, err
+	}
+	normalized.ID = strings.TrimSpace(normalized.ID)
+	if normalized.ID == "" {
+		normalized.ID = canonicalID
+	}
+	if normalized.ID != canonicalID {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, store.ValidationErrorf("branch claim ID must equal canonical ID %q", canonicalID)
+	}
+	if normalized.OwnerKind != store.BranchClaimOwnerTask && normalized.OwnerKind != store.BranchClaimOwnerSession {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, store.ValidationErrorf("unsupported branch claim owner kind %q", normalized.OwnerKind)
+	}
+	if err := store.ValidateControlIdentifier("branch claim owner UID", normalized.OwnerUID); err != nil {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, err
+	}
+	if normalized.Generation == 0 {
+		normalized.Generation = 1
+	}
+	if normalized.Generation != 1 {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, store.ValidationErrorf("new branch claim generation must be one")
+	}
+	if err := normalized.LastVerified.Validate("branch baseline"); err != nil {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, err
+	}
+	if normalized.Availability == "" {
+		normalized.Availability = store.BranchClaimAvailable
+	}
+	if !isKnownBranchClaimAvailability(normalized.Availability) {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, store.ValidationErrorf("unsupported branch claim availability %q", normalized.Availability)
+	}
+	normalized.BlockedReason = strings.TrimSpace(normalized.BlockedReason)
+	normalized.RelatedPublicationID = strings.TrimSpace(normalized.RelatedPublicationID)
+	if normalized.Availability == store.BranchClaimAvailable && (normalized.BlockedReason != "" || normalized.RelatedPublicationID != "") {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, store.ValidationErrorf("available branch claim must not have block metadata")
+	}
+	if normalized.Availability == store.BranchClaimReconciliationBlocked && normalized.BlockedReason == "" {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, store.ValidationErrorf("reconciliation-blocked branch claim requires a reason")
+	}
+	if err := store.ValidateControlReason("branch claim blocked reason", normalized.BlockedReason); err != nil {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, err
+	}
+	if err := store.ValidateCanonicalDigest("branch claim request digest", normalized.RequestDigest); err != nil {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, err
+	}
+	fence, err = normalizeEpochFence(fence)
+	if err != nil {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, err
+	}
+	if normalized.Version != 0 && normalized.Version != 1 {
+		return store.BranchClaim{}, store.ControllerEpochFence{}, store.ValidationErrorf("new branch claim version must be zero or one")
+	}
+	now := normalizeControlTime(normalized.CreatedAt)
+	normalized.CreatedAt = now
+	if normalized.UpdatedAt.IsZero() {
+		normalized.UpdatedAt = now
+	} else {
+		normalized.UpdatedAt = normalized.UpdatedAt.UTC()
+	}
+	normalized.ControllerEpochName = fence.Name
+	normalized.ControllerEpoch = fence.Epoch
+	normalized.Version = 1
+	normalized.LastOperationID = ""
+	normalized.LastOperationDigest = ""
+	return normalized, fence, nil
+}
+
+func normalizeBranchClaimReclamationRequest(request store.ReclaimBranchClaimRequest) (store.ReclaimBranchClaimRequest, error) {
+	request.ID = strings.TrimSpace(request.ID)
+	request.ExpectedRepositoryID = strings.TrimSpace(request.ExpectedRepositoryID)
+	request.ExpectedRef = strings.TrimSpace(request.ExpectedRef)
+	request.ExpectedOwnerUID = strings.TrimSpace(request.ExpectedOwnerUID)
+	request.ExpectedRequestDigest = strings.TrimSpace(request.ExpectedRequestDigest)
+	if err := store.ValidateControlIdentifier("branch claim ID", request.ID); err != nil {
+		return store.ReclaimBranchClaimRequest{}, err
+	}
+	if err := store.ValidateControlIdentifier("publication repository ID", request.ExpectedRepositoryID); err != nil {
+		return store.ReclaimBranchClaimRequest{}, err
+	}
+	if err := store.ValidateFullBranchRef(request.ExpectedRef); err != nil {
+		return store.ReclaimBranchClaimRequest{}, err
+	}
+	canonicalID, err := store.CanonicalBranchClaimID(request.ExpectedRepositoryID, request.ExpectedRef)
+	if err != nil {
+		return store.ReclaimBranchClaimRequest{}, err
+	}
+	if request.ID != canonicalID {
+		return store.ReclaimBranchClaimRequest{}, store.ValidationErrorf("branch claim ID must equal canonical ID %q", canonicalID)
+	}
+	if request.ExpectedOwnerKind != store.BranchClaimOwnerTask && request.ExpectedOwnerKind != store.BranchClaimOwnerSession {
+		return store.ReclaimBranchClaimRequest{}, store.ValidationErrorf("branch claim owner kind is not reclaimable")
+	}
+	if err := store.ValidateControlIdentifier("branch claim owner UID", request.ExpectedOwnerUID); err != nil {
+		return store.ReclaimBranchClaimRequest{}, err
+	}
+	if request.ExpectedVersion < 1 || request.ExpectedGeneration < 1 {
+		return store.ReclaimBranchClaimRequest{}, store.ValidationErrorf("branch claim expected version and generation must be at least 1")
+	}
+	if err := request.ExpectedLastVerified.Validate("expected branch baseline"); err != nil {
+		return store.ReclaimBranchClaimRequest{}, err
+	}
+	if request.ExpectedAvailability != store.BranchClaimAvailable {
+		return store.ReclaimBranchClaimRequest{}, store.ValidationErrorf("only available branch claims may be reclaimed")
+	}
+	if err := store.ValidateCanonicalDigest("branch claim request digest", request.ExpectedRequestDigest); err != nil {
+		return store.ReclaimBranchClaimRequest{}, err
+	}
+	fence, err := normalizeEpochFence(request.Fence)
+	if err != nil {
+		return store.ReclaimBranchClaimRequest{}, err
+	}
+	request.Fence = fence
+	return request, nil
+}
+
+func branchClaimReclamationIdentityReplaced(claim store.BranchClaim, request store.ReclaimBranchClaimRequest) bool {
+	return claim.OwnerKind != request.ExpectedOwnerKind || claim.OwnerUID != request.ExpectedOwnerUID || claim.RequestDigest != request.ExpectedRequestDigest
+}
+
+func branchClaimMatchesReclamation(claim store.BranchClaim, request store.ReclaimBranchClaimRequest) bool {
+	return claim.ID == request.ID && claim.RepositoryID == request.ExpectedRepositoryID && claim.Ref == request.ExpectedRef &&
+		claim.OwnerKind == request.ExpectedOwnerKind && claim.OwnerUID == request.ExpectedOwnerUID &&
+		claim.Generation == request.ExpectedGeneration && claim.LastVerified.Equal(request.ExpectedLastVerified) &&
+		claim.Availability == request.ExpectedAvailability && claim.BlockedReason == "" && claim.RelatedPublicationID == "" &&
+		claim.RequestDigest == request.ExpectedRequestDigest && claim.Version == request.ExpectedVersion
+}
+
+func sameBranchClaimCreation(a, b store.BranchClaim) bool {
+	return a.ID == b.ID && a.RepositoryID == b.RepositoryID && a.Ref == b.Ref &&
+		a.OwnerKind == b.OwnerKind && a.OwnerUID == b.OwnerUID && a.RequestDigest == b.RequestDigest
+}
+
+func isKnownBranchClaimAvailability(value store.BranchClaimAvailability) bool {
+	return value == store.BranchClaimAvailable || value == store.BranchClaimReconciliationBlocked
+}
+
+func getBranchClaim(ctx context.Context, q controlQueryRower, id string) (store.BranchClaim, error) {
+	var claim store.BranchClaim
+	err := q.QueryRowContext(ctx,
+		`SELECT id, repository_id, ref, owner_kind, owner_uid, generation, last_verified_absent,
+		        last_verified_sha, availability, blocked_reason, related_publication_id, request_digest,
+		        controller_epoch_name, controller_epoch, last_operation_id, last_operation_digest,
+		        version, created_at, updated_at
+		 FROM branch_claims WHERE id = ?`, id,
+	).Scan(
+		&claim.ID, &claim.RepositoryID, &claim.Ref, &claim.OwnerKind, &claim.OwnerUID, &claim.Generation,
+		&claim.LastVerified.Absent, &claim.LastVerified.SHA, &claim.Availability, &claim.BlockedReason,
+		&claim.RelatedPublicationID, &claim.RequestDigest, &claim.ControllerEpochName,
+		&claim.ControllerEpoch, &claim.LastOperationID, &claim.LastOperationDigest,
+		&claim.Version, &claim.CreatedAt, &claim.UpdatedAt,
+	)
+	if errors.Is(err, sql.ErrNoRows) {
+		return store.BranchClaim{}, store.ErrNotFound
+	}
+	if err != nil {
+		return store.BranchClaim{}, fmt.Errorf("get branch claim: %w", err)
+	}
+	return claim, nil
+}
diff --git a/internal/store/sqlite/coexistence_migrations.go b/internal/store/sqlite/coexistence_migrations.go
new file mode 100644
index 000000000..3d1cf96d6
--- /dev/null
+++ b/internal/store/sqlite/coexistence_migrations.go
@@ -0,0 +1,171 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package sqlite
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+// migrateAgentExecution creates the immutable encrypted execution snapshots,
+// Session protocol/runtime lineage, and durable harness v1 attempt aggregates.
+// All statements are idempotent and run inside one transaction.
+func migrateAgentExecution(db *sql.DB) error {
+	statements := []string{
+		`CREATE TABLE IF NOT EXISTS agent_execution_snapshots (
+			task_uid        TEXT NOT NULL,
+			digest          TEXT NOT NULL,
+			schema_version  INTEGER NOT NULL CHECK(schema_version > 0),
+			nonce           BLOB NOT NULL,
+			ciphertext      BLOB NOT NULL,
+			created_at      TIMESTAMP NOT NULL,
+			PRIMARY KEY (task_uid, digest)
+		)`,
+		`CREATE INDEX IF NOT EXISTS idx_agent_execution_snapshots_task
+			ON agent_execution_snapshots(task_uid, created_at ASC)`,
+
+		`CREATE TABLE IF NOT EXISTS session_lineages (
+			namespace          TEXT NOT NULL,
+			session_name       TEXT NOT NULL,
+			namespace_uid      TEXT NOT NULL,
+			session_uid        TEXT NOT NULL,
+			contract_version   TEXT NOT NULL CHECK(contract_version IN ('orka.harness.v1','orka.harness.v2')),
+			lineage_generation INTEGER NOT NULL CHECK(lineage_generation > 0),
+			runtime_identity   TEXT NOT NULL,
+			config_digest      TEXT NOT NULL DEFAULT '',
+			version            INTEGER NOT NULL CHECK(version > 0),
+			created_at         TIMESTAMP NOT NULL,
+			updated_at         TIMESTAMP NOT NULL,
+			PRIMARY KEY (namespace, session_name),
+			UNIQUE (session_uid)
+		)`,
+		`CREATE TABLE IF NOT EXISTS harness_v1_attempts (
+			id                           TEXT PRIMARY KEY,
+			namespace                    TEXT NOT NULL,
+			task_name                    TEXT NOT NULL DEFAULT '',
+			task_uid                     TEXT NOT NULL,
+			attempt                      INTEGER NOT NULL CHECK(attempt > 0),
+			binding_digest               TEXT NOT NULL,
+			snapshot_digest              TEXT NOT NULL,
+			request_digest               TEXT NOT NULL,
+			turn_id                      TEXT NOT NULL,
+			runtime_session_id           TEXT NOT NULL DEFAULT '',
+			correlation_id               TEXT NOT NULL DEFAULT '',
+			backend                      TEXT NOT NULL DEFAULT '',
+			backend_endpoint             TEXT NOT NULL DEFAULT '',
+			auth_secret_namespace        TEXT NOT NULL DEFAULT '',
+			auth_secret_name             TEXT NOT NULL DEFAULT '',
+			auth_secret_key              TEXT NOT NULL DEFAULT '',
+			auth_secret_uid              TEXT NOT NULL DEFAULT '',
+			auth_secret_resource_version TEXT NOT NULL DEFAULT '',
+			state                        TEXT NOT NULL CHECK(state IN (
+				'Prepared','Submitting','Rejected','SubmittedUnknown','Accepted','Running',
+				'CancelRequested','Settling','Succeeded','Failed','Cancelled','OutcomeUnknown')),
+			last_event_seq               INTEGER NOT NULL DEFAULT 0,
+			cancel_requested_at          TIMESTAMP,
+			terminal_receipt_digest      TEXT NOT NULL DEFAULT '',
+			terminal_reason              TEXT NOT NULL DEFAULT '',
+			duplicate_safe               BOOLEAN NOT NULL DEFAULT FALSE,
+			retry_class                  TEXT NOT NULL CHECK(retry_class IN ('none','duplicate-safe')),
+			controller_epoch_name        TEXT NOT NULL DEFAULT '',
+			controller_epoch             INTEGER NOT NULL DEFAULT 0,
+			last_operation_id            TEXT NOT NULL DEFAULT '',
+			last_operation_digest        TEXT NOT NULL DEFAULT '',
+			version                      INTEGER NOT NULL CHECK(version > 0),
+			created_at                   TIMESTAMP NOT NULL,
+			updated_at                   TIMESTAMP NOT NULL,
+			UNIQUE (namespace, task_uid, attempt)
+		)`,
+		`CREATE INDEX IF NOT EXISTS idx_harness_v1_attempts_task
+			ON harness_v1_attempts(namespace, task_uid, attempt ASC)`,
+		`CREATE INDEX IF NOT EXISTS idx_harness_v1_attempts_active
+			ON harness_v1_attempts(state, updated_at ASC)
+			WHERE state NOT IN ('Rejected','Succeeded','Failed','Cancelled','OutcomeUnknown')`,
+	}
+
+	tx, err := db.Begin()
+	if err != nil {
+		return fmt.Errorf("begin coexistence migration: %w", err)
+	}
+	defer func() { _ = tx.Rollback() }()
+	for _, statement := range statements {
+		if _, err := tx.Exec(statement); err != nil {
+			return fmt.Errorf("agent execution migration failed: %w", err)
+		}
+	}
+	if err := migrateSessionLineagesWithoutProvenance(tx); err != nil {
+		return fmt.Errorf("agent execution migration failed: %w", err)
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("commit agent execution migration: %w", err)
+	}
+	return nil
+}
+
+func migrateSessionLineagesWithoutProvenance(tx *sql.Tx) error {
+	columns, err := tx.Query(`PRAGMA table_info(session_lineages)`)
+	if err != nil {
+		return fmt.Errorf("inspect session lineage schema: %w", err)
+	}
+	hasProvenance := false
+	for columns.Next() {
+		var cid, notNull, primaryKey int
+		var name, columnType string
+		var defaultValue any
+		if err := columns.Scan(&cid, &name, &columnType, &notNull, &defaultValue, &primaryKey); err != nil {
+			_ = columns.Close()
+			return fmt.Errorf("scan session lineage schema: %w", err)
+		}
+		hasProvenance = hasProvenance || name == "provenance"
+	}
+	if err := columns.Err(); err != nil {
+		_ = columns.Close()
+		return fmt.Errorf("inspect session lineage schema: %w", err)
+	}
+	if err := columns.Close(); err != nil {
+		return fmt.Errorf("close session lineage schema: %w", err)
+	}
+	if !hasProvenance {
+		return nil
+	}
+
+	if _, err := tx.Exec(`DROP TABLE IF EXISTS session_lineages_static_mode`); err != nil {
+		return fmt.Errorf("drop stale static session lineage migration table: %w", err)
+	}
+	if _, err := tx.Exec(`CREATE TABLE session_lineages_static_mode (
+		namespace          TEXT NOT NULL,
+		session_name       TEXT NOT NULL,
+		namespace_uid      TEXT NOT NULL,
+		session_uid        TEXT NOT NULL,
+		contract_version   TEXT NOT NULL CHECK(contract_version IN ('orka.harness.v1','orka.harness.v2')),
+		lineage_generation INTEGER NOT NULL CHECK(lineage_generation > 0),
+		runtime_identity   TEXT NOT NULL,
+		config_digest      TEXT NOT NULL DEFAULT '',
+		version            INTEGER NOT NULL CHECK(version > 0),
+		created_at         TIMESTAMP NOT NULL,
+		updated_at         TIMESTAMP NOT NULL,
+		PRIMARY KEY (namespace, session_name),
+		UNIQUE (session_uid)
+	)`); err != nil {
+		return fmt.Errorf("create static session lineage migration table: %w", err)
+	}
+	if _, err := tx.Exec(`INSERT INTO session_lineages_static_mode (
+		namespace, session_name, namespace_uid, session_uid, contract_version,
+		lineage_generation, runtime_identity, config_digest, version, created_at, updated_at
+	) SELECT namespace, session_name, namespace_uid, session_uid, contract_version,
+		lineage_generation, runtime_identity, config_digest, version, created_at, updated_at
+		FROM session_lineages`); err != nil {
+		return fmt.Errorf("copy static session lineages: %w", err)
+	}
+	if _, err := tx.Exec(`DROP TABLE session_lineages`); err != nil {
+		return fmt.Errorf("drop legacy session lineage table: %w", err)
+	}
+	if _, err := tx.Exec(`ALTER TABLE session_lineages_static_mode RENAME TO session_lineages`); err != nil {
+		return fmt.Errorf("rename static session lineage table: %w", err)
+	}
+	return nil
+}
diff --git a/internal/store/sqlite/coexistence_store_test.go b/internal/store/sqlite/coexistence_store_test.go
new file mode 100644
index 000000000..e9b9fcac4
--- /dev/null
+++ b/internal/store/sqlite/coexistence_store_test.go
@@ -0,0 +1,774 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package sqlite
+
+import (
+	"bytes"
+	"context"
+	"database/sql"
+	"errors"
+	"path/filepath"
+	"sort"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+func TestAgentExecutionMigrationRemovesLegacySessionLineageProvenance(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "legacy-lineage.db")
+	db, err := sql.Open("sqlite", dbPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	if _, err := db.Exec(`CREATE TABLE session_lineages (
+		namespace TEXT NOT NULL, session_name TEXT NOT NULL, namespace_uid TEXT NOT NULL,
+		session_uid TEXT NOT NULL, contract_version TEXT NOT NULL,
+		lineage_generation INTEGER NOT NULL, runtime_identity TEXT NOT NULL,
+		config_digest TEXT NOT NULL, provenance TEXT NOT NULL, version INTEGER NOT NULL,
+		created_at TIMESTAMP NOT NULL, updated_at TIMESTAMP NOT NULL,
+		PRIMARY KEY(namespace, session_name), UNIQUE(session_uid)
+	)`); err != nil {
+		t.Fatal(err)
+	}
+	now := time.Date(2026, 8, 7, 9, 0, 0, 0, time.UTC)
+	digest := store.CanonicalAgentExecutionSnapshotDigest([]byte("legacy-lineage"))
+	if _, err := db.Exec(`INSERT INTO session_lineages VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		"tenant", "chat", "namespace-uid", "session-uid", "orka.harness.v2", 1,
+		"codex", digest, "legacy-adopted", 1, now, now); err != nil {
+		t.Fatal(err)
+	}
+	if err := migrateAgentExecution(db); err != nil {
+		t.Fatalf("migrateAgentExecution: %v", err)
+	}
+	if sqliteTableHasColumn(t, db, "session_lineages", "provenance") {
+		t.Fatal("legacy provenance column remains after static-mode migration")
+	}
+	var gotUID, gotDigest string
+	if err := db.QueryRow(`SELECT session_uid, config_digest FROM session_lineages
+		WHERE namespace = ? AND session_name = ?`, "tenant", "chat").Scan(&gotUID, &gotDigest); err != nil {
+		t.Fatal(err)
+	}
+	if gotUID != "session-uid" || gotDigest != digest {
+		t.Fatalf("migrated lineage = (%q, %q), want preserved identity", gotUID, gotDigest)
+	}
+}
+
+var (
+	_ store.AgentExecutionSnapshotStore          = (*Store)(nil)
+	_ store.AgentExecutionSnapshotLifecycleStore = (*Store)(nil)
+	_ store.SessionLineageStore                  = (*Store)(nil)
+	_ store.HarnessV1AttemptStore                = (*Store)(nil)
+)
+
+func newCoexistenceTestStore(t *testing.T) *Store {
+	t.Helper()
+	dbPath := filepath.Join(t.TempDir(), "coexistence.db")
+	db, err := NewDB(dbPath)
+	if err != nil {
+		t.Fatalf("NewDB: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	return NewStore(db, dbPath)
+}
+
+func testSnapshotCipher(t *testing.T) *AgentExecutionSnapshotCipher {
+	t.Helper()
+	cipher, err := NewAgentExecutionSnapshotCipher(bytes.Repeat([]byte{0x42}, AgentExecutionSnapshotKeyBytes))
+	if err != nil {
+		t.Fatalf("NewAgentExecutionSnapshotCipher: %v", err)
+	}
+	return cipher
+}
+
+func persistLifecycleSnapshot(
+	t *testing.T,
+	ctx context.Context,
+	s *Store,
+	taskUID string,
+	body []byte,
+	createdAt time.Time,
+) store.AgentExecutionSnapshotKey {
+	t.Helper()
+	key := store.AgentExecutionSnapshotKey{
+		TaskUID: taskUID,
+		Digest:  store.CanonicalAgentExecutionSnapshotDigest(body),
+	}
+	if err := s.PersistAgentExecutionSnapshot(ctx, store.AgentExecutionSnapshot{
+		TaskUID:       key.TaskUID,
+		Digest:        key.Digest,
+		SchemaVersion: store.AgentExecutionSnapshotSchemaVersion,
+		Body:          body,
+		CreatedAt:     createdAt,
+	}); err != nil {
+		t.Fatalf("persist lifecycle snapshot %s: %v", key.ID(), err)
+	}
+	return key
+}
+
+func TestAgentExecutionSnapshotFailsClosedWithoutCipher(t *testing.T) {
+	ctx := context.Background()
+	s := newCoexistenceTestStore(t)
+	body := []byte(`{"prompt":"resolved"}`)
+	snapshot := store.AgentExecutionSnapshot{
+		TaskUID:       "task-uid-1",
+		Digest:        store.CanonicalAgentExecutionSnapshotDigest(body),
+		SchemaVersion: store.AgentExecutionSnapshotSchemaVersion,
+		Body:          body,
+	}
+	if err := s.PersistAgentExecutionSnapshot(ctx, snapshot); err == nil {
+		t.Fatal("persist without a cipher must fail closed")
+	}
+	if _, err := s.GetAgentExecutionSnapshot(ctx, store.AgentExecutionSnapshotKey{TaskUID: "task-uid-1", Digest: snapshot.Digest}); err == nil {
+		t.Fatal("get without a cipher must fail closed")
+	}
+}
+
+func TestAgentExecutionSnapshotRoundTripEncryptedAtRest(t *testing.T) {
+	ctx := context.Background()
+	s := newCoexistenceTestStore(t)
+	if err := s.SetAgentExecutionSnapshotCipher(testSnapshotCipher(t)); err != nil {
+		t.Fatal(err)
+	}
+
+	body := []byte(`{"prompt":"SENSITIVE-RESOLVED-PROMPT","model":"provider/model"}`)
+	snapshot := store.AgentExecutionSnapshot{
+		TaskUID:       "task-uid-1",
+		Digest:        store.CanonicalAgentExecutionSnapshotDigest(body),
+		SchemaVersion: store.AgentExecutionSnapshotSchemaVersion,
+		Body:          body,
+	}
+	if err := s.PersistAgentExecutionSnapshot(ctx, snapshot); err != nil {
+		t.Fatalf("persist snapshot: %v", err)
+	}
+	// Idempotent identical persist.
+	if err := s.PersistAgentExecutionSnapshot(ctx, snapshot); err != nil {
+		t.Fatalf("idempotent persist: %v", err)
+	}
+	// Same key with different content is rejected.
+	different := snapshot
+	different.SchemaVersion = snapshot.SchemaVersion + 1
+	if err := s.PersistAgentExecutionSnapshot(ctx, different); !errors.Is(err, store.ErrDuplicateMismatch) {
+		t.Fatalf("expected ErrDuplicateMismatch, got %v", err)
+	}
+
+	got, err := s.GetAgentExecutionSnapshot(ctx, store.AgentExecutionSnapshotKey{TaskUID: "task-uid-1", Digest: snapshot.Digest})
+	if err != nil {
+		t.Fatalf("get snapshot: %v", err)
+	}
+	if !bytes.Equal(got.Body, body) || got.SchemaVersion != snapshot.SchemaVersion {
+		t.Fatalf("snapshot round trip mismatch: %+v", got)
+	}
+
+	// The stored bytes must not contain the plaintext.
+	var ciphertext []byte
+	if err := s.db.QueryRow(`SELECT ciphertext FROM agent_execution_snapshots WHERE task_uid = ?`, "task-uid-1").Scan(&ciphertext); err != nil {
+		t.Fatalf("read raw ciphertext: %v", err)
+	}
+	if bytes.Contains(ciphertext, []byte("SENSITIVE-RESOLVED-PROMPT")) {
+		t.Fatal("snapshot body is stored in plaintext")
+	}
+
+	// Digest mismatch on persist is rejected.
+	bad := snapshot
+	bad.Digest = store.CanonicalAgentExecutionSnapshotDigest([]byte("other"))
+	if err := s.PersistAgentExecutionSnapshot(ctx, bad); err == nil {
+		t.Fatal("digest/body mismatch must be rejected")
+	}
+
+	keys, err := s.ListAgentExecutionSnapshotKeys(ctx, "task-uid-1")
+	if err != nil || len(keys) != 1 || keys[0].Digest != snapshot.Digest {
+		t.Fatalf("list snapshot keys = %v, %v", keys, err)
+	}
+	if err := s.DeleteAgentExecutionSnapshots(ctx, "task-uid-1"); err != nil {
+		t.Fatalf("delete snapshots: %v", err)
+	}
+	if _, err := s.GetAgentExecutionSnapshot(ctx, store.AgentExecutionSnapshotKey{TaskUID: "task-uid-1", Digest: snapshot.Digest}); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("expected ErrNotFound after delete, got %v", err)
+	}
+}
+
+func TestAgentExecutionSnapshotCipherActivationRejectsRotationWithRetainedSnapshots(t *testing.T) {
+	ctx := context.Background()
+	s := newCoexistenceTestStore(t)
+	previousCipher := testSnapshotCipher(t)
+	if err := s.SetAgentExecutionSnapshotCipher(previousCipher); err != nil {
+		t.Fatal(err)
+	}
+	body := []byte(`{"prompt":"retained"}`)
+	snapshot := store.AgentExecutionSnapshot{
+		TaskUID:       "task-uid-rotation",
+		Digest:        store.CanonicalAgentExecutionSnapshotDigest(body),
+		SchemaVersion: store.AgentExecutionSnapshotSchemaVersion,
+		Body:          body,
+	}
+	if err := s.PersistAgentExecutionSnapshot(ctx, snapshot); err != nil {
+		t.Fatal(err)
+	}
+
+	rotatedCipher, err := NewAgentExecutionSnapshotCipher(bytes.Repeat([]byte{0x43}, AgentExecutionSnapshotKeyBytes))
+	if err != nil {
+		t.Fatal(err)
+	}
+	restarted := NewStore(s.db, "restart-with-rotated-key")
+	if err := restarted.SetAgentExecutionSnapshotCipher(rotatedCipher); err == nil || !strings.Contains(err.Error(), "cannot authenticate retained snapshot") {
+		t.Fatalf("rotated key activation error = %v", err)
+	}
+	if err := restarted.PersistAgentExecutionSnapshot(ctx, snapshot); !errors.Is(err, errSnapshotCipherRequired) {
+		t.Fatalf("failed key activation must leave snapshot persistence closed, got %v", err)
+	}
+
+	restartedWithPreviousKey := NewStore(s.db, "restart-with-previous-key")
+	if err := restartedWithPreviousKey.SetAgentExecutionSnapshotCipher(previousCipher); err != nil {
+		t.Fatalf("activate previous key after restart: %v", err)
+	}
+	if _, err := restartedWithPreviousKey.GetAgentExecutionSnapshot(ctx, store.AgentExecutionSnapshotKey{
+		TaskUID: snapshot.TaskUID,
+		Digest:  snapshot.Digest,
+	}); err != nil {
+		t.Fatalf("read retained snapshot with previous key: %v", err)
+	}
+
+	if err := s.DeleteAgentExecutionSnapshots(ctx, snapshot.TaskUID); err != nil {
+		t.Fatal(err)
+	}
+	restartedAfterRetention := NewStore(s.db, "restart-after-retention")
+	if err := restartedAfterRetention.SetAgentExecutionSnapshotCipher(rotatedCipher); err != nil {
+		t.Fatalf("activate rotated key after retained snapshots are removed: %v", err)
+	}
+}
+
+func TestAgentExecutionSnapshotLifecycleMetadataOrderingAndStrictCutoff(t *testing.T) {
+	ctx := context.Background()
+	s := newCoexistenceTestStore(t)
+	if err := s.SetAgentExecutionSnapshotCipher(testSnapshotCipher(t)); err != nil {
+		t.Fatal(err)
+	}
+
+	base := time.Date(2026, 8, 6, 8, 0, 0, 0, time.UTC)
+	early := persistLifecycleSnapshot(t, ctx, s, "task-z", []byte(`{"snapshot":"early"}`), base)
+	tiedAt := base.Add(time.Minute)
+	tied := []store.AgentExecutionSnapshotKey{
+		persistLifecycleSnapshot(t, ctx, s, "task-b", []byte(`{"snapshot":"task-b"}`), tiedAt),
+		persistLifecycleSnapshot(t, ctx, s, "task-a", []byte(`{"snapshot":"task-a-1"}`), tiedAt),
+		persistLifecycleSnapshot(t, ctx, s, "task-a", []byte(`{"snapshot":"task-a-2"}`), tiedAt),
+	}
+	sort.Slice(tied, func(i, j int) bool {
+		if tied[i].TaskUID != tied[j].TaskUID {
+			return tied[i].TaskUID < tied[j].TaskUID
+		}
+		return tied[i].Digest < tied[j].Digest
+	})
+	cutoff := base.Add(2 * time.Minute)
+	_ = persistLifecycleSnapshot(t, ctx, s, "task-boundary", []byte(`{"snapshot":"boundary"}`), cutoff)
+	_ = persistLifecycleSnapshot(t, ctx, s, "task-late", []byte(`{"snapshot":"late"}`), cutoff.Add(time.Nanosecond))
+
+	metadata, err := s.ListAgentExecutionSnapshotMetadataBefore(ctx, cutoff)
+	if err != nil {
+		t.Fatalf("ListAgentExecutionSnapshotMetadataBefore: %v", err)
+	}
+	wantKeys := append([]store.AgentExecutionSnapshotKey{early}, tied...)
+	if len(metadata) != len(wantKeys) {
+		t.Fatalf("metadata length = %d, want %d: %#v", len(metadata), len(wantKeys), metadata)
+	}
+	for index, wantKey := range wantKeys {
+		if metadata[index].Key != wantKey {
+			t.Fatalf("metadata[%d].Key = %#v, want %#v", index, metadata[index].Key, wantKey)
+		}
+		wantCreatedAt := tiedAt
+		if index == 0 {
+			wantCreatedAt = base
+		}
+		if !metadata[index].CreatedAt.Equal(wantCreatedAt) ||
+			metadata[index].SchemaVersion != store.AgentExecutionSnapshotSchemaVersion {
+			t.Fatalf("metadata[%d] = %#v, want createdAt=%s schemaVersion=%d",
+				index, metadata[index], wantCreatedAt, store.AgentExecutionSnapshotSchemaVersion)
+		}
+	}
+	if _, err := s.ListAgentExecutionSnapshotMetadataBefore(ctx, time.Time{}); err == nil {
+		t.Fatal("zero metadata cutoff must fail validation")
+	}
+}
+
+func TestAgentExecutionSnapshotLifecycleMetadataRejectsCorruptStoredIdentity(t *testing.T) {
+	ctx := context.Background()
+	s := newCoexistenceTestStore(t)
+	now := time.Date(2026, 8, 6, 9, 0, 0, 0, time.UTC)
+	if _, err := s.db.ExecContext(ctx, `INSERT INTO agent_execution_snapshots
+		(task_uid, digest, schema_version, nonce, ciphertext, created_at)
+		VALUES (?, ?, ?, ?, ?, ?)`,
+		"task-corrupt", "not-a-canonical-digest", 1, []byte{1}, []byte{2}, now); err != nil {
+		t.Fatalf("seed corrupt snapshot metadata: %v", err)
+	}
+
+	if _, err := s.ListAgentExecutionSnapshotMetadataBefore(ctx, now.Add(time.Minute)); err == nil ||
+		!strings.Contains(err.Error(), "snapshot digest") {
+		t.Fatalf("corrupt stored identity error = %v, want digest integrity failure", err)
+	}
+}
+
+func TestAgentExecutionSnapshotLifecycleReferenceCounts(t *testing.T) {
+	ctx := context.Background()
+	s := newCoexistenceTestStore(t)
+	if err := s.SetAgentExecutionSnapshotCipher(testSnapshotCipher(t)); err != nil {
+		t.Fatal(err)
+	}
+	now := time.Date(2026, 8, 6, 10, 0, 0, 0, time.UTC)
+	key := persistLifecycleSnapshot(t, ctx, s, "task-uid", []byte(`{"snapshot":"target"}`), now)
+	otherDigestKey := persistLifecycleSnapshot(t, ctx, s, key.TaskUID, []byte(`{"snapshot":"other"}`), now)
+	otherTaskKey := persistLifecycleSnapshot(t, ctx, s, "other-task-uid", []byte(`{"snapshot":"target"}`), now)
+	bindingDigest := store.CanonicalAgentExecutionSnapshotDigest([]byte("binding"))
+	requestDigest := store.CanonicalAgentExecutionSnapshotDigest([]byte("request"))
+
+	mustExec := func(statement string, args ...any) {
+		t.Helper()
+		if _, err := s.db.ExecContext(ctx, statement, args...); err != nil {
+			t.Fatalf("seed snapshot reference: %v", err)
+		}
+	}
+	seedHarnessAttempt := func(id, taskUID string, attempt int, snapshotDigest string) {
+		mustExec(`INSERT INTO harness_v1_attempts
+			(id, namespace, task_name, task_uid, attempt, binding_digest,
+			 snapshot_digest, request_digest, turn_id, state, retry_class,
+			 version, created_at, updated_at)
+			VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'Prepared', 'none', 1, ?, ?)`,
+			id, "ns", "task-"+id, taskUID, attempt, bindingDigest,
+			snapshotDigest, requestDigest, "turn-"+id, now, now)
+	}
+	seedPromptAttempt := func(id, taskUID string, attempt int, snapshotDigest string) {
+		mustExec(`INSERT INTO prompt_attempts
+			(id, namespace, task_uid, attempt, prompt_id, request_digest,
+			 binding_digest, snapshot_digest, execution_state, delivery_state,
+			 controller_epoch_name, controller_epoch, version, created_at, updated_at)
+			VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'Queued', 'NotRequested', 'epoch', 1, 1, ?, ?)`,
+			id, "ns", taskUID, attempt, "prompt-"+id, requestDigest,
+			bindingDigest, snapshotDigest, now, now)
+	}
+	seedLineage := func(id, configDigest string) {
+		mustExec(`INSERT INTO session_lineages
+			(namespace, session_name, namespace_uid, session_uid, contract_version,
+			 lineage_generation, runtime_identity, config_digest, version, created_at, updated_at)
+			VALUES (?, ?, ?, ?, 'orka.harness.v2', 1, 'codex', ?, 1, ?, ?)`,
+			"ns", "session-"+id, "namespace-uid", "session-uid-"+id,
+			configDigest, now, now)
+	}
+	seedSessionTurn := func(id, taskUID string, attempt int) {
+		sessionName := "turn-session-" + id
+		mustExec(`INSERT INTO sessions(namespace, name, session_type) VALUES (?, ?, 'task')`, "ns", sessionName)
+		mustExec(`INSERT INTO session_turns
+			(id, namespace, session_name, session_uid, lease_generation, task_uid,
+			 attempt, prompt_id, prompt_attempt_id, request_digest, user_prompt,
+			 state, controller_epoch_name, controller_epoch, version, created_at, updated_at)
+			VALUES (?, ?, ?, ?, 1, ?, ?, ?, ?, ?, 'prompt', 'Open', 'epoch', 1, 1, ?, ?)`,
+			"turn-"+id, "ns", sessionName, "turn-session-uid-"+id, taskUID, attempt,
+			"turn-prompt-"+id, "turn-attempt-"+id, requestDigest, now, now)
+	}
+
+	seedHarnessAttempt("harness-match-1", key.TaskUID, 1, key.Digest)
+	seedHarnessAttempt("harness-match-2", key.TaskUID, 2, key.Digest)
+	seedHarnessAttempt("harness-other-digest", key.TaskUID, 3, otherDigestKey.Digest)
+	seedHarnessAttempt("harness-other-task", otherTaskKey.TaskUID, 1, key.Digest)
+	seedPromptAttempt("prompt-match-1", key.TaskUID, 1, key.Digest)
+	seedPromptAttempt("prompt-match-2", key.TaskUID, 2, key.Digest)
+	seedPromptAttempt("prompt-other-digest", key.TaskUID, 3, otherDigestKey.Digest)
+	seedPromptAttempt("prompt-other-task", otherTaskKey.TaskUID, 1, key.Digest)
+	seedSessionTurn("match-1", key.TaskUID, 1)
+	seedSessionTurn("match-2", key.TaskUID, 2)
+	seedSessionTurn("other-task", otherTaskKey.TaskUID, 1)
+	// A lineage configuration digest is not an execution snapshot reference.
+	seedLineage("match-1", key.Digest)
+	seedLineage("match-2", key.Digest)
+	seedLineage("other", otherDigestKey.Digest)
+
+	counts, err := s.CountAgentExecutionSnapshotReferences(ctx, key)
+	if err != nil {
+		t.Fatalf("CountAgentExecutionSnapshotReferences: %v", err)
+	}
+	want := store.AgentExecutionSnapshotReferenceCounts{
+		HarnessV1Attempts: 2,
+		PromptAttempts:    2,
+		SessionTurns:      2,
+	}
+	if counts != want || counts.Total() != 6 {
+		t.Fatalf("reference counts = %#v (total %d), want %#v (total 6)", counts, counts.Total(), want)
+	}
+
+	otherTaskCounts, err := s.CountAgentExecutionSnapshotReferences(ctx, otherTaskKey)
+	if err != nil {
+		t.Fatalf("count other Task references: %v", err)
+	}
+	wantOtherTask := store.AgentExecutionSnapshotReferenceCounts{
+		HarnessV1Attempts: 1,
+		PromptAttempts:    1,
+		SessionTurns:      1,
+	}
+	if otherTaskCounts != wantOtherTask {
+		t.Fatalf("other Task reference counts = %#v, want %#v", otherTaskCounts, wantOtherTask)
+	}
+	if _, err := s.CountAgentExecutionSnapshotReferences(ctx, store.AgentExecutionSnapshotKey{}); err == nil {
+		t.Fatal("incomplete snapshot key must fail reference-count validation")
+	}
+}
+
+func TestAgentExecutionSnapshotLifecycleDeletesOnlyExactKey(t *testing.T) {
+	ctx := context.Background()
+	s := newCoexistenceTestStore(t)
+	if err := s.SetAgentExecutionSnapshotCipher(testSnapshotCipher(t)); err != nil {
+		t.Fatal(err)
+	}
+	now := time.Date(2026, 8, 6, 11, 0, 0, 0, time.UTC)
+	targetBody := []byte(`{"snapshot":"target"}`)
+	target := persistLifecycleSnapshot(t, ctx, s, "task-uid", targetBody, now)
+	sibling := persistLifecycleSnapshot(t, ctx, s, target.TaskUID, []byte(`{"snapshot":"sibling"}`), now)
+	otherTask := persistLifecycleSnapshot(t, ctx, s, "other-task-uid", targetBody, now)
+
+	if err := s.DeleteAgentExecutionSnapshot(ctx, target); err != nil {
+		t.Fatalf("DeleteAgentExecutionSnapshot: %v", err)
+	}
+	if _, err := s.GetAgentExecutionSnapshot(ctx, target); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("deleted target error = %v, want ErrNotFound", err)
+	}
+	for _, retained := range []store.AgentExecutionSnapshotKey{sibling, otherTask} {
+		if _, err := s.GetAgentExecutionSnapshot(ctx, retained); err != nil {
+			t.Fatalf("retained snapshot %s: %v", retained.ID(), err)
+		}
+	}
+	if err := s.DeleteAgentExecutionSnapshot(ctx, target); err != nil {
+		t.Fatalf("idempotent exact delete: %v", err)
+	}
+	if err := s.DeleteAgentExecutionSnapshot(ctx, store.AgentExecutionSnapshotKey{}); err == nil {
+		t.Fatal("incomplete exact-delete key must fail validation")
+	}
+}
+
+func TestSessionLineageProjectionIsIdempotentAndRejectsDivergence(t *testing.T) {
+	ctx := context.Background()
+	s := newCoexistenceTestStore(t)
+
+	now := time.Date(2026, 8, 5, 9, 0, 0, 0, time.UTC)
+	lineage := store.SessionLineage{
+		Namespace:         "ns",
+		SessionName:       "chat",
+		NamespaceUID:      "ns-uid",
+		SessionUID:        "session-uid",
+		ContractVersion:   "orka.harness.v2",
+		LineageGeneration: 1,
+		RuntimeIdentity:   "codex",
+		ConfigDigest:      store.CanonicalAgentExecutionSnapshotDigest([]byte("cfg")),
+		Version:           1,
+		CreatedAt:         now,
+		UpdatedAt:         now,
+	}
+
+	if _, err := s.GetSessionLineage(ctx, "ns", "chat"); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("expected ErrNotFound before projection, got %v", err)
+	}
+
+	projected, err := s.ProjectSessionLineage(ctx, lineage)
+	if err != nil {
+		t.Fatalf("project lineage: %v", err)
+	}
+	if projected.LineageGeneration != 1 || projected.Version != 1 {
+		t.Fatalf("unexpected projected lineage: %+v", projected)
+	}
+
+	// An identical authoritative record projects idempotently.
+	again, err := s.ProjectSessionLineage(ctx, lineage)
+	if err != nil {
+		t.Fatalf("verify projection: %v", err)
+	}
+	if again.SessionUID != lineage.SessionUID {
+		t.Fatalf("verified lineage mismatch: %+v", again)
+	}
+
+	// Cross-protocol continuation is rejected.
+	crossProtocol := lineage
+	crossProtocol.ContractVersion = "orka.harness.v1"
+	crossProtocol.RuntimeIdentity = "opencode"
+	if _, err := s.ProjectSessionLineage(ctx, crossProtocol); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("expected ErrConflict for cross-protocol projection, got %v", err)
+	}
+
+	// A recreated same-name Session (new UID) never attaches to old state.
+	recreated := lineage
+	recreated.SessionUID = "different-session-uid"
+	if _, err := s.ProjectSessionLineage(ctx, recreated); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("expected ErrConflict for recreated session UID, got %v", err)
+	}
+
+	// A recreated same-name namespace never attaches to old state.
+	recreatedNamespace := lineage
+	recreatedNamespace.NamespaceUID = "different-ns-uid"
+	if _, err := s.ProjectSessionLineage(ctx, recreatedNamespace); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("expected ErrConflict for recreated namespace UID, got %v", err)
+	}
+
+	changedConfig := lineage
+	changedConfig.ConfigDigest = store.CanonicalAgentExecutionSnapshotDigest([]byte("different-cfg"))
+	if _, err := s.ProjectSessionLineage(ctx, changedConfig); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("expected ErrConflict for changed configuration, got %v", err)
+	}
+
+	if err := s.DeleteSessionLineage(ctx, "ns", "chat"); err != nil {
+		t.Fatalf("delete lineage: %v", err)
+	}
+	if _, err := s.GetSessionLineage(ctx, "ns", "chat"); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("expected ErrNotFound after delete, got %v", err)
+	}
+}
+
+func testHarnessV1Attempt() *store.HarnessV1Attempt {
+	digest := store.CanonicalAgentExecutionSnapshotDigest
+	return &store.HarnessV1Attempt{
+		Namespace:                 "ns",
+		TaskName:                  "task-1",
+		TaskUID:                   "task-uid-1",
+		Attempt:                   1,
+		BindingDigest:             digest([]byte("binding")),
+		SnapshotDigest:            digest([]byte("snapshot")),
+		RequestDigest:             digest([]byte("request")),
+		TurnID:                    "turn-1",
+		Backend:                   "harness-wrapper",
+		AuthSecretNamespace:       "ns",
+		AuthSecretName:            "harness-auth",
+		AuthSecretKey:             "token",
+		AuthSecretUID:             "secret-uid-1",
+		AuthSecretResourceVersion: "17",
+		State:                     store.HarnessV1AttemptPrepared,
+		RetryClass:                store.HarnessV1RetryClassNone,
+	}
+}
+
+func harnessV1Transition(
+	key store.HarnessV1AttemptKey,
+	fence store.ControllerEpochFence,
+	version int64,
+	from, to store.HarnessV1AttemptState,
+	op string,
+) store.HarnessV1AttemptTransition {
+	return store.HarnessV1AttemptTransition{
+		Key:             key,
+		ExpectedVersion: version,
+		ExpectedState:   from,
+		TargetState:     to,
+		OperationID:     op,
+		OperationDigest: store.CanonicalAgentExecutionSnapshotDigest([]byte(op)),
+		Fence:           fence,
+	}
+}
+
+func TestHarnessV1AttemptLifecycleAndCAS(t *testing.T) {
+	ctx := context.Background()
+	s := newCoexistenceTestStore(t)
+	fence := seedControlEpoch(t, s)
+	attempt := testHarnessV1Attempt()
+	key := store.HarnessV1AttemptKey{Namespace: attempt.Namespace, TaskUID: attempt.TaskUID, Attempt: attempt.Attempt}
+
+	if err := s.CreateHarnessV1Attempt(ctx, attempt, fence); err != nil {
+		t.Fatalf("create attempt: %v", err)
+	}
+	if err := s.CreateHarnessV1Attempt(ctx, attempt, fence); err != nil {
+		t.Fatalf("idempotent create: %v", err)
+	}
+	different := *attempt
+	different.RequestDigest = store.CanonicalAgentExecutionSnapshotDigest([]byte("other-request"))
+	if err := s.CreateHarnessV1Attempt(ctx, &different, fence); !errors.Is(err, store.ErrDuplicateMismatch) {
+		t.Fatalf("expected ErrDuplicateMismatch, got %v", err)
+	}
+
+	// Persist Submitting before writing StartTurn.
+	current, err := s.TransitionHarnessV1Attempt(ctx, harnessV1Transition(key, fence, 1, store.HarnessV1AttemptPrepared, store.HarnessV1AttemptSubmitting, "submit"))
+	if err != nil {
+		t.Fatalf("Prepared->Submitting: %v", err)
+	}
+	if err := s.CreateHarnessV1Attempt(ctx, attempt, fence); err != nil {
+		t.Fatalf("idempotent create after transition: %v", err)
+	}
+	// Replay of the same operation is idempotent.
+	replay, err := s.TransitionHarnessV1Attempt(ctx, harnessV1Transition(key, fence, 1, store.HarnessV1AttemptPrepared, store.HarnessV1AttemptSubmitting, "submit"))
+	if err != nil || replay.Version != current.Version {
+		t.Fatalf("replay transition = %+v, %v", replay, err)
+	}
+	// Same operation ID with a different digest is rejected.
+	conflicting := harnessV1Transition(key, fence, 1, store.HarnessV1AttemptPrepared, store.HarnessV1AttemptSubmitting, "submit")
+	conflicting.OperationDigest = store.CanonicalAgentExecutionSnapshotDigest([]byte("tampered"))
+	if _, err := s.TransitionHarnessV1Attempt(ctx, conflicting); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("expected ErrConflict for tampered replay, got %v", err)
+	}
+
+	// Stale version CAS fails.
+	if _, err := s.TransitionHarnessV1Attempt(ctx, harnessV1Transition(key, fence, 1, store.HarnessV1AttemptSubmitting, store.HarnessV1AttemptAccepted, "accept-stale")); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("expected ErrConflict for stale version, got %v", err)
+	}
+
+	// Illegal transition fails.
+	if _, err := s.TransitionHarnessV1Attempt(ctx, harnessV1Transition(key, fence, current.Version, store.HarnessV1AttemptSubmitting, store.HarnessV1AttemptSucceeded, "skip")); err == nil {
+		t.Fatal("Submitting->Succeeded must be rejected")
+	}
+
+	sessionID := "runtime-session-1"
+	acceptTransition := harnessV1Transition(key, fence, current.Version, store.HarnessV1AttemptSubmitting, store.HarnessV1AttemptAccepted, "accept")
+	acceptTransition.Updates.RuntimeSessionID = &sessionID
+	current, err = s.TransitionHarnessV1Attempt(ctx, acceptTransition)
+	if err != nil || current.RuntimeSessionID != sessionID {
+		t.Fatalf("Submitting->Accepted = %+v, %v", current, err)
+	}
+
+	active, err := s.ListActiveHarnessV1Attempts(ctx)
+	if err != nil || len(active) != 1 {
+		t.Fatalf("active attempts = %v, %v", active, err)
+	}
+
+	// OutcomeUnknown requires a terminal reason.
+	if _, err := s.TransitionHarnessV1Attempt(ctx, harnessV1Transition(key, fence, current.Version, store.HarnessV1AttemptAccepted, store.HarnessV1AttemptOutcomeUnknown, "unknown-no-reason")); err == nil {
+		t.Fatal("OutcomeUnknown without a reason must be rejected")
+	}
+
+	reason := "RuntimeLost"
+	unknownTransition := harnessV1Transition(key, fence, current.Version, store.HarnessV1AttemptAccepted, store.HarnessV1AttemptOutcomeUnknown, "unknown")
+	unknownTransition.Updates.TerminalReason = &reason
+	current, err = s.TransitionHarnessV1Attempt(ctx, unknownTransition)
+	if err != nil || current.State != store.HarnessV1AttemptOutcomeUnknown {
+		t.Fatalf("Accepted->OutcomeUnknown = %+v, %v", current, err)
+	}
+
+	// Terminal states admit no further transitions.
+	if _, err := s.TransitionHarnessV1Attempt(ctx, harnessV1Transition(key, fence, current.Version, store.HarnessV1AttemptOutcomeUnknown, store.HarnessV1AttemptSucceeded, "resurrect")); err == nil {
+		t.Fatal("OutcomeUnknown is terminal and must not transition")
+	}
+
+	active, err = s.ListActiveHarnessV1Attempts(ctx)
+	if err != nil || len(active) != 0 {
+		t.Fatalf("active attempts after terminal = %v, %v", active, err)
+	}
+
+	attempts, err := s.ListHarnessV1AttemptsByTask(ctx, "ns", "task-uid-1")
+	if err != nil || len(attempts) != 1 || !strings.Contains(string(attempts[0].State), "OutcomeUnknown") {
+		t.Fatalf("attempts by task = %v, %v", attempts, err)
+	}
+}
+
+func TestHarnessV1AttemptCreateRejectsEveryImmutableMismatch(t *testing.T) {
+	digest := store.CanonicalAgentExecutionSnapshotDigest
+	tests := []struct {
+		name   string
+		mutate func(*store.HarnessV1Attempt)
+	}{
+		{name: "task name", mutate: func(attempt *store.HarnessV1Attempt) { attempt.TaskName = "other-task" }},
+		{name: "binding digest", mutate: func(attempt *store.HarnessV1Attempt) { attempt.BindingDigest = digest([]byte("other-binding")) }},
+		{name: "snapshot digest", mutate: func(attempt *store.HarnessV1Attempt) { attempt.SnapshotDigest = digest([]byte("other-snapshot")) }},
+		{name: "request digest", mutate: func(attempt *store.HarnessV1Attempt) { attempt.RequestDigest = digest([]byte("other-request")) }},
+		{name: "turn ID", mutate: func(attempt *store.HarnessV1Attempt) { attempt.TurnID = "other-turn" }},
+		{name: "backend", mutate: func(attempt *store.HarnessV1Attempt) { attempt.Backend = "external-runtime" }},
+		{name: "auth namespace", mutate: func(attempt *store.HarnessV1Attempt) { attempt.AuthSecretNamespace = "other-ns" }},
+		{name: "auth name", mutate: func(attempt *store.HarnessV1Attempt) { attempt.AuthSecretName = "other-auth" }},
+		{name: "auth key", mutate: func(attempt *store.HarnessV1Attempt) { attempt.AuthSecretKey = "other-token" }},
+		{name: "auth UID", mutate: func(attempt *store.HarnessV1Attempt) { attempt.AuthSecretUID = "other-secret-uid" }},
+		{name: "auth resource version", mutate: func(attempt *store.HarnessV1Attempt) { attempt.AuthSecretResourceVersion = "18" }},
+		{name: "duplicate safety", mutate: func(attempt *store.HarnessV1Attempt) { attempt.DuplicateSafe = true }},
+		{name: "retry class", mutate: func(attempt *store.HarnessV1Attempt) { attempt.RetryClass = store.HarnessV1RetryClassDuplicateSafe }},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+			s := newCoexistenceTestStore(t)
+			fence := seedControlEpoch(t, s)
+			attempt := testHarnessV1Attempt()
+			if err := s.CreateHarnessV1Attempt(ctx, attempt, fence); err != nil {
+				t.Fatalf("create attempt: %v", err)
+			}
+			candidate := *attempt
+			tt.mutate(&candidate)
+			if err := s.CreateHarnessV1Attempt(ctx, &candidate, fence); !errors.Is(err, store.ErrDuplicateMismatch) {
+				t.Fatalf("create with mismatched %s = %v, want ErrDuplicateMismatch", tt.name, err)
+			}
+		})
+	}
+}
+
+func TestHarnessV1AttemptCreateAndTransitionRequireCurrentControllerEpoch(t *testing.T) {
+	ctx := context.Background()
+	s := newCoexistenceTestStore(t)
+	fence := seedControlEpoch(t, s)
+	attempt := testHarnessV1Attempt()
+	key := store.HarnessV1AttemptKey{Namespace: attempt.Namespace, TaskUID: attempt.TaskUID, Attempt: attempt.Attempt}
+
+	wrongHolder := fence
+	wrongHolder.HolderID = "controller-b"
+	if err := s.CreateHarnessV1Attempt(ctx, attempt, wrongHolder); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("create with wrong holder = %v, want ErrConflict", err)
+	}
+	if err := s.CreateHarnessV1Attempt(ctx, attempt, fence); err != nil {
+		t.Fatalf("create attempt: %v", err)
+	}
+
+	epoch, err := s.GetControllerEpoch(ctx, fence.Name)
+	if err != nil {
+		t.Fatalf("get controller epoch: %v", err)
+	}
+	advanced, err := s.CompareAndSwapControllerEpoch(ctx, store.ControllerEpochCAS{
+		Name:            epoch.Name,
+		ExpectedVersion: epoch.Version,
+		ExpectedEpoch:   epoch.Epoch,
+		NewEpoch:        epoch.Epoch + 1,
+		HolderID:        "controller-b",
+		RequestDigest:   controlTestDigest("harness-v1-epoch-2"),
+		UpdatedAt:       time.Date(2026, 8, 6, 12, 0, 0, 0, time.UTC),
+	})
+	if err != nil {
+		t.Fatalf("advance controller epoch: %v", err)
+	}
+	currentFence := store.ControllerEpochFence{Name: advanced.Name, Epoch: advanced.Epoch, HolderID: advanced.HolderID}
+
+	if err := s.CreateHarnessV1Attempt(ctx, attempt, fence); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("idempotent create with stale fence = %v, want ErrConflict", err)
+	}
+	transition := harnessV1Transition(key, fence, 1, store.HarnessV1AttemptPrepared, store.HarnessV1AttemptSubmitting, "stale-submit")
+	if _, err := s.TransitionHarnessV1Attempt(ctx, transition); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("transition with stale fence = %v, want ErrConflict", err)
+	}
+	transition = harnessV1Transition(key, currentFence, 1, store.HarnessV1AttemptPrepared, store.HarnessV1AttemptSubmitting, "current-submit")
+	if _, err := s.TransitionHarnessV1Attempt(ctx, transition); err != nil {
+		t.Fatalf("transition with current fence: %v", err)
+	}
+}
+
+func TestHarnessV1AttemptSurvivesRestart(t *testing.T) {
+	ctx := context.Background()
+	dbPath := filepath.Join(t.TempDir(), "coexistence-restart.db")
+	db, err := NewDB(dbPath)
+	if err != nil {
+		t.Fatalf("NewDB: %v", err)
+	}
+	s := NewStore(db, dbPath)
+	fence := seedControlEpoch(t, s)
+	attempt := testHarnessV1Attempt()
+	if err := s.CreateHarnessV1Attempt(ctx, attempt, fence); err != nil {
+		t.Fatalf("create attempt: %v", err)
+	}
+	key := store.HarnessV1AttemptKey{Namespace: attempt.Namespace, TaskUID: attempt.TaskUID, Attempt: attempt.Attempt}
+	if _, err := s.TransitionHarnessV1Attempt(ctx, harnessV1Transition(key, fence, 1, store.HarnessV1AttemptPrepared, store.HarnessV1AttemptSubmitting, "submit")); err != nil {
+		t.Fatalf("transition: %v", err)
+	}
+	if err := db.Close(); err != nil {
+		t.Fatalf("close db: %v", err)
+	}
+
+	reopened, err := NewDB(dbPath)
+	if err != nil {
+		t.Fatalf("reopen db: %v", err)
+	}
+	t.Cleanup(func() { _ = reopened.Close() })
+	restarted := NewStore(reopened, dbPath)
+	got, err := restarted.GetHarnessV1Attempt(ctx, key)
+	if err != nil || got.State != store.HarnessV1AttemptSubmitting || got.Version != 2 {
+		t.Fatalf("attempt after restart = %+v, %v", got, err)
+	}
+}
diff --git a/internal/store/sqlite/control_helpers.go b/internal/store/sqlite/control_helpers.go
new file mode 100644
index 000000000..3fbf17e28
--- /dev/null
+++ b/internal/store/sqlite/control_helpers.go
@@ -0,0 +1,152 @@
+package sqlite
+
+import (
+	"context"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"reflect"
+	"strings"
+	"time"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+const (
+	defaultOutboxClaimLimit = 50
+	maxOutboxClaimLimit     = 500
+)
+
+type controlQueryRower interface {
+	QueryRowContext(ctx context.Context, query string, args ...any) *sql.Row
+}
+
+func normalizeControllerEpochName(name string) (string, error) {
+	name = strings.TrimSpace(name)
+	if name == "" {
+		name = store.DefaultControllerEpochName
+	}
+	if err := store.ValidateControlIdentifier("controller epoch name", name); err != nil {
+		return "", err
+	}
+	if name != store.DefaultControllerEpochName {
+		return "", store.ValidationErrorf("first-release control store supports only controller epoch %q", store.DefaultControllerEpochName)
+	}
+	return name, nil
+}
+
+func normalizeEpochFence(fence store.ControllerEpochFence) (store.ControllerEpochFence, error) {
+	name, err := normalizeControllerEpochName(fence.Name)
+	if err != nil {
+		return store.ControllerEpochFence{}, err
+	}
+	fence.Name = name
+	fence.HolderID = strings.TrimSpace(fence.HolderID)
+	if err := store.ValidateControlIdentifier("controller epoch holder ID", fence.HolderID); err != nil {
+		return store.ControllerEpochFence{}, err
+	}
+	if fence.Epoch < 1 {
+		return store.ControllerEpochFence{}, store.ValidationErrorf("controller epoch must be at least 1")
+	}
+	return fence, nil
+}
+
+func requireControllerEpoch(ctx context.Context, q controlQueryRower, fence store.ControllerEpochFence) error {
+	fence, err := normalizeEpochFence(fence)
+	if err != nil {
+		return err
+	}
+	var epoch int64
+	var holder string
+	err = q.QueryRowContext(ctx,
+		`SELECT epoch, holder_id FROM controller_epochs WHERE name = ?`,
+		fence.Name,
+	).Scan(&epoch, &holder)
+	if errors.Is(err, sql.ErrNoRows) {
+		return fmt.Errorf("%w: controller epoch %q does not exist", store.ErrConflict, fence.Name)
+	}
+	if err != nil {
+		return err
+	}
+	if epoch != fence.Epoch || holder != fence.HolderID {
+		return fmt.Errorf("%w: controller epoch fence %s/%d/%s does not match current %d/%s", store.ErrConflict, fence.Name, fence.Epoch, fence.HolderID, epoch, holder)
+	}
+	return nil
+}
+
+func normalizeControlTime(value time.Time) time.Time {
+	if value.IsZero() {
+		return time.Now().UTC()
+	}
+	return value.UTC()
+}
+
+func normalizeOptionalControlTime(value *time.Time) *time.Time {
+	if value == nil {
+		return nil
+	}
+	normalized := value.UTC()
+	return &normalized
+}
+
+func marshalOptionalControlJSON(value any) ([]byte, error) {
+	if value == nil {
+		return nil, nil
+	}
+	reflected := reflect.ValueOf(value)
+	switch reflected.Kind() {
+	case reflect.Chan, reflect.Func, reflect.Interface, reflect.Map, reflect.Pointer, reflect.Slice:
+		if reflected.IsNil() {
+			return nil, nil
+		}
+	}
+	data, err := json.Marshal(value)
+	if err != nil {
+		return nil, err
+	}
+	return data, nil
+}
+
+func unmarshalOptionalControlJSON(data []byte, value any) error {
+	if len(data) == 0 {
+		return nil
+	}
+	return json.Unmarshal(data, value)
+}
+
+func controlJSONPresent(data []byte) bool {
+	trimmed := strings.TrimSpace(string(data))
+	return trimmed != "" && trimmed != "null"
+}
+
+func controlConflict(format string, args ...any) error {
+	return fmt.Errorf("%w: %s", store.ErrConflict, fmt.Sprintf(format, args...))
+}
+
+func rowsAffectedExactlyOne(result sql.Result, what string) error {
+	rows, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if rows != 1 {
+		return controlConflict("stale %s mutation", what)
+	}
+	return nil
+}
+
+func canonicalBytesDigest(value []byte) string {
+	sum := sha256.Sum256(value)
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
+
+func nullTimeValue(value *time.Time) any {
+	if value == nil {
+		return nil
+	}
+	return value.UTC()
+}
+
+var _ store.DurableControlStore = (*Store)(nil)
diff --git a/internal/store/sqlite/control_migrations.go b/internal/store/sqlite/control_migrations.go
new file mode 100644
index 000000000..3fef0afae
--- /dev/null
+++ b/internal/store/sqlite/control_migrations.go
@@ -0,0 +1,456 @@
+package sqlite
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+// migrateControlStore installs the durable ACP-core control-store foundation.
+// It is intentionally called from migrate after the legacy session/transcript
+// tables exist because session_controls has a preserving foreign key to them.
+func migrateControlStore(db *sql.DB) error {
+	statements := []string{
+		`CREATE TABLE IF NOT EXISTS controller_epochs (
+			name           TEXT PRIMARY KEY,
+			epoch          INTEGER NOT NULL CHECK(epoch > 0),
+			holder_id      TEXT NOT NULL,
+			request_digest TEXT NOT NULL,
+			version        INTEGER NOT NULL CHECK(version > 0),
+			acquired_at    TIMESTAMP NOT NULL,
+			updated_at     TIMESTAMP NOT NULL
+		)`,
+		`CREATE TABLE IF NOT EXISTS prompt_attempts (
+			id                       TEXT PRIMARY KEY,
+			namespace                TEXT NOT NULL,
+			task_uid                 TEXT NOT NULL,
+			attempt                  INTEGER NOT NULL CHECK(attempt > 0),
+			prompt_id                TEXT NOT NULL,
+			session_uid              TEXT NOT NULL DEFAULT '',
+			session_lease_generation INTEGER NOT NULL DEFAULT 0 CHECK(session_lease_generation >= 0),
+			runtime_instance_id      TEXT NOT NULL DEFAULT '',
+			request_digest           TEXT NOT NULL,
+			binding_digest           TEXT NOT NULL DEFAULT '',
+			snapshot_digest          TEXT NOT NULL DEFAULT '',
+			execution_state          TEXT NOT NULL CHECK(execution_state IN (
+				'Queued','Reserved','SessionStarting','Planned','Submitting','SubmittedUnknown',
+				'Accepted','Running','Settling','Succeeded','Failed','Cancelled','OutcomeUnknown'
+			)),
+			delivery_state           TEXT NOT NULL CHECK(delivery_state IN (
+				'NotRequested','Validating','Preparing','Prepared','Publishing','Verifying',
+				'VerifiedExact','DeliveredSuperseded','ReadValidated','NoChange','CancelledBeforePublish',
+				'ReadOnlyWorkspaceModified','DeliveryConflict','CredentialBlocked','PublicationOutcomeUnknown'
+			)),
+			terminal_reason          TEXT NOT NULL DEFAULT '',
+			outcome_marker           TEXT NOT NULL DEFAULT '',
+			controller_epoch_name    TEXT NOT NULL,
+			controller_epoch         INTEGER NOT NULL CHECK(controller_epoch > 0),
+			last_operation_id        TEXT NOT NULL DEFAULT '',
+			last_operation_digest    TEXT NOT NULL DEFAULT '',
+			version                  INTEGER NOT NULL CHECK(version > 0),
+			created_at               TIMESTAMP NOT NULL,
+			updated_at               TIMESTAMP NOT NULL,
+			UNIQUE(namespace, task_uid, attempt, prompt_id)
+		)`,
+		`CREATE INDEX IF NOT EXISTS idx_prompt_attempts_task
+			ON prompt_attempts(namespace, task_uid, attempt DESC, prompt_id)`,
+		`CREATE INDEX IF NOT EXISTS idx_prompt_attempts_state
+			ON prompt_attempts(namespace, execution_state, delivery_state, updated_at)`,
+		`CREATE TABLE IF NOT EXISTS prompt_attempt_reclamations (
+			namespace                             TEXT NOT NULL,
+			task_name                             TEXT NOT NULL,
+			task_uid                              TEXT NOT NULL,
+			mode                                  TEXT NOT NULL CHECK(mode IN ('Projected','Unbound','NoAttempt')),
+			continuity_session                    BOOLEAN NOT NULL,
+			final_continuity_session              BOOLEAN NOT NULL,
+			final_prompt_attempt_id               TEXT NOT NULL DEFAULT '',
+			terminal_projection_id                TEXT NOT NULL DEFAULT '',
+			final_session_turn_id                 TEXT NOT NULL DEFAULT '',
+			terminal_projection_aggregate_kind    TEXT NOT NULL DEFAULT '',
+			terminal_projection_aggregate_id      TEXT NOT NULL DEFAULT '',
+			candidate_ids                         BLOB NOT NULL,
+			requested_external_effect_aggregate_ids BLOB NOT NULL,
+			related_external_effect_aggregate_ids BLOB NOT NULL,
+			controller_epoch_name                 TEXT NOT NULL,
+			controller_epoch                      INTEGER NOT NULL CHECK(controller_epoch > 0),
+			created_at                            TIMESTAMP NOT NULL,
+			PRIMARY KEY(namespace, task_uid)
+		)`,
+		`CREATE TABLE IF NOT EXISTS session_controls (
+			namespace                 TEXT NOT NULL,
+			session_name              TEXT NOT NULL,
+			session_uid               TEXT NOT NULL UNIQUE,
+			request_digest            TEXT NOT NULL,
+			availability              TEXT NOT NULL CHECK(availability IN ('Available','ReconciliationBlocked')),
+			lease_generation          INTEGER NOT NULL DEFAULT 0 CHECK(lease_generation >= 0),
+			lease_task_uid            TEXT NOT NULL DEFAULT '',
+			lease_attempt             INTEGER NOT NULL DEFAULT 0 CHECK(lease_attempt >= 0),
+			lease_prompt_id           TEXT NOT NULL DEFAULT '',
+			lease_request_digest      TEXT NOT NULL DEFAULT '',
+			lease_acquired_at         TIMESTAMP,
+			lease_expires_at          TIMESTAMP,
+			blocked_reason            TEXT NOT NULL DEFAULT '',
+			related_prompt_attempt_id TEXT NOT NULL DEFAULT '',
+			related_publication_id    TEXT NOT NULL DEFAULT '',
+			verified_repository_id    TEXT NOT NULL DEFAULT '',
+			verified_ref              TEXT NOT NULL DEFAULT '',
+			verified_sha              TEXT NOT NULL DEFAULT '',
+			controller_epoch_name     TEXT NOT NULL,
+			controller_epoch          INTEGER NOT NULL CHECK(controller_epoch > 0),
+			last_operation_id         TEXT NOT NULL DEFAULT '',
+			last_operation_digest     TEXT NOT NULL DEFAULT '',
+			version                   INTEGER NOT NULL CHECK(version > 0),
+			created_at                TIMESTAMP NOT NULL,
+			updated_at                TIMESTAMP NOT NULL,
+			PRIMARY KEY(namespace, session_name),
+			FOREIGN KEY(namespace, session_name) REFERENCES sessions(namespace, name) ON DELETE RESTRICT,
+			CHECK((lease_task_uid = '' AND lease_attempt = 0 AND lease_prompt_id = '' AND lease_request_digest = '' AND lease_acquired_at IS NULL AND lease_expires_at IS NULL)
+			   OR (lease_task_uid <> '' AND lease_attempt > 0 AND lease_prompt_id <> '' AND lease_request_digest <> '' AND lease_acquired_at IS NOT NULL)),
+			CHECK((availability = 'Available' AND blocked_reason = '') OR availability = 'ReconciliationBlocked'),
+			CHECK((verified_repository_id = '' AND verified_ref = '' AND verified_sha = '')
+			   OR (verified_repository_id <> '' AND verified_ref <> '' AND verified_sha <> ''))
+		)`,
+		`CREATE INDEX IF NOT EXISTS idx_session_controls_availability
+			ON session_controls(namespace, availability, updated_at)`,
+		`CREATE TABLE IF NOT EXISTS session_turns (
+			id                    TEXT PRIMARY KEY,
+			namespace             TEXT NOT NULL,
+			session_name          TEXT NOT NULL,
+			session_uid           TEXT NOT NULL,
+			lease_generation      INTEGER NOT NULL CHECK(lease_generation > 0),
+			task_uid              TEXT NOT NULL,
+			attempt               INTEGER NOT NULL CHECK(attempt > 0),
+			prompt_id             TEXT NOT NULL,
+			prompt_attempt_id     TEXT NOT NULL,
+			request_digest        TEXT NOT NULL,
+			user_prompt           TEXT NOT NULL,
+			state                 TEXT NOT NULL CHECK(state IN ('Open','Finalized')),
+			terminal_kind         TEXT NOT NULL DEFAULT '' CHECK(terminal_kind IN ('','AssistantResult','OutcomeMarker')),
+			terminal_content      TEXT NOT NULL DEFAULT '',
+			finalization_digest   TEXT NOT NULL DEFAULT '',
+			publication_id        TEXT NOT NULL DEFAULT '',
+			publication_receipt   BLOB,
+			projection_id         TEXT NOT NULL DEFAULT '',
+			projection_kind       TEXT NOT NULL DEFAULT '',
+			projection_digest     TEXT NOT NULL DEFAULT '',
+			projection_available_at TIMESTAMP,
+			controller_epoch_name TEXT NOT NULL,
+			controller_epoch      INTEGER NOT NULL CHECK(controller_epoch > 0),
+			version               INTEGER NOT NULL CHECK(version > 0),
+			created_at            TIMESTAMP NOT NULL,
+			finalized_at          TIMESTAMP,
+			updated_at            TIMESTAMP NOT NULL,
+			UNIQUE(session_uid, lease_generation, task_uid, attempt, prompt_id),
+			FOREIGN KEY(namespace, session_name) REFERENCES sessions(namespace, name) ON DELETE RESTRICT,
+			CHECK((state = 'Open' AND terminal_kind = '' AND finalization_digest = '' AND finalized_at IS NULL)
+			   OR (state = 'Finalized' AND terminal_kind <> '' AND finalization_digest <> '' AND finalized_at IS NOT NULL))
+		)`,
+		`CREATE INDEX IF NOT EXISTS idx_session_turns_session
+			ON session_turns(session_uid, lease_generation DESC)`,
+		`CREATE TABLE IF NOT EXISTS branch_claims (
+			id                     TEXT PRIMARY KEY,
+			repository_id          TEXT NOT NULL,
+			ref                    TEXT NOT NULL,
+			owner_kind             TEXT NOT NULL CHECK(owner_kind IN ('Task','Session')),
+			owner_uid              TEXT NOT NULL,
+			generation             INTEGER NOT NULL CHECK(generation > 0),
+			last_verified_absent   BOOLEAN NOT NULL,
+			last_verified_sha      TEXT NOT NULL DEFAULT '',
+			availability           TEXT NOT NULL CHECK(availability IN ('Available','ReconciliationBlocked')),
+			blocked_reason         TEXT NOT NULL DEFAULT '',
+			related_publication_id TEXT NOT NULL DEFAULT '',
+			request_digest         TEXT NOT NULL,
+			controller_epoch_name  TEXT NOT NULL,
+			controller_epoch       INTEGER NOT NULL CHECK(controller_epoch > 0),
+			last_operation_id      TEXT NOT NULL DEFAULT '',
+			last_operation_digest  TEXT NOT NULL DEFAULT '',
+			version                INTEGER NOT NULL CHECK(version > 0),
+			created_at             TIMESTAMP NOT NULL,
+			updated_at             TIMESTAMP NOT NULL,
+			UNIQUE(repository_id, ref),
+			CHECK((last_verified_absent = TRUE AND last_verified_sha = '')
+			   OR (last_verified_absent = FALSE AND last_verified_sha <> '')),
+			CHECK((availability = 'Available' AND blocked_reason = '') OR availability = 'ReconciliationBlocked')
+		)`,
+		`CREATE INDEX IF NOT EXISTS idx_branch_claims_owner
+			ON branch_claims(owner_kind, owner_uid, availability)`,
+		`CREATE TABLE IF NOT EXISTS publications (
+			id                         TEXT PRIMARY KEY,
+			namespace                  TEXT NOT NULL,
+			generation                 INTEGER NOT NULL CHECK(generation > 0),
+			task_uid                   TEXT NOT NULL,
+			attempt                    INTEGER NOT NULL CHECK(attempt > 0),
+			prompt_id                  TEXT NOT NULL,
+			session_uid                TEXT NOT NULL DEFAULT '',
+			branch_claim_id            TEXT NOT NULL,
+			branch_claim_generation    INTEGER NOT NULL CHECK(branch_claim_generation > 0),
+			source_repository_id       TEXT NOT NULL,
+			source_ref                 TEXT NOT NULL,
+			source_baseline_sha        TEXT NOT NULL,
+			target_repository_id       TEXT NOT NULL,
+			target_ref                 TEXT NOT NULL,
+			baseline_absent            BOOLEAN NOT NULL,
+			baseline_sha               TEXT NOT NULL DEFAULT '',
+			artifact_id                TEXT NOT NULL,
+			artifact_digest            TEXT NOT NULL,
+			artifact_size_bytes        INTEGER NOT NULL CHECK(artifact_size_bytes > 0),
+			artifact_media_type        TEXT NOT NULL,
+			publication_credential_ref TEXT NOT NULL,
+			commit_identity            TEXT NOT NULL,
+			commit_message             TEXT NOT NULL,
+			commit_timestamp           TIMESTAMP NOT NULL,
+			pr_intent                  BLOB,
+			request_digest             TEXT NOT NULL,
+			state                      TEXT NOT NULL CHECK(state IN (
+				'Preparing','Prepared','Publishing','Verifying','VerifiedExact','DeliveredSuperseded',
+				'CancelledBeforePublish','DeliveryConflict','CredentialBlocked','PreparationFailed','PublicationOutcomeUnknown'
+			)),
+			prepared_receipt           BLOB,
+			publish_receipt            BLOB,
+			verification_receipt       BLOB,
+			pr_receipt                 BLOB,
+			terminal_reason            TEXT NOT NULL DEFAULT '',
+			controller_epoch_name      TEXT NOT NULL,
+			controller_epoch           INTEGER NOT NULL CHECK(controller_epoch > 0),
+			last_operation_id          TEXT NOT NULL DEFAULT '',
+			last_operation_digest      TEXT NOT NULL DEFAULT '',
+			version                    INTEGER NOT NULL CHECK(version > 0),
+			created_at                 TIMESTAMP NOT NULL,
+			updated_at                 TIMESTAMP NOT NULL,
+			FOREIGN KEY(branch_claim_id) REFERENCES branch_claims(id) ON DELETE RESTRICT,
+			CHECK((baseline_absent = TRUE AND baseline_sha = '')
+			   OR (baseline_absent = FALSE AND baseline_sha <> ''))
+		)`,
+		`CREATE INDEX IF NOT EXISTS idx_publications_task
+			ON publications(namespace, task_uid, attempt, prompt_id, generation)`,
+		`CREATE INDEX IF NOT EXISTS idx_publications_reconcile
+			ON publications(state, updated_at)`,
+		`CREATE TABLE IF NOT EXISTS external_effects (
+			id                    TEXT PRIMARY KEY,
+			kind                  TEXT NOT NULL,
+			namespace             TEXT NOT NULL,
+			aggregate_id          TEXT NOT NULL,
+			operation_id          TEXT NOT NULL,
+			request_digest        TEXT NOT NULL,
+			state                 TEXT NOT NULL CHECK(state IN ('Pending','InFlight','Succeeded','Failed','OutcomeUnknown')),
+			response_digest       TEXT NOT NULL DEFAULT '',
+			response              BLOB,
+			lease_owner           TEXT NOT NULL DEFAULT '',
+			lease_expires_at      TIMESTAMP,
+			attempts              INTEGER NOT NULL DEFAULT 0 CHECK(attempts >= 0),
+			controller_epoch_name TEXT NOT NULL,
+			controller_epoch      INTEGER NOT NULL CHECK(controller_epoch > 0),
+			version               INTEGER NOT NULL CHECK(version > 0),
+			created_at            TIMESTAMP NOT NULL,
+			updated_at            TIMESTAMP NOT NULL,
+			UNIQUE(kind, namespace, aggregate_id, operation_id),
+			CHECK((lease_owner = '' AND lease_expires_at IS NULL) OR (lease_owner <> '' AND lease_expires_at IS NOT NULL))
+		)`,
+		`CREATE INDEX IF NOT EXISTS idx_external_effects_reconcile
+			ON external_effects(state, lease_expires_at, updated_at)`,
+		`CREATE TABLE IF NOT EXISTS outbox_projections (
+			id                    TEXT PRIMARY KEY,
+			aggregate_kind        TEXT NOT NULL,
+			aggregate_id          TEXT NOT NULL,
+			projection_kind       TEXT NOT NULL,
+			payload_digest        TEXT NOT NULL,
+			payload               BLOB NOT NULL,
+			state                 TEXT NOT NULL CHECK(state IN ('Pending','Delivering','Delivered','DeadLetter')),
+			attempts              INTEGER NOT NULL DEFAULT 0 CHECK(attempts >= 0),
+			initial_available_at  TIMESTAMP NOT NULL,
+			available_at          TIMESTAMP NOT NULL,
+			lease_owner           TEXT NOT NULL DEFAULT '',
+			lease_expires_at      TIMESTAMP,
+			delivery_digest       TEXT NOT NULL DEFAULT '',
+			last_error            TEXT NOT NULL DEFAULT '',
+			last_operation_id     TEXT NOT NULL DEFAULT '',
+			last_operation_digest TEXT NOT NULL DEFAULT '',
+			controller_epoch_name TEXT NOT NULL,
+			controller_epoch      INTEGER NOT NULL CHECK(controller_epoch > 0),
+			version               INTEGER NOT NULL CHECK(version > 0),
+			created_at            TIMESTAMP NOT NULL,
+			updated_at            TIMESTAMP NOT NULL,
+			delivered_at          TIMESTAMP,
+			CHECK((state = 'Delivering' AND lease_owner <> '' AND lease_expires_at IS NOT NULL)
+			   OR (state <> 'Delivering' AND lease_owner = '' AND lease_expires_at IS NULL)),
+			CHECK((state = 'Delivered' AND delivered_at IS NOT NULL)
+			   OR (state <> 'Delivered' AND delivered_at IS NULL))
+		)`,
+		`CREATE INDEX IF NOT EXISTS idx_outbox_projections_due
+			ON outbox_projections(state, available_at, lease_expires_at, created_at)`,
+		`CREATE INDEX IF NOT EXISTS idx_outbox_projections_aggregate
+			ON outbox_projections(aggregate_kind, aggregate_id, projection_kind)`,
+	}
+
+	tx, err := db.Begin()
+	if err != nil {
+		return fmt.Errorf("control-store migration failed: %w", err)
+	}
+	defer func() { _ = tx.Rollback() }()
+	for _, statement := range statements {
+		if _, err := tx.Exec(statement); err != nil {
+			return fmt.Errorf("control-store migration failed: %w", err)
+		}
+	}
+	if err := migrateSessionTurnsToKubernetesAuthority(tx); err != nil {
+		return fmt.Errorf("control-store migration failed: %w", err)
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("control-store migration failed: %w", err)
+	}
+	if err := ensureSQLiteColumns(db, "prompt_attempts", []sqliteColumnMigration{
+		{Name: "binding_digest", Definition: "binding_digest TEXT NOT NULL DEFAULT ''"},
+		{Name: "snapshot_digest", Definition: "snapshot_digest TEXT NOT NULL DEFAULT ''"},
+	}); err != nil {
+		return fmt.Errorf("control-store migration failed: %w", err)
+	}
+	return nil
+}
+
+func migrateSessionTurnsToKubernetesAuthority(tx *sql.Tx) error {
+	hasNamespace := false
+	hasProjectionBinding := false
+	columns, err := tx.Query(`PRAGMA table_info(session_turns)`)
+	if err != nil {
+		return fmt.Errorf("inspect session_turns columns: %w", err)
+	}
+	for columns.Next() {
+		var cid, notNull, primaryKey int
+		var name, columnType string
+		var defaultValue any
+		if err := columns.Scan(&cid, &name, &columnType, &notNull, &defaultValue, &primaryKey); err != nil {
+			_ = columns.Close()
+			return fmt.Errorf("scan session_turns column: %w", err)
+		}
+		if name == "namespace" {
+			hasNamespace = true
+		}
+		if name == "projection_id" {
+			hasProjectionBinding = true
+		}
+	}
+	if err := columns.Err(); err != nil {
+		_ = columns.Close()
+		return fmt.Errorf("inspect session_turns columns: %w", err)
+	}
+	if err := columns.Close(); err != nil {
+		return fmt.Errorf("close session_turns columns: %w", err)
+	}
+
+	referencesControlRows := false
+	foreignKeys, err := tx.Query(`PRAGMA foreign_key_list(session_turns)`)
+	if err != nil {
+		return fmt.Errorf("inspect session_turns foreign keys: %w", err)
+	}
+	for foreignKeys.Next() {
+		var id, seq int
+		var table, from, to, onUpdate, onDelete, match string
+		if err := foreignKeys.Scan(&id, &seq, &table, &from, &to, &onUpdate, &onDelete, &match); err != nil {
+			_ = foreignKeys.Close()
+			return fmt.Errorf("scan session_turns foreign key: %w", err)
+		}
+		if table == "session_controls" {
+			referencesControlRows = true
+		}
+	}
+	if err := foreignKeys.Err(); err != nil {
+		_ = foreignKeys.Close()
+		return fmt.Errorf("inspect session_turns foreign keys: %w", err)
+	}
+	if err := foreignKeys.Close(); err != nil {
+		return fmt.Errorf("close session_turns foreign keys: %w", err)
+	}
+	if hasNamespace && hasProjectionBinding && !referencesControlRows {
+		return nil
+	}
+
+	if _, err := tx.Exec(`DROP TABLE IF EXISTS session_turns_kubernetes_authoritative`); err != nil {
+		return fmt.Errorf("drop stale session_turns migration table: %w", err)
+	}
+	if _, err := tx.Exec(`CREATE TABLE session_turns_kubernetes_authoritative (
+		id                    TEXT PRIMARY KEY,
+		namespace             TEXT NOT NULL,
+		session_name          TEXT NOT NULL,
+		session_uid           TEXT NOT NULL,
+		lease_generation      INTEGER NOT NULL CHECK(lease_generation > 0),
+		task_uid              TEXT NOT NULL,
+		attempt               INTEGER NOT NULL CHECK(attempt > 0),
+		prompt_id             TEXT NOT NULL,
+		prompt_attempt_id     TEXT NOT NULL,
+		request_digest        TEXT NOT NULL,
+		user_prompt           TEXT NOT NULL,
+		state                 TEXT NOT NULL CHECK(state IN ('Open','Finalized')),
+		terminal_kind         TEXT NOT NULL DEFAULT '' CHECK(terminal_kind IN ('','AssistantResult','OutcomeMarker')),
+		terminal_content      TEXT NOT NULL DEFAULT '',
+		finalization_digest   TEXT NOT NULL DEFAULT '',
+		publication_id        TEXT NOT NULL DEFAULT '',
+		publication_receipt   BLOB,
+		projection_id         TEXT NOT NULL DEFAULT '',
+		projection_kind       TEXT NOT NULL DEFAULT '',
+		projection_digest     TEXT NOT NULL DEFAULT '',
+		projection_available_at TIMESTAMP,
+		controller_epoch_name TEXT NOT NULL,
+		controller_epoch      INTEGER NOT NULL CHECK(controller_epoch > 0),
+		version               INTEGER NOT NULL CHECK(version > 0),
+		created_at            TIMESTAMP NOT NULL,
+		finalized_at          TIMESTAMP,
+		updated_at            TIMESTAMP NOT NULL,
+		UNIQUE(session_uid, lease_generation, task_uid, attempt, prompt_id),
+		FOREIGN KEY(namespace, session_name) REFERENCES sessions(namespace, name) ON DELETE RESTRICT,
+		CHECK((state = 'Open' AND terminal_kind = '' AND finalization_digest = '' AND finalized_at IS NULL)
+		   OR (state = 'Finalized' AND terminal_kind <> '' AND finalization_digest <> '' AND finalized_at IS NOT NULL))
+	)`); err != nil {
+		return fmt.Errorf("create Kubernetes-authoritative session_turns table: %w", err)
+	}
+
+	var sourceCount int
+	if err := tx.QueryRow(`SELECT COUNT(*) FROM session_turns`).Scan(&sourceCount); err != nil {
+		return fmt.Errorf("count existing session turns: %w", err)
+	}
+	copyStatement := `INSERT INTO session_turns_kubernetes_authoritative(
+		id, namespace, session_name, session_uid, lease_generation, task_uid, attempt, prompt_id,
+		prompt_attempt_id, request_digest, user_prompt, state, terminal_kind, terminal_content,
+		finalization_digest, publication_id, publication_receipt, projection_id, projection_kind,
+		projection_digest, projection_available_at, controller_epoch_name,
+		controller_epoch, version, created_at, finalized_at, updated_at
+	)`
+	if hasNamespace && hasProjectionBinding {
+		copyStatement += ` SELECT id, namespace, session_name, session_uid, lease_generation, task_uid, attempt, prompt_id,
+			prompt_attempt_id, request_digest, user_prompt, state, terminal_kind, terminal_content,
+			finalization_digest, publication_id, publication_receipt, projection_id, projection_kind,
+			projection_digest, projection_available_at, controller_epoch_name,
+			controller_epoch, version, created_at, finalized_at, updated_at FROM session_turns`
+	} else if hasNamespace {
+		copyStatement += ` SELECT id, namespace, session_name, session_uid, lease_generation, task_uid, attempt, prompt_id,
+			prompt_attempt_id, request_digest, user_prompt, state, terminal_kind, terminal_content,
+			finalization_digest, publication_id, publication_receipt, '', '', '', NULL, controller_epoch_name,
+			controller_epoch, version, created_at, finalized_at, updated_at FROM session_turns`
+	} else {
+		copyStatement += ` SELECT turns.id, controls.namespace, controls.session_name, turns.session_uid,
+			turns.lease_generation, turns.task_uid, turns.attempt, turns.prompt_id, turns.prompt_attempt_id,
+			turns.request_digest, turns.user_prompt, turns.state, turns.terminal_kind, turns.terminal_content,
+			turns.finalization_digest, turns.publication_id, turns.publication_receipt, '', '', '', NULL,
+			turns.controller_epoch_name, turns.controller_epoch, turns.version, turns.created_at,
+			turns.finalized_at, turns.updated_at
+			FROM session_turns AS turns JOIN session_controls AS controls ON controls.session_uid = turns.session_uid`
+	}
+	if _, err := tx.Exec(copyStatement); err != nil {
+		return fmt.Errorf("copy existing session turns: %w", err)
+	}
+	var copiedCount int
+	if err := tx.QueryRow(`SELECT COUNT(*) FROM session_turns_kubernetes_authoritative`).Scan(&copiedCount); err != nil {
+		return fmt.Errorf("count copied session turns: %w", err)
+	}
+	if copiedCount != sourceCount {
+		return fmt.Errorf("copied %d of %d existing session turns", copiedCount, sourceCount)
+	}
+	if _, err := tx.Exec(`DROP TABLE session_turns`); err != nil {
+		return fmt.Errorf("drop legacy session_turns table: %w", err)
+	}
+	if _, err := tx.Exec(`ALTER TABLE session_turns_kubernetes_authoritative RENAME TO session_turns`); err != nil {
+		return fmt.Errorf("rename Kubernetes-authoritative session_turns table: %w", err)
+	}
+	if _, err := tx.Exec(`CREATE INDEX IF NOT EXISTS idx_session_turns_session ON session_turns(session_uid, lease_generation DESC)`); err != nil {
+		return fmt.Errorf("recreate session_turns index: %w", err)
+	}
+	return nil
+}
diff --git a/internal/store/sqlite/control_store_test.go b/internal/store/sqlite/control_store_test.go
new file mode 100644
index 000000000..e38143af4
--- /dev/null
+++ b/internal/store/sqlite/control_store_test.go
@@ -0,0 +1,994 @@
+package sqlite
+
+import (
+	"context"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+const (
+	controlTestGitSHA           = "0123456789012345678901234567890123456789"
+	controlTestGitSHA2          = "abcdefabcdefabcdefabcdefabcdefabcdefabcd"
+	controlTestSessionType      = "chat"
+	controlTestControllerB      = "controller-b"
+	controlTestAggregateKind    = "SessionTurn"
+	controlTestProjectionKind   = "TaskStatus"
+	controlTestPrepareOperation = "prepare-1"
+	controlTestSessionName      = "session-1"
+	controlTestSessionUID       = "session-uid-1"
+	controlTestProjectorA       = "projector-a"
+	controlTestProjectorB       = "projector-b"
+	controlTestWorkerA          = "worker-a"
+	controlTestUnknownSuffix    = "unknown"
+)
+
+func controlTestDigest(value string) string {
+	sum := sha256.Sum256([]byte(value))
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
+
+func boundPromptAttemptForSQLiteTest(attempt *store.PromptAttempt) *store.PromptAttempt {
+	if attempt == nil {
+		return nil
+	}
+	if attempt.BindingDigest == "" {
+		attempt.BindingDigest = controlTestDigest("test-v2-binding")
+	}
+	if attempt.SnapshotDigest == "" {
+		attempt.SnapshotDigest = controlTestDigest("test-v2-snapshot")
+	}
+	return attempt
+}
+
+func seedControlEpoch(t *testing.T, s *Store) store.ControllerEpochFence {
+	t.Helper()
+	epoch, err := s.CompareAndSwapControllerEpoch(context.Background(), store.ControllerEpochCAS{
+		ExpectedVersion: 0,
+		ExpectedEpoch:   0,
+		NewEpoch:        1,
+		HolderID:        "controller-a",
+		RequestDigest:   controlTestDigest("epoch-1"),
+		UpdatedAt:       time.Date(2026, 7, 24, 12, 0, 0, 0, time.UTC),
+	})
+	if err != nil {
+		t.Fatalf("seed controller epoch: %v", err)
+	}
+	return store.ControllerEpochFence{Name: epoch.Name, Epoch: epoch.Epoch, HolderID: epoch.HolderID}
+}
+
+func createControlTranscriptSession(t *testing.T, s *Store, namespace, name string, now time.Time) {
+	t.Helper()
+	if err := s.CreateSession(context.Background(), &store.SessionRecord{
+		Namespace: namespace, Name: name, SessionType: controlTestSessionType, CreatedAt: now, UpdatedAt: now,
+	}); err != nil {
+		t.Fatalf("CreateSession: %v", err)
+	}
+}
+
+func TestControllerEpochCASIdempotencyAndFencing(t *testing.T) {
+	s := setupTestStore(t)
+	ctx := context.Background()
+	now := time.Date(2026, 7, 24, 12, 0, 0, 0, time.UTC)
+	create := store.ControllerEpochCAS{
+		ExpectedVersion: 0, ExpectedEpoch: 0, NewEpoch: 1, HolderID: "controller-a",
+		RequestDigest: controlTestDigest("epoch-create"), UpdatedAt: now,
+	}
+	first, err := s.CompareAndSwapControllerEpoch(ctx, create)
+	if err != nil {
+		t.Fatalf("create epoch: %v", err)
+	}
+	if first.Version != 1 || first.Epoch != 1 || first.Name != store.DefaultControllerEpochName {
+		t.Fatalf("created epoch = %#v", first)
+	}
+	retry, err := s.CompareAndSwapControllerEpoch(ctx, create)
+	if err != nil {
+		t.Fatalf("same-digest retry: %v", err)
+	}
+	if retry.Version != first.Version {
+		t.Fatalf("retry advanced version: got %d want %d", retry.Version, first.Version)
+	}
+	mismatch := create
+	mismatch.RequestDigest = controlTestDigest("different-create")
+	if _, err := s.CompareAndSwapControllerEpoch(ctx, mismatch); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("same epoch different digest error = %v, want ErrConflict", err)
+	}
+	if _, err := s.CompareAndSwapControllerEpoch(ctx, store.ControllerEpochCAS{
+		ExpectedVersion: 99, ExpectedEpoch: 1, NewEpoch: 2, HolderID: controlTestControllerB,
+		RequestDigest: controlTestDigest("stale"), UpdatedAt: now.Add(time.Minute),
+	}); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("stale epoch error = %v, want ErrConflict", err)
+	}
+	if _, err := s.CompareAndSwapControllerEpoch(ctx, store.ControllerEpochCAS{
+		Name: "alternate-controller-domain", ExpectedVersion: 0, ExpectedEpoch: 0, NewEpoch: 1,
+		HolderID: "rogue-controller", RequestDigest: controlTestDigest("rogue-epoch"), UpdatedAt: now,
+	}); !errors.Is(err, store.ErrValidation) {
+		t.Fatalf("alternate epoch domain error = %v, want ErrValidation", err)
+	}
+	second, err := s.CompareAndSwapControllerEpoch(ctx, store.ControllerEpochCAS{
+		ExpectedVersion: first.Version, ExpectedEpoch: first.Epoch, NewEpoch: 2, HolderID: controlTestControllerB,
+		RequestDigest: controlTestDigest("epoch-2"), UpdatedAt: now.Add(time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("advance epoch: %v", err)
+	}
+	if second.Version != 2 || second.Epoch != 2 || second.HolderID != "controller-b" {
+		t.Fatalf("advanced epoch = %#v", second)
+	}
+}
+
+func TestPromptAttemptSubmittedUnknownBecomesTerminalOutcomeUnknown(t *testing.T) {
+	s := setupTestStore(t)
+	ctx := context.Background()
+	fence := seedControlEpoch(t, s)
+	key := store.PromptAttemptKey{Namespace: "ns", TaskUID: "task-uid-1", Attempt: 1, PromptID: "prompt-1"}
+	id, err := key.CanonicalID()
+	if err != nil {
+		t.Fatalf("canonical prompt attempt ID: %v", err)
+	}
+	created, err := s.CreatePromptAttempt(ctx, boundPromptAttemptForSQLiteTest(&store.PromptAttempt{
+		Key: key, RequestDigest: controlTestDigest("prompt-request"),
+	}), fence)
+	if err != nil {
+		t.Fatalf("CreatePromptAttempt: %v", err)
+	}
+	if created.ID != id || created.Version != 1 || created.ExecutionState != store.PromptExecutionQueued {
+		t.Fatalf("created prompt attempt = %#v", created)
+	}
+	if created.BindingDigest != controlTestDigest("test-v2-binding") ||
+		created.SnapshotDigest != controlTestDigest("test-v2-snapshot") {
+		t.Fatalf("created prompt attempt binding = %q/%q", created.BindingDigest, created.SnapshotDigest)
+	}
+	retry, err := s.CreatePromptAttempt(ctx, boundPromptAttemptForSQLiteTest(&store.PromptAttempt{Key: key, RequestDigest: created.RequestDigest}), fence)
+	if err != nil || retry.Version != created.Version {
+		t.Fatalf("same-digest prompt retry = %#v, %v", retry, err)
+	}
+	if _, err := s.CreatePromptAttempt(ctx, boundPromptAttemptForSQLiteTest(&store.PromptAttempt{Key: key, RequestDigest: controlTestDigest("other-prompt")}), fence); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("prompt digest mismatch error = %v, want ErrConflict", err)
+	}
+	mismatchedBinding := boundPromptAttemptForSQLiteTest(&store.PromptAttempt{Key: key, RequestDigest: created.RequestDigest})
+	mismatchedBinding.BindingDigest = controlTestDigest("different-binding")
+	if _, err := s.CreatePromptAttempt(ctx, mismatchedBinding, fence); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("prompt binding digest mismatch error = %v, want ErrConflict", err)
+	}
+	unboundKey := store.PromptAttemptKey{Namespace: "ns", TaskUID: "task-uid-unbound", Attempt: 1, PromptID: "prompt-unbound"}
+	if _, err := s.CreatePromptAttempt(ctx, &store.PromptAttempt{
+		Key: unboundKey, RequestDigest: controlTestDigest("unbound-prompt"),
+	}, fence); !errors.Is(err, store.ErrValidation) {
+		t.Fatalf("unbound prompt attempt error = %v, want ErrValidation", err)
+	}
+
+	current := created
+	states := []store.PromptExecutionState{
+		store.PromptExecutionReserved,
+		store.PromptExecutionSessionStarting,
+		store.PromptExecutionPlanned,
+		store.PromptExecutionSubmitting,
+		store.PromptExecutionSubmittedUnknown,
+		store.PromptExecutionOutcomeUnknown,
+	}
+	for index, next := range states {
+		transition := store.PromptAttemptExecutionTransition{
+			ID: current.ID, Fence: fence, ExpectedVersion: current.Version,
+			ExpectedState: current.ExecutionState, NewState: next,
+			OperationID:     "execution-op-" + string(rune('a'+index)),
+			OperationDigest: controlTestDigest("execution-op-" + string(rune('a'+index))),
+			TerminalReason:  "runtime acceptance was ambiguous",
+			UpdatedAt:       created.CreatedAt.Add(time.Duration(index+1) * time.Second),
+		}
+		if next == store.PromptExecutionOutcomeUnknown {
+			transition.OutcomeMarker = "The prior prompt may have been accepted; it was not replayed."
+		}
+		current, err = s.TransitionPromptAttemptExecution(ctx, transition)
+		if err != nil {
+			t.Fatalf("transition to %s: %v", next, err)
+		}
+	}
+	if current.ExecutionState != store.PromptExecutionOutcomeUnknown || current.OutcomeMarker == "" {
+		t.Fatalf("terminal ambiguous attempt = %#v", current)
+	}
+	afterMutationRetry, err := s.CreatePromptAttempt(ctx, boundPromptAttemptForSQLiteTest(&store.PromptAttempt{Key: key, RequestDigest: created.RequestDigest}), fence)
+	if err != nil || afterMutationRetry.ExecutionState != store.PromptExecutionOutcomeUnknown {
+		t.Fatalf("post-transition create retry = %#v, %v", afterMutationRetry, err)
+	}
+	if _, err := s.TransitionPromptAttemptExecution(ctx, store.PromptAttemptExecutionTransition{
+		ID: current.ID, Fence: fence, ExpectedVersion: current.Version,
+		ExpectedState: current.ExecutionState, NewState: store.PromptExecutionQueued,
+		OperationID: "illegal-retry", OperationDigest: controlTestDigest("illegal-retry"),
+	}); !errors.Is(err, store.ErrValidation) {
+		t.Fatalf("OutcomeUnknown replay transition error = %v, want ErrValidation", err)
+	}
+}
+
+func TestPromptAttemptBindingDigestMigrationPreservesLegacyRead(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "legacy-prompt-attempt.db")
+	legacyDB, err := sql.Open("sqlite", path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = legacyDB.Exec(`CREATE TABLE prompt_attempts (
+		id TEXT PRIMARY KEY,
+		namespace TEXT NOT NULL,
+		task_uid TEXT NOT NULL,
+		attempt INTEGER NOT NULL,
+		prompt_id TEXT NOT NULL,
+		session_uid TEXT NOT NULL DEFAULT '',
+		session_lease_generation INTEGER NOT NULL DEFAULT 0,
+		runtime_instance_id TEXT NOT NULL DEFAULT '',
+		request_digest TEXT NOT NULL,
+		execution_state TEXT NOT NULL,
+		delivery_state TEXT NOT NULL,
+		terminal_reason TEXT NOT NULL DEFAULT '',
+		outcome_marker TEXT NOT NULL DEFAULT '',
+		controller_epoch_name TEXT NOT NULL,
+		controller_epoch INTEGER NOT NULL,
+		last_operation_id TEXT NOT NULL DEFAULT '',
+		last_operation_digest TEXT NOT NULL DEFAULT '',
+		version INTEGER NOT NULL,
+		created_at TIMESTAMP NOT NULL,
+		updated_at TIMESTAMP NOT NULL,
+		UNIQUE(namespace, task_uid, attempt, prompt_id)
+	);
+	INSERT INTO prompt_attempts(
+		id, namespace, task_uid, attempt, prompt_id, request_digest, execution_state,
+		delivery_state, controller_epoch_name, controller_epoch, version, created_at, updated_at
+	) VALUES (?, 'legacy-ns', 'legacy-task-uid', 1, 'legacy-prompt', ?, 'Running',
+		'NotRequested', 'orka-controller', 1, 4, ?, ?)`,
+		"legacy-attempt", controlTestDigest("legacy-request"),
+		time.Date(2026, 7, 1, 10, 0, 0, 0, time.UTC), time.Date(2026, 7, 1, 10, 5, 0, 0, time.UTC))
+	if err != nil {
+		_ = legacyDB.Close()
+		t.Fatalf("seed legacy PromptAttempt: %v", err)
+	}
+	if err := legacyDB.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	migratedDB, err := NewDB(path)
+	if err != nil {
+		t.Fatalf("migrate legacy PromptAttempt: %v", err)
+	}
+	defer migratedDB.Close() //nolint:errcheck
+	attempt, err := NewStore(migratedDB, path).GetPromptAttempt(context.Background(), "legacy-attempt")
+	if err != nil {
+		t.Fatalf("read migrated legacy PromptAttempt: %v", err)
+	}
+	if attempt.BindingDigest != "" || attempt.SnapshotDigest != "" || attempt.ExecutionState != store.PromptExecutionRunning {
+		t.Fatalf("migrated legacy PromptAttempt = %#v", attempt)
+	}
+}
+
+func TestBranchClaimAndPublicationExactReceipts(t *testing.T) {
+	s := setupTestStore(t)
+	ctx := context.Background()
+	fence := seedControlEpoch(t, s)
+	now := time.Date(2026, 7, 24, 13, 0, 0, 0, time.UTC)
+	claim, err := s.CreateBranchClaim(ctx, &store.BranchClaim{
+		RepositoryID: "github:orka/test", Ref: "refs/heads/orka/session-1",
+		OwnerKind: store.BranchClaimOwnerSession, OwnerUID: controlTestSessionUID, Generation: 1,
+		LastVerified: store.RemoteRefState{Absent: true}, RequestDigest: controlTestDigest("claim"),
+		CreatedAt: now,
+	}, fence)
+	if err != nil {
+		t.Fatalf("CreateBranchClaim: %v", err)
+	}
+	if _, err := s.CreateBranchClaim(ctx, &store.BranchClaim{
+		RepositoryID: claim.RepositoryID, Ref: claim.Ref, OwnerKind: claim.OwnerKind,
+		OwnerUID: claim.OwnerUID, Generation: 1, LastVerified: claim.LastVerified,
+		RequestDigest: claim.RequestDigest, CreatedAt: now,
+	}, fence); err != nil {
+		t.Fatalf("same branch claim retry: %v", err)
+	}
+	if _, err := s.CompareAndSwapBranchClaim(ctx, store.BranchClaimCAS{
+		ID: claim.ID, Fence: fence, ExpectedVersion: claim.Version, ExpectedGeneration: claim.Generation,
+		NewGeneration: claim.Generation, ExpectedLastVerified: store.RemoteRefState{SHA: controlTestGitSHA},
+		NewLastVerified:      store.RemoteRefState{SHA: controlTestGitSHA2},
+		ExpectedAvailability: store.BranchClaimAvailable, NewAvailability: store.BranchClaimAvailable,
+		OperationID: "wrong-baseline", OperationDigest: controlTestDigest("wrong-baseline"), UpdatedAt: now.Add(time.Second),
+	}); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("branch baseline mismatch error = %v, want ErrConflict", err)
+	}
+
+	publication := &store.Publication{
+		ID: "publication-1", Namespace: "ns", Generation: 1, TaskUID: "task-uid-1", Attempt: 1,
+		PromptID: "prompt-1", SessionUID: claim.OwnerUID, BranchClaimID: claim.ID,
+		BranchClaimGeneration: claim.Generation, SourceRepositoryID: "github:orka/source", SourceBaselineSHA: controlTestGitSHA,
+		SourceRef: "refs/heads/main", TargetRepositoryID: claim.RepositoryID, TargetRef: claim.Ref,
+		Baseline: claim.LastVerified, ArtifactID: "sha256-artifact", ArtifactDigest: controlTestDigest("artifact"),
+		ArtifactSizeBytes: 128, ArtifactMediaType: "application/vnd.orka.workspace-delta.v1+tar",
+		PublicationCredentialRef: "secret/ns/publisher#token", CommitIdentity: "Orka <orka@example.invalid>",
+		CommitMessage: "feat: apply agent changes", CommitTimestamp: now,
+		RequestDigest: controlTestDigest("publication-intent"), CreatedAt: now,
+	}
+	current, err := s.CreatePublication(ctx, publication, fence)
+	if err != nil {
+		t.Fatalf("CreatePublication: %v", err)
+	}
+	prepared := store.PreparedPublicationReceipt{
+		OperationID: controlTestPrepareOperation, RequestDigest: controlTestDigest("prepare-response"),
+		TreeSHA: controlTestGitSHA2, CommitSHA: controlTestGitSHA, ManifestDigest: controlTestDigest("manifest"),
+		BundleArtifactID: "bundle-artifact", BundleDigest: controlTestDigest("bundle"), BundleSizeBytes: 256,
+		BundleMediaType: store.PreparedBundleMediaType, BundleRef: "refs/orka/publications/" + strings.Repeat("f", 64),
+		PreparedAt: now.Add(time.Minute),
+	}
+	current, err = s.TransitionPublication(ctx, store.PublicationTransition{
+		ID: current.ID, Fence: fence, ExpectedVersion: current.Version, ExpectedGeneration: current.Generation,
+		ExpectedState: current.State, NewState: store.PublicationPrepared,
+		OperationID: controlTestPrepareOperation, OperationDigest: controlTestDigest(controlTestPrepareOperation),
+		PreparedReceipt: &prepared, UpdatedAt: now.Add(time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("prepare publication: %v", err)
+	}
+	duplicate, err := s.TransitionPublication(ctx, store.PublicationTransition{
+		ID: current.ID, Fence: fence, ExpectedVersion: 1, ExpectedGeneration: current.Generation,
+		ExpectedState: store.PublicationPreparing, NewState: store.PublicationPrepared,
+		OperationID: controlTestPrepareOperation, OperationDigest: controlTestDigest(controlTestPrepareOperation),
+		PreparedReceipt: &prepared, UpdatedAt: now.Add(time.Minute),
+	})
+	if err != nil || duplicate.Version != current.Version {
+		t.Fatalf("idempotent prepare retry = %#v, %v", duplicate, err)
+	}
+	if _, err := s.TransitionPublication(ctx, store.PublicationTransition{
+		ID: current.ID, Fence: fence, ExpectedVersion: 1, ExpectedGeneration: current.Generation,
+		ExpectedState: store.PublicationPreparing, NewState: store.PublicationPrepared,
+		OperationID: controlTestPrepareOperation, OperationDigest: controlTestDigest("different-prepare"),
+		PreparedReceipt: &prepared,
+	}); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("prepare digest mismatch error = %v, want ErrConflict", err)
+	}
+	prIntent := store.PullRequestIntent{
+		BaseRepositoryID: publication.SourceRepositoryID, BaseRef: "refs/heads/main",
+		HeadRepositoryID: publication.TargetRepositoryID, HeadRef: publication.TargetRef,
+		PublicationGeneration: publication.Generation, ExpectedHeadSHA: prepared.CommitSHA,
+	}
+	current, err = s.SetPublicationPRIntent(ctx, store.SetPublicationPRIntentRequest{
+		ID: current.ID, Fence: fence, ExpectedVersion: current.Version, ExpectedGeneration: current.Generation,
+		ExpectedState: store.PublicationPrepared, Intent: prIntent,
+		OperationID: "set-pr-intent", OperationDigest: controlTestDigest("set-pr-intent"), UpdatedAt: now.Add(90 * time.Second),
+	})
+	if err != nil {
+		t.Fatalf("SetPublicationPRIntent: %v", err)
+	}
+	if current.PRIntent == nil || current.PRIntent.ExpectedHeadSHA != prepared.CommitSHA {
+		t.Fatalf("PR intent = %#v", current.PRIntent)
+	}
+	current, err = s.TransitionPublication(ctx, store.PublicationTransition{
+		ID: current.ID, Fence: fence, ExpectedVersion: current.Version, ExpectedGeneration: current.Generation,
+		ExpectedState: current.State, NewState: store.PublicationPublishing,
+		OperationID: "publish-cas", OperationDigest: controlTestDigest("publish-cas"), UpdatedAt: now.Add(2 * time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("choose publishing: %v", err)
+	}
+	publishReceipt := store.PublishOperationReceipt{
+		OperationID: "publish-call", RequestDigest: controlTestDigest("publish-call"),
+		TargetRepositoryID: current.TargetRepositoryID, TargetRef: current.TargetRef,
+		RemoteBefore: current.Baseline, ExpectedCommitSHA: prepared.CommitSHA,
+		AcknowledgementUnknown: true, PublishedAt: now.Add(3 * time.Minute),
+	}
+	current, err = s.TransitionPublication(ctx, store.PublicationTransition{
+		ID: current.ID, Fence: fence, ExpectedVersion: current.Version, ExpectedGeneration: current.Generation,
+		ExpectedState: current.State, NewState: store.PublicationVerifying,
+		OperationID: publishReceipt.OperationID, OperationDigest: publishReceipt.RequestDigest,
+		PublishReceipt: &publishReceipt, UpdatedAt: now.Add(3 * time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("persist publish receipt: %v", err)
+	}
+	verification := store.PublicationVerificationReceipt{
+		OperationID: "verify-call", RequestDigest: controlTestDigest("verify-call"),
+		Outcome: store.PublicationVerifiedExact, ExpectedCommitSHA: prepared.CommitSHA,
+		ObservedRemote: store.RemoteRefState{SHA: prepared.CommitSHA}, VerifiedAt: now.Add(4 * time.Minute),
+	}
+	current, err = s.TransitionPublication(ctx, store.PublicationTransition{
+		ID: current.ID, Fence: fence, ExpectedVersion: current.Version, ExpectedGeneration: current.Generation,
+		ExpectedState: current.State, NewState: store.PublicationVerifiedExact,
+		OperationID: verification.OperationID, OperationDigest: verification.RequestDigest,
+		VerificationReceipt: &verification, UpdatedAt: now.Add(4 * time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("verify publication: %v", err)
+	}
+	if current.State != store.PublicationVerifiedExact || current.VerificationReceipt.ObservedRemote.SHA != prepared.CommitSHA {
+		t.Fatalf("verified publication = %#v", current)
+	}
+	afterMutationRetry, err := s.CreatePublication(ctx, publication, fence)
+	if err != nil || afterMutationRetry.State != store.PublicationVerifiedExact {
+		t.Fatalf("post-transition publication create retry = %#v, %v", afterMutationRetry, err)
+	}
+}
+
+//nolint:gocyclo // The test verifies the complete atomic finalization and restart contract.
+func TestSessionTurnAtomicFinalizationPersistsAcrossRestart(t *testing.T) {
+	ctx := context.Background()
+	dbPath := filepath.Join(t.TempDir(), "control.db")
+	db, err := NewDB(dbPath)
+	if err != nil {
+		t.Fatalf("NewDB: %v", err)
+	}
+	s := NewStore(db, dbPath)
+	fence := seedControlEpoch(t, s)
+	now := time.Date(2026, 7, 24, 14, 0, 0, 0, time.UTC)
+	createControlTranscriptSession(t, s, "ns", controlTestSessionName, now)
+	control, err := s.CreateSessionControl(ctx, &store.SessionControl{
+		Namespace: "ns", SessionName: controlTestSessionName, SessionUID: controlTestSessionUID,
+		RequestDigest: controlTestDigest("session-control-final"), CreatedAt: now,
+	}, fence)
+	if err != nil {
+		t.Fatalf("CreateSessionControl: %v", err)
+	}
+	claim, publication := createVerifiedPublicationFixture(t, s, fence, now, control.SessionUID)
+	control, err = s.AcquireSessionMutationLease(ctx, store.AcquireSessionMutationLeaseRequest{
+		Namespace: control.Namespace, SessionName: control.SessionName, SessionUID: control.SessionUID,
+		Fence: fence, ExpectedVersion: control.Version, ExpectedLeaseGeneration: control.LeaseGeneration,
+		TaskUID: "task-uid-final", Attempt: 1, PromptID: "prompt-final",
+		RequestDigest: controlTestDigest("lease-final"), AcquiredAt: now.Add(5 * time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("AcquireSessionMutationLease: %v", err)
+	}
+	attemptKey := store.PromptAttemptKey{Namespace: "ns", TaskUID: "task-uid-final", Attempt: 1, PromptID: "prompt-final"}
+	attempt, err := s.CreatePromptAttempt(ctx, boundPromptAttemptForSQLiteTest(&store.PromptAttempt{
+		Key: attemptKey, SessionUID: control.SessionUID, SessionLeaseGeneration: control.LeaseGeneration,
+		RequestDigest: controlTestDigest("prompt-final"), CreatedAt: now.Add(5 * time.Minute),
+	}), fence)
+	if err != nil {
+		t.Fatalf("CreatePromptAttempt: %v", err)
+	}
+	attempt = completePromptAttemptForFinalization(t, s, fence, attempt, store.PromptDeliveryVerifiedExact)
+	turnKey := store.SessionTurnKey{
+		SessionUID: control.SessionUID, LeaseGeneration: control.LeaseGeneration,
+		TaskUID: attemptKey.TaskUID, Attempt: attemptKey.Attempt, PromptID: attemptKey.PromptID,
+	}
+	turnID, _ := turnKey.CanonicalID()
+	turn, err := s.CreateSessionTurn(ctx, store.CreateSessionTurnRequest{
+		Turn: store.SessionTurn{Key: turnKey, PromptAttemptID: attempt.ID,
+			RequestDigest: controlTestDigest("turn-final"), UserPrompt: "Please make the verified change.",
+			CreatedAt: now.Add(6 * time.Minute)},
+		Fence: fence, ExpectedSessionVersion: control.Version,
+	})
+	if err != nil {
+		t.Fatalf("CreateSessionTurn: %v", err)
+	}
+	payload := json.RawMessage(`{"phase":"Succeeded","delivery":"VerifiedExact"}`)
+	finalized, err := s.FinalizeSessionTurn(ctx, store.FinalizeSessionTurnRequest{
+		Key: turnKey, Fence: fence, ExpectedSessionVersion: control.Version, ExpectedTurnVersion: turn.Version,
+		FinalizationDigest: controlTestDigest("finalization"), TerminalKind: store.SessionTurnAssistantResult,
+		TerminalContent: "The change was published and independently verified.", PublicationID: publication.ID,
+		Projection: store.OutboxProjection{
+			ID: "outbox-session-turn-final", AggregateKind: controlTestAggregateKind, AggregateID: turnID,
+			ProjectionKind: controlTestProjectionKind, Payload: payload, PayloadDigest: controlTestDigest(string(payload)),
+		},
+		FinalizedAt: now.Add(7 * time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("FinalizeSessionTurn: %v", err)
+	}
+	if finalized.State != store.SessionTurnFinalized || finalized.PublicationReceipt == nil || finalized.PublicationReceipt.State != store.PublicationVerifiedExact {
+		t.Fatalf("finalized turn = %#v", finalized)
+	}
+	transcript, err := s.LoadTranscript(ctx, "ns", controlTestSessionName, 0)
+	if err != nil {
+		t.Fatalf("LoadTranscript: %v", err)
+	}
+	if len(transcript) != 2 || transcript[0].Role != roleUser || transcript[1].Role != roleAssistant {
+		t.Fatalf("transcript = %#v", transcript)
+	}
+	retry, err := s.FinalizeSessionTurn(ctx, store.FinalizeSessionTurnRequest{
+		Key: turnKey, Fence: fence, ExpectedSessionVersion: control.Version, ExpectedTurnVersion: turn.Version,
+		FinalizationDigest: finalized.FinalizationDigest, TerminalKind: finalized.TerminalKind,
+		TerminalContent: finalized.TerminalContent, PublicationID: publication.ID,
+		Projection: store.OutboxProjection{
+			ID: "outbox-session-turn-final", AggregateKind: controlTestAggregateKind, AggregateID: turnID,
+			ProjectionKind: controlTestProjectionKind, Payload: payload, PayloadDigest: controlTestDigest(string(payload)),
+		},
+		FinalizedAt: now.Add(7 * time.Minute),
+	})
+	if err != nil || retry.Version != finalized.Version {
+		t.Fatalf("idempotent finalization retry = %#v, %v", retry, err)
+	}
+	transcript, _ = s.LoadTranscript(ctx, "ns", controlTestSessionName, 0)
+	if len(transcript) != 2 {
+		t.Fatalf("retry duplicated transcript: %#v", transcript)
+	}
+	updatedControl, err := s.GetSessionControl(ctx, "ns", controlTestSessionName)
+	if err != nil {
+		t.Fatalf("GetSessionControl: %v", err)
+	}
+	if updatedControl.Lease != nil || updatedControl.Availability != store.SessionAvailable || updatedControl.VerifiedBaseline == nil || updatedControl.VerifiedBaseline.SHA != controlTestGitSHA {
+		t.Fatalf("finalized session control = %#v", updatedControl)
+	}
+	controlRetry, err := s.CreateSessionControl(ctx, &store.SessionControl{
+		Namespace: "ns", SessionName: controlTestSessionName, SessionUID: controlTestSessionUID,
+		RequestDigest: controlTestDigest("session-control-final"), CreatedAt: now,
+	}, fence)
+	if err != nil || controlRetry.Version != updatedControl.Version {
+		t.Fatalf("post-finalization session-control retry = %#v, %v", controlRetry, err)
+	}
+	updatedClaim, err := s.GetBranchClaim(ctx, claim.ID)
+	if err != nil || updatedClaim.LastVerified.SHA != controlTestGitSHA {
+		t.Fatalf("finalized branch claim = %#v, %v", updatedClaim, err)
+	}
+	claimRetry, err := s.CreateBranchClaim(ctx, &store.BranchClaim{
+		RepositoryID: claim.RepositoryID, Ref: claim.Ref, OwnerKind: claim.OwnerKind, OwnerUID: claim.OwnerUID,
+		Generation: 1, LastVerified: store.RemoteRefState{Absent: true}, RequestDigest: claim.RequestDigest, CreatedAt: now,
+	}, fence)
+	if err != nil || claimRetry.LastVerified.SHA != controlTestGitSHA {
+		t.Fatalf("post-finalization branch-claim retry = %#v, %v", claimRetry, err)
+	}
+	outbox, err := s.GetOutboxProjection(ctx, "outbox-session-turn-final")
+	if err != nil || outbox.State != store.OutboxProjectionPending {
+		t.Fatalf("outbox = %#v, %v", outbox, err)
+	}
+	if err := db.Close(); err != nil {
+		t.Fatalf("close DB: %v", err)
+	}
+	db, err = NewDB(dbPath)
+	if err != nil {
+		t.Fatalf("reopen DB: %v", err)
+	}
+	defer db.Close() //nolint:errcheck
+	restarted := NewStore(db, dbPath)
+	if got, err := restarted.GetSessionTurn(ctx, finalized.ID); err != nil || got.State != store.SessionTurnFinalized {
+		t.Fatalf("restarted session turn = %#v, %v", got, err)
+	}
+	if got, err := restarted.GetOutboxProjection(ctx, outbox.ID); err != nil || got.State != store.OutboxProjectionPending {
+		t.Fatalf("restarted outbox = %#v, %v", got, err)
+	}
+}
+
+func TestPublicationOutcomeUnknownBlocksSessionAndBranch(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "reconcile.db")
+	db, err := NewDB(dbPath)
+	if err != nil {
+		t.Fatalf("NewDB: %v", err)
+	}
+	s := NewStore(db, dbPath)
+	ctx := context.Background()
+	fence := seedControlEpoch(t, s)
+	now := time.Date(2026, 7, 24, 15, 0, 0, 0, time.UTC)
+	createControlTranscriptSession(t, s, "ns", "blocked-session", now)
+	control, err := s.CreateSessionControl(ctx, &store.SessionControl{
+		Namespace: "ns", SessionName: "blocked-session", SessionUID: "blocked-session-uid",
+		RequestDigest: controlTestDigest("session-control-blocked"), CreatedAt: now,
+	}, fence)
+	if err != nil {
+		t.Fatalf("CreateSessionControl: %v", err)
+	}
+	claim, publication := createOutcomeUnknownPublicationFixture(t, s, fence, now, control.SessionUID)
+	control, err = s.AcquireSessionMutationLease(ctx, store.AcquireSessionMutationLeaseRequest{
+		Namespace: control.Namespace, SessionName: control.SessionName, SessionUID: control.SessionUID,
+		Fence: fence, ExpectedVersion: control.Version, ExpectedLeaseGeneration: control.LeaseGeneration,
+		TaskUID: "task-uid-unknown", Attempt: 1, PromptID: "prompt-unknown",
+		RequestDigest: controlTestDigest("lease-unknown"), AcquiredAt: now.Add(5 * time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("AcquireSessionMutationLease: %v", err)
+	}
+	attemptKey := store.PromptAttemptKey{Namespace: "ns", TaskUID: "task-uid-unknown", Attempt: 1, PromptID: "prompt-unknown"}
+	attempt, err := s.CreatePromptAttempt(ctx, boundPromptAttemptForSQLiteTest(&store.PromptAttempt{
+		Key: attemptKey, SessionUID: control.SessionUID, SessionLeaseGeneration: control.LeaseGeneration,
+		RequestDigest: controlTestDigest("prompt-unknown"), CreatedAt: now.Add(5 * time.Minute),
+	}), fence)
+	if err != nil {
+		t.Fatalf("CreatePromptAttempt: %v", err)
+	}
+	attempt = completePromptAttemptForFinalization(t, s, fence, attempt, store.PromptDeliveryPublicationOutcomeUnknown)
+	turnKey := store.SessionTurnKey{SessionUID: control.SessionUID, LeaseGeneration: control.LeaseGeneration, TaskUID: attemptKey.TaskUID, Attempt: 1, PromptID: attemptKey.PromptID}
+	turnID, _ := turnKey.CanonicalID()
+	turn, err := s.CreateSessionTurn(ctx, store.CreateSessionTurnRequest{
+		Turn: store.SessionTurn{Key: turnKey, PromptAttemptID: attempt.ID,
+			RequestDigest: controlTestDigest("turn-unknown"), UserPrompt: "Publish a change.", CreatedAt: now.Add(6 * time.Minute)},
+		Fence: fence, ExpectedSessionVersion: control.Version,
+	})
+	if err != nil {
+		t.Fatalf("CreateSessionTurn: %v", err)
+	}
+	payload := json.RawMessage(`{"phase":"Failed","execution":"OutcomeUnknown","delivery":"PublicationOutcomeUnknown"}`)
+	_, err = s.FinalizeSessionTurn(ctx, store.FinalizeSessionTurnRequest{
+		Key: turnKey, Fence: fence, ExpectedSessionVersion: control.Version, ExpectedTurnVersion: turn.Version,
+		FinalizationDigest: controlTestDigest("unknown-finalization"), TerminalKind: store.SessionTurnOutcomeMarker,
+		TerminalContent: "Publication may have occurred; no assistant result was invented.", PublicationID: publication.ID,
+		BlockReason: "remote ref could not be observed after bounded verification",
+		Projection: store.OutboxProjection{ID: "outbox-unknown", AggregateKind: controlTestAggregateKind, AggregateID: turnID,
+			ProjectionKind: controlTestProjectionKind, Payload: payload, PayloadDigest: controlTestDigest(string(payload))},
+		FinalizedAt: now.Add(7 * time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("FinalizeSessionTurn unknown: %v", err)
+	}
+	blocked, err := s.GetSessionControl(ctx, control.Namespace, control.SessionName)
+	if err != nil || blocked.Availability != store.SessionReconciliationBlocked || blocked.Lease != nil {
+		t.Fatalf("blocked session = %#v, %v", blocked, err)
+	}
+	blockedClaim, err := s.GetBranchClaim(ctx, claim.ID)
+	if err != nil || blockedClaim.Availability != store.BranchClaimReconciliationBlocked || blockedClaim.RelatedPublicationID != publication.ID {
+		t.Fatalf("blocked branch claim = %#v, %v", blockedClaim, err)
+	}
+	if _, err := s.AcquireSessionMutationLease(ctx, store.AcquireSessionMutationLeaseRequest{
+		Namespace: blocked.Namespace, SessionName: blocked.SessionName, SessionUID: blocked.SessionUID,
+		Fence: fence, ExpectedVersion: blocked.Version, ExpectedLeaseGeneration: blocked.LeaseGeneration,
+		TaskUID: "new-task", Attempt: 1, PromptID: "new-prompt", RequestDigest: controlTestDigest("new-lease"),
+	}); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("blocked session lease error = %v, want ErrConflict", err)
+	}
+	if err := db.Close(); err != nil {
+		t.Fatalf("close before reconciliation: %v", err)
+	}
+	db, err = NewDB(dbPath)
+	if err != nil {
+		t.Fatalf("reopen before reconciliation: %v", err)
+	}
+	defer db.Close() //nolint:errcheck
+	s = NewStore(db, dbPath)
+	reconcileOperationID := "reconcile-unknown-publication"
+	reconcileOperationDigest := controlTestDigest(reconcileOperationID)
+	reconciled, err := s.ReconcileSessionControl(ctx, store.ReconcileSessionControlRequest{
+		Namespace: blocked.Namespace, SessionName: blocked.SessionName, SessionUID: blocked.SessionUID,
+		Fence: fence, ExpectedVersion: blocked.Version, ExpectedLeaseGeneration: blocked.LeaseGeneration,
+		ExpectedRelatedPublicationID: publication.ID, BranchClaimID: blockedClaim.ID,
+		ExpectedBranchClaimVersion: blockedClaim.Version, ExpectedBranchClaimGeneration: blockedClaim.Generation,
+		ExpectedBranchBaseline: blockedClaim.LastVerified,
+		VerifiedBaseline:       store.VerifiedBranchBaseline{RepositoryID: blockedClaim.RepositoryID, Ref: blockedClaim.Ref, SHA: controlTestGitSHA},
+		OperationID:            reconcileOperationID, OperationDigest: reconcileOperationDigest,
+		ReconciledAt: now.Add(8 * time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("ReconcileSessionControl: %v", err)
+	}
+	if reconciled.Availability != store.SessionAvailable || reconciled.VerifiedBaseline == nil || reconciled.VerifiedBaseline.SHA != controlTestGitSHA {
+		t.Fatalf("reconciled session = %#v", reconciled)
+	}
+	if retry, err := s.ReconcileSessionControl(ctx, store.ReconcileSessionControlRequest{
+		Namespace: blocked.Namespace, SessionName: blocked.SessionName, SessionUID: blocked.SessionUID,
+		Fence: fence, ExpectedVersion: blocked.Version, ExpectedLeaseGeneration: blocked.LeaseGeneration,
+		ExpectedRelatedPublicationID: publication.ID, BranchClaimID: blockedClaim.ID,
+		ExpectedBranchClaimVersion: blockedClaim.Version, ExpectedBranchClaimGeneration: blockedClaim.Generation,
+		ExpectedBranchBaseline: blockedClaim.LastVerified,
+		VerifiedBaseline:       *reconciled.VerifiedBaseline, OperationID: reconcileOperationID,
+		OperationDigest: reconcileOperationDigest, ReconciledAt: now.Add(8 * time.Minute),
+	}); err != nil || retry.Version != reconciled.Version {
+		t.Fatalf("idempotent session reconciliation retry = %#v, %v", retry, err)
+	}
+	reconciledClaim, err := s.GetBranchClaim(ctx, blockedClaim.ID)
+	if err != nil || reconciledClaim.Availability != store.BranchClaimAvailable || reconciledClaim.LastVerified.SHA != controlTestGitSHA {
+		t.Fatalf("reconciled branch claim = %#v, %v", reconciledClaim, err)
+	}
+	if _, err := s.AcquireSessionMutationLease(ctx, store.AcquireSessionMutationLeaseRequest{
+		Namespace: reconciled.Namespace, SessionName: reconciled.SessionName, SessionUID: reconciled.SessionUID,
+		Fence: fence, ExpectedVersion: reconciled.Version, ExpectedLeaseGeneration: reconciled.LeaseGeneration,
+		TaskUID: "new-task", Attempt: 1, PromptID: "new-prompt", RequestDigest: controlTestDigest("new-lease"),
+		AcquiredAt: now.Add(9 * time.Minute),
+	}); err != nil {
+		t.Fatalf("lease after reconciliation: %v", err)
+	}
+}
+
+//nolint:gocyclo // The test covers the full reserve, lease, retry, delivery, and dead-letter lifecycle.
+func TestExternalEffectAndOutboxRestartSafeLeases(t *testing.T) {
+	s := setupTestStore(t)
+	ctx := context.Background()
+	fence := seedControlEpoch(t, s)
+	now := time.Date(2026, 7, 24, 16, 0, 0, 0, time.UTC)
+	identity := store.ExternalEffectIdentity{Kind: "publisher.prepare", Namespace: "ns", AggregateID: "publication-1", OperationID: "prepare-1"}
+	effect, err := s.ReserveExternalEffect(ctx, store.ReserveExternalEffectRequest{
+		Identity: identity, RequestDigest: controlTestDigest("prepare-request"), Fence: fence, CreatedAt: now,
+	})
+	if err != nil {
+		t.Fatalf("ReserveExternalEffect: %v", err)
+	}
+	if _, err := s.ReserveExternalEffect(ctx, store.ReserveExternalEffectRequest{
+		Identity: identity, RequestDigest: effect.RequestDigest, Fence: fence, CreatedAt: now,
+	}); err != nil {
+		t.Fatalf("same external effect retry: %v", err)
+	}
+	if _, err := s.ReserveExternalEffect(ctx, store.ReserveExternalEffectRequest{
+		Identity: identity, RequestDigest: controlTestDigest("different-request"), Fence: fence, CreatedAt: now,
+	}); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("effect digest mismatch error = %v, want ErrConflict", err)
+	}
+	leaseExpiry := now.Add(time.Minute)
+	effect, err = s.TransitionExternalEffect(ctx, store.ExternalEffectTransition{
+		ID: effect.ID, Fence: fence, ExpectedVersion: effect.Version, ExpectedState: effect.State,
+		NewState: store.ExternalEffectInFlight, RequestDigest: effect.RequestDigest,
+		LeaseOwner: controlTestWorkerA, LeaseExpiresAt: &leaseExpiry, UpdatedAt: now,
+	})
+	if err != nil {
+		t.Fatalf("claim external effect: %v", err)
+	}
+	response := json.RawMessage(`{"tree":"0123456789012345678901234567890123456789"}`)
+	responseDigest := controlTestDigest(string(response))
+	if _, err := s.TransitionExternalEffect(ctx, store.ExternalEffectTransition{
+		ID: effect.ID, Fence: fence, ExpectedVersion: effect.Version, ExpectedState: effect.State,
+		NewState: store.ExternalEffectSucceeded, RequestDigest: effect.RequestDigest,
+		ExpectedLeaseOwner: "worker-b", Response: response, ResponseDigest: responseDigest,
+		UpdatedAt: now.Add(30 * time.Second),
+	}); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("non-owner external effect completion error = %v, want ErrConflict", err)
+	}
+	effect, err = s.TransitionExternalEffect(ctx, store.ExternalEffectTransition{
+		ID: effect.ID, Fence: fence, ExpectedVersion: effect.Version, ExpectedState: effect.State,
+		NewState: store.ExternalEffectSucceeded, RequestDigest: effect.RequestDigest,
+		ExpectedLeaseOwner: controlTestWorkerA, Response: response, ResponseDigest: responseDigest, UpdatedAt: now.Add(30 * time.Second),
+	})
+	if err != nil {
+		t.Fatalf("complete external effect: %v", err)
+	}
+	if effect.State != store.ExternalEffectSucceeded || effect.Attempts != 1 {
+		t.Fatalf("completed effect = %#v", effect)
+	}
+	if retry, err := s.TransitionExternalEffect(ctx, store.ExternalEffectTransition{
+		ID: effect.ID, Fence: fence, ExpectedVersion: 2, ExpectedState: store.ExternalEffectInFlight,
+		NewState: store.ExternalEffectSucceeded, RequestDigest: effect.RequestDigest,
+		ExpectedLeaseOwner: controlTestWorkerA, Response: response, ResponseDigest: responseDigest, UpdatedAt: now.Add(30 * time.Second),
+	}); err != nil || retry.Version != effect.Version {
+		t.Fatalf("idempotent effect completion = %#v, %v", retry, err)
+	}
+
+	payload := json.RawMessage(`{"task":"task-1","phase":"Succeeded"}`)
+	projection, err := s.EnqueueOutboxProjection(ctx, &store.OutboxProjection{
+		ID: "outbox-lease-test", AggregateKind: controlTestAggregateKind, AggregateID: "turn-1",
+		ProjectionKind: controlTestProjectionKind, Payload: payload, PayloadDigest: controlTestDigest(string(payload)),
+		CreatedAt: now,
+	}, fence)
+	if err != nil {
+		t.Fatalf("EnqueueOutboxProjection: %v", err)
+	}
+	if _, err := s.EnqueueOutboxProjection(ctx, &store.OutboxProjection{
+		ID: projection.ID, AggregateKind: projection.AggregateKind, AggregateID: projection.AggregateID,
+		ProjectionKind: projection.ProjectionKind, Payload: payload, PayloadDigest: projection.PayloadDigest,
+		CreatedAt: now, AvailableAt: now.Add(5 * time.Minute),
+	}, fence); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("outbox schedule mismatch error = %v, want ErrConflict", err)
+	}
+	claimed, err := s.ClaimOutboxProjections(ctx, store.ClaimOutboxProjectionsRequest{
+		Fence: fence, WorkerID: controlTestProjectorA, Limit: 10, LeaseDuration: time.Minute, Now: now,
+	})
+	if err != nil || len(claimed) != 1 || claimed[0].ID != projection.ID {
+		t.Fatalf("claimed outbox = %#v, %v", claimed, err)
+	}
+	projection = &claimed[0]
+	retryOperationID := "outbox-retry-1"
+	retryOperationDigest := controlTestDigest(retryOperationID)
+	pending, err := s.CompleteOutboxProjection(ctx, store.CompleteOutboxProjectionRequest{
+		ID: projection.ID, Fence: fence, ExpectedVersion: projection.Version, LeaseOwner: controlTestProjectorA,
+		OperationID: retryOperationID, OperationDigest: retryOperationDigest,
+		NewState: store.OutboxProjectionPending, LastError: "temporary API failure",
+		AvailableAt: now.Add(2 * time.Minute), UpdatedAt: now.Add(time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("retry outbox: %v", err)
+	}
+	if retried, err := s.CompleteOutboxProjection(ctx, store.CompleteOutboxProjectionRequest{
+		ID: projection.ID, Fence: fence, ExpectedVersion: projection.Version, LeaseOwner: controlTestProjectorA,
+		OperationID: retryOperationID, OperationDigest: retryOperationDigest,
+		NewState: store.OutboxProjectionPending, LastError: "temporary API failure",
+		AvailableAt: now.Add(2 * time.Minute), UpdatedAt: now.Add(time.Minute),
+	}); err != nil || retried.Version != pending.Version {
+		t.Fatalf("idempotent outbox retry completion = %#v, %v", retried, err)
+	}
+	if claimed, err := s.ClaimOutboxProjections(ctx, store.ClaimOutboxProjectionsRequest{
+		Fence: fence, WorkerID: controlTestProjectorB, Limit: 10, LeaseDuration: time.Minute, Now: now.Add(90 * time.Second),
+	}); err != nil || len(claimed) != 0 {
+		t.Fatalf("early claim = %#v, %v", claimed, err)
+	}
+	claimed, err = s.ClaimOutboxProjections(ctx, store.ClaimOutboxProjectionsRequest{
+		Fence: fence, WorkerID: controlTestProjectorB, Limit: 10, LeaseDuration: time.Minute, Now: now.Add(2 * time.Minute),
+	})
+	if err != nil || len(claimed) != 1 {
+		t.Fatalf("retry claim = %#v, %v", claimed, err)
+	}
+	deliveryDigest := controlTestDigest("task-status-resource-version-9")
+	delivered, err := s.CompleteOutboxProjection(ctx, store.CompleteOutboxProjectionRequest{
+		ID: claimed[0].ID, Fence: fence, ExpectedVersion: claimed[0].Version, LeaseOwner: controlTestProjectorB,
+		OperationID: "outbox-deliver-1", OperationDigest: controlTestDigest("outbox-deliver-1"),
+		NewState: store.OutboxProjectionDelivered, DeliveryDigest: deliveryDigest,
+		UpdatedAt: now.Add(150 * time.Second),
+	})
+	if err != nil {
+		t.Fatalf("deliver outbox: %v", err)
+	}
+	if delivered.State != store.OutboxProjectionDelivered || delivered.Attempts != 2 || delivered.DeliveredAt == nil {
+		t.Fatalf("delivered outbox = %#v", delivered)
+	}
+	if retry, err := s.CompleteOutboxProjection(ctx, store.CompleteOutboxProjectionRequest{
+		ID: delivered.ID, Fence: fence, ExpectedVersion: 1, LeaseOwner: controlTestProjectorB,
+		OperationID: "outbox-deliver-1", OperationDigest: controlTestDigest("outbox-deliver-1"),
+		NewState: store.OutboxProjectionDelivered, DeliveryDigest: deliveryDigest,
+		UpdatedAt: now.Add(150 * time.Second),
+	}); err != nil || retry.Version != delivered.Version {
+		t.Fatalf("idempotent delivery retry = %#v, %v", retry, err)
+	}
+	if retry, err := s.EnqueueOutboxProjection(ctx, &store.OutboxProjection{
+		ID: delivered.ID, AggregateKind: delivered.AggregateKind, AggregateID: delivered.AggregateID,
+		ProjectionKind: delivered.ProjectionKind, Payload: payload, PayloadDigest: delivered.PayloadDigest,
+	}, fence); err != nil || retry.State != store.OutboxProjectionDelivered {
+		t.Fatalf("schedule-omitted enqueue retry after delivery = %#v, %v", retry, err)
+	}
+
+	deadPayload := json.RawMessage(`{"task":"task-dead","phase":"Failed"}`)
+	dead, err := s.EnqueueOutboxProjection(ctx, &store.OutboxProjection{
+		ID: "outbox-dead-letter", AggregateKind: controlTestAggregateKind, AggregateID: "turn-dead",
+		ProjectionKind: controlTestProjectionKind, Payload: deadPayload,
+		PayloadDigest: controlTestDigest(string(deadPayload)), CreatedAt: now.Add(3 * time.Minute),
+	}, fence)
+	if err != nil {
+		t.Fatalf("enqueue dead-letter fixture: %v", err)
+	}
+	deadClaim, err := s.ClaimOutboxProjections(ctx, store.ClaimOutboxProjectionsRequest{
+		Fence: fence, WorkerID: controlTestProjectorA, Limit: 10, LeaseDuration: time.Minute,
+		Now: now.Add(3 * time.Minute),
+	})
+	if err != nil || len(deadClaim) != 1 || deadClaim[0].ID != dead.ID {
+		t.Fatalf("claim dead-letter fixture = %#v, %v", deadClaim, err)
+	}
+	deadOperationID := "outbox-dead-letter-1"
+	deadOperationDigest := controlTestDigest(deadOperationID)
+	dead, err = s.CompleteOutboxProjection(ctx, store.CompleteOutboxProjectionRequest{
+		ID: dead.ID, Fence: fence, ExpectedVersion: deadClaim[0].Version, LeaseOwner: controlTestProjectorA,
+		OperationID: deadOperationID, OperationDigest: deadOperationDigest,
+		NewState: store.OutboxProjectionDeadLetter, LastError: "permanent projection rejection",
+		UpdatedAt: now.Add(3*time.Minute + 30*time.Second),
+	})
+	if err != nil {
+		t.Fatalf("dead-letter outbox: %v", err)
+	}
+	if retry, err := s.CompleteOutboxProjection(ctx, store.CompleteOutboxProjectionRequest{
+		ID: dead.ID, Fence: fence, ExpectedVersion: deadClaim[0].Version, LeaseOwner: controlTestProjectorA,
+		OperationID: deadOperationID, OperationDigest: deadOperationDigest,
+		NewState: store.OutboxProjectionDeadLetter, LastError: "permanent projection rejection",
+		UpdatedAt: now.Add(3*time.Minute + 30*time.Second),
+	}); err != nil || retry.Version != dead.Version {
+		t.Fatalf("idempotent dead-letter retry = %#v, %v", retry, err)
+	}
+}
+
+func completePromptAttemptForFinalization(t *testing.T, s *Store, fence store.ControllerEpochFence, attempt *store.PromptAttempt, delivery store.PromptDeliveryState) *store.PromptAttempt {
+	t.Helper()
+	ctx := context.Background()
+	for _, state := range []store.PromptExecutionState{
+		store.PromptExecutionReserved, store.PromptExecutionSessionStarting, store.PromptExecutionPlanned,
+		store.PromptExecutionSubmitting, store.PromptExecutionAccepted, store.PromptExecutionRunning,
+		store.PromptExecutionSettling, store.PromptExecutionSucceeded,
+	} {
+		operationID := "complete-execution-" + string(state)
+		updated, err := s.TransitionPromptAttemptExecution(ctx, store.PromptAttemptExecutionTransition{
+			ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.ExecutionState,
+			NewState: state, OperationID: operationID, OperationDigest: controlTestDigest(operationID),
+			UpdatedAt: attempt.UpdatedAt.Add(time.Second),
+		})
+		if err != nil {
+			t.Fatalf("complete prompt execution to %s: %v", state, err)
+		}
+		attempt = updated
+	}
+	if delivery == store.PromptDeliveryNotRequested {
+		return attempt
+	}
+	for _, state := range []store.PromptDeliveryState{
+		store.PromptDeliveryValidating, store.PromptDeliveryPreparing, store.PromptDeliveryPrepared,
+		store.PromptDeliveryPublishing, store.PromptDeliveryVerifying, delivery,
+	} {
+		operationID := "complete-delivery-" + string(state)
+		updated, err := s.TransitionPromptAttemptDelivery(ctx, store.PromptAttemptDeliveryTransition{
+			ID: attempt.ID, Fence: fence, ExpectedVersion: attempt.Version, ExpectedState: attempt.DeliveryState,
+			NewState: state, OperationID: operationID, OperationDigest: controlTestDigest(operationID),
+			TerminalReason: "delivery reconciliation completed", UpdatedAt: attempt.UpdatedAt.Add(time.Second),
+		})
+		if err != nil {
+			t.Fatalf("complete prompt delivery to %s: %v", state, err)
+		}
+		attempt = updated
+	}
+	return attempt
+}
+
+func createVerifiedPublicationFixture(t *testing.T, s *Store, fence store.ControllerEpochFence, now time.Time, sessionUID string) (*store.BranchClaim, *store.Publication) {
+	t.Helper()
+	return createPublicationFixture(t, s, fence, now, sessionUID, store.PublicationVerifiedExact)
+}
+
+func createOutcomeUnknownPublicationFixture(t *testing.T, s *Store, fence store.ControllerEpochFence, now time.Time, sessionUID string) (*store.BranchClaim, *store.Publication) {
+	t.Helper()
+	return createPublicationFixture(t, s, fence, now, sessionUID, store.PublicationOutcomeUnknown)
+}
+
+func createPublicationFixture(t *testing.T, s *Store, fence store.ControllerEpochFence, now time.Time, sessionUID string, outcome store.PublicationState) (*store.BranchClaim, *store.Publication) {
+	t.Helper()
+	ctx := context.Background()
+	suffix := "verified"
+	taskSuffix := "final"
+	if outcome == store.PublicationOutcomeUnknown {
+		suffix = controlTestUnknownSuffix
+		taskSuffix = controlTestUnknownSuffix
+	}
+	claim, err := s.CreateBranchClaim(ctx, &store.BranchClaim{
+		RepositoryID: "github:orka/" + suffix, Ref: "refs/heads/orka/" + suffix,
+		OwnerKind: store.BranchClaimOwnerSession, OwnerUID: sessionUID, Generation: 1,
+		LastVerified: store.RemoteRefState{Absent: true}, RequestDigest: controlTestDigest("claim-" + suffix), CreatedAt: now,
+	}, fence)
+	if err != nil {
+		t.Fatalf("fixture CreateBranchClaim: %v", err)
+	}
+	publication, err := s.CreatePublication(ctx, &store.Publication{
+		ID: "publication-" + suffix, Namespace: "ns", Generation: 1,
+		TaskUID: "task-uid-" + taskSuffix,
+		Attempt: 1, PromptID: "prompt-" + taskSuffix,
+		SessionUID: sessionUID, BranchClaimID: claim.ID, BranchClaimGeneration: claim.Generation,
+		SourceRepositoryID: "github:orka/source", SourceBaselineSHA: controlTestGitSHA, SourceRef: "refs/heads/main",
+		TargetRepositoryID: claim.RepositoryID, TargetRef: claim.Ref, Baseline: claim.LastVerified,
+		ArtifactID: "sha256-artifact", ArtifactDigest: controlTestDigest("artifact-" + suffix), ArtifactSizeBytes: 128, ArtifactMediaType: "application/vnd.orka.workspace-delta.v1+tar", PublicationCredentialRef: "secret/ns/publisher#token",
+		CommitIdentity: "Orka <orka@example.invalid>", CommitMessage: "feat: " + suffix,
+		CommitTimestamp: now, RequestDigest: controlTestDigest("publication-" + suffix), CreatedAt: now,
+	}, fence)
+	if err != nil {
+		t.Fatalf("fixture CreatePublication: %v", err)
+	}
+	prepared := store.PreparedPublicationReceipt{
+		OperationID: "prepare-" + suffix, RequestDigest: controlTestDigest("prepare-response-" + suffix),
+		TreeSHA: controlTestGitSHA2, CommitSHA: controlTestGitSHA, ManifestDigest: controlTestDigest("manifest-" + suffix),
+		BundleArtifactID: "bundle-artifact-" + suffix, BundleDigest: controlTestDigest("bundle-" + suffix), BundleSizeBytes: 256,
+		BundleMediaType: store.PreparedBundleMediaType, BundleRef: "refs/orka/publications/" + strings.Repeat("f", 64),
+		PreparedAt: now.Add(time.Minute),
+	}
+	publication, err = s.TransitionPublication(ctx, store.PublicationTransition{
+		ID: publication.ID, Fence: fence, ExpectedVersion: publication.Version, ExpectedGeneration: publication.Generation,
+		ExpectedState: publication.State, NewState: store.PublicationPrepared,
+		OperationID: "prepare-" + suffix, OperationDigest: controlTestDigest("prepare-" + suffix), PreparedReceipt: &prepared, UpdatedAt: now.Add(time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("fixture prepare: %v", err)
+	}
+	publication, err = s.TransitionPublication(ctx, store.PublicationTransition{
+		ID: publication.ID, Fence: fence, ExpectedVersion: publication.Version, ExpectedGeneration: publication.Generation,
+		ExpectedState: publication.State, NewState: store.PublicationPublishing,
+		OperationID: "publish-cas-" + suffix, OperationDigest: controlTestDigest("publish-cas-" + suffix), UpdatedAt: now.Add(2 * time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("fixture publishing: %v", err)
+	}
+	publishReceipt := store.PublishOperationReceipt{
+		OperationID: "publish-" + suffix, RequestDigest: controlTestDigest("publish-" + suffix),
+		TargetRepositoryID: publication.TargetRepositoryID, TargetRef: publication.TargetRef,
+		RemoteBefore: publication.Baseline, ExpectedCommitSHA: prepared.CommitSHA,
+		AcknowledgementUnknown: outcome == store.PublicationOutcomeUnknown, PublishedAt: now.Add(3 * time.Minute),
+	}
+	publication, err = s.TransitionPublication(ctx, store.PublicationTransition{
+		ID: publication.ID, Fence: fence, ExpectedVersion: publication.Version, ExpectedGeneration: publication.Generation,
+		ExpectedState: publication.State, NewState: store.PublicationVerifying,
+		OperationID: publishReceipt.OperationID, OperationDigest: publishReceipt.RequestDigest,
+		PublishReceipt: &publishReceipt, UpdatedAt: now.Add(3 * time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("fixture verifying: %v", err)
+	}
+	verification := store.PublicationVerificationReceipt{
+		OperationID: "verify-" + suffix, RequestDigest: controlTestDigest("verify-" + suffix),
+		Outcome: outcome, ExpectedCommitSHA: prepared.CommitSHA, VerifiedAt: now.Add(4 * time.Minute),
+	}
+	terminalReason := ""
+	if outcome == store.PublicationVerifiedExact {
+		verification.ObservedRemote = store.RemoteRefState{SHA: prepared.CommitSHA}
+	} else {
+		terminalReason = "remote observation remained unavailable"
+	}
+	publication, err = s.TransitionPublication(ctx, store.PublicationTransition{
+		ID: publication.ID, Fence: fence, ExpectedVersion: publication.Version, ExpectedGeneration: publication.Generation,
+		ExpectedState: publication.State, NewState: outcome, OperationID: verification.OperationID,
+		OperationDigest: verification.RequestDigest, VerificationReceipt: &verification,
+		TerminalReason: terminalReason, UpdatedAt: now.Add(4 * time.Minute),
+	})
+	if err != nil {
+		t.Fatalf("fixture verification outcome %s: %v", outcome, err)
+	}
+	return claim, publication
+}
diff --git a/internal/store/sqlite/controller_epoch_store.go b/internal/store/sqlite/controller_epoch_store.go
new file mode 100644
index 000000000..03b0edc89
--- /dev/null
+++ b/internal/store/sqlite/controller_epoch_store.go
@@ -0,0 +1,227 @@
+package sqlite
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+// GetControllerEpoch returns the current durable controller epoch.
+func (s *Store) GetControllerEpoch(ctx context.Context, name string) (*store.ControllerEpoch, error) {
+	name, err := normalizeControllerEpochName(name)
+	if err != nil {
+		return nil, err
+	}
+	epoch, err := getControllerEpoch(ctx, s.db, name)
+	if err != nil {
+		return nil, err
+	}
+	return &epoch, nil
+}
+
+// CompareAndSwapControllerEpoch creates or advances the controller epoch with
+// exact version/epoch CAS semantics. A same-holder, same-digest retry of an
+// already committed target epoch is idempotent.
+func (s *Store) CompareAndSwapControllerEpoch(ctx context.Context, change store.ControllerEpochCAS) (*store.ControllerEpoch, error) {
+	change.Name = strings.TrimSpace(change.Name)
+	name, err := normalizeControllerEpochName(change.Name)
+	if err != nil {
+		return nil, err
+	}
+	change.Name = name
+	change.HolderID = strings.TrimSpace(change.HolderID)
+	if err := store.ValidateControlIdentifier("controller epoch holder ID", change.HolderID); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateCanonicalDigest("controller epoch request digest", change.RequestDigest); err != nil {
+		return nil, err
+	}
+	if change.ExpectedVersion < 0 || change.ExpectedEpoch < 0 {
+		return nil, store.ValidationErrorf("controller epoch expected version and epoch must not be negative")
+	}
+	if change.NewEpoch < 1 {
+		return nil, store.ValidationErrorf("controller new epoch must be at least 1")
+	}
+	change.UpdatedAt = normalizeControlTime(change.UpdatedAt)
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	current, err := getControllerEpoch(ctx, tx, change.Name)
+	if errors.Is(err, store.ErrNotFound) {
+		if change.ExpectedVersion != 0 || change.ExpectedEpoch != 0 || change.NewEpoch != 1 {
+			return nil, controlConflict("controller epoch %q does not exist; creation requires expected version/epoch 0 and new epoch 1", change.Name)
+		}
+		created := store.ControllerEpoch{
+			Name:          change.Name,
+			Epoch:         change.NewEpoch,
+			HolderID:      change.HolderID,
+			RequestDigest: change.RequestDigest,
+			Version:       1,
+			AcquiredAt:    change.UpdatedAt,
+			UpdatedAt:     change.UpdatedAt,
+		}
+		_, err = tx.ExecContext(ctx,
+			`INSERT INTO controller_epochs(name, epoch, holder_id, request_digest, version, acquired_at, updated_at)
+			 VALUES (?, ?, ?, ?, ?, ?, ?)`,
+			created.Name, created.Epoch, created.HolderID, created.RequestDigest, created.Version, created.AcquiredAt, created.UpdatedAt,
+		)
+		if err != nil {
+			if isSQLiteConstraintError(err) {
+				return nil, controlConflict("controller epoch %q was created concurrently", change.Name)
+			}
+			return nil, err
+		}
+		if err := tx.Commit(); err != nil {
+			return nil, err
+		}
+		return &created, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	if current.Epoch == change.NewEpoch {
+		if current.HolderID == change.HolderID && current.RequestDigest == change.RequestDigest {
+			return &current, nil
+		}
+		return nil, controlConflict("controller epoch %q target %d already exists with different holder or digest", change.Name, change.NewEpoch)
+	}
+	if current.Version != change.ExpectedVersion || current.Epoch != change.ExpectedEpoch {
+		return nil, controlConflict("controller epoch %q is version %d epoch %d, expected version %d epoch %d", change.Name, current.Version, current.Epoch, change.ExpectedVersion, change.ExpectedEpoch)
+	}
+	if change.NewEpoch != change.ExpectedEpoch+1 {
+		return nil, store.ValidationErrorf("controller epoch must advance exactly by one: expected new epoch %d", change.ExpectedEpoch+1)
+	}
+
+	result, err := tx.ExecContext(ctx,
+		`UPDATE controller_epochs
+		 SET epoch = ?, holder_id = ?, request_digest = ?, version = version + 1, acquired_at = ?, updated_at = ?
+		 WHERE name = ? AND version = ? AND epoch = ?`,
+		change.NewEpoch, change.HolderID, change.RequestDigest, change.UpdatedAt, change.UpdatedAt,
+		change.Name, change.ExpectedVersion, change.ExpectedEpoch,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if err := rowsAffectedExactlyOne(result, "controller epoch"); err != nil {
+		return nil, err
+	}
+	current.Epoch = change.NewEpoch
+	current.HolderID = change.HolderID
+	current.RequestDigest = change.RequestDigest
+	current.Version++
+	current.AcquiredAt = change.UpdatedAt
+	current.UpdatedAt = change.UpdatedAt
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &current, nil
+}
+
+// SyncControllerEpochMirror records the exact Kubernetes-authoritative epoch
+// used to fence SQLite payload mutations. It may move a stale mirror forward
+// after a crash between authoritative acquisition and mirror persistence, but
+// never rewinds or replaces conflicting evidence at the same epoch.
+func (s *Store) SyncControllerEpochMirror(ctx context.Context, authoritative store.ControllerEpoch) error {
+	name, err := normalizeControllerEpochName(authoritative.Name)
+	if err != nil {
+		return err
+	}
+	authoritative.Name = name
+	authoritative.HolderID = strings.TrimSpace(authoritative.HolderID)
+	if err := store.ValidateControlIdentifier("controller epoch holder ID", authoritative.HolderID); err != nil {
+		return err
+	}
+	if err := store.ValidateCanonicalDigest("controller epoch request digest", authoritative.RequestDigest); err != nil {
+		return err
+	}
+	if authoritative.Epoch < 1 || authoritative.Version < 1 {
+		return store.ValidationErrorf("mirrored controller epoch and version must be positive")
+	}
+	authoritative.AcquiredAt = normalizeControlTime(authoritative.AcquiredAt)
+	authoritative.UpdatedAt = normalizeControlTime(authoritative.UpdatedAt)
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("begin controller epoch mirror sync: %w", err)
+	}
+	defer func() { _ = tx.Rollback() }()
+	current, err := getControllerEpoch(ctx, tx, authoritative.Name)
+	if errors.Is(err, store.ErrNotFound) {
+		_, err = tx.ExecContext(ctx,
+			`INSERT INTO controller_epochs(name, epoch, holder_id, request_digest, version, acquired_at, updated_at)
+			 VALUES (?, ?, ?, ?, ?, ?, ?)`,
+			authoritative.Name, authoritative.Epoch, authoritative.HolderID, authoritative.RequestDigest,
+			authoritative.Version, authoritative.AcquiredAt, authoritative.UpdatedAt,
+		)
+		if err != nil {
+			if isSQLiteConstraintError(err) {
+				return controlConflict("controller epoch mirror %q was created concurrently", authoritative.Name)
+			}
+			return fmt.Errorf("create controller epoch mirror: %w", err)
+		}
+		if err := tx.Commit(); err != nil {
+			return fmt.Errorf("commit controller epoch mirror create: %w", err)
+		}
+		return nil
+	}
+	if err != nil {
+		return fmt.Errorf("read controller epoch mirror: %w", err)
+	}
+	if current.Epoch > authoritative.Epoch {
+		return controlConflict(
+			"controller epoch mirror %q is ahead at %d, authoritative epoch is %d",
+			authoritative.Name, current.Epoch, authoritative.Epoch,
+		)
+	}
+	if current.Epoch == authoritative.Epoch {
+		if current.HolderID != authoritative.HolderID || current.RequestDigest != authoritative.RequestDigest {
+			return controlConflict(
+				"controller epoch mirror %q conflicts at epoch %d", authoritative.Name, authoritative.Epoch,
+			)
+		}
+		return nil
+	}
+	result, err := tx.ExecContext(ctx,
+		`UPDATE controller_epochs
+		 SET epoch = ?, holder_id = ?, request_digest = ?, version = ?, acquired_at = ?, updated_at = ?
+		 WHERE name = ? AND epoch = ? AND holder_id = ?`,
+		authoritative.Epoch, authoritative.HolderID, authoritative.RequestDigest, authoritative.Version,
+		authoritative.AcquiredAt, authoritative.UpdatedAt,
+		authoritative.Name, current.Epoch, current.HolderID,
+	)
+	if err != nil {
+		return fmt.Errorf("update controller epoch mirror: %w", err)
+	}
+	if err := rowsAffectedExactlyOne(result, "controller epoch mirror"); err != nil {
+		return err
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("commit controller epoch mirror update: %w", err)
+	}
+	return nil
+}
+
+func getControllerEpoch(ctx context.Context, q controlQueryRower, name string) (store.ControllerEpoch, error) {
+	var epoch store.ControllerEpoch
+	err := q.QueryRowContext(ctx,
+		`SELECT name, epoch, holder_id, request_digest, version, acquired_at, updated_at
+		 FROM controller_epochs WHERE name = ?`,
+		name,
+	).Scan(&epoch.Name, &epoch.Epoch, &epoch.HolderID, &epoch.RequestDigest, &epoch.Version, &epoch.AcquiredAt, &epoch.UpdatedAt)
+	if errors.Is(err, sql.ErrNoRows) {
+		return store.ControllerEpoch{}, store.ErrNotFound
+	}
+	if err != nil {
+		return store.ControllerEpoch{}, fmt.Errorf("get controller epoch: %w", err)
+	}
+	return epoch, nil
+}
diff --git a/internal/store/sqlite/database_lock_other.go b/internal/store/sqlite/database_lock_other.go
new file mode 100644
index 000000000..d914c2354
--- /dev/null
+++ b/internal/store/sqlite/database_lock_other.go
@@ -0,0 +1,19 @@
+//go:build !darwin && !linux
+
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package sqlite
+
+import (
+	"fmt"
+	"io"
+	"runtime"
+)
+
+func lockDatabaseFile(string) (io.Closer, error) {
+	return nil, fmt.Errorf("process-lifetime SQLite locking is unsupported on %s", runtime.GOOS)
+}
diff --git a/internal/store/sqlite/database_lock_test.go b/internal/store/sqlite/database_lock_test.go
new file mode 100644
index 000000000..3615f2f5d
--- /dev/null
+++ b/internal/store/sqlite/database_lock_test.go
@@ -0,0 +1,64 @@
+//go:build darwin || linux
+
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package sqlite
+
+import (
+	"context"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestOpenLockedStoreExcludesOverlappingProcesses(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "orka.db")
+	first, err := OpenLockedStore(path)
+	if err != nil {
+		t.Fatalf("OpenLockedStore(first): %v", err)
+	}
+
+	if _, err := OpenLockedStore(path); err == nil || !strings.Contains(err.Error(), "process lock") {
+		t.Fatalf("OpenLockedStore(second) error = %v, want process lock conflict", err)
+	}
+
+	if err := first.close(); err != nil {
+		t.Fatalf("close first store: %v", err)
+	}
+	second, err := OpenLockedStore(path)
+	if err != nil {
+		t.Fatalf("OpenLockedStore(after release): %v", err)
+	}
+	if err := second.close(); err != nil {
+		t.Fatalf("close second store: %v", err)
+	}
+}
+
+func TestOpenLockedStoreRejectsNonFilesystemPaths(t *testing.T) {
+	for _, path := range []string{"", "  ", ":memory:"} {
+		t.Run(path, func(t *testing.T) {
+			if _, err := OpenLockedStore(path); err == nil {
+				t.Fatalf("OpenLockedStore(%q) error = nil", path)
+			}
+		})
+	}
+}
+
+func TestLockedStoreRunnableRequiresLeaderElection(t *testing.T) {
+	store, err := OpenLockedStore(filepath.Join(t.TempDir(), "orka.db"))
+	if err != nil {
+		t.Fatalf("OpenLockedStore: %v", err)
+	}
+	if !store.NeedLeaderElection() {
+		t.Fatal("NeedLeaderElection() = false, want true")
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	if err := store.Start(ctx); err != nil {
+		t.Fatalf("Start(cancelled): %v", err)
+	}
+}
diff --git a/internal/store/sqlite/database_lock_unix.go b/internal/store/sqlite/database_lock_unix.go
new file mode 100644
index 000000000..5531b59a7
--- /dev/null
+++ b/internal/store/sqlite/database_lock_unix.go
@@ -0,0 +1,66 @@
+//go:build darwin || linux
+
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package sqlite
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"golang.org/x/sys/unix"
+)
+
+const databaseLockSuffix = ".controller.lock"
+
+// lockDatabaseFile holds a non-blocking advisory lock adjacent to the SQLite
+// database. It deliberately runs before sql.Open and migrations.
+func lockDatabaseFile(databasePath string) (io.Closer, error) {
+	databasePath = strings.TrimSpace(databasePath)
+	if databasePath == "" || databasePath == ":memory:" {
+		return nil, fmt.Errorf("production SQLite database path must name a filesystem file")
+	}
+	lockPath := databasePath + databaseLockSuffix
+	if err := os.MkdirAll(filepath.Dir(lockPath), 0o750); err != nil {
+		return nil, fmt.Errorf("create SQLite lock directory: %w", err)
+	}
+	fd, err := unix.Open(lockPath, unix.O_CREAT|unix.O_RDWR|unix.O_CLOEXEC|unix.O_NOFOLLOW, 0o600)
+	if err != nil {
+		return nil, fmt.Errorf("open SQLite process lock %q: %w", lockPath, err)
+	}
+	file := os.NewFile(uintptr(fd), lockPath)
+	if file == nil {
+		_ = unix.Close(fd)
+		return nil, fmt.Errorf("create SQLite process lock handle %q", lockPath)
+	}
+	if err := unix.Flock(int(file.Fd()), unix.LOCK_EX|unix.LOCK_NB); err != nil {
+		_ = file.Close()
+		return nil, fmt.Errorf("acquire SQLite process lock %q: %w", lockPath, err)
+	}
+	return &databaseFileLock{file: file, path: lockPath}, nil
+}
+
+type databaseFileLock struct {
+	file *os.File
+	path string
+}
+
+func (l *databaseFileLock) Close() error {
+	if l == nil || l.file == nil {
+		return nil
+	}
+	unlockErr := unix.Flock(int(l.file.Fd()), unix.LOCK_UN)
+	closeErr := l.file.Close()
+	l.file = nil
+	if unlockErr != nil {
+		return fmt.Errorf("release SQLite process lock %q: %w", l.path, unlockErr)
+	}
+	return closeErr
+}
diff --git a/internal/store/sqlite/external_effect_store.go b/internal/store/sqlite/external_effect_store.go
new file mode 100644
index 000000000..a017fc2c4
--- /dev/null
+++ b/internal/store/sqlite/external_effect_store.go
@@ -0,0 +1,288 @@
+package sqlite
+
+import (
+	"bytes"
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+var _ store.ExternalEffectStore = (*Store)(nil)
+
+// ReserveExternalEffect creates or returns a durable same-digest effect identity.
+func (s *Store) ReserveExternalEffect(ctx context.Context, request store.ReserveExternalEffectRequest) (*store.ExternalEffect, error) {
+	request.Identity.Kind = strings.TrimSpace(request.Identity.Kind)
+	request.Identity.Namespace = strings.TrimSpace(request.Identity.Namespace)
+	request.Identity.AggregateID = strings.TrimSpace(request.Identity.AggregateID)
+	request.Identity.OperationID = strings.TrimSpace(request.Identity.OperationID)
+	if err := request.Identity.Validate(); err != nil {
+		return nil, err
+	}
+	id, err := request.Identity.CanonicalID()
+	if err != nil {
+		return nil, err
+	}
+	if err := store.ValidateCanonicalDigest("external effect request digest", request.RequestDigest); err != nil {
+		return nil, err
+	}
+	fence, err := normalizeEpochFence(request.Fence)
+	if err != nil {
+		return nil, err
+	}
+	request.Fence = fence
+	request.CreatedAt = normalizeControlTime(request.CreatedAt)
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, request.Fence); err != nil {
+		return nil, err
+	}
+	effect := store.ExternalEffect{
+		ID:                  id,
+		Identity:            request.Identity,
+		RequestDigest:       request.RequestDigest,
+		State:               store.ExternalEffectPending,
+		ControllerEpochName: request.Fence.Name,
+		ControllerEpoch:     request.Fence.Epoch,
+		Version:             1,
+		CreatedAt:           request.CreatedAt,
+		UpdatedAt:           request.CreatedAt,
+	}
+	_, err = tx.ExecContext(ctx,
+		`INSERT INTO external_effects(
+			id, kind, namespace, aggregate_id, operation_id, request_digest, state, response_digest,
+			response, lease_owner, lease_expires_at, attempts, controller_epoch_name,
+			controller_epoch, version, created_at, updated_at
+		) VALUES (?, ?, ?, ?, ?, ?, ?, '', NULL, '', NULL, 0, ?, ?, 1, ?, ?)`,
+		effect.ID, effect.Identity.Kind, effect.Identity.Namespace, effect.Identity.AggregateID,
+		effect.Identity.OperationID, effect.RequestDigest, string(effect.State),
+		effect.ControllerEpochName, effect.ControllerEpoch, effect.CreatedAt, effect.UpdatedAt,
+	)
+	if err != nil {
+		if !isSQLiteConstraintError(err) {
+			return nil, err
+		}
+		existing, getErr := getExternalEffect(ctx, tx, effect.ID)
+		if getErr == nil && existing.Identity == effect.Identity && existing.RequestDigest == effect.RequestDigest {
+			return &existing, nil
+		}
+		return nil, controlConflict("external effect %q was reused with a different identity or request digest", effect.ID)
+	}
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &effect, nil
+}
+
+// GetExternalEffect returns one durable external-effect record.
+func (s *Store) GetExternalEffect(ctx context.Context, id string) (*store.ExternalEffect, error) {
+	id = strings.TrimSpace(id)
+	if err := store.ValidateControlIdentifier("external effect ID", id); err != nil {
+		return nil, err
+	}
+	effect, err := getExternalEffect(ctx, s.db, id)
+	if err != nil {
+		return nil, err
+	}
+	return &effect, nil
+}
+
+// TransitionExternalEffect applies an exact version/state/epoch CAS. Terminal
+// same-response retries are idempotent; request-digest mismatch always conflicts.
+//
+//nolint:gocyclo // State, lease, digest, and terminal-response invariants are validated together.
+func (s *Store) TransitionExternalEffect(ctx context.Context, transition store.ExternalEffectTransition) (*store.ExternalEffect, error) {
+	transition.ID = strings.TrimSpace(transition.ID)
+	if err := store.ValidateControlIdentifier("external effect ID", transition.ID); err != nil {
+		return nil, err
+	}
+	fence, err := normalizeEpochFence(transition.Fence)
+	if err != nil {
+		return nil, err
+	}
+	transition.Fence = fence
+	if transition.ExpectedVersion < 1 {
+		return nil, store.ValidationErrorf("external effect expected version must be at least 1")
+	}
+	if !isKnownExternalEffectState(transition.ExpectedState) || !isKnownExternalEffectState(transition.NewState) {
+		return nil, store.ValidationErrorf("unsupported external effect transition %q -> %q", transition.ExpectedState, transition.NewState)
+	}
+	if !validExternalEffectTransition(transition.ExpectedState, transition.NewState) {
+		return nil, store.ValidationErrorf("external effect transition %s -> %s is not allowed", transition.ExpectedState, transition.NewState)
+	}
+	if err := store.ValidateCanonicalDigest("external effect request digest", transition.RequestDigest); err != nil {
+		return nil, err
+	}
+	transition.ExpectedLeaseOwner = strings.TrimSpace(transition.ExpectedLeaseOwner)
+	transition.LeaseOwner = strings.TrimSpace(transition.LeaseOwner)
+	transition.LeaseExpiresAt = normalizeOptionalControlTime(transition.LeaseExpiresAt)
+	transition.UpdatedAt = normalizeControlTime(transition.UpdatedAt)
+	if transition.ExpectedState == store.ExternalEffectInFlight {
+		if err := store.ValidateControlIdentifier("expected external effect lease owner", transition.ExpectedLeaseOwner); err != nil {
+			return nil, err
+		}
+	} else if transition.ExpectedLeaseOwner != "" {
+		return nil, store.ValidationErrorf("pending external effect transition must not set an expected lease owner")
+	}
+	if transition.NewState == store.ExternalEffectInFlight {
+		if err := store.ValidateControlIdentifier("external effect lease owner", transition.LeaseOwner); err != nil {
+			return nil, err
+		}
+		if transition.LeaseExpiresAt == nil || !transition.LeaseExpiresAt.After(transition.UpdatedAt) {
+			return nil, store.ValidationErrorf("in-flight external effect requires a future lease expiry")
+		}
+		if len(transition.Response) > 0 || transition.ResponseDigest != "" {
+			return nil, store.ValidationErrorf("in-flight external effect must not include a response")
+		}
+	} else {
+		if transition.LeaseOwner != "" || transition.LeaseExpiresAt != nil {
+			return nil, store.ValidationErrorf("non-in-flight external effect must clear lease fields")
+		}
+		if len(transition.Response) > 0 {
+			if err := store.ValidateControlPayload("external effect response", transition.Response); err != nil {
+				return nil, err
+			}
+			if err := store.ValidateCanonicalDigest("external effect response digest", transition.ResponseDigest); err != nil {
+				return nil, err
+			}
+			if canonicalBytesDigest(transition.Response) != transition.ResponseDigest {
+				return nil, store.ValidationErrorf("external effect response digest does not match response bytes")
+			}
+		} else if transition.ResponseDigest != "" {
+			return nil, store.ValidationErrorf("external effect response digest requires response bytes")
+		}
+	}
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, transition.Fence); err != nil {
+		return nil, err
+	}
+	effect, err := getExternalEffect(ctx, tx, transition.ID)
+	if err != nil {
+		return nil, err
+	}
+	if effect.RequestDigest != transition.RequestDigest {
+		return nil, controlConflict("external effect %q request digest does not match reserved identity", effect.ID)
+	}
+	if effect.State == transition.NewState && effect.ResponseDigest == transition.ResponseDigest &&
+		bytes.Equal(effect.Response, transition.Response) && effect.LeaseOwner == transition.LeaseOwner &&
+		equalOptionalTime(effect.LeaseExpiresAt, transition.LeaseExpiresAt) {
+		return &effect, nil
+	}
+	if effect.Version != transition.ExpectedVersion || effect.State != transition.ExpectedState || effect.LeaseOwner != transition.ExpectedLeaseOwner {
+		return nil, controlConflict("external effect %q no longer matches expected version, state, or lease owner", effect.ID)
+	}
+	if transition.ExpectedState == store.ExternalEffectInFlight && transition.NewState == store.ExternalEffectInFlight &&
+		effect.LeaseOwner != transition.LeaseOwner && effect.LeaseExpiresAt != nil && effect.LeaseExpiresAt.After(transition.UpdatedAt) {
+		return nil, controlConflict("external effect %q is still leased by %q", effect.ID, effect.LeaseOwner)
+	}
+
+	attemptIncrement := int64(0)
+	if transition.NewState == store.ExternalEffectInFlight {
+		attemptIncrement = 1
+	}
+	result, err := tx.ExecContext(ctx,
+		`UPDATE external_effects
+		 SET state = ?, response_digest = ?, response = ?, lease_owner = ?, lease_expires_at = ?,
+		     attempts = attempts + ?, controller_epoch_name = ?, controller_epoch = ?,
+		     version = version + 1, updated_at = ?
+		 WHERE id = ? AND version = ? AND state = ? AND request_digest = ? AND lease_owner = ?`,
+		string(transition.NewState), transition.ResponseDigest, []byte(transition.Response), transition.LeaseOwner,
+		nullTimeValue(transition.LeaseExpiresAt), attemptIncrement, transition.Fence.Name,
+		transition.Fence.Epoch, transition.UpdatedAt, transition.ID, transition.ExpectedVersion,
+		string(transition.ExpectedState), transition.RequestDigest, transition.ExpectedLeaseOwner,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if err := rowsAffectedExactlyOne(result, "external effect"); err != nil {
+		return nil, err
+	}
+	effect.State = transition.NewState
+	effect.ResponseDigest = transition.ResponseDigest
+	effect.Response = append(effect.Response[:0], transition.Response...)
+	effect.LeaseOwner = transition.LeaseOwner
+	effect.LeaseExpiresAt = transition.LeaseExpiresAt
+	effect.Attempts += attemptIncrement
+	effect.ControllerEpochName = transition.Fence.Name
+	effect.ControllerEpoch = transition.Fence.Epoch
+	effect.Version++
+	effect.UpdatedAt = transition.UpdatedAt
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &effect, nil
+}
+
+func isKnownExternalEffectState(state store.ExternalEffectState) bool {
+	switch state {
+	case store.ExternalEffectPending, store.ExternalEffectInFlight, store.ExternalEffectSucceeded,
+		store.ExternalEffectFailed, store.ExternalEffectOutcomeUnknown:
+		return true
+	default:
+		return false
+	}
+}
+
+func validExternalEffectTransition(from, to store.ExternalEffectState) bool {
+	switch from {
+	case store.ExternalEffectPending:
+		return to == store.ExternalEffectInFlight || to == store.ExternalEffectSucceeded ||
+			to == store.ExternalEffectFailed || to == store.ExternalEffectOutcomeUnknown
+	case store.ExternalEffectInFlight:
+		return to == store.ExternalEffectInFlight || to == store.ExternalEffectSucceeded ||
+			to == store.ExternalEffectFailed || to == store.ExternalEffectOutcomeUnknown
+	default:
+		return false
+	}
+}
+
+func equalOptionalTime(a, b *time.Time) bool {
+	if a == nil || b == nil {
+		return a == nil && b == nil
+	}
+	return a.Equal(*b)
+}
+
+func getExternalEffect(ctx context.Context, q controlQueryRower, id string) (store.ExternalEffect, error) {
+	var effect store.ExternalEffect
+	var response []byte
+	var leaseExpiry sql.NullTime
+	err := q.QueryRowContext(ctx,
+		`SELECT id, kind, namespace, aggregate_id, operation_id, request_digest, state,
+		        response_digest, response, lease_owner, lease_expires_at, attempts,
+		        controller_epoch_name, controller_epoch, version, created_at, updated_at
+		 FROM external_effects WHERE id = ?`, id,
+	).Scan(
+		&effect.ID, &effect.Identity.Kind, &effect.Identity.Namespace, &effect.Identity.AggregateID,
+		&effect.Identity.OperationID, &effect.RequestDigest, &effect.State, &effect.ResponseDigest,
+		&response, &effect.LeaseOwner, &leaseExpiry, &effect.Attempts, &effect.ControllerEpochName,
+		&effect.ControllerEpoch, &effect.Version, &effect.CreatedAt, &effect.UpdatedAt,
+	)
+	if errors.Is(err, sql.ErrNoRows) {
+		return store.ExternalEffect{}, store.ErrNotFound
+	}
+	if err != nil {
+		return store.ExternalEffect{}, fmt.Errorf("get external effect: %w", err)
+	}
+	if len(response) > 0 {
+		effect.Response = append(effect.Response, response...)
+	}
+	if leaseExpiry.Valid {
+		value := leaseExpiry.Time
+		effect.LeaseExpiresAt = &value
+	}
+	return effect, nil
+}
diff --git a/internal/store/sqlite/harness_v1_attempt_store.go b/internal/store/sqlite/harness_v1_attempt_store.go
new file mode 100644
index 000000000..0c7388ac9
--- /dev/null
+++ b/internal/store/sqlite/harness_v1_attempt_store.go
@@ -0,0 +1,450 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package sqlite
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+// CreateHarnessV1Attempt implements store.HarnessV1AttemptStore.
+func (s *Store) CreateHarnessV1Attempt(
+	ctx context.Context,
+	attempt *store.HarnessV1Attempt,
+	fence store.ControllerEpochFence,
+) error {
+	if err := attempt.Validate(); err != nil {
+		return err
+	}
+	fence, err := normalizeEpochFence(fence)
+	if err != nil {
+		return err
+	}
+	normalized := *attempt
+	normalized.ControllerEpochName = fence.Name
+	normalized.ControllerEpoch = fence.Epoch
+	key := store.HarnessV1AttemptKey{
+		Namespace: normalized.Namespace,
+		TaskUID:   normalized.TaskUID,
+		Attempt:   normalized.Attempt,
+	}
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("begin harness v1 attempt create: %w", err)
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, fence); err != nil {
+		return err
+	}
+
+	now := time.Now().UTC()
+	result, err := tx.ExecContext(ctx, `INSERT INTO harness_v1_attempts
+		(id, namespace, task_name, task_uid, attempt, binding_digest, snapshot_digest, request_digest,
+		 turn_id, runtime_session_id, correlation_id, backend, backend_endpoint,
+		 auth_secret_namespace, auth_secret_name, auth_secret_key, auth_secret_uid, auth_secret_resource_version,
+		 state, last_event_seq, terminal_receipt_digest, terminal_reason, duplicate_safe, retry_class,
+		 controller_epoch_name, controller_epoch, last_operation_id, last_operation_digest,
+		 version, created_at, updated_at)
+		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, '', '', ?, ?, ?, ?, '', '', 1, ?, ?)
+		ON CONFLICT(namespace, task_uid, attempt) DO NOTHING`,
+		key.CanonicalID(), normalized.Namespace, normalized.TaskName, normalized.TaskUID, normalized.Attempt,
+		normalized.BindingDigest, normalized.SnapshotDigest, normalized.RequestDigest,
+		normalized.TurnID, normalized.RuntimeSessionID, normalized.CorrelationID, normalized.Backend, normalized.BackendEndpoint,
+		normalized.AuthSecretNamespace, normalized.AuthSecretName, normalized.AuthSecretKey, normalized.AuthSecretUID, normalized.AuthSecretResourceVersion,
+		string(store.HarnessV1AttemptPrepared), normalized.DuplicateSafe, string(normalized.RetryClass),
+		normalized.ControllerEpochName, normalized.ControllerEpoch, now, now)
+	if err != nil {
+		return fmt.Errorf("create harness v1 attempt: %w", err)
+	}
+	affected, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("create harness v1 attempt rows: %w", err)
+	}
+	switch affected {
+	case 0:
+		existing, getErr := scanHarnessV1Attempt(tx.QueryRowContext(ctx, harnessV1AttemptSelectSQL+`
+			WHERE namespace = ? AND task_uid = ? AND attempt = ?`,
+			key.Namespace, key.TaskUID, key.Attempt))
+		if errors.Is(getErr, sql.ErrNoRows) {
+			return fmt.Errorf("%w: harness v1 attempt %s conflicted without a readable row",
+				store.ErrConflict, key.CanonicalID())
+		}
+		if getErr != nil {
+			return fmt.Errorf("read conflicting harness v1 attempt: %w", getErr)
+		}
+		if !sameHarnessV1AttemptCreation(*existing, normalized) {
+			return fmt.Errorf("%w: harness v1 attempt %s already exists with different immutable content",
+				store.ErrDuplicateMismatch, key.CanonicalID())
+		}
+	case 1:
+	default:
+		return fmt.Errorf("%w: harness v1 attempt %s create affected %d rows",
+			store.ErrConflict, key.CanonicalID(), affected)
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("commit harness v1 attempt create: %w", err)
+	}
+	return nil
+}
+
+// GetHarnessV1Attempt implements store.HarnessV1AttemptStore.
+func (s *Store) GetHarnessV1Attempt(ctx context.Context, key store.HarnessV1AttemptKey) (*store.HarnessV1Attempt, error) {
+	if err := key.Validate(); err != nil {
+		return nil, err
+	}
+	attempt, err := scanHarnessV1Attempt(s.db.QueryRowContext(ctx, harnessV1AttemptSelectSQL+`
+		WHERE namespace = ? AND task_uid = ? AND attempt = ?`, key.Namespace, key.TaskUID, key.Attempt))
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, store.ErrNotFound
+	}
+	if err != nil {
+		return nil, fmt.Errorf("get harness v1 attempt: %w", err)
+	}
+	return attempt, nil
+}
+
+// ListHarnessV1AttemptsByTask implements store.HarnessV1AttemptStore.
+func (s *Store) ListHarnessV1AttemptsByTask(ctx context.Context, namespace, taskUID string) ([]store.HarnessV1Attempt, error) {
+	if strings.TrimSpace(namespace) == "" || strings.TrimSpace(taskUID) == "" {
+		return nil, store.ValidationErrorf("harness v1 attempt namespace and task UID are required")
+	}
+	rows, err := s.db.QueryContext(ctx, harnessV1AttemptSelectSQL+`
+		WHERE namespace = ? AND task_uid = ? ORDER BY attempt ASC`, namespace, taskUID)
+	if err != nil {
+		return nil, fmt.Errorf("list harness v1 attempts: %w", err)
+	}
+	return collectHarnessV1Attempts(rows)
+}
+
+// ListActiveHarnessV1Attempts implements store.HarnessV1AttemptStore.
+func (s *Store) ListActiveHarnessV1Attempts(ctx context.Context) ([]store.HarnessV1Attempt, error) {
+	rows, err := s.db.QueryContext(ctx, harnessV1AttemptSelectSQL+`
+		WHERE state NOT IN ('Rejected','Succeeded','Failed','Cancelled','OutcomeUnknown')
+		ORDER BY updated_at ASC, id ASC`)
+	if err != nil {
+		return nil, fmt.Errorf("list active harness v1 attempts: %w", err)
+	}
+	return collectHarnessV1Attempts(rows)
+}
+
+// ReclaimHarnessV1Attempts implements store.HarnessV1AttemptStore. Attempt
+// removal is fenced by the current controller epoch and re-proves every
+// terminal and Session/outbox barrier in one SQLite transaction.
+func (s *Store) ReclaimHarnessV1Attempts(
+	ctx context.Context,
+	request store.ReclaimHarnessV1AttemptsRequest,
+) (int, error) {
+	request.Namespace = strings.TrimSpace(request.Namespace)
+	request.TaskUID = strings.TrimSpace(request.TaskUID)
+	request.BindingDigest = strings.TrimSpace(request.BindingDigest)
+	if request.Namespace == "" || request.TaskUID == "" {
+		return 0, store.ValidationErrorf("harness v1 reclamation namespace and task UID are required")
+	}
+	if err := store.ValidateCanonicalDigest("harness v1 reclamation binding digest", request.BindingDigest); err != nil {
+		return 0, err
+	}
+	fence, err := normalizeEpochFence(request.Fence)
+	if err != nil {
+		return 0, err
+	}
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return 0, fmt.Errorf("begin harness v1 attempt reclamation: %w", err)
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, fence); err != nil {
+		return 0, err
+	}
+	rows, err := tx.QueryContext(ctx, harnessV1AttemptSelectSQL+`
+		WHERE namespace = ? AND task_uid = ? ORDER BY attempt ASC`, request.Namespace, request.TaskUID)
+	if err != nil {
+		return 0, fmt.Errorf("list harness v1 attempts for reclamation: %w", err)
+	}
+	attempts, err := collectHarnessV1Attempts(rows)
+	if err != nil {
+		return 0, err
+	}
+	for i := range attempts {
+		attempt := &attempts[i]
+		if attempt.BindingDigest != request.BindingDigest {
+			return 0, fmt.Errorf("%w: harness v1 attempt binding changed before reclamation", store.ErrConflict)
+		}
+		if !store.IsTerminalHarnessV1AttemptState(attempt.State) {
+			return 0, fmt.Errorf("%w: harness v1 attempt %s is not terminal", store.ErrNotReady,
+				(store.HarnessV1AttemptKey{Namespace: attempt.Namespace, TaskUID: attempt.TaskUID, Attempt: attempt.Attempt}).CanonicalID())
+		}
+		if !request.SessionRequired || harnessV1AttemptHasNoSessionSideEffect(*attempt) {
+			continue
+		}
+		ref := (store.HarnessV1AttemptKey{
+			Namespace: attempt.Namespace, TaskUID: attempt.TaskUID, Attempt: attempt.Attempt,
+		}).SessionReferenceID()
+		var turnState, projectionID string
+		err := tx.QueryRowContext(ctx, `SELECT state, projection_id FROM session_turns
+			WHERE prompt_attempt_id = ?`, ref).Scan(&turnState, &projectionID)
+		if errors.Is(err, sql.ErrNoRows) {
+			return 0, fmt.Errorf("%w: harness v1 attempt %s has no durable SessionTurn", store.ErrNotReady, ref)
+		}
+		if err != nil {
+			return 0, fmt.Errorf("load harness v1 SessionTurn for reclamation: %w", err)
+		}
+		if turnState != string(store.SessionTurnFinalized) || strings.TrimSpace(projectionID) == "" {
+			return 0, fmt.Errorf("%w: harness v1 SessionTurn %s is not finalized", store.ErrNotReady, ref)
+		}
+		var projectionState string
+		if err := tx.QueryRowContext(ctx, `SELECT state FROM outbox_projections WHERE id = ?`, projectionID).Scan(&projectionState); err != nil {
+			if errors.Is(err, sql.ErrNoRows) {
+				return 0, fmt.Errorf("%w: harness v1 SessionTurn %s has no terminal projection", store.ErrNotReady, ref)
+			}
+			return 0, fmt.Errorf("load harness v1 SessionTurn projection for reclamation: %w", err)
+		}
+		if projectionState != string(store.OutboxProjectionDelivered) {
+			return 0, fmt.Errorf("%w: harness v1 SessionTurn projection %s is %s", store.ErrNotReady, projectionID, projectionState)
+		}
+	}
+	result, err := tx.ExecContext(ctx, `DELETE FROM harness_v1_attempts WHERE namespace = ? AND task_uid = ?`, request.Namespace, request.TaskUID)
+	if err != nil {
+		return 0, fmt.Errorf("reclaim harness v1 attempts: %w", err)
+	}
+	deleted, err := result.RowsAffected()
+	if err != nil {
+		return 0, fmt.Errorf("reclaim harness v1 attempt rows: %w", err)
+	}
+	if deleted != int64(len(attempts)) {
+		return 0, fmt.Errorf("%w: harness v1 reclamation deleted %d of %d attempts", store.ErrConflict, deleted, len(attempts))
+	}
+	if err := tx.Commit(); err != nil {
+		return 0, fmt.Errorf("commit harness v1 attempt reclamation: %w", err)
+	}
+	return int(deleted), nil
+}
+
+func harnessV1AttemptHasNoSessionSideEffect(attempt store.HarnessV1Attempt) bool {
+	if attempt.TerminalReceiptDigest != "" {
+		return false
+	}
+	if attempt.State == store.HarnessV1AttemptCancelled {
+		return true
+	}
+	if attempt.State != store.HarnessV1AttemptRejected {
+		return false
+	}
+	switch attempt.TerminalReason {
+	case "BackendDisabled", "CredentialChanged", "InvalidBinding", "SessionConflict":
+		return true
+	default:
+		return false
+	}
+}
+
+// TransitionHarnessV1Attempt implements store.HarnessV1AttemptStore.
+func (s *Store) TransitionHarnessV1Attempt(ctx context.Context, transition store.HarnessV1AttemptTransition) (*store.HarnessV1Attempt, error) {
+	if err := transition.Key.Validate(); err != nil {
+		return nil, err
+	}
+	if strings.TrimSpace(transition.OperationID) == "" {
+		return nil, store.ValidationErrorf("harness v1 attempt transition operation ID is required")
+	}
+	if err := store.ValidateCanonicalDigest("harness v1 attempt operation digest", transition.OperationDigest); err != nil {
+		return nil, err
+	}
+	fence, err := normalizeEpochFence(transition.Fence)
+	if err != nil {
+		return nil, err
+	}
+	transition.Fence = fence
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, fmt.Errorf("begin harness v1 attempt transition: %w", err)
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, transition.Fence); err != nil {
+		return nil, err
+	}
+
+	current, err := scanHarnessV1Attempt(tx.QueryRowContext(ctx, harnessV1AttemptSelectSQL+`
+		WHERE namespace = ? AND task_uid = ? AND attempt = ?`,
+		transition.Key.Namespace, transition.Key.TaskUID, transition.Key.Attempt))
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, store.ErrNotFound
+	}
+	if err != nil {
+		return nil, fmt.Errorf("read harness v1 attempt: %w", err)
+	}
+
+	// Idempotent replay of an already-applied operation.
+	if current.LastOperationID == transition.OperationID {
+		if current.LastOperationDigest != transition.OperationDigest || current.State != transition.TargetState {
+			return nil, fmt.Errorf("%w: harness v1 attempt %s operation %s was applied with different content",
+				store.ErrConflict, transition.Key.CanonicalID(), transition.OperationID)
+		}
+		if err := tx.Commit(); err != nil {
+			return nil, fmt.Errorf("commit harness v1 attempt replay: %w", err)
+		}
+		return current, nil
+	}
+
+	if current.Version != transition.ExpectedVersion {
+		return nil, fmt.Errorf("%w: harness v1 attempt %s version %d does not match expected %d",
+			store.ErrConflict, transition.Key.CanonicalID(), current.Version, transition.ExpectedVersion)
+	}
+	if current.State != transition.ExpectedState {
+		return nil, fmt.Errorf("%w: harness v1 attempt %s state %s does not match expected %s",
+			store.ErrConflict, transition.Key.CanonicalID(), current.State, transition.ExpectedState)
+	}
+	if err := store.ValidateHarnessV1AttemptTransition(current.State, transition.TargetState); err != nil {
+		return nil, err
+	}
+
+	updated := *current
+	updated.State = transition.TargetState
+	updated.Version = current.Version + 1
+	updated.LastOperationID = transition.OperationID
+	updated.LastOperationDigest = transition.OperationDigest
+	if transition.Fence.Name != "" {
+		updated.ControllerEpochName = transition.Fence.Name
+		updated.ControllerEpoch = transition.Fence.Epoch
+	}
+	applyHarnessV1AttemptUpdates(&updated, transition.Updates)
+	if transition.TargetState == store.HarnessV1AttemptOutcomeUnknown && updated.TerminalReason == "" {
+		return nil, store.ValidationErrorf("harness v1 attempt OutcomeUnknown requires a terminal reason")
+	}
+	updated.UpdatedAt = time.Now().UTC()
+
+	var cancelRequestedAt any
+	if updated.CancelRequestedAt != nil {
+		cancelRequestedAt = updated.CancelRequestedAt.UTC()
+	}
+	result, err := tx.ExecContext(ctx, `UPDATE harness_v1_attempts SET
+			state = ?, runtime_session_id = ?, correlation_id = ?, backend_endpoint = ?,
+			last_event_seq = ?, cancel_requested_at = ?, terminal_receipt_digest = ?, terminal_reason = ?,
+			controller_epoch_name = ?, controller_epoch = ?, last_operation_id = ?, last_operation_digest = ?,
+			version = ?, updated_at = ?
+		WHERE namespace = ? AND task_uid = ? AND attempt = ? AND version = ?`,
+		string(updated.State), updated.RuntimeSessionID, updated.CorrelationID, updated.BackendEndpoint,
+		updated.LastEventSeq, cancelRequestedAt, updated.TerminalReceiptDigest, updated.TerminalReason,
+		updated.ControllerEpochName, updated.ControllerEpoch, updated.LastOperationID, updated.LastOperationDigest,
+		updated.Version, updated.UpdatedAt,
+		transition.Key.Namespace, transition.Key.TaskUID, transition.Key.Attempt, current.Version)
+	if err != nil {
+		return nil, fmt.Errorf("transition harness v1 attempt: %w", err)
+	}
+	affected, err := result.RowsAffected()
+	if err != nil {
+		return nil, fmt.Errorf("transition harness v1 attempt rows: %w", err)
+	}
+	if affected != 1 {
+		return nil, fmt.Errorf("%w: harness v1 attempt %s was concurrently modified",
+			store.ErrConflict, transition.Key.CanonicalID())
+	}
+	if err := tx.Commit(); err != nil {
+		return nil, fmt.Errorf("commit harness v1 attempt transition: %w", err)
+	}
+	return &updated, nil
+}
+
+func applyHarnessV1AttemptUpdates(attempt *store.HarnessV1Attempt, updates store.HarnessV1AttemptUpdates) {
+	if updates.RuntimeSessionID != nil {
+		attempt.RuntimeSessionID = *updates.RuntimeSessionID
+	}
+	if updates.CorrelationID != nil {
+		attempt.CorrelationID = *updates.CorrelationID
+	}
+	if updates.BackendEndpoint != nil {
+		attempt.BackendEndpoint = *updates.BackendEndpoint
+	}
+	if updates.LastEventSeq != nil {
+		attempt.LastEventSeq = *updates.LastEventSeq
+	}
+	if updates.CancelRequestedAt != nil {
+		requestedAt := updates.CancelRequestedAt.UTC()
+		attempt.CancelRequestedAt = &requestedAt
+	}
+	if updates.TerminalReceiptDigest != nil {
+		attempt.TerminalReceiptDigest = *updates.TerminalReceiptDigest
+	}
+	if updates.TerminalReason != nil {
+		attempt.TerminalReason = *updates.TerminalReason
+	}
+}
+
+func sameHarnessV1AttemptCreation(a, b store.HarnessV1Attempt) bool {
+	return a.Namespace == b.Namespace &&
+		a.TaskName == b.TaskName &&
+		a.TaskUID == b.TaskUID &&
+		a.Attempt == b.Attempt &&
+		a.BindingDigest == b.BindingDigest &&
+		a.SnapshotDigest == b.SnapshotDigest &&
+		a.RequestDigest == b.RequestDigest &&
+		a.TurnID == b.TurnID &&
+		a.Backend == b.Backend &&
+		a.AuthSecretNamespace == b.AuthSecretNamespace &&
+		a.AuthSecretName == b.AuthSecretName &&
+		a.AuthSecretKey == b.AuthSecretKey &&
+		a.AuthSecretUID == b.AuthSecretUID &&
+		a.AuthSecretResourceVersion == b.AuthSecretResourceVersion &&
+		a.DuplicateSafe == b.DuplicateSafe &&
+		a.RetryClass == b.RetryClass
+}
+
+const harnessV1AttemptSelectSQL = `SELECT namespace, task_name, task_uid, attempt,
+	binding_digest, snapshot_digest, request_digest, turn_id, runtime_session_id, correlation_id,
+	backend, backend_endpoint, auth_secret_namespace, auth_secret_name, auth_secret_key, auth_secret_uid, auth_secret_resource_version,
+	state, last_event_seq, cancel_requested_at, terminal_receipt_digest, terminal_reason,
+	duplicate_safe, retry_class, controller_epoch_name, controller_epoch,
+	last_operation_id, last_operation_digest, version, created_at, updated_at
+	FROM harness_v1_attempts`
+
+func scanHarnessV1Attempt(row sessionLineageScanner) (*store.HarnessV1Attempt, error) {
+	var (
+		attempt           store.HarnessV1Attempt
+		state             string
+		retryClass        string
+		cancelRequestedAt sql.NullTime
+	)
+	if err := row.Scan(&attempt.Namespace, &attempt.TaskName, &attempt.TaskUID, &attempt.Attempt,
+		&attempt.BindingDigest, &attempt.SnapshotDigest, &attempt.RequestDigest,
+		&attempt.TurnID, &attempt.RuntimeSessionID, &attempt.CorrelationID,
+		&attempt.Backend, &attempt.BackendEndpoint,
+		&attempt.AuthSecretNamespace, &attempt.AuthSecretName, &attempt.AuthSecretKey, &attempt.AuthSecretUID, &attempt.AuthSecretResourceVersion,
+		&state, &attempt.LastEventSeq, &cancelRequestedAt, &attempt.TerminalReceiptDigest, &attempt.TerminalReason,
+		&attempt.DuplicateSafe, &retryClass, &attempt.ControllerEpochName, &attempt.ControllerEpoch,
+		&attempt.LastOperationID, &attempt.LastOperationDigest,
+		&attempt.Version, &attempt.CreatedAt, &attempt.UpdatedAt); err != nil {
+		return nil, err
+	}
+	attempt.State = store.HarnessV1AttemptState(state)
+	attempt.RetryClass = store.HarnessV1AttemptRetryClass(retryClass)
+	if cancelRequestedAt.Valid {
+		requestedAt := cancelRequestedAt.Time.UTC()
+		attempt.CancelRequestedAt = &requestedAt
+	}
+	attempt.CreatedAt = attempt.CreatedAt.UTC()
+	attempt.UpdatedAt = attempt.UpdatedAt.UTC()
+	return &attempt, nil
+}
+
+func collectHarnessV1Attempts(rows *sql.Rows) ([]store.HarnessV1Attempt, error) {
+	defer func() { _ = rows.Close() }()
+	var attempts []store.HarnessV1Attempt
+	for rows.Next() {
+		attempt, err := scanHarnessV1Attempt(rows)
+		if err != nil {
+			return nil, fmt.Errorf("scan harness v1 attempt: %w", err)
+		}
+		attempts = append(attempts, *attempt)
+	}
+	return attempts, rows.Err()
+}
diff --git a/internal/store/sqlite/harness_v1_attempt_store_test.go b/internal/store/sqlite/harness_v1_attempt_store_test.go
new file mode 100644
index 000000000..413eea76b
--- /dev/null
+++ b/internal/store/sqlite/harness_v1_attempt_store_test.go
@@ -0,0 +1,45 @@
+package sqlite
+
+import (
+	"testing"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+func TestHarnessV1AttemptHasNoSessionSideEffect(t *testing.T) {
+	tests := []struct {
+		name    string
+		attempt store.HarnessV1Attempt
+		want    bool
+	}{
+		{
+			name: "pre-submit Session conflict",
+			attempt: store.HarnessV1Attempt{
+				State: store.HarnessV1AttemptRejected, TerminalReason: "SessionConflict",
+			},
+			want: true,
+		},
+		{
+			name: "receipt proves possible Session side effect",
+			attempt: store.HarnessV1Attempt{
+				State: store.HarnessV1AttemptRejected, TerminalReason: "SessionConflict",
+				TerminalReceiptDigest: "sha256:receipt",
+			},
+			want: false,
+		},
+		{
+			name: "wrapper rejection may have a Session turn",
+			attempt: store.HarnessV1Attempt{
+				State: store.HarnessV1AttemptRejected, TerminalReason: "PromptNotAccepted",
+			},
+			want: false,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if got := harnessV1AttemptHasNoSessionSideEffect(test.attempt); got != test.want {
+				t.Fatalf("harnessV1AttemptHasNoSessionSideEffect() = %t, want %t", got, test.want)
+			}
+		})
+	}
+}
diff --git a/internal/store/sqlite/integration_test.go b/internal/store/sqlite/integration_test.go
index a322732fb..725e2f872 100644
--- a/internal/store/sqlite/integration_test.go
+++ b/internal/store/sqlite/integration_test.go
@@ -8,6 +8,7 @@ import (
 	"math/rand"
 	"os"
 	"path/filepath"
+	"reflect"
 	"strings"
 	"sync"
 	"testing"
@@ -615,6 +616,71 @@ func TestIntegration_GracefulShutdown(t *testing.T) {
 	}
 }
 
+func TestIntegration_ShutdownDoesNotWritePlannerStatistics(t *testing.T) {
+	dir := t.TempDir()
+	dbPath := filepath.Join(dir, "shutdown-no-write.db")
+
+	db, err := NewDB(dbPath)
+	if err != nil {
+		t.Fatalf("NewDB: %v", err)
+	}
+	if _, err := db.Exec(`
+		CREATE TABLE shutdown_optimizer_probe (
+			id INTEGER PRIMARY KEY,
+			value TEXT NOT NULL
+		);
+		CREATE INDEX shutdown_optimizer_probe_value
+			ON shutdown_optimizer_probe(value);
+		WITH RECURSIVE sequence(value) AS (
+			SELECT 1
+			UNION ALL
+			SELECT value + 1 FROM sequence WHERE value < 10000
+		)
+		INSERT INTO shutdown_optimizer_probe(value)
+			SELECT printf('value-%05d', value) FROM sequence;
+	`); err != nil {
+		_ = db.Close()
+		t.Fatalf("seed optimizer probe: %v", err)
+	}
+	var count int
+	if err := db.QueryRow(`SELECT COUNT(*) FROM shutdown_optimizer_probe WHERE value = ?`, "value-05000").Scan(&count); err != nil {
+		_ = db.Close()
+		t.Fatalf("query optimizer probe: %v", err)
+	}
+	if count != 1 {
+		_ = db.Close()
+		t.Fatalf("optimizer probe count = %d, want 1", count)
+	}
+
+	var statisticsTables int
+	if err := db.QueryRow(`SELECT COUNT(*) FROM sqlite_schema WHERE name = 'sqlite_stat1'`).Scan(&statisticsTables); err != nil {
+		_ = db.Close()
+		t.Fatalf("query pre-shutdown statistics tables: %v", err)
+	}
+	if statisticsTables != 0 {
+		_ = db.Close()
+		t.Fatalf("pre-shutdown sqlite_stat1 tables = %d, want 0", statisticsTables)
+	}
+
+	shutdownCtx, cancel := context.WithCancel(context.Background())
+	cancel()
+	if err := NewStore(db, dbPath).Start(shutdownCtx); err != nil {
+		t.Fatalf("Start after cancellation: %v", err)
+	}
+
+	reopened, err := sql.Open("sqlite", dbPath)
+	if err != nil {
+		t.Fatalf("sql.Open after shutdown: %v", err)
+	}
+	defer reopened.Close() //nolint:errcheck
+	if err := reopened.QueryRow(`SELECT COUNT(*) FROM sqlite_schema WHERE name = 'sqlite_stat1'`).Scan(&statisticsTables); err != nil {
+		t.Fatalf("query post-shutdown statistics tables: %v", err)
+	}
+	if statisticsTables != 0 {
+		t.Fatalf("post-shutdown sqlite_stat1 tables = %d, want 0", statisticsTables)
+	}
+}
+
 func TestIntegration_HealthCheckOnDisk(t *testing.T) {
 	s := setupDiskStore(t)
 	ctx := context.Background()
@@ -852,6 +918,86 @@ func TestIntegration_MigrateSecurityScanLegacySchema(t *testing.T) {
 	}
 }
 
+func TestIntegration_MigrateAndReopenPatchProposalPublicationEvidence(t *testing.T) {
+	dir := t.TempDir()
+	dbPath := filepath.Join(dir, "patch-publication-legacy.db")
+	initial, bound := testPatchProposalPublication("legacy")
+
+	legacyDB, err := sql.Open("sqlite", dbPath)
+	if err != nil {
+		t.Fatalf("sql.Open() error = %v", err)
+	}
+	if _, err := legacyDB.Exec(`
+		CREATE TABLE security_patch_proposals (
+			id                TEXT PRIMARY KEY,
+			namespace         TEXT NOT NULL,
+			repository_scan   TEXT NOT NULL,
+			finding_id        TEXT NOT NULL,
+			task_name         TEXT NOT NULL,
+			branch            TEXT NOT NULL,
+			diff_artifact     TEXT NOT NULL DEFAULT '',
+			summary_artifact  TEXT NOT NULL DEFAULT '',
+			status            TEXT NOT NULL,
+			pr_number         INTEGER,
+			pr_url            TEXT NOT NULL DEFAULT '',
+			created_at        TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+			updated_at        TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+		);
+		CREATE INDEX idx_security_patch_proposals_finding
+			ON security_patch_proposals(namespace, finding_id, created_at DESC);
+		INSERT INTO security_patch_proposals (
+			id, namespace, repository_scan, finding_id, task_name, branch, status
+		) VALUES (?, ?, ?, ?, ?, ?, ?)
+	`, initial.ID, initial.Namespace, initial.RepositoryScan, initial.FindingID, initial.TaskName, initial.Branch, initial.Status); err != nil {
+		_ = legacyDB.Close()
+		t.Fatalf("seed legacy patch proposal schema error = %v", err)
+	}
+	if err := legacyDB.Close(); err != nil {
+		t.Fatalf("legacyDB.Close() error = %v", err)
+	}
+
+	db, err := NewDB(dbPath)
+	if err != nil {
+		t.Fatalf("NewDB() migrated patch proposal schema error = %v", err)
+	}
+	if !sqliteTableHasColumn(t, db, "security_patch_proposals", "publication_evidence_json") {
+		_ = db.Close()
+		t.Fatal("security_patch_proposals missing migrated publication_evidence_json column")
+	}
+	s := NewStore(db, dbPath)
+	if err := s.BindPatchProposalPublicationEvidence(context.Background(), bound); err != nil {
+		_ = db.Close()
+		t.Fatalf("BindPatchProposalPublicationEvidence() after migration error = %v", err)
+	}
+	boundUpdatedAt := bound.UpdatedAt
+	if err := db.Close(); err != nil {
+		t.Fatalf("db.Close() error = %v", err)
+	}
+
+	reopenedDB, err := NewDB(dbPath)
+	if err != nil {
+		t.Fatalf("NewDB() reopen error = %v", err)
+	}
+	defer reopenedDB.Close() //nolint:errcheck
+	reopenedStore := NewStore(reopenedDB, dbPath)
+	stored := onlyPatchProposal(t, reopenedStore, initial.Namespace, initial.FindingID)
+	if !reflect.DeepEqual(stored.PublicationEvidence, bound.PublicationEvidence) {
+		t.Fatalf("reopened publication evidence = %#v, want %#v", stored.PublicationEvidence, bound.PublicationEvidence)
+	}
+	if !stored.UpdatedAt.Equal(boundUpdatedAt) {
+		t.Fatalf("reopened updatedAt = %v, want %v", stored.UpdatedAt, boundUpdatedAt)
+	}
+
+	replay := clonePatchProposal(bound)
+	replay.UpdatedAt = time.Time{}
+	if err := reopenedStore.BindPatchProposalPublicationEvidence(context.Background(), replay); err != nil {
+		t.Fatalf("identical replay after reopen error = %v", err)
+	}
+	if !replay.UpdatedAt.Equal(boundUpdatedAt) {
+		t.Fatalf("replay after reopen updatedAt = %v, want unchanged %v", replay.UpdatedAt, boundUpdatedAt)
+	}
+}
+
 func sqliteTableHasColumn(t *testing.T, db *sql.DB, table, column string) bool {
 	t.Helper()
 	rows, err := db.Query(fmt.Sprintf("PRAGMA table_info(%s)", table))
diff --git a/internal/store/sqlite/memory_store_test.go b/internal/store/sqlite/memory_store_test.go
index 2dc13f3bb..da1aec322 100644
--- a/internal/store/sqlite/memory_store_test.go
+++ b/internal/store/sqlite/memory_store_test.go
@@ -135,7 +135,7 @@ func TestMemoryProposalStore(t *testing.T) {
 	if err != nil {
 		t.Fatalf("ListMemoryProposals: %v", err)
 	}
-	if len(listed) != 1 || listed[0].ID != proposal.ID || listed[0].Status != "pending" {
+	if len(listed) != 1 || listed[0].ID != proposal.ID || listed[0].Status != proposalStatusPending {
 		t.Fatalf("unexpected proposals: %+v", listed)
 	}
 
diff --git a/internal/store/sqlite/message_store.go b/internal/store/sqlite/message_store.go
index b2ac44d1b..5eda47d45 100644
--- a/internal/store/sqlite/message_store.go
+++ b/internal/store/sqlite/message_store.go
@@ -27,12 +27,12 @@ func (s *Store) SendMessage(ctx context.Context, msg *store.Message) error {
 }
 
 // GetMessages returns unread messages for a task, including broadcasts to siblings.
-// parentTask scopes broadcasts: only messages with matching parent_task where to_task="*" are included.
+// parentTask scopes both direct and broadcast delivery to one coordinator family.
 // If markRead is true, messages are marked as read atomically.
 func (s *Store) GetMessages(ctx context.Context, namespace, taskName, parentTask string, markRead bool) ([]store.Message, error) {
 	if !markRead {
 		// Read-only path doesn't need a transaction
-		rows, err := s.db.QueryContext(ctx, selectUnreadMessagesSQL, namespace, taskName, taskName, parentTask)
+		rows, err := s.db.QueryContext(ctx, selectUnreadMessagesSQL, namespace, taskName, parentTask, taskName)
 		if err != nil {
 			return nil, err
 		}
@@ -48,7 +48,7 @@ func (s *Store) GetMessages(ctx context.Context, namespace, taskName, parentTask
 	}
 	defer tx.Rollback() //nolint:errcheck
 
-	rows, err := tx.QueryContext(ctx, selectUnreadMessagesSQL, namespace, taskName, taskName, parentTask)
+	rows, err := tx.QueryContext(ctx, selectUnreadMessagesSQL, namespace, taskName, parentTask, taskName)
 	if err != nil {
 		return nil, err
 	}
@@ -68,8 +68,9 @@ func (s *Store) GetMessages(ctx context.Context, namespace, taskName, parentTask
 			 SET read = TRUE
 			 WHERE namespace = ? AND read = FALSE
 			   AND from_task != ?
-			   AND (to_task = ? OR (to_task = '*' AND parent_task = ?))`,
-			namespace, taskName, taskName, parentTask,
+			   AND parent_task = ?
+			   AND (to_task = ? OR to_task = '*')`,
+			namespace, taskName, parentTask, taskName,
 		); err != nil {
 			return nil, err
 		}
@@ -86,7 +87,8 @@ const selectUnreadMessagesSQL = `SELECT id, from_task, to_task, parent_task, con
 	 FROM messages
 	 WHERE namespace = ? AND read = FALSE
 	   AND from_task != ?
-	   AND (to_task = ? OR (to_task = '*' AND parent_task = ?))
+	   AND parent_task = ?
+	   AND (to_task = ? OR to_task = '*')
 	 ORDER BY id ASC`
 
 func scanUnreadMessages(rows *sql.Rows, namespace string) ([]store.Message, error) {
diff --git a/internal/store/sqlite/message_store_test.go b/internal/store/sqlite/message_store_test.go
index da7609369..a12967ed7 100644
--- a/internal/store/sqlite/message_store_test.go
+++ b/internal/store/sqlite/message_store_test.go
@@ -81,6 +81,50 @@ func TestGetMessagesNamespaceIsolation(t *testing.T) {
 	}
 }
 
+func TestGetMessagesScopesDirectDeliveryAndMarkReadByParent(t *testing.T) {
+	s := setupTestStore(t)
+	ctx := context.Background()
+	const (
+		namespace = "ns-direct-family"
+		receiver  = "receiver"
+		parentA   = "parent-a"
+		parentB   = "parent-b"
+	)
+
+	for _, message := range []*store.Message{
+		{Namespace: namespace, FromTask: "sender-a", ToTask: receiver, ParentTask: parentA, Content: "family-a"},
+		{Namespace: namespace, FromTask: "sender-b", ToTask: receiver, ParentTask: parentB, Content: "family-b"},
+	} {
+		if err := s.SendMessage(ctx, message); err != nil {
+			t.Fatalf("SendMessage: %v", err)
+		}
+	}
+
+	messages, err := s.GetMessages(ctx, namespace, receiver, parentB, true)
+	if err != nil {
+		t.Fatalf("GetMessages parent B: %v", err)
+	}
+	if len(messages) != 1 || messages[0].Content != "family-b" {
+		t.Fatalf("parent B messages = %#v, want only family-b", messages)
+	}
+
+	messages, err = s.GetMessages(ctx, namespace, receiver, parentA, false)
+	if err != nil {
+		t.Fatalf("GetMessages parent A: %v", err)
+	}
+	if len(messages) != 1 || messages[0].Content != "family-a" {
+		t.Fatalf("parent A messages = %#v, want unread family-a", messages)
+	}
+
+	messages, err = s.GetMessages(ctx, namespace, receiver, parentB, false)
+	if err != nil {
+		t.Fatalf("GetMessages parent B after mark-read: %v", err)
+	}
+	if len(messages) != 0 {
+		t.Fatalf("parent B messages after mark-read = %#v, want none", messages)
+	}
+}
+
 func TestGetMessagesMultipleMarkRead(t *testing.T) {
 	s := setupTestStore(t)
 	ctx := context.Background()
diff --git a/internal/store/sqlite/outbox_store.go b/internal/store/sqlite/outbox_store.go
new file mode 100644
index 000000000..d88504515
--- /dev/null
+++ b/internal/store/sqlite/outbox_store.go
@@ -0,0 +1,493 @@
+package sqlite
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+var _ store.OutboxProjectionStore = (*Store)(nil)
+var _ store.OutboxPersistenceStore = (*Store)(nil)
+
+// EnqueueOutboxProjection inserts a restart-safe projection record. Reusing an
+// ID with byte-identical payload and metadata is idempotent; any mismatch conflicts.
+func (s *Store) EnqueueOutboxProjection(ctx context.Context, projection *store.OutboxProjection, fence store.ControllerEpochFence) (*store.OutboxProjection, error) {
+	return s.enqueueOutboxProjection(ctx, projection, fence, true)
+}
+
+// EnqueueOutboxProjectionRecord persists an outbox record after a Kubernetes
+// control store has validated the controller epoch fence.
+func (s *Store) EnqueueOutboxProjectionRecord(ctx context.Context, projection *store.OutboxProjection, fence store.ControllerEpochFence) (*store.OutboxProjection, error) {
+	return s.enqueueOutboxProjection(ctx, projection, fence, false)
+}
+
+func (s *Store) enqueueOutboxProjection(ctx context.Context, projection *store.OutboxProjection, fence store.ControllerEpochFence, requireSQLiteEpoch bool) (*store.OutboxProjection, error) {
+	if projection == nil {
+		return nil, store.ValidationErrorf("outbox projection is required")
+	}
+	scheduleExplicit := !projection.AvailableAt.IsZero()
+	normalized, fence, err := normalizeOutboxProjectionForCreate(*projection, fence, time.Time{})
+	if err != nil {
+		return nil, err
+	}
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if requireSQLiteEpoch {
+		if err := requireControllerEpoch(ctx, tx, fence); err != nil {
+			return nil, err
+		}
+	}
+	created, err := enqueueOutboxProjectionTx(ctx, tx, normalized, scheduleExplicit)
+	if err != nil {
+		return nil, err
+	}
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &created, nil
+}
+
+// GetOutboxProjection returns one outbox record.
+func (s *Store) GetOutboxProjection(ctx context.Context, id string) (*store.OutboxProjection, error) {
+	id = strings.TrimSpace(id)
+	if err := store.ValidateControlIdentifier("outbox projection ID", id); err != nil {
+		return nil, err
+	}
+	projection, err := getOutboxProjection(ctx, s.db, id)
+	if err != nil {
+		return nil, err
+	}
+	return &projection, nil
+}
+
+// ClaimOutboxProjections leases due pending records and expired delivering
+// records in one transaction. Attempts and versions advance before records are returned.
+func (s *Store) ClaimOutboxProjections(ctx context.Context, request store.ClaimOutboxProjectionsRequest) ([]store.OutboxProjection, error) {
+	return s.claimOutboxProjections(ctx, request, true)
+}
+
+// ClaimOutboxProjectionRecords claims due records after a Kubernetes control
+// store has validated the controller epoch fence.
+func (s *Store) ClaimOutboxProjectionRecords(ctx context.Context, request store.ClaimOutboxProjectionsRequest) ([]store.OutboxProjection, error) {
+	return s.claimOutboxProjections(ctx, request, false)
+}
+
+func (s *Store) claimOutboxProjections(ctx context.Context, request store.ClaimOutboxProjectionsRequest, requireSQLiteEpoch bool) ([]store.OutboxProjection, error) {
+	fence, err := normalizeEpochFence(request.Fence)
+	if err != nil {
+		return nil, err
+	}
+	request.Fence = fence
+	request.WorkerID = strings.TrimSpace(request.WorkerID)
+	if err := store.ValidateControlIdentifier("outbox worker ID", request.WorkerID); err != nil {
+		return nil, err
+	}
+	if request.LeaseDuration <= 0 || request.LeaseDuration > 24*time.Hour {
+		return nil, store.ValidationErrorf("outbox lease duration must be greater than zero and no more than 24 hours")
+	}
+	request.Now = normalizeControlTime(request.Now)
+	limit := request.Limit
+	if limit <= 0 {
+		limit = defaultOutboxClaimLimit
+	}
+	if limit > maxOutboxClaimLimit {
+		limit = maxOutboxClaimLimit
+	}
+	leaseExpiresAt := request.Now.Add(request.LeaseDuration)
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if requireSQLiteEpoch {
+		if err := requireControllerEpoch(ctx, tx, request.Fence); err != nil {
+			return nil, err
+		}
+	}
+	rows, err := tx.QueryContext(ctx,
+		`SELECT id FROM outbox_projections
+		 WHERE (state = 'Pending' AND available_at <= ?)
+		    OR (state = 'Delivering' AND lease_expires_at <= ?)
+		 ORDER BY available_at ASC, created_at ASC, id ASC
+		 LIMIT ?`,
+		request.Now, request.Now, limit,
+	)
+	if err != nil {
+		return nil, err
+	}
+	var ids []string
+	for rows.Next() {
+		var id string
+		if err := rows.Scan(&id); err != nil {
+			_ = rows.Close()
+			return nil, err
+		}
+		ids = append(ids, id)
+	}
+	if err := rows.Err(); err != nil {
+		_ = rows.Close()
+		return nil, err
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+
+	claimed := make([]store.OutboxProjection, 0, len(ids))
+	for _, id := range ids {
+		projection, err := getOutboxProjection(ctx, tx, id)
+		if err != nil {
+			return nil, err
+		}
+		result, err := tx.ExecContext(ctx,
+			`UPDATE outbox_projections
+			 SET state = 'Delivering', attempts = attempts + 1, lease_owner = ?, lease_expires_at = ?,
+			     controller_epoch_name = ?, controller_epoch = ?, version = version + 1, updated_at = ?
+			 WHERE id = ? AND version = ? AND (
+			       (state = 'Pending' AND available_at <= ?)
+			       OR (state = 'Delivering' AND lease_expires_at <= ?)
+			 )`,
+			request.WorkerID, leaseExpiresAt, request.Fence.Name, request.Fence.Epoch,
+			request.Now, id, projection.Version, request.Now, request.Now,
+		)
+		if err != nil {
+			return nil, err
+		}
+		if err := rowsAffectedExactlyOne(result, "outbox claim"); err != nil {
+			return nil, err
+		}
+		projection.State = store.OutboxProjectionDelivering
+		projection.Attempts++
+		projection.LeaseOwner = request.WorkerID
+		projection.LeaseExpiresAt = &leaseExpiresAt
+		projection.ControllerEpochName = request.Fence.Name
+		projection.ControllerEpoch = request.Fence.Epoch
+		projection.Version++
+		projection.UpdatedAt = request.Now
+		claimed = append(claimed, projection)
+	}
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return claimed, nil
+}
+
+// CompleteOutboxProjection completes, retries, or dead-letters the exact lease.
+//
+//nolint:gocyclo // Completion validates distinct retry, delivery, and dead-letter invariants.
+func (s *Store) CompleteOutboxProjection(ctx context.Context, request store.CompleteOutboxProjectionRequest) (*store.OutboxProjection, error) {
+	return s.completeOutboxProjection(ctx, request, true)
+}
+
+// CompleteOutboxProjectionRecord completes a claimed record after a
+// Kubernetes control store has validated the controller epoch fence.
+func (s *Store) CompleteOutboxProjectionRecord(ctx context.Context, request store.CompleteOutboxProjectionRequest) (*store.OutboxProjection, error) {
+	return s.completeOutboxProjection(ctx, request, false)
+}
+
+//nolint:gocyclo // Completion validates distinct retry, delivery, and dead-letter invariants.
+func (s *Store) completeOutboxProjection(ctx context.Context, request store.CompleteOutboxProjectionRequest, requireSQLiteEpoch bool) (*store.OutboxProjection, error) {
+	request.ID = strings.TrimSpace(request.ID)
+	request.LeaseOwner = strings.TrimSpace(request.LeaseOwner)
+	if err := store.ValidateControlIdentifier("outbox projection ID", request.ID); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateControlIdentifier("outbox lease owner", request.LeaseOwner); err != nil {
+		return nil, err
+	}
+	fence, err := normalizeEpochFence(request.Fence)
+	if err != nil {
+		return nil, err
+	}
+	request.Fence = fence
+	if request.ExpectedVersion < 1 {
+		return nil, store.ValidationErrorf("outbox expected version must be at least 1")
+	}
+	request.OperationID = strings.TrimSpace(request.OperationID)
+	if err := store.ValidateControlIdentifier("outbox completion operation ID", request.OperationID); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateCanonicalDigest("outbox completion operation digest", request.OperationDigest); err != nil {
+		return nil, err
+	}
+	request.UpdatedAt = normalizeControlTime(request.UpdatedAt)
+	request.LastError = strings.TrimSpace(request.LastError)
+	if err := store.ValidateControlReason("outbox last error", request.LastError); err != nil {
+		return nil, err
+	}
+	switch request.NewState {
+	case store.OutboxProjectionDelivered:
+		if err := store.ValidateCanonicalDigest("outbox delivery digest", request.DeliveryDigest); err != nil {
+			return nil, err
+		}
+		if request.LastError != "" {
+			return nil, store.ValidationErrorf("delivered outbox projection must clear last error")
+		}
+	case store.OutboxProjectionPending:
+		if request.LastError == "" {
+			return nil, store.ValidationErrorf("retrying outbox projection requires an error")
+		}
+		if request.DeliveryDigest != "" {
+			return nil, store.ValidationErrorf("retrying outbox projection must not set a delivery digest")
+		}
+		if request.AvailableAt.IsZero() {
+			request.AvailableAt = request.UpdatedAt
+		} else {
+			request.AvailableAt = request.AvailableAt.UTC()
+		}
+	case store.OutboxProjectionDeadLetter:
+		if request.LastError == "" {
+			return nil, store.ValidationErrorf("dead-lettered outbox projection requires an error")
+		}
+		if request.DeliveryDigest != "" {
+			return nil, store.ValidationErrorf("dead-lettered outbox projection must not set a delivery digest")
+		}
+	default:
+		return nil, store.ValidationErrorf("outbox completion state must be Pending, Delivered, or DeadLetter")
+	}
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if requireSQLiteEpoch {
+		if err := requireControllerEpoch(ctx, tx, request.Fence); err != nil {
+			return nil, err
+		}
+	}
+	projection, err := getOutboxProjection(ctx, tx, request.ID)
+	if err != nil {
+		return nil, err
+	}
+	if projection.LastOperationID == request.OperationID {
+		if projection.LastOperationDigest != request.OperationDigest {
+			return nil, controlConflict("outbox completion operation %q was reused with a different digest", request.OperationID)
+		}
+		if outboxCompletionMatches(projection, request) {
+			return &projection, nil
+		}
+		return nil, controlConflict("outbox completion operation %q was already applied with different target values", request.OperationID)
+	}
+	if projection.Version != request.ExpectedVersion || projection.State != store.OutboxProjectionDelivering || projection.LeaseOwner != request.LeaseOwner {
+		return nil, controlConflict("outbox projection %q no longer matches expected version or lease owner", projection.ID)
+	}
+
+	availableAt := projection.AvailableAt
+	var deliveredAt *time.Time
+	if request.NewState == store.OutboxProjectionPending {
+		availableAt = request.AvailableAt
+	}
+	if request.NewState == store.OutboxProjectionDelivered {
+		value := request.UpdatedAt
+		deliveredAt = &value
+	}
+	result, err := tx.ExecContext(ctx,
+		`UPDATE outbox_projections
+		 SET state = ?, available_at = ?, lease_owner = '', lease_expires_at = NULL,
+		     delivery_digest = ?, last_error = ?, last_operation_id = ?, last_operation_digest = ?,
+		     controller_epoch_name = ?, controller_epoch = ?, version = version + 1, updated_at = ?, delivered_at = ?
+		 WHERE id = ? AND version = ? AND state = 'Delivering' AND lease_owner = ?`,
+		string(request.NewState), availableAt, request.DeliveryDigest, request.LastError,
+		request.OperationID, request.OperationDigest, request.Fence.Name, request.Fence.Epoch,
+		request.UpdatedAt, nullTimeValue(deliveredAt),
+		request.ID, request.ExpectedVersion, request.LeaseOwner,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if err := rowsAffectedExactlyOne(result, "outbox completion"); err != nil {
+		return nil, err
+	}
+	projection.State = request.NewState
+	projection.AvailableAt = availableAt
+	projection.LeaseOwner = ""
+	projection.LeaseExpiresAt = nil
+	projection.DeliveryDigest = request.DeliveryDigest
+	projection.LastError = request.LastError
+	projection.LastOperationID = request.OperationID
+	projection.LastOperationDigest = request.OperationDigest
+	projection.ControllerEpochName = request.Fence.Name
+	projection.ControllerEpoch = request.Fence.Epoch
+	projection.Version++
+	projection.UpdatedAt = request.UpdatedAt
+	projection.DeliveredAt = deliveredAt
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &projection, nil
+}
+
+func normalizeOutboxProjectionForCreate(projection store.OutboxProjection, fence store.ControllerEpochFence, defaultTime time.Time) (store.OutboxProjection, store.ControllerEpochFence, error) {
+	projection.ID = strings.TrimSpace(projection.ID)
+	projection.AggregateKind = strings.TrimSpace(projection.AggregateKind)
+	projection.AggregateID = strings.TrimSpace(projection.AggregateID)
+	projection.ProjectionKind = strings.TrimSpace(projection.ProjectionKind)
+	for field, value := range map[string]string{
+		"outbox projection ID":   projection.ID,
+		"outbox aggregate kind":  projection.AggregateKind,
+		"outbox aggregate ID":    projection.AggregateID,
+		"outbox projection kind": projection.ProjectionKind,
+	} {
+		if err := store.ValidateControlIdentifier(field, value); err != nil {
+			return store.OutboxProjection{}, store.ControllerEpochFence{}, err
+		}
+	}
+	if err := store.ValidateControlPayload("outbox payload", projection.Payload); err != nil {
+		return store.OutboxProjection{}, store.ControllerEpochFence{}, err
+	}
+	if err := store.ValidateCanonicalDigest("outbox payload digest", projection.PayloadDigest); err != nil {
+		return store.OutboxProjection{}, store.ControllerEpochFence{}, err
+	}
+	if canonicalBytesDigest(projection.Payload) != projection.PayloadDigest {
+		return store.OutboxProjection{}, store.ControllerEpochFence{}, store.ValidationErrorf("outbox payload digest does not match payload bytes")
+	}
+	fence, err := normalizeEpochFence(fence)
+	if err != nil {
+		return store.OutboxProjection{}, store.ControllerEpochFence{}, err
+	}
+	if projection.State == "" {
+		projection.State = store.OutboxProjectionPending
+	}
+	if projection.State != store.OutboxProjectionPending {
+		return store.OutboxProjection{}, store.ControllerEpochFence{}, store.ValidationErrorf("new outbox projection must start in %s", store.OutboxProjectionPending)
+	}
+	if projection.Version != 0 && projection.Version != 1 {
+		return store.OutboxProjection{}, store.ControllerEpochFence{}, store.ValidationErrorf("new outbox projection version must be zero or one")
+	}
+	if projection.Attempts != 0 || projection.LeaseOwner != "" || projection.LeaseExpiresAt != nil ||
+		projection.DeliveryDigest != "" || projection.DeliveredAt != nil || projection.LastOperationID != "" ||
+		projection.LastOperationDigest != "" {
+		return store.OutboxProjection{}, store.ControllerEpochFence{}, store.ValidationErrorf("new outbox projection must not include delivery state")
+	}
+	if defaultTime.IsZero() {
+		defaultTime = normalizeControlTime(projection.CreatedAt)
+	} else {
+		defaultTime = defaultTime.UTC()
+	}
+	projection.CreatedAt = defaultTime
+	if projection.UpdatedAt.IsZero() {
+		projection.UpdatedAt = defaultTime
+	} else {
+		projection.UpdatedAt = projection.UpdatedAt.UTC()
+	}
+	if projection.AvailableAt.IsZero() {
+		projection.AvailableAt = defaultTime
+	} else {
+		projection.AvailableAt = projection.AvailableAt.UTC()
+	}
+	projection.InitialAvailableAt = projection.AvailableAt
+	projection.ControllerEpochName = fence.Name
+	projection.ControllerEpoch = fence.Epoch
+	projection.Version = 1
+	projection.LastError = ""
+	return projection, fence, nil
+}
+
+func enqueueOutboxProjectionTx(ctx context.Context, tx *sql.Tx, projection store.OutboxProjection, compareSchedule bool) (store.OutboxProjection, error) {
+	_, err := tx.ExecContext(ctx,
+		`INSERT INTO outbox_projections(
+			id, aggregate_kind, aggregate_id, projection_kind, payload_digest, payload, state,
+			attempts, initial_available_at, available_at, lease_owner, lease_expires_at, delivery_digest, last_error,
+			last_operation_id, last_operation_digest, controller_epoch_name, controller_epoch,
+			version, created_at, updated_at, delivered_at
+		) VALUES (?, ?, ?, ?, ?, ?, ?, 0, ?, ?, '', NULL, '', '', '', '', ?, ?, 1, ?, ?, NULL)`,
+		projection.ID, projection.AggregateKind, projection.AggregateID, projection.ProjectionKind,
+		projection.PayloadDigest, []byte(projection.Payload), string(projection.State),
+		projection.InitialAvailableAt, projection.AvailableAt, projection.ControllerEpochName,
+		projection.ControllerEpoch, projection.CreatedAt, projection.UpdatedAt,
+	)
+	if err == nil {
+		return projection, nil
+	}
+	if !isSQLiteConstraintError(err) {
+		return store.OutboxProjection{}, err
+	}
+	existing, getErr := getOutboxProjection(ctx, tx, projection.ID)
+	if getErr == nil && sameOutboxProjectionCreation(existing, projection, compareSchedule) {
+		return existing, nil
+	}
+	return store.OutboxProjection{}, controlConflict("outbox projection %q was reused with different payload or metadata", projection.ID)
+}
+
+func sameOutboxProjectionCreation(a, b store.OutboxProjection, compareSchedule bool) bool {
+	if a.ID != b.ID || a.AggregateKind != b.AggregateKind || a.AggregateID != b.AggregateID ||
+		a.ProjectionKind != b.ProjectionKind || a.PayloadDigest != b.PayloadDigest ||
+		string(a.Payload) != string(b.Payload) {
+		return false
+	}
+	return !compareSchedule || a.InitialAvailableAt.Equal(b.InitialAvailableAt)
+}
+
+func outboxCompletionMatches(projection store.OutboxProjection, request store.CompleteOutboxProjectionRequest) bool {
+	if projection.State != request.NewState {
+		return false
+	}
+	switch request.NewState {
+	case store.OutboxProjectionDelivered:
+		return projection.DeliveryDigest == request.DeliveryDigest && projection.LastError == ""
+	case store.OutboxProjectionPending:
+		return projection.DeliveryDigest == "" && projection.LastError == request.LastError &&
+			projection.AvailableAt.Equal(request.AvailableAt)
+	case store.OutboxProjectionDeadLetter:
+		return projection.DeliveryDigest == "" && projection.LastError == request.LastError
+	default:
+		return false
+	}
+}
+
+func getOutboxProjection(ctx context.Context, q controlQueryRower, id string) (store.OutboxProjection, error) {
+	var projection store.OutboxProjection
+	var payload []byte
+	var leaseExpiry, deliveredAt sql.NullTime
+	err := q.QueryRowContext(ctx,
+		`SELECT id, aggregate_kind, aggregate_id, projection_kind, payload_digest, payload, state,
+		        attempts, initial_available_at, available_at, lease_owner, lease_expires_at,
+		        delivery_digest, last_error, last_operation_id, last_operation_digest,
+		        controller_epoch_name, controller_epoch, version, created_at, updated_at, delivered_at
+		 FROM outbox_projections WHERE id = ?`, id,
+	).Scan(
+		&projection.ID, &projection.AggregateKind, &projection.AggregateID, &projection.ProjectionKind,
+		&projection.PayloadDigest, &payload, &projection.State, &projection.Attempts,
+		&projection.InitialAvailableAt, &projection.AvailableAt, &projection.LeaseOwner, &leaseExpiry,
+		&projection.DeliveryDigest, &projection.LastError, &projection.LastOperationID,
+		&projection.LastOperationDigest, &projection.ControllerEpochName, &projection.ControllerEpoch, &projection.Version,
+		&projection.CreatedAt, &projection.UpdatedAt, &deliveredAt,
+	)
+	if errors.Is(err, sql.ErrNoRows) {
+		return store.OutboxProjection{}, store.ErrNotFound
+	}
+	if err != nil {
+		return store.OutboxProjection{}, fmt.Errorf("get outbox projection: %w", err)
+	}
+	projection.Payload = append(projection.Payload, payload...)
+	if leaseExpiry.Valid {
+		value := leaseExpiry.Time
+		projection.LeaseExpiresAt = &value
+	}
+	if deliveredAt.Valid {
+		value := deliveredAt.Time
+		projection.DeliveredAt = &value
+	}
+	return projection, nil
+}
+
+// CountUnsettledOutboxProjections reports Pending or Delivering projections
+// without claiming them. It is used only by the planned-upgrade drain barrier.
+func (s *Store) CountUnsettledOutboxProjections(ctx context.Context) (int64, error) {
+	var count int64
+	if err := s.db.QueryRowContext(ctx,
+		`SELECT COUNT(*) FROM outbox_projections WHERE state IN ('Pending', 'Delivering')`,
+	).Scan(&count); err != nil {
+		return 0, fmt.Errorf("count unsettled outbox projections: %w", err)
+	}
+	return count, nil
+}
diff --git a/internal/store/sqlite/prompt_attempt_store.go b/internal/store/sqlite/prompt_attempt_store.go
new file mode 100644
index 000000000..e877a9325
--- /dev/null
+++ b/internal/store/sqlite/prompt_attempt_store.go
@@ -0,0 +1,1210 @@
+package sqlite
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"reflect"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+var _ store.PromptAttemptStore = (*Store)(nil)
+
+// CreatePromptAttempt inserts a canonical prompt attempt. Repeating the exact
+// immutable request, binding, and snapshot digests returns the committed row;
+// reusing the identity for different immutable input conflicts.
+func (s *Store) CreatePromptAttempt(ctx context.Context, attempt *store.PromptAttempt, fence store.ControllerEpochFence) (*store.PromptAttempt, error) {
+	normalized, fence, err := normalizePromptAttemptForCreate(attempt, fence)
+	if err != nil {
+		return nil, err
+	}
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, fence); err != nil {
+		return nil, err
+	}
+	if _, markerErr := getPromptAttemptReclamationMarkerSQLite(ctx, tx, normalized.Key.Namespace, normalized.Key.TaskUID); markerErr == nil {
+		return nil, controlConflict("Task %q has already prepared PromptAttempt reclamation", normalized.Key.TaskUID)
+	} else if !errors.Is(markerErr, store.ErrNotFound) {
+		return nil, markerErr
+	}
+	if existing, getErr := getPromptAttempt(ctx, tx, normalized.ID); getErr == nil {
+		if samePromptAttemptCreation(existing, normalized) {
+			return &existing, nil
+		}
+		return nil, controlConflict("prompt attempt %q was reused with a different request digest or immutable identity", normalized.ID)
+	} else if !errors.Is(getErr, store.ErrNotFound) {
+		return nil, getErr
+	}
+
+	_, err = tx.ExecContext(ctx,
+		`INSERT INTO prompt_attempts(
+			id, namespace, task_uid, attempt, prompt_id, session_uid, session_lease_generation,
+			runtime_instance_id, request_digest, binding_digest, snapshot_digest,
+			execution_state, delivery_state, terminal_reason,
+			outcome_marker, controller_epoch_name, controller_epoch, last_operation_id,
+			last_operation_digest, version, created_at, updated_at
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		normalized.ID, normalized.Key.Namespace, normalized.Key.TaskUID, normalized.Key.Attempt, normalized.Key.PromptID,
+		normalized.SessionUID, normalized.SessionLeaseGeneration, normalized.RuntimeInstanceID, normalized.RequestDigest,
+		normalized.BindingDigest, normalized.SnapshotDigest,
+		string(normalized.ExecutionState), string(normalized.DeliveryState), normalized.TerminalReason, normalized.OutcomeMarker,
+		normalized.ControllerEpochName, normalized.ControllerEpoch, normalized.LastOperationID,
+		normalized.LastOperationDigest, normalized.Version, normalized.CreatedAt, normalized.UpdatedAt,
+	)
+	if err != nil {
+		if !isSQLiteConstraintError(err) {
+			return nil, err
+		}
+		existing, getErr := getPromptAttempt(ctx, tx, normalized.ID)
+		if getErr != nil {
+			return nil, controlConflict("prompt attempt %q already exists with a conflicting identity", normalized.ID)
+		}
+		if samePromptAttemptCreation(existing, normalized) {
+			return &existing, nil
+		}
+		return nil, controlConflict("prompt attempt %q was reused with a different request digest or immutable identity", normalized.ID)
+	}
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &normalized, nil
+}
+
+// GetPromptAttempt returns one durable prompt attempt.
+func (s *Store) GetPromptAttempt(ctx context.Context, id string) (*store.PromptAttempt, error) {
+	id = strings.TrimSpace(id)
+	if err := store.ValidateControlIdentifier("prompt attempt ID", id); err != nil {
+		return nil, err
+	}
+	attempt, err := getPromptAttempt(ctx, s.db, id)
+	if err != nil {
+		return nil, err
+	}
+	return &attempt, nil
+}
+
+type promptAttemptReclamationMarker struct {
+	Namespace                           string
+	TaskName                            string
+	TaskUID                             string
+	Mode                                store.PromptAttemptReclamationMode
+	ContinuitySession                   bool
+	FinalContinuitySession              bool
+	FinalPromptAttemptID                string
+	TerminalProjectionID                string
+	FinalSessionTurnID                  string
+	TerminalProjectionAggregateKind     string
+	TerminalProjectionAggregateID       string
+	CandidateIDs                        []string
+	RequestedExternalEffectAggregateIDs []string
+	RelatedExternalEffectAggregateIDs   []string
+	ControllerEpochName                 string
+	ControllerEpoch                     int64
+	CreatedAt                           time.Time
+}
+
+// PreparePromptAttemptReclamation proves and durably records the complete
+// task-scoped retention barrier without deleting PromptAttempts.
+func (s *Store) PreparePromptAttemptReclamation(ctx context.Context, request store.ReclaimPromptAttemptsRequest) error {
+	_, err := s.runPromptAttemptReclamation(ctx, request, false)
+	return err
+}
+
+// ReclaimPromptAttempts is the SQLite compatibility implementation of the
+// task-scoped retention contract. Marker creation and deletion are committed in
+// one transaction for direct callers; controller callers may prepare first so
+// artifact retirement happens between durable authorization and deletion.
+//
+//nolint:gocyclo // Retention keeps every cross-aggregate safety barrier explicit and auditable in one transaction.
+func (s *Store) ReclaimPromptAttempts(ctx context.Context, request store.ReclaimPromptAttemptsRequest) (int, error) {
+	return s.runPromptAttemptReclamation(ctx, request, true)
+}
+
+func (s *Store) runPromptAttemptReclamation(ctx context.Context, request store.ReclaimPromptAttemptsRequest, deleteAttempts bool) (int, error) {
+	normalized, err := normalizePromptAttemptReclamationRequestSQLite(request)
+	if err != nil {
+		return 0, err
+	}
+	fence, err := normalizeEpochFence(normalized.Fence)
+	if err != nil {
+		return 0, err
+	}
+	normalized.Fence = fence
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return 0, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, normalized.Fence); err != nil {
+		return 0, err
+	}
+	marker, attempts, err := preparePromptAttemptReclamationSQLite(ctx, tx, normalized)
+	if err != nil {
+		return 0, err
+	}
+	if !deleteAttempts {
+		if err := tx.Commit(); err != nil {
+			return 0, err
+		}
+		return 0, nil
+	}
+	if len(attempts) == 0 {
+		if err := tx.Commit(); err != nil {
+			return 0, err
+		}
+		return 0, nil
+	}
+	authorized := make(map[string]struct{}, len(marker.CandidateIDs))
+	for _, id := range marker.CandidateIDs {
+		authorized[id] = struct{}{}
+	}
+	for _, attempt := range attempts {
+		if _, ok := authorized[attempt.ID]; !ok {
+			return 0, controlConflict("PromptAttempt %q was created after Task reclamation was prepared", attempt.ID)
+		}
+	}
+	result, err := tx.ExecContext(ctx, `DELETE FROM prompt_attempts WHERE namespace = ? AND task_uid = ?`, normalized.Namespace, normalized.TaskUID)
+	if err != nil {
+		return 0, fmt.Errorf("delete reclaimed prompt attempts: %w", err)
+	}
+	deleted, err := result.RowsAffected()
+	if err != nil {
+		return 0, fmt.Errorf("count reclaimed prompt attempts: %w", err)
+	}
+	if deleted != int64(len(attempts)) {
+		return 0, controlConflict("prompt attempt reclamation deleted %d rows, expected %d", deleted, len(attempts))
+	}
+	if err := tx.Commit(); err != nil {
+		return 0, err
+	}
+	return int(deleted), nil
+}
+
+func normalizePromptAttemptReclamationRequestSQLite(request store.ReclaimPromptAttemptsRequest) (store.ReclaimPromptAttemptsRequest, error) {
+	request.Namespace = strings.TrimSpace(request.Namespace)
+	request.TaskName = strings.TrimSpace(request.TaskName)
+	request.TaskUID = strings.TrimSpace(request.TaskUID)
+	for field, value := range map[string]string{
+		"prompt attempt namespace": request.Namespace,
+		"prompt attempt Task name": request.TaskName,
+		"prompt attempt Task UID":  request.TaskUID,
+	} {
+		if err := store.ValidateControlIdentifier(field, value); err != nil {
+			return store.ReclaimPromptAttemptsRequest{}, err
+		}
+	}
+	switch request.Mode {
+	case store.PromptAttemptReclamationProjected, store.PromptAttemptReclamationUnbound, store.PromptAttemptReclamationNoAttempt:
+	default:
+		return store.ReclaimPromptAttemptsRequest{}, store.ValidationErrorf("unsupported prompt attempt reclamation mode %q", request.Mode)
+	}
+	if request.FinalContinuitySession && (!request.ContinuitySession || request.Mode != store.PromptAttemptReclamationProjected) {
+		return store.ReclaimPromptAttemptsRequest{}, store.ValidationErrorf("final continuity SessionTurn binding requires projected continuity reclamation")
+	}
+	request.FinalPromptAttemptID = strings.TrimSpace(request.FinalPromptAttemptID)
+	request.TerminalProjectionID = strings.TrimSpace(request.TerminalProjectionID)
+	if request.Mode == store.PromptAttemptReclamationProjected {
+		if err := store.ValidateControlIdentifier("final prompt attempt ID", request.FinalPromptAttemptID); err != nil {
+			return store.ReclaimPromptAttemptsRequest{}, err
+		}
+		if request.TerminalProjectionID != "" {
+			if err := store.ValidateControlIdentifier("terminal projection ID", request.TerminalProjectionID); err != nil {
+				return store.ReclaimPromptAttemptsRequest{}, err
+			}
+		}
+	} else if request.FinalPromptAttemptID != "" || request.TerminalProjectionID != "" {
+		return store.ReclaimPromptAttemptsRequest{}, store.ValidationErrorf("only projected prompt attempt reclamation accepts final attempt and projection IDs")
+	}
+	request.RelatedExternalEffectAggregateIDs = normalizePromptAttemptReclamationIDsSQLite(request.RelatedExternalEffectAggregateIDs)
+	for _, id := range request.RelatedExternalEffectAggregateIDs {
+		if err := store.ValidateControlIdentifier("related external effect aggregate ID", id); err != nil {
+			return store.ReclaimPromptAttemptsRequest{}, err
+		}
+	}
+	return request, nil
+}
+
+func normalizePromptAttemptReclamationIDsSQLite(values []string) []string {
+	set := make(map[string]struct{}, len(values))
+	for _, value := range values {
+		value = strings.TrimSpace(value)
+		if value != "" {
+			set[value] = struct{}{}
+		}
+	}
+	result := make([]string, 0, len(set))
+	for value := range set {
+		result = append(result, value)
+	}
+	sort.Strings(result)
+	return result
+}
+
+func preparePromptAttemptReclamationSQLite(
+	ctx context.Context,
+	tx *sql.Tx,
+	request store.ReclaimPromptAttemptsRequest,
+) (promptAttemptReclamationMarker, []store.PromptAttempt, error) {
+	attempts, err := listTaskPromptAttemptsSQLite(ctx, tx, request.Namespace, request.TaskUID)
+	if err != nil {
+		return promptAttemptReclamationMarker{}, nil, err
+	}
+	marker, err := getPromptAttemptReclamationMarkerSQLite(ctx, tx, request.Namespace, request.TaskUID)
+	if err == nil {
+		if err := validatePromptAttemptReclamationMarkerRequestSQLite(marker, request); err != nil {
+			return promptAttemptReclamationMarker{}, nil, err
+		}
+		if err := verifyPreparedPromptAttemptReclamationSQLite(ctx, tx, marker, attempts); err != nil {
+			return promptAttemptReclamationMarker{}, nil, err
+		}
+		return marker, attempts, nil
+	}
+	if !errors.Is(err, store.ErrNotFound) {
+		return promptAttemptReclamationMarker{}, nil, err
+	}
+	if request.Mode == store.PromptAttemptReclamationUnbound {
+		attempts, err = settleUnboundPromptAttemptsForReclamationSQLite(ctx, tx, attempts, request.Fence)
+		if err != nil {
+			return promptAttemptReclamationMarker{}, nil, err
+		}
+	}
+	marker, err = buildPromptAttemptReclamationMarkerSQLite(ctx, tx, request, attempts)
+	if err != nil {
+		return promptAttemptReclamationMarker{}, nil, err
+	}
+	if err := insertPromptAttemptReclamationMarkerSQLite(ctx, tx, marker); err != nil {
+		return promptAttemptReclamationMarker{}, nil, err
+	}
+	return marker, attempts, nil
+}
+
+func listTaskPromptAttemptsSQLite(ctx context.Context, tx *sql.Tx, namespace, taskUID string) ([]store.PromptAttempt, error) {
+	rows, err := tx.QueryContext(ctx, `SELECT id FROM prompt_attempts WHERE namespace = ? AND task_uid = ? ORDER BY attempt, id`, namespace, taskUID)
+	if err != nil {
+		return nil, fmt.Errorf("list prompt attempts for Task reclamation: %w", err)
+	}
+	defer rows.Close() //nolint:errcheck
+	ids := make([]string, 0)
+	for rows.Next() {
+		var id string
+		if err := rows.Scan(&id); err != nil {
+			return nil, fmt.Errorf("scan prompt attempt for Task reclamation: %w", err)
+		}
+		ids = append(ids, id)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("list prompt attempts for Task reclamation: %w", err)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, fmt.Errorf("close prompt attempt reclamation rows: %w", err)
+	}
+	attempts := make([]store.PromptAttempt, 0, len(ids))
+	for _, id := range ids {
+		attempt, err := getPromptAttempt(ctx, tx, id)
+		if err != nil {
+			return nil, err
+		}
+		attempts = append(attempts, attempt)
+	}
+	return attempts, nil
+}
+
+func settleUnboundPromptAttemptsForReclamationSQLite(
+	ctx context.Context,
+	tx *sql.Tx,
+	attempts []store.PromptAttempt,
+	fence store.ControllerEpochFence,
+) ([]store.PromptAttempt, error) {
+	result := make([]store.PromptAttempt, 0, len(attempts))
+	var newestID string
+	if len(attempts) > 0 {
+		newest, err := newestPromptAttemptForReclamationSQLite(append([]store.PromptAttempt(nil), attempts...))
+		if err != nil {
+			return nil, err
+		}
+		newestID = newest.ID
+	}
+	for _, attempt := range attempts {
+		if attempt.ID != newestID {
+			if !store.IsTerminalPromptExecutionState(attempt.ExecutionState) || !store.IsTerminalPromptDeliveryState(attempt.DeliveryState) {
+				return nil, sqlitePromptAttemptReclaimNotReady("historical prompt attempt %q is not terminal", attempt.ID)
+			}
+			result = append(result, attempt)
+			continue
+		}
+		if attempt.SessionUID != "" || attempt.SessionLeaseGeneration != 0 || attempt.RuntimeInstanceID != "" {
+			return nil, sqlitePromptAttemptReclaimNotReady("unbound prompt attempt %q already has a runtime or Session binding", attempt.ID)
+		}
+		if store.IsTerminalPromptExecutionState(attempt.ExecutionState) {
+			if !store.IsTerminalPromptDeliveryState(attempt.DeliveryState) {
+				return nil, sqlitePromptAttemptReclaimNotReady("unbound prompt attempt %q delivery is not terminal", attempt.ID)
+			}
+			result = append(result, attempt)
+			continue
+		}
+		if attempt.ExecutionState != store.PromptExecutionQueued || attempt.DeliveryState != store.PromptDeliveryNotRequested {
+			return nil, sqlitePromptAttemptReclaimNotReady("unbound prompt attempt %q is not safely cancellable from state %s", attempt.ID, attempt.ExecutionState)
+		}
+		operationID := store.CanonicalControlID("reclaim-unbound-cancel", attempt.ID)
+		operationDigest := canonicalBytesDigest([]byte("reclaim-unbound-cancel:" + attempt.ID))
+		updatedAt := normalizeControlTime(time.Time{})
+		resultSQL, err := tx.ExecContext(ctx,
+			`UPDATE prompt_attempts
+			 SET execution_state = 'Cancelled', terminal_reason = ?, controller_epoch_name = ?, controller_epoch = ?,
+			     last_operation_id = ?, last_operation_digest = ?, version = version + 1, updated_at = ?
+			 WHERE id = ? AND version = ? AND execution_state = 'Queued'`,
+			"Task deleted before durable execution status binding", fence.Name, fence.Epoch,
+			operationID, operationDigest, updatedAt, attempt.ID, attempt.Version,
+		)
+		if err != nil {
+			return nil, err
+		}
+		if err := rowsAffectedExactlyOne(resultSQL, "cancel unbound prompt attempt for reclamation"); err != nil {
+			return nil, err
+		}
+		attempt, err = getPromptAttempt(ctx, tx, attempt.ID)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, attempt)
+	}
+	return result, nil
+}
+
+func buildPromptAttemptReclamationMarkerSQLite(
+	ctx context.Context,
+	tx *sql.Tx,
+	request store.ReclaimPromptAttemptsRequest,
+	attempts []store.PromptAttempt,
+) (promptAttemptReclamationMarker, error) {
+	effectiveMode := request.Mode
+	if effectiveMode == store.PromptAttemptReclamationUnbound && len(attempts) == 0 {
+		effectiveMode = store.PromptAttemptReclamationNoAttempt
+	}
+	marker := promptAttemptReclamationMarker{
+		Namespace: request.Namespace, TaskName: request.TaskName, TaskUID: request.TaskUID,
+		Mode: effectiveMode, ContinuitySession: request.ContinuitySession,
+		FinalContinuitySession:              request.FinalContinuitySession,
+		RequestedExternalEffectAggregateIDs: append([]string(nil), request.RelatedExternalEffectAggregateIDs...),
+		ControllerEpochName:                 request.Fence.Name, ControllerEpoch: request.Fence.Epoch, CreatedAt: normalizeControlTime(time.Time{}),
+	}
+	if effectiveMode == store.PromptAttemptReclamationNoAttempt {
+		if len(attempts) != 0 {
+			return promptAttemptReclamationMarker{}, controlConflict("Task %q declared no durable attempt but owns %d PromptAttempts", request.TaskUID, len(attempts))
+		}
+		marker.RelatedExternalEffectAggregateIDs = normalizePromptAttemptReclamationIDsSQLite(append([]string{request.TaskUID}, request.RelatedExternalEffectAggregateIDs...))
+		if _, err := verifyPromptAttemptReferencesSQLite(ctx, tx, marker, nil); err != nil {
+			return promptAttemptReclamationMarker{}, err
+		}
+		return marker, nil
+	}
+	if len(attempts) == 0 {
+		return promptAttemptReclamationMarker{}, sqlitePromptAttemptReclaimNotReady("Task %q has no durable PromptAttempt and no reclamation marker", request.TaskUID)
+	}
+	for _, attempt := range attempts {
+		if !store.IsTerminalPromptExecutionState(attempt.ExecutionState) || !store.IsTerminalPromptDeliveryState(attempt.DeliveryState) {
+			return promptAttemptReclamationMarker{}, sqlitePromptAttemptReclaimNotReady("prompt attempt %q is not terminal", attempt.ID)
+		}
+		marker.CandidateIDs = append(marker.CandidateIDs, attempt.ID)
+		if attempt.SessionUID != "" {
+			marker.RelatedExternalEffectAggregateIDs = append(marker.RelatedExternalEffectAggregateIDs, attempt.SessionUID)
+		}
+	}
+	marker.CandidateIDs = normalizePromptAttemptReclamationIDsSQLite(marker.CandidateIDs)
+	marker.RelatedExternalEffectAggregateIDs = normalizePromptAttemptReclamationIDsSQLite(append(marker.RelatedExternalEffectAggregateIDs, append([]string{request.TaskUID}, request.RelatedExternalEffectAggregateIDs...)...))
+	finalAttempt, err := newestPromptAttemptForReclamationSQLite(attempts)
+	if err != nil {
+		return promptAttemptReclamationMarker{}, err
+	}
+	marker.FinalPromptAttemptID = finalAttempt.ID
+	if request.Mode == store.PromptAttemptReclamationProjected && request.FinalPromptAttemptID != finalAttempt.ID {
+		return promptAttemptReclamationMarker{}, controlConflict("final prompt attempt %q is not the newest Task attempt %q", request.FinalPromptAttemptID, finalAttempt.ID)
+	}
+	turns, err := verifyPromptAttemptReferencesSQLite(ctx, tx, marker, attempts)
+	if err != nil {
+		return promptAttemptReclamationMarker{}, err
+	}
+	if request.Mode == store.PromptAttemptReclamationProjected {
+		if request.TerminalProjectionID == "" {
+			return promptAttemptReclamationMarker{}, store.ValidationErrorf("terminal projection ID is required before preparing projected reclamation")
+		}
+		marker.TerminalProjectionID = request.TerminalProjectionID
+		if request.FinalContinuitySession {
+			turn, ok := turns[finalAttempt.ID]
+			if !ok {
+				return promptAttemptReclamationMarker{}, sqlitePromptAttemptReclaimNotReady("final continuity prompt attempt %q has no finalized SessionTurn", finalAttempt.ID)
+			}
+			marker.FinalSessionTurnID = turn.ID
+			marker.TerminalProjectionAggregateKind = "SessionTurn"
+			marker.TerminalProjectionAggregateID = turn.ID
+		} else {
+			expectedID := store.CanonicalControlID("task-terminal-projection", request.Namespace, request.TaskUID, fmt.Sprint(finalAttempt.Key.Attempt))
+			if request.TerminalProjectionID != expectedID {
+				return promptAttemptReclamationMarker{}, controlConflict("terminal projection %q does not match newest standalone prompt attempt %q", request.TerminalProjectionID, finalAttempt.ID)
+			}
+			marker.TerminalProjectionAggregateKind = "Task"
+			marker.TerminalProjectionAggregateID = request.TaskUID
+		}
+		if err := verifyPromptAttemptTerminalProjectionMarkerSQLite(ctx, tx, marker); err != nil {
+			return promptAttemptReclamationMarker{}, err
+		}
+	}
+	return marker, nil
+}
+
+func newestPromptAttemptForReclamationSQLite(attempts []store.PromptAttempt) (store.PromptAttempt, error) {
+	if len(attempts) == 0 {
+		return store.PromptAttempt{}, store.ErrNotFound
+	}
+	copyAttempts := append([]store.PromptAttempt(nil), attempts...)
+	sort.Slice(copyAttempts, func(i, j int) bool {
+		if copyAttempts[i].Key.Attempt != copyAttempts[j].Key.Attempt {
+			return copyAttempts[i].Key.Attempt > copyAttempts[j].Key.Attempt
+		}
+		return copyAttempts[i].ID < copyAttempts[j].ID
+	})
+	if len(copyAttempts) > 1 && copyAttempts[0].Key.Attempt == copyAttempts[1].Key.Attempt {
+		return store.PromptAttempt{}, controlConflict("Task %q has multiple PromptAttempts at newest attempt %d", copyAttempts[0].Key.TaskUID, copyAttempts[0].Key.Attempt)
+	}
+	return copyAttempts[0], nil
+}
+
+func verifyPreparedPromptAttemptReclamationSQLite(
+	ctx context.Context,
+	tx *sql.Tx,
+	marker promptAttemptReclamationMarker,
+	attempts []store.PromptAttempt,
+) error {
+	authorized := make(map[string]struct{}, len(marker.CandidateIDs))
+	for _, id := range marker.CandidateIDs {
+		authorized[id] = struct{}{}
+	}
+	for _, attempt := range attempts {
+		if _, ok := authorized[attempt.ID]; !ok {
+			return controlConflict("PromptAttempt %q was created after Task reclamation was prepared", attempt.ID)
+		}
+		if !store.IsTerminalPromptExecutionState(attempt.ExecutionState) || !store.IsTerminalPromptDeliveryState(attempt.DeliveryState) {
+			return sqlitePromptAttemptReclaimNotReady("prompt attempt %q is not terminal", attempt.ID)
+		}
+	}
+	if marker.Mode == store.PromptAttemptReclamationNoAttempt && len(attempts) != 0 {
+		return controlConflict("no-attempt reclamation marker now has PromptAttempt candidates")
+	}
+	if _, err := verifyPromptAttemptReferencesSQLite(ctx, tx, marker, attempts); err != nil {
+		return err
+	}
+	if marker.Mode == store.PromptAttemptReclamationProjected {
+		return verifyPromptAttemptTerminalProjectionMarkerSQLite(ctx, tx, marker)
+	}
+	return nil
+}
+
+func verifyPromptAttemptReferencesSQLite(
+	ctx context.Context,
+	tx *sql.Tx,
+	marker promptAttemptReclamationMarker,
+	attempts []store.PromptAttempt,
+) (map[string]store.SessionTurn, error) {
+	protected := make(map[string]struct{}, len(marker.CandidateIDs))
+	for _, id := range marker.CandidateIDs {
+		protected[id] = struct{}{}
+	}
+	controlRows, err := tx.QueryContext(ctx,
+		`SELECT session_name, availability, lease_task_uid, related_prompt_attempt_id
+		 FROM session_controls WHERE namespace = ? AND (lease_task_uid = ? OR related_prompt_attempt_id <> '')`,
+		marker.Namespace, marker.TaskUID,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("list Session references for prompt attempt reclamation: %w", err)
+	}
+	for controlRows.Next() {
+		var sessionName, leaseTaskUID, relatedAttemptID string
+		var availability store.SessionAvailability
+		if err := controlRows.Scan(&sessionName, &availability, &leaseTaskUID, &relatedAttemptID); err != nil {
+			_ = controlRows.Close()
+			return nil, fmt.Errorf("scan Session reference for prompt attempt reclamation: %w", err)
+		}
+		if leaseTaskUID == marker.TaskUID {
+			_ = controlRows.Close()
+			return nil, sqlitePromptAttemptReclaimNotReady("Session %s/%s still has a mutation lease for Task %q", marker.Namespace, sessionName, marker.TaskUID)
+		}
+		if _, related := protected[relatedAttemptID]; related && availability == store.SessionReconciliationBlocked {
+			_ = controlRows.Close()
+			return nil, sqlitePromptAttemptReclaimNotReady("Session %s/%s still references prompt attempt %q", marker.Namespace, sessionName, relatedAttemptID)
+		}
+	}
+	if err := controlRows.Err(); err != nil {
+		_ = controlRows.Close()
+		return nil, fmt.Errorf("list Session references for prompt attempt reclamation: %w", err)
+	}
+	if err := controlRows.Close(); err != nil {
+		return nil, fmt.Errorf("close Session reference reclamation rows: %w", err)
+	}
+
+	turns := make(map[string]store.SessionTurn)
+	if marker.ContinuitySession {
+		for _, attempt := range attempts {
+			if attempt.SessionUID == "" && attempt.SessionLeaseGeneration == 0 {
+				continue
+			}
+			if attempt.SessionUID == "" || attempt.SessionLeaseGeneration < 1 {
+				return nil, controlConflict("prompt attempt %q has an incomplete SessionTurn binding", attempt.ID)
+			}
+			key := store.SessionTurnKey{
+				SessionUID: attempt.SessionUID, LeaseGeneration: attempt.SessionLeaseGeneration,
+				TaskUID: attempt.Key.TaskUID, Attempt: attempt.Key.Attempt, PromptID: attempt.Key.PromptID,
+			}
+			turnID, err := key.CanonicalID()
+			if err != nil {
+				return nil, err
+			}
+			turn, err := getSessionTurn(ctx, tx, turnID)
+			if errors.Is(err, store.ErrNotFound) {
+				return nil, sqlitePromptAttemptReclaimNotReady("SessionTurn %q for prompt attempt %q is not durable", turnID, attempt.ID)
+			}
+			if err != nil {
+				return nil, fmt.Errorf("load SessionTurn for prompt attempt reclamation: %w", err)
+			}
+			if turn.Key != key || turn.PromptAttemptID != attempt.ID {
+				return nil, controlConflict("SessionTurn %q does not match prompt attempt %q", turnID, attempt.ID)
+			}
+			if turn.State != store.SessionTurnFinalized || turn.FinalizedAt == nil || strings.TrimSpace(turn.ProjectionID) == "" {
+				return nil, sqlitePromptAttemptReclaimNotReady("SessionTurn %q for prompt attempt %q is not finalized", turnID, attempt.ID)
+			}
+			turns[attempt.ID] = turn
+		}
+	}
+	if err := verifyPromptAttemptPublicationsAndEffectsSQLite(ctx, tx, marker); err != nil {
+		return nil, err
+	}
+	return turns, nil
+}
+
+func verifyPromptAttemptPublicationsAndEffectsSQLite(ctx context.Context, tx *sql.Tx, marker promptAttemptReclamationMarker) error {
+	relatedEffects := make(map[string]struct{}, len(marker.RelatedExternalEffectAggregateIDs)+1)
+	relatedEffects[marker.TaskUID] = struct{}{}
+	for _, id := range marker.RelatedExternalEffectAggregateIDs {
+		relatedEffects[id] = struct{}{}
+	}
+	publicationRows, err := tx.QueryContext(ctx, `SELECT id, state FROM publications WHERE namespace = ? AND task_uid = ?`, marker.Namespace, marker.TaskUID)
+	if err != nil {
+		return fmt.Errorf("list publications for prompt attempt reclamation: %w", err)
+	}
+	for publicationRows.Next() {
+		var id string
+		var state store.PublicationState
+		if err := publicationRows.Scan(&id, &state); err != nil {
+			_ = publicationRows.Close()
+			return fmt.Errorf("scan publication for prompt attempt reclamation: %w", err)
+		}
+		if !store.IsTerminalPublicationState(state) {
+			_ = publicationRows.Close()
+			return sqlitePromptAttemptReclaimNotReady("publication %q is not terminal", id)
+		}
+		relatedEffects[id] = struct{}{}
+	}
+	if err := publicationRows.Err(); err != nil {
+		_ = publicationRows.Close()
+		return fmt.Errorf("list publications for prompt attempt reclamation: %w", err)
+	}
+	if err := publicationRows.Close(); err != nil {
+		return fmt.Errorf("close publication reclamation rows: %w", err)
+	}
+
+	effectRows, err := tx.QueryContext(ctx, `SELECT id, aggregate_id, state FROM external_effects WHERE namespace = ?`, marker.Namespace)
+	if err != nil {
+		return fmt.Errorf("list external effects for prompt attempt reclamation: %w", err)
+	}
+	for effectRows.Next() {
+		var id, aggregateID string
+		var state store.ExternalEffectState
+		if err := effectRows.Scan(&id, &aggregateID, &state); err != nil {
+			_ = effectRows.Close()
+			return fmt.Errorf("scan external effect for prompt attempt reclamation: %w", err)
+		}
+		if _, related := relatedEffects[aggregateID]; !related {
+			continue
+		}
+		switch state {
+		case store.ExternalEffectSucceeded, store.ExternalEffectFailed, store.ExternalEffectOutcomeUnknown:
+		default:
+			_ = effectRows.Close()
+			return sqlitePromptAttemptReclaimNotReady("external effect %q is not terminal", id)
+		}
+	}
+	if err := effectRows.Err(); err != nil {
+		_ = effectRows.Close()
+		return fmt.Errorf("list external effects for prompt attempt reclamation: %w", err)
+	}
+	if err := effectRows.Close(); err != nil {
+		return fmt.Errorf("close external effect reclamation rows: %w", err)
+	}
+	return nil
+}
+
+func verifyPromptAttemptTerminalProjectionMarkerSQLite(ctx context.Context, tx *sql.Tx, marker promptAttemptReclamationMarker) error {
+	projection, err := getOutboxProjection(ctx, tx, marker.TerminalProjectionID)
+	if errors.Is(err, store.ErrNotFound) {
+		return sqlitePromptAttemptReclaimNotReady("terminal projection %q is not durable", marker.TerminalProjectionID)
+	}
+	if err != nil {
+		return fmt.Errorf("load terminal projection for prompt attempt reclamation: %w", err)
+	}
+	if projection.State != store.OutboxProjectionDelivered {
+		return sqlitePromptAttemptReclaimNotReady("terminal projection %q is not delivered", projection.ID)
+	}
+	if projection.ProjectionKind != "TaskTerminalStatus" ||
+		projection.AggregateKind != marker.TerminalProjectionAggregateKind || projection.AggregateID != marker.TerminalProjectionAggregateID {
+		return controlConflict("terminal projection %q does not match the prepared Task finalization aggregate", projection.ID)
+	}
+	if marker.FinalSessionTurnID != "" {
+		turn, err := getSessionTurn(ctx, tx, marker.FinalSessionTurnID)
+		if err != nil {
+			return fmt.Errorf("load final SessionTurn for prompt attempt reclamation: %w", err)
+		}
+		if turn.State != store.SessionTurnFinalized || turn.FinalizedAt == nil || turn.ProjectionID != projection.ID {
+			return controlConflict("terminal projection %q does not match final SessionTurn %q", projection.ID, marker.FinalSessionTurnID)
+		}
+	}
+	return nil
+}
+
+func validatePromptAttemptReclamationMarkerRequestSQLite(marker promptAttemptReclamationMarker, request store.ReclaimPromptAttemptsRequest) error {
+	modeMatches := marker.Mode == request.Mode ||
+		request.Mode == store.PromptAttemptReclamationUnbound && marker.Mode == store.PromptAttemptReclamationNoAttempt
+	if marker.Namespace != request.Namespace || marker.TaskName != request.TaskName || marker.TaskUID != request.TaskUID ||
+		!modeMatches || marker.ContinuitySession != request.ContinuitySession ||
+		!reflect.DeepEqual(marker.RequestedExternalEffectAggregateIDs, request.RelatedExternalEffectAggregateIDs) {
+		return controlConflict("prompt attempt reclamation marker does not match the current Task request")
+	}
+	if request.Mode == store.PromptAttemptReclamationProjected &&
+		(marker.FinalPromptAttemptID != request.FinalPromptAttemptID ||
+			request.TerminalProjectionID != "" && (marker.TerminalProjectionID != request.TerminalProjectionID || marker.FinalContinuitySession != request.FinalContinuitySession)) {
+		return controlConflict("prompt attempt reclamation marker does not match the current final attempt/projection")
+	}
+	if marker.Mode == store.PromptAttemptReclamationProjected && len(marker.CandidateIDs) == 0 {
+		return controlConflict("prompt attempt reclamation marker has no projected candidate set")
+	}
+	return nil
+}
+
+func insertPromptAttemptReclamationMarkerSQLite(ctx context.Context, tx *sql.Tx, marker promptAttemptReclamationMarker) error {
+	candidateJSON, err := json.Marshal(marker.CandidateIDs)
+	if err != nil {
+		return err
+	}
+	requestedEffectsJSON, err := json.Marshal(marker.RequestedExternalEffectAggregateIDs)
+	if err != nil {
+		return err
+	}
+	relatedEffectsJSON, err := json.Marshal(marker.RelatedExternalEffectAggregateIDs)
+	if err != nil {
+		return err
+	}
+	_, err = tx.ExecContext(ctx,
+		`INSERT INTO prompt_attempt_reclamations(
+			namespace, task_name, task_uid, mode, continuity_session, final_continuity_session, final_prompt_attempt_id,
+			terminal_projection_id, final_session_turn_id, terminal_projection_aggregate_kind,
+			terminal_projection_aggregate_id, candidate_ids, requested_external_effect_aggregate_ids,
+			related_external_effect_aggregate_ids, controller_epoch_name, controller_epoch, created_at
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		marker.Namespace, marker.TaskName, marker.TaskUID, string(marker.Mode), marker.ContinuitySession, marker.FinalContinuitySession,
+		marker.FinalPromptAttemptID, marker.TerminalProjectionID, marker.FinalSessionTurnID,
+		marker.TerminalProjectionAggregateKind, marker.TerminalProjectionAggregateID,
+		candidateJSON, requestedEffectsJSON, relatedEffectsJSON, marker.ControllerEpochName, marker.ControllerEpoch, marker.CreatedAt,
+	)
+	if err != nil {
+		if isSQLiteConstraintError(err) {
+			return controlConflict("prompt attempt reclamation marker for Task %q already exists", marker.TaskUID)
+		}
+		return fmt.Errorf("create prompt attempt reclamation marker: %w", err)
+	}
+	return nil
+}
+
+func getPromptAttemptReclamationMarkerSQLite(ctx context.Context, q controlQueryRower, namespace, taskUID string) (promptAttemptReclamationMarker, error) {
+	var marker promptAttemptReclamationMarker
+	var mode string
+	var candidateJSON, requestedEffectsJSON, relatedEffectsJSON []byte
+	err := q.QueryRowContext(ctx,
+		`SELECT namespace, task_name, task_uid, mode, continuity_session, final_continuity_session, final_prompt_attempt_id,
+		        terminal_projection_id, final_session_turn_id, terminal_projection_aggregate_kind,
+		        terminal_projection_aggregate_id, candidate_ids, requested_external_effect_aggregate_ids,
+		        related_external_effect_aggregate_ids, controller_epoch_name, controller_epoch, created_at
+		 FROM prompt_attempt_reclamations WHERE namespace = ? AND task_uid = ?`, namespace, taskUID,
+	).Scan(
+		&marker.Namespace, &marker.TaskName, &marker.TaskUID, &mode, &marker.ContinuitySession, &marker.FinalContinuitySession,
+		&marker.FinalPromptAttemptID, &marker.TerminalProjectionID, &marker.FinalSessionTurnID,
+		&marker.TerminalProjectionAggregateKind, &marker.TerminalProjectionAggregateID,
+		&candidateJSON, &requestedEffectsJSON, &relatedEffectsJSON,
+		&marker.ControllerEpochName, &marker.ControllerEpoch, &marker.CreatedAt,
+	)
+	if errors.Is(err, sql.ErrNoRows) {
+		return promptAttemptReclamationMarker{}, store.ErrNotFound
+	}
+	if err != nil {
+		return promptAttemptReclamationMarker{}, fmt.Errorf("get prompt attempt reclamation marker: %w", err)
+	}
+	marker.Mode = store.PromptAttemptReclamationMode(mode)
+	if err := json.Unmarshal(candidateJSON, &marker.CandidateIDs); err != nil {
+		return promptAttemptReclamationMarker{}, fmt.Errorf("decode prompt attempt reclamation candidates: %w", err)
+	}
+	if err := json.Unmarshal(requestedEffectsJSON, &marker.RequestedExternalEffectAggregateIDs); err != nil {
+		return promptAttemptReclamationMarker{}, fmt.Errorf("decode prompt attempt reclamation requested effects: %w", err)
+	}
+	if err := json.Unmarshal(relatedEffectsJSON, &marker.RelatedExternalEffectAggregateIDs); err != nil {
+		return promptAttemptReclamationMarker{}, fmt.Errorf("decode prompt attempt reclamation related effects: %w", err)
+	}
+	marker.CandidateIDs = normalizePromptAttemptReclamationIDsSQLite(marker.CandidateIDs)
+	marker.RequestedExternalEffectAggregateIDs = normalizePromptAttemptReclamationIDsSQLite(marker.RequestedExternalEffectAggregateIDs)
+	marker.RelatedExternalEffectAggregateIDs = normalizePromptAttemptReclamationIDsSQLite(marker.RelatedExternalEffectAggregateIDs)
+	return marker, nil
+}
+
+func sqlitePromptAttemptReclaimNotReady(format string, args ...any) error {
+	return fmt.Errorf("%w: %s", store.ErrNotReady, fmt.Sprintf(format, args...))
+}
+
+// RecoverPromptAttemptPreSubmission returns an old-epoch pre-submission
+// attempt to Reserved without inventing a new attempt or replaying a prompt.
+func (s *Store) RecoverPromptAttemptPreSubmission(ctx context.Context, recovery store.PromptAttemptPreSubmissionRecovery) (*store.PromptAttempt, error) {
+	recovery.ID = strings.TrimSpace(recovery.ID)
+	if err := store.ValidateControlIdentifier("prompt attempt ID", recovery.ID); err != nil {
+		return nil, err
+	}
+	fence, err := normalizeEpochFence(recovery.Fence)
+	if err != nil {
+		return nil, err
+	}
+	recovery.Fence = fence
+	if recovery.ExpectedVersion < 1 {
+		return nil, store.ValidationErrorf("prompt attempt expected version must be at least 1")
+	}
+	if recovery.ExpectedState != store.PromptExecutionReserved &&
+		recovery.ExpectedState != store.PromptExecutionSessionStarting && recovery.ExpectedState != store.PromptExecutionPlanned {
+		return nil, store.ValidationErrorf("only Reserved, SessionStarting, or Planned attempts may be recovered before submission")
+	}
+	recovery.OperationID = strings.TrimSpace(recovery.OperationID)
+	if err := store.ValidateControlIdentifier("prompt attempt recovery operation ID", recovery.OperationID); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateCanonicalDigest("prompt attempt recovery operation digest", recovery.OperationDigest); err != nil {
+		return nil, err
+	}
+	recovery.RecoveredAt = normalizeControlTime(recovery.RecoveredAt)
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, recovery.Fence); err != nil {
+		return nil, err
+	}
+	attempt, err := getPromptAttempt(ctx, tx, recovery.ID)
+	if err != nil {
+		return nil, err
+	}
+	if attempt.LastOperationID == recovery.OperationID {
+		if attempt.LastOperationDigest != recovery.OperationDigest {
+			return nil, controlConflict("prompt attempt recovery operation %q was reused with a different digest", recovery.OperationID)
+		}
+		if attempt.ExecutionState == store.PromptExecutionReserved {
+			return &attempt, nil
+		}
+		return nil, controlConflict("prompt attempt recovery operation %q was already applied with a different state", recovery.OperationID)
+	}
+	if attempt.Version != recovery.ExpectedVersion || attempt.ExecutionState != recovery.ExpectedState {
+		return nil, controlConflict("prompt attempt %q no longer matches pre-submission recovery version/state", attempt.ID)
+	}
+	result, err := tx.ExecContext(ctx,
+		`UPDATE prompt_attempts
+		 SET execution_state = 'Reserved', runtime_instance_id = '', session_uid = '', session_lease_generation = 0,
+		     controller_epoch_name = ?, controller_epoch = ?, last_operation_id = ?, last_operation_digest = ?,
+		     version = version + 1, updated_at = ?
+		 WHERE id = ? AND version = ? AND execution_state = ?`,
+		recovery.Fence.Name, recovery.Fence.Epoch, recovery.OperationID, recovery.OperationDigest,
+		recovery.RecoveredAt, recovery.ID, recovery.ExpectedVersion, string(recovery.ExpectedState),
+	)
+	if err != nil {
+		return nil, err
+	}
+	if err := rowsAffectedExactlyOne(result, "prompt attempt pre-submission recovery"); err != nil {
+		return nil, err
+	}
+	attempt.ExecutionState = store.PromptExecutionReserved
+	attempt.RuntimeInstanceID = ""
+	attempt.SessionUID = ""
+	attempt.SessionLeaseGeneration = 0
+	attempt.ControllerEpochName = recovery.Fence.Name
+	attempt.ControllerEpoch = recovery.Fence.Epoch
+	attempt.LastOperationID = recovery.OperationID
+	attempt.LastOperationDigest = recovery.OperationDigest
+	attempt.Version++
+	attempt.UpdatedAt = recovery.RecoveredAt
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &attempt, nil
+}
+
+// TransitionPromptAttemptExecution applies an exact version/state/epoch CAS.
+//
+//nolint:gocyclo // Execution-state, fencing, and immutable runtime/session bindings are one CAS boundary.
+func (s *Store) TransitionPromptAttemptExecution(ctx context.Context, transition store.PromptAttemptExecutionTransition) (*store.PromptAttempt, error) {
+	transition.ID = strings.TrimSpace(transition.ID)
+	if err := store.ValidateControlIdentifier("prompt attempt ID", transition.ID); err != nil {
+		return nil, err
+	}
+	fence, err := normalizeEpochFence(transition.Fence)
+	if err != nil {
+		return nil, err
+	}
+	transition.Fence = fence
+	if transition.ExpectedVersion < 1 {
+		return nil, store.ValidationErrorf("prompt attempt expected version must be at least 1")
+	}
+	if err := store.ValidatePromptExecutionTransition(transition.ExpectedState, transition.NewState); err != nil {
+		return nil, err
+	}
+	transition.OperationID = strings.TrimSpace(transition.OperationID)
+	if err := store.ValidateControlIdentifier("prompt attempt operation ID", transition.OperationID); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateCanonicalDigest("prompt attempt operation digest", transition.OperationDigest); err != nil {
+		return nil, err
+	}
+	transition.RuntimeInstanceID = strings.TrimSpace(transition.RuntimeInstanceID)
+	transition.SessionUID = strings.TrimSpace(transition.SessionUID)
+	if transition.SessionLeaseGeneration < 0 {
+		return nil, store.ValidationErrorf("session lease generation must not be negative")
+	}
+	if transition.SessionLeaseGeneration > 0 && transition.SessionUID == "" {
+		return nil, store.ValidationErrorf("session UID is required when setting a session lease generation")
+	}
+	if transition.SessionUID != "" {
+		if err := store.ValidateControlIdentifier("session UID", transition.SessionUID); err != nil {
+			return nil, err
+		}
+	}
+	if transition.RuntimeInstanceID != "" {
+		if err := store.ValidateControlIdentifier("runtime instance ID", transition.RuntimeInstanceID); err != nil {
+			return nil, err
+		}
+	}
+	if err := store.ValidateControlReason("prompt attempt terminal reason", transition.TerminalReason); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateControlReason("prompt attempt outcome marker", transition.OutcomeMarker); err != nil {
+		return nil, err
+	}
+	if transition.NewState == store.PromptExecutionOutcomeUnknown && strings.TrimSpace(transition.OutcomeMarker) == "" {
+		return nil, store.ValidationErrorf("OutcomeUnknown requires an explicit outcome marker")
+	}
+	transition.UpdatedAt = normalizeControlTime(transition.UpdatedAt)
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, transition.Fence); err != nil {
+		return nil, err
+	}
+	attempt, err := getPromptAttempt(ctx, tx, transition.ID)
+	if err != nil {
+		return nil, err
+	}
+	if attempt.LastOperationID == transition.OperationID {
+		if attempt.LastOperationDigest != transition.OperationDigest {
+			return nil, controlConflict("prompt attempt operation %q was reused with a different digest", transition.OperationID)
+		}
+		if attempt.ExecutionState == transition.NewState {
+			return &attempt, nil
+		}
+		return nil, controlConflict("prompt attempt operation %q was already applied to state %s", transition.OperationID, attempt.ExecutionState)
+	}
+	if attempt.Version != transition.ExpectedVersion || attempt.ExecutionState != transition.ExpectedState {
+		return nil, controlConflict("prompt attempt %q is version %d state %s, expected version %d state %s", attempt.ID, attempt.Version, attempt.ExecutionState, transition.ExpectedVersion, transition.ExpectedState)
+	}
+	if transition.RuntimeInstanceID != "" && attempt.RuntimeInstanceID != "" && attempt.RuntimeInstanceID != transition.RuntimeInstanceID {
+		return nil, controlConflict("prompt attempt %q runtime instance is immutable once set", attempt.ID)
+	}
+	if transition.SessionUID != "" && attempt.SessionUID != "" && attempt.SessionUID != transition.SessionUID {
+		return nil, controlConflict("prompt attempt %q session UID is immutable once set", attempt.ID)
+	}
+	if transition.SessionLeaseGeneration > 0 && attempt.SessionLeaseGeneration > 0 && attempt.SessionLeaseGeneration != transition.SessionLeaseGeneration {
+		return nil, controlConflict("prompt attempt %q session lease generation is immutable once set", attempt.ID)
+	}
+
+	runtimeInstanceID := attempt.RuntimeInstanceID
+	if transition.RuntimeInstanceID != "" {
+		runtimeInstanceID = transition.RuntimeInstanceID
+	}
+	sessionUID := attempt.SessionUID
+	if transition.SessionUID != "" {
+		sessionUID = transition.SessionUID
+	}
+	leaseGeneration := attempt.SessionLeaseGeneration
+	if transition.SessionLeaseGeneration > 0 {
+		leaseGeneration = transition.SessionLeaseGeneration
+	}
+	terminalReason := attempt.TerminalReason
+	if transition.TerminalReason != "" || store.IsTerminalPromptExecutionState(transition.NewState) {
+		terminalReason = transition.TerminalReason
+	}
+	outcomeMarker := attempt.OutcomeMarker
+	if transition.OutcomeMarker != "" {
+		outcomeMarker = transition.OutcomeMarker
+	}
+
+	result, err := tx.ExecContext(ctx,
+		`UPDATE prompt_attempts
+		 SET execution_state = ?, runtime_instance_id = ?, session_uid = ?, session_lease_generation = ?,
+		     terminal_reason = ?, outcome_marker = ?, controller_epoch_name = ?, controller_epoch = ?,
+		     last_operation_id = ?, last_operation_digest = ?, version = version + 1, updated_at = ?
+		 WHERE id = ? AND version = ? AND execution_state = ?`,
+		string(transition.NewState), runtimeInstanceID, sessionUID, leaseGeneration, terminalReason, outcomeMarker,
+		transition.Fence.Name, transition.Fence.Epoch, transition.OperationID, transition.OperationDigest,
+		transition.UpdatedAt, transition.ID, transition.ExpectedVersion, string(transition.ExpectedState),
+	)
+	if err != nil {
+		return nil, err
+	}
+	if err := rowsAffectedExactlyOne(result, "prompt attempt execution"); err != nil {
+		return nil, err
+	}
+	attempt.ExecutionState = transition.NewState
+	attempt.RuntimeInstanceID = runtimeInstanceID
+	attempt.SessionUID = sessionUID
+	attempt.SessionLeaseGeneration = leaseGeneration
+	attempt.TerminalReason = terminalReason
+	attempt.OutcomeMarker = outcomeMarker
+	attempt.ControllerEpochName = transition.Fence.Name
+	attempt.ControllerEpoch = transition.Fence.Epoch
+	attempt.LastOperationID = transition.OperationID
+	attempt.LastOperationDigest = transition.OperationDigest
+	attempt.Version++
+	attempt.UpdatedAt = transition.UpdatedAt
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &attempt, nil
+}
+
+// TransitionPromptAttemptDelivery applies an exact delivery-state CAS.
+func (s *Store) TransitionPromptAttemptDelivery(ctx context.Context, transition store.PromptAttemptDeliveryTransition) (*store.PromptAttempt, error) {
+	transition.ID = strings.TrimSpace(transition.ID)
+	if err := store.ValidateControlIdentifier("prompt attempt ID", transition.ID); err != nil {
+		return nil, err
+	}
+	fence, err := normalizeEpochFence(transition.Fence)
+	if err != nil {
+		return nil, err
+	}
+	transition.Fence = fence
+	if transition.ExpectedVersion < 1 {
+		return nil, store.ValidationErrorf("prompt attempt expected version must be at least 1")
+	}
+	if err := store.ValidatePromptDeliveryTransition(transition.ExpectedState, transition.NewState); err != nil {
+		return nil, err
+	}
+	transition.OperationID = strings.TrimSpace(transition.OperationID)
+	if err := store.ValidateControlIdentifier("prompt attempt operation ID", transition.OperationID); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateCanonicalDigest("prompt attempt operation digest", transition.OperationDigest); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateControlReason("prompt delivery terminal reason", transition.TerminalReason); err != nil {
+		return nil, err
+	}
+	transition.UpdatedAt = normalizeControlTime(transition.UpdatedAt)
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, transition.Fence); err != nil {
+		return nil, err
+	}
+	attempt, err := getPromptAttempt(ctx, tx, transition.ID)
+	if err != nil {
+		return nil, err
+	}
+	if attempt.LastOperationID == transition.OperationID {
+		if attempt.LastOperationDigest != transition.OperationDigest {
+			return nil, controlConflict("prompt attempt operation %q was reused with a different digest", transition.OperationID)
+		}
+		if attempt.DeliveryState == transition.NewState {
+			return &attempt, nil
+		}
+		return nil, controlConflict("prompt attempt operation %q was already applied to delivery state %s", transition.OperationID, attempt.DeliveryState)
+	}
+	if attempt.Version != transition.ExpectedVersion || attempt.DeliveryState != transition.ExpectedState {
+		return nil, controlConflict("prompt attempt %q is version %d delivery state %s, expected version %d state %s", attempt.ID, attempt.Version, attempt.DeliveryState, transition.ExpectedVersion, transition.ExpectedState)
+	}
+
+	terminalReason := attempt.TerminalReason
+	if transition.TerminalReason != "" || store.IsTerminalPromptDeliveryState(transition.NewState) {
+		terminalReason = transition.TerminalReason
+	}
+	result, err := tx.ExecContext(ctx,
+		`UPDATE prompt_attempts
+		 SET delivery_state = ?, terminal_reason = ?, controller_epoch_name = ?, controller_epoch = ?,
+		     last_operation_id = ?, last_operation_digest = ?, version = version + 1, updated_at = ?
+		 WHERE id = ? AND version = ? AND delivery_state = ?`,
+		string(transition.NewState), terminalReason, transition.Fence.Name, transition.Fence.Epoch,
+		transition.OperationID, transition.OperationDigest, transition.UpdatedAt,
+		transition.ID, transition.ExpectedVersion, string(transition.ExpectedState),
+	)
+	if err != nil {
+		return nil, err
+	}
+	if err := rowsAffectedExactlyOne(result, "prompt attempt delivery"); err != nil {
+		return nil, err
+	}
+	attempt.DeliveryState = transition.NewState
+	attempt.TerminalReason = terminalReason
+	attempt.ControllerEpochName = transition.Fence.Name
+	attempt.ControllerEpoch = transition.Fence.Epoch
+	attempt.LastOperationID = transition.OperationID
+	attempt.LastOperationDigest = transition.OperationDigest
+	attempt.Version++
+	attempt.UpdatedAt = transition.UpdatedAt
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &attempt, nil
+}
+
+func normalizePromptAttemptForCreate(attempt *store.PromptAttempt, fence store.ControllerEpochFence) (store.PromptAttempt, store.ControllerEpochFence, error) {
+	if attempt == nil {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, store.ValidationErrorf("prompt attempt is required")
+	}
+	normalized := *attempt
+	normalized.Key.Namespace = strings.TrimSpace(normalized.Key.Namespace)
+	normalized.Key.TaskUID = strings.TrimSpace(normalized.Key.TaskUID)
+	normalized.Key.PromptID = strings.TrimSpace(normalized.Key.PromptID)
+	if err := normalized.Key.Validate(); err != nil {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, err
+	}
+	canonicalID, err := normalized.Key.CanonicalID()
+	if err != nil {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, err
+	}
+	normalized.ID = strings.TrimSpace(normalized.ID)
+	if normalized.ID == "" {
+		normalized.ID = canonicalID
+	}
+	if normalized.ID != canonicalID {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, store.ValidationErrorf("prompt attempt ID must equal canonical ID %q", canonicalID)
+	}
+	if err := store.ValidateCanonicalDigest("prompt attempt request digest", normalized.RequestDigest); err != nil {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, err
+	}
+	if err := store.ValidateCanonicalDigest("prompt attempt binding digest", normalized.BindingDigest); err != nil {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, err
+	}
+	if err := store.ValidateCanonicalDigest("prompt attempt snapshot digest", normalized.SnapshotDigest); err != nil {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, err
+	}
+	if normalized.ExecutionState == "" {
+		normalized.ExecutionState = store.PromptExecutionQueued
+	}
+	if !store.IsKnownPromptExecutionState(normalized.ExecutionState) {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, store.ValidationErrorf("unsupported prompt execution state %q", normalized.ExecutionState)
+	}
+	if normalized.ExecutionState != store.PromptExecutionQueued {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, store.ValidationErrorf("new prompt attempt must start in %s", store.PromptExecutionQueued)
+	}
+	if normalized.DeliveryState == "" {
+		normalized.DeliveryState = store.PromptDeliveryNotRequested
+	}
+	if normalized.DeliveryState != store.PromptDeliveryNotRequested {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, store.ValidationErrorf("new prompt attempt must start delivery in %s", store.PromptDeliveryNotRequested)
+	}
+	fence, err = normalizeEpochFence(fence)
+	if err != nil {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, err
+	}
+	normalized.SessionUID = strings.TrimSpace(normalized.SessionUID)
+	normalized.RuntimeInstanceID = strings.TrimSpace(normalized.RuntimeInstanceID)
+	if normalized.SessionLeaseGeneration < 0 {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, store.ValidationErrorf("session lease generation must not be negative")
+	}
+	if normalized.SessionLeaseGeneration > 0 && normalized.SessionUID == "" {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, store.ValidationErrorf("session UID is required with a session lease generation")
+	}
+	if normalized.SessionUID != "" {
+		if err := store.ValidateControlIdentifier("session UID", normalized.SessionUID); err != nil {
+			return store.PromptAttempt{}, store.ControllerEpochFence{}, err
+		}
+	}
+	if normalized.RuntimeInstanceID != "" {
+		if err := store.ValidateControlIdentifier("runtime instance ID", normalized.RuntimeInstanceID); err != nil {
+			return store.PromptAttempt{}, store.ControllerEpochFence{}, err
+		}
+	}
+	if normalized.Version != 0 && normalized.Version != 1 {
+		return store.PromptAttempt{}, store.ControllerEpochFence{}, store.ValidationErrorf("new prompt attempt version must be zero or one")
+	}
+	now := normalizeControlTime(normalized.CreatedAt)
+	normalized.CreatedAt = now
+	if normalized.UpdatedAt.IsZero() {
+		normalized.UpdatedAt = now
+	} else {
+		normalized.UpdatedAt = normalized.UpdatedAt.UTC()
+	}
+	normalized.ControllerEpochName = fence.Name
+	normalized.ControllerEpoch = fence.Epoch
+	normalized.Version = 1
+	normalized.LastOperationID = ""
+	normalized.LastOperationDigest = ""
+	return normalized, fence, nil
+}
+
+func samePromptAttemptCreation(a, b store.PromptAttempt) bool {
+	return a.ID == b.ID && a.Key == b.Key && a.RequestDigest == b.RequestDigest &&
+		a.BindingDigest == b.BindingDigest && a.SnapshotDigest == b.SnapshotDigest
+}
+
+func getPromptAttempt(ctx context.Context, q controlQueryRower, id string) (store.PromptAttempt, error) {
+	var attempt store.PromptAttempt
+	err := q.QueryRowContext(ctx,
+		`SELECT id, namespace, task_uid, attempt, prompt_id, session_uid, session_lease_generation,
+		        runtime_instance_id, request_digest, binding_digest, snapshot_digest,
+		        execution_state, delivery_state, terminal_reason,
+		        outcome_marker, controller_epoch_name, controller_epoch, last_operation_id,
+		        last_operation_digest, version, created_at, updated_at
+		 FROM prompt_attempts WHERE id = ?`,
+		id,
+	).Scan(
+		&attempt.ID, &attempt.Key.Namespace, &attempt.Key.TaskUID, &attempt.Key.Attempt, &attempt.Key.PromptID,
+		&attempt.SessionUID, &attempt.SessionLeaseGeneration, &attempt.RuntimeInstanceID, &attempt.RequestDigest,
+		&attempt.BindingDigest, &attempt.SnapshotDigest,
+		&attempt.ExecutionState, &attempt.DeliveryState, &attempt.TerminalReason, &attempt.OutcomeMarker,
+		&attempt.ControllerEpochName, &attempt.ControllerEpoch, &attempt.LastOperationID,
+		&attempt.LastOperationDigest, &attempt.Version, &attempt.CreatedAt, &attempt.UpdatedAt,
+	)
+	if errors.Is(err, sql.ErrNoRows) {
+		return store.PromptAttempt{}, store.ErrNotFound
+	}
+	if err != nil {
+		return store.PromptAttempt{}, fmt.Errorf("get prompt attempt: %w", err)
+	}
+	return attempt, nil
+}
diff --git a/internal/store/sqlite/publication_store.go b/internal/store/sqlite/publication_store.go
new file mode 100644
index 000000000..96ff9d2c1
--- /dev/null
+++ b/internal/store/sqlite/publication_store.go
@@ -0,0 +1,847 @@
+package sqlite
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"reflect"
+	"strings"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+var _ store.PublicationStore = (*Store)(nil)
+
+// CreatePublication persists immutable clean-room publication intent in Preparing.
+func (s *Store) CreatePublication(ctx context.Context, publication *store.Publication, fence store.ControllerEpochFence) (*store.Publication, error) {
+	normalized, fence, err := normalizePublicationForCreate(publication, fence)
+	if err != nil {
+		return nil, err
+	}
+	prIntentJSON, err := marshalOptionalControlJSON(normalized.PRIntent)
+	if err != nil {
+		return nil, err
+	}
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, fence); err != nil {
+		return nil, err
+	}
+	if existing, getErr := getPublication(ctx, tx, normalized.ID); getErr == nil {
+		if samePublicationCreation(existing, normalized) {
+			return &existing, nil
+		}
+		return nil, controlConflict("publication %q was reused with different immutable intent or request digest", normalized.ID)
+	} else if !errors.Is(getErr, store.ErrNotFound) {
+		return nil, getErr
+	}
+	claim, err := getBranchClaim(ctx, tx, normalized.BranchClaimID)
+	if err != nil {
+		return nil, fmt.Errorf("publication branch claim: %w", err)
+	}
+	if claim.RepositoryID != normalized.TargetRepositoryID || claim.Ref != normalized.TargetRef ||
+		claim.Generation != normalized.BranchClaimGeneration || !claim.LastVerified.Equal(normalized.Baseline) ||
+		claim.Availability != store.BranchClaimAvailable {
+		return nil, controlConflict("publication %q branch claim does not match exact target, generation, baseline, or availability", normalized.ID)
+	}
+
+	_, err = tx.ExecContext(ctx,
+		`INSERT INTO publications(
+			id, namespace, generation, task_uid, attempt, prompt_id, session_uid, branch_claim_id,
+			branch_claim_generation, source_repository_id, source_ref, source_baseline_sha, target_repository_id, target_ref,
+			baseline_absent, baseline_sha, artifact_id, artifact_digest, artifact_size_bytes, artifact_media_type,
+			publication_credential_ref, commit_identity,
+			commit_message, commit_timestamp, pr_intent, request_digest, state, prepared_receipt,
+			publish_receipt, verification_receipt, pr_receipt, terminal_reason, controller_epoch_name,
+			controller_epoch, last_operation_id, last_operation_digest, version, created_at, updated_at
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		normalized.ID, normalized.Namespace, normalized.Generation, normalized.TaskUID, normalized.Attempt,
+		normalized.PromptID, normalized.SessionUID, normalized.BranchClaimID, normalized.BranchClaimGeneration,
+		normalized.SourceRepositoryID, normalized.SourceRef, normalized.SourceBaselineSHA, normalized.TargetRepositoryID, normalized.TargetRef,
+		normalized.Baseline.Absent, normalized.Baseline.SHA, normalized.ArtifactID, normalized.ArtifactDigest,
+		normalized.ArtifactSizeBytes, normalized.ArtifactMediaType,
+		normalized.PublicationCredentialRef, normalized.CommitIdentity, normalized.CommitMessage,
+		normalized.CommitTimestamp, prIntentJSON, normalized.RequestDigest, string(normalized.State), nil, nil, nil, nil,
+		normalized.TerminalReason, normalized.ControllerEpochName, normalized.ControllerEpoch,
+		normalized.LastOperationID, normalized.LastOperationDigest, normalized.Version,
+		normalized.CreatedAt, normalized.UpdatedAt,
+	)
+	if err != nil {
+		if !isSQLiteConstraintError(err) {
+			return nil, err
+		}
+		existing, getErr := getPublication(ctx, tx, normalized.ID)
+		if getErr == nil && samePublicationCreation(existing, normalized) {
+			return &existing, nil
+		}
+		return nil, controlConflict("publication %q was reused with different immutable intent or request digest", normalized.ID)
+	}
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &normalized, nil
+}
+
+// GetPublication returns a publication and its exact receipts.
+func (s *Store) GetPublication(ctx context.Context, id string) (*store.Publication, error) {
+	id = strings.TrimSpace(id)
+	if err := store.ValidateControlIdentifier("publication ID", id); err != nil {
+		return nil, err
+	}
+	publication, err := getPublication(ctx, s.db, id)
+	if err != nil {
+		return nil, err
+	}
+	return &publication, nil
+}
+
+// SetPublicationPRIntent persists the exact PR tuple after independent remote
+// verification has fixed the current head and before the first forge call.
+func (s *Store) SetPublicationPRIntent(ctx context.Context, request store.SetPublicationPRIntentRequest) (*store.Publication, error) {
+	request.ID = strings.TrimSpace(request.ID)
+	if err := store.ValidateControlIdentifier("publication ID", request.ID); err != nil {
+		return nil, err
+	}
+	fence, err := normalizeEpochFence(request.Fence)
+	if err != nil {
+		return nil, err
+	}
+	request.Fence = fence
+	if request.ExpectedVersion < 1 || request.ExpectedGeneration < 1 || request.ExpectedState != store.PublicationPrepared && request.ExpectedState != store.PublicationVerifying {
+		return nil, store.ValidationErrorf("PR intent requires an exact Prepared or Verifying publication version/generation")
+	}
+	if err := validatePullRequestIntent(request.Intent, request.ExpectedGeneration); err != nil {
+		return nil, err
+	}
+	request.OperationID = strings.TrimSpace(request.OperationID)
+	if err := store.ValidateControlIdentifier("PR intent operation ID", request.OperationID); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateCanonicalDigest("PR intent operation digest", request.OperationDigest); err != nil {
+		return nil, err
+	}
+	request.UpdatedAt = normalizeControlTime(request.UpdatedAt)
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, request.Fence); err != nil {
+		return nil, err
+	}
+	publication, err := getPublication(ctx, tx, request.ID)
+	if err != nil {
+		return nil, err
+	}
+	if publication.PreparedReceipt == nil {
+		return nil, store.ValidationErrorf("PR intent requires a durable prepared receipt")
+	}
+	if request.ExpectedState == store.PublicationPrepared && publication.PreparedReceipt.CommitSHA != request.Intent.ExpectedHeadSHA {
+		return nil, store.ValidationErrorf("Prepared PR intent expected head must equal the durable prepared commit")
+	}
+	if publication.LastOperationID == request.OperationID {
+		if publication.LastOperationDigest == request.OperationDigest && publication.PRIntent != nil && reflect.DeepEqual(*publication.PRIntent, request.Intent) {
+			return &publication, nil
+		}
+		return nil, controlConflict("PR intent operation %q was reused with different content", request.OperationID)
+	}
+	if publication.Version != request.ExpectedVersion || publication.Generation != request.ExpectedGeneration || publication.State != request.ExpectedState || publication.PRIntent != nil {
+		return nil, controlConflict("publication %q no longer matches PR intent version/generation/state", publication.ID)
+	}
+	intentJSON, err := marshalOptionalControlJSON(&request.Intent)
+	if err != nil {
+		return nil, err
+	}
+	result, err := tx.ExecContext(ctx,
+		`UPDATE publications SET pr_intent = ?, controller_epoch_name = ?, controller_epoch = ?,
+		 last_operation_id = ?, last_operation_digest = ?, version = version + 1, updated_at = ?
+		 WHERE id = ? AND version = ? AND generation = ? AND state = ? AND pr_intent IS NULL`,
+		intentJSON, request.Fence.Name, request.Fence.Epoch, request.OperationID, request.OperationDigest,
+		request.UpdatedAt, request.ID, request.ExpectedVersion, request.ExpectedGeneration, string(request.ExpectedState),
+	)
+	if err != nil {
+		return nil, err
+	}
+	if err := rowsAffectedExactlyOne(result, "publication PR intent"); err != nil {
+		return nil, err
+	}
+	intent := request.Intent
+	publication.PRIntent = &intent
+	publication.ControllerEpochName = request.Fence.Name
+	publication.ControllerEpoch = request.Fence.Epoch
+	publication.LastOperationID = request.OperationID
+	publication.LastOperationDigest = request.OperationDigest
+	publication.Version++
+	publication.UpdatedAt = request.UpdatedAt
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &publication, nil
+}
+
+// SetPublicationPRReceipt commits the exact forge result before the
+// Publication leaves Verifying.
+func (s *Store) SetPublicationPRReceipt(ctx context.Context, request store.SetPublicationPRReceiptRequest) (*store.Publication, error) {
+	request.ID = strings.TrimSpace(request.ID)
+	if err := store.ValidateControlIdentifier("publication ID", request.ID); err != nil {
+		return nil, err
+	}
+	fence, err := normalizeEpochFence(request.Fence)
+	if err != nil {
+		return nil, err
+	}
+	request.Fence = fence
+	if request.ExpectedVersion < 1 || request.ExpectedGeneration < 1 || request.ExpectedState != store.PublicationVerifying {
+		return nil, store.ValidationErrorf("PR receipt requires an exact Verifying publication version/generation")
+	}
+	request.OperationID = strings.TrimSpace(request.OperationID)
+	if err := store.ValidateControlIdentifier("PR receipt operation ID", request.OperationID); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateCanonicalDigest("PR receipt operation digest", request.OperationDigest); err != nil {
+		return nil, err
+	}
+	request.UpdatedAt = normalizeControlTime(request.UpdatedAt)
+	if err := validatePullRequestReceipt(request.Receipt); err != nil {
+		return nil, err
+	}
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, request.Fence); err != nil {
+		return nil, err
+	}
+	publication, err := getPublication(ctx, tx, request.ID)
+	if err != nil {
+		return nil, err
+	}
+	if publication.PRIntent == nil || publication.PRIntent.ExpectedHeadSHA != request.Receipt.HeadSHA {
+		return nil, store.ValidationErrorf("PR receipt does not match the persisted intent head")
+	}
+	if publication.LastOperationID == request.OperationID {
+		if publication.LastOperationDigest == request.OperationDigest && publication.PullRequestReceipt != nil && reflect.DeepEqual(*publication.PullRequestReceipt, request.Receipt) {
+			return &publication, nil
+		}
+		return nil, controlConflict("PR receipt operation %q was reused with different content", request.OperationID)
+	}
+	if publication.Version != request.ExpectedVersion || publication.Generation != request.ExpectedGeneration || publication.State != request.ExpectedState || publication.PullRequestReceipt != nil {
+		return nil, controlConflict("publication %q no longer matches PR receipt version/generation/state", publication.ID)
+	}
+	receiptJSON, err := marshalOptionalControlJSON(&request.Receipt)
+	if err != nil {
+		return nil, err
+	}
+	result, err := tx.ExecContext(ctx,
+		`UPDATE publications SET pr_receipt = ?, controller_epoch_name = ?, controller_epoch = ?,
+		 last_operation_id = ?, last_operation_digest = ?, version = version + 1, updated_at = ?
+		 WHERE id = ? AND version = ? AND generation = ? AND state = 'Verifying' AND pr_receipt IS NULL`,
+		receiptJSON, request.Fence.Name, request.Fence.Epoch, request.OperationID, request.OperationDigest,
+		request.UpdatedAt, request.ID, request.ExpectedVersion, request.ExpectedGeneration,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if err := rowsAffectedExactlyOne(result, "publication PR receipt"); err != nil {
+		return nil, err
+	}
+	receipt := request.Receipt
+	publication.PullRequestReceipt = &receipt
+	publication.ControllerEpochName = request.Fence.Name
+	publication.ControllerEpoch = request.Fence.Epoch
+	publication.LastOperationID = request.OperationID
+	publication.LastOperationDigest = request.OperationDigest
+	publication.Version++
+	publication.UpdatedAt = request.UpdatedAt
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &publication, nil
+}
+
+func validatePullRequestReceipt(receipt store.PullRequestOperationReceipt) error {
+	for field, value := range map[string]string{
+		"PR receipt operation ID": receipt.OperationID, "PR receipt intent key": receipt.IntentKey,
+		"PR receipt forge ID": receipt.ForgeID, "PR receipt URL": receipt.URL, "PR receipt state": receipt.State,
+	} {
+		if err := store.ValidateControlIdentifier(field, strings.TrimSpace(value)); err != nil {
+			return err
+		}
+	}
+	if err := store.ValidateCanonicalDigest("PR receipt request digest", receipt.RequestDigest); err != nil {
+		return err
+	}
+	if err := store.ValidateGitObjectID("PR receipt head SHA", receipt.HeadSHA); err != nil {
+		return err
+	}
+	if receipt.ReconciledAt.IsZero() {
+		return store.ValidationErrorf("PR receipt reconciliation timestamp is required")
+	}
+	return nil
+}
+
+// TransitionPublication applies a fenced generation/version/state CAS and
+// validates that the persisted receipt exactly matches immutable intent.
+//
+//nolint:gocyclo // Receipt-specific validation and the publication CAS intentionally share one boundary.
+func (s *Store) TransitionPublication(ctx context.Context, transition store.PublicationTransition) (*store.Publication, error) {
+	transition.ID = strings.TrimSpace(transition.ID)
+	if err := store.ValidateControlIdentifier("publication ID", transition.ID); err != nil {
+		return nil, err
+	}
+	fence, err := normalizeEpochFence(transition.Fence)
+	if err != nil {
+		return nil, err
+	}
+	transition.Fence = fence
+	if transition.ExpectedVersion < 1 || transition.ExpectedGeneration < 1 {
+		return nil, store.ValidationErrorf("publication expected version and generation must be at least 1")
+	}
+	if err := store.ValidatePublicationTransition(transition.ExpectedState, transition.NewState); err != nil {
+		return nil, err
+	}
+	transition.OperationID = strings.TrimSpace(transition.OperationID)
+	if err := store.ValidateControlIdentifier("publication operation ID", transition.OperationID); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateCanonicalDigest("publication operation digest", transition.OperationDigest); err != nil {
+		return nil, err
+	}
+	transition.TerminalReason = strings.TrimSpace(transition.TerminalReason)
+	if err := store.ValidateControlReason("publication terminal reason", transition.TerminalReason); err != nil {
+		return nil, err
+	}
+	transition.UpdatedAt = normalizeControlTime(transition.UpdatedAt)
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, transition.Fence); err != nil {
+		return nil, err
+	}
+	publication, err := getPublication(ctx, tx, transition.ID)
+	if err != nil {
+		return nil, err
+	}
+	if err := validatePublicationTransitionReceipts(publication, transition); err != nil {
+		return nil, err
+	}
+	if publication.LastOperationID == transition.OperationID {
+		if publication.LastOperationDigest != transition.OperationDigest {
+			return nil, controlConflict("publication operation %q was reused with a different digest", transition.OperationID)
+		}
+		if publication.State == transition.NewState && publicationTransitionReceiptsMatch(publication, transition) {
+			return &publication, nil
+		}
+		return nil, controlConflict("publication operation %q was already applied with different target state or receipt", transition.OperationID)
+	}
+	if publication.Version != transition.ExpectedVersion || publication.Generation != transition.ExpectedGeneration || publication.State != transition.ExpectedState {
+		return nil, controlConflict("publication %q is version %d generation %d state %s, expected version %d generation %d state %s", publication.ID, publication.Version, publication.Generation, publication.State, transition.ExpectedVersion, transition.ExpectedGeneration, transition.ExpectedState)
+	}
+
+	prepared := publication.PreparedReceipt
+	if transition.PreparedReceipt != nil {
+		copyValue := *transition.PreparedReceipt
+		prepared = &copyValue
+	}
+	publish := publication.PublishReceipt
+	if transition.PublishReceipt != nil {
+		copyValue := *transition.PublishReceipt
+		publish = &copyValue
+	}
+	verification := publication.VerificationReceipt
+	if transition.VerificationReceipt != nil {
+		copyValue := *transition.VerificationReceipt
+		verification = &copyValue
+	}
+	preparedJSON, err := marshalOptionalControlJSON(prepared)
+	if err != nil {
+		return nil, err
+	}
+	publishJSON, err := marshalOptionalControlJSON(publish)
+	if err != nil {
+		return nil, err
+	}
+	verificationJSON, err := marshalOptionalControlJSON(verification)
+	if err != nil {
+		return nil, err
+	}
+	terminalReason := publication.TerminalReason
+	if transition.TerminalReason != "" || store.IsTerminalPublicationState(transition.NewState) {
+		terminalReason = transition.TerminalReason
+	}
+	result, err := tx.ExecContext(ctx,
+		`UPDATE publications
+		 SET state = ?, prepared_receipt = ?, publish_receipt = ?, verification_receipt = ?,
+		     terminal_reason = ?, controller_epoch_name = ?, controller_epoch = ?, last_operation_id = ?,
+		     last_operation_digest = ?, version = version + 1, updated_at = ?
+		 WHERE id = ? AND version = ? AND generation = ? AND state = ?`,
+		string(transition.NewState), preparedJSON, publishJSON, verificationJSON, terminalReason,
+		transition.Fence.Name, transition.Fence.Epoch, transition.OperationID, transition.OperationDigest,
+		transition.UpdatedAt, transition.ID, transition.ExpectedVersion, transition.ExpectedGeneration,
+		string(transition.ExpectedState),
+	)
+	if err != nil {
+		return nil, err
+	}
+	if err := rowsAffectedExactlyOne(result, "publication"); err != nil {
+		return nil, err
+	}
+	publication.State = transition.NewState
+	publication.PreparedReceipt = prepared
+	publication.PublishReceipt = publish
+	publication.VerificationReceipt = verification
+	publication.TerminalReason = terminalReason
+	publication.ControllerEpochName = transition.Fence.Name
+	publication.ControllerEpoch = transition.Fence.Epoch
+	publication.LastOperationID = transition.OperationID
+	publication.LastOperationDigest = transition.OperationDigest
+	publication.Version++
+	publication.UpdatedAt = transition.UpdatedAt
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &publication, nil
+}
+
+//nolint:gocyclo // The explicit state-machine branches are easier to audit together.
+func normalizePublicationForCreate(publication *store.Publication, fence store.ControllerEpochFence) (store.Publication, store.ControllerEpochFence, error) {
+	if publication == nil {
+		return store.Publication{}, store.ControllerEpochFence{}, store.ValidationErrorf("publication is required")
+	}
+	normalized := *publication
+	normalized.ID = strings.TrimSpace(normalized.ID)
+	normalized.Namespace = strings.TrimSpace(normalized.Namespace)
+	normalized.TaskUID = strings.TrimSpace(normalized.TaskUID)
+	normalized.PromptID = strings.TrimSpace(normalized.PromptID)
+	normalized.SessionUID = strings.TrimSpace(normalized.SessionUID)
+	normalized.BranchClaimID = strings.TrimSpace(normalized.BranchClaimID)
+	normalized.SourceRepositoryID = strings.TrimSpace(normalized.SourceRepositoryID)
+	normalized.SourceRef = strings.TrimSpace(normalized.SourceRef)
+	normalized.TargetRepositoryID = strings.TrimSpace(normalized.TargetRepositoryID)
+	normalized.TargetRef = strings.TrimSpace(normalized.TargetRef)
+	normalized.PublicationCredentialRef = strings.TrimSpace(normalized.PublicationCredentialRef)
+	normalized.CommitIdentity = strings.TrimSpace(normalized.CommitIdentity)
+	for field, value := range map[string]string{
+		"publication ID": normalized.ID, "publication namespace": normalized.Namespace,
+		"publication task UID": normalized.TaskUID, "publication prompt ID": normalized.PromptID,
+		"branch claim ID": normalized.BranchClaimID, "source repository ID": normalized.SourceRepositoryID,
+		"source ref": normalized.SourceRef, "target repository ID": normalized.TargetRepositoryID,
+		"publication credential reference": normalized.PublicationCredentialRef,
+		"commit identity":                  normalized.CommitIdentity,
+	} {
+		if err := store.ValidateControlIdentifier(field, value); err != nil {
+			return store.Publication{}, store.ControllerEpochFence{}, err
+		}
+	}
+	if normalized.SessionUID != "" {
+		if err := store.ValidateControlIdentifier("publication session UID", normalized.SessionUID); err != nil {
+			return store.Publication{}, store.ControllerEpochFence{}, err
+		}
+	}
+	if normalized.Generation < 1 || normalized.BranchClaimGeneration < 1 || normalized.Attempt < 1 {
+		return store.Publication{}, store.ControllerEpochFence{}, store.ValidationErrorf("publication generation, branch claim generation, and attempt must be at least 1")
+	}
+	if err := store.ValidateFullBranchRef(normalized.TargetRef); err != nil {
+		return store.Publication{}, store.ControllerEpochFence{}, err
+	}
+	if err := normalized.Baseline.Validate("publication baseline"); err != nil {
+		return store.Publication{}, store.ControllerEpochFence{}, err
+	}
+	if err := store.ValidateCanonicalDigest("publication artifact digest", normalized.ArtifactDigest); err != nil {
+		return store.Publication{}, store.ControllerEpochFence{}, err
+	}
+	if err := store.ValidateGitObjectID("publication source baseline SHA", strings.TrimSpace(normalized.SourceBaselineSHA)); err != nil {
+		return store.Publication{}, store.ControllerEpochFence{}, err
+	}
+	normalized.SourceBaselineSHA = strings.TrimSpace(normalized.SourceBaselineSHA)
+	normalized.ArtifactID = strings.TrimSpace(normalized.ArtifactID)
+	normalized.ArtifactMediaType = strings.TrimSpace(normalized.ArtifactMediaType)
+	if err := store.ValidateControlIdentifier("publication artifact ID", normalized.ArtifactID); err != nil {
+		return store.Publication{}, store.ControllerEpochFence{}, err
+	}
+	if normalized.ArtifactSizeBytes < 1 {
+		return store.Publication{}, store.ControllerEpochFence{}, store.ValidationErrorf("publication artifact size must be positive")
+	}
+	if normalized.ArtifactMediaType == "" {
+		return store.Publication{}, store.ControllerEpochFence{}, store.ValidationErrorf("publication artifact media type is required")
+	}
+	if err := store.ValidateCanonicalDigest("publication request digest", normalized.RequestDigest); err != nil {
+		return store.Publication{}, store.ControllerEpochFence{}, err
+	}
+	if strings.TrimSpace(normalized.CommitMessage) == "" {
+		return store.Publication{}, store.ControllerEpochFence{}, store.ValidationErrorf("publication commit message is required")
+	}
+	if err := store.ValidateControlReason("publication commit message", normalized.CommitMessage); err != nil {
+		return store.Publication{}, store.ControllerEpochFence{}, err
+	}
+	if normalized.CommitTimestamp.IsZero() {
+		return store.Publication{}, store.ControllerEpochFence{}, store.ValidationErrorf("publication commit timestamp is required")
+	}
+	normalized.CommitTimestamp = normalized.CommitTimestamp.UTC()
+	if normalized.PRIntent != nil {
+		copyIntent := *normalized.PRIntent
+		copyIntent.BaseRepositoryID = strings.TrimSpace(copyIntent.BaseRepositoryID)
+		copyIntent.BaseRef = strings.TrimSpace(copyIntent.BaseRef)
+		copyIntent.HeadRepositoryID = strings.TrimSpace(copyIntent.HeadRepositoryID)
+		copyIntent.HeadRef = strings.TrimSpace(copyIntent.HeadRef)
+		copyIntent.ExpectedHeadSHA = strings.TrimSpace(copyIntent.ExpectedHeadSHA)
+		normalized.PRIntent = &copyIntent
+		if err := validatePullRequestIntent(copyIntent, normalized.Generation); err != nil {
+			return store.Publication{}, store.ControllerEpochFence{}, err
+		}
+	}
+	if normalized.State == "" {
+		normalized.State = store.PublicationPreparing
+	}
+	if normalized.State != store.PublicationPreparing {
+		return store.Publication{}, store.ControllerEpochFence{}, store.ValidationErrorf("new publication must start in %s", store.PublicationPreparing)
+	}
+	if normalized.PreparedReceipt != nil || normalized.PublishReceipt != nil || normalized.VerificationReceipt != nil || normalized.PullRequestReceipt != nil {
+		return store.Publication{}, store.ControllerEpochFence{}, store.ValidationErrorf("new publication must not include operation receipts")
+	}
+	fence, err := normalizeEpochFence(fence)
+	if err != nil {
+		return store.Publication{}, store.ControllerEpochFence{}, err
+	}
+	if normalized.Version != 0 && normalized.Version != 1 {
+		return store.Publication{}, store.ControllerEpochFence{}, store.ValidationErrorf("new publication version must be zero or one")
+	}
+	now := normalizeControlTime(normalized.CreatedAt)
+	normalized.CreatedAt = now
+	if normalized.UpdatedAt.IsZero() {
+		normalized.UpdatedAt = now
+	} else {
+		normalized.UpdatedAt = normalized.UpdatedAt.UTC()
+	}
+	normalized.ControllerEpochName = fence.Name
+	normalized.ControllerEpoch = fence.Epoch
+	normalized.Version = 1
+	normalized.LastOperationID = ""
+	normalized.LastOperationDigest = ""
+	normalized.TerminalReason = ""
+	return normalized, fence, nil
+}
+
+func validatePullRequestIntent(intent store.PullRequestIntent, generation int64) error {
+	for field, value := range map[string]string{
+		"PR base repository ID": intent.BaseRepositoryID,
+		"PR head repository ID": intent.HeadRepositoryID,
+	} {
+		if err := store.ValidateControlIdentifier(field, value); err != nil {
+			return err
+		}
+	}
+	if err := store.ValidateFullBranchRef(intent.BaseRef); err != nil {
+		return err
+	}
+	if err := store.ValidateFullBranchRef(intent.HeadRef); err != nil {
+		return err
+	}
+	if intent.PublicationGeneration != generation {
+		return store.ValidationErrorf("PR intent publication generation %d does not match publication generation %d", intent.PublicationGeneration, generation)
+	}
+	return store.ValidateGitObjectID("PR expected head SHA", intent.ExpectedHeadSHA)
+}
+
+//nolint:gocyclo // Each destination state has intentionally distinct exact-receipt invariants.
+func validatePublicationTransitionReceipts(publication store.Publication, transition store.PublicationTransition) error {
+	var receiptErr error
+	switch transition.NewState {
+	case store.PublicationPrepared:
+		if transition.PreparedReceipt == nil || transition.PublishReceipt != nil || transition.VerificationReceipt != nil {
+			return store.ValidationErrorf("Prepared transition requires only a prepared receipt")
+		}
+		receiptErr = validatePreparedReceipt(*transition.PreparedReceipt)
+	case store.PublicationPublishing, store.PublicationCancelledBeforePublish:
+		if transition.PreparedReceipt != nil || transition.PublishReceipt != nil || transition.VerificationReceipt != nil {
+			return store.ValidationErrorf("%s transition must not replace receipts", transition.NewState)
+		}
+	case store.PublicationVerifying:
+		if transition.PublishReceipt == nil || transition.PreparedReceipt != nil || transition.VerificationReceipt != nil {
+			return store.ValidationErrorf("Verifying transition requires only a publish receipt")
+		}
+		receiptErr = validatePublishReceipt(publication, transition, *transition.PublishReceipt)
+	case store.PublicationOutcomeUnknown:
+		if (transition.ExpectedState == store.PublicationPreparing || transition.ExpectedState == store.PublicationPublishing) &&
+			transition.VerificationReceipt == nil && transition.PreparedReceipt == nil && transition.PublishReceipt == nil {
+			break
+		}
+		fallthrough
+	case store.PublicationVerifiedExact, store.PublicationDeliveredSuperseded:
+		if transition.VerificationReceipt == nil || transition.PreparedReceipt != nil || transition.PublishReceipt != nil {
+			return store.ValidationErrorf("%s transition requires only a verification receipt", transition.NewState)
+		}
+		receiptErr = validateVerificationReceipt(publication, transition, *transition.VerificationReceipt)
+	case store.PublicationDeliveryConflict:
+		if transition.ExpectedState == store.PublicationVerifying {
+			if transition.VerificationReceipt == nil || transition.PreparedReceipt != nil || transition.PublishReceipt != nil {
+				return store.ValidationErrorf("verified DeliveryConflict transition requires only a verification receipt")
+			}
+			receiptErr = validateVerificationReceipt(publication, transition, *transition.VerificationReceipt)
+		} else if transition.PreparedReceipt != nil || transition.PublishReceipt != nil || transition.VerificationReceipt != nil {
+			return store.ValidationErrorf("preparation DeliveryConflict transition must not include receipts")
+		}
+	default:
+		if transition.PreparedReceipt != nil || transition.PublishReceipt != nil || transition.VerificationReceipt != nil {
+			return store.ValidationErrorf("%s transition must not include receipts", transition.NewState)
+		}
+	}
+	if receiptErr != nil {
+		return receiptErr
+	}
+	switch transition.NewState {
+	case store.PublicationDeliveryConflict, store.PublicationCredentialBlocked,
+		store.PublicationPreparationFailed, store.PublicationOutcomeUnknown:
+		if strings.TrimSpace(transition.TerminalReason) == "" {
+			return store.ValidationErrorf("terminal publication state %s requires a reason", transition.NewState)
+		}
+	}
+	return nil
+}
+
+func validatePreparedReceipt(receipt store.PreparedPublicationReceipt) error {
+	if err := store.ValidateControlIdentifier("prepared operation ID", receipt.OperationID); err != nil {
+		return err
+	}
+	if err := store.ValidateCanonicalDigest("prepared request digest", receipt.RequestDigest); err != nil {
+		return err
+	}
+	if err := store.ValidateGitObjectID("prepared tree SHA", receipt.TreeSHA); err != nil {
+		return err
+	}
+	if err := store.ValidateGitObjectID("prepared commit SHA", receipt.CommitSHA); err != nil {
+		return err
+	}
+	if err := store.ValidateCanonicalDigest("prepared manifest digest", receipt.ManifestDigest); err != nil {
+		return err
+	}
+	if err := store.ValidateWorkspaceRelativeRoot(receipt.RelativeRoot); err != nil {
+		return err
+	}
+	if err := store.ValidateControlIdentifier("prepared bundle artifact ID", receipt.BundleArtifactID); err != nil {
+		return err
+	}
+	if err := store.ValidateCanonicalDigest("prepared bundle digest", receipt.BundleDigest); err != nil {
+		return err
+	}
+	if receipt.BundleSizeBytes < 1 || receipt.BundleMediaType != store.PreparedBundleMediaType ||
+		!strings.HasPrefix(receipt.BundleRef, "refs/orka/publications/") || len(strings.TrimPrefix(receipt.BundleRef, "refs/orka/publications/")) != 64 {
+		return store.ValidationErrorf("prepared bundle artifact metadata is invalid")
+	}
+	if receipt.PreparedAt.IsZero() {
+		return store.ValidationErrorf("prepared receipt timestamp is required")
+	}
+	return nil
+}
+
+func validatePublishReceipt(publication store.Publication, transition store.PublicationTransition, receipt store.PublishOperationReceipt) error {
+	if publication.PreparedReceipt == nil {
+		return store.ValidationErrorf("publication must have a durable prepared receipt before publishing")
+	}
+	if receipt.OperationID != transition.OperationID || receipt.RequestDigest != transition.OperationDigest {
+		return store.ValidationErrorf("publish receipt operation identity and digest must match transition")
+	}
+	if receipt.TargetRepositoryID != publication.TargetRepositoryID || receipt.TargetRef != publication.TargetRef || !receipt.RemoteBefore.Equal(publication.Baseline) || receipt.ExpectedCommitSHA != publication.PreparedReceipt.CommitSHA {
+		return store.ValidationErrorf("publish receipt does not exactly match persisted publication target, baseline, or commit")
+	}
+	if err := receipt.RemoteBefore.Validate("publish remote-before"); err != nil {
+		return err
+	}
+	if err := store.ValidateGitObjectID("publish expected commit SHA", receipt.ExpectedCommitSHA); err != nil {
+		return err
+	}
+	if receipt.PublishedAt.IsZero() {
+		return store.ValidationErrorf("publish receipt timestamp is required")
+	}
+	return nil
+}
+
+func validateVerificationReceipt(publication store.Publication, transition store.PublicationTransition, receipt store.PublicationVerificationReceipt) error {
+	if publication.PreparedReceipt == nil || publication.PublishReceipt == nil {
+		return store.ValidationErrorf("publication must have prepare and publish receipts before verification")
+	}
+	if receipt.OperationID != transition.OperationID || receipt.RequestDigest != transition.OperationDigest || receipt.Outcome != transition.NewState {
+		return store.ValidationErrorf("verification receipt operation identity, digest, and outcome must match transition")
+	}
+	if receipt.ExpectedCommitSHA != publication.PreparedReceipt.CommitSHA {
+		return store.ValidationErrorf("verification expected commit does not match prepared commit")
+	}
+	if receipt.VerifiedAt.IsZero() {
+		return store.ValidationErrorf("verification receipt timestamp is required")
+	}
+	switch receipt.Outcome {
+	case store.PublicationVerifiedExact:
+		if err := receipt.ObservedRemote.Validate("verified remote"); err != nil {
+			return err
+		}
+		if receipt.ObservedRemote.Absent || receipt.ObservedRemote.SHA != receipt.ExpectedCommitSHA {
+			return store.ValidationErrorf("VerifiedExact requires observed remote to equal expected commit")
+		}
+		if receipt.DescendantProofDigest != "" {
+			return store.ValidationErrorf("VerifiedExact must not include a descendant proof")
+		}
+	case store.PublicationDeliveredSuperseded:
+		if err := receipt.ObservedRemote.Validate("superseding remote"); err != nil {
+			return err
+		}
+		if receipt.ObservedRemote.Absent || receipt.ObservedRemote.SHA == receipt.ExpectedCommitSHA {
+			return store.ValidationErrorf("DeliveredSuperseded requires a different observed descendant SHA")
+		}
+		if err := store.ValidateCanonicalDigest("descendant proof digest", receipt.DescendantProofDigest); err != nil {
+			return err
+		}
+	case store.PublicationDeliveryConflict:
+		if err := receipt.ObservedRemote.Validate("conflicting remote"); err != nil {
+			return err
+		}
+	case store.PublicationOutcomeUnknown:
+		if receipt.ObservedRemote.Absent || receipt.ObservedRemote.SHA != "" || receipt.DescendantProofDigest != "" {
+			return store.ValidationErrorf("PublicationOutcomeUnknown must not invent a remote observation or descendant proof")
+		}
+	default:
+		return store.ValidationErrorf("unsupported verification outcome %q", receipt.Outcome)
+	}
+	return nil
+}
+
+func publicationTransitionReceiptsMatch(publication store.Publication, transition store.PublicationTransition) bool {
+	if transition.PreparedReceipt != nil && !equalPreparedReceipt(publication.PreparedReceipt, transition.PreparedReceipt) {
+		return false
+	}
+	if transition.PublishReceipt != nil && !equalPublishReceipt(publication.PublishReceipt, transition.PublishReceipt) {
+		return false
+	}
+	if transition.VerificationReceipt != nil && !equalVerificationReceipt(publication.VerificationReceipt, transition.VerificationReceipt) {
+		return false
+	}
+	return true
+}
+
+func equalPreparedReceipt(a, b *store.PreparedPublicationReceipt) bool {
+	if a == nil || b == nil {
+		return a == nil && b == nil
+	}
+	return a.OperationID == b.OperationID && a.RequestDigest == b.RequestDigest &&
+		a.TreeSHA == b.TreeSHA && a.CommitSHA == b.CommitSHA && a.ManifestDigest == b.ManifestDigest && a.RelativeRoot == b.RelativeRoot &&
+		a.BundleArtifactID == b.BundleArtifactID && a.BundleDigest == b.BundleDigest && a.BundleSizeBytes == b.BundleSizeBytes &&
+		a.BundleMediaType == b.BundleMediaType && a.BundleRef == b.BundleRef && a.PreparedAt.Equal(b.PreparedAt)
+}
+
+func equalPublishReceipt(a, b *store.PublishOperationReceipt) bool {
+	if a == nil || b == nil {
+		return a == nil && b == nil
+	}
+	return a.OperationID == b.OperationID && a.RequestDigest == b.RequestDigest &&
+		a.TargetRepositoryID == b.TargetRepositoryID && a.TargetRef == b.TargetRef &&
+		a.RemoteBefore.Equal(b.RemoteBefore) && a.ExpectedCommitSHA == b.ExpectedCommitSHA &&
+		a.AcknowledgementUnknown == b.AcknowledgementUnknown && a.PublishedAt.Equal(b.PublishedAt)
+}
+
+func equalVerificationReceipt(a, b *store.PublicationVerificationReceipt) bool {
+	if a == nil || b == nil {
+		return a == nil && b == nil
+	}
+	return a.OperationID == b.OperationID && a.RequestDigest == b.RequestDigest && a.Outcome == b.Outcome &&
+		a.ExpectedCommitSHA == b.ExpectedCommitSHA && a.ObservedRemote.Equal(b.ObservedRemote) &&
+		a.DescendantProofDigest == b.DescendantProofDigest && a.VerifiedAt.Equal(b.VerifiedAt)
+}
+
+func samePublicationCreation(a, b store.Publication) bool {
+	prIntentMatches := b.PRIntent == nil || reflect.DeepEqual(a.PRIntent, b.PRIntent)
+	return a.ID == b.ID && a.Namespace == b.Namespace && a.Generation == b.Generation &&
+		a.TaskUID == b.TaskUID && a.Attempt == b.Attempt && a.PromptID == b.PromptID &&
+		a.SessionUID == b.SessionUID && a.BranchClaimID == b.BranchClaimID &&
+		a.BranchClaimGeneration == b.BranchClaimGeneration && a.SourceRepositoryID == b.SourceRepositoryID &&
+		a.SourceRef == b.SourceRef && a.SourceBaselineSHA == b.SourceBaselineSHA && a.TargetRepositoryID == b.TargetRepositoryID && a.TargetRef == b.TargetRef &&
+		a.Baseline.Equal(b.Baseline) && a.ArtifactID == b.ArtifactID && a.ArtifactDigest == b.ArtifactDigest &&
+		a.ArtifactSizeBytes == b.ArtifactSizeBytes && a.ArtifactMediaType == b.ArtifactMediaType &&
+		a.PublicationCredentialRef == b.PublicationCredentialRef && a.CommitIdentity == b.CommitIdentity &&
+		a.CommitMessage == b.CommitMessage && a.CommitTimestamp.Equal(b.CommitTimestamp) &&
+		prIntentMatches && a.RequestDigest == b.RequestDigest
+}
+
+func publicationReceipt(publication store.Publication) store.PublicationReceipt {
+	return store.PublicationReceipt{
+		PublicationID: publication.ID,
+		Generation:    publication.Generation,
+		State:         publication.State,
+		Prepared:      publication.PreparedReceipt,
+		Publish:       publication.PublishReceipt,
+		Verification:  publication.VerificationReceipt,
+		PullRequest:   publication.PullRequestReceipt,
+	}
+}
+
+func getPublication(ctx context.Context, q controlQueryRower, id string) (store.Publication, error) {
+	var publication store.Publication
+	var prIntentJSON, preparedJSON, publishJSON, verificationJSON, pullRequestJSON []byte
+	err := q.QueryRowContext(ctx,
+		`SELECT id, namespace, generation, task_uid, attempt, prompt_id, session_uid, branch_claim_id,
+		        branch_claim_generation, source_repository_id, source_ref, source_baseline_sha, target_repository_id, target_ref,
+		        baseline_absent, baseline_sha, artifact_id, artifact_digest, artifact_size_bytes, artifact_media_type,
+		        publication_credential_ref, commit_identity,
+		        commit_message, commit_timestamp, pr_intent, request_digest, state, prepared_receipt,
+		        publish_receipt, verification_receipt, pr_receipt, terminal_reason, controller_epoch_name,
+		        controller_epoch, last_operation_id, last_operation_digest, version, created_at, updated_at
+		 FROM publications WHERE id = ?`, id,
+	).Scan(
+		&publication.ID, &publication.Namespace, &publication.Generation, &publication.TaskUID,
+		&publication.Attempt, &publication.PromptID, &publication.SessionUID, &publication.BranchClaimID,
+		&publication.BranchClaimGeneration, &publication.SourceRepositoryID, &publication.SourceRef, &publication.SourceBaselineSHA,
+		&publication.TargetRepositoryID, &publication.TargetRef, &publication.Baseline.Absent,
+		&publication.Baseline.SHA, &publication.ArtifactID, &publication.ArtifactDigest,
+		&publication.ArtifactSizeBytes, &publication.ArtifactMediaType, &publication.PublicationCredentialRef,
+		&publication.CommitIdentity, &publication.CommitMessage, &publication.CommitTimestamp,
+		&prIntentJSON, &publication.RequestDigest, &publication.State, &preparedJSON, &publishJSON,
+		&verificationJSON, &pullRequestJSON, &publication.TerminalReason, &publication.ControllerEpochName,
+		&publication.ControllerEpoch, &publication.LastOperationID, &publication.LastOperationDigest,
+		&publication.Version, &publication.CreatedAt, &publication.UpdatedAt,
+	)
+	if errors.Is(err, sql.ErrNoRows) {
+		return store.Publication{}, store.ErrNotFound
+	}
+	if err != nil {
+		return store.Publication{}, fmt.Errorf("get publication: %w", err)
+	}
+	if controlJSONPresent(prIntentJSON) {
+		publication.PRIntent = &store.PullRequestIntent{}
+		if err := unmarshalOptionalControlJSON(prIntentJSON, publication.PRIntent); err != nil {
+			return store.Publication{}, fmt.Errorf("decode publication PR intent: %w", err)
+		}
+	}
+	if controlJSONPresent(preparedJSON) {
+		publication.PreparedReceipt = &store.PreparedPublicationReceipt{}
+		if err := unmarshalOptionalControlJSON(preparedJSON, publication.PreparedReceipt); err != nil {
+			return store.Publication{}, fmt.Errorf("decode prepared receipt: %w", err)
+		}
+	}
+	if controlJSONPresent(publishJSON) {
+		publication.PublishReceipt = &store.PublishOperationReceipt{}
+		if err := unmarshalOptionalControlJSON(publishJSON, publication.PublishReceipt); err != nil {
+			return store.Publication{}, fmt.Errorf("decode publish receipt: %w", err)
+		}
+	}
+	if controlJSONPresent(verificationJSON) {
+		publication.VerificationReceipt = &store.PublicationVerificationReceipt{}
+		if err := unmarshalOptionalControlJSON(verificationJSON, publication.VerificationReceipt); err != nil {
+			return store.Publication{}, fmt.Errorf("decode verification receipt: %w", err)
+		}
+	}
+	if controlJSONPresent(pullRequestJSON) {
+		publication.PullRequestReceipt = &store.PullRequestOperationReceipt{}
+		if err := unmarshalOptionalControlJSON(pullRequestJSON, publication.PullRequestReceipt); err != nil {
+			return store.Publication{}, fmt.Errorf("decode pull request receipt: %w", err)
+		}
+	}
+	return publication, nil
+}
diff --git a/internal/store/sqlite/runtime_session_store.go b/internal/store/sqlite/runtime_session_store.go
index eb57b8543..8ec041ee0 100644
--- a/internal/store/sqlite/runtime_session_store.go
+++ b/internal/store/sqlite/runtime_session_store.go
@@ -11,6 +11,8 @@ import (
 	"database/sql"
 	"errors"
 	"fmt"
+	"reflect"
+	"sort"
 	"strings"
 	"time"
 
@@ -212,6 +214,105 @@ func (s *Store) DeleteRuntimeSession(ctx context.Context, namespace string, id h
 	return store.ValidationErrorf("runtime session %s/%s must be %s before physical deletion (current state: %s)", namespace, id, harness.RuntimeSessionStateDeleted, session.State)
 }
 
+// ReclaimRuntimeSessionsForTask atomically reclaims the exact legacy runtime
+// rows authorized by a sealed inventory/adjudication consumer. The full
+// active-task set is compared inside the transaction so a late or changed row
+// fails closed instead of being swept under a name-only match.
+func (s *Store) ReclaimRuntimeSessionsForTask(
+	ctx context.Context,
+	namespace string,
+	activeTask string,
+	expected []harness.RuntimeSession,
+) error {
+	namespace = strings.TrimSpace(namespace)
+	activeTask = strings.TrimSpace(activeTask)
+	if namespace == "" || activeTask == "" {
+		return store.ValidationErrorf("runtime session namespace and active task are required")
+	}
+	expected = append([]harness.RuntimeSession(nil), expected...)
+	sort.Slice(expected, func(i, j int) bool { return expected[i].ID < expected[j].ID })
+	for i := range expected {
+		if expected[i].Owner.Namespace != namespace || expected[i].Owner.ActiveTask != activeTask {
+			return store.ValidationErrorf("expected runtime session %q does not match the reclamation owner", expected[i].ID)
+		}
+	}
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+	rows, err := tx.QueryContext(ctx, runtimeSessionSelectSQL()+
+		` WHERE namespace = ? AND active_task = ? ORDER BY id`, namespace, activeTask)
+	if err != nil {
+		return err
+	}
+	current := make([]harness.RuntimeSession, 0, len(expected))
+	for rows.Next() {
+		session, scanErr := scanRuntimeSession(rows)
+		if scanErr != nil {
+			_ = rows.Close()
+			return scanErr
+		}
+		current = append(current, session)
+	}
+	if err := rows.Close(); err != nil {
+		return err
+	}
+	if err := rows.Err(); err != nil {
+		return err
+	}
+	if !reflect.DeepEqual(current, expected) {
+		return fmt.Errorf("%w: legacy runtime session set changed before reclamation", store.ErrConflict)
+	}
+
+	now := time.Now().UTC()
+	for i := range current {
+		session := current[i]
+		if session.State != harness.RuntimeSessionStateDeleted {
+			if !harness.RuntimeSessionTransitionAllowed(session.State, harness.RuntimeSessionStateDeleting) {
+				return fmt.Errorf("%w: runtime session %s state %s cannot enter deletion",
+					store.ErrConflict, session.ID, session.State)
+			}
+			result, updateErr := tx.ExecContext(ctx,
+				`UPDATE runtime_sessions SET state = ?, active_task = '', updated_at = ?
+				 WHERE namespace = ? AND id = ? AND state = ? AND active_task = ?`,
+				string(harness.RuntimeSessionStateDeleting), now, namespace, string(session.ID),
+				string(session.State), activeTask,
+			)
+			if updateErr != nil {
+				return updateErr
+			}
+			if err := ensureRowsAffected(result); err != nil {
+				return err
+			}
+			result, updateErr = tx.ExecContext(ctx,
+				`UPDATE runtime_sessions SET state = ?, updated_at = ?
+				 WHERE namespace = ? AND id = ? AND state = ?`,
+				string(harness.RuntimeSessionStateDeleted), now, namespace, string(session.ID),
+				string(harness.RuntimeSessionStateDeleting),
+			)
+			if updateErr != nil {
+				return updateErr
+			}
+			if err := ensureRowsAffected(result); err != nil {
+				return err
+			}
+		}
+		result, deleteErr := tx.ExecContext(ctx,
+			`DELETE FROM runtime_sessions WHERE namespace = ? AND id = ? AND state = ?`,
+			namespace, string(session.ID), string(harness.RuntimeSessionStateDeleted),
+		)
+		if deleteErr != nil {
+			return deleteErr
+		}
+		if err := ensureRowsAffected(result); err != nil {
+			return err
+		}
+	}
+	return tx.Commit()
+}
+
 type runtimeSessionQueryable interface {
 	QueryRowContext(ctx context.Context, query string, args ...any) *sql.Row
 }
diff --git a/internal/store/sqlite/security_store.go b/internal/store/sqlite/security_store.go
index 3c815e36e..52ec6c397 100644
--- a/internal/store/sqlite/security_store.go
+++ b/internal/store/sqlite/security_store.go
@@ -8,6 +8,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"reflect"
 	"strconv"
 	"strings"
 	"time"
@@ -15,6 +16,13 @@ import (
 	"github.com/orka-agents/orka/internal/store"
 )
 
+const (
+	securityScanRunPhasePending         = "pending"
+	securityScanRunPhaseRunning         = "running"
+	securityReviewStatusPending         = "pending"
+	securityPatchProposalStatusPROpened = "pr_opened"
+)
+
 func parseOffsetCursor(cursor string) (int, error) {
 	if cursor == "" {
 		return 0, nil
@@ -53,29 +61,74 @@ func unmarshalSecurityJSON(payload string, value any) error {
 	return json.Unmarshal([]byte(payload), value)
 }
 
+// Timestamps persist as TEXT and list queries order them lexicographically, so
+// every persisted time is normalized to UTC here regardless of the location
+// callers supplied.
+func utcTime(value time.Time) time.Time {
+	return value.UTC()
+}
+
+func utcTimePtr(value *time.Time) *time.Time {
+	if value == nil {
+		return nil
+	}
+	utc := value.UTC()
+	return &utc
+}
+
 // CreateScanRun inserts a new scan run.
 func (s *Store) CreateScanRun(ctx context.Context, run *store.ScanRun) error {
-	now := time.Now()
+	run.StartedAt = utcTime(run.StartedAt)
+	run.CompletedAt = utcTimePtr(run.CompletedAt)
+	now := time.Now().UTC()
 	if run.StartedAt.IsZero() {
 		run.StartedAt = now
 	}
-	_, err := s.db.ExecContext(ctx,
-		`INSERT INTO security_scan_runs
+	query := `INSERT INTO security_scan_runs
 		 (id, namespace, repository_scan, task_name, mode, phase, base_commit, head_commit, commit_count,
 		  slice_count, reviewed_slice_count, skipped_slice_count, accepted_findings, dropped_findings,
 		  scanner_policy_version, policy_digest, idempotency_key, summary, error_message, started_at, completed_at)
-		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+	args := []any{
 		run.ID, run.Namespace, run.RepositoryScan, run.TaskName, run.Mode, run.Phase,
 		run.BaseCommit, run.HeadCommit, run.CommitCount, run.SliceCount, run.ReviewedSliceCount,
 		run.SkippedSliceCount, run.AcceptedFindings, run.DroppedFindings,
 		run.ScannerPolicyVersion, run.PolicyDigest, run.IdempotencyKey, run.Summary, run.ErrorMessage,
 		run.StartedAt, run.CompletedAt,
-	)
-	return err
+	}
+	if run.Phase == securityScanRunPhasePending || run.Phase == securityScanRunPhaseRunning {
+		query = `INSERT INTO security_scan_runs
+		 (id, namespace, repository_scan, task_name, mode, phase, base_commit, head_commit, commit_count,
+		  slice_count, reviewed_slice_count, skipped_slice_count, accepted_findings, dropped_findings,
+		  scanner_policy_version, policy_digest, idempotency_key, summary, error_message, started_at, completed_at)
+		 SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
+		 WHERE NOT EXISTS (
+		   SELECT 1 FROM security_scan_runs
+		   WHERE namespace = ? AND repository_scan = ? AND phase IN ('pending', 'running')
+		 )`
+		args = append(args, run.Namespace, run.RepositoryScan)
+	}
+	result, err := s.db.ExecContext(ctx, query, args...)
+	if err != nil && isSQLiteConstraintError(err) {
+		return fmt.Errorf("%w: active security scan run already exists", store.ErrConflict)
+	}
+	if err != nil {
+		return err
+	}
+	created, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if created != 1 {
+		return fmt.Errorf("%w: active security scan run already exists", store.ErrConflict)
+	}
+	return nil
 }
 
 // UpdateScanRun updates a scan run.
 func (s *Store) UpdateScanRun(ctx context.Context, run *store.ScanRun) error {
+	run.StartedAt = utcTime(run.StartedAt)
+	run.CompletedAt = utcTimePtr(run.CompletedAt)
 	_, err := s.db.ExecContext(ctx,
 		`UPDATE security_scan_runs
 		 SET task_name = ?, mode = ?, phase = ?, base_commit = ?, head_commit = ?, commit_count = ?,
@@ -176,7 +229,7 @@ func (s *Store) UpsertReviewSlice(ctx context.Context, slice *store.ReviewSlice)
 		slice.Confidence = "medium"
 	}
 	if slice.Status == "" {
-		slice.Status = "pending"
+		slice.Status = securityReviewStatusPending
 	}
 
 	entrypointsJSON, err := marshalSecurityJSON(slice.Entrypoints)
@@ -212,7 +265,9 @@ func (s *Store) UpsertReviewSlice(ctx context.Context, slice *store.ReviewSlice)
 		return err
 	}
 
-	now := time.Now()
+	slice.CreatedAt = utcTime(slice.CreatedAt)
+	slice.LastReviewedAt = utcTimePtr(slice.LastReviewedAt)
+	now := time.Now().UTC()
 	if slice.CreatedAt.IsZero() {
 		slice.CreatedAt = now
 	}
@@ -222,8 +277,9 @@ func (s *Store) UpsertReviewSlice(ctx context.Context, slice *store.ReviewSlice)
 		`INSERT INTO security_review_slices
 		 (id, namespace, repository_scan, source, title, summary, kind, confidence, status,
 		  entrypoints_json, owned_files_json, context_files_json, tests_json, tags_json,
-		  trust_boundaries_json, changed_files_json, changed_line_ranges_json, last_scan_run_id, last_reviewed_at, created_at, updated_at)
-		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+		  trust_boundaries_json, changed_files_json, changed_line_ranges_json, review_context_json,
+		  review_context_hash, last_scan_run_id, last_reviewed_at, created_at, updated_at)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 		 ON CONFLICT(namespace, repository_scan, id) DO UPDATE SET
 		   source = excluded.source,
 		   title = excluded.title,
@@ -239,13 +295,16 @@ func (s *Store) UpsertReviewSlice(ctx context.Context, slice *store.ReviewSlice)
 		   trust_boundaries_json = excluded.trust_boundaries_json,
 		   changed_files_json = excluded.changed_files_json,
 		   changed_line_ranges_json = excluded.changed_line_ranges_json,
+		   review_context_json = excluded.review_context_json,
+		   review_context_hash = excluded.review_context_hash,
 		   last_scan_run_id = excluded.last_scan_run_id,
 		   last_reviewed_at = COALESCE(excluded.last_reviewed_at, security_review_slices.last_reviewed_at),
 		   updated_at = excluded.updated_at`,
 		slice.ID, slice.Namespace, slice.RepositoryScan, slice.Source, slice.Title, slice.Summary,
 		slice.Kind, slice.Confidence, slice.Status, entrypointsJSON, ownedFilesJSON, contextFilesJSON,
 		testsJSON, tagsJSON, trustBoundariesJSON, changedFilesJSON, changedLineRangesJSON,
-		slice.LastScanRunID, slice.LastReviewedAt, slice.CreatedAt, slice.UpdatedAt,
+		slice.ReviewContextJSON, slice.ReviewContextHash, slice.LastScanRunID, slice.LastReviewedAt,
+		slice.CreatedAt, slice.UpdatedAt,
 	)
 	return err
 }
@@ -268,7 +327,8 @@ func scanReviewSlice(scanner interface {
 		&slice.ID, &slice.Namespace, &slice.RepositoryScan, &slice.Source, &slice.Title,
 		&slice.Summary, &slice.Kind, &slice.Confidence, &slice.Status, &entrypointsJSON,
 		&ownedFilesJSON, &contextFilesJSON, &testsJSON, &tagsJSON, &trustBoundariesJSON,
-		&changedFilesJSON, &changedLineRangesJSON, &slice.LastScanRunID, &slice.LastReviewedAt, &slice.CreatedAt, &slice.UpdatedAt,
+		&changedFilesJSON, &changedLineRangesJSON, &slice.ReviewContextJSON, &slice.ReviewContextHash,
+		&slice.LastScanRunID, &slice.LastReviewedAt, &slice.CreatedAt, &slice.UpdatedAt,
 	)
 	if err != nil {
 		return nil, err
@@ -314,7 +374,8 @@ func (s *Store) ListReviewSlices(ctx context.Context, filter store.ReviewSliceFi
 	query := strings.Builder{}
 	query.WriteString(`SELECT id, namespace, repository_scan, source, title, summary, kind, confidence, status,
 		entrypoints_json, owned_files_json, context_files_json, tests_json, tags_json, trust_boundaries_json,
-		changed_files_json, changed_line_ranges_json, last_scan_run_id, last_reviewed_at, created_at, updated_at
+		changed_files_json, changed_line_ranges_json, review_context_json, review_context_hash,
+		last_scan_run_id, last_reviewed_at, created_at, updated_at
 		FROM security_review_slices WHERE namespace = ? AND repository_scan = ?`)
 	args := []any{filter.Namespace, filter.RepositoryScan}
 	if filter.Status != "" {
@@ -353,7 +414,8 @@ func (s *Store) GetReviewSlice(ctx context.Context, namespace, repositoryScan, i
 	row := s.db.QueryRowContext(ctx,
 		`SELECT id, namespace, repository_scan, source, title, summary, kind, confidence, status,
 		        entrypoints_json, owned_files_json, context_files_json, tests_json, tags_json, trust_boundaries_json,
-		        changed_files_json, changed_line_ranges_json, last_scan_run_id, last_reviewed_at, created_at, updated_at
+		        changed_files_json, changed_line_ranges_json, review_context_json, review_context_hash,
+		        last_scan_run_id, last_reviewed_at, created_at, updated_at
 		 FROM security_review_slices
 		 WHERE namespace = ? AND repository_scan = ? AND id = ?`,
 		namespace, repositoryScan, id,
@@ -370,7 +432,7 @@ func (s *Store) GetReviewSlice(ctx context.Context, namespace, repositoryScan, i
 
 // UpdateReviewSliceStatus updates slice status and review timestamp.
 func (s *Store) UpdateReviewSliceStatus(ctx context.Context, namespace, repositoryScan, id, lastScanRunID, status string) error {
-	now := time.Now()
+	now := time.Now().UTC()
 	res, err := s.db.ExecContext(ctx,
 		`UPDATE security_review_slices
 		 SET status = ?, last_reviewed_at = CASE WHEN ? IN ('reviewed', 'completed') THEN ? ELSE last_reviewed_at END,
@@ -439,7 +501,8 @@ func (s *Store) SaveThreatModel(ctx context.Context, model *store.ThreatModel) e
 		model.Version = latestVersion + 1
 	}
 
-	now := time.Now()
+	model.CreatedAt = utcTime(model.CreatedAt)
+	now := time.Now().UTC()
 	if model.CreatedAt.IsZero() {
 		model.CreatedAt = now
 	}
@@ -498,7 +561,8 @@ func (s *Store) UpsertFinding(ctx context.Context, finding *store.Finding) error
 		return err
 	}
 
-	now := time.Now()
+	finding.CreatedAt = utcTime(finding.CreatedAt)
+	now := time.Now().UTC()
 	if finding.CreatedAt.IsZero() {
 		finding.CreatedAt = now
 	}
@@ -799,7 +863,11 @@ func (s *Store) UpdateFindingState(ctx context.Context, namespace, id, state str
 
 // CreatePatchProposal inserts a new patch proposal.
 func (s *Store) CreatePatchProposal(ctx context.Context, proposal *store.PatchProposal) error {
-	now := time.Now()
+	if proposal.PublicationEvidence != nil {
+		return store.ValidationErrorf("patch proposal publication evidence must be bound with BindPatchProposalPublicationEvidence")
+	}
+	proposal.CreatedAt = utcTime(proposal.CreatedAt)
+	now := time.Now().UTC()
 	if proposal.CreatedAt.IsZero() {
 		proposal.CreatedAt = now
 	}
@@ -815,24 +883,251 @@ func (s *Store) CreatePatchProposal(ctx context.Context, proposal *store.PatchPr
 	return err
 }
 
+// BindPatchProposalPublicationEvidence atomically finalizes a proposal with one
+// immutable governed-publication tuple. Identical replay is a no-op; any
+// differing replay conflicts and leaves the first tuple unchanged.
+func (s *Store) BindPatchProposalPublicationEvidence(ctx context.Context, proposal *store.PatchProposal) error {
+	evidenceJSON, err := validatePatchProposalPublicationBinding(proposal)
+	if err != nil {
+		return err
+	}
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	existing, existingEvidenceJSON, err := getPatchProposalPublicationBinding(ctx, tx, proposal.Namespace, proposal.ID)
+	if err != nil {
+		return err
+	}
+	if strings.TrimSpace(existingEvidenceJSON) != "" {
+		if samePatchProposalPublicationBinding(existing, proposal, existingEvidenceJSON, evidenceJSON) {
+			proposal.CreatedAt = existing.CreatedAt
+			proposal.UpdatedAt = existing.UpdatedAt
+			return nil
+		}
+		return fmt.Errorf("%w: patch proposal %s/%s publication evidence already differs", store.ErrConflict, proposal.Namespace, proposal.ID)
+	}
+
+	now := time.Now().UTC()
+	result, err := tx.ExecContext(ctx,
+		`UPDATE security_patch_proposals
+		 SET branch = ?, diff_artifact = ?, summary_artifact = ?, status = ?, pr_number = ?, pr_url = ?,
+		     publication_evidence_json = ?, updated_at = ?
+		 WHERE namespace = ? AND id = ? AND publication_evidence_json = ''`,
+		proposal.Branch, proposal.DiffArtifact, proposal.SummaryArtifact, proposal.Status, proposal.PRNumber, proposal.PRURL,
+		evidenceJSON, now, proposal.Namespace, proposal.ID,
+	)
+	if err != nil {
+		return err
+	}
+	updated, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if updated != 1 {
+		return fmt.Errorf("%w: patch proposal %s/%s publication evidence changed concurrently", store.ErrConflict, proposal.Namespace, proposal.ID)
+	}
+	if err := tx.Commit(); err != nil {
+		fresh, freshEvidenceJSON, getErr := getPatchProposalPublicationBinding(ctx, s.db, proposal.Namespace, proposal.ID)
+		if getErr == nil && samePatchProposalPublicationBinding(fresh, proposal, freshEvidenceJSON, evidenceJSON) {
+			proposal.CreatedAt = fresh.CreatedAt
+			proposal.UpdatedAt = fresh.UpdatedAt
+			return nil
+		}
+		return err
+	}
+	proposal.CreatedAt = existing.CreatedAt
+	proposal.UpdatedAt = now
+	return nil
+}
+
+type patchProposalPublicationBindingScanner interface {
+	Scan(dest ...any) error
+}
+
+func getPatchProposalPublicationBinding(
+	ctx context.Context,
+	queryer interface {
+		QueryRowContext(context.Context, string, ...any) *sql.Row
+	},
+	namespace string,
+	id string,
+) (store.PatchProposal, string, error) {
+	row := queryer.QueryRowContext(ctx,
+		`SELECT namespace, id, task_name, branch, diff_artifact, summary_artifact, status, pr_number, pr_url,
+		        publication_evidence_json, created_at, updated_at
+		 FROM security_patch_proposals WHERE namespace = ? AND id = ?`,
+		namespace, id,
+	)
+	return scanPatchProposalPublicationBinding(row)
+}
+
+func scanPatchProposalPublicationBinding(scanner patchProposalPublicationBindingScanner) (store.PatchProposal, string, error) {
+	var proposal store.PatchProposal
+	var evidenceJSON string
+	if err := scanner.Scan(
+		&proposal.Namespace, &proposal.ID, &proposal.TaskName, &proposal.Branch, &proposal.DiffArtifact, &proposal.SummaryArtifact,
+		&proposal.Status, &proposal.PRNumber, &proposal.PRURL, &evidenceJSON, &proposal.CreatedAt, &proposal.UpdatedAt,
+	); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return store.PatchProposal{}, "", store.ErrNotFound
+		}
+		return store.PatchProposal{}, "", err
+	}
+	if strings.TrimSpace(evidenceJSON) != "" {
+		var evidence store.PatchPublicationEvidence
+		if err := json.Unmarshal([]byte(evidenceJSON), &evidence); err != nil {
+			return store.PatchProposal{}, "", fmt.Errorf("decode patch publication evidence: %w", err)
+		}
+		proposal.PublicationEvidence = &evidence
+	}
+	return proposal, evidenceJSON, nil
+}
+
+//nolint:gocyclo // The immutable evidence validator intentionally keeps every cross-field policy check in one fail-closed path.
+func validatePatchProposalPublicationBinding(proposal *store.PatchProposal) (string, error) {
+	if proposal == nil || strings.TrimSpace(proposal.Namespace) == "" || strings.TrimSpace(proposal.ID) == "" {
+		return "", store.ValidationErrorf("patch proposal namespace and ID are required")
+	}
+	if proposal.PublicationEvidence == nil {
+		return "", store.ValidationErrorf("patch proposal publication evidence is required")
+	}
+	if proposal.Status != securityPatchProposalStatusPROpened || proposal.PRNumber == nil || *proposal.PRNumber < 1 || strings.TrimSpace(proposal.PRURL) == "" {
+		return "", store.ValidationErrorf("patch proposal publication projections are incomplete")
+	}
+	evidence := proposal.PublicationEvidence
+	if err := store.ValidateControlIdentifier("patch publication ID", evidence.PublicationID); err != nil {
+		return "", err
+	}
+	if err := store.ValidateCanonicalDigest("patch publication artifact digest", evidence.ArtifactDigest); err != nil {
+		return "", err
+	}
+	for field, value := range map[string]string{
+		"source repository ID":  evidence.SourceRepositoryID,
+		"target repository ID":  evidence.TargetRepositoryID,
+		"PR base repository ID": evidence.PRIntent.BaseRepositoryID,
+		"PR head repository ID": evidence.PRIntent.HeadRepositoryID,
+		"PR forge ID":           evidence.PRReceipt.ForgeID,
+		"PR URL":                evidence.PRReceipt.URL,
+	} {
+		if strings.TrimSpace(value) == "" {
+			return "", store.ValidationErrorf("patch publication %s is required", field)
+		}
+	}
+	for field, value := range map[string]string{
+		"source ref":           evidence.SourceRef,
+		"source baseline SHA":  evidence.SourceBaselineSHA,
+		"expected commit SHA":  evidence.ExpectedCommitSHA,
+		"verified remote SHA":  evidence.VerifiedRemoteSHA,
+		"PR expected head SHA": evidence.PRIntent.ExpectedHeadSHA,
+		"PR receipt head SHA":  evidence.PRReceipt.HeadSHA,
+	} {
+		if err := store.ValidateGitObjectID("patch publication "+field, value); err != nil {
+			return "", err
+		}
+	}
+	for _, ref := range []string{evidence.TargetRef, evidence.PRIntent.BaseRef, evidence.PRIntent.HeadRef} {
+		if err := store.ValidateFullBranchRef(ref); err != nil {
+			return "", err
+		}
+	}
+	if evidence.PRIntent.PublicationGeneration < 1 {
+		return "", store.ValidationErrorf("patch publication generation must be at least 1")
+	}
+	if err := store.ValidateCanonicalDigest("patch PR intent key", evidence.PRReceipt.IntentKey); err != nil {
+		return "", err
+	}
+	if evidence.PRReceipt.State != "Open" {
+		return "", store.ValidationErrorf("patch pull request must be open")
+	}
+	if evidence.PRReceipt.Number < 1 || evidence.PRReceipt.Number != *proposal.PRNumber {
+		return "", store.ValidationErrorf("patch pull request number does not match its projection")
+	}
+	if evidence.TargetRepositoryID != evidence.PRIntent.HeadRepositoryID ||
+		evidence.SourceRef != evidence.SourceBaselineSHA ||
+		evidence.TargetRef != evidence.PRIntent.HeadRef ||
+		evidence.ExpectedCommitSHA != evidence.VerifiedRemoteSHA ||
+		evidence.ExpectedCommitSHA != evidence.PRIntent.ExpectedHeadSHA ||
+		evidence.ExpectedCommitSHA != evidence.PRReceipt.HeadSHA ||
+		strings.TrimPrefix(evidence.TargetRef, "refs/heads/") != strings.TrimSpace(proposal.Branch) ||
+		evidence.PRReceipt.URL != strings.TrimSpace(proposal.PRURL) {
+		return "", store.ValidationErrorf("patch publication evidence does not match its exact projections")
+	}
+	data, err := json.Marshal(evidence)
+	if err != nil {
+		return "", err
+	}
+	return string(data), nil
+}
+
+func samePatchProposalPublicationBinding(existing store.PatchProposal, desired *store.PatchProposal, existingEvidenceJSON, desiredEvidenceJSON string) bool {
+	if desired == nil || existing.Branch != desired.Branch || existing.DiffArtifact != desired.DiffArtifact ||
+		existing.SummaryArtifact != desired.SummaryArtifact || existing.Status != desired.Status ||
+		existing.PRURL != desired.PRURL || !reflect.DeepEqual(existing.PRNumber, desired.PRNumber) {
+		return false
+	}
+	var existingEvidence, desiredEvidence store.PatchPublicationEvidence
+	if err := json.Unmarshal([]byte(existingEvidenceJSON), &existingEvidence); err != nil {
+		return false
+	}
+	if err := json.Unmarshal([]byte(desiredEvidenceJSON), &desiredEvidence); err != nil {
+		return false
+	}
+	return reflect.DeepEqual(existingEvidence, desiredEvidence)
+}
+
 // UpdatePatchProposal updates an existing patch proposal.
 func (s *Store) UpdatePatchProposal(ctx context.Context, proposal *store.PatchProposal) error {
-	proposal.UpdatedAt = time.Now()
-	_, err := s.db.ExecContext(ctx,
+	if proposal == nil || strings.TrimSpace(proposal.Namespace) == "" || strings.TrimSpace(proposal.ID) == "" {
+		return store.ValidationErrorf("patch proposal namespace and ID are required")
+	}
+	if proposal.PublicationEvidence != nil {
+		return store.ValidationErrorf("patch proposal publication evidence must be bound with BindPatchProposalPublicationEvidence")
+	}
+	now := time.Now().UTC()
+	result, err := s.db.ExecContext(ctx,
 		`UPDATE security_patch_proposals
 		 SET task_name = ?, branch = ?, diff_artifact = ?, summary_artifact = ?, status = ?, pr_number = ?, pr_url = ?, updated_at = ?
-		 WHERE namespace = ? AND id = ?`,
+		 WHERE namespace = ? AND id = ? AND publication_evidence_json = ''`,
 		proposal.TaskName, proposal.Branch, proposal.DiffArtifact, proposal.SummaryArtifact, proposal.Status, proposal.PRNumber,
-		proposal.PRURL, proposal.UpdatedAt, proposal.Namespace, proposal.ID,
+		proposal.PRURL, now, proposal.Namespace, proposal.ID,
 	)
-	return err
+	if err != nil {
+		return err
+	}
+	updated, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if updated == 1 {
+		proposal.UpdatedAt = now
+		return nil
+	}
+
+	existing, evidenceJSON, err := getPatchProposalPublicationBinding(ctx, s.db, proposal.Namespace, proposal.ID)
+	if err != nil {
+		return err
+	}
+	if strings.TrimSpace(evidenceJSON) == "" {
+		return fmt.Errorf("%w: patch proposal %s/%s changed concurrently", store.ErrConflict, proposal.Namespace, proposal.ID)
+	}
+	if existing.TaskName == proposal.TaskName && existing.Branch == proposal.Branch &&
+		existing.DiffArtifact == proposal.DiffArtifact && existing.SummaryArtifact == proposal.SummaryArtifact &&
+		existing.Status == proposal.Status && existing.PRURL == proposal.PRURL && reflect.DeepEqual(existing.PRNumber, proposal.PRNumber) {
+		proposal.CreatedAt = existing.CreatedAt
+		proposal.UpdatedAt = existing.UpdatedAt
+		return nil
+	}
+	return fmt.Errorf("%w: patch proposal %s/%s publication projections are immutable", store.ErrConflict, proposal.Namespace, proposal.ID)
 }
 
 // ListPatchProposals lists patch proposals for a finding, newest first.
 func (s *Store) ListPatchProposals(ctx context.Context, namespace, findingID string) ([]store.PatchProposal, error) {
 	rows, err := s.db.QueryContext(ctx,
 		`SELECT id, namespace, repository_scan, finding_id, task_name, branch, diff_artifact, summary_artifact,
-		        status, pr_number, pr_url, created_at, updated_at
+		        status, pr_number, pr_url, publication_evidence_json, created_at, updated_at
 		 FROM security_patch_proposals
 		 WHERE namespace = ? AND finding_id = ?
 		 ORDER BY created_at DESC, id DESC`,
@@ -846,13 +1141,21 @@ func (s *Store) ListPatchProposals(ctx context.Context, namespace, findingID str
 	var proposals []store.PatchProposal
 	for rows.Next() {
 		var proposal store.PatchProposal
+		var evidenceJSON string
 		if err := rows.Scan(
 			&proposal.ID, &proposal.Namespace, &proposal.RepositoryScan, &proposal.FindingID, &proposal.TaskName, &proposal.Branch,
 			&proposal.DiffArtifact, &proposal.SummaryArtifact, &proposal.Status, &proposal.PRNumber, &proposal.PRURL,
-			&proposal.CreatedAt, &proposal.UpdatedAt,
+			&evidenceJSON, &proposal.CreatedAt, &proposal.UpdatedAt,
 		); err != nil {
 			return nil, err
 		}
+		if strings.TrimSpace(evidenceJSON) != "" {
+			var evidence store.PatchPublicationEvidence
+			if err := json.Unmarshal([]byte(evidenceJSON), &evidence); err != nil {
+				return nil, fmt.Errorf("decode patch publication evidence: %w", err)
+			}
+			proposal.PublicationEvidence = &evidence
+		}
 		proposals = append(proposals, proposal)
 	}
 	return proposals, rows.Err()
@@ -869,11 +1172,12 @@ func (s *Store) CreateDroppedFinding(ctx context.Context, dropped *store.Dropped
 			dropped.SliceID,
 			dropped.Reason,
 			dropped.SampleJSON,
-			time.Now().Format(time.RFC3339Nano),
+			time.Now().UTC().Format(time.RFC3339Nano),
 		}, "|"))
 	}
+	dropped.CreatedAt = utcTime(dropped.CreatedAt)
 	if dropped.CreatedAt.IsZero() {
-		dropped.CreatedAt = time.Now()
+		dropped.CreatedAt = time.Now().UTC()
 	}
 	_, err := s.db.ExecContext(ctx,
 		`INSERT OR IGNORE INTO security_dropped_findings
diff --git a/internal/store/sqlite/security_store_test.go b/internal/store/sqlite/security_store_test.go
index 69eed0e75..7557aa156 100644
--- a/internal/store/sqlite/security_store_test.go
+++ b/internal/store/sqlite/security_store_test.go
@@ -9,6 +9,9 @@ package sqlite
 import (
 	"context"
 	"errors"
+	"path/filepath"
+	"reflect"
+	"strings"
 	"testing"
 	"time"
 
@@ -20,6 +23,287 @@ const (
 	testStateOpen  = "open"
 )
 
+func testPatchProposalPublication(suffix string) (*store.PatchProposal, *store.PatchProposal) {
+	proposal := &store.PatchProposal{
+		ID:             "patch-" + suffix,
+		Namespace:      "ns1",
+		RepositoryScan: "repo1",
+		FindingID:      "finding-" + suffix,
+		TaskName:       "task-" + suffix,
+		Branch:         "orka/security/" + suffix,
+		Status:         "pending",
+	}
+	bound := *proposal
+	prNumber := 42
+	headSHA := strings.Repeat("b", 40)
+	bound.DiffArtifact = "security-patch-" + suffix + ".diff"
+	bound.SummaryArtifact = "security-patch-" + suffix + ".json"
+	bound.Status = securityPatchProposalStatusPROpened
+	bound.PRNumber = &prNumber
+	bound.PRURL = "https://github.com/example/source/pull/42"
+	bound.PublicationEvidence = &store.PatchPublicationEvidence{
+		PublicationID:      "pub-" + suffix,
+		ArtifactDigest:     "sha256:" + strings.Repeat("a", 64),
+		SourceRepositoryID: "github.com/example/source",
+		SourceRef:          strings.Repeat("1", 40),
+		SourceBaselineSHA:  strings.Repeat("1", 40),
+		TargetRepositoryID: "github.com/example/target",
+		TargetRef:          "refs/heads/" + bound.Branch,
+		ExpectedCommitSHA:  headSHA,
+		VerifiedRemoteSHA:  headSHA,
+		PRIntent: store.PullRequestIntent{
+			BaseRepositoryID:      "github.com/example/source",
+			BaseRef:               "refs/heads/main",
+			HeadRepositoryID:      "github.com/example/target",
+			HeadRef:               "refs/heads/" + bound.Branch,
+			PublicationGeneration: 1,
+			ExpectedHeadSHA:       headSHA,
+		},
+		PRReceipt: store.PatchPullRequestEvidence{
+			IntentKey: "sha256:" + strings.Repeat("c", 64),
+			ForgeID:   "github:123:42",
+			Number:    prNumber,
+			URL:       bound.PRURL,
+			State:     "Open",
+			HeadSHA:   headSHA,
+		},
+	}
+	return proposal, &bound
+}
+
+func clonePatchProposal(proposal *store.PatchProposal) *store.PatchProposal {
+	if proposal == nil {
+		return nil
+	}
+	clone := *proposal
+	if proposal.PRNumber != nil {
+		value := *proposal.PRNumber
+		clone.PRNumber = &value
+	}
+	if proposal.PublicationEvidence != nil {
+		evidence := *proposal.PublicationEvidence
+		clone.PublicationEvidence = &evidence
+	}
+	return &clone
+}
+
+func onlyPatchProposal(t *testing.T, s *Store, namespace, findingID string) store.PatchProposal {
+	t.Helper()
+	proposals, err := s.ListPatchProposals(context.Background(), namespace, findingID)
+	if err != nil {
+		t.Fatalf("ListPatchProposals() error = %v", err)
+	}
+	if len(proposals) != 1 {
+		t.Fatalf("len(proposals) = %d, want 1", len(proposals))
+	}
+	return proposals[0]
+}
+
+func TestPatchProposalPublicationEvidenceBindIsImmutableAndReplaySafe(t *testing.T) {
+	s := setupTestStore(t)
+	ctx := context.Background()
+	initial, bound := testPatchProposalPublication("immutable")
+	if err := s.CreatePatchProposal(ctx, initial); err != nil {
+		t.Fatalf("CreatePatchProposal() error = %v", err)
+	}
+	if err := s.BindPatchProposalPublicationEvidence(ctx, bound); err != nil {
+		t.Fatalf("BindPatchProposalPublicationEvidence() error = %v", err)
+	}
+
+	stored := onlyPatchProposal(t, s, initial.Namespace, initial.FindingID)
+	if !reflect.DeepEqual(stored.PublicationEvidence, bound.PublicationEvidence) {
+		t.Fatalf("publication evidence = %#v, want %#v", stored.PublicationEvidence, bound.PublicationEvidence)
+	}
+	firstUpdatedAt := stored.UpdatedAt
+
+	replay := clonePatchProposal(bound)
+	replay.CreatedAt = time.Time{}
+	replay.UpdatedAt = time.Time{}
+	if err := s.BindPatchProposalPublicationEvidence(ctx, replay); err != nil {
+		t.Fatalf("identical BindPatchProposalPublicationEvidence() replay error = %v", err)
+	}
+	if !replay.UpdatedAt.Equal(firstUpdatedAt) {
+		t.Fatalf("identical replay updatedAt = %v, want unchanged %v", replay.UpdatedAt, firstUpdatedAt)
+	}
+
+	identicalUpdate := clonePatchProposal(&stored)
+	identicalUpdate.PublicationEvidence = nil
+	if err := s.UpdatePatchProposal(ctx, identicalUpdate); err != nil {
+		t.Fatalf("identical UpdatePatchProposal() error = %v", err)
+	}
+	if !identicalUpdate.UpdatedAt.Equal(firstUpdatedAt) {
+		t.Fatalf("identical generic update updatedAt = %v, want unchanged %v", identicalUpdate.UpdatedAt, firstUpdatedAt)
+	}
+
+	mutations := []struct {
+		name   string
+		mutate func(*store.PatchProposal)
+	}{
+		{name: "task name", mutate: func(p *store.PatchProposal) { p.TaskName = "other-task" }},
+		{name: "branch", mutate: func(p *store.PatchProposal) { p.Branch = "orka/security/other" }},
+		{name: "diff artifact", mutate: func(p *store.PatchProposal) { p.DiffArtifact = "other.diff" }},
+		{name: "summary artifact", mutate: func(p *store.PatchProposal) { p.SummaryArtifact = "other.json" }},
+		{name: "status", mutate: func(p *store.PatchProposal) { p.Status = publishPhaseFailed }},
+		{name: "PR number", mutate: func(p *store.PatchProposal) { value := 43; p.PRNumber = &value }},
+		{name: "PR URL", mutate: func(p *store.PatchProposal) { p.PRURL = "https://github.com/example/source/pull/43" }},
+	}
+	for _, tt := range mutations {
+		t.Run(tt.name, func(t *testing.T) {
+			candidate := clonePatchProposal(&stored)
+			candidate.PublicationEvidence = nil
+			tt.mutate(candidate)
+			if err := s.UpdatePatchProposal(ctx, candidate); !errors.Is(err, store.ErrConflict) {
+				t.Fatalf("UpdatePatchProposal() error = %v, want conflict", err)
+			}
+			after := onlyPatchProposal(t, s, initial.Namespace, initial.FindingID)
+			if !after.UpdatedAt.Equal(firstUpdatedAt) || !reflect.DeepEqual(after, stored) {
+				t.Fatalf("bound proposal changed after rejected %s mutation: got %#v, want %#v", tt.name, after, stored)
+			}
+		})
+	}
+
+	conflictingBind := clonePatchProposal(bound)
+	conflictingBind.PublicationEvidence.ArtifactDigest = "sha256:" + strings.Repeat("d", 64)
+	if err := s.BindPatchProposalPublicationEvidence(ctx, conflictingBind); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("conflicting BindPatchProposalPublicationEvidence() error = %v, want conflict", err)
+	}
+	afterConflict := onlyPatchProposal(t, s, initial.Namespace, initial.FindingID)
+	if !reflect.DeepEqual(afterConflict, stored) {
+		t.Fatalf("bound proposal changed after conflicting bind: got %#v, want %#v", afterConflict, stored)
+	}
+}
+
+func TestCreateScanRunAtomicallyRejectsConcurrentActiveIdempotency(t *testing.T) {
+	s := setupTestStore(t)
+	ctx := context.Background()
+	start := make(chan struct{})
+	results := make(chan error, 2)
+	for index, id := range []string{"scan-concurrent-a", "scan-concurrent-b"} {
+		idempotencyKey := "scanidem:concurrent-a"
+		if index == 1 {
+			idempotencyKey = "scanidem:concurrent-b"
+		}
+		go func() {
+			<-start
+			results <- s.CreateScanRun(ctx, &store.ScanRun{
+				ID:             id,
+				Namespace:      "ns1",
+				RepositoryScan: "repo1",
+				TaskName:       id + "-task",
+				Mode:           "manual",
+				Phase:          "pending",
+				IdempotencyKey: idempotencyKey,
+				StartedAt:      time.Now(),
+			})
+		}()
+	}
+	close(start)
+
+	successes := 0
+	conflicts := 0
+	for range 2 {
+		err := <-results
+		switch {
+		case err == nil:
+			successes++
+		case errors.Is(err, store.ErrConflict):
+			conflicts++
+		default:
+			t.Fatalf("CreateScanRun() error = %v", err)
+		}
+	}
+	if successes != 1 || conflicts != 1 {
+		t.Fatalf("CreateScanRun() successes/conflicts = %d/%d, want 1/1", successes, conflicts)
+	}
+
+	runs, _, err := s.ListScanRuns(ctx, "ns1", "repo1", 10, "")
+	if err != nil {
+		t.Fatalf("ListScanRuns() error = %v", err)
+	}
+	if len(runs) != 1 || runs[0].IdempotencyKey == "" || runs[0].Phase != "pending" {
+		t.Fatalf("runs = %#v, want one pending claimed run", runs)
+	}
+
+	runs[0].Phase = "failed"
+	completedAt := time.Now()
+	runs[0].CompletedAt = &completedAt
+	if err := s.UpdateScanRun(ctx, &runs[0]); err != nil {
+		t.Fatalf("UpdateScanRun() error = %v", err)
+	}
+	if err := s.CreateScanRun(ctx, &store.ScanRun{
+		ID:             "scan-concurrent-retry",
+		Namespace:      "ns1",
+		RepositoryScan: "repo1",
+		TaskName:       "scan-concurrent-retry-task",
+		Mode:           "manual",
+		Phase:          "pending",
+		IdempotencyKey: "scanidem:concurrent-retry",
+		StartedAt:      time.Now(),
+	}); err != nil {
+		t.Fatalf("CreateScanRun() after terminal run error = %v", err)
+	}
+}
+
+func TestCreateScanRunAtomicallyRejectsConcurrentActiveAcrossConnections(t *testing.T) {
+	databasePath := filepath.Join(t.TempDir(), "security-scan-admission.db")
+	dbA, err := NewDB(databasePath)
+	if err != nil {
+		t.Fatalf("NewDB(first) error = %v", err)
+	}
+	t.Cleanup(func() { _ = dbA.Close() })
+	dbB, err := NewDB(databasePath)
+	if err != nil {
+		t.Fatalf("NewDB(second) error = %v", err)
+	}
+	t.Cleanup(func() { _ = dbB.Close() })
+	stores := []*Store{NewStore(dbA, databasePath), NewStore(dbB, databasePath)}
+
+	ctx := context.Background()
+	start := make(chan struct{})
+	results := make(chan error, len(stores))
+	for index := range stores {
+		go func() {
+			<-start
+			results <- stores[index].CreateScanRun(ctx, &store.ScanRun{
+				ID:             "scan-cross-connection-" + string(rune('a'+index)),
+				Namespace:      "ns1",
+				RepositoryScan: "repo1",
+				TaskName:       "scan-cross-connection-task-" + string(rune('a'+index)),
+				Mode:           "manual",
+				Phase:          "pending",
+				IdempotencyKey: "scanidem:cross-connection-" + string(rune('a'+index)),
+				StartedAt:      time.Now(),
+			})
+		}()
+	}
+	close(start)
+
+	successes := 0
+	conflicts := 0
+	for range stores {
+		err := <-results
+		switch {
+		case err == nil:
+			successes++
+		case errors.Is(err, store.ErrConflict):
+			conflicts++
+		default:
+			t.Fatalf("CreateScanRun() cross-connection error = %v", err)
+		}
+	}
+	if successes != 1 || conflicts != 1 {
+		t.Fatalf("CreateScanRun() cross-connection successes/conflicts = %d/%d, want 1/1", successes, conflicts)
+	}
+
+	runs, _, err := stores[0].ListScanRuns(ctx, "ns1", "repo1", 10, "")
+	if err != nil {
+		t.Fatalf("ListScanRuns() error = %v", err)
+	}
+	if len(runs) != 1 || runs[0].Phase != "pending" {
+		t.Fatalf("runs = %#v, want one pending cross-connection claim", runs)
+	}
+}
+
 func TestSaveThreatModelReplacesCurrentModel(t *testing.T) {
 	s := setupTestStore(t)
 	ctx := context.Background()
diff --git a/internal/store/sqlite/session_cleanup.go b/internal/store/sqlite/session_cleanup.go
new file mode 100644
index 000000000..64660588f
--- /dev/null
+++ b/internal/store/sqlite/session_cleanup.go
@@ -0,0 +1,644 @@
+package sqlite
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"strings"
+	"time"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+var _ store.SessionCleanupPersistenceStore = (*Store)(nil)
+
+// GetSessionCleanupIntent returns the durable cross-store cleanup plan.
+func (s *Store) GetSessionCleanupIntent(ctx context.Context, namespace, sessionName string) (*store.SessionCleanupIntent, error) {
+	var encoded []byte
+	err := s.db.QueryRowContext(ctx,
+		`SELECT plan FROM session_cleanup_intents WHERE namespace = ? AND session_name = ?`,
+		namespace, sessionName,
+	).Scan(&encoded)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, store.ErrNotFound
+	}
+	if err != nil {
+		return nil, err
+	}
+	var intent store.SessionCleanupIntent
+	if err := json.Unmarshal(encoded, &intent); err != nil {
+		return nil, err
+	}
+	return &intent, nil
+}
+
+// ListSessionCleanupIntents returns every pending durable cleanup plan in
+// deterministic order for controller-startup recovery.
+func (s *Store) ListSessionCleanupIntents(ctx context.Context) ([]store.SessionCleanupIntent, error) {
+	rows, err := s.db.QueryContext(ctx,
+		`SELECT plan FROM session_cleanup_intents ORDER BY namespace, session_name`,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close() //nolint:errcheck
+	intents := make([]store.SessionCleanupIntent, 0)
+	for rows.Next() {
+		var encoded []byte
+		if err := rows.Scan(&encoded); err != nil {
+			return nil, err
+		}
+		var intent store.SessionCleanupIntent
+		if err := json.Unmarshal(encoded, &intent); err != nil {
+			return nil, err
+		}
+		if err := normalizeSessionCleanupIntent(&intent); err != nil {
+			return nil, err
+		}
+		intents = append(intents, intent)
+	}
+	return intents, rows.Err()
+}
+
+// GetSessionCleanupCompletion returns the durable deletion tombstone retained
+// after the Session row and intent have been atomically removed.
+func (s *Store) GetSessionCleanupCompletion(ctx context.Context, namespace, sessionName string) (*store.SessionCleanupCompletion, error) {
+	completion := &store.SessionCleanupCompletion{}
+	err := s.db.QueryRowContext(ctx,
+		`SELECT namespace, session_name, session_uid, operation_id, operation_digest, completed_at
+		 FROM session_cleanup_completions WHERE namespace = ? AND session_name = ?`,
+		namespace, sessionName,
+	).Scan(&completion.Namespace, &completion.SessionName, &completion.SessionUID, &completion.OperationID, &completion.OperationDigest, &completion.CompletedAt)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, store.ErrNotFound
+	}
+	if err != nil {
+		return nil, err
+	}
+	completion.CompletedAt = completion.CompletedAt.UTC()
+	return completion, nil
+}
+
+// HasSessionCleanupFenceForUID reports whether a Session UID belongs to a
+// pending or completed deletion and may not acquire new Kubernetes authority.
+func (s *Store) HasSessionCleanupFenceForUID(ctx context.Context, sessionUID string) (bool, error) {
+	sessionUID = strings.TrimSpace(sessionUID)
+	if sessionUID == "" {
+		return false, nil
+	}
+	var count int
+	if err := s.db.QueryRowContext(ctx,
+		`SELECT COUNT(*) FROM session_cleanup_completions WHERE session_uid = ?`, sessionUID,
+	).Scan(&count); err != nil {
+		return false, err
+	}
+	if count > 0 {
+		return true, nil
+	}
+	rows, err := s.db.QueryContext(ctx, `SELECT plan FROM session_cleanup_intents`)
+	if err != nil {
+		return false, err
+	}
+	defer rows.Close() //nolint:errcheck
+	for rows.Next() {
+		var encoded []byte
+		if err := rows.Scan(&encoded); err != nil {
+			return false, err
+		}
+		var intent store.SessionCleanupIntent
+		if err := json.Unmarshal(encoded, &intent); err != nil {
+			return false, err
+		}
+		if intent.SessionUID == sessionUID {
+			return true, nil
+		}
+	}
+	return false, rows.Err()
+}
+
+// GetSessionCleanupIdentity returns the Kubernetes Session UID already bound
+// to a transcript row, including a bind-before-control crash residue.
+func (s *Store) GetSessionCleanupIdentity(ctx context.Context, namespace, sessionName string) (string, error) {
+	var sessionUID string
+	err := s.db.QueryRowContext(ctx,
+		`SELECT control_session_uid FROM sessions WHERE namespace = ? AND name = ?`, namespace, sessionName,
+	).Scan(&sessionUID)
+	if errors.Is(err, sql.ErrNoRows) {
+		return "", store.ErrNotFound
+	}
+	return sessionUID, err
+}
+
+// BindSessionCleanupIdentity records the Kubernetes Session UID on the
+// transcript row so deletion cannot confuse a pre-cutover replacement with the
+// control record left by an older Session incarnation.
+func (s *Store) BindSessionCleanupIdentity(ctx context.Context, namespace, sessionName, sessionUID string) error {
+	trimmedNamespace := strings.TrimSpace(namespace)
+	if namespace != trimmedNamespace {
+		return store.ValidationErrorf("session namespace must not contain surrounding whitespace")
+	}
+	trimmedSessionName := strings.TrimSpace(sessionName)
+	if sessionName != trimmedSessionName {
+		return store.ValidationErrorf("session name must not contain surrounding whitespace")
+	}
+	namespace = trimmedNamespace
+	sessionName = trimmedSessionName
+	sessionUID = strings.TrimSpace(sessionUID)
+	if err := store.ValidateControlIdentifier("session namespace", namespace); err != nil {
+		return err
+	}
+	if err := store.ValidateControlIdentifier("session name", sessionName); err != nil {
+		return err
+	}
+	if err := store.ValidateControlIdentifier("session UID", sessionUID); err != nil {
+		return err
+	}
+	result, err := s.db.ExecContext(ctx,
+		`UPDATE sessions SET control_session_uid = ?
+		 WHERE namespace = ? AND name = ?
+		   AND (control_session_uid = '' OR control_session_uid = ?)
+		   AND NOT EXISTS (
+		     SELECT 1 FROM session_cleanup_intents
+		     WHERE namespace = ? AND session_name = ?
+		   )
+		   AND NOT EXISTS (
+		     SELECT 1 FROM session_cleanup_completions
+		     WHERE namespace = ? AND session_name = ?
+		   )`,
+		sessionUID, namespace, sessionName, sessionUID,
+		namespace, sessionName, namespace, sessionName,
+	)
+	if err != nil {
+		return err
+	}
+	rows, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if rows == 1 {
+		return nil
+	}
+	var count int
+	if err := s.db.QueryRowContext(ctx,
+		`SELECT COUNT(*) FROM sessions WHERE namespace = ? AND name = ?`, namespace, sessionName,
+	).Scan(&count); err != nil {
+		return err
+	}
+	if count == 0 {
+		return store.ErrNotFound
+	}
+	return controlConflict("session %s/%s has a different cleanup identity or deletion fence", namespace, sessionName)
+}
+
+// HasSessionCleanupIntent reports whether new work must be refused for a
+// Session whose deletion has crossed the durable intent boundary.
+func (s *Store) HasSessionCleanupIntent(ctx context.Context, namespace, sessionName string) (bool, error) {
+	var count int
+	if err := s.db.QueryRowContext(ctx,
+		`SELECT COUNT(*) FROM session_cleanup_intents WHERE namespace = ? AND session_name = ?`,
+		strings.TrimSpace(namespace), strings.TrimSpace(sessionName),
+	).Scan(&count); err != nil {
+		return false, err
+	}
+	return count > 0, nil
+}
+
+// PrepareSessionCleanup atomically re-proves SQLite quiescence and records the
+// exact Kubernetes cleanup plan before any authoritative object is deleted.
+func (s *Store) PrepareSessionCleanup(ctx context.Context, intent store.SessionCleanupIntent) (*store.SessionCleanupIntent, error) {
+	if err := normalizeSessionCleanupIntent(&intent); err != nil {
+		return nil, err
+	}
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	if existing, getErr := getSessionCleanupIntentTx(ctx, tx, intent.Namespace, intent.SessionName); getErr == nil {
+		if existing.OperationID != intent.OperationID || existing.OperationDigest != intent.OperationDigest {
+			return nil, controlConflict("session cleanup intent for %s/%s belongs to a different operation", intent.Namespace, intent.SessionName)
+		}
+		return existing, nil
+	} else if !errors.Is(getErr, store.ErrNotFound) {
+		return nil, getErr
+	}
+	if err := validateSessionCleanupEligibilityTx(ctx, tx, intent); err != nil {
+		return nil, err
+	}
+	encoded, err := json.Marshal(intent)
+	if err != nil {
+		return nil, err
+	}
+	if _, err := tx.ExecContext(ctx,
+		`INSERT INTO session_cleanup_intents(namespace, session_name, operation_id, operation_digest, plan, created_at)
+		 VALUES (?, ?, ?, ?, ?, ?)`,
+		intent.Namespace, intent.SessionName, intent.OperationID, intent.OperationDigest, encoded, intent.PreparedAt,
+	); err != nil {
+		return nil, err
+	}
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &intent, nil
+}
+
+// CompleteSessionCleanup removes SQLite-owned turn/outbox/transcript state only
+// after the caller has reclaimed the exact Kubernetes plan in the intent.
+//
+//nolint:gocyclo // Receipt, transcript, projection, cursor, and intent deletion must remain one auditable transaction.
+func (s *Store) CompleteSessionCleanup(ctx context.Context, request store.CompleteSessionCleanupRequest) error {
+	namespace := strings.TrimSpace(request.Namespace)
+	if request.Namespace != namespace {
+		return store.ValidationErrorf("session namespace must not contain surrounding whitespace")
+	}
+	sessionName := strings.TrimSpace(request.SessionName)
+	if request.SessionName != sessionName {
+		return store.ValidationErrorf("session name must not contain surrounding whitespace")
+	}
+	request.Namespace = namespace
+	request.SessionName = sessionName
+	request.OperationID = strings.TrimSpace(request.OperationID)
+	request.OperationDigest = strings.TrimSpace(request.OperationDigest)
+	for field, value := range map[string]string{
+		"session namespace": request.Namespace, "session name": request.SessionName,
+		"session cleanup operation ID": request.OperationID,
+	} {
+		if err := store.ValidateControlIdentifier(field, value); err != nil {
+			return err
+		}
+	}
+	if err := store.ValidateCanonicalDigest("session cleanup operation digest", request.OperationDigest); err != nil {
+		return err
+	}
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+	intent, err := getSessionCleanupIntentTx(ctx, tx, request.Namespace, request.SessionName)
+	if errors.Is(err, store.ErrNotFound) {
+		completion, completionErr := getSessionCleanupCompletionTx(ctx, tx, request.Namespace, request.SessionName)
+		if completionErr == nil && completion.OperationID == request.OperationID && completion.OperationDigest == request.OperationDigest {
+			return nil
+		}
+		if completionErr == nil {
+			return controlConflict("session cleanup completion belongs to a different operation")
+		}
+		if !errors.Is(completionErr, store.ErrNotFound) {
+			return completionErr
+		}
+		return controlConflict("session %s/%s has no durable cleanup intent or completion receipt", request.Namespace, request.SessionName)
+	}
+	if err != nil {
+		return err
+	}
+	if intent.OperationID != request.OperationID || intent.OperationDigest != request.OperationDigest {
+		return controlConflict("session cleanup completion does not match the durable intent")
+	}
+	var sessionCount int64
+	if err := tx.QueryRowContext(ctx,
+		`SELECT COUNT(*) FROM sessions WHERE namespace = ? AND name = ?`, request.Namespace, request.SessionName,
+	).Scan(&sessionCount); err != nil {
+		return err
+	}
+	if sessionCount == 0 && intent.SessionUID == "" {
+		return store.ErrNotFound
+	}
+	if err := validateSessionCleanupEligibilityTx(ctx, tx, *intent); err != nil {
+		return err
+	}
+	if _, err := tx.ExecContext(ctx,
+		`DELETE FROM outbox_projections
+		 WHERE aggregate_kind = ?
+		   AND aggregate_id IN (SELECT id FROM session_turns WHERE namespace = ? AND session_name = ?)`,
+		sessionTurnAggregateKind, request.Namespace, request.SessionName,
+	); err != nil {
+		return err
+	}
+	if _, err := tx.ExecContext(ctx,
+		`DELETE FROM session_turns WHERE namespace = ? AND session_name = ?`, request.Namespace, request.SessionName,
+	); err != nil {
+		return err
+	}
+	if _, err := tx.ExecContext(ctx,
+		`DELETE FROM session_controls WHERE namespace = ? AND session_name = ?`, request.Namespace, request.SessionName,
+	); err != nil {
+		return err
+	}
+	completedAt := time.Now().UTC()
+	receiptResult, err := tx.ExecContext(ctx,
+		`INSERT INTO session_cleanup_completions(namespace, session_name, session_uid, operation_id, operation_digest, completed_at)
+		 VALUES (?, ?, ?, ?, ?, ?)
+		 ON CONFLICT(namespace, session_name) DO UPDATE SET
+		   session_uid = excluded.session_uid,
+		   operation_id = excluded.operation_id,
+		   operation_digest = excluded.operation_digest,
+		   completed_at = excluded.completed_at
+		 WHERE session_cleanup_completions.session_uid = excluded.session_uid
+		   AND session_cleanup_completions.operation_id = excluded.operation_id
+		   AND session_cleanup_completions.operation_digest = excluded.operation_digest`,
+		request.Namespace, request.SessionName, intent.SessionUID, request.OperationID, request.OperationDigest, completedAt,
+	)
+	if err != nil {
+		return err
+	}
+	if rows, rowsErr := receiptResult.RowsAffected(); rowsErr != nil {
+		return rowsErr
+	} else if rows != 1 {
+		return controlConflict("session cleanup completion belongs to a different operation")
+	}
+	result, err := tx.ExecContext(ctx,
+		`DELETE FROM sessions WHERE namespace = ? AND name = ? AND session_type <> ?`,
+		request.Namespace, request.SessionName, store.SessionTypeGateway,
+	)
+	if err != nil {
+		return err
+	}
+	deleted, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if deleted != sessionCount {
+		return controlConflict("session %s/%s changed before transcript cleanup", request.Namespace, request.SessionName)
+	}
+	if _, err := tx.ExecContext(ctx,
+		`UPDATE execution_events SET session_name = '', session_seq = 0 WHERE namespace = ? AND session_name = ?`,
+		request.Namespace, request.SessionName,
+	); err != nil {
+		return err
+	}
+	if _, err := tx.ExecContext(ctx,
+		`DELETE FROM execution_event_session_sequences WHERE namespace = ? AND session_name = ?`,
+		request.Namespace, request.SessionName,
+	); err != nil {
+		return err
+	}
+	intentResult, err := tx.ExecContext(ctx,
+		`DELETE FROM session_cleanup_intents
+		 WHERE namespace = ? AND session_name = ? AND operation_id = ? AND operation_digest = ?`,
+		request.Namespace, request.SessionName, request.OperationID, request.OperationDigest,
+	)
+	if err != nil {
+		return err
+	}
+	if rows, rowsErr := intentResult.RowsAffected(); rowsErr != nil {
+		return rowsErr
+	} else if rows != 1 {
+		return controlConflict("session cleanup intent changed before completion")
+	}
+	return tx.Commit()
+}
+
+//nolint:gocyclo // The durable cross-store plan validates each independent exact fence in one place.
+func normalizeSessionCleanupIntent(intent *store.SessionCleanupIntent) error {
+	namespace := strings.TrimSpace(intent.Namespace)
+	if intent.Namespace != namespace {
+		return store.ValidationErrorf("session namespace must not contain surrounding whitespace")
+	}
+	sessionName := strings.TrimSpace(intent.SessionName)
+	if intent.SessionName != sessionName {
+		return store.ValidationErrorf("session name must not contain surrounding whitespace")
+	}
+	intent.Namespace = namespace
+	intent.SessionName = sessionName
+	intent.SessionUID = strings.TrimSpace(intent.SessionUID)
+	intent.ControlObjectUID = strings.TrimSpace(intent.ControlObjectUID)
+	intent.ControlRequestDigest = strings.TrimSpace(intent.ControlRequestDigest)
+	intent.LeaseName = strings.TrimSpace(intent.LeaseName)
+	intent.LeaseObjectUID = strings.TrimSpace(intent.LeaseObjectUID)
+	intent.OperationID = strings.TrimSpace(intent.OperationID)
+	intent.OperationDigest = strings.TrimSpace(intent.OperationDigest)
+	for field, value := range map[string]string{
+		"session namespace": intent.Namespace, "session name": intent.SessionName,
+		"session cleanup operation ID": intent.OperationID,
+	} {
+		if err := store.ValidateControlIdentifier(field, value); err != nil {
+			return err
+		}
+	}
+	if err := store.ValidateCanonicalDigest("session cleanup operation digest", intent.OperationDigest); err != nil {
+		return err
+	}
+	if intent.PreparedAt.IsZero() {
+		return store.ValidationErrorf("session cleanup preparation time is required")
+	}
+	intent.PreparedAt = intent.PreparedAt.UTC()
+	if intent.SessionUID == "" {
+		if intent.ControlObjectUID != "" || intent.ControlRequestDigest != "" || intent.ExpectedControlVersion != 0 ||
+			intent.ExpectedLeaseGeneration != 0 || intent.LeaseName != "" || intent.LeaseObjectUID != "" ||
+			len(intent.BranchClaims) != 0 || intent.ExpectedVerifiedBaseline != nil {
+			return store.ValidationErrorf("transcript-only session cleanup must not carry Kubernetes control fences")
+		}
+		return nil
+	}
+	if err := store.ValidateControlIdentifier("session UID", intent.SessionUID); err != nil {
+		return err
+	}
+	if intent.ControlRequestDigest == "" {
+		if intent.ControlObjectUID != "" || intent.ExpectedControlVersion != 0 ||
+			intent.ExpectedControlLastOperationID != "" || intent.ExpectedControlLastDigest != "" ||
+			intent.ExpectedVerifiedBaseline != nil {
+			return store.ValidationErrorf("UID-only session cleanup must not carry RuntimeSessionControl fences")
+		}
+	} else {
+		if err := store.ValidateCanonicalDigest("session control request digest", intent.ControlRequestDigest); err != nil {
+			return err
+		}
+		if intent.ExpectedControlVersion < 1 {
+			return store.ValidationErrorf("session cleanup control version must be at least one")
+		}
+	}
+	if intent.LeaseName == "" {
+		if intent.LeaseObjectUID != "" || intent.ExpectedLeaseGeneration != 0 {
+			return store.ValidationErrorf("session cleanup Lease fence is incomplete")
+		}
+	} else {
+		if intent.ExpectedLeaseGeneration < 1 {
+			return store.ValidationErrorf("session cleanup Lease generation must be at least one")
+		}
+		if err := store.ValidateControlIdentifier("session Lease name", intent.LeaseName); err != nil {
+			return err
+		}
+	}
+	for i := range intent.BranchClaims {
+		claim := &intent.BranchClaims[i]
+		claim.ID = strings.TrimSpace(claim.ID)
+		claim.ExpectedRepositoryID = strings.TrimSpace(claim.ExpectedRepositoryID)
+		claim.ExpectedRef = strings.TrimSpace(claim.ExpectedRef)
+		claim.ExpectedOwnerUID = strings.TrimSpace(claim.ExpectedOwnerUID)
+		claim.ExpectedRequestDigest = strings.TrimSpace(claim.ExpectedRequestDigest)
+		claim.ExpectedBlockedReason = strings.TrimSpace(claim.ExpectedBlockedReason)
+		claim.ExpectedPublicationID = strings.TrimSpace(claim.ExpectedPublicationID)
+		if claim.ExpectedOwnerUID != intent.SessionUID {
+			return store.ValidationErrorf("session cleanup branch claim owner does not match Session UID")
+		}
+		switch claim.ExpectedAvailability {
+		case store.BranchClaimAvailable:
+			if claim.ExpectedBlockedReason != "" || claim.ExpectedPublicationID != "" {
+				return store.ValidationErrorf("available session cleanup branch claim carries blocked state")
+			}
+		default:
+			return store.ValidationErrorf("session cleanup branch claim has unsupported availability %q", claim.ExpectedAvailability)
+		}
+		if claim.ExpectedVersion < 1 || claim.ExpectedGeneration < 1 {
+			return store.ValidationErrorf("session cleanup branch claim version and generation must be at least one")
+		}
+		if err := store.ValidateControlIdentifier("branch claim ID", claim.ID); err != nil {
+			return err
+		}
+		if err := store.ValidateControlIdentifier("publication repository ID", claim.ExpectedRepositoryID); err != nil {
+			return err
+		}
+		if err := store.ValidateFullBranchRef(claim.ExpectedRef); err != nil {
+			return err
+		}
+		if err := claim.ExpectedLastVerified.Validate("session cleanup branch baseline"); err != nil {
+			return err
+		}
+		if err := store.ValidateCanonicalDigest("session cleanup branch request digest", claim.ExpectedRequestDigest); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validateSessionCleanupEligibilityTx(ctx context.Context, tx *sql.Tx, intent store.SessionCleanupIntent) error {
+	var sessionType, activeTask, activeTaskUID, controlSessionUID string
+	var activeTaskExpiresAt sql.NullTime
+	if err := tx.QueryRowContext(ctx,
+		`SELECT session_type, active_task, active_task_uid, active_task_expires_at, control_session_uid
+		 FROM sessions WHERE namespace = ? AND name = ?`,
+		intent.Namespace, intent.SessionName,
+	).Scan(&sessionType, &activeTask, &activeTaskUID, &activeTaskExpiresAt, &controlSessionUID); errors.Is(err, sql.ErrNoRows) {
+		if intent.SessionUID != "" {
+			return nil
+		}
+		return store.ErrNotFound
+	} else if err != nil {
+		return err
+	}
+	needsTurnIdentityProof := false
+	if intent.SessionUID != "" {
+		if controlSessionUID == "" {
+			needsTurnIdentityProof = true
+		} else if controlSessionUID != intent.SessionUID {
+			return controlConflict("session %s/%s transcript is not bound to Kubernetes Session UID %q", intent.Namespace, intent.SessionName, intent.SessionUID)
+		}
+	} else if controlSessionUID != "" {
+		return controlConflict("session %s/%s has Kubernetes cleanup identity %q but no control plan", intent.Namespace, intent.SessionName, controlSessionUID)
+	}
+	if sessionType == store.SessionTypeGateway {
+		return store.ErrGatewayOwnedSession
+	}
+	if err := ensureSessionLockQuiescentTx(
+		ctx, tx, intent.Namespace, intent.SessionName, activeTask, activeTaskUID, activeTaskExpiresAt,
+	); err != nil {
+		return err
+	}
+	var pendingGatewayEvents int
+	if err := tx.QueryRowContext(ctx, `SELECT COUNT(*) FROM gateway_events
+		WHERE namespace = ? AND session_name = ? AND state IN (?, ?, ?, ?)`,
+		intent.Namespace, intent.SessionName, store.GatewayEventAccepted, store.GatewayEventQueued,
+		store.GatewayEventDispatching, store.GatewayEventTaskCreated,
+	).Scan(&pendingGatewayEvents); err != nil {
+		return err
+	}
+	if pendingGatewayEvents > 0 {
+		return store.ErrConflict
+	}
+	rows, err := tx.QueryContext(ctx,
+		`SELECT session_uid, state, terminal_kind, terminal_content
+		 FROM session_turns WHERE namespace = ? AND session_name = ?`,
+		intent.Namespace, intent.SessionName,
+	)
+	if err != nil {
+		return err
+	}
+	defer rows.Close() //nolint:errcheck
+	turnCount := 0
+	for rows.Next() {
+		turnCount++
+		var sessionUID string
+		var state store.SessionTurnState
+		var terminalKind store.SessionTurnTerminalKind
+		var terminalContent string
+		if err := rows.Scan(&sessionUID, &state, &terminalKind, &terminalContent); err != nil {
+			return err
+		}
+		if intent.SessionUID == "" || sessionUID != intent.SessionUID || state != store.SessionTurnFinalized {
+			return store.ErrConflict
+		}
+		if terminalKind == store.SessionTurnOutcomeMarker {
+			var marker struct {
+				Kind string `json:"kind"`
+			}
+			if err := json.Unmarshal([]byte(terminalContent), &marker); err != nil || marker.Kind == "OutcomeUnknown" {
+				return store.ErrConflict
+			}
+		}
+	}
+	if err := rows.Err(); err != nil {
+		return err
+	}
+	if intent.SessionUID == "" && turnCount > 0 {
+		return store.ErrConflict
+	}
+	if needsTurnIdentityProof && turnCount == 0 {
+		return controlConflict("legacy session %s/%s has no SessionTurn proof for Kubernetes Session UID %q", intent.Namespace, intent.SessionName, intent.SessionUID)
+	}
+	var unsettledProjections int
+	if err := tx.QueryRowContext(ctx,
+		`SELECT COUNT(*)
+		 FROM outbox_projections AS projections
+		 JOIN session_turns AS turns ON projections.aggregate_kind = ? AND projections.aggregate_id = turns.id
+		 WHERE turns.namespace = ? AND turns.session_name = ?
+		   AND projections.state NOT IN (?, ?)`,
+		sessionTurnAggregateKind, intent.Namespace, intent.SessionName,
+		store.OutboxProjectionDelivered, store.OutboxProjectionDeadLetter,
+	).Scan(&unsettledProjections); err != nil {
+		return err
+	}
+	if unsettledProjections > 0 {
+		return store.ErrConflict
+	}
+	return nil
+}
+
+func getSessionCleanupIntentTx(ctx context.Context, tx *sql.Tx, namespace, sessionName string) (*store.SessionCleanupIntent, error) {
+	var encoded []byte
+	err := tx.QueryRowContext(ctx,
+		`SELECT plan FROM session_cleanup_intents WHERE namespace = ? AND session_name = ?`,
+		namespace, sessionName,
+	).Scan(&encoded)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, store.ErrNotFound
+	}
+	if err != nil {
+		return nil, err
+	}
+	var intent store.SessionCleanupIntent
+	if err := json.Unmarshal(encoded, &intent); err != nil {
+		return nil, err
+	}
+	return &intent, nil
+}
+
+func getSessionCleanupCompletionTx(ctx context.Context, tx *sql.Tx, namespace, sessionName string) (*store.SessionCleanupCompletion, error) {
+	completion := &store.SessionCleanupCompletion{}
+	err := tx.QueryRowContext(ctx,
+		`SELECT namespace, session_name, session_uid, operation_id, operation_digest, completed_at
+		 FROM session_cleanup_completions WHERE namespace = ? AND session_name = ?`,
+		namespace, sessionName,
+	).Scan(&completion.Namespace, &completion.SessionName, &completion.SessionUID, &completion.OperationID, &completion.OperationDigest, &completion.CompletedAt)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, store.ErrNotFound
+	}
+	if err != nil {
+		return nil, err
+	}
+	completion.CompletedAt = completion.CompletedAt.UTC()
+	return completion, nil
+}
diff --git a/internal/store/sqlite/session_cleanup_test.go b/internal/store/sqlite/session_cleanup_test.go
new file mode 100644
index 000000000..2be9072b5
--- /dev/null
+++ b/internal/store/sqlite/session_cleanup_test.go
@@ -0,0 +1,134 @@
+package sqlite
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+func TestTranscriptSessionCleanupCompletionIsIdempotentUntilNameReuse(t *testing.T) {
+	s := setupTestStore(t)
+	ctx := context.Background()
+	now := time.Date(2026, 8, 1, 12, 0, 0, 0, time.UTC)
+	createControlTranscriptSession(t, s, "tenant-a", "chat-delete", now)
+	intent := store.SessionCleanupIntent{
+		Namespace: "tenant-a", SessionName: "chat-delete",
+		OperationID: "delete-chat-session", OperationDigest: controlTestDigest("delete-chat-session"), PreparedAt: now,
+	}
+	prepared, err := s.PrepareSessionCleanup(ctx, intent)
+	if err != nil {
+		t.Fatalf("PrepareSessionCleanup(): %v", err)
+	}
+	listed, err := s.ListSessionCleanupIntents(ctx)
+	if err != nil {
+		t.Fatalf("ListSessionCleanupIntents(): %v", err)
+	}
+	if len(listed) != 1 || listed[0].OperationDigest != prepared.OperationDigest {
+		t.Fatalf("pending cleanup intents = %#v", listed)
+	}
+	request := store.CompleteSessionCleanupRequest{
+		Namespace: intent.Namespace, SessionName: intent.SessionName,
+		OperationID: intent.OperationID, OperationDigest: intent.OperationDigest,
+	}
+	if err := s.CompleteSessionCleanup(ctx, request); err != nil {
+		t.Fatalf("CompleteSessionCleanup(): %v", err)
+	}
+	if err := s.CompleteSessionCleanup(ctx, request); err != nil {
+		t.Fatalf("CompleteSessionCleanup(idempotent retry): %v", err)
+	}
+	if _, err := s.GetSession(ctx, intent.Namespace, intent.SessionName); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("GetSession() error = %v, want ErrNotFound", err)
+	}
+	completion, err := s.GetSessionCleanupCompletion(ctx, intent.Namespace, intent.SessionName)
+	if err != nil {
+		t.Fatalf("GetSessionCleanupCompletion(): %v", err)
+	}
+	if completion.OperationID != intent.OperationID || completion.OperationDigest != intent.OperationDigest || completion.CompletedAt.IsZero() {
+		t.Fatalf("completion receipt = %#v", completion)
+	}
+	if err := s.CreateSession(ctx, &store.SessionRecord{
+		Namespace: intent.Namespace, Name: intent.SessionName, SessionType: "chat", CreatedAt: now, UpdatedAt: now,
+	}); err != nil {
+		t.Fatalf("CreateSession(reused transcript-only name): %v", err)
+	}
+	if _, err := s.GetSessionCleanupCompletion(ctx, intent.Namespace, intent.SessionName); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("GetSessionCleanupCompletion(after name reuse) error = %v, want ErrNotFound", err)
+	}
+}
+
+func TestSessionCleanupIntentBlocksTranscriptAppend(t *testing.T) {
+	s := setupTestStore(t)
+	ctx := context.Background()
+	now := time.Date(2026, 8, 1, 12, 0, 0, 0, time.UTC)
+	createControlTranscriptSession(t, s, "tenant-a", "chat-pending-delete", now)
+	if _, err := s.PrepareSessionCleanup(ctx, store.SessionCleanupIntent{
+		Namespace: "tenant-a", SessionName: "chat-pending-delete",
+		OperationID: "delete-chat-pending", OperationDigest: controlTestDigest("delete-chat-pending"), PreparedAt: now,
+	}); err != nil {
+		t.Fatalf("PrepareSessionCleanup(): %v", err)
+	}
+	if err := s.AppendMessages(ctx, "tenant-a", "chat-pending-delete", []store.SessionMessage{{
+		Role: "assistant", Content: "late response", Timestamp: now,
+	}}); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("AppendMessages() error = %v, want ErrConflict", err)
+	}
+	if err := s.DeleteSession(ctx, "tenant-a", "chat-pending-delete"); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("DeleteSession(pending cleanup) error = %v, want ErrConflict", err)
+	}
+	if _, err := s.GetSessionCleanupIntent(ctx, "tenant-a", "chat-pending-delete"); err != nil {
+		t.Fatalf("cleanup intent was erased by direct deletion attempt: %v", err)
+	}
+}
+
+func TestExpiredTransientSessionLockDoesNotWedgeDeletion(t *testing.T) {
+	s := setupTestStore(t)
+	ctx := context.Background()
+	now := time.Now().UTC()
+	createControlTranscriptSession(t, s, "tenant-a", "chat-expired-lock", now)
+	if err := s.AcquireLockUntil(ctx, "tenant-a", "chat-expired-lock", "chat-request-old", "chat-request-old", now.Add(time.Minute)); err != nil {
+		t.Fatalf("AcquireLockUntil(): %v", err)
+	}
+	if _, err := s.db.ExecContext(ctx,
+		`UPDATE sessions SET active_task_expires_at = ? WHERE namespace = ? AND name = ?`,
+		now.Add(-time.Minute), "tenant-a", "chat-expired-lock",
+	); err != nil {
+		t.Fatalf("expire transient lock: %v", err)
+	}
+	if err := s.DeleteSession(ctx, "tenant-a", "chat-expired-lock"); err != nil {
+		t.Fatalf("DeleteSession(after transient lock expiry): %v", err)
+	}
+}
+
+func TestExpiredTransientSessionOwnerCannotWriteAfterTakeover(t *testing.T) {
+	s := setupTestStore(t)
+	ctx := context.Background()
+	now := time.Now().UTC()
+	createControlTranscriptSession(t, s, "tenant-a", "chat-lock-takeover", now)
+	if err := s.AcquireLockUntil(ctx, "tenant-a", "chat-lock-takeover", "owner-a", "owner-a", now.Add(time.Minute)); err != nil {
+		t.Fatalf("AcquireLockUntil(owner A): %v", err)
+	}
+	if _, err := s.db.ExecContext(ctx,
+		`UPDATE sessions SET active_task_expires_at = ? WHERE namespace = ? AND name = ?`,
+		now.Add(-time.Minute), "tenant-a", "chat-lock-takeover",
+	); err != nil {
+		t.Fatalf("expire owner A: %v", err)
+	}
+	if err := s.AcquireLockUntil(ctx, "tenant-a", "chat-lock-takeover", "owner-b", "owner-b", now.Add(time.Minute)); err != nil {
+		t.Fatalf("AcquireLockUntil(owner B): %v", err)
+	}
+	late := []store.SessionMessage{{Role: "assistant", Content: "stale", Timestamp: now}}
+	if err := s.AppendMessagesWithLock(ctx, "tenant-a", "chat-lock-takeover", "owner-a", "owner-a", late); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("AppendMessagesWithLock(stale owner) error = %v, want ErrConflict", err)
+	}
+	if err := s.UpdateTokenCountsWithLock(ctx, "tenant-a", "chat-lock-takeover", "owner-a", "owner-a", 1, 1); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("UpdateTokenCountsWithLock(stale owner) error = %v, want ErrConflict", err)
+	}
+	if err := s.AppendMessagesWithLock(ctx, "tenant-a", "chat-lock-takeover", "owner-b", "owner-b", []store.SessionMessage{{
+		Role: "assistant", Content: "current", Timestamp: now,
+	}}); err != nil {
+		t.Fatalf("AppendMessagesWithLock(current owner): %v", err)
+	}
+}
diff --git a/internal/store/sqlite/session_control_store.go b/internal/store/sqlite/session_control_store.go
new file mode 100644
index 000000000..81a02569d
--- /dev/null
+++ b/internal/store/sqlite/session_control_store.go
@@ -0,0 +1,1203 @@
+package sqlite
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"reflect"
+	"strings"
+	"time"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+var _ store.SessionControlStore = (*Store)(nil)
+
+const (
+	sessionTurnAggregateKind     = "SessionTurn"
+	sessionTurnRoleAssistant     = "assistant"
+	sessionTurnRoleOutcomeMarker = "system"
+	sessionControlFieldNamespace = "session namespace"
+	sessionControlFieldName      = "session name"
+	sessionControlFieldUID       = "session UID"
+)
+
+// CreateSessionControl attaches an immutable SessionUID and fenced control
+// metadata to an existing transcript session.
+func (s *Store) CreateSessionControl(ctx context.Context, control *store.SessionControl, fence store.ControllerEpochFence) (*store.SessionControl, error) {
+	normalized, fence, err := normalizeSessionControlForCreate(control, fence)
+	if err != nil {
+		return nil, err
+	}
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, fence); err != nil {
+		return nil, err
+	}
+	if existing, getErr := getSessionControl(ctx, tx, normalized.Namespace, normalized.SessionName); getErr == nil {
+		if sameSessionControlCreation(existing, normalized) {
+			return &existing, nil
+		}
+		return nil, controlConflict("session control %s/%s was reused with a different UID or request digest", normalized.Namespace, normalized.SessionName)
+	} else if !errors.Is(getErr, store.ErrNotFound) {
+		return nil, getErr
+	}
+	var exists int
+	if err := tx.QueryRowContext(ctx,
+		`SELECT COUNT(*) FROM sessions WHERE namespace = ? AND name = ?`,
+		normalized.Namespace, normalized.SessionName,
+	).Scan(&exists); err != nil {
+		return nil, err
+	}
+	if exists != 1 {
+		return nil, store.ErrNotFound
+	}
+	verifiedRepositoryID, verifiedRef, verifiedSHA := baselineColumns(normalized.VerifiedBaseline)
+	_, err = tx.ExecContext(ctx,
+		`INSERT INTO session_controls(
+			namespace, session_name, session_uid, request_digest, availability, lease_generation, lease_task_uid,
+			lease_attempt, lease_prompt_id, lease_request_digest, lease_acquired_at, lease_expires_at,
+			blocked_reason, related_prompt_attempt_id, related_publication_id, verified_repository_id,
+			verified_ref, verified_sha, controller_epoch_name, controller_epoch, last_operation_id,
+			last_operation_digest, version, created_at, updated_at
+		) VALUES (?, ?, ?, ?, ?, ?, '', 0, '', '', NULL, NULL, ?, ?, ?, ?, ?, ?, ?, ?, '', '', 1, ?, ?)`,
+		normalized.Namespace, normalized.SessionName, normalized.SessionUID, normalized.RequestDigest,
+		string(normalized.Availability), normalized.LeaseGeneration, normalized.BlockedReason, normalized.RelatedPromptAttemptID,
+		normalized.RelatedPublicationID, verifiedRepositoryID, verifiedRef, verifiedSHA,
+		normalized.ControllerEpochName, normalized.ControllerEpoch, normalized.CreatedAt, normalized.UpdatedAt,
+	)
+	if err != nil {
+		if !isSQLiteConstraintError(err) {
+			return nil, err
+		}
+		existing, getErr := getSessionControl(ctx, tx, normalized.Namespace, normalized.SessionName)
+		if getErr == nil && sameSessionControlCreation(existing, normalized) {
+			return &existing, nil
+		}
+		return nil, controlConflict("session control %s/%s already exists with a different immutable UID or request digest", normalized.Namespace, normalized.SessionName)
+	}
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &normalized, nil
+}
+
+// GetSessionControl returns control state for an existing transcript session.
+func (s *Store) GetSessionControl(ctx context.Context, namespace, sessionName string) (*store.SessionControl, error) {
+	namespace = strings.TrimSpace(namespace)
+	sessionName = strings.TrimSpace(sessionName)
+	if err := store.ValidateControlIdentifier("session namespace", namespace); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateControlIdentifier("session name", sessionName); err != nil {
+		return nil, err
+	}
+	control, err := getSessionControl(ctx, s.db, namespace, sessionName)
+	if err != nil {
+		return nil, err
+	}
+	return &control, nil
+}
+
+// AcquireSessionMutationLease acquires the next monotonic lease generation and
+// mirrors ownership into the legacy session active_task field in the same transaction.
+func (s *Store) AcquireSessionMutationLease(ctx context.Context, request store.AcquireSessionMutationLeaseRequest) (*store.SessionControl, error) {
+	request.Namespace = strings.TrimSpace(request.Namespace)
+	request.SessionName = strings.TrimSpace(request.SessionName)
+	request.SessionUID = strings.TrimSpace(request.SessionUID)
+	request.TaskUID = strings.TrimSpace(request.TaskUID)
+	request.PromptID = strings.TrimSpace(request.PromptID)
+	for field, value := range map[string]string{
+		sessionControlFieldNamespace: request.Namespace, sessionControlFieldName: request.SessionName,
+		sessionControlFieldUID: request.SessionUID, "lease task UID": request.TaskUID,
+		"lease prompt ID": request.PromptID,
+	} {
+		if err := store.ValidateControlIdentifier(field, value); err != nil {
+			return nil, err
+		}
+	}
+	fence, err := normalizeEpochFence(request.Fence)
+	if err != nil {
+		return nil, err
+	}
+	request.Fence = fence
+	if request.ExpectedVersion < 1 || request.ExpectedLeaseGeneration < 0 || request.Attempt < 1 {
+		return nil, store.ValidationErrorf("session expected version and attempt must be at least 1 and lease generation must not be negative")
+	}
+	if err := store.ValidateCanonicalDigest("session lease request digest", request.RequestDigest); err != nil {
+		return nil, err
+	}
+	request.AcquiredAt = normalizeControlTime(request.AcquiredAt)
+	request.ExpiresAt = normalizeOptionalControlTime(request.ExpiresAt)
+	if request.ExpiresAt != nil && !request.ExpiresAt.After(request.AcquiredAt) {
+		return nil, store.ValidationErrorf("session lease expiry must be after acquisition")
+	}
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, request.Fence); err != nil {
+		return nil, err
+	}
+	control, err := getSessionControl(ctx, tx, request.Namespace, request.SessionName)
+	if err != nil {
+		return nil, err
+	}
+	if control.SessionUID != request.SessionUID {
+		return nil, controlConflict("session %s/%s UID does not match immutable control record", request.Namespace, request.SessionName)
+	}
+	if control.Lease != nil && control.Lease.TaskUID == request.TaskUID && control.Lease.Attempt == request.Attempt &&
+		control.Lease.PromptID == request.PromptID {
+		if control.Lease.RequestDigest == request.RequestDigest {
+			return &control, nil
+		}
+		return nil, controlConflict("session lease identity was reused with a different request digest")
+	}
+	if control.Version != request.ExpectedVersion || control.LeaseGeneration != request.ExpectedLeaseGeneration {
+		return nil, controlConflict("session %s/%s is version %d lease generation %d, expected version %d generation %d", request.Namespace, request.SessionName, control.Version, control.LeaseGeneration, request.ExpectedVersion, request.ExpectedLeaseGeneration)
+	}
+	if control.Availability != store.SessionAvailable {
+		return nil, controlConflict("session %s/%s is reconciliation-blocked: %s", request.Namespace, request.SessionName, control.BlockedReason)
+	}
+	if control.Lease != nil {
+		return nil, controlConflict("session %s/%s is already leased by task %s", request.Namespace, request.SessionName, control.Lease.TaskUID)
+	}
+
+	legacyResult, err := tx.ExecContext(ctx,
+		`UPDATE sessions SET active_task = ?, updated_at = ?
+		 WHERE namespace = ? AND name = ? AND (active_task = '' OR active_task = ?)`,
+		request.TaskUID, request.AcquiredAt, request.Namespace, request.SessionName, request.TaskUID,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if err := rowsAffectedExactlyOne(legacyResult, "session active-task lease"); err != nil {
+		return nil, controlConflict("legacy session lock prevented mutation lease acquisition")
+	}
+	newGeneration := control.LeaseGeneration + 1
+	result, err := tx.ExecContext(ctx,
+		`UPDATE session_controls
+		 SET lease_generation = ?, lease_task_uid = ?, lease_attempt = ?, lease_prompt_id = ?,
+		     lease_request_digest = ?, lease_acquired_at = ?, lease_expires_at = ?,
+		     controller_epoch_name = ?, controller_epoch = ?, version = version + 1, updated_at = ?
+		 WHERE namespace = ? AND session_name = ? AND session_uid = ? AND version = ?
+		   AND lease_generation = ? AND availability = 'Available' AND lease_task_uid = ''`,
+		newGeneration, request.TaskUID, request.Attempt, request.PromptID, request.RequestDigest,
+		request.AcquiredAt, nullTimeValue(request.ExpiresAt), request.Fence.Name, request.Fence.Epoch,
+		request.AcquiredAt, request.Namespace, request.SessionName, request.SessionUID,
+		request.ExpectedVersion, request.ExpectedLeaseGeneration,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if err := rowsAffectedExactlyOne(result, "session mutation lease"); err != nil {
+		return nil, err
+	}
+	control.LeaseGeneration = newGeneration
+	control.Lease = &store.SessionMutationLease{
+		Generation: newGeneration, TaskUID: request.TaskUID, Attempt: request.Attempt,
+		PromptID: request.PromptID, RequestDigest: request.RequestDigest,
+		AcquiredAt: request.AcquiredAt, ExpiresAt: request.ExpiresAt,
+	}
+	control.ControllerEpochName = request.Fence.Name
+	control.ControllerEpoch = request.Fence.Epoch
+	control.Version++
+	control.UpdatedAt = request.AcquiredAt
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &control, nil
+}
+
+// ReleaseSessionMutationLease atomically aborts an exact pre-prompt lease in
+// the legacy SQLite-authoritative store.
+func (s *Store) ReleaseSessionMutationLease(ctx context.Context, request store.ReleaseSessionMutationLeaseRequest) (*store.SessionControl, error) {
+	request.Namespace = strings.TrimSpace(request.Namespace)
+	request.SessionName = strings.TrimSpace(request.SessionName)
+	request.SessionUID = strings.TrimSpace(request.SessionUID)
+	request.OperationID = strings.TrimSpace(request.OperationID)
+	for field, value := range map[string]string{
+		sessionControlFieldNamespace: request.Namespace, sessionControlFieldName: request.SessionName,
+		sessionControlFieldUID: request.SessionUID, "session lease release operation ID": request.OperationID,
+	} {
+		if err := store.ValidateControlIdentifier(field, value); err != nil {
+			return nil, err
+		}
+	}
+	if err := request.Key.Validate(); err != nil {
+		return nil, err
+	}
+	turnID, err := request.Key.CanonicalID()
+	if err != nil {
+		return nil, err
+	}
+	if request.Key.SessionUID != request.SessionUID || request.ExpectedSessionVersion < 1 || request.OperationID != "release-pre-prompt:"+turnID {
+		return nil, store.ValidationErrorf("session lease release identity/version is invalid")
+	}
+	if err := store.ValidateCanonicalDigest("session lease request digest", request.LeaseRequestDigest); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateCanonicalDigest("session lease release operation digest", request.OperationDigest); err != nil {
+		return nil, err
+	}
+	expectedDigest, err := store.SessionLeaseReleaseOperationDigest(turnID, request.LeaseRequestDigest)
+	if err != nil {
+		return nil, err
+	}
+	if request.OperationDigest != expectedDigest {
+		return nil, store.ValidationErrorf("session lease release operation digest does not match its Lease request digest")
+	}
+	fence, err := normalizeEpochFence(request.Fence)
+	if err != nil {
+		return nil, err
+	}
+	request.Fence = fence
+	request.ReleasedAt = normalizeControlTime(request.ReleasedAt)
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, request.Fence); err != nil {
+		return nil, err
+	}
+	control, err := getSessionControl(ctx, tx, request.Namespace, request.SessionName)
+	if err != nil {
+		return nil, err
+	}
+	if control.SessionUID != request.SessionUID {
+		return nil, controlConflict("session %s/%s UID does not match immutable control record", request.Namespace, request.SessionName)
+	}
+	if control.LastOperationID == request.OperationID {
+		if control.LastOperationDigest != request.OperationDigest || control.Lease != nil {
+			return nil, controlConflict("session lease release operation %q was already applied with different target values", request.OperationID)
+		}
+		return &control, nil
+	}
+	if control.Version != request.ExpectedSessionVersion || !sessionLeaseMatches(control.Lease, request.Key) || control.Lease.RequestDigest != request.LeaseRequestDigest {
+		return nil, controlConflict("session %s/%s no longer matches the pre-prompt lease release fence", request.Namespace, request.SessionName)
+	}
+	if _, err := tx.ExecContext(ctx,
+		`UPDATE sessions SET active_task = '', updated_at = ? WHERE namespace = ? AND name = ? AND active_task = ?`,
+		request.ReleasedAt, request.Namespace, request.SessionName, request.Key.TaskUID,
+	); err != nil {
+		return nil, err
+	}
+	result, err := tx.ExecContext(ctx,
+		`UPDATE session_controls
+		 SET lease_task_uid = '', lease_attempt = 0, lease_prompt_id = '', lease_request_digest = '',
+		     lease_acquired_at = NULL, lease_expires_at = NULL, controller_epoch_name = ?, controller_epoch = ?,
+		     last_operation_id = ?, last_operation_digest = ?, version = version + 1, updated_at = ?
+		 WHERE namespace = ? AND session_name = ? AND session_uid = ? AND version = ?
+		   AND lease_generation = ? AND lease_task_uid = ? AND lease_attempt = ? AND lease_prompt_id = ? AND lease_request_digest = ?`,
+		request.Fence.Name, request.Fence.Epoch, request.OperationID, request.OperationDigest, request.ReleasedAt,
+		request.Namespace, request.SessionName, request.SessionUID, request.ExpectedSessionVersion,
+		request.Key.LeaseGeneration, request.Key.TaskUID, request.Key.Attempt, request.Key.PromptID, request.LeaseRequestDigest,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if err := rowsAffectedExactlyOne(result, "pre-prompt session lease release"); err != nil {
+		return nil, err
+	}
+	control.Lease = nil
+	control.ControllerEpochName = request.Fence.Name
+	control.ControllerEpoch = request.Fence.Epoch
+	control.LastOperationID = request.OperationID
+	control.LastOperationDigest = request.OperationDigest
+	control.Version++
+	control.UpdatedAt = request.ReleasedAt
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &control, nil
+}
+
+// ReconcileSessionControl atomically establishes an independently observed
+// branch baseline and returns a reconciliation-blocked Session and BranchClaim
+// to Available using exact session/claim version and generation fences.
+//
+//nolint:gocyclo // Session and branch recovery are one explicit cross-aggregate CAS transaction.
+func (s *Store) ReconcileSessionControl(ctx context.Context, request store.ReconcileSessionControlRequest) (*store.SessionControl, error) {
+	request.Namespace = strings.TrimSpace(request.Namespace)
+	request.SessionName = strings.TrimSpace(request.SessionName)
+	request.SessionUID = strings.TrimSpace(request.SessionUID)
+	request.ExpectedRelatedPublicationID = strings.TrimSpace(request.ExpectedRelatedPublicationID)
+	request.BranchClaimID = strings.TrimSpace(request.BranchClaimID)
+	request.OperationID = strings.TrimSpace(request.OperationID)
+	for field, value := range map[string]string{
+		sessionControlFieldNamespace: request.Namespace, sessionControlFieldName: request.SessionName,
+		sessionControlFieldUID: request.SessionUID, "related publication ID": request.ExpectedRelatedPublicationID,
+		"branch claim ID": request.BranchClaimID, "session reconciliation operation ID": request.OperationID,
+	} {
+		if err := store.ValidateControlIdentifier(field, value); err != nil {
+			return nil, err
+		}
+	}
+	fence, err := normalizeEpochFence(request.Fence)
+	if err != nil {
+		return nil, err
+	}
+	request.Fence = fence
+	if request.ExpectedVersion < 1 || request.ExpectedLeaseGeneration < 1 ||
+		request.ExpectedBranchClaimVersion < 1 || request.ExpectedBranchClaimGeneration < 1 {
+		return nil, store.ValidationErrorf("session/branch reconciliation versions and generations must be at least 1")
+	}
+	if err := request.ExpectedBranchBaseline.Validate("expected reconciliation branch baseline"); err != nil {
+		return nil, err
+	}
+	request.VerifiedBaseline.RepositoryID = strings.TrimSpace(request.VerifiedBaseline.RepositoryID)
+	request.VerifiedBaseline.Ref = strings.TrimSpace(request.VerifiedBaseline.Ref)
+	request.VerifiedBaseline.SHA = strings.TrimSpace(request.VerifiedBaseline.SHA)
+	if err := validateVerifiedBaseline(request.VerifiedBaseline); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateCanonicalDigest("session reconciliation operation digest", request.OperationDigest); err != nil {
+		return nil, err
+	}
+	request.ReconciledAt = normalizeControlTime(request.ReconciledAt)
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, request.Fence); err != nil {
+		return nil, err
+	}
+	control, err := getSessionControl(ctx, tx, request.Namespace, request.SessionName)
+	if err != nil {
+		return nil, err
+	}
+	if control.LastOperationID == request.OperationID {
+		if control.LastOperationDigest != request.OperationDigest {
+			return nil, controlConflict("session reconciliation operation %q was reused with a different digest", request.OperationID)
+		}
+		if control.Availability == store.SessionAvailable && control.Lease == nil &&
+			control.VerifiedBaseline != nil && reflect.DeepEqual(*control.VerifiedBaseline, request.VerifiedBaseline) {
+			return &control, nil
+		}
+		return nil, controlConflict("session reconciliation operation %q was already applied with different target values", request.OperationID)
+	}
+	if control.SessionUID != request.SessionUID || control.Version != request.ExpectedVersion ||
+		control.LeaseGeneration != request.ExpectedLeaseGeneration || control.Lease != nil ||
+		control.Availability != store.SessionReconciliationBlocked ||
+		control.RelatedPublicationID != request.ExpectedRelatedPublicationID {
+		return nil, controlConflict("session %s/%s no longer matches the blocked reconciliation fence", request.Namespace, request.SessionName)
+	}
+	claim, err := getBranchClaim(ctx, tx, request.BranchClaimID)
+	if err != nil {
+		return nil, err
+	}
+	if claim.Version != request.ExpectedBranchClaimVersion || claim.Generation != request.ExpectedBranchClaimGeneration ||
+		!claim.LastVerified.Equal(request.ExpectedBranchBaseline) ||
+		claim.Availability != store.BranchClaimReconciliationBlocked ||
+		claim.RelatedPublicationID != request.ExpectedRelatedPublicationID ||
+		claim.RepositoryID != request.VerifiedBaseline.RepositoryID || claim.Ref != request.VerifiedBaseline.Ref {
+		return nil, controlConflict("branch claim %q no longer matches the blocked reconciliation fence", claim.ID)
+	}
+	branchResult, err := tx.ExecContext(ctx,
+		`UPDATE branch_claims
+		 SET last_verified_absent = FALSE, last_verified_sha = ?, availability = 'Available',
+		     blocked_reason = '', related_publication_id = '', controller_epoch_name = ?, controller_epoch = ?,
+		     last_operation_id = ?, last_operation_digest = ?, version = version + 1, updated_at = ?
+		 WHERE id = ? AND version = ? AND generation = ? AND last_verified_absent = ?
+		   AND last_verified_sha = ? AND availability = 'ReconciliationBlocked'
+		   AND related_publication_id = ?`,
+		request.VerifiedBaseline.SHA, request.Fence.Name, request.Fence.Epoch,
+		request.OperationID, request.OperationDigest, request.ReconciledAt, claim.ID,
+		request.ExpectedBranchClaimVersion, request.ExpectedBranchClaimGeneration,
+		request.ExpectedBranchBaseline.Absent, request.ExpectedBranchBaseline.SHA,
+		request.ExpectedRelatedPublicationID,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if err := rowsAffectedExactlyOne(branchResult, "branch reconciliation"); err != nil {
+		return nil, err
+	}
+	controlResult, err := tx.ExecContext(ctx,
+		`UPDATE session_controls
+		 SET availability = 'Available', blocked_reason = '', related_prompt_attempt_id = '',
+		     related_publication_id = '', verified_repository_id = ?, verified_ref = ?, verified_sha = ?,
+		     controller_epoch_name = ?, controller_epoch = ?, last_operation_id = ?,
+		     last_operation_digest = ?, version = version + 1, updated_at = ?
+		 WHERE namespace = ? AND session_name = ? AND session_uid = ? AND version = ?
+		   AND lease_generation = ? AND lease_task_uid = '' AND availability = 'ReconciliationBlocked'
+		   AND related_publication_id = ?`,
+		request.VerifiedBaseline.RepositoryID, request.VerifiedBaseline.Ref, request.VerifiedBaseline.SHA,
+		request.Fence.Name, request.Fence.Epoch, request.OperationID, request.OperationDigest,
+		request.ReconciledAt, request.Namespace, request.SessionName, request.SessionUID,
+		request.ExpectedVersion, request.ExpectedLeaseGeneration, request.ExpectedRelatedPublicationID,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if err := rowsAffectedExactlyOne(controlResult, "session reconciliation"); err != nil {
+		return nil, err
+	}
+	control.Availability = store.SessionAvailable
+	control.BlockedReason = ""
+	control.RelatedPromptAttemptID = ""
+	control.RelatedPublicationID = ""
+	baseline := request.VerifiedBaseline
+	control.VerifiedBaseline = &baseline
+	control.ControllerEpochName = request.Fence.Name
+	control.ControllerEpoch = request.Fence.Epoch
+	control.LastOperationID = request.OperationID
+	control.LastOperationDigest = request.OperationDigest
+	control.Version++
+	control.UpdatedAt = request.ReconciledAt
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &control, nil
+}
+
+// CreateSessionTurn opens a durable turn only under its exact active lease.
+func (s *Store) CreateSessionTurn(ctx context.Context, request store.CreateSessionTurnRequest) (*store.SessionTurn, error) {
+	normalized, fence, err := normalizeSessionTurnForCreate(request.Turn, request.Fence)
+	if err != nil {
+		return nil, err
+	}
+	if request.ExpectedSessionVersion < 1 {
+		return nil, store.ValidationErrorf("expected session version must be at least 1")
+	}
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, fence); err != nil {
+		return nil, err
+	}
+	if existing, getErr := getSessionTurn(ctx, tx, normalized.ID); getErr == nil {
+		if sameSessionTurnCreation(existing, normalized) {
+			return &existing, nil
+		}
+		return nil, controlConflict("session turn %q was reused with different prompt input or request digest", normalized.ID)
+	} else if !errors.Is(getErr, store.ErrNotFound) {
+		return nil, getErr
+	}
+	control, err := getSessionControlByUID(ctx, tx, normalized.Key.SessionUID)
+	if err != nil {
+		return nil, err
+	}
+	if control.Version != request.ExpectedSessionVersion || !sessionLeaseMatches(control.Lease, normalized.Key) {
+		return nil, controlConflict("session turn %q does not match the active session lease/version", normalized.ID)
+	}
+	attempt, err := getPromptAttempt(ctx, tx, normalized.PromptAttemptID)
+	if err != nil {
+		return nil, fmt.Errorf("session turn prompt attempt: %w", err)
+	}
+	if attempt.Key.TaskUID != normalized.Key.TaskUID || attempt.Key.Attempt != normalized.Key.Attempt ||
+		attempt.Key.PromptID != normalized.Key.PromptID || attempt.SessionUID != normalized.Key.SessionUID ||
+		attempt.SessionLeaseGeneration != normalized.Key.LeaseGeneration {
+		return nil, controlConflict("session turn prompt attempt does not match the fenced session turn identity")
+	}
+	_, err = tx.ExecContext(ctx,
+		`INSERT INTO session_turns(
+			id, namespace, session_name, session_uid, lease_generation, task_uid, attempt, prompt_id, prompt_attempt_id,
+			request_digest, user_prompt, state, terminal_kind, terminal_content, finalization_digest,
+			publication_id, publication_receipt, controller_epoch_name, controller_epoch,
+			version, created_at, finalized_at, updated_at
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'Open', '', '', '', '', NULL, ?, ?, 1, ?, NULL, ?)`,
+		normalized.ID, control.Namespace, control.SessionName, normalized.Key.SessionUID, normalized.Key.LeaseGeneration, normalized.Key.TaskUID,
+		normalized.Key.Attempt, normalized.Key.PromptID, normalized.PromptAttemptID, normalized.RequestDigest,
+		normalized.UserPrompt, normalized.ControllerEpochName, normalized.ControllerEpoch,
+		normalized.CreatedAt, normalized.UpdatedAt,
+	)
+	if err != nil {
+		if isSQLiteConstraintError(err) {
+			return nil, controlConflict("session turn %q was created concurrently", normalized.ID)
+		}
+		return nil, err
+	}
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &normalized, nil
+}
+
+// GetSessionTurn returns a durable session turn.
+func (s *Store) GetSessionTurn(ctx context.Context, id string) (*store.SessionTurn, error) {
+	id = strings.TrimSpace(id)
+	if err := store.ValidateControlIdentifier("session turn ID", id); err != nil {
+		return nil, err
+	}
+	turn, err := getSessionTurn(ctx, s.db, id)
+	if err != nil {
+		return nil, err
+	}
+	return &turn, nil
+}
+
+// FinalizeSessionTurn is the atomic cross-store completion barrier. It optionally
+// appends the canonical user/terminal transcript entries, snapshots the publication
+// receipt, advances or blocks branch/session baselines, releases only the matching
+// lease, and enqueues the terminal projection before commit.
+//
+//nolint:gocyclo // This is the deliberate atomic cross-store completion transaction.
+func (s *Store) FinalizeSessionTurn(ctx context.Context, request store.FinalizeSessionTurnRequest) (*store.SessionTurn, error) {
+	if err := request.Key.Validate(); err != nil {
+		return nil, err
+	}
+	turnID, err := request.Key.CanonicalID()
+	if err != nil {
+		return nil, err
+	}
+	fence, err := normalizeEpochFence(request.Fence)
+	if err != nil {
+		return nil, err
+	}
+	request.Fence = fence
+	if request.ExpectedSessionVersion < 1 || request.ExpectedTurnVersion < 1 {
+		return nil, store.ValidationErrorf("expected session and turn versions must be at least 1")
+	}
+	if err := store.ValidateCanonicalDigest("session turn finalization digest", request.FinalizationDigest); err != nil {
+		return nil, err
+	}
+	if request.TerminalKind != store.SessionTurnAssistantResult && request.TerminalKind != store.SessionTurnOutcomeMarker {
+		return nil, store.ValidationErrorf("unsupported session turn terminal kind %q", request.TerminalKind)
+	}
+	if request.TerminalKind == store.SessionTurnOutcomeMarker && strings.TrimSpace(request.TerminalContent) == "" {
+		return nil, store.ValidationErrorf("outcome-marker finalization requires explicit marker content")
+	}
+	if request.SkipTranscriptAppend && request.SkipUserPromptAppend {
+		return nil, store.ValidationErrorf("session turn cannot combine full transcript suppression with user-prompt-only suppression")
+	}
+	if err := store.ValidateControlText("session turn terminal content", request.TerminalContent); err != nil {
+		return nil, err
+	}
+	request.PublicationID = strings.TrimSpace(request.PublicationID)
+	if request.PublicationID != "" {
+		if err := store.ValidateControlIdentifier("publication ID", request.PublicationID); err != nil {
+			return nil, err
+		}
+	}
+	request.BlockReason = strings.TrimSpace(request.BlockReason)
+	if err := store.ValidateControlReason("session block reason", request.BlockReason); err != nil {
+		return nil, err
+	}
+	if request.VerifiedBaseline != nil {
+		copyBaseline := *request.VerifiedBaseline
+		request.VerifiedBaseline = &copyBaseline
+		if err := validateVerifiedBaseline(copyBaseline); err != nil {
+			return nil, err
+		}
+	}
+	request.FinalizedAt = normalizeControlTime(request.FinalizedAt)
+	projectionScheduleExplicit := !request.Projection.AvailableAt.IsZero()
+	projection, _, err := normalizeOutboxProjectionForCreate(request.Projection, request.Fence, request.FinalizedAt)
+	if err != nil {
+		return nil, err
+	}
+	if projection.AggregateKind != sessionTurnAggregateKind || projection.AggregateID != turnID {
+		return nil, store.ValidationErrorf("finalization projection must target SessionTurn aggregate %q", turnID)
+	}
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, request.Fence); err != nil {
+		return nil, err
+	}
+	turn, err := getSessionTurn(ctx, tx, turnID)
+	if err != nil {
+		return nil, err
+	}
+	if turn.State == store.SessionTurnFinalized {
+		if turn.FinalizationDigest == request.FinalizationDigest && turn.TerminalKind == request.TerminalKind &&
+			turn.TerminalContent == request.TerminalContent && turn.PublicationID == request.PublicationID {
+			return &turn, nil
+		}
+		return nil, controlConflict("session turn %q was finalized with different terminal data or digest", turn.ID)
+	}
+	if turn.Version != request.ExpectedTurnVersion {
+		return nil, controlConflict("session turn %q is version %d, expected %d", turn.ID, turn.Version, request.ExpectedTurnVersion)
+	}
+	control, err := getSessionControlByUID(ctx, tx, request.Key.SessionUID)
+	if err != nil {
+		return nil, err
+	}
+	if control.Version != request.ExpectedSessionVersion || !sessionLeaseMatches(control.Lease, request.Key) {
+		return nil, controlConflict("session turn %q finalization is fenced by a different session version or lease", turn.ID)
+	}
+	attempt, err := getPromptAttempt(ctx, tx, turn.PromptAttemptID)
+	if err != nil {
+		return nil, fmt.Errorf("finalize prompt attempt: %w", err)
+	}
+	if err := validatePromptAttemptForFinalization(attempt, request); err != nil {
+		return nil, err
+	}
+
+	var receipt *store.PublicationReceipt
+	var publication *store.Publication
+	verifiedBaseline := request.VerifiedBaseline
+	if verifiedBaseline == nil && control.VerifiedBaseline != nil {
+		copyBaseline := *control.VerifiedBaseline
+		verifiedBaseline = &copyBaseline
+	}
+	blockReason := request.BlockReason
+	if request.PublicationID != "" {
+		value, getErr := getPublication(ctx, tx, request.PublicationID)
+		if getErr != nil {
+			return nil, fmt.Errorf("finalize publication: %w", getErr)
+		}
+		publication = &value
+		if value.TaskUID != request.Key.TaskUID || value.Attempt != request.Key.Attempt || value.PromptID != request.Key.PromptID ||
+			(value.SessionUID != "" && value.SessionUID != request.Key.SessionUID) || !store.IsTerminalPublicationState(value.State) {
+			return nil, controlConflict("publication %q does not match the terminal session turn identity/state", value.ID)
+		}
+		expectedDelivery, mapErr := promptDeliveryStateForPublication(value.State)
+		if mapErr != nil {
+			return nil, mapErr
+		}
+		if attempt.DeliveryState != expectedDelivery {
+			return nil, controlConflict("prompt attempt delivery state %s does not match publication state %s", attempt.DeliveryState, value.State)
+		}
+		receiptValue := publicationReceipt(value)
+		receipt = &receiptValue
+		derivedBaseline, unresolved, deriveErr := finalizationPublicationBaseline(value)
+		if deriveErr != nil {
+			return nil, deriveErr
+		}
+		if derivedBaseline != nil {
+			if verifiedBaseline != nil && !reflect.DeepEqual(*verifiedBaseline, *derivedBaseline) {
+				return nil, controlConflict("requested verified baseline does not match independent publication receipt")
+			}
+			verifiedBaseline = derivedBaseline
+		}
+		if unresolved && blockReason == "" {
+			return nil, store.ValidationErrorf("unresolved publication outcome requires a durable session block reason")
+		}
+	}
+	if request.PublicationID == "" && verifiedBaseline != nil {
+		return nil, store.ValidationErrorf("verified baseline advancement requires a publication receipt")
+	}
+
+	availability := store.SessionAvailable
+	if blockReason != "" {
+		availability = store.SessionReconciliationBlocked
+	}
+	if publication != nil {
+		if err := finalizeBranchClaimTx(ctx, tx, *publication, verifiedBaseline, availability, blockReason, request.FinalizationDigest, request.Fence, request.FinalizedAt); err != nil {
+			return nil, err
+		}
+	}
+	receiptJSON, err := marshalOptionalControlJSON(receipt)
+	if err != nil {
+		return nil, err
+	}
+	messageCountDelta := 0
+	if !request.SkipTranscriptAppend {
+		terminalRole := sessionTurnRoleAssistant
+		if request.TerminalKind == store.SessionTurnOutcomeMarker {
+			terminalRole = sessionTurnRoleOutcomeMarker
+		}
+		messageCountDelta, err = appendSessionTurnTranscript(
+			ctx, tx, control.Namespace, control.SessionName, turn.UserPrompt,
+			terminalRole, request.TerminalContent, request.FinalizedAt, request.SkipUserPromptAppend,
+		)
+		if err != nil {
+			return nil, err
+		}
+	}
+	legacyResult, err := tx.ExecContext(ctx,
+		`UPDATE sessions
+		 SET message_count = message_count + ?, active_task = '', updated_at = ?
+		 WHERE namespace = ? AND name = ? AND active_task = ?`,
+		messageCountDelta, request.FinalizedAt, control.Namespace, control.SessionName, request.Key.TaskUID,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if err := rowsAffectedExactlyOne(legacyResult, "session transcript finalization"); err != nil {
+		return nil, err
+	}
+
+	verifiedRepositoryID, verifiedRef, verifiedSHA := baselineColumns(verifiedBaseline)
+	relatedPromptAttemptID := ""
+	relatedPublicationID := ""
+	if availability == store.SessionReconciliationBlocked {
+		relatedPromptAttemptID = turn.PromptAttemptID
+		relatedPublicationID = request.PublicationID
+	}
+	controlResult, err := tx.ExecContext(ctx,
+		`UPDATE session_controls
+		 SET availability = ?, lease_task_uid = '', lease_attempt = 0, lease_prompt_id = '',
+		     lease_request_digest = '', lease_acquired_at = NULL, lease_expires_at = NULL,
+		     blocked_reason = ?, related_prompt_attempt_id = ?, related_publication_id = ?,
+		     verified_repository_id = ?, verified_ref = ?, verified_sha = ?,
+		     controller_epoch_name = ?, controller_epoch = ?, last_operation_id = ?,
+		     last_operation_digest = ?, version = version + 1, updated_at = ?
+		 WHERE namespace = ? AND session_name = ? AND session_uid = ? AND version = ?
+		   AND lease_generation = ? AND lease_task_uid = ? AND lease_attempt = ? AND lease_prompt_id = ?`,
+		string(availability), blockReason, relatedPromptAttemptID, relatedPublicationID,
+		verifiedRepositoryID, verifiedRef, verifiedSHA, request.Fence.Name, request.Fence.Epoch,
+		"finalize:"+turn.ID, request.FinalizationDigest, request.FinalizedAt,
+		control.Namespace, control.SessionName, control.SessionUID,
+		request.ExpectedSessionVersion, request.Key.LeaseGeneration, request.Key.TaskUID,
+		request.Key.Attempt, request.Key.PromptID,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if err := rowsAffectedExactlyOne(controlResult, "session finalization"); err != nil {
+		return nil, err
+	}
+	turnResult, err := tx.ExecContext(ctx,
+		`UPDATE session_turns
+		 SET state = 'Finalized', terminal_kind = ?, terminal_content = ?, finalization_digest = ?,
+		     publication_id = ?, publication_receipt = ?, projection_id = ?, projection_kind = ?,
+		     projection_digest = ?, projection_available_at = ?, controller_epoch_name = ?, controller_epoch = ?,
+		     version = version + 1, finalized_at = ?, updated_at = ?
+		 WHERE id = ? AND version = ? AND state = 'Open'`,
+		string(request.TerminalKind), request.TerminalContent, request.FinalizationDigest,
+		request.PublicationID, receiptJSON, projection.ID, projection.ProjectionKind, projection.PayloadDigest,
+		projection.InitialAvailableAt, request.Fence.Name, request.Fence.Epoch,
+		request.FinalizedAt, request.FinalizedAt, turn.ID, request.ExpectedTurnVersion,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if err := rowsAffectedExactlyOne(turnResult, "session turn finalization"); err != nil {
+		return nil, err
+	}
+	if _, err := enqueueOutboxProjectionTx(ctx, tx, projection, projectionScheduleExplicit); err != nil {
+		return nil, err
+	}
+
+	turn.State = store.SessionTurnFinalized
+	turn.TerminalKind = request.TerminalKind
+	turn.TerminalContent = request.TerminalContent
+	turn.FinalizationDigest = request.FinalizationDigest
+	turn.PublicationID = request.PublicationID
+	turn.PublicationReceipt = receipt
+	turn.ProjectionID = projection.ID
+	turn.ProjectionKind = projection.ProjectionKind
+	turn.ProjectionDigest = projection.PayloadDigest
+	turn.ProjectionAvailableAt = projection.InitialAvailableAt
+	turn.ControllerEpochName = request.Fence.Name
+	turn.ControllerEpoch = request.Fence.Epoch
+	turn.Version++
+	turn.FinalizedAt = &request.FinalizedAt
+	turn.UpdatedAt = request.FinalizedAt
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &turn, nil
+}
+
+// ResumeSessionTurnFinalization is a compatibility no-op for the legacy
+// SQLite-authoritative store because its transcript, control, lease, and outbox
+// finalization commit in one transaction. It still validates the current epoch
+// and exact persisted finalization identity so recovery cannot accept a
+// different turn or digest.
+func (s *Store) ResumeSessionTurnFinalization(ctx context.Context, request store.ResumeSessionTurnFinalizationRequest) (*store.SessionTurn, error) {
+	if err := request.Key.Validate(); err != nil {
+		return nil, err
+	}
+	turnID, err := request.Key.CanonicalID()
+	if err != nil {
+		return nil, err
+	}
+	request.PromptAttemptID = strings.TrimSpace(request.PromptAttemptID)
+	if err := store.ValidateControlIdentifier("prompt attempt ID", request.PromptAttemptID); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateCanonicalDigest("session turn finalization digest", request.FinalizationDigest); err != nil {
+		return nil, err
+	}
+	fence, err := normalizeEpochFence(request.Fence)
+	if err != nil {
+		return nil, err
+	}
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := requireControllerEpoch(ctx, tx, fence); err != nil {
+		return nil, err
+	}
+	turn, err := getSessionTurn(ctx, tx, turnID)
+	if err != nil {
+		return nil, err
+	}
+	if turn.State != store.SessionTurnFinalized || turn.Key != request.Key ||
+		turn.PromptAttemptID != request.PromptAttemptID || turn.FinalizationDigest != request.FinalizationDigest {
+		return nil, controlConflict("session turn %q does not match the persisted finalization recovery identity", turnID)
+	}
+	return &turn, nil
+}
+
+func normalizeSessionControlForCreate(control *store.SessionControl, fence store.ControllerEpochFence) (store.SessionControl, store.ControllerEpochFence, error) {
+	if control == nil {
+		return store.SessionControl{}, store.ControllerEpochFence{}, store.ValidationErrorf("session control is required")
+	}
+	normalized := *control
+	normalized.Namespace = strings.TrimSpace(normalized.Namespace)
+	normalized.SessionName = strings.TrimSpace(normalized.SessionName)
+	normalized.SessionUID = strings.TrimSpace(normalized.SessionUID)
+	for field, value := range map[string]string{
+		"session namespace": normalized.Namespace, "session name": normalized.SessionName,
+		"session UID": normalized.SessionUID,
+	} {
+		if err := store.ValidateControlIdentifier(field, value); err != nil {
+			return store.SessionControl{}, store.ControllerEpochFence{}, err
+		}
+	}
+	if err := store.ValidateCanonicalDigest("session control request digest", normalized.RequestDigest); err != nil {
+		return store.SessionControl{}, store.ControllerEpochFence{}, err
+	}
+	if normalized.Availability == "" {
+		normalized.Availability = store.SessionAvailable
+	}
+	if normalized.Availability != store.SessionAvailable && normalized.Availability != store.SessionReconciliationBlocked {
+		return store.SessionControl{}, store.ControllerEpochFence{}, store.ValidationErrorf("unsupported session availability %q", normalized.Availability)
+	}
+	if normalized.Lease != nil {
+		return store.SessionControl{}, store.ControllerEpochFence{}, store.ValidationErrorf("new session control must not contain an active lease")
+	}
+	if normalized.LeaseGeneration < 0 {
+		return store.SessionControl{}, store.ControllerEpochFence{}, store.ValidationErrorf("session lease generation must not be negative")
+	}
+	normalized.BlockedReason = strings.TrimSpace(normalized.BlockedReason)
+	if normalized.Availability == store.SessionAvailable && (normalized.BlockedReason != "" || normalized.RelatedPromptAttemptID != "" || normalized.RelatedPublicationID != "") {
+		return store.SessionControl{}, store.ControllerEpochFence{}, store.ValidationErrorf("available session control must not contain reconciliation block metadata")
+	}
+	if normalized.Availability == store.SessionReconciliationBlocked && normalized.BlockedReason == "" {
+		return store.SessionControl{}, store.ControllerEpochFence{}, store.ValidationErrorf("reconciliation-blocked session requires a reason")
+	}
+	if err := store.ValidateControlReason("session blocked reason", normalized.BlockedReason); err != nil {
+		return store.SessionControl{}, store.ControllerEpochFence{}, err
+	}
+	if normalized.VerifiedBaseline != nil {
+		copyBaseline := *normalized.VerifiedBaseline
+		normalized.VerifiedBaseline = &copyBaseline
+		if err := validateVerifiedBaseline(copyBaseline); err != nil {
+			return store.SessionControl{}, store.ControllerEpochFence{}, err
+		}
+	}
+	fence, err := normalizeEpochFence(fence)
+	if err != nil {
+		return store.SessionControl{}, store.ControllerEpochFence{}, err
+	}
+	if normalized.Version != 0 && normalized.Version != 1 {
+		return store.SessionControl{}, store.ControllerEpochFence{}, store.ValidationErrorf("new session control version must be zero or one")
+	}
+	now := normalizeControlTime(normalized.CreatedAt)
+	normalized.CreatedAt = now
+	if normalized.UpdatedAt.IsZero() {
+		normalized.UpdatedAt = now
+	} else {
+		normalized.UpdatedAt = normalized.UpdatedAt.UTC()
+	}
+	normalized.ControllerEpochName = fence.Name
+	normalized.ControllerEpoch = fence.Epoch
+	normalized.Version = 1
+	return normalized, fence, nil
+}
+
+func normalizeSessionTurnForCreate(turn store.SessionTurn, fence store.ControllerEpochFence) (store.SessionTurn, store.ControllerEpochFence, error) {
+	turn.Key.SessionUID = strings.TrimSpace(turn.Key.SessionUID)
+	turn.Key.TaskUID = strings.TrimSpace(turn.Key.TaskUID)
+	turn.Key.PromptID = strings.TrimSpace(turn.Key.PromptID)
+	if err := turn.Key.Validate(); err != nil {
+		return store.SessionTurn{}, store.ControllerEpochFence{}, err
+	}
+	canonicalID, err := turn.Key.CanonicalID()
+	if err != nil {
+		return store.SessionTurn{}, store.ControllerEpochFence{}, err
+	}
+	turn.ID = strings.TrimSpace(turn.ID)
+	if turn.ID == "" {
+		turn.ID = canonicalID
+	}
+	if turn.ID != canonicalID {
+		return store.SessionTurn{}, store.ControllerEpochFence{}, store.ValidationErrorf("session turn ID must equal canonical ID %q", canonicalID)
+	}
+	turn.PromptAttemptID = strings.TrimSpace(turn.PromptAttemptID)
+	if err := store.ValidateControlIdentifier("prompt attempt ID", turn.PromptAttemptID); err != nil {
+		return store.SessionTurn{}, store.ControllerEpochFence{}, err
+	}
+	if err := store.ValidateCanonicalDigest("session turn request digest", turn.RequestDigest); err != nil {
+		return store.SessionTurn{}, store.ControllerEpochFence{}, err
+	}
+	if strings.TrimSpace(turn.UserPrompt) == "" {
+		return store.SessionTurn{}, store.ControllerEpochFence{}, store.ValidationErrorf("session turn user prompt is required")
+	}
+	if err := store.ValidateControlText("session turn user prompt", turn.UserPrompt); err != nil {
+		return store.SessionTurn{}, store.ControllerEpochFence{}, err
+	}
+	if turn.State == "" {
+		turn.State = store.SessionTurnOpen
+	}
+	if turn.State != store.SessionTurnOpen || turn.TerminalKind != "" || turn.TerminalContent != "" ||
+		turn.FinalizationDigest != "" || turn.PublicationID != "" || turn.PublicationReceipt != nil || turn.FinalizedAt != nil {
+		return store.SessionTurn{}, store.ControllerEpochFence{}, store.ValidationErrorf("new session turn must be open and must not contain finalization data")
+	}
+	fence, err = normalizeEpochFence(fence)
+	if err != nil {
+		return store.SessionTurn{}, store.ControllerEpochFence{}, err
+	}
+	if turn.Version != 0 && turn.Version != 1 {
+		return store.SessionTurn{}, store.ControllerEpochFence{}, store.ValidationErrorf("new session turn version must be zero or one")
+	}
+	now := normalizeControlTime(turn.CreatedAt)
+	turn.CreatedAt = now
+	if turn.UpdatedAt.IsZero() {
+		turn.UpdatedAt = now
+	} else {
+		turn.UpdatedAt = turn.UpdatedAt.UTC()
+	}
+	turn.ControllerEpochName = fence.Name
+	turn.ControllerEpoch = fence.Epoch
+	turn.Version = 1
+	return turn, fence, nil
+}
+
+func validateVerifiedBaseline(baseline store.VerifiedBranchBaseline) error {
+	if err := store.ValidateControlIdentifier("verified repository ID", strings.TrimSpace(baseline.RepositoryID)); err != nil {
+		return err
+	}
+	if err := store.ValidateFullBranchRef(strings.TrimSpace(baseline.Ref)); err != nil {
+		return err
+	}
+	return store.ValidateGitObjectID("verified branch SHA", baseline.SHA)
+}
+
+func baselineColumns(baseline *store.VerifiedBranchBaseline) (string, string, string) {
+	if baseline == nil {
+		return "", "", ""
+	}
+	return baseline.RepositoryID, baseline.Ref, baseline.SHA
+}
+
+func sameSessionControlCreation(a, b store.SessionControl) bool {
+	return a.Namespace == b.Namespace && a.SessionName == b.SessionName && a.SessionUID == b.SessionUID &&
+		a.RequestDigest == b.RequestDigest
+}
+
+func sameSessionTurnCreation(a, b store.SessionTurn) bool {
+	return a.ID == b.ID && a.Key == b.Key && a.PromptAttemptID == b.PromptAttemptID &&
+		a.RequestDigest == b.RequestDigest && a.UserPrompt == b.UserPrompt
+}
+
+func sessionLeaseMatches(lease *store.SessionMutationLease, key store.SessionTurnKey) bool {
+	return lease != nil && lease.Generation == key.LeaseGeneration && lease.TaskUID == key.TaskUID &&
+		lease.Attempt == key.Attempt && lease.PromptID == key.PromptID
+}
+
+func validatePromptAttemptForFinalization(attempt store.PromptAttempt, request store.FinalizeSessionTurnRequest) error {
+	if attempt.Key.TaskUID != request.Key.TaskUID || attempt.Key.Attempt != request.Key.Attempt ||
+		attempt.Key.PromptID != request.Key.PromptID || attempt.SessionUID != request.Key.SessionUID ||
+		attempt.SessionLeaseGeneration != request.Key.LeaseGeneration {
+		return controlConflict("prompt attempt %q does not match the fenced session turn identity", attempt.ID)
+	}
+	if !store.IsTerminalPromptExecutionState(attempt.ExecutionState) {
+		return controlConflict("prompt attempt %q execution is not terminal: %s", attempt.ID, attempt.ExecutionState)
+	}
+	if !store.IsTerminalPromptDeliveryState(attempt.DeliveryState) {
+		return controlConflict("prompt attempt %q delivery is not terminal: %s", attempt.ID, attempt.DeliveryState)
+	}
+	if request.TerminalKind == store.SessionTurnAssistantResult && attempt.ExecutionState != store.PromptExecutionSucceeded {
+		return store.ValidationErrorf("assistant-result finalization requires succeeded prompt execution, got %s", attempt.ExecutionState)
+	}
+	if request.PublicationID == "" {
+		switch attempt.DeliveryState {
+		case store.PromptDeliveryNotRequested, store.PromptDeliveryReadValidated, store.PromptDeliveryNoChange,
+			store.PromptDeliveryReadOnlyWorkspaceModified, store.PromptDeliveryCredentialBlocked, store.PromptDeliveryConflict:
+			return nil
+		default:
+			return controlConflict("prompt attempt delivery state %s requires a matching publication receipt", attempt.DeliveryState)
+		}
+	}
+	return nil
+}
+
+func promptDeliveryStateForPublication(state store.PublicationState) (store.PromptDeliveryState, error) {
+	switch state {
+	case store.PublicationVerifiedExact:
+		return store.PromptDeliveryVerifiedExact, nil
+	case store.PublicationDeliveredSuperseded:
+		return store.PromptDeliveryDeliveredSuperseded, nil
+	case store.PublicationCancelledBeforePublish:
+		return store.PromptDeliveryCancelledBeforePublish, nil
+	case store.PublicationDeliveryConflict, store.PublicationPreparationFailed:
+		return store.PromptDeliveryConflict, nil
+	case store.PublicationCredentialBlocked:
+		return store.PromptDeliveryCredentialBlocked, nil
+	case store.PublicationOutcomeUnknown:
+		return store.PromptDeliveryPublicationOutcomeUnknown, nil
+	default:
+		return "", store.ValidationErrorf("publication state %s cannot finalize a session turn", state)
+	}
+}
+
+func finalizationPublicationBaseline(publication store.Publication) (*store.VerifiedBranchBaseline, bool, error) {
+	switch publication.State {
+	case store.PublicationVerifiedExact:
+		if publication.PreparedReceipt == nil || publication.VerificationReceipt == nil {
+			return nil, false, store.ValidationErrorf("verified publication lacks exact receipts")
+		}
+		return &store.VerifiedBranchBaseline{RepositoryID: publication.TargetRepositoryID, Ref: publication.TargetRef, SHA: publication.PreparedReceipt.CommitSHA}, false, nil
+	case store.PublicationDeliveredSuperseded:
+		if publication.VerificationReceipt == nil || publication.VerificationReceipt.ObservedRemote.Absent || publication.VerificationReceipt.ObservedRemote.SHA == "" {
+			return nil, false, store.ValidationErrorf("superseded publication lacks observed descendant receipt")
+		}
+		return &store.VerifiedBranchBaseline{RepositoryID: publication.TargetRepositoryID, Ref: publication.TargetRef, SHA: publication.VerificationReceipt.ObservedRemote.SHA}, false, nil
+	case store.PublicationOutcomeUnknown:
+		return nil, true, nil
+	case store.PublicationDeliveryConflict:
+		return nil, true, nil
+	default:
+		return nil, false, nil
+	}
+}
+
+func finalizeBranchClaimTx(ctx context.Context, tx *sql.Tx, publication store.Publication, baseline *store.VerifiedBranchBaseline, availability store.SessionAvailability, blockReason, operationDigest string, fence store.ControllerEpochFence, updatedAt time.Time) error {
+	claim, err := getBranchClaim(ctx, tx, publication.BranchClaimID)
+	if err != nil {
+		return err
+	}
+	if claim.Generation != publication.BranchClaimGeneration || claim.RepositoryID != publication.TargetRepositoryID ||
+		claim.Ref != publication.TargetRef || !claim.LastVerified.Equal(publication.Baseline) ||
+		claim.Availability != store.BranchClaimAvailable {
+		return controlConflict("branch claim %q no longer matches publication finalization baseline/generation", claim.ID)
+	}
+	newRemote := claim.LastVerified
+	claimAvailability := store.BranchClaimAvailable
+	relatedPublicationID := ""
+	if baseline != nil {
+		newRemote = store.RemoteRefState{SHA: baseline.SHA}
+	}
+	if availability == store.SessionReconciliationBlocked {
+		claimAvailability = store.BranchClaimReconciliationBlocked
+		relatedPublicationID = publication.ID
+	}
+	result, err := tx.ExecContext(ctx,
+		`UPDATE branch_claims
+		 SET last_verified_absent = ?, last_verified_sha = ?, availability = ?, blocked_reason = ?,
+		     related_publication_id = ?, controller_epoch_name = ?, controller_epoch = ?,
+		     last_operation_id = ?, last_operation_digest = ?, version = version + 1, updated_at = ?
+		 WHERE id = ? AND version = ? AND generation = ? AND last_verified_absent = ?
+		   AND last_verified_sha = ? AND availability = 'Available'`,
+		newRemote.Absent, newRemote.SHA, string(claimAvailability), blockReason, relatedPublicationID,
+		fence.Name, fence.Epoch, "finalize:"+publication.ID, operationDigest, updatedAt,
+		claim.ID, claim.Version, claim.Generation, claim.LastVerified.Absent, claim.LastVerified.SHA,
+	)
+	if err != nil {
+		return err
+	}
+	return rowsAffectedExactlyOne(result, "branch claim finalization")
+}
+
+func getSessionControl(ctx context.Context, q controlQueryRower, namespace, sessionName string) (store.SessionControl, error) {
+	return scanSessionControl(q.QueryRowContext(ctx, sessionControlSelectSQL()+` WHERE namespace = ? AND session_name = ?`, namespace, sessionName))
+}
+
+func getSessionControlByUID(ctx context.Context, q controlQueryRower, sessionUID string) (store.SessionControl, error) {
+	return scanSessionControl(q.QueryRowContext(ctx, sessionControlSelectSQL()+` WHERE session_uid = ?`, sessionUID))
+}
+
+func sessionControlSelectSQL() string {
+	return `SELECT namespace, session_name, session_uid, request_digest, availability, lease_generation, lease_task_uid,
+	        lease_attempt, lease_prompt_id, lease_request_digest, lease_acquired_at, lease_expires_at,
+	        blocked_reason, related_prompt_attempt_id, related_publication_id, verified_repository_id,
+	        verified_ref, verified_sha, controller_epoch_name, controller_epoch, last_operation_id,
+	        last_operation_digest, version, created_at, updated_at
+	 FROM session_controls`
+}
+
+type controlScanner interface {
+	Scan(dest ...any) error
+}
+
+func scanSessionControl(scanner controlScanner) (store.SessionControl, error) {
+	var control store.SessionControl
+	var leaseTaskUID, leasePromptID, leaseRequestDigest string
+	var leaseAttempt int64
+	var leaseAcquired, leaseExpires sql.NullTime
+	var verifiedRepositoryID, verifiedRef, verifiedSHA string
+	err := scanner.Scan(
+		&control.Namespace, &control.SessionName, &control.SessionUID, &control.RequestDigest, &control.Availability,
+		&control.LeaseGeneration, &leaseTaskUID, &leaseAttempt, &leasePromptID, &leaseRequestDigest,
+		&leaseAcquired, &leaseExpires, &control.BlockedReason, &control.RelatedPromptAttemptID,
+		&control.RelatedPublicationID, &verifiedRepositoryID, &verifiedRef, &verifiedSHA,
+		&control.ControllerEpochName, &control.ControllerEpoch, &control.LastOperationID,
+		&control.LastOperationDigest, &control.Version,
+		&control.CreatedAt, &control.UpdatedAt,
+	)
+	if errors.Is(err, sql.ErrNoRows) {
+		return store.SessionControl{}, store.ErrNotFound
+	}
+	if err != nil {
+		return store.SessionControl{}, fmt.Errorf("get session control: %w", err)
+	}
+	if leaseTaskUID != "" {
+		control.Lease = &store.SessionMutationLease{
+			Generation: control.LeaseGeneration, TaskUID: leaseTaskUID, Attempt: leaseAttempt,
+			PromptID: leasePromptID, RequestDigest: leaseRequestDigest, AcquiredAt: leaseAcquired.Time,
+		}
+		if leaseExpires.Valid {
+			value := leaseExpires.Time
+			control.Lease.ExpiresAt = &value
+		}
+	}
+	if verifiedRepositoryID != "" {
+		control.VerifiedBaseline = &store.VerifiedBranchBaseline{RepositoryID: verifiedRepositoryID, Ref: verifiedRef, SHA: verifiedSHA}
+	}
+	return control, nil
+}
+
+func getSessionTurn(ctx context.Context, q controlQueryRower, id string) (store.SessionTurn, error) {
+	var turn store.SessionTurn
+	var receiptJSON []byte
+	var finalizedAt, projectionAvailableAt sql.NullTime
+	err := q.QueryRowContext(ctx,
+		`SELECT id, session_uid, lease_generation, task_uid, attempt, prompt_id, prompt_attempt_id,
+		        request_digest, user_prompt, state, terminal_kind, terminal_content, finalization_digest,
+		        publication_id, publication_receipt, projection_id, projection_kind, projection_digest,
+		        projection_available_at, controller_epoch_name, controller_epoch,
+		        version, created_at, finalized_at, updated_at
+		 FROM session_turns WHERE id = ?`, id,
+	).Scan(
+		&turn.ID, &turn.Key.SessionUID, &turn.Key.LeaseGeneration, &turn.Key.TaskUID,
+		&turn.Key.Attempt, &turn.Key.PromptID, &turn.PromptAttemptID, &turn.RequestDigest,
+		&turn.UserPrompt, &turn.State, &turn.TerminalKind, &turn.TerminalContent,
+		&turn.FinalizationDigest, &turn.PublicationID, &receiptJSON, &turn.ProjectionID,
+		&turn.ProjectionKind, &turn.ProjectionDigest, &projectionAvailableAt, &turn.ControllerEpochName,
+		&turn.ControllerEpoch, &turn.Version, &turn.CreatedAt, &finalizedAt, &turn.UpdatedAt,
+	)
+	if errors.Is(err, sql.ErrNoRows) {
+		return store.SessionTurn{}, store.ErrNotFound
+	}
+	if err != nil {
+		return store.SessionTurn{}, fmt.Errorf("get session turn: %w", err)
+	}
+	if controlJSONPresent(receiptJSON) {
+		turn.PublicationReceipt = &store.PublicationReceipt{}
+		if err := unmarshalOptionalControlJSON(receiptJSON, turn.PublicationReceipt); err != nil {
+			return store.SessionTurn{}, fmt.Errorf("decode session turn publication receipt: %w", err)
+		}
+	}
+	if finalizedAt.Valid {
+		value := finalizedAt.Time
+		turn.FinalizedAt = &value
+	}
+	if projectionAvailableAt.Valid {
+		turn.ProjectionAvailableAt = projectionAvailableAt.Time
+	}
+	return turn, nil
+}
diff --git a/internal/store/sqlite/session_delete_control_test.go b/internal/store/sqlite/session_delete_control_test.go
new file mode 100644
index 000000000..164626dc8
--- /dev/null
+++ b/internal/store/sqlite/session_delete_control_test.go
@@ -0,0 +1,189 @@
+package sqlite
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+func TestDeleteSessionRejectsOpenDurableTurn(t *testing.T) {
+	s, control, fence := seedSessionForDurableDeleteTest(t, store.SessionTurnOpen, "")
+
+	if err := s.DeleteSession(context.Background(), control.Namespace, control.SessionName); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("DeleteSession() error = %v, want ErrConflict", err)
+	}
+	if _, err := s.GetSession(context.Background(), control.Namespace, control.SessionName); err != nil {
+		t.Fatalf("GetSession() after rejected delete = %v", err)
+	}
+	turnID, err := (store.SessionTurnKey{
+		SessionUID: control.SessionUID, LeaseGeneration: 1, TaskUID: "task-1", Attempt: 1, PromptID: "prompt-1",
+	}).CanonicalID()
+	if err != nil {
+		t.Fatalf("CanonicalID() error = %v", err)
+	}
+	if _, err := s.GetSessionTurn(context.Background(), turnID); err != nil {
+		t.Fatalf("GetSessionTurn() after rejected delete = %v", err)
+	}
+	_ = fence
+}
+
+func TestDeleteSessionRejectsUndeliveredTurnProjection(t *testing.T) {
+	s, control, _ := seedSessionForDurableDeleteTest(t, store.SessionTurnFinalized, store.OutboxProjectionPending)
+
+	if err := s.DeleteSession(context.Background(), control.Namespace, control.SessionName); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("DeleteSession() error = %v, want ErrConflict", err)
+	}
+	if _, err := s.GetOutboxProjection(context.Background(), "outbox-session-delete"); err != nil {
+		t.Fatalf("GetOutboxProjection() after rejected delete = %v", err)
+	}
+}
+
+func TestDeleteSessionRejectsActiveMutationLease(t *testing.T) {
+	s, control, fence := seedSessionForDurableDeleteTest(t, "", "")
+	now := time.Date(2026, 8, 1, 12, 0, 0, 0, time.UTC)
+	leased, err := s.AcquireSessionMutationLease(context.Background(), store.AcquireSessionMutationLeaseRequest{
+		Namespace:               control.Namespace,
+		SessionName:             control.SessionName,
+		SessionUID:              control.SessionUID,
+		Fence:                   fence,
+		ExpectedVersion:         control.Version,
+		ExpectedLeaseGeneration: control.LeaseGeneration,
+		TaskUID:                 "task-lease",
+		Attempt:                 1,
+		PromptID:                "prompt-lease",
+		RequestDigest:           controlTestDigest("session-delete-lease"),
+		AcquiredAt:              now,
+	})
+	if err != nil {
+		t.Fatalf("AcquireSessionMutationLease() error = %v", err)
+	}
+	if leased.Lease == nil {
+		t.Fatal("AcquireSessionMutationLease() did not persist a lease")
+	}
+
+	if err := s.DeleteSession(context.Background(), control.Namespace, control.SessionName); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("DeleteSession() error = %v, want ErrConflict", err)
+	}
+}
+
+func TestDeleteSessionRejectsPublicationBackedSessionClaim(t *testing.T) {
+	s, control, _ := seedSessionForDurableDeleteTest(t, store.SessionTurnFinalized, store.OutboxProjectionDelivered)
+	if _, err := s.db.ExecContext(context.Background(),
+		`UPDATE session_turns SET publication_id = 'publication-session-delete' WHERE namespace = ? AND session_name = ?`,
+		control.Namespace, control.SessionName,
+	); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := s.DeleteSession(context.Background(), control.Namespace, control.SessionName); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("DeleteSession() error = %v, want ErrConflict", err)
+	}
+	if _, err := s.GetSession(context.Background(), control.Namespace, control.SessionName); err != nil {
+		t.Fatalf("publication-backed session was deleted: %v", err)
+	}
+}
+
+func TestDeleteSessionReclaimsSettledDurableTurnState(t *testing.T) {
+	s, control, _ := seedSessionForDurableDeleteTest(t, store.SessionTurnFinalized, store.OutboxProjectionDelivered)
+	ctx := context.Background()
+
+	if err := s.DeleteSession(ctx, control.Namespace, control.SessionName); err != nil {
+		t.Fatalf("DeleteSession() error = %v", err)
+	}
+	if _, err := s.GetSession(ctx, control.Namespace, control.SessionName); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("GetSession() error = %v, want ErrNotFound", err)
+	}
+	if _, err := s.GetSessionControl(ctx, control.Namespace, control.SessionName); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("GetSessionControl() error = %v, want ErrNotFound", err)
+	}
+	turnID, err := (store.SessionTurnKey{
+		SessionUID: control.SessionUID, LeaseGeneration: 1, TaskUID: "task-1", Attempt: 1, PromptID: "prompt-1",
+	}).CanonicalID()
+	if err != nil {
+		t.Fatalf("CanonicalID() error = %v", err)
+	}
+	if _, err := s.GetSessionTurn(ctx, turnID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("GetSessionTurn() error = %v, want ErrNotFound", err)
+	}
+	if _, err := s.GetOutboxProjection(ctx, "outbox-session-delete"); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("GetOutboxProjection() error = %v, want ErrNotFound", err)
+	}
+}
+
+func seedSessionForDurableDeleteTest(
+	t *testing.T,
+	turnState store.SessionTurnState,
+	projectionState store.OutboxProjectionState,
+) (*Store, *store.SessionControl, store.ControllerEpochFence) {
+	t.Helper()
+	s := setupTestStore(t)
+	ctx := context.Background()
+	now := time.Date(2026, 8, 1, 10, 0, 0, 0, time.UTC)
+	fence := seedControlEpoch(t, s)
+	createControlTranscriptSession(t, s, "ns-delete", "session-delete", now)
+	control, err := s.CreateSessionControl(ctx, &store.SessionControl{
+		Namespace:     "ns-delete",
+		SessionName:   "session-delete",
+		SessionUID:    "session-delete-uid",
+		RequestDigest: controlTestDigest("session-delete-control"),
+		CreatedAt:     now,
+	}, fence)
+	if err != nil {
+		t.Fatalf("CreateSessionControl() error = %v", err)
+	}
+	if turnState == "" {
+		return s, control, fence
+	}
+	turnKey := store.SessionTurnKey{
+		SessionUID: control.SessionUID, LeaseGeneration: 1, TaskUID: "task-1", Attempt: 1, PromptID: "prompt-1",
+	}
+	turnID, err := turnKey.CanonicalID()
+	if err != nil {
+		t.Fatalf("CanonicalID() error = %v", err)
+	}
+	if turnState == store.SessionTurnOpen {
+		_, err = s.db.ExecContext(ctx, `INSERT INTO session_turns(
+			id, namespace, session_name, session_uid, lease_generation, task_uid, attempt, prompt_id,
+			prompt_attempt_id, request_digest, user_prompt, state, controller_epoch_name, controller_epoch,
+			version, created_at, updated_at
+		) VALUES (?, ?, ?, ?, 1, 'task-1', 1, 'prompt-1', 'attempt-1', ?, 'hello', 'Open', ?, ?, 1, ?, ?)`,
+			turnID, control.Namespace, control.SessionName, control.SessionUID,
+			controlTestDigest("session-delete-turn"), fence.Name, fence.Epoch, now, now,
+		)
+	} else {
+		_, err = s.db.ExecContext(ctx, `INSERT INTO session_turns(
+			id, namespace, session_name, session_uid, lease_generation, task_uid, attempt, prompt_id,
+			prompt_attempt_id, request_digest, user_prompt, state, terminal_kind, terminal_content,
+			finalization_digest, controller_epoch_name, controller_epoch, version, created_at, finalized_at, updated_at
+		) VALUES (?, ?, ?, ?, 1, 'task-1', 1, 'prompt-1', 'attempt-1', ?, 'hello', 'Finalized',
+			'AssistantResult', 'done', ?, ?, ?, 2, ?, ?, ?)`,
+			turnID, control.Namespace, control.SessionName, control.SessionUID,
+			controlTestDigest("session-delete-turn"), controlTestDigest("session-delete-finalization"),
+			fence.Name, fence.Epoch, now, now.Add(time.Minute), now.Add(time.Minute),
+		)
+	}
+	if err != nil {
+		t.Fatalf("insert session turn: %v", err)
+	}
+	if projectionState == "" {
+		return s, control, fence
+	}
+	var deliveredAt any
+	if projectionState == store.OutboxProjectionDelivered {
+		deliveredAt = now.Add(2 * time.Minute)
+	}
+	if _, err := s.db.ExecContext(ctx, `INSERT INTO outbox_projections(
+		id, aggregate_kind, aggregate_id, projection_kind, payload_digest, payload, state,
+		initial_available_at, available_at, controller_epoch_name, controller_epoch, version,
+		created_at, updated_at, delivered_at
+	) VALUES ('outbox-session-delete', ?, ?, 'TaskStatus', ?, '{}', ?, ?, ?, ?, ?, 1, ?, ?, ?)`,
+		sessionTurnAggregateKind, turnID, controlTestDigest("session-delete-projection"), projectionState,
+		now, now, fence.Name, fence.Epoch, now, now, deliveredAt,
+	); err != nil {
+		t.Fatalf("insert outbox projection: %v", err)
+	}
+	return s, control, fence
+}
diff --git a/internal/store/sqlite/session_lineage_store.go b/internal/store/sqlite/session_lineage_store.go
new file mode 100644
index 000000000..3fb80e097
--- /dev/null
+++ b/internal/store/sqlite/session_lineage_store.go
@@ -0,0 +1,137 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package sqlite
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+// ProjectSessionLineage implements store.SessionLineageStore. Kubernetes has
+// already established the authoritative lineage and mutation Lease before
+// this idempotent payload projection runs. A conflicting row is an integrity
+// failure to repair explicitly, never a SQLite decision about Session owner.
+func (s *Store) ProjectSessionLineage(ctx context.Context, lineage store.SessionLineage) (*store.SessionLineage, error) {
+	if err := lineage.Validate(); err != nil {
+		return nil, err
+	}
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, fmt.Errorf("begin session lineage claim: %w", err)
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	existing, err := scanSessionLineage(tx.QueryRowContext(ctx, sessionLineageSelectSQL+`
+		WHERE namespace = ? AND session_name = ?`, lineage.Namespace, lineage.SessionName))
+	switch {
+	case err == nil:
+		if mismatch := sessionLineageProjectionMismatch(existing, lineage); mismatch != "" {
+			return nil, fmt.Errorf("%w: session %s/%s lineage %s", store.ErrConflict,
+				lineage.Namespace, lineage.SessionName, mismatch)
+		}
+		if err := tx.Commit(); err != nil {
+			return nil, fmt.Errorf("commit session lineage projection verification: %w", err)
+		}
+		return existing, nil
+	case errors.Is(err, sql.ErrNoRows):
+	default:
+		return nil, fmt.Errorf("read session lineage: %w", err)
+	}
+
+	if _, err := tx.ExecContext(ctx, `INSERT INTO session_lineages
+		(namespace, session_name, namespace_uid, session_uid, contract_version,
+		 lineage_generation, runtime_identity, config_digest, version, created_at, updated_at)
+		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		lineage.Namespace, lineage.SessionName, lineage.NamespaceUID, lineage.SessionUID,
+		lineage.ContractVersion, lineage.LineageGeneration, lineage.RuntimeIdentity, lineage.ConfigDigest,
+		lineage.Version, lineage.CreatedAt.UTC(), lineage.UpdatedAt.UTC()); err != nil {
+		return nil, fmt.Errorf("project session lineage: %w", err)
+	}
+	if err := tx.Commit(); err != nil {
+		return nil, fmt.Errorf("commit session lineage projection: %w", err)
+	}
+	result := lineage
+	result.CreatedAt = result.CreatedAt.UTC()
+	result.UpdatedAt = result.UpdatedAt.UTC()
+	return &result, nil
+}
+
+// GetSessionLineage implements store.SessionLineageStore.
+func (s *Store) GetSessionLineage(ctx context.Context, namespace, sessionName string) (*store.SessionLineage, error) {
+	if strings.TrimSpace(namespace) == "" || strings.TrimSpace(sessionName) == "" {
+		return nil, store.ValidationErrorf("session lineage namespace and session name are required")
+	}
+	lineage, err := scanSessionLineage(s.db.QueryRowContext(ctx, sessionLineageSelectSQL+`
+		WHERE namespace = ? AND session_name = ?`, namespace, sessionName))
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, store.ErrNotFound
+	}
+	if err != nil {
+		return nil, fmt.Errorf("get session lineage: %w", err)
+	}
+	return lineage, nil
+}
+
+// DeleteSessionLineage implements store.SessionLineageStore.
+func (s *Store) DeleteSessionLineage(ctx context.Context, namespace, sessionName string) error {
+	if strings.TrimSpace(namespace) == "" || strings.TrimSpace(sessionName) == "" {
+		return store.ValidationErrorf("session lineage namespace and session name are required")
+	}
+	if _, err := s.db.ExecContext(ctx, `DELETE FROM session_lineages
+		WHERE namespace = ? AND session_name = ?`, namespace, sessionName); err != nil {
+		return fmt.Errorf("delete session lineage: %w", err)
+	}
+	return nil
+}
+
+const sessionLineageSelectSQL = `SELECT namespace, session_name, namespace_uid, session_uid,
+	contract_version, lineage_generation, runtime_identity, config_digest, version,
+	created_at, updated_at
+	FROM session_lineages`
+
+type sessionLineageScanner interface {
+	Scan(dest ...any) error
+}
+
+func scanSessionLineage(row sessionLineageScanner) (*store.SessionLineage, error) {
+	var lineage store.SessionLineage
+	if err := row.Scan(&lineage.Namespace, &lineage.SessionName, &lineage.NamespaceUID,
+		&lineage.SessionUID, &lineage.ContractVersion, &lineage.LineageGeneration,
+		&lineage.RuntimeIdentity, &lineage.ConfigDigest,
+		&lineage.Version, &lineage.CreatedAt, &lineage.UpdatedAt); err != nil {
+		return nil, err
+	}
+	lineage.CreatedAt = lineage.CreatedAt.UTC()
+	lineage.UpdatedAt = lineage.UpdatedAt.UTC()
+	return &lineage, nil
+}
+
+// sessionLineageProjectionMismatch reports any immutable difference between
+// the Kubernetes-authoritative record and its SQLite payload projection.
+func sessionLineageProjectionMismatch(existing *store.SessionLineage, lineage store.SessionLineage) string {
+	switch {
+	case existing.ContractVersion != lineage.ContractVersion:
+		return fmt.Sprintf("is bound to contract %s, not %s", existing.ContractVersion, lineage.ContractVersion)
+	case existing.SessionUID != lineage.SessionUID:
+		return "belongs to a different Session UID; a recreated same-name Session never attaches to old runtime state"
+	case existing.NamespaceUID != lineage.NamespaceUID:
+		return "belongs to a different namespace UID; a recreated same-name namespace never attaches to old runtime state"
+	case existing.RuntimeIdentity != lineage.RuntimeIdentity:
+		return fmt.Sprintf("is bound to runtime identity %q, not %q", existing.RuntimeIdentity, lineage.RuntimeIdentity)
+	case existing.ConfigDigest != lineage.ConfigDigest:
+		return fmt.Sprintf("is bound to configuration digest %q, not %q", existing.ConfigDigest, lineage.ConfigDigest)
+	case existing.LineageGeneration != lineage.LineageGeneration:
+		return fmt.Sprintf("has lineage generation %d, not %d", existing.LineageGeneration, lineage.LineageGeneration)
+	default:
+		return ""
+	}
+}
diff --git a/internal/store/sqlite/session_store.go b/internal/store/sqlite/session_store.go
index b77b06a14..38924fab3 100644
--- a/internal/store/sqlite/session_store.go
+++ b/internal/store/sqlite/session_store.go
@@ -15,14 +15,48 @@ import (
 
 // CreateSession inserts a new session record.
 func (s *Store) CreateSession(ctx context.Context, session *store.SessionRecord) error {
-	_, err := s.db.ExecContext(ctx,
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+	// Transcript-only completions are an idempotency receipt until the name is
+	// deliberately reused. Kubernetes-backed completions retain a SessionUID and
+	// permanently reserve the deleted identity.
+	if _, err := tx.ExecContext(ctx,
+		`DELETE FROM session_cleanup_completions
+		 WHERE namespace = ? AND session_name = ? AND session_uid = ''`,
+		session.Namespace, session.Name,
+	); err != nil {
+		return err
+	}
+	result, err := tx.ExecContext(ctx,
 		`INSERT INTO sessions (namespace, name, session_type, active_task, active_task_uid, message_count, input_tokens, output_tokens, cancelled, created_at, updated_at)
-		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		 SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
+		 WHERE NOT EXISTS (
+		   SELECT 1 FROM session_cleanup_intents
+		   WHERE namespace = ? AND session_name = ?
+		 )
+		 AND NOT EXISTS (
+		   SELECT 1 FROM session_cleanup_completions
+		   WHERE namespace = ? AND session_name = ?
+		 )`,
 		session.Namespace, session.Name, session.SessionType, session.ActiveTask, session.ActiveTaskUID,
 		session.MessageCount, session.InputTokens, session.OutputTokens, session.Cancelled,
 		session.CreatedAt, session.UpdatedAt,
+		session.Namespace, session.Name, session.Namespace, session.Name,
 	)
-	return err
+	if err != nil {
+		return err
+	}
+	inserted, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if inserted != 1 {
+		return fmt.Errorf("%w: session %s/%s is being deleted or its Kubernetes identity was deleted", store.ErrConflict, session.Namespace, session.Name)
+	}
+	return tx.Commit()
 }
 
 // GetSession loads a session with all its messages.
@@ -89,18 +123,29 @@ func (s *Store) ListSessions(ctx context.Context, namespace string) ([]store.Ses
 	return sessions, rows.Err()
 }
 
-// DeleteSession removes a session, its messages (via CASCADE), and its session-scoped execution event read model.
+// DeleteSession removes a quiescent session, its settled durable turn state,
+// its messages (via CASCADE), and its session-scoped execution event read
+// model. Open turns, active mutation leases, reconciliation-blocked controls,
+// and undelivered projections keep the session durable for recovery.
 func (s *Store) DeleteSession(ctx context.Context, namespace, name string) error {
 	tx, err := s.db.BeginTx(ctx, nil)
 	if err != nil {
 		return err
 	}
 	defer func() { _ = tx.Rollback() }()
-	var sessionType string
+	var sessionType, activeTask, activeTaskUID string
+	var activeTaskExpiresAt sql.NullTime
 	if err := tx.QueryRowContext(ctx,
-		`SELECT session_type FROM sessions WHERE namespace = ? AND name = ?`,
+		`SELECT session_type, active_task, active_task_uid, active_task_expires_at
+		 FROM sessions WHERE namespace = ? AND name = ?`,
 		namespace, name,
-	).Scan(&sessionType); err != nil && !errors.Is(err, sql.ErrNoRows) {
+	).Scan(&sessionType, &activeTask, &activeTaskUID, &activeTaskExpiresAt); err != nil && !errors.Is(err, sql.ErrNoRows) {
+		return err
+	}
+	if err := ensureSessionLockQuiescentTx(ctx, tx, namespace, name, activeTask, activeTaskUID, activeTaskExpiresAt); err != nil {
+		return err
+	}
+	if err := ensureNoSessionCleanupIntentTx(ctx, tx, namespace, name); err != nil {
 		return err
 	}
 	var pendingGatewayEvents int
@@ -120,6 +165,67 @@ func (s *Store) DeleteSession(ctx context.Context, namespace, name string) error
 	if sessionType == store.SessionTypeGateway {
 		return store.ErrGatewayOwnedSession
 	}
+	var controlAvailability, controlLeaseTaskUID string
+	if err := tx.QueryRowContext(ctx,
+		`SELECT availability, lease_task_uid FROM session_controls WHERE namespace = ? AND session_name = ?`,
+		namespace, name,
+	).Scan(&controlAvailability, &controlLeaseTaskUID); err != nil && !errors.Is(err, sql.ErrNoRows) {
+		return err
+	}
+	if controlLeaseTaskUID != "" || (controlAvailability != "" && controlAvailability != string(store.SessionAvailable)) {
+		return store.ErrConflict
+	}
+	var unsettledTurns int
+	if err := tx.QueryRowContext(ctx,
+		`SELECT COUNT(*) FROM session_turns WHERE namespace = ? AND session_name = ? AND state <> ?`,
+		namespace, name, store.SessionTurnFinalized,
+	).Scan(&unsettledTurns); err != nil {
+		return err
+	}
+	if unsettledTurns > 0 {
+		return store.ErrConflict
+	}
+	var publicationBackedTurns int
+	if err := tx.QueryRowContext(ctx,
+		`SELECT COUNT(*) FROM session_turns WHERE namespace = ? AND session_name = ? AND publication_id <> ''`,
+		namespace, name,
+	).Scan(&publicationBackedTurns); err != nil {
+		return err
+	}
+	if publicationBackedTurns > 0 {
+		// A publication-backed Session may still own its continuation
+		// BranchClaim in the Kubernetes control store. Generic transcript
+		// deletion cannot safely reclaim that cross-store ownership fence.
+		return store.ErrConflict
+	}
+	var unsettledProjections int
+	if err := tx.QueryRowContext(ctx,
+		`SELECT COUNT(*)
+		 FROM outbox_projections AS projections
+		 JOIN session_turns AS turns ON projections.aggregate_kind = ? AND projections.aggregate_id = turns.id
+		 WHERE turns.namespace = ? AND turns.session_name = ?
+		   AND projections.state NOT IN (?, ?)`,
+		sessionTurnAggregateKind, namespace, name, store.OutboxProjectionDelivered, store.OutboxProjectionDeadLetter,
+	).Scan(&unsettledProjections); err != nil {
+		return err
+	}
+	if unsettledProjections > 0 {
+		return store.ErrConflict
+	}
+	if _, err := tx.ExecContext(ctx,
+		`DELETE FROM outbox_projections
+		 WHERE aggregate_kind = ?
+		   AND aggregate_id IN (SELECT id FROM session_turns WHERE namespace = ? AND session_name = ?)`,
+		sessionTurnAggregateKind, namespace, name,
+	); err != nil {
+		return err
+	}
+	if _, err := tx.ExecContext(ctx, `DELETE FROM session_turns WHERE namespace = ? AND session_name = ?`, namespace, name); err != nil {
+		return err
+	}
+	if _, err := tx.ExecContext(ctx, `DELETE FROM session_controls WHERE namespace = ? AND session_name = ?`, namespace, name); err != nil {
+		return err
+	}
 	deleteResult, err := tx.ExecContext(ctx,
 		`DELETE FROM sessions WHERE namespace = ? AND name = ? AND session_type <> ?`,
 		namespace, name, store.SessionTypeGateway,
@@ -147,9 +253,67 @@ func (s *Store) DeleteSession(ctx context.Context, namespace, name string) error
 	return tx.Commit()
 }
 
-// AcquireLock atomically sets the active_task for a session.
+func ensureSessionLockQuiescentTx(
+	ctx context.Context,
+	tx *sql.Tx,
+	namespace, name, activeTask, activeTaskUID string,
+	activeTaskExpiresAt sql.NullTime,
+) error {
+	if activeTask == "" {
+		return nil
+	}
+	if !activeTaskExpiresAt.Valid || activeTaskExpiresAt.Time.After(time.Now().UTC()) {
+		return store.ErrConflict
+	}
+	result, err := tx.ExecContext(ctx,
+		`UPDATE sessions SET active_task = '', active_task_uid = '', active_task_expires_at = NULL
+		 WHERE namespace = ? AND name = ? AND active_task = ? AND active_task_uid = ?
+		   AND active_task_expires_at = ?`,
+		namespace, name, activeTask, activeTaskUID, activeTaskExpiresAt.Time,
+	)
+	if err != nil {
+		return err
+	}
+	rows, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if rows != 1 {
+		return store.ErrConflict
+	}
+	return nil
+}
+
+func ensureNoSessionCleanupIntentTx(ctx context.Context, tx *sql.Tx, namespace, name string) error {
+	var cleanupPending int
+	if err := tx.QueryRowContext(ctx,
+		`SELECT COUNT(*) FROM session_cleanup_intents WHERE namespace = ? AND session_name = ?`,
+		namespace, name,
+	).Scan(&cleanupPending); err != nil {
+		return err
+	}
+	if cleanupPending > 0 {
+		return store.ErrConflict
+	}
+	return nil
+}
+
+// AcquireLock atomically sets a durable Task lock for a session.
 // Returns store.ErrNotFound if the session does not exist, or an error if already locked.
 func (s *Store) AcquireLock(ctx context.Context, namespace, name, taskName, taskUID string) error {
+	return s.acquireLock(ctx, namespace, name, taskName, taskUID, nil)
+}
+
+// AcquireLockUntil atomically sets a crash-recoverable transient lock.
+func (s *Store) AcquireLockUntil(ctx context.Context, namespace, name, ownerName, ownerUID string, expiresAt time.Time) error {
+	expiresAt = expiresAt.UTC()
+	if !expiresAt.After(time.Now().UTC()) {
+		return store.ValidationErrorf("session lock expiration must be in the future")
+	}
+	return s.acquireLock(ctx, namespace, name, ownerName, ownerUID, &expiresAt)
+}
+
+func (s *Store) acquireLock(ctx context.Context, namespace, name, taskName, taskUID string, expiresAt *time.Time) error {
 	// Check if session exists
 	var count int
 	err := s.db.QueryRowContext(ctx,
@@ -198,13 +362,24 @@ func (s *Store) AcquireLock(ctx context.Context, namespace, name, taskName, task
 		}
 	}
 
-	// Try to acquire the exact Task incarnation. Empty stored UIDs are adopted only for
-	// compatibility with locks created before the fencing column existed.
+	// Try to acquire the exact owner incarnation. Empty stored UIDs are adopted only
+	// for compatibility with locks created before the fencing column existed. Expired
+	// transient locks are reclaimable after a controller crash.
+	var expiresValue any
+	if expiresAt != nil {
+		expiresValue = *expiresAt
+	}
+	now := time.Now().UTC()
 	result, err := s.db.ExecContext(ctx,
-		`UPDATE sessions SET active_task = ?, active_task_uid = ?
+		`UPDATE sessions SET active_task = ?, active_task_uid = ?, active_task_expires_at = ?
 		 WHERE namespace = ? AND name = ? AND (active_task = '' OR
-		   (active_task = ? AND (active_task_uid = '' OR active_task_uid = ?)))`,
-		taskName, taskUID, namespace, name, taskName, taskUID,
+		   (active_task_expires_at IS NOT NULL AND active_task_expires_at <= ?) OR
+		   (active_task = ? AND (active_task_uid = '' OR active_task_uid = ?)))
+		   AND NOT EXISTS (
+		     SELECT 1 FROM session_cleanup_intents
+		     WHERE namespace = ? AND session_name = ?
+		   )`,
+		taskName, taskUID, expiresValue, namespace, name, now, taskName, taskUID, namespace, name,
 	)
 	if err != nil {
 		return err
@@ -215,7 +390,12 @@ func (s *Store) AcquireLock(ctx context.Context, namespace, name, taskName, task
 		return err
 	}
 	if rows == 0 {
-		return fmt.Errorf("session %s/%s is already locked", namespace, name)
+		if pending, pendingErr := s.HasSessionCleanupIntent(ctx, namespace, name); pendingErr != nil {
+			return pendingErr
+		} else if pending {
+			return fmt.Errorf("%w: session %s/%s is being deleted", store.ErrConflict, namespace, name)
+		}
+		return fmt.Errorf("%w: session %s/%s is already locked", store.ErrConflict, namespace, name)
 	}
 	return nil
 }
@@ -223,7 +403,7 @@ func (s *Store) AcquireLock(ctx context.Context, namespace, name, taskName, task
 // ReleaseLock clears the lock only for the exact Task incarnation.
 func (s *Store) ReleaseLock(ctx context.Context, namespace, name, taskName, taskUID string) error {
 	_, err := s.db.ExecContext(ctx,
-		`UPDATE sessions SET active_task = '', active_task_uid = ''
+		`UPDATE sessions SET active_task = '', active_task_uid = '', active_task_expires_at = NULL
 		 WHERE namespace = ? AND name = ? AND active_task = ?
 		   AND active_task_uid = ?`,
 		namespace, name, taskName, taskUID,
@@ -233,27 +413,68 @@ func (s *Store) ReleaseLock(ctx context.Context, namespace, name, taskName, task
 
 // IsLocked returns true if the session is locked by another Task incarnation.
 func (s *Store) IsLocked(ctx context.Context, namespace, name, currentTask, currentTaskUID string) (bool, error) {
-	var activeTask, activeTaskUID string
-	err := s.db.QueryRowContext(ctx,
-		`SELECT active_task, active_task_uid FROM sessions WHERE namespace = ? AND name = ?`,
-		namespace, name,
-	).Scan(&activeTask, &activeTaskUID)
-	if errors.Is(err, sql.ErrNoRows) {
-		return false, store.ErrNotFound
-	}
-	if err != nil {
-		return false, err
-	}
-	if activeTask == "" {
-		return false, nil
+	for range 3 {
+		var activeTask, activeTaskUID string
+		var activeTaskExpiresAt sql.NullTime
+		err := s.db.QueryRowContext(ctx,
+			`SELECT active_task, active_task_uid, active_task_expires_at FROM sessions WHERE namespace = ? AND name = ?`,
+			namespace, name,
+		).Scan(&activeTask, &activeTaskUID, &activeTaskExpiresAt)
+		if errors.Is(err, sql.ErrNoRows) {
+			return false, store.ErrNotFound
+		}
+		if err != nil {
+			return false, err
+		}
+		if activeTask == "" {
+			return false, nil
+		}
+		if !activeTaskExpiresAt.Valid || activeTaskExpiresAt.Time.After(time.Now().UTC()) {
+			return activeTask != currentTask || (activeTaskUID != "" && activeTaskUID != currentTaskUID), nil
+		}
+		result, err := s.db.ExecContext(ctx,
+			`UPDATE sessions SET active_task = '', active_task_uid = '', active_task_expires_at = NULL
+			 WHERE namespace = ? AND name = ? AND active_task = ? AND active_task_uid = ?
+			   AND active_task_expires_at = ?`,
+			namespace, name, activeTask, activeTaskUID, activeTaskExpiresAt.Time,
+		)
+		if err != nil {
+			return false, err
+		}
+		rows, err := result.RowsAffected()
+		if err != nil {
+			return false, err
+		}
+		if rows == 1 {
+			return false, nil
+		}
 	}
-	return activeTask != currentTask || (activeTaskUID != "" && activeTaskUID != currentTaskUID), nil
+	// Rapid lock churn is conservatively reported as locked.
+	return true, nil
 }
 
 // AppendMessages inserts messages into a session's logical transcript and updates session metadata.
 // Stable message IDs make retries idempotent; even-numbered logical orders leave a gap for
 // gateway terminal projections that arrive after later user messages were durably admitted.
 func (s *Store) AppendMessages(ctx context.Context, namespace, name string, messages []store.SessionMessage) error {
+	return s.appendMessages(ctx, namespace, name, "", "", messages)
+}
+
+// AppendMessagesWithLock requires the exact transient lock owner through the
+// whole transaction, preventing writes after lease expiry and takeover.
+func (s *Store) AppendMessagesWithLock(
+	ctx context.Context,
+	namespace, name, ownerName, ownerUID string,
+	messages []store.SessionMessage,
+) error {
+	return s.appendMessages(ctx, namespace, name, ownerName, ownerUID, messages)
+}
+
+func (s *Store) appendMessages(
+	ctx context.Context,
+	namespace, name, ownerName, ownerUID string,
+	messages []store.SessionMessage,
+) error {
 	tx, err := s.db.BeginTx(ctx, nil)
 	if err != nil {
 		return err
@@ -270,6 +491,21 @@ func (s *Store) AppendMessages(ctx context.Context, namespace, name string, mess
 	if ownerType == gatewaySessionOwnerType {
 		return store.ErrConflict
 	}
+	if ownerName != "" || ownerUID != "" {
+		if err := verifySessionWriteLockTx(ctx, tx, namespace, name, ownerName, ownerUID); err != nil {
+			return err
+		}
+	}
+	var cleanupPending int
+	if err := tx.QueryRowContext(ctx,
+		`SELECT COUNT(*) FROM session_cleanup_intents WHERE namespace = ? AND session_name = ?`,
+		namespace, name,
+	).Scan(&cleanupPending); err != nil {
+		return err
+	}
+	if cleanupPending > 0 {
+		return store.ErrConflict
+	}
 
 	stmt, err := tx.PrepareContext(ctx,
 		`INSERT INTO session_messages
@@ -343,6 +579,30 @@ func (s *Store) AppendMessages(ctx context.Context, namespace, name string, mess
 	return tx.Commit()
 }
 
+func verifySessionWriteLockTx(ctx context.Context, tx *sql.Tx, namespace, name, ownerName, ownerUID string) error {
+	result, err := tx.ExecContext(ctx,
+		`UPDATE sessions SET updated_at = updated_at
+		 WHERE namespace = ? AND name = ? AND active_task = ? AND active_task_uid = ?
+		   AND (active_task_expires_at IS NULL OR active_task_expires_at > ?)
+		   AND NOT EXISTS (
+		     SELECT 1 FROM session_cleanup_intents
+		     WHERE namespace = ? AND session_name = ?
+		   )`,
+		namespace, name, ownerName, ownerUID, time.Now().UTC(), namespace, name,
+	)
+	if err != nil {
+		return err
+	}
+	rows, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if rows != 1 {
+		return fmt.Errorf("%w: session %s/%s lock owner changed or expired", store.ErrConflict, namespace, name)
+	}
+	return nil
+}
+
 // LoadTranscript retrieves messages in logical conversation order.
 func (s *Store) LoadTranscript(ctx context.Context, namespace, name string, maxMessages int) ([]store.SessionMessage, error) {
 	return s.loadTranscript(ctx, namespace, name, 0, maxMessages)
@@ -525,6 +785,37 @@ func (s *Store) UpdateTokenCounts(ctx context.Context, namespace, name string, i
 	return err
 }
 
+// UpdateTokenCountsWithLock requires the exact active transient lock owner.
+func (s *Store) UpdateTokenCountsWithLock(
+	ctx context.Context,
+	namespace, name, ownerName, ownerUID string,
+	inputTokens, outputTokens int,
+) error {
+	result, err := s.db.ExecContext(ctx,
+		`UPDATE sessions
+		 SET input_tokens = input_tokens + ?, output_tokens = output_tokens + ?, updated_at = ?
+		 WHERE namespace = ? AND name = ? AND active_task = ? AND active_task_uid = ?
+		   AND (active_task_expires_at IS NULL OR active_task_expires_at > ?)
+		   AND NOT EXISTS (
+		     SELECT 1 FROM session_cleanup_intents
+		     WHERE namespace = ? AND session_name = ?
+		   )`,
+		inputTokens, outputTokens, time.Now().UTC(), namespace, name, ownerName, ownerUID,
+		time.Now().UTC(), namespace, name,
+	)
+	if err != nil {
+		return err
+	}
+	rows, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if rows != 1 {
+		return fmt.Errorf("%w: session %s/%s lock owner changed or expired", store.ErrConflict, namespace, name)
+	}
+	return nil
+}
+
 // nilIfEmpty returns nil if s is empty, otherwise returns a pointer to s.
 func nilIfEmpty(s string) *string {
 	if s == "" {
diff --git a/internal/store/sqlite/session_turn_persistence.go b/internal/store/sqlite/session_turn_persistence.go
new file mode 100644
index 000000000..40fef94c0
--- /dev/null
+++ b/internal/store/sqlite/session_turn_persistence.go
@@ -0,0 +1,460 @@
+package sqlite
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"reflect"
+	"strings"
+	"time"
+
+	"github.com/orka-agents/orka/internal/store"
+)
+
+var _ store.SessionTurnPersistenceStore = (*Store)(nil)
+
+var deferredSessionTurnProjectionTime = time.Date(9999, time.December, 31, 23, 59, 59, 0, time.UTC)
+
+// CreateSessionTurnRecord persists only the SQLite-owned open turn after the
+// Kubernetes store has validated SessionControl and PromptAttempt fences.
+func (s *Store) CreateSessionTurnRecord(ctx context.Context, request store.CreateSessionTurnRecordRequest) (*store.SessionTurn, error) {
+	request.Namespace = strings.TrimSpace(request.Namespace)
+	request.SessionName = strings.TrimSpace(request.SessionName)
+	if err := store.ValidateControlIdentifier("session namespace", request.Namespace); err != nil {
+		return nil, err
+	}
+	if err := store.ValidateControlIdentifier("session name", request.SessionName); err != nil {
+		return nil, err
+	}
+	normalized, _, err := normalizeSessionTurnForCreate(request.Turn, request.Fence)
+	if err != nil {
+		return nil, err
+	}
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if existing, getErr := getSessionTurn(ctx, tx, normalized.ID); getErr == nil {
+		if !sameSessionTurnCreation(existing, normalized) {
+			return nil, controlConflict("session turn %q was reused with different prompt input or request digest", normalized.ID)
+		}
+		if err := requireSessionTurnBinding(ctx, tx, normalized.ID, request.Namespace, request.SessionName); err != nil {
+			return nil, err
+		}
+		return &existing, nil
+	} else if !errors.Is(getErr, store.ErrNotFound) {
+		return nil, getErr
+	}
+	if err := requireTranscriptSession(ctx, tx, request.Namespace, request.SessionName); err != nil {
+		return nil, err
+	}
+	if err := requireSessionUIDBinding(ctx, tx, normalized.Key.SessionUID, request.Namespace, request.SessionName); err != nil {
+		return nil, err
+	}
+	_, err = tx.ExecContext(ctx,
+		`INSERT INTO session_turns(
+			id, namespace, session_name, session_uid, lease_generation, task_uid, attempt, prompt_id,
+			prompt_attempt_id, request_digest, user_prompt, state, terminal_kind, terminal_content,
+			finalization_digest, publication_id, publication_receipt, controller_epoch_name,
+			controller_epoch, version, created_at, finalized_at, updated_at
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'Open', '', '', '', '', NULL, ?, ?, 1, ?, NULL, ?)`,
+		normalized.ID, request.Namespace, request.SessionName, normalized.Key.SessionUID,
+		normalized.Key.LeaseGeneration, normalized.Key.TaskUID, normalized.Key.Attempt,
+		normalized.Key.PromptID, normalized.PromptAttemptID, normalized.RequestDigest,
+		normalized.UserPrompt, normalized.ControllerEpochName, normalized.ControllerEpoch,
+		normalized.CreatedAt, normalized.UpdatedAt,
+	)
+	if err != nil {
+		if isSQLiteConstraintError(err) {
+			return nil, controlConflict("session turn %q was created concurrently", normalized.ID)
+		}
+		return nil, err
+	}
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &normalized, nil
+}
+
+// CommitSessionTurnFinalization atomically persists optional transcript entries,
+// the finalized turn receipt, and a deliberately deferred terminal projection.
+// It never reads or mutates SQLite control-plane mirror tables.
+func (s *Store) CommitSessionTurnFinalization(ctx context.Context, request store.CommitSessionTurnFinalizationRequest) (*store.SessionTurn, error) {
+	normalized, projection, err := normalizeSessionTurnPersistenceFinalization(request)
+	if err != nil {
+		return nil, err
+	}
+	deferredProjection := projection
+	deferredProjection.AvailableAt = deferredSessionTurnProjectionTime
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	turnID, err := normalized.Key.CanonicalID()
+	if err != nil {
+		return nil, err
+	}
+	turn, err := getSessionTurn(ctx, tx, turnID)
+	if err != nil {
+		return nil, err
+	}
+	if err := requireSessionTurnBinding(ctx, tx, turn.ID, normalized.Namespace, normalized.SessionName); err != nil {
+		return nil, err
+	}
+	if turn.State == store.SessionTurnFinalized {
+		if sessionTurnPersistenceFinalizationMatches(turn, normalized) {
+			return &turn, nil
+		}
+		return nil, controlConflict("session turn %q was finalized with different terminal data, receipt, or digest", turn.ID)
+	}
+	if turn.Key != normalized.Key {
+		return nil, controlConflict("session turn %q key does not match finalization request", turn.ID)
+	}
+	if turn.Version != normalized.ExpectedTurnVersion {
+		return nil, controlConflict("session turn %q is version %d, expected %d", turn.ID, turn.Version, normalized.ExpectedTurnVersion)
+	}
+	if err := requireTranscriptSession(ctx, tx, normalized.Namespace, normalized.SessionName); err != nil {
+		return nil, err
+	}
+	receiptJSON, err := marshalOptionalControlJSON(normalized.PublicationReceipt)
+	if err != nil {
+		return nil, err
+	}
+	messageCountDelta := 0
+	if !normalized.SkipTranscriptAppend {
+		terminalRole := sessionTurnRoleAssistant
+		if normalized.TerminalKind == store.SessionTurnOutcomeMarker {
+			terminalRole = sessionTurnRoleOutcomeMarker
+		}
+		messageCountDelta, err = appendSessionTurnTranscript(
+			ctx, tx, normalized.Namespace, normalized.SessionName, turn.UserPrompt,
+			terminalRole, normalized.TerminalContent, normalized.FinalizedAt, normalized.SkipUserPromptAppend,
+		)
+		if err != nil {
+			return nil, err
+		}
+	}
+	sessionResult, err := tx.ExecContext(ctx,
+		`UPDATE sessions SET message_count = message_count + ?, active_task = '', updated_at = ?
+		 WHERE namespace = ? AND name = ?`,
+		messageCountDelta, normalized.FinalizedAt, normalized.Namespace, normalized.SessionName,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if err := rowsAffectedExactlyOne(sessionResult, "session transcript finalization"); err != nil {
+		return nil, err
+	}
+	turnResult, err := tx.ExecContext(ctx,
+		`UPDATE session_turns
+		 SET state = 'Finalized', terminal_kind = ?, terminal_content = ?, finalization_digest = ?,
+		     publication_id = ?, publication_receipt = ?, projection_id = ?, projection_kind = ?,
+		     projection_digest = ?, projection_available_at = ?, controller_epoch_name = ?, controller_epoch = ?,
+		     version = version + 1, finalized_at = ?, updated_at = ?
+		 WHERE id = ? AND version = ? AND state = 'Open'`,
+		string(normalized.TerminalKind), normalized.TerminalContent, normalized.FinalizationDigest,
+		normalized.PublicationID, receiptJSON, projection.ID, projection.ProjectionKind,
+		projection.PayloadDigest, projection.InitialAvailableAt, normalized.Fence.Name, normalized.Fence.Epoch,
+		normalized.FinalizedAt, normalized.FinalizedAt, turn.ID, normalized.ExpectedTurnVersion,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if err := rowsAffectedExactlyOne(turnResult, "session turn finalization"); err != nil {
+		return nil, err
+	}
+	if _, err := enqueueOutboxProjectionTx(ctx, tx, deferredProjection, true); err != nil {
+		return nil, err
+	}
+
+	turn.State = store.SessionTurnFinalized
+	turn.TerminalKind = normalized.TerminalKind
+	turn.TerminalContent = normalized.TerminalContent
+	turn.FinalizationDigest = normalized.FinalizationDigest
+	turn.PublicationID = normalized.PublicationID
+	turn.PublicationReceipt = clonePublicationReceipt(normalized.PublicationReceipt)
+	turn.ProjectionID = projection.ID
+	turn.ProjectionKind = projection.ProjectionKind
+	turn.ProjectionDigest = projection.PayloadDigest
+	turn.ProjectionAvailableAt = projection.InitialAvailableAt
+	turn.ControllerEpochName = normalized.Fence.Name
+	turn.ControllerEpoch = normalized.Fence.Epoch
+	turn.Version++
+	turn.FinalizedAt = &normalized.FinalizedAt
+	turn.UpdatedAt = normalized.FinalizedAt
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &turn, nil
+}
+
+// ActivateSessionTurnProjection makes the deferred terminal projection
+// claimable only after Kubernetes control finalization has committed.
+func (s *Store) ActivateSessionTurnProjection(ctx context.Context, request store.ActivateSessionTurnProjectionRequest) (*store.OutboxProjection, error) {
+	normalized, err := normalizeActivateSessionTurnProjectionRequest(request)
+	if err != nil {
+		return nil, err
+	}
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = tx.Rollback() }()
+	turn, err := getSessionTurn(ctx, tx, normalized.TurnID)
+	if err != nil {
+		return nil, err
+	}
+	if turn.State != store.SessionTurnFinalized || turn.FinalizationDigest != normalized.FinalizationDigest {
+		return nil, controlConflict("session turn %q is not finalized with the expected digest", normalized.TurnID)
+	}
+	projection, err := getOutboxProjection(ctx, tx, normalized.ProjectionID)
+	if err != nil {
+		return nil, err
+	}
+	if projection.AggregateKind != normalized.ExpectedAggregateKind || projection.AggregateID != normalized.TurnID || projection.ProjectionKind != normalized.ExpectedProjectionKind || projection.PayloadDigest != normalized.ExpectedPayloadDigest {
+		return nil, controlConflict("outbox projection %q does not match finalized SessionTurn", projection.ID)
+	}
+	operationID := "activate-session-turn:" + normalized.TurnID
+	if projection.LastOperationID == operationID {
+		if projection.LastOperationDigest != normalized.FinalizationDigest {
+			return nil, controlConflict("outbox activation operation %q was reused with a different digest", operationID)
+		}
+		return &projection, nil
+	}
+	if projection.InitialAvailableAt.Equal(normalized.AvailableAt) && !projection.AvailableAt.Equal(deferredSessionTurnProjectionTime) {
+		// Once the deferred timestamp is released, later outbox claim/retry/
+		// delivery transitions own AvailableAt and LastOperationID. Finalization
+		// retries must not rewind or reject that delivery state.
+		return &projection, nil
+	}
+	if projection.State != store.OutboxProjectionPending || projection.Attempts != 0 || projection.LeaseOwner != "" || projection.LeaseExpiresAt != nil {
+		return nil, controlConflict("outbox projection %q was claimed before SessionTurn activation", projection.ID)
+	}
+	result, err := tx.ExecContext(ctx,
+		`UPDATE outbox_projections
+		 SET available_at = ?, last_operation_id = ?, last_operation_digest = ?,
+		     controller_epoch_name = ?, controller_epoch = ?, version = version + 1, updated_at = ?
+		 WHERE id = ? AND version = ? AND state = 'Pending' AND attempts = 0 AND lease_owner = ''`,
+		normalized.AvailableAt, operationID, normalized.FinalizationDigest,
+		normalized.Fence.Name, normalized.Fence.Epoch, normalized.UpdatedAt,
+		projection.ID, projection.Version,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if err := rowsAffectedExactlyOne(result, "session turn outbox activation"); err != nil {
+		return nil, err
+	}
+	projection.AvailableAt = normalized.AvailableAt
+	projection.LastOperationID = operationID
+	projection.LastOperationDigest = normalized.FinalizationDigest
+	projection.ControllerEpochName = normalized.Fence.Name
+	projection.ControllerEpoch = normalized.Fence.Epoch
+	projection.Version++
+	projection.UpdatedAt = normalized.UpdatedAt
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return &projection, nil
+}
+
+func normalizeSessionTurnPersistenceFinalization(request store.CommitSessionTurnFinalizationRequest) (store.CommitSessionTurnFinalizationRequest, store.OutboxProjection, error) {
+	if err := request.Key.Validate(); err != nil {
+		return store.CommitSessionTurnFinalizationRequest{}, store.OutboxProjection{}, err
+	}
+	request.Namespace = strings.TrimSpace(request.Namespace)
+	request.SessionName = strings.TrimSpace(request.SessionName)
+	if err := store.ValidateControlIdentifier("session namespace", request.Namespace); err != nil {
+		return store.CommitSessionTurnFinalizationRequest{}, store.OutboxProjection{}, err
+	}
+	if err := store.ValidateControlIdentifier("session name", request.SessionName); err != nil {
+		return store.CommitSessionTurnFinalizationRequest{}, store.OutboxProjection{}, err
+	}
+	fence, err := normalizeEpochFence(request.Fence)
+	if err != nil {
+		return store.CommitSessionTurnFinalizationRequest{}, store.OutboxProjection{}, err
+	}
+	request.Fence = fence
+	if request.ExpectedTurnVersion < 1 {
+		return store.CommitSessionTurnFinalizationRequest{}, store.OutboxProjection{}, store.ValidationErrorf("expected turn version must be at least 1")
+	}
+	if err := store.ValidateCanonicalDigest("session turn finalization digest", request.FinalizationDigest); err != nil {
+		return store.CommitSessionTurnFinalizationRequest{}, store.OutboxProjection{}, err
+	}
+	if request.TerminalKind != store.SessionTurnAssistantResult && request.TerminalKind != store.SessionTurnOutcomeMarker {
+		return store.CommitSessionTurnFinalizationRequest{}, store.OutboxProjection{}, store.ValidationErrorf("unsupported session turn terminal kind %q", request.TerminalKind)
+	}
+	if request.TerminalKind == store.SessionTurnOutcomeMarker && strings.TrimSpace(request.TerminalContent) == "" {
+		return store.CommitSessionTurnFinalizationRequest{}, store.OutboxProjection{}, store.ValidationErrorf("outcome-marker finalization requires explicit marker content")
+	}
+	if request.SkipTranscriptAppend && request.SkipUserPromptAppend {
+		return store.CommitSessionTurnFinalizationRequest{}, store.OutboxProjection{}, store.ValidationErrorf("session turn cannot combine full transcript suppression with user-prompt-only suppression")
+	}
+	if err := store.ValidateControlText("session turn terminal content", request.TerminalContent); err != nil {
+		return store.CommitSessionTurnFinalizationRequest{}, store.OutboxProjection{}, err
+	}
+	request.PublicationID = strings.TrimSpace(request.PublicationID)
+	if request.PublicationID != "" {
+		if err := store.ValidateControlIdentifier("publication ID", request.PublicationID); err != nil {
+			return store.CommitSessionTurnFinalizationRequest{}, store.OutboxProjection{}, err
+		}
+		if request.PublicationReceipt == nil || request.PublicationReceipt.PublicationID != request.PublicationID {
+			return store.CommitSessionTurnFinalizationRequest{}, store.OutboxProjection{}, store.ValidationErrorf("publication finalization requires the matching receipt snapshot")
+		}
+	} else if request.PublicationReceipt != nil {
+		return store.CommitSessionTurnFinalizationRequest{}, store.OutboxProjection{}, store.ValidationErrorf("publication receipt requires a publication ID")
+	}
+	request.FinalizedAt = normalizeControlTime(request.FinalizedAt)
+	projection, _, err := normalizeOutboxProjectionForCreate(request.Projection, request.Fence, request.FinalizedAt)
+	if err != nil {
+		return store.CommitSessionTurnFinalizationRequest{}, store.OutboxProjection{}, err
+	}
+	turnID, err := request.Key.CanonicalID()
+	if err != nil {
+		return store.CommitSessionTurnFinalizationRequest{}, store.OutboxProjection{}, err
+	}
+	if projection.AggregateKind != sessionTurnAggregateKind || projection.AggregateID != turnID {
+		return store.CommitSessionTurnFinalizationRequest{}, store.OutboxProjection{}, store.ValidationErrorf("finalization projection must target SessionTurn aggregate %q", turnID)
+	}
+	return request, projection, nil
+}
+
+func appendSessionTurnTranscript(
+	ctx context.Context,
+	tx *sql.Tx,
+	namespace, sessionName, userPrompt, terminalRole, terminalContent string,
+	createdAt time.Time,
+	skipUserPromptAppend bool,
+) (int, error) {
+	appendMessage := func(role, content string) error {
+		messageID, err := newSessionMessageID()
+		if err != nil {
+			return err
+		}
+		sortOrder, err := nextSessionMessageOrderTx(ctx, tx, namespace, sessionName)
+		if err != nil {
+			return err
+		}
+		_, err = tx.ExecContext(ctx,
+			`INSERT INTO session_messages(
+				namespace, session_name, message_id, sort_order, role, content, metadata_json, created_at
+			) VALUES (?, ?, ?, ?, ?, ?, '{}', ?)`,
+			namespace, sessionName, messageID, sortOrder, role, content, createdAt,
+		)
+		return err
+	}
+	messageCount := 0
+	if !skipUserPromptAppend {
+		if err := appendMessage("user", userPrompt); err != nil {
+			return 0, err
+		}
+		messageCount++
+	}
+	if err := appendMessage(terminalRole, terminalContent); err != nil {
+		return 0, err
+	}
+	return messageCount + 1, nil
+}
+
+func normalizeActivateSessionTurnProjectionRequest(request store.ActivateSessionTurnProjectionRequest) (store.ActivateSessionTurnProjectionRequest, error) {
+	request.TurnID = strings.TrimSpace(request.TurnID)
+	request.ProjectionID = strings.TrimSpace(request.ProjectionID)
+	request.ExpectedAggregateKind = strings.TrimSpace(request.ExpectedAggregateKind)
+	request.ExpectedProjectionKind = strings.TrimSpace(request.ExpectedProjectionKind)
+	for field, value := range map[string]string{
+		"session turn ID":        request.TurnID,
+		"outbox projection ID":   request.ProjectionID,
+		"outbox aggregate kind":  request.ExpectedAggregateKind,
+		"outbox projection kind": request.ExpectedProjectionKind,
+	} {
+		if err := store.ValidateControlIdentifier(field, value); err != nil {
+			return store.ActivateSessionTurnProjectionRequest{}, err
+		}
+	}
+	if err := store.ValidateCanonicalDigest("outbox payload digest", request.ExpectedPayloadDigest); err != nil {
+		return store.ActivateSessionTurnProjectionRequest{}, err
+	}
+	fence, err := normalizeEpochFence(request.Fence)
+	if err != nil {
+		return store.ActivateSessionTurnProjectionRequest{}, err
+	}
+	request.Fence = fence
+	if err := store.ValidateCanonicalDigest("session turn finalization digest", request.FinalizationDigest); err != nil {
+		return store.ActivateSessionTurnProjectionRequest{}, err
+	}
+	request.UpdatedAt = normalizeControlTime(request.UpdatedAt)
+	if request.AvailableAt.IsZero() {
+		request.AvailableAt = request.UpdatedAt
+	} else {
+		request.AvailableAt = request.AvailableAt.UTC()
+	}
+	return request, nil
+}
+
+func sessionTurnPersistenceFinalizationMatches(turn store.SessionTurn, request store.CommitSessionTurnFinalizationRequest) bool {
+	return turn.FinalizationDigest == request.FinalizationDigest && turn.TerminalKind == request.TerminalKind &&
+		turn.TerminalContent == request.TerminalContent && turn.PublicationID == request.PublicationID &&
+		reflect.DeepEqual(turn.PublicationReceipt, request.PublicationReceipt) && turn.ProjectionID == request.Projection.ID &&
+		turn.ProjectionKind == request.Projection.ProjectionKind && turn.ProjectionDigest == request.Projection.PayloadDigest &&
+		turn.ProjectionAvailableAt.Equal(projectionAvailableAt(request.Projection, request.FinalizedAt))
+}
+
+func projectionAvailableAt(projection store.OutboxProjection, fallback time.Time) time.Time {
+	if projection.AvailableAt.IsZero() {
+		return fallback.UTC()
+	}
+	return projection.AvailableAt.UTC()
+}
+
+func requireTranscriptSession(ctx context.Context, q controlQueryRower, namespace, sessionName string) error {
+	var count int
+	if err := q.QueryRowContext(ctx, `SELECT COUNT(*) FROM sessions WHERE namespace = ? AND name = ?`, namespace, sessionName).Scan(&count); err != nil {
+		return err
+	}
+	if count != 1 {
+		return store.ErrNotFound
+	}
+	return nil
+}
+
+func requireSessionUIDBinding(ctx context.Context, q controlQueryRower, sessionUID, namespace, sessionName string) error {
+	var existingNamespace, existingSessionName string
+	err := q.QueryRowContext(ctx, `SELECT namespace, session_name FROM session_turns WHERE session_uid = ? LIMIT 1`, sessionUID).Scan(&existingNamespace, &existingSessionName)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	if existingNamespace != namespace || existingSessionName != sessionName {
+		return controlConflict("session UID %q is already bound to %s/%s", sessionUID, existingNamespace, existingSessionName)
+	}
+	return nil
+}
+
+func requireSessionTurnBinding(ctx context.Context, q controlQueryRower, turnID, namespace, sessionName string) error {
+	var existingNamespace, existingSessionName string
+	err := q.QueryRowContext(ctx, `SELECT namespace, session_name FROM session_turns WHERE id = ?`, turnID).Scan(&existingNamespace, &existingSessionName)
+	if errors.Is(err, sql.ErrNoRows) {
+		return store.ErrNotFound
+	}
+	if err != nil {
+		return err
+	}
+	if existingNamespace != namespace || existingSessionName != sessionName {
+		return controlConflict("session turn %q is bound to %s/%s, not %s/%s", turnID, existingNamespace, existingSessionName, namespace, sessionName)
+	}
+	return nil
+}
+
+func clonePublicationReceipt(receipt *store.PublicationReceipt) *store.PublicationReceipt {
+	if receipt == nil {
+		return nil
+	}
+	copyValue := *receipt
+	return &copyValue
+}
diff --git a/internal/store/sqlite/session_turn_persistence_test.go b/internal/store/sqlite/session_turn_persistence_test.go
new file mode 100644
index 000000000..3b541d22d
--- /dev/null
+++ b/internal/store/sqlite/session_turn_persistence_test.go
@@ -0,0 +1,101 @@
+package sqlite
+
+import (
+	"database/sql"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func TestSessionTurnSchemaMigrationRemovesControlRowForeignKey(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "legacy-turns.db")
+	db, err := sql.Open("sqlite", path)
+	if err != nil {
+		t.Fatalf("open legacy database: %v", err)
+	}
+	statements := []string{
+		`PRAGMA foreign_keys=ON`,
+		`CREATE TABLE sessions (
+			namespace TEXT NOT NULL, name TEXT NOT NULL, session_type TEXT NOT NULL DEFAULT 'task',
+			active_task TEXT NOT NULL DEFAULT '', message_count INTEGER NOT NULL DEFAULT 0,
+			input_tokens INTEGER NOT NULL DEFAULT 0, output_tokens INTEGER NOT NULL DEFAULT 0,
+			cancelled BOOLEAN NOT NULL DEFAULT FALSE, created_at TIMESTAMP, updated_at TIMESTAMP,
+			PRIMARY KEY(namespace, name)
+		)`,
+		`CREATE TABLE session_controls (
+			namespace TEXT NOT NULL, session_name TEXT NOT NULL, session_uid TEXT NOT NULL UNIQUE,
+			availability TEXT NOT NULL, updated_at TIMESTAMP NOT NULL,
+			PRIMARY KEY(namespace, session_name),
+			FOREIGN KEY(namespace, session_name) REFERENCES sessions(namespace, name)
+		)`,
+		`CREATE TABLE session_turns (
+			id TEXT PRIMARY KEY, session_uid TEXT NOT NULL, lease_generation INTEGER NOT NULL,
+			task_uid TEXT NOT NULL, attempt INTEGER NOT NULL, prompt_id TEXT NOT NULL,
+			prompt_attempt_id TEXT NOT NULL, request_digest TEXT NOT NULL, user_prompt TEXT NOT NULL,
+			state TEXT NOT NULL, terminal_kind TEXT NOT NULL DEFAULT '', terminal_content TEXT NOT NULL DEFAULT '',
+			finalization_digest TEXT NOT NULL DEFAULT '', publication_id TEXT NOT NULL DEFAULT '',
+			publication_receipt BLOB, controller_epoch_name TEXT NOT NULL, controller_epoch INTEGER NOT NULL,
+			version INTEGER NOT NULL, created_at TIMESTAMP NOT NULL, finalized_at TIMESTAMP, updated_at TIMESTAMP NOT NULL,
+			UNIQUE(session_uid, lease_generation, task_uid, attempt, prompt_id),
+			FOREIGN KEY(session_uid) REFERENCES session_controls(session_uid)
+		)`,
+		`INSERT INTO sessions(namespace, name, created_at, updated_at) VALUES ('tenant-a', 'session-a', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)`,
+		`INSERT INTO session_controls(namespace, session_name, session_uid, availability, updated_at)
+		 VALUES ('tenant-a', 'session-a', 'session-uid-a', 'Available', CURRENT_TIMESTAMP)`,
+		`INSERT INTO session_turns(
+			id, session_uid, lease_generation, task_uid, attempt, prompt_id, prompt_attempt_id,
+			request_digest, user_prompt, state, controller_epoch_name, controller_epoch, version, created_at, updated_at
+		) VALUES (
+			'turn-a', 'session-uid-a', 1, 'task-a', 1, 'prompt-a', 'attempt-a',
+			'sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', 'hello', 'Open',
+			'orka-controller', 1, 1, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP
+		)`,
+	}
+	for _, statement := range statements {
+		if _, err := db.Exec(statement); err != nil {
+			_ = db.Close()
+			t.Fatalf("legacy setup failed for %q: %v", statement, err)
+		}
+	}
+	if err := db.Close(); err != nil {
+		t.Fatalf("close legacy database: %v", err)
+	}
+
+	migrated, err := NewDB(path)
+	if err != nil {
+		t.Fatalf("NewDB migration: %v", err)
+	}
+	t.Cleanup(func() { _ = migrated.Close() })
+	var namespace, sessionName string
+	if err := migrated.QueryRow(`SELECT namespace, session_name FROM session_turns WHERE id = 'turn-a'`).Scan(&namespace, &sessionName); err != nil {
+		t.Fatalf("read migrated turn binding: %v", err)
+	}
+	if namespace != "tenant-a" || sessionName != "session-a" {
+		t.Fatalf("migrated binding = %s/%s", namespace, sessionName)
+	}
+	rows, err := migrated.Query(`PRAGMA foreign_key_list(session_turns)`)
+	if err != nil {
+		t.Fatalf("foreign_key_list: %v", err)
+	}
+	for rows.Next() {
+		var id, seq int
+		var table, from, to, onUpdate, onDelete, match string
+		if err := rows.Scan(&id, &seq, &table, &from, &to, &onUpdate, &onDelete, &match); err != nil {
+			t.Fatalf("scan foreign key: %v", err)
+		}
+		if table == "session_controls" {
+			t.Fatal("session_turns still depends on SQLite session_controls")
+		}
+	}
+	if err := rows.Err(); err != nil {
+		t.Fatalf("foreign_key_list rows: %v", err)
+	}
+	if err := rows.Close(); err != nil {
+		t.Fatalf("close foreign_key_list rows: %v", err)
+	}
+
+	var createdAt time.Time
+	if err := migrated.QueryRow(`SELECT created_at FROM session_turns WHERE id = 'turn-a'`).Scan(&createdAt); err != nil {
+		t.Fatalf("legacy turn timestamp was not preserved: %v", err)
+	}
+}
diff --git a/internal/store/sqlite/sqlite.go b/internal/store/sqlite/sqlite.go
index 10fe75770..45f388e58 100644
--- a/internal/store/sqlite/sqlite.go
+++ b/internal/store/sqlite/sqlite.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"database/sql"
 	"fmt"
+	"io"
 	"os"
 	"sync"
 	"time"
@@ -82,8 +83,10 @@ func migrate(db *sql.DB) error {
 			session_type  TEXT NOT NULL DEFAULT 'task',
 			owner_type    TEXT NOT NULL DEFAULT '',
 			owner_ref     TEXT NOT NULL DEFAULT '',
-			active_task     TEXT NOT NULL DEFAULT '',
-			active_task_uid TEXT NOT NULL DEFAULT '',
+			active_task            TEXT NOT NULL DEFAULT '',
+			active_task_uid        TEXT NOT NULL DEFAULT '',
+			active_task_expires_at TIMESTAMP,
+			control_session_uid    TEXT NOT NULL DEFAULT '',
 			message_count   INTEGER NOT NULL DEFAULT 0,
 			input_tokens  INTEGER NOT NULL DEFAULT 0,
 			output_tokens INTEGER NOT NULL DEFAULT 0,
@@ -92,6 +95,24 @@ func migrate(db *sql.DB) error {
 			updated_at    TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
 			PRIMARY KEY (namespace, name)
 		)`,
+		`CREATE TABLE IF NOT EXISTS session_cleanup_intents (
+			namespace        TEXT NOT NULL,
+			session_name     TEXT NOT NULL,
+			operation_id     TEXT NOT NULL,
+			operation_digest TEXT NOT NULL,
+			plan             BLOB NOT NULL,
+			created_at       TIMESTAMP NOT NULL,
+			PRIMARY KEY(namespace, session_name)
+		)`,
+		`CREATE TABLE IF NOT EXISTS session_cleanup_completions (
+			namespace        TEXT NOT NULL,
+			session_name     TEXT NOT NULL,
+			session_uid      TEXT NOT NULL DEFAULT '',
+			operation_id     TEXT NOT NULL,
+			operation_digest TEXT NOT NULL,
+			completed_at     TIMESTAMP NOT NULL,
+			PRIMARY KEY(namespace, session_name)
+		)`,
 		`CREATE TABLE IF NOT EXISTS session_messages (
 			id           INTEGER PRIMARY KEY AUTOINCREMENT,
 			namespace    TEXT NOT NULL,
@@ -342,6 +363,10 @@ func migrate(db *sql.DB) error {
 			tests_json        TEXT NOT NULL DEFAULT '[]',
 			tags_json         TEXT NOT NULL DEFAULT '[]',
 			trust_boundaries_json TEXT NOT NULL DEFAULT '[]',
+			changed_files_json TEXT NOT NULL DEFAULT '[]',
+			changed_line_ranges_json TEXT NOT NULL DEFAULT '[]',
+			review_context_json TEXT NOT NULL DEFAULT '',
+			review_context_hash TEXT NOT NULL DEFAULT '',
 			last_scan_run_id  TEXT NOT NULL DEFAULT '',
 			last_reviewed_at  TIMESTAMP,
 			created_at        TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
@@ -373,6 +398,7 @@ func migrate(db *sql.DB) error {
 			status            TEXT NOT NULL,
 			pr_number         INTEGER,
 			pr_url            TEXT NOT NULL DEFAULT '',
+			publication_evidence_json TEXT NOT NULL DEFAULT '',
 			created_at        TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
 			updated_at        TIMESTAMP DEFAULT CURRENT_TIMESTAMP
 		)`,
@@ -834,9 +860,20 @@ func migrate(db *sql.DB) error {
 		{Name: "owner_type", Definition: "owner_type TEXT NOT NULL DEFAULT ''"},
 		{Name: "owner_ref", Definition: "owner_ref TEXT NOT NULL DEFAULT ''"},
 		{Name: "active_task_uid", Definition: "active_task_uid TEXT NOT NULL DEFAULT ''"},
+		{Name: "active_task_expires_at", Definition: "active_task_expires_at TIMESTAMP"},
+		{Name: "control_session_uid", Definition: "control_session_uid TEXT NOT NULL DEFAULT ''"},
+	}); err != nil {
+		return err
+	}
+	if err := ensureSQLiteColumns(db, "session_cleanup_completions", []sqliteColumnMigration{
+		{Name: "session_uid", Definition: "session_uid TEXT NOT NULL DEFAULT ''"},
 	}); err != nil {
 		return err
 	}
+	if _, err := db.Exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_session_cleanup_completions_uid
+		ON session_cleanup_completions(session_uid) WHERE session_uid <> ''`); err != nil {
+		return fmt.Errorf("migration failed: %w", err)
+	}
 	if _, err := db.Exec(`UPDATE sessions SET active_task_uid = COALESCE((
 		SELECT event.task_uid FROM gateway_events event
 		WHERE event.namespace = sessions.namespace AND event.session_name = sessions.name
@@ -1013,6 +1050,8 @@ func migrate(db *sql.DB) error {
 	if err := ensureSQLiteColumns(db, "security_review_slices", []sqliteColumnMigration{
 		{Name: "changed_files_json", Definition: "changed_files_json TEXT NOT NULL DEFAULT '[]'"},
 		{Name: "changed_line_ranges_json", Definition: "changed_line_ranges_json TEXT NOT NULL DEFAULT '[]'"},
+		{Name: "review_context_json", Definition: "review_context_json TEXT NOT NULL DEFAULT ''"},
+		{Name: "review_context_hash", Definition: "review_context_hash TEXT NOT NULL DEFAULT ''"},
 	}); err != nil {
 		return err
 	}
@@ -1021,6 +1060,11 @@ func migrate(db *sql.DB) error {
 	}); err != nil {
 		return err
 	}
+	if err := ensureSQLiteColumns(db, "security_patch_proposals", []sqliteColumnMigration{
+		{Name: "publication_evidence_json", Definition: "publication_evidence_json TEXT NOT NULL DEFAULT ''"},
+	}); err != nil {
+		return err
+	}
 	if err := ensureSecurityReviewSlicesScopedPrimaryKey(db); err != nil {
 		return err
 	}
@@ -1041,6 +1085,12 @@ func migrate(db *sql.DB) error {
 		WHERE source_proposal_id <> ''`); err != nil {
 		return fmt.Errorf("migration failed: %w", err)
 	}
+	if err := migrateControlStore(db); err != nil {
+		return err
+	}
+	if err := migrateAgentExecution(db); err != nil {
+		return err
+	}
 
 	return nil
 }
@@ -1153,6 +1203,8 @@ func ensureSecurityReviewSlicesScopedPrimaryKey(db *sql.DB) error {
 		trust_boundaries_json TEXT NOT NULL DEFAULT '[]',
 		changed_files_json TEXT NOT NULL DEFAULT '[]',
 		changed_line_ranges_json TEXT NOT NULL DEFAULT '[]',
+		review_context_json TEXT NOT NULL DEFAULT '',
+		review_context_hash TEXT NOT NULL DEFAULT '',
 		last_scan_run_id  TEXT NOT NULL DEFAULT '',
 		last_reviewed_at  TIMESTAMP,
 		created_at        TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
@@ -1164,10 +1216,12 @@ func ensureSecurityReviewSlicesScopedPrimaryKey(db *sql.DB) error {
 	if _, err := tx.Exec(`INSERT INTO security_review_slices_migration
 		(id, namespace, repository_scan, source, title, summary, kind, confidence, status,
 		 entrypoints_json, owned_files_json, context_files_json, tests_json, tags_json,
-		 trust_boundaries_json, changed_files_json, changed_line_ranges_json, last_scan_run_id, last_reviewed_at, created_at, updated_at)
+		 trust_boundaries_json, changed_files_json, changed_line_ranges_json, review_context_json,
+		 review_context_hash, last_scan_run_id, last_reviewed_at, created_at, updated_at)
 		SELECT id, namespace, repository_scan, source, title, summary, kind, confidence, status,
 		 entrypoints_json, owned_files_json, context_files_json, tests_json, tags_json,
-		 trust_boundaries_json, changed_files_json, changed_line_ranges_json, last_scan_run_id, last_reviewed_at, created_at, updated_at
+		 trust_boundaries_json, changed_files_json, changed_line_ranges_json, review_context_json,
+		 review_context_hash, last_scan_run_id, last_reviewed_at, created_at, updated_at
 		FROM security_review_slices`); err != nil {
 		return fmt.Errorf("migration failed: %w", err)
 	}
@@ -1227,8 +1281,13 @@ func sqlitePrimaryKeyColumns(db *sql.DB, table string) ([]string, error) {
 type Store struct {
 	db               *sql.DB
 	dbPath           string
+	processLock      io.Closer
 	executionEventMu sync.Mutex
 
+	// snapshotCipher encrypts immutable agent execution snapshot bodies at
+	// rest. Snapshot persistence fails closed while it is nil.
+	snapshotCipher *AgentExecutionSnapshotCipher
+
 	// applyMemoryProposalAfterAcceptedRead is a test hook used to coordinate
 	// multi-connection proposal-apply races after an accepted proposal is read.
 	applyMemoryProposalAfterAcceptedRead func()
@@ -1244,8 +1303,25 @@ func NewStore(db *sql.DB, dbPath string) *Store {
 	return &Store{db: db, dbPath: dbPath}
 }
 
+// OpenLockedStore acquires the process-lifetime filesystem lock adjacent to
+// path before SQLite is opened or migrated. Production controller wiring must
+// use this constructor so overlapping Pods or releases cannot migrate or write
+// the same database even if Kubernetes ownership fencing is misconfigured.
+func OpenLockedStore(path string) (*Store, error) {
+	lock, err := lockDatabaseFile(path)
+	if err != nil {
+		return nil, err
+	}
+	db, err := NewDB(path)
+	if err != nil {
+		_ = lock.Close()
+		return nil, err
+	}
+	return &Store{db: db, dbPath: path, processLock: lock}, nil
+}
+
 // Start runs background maintenance and blocks until ctx is cancelled,
-// then optimizes and closes the database.
+// then closes the database without issuing any final writes.
 // It satisfies the controller-runtime manager.Runnable interface.
 func (s *Store) Start(ctx context.Context) error {
 	logger := log.FromContext(ctx).WithName("sqlite-store")
@@ -1262,14 +1338,32 @@ func (s *Store) Start(ctx context.Context) error {
 	for {
 		select {
 		case <-ctx.Done():
-			s.db.Exec("PRAGMA optimize") //nolint:errcheck
-			return s.db.Close()
+			return s.close()
 		case <-ticker.C:
 			s.updateDBSizeMetric()
 		}
 	}
 }
 
+// NeedLeaderElection keeps SQLite-backed background mutation behind the
+// controller-runtime leader gate. The filesystem lock remains held for the
+// whole process lifetime, including standby/startup, and is the final defense
+// against overlapping writers.
+func (s *Store) NeedLeaderElection() bool { return true }
+
+func (s *Store) close() error {
+	dbErr := s.db.Close()
+	var lockErr error
+	if s.processLock != nil {
+		lockErr = s.processLock.Close()
+		s.processLock = nil
+	}
+	if dbErr != nil {
+		return dbErr
+	}
+	return lockErr
+}
+
 // updateDBSizeMetric reads the database file size and updates the gauge.
 func (s *Store) updateDBSizeMetric() {
 	if s.dbPath == "" || s.dbPath == ":memory:" {
diff --git a/internal/store/store.go b/internal/store/store.go
index 526d2d8ed..8f27749ac 100644
--- a/internal/store/store.go
+++ b/internal/store/store.go
@@ -81,6 +81,19 @@ type SessionStore interface {
 	UpdateTokenCounts(ctx context.Context, namespace, name string, inputTokens, outputTokens int) error
 }
 
+// ExpiringSessionLockStore supports crash-recoverable transient locks. Durable
+// Task locks continue to use SessionStore.AcquireLock without an expiry.
+type ExpiringSessionLockStore interface {
+	AcquireLockUntil(ctx context.Context, namespace, name, ownerName, ownerUID string, expiresAt time.Time) error
+}
+
+// FencedSessionWriteStore binds transcript and token writes to the exact active
+// transient lock owner so an expired request cannot write after takeover.
+type FencedSessionWriteStore interface {
+	AppendMessagesWithLock(ctx context.Context, namespace, name, ownerName, ownerUID string, messages []SessionMessage) error
+	UpdateTokenCountsWithLock(ctx context.Context, namespace, name, ownerName, ownerUID string, inputTokens, outputTokens int) error
+}
+
 // GatewayEventStore handles durable normalized ingress records and atomic Session projection.
 type GatewayEventStore interface {
 	AdmitGatewayEvent(ctx context.Context, admission GatewayEventAdmission) (*GatewayEvent, bool, error)
@@ -173,6 +186,7 @@ type SecurityStore interface {
 
 	CreatePatchProposal(ctx context.Context, proposal *PatchProposal) error
 	UpdatePatchProposal(ctx context.Context, proposal *PatchProposal) error
+	BindPatchProposalPublicationEvidence(ctx context.Context, proposal *PatchProposal) error
 	ListPatchProposals(ctx context.Context, namespace, findingID string) ([]PatchProposal, error)
 
 	CreateDroppedFinding(ctx context.Context, dropped *DroppedFinding) error
diff --git a/internal/taskterminal/projection.go b/internal/taskterminal/projection.go
new file mode 100644
index 000000000..aac6a0265
--- /dev/null
+++ b/internal/taskterminal/projection.go
@@ -0,0 +1,317 @@
+package taskterminal
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/json"
+	"fmt"
+	"io"
+	"reflect"
+	"strings"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+)
+
+const (
+	// ProjectionKind is the durable outbox projection for terminal Task status.
+	ProjectionKind = "TaskTerminalStatus"
+
+	// NoWorkspaceRevision is the protocol-only revision harness v2 records for
+	// Tasks without a repository workspace. It is not a Git object ID: the
+	// outbox projector strips it from delivery evidence before the
+	// schema-validated Task status, while immutable projection payloads keep it.
+	NoWorkspaceRevision = "empty"
+
+	restoreIdentityChangedReason = corev1alpha1.TaskExecutionReason("RestoreIdentityChanged")
+)
+
+// Projection is the canonical payload of a terminal Task outbox projection.
+type Projection struct {
+	Namespace      string                             `json:"namespace"`
+	Task           string                             `json:"task"`
+	TaskUID        string                             `json:"taskUID"`
+	Attempt        int32                              `json:"attempt"`
+	Phase          corev1alpha1.TaskPhase             `json:"phase"`
+	Message        string                             `json:"message,omitempty"`
+	BindingDigest  string                             `json:"bindingDigest,omitempty"`
+	HarnessRuntime *corev1alpha1.HarnessRuntimeStatus `json:"harnessRuntime,omitempty"`
+	ResultRef      *corev1alpha1.ResultReference      `json:"resultRef,omitempty"`
+	Execution      corev1alpha1.TaskExecutionStatus   `json:"execution"`
+	Delivery       *corev1alpha1.TaskDeliveryStatus   `json:"delivery,omitempty"`
+}
+
+// ValidateRestoredProjection decodes and proves that one immutable source
+// terminal projection is compatible with the restored Task incarnation and
+// its final source PromptAttempt. Restore-only status text, controller epoch,
+// and transition timestamps are deliberately not compared with the restored
+// Task because the restored incarnation records a new settlement event.
+func ValidateRestoredProjection(
+	payload []byte,
+	task *corev1alpha1.Task,
+	sourceTaskUID string,
+	attempt *store.PromptAttempt,
+) (*Projection, error) {
+	projection, err := decodeProjection(payload)
+	if err != nil {
+		return nil, err
+	}
+	return validateProjection(projection, task, sourceTaskUID, attempt)
+}
+
+// ValidateFinalizedSessionProjection validates a Session-backed terminal
+// projection and its immutable SessionTurn. It accepts the one legacy payload
+// shape produced before Session projections copied the frozen execution
+// identity: every execution field other than the terminal classification was
+// omitted. That compatibility path is authorized only by an exact finalized
+// SessionTurn which pins this payload digest and the same PromptAttempt.
+func ValidateFinalizedSessionProjection(
+	payload []byte,
+	task *corev1alpha1.Task,
+	sourceTaskUID string,
+	attempt *store.PromptAttempt,
+	turn *store.SessionTurn,
+) (*Projection, error) {
+	projection, err := decodeProjection(payload)
+	if err != nil {
+		return nil, err
+	}
+	if err := validateFinalizedSessionTurn(payload, task, sourceTaskUID, attempt, turn); err != nil {
+		return nil, err
+	}
+	if legacySessionExecutionIdentityOmitted(projection.Execution) {
+		execution := *task.Status.Execution.DeepCopy()
+		execution.State = projection.Execution.State
+		execution.Outcome = projection.Execution.Outcome
+		execution.Reason = projection.Execution.Reason
+		execution.Attempt = projection.Execution.Attempt
+		execution.PromptID = projection.Execution.PromptID
+		execution.Message = projection.Execution.Message
+		normalized := *projection
+		normalized.Execution = execution
+		projection = &normalized
+	}
+	return validateProjection(projection, task, sourceTaskUID, attempt)
+}
+
+//nolint:gocyclo // Keep the complete fail-closed terminal-payload contract in one auditable boundary.
+func validateProjection(
+	projection *Projection,
+	task *corev1alpha1.Task,
+	sourceTaskUID string,
+	attempt *store.PromptAttempt,
+) (*Projection, error) {
+	if task == nil || task.Status.Execution == nil || attempt == nil {
+		return nil, conflict("restored terminal projection evidence is incomplete")
+	}
+	sourceTaskUID = strings.TrimSpace(sourceTaskUID)
+	binding := task.Status.AgentExecutionBinding
+	if sourceTaskUID == "" {
+		return nil, conflict("restored terminal projection source binding is invalid")
+	}
+	if string(task.UID) != sourceTaskUID {
+		if binding == nil || binding.ContractVersion != corev1alpha1.AgentRuntimeContractHarnessV2 ||
+			string(binding.Task.UID) != sourceTaskUID {
+			return nil, conflict("restored terminal projection source binding is invalid")
+		}
+	}
+	if projection.HarnessRuntime != nil || projection.ResultRef != nil {
+		return nil, conflict("restored harness v2 terminal projection contains harness v1 payload")
+	}
+	if projection.Namespace != task.Namespace || projection.Task != task.Name || projection.TaskUID != sourceTaskUID ||
+		projection.Attempt < 1 || projection.Attempt != task.Status.Execution.Attempt ||
+		int64(projection.Attempt) != attempt.Key.Attempt || attempt.Key.Namespace != task.Namespace ||
+		attempt.Key.TaskUID != sourceTaskUID {
+		return nil, conflict("restored terminal projection Task identity does not match its source attempt")
+	}
+	if projection.BindingDigest != "" && (binding == nil || projection.BindingDigest != binding.BindingDigest) {
+		return nil, conflict("restored terminal projection binding digest does not match its Task")
+	}
+	if projection.Execution.Attempt != projection.Attempt ||
+		projection.Execution.PromptID == "" || projection.Execution.PromptID != task.Status.Execution.PromptID ||
+		projection.Execution.PromptID != attempt.Key.PromptID {
+		return nil, conflict("restored terminal projection execution identity does not match its source attempt")
+	}
+	if attempt.RequestDigest != "" && projection.Execution.RequestDigest != attempt.RequestDigest {
+		return nil, conflict("restored terminal projection request digest does not match its source attempt")
+	}
+	if task.Status.Execution.RequestDigest != "" && projection.Execution.RequestDigest != task.Status.Execution.RequestDigest {
+		return nil, conflict("restored terminal projection request digest does not match its Task")
+	}
+	wantState, wantOutcome, ok := terminalExecution(attempt.ExecutionState)
+	if !ok || projection.Execution.State != wantState || projection.Execution.Outcome != wantOutcome {
+		return nil, conflict("restored terminal projection execution outcome does not match its source attempt")
+	}
+	if projection.Delivery == nil || !store.IsTerminalPromptDeliveryState(attempt.DeliveryState) ||
+		store.PromptDeliveryState(projection.Delivery.State) != attempt.DeliveryState ||
+		string(projection.Delivery.Outcome) != string(attempt.DeliveryState) {
+		return nil, conflict("restored terminal projection delivery outcome does not match its source attempt")
+	}
+	if projection.Phase != terminalPhase(wantState, attempt.DeliveryState) {
+		return nil, conflict("restored terminal projection phase does not match its terminal outcome")
+	}
+	if task.Status.Delivery == nil || !equalDeliveryEvidence(task, projection.Delivery, task.Status.Delivery) {
+		return nil, conflict("restored terminal projection delivery evidence does not match its Task")
+	}
+	if err := validateRuntimeIdentity(projection.Execution, *task.Status.Execution, *attempt); err != nil {
+		return nil, err
+	}
+	projectionRestoreReason := projection.Execution.Reason == restoreIdentityChangedReason
+	attemptRestoreReason := attempt.TerminalReason == string(restoreIdentityChangedReason)
+	if projectionRestoreReason != attemptRestoreReason {
+		return nil, conflict("restored terminal projection restore marker does not match its source attempt")
+	}
+	if projectionRestoreReason && (strings.TrimSpace(attempt.OutcomeMarker) == "" ||
+		projection.Execution.Message != attempt.OutcomeMarker || projection.Message != attempt.OutcomeMarker) {
+		return nil, conflict("restored terminal projection restore message does not match its source attempt")
+	}
+	return projection, nil
+}
+
+func validateFinalizedSessionTurn(
+	payload []byte,
+	task *corev1alpha1.Task,
+	sourceTaskUID string,
+	attempt *store.PromptAttempt,
+	turn *store.SessionTurn,
+) error {
+	if task == nil || task.Status.Execution == nil || attempt == nil || turn == nil {
+		return conflict("finalized Session terminal projection evidence is incomplete")
+	}
+	if task.Spec.SessionRef == nil || turn.State != store.SessionTurnFinalized || turn.FinalizedAt == nil ||
+		turn.ProjectionID == "" || turn.ProjectionKind != ProjectionKind ||
+		turn.ProjectionDigest != fmt.Sprintf("sha256:%x", sha256.Sum256(payload)) {
+		return conflict("finalized Session terminal projection is not pinned by its SessionTurn")
+	}
+	canonicalID, err := turn.Key.CanonicalID()
+	if err != nil || canonicalID != turn.ID {
+		return conflict("finalized SessionTurn identity is invalid")
+	}
+	sourceTaskUID = strings.TrimSpace(sourceTaskUID)
+	// turn.Key.LeaseGeneration is the per-prompt Session mutation-lease
+	// generation and is fenced against the PromptAttempt's recorded lease.
+	// Task.Status.Execution.RuntimeSessionGeneration is the RuntimeSession
+	// incarnation generation — a different counter that only coincides with
+	// the lease generation for a session's first prompt — so the turn binds to
+	// the Task through the session UID, never through that generation.
+	if turn.Key.TaskUID != sourceTaskUID || turn.Key.Attempt != attempt.Key.Attempt ||
+		turn.Key.PromptID != attempt.Key.PromptID || turn.PromptAttemptID != attempt.ID ||
+		turn.Key.SessionUID != attempt.SessionUID || turn.Key.LeaseGeneration != attempt.SessionLeaseGeneration ||
+		turn.Key.SessionUID != task.Status.Execution.RuntimeSessionUID {
+		return conflict("finalized SessionTurn does not match its Task and PromptAttempt")
+	}
+	wantTerminalKind := store.SessionTurnOutcomeMarker
+	if attempt.ExecutionState == store.PromptExecutionSucceeded {
+		wantTerminalKind = store.SessionTurnAssistantResult
+	}
+	if turn.TerminalKind != wantTerminalKind {
+		return conflict("finalized SessionTurn terminal kind does not match its PromptAttempt")
+	}
+	return nil
+}
+
+func legacySessionExecutionIdentityOmitted(execution corev1alpha1.TaskExecutionStatus) bool {
+	execution.State = ""
+	execution.Outcome = ""
+	execution.Reason = ""
+	execution.Attempt = 0
+	execution.PromptID = ""
+	execution.Message = ""
+	return reflect.DeepEqual(execution, corev1alpha1.TaskExecutionStatus{})
+}
+
+func decodeProjection(payload []byte) (*Projection, error) {
+	decoder := json.NewDecoder(bytes.NewReader(payload))
+	decoder.DisallowUnknownFields()
+	projection := &Projection{}
+	if err := decoder.Decode(projection); err != nil {
+		return nil, conflict("decode restored terminal projection: %v", err)
+	}
+	if err := decoder.Decode(&struct{}{}); err != io.EOF {
+		return nil, conflict("restored terminal projection contains trailing data")
+	}
+	return projection, nil
+}
+
+func terminalExecution(state store.PromptExecutionState) (corev1alpha1.TaskExecutionState, corev1alpha1.TaskExecutionOutcome, bool) {
+	switch state {
+	case store.PromptExecutionSucceeded:
+		return corev1alpha1.TaskExecutionStateSucceeded, corev1alpha1.TaskExecutionOutcomeSucceeded, true
+	case store.PromptExecutionFailed:
+		return corev1alpha1.TaskExecutionStateFailed, corev1alpha1.TaskExecutionOutcomeFailed, true
+	case store.PromptExecutionCancelled:
+		return corev1alpha1.TaskExecutionStateCancelled, corev1alpha1.TaskExecutionOutcomeCancelled, true
+	case store.PromptExecutionOutcomeUnknown:
+		return corev1alpha1.TaskExecutionStateOutcomeUnknown, corev1alpha1.TaskExecutionOutcomeOutcomeUnknown, true
+	default:
+		return "", "", false
+	}
+}
+
+func terminalPhase(state corev1alpha1.TaskExecutionState, delivery store.PromptDeliveryState) corev1alpha1.TaskPhase {
+	if state == corev1alpha1.TaskExecutionStateCancelled {
+		return corev1alpha1.TaskPhaseCancelled
+	}
+	if state == corev1alpha1.TaskExecutionStateSucceeded {
+		switch delivery {
+		case store.PromptDeliveryNotRequested, store.PromptDeliveryReadValidated, store.PromptDeliveryNoChange,
+			store.PromptDeliveryVerifiedExact, store.PromptDeliveryDeliveredSuperseded:
+			return corev1alpha1.TaskPhaseSucceeded
+		case store.PromptDeliveryCancelledBeforePublish:
+			return corev1alpha1.TaskPhaseCancelled
+		}
+	}
+	return corev1alpha1.TaskPhaseFailed
+}
+
+func equalDeliveryEvidence(task *corev1alpha1.Task, left, right *corev1alpha1.TaskDeliveryStatus) bool {
+	if left == nil || right == nil {
+		return left == nil && right == nil
+	}
+	leftCopy := left.DeepCopy()
+	rightCopy := right.DeepCopy()
+	leftCopy.State, rightCopy.State = "", ""
+	leftCopy.Outcome, rightCopy.Outcome = "", ""
+	leftCopy.LastTransitionTime, rightCopy.LastTransitionTime = nil, nil
+	// The projector strips the protocol-only no-workspace revision before the
+	// schema-validated Task status while the immutable payload keeps it, so
+	// evidence is compared through that same normalization.
+	if task != nil && task.Spec.Workspace == nil {
+		if leftCopy.StartingSHA == NoWorkspaceRevision {
+			leftCopy.StartingSHA = ""
+		}
+		if rightCopy.StartingSHA == NoWorkspaceRevision {
+			rightCopy.StartingSHA = ""
+		}
+	}
+	return reflect.DeepEqual(leftCopy, rightCopy)
+}
+
+func validateRuntimeIdentity(projected, task corev1alpha1.TaskExecutionStatus, attempt store.PromptAttempt) error {
+	if projected.RuntimePoolName != task.RuntimePoolName || projected.RuntimePoolUID != task.RuntimePoolUID ||
+		projected.AgentRuntimeName != task.AgentRuntimeName || projected.AgentRuntimeUID != task.AgentRuntimeUID ||
+		projected.RuntimeInstanceID != task.RuntimeInstanceID || projected.RuntimeSessionUID != task.RuntimeSessionUID ||
+		projected.RuntimeSessionGeneration != task.RuntimeSessionGeneration ||
+		projected.RuntimeSessionSupervisorBootID != task.RuntimeSessionSupervisorBootID ||
+		projected.RuntimeSessionProfileDigest != task.RuntimeSessionProfileDigest ||
+		projected.RuntimeSessionMCPDigest != task.RuntimeSessionMCPDigest ||
+		projected.RuntimeSessionWorkspaceDigest != task.RuntimeSessionWorkspaceDigest {
+		return conflict("restored terminal projection runtime identity does not match its Task")
+	}
+	if attempt.RuntimeInstanceID != "" && projected.RuntimeInstanceID != attempt.RuntimeInstanceID {
+		return conflict("restored terminal projection runtime instance does not match its source attempt")
+	}
+	// The projection records the RuntimeSession incarnation generation while
+	// the attempt records the per-prompt Session mutation-lease generation;
+	// they only coincide for a session's first prompt, so the attempt binding
+	// is fenced by session UID here and by lease generation on the finalized
+	// SessionTurn.
+	if attempt.SessionUID != "" && projected.RuntimeSessionUID != attempt.SessionUID {
+		return conflict("restored terminal projection runtime Session does not match its source attempt")
+	}
+	return nil
+}
+
+func conflict(format string, args ...any) error {
+	return fmt.Errorf("%w: %s", store.ErrConflict, fmt.Sprintf(format, args...))
+}
diff --git a/internal/taskterminal/projection_test.go b/internal/taskterminal/projection_test.go
new file mode 100644
index 000000000..8d5e43cf4
--- /dev/null
+++ b/internal/taskterminal/projection_test.go
@@ -0,0 +1,372 @@
+package taskterminal
+
+import (
+	"crypto/sha256"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/store"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+func TestValidateRestoredProjectionAcceptsExactSourceEvidence(t *testing.T) {
+	task, sourceUID, attempt, projection := restoredProjectionFixture()
+
+	if _, err := ValidateRestoredProjection(marshalProjection(t, projection), task, sourceUID, attempt); err != nil {
+		t.Fatalf("ValidateRestoredProjection() error = %v", err)
+	}
+}
+
+func TestValidateRestoredProjectionAcceptsDocumentedDeliverySettlementRewrite(t *testing.T) {
+	task, sourceUID, attempt, projection := restoredProjectionFixture()
+	attempt.DeliveryState = store.PromptDeliveryPublicationOutcomeUnknown
+	projection.Phase = corev1alpha1.TaskPhaseFailed
+	projection.Delivery.State = corev1alpha1.TaskDeliveryStatePublicationOutcomeUnknown
+	projection.Delivery.Outcome = corev1alpha1.TaskDeliveryOutcomePublicationOutcomeUnknown
+	projection.Delivery.LastTransitionTime = timePtr(time.Date(2026, 8, 11, 12, 5, 0, 0, time.UTC))
+	task.Status.Delivery.State = corev1alpha1.TaskDeliveryStatePreparing
+	task.Status.Delivery.Outcome = ""
+	task.Status.Delivery.LastTransitionTime = timePtr(time.Date(2026, 8, 11, 12, 4, 0, 0, time.UTC))
+
+	if _, err := ValidateRestoredProjection(marshalProjection(t, projection), task, sourceUID, attempt); err != nil {
+		t.Fatalf("ValidateRestoredProjection(documented settlement rewrite) error = %v", err)
+	}
+}
+
+func TestValidateRestoredProjectionAcceptsExactRestoreMarker(t *testing.T) {
+	task, sourceUID, attempt, projection := restoredProjectionFixture()
+	const message = "Task incarnation changed during restore after source execution reached a durable terminal state; execution was preserved and was not replayed"
+	attempt.TerminalReason = string(restoreIdentityChangedReason)
+	attempt.OutcomeMarker = message
+	projection.Execution.Reason = restoreIdentityChangedReason
+	projection.Execution.Message = message
+	projection.Message = message
+
+	if _, err := ValidateRestoredProjection(marshalProjection(t, projection), task, sourceUID, attempt); err != nil {
+		t.Fatalf("ValidateRestoredProjection(restore marker) error = %v", err)
+	}
+}
+
+func TestValidateFinalizedSessionProjectionAcceptsPinnedLegacySparseExecution(t *testing.T) {
+	task, sourceUID, attempt, projection := restoredProjectionFixture()
+	task.Spec.SessionRef = &corev1alpha1.SessionReference{Name: "session-transcript", Create: true}
+	legacyExecution := corev1alpha1.TaskExecutionStatus{
+		State: projection.Execution.State, Outcome: projection.Execution.Outcome,
+		Reason: projection.Execution.Reason, Attempt: projection.Execution.Attempt,
+		PromptID: projection.Execution.PromptID, Message: projection.Execution.Message,
+	}
+	projection.Execution = legacyExecution
+	payload := marshalProjection(t, projection)
+	turn := finalizedSessionProjectionTurn(t, payload, attempt)
+
+	validated, err := ValidateFinalizedSessionProjection(payload, task, sourceUID, attempt, turn)
+	if err != nil {
+		t.Fatalf("ValidateFinalizedSessionProjection() error = %v", err)
+	}
+	if validated.Execution.RequestDigest != attempt.RequestDigest ||
+		validated.Execution.RuntimeSessionUID != attempt.SessionUID ||
+		validated.Execution.RuntimeSessionGeneration != attempt.SessionLeaseGeneration {
+		t.Fatalf("legacy Session projection did not recover frozen execution identity: %#v", validated.Execution)
+	}
+}
+
+func TestValidateFinalizedSessionProjectionAcceptsContinuationLeaseGeneration(t *testing.T) {
+	// A session continuation prompt runs under a later mutation-lease
+	// generation than the RuntimeSession incarnation generation frozen in the
+	// Task execution identity. Reclamation must still validate, or every
+	// continuation Task becomes undeletable.
+	task, sourceUID, attempt, projection := restoredProjectionFixture()
+	task.Spec.SessionRef = &corev1alpha1.SessionReference{Name: "session-transcript", Create: false}
+	attempt.SessionLeaseGeneration = task.Status.Execution.RuntimeSessionGeneration + 1
+	payload := marshalProjection(t, projection)
+	turn := finalizedSessionProjectionTurn(t, payload, attempt)
+
+	if _, err := ValidateFinalizedSessionProjection(payload, task, sourceUID, attempt, turn); err != nil {
+		t.Fatalf("ValidateFinalizedSessionProjection(continuation lease) error = %v", err)
+	}
+}
+
+func TestValidateFinalizedSessionProjectionAcceptsStrippedNoWorkspaceRevision(t *testing.T) {
+	// A Task without a repository workspace freezes the protocol-only "empty"
+	// revision in its projected delivery evidence, while the outbox projector
+	// strips that value before the schema-validated Task status. Reclamation
+	// must compare through the same normalization, or every no-workspace Task
+	// with delivery evidence becomes undeletable.
+	task, sourceUID, attempt, projection := restoredProjectionFixture()
+	task.Spec.SessionRef = &corev1alpha1.SessionReference{Name: "session-transcript", Create: true}
+	attempt.DeliveryState = store.PromptDeliveryReadValidated
+	projection.Delivery = &corev1alpha1.TaskDeliveryStatus{
+		State:       corev1alpha1.TaskDeliveryStateReadValidated,
+		Outcome:     corev1alpha1.TaskDeliveryOutcomeReadValidated,
+		StartingSHA: NoWorkspaceRevision,
+	}
+	task.Status.Delivery = &corev1alpha1.TaskDeliveryStatus{
+		State:   corev1alpha1.TaskDeliveryStateReadValidated,
+		Outcome: corev1alpha1.TaskDeliveryOutcomeReadValidated,
+	}
+	payload := marshalProjection(t, projection)
+	turn := finalizedSessionProjectionTurn(t, payload, attempt)
+
+	if _, err := ValidateFinalizedSessionProjection(payload, task, sourceUID, attempt, turn); err != nil {
+		t.Fatalf("ValidateFinalizedSessionProjection(no-workspace revision) error = %v", err)
+	}
+}
+
+func TestValidateRestoredProjectionRejectsNoWorkspaceRevisionForWorkspaceTask(t *testing.T) {
+	task, sourceUID, attempt, projection := restoredProjectionFixture()
+	task.Spec.Workspace = &corev1alpha1.WorkspaceConfig{}
+	projection.Delivery.StartingSHA = NoWorkspaceRevision
+	task.Status.Delivery.StartingSHA = ""
+
+	if _, err := ValidateRestoredProjection(marshalProjection(t, projection), task, sourceUID, attempt); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("ValidateRestoredProjection(workspace task with protocol revision) error = %v, want ErrConflict", err)
+	}
+}
+
+func TestValidateFinalizedSessionProjectionRejectsLeaseGenerationDrift(t *testing.T) {
+	task, sourceUID, attempt, projection := restoredProjectionFixture()
+	task.Spec.SessionRef = &corev1alpha1.SessionReference{Name: "session-transcript", Create: false}
+	payload := marshalProjection(t, projection)
+	turn := finalizedSessionProjectionTurn(t, payload, attempt)
+	// Drift between the finalized turn and its attempt must stay fenced even
+	// though the Task's incarnation generation is no longer compared.
+	attempt.SessionLeaseGeneration++
+
+	if _, err := ValidateFinalizedSessionProjection(payload, task, sourceUID, attempt, turn); !errors.Is(err, store.ErrConflict) {
+		t.Fatalf("ValidateFinalizedSessionProjection(lease drift) error = %v, want ErrConflict", err)
+	}
+}
+
+func TestValidateFinalizedSessionProjectionRejectsUnpinnedOrPartialLegacyPayload(t *testing.T) {
+	tests := []struct {
+		name   string
+		mutate func(*corev1alpha1.Task, *store.PromptAttempt, *Projection, *store.SessionTurn)
+	}{
+		{name: "no Session reference", mutate: func(task *corev1alpha1.Task, _ *store.PromptAttempt, _ *Projection, _ *store.SessionTurn) {
+			task.Spec.SessionRef = nil
+		}},
+		{name: "projection digest", mutate: func(_ *corev1alpha1.Task, _ *store.PromptAttempt, _ *Projection, turn *store.SessionTurn) {
+			turn.ProjectionDigest = digest("different-payload")
+		}},
+		{name: "prompt attempt identity", mutate: func(_ *corev1alpha1.Task, _ *store.PromptAttempt, _ *Projection, turn *store.SessionTurn) {
+			turn.PromptAttemptID = "different-attempt"
+		}},
+		{name: "Session identity", mutate: func(_ *corev1alpha1.Task, _ *store.PromptAttempt, _ *Projection, turn *store.SessionTurn) {
+			turn.Key.SessionUID = "different-session"
+		}},
+		{name: "terminal kind", mutate: func(_ *corev1alpha1.Task, _ *store.PromptAttempt, _ *Projection, turn *store.SessionTurn) {
+			turn.TerminalKind = store.SessionTurnOutcomeMarker
+		}},
+		{name: "partial request identity", mutate: func(_ *corev1alpha1.Task, _ *store.PromptAttempt, projection *Projection, _ *store.SessionTurn) {
+			projection.Execution.RequestDigest = digest("different-request")
+		}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			task, sourceUID, attempt, projection := restoredProjectionFixture()
+			task.Spec.SessionRef = &corev1alpha1.SessionReference{Name: "session-transcript", Create: true}
+			projection.Execution = corev1alpha1.TaskExecutionStatus{
+				State: projection.Execution.State, Outcome: projection.Execution.Outcome,
+				Reason: projection.Execution.Reason, Attempt: projection.Execution.Attempt,
+				PromptID: projection.Execution.PromptID, Message: projection.Execution.Message,
+			}
+			payload := marshalProjection(t, projection)
+			turn := finalizedSessionProjectionTurn(t, payload, attempt)
+			tt.mutate(task, attempt, &projection, turn)
+			payload = marshalProjection(t, projection)
+			if tt.name != "partial request identity" {
+				// Mutations above target authoritative evidence, not the payload.
+				turn.ProjectionDigest = fmt.Sprintf("sha256:%x", sha256.Sum256(payload))
+				if tt.name == "projection digest" {
+					turn.ProjectionDigest = digest("different-payload")
+				}
+			}
+			if _, err := ValidateFinalizedSessionProjection(payload, task, sourceUID, attempt, turn); !errors.Is(err, store.ErrConflict) {
+				t.Fatalf("ValidateFinalizedSessionProjection() error = %v, want ErrConflict", err)
+			}
+		})
+	}
+}
+
+//nolint:gocyclo // One table deliberately covers every security-relevant terminal payload field.
+func TestValidateRestoredProjectionRejectsForgedOrIncompletePayload(t *testing.T) {
+	const forgedValue = "other"
+
+	tests := []struct {
+		name   string
+		mutate func(*Projection)
+	}{
+		{name: "namespace", mutate: func(p *Projection) { p.Namespace = forgedValue }},
+		{name: "task name", mutate: func(p *Projection) { p.Task = forgedValue }},
+		{name: "source UID", mutate: func(p *Projection) { p.TaskUID = forgedValue }},
+		{name: "attempt", mutate: func(p *Projection) { p.Attempt++ }},
+		{name: "execution attempt", mutate: func(p *Projection) { p.Execution.Attempt++ }},
+		{name: "prompt ID", mutate: func(p *Projection) { p.Execution.PromptID = forgedValue }},
+		{name: "request digest", mutate: func(p *Projection) { p.Execution.RequestDigest = digest("other-request") }},
+		{name: "binding digest", mutate: func(p *Projection) { p.BindingDigest = digest("other-binding") }},
+		{name: "execution state", mutate: func(p *Projection) { p.Execution.State = corev1alpha1.TaskExecutionStateFailed }},
+		{name: "execution outcome", mutate: func(p *Projection) { p.Execution.Outcome = corev1alpha1.TaskExecutionOutcomeFailed }},
+		{name: "phase", mutate: func(p *Projection) { p.Phase = corev1alpha1.TaskPhaseFailed }},
+		{name: "runtime pool", mutate: func(p *Projection) { p.Execution.RuntimePoolName = forgedValue }},
+		{name: "runtime pool UID", mutate: func(p *Projection) { p.Execution.RuntimePoolUID = forgedValue }},
+		{name: "runtime instance", mutate: func(p *Projection) { p.Execution.RuntimeInstanceID = forgedValue }},
+		{name: "runtime Session", mutate: func(p *Projection) { p.Execution.RuntimeSessionUID = forgedValue }},
+		{name: "runtime Session generation", mutate: func(p *Projection) { p.Execution.RuntimeSessionGeneration++ }},
+		{name: "runtime supervisor boot", mutate: func(p *Projection) { p.Execution.RuntimeSessionSupervisorBootID = forgedValue }},
+		{name: "runtime profile digest", mutate: func(p *Projection) { p.Execution.RuntimeSessionProfileDigest = digest("other-profile") }},
+		{name: "runtime MCP digest", mutate: func(p *Projection) { p.Execution.RuntimeSessionMCPDigest = digest("other-mcp") }},
+		{name: "runtime workspace digest", mutate: func(p *Projection) { p.Execution.RuntimeSessionWorkspaceDigest = digest("other-workspace") }},
+		{name: "delivery omitted", mutate: func(p *Projection) { p.Delivery = nil }},
+		{name: "delivery state", mutate: func(p *Projection) { p.Delivery.State = corev1alpha1.TaskDeliveryStateDeliveryConflict }},
+		{name: "delivery outcome", mutate: func(p *Projection) { p.Delivery.Outcome = corev1alpha1.TaskDeliveryOutcomeDeliveryConflict }},
+		{name: "delivery reason", mutate: func(p *Projection) { p.Delivery.Reason = "Other" }},
+		{name: "publication ID", mutate: func(p *Projection) { p.Delivery.PublicationID = forgedValue }},
+		{name: "source repository", mutate: func(p *Projection) { p.Delivery.SourceRepository.ID = "github.com/other/source" }},
+		{name: "publication repository", mutate: func(p *Projection) { p.Delivery.PublicationRepository.ID = "github.com/other/target" }},
+		{name: "branch", mutate: func(p *Projection) { p.Delivery.Branch = forgedValue }},
+		{name: "starting SHA", mutate: func(p *Projection) { p.Delivery.StartingSHA = strings.Repeat("a", 40) }},
+		{name: "remote before SHA", mutate: func(p *Projection) { value := strings.Repeat("b", 40); p.Delivery.RemoteBeforeSHA = &value }},
+		{name: "tree SHA", mutate: func(p *Projection) { p.Delivery.TreeSHA = strings.Repeat("c", 40) }},
+		{name: "expected commit SHA", mutate: func(p *Projection) { p.Delivery.ExpectedCommitSHA = strings.Repeat("d", 40) }},
+		{name: "verified remote SHA", mutate: func(p *Projection) { p.Delivery.VerifiedRemoteSHA = strings.Repeat("e", 40) }},
+		{name: "superseding remote SHA", mutate: func(p *Projection) { p.Delivery.SupersedingRemoteSHA = strings.Repeat("f", 40) }},
+		{name: "artifact digest", mutate: func(p *Projection) { p.Delivery.ArtifactDigest = digest("other-artifact") }},
+		{name: "pull request receipt", mutate: func(p *Projection) { p.Delivery.PRReceipt.ID = forgedValue }},
+		{name: "delivery message", mutate: func(p *Projection) { p.Delivery.Message = forgedValue }},
+		{name: "harness v1 runtime", mutate: func(p *Projection) { p.HarnessRuntime = &corev1alpha1.HarnessRuntimeStatus{} }},
+		{name: "harness v1 result", mutate: func(p *Projection) { p.ResultRef = &corev1alpha1.ResultReference{} }},
+		{name: "unproved restore marker", mutate: func(p *Projection) { p.Execution.Reason = restoreIdentityChangedReason }},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			task, sourceUID, attempt, projection := restoredProjectionFixture()
+			tt.mutate(&projection)
+			if _, err := ValidateRestoredProjection(marshalProjection(t, projection), task, sourceUID, attempt); !errors.Is(err, store.ErrConflict) {
+				t.Fatalf("ValidateRestoredProjection() error = %v, want ErrConflict", err)
+			}
+		})
+	}
+
+	for _, tt := range []struct {
+		name    string
+		payload []byte
+	}{
+		{name: "empty object", payload: []byte(`{}`)},
+		{name: "legacy phase only", payload: []byte(`{"phase":"Succeeded"}`)},
+		{name: "unknown field", payload: []byte(`{"unknown":true}`)},
+		{name: "trailing object", payload: []byte(`{} {}`)},
+		{name: "not JSON", payload: []byte(`not-json`)},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			task, sourceUID, attempt, _ := restoredProjectionFixture()
+			if _, err := ValidateRestoredProjection(tt.payload, task, sourceUID, attempt); !errors.Is(err, store.ErrConflict) {
+				t.Fatalf("ValidateRestoredProjection() error = %v, want ErrConflict", err)
+			}
+		})
+	}
+}
+
+func restoredProjectionFixture() (*corev1alpha1.Task, string, *store.PromptAttempt, Projection) {
+	const sourceUID = "11111111-1111-1111-1111-111111111111"
+	remoteBefore := strings.Repeat("1", 40)
+	transition := metav1.NewTime(time.Date(2026, 8, 11, 12, 0, 0, 0, time.UTC))
+	delivery := &corev1alpha1.TaskDeliveryStatus{
+		State: corev1alpha1.TaskDeliveryStateVerifiedExact, Outcome: corev1alpha1.TaskDeliveryOutcomeVerifiedExact,
+		Reason: "Verified", PublicationID: "publication-source", Branch: "restore-proof",
+		SourceRepository:      &corev1alpha1.RepositoryIdentity{Provider: "github", ID: "github.com/example/source"},
+		PublicationRepository: &corev1alpha1.RepositoryIdentity{Provider: "github", ID: "github.com/example/target"},
+		StartingSHA:           strings.Repeat("2", 40), RemoteBeforeSHA: &remoteBefore, TreeSHA: strings.Repeat("3", 40),
+		ExpectedCommitSHA: strings.Repeat("4", 40), VerifiedRemoteSHA: strings.Repeat("4", 40),
+		SupersedingRemoteSHA: strings.Repeat("5", 40), ArtifactDigest: digest("artifact"),
+		PRReceipt: &corev1alpha1.TaskPullRequestReceipt{ID: "pr-1", Number: 1, URL: "https://github.com/example/target/pull/1", State: "open"},
+		Message:   "verified exact", LastTransitionTime: &transition,
+	}
+	execution := &corev1alpha1.TaskExecutionStatus{
+		State: corev1alpha1.TaskExecutionStateSucceeded, Outcome: corev1alpha1.TaskExecutionOutcomeSucceeded,
+		Reason: restoreIdentityChangedReason, Message: "restored status", Attempt: 2, PromptID: "prompt-final",
+		RuntimePoolName: "pool", RuntimePoolUID: "pool-uid", RuntimeInstanceID: "runtime-instance",
+		RuntimeSessionUID: "session-uid", RuntimeSessionGeneration: 3, RuntimeSessionSupervisorBootID: "boot-id",
+		RuntimeSessionProfileDigest: digest("profile"), RuntimeSessionMCPDigest: digest("mcp"),
+		RuntimeSessionWorkspaceDigest: digest("workspace"), RequestDigest: digest("request"), ControllerEpoch: 9,
+		LastTransitionTime: &transition,
+	}
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "tenant-a", Name: "restored-task", UID: types.UID("22222222-2222-2222-2222-222222222222")},
+		Status: corev1alpha1.TaskStatus{
+			Phase: corev1alpha1.TaskPhaseSucceeded, Message: "restored status", Execution: execution, Delivery: delivery.DeepCopy(),
+			AgentExecutionBinding: &corev1alpha1.AgentExecutionBinding{
+				SchemaVersion: 1, ContractVersion: corev1alpha1.AgentRuntimeContractHarnessV2,
+				BindingDigest: digest("binding"), Task: corev1alpha1.AgentExecutionBindingTaskRef{UID: types.UID(sourceUID)},
+				Snapshot: corev1alpha1.AgentExecutionSnapshotRef{ID: sourceUID + "/" + digest("snapshot"), Digest: digest("snapshot"), SchemaVersion: 1},
+			},
+		},
+	}
+	attempt := &store.PromptAttempt{
+		ID:            "prompt-attempt-final",
+		Key:           store.PromptAttemptKey{Namespace: task.Namespace, TaskUID: sourceUID, Attempt: 2, PromptID: execution.PromptID},
+		RequestDigest: execution.RequestDigest, BindingDigest: task.Status.AgentExecutionBinding.BindingDigest,
+		RuntimeInstanceID: execution.RuntimeInstanceID, SessionUID: execution.RuntimeSessionUID,
+		SessionLeaseGeneration: execution.RuntimeSessionGeneration, ExecutionState: store.PromptExecutionSucceeded,
+		DeliveryState: store.PromptDeliveryVerifiedExact, ControllerEpoch: 7,
+	}
+	projectionExecution := *execution.DeepCopy()
+	projectionExecution.Reason = "SourceCompleted"
+	projectionExecution.Message = "source terminal message"
+	projectionExecution.ControllerEpoch = attempt.ControllerEpoch
+	projectionExecution.LastTransitionTime = timePtr(time.Date(2026, 8, 11, 11, 59, 0, 0, time.UTC))
+	projection := Projection{
+		Namespace: task.Namespace, Task: task.Name, TaskUID: sourceUID, Attempt: execution.Attempt,
+		Phase: corev1alpha1.TaskPhaseSucceeded, Message: "source completed",
+		BindingDigest: task.Status.AgentExecutionBinding.BindingDigest, Execution: projectionExecution,
+		Delivery: delivery.DeepCopy(),
+	}
+	projection.Delivery.LastTransitionTime = timePtr(time.Date(2026, 8, 11, 11, 58, 0, 0, time.UTC))
+	return task, sourceUID, attempt, projection
+}
+
+func marshalProjection(t *testing.T, projection Projection) []byte {
+	t.Helper()
+	payload, err := json.Marshal(projection)
+	if err != nil {
+		t.Fatalf("json.Marshal(): %v", err)
+	}
+	return payload
+}
+
+func finalizedSessionProjectionTurn(t *testing.T, payload []byte, attempt *store.PromptAttempt) *store.SessionTurn {
+	t.Helper()
+	key := store.SessionTurnKey{
+		SessionUID: attempt.SessionUID, LeaseGeneration: attempt.SessionLeaseGeneration,
+		TaskUID: attempt.Key.TaskUID, Attempt: attempt.Key.Attempt, PromptID: attempt.Key.PromptID,
+	}
+	id, err := key.CanonicalID()
+	if err != nil {
+		t.Fatalf("SessionTurnKey.CanonicalID(): %v", err)
+	}
+	finalizedAt := time.Date(2026, 8, 11, 12, 10, 0, 0, time.UTC)
+	return &store.SessionTurn{
+		ID: id, Key: key, PromptAttemptID: attempt.ID, State: store.SessionTurnFinalized,
+		TerminalKind: store.SessionTurnAssistantResult, ProjectionID: "outbox:session-terminal",
+		ProjectionKind: ProjectionKind, ProjectionDigest: fmt.Sprintf("sha256:%x", sha256.Sum256(payload)),
+		FinalizedAt: &finalizedAt,
+	}
+}
+
+func digest(value string) string {
+	if len(value) > 64 {
+		value = value[:64]
+	}
+	return "sha256:" + value + strings.Repeat("0", 64-len(value))
+}
+
+func timePtr(value time.Time) *metav1.Time {
+	result := metav1.NewTime(value)
+	return &result
+}
diff --git a/internal/tools/agent_model_update.go b/internal/tools/agent_model_update.go
new file mode 100644
index 000000000..10bbbe658
--- /dev/null
+++ b/internal/tools/agent_model_update.go
@@ -0,0 +1,239 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package tools
+
+import (
+	"fmt"
+	"math"
+	"strings"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+)
+
+type agentModelUpdate struct {
+	provider       string
+	providerSet    bool
+	name           string
+	nameSet        bool
+	legacyString   bool
+	temperature    float64
+	temperatureSet bool
+	contextWindow  int32
+	contextSet     bool
+	maxTokens      int32
+	maxTokensSet   bool
+}
+
+func parseAgentModelUpdate(value any) (agentModelUpdate, error) {
+	var update agentModelUpdate
+	switch model := value.(type) {
+	case map[string]any:
+		if err := parseAgentModelStringField(model, "provider", &update.provider, &update.providerSet); err != nil {
+			return agentModelUpdate{}, err
+		}
+		if err := parseAgentModelStringField(model, nameField, &update.name, &update.nameSet); err != nil {
+			return agentModelUpdate{}, err
+		}
+		if raw, ok := model["temperature"]; ok {
+			temperature, ok := raw.(float64)
+			if !ok || math.IsNaN(temperature) || math.IsInf(temperature, 0) {
+				return agentModelUpdate{}, fmt.Errorf("model.temperature must be a number")
+			}
+			if temperature < 0 || temperature > 2 {
+				return agentModelUpdate{}, fmt.Errorf("model.temperature must be between 0 and 2")
+			}
+			update.temperature = temperature
+			update.temperatureSet = true
+		}
+		if raw, ok := model["contextWindow"]; ok {
+			contextWindow, err := parsePositiveAgentModelInt32("model.contextWindow", raw)
+			if err != nil {
+				return agentModelUpdate{}, err
+			}
+			update.contextWindow = contextWindow
+			update.contextSet = true
+		}
+		if raw, ok := model["maxTokens"]; ok {
+			maxTokens, err := parsePositiveAgentModelInt32("model.maxTokens", raw)
+			if err != nil {
+				return agentModelUpdate{}, err
+			}
+			update.maxTokens = maxTokens
+			update.maxTokensSet = true
+		}
+		return update, nil
+	case string:
+		legacy := strings.TrimSpace(model)
+		if legacy == "" {
+			return update, nil
+		}
+		update.name = legacy
+		update.nameSet = true
+		update.legacyString = true
+		return update, nil
+	default:
+		return agentModelUpdate{}, fmt.Errorf("model must be an object")
+	}
+}
+
+func parseAgentModelStringField(model map[string]any, field string, destination *string, supplied *bool) error {
+	raw, ok := model[field]
+	if !ok {
+		return nil
+	}
+	value, ok := raw.(string)
+	if !ok {
+		return fmt.Errorf("model.%s must be a string", field)
+	}
+	*destination = strings.TrimSpace(value)
+	*supplied = true
+	return nil
+}
+
+func parsePositiveAgentModelInt32(field string, raw any) (int32, error) {
+	value, ok := raw.(float64)
+	const maxInt32 = float64(1<<31 - 1)
+	if !ok || math.IsNaN(value) || math.IsInf(value, 0) || math.Trunc(value) != value {
+		return 0, fmt.Errorf("%s must be an integer", field)
+	}
+	if value < 1 || value > maxInt32 {
+		return 0, fmt.Errorf("%s must be a positive 32-bit integer", field)
+	}
+	return int32(value), nil
+}
+
+func validateBuiltInRuntimeModelLimits(runtimeType corev1alpha1.AgentRuntimeType, model *corev1alpha1.ModelConfig) error {
+	if !isBuiltInACPRuntime(runtimeType) || runtimeType == corev1alpha1.AgentRuntimeOpencode || model == nil {
+		return nil
+	}
+	if model.ContextWindow != nil {
+		return fmt.Errorf("built-in ACP runtime %q does not support model.contextWindow", runtimeType)
+	}
+	if model.MaxTokens != nil {
+		return fmt.Errorf("built-in ACP runtime %q does not support model.maxTokens", runtimeType)
+	}
+	return nil
+}
+
+func applyAgentModelUpdate(agent *corev1alpha1.Agent, update agentModelUpdate) error {
+	if !update.hasChanges() {
+		return nil
+	}
+	if agent != nil && agent.Spec.Runtime != nil {
+		requestedLimits := &corev1alpha1.ModelConfig{}
+		if update.contextSet {
+			requestedLimits.ContextWindow = &update.contextWindow
+		}
+		if update.maxTokensSet {
+			requestedLimits.MaxTokens = &update.maxTokens
+		}
+		if err := validateBuiltInRuntimeModelLimits(agent.Spec.Runtime.Type, requestedLimits); err != nil {
+			return err
+		}
+	}
+	if agent.Spec.Model == nil {
+		agent.Spec.Model = &corev1alpha1.ModelConfig{}
+	}
+	if isOpenCodeAgent(agent) {
+		return applyOpenCodeModelUpdate(agent.Spec.Model, update)
+	}
+	applyCommonAgentModelUpdate(agent.Spec.Model, update)
+	return nil
+}
+
+func (u agentModelUpdate) hasChanges() bool {
+	return u.providerSet || u.nameSet || u.temperatureSet || u.contextSet || u.maxTokensSet
+}
+
+func applyCommonAgentModelUpdate(model *corev1alpha1.ModelConfig, update agentModelUpdate) {
+	if update.legacyString {
+		provider, modelName := splitModelString(update.name)
+		if provider != "" {
+			model.Provider = strings.TrimSpace(provider)
+		}
+		model.Name = strings.TrimSpace(modelName)
+		applyAgentModelControlUpdate(model, update)
+		return
+	}
+	if update.providerSet {
+		model.Provider = update.provider
+	}
+	if update.nameSet {
+		model.Name = update.name
+	}
+	applyAgentModelControlUpdate(model, update)
+}
+
+func applyOpenCodeModelUpdate(model *corev1alpha1.ModelConfig, update agentModelUpdate) error {
+	provider, modelName := currentOpenCodeModelIdentity(model)
+	nameWasQualified := false
+	if update.nameSet {
+		requestedName := strings.TrimSpace(update.name)
+		if requestedProvider, requestedModel, qualified := strings.Cut(requestedName, "/"); qualified {
+			provider = strings.TrimSpace(requestedProvider)
+			modelName = strings.TrimSpace(requestedModel)
+			nameWasQualified = true
+		} else {
+			modelName = requestedName
+		}
+	}
+	if update.providerSet {
+		requestedProvider := strings.TrimSpace(update.provider)
+		if requestedProvider != "" && nameWasQualified && provider != "" && requestedProvider != provider {
+			return fmt.Errorf("model.provider %q does not match provider %q in model.name", requestedProvider, provider)
+		}
+		if requestedProvider != "" || !nameWasQualified {
+			provider = requestedProvider
+		}
+	}
+
+	model.Name = modelName
+	model.Provider = provider
+	if nameWasQualified {
+		// Preserve every qualified OpenCode ID through final validation so nested
+		// model paths are not reinterpreted as a conflicting provider hint.
+		model.Provider = ""
+		if provider != "" {
+			model.Name = provider + "/" + modelName
+		}
+		if update.providerSet {
+			model.Provider = strings.TrimSpace(update.provider)
+		}
+	}
+	applyAgentModelControlUpdate(model, update)
+	return nil
+}
+
+func currentOpenCodeModelIdentity(model *corev1alpha1.ModelConfig) (string, string) {
+	if model == nil {
+		return "", ""
+	}
+	requested := strings.TrimSpace(model.Name)
+	if provider, modelName, qualified := strings.Cut(requested, "/"); qualified {
+		return strings.TrimSpace(provider), strings.TrimSpace(modelName)
+	}
+	return strings.TrimSpace(model.Provider), requested
+}
+
+func applyAgentModelControlUpdate(model *corev1alpha1.ModelConfig, update agentModelUpdate) {
+	if update.temperatureSet {
+		temperature := update.temperature
+		model.Temperature = &temperature
+	}
+	if update.contextSet {
+		contextWindow := update.contextWindow
+		model.ContextWindow = &contextWindow
+	}
+	if update.maxTokensSet {
+		maxTokens := update.maxTokens
+		model.MaxTokens = &maxTokens
+	}
+}
+
+func isOpenCodeAgent(agent *corev1alpha1.Agent) bool {
+	return agent != nil && agent.Spec.Runtime != nil && agent.Spec.Runtime.Type == corev1alpha1.AgentRuntimeOpencode
+}
diff --git a/internal/tools/auto_merge_pull_request.go b/internal/tools/auto_merge_pull_request.go
index 8cf584be5..1d9610485 100644
--- a/internal/tools/auto_merge_pull_request.go
+++ b/internal/tools/auto_merge_pull_request.go
@@ -18,7 +18,6 @@ import (
 	"time"
 
 	"github.com/go-logr/logr"
-	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/log"
@@ -151,25 +150,15 @@ func (t *AutoMergePullRequestTool) Execute(ctx context.Context, argsJSON json.Ra
 		return "", fmt.Errorf("failed to parse GitHub repo from %s: %w", repoURL, err)
 	}
 
-	// Get the git token from the referenced secret
-	if ws.GitSecretRef == nil {
-		return "", fmt.Errorf("task %s workspace has no gitSecretRef configured", args.TaskName)
+	// Forge API operations must use the forge credential, not the repository
+	// publication credential used for Git pushes.
+	if ws.ForgeCredentialRef == nil {
+		return "", fmt.Errorf("task %s workspace has no forgeCredentialRef configured", args.TaskName)
 	}
 
-	var secret corev1.Secret
-	if err := t.k8sClient.Get(ctx, types.NamespacedName{Name: ws.GitSecretRef.Name, Namespace: ns}, &secret); err != nil {
-		return "", fmt.Errorf("failed to get git secret %s: %w", ws.GitSecretRef.Name, err)
-	}
-
-	token := ""
-	for _, key := range []string{tokenKey, passwordKey} {
-		if v, ok := secret.Data[key]; ok {
-			token = strings.TrimSpace(string(v))
-			break
-		}
-	}
-	if token == "" {
-		return "", fmt.Errorf("git secret %s does not contain a 'token' or 'password' key", ws.GitSecretRef.Name)
+	token, err := resolveForgeCredentialToken(ctx, t.k8sClient, ns, ws.ForgeCredentialRef)
+	if err != nil {
+		return "", err
 	}
 
 	baseURL := githubAPIBaseURL
diff --git a/internal/tools/auto_merge_pull_request_test.go b/internal/tools/auto_merge_pull_request_test.go
index 779d03fb9..c47d096e2 100644
--- a/internal/tools/auto_merge_pull_request_test.go
+++ b/internal/tools/auto_merge_pull_request_test.go
@@ -65,7 +65,7 @@ func TestAutoMergePullRequestTool_CIPassesImmediately(t *testing.T) {
 
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if auth := r.Header.Get("Authorization"); auth != testBearerToken {
-			t.Errorf("unexpected auth header: %s", auth)
+			t.Error("request did not use the expected forge credential")
 		}
 		switch {
 		case r.Method == http.MethodGet && strings.HasSuffix(r.URL.Path, "/pulls/42"):
@@ -93,12 +93,10 @@ func TestAutoMergePullRequestTool_CIPassesImmediately(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      testSozercanAynaRepoURL,
-					Branch:       testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{Name: testGitCredsSecretName},
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:            testSozercanAynaRepoURL,
+				Branch:             testBranch,
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: testGitCredsSecretName},
 			},
 		},
 	}
@@ -173,12 +171,10 @@ func TestAutoMergePullRequestTool_CIFails(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      testSozercanAynaRepoURL,
-					Branch:       testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{Name: testGitCredsSecretName},
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:            testSozercanAynaRepoURL,
+				Branch:             testBranch,
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: testGitCredsSecretName},
 			},
 		},
 	}
@@ -244,12 +240,10 @@ func TestAutoMergePullRequestTool_Timeout(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      testSozercanAynaRepoURL,
-					Branch:       testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{Name: testGitCredsSecretName},
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:            testSozercanAynaRepoURL,
+				Branch:             testBranch,
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: testGitCredsSecretName},
 			},
 		},
 	}
@@ -306,12 +300,10 @@ func TestAutoMergePullRequestTool_ContextCancelled(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      testSozercanAynaRepoURL,
-					Branch:       testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{Name: testGitCredsSecretName},
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:            testSozercanAynaRepoURL,
+				Branch:             testBranch,
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: testGitCredsSecretName},
 			},
 		},
 	}
@@ -386,12 +378,10 @@ func TestAutoMergePullRequestTool_MergeMethods(t *testing.T) {
 				ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 				Spec: corev1alpha1.TaskSpec{
 					Type: corev1alpha1.TaskTypeAgent,
-					AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-						Workspace: &corev1alpha1.WorkspaceConfig{
-							GitRepo:      testSozercanAynaRepoURL,
-							Branch:       testBranch,
-							GitSecretRef: &corev1.LocalObjectReference{Name: testGitCredsSecretName},
-						},
+					Workspace: &corev1alpha1.WorkspaceConfig{
+						GitRepo:            testSozercanAynaRepoURL,
+						Branch:             testBranch,
+						ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: testGitCredsSecretName},
 					},
 				},
 			}
@@ -457,12 +447,10 @@ func TestAutoMergePullRequestTool_PRClosedExternally(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      testSozercanAynaRepoURL,
-					Branch:       testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{Name: testGitCredsSecretName},
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:            testSozercanAynaRepoURL,
+				Branch:             testBranch,
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: testGitCredsSecretName},
 			},
 		},
 	}
@@ -527,12 +515,10 @@ func TestAutoMergePullRequestTool_PRAlreadyMerged(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      testSozercanAynaRepoURL,
-					Branch:       testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{Name: testGitCredsSecretName},
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:            testSozercanAynaRepoURL,
+				Branch:             testBranch,
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: testGitCredsSecretName},
 			},
 		},
 	}
@@ -622,7 +608,7 @@ func TestAutoMergePullRequestTool_MissingTask(t *testing.T) {
 func TestGetGitHubPRDetails(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if auth := r.Header.Get("Authorization"); auth != testBearerToken {
-			t.Errorf("unexpected auth header: %s", auth)
+			t.Error("request did not use the expected credential")
 		}
 		if !strings.HasSuffix(r.URL.Path, "/repos/sozercan/ayna/pulls/42") {
 			t.Errorf("unexpected path: %s", r.URL.Path)
@@ -1145,12 +1131,10 @@ func TestAutoMergePullRequestTool_InvalidTimeout(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      testSozercanAynaRepoURL,
-					Branch:       testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{Name: testGitCredsSecretName},
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:            testSozercanAynaRepoURL,
+				Branch:             testBranch,
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: testGitCredsSecretName},
 			},
 		},
 	}
@@ -1210,7 +1194,7 @@ func TestAutoMergePullRequestTool_NoWorkspace(t *testing.T) {
 	}
 }
 
-func TestAutoMergePullRequestTool_NoGitSecretRef(t *testing.T) {
+func TestAutoMergePullRequestTool_NoForgeCredentialRef(t *testing.T) {
 	scheme := runtime.NewScheme()
 	_ = corev1alpha1.AddToScheme(scheme)
 	_ = corev1.AddToScheme(scheme)
@@ -1219,11 +1203,10 @@ func TestAutoMergePullRequestTool_NoGitSecretRef(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: testSozercanAynaRepoURL,
-					Branch:  testBranch,
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:                  testSozercanAynaRepoURL,
+				Branch:                   testBranch,
+				PublicationCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "publication-creds"},
 			},
 		},
 	}
@@ -1240,14 +1223,14 @@ func TestAutoMergePullRequestTool_NoGitSecretRef(t *testing.T) {
 
 	_, err := tool.Execute(context.Background(), args)
 	if err == nil {
-		t.Fatal("expected error for task without gitSecretRef")
+		t.Fatal("expected error for task without forgeCredentialRef")
 	}
-	if !strings.Contains(err.Error(), "no gitSecretRef") {
+	if !strings.Contains(err.Error(), "no forgeCredentialRef") {
 		t.Errorf("unexpected error: %s", err.Error())
 	}
 }
 
-func TestAutoMergePullRequestTool_EmptyToken(t *testing.T) {
+func TestAutoMergePullRequestTool_MissingDefaultForgeCredentialKey(t *testing.T) {
 	scheme := runtime.NewScheme()
 	_ = corev1alpha1.AddToScheme(scheme)
 	_ = corev1.AddToScheme(scheme)
@@ -1256,12 +1239,10 @@ func TestAutoMergePullRequestTool_EmptyToken(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      testSozercanAynaRepoURL,
-					Branch:       testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{Name: testGitCredsSecretName},
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:            testSozercanAynaRepoURL,
+				Branch:             testBranch,
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: testGitCredsSecretName},
 			},
 		},
 	}
@@ -1282,15 +1263,20 @@ func TestAutoMergePullRequestTool_EmptyToken(t *testing.T) {
 
 	_, err := tool.Execute(context.Background(), args)
 	if err == nil {
-		t.Fatal("expected error for empty token")
+		t.Fatal("expected error for missing default forge credential key")
 	}
-	if !strings.Contains(err.Error(), "does not contain a 'token' or 'password' key") {
+	if !strings.Contains(err.Error(), `does not contain configured key "token"`) {
 		t.Errorf("unexpected error: %s", err.Error())
 	}
 }
 
-func TestAutoMergePullRequestTool_PasswordKey(t *testing.T) {
+func TestAutoMergePullRequestTool_CustomForgeCredentialKey(t *testing.T) {
+	const customForgeKey = "github-api-token"
+
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if auth := r.Header.Get("Authorization"); auth != testBearerToken {
+			t.Error("request did not use the expected credential")
+		}
 		switch {
 		case r.Method == http.MethodGet && strings.HasSuffix(r.URL.Path, "/pulls/42"):
 			w.WriteHeader(200)
@@ -1315,21 +1301,24 @@ func TestAutoMergePullRequestTool_PasswordKey(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      testSozercanAynaRepoURL,
-					Branch:       testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{Name: testGitCredsSecretName},
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:                  testSozercanAynaRepoURL,
+				Branch:                   testBranch,
+				PublicationCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "publication-creds"},
+				ForgeCredentialRef:       &corev1alpha1.WorkspaceCredentialReference{Name: testGitCredsSecretName, Key: customForgeKey},
 			},
 		},
 	}
 	secret := &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{Name: testGitCredsSecretName, Namespace: defaultNamespace},
-		Data:       map[string][]byte{passwordKey: []byte("pwd-token")},
+		Data:       map[string][]byte{customForgeKey: []byte(testGitHubToken)},
+	}
+	publicationSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{Name: "publication-creds", Namespace: defaultNamespace},
+		Data:       map[string][]byte{tokenKey: []byte("decoy")},
 	}
 
-	k8sClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(task, secret).Build()
+	k8sClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(task, secret, publicationSecret).Build()
 	tool := &AutoMergePullRequestTool{k8sClient: k8sClient, apiBaseURL: server.URL}
 
 	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
diff --git a/internal/tools/broker_coordination_registration_test.go b/internal/tools/broker_coordination_registration_test.go
new file mode 100644
index 000000000..d4ee2ab15
--- /dev/null
+++ b/internal/tools/broker_coordination_registration_test.go
@@ -0,0 +1,460 @@
+package tools
+
+import (
+	"context"
+	"encoding/json"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/contexttoken"
+	"github.com/orka-agents/orka/internal/labels"
+	"github.com/orka-agents/orka/internal/store"
+	"github.com/orka-agents/orka/internal/transactiontoken"
+)
+
+const (
+	brokerTestNamespace            = "team-a"
+	brokerTestAgentName            = "agent-a"
+	brokerMemoryProposalType       = "memory"
+	brokerSkillProposalType        = "skill"
+	brokerProposalStatusPending    = "pending"
+	brokerDelegateTransactionScope = "orka:agents:delegate"
+)
+
+type brokerMemoryStore struct {
+	memoryFilter     store.MemoryFilter
+	memories         []store.Memory
+	proposals        []store.MemoryProposal
+	transcriptFilter store.TranscriptSearchFilter
+	transcript       []store.TranscriptSearchResult
+}
+
+func (s *brokerMemoryStore) ListMemories(_ context.Context, filter store.MemoryFilter) ([]store.Memory, error) {
+	s.memoryFilter = filter
+	return append([]store.Memory(nil), s.memories...), nil
+}
+
+func (s *brokerMemoryStore) CreateMemoryProposal(_ context.Context, proposal *store.MemoryProposal) error {
+	s.proposals = append(s.proposals, *proposal)
+	proposal.ID = "proposal-id"
+	proposal.Status = brokerProposalStatusPending
+	return nil
+}
+
+func (s *brokerMemoryStore) SearchTranscript(_ context.Context, filter store.TranscriptSearchFilter) ([]store.TranscriptSearchResult, error) {
+	s.transcriptFilter = filter
+	return append([]store.TranscriptSearchResult(nil), s.transcript...), nil
+}
+
+func TestRegisterBrokeredCoordinationToolsIsIdempotentAndBounded(t *testing.T) {
+	registry := NewRegistry()
+	k8sClient := newFakeClient()
+
+	if err := RegisterBrokeredCoordinationTools(registry, k8sClient); err != nil {
+		t.Fatalf("RegisterBrokeredCoordinationTools() error = %v", err)
+	}
+	first := registry.Names()
+	if err := RegisterBrokeredCoordinationTools(registry, k8sClient); err != nil {
+		t.Fatalf("second RegisterBrokeredCoordinationTools() error = %v", err)
+	}
+	if got := registry.Names(); !slices.Equal(got, first) {
+		t.Fatalf("second registration changed names: first=%v second=%v", first, got)
+	}
+
+	want := []string{
+		checkMessagesToolName,
+		delegateTaskToolName,
+		"propose_memory",
+		"recall_memory",
+		"remember",
+		"search_transcript",
+		sendMessageToolName,
+		waitForTasksToolName,
+	}
+	slices.Sort(want)
+	if !slices.Equal(first, want) {
+		t.Fatalf("registered broker tools = %v, want %v", first, want)
+	}
+
+	for _, rejected := range []string{
+		codeExecToolName,
+		fileReadToolName,
+		fileWriteToolName,
+		createContainerTaskToolName,
+		cancelTaskToolName,
+		mergePullRequestToolName,
+		autoMergePullRequestToolName,
+		reviewPullRequestToolName,
+		postReviewCommentToolName,
+		createAgentToolName,
+		deleteAgentToolName,
+		updatePlanToolName,
+	} {
+		if _, ok := registry.Get(rejected); ok {
+			t.Fatalf("unsafe or unsupported broker tool %q was registered", rejected)
+		}
+	}
+}
+
+func TestBrokeredMemoryToolsUseRequestScopedStores(t *testing.T) {
+	t.Setenv(envOrkaControllerURL, "http://controller-env-must-not-be-used.invalid")
+	t.Setenv(envOrkaTaskNamespace, "wrong-namespace")
+	t.Setenv(envOrkaTaskName, "wrong-task")
+
+	memoryStore := &brokerMemoryStore{
+		memories: []store.Memory{{ID: "memory-1", Namespace: brokerTestNamespace, Content: "bounded context"}},
+		transcript: []store.TranscriptSearchResult{{
+			SessionName: "older-session", MessageID: 7, Role: "assistant", Snippet: "bounded context",
+		}},
+	}
+	ctx := WithToolContext(context.Background(), &ToolContext{
+		Brokered:             true,
+		Namespace:            brokerTestNamespace,
+		TaskID:               testTaskAName,
+		AgentName:            brokerTestAgentName,
+		MemoryReader:         memoryStore,
+		MemoryProposalWriter: memoryStore,
+		TranscriptSearcher:   memoryStore,
+	})
+
+	recalled, err := NewRecallMemoryTool().Execute(ctx, json.RawMessage(`{"query":"bounded","tags":["policy"]}`))
+	if err != nil {
+		t.Fatalf("recall_memory Execute() error = %v", err)
+	}
+	if !strings.Contains(recalled, `"id":"memory-1"`) {
+		t.Fatalf("recall_memory result = %s", recalled)
+	}
+	if memoryStore.memoryFilter.Namespace != brokerTestNamespace || memoryStore.memoryFilter.Query != "bounded" || !slices.Equal(memoryStore.memoryFilter.Tags, []string{"policy"}) {
+		t.Fatalf("recall filter = %#v", memoryStore.memoryFilter)
+	}
+
+	if _, err := NewRememberMemoryTool().Execute(ctx, json.RawMessage(`{"content":"Remember request-scoped stores."}`)); err != nil {
+		t.Fatalf("remember Execute() error = %v", err)
+	}
+	if _, err := NewProposeMemoryTool().Execute(ctx, json.RawMessage(`{"title":"Add broker guidance","content":"Use request context."}`)); err != nil {
+		t.Fatalf("propose_memory Execute() error = %v", err)
+	}
+	if len(memoryStore.proposals) != 2 {
+		t.Fatalf("proposal count = %d, want 2", len(memoryStore.proposals))
+	}
+	for _, proposal := range memoryStore.proposals {
+		if proposal.Namespace != brokerTestNamespace || proposal.TaskName != testTaskAName || proposal.AgentName != brokerTestAgentName {
+			t.Fatalf("proposal provenance = %#v", proposal)
+		}
+	}
+	if memoryStore.proposals[0].Type != brokerMemoryProposalType || memoryStore.proposals[1].Type != brokerSkillProposalType {
+		t.Fatalf("proposal types = %q, %q", memoryStore.proposals[0].Type, memoryStore.proposals[1].Type)
+	}
+
+	searched, err := NewSearchTranscriptTool().Execute(ctx, json.RawMessage(`{"query":"bounded","roles":["assistant"]}`))
+	if err != nil {
+		t.Fatalf("search_transcript Execute() error = %v", err)
+	}
+	if !strings.Contains(searched, `"sessionName":"older-session"`) {
+		t.Fatalf("search_transcript result = %s", searched)
+	}
+	if memoryStore.transcriptFilter.Namespace != brokerTestNamespace || memoryStore.transcriptFilter.ExcludeSessionName != testTaskAName || !slices.Equal(memoryStore.transcriptFilter.Roles, []string{"assistant"}) {
+		t.Fatalf("transcript filter = %#v", memoryStore.transcriptFilter)
+	}
+}
+
+func TestBrokeredMemoryToolFailsClosedWithoutRequestStore(t *testing.T) {
+	t.Setenv(envOrkaControllerURL, "http://controller-env-must-not-be-used.invalid")
+	t.Setenv(envOrkaTaskNamespace, "wrong-namespace")
+	t.Setenv(envOrkaTaskName, "wrong-task")
+
+	ctx := WithToolContext(context.Background(), &ToolContext{
+		Brokered:  true,
+		Namespace: brokerTestNamespace,
+		TaskID:    testTaskAName,
+	})
+	_, err := NewRecallMemoryTool().Execute(ctx, json.RawMessage(`{"query":"anything"}`))
+	if err == nil || !strings.Contains(err.Error(), "brokered memory reader is not configured") {
+		t.Fatalf("recall_memory error = %v", err)
+	}
+}
+
+func TestBrokeredDelegateTaskUsesRequestScopedParentContext(t *testing.T) {
+	t.Setenv(envOrkaTaskName, "wrong-parent")
+	t.Setenv(envOrkaTaskNamespace, "wrong-namespace")
+	t.Setenv(envOrkaCoordinationDepth, "9")
+	t.Setenv(envOrkaCoordinationAllowedAgents, "wrong-agent")
+	t.Setenv(envOrkaCoordinationMaxDepth, "1")
+
+	parent := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "parent-task", Namespace: brokerTestNamespace, UID: types.UID("parent-uid"),
+			Annotations: map[string]string{labels.AnnotationCoordinationDepth: "1"},
+		},
+		Spec: corev1alpha1.TaskSpec{
+			Type:     corev1alpha1.TaskTypeAgent,
+			AgentRef: &corev1alpha1.AgentReference{Name: testCoordinatorTaskName},
+		},
+	}
+	coordinator := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: testCoordinatorTaskName, Namespace: brokerTestNamespace},
+		Spec: corev1alpha1.AgentSpec{Coordination: &corev1alpha1.CoordinationConfig{
+			Enabled: true, MaxDepth: 3,
+			AllowedAgents: []corev1alpha1.AllowedAgent{{Name: "researcher"}},
+		}},
+	}
+	researcher := &corev1alpha1.Agent{ObjectMeta: metav1.ObjectMeta{Name: "researcher", Namespace: brokerTestNamespace}}
+	k8sClient := newFakeClient(parent, coordinator, researcher)
+	registry := NewRegistry()
+	if err := RegisterBrokeredCoordinationTools(registry, k8sClient); err != nil {
+		t.Fatal(err)
+	}
+
+	ctx := WithToolContext(context.Background(), &ToolContext{
+		Brokered:  true,
+		Namespace: brokerTestNamespace,
+		TaskID:    "parent-task",
+		TaskUID:   "parent-uid",
+	})
+	result, err := registry.Execute(ctx, delegateTaskToolName, json.RawMessage(`{"agent":"researcher","prompt":"Investigate"}`))
+	if err != nil {
+		t.Fatalf("delegate_task Execute() error = %v", err)
+	}
+	var delegated DelegateTaskResult
+	if err := json.Unmarshal([]byte(result), &delegated); err != nil {
+		t.Fatalf("decode delegate result: %v", err)
+	}
+	child := &corev1alpha1.Task{}
+	if err := k8sClient.Get(context.Background(), types.NamespacedName{Namespace: brokerTestNamespace, Name: delegated.TaskName}, child); err != nil {
+		t.Fatalf("get child task: %v", err)
+	}
+	if child.Annotations[labels.AnnotationCoordinationDepth] != "2" {
+		t.Fatalf("child depth = %q, want 2", child.Annotations[labels.AnnotationCoordinationDepth])
+	}
+	if got := labels.ParentTaskName(child.Labels, child.Annotations); got != "parent-task" {
+		t.Fatalf("child parent = %q, want parent-task", got)
+	}
+}
+
+type recordingBrokeredDelegateExchanger struct {
+	requests []contexttoken.ExchangeRequest
+	token    string
+	err      error
+}
+
+func (e *recordingBrokeredDelegateExchanger) Exchange(_ context.Context, request contexttoken.ExchangeRequest) (string, error) {
+	e.requests = append(e.requests, request)
+	return e.token, e.err
+}
+
+func brokeredDelegateFixtures(transactional bool) (*corev1alpha1.Task, *corev1alpha1.Agent, *corev1alpha1.Agent) {
+	parent := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "parent-task", Namespace: brokerTestNamespace, UID: types.UID("parent-uid"),
+			Annotations: map[string]string{labels.AnnotationCoordinationDepth: "0"},
+		},
+		Spec: corev1alpha1.TaskSpec{
+			Type:     corev1alpha1.TaskTypeAgent,
+			AgentRef: &corev1alpha1.AgentReference{Name: testCoordinatorTaskName},
+		},
+	}
+	if transactional {
+		parent.Spec.Transaction = &corev1alpha1.TaskTransaction{
+			Profile: transactiontoken.ProfileName,
+			ID:      parentTransactionID,
+			Scope:   brokerDelegateTransactionScope + " " + childTransactionScope,
+			Scopes:  []string{brokerDelegateTransactionScope, childTransactionScope},
+		}
+	}
+	coordinator := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: testCoordinatorTaskName, Namespace: brokerTestNamespace},
+		Spec: corev1alpha1.AgentSpec{Coordination: &corev1alpha1.CoordinationConfig{
+			Enabled: true, MaxDepth: 3,
+			AllowedAgents: []corev1alpha1.AllowedAgent{
+				{Name: "researcher"},
+				{Name: "researcher", Namespace: "other-team"},
+			},
+		}},
+	}
+	researcher := &corev1alpha1.Agent{ObjectMeta: metav1.ObjectMeta{Name: "researcher", Namespace: brokerTestNamespace}}
+	return parent, coordinator, researcher
+}
+
+func TestBrokeredDelegateTaskEnforcesNamespaceScopeBeforeResourceAccess(t *testing.T) {
+	tests := []struct {
+		name          string
+		toolContext   ToolContext
+		arguments     string
+		wantErrorPart string
+	}{
+		{
+			name: "watch namespace rejects child Task namespace",
+			toolContext: ToolContext{
+				WatchNamespace: brokerTestNamespace,
+			},
+			arguments:     `{"agent":"researcher","agentNamespace":"team-a","taskNamespace":"other-team","prompt":"Investigate"}`,
+			wantErrorPart: `child Task namespace "other-team" is outside watched namespace "team-a"`,
+		},
+		{
+			name: "watch namespace rejects target Agent namespace",
+			toolContext: ToolContext{
+				WatchNamespace: brokerTestNamespace,
+			},
+			arguments:     `{"agent":"researcher","agentNamespace":"other-team","taskNamespace":"team-a","prompt":"Investigate"}`,
+			wantErrorPart: `target Agent namespace "other-team" is outside watched namespace "team-a"`,
+		},
+		{
+			name: "namespace isolation rejects child Task namespace",
+			toolContext: ToolContext{
+				EnforceNamespaceIsolation: true,
+			},
+			arguments:     `{"agent":"researcher","agentNamespace":"team-a","taskNamespace":"other-team","prompt":"Investigate"}`,
+			wantErrorPart: `child Task namespace "other-team" is outside request namespace "team-a"`,
+		},
+		{
+			name: "namespace isolation rejects target Agent namespace",
+			toolContext: ToolContext{
+				EnforceNamespaceIsolation: true,
+			},
+			arguments:     `{"agent":"researcher","agentNamespace":"other-team","taskNamespace":"team-a","prompt":"Investigate"}`,
+			wantErrorPart: `target Agent namespace "other-team" is outside request namespace "team-a"`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			parent, coordinator, _ := brokeredDelegateFixtures(false)
+			k8sClient := newFakeClient(parent, coordinator)
+			registry := NewRegistry()
+			if err := RegisterBrokeredCoordinationTools(registry, k8sClient); err != nil {
+				t.Fatal(err)
+			}
+			tt.toolContext.Brokered = true
+			tt.toolContext.Namespace = brokerTestNamespace
+			tt.toolContext.TaskID = parent.Name
+			tt.toolContext.TaskUID = string(parent.UID)
+			ctx := WithToolContext(context.Background(), &tt.toolContext)
+
+			_, err := registry.Execute(ctx, delegateTaskToolName, json.RawMessage(tt.arguments))
+			if err == nil || !strings.Contains(err.Error(), tt.wantErrorPart) {
+				t.Fatalf("delegate_task error = %v, want containing %q", err, tt.wantErrorPart)
+			}
+			if strings.Contains(err.Error(), "failed to get agent") {
+				t.Fatalf("delegate_task loaded the target Agent before enforcing namespace scope: %v", err)
+			}
+			tasks := &corev1alpha1.TaskList{}
+			if err := k8sClient.List(context.Background(), tasks); err != nil {
+				t.Fatal(err)
+			}
+			if len(tasks.Items) != 1 || tasks.Items[0].Name != parent.Name {
+				t.Fatalf("unexpected Task mutation after namespace rejection: %#v", tasks.Items)
+			}
+		})
+	}
+}
+
+func TestBrokeredDelegateTaskUsesRegisteredControllerTTSConfiguration(t *testing.T) {
+	// Worker-only environment must not influence brokered execution.
+	t.Setenv("ORKA_CONTEXT_TOKEN_TTS_ENDPOINT", "http://worker-env-must-not-be-used.invalid/token")
+	t.Setenv("ORKA_CONTEXT_TOKEN_CHILD_SCOPE", "orka:admin")
+
+	parent, coordinator, researcher := brokeredDelegateFixtures(true)
+	k8sClient := newFakeClient(parent, coordinator, researcher)
+	registry := NewRegistry()
+	if err := RegisterBrokeredCoordinationTools(registry, k8sClient); err != nil {
+		t.Fatal(err)
+	}
+	exchanger := &recordingBrokeredDelegateExchanger{token: "child-transaction-token"}
+	resolverCalls := 0
+	if err := RegisterBrokeredDelegateTaskTool(registry, k8sClient, BrokeredDelegateTaskTransactionExchangeConfig{
+		TTS: contexttoken.TTSConfig{
+			Endpoint: "https://controller-tts.example.test/oauth/token", TokenSource: contexttoken.TTSTokenSourceIncoming,
+			ChildTokenTTL: 2 * time.Minute,
+		},
+		Exchanger:        exchanger,
+		SubjectTokenType: transactiontoken.SubjectTokenTypeTransactionToken,
+		ChildScope:       childTransactionScope,
+		ResolveSubjectToken: func(_ context.Context, gotParent *corev1alpha1.Task, tokenSource string) (string, error) {
+			resolverCalls++
+			if gotParent.Name != parent.Name || gotParent.UID != parent.UID {
+				t.Fatalf("resolver parent = %s/%s uid=%s, want %s/%s uid=%s", gotParent.Namespace, gotParent.Name, gotParent.UID, parent.Namespace, parent.Name, parent.UID)
+			}
+			if tokenSource != contexttoken.TTSTokenSourceIncoming {
+				t.Fatalf("resolver token source = %q, want incoming", tokenSource)
+			}
+			return parentTransactionToken, nil
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	ctx := WithToolContext(context.Background(), &ToolContext{
+		Brokered: true, Namespace: brokerTestNamespace, TaskID: parent.Name, TaskUID: string(parent.UID),
+	})
+	result, err := registry.Execute(ctx, delegateTaskToolName, json.RawMessage(`{"agent":"researcher","prompt":"Investigate"}`))
+	if err != nil {
+		t.Fatalf("delegate_task Execute() error = %v", err)
+	}
+	if resolverCalls != 1 {
+		t.Fatalf("subject-token resolver calls = %d, want 1", resolverCalls)
+	}
+	if len(exchanger.requests) != 1 {
+		t.Fatalf("TTS exchange requests = %d, want 1", len(exchanger.requests))
+	}
+	request := exchanger.requests[0]
+	if request.SubjectToken != parentTransactionToken || request.Scope != childTransactionScope || request.RequestedTTL != 2*time.Minute {
+		t.Fatalf("TTS exchange request = %#v", request)
+	}
+	if request.SubjectTokenType != transactiontoken.SubjectTokenTypeTransactionToken {
+		t.Fatalf("subject token type = %q", request.SubjectTokenType)
+	}
+
+	var delegated DelegateTaskResult
+	if err := json.Unmarshal([]byte(result), &delegated); err != nil {
+		t.Fatal(err)
+	}
+	child := &corev1alpha1.Task{}
+	if err := k8sClient.Get(context.Background(), types.NamespacedName{Namespace: brokerTestNamespace, Name: delegated.TaskName}, child); err != nil {
+		t.Fatal(err)
+	}
+	secretName := child.Annotations[labels.AnnotationTransactionTokenSecret]
+	if secretName == "" {
+		t.Fatal("delegated child is missing transaction-token Secret annotation")
+	}
+	secret := &corev1.Secret{}
+	if err := k8sClient.Get(context.Background(), types.NamespacedName{Namespace: brokerTestNamespace, Name: secretName}, secret); err != nil {
+		t.Fatal(err)
+	}
+	if got := string(secret.Data["token"]); got != "child-transaction-token" {
+		t.Fatalf("child transaction token = %q, want exchanged token", got)
+	}
+	if len(secret.OwnerReferences) != 1 || secret.OwnerReferences[0].UID != child.UID {
+		t.Fatalf("child transaction-token Secret owner = %#v, want child uid %s", secret.OwnerReferences, child.UID)
+	}
+}
+
+func TestBrokeredDelegateTaskFailsClosedWithoutRegisteredTTSConfiguration(t *testing.T) {
+	parent, coordinator, researcher := brokeredDelegateFixtures(true)
+	k8sClient := newFakeClient(parent, coordinator, researcher)
+	registry := NewRegistry()
+	if err := RegisterBrokeredCoordinationTools(registry, k8sClient); err != nil {
+		t.Fatal(err)
+	}
+	ctx := WithToolContext(context.Background(), &ToolContext{
+		Brokered: true, Namespace: brokerTestNamespace, TaskID: parent.Name, TaskUID: string(parent.UID),
+	})
+
+	_, err := registry.Execute(ctx, delegateTaskToolName, json.RawMessage(`{"agent":"researcher","prompt":"Investigate"}`))
+	if err == nil || !strings.Contains(err.Error(), "transaction-token exchange configuration is not registered") {
+		t.Fatalf("delegate_task error = %v, want missing brokered TTS configuration", err)
+	}
+	tasks := &corev1alpha1.TaskList{}
+	if err := k8sClient.List(context.Background(), tasks); err != nil {
+		t.Fatal(err)
+	}
+	if len(tasks.Items) != 1 || tasks.Items[0].Name != parent.Name {
+		t.Fatalf("unexpected Task mutation after brokered TTS failure: %#v", tasks.Items)
+	}
+}
diff --git a/internal/tools/chat_create_agent.go b/internal/tools/chat_create_agent.go
index ee0427031..1ac9b774b 100644
--- a/internal/tools/chat_create_agent.go
+++ b/internal/tools/chat_create_agent.go
@@ -12,15 +12,14 @@ import (
 	"fmt"
 	"strings"
 	"time"
-	"unicode"
 
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/executionmode"
 	"github.com/orka-agents/orka/internal/labels"
 	"github.com/orka-agents/orka/internal/tracing"
 )
@@ -35,16 +34,18 @@ func (t *ChatCreateAgentTool) Description() string {
 }
 
 func (t *ChatCreateAgentTool) Parameters() json.RawMessage {
-	return mustMarshalSchema(map[string]any{jsonSchemaTypeField: jsonSchemaTypeObject, jsonSchemaPropertiesField: map[string]any{nameField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: agentNameDescription}, namespaceField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: namespaceDescription}, providerRefField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Optional Provider CRD reference name. Omit for runtime Agents; provide explicitly for AI/coordinator Agents when a specific provider is required."}, systemPromptField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "System prompt for the agent"}, toolsField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeArray, itemsField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString}, jsonSchemaDescriptionField: "Tool names to attach"}, "resources": map[string]any{jsonSchemaTypeField: jsonSchemaTypeObject, jsonSchemaDescriptionField: `Optional Kubernetes resource requests/limits for tasks using this agent, e.g. {requests:{cpu:"100m",memory:"512Mi"},limits:{cpu:"1",memory:"2Gi"}}`, jsonSchemaPropertiesField: map[string]any{
+	return mustMarshalSchema(map[string]any{jsonSchemaTypeField: jsonSchemaTypeObject, jsonSchemaPropertiesField: map[string]any{nameField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: agentNameDescription}, namespaceField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: namespaceDescription}, providerRefField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Optional Provider CRD reference name. Omit for runtime Agents; provide explicitly for AI/coordinator Agents when a specific provider is required."}, systemPromptField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "System prompt for the agent. Omit for OpenCode runtime Agents because OpenCode cannot enforce Agent system prompts; use initialPrompt or Task prompts instead."}, toolsField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeArray, itemsField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString}, jsonSchemaDescriptionField: "Tool names to attach"}, "resources": map[string]any{jsonSchemaTypeField: jsonSchemaTypeObject, jsonSchemaDescriptionField: `Optional Kubernetes resource requests/limits for tasks using this agent, e.g. {requests:{cpu:"100m",memory:"512Mi"},limits:{cpu:"1",memory:"2Gi"}}`, jsonSchemaPropertiesField: map[string]any{
 		"requests": map[string]any{jsonSchemaTypeField: jsonSchemaTypeObject, "additionalProperties": map[string]any{jsonSchemaTypeField: jsonSchemaTypeString}},
 		"limits":   map[string]any{jsonSchemaTypeField: jsonSchemaTypeObject, "additionalProperties": map[string]any{jsonSchemaTypeField: jsonSchemaTypeString}},
 	},
-	}, modelField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeObject, jsonSchemaDescriptionField: "Model configuration; model.name is required for OpenCode runtimes", jsonSchemaPropertiesField: map[string]any{
-		"provider": map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Model provider (e.g. anthropic, openai)"}, nameField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Model name; required endpoint model ID for OpenCode"}, "temperature": map[string]any{jsonSchemaTypeField: "number", jsonSchemaDescriptionField: "Sampling temperature"},
+	}, modelField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeObject, jsonSchemaDescriptionField: "Model configuration; OpenCode requires a literal provider/model name plus reviewed contextWindow and maxTokens", jsonSchemaPropertiesField: map[string]any{
+		"provider": map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Model provider (e.g. anthropic, openai)"}, nameField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Model name; OpenCode requires a literal provider/model ID"}, "temperature": map[string]any{jsonSchemaTypeField: "number", "minimum": 0, "maximum": 2, jsonSchemaDescriptionField: "Sampling temperature. OpenCode only accepts the legacy default 0.7."},
+		"contextWindow": map[string]any{jsonSchemaTypeField: jsonSchemaTypeInteger, "minimum": 1, jsonSchemaDescriptionField: "Reviewed model context capacity; required for OpenCode"},
+		"maxTokens":     map[string]any{jsonSchemaTypeField: jsonSchemaTypeInteger, "minimum": 1, jsonSchemaDescriptionField: "Reviewed maximum output tokens; required for OpenCode"},
 	},
-	}, runtimeField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeObject, jsonSchemaPropertiesField: map[string]any{jsonSchemaTypeField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Runtime type: copilot, claude, codex, or opencode"}, "defaultMaxTurns": map[string]any{jsonSchemaTypeField: jsonSchemaTypeInteger, jsonSchemaDescriptionField: "Default max agent loop iterations"},
-		"defaultAllowedTools": map[string]any{jsonSchemaTypeField: jsonSchemaTypeArray, itemsField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString}, jsonSchemaDescriptionField: "Default CLI tools allowed for tasks using this runtime agent"},
-		"defaultAllowBash":    map[string]any{jsonSchemaTypeField: jsonSchemaTypeBoolean, jsonSchemaDescriptionField: "Whether bash is allowed by default for tasks using this runtime agent"}, secretRefField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Optional secret name containing runtime credentials. Omit to auto-discover the standard secret for this runtime."},
+	}, runtimeField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeObject, jsonSchemaDescriptionField: "CLI runtime configuration. OpenCode uses the built-in ACP RuntimePool profile and controller provider proxy.", jsonSchemaPropertiesField: map[string]any{jsonSchemaTypeField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Runtime type: copilot, claude, codex, or opencode"}, "defaultMaxTurns": map[string]any{jsonSchemaTypeField: jsonSchemaTypeInteger, jsonSchemaDescriptionField: "Default max agent loop iterations"},
+		"defaultAllowedTools": map[string]any{jsonSchemaTypeField: jsonSchemaTypeArray, itemsField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString}, jsonSchemaDescriptionField: "Default CLI tools allowed for tasks using this runtime agent. OpenCode defaults to Read, Write, Edit, Bash, Glob, and Grep when omitted."},
+		"defaultAllowBash":    map[string]any{jsonSchemaTypeField: jsonSchemaTypeBoolean, jsonSchemaDescriptionField: "Whether bash is allowed by default for tasks using this runtime agent. OpenCode defaults to true when omitted."}, secretRefField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Deprecated legacy field. Built-in ACP runtimes are credential-free at the Agent boundary; OpenCode rejects it."},
 	},
 	}, "initialPrompt": map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "When provided, automatically create and start a Task using this agent with this prompt. One tool call = agent + task. Leave empty to only create the agent config without running it."},
 		"coordination": map[string]any{jsonSchemaTypeField: jsonSchemaTypeObject, jsonSchemaDescriptionField: "Enable multi-agent coordination so this agent can delegate tasks to other agents via delegate_task/wait_for_tasks tools", jsonSchemaPropertiesField: map[string]any{
@@ -98,30 +99,35 @@ func (t *ChatCreateAgentTool) Execute(ctx context.Context, args json.RawMessage)
 		case map[string]any:
 			name := chatGetStringArg(m, nameField)
 			provider := chatGetStringArg(m, "provider")
-			if chatRuntimeTypeArg(a) == corev1alpha1.AgentRuntimeOpencode {
-				name = strings.TrimSpace(name)
-				provider = strings.TrimFunc(provider, func(r rune) bool {
-					return r == '/' || unicode.IsSpace(r)
-				})
-				if name != "" && provider != "" {
-					providerPrefix := provider + "/"
-					if !strings.HasPrefix(name, providerPrefix) {
-						name = providerPrefix + strings.TrimPrefix(name, "/")
-					}
-				}
-				provider = ""
-			}
 			agent.Spec.Model = &corev1alpha1.ModelConfig{Name: name, Provider: provider}
 			if temp, ok := m["temperature"]; ok {
 				if tempF, ok := temp.(float64); ok {
 					agent.Spec.Model.Temperature = &tempF
 				}
 			}
-		case string:
-			if chatRuntimeTypeArg(a) == corev1alpha1.AgentRuntimeOpencode {
-				agent.Spec.Model = &corev1alpha1.ModelConfig{Name: m}
-				break
+			if raw, supplied := m["contextWindow"]; supplied {
+				contextWindow, err := parsePositiveAgentModelInt32("model.contextWindow", raw)
+				if err != nil {
+					return ChatToolErrorResult(
+						"invalid_arguments",
+						err.Error(),
+						"Use a positive whole-number model.contextWindow within the 32-bit integer range.",
+					)
+				}
+				agent.Spec.Model.ContextWindow = &contextWindow
 			}
+			if raw, supplied := m["maxTokens"]; supplied {
+				maxTokens, err := parsePositiveAgentModelInt32("model.maxTokens", raw)
+				if err != nil {
+					return ChatToolErrorResult(
+						"invalid_arguments",
+						err.Error(),
+						"Use a positive whole-number model.maxTokens within the 32-bit integer range.",
+					)
+				}
+				agent.Spec.Model.MaxTokens = &maxTokens
+			}
+		case string:
 			provider, modelName := splitModelString(m)
 			if provider != "" {
 				agent.Spec.Model = &corev1alpha1.ModelConfig{Provider: provider, Name: modelName}
@@ -158,9 +164,16 @@ func (t *ChatCreateAgentTool) Execute(ctx context.Context, args json.RawMessage)
 		agent.Spec.Resources = resources
 	}
 
-	if errResult, ok := parseRuntimeConfig(ctx, tc.Client, namespace, a, agent); !ok {
+	if errResult, ok := parseRuntimeConfig(a, agent); !ok {
 		return errResult, nil
 	}
+	if err := executionmode.DefaultBuiltInAgentContract(agent, tc.ExecutionMode); err != nil {
+		return ChatToolErrorResult(
+			"invalid_arguments",
+			err.Error(),
+			"Use the built-in runtime contract selected by this Orka installation.",
+		)
+	}
 	parseCoordinationConfig(a, agent)
 
 	if result, ok := authorizeAgentCreate(ctx, tc, agent); !ok {
@@ -292,16 +305,8 @@ func parseResourceListArg(resourcesMap map[string]any, key string) (corev1.Resou
 	return resourceList, "", true
 }
 
-func chatRuntimeTypeArg(a map[string]any) corev1alpha1.AgentRuntimeType {
-	runtimeArgs, ok := a[runtimeField].(map[string]any)
-	if !ok {
-		return ""
-	}
-	return corev1alpha1.AgentRuntimeType(chatGetStringArg(runtimeArgs, jsonSchemaTypeField))
-}
-
 // parseRuntimeConfig extracts runtime configuration from chat args into the agent spec.
-func parseRuntimeConfig(ctx context.Context, k8sClient client.Reader, namespace string, a map[string]any, agent *corev1alpha1.Agent) (string, bool) {
+func parseRuntimeConfig(a map[string]any, agent *corev1alpha1.Agent) (string, bool) {
 	if coord, ok := a["coordination"].(map[string]any); ok {
 		if enabled, ok := coord[enabledString].(bool); ok && enabled {
 			return "", true
@@ -315,23 +320,54 @@ func parseRuntimeConfig(ctx context.Context, k8sClient client.Reader, namespace
 	if !ok {
 		return "", true
 	}
-	runtimeType := chatGetStringArg(rtMap, jsonSchemaTypeField)
+	runtimeType := strings.TrimSpace(chatGetStringArg(rtMap, jsonSchemaTypeField))
 	if runtimeType == "" {
-		return "", true
+		result, _ := ChatToolErrorResult(
+			"invalid_arguments",
+			"runtime.type is required when runtime is provided",
+			"Use one of the built-in ACP runtimes: copilot, claude, codex, or opencode.",
+		)
+		return result, false
 	}
-	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{
-		Type: corev1alpha1.AgentRuntimeType(runtimeType),
+	resolvedRuntimeType := corev1alpha1.AgentRuntimeType(runtimeType)
+	if !isBuiltInACPRuntime(resolvedRuntimeType) {
+		result, _ := ChatToolErrorResult(
+			"invalid_arguments",
+			fmt.Sprintf("unsupported runtime type %q", runtimeType),
+			"Use one of the built-in ACP runtimes: copilot, claude, codex, or opencode.",
+		)
+		return result, false
 	}
-	if agent.Spec.Runtime.Type == corev1alpha1.AgentRuntimeOpencode {
-		if agent.Spec.Model == nil || strings.TrimSpace(agent.Spec.Model.Name) == "" {
+	if err := validateBuiltInRuntimeModelLimits(resolvedRuntimeType, agent.Spec.Model); err != nil {
+		result, _ := ChatToolErrorResult(
+			"invalid_arguments",
+			err.Error(),
+			"Remove contextWindow/maxTokens for Codex, Claude, or Copilot; those reviewed limits are OpenCode-only.",
+		)
+		return result, false
+	}
+	if resolvedRuntimeType == corev1alpha1.AgentRuntimeOpencode {
+		if agent.Spec.SystemPrompt != nil && strings.TrimSpace(agent.Spec.SystemPrompt.Inline) != "" {
+			result, _ := ChatToolErrorResult(
+				"invalid_arguments",
+				"opencode runtime does not support systemPrompt",
+				"Omit systemPrompt for OpenCode Agents and use initialPrompt or Task prompts for instructions.",
+			)
+			return result, false
+		}
+		if secretRef := strings.TrimSpace(chatGetStringArg(rtMap, secretRefField)); secretRef != "" {
 			result, _ := ChatToolErrorResult(
 				"invalid_arguments",
-				"model.name is required for opencode runtime",
-				"Set model.name to the endpoint-specific OpenCode model ID.",
+				"opencode runtime does not accept runtime.secretRef; provider access is controller-proxied",
+				"Remove runtime.secretRef for OpenCode Agents.",
 			)
 			return result, false
 		}
+		if result, ok := normalizeChatOpenCodeModel(agent); !ok {
+			return result, false
+		}
 	}
+	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{Type: resolvedRuntimeType}
 	if agent.Spec.Model != nil {
 		agent.Spec.Model.Provider = ""
 	}
@@ -339,28 +375,29 @@ func parseRuntimeConfig(ctx context.Context, k8sClient client.Reader, namespace
 		maxTurnsInt := int32(maxTurns)
 		agent.Spec.Runtime.DefaultMaxTurns = &maxTurnsInt
 	}
-	if allowedTools := chatGetStringSliceArg(rtMap, "defaultAllowedTools"); len(allowedTools) > 0 {
-		agent.Spec.Runtime.DefaultAllowedTools = allowedTools
+	_, allowedToolsSupplied := rtMap["defaultAllowedTools"]
+	if allowedToolsSupplied {
+		agent.Spec.Runtime.DefaultAllowedTools = chatGetStringSliceArg(rtMap, "defaultAllowedTools")
 	}
+	_, allowBashSupplied := rtMap["defaultAllowBash"]
 	if allowBash, ok := rtMap["defaultAllowBash"].(bool); ok {
 		agent.Spec.Runtime.DefaultAllowBash = &allowBash
 	}
-	secretRef, err := resolveRuntimeSecretRef(ctx, k8sClient, namespace, agent.Spec.Runtime.Type, chatGetRuntimeSecretRefArg(a))
-	if err != nil {
-		result, _ := ChatToolErrorResult("invalid_arguments", err.Error(), "Create one of the supported runtime credential secrets or choose an AI agent without runtime")
-		return result, false
-	}
-	agent.Spec.SecretRef = secretRef
+	applyOpencodeRuntimeDefaults(agent.Spec.Runtime, allowedToolsSupplied, allowBashSupplied)
+	agent.Spec.SecretRef = nil
 	agent.Spec.ProviderRef = nil
 	return "", true
 }
 
-func chatGetRuntimeSecretRefArg(a map[string]any) string {
-	rt, ok := a[runtimeField].(map[string]any)
-	if !ok {
-		return ""
+func normalizeChatOpenCodeModel(agent *corev1alpha1.Agent) (string, bool) {
+	providerID, modelID, specErr := validateOpenCodeModelSpec(agent.Spec.Model)
+	if specErr != nil {
+		result, _ := ChatToolErrorResult("invalid_arguments", specErr.message, specErr.hint)
+		return result, false
 	}
-	return chatGetStringArg(rt, secretRefField)
+	agent.Spec.Model.Name = providerID + "/" + modelID
+	agent.Spec.Model.Provider = ""
+	return "", true
 }
 
 // parseCoordinationConfig extracts coordination configuration from chat args into the agent spec.
diff --git a/internal/tools/chat_create_agent_test.go b/internal/tools/chat_create_agent_test.go
index 10e22e581..d0effe1b1 100644
--- a/internal/tools/chat_create_agent_test.go
+++ b/internal/tools/chat_create_agent_test.go
@@ -9,25 +9,35 @@ package tools
 import (
 	"context"
 	"encoding/json"
+	"slices"
 	"strings"
 	"testing"
 
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
-	"github.com/orka-agents/orka/internal/workerenv"
+	"github.com/orka-agents/orka/internal/executionmode"
 )
 
 const testProviderOpenAI = "openai"
 
+func TestChatCreateAgentTool_ParametersDescribeOpenCodeACP(t *testing.T) {
+	params := string((&ChatCreateAgentTool{}).Parameters())
+	for _, want := range []string{"copilot, claude, codex, or opencode", "OpenCode defaults to Read, Write, Edit, Bash, Glob, and Grep", "OpenCode defaults to true", "Omit for OpenCode runtime Agents"} {
+		if !strings.Contains(params, want) {
+			t.Errorf("Parameters() missing %q", want)
+		}
+	}
+}
+
 func TestChatCreateAgentTool_Execute_OmittedProviderRefLeavesNil(t *testing.T) {
 	fc := newFakeClient()
 	ctx := WithToolContext(context.Background(), &ToolContext{
-		Client:    fc,
-		Namespace: defaultNamespace,
+		Client:        fc,
+		Namespace:     defaultNamespace,
+		ExecutionMode: executionmode.HarnessV2,
 	})
 
 	tool := &ChatCreateAgentTool{}
@@ -63,68 +73,66 @@ func TestChatCreateAgentTool_Execute_OmittedProviderRefLeavesNil(t *testing.T) {
 	}
 }
 
-func TestChatCreateAgentTool_Execute_PreservesSlashQualifiedOpencodeModel(t *testing.T) {
-	secret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: "opencode-credentials", Namespace: defaultNamespace},
-		Data: map[string][]byte{
-			workerenv.OpenAIBaseURL: []byte("https://models.example.invalid/v1"),
-			workerenv.OpenAIAPIKey:  []byte("credential"),
-		},
-	}
-	fc := newFakeClient(secret)
-	ctx := WithToolContext(context.Background(), &ToolContext{
-		Client:    fc,
-		Namespace: defaultNamespace,
-	})
-
-	tool := &ChatCreateAgentTool{}
-	result, err := tool.Execute(ctx, json.RawMessage(`{
-		"name":"opencode-slash-model",
-		"model":"moonshotai/Kimi-K2-Instruct-0905",
+func TestChatCreateAgentTool_Execute_RejectsOpenCodeSystemPrompt(t *testing.T) {
+	fc := newFakeClient()
+	ctx := WithToolContext(context.Background(), &ToolContext{Client: fc, Namespace: defaultNamespace, ExecutionMode: executionmode.HarnessV2})
+	result, err := (&ChatCreateAgentTool{}).Execute(ctx, json.RawMessage(`{
+		"name":"opencode-prompt-agent",
+		"systemPrompt":"You write code",
+		"model":{"name":"openai/gpt-5.4","contextWindow":32768,"maxTokens":4096},
 		"runtime":{"type":"opencode"}
 	}`))
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
-
 	var response ChatToolResult
 	if err := json.Unmarshal([]byte(result), &response); err != nil {
 		t.Fatalf("failed to parse result: %v", err)
 	}
-	if !response.Success {
-		t.Fatalf("expected success, got error: %s", response.Error)
+	if response.Success || response.ErrorType != errTypeInvalidArgs || !strings.Contains(response.Error, "does not support systemPrompt") {
+		t.Fatalf("response = %#v, want OpenCode systemPrompt rejection", response)
 	}
-
 	var created corev1alpha1.Agent
-	if err := fc.Get(context.Background(), client.ObjectKey{Name: "opencode-slash-model", Namespace: defaultNamespace}, &created); err != nil {
-		t.Fatalf("failed to get created agent: %v", err)
-	}
-	if created.Spec.Model == nil || created.Spec.Model.Name != "moonshotai/Kimi-K2-Instruct-0905" || created.Spec.Model.Provider != "" {
-		t.Fatalf("model = %#v, want exact slash-qualified OpenCode model", created.Spec.Model)
+	if err := fc.Get(context.Background(), client.ObjectKey{Name: "opencode-prompt-agent", Namespace: defaultNamespace}, &created); !apierrors.IsNotFound(err) {
+		t.Fatalf("invalid OpenCode Agent should not be created, get err=%v", err)
 	}
 }
 
-func TestChatCreateAgentTool_Execute_PreservesObjectOpencodeModel(t *testing.T) {
-	secret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: "opencode-credentials", Namespace: defaultNamespace},
-		Data: map[string][]byte{
-			workerenv.OpenAIBaseURL: []byte("https://models.example.invalid/v1"),
-			workerenv.OpenAIAPIKey:  []byte("credential"),
-		},
+func TestChatCreateAgentTool_Execute_RejectsUnsupportedOpenCodeTemperature(t *testing.T) {
+	fc := newFakeClient()
+	ctx := WithToolContext(context.Background(), &ToolContext{Client: fc, Namespace: defaultNamespace, ExecutionMode: executionmode.HarnessV2})
+	result, err := (&ChatCreateAgentTool{}).Execute(ctx, json.RawMessage(`{
+		"name":"opencode-temperature-agent",
+		"model":{"name":"openai/gpt-5.4","temperature":1,"contextWindow":32768,"maxTokens":4096},
+		"runtime":{"type":"opencode"}
+	}`))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
 	}
-	fc := newFakeClient(secret)
-	ctx := WithToolContext(context.Background(), &ToolContext{Client: fc, Namespace: defaultNamespace})
+	var response ChatToolResult
+	if err := json.Unmarshal([]byte(result), &response); err != nil {
+		t.Fatalf("failed to parse result: %v", err)
+	}
+	if response.Success || response.ErrorType != errTypeInvalidArgs || !strings.Contains(response.Error, "temperature") {
+		t.Fatalf("response = %#v, want unsupported OpenCode temperature rejection", response)
+	}
+	var created corev1alpha1.Agent
+	if err := fc.Get(context.Background(), client.ObjectKey{Name: "opencode-temperature-agent", Namespace: defaultNamespace}, &created); !apierrors.IsNotFound(err) {
+		t.Fatalf("invalid OpenCode Agent should not be created, get err=%v", err)
+	}
+}
 
-	tool := &ChatCreateAgentTool{}
-	result, err := tool.Execute(ctx, json.RawMessage(`{
-		"name":"opencode-object-model",
-		"model":{"provider":"google","name":"google/gemma-3n-e4b"},
+func TestChatCreateAgentTool_Execute_AcceptsLegacyOpenCodeTemperature(t *testing.T) {
+	fc := newFakeClient()
+	ctx := WithToolContext(context.Background(), &ToolContext{Client: fc, Namespace: defaultNamespace, ExecutionMode: executionmode.HarnessV2})
+	result, err := (&ChatCreateAgentTool{}).Execute(ctx, json.RawMessage(`{
+		"name":"opencode-legacy-temperature-agent",
+		"model":{"name":"openai/gpt-5.4","temperature":0.7,"contextWindow":32768,"maxTokens":4096},
 		"runtime":{"type":"opencode"}
 	}`))
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
-
 	var response ChatToolResult
 	if err := json.Unmarshal([]byte(result), &response); err != nil {
 		t.Fatalf("failed to parse result: %v", err)
@@ -132,158 +140,203 @@ func TestChatCreateAgentTool_Execute_PreservesObjectOpencodeModel(t *testing.T)
 	if !response.Success {
 		t.Fatalf("expected success, got error: %s", response.Error)
 	}
-
 	var created corev1alpha1.Agent
-	if err := fc.Get(context.Background(), client.ObjectKey{Name: "opencode-object-model", Namespace: defaultNamespace}, &created); err != nil {
-		t.Fatalf("failed to get created agent: %v", err)
+	if err := fc.Get(context.Background(), client.ObjectKey{Name: "opencode-legacy-temperature-agent", Namespace: defaultNamespace}, &created); err != nil {
+		t.Fatalf("failed to get created Agent: %v", err)
 	}
-	if created.Spec.Model == nil || created.Spec.Model.Name != "google/gemma-3n-e4b" || created.Spec.Model.Provider != "" {
-		t.Fatalf("model = %#v, want reconstructed slash-qualified OpenCode model", created.Spec.Model)
+	if created.Spec.Model == nil || created.Spec.Model.Temperature == nil || *created.Spec.Model.Temperature != 0.7 {
+		t.Fatalf("model.temperature = %#v, want legacy value 0.7", created.Spec.Model)
 	}
 }
 
-func TestChatCreateAgentTool_Execute_NormalizesObjectOpencodeModel(t *testing.T) {
-	tests := []struct {
+func TestChatCreateAgentTool_Execute_RejectsFractionalOpenCodeModelLimits(t *testing.T) {
+	for _, tc := range []struct {
 		name      string
 		agentName string
-		provider  string
-		modelName string
-		wantName  string
+		args      json.RawMessage
+		wantField string
 	}{
 		{
-			name:      "padded name and provider",
-			agentName: "opencode-padded-model",
-			provider:  " / /google/ / ",
-			modelName: " gemma-3n-e4b ",
-			wantName:  "google/gemma-3n-e4b",
-		},
-		{
-			name:      "whitespace provider",
-			agentName: "opencode-whitespace-provider",
-			provider:  " \t\n ",
-			modelName: " gemma-3n-e4b ",
-			wantName:  "gemma-3n-e4b",
+			name:      "context window",
+			agentName: "fractional-context-window",
+			args: json.RawMessage(`{
+				"name":"fractional-context-window",
+				"model":{"name":"openai/gpt-5.4","contextWindow":32768.5,"maxTokens":4096},
+				"runtime":{"type":"opencode"}
+			}`),
+			wantField: "model.contextWindow",
 		},
 		{
-			name:      "slash-only provider",
-			agentName: "opencode-slash-only-provider",
-			provider:  " / / / ",
-			modelName: "gemma-3n-e4b",
-			wantName:  "gemma-3n-e4b",
+			name:      "max tokens",
+			agentName: "fractional-max-tokens",
+			args: json.RawMessage(`{
+				"name":"fractional-max-tokens",
+				"model":{"name":"openai/gpt-5.4","contextWindow":32768,"maxTokens":4096.5},
+				"runtime":{"type":"opencode"}
+			}`),
+			wantField: "model.maxTokens",
 		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			secret := &corev1.Secret{
-				ObjectMeta: metav1.ObjectMeta{Name: "opencode-credentials", Namespace: defaultNamespace},
-				Data: map[string][]byte{
-					workerenv.OpenAIBaseURL: []byte("https://models.example.invalid/v1"),
-					workerenv.OpenAIAPIKey:  []byte("credential"),
-				},
-			}
-			fc := newFakeClient(secret)
-			ctx := WithToolContext(context.Background(), &ToolContext{Client: fc, Namespace: defaultNamespace})
-			args, err := json.Marshal(map[string]any{
-				nameField: tt.agentName,
-				modelField: map[string]any{
-					"provider": tt.provider,
-					nameField:  tt.modelName,
-				},
-				runtimeField: map[string]any{jsonSchemaTypeField: string(corev1alpha1.AgentRuntimeOpencode)},
-			})
-			if err != nil {
-				t.Fatalf("marshal args: %v", err)
-			}
-
-			result, err := (&ChatCreateAgentTool{}).Execute(ctx, args)
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			fc := newFakeClient()
+			ctx := WithToolContext(context.Background(), &ToolContext{Client: fc, Namespace: defaultNamespace, ExecutionMode: executionmode.HarnessV2})
+			result, err := (&ChatCreateAgentTool{}).Execute(ctx, tc.args)
 			if err != nil {
 				t.Fatalf("unexpected error: %v", err)
 			}
-
 			var response ChatToolResult
 			if err := json.Unmarshal([]byte(result), &response); err != nil {
 				t.Fatalf("failed to parse result: %v", err)
 			}
-			if !response.Success {
-				t.Fatalf("expected success, got error: %s", response.Error)
+			if response.Success || response.ErrorType != errTypeInvalidArgs || !strings.Contains(response.Error, tc.wantField) {
+				t.Fatalf("response = %#v, want %s integer rejection", response, tc.wantField)
 			}
-
 			var created corev1alpha1.Agent
-			if err := fc.Get(context.Background(), client.ObjectKey{Name: tt.agentName, Namespace: defaultNamespace}, &created); err != nil {
-				t.Fatalf("failed to get created agent: %v", err)
-			}
-			if created.Spec.Model == nil || created.Spec.Model.Name != tt.wantName || created.Spec.Model.Provider != "" {
-				t.Fatalf("model = %#v, want OpenCode model name %q without provider field", created.Spec.Model, tt.wantName)
+			if err := fc.Get(context.Background(), client.ObjectKey{Name: tc.agentName, Namespace: defaultNamespace}, &created); !apierrors.IsNotFound(err) {
+				t.Fatalf("invalid OpenCode Agent should not be created, get err=%v", err)
 			}
 		})
 	}
 }
 
-func TestChatCreateAgentTool_Execute_RejectsBlankObjectOpencodeModelNames(t *testing.T) {
-	tests := []struct {
-		name      string
-		agentName string
-		modelName string
+func TestParsePositiveAgentModelInt32(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		raw  any
+		want int32
 	}{
-		{name: "empty", agentName: "opencode-empty-model", modelName: ""},
-		{name: "whitespace", agentName: "opencode-whitespace-model", modelName: " \t\n"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			secret := &corev1.Secret{
-				ObjectMeta: metav1.ObjectMeta{Name: "opencode-credentials", Namespace: defaultNamespace},
-				Data: map[string][]byte{
-					workerenv.OpenAIBaseURL: []byte("https://models.example.invalid/v1"),
-					workerenv.OpenAIAPIKey:  []byte("credential"),
-				},
-			}
-			fc := newFakeClient(secret)
-			ctx := WithToolContext(context.Background(), &ToolContext{Client: fc, Namespace: defaultNamespace})
-			args, err := json.Marshal(map[string]any{
-				nameField: tt.agentName,
-				modelField: map[string]any{
-					"provider": testProviderOpenAI,
-					nameField:  tt.modelName,
-				},
-				runtimeField: map[string]any{jsonSchemaTypeField: string(corev1alpha1.AgentRuntimeOpencode)},
-			})
-			if err != nil {
-				t.Fatalf("marshal args: %v", err)
-			}
-
-			result, err := (&ChatCreateAgentTool{}).Execute(ctx, args)
+		{name: "decoded JSON integer", raw: float64(4096), want: 4096},
+		{name: "max int32", raw: float64(1<<31 - 1), want: 1<<31 - 1},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := parsePositiveAgentModelInt32("model.contextWindow", tc.raw)
 			if err != nil {
 				t.Fatalf("unexpected error: %v", err)
 			}
-
-			var response ChatToolResult
-			if err := json.Unmarshal([]byte(result), &response); err != nil {
-				t.Fatalf("failed to parse result: %v", err)
-			}
-			if response.Success {
-				t.Fatalf("expected blank OpenCode model name to be rejected, got success: %#v", response)
-			}
-			if response.ErrorType != errTypeInvalidArgs || !strings.Contains(response.Error, "model.name is required for opencode") {
-				t.Fatalf("error result = %#v, want invalid_arguments for blank model.name", response)
+			if got != tc.want {
+				t.Fatalf("got %d, want %d", got, tc.want)
 			}
+		})
+	}
 
-			var created corev1alpha1.Agent
-			err = fc.Get(context.Background(), client.ObjectKey{Name: tt.agentName, Namespace: defaultNamespace}, &created)
-			if !apierrors.IsNotFound(err) {
-				t.Fatalf("agent should not be created for blank model.name, get err=%v", err)
+	for _, tc := range []struct {
+		name      string
+		raw       any
+		wantError string
+	}{
+		{name: "fractional decoded JSON number", raw: float64(4096.5), wantError: "must be an integer"},
+		{name: "zero", raw: float64(0), wantError: "positive 32-bit integer"},
+		{name: "negative", raw: float64(-1), wantError: "positive 32-bit integer"},
+		{name: "overflow", raw: float64(1 << 31), wantError: "positive 32-bit integer"},
+		{name: "wrong type", raw: "4096", wantError: "must be an integer"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := parsePositiveAgentModelInt32("model.contextWindow", tc.raw)
+			if err == nil || !strings.Contains(err.Error(), tc.wantError) {
+				t.Fatalf("error = %v, want %q", err, tc.wantError)
 			}
 		})
 	}
 }
 
+func TestChatCreateAgentTool_Execute_RejectsOpenCodeLegacySecret(t *testing.T) {
+	fc := newFakeClient()
+	ctx := WithToolContext(context.Background(), &ToolContext{Client: fc, Namespace: defaultNamespace, ExecutionMode: executionmode.HarnessV2})
+	result, err := (&ChatCreateAgentTool{}).Execute(ctx, json.RawMessage(`{
+		"name": "legacy-runtime-agent",
+		"model": "openai/gpt-5.4",
+		"runtime": {"type": "opencode", "secretRef": "legacy-runtime"}
+	}`))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	var response ChatToolResult
+	if err := json.Unmarshal([]byte(result), &response); err != nil {
+		t.Fatalf("failed to parse result: %v", err)
+	}
+	if response.Success || response.ErrorType != errTypeInvalidArgs || !strings.Contains(response.Error, "does not accept runtime.secretRef") {
+		t.Fatalf("response = %#v, want legacy secret rejection", response)
+	}
+	var created corev1alpha1.Agent
+	if err := fc.Get(context.Background(), client.ObjectKey{Name: "legacy-runtime-agent", Namespace: defaultNamespace}, &created); !apierrors.IsNotFound(err) {
+		t.Fatalf("invalid OpenCode Agent should not be created, get err=%v", err)
+	}
+}
+
+func TestChatCreateAgentTool_Execute_UsesBuiltInOpenCode(t *testing.T) {
+	fc := newFakeClient()
+	ctx := WithToolContext(context.Background(), &ToolContext{Client: fc, Namespace: defaultNamespace, ExecutionMode: executionmode.HarnessV2})
+	result, err := (&ChatCreateAgentTool{}).Execute(ctx, json.RawMessage(`{
+		"name":"opencode-agent",
+		"model":{"name":"moonshotai/Kimi-K2-Instruct-0905","contextWindow":32768,"maxTokens":4096},
+		"runtime":{"type":"opencode"}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var response ChatToolResult
+	if err := json.Unmarshal([]byte(result), &response); err != nil {
+		t.Fatal(err)
+	}
+	if !response.Success {
+		t.Fatalf("response = %#v, want success", response)
+	}
+	var agent corev1alpha1.Agent
+	if err := fc.Get(context.Background(), client.ObjectKey{Name: "opencode-agent", Namespace: defaultNamespace}, &agent); err != nil {
+		t.Fatal(err)
+	}
+	wantTools := []string{"Read", "Write", "Edit", "Bash", "Glob", "Grep"}
+	if agent.Spec.Runtime == nil || agent.Spec.Runtime.Type != corev1alpha1.AgentRuntimeOpencode || !slices.Equal(agent.Spec.Runtime.DefaultAllowedTools, wantTools) {
+		t.Fatalf("runtime = %#v, want OpenCode defaults %#v", agent.Spec.Runtime, wantTools)
+	}
+	if got := agent.BuiltInContractVersion(); got != corev1alpha1.AgentRuntimeContractHarnessV2 {
+		t.Fatalf("contractVersion = %q, want %q", got, corev1alpha1.AgentRuntimeContractHarnessV2)
+	}
+	if agent.Spec.Model == nil || agent.Spec.Model.Name != "moonshotai/Kimi-K2-Instruct-0905" || agent.Spec.Model.Provider != "" {
+		t.Fatalf("model = %#v, want provider-qualified OpenCode model", agent.Spec.Model)
+	}
+	if agent.Spec.SystemPrompt != nil {
+		t.Fatalf("systemPrompt = %#v, want nil for OpenCode runtime", agent.Spec.SystemPrompt)
+	}
+}
+
+func TestChatCreateAgentTool_Execute_DefaultsHarnessV1Contract(t *testing.T) {
+	fc := newFakeClient()
+	ctx := WithToolContext(context.Background(), &ToolContext{
+		Client:        fc,
+		Namespace:     defaultNamespace,
+		ExecutionMode: executionmode.HarnessV1,
+	})
+	result, err := (&ChatCreateAgentTool{}).Execute(ctx, json.RawMessage(`{
+		"name":"v1-runtime-agent",
+		"runtime":{"type":"codex"}
+	}`))
+	if err != nil {
+		t.Fatalf("Execute() error = %v", err)
+	}
+	var response ChatToolResult
+	if err := json.Unmarshal([]byte(result), &response); err != nil {
+		t.Fatalf("failed to parse result: %v", err)
+	}
+	if !response.Success {
+		t.Fatalf("response = %#v, want success", response)
+	}
+	created := &corev1alpha1.Agent{}
+	if err := fc.Get(context.Background(), client.ObjectKey{Name: "v1-runtime-agent", Namespace: defaultNamespace}, created); err != nil {
+		t.Fatalf("failed to get Agent: %v", err)
+	}
+	if got := created.BuiltInContractVersion(); got != corev1alpha1.AgentRuntimeContractHarnessV1 {
+		t.Fatalf("contractVersion = %q, want %q", got, corev1alpha1.AgentRuntimeContractHarnessV1)
+	}
+}
+
 func TestChatCreateAgentTool_Execute_RollsBackAgentWhenInitialTaskAuthorizationFails(t *testing.T) {
 	fc := newFakeClient()
 	ctx := WithToolContext(context.Background(), &ToolContext{
-		Client:     fc,
-		Namespace:  defaultNamespace,
-		TaskLabels: func() map[string]string { return map[string]string{} },
+		Client:        fc,
+		Namespace:     defaultNamespace,
+		ExecutionMode: executionmode.HarnessV2,
+		TaskLabels:    func() map[string]string { return map[string]string{} },
 		CheckTaskLimit: func() *ChatToolError {
 			return nil
 		},
@@ -320,8 +373,9 @@ func TestChatCreateAgentTool_Execute_RollsBackAgentWhenInitialTaskAuthorizationF
 func TestChatCreateAgentTool_Execute_AuthorizesAgentBeforeCreate(t *testing.T) {
 	fc := newFakeClient()
 	ctx := WithToolContext(context.Background(), &ToolContext{
-		Client:    fc,
-		Namespace: defaultNamespace,
+		Client:        fc,
+		Namespace:     defaultNamespace,
+		ExecutionMode: executionmode.HarnessV2,
 		AuthorizeAgentCreate: func(context.Context, *corev1alpha1.Agent) *ChatToolError {
 			return &ChatToolError{Type: "authorization_failed", Message: "agent blocked by context token"}
 		},
@@ -347,204 +401,113 @@ func TestChatCreateAgentTool_Execute_AuthorizesAgentBeforeCreate(t *testing.T) {
 		t.Fatalf("agent should not have been created, get err=%v", err)
 	}
 }
-
-func TestParseRuntimeConfig_ResolvesExplicitSecretRef(t *testing.T) {
-	fc := newFakeClient(&corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      claudeCredentialsSecretName,
-			Namespace: defaultNamespace,
-		},
-	})
-	agent := &corev1alpha1.Agent{
-		Spec: corev1alpha1.AgentSpec{
-			ProviderRef: &corev1alpha1.ProviderReference{Name: testProviderOpenAI},
-		},
-	}
-
-	args := map[string]any{runtimeField: map[string]any{jsonSchemaTypeField: runtimeTypeClaude, secretRefField: claudeCredentialsSecretName}}
-
-	if errResult, ok := parseRuntimeConfig(context.Background(), fc, defaultNamespace, args, agent); !ok {
-		t.Fatalf("parseRuntimeConfig returned error: %s", errResult)
-	}
-
-	if agent.Spec.Runtime == nil {
-		t.Fatal("agent.Spec.Runtime is nil")
-	}
-	if agent.Spec.Runtime.Type != corev1alpha1.AgentRuntimeType(runtimeTypeClaude) {
-		t.Errorf("runtime.type = %q, want %q", agent.Spec.Runtime.Type, runtimeTypeClaude)
-	}
-	if agent.Spec.SecretRef == nil {
-		t.Fatal("agent.Spec.SecretRef is nil")
-	}
-	if agent.Spec.SecretRef.Name != claudeCredentialsSecretName {
-		t.Errorf("secretRef.name = %q, want %q", agent.Spec.SecretRef.Name, claudeCredentialsSecretName)
-	}
-	if agent.Spec.ProviderRef != nil {
-		t.Errorf("providerRef = %v, want nil", agent.Spec.ProviderRef)
+func TestParseRuntimeConfig_BuiltInRuntimesAreCredentialFree(t *testing.T) {
+	for _, runtimeType := range []corev1alpha1.AgentRuntimeType{
+		corev1alpha1.AgentRuntimeCopilot,
+		corev1alpha1.AgentRuntimeClaude,
+		corev1alpha1.AgentRuntimeCodex,
+	} {
+		t.Run(string(runtimeType), func(t *testing.T) {
+			agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{
+				ProviderRef: &corev1alpha1.ProviderReference{Name: testProviderOpenAI},
+				SecretRef:   &corev1.LocalObjectReference{Name: "legacy-runtime"},
+			}}
+			args := map[string]any{runtimeField: map[string]any{
+				jsonSchemaTypeField: string(runtimeType),
+				secretRefField:      "missing-legacy-runtime",
+			}}
+			if errResult, ok := parseRuntimeConfig(args, agent); !ok {
+				t.Fatalf("parseRuntimeConfig returned error: %s", errResult)
+			}
+			if agent.Spec.Runtime == nil || agent.Spec.Runtime.Type != runtimeType {
+				t.Fatalf("runtime = %#v, want %q", agent.Spec.Runtime, runtimeType)
+			}
+			if agent.Spec.ProviderRef != nil || agent.Spec.SecretRef != nil {
+				t.Fatalf("providerRef=%#v secretRef=%#v, want credential-free runtime", agent.Spec.ProviderRef, agent.Spec.SecretRef)
+			}
+		})
 	}
-}
-
-func TestParseRuntimeConfig_ResolvesOpencodeSecretRef(t *testing.T) {
-	fc := newFakeClient(&corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      testRuntimeCredsSecretName,
-			Namespace: defaultNamespace,
-		},
-		Data: map[string][]byte{
-			workerenv.OpenAIBaseURL: []byte("https://models.example.invalid/v1"),
-			workerenv.OpenAIAPIKey:  []byte("credential"),
-		},
-	})
-	agent := &corev1alpha1.Agent{
-		Spec: corev1alpha1.AgentSpec{
+	t.Run("opencode", func(t *testing.T) {
+		agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{
+			Model:       testOpenCodeModelConfig("openai/gpt-5.4"),
 			ProviderRef: &corev1alpha1.ProviderReference{Name: testProviderOpenAI},
-			Model:       &corev1alpha1.ModelConfig{Name: "kimi-k2", Provider: testProviderOpenAI},
-		},
-	}
-
-	runtimeArgs := map[string]any{jsonSchemaTypeField: string(corev1alpha1.AgentRuntimeOpencode)}
-	runtimeArgs[secretRefField] = testRuntimeCredsSecretName
-	args := map[string]any{runtimeField: runtimeArgs}
-
-	if errResult, ok := parseRuntimeConfig(context.Background(), fc, defaultNamespace, args, agent); !ok {
-		t.Fatalf("parseRuntimeConfig returned error: %s", errResult)
-	}
-	if agent.Spec.Runtime == nil || agent.Spec.Runtime.Type != corev1alpha1.AgentRuntimeOpencode {
-		t.Fatalf("runtime = %#v, want opencode", agent.Spec.Runtime)
-	}
-	if agent.Spec.SecretRef == nil || agent.Spec.SecretRef.Name != testRuntimeCredsSecretName {
-		t.Fatalf("secretRef = %#v, want %q", agent.Spec.SecretRef, testRuntimeCredsSecretName)
-	}
-	if agent.Spec.ProviderRef != nil {
-		t.Fatalf("providerRef = %#v, want nil", agent.Spec.ProviderRef)
-	}
-	if agent.Spec.Model == nil || agent.Spec.Model.Name != "kimi-k2" || agent.Spec.Model.Provider != "" {
-		t.Fatalf("model = %#v, want runtime model name without provider field", agent.Spec.Model)
-	}
-}
-
-func TestParseRuntimeConfig_AutoDiscoversOpencodeEndpointSecret(t *testing.T) {
-	fc := newFakeClient(&corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: "opencode-api-key", Namespace: defaultNamespace},
-		Data: map[string][]byte{
-			workerenv.OpenAIBaseURL: []byte("https://models.example.invalid/v1"),
-		},
+			SecretRef:   &corev1.LocalObjectReference{Name: "legacy-runtime"},
+		}}
+		args := map[string]any{runtimeField: map[string]any{jsonSchemaTypeField: "opencode"}}
+		if errResult, ok := parseRuntimeConfig(args, agent); !ok {
+			t.Fatalf("parseRuntimeConfig returned error: %s", errResult)
+		}
+		wantTools := []string{"Read", "Write", "Edit", "Bash", "Glob", "Grep"}
+		if agent.Spec.Runtime == nil || agent.Spec.Runtime.Type != corev1alpha1.AgentRuntimeOpencode || !slices.Equal(agent.Spec.Runtime.DefaultAllowedTools, wantTools) {
+			t.Fatalf("runtime = %#v, want OpenCode defaults %#v", agent.Spec.Runtime, wantTools)
+		}
+		if agent.Spec.ProviderRef != nil || agent.Spec.SecretRef != nil || agent.Spec.Model.Provider != "" {
+			t.Fatalf("providerRef=%#v secretRef=%#v model=%#v, want credential-free OpenCode runtime", agent.Spec.ProviderRef, agent.Spec.SecretRef, agent.Spec.Model)
+		}
 	})
-	agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Model: &corev1alpha1.ModelConfig{Name: "kimi-k2"}}}
-	args := map[string]any{runtimeField: map[string]any{jsonSchemaTypeField: string(corev1alpha1.AgentRuntimeOpencode)}}
-
-	if errResult, ok := parseRuntimeConfig(context.Background(), fc, defaultNamespace, args, agent); !ok {
-		t.Fatalf("parseRuntimeConfig returned error: %s", errResult)
-	}
-	if agent.Spec.SecretRef == nil || agent.Spec.SecretRef.Name != "opencode-api-key" {
-		t.Fatalf("secretRef = %#v, want complete OpenCode secret", agent.Spec.SecretRef)
-	}
-}
-
-func TestParseRuntimeConfig_RejectsIncompleteOpencodeSecret(t *testing.T) {
-	fc := newFakeClient(&corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: "opencode-api-key", Namespace: defaultNamespace},
-		Data: map[string][]byte{
-			workerenv.OpenAIAPIKey: []byte("credential"),
-		},
+	t.Run("normalizes runtime type", func(t *testing.T) {
+		agent := &corev1alpha1.Agent{}
+		args := map[string]any{runtimeField: map[string]any{jsonSchemaTypeField: "  claude  "}}
+		if errResult, ok := parseRuntimeConfig(args, agent); !ok {
+			t.Fatalf("parseRuntimeConfig returned error: %s", errResult)
+		}
+		if agent.Spec.Runtime == nil || agent.Spec.Runtime.Type != corev1alpha1.AgentRuntimeClaude {
+			t.Fatalf("runtime = %#v, want normalized claude", agent.Spec.Runtime)
+		}
 	})
-	agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Model: &corev1alpha1.ModelConfig{Name: "kimi-k2"}}}
-	args := map[string]any{runtimeField: map[string]any{jsonSchemaTypeField: string(corev1alpha1.AgentRuntimeOpencode)}}
-
-	errResult, ok := parseRuntimeConfig(context.Background(), fc, defaultNamespace, args, agent)
-	if ok {
-		t.Fatal("parseRuntimeConfig accepted incomplete OpenCode credentials")
-	}
-	if !strings.Contains(errResult, workerenv.OpenAIBaseURL) {
-		t.Fatalf("error = %q, want missing %s", errResult, workerenv.OpenAIBaseURL)
-	}
-}
-
-func TestParseRuntimeConfig_RejectsOpencodeWithoutModel(t *testing.T) {
-	agent := &corev1alpha1.Agent{}
-	runtimeArgs := map[string]any{jsonSchemaTypeField: string(corev1alpha1.AgentRuntimeOpencode)}
-	args := map[string]any{runtimeField: runtimeArgs}
-
-	errResult, ok := parseRuntimeConfig(context.Background(), newFakeClient(), defaultNamespace, args, agent)
-	if ok {
-		t.Fatal("parseRuntimeConfig() accepted OpenCode without model.name")
-	}
-	var result ChatToolResult
-	if err := json.Unmarshal([]byte(errResult), &result); err != nil {
-		t.Fatalf("unmarshal error result: %v", err)
-	}
-	if result.ErrorType != "invalid_arguments" || !strings.Contains(result.Error, "model.name is required for opencode") {
-		t.Fatalf("error result = %#v, want invalid_arguments for missing model", result)
-	}
 }
 
-func TestParseRuntimeConfig_AutoDiscoversSecretRef(t *testing.T) {
-	fc := newFakeClient(&corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      claudeAPIKeySecretName,
-			Namespace: defaultNamespace,
-		},
-	})
-	agent := &corev1alpha1.Agent{
-		Spec: corev1alpha1.AgentSpec{
-			ProviderRef: &corev1alpha1.ProviderReference{Name: testProviderOpenAI},
-		},
-	}
-
-	args := map[string]any{runtimeField: map[string]any{jsonSchemaTypeField: runtimeTypeClaude}}
-
-	if errResult, ok := parseRuntimeConfig(context.Background(), fc, defaultNamespace, args, agent); !ok {
-		t.Fatalf("parseRuntimeConfig returned error: %s", errResult)
-	}
-
-	if agent.Spec.SecretRef == nil {
-		t.Fatal("agent.Spec.SecretRef is nil")
-	}
-	if agent.Spec.SecretRef.Name != claudeAPIKeySecretName {
-		t.Errorf("secretRef.name = %q, want %q", agent.Spec.SecretRef.Name, claudeAPIKeySecretName)
+func TestParseRuntimeConfig_RejectsModelLimitsForNonOpenCodeBuiltIns(t *testing.T) {
+	contextWindow := int32(32768)
+	maxTokens := int32(4096)
+	for _, tt := range []struct {
+		name      string
+		runtime   corev1alpha1.AgentRuntimeType
+		model     *corev1alpha1.ModelConfig
+		wantError string
+	}{
+		{name: "codex context window", runtime: corev1alpha1.AgentRuntimeCodex, model: &corev1alpha1.ModelConfig{ContextWindow: &contextWindow}, wantError: "contextWindow"},
+		{name: "claude max tokens", runtime: corev1alpha1.AgentRuntimeClaude, model: &corev1alpha1.ModelConfig{MaxTokens: &maxTokens}, wantError: "maxTokens"},
+		{name: "copilot context window", runtime: corev1alpha1.AgentRuntimeCopilot, model: &corev1alpha1.ModelConfig{ContextWindow: &contextWindow}, wantError: "contextWindow"},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Model: tt.model}}
+			result, ok := parseRuntimeConfig(map[string]any{runtimeField: map[string]any{jsonSchemaTypeField: string(tt.runtime)}}, agent)
+			if ok {
+				t.Fatal("parseRuntimeConfig accepted ignored built-in model limits")
+			}
+			var response ChatToolResult
+			if err := json.Unmarshal([]byte(result), &response); err != nil {
+				t.Fatal(err)
+			}
+			if !strings.Contains(response.Error, tt.wantError) {
+				t.Fatalf("response = %#v, want %q rejection", response, tt.wantError)
+			}
+		})
 	}
 }
 
-func TestParseRuntimeConfig_AutoDiscoversCodexSecretRef(t *testing.T) {
-	fc := newFakeClient(&corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      codexRuntimeCopilotSecretName,
-			Namespace: defaultNamespace,
-		},
-	})
-	agent := &corev1alpha1.Agent{
-		Spec: corev1alpha1.AgentSpec{
-			ProviderRef: &corev1alpha1.ProviderReference{Name: testProviderOpenAI},
-		},
-	}
-
-	args := map[string]any{runtimeField: map[string]any{jsonSchemaTypeField: "codex"}}
-
-	if errResult, ok := parseRuntimeConfig(context.Background(), fc, defaultNamespace, args, agent); !ok {
-		t.Fatalf("parseRuntimeConfig returned error: %s", errResult)
-	}
-
-	if agent.Spec.Runtime == nil {
-		t.Fatal("agent.Spec.Runtime is nil")
-	}
-	if agent.Spec.Runtime.Type != corev1alpha1.AgentRuntimeType("codex") {
-		t.Errorf("runtime.type = %q, want %q", agent.Spec.Runtime.Type, "codex")
-	}
-	if agent.Spec.SecretRef == nil {
-		t.Fatal("agent.Spec.SecretRef is nil")
-	}
-	if agent.Spec.SecretRef.Name != codexRuntimeCopilotSecretName {
-		t.Errorf("secretRef.name = %q, want %q", agent.Spec.SecretRef.Name, codexRuntimeCopilotSecretName)
+func TestParseRuntimeConfig_RejectsUnsupportedRuntime(t *testing.T) {
+	for _, runtimeType := range []string{"unknown", "", "   "} {
+		t.Run(runtimeType, func(t *testing.T) {
+			agent := &corev1alpha1.Agent{}
+			args := map[string]any{runtimeField: map[string]any{jsonSchemaTypeField: runtimeType}}
+			errResult, ok := parseRuntimeConfig(args, agent)
+			if ok {
+				t.Fatal("parseRuntimeConfig accepted invalid runtime")
+			}
+			var response ChatToolResult
+			if err := json.Unmarshal([]byte(errResult), &response); err != nil {
+				t.Fatalf("unmarshal error result: %v", err)
+			}
+			if response.ErrorType != errTypeInvalidArgs || (!strings.Contains(response.Error, "unsupported runtime type") && !strings.Contains(response.Error, "runtime.type is required")) {
+				t.Fatalf("response = %#v, want invalid runtime rejection", response)
+			}
+		})
 	}
 }
 
 func TestParseRuntimeConfig_AppliesRuntimeDefaults(t *testing.T) {
-	fc := newFakeClient(&corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      claudeAPIKeySecretName,
-			Namespace: defaultNamespace,
-		},
-	})
 	agent := &corev1alpha1.Agent{
 		Spec: corev1alpha1.AgentSpec{
 			ProviderRef: &corev1alpha1.ProviderReference{Name: testProviderOpenAI},
@@ -557,7 +520,7 @@ func TestParseRuntimeConfig_AppliesRuntimeDefaults(t *testing.T) {
 	},
 	}
 
-	if errResult, ok := parseRuntimeConfig(context.Background(), fc, defaultNamespace, args, agent); !ok {
+	if errResult, ok := parseRuntimeConfig(args, agent); !ok {
 		t.Fatalf("parseRuntimeConfig returned error: %s", errResult)
 	}
 
@@ -574,52 +537,6 @@ func TestParseRuntimeConfig_AppliesRuntimeDefaults(t *testing.T) {
 		t.Fatalf("defaultAllowBash = %v, want false", agent.Spec.Runtime.DefaultAllowBash)
 	}
 }
-
-func TestParseRuntimeConfig_AcceptsCustomSecretRef(t *testing.T) {
-	fc := newFakeClient(&corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      testRuntimeCredsSecretName,
-			Namespace: defaultNamespace,
-		},
-	})
-	agent := &corev1alpha1.Agent{
-		Spec: corev1alpha1.AgentSpec{
-			ProviderRef: &corev1alpha1.ProviderReference{Name: testProviderOpenAI},
-		},
-	}
-
-	args := map[string]any{runtimeField: map[string]any{jsonSchemaTypeField: runtimeTypeClaude, secretRefField: testRuntimeCredsSecretName}}
-
-	if errResult, ok := parseRuntimeConfig(context.Background(), fc, defaultNamespace, args, agent); !ok {
-		t.Fatalf("parseRuntimeConfig returned error: %s", errResult)
-	}
-	if agent.Spec.SecretRef == nil {
-		t.Fatal("agent.Spec.SecretRef is nil")
-	}
-	if agent.Spec.SecretRef.Name != testRuntimeCredsSecretName {
-		t.Errorf("secretRef.name = %q, want %q", agent.Spec.SecretRef.Name, testRuntimeCredsSecretName)
-	}
-}
-
-func TestParseRuntimeConfig_RejectsMissingSecretRef(t *testing.T) {
-	fc := newFakeClient()
-	agent := &corev1alpha1.Agent{
-		Spec: corev1alpha1.AgentSpec{
-			ProviderRef: &corev1alpha1.ProviderReference{Name: testProviderOpenAI},
-		},
-	}
-
-	args := map[string]any{runtimeField: map[string]any{jsonSchemaTypeField: runtimeTypeClaude, secretRefField: testRuntimeCredsSecretName}}
-
-	errResult, ok := parseRuntimeConfig(context.Background(), fc, defaultNamespace, args, agent)
-	if ok {
-		t.Fatal("expected parseRuntimeConfig to fail")
-	}
-	if !strings.Contains(errResult, notFoundMessage) {
-		t.Fatalf("error = %q, want it to mention not found", errResult)
-	}
-}
-
 func TestParseCoordinationConfig_EnabledClearsRuntimeAndSecretRef(t *testing.T) {
 	agent := &corev1alpha1.Agent{
 		Spec: corev1alpha1.AgentSpec{
@@ -649,3 +566,51 @@ func TestParseCoordinationConfig_EnabledClearsRuntimeAndSecretRef(t *testing.T)
 		t.Errorf("secretRef = %v, want nil", agent.Spec.SecretRef)
 	}
 }
+
+func TestParseRuntimeConfig_PreservesExplicitEmptyOpenCodeTools(t *testing.T) {
+	allowBash := false
+	agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Model: testOpenCodeModelConfig("openai/gpt-5.4")}}
+	args := map[string]any{runtimeField: map[string]any{
+		jsonSchemaTypeField:   "opencode",
+		"defaultAllowedTools": []any{},
+		"defaultAllowBash":    allowBash,
+	}}
+	if errResult, ok := parseRuntimeConfig(args, agent); !ok {
+		t.Fatalf("parseRuntimeConfig returned error: %s", errResult)
+	}
+	if agent.Spec.Runtime == nil || agent.Spec.Runtime.DefaultAllowedTools == nil || len(agent.Spec.Runtime.DefaultAllowedTools) != 0 {
+		t.Fatalf("defaultAllowedTools = %#v, want explicit empty", agent.Spec.Runtime)
+	}
+	if agent.Spec.Runtime.DefaultAllowBash == nil || *agent.Spec.Runtime.DefaultAllowBash {
+		t.Fatalf("defaultAllowBash = %v, want false", agent.Spec.Runtime.DefaultAllowBash)
+	}
+}
+
+func TestParseRuntimeConfig_RejectsInvalidOpenCodeModel(t *testing.T) {
+	contextWindow := int32(32768)
+	maxTokens := int32(4096)
+	inverted := int32(4096)
+	for name, model := range map[string]*corev1alpha1.ModelConfig{
+		"missing":         nil,
+		"bare":            {Name: "gpt-5.4", ContextWindow: &contextWindow, MaxTokens: &maxTokens},
+		"substitution":    {Name: "{env:PROVIDER}/gpt", ContextWindow: &contextWindow, MaxTokens: &maxTokens},
+		"missing context": {Name: "openai/gpt-5.4", MaxTokens: &maxTokens},
+		"missing output":  {Name: "openai/gpt-5.4", ContextWindow: &contextWindow},
+		"inverted":        {Name: "openai/gpt-5.4", ContextWindow: &inverted, MaxTokens: &maxTokens},
+	} {
+		t.Run(name, func(t *testing.T) {
+			agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Model: model}}
+			errResult, ok := parseRuntimeConfig(map[string]any{runtimeField: map[string]any{jsonSchemaTypeField: "opencode"}}, agent)
+			if ok {
+				t.Fatal("parseRuntimeConfig accepted invalid OpenCode model")
+			}
+			var response ChatToolResult
+			if err := json.Unmarshal([]byte(errResult), &response); err != nil {
+				t.Fatal(err)
+			}
+			if response.ErrorType != errTypeInvalidArgs {
+				t.Fatalf("response = %#v, want invalid arguments", response)
+			}
+		})
+	}
+}
diff --git a/internal/tools/chat_helpers.go b/internal/tools/chat_helpers.go
index 9eff7377f..392aa927d 100644
--- a/internal/tools/chat_helpers.go
+++ b/internal/tools/chat_helpers.go
@@ -8,10 +8,14 @@ package tools
 
 import (
 	"fmt"
+	"math"
+	"strconv"
 	"strings"
 	"time"
 
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
 )
 
 // classifyChatK8sErr returns a ChatToolResult for common K8s API errors.
@@ -85,6 +89,39 @@ func chatGetIntArg(args map[string]any, key string, defaultVal int) int {
 	}
 }
 
+// chatParseBoolArg parses a bool tool argument that may arrive as a JSON
+// boolean or a string boolean.
+func chatParseBoolArg(value any) (bool, error) {
+	switch v := value.(type) {
+	case bool:
+		return v, nil
+	case string:
+		return strconv.ParseBool(strings.TrimSpace(v))
+	default:
+		return false, fmt.Errorf("value is not a boolean")
+	}
+}
+
+// chatParseIntArg parses an integer tool argument that may arrive as a JSON
+// number or a numeric string.
+func chatParseIntArg(value any) (int, error) {
+	switch v := value.(type) {
+	case float64:
+		if math.IsNaN(v) || math.IsInf(v, 0) || v != math.Trunc(v) {
+			return 0, fmt.Errorf("value is not an integer")
+		}
+		return int(v), nil
+	case int:
+		return v, nil
+	case int64:
+		return int(v), nil
+	case string:
+		return strconv.Atoi(strings.TrimSpace(v))
+	default:
+		return 0, fmt.Errorf("value is not an integer")
+	}
+}
+
 // chatGetStringSliceArg extracts a string slice argument.
 func chatGetStringSliceArg(args map[string]any, key string) []string {
 	v, ok := args[key]
@@ -123,6 +160,60 @@ func parseTimeoutArg(args map[string]any) (time.Duration, string, bool) {
 	return d, "", true
 }
 
+// maxTurns bounds mirror the Task CRD validation on spec.agentRuntime.maxTurns
+// (+kubebuilder:validation:Minimum=1, +kubebuilder:validation:Maximum=1000).
+const (
+	minMaxTurns = 1
+	maxMaxTurns = 1000
+)
+
+// parseMaxTurnsArg parses the optional maxTurns argument and returns an error
+// result if invalid.
+func parseMaxTurnsArg(args map[string]any) (*int32, string, bool) {
+	raw, ok := args["maxTurns"]
+	if !ok {
+		return nil, "", true
+	}
+	turns, err := chatParseIntArg(raw)
+	if err != nil {
+		r, _ := ChatToolErrorResult("invalid_arguments",
+			"maxTurns must be an integer",
+			"Provide maxTurns as a positive integer or omit it")
+		return nil, r, false
+	}
+	if turns < minMaxTurns || turns > maxMaxTurns {
+		r, _ := ChatToolErrorResult("invalid_arguments",
+			fmt.Sprintf("maxTurns must be between %d and %d", minMaxTurns, maxMaxTurns),
+			"Provide maxTurns within the allowed range or omit it")
+		return nil, r, false
+	}
+	value := int32(turns)
+	return &value, "", true
+}
+
+// workspaceRequestsPublication reports whether any publication field upgrades
+// the workspace to write intent.
+func workspaceRequestsPublication(wsCfg *corev1alpha1.WorkspaceConfig) bool {
+	return wsCfg.PublicationGitRepo != "" || wsCfg.PushBranch != "" || wsCfg.PRBaseBranch != "" || wsCfg.CreatePR
+}
+
+// parseCreatePRArg parses the optional workspace.createPR argument and returns
+// an error result if invalid.
+func parseCreatePRArg(wsMap map[string]any) (bool, string, bool) {
+	raw, ok := wsMap["createPR"]
+	if !ok {
+		return false, "", true
+	}
+	createPR, err := chatParseBoolArg(raw)
+	if err != nil {
+		r, _ := ChatToolErrorResult("invalid_arguments",
+			"workspace.createPR must be a boolean",
+			"Set createPR to true or false")
+		return false, r, false
+	}
+	return createPR, "", true
+}
+
 // taskCreatedMsg returns the appropriate message for a created task.
 func taskCreatedMsg(schedule string) string {
 	if schedule != "" {
diff --git a/internal/tools/check_pr_review_marker.go b/internal/tools/check_pr_review_marker.go
index 3412f2b4f..59fa06385 100644
--- a/internal/tools/check_pr_review_marker.go
+++ b/internal/tools/check_pr_review_marker.go
@@ -101,7 +101,7 @@ func (t *CheckPRReviewMarkerTool) Execute(ctx context.Context, argsJSON json.Raw
 		return "", fmt.Errorf("pr_number is required")
 	}
 
-	owner, repo, token, baseURL, err := resolveScopedRepoAndToken(ctx, t.k8sClient, args.TaskName, args.RepoURL, t.apiBaseURL)
+	owner, repo, token, baseURL, err := resolveScopedReadRepoAndToken(ctx, t.k8sClient, args.TaskName, args.RepoURL, t.apiBaseURL)
 	if err != nil {
 		return "", err
 	}
diff --git a/internal/tools/check_pr_review_marker_test.go b/internal/tools/check_pr_review_marker_test.go
index c33485370..d44c1ad5a 100644
--- a/internal/tools/check_pr_review_marker_test.go
+++ b/internal/tools/check_pr_review_marker_test.go
@@ -339,6 +339,7 @@ func setCheckPRReviewMarkerTestEnv(t *testing.T) {
 
 func newCheckPRReviewMarkerTestTool(apiBaseURL string) (*CheckPRReviewMarkerTool, context.Context) {
 	task, secret := githubRepoTaskWithSecret(testSozercanAynaRepoURL)
+	task.Spec.Workspace.ForgeCredentialRef = nil
 	return &CheckPRReviewMarkerTool{k8sClient: newFakeClient(task, secret), apiBaseURL: apiBaseURL},
 		contextWithTaskScope()
 }
diff --git a/internal/tools/check_pull_request_ci.go b/internal/tools/check_pull_request_ci.go
index ccb2d08c9..c20579095 100644
--- a/internal/tools/check_pull_request_ci.go
+++ b/internal/tools/check_pull_request_ci.go
@@ -98,7 +98,7 @@ func (t *CheckPullRequestCITool) Execute(ctx context.Context, argsJSON json.RawM
 		return "", err
 	}
 
-	owner, repo, token, baseURL, err := resolveScopedRepoAndToken(ctx, t.k8sClient, args.TaskName, args.RepoURL, t.apiBaseURL)
+	owner, repo, token, baseURL, err := resolveScopedReadRepoAndToken(ctx, t.k8sClient, args.TaskName, args.RepoURL, t.apiBaseURL)
 	if err != nil {
 		return "", err
 	}
diff --git a/internal/tools/check_pull_request_ci_test.go b/internal/tools/check_pull_request_ci_test.go
index f271108ae..42e2a63e6 100644
--- a/internal/tools/check_pull_request_ci_test.go
+++ b/internal/tools/check_pull_request_ci_test.go
@@ -448,12 +448,10 @@ func checkPullRequestCITestObjects() (*corev1alpha1.Task, *corev1.Secret) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      testSozercanAynaRepoURL,
-					Branch:       testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{Name: testGitCredsSecretName},
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:           testSozercanAynaRepoURL,
+				Branch:            testBranch,
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: testGitCredsSecretName},
 			},
 		},
 	}
diff --git a/internal/tools/code_exec.go b/internal/tools/code_exec.go
index bffad6c2a..a336c2895 100644
--- a/internal/tools/code_exec.go
+++ b/internal/tools/code_exec.go
@@ -980,7 +980,7 @@ func (b *cappedBuffer) Total() int64 {
 	return b.total
 }
 
-const safeCodeExecPath = "/usr/local/bin:/usr/bin:/bin:/opt/homebrew/bin"
+const safeCodeExecPath = "/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin"
 
 func scrubCodeExecEnv(environ []string) []string {
 	scrubbed := []string{
@@ -995,7 +995,7 @@ func scrubCodeExecEnv(environ []string) []string {
 		"TERM=dumb",
 	}
 
-	for _, name := range []string{"SystemRoot", "SYSTEMROOT", "WINDIR", "windir", "COMSPEC", "PATHEXT", "DEVELOPER_DIR"} {
+	for _, name := range []string{"SystemRoot", "SYSTEMROOT", "WINDIR", "windir", "COMSPEC", "PATHEXT"} {
 		if value, ok := lookupEnvValue(environ, name); ok {
 			scrubbed = append(scrubbed, name+"="+value)
 		}
diff --git a/internal/tools/code_exec_test.go b/internal/tools/code_exec_test.go
index 7cc7e97e1..26278a84d 100644
--- a/internal/tools/code_exec_test.go
+++ b/internal/tools/code_exec_test.go
@@ -715,6 +715,26 @@ func TestCodeExecTool_Execute_EnvironmentScrubbed(t *testing.T) {
 	}
 }
 
+func TestScrubCodeExecEnvDropsDeveloperOverridesAndUsesStableToolPath(t *testing.T) {
+	env := scrubCodeExecEnv([]string{
+		"DEVELOPER_DIR=/Applications/Missing-Xcode.app/Contents/Developer",
+		"SystemRoot=C:\\Windows",
+		"ORKA_SECRET_TOKEN=secret",
+	})
+	joined := strings.Join(env, "\n")
+	if !strings.Contains(joined, "PATH="+safeCodeExecPath) {
+		t.Fatalf("scrubbed environment is missing the stable tool path: %q", env)
+	}
+	if !strings.Contains(joined, "SystemRoot=C:\\Windows") {
+		t.Fatalf("scrubbed environment dropped required Windows system state: %q", env)
+	}
+	for _, forbidden := range []string{"DEVELOPER_DIR=", "ORKA_SECRET_TOKEN="} {
+		if strings.Contains(joined, forbidden) {
+			t.Fatalf("scrubbed environment retained %q: %q", forbidden, env)
+		}
+	}
+}
+
 func TestCodeExecTool_Execute_OutputCapsStdoutAndStderr(t *testing.T) {
 	tmpDir := t.TempDir()
 	tool := newInProcessCodeExecTestTool(tmpDir, 30*time.Second, map[string]bool{codeLanguageBash: true})
diff --git a/internal/tools/comment_on_issue.go b/internal/tools/comment_on_issue.go
index 3bbb01975..d4b711121 100644
--- a/internal/tools/comment_on_issue.go
+++ b/internal/tools/comment_on_issue.go
@@ -86,7 +86,7 @@ func (t *CommentOnIssueTool) Execute(ctx context.Context, argsJSON json.RawMessa
 	}
 
 	// Resolve repo and token using the shared helper
-	owner, repo, token, baseURL, err := resolveRepoAndToken(ctx, t.k8sClient, args.TaskName, args.RepoURL, t.apiBaseURL)
+	owner, repo, token, baseURL, err := resolveForgeRepoAndToken(ctx, t.k8sClient, args.TaskName, args.RepoURL, t.apiBaseURL)
 	if err != nil {
 		return "", err
 	}
diff --git a/internal/tools/comment_on_issue_test.go b/internal/tools/comment_on_issue_test.go
index f7c86bfd3..e4226bf37 100644
--- a/internal/tools/comment_on_issue_test.go
+++ b/internal/tools/comment_on_issue_test.go
@@ -94,14 +94,17 @@ func TestCommentOnIssueTool_Success(t *testing.T) {
 	}))
 	defer server.Close()
 
-	t.Setenv("GITHUB_TOKEN", testGitHubToken)
+	t.Setenv("GITHUB_TOKEN", "")
+	task, secret := githubRepoTaskWithSecret(testOrgTestRepoURL)
+	task.Spec.Workspace.ReadCredentialRef = nil
 
 	tool := &CommentOnIssueTool{
-		k8sClient:  newFakeClient(),
+		k8sClient:  newFakeClient(task, secret),
 		apiBaseURL: server.URL,
 	}
 
 	args, _ := json.Marshal(CommentOnIssueArgs{
+		TaskName:    testCoderTaskName,
 		RepoURL:     testOrgTestRepoURL,
 		IssueNumber: 42,
 		Body:        "🤖 Agent is working on this issue",
diff --git a/internal/tools/common_constants.go b/internal/tools/common_constants.go
index 795b964f0..30c55adda 100644
--- a/internal/tools/common_constants.go
+++ b/internal/tools/common_constants.go
@@ -69,10 +69,6 @@ const (
 	testCoderAgentName              = "coder"
 	testClaudeCoderName             = "claude-coder"
 	runtimeTypeClaude               = "claude"
-	claudeCredentialsSecretName     = "claude-credentials"
-	claudeAPIKeySecretName          = "claude-api-key"
-	codexRuntimeCopilotSecretName   = "codex-runtime-copilot"
-	codexProxyTokenSecretName       = "codex-proxy-token"
 	testSecondToolDescription       = "Second tool"
 	testTool1Description            = "Tool 1"
 
diff --git a/internal/tools/create_agent.go b/internal/tools/create_agent.go
index 320eede98..a2d44cb32 100644
--- a/internal/tools/create_agent.go
+++ b/internal/tools/create_agent.go
@@ -15,6 +15,8 @@ import (
 	"strings"
 	"time"
 
+	"github.com/orka-agents/orka/internal/acp"
+	"github.com/orka-agents/orka/internal/executionmode"
 	"github.com/orka-agents/orka/internal/workerenv"
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -27,7 +29,8 @@ import (
 
 // CreateAgentTool implements dynamic Agent CRD creation
 type CreateAgentTool struct {
-	k8sClient client.Client
+	k8sClient     client.Client
+	executionMode executionmode.Mode
 }
 
 // CreateAgentArgs are the arguments for the create_agent tool
@@ -44,14 +47,31 @@ type CreateAgentArgs struct {
 
 // ModelArgs specifies LLM model configuration
 type ModelArgs struct {
-	Provider string `json:"provider,omitempty"`
-	Name     string `json:"name,omitempty"`
+	Provider      string `json:"provider,omitempty"`
+	Name          string `json:"name,omitempty"`
+	ContextWindow *int32 `json:"contextWindow,omitempty"`
+	MaxTokens     *int32 `json:"maxTokens,omitempty"`
 }
 
 // RuntimeArgs specifies agent CLI runtime configuration
 type RuntimeArgs struct {
-	Type      string `json:"type"`
-	SecretRef string `json:"secretRef,omitempty"`
+	Type                string   `json:"type"`
+	SecretRef           string   `json:"secretRef,omitempty"`
+	DefaultAllowedTools []string `json:"defaultAllowedTools,omitempty"`
+	DefaultAllowBash    *bool    `json:"defaultAllowBash,omitempty"`
+}
+
+func applyOpencodeRuntimeDefaults(runtime *corev1alpha1.AgentCLIRuntime, allowedToolsSupplied, allowBashSupplied bool) {
+	if runtime == nil || runtime.Type != corev1alpha1.AgentRuntimeOpencode {
+		return
+	}
+	if !allowedToolsSupplied {
+		runtime.DefaultAllowedTools = acp.OpenCodeDefaultAllowedTools()
+	}
+	if !allowBashSupplied {
+		allowBash := true
+		runtime.DefaultAllowBash = &allowBash
+	}
 }
 
 // CoordinationArgs specifies coordination configuration
@@ -76,9 +96,10 @@ type CreateAgentResult struct {
 }
 
 // NewCreateAgentTool creates a new create_agent tool
-func NewCreateAgentTool(k8sClient client.Client) *CreateAgentTool {
+func NewCreateAgentTool(k8sClient client.Client, mode executionmode.Mode) *CreateAgentTool {
 	return &CreateAgentTool{
-		k8sClient: k8sClient,
+		k8sClient:     k8sClient,
+		executionMode: mode,
 	}
 }
 
@@ -103,19 +124,29 @@ func (t *CreateAgentTool) Parameters() json.RawMessage {
 			},
 			"systemPrompt": {
 				"type": "string",
-				"description": "System prompt for the agent"
+				"description": "System prompt for the agent. Required unless runtime.type is opencode; OpenCode cannot enforce Agent system prompts, so omit this field and use task prompts instead."
 			},
 			"model": {
 				"type": "object",
-				"description": "LLM model config; model.name is required for OpenCode runtimes and otherwise inherited from the coordinator when omitted",
+				"description": "LLM model config; model.name is inherited from the coordinator when omitted except for OpenCode, which requires provider/model form",
 				"properties": {
 					"provider": {
 						"type": "string",
-						"description": "LLM provider (e.g. anthropic, openai)"
+						"description": "LLM provider (e.g. anthropic, openai). For OpenCode, use only with a provider-relative bare model name; omit it when model.name already contains the full provider/model ID."
 					},
 					"name": {
 						"type": "string",
 						"description": "Model identifier"
+					},
+					"contextWindow": {
+						"type": "integer",
+						"minimum": 1,
+						"description": "Reviewed model context capacity; required for OpenCode"
+					},
+					"maxTokens": {
+						"type": "integer",
+						"minimum": 1,
+						"description": "Reviewed maximum output tokens; required for OpenCode"
 					}
 				}
 			},
@@ -165,23 +196,105 @@ func (t *CreateAgentTool) Parameters() json.RawMessage {
 			},
 			"runtime": {
 				"type": "object",
-				"description": "Set to make this a CLI runtime agent (copilot, claude, codex, or opencode). Runtime agents run code, edit files, and use git. Do NOT set runtime on coordinator agents.",
+					"description": "Set to make this a built-in ACP runtime agent (copilot, claude, codex, or opencode). Runtime agents run code against a materialized workspace. Do NOT set runtime on coordinator agents.",
 				"properties": {
 					"type": {
 						"type": "string",
-						"description": "Runtime type: copilot, claude, codex, or opencode"
+							"description": "Runtime type: copilot, claude, codex, or opencode"
 					},
 					"secretRef": {
 						"type": "string",
-						"description": "Optional secret name containing runtime credentials. Omit to auto-discover the standard secret for this runtime."
+						"description": "Deprecated legacy field. Built-in ACP runtimes are credential-free at the Agent boundary; OpenCode rejects it."
+					},
+					"defaultAllowedTools": {
+						"type": "array",
+						"items": {"type": "string"},
+						"description": "Default CLI tools allowed for tasks using this runtime agent. OpenCode defaults to Read, Write, Edit, Bash, Glob, and Grep when omitted."
+					},
+					"defaultAllowBash": {
+						"type": "boolean",
+						"description": "Whether bash is allowed by default. OpenCode defaults to true when omitted."
 					}
 				}
 			}
 		},
-		"required": ["role", "systemPrompt"]
+		"required": ["role"]
 	}`)
 }
 
+func isBuiltInACPRuntime(runtimeType corev1alpha1.AgentRuntimeType) bool {
+	switch runtimeType {
+	case corev1alpha1.AgentRuntimeCopilot, corev1alpha1.AgentRuntimeClaude, corev1alpha1.AgentRuntimeCodex, corev1alpha1.AgentRuntimeOpencode:
+		return true
+	default:
+		return false
+	}
+}
+
+func normalizedCreateAgentModel(runtime *RuntimeArgs, model *ModelArgs) (string, error) {
+	requested := ""
+	if model != nil {
+		requested = strings.TrimSpace(model.Name)
+	}
+	if runtime == nil {
+		return requested, nil
+	}
+	runtimeType := corev1alpha1.AgentRuntimeType(strings.TrimSpace(runtime.Type))
+	if model != nil {
+		if err := validateBuiltInRuntimeModelLimits(runtimeType, &corev1alpha1.ModelConfig{
+			ContextWindow: model.ContextWindow,
+			MaxTokens:     model.MaxTokens,
+		}); err != nil {
+			return "", err
+		}
+	}
+	if runtimeType != corev1alpha1.AgentRuntimeOpencode {
+		return requested, nil
+	}
+	var spec *corev1alpha1.ModelConfig
+	if model != nil {
+		spec = &corev1alpha1.ModelConfig{
+			Provider:      model.Provider,
+			Name:          model.Name,
+			ContextWindow: model.ContextWindow,
+			MaxTokens:     model.MaxTokens,
+		}
+	}
+	providerID, modelID, specErr := validateOpenCodeModelSpec(spec)
+	if specErr != nil {
+		return "", specErr
+	}
+	return providerID + "/" + modelID, nil
+}
+
+func configureCreatedAgentRuntime(agent *corev1alpha1.Agent, runtimeArgs *RuntimeArgs) error {
+	if runtimeArgs == nil {
+		return nil
+	}
+	runtimeType := corev1alpha1.AgentRuntimeType(strings.TrimSpace(runtimeArgs.Type))
+	runtime := &corev1alpha1.AgentCLIRuntime{Type: runtimeType}
+	if runtimeArgs.DefaultAllowedTools != nil {
+		runtime.DefaultAllowedTools = append([]string{}, runtimeArgs.DefaultAllowedTools...)
+	}
+	if runtimeArgs.DefaultAllowBash != nil {
+		allowBash := *runtimeArgs.DefaultAllowBash
+		runtime.DefaultAllowBash = &allowBash
+	}
+	if runtimeType == corev1alpha1.AgentRuntimeOpencode {
+		if strings.TrimSpace(runtimeArgs.SecretRef) != "" {
+			return fmt.Errorf("opencode runtime does not accept runtime.secretRef; provider access is controller-proxied")
+		}
+		applyOpencodeRuntimeDefaults(runtime, runtimeArgs.DefaultAllowedTools != nil, runtimeArgs.DefaultAllowBash != nil)
+		if agent.Spec.Model != nil {
+			agent.Spec.Model.Provider = ""
+		}
+	}
+	agent.Spec.Runtime = runtime
+	agent.Spec.ProviderRef = nil
+	agent.Spec.SecretRef = nil
+	return nil
+}
+
 // Execute creates an Agent CRD dynamically
 func (t *CreateAgentTool) Execute(ctx context.Context, args json.RawMessage) (string, error) {
 	var a CreateAgentArgs
@@ -192,27 +305,26 @@ func (t *CreateAgentTool) Execute(ctx context.Context, args json.RawMessage) (st
 	if a.Role == "" {
 		return "", fmt.Errorf("role is required")
 	}
-	if a.SystemPrompt == "" {
-		return "", fmt.Errorf("systemPrompt is required")
-	}
 	runtimeType := ""
 	if a.Runtime != nil {
 		runtimeType = strings.TrimSpace(a.Runtime.Type)
-	}
-	requestedModel := ""
-	if a.Model != nil {
-		requestedModel = strings.TrimSpace(a.Model.Name)
+		if runtimeType == "" {
+			return "", fmt.Errorf("runtime.type is required when runtime is provided")
+		}
+		if !isBuiltInACPRuntime(corev1alpha1.AgentRuntimeType(runtimeType)) {
+			return "", fmt.Errorf("unsupported runtime type %q; supported built-in runtimes are copilot, claude, codex, and opencode", runtimeType)
+		}
 	}
 	if runtimeType == string(corev1alpha1.AgentRuntimeOpencode) {
-		if requestedModel == "" {
-			return "", fmt.Errorf("model.name is required for opencode runtime")
-		}
-		if provider := strings.TrimSpace(a.Model.Provider); provider != "" {
-			providerPrefix := strings.TrimSuffix(provider, "/") + "/"
-			if !strings.HasPrefix(requestedModel, providerPrefix) {
-				requestedModel = providerPrefix + strings.TrimPrefix(requestedModel, "/")
-			}
+		if strings.TrimSpace(a.SystemPrompt) != "" {
+			return "", fmt.Errorf("opencode runtime does not support systemPrompt; omit it and use task prompts for instructions")
 		}
+	} else if strings.TrimSpace(a.SystemPrompt) == "" {
+		return "", fmt.Errorf("systemPrompt is required")
+	}
+	requestedModel, err := normalizedCreateAgentModel(a.Runtime, a.Model)
+	if err != nil {
+		return "", err
 	}
 
 	parentName := os.Getenv(envOrkaTaskName)
@@ -238,6 +350,8 @@ func (t *CreateAgentTool) Execute(ctx context.Context, args json.RawMessage) (st
 	model := &corev1alpha1.ModelConfig{}
 	if a.Model != nil {
 		model.Name = requestedModel
+		model.ContextWindow = a.Model.ContextWindow
+		model.MaxTokens = a.Model.MaxTokens
 	}
 	if model.Name == "" {
 		model.Name = os.Getenv(workerenv.AIModel)
@@ -298,13 +412,13 @@ func (t *CreateAgentTool) Execute(ctx context.Context, args json.RawMessage) (st
 		Spec: corev1alpha1.AgentSpec{
 			ProviderRef: &corev1alpha1.ProviderReference{Name: providerRefName},
 			Model:       model,
-			SystemPrompt: &corev1alpha1.PromptSource{
-				Inline: a.SystemPrompt,
-			},
-			Tools:  toolRefs,
-			Skills: skillRefs,
+			Tools:       toolRefs,
+			Skills:      skillRefs,
 		},
 	}
+	if strings.TrimSpace(a.SystemPrompt) != "" {
+		agent.Spec.SystemPrompt = &corev1alpha1.PromptSource{Inline: a.SystemPrompt}
+	}
 
 	// Set coordination config if provided
 	if a.Coordination != nil {
@@ -322,31 +436,24 @@ func (t *CreateAgentTool) Execute(ctx context.Context, args json.RawMessage) (st
 		agent.Spec.Coordination = coord
 	}
 
-	// Set runtime if provided (makes this a CLI agent like copilot/claude/codex/opencode)
-	if a.Runtime != nil && a.Runtime.Type != "" {
-		agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{
-			Type: corev1alpha1.AgentRuntimeType(a.Runtime.Type),
-		}
-		// Runtime agents don't use providerRef
-		agent.Spec.ProviderRef = nil
-		secretRef, err := resolveRuntimeSecretRef(ctx, t.k8sClient, ns, agent.Spec.Runtime.Type, a.Runtime.SecretRef)
-		if err != nil {
-			return "", err
-		}
-		agent.Spec.SecretRef = secretRef
+	// Set the normalized built-in runtime when provided.
+	if err := configureCreatedAgentRuntime(agent, a.Runtime); err != nil {
+		return "", err
+	}
+	if err := executionmode.DefaultBuiltInAgentContract(agent, t.executionMode); err != nil {
+		return "", err
 	}
 
-	// Set owner reference to parent task for auto-cleanup
-	blockOwnerDeletion := true
+	// Set a non-blocking owner reference for auto-cleanup. Worker RBAC allows
+	// creating child resources but not updating the parent Task's finalizers.
 	isController := true
 	agent.OwnerReferences = []metav1.OwnerReference{
 		{
-			APIVersion:         corev1alpha1.GroupVersion.String(),
-			Kind:               taskKindString,
-			Name:               parentTask.Name,
-			UID:                parentTask.UID,
-			Controller:         &isController,
-			BlockOwnerDeletion: &blockOwnerDeletion,
+			APIVersion: corev1alpha1.GroupVersion.String(),
+			Kind:       taskKindString,
+			Name:       parentTask.Name,
+			UID:        parentTask.UID,
+			Controller: &isController,
 		},
 	}
 
diff --git a/internal/tools/create_agent_task.go b/internal/tools/create_agent_task.go
index 5dca54f6b..f165d43d7 100644
--- a/internal/tools/create_agent_task.go
+++ b/internal/tools/create_agent_task.go
@@ -10,10 +10,15 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"net/url"
+	"path"
+	"strings"
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/security"
+	"github.com/orka-agents/orka/internal/store"
 	"github.com/orka-agents/orka/internal/tracing"
 )
 
@@ -27,12 +32,20 @@ func (t *CreateAgentTaskTool) Description() string {
 }
 
 func (t *CreateAgentTaskTool) Parameters() json.RawMessage {
-	return mustMarshalSchema(map[string]any{jsonSchemaTypeField: jsonSchemaTypeObject, jsonSchemaPropertiesField: map[string]any{nameField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: taskNameDescription}, promptField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "The prompt/instruction for the agent"}, agentRefField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Agent name with runtime configured"}, namespaceField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: namespaceDescription}, timeoutField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: timeoutDescription}, "maxTurns": map[string]any{jsonSchemaTypeField: jsonSchemaTypeInteger, jsonSchemaDescriptionField: "Maximum agent loop iterations"}, workspaceField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeObject, jsonSchemaPropertiesField: map[string]any{
-		"gitRepo":      map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Git repository URL"},
-		"branch":       map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Git branch to clone from (must exist). Omit to use the default branch."},
-		"pushBranch":   map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Branch name to push changes to (will be created if it doesn't exist). Use this for new feature branches."},
-		"gitSecretRef": map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Optional secret name containing git credentials. Omit to auto-discover git credentials or reuse the Copilot agent secret when available."},
-		"subPath":      map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Sub-path within the repo"},
+	return mustMarshalSchema(map[string]any{jsonSchemaTypeField: jsonSchemaTypeObject, jsonSchemaPropertiesField: map[string]any{nameField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: taskNameDescription}, promptField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "The prompt/instruction for the agent"}, agentRefField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Agent name with runtime configured"}, namespaceField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: namespaceDescription}, timeoutField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: timeoutDescription}, "maxTurns": map[string]any{jsonSchemaTypeField: jsonSchemaTypeInteger, jsonSchemaMinimumField: minMaxTurns, jsonSchemaMaximumField: maxMaxTurns, jsonSchemaDescriptionField: "Maximum agent loop iterations"}, workspaceField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeObject, jsonSchemaPropertiesField: map[string]any{
+		"intent":                       map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaEnumField: []string{"read", "write"}, jsonSchemaDescriptionField: "Workspace intent. Defaults to read; publication fields require write. Write intent requires gitRepo and publicationCredentialRef."},
+		"gitRepo":                      map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Source Git repository URL as a credential-free HTTPS URL, e.g. https://github.com/owner/repo. GitHub SSH roots (git@github.com:owner/repo) are converted automatically; other schemes and embedded credentials are rejected. Required for write intent."},
+		"branch":                       map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Source branch to clone from (must exist). Omit with ref to resolve and freeze the repository's advertised default branch. Requires gitRepo."},
+		"ref":                          map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Exact source commit, tag, or ref. Requires gitRepo."},
+		"readCredentialRef":            map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Optional Secret name for clone/read credentials. Omit to auto-discover a read credential when available. Requires gitRepo."},
+		"publicationGitRepo":           map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Publication repository URL for write Tasks as a credential-free HTTPS URL, e.g. https://github.com/owner/repo. GitHub SSH roots (git@github.com:owner/repo) are converted automatically; other schemes and embedded credentials are rejected."},
+		"publicationReadCredentialRef": map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Optional Secret name for target-repository preflight and verification credentials. Write intent only."},
+		"publicationCredentialRef":     map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Secret name for target-repository write credentials. Required for write intent; write intent only."},
+		"forgeCredentialRef":           map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Optional Secret name for forge API credentials used to reconcile pull requests. Required when createPR is true; write intent only."},
+		"pushBranch":                   map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Publication branch name (write intent)"},
+		"prBaseBranch":                 map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Pull request base branch. Required when createPR is true."},
+		"createPR":                     map[string]any{jsonSchemaTypeField: jsonSchemaTypeBoolean, jsonSchemaDescriptionField: "Reconcile a pull request after publication. Requires prBaseBranch and forgeCredentialRef."},
+		"subPath":                      map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Sub-path within the repo. Requires gitRepo."},
 	},
 	}, scheduleField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: cronScheduleDescription},
 	}, jsonSchemaRequiredField: []string{nameField, promptField, agentRefField},
@@ -92,45 +105,82 @@ func (t *CreateAgentTaskTool) Execute(ctx context.Context, args json.RawMessage)
 
 	var agentRuntime *corev1alpha1.AgentRuntimeSpec
 
-	if maxTurns, ok := a["maxTurns"]; ok {
-		if agentRuntime == nil {
-			agentRuntime = &corev1alpha1.AgentRuntimeSpec{}
-		}
-		mt := int32(maxTurns.(float64))
-		agentRuntime.MaxTurns = &mt
+	if turns, errResult, ok := parseMaxTurnsArg(a); !ok {
+		return errResult, nil
+	} else if turns != nil {
+		agentRuntime = &corev1alpha1.AgentRuntimeSpec{MaxTurns: turns}
 	}
 
 	if ws, ok := a[workspaceField]; ok {
-		if wsMap, ok := ws.(map[string]any); ok {
-			if agentRuntime == nil {
-				agentRuntime = &corev1alpha1.AgentRuntimeSpec{}
-			}
-			wsCfg := &corev1alpha1.WorkspaceConfig{}
-			if gitRepo := chatGetStringArg(wsMap, "gitRepo"); gitRepo != "" {
-				wsCfg.GitRepo = gitRepo
-			}
-			if branch := chatGetStringArg(wsMap, "branch"); branch != "" {
-				wsCfg.Branch = branch
-			}
-			if subPath := chatGetStringArg(wsMap, "subPath"); subPath != "" {
-				wsCfg.SubPath = subPath
-			}
-			if pushBranch := chatGetStringArg(wsMap, "pushBranch"); pushBranch != "" {
-				wsCfg.PushBranch = pushBranch
+		wsMap, ok := ws.(map[string]any)
+		if !ok {
+			return ChatToolErrorResult("invalid_arguments", "workspace must be an object", "Provide workspace as a JSON object or omit it")
+		}
+		wsCfg := &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentRead}
+		if intent := strings.ToLower(strings.TrimSpace(chatGetStringArg(wsMap, "intent"))); intent != "" {
+			switch corev1alpha1.WorkspaceIntent(intent) {
+			case corev1alpha1.WorkspaceIntentRead, corev1alpha1.WorkspaceIntentWrite:
+				wsCfg.Intent = corev1alpha1.WorkspaceIntent(intent)
+			default:
+				return ChatToolErrorResult("invalid_arguments", "workspace.intent must be read or write", "Use read for inspection or write for publication")
 			}
+		}
+		gitRepo, repoErr := canonicalAgentWorkspaceRepositoryArg("gitRepo", chatGetStringArg(wsMap, "gitRepo"))
+		if repoErr != nil {
+			return ChatToolErrorResult(repoErr.Type, repoErr.Message, repoErr.Suggestion)
+		}
+		wsCfg.GitRepo = gitRepo
+		wsCfg.Branch = chatGetStringArg(wsMap, "branch")
+		wsCfg.Ref = chatGetStringArg(wsMap, "ref")
+		wsCfg.SubPath = chatGetStringArg(wsMap, "subPath")
+		publicationGitRepo, repoErr := canonicalAgentWorkspaceRepositoryArg("publicationGitRepo", chatGetStringArg(wsMap, "publicationGitRepo"))
+		if repoErr != nil {
+			return ChatToolErrorResult(repoErr.Type, repoErr.Message, repoErr.Suggestion)
+		}
+		wsCfg.PublicationGitRepo = publicationGitRepo
+		wsCfg.PushBranch = chatGetStringArg(wsMap, "pushBranch")
+		wsCfg.PRBaseBranch = chatGetStringArg(wsMap, "prBaseBranch")
+		createPR, errResult, ok := parseCreatePRArg(wsMap)
+		if !ok {
+			return errResult, nil
+		}
+		wsCfg.CreatePR = createPR
+		if workspaceRequestsPublication(wsCfg) {
+			wsCfg.Intent = corev1alpha1.WorkspaceIntentWrite
+		}
+		readCredential := strings.TrimSpace(chatGetStringArg(wsMap, "readCredentialRef"))
+		publicationReadCredential := strings.TrimSpace(chatGetStringArg(wsMap, "publicationReadCredentialRef"))
+		publicationCredential := strings.TrimSpace(chatGetStringArg(wsMap, "publicationCredentialRef"))
+		forgeCredential := strings.TrimSpace(chatGetStringArg(wsMap, "forgeCredentialRef"))
+		if wsErr := agentWorkspacePreflightError(wsCfg, readCredential, publicationReadCredential, publicationCredential, forgeCredential); wsErr != nil {
+			return ChatToolErrorResult(wsErr.Type, wsErr.Message, wsErr.Suggestion)
+		}
+		// Only attach read credentials alongside a gitRepo: the controller
+		// workspace preflight rejects readCredentialRef without gitRepo, so
+		// auto-discovery must not doom a repository-free workspace.
+		if strings.TrimSpace(wsCfg.GitRepo) != "" {
 			agent, err := loadAgent(ctx, tc.Client, namespace, agentRef)
 			if err != nil {
 				result, _ := ChatToolErrorResult(internalErrorType, err.Error(), "")
 				return result, nil
 			}
-			secretRef, err := resolveWorkspaceGitSecretRef(ctx, tc.Client, namespace, agent, chatGetStringArg(wsMap, "gitSecretRef"))
+			readRef, err := resolveWorkspaceCredentialRef(ctx, tc.Client, namespace, agent, readCredential)
 			if err != nil {
 				result, _ := ChatToolErrorResult(internalErrorType, err.Error(), "")
 				return result, nil
 			}
-			wsCfg.GitSecretRef = secretRef
-			agentRuntime.Workspace = wsCfg
+			wsCfg.ReadCredentialRef = readRef
+		}
+		if publicationReadCredential != "" {
+			wsCfg.PublicationReadCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: publicationReadCredential}
 		}
+		if publicationCredential != "" {
+			wsCfg.PublicationCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: publicationCredential}
+		}
+		if forgeCredential != "" {
+			wsCfg.ForgeCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: forgeCredential}
+		}
+		task.Spec.Workspace = wsCfg
 	}
 
 	task.Spec.AgentRuntime = agentRuntime
@@ -151,3 +201,111 @@ func (t *CreateAgentTaskTool) Execute(ctx context.Context, args json.RawMessage)
 	tc.IncrementTasks()
 	return ChatToolSuccess(map[string]any{nameField: task.Name, namespaceField: task.Namespace, phaseField: taskPhasePendingString, messageField: taskCreatedMsg(schedule)})
 }
+
+// agentWorkspacePreflightError mirrors the tool-expressible subset of the
+// controller's validateACPWorkspacePreflight rules so obviously doomed Tasks
+// are rejected before consuming the session task budget. The controller-side
+// preflight remains authoritative; keep the mirrored conditions in exact
+// behavior parity with it (not stricter and not looser).
+func agentWorkspacePreflightError(wsCfg *corev1alpha1.WorkspaceConfig, readCredential, publicationReadCredential, publicationCredential, forgeCredential string) *ChatToolError {
+	invalidArgs := func(message, suggestion string) *ChatToolError {
+		return &ChatToolError{Type: "invalid_arguments", Message: message, Suggestion: suggestion}
+	}
+	if strings.TrimSpace(wsCfg.GitRepo) == "" {
+		switch {
+		case strings.TrimSpace(wsCfg.Branch) != "":
+			return invalidArgs("workspace.branch requires workspace.gitRepo", "Provide workspace.gitRepo or omit branch")
+		case strings.TrimSpace(wsCfg.Ref) != "":
+			return invalidArgs("workspace.ref requires workspace.gitRepo", "Provide workspace.gitRepo or omit ref")
+		case strings.TrimSpace(wsCfg.SubPath) != "":
+			return invalidArgs("workspace.subPath requires workspace.gitRepo", "Provide workspace.gitRepo or omit subPath")
+		case readCredential != "":
+			return invalidArgs("workspace.readCredentialRef requires workspace.gitRepo", "Provide workspace.gitRepo or omit readCredentialRef")
+		}
+	}
+	if wsCfg.Intent != corev1alpha1.WorkspaceIntentWrite {
+		switch {
+		case publicationReadCredential != "":
+			return invalidArgs("workspace.publicationReadCredentialRef requires write workspace intent", "Set workspace.intent to write or omit publicationReadCredentialRef")
+		case publicationCredential != "":
+			return invalidArgs("workspace.publicationCredentialRef requires write workspace intent", "Set workspace.intent to write or omit publicationCredentialRef")
+		case forgeCredential != "":
+			return invalidArgs("workspace.forgeCredentialRef requires write workspace intent", "Set workspace.intent to write or omit forgeCredentialRef")
+		}
+		return nil
+	}
+	if publicationCredential == "" {
+		return invalidArgs("workspace.publicationCredentialRef is required for write intent", "Provide a dedicated target-repository write credential")
+	}
+	if strings.TrimSpace(wsCfg.GitRepo) == "" {
+		return invalidArgs("workspace.gitRepo is required for write intent", "Provide the source repository URL for the publication workspace")
+	}
+	if pushBranch := strings.TrimSpace(wsCfg.PushBranch); pushBranch != "" {
+		if err := validateWorkspaceBranchArg(pushBranch); err != nil {
+			return invalidArgs(fmt.Sprintf("workspace.pushBranch is invalid: %v", err), "Provide a valid Git branch name")
+		}
+	}
+	if wsCfg.CreatePR {
+		if strings.TrimSpace(wsCfg.PRBaseBranch) == "" {
+			return invalidArgs("workspace.createPR requires workspace.prBaseBranch", "Provide the pull request base branch")
+		}
+		if err := validateWorkspaceBranchArg(strings.TrimSpace(wsCfg.PRBaseBranch)); err != nil {
+			return invalidArgs(fmt.Sprintf("workspace.prBaseBranch is invalid: %v", err), "Provide a valid pull request base branch name")
+		}
+		if forgeCredential == "" {
+			return invalidArgs("workspace.createPR requires workspace.forgeCredentialRef", "Provide a forge API credential Secret for pull request reconciliation")
+		}
+	}
+	return nil
+}
+
+// canonicalAgentWorkspaceRepositoryArg canonicalizes a workspace repository
+// argument to the only form the controller's workspace preflight accepts: a
+// credential-free HTTPS URL without query or fragment. GitHub-style SSH roots
+// (git@github.com:owner/repo[.git]) are first converted with
+// security.CanonicalRepositoryCloneURL, consistent with the repository-scan
+// path. The reject conditions mirror the RULE enforced by the controller's
+// canonicalWorkspaceRepositoryURL — keep them in exact behavior parity (not
+// stricter and not looser) so an accepted URL never fails the controller
+// preflight after the Task is created.
+func canonicalAgentWorkspaceRepositoryArg(field, raw string) (string, *ChatToolError) {
+	trimmed := strings.TrimSpace(raw)
+	if trimmed == "" {
+		return "", nil
+	}
+	invalid := func(detail string) *ChatToolError {
+		return &ChatToolError{
+			Type:    "invalid_arguments",
+			Message: fmt.Sprintf("workspace.%s %s", field, detail),
+			Suggestion: "Use a credential-free HTTPS URL such as https://github.com/owner/repo" +
+				" (GitHub SSH roots like git@github.com:owner/repo are converted automatically)",
+		}
+	}
+	canonical := security.CanonicalRepositoryCloneURL(trimmed)
+	parsed, err := url.Parse(canonical)
+	if err != nil || parsed.User != nil || parsed.Scheme != "https" || parsed.Host == "" ||
+		parsed.RawQuery != "" || parsed.ForceQuery || parsed.Fragment != "" || parsed.Opaque != "" {
+		return "", invalid("must be a credential-free HTTPS URL without query or fragment")
+	}
+	if port := parsed.Port(); port != "" && port != "443" {
+		return "", invalid("must use the default HTTPS port")
+	}
+	if parsed.RawPath != "" && parsed.EscapedPath() != parsed.Path {
+		return "", invalid("has a non-canonical escaped path")
+	}
+	cleaned := strings.TrimSuffix(strings.TrimPrefix(path.Clean(parsed.Path), "/"), ".git")
+	if cleaned == "" || cleaned == "." || parsed.Path == "/" || path.Clean(parsed.Path) != parsed.Path {
+		return "", invalid("path is invalid")
+	}
+	return canonical, nil
+}
+
+// validateWorkspaceBranchArg mirrors the controller's canonicalWorkspaceBranchRef
+// check with the same canonical branch-ref validator.
+func validateWorkspaceBranchArg(branch string) error {
+	ref := branch
+	if !strings.HasPrefix(ref, "refs/heads/") {
+		ref = "refs/heads/" + ref
+	}
+	return store.ValidateFullBranchRef(ref)
+}
diff --git a/internal/tools/create_agent_task_test.go b/internal/tools/create_agent_task_test.go
index 6ccbe0659..ea79627f9 100644
--- a/internal/tools/create_agent_task_test.go
+++ b/internal/tools/create_agent_task_test.go
@@ -66,6 +66,19 @@ func TestCreateAgentTaskTool_Parameters(t *testing.T) {
 			t.Errorf("missing %s property", key)
 		}
 	}
+	workspaceSchema, ok := props[workspaceField].(map[string]any)
+	if !ok {
+		t.Fatal("workspace schema is not an object")
+	}
+	workspaceProps, ok := workspaceSchema[jsonSchemaPropertiesField].(map[string]any)
+	if !ok {
+		t.Fatal("workspace schema is missing properties")
+	}
+	for _, key := range []string{"publicationReadCredentialRef", "publicationCredentialRef", "forgeCredentialRef"} {
+		if _, ok := workspaceProps[key]; !ok {
+			t.Errorf("workspace schema missing %s property", key)
+		}
+	}
 }
 
 func newCreateAgentTaskToolCtx(fc client.Client) context.Context {
@@ -123,12 +136,13 @@ func TestCreateAgentTaskTool_Execute(t *testing.T) {
 				"prompt":"Refactor module",
 				"agentRef":"claude-agent",
 				"maxTurns": 10,
-				"workspace": {
-					"gitRepo": "https://github.com/example/repo",
-					"branch": "main",
-					"pushBranch": "feature/refactor",
-					"subPath": "src"
-				}
+					"workspace": {
+						"gitRepo": "https://github.com/example/repo",
+						"branch": "main",
+						"pushBranch": "feature/refactor",
+						"publicationCredentialRef": "git-publish",
+						"subPath": "src"
+					}
 			}`),
 			checkResult: func(t *testing.T, result string) {
 				var r ChatToolResult
@@ -267,7 +281,194 @@ func TestCreateAgentTaskTool_Execute(t *testing.T) {
 	}
 }
 
-func TestCreateAgentTaskTool_Execute_PreservesExplicitGitSecretRef(t *testing.T) {
+func TestCreateAgentTaskTool_Execute_RejectsNonObjectWorkspace(t *testing.T) {
+	for _, workspace := range []string{`"repo"`, `["repo"]`, `null`} {
+		t.Run(workspace, func(t *testing.T) {
+			fc := newFakeClient()
+			ctx := newCreateAgentTaskToolCtx(fc)
+			tool := &CreateAgentTaskTool{}
+			args := json.RawMessage(`{"prompt":"Fix the bug","agentRef":"codex-agent","workspace":` + workspace + `}`)
+
+			result, err := tool.Execute(ctx, args)
+			if err != nil {
+				t.Fatalf("Execute() error = %v", err)
+			}
+			var response ChatToolResult
+			if err := json.Unmarshal([]byte(result), &response); err != nil {
+				t.Fatal(err)
+			}
+			if response.Success || response.ErrorType != errTypeInvalidArgs || !strings.Contains(response.Error, "workspace must be an object") {
+				t.Fatalf("response = %#v, want invalid workspace arguments", response)
+			}
+		})
+	}
+}
+
+func TestCreateAgentTaskTool_Execute_ParsesStringBooleanCreatePR(t *testing.T) {
+	fc := newFakeClient()
+	ctx := newCreateAgentTaskToolCtx(fc)
+	tool := &CreateAgentTaskTool{}
+	args := json.RawMessage(`{
+		"prompt":"Fix the bug",
+		"agentRef":"codex-agent",
+		"workspace":{
+			"gitRepo":"https://github.com/example/source.git",
+			"pushBranch":"orka/fix",
+			"prBaseBranch":"main",
+			"createPR":"true",
+			"readCredentialRef":"source-read",
+			"publicationCredentialRef":"target-write",
+			"forgeCredentialRef":"forge"
+		}
+	}`)
+
+	result, err := tool.Execute(ctx, args)
+	if err != nil {
+		t.Fatalf("Execute() error = %v", err)
+	}
+	var response ChatToolResult
+	if err := json.Unmarshal([]byte(result), &response); err != nil {
+		t.Fatal(err)
+	}
+	if !response.Success {
+		t.Fatalf("response = %#v, want success", response)
+	}
+	task := &corev1alpha1.Task{}
+	if err := fc.Get(t.Context(), apitypes.NamespacedName{Name: testAgentTaskGeneratedName, Namespace: defaultNamespace}, task); err != nil {
+		t.Fatal(err)
+	}
+	if task.Spec.Workspace == nil || !task.Spec.Workspace.CreatePR {
+		t.Fatalf("workspace = %#v, want createPR true from string boolean", task.Spec.Workspace)
+	}
+}
+
+func TestCreateAgentTaskTool_Execute_RejectsInvalidCreatePRAndMaxTurns(t *testing.T) {
+	tests := []struct {
+		name string
+		args string
+		want string
+	}{
+		{
+			name: "createPR",
+			args: `{"prompt":"Fix","agentRef":"codex-agent","workspace":{"gitRepo":"https://github.com/example/repo","createPR":"yes-please"}}`,
+			want: "workspace.createPR must be a boolean",
+		},
+		{
+			name: "maxTurns",
+			args: `{"prompt":"Fix","agentRef":"codex-agent","maxTurns":"lots"}`,
+			want: "maxTurns must be an integer",
+		},
+		{
+			name: "maxTurnsOutOfRange",
+			args: `{"prompt":"Fix","agentRef":"codex-agent","maxTurns":2147483648}`,
+			want: "maxTurns must be between 1 and 1000",
+		},
+		{
+			name: "maxTurnsNonPositive",
+			args: `{"prompt":"Fix","agentRef":"codex-agent","maxTurns":0}`,
+			want: "maxTurns must be between 1 and 1000",
+		},
+		{
+			name: "maxTurnsFractional",
+			args: `{"prompt":"Fix","agentRef":"codex-agent","maxTurns":1.9}`,
+			want: "maxTurns must be an integer",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fc := newFakeClient()
+			ctx := newCreateAgentTaskToolCtx(fc)
+			tool := &CreateAgentTaskTool{}
+
+			result, err := tool.Execute(ctx, json.RawMessage(tt.args))
+			if err != nil {
+				t.Fatalf("Execute() error = %v", err)
+			}
+			var response ChatToolResult
+			if err := json.Unmarshal([]byte(result), &response); err != nil {
+				t.Fatal(err)
+			}
+			if response.Success || response.ErrorType != errTypeInvalidArgs || !strings.Contains(response.Error, tt.want) {
+				t.Fatalf("response = %#v, want %q", response, tt.want)
+			}
+		})
+	}
+}
+
+func TestCreateAgentTaskTool_Execute_RequiresExplicitPublicationCredentialForWrite(t *testing.T) {
+	fc := newFakeClient()
+	ctx := newCreateAgentTaskToolCtx(fc)
+	tool := &CreateAgentTaskTool{}
+	args := json.RawMessage(`{
+		"prompt":"Fix the bug",
+		"agentRef":"codex-agent",
+		"workspace":{"gitRepo":"https://github.com/example/repo","intent":"write","readCredentialRef":"source-read"}
+	}`)
+
+	result, err := tool.Execute(ctx, args)
+	if err != nil {
+		t.Fatalf("Execute() error = %v", err)
+	}
+	var response ChatToolResult
+	if err := json.Unmarshal([]byte(result), &response); err != nil {
+		t.Fatal(err)
+	}
+	if response.Success || response.ErrorType != errTypeInvalidArgs || !strings.Contains(response.Error, "publicationCredentialRef is required") {
+		t.Fatalf("response = %#v, want explicit publication credential denial", response)
+	}
+}
+
+func TestCreateAgentTaskTool_Execute_BindsPublicationCredentialRoles(t *testing.T) {
+	fc := newFakeClient()
+	ctx := newCreateAgentTaskToolCtx(fc)
+	tool := &CreateAgentTaskTool{}
+	args := json.RawMessage(`{
+		"prompt":"Fix the bug",
+		"agentRef":"codex-agent",
+		"workspace":{
+			"gitRepo":"https://github.com/example/source.git",
+			"publicationGitRepo":"https://github.com/example/target.git",
+			"pushBranch":"orka/fix",
+			"prBaseBranch":"main",
+			"createPR":true,
+			"readCredentialRef":"source-read",
+			"publicationReadCredentialRef":"target-read",
+			"publicationCredentialRef":"target-write",
+			"forgeCredentialRef":"forge"
+		}
+	}`)
+
+	result, err := tool.Execute(ctx, args)
+	if err != nil {
+		t.Fatalf("Execute() error = %v", err)
+	}
+	var response ChatToolResult
+	if err := json.Unmarshal([]byte(result), &response); err != nil {
+		t.Fatal(err)
+	}
+	if !response.Success {
+		t.Fatalf("response = %#v, want success", response)
+	}
+	task := &corev1alpha1.Task{}
+	if err := fc.Get(t.Context(), apitypes.NamespacedName{Name: testAgentTaskGeneratedName, Namespace: defaultNamespace}, task); err != nil {
+		t.Fatal(err)
+	}
+	workspace := task.Spec.Workspace
+	if workspace == nil || workspace.ReadCredentialRef == nil || workspace.ReadCredentialRef.Name != "source-read" {
+		t.Fatalf("readCredentialRef = %#v, want source-read", workspace)
+	}
+	if workspace.PublicationReadCredentialRef == nil || workspace.PublicationReadCredentialRef.Name != "target-read" {
+		t.Fatalf("publicationReadCredentialRef = %#v, want target-read", workspace.PublicationReadCredentialRef)
+	}
+	if workspace.PublicationCredentialRef == nil || workspace.PublicationCredentialRef.Name != "target-write" {
+		t.Fatalf("publicationCredentialRef = %#v, want target-write", workspace.PublicationCredentialRef)
+	}
+	if workspace.ForgeCredentialRef == nil || workspace.ForgeCredentialRef.Name != "forge" {
+		t.Fatalf("forgeCredentialRef = %#v, want forge", workspace.ForgeCredentialRef)
+	}
+}
+
+func TestCreateAgentTaskTool_Execute_PreservesExplicitReadCredentialRef(t *testing.T) {
 	fc := newFakeClient(
 		&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "my-secret", Namespace: defaultNamespace}},
 	)
@@ -279,7 +480,7 @@ func TestCreateAgentTaskTool_Execute_PreservesExplicitGitSecretRef(t *testing.T)
 		"agentRef":"claude-agent",
 		"workspace":{
 			"gitRepo":"https://github.com/example/repo",
-			"gitSecretRef":"my-secret"
+			"readCredentialRef":"my-secret"
 		}
 	}`))
 	if err != nil {
@@ -298,18 +499,18 @@ func TestCreateAgentTaskTool_Execute_PreservesExplicitGitSecretRef(t *testing.T)
 	if err := fc.Get(context.Background(), apitypes.NamespacedName{Name: testAgentTaskGeneratedName, Namespace: defaultNamespace}, task); err != nil {
 		t.Fatalf("failed to get task: %v", err)
 	}
-	if task.Spec.AgentRuntime == nil || task.Spec.AgentRuntime.Workspace == nil {
+	if task.Spec.Workspace == nil {
 		t.Fatal("expected workspace to be set")
 	}
-	if task.Spec.AgentRuntime.Workspace.GitSecretRef == nil {
-		t.Fatal("expected gitSecretRef to be preserved")
+	if task.Spec.Workspace.ReadCredentialRef == nil {
+		t.Fatal("expected readCredentialRef to be preserved")
 	}
-	if task.Spec.AgentRuntime.Workspace.GitSecretRef.Name != "my-secret" {
-		t.Errorf("gitSecretRef = %q, want %q", task.Spec.AgentRuntime.Workspace.GitSecretRef.Name, "my-secret")
+	if task.Spec.Workspace.ReadCredentialRef.Name != "my-secret" {
+		t.Errorf("readCredentialRef = %q, want %q", task.Spec.Workspace.ReadCredentialRef.Name, "my-secret")
 	}
 }
 
-func TestCreateAgentTaskTool_Execute_AutoDiscoversGitSecretRefWhenOmitted(t *testing.T) {
+func TestCreateAgentTaskTool_Execute_AutoDiscoversReadCredentialRefWhenOmitted(t *testing.T) {
 	fc := newFakeClient(
 		&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: testGitCredentialsSecret, Namespace: defaultNamespace}},
 	)
@@ -339,14 +540,14 @@ func TestCreateAgentTaskTool_Execute_AutoDiscoversGitSecretRefWhenOmitted(t *tes
 	if err := fc.Get(context.Background(), apitypes.NamespacedName{Name: testAgentTaskGeneratedName, Namespace: defaultNamespace}, task); err != nil {
 		t.Fatalf("failed to get task: %v", err)
 	}
-	if task.Spec.AgentRuntime == nil || task.Spec.AgentRuntime.Workspace == nil {
+	if task.Spec.Workspace == nil {
 		t.Fatal("expected workspace to be set")
 	}
-	if task.Spec.AgentRuntime.Workspace.GitSecretRef == nil {
-		t.Fatal("expected gitSecretRef to be auto-discovered")
+	if task.Spec.Workspace.ReadCredentialRef == nil {
+		t.Fatal("expected readCredentialRef to be auto-discovered")
 	}
-	if task.Spec.AgentRuntime.Workspace.GitSecretRef.Name != testGitCredentialsSecret {
-		t.Fatalf("gitSecretRef = %q, want %q", task.Spec.AgentRuntime.Workspace.GitSecretRef.Name, testGitCredentialsSecret)
+	if task.Spec.Workspace.ReadCredentialRef.Name != testGitCredentialsSecret {
+		t.Fatalf("readCredentialRef = %q, want %q", task.Spec.Workspace.ReadCredentialRef.Name, testGitCredentialsSecret)
 	}
 }
 
@@ -386,11 +587,233 @@ func TestCreateAgentTaskTool_Execute_UsesCopilotAgentSecretForGitCredentials(t *
 	if err := fc.Get(context.Background(), apitypes.NamespacedName{Name: testAgentTaskGeneratedName, Namespace: defaultNamespace}, task); err != nil {
 		t.Fatalf("failed to get task: %v", err)
 	}
-	if task.Spec.AgentRuntime == nil || task.Spec.AgentRuntime.Workspace == nil || task.Spec.AgentRuntime.Workspace.GitSecretRef == nil {
-		t.Fatal("expected gitSecretRef to be populated from the copilot agent")
+	if task.Spec.Workspace == nil || task.Spec.Workspace.ReadCredentialRef == nil {
+		t.Fatal("expected readCredentialRef to be populated from the copilot agent")
+	}
+	if task.Spec.Workspace.ReadCredentialRef.Name != testCustomCopilotSecretName {
+		t.Fatalf("readCredentialRef = %q, want %q", task.Spec.Workspace.ReadCredentialRef.Name, testCustomCopilotSecretName)
+	}
+}
+
+func TestCreateAgentTaskTool_Execute_MirrorsWorkspacePreflight(t *testing.T) {
+	tests := []struct {
+		name    string
+		args    string
+		wantErr string
+	}{
+		{
+			name:    "branch requires gitRepo",
+			args:    `{"prompt":"p","agentRef":"a","workspace":{"branch":"main"}}`,
+			wantErr: "workspace.branch requires workspace.gitRepo",
+		},
+		{
+			name:    "ref requires gitRepo",
+			args:    `{"prompt":"p","agentRef":"a","workspace":{"ref":"abc123"}}`,
+			wantErr: "workspace.ref requires workspace.gitRepo",
+		},
+		{
+			name:    "subPath requires gitRepo",
+			args:    `{"prompt":"p","agentRef":"a","workspace":{"subPath":"src"}}`,
+			wantErr: "workspace.subPath requires workspace.gitRepo",
+		},
+		{
+			name:    "readCredentialRef requires gitRepo",
+			args:    `{"prompt":"p","agentRef":"a","workspace":{"readCredentialRef":"source-read"}}`,
+			wantErr: "workspace.readCredentialRef requires workspace.gitRepo",
+		},
+		{
+			name:    "publicationReadCredentialRef requires write intent",
+			args:    `{"prompt":"p","agentRef":"a","workspace":{"gitRepo":"https://github.com/example/repo","publicationReadCredentialRef":"target-read"}}`,
+			wantErr: "workspace.publicationReadCredentialRef requires write workspace intent",
+		},
+		{
+			name:    "publicationCredentialRef requires write intent",
+			args:    `{"prompt":"p","agentRef":"a","workspace":{"gitRepo":"https://github.com/example/repo","publicationCredentialRef":"target-write"}}`,
+			wantErr: "workspace.publicationCredentialRef requires write workspace intent",
+		},
+		{
+			name:    "forgeCredentialRef requires write intent",
+			args:    `{"prompt":"p","agentRef":"a","workspace":{"gitRepo":"https://github.com/example/repo","forgeCredentialRef":"forge"}}`,
+			wantErr: "workspace.forgeCredentialRef requires write workspace intent",
+		},
+		{
+			name:    "write intent requires gitRepo",
+			args:    `{"prompt":"p","agentRef":"a","workspace":{"intent":"write","publicationCredentialRef":"target-write"}}`,
+			wantErr: "workspace.gitRepo is required for write intent",
+		},
+		{
+			name:    "invalid pushBranch",
+			args:    `{"prompt":"p","agentRef":"a","workspace":{"gitRepo":"https://github.com/example/repo","pushBranch":"bad..branch","publicationCredentialRef":"target-write"}}`,
+			wantErr: "workspace.pushBranch is invalid",
+		},
+		{
+			name:    "createPR requires prBaseBranch",
+			args:    `{"prompt":"p","agentRef":"a","workspace":{"gitRepo":"https://github.com/example/repo","pushBranch":"orka/fix","createPR":true,"publicationCredentialRef":"target-write","forgeCredentialRef":"forge"}}`,
+			wantErr: "workspace.createPR requires workspace.prBaseBranch",
+		},
+		{
+			name:    "createPR with invalid prBaseBranch",
+			args:    `{"prompt":"p","agentRef":"a","workspace":{"gitRepo":"https://github.com/example/repo","pushBranch":"orka/fix","prBaseBranch":"bad branch","createPR":true,"publicationCredentialRef":"target-write","forgeCredentialRef":"forge"}}`,
+			wantErr: "workspace.prBaseBranch is invalid",
+		},
+		{
+			name:    "createPR requires forgeCredentialRef",
+			args:    `{"prompt":"p","agentRef":"a","workspace":{"gitRepo":"https://github.com/example/repo","pushBranch":"orka/fix","prBaseBranch":"main","createPR":true,"publicationCredentialRef":"target-write"}}`,
+			wantErr: "workspace.createPR requires workspace.forgeCredentialRef",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fc := newFakeClient()
+			ctx := newCreateAgentTaskToolCtx(fc)
+			tool := &CreateAgentTaskTool{}
+
+			result, err := tool.Execute(ctx, json.RawMessage(tt.args))
+			if err != nil {
+				t.Fatalf("Execute() error = %v", err)
+			}
+			var response ChatToolResult
+			if err := json.Unmarshal([]byte(result), &response); err != nil {
+				t.Fatal(err)
+			}
+			if response.Success || response.ErrorType != errTypeInvalidArgs || !strings.Contains(response.Error, tt.wantErr) {
+				t.Fatalf("response = %#v, want %q", response, tt.wantErr)
+			}
+			taskList := &corev1alpha1.TaskList{}
+			if err := fc.List(context.Background(), taskList); err != nil {
+				t.Fatal(err)
+			}
+			if len(taskList.Items) != 0 {
+				t.Fatalf("expected no Task to be created, got %d", len(taskList.Items))
+			}
+		})
+	}
+}
+
+func TestCreateAgentTaskTool_Execute_CanonicalizesWorkspaceRepositoryArgs(t *testing.T) {
+	tests := []struct {
+		name        string
+		args        string
+		wantErr     string
+		wantGitRepo string
+		wantPubRepo string
+	}{
+		{
+			name:        "github ssh gitRepo canonicalized",
+			args:        `{"prompt":"p","agentRef":"a","workspace":{"gitRepo":"git@github.com:example/repo.git"}}`,
+			wantGitRepo: "https://github.com/example/repo",
+		},
+		{
+			name:        "plain https gitRepo accepted",
+			args:        `{"prompt":"p","agentRef":"a","workspace":{"gitRepo":"https://github.com/example/repo"}}`,
+			wantGitRepo: "https://github.com/example/repo",
+		},
+		{
+			name:    "http gitRepo rejected",
+			args:    `{"prompt":"p","agentRef":"a","workspace":{"gitRepo":"http://github.com/example/repo"}}`,
+			wantErr: "workspace.gitRepo must be a credential-free HTTPS URL",
+		},
+		{
+			name:    "credential-embedding gitRepo rejected",
+			args:    `{"prompt":"p","agentRef":"a","workspace":{"gitRepo":"https://user:pass@github.com/example/repo"}}`,
+			wantErr: "workspace.gitRepo must be a credential-free HTTPS URL",
+		},
+		{
+			name: "github ssh publicationGitRepo canonicalized",
+			args: `{"prompt":"p","agentRef":"a","workspace":{"gitRepo":"https://github.com/example/repo",` +
+				`"publicationGitRepo":"git@github.com:example/fork.git","publicationCredentialRef":"target-write"}}`,
+			wantGitRepo: "https://github.com/example/repo",
+			wantPubRepo: "https://github.com/example/fork",
+		},
+		{
+			name: "http publicationGitRepo rejected",
+			args: `{"prompt":"p","agentRef":"a","workspace":{"gitRepo":"https://github.com/example/repo",` +
+				`"publicationGitRepo":"http://github.com/example/fork","publicationCredentialRef":"target-write"}}`,
+			wantErr: "workspace.publicationGitRepo must be a credential-free HTTPS URL",
+		},
+		{
+			name: "credential-embedding publicationGitRepo rejected",
+			args: `{"prompt":"p","agentRef":"a","workspace":{"gitRepo":"https://github.com/example/repo",` +
+				`"publicationGitRepo":"https://user:pass@github.com/example/fork","publicationCredentialRef":"target-write"}}`,
+			wantErr: "workspace.publicationGitRepo must be a credential-free HTTPS URL",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fc := newFakeClient()
+			ctx := newCreateAgentTaskToolCtx(fc)
+			tool := &CreateAgentTaskTool{}
+
+			result, err := tool.Execute(ctx, json.RawMessage(tt.args))
+			if err != nil {
+				t.Fatalf("Execute() error = %v", err)
+			}
+			var response ChatToolResult
+			if err := json.Unmarshal([]byte(result), &response); err != nil {
+				t.Fatal(err)
+			}
+			if tt.wantErr != "" {
+				if response.Success || response.ErrorType != errTypeInvalidArgs || !strings.Contains(response.Error, tt.wantErr) {
+					t.Fatalf("response = %#v, want invalid_arguments containing %q", response, tt.wantErr)
+				}
+				taskList := &corev1alpha1.TaskList{}
+				if err := fc.List(context.Background(), taskList); err != nil {
+					t.Fatal(err)
+				}
+				if len(taskList.Items) != 0 {
+					t.Fatalf("expected no Task to be created, got %d", len(taskList.Items))
+				}
+				return
+			}
+			if !response.Success {
+				t.Fatalf("expected success, got error: %s", response.Error)
+			}
+			task := &corev1alpha1.Task{}
+			if err := fc.Get(context.Background(), apitypes.NamespacedName{Name: testAgentTaskGeneratedName, Namespace: defaultNamespace}, task); err != nil {
+				t.Fatal(err)
+			}
+			if task.Spec.Workspace == nil {
+				t.Fatal("expected workspace to be set")
+			}
+			if task.Spec.Workspace.GitRepo != tt.wantGitRepo {
+				t.Fatalf("gitRepo = %q, want %q", task.Spec.Workspace.GitRepo, tt.wantGitRepo)
+			}
+			if task.Spec.Workspace.PublicationGitRepo != tt.wantPubRepo {
+				t.Fatalf("publicationGitRepo = %q, want %q", task.Spec.Workspace.PublicationGitRepo, tt.wantPubRepo)
+			}
+		})
+	}
+}
+
+func TestCreateAgentTaskTool_Execute_AllowsReadWorkspaceWithoutGitRepo(t *testing.T) {
+	// The controller preflight rejects readCredentialRef without gitRepo, so
+	// auto-discovery must not attach one to a repository-free read workspace.
+	fc := newFakeClient(
+		&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: testGitCredentialsSecret, Namespace: defaultNamespace}},
+	)
+	ctx := newCreateAgentTaskToolCtx(fc)
+	tool := &CreateAgentTaskTool{}
+
+	result, err := tool.Execute(ctx, json.RawMessage(`{"prompt":"p","agentRef":"a","workspace":{"intent":"read"}}`))
+	if err != nil {
+		t.Fatalf("Execute() error = %v", err)
+	}
+	var r ChatToolResult
+	if err := json.Unmarshal([]byte(result), &r); err != nil {
+		t.Fatal(err)
+	}
+	if !r.Success {
+		t.Fatalf("expected success, got error: %s", r.Error)
+	}
+	task := &corev1alpha1.Task{}
+	if err := fc.Get(context.Background(), apitypes.NamespacedName{Name: testAgentTaskGeneratedName, Namespace: defaultNamespace}, task); err != nil {
+		t.Fatal(err)
+	}
+	if task.Spec.Workspace == nil {
+		t.Fatal("expected workspace to be set")
 	}
-	if task.Spec.AgentRuntime.Workspace.GitSecretRef.Name != testCustomCopilotSecretName {
-		t.Fatalf("gitSecretRef = %q, want %q", task.Spec.AgentRuntime.Workspace.GitSecretRef.Name, testCustomCopilotSecretName)
+	if task.Spec.Workspace.ReadCredentialRef != nil {
+		t.Fatalf("readCredentialRef = %#v, want nil without gitRepo", task.Spec.Workspace.ReadCredentialRef)
 	}
 }
 
diff --git a/internal/tools/create_agent_test.go b/internal/tools/create_agent_test.go
index 7da094eaf..62063d903 100644
--- a/internal/tools/create_agent_test.go
+++ b/internal/tools/create_agent_test.go
@@ -9,34 +9,34 @@ package tools
 import (
 	"context"
 	"encoding/json"
+	"slices"
 	"strings"
 	"testing"
 
-	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	apitypes "k8s.io/apimachinery/pkg/types"
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/executionmode"
 	"github.com/orka-agents/orka/internal/labels"
-	"github.com/orka-agents/orka/internal/workerenv"
 )
 
 func TestCreateAgentTool_Name(t *testing.T) {
-	tool := NewCreateAgentTool(newFakeClient())
+	tool := NewCreateAgentTool(newFakeClient(), executionmode.HarnessV2)
 	if got := tool.Name(); got != createAgentToolName {
 		t.Errorf("Name() = %v, want %v", got, createAgentToolName)
 	}
 }
 
 func TestCreateAgentTool_Description(t *testing.T) {
-	tool := NewCreateAgentTool(newFakeClient())
+	tool := NewCreateAgentTool(newFakeClient(), executionmode.HarnessV2)
 	if got := tool.Description(); got == "" {
 		t.Error("Description() returned empty string")
 	}
 }
 
 func TestCreateAgentTool_Parameters(t *testing.T) {
-	tool := NewCreateAgentTool(newFakeClient())
+	tool := NewCreateAgentTool(newFakeClient(), executionmode.HarnessV2)
 	params := tool.Parameters()
 	if params == nil {
 		t.Fatal("Parameters() returned nil")
@@ -49,6 +49,22 @@ func TestCreateAgentTool_Parameters(t *testing.T) {
 	if schema[jsonSchemaTypeField] != typeObject {
 		t.Error("Parameters schema should have type: object")
 	}
+	required, ok := schema["required"].([]any)
+	if !ok {
+		t.Fatal("Parameters schema required field is not an array")
+	}
+	if slices.Contains(required, any("systemPrompt")) {
+		t.Error("Parameters schema must not require systemPrompt for OpenCode")
+	}
+	properties, ok := schema[jsonSchemaPropertiesField].(map[string]any)
+	if !ok {
+		t.Fatal("Parameters schema properties field is not an object")
+	}
+	systemPrompt, ok := properties["systemPrompt"].(map[string]any)
+	description, _ := systemPrompt[jsonSchemaDescriptionField].(string)
+	if !ok || !strings.Contains(description, "Required unless runtime.type is opencode") {
+		t.Fatalf("systemPrompt schema = %#v, want OpenCode omission guidance", systemPrompt)
+	}
 }
 
 func TestCreateAgentTool_Execute(t *testing.T) {
@@ -137,7 +153,7 @@ func TestCreateAgentTool_Execute(t *testing.T) {
 			}
 
 			k8sClient := newFakeClient(parentTask())
-			tool := NewCreateAgentTool(k8sClient)
+			tool := NewCreateAgentTool(k8sClient, executionmode.HarnessV2)
 
 			result, err := tool.Execute(context.Background(), tt.args)
 
@@ -177,7 +193,7 @@ func TestCreateAgentTool_Execute_OwnerReference(t *testing.T) {
 	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
 
 	k8sClient := newFakeClient(parentTask())
-	tool := NewCreateAgentTool(k8sClient)
+	tool := NewCreateAgentTool(k8sClient, executionmode.HarnessV2)
 
 	args := json.RawMessage(`{"role": "coder", "systemPrompt": "You code things"}`)
 	result, err := tool.Execute(context.Background(), args)
@@ -215,8 +231,8 @@ func TestCreateAgentTool_Execute_OwnerReference(t *testing.T) {
 	if ownerRef.Controller == nil || !*ownerRef.Controller {
 		t.Error("ownerRef.Controller should be true")
 	}
-	if ownerRef.BlockOwnerDeletion == nil || !*ownerRef.BlockOwnerDeletion {
-		t.Error("ownerRef.BlockOwnerDeletion should be true")
+	if ownerRef.BlockOwnerDeletion != nil {
+		t.Errorf("ownerRef.BlockOwnerDeletion = %#v, want nil", ownerRef.BlockOwnerDeletion)
 	}
 }
 
@@ -225,7 +241,7 @@ func TestCreateAgentTool_Execute_AutoNaming(t *testing.T) {
 	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
 
 	k8sClient := newFakeClient(parentTask())
-	tool := NewCreateAgentTool(k8sClient)
+	tool := NewCreateAgentTool(k8sClient, executionmode.HarnessV2)
 
 	args := json.RawMessage(`{"role": "reviewer", "systemPrompt": "You review code"}`)
 	result, err := tool.Execute(context.Background(), args)
@@ -259,7 +275,7 @@ func TestCreateAgentTool_Execute_AllFields(t *testing.T) {
 	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
 
 	k8sClient := newFakeClient(parentTask())
-	tool := NewCreateAgentTool(k8sClient)
+	tool := NewCreateAgentTool(k8sClient, executionmode.HarnessV2)
 
 	args := json.RawMessage(`{
 		"role": "coder",
@@ -379,7 +395,7 @@ func TestCreateAgentTool_Execute_InheritedModelProvider(t *testing.T) {
 	t.Setenv("ORKA_AI_MODEL", testGPT4OModel)
 
 	k8sClient := newFakeClient(parentTask())
-	tool := NewCreateAgentTool(k8sClient)
+	tool := NewCreateAgentTool(k8sClient, executionmode.HarnessV2)
 
 	args := json.RawMessage(`{"role": "analyst", "systemPrompt": "You analyze data"}`)
 	result, err := tool.Execute(context.Background(), args)
@@ -416,301 +432,269 @@ func TestCreateAgentTool_Execute_InheritedModelProvider(t *testing.T) {
 	}
 }
 
-func TestCreateAgentTool_Execute_PreservesExplicitRuntimeSecretRef(t *testing.T) {
-	t.Setenv(envOrkaTaskName, parentTaskName)
-	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
+func TestCreateAgentTool_Execute_BuiltInRuntimesAreCredentialFree(t *testing.T) {
+	tests := []struct {
+		name        string
+		runtimeArgs string
+		runtimeType corev1alpha1.AgentRuntimeType
+	}{
+		{
+			name:        "claude without legacy secret",
+			runtimeArgs: `{"type":"claude"}`,
+			runtimeType: corev1alpha1.AgentRuntimeClaude,
+		},
+		{
+			name:        "codex without legacy secret",
+			runtimeArgs: `{"type":"codex"}`,
+			runtimeType: corev1alpha1.AgentRuntimeCodex,
+		},
+		{
+			name:        "copilot without legacy secret",
+			runtimeArgs: `{"type":"copilot"}`,
+			runtimeType: corev1alpha1.AgentRuntimeCopilot,
+		},
+		{
+			name:        "legacy secretRef is not retained",
+			runtimeArgs: `{"type":"claude","secretRef":"missing-legacy-secret"}`,
+			runtimeType: corev1alpha1.AgentRuntimeClaude,
+		},
+		{
+			name:        "runtime type is normalized",
+			runtimeArgs: `{"type":"  claude  "}`,
+			runtimeType: corev1alpha1.AgentRuntimeClaude,
+		},
+	}
 
-	k8sClient := newFakeClient(
-		parentTask(),
-		&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: claudeCredentialsSecretName, Namespace: defaultNamespace}},
-	)
-	tool := NewCreateAgentTool(k8sClient)
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Setenv(envOrkaTaskName, parentTaskName)
+			t.Setenv(envOrkaTaskNamespace, defaultNamespace)
 
-	args := json.RawMessage(`{
-		"role": "coder",
-		"systemPrompt": "You write code",
-		"runtime": {
-			"type": "claude",
-			"secretRef": "claude-credentials"
-		}
-	}`)
+			k8sClient := newFakeClient(parentTask())
+			tool := NewCreateAgentTool(k8sClient, executionmode.HarnessV2)
+			args := json.RawMessage(`{"role":"coder","systemPrompt":"You write code","runtime":` + tt.runtimeArgs + `}`)
 
-	result, err := tool.Execute(context.Background(), args)
-	if err != nil {
-		t.Fatalf("Execute() error = %v", err)
-	}
+			result, err := tool.Execute(context.Background(), args)
+			if err != nil {
+				t.Fatalf("Execute() error = %v", err)
+			}
 
-	var agentResult CreateAgentResult
-	if err := json.Unmarshal([]byte(result), &agentResult); err != nil {
-		t.Fatalf("failed to unmarshal result: %v", err)
-	}
+			var agentResult CreateAgentResult
+			if err := json.Unmarshal([]byte(result), &agentResult); err != nil {
+				t.Fatalf("failed to unmarshal result: %v", err)
+			}
 
-	agent := &corev1alpha1.Agent{}
-	if err := k8sClient.Get(context.Background(), apitypes.NamespacedName{
-		Name:      agentResult.AgentName,
-		Namespace: agentResult.Namespace,
-	}, agent); err != nil {
-		t.Fatalf("failed to get agent: %v", err)
-	}
+			agent := &corev1alpha1.Agent{}
+			if err := k8sClient.Get(context.Background(), apitypes.NamespacedName{
+				Name:      agentResult.AgentName,
+				Namespace: agentResult.Namespace,
+			}, agent); err != nil {
+				t.Fatalf("failed to get agent: %v", err)
+			}
 
-	if agent.Spec.Runtime == nil {
-		t.Fatal("agent.Spec.Runtime is nil")
-	}
-	if agent.Spec.Runtime.Type != corev1alpha1.AgentRuntimeType(runtimeTypeClaude) {
-		t.Errorf("runtime.type = %q, want %q", agent.Spec.Runtime.Type, runtimeTypeClaude)
-	}
-	if agent.Spec.SecretRef == nil {
-		t.Fatal("agent.Spec.SecretRef is nil")
-	}
-	if agent.Spec.SecretRef.Name != claudeCredentialsSecretName {
-		t.Errorf("secretRef.name = %q, want %q", agent.Spec.SecretRef.Name, claudeCredentialsSecretName)
+			if agent.Spec.Runtime == nil || agent.Spec.Runtime.Type != tt.runtimeType {
+				t.Fatalf("runtime = %#v, want type %q", agent.Spec.Runtime, tt.runtimeType)
+			}
+			if got := agent.BuiltInContractVersion(); got != corev1alpha1.AgentRuntimeContractHarnessV2 {
+				t.Fatalf("contractVersion = %q, want %q", got, corev1alpha1.AgentRuntimeContractHarnessV2)
+			}
+			if agent.Spec.ProviderRef != nil {
+				t.Fatalf("providerRef = %#v, want nil for runtime agent", agent.Spec.ProviderRef)
+			}
+			if agent.Spec.SecretRef != nil {
+				t.Fatalf("secretRef = %#v, want nil for built-in ACP runtime", agent.Spec.SecretRef)
+			}
+		})
 	}
 }
 
-func TestCreateAgentTool_Execute_AutoDiscoversRuntimeSecretRefWhenOmitted(t *testing.T) {
+func TestCreateAgentTool_Execute_DefaultsHarnessV1Contract(t *testing.T) {
 	t.Setenv(envOrkaTaskName, parentTaskName)
 	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
 
-	k8sClient := newFakeClient(
-		parentTask(),
-		&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: claudeAPIKeySecretName, Namespace: defaultNamespace}},
+	k8sClient := newFakeClient(parentTask())
+	result, err := NewCreateAgentTool(k8sClient, executionmode.HarnessV1).Execute(
+		context.Background(),
+		json.RawMessage(`{"role":"coder","systemPrompt":"You write code","runtime":{"type":"codex"}}`),
 	)
-	tool := NewCreateAgentTool(k8sClient)
-
-	args := json.RawMessage(`{
-		"role": "coder",
-		"systemPrompt": "You write code",
-		"runtime": {
-			"type": "claude"
-		}
-	}`)
-
-	result, err := tool.Execute(context.Background(), args)
 	if err != nil {
 		t.Fatalf("Execute() error = %v", err)
 	}
 
-	var agentResult CreateAgentResult
-	if err := json.Unmarshal([]byte(result), &agentResult); err != nil {
+	var createdResult CreateAgentResult
+	if err := json.Unmarshal([]byte(result), &createdResult); err != nil {
 		t.Fatalf("failed to unmarshal result: %v", err)
 	}
-
-	agent := &corev1alpha1.Agent{}
+	created := &corev1alpha1.Agent{}
 	if err := k8sClient.Get(context.Background(), apitypes.NamespacedName{
-		Name:      agentResult.AgentName,
-		Namespace: agentResult.Namespace,
-	}, agent); err != nil {
-		t.Fatalf("failed to get agent: %v", err)
+		Name: createdResult.AgentName, Namespace: createdResult.Namespace,
+	}, created); err != nil {
+		t.Fatalf("failed to get Agent: %v", err)
 	}
-
-	if agent.Spec.Runtime == nil {
-		t.Fatal("agent.Spec.Runtime is nil")
-	}
-	if agent.Spec.Runtime.Type != corev1alpha1.AgentRuntimeType(runtimeTypeClaude) {
-		t.Errorf("runtime.type = %q, want %q", agent.Spec.Runtime.Type, runtimeTypeClaude)
-	}
-	if agent.Spec.SecretRef == nil {
-		t.Fatal("agent.Spec.SecretRef is nil")
-	}
-	if agent.Spec.SecretRef.Name != claudeAPIKeySecretName {
-		t.Errorf("secretRef.name = %q, want %q", agent.Spec.SecretRef.Name, claudeAPIKeySecretName)
+	if got := created.BuiltInContractVersion(); got != corev1alpha1.AgentRuntimeContractHarnessV1 {
+		t.Fatalf("contractVersion = %q, want %q", got, corev1alpha1.AgentRuntimeContractHarnessV1)
 	}
 }
 
-func TestCreateAgentTool_Execute_AutoDiscoversCodexRuntimeSecretRefWhenOmitted(t *testing.T) {
-	t.Setenv(envOrkaTaskName, parentTaskName)
-	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
-
-	k8sClient := newFakeClient(
-		parentTask(),
-		&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: codexProxyTokenSecretName, Namespace: defaultNamespace}},
-	)
-	tool := NewCreateAgentTool(k8sClient)
-
-	args := json.RawMessage(`{
-		"role": "coder",
-		"systemPrompt": "You write code",
-		"runtime": {
-			"type": "codex"
-		}
-	}`)
-
-	result, err := tool.Execute(context.Background(), args)
-	if err != nil {
-		t.Fatalf("Execute() error = %v", err)
-	}
-
-	var agentResult CreateAgentResult
-	if err := json.Unmarshal([]byte(result), &agentResult); err != nil {
-		t.Fatalf("failed to unmarshal result: %v", err)
-	}
-
-	agent := &corev1alpha1.Agent{}
-	if err := k8sClient.Get(context.Background(), apitypes.NamespacedName{
-		Name:      agentResult.AgentName,
-		Namespace: agentResult.Namespace,
-	}, agent); err != nil {
-		t.Fatalf("failed to get agent: %v", err)
-	}
-
-	if agent.Spec.Runtime == nil {
-		t.Fatal("agent.Spec.Runtime is nil")
-	}
-	if agent.Spec.Runtime.Type != corev1alpha1.AgentRuntimeType("codex") {
-		t.Errorf("runtime.type = %q, want %q", agent.Spec.Runtime.Type, "codex")
-	}
-	if agent.Spec.SecretRef == nil {
-		t.Fatal("agent.Spec.SecretRef is nil")
-	}
-	if agent.Spec.SecretRef.Name != codexProxyTokenSecretName {
-		t.Errorf("secretRef.name = %q, want %q", agent.Spec.SecretRef.Name, codexProxyTokenSecretName)
+func TestCreateAgentTool_Execute_RejectsModelLimitsForNonOpenCodeBuiltIns(t *testing.T) {
+	for _, tt := range []struct {
+		name      string
+		runtime   string
+		modelJSON string
+		wantError string
+	}{
+		{name: "codex context window", runtime: "codex", modelJSON: `{"name":"gpt-5.4","contextWindow":32768}`, wantError: "contextWindow"},
+		{name: "claude max tokens", runtime: "claude", modelJSON: `{"name":"claude-sonnet","maxTokens":4096}`, wantError: "maxTokens"},
+		{name: "copilot context window", runtime: "copilot", modelJSON: `{"name":"gpt-5.3-codex","contextWindow":32768}`, wantError: "contextWindow"},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Setenv(envOrkaTaskName, parentTaskName)
+			t.Setenv(envOrkaTaskNamespace, defaultNamespace)
+			_, err := NewCreateAgentTool(newFakeClient(parentTask()), executionmode.HarnessV2).Execute(context.Background(), json.RawMessage(
+				`{"role":"coder","systemPrompt":"You write code","model":`+tt.modelJSON+`,"runtime":{"type":"`+tt.runtime+`"}}`,
+			))
+			if err == nil || !strings.Contains(err.Error(), tt.wantError) {
+				t.Fatalf("Execute() error = %v, want %q rejection", err, tt.wantError)
+			}
+		})
 	}
 }
 
-func TestCreateAgentTool_Execute_AcceptsCustomRuntimeSecretRef(t *testing.T) {
-	t.Setenv(envOrkaTaskName, parentTaskName)
-	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
-
-	k8sClient := newFakeClient(
-		parentTask(),
-		&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: testRuntimeCredsSecretName, Namespace: defaultNamespace}},
+func TestNormalizedCreateAgentModelAcceptsQualifiedIDWithNestedSlashes(t *testing.T) {
+	contextWindow := int32(32768)
+	maxTokens := int32(4096)
+	got, err := normalizedCreateAgentModel(
+		&RuntimeArgs{Type: string(corev1alpha1.AgentRuntimeOpencode)},
+		&ModelArgs{Name: "openrouter/anthropic/claude-sonnet-4", ContextWindow: &contextWindow, MaxTokens: &maxTokens},
 	)
-	tool := NewCreateAgentTool(k8sClient)
-
-	args := json.RawMessage(`{
-		"role": "coder",
-		"systemPrompt": "You write code",
-		"runtime": {
-			"type": "claude",
-			"secretRef": "runtime-creds"
-		}
-	}`)
-
-	result, err := tool.Execute(context.Background(), args)
 	if err != nil {
-		t.Fatalf("Execute() error = %v", err)
-	}
-
-	var agentResult CreateAgentResult
-	if err := json.Unmarshal([]byte(result), &agentResult); err != nil {
-		t.Fatalf("failed to unmarshal result: %v", err)
-	}
-
-	agent := &corev1alpha1.Agent{}
-	if err := k8sClient.Get(context.Background(), apitypes.NamespacedName{
-		Name:      agentResult.AgentName,
-		Namespace: agentResult.Namespace,
-	}, agent); err != nil {
-		t.Fatalf("failed to get agent: %v", err)
-	}
-	if agent.Spec.SecretRef == nil {
-		t.Fatal("agent.Spec.SecretRef is nil")
+		t.Fatal(err)
 	}
-	if agent.Spec.SecretRef.Name != testRuntimeCredsSecretName {
-		t.Errorf("secretRef.name = %q, want %q", agent.Spec.SecretRef.Name, testRuntimeCredsSecretName)
+	if got != "openrouter/anthropic/claude-sonnet-4" {
+		t.Fatalf("normalized model = %q, want full provider-scoped ID", got)
 	}
 }
 
-func TestCreateAgentTool_Execute_AcceptsOpencodeRuntimeSecretRef(t *testing.T) {
+func TestCreateAgentTool_Execute_UsesBuiltInOpenCode(t *testing.T) {
 	t.Setenv(envOrkaTaskName, parentTaskName)
 	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
+	k8sClient := newFakeClient(parentTask())
+	tool := NewCreateAgentTool(k8sClient, executionmode.HarnessV2)
 
-	k8sClient := newFakeClient(
-		parentTask(),
-		&corev1.Secret{
-			ObjectMeta: metav1.ObjectMeta{Name: testRuntimeCredsSecretName, Namespace: defaultNamespace},
-			Data: map[string][]byte{
-				workerenv.OpenAIBaseURL: []byte("https://models.example.invalid/v1"),
-				workerenv.OpenAIAPIKey:  []byte("credential"),
-			},
-		},
-	)
-	tool := NewCreateAgentTool(k8sClient)
-
-	args := json.RawMessage(`{
-		"role": "coder",
-		"systemPrompt": "You write code",
-		"model": {"provider": "moonshotai", "name": "Kimi-K2-Instruct-0905"},
-		"runtime": {
-			"type": "opencode",
-			"secretRef": "runtime-creds"
-		}
-	}`)
-
-	result, err := tool.Execute(context.Background(), args)
+	result, err := tool.Execute(context.Background(), json.RawMessage(`{
+		"role":"coder",
+		"model":{"provider":"moonshotai","name":"Kimi-K2-Instruct-0905","contextWindow":32768,"maxTokens":4096},
+		"runtime":{"type":"opencode"}
+	}`))
 	if err != nil {
 		t.Fatalf("Execute() error = %v", err)
 	}
-
 	var agentResult CreateAgentResult
 	if err := json.Unmarshal([]byte(result), &agentResult); err != nil {
-		t.Fatalf("failed to unmarshal result: %v", err)
+		t.Fatal(err)
 	}
-
-	agent := &corev1alpha1.Agent{}
-	if err := k8sClient.Get(context.Background(), apitypes.NamespacedName{
-		Name:      agentResult.AgentName,
-		Namespace: agentResult.Namespace,
-	}, agent); err != nil {
-		t.Fatalf("failed to get agent: %v", err)
+	var agent corev1alpha1.Agent
+	if err := k8sClient.Get(context.Background(), apitypes.NamespacedName{Name: agentResult.AgentName, Namespace: agentResult.Namespace}, &agent); err != nil {
+		t.Fatal(err)
 	}
 	if agent.Spec.Runtime == nil || agent.Spec.Runtime.Type != corev1alpha1.AgentRuntimeOpencode {
 		t.Fatalf("runtime = %#v, want opencode", agent.Spec.Runtime)
 	}
-	if agent.Spec.Model == nil || agent.Spec.Model.Name != "moonshotai/Kimi-K2-Instruct-0905" {
+	if agent.Spec.Model == nil || agent.Spec.Model.Name != "moonshotai/Kimi-K2-Instruct-0905" || agent.Spec.Model.Provider != "" {
 		t.Fatalf("model = %#v, want provider-qualified OpenCode model", agent.Spec.Model)
 	}
-	if agent.Spec.Model.Provider != "" {
-		t.Fatalf("model.provider = %q, want empty for runtime agent", agent.Spec.Model.Provider)
+	wantTools := []string{"Read", "Write", "Edit", "Bash", "Glob", "Grep"}
+	if !slices.Equal(agent.Spec.Runtime.DefaultAllowedTools, wantTools) {
+		t.Fatalf("defaultAllowedTools = %#v, want %#v", agent.Spec.Runtime.DefaultAllowedTools, wantTools)
 	}
-	if agent.Spec.ProviderRef != nil {
-		t.Fatalf("providerRef = %#v, want nil for runtime agent", agent.Spec.ProviderRef)
+	if agent.Spec.Runtime.DefaultAllowBash == nil || !*agent.Spec.Runtime.DefaultAllowBash {
+		t.Fatalf("defaultAllowBash = %v, want true", agent.Spec.Runtime.DefaultAllowBash)
 	}
-	if agent.Spec.SecretRef == nil || agent.Spec.SecretRef.Name != testRuntimeCredsSecretName {
-		t.Fatalf("secretRef = %#v, want %q", agent.Spec.SecretRef, testRuntimeCredsSecretName)
+	if agent.Spec.ProviderRef != nil || agent.Spec.SecretRef != nil {
+		t.Fatalf("providerRef=%#v secretRef=%#v, want credential-free runtime", agent.Spec.ProviderRef, agent.Spec.SecretRef)
+	}
+	if agent.Spec.SystemPrompt != nil {
+		t.Fatalf("systemPrompt = %#v, want nil for OpenCode runtime", agent.Spec.SystemPrompt)
 	}
 }
 
-func TestCreateAgentTool_Execute_RejectsOpencodeWithoutModel(t *testing.T) {
+func TestCreateAgentTool_Execute_PreservesExplicitEmptyOpenCodeTools(t *testing.T) {
 	t.Setenv(envOrkaTaskName, parentTaskName)
 	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
-	t.Setenv(workerenv.AIModel, "coordinator-model")
-
-	tool := NewCreateAgentTool(newFakeClient(parentTask()))
-	args := json.RawMessage(`{
-		"role": "coder",
-		"systemPrompt": "You write code",
-		"runtime": {"type": "opencode"}
-	}`)
-
-	_, err := tool.Execute(context.Background(), args)
-	if err == nil || !strings.Contains(err.Error(), "model.name is required for opencode") {
-		t.Fatalf("Execute() error = %v, want missing OpenCode model rejection", err)
+	k8sClient := newFakeClient(parentTask())
+	result, err := NewCreateAgentTool(k8sClient, executionmode.HarnessV2).Execute(context.Background(), json.RawMessage(`{
+		"role":"coder","model":{"name":"openai/gpt-5.4","contextWindow":32768,"maxTokens":4096},
+		"runtime":{"type":"opencode","defaultAllowedTools":[],"defaultAllowBash":false}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var agentResult CreateAgentResult
+	if err := json.Unmarshal([]byte(result), &agentResult); err != nil {
+		t.Fatal(err)
+	}
+	var agent corev1alpha1.Agent
+	if err := k8sClient.Get(context.Background(), apitypes.NamespacedName{Name: agentResult.AgentName, Namespace: agentResult.Namespace}, &agent); err != nil {
+		t.Fatal(err)
+	}
+	if agent.Spec.Runtime == nil || agent.Spec.Runtime.DefaultAllowedTools == nil || len(agent.Spec.Runtime.DefaultAllowedTools) != 0 {
+		t.Fatalf("defaultAllowedTools = %#v, want explicit empty", agent.Spec.Runtime)
 	}
 }
 
-func TestCreateAgentTool_Execute_RejectsMissingRuntimeSecretRef(t *testing.T) {
+func TestCreateAgentTool_Execute_RejectsOpenCodeSystemPrompt(t *testing.T) {
 	t.Setenv(envOrkaTaskName, parentTaskName)
 	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
+	_, err := NewCreateAgentTool(newFakeClient(parentTask()), executionmode.HarnessV2).Execute(context.Background(), json.RawMessage(`{
+		"role":"coder",
+		"systemPrompt":"You write code",
+		"model":{"name":"openai/gpt-5.4","contextWindow":32768,"maxTokens":4096},
+		"runtime":{"type":"opencode"}
+	}`))
+	if err == nil || !strings.Contains(err.Error(), "does not support systemPrompt") {
+		t.Fatalf("Execute() error = %v, want OpenCode systemPrompt rejection", err)
+	}
+}
 
-	k8sClient := newFakeClient(parentTask())
-	tool := NewCreateAgentTool(k8sClient)
-
-	args := json.RawMessage(`{
-		"role": "coder",
-		"systemPrompt": "You write code",
-		"runtime": {
-			"type": "claude",
-			"secretRef": "runtime-creds"
-		}
-	}`)
-
-	_, err := tool.Execute(context.Background(), args)
-	if err == nil {
-		t.Fatal("expected error")
+func TestCreateAgentTool_Execute_RejectsInvalidOpenCodeConfiguration(t *testing.T) {
+	for name, args := range map[string]string{
+		"missing model":     `{"role":"coder","runtime":{"type":"opencode"}}`,
+		"bare model":        `{"role":"coder","model":{"name":"gpt-5.4","contextWindow":32768,"maxTokens":4096},"runtime":{"type":"opencode"}}`,
+		"substitution":      `{"role":"coder","model":{"name":"{env:PROVIDER}/gpt","contextWindow":32768,"maxTokens":4096},"runtime":{"type":"opencode"}}`,
+		"provider conflict": `{"role":"coder","model":{"provider":"anthropic","name":"openai/gpt-5.4","contextWindow":32768,"maxTokens":4096},"runtime":{"type":"opencode"}}`,
+		"missing context":   `{"role":"coder","model":{"name":"openai/gpt-5.4","maxTokens":4096},"runtime":{"type":"opencode"}}`,
+		"missing output":    `{"role":"coder","model":{"name":"openai/gpt-5.4","contextWindow":32768},"runtime":{"type":"opencode"}}`,
+		"inverted limits":   `{"role":"coder","model":{"name":"openai/gpt-5.4","contextWindow":4096,"maxTokens":4096},"runtime":{"type":"opencode"}}`,
+		"legacy secret":     `{"role":"coder","model":{"name":"openai/gpt-5.4","contextWindow":32768,"maxTokens":4096},"runtime":{"type":"opencode","secretRef":"legacy"}}`,
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Setenv(envOrkaTaskName, parentTaskName)
+			t.Setenv(envOrkaTaskNamespace, defaultNamespace)
+			_, err := NewCreateAgentTool(newFakeClient(parentTask()), executionmode.HarnessV2).Execute(context.Background(), json.RawMessage(args))
+			if err == nil {
+				t.Fatal("Execute() accepted invalid OpenCode configuration")
+			}
+		})
 	}
-	if !strings.Contains(err.Error(), notFoundMessage) {
-		t.Fatalf("error = %v, want it to mention not found", err)
+}
+
+func TestCreateAgentTool_Execute_RejectsUnsupportedRuntime(t *testing.T) {
+	for _, runtimeArgs := range []string{
+		`{"type":"unknown"}`,
+		`{}`,
+		`{"type":"   "}`,
+	} {
+		t.Run(runtimeArgs, func(t *testing.T) {
+			t.Setenv(envOrkaTaskName, parentTaskName)
+			t.Setenv(envOrkaTaskNamespace, defaultNamespace)
+			k8sClient := newFakeClient(parentTask())
+			tool := NewCreateAgentTool(k8sClient, executionmode.HarnessV2)
+			args := json.RawMessage(`{"role":"coder","systemPrompt":"You write code","runtime":` + runtimeArgs + `}`)
+			_, err := tool.Execute(context.Background(), args)
+			if err == nil || (!strings.Contains(err.Error(), "unsupported runtime type") && !strings.Contains(err.Error(), "runtime.type is required")) {
+				t.Fatalf("Execute() error = %v, want invalid runtime rejection", err)
+			}
+		})
 	}
 }
 
@@ -731,7 +715,7 @@ func TestCreateAgentTool_Execute_DefaultNamespace(t *testing.T) {
 	}
 
 	k8sClient := newFakeClient(parent)
-	tool := NewCreateAgentTool(k8sClient)
+	tool := NewCreateAgentTool(k8sClient, executionmode.HarnessV2)
 
 	args := json.RawMessage(`{"role": "coder", "systemPrompt": "Code stuff"}`)
 	result, err := tool.Execute(context.Background(), args)
diff --git a/internal/tools/create_container_task.go b/internal/tools/create_container_task.go
index 620d67a99..11c4f8875 100644
--- a/internal/tools/create_container_task.go
+++ b/internal/tools/create_container_task.go
@@ -13,7 +13,6 @@ import (
 	"os"
 	"strings"
 
-	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
@@ -41,15 +40,17 @@ func (t *CreateContainerTaskTool) Description() string {
 }
 
 func (t *CreateContainerTaskTool) Parameters() json.RawMessage {
-	return mustMarshalSchema(map[string]any{jsonSchemaTypeField: jsonSchemaTypeObject, jsonSchemaPropertiesField: map[string]any{nameField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: taskNameDescription}, "image": map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Container image to run. Leave empty to use the default worker image which includes common tools (kubectl, sh) and writes results to a ConfigMap. Only set a custom image if you need a specific runtime not in the default worker."},
+	return mustMarshalSchema(map[string]any{jsonSchemaTypeField: jsonSchemaTypeObject, jsonSchemaPropertiesField: map[string]any{nameField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: taskNameDescription}, "image": map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Container image to run. Leave empty to use the default worker image which includes common tools (kubectl, sh) and writes results to a ConfigMap. Only set a custom image if you need a specific runtime not in the default worker. Custom images cannot publish workspace changes: do not combine with workspace.pushBranch."},
 		"command": map[string]any{jsonSchemaTypeField: jsonSchemaTypeArray, itemsField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString}, jsonSchemaDescriptionField: "Command to execute"},
 		"args":    map[string]any{jsonSchemaTypeField: jsonSchemaTypeArray, itemsField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString}, jsonSchemaDescriptionField: "Arguments to the command"}, workspaceField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeObject, jsonSchemaDescriptionField: "Git workspace for the command. Required when the command validates, builds, tests, or inspects repository files. Orka prepares /workspace before running the container and records workspace provenance in the result.", jsonSchemaPropertiesField: map[string]any{
-			"gitRepo":      map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Git repository URL"},
-			"branch":       map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Git branch to clone from (must exist). Omit to use the default branch."},
-			"ref":          map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Exact git ref, commit SHA, or tag to checkout. Prefer this for validation."},
-			"gitSecretRef": map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Optional Secret name containing git credentials. Omit for public repositories. Container tasks do not auto-discover git credentials."},
-			"subPath":      map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Sub-path within the repo to run from"},
-			"pushBranch":   map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Branch name to push command-produced changes to. Omit for read-only validation."},
+			"gitRepo":                  map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Source Git repository URL"},
+			"branch":                   map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Source branch to clone from (must exist). Omit to use the default branch."},
+			"ref":                      map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Exact source git ref, commit SHA, or tag to checkout. Prefer this for validation."},
+			"readCredentialRef":        map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Optional Secret name for clone/read credentials. Omit for public repositories."},
+			"publicationGitRepo":       map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Publication repository URL for command-produced changes"},
+			"publicationCredentialRef": map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Optional Secret name for publication credentials"},
+			"subPath":                  map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Sub-path within the repo to run from"},
+			"pushBranch":               map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Publication branch name. Omit for read-only validation. Requires publicationCredentialRef and the default worker image; not supported with a custom image."},
 		},
 		}, priorTaskField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Optional prior task whose structured diff should be applied before running the container command. If workspace is omitted, Orka copies the workspace from this prior task when available."}, namespaceField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: namespaceDescription}, timeoutField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: timeoutDescription}, priorityField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeInteger, jsonSchemaDescriptionField: "Priority 0-1000"}, scheduleField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: cronScheduleDescription},
 	}, jsonSchemaRequiredField: []string{nameField},
@@ -180,14 +181,12 @@ func (t *CreateContainerTaskTool) executeCoordination(ctx context.Context, args
 	}
 	if parentTask.UID != "" {
 		isController := true
-		blockOwnerDeletion := true
 		task.OwnerReferences = []metav1.OwnerReference{{
-			APIVersion:         corev1alpha1.GroupVersion.String(),
-			Kind:               "Task",
-			Name:               parentTask.Name,
-			UID:                parentTask.UID,
-			Controller:         &isController,
-			BlockOwnerDeletion: &blockOwnerDeletion,
+			APIVersion: corev1alpha1.GroupVersion.String(),
+			Kind:       "Task",
+			Name:       parentTask.Name,
+			UID:        parentTask.UID,
+			Controller: &isController,
 		}}
 	}
 	if err := validateChildTaskAgainstParentTransaction(ctx, t.k8sClient, parentTask, task, ""); err != nil {
@@ -261,6 +260,35 @@ func validateContainerTaskWorkspace(task *corev1alpha1.Task) *ChatToolError {
 	if task == nil || task.Spec.Type != corev1alpha1.TaskTypeContainer {
 		return nil
 	}
+	// Mirror the Job builder's validateContainerPublicationWorkspace gates
+	// against the effective (post-inheritance) workspace. The tool schema never
+	// exposes these fields, so their only source here is a prior_task workspace
+	// copied from an agent Task; created Tasks carrying them would be rejected
+	// by the Job builder after creation.
+	if field := unsupportedContainerWorkspaceField(task.Spec.Workspace); field != "" {
+		return &ChatToolError{
+			Type: "unsupported_container_workspace_field",
+			Message: fmt.Sprintf(
+				"container tasks do not support %s, which was inherited from the prior_task workspace", field),
+			Suggestion: "Provide an explicit workspace (gitRepo, ref/branch, readCredentialRef) for the container task instead of inheriting the agent task's clean-room publication workspace.",
+		}
+	}
+	if task.Spec.Workspace != nil && strings.TrimSpace(task.Spec.Workspace.PushBranch) != "" {
+		if strings.TrimSpace(task.Spec.Image) != "" {
+			return &ChatToolError{
+				Type:       "unsupported_custom_image_publication",
+				Message:    "custom-image container tasks do not support workspace.pushBranch publication",
+				Suggestion: "Omit image so the default worker image handles publication, or remove workspace.pushBranch to run the custom image without publication.",
+			}
+		}
+		if task.Spec.Workspace.PublicationCredentialRef == nil || strings.TrimSpace(task.Spec.Workspace.PublicationCredentialRef.Name) == "" {
+			return &ChatToolError{
+				Type:       "missing_publication_credential",
+				Message:    "container workspace.pushBranch requires an explicit workspace.publicationCredentialRef",
+				Suggestion: "Provide a publicationCredentialRef with write access to publicationGitRepo. Do not reuse readCredentialRef implicitly for publication.",
+			}
+		}
+	}
 	if task.Spec.Workspace != nil && task.Spec.Workspace.GitRepo != "" {
 		return nil
 	}
@@ -270,7 +298,34 @@ func validateContainerTaskWorkspace(task *corev1alpha1.Task) *ChatToolError {
 	return &ChatToolError{
 		Type:       "missing_workspace",
 		Message:    "container command appears to validate or inspect repository files, but no workspace.gitRepo was provided or inherited",
-		Suggestion: "Retry create_container_task with workspace.gitRepo, workspace.gitSecretRef when private, and workspace.ref or workspace.branch for the exact code under test. Alternatively provide prior_task for a task that already has a workspace.",
+		Suggestion: "Retry create_container_task with workspace.gitRepo, workspace.readCredentialRef when private, and workspace.ref or workspace.branch for the exact code under test. Alternatively provide prior_task for a task that already has a workspace.",
+	}
+}
+
+// unsupportedContainerWorkspaceField returns the first workspace field the Job
+// builder's validateContainerPublicationWorkspace rejects for container Tasks:
+// clean-room publication and policy fields supported only on agent Tasks. Keep
+// this list in sync with internal/controller/job_builder.go.
+func unsupportedContainerWorkspaceField(workspace *corev1alpha1.WorkspaceConfig) string {
+	switch {
+	case workspace == nil:
+		return ""
+	case strings.TrimSpace(workspace.ExpectedRemoteSHA) != "":
+		return "workspace.expectedRemoteSHA"
+	case workspace.CreatePR:
+		return "workspace.createPR"
+	case workspace.MaxChangedFiles != nil:
+		return "workspace.maxChangedFiles"
+	case len(workspace.AllowedPaths) > 0:
+		return "workspace.allowedPaths"
+	case workspace.DenyRepositoryControlPaths:
+		return "workspace.denyRepositoryControlPaths"
+	case workspace.RejectBinaryFiles:
+		return "workspace.rejectBinaryFiles"
+	case workspace.RejectSecretLikeContent:
+		return "workspace.rejectSecretLikeContent"
+	default:
+		return ""
 	}
 }
 
@@ -327,12 +382,19 @@ func buildContainerTask(a map[string]any) *corev1alpha1.Task {
 			if subPath := chatGetStringArg(wsMap, "subPath"); subPath != "" {
 				wsCfg.SubPath = subPath
 			}
+			if readCredentialRef := chatGetStringArg(wsMap, "readCredentialRef"); readCredentialRef != "" {
+				wsCfg.ReadCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: readCredentialRef}
+			}
+			if publicationGitRepo := chatGetStringArg(wsMap, "publicationGitRepo"); publicationGitRepo != "" {
+				wsCfg.PublicationGitRepo = publicationGitRepo
+			}
+			if publicationCredentialRef := chatGetStringArg(wsMap, "publicationCredentialRef"); publicationCredentialRef != "" {
+				wsCfg.PublicationCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: publicationCredentialRef}
+			}
 			if pushBranch := chatGetStringArg(wsMap, "pushBranch"); pushBranch != "" {
+				wsCfg.Intent = corev1alpha1.WorkspaceIntentWrite
 				wsCfg.PushBranch = pushBranch
 			}
-			if gitSecretRef := chatGetStringArg(wsMap, "gitSecretRef"); gitSecretRef != "" {
-				wsCfg.GitSecretRef = &corev1.LocalObjectReference{Name: gitSecretRef}
-			}
 			task.Spec.Workspace = wsCfg
 		}
 	}
diff --git a/internal/tools/create_container_task_test.go b/internal/tools/create_container_task_test.go
index 48192970c..60a36d2f7 100644
--- a/internal/tools/create_container_task_test.go
+++ b/internal/tools/create_container_task_test.go
@@ -9,9 +9,9 @@ package tools
 import (
 	"context"
 	"encoding/json"
+	"strings"
 	"testing"
 
-	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
@@ -155,8 +155,8 @@ func expectContainerTaskWorkspace(t *testing.T, fc client.Client) {
 	if task.Spec.Workspace.Ref != "abc123" {
 		t.Errorf("ref = %q", task.Spec.Workspace.Ref)
 	}
-	if task.Spec.Workspace.GitSecretRef == nil || task.Spec.Workspace.GitSecretRef.Name != testGitCredentialsSecret {
-		t.Fatalf("gitSecretRef = %#v", task.Spec.Workspace.GitSecretRef)
+	if task.Spec.Workspace.ReadCredentialRef == nil || task.Spec.Workspace.ReadCredentialRef.Name != testGitCredentialsSecret {
+		t.Fatalf("readCredentialRef = %#v", task.Spec.Workspace.ReadCredentialRef)
 	}
 	if task.Spec.PriorTaskRef == nil || task.Spec.PriorTaskRef.Name != testCoderTaskName {
 		t.Fatalf("priorTaskRef = %#v", task.Spec.PriorTaskRef)
@@ -186,8 +186,8 @@ func expectContainerTaskInheritedWorkspace(t *testing.T, fc client.Client) {
 	if task.Spec.Workspace.SubPath != "src" {
 		t.Errorf("subPath = %q", task.Spec.Workspace.SubPath)
 	}
-	if task.Spec.Workspace.GitSecretRef == nil || task.Spec.Workspace.GitSecretRef.Name != testGitCredentialsSecret {
-		t.Fatalf("gitSecretRef = %#v", task.Spec.Workspace.GitSecretRef)
+	if task.Spec.Workspace.ReadCredentialRef == nil || task.Spec.Workspace.ReadCredentialRef.Name != testGitCredentialsSecret {
+		t.Fatalf("readCredentialRef = %#v", task.Spec.Workspace.ReadCredentialRef)
 	}
 	if task.Spec.PriorTaskRef == nil || task.Spec.PriorTaskRef.Name != testCoderTaskName {
 		t.Fatalf("priorTaskRef = %#v", task.Spec.PriorTaskRef)
@@ -227,7 +227,7 @@ func TestCreateContainerTaskTool_Execute(t *testing.T) {
 		},
 		{
 			name: "with workspace",
-			args: json.RawMessage(`{"name":"validation","image":"golang:1.26","command":["sh","-lc"],"args":["go test ./..."],"workspace":{"gitRepo":"https://github.com/example/repo.git","branch":"feature","ref":"abc123","gitSecretRef":"git-credentials","subPath":"src"},"prior_task":"coder-task"}`),
+			args: json.RawMessage(`{"name":"validation","image":"golang:1.26","command":["sh","-lc"],"args":["go test ./..."],"workspace":{"gitRepo":"https://github.com/example/repo.git","branch":"feature","ref":"abc123","readCredentialRef":"git-credentials","subPath":"src"},"prior_task":"coder-task"}`),
 			objects: []client.Object{
 				&corev1alpha1.Task{
 					ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
@@ -237,6 +237,50 @@ func TestCreateContainerTaskTool_Execute(t *testing.T) {
 			checkResult: expectContainerTaskSuccess,
 			checkClient: expectContainerTaskWorkspace,
 		},
+		{
+			name: "push branch requires explicit publication credential",
+			args: json.RawMessage(`{"name":"publish","command":["sh","-lc"],"args":["echo change >> file.txt"],"workspace":{"gitRepo":"https://github.com/example/source.git","publicationGitRepo":"https://github.com/example/target.git","pushBranch":"orka/publish"}}`),
+			checkResult: func(t *testing.T, result string) {
+				expectContainerTaskError(t, result, "missing_publication_credential")
+			},
+		},
+		{
+			name:        "push branch keeps explicit publication repository and credential",
+			args:        json.RawMessage(`{"name":"publish","command":["sh","-lc"],"args":["echo change >> file.txt"],"workspace":{"gitRepo":"https://github.com/example/source.git","readCredentialRef":"source-read","publicationGitRepo":"https://github.com/example/target.git","publicationCredentialRef":"target-write","pushBranch":"orka/publish"}}`),
+			checkResult: expectContainerTaskSuccess,
+			checkClient: func(t *testing.T, fc client.Client) {
+				task := &corev1alpha1.Task{}
+				key := client.ObjectKey{Name: testContainerTaskGeneratedName, Namespace: defaultNamespace}
+				if err := fc.Get(context.Background(), key, task); err != nil {
+					t.Fatalf("failed to get created task: %v", err)
+				}
+				workspace := task.Spec.Workspace
+				if workspace == nil || workspace.Intent != corev1alpha1.WorkspaceIntentWrite || workspace.PushBranch != "orka/publish" ||
+					workspace.PublicationGitRepo != "https://github.com/example/target.git" || workspace.PublicationCredentialRef == nil ||
+					workspace.PublicationCredentialRef.Name != "target-write" {
+					t.Fatalf("publication workspace = %#v", workspace)
+				}
+			},
+		},
+		{
+			name: "custom image with push branch publication rejected",
+			args: json.RawMessage(`{"name":"publish","image":"golang:1.26","command":["sh","-lc"],"args":["echo change >> file.txt"],"workspace":{"gitRepo":"https://github.com/example/source.git","publicationGitRepo":"https://github.com/example/target.git","publicationCredentialRef":"target-write","pushBranch":"orka/publish"}}`),
+			checkResult: func(t *testing.T, result string) {
+				expectContainerTaskError(t, result, "unsupported_custom_image_publication")
+			},
+		},
+		{
+			name: "custom image with push branch rejected before credential check",
+			args: json.RawMessage(`{"name":"publish","image":"golang:1.26","command":["sh","-lc"],"args":["echo change >> file.txt"],"workspace":{"gitRepo":"https://github.com/example/source.git","pushBranch":"orka/publish"}}`),
+			checkResult: func(t *testing.T, result string) {
+				expectContainerTaskError(t, result, "unsupported_custom_image_publication")
+			},
+		},
+		{
+			name:        "custom image with read-only workspace accepted",
+			args:        json.RawMessage(`{"name":"inspect","image":"golang:1.26","command":["sh","-lc"],"args":["go vet ./..."],"workspace":{"gitRepo":"https://github.com/example/source.git","readCredentialRef":"source-read"}}`),
+			checkResult: expectContainerTaskSuccess,
+		},
 		{
 			name: "repo validation without workspace fails",
 			args: json.RawMessage(`{"name":"validation","image":"golang:1.26","command":["sh","-lc"],"args":["go test ./..."]}`),
@@ -253,10 +297,10 @@ func TestCreateContainerTaskTool_Execute(t *testing.T) {
 					Spec: corev1alpha1.TaskSpec{
 						Type: corev1alpha1.TaskTypeAgent,
 						Workspace: &corev1alpha1.WorkspaceConfig{
-							GitRepo:      "https://github.com/example/prior.git",
-							Ref:          "prior-sha",
-							SubPath:      "src",
-							GitSecretRef: &corev1.LocalObjectReference{Name: testGitCredentialsSecret},
+							GitRepo:           "https://github.com/example/prior.git",
+							Ref:               "prior-sha",
+							SubPath:           "src",
+							ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: testGitCredentialsSecret},
 						},
 					},
 				},
@@ -316,6 +360,132 @@ func TestCreateContainerTaskTool_Execute(t *testing.T) {
 	}
 }
 
+func TestCreateContainerTaskTool_InheritedPublicationWorkspaceFields(t *testing.T) {
+	maxChanged := int32(3)
+	tests := []struct {
+		name          string
+		workspace     corev1alpha1.WorkspaceConfig
+		wantErrorType string
+		wantInMessage string
+	}{
+		{
+			name: "inherited expectedRemoteSHA rejected",
+			workspace: corev1alpha1.WorkspaceConfig{
+				GitRepo:           "https://github.com/example/prior.git",
+				ExpectedRemoteSHA: "1111111111111111111111111111111111111111",
+			},
+			wantErrorType: "unsupported_container_workspace_field",
+			wantInMessage: "workspace.expectedRemoteSHA",
+		},
+		{
+			name: "inherited createPR rejected",
+			workspace: corev1alpha1.WorkspaceConfig{
+				GitRepo:  "https://github.com/example/prior.git",
+				CreatePR: true,
+			},
+			wantErrorType: "unsupported_container_workspace_field",
+			wantInMessage: "workspace.createPR",
+		},
+		{
+			name: "inherited maxChangedFiles rejected",
+			workspace: corev1alpha1.WorkspaceConfig{
+				GitRepo:         "https://github.com/example/prior.git",
+				MaxChangedFiles: &maxChanged,
+			},
+			wantErrorType: "unsupported_container_workspace_field",
+			wantInMessage: "workspace.maxChangedFiles",
+		},
+		{
+			name: "inherited allowedPaths rejected",
+			workspace: corev1alpha1.WorkspaceConfig{
+				GitRepo:      "https://github.com/example/prior.git",
+				AllowedPaths: []string{"src/**"},
+			},
+			wantErrorType: "unsupported_container_workspace_field",
+			wantInMessage: "workspace.allowedPaths",
+		},
+		{
+			name: "inherited denyRepositoryControlPaths rejected",
+			workspace: corev1alpha1.WorkspaceConfig{
+				GitRepo:                    "https://github.com/example/prior.git",
+				DenyRepositoryControlPaths: true,
+			},
+			wantErrorType: "unsupported_container_workspace_field",
+			wantInMessage: "workspace.denyRepositoryControlPaths",
+		},
+		{
+			name: "inherited rejectBinaryFiles rejected",
+			workspace: corev1alpha1.WorkspaceConfig{
+				GitRepo:           "https://github.com/example/prior.git",
+				RejectBinaryFiles: true,
+			},
+			wantErrorType: "unsupported_container_workspace_field",
+			wantInMessage: "workspace.rejectBinaryFiles",
+		},
+		{
+			name: "inherited rejectSecretLikeContent rejected",
+			workspace: corev1alpha1.WorkspaceConfig{
+				GitRepo:                 "https://github.com/example/prior.git",
+				RejectSecretLikeContent: true,
+			},
+			wantErrorType: "unsupported_container_workspace_field",
+			wantInMessage: "workspace.rejectSecretLikeContent",
+		},
+		{
+			name: "inherited read workspace accepted",
+			workspace: corev1alpha1.WorkspaceConfig{
+				GitRepo:           "https://github.com/example/prior.git",
+				Ref:               "prior-sha",
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: testGitCredentialsSecret},
+			},
+		},
+	}
+
+	args := json.RawMessage(`{"name":"validation","command":["sh","-lc"],"args":["go test ./..."],"prior_task":"coder-task"}`)
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			prior := &corev1alpha1.Task{
+				ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
+				Spec: corev1alpha1.TaskSpec{
+					Type:      corev1alpha1.TaskTypeAgent,
+					Workspace: tt.workspace.DeepCopy(),
+				},
+			}
+			fc := newFakeClient(prior)
+			ctx := newCreateContainerTaskToolCtx(fc)
+			tool := &CreateContainerTaskTool{}
+
+			result, err := tool.Execute(ctx, args)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			r := parseContainerTaskToolResult(t, result)
+			if tt.wantErrorType == "" {
+				if !r.Success {
+					t.Fatalf("expected success, got %s: %s", r.ErrorType, r.Error)
+				}
+				return
+			}
+			if r.Success {
+				t.Fatalf("expected %s rejection, got success", tt.wantErrorType)
+			}
+			if r.ErrorType != tt.wantErrorType {
+				t.Errorf("errorType = %q, want %q", r.ErrorType, tt.wantErrorType)
+			}
+			if !strings.Contains(r.Error, tt.wantInMessage) {
+				t.Errorf("error message %q does not name %q", r.Error, tt.wantInMessage)
+			}
+			taskList := &corev1alpha1.TaskList{}
+			if err := fc.List(context.Background(), taskList); err != nil {
+				t.Fatalf("failed to list tasks: %v", err)
+			}
+			if len(taskList.Items) != 1 {
+				t.Fatalf("expected no container Task to be created, found %d Tasks", len(taskList.Items))
+			}
+		})
+	}
+}
+
 func TestCreateContainerTaskTool_ExecuteCoordination_InheritsParentProvenance(t *testing.T) {
 	t.Setenv(envOrkaTaskName, parentTaskName)
 	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
diff --git a/internal/tools/create_pr_monitor.go b/internal/tools/create_pr_monitor.go
index dd779c29a..d80ac0891 100644
--- a/internal/tools/create_pr_monitor.go
+++ b/internal/tools/create_pr_monitor.go
@@ -70,7 +70,7 @@ func (t *CreatePRMonitorTool) Parameters() json.RawMessage {
 				jsonSchemaTypeField:        jsonSchemaTypeString,
 				jsonSchemaDescriptionField: "Optional Provider CRD reference name for the scheduled AI task.",
 			},
-			"gitSecretRef": map[string]any{
+			"readCredentialRef": map[string]any{
 				jsonSchemaTypeField:        jsonSchemaTypeString,
 				jsonSchemaDescriptionField: "Optional Secret name containing git/GitHub credentials for private repositories. If omitted, Orka tries common git credential secret names.",
 			},
@@ -184,10 +184,10 @@ func (t *CreatePRMonitorTool) Execute(ctx context.Context, argsJSON json.RawMess
 		Tools: append([]string(nil), prMonitorRequiredTools...),
 	}
 	workspace := &corev1alpha1.WorkspaceConfig{GitRepo: repoURL}
-	requestedGitSecretRef := chatGetStringArg(args, "gitSecretRef")
-	secretRef, secretRefErr := resolveWorkspaceGitSecretRef(ctx, tc.Client, namespace, nil, requestedGitSecretRef)
+	requestedReadCredentialRef := chatGetStringArg(args, "readCredentialRef")
+	secretRef, secretRefErr := resolveWorkspaceCredentialRef(ctx, tc.Client, namespace, nil, requestedReadCredentialRef)
 	if secretRefErr == nil && secretRef != nil {
-		workspace.GitSecretRef = secretRef
+		workspace.ReadCredentialRef = secretRef
 	}
 	task.Spec.Workspace = workspace
 	task.Spec.Env = append(task.Spec.Env, corev1.EnvVar{Name: workerenv.GitRepo, Value: repoURL})
@@ -200,10 +200,10 @@ func (t *CreatePRMonitorTool) Execute(ctx context.Context, argsJSON json.RawMess
 		return result, nil
 	}
 
-	if result, err := validatePRMonitorGitSecretRef(ctx, tc.Client, namespace, requestedGitSecretRef, secretRef, secretRefErr); result != "" || err != nil {
+	if result, err := validatePRMonitorReadCredentialRef(ctx, tc.Client, namespace, requestedReadCredentialRef, secretRef, secretRefErr); result != "" || err != nil {
 		return result, err
 	}
-	workspace.GitSecretRef = secretRef
+	workspace.ReadCredentialRef = secretRef
 
 	if err := tc.Client.Create(ctx, task); err != nil {
 		return classifyChatK8sErr(err)
@@ -219,27 +219,27 @@ func (t *CreatePRMonitorTool) Execute(ctx context.Context, argsJSON json.RawMess
 	})
 }
 
-func validatePRMonitorGitSecretRef(ctx context.Context, k8sClient client.Reader, namespace, requested string, secretRef *corev1.LocalObjectReference, secretRefErr error) (string, error) {
+func validatePRMonitorReadCredentialRef(ctx context.Context, k8sClient client.Reader, namespace, requested string, secretRef *corev1alpha1.WorkspaceCredentialReference, secretRefErr error) (string, error) {
 	if requested != "" {
 		var secret corev1.Secret
 		if err := k8sClient.Get(ctx, types.NamespacedName{Name: requested, Namespace: namespace}, &secret); err != nil {
 			if apierrors.IsNotFound(err) {
-				return ChatToolErrorResult("invalid_arguments", fmt.Sprintf("git secretRef %q not found in namespace %q", requested, namespace), "Create the Secret or provide a valid gitSecretRef")
+				return ChatToolErrorResult("invalid_arguments", fmt.Sprintf("read credentialRef %q not found in namespace %q", requested, namespace), "Create the Secret or provide a valid readCredentialRef")
 			}
 			return classifyChatK8sErr(err)
 		}
 	}
 	if secretRefErr != nil {
 		if requested != "" {
-			return ChatToolErrorResult("invalid_arguments", secretRefErr.Error(), "Create the Secret or provide a valid gitSecretRef")
+			return ChatToolErrorResult("invalid_arguments", secretRefErr.Error(), "Create the Secret or provide a valid readCredentialRef")
 		}
 		return classifyChatK8sErr(secretRefErr)
 	}
 	if secretRef == nil {
 		return ChatToolErrorResult(
 			"invalid_arguments",
-			fmt.Sprintf("gitSecretRef is required for PR monitor GitHub access; no supported git credential Secret found in namespace %q", namespace),
-			fmt.Sprintf("Provide gitSecretRef or create one of these Secrets in namespace %q: %s", namespace, strings.Join(gitCredentialSecretCandidates, ", ")),
+			fmt.Sprintf("readCredentialRef is required for PR monitor GitHub access; no supported git credential Secret found in namespace %q", namespace),
+			fmt.Sprintf("Provide readCredentialRef or create one of these Secrets in namespace %q: %s", namespace, strings.Join(gitCredentialSecretCandidates, ", ")),
 		)
 	}
 	if err := validateGitCredentialSecret(ctx, k8sClient, namespace, secretRef.Name); err != nil {
diff --git a/internal/tools/create_pr_monitor_test.go b/internal/tools/create_pr_monitor_test.go
index f4d31f890..fe61046d9 100644
--- a/internal/tools/create_pr_monitor_test.go
+++ b/internal/tools/create_pr_monitor_test.go
@@ -54,7 +54,7 @@ func TestCreatePRMonitorTool_Metadata(t *testing.T) {
 		scheduleField,
 		agentRefField,
 		providerRefField,
-		"gitSecretRef",
+		"readCredentialRef",
 		perPageField,
 		"review_event",
 		promptField,
@@ -112,15 +112,15 @@ func TestCreatePRMonitorTool_ExecuteCreatesScheduledAITask(t *testing.T) {
 	tool := &CreatePRMonitorTool{}
 
 	resultJSON, err := tool.Execute(ctx, mustJSON(t, map[string]any{
-		nameField:        "daily-pr-monitor",
-		repoURLField:     "https://github.com/orka-agents/orka",
-		scheduleField:    "*/15 * * * *",
-		agentRefField:    "reviewer",
-		providerRefField: "default-provider",
-		"gitSecretRef":   testGitCredentialsSecret,
-		perPageField:     100,
-		"review_event":   "comment",
-		promptField:      "Focus on regressions.",
+		nameField:           "daily-pr-monitor",
+		repoURLField:        "https://github.com/orka-agents/orka",
+		scheduleField:       "*/15 * * * *",
+		agentRefField:       "reviewer",
+		providerRefField:    "default-provider",
+		"readCredentialRef": testGitCredentialsSecret,
+		perPageField:        100,
+		"review_event":      "comment",
+		promptField:         "Focus on regressions.",
 	}))
 	if err != nil {
 		t.Fatalf("Execute() returned error: %v", err)
@@ -165,8 +165,8 @@ func TestCreatePRMonitorTool_ExecuteCreatesScheduledAITask(t *testing.T) {
 	if task.Spec.Workspace.GitRepo != "https://github.com/orka-agents/orka" {
 		t.Errorf("workspace.gitRepo = %q", task.Spec.Workspace.GitRepo)
 	}
-	if task.Spec.Workspace.GitSecretRef == nil || task.Spec.Workspace.GitSecretRef.Name != testGitCredentialsSecret {
-		t.Fatalf("workspace.gitSecretRef = %#v, want %s", task.Spec.Workspace.GitSecretRef, testGitCredentialsSecret)
+	if task.Spec.Workspace.ReadCredentialRef == nil || task.Spec.Workspace.ReadCredentialRef.Name != testGitCredentialsSecret {
+		t.Fatalf("workspace.readCredentialRef = %#v, want %s", task.Spec.Workspace.ReadCredentialRef, testGitCredentialsSecret)
 	}
 	if !hasEnvVar(task.Spec.Env, workerenv.GitRepo, "https://github.com/orka-agents/orka") {
 		t.Errorf("env missing %s=https://github.com/orka-agents/orka: %#v", workerenv.GitRepo, task.Spec.Env)
@@ -208,11 +208,11 @@ func TestCreatePRMonitorTool_ExecuteStampsTraceContext(t *testing.T) {
 	ctx := WithToolContext(parentCtx, GetToolContext(baseCtx))
 
 	_, err := (&CreatePRMonitorTool{}).Execute(ctx, mustJSON(t, map[string]any{
-		nameField:      "trace-pr-monitor",
-		repoURLField:   "https://github.com/orka-agents/orka",
-		scheduleField:  "*/15 * * * *",
-		agentRefField:  "reviewer",
-		"gitSecretRef": gitSecret.Name,
+		nameField:           "trace-pr-monitor",
+		repoURLField:        "https://github.com/orka-agents/orka",
+		scheduleField:       "*/15 * * * *",
+		agentRefField:       "reviewer",
+		"readCredentialRef": gitSecret.Name,
 	}))
 	if err != nil {
 		t.Fatalf("Execute() error = %v", err)
@@ -245,8 +245,8 @@ func TestCreatePRMonitorTool_ExecuteAuthorizesTaskCreate(t *testing.T) {
 	ctx := newCreatePRMonitorToolContextWithAuthorize(fc, func(_ context.Context, task *corev1alpha1.Task) *ChatToolError {
 		authorized = true
 		authorizedWithSecret = task.Spec.Workspace != nil &&
-			task.Spec.Workspace.GitSecretRef != nil &&
-			task.Spec.Workspace.GitSecretRef.Name == testGitCredentialsSecret
+			task.Spec.Workspace.ReadCredentialRef != nil &&
+			task.Spec.Workspace.ReadCredentialRef.Name == testGitCredentialsSecret
 		if task.Annotations == nil {
 			task.Annotations = map[string]string{}
 		}
@@ -274,7 +274,7 @@ func TestCreatePRMonitorTool_ExecuteAuthorizesTaskCreate(t *testing.T) {
 		t.Fatal("AuthorizeTaskCreate was not called")
 	}
 	if !authorizedWithSecret {
-		t.Fatal("AuthorizeTaskCreate did not see the resolved gitSecretRef")
+		t.Fatal("AuthorizeTaskCreate did not see the resolved readCredentialRef")
 	}
 
 	var task corev1alpha1.Task
@@ -339,11 +339,11 @@ func TestCreatePRMonitorTool_ExecuteAuthorizesBeforeExplicitGitSecretLookup(t *t
 	})
 
 	resultJSON, err := (&CreatePRMonitorTool{}).Execute(ctx, mustJSON(t, map[string]any{
-		nameField:      "daily-pr-monitor",
-		repoURLField:   testSozercanAynaRepoURL,
-		scheduleField:  "*/15 * * * *",
-		agentRefField:  "reviewer",
-		"gitSecretRef": "missing-secret",
+		nameField:           "daily-pr-monitor",
+		repoURLField:        testSozercanAynaRepoURL,
+		scheduleField:       "*/15 * * * *",
+		agentRefField:       "reviewer",
+		"readCredentialRef": "missing-secret",
 	}))
 	if err != nil {
 		t.Fatalf("Execute() returned error: %v", err)
@@ -380,7 +380,7 @@ func TestCreatePRMonitorTool_ExecuteRejectsMissingGitCredentials(t *testing.T) {
 		scheduleField: "*/15 * * * *",
 		agentRefField: "reviewer",
 	})
-	if result.ErrorType != errTypeInvalidArgs || !strings.Contains(result.Error, "gitSecretRef is required") {
+	if result.ErrorType != errTypeInvalidArgs || !strings.Contains(result.Error, "readCredentialRef is required") {
 		t.Fatalf("result = %#v, want missing git credentials invalid_arguments", result)
 	}
 
@@ -400,11 +400,11 @@ func TestCreatePRMonitorTool_ExecuteRejectsMissingExplicitGitSecret(t *testing.T
 	})
 
 	resultJSON, err := (&CreatePRMonitorTool{}).Execute(newCreatePRMonitorToolContext(fc), mustJSON(t, map[string]any{
-		nameField:      "daily-pr-monitor",
-		repoURLField:   testSozercanAynaRepoURL,
-		scheduleField:  "*/15 * * * *",
-		agentRefField:  "reviewer",
-		"gitSecretRef": "missing-secret",
+		nameField:           "daily-pr-monitor",
+		repoURLField:        testSozercanAynaRepoURL,
+		scheduleField:       "*/15 * * * *",
+		agentRefField:       "reviewer",
+		"readCredentialRef": "missing-secret",
 	}))
 	if err != nil {
 		t.Fatalf("Execute() returned error: %v", err)
@@ -414,16 +414,16 @@ func TestCreatePRMonitorTool_ExecuteRejectsMissingExplicitGitSecret(t *testing.T
 		t.Fatalf("failed to unmarshal result: %v", err)
 	}
 	if result.Success {
-		t.Fatalf("expected missing gitSecretRef failure, got success: %s", resultJSON)
+		t.Fatalf("expected missing readCredentialRef failure, got success: %s", resultJSON)
 	}
 	if result.ErrorType != errTypeInvalidArgs || !strings.Contains(result.Error, "missing-secret") {
-		t.Fatalf("result = %#v, want missing explicit gitSecretRef invalid_arguments", result)
+		t.Fatalf("result = %#v, want missing explicit readCredentialRef invalid_arguments", result)
 	}
 
 	var task corev1alpha1.Task
 	err = fc.Get(context.Background(), types.NamespacedName{Name: "pr-monitor-task", Namespace: defaultNamespace}, &task)
 	if err == nil {
-		t.Fatal("task was created despite missing explicit gitSecretRef")
+		t.Fatal("task was created despite missing explicit readCredentialRef")
 	}
 }
 
diff --git a/internal/tools/create_pull_request.go b/internal/tools/create_pull_request.go
index a70e7c351..f3065cf44 100644
--- a/internal/tools/create_pull_request.go
+++ b/internal/tools/create_pull_request.go
@@ -82,7 +82,7 @@ func (t *CreatePullRequestTool) Execute(ctx context.Context, argsJSON json.RawMe
 		return "", fmt.Errorf("task_name, head_branch, base_branch, and title are required")
 	}
 
-	owner, repo, token, baseURL, err := resolveRepoAndToken(ctx, t.k8sClient, args.TaskName, "", t.apiBaseURL)
+	owner, repo, token, baseURL, err := resolveForgeRepoAndToken(ctx, t.k8sClient, args.TaskName, "", t.apiBaseURL)
 	if err != nil {
 		return "", err
 	}
diff --git a/internal/tools/create_pull_request_test.go b/internal/tools/create_pull_request_test.go
index 930b7f8b5..9a6777daf 100644
--- a/internal/tools/create_pull_request_test.go
+++ b/internal/tools/create_pull_request_test.go
@@ -187,13 +187,11 @@ func TestCreatePullRequestTool_Success(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: testSozercanAynaRepoURL,
-					Branch:  testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{
-						Name: testGitCredsSecretName,
-					},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: testSozercanAynaRepoURL,
+				Branch:  testBranch,
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: testGitCredsSecretName,
 				},
 			},
 		},
@@ -289,13 +287,11 @@ func TestCreatePullRequestTool_ExistingPR(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: testSozercanAynaRepoURL,
-					Branch:  testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{
-						Name: testGitCredsSecretName,
-					},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: testSozercanAynaRepoURL,
+				Branch:  testBranch,
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: testGitCredsSecretName,
 				},
 			},
 		},
@@ -388,10 +384,8 @@ func TestCreatePullRequestTool_NoGitRepo(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					Branch: testBranch,
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				Branch: testBranch,
 			},
 		},
 	}
@@ -417,7 +411,7 @@ func TestCreatePullRequestTool_NoGitRepo(t *testing.T) {
 	}
 }
 
-func TestCreatePullRequestTool_NoGitSecretRefWithoutFallbackToken(t *testing.T) {
+func TestCreatePullRequestTool_NoForgeCredentialRefFailsClosed(t *testing.T) {
 	scheme := runtime.NewScheme()
 	_ = corev1alpha1.AddToScheme(scheme)
 	_ = corev1.AddToScheme(scheme)
@@ -426,11 +420,9 @@ func TestCreatePullRequestTool_NoGitSecretRefWithoutFallbackToken(t *testing.T)
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: testSozercanAynaRepoURL,
-					Branch:  testBranch,
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: testSozercanAynaRepoURL,
+				Branch:  testBranch,
 			},
 		},
 	}
@@ -447,11 +439,13 @@ func TestCreatePullRequestTool_NoGitSecretRefWithoutFallbackToken(t *testing.T)
 		Title:      testPullRequestTitle,
 	})
 
+	t.Setenv("GITHUB_TOKEN", testGitHubToken)
+
 	_, err := tool.Execute(context.Background(), args)
 	if err == nil {
-		t.Fatal("expected error for no token")
+		t.Fatal("expected error for missing forgeCredentialRef")
 	}
-	if !strings.Contains(err.Error(), "could not resolve GitHub token") {
+	if !strings.Contains(err.Error(), "workspace has no forgeCredentialRef configured") {
 		t.Errorf("unexpected error: %s", err.Error())
 	}
 }
@@ -465,18 +459,16 @@ func TestCreatePullRequestTool_EmptyToken(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      testSozercanAynaRepoURL,
-					Branch:       testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{Name: testGitCredsSecretName},
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:            testSozercanAynaRepoURL,
+				Branch:             testBranch,
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: testGitCredsSecretName},
 			},
 		},
 	}
 	secret := &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{Name: testGitCredsSecretName, Namespace: defaultNamespace},
-		Data:       map[string][]byte{otherSecretKey: []byte("value")},
+		Data:       map[string][]byte{tokenKey: []byte(" \n")},
 	}
 
 	k8sClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(task, secret).Build()
@@ -495,7 +487,7 @@ func TestCreatePullRequestTool_EmptyToken(t *testing.T) {
 	if err == nil {
 		t.Fatal("expected error for empty token")
 	}
-	if !strings.Contains(err.Error(), "does not contain a 'token', 'password', or 'GITHUB_TOKEN' key") {
+	if !strings.Contains(err.Error(), `contains an empty configured key "token"`) {
 		t.Errorf("unexpected error: %s", err.Error())
 	}
 }
diff --git a/internal/tools/delegate_task.go b/internal/tools/delegate_task.go
index f6972fe6a..4e911d5eb 100644
--- a/internal/tools/delegate_task.go
+++ b/internal/tools/delegate_task.go
@@ -15,28 +15,58 @@ import (
 	"strings"
 	"time"
 
+	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/contexttoken"
 	"github.com/orka-agents/orka/internal/labels"
 	orkatracing "github.com/orka-agents/orka/internal/tracing"
 	"go.opentelemetry.io/otel/trace"
 )
 
-// DelegateTaskTool implements multi-agent task delegation
+const (
+	delegateRequestOperationField  = "operation"
+	delegateRequestParentTaskField = "parentTask"
+)
+
+// DelegateTaskSubjectTokenResolver resolves the exact subject token authorized
+// for one authenticated parent Task. Implementations must not fall back to
+// process-global worker credentials for brokered requests.
+type DelegateTaskSubjectTokenResolver func(context.Context, *corev1alpha1.Task, string) (string, error)
+
+// BrokeredDelegateTaskTransactionExchangeConfig carries controller-parsed TTS
+// settings and request-scoped dependencies for brokered child-token exchange.
+type BrokeredDelegateTaskTransactionExchangeConfig struct {
+	TTS                 contexttoken.TTSConfig
+	Exchanger           contexttoken.Exchanger
+	SubjectTokenType    string
+	ChildScope          string
+	ResolveSubjectToken DelegateTaskSubjectTokenResolver
+}
+
+// DelegateTaskTool implements multi-agent task delegation.
 type DelegateTaskTool struct {
-	k8sClient client.Client
+	k8sClient                   client.Client
+	brokeredTransactionExchange *BrokeredDelegateTaskTransactionExchangeConfig
 }
 
 // WorkspaceArgs specifies a git workspace for agent runtime tasks
 type WorkspaceArgs struct {
-	GitRepo      string `json:"gitRepo,omitempty"`
-	Branch       string `json:"branch,omitempty"`
-	Ref          string `json:"ref,omitempty"`
-	GitSecretRef string `json:"gitSecretRef,omitempty"`
-	PushBranch   string `json:"pushBranch,omitempty"`
+	Intent                       string `json:"intent,omitempty"`
+	GitRepo                      string `json:"gitRepo,omitempty"`
+	Branch                       string `json:"branch,omitempty"`
+	Ref                          string `json:"ref,omitempty"`
+	ReadCredentialRef            string `json:"readCredentialRef,omitempty"`
+	PublicationGitRepo           string `json:"publicationGitRepo,omitempty"`
+	PublicationReadCredentialRef string `json:"publicationReadCredentialRef,omitempty"`
+	PublicationCredentialRef     string `json:"publicationCredentialRef,omitempty"`
+	ForgeCredentialRef           string `json:"forgeCredentialRef,omitempty"`
+	PushBranch                   string `json:"pushBranch,omitempty"`
+	PRBaseBranch                 string `json:"prBaseBranch,omitempty"`
+	CreatePR                     bool   `json:"createPR,omitempty"`
 }
 
 // DelegateTaskArgs are the arguments for the delegate_task tool
@@ -84,6 +114,50 @@ func NewDelegateTaskTool(k8sClient client.Client) *DelegateTaskTool {
 	}
 }
 
+// NewBrokeredDelegateTaskTool creates a delegate_task implementation that uses
+// controller-parsed TTS settings and request-scoped subject-token resolution.
+// The configuration is copied so later caller mutation cannot change the live
+// broker policy.
+func NewBrokeredDelegateTaskTool(
+	k8sClient client.Client,
+	config BrokeredDelegateTaskTransactionExchangeConfig,
+) (*DelegateTaskTool, error) {
+	if k8sClient == nil {
+		return nil, fmt.Errorf("brokered delegate_task requires a Kubernetes client")
+	}
+	if config.TTS.Enabled() {
+		if config.Exchanger == nil {
+			return nil, fmt.Errorf("brokered delegate_task requires a transaction-token exchanger when TTS is enabled")
+		}
+		if config.ResolveSubjectToken == nil {
+			return nil, fmt.Errorf("brokered delegate_task requires request-scoped subject-token resolution when TTS is enabled")
+		}
+	}
+	copyConfig := config
+	return &DelegateTaskTool{
+		k8sClient:                   k8sClient,
+		brokeredTransactionExchange: &copyConfig,
+	}, nil
+}
+
+// RegisterBrokeredDelegateTaskTool replaces the generic delegate_task
+// registration with the controller-configured broker implementation.
+func RegisterBrokeredDelegateTaskTool(
+	registry *Registry,
+	k8sClient client.Client,
+	config BrokeredDelegateTaskTransactionExchangeConfig,
+) error {
+	if registry == nil {
+		return fmt.Errorf("brokered coordination tool registry is required")
+	}
+	tool, err := NewBrokeredDelegateTaskTool(k8sClient, config)
+	if err != nil {
+		return err
+	}
+	registry.Register(tool)
+	return nil
+}
+
 // Name returns the tool name
 func (t *DelegateTaskTool) Name() string {
 	return delegateTaskToolName
@@ -137,19 +211,48 @@ func (t *DelegateTaskTool) Parameters() json.RawMessage {
 					},
 					"branch": {
 						"type": "string",
-						"description": "Git branch name"
+						"description": "Git branch name. Omit with ref to resolve and freeze the repository's advertised default branch."
 					},
 					"ref": {
 						"type": "string",
 						"description": "Git ref (commit SHA or tag)"
 					},
-					"gitSecretRef": {
+					"intent": {
 						"type": "string",
-						"description": "Optional git credential Secret name. Omit to auto-discover git credentials or reuse the Copilot agent secret when available."
+						"enum": ["read", "write"],
+						"description": "Workspace intent. Defaults to read; publication fields require write."
+					},
+					"readCredentialRef": {
+						"type": "string",
+						"description": "Optional Secret name for clone/read credentials. Omit to auto-discover a read credential when available. Requires gitRepo."
+					},
+					"publicationGitRepo": {
+						"type": "string",
+						"description": "Publication repository URL for write Tasks."
+					},
+					"publicationReadCredentialRef": {
+						"type": "string",
+						"description": "Optional Secret name for target-repository preflight and verification credentials."
+					},
+					"publicationCredentialRef": {
+						"type": "string",
+						"description": "Secret name for target-repository write credentials. Required for write intent."
+					},
+					"forgeCredentialRef": {
+						"type": "string",
+						"description": "Optional Secret name for forge API credentials used to reconcile pull requests."
 					},
 					"pushBranch": {
 						"type": "string",
-						"description": "Remote branch name to push changes to after the agent completes. When set, changes are committed and pushed automatically."
+						"description": "Publication branch name for a write Task."
+					},
+					"prBaseBranch": {
+						"type": "string",
+						"description": "Pull request base branch."
+					},
+					"createPR": {
+						"type": "boolean",
+						"description": "Reconcile a pull request after publication."
 					}
 				}
 			},
@@ -226,13 +329,45 @@ func namespacedDelegateAgent(namespace, name string) string {
 	return namespace + "/" + name
 }
 
-// parseDelegateArgs parses and validates the delegation arguments and environment.
+func validateDelegateNamespaceScope(toolCtx *ToolContext, resourceKind, namespace string) error {
+	if toolCtx == nil {
+		return nil
+	}
+	namespace = strings.TrimSpace(namespace)
+	if watchNamespace := strings.TrimSpace(toolCtx.WatchNamespace); watchNamespace != "" && namespace != watchNamespace {
+		return fmt.Errorf("%s namespace %q is outside watched namespace %q", resourceKind, namespace, watchNamespace)
+	}
+	if toolCtx.EnforceNamespaceIsolation {
+		requestNamespace := strings.TrimSpace(toolCtx.Namespace)
+		if namespace != requestNamespace {
+			return fmt.Errorf("%s namespace %q is outside request namespace %q", resourceKind, namespace, requestNamespace)
+		}
+	}
+	return nil
+}
+
+// parseDelegateArgs parses and validates delegation arguments against either
+// worker environment or an authenticated broker request context.
+//
+//nolint:gocyclo // Delegation keeps worker and authenticated broker policy checks auditable in one path.
 func (t *DelegateTaskTool) parseDelegateArgs(ctx context.Context, args json.RawMessage) (*delegationContext, error) {
 	parentName := os.Getenv(envOrkaTaskName)
 	parentNamespace := os.Getenv(envOrkaTaskNamespace)
 	depthStr := os.Getenv(envOrkaCoordinationDepth)
 	allowedAgents := os.Getenv(envOrkaCoordinationAllowedAgents)
 	maxDepthStr := os.Getenv(envOrkaCoordinationMaxDepth)
+	toolCtx := GetToolContext(ctx)
+	brokered := toolCtx != nil && toolCtx.Brokered
+	if brokered {
+		parentName = strings.TrimSpace(toolCtx.TaskID)
+		parentNamespace = strings.TrimSpace(toolCtx.Namespace)
+		depthStr = ""
+		allowedAgents = ""
+		maxDepthStr = ""
+		if parentName == "" || parentNamespace == "" {
+			return nil, fmt.Errorf("brokered delegation requires request-scoped task and namespace context")
+		}
+	}
 
 	var delegateArgs DelegateTaskArgs
 	if err := json.Unmarshal(args, &delegateArgs); err != nil {
@@ -246,29 +381,6 @@ func (t *DelegateTaskTool) parseDelegateArgs(ctx context.Context, args json.RawM
 		return nil, fmt.Errorf("prompt is required")
 	}
 
-	// Validate depth
-	currentDepth := 0
-	if depthStr != "" {
-		var err error
-		currentDepth, err = strconv.Atoi(depthStr)
-		if err != nil {
-			return nil, fmt.Errorf("invalid coordination depth %q: %w", depthStr, err)
-		}
-	}
-
-	maxDepth := 3
-	if maxDepthStr != "" {
-		var err error
-		maxDepth, err = strconv.Atoi(maxDepthStr)
-		if err != nil {
-			return nil, fmt.Errorf("invalid max coordination depth %q: %w", maxDepthStr, err)
-		}
-	}
-
-	if currentDepth+1 > maxDepth {
-		return nil, fmt.Errorf("coordination depth exceeded: current depth %d, max depth %d", currentDepth, maxDepth)
-	}
-
 	// Determine child task and target agent namespaces. The legacy namespace
 	// field remains compatible: when no split fields are supplied it targets both
 	// the child task and agent. New callers should prefer taskNamespace and
@@ -295,13 +407,18 @@ func (t *DelegateTaskTool) parseDelegateArgs(ctx context.Context, args json.RawM
 		}
 	}
 
-	// Validate agent is allowed, including namespace when the allowlist entry is
-	// namespaced as namespace/name. Bare names retain existing same-name behavior.
-	if allowedAgents != "" && !delegatedAgentAllowed(delegateArgs.Agent, agentNS, taskNS, allowedAgents) {
-		return nil, fmt.Errorf("agent %q is not in the allowed agents list", namespacedDelegateAgent(agentNS, delegateArgs.Agent))
+	// Enforce the authenticated request's namespace boundary before any target
+	// Agent lookup or child creation. This keeps brokered execution at least as
+	// narrow as the controller's watch and namespace-isolation configuration.
+	if err := validateDelegateNamespaceScope(toolCtx, "child Task", taskNS); err != nil {
+		return nil, err
+	}
+	if err := validateDelegateNamespaceScope(toolCtx, "target Agent", agentNS); err != nil {
+		return nil, err
 	}
 
-	// Fetch parent Task for owner reference
+	// Fetch parent Task for owner reference. Brokered calls always require the
+	// exact authenticated Task; worker calls retain the legacy empty-parent path.
 	parentTask := &corev1alpha1.Task{}
 	if parentName != "" {
 		parentLookupNS := parentNamespace
@@ -313,7 +430,80 @@ func (t *DelegateTaskTool) parseDelegateArgs(ctx context.Context, args json.RawM
 		}
 	}
 
-	// Determine priority
+	if brokered {
+		authenticatedUID := strings.TrimSpace(toolCtx.TaskUID)
+		if authenticatedUID == "" || string(parentTask.UID) != authenticatedUID {
+			return nil, fmt.Errorf("brokered delegation parent Task identity changed")
+		}
+		depthStr = strings.TrimSpace(parentTask.Annotations[labels.AnnotationCoordinationDepth])
+		if depthStr == "" {
+			depthStr = "0"
+		}
+		if parentTask.Spec.AgentRef == nil || strings.TrimSpace(parentTask.Spec.AgentRef.Name) == "" {
+			return nil, fmt.Errorf("brokered delegation requires a parent Task with agentRef")
+		}
+		parentAgentNamespace := parentTask.Namespace
+		if value := strings.TrimSpace(parentTask.Spec.AgentRef.Namespace); value != "" {
+			parentAgentNamespace = value
+		}
+		parentAgent := &corev1alpha1.Agent{}
+		if err := t.k8sClient.Get(ctx, types.NamespacedName{
+			Name: parentTask.Spec.AgentRef.Name, Namespace: parentAgentNamespace,
+		}, parentAgent); err != nil {
+			return nil, fmt.Errorf("failed to get parent agent: %w", err)
+		}
+		coordination := parentAgent.Spec.Coordination
+		if coordination == nil || !coordination.Enabled {
+			return nil, fmt.Errorf("parent agent does not have coordination enabled")
+		}
+		if coordination.MaxDepth > 0 {
+			maxDepthStr = strconv.FormatInt(int64(coordination.MaxDepth), 10)
+		}
+		allowed := make([]string, 0, len(coordination.AllowedAgents))
+		for _, agent := range coordination.AllowedAgents {
+			name := strings.TrimSpace(agent.Name)
+			if name == "" {
+				continue
+			}
+			if namespace := strings.TrimSpace(agent.Namespace); namespace != "" {
+				allowed = append(allowed, namespacedDelegateAgent(namespace, name))
+			} else {
+				allowed = append(allowed, name)
+			}
+		}
+		allowedAgents = strings.Join(allowed, ",")
+	}
+
+	// Validate depth.
+	currentDepth := 0
+	if depthStr != "" {
+		var err error
+		currentDepth, err = strconv.Atoi(depthStr)
+		if err != nil {
+			return nil, fmt.Errorf("invalid coordination depth %q: %w", depthStr, err)
+		}
+	}
+
+	maxDepth := 3
+	if maxDepthStr != "" {
+		var err error
+		maxDepth, err = strconv.Atoi(maxDepthStr)
+		if err != nil {
+			return nil, fmt.Errorf("invalid max coordination depth %q: %w", maxDepthStr, err)
+		}
+	}
+
+	if currentDepth+1 > maxDepth {
+		return nil, fmt.Errorf("coordination depth exceeded: current depth %d, max depth %d", currentDepth, maxDepth)
+	}
+
+	// Validate agent is allowed, including namespace when the allowlist entry is
+	// namespaced as namespace/name. Bare names retain existing same-name behavior.
+	if (brokered || allowedAgents != "") && !delegatedAgentAllowed(delegateArgs.Agent, agentNS, taskNS, allowedAgents) {
+		return nil, fmt.Errorf("agent %q is not in the allowed agents list", namespacedDelegateAgent(agentNS, delegateArgs.Agent))
+	}
+
+	// Determine priority.
 	var priority *int32
 	if delegateArgs.Priority != nil {
 		priority = delegateArgs.Priority
@@ -321,7 +511,7 @@ func (t *DelegateTaskTool) parseDelegateArgs(ctx context.Context, args json.RawM
 		priority = parentTask.Spec.Priority
 	}
 
-	// Look up the target Agent to determine task type
+	// Look up the target Agent to determine task type.
 	targetAgent := &corev1alpha1.Agent{}
 	if err := t.k8sClient.Get(ctx, types.NamespacedName{
 		Name: delegateArgs.Agent, Namespace: agentNS,
@@ -409,6 +599,12 @@ func (t *DelegateTaskTool) buildDelegatedTask(ctx context.Context, dc *delegatio
 	if dc.args.Feedback != "" {
 		childTask.Spec.Prompt = fmt.Sprintf("FEEDBACK FROM REVIEW:\n%s\n\nTASK:\n%s", dc.args.Feedback, childTask.Spec.Prompt)
 	}
+	if taskType == corev1alpha1.TaskTypeAI {
+		// Native AI admission requires spec.ai. Keep Agent-owned provider,
+		// model, prompt defaults, skills, and tools authoritative; the child
+		// contributes only its task-specific prompt.
+		childTask.Spec.AI = &corev1alpha1.AISpec{Prompt: childTask.Spec.Prompt}
+	}
 
 	// Handle prior task reference for iterative workflows
 	if dc.args.PriorTask != "" {
@@ -419,18 +615,18 @@ func (t *DelegateTaskTool) buildDelegatedTask(ctx context.Context, dc *delegatio
 
 	// Set owner reference only for same-namespace children. Kubernetes treats
 	// cross-namespace owner references for namespaced objects as invalid and may
-	// garbage-collect the child; labels/annotations still preserve lineage.
+	// garbage-collect the child; labels/annotations still preserve lineage. Do
+	// not request foreground-deletion blocking: workers can create Tasks but do
+	// not have permission to update the parent Task's finalizers.
 	if dc.parentTask.UID != "" && dc.parentTask.Namespace == dc.namespace {
 		isController := true
-		blockOwnerDeletion := true
 		childTask.OwnerReferences = []metav1.OwnerReference{
 			{
-				APIVersion:         corev1alpha1.GroupVersion.String(),
-				Kind:               taskKindString,
-				Name:               dc.parentTask.Name,
-				UID:                dc.parentTask.UID,
-				Controller:         &isController,
-				BlockOwnerDeletion: &blockOwnerDeletion,
+				APIVersion: corev1alpha1.GroupVersion.String(),
+				Kind:       taskKindString,
+				Name:       dc.parentTask.Name,
+				UID:        dc.parentTask.UID,
+				Controller: &isController,
 			},
 		}
 	}
@@ -443,17 +639,55 @@ func (t *DelegateTaskTool) applyAgentRuntimeConfig(ctx context.Context, childTas
 	childTask.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{}
 
 	if dc.args.Workspace != nil {
-		childTask.Spec.AgentRuntime.Workspace = &corev1alpha1.WorkspaceConfig{
-			GitRepo:    dc.args.Workspace.GitRepo,
-			Branch:     dc.args.Workspace.Branch,
-			Ref:        dc.args.Workspace.Ref,
-			PushBranch: dc.args.Workspace.PushBranch,
+		intent := corev1alpha1.WorkspaceIntent(strings.ToLower(strings.TrimSpace(dc.args.Workspace.Intent)))
+		if intent == "" {
+			intent = corev1alpha1.WorkspaceIntentRead
 		}
-		secretRef, err := resolveWorkspaceGitSecretRef(ctx, t.k8sClient, dc.namespace, dc.targetAgent, dc.args.Workspace.GitSecretRef)
-		if err != nil {
-			return err
+		if intent != corev1alpha1.WorkspaceIntentRead && intent != corev1alpha1.WorkspaceIntentWrite {
+			return fmt.Errorf("workspace intent must be read or write")
+		}
+		workspace := &corev1alpha1.WorkspaceConfig{
+			Intent:             intent,
+			GitRepo:            dc.args.Workspace.GitRepo,
+			Branch:             dc.args.Workspace.Branch,
+			Ref:                dc.args.Workspace.Ref,
+			PublicationGitRepo: dc.args.Workspace.PublicationGitRepo,
+			PushBranch:         dc.args.Workspace.PushBranch,
+			PRBaseBranch:       dc.args.Workspace.PRBaseBranch,
+			CreatePR:           dc.args.Workspace.CreatePR,
+		}
+		if workspace.PublicationGitRepo != "" || workspace.PushBranch != "" || workspace.PRBaseBranch != "" || workspace.CreatePR {
+			workspace.Intent = corev1alpha1.WorkspaceIntentWrite
+		}
+		publicationCredential := strings.TrimSpace(dc.args.Workspace.PublicationCredentialRef)
+		if workspace.Intent == corev1alpha1.WorkspaceIntentWrite && publicationCredential == "" {
+			return fmt.Errorf("workspace publicationCredentialRef is required for write intent")
+		}
+		// Only attach read credentials alongside a gitRepo: the controller
+		// workspace preflight rejects readCredentialRef without gitRepo, so
+		// auto-discovery must not doom a repository-free workspace.
+		readCredential := strings.TrimSpace(dc.args.Workspace.ReadCredentialRef)
+		if strings.TrimSpace(workspace.GitRepo) == "" {
+			if readCredential != "" {
+				return fmt.Errorf("workspace readCredentialRef requires gitRepo")
+			}
+		} else {
+			readRef, err := resolveWorkspaceCredentialRef(ctx, t.k8sClient, dc.namespace, dc.targetAgent, readCredential)
+			if err != nil {
+				return err
+			}
+			workspace.ReadCredentialRef = readRef
 		}
-		childTask.Spec.AgentRuntime.Workspace.GitSecretRef = secretRef
+		if publicationReadCredential := strings.TrimSpace(dc.args.Workspace.PublicationReadCredentialRef); publicationReadCredential != "" {
+			workspace.PublicationReadCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: publicationReadCredential}
+		}
+		if publicationCredential != "" {
+			workspace.PublicationCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: publicationCredential}
+		}
+		if forgeCredential := strings.TrimSpace(dc.args.Workspace.ForgeCredentialRef); forgeCredential != "" {
+			workspace.ForgeCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: forgeCredential}
+		}
+		childTask.Spec.Workspace = workspace
 	}
 
 	if dc.args.MaxTurns != nil {
@@ -477,10 +711,7 @@ func (t *DelegateTaskTool) applyPriorTaskConfig(ctx context.Context, childTask *
 		// Copy workspace from prior task if not explicitly provided
 		if dc.args.Workspace == nil {
 			if priorWorkspace := taskWorkspace(priorTask); priorWorkspace != nil {
-				if childTask.Spec.AgentRuntime == nil {
-					childTask.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{}
-				}
-				childTask.Spec.AgentRuntime.Workspace = priorWorkspace.DeepCopy()
+				childTask.Spec.Workspace = priorWorkspace.DeepCopy()
 			}
 		}
 
@@ -502,6 +733,134 @@ func (t *DelegateTaskTool) applyPriorTaskConfig(ctx context.Context, childTask *
 	}
 }
 
+func (t *DelegateTaskTool) shouldPrepareChildTransactionToken(
+	ctx context.Context,
+	parentTask *corev1alpha1.Task,
+) (bool, error) {
+	toolCtx := GetToolContext(ctx)
+	if toolCtx == nil || !toolCtx.Brokered {
+		return shouldPrepareChildTransactionToken(parentTask)
+	}
+	if parentTask == nil || parentTask.Spec.Transaction == nil {
+		return false, nil
+	}
+	if t.brokeredTransactionExchange == nil {
+		return false, fmt.Errorf("brokered delegate_task transaction-token exchange configuration is not registered")
+	}
+	return t.brokeredTransactionExchange.TTS.Enabled(), nil
+}
+
+func (t *DelegateTaskTool) prepareChildTransactionToken(
+	ctx context.Context,
+	parentTask, childTask *corev1alpha1.Task,
+	operation, agent string,
+) error {
+	toolCtx := GetToolContext(ctx)
+	if toolCtx == nil || !toolCtx.Brokered {
+		return prepareChildTransactionToken(ctx, t.k8sClient, parentTask, childTask, operation, agent)
+	}
+	return t.prepareBrokeredChildTransactionToken(ctx, parentTask, childTask, operation, agent)
+}
+
+func (t *DelegateTaskTool) prepareBrokeredChildTransactionToken(
+	ctx context.Context,
+	parentTask, childTask *corev1alpha1.Task,
+	operation, agent string,
+) error {
+	config := t.brokeredTransactionExchange
+	if config == nil {
+		return fmt.Errorf("brokered delegate_task transaction-token exchange configuration is not registered")
+	}
+	if !config.TTS.Enabled() || parentTask == nil || parentTask.Spec.Transaction == nil {
+		return nil
+	}
+	if parentTask.UID == "" {
+		return fmt.Errorf("parent task UID is required for child transaction token exchange")
+	}
+	if config.Exchanger == nil {
+		return fmt.Errorf("brokered delegate_task transaction-token exchanger is not configured")
+	}
+	if config.ResolveSubjectToken == nil {
+		return fmt.Errorf("brokered delegate_task request-scoped subject-token resolver is not configured")
+	}
+
+	scope := strings.TrimSpace(config.ChildScope)
+	if scope == "" {
+		return fmt.Errorf("context-token child scope is required when brokered TTS is enabled for child task tokens")
+	}
+	if err := validateChildTransactionScope(parentTask, scope); err != nil {
+		return err
+	}
+	subjectToken, err := config.ResolveSubjectToken(ctx, parentTask, config.TTS.TokenSource)
+	if err != nil {
+		return fmt.Errorf("resolving brokered child transaction subject token: %w", err)
+	}
+	if strings.TrimSpace(subjectToken) == "" {
+		return fmt.Errorf("resolving brokered child transaction subject token: resolved token is empty")
+	}
+	subjectTokenType := strings.TrimSpace(config.SubjectTokenType)
+	if subjectTokenType == "" {
+		subjectTokenType = contexttoken.SubjectTokenTypeForSource(config.TTS.TokenSource)
+	}
+
+	requestDetails := map[string]any{
+		delegateRequestOperationField:  operation,
+		delegateRequestParentTaskField: parentTask.Name,
+		namespaceField:                 childTask.Namespace,
+	}
+	if agent != "" {
+		requestDetails["agent"] = agent
+	}
+	if parentTask.Spec.Transaction.ID != "" {
+		requestDetails["txn"] = parentTask.Spec.Transaction.ID
+	}
+	token, err := config.Exchanger.Exchange(ctx, contexttoken.ExchangeRequest{
+		SubjectToken:     subjectToken,
+		SubjectTokenType: subjectTokenType,
+		Scope:            scope,
+		RequestedTTL:     config.TTS.ChildTokenTTL,
+		RequestDetails:   requestDetails,
+	})
+	if err != nil {
+		return fmt.Errorf("exchanging child transaction token: %w", err)
+	}
+	token = strings.TrimSpace(token)
+	if token == "" {
+		return fmt.Errorf("exchanging child transaction token: TTS returned an empty token")
+	}
+
+	secretName, err := childTransactionTokenSecretName(parentTask.Name)
+	if err != nil {
+		return err
+	}
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:            secretName,
+			Namespace:       childTask.Namespace,
+			OwnerReferences: taskOwnerReference(parentTask),
+			Labels: map[string]string{
+				labels.LabelParentTask: labels.SelectorValue(parentTask.Name),
+			},
+			Annotations: map[string]string{
+				labels.AnnotationParentTaskName: parentTask.Name,
+			},
+		},
+		Type: corev1.SecretTypeOpaque,
+		Data: map[string][]byte{
+			"token": []byte(token),
+		},
+	}
+	if err := t.k8sClient.Create(ctx, secret); err != nil {
+		return fmt.Errorf("creating child transaction token secret: %w", err)
+	}
+	stampChildTransactionScope(childTask, scope)
+	if childTask.Annotations == nil {
+		childTask.Annotations = map[string]string{}
+	}
+	childTask.Annotations[labels.AnnotationTransactionTokenSecret] = secretName
+	return nil
+}
+
 // Execute delegates a task to another agent
 func (t *DelegateTaskTool) Execute(ctx context.Context, args json.RawMessage) (string, error) {
 	dc, err := t.parseDelegateArgs(ctx, args)
@@ -520,13 +879,13 @@ func (t *DelegateTaskTool) Execute(ctx context.Context, args json.RawMessage) (s
 		return "", err
 	}
 
-	childTokenExchangeEnabled, err := shouldPrepareChildTransactionToken(dc.parentTask)
+	childTokenExchangeEnabled, err := t.shouldPrepareChildTransactionToken(ctx, dc.parentTask)
 	if err != nil {
 		return "", err
 	}
 	if childTokenExchangeEnabled {
 		markChildTransactionTokenPending(childTask)
-		if err := prepareChildTransactionToken(ctx, t.k8sClient, dc.parentTask, childTask, "delegateTask", dc.args.Agent); err != nil {
+		if err := t.prepareChildTransactionToken(ctx, dc.parentTask, childTask, "delegateTask", dc.args.Agent); err != nil {
 			return "", err
 		}
 	}
diff --git a/internal/tools/delegate_task_test.go b/internal/tools/delegate_task_test.go
index b16d1c866..de1d935ef 100644
--- a/internal/tools/delegate_task_test.go
+++ b/internal/tools/delegate_task_test.go
@@ -117,8 +117,8 @@ func expectInheritedTaskProvenance(t *testing.T, task *corev1alpha1.Task) {
 	if ownerRef.Controller == nil || !*ownerRef.Controller {
 		t.Fatalf("ownerRef.Controller = %#v, want true", ownerRef.Controller)
 	}
-	if ownerRef.BlockOwnerDeletion == nil || !*ownerRef.BlockOwnerDeletion {
-		t.Fatalf("ownerRef.BlockOwnerDeletion = %#v, want true", ownerRef.BlockOwnerDeletion)
+	if ownerRef.BlockOwnerDeletion != nil {
+		t.Fatalf("ownerRef.BlockOwnerDeletion = %#v, want nil", ownerRef.BlockOwnerDeletion)
 	}
 }
 
@@ -150,6 +150,23 @@ func TestDelegateTaskTool_Parameters(t *testing.T) {
 	if parametersSchema[jsonSchemaTypeField] != typeObject {
 		t.Error("Parameters schema should have type: object")
 	}
+	properties, ok := parametersSchema[jsonSchemaPropertiesField].(map[string]any)
+	if !ok {
+		t.Fatal("Parameters schema is missing properties")
+	}
+	workspaceSchema, ok := properties[workspaceField].(map[string]any)
+	if !ok {
+		t.Fatal("workspace schema is not an object")
+	}
+	workspaceProperties, ok := workspaceSchema[jsonSchemaPropertiesField].(map[string]any)
+	if !ok {
+		t.Fatal("workspace schema is missing properties")
+	}
+	for _, key := range []string{"publicationReadCredentialRef", "publicationCredentialRef", "forgeCredentialRef"} {
+		if _, ok := workspaceProperties[key]; !ok {
+			t.Errorf("workspace schema missing %s property", key)
+		}
+	}
 }
 
 func TestDelegateTaskTool_Execute(t *testing.T) {
@@ -762,6 +779,9 @@ func TestDelegateTaskTool_Execute_ChildTaskFields(t *testing.T) {
 	if childTask.Spec.Prompt != "Investigate this" {
 		t.Errorf("spec.prompt = %q, want %q", childTask.Spec.Prompt, "Investigate this")
 	}
+	if childTask.Spec.AI == nil || childTask.Spec.AI.Prompt != childTask.Spec.Prompt {
+		t.Fatalf("spec.ai = %#v, want only delegated prompt %q", childTask.Spec.AI, childTask.Spec.Prompt)
+	}
 	expectInheritedTaskProvenance(t, childTask)
 
 	// Verify owner reference
@@ -778,8 +798,8 @@ func TestDelegateTaskTool_Execute_ChildTaskFields(t *testing.T) {
 	if ownerRef.Controller == nil || !*ownerRef.Controller {
 		t.Error("ownerRef.Controller should be true")
 	}
-	if ownerRef.BlockOwnerDeletion == nil || !*ownerRef.BlockOwnerDeletion {
-		t.Errorf("ownerRef.BlockOwnerDeletion = %#v, want true", ownerRef.BlockOwnerDeletion)
+	if ownerRef.BlockOwnerDeletion != nil {
+		t.Errorf("ownerRef.BlockOwnerDeletion = %#v, want nil", ownerRef.BlockOwnerDeletion)
 	}
 
 	// Verify priority inherited from parent
@@ -858,19 +878,22 @@ func TestDelegateTaskTool_Execute_AgentType(t *testing.T) {
 	if childTask.Spec.Type != corev1alpha1.TaskTypeAgent {
 		t.Errorf("spec.type = %q, want %q", childTask.Spec.Type, corev1alpha1.TaskTypeAgent)
 	}
+	if childTask.Spec.AI != nil {
+		t.Fatalf("spec.ai = %#v, want nil for an explicit runtime Agent", childTask.Spec.AI)
+	}
 
 	// Verify agent runtime config
 	if childTask.Spec.AgentRuntime == nil {
 		t.Fatal("spec.agentRuntime is nil")
 	}
-	if childTask.Spec.AgentRuntime.Workspace == nil {
+	if childTask.Spec.Workspace == nil {
 		t.Fatal("spec.agentRuntime.workspace is nil")
 	}
-	if childTask.Spec.AgentRuntime.Workspace.GitRepo != "https://github.com/myorg/myrepo.git" {
-		t.Errorf("workspace.gitRepo = %q, want %q", childTask.Spec.AgentRuntime.Workspace.GitRepo, "https://github.com/myorg/myrepo.git")
+	if childTask.Spec.Workspace.GitRepo != "https://github.com/myorg/myrepo.git" {
+		t.Errorf("workspace.gitRepo = %q, want %q", childTask.Spec.Workspace.GitRepo, "https://github.com/myorg/myrepo.git")
 	}
-	if childTask.Spec.AgentRuntime.Workspace.Branch != testBranch {
-		t.Errorf("workspace.branch = %q, want %q", childTask.Spec.AgentRuntime.Workspace.Branch, testBranch)
+	if childTask.Spec.Workspace.Branch != testBranch {
+		t.Errorf("workspace.branch = %q, want %q", childTask.Spec.Workspace.Branch, testBranch)
 	}
 	if childTask.Spec.AgentRuntime.MaxTurns == nil || *childTask.Spec.AgentRuntime.MaxTurns != 50 {
 		t.Errorf("agentRuntime.maxTurns = %v, want 50", childTask.Spec.AgentRuntime.MaxTurns)
@@ -988,7 +1011,7 @@ func TestDelegateTaskTool_Execute_AgentTypeNoWorkspace(t *testing.T) {
 	if childTask.Spec.AgentRuntime == nil {
 		t.Fatal("spec.agentRuntime should not be nil for agent-type tasks")
 	}
-	if childTask.Spec.AgentRuntime.Workspace != nil {
+	if childTask.Spec.Workspace != nil {
 		t.Error("spec.agentRuntime.workspace should be nil when not provided")
 	}
 	if childTask.Spec.AgentRuntime.MaxTurns != nil {
@@ -1037,6 +1060,21 @@ func TestDelegateTaskTool_Execute_AITypeNoRuntime(t *testing.T) {
 	if childTask.Spec.AgentRuntime != nil {
 		t.Error("spec.agentRuntime should be nil for AI-type tasks")
 	}
+	if childTask.Spec.AgentRef == nil || childTask.Spec.AgentRef.Name != testResearcherAgentName {
+		t.Fatalf("spec.agentRef = %#v, want %q", childTask.Spec.AgentRef, testResearcherAgentName)
+	}
+	if childTask.Spec.AI == nil {
+		t.Fatal("spec.ai is nil for a native AI child")
+	}
+	if childTask.Spec.AI.Prompt != "Research the topic" {
+		t.Fatalf("spec.ai.prompt = %q, want %q", childTask.Spec.AI.Prompt, "Research the topic")
+	}
+	if childTask.Spec.AI.ProviderRef != nil || childTask.Spec.AI.Provider != "" ||
+		childTask.Spec.AI.Model != "" || childTask.Spec.AI.SystemPrompt != "" ||
+		childTask.Spec.AI.Temperature != nil || childTask.Spec.AI.MaxTokens != nil ||
+		len(childTask.Spec.AI.Skills) != 0 || len(childTask.Spec.AI.Tools) != 0 {
+		t.Fatalf("spec.ai copied Agent configuration: %#v", childTask.Spec.AI)
+	}
 }
 
 func contains(s, substr string) bool {
@@ -1067,11 +1105,9 @@ func TestDelegateTaskTool_Execute_PriorTask(t *testing.T) {
 		Spec: corev1alpha1.TaskSpec{
 			Type:   corev1alpha1.TaskTypeAgent,
 			Prompt: "original prompt",
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: "https://github.com/example/repo",
-					Branch:  testBranch,
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: "https://github.com/example/repo",
+				Branch:  testBranch,
 			},
 		},
 		Status: corev1alpha1.TaskStatus{
@@ -1139,11 +1175,11 @@ func TestDelegateTaskTool_Execute_PriorTask(t *testing.T) {
 	}
 
 	// Verify workspace was copied from prior task
-	if childTask.Spec.AgentRuntime == nil || childTask.Spec.AgentRuntime.Workspace == nil {
+	if childTask.Spec.Workspace == nil {
 		t.Fatal("expected workspace to be copied from prior task")
 	}
-	if childTask.Spec.AgentRuntime.Workspace.GitRepo != "https://github.com/example/repo" {
-		t.Errorf("expected git repo from prior task, got %q", childTask.Spec.AgentRuntime.Workspace.GitRepo)
+	if childTask.Spec.Workspace.GitRepo != "https://github.com/example/repo" {
+		t.Errorf("expected git repo from prior task, got %q", childTask.Spec.Workspace.GitRepo)
 	}
 }
 
@@ -1180,6 +1216,9 @@ func TestDelegateTaskTool_Execute_FeedbackOnly(t *testing.T) {
 	if !strings.Contains(childTask.Spec.Prompt, "FEEDBACK FROM REVIEW") {
 		t.Errorf("expected feedback in prompt, got %q", childTask.Spec.Prompt)
 	}
+	if childTask.Spec.AI == nil || childTask.Spec.AI.Prompt != childTask.Spec.Prompt {
+		t.Fatalf("spec.ai = %#v, want feedback-adjusted prompt %q", childTask.Spec.AI, childTask.Spec.Prompt)
+	}
 	// PriorTaskRef should NOT be set
 	if childTask.Spec.PriorTaskRef != nil {
 		t.Errorf("expected PriorTaskRef to be nil when prior_task not specified")
@@ -1214,7 +1253,10 @@ func TestDelegateTaskTool_Execute_PushBranch(t *testing.T) {
 		"workspace": {
 			"gitRepo": "https://github.com/sozercan/ayna",
 			"branch": "main",
-			"gitSecretRef": "git-credentials",
+			"readCredentialRef": "git-credentials",
+			"publicationReadCredentialRef": "git-target-read",
+			"publicationCredentialRef": "git-target-write",
+			"forgeCredentialRef": "git-forge",
 			"pushBranch": "feature/edit-message"
 		}
 	}`)
@@ -1234,22 +1276,53 @@ func TestDelegateTaskTool_Execute_PushBranch(t *testing.T) {
 		t.Fatalf("failed to get child task: %v", err)
 	}
 
-	if childTask.Spec.AgentRuntime == nil || childTask.Spec.AgentRuntime.Workspace == nil {
+	if childTask.Spec.Workspace == nil {
 		t.Fatal("expected workspace to be set")
 	}
-	ws := childTask.Spec.AgentRuntime.Workspace
+	ws := childTask.Spec.Workspace
 	if ws.PushBranch != "feature/edit-message" {
 		t.Errorf("pushBranch = %q, want %q", ws.PushBranch, "feature/edit-message")
 	}
 	if ws.GitRepo != testSozercanAynaRepoURL {
 		t.Errorf("gitRepo = %q, want %q", ws.GitRepo, testSozercanAynaRepoURL)
 	}
-	if ws.GitSecretRef == nil || ws.GitSecretRef.Name != "git-credentials" {
-		t.Errorf("gitSecretRef = %v, want git-credentials", ws.GitSecretRef)
+	if ws.ReadCredentialRef == nil || ws.ReadCredentialRef.Name != "git-credentials" {
+		t.Errorf("readCredentialRef = %v, want git-credentials", ws.ReadCredentialRef)
+	}
+	if ws.PublicationReadCredentialRef == nil || ws.PublicationReadCredentialRef.Name != "git-target-read" {
+		t.Errorf("publicationReadCredentialRef = %v, want git-target-read", ws.PublicationReadCredentialRef)
+	}
+	if ws.PublicationCredentialRef == nil || ws.PublicationCredentialRef.Name != "git-target-write" {
+		t.Errorf("publicationCredentialRef = %v, want git-target-write", ws.PublicationCredentialRef)
+	}
+	if ws.ForgeCredentialRef == nil || ws.ForgeCredentialRef.Name != "git-forge" {
+		t.Errorf("forgeCredentialRef = %v, want git-forge", ws.ForgeCredentialRef)
+	}
+}
+
+func TestDelegateTaskTool_Execute_RequiresExplicitPublicationCredentialForWrite(t *testing.T) {
+	t.Setenv(envOrkaTaskName, parentTaskName)
+	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
+	t.Setenv(envOrkaCoordinationDepth, "0")
+	t.Setenv(envOrkaCoordinationAllowedAgents, testClaudeCoderName)
+	t.Setenv(envOrkaCoordinationMaxDepth, "3")
+
+	agentWithRuntime := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: testClaudeCoderName, Namespace: defaultNamespace},
+		Spec:       corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{Type: runtimeTypeClaude}},
+	}
+	tool := NewDelegateTaskTool(newFakeClient(parentTask(), agentWithRuntime))
+	_, err := tool.Execute(context.Background(), json.RawMessage(`{
+		"agent":"claude-coder",
+		"prompt":"Implement feature",
+		"workspace":{"gitRepo":"https://github.com/sozercan/ayna","intent":"write","readCredentialRef":"git-credentials"}
+	}`))
+	if err == nil || !strings.Contains(err.Error(), "publicationCredentialRef is required") {
+		t.Fatalf("Execute() error = %v, want explicit publication credential denial", err)
 	}
 }
 
-func TestDelegateTaskTool_Execute_AutoDiscoversGitSecretRef(t *testing.T) {
+func TestDelegateTaskTool_Execute_AutoDiscoversReadCredentialRef(t *testing.T) {
 	t.Setenv(envOrkaTaskName, parentTaskName)
 	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
 	t.Setenv(envOrkaCoordinationDepth, "0")
@@ -1276,6 +1349,7 @@ func TestDelegateTaskTool_Execute_AutoDiscoversGitSecretRef(t *testing.T) {
 		"workspace": {
 			"gitRepo": "https://github.com/sozercan/ayna",
 			"branch": "main",
+			"publicationCredentialRef": "git-target-write",
 			"pushBranch": "feature/auto-secret"
 		}
 	}`)
@@ -1295,14 +1369,95 @@ func TestDelegateTaskTool_Execute_AutoDiscoversGitSecretRef(t *testing.T) {
 		t.Fatalf("failed to get child task: %v", err)
 	}
 
-	if childTask.Spec.AgentRuntime == nil || childTask.Spec.AgentRuntime.Workspace == nil {
+	if childTask.Spec.Workspace == nil {
+		t.Fatal("expected workspace to be set")
+	}
+	if childTask.Spec.Workspace.ReadCredentialRef == nil {
+		t.Fatal("expected readCredentialRef to be auto-populated")
+	}
+	if childTask.Spec.Workspace.ReadCredentialRef.Name != testCustomCopilotSecretName {
+		t.Errorf("readCredentialRef = %q, want %q", childTask.Spec.Workspace.ReadCredentialRef.Name, testCustomCopilotSecretName)
+	}
+}
+
+func TestDelegateTaskTool_Execute_RepositoryFreeWorkspaceSkipsReadCredentialDiscovery(t *testing.T) {
+	t.Setenv(envOrkaTaskName, parentTaskName)
+	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
+	t.Setenv(envOrkaCoordinationDepth, "0")
+	t.Setenv(envOrkaCoordinationAllowedAgents, "copilot-coder")
+	t.Setenv(envOrkaCoordinationMaxDepth, "3")
+
+	// The agent carries a discoverable secret, but the controller workspace
+	// preflight rejects readCredentialRef without gitRepo — auto-discovery must
+	// not doom a repository-free workspace.
+	agentWithRuntime := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "copilot-coder", Namespace: defaultNamespace},
+		Spec: corev1alpha1.AgentSpec{
+			Runtime:   &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeCopilot},
+			SecretRef: &corev1.LocalObjectReference{Name: testCustomCopilotSecretName},
+		},
+	}
+	k8sClient := newFakeClient(parentTask(), agentWithRuntime)
+	tool := NewDelegateTaskTool(k8sClient)
+
+	result, err := tool.Execute(context.Background(), json.RawMessage(`{
+		"agent": "copilot-coder",
+		"prompt": "Summarize the design",
+		"workspace": {"intent": "read"}
+	}`))
+	if err != nil {
+		t.Fatalf("Execute() error = %v", err)
+	}
+	var delegateResult DelegateTaskResult
+	if err := json.Unmarshal([]byte(result), &delegateResult); err != nil {
+		t.Fatal(err)
+	}
+	childTask := &corev1alpha1.Task{}
+	if err := k8sClient.Get(context.Background(), apitypes.NamespacedName{
+		Name: delegateResult.TaskName, Namespace: defaultNamespace,
+	}, childTask); err != nil {
+		t.Fatalf("failed to get child task: %v", err)
+	}
+	if childTask.Spec.Workspace == nil {
 		t.Fatal("expected workspace to be set")
 	}
-	if childTask.Spec.AgentRuntime.Workspace.GitSecretRef == nil {
-		t.Fatal("expected gitSecretRef to be auto-populated")
+	if childTask.Spec.Workspace.ReadCredentialRef != nil {
+		t.Fatalf("readCredentialRef = %#v, want nil without gitRepo", childTask.Spec.Workspace.ReadCredentialRef)
+	}
+}
+
+func TestDelegateTaskTool_Execute_ExplicitReadCredentialRequiresGitRepo(t *testing.T) {
+	t.Setenv(envOrkaTaskName, parentTaskName)
+	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
+	t.Setenv(envOrkaCoordinationDepth, "0")
+	t.Setenv(envOrkaCoordinationAllowedAgents, "copilot-coder")
+	t.Setenv(envOrkaCoordinationMaxDepth, "3")
+
+	agentWithRuntime := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "copilot-coder", Namespace: defaultNamespace},
+		Spec: corev1alpha1.AgentSpec{
+			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeCopilot},
+		},
+	}
+	k8sClient := newFakeClient(parentTask(), agentWithRuntime)
+	tool := NewDelegateTaskTool(k8sClient)
+
+	_, err := tool.Execute(context.Background(), json.RawMessage(`{
+		"agent": "copilot-coder",
+		"prompt": "Summarize the design",
+		"workspace": {"readCredentialRef": "my-secret"}
+	}`))
+	if err == nil || !strings.Contains(err.Error(), "readCredentialRef requires gitRepo") {
+		t.Fatalf("Execute() error = %v, want readCredentialRef requires gitRepo", err)
 	}
-	if childTask.Spec.AgentRuntime.Workspace.GitSecretRef.Name != testCustomCopilotSecretName {
-		t.Errorf("gitSecretRef = %q, want %q", childTask.Spec.AgentRuntime.Workspace.GitSecretRef.Name, testCustomCopilotSecretName)
+	taskList := &corev1alpha1.TaskList{}
+	if err := k8sClient.List(context.Background(), taskList); err != nil {
+		t.Fatal(err)
+	}
+	for _, task := range taskList.Items {
+		if task.Name != parentTaskName {
+			t.Fatalf("unexpected child Task %q created", task.Name)
+		}
 	}
 }
 
diff --git a/internal/tools/file_read.go b/internal/tools/file_read.go
index f35bc502f..f94905936 100644
--- a/internal/tools/file_read.go
+++ b/internal/tools/file_read.go
@@ -90,113 +90,113 @@ func (t *FileReadTool) Parameters() json.RawMessage {
 	}`)
 }
 
-// Execute reads the file
+// Execute reads the file.
 func (t *FileReadTool) Execute(ctx context.Context, args json.RawMessage) (string, error) {
+	_ = ctx
 	var readArgs FileReadArgs
 	if err := json.Unmarshal(args, &readArgs); err != nil {
 		return "", fmt.Errorf("invalid arguments: %w", err)
 	}
-
 	if readArgs.Path == "" {
 		return "", fmt.Errorf("path is required")
 	}
-
-	// Resolve the path
-	filePath := readArgs.Path
-	if !filepath.IsAbs(filePath) {
-		filePath = filepath.Join(t.workDir, filePath)
+	if readArgs.Offset < 0 {
+		return "", fmt.Errorf("offset must be non-negative")
 	}
 
-	// Clean the path and check for traversal attacks
-	filePath = filepath.Clean(filePath)
-
-	// Resolve symlinks to prevent bypass
-	resolvedPath, err := filepath.EvalSymlinks(filePath)
-	if err != nil && !os.IsNotExist(err) {
-		return "", fmt.Errorf("access denied: cannot resolve path")
-	}
-	if err == nil {
-		filePath = resolvedPath
-	}
-
-	if !t.isPathAllowed(filePath) {
+	rootPath, relativePath, ok := t.allowedRootForPath(readArgs.Path)
+	if !ok {
 		return "", fmt.Errorf("access denied: path outside allowed directories")
 	}
+	root, err := os.OpenRoot(rootPath)
+	if err != nil {
+		return "", fmt.Errorf("access denied: cannot open allowed directory")
+	}
+	defer func() { _ = root.Close() }()
 
-	// Check if file exists
-	info, err := os.Stat(filePath)
+	file, err := root.Open(relativePath)
 	if err != nil {
 		if os.IsNotExist(err) {
 			return "", fmt.Errorf("file not found: %s", readArgs.Path)
 		}
-		return "", fmt.Errorf("failed to stat file: %w", err)
+		return "", fmt.Errorf("failed to open file: %w", err)
 	}
+	defer func() { _ = file.Close() }()
 
+	info, err := file.Stat()
+	if err != nil {
+		return "", fmt.Errorf("failed to stat file: %w", err)
+	}
 	if info.IsDir() {
 		return "", fmt.Errorf("path is a directory, not a file")
 	}
-
-	// Open the file
-	file, err := os.Open(filePath)
-	if err != nil {
-		return "", fmt.Errorf("failed to open file: %w", err)
-	}
-	defer file.Close() //nolint:errcheck
-
-	// Handle offset
 	if readArgs.Offset > 0 {
-		_, err = file.Seek(readArgs.Offset, io.SeekStart)
-		if err != nil {
+		if _, err := file.Seek(readArgs.Offset, io.SeekStart); err != nil {
 			return "", fmt.Errorf("failed to seek: %w", err)
 		}
 	}
 
-	// Set limit
-	limit := int64(65536) // Default 64KB
+	const (
+		defaultFileReadBytes = int64(65536)
+		maxFileReadBytes     = int64(1024 * 1024)
+	)
+	limit := defaultFileReadBytes
 	if readArgs.Limit > 0 {
 		limit = readArgs.Limit
 	}
-	if limit > t.maxFileSize {
+	if limit > maxFileReadBytes {
+		limit = maxFileReadBytes
+	}
+	if t.maxFileSize > 0 && limit > t.maxFileSize {
 		limit = t.maxFileSize
 	}
+	if limit < 0 {
+		return "", fmt.Errorf("invalid file read limit")
+	}
 
-	// Read the file
-	content := make([]byte, limit)
+	content := make([]byte, int(limit))
 	n, err := file.Read(content)
 	if err != nil && err != io.EOF {
 		return "", fmt.Errorf("failed to read file: %w", err)
 	}
 
+	remaining := max(info.Size()-readArgs.Offset, 0)
 	result := FileReadResult{
 		Content:   string(content[:n]),
 		Path:      readArgs.Path,
 		Size:      info.Size(),
-		Truncated: int64(n) < info.Size()-readArgs.Offset,
+		Truncated: int64(n) < remaining,
 	}
-
 	output, err := json.MarshalIndent(result, "", "  ")
 	if err != nil {
 		return "", err
 	}
-
 	return string(output), nil
 }
 
-// isPathAllowed checks if the path is within allowed directories
-func (t *FileReadTool) isPathAllowed(path string) bool {
+// allowedRootForPath maps a requested path to one os.Root-relative name. os.Root
+// enforces confinement across symlink traversal and closes the check/open race.
+func (t *FileReadTool) allowedRootForPath(requested string) (string, string, bool) {
+	candidate := requested
+	if !filepath.IsAbs(candidate) {
+		candidate = filepath.Join(t.workDir, candidate)
+	}
+	candidate, err := filepath.Abs(filepath.Clean(candidate))
+	if err != nil {
+		return "", "", false
+	}
 	for _, allowedPath := range t.allowedPaths {
-		if path == allowedPath || strings.HasPrefix(path, allowedPath+"/") {
-			return true
+		allowed, err := filepath.Abs(filepath.Clean(allowedPath))
+		if err != nil {
+			continue
 		}
-		// Also check with symlinks resolved for consistent comparison
-		resolved, err := filepath.EvalSymlinks(allowedPath)
-		if err == nil && resolved != allowedPath {
-			if path == resolved || strings.HasPrefix(path, resolved+"/") {
-				return true
-			}
+		relative, err := filepath.Rel(allowed, candidate)
+		if err != nil || filepath.IsAbs(relative) || relative == ".." || strings.HasPrefix(relative, ".."+string(filepath.Separator)) {
+			continue
 		}
+		return allowed, relative, true
 	}
-	return false
+	return "", "", false
 }
 
 // Ensure FileReadTool implements Tool
diff --git a/internal/tools/file_read_test.go b/internal/tools/file_read_test.go
index 0a87cb9c3..3e66e3783 100644
--- a/internal/tools/file_read_test.go
+++ b/internal/tools/file_read_test.go
@@ -330,7 +330,24 @@ func TestFileReadTool_Execute_LimitExceedsMax(t *testing.T) {
 	}
 }
 
-func TestFileReadTool_isPathAllowed(t *testing.T) {
+func TestFileReadTool_Execute_RejectsAbsoluteSymlink(t *testing.T) {
+	tmpDir := t.TempDir()
+	realFile := filepath.Join(tmpDir, "real.txt")
+	if err := os.WriteFile(realFile, []byte("real content"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	symlinkFile := filepath.Join(tmpDir, "absolute-link.txt")
+	if err := os.Symlink(realFile, symlinkFile); err != nil {
+		t.Skipf("symlinks not supported: %v", err)
+	}
+	tool := &FileReadTool{workDir: tmpDir, maxFileSize: 1024 * 1024, allowedPaths: []string{tmpDir}}
+	args := json.RawMessage(`{"path": "` + symlinkFile + `"}`)
+	if _, err := tool.Execute(context.Background(), args); err == nil {
+		t.Fatal("Execute() accepted an absolute symlink")
+	}
+}
+
+func TestFileReadTool_allowedRootForPath(t *testing.T) {
 	tool := &FileReadTool{
 		allowedPaths: []string{defaultWorkspacePath, tempDirPath},
 	}
@@ -349,8 +366,8 @@ func TestFileReadTool_isPathAllowed(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.path, func(t *testing.T) {
-			if got := tool.isPathAllowed(tt.path); got != tt.allowed {
-				t.Errorf("isPathAllowed(%q) = %v, want %v", tt.path, got, tt.allowed)
+			if _, _, got := tool.allowedRootForPath(tt.path); got != tt.allowed {
+				t.Errorf("allowedRootForPath(%q) allowed = %v, want %v", tt.path, got, tt.allowed)
 			}
 		})
 	}
@@ -488,7 +505,7 @@ func TestFileReadTool_Execute_Symlink(t *testing.T) {
 		t.Fatalf("failed to create file: %v", err)
 	}
 	symlinkFile := filepath.Join(tmpDir, "link.txt")
-	if err := os.Symlink(realFile, symlinkFile); err != nil {
+	if err := os.Symlink(filepath.Base(realFile), symlinkFile); err != nil {
 		t.Skipf("symlinks not supported: %v", err)
 	}
 
diff --git a/internal/tools/get_issue.go b/internal/tools/get_issue.go
index 2623e6efe..1b5f80d98 100644
--- a/internal/tools/get_issue.go
+++ b/internal/tools/get_issue.go
@@ -94,7 +94,7 @@ func (t *GetIssueTool) Execute(ctx context.Context, argsJSON json.RawMessage) (s
 		return "", fmt.Errorf("issue_number is required and must be positive")
 	}
 
-	owner, repo, token, baseURL, err := resolveRepoAndToken(ctx, t.k8sClient, args.TaskName, args.RepoURL, t.apiBaseURL)
+	owner, repo, token, baseURL, err := resolveReadRepoAndToken(ctx, t.k8sClient, args.TaskName, args.RepoURL, t.apiBaseURL)
 	if err != nil {
 		return "", fmt.Errorf("failed to resolve repo and token: %w", err)
 	}
diff --git a/internal/tools/get_issue_test.go b/internal/tools/get_issue_test.go
index a4a54390b..f57fc76b7 100644
--- a/internal/tools/get_issue_test.go
+++ b/internal/tools/get_issue_test.go
@@ -89,11 +89,14 @@ func TestGetIssueTool_FullDetails(t *testing.T) {
 	}))
 	defer server.Close()
 
-	t.Setenv("GITHUB_TOKEN", testGitHubToken)
+	t.Setenv("GITHUB_TOKEN", "")
+	task, secret := githubRepoTaskWithSecret(testOrgTestRepoURL)
+	task.Spec.Workspace.ForgeCredentialRef = nil
 
-	tool := &GetIssueTool{apiBaseURL: server.URL}
+	tool := &GetIssueTool{k8sClient: newFakeClient(task, secret), apiBaseURL: server.URL}
 
 	args, _ := json.Marshal(GetIssueArgs{
+		TaskName:    testCoderTaskName,
 		RepoURL:     testOrgTestRepoURL,
 		IssueNumber: 42,
 	})
diff --git a/internal/tools/github_helpers.go b/internal/tools/github_helpers.go
index 1ae3466f4..19bf03e81 100644
--- a/internal/tools/github_helpers.go
+++ b/internal/tools/github_helpers.go
@@ -23,38 +23,62 @@ import (
 
 const githubPRStateClosed = "closed"
 
+type githubCredentialPolicy uint8
+
+const (
+	githubCredentialRead githubCredentialPolicy = iota
+	githubCredentialForgeMutation
+)
+
 type githubRepoScope struct {
-	source string
-	owner  string
-	repo   string
+	source            string
+	owner             string
+	repo              string
+	readCredentialRef *corev1alpha1.WorkspaceCredentialReference
 }
 
 type githubTaskContext struct {
-	scopes       []githubRepoScope
-	gitSecretRef *corev1.LocalObjectReference
+	scopes             []githubRepoScope
+	forgeCredentialRef *corev1alpha1.WorkspaceCredentialReference
 }
 
-// resolveRepoAndToken resolves GitHub owner/repo, auth token, and API base URL.
+// resolveReadRepoAndToken resolves GitHub owner/repo, read-only auth token, and API base URL.
 // Repository resolution prefers an explicit repoURL, then task workspace config,
 // then ORKA_GIT_REPO when no task context is available. If taskName, or an
 // implicit ToolContext task, is available alongside repoURL, repoURL still
 // selects the repository while the task workspace supplies repository scope
 // and can supply credentials.
 //
-// Token resolution (in order):
-//  1. task workspace gitSecretRef, when configured for taskName or current task
-//  2. /secrets/git/token file (mounted in pod)
-//  3. /secrets/git/password file (mounted in pod)
-//  4. GITHUB_TOKEN env var
-func resolveRepoAndToken(ctx context.Context, k8sClient client.Client, taskName, repoURL, overrideBaseURL string) (owner, repo, token, baseURL string, err error) {
-	return resolveRepoAndTokenWithScopePolicy(ctx, k8sClient, taskName, repoURL, overrideBaseURL, false)
+// For task-scoped calls, read credentials are selected by repository role:
+// readCredentialRef for the source repository and publicationReadCredentialRef
+// for the publication repository. Repository write and forge mutation credentials
+// are never used for read-only calls.
+func resolveReadRepoAndToken(ctx context.Context, k8sClient client.Client, taskName, repoURL, overrideBaseURL string) (owner, repo, token, baseURL string, err error) {
+	return resolveRepoAndTokenWithPolicy(ctx, k8sClient, taskName, repoURL, overrideBaseURL, false, githubCredentialRead)
+}
+
+func resolveScopedReadRepoAndToken(ctx context.Context, k8sClient client.Client, taskName, repoURL, overrideBaseURL string) (owner, repo, token, baseURL string, err error) {
+	return resolveRepoAndTokenWithPolicy(ctx, k8sClient, taskName, repoURL, overrideBaseURL, true, githubCredentialRead)
+}
+
+// resolveForgeRepoAndToken resolves GitHub owner/repo, forge-mutation auth token,
+// and API base URL. Task-scoped mutations require forgeCredentialRef and never
+// fall back to publication or read credentials.
+func resolveForgeRepoAndToken(ctx context.Context, k8sClient client.Client, taskName, repoURL, overrideBaseURL string) (owner, repo, token, baseURL string, err error) {
+	return resolveRepoAndTokenWithPolicy(ctx, k8sClient, taskName, repoURL, overrideBaseURL, false, githubCredentialForgeMutation)
 }
 
-func resolveScopedRepoAndToken(ctx context.Context, k8sClient client.Client, taskName, repoURL, overrideBaseURL string) (owner, repo, token, baseURL string, err error) {
-	return resolveRepoAndTokenWithScopePolicy(ctx, k8sClient, taskName, repoURL, overrideBaseURL, true)
+func resolveScopedForgeRepoAndToken(ctx context.Context, k8sClient client.Client, taskName, repoURL, overrideBaseURL string) (owner, repo, token, baseURL string, err error) {
+	return resolveRepoAndTokenWithPolicy(ctx, k8sClient, taskName, repoURL, overrideBaseURL, true, githubCredentialForgeMutation)
 }
 
-func resolveRepoAndTokenWithScopePolicy(ctx context.Context, k8sClient client.Client, taskName, repoURL, overrideBaseURL string, requireRepoURLScope bool) (owner, repo, token, baseURL string, err error) {
+func resolveRepoAndTokenWithPolicy(
+	ctx context.Context,
+	k8sClient client.Client,
+	taskName, repoURL, overrideBaseURL string,
+	requireRepoURLScope bool,
+	credentialPolicy githubCredentialPolicy,
+) (owner, repo, token, baseURL string, err error) {
 	baseURL = githubAPIBaseURL
 	if overrideBaseURL != "" {
 		baseURL = overrideBaseURL
@@ -90,7 +114,12 @@ func resolveRepoAndTokenWithScopePolicy(ctx context.Context, k8sClient client.Cl
 				formatGitHubRepoScopes(taskContext.scopes),
 			)
 		}
-		token, err = resolveGitSecretToken(ctx, k8sClient, taskContext.gitSecretRef)
+
+		credentialRef, err := taskContext.credentialRef(scopeTaskName, owner, repo, credentialPolicy)
+		if err != nil {
+			return "", "", "", "", err
+		}
+		token, err = resolveGitSecretToken(ctx, k8sClient, credentialRef)
 		if err != nil {
 			return "", "", "", "", err
 		}
@@ -150,14 +179,31 @@ func loadGitHubTaskContext(ctx context.Context, k8sClient client.Client, taskNam
 	var scopes []githubRepoScope
 	ws := githubTaskWorkspace(&task)
 	if ws != nil {
-		result.gitSecretRef = ws.GitSecretRef
+		result.forgeCredentialRef = ws.ForgeCredentialRef
 	}
 	if ws != nil && strings.TrimSpace(ws.GitRepo) != "" {
 		owner, repo, err := parseGitHubRepo(ws.GitRepo)
 		if err != nil {
 			return githubTaskContext{}, fmt.Errorf("failed to parse GitHub repo from %s: %w", ws.GitRepo, err)
 		}
-		scopes = append(scopes, githubRepoScope{source: "task workspace", owner: owner, repo: repo})
+		scopes = append(scopes, githubRepoScope{
+			source:            "task workspace",
+			owner:             owner,
+			repo:              repo,
+			readCredentialRef: ws.ReadCredentialRef,
+		})
+	}
+	if ws != nil && strings.TrimSpace(ws.PublicationGitRepo) != "" {
+		owner, repo, err := parseGitHubRepo(ws.PublicationGitRepo)
+		if err != nil {
+			return githubTaskContext{}, fmt.Errorf("failed to parse GitHub publication repo from %s: %w", ws.PublicationGitRepo, err)
+		}
+		scopes = append(scopes, githubRepoScope{
+			source:            "task publication workspace",
+			owner:             owner,
+			repo:              repo,
+			readCredentialRef: ws.PublicationReadCredentialRef,
+		})
 	}
 	if task.Spec.Transaction != nil {
 		if txRepo := strings.TrimSpace(task.Spec.Transaction.Context["repo"]); txRepo != "" {
@@ -215,43 +261,70 @@ func formatGitHubRepoScopes(scopes []githubRepoScope) string {
 }
 
 func githubTaskWorkspace(task *corev1alpha1.Task) *corev1alpha1.WorkspaceConfig {
-	ws := task.Spec.Workspace
-	if ws == nil && task.Spec.AgentRuntime != nil {
-		ws = task.Spec.AgentRuntime.Workspace
+	if task == nil {
+		return nil
+	}
+	return task.Spec.Workspace
+}
+
+func (c githubTaskContext) credentialRef(
+	taskName, owner, repo string,
+	policy githubCredentialPolicy,
+) (*corev1alpha1.WorkspaceCredentialReference, error) {
+	switch policy {
+	case githubCredentialRead:
+		for _, scope := range c.scopes {
+			if githubRepoMatches(owner, repo, scope.owner, scope.repo) && scope.readCredentialRef != nil {
+				return scope.readCredentialRef, nil
+			}
+		}
+		return nil, nil
+	case githubCredentialForgeMutation:
+		if c.forgeCredentialRef == nil || strings.TrimSpace(c.forgeCredentialRef.Name) == "" {
+			return nil, fmt.Errorf("task %s workspace has no forgeCredentialRef configured", taskName)
+		}
+		return c.forgeCredentialRef, nil
+	default:
+		return nil, fmt.Errorf("unsupported GitHub credential policy %d", policy)
 	}
-	return ws
 }
 
-func resolveGitSecretToken(ctx context.Context, k8sClient client.Client, gitSecretRef *corev1.LocalObjectReference) (string, error) {
-	if gitSecretRef == nil {
+func resolveGitSecretToken(ctx context.Context, k8sClient client.Client, credentialRef *corev1alpha1.WorkspaceCredentialReference) (string, error) {
+	if credentialRef == nil {
 		return "", nil
 	}
+	credentialName := credentialRef.Name
+	if strings.TrimSpace(credentialName) == "" {
+		return "", fmt.Errorf("git credential reference name is required")
+	}
+
 	namespace := githubTaskNamespace(ctx)
 	if tc := GetToolContext(ctx); tc != nil {
 		if tc.AuthorizeSecretRead == nil {
 			if tc.RequireSecretReadAuthorization {
-				return "", fmt.Errorf("git secret %s/%s requires a secret credential authorizer", namespace, gitSecretRef.Name)
+				return "", fmt.Errorf("git secret %s/%s requires a secret credential authorizer", namespace, credentialName)
 			}
-		} else if authzErr := tc.AuthorizeSecretRead(ctx, namespace, gitSecretRef.Name); authzErr != nil {
-			return "", fmt.Errorf("not authorized to read git secret %s/%s: %s", namespace, gitSecretRef.Name, authzErr.Message)
+		} else if authzErr := tc.AuthorizeSecretRead(ctx, namespace, credentialName); authzErr != nil {
+			return "", fmt.Errorf("not authorized to read git secret %s/%s: %s", namespace, credentialName, authzErr.Message)
 		}
 	}
+
 	var secret corev1.Secret
-	if err := k8sClient.Get(ctx, types.NamespacedName{Name: gitSecretRef.Name, Namespace: namespace}, &secret); err != nil {
-		return "", fmt.Errorf("failed to get git secret %s: %w", gitSecretRef.Name, err)
+	if err := k8sClient.Get(ctx, types.NamespacedName{Name: credentialName, Namespace: namespace}, &secret); err != nil {
+		return "", fmt.Errorf("failed to get git secret %s: %w", credentialName, err)
 	}
 
-	var token string
-	for _, key := range []string{tokenKey, passwordKey, workerenv.GitHubToken} {
-		if v, ok := secret.Data[key]; ok {
-			token = strings.TrimSpace(string(v))
-			if token != "" {
-				break
-			}
-		}
+	key := credentialRef.Key
+	if key == "" {
+		key = tokenKey
+	}
+	value, ok := secret.Data[key]
+	if !ok {
+		return "", fmt.Errorf("git secret %s does not contain configured key %q", credentialName, key)
 	}
+	token := strings.TrimSpace(string(value))
 	if token == "" {
-		return "", fmt.Errorf("git secret %s does not contain a 'token', 'password', or 'GITHUB_TOKEN' key", gitSecretRef.Name)
+		return "", fmt.Errorf("git secret %s contains an empty configured key %q", credentialName, key)
 	}
 
 	return token, nil
diff --git a/internal/tools/github_helpers_test.go b/internal/tools/github_helpers_test.go
index 02b823e77..044832f0c 100644
--- a/internal/tools/github_helpers_test.go
+++ b/internal/tools/github_helpers_test.go
@@ -41,10 +41,10 @@ func (c *countingClient) Get(ctx context.Context, key client.ObjectKey, obj clie
 	return c.Client.Get(ctx, key, obj, opts...)
 }
 
-func TestResolveRepoAndToken_DirectRepoURL_HTTPS(t *testing.T) {
+func TestResolveReadRepoAndToken_DirectRepoURL_HTTPS(t *testing.T) {
 	t.Setenv("GITHUB_TOKEN", testEnvToken)
 
-	owner, repo, token, baseURL, err := resolveRepoAndToken(
+	owner, repo, token, baseURL, err := resolveReadRepoAndToken(
 		context.Background(), nil,
 		"", testMyOrgRepoURL, "",
 	)
@@ -62,10 +62,10 @@ func TestResolveRepoAndToken_DirectRepoURL_HTTPS(t *testing.T) {
 	}
 }
 
-func TestResolveRepoAndToken_DirectRepoURL_SSH(t *testing.T) {
+func TestResolveReadRepoAndToken_DirectRepoURL_SSH(t *testing.T) {
 	t.Setenv("GITHUB_TOKEN", testEnvToken)
 
-	owner, repo, token, _, err := resolveRepoAndToken(
+	owner, repo, token, _, err := resolveReadRepoAndToken(
 		context.Background(), nil,
 		"", "git@github.com:myorg/myrepo.git", "",
 	)
@@ -80,11 +80,11 @@ func TestResolveRepoAndToken_DirectRepoURL_SSH(t *testing.T) {
 	}
 }
 
-func TestResolveRepoAndToken_EnvVarFallback(t *testing.T) {
+func TestResolveReadRepoAndToken_EnvVarFallback(t *testing.T) {
 	t.Setenv("ORKA_GIT_REPO", "https://github.com/envorg/envrepo")
 	t.Setenv("GITHUB_TOKEN", testEnvToken)
 
-	owner, repo, token, _, err := resolveRepoAndToken(
+	owner, repo, token, _, err := resolveReadRepoAndToken(
 		context.Background(), nil,
 		"", "", "",
 	)
@@ -99,7 +99,7 @@ func TestResolveRepoAndToken_EnvVarFallback(t *testing.T) {
 	}
 }
 
-func TestResolveRepoAndToken_TaskName(t *testing.T) {
+func TestResolveReadRepoAndToken_TaskName(t *testing.T) {
 	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
 
 	scheme := runtime.NewScheme()
@@ -110,11 +110,9 @@ func TestResolveRepoAndToken_TaskName(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testMyTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      "https://github.com/taskorg/taskrepo",
-					GitSecretRef: &corev1.LocalObjectReference{Name: testGitCredsSecretName},
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:           "https://github.com/taskorg/taskrepo",
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: testGitCredsSecretName},
 			},
 		},
 	}
@@ -125,7 +123,7 @@ func TestResolveRepoAndToken_TaskName(t *testing.T) {
 
 	k8sClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(task, secret).Build()
 
-	owner, repo, token, baseURL, err := resolveRepoAndToken(
+	owner, repo, token, baseURL, err := resolveReadRepoAndToken(
 		context.Background(), k8sClient, testMyTaskName, "", "",
 	)
 	if err != nil {
@@ -142,25 +140,152 @@ func TestResolveRepoAndToken_TaskName(t *testing.T) {
 	}
 }
 
-func TestResolveRepoAndToken_TaskNameAndRepoURLLoadsTaskOnce(t *testing.T) {
+func TestResolveGitHubCredentials_RoleSeparation(t *testing.T) {
 	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
+	t.Setenv(workerenv.GitHubToken, "environment-token-must-not-be-used")
 
+	const forgeKey = "forge-api-token"
 	scheme := runtime.NewScheme()
 	_ = corev1alpha1.AddToScheme(scheme)
 	_ = corev1.AddToScheme(scheme)
 
 	task := &corev1alpha1.Task{
-		ObjectMeta: metav1.ObjectMeta{Name: testMyTaskName, Namespace: defaultNamespace},
+		ObjectMeta: metav1.ObjectMeta{Name: "role-separated-task", Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      testMyOrgRepoURL,
-					GitSecretRef: &corev1.LocalObjectReference{Name: testGitCredsSecretName},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:                      "https://github.com/source/repository",
+				PublicationGitRepo:           "https://github.com/target/repository",
+				ReadCredentialRef:            &corev1alpha1.WorkspaceCredentialReference{Name: "source-read"},
+				PublicationReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "target-read"},
+				PublicationCredentialRef:     &corev1alpha1.WorkspaceCredentialReference{Name: "target-write"},
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: "forge-api",
+					Key:  forgeKey,
 				},
 			},
 		},
 	}
+	objects := []client.Object{
+		task,
+		&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "source-read", Namespace: defaultNamespace}, Data: map[string][]byte{tokenKey: []byte("source-read-token")}},
+		&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "target-read", Namespace: defaultNamespace}, Data: map[string][]byte{tokenKey: []byte("target-read-token")}},
+		&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "target-write", Namespace: defaultNamespace}, Data: map[string][]byte{tokenKey: []byte("target-write-token")}},
+		&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "forge-api", Namespace: defaultNamespace}, Data: map[string][]byte{
+			tokenKey: []byte("wrong-default-sibling"),
+			forgeKey: []byte("forge-token"),
+		}},
+	}
+	k8sClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(objects...).Build()
+
+	tests := []struct {
+		name    string
+		resolve func() (string, error)
+		want    string
+	}{
+		{
+			name: "source read",
+			resolve: func() (string, error) {
+				_, _, token, _, err := resolveReadRepoAndToken(context.Background(), k8sClient, task.Name, "", "")
+				return token, err
+			},
+			want: "source-read-token",
+		},
+		{
+			name: "publication read",
+			resolve: func() (string, error) {
+				_, _, token, _, err := resolveScopedReadRepoAndToken(
+					context.Background(), k8sClient, task.Name, task.Spec.Workspace.PublicationGitRepo, "",
+				)
+				return token, err
+			},
+			want: "target-read-token",
+		},
+		{
+			name: "source forge mutation",
+			resolve: func() (string, error) {
+				_, _, token, _, err := resolveForgeRepoAndToken(context.Background(), k8sClient, task.Name, "", "")
+				return token, err
+			},
+			want: "forge-token",
+		},
+		{
+			name: "publication forge mutation",
+			resolve: func() (string, error) {
+				_, _, token, _, err := resolveScopedForgeRepoAndToken(
+					context.Background(), k8sClient, task.Name, task.Spec.Workspace.PublicationGitRepo, "",
+				)
+				return token, err
+			},
+			want: "forge-token",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			token, err := tt.resolve()
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if token != tt.want {
+				t.Error("resolved token from the wrong credential role")
+			}
+		})
+	}
+}
+
+func TestResolveForgeRepoAndToken_TaskWithoutForgeCredentialFailsClosed(t *testing.T) {
+	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
+	t.Setenv(workerenv.GitHubToken, "environment-token-must-not-be-used")
+
+	scheme := runtime.NewScheme()
+	_ = corev1alpha1.AddToScheme(scheme)
+	_ = corev1.AddToScheme(scheme)
+
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "no-forge-task", Namespace: defaultNamespace},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent,
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:                  testMyOrgRepoURL,
+				ReadCredentialRef:        &corev1alpha1.WorkspaceCredentialReference{Name: "source-read"},
+				PublicationCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "target-write"},
+			},
+		},
+	}
+	objects := []client.Object{
+		task,
+		&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "source-read", Namespace: defaultNamespace}, Data: map[string][]byte{tokenKey: []byte("source-read-token")}},
+		&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "target-write", Namespace: defaultNamespace}, Data: map[string][]byte{tokenKey: []byte("target-write-token")}},
+	}
+	k8sClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(objects...).Build()
+
+	_, _, _, _, err := resolveForgeRepoAndToken(context.Background(), k8sClient, task.Name, "", "")
+	if err == nil {
+		t.Fatal("expected missing forgeCredentialRef error")
+	}
+	if !contains(err.Error(), "workspace has no forgeCredentialRef configured") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
+func TestResolveReadRepoAndToken_TaskNameAndRepoURLLoadsTaskOnce(t *testing.T) {
+	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
+
+	scheme := runtime.NewScheme()
+	_ = corev1alpha1.AddToScheme(scheme)
+	_ = corev1.AddToScheme(scheme)
+
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: testMyTaskName, Namespace: defaultNamespace},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent,
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:           testMyOrgRepoURL,
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: testGitCredsSecretName},
+			},
+		},
+	}
 	secret := &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{Name: testGitCredsSecretName, Namespace: defaultNamespace},
 		Data:       map[string][]byte{tokenKey: []byte("task-secret-token")},
@@ -170,7 +295,7 @@ func TestResolveRepoAndToken_TaskNameAndRepoURLLoadsTaskOnce(t *testing.T) {
 		Client: fake.NewClientBuilder().WithScheme(scheme).WithObjects(task, secret).Build(),
 	}
 
-	owner, repo, token, _, err := resolveRepoAndToken(
+	owner, repo, token, _, err := resolveReadRepoAndToken(
 		context.Background(), k8sClient, testMyTaskName, testMyOrgRepoURL, "",
 	)
 	if err != nil {
@@ -187,8 +312,9 @@ func TestResolveRepoAndToken_TaskNameAndRepoURLLoadsTaskOnce(t *testing.T) {
 	}
 }
 
-func TestResolveRepoAndToken_TaskName_PasswordKey(t *testing.T) {
+func TestResolveReadRepoAndToken_TaskName_MissingCustomKeyDoesNotUseSiblings(t *testing.T) {
 	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
+	t.Setenv(workerenv.GitHubToken, testEnvToken)
 
 	scheme := runtime.NewScheme()
 	_ = corev1alpha1.AddToScheme(scheme)
@@ -198,81 +324,127 @@ func TestResolveRepoAndToken_TaskName_PasswordKey(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: "pw-task", Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      "https://github.com/pworg/pwrepo",
-					GitSecretRef: &corev1.LocalObjectReference{Name: "git-pw"},
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:           "https://github.com/pworg/pwrepo",
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "git-pw", Key: "github-api-token"},
 			},
 		},
 	}
 	secret := &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{Name: "git-pw", Namespace: defaultNamespace},
-		Data:       map[string][]byte{passwordKey: []byte("pw-token")},
+		Data: map[string][]byte{
+			tokenKey:    []byte("default-sibling-token"),
+			passwordKey: []byte("password-sibling-token"),
+		},
 	}
 
 	k8sClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(task, secret).Build()
 
-	_, _, token, _, err := resolveRepoAndToken(
+	_, _, _, _, err := resolveReadRepoAndToken(
 		context.Background(), k8sClient,
 		"pw-task", "", "",
 	)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
+	if err == nil {
+		t.Fatal("expected configured-key error")
 	}
-	if token != "pw-token" {
-		t.Errorf("got token=%q, want pw-token", token)
+	if !contains(err.Error(), `does not contain configured key "github-api-token"`) {
+		t.Fatalf("unexpected error: %v", err)
 	}
 }
 
-func TestResolveRepoAndToken_TaskName_GitHubTokenKey(t *testing.T) {
+func TestResolveReadRepoAndToken_TaskName_CustomKey(t *testing.T) {
 	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
 
+	const customKey = "github-api-token"
 	scheme := runtime.NewScheme()
 	_ = corev1alpha1.AddToScheme(scheme)
 	_ = corev1.AddToScheme(scheme)
 
 	task := &corev1alpha1.Task{
-		ObjectMeta: metav1.ObjectMeta{Name: "github-token-task", Namespace: defaultNamespace},
+		ObjectMeta: metav1.ObjectMeta{Name: "custom-key-task", Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      "https://github.com/githuborg/githubrepo",
-					GitSecretRef: &corev1.LocalObjectReference{Name: "github-token-secret"},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: "https://github.com/custom/custom",
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: "custom-key-secret",
+					Key:  customKey,
 				},
 			},
 		},
 	}
 	secret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: "github-token-secret", Namespace: defaultNamespace},
+		ObjectMeta: metav1.ObjectMeta{Name: "custom-key-secret", Namespace: defaultNamespace},
 		Data: map[string][]byte{
-			tokenKey:              []byte(" \n"),
-			workerenv.GitHubToken: []byte("github-key-token"),
+			tokenKey:  []byte("wrong-sibling-token"),
+			customKey: []byte("custom-key-token"),
 		},
 	}
 
 	k8sClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(task, secret).Build()
 
-	_, _, token, _, err := resolveRepoAndToken(
+	_, _, token, _, err := resolveReadRepoAndToken(
 		context.Background(), k8sClient,
-		"github-token-task", "", "",
+		"custom-key-task", "", "",
 	)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
-	if token != "github-key-token" {
-		t.Errorf("got token=%q, want github-key-token", token)
+	if token != "custom-key-token" {
+		t.Error("resolved token from the wrong Secret key")
 	}
 }
 
-// TestResolveRepoAndToken_TaskName_ToolContextNamespace pins the namespace
+func TestResolveReadRepoAndToken_TaskName_EmptySelectedKeyDoesNotUseSibling(t *testing.T) {
+	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
+
+	const customKey = "github-api-token"
+	scheme := runtime.NewScheme()
+	_ = corev1alpha1.AddToScheme(scheme)
+	_ = corev1.AddToScheme(scheme)
+
+	task := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{Name: "empty-key-task", Namespace: defaultNamespace},
+		Spec: corev1alpha1.TaskSpec{
+			Type: corev1alpha1.TaskTypeAgent,
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: "https://github.com/empty/empty",
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: "empty-key-secret",
+					Key:  customKey,
+				},
+			},
+		},
+	}
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{Name: "empty-key-secret", Namespace: defaultNamespace},
+		Data: map[string][]byte{
+			tokenKey:  []byte("wrong-sibling-token"),
+			customKey: []byte(" \n"),
+		},
+	}
+
+	k8sClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(task, secret).Build()
+
+	_, _, _, _, err := resolveReadRepoAndToken(
+		context.Background(), k8sClient,
+		"empty-key-task", "", "",
+	)
+	if err == nil {
+		t.Fatal("expected empty configured-key error")
+	}
+	if !contains(err.Error(), `contains an empty configured key "github-api-token"`) {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
+// TestResolveReadRepoAndToken_TaskName_ToolContextNamespace pins the namespace
 // resolution order for the proxy use case: when the controller process runs
 // create_pull_request server-side, it has no per-request env vars, so the
 // helper must read namespace from ToolContext (set by the proxy from the
 // request context). Falling back to ORKA_TASK_NAMESPACE / "default" silently
 // resolved the wrong Task and broke the chat-to-PR demo after every retry.
-func TestResolveRepoAndToken_TaskName_ToolContextNamespace(t *testing.T) {
+func TestResolveReadRepoAndToken_TaskName_ToolContextNamespace(t *testing.T) {
 	// Intentionally point env var at the wrong namespace to prove ToolContext wins.
 	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
 	t.Setenv("GITHUB_TOKEN", "")
@@ -287,11 +459,9 @@ func TestResolveRepoAndToken_TaskName_ToolContextNamespace(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: "proxy-task", Namespace: proxyNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      "https://github.com/proxorg/proxyrepo",
-					GitSecretRef: &corev1.LocalObjectReference{Name: "proxy-creds"},
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:           "https://github.com/proxorg/proxyrepo",
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "proxy-creds"},
 			},
 		},
 	}
@@ -304,7 +474,7 @@ func TestResolveRepoAndToken_TaskName_ToolContextNamespace(t *testing.T) {
 
 	ctx := WithToolContext(context.Background(), &ToolContext{Namespace: proxyNamespace})
 
-	owner, repo, token, _, err := resolveRepoAndToken(
+	owner, repo, token, _, err := resolveReadRepoAndToken(
 		ctx, k8sClient, "proxy-task", "", "",
 	)
 	if err != nil {
@@ -318,7 +488,7 @@ func TestResolveRepoAndToken_TaskName_ToolContextNamespace(t *testing.T) {
 	}
 }
 
-func TestResolveRepoAndToken_TokenFromFile(t *testing.T) {
+func TestResolveReadRepoAndToken_TokenFromFile(t *testing.T) {
 	// Create a temp directory to simulate /secrets/git/token
 	tmpDir := t.TempDir()
 	tokenFile := filepath.Join(tmpDir, tokenKey)
@@ -336,10 +506,10 @@ func TestResolveRepoAndToken_TokenFromFile(t *testing.T) {
 	}
 }
 
-func TestResolveRepoAndToken_TokenFromEnvVar(t *testing.T) {
+func TestResolveReadRepoAndToken_TokenFromEnvVar(t *testing.T) {
 	t.Setenv("GITHUB_TOKEN", "my-gh-token")
 
-	owner, repo, token, _, err := resolveRepoAndToken(
+	owner, repo, token, _, err := resolveReadRepoAndToken(
 		context.Background(), nil,
 		"", testOrgTestRepoURL, "",
 	)
@@ -354,10 +524,10 @@ func TestResolveRepoAndToken_TokenFromEnvVar(t *testing.T) {
 	}
 }
 
-func TestResolveRepoAndToken_BaseURLOverride(t *testing.T) {
+func TestResolveReadRepoAndToken_BaseURLOverride(t *testing.T) {
 	t.Setenv("GITHUB_TOKEN", "tok")
 
-	_, _, _, baseURL, err := resolveRepoAndToken(
+	_, _, _, baseURL, err := resolveReadRepoAndToken(
 		context.Background(), nil,
 		"", "https://github.com/o/r", "http://localhost:8080",
 	)
@@ -369,11 +539,11 @@ func TestResolveRepoAndToken_BaseURLOverride(t *testing.T) {
 	}
 }
 
-func TestResolveRepoAndToken_ErrorNoRepoURL(t *testing.T) {
+func TestResolveReadRepoAndToken_ErrorNoRepoURL(t *testing.T) {
 	// Ensure ORKA_GIT_REPO is not set
 	t.Setenv("ORKA_GIT_REPO", "")
 
-	_, _, _, _, err := resolveRepoAndToken(
+	_, _, _, _, err := resolveReadRepoAndToken(
 		context.Background(), nil,
 		"", "", "",
 	)
@@ -385,10 +555,10 @@ func TestResolveRepoAndToken_ErrorNoRepoURL(t *testing.T) {
 	}
 }
 
-func TestResolveRepoAndToken_ErrorInvalidURL(t *testing.T) {
+func TestResolveReadRepoAndToken_ErrorInvalidURL(t *testing.T) {
 	t.Setenv("GITHUB_TOKEN", "tok")
 
-	_, _, _, _, err := resolveRepoAndToken(
+	_, _, _, _, err := resolveReadRepoAndToken(
 		context.Background(), nil,
 		"", "not-a-valid-url", "",
 	)
@@ -400,7 +570,7 @@ func TestResolveRepoAndToken_ErrorInvalidURL(t *testing.T) {
 	}
 }
 
-func TestResolveRepoAndToken_ErrorTaskNotFound(t *testing.T) {
+func TestResolveReadRepoAndToken_ErrorTaskNotFound(t *testing.T) {
 	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
 
 	scheme := runtime.NewScheme()
@@ -409,7 +579,7 @@ func TestResolveRepoAndToken_ErrorTaskNotFound(t *testing.T) {
 
 	k8sClient := fake.NewClientBuilder().WithScheme(scheme).Build()
 
-	_, _, _, _, err := resolveRepoAndToken(
+	_, _, _, _, err := resolveReadRepoAndToken(
 		context.Background(), k8sClient,
 		"nonexistent-task", "", "",
 	)
@@ -421,11 +591,11 @@ func TestResolveRepoAndToken_ErrorTaskNotFound(t *testing.T) {
 	}
 }
 
-func TestResolveRepoAndToken_ErrorNoToken(t *testing.T) {
+func TestResolveReadRepoAndToken_ErrorNoToken(t *testing.T) {
 	// Clear all token sources
 	t.Setenv("GITHUB_TOKEN", "")
 
-	_, _, _, _, err := resolveRepoAndToken(
+	_, _, _, _, err := resolveReadRepoAndToken(
 		context.Background(), nil,
 		"", "https://github.com/o/r", "",
 	)
@@ -437,7 +607,7 @@ func TestResolveRepoAndToken_ErrorNoToken(t *testing.T) {
 	}
 }
 
-func TestResolveRepoAndToken_ErrorTaskNoWorkspace(t *testing.T) {
+func TestResolveReadRepoAndToken_ErrorTaskNoWorkspace(t *testing.T) {
 	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
 
 	scheme := runtime.NewScheme()
@@ -453,7 +623,7 @@ func TestResolveRepoAndToken_ErrorTaskNoWorkspace(t *testing.T) {
 
 	k8sClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(task).Build()
 
-	_, _, _, _, err := resolveRepoAndToken(
+	_, _, _, _, err := resolveReadRepoAndToken(
 		context.Background(), k8sClient, testNoWorkspaceTaskName, "", "",
 	)
 	if err == nil {
@@ -464,7 +634,7 @@ func TestResolveRepoAndToken_ErrorTaskNoWorkspace(t *testing.T) {
 	}
 }
 
-func TestResolveRepoAndToken_TaskWithoutGitSecretRefFallsBackToEnvToken(t *testing.T) {
+func TestResolveReadRepoAndToken_TaskWithoutGitSecretRefFallsBackToEnvToken(t *testing.T) {
 	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
 	t.Setenv("GITHUB_TOKEN", testEnvToken)
 
@@ -476,17 +646,15 @@ func TestResolveRepoAndToken_TaskWithoutGitSecretRefFallsBackToEnvToken(t *testi
 		ObjectMeta: metav1.ObjectMeta{Name: "no-secret-task", Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: testOrgRepoURL,
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: testOrgRepoURL,
 			},
 		},
 	}
 
 	k8sClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(task).Build()
 
-	owner, repo, token, _, err := resolveRepoAndToken(
+	owner, repo, token, _, err := resolveReadRepoAndToken(
 		context.Background(), k8sClient,
 		"no-secret-task", "", "",
 	)
@@ -501,7 +669,7 @@ func TestResolveRepoAndToken_TaskWithoutGitSecretRefFallsBackToEnvToken(t *testi
 	}
 }
 
-func TestResolveRepoAndToken_RepoURLMatchingTaskNameUsesTaskToken(t *testing.T) {
+func TestResolveReadRepoAndToken_RepoURLMatchingTaskNameUsesTaskToken(t *testing.T) {
 	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
 
 	scheme := runtime.NewScheme()
@@ -512,11 +680,9 @@ func TestResolveRepoAndToken_RepoURLMatchingTaskNameUsesTaskToken(t *testing.T)
 		ObjectMeta: metav1.ObjectMeta{Name: "some-task", Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      "https://github.com/task-org/task-repo",
-					GitSecretRef: &corev1.LocalObjectReference{Name: testGitCredsSecretName},
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:           "https://github.com/task-org/task-repo",
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: testGitCredsSecretName},
 			},
 		},
 	}
@@ -526,7 +692,7 @@ func TestResolveRepoAndToken_RepoURLMatchingTaskNameUsesTaskToken(t *testing.T)
 	}
 	k8sClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(task, secret).Build()
 
-	owner, repo, token, _, err := resolveRepoAndToken(
+	owner, repo, token, _, err := resolveReadRepoAndToken(
 		context.Background(), k8sClient,
 		"some-task", "https://github.com/task-org/task-repo", "",
 	)
@@ -541,7 +707,7 @@ func TestResolveRepoAndToken_RepoURLMatchingTaskNameUsesTaskToken(t *testing.T)
 	}
 }
 
-func TestResolveRepoAndToken_RepoURLMismatchRejectsTaskToken(t *testing.T) {
+func TestResolveReadRepoAndToken_RepoURLMismatchRejectsTaskToken(t *testing.T) {
 	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
 
 	scheme := runtime.NewScheme()
@@ -552,11 +718,9 @@ func TestResolveRepoAndToken_RepoURLMismatchRejectsTaskToken(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: "some-task", Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      "https://github.com/task-org/task-repo",
-					GitSecretRef: &corev1.LocalObjectReference{Name: testGitCredsSecretName},
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:           "https://github.com/task-org/task-repo",
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: testGitCredsSecretName},
 			},
 		},
 	}
@@ -566,7 +730,7 @@ func TestResolveRepoAndToken_RepoURLMismatchRejectsTaskToken(t *testing.T) {
 	}
 	k8sClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(task, secret).Build()
 
-	_, _, _, _, err := resolveRepoAndToken(
+	_, _, _, _, err := resolveReadRepoAndToken(
 		context.Background(), k8sClient,
 		"some-task", "https://github.com/url-org/url-repo", "",
 	)
@@ -578,7 +742,7 @@ func TestResolveRepoAndToken_RepoURLMismatchRejectsTaskToken(t *testing.T) {
 	}
 }
 
-func TestResolveRepoAndToken_RepoURLWithMissingTaskFailsClosed(t *testing.T) {
+func TestResolveReadRepoAndToken_RepoURLWithMissingTaskFailsClosed(t *testing.T) {
 	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
 	t.Setenv("GITHUB_TOKEN", testEnvToken)
 
@@ -587,7 +751,7 @@ func TestResolveRepoAndToken_RepoURLWithMissingTaskFailsClosed(t *testing.T) {
 	_ = corev1.AddToScheme(scheme)
 	k8sClient := fake.NewClientBuilder().WithScheme(scheme).Build()
 
-	_, _, _, _, err := resolveRepoAndToken(
+	_, _, _, _, err := resolveReadRepoAndToken(
 		context.Background(), k8sClient,
 		"nonexistent-task", "https://github.com/url-org/url-repo", "",
 	)
diff --git a/internal/tools/integration_test.go b/internal/tools/integration_test.go
index cbc127723..0f077b30f 100644
--- a/internal/tools/integration_test.go
+++ b/internal/tools/integration_test.go
@@ -56,12 +56,13 @@ func buildIntegrationObjects(token string) (*corev1alpha1.Task, *corev1.Secret)
 			Namespace: defaultNamespace,
 		},
 		Spec: corev1alpha1.TaskSpec{
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: integrationRepo,
-					GitSecretRef: &corev1.LocalObjectReference{
-						Name: integrationSecretName,
-					},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: integrationRepo,
+				PublicationCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: integrationSecretName,
+				},
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: integrationSecretName,
 				},
 			},
 		},
diff --git a/internal/tools/list_issues.go b/internal/tools/list_issues.go
index b6d7b5d3a..41dba59bf 100644
--- a/internal/tools/list_issues.go
+++ b/internal/tools/list_issues.go
@@ -93,7 +93,7 @@ func (t *ListIssuesTool) Execute(ctx context.Context, argsJSON json.RawMessage)
 	}
 
 	// Resolve repo and token using the shared helper
-	owner, repo, token, baseURL, err := resolveRepoAndToken(ctx, t.k8sClient, args.TaskName, args.RepoURL, t.apiBaseURL)
+	owner, repo, token, baseURL, err := resolveReadRepoAndToken(ctx, t.k8sClient, args.TaskName, args.RepoURL, t.apiBaseURL)
 	if err != nil {
 		return "", err
 	}
diff --git a/internal/tools/list_issues_test.go b/internal/tools/list_issues_test.go
index fe69a082a..71f27fb98 100644
--- a/internal/tools/list_issues_test.go
+++ b/internal/tools/list_issues_test.go
@@ -85,15 +85,18 @@ func TestListIssuesTool_DefaultUnassigned(t *testing.T) {
 	}))
 	defer server.Close()
 
-	t.Setenv("GITHUB_TOKEN", testGitHubToken)
+	t.Setenv("GITHUB_TOKEN", "")
+	task, secret := githubRepoTaskWithSecret(testOrgTestRepoURL)
+	task.Spec.Workspace.ForgeCredentialRef = nil
 
 	tool := &ListIssuesTool{
-		k8sClient:  newFakeClient(),
+		k8sClient:  newFakeClient(task, secret),
 		apiBaseURL: server.URL,
 	}
 
 	args, _ := json.Marshal(ListIssuesArgs{
-		RepoURL: testOrgTestRepoURL,
+		TaskName: testCoderTaskName,
+		RepoURL:  testOrgTestRepoURL,
 	})
 
 	result, err := tool.Execute(context.Background(), args)
diff --git a/internal/tools/list_pull_requests.go b/internal/tools/list_pull_requests.go
index 5cbb8eb8e..4e1b7e2d5 100644
--- a/internal/tools/list_pull_requests.go
+++ b/internal/tools/list_pull_requests.go
@@ -95,7 +95,7 @@ func (t *ListPullRequestsTool) Execute(ctx context.Context, argsJSON json.RawMes
 		args.Page = 1
 	}
 
-	owner, repo, token, baseURL, err := resolveScopedRepoAndToken(ctx, t.k8sClient, args.TaskName, args.RepoURL, t.apiBaseURL)
+	owner, repo, token, baseURL, err := resolveScopedReadRepoAndToken(ctx, t.k8sClient, args.TaskName, args.RepoURL, t.apiBaseURL)
 	if err != nil {
 		return "", err
 	}
diff --git a/internal/tools/list_pull_requests_test.go b/internal/tools/list_pull_requests_test.go
index 18fb3e981..ea74b624b 100644
--- a/internal/tools/list_pull_requests_test.go
+++ b/internal/tools/list_pull_requests_test.go
@@ -361,6 +361,7 @@ func TestListPullRequestsTool_WithRepoURL(t *testing.T) {
 	defer server.Close()
 
 	task, secret := githubRepoTaskWithSecret(testMyOrgRepoURL)
+	task.Spec.Workspace.ForgeCredentialRef = nil
 	tool := &ListPullRequestsTool{k8sClient: newFakeClient(task, secret), apiBaseURL: server.URL}
 	ctx := contextWithTaskScope()
 
@@ -468,13 +469,11 @@ func TestListPullRequestsTool_WithTaskName(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: testSozercanAynaRepoURL,
-					Branch:  testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{
-						Name: testGitCredsSecretName,
-					},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: testSozercanAynaRepoURL,
+				Branch:  testBranch,
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: testGitCredsSecretName,
 				},
 			},
 		},
diff --git a/internal/tools/memory_tools.go b/internal/tools/memory_tools.go
index 2e509fc10..bb4805fa8 100644
--- a/internal/tools/memory_tools.go
+++ b/internal/tools/memory_tools.go
@@ -18,6 +18,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/orka-agents/orka/internal/store"
 	"github.com/orka-agents/orka/internal/workerenv"
 )
 
@@ -100,11 +101,34 @@ func (t *RecallMemoryTool) Execute(ctx context.Context, args json.RawMessage) (s
 		return "", fmt.Errorf("limit must be non-negative")
 	}
 
-	cfg, err := loadInternalControllerConfig()
+	cfg, toolCtx, err := memoryToolExecutionConfig(ctx)
 	if err != nil {
 		return "", err
 	}
 
+	if toolCtx != nil {
+		if toolCtx.MemoryReader == nil {
+			return "", fmt.Errorf("brokered memory reader is not configured")
+		}
+		memories, readErr := toolCtx.MemoryReader.ListMemories(ctx, store.MemoryFilter{
+			Namespace:       cfg.Namespace,
+			Query:           strings.TrimSpace(a.Query),
+			Tags:            append([]string(nil), a.Tags...),
+			TaskName:        firstNonEmpty(a.TaskName, a.TaskNameCamel),
+			AgentName:       firstNonEmpty(a.AgentName, a.AgentNameCamel),
+			Source:          strings.TrimSpace(a.Source),
+			Limit:           a.Limit,
+			IncludeDisabled: a.IncludeDisabled || a.IncludeDisabledCamel,
+		})
+		if readErr != nil {
+			return "", fmt.Errorf("failed to recall memory: %w", readErr)
+		}
+		if memories == nil {
+			memories = []store.Memory{}
+		}
+		return marshalMemoryToolResult(memories)
+	}
+
 	values := url.Values{}
 	addQueryValue(values, "query", a.Query)
 	if len(a.Tags) > 0 {
@@ -218,7 +242,7 @@ func (t *ProposeMemoryTool) Execute(ctx context.Context, args json.RawMessage) (
 		return "", fmt.Errorf("title is required")
 	}
 
-	cfg, err := loadInternalControllerConfig()
+	cfg, toolCtx, err := memoryToolExecutionConfig(ctx)
 	if err != nil {
 		return "", err
 	}
@@ -229,7 +253,7 @@ func (t *ProposeMemoryTool) Execute(ctx context.Context, args json.RawMessage) (
 	}
 	agentName := firstNonEmpty(a.AgentName, a.AgentNameCamel, cfg.AgentName)
 
-	payload, err := json.Marshal(proposeMemoryPayload{
+	payload := proposeMemoryPayload{
 		Namespace:   cfg.Namespace,
 		TaskName:    cfg.TaskName,
 		AgentName:   agentName,
@@ -239,13 +263,8 @@ func (t *ProposeMemoryTool) Execute(ctx context.Context, args json.RawMessage) (
 		Description: strings.TrimSpace(a.Description),
 		Content:     strings.TrimSpace(a.Content),
 		Patch:       strings.TrimSpace(a.Patch),
-	})
-	if err != nil {
-		return "", fmt.Errorf("failed to marshal memory proposal: %w", err)
 	}
-
-	endpoint := cfg.url("/internal/v1/memory-proposals/"+url.PathEscape(cfg.Namespace), nil)
-	body, err := doInternalControllerRequest(ctx, cfg, http.MethodPost, endpoint, payload)
+	body, err := submitMemoryProposal(ctx, cfg, toolCtx, payload)
 	if err != nil {
 		return "", fmt.Errorf("failed to propose memory: %w", err)
 	}
@@ -323,7 +342,7 @@ func (t *RememberMemoryTool) Execute(ctx context.Context, args json.RawMessage)
 		return "", fmt.Errorf("content is required")
 	}
 
-	cfg, err := loadInternalControllerConfig()
+	cfg, toolCtx, err := memoryToolExecutionConfig(ctx)
 	if err != nil {
 		return "", err
 	}
@@ -335,7 +354,7 @@ func (t *RememberMemoryTool) Execute(ctx context.Context, args json.RawMessage)
 	agentName := firstNonEmpty(a.AgentName, a.AgentNameCamel, cfg.AgentName)
 	description := appendRememberTags(strings.TrimSpace(a.Description), a.Tags)
 
-	payload, err := json.Marshal(proposeMemoryPayload{
+	payload := proposeMemoryPayload{
 		Namespace:   cfg.Namespace,
 		TaskName:    cfg.TaskName,
 		AgentName:   agentName,
@@ -343,13 +362,8 @@ func (t *RememberMemoryTool) Execute(ctx context.Context, args json.RawMessage)
 		Title:       title,
 		Description: description,
 		Content:     content,
-	})
-	if err != nil {
-		return "", fmt.Errorf("failed to marshal memory proposal: %w", err)
 	}
-
-	endpoint := cfg.url("/internal/v1/memory-proposals/"+url.PathEscape(cfg.Namespace), nil)
-	body, err := doInternalControllerRequest(ctx, cfg, http.MethodPost, endpoint, payload)
+	body, err := submitMemoryProposal(ctx, cfg, toolCtx, payload)
 	if err != nil {
 		return "", fmt.Errorf("failed to remember: %w", err)
 	}
@@ -469,7 +483,7 @@ func (t *SearchTranscriptTool) Execute(ctx context.Context, args json.RawMessage
 		return "", fmt.Errorf("max_snippet_length must be non-negative")
 	}
 
-	cfg, err := loadInternalControllerConfig()
+	cfg, toolCtx, err := memoryToolExecutionConfig(ctx)
 	if err != nil {
 		return "", err
 	}
@@ -479,6 +493,28 @@ func (t *SearchTranscriptTool) Execute(ctx context.Context, args json.RawMessage
 		excludeSessionName = cfg.TaskName
 	}
 
+	if toolCtx != nil {
+		if toolCtx.TranscriptSearcher == nil {
+			return "", fmt.Errorf("brokered transcript searcher is not configured")
+		}
+		results, searchErr := toolCtx.TranscriptSearcher.SearchTranscript(ctx, store.TranscriptSearchFilter{
+			Namespace:          cfg.Namespace,
+			Query:              query,
+			SessionName:        firstNonEmpty(a.SessionName, a.SessionNameCamel),
+			ExcludeSessionName: excludeSessionName,
+			Roles:              append([]string(nil), a.Roles...),
+			Limit:              a.Limit,
+			MaxSnippetLength:   maxSnippetLength,
+		})
+		if searchErr != nil {
+			return "", fmt.Errorf("failed to search transcript: %w", searchErr)
+		}
+		if results == nil {
+			results = []store.TranscriptSearchResult{}
+		}
+		return marshalMemoryToolResult(results)
+	}
+
 	values := url.Values{}
 	values.Set("query", query)
 	addQueryValue(values, "sessionName", firstNonEmpty(a.SessionName, a.SessionNameCamel))
@@ -540,6 +576,60 @@ func (l *memoryToolStringList) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
+func memoryToolExecutionConfig(ctx context.Context) (internalControllerConfig, *ToolContext, error) {
+	toolCtx := GetToolContext(ctx)
+	if toolCtx == nil || !toolCtx.Brokered {
+		cfg, err := loadInternalControllerConfig()
+		return cfg, nil, err
+	}
+	cfg := internalControllerConfig{
+		Namespace: strings.TrimSpace(toolCtx.Namespace),
+		TaskName:  strings.TrimSpace(toolCtx.TaskID),
+		AgentName: strings.TrimSpace(toolCtx.AgentName),
+	}
+	if cfg.Namespace == "" || cfg.TaskName == "" {
+		return cfg, toolCtx, fmt.Errorf("brokered memory tools require request-scoped namespace and task name")
+	}
+	return cfg, toolCtx, nil
+}
+
+func submitMemoryProposal(
+	ctx context.Context,
+	cfg internalControllerConfig,
+	toolCtx *ToolContext,
+	payload proposeMemoryPayload,
+) (string, error) {
+	if toolCtx != nil {
+		if toolCtx.MemoryProposalWriter == nil {
+			return "", fmt.Errorf("brokered memory proposal writer is not configured")
+		}
+		proposal := &store.MemoryProposal{
+			Namespace: payload.Namespace, TaskName: payload.TaskName, AgentName: payload.AgentName,
+			Type: payload.Type, SkillName: payload.SkillName, Title: payload.Title,
+			Description: payload.Description, Content: payload.Content, Patch: payload.Patch,
+		}
+		if err := toolCtx.MemoryProposalWriter.CreateMemoryProposal(ctx, proposal); err != nil {
+			return "", err
+		}
+		return marshalMemoryToolResult(proposal)
+	}
+
+	encoded, err := json.Marshal(payload)
+	if err != nil {
+		return "", fmt.Errorf("failed to marshal memory proposal: %w", err)
+	}
+	endpoint := cfg.url("/internal/v1/memory-proposals/"+url.PathEscape(cfg.Namespace), nil)
+	return doInternalControllerRequest(ctx, cfg, http.MethodPost, endpoint, encoded)
+}
+
+func marshalMemoryToolResult(value any) (string, error) {
+	encoded, err := json.Marshal(value)
+	if err != nil {
+		return "", fmt.Errorf("failed to marshal memory tool result: %w", err)
+	}
+	return string(encoded), nil
+}
+
 type internalControllerConfig struct {
 	ControllerURL string
 	Namespace     string
diff --git a/internal/tools/merge_pull_request.go b/internal/tools/merge_pull_request.go
index 499a0e116..7e4afbeb4 100644
--- a/internal/tools/merge_pull_request.go
+++ b/internal/tools/merge_pull_request.go
@@ -126,25 +126,15 @@ func (t *MergePullRequestTool) Execute(ctx context.Context, argsJSON json.RawMes
 		return "", fmt.Errorf("failed to parse GitHub repo from %s: %w", repoURL, err)
 	}
 
-	// Get the git token from the referenced secret
-	if ws.GitSecretRef == nil {
-		return "", fmt.Errorf("task %s workspace has no gitSecretRef configured", args.TaskName)
+	// Forge API operations must use the forge credential, not the repository
+	// publication credential used for Git pushes.
+	if ws.ForgeCredentialRef == nil {
+		return "", fmt.Errorf("task %s workspace has no forgeCredentialRef configured", args.TaskName)
 	}
 
-	var secret corev1.Secret
-	if err := t.k8sClient.Get(ctx, types.NamespacedName{Name: ws.GitSecretRef.Name, Namespace: ns}, &secret); err != nil {
-		return "", fmt.Errorf("failed to get git secret %s: %w", ws.GitSecretRef.Name, err)
-	}
-
-	token := ""
-	for _, key := range []string{tokenKey, passwordKey} {
-		if v, ok := secret.Data[key]; ok {
-			token = strings.TrimSpace(string(v))
-			break
-		}
-	}
-	if token == "" {
-		return "", fmt.Errorf("git secret %s does not contain a 'token' or 'password' key", ws.GitSecretRef.Name)
+	token, err := resolveForgeCredentialToken(ctx, t.k8sClient, ns, ws.ForgeCredentialRef)
+	if err != nil {
+		return "", err
 	}
 
 	baseURL := githubAPIBaseURL
@@ -190,6 +180,46 @@ func (t *MergePullRequestTool) Execute(ctx context.Context, argsJSON json.RawMes
 	return string(resultJSON), nil
 }
 
+func resolveForgeCredentialToken(
+	ctx context.Context,
+	k8sClient client.Client,
+	namespace string,
+	credentialRef *corev1alpha1.WorkspaceCredentialReference,
+) (string, error) {
+	if credentialRef == nil {
+		return "", fmt.Errorf("forgeCredentialRef is required")
+	}
+
+	if tc := GetToolContext(ctx); tc != nil {
+		if tc.AuthorizeSecretRead == nil {
+			if tc.RequireSecretReadAuthorization {
+				return "", fmt.Errorf("forge credential secret %s/%s requires a secret credential authorizer", namespace, credentialRef.Name)
+			}
+		} else if authzErr := tc.AuthorizeSecretRead(ctx, namespace, credentialRef.Name); authzErr != nil {
+			return "", fmt.Errorf("not authorized to read forge credential secret %s/%s: %s", namespace, credentialRef.Name, authzErr.Message)
+		}
+	}
+
+	var secret corev1.Secret
+	if err := k8sClient.Get(ctx, types.NamespacedName{Name: credentialRef.Name, Namespace: namespace}, &secret); err != nil {
+		return "", fmt.Errorf("failed to get forge credential secret %s: %w", credentialRef.Name, err)
+	}
+
+	key := strings.TrimSpace(credentialRef.Key)
+	if key == "" {
+		key = tokenKey
+	}
+	value, ok := secret.Data[key]
+	if !ok {
+		return "", fmt.Errorf("forge credential secret %s does not contain configured key %q", credentialRef.Name, key)
+	}
+	token := strings.TrimSpace(string(value))
+	if token == "" {
+		return "", fmt.Errorf("forge credential secret %s contains an empty configured key %q", credentialRef.Name, key)
+	}
+	return token, nil
+}
+
 // getGitHubPRHeadSHA retrieves the head SHA for a pull request.
 func getGitHubPRHeadSHA(ctx context.Context, token, owner, repo string, prNumber int, baseURL string) (string, error) {
 	url := fmt.Sprintf("%s/repos/%s/%s/pulls/%d", baseURL, owner, repo, prNumber)
diff --git a/internal/tools/merge_pull_request_test.go b/internal/tools/merge_pull_request_test.go
index 46d29b36e..217139e8c 100644
--- a/internal/tools/merge_pull_request_test.go
+++ b/internal/tools/merge_pull_request_test.go
@@ -92,13 +92,11 @@ func TestMergePullRequestTool_MissingSecret(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: testSozercanAynaRepoURL,
-					Branch:  testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{
-						Name: testGitCredsSecretName,
-					},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: testSozercanAynaRepoURL,
+				Branch:  testBranch,
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: testGitCredsSecretName,
 				},
 			},
 		},
@@ -118,7 +116,7 @@ func TestMergePullRequestTool_MissingSecret(t *testing.T) {
 	if err == nil {
 		t.Fatal("expected error for missing secret")
 	}
-	if got := err.Error(); !strings.Contains(got, "failed to get git secret") {
+	if got := err.Error(); !strings.Contains(got, "failed to get forge credential secret") {
 		t.Errorf("unexpected error: %s", got)
 	}
 }
@@ -150,13 +148,11 @@ func TestMergePullRequestTool_CIChecksFailed(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: testSozercanAynaRepoURL,
-					Branch:  testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{
-						Name: testGitCredsSecretName,
-					},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: testSozercanAynaRepoURL,
+				Branch:  testBranch,
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: testGitCredsSecretName,
 				},
 			},
 		},
@@ -204,7 +200,7 @@ func TestMergePullRequestTool_Success(t *testing.T) {
 	// Mock GitHub API
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if auth := r.Header.Get("Authorization"); auth != testBearerToken {
-			t.Errorf("unexpected auth header: %s", auth)
+			t.Error("request did not use the expected forge credential")
 		}
 
 		switch {
@@ -243,13 +239,11 @@ func TestMergePullRequestTool_Success(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: testSozercanAynaRepoURL,
-					Branch:  testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{
-						Name: testGitCredsSecretName,
-					},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: testSozercanAynaRepoURL,
+				Branch:  testBranch,
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: testGitCredsSecretName,
 				},
 			},
 		},
@@ -314,13 +308,11 @@ func TestMergePullRequestTool_Execute_APIError(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: testSozercanAynaRepoURL,
-					Branch:  testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{
-						Name: testGitCredsSecretName,
-					},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: testSozercanAynaRepoURL,
+				Branch:  testBranch,
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: testGitCredsSecretName,
 				},
 			},
 		},
@@ -410,13 +402,11 @@ func TestMergePullRequestTool_Execute_DifferentMergeMethods(t *testing.T) {
 				ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 				Spec: corev1alpha1.TaskSpec{
 					Type: corev1alpha1.TaskTypeAgent,
-					AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-						Workspace: &corev1alpha1.WorkspaceConfig{
-							GitRepo: testSozercanAynaRepoURL,
-							Branch:  testBranch,
-							GitSecretRef: &corev1.LocalObjectReference{
-								Name: testGitCredsSecretName,
-							},
+					Workspace: &corev1alpha1.WorkspaceConfig{
+						GitRepo: testSozercanAynaRepoURL,
+						Branch:  testBranch,
+						ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+							Name: testGitCredsSecretName,
 						},
 					},
 				},
@@ -488,13 +478,11 @@ func TestMergePullRequestTool_Execute_PRAlreadyMerged(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: testSozercanAynaRepoURL,
-					Branch:  testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{
-						Name: testGitCredsSecretName,
-					},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: testSozercanAynaRepoURL,
+				Branch:  testBranch,
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: testGitCredsSecretName,
 				},
 			},
 		},
@@ -570,10 +558,8 @@ func TestMergePullRequestTool_NoGitRepo(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					Branch: testBranch,
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				Branch: testBranch,
 			},
 		},
 	}
@@ -597,7 +583,7 @@ func TestMergePullRequestTool_NoGitRepo(t *testing.T) {
 	}
 }
 
-func TestMergePullRequestTool_NoGitSecretRef(t *testing.T) {
+func TestMergePullRequestTool_NoForgeCredentialRef(t *testing.T) {
 	scheme := runtime.NewScheme()
 	_ = corev1alpha1.AddToScheme(scheme)
 	_ = corev1.AddToScheme(scheme)
@@ -606,11 +592,10 @@ func TestMergePullRequestTool_NoGitSecretRef(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: testSozercanAynaRepoURL,
-					Branch:  testBranch,
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:                  testSozercanAynaRepoURL,
+				Branch:                   testBranch,
+				PublicationCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "publication-creds"},
 			},
 		},
 	}
@@ -627,14 +612,14 @@ func TestMergePullRequestTool_NoGitSecretRef(t *testing.T) {
 
 	_, err := tool.Execute(context.Background(), args)
 	if err == nil {
-		t.Fatal("expected error for no gitSecretRef")
+		t.Fatal("expected error for no forgeCredentialRef")
 	}
-	if !strings.Contains(err.Error(), "no gitSecretRef") {
+	if !strings.Contains(err.Error(), "no forgeCredentialRef") {
 		t.Errorf("unexpected error: %s", err.Error())
 	}
 }
 
-func TestMergePullRequestTool_EmptyToken(t *testing.T) {
+func TestMergePullRequestTool_MissingDefaultForgeCredentialKey(t *testing.T) {
 	scheme := runtime.NewScheme()
 	_ = corev1alpha1.AddToScheme(scheme)
 	_ = corev1.AddToScheme(scheme)
@@ -643,12 +628,10 @@ func TestMergePullRequestTool_EmptyToken(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      testSozercanAynaRepoURL,
-					Branch:       testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{Name: testGitCredsSecretName},
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:            testSozercanAynaRepoURL,
+				Branch:             testBranch,
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: testGitCredsSecretName},
 			},
 		},
 	}
@@ -669,15 +652,20 @@ func TestMergePullRequestTool_EmptyToken(t *testing.T) {
 
 	_, err := tool.Execute(context.Background(), args)
 	if err == nil {
-		t.Fatal("expected error for empty token")
+		t.Fatal("expected error for missing default forge credential key")
 	}
-	if !strings.Contains(err.Error(), "does not contain a 'token' or 'password' key") {
+	if !strings.Contains(err.Error(), `does not contain configured key "token"`) {
 		t.Errorf("unexpected error: %s", err.Error())
 	}
 }
 
-func TestMergePullRequestTool_PasswordKey(t *testing.T) {
+func TestMergePullRequestTool_CustomForgeCredentialKey(t *testing.T) {
+	const customForgeKey = "github-api-token"
+
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if auth := r.Header.Get("Authorization"); auth != testBearerToken {
+			t.Error("request did not use the expected credential")
+		}
 		switch {
 		case r.Method == http.MethodGet && strings.HasSuffix(r.URL.Path, "/pulls/42"):
 			w.WriteHeader(200)
@@ -702,21 +690,24 @@ func TestMergePullRequestTool_PasswordKey(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      testSozercanAynaRepoURL,
-					Branch:       testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{Name: testGitCredsSecretName},
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:                  testSozercanAynaRepoURL,
+				Branch:                   testBranch,
+				PublicationCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: "publication-creds"},
+				ForgeCredentialRef:       &corev1alpha1.WorkspaceCredentialReference{Name: testGitCredsSecretName, Key: customForgeKey},
 			},
 		},
 	}
 	secret := &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{Name: testGitCredsSecretName, Namespace: defaultNamespace},
-		Data:       map[string][]byte{passwordKey: []byte("my-password")},
+		Data:       map[string][]byte{customForgeKey: []byte(testGitHubToken)},
+	}
+	publicationSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{Name: "publication-creds", Namespace: defaultNamespace},
+		Data:       map[string][]byte{tokenKey: []byte("decoy")},
 	}
 
-	k8sClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(task, secret).Build()
+	k8sClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(task, secret, publicationSecret).Build()
 	tool := &MergePullRequestTool{k8sClient: k8sClient, apiBaseURL: server.URL}
 
 	t.Setenv(envOrkaTaskNamespace, defaultNamespace)
diff --git a/internal/tools/opencode_model_validation.go b/internal/tools/opencode_model_validation.go
new file mode 100644
index 000000000..817826370
--- /dev/null
+++ b/internal/tools/opencode_model_validation.go
@@ -0,0 +1,101 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package tools
+
+import (
+	"fmt"
+	"strings"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+)
+
+const legacyDefaultOpenCodeTemperature = 0.7
+
+// openCodeModelSpecError is a fail-closed OpenCode model validation failure.
+// message is the caller-visible error text; hint is remediation guidance for
+// chat-tool surfaces.
+type openCodeModelSpecError struct {
+	message string
+	hint    string
+}
+
+func (e *openCodeModelSpecError) Error() string { return e.message }
+
+// validateOpenCodeModelSpec applies the fail-closed OpenCode model rules
+// shared by the create-agent and chat-create-agent surfaces: substitution
+// braces are rejected, the model must resolve to literal provider/model form,
+// an explicit provider hint must match the provider embedded in model.name,
+// temperature may only be the legacy default, fallbacks are unsupported, and
+// contextWindow/maxTokens must be positive with contextWindow exceeding
+// maxTokens. On success it returns the resolved providerID and modelID.
+func validateOpenCodeModelSpec(model *corev1alpha1.ModelConfig) (string, string, *openCodeModelSpecError) {
+	if model == nil || strings.TrimSpace(model.Name) == "" {
+		return "", "", &openCodeModelSpecError{
+			message: "model.name is required for opencode runtime",
+			hint:    "Set model.name to a literal provider/model ID such as openai/gpt-5.4.",
+		}
+	}
+	requested := strings.TrimSpace(model.Name)
+	providerHint := strings.Trim(strings.TrimSpace(model.Provider), "/")
+	if strings.ContainsAny(requested, "{}") || strings.ContainsAny(providerHint, "{}") {
+		return "", "", &openCodeModelSpecError{
+			message: "model.name for opencode runtime must not contain substitution braces",
+			hint:    "Use the literal provider/model ID without OpenCode config substitutions.",
+		}
+	}
+	providerID, modelID, qualified := strings.Cut(requested, "/")
+	if qualified {
+		providerID = strings.TrimSpace(providerID)
+		modelID = strings.TrimSpace(modelID)
+		if providerHint != "" && providerHint != providerID {
+			return "", "", &openCodeModelSpecError{
+				message: fmt.Sprintf("model.provider %q does not match provider %q in model.name for opencode runtime", providerHint, providerID),
+				hint:    "Use one provider consistently, or omit model.provider when model.name already uses provider/model form.",
+			}
+		}
+	} else {
+		providerID = providerHint
+		modelID = requested
+	}
+	if providerID == "" || modelID == "" {
+		return "", "", &openCodeModelSpecError{
+			message: "model.name for opencode runtime must use provider/model form",
+			hint:    "Set model.name to a literal provider/model ID such as openai/gpt-5.4.",
+		}
+	}
+	if model.Temperature != nil && *model.Temperature != legacyDefaultOpenCodeTemperature {
+		return "", "", &openCodeModelSpecError{
+			message: fmt.Sprintf("opencode runtime does not support model.temperature values other than the legacy default %.1f", legacyDefaultOpenCodeTemperature),
+			hint:    "Omit model.temperature for OpenCode or use the legacy default 0.7.",
+		}
+	}
+	if len(model.Fallbacks) > 0 {
+		return "", "", &openCodeModelSpecError{
+			message: "opencode runtime does not support model.fallbacks",
+			hint:    "Remove model.fallbacks from the OpenCode Agent.",
+		}
+	}
+	if model.ContextWindow == nil || *model.ContextWindow <= 0 {
+		return "", "", &openCodeModelSpecError{
+			message: "model.contextWindow is required for opencode runtime and must be positive",
+			hint:    "Set model.contextWindow to the reviewed context capacity for the selected model.",
+		}
+	}
+	if model.MaxTokens == nil || *model.MaxTokens <= 0 {
+		return "", "", &openCodeModelSpecError{
+			message: "model.maxTokens is required for opencode runtime and must be positive",
+			hint:    "Set model.maxTokens to the reviewed output limit for the selected model.",
+		}
+	}
+	if *model.ContextWindow <= *model.MaxTokens {
+		return "", "", &openCodeModelSpecError{
+			message: "model.contextWindow must exceed model.maxTokens for opencode runtime",
+			hint:    "Use the reviewed context and output capacities for the selected model.",
+		}
+	}
+	return providerID, modelID, nil
+}
diff --git a/internal/tools/opencode_test_helpers_test.go b/internal/tools/opencode_test_helpers_test.go
new file mode 100644
index 000000000..42905257b
--- /dev/null
+++ b/internal/tools/opencode_test_helpers_test.go
@@ -0,0 +1,15 @@
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package tools
+
+import corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+
+func testOpenCodeModelConfig(name string) *corev1alpha1.ModelConfig {
+	contextWindow := int32(32768)
+	maxTokens := int32(4096)
+	return &corev1alpha1.ModelConfig{Name: name, ContextWindow: &contextWindow, MaxTokens: &maxTokens}
+}
diff --git a/internal/tools/post_review_comment.go b/internal/tools/post_review_comment.go
index 11ae055e6..02865d38d 100644
--- a/internal/tools/post_review_comment.go
+++ b/internal/tools/post_review_comment.go
@@ -113,7 +113,7 @@ func (t *PostReviewCommentTool) Execute(ctx context.Context, argsJSON json.RawMe
 		return "", fmt.Errorf("invalid event value %q: must be APPROVE, REQUEST_CHANGES, or COMMENT", args.Event)
 	}
 
-	owner, repo, token, _, err := resolveScopedRepoAndToken(ctx, t.k8sClient, args.TaskName, args.RepoURL, t.apiBaseURL)
+	owner, repo, token, _, err := resolveScopedForgeRepoAndToken(ctx, t.k8sClient, args.TaskName, args.RepoURL, t.apiBaseURL)
 	if err != nil {
 		return "", err
 	}
diff --git a/internal/tools/post_review_comment_test.go b/internal/tools/post_review_comment_test.go
index 3a7bf270e..d39feb73a 100644
--- a/internal/tools/post_review_comment_test.go
+++ b/internal/tools/post_review_comment_test.go
@@ -114,13 +114,11 @@ func TestPostReviewCommentTool_Success(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: "review-task", Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: testSozercanAynaRepoURL,
-					Branch:  testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{
-						Name: testGitCredsSecretName,
-					},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: testSozercanAynaRepoURL,
+				Branch:  testBranch,
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: testGitCredsSecretName,
 				},
 			},
 		},
@@ -198,6 +196,7 @@ func TestPostReviewCommentTool_WithRepoURL(t *testing.T) {
 	defer server.Close()
 
 	task, secret := githubRepoTaskWithSecret(testSozercanAynaRepoURL)
+	task.Spec.Workspace.ReadCredentialRef = nil
 	k8sClient := newFakeClient(task, secret)
 	tool := &PostReviewCommentTool{k8sClient: k8sClient, apiBaseURL: server.URL}
 	ctx := contextWithTaskScope()
@@ -276,12 +275,10 @@ func TestPostReviewCommentTool_RejectsRepoURLOutsideTaskWorkspace(t *testing.T)
 		ObjectMeta: metav1.ObjectMeta{Name: "scoped-review-task", Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: testSozercanAynaRepoURL,
-					GitSecretRef: &corev1.LocalObjectReference{
-						Name: testGitCredsSecretName,
-					},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: testSozercanAynaRepoURL,
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: testGitCredsSecretName,
 				},
 			},
 		},
@@ -325,6 +322,7 @@ func TestPostReviewCommentTool_RejectsRepoURLOutsideTaskScope(t *testing.T) {
 	defer server.Close()
 
 	task, secret := githubRepoTaskWithSecret(testSozercanAynaRepoURL)
+	task.Spec.Workspace.ReadCredentialRef = nil
 	k8sClient := newFakeClient(task, secret)
 	tool := &PostReviewCommentTool{k8sClient: k8sClient, apiBaseURL: server.URL}
 
@@ -376,13 +374,11 @@ func TestPostReviewCommentTool_WithoutComments(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: "comment-task", Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: testSozercanAynaRepoURL,
-					Branch:  testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{
-						Name: testGitCredsSecretName,
-					},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: testSozercanAynaRepoURL,
+				Branch:  testBranch,
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: testGitCredsSecretName,
 				},
 			},
 		},
@@ -390,7 +386,7 @@ func TestPostReviewCommentTool_WithoutComments(t *testing.T) {
 
 	secret := &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{Name: testGitCredsSecretName, Namespace: defaultNamespace},
-		Data:       map[string][]byte{passwordKey: []byte("pw-token")},
+		Data:       map[string][]byte{tokenKey: []byte(testGitHubToken)},
 	}
 
 	k8sClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(task, secret).Build()
@@ -519,13 +515,11 @@ func TestPostReviewCommentTool_Execute_MissingSecret(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: "secret-missing-task", Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: testSozercanAynaRepoURL,
-					Branch:  testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{
-						Name: "nonexistent-secret",
-					},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: testSozercanAynaRepoURL,
+				Branch:  testBranch,
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: "nonexistent-secret",
 				},
 			},
 		},
@@ -567,13 +561,11 @@ func TestPostReviewCommentTool_Execute_APIError(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: "api-error-task", Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: testSozercanAynaRepoURL,
-					Branch:  testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{
-						Name: testGitCredsSecretName,
-					},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: testSozercanAynaRepoURL,
+				Branch:  testBranch,
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: testGitCredsSecretName,
 				},
 			},
 		},
@@ -639,13 +631,11 @@ func TestPostReviewCommentTool_Execute_AllEventTypes(t *testing.T) {
 				ObjectMeta: metav1.ObjectMeta{Name: "event-task", Namespace: defaultNamespace},
 				Spec: corev1alpha1.TaskSpec{
 					Type: corev1alpha1.TaskTypeAgent,
-					AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-						Workspace: &corev1alpha1.WorkspaceConfig{
-							GitRepo: testSozercanAynaRepoURL,
-							Branch:  testBranch,
-							GitSecretRef: &corev1.LocalObjectReference{
-								Name: testGitCredsSecretName,
-							},
+					Workspace: &corev1alpha1.WorkspaceConfig{
+						GitRepo: testSozercanAynaRepoURL,
+						Branch:  testBranch,
+						ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+							Name: testGitCredsSecretName,
 						},
 					},
 				},
diff --git a/internal/tools/registry.go b/internal/tools/registry.go
index 8a81de876..623ff906b 100644
--- a/internal/tools/registry.go
+++ b/internal/tools/registry.go
@@ -17,6 +17,7 @@ import (
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
 	"github.com/orka-agents/orka/internal/approvals"
+	"github.com/orka-agents/orka/internal/executionmode"
 	"github.com/orka-agents/orka/internal/llm"
 	"github.com/orka-agents/orka/internal/store"
 	"github.com/orka-agents/orka/internal/tracing"
@@ -29,6 +30,23 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
+// MemoryReader is the least-privilege store dependency required by recall_memory.
+type MemoryReader interface {
+	ListMemories(context.Context, store.MemoryFilter) ([]store.Memory, error)
+}
+
+// MemoryProposalWriter is the least-privilege store dependency required by
+// remember and propose_memory.
+type MemoryProposalWriter interface {
+	CreateMemoryProposal(context.Context, *store.MemoryProposal) error
+}
+
+// TranscriptSearcher is the least-privilege store dependency required by
+// search_transcript.
+type TranscriptSearcher interface {
+	SearchTranscript(context.Context, store.TranscriptSearchFilter) ([]store.TranscriptSearchResult, error)
+}
+
 // ToolContext provides dependencies for tools that need K8s client access or other services.
 type ToolContext struct {
 	Client                    client.Client
@@ -38,12 +56,22 @@ type ToolContext struct {
 	TaskID                    string
 	TaskUID                   string
 	ParentTaskID              string
+	AgentName                 string
 	ToolCallID                string
 	Tenant                    string
 	Provider                  string
 	ProviderType              string
+	ExecutionMode             executionmode.Mode
 	WatchNamespace            string
 	EnforceNamespaceIsolation bool
+	// Brokered marks an authenticated controller-side MCP broker execution.
+	// Broker-aware tools must fail closed on missing request-scoped dependencies
+	// instead of falling back to controller process environment or credentials.
+	Brokered bool
+	// Least-privilege durable dependencies for brokered memory tools.
+	MemoryReader         MemoryReader
+	MemoryProposalWriter MemoryProposalWriter
+	TranscriptSearcher   TranscriptSearcher
 	// ResultStore for fetching task outputs (store.ResultStore)
 	ResultStore interface {
 		GetResult(ctx context.Context, namespace, taskName string) ([]byte, error)
@@ -569,7 +597,7 @@ func RegisterBuiltinTools() {
 }
 
 // RegisterCoordinationTools registers coordination tools that require a K8s client
-func RegisterCoordinationTools(k8sClient client.Client) {
+func RegisterCoordinationTools(k8sClient client.Client, mode executionmode.Mode) {
 	DefaultRegistry.Register(NewDelegateTaskTool(k8sClient))
 	DefaultRegistry.Register(NewWaitForTasksTool(k8sClient))
 	DefaultRegistry.Register(NewCreateContainerTaskTool(k8sClient))
@@ -587,7 +615,7 @@ func RegisterCoordinationTools(k8sClient client.Client) {
 	DefaultRegistry.Register(NewListPullRequestsTool(k8sClient))
 	DefaultRegistry.Register(NewGetIssueTool(k8sClient))
 	DefaultRegistry.Register(NewCommentOnIssueTool(k8sClient))
-	DefaultRegistry.Register(NewCreateAgentTool(k8sClient))
+	DefaultRegistry.Register(NewCreateAgentTool(k8sClient, mode))
 	DefaultRegistry.Register(NewDeleteAgentTool(k8sClient))
 	DefaultRegistry.Register(NewUpdatePlanTool())
 	DefaultRegistry.Register(NewRecallMemoryTool())
@@ -596,6 +624,32 @@ func RegisterCoordinationTools(k8sClient client.Client) {
 	DefaultRegistry.Register(NewSearchTranscriptTool())
 }
 
+// RegisterBrokeredCoordinationTools registers only coordination tools whose
+// implementations can execute safely inside the authenticated controller MCP
+// broker. Registration is idempotent because Registry.Register replaces the
+// implementation for a stable tool name.
+//
+// Do not broaden this list with worker-local tools or tools that obtain forge,
+// repository, or ServiceAccount credentials from process environment. Those
+// implementations are not request-scoped in the controller process.
+func RegisterBrokeredCoordinationTools(r *Registry, k8sClient client.Client) error {
+	if r == nil {
+		return fmt.Errorf("brokered coordination tool registry is required")
+	}
+	if k8sClient == nil {
+		return fmt.Errorf("brokered coordination tools require a Kubernetes client")
+	}
+	r.Register(NewDelegateTaskTool(k8sClient))
+	r.Register(NewWaitForTasksTool(k8sClient))
+	r.Register(NewSendMessageTool())
+	r.Register(NewCheckMessagesTool())
+	r.Register(NewRecallMemoryTool())
+	r.Register(NewRememberMemoryTool())
+	r.Register(NewProposeMemoryTool())
+	r.Register(NewSearchTranscriptTool())
+	return nil
+}
+
 // RegisterChatTools registers the chat/management tools into the given registry.
 func RegisterChatTools(r *Registry) {
 	r.Register(&CreateAITaskTool{})
diff --git a/internal/tools/registry_test.go b/internal/tools/registry_test.go
index 3c2f77a88..c95eaa0fa 100644
--- a/internal/tools/registry_test.go
+++ b/internal/tools/registry_test.go
@@ -12,6 +12,8 @@ import (
 	"reflect"
 	"slices"
 	"testing"
+
+	"github.com/orka-agents/orka/internal/executionmode"
 )
 
 // mockTool is a simple mock tool for testing
@@ -325,7 +327,7 @@ func TestRegisterCoordinationTools(t *testing.T) {
 	defer func() { DefaultRegistry = origRegistry }()
 
 	k8sClient := newFakeClient()
-	RegisterCoordinationTools(k8sClient)
+	RegisterCoordinationTools(k8sClient, executionmode.HarnessV2)
 
 	expectedTools := []string{
 		delegateTaskToolName,
diff --git a/internal/tools/review_pull_request.go b/internal/tools/review_pull_request.go
index aa118358f..f82dde0f0 100644
--- a/internal/tools/review_pull_request.go
+++ b/internal/tools/review_pull_request.go
@@ -91,7 +91,7 @@ func (t *ReviewPullRequestTool) Execute(ctx context.Context, argsJSON json.RawMe
 		return "", fmt.Errorf("pr_number is required")
 	}
 
-	owner, repo, token, baseURL, err := resolveScopedRepoAndToken(ctx, t.k8sClient, args.TaskName, args.RepoURL, t.apiBaseURL)
+	owner, repo, token, baseURL, err := resolveScopedReadRepoAndToken(ctx, t.k8sClient, args.TaskName, args.RepoURL, t.apiBaseURL)
 	if err != nil {
 		return "", err
 	}
diff --git a/internal/tools/review_pull_request_test.go b/internal/tools/review_pull_request_test.go
index 561f40916..847b1de87 100644
--- a/internal/tools/review_pull_request_test.go
+++ b/internal/tools/review_pull_request_test.go
@@ -111,13 +111,11 @@ func TestReviewPullRequestTool_MissingSecret(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: testSozercanAynaRepoURL,
-					Branch:  testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{
-						Name: testGitCredsSecretName,
-					},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: testSozercanAynaRepoURL,
+				Branch:  testBranch,
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: testGitCredsSecretName,
 				},
 			},
 		},
@@ -198,13 +196,11 @@ func TestReviewPullRequestTool_Success(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: testSozercanAynaRepoURL,
-					Branch:  testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{
-						Name: testGitCredsSecretName,
-					},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: testSozercanAynaRepoURL,
+				Branch:  testBranch,
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: testGitCredsSecretName,
 				},
 			},
 		},
@@ -320,6 +316,7 @@ func TestReviewPullRequestTool_WithRepoURL(t *testing.T) {
 	defer server.Close()
 
 	task, secret := githubRepoTaskWithSecret(testSozercanAynaRepoURL)
+	task.Spec.Workspace.ForgeCredentialRef = nil
 	k8sClient := newFakeClient(task, secret)
 	tool := &ReviewPullRequestTool{k8sClient: k8sClient, apiBaseURL: server.URL}
 	ctx := contextWithTaskScope()
@@ -390,6 +387,7 @@ func TestReviewPullRequestTool_RejectsRepoURLOutsideTaskScope(t *testing.T) {
 	defer server.Close()
 
 	task, secret := githubRepoTaskWithSecret(testSozercanAynaRepoURL)
+	task.Spec.Workspace.ForgeCredentialRef = nil
 	k8sClient := newFakeClient(task, secret)
 	tool := &ReviewPullRequestTool{k8sClient: k8sClient, apiBaseURL: server.URL}
 
@@ -428,13 +426,11 @@ func TestReviewPullRequestTool_Execute_APIError(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: testSozercanAynaRepoURL,
-					Branch:  testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{
-						Name: testGitCredsSecretName,
-					},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: testSozercanAynaRepoURL,
+				Branch:  testBranch,
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: testGitCredsSecretName,
 				},
 			},
 		},
@@ -504,13 +500,11 @@ func TestReviewPullRequestTool_Execute_PRNotFound(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: testSozercanAynaRepoURL,
-					Branch:  testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{
-						Name: testGitCredsSecretName,
-					},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: testSozercanAynaRepoURL,
+				Branch:  testBranch,
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: testGitCredsSecretName,
 				},
 			},
 		},
@@ -584,13 +578,11 @@ func TestReviewPullRequestTool_Execute_EmptyDiff(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: testSozercanAynaRepoURL,
-					Branch:  testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{
-						Name: testGitCredsSecretName,
-					},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: testSozercanAynaRepoURL,
+				Branch:  testBranch,
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: testGitCredsSecretName,
 				},
 			},
 		},
@@ -673,10 +665,8 @@ func TestReviewPullRequestTool_NoGitRepo(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					Branch: testBranch,
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				Branch: testBranch,
 			},
 		},
 	}
@@ -729,11 +719,9 @@ func TestReviewPullRequestTool_NoGitSecretRefFallsBackToEnvToken(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo: testSozercanAynaRepoURL,
-					Branch:  testBranch,
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo: testSozercanAynaRepoURL,
+				Branch:  testBranch,
 			},
 		},
 	}
@@ -768,18 +756,16 @@ func TestReviewPullRequestTool_EmptyToken(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      testSozercanAynaRepoURL,
-					Branch:       testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{Name: testGitCredsSecretName},
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:           testSozercanAynaRepoURL,
+				Branch:            testBranch,
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: testGitCredsSecretName},
 			},
 		},
 	}
 	secret := &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{Name: testGitCredsSecretName, Namespace: defaultNamespace},
-		Data:       map[string][]byte{otherSecretKey: []byte("value")},
+		Data:       map[string][]byte{tokenKey: []byte(" \n")},
 	}
 
 	k8sClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(task, secret).Build()
@@ -792,12 +778,12 @@ func TestReviewPullRequestTool_EmptyToken(t *testing.T) {
 	if err == nil {
 		t.Fatal("expected error for empty token")
 	}
-	if !strings.Contains(err.Error(), "does not contain a 'token', 'password', or 'GITHUB_TOKEN' key") {
+	if !strings.Contains(err.Error(), `contains an empty configured key "token"`) {
 		t.Errorf("unexpected error: %s", err.Error())
 	}
 }
 
-func TestReviewPullRequestTool_PasswordKeyFallback(t *testing.T) {
+func TestReviewPullRequestTool_CustomPasswordKey(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		accept := r.Header.Get("Accept")
 		path := r.URL.Path
@@ -826,12 +812,10 @@ func TestReviewPullRequestTool_PasswordKeyFallback(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      testSozercanAynaRepoURL,
-					Branch:       testBranch,
-					GitSecretRef: &corev1.LocalObjectReference{Name: testGitCredsSecretName},
-				},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:           testSozercanAynaRepoURL,
+				Branch:            testBranch,
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: testGitCredsSecretName, Key: passwordKey},
 			},
 		},
 	}
diff --git a/internal/tools/secret_resolution.go b/internal/tools/secret_resolution.go
index 3f2b141ea..72164c123 100644
--- a/internal/tools/secret_resolution.go
+++ b/internal/tools/secret_resolution.go
@@ -20,119 +20,11 @@ import (
 	"github.com/orka-agents/orka/internal/workerenv"
 )
 
-var (
-	copilotRuntimeSecretCandidates  = []string{"copilot-token"}
-	claudeRuntimeSecretCandidates   = []string{claudeCredentialsSecretName, claudeAPIKeySecretName}
-	codexRuntimeSecretCandidates    = []string{codexRuntimeCopilotSecretName, "codex-runtime-openai", "codex-credentials", "codex-api-key", codexProxyTokenSecretName, "openai-api-key"}
-	opencodeRuntimeSecretCandidates = []string{"opencode-credentials", "opencode-api-key"}
-	gitCredentialSecretCandidates   = []string{"git-credentials", "github-credentials", "copilot-token", "github-token", "git-token"}
-)
-
-// RuntimeSecretCandidates returns the supported secret names for the given runtime.
-func RuntimeSecretCandidates(runtimeType corev1alpha1.AgentRuntimeType) []string {
-	switch runtimeType {
-	case corev1alpha1.AgentRuntimeCopilot:
-		return append([]string(nil), copilotRuntimeSecretCandidates...)
-	case corev1alpha1.AgentRuntimeClaude:
-		return append([]string(nil), claudeRuntimeSecretCandidates...)
-	case corev1alpha1.AgentRuntimeCodex:
-		return append([]string(nil), codexRuntimeSecretCandidates...)
-	case corev1alpha1.AgentRuntimeOpencode:
-		return append([]string(nil), opencodeRuntimeSecretCandidates...)
-	default:
-		return nil
-	}
-}
-
-// FirstPresentSecretName returns the first candidate found in the present map.
-func FirstPresentSecretName(present map[string]bool, candidates []string) string {
-	for _, name := range candidates {
-		if present[name] {
-			return name
-		}
-	}
-	return ""
-}
-
-func resolveRuntimeSecretRef(ctx context.Context, k8sClient client.Reader, namespace string, runtimeType corev1alpha1.AgentRuntimeType, requested string) (*corev1.LocalObjectReference, error) {
-	candidates := RuntimeSecretCandidates(runtimeType)
-	if len(candidates) == 0 {
-		return nil, fmt.Errorf("unsupported runtime type %q", runtimeType)
-	}
-
-	if requested != "" {
-		secret, exists, err := getSecret(ctx, k8sClient, namespace, requested)
-		if err != nil {
-			return nil, err
-		}
-		if !exists {
-			return nil, fmt.Errorf("runtime secretRef %q not found in namespace %q", requested, namespace)
-		}
-		if err := validateRuntimeSecret(runtimeType, secret); err != nil {
-			return nil, fmt.Errorf("runtime secretRef %q in namespace %q %w", requested, namespace, err)
-		}
-		return &corev1.LocalObjectReference{Name: requested}, nil
-	}
-
-	name, err := firstUsableRuntimeSecretName(ctx, k8sClient, namespace, runtimeType, candidates)
-	if err != nil {
-		return nil, err
-	}
-	if name == "" {
-		return nil, fmt.Errorf("no supported %s runtime credentials found in namespace %q; expected one of %s", runtimeType, namespace, strings.Join(candidates, ", "))
-	}
-	return &corev1.LocalObjectReference{Name: name}, nil
-}
+var gitCredentialSecretCandidates = []string{"git-credentials", "github-credentials", "copilot-token", "github-token", "git-token"}
 
-func FirstUsableRuntimeSecretName(secrets []corev1.Secret, runtimeType corev1alpha1.AgentRuntimeType) string {
-	for _, candidate := range RuntimeSecretCandidates(runtimeType) {
-		for i := range secrets {
-			if secrets[i].Name != candidate {
-				continue
-			}
-			if validateRuntimeSecret(runtimeType, &secrets[i]) == nil {
-				return candidate
-			}
-		}
-	}
-	return ""
-}
-
-func firstUsableRuntimeSecretName(ctx context.Context, k8sClient client.Reader, namespace string, runtimeType corev1alpha1.AgentRuntimeType, candidates []string) (string, error) {
-	invalid := make([]string, 0)
-	for _, name := range candidates {
-		secret, exists, err := getSecret(ctx, k8sClient, namespace, name)
-		if err != nil {
-			return "", err
-		}
-		if !exists {
-			continue
-		}
-		if err := validateRuntimeSecret(runtimeType, secret); err != nil {
-			invalid = append(invalid, fmt.Sprintf("%q %v", name, err))
-			continue
-		}
-		return name, nil
-	}
-	if len(invalid) > 0 {
-		return "", fmt.Errorf("no valid %s runtime credentials found in namespace %q: %s", runtimeType, namespace, strings.Join(invalid, "; "))
-	}
-	return "", nil
-}
-
-func validateRuntimeSecret(runtimeType corev1alpha1.AgentRuntimeType, secret *corev1.Secret) error {
-	if runtimeType != corev1alpha1.AgentRuntimeOpencode {
-		return nil
-	}
-	if secret == nil || strings.TrimSpace(string(secret.Data[workerenv.OpenAIBaseURL])) == "" {
-		return fmt.Errorf("must contain non-empty %s", workerenv.OpenAIBaseURL)
-	}
-	return nil
-}
-
-func resolveWorkspaceGitSecretRef(ctx context.Context, k8sClient client.Reader, namespace string, agent *corev1alpha1.Agent, requested string) (*corev1.LocalObjectReference, error) {
+func resolveWorkspaceCredentialRef(ctx context.Context, k8sClient client.Reader, namespace string, agent *corev1alpha1.Agent, requested string) (*corev1alpha1.WorkspaceCredentialReference, error) {
 	if requested != "" {
-		return &corev1.LocalObjectReference{Name: requested}, nil
+		return &corev1alpha1.WorkspaceCredentialReference{Name: requested}, nil
 	}
 
 	if agent != nil &&
@@ -140,7 +32,7 @@ func resolveWorkspaceGitSecretRef(ctx context.Context, k8sClient client.Reader,
 		agent.Spec.Runtime.Type == corev1alpha1.AgentRuntimeCopilot &&
 		agent.Spec.SecretRef != nil &&
 		agent.Spec.SecretRef.Name != "" {
-		return &corev1.LocalObjectReference{Name: agent.Spec.SecretRef.Name}, nil
+		return &corev1alpha1.WorkspaceCredentialReference{Name: agent.Spec.SecretRef.Name}, nil
 	}
 
 	name, err := firstExistingSecretName(ctx, k8sClient, namespace, append([]string(nil), gitCredentialSecretCandidates...))
@@ -150,7 +42,7 @@ func resolveWorkspaceGitSecretRef(ctx context.Context, k8sClient client.Reader,
 	if name == "" {
 		return nil, nil
 	}
-	return &corev1.LocalObjectReference{Name: name}, nil
+	return &corev1alpha1.WorkspaceCredentialReference{Name: name}, nil
 }
 
 func validateGitCredentialSecret(ctx context.Context, k8sClient client.Reader, namespace, name string) error {
@@ -190,13 +82,7 @@ func taskWorkspace(task *corev1alpha1.Task) *corev1alpha1.WorkspaceConfig {
 	if task == nil {
 		return nil
 	}
-	if task.Spec.Workspace != nil {
-		return task.Spec.Workspace
-	}
-	if task.Spec.AgentRuntime != nil {
-		return task.Spec.AgentRuntime.Workspace
-	}
-	return nil
+	return task.Spec.Workspace
 }
 
 func loadAgent(ctx context.Context, k8sClient client.Reader, namespace, agentName string) (*corev1alpha1.Agent, error) {
diff --git a/internal/tools/secret_resolution_test.go b/internal/tools/secret_resolution_test.go
deleted file mode 100644
index 796eba5ca..000000000
--- a/internal/tools/secret_resolution_test.go
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
-Copyright (c) 2026.
-
-MIT License - see LICENSE file for details.
-*/
-
-package tools
-
-import (
-	"slices"
-	"testing"
-
-	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
-)
-
-func TestRuntimeSecretCandidatesOpencode(t *testing.T) {
-	candidates := RuntimeSecretCandidates(corev1alpha1.AgentRuntimeOpencode)
-	for _, want := range []string{"opencode-credentials", "opencode-api-key"} {
-		if !slices.Contains(candidates, want) {
-			t.Fatalf("RuntimeSecretCandidates(opencode) = %#v, want %q", candidates, want)
-		}
-	}
-	if slices.Contains(candidates, "openai-api-key") {
-		t.Fatalf("RuntimeSecretCandidates(opencode) = %#v, want no generic OpenAI fallback", candidates)
-	}
-
-	candidates[0] = "changed-candidate"
-	if got := RuntimeSecretCandidates(corev1alpha1.AgentRuntimeOpencode)[0]; got == "changed-candidate" {
-		t.Fatal("RuntimeSecretCandidates returned shared backing storage")
-	}
-}
diff --git a/internal/tools/send_message.go b/internal/tools/send_message.go
index da3cf7b6a..ed71d536e 100644
--- a/internal/tools/send_message.go
+++ b/internal/tools/send_message.go
@@ -17,6 +17,10 @@ import (
 	"strings"
 	"time"
 
+	ctrlclient "sigs.k8s.io/controller-runtime/pkg/client"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/labels"
 	"github.com/orka-agents/orka/internal/store"
 )
 
@@ -74,7 +78,8 @@ func (t *SendMessageTool) Execute(ctx context.Context, args json.RawMessage) (st
 		return "", fmt.Errorf("failed to parse arguments: %w", err)
 	}
 
-	if a.ToTask == "" || a.Content == "" {
+	targetTask := strings.TrimSpace(a.ToTask)
+	if targetTask == "" || a.Content == "" {
 		return "", fmt.Errorf("to_task and content are required")
 	}
 
@@ -85,16 +90,28 @@ func (t *SendMessageTool) Execute(ctx context.Context, args json.RawMessage) (st
 		if taskName == "" || namespace == "" || parentTask == "" {
 			return "", fmt.Errorf("messaging requires task, namespace, and parent task context")
 		}
+		if toolCtx.Brokered && targetTask != "*" {
+			if toolCtx.Client == nil {
+				return "", fmt.Errorf("brokered messaging requires a Kubernetes client")
+			}
+			target := &corev1alpha1.Task{}
+			if err := toolCtx.Client.Get(ctx, ctrlclient.ObjectKey{Namespace: namespace, Name: targetTask}, target); err != nil {
+				return "", fmt.Errorf("validate sibling task %q: %w", targetTask, err)
+			}
+			if labels.ParentTaskName(target.Labels, target.Annotations) != parentTask {
+				return "", fmt.Errorf("target task %q is not a sibling in coordinator family %q", targetTask, parentTask)
+			}
+		}
 		if err := toolCtx.MessageStore.SendMessage(ctx, &store.Message{
 			Namespace:  namespace,
 			FromTask:   taskName,
-			ToTask:     a.ToTask,
+			ToTask:     targetTask,
 			ParentTask: parentTask,
 			Content:    a.Content,
 		}); err != nil {
 			return "", fmt.Errorf("failed to send message: %w", err)
 		}
-		target := a.ToTask
+		target := targetTask
 		if target == "*" {
 			target = "all siblings"
 		}
@@ -112,7 +129,7 @@ func (t *SendMessageTool) Execute(ctx context.Context, args json.RawMessage) (st
 
 	body, _ := json.Marshal(map[string]string{
 		"fromTask":   taskName,
-		"toTask":     a.ToTask,
+		"toTask":     targetTask,
 		"parentTask": parentTask,
 		"content":    a.Content,
 	})
@@ -137,7 +154,7 @@ func (t *SendMessageTool) Execute(ctx context.Context, args json.RawMessage) (st
 	defer resp.Body.Close() //nolint:errcheck
 
 	if resp.StatusCode >= 200 && resp.StatusCode < 300 {
-		target := a.ToTask
+		target := targetTask
 		if target == "*" {
 			target = "all siblings"
 		}
diff --git a/internal/tools/send_message_test.go b/internal/tools/send_message_test.go
index d98bc65b3..bb290c667 100644
--- a/internal/tools/send_message_test.go
+++ b/internal/tools/send_message_test.go
@@ -11,9 +11,37 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/labels"
+	"github.com/orka-agents/orka/internal/store"
 )
 
+type recordingMessageStore struct {
+	messages []store.Message
+}
+
+func (s *recordingMessageStore) SendMessage(_ context.Context, message *store.Message) error {
+	s.messages = append(s.messages, *message)
+	return nil
+}
+
+func (*recordingMessageStore) GetMessages(context.Context, string, string, string, bool) ([]store.Message, error) {
+	return nil, nil
+}
+
+func (*recordingMessageStore) DeleteTaskMessages(context.Context, string, string) error {
+	return nil
+}
+
+func (*recordingMessageStore) DeleteParentMessages(context.Context, string, string) error {
+	return nil
+}
+
 func TestSendMessageTool_Name(t *testing.T) {
 	tool := NewSendMessageTool()
 	if got := tool.Name(); got != sendMessageToolName {
@@ -185,3 +213,77 @@ func TestSendMessageTool_Execute(t *testing.T) {
 		})
 	}
 }
+
+func TestSendMessageTool_BrokeredSiblingScope(t *testing.T) {
+	const (
+		parentTask      = "coordinator-a"
+		senderTask      = "worker-a"
+		siblingTask     = "worker-b"
+		unrelatedTask   = "worker-other"
+		unrelatedParent = "coordinator-b"
+	)
+	sibling := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{
+		Name: siblingTask, Namespace: defaultNamespace,
+		Labels:      map[string]string{labels.LabelParentTask: labels.SelectorValue(parentTask)},
+		Annotations: map[string]string{labels.AnnotationParentTaskName: parentTask},
+	}}
+	unrelated := &corev1alpha1.Task{ObjectMeta: metav1.ObjectMeta{
+		Name: unrelatedTask, Namespace: defaultNamespace,
+		Labels:      map[string]string{labels.LabelParentTask: labels.SelectorValue(unrelatedParent)},
+		Annotations: map[string]string{labels.AnnotationParentTaskName: unrelatedParent},
+	}}
+
+	tests := []struct {
+		name         string
+		target       string
+		withClient   bool
+		wantErr      string
+		wantMessages int
+	}{
+		{name: "sibling", target: siblingTask, withClient: true, wantMessages: 1},
+		{name: "broadcast", target: "*", wantMessages: 1},
+		{name: "unrelated coordinator family", target: unrelatedTask, withClient: true, wantErr: "not a sibling"},
+		{name: "missing target", target: "missing", withClient: true, wantErr: "validate sibling task"},
+		{name: "missing broker client", target: siblingTask, wantErr: "requires a Kubernetes client"},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			messageStore := &recordingMessageStore{}
+			toolContext := &ToolContext{
+				Brokered: true, Namespace: defaultNamespace, TaskID: senderTask,
+				ParentTaskID: parentTask, MessageStore: messageStore,
+			}
+			if test.withClient {
+				toolContext.Client = newFakeClient(sibling, unrelated)
+			}
+			ctx := WithToolContext(context.Background(), toolContext)
+			arguments, err := json.Marshal(SendMessageArgs{ToTask: test.target, Content: testHelloText})
+			if err != nil {
+				t.Fatal(err)
+			}
+			result, err := NewSendMessageTool().Execute(ctx, arguments)
+			if test.wantErr != "" {
+				if err == nil || !strings.Contains(err.Error(), test.wantErr) {
+					t.Fatalf("Execute() error = %v, want substring %q", err, test.wantErr)
+				}
+			} else {
+				if err != nil {
+					t.Fatalf("Execute() error = %v", err)
+				}
+				if result == "" {
+					t.Fatal("Execute() returned an empty success result")
+				}
+			}
+			if len(messageStore.messages) != test.wantMessages {
+				t.Fatalf("stored messages = %d, want %d", len(messageStore.messages), test.wantMessages)
+			}
+			if test.wantMessages == 1 {
+				message := messageStore.messages[0]
+				if message.FromTask != senderTask || message.ToTask != test.target || message.ParentTask != parentTask {
+					t.Fatalf("stored message scope = %#v", message)
+				}
+			}
+		})
+	}
+}
diff --git a/internal/tools/test_helpers_test.go b/internal/tools/test_helpers_test.go
index 52f82438c..ee64ebf6e 100644
--- a/internal/tools/test_helpers_test.go
+++ b/internal/tools/test_helpers_test.go
@@ -76,10 +76,11 @@ func githubRepoTaskWithSecret(repoURL string) (*corev1alpha1.Task, *corev1.Secre
 		ObjectMeta: metav1.ObjectMeta{Name: testCoderTaskName, Namespace: defaultNamespace},
 		Spec: corev1alpha1.TaskSpec{
 			Type: corev1alpha1.TaskTypeAgent,
-			AgentRuntime: &corev1alpha1.AgentRuntimeSpec{
-				Workspace: &corev1alpha1.WorkspaceConfig{
-					GitRepo:      repoURL,
-					GitSecretRef: &corev1.LocalObjectReference{Name: testGitCredsSecretName},
+			Workspace: &corev1alpha1.WorkspaceConfig{
+				GitRepo:           repoURL,
+				ReadCredentialRef: &corev1alpha1.WorkspaceCredentialReference{Name: testGitCredsSecretName},
+				ForgeCredentialRef: &corev1alpha1.WorkspaceCredentialReference{
+					Name: testGitCredsSecretName,
 				},
 			},
 		},
diff --git a/internal/tools/transaction_context_authorization.go b/internal/tools/transaction_context_authorization.go
index d539fe7cf..4916b5b93 100644
--- a/internal/tools/transaction_context_authorization.go
+++ b/internal/tools/transaction_context_authorization.go
@@ -5,15 +5,21 @@ import (
 	"encoding/json"
 	"fmt"
 	"slices"
+	"sort"
 	"strings"
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	"github.com/orka-agents/orka/internal/acp"
 	"github.com/orka-agents/orka/internal/labels"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
+const transactionSecretCredentialReadScope = "orka:secrets:credentials:read"
+
 type transactionProviderInfo struct {
 	Name      string
 	Namespace string
@@ -70,17 +76,29 @@ func validateChildTaskAgainstParentTransaction(ctx context.Context, k8sClient cl
 	}
 
 	workspace := taskWorkspace(child)
-	if workspace != nil && workspace.GitSecretRef != nil && strings.TrimSpace(workspace.GitSecretRef.Name) != "" {
-		const secretCredentialReadScope = "orka:secrets:credentials:read"
-		if !TransactionHasScope(parent.Spec.Transaction, secretCredentialReadScope) {
-			return fmt.Errorf("child task git secret %q requires transaction scope %q", workspace.GitSecretRef.Name, secretCredentialReadScope)
-		}
-		if want := strings.TrimSpace(txCtx["secret"]); want != "" && workspace.GitSecretRef.Name != want {
-			return fmt.Errorf("child task git secret %q does not match transaction context %q", workspace.GitSecretRef.Name, want)
+	if workspace != nil {
+		for _, credential := range []struct {
+			role string
+			ref  *corev1alpha1.WorkspaceCredentialReference
+		}{
+			{role: "source-read", ref: workspace.ReadCredentialRef},
+			{role: "target-read", ref: workspace.PublicationReadCredentialRef},
+			{role: "target-write", ref: workspace.PublicationCredentialRef},
+			{role: "forge", ref: workspace.ForgeCredentialRef},
+		} {
+			if credential.ref == nil || strings.TrimSpace(credential.ref.Name) == "" {
+				continue
+			}
+			if !TransactionHasScope(parent.Spec.Transaction, transactionSecretCredentialReadScope) {
+				return fmt.Errorf("child task %s credential %q requires transaction scope %q", credential.role, credential.ref.Name, transactionSecretCredentialReadScope)
+			}
+			if want := strings.TrimSpace(txCtx["secret"]); want != "" && credential.ref.Name != want {
+				return fmt.Errorf("child task %s credential %q does not match transaction context %q", credential.role, credential.ref.Name, want)
+			}
 		}
 	}
 	if len(txCtx) == 0 {
-		return nil
+		return validateChildToolCredentialConstraints(ctx, k8sClient, parent, child, childCtx)
 	}
 	for _, constraint := range []struct {
 		key string
@@ -100,7 +118,7 @@ func validateChildTaskAgainstParentTransaction(ctx context.Context, k8sClient cl
 	if err := validateChildToolConstraints(txCtx, childCtx); err != nil {
 		return err
 	}
-	return nil
+	return validateChildToolCredentialConstraints(ctx, k8sClient, parent, child, childCtx)
 }
 
 func TransactionHasScope(tx *corev1alpha1.TaskTransaction, want string) bool {
@@ -164,12 +182,14 @@ func resolveChildTransactionContext(ctx context.Context, k8sClient client.Client
 	childCtx.providerInfo, childCtx.model = childTransactionEffectiveProviderModel(child, childCtx.agent, childCtx.provider, childCtx.providerInfo)
 	childCtx.fallbacks = childTransactionFallbackProviderModels(ctx, k8sClient, child.Namespace, childCtx.agent)
 	childCtx.aiTools = childTransactionEffectiveAITools(child, childCtx.agent)
-	childCtx.runtimeTools = childTransactionEffectiveRuntimeAllowedTools(child, childCtx.agent)
-	childCtx.runtimeBash = childTransactionEffectiveRuntimeAllowBash(child, childCtx.agent)
+	childCtx.runtimeTools, childCtx.runtimeBash = childTransactionEffectiveRuntimePolicy(child, childCtx.agent)
 	return childCtx, nil
 }
 
 func childTransactionProviderRef(child *corev1alpha1.Task, agent *corev1alpha1.Agent) *corev1alpha1.ProviderReference {
+	if childTransactionOpenCodeAgentTask(child, agent) {
+		return nil
+	}
 	if child.Spec.AI != nil && child.Spec.AI.ProviderRef != nil {
 		return child.Spec.AI.ProviderRef
 	}
@@ -181,7 +201,9 @@ func childTransactionProviderRef(child *corev1alpha1.Task, agent *corev1alpha1.A
 
 func childTransactionEffectiveProviderModel(child *corev1alpha1.Task, agent *corev1alpha1.Agent, provider *corev1alpha1.Provider, providerInfo transactionProviderInfo) (transactionProviderInfo, string) {
 	model := ""
-	if provider != nil {
+	openCodeAgent := childTransactionOpenCodeAgent(agent)
+	openCodeAgentTask := childTransactionOpenCodeAgentTask(child, agent)
+	if provider != nil && !openCodeAgent {
 		providerInfo = transactionProviderInfo{
 			Name:      provider.Name,
 			Namespace: provider.Namespace,
@@ -190,14 +212,16 @@ func childTransactionEffectiveProviderModel(child *corev1alpha1.Task, agent *cor
 		model = provider.Spec.DefaultModel
 	}
 	if agent != nil && agent.Spec.Model != nil {
-		if strings.TrimSpace(agent.Spec.Model.Provider) != "" {
+		if openCodeAgent {
+			providerInfo = transactionProviderInfo{Type: childTransactionOpenCodeModelProvider(agent)}
+		} else if strings.TrimSpace(agent.Spec.Model.Provider) != "" {
 			providerInfo = transactionProviderInfo{Type: agent.Spec.Model.Provider}
 		}
 		if strings.TrimSpace(agent.Spec.Model.Name) != "" {
 			model = agent.Spec.Model.Name
 		}
 	}
-	if child.Spec.AI != nil {
+	if child.Spec.AI != nil && !openCodeAgentTask {
 		if strings.TrimSpace(child.Spec.AI.Provider) != "" {
 			providerInfo = transactionProviderInfo{Type: child.Spec.AI.Provider}
 		}
@@ -205,7 +229,7 @@ func childTransactionEffectiveProviderModel(child *corev1alpha1.Task, agent *cor
 			model = child.Spec.AI.Model
 		}
 	}
-	if provider != nil {
+	if provider != nil && !openCodeAgent {
 		providerInfo = transactionProviderInfo{
 			Name:      provider.Name,
 			Namespace: provider.Namespace,
@@ -215,6 +239,25 @@ func childTransactionEffectiveProviderModel(child *corev1alpha1.Task, agent *cor
 	return providerInfo, model
 }
 
+func childTransactionOpenCodeAgentTask(child *corev1alpha1.Task, agent *corev1alpha1.Agent) bool {
+	return child != nil && child.Spec.Type == corev1alpha1.TaskTypeAgent && childTransactionOpenCodeAgent(agent)
+}
+
+func childTransactionOpenCodeAgent(agent *corev1alpha1.Agent) bool {
+	return agent != nil && agent.Spec.Runtime != nil && agent.Spec.Runtime.Type == corev1alpha1.AgentRuntimeOpencode
+}
+
+func childTransactionOpenCodeModelProvider(agent *corev1alpha1.Agent) string {
+	if !childTransactionOpenCodeAgent(agent) || agent.Spec.Model == nil {
+		return ""
+	}
+	provider, model, ok := strings.Cut(strings.TrimSpace(agent.Spec.Model.Name), "/")
+	if !ok || strings.TrimSpace(model) == "" {
+		return ""
+	}
+	return strings.TrimSpace(provider)
+}
+
 func childTransactionFallbackProviderModels(ctx context.Context, k8sClient client.Client, namespace string, agent *corev1alpha1.Agent) []transactionProviderModel {
 	if k8sClient == nil || agent == nil || agent.Spec.Model == nil || len(agent.Spec.Model.Fallbacks) == 0 {
 		return nil
@@ -290,7 +333,10 @@ func validateChildToolConstraints(txCtx map[string]string, childCtx childTransac
 	if !ok {
 		return nil
 	}
-	if childCtx.childType == corev1alpha1.TaskTypeAgent && !hasNonEmptyTransactionTools(childCtx.runtimeTools) {
+	if childCtx.agent != nil && childCtx.agent.Spec.Runtime != nil && childCtx.agent.Spec.Runtime.Type == corev1alpha1.AgentRuntimeOpencode {
+		allowed = acp.NormalizeOpenCodeAuthorizationTools(allowed)
+	}
+	if childCtx.childType == corev1alpha1.TaskTypeAgent && childTransactionRuntimeToolsUnrestricted(childCtx.runtimeTools) {
 		return fmt.Errorf("child task agent runtime tools are unrestricted by task or agent while transaction context restricts allowedTools")
 	}
 	runtimeTools := childTransactionRuntimeToolConstraints(childCtx)
@@ -306,8 +352,222 @@ func validateChildToolConstraints(txCtx map[string]string, childCtx childTransac
 	return nil
 }
 
+type childTransactionCredentialRequirements struct {
+	requiresScope bool
+	secretNames   map[string]struct{}
+}
+
+func validateChildToolCredentialConstraints(
+	ctx context.Context,
+	k8sClient client.Client,
+	parent, child *corev1alpha1.Task,
+	childCtx childTransactionContext,
+) error {
+	for _, toolName := range childTransactionCustomToolNames(childCtx) {
+		if k8sClient == nil {
+			return fmt.Errorf("child task tool %q is unresolved because a Kubernetes client is unavailable", toolName)
+		}
+		tool := &corev1alpha1.Tool{}
+		if err := k8sClient.Get(ctx, types.NamespacedName{Name: toolName, Namespace: child.Namespace}, tool); err != nil {
+			if apierrors.IsNotFound(err) {
+				return fmt.Errorf("child task tool %q is unresolved", toolName)
+			}
+			return fmt.Errorf("resolve child task Tool %q in namespace %q: %w", toolName, child.Namespace, err)
+		}
+		if tool.Spec.HTTP == nil {
+			continue
+		}
+
+		requirements := childTransactionCredentialRequirements{secretNames: map[string]struct{}{}}
+		if authSecretRef := tool.Spec.HTTP.AuthSecretRef; authSecretRef != nil {
+			secretName := strings.TrimSpace(authSecretRef.Name)
+			if secretName == "" {
+				return fmt.Errorf("child task tool %q has an unresolved HTTP auth Secret reference", toolName)
+			}
+			requirements.addSecret(secretName)
+		}
+		if policyRef := tool.Spec.HTTP.OutboundAccessPolicyRef; policyRef != nil {
+			policyName := strings.TrimSpace(policyRef.Name)
+			if policyName == "" {
+				return fmt.Errorf("child task tool %q has an unresolved OutboundAccessPolicy reference", toolName)
+			}
+			policy := &corev1alpha1.OutboundAccessPolicy{}
+			if err := k8sClient.Get(ctx, types.NamespacedName{Name: policyName, Namespace: child.Namespace}, policy); err != nil {
+				if apierrors.IsNotFound(err) {
+					return fmt.Errorf("child task tool %q references unresolved OutboundAccessPolicy %q", toolName, policyName)
+				}
+				return fmt.Errorf("resolve child task Tool %q OutboundAccessPolicy %q: %w", toolName, policyName, err)
+			}
+			if !childTransactionOutboundAccessPolicyReady(policy) {
+				return fmt.Errorf("child task tool %q references not-ready OutboundAccessPolicy %q", toolName, policyName)
+			}
+			if err := requirements.addOutboundAccessPolicy(policy); err != nil {
+				return fmt.Errorf("child task tool %q OutboundAccessPolicy %q credentials: %w", toolName, policyName, err)
+			}
+		}
+		if err := validateChildTransactionCredentialRequirements(parent, fmt.Sprintf("tool %q credential", toolName), requirements); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func childTransactionCustomToolNames(childCtx childTransactionContext) []string {
+	builtInTools := make(map[string]struct{})
+	for _, name := range KnownBuiltInToolNames() {
+		builtInTools[name] = struct{}{}
+	}
+	seen := map[string]struct{}{}
+	custom := []string{}
+	toolNames := append(append([]string{}, childCtx.aiTools...), childTransactionRuntimeToolConstraints(childCtx)...)
+	for _, name := range toolNames {
+		name = strings.TrimSpace(name)
+		if name == "" {
+			continue
+		}
+		if _, builtIn := builtInTools[name]; builtIn || childTransactionProviderNativeToolName(childCtx.agent, name) {
+			continue
+		}
+		if _, ok := seen[name]; ok {
+			continue
+		}
+		seen[name] = struct{}{}
+		custom = append(custom, name)
+	}
+	sort.Strings(custom)
+	return custom
+}
+
+func childTransactionProviderNativeToolName(agent *corev1alpha1.Agent, name string) bool {
+	return agent != nil && agent.Spec.Runtime != nil &&
+		acp.IsBuiltInRuntimeNativeTool(string(agent.Spec.Runtime.Type), name)
+}
+
+func (requirements *childTransactionCredentialRequirements) addSecret(name string) {
+	name = strings.TrimSpace(name)
+	if name == "" {
+		return
+	}
+	if requirements.secretNames == nil {
+		requirements.secretNames = map[string]struct{}{}
+	}
+	requirements.secretNames[name] = struct{}{}
+	requirements.requiresScope = true
+}
+
+func (requirements *childTransactionCredentialRequirements) addOutboundAccessPolicy(policy *corev1alpha1.OutboundAccessPolicy) error {
+	if policy == nil {
+		return fmt.Errorf("policy is unresolved")
+	}
+	addSecretRef := func(role string, ref *corev1alpha1.NamespacedSecretKeySelector) error {
+		if ref == nil {
+			return nil
+		}
+		name := strings.TrimSpace(ref.Name)
+		if name == "" {
+			return fmt.Errorf("%s Secret reference is unresolved", role)
+		}
+		if namespace := strings.TrimSpace(ref.Namespace); namespace != "" && namespace != policy.Namespace {
+			return fmt.Errorf("%s Secret namespace %q does not match policy namespace %q", role, namespace, policy.Namespace)
+		}
+		requirements.addSecret(name)
+		return nil
+	}
+	addTokenSource := func(role string, source *corev1alpha1.OutboundTokenSource) error {
+		if source == nil {
+			return nil
+		}
+		if source.Source == corev1alpha1.OutboundTokenSourceServiceAccount {
+			requirements.requiresScope = true
+		}
+		if source.Source == corev1alpha1.OutboundTokenSourceSecretRef && source.SecretRef == nil {
+			return fmt.Errorf("%s Secret reference is unresolved", role)
+		}
+		return addSecretRef(role, source.SecretRef)
+	}
+	addTLS := func(role string, tlsConfig *corev1alpha1.OutboundTLSConfig) error {
+		if tlsConfig == nil {
+			return nil
+		}
+		return addSecretRef(role, tlsConfig.CASecretRef)
+	}
+
+	if direct := policy.Spec.Direct; direct != nil {
+		if err := addTokenSource("subject", &direct.Subject); err != nil {
+			return err
+		}
+		if err := addTokenSource("actor", direct.Actor); err != nil {
+			return err
+		}
+		if auth := direct.ClientAuthentication; auth != nil {
+			if err := addSecretRef("client authentication", auth.ClientSecretRef); err != nil {
+				return err
+			}
+			if err := addSecretRef("private-key authentication", auth.PrivateKeyRef); err != nil {
+				return err
+			}
+		}
+		if err := addTLS("token endpoint CA", direct.TokenEndpoint.TLS); err != nil {
+			return err
+		}
+	}
+	if gateway := policy.Spec.Gateway; gateway != nil {
+		if err := addTLS("gateway CA", gateway.TLS); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validateChildTransactionCredentialRequirements(
+	parent *corev1alpha1.Task,
+	description string,
+	requirements childTransactionCredentialRequirements,
+) error {
+	if !requirements.requiresScope {
+		return nil
+	}
+	if !TransactionHasScope(parent.Spec.Transaction, transactionSecretCredentialReadScope) {
+		return fmt.Errorf("child task %s requires transaction scope %q", description, transactionSecretCredentialReadScope)
+	}
+	want := strings.TrimSpace(parent.Spec.Transaction.Context["secret"])
+	if want == "" {
+		return nil
+	}
+	secretNames := make([]string, 0, len(requirements.secretNames))
+	for name := range requirements.secretNames {
+		secretNames = append(secretNames, name)
+	}
+	sort.Strings(secretNames)
+	for _, name := range secretNames {
+		if name != want {
+			return fmt.Errorf("child task %s %q does not match transaction context %q", description, name, want)
+		}
+	}
+	return nil
+}
+
+func childTransactionOutboundAccessPolicyReady(policy *corev1alpha1.OutboundAccessPolicy) bool {
+	if policy == nil || !policy.DeletionTimestamp.IsZero() || policy.Status.ObservedGeneration != policy.Generation {
+		return false
+	}
+	for _, conditionType := range []string{
+		corev1alpha1.OutboundAccessPolicyConditionAccepted,
+		corev1alpha1.OutboundAccessPolicyConditionResolvedRefs,
+	} {
+		condition := meta.FindStatusCondition(policy.Status.Conditions, conditionType)
+		if condition == nil || condition.Status != metav1.ConditionTrue || condition.ObservedGeneration != policy.Generation {
+			return false
+		}
+	}
+	return true
+}
+
 func childTransactionRuntimeToolConstraints(childCtx childTransactionContext) []string {
 	runtimeTools := append([]string{}, childCtx.runtimeTools...)
+	if childCtx.agent != nil && childCtx.agent.Spec.Runtime != nil && childCtx.agent.Spec.Runtime.Type == corev1alpha1.AgentRuntimeOpencode {
+		return runtimeTools
+	}
 	if childCtx.childType == corev1alpha1.TaskTypeAgent && childCtx.runtimeBash {
 		runtimeTools = append(runtimeTools, "Bash")
 	}
@@ -320,6 +580,10 @@ func hasNonEmptyTransactionTools(tools []string) bool {
 	})
 }
 
+func childTransactionRuntimeToolsUnrestricted(tools []string) bool {
+	return tools == nil || (len(tools) > 0 && !hasNonEmptyTransactionTools(tools))
+}
+
 func childTransactionEffectiveAITools(child *corev1alpha1.Task, agent *corev1alpha1.Agent) []string {
 	tools := []string{}
 	if agent != nil {
@@ -353,6 +617,14 @@ func childTransactionEffectiveAITools(child *corev1alpha1.Task, agent *corev1alp
 			}
 		}
 	}
+	messagingCapable := child.Spec.Type == corev1alpha1.TaskTypeAI || child.Spec.Type == corev1alpha1.TaskTypeAgent
+	if _, delegatedChild := child.Labels[labels.LabelParentTask]; messagingCapable && delegatedChild && child.Annotations[labels.AnnotationDisableCoordinationToolInject] != trueStr {
+		for _, tool := range []string{sendMessageToolName, checkMessagesToolName} {
+			if !slices.Contains(tools, tool) {
+				tools = append(tools, tool)
+			}
+		}
+	}
 	return tools
 }
 
@@ -365,25 +637,65 @@ func transactionMemoryToolNames() []string {
 	}
 }
 
-func childTransactionEffectiveRuntimeAllowedTools(child *corev1alpha1.Task, agent *corev1alpha1.Agent) []string {
-	if child.Spec.AgentRuntime != nil && len(child.Spec.AgentRuntime.AllowedTools) > 0 {
-		return append([]string{}, child.Spec.AgentRuntime.AllowedTools...)
+func childTransactionAgentRuntimeAllowedTools(agent *corev1alpha1.Agent) []string {
+	if agent == nil || agent.Spec.Runtime == nil {
+		return nil
 	}
-	if agent != nil && agent.Spec.Runtime != nil && len(agent.Spec.Runtime.DefaultAllowedTools) > 0 {
-		return append([]string{}, agent.Spec.Runtime.DefaultAllowedTools...)
+	runtime := agent.Spec.Runtime
+	if runtime.Type == corev1alpha1.AgentRuntimeOpencode && runtime.DefaultAllowedTools == nil {
+		return acp.OpenCodeDefaultAllowedTools()
+	}
+	if runtime.DefaultAllowedTools != nil {
+		return append([]string{}, runtime.DefaultAllowedTools...)
 	}
 	return nil
 }
 
-func childTransactionEffectiveRuntimeAllowBash(child *corev1alpha1.Task, agent *corev1alpha1.Agent) bool {
+func childTransactionAgentRuntimeAllowBash(agent *corev1alpha1.Agent) bool {
 	allowBash := true
 	if agent != nil && agent.Spec.Runtime != nil && agent.Spec.Runtime.DefaultAllowBash != nil {
 		allowBash = *agent.Spec.Runtime.DefaultAllowBash
 	}
+	return allowBash
+}
+
+func childTransactionEffectiveRuntimePolicy(child *corev1alpha1.Task, agent *corev1alpha1.Agent) ([]string, bool) {
+	allowedTools := childTransactionAgentRuntimeAllowedTools(agent)
+	if child.Spec.AgentRuntime != nil && child.Spec.AgentRuntime.AllowedTools != nil {
+		allowedTools = append([]string{}, child.Spec.AgentRuntime.AllowedTools...)
+	}
+	allowBash := childTransactionAgentRuntimeAllowBash(agent)
+	disallowedTools := []string(nil)
 	if child.Spec.AgentRuntime != nil && child.Spec.AgentRuntime.AllowBash != nil {
 		allowBash = *child.Spec.AgentRuntime.AllowBash
 	}
-	return allowBash
+	if child.Spec.AgentRuntime != nil {
+		disallowedTools = append(disallowedTools, child.Spec.AgentRuntime.DisallowedTools...)
+	}
+	if agent == nil || agent.Spec.Runtime == nil {
+		return allowedTools, allowBash
+	}
+	if agent.Spec.Runtime.Type != corev1alpha1.AgentRuntimeOpencode {
+		switch agent.Spec.Runtime.Type {
+		case corev1alpha1.AgentRuntimeClaude, corev1alpha1.AgentRuntimeCodex, corev1alpha1.AgentRuntimeCopilot:
+			// Preserve a non-empty all-blank allowlist as the existing fail-closed
+			// unrestricted sentinel instead of collapsing it into explicit deny-all.
+			if len(allowedTools) > 0 && !hasNonEmptyTransactionTools(allowedTools) {
+				return allowedTools, allowBash
+			}
+			allowedTools, disallowedTools, allowBash = acp.NormalizeBuiltInRuntimeToolPolicy(
+				string(agent.Spec.Runtime.Type), allowedTools, disallowedTools, allowBash,
+			)
+			allowedTools = acp.BuiltInRuntimeEffectiveAllowedTools(allowedTools, disallowedTools, allowBash)
+			allowBash = acp.BuiltInRuntimeEffectiveAllowBash(allowedTools, disallowedTools, allowBash)
+		}
+		return allowedTools, allowBash
+	}
+	workspace := child.Spec.Workspace
+	readIntent := workspace == nil || workspace.Intent == "" || workspace.Intent == corev1alpha1.WorkspaceIntentRead
+	allowedTools, disallowedTools, allowBash = acp.NormalizeOpenCodeToolPolicy(readIntent, allowedTools, disallowedTools, allowBash)
+	allowedTools = acp.OpenCodeEffectiveAllowedTools(allowedTools, disallowedTools, allowBash)
+	return allowedTools, allowBash && slices.Contains(allowedTools, "bash")
 }
 
 func transactionCoordinationToolNames() []string {
diff --git a/internal/tools/transaction_context_authorization_test.go b/internal/tools/transaction_context_authorization_test.go
index b76bd4a59..2ad45af7d 100644
--- a/internal/tools/transaction_context_authorization_test.go
+++ b/internal/tools/transaction_context_authorization_test.go
@@ -8,6 +8,7 @@ package tools
 
 import (
 	"context"
+	"slices"
 	"strings"
 	"testing"
 
@@ -46,6 +47,63 @@ func TestValidateChildTaskAgainstParentTransactionRejectsDisallowedAgent(t *test
 	}
 }
 
+func TestValidateChildTaskAgainstParentTransactionAuthorizesAllWorkspaceCredentialRoles(t *testing.T) {
+	firstName := "workspace-a"
+	secondName := "workspace-b"
+	tests := []struct {
+		name string
+		role string
+		set  func(*corev1alpha1.WorkspaceConfig)
+	}{
+		{name: "source read", role: "source-read", set: func(workspace *corev1alpha1.WorkspaceConfig) {
+			workspace.ReadCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: secondName}
+		}},
+		{name: "target read", role: "target-read", set: func(workspace *corev1alpha1.WorkspaceConfig) {
+			workspace.PublicationReadCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: secondName}
+		}},
+		{name: "target write", role: "target-write", set: func(workspace *corev1alpha1.WorkspaceConfig) {
+			workspace.PublicationCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: secondName}
+		}},
+		{name: "forge", role: "forge", set: func(workspace *corev1alpha1.WorkspaceConfig) {
+			workspace.ForgeCredentialRef = &corev1alpha1.WorkspaceCredentialReference{Name: secondName}
+		}},
+	}
+	for _, test := range tests {
+		t.Run(test.name+" requires scope", func(t *testing.T) {
+			parent := parentTask()
+			parent.Spec.Transaction.Scope = ""
+			parent.Spec.Transaction.Scopes = nil
+			parent.Spec.Transaction.Context = map[string]string{}
+			child := &corev1alpha1.Task{
+				ObjectMeta: metav1.ObjectMeta{Name: "child", Namespace: defaultNamespace},
+				Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeContainer, Workspace: &corev1alpha1.WorkspaceConfig{}},
+			}
+			test.set(child.Spec.Workspace)
+
+			err := validateChildTaskAgainstParentTransaction(context.Background(), newFakeClient(), parent, child, "")
+			if err == nil || !strings.Contains(err.Error(), "child task "+test.role+" credential") || !strings.Contains(err.Error(), "requires transaction scope") {
+				t.Fatalf("validateChildTaskAgainstParentTransaction() error = %v, want %s scope denial", err, test.role)
+			}
+		})
+
+		t.Run(test.name+" enforces secret subset", func(t *testing.T) {
+			parent := parentTask()
+			parent.Spec.Transaction.Scopes = []string{"orka:secrets:credentials:read"}
+			parent.Spec.Transaction.Context = map[string]string{"secret": firstName}
+			child := &corev1alpha1.Task{
+				ObjectMeta: metav1.ObjectMeta{Name: "child", Namespace: defaultNamespace},
+				Spec:       corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeContainer, Workspace: &corev1alpha1.WorkspaceConfig{}},
+			}
+			test.set(child.Spec.Workspace)
+
+			err := validateChildTaskAgainstParentTransaction(context.Background(), newFakeClient(), parent, child, "")
+			if err == nil || !strings.Contains(err.Error(), "child task "+test.role+" credential") || !strings.Contains(err.Error(), "does not match transaction context") {
+				t.Fatalf("validateChildTaskAgainstParentTransaction() error = %v, want %s subset denial", err, test.role)
+			}
+		})
+	}
+}
+
 func TestValidateChildTaskAgainstParentTransactionRejectsDisallowedProviderModelAndTool(t *testing.T) {
 	parent := parentTask()
 	parent.Spec.Transaction.Context = map[string]string{
@@ -100,6 +158,41 @@ func TestValidateChildTaskAgainstParentTransactionRejectsProviderlessChildUnderP
 	}
 }
 
+func TestValidateChildTaskAgainstParentTransactionDerivesOpenCodeProviderFromModelName(t *testing.T) {
+	const model = "openrouter/anthropic/claude-sonnet-4"
+	parent := parentTask()
+	parent.Spec.Transaction.Context = map[string]string{
+		"namespace":        defaultNamespace,
+		"allowedAgents":    `["researcher"]`,
+		"allowedProviders": `["openrouter"]`,
+		"allowedModels":    `["` + model + `"]`,
+	}
+	agent := researcherAgent()
+	agent.Spec.Model = &corev1alpha1.ModelConfig{Name: model}
+	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeOpencode}
+	overrideProvider := &corev1alpha1.Provider{
+		ObjectMeta: metav1.ObjectMeta{Name: "override-provider", Namespace: defaultNamespace},
+		Spec: corev1alpha1.ProviderSpec{
+			Type:         corev1alpha1.ProviderTypeAnthropic,
+			SecretRef:    corev1alpha1.ProviderSecretRef{Name: "override-secret"},
+			DefaultModel: "claude-sonnet-4",
+		},
+	}
+	agent.Spec.Model.Provider = string(corev1alpha1.ProviderTypeAnthropic)
+	agent.Spec.ProviderRef = &corev1alpha1.ProviderReference{Name: overrideProvider.Name}
+	child := childTaskForResearcherAgent()
+	child.Spec.Type = corev1alpha1.TaskTypeAgent
+	child.Spec.AI = &corev1alpha1.AISpec{
+		ProviderRef: &corev1alpha1.ProviderReference{Name: overrideProvider.Name},
+		Provider:    string(corev1alpha1.ProviderTypeAnthropic),
+		Model:       "claude-sonnet-4",
+	}
+
+	if err := validateChildTaskAgainstParentTransaction(context.Background(), newFakeClient(agent, overrideProvider), parent, child, testResearcherAgentName); err != nil {
+		t.Fatalf("validateChildTaskAgainstParentTransaction() rejected provider-qualified OpenCode model: %v", err)
+	}
+}
+
 func TestValidateChildTaskAgainstParentTransactionRejectsUnrestrictedAgentRuntimeTools(t *testing.T) {
 	parent := parentTask()
 	parent.Spec.Transaction.Context = map[string]string{
@@ -139,7 +232,28 @@ func TestValidateChildTaskAgainstParentTransactionRejectsBlankAgentRuntimeTools(
 	}
 }
 
-func TestValidateChildTaskAgainstParentTransactionRejectsEnabledBashOutsideAllowedTools(t *testing.T) {
+func TestValidateChildTaskAgainstParentTransactionAcceptsExplicitAllowlistWithoutBash(t *testing.T) {
+	parent := parentTask()
+	parent.Spec.Transaction.Context = map[string]string{
+		"namespace":     defaultNamespace,
+		"allowedAgents": `["researcher"]`,
+		"allowedTools":  `["Read"]`,
+	}
+	agent := researcherAgent()
+	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{
+		Type:                corev1alpha1.AgentRuntimeCodex,
+		DefaultAllowedTools: []string{"Read"},
+	}
+	child := childTaskForResearcherAgent()
+	child.Spec.Type = corev1alpha1.TaskTypeAgent
+
+	if err := validateChildTaskAgainstParentTransaction(context.Background(), newFakeClient(agent), parent, child, testResearcherAgentName); err != nil {
+		t.Fatalf("validateChildTaskAgainstParentTransaction() error = %v, want explicit Read-only subset accepted", err)
+	}
+}
+
+func TestValidateChildTaskAgainstParentTransactionRequiresInjectedChildMessagingTools(t *testing.T) {
+	allowBash := false
 	parent := parentTask()
 	parent.Spec.Transaction.Context = map[string]string{
 		"namespace":     defaultNamespace,
@@ -150,13 +264,297 @@ func TestValidateChildTaskAgainstParentTransactionRejectsEnabledBashOutsideAllow
 	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{
 		Type:                corev1alpha1.AgentRuntimeCodex,
 		DefaultAllowedTools: []string{"Read"},
+		DefaultAllowBash:    &allowBash,
+	}
+	child := childTaskForResearcherAgent()
+	child.Spec.Type = corev1alpha1.TaskTypeAgent
+	child.Labels = map[string]string{labels.LabelParentTask: labels.SelectorValue(parent.Name)}
+
+	err := validateChildTaskAgainstParentTransaction(context.Background(), newFakeClient(agent), parent, child, testResearcherAgentName)
+	if err == nil || !strings.Contains(err.Error(), `tool "send_message"`) {
+		t.Fatalf("validateChildTaskAgainstParentTransaction() error = %v, want injected messaging tool denial", err)
+	}
+
+	parent.Spec.Transaction.Context["allowedTools"] = `["Read","send_message","check_messages"]`
+	if err := validateChildTaskAgainstParentTransaction(context.Background(), newFakeClient(agent), parent, child, testResearcherAgentName); err != nil {
+		t.Fatalf("validateChildTaskAgainstParentTransaction() rejected allowed injected messaging tools: %v", err)
+	}
+}
+
+func TestValidateChildTaskAgainstParentTransactionDoesNotInjectMessagingIntoContainerChildren(t *testing.T) {
+	parent := parentTask()
+	parent.Spec.Transaction.Context = map[string]string{
+		"namespace":    defaultNamespace,
+		"allowedTools": `[]`,
+	}
+	child := &corev1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "container-child",
+			Namespace: defaultNamespace,
+			Labels:    map[string]string{labels.LabelParentTask: labels.SelectorValue(parent.Name)},
+		},
+		Spec: corev1alpha1.TaskSpec{Type: corev1alpha1.TaskTypeContainer},
+	}
+
+	if err := validateChildTaskAgainstParentTransaction(context.Background(), newFakeClient(), parent, child, ""); err != nil {
+		t.Fatalf("validateChildTaskAgainstParentTransaction() injected messaging into container child: %v", err)
+	}
+}
+
+func TestValidateChildTaskAgainstParentTransactionRejectsInjectedMessagingForOpenCodeDenyAll(t *testing.T) {
+	allowBash := false
+	parent := parentTask()
+	parent.Spec.Transaction.Context = map[string]string{
+		"namespace":     defaultNamespace,
+		"allowedAgents": `["researcher"]`,
+		"allowedTools":  `[]`,
+	}
+	agent := researcherAgent()
+	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{
+		Type:                corev1alpha1.AgentRuntimeOpencode,
+		DefaultAllowedTools: []string{},
+		DefaultAllowBash:    &allowBash,
 	}
 	child := childTaskForResearcherAgent()
 	child.Spec.Type = corev1alpha1.TaskTypeAgent
+	child.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{}, AllowBash: &allowBash}
+	child.Labels = map[string]string{labels.LabelParentTask: labels.SelectorValue(parent.Name)}
 
 	err := validateChildTaskAgainstParentTransaction(context.Background(), newFakeClient(agent), parent, child, testResearcherAgentName)
-	if err == nil || !strings.Contains(err.Error(), `tool "Bash"`) {
-		t.Fatalf("validateChildTaskAgainstParentTransaction() error = %v, want bash tool denial", err)
+	if err == nil || !strings.Contains(err.Error(), `tool "send_message"`) {
+		t.Fatalf("validateChildTaskAgainstParentTransaction() error = %v, want explicit deny-all to reject injected messaging tools", err)
+	}
+
+	parent.Spec.Transaction.Context["allowedTools"] = `["send_message","check_messages"]`
+	if err := validateChildTaskAgainstParentTransaction(context.Background(), newFakeClient(agent), parent, child, testResearcherAgentName); err != nil {
+		t.Fatalf("validateChildTaskAgainstParentTransaction() rejected authorized injected messaging tools: %v", err)
+	}
+
+	parent.Spec.Transaction.Context["allowedTools"] = `[]`
+	child.Annotations = map[string]string{labels.AnnotationDisableCoordinationToolInject: trueStr}
+	if err := validateChildTaskAgainstParentTransaction(context.Background(), newFakeClient(agent), parent, child, testResearcherAgentName); err != nil {
+		t.Fatalf("validateChildTaskAgainstParentTransaction() rejected deny-all with messaging injection disabled: %v", err)
+	}
+}
+
+func TestValidateChildTaskAgainstParentTransactionAuthorizesCustomToolHTTPSecret(t *testing.T) {
+	const (
+		toolName   = "custom-search"
+		secretName = "custom-search-credentials"
+	)
+	parent, agent, child := delegatedOpenCodeCustomToolTransaction(toolName)
+	tool := &corev1alpha1.Tool{
+		ObjectMeta: metav1.ObjectMeta{Name: toolName, Namespace: defaultNamespace},
+		Spec: corev1alpha1.ToolSpec{HTTP: &corev1alpha1.HTTPExecution{
+			AuthSecretRef: &corev1alpha1.SecretKeySelector{Name: secretName, Key: "token"},
+		}},
+	}
+
+	parent.Spec.Transaction.Scope = ""
+	parent.Spec.Transaction.Scopes = nil
+	err := validateChildTaskAgainstParentTransaction(context.Background(), newFakeClient(agent, tool), parent, child, testResearcherAgentName)
+	if err == nil || !strings.Contains(err.Error(), `requires transaction scope "orka:secrets:credentials:read"`) {
+		t.Fatalf("validateChildTaskAgainstParentTransaction() error = %v, want custom Tool credential scope denial", err)
+	}
+
+	parent.Spec.Transaction.Scopes = []string{"orka:secrets:credentials:read"}
+	parent.Spec.Transaction.Context["secret"] = "different-secret"
+	err = validateChildTaskAgainstParentTransaction(context.Background(), newFakeClient(agent, tool), parent, child, testResearcherAgentName)
+	if err == nil || !strings.Contains(err.Error(), secretName) || !strings.Contains(err.Error(), "does not match transaction context") {
+		t.Fatalf("validateChildTaskAgainstParentTransaction() error = %v, want custom Tool secret binding denial", err)
+	}
+
+	parent.Spec.Transaction.Context["secret"] = secretName
+	if err := validateChildTaskAgainstParentTransaction(context.Background(), newFakeClient(agent, tool), parent, child, testResearcherAgentName); err != nil {
+		t.Fatalf("validateChildTaskAgainstParentTransaction() rejected authorized custom Tool credential: %v", err)
+	}
+}
+
+func TestValidateChildTaskAgainstParentTransactionAuthorizesCustomToolOutboundCredentials(t *testing.T) {
+	const (
+		toolName   = "custom-search"
+		policyName = "resource-api"
+		secretName = "resource-assertion"
+	)
+	parent, agent, child := delegatedOpenCodeCustomToolTransaction(toolName)
+	tool := &corev1alpha1.Tool{
+		ObjectMeta: metav1.ObjectMeta{Name: toolName, Namespace: defaultNamespace},
+		Spec: corev1alpha1.ToolSpec{HTTP: &corev1alpha1.HTTPExecution{
+			OutboundAccessPolicyRef: &corev1alpha1.LocalObjectReference{Name: policyName},
+		}},
+	}
+	policy := readyChildTransactionOutboundPolicy(policyName, corev1alpha1.OutboundAccessPolicySpec{
+		Direct: &corev1alpha1.DirectOutboundAccess{
+			Subject: corev1alpha1.OutboundTokenSource{
+				Source:    corev1alpha1.OutboundTokenSourceSecretRef,
+				TokenType: "urn:example:assertion",
+				SecretRef: &corev1alpha1.NamespacedSecretKeySelector{Name: secretName, Key: "token"},
+			},
+			TokenEndpoint:           corev1alpha1.OutboundTokenEndpoint{URL: "https://identity.example.test/token"},
+			ExpectedIssuedTokenType: "urn:example:resource",
+		},
+	})
+
+	parent.Spec.Transaction.Scope = ""
+	parent.Spec.Transaction.Scopes = nil
+	err := validateChildTaskAgainstParentTransaction(context.Background(), newFakeClient(agent, tool, policy), parent, child, testResearcherAgentName)
+	if err == nil || !strings.Contains(err.Error(), `requires transaction scope "orka:secrets:credentials:read"`) {
+		t.Fatalf("validateChildTaskAgainstParentTransaction() error = %v, want outbound credential scope denial", err)
+	}
+
+	parent.Spec.Transaction.Scopes = []string{"orka:secrets:credentials:read"}
+	parent.Spec.Transaction.Context["secret"] = "different-secret"
+	err = validateChildTaskAgainstParentTransaction(context.Background(), newFakeClient(agent, tool, policy), parent, child, testResearcherAgentName)
+	if err == nil || !strings.Contains(err.Error(), secretName) || !strings.Contains(err.Error(), "does not match transaction context") {
+		t.Fatalf("validateChildTaskAgainstParentTransaction() error = %v, want outbound secret binding denial", err)
+	}
+
+	parent.Spec.Transaction.Context["secret"] = secretName
+	if err := validateChildTaskAgainstParentTransaction(context.Background(), newFakeClient(agent, tool, policy), parent, child, testResearcherAgentName); err != nil {
+		t.Fatalf("validateChildTaskAgainstParentTransaction() rejected authorized outbound credential: %v", err)
+	}
+}
+
+func TestValidateChildTaskAgainstParentTransactionFailsClosedOnCustomToolDependencies(t *testing.T) {
+	const (
+		toolName   = "custom-search"
+		policyName = "resource-api"
+	)
+	parent, agent, child := delegatedOpenCodeCustomToolTransaction(toolName)
+
+	t.Run("unresolved Tool", func(t *testing.T) {
+		err := validateChildTaskAgainstParentTransaction(context.Background(), newFakeClient(agent), parent, child, testResearcherAgentName)
+		if err == nil || !strings.Contains(err.Error(), `tool "custom-search" is unresolved`) {
+			t.Fatalf("validateChildTaskAgainstParentTransaction() error = %v, want unresolved Tool denial", err)
+		}
+	})
+
+	tool := &corev1alpha1.Tool{
+		ObjectMeta: metav1.ObjectMeta{Name: toolName, Namespace: defaultNamespace},
+		Spec: corev1alpha1.ToolSpec{HTTP: &corev1alpha1.HTTPExecution{
+			OutboundAccessPolicyRef: &corev1alpha1.LocalObjectReference{Name: policyName},
+		}},
+	}
+	t.Run("unresolved OutboundAccessPolicy", func(t *testing.T) {
+		err := validateChildTaskAgainstParentTransaction(context.Background(), newFakeClient(agent, tool), parent, child, testResearcherAgentName)
+		if err == nil || !strings.Contains(err.Error(), `references unresolved OutboundAccessPolicy "resource-api"`) {
+			t.Fatalf("validateChildTaskAgainstParentTransaction() error = %v, want unresolved policy denial", err)
+		}
+	})
+
+	policy := readyChildTransactionOutboundPolicy(policyName, corev1alpha1.OutboundAccessPolicySpec{
+		Direct: &corev1alpha1.DirectOutboundAccess{
+			Subject:       corev1alpha1.OutboundTokenSource{Source: corev1alpha1.OutboundTokenSourceTransactionToken},
+			TokenEndpoint: corev1alpha1.OutboundTokenEndpoint{URL: "https://identity.example.test/token"},
+		},
+	})
+	policy.Status.Conditions[1].Status = metav1.ConditionFalse
+	t.Run("not-ready OutboundAccessPolicy", func(t *testing.T) {
+		err := validateChildTaskAgainstParentTransaction(context.Background(), newFakeClient(agent, tool, policy), parent, child, testResearcherAgentName)
+		if err == nil || !strings.Contains(err.Error(), `references not-ready OutboundAccessPolicy "resource-api"`) {
+			t.Fatalf("validateChildTaskAgainstParentTransaction() error = %v, want not-ready policy denial", err)
+		}
+	})
+}
+
+func TestChildTransactionCredentialRequirementsCollectsOutboundCredentialSources(t *testing.T) {
+	tests := []struct {
+		name        string
+		spec        corev1alpha1.OutboundAccessPolicySpec
+		wantSecrets []string
+	}{
+		{
+			name: "direct secret sources",
+			spec: corev1alpha1.OutboundAccessPolicySpec{Direct: &corev1alpha1.DirectOutboundAccess{
+				Subject: corev1alpha1.OutboundTokenSource{
+					Source:    corev1alpha1.OutboundTokenSourceSecretRef,
+					SecretRef: &corev1alpha1.NamespacedSecretKeySelector{Name: "subject-secret", Key: "token"},
+				},
+				Actor: &corev1alpha1.OutboundTokenSource{
+					Source:    corev1alpha1.OutboundTokenSourceSecretRef,
+					SecretRef: &corev1alpha1.NamespacedSecretKeySelector{Name: "actor-secret", Key: "token"},
+				},
+				TokenEndpoint: corev1alpha1.OutboundTokenEndpoint{TLS: &corev1alpha1.OutboundTLSConfig{
+					CASecretRef: &corev1alpha1.NamespacedSecretKeySelector{Name: "token-ca", Key: "ca.crt"},
+				}},
+				ClientAuthentication: &corev1alpha1.OutboundClientAuthentication{
+					ClientSecretRef: &corev1alpha1.NamespacedSecretKeySelector{Name: "client-secret", Key: "secret"},
+					PrivateKeyRef:   &corev1alpha1.NamespacedSecretKeySelector{Name: "private-key", Key: "key.pem"},
+				},
+			}},
+			wantSecrets: []string{"actor-secret", "client-secret", "private-key", "subject-secret", "token-ca"},
+		},
+		{
+			name: "service account source",
+			spec: corev1alpha1.OutboundAccessPolicySpec{Direct: &corev1alpha1.DirectOutboundAccess{
+				Subject: corev1alpha1.OutboundTokenSource{Source: corev1alpha1.OutboundTokenSourceServiceAccount},
+			}},
+		},
+		{
+			name: "gateway CA",
+			spec: corev1alpha1.OutboundAccessPolicySpec{Gateway: &corev1alpha1.GatewayOutboundAccess{
+				TLS: &corev1alpha1.OutboundTLSConfig{CASecretRef: &corev1alpha1.NamespacedSecretKeySelector{
+					Name: "gateway-ca", Key: "ca.crt",
+				}},
+			}},
+			wantSecrets: []string{"gateway-ca"},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			requirements := childTransactionCredentialRequirements{}
+			policy := readyChildTransactionOutboundPolicy("resource-api", test.spec)
+			if err := requirements.addOutboundAccessPolicy(policy); err != nil {
+				t.Fatalf("addOutboundAccessPolicy() error = %v", err)
+			}
+			if !requirements.requiresScope {
+				t.Fatal("addOutboundAccessPolicy() did not require credential-read scope")
+			}
+			gotSecrets := make([]string, 0, len(requirements.secretNames))
+			for name := range requirements.secretNames {
+				gotSecrets = append(gotSecrets, name)
+			}
+			slices.Sort(gotSecrets)
+			if !slices.Equal(gotSecrets, test.wantSecrets) {
+				t.Fatalf("credential secrets = %#v, want %#v", gotSecrets, test.wantSecrets)
+			}
+		})
+	}
+}
+
+func delegatedOpenCodeCustomToolTransaction(toolName string) (*corev1alpha1.Task, *corev1alpha1.Agent, *corev1alpha1.Task) {
+	allowBash := false
+	parent := parentTask()
+	parent.Spec.Transaction.Context = map[string]string{
+		"namespace":     defaultNamespace,
+		"allowedAgents": `["researcher"]`,
+		"allowedTools":  `["` + toolName + `","send_message","check_messages"]`,
+	}
+	agent := researcherAgent()
+	agent.Spec.Runtime = &corev1alpha1.AgentCLIRuntime{
+		Type:                corev1alpha1.AgentRuntimeOpencode,
+		DefaultAllowedTools: []string{toolName},
+		DefaultAllowBash:    &allowBash,
+	}
+	child := childTaskForResearcherAgent()
+	child.Spec.Type = corev1alpha1.TaskTypeAgent
+	child.Labels = map[string]string{labels.LabelParentTask: labels.SelectorValue(parent.Name)}
+	return parent, agent, child
+}
+
+func readyChildTransactionOutboundPolicy(name string, spec corev1alpha1.OutboundAccessPolicySpec) *corev1alpha1.OutboundAccessPolicy {
+	const generation = int64(2)
+	return &corev1alpha1.OutboundAccessPolicy{
+		ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: defaultNamespace, Generation: generation},
+		Spec:       spec,
+		Status: corev1alpha1.OutboundAccessPolicyStatus{
+			ObservedGeneration: generation,
+			Conditions: []metav1.Condition{
+				{Type: corev1alpha1.OutboundAccessPolicyConditionAccepted, Status: metav1.ConditionTrue, ObservedGeneration: generation},
+				{Type: corev1alpha1.OutboundAccessPolicyConditionResolvedRefs, Status: metav1.ConditionTrue, ObservedGeneration: generation},
+			},
+		},
 	}
 }
 
@@ -213,3 +611,194 @@ func childTaskForResearcherAgent() *corev1alpha1.Task {
 		},
 	}
 }
+
+func TestChildTransactionEffectiveRuntimePolicyNormalizesOpenCode(t *testing.T) {
+	allowBash := false
+	agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+		Type: corev1alpha1.AgentRuntimeOpencode,
+	}}}
+	child := &corev1alpha1.Task{}
+	tools, bash := childTransactionEffectiveRuntimePolicy(child, agent)
+	if want := []string{"glob", "read"}; !slices.Equal(tools, want) {
+		t.Fatalf("read-intent tools = %#v, want %#v", tools, want)
+	}
+	if bash {
+		t.Fatal("read-intent policy retained bash")
+	}
+
+	agent.Spec.Runtime.DefaultAllowedTools = []string{"Edit"}
+	agent.Spec.Runtime.DefaultAllowBash = &allowBash
+	child.Spec.Workspace = &corev1alpha1.WorkspaceConfig{Intent: corev1alpha1.WorkspaceIntentWrite}
+	tools, bash = childTransactionEffectiveRuntimePolicy(child, agent)
+	if want := []string{"apply_patch", "edit", "write"}; !slices.Equal(tools, want) {
+		t.Fatalf("write-intent tools = %#v, want %#v", tools, want)
+	}
+	if bash {
+		t.Fatal("write-intent policy changed explicit bash denial")
+	}
+
+	child.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{DisallowedTools: []string{"write"}, AllowBash: &allowBash}
+	tools, _ = childTransactionEffectiveRuntimePolicy(child, agent)
+	if tools == nil || len(tools) != 0 {
+		t.Fatalf("disallowed mutation alias tools = %#v, want non-nil empty", tools)
+	}
+
+	agent.Spec.Runtime.DefaultAllowedTools = []string{}
+	child.Spec.AgentRuntime = nil
+	tools, _ = childTransactionEffectiveRuntimePolicy(child, agent)
+	if tools == nil || len(tools) != 0 {
+		t.Fatalf("explicit empty tools = %#v, want non-nil empty", tools)
+	}
+
+	agent.Spec.Runtime.DefaultAllowedTools = nil
+	child.Spec.AgentRuntime = &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{}}
+	tools, _ = childTransactionEffectiveRuntimePolicy(child, agent)
+	if tools == nil || len(tools) != 0 {
+		t.Fatalf("explicit empty task override = %#v, want non-nil empty", tools)
+	}
+}
+
+func TestChildTransactionEffectiveRuntimePolicyNormalizesBuiltInNarrowing(t *testing.T) {
+	allowBash := false
+	runtimes := []corev1alpha1.AgentRuntimeType{
+		corev1alpha1.AgentRuntimeClaude,
+		corev1alpha1.AgentRuntimeCodex,
+		corev1alpha1.AgentRuntimeCopilot,
+	}
+	for _, runtimeType := range runtimes {
+		t.Run(string(runtimeType), func(t *testing.T) {
+			agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{Type: runtimeType}}}
+
+			t.Run("unrestricted remains nil", func(t *testing.T) {
+				tools, bash := childTransactionEffectiveRuntimePolicy(&corev1alpha1.Task{}, agent)
+				if tools != nil || !bash {
+					t.Fatalf("unrestricted policy = %#v allowBash=%v, want nil allowBash=true", tools, bash)
+				}
+			})
+
+			t.Run("explicit empty remains deny all", func(t *testing.T) {
+				child := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{
+					Type:         corev1alpha1.TaskTypeAgent,
+					AgentRuntime: &corev1alpha1.AgentRuntimeSpec{AllowedTools: []string{}, AllowBash: &allowBash},
+				}}
+				tools, bash := childTransactionEffectiveRuntimePolicy(child, agent)
+				if tools == nil || len(tools) != 0 || bash {
+					t.Fatalf("explicit deny-all policy = %#v allowBash=%v, want non-nil empty allowBash=false", tools, bash)
+				}
+				if err := validateChildToolConstraints(map[string]string{"allowedTools": `[]`}, childTransactionContext{
+					childType: child.Spec.Type, agent: agent, runtimeTools: tools, runtimeBash: bash,
+				}); err != nil {
+					t.Fatalf("explicit deny-all subset rejected: %v", err)
+				}
+			})
+
+			t.Run("explicit allowlist without bash closes effective bash", func(t *testing.T) {
+				explicitAgent := agent.DeepCopy()
+				explicitAgent.Spec.Runtime.DefaultAllowedTools = []string{"Read"}
+				tools, bash := childTransactionEffectiveRuntimePolicy(&corev1alpha1.Task{}, explicitAgent)
+				if !slices.Equal(tools, []string{"Read"}) || bash {
+					t.Fatalf("explicit read-only policy = %#v allowBash=%v, want Read with allowBash=false", tools, bash)
+				}
+			})
+
+			t.Run("deny only expands implicit native tools", func(t *testing.T) {
+				child := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{
+					Type:         corev1alpha1.TaskTypeAgent,
+					AgentRuntime: &corev1alpha1.AgentRuntimeSpec{DisallowedTools: []string{"Write"}},
+				}}
+				tools, bash := childTransactionEffectiveRuntimePolicy(child, agent)
+				want := []string{"Bash", "Edit", "Glob", "Grep", "Read", "WebFetch", "WebSearch"}
+				if !slices.Equal(tools, want) || !bash {
+					t.Fatalf("deny-only policy = %#v allowBash=%v, want %#v allowBash=true", tools, bash, want)
+				}
+				if err := validateChildToolConstraints(map[string]string{
+					"allowedTools": `["Bash","Edit","Glob","Grep","Read","WebFetch","WebSearch"]`,
+				}, childTransactionContext{
+					childType: child.Spec.Type, agent: agent, runtimeTools: tools, runtimeBash: bash,
+				}); err != nil {
+					t.Fatalf("deny-only subset rejected: %v", err)
+				}
+			})
+
+			t.Run("bash disabled expands implicit native tools", func(t *testing.T) {
+				child := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{
+					Type:         corev1alpha1.TaskTypeAgent,
+					AgentRuntime: &corev1alpha1.AgentRuntimeSpec{AllowBash: &allowBash},
+				}}
+				tools, bash := childTransactionEffectiveRuntimePolicy(child, agent)
+				want := []string{"Edit", "Glob", "Grep", "Read", "WebFetch", "WebSearch", "Write"}
+				if !slices.Equal(tools, want) || bash {
+					t.Fatalf("bash-disabled policy = %#v allowBash=%v, want %#v allowBash=false", tools, bash, want)
+				}
+				if err := validateChildToolConstraints(map[string]string{
+					"allowedTools": `["Edit","Glob","Grep","Read","WebFetch","WebSearch","Write"]`,
+				}, childTransactionContext{
+					childType: child.Spec.Type, agent: agent, runtimeTools: tools, runtimeBash: bash,
+				}); err != nil {
+					t.Fatalf("bash-disabled subset rejected: %v", err)
+				}
+			})
+
+			t.Run("disallowed bash is removed before subset checks", func(t *testing.T) {
+				child := &corev1alpha1.Task{Spec: corev1alpha1.TaskSpec{
+					Type:         corev1alpha1.TaskTypeAgent,
+					AgentRuntime: &corev1alpha1.AgentRuntimeSpec{DisallowedTools: []string{"bAsH"}},
+				}}
+				tools, bash := childTransactionEffectiveRuntimePolicy(child, agent)
+				want := []string{"Edit", "Glob", "Grep", "Read", "WebFetch", "WebSearch", "Write"}
+				if !slices.Equal(tools, want) || bash {
+					t.Fatalf("bash-denied policy = %#v allowBash=%v, want %#v allowBash=false", tools, bash, want)
+				}
+				if err := validateChildToolConstraints(map[string]string{
+					"allowedTools": `["Edit","Glob","Grep","Read","WebFetch","WebSearch","Write"]`,
+				}, childTransactionContext{
+					childType: child.Spec.Type, agent: agent, runtimeTools: tools, runtimeBash: bash,
+				}); err != nil {
+					t.Fatalf("bash-denied subset rejected: %v", err)
+				}
+			})
+		})
+	}
+}
+
+func TestValidateChildToolConstraintsAcceptsOpenCodeDenyAll(t *testing.T) {
+	allowBash := false
+	agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+		Type: corev1alpha1.AgentRuntimeOpencode, DefaultAllowedTools: []string{}, DefaultAllowBash: &allowBash,
+	}}}
+	err := validateChildToolConstraints(map[string]string{"allowedTools": "[]"}, childTransactionContext{
+		childType: corev1alpha1.TaskTypeAgent, agent: agent, runtimeTools: []string{}, runtimeBash: false,
+	})
+	if err != nil {
+		t.Fatalf("deny-all OpenCode policy rejected: %v", err)
+	}
+}
+
+func TestValidateChildToolConstraintsNormalizesOpenCodePublicAllowlist(t *testing.T) {
+	agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+		Type: corev1alpha1.AgentRuntimeOpencode,
+	}}}
+	err := validateChildToolConstraints(map[string]string{
+		"allowedTools": `["Read","Edit","Bash"]`,
+	}, childTransactionContext{
+		childType:    corev1alpha1.TaskTypeAgent,
+		agent:        agent,
+		runtimeTools: []string{"apply_patch", "bash", "edit", "read", "write"},
+		runtimeBash:  true,
+	})
+	if err != nil {
+		t.Fatalf("public OpenCode allowlist rejected: %v", err)
+	}
+}
+
+func TestValidateChildToolConstraintsAcceptsGenericDenyAll(t *testing.T) {
+	agent := &corev1alpha1.Agent{Spec: corev1alpha1.AgentSpec{Runtime: &corev1alpha1.AgentCLIRuntime{
+		Type: corev1alpha1.AgentRuntimeCodex, DefaultAllowedTools: []string{},
+	}}}
+	err := validateChildToolConstraints(map[string]string{"allowedTools": "[]"}, childTransactionContext{
+		childType: corev1alpha1.TaskTypeAgent, agent: agent, runtimeTools: []string{}, runtimeBash: false,
+	})
+	if err != nil {
+		t.Fatalf("deny-all generic runtime policy rejected: %v", err)
+	}
+}
diff --git a/internal/tools/update_agent.go b/internal/tools/update_agent.go
index ea5fdd48e..8b3b68e4b 100644
--- a/internal/tools/update_agent.go
+++ b/internal/tools/update_agent.go
@@ -27,9 +27,15 @@ func (t *UpdateAgentTool) Description() string {
 }
 
 func (t *UpdateAgentTool) Parameters() json.RawMessage {
-	return mustMarshalSchema(map[string]any{jsonSchemaTypeField: jsonSchemaTypeObject, jsonSchemaPropertiesField: map[string]any{nameField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: agentNameDescription}, namespaceField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: namespaceDescription}, systemPromptField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "System prompt for the agent"}, toolsField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeArray, itemsField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString}, jsonSchemaDescriptionField: "Tool names to attach"}, modelField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeObject, jsonSchemaPropertiesField: map[string]any{
-		"provider": map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Model provider (e.g. anthropic, openai)"}, nameField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Model name"}, "temperature": map[string]any{jsonSchemaTypeField: "number", jsonSchemaDescriptionField: "Sampling temperature"},
+	return mustMarshalSchema(map[string]any{jsonSchemaTypeField: jsonSchemaTypeObject, jsonSchemaPropertiesField: map[string]any{nameField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: agentNameDescription}, namespaceField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: namespaceDescription}, systemPromptField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "System prompt for the agent. OpenCode runtime Agents do not support Agent system prompts; use Task prompts instead."}, toolsField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeArray, itemsField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeString}, jsonSchemaDescriptionField: "Tool names to attach"}, modelField: map[string]any{jsonSchemaTypeField: jsonSchemaTypeObject, jsonSchemaPropertiesField: map[string]any{
+		"provider": map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Model provider (e.g. anthropic, openai). For OpenCode this is normalized into model.name."},
+		nameField:  map[string]any{jsonSchemaTypeField: jsonSchemaTypeString, jsonSchemaDescriptionField: "Model name. OpenCode accepts a provider/model ID or a bare model name when the existing provider is retained."},
+		"temperature": map[string]any{jsonSchemaTypeField: "number", "minimum": 0, "maximum": 2,
+			jsonSchemaDescriptionField: "Sampling temperature. OpenCode only accepts the legacy default 0.7."},
+		"contextWindow": map[string]any{jsonSchemaTypeField: jsonSchemaTypeInteger, "minimum": 1, jsonSchemaDescriptionField: "Reviewed model context capacity; required for OpenCode"},
+		"maxTokens":     map[string]any{jsonSchemaTypeField: jsonSchemaTypeInteger, "minimum": 1, jsonSchemaDescriptionField: "Reviewed maximum output tokens; required for OpenCode"},
 	},
+		jsonSchemaDescriptionField: "Partial model update. Omitted fields preserve their existing values.",
 	},
 	}, jsonSchemaRequiredField: []string{nameField},
 	})
@@ -58,23 +64,29 @@ func (t *UpdateAgentTool) Execute(ctx context.Context, args json.RawMessage) (st
 		return classifyChatK8sErr(err)
 	}
 
-	// Update specified fields
-	if modelProvider := chatGetStringArg(a, modelField); modelProvider != "" {
-		parts := strings.SplitN(modelProvider, "/", 2)
-		if agent.Spec.Model == nil {
-			agent.Spec.Model = &corev1alpha1.ModelConfig{}
+	requestedSystemPrompt := chatGetStringArg(a, systemPromptField)
+
+	if rawModel, supplied := a[modelField]; supplied {
+		modelUpdate, err := parseAgentModelUpdate(rawModel)
+		if err != nil {
+			return ChatToolErrorResult(
+				"invalid_arguments",
+				err.Error(),
+				"Provide model as an object with valid provider, name, temperature, contextWindow, and maxTokens fields.",
+			)
 		}
-		if len(parts) == 2 {
-			agent.Spec.Model.Provider = parts[0]
-			agent.Spec.Model.Name = parts[1]
-		} else {
-			agent.Spec.Model.Name = modelProvider
+		if err := applyAgentModelUpdate(agent, modelUpdate); err != nil {
+			return ChatToolErrorResult(
+				"invalid_arguments",
+				err.Error(),
+				"Use a consistent provider/model ID and reviewed model limits.",
+			)
 		}
 	}
 
-	if systemPrompt := chatGetStringArg(a, systemPromptField); systemPrompt != "" {
+	if requestedSystemPrompt != "" {
 		agent.Spec.SystemPrompt = &corev1alpha1.PromptSource{
-			Inline: systemPrompt,
+			Inline: requestedSystemPrompt,
 		}
 	}
 
@@ -85,6 +97,20 @@ func (t *UpdateAgentTool) Execute(ctx context.Context, args json.RawMessage) (st
 		}
 	}
 
+	if isOpenCodeAgent(agent) {
+		if agent.Spec.SystemPrompt != nil &&
+			(strings.TrimSpace(agent.Spec.SystemPrompt.Inline) != "" || agent.Spec.SystemPrompt.ConfigMapRef != nil) {
+			return ChatToolErrorResult(
+				"invalid_arguments",
+				"opencode runtime does not support systemPrompt",
+				"Remove spec.systemPrompt and use Task prompts for OpenCode instructions.",
+			)
+		}
+		if result, ok := normalizeChatOpenCodeModel(agent); !ok {
+			return result, nil
+		}
+	}
+
 	// Re-fetch before update to avoid conflicts
 	latest := &corev1alpha1.Agent{}
 	if err := tc.Client.Get(ctx, types.NamespacedName{Name: name, Namespace: namespace}, latest); err != nil {
diff --git a/internal/tools/update_agent_test.go b/internal/tools/update_agent_test.go
index 9d8a1cb8b..c7de37168 100644
--- a/internal/tools/update_agent_test.go
+++ b/internal/tools/update_agent_test.go
@@ -9,6 +9,8 @@ package tools
 import (
 	"context"
 	"encoding/json"
+	"reflect"
+	"strings"
 	"testing"
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -53,6 +55,24 @@ func TestUpdateAgentTool_Parameters(t *testing.T) {
 			t.Errorf("missing %s property", key)
 		}
 	}
+	systemPrompt, ok := props[systemPromptField].(map[string]any)
+	description, _ := systemPrompt[jsonSchemaDescriptionField].(string)
+	if !ok || !strings.Contains(description, "OpenCode runtime Agents do not support") {
+		t.Fatalf("systemPrompt schema = %#v, want OpenCode restriction guidance", systemPrompt)
+	}
+	model, ok := props[modelField].(map[string]any)
+	if !ok {
+		t.Fatalf("model schema = %#v, want object", props[modelField])
+	}
+	modelProps, ok := model[jsonSchemaPropertiesField].(map[string]any)
+	if !ok {
+		t.Fatalf("model properties = %#v, want object", model[jsonSchemaPropertiesField])
+	}
+	for _, key := range []string{"provider", nameField, "temperature", "contextWindow", "maxTokens"} {
+		if _, ok := modelProps[key]; !ok {
+			t.Errorf("model schema missing %s property", key)
+		}
+	}
 }
 
 func TestUpdateAgentTool_Execute(t *testing.T) {
@@ -199,6 +219,385 @@ func TestUpdateAgentTool_Execute_VerifyUpdatedFields(t *testing.T) {
 	}
 }
 
+func TestUpdateAgentTool_Execute_UpdatesNestedModelFields(t *testing.T) {
+	temperature := 0.2
+	contextWindow := int32(32768)
+	maxTokens := int32(4096)
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: testMyAgentName, Namespace: defaultNamespace},
+		Spec: corev1alpha1.AgentSpec{Model: &corev1alpha1.ModelConfig{
+			Provider:      providerOpenAI,
+			Name:          testGPT4OModel,
+			Temperature:   &temperature,
+			ContextWindow: &contextWindow,
+			MaxTokens:     &maxTokens,
+		}},
+	}
+	fc := newFakeClient(agent)
+	ctx := WithToolContext(context.Background(), &ToolContext{Client: fc, Namespace: defaultNamespace})
+	result, err := (&UpdateAgentTool{}).Execute(ctx, json.RawMessage(`{
+		"name":"my-agent",
+		"model":{"provider":"anthropic","name":"claude-sonnet-4-20250514","temperature":0.4,"contextWindow":200000,"maxTokens":8192}
+	}`))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	var response ChatToolResult
+	if err := json.Unmarshal([]byte(result), &response); err != nil {
+		t.Fatalf("failed to parse result: %v", err)
+	}
+	if !response.Success {
+		t.Fatalf("expected success, got error: %s", response.Error)
+	}
+
+	var updated corev1alpha1.Agent
+	if err := fc.Get(context.Background(), apitypes.NamespacedName{Name: testMyAgentName, Namespace: defaultNamespace}, &updated); err != nil {
+		t.Fatal(err)
+	}
+	if updated.Spec.Model == nil || updated.Spec.Model.Provider != "anthropic" || updated.Spec.Model.Name != "claude-sonnet-4-20250514" {
+		t.Fatalf("model identity = %#v, want nested provider/name update", updated.Spec.Model)
+	}
+	if updated.Spec.Model.Temperature == nil || *updated.Spec.Model.Temperature != 0.4 {
+		t.Fatalf("model.temperature = %#v, want 0.4", updated.Spec.Model.Temperature)
+	}
+	if updated.Spec.Model.ContextWindow == nil || *updated.Spec.Model.ContextWindow != 200000 {
+		t.Fatalf("model.contextWindow = %#v, want 200000", updated.Spec.Model.ContextWindow)
+	}
+	if updated.Spec.Model.MaxTokens == nil || *updated.Spec.Model.MaxTokens != 8192 {
+		t.Fatalf("model.maxTokens = %#v, want 8192", updated.Spec.Model.MaxTokens)
+	}
+}
+
+func TestUpdateAgentTool_Execute_LegacyModelStringKeepsProviderBackedSplitting(t *testing.T) {
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: testMyAgentName, Namespace: defaultNamespace},
+		Spec: corev1alpha1.AgentSpec{Model: &corev1alpha1.ModelConfig{
+			Provider: providerOpenAI,
+			Name:     testGPT4OModel,
+		}},
+	}
+	fc := newFakeClient(agent)
+	ctx := WithToolContext(context.Background(), &ToolContext{Client: fc, Namespace: defaultNamespace})
+	result, err := (&UpdateAgentTool{}).Execute(ctx, json.RawMessage(`{
+		"name":"my-agent",
+		"model":"anthropic/claude-haiku-4-5"
+	}`))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	var response ChatToolResult
+	if err := json.Unmarshal([]byte(result), &response); err != nil {
+		t.Fatalf("failed to parse result: %v", err)
+	}
+	if !response.Success {
+		t.Fatalf("expected success, got error: %s", response.Error)
+	}
+
+	var updated corev1alpha1.Agent
+	if err := fc.Get(context.Background(), apitypes.NamespacedName{Name: testMyAgentName, Namespace: defaultNamespace}, &updated); err != nil {
+		t.Fatal(err)
+	}
+	if updated.Spec.Model == nil || updated.Spec.Model.Provider != "anthropic" || updated.Spec.Model.Name != "claude-haiku-4-5" {
+		t.Fatalf("model identity = %#v, want legacy provider/name split", updated.Spec.Model)
+	}
+}
+
+func TestUpdateAgentTool_Execute_RejectsModelLimitsForNonOpenCodeBuiltIns(t *testing.T) {
+	for _, tt := range []struct {
+		name      string
+		runtime   corev1alpha1.AgentRuntimeType
+		modelJSON string
+		wantError string
+	}{
+		{name: "codex context window", runtime: corev1alpha1.AgentRuntimeCodex, modelJSON: `{"contextWindow":32768}`, wantError: "contextWindow"},
+		{name: "claude max tokens", runtime: corev1alpha1.AgentRuntimeClaude, modelJSON: `{"maxTokens":4096}`, wantError: "maxTokens"},
+		{name: "copilot context window", runtime: corev1alpha1.AgentRuntimeCopilot, modelJSON: `{"contextWindow":32768}`, wantError: "contextWindow"},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			original := &corev1alpha1.Agent{
+				ObjectMeta: metav1.ObjectMeta{Name: testMyAgentName, Namespace: defaultNamespace},
+				Spec: corev1alpha1.AgentSpec{
+					Runtime: &corev1alpha1.AgentCLIRuntime{Type: tt.runtime},
+					Model:   &corev1alpha1.ModelConfig{Name: "model"},
+				},
+			}
+			fc := newFakeClient(original.DeepCopy())
+			ctx := WithToolContext(context.Background(), &ToolContext{Client: fc, Namespace: defaultNamespace})
+			result, err := (&UpdateAgentTool{}).Execute(ctx, json.RawMessage(`{"name":"my-agent","model":`+tt.modelJSON+`}`))
+			if err != nil {
+				t.Fatal(err)
+			}
+			var response ChatToolResult
+			if err := json.Unmarshal([]byte(result), &response); err != nil {
+				t.Fatal(err)
+			}
+			if response.Success || !strings.Contains(response.Error, tt.wantError) {
+				t.Fatalf("response = %#v, want %q rejection", response, tt.wantError)
+			}
+			var persisted corev1alpha1.Agent
+			if err := fc.Get(context.Background(), apitypes.NamespacedName{Name: testMyAgentName, Namespace: defaultNamespace}, &persisted); err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(persisted.Spec, original.Spec) {
+				t.Fatalf("persisted spec changed after rejection: got %#v want %#v", persisted.Spec, original.Spec)
+			}
+		})
+	}
+}
+
+func TestUpdateAgentTool_Execute_NormalizesOpenCodeModelAndPreservesOmittedFields(t *testing.T) {
+	temperature := 0.7
+	contextWindow := int32(32768)
+	maxTokens := int32(4096)
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: testMyAgentName, Namespace: defaultNamespace},
+		Spec: corev1alpha1.AgentSpec{
+			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeOpencode},
+			Model: &corev1alpha1.ModelConfig{
+				Name:          "openai/gpt-5.4",
+				Temperature:   &temperature,
+				ContextWindow: &contextWindow,
+				MaxTokens:     &maxTokens,
+			},
+		},
+	}
+	fc := newFakeClient(agent)
+	ctx := WithToolContext(context.Background(), &ToolContext{Client: fc, Namespace: defaultNamespace})
+	result, err := (&UpdateAgentTool{}).Execute(ctx, json.RawMessage(`{
+		"name":"my-agent",
+		"model":{"name":"gpt-5.5"}
+	}`))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	var response ChatToolResult
+	if err := json.Unmarshal([]byte(result), &response); err != nil {
+		t.Fatalf("failed to parse result: %v", err)
+	}
+	if !response.Success {
+		t.Fatalf("expected success, got error: %s", response.Error)
+	}
+
+	var updated corev1alpha1.Agent
+	if err := fc.Get(context.Background(), apitypes.NamespacedName{Name: testMyAgentName, Namespace: defaultNamespace}, &updated); err != nil {
+		t.Fatal(err)
+	}
+	if updated.Spec.Model == nil || updated.Spec.Model.Name != "openai/gpt-5.5" || updated.Spec.Model.Provider != "" {
+		t.Fatalf("model identity = %#v, want normalized OpenCode model", updated.Spec.Model)
+	}
+	if updated.Spec.Model.Temperature == nil || *updated.Spec.Model.Temperature != temperature ||
+		updated.Spec.Model.ContextWindow == nil || *updated.Spec.Model.ContextWindow != contextWindow ||
+		updated.Spec.Model.MaxTokens == nil || *updated.Spec.Model.MaxTokens != maxTokens {
+		t.Fatalf("model = %#v, want omitted controls preserved", updated.Spec.Model)
+	}
+}
+
+func TestUpdateAgentTool_Execute_PreservesNestedOpenCodeLegacyModelString(t *testing.T) {
+	agent := testOpenCodeAgent()
+	fc := newFakeClient(agent)
+	ctx := WithToolContext(context.Background(), &ToolContext{Client: fc, Namespace: defaultNamespace})
+	result, err := (&UpdateAgentTool{}).Execute(ctx, json.RawMessage(`{
+		"name":"my-agent",
+		"model":"openrouter/anthropic/claude-sonnet-4"
+	}`))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	var response ChatToolResult
+	if err := json.Unmarshal([]byte(result), &response); err != nil {
+		t.Fatalf("failed to parse result: %v", err)
+	}
+	if !response.Success {
+		t.Fatalf("expected success, got error: %s", response.Error)
+	}
+
+	var updated corev1alpha1.Agent
+	if err := fc.Get(context.Background(), apitypes.NamespacedName{Name: testMyAgentName, Namespace: defaultNamespace}, &updated); err != nil {
+		t.Fatal(err)
+	}
+	if updated.Spec.Model == nil || updated.Spec.Model.Name != "openrouter/anthropic/claude-sonnet-4" || updated.Spec.Model.Provider != "" {
+		t.Fatalf("model identity = %#v, want full nested OpenCode model ID", updated.Spec.Model)
+	}
+}
+
+func TestUpdateAgentTool_Execute_PreservesNestedOpenCodeObjectModelName(t *testing.T) {
+	agent := testOpenCodeAgent()
+	fc := newFakeClient(agent)
+	ctx := WithToolContext(context.Background(), &ToolContext{Client: fc, Namespace: defaultNamespace})
+	result, err := (&UpdateAgentTool{}).Execute(ctx, json.RawMessage(`{
+		"name":"my-agent",
+		"model":{"name":"openrouter/google/gemini-3.1-pro"}
+	}`))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	var response ChatToolResult
+	if err := json.Unmarshal([]byte(result), &response); err != nil {
+		t.Fatalf("failed to parse result: %v", err)
+	}
+	if !response.Success {
+		t.Fatalf("expected success, got error: %s", response.Error)
+	}
+
+	var updated corev1alpha1.Agent
+	if err := fc.Get(context.Background(), apitypes.NamespacedName{Name: testMyAgentName, Namespace: defaultNamespace}, &updated); err != nil {
+		t.Fatal(err)
+	}
+	if updated.Spec.Model == nil || updated.Spec.Model.Name != "openrouter/google/gemini-3.1-pro" || updated.Spec.Model.Provider != "" {
+		t.Fatalf("model identity = %#v, want full nested OpenCode object model ID", updated.Spec.Model)
+	}
+}
+
+func TestUpdateAgentTool_Execute_UpdatesAllOpenCodeModelFields(t *testing.T) {
+	contextWindow := int32(32768)
+	maxTokens := int32(4096)
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: testMyAgentName, Namespace: defaultNamespace},
+		Spec: corev1alpha1.AgentSpec{
+			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeOpencode},
+			Model: &corev1alpha1.ModelConfig{
+				Name:          "openai/gpt-5.4",
+				ContextWindow: &contextWindow,
+				MaxTokens:     &maxTokens,
+			},
+		},
+	}
+	fc := newFakeClient(agent)
+	ctx := WithToolContext(context.Background(), &ToolContext{Client: fc, Namespace: defaultNamespace})
+	result, err := (&UpdateAgentTool{}).Execute(ctx, json.RawMessage(`{
+		"name":"my-agent",
+		"model":{"provider":"anthropic","name":"claude-sonnet-4-20250514","temperature":0.7,"contextWindow":200000,"maxTokens":8192}
+	}`))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	var response ChatToolResult
+	if err := json.Unmarshal([]byte(result), &response); err != nil {
+		t.Fatalf("failed to parse result: %v", err)
+	}
+	if !response.Success {
+		t.Fatalf("expected success, got error: %s", response.Error)
+	}
+
+	var updated corev1alpha1.Agent
+	if err := fc.Get(context.Background(), apitypes.NamespacedName{Name: testMyAgentName, Namespace: defaultNamespace}, &updated); err != nil {
+		t.Fatal(err)
+	}
+	if updated.Spec.Model == nil || updated.Spec.Model.Name != "anthropic/claude-sonnet-4-20250514" || updated.Spec.Model.Provider != "" {
+		t.Fatalf("model identity = %#v, want normalized OpenCode provider/model", updated.Spec.Model)
+	}
+	if updated.Spec.Model.Temperature == nil || *updated.Spec.Model.Temperature != 0.7 ||
+		updated.Spec.Model.ContextWindow == nil || *updated.Spec.Model.ContextWindow != 200000 ||
+		updated.Spec.Model.MaxTokens == nil || *updated.Spec.Model.MaxTokens != 8192 {
+		t.Fatalf("model controls = %#v, want all nested fields persisted", updated.Spec.Model)
+	}
+}
+
+func TestUpdateAgentTool_Execute_RejectsInvalidOpenCodeModelUpdates(t *testing.T) {
+	tests := []struct {
+		name      string
+		modelJSON string
+		wantError string
+	}{
+		{name: "unsupported temperature", modelJSON: `{"temperature":1}`, wantError: "temperature"},
+		{name: "invalid token limits", modelJSON: `{"contextWindow":4096,"maxTokens":4096}`, wantError: "must exceed"},
+		{name: "substitution model", modelJSON: `{"name":"{env:PROVIDER}/gpt"}`, wantError: "substitution braces"},
+		{name: "conflicting provider", modelJSON: `{"provider":"anthropic","name":"openai/gpt-5.4"}`, wantError: "provider"},
+		{name: "nested model with conflicting provider", modelJSON: `{"provider":"openrouter","name":"anthropic/claude-sonnet-4"}`, wantError: "provider"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			original := testOpenCodeAgent()
+			fc := newFakeClient(original.DeepCopy())
+			ctx := WithToolContext(context.Background(), &ToolContext{Client: fc, Namespace: defaultNamespace})
+			result, err := (&UpdateAgentTool{}).Execute(ctx, json.RawMessage(`{"name":"my-agent","model":`+tt.modelJSON+`}`))
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			var response ChatToolResult
+			if err := json.Unmarshal([]byte(result), &response); err != nil {
+				t.Fatalf("failed to parse result: %v", err)
+			}
+			if response.Success || response.ErrorType != errTypeInvalidArgs || !strings.Contains(response.Error, tt.wantError) {
+				t.Fatalf("response = %#v, want rejection containing %q", response, tt.wantError)
+			}
+
+			var persisted corev1alpha1.Agent
+			if err := fc.Get(context.Background(), apitypes.NamespacedName{Name: testMyAgentName, Namespace: defaultNamespace}, &persisted); err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(persisted.Spec, original.Spec) {
+				t.Fatalf("persisted spec changed after rejected update:\n got: %#v\nwant: %#v", persisted.Spec, original.Spec)
+			}
+		})
+	}
+}
+
+func TestUpdateAgentTool_Execute_RejectsUnusableResultingOpenCodeAgent(t *testing.T) {
+	agent := testOpenCodeAgent()
+	unsupportedTemperature := 1.0
+	agent.Spec.Model.Temperature = &unsupportedTemperature
+	fc := newFakeClient(agent.DeepCopy())
+	ctx := WithToolContext(context.Background(), &ToolContext{Client: fc, Namespace: defaultNamespace})
+	result, err := (&UpdateAgentTool{}).Execute(ctx, json.RawMessage(`{"name":"my-agent","tools":["web_search"]}`))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	var response ChatToolResult
+	if err := json.Unmarshal([]byte(result), &response); err != nil {
+		t.Fatalf("failed to parse result: %v", err)
+	}
+	if response.Success || response.ErrorType != errTypeInvalidArgs || !strings.Contains(response.Error, "temperature") {
+		t.Fatalf("response = %#v, want unusable resulting Agent rejection", response)
+	}
+	var persisted corev1alpha1.Agent
+	if err := fc.Get(context.Background(), apitypes.NamespacedName{Name: testMyAgentName, Namespace: defaultNamespace}, &persisted); err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(persisted.Spec, agent.Spec) {
+		t.Fatalf("persisted spec changed after rejected update:\n got: %#v\nwant: %#v", persisted.Spec, agent.Spec)
+	}
+}
+
+func TestUpdateAgentTool_Execute_RejectsOpenCodeSystemPrompt(t *testing.T) {
+	agent := &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: testMyAgentName, Namespace: defaultNamespace},
+		Spec: corev1alpha1.AgentSpec{
+			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeOpencode},
+		},
+	}
+	fc := newFakeClient(agent)
+	ctx := WithToolContext(context.Background(), &ToolContext{Client: fc, Namespace: defaultNamespace})
+	result, err := (&UpdateAgentTool{}).Execute(ctx, json.RawMessage(`{"name":"my-agent","systemPrompt":"You write code"}`))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	var response ChatToolResult
+	if err := json.Unmarshal([]byte(result), &response); err != nil {
+		t.Fatalf("failed to parse result: %v", err)
+	}
+	if response.Success || response.ErrorType != errTypeInvalidArgs || !strings.Contains(response.Error, "does not support systemPrompt") {
+		t.Fatalf("response = %#v, want OpenCode systemPrompt rejection", response)
+	}
+	var updated corev1alpha1.Agent
+	if err := fc.Get(context.Background(), apitypes.NamespacedName{Name: testMyAgentName, Namespace: defaultNamespace}, &updated); err != nil {
+		t.Fatal(err)
+	}
+	if updated.Spec.SystemPrompt != nil {
+		t.Fatalf("systemPrompt = %#v, want unchanged nil value", updated.Spec.SystemPrompt)
+	}
+}
+
+func testOpenCodeAgent() *corev1alpha1.Agent {
+	return &corev1alpha1.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: testMyAgentName, Namespace: defaultNamespace},
+		Spec: corev1alpha1.AgentSpec{
+			Runtime: &corev1alpha1.AgentCLIRuntime{Type: corev1alpha1.AgentRuntimeOpencode},
+			Model:   testOpenCodeModelConfig("openai/gpt-5.4"),
+		},
+	}
+}
+
 func TestUpdateAgentTool_Execute_MissingToolContext(t *testing.T) {
 	tool := &UpdateAgentTool{}
 	result, err := tool.Execute(context.Background(), json.RawMessage(`{"name":"x"}`))
diff --git a/internal/tools/wait_for_tasks.go b/internal/tools/wait_for_tasks.go
index 65779d224..bf1521c55 100644
--- a/internal/tools/wait_for_tasks.go
+++ b/internal/tools/wait_for_tasks.go
@@ -44,27 +44,27 @@ type WaitForTasksResult struct {
 
 // TaskResultInfo holds individual task result information
 type TaskResultInfo struct {
-	Task             string                                 `json:"task"`
-	Agent            string                                 `json:"agent,omitempty"`
-	Phase            string                                 `json:"phase"`
-	Result           string                                 `json:"result,omitempty"`
-	Summary          string                                 `json:"summary,omitempty"`
-	Verdict          string                                 `json:"verdict,omitempty"`
-	Feedback         string                                 `json:"feedback,omitempty"`
-	Files            []string                               `json:"files,omitempty"`
-	Data             map[string]any                         `json:"data,omitempty"`
-	Artifacts        []common.ArtifactRef                   `json:"artifacts,omitempty"`
-	BaseSHA          string                                 `json:"baseSHA,omitempty"`
-	HeadSHA          string                                 `json:"headSHA,omitempty"`
-	PushBranch       string                                 `json:"pushBranch,omitempty"`
-	WorkspaceRef     string                                 `json:"workspaceRef,omitempty"`
-	WorkspaceBranch  string                                 `json:"workspaceBranch,omitempty"`
-	Iteration        string                                 `json:"iteration,omitempty"`
-	FailureDetails   *FailureDetails                        `json:"failureDetails,omitempty"`
-	Retried          bool                                   `json:"retried,omitempty"`
-	RetryTaskName    string                                 `json:"retryTaskName,omitempty"`
-	ExecutionOutcome *corev1alpha1.TaskExecutionOutcome     `json:"executionOutcome,omitempty"`
-	WorkspaceStatus  *corev1alpha1.ExecutionWorkspaceStatus `json:"workspaceStatus,omitempty"`
+	Task             string                                     `json:"task"`
+	Agent            string                                     `json:"agent,omitempty"`
+	Phase            string                                     `json:"phase"`
+	Result           string                                     `json:"result,omitempty"`
+	Summary          string                                     `json:"summary,omitempty"`
+	Verdict          string                                     `json:"verdict,omitempty"`
+	Feedback         string                                     `json:"feedback,omitempty"`
+	Files            []string                                   `json:"files,omitempty"`
+	Data             map[string]any                             `json:"data,omitempty"`
+	Artifacts        []common.ArtifactRef                       `json:"artifacts,omitempty"`
+	BaseSHA          string                                     `json:"baseSHA,omitempty"`
+	HeadSHA          string                                     `json:"headSHA,omitempty"`
+	PushBranch       string                                     `json:"pushBranch,omitempty"`
+	WorkspaceRef     string                                     `json:"workspaceRef,omitempty"`
+	WorkspaceBranch  string                                     `json:"workspaceBranch,omitempty"`
+	Iteration        string                                     `json:"iteration,omitempty"`
+	FailureDetails   *FailureDetails                            `json:"failureDetails,omitempty"`
+	Retried          bool                                       `json:"retried,omitempty"`
+	RetryTaskName    string                                     `json:"retryTaskName,omitempty"`
+	ExecutionOutcome *corev1alpha1.TaskWorkloadExecutionOutcome `json:"executionOutcome,omitempty"`
+	WorkspaceStatus  *corev1alpha1.ExecutionWorkspaceStatus     `json:"workspaceStatus,omitempty"`
 }
 
 func waitTaskTerminal(phase corev1alpha1.TaskPhase) bool {
diff --git a/internal/tools/web_fetch.go b/internal/tools/web_fetch.go
index 4de3d49bc..c5f7babe0 100644
--- a/internal/tools/web_fetch.go
+++ b/internal/tools/web_fetch.go
@@ -11,18 +11,22 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"net/url"
 	"regexp"
 	"strings"
 	"time"
+
+	"github.com/orka-agents/orka/internal/tokenexchange"
 )
 
 const extractorRaw = "raw"
 
 // WebFetchTool implements URL content fetching and extraction
 type WebFetchTool struct {
-	client *http.Client
+	client               *http.Client
+	allowPrivateForTests bool
 }
 
 // WebFetchArgs are the arguments for the web fetch tool
@@ -46,17 +50,40 @@ const maxBodySize = 5 * 1024 * 1024 // 5MB
 
 // NewWebFetchTool creates a new web fetch tool
 func NewWebFetchTool() *WebFetchTool {
-	return &WebFetchTool{
-		client: &http.Client{
-			Timeout: 60 * time.Second,
-			CheckRedirect: func(_ *http.Request, via []*http.Request) error {
-				if len(via) >= 5 {
-					return fmt.Errorf("too many redirects (max 5)")
-				}
-				return nil
-			},
+	transport := http.DefaultTransport.(*http.Transport).Clone()
+	transport.Proxy = nil
+	transport.DialContext = tokenexchange.PublicEndpointDialContext
+	transport.DisableKeepAlives = true
+	tool := &WebFetchTool{}
+	tool.client = &http.Client{
+		Transport: transport,
+		Timeout:   60 * time.Second,
+		CheckRedirect: func(request *http.Request, via []*http.Request) error {
+			if len(via) >= 5 {
+				return fmt.Errorf("too many redirects (max 5)")
+			}
+			return validateWebFetchURL(request.URL, false)
 		},
 	}
+	return tool
+}
+
+func validateWebFetchURL(parsed *url.URL, allowPrivate bool) error {
+	if parsed == nil || (parsed.Scheme != "http" && parsed.Scheme != "https") {
+		return fmt.Errorf("only http and https URLs are supported")
+	}
+	if parsed.Host == "" || parsed.Hostname() == "" {
+		return fmt.Errorf("URL must have a host")
+	}
+	if parsed.User != nil {
+		return fmt.Errorf("URL userinfo is not supported")
+	}
+	if !allowPrivate {
+		if address := net.ParseIP(parsed.Hostname()); address != nil && !tokenexchange.IsPublicAddress(address) {
+			return fmt.Errorf("URL must not target private, loopback, or link-local addresses")
+		}
+	}
+	return nil
 }
 
 // Name returns the tool name
@@ -104,23 +131,19 @@ func (t *WebFetchTool) Execute(ctx context.Context, args json.RawMessage) (strin
 		return "", fmt.Errorf("url is required")
 	}
 
-	// Validate URL
 	parsed, err := url.Parse(fetchArgs.URL)
 	if err != nil {
 		return "", fmt.Errorf("invalid URL: %w", err)
 	}
-	if parsed.Scheme != "http" && parsed.Scheme != "https" {
-		return "", fmt.Errorf("only http and https URLs are supported")
-	}
-	if parsed.Host == "" {
-		return "", fmt.Errorf("URL must have a host")
+	if err := validateWebFetchURL(parsed, t.allowPrivateForTests); err != nil {
+		return "", err
 	}
 
 	if fetchArgs.MaxChars <= 0 {
 		fetchArgs.MaxChars = 50000
 	}
 
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, fetchArgs.URL, nil)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, parsed.String(), nil)
 	if err != nil {
 		return "", fmt.Errorf("failed to create request: %w", err)
 	}
diff --git a/internal/tools/web_fetch_test.go b/internal/tools/web_fetch_test.go
index 4eb29438d..eef8eff47 100644
--- a/internal/tools/web_fetch_test.go
+++ b/internal/tools/web_fetch_test.go
@@ -53,7 +53,7 @@ func TestWebFetchTool_Execute_HTML(t *testing.T) {
 	}))
 	defer server.Close()
 
-	tool := &WebFetchTool{client: server.Client()}
+	tool := &WebFetchTool{client: server.Client(), allowPrivateForTests: true}
 	args := json.RawMessage(`{"url": "` + server.URL + `"}`)
 	result, err := tool.Execute(context.Background(), args)
 	if err != nil {
@@ -91,7 +91,7 @@ func TestWebFetchTool_Execute_JSON(t *testing.T) {
 	}))
 	defer server.Close()
 
-	tool := &WebFetchTool{client: server.Client()}
+	tool := &WebFetchTool{client: server.Client(), allowPrivateForTests: true}
 	args := json.RawMessage(`{"url": "` + server.URL + `"}`)
 	result, err := tool.Execute(context.Background(), args)
 	if err != nil {
@@ -119,7 +119,7 @@ func TestWebFetchTool_Execute_Raw(t *testing.T) {
 	}))
 	defer server.Close()
 
-	tool := &WebFetchTool{client: server.Client()}
+	tool := &WebFetchTool{client: server.Client(), allowPrivateForTests: true}
 	args := json.RawMessage(`{"url": "` + server.URL + `", "raw": true}`)
 	result, err := tool.Execute(context.Background(), args)
 	if err != nil {
@@ -150,6 +150,8 @@ func TestWebFetchTool_Execute_URLValidation(t *testing.T) {
 		{"empty host", `http://`},
 		{"no scheme", `example.com`},
 		{"ftp scheme", `ftp://example.com`},
+		{"loopback", `http://127.0.0.1/`},
+		{"link local", `http://169.254.169.254/latest/meta-data/`},
 	}
 
 	for _, tt := range tests {
@@ -183,7 +185,7 @@ func TestWebFetchTool_Execute_Truncation(t *testing.T) {
 	}))
 	defer server.Close()
 
-	tool := &WebFetchTool{client: server.Client()}
+	tool := &WebFetchTool{client: server.Client(), allowPrivateForTests: true}
 	args := json.RawMessage(`{"url": "` + server.URL + `", "max_chars": 100}`)
 	result, err := tool.Execute(context.Background(), args)
 	if err != nil {
@@ -215,7 +217,7 @@ func TestWebFetchTool_Execute_Redirect(t *testing.T) {
 	}))
 	defer redirectServer.Close()
 
-	tool := NewWebFetchTool()
+	tool := &WebFetchTool{client: redirectServer.Client(), allowPrivateForTests: true}
 	args := json.RawMessage(`{"url": "` + redirectServer.URL + `"}`)
 	result, err := tool.Execute(context.Background(), args)
 	if err != nil {
diff --git a/internal/workerenv/env.go b/internal/workerenv/env.go
index b47672e7b..9b64a33a1 100644
--- a/internal/workerenv/env.go
+++ b/internal/workerenv/env.go
@@ -71,6 +71,7 @@ const (
 	AIAzureAPIVersion = "ORKA_AI_AZURE_API_VERSION"
 	AITools           = "ORKA_AI_TOOLS"
 	AIFallbackCount   = "ORKA_AI_FALLBACK_COUNT"
+	ControllerMode    = "ORKA_CONTROLLER_MODE"
 
 	// Telemetry env vars.
 	EnableTelemetry = "ORKA_ENABLE_TELEMETRY"
@@ -238,14 +239,6 @@ func Env(name, value string) corev1.EnvVar {
 	return corev1.EnvVar{Name: name, Value: value}
 }
 
-// EnvIfSet returns an env var and true when value is non-empty.
-func EnvIfSet(name, value string) (corev1.EnvVar, bool) {
-	if value == "" {
-		return corev1.EnvVar{}, false
-	}
-	return Env(name, value), true
-}
-
 // AppendIfSet appends name=value to envVars only when value is non-empty.
 func AppendIfSet(envVars []corev1.EnvVar, name, value string) []corev1.EnvVar {
 	if value == "" {
@@ -457,6 +450,7 @@ type AIWorkerEnv struct {
 	TraceParent                      string
 	TraceState                       string
 	TraceBaggage                     string
+	ControllerMode                   string
 }
 
 // EnvVars renders AI worker env vars. Fallback API keys are included only when
@@ -489,6 +483,7 @@ func (e AIWorkerEnv) EnvVars() []corev1.EnvVar {
 	envVars = AppendIfSet(envVars, TraceParent, e.TraceParent)
 	envVars = AppendIfSet(envVars, TraceState, e.TraceState)
 	envVars = AppendIfSet(envVars, TraceBaggage, e.TraceBaggage)
+	envVars = AppendIfSet(envVars, ControllerMode, e.ControllerMode)
 	if len(e.Fallbacks) > 0 {
 		envVars = append(envVars, Env(AIFallbackCount, strconv.Itoa(len(e.Fallbacks))))
 		for i, fallback := range e.Fallbacks {
@@ -516,6 +511,7 @@ func ParseAIWorkerEnv(getenv func(string) string) AIWorkerEnv {
 		TraceParent:                      getenv(TraceParent),
 		TraceState:                       getenv(TraceState),
 		TraceBaggage:                     getenv(TraceBaggage),
+		ControllerMode:                   getenv(ControllerMode),
 	}
 }
 
diff --git a/internal/workerenv/env_test.go b/internal/workerenv/env_test.go
index f1904eadc..ace6fa14a 100644
--- a/internal/workerenv/env_test.go
+++ b/internal/workerenv/env_test.go
@@ -38,6 +38,7 @@ func TestAIWorkerEnvRoundTrip(t *testing.T) {
 		TraceParent:                      "00-0123456789abcdef0123456789abcdef-0123456789abcdef-01",
 		TraceState:                       "vendor=value",
 		TraceBaggage:                     "tenant=acme",
+		ControllerMode:                   "harness-v2",
 		Fallbacks: []FallbackProviderEnv{{
 			Provider:        "anthropic",
 			APIKey:          "secret",
@@ -73,6 +74,9 @@ func TestAIWorkerEnvRoundTrip(t *testing.T) {
 	if !parsed.EnableTelemetry || parsed.TraceParent != env.TraceParent || parsed.TraceState != env.TraceState || parsed.TraceBaggage != env.TraceBaggage {
 		t.Fatalf("telemetry env mismatch: got %#v, want parent=%q state=%q baggage=%q", parsed, env.TraceParent, env.TraceState, env.TraceBaggage)
 	}
+	if parsed.ControllerMode != env.ControllerMode {
+		t.Fatalf("controller mode = %q, want %q", parsed.ControllerMode, env.ControllerMode)
+	}
 	if len(parsed.Fallbacks) != 1 {
 		t.Fatalf("fallback count = %d, want 1", len(parsed.Fallbacks))
 	}
diff --git a/internal/workspacedelta/archive.go b/internal/workspacedelta/archive.go
new file mode 100644
index 000000000..49796cdcf
--- /dev/null
+++ b/internal/workspacedelta/archive.go
@@ -0,0 +1,130 @@
+package workspacedelta
+
+import (
+	"archive/tar"
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"sort"
+	"time"
+)
+
+const (
+	manifestArchivePath  = "meta/manifest.json"
+	deletionsArchivePath = "meta/deletions.json"
+	symlinksArchivePath  = "meta/symlinks.json"
+	fileArchivePrefix    = "files/"
+)
+
+type deletionDocument struct {
+	Schema    string     `json:"schema"`
+	Deletions []Deletion `json:"deletions"`
+}
+
+type symlinkDocument struct {
+	Schema   string    `json:"schema"`
+	Symlinks []Symlink `json:"symlinks"`
+}
+
+type archiveEntry struct {
+	name string
+	mode int64
+	data []byte
+}
+
+func buildArtifact(
+	changes []Change,
+	deletions []Deletion,
+	symlinks []Symlink,
+	post map[string]entry,
+	limits Limits,
+) ([]byte, string, []byte, string, error) {
+	deletionBytes, err := marshalCanonical(deletionDocument{Schema: ManifestSchema, Deletions: deletions})
+	if err != nil {
+		return nil, "", nil, "", fmt.Errorf("encode deletion manifest: %w", err)
+	}
+	symlinkBytes, err := marshalCanonical(symlinkDocument{Schema: ManifestSchema, Symlinks: symlinks})
+	if err != nil {
+		return nil, "", nil, "", fmt.Errorf("encode symlink manifest: %w", err)
+	}
+	manifest := Manifest{
+		Schema: ManifestSchema, Entries: changes,
+		DeletionsDigest: digestBytes(deletionBytes), SymlinksDigest: digestBytes(symlinkBytes),
+	}
+	manifestBytes, err := marshalCanonical(manifest)
+	if err != nil {
+		return nil, "", nil, "", fmt.Errorf("encode workspace manifest: %w", err)
+	}
+
+	archiveEntries := []archiveEntry{
+		{name: manifestArchivePath, mode: 0o644, data: manifestBytes},
+		{name: deletionsArchivePath, mode: 0o644, data: deletionBytes},
+		{name: symlinksArchivePath, mode: 0o644, data: symlinkBytes},
+	}
+	for _, change := range changes {
+		if change.Kind != EntryFile {
+			continue
+		}
+		current, found := post[change.Path]
+		if !found || current.kind != EntryFile || current.protected || current.digest != change.Digest {
+			return nil, "", nil, "", pathError("archive", change.Path, ErrInvalidBaseline)
+		}
+		archiveEntries = append(archiveEntries, archiveEntry{
+			name: fileArchivePrefix + change.Path,
+			mode: change.Mode,
+			data: append([]byte(nil), current.content...),
+		})
+	}
+	sort.Slice(archiveEntries, func(i, j int) bool { return archiveEntries[i].name < archiveEntries[j].name })
+
+	buffer := &boundedBuffer{max: limits.MaxArtifactBytes}
+	writer := tar.NewWriter(buffer)
+	fixedTime := time.Unix(0, 0).UTC()
+	for _, current := range archiveEntries {
+		header := &tar.Header{
+			Name: current.name, Mode: current.mode, Size: int64(len(current.data)),
+			ModTime: fixedTime, Typeflag: tar.TypeReg, Format: tar.FormatPAX,
+			Uid: 0, Gid: 0, Uname: "", Gname: "",
+		}
+		if err := writer.WriteHeader(header); err != nil {
+			_ = writer.Close()
+			return nil, "", nil, "", fmt.Errorf("write tar header %q: %w", current.name, err)
+		}
+		if _, err := writer.Write(current.data); err != nil {
+			_ = writer.Close()
+			return nil, "", nil, "", fmt.Errorf("write tar entry %q: %w", current.name, err)
+		}
+	}
+	if err := writer.Close(); err != nil {
+		return nil, "", nil, "", fmt.Errorf("close workspace tar: %w", err)
+	}
+	artifact := append([]byte(nil), buffer.Bytes()...)
+	return manifestBytes, digestBytes(manifestBytes), artifact, digestBytes(artifact), nil
+}
+
+func marshalCanonical(value any) ([]byte, error) {
+	encoded, err := json.Marshal(value)
+	if err != nil {
+		return nil, err
+	}
+	return append(encoded, '\n'), nil
+}
+
+func digestBytes(value []byte) string {
+	sum := sha256.Sum256(value)
+	return DigestPrefix + hex.EncodeToString(sum[:])
+}
+
+type boundedBuffer struct {
+	bytes.Buffer
+	max int64
+}
+
+func (b *boundedBuffer) Write(value []byte) (int, error) {
+	if int64(b.Len()) > b.max-int64(len(value)) {
+		return 0, fmt.Errorf("%w: artifact exceeds %d bytes", ErrLimitExceeded, b.max)
+	}
+	return b.Buffer.Write(value)
+}
diff --git a/internal/workspacedelta/build_limits_test.go b/internal/workspacedelta/build_limits_test.go
new file mode 100644
index 000000000..4718583a9
--- /dev/null
+++ b/internal/workspacedelta/build_limits_test.go
@@ -0,0 +1,52 @@
+package workspacedelta
+
+import (
+	"errors"
+	"strings"
+	"testing"
+)
+
+func TestBuildWithLimitsRejectsCumulativeChangedContentBeforeRetention(t *testing.T) {
+	root := t.TempDir()
+	writeTestFile(t, root, "one.txt", "before one\n", 0o644)
+	writeTestFile(t, root, "two.txt", "before two\n", 0o644)
+	baseline := captureTestBaseline(t, root, Options{})
+
+	writeTestFile(t, root, "one.txt", strings.Repeat("a", 700), 0o644)
+	writeTestFile(t, root, "two.txt", strings.Repeat("b", 700), 0o644)
+
+	_, err := BuildWithLimits(baseline, root, IntentWrite, BuildLimits{MaxArtifactBytes: 1024})
+	if !errors.Is(err, ErrLimitExceeded) {
+		t.Fatalf("BuildWithLimits error = %v, want ErrLimitExceeded", err)
+	}
+	var pathErr *PathError
+	if !errors.As(err, &pathErr) || pathErr.Op != "retain changed content" {
+		t.Fatalf("BuildWithLimits error = %v, want pre-retention changed-content rejection", err)
+	}
+	if !strings.Contains(err.Error(), "changed file content exceeds 1024 bytes") {
+		t.Fatalf("BuildWithLimits error = %v, want negotiated byte limit", err)
+	}
+
+	result, err := Build(baseline, root, IntentWrite)
+	if err != nil {
+		t.Fatalf("Build with baseline defaults: %v", err)
+	}
+	if result.Classification != ClassificationWriteDelta || len(result.Artifact) <= 1024 {
+		t.Fatalf("default Build result = classification %q, artifact bytes %d", result.Classification, len(result.Artifact))
+	}
+}
+
+func TestBuildWithLimitsBoundsArchiveConstruction(t *testing.T) {
+	root := t.TempDir()
+	writeTestFile(t, root, "file.txt", "before\n", 0o644)
+	baseline := captureTestBaseline(t, root, Options{})
+	writeTestFile(t, root, "file.txt", "after\n", 0o644)
+
+	_, err := BuildWithLimits(baseline, root, IntentWrite, BuildLimits{MaxArtifactBytes: 512})
+	if !errors.Is(err, ErrLimitExceeded) {
+		t.Fatalf("BuildWithLimits error = %v, want ErrLimitExceeded", err)
+	}
+	if !strings.Contains(err.Error(), "artifact exceeds 512 bytes") {
+		t.Fatalf("BuildWithLimits error = %v, want bounded archive construction", err)
+	}
+}
diff --git a/internal/workspacedelta/compare.go b/internal/workspacedelta/compare.go
new file mode 100644
index 000000000..91edae748
--- /dev/null
+++ b/internal/workspacedelta/compare.go
@@ -0,0 +1,250 @@
+package workspacedelta
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+)
+
+// Build compares a trusted pre-prompt baseline with a frozen post-prompt tree.
+// It returns no artifact for no-change and read-only-modified classifications.
+func Build(baseline *Snapshot, postRoot string, intent Intent) (Result, error) {
+	return BuildWithLimits(baseline, postRoot, intent, BuildLimits{})
+}
+
+// BuildWithLimits compares a trusted baseline with a frozen post-prompt tree
+// while applying limits that may only narrow the baseline's captured limits.
+func BuildWithLimits(baseline *Snapshot, postRoot string, intent Intent, limits BuildLimits) (Result, error) {
+	if err := intent.validate(); err != nil {
+		return Result{}, err
+	}
+	if err := validateBaseline(baseline); err != nil {
+		return Result{}, err
+	}
+	artifactLimit, err := effectiveArtifactLimit(baseline.options.limits.MaxArtifactBytes, limits.MaxArtifactBytes)
+	if err != nil {
+		return Result{}, err
+	}
+	post, err := capture(postRoot, baseline.options, false)
+	if err != nil {
+		return Result{}, err
+	}
+	if err := compareProtectedEntries(baseline.entries, post.entries); err != nil {
+		return Result{}, err
+	}
+	changes, deletions, symlinks := compareEntries(baseline.entries, post.entries)
+	if len(changes) == 0 && len(deletions) == 0 {
+		return Result{Classification: ClassificationNoChange}, nil
+	}
+	result := Result{Changes: changes, Deletions: deletions, Symlinks: symlinks}
+	if intent == IntentRead {
+		result.Classification = ClassificationReadOnlyModified
+		return result, nil
+	}
+	result.Classification = ClassificationWriteDelta
+	if err := retainChangedContents(postRoot, post, changes, artifactLimit); err != nil {
+		return Result{}, err
+	}
+	artifactLimits := baseline.options.limits
+	artifactLimits.MaxArtifactBytes = artifactLimit
+	manifest, manifestDigest, artifact, artifactDigest, err := buildArtifact(changes, deletions, symlinks, post.entries, artifactLimits)
+	if err != nil {
+		return Result{}, err
+	}
+	result.Manifest = manifest
+	result.ManifestDigest = manifestDigest
+	result.Artifact = artifact
+	result.ArtifactDigest = artifactDigest
+	return result, nil
+}
+
+func effectiveArtifactLimit(baselineLimit, requestedLimit int64) (int64, error) {
+	if requestedLimit < 0 {
+		return 0, fmt.Errorf("build max artifact bytes must not be negative")
+	}
+	if requestedLimit > 0 && requestedLimit < baselineLimit {
+		return requestedLimit, nil
+	}
+	return baselineLimit, nil
+}
+
+func validateBaseline(baseline *Snapshot) error {
+	if baseline == nil || baseline.version != snapshotVersion || baseline.entries == nil || baseline.optionsDigest == "" || baseline.manifestDigest == "" {
+		return ErrInvalidBaseline
+	}
+	optionsDigest, err := baseline.options.digest()
+	if err != nil || optionsDigest != baseline.optionsDigest {
+		return ErrInvalidBaseline
+	}
+	manifestDigest, err := snapshotDigest(baseline)
+	if err != nil || manifestDigest != baseline.manifestDigest {
+		return ErrInvalidBaseline
+	}
+	return nil
+}
+
+func compareProtectedEntries(baseline, post map[string]entry) error {
+	paths := make(map[string]struct{})
+	for entryPath, current := range baseline {
+		if current.protected {
+			paths[entryPath] = struct{}{}
+		}
+	}
+	for entryPath, current := range post {
+		if current.protected {
+			paths[entryPath] = struct{}{}
+		}
+	}
+	ordered := make([]string, 0, len(paths))
+	for entryPath := range paths {
+		ordered = append(ordered, entryPath)
+	}
+	sort.Strings(ordered)
+	for _, entryPath := range ordered {
+		before, hadBefore := baseline[entryPath]
+		after, hasAfter := post[entryPath]
+		if !hadBefore || !hasAfter || !protectedEntryEqual(before, after) {
+			return pathError("compare protected path", entryPath, ErrExcludedPathModified)
+		}
+	}
+	return nil
+}
+
+func compareEntries(baseline, post map[string]entry) ([]Change, []Deletion, []Symlink) {
+	paths := make(map[string]struct{}, len(baseline)+len(post))
+	for entryPath, current := range baseline {
+		if !current.protected {
+			paths[entryPath] = struct{}{}
+		}
+	}
+	for entryPath, current := range post {
+		if !current.protected {
+			paths[entryPath] = struct{}{}
+		}
+	}
+	ordered := make([]string, 0, len(paths))
+	for entryPath := range paths {
+		ordered = append(ordered, entryPath)
+	}
+	sort.Strings(ordered)
+
+	changes := make([]Change, 0)
+	deletions := make([]Deletion, 0)
+	symlinks := make([]Symlink, 0)
+	for _, entryPath := range ordered {
+		before, hadBefore := baseline[entryPath]
+		after, hasAfter := post[entryPath]
+		if hadBefore && (!hasAfter || before.kind != after.kind) {
+			deletions = append(deletions, Deletion{Path: entryPath, Kind: before.kind})
+		}
+		if !hasAfter || (hadBefore && entryEqual(before, after)) {
+			continue
+		}
+		operation := ChangeAdded
+		if hadBefore {
+			if before.kind == after.kind {
+				operation = ChangeModified
+			} else {
+				operation = ChangeReplaced
+			}
+		}
+		change := Change{
+			Path: entryPath, Operation: operation, Kind: after.kind, Mode: after.mode,
+			Size: after.size, Digest: after.digest, Target: after.target,
+		}
+		changes = append(changes, change)
+		if after.kind == EntrySymlink {
+			symlinks = append(symlinks, Symlink{Path: entryPath, Target: after.target, Mode: after.mode})
+		}
+	}
+	return changes, deletions, symlinks
+}
+
+func entryEqual(left, right entry) bool {
+	return left.kind == right.kind && left.mode == right.mode && left.size == right.size &&
+		left.digest == right.digest && left.target == right.target && left.protected == right.protected
+}
+
+func protectedEntryEqual(left, right entry) bool {
+	return entryEqual(left, right) && left.sourceMode == right.sourceMode
+}
+
+func (r Result) Validate() error {
+	switch r.Classification {
+	case ClassificationNoChange:
+		if len(r.Changes) != 0 || len(r.Deletions) != 0 || len(r.Symlinks) != 0 || len(r.Manifest) != 0 ||
+			r.ManifestDigest != "" || len(r.Artifact) != 0 || r.ArtifactDigest != "" {
+			return fmt.Errorf("no-change result carries delta data")
+		}
+	case ClassificationReadOnlyModified:
+		if len(r.Changes)+len(r.Deletions) == 0 || len(r.Manifest) != 0 || r.ManifestDigest != "" ||
+			len(r.Artifact) != 0 || r.ArtifactDigest != "" {
+			return fmt.Errorf("read-only-modified result is inconsistent")
+		}
+	case ClassificationWriteDelta:
+		if len(r.Changes)+len(r.Deletions) == 0 || len(r.Manifest) == 0 || r.ManifestDigest == "" ||
+			len(r.Artifact) == 0 || r.ArtifactDigest == "" {
+			return fmt.Errorf("write-delta result is incomplete")
+		}
+	default:
+		return fmt.Errorf("unsupported classification %q", r.Classification)
+	}
+	return nil
+}
+
+func retainChangedContents(postRoot string, post *Snapshot, changes []Change, maxContentBytes int64) error {
+	var changedBytes int64
+	for _, change := range changes {
+		if change.Kind != EntryFile {
+			continue
+		}
+		if change.Size < 0 || changedBytes > maxContentBytes-change.Size {
+			return pathError(
+				"retain changed content",
+				change.Path,
+				fmt.Errorf("%w: changed file content exceeds %d bytes", ErrLimitExceeded, maxContentBytes),
+			)
+		}
+		changedBytes += change.Size
+	}
+
+	absolute, err := filepath.Abs(filepath.Clean(postRoot))
+	if err != nil {
+		return fmt.Errorf("absolute workspace root: %w", err)
+	}
+	retentionOptions := post.options
+	if maxContentBytes < retentionOptions.limits.MaxFileBytes {
+		retentionOptions.limits.MaxFileBytes = maxContentBytes
+	}
+	if maxContentBytes < retentionOptions.limits.MaxTotalBytes {
+		retentionOptions.limits.MaxTotalBytes = maxContentBytes
+	}
+	seen := make(map[fileIdentity]string)
+	var retainedBytes int64
+	for _, change := range changes {
+		if change.Kind != EntryFile {
+			continue
+		}
+		current, found := post.entries[change.Path]
+		if !found || current.protected {
+			return pathError("retain changed content", change.Path, ErrInvalidBaseline)
+		}
+		filePath := filepath.Join(absolute, filepath.FromSlash(change.Path))
+		initial, err := os.Lstat(filePath)
+		if err != nil {
+			return pathError("retain changed content", change.Path, err)
+		}
+		captured, err := captureRegular(filePath, change.Path, initial, false, retentionOptions, true, retainedBytes, seen)
+		if err != nil {
+			return err
+		}
+		if !entryEqual(current, captured) {
+			return pathError("retain changed content", change.Path, ErrInvalidBaseline)
+		}
+		retainedBytes += captured.size
+		current.content = captured.content
+		post.entries[change.Path] = current
+	}
+	return nil
+}
diff --git a/internal/workspacedelta/doc.go b/internal/workspacedelta/doc.go
new file mode 100644
index 000000000..265af038c
--- /dev/null
+++ b/internal/workspacedelta/doc.go
@@ -0,0 +1,7 @@
+// Package workspacedelta captures and compares bounded workspace trees and
+// produces deterministic, publication-safe change artifacts.
+//
+// Capture and Build never follow workspace symlinks. Callers are responsible
+// for freezing the workspace process tree before Build and keeping it frozen
+// until the returned artifact is durably stored.
+package workspacedelta
diff --git a/internal/workspacedelta/errors.go b/internal/workspacedelta/errors.go
new file mode 100644
index 000000000..6ab9df914
--- /dev/null
+++ b/internal/workspacedelta/errors.go
@@ -0,0 +1,47 @@
+package workspacedelta
+
+import (
+	"errors"
+	"fmt"
+)
+
+var (
+	ErrInvalidRoot           = errors.New("invalid workspace root")
+	ErrInvalidBaseline       = errors.New("invalid trusted baseline")
+	ErrPathTraversal         = errors.New("workspace path traversal")
+	ErrReservedPath          = errors.New("reserved workspace path")
+	ErrExcludedPathModified  = errors.New("excluded workspace path modified")
+	ErrUnsafeFileType        = errors.New("unsafe workspace file type")
+	ErrHardlinkAmbiguous     = errors.New("workspace hardlink ambiguity")
+	ErrUnsafeSymlink         = errors.New("unsafe workspace symlink")
+	ErrLimitExceeded         = errors.New("workspace delta limit exceeded")
+	ErrUnsupportedFilesystem = errors.New("unsupported filesystem safety primitive")
+)
+
+// PathError associates a safety failure with a slash-separated workspace path.
+type PathError struct {
+	Op   string
+	Path string
+	Err  error
+}
+
+func (e *PathError) Error() string {
+	if e == nil {
+		return "<nil>"
+	}
+	if e.Path == "" {
+		return fmt.Sprintf("%s: %v", e.Op, e.Err)
+	}
+	return fmt.Sprintf("%s %q: %v", e.Op, e.Path, e.Err)
+}
+
+func (e *PathError) Unwrap() error {
+	if e == nil {
+		return nil
+	}
+	return e.Err
+}
+
+func pathError(op, path string, err error) error {
+	return &PathError{Op: op, Path: path, Err: err}
+}
diff --git a/internal/workspacedelta/nofollow_unix.go b/internal/workspacedelta/nofollow_unix.go
new file mode 100644
index 000000000..485c68ba2
--- /dev/null
+++ b/internal/workspacedelta/nofollow_unix.go
@@ -0,0 +1,37 @@
+//go:build darwin || linux
+
+package workspacedelta
+
+import (
+	"fmt"
+	"os"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+type fileIdentity struct {
+	device uint64
+	inode  uint64
+}
+
+func identityAndLinks(info os.FileInfo) (fileIdentity, uint64, error) {
+	stat, ok := info.Sys().(*syscall.Stat_t)
+	if !ok || stat == nil {
+		return fileIdentity{}, 0, ErrUnsupportedFilesystem
+	}
+	return fileIdentity{device: uint64(stat.Dev), inode: uint64(stat.Ino)}, uint64(stat.Nlink), nil //nolint:unconvert
+}
+
+func openRegularNoFollow(filePath string) (*os.File, error) {
+	fd, err := unix.Open(filePath, unix.O_RDONLY|unix.O_CLOEXEC|unix.O_NOFOLLOW|unix.O_NONBLOCK, 0)
+	if err != nil {
+		return nil, err
+	}
+	file := os.NewFile(uintptr(fd), filePath)
+	if file == nil {
+		_ = unix.Close(fd)
+		return nil, fmt.Errorf("create file handle")
+	}
+	return file, nil
+}
diff --git a/internal/workspacedelta/nofollow_unsupported.go b/internal/workspacedelta/nofollow_unsupported.go
new file mode 100644
index 000000000..edeb8d27c
--- /dev/null
+++ b/internal/workspacedelta/nofollow_unsupported.go
@@ -0,0 +1,15 @@
+//go:build !darwin && !linux
+
+package workspacedelta
+
+import "os"
+
+type fileIdentity struct{}
+
+func identityAndLinks(os.FileInfo) (fileIdentity, uint64, error) {
+	return fileIdentity{}, 0, ErrUnsupportedFilesystem
+}
+
+func openRegularNoFollow(string) (*os.File, error) {
+	return nil, ErrUnsupportedFilesystem
+}
diff --git a/internal/workspacedelta/path.go b/internal/workspacedelta/path.go
new file mode 100644
index 000000000..21db25e98
--- /dev/null
+++ b/internal/workspacedelta/path.go
@@ -0,0 +1,165 @@
+package workspacedelta
+
+import (
+	"fmt"
+	"path"
+	"path/filepath"
+	"strings"
+	"unicode/utf8"
+)
+
+func canonicalRelativePath(root, filePath string, maxBytes int) (string, error) {
+	rel, err := filepath.Rel(root, filePath)
+	if err != nil {
+		return "", fmt.Errorf("make workspace path relative: %w", err)
+	}
+	rel = filepath.ToSlash(rel)
+	if rel == "." {
+		return "", nil
+	}
+	if err := validateArchivePath(rel, maxBytes); err != nil {
+		return "", err
+	}
+	return rel, nil
+}
+
+func validateArchivePath(value string, maxBytes int) error {
+	if value == "" || value == "." || strings.HasPrefix(value, "/") || strings.Contains(value, "\\") ||
+		strings.IndexByte(value, 0) >= 0 || !utf8.ValidString(value) {
+		return pathError("validate", value, ErrPathTraversal)
+	}
+	if len(value) > maxBytes {
+		return pathError("validate", value, fmt.Errorf("%w: path exceeds %d bytes", ErrLimitExceeded, maxBytes))
+	}
+	if hasControl(value) {
+		return pathError("validate", value, ErrPathTraversal)
+	}
+	cleaned := path.Clean(value)
+	if cleaned != value || cleaned == ".." || strings.HasPrefix(cleaned, "../") {
+		return pathError("validate", value, ErrPathTraversal)
+	}
+	for component := range strings.SplitSeq(value, "/") {
+		if component == "" || component == "." || component == ".." {
+			return pathError("validate", value, ErrPathTraversal)
+		}
+	}
+	return nil
+}
+
+func hasControl(value string) bool {
+	for _, r := range value {
+		if r < 0x20 || r == 0x7f {
+			return true
+		}
+	}
+	return false
+}
+
+func validateSymlinkTarget(linkPath, target string, options normalizedOptions) (string, error) {
+	if target == "" || len(target) > options.limits.MaxSymlinkBytes || !utf8.ValidString(target) ||
+		strings.IndexByte(target, 0) >= 0 || strings.Contains(target, "\\") || hasControl(target) {
+		return "", pathError("validate symlink", linkPath, ErrUnsafeSymlink)
+	}
+	if path.IsAbs(target) || filepath.IsAbs(target) {
+		return "", pathError("validate symlink", linkPath, ErrUnsafeSymlink)
+	}
+	resolved := path.Clean(path.Join(path.Dir(linkPath), target))
+	if resolved == "." || strings.HasPrefix(linkPath, resolved+"/") {
+		return "", pathError("validate symlink", linkPath, ErrUnsafeSymlink)
+	}
+	if resolved == ".." || strings.HasPrefix(resolved, "../") || strings.HasPrefix(resolved, "/") {
+		return "", pathError("validate symlink", linkPath, ErrUnsafeSymlink)
+	}
+	if resolved != "." {
+		if err := validateArchivePath(resolved, options.limits.MaxPathBytes); err != nil {
+			return "", pathError("validate symlink", linkPath, fmt.Errorf("%w: %v", ErrUnsafeSymlink, err))
+		}
+		protected, err := options.classifyPath(resolved)
+		if err != nil {
+			return "", pathError("validate symlink", linkPath, fmt.Errorf("%w: %v", ErrUnsafeSymlink, err))
+		}
+		if protected && !isReadOnlySkillsAlias(linkPath, target, resolved) {
+			return "", pathError("validate symlink", linkPath, ErrUnsafeSymlink)
+		}
+	}
+	return resolved, nil
+}
+
+func validateSymlinkGraph(entries map[string]entry, options normalizedOptions) error {
+	for start, current := range entries {
+		if current.kind != EntrySymlink {
+			continue
+		}
+		resolved, err := validateSymlinkTarget(start, current.target, options)
+		if err != nil {
+			return err
+		}
+		if isReadOnlySkillsAlias(start, current.target, resolved) {
+			target, found := entries[resolved]
+			if !found || target.kind != EntryDirectory || !target.protected {
+				return pathError("validate symlink", start, ErrUnsafeSymlink)
+			}
+		}
+		if err := resolveSymlinkPath(start, resolved, entries, options, map[string]struct{}{start: {}}); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func resolveSymlinkPath(start, value string, entries map[string]entry, options normalizedOptions, visiting map[string]struct{}) error {
+	prefix, remainder, found := firstSymlinkPrefix(value, entries)
+	if !found {
+		return nil
+	}
+	if _, cycle := visiting[prefix]; cycle {
+		return pathError("validate symlink", start, ErrUnsafeSymlink)
+	}
+	visiting[prefix] = struct{}{}
+	defer delete(visiting, prefix)
+
+	linked := entries[prefix]
+	base, err := validateSymlinkTarget(prefix, linked.target, options)
+	if err != nil {
+		return err
+	}
+	resolved := base
+	if remainder != "" {
+		resolved = path.Clean(path.Join(base, remainder))
+	}
+	if err := validateResolvedSymlinkPath(start, resolved, options); err != nil {
+		return err
+	}
+	return resolveSymlinkPath(start, resolved, entries, options, visiting)
+}
+
+func validateResolvedSymlinkPath(start, value string, options normalizedOptions) error {
+	if value == "." {
+		return nil
+	}
+	if value == ".." || strings.HasPrefix(value, "../") || strings.HasPrefix(value, "/") {
+		return pathError("validate symlink", start, ErrUnsafeSymlink)
+	}
+	if err := validateArchivePath(value, options.limits.MaxPathBytes); err != nil {
+		return pathError("validate symlink", start, fmt.Errorf("%w: %v", ErrUnsafeSymlink, err))
+	}
+	protected, err := options.classifyPath(value)
+	if err != nil || protected {
+		return pathError("validate symlink", start, ErrUnsafeSymlink)
+	}
+	return nil
+}
+
+func firstSymlinkPrefix(value string, entries map[string]entry) (prefix, remainder string, found bool) {
+	if value == "." || value == "" {
+		return "", "", false
+	}
+	components := strings.Split(value, "/")
+	for i := range components {
+		candidate := strings.Join(components[:i+1], "/")
+		if current, exists := entries[candidate]; exists && current.kind == EntrySymlink {
+			return candidate, strings.Join(components[i+1:], "/"), true
+		}
+	}
+	return "", "", false
+}
diff --git a/internal/workspacedelta/policy.go b/internal/workspacedelta/policy.go
new file mode 100644
index 000000000..89d3aae03
--- /dev/null
+++ b/internal/workspacedelta/policy.go
@@ -0,0 +1,225 @@
+package workspacedelta
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+	"unicode/utf8"
+)
+
+const (
+	defaultMaxEntries             = 100_000
+	defaultMaxFileBytes     int64 = 256 << 20
+	defaultMaxTotalBytes    int64 = 2 << 30
+	defaultMaxArtifactBytes int64 = 3 << 30
+	defaultMaxPathBytes           = 4 << 10
+	defaultMaxSymlinkBytes        = 4 << 10
+
+	// Repository tool conventions commonly expose the same checked-in skill
+	// tree to multiple agents. This exact alias is read-only: both the link and
+	// its protected target are fingerprinted and excluded from publication.
+	readOnlySkillsAliasPath     = ".agents/skills"
+	readOnlySkillsAliasTarget   = "../.claude/skills"
+	readOnlySkillsAliasResolved = ".claude/skills"
+)
+
+var mandatoryExcludedNames = []string{
+	".git",
+	".orka-metadata",
+	".orka-supervisor",
+	".codex",
+	".claude",
+	".copilot",
+	".config",
+	".credentials",
+	".secrets",
+	".ssh",
+	".gnupg",
+	".aws",
+	".azure",
+	".docker",
+	".kube",
+}
+
+var mandatoryReservedNames = []string{
+	".orka-artifacts",
+	".orka-credentials",
+	".orka-infrastructure",
+	".orka-publisher",
+	".orka-runtime-control",
+	".orka-workspace-delta",
+}
+
+// Limits bounds both snapshots and generated artifacts. Zero fields use the
+// secure defaults; negative fields are invalid.
+type Limits struct {
+	MaxEntries       int
+	MaxFileBytes     int64
+	MaxTotalBytes    int64
+	MaxArtifactBytes int64
+	MaxPathBytes     int
+	MaxSymlinkBytes  int
+}
+
+// Options adds deployment-specific protected and reserved path-component
+// names. Built-in security names cannot be disabled.
+type Options struct {
+	Limits                  Limits
+	AdditionalExcludedNames []string
+	AdditionalReservedNames []string
+}
+
+type normalizedOptions struct {
+	limits        Limits
+	excludedNames []string
+	reservedNames []string
+	excludedSet   map[string]struct{}
+	reservedSet   map[string]struct{}
+}
+
+// DefaultLimits returns the package's bounded first-release defaults.
+func DefaultLimits() Limits {
+	return Limits{
+		MaxEntries:       defaultMaxEntries,
+		MaxFileBytes:     defaultMaxFileBytes,
+		MaxTotalBytes:    defaultMaxTotalBytes,
+		MaxArtifactBytes: defaultMaxArtifactBytes,
+		MaxPathBytes:     defaultMaxPathBytes,
+		MaxSymlinkBytes:  defaultMaxSymlinkBytes,
+	}
+}
+
+func normalizeOptions(options Options) (normalizedOptions, error) {
+	limits, err := normalizeLimits(options.Limits)
+	if err != nil {
+		return normalizedOptions{}, err
+	}
+	excluded, err := normalizeNames(mandatoryExcludedNames, options.AdditionalExcludedNames)
+	if err != nil {
+		return normalizedOptions{}, fmt.Errorf("excluded names: %w", err)
+	}
+	reserved, err := normalizeNames(mandatoryReservedNames, options.AdditionalReservedNames)
+	if err != nil {
+		return normalizedOptions{}, fmt.Errorf("reserved names: %w", err)
+	}
+	excludedSet := make(map[string]struct{}, len(excluded))
+	for _, name := range excluded {
+		excludedSet[strings.ToLower(name)] = struct{}{}
+	}
+	reservedSet := make(map[string]struct{}, len(reserved))
+	for _, name := range reserved {
+		key := strings.ToLower(name)
+		if _, exists := excludedSet[key]; exists {
+			return normalizedOptions{}, fmt.Errorf("path component %q cannot be both excluded and reserved", name)
+		}
+		reservedSet[key] = struct{}{}
+	}
+	return normalizedOptions{
+		limits: limits, excludedNames: excluded, reservedNames: reserved,
+		excludedSet: excludedSet, reservedSet: reservedSet,
+	}, nil
+}
+
+func normalizeLimits(limits Limits) (Limits, error) {
+	defaults := DefaultLimits()
+	if limits.MaxEntries < 0 || limits.MaxFileBytes < 0 || limits.MaxTotalBytes < 0 ||
+		limits.MaxArtifactBytes < 0 || limits.MaxPathBytes < 0 || limits.MaxSymlinkBytes < 0 {
+		return Limits{}, fmt.Errorf("limits must not be negative")
+	}
+	if limits.MaxEntries == 0 {
+		limits.MaxEntries = defaults.MaxEntries
+	}
+	if limits.MaxFileBytes == 0 {
+		limits.MaxFileBytes = defaults.MaxFileBytes
+	}
+	if limits.MaxTotalBytes == 0 {
+		limits.MaxTotalBytes = defaults.MaxTotalBytes
+	}
+	if limits.MaxArtifactBytes == 0 {
+		limits.MaxArtifactBytes = defaults.MaxArtifactBytes
+	}
+	if limits.MaxPathBytes == 0 {
+		limits.MaxPathBytes = defaults.MaxPathBytes
+	}
+	if limits.MaxSymlinkBytes == 0 {
+		limits.MaxSymlinkBytes = defaults.MaxSymlinkBytes
+	}
+	if limits.MaxFileBytes > limits.MaxTotalBytes {
+		return Limits{}, fmt.Errorf("max file bytes cannot exceed max total bytes")
+	}
+	return limits, nil
+}
+
+func normalizeNames(required, additional []string) ([]string, error) {
+	set := make(map[string]string, len(required)+len(additional))
+	for _, source := range [][]string{required, additional} {
+		for _, raw := range source {
+			name := strings.TrimSpace(raw)
+			if err := validateComponentName(name); err != nil {
+				return nil, err
+			}
+			key := strings.ToLower(name)
+			if _, exists := set[key]; !exists {
+				set[key] = name
+			}
+		}
+	}
+	out := make([]string, 0, len(set))
+	for _, name := range set {
+		out = append(out, name)
+	}
+	sort.Slice(out, func(i, j int) bool {
+		return strings.ToLower(out[i]) < strings.ToLower(out[j])
+	})
+	return out, nil
+}
+
+func validateComponentName(name string) error {
+	if name == "" || name == "." || name == ".." || strings.ContainsAny(name, "/\\\x00") || !utf8.ValidString(name) {
+		return fmt.Errorf("invalid path component name %q", name)
+	}
+	if hasControl(name) {
+		return fmt.Errorf("path component name contains control characters")
+	}
+	return nil
+}
+
+func (o normalizedOptions) digest() (string, error) {
+	value := struct {
+		Schema        string   `json:"schema"`
+		Limits        Limits   `json:"limits"`
+		ExcludedNames []string `json:"excludedNames"`
+		ReservedNames []string `json:"reservedNames"`
+	}{
+		Schema: ManifestSchema, Limits: o.limits,
+		ExcludedNames: o.excludedNames, ReservedNames: o.reservedNames,
+	}
+	encoded, err := json.Marshal(value)
+	if err != nil {
+		return "", fmt.Errorf("encode workspace policy: %w", err)
+	}
+	sum := sha256.Sum256(encoded)
+	return DigestPrefix + hex.EncodeToString(sum[:]), nil
+}
+
+func (o normalizedOptions) classifyPath(path string) (protected bool, err error) {
+	for component := range strings.SplitSeq(path, "/") {
+		key := strings.ToLower(component)
+		if _, found := o.reservedSet[key]; found {
+			return false, pathError("validate", path, ErrReservedPath)
+		}
+		if _, found := o.excludedSet[key]; found {
+			protected = true
+		}
+	}
+	return protected, nil
+}
+
+func isReadOnlySkillsAlias(linkPath, target, resolved string) bool {
+	return linkPath == readOnlySkillsAliasPath &&
+		target == readOnlySkillsAliasTarget &&
+		resolved == readOnlySkillsAliasResolved
+}
diff --git a/internal/workspacedelta/security_unix_test.go b/internal/workspacedelta/security_unix_test.go
new file mode 100644
index 000000000..345594cc1
--- /dev/null
+++ b/internal/workspacedelta/security_unix_test.go
@@ -0,0 +1,75 @@
+//go:build darwin || linux
+
+package workspacedelta
+
+import (
+	"errors"
+	"net"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"golang.org/x/sys/unix"
+)
+
+func TestCaptureRejectsFIFOAndSocket(t *testing.T) {
+	t.Run("fifo", func(t *testing.T) {
+		root := t.TempDir()
+		if err := unix.Mkfifo(filepath.Join(root, "pipe"), 0o600); err != nil {
+			t.Fatalf("mkfifo: %v", err)
+		}
+		_, err := Capture(root, Options{})
+		if !errors.Is(err, ErrUnsafeFileType) {
+			t.Fatalf("Capture error = %v, want ErrUnsafeFileType", err)
+		}
+	})
+	t.Run("socket", func(t *testing.T) {
+		root, err := os.MkdirTemp("/tmp", "orka-wd-")
+		if err != nil {
+			t.Fatalf("create short socket directory: %v", err)
+		}
+		t.Cleanup(func() { _ = os.RemoveAll(root) })
+		socketPath := filepath.Join(root, "agent.sock")
+		listener, err := net.ListenUnix("unix", &net.UnixAddr{Name: socketPath, Net: "unix"})
+		if err != nil {
+			t.Fatalf("listen unix socket: %v", err)
+		}
+		defer func() { _ = listener.Close() }()
+		_, err = Capture(root, Options{})
+		if !errors.Is(err, ErrUnsafeFileType) {
+			t.Fatalf("Capture error = %v, want ErrUnsafeFileType", err)
+		}
+	})
+}
+
+func TestCaptureRejectsHardlinksInsideOrOutsideWorkspace(t *testing.T) {
+	for _, test := range []struct {
+		name  string
+		alias func(t *testing.T, root, original string)
+	}{
+		{name: "inside", alias: func(t *testing.T, root, original string) {
+			if err := os.Link(original, filepath.Join(root, "alias")); err != nil {
+				t.Fatalf("create internal hardlink: %v", err)
+			}
+		}},
+		{name: "outside", alias: func(t *testing.T, root, original string) {
+			outside := filepath.Join(t.TempDir(), "alias")
+			if err := os.Link(original, outside); err != nil {
+				t.Fatalf("create external hardlink: %v", err)
+			}
+		}},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			root := t.TempDir()
+			original := filepath.Join(root, "original")
+			if err := os.WriteFile(original, []byte("data"), 0o600); err != nil {
+				t.Fatalf("write original: %v", err)
+			}
+			test.alias(t, root, original)
+			_, err := Capture(root, Options{})
+			if !errors.Is(err, ErrHardlinkAmbiguous) {
+				t.Fatalf("Capture error = %v, want ErrHardlinkAmbiguous", err)
+			}
+		})
+	}
+}
diff --git a/internal/workspacedelta/snapshot.go b/internal/workspacedelta/snapshot.go
new file mode 100644
index 000000000..0f840ed6f
--- /dev/null
+++ b/internal/workspacedelta/snapshot.go
@@ -0,0 +1,304 @@
+package workspacedelta
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"sort"
+)
+
+const snapshotVersion uint32 = 1
+
+// Capture validates and fingerprints a workspace tree without following
+// symlinks. The returned Snapshot is suitable as a trusted pre-prompt baseline.
+func Capture(root string, options Options) (*Snapshot, error) {
+	normalized, err := normalizeOptions(options)
+	if err != nil {
+		return nil, fmt.Errorf("workspace delta options: %w", err)
+	}
+	return capture(root, normalized, false)
+}
+
+func capture(root string, options normalizedOptions, retainContent bool) (*Snapshot, error) {
+	root = filepath.Clean(root)
+	if root == "." || root == "" {
+		return nil, ErrInvalidRoot
+	}
+	absolute, err := filepath.Abs(root)
+	if err != nil {
+		return nil, fmt.Errorf("absolute workspace root: %w", err)
+	}
+	rootInfo, err := os.Lstat(absolute)
+	if err != nil {
+		return nil, pathError("inspect root", "", fmt.Errorf("%w: %v", ErrInvalidRoot, err))
+	}
+	if rootInfo.Mode()&os.ModeSymlink != 0 || !rootInfo.IsDir() {
+		return nil, pathError("inspect root", "", ErrInvalidRoot)
+	}
+
+	optionsDigest, err := options.digest()
+	if err != nil {
+		return nil, err
+	}
+	snapshot := &Snapshot{
+		version:       snapshotVersion,
+		entries:       make(map[string]entry),
+		options:       options,
+		optionsDigest: optionsDigest,
+	}
+	seenFiles := make(map[fileIdentity]string)
+
+	err = filepath.WalkDir(absolute, func(filePath string, dirEntry fs.DirEntry, walkErr error) error {
+		if walkErr != nil {
+			return pathError("walk", relativeForError(absolute, filePath), walkErr)
+		}
+		if filePath == absolute {
+			return nil
+		}
+		relative, err := canonicalRelativePath(absolute, filePath, options.limits.MaxPathBytes)
+		if err != nil {
+			return err
+		}
+		protected, err := options.classifyPath(relative)
+		if err != nil {
+			return err
+		}
+		if snapshot.entryCount >= options.limits.MaxEntries {
+			return pathError("capture", relative, fmt.Errorf("%w: entry count exceeds %d", ErrLimitExceeded, options.limits.MaxEntries))
+		}
+
+		info, err := os.Lstat(filePath)
+		if err != nil {
+			return pathError("inspect", relative, err)
+		}
+		current := entry{path: relative, protected: protected}
+		switch mode := info.Mode(); {
+		case mode.IsDir():
+			current.kind = EntryDirectory
+			current.mode = normalizedMode(EntryDirectory, mode)
+			current.sourceMode = uint32(mode.Perm())
+		case mode.IsRegular():
+			current, err = captureRegular(filePath, relative, info, protected, options, retainContent, snapshot.totalBytes, seenFiles)
+			if err != nil {
+				return err
+			}
+			snapshot.totalBytes += current.size
+		case mode&os.ModeSymlink != 0:
+			current, err = captureSymlink(filePath, relative, info, protected, options)
+			if err != nil {
+				return err
+			}
+		default:
+			return pathError("capture", relative, fmt.Errorf("%w: mode %s", ErrUnsafeFileType, mode.String()))
+		}
+		snapshot.entries[relative] = current
+		snapshot.entryCount++
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	if err := validateSymlinkGraph(snapshot.entries, options); err != nil {
+		return nil, err
+	}
+	rootAfter, err := os.Lstat(absolute)
+	if err != nil || rootAfter.Mode()&os.ModeSymlink != 0 || !rootAfter.IsDir() || !os.SameFile(rootInfo, rootAfter) {
+		return nil, pathError("revalidate root", "", ErrInvalidRoot)
+	}
+	snapshot.manifestDigest, err = snapshotDigest(snapshot)
+	if err != nil {
+		return nil, err
+	}
+	return snapshot, nil
+}
+
+//nolint:gocyclo // The explicit state-machine branches are easier to audit together.
+func captureRegular(
+	filePath, relative string,
+	initial os.FileInfo,
+	protected bool,
+	options normalizedOptions,
+	retainContent bool,
+	currentTotal int64,
+	seen map[fileIdentity]string,
+) (entry, error) {
+	initialIdentity, links, err := identityAndLinks(initial)
+	if err != nil {
+		return entry{}, pathError("inspect hardlinks", relative, err)
+	}
+	if links != 1 {
+		return entry{}, pathError("inspect hardlinks", relative, ErrHardlinkAmbiguous)
+	}
+	if previous, exists := seen[initialIdentity]; exists {
+		return entry{}, pathError("inspect hardlinks", relative, fmt.Errorf("%w: aliases %q", ErrHardlinkAmbiguous, previous))
+	}
+	if initial.Size() < 0 || initial.Size() > options.limits.MaxFileBytes {
+		return entry{}, pathError("capture", relative, fmt.Errorf("%w: file exceeds %d bytes", ErrLimitExceeded, options.limits.MaxFileBytes))
+	}
+	if currentTotal > options.limits.MaxTotalBytes-initial.Size() {
+		return entry{}, pathError("capture", relative, fmt.Errorf("%w: total bytes exceed %d", ErrLimitExceeded, options.limits.MaxTotalBytes))
+	}
+
+	file, err := openRegularNoFollow(filePath)
+	if err != nil {
+		return entry{}, pathError("open no-follow", relative, fmt.Errorf("%w: %v", ErrUnsafeFileType, err))
+	}
+	defer func() { _ = file.Close() }()
+	opened, err := file.Stat()
+	if err != nil {
+		return entry{}, pathError("inspect open file", relative, err)
+	}
+	openedIdentity, openedLinks, err := identityAndLinks(opened)
+	if err != nil {
+		return entry{}, pathError("inspect hardlinks", relative, err)
+	}
+	if !opened.Mode().IsRegular() || openedIdentity != initialIdentity || openedLinks != 1 || opened.Size() != initial.Size() {
+		return entry{}, pathError("revalidate open file", relative, ErrHardlinkAmbiguous)
+	}
+
+	hash := sha256.New()
+	var content bytes.Buffer
+	writer := io.Writer(hash)
+	if retainContent {
+		writer = io.MultiWriter(hash, &content)
+	}
+	read, err := io.Copy(writer, io.LimitReader(file, options.limits.MaxFileBytes+1))
+	if err != nil {
+		return entry{}, pathError("read", relative, err)
+	}
+	if read > options.limits.MaxFileBytes || read != opened.Size() {
+		return entry{}, pathError("read", relative, fmt.Errorf("%w: file changed or exceeded %d bytes", ErrLimitExceeded, options.limits.MaxFileBytes))
+	}
+	openedAfter, err := file.Stat()
+	if err != nil {
+		return entry{}, pathError("revalidate open file", relative, err)
+	}
+	openedAfterIdentity, openedAfterLinks, err := identityAndLinks(openedAfter)
+	if err != nil {
+		return entry{}, pathError("inspect hardlinks", relative, err)
+	}
+	pathAfter, err := os.Lstat(filePath)
+	if err != nil {
+		return entry{}, pathError("revalidate path", relative, err)
+	}
+	pathAfterIdentity, pathAfterLinks, err := identityAndLinks(pathAfter)
+	if err != nil {
+		return entry{}, pathError("inspect hardlinks", relative, err)
+	}
+	if openedAfterIdentity != initialIdentity || pathAfterIdentity != initialIdentity || openedAfterLinks != 1 || pathAfterLinks != 1 ||
+		openedAfter.Size() != read || pathAfter.Size() != read || !openedAfter.Mode().IsRegular() || !pathAfter.Mode().IsRegular() {
+		return entry{}, pathError("revalidate file", relative, ErrHardlinkAmbiguous)
+	}
+	seen[initialIdentity] = relative
+	result := entry{
+		path: relative, kind: EntryFile, mode: normalizedMode(EntryFile, openedAfter.Mode()),
+		size: read, digest: DigestPrefix + hex.EncodeToString(hash.Sum(nil)), protected: protected,
+		sourceMode: uint32(openedAfter.Mode().Perm()),
+	}
+	if retainContent {
+		result.content = append([]byte(nil), content.Bytes()...)
+	}
+	return result, nil
+}
+
+func captureSymlink(filePath, relative string, initial os.FileInfo, protected bool, options normalizedOptions) (entry, error) {
+	initialIdentity, initialLinks, err := identityAndLinks(initial)
+	if err != nil {
+		return entry{}, pathError("inspect symlink", relative, err)
+	}
+	if initialLinks != 1 {
+		return entry{}, pathError("inspect hardlinks", relative, ErrHardlinkAmbiguous)
+	}
+	target, err := os.Readlink(filePath)
+	if err != nil {
+		return entry{}, pathError("read symlink", relative, err)
+	}
+	resolved, err := validateSymlinkTarget(relative, target, options)
+	if err != nil {
+		return entry{}, err
+	}
+	protected = protected || isReadOnlySkillsAlias(relative, target, resolved)
+	after, err := os.Lstat(filePath)
+	if err != nil {
+		return entry{}, pathError("revalidate symlink", relative, err)
+	}
+	afterIdentity, afterLinks, err := identityAndLinks(after)
+	if err != nil {
+		return entry{}, pathError("inspect symlink", relative, err)
+	}
+	if after.Mode()&os.ModeSymlink == 0 || afterIdentity != initialIdentity || afterLinks != 1 {
+		return entry{}, pathError("revalidate symlink", relative, ErrUnsafeSymlink)
+	}
+	return entry{
+		path: relative, kind: EntrySymlink, mode: normalizedMode(EntrySymlink, after.Mode()),
+		target: target, protected: protected, sourceMode: uint32(after.Mode().Perm()),
+	}, nil
+}
+
+func normalizedMode(kind EntryKind, mode os.FileMode) int64 {
+	switch kind {
+	case EntryDirectory:
+		return 0o755
+	case EntryFile:
+		if mode.Perm()&0o111 != 0 {
+			return 0o755
+		}
+		return 0o644
+	case EntrySymlink:
+		return 0o777
+	default:
+		return 0
+	}
+}
+
+func relativeForError(root, filePath string) string {
+	relative, err := filepath.Rel(root, filePath)
+	if err != nil || relative == "." {
+		return ""
+	}
+	return filepath.ToSlash(relative)
+}
+
+type snapshotManifestEntry struct {
+	Path       string    `json:"path"`
+	Kind       EntryKind `json:"kind"`
+	Mode       int64     `json:"mode"`
+	Size       int64     `json:"size,omitempty"`
+	Digest     string    `json:"digest,omitempty"`
+	Target     string    `json:"target,omitempty"`
+	Protected  bool      `json:"protected,omitempty"`
+	SourceMode uint32    `json:"sourceMode"`
+}
+
+func snapshotDigest(snapshot *Snapshot) (string, error) {
+	paths := make([]string, 0, len(snapshot.entries))
+	for entryPath := range snapshot.entries {
+		paths = append(paths, entryPath)
+	}
+	sort.Strings(paths)
+	entries := make([]snapshotManifestEntry, 0, len(paths))
+	for _, entryPath := range paths {
+		current := snapshot.entries[entryPath]
+		entries = append(entries, snapshotManifestEntry{
+			Path: current.path, Kind: current.kind, Mode: current.mode, Size: current.size,
+			Digest: current.digest, Target: current.target, Protected: current.protected, SourceMode: current.sourceMode,
+		})
+	}
+	manifest := struct {
+		Schema       string                  `json:"schema"`
+		PolicyDigest string                  `json:"policyDigest"`
+		Entries      []snapshotManifestEntry `json:"entries"`
+	}{Schema: ManifestSchema, PolicyDigest: snapshot.optionsDigest, Entries: entries}
+	encoded, err := json.Marshal(manifest)
+	if err != nil {
+		return "", fmt.Errorf("encode snapshot manifest: %w", err)
+	}
+	sum := sha256.Sum256(encoded)
+	return DigestPrefix + hex.EncodeToString(sum[:]), nil
+}
diff --git a/internal/workspacedelta/types.go b/internal/workspacedelta/types.go
new file mode 100644
index 000000000..b64630d49
--- /dev/null
+++ b/internal/workspacedelta/types.go
@@ -0,0 +1,160 @@
+package workspacedelta
+
+import "fmt"
+
+const (
+	ManifestSchema = "orka.workspace-delta.v1"
+	DigestPrefix   = "sha256:"
+)
+
+// Intent determines whether a non-empty delta is an error classification or a
+// publication artifact.
+type Intent string
+
+const (
+	IntentRead  Intent = "read"
+	IntentWrite Intent = "write"
+)
+
+func (i Intent) validate() error {
+	switch i {
+	case IntentRead, IntentWrite:
+		return nil
+	default:
+		return fmt.Errorf("unsupported workspace intent %q", i)
+	}
+}
+
+// Classification is the result of comparing a trusted baseline with the
+// frozen final workspace tree.
+type Classification string
+
+const (
+	ClassificationNoChange         Classification = "no_change"
+	ClassificationReadOnlyModified Classification = "read_only_modified"
+	ClassificationWriteDelta       Classification = "write_delta"
+)
+
+// EntryKind is a normalized workspace entry type.
+type EntryKind string
+
+const (
+	EntryDirectory EntryKind = "directory"
+	EntryFile      EntryKind = "file"
+	EntrySymlink   EntryKind = "symlink"
+)
+
+// ChangeOperation describes how a final-tree entry relates to the baseline.
+type ChangeOperation string
+
+const (
+	ChangeAdded    ChangeOperation = "added"
+	ChangeModified ChangeOperation = "modified"
+	ChangeReplaced ChangeOperation = "replaced"
+)
+
+// Change is deterministic metadata for one added or changed final-tree entry.
+// File contents are stored separately under files/<Path> in a write artifact.
+type Change struct {
+	Path      string          `json:"path"`
+	Operation ChangeOperation `json:"operation"`
+	Kind      EntryKind       `json:"kind"`
+	Mode      int64           `json:"mode"`
+	Size      int64           `json:"size,omitempty"`
+	Digest    string          `json:"digest,omitempty"`
+	Target    string          `json:"target,omitempty"`
+}
+
+// Deletion explicitly identifies one baseline entry absent from, or replaced
+// in, the final tree.
+type Deletion struct {
+	Path string    `json:"path"`
+	Kind EntryKind `json:"kind"`
+}
+
+// Symlink contains validated symlink metadata. Artifacts never contain tar
+// symlink headers, which avoids extraction-order and link-following hazards.
+type Symlink struct {
+	Path   string `json:"path"`
+	Target string `json:"target"`
+	Mode   int64  `json:"mode"`
+}
+
+// Manifest is the canonical metadata embedded in each non-empty write
+// artifact. Entries, deletions, and symlinks are sorted deterministically.
+type Manifest struct {
+	Schema          string   `json:"schema"`
+	Entries         []Change `json:"entries"`
+	DeletionsDigest string   `json:"deletionsDigest"`
+	SymlinksDigest  string   `json:"symlinksDigest"`
+}
+
+// Result is the complete comparison result. Artifact and manifest bytes are
+// present only for ClassificationWriteDelta.
+type Result struct {
+	Classification Classification
+	Changes        []Change
+	Deletions      []Deletion
+	Symlinks       []Symlink
+	Manifest       []byte
+	ManifestDigest string
+	Artifact       []byte
+	ArtifactDigest string
+}
+
+// BuildLimits narrows resource limits while constructing a delta from a trusted
+// baseline. Zero fields preserve the limits captured in the baseline.
+type BuildLimits struct {
+	MaxArtifactBytes int64
+}
+
+// Snapshot is an immutable trusted baseline created by Capture. Its internal
+// entries and policy are intentionally not exported so callers cannot forge a
+// baseline by assembling public fields.
+type Snapshot struct {
+	version        uint32
+	entries        map[string]entry
+	options        normalizedOptions
+	optionsDigest  string
+	manifestDigest string
+	entryCount     int
+	totalBytes     int64
+}
+
+// ManifestDigest returns the content digest of the normalized snapshot.
+func (s *Snapshot) ManifestDigest() string {
+	if s == nil {
+		return ""
+	}
+	return s.manifestDigest
+}
+
+// EntryCount returns the number of validated entries, including protected
+// entries excluded from publication.
+func (s *Snapshot) EntryCount() int {
+	if s == nil {
+		return 0
+	}
+	return s.entryCount
+}
+
+// TotalBytes returns the validated regular-file bytes in the snapshot,
+// including protected entries excluded from publication.
+func (s *Snapshot) TotalBytes() int64 {
+	if s == nil {
+		return 0
+	}
+	return s.totalBytes
+}
+
+type entry struct {
+	path       string
+	kind       EntryKind
+	mode       int64
+	size       int64
+	digest     string
+	target     string
+	protected  bool
+	sourceMode uint32
+	content    []byte
+}
diff --git a/internal/workspacedelta/workspacedelta_test.go b/internal/workspacedelta/workspacedelta_test.go
new file mode 100644
index 000000000..119a55b2b
--- /dev/null
+++ b/internal/workspacedelta/workspacedelta_test.go
@@ -0,0 +1,469 @@
+package workspacedelta
+
+import (
+	"archive/tar"
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"reflect"
+	"sort"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestBuildClassifiesNoChangeAndReadOnlyMutation(t *testing.T) {
+	root := t.TempDir()
+	writeTestFile(t, root, "README.md", "before\n", 0o640)
+	baseline := captureTestBaseline(t, root, Options{})
+
+	unchanged, err := Build(baseline, root, IntentRead)
+	if err != nil {
+		t.Fatalf("Build unchanged: %v", err)
+	}
+	if unchanged.Classification != ClassificationNoChange {
+		t.Fatalf("classification = %q, want %q", unchanged.Classification, ClassificationNoChange)
+	}
+	if err := unchanged.Validate(); err != nil {
+		t.Fatalf("validate unchanged result: %v", err)
+	}
+
+	writeTestFile(t, root, "README.md", "after\n", 0o600)
+	modified, err := Build(baseline, root, IntentRead)
+	if err != nil {
+		t.Fatalf("Build read-only mutation: %v", err)
+	}
+	if modified.Classification != ClassificationReadOnlyModified {
+		t.Fatalf("classification = %q, want %q", modified.Classification, ClassificationReadOnlyModified)
+	}
+	if len(modified.Changes) != 1 || modified.Changes[0].Path != "README.md" || modified.Changes[0].Kind != EntryFile {
+		t.Fatalf("unexpected changes: %#v", modified.Changes)
+	}
+	if len(modified.Artifact) != 0 || modified.ArtifactDigest != "" || len(modified.Manifest) != 0 {
+		t.Fatal("read-only mutation produced a publication artifact")
+	}
+	if err := modified.Validate(); err != nil {
+		t.Fatalf("validate read-only result: %v", err)
+	}
+}
+
+func TestBuildProducesDeterministicDeltaWithDeletionAndSymlinkMetadata(t *testing.T) {
+	root := t.TempDir()
+	writeTestFile(t, root, "keep.txt", "old\n", 0o600)
+	writeTestFile(t, root, "delete.txt", "remove me\n", 0o644)
+	writeTestFile(t, root, ".git/config", "[safe]\n", 0o600)
+	baseline := captureTestBaseline(t, root, Options{})
+
+	writeTestFile(t, root, "keep.txt", "new\n", 0o666)
+	if err := os.Remove(filepath.Join(root, "delete.txt")); err != nil {
+		t.Fatalf("remove deleted file: %v", err)
+	}
+	writeTestFile(t, root, "bin/run", "#!/bin/sh\nexit 0\n", 0o711)
+	if err := os.Symlink("keep.txt", filepath.Join(root, "latest")); err != nil {
+		t.Fatalf("create symlink: %v", err)
+	}
+
+	result, err := Build(baseline, root, IntentWrite)
+	if err != nil {
+		t.Fatalf("Build write delta: %v", err)
+	}
+	if result.Classification != ClassificationWriteDelta {
+		t.Fatalf("classification = %q, want %q", result.Classification, ClassificationWriteDelta)
+	}
+	if err := result.Validate(); err != nil {
+		t.Fatalf("validate write result: %v", err)
+	}
+	assertDigest(t, result.ManifestDigest, result.Manifest)
+	assertDigest(t, result.ArtifactDigest, result.Artifact)
+
+	entries, order := readTestArchive(t, result.Artifact)
+	wantOrder := append([]string(nil), order...)
+	sort.Strings(wantOrder)
+	if !reflect.DeepEqual(order, wantOrder) {
+		t.Fatalf("tar order = %v, want sorted %v", order, wantOrder)
+	}
+	for _, name := range []string{
+		"files/bin/run", "files/keep.txt", deletionsArchivePath, manifestArchivePath, symlinksArchivePath,
+	} {
+		if _, found := entries[name]; !found {
+			t.Errorf("archive missing %q", name)
+		}
+	}
+	for name := range entries {
+		if strings.Contains(name, ".git") || name == "files/latest" {
+			t.Errorf("unsafe or metadata-only path %q included as file payload", name)
+		}
+	}
+	if got := string(entries["files/keep.txt"].data); got != "new\n" {
+		t.Errorf("keep payload = %q", got)
+	}
+	if mode := entries["files/keep.txt"].header.Mode; mode != 0o644 {
+		t.Errorf("normalized regular mode = %#o, want 0644", mode)
+	}
+	if mode := entries["files/bin/run"].header.Mode; mode != 0o755 {
+		t.Errorf("normalized executable mode = %#o, want 0755", mode)
+	}
+	for name, archived := range entries {
+		if !archived.header.ModTime.Equal(time.Unix(0, 0).UTC()) || archived.header.Uid != 0 || archived.header.Gid != 0 {
+			t.Errorf("entry %q has nondeterministic metadata: mtime=%s uid=%d gid=%d", name, archived.header.ModTime, archived.header.Uid, archived.header.Gid)
+		}
+	}
+
+	var deletions deletionDocument
+	if err := json.Unmarshal(entries[deletionsArchivePath].data, &deletions); err != nil {
+		t.Fatalf("decode deletion manifest: %v", err)
+	}
+	if len(deletions.Deletions) != 1 || deletions.Deletions[0] != (Deletion{Path: "delete.txt", Kind: EntryFile}) {
+		t.Fatalf("deletions = %#v", deletions.Deletions)
+	}
+	var links symlinkDocument
+	if err := json.Unmarshal(entries[symlinksArchivePath].data, &links); err != nil {
+		t.Fatalf("decode symlink manifest: %v", err)
+	}
+	if len(links.Symlinks) != 1 || links.Symlinks[0] != (Symlink{Path: "latest", Target: "keep.txt", Mode: 0o777}) {
+		t.Fatalf("symlinks = %#v", links.Symlinks)
+	}
+	var manifest Manifest
+	if err := json.Unmarshal(result.Manifest, &manifest); err != nil {
+		t.Fatalf("decode manifest: %v", err)
+	}
+	assertDigest(t, manifest.DeletionsDigest, entries[deletionsArchivePath].data)
+	assertDigest(t, manifest.SymlinksDigest, entries[symlinksArchivePath].data)
+}
+
+func TestBuildOutputIsIndependentOfCreationOrderTimestampsAndNonExecutableModes(t *testing.T) {
+	baselineRoot := t.TempDir()
+	writeTestFile(t, baselineRoot, "old.txt", "old\n", 0o644)
+	baseline := captureTestBaseline(t, baselineRoot, Options{})
+
+	first := t.TempDir()
+	second := t.TempDir()
+	populate := func(t *testing.T, root string, reverse bool) {
+		t.Helper()
+		writeTestFile(t, root, "old.txt", "changed\n", 0o600)
+		paths := []string{"zeta.txt", "nested/alpha.txt"}
+		if reverse {
+			paths[0], paths[1] = paths[1], paths[0]
+		}
+		for _, name := range paths {
+			writeTestFile(t, root, name, name+"\n", 0o660)
+		}
+		if err := os.Symlink("nested/alpha.txt", filepath.Join(root, "current")); err != nil {
+			t.Fatalf("create deterministic symlink: %v", err)
+		}
+	}
+	populate(t, first, false)
+	populate(t, second, true)
+	old := time.Unix(1_000, 0)
+	future := time.Unix(9_000_000, 0)
+	if err := filepath.Walk(first, func(name string, _ os.FileInfo, err error) error {
+		if err == nil {
+			return os.Chtimes(name, old, old)
+		}
+		return err
+	}); err != nil {
+		t.Fatalf("set first timestamps: %v", err)
+	}
+	if err := filepath.Walk(second, func(name string, _ os.FileInfo, err error) error {
+		if err == nil {
+			return os.Chtimes(name, future, future)
+		}
+		return err
+	}); err != nil {
+		t.Fatalf("set second timestamps: %v", err)
+	}
+
+	one, err := Build(baseline, first, IntentWrite)
+	if err != nil {
+		t.Fatalf("Build first: %v", err)
+	}
+	two, err := Build(baseline, second, IntentWrite)
+	if err != nil {
+		t.Fatalf("Build second: %v", err)
+	}
+	if !bytes.Equal(one.Manifest, two.Manifest) || one.ManifestDigest != two.ManifestDigest {
+		t.Fatalf("manifests differ:\n%s\n%s", one.Manifest, two.Manifest)
+	}
+	if !bytes.Equal(one.Artifact, two.Artifact) || one.ArtifactDigest != two.ArtifactDigest {
+		t.Fatalf("artifacts are not deterministic: %s != %s", one.ArtifactDigest, two.ArtifactDigest)
+	}
+}
+
+func TestCaptureRejectsUnsafeSymlinks(t *testing.T) {
+	tests := []struct {
+		name  string
+		setup func(t *testing.T, root string)
+	}{
+		{name: "absolute", setup: func(t *testing.T, root string) {
+			if err := os.Symlink("/etc/passwd", filepath.Join(root, "escape")); err != nil {
+				t.Fatal(err)
+			}
+		}},
+		{name: "traversal", setup: func(t *testing.T, root string) {
+			if err := os.Symlink("../../outside", filepath.Join(root, "escape")); err != nil {
+				t.Fatal(err)
+			}
+		}},
+		{name: "protected target", setup: func(t *testing.T, root string) {
+			writeTestFile(t, root, ".git/config", "safe\n", 0o600)
+			if err := os.Symlink(".git/config", filepath.Join(root, "escape")); err != nil {
+				t.Fatal(err)
+			}
+		}},
+		{name: "cycle", setup: func(t *testing.T, root string) {
+			if err := os.Symlink("b", filepath.Join(root, "a")); err != nil {
+				t.Fatal(err)
+			}
+			if err := os.Symlink("a", filepath.Join(root, "b")); err != nil {
+				t.Fatal(err)
+			}
+		}},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			root := t.TempDir()
+			test.setup(t, root)
+			_, err := Capture(root, Options{})
+			if !errors.Is(err, ErrUnsafeSymlink) {
+				t.Fatalf("Capture error = %v, want ErrUnsafeSymlink", err)
+			}
+		})
+	}
+}
+
+func TestReadOnlySkillsAliasIsAcceptedButRemainsProtected(t *testing.T) {
+	root := t.TempDir()
+	writeTestFile(t, root, ".claude/skills/example/SKILL.md", "baseline\n", 0o644)
+	if err := os.MkdirAll(filepath.Join(root, ".agents"), 0o755); err != nil {
+		t.Fatalf("create .agents: %v", err)
+	}
+	aliasPath := filepath.Join(root, readOnlySkillsAliasPath)
+	if err := os.Symlink(readOnlySkillsAliasTarget, aliasPath); err != nil {
+		t.Fatalf("create skills alias: %v", err)
+	}
+
+	baseline := captureTestBaseline(t, root, Options{})
+	unchanged, err := Build(baseline, root, IntentWrite)
+	if err != nil {
+		t.Fatalf("Build unchanged alias: %v", err)
+	}
+	if unchanged.Classification != ClassificationNoChange {
+		t.Fatalf("classification = %q, want %q", unchanged.Classification, ClassificationNoChange)
+	}
+
+	writeTestFile(t, root, ".claude/skills/example/SKILL.md", "modified\n", 0o644)
+	if _, err := Build(baseline, root, IntentWrite); !errors.Is(err, ErrExcludedPathModified) {
+		t.Fatalf("Build modified alias target error = %v, want ErrExcludedPathModified", err)
+	}
+
+	writeTestFile(t, root, ".claude/skills/example/SKILL.md", "baseline\n", 0o644)
+	if err := os.Remove(aliasPath); err != nil {
+		t.Fatalf("remove skills alias: %v", err)
+	}
+	if err := os.Symlink("../src", aliasPath); err != nil {
+		t.Fatalf("replace skills alias: %v", err)
+	}
+	if _, err := Build(baseline, root, IntentWrite); !errors.Is(err, ErrExcludedPathModified) {
+		t.Fatalf("Build replaced alias error = %v, want ErrExcludedPathModified", err)
+	}
+}
+
+func TestReadOnlySkillsAliasExceptionIsExact(t *testing.T) {
+	tests := []struct {
+		name   string
+		path   string
+		target string
+		setup  func(t *testing.T, root string)
+	}{
+		{
+			name: "different link path", path: ".agents/other", target: readOnlySkillsAliasTarget,
+			setup: func(t *testing.T, root string) {
+				writeTestFile(t, root, ".claude/skills/example/SKILL.md", "baseline\n", 0o644)
+			},
+		},
+		{
+			name: "different protected target", path: readOnlySkillsAliasPath, target: "../.claude/settings.json",
+			setup: func(t *testing.T, root string) {
+				writeTestFile(t, root, ".claude/settings.json", "{}\n", 0o644)
+			},
+		},
+		{
+			name: "missing target", path: readOnlySkillsAliasPath, target: readOnlySkillsAliasTarget,
+			setup: func(t *testing.T, root string) {},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			root := t.TempDir()
+			test.setup(t, root)
+			if err := os.MkdirAll(filepath.Dir(filepath.Join(root, test.path)), 0o755); err != nil {
+				t.Fatalf("create alias parent: %v", err)
+			}
+			if err := os.Symlink(test.target, filepath.Join(root, test.path)); err != nil {
+				t.Fatalf("create alias: %v", err)
+			}
+			if _, err := Capture(root, Options{}); !errors.Is(err, ErrUnsafeSymlink) {
+				t.Fatalf("Capture error = %v, want ErrUnsafeSymlink", err)
+			}
+		})
+	}
+}
+
+func TestBuildRejectsGitAndExcludedRootMutation(t *testing.T) {
+	for _, protectedPath := range []string{".git/config", ".codex/config.toml"} {
+		t.Run(protectedPath, func(t *testing.T) {
+			root := t.TempDir()
+			writeTestFile(t, root, "source.txt", "stable\n", 0o644)
+			writeTestFile(t, root, protectedPath, "before\n", 0o600)
+			baseline := captureTestBaseline(t, root, Options{})
+			writeTestFile(t, root, protectedPath, "after\n", 0o600)
+			_, err := Build(baseline, root, IntentWrite)
+			if !errors.Is(err, ErrExcludedPathModified) {
+				t.Fatalf("Build error = %v, want ErrExcludedPathModified", err)
+			}
+		})
+	}
+}
+
+func TestBuildRejectsReservedInfrastructurePathMutation(t *testing.T) {
+	root := t.TempDir()
+	writeTestFile(t, root, "source.txt", "stable\n", 0o644)
+	baseline := captureTestBaseline(t, root, Options{})
+	writeTestFile(t, root, ".orka-infrastructure/state", "attacker-controlled\n", 0o600)
+	_, err := Build(baseline, root, IntentWrite)
+	if !errors.Is(err, ErrReservedPath) {
+		t.Fatalf("Build error = %v, want ErrReservedPath", err)
+	}
+}
+
+func TestCaptureRejectsRootSymlinkAndTraversalPolicy(t *testing.T) {
+	realRoot := t.TempDir()
+	linkRoot := filepath.Join(t.TempDir(), "workspace")
+	if err := os.Symlink(realRoot, linkRoot); err != nil {
+		t.Fatalf("create root symlink: %v", err)
+	}
+	if _, err := Capture(linkRoot, Options{}); !errors.Is(err, ErrInvalidRoot) {
+		t.Fatalf("Capture root symlink error = %v, want ErrInvalidRoot", err)
+	}
+	if _, err := Capture(realRoot, Options{AdditionalReservedNames: []string{"../escape"}}); err == nil {
+		t.Fatal("Capture accepted traversing reserved path policy")
+	}
+	if err := validateArchivePath("../escape", DefaultLimits().MaxPathBytes); !errors.Is(err, ErrPathTraversal) {
+		t.Fatalf("validateArchivePath error = %v, want ErrPathTraversal", err)
+	}
+}
+
+func TestCaptureAndArtifactLimits(t *testing.T) {
+	t.Run("single file", func(t *testing.T) {
+		root := t.TempDir()
+		writeTestFile(t, root, "large", "12345", 0o644)
+		_, err := Capture(root, Options{Limits: Limits{MaxFileBytes: 4, MaxTotalBytes: 8}})
+		if !errors.Is(err, ErrLimitExceeded) {
+			t.Fatalf("Capture error = %v, want ErrLimitExceeded", err)
+		}
+	})
+	t.Run("total bytes", func(t *testing.T) {
+		root := t.TempDir()
+		writeTestFile(t, root, "one", "123", 0o644)
+		writeTestFile(t, root, "two", "456", 0o644)
+		_, err := Capture(root, Options{Limits: Limits{MaxFileBytes: 4, MaxTotalBytes: 5}})
+		if !errors.Is(err, ErrLimitExceeded) {
+			t.Fatalf("Capture error = %v, want ErrLimitExceeded", err)
+		}
+	})
+	t.Run("entry count", func(t *testing.T) {
+		root := t.TempDir()
+		writeTestFile(t, root, "one", "1", 0o644)
+		writeTestFile(t, root, "two", "2", 0o644)
+		_, err := Capture(root, Options{Limits: Limits{MaxEntries: 1}})
+		if !errors.Is(err, ErrLimitExceeded) {
+			t.Fatalf("Capture error = %v, want ErrLimitExceeded", err)
+		}
+	})
+	t.Run("artifact bytes", func(t *testing.T) {
+		root := t.TempDir()
+		writeTestFile(t, root, "file", "before", 0o644)
+		baseline := captureTestBaseline(t, root, Options{Limits: Limits{MaxArtifactBytes: 512}})
+		writeTestFile(t, root, "file", "after", 0o644)
+		_, err := Build(baseline, root, IntentWrite)
+		if !errors.Is(err, ErrLimitExceeded) {
+			t.Fatalf("Build error = %v, want ErrLimitExceeded", err)
+		}
+	})
+}
+
+func TestBuildRejectsForgedBaseline(t *testing.T) {
+	root := t.TempDir()
+	if _, err := Build(&Snapshot{}, root, IntentWrite); !errors.Is(err, ErrInvalidBaseline) {
+		t.Fatalf("Build error = %v, want ErrInvalidBaseline", err)
+	}
+}
+
+func captureTestBaseline(t *testing.T, root string, options Options) *Snapshot {
+	t.Helper()
+	baseline, err := Capture(root, options)
+	if err != nil {
+		t.Fatalf("Capture baseline: %v", err)
+	}
+	if baseline.ManifestDigest() == "" {
+		t.Fatal("baseline has no manifest digest")
+	}
+	return baseline
+}
+
+func writeTestFile(t *testing.T, root, name, content string, mode os.FileMode) {
+	t.Helper()
+	filePath := filepath.Join(root, filepath.FromSlash(name))
+	if err := os.MkdirAll(filepath.Dir(filePath), 0o755); err != nil {
+		t.Fatalf("mkdir %s: %v", name, err)
+	}
+	if err := os.WriteFile(filePath, []byte(content), mode); err != nil {
+		t.Fatalf("write %s: %v", name, err)
+	}
+	if err := os.Chmod(filePath, mode); err != nil {
+		t.Fatalf("chmod %s: %v", name, err)
+	}
+}
+
+func assertDigest(t *testing.T, got string, value []byte) {
+	t.Helper()
+	sum := sha256.Sum256(value)
+	want := DigestPrefix + hex.EncodeToString(sum[:])
+	if got != want {
+		t.Fatalf("digest = %q, want %q", got, want)
+	}
+}
+
+type archivedEntry struct {
+	header tar.Header
+	data   []byte
+}
+
+func readTestArchive(t *testing.T, artifact []byte) (map[string]archivedEntry, []string) {
+	t.Helper()
+	reader := tar.NewReader(bytes.NewReader(artifact))
+	entries := make(map[string]archivedEntry)
+	var order []string
+	for {
+		header, err := reader.Next()
+		if errors.Is(err, io.EOF) {
+			break
+		}
+		if err != nil {
+			t.Fatalf("read tar: %v", err)
+		}
+		data, err := io.ReadAll(reader)
+		if err != nil {
+			t.Fatalf("read tar entry %s: %v", header.Name, err)
+		}
+		copyHeader := *header
+		entries[header.Name] = archivedEntry{header: copyHeader, data: data}
+		order = append(order, header.Name)
+	}
+	return entries, order
+}
diff --git a/manifest_staging/charts/orka/README.md b/manifest_staging/charts/orka/README.md
index ef3c5a383..270dc54fd 100644
--- a/manifest_staging/charts/orka/README.md
+++ b/manifest_staging/charts/orka/README.md
@@ -2,33 +2,171 @@
 
 This chart is generated from `cmd/build/helmify`; edit the generator inputs and
 run `make manifests` rather than editing generated chart copies directly. It
-packages all thirteen canonical Orka CRDs under `crds/`.
+packages all 26 canonical Orka CRDs under `crds/`.
 
 ## Fresh install
 
-A normal install creates the CRDs before the templated release resources:
+A normal `harness-v2` install requires Vekil to be running in `vekil-system`,
+immutable controller and Publisher image digests, and two operator-managed
+Secrets. Prepare:
+
+- a snapshot key file containing exactly 32 random bytes;
+- a webhook serving certificate and private key whose certificate is valid for
+  `orka-webhook.orka-system.svc`, plus its PEM CA certificate; and
+- `CONTROLLER_DIGEST` and `PUBLISHER_DIGEST` values in
+  `sha256:<64 lowercase hexadecimal characters>` form.
+
+The following creates the namespace and required Secrets without putting key
+material in Helm values or command-line arguments, then installs the CRDs and
+release resources. Replace the file paths and digest placeholders first:
 
 ```bash
+set -euo pipefail
+
+: "${SNAPSHOT_KEY_FILE:?set SNAPSHOT_KEY_FILE to the 32-byte key file}"
+: "${WEBHOOK_CERT_FILE:?set WEBHOOK_CERT_FILE to the serving certificate}"
+: "${WEBHOOK_PRIVATE_KEY_FILE:?set WEBHOOK_PRIVATE_KEY_FILE to the private key}"
+: "${WEBHOOK_CA_FILE:?set WEBHOOK_CA_FILE to the CA certificate}"
+: "${CONTROLLER_DIGEST:?set CONTROLLER_DIGEST to sha256:<64 lowercase hex>}"
+: "${PUBLISHER_DIGEST:?set PUBLISHER_DIGEST to sha256:<64 lowercase hex>}"
+
+kubectl create -f - <<'EOF'
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: orka-system
+  labels:
+    orka.ai/controller-mode: harness-v2
+EOF
+kubectl -n orka-system create secret generic agent-execution-snapshot-key \
+  --from-file=snapshot-key="${SNAPSHOT_KEY_FILE}"
+kubectl -n orka-system create secret generic orka-webhook-tls \
+  --type=kubernetes.io/tls \
+  --from-file=tls.crt="${WEBHOOK_CERT_FILE}" \
+  --from-file=tls.key="${WEBHOOK_PRIVATE_KEY_FILE}" \
+  --from-file=ca.crt="${WEBHOOK_CA_FILE}"
+
+WEBHOOK_CA_BUNDLE="$(kubectl -n orka-system get secret orka-webhook-tls \
+  -o jsonpath='{.data.ca\.crt}')"
+
 helm install orka charts/orka \
   --namespace orka-system \
-  --create-namespace \
+  --set controller.mode=harness-v2 \
+  --set controller.watchNamespace=orka-system \
+  --set-string controller.image.digest="${CONTROLLER_DIGEST}" \
+  --set-string publisher.image.digest="${PUBLISHER_DIGEST}" \
+  --set-string controller.agentExecutionSnapshot.existingSecret=agent-execution-snapshot-key \
+  --set-string controller.agentExecutionSnapshot.key=snapshot-key \
+  --set-string webhooks.tls.existingSecret=orka-webhook-tls \
+  --set-string webhooks.caBundle="${WEBHOOK_CA_BUNDLE}" \
+  --set providerProxy.enabled=true \
   --wait
 ```
 
+The chart installs the exact cross-namespace ingress policy for Vekil. The
+chart-managed provider proxy itself always runs in the Helm release namespace. Leave
+`controller.acpRuntime.providerProxyNamespace` empty or set it to that release
+namespace. The only supported upstream is
+`http://vekil.vekil-system.svc:1337` (an optional trailing slash is normalized);
+alternate hosts, namespaces, and ports are rejected because the chart does not
+create matching NetworkPolicies.
+
+`service.port` is the controller Service port used by controller and Publisher Service URLs. `controller.apiPort` is only the controller container listener and Service target port.
+
+### SCM proxy NetworkPolicy portability boundary
+
+The SCM proxy NetworkPolicy excludes RFC 1918 and reserved address ranges, but
+Kubernetes does not define whether Service destination NAT runs before or
+after `ipBlock` evaluation. Some CNI and cloud combinations can therefore
+reach the `kubernetes.default` transport through its ClusterIP despite those
+exclusions. This does not grant API authorization: the SCM proxy Pod and
+ServiceAccount do not mount a service-account token, service links are disabled,
+Orka grants that identity no API RBAC, and the proxy refuses to start if the
+conventional Kubernetes service-account token path exists. The proxy itself
+accepts only exact configured SCM hostnames and rejects non-public DNS answers
+and connected peers. Clusters requiring TCP-level API denial must add and
+validate a CNI- or cloud-native pre-DNAT or Service-aware egress control;
+standard NetworkPolicy cannot guarantee this portably.
+
+### Coordinated authentication Secret rotation
+
+The Publisher and SCM egress proxy read their authentication material at process startup. Rotate each Secret and its non-secret rollout marker in the same Helm upgrade:
+
+- When rotating `publisher.auth.existingSecret` (or the chart-managed publisher auth values), bump `publisher.auth.rolloutNonce`. The marker is added only to the controller and Publisher Pod templates so both restart onto the same credential generation.
+- When rotating `scmEgressProxy.auth.existingSecret` (or the chart-managed SCM proxy token), bump `scmEgressProxy.auth.rolloutNonce`. The marker is added only to the Publisher and SCM proxy Pod templates.
+
+The nonce is a revision label, not a credential. Never put Secret content in it. A coordinated upgrade may briefly fail closed while Pods roll, but it avoids an indefinite split generation.
+
+The harness-v1 wrapper likewise keeps execution authority and transport
+material separate. `harnessV1.auth.existingSecret` contains only the bearer
+token and is immutable while v1 work exists. `harnessV1.tls.existingSecret`
+contains `tls.crt`, `tls.key`, and `ca.crt`. A TLS Secret name change is a
+wrapper Pod-template change and automatically uses the existing drained
+rollover. For same-name certificate renewal, update the TLS Secret and bump
+`harnessV1.tls.rolloutNonce` in the Helm upgrade; the hook drains the live
+wrapper before both wrapper and controller restart. Keep the updated `ca.crt`
+able to verify the certificate currently being served during that drain, or
+rotate to a versioned TLS Secret so the hook can mount the prior CA.
+
 CRDs are cluster-scoped and shared by every Orka release. Use `--skip-crds`
 only when a designated platform or GitOps workflow already manages compatible
 Orka CRDs for the cluster.
 
+## Static harness mode
+
+Every release selects exactly one controller mode: `harness-v1` or
+`harness-v2`. `dual`, `auto`, and `harness-v1-drain` are rejected. Each release
+also requires a distinct, non-empty `controller.watchNamespace` labeled with
+the matching mode:
+
+```bash
+kubectl create -f - <<'EOF'
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: orka-v2-system
+  labels:
+    orka.ai/controller-mode: harness-v2
+EOF
+
+helm install orka-v2 charts/orka \
+  --namespace orka-v2-system \
+  --set controller.mode=harness-v2 \
+  --set controller.watchNamespace=orka-v2-system
+```
+
+The mode is an installation identity, not an upgrade toggle. Never change a
+release from v1 to v2 in place or reuse its PVC, SQLite store, ledger, Session,
+or Task identities under the other mode.
+
+A v1 and v2 release may share a cluster only when their release/watch
+namespaces, Services, ServiceAccounts/RBAC, Leases, stores, Secrets, and
+data-plane resources are disjoint. The chart intentionally requires
+`controller.watchNamespace` to equal the Helm release namespace. The v2
+release must also have its own runtime namespace. Install the shared compatible
+CRDs and common admission resources through one designated owner; install the
+second release with `--skip-crds`.
+
 Controller Services, worker ServiceAccounts, and worker RBAC are scoped to the
 Helm release name. Run only one Orka controller release per namespace. If a
 cluster has multiple releases, every release (including the first) must use a
 cluster-unique release name or `fullnameOverride`, a separate controller
-namespace, and a distinct, non-empty `controller.watchNamespace`. Do not mix a
-cluster-wide watcher with namespace-scoped releases: gateway admission policies
-would overlap. All releases share the same cluster-scoped CRDs.
+namespace, and a distinct, non-empty `controller.watchNamespace`. Cluster-wide
+watchers are rejected. All releases share the same cluster-scoped CRDs, and
+cluster-scoped gateway/workspace ownership belongs only to the v2 release.
 
 ## Upgrade
 
+An in-place controller upgrade is supported only when the release namespace
+already carries the same static mode claim and any live controller declares
+that mode and watch namespace. A deleted controller can be recreated only
+under that retained same-mode namespace claim. A pre-static controller that
+implicitly enabled ACP is not a supported `harness-v2` upgrade source because
+its accepted attempts may lack the immutable execution authority required for
+recovery. Settle or retire that installation and install static `harness-v2`
+as a new release and namespace. The chart rejects missing, opposite-mode, and
+legacy identity before rendering upgrade resources.
+
 Helm installs files from `crds/` only during installation. It does not create or
 update them during `helm upgrade`, including when upgrading from an older Orka
 chart that installed no CRDs.
@@ -76,7 +214,7 @@ A matching Orka source checkout provides the same guarded flow as
 competing CRD apply workflows for the same cluster.
 
 If another system owns the CRDs, perform the CRD-first step through that system,
-wait for all thirteen CRDs to become `Established`, and then upgrade Orka.
+wait for all 26 CRDs to become `Established`, and then upgrade Orka.
 
 If a previous release was uninstalled, update its retained CRDs first and install
 the replacement release with `--skip-crds`.
diff --git a/manifest_staging/charts/orka/crds/agent-customresourcedefinition.yaml b/manifest_staging/charts/orka/crds/agent-customresourcedefinition.yaml
index 6bcb07722..76f7d04c9 100644
--- a/manifest_staging/charts/orka/crds/agent-customresourcedefinition.yaml
+++ b/manifest_staging/charts/orka/crds/agent-customresourcedefinition.yaml
@@ -1094,10 +1094,10 @@ spec:
                     type: array
                   workspace:
                     description: |-
-                      Workspace requests an upstream agent-sandbox execution workspace for agent Tasks.
-                      When enabled, the Task controller validates the request and propagates the
-                      resolved sandbox settings to the agent worker Job. The worker wrapper then
-                      claims the sandbox workspace and runs the configured agent runtime inside it.
+                      Workspace requests an execution workspace for worker-backed Task types.
+                      ACP core agent Tasks reject this field because their ephemeral workspace is
+                      owned by RuntimeSession lifecycle and clean-room publication. Actor-backed
+                      RuntimeSession support is a future integration behind the v2 lifecycle seam.
                     properties:
                       boot:
                         description: |-
@@ -1247,6 +1247,13 @@ spec:
                   Model defines the LLM model configuration
                   Provider field is optional if providerRef is set
                 properties:
+                  contextWindow:
+                    description: |-
+                      ContextWindow is the reviewed model context capacity in tokens. Built-in
+                      runtimes that manage their own compaction require this value explicitly.
+                    format: int32
+                    minimum: 1
+                    type: integer
                   fallbacks:
                     description: |-
                       Fallbacks defines alternative providers to try when the primary fails.
@@ -1267,7 +1274,10 @@ spec:
                       type: object
                     type: array
                   maxTokens:
-                    description: MaxTokens limits the response length
+                    description: |-
+                      MaxTokens limits the response length. OpenCode validates positive reviewed
+                      limits at its runtime-specific admission boundary; existing Agent objects
+                      may retain the legacy zero value.
                     format: int32
                     type: integer
                   name:
@@ -1284,7 +1294,6 @@ spec:
                     - openai
                     type: string
                   temperature:
-                    default: 0.7
                     description: Temperature controls randomness in generation
                     maximum: 2
                     minimum: 0
@@ -1382,6 +1391,17 @@ spec:
                   Runtime configures this Agent for external CLI runtimes (type: agent tasks).
                   When set, this Agent is for type: agent tasks only (mutually exclusive with providerRef).
                 properties:
+                  contractVersion:
+                    description: |-
+                      ContractVersion is the immutable harness protocol selector for built-in
+                      runtime types. There is no default: a missing selector is never
+                      interpreted as either protocol, and fail-closed admission requires an
+                      explicit value on new built-in Agents. runtime.type alone (including
+                      opencode, which exists in both protocols) is never protocol evidence.
+                    enum:
+                    - orka.harness.v1
+                    - orka.harness.v2
+                    type: string
                   defaultAllowBash:
                     description: |-
                       DefaultAllowBash controls whether bash is allowed by default for tasks using this Agent.
@@ -1428,15 +1448,21 @@ spec:
                     description: Type specifies which built-in CLI runtime to use.
                       Use runtimeRef for admin-registered custom runtimes.
                     enum:
-                    - copilot
                     - claude
                     - codex
+                    - copilot
                     - opencode
                     type: string
                 type: object
                 x-kubernetes-validations:
                 - message: exactly one of type or runtimeRef is required
                   rule: has(self.type) != has(self.runtimeRef)
+                - message: runtime.contractVersion is immutable once set
+                  rule: '!has(oldSelf.contractVersion) || (has(self.contractVersion)
+                    && self.contractVersion == oldSelf.contractVersion)'
+                - message: runtime.contractVersion applies only to built-in runtime
+                    types; runtimeRef derives the protocol from the referenced AgentRuntime
+                  rule: '!has(self.contractVersion) || has(self.type)'
               secretRef:
                 description: SecretRef references a Secret containing LLM API keys
                 properties:
@@ -1520,6 +1546,9 @@ spec:
                     description: Inline is the inline prompt text
                     type: string
                 type: object
+                x-kubernetes-validations:
+                - message: system prompt must use only one of inline or configMapRef
+                  rule: '!(has(self.inline) && self.inline.size() > 0 && has(self.configMapRef))'
               tools:
                 description: Tools lists the default tools available to this agent
                 items:
@@ -1547,6 +1576,11 @@ spec:
             x-kubernetes-validations:
             - message: execution.workspace.classRef is only supported on Task specs
               rule: '!has(self.execution) || !has(self.execution.workspace) || !has(self.execution.workspace.classRef)'
+            - message: opencode orka.harness.v2 runtime does not support spec.systemPrompt
+              rule: '!(has(self.runtime) && has(self.runtime.type) && self.runtime.type
+                == ''opencode'' && has(self.runtime.contractVersion) && self.runtime.contractVersion
+                == ''orka.harness.v2'' && has(self.systemPrompt) && ((has(self.systemPrompt.inline)
+                && self.systemPrompt.inline.size() > 0) || has(self.systemPrompt.configMapRef)))'
           status:
             description: AgentStatus defines the observed state of Agent
             properties:
diff --git a/manifest_staging/charts/orka/crds/agentruntime-customresourcedefinition.yaml b/manifest_staging/charts/orka/crds/agentruntime-customresourcedefinition.yaml
index e9623b7ae..707f8640a 100644
--- a/manifest_staging/charts/orka/crds/agentruntime-customresourcedefinition.yaml
+++ b/manifest_staging/charts/orka/crds/agentruntime-customresourcedefinition.yaml
@@ -24,8 +24,8 @@ spec:
     - jsonPath: .spec.deployment.mode
       name: Mode
       type: string
-    - jsonPath: .status.observedCapabilities.runtimeName
-      name: Runtime
+    - jsonPath: .status.observedCapabilities.runtimeInstanceID
+      name: Instance
       type: string
     - jsonPath: .metadata.creationTimestamp
       name: Age
@@ -33,7 +33,8 @@ spec:
     name: v1alpha1
     schema:
       openAPIV3Schema:
-        description: AgentRuntime is the Schema for registered Orka harness runtimes.
+        description: AgentRuntime is the Schema for registered external Orka harness
+          runtimes.
         properties:
           apiVersion:
             description: |-
@@ -53,19 +54,27 @@ spec:
           metadata:
             type: object
           spec:
-            description: AgentRuntimeRegistrySpec defines the desired state of a registered
-              Orka harness runtime.
+            description: |-
+              AgentRuntimeRegistrySpec defines the desired state of a registered Orka harness runtime.
+              The dual schema has no contractVersion default: omission is tolerated only for
+              stored objects awaiting the one-time bridge classification and is never
+              interpreted as either protocol. Fail-closed admission requires an explicit
+              value for new registrations.
             properties:
               capabilities:
-                description: Capabilities declares readiness requirements Orka checks
-                  against the runtime.
+                description: |-
+                  Capabilities pins the runtime capability claims. Required with the exact
+                  instance/profile/limits/governance shape for orka.harness.v2; historically
+                  optional for orka.harness.v1.
                 properties:
                   brokeredToolClasses:
-                    description: BrokeredToolClasses lists brokered tool classes the
-                      runtime must advertise when brokered mode is required.
+                    description: |-
+                      BrokeredToolClasses lists the harness v1 brokered tool classes supported
+                      by the runtime. v1 only; historically optional.
                     items:
-                      description: AgentRuntimeBrokeredToolClass declares which classes
-                        of Orka-brokered tools a runtime can request.
+                      description: |-
+                        AgentRuntimeBrokeredToolClass classifies Tool CRDs. It is shared by the Tool
+                        API and by harness v1 AgentRuntime capability declarations.
                       enum:
                       - read
                       - write
@@ -73,44 +82,293 @@ spec:
                       type: string
                     type: array
                     x-kubernetes-list-type: set
+                  limits:
+                    description: Limits must exactly match /v2/capabilities. v2 only.
+                    properties:
+                      maxBufferedEvents:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxConcurrentPrompts:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxEventLineBytes:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxPendingPermissions:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxPromptLeaseMillis:
+                        format: int64
+                        minimum: 1
+                        type: integer
+                      maxRequestBytes:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxResidentSessions:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxTerminalResultBytes:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxUpdateEventsPerSecond:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxWorkspaceDeltaBytes:
+                        format: int64
+                        minimum: 1
+                        type: integer
+                      minPromptLeaseMillis:
+                        format: int64
+                        minimum: 1
+                        type: integer
+                    required:
+                    - maxBufferedEvents
+                    - maxConcurrentPrompts
+                    - maxEventLineBytes
+                    - maxPendingPermissions
+                    - maxPromptLeaseMillis
+                    - maxRequestBytes
+                    - maxResidentSessions
+                    - maxTerminalResultBytes
+                    - maxUpdateEventsPerSecond
+                    - maxWorkspaceDeltaBytes
+                    - minPromptLeaseMillis
+                    type: object
+                  profile:
+                    description: Profile is the exact immutable profile accepted by
+                      v2 session creation.
+                    properties:
+                      acpProfile:
+                        description: ACPProfile is the reviewed ACP profile.
+                        enum:
+                        - acp.v1
+                        type: string
+                      adapterDigest:
+                        description: AdapterDigest pins the adapter/CLI artifact set.
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      adapterName:
+                        description: AdapterName identifies the sole adapter contained
+                          by this external profile.
+                        maxLength: 128
+                        minLength: 1
+                        type: string
+                      agentConfigurationDigest:
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      approvalPolicyDigest:
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      digest:
+                        description: Digest is the canonical orka.harness.v2 runtime-profile
+                          digest.
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      digestSchemaVersion:
+                        description: DigestSchemaVersion identifies the canonical
+                          profile digest schema.
+                        enum:
+                        - 1
+                        format: int32
+                        type: integer
+                      mcpConfigurationDigest:
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      model:
+                        maxLength: 256
+                        minLength: 1
+                        type: string
+                      modelLimits:
+                        description: ModelLimits pins optional reviewed model token
+                          capacities.
+                        properties:
+                          context:
+                            description: Context is the maximum model context capacity
+                              in tokens.
+                            format: int64
+                            minimum: 1
+                            type: integer
+                          output:
+                            description: Output is the maximum generated output in
+                              tokens.
+                            format: int64
+                            minimum: 1
+                            type: integer
+                        required:
+                        - context
+                        - output
+                        type: object
+                        x-kubernetes-validations:
+                        - message: model context limit must exceed output limit
+                          rule: self.context > self.output
+                      providerKind:
+                        maxLength: 128
+                        minLength: 1
+                        type: string
+                      proxyCredentialRole:
+                        maxLength: 256
+                        minLength: 1
+                        type: string
+                      proxyCredentialScope:
+                        maxLength: 1024
+                        minLength: 1
+                        type: string
+                      resourceClass:
+                        maxLength: 128
+                        minLength: 1
+                        type: string
+                      toolPolicyDigest:
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      workspaceIntent:
+                        description: WorkspaceIntent is the one immutable strict intent
+                          represented by this profile.
+                        enum:
+                        - read
+                        - write
+                        type: string
+                    required:
+                    - acpProfile
+                    - adapterDigest
+                    - adapterName
+                    - agentConfigurationDigest
+                    - approvalPolicyDigest
+                    - digest
+                    - digestSchemaVersion
+                    - mcpConfigurationDigest
+                    - model
+                    - providerKind
+                    - proxyCredentialRole
+                    - proxyCredentialScope
+                    - resourceClass
+                    - toolPolicyDigest
+                    - workspaceIntent
+                    type: object
+                  runtimeInstanceID:
+                    description: |-
+                      RuntimeInstanceID is the immutable external supervisor instance expected from
+                      authenticated /v2/status and every conformance response. v2 only.
+                    maxLength: 253
+                    minLength: 1
+                    type: string
                   supportsArtifacts:
-                    description: SupportsArtifacts requires the runtime to advertise
-                      artifact/result reference support when true.
+                    description: SupportsArtifacts declares harness v1 artifact support.
+                      v1 only.
                     type: boolean
                   supportsCancel:
-                    description: SupportsCancel requires the runtime to advertise
-                      cancellation support when true.
+                    description: SupportsCancel declares harness v1 turn cancellation
+                      support. v1 only.
                     type: boolean
                   supportsContinuation:
-                    description: SupportsContinuation requires the runtime to advertise
-                      continuation after Orka-brokered tool results when true.
+                    description: SupportsContinuation declares harness v1 brokered
+                      continuation support. v1 only.
+                    type: boolean
+                  supportsDrain:
+                    description: SupportsDrain must exactly match the static v2 capability
+                      claim.
+                    type: boolean
+                  supportsPublicationFinalization:
+                    description: SupportsPublicationFinalization must exactly match
+                      the static v2 capability claim.
                     type: boolean
                   supportsRuntimeSessions:
-                    description: SupportsRuntimeSessions requires the runtime to advertise
-                      stable runtime sessions when true.
+                    description: SupportsRuntimeSessions declares harness v1 runtime
+                      session support. v1 only.
                     type: boolean
                   toolExecutionModes:
-                    description: ToolExecutionModes lists tool execution modes the
-                      runtime must advertise.
+                    description: |-
+                      ToolExecutionModes lists the harness v1 tool execution modes supported by
+                      the runtime. v1 only; historically optional.
                     items:
-                      description: AgentRuntimeToolExecutionMode declares how custom
-                        runtimes interact with tools.
+                      description: AgentRuntimeToolExecutionMode describes how a harness
+                        v1 runtime executes tools.
                       enum:
                       - observed
                       - brokered
                       type: string
                     type: array
                     x-kubernetes-list-type: set
+                  workspaceGovernance:
+                    description: WorkspaceGovernance must exactly match the static
+                      v2 capability claim.
+                    properties:
+                      cancellationSettlement:
+                        type: boolean
+                      duplicateSafeMutations:
+                        type: boolean
+                      exactInstanceFencing:
+                        type: boolean
+                      mode:
+                        description: Mode selects strict Orka governance or an explicit
+                          trusted escape hatch.
+                        enum:
+                        - strict-governed
+                        - trusted-non-governed
+                        type: string
+                      noDirectSCMPublication:
+                        type: boolean
+                      orkaOwnedCleanRoomPublication:
+                        type: boolean
+                      orkaOwnedWorkspaceDeltas:
+                        type: boolean
+                      promptScopedBrokerAuthorization:
+                        type: boolean
+                      trusted:
+                        description: |-
+                          Trusted must be true only for trusted-non-governed runtimes. Such runtimes
+                          are ineligible for Tasks requesting strict read or write guarantees.
+                        type: boolean
+                    required:
+                    - cancellationSettlement
+                    - duplicateSafeMutations
+                    - exactInstanceFencing
+                    - mode
+                    - noDirectSCMPublication
+                    - orkaOwnedCleanRoomPublication
+                    - orkaOwnedWorkspaceDeltas
+                    - promptScopedBrokerAuthorization
+                    - trusted
+                    type: object
+                    x-kubernetes-validations:
+                    - message: trusted-non-governed runtimes must be explicitly marked
+                        trusted
+                      rule: self.mode != 'trusted-non-governed' || self.trusted
+                    - message: strict-governed runtimes must not use the trusted non-governed
+                        escape hatch
+                      rule: self.mode != 'strict-governed' || !self.trusted
+                    - message: strict-governed runtimes must claim every strict workspace
+                        governance guarantee
+                      rule: self.mode != 'strict-governed' || (self.orkaOwnedWorkspaceDeltas
+                        && self.promptScopedBrokerAuthorization && self.noDirectSCMPublication
+                        && self.orkaOwnedCleanRoomPublication && self.exactInstanceFencing
+                        && self.duplicateSafeMutations && self.cancellationSettlement)
+                    - message: trusted-non-governed runtimes must not claim strict
+                        workspace guarantees
+                      rule: self.mode != 'trusted-non-governed' || (!self.orkaOwnedWorkspaceDeltas
+                        && !self.promptScopedBrokerAuthorization && !self.noDirectSCMPublication
+                        && !self.orkaOwnedCleanRoomPublication && !self.exactInstanceFencing
+                        && !self.duplicateSafeMutations && !self.cancellationSettlement)
                 type: object
               clientAuth:
-                description: ClientAuth configures controller-to-runtime authentication.
+                description: ClientAuth configures controller authentication and mutation
+                  authorization.
                 properties:
                   bearerTokenSecretRef:
                     description: |-
-                      BearerAuthRef points to the bearer token Secret used for mutating harness endpoints.
-                      The referenced Secret must opt in with label orka.ai/agent-runtime-auth=true,
-                      may set orka.ai/agent-runtime-name=<runtime> to restrict use to one AgentRuntime,
-                      and must set annotation orka.ai/agent-runtime-endpoint=<deployment.endpoint> to bind the token to one endpoint.
+                      BearerAuthRef points to the harness v1 bearer token Secret used for
+                      mutating v1 harness endpoints. The referenced Secret must opt in with
+                      label orka.ai/agent-runtime-auth=true, may set
+                      orka.ai/agent-runtime-name=<runtime> to restrict use to one AgentRuntime,
+                      and must set annotation orka.ai/agent-runtime-endpoint=<deployment.endpoint>
+                      to bind the token to one endpoint.
                     properties:
                       key:
                         description: Key is the Secret data key containing the bearer
@@ -125,28 +383,80 @@ spec:
                     - key
                     - name
                     type: object
-                required:
-                - bearerTokenSecretRef
+                  controllerBearerTokenSecretRef:
+                    description: |-
+                      ControllerBearerTokenSecretRef supplies the controller bearer token used by
+                      authenticated v2 status and mutation endpoints.
+                    properties:
+                      key:
+                        description: Key is the Secret data key.
+                        maxLength: 253
+                        minLength: 1
+                        type: string
+                      name:
+                        description: Name is the Secret name in the AgentRuntime namespace.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                    required:
+                    - key
+                    - name
+                    type: object
+                  operationCapabilitySecretRef:
+                    description: |-
+                      OperationCapabilitySecretRef supplies the HMAC secret used to bind every
+                      v2 mutation to its exact fence, operation identity, request digest, and expiry.
+                    properties:
+                      key:
+                        description: Key is the Secret data key.
+                        maxLength: 253
+                        minLength: 1
+                        type: string
+                      name:
+                        description: Name is the Secret name in the AgentRuntime namespace.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                    required:
+                    - key
+                    - name
+                    type: object
                 type: object
+                x-kubernetes-validations:
+                - message: legacy v1 and v2 client auth shapes are mutually exclusive
+                  rule: '!(has(self.bearerTokenSecretRef) && (has(self.controllerBearerTokenSecretRef)
+                    || has(self.operationCapabilitySecretRef)))'
+                - message: v2 client auth requires both controllerBearerTokenSecretRef
+                    and operationCapabilitySecretRef
+                  rule: has(self.controllerBearerTokenSecretRef) == has(self.operationCapabilitySecretRef)
+                - message: client auth requires either the v1 or the v2 credential
+                    shape
+                  rule: has(self.bearerTokenSecretRef) || has(self.controllerBearerTokenSecretRef)
               contractVersion:
-                default: orka.harness.v1
-                description: ContractVersion is the Orka harness contract this runtime
-                  must implement.
+                description: |-
+                  ContractVersion is the Orka harness contract this runtime must implement.
+                  It is immutable once set. Required for new registrations through
+                  fail-closed admission; the bridge schema tolerates omission only on
+                  unchanged stored objects while execution admission is closed.
                 enum:
                 - orka.harness.v1
+                - orka.harness.v2
                 type: string
               deployment:
                 description: Deployment identifies the runtime endpoint provider.
                 properties:
                   endpoint:
                     description: |-
-                      Endpoint is the base URL for a pre-deployed or external orka.harness.v1 service.
-                      It must not contain credentials; bearer auth is configured via clientAuth.
+                      Endpoint is the base URL for an external harness service. It must not
+                      contain credentials, query parameters, or fragments.
                     pattern: ^https?://[^\s@?#]+$
                     type: string
                   mode:
-                    description: Mode is the deployment mode. The first milestone
-                      supports external endpoints only.
+                    description: |-
+                      Mode is the deployment mode. External AgentRuntime registrations are not
+                      scaled or recycled by Orka.
                     enum:
                     - external-endpoint
                     type: string
@@ -156,9 +466,40 @@ spec:
                 type: object
             required:
             - clientAuth
-            - contractVersion
             - deployment
             type: object
+            x-kubernetes-validations:
+            - message: contractVersion is immutable once set
+              rule: '!has(oldSelf.contractVersion) || (has(self.contractVersion) &&
+                self.contractVersion == oldSelf.contractVersion)'
+            - message: orka.harness.v1 requires the legacy bearerTokenSecretRef client
+                auth shape
+              rule: '!has(self.contractVersion) || self.contractVersion != ''orka.harness.v1''
+                || (has(self.clientAuth.bearerTokenSecretRef) && !has(self.clientAuth.controllerBearerTokenSecretRef)
+                && !has(self.clientAuth.operationCapabilitySecretRef))'
+            - message: orka.harness.v1 capabilities must not carry v2 capability fields
+              rule: '!has(self.contractVersion) || self.contractVersion != ''orka.harness.v1''
+                || !has(self.capabilities) || (!has(self.capabilities.runtimeInstanceID)
+                && !has(self.capabilities.profile) && !has(self.capabilities.limits)
+                && !has(self.capabilities.workspaceGovernance) && !has(self.capabilities.supportsDrain)
+                && !has(self.capabilities.supportsPublicationFinalization))'
+            - message: orka.harness.v2 requires the v2 controller bearer and operation
+                capability client auth shape
+              rule: '!has(self.contractVersion) || self.contractVersion != ''orka.harness.v2''
+                || (has(self.clientAuth.controllerBearerTokenSecretRef) && has(self.clientAuth.operationCapabilitySecretRef)
+                && !has(self.clientAuth.bearerTokenSecretRef))'
+            - message: orka.harness.v2 requires pinned instance, profile, limits,
+                and workspace governance capabilities
+              rule: '!has(self.contractVersion) || self.contractVersion != ''orka.harness.v2''
+                || (has(self.capabilities) && has(self.capabilities.runtimeInstanceID)
+                && has(self.capabilities.profile) && has(self.capabilities.limits)
+                && has(self.capabilities.workspaceGovernance))'
+            - message: orka.harness.v2 capabilities must not carry v1 capability fields
+              rule: '!has(self.contractVersion) || self.contractVersion != ''orka.harness.v2''
+                || !has(self.capabilities) || (!has(self.capabilities.toolExecutionModes)
+                && !has(self.capabilities.brokeredToolClasses) && !has(self.capabilities.supportsCancel)
+                && !has(self.capabilities.supportsRuntimeSessions) && !has(self.capabilities.supportsContinuation)
+                && !has(self.capabilities.supportsArtifacts))'
           status:
             description: AgentRuntimeStatus defines the observed state of an AgentRuntime.
             properties:
@@ -232,20 +573,26 @@ spec:
                 type: string
               observedAuthRefResourceVersion:
                 description: |-
-                  ObservedAuthRefResourceVersion is the resourceVersion of the bearer auth Secret
-                  used for the last readiness probe. It is non-secret metadata used to decide
-                  when token rotation requires a fresh authenticated conformance turn.
+                  ObservedAuthRefResourceVersion is the resourceVersion of the harness v1
+                  bearer auth Secret used for the last v1 readiness probe. It is non-secret
+                  metadata used to decide when token rotation requires a fresh authenticated
+                  conformance turn. v2 probes use the two v2 auth resource-version fields.
                 type: string
               observedCapabilities:
                 description: ObservedCapabilities contains sanitized capabilities
                   from the last probe.
                 properties:
+                  acpVersion:
+                    type: string
+                  adapterDigest:
+                    type: string
+                  adapterName:
+                    type: string
                   brokeredToolClasses:
-                    description: BrokeredToolClasses are the brokered tool classes
-                      advertised by /v1/capabilities.
                     items:
-                      description: AgentRuntimeBrokeredToolClass declares which classes
-                        of Orka-brokered tools a runtime can request.
+                      description: |-
+                        AgentRuntimeBrokeredToolClass classifies Tool CRDs. It is shared by the Tool
+                        API and by harness v1 AgentRuntime capability declarations.
                       enum:
                       - read
                       - write
@@ -253,63 +600,123 @@ spec:
                       type: string
                     type: array
                     x-kubernetes-list-type: set
+                  controllerEpoch:
+                    format: int64
+                    type: integer
+                  lifecycle:
+                    type: string
+                  limits:
+                    description: Limits records the v2 protocol bounds. It is absent
+                      for harness v1.
+                    properties:
+                      maxBufferedEvents:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxConcurrentPrompts:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxEventLineBytes:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxPendingPermissions:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxPromptLeaseMillis:
+                        format: int64
+                        minimum: 1
+                        type: integer
+                      maxRequestBytes:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxResidentSessions:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxTerminalResultBytes:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxUpdateEventsPerSecond:
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      maxWorkspaceDeltaBytes:
+                        format: int64
+                        minimum: 1
+                        type: integer
+                      minPromptLeaseMillis:
+                        format: int64
+                        minimum: 1
+                        type: integer
+                    required:
+                    - maxBufferedEvents
+                    - maxConcurrentPrompts
+                    - maxEventLineBytes
+                    - maxPendingPermissions
+                    - maxPromptLeaseMillis
+                    - maxRequestBytes
+                    - maxResidentSessions
+                    - maxTerminalResultBytes
+                    - maxUpdateEventsPerSecond
+                    - maxWorkspaceDeltaBytes
+                    - minPromptLeaseMillis
+                    type: object
                   maxConcurrentTurns:
-                    description: MaxConcurrentTurns is the advertised concurrency
-                      ceiling.
                     type: integer
                   maxOutputBytes:
-                    description: MaxOutputBytes is the advertised maximum output payload
-                      size.
                     format: int64
                     type: integer
                   maxTurnSeconds:
-                    description: MaxTurnSeconds is the advertised per-turn duration
-                      ceiling.
+                    type: integer
+                  model:
+                    type: string
+                  profileDigestSchemaVersion:
+                    format: int32
                     type: integer
                   protocolVersion:
-                    description: ProtocolVersion is the runtime's advertised Orka
-                      protocol version.
                     type: string
                   providerKind:
-                    description: ProviderKind is the provider kind advertised by /v1/capabilities.
+                    type: string
+                  runtimeInstanceID:
                     type: string
                   runtimeName:
-                    description: RuntimeName is the runtime name advertised by /v1/capabilities.
+                    type: string
+                  runtimePoolGeneration:
+                    format: int64
+                    type: integer
+                  runtimePoolUID:
+                    type: string
+                  runtimeProfileDigest:
                     type: string
                   runtimeVersion:
-                    description: RuntimeVersion is the runtime version advertised
-                      by /v1/capabilities.
+                    type: string
+                  supervisorBootID:
                     type: string
                   supportsArtifacts:
-                    description: SupportsArtifacts reports whether the runtime advertises
-                      artifact/result reference support.
                     type: boolean
                   supportsCancel:
-                    description: SupportsCancel reports whether the runtime advertises
-                      cancellation support.
                     type: boolean
                   supportsContinuation:
-                    description: SupportsContinuation reports whether the runtime
-                      advertises continuation support.
+                    type: boolean
+                  supportsDrain:
+                    type: boolean
+                  supportsPublicationFinalization:
                     type: boolean
                   supportsRuntimeSessions:
-                    description: SupportsRuntimeSessions reports whether the runtime
-                      advertises runtime-session support.
                     type: boolean
                   supportsSuspend:
-                    description: SupportsSuspend reports whether the runtime advertises
-                      suspend support.
                     type: boolean
                   supportsWorkspaceSnapshot:
-                    description: SupportsWorkspaceSnapshot reports whether the runtime
-                      advertises workspace snapshots.
                     type: boolean
                   toolExecutionModes:
-                    description: ToolExecutionModes are the tool modes advertised
-                      by /v1/capabilities.
                     items:
-                      description: AgentRuntimeToolExecutionMode declares how custom
-                        runtimes interact with tools.
+                      description: AgentRuntimeToolExecutionMode describes how a harness
+                        v1 runtime executes tools.
                       enum:
                       - observed
                       - brokered
@@ -317,14 +724,83 @@ spec:
                     type: array
                     x-kubernetes-list-type: set
                   transport:
-                    description: Transport is the runtime transport, normally http+sse.
                     type: string
+                  workspaceGovernance:
+                    description: WorkspaceGovernance records the v2 workspace guarantees.
+                      It is absent for harness v1.
+                    properties:
+                      cancellationSettlement:
+                        type: boolean
+                      duplicateSafeMutations:
+                        type: boolean
+                      exactInstanceFencing:
+                        type: boolean
+                      mode:
+                        description: Mode selects strict Orka governance or an explicit
+                          trusted escape hatch.
+                        enum:
+                        - strict-governed
+                        - trusted-non-governed
+                        type: string
+                      noDirectSCMPublication:
+                        type: boolean
+                      orkaOwnedCleanRoomPublication:
+                        type: boolean
+                      orkaOwnedWorkspaceDeltas:
+                        type: boolean
+                      promptScopedBrokerAuthorization:
+                        type: boolean
+                      trusted:
+                        description: |-
+                          Trusted must be true only for trusted-non-governed runtimes. Such runtimes
+                          are ineligible for Tasks requesting strict read or write guarantees.
+                        type: boolean
+                    required:
+                    - cancellationSettlement
+                    - duplicateSafeMutations
+                    - exactInstanceFencing
+                    - mode
+                    - noDirectSCMPublication
+                    - orkaOwnedCleanRoomPublication
+                    - orkaOwnedWorkspaceDeltas
+                    - promptScopedBrokerAuthorization
+                    - trusted
+                    type: object
+                    x-kubernetes-validations:
+                    - message: trusted-non-governed runtimes must be explicitly marked
+                        trusted
+                      rule: self.mode != 'trusted-non-governed' || self.trusted
+                    - message: strict-governed runtimes must not use the trusted non-governed
+                        escape hatch
+                      rule: self.mode != 'strict-governed' || !self.trusted
+                    - message: strict-governed runtimes must claim every strict workspace
+                        governance guarantee
+                      rule: self.mode != 'strict-governed' || (self.orkaOwnedWorkspaceDeltas
+                        && self.promptScopedBrokerAuthorization && self.noDirectSCMPublication
+                        && self.orkaOwnedCleanRoomPublication && self.exactInstanceFencing
+                        && self.duplicateSafeMutations && self.cancellationSettlement)
+                    - message: trusted-non-governed runtimes must not claim strict
+                        workspace guarantees
+                      rule: self.mode != 'trusted-non-governed' || (!self.orkaOwnedWorkspaceDeltas
+                        && !self.promptScopedBrokerAuthorization && !self.noDirectSCMPublication
+                        && !self.orkaOwnedCleanRoomPublication && !self.exactInstanceFencing
+                        && !self.duplicateSafeMutations && !self.cancellationSettlement)
                 type: object
+              observedControllerAuthRefResourceVersion:
+                description: |-
+                  ObservedControllerAuthRefResourceVersion is the bearer Secret version used
+                  by the last successful or failed authenticated conformance probe.
+                type: string
               observedGeneration:
                 description: ObservedGeneration is the latest generation reconciled
                   into this status.
                 format: int64
                 type: integer
+              observedOperationCapabilityRefResourceVersion:
+                description: |-
+                  ObservedOperationCapabilityRefResourceVersion is the HMAC Secret version used
+                  by the last mutation conformance probe.
+                type: string
               ready:
                 description: Ready indicates the runtime passed the configured Orka
                   readiness checks.
diff --git a/manifest_staging/charts/orka/crds/branchclaim-customresourcedefinition.yaml b/manifest_staging/charts/orka/crds/branchclaim-customresourcedefinition.yaml
new file mode 100644
index 000000000..1328a8fe0
--- /dev/null
+++ b/manifest_staging/charts/orka/crds/branchclaim-customresourcedefinition.yaml
@@ -0,0 +1,197 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: branchclaims.core.orka.ai
+spec:
+  group: core.orka.ai
+  names:
+    kind: BranchClaim
+    listKind: BranchClaimList
+    plural: branchclaims
+    shortNames:
+    - bclaim
+    singular: branchclaim
+  scope: Cluster
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .spec.repositoryId
+      name: Repository
+      type: string
+    - jsonPath: .spec.ref
+      name: Ref
+      type: string
+    - jsonPath: .spec.ownerKind
+      name: Owner
+      type: string
+    - jsonPath: .status.generation
+      name: Generation
+      type: integer
+    - jsonPath: .status.availability
+      name: Availability
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: |-
+          BranchClaim is the cluster-wide Kubernetes-authoritative ownership and exact
+          baseline record for one canonical repository branch.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: BranchClaimSpec is the immutable repository/ref ownership
+              identity.
+            properties:
+              id:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              ownerKind:
+                description: BranchClaimOwnerKind identifies the durable owner of
+                  an Orka-managed branch.
+                enum:
+                - Task
+                - Session
+                type: string
+              ownerUid:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              ref:
+                maxLength: 1024
+                pattern: ^refs/heads/.+$
+                type: string
+              repositoryId:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              requestDigest:
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+            required:
+            - id
+            - ownerKind
+            - ownerUid
+            - ref
+            - repositoryId
+            - requestDigest
+            type: object
+            x-kubernetes-validations:
+            - message: branch claim spec is immutable
+              rule: self == oldSelf
+          status:
+            description: BranchClaimStatus is the exact generation, baseline, and
+              availability CAS.
+            properties:
+              availability:
+                description: BranchClaimAvailability gates further branch mutation.
+                enum:
+                - Available
+                - ReconciliationBlocked
+                type: string
+              blockedReason:
+                maxLength: 16384
+                type: string
+              controllerEpoch:
+                description: ControllerEpoch is the exact epoch that performed the
+                  last mutation.
+                format: int64
+                minimum: 1
+                type: integer
+              controllerEpochLeaseResourceVersion:
+                description: |-
+                  ControllerEpochLeaseResourceVersion is the resourceVersion of the
+                  authoritative controller-epoch Lease observed by the mutation.
+                maxLength: 64
+                type: string
+              controllerEpochName:
+                description: |-
+                  ControllerEpochName identifies the controller epoch domain checked before
+                  the mutation.
+                maxLength: 253
+                type: string
+              createdAt:
+                description: CreatedAt is the normalized logical creation time.
+                format: date-time
+                type: string
+              generation:
+                format: int64
+                minimum: 1
+                type: integer
+              lastOperationDigest:
+                description: LastOperationDigest binds LastOperationID to exact canonical
+                  input.
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              lastOperationId:
+                description: LastOperationID is the last idempotent mutation identity
+                  applied.
+                maxLength: 1024
+                type: string
+              lastVerified:
+                description: LastVerified is the independently observed exact target
+                  ref.
+                properties:
+                  absent:
+                    type: boolean
+                  sha:
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                required:
+                - absent
+                type: object
+                x-kubernetes-validations:
+                - message: absent and sha are mutually exclusive
+                  rule: '!(self.absent && has(self.sha) && size(self.sha) > 0)'
+              relatedPublicationId:
+                maxLength: 1024
+                type: string
+              updatedAt:
+                description: UpdatedAt is the normalized logical mutation time.
+                format: date-time
+                type: string
+              version:
+                description: |-
+                  Version is the monotonic domain CAS version. It advances once for each
+                  successfully persisted logical mutation.
+                format: int64
+                minimum: 1
+                type: integer
+            type: object
+            x-kubernetes-validations:
+            - message: available branch claims must clear block metadata
+              rule: '!has(self.availability) || self.availability != ''Available''
+                || ((!has(self.blockedReason) || size(self.blockedReason) == 0) &&
+                (!has(self.relatedPublicationId) || size(self.relatedPublicationId)
+                == 0))'
+            - message: reconciliation-blocked branch claims require a reason
+              rule: '!has(self.availability) || self.availability != ''ReconciliationBlocked''
+                || (has(self.blockedReason) && size(self.blockedReason) > 0)'
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/manifest_staging/charts/orka/crds/controllerepoch-customresourcedefinition.yaml b/manifest_staging/charts/orka/crds/controllerepoch-customresourcedefinition.yaml
new file mode 100644
index 000000000..9d1c486f2
--- /dev/null
+++ b/manifest_staging/charts/orka/crds/controllerepoch-customresourcedefinition.yaml
@@ -0,0 +1,109 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: controllerepochs.core.orka.ai
+spec:
+  group: core.orka.ai
+  names:
+    kind: ControllerEpoch
+    listKind: ControllerEpochList
+    plural: controllerepochs
+    shortNames:
+    - cepoch
+    singular: controllerepoch
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.epoch
+      name: Epoch
+      type: integer
+    - jsonPath: .status.holderId
+      name: Holder
+      type: string
+    - jsonPath: .status.version
+      name: Version
+      type: integer
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: |-
+          ControllerEpoch is the human-visible Kubernetes control record paired with
+          an authoritative namespaced Lease.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: |-
+              ControllerEpochSpec is the immutable epoch-domain identity. The associated
+              coordination.k8s.io Lease is the CAS authority for holder and epoch changes.
+            properties:
+              name:
+                maxLength: 253
+                minLength: 1
+                type: string
+            required:
+            - name
+            type: object
+            x-kubernetes-validations:
+            - message: controller epoch spec is immutable
+              rule: self == oldSelf
+          status:
+            description: |-
+              ControllerEpochStatus mirrors the authoritative Lease state for inspection
+              and recovery. LeaseResourceVersion identifies the exact Lease revision.
+            properties:
+              acquiredAt:
+                format: date-time
+                type: string
+              epoch:
+                format: int64
+                minimum: 1
+                type: integer
+              holderId:
+                maxLength: 1024
+                type: string
+              leaseName:
+                maxLength: 253
+                type: string
+              leaseResourceVersion:
+                maxLength: 64
+                type: string
+              requestDigest:
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              updatedAt:
+                format: date-time
+                type: string
+              version:
+                format: int64
+                minimum: 1
+                type: integer
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/manifest_staging/charts/orka/crds/externaleffect-customresourcedefinition.yaml b/manifest_staging/charts/orka/crds/externaleffect-customresourcedefinition.yaml
new file mode 100644
index 000000000..e17b0a44f
--- /dev/null
+++ b/manifest_staging/charts/orka/crds/externaleffect-customresourcedefinition.yaml
@@ -0,0 +1,191 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: externaleffects.core.orka.ai
+spec:
+  group: core.orka.ai
+  names:
+    kind: ExternalEffect
+    listKind: ExternalEffectList
+    plural: externaleffects
+    shortNames:
+    - eeffect
+    singular: externaleffect
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.state
+      name: State
+      type: string
+    - jsonPath: .spec.kind
+      name: Kind
+      type: string
+    - jsonPath: .status.attempts
+      name: Attempts
+      type: integer
+    - jsonPath: .status.version
+      name: Version
+      type: integer
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: |-
+          ExternalEffect is the Kubernetes-authoritative canonical idempotency record
+          for an operation outside SQLite.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: |-
+              ExternalEffectSpec is the immutable canonical identity and request binding.
+              The identity namespace intentionally duplicates metadata.namespace so a
+              serialized record remains self-describing and can be checked fail-closed.
+            properties:
+              aggregateId:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              id:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              identityNamespace:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              kind:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              operationId:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              requestDigest:
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+            required:
+            - aggregateId
+            - id
+            - identityNamespace
+            - kind
+            - operationId
+            - requestDigest
+            type: object
+            x-kubernetes-validations:
+            - message: external effect spec is immutable
+              rule: self == oldSelf
+          status:
+            description: |-
+              ExternalEffectStatus contains the mutable state, response, lease, and epoch
+              fence for one canonical external effect.
+            properties:
+              attempts:
+                format: int64
+                minimum: 0
+                type: integer
+              controllerEpoch:
+                description: ControllerEpoch is the exact epoch that performed the
+                  last mutation.
+                format: int64
+                minimum: 1
+                type: integer
+              controllerEpochLeaseResourceVersion:
+                description: |-
+                  ControllerEpochLeaseResourceVersion is the resourceVersion of the
+                  authoritative controller-epoch Lease observed by the mutation.
+                maxLength: 64
+                type: string
+              controllerEpochName:
+                description: |-
+                  ControllerEpochName identifies the controller epoch domain checked before
+                  the mutation.
+                maxLength: 253
+                type: string
+              createdAt:
+                description: CreatedAt is the normalized logical creation time.
+                format: date-time
+                type: string
+              lastOperationDigest:
+                description: LastOperationDigest binds LastOperationID to exact canonical
+                  input.
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              lastOperationId:
+                description: LastOperationID is the last idempotent mutation identity
+                  applied.
+                maxLength: 1024
+                type: string
+              leaseExpiresAt:
+                format: date-time
+                type: string
+              leaseOwner:
+                maxLength: 1024
+                type: string
+              response:
+                description: |-
+                  Response stores a bounded JSON response for idempotent replay. Large
+                  response bodies should remain in the artifact store and be referenced by
+                  a compact receipt instead.
+                x-kubernetes-preserve-unknown-fields: true
+              responseDigest:
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              state:
+                description: |-
+                  ExternalEffectControlState is the durable state of one idempotent operation
+                  performed outside the controller's SQLite transaction boundary.
+                enum:
+                - Pending
+                - InFlight
+                - Succeeded
+                - Failed
+                - OutcomeUnknown
+                type: string
+              updatedAt:
+                description: UpdatedAt is the normalized logical mutation time.
+                format: date-time
+                type: string
+              version:
+                description: |-
+                  Version is the monotonic domain CAS version. It advances once for each
+                  successfully persisted logical mutation.
+                format: int64
+                minimum: 1
+                type: integer
+            type: object
+            x-kubernetes-validations:
+            - message: in-flight external effects require a lease owner and expiry
+              rule: '!has(self.state) || self.state != ''InFlight'' || (has(self.leaseOwner)
+                && size(self.leaseOwner) > 0 && has(self.leaseExpiresAt))'
+            - message: non-in-flight external effects must clear lease fields
+              rule: '!has(self.state) || self.state == ''InFlight'' || ((!has(self.leaseOwner)
+                || size(self.leaseOwner) == 0) && !has(self.leaseExpiresAt))'
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/manifest_staging/charts/orka/crds/promptattempt-customresourcedefinition.yaml b/manifest_staging/charts/orka/crds/promptattempt-customresourcedefinition.yaml
new file mode 100644
index 000000000..e2781f0cc
--- /dev/null
+++ b/manifest_staging/charts/orka/crds/promptattempt-customresourcedefinition.yaml
@@ -0,0 +1,280 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: promptattempts.core.orka.ai
+spec:
+  group: core.orka.ai
+  names:
+    kind: PromptAttempt
+    listKind: PromptAttemptList
+    plural: promptattempts
+    shortNames:
+    - pattempt
+    singular: promptattempt
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.executionState
+      name: Execution
+      type: string
+    - jsonPath: .status.deliveryState
+      name: Delivery
+      type: string
+    - jsonPath: .spec.attempt
+      name: Attempt
+      type: integer
+    - jsonPath: .status.version
+      name: Version
+      type: integer
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: |-
+          PromptAttempt is the Kubernetes-authoritative prompt execution and delivery
+          control record.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: |-
+              PromptAttemptSpec is the immutable identity and request binding for one
+              Task prompt attempt.
+            properties:
+              attempt:
+                description: Attempt is the one-based Task attempt number.
+                format: int64
+                minimum: 1
+                type: integer
+              bindingDigest:
+                description: |-
+                  BindingDigest identifies the immutable Task-lifetime v2 execution
+                  binding. It is optional only so pre-coexistence records remain readable;
+                  all PromptAttempts newly created through DurableControlStore require it.
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              credentialBindings:
+                description: CredentialBindings is the immutable, role-separated Secret
+                  identity set.
+                items:
+                  description: |-
+                    PromptCredentialBinding freezes one role-specific Secret identity without
+                    storing credential material.
+                  properties:
+                    namespace:
+                      maxLength: 253
+                      minLength: 1
+                      type: string
+                    resourceVersion:
+                      maxLength: 253
+                      minLength: 1
+                      type: string
+                    role:
+                      enum:
+                      - SourceRead
+                      - TargetRead
+                      - TargetWrite
+                      - Forge
+                      type: string
+                    secretKey:
+                      maxLength: 253
+                      minLength: 1
+                      type: string
+                    secretName:
+                      maxLength: 253
+                      minLength: 1
+                      type: string
+                    secretUid:
+                      maxLength: 253
+                      minLength: 1
+                      type: string
+                  required:
+                  - namespace
+                  - resourceVersion
+                  - role
+                  - secretKey
+                  - secretName
+                  - secretUid
+                  type: object
+                maxItems: 4
+                type: array
+                x-kubernetes-list-map-keys:
+                - role
+                x-kubernetes-list-type: map
+              id:
+                description: ID is the canonical DurableControlStore prompt-attempt
+                  ID.
+                maxLength: 1024
+                minLength: 1
+                type: string
+              promptId:
+                description: PromptID is the immutable prompt identity within the
+                  attempt.
+                maxLength: 1024
+                minLength: 1
+                type: string
+              requestDigest:
+                description: RequestDigest binds the prompt identity to exact canonical
+                  input.
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              snapshotDigest:
+                description: |-
+                  SnapshotDigest identifies the immutable encrypted execution snapshot.
+                  It is optional only so pre-coexistence records remain readable; all
+                  PromptAttempts newly created through DurableControlStore require it.
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              taskUid:
+                description: TaskUID is the immutable Kubernetes UID of the Task.
+                maxLength: 1024
+                minLength: 1
+                type: string
+            required:
+            - attempt
+            - id
+            - promptId
+            - requestDigest
+            - taskUid
+            type: object
+            x-kubernetes-validations:
+            - message: prompt attempt spec is immutable
+              rule: self == oldSelf
+            - message: bindingDigest and snapshotDigest must be recorded together
+              rule: has(self.bindingDigest) == has(self.snapshotDigest)
+          status:
+            description: PromptAttemptStatus holds the exact execution and delivery
+              state machines.
+            properties:
+              controllerEpoch:
+                description: ControllerEpoch is the exact epoch that performed the
+                  last mutation.
+                format: int64
+                minimum: 1
+                type: integer
+              controllerEpochLeaseResourceVersion:
+                description: |-
+                  ControllerEpochLeaseResourceVersion is the resourceVersion of the
+                  authoritative controller-epoch Lease observed by the mutation.
+                maxLength: 64
+                type: string
+              controllerEpochName:
+                description: |-
+                  ControllerEpochName identifies the controller epoch domain checked before
+                  the mutation.
+                maxLength: 253
+                type: string
+              createdAt:
+                description: CreatedAt is the normalized logical creation time.
+                format: date-time
+                type: string
+              deliveryState:
+                description: PromptAttemptDeliveryState is the durable delivery state
+                  for one prompt.
+                enum:
+                - NotRequested
+                - Validating
+                - Preparing
+                - Prepared
+                - Publishing
+                - Verifying
+                - VerifiedExact
+                - DeliveredSuperseded
+                - ReadValidated
+                - NoChange
+                - CancelledBeforePublish
+                - ReadOnlyWorkspaceModified
+                - DeliveryConflict
+                - CredentialBlocked
+                - PublicationOutcomeUnknown
+                type: string
+              executionState:
+                description: PromptAttemptExecutionState is the durable prompt execution
+                  state.
+                enum:
+                - Queued
+                - Reserved
+                - SessionStarting
+                - Planned
+                - Submitting
+                - SubmittedUnknown
+                - Accepted
+                - Running
+                - Settling
+                - Succeeded
+                - Failed
+                - Cancelled
+                - OutcomeUnknown
+                type: string
+              lastOperationDigest:
+                description: LastOperationDigest binds LastOperationID to exact canonical
+                  input.
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              lastOperationId:
+                description: LastOperationID is the last idempotent mutation identity
+                  applied.
+                maxLength: 1024
+                type: string
+              outcomeMarker:
+                maxLength: 16384
+                type: string
+              runtimeInstanceId:
+                description: RuntimeInstanceID is immutable after first binding.
+                maxLength: 1024
+                type: string
+              sessionLeaseGeneration:
+                description: SessionLeaseGeneration is immutable after first binding.
+                format: int64
+                minimum: 1
+                type: integer
+              sessionUid:
+                description: SessionUID is immutable after first binding.
+                maxLength: 1024
+                type: string
+              terminalReason:
+                maxLength: 16384
+                type: string
+              updatedAt:
+                description: UpdatedAt is the normalized logical mutation time.
+                format: date-time
+                type: string
+              version:
+                description: |-
+                  Version is the monotonic domain CAS version. It advances once for each
+                  successfully persisted logical mutation.
+                format: int64
+                minimum: 1
+                type: integer
+            type: object
+            x-kubernetes-validations:
+            - message: OutcomeUnknown requires an explicit outcome marker
+              rule: '!has(self.executionState) || self.executionState != ''OutcomeUnknown''
+                || (has(self.outcomeMarker) && size(self.outcomeMarker) > 0)'
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/manifest_staging/charts/orka/crds/publication-customresourcedefinition.yaml b/manifest_staging/charts/orka/crds/publication-customresourcedefinition.yaml
new file mode 100644
index 000000000..0b921bca9
--- /dev/null
+++ b/manifest_staging/charts/orka/crds/publication-customresourcedefinition.yaml
@@ -0,0 +1,529 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: publications.core.orka.ai
+spec:
+  group: core.orka.ai
+  names:
+    kind: Publication
+    listKind: PublicationList
+    plural: publications
+    shortNames:
+    - pubctl
+    singular: publication
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.state
+      name: State
+      type: string
+    - jsonPath: .spec.generation
+      name: Generation
+      type: integer
+    - jsonPath: .spec.targetRef
+      name: Target
+      type: string
+    - jsonPath: .status.version
+      name: Version
+      type: integer
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: Publication is the Kubernetes-authoritative clean-room publication
+          record.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: |-
+              PublicationSpec is the immutable clean-room publication identity and input.
+              Mutable receipts and forge intent live only in status.
+            properties:
+              artifactDigest:
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              artifactId:
+                description: ArtifactID identifies the durable content-addressed change
+                  artifact.
+                maxLength: 1024
+                minLength: 1
+                type: string
+              artifactMediaType:
+                maxLength: 255
+                minLength: 1
+                type: string
+              artifactSizeBytes:
+                format: int64
+                minimum: 1
+                type: integer
+              attempt:
+                format: int64
+                minimum: 1
+                type: integer
+              baseline:
+                description: |-
+                  ControlRemoteRefState is an exact remote-ref observation. Absent and SHA are
+                  mutually exclusive. The all-zero value is reserved for an explicitly unknown
+                  observation in PublicationOutcomeUnknown receipts.
+                properties:
+                  absent:
+                    type: boolean
+                  sha:
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                required:
+                - absent
+                type: object
+                x-kubernetes-validations:
+                - message: absent and sha are mutually exclusive
+                  rule: '!(self.absent && has(self.sha) && size(self.sha) > 0)'
+              branchClaimGeneration:
+                format: int64
+                minimum: 1
+                type: integer
+              branchClaimId:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              commitIdentity:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              commitMessage:
+                maxLength: 16384
+                minLength: 1
+                type: string
+              commitTimestamp:
+                format: date-time
+                type: string
+              generation:
+                format: int64
+                minimum: 1
+                type: integer
+              id:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              promptId:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              publicationCredentialRef:
+                description: |-
+                  PublicationCredentialRef identifies an operation-scoped Secret reference;
+                  it never contains credential material.
+                maxLength: 1024
+                minLength: 1
+                type: string
+              requestDigest:
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              sessionUid:
+                maxLength: 1024
+                type: string
+              sourceBaselineSha:
+                pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                type: string
+              sourceRef:
+                description: SourceRef is the exact immutable source ref or revision
+                  selector.
+                maxLength: 1024
+                minLength: 1
+                type: string
+              sourceRepositoryId:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              targetRef:
+                maxLength: 1024
+                pattern: ^refs/heads/.+$
+                type: string
+              targetRepositoryId:
+                maxLength: 1024
+                minLength: 1
+                type: string
+              taskUid:
+                maxLength: 1024
+                minLength: 1
+                type: string
+            required:
+            - artifactDigest
+            - artifactId
+            - artifactMediaType
+            - artifactSizeBytes
+            - attempt
+            - baseline
+            - branchClaimGeneration
+            - branchClaimId
+            - commitIdentity
+            - commitMessage
+            - commitTimestamp
+            - generation
+            - id
+            - promptId
+            - publicationCredentialRef
+            - requestDigest
+            - sourceBaselineSha
+            - sourceRef
+            - sourceRepositoryId
+            - targetRef
+            - targetRepositoryId
+            - taskUid
+            type: object
+            x-kubernetes-validations:
+            - message: publication spec is immutable
+              rule: self == oldSelf
+          status:
+            description: PublicationStatus contains mutable state, exact receipts,
+              and epoch fencing.
+            properties:
+              controllerEpoch:
+                description: ControllerEpoch is the exact epoch that performed the
+                  last mutation.
+                format: int64
+                minimum: 1
+                type: integer
+              controllerEpochLeaseResourceVersion:
+                description: |-
+                  ControllerEpochLeaseResourceVersion is the resourceVersion of the
+                  authoritative controller-epoch Lease observed by the mutation.
+                maxLength: 64
+                type: string
+              controllerEpochName:
+                description: |-
+                  ControllerEpochName identifies the controller epoch domain checked before
+                  the mutation.
+                maxLength: 253
+                type: string
+              createdAt:
+                description: CreatedAt is the normalized logical creation time.
+                format: date-time
+                type: string
+              lastOperationDigest:
+                description: LastOperationDigest binds LastOperationID to exact canonical
+                  input.
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              lastOperationId:
+                description: LastOperationID is the last idempotent mutation identity
+                  applied.
+                maxLength: 1024
+                type: string
+              prIntent:
+                description: |-
+                  PublicationPullRequestIntent is the exact forge tuple persisted before the
+                  first forge API call.
+                properties:
+                  baseRef:
+                    maxLength: 1024
+                    pattern: ^refs/heads/.+$
+                    type: string
+                  baseRepositoryId:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  expectedHeadSha:
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                  headRef:
+                    maxLength: 1024
+                    pattern: ^refs/heads/.+$
+                    type: string
+                  headRepositoryId:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  publicationGeneration:
+                    format: int64
+                    minimum: 1
+                    type: integer
+                required:
+                - baseRef
+                - baseRepositoryId
+                - expectedHeadSha
+                - headRef
+                - headRepositoryId
+                - publicationGeneration
+                type: object
+              preparedReceipt:
+                description: PreparedPublicationControlReceipt records deterministic
+                  commit preparation.
+                properties:
+                  bundleArtifactId:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  bundleDigest:
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  bundleMediaType:
+                    maxLength: 255
+                    minLength: 1
+                    type: string
+                  bundleRef:
+                    pattern: ^refs/orka/publications/[a-f0-9]{64}$
+                    type: string
+                  bundleSizeBytes:
+                    format: int64
+                    minimum: 1
+                    type: integer
+                  commitSha:
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                  manifestDigest:
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  operationId:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  preparedAt:
+                    format: date-time
+                    type: string
+                  relativeRoot:
+                    description: |-
+                      RelativeRoot is the canonical repository-relative workspace root applied
+                      to every path in the immutable delta artifact.
+                    maxLength: 1024
+                    type: string
+                  requestDigest:
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  treeSha:
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                required:
+                - bundleArtifactId
+                - bundleDigest
+                - bundleMediaType
+                - bundleRef
+                - bundleSizeBytes
+                - commitSha
+                - manifestDigest
+                - operationId
+                - preparedAt
+                - requestDigest
+                - treeSha
+                type: object
+              publishReceipt:
+                description: PublishOperationControlReceipt records the exact server-enforced
+                  ref CAS.
+                properties:
+                  acknowledgementUnknown:
+                    type: boolean
+                  expectedCommitSha:
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                  operationId:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  publishedAt:
+                    format: date-time
+                    type: string
+                  remoteBefore:
+                    description: |-
+                      ControlRemoteRefState is an exact remote-ref observation. Absent and SHA are
+                      mutually exclusive. The all-zero value is reserved for an explicitly unknown
+                      observation in PublicationOutcomeUnknown receipts.
+                    properties:
+                      absent:
+                        type: boolean
+                      sha:
+                        pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                        type: string
+                    required:
+                    - absent
+                    type: object
+                    x-kubernetes-validations:
+                    - message: absent and sha are mutually exclusive
+                      rule: '!(self.absent && has(self.sha) && size(self.sha) > 0)'
+                  requestDigest:
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  targetRef:
+                    maxLength: 1024
+                    pattern: ^refs/heads/.+$
+                    type: string
+                  targetRepositoryId:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                required:
+                - acknowledgementUnknown
+                - expectedCommitSha
+                - operationId
+                - publishedAt
+                - remoteBefore
+                - requestDigest
+                - targetRef
+                - targetRepositoryId
+                type: object
+              pullRequestReceipt:
+                description: PullRequestOperationControlReceipt snapshots exact forge
+                  reconciliation.
+                properties:
+                  forgeId:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  headSha:
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                  intentKey:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  operationId:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  reconciledAt:
+                    format: date-time
+                    type: string
+                  requestDigest:
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  state:
+                    maxLength: 128
+                    minLength: 1
+                    type: string
+                  url:
+                    maxLength: 2048
+                    minLength: 1
+                    type: string
+                required:
+                - forgeId
+                - headSha
+                - intentKey
+                - operationId
+                - reconciledAt
+                - requestDigest
+                - state
+                - url
+                type: object
+              state:
+                description: PublicationControlState is the clean-room publication
+                  state machine.
+                enum:
+                - Preparing
+                - Prepared
+                - Publishing
+                - Verifying
+                - VerifiedExact
+                - DeliveredSuperseded
+                - CancelledBeforePublish
+                - DeliveryConflict
+                - CredentialBlocked
+                - PreparationFailed
+                - PublicationOutcomeUnknown
+                type: string
+              terminalReason:
+                maxLength: 16384
+                type: string
+              updatedAt:
+                description: UpdatedAt is the normalized logical mutation time.
+                format: date-time
+                type: string
+              verificationReceipt:
+                description: PublicationVerificationControlReceipt is an independent
+                  remote observation.
+                properties:
+                  descendantProofDigest:
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  expectedCommitSha:
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                  observedRemote:
+                    description: |-
+                      ControlRemoteRefState is an exact remote-ref observation. Absent and SHA are
+                      mutually exclusive. The all-zero value is reserved for an explicitly unknown
+                      observation in PublicationOutcomeUnknown receipts.
+                    properties:
+                      absent:
+                        type: boolean
+                      sha:
+                        pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                        type: string
+                    required:
+                    - absent
+                    type: object
+                    x-kubernetes-validations:
+                    - message: absent and sha are mutually exclusive
+                      rule: '!(self.absent && has(self.sha) && size(self.sha) > 0)'
+                  operationId:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  outcome:
+                    description: PublicationControlState is the clean-room publication
+                      state machine.
+                    enum:
+                    - Preparing
+                    - Prepared
+                    - Publishing
+                    - Verifying
+                    - VerifiedExact
+                    - DeliveredSuperseded
+                    - CancelledBeforePublish
+                    - DeliveryConflict
+                    - CredentialBlocked
+                    - PreparationFailed
+                    - PublicationOutcomeUnknown
+                    type: string
+                  requestDigest:
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  verifiedAt:
+                    format: date-time
+                    type: string
+                required:
+                - expectedCommitSha
+                - observedRemote
+                - operationId
+                - outcome
+                - requestDigest
+                - verifiedAt
+                type: object
+              version:
+                description: |-
+                  Version is the monotonic domain CAS version. It advances once for each
+                  successfully persisted logical mutation.
+                format: int64
+                minimum: 1
+                type: integer
+            type: object
+            x-kubernetes-validations:
+            - message: failure and unknown publication states require a terminal reason
+              rule: '!has(self.state) || !(self.state in [''DeliveryConflict'', ''CredentialBlocked'',
+                ''PreparationFailed'', ''PublicationOutcomeUnknown'']) || (has(self.terminalReason)
+                && size(self.terminalReason) > 0)'
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/manifest_staging/charts/orka/crds/repositorymonitor-customresourcedefinition.yaml b/manifest_staging/charts/orka/crds/repositorymonitor-customresourcedefinition.yaml
index 9e2d52ca6..8dabeb7e0 100644
--- a/manifest_staging/charts/orka/crds/repositorymonitor-customresourcedefinition.yaml
+++ b/manifest_staging/charts/orka/crds/repositorymonitor-customresourcedefinition.yaml
@@ -176,9 +176,28 @@ spec:
                 description: Branch is the default base branch for repository-wide
                   monitoring decisions.
                 type: string
+              forgeCredentialRef:
+                description: |-
+                  ForgeCredentialRef references the GitHub API credential used only for
+                  controller-owned forge reads and mutations. Write workflows and GitHub label
+                  triggers require this explicit reference.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
               gitSecretRef:
-                description: GitSecretRef references GitHub credentials for repository
-                  monitor operations.
+                description: |-
+                  GitSecretRef is the backward-compatible source-read credential reference.
+                  ReadCredentialRef takes precedence when both are set. GitSecretRef is never
+                  used for publication writes or forge mutations.
                 properties:
                   name:
                     default: ""
@@ -329,6 +348,57 @@ spec:
                 enum:
                 - github
                 type: string
+              publicationCredentialRef:
+                description: |-
+                  PublicationCredentialRef references the target-repository write credential
+                  used only for exact compare-and-swap publication. Write workflows require
+                  this explicit reference.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
+              publicationReadCredentialRef:
+                description: |-
+                  PublicationReadCredentialRef references the target-repository read
+                  credential used only for publication preflight and independent verification.
+                  Write workflows require this explicit reference.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
+              readCredentialRef:
+                description: |-
+                  ReadCredentialRef references the source-repository clone/read credential.
+                  It is resolved only by the clean-room workspace boundary. When omitted,
+                  GitSecretRef remains the backward-compatible read-only fallback.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
               repair:
                 description: Repair controls bounded repair behavior.
                 properties:
diff --git a/manifest_staging/charts/orka/crds/repositoryscan-customresourcedefinition.yaml b/manifest_staging/charts/orka/crds/repositoryscan-customresourcedefinition.yaml
index 776b58b50..d66b61335 100644
--- a/manifest_staging/charts/orka/crds/repositoryscan-customresourcedefinition.yaml
+++ b/manifest_staging/charts/orka/crds/repositoryscan-customresourcedefinition.yaml
@@ -103,12 +103,32 @@ spec:
                 required:
                 - name
                 type: object
+              forgeCredentialRef:
+                description: |-
+                  ForgeCredentialRef references the GitHub API credential used only for
+                  controller-owned pull request reconciliation. Patch workflows require this
+                  explicit reference.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
               forkRepo:
                 description: ForkRepo is the writable fork repository URL used for
                   patch proposals.
                 type: string
               gitSecretRef:
-                description: GitSecretRef references git credentials for private repositories.
+                description: |-
+                  GitSecretRef is the backward-compatible source-read credential reference.
+                  ReadCredentialRef takes precedence when both are set. GitSecretRef is never
+                  used for publication writes or forge mutations.
                 properties:
                   name:
                     default: ""
@@ -156,6 +176,57 @@ spec:
                 enum:
                 - github
                 type: string
+              publicationCredentialRef:
+                description: |-
+                  PublicationCredentialRef references the target-repository write credential
+                  used only for exact compare-and-swap publication. Patch workflows require
+                  this explicit reference.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
+              publicationReadCredentialRef:
+                description: |-
+                  PublicationReadCredentialRef references the target-repository read
+                  credential used only for publication preflight and independent verification.
+                  Patch workflows require this explicit reference.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
+              readCredentialRef:
+                description: |-
+                  ReadCredentialRef references the source-repository clone/read credential.
+                  It is resolved only by the clean-room workspace boundary. When omitted,
+                  GitSecretRef remains the backward-compatible read-only fallback.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
               ref:
                 description: Ref is a specific git ref, tag, or commit SHA to checkout
                   for scan tasks.
diff --git a/manifest_staging/charts/orka/crds/runtimepool-customresourcedefinition.yaml b/manifest_staging/charts/orka/crds/runtimepool-customresourcedefinition.yaml
new file mode 100644
index 000000000..60b385f92
--- /dev/null
+++ b/manifest_staging/charts/orka/crds/runtimepool-customresourcedefinition.yaml
@@ -0,0 +1,666 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: runtimepools.core.orka.ai
+spec:
+  group: core.orka.ai
+  names:
+    kind: RuntimePool
+    listKind: RuntimePoolList
+    plural: runtimepools
+    shortNames:
+    - rtpool
+    singular: runtimepool
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.lifecycle
+      name: Lifecycle
+      type: string
+    - jsonPath: .status.admissionState
+      name: Admission
+      type: string
+    - jsonPath: .status.desiredReplicas
+      name: Desired
+      type: integer
+    - jsonPath: .status.currentReplicas
+      name: Current
+      type: integer
+    - jsonPath: .status.capacity.residentSessions
+      name: Sessions
+      type: integer
+    - jsonPath: .status.capacity.runningPrompts
+      name: Prompts
+      type: integer
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: RuntimePool is the Schema for controller-owned ACP runtime pools.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: |-
+              RuntimePoolSpec defines the desired state of a controller-owned logical pool.
+              Trust-domain placement and the runtime image/profile are immutable; rollout
+              uses drain-and-replace rather than changing an in-memory instance in place.
+            properties:
+              capacity:
+                default:
+                  maxResidentSessions: 10
+                  maxRunningPrompts: 4
+                description: Capacity sets resident-session and running-prompt limits.
+                properties:
+                  maxResidentSessions:
+                    default: 10
+                    description: MaxResidentSessions is the maximum number of resident
+                      RuntimeSessions.
+                    format: int32
+                    maximum: 1000
+                    minimum: 1
+                    type: integer
+                  maxRunningPrompts:
+                    default: 4
+                    description: MaxRunningPrompts is the maximum number of concurrently
+                      running prompts.
+                    format: int32
+                    maximum: 1000
+                    minimum: 1
+                    type: integer
+                type: object
+                x-kubernetes-validations:
+                - message: maxRunningPrompts cannot exceed maxResidentSessions
+                  rule: self.maxRunningPrompts <= self.maxResidentSessions
+              coldStartTimeoutSeconds:
+                default: 120
+                description: ColdStartTimeoutSeconds bounds a 0 -> 1 startup before
+                  the pool is marked degraded.
+                format: int32
+                maximum: 3600
+                minimum: 1
+                type: integer
+              desiredReplicas:
+                default: 0
+                description: |-
+                  DesiredReplicas is zero or one. More than one runtime Pod would make
+                  stateful exact-instance routing ambiguous.
+                format: int32
+                maximum: 1
+                minimum: 0
+                type: integer
+              runtime:
+                description: Runtime pins the immutable supervisor image and behavior
+                  profile.
+                properties:
+                  image:
+                    description: Image is a digest-pinned OCI image. Mutable tags
+                      are intentionally rejected.
+                    maxLength: 2048
+                    pattern: ^[^\s@]+@sha256:[a-f0-9]{64}$
+                    type: string
+                  profile:
+                    description: Profile is the immutable runtime profile enforced
+                      for every active instance.
+                    properties:
+                      acpProfile:
+                        description: ACPProfile is the reviewed ACP wire/profile identifier.
+                        enum:
+                        - acp.v1
+                        type: string
+                      adapterDigests:
+                        additionalProperties:
+                          type: string
+                        description: AdapterDigests pins every adapter and provider
+                          CLI artifact used by the pool.
+                        maxProperties: 32
+                        minProperties: 1
+                        type: object
+                      agentConfigurationDigest:
+                        description: AgentConfigurationDigest freezes non-secret Agent/runtime
+                          configuration.
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      approvalPolicyDigest:
+                        description: ApprovalPolicyDigest freezes the effective approval
+                          policy.
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      digest:
+                        description: Digest is the canonical immutable runtime-profile
+                          digest.
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      digestSchemaVersion:
+                        description: DigestSchemaVersion identifies the canonicalization
+                          schema used to compute Digest.
+                        maxLength: 64
+                        minLength: 1
+                        pattern: ^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$
+                        type: string
+                      mcpConfigurationDigest:
+                        description: MCPConfigurationDigest freezes prompt-scoped
+                          broker/MCP configuration.
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      model:
+                        description: Model is the exact reviewed model identifier.
+                        maxLength: 256
+                        minLength: 1
+                        type: string
+                      modelLimits:
+                        description: |-
+                          ModelLimits pins the reviewed context and output capacities used by the
+                          runtime's local compaction policy.
+                        properties:
+                          context:
+                            description: Context is the maximum model context capacity
+                              in tokens.
+                            format: int64
+                            minimum: 1
+                            type: integer
+                          output:
+                            description: Output is the maximum generated output in
+                              tokens.
+                            format: int64
+                            minimum: 1
+                            type: integer
+                        required:
+                        - context
+                        - output
+                        type: object
+                        x-kubernetes-validations:
+                        - message: model context limit must exceed output limit
+                          rule: self.context > self.output
+                      protocolVersion:
+                        default: orka.harness.v2
+                        description: ProtocolVersion is the controller-to-supervisor
+                          protocol profile.
+                        enum:
+                        - orka.harness.v2
+                        type: string
+                      providerKind:
+                        description: ProviderKind selects the one provider adapter
+                          present in the immutable image.
+                        enum:
+                        - codex
+                        - claude
+                        - copilot
+                        - opencode
+                        type: string
+                      proxyCredentialRole:
+                        description: ProxyCredentialRole identifies the provider-proxy
+                          client role, never a secret value.
+                        maxLength: 256
+                        minLength: 1
+                        type: string
+                      proxyCredentialScope:
+                        description: ProxyCredentialScope is the bounded model/session
+                          capability scope.
+                        maxLength: 1024
+                        minLength: 1
+                        type: string
+                      resourceClass:
+                        description: ResourceClass is the controller-supported pool
+                          resource class included in Digest.
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9.]*[a-z0-9])?$
+                        type: string
+                      toolPolicyDigest:
+                        description: ToolPolicyDigest freezes the effective tool allow/deny
+                          policy.
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      workspaceIntent:
+                        description: WorkspaceIntent is part of the immutable runtime
+                          profile.
+                        enum:
+                        - read
+                        - write
+                        type: string
+                    required:
+                    - acpProfile
+                    - adapterDigests
+                    - agentConfigurationDigest
+                    - approvalPolicyDigest
+                    - digest
+                    - digestSchemaVersion
+                    - mcpConfigurationDigest
+                    - model
+                    - providerKind
+                    - proxyCredentialRole
+                    - proxyCredentialScope
+                    - resourceClass
+                    - toolPolicyDigest
+                    - workspaceIntent
+                    type: object
+                    x-kubernetes-validations:
+                    - message: OpenCode runtime profiles require modelLimits
+                      rule: self.providerKind != 'opencode' || has(self.modelLimits)
+                required:
+                - image
+                - profile
+                type: object
+              runtimeNamespace:
+                description: |-
+                  RuntimeNamespace is the physical namespace for controller-owned runtime
+                  resources. When omitted, the controller selects its configured runtime namespace.
+                maxLength: 63
+                pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                type: string
+              trustDomain:
+                description: TrustDomain is the logical namespace/identity boundary
+                  served by this pool.
+                properties:
+                  identity:
+                    description: |-
+                      Identity is the controller-defined, canonical trust-domain identity. It
+                      must remain stable across physical runtime namespace or Pod replacement.
+                    maxLength: 253
+                    minLength: 1
+                    type: string
+                  namespace:
+                    description: Namespace is the Task namespace represented by this
+                      trust domain.
+                    maxLength: 63
+                    minLength: 1
+                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                    type: string
+                required:
+                - identity
+                - namespace
+                type: object
+            required:
+            - runtime
+            - trustDomain
+            type: object
+            x-kubernetes-validations:
+            - message: trustDomain is immutable
+              rule: self.trustDomain == oldSelf.trustDomain
+            - message: runtimeNamespace is immutable
+              rule: has(self.runtimeNamespace) == has(oldSelf.runtimeNamespace) &&
+                (!has(self.runtimeNamespace) || self.runtimeNamespace == oldSelf.runtimeNamespace)
+            - message: runtime image and profile are immutable
+              rule: self.runtime == oldSelf.runtime
+          status:
+            description: RuntimePoolStatus defines the observed state of a controller-owned
+              pool.
+            properties:
+              activeInstance:
+                description: |-
+                  ActiveInstance is the exact selected Pod and supervisor boot. It is empty
+                  unless one instance has been authoritatively selected.
+                properties:
+                  bootID:
+                    description: BootID is the immutable supervisor boot identifier
+                      inside the selected Pod.
+                    maxLength: 128
+                    minLength: 1
+                    type: string
+                  controllerEpoch:
+                    description: ControllerEpoch is the durable controller epoch to
+                      which this instance is bound.
+                    format: int64
+                    minimum: 1
+                    type: integer
+                  lastObservedTime:
+                    description: LastObservedTime is the last authenticated status
+                      observation for this instance.
+                    format: date-time
+                    type: string
+                  podAddress:
+                    description: |-
+                      PodAddress is the exact Pod address used for stateful routing, not a
+                      load-balanced Service endpoint.
+                    maxLength: 253
+                    minLength: 1
+                    type: string
+                  podName:
+                    description: PodName is the exact selected runtime Pod name.
+                    maxLength: 253
+                    minLength: 1
+                    type: string
+                  podNamespace:
+                    description: PodNamespace is the namespace containing the selected
+                      runtime Pod.
+                    maxLength: 63
+                    minLength: 1
+                    type: string
+                  podUID:
+                    description: PodUID is the Kubernetes UID of the selected Pod.
+                    maxLength: 128
+                    minLength: 1
+                    type: string
+                  profileDigest:
+                    description: ProfileDigest is the immutable runtime-profile digest
+                      advertised by this instance.
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  profileDigestSchemaVersion:
+                    description: ProfileDigestSchemaVersion is the digest schema advertised
+                      by this instance.
+                    maxLength: 64
+                    minLength: 1
+                    type: string
+                  protocolVersion:
+                    description: ProtocolVersion is the supervisor protocol actually
+                      advertised by this instance.
+                    enum:
+                    - orka.harness.v2
+                    type: string
+                  providerTokenGeneration:
+                    description: |-
+                      ProviderTokenGeneration is a non-secret digest generation for the exact
+                      provider capability mounted into this runtime Pod. It lets the controller
+                      prove that a selected instance converged on the intended proxy credential
+                      without exposing the bearer token.
+                    pattern: ^[a-f0-9]{16}$
+                    type: string
+                  runtimeInstanceID:
+                    description: RuntimeInstanceID is the portable v2 instance fence
+                      derived from PodUID and BootID.
+                    maxLength: 253
+                    minLength: 1
+                    type: string
+                required:
+                - bootID
+                - controllerEpoch
+                - podAddress
+                - podName
+                - podNamespace
+                - podUID
+                - profileDigest
+                - profileDigestSchemaVersion
+                - protocolVersion
+                - providerTokenGeneration
+                - runtimeInstanceID
+                type: object
+              admissionState:
+                description: AdmissionState is the authoritative admission gate for
+                  new RuntimeSessions.
+                enum:
+                - Closed
+                - Accepting
+                - Draining
+                - Ambiguous
+                type: string
+              capacity:
+                description: Capacity reports effective limits, use, and queued demand.
+                properties:
+                  finalizingSessions:
+                    description: FinalizingSessions is the count reserved for validation,
+                      publication, or finalization.
+                    format: int32
+                    minimum: 0
+                    type: integer
+                  liveDescendants:
+                    description: LiveDescendants is the authenticated count of tracked
+                      runtime descendants.
+                    format: int32
+                    minimum: 0
+                    type: integer
+                  maxResidentSessions:
+                    description: MaxResidentSessions is the effective configured resident-session
+                      limit.
+                    format: int32
+                    minimum: 0
+                    type: integer
+                  maxRunningPrompts:
+                    description: MaxRunningPrompts is the effective configured running-prompt
+                      limit.
+                    format: int32
+                    minimum: 0
+                    type: integer
+                  pendingPermissions:
+                    description: PendingPermissions is the authenticated count of
+                      unresolved prompt permissions.
+                    format: int32
+                    minimum: 0
+                    type: integer
+                  queuedTasks:
+                    description: QueuedTasks is durable unsatisfied demand assigned
+                      to this pool.
+                    format: int32
+                    minimum: 0
+                    type: integer
+                  reservations:
+                    description: |-
+                      Reservations is the bounded authoritative set of coordinator-owned
+                      pre-admission capacity claims.
+                    items:
+                      description: |-
+                        RuntimePoolCapacityReservationStatus is one durable, exact-instance capacity
+                        claim. The composite key is the pool UID, Task UID, attempt, and controller
+                        epoch. A reservation claims resident-session and prompt admission slots until
+                        the supervisor accepts the corresponding work or the reservation expires.
+                      properties:
+                        attempt:
+                          description: Attempt is the Task attempt that owns the claim.
+                          format: int32
+                          minimum: 1
+                          type: integer
+                        controllerEpoch:
+                          description: ControllerEpoch fences the claim to one controller
+                            leadership epoch.
+                          format: int64
+                          minimum: 1
+                          type: integer
+                        expiresAt:
+                          description: |-
+                            ExpiresAt is renewed while pre-admission work is active. A later
+                            dispatcher may reclaim the claim after this time.
+                          format: date-time
+                          type: string
+                        poolUID:
+                          description: PoolUID fences the claim to the exact RuntimePool
+                            object.
+                          maxLength: 128
+                          minLength: 1
+                          type: string
+                        promptSlots:
+                          description: PromptSlots is one until the prompt is accepted
+                            by the supervisor.
+                          format: int32
+                          maximum: 1
+                          minimum: 0
+                          type: integer
+                        reservedAt:
+                          description: ReservedAt is the first successful resource-version
+                            CAS for this claim.
+                          format: date-time
+                          type: string
+                        residentSlots:
+                          description: |-
+                            ResidentSlots is zero after a RuntimeSession is admitted and one while a
+                            new resident-session slot is still reserved.
+                          format: int32
+                          maximum: 1
+                          minimum: 0
+                          type: integer
+                        runtimeInstanceID:
+                          description: RuntimeInstanceID binds admission to the exact
+                            selected Pod/boot pair.
+                          maxLength: 253
+                          minLength: 1
+                          type: string
+                        taskUID:
+                          description: TaskUID is the immutable Task identity that
+                            owns the claim.
+                          maxLength: 128
+                          minLength: 1
+                          type: string
+                      required:
+                      - attempt
+                      - controllerEpoch
+                      - expiresAt
+                      - poolUID
+                      - promptSlots
+                      - reservedAt
+                      - residentSlots
+                      - runtimeInstanceID
+                      - taskUID
+                      type: object
+                      x-kubernetes-validations:
+                      - message: a capacity reservation must claim at least one slot
+                        rule: self.residentSlots + self.promptSlots > 0
+                    maxItems: 1000
+                    type: array
+                    x-kubernetes-list-map-keys:
+                    - poolUID
+                    - taskUID
+                    - attempt
+                    - controllerEpoch
+                    x-kubernetes-list-type: map
+                  reservedPrompts:
+                    description: ReservedPrompts is the sum of prompt slots in Reservations.
+                    format: int32
+                    minimum: 0
+                    type: integer
+                  reservedSessions:
+                    description: ReservedSessions is the sum of resident slots in
+                      Reservations.
+                    format: int32
+                    minimum: 0
+                    type: integer
+                  residentSessions:
+                    description: ResidentSessions is the authenticated supervisor
+                      count of resident sessions.
+                    format: int32
+                    minimum: 0
+                    type: integer
+                  runningPrompts:
+                    description: RunningPrompts is the authenticated supervisor count
+                      of active prompts.
+                    format: int32
+                    minimum: 0
+                    type: integer
+                type: object
+              conditions:
+                description: |-
+                  Conditions report admission, Pod Security, quota, scheduling, rollout, and
+                  other controller-observed failures.
+                items:
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              controllerEpoch:
+                description: ControllerEpoch is the durable epoch required for authoritative
+                  pool writes.
+                format: int64
+                minimum: 0
+                type: integer
+              currentReplicas:
+                description: CurrentReplicas is the number of non-terminated runtime
+                  Pods owned by the pool.
+                format: int32
+                minimum: 0
+                type: integer
+              desiredReplicas:
+                description: DesiredReplicas is the desired replica count observed
+                  by the controller.
+                format: int32
+                maximum: 1
+                minimum: 0
+                type: integer
+              lifecycle:
+                description: Lifecycle is the explicit pool lifecycle.
+                enum:
+                - Stopped
+                - Starting
+                - Serving
+                - Draining
+                - Quiescent
+                - Stopping
+                - Degraded
+                - Ambiguous
+                type: string
+              message:
+                description: Message contains bounded, sanitized reconciliation context.
+                maxLength: 1024
+                type: string
+              observedGeneration:
+                description: ObservedGeneration is the latest RuntimePool generation
+                  reconciled by the controller.
+                format: int64
+                type: integer
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/manifest_staging/charts/orka/crds/runtimesessioncontrol-customresourcedefinition.yaml b/manifest_staging/charts/orka/crds/runtimesessioncontrol-customresourcedefinition.yaml
new file mode 100644
index 000000000..eeac33fe3
--- /dev/null
+++ b/manifest_staging/charts/orka/crds/runtimesessioncontrol-customresourcedefinition.yaml
@@ -0,0 +1,371 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: runtimesessioncontrols.core.orka.ai
+spec:
+  group: core.orka.ai
+  names:
+    kind: RuntimeSessionControl
+    listKind: RuntimeSessionControlList
+    plural: runtimesessioncontrols
+    shortNames:
+    - rsctrl
+    singular: runtimesessioncontrol
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.lifecycle
+      name: Lifecycle
+      type: string
+    - jsonPath: .status.availability
+      name: Availability
+      type: string
+    - jsonPath: .status.generation
+      name: Generation
+      type: integer
+    - jsonPath: .status.mutationLeaseGeneration
+      name: Lease
+      type: integer
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: |-
+          RuntimeSessionControl is the Kubernetes-authoritative RuntimeSession control
+          record. SessionTurn/transcript/deferred-outbox data remains in one durable
+          SQLite transaction; the Kubernetes store completes the authoritative
+          SessionControl/BranchClaim CAS before activating the terminal projection.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: |-
+              RuntimeSessionControlSpec contains immutable session identity, ownership, and
+              profile bindings. Profile changes create a new session generation in status;
+              they do not mutate this immutable record identity.
+            properties:
+              owner:
+                description: Owner identifies the immutable Task or durable Session
+                  owner.
+                properties:
+                  kind:
+                    enum:
+                    - Task
+                    - Session
+                    - RuntimePool
+                    - PromptAttempt
+                    type: string
+                  uid:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                required:
+                - kind
+                - uid
+                type: object
+              profileDigestSchemaVersion:
+                description: ProfileDigestSchemaVersion identifies how RuntimeProfileDigest
+                  was built.
+                maxLength: 64
+                type: string
+              requestDigest:
+                description: RequestDigest binds creation to exact canonical input.
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              runtimePoolRef:
+                description: RuntimePoolRef is the controller-owned logical pool name
+                  when known.
+                maxLength: 253
+                type: string
+              runtimePoolUid:
+                description: RuntimePoolUID fences the pool object across delete/recreate.
+                maxLength: 1024
+                type: string
+              runtimeProfileDigest:
+                description: RuntimeProfileDigest binds the session to immutable runtime
+                  behavior.
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              sessionName:
+                description: |-
+                  SessionName is the immutable user-visible Session key within the object
+                  namespace. The Kubernetes object name is a digest-derived storage key and
+                  must not be treated as the Session name.
+                maxLength: 1024
+                minLength: 1
+                type: string
+              sessionUid:
+                description: SessionUID is the immutable Orka Session identity.
+                maxLength: 1024
+                minLength: 1
+                type: string
+            required:
+            - owner
+            - requestDigest
+            - sessionName
+            - sessionUid
+            type: object
+            x-kubernetes-validations:
+            - message: runtime session control spec is immutable
+              rule: self == oldSelf
+          status:
+            description: |-
+              RuntimeSessionControlStatus contains the lifecycle, generation, mutation
+              Lease, and independently verified recovery baseline.
+            properties:
+              availability:
+                description: RuntimeSessionControlAvailability gates the Session mutation
+                  lease.
+                enum:
+                - Available
+                - ReconciliationBlocked
+                type: string
+              blockedReason:
+                maxLength: 16384
+                type: string
+              controllerEpoch:
+                description: ControllerEpoch is the exact epoch that performed the
+                  last mutation.
+                format: int64
+                minimum: 1
+                type: integer
+              controllerEpochLeaseResourceVersion:
+                description: |-
+                  ControllerEpochLeaseResourceVersion is the resourceVersion of the
+                  authoritative controller-epoch Lease observed by the mutation.
+                maxLength: 64
+                type: string
+              controllerEpochName:
+                description: |-
+                  ControllerEpochName identifies the controller epoch domain checked before
+                  the mutation.
+                maxLength: 253
+                type: string
+              createdAt:
+                description: CreatedAt is the normalized logical creation time.
+                format: date-time
+                type: string
+              generation:
+                description: Generation is the monotonic ACP RuntimeSession generation.
+                format: int64
+                minimum: 1
+                type: integer
+              lastOperationDigest:
+                description: LastOperationDigest binds LastOperationID to exact canonical
+                  input.
+                pattern: ^sha256:[a-f0-9]{64}$
+                type: string
+              lastOperationId:
+                description: LastOperationID is the last idempotent mutation identity
+                  applied.
+                maxLength: 1024
+                type: string
+              lifecycle:
+                description: RuntimeSessionControlLifecycle is the durable RuntimeSession
+                  lifecycle.
+                enum:
+                - Creating
+                - Idle
+                - PromptRunning
+                - Validating
+                - PreparingPublication
+                - PublicationPrepared
+                - Publishing
+                - Verifying
+                - Finalizing
+                - Cancelling
+                - Poisoned
+                - Deleting
+                - Deleted
+                type: string
+              lineage:
+                description: |-
+                  Lineage is established or verified in the same RuntimeSessionControl
+                  status CAS that mirrors the authoritative mutation Lease.
+                properties:
+                  configDigest:
+                    description: |-
+                      ConfigDigest freezes the configuration/execution-snapshot identity used
+                      when the lineage was established.
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  contractVersion:
+                    description: |-
+                      AgentRuntimeContractVersion identifies the Orka-facing runtime contract.
+                      During harness coexistence both protocol values are schema-valid; omission is
+                      never protocol evidence and is tolerated only for stored objects awaiting the
+                      one-time bridge classification.
+                    enum:
+                    - orka.harness.v1
+                    - orka.harness.v2
+                    type: string
+                  establishedAt:
+                    format: date-time
+                    type: string
+                  generation:
+                    format: int64
+                    minimum: 1
+                    type: integer
+                  namespaceUID:
+                    description: |-
+                      NamespaceUID prevents a same-name recreated namespace from attaching to
+                      durable state owned by the previous namespace identity.
+                    type: string
+                  runtimeIdentity:
+                    description: RuntimeIdentity is the built-in runtime type or AgentRuntime
+                      UID.
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  sessionUid:
+                    description: SessionUID repeats the immutable control identity
+                      at the lineage fence.
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                required:
+                - configDigest
+                - contractVersion
+                - establishedAt
+                - generation
+                - namespaceUID
+                - runtimeIdentity
+                - sessionUid
+                type: object
+              mutationLease:
+                description: |-
+                  RuntimeSessionMutationLeaseStatus mirrors the namespaced Kubernetes Lease
+                  that serializes mutation for one immutable SessionUID.
+                properties:
+                  acquiredAt:
+                    format: date-time
+                    type: string
+                  attempt:
+                    format: int64
+                    minimum: 1
+                    type: integer
+                  expiresAt:
+                    format: date-time
+                    type: string
+                  generation:
+                    format: int64
+                    minimum: 1
+                    type: integer
+                  leaseName:
+                    maxLength: 253
+                    minLength: 1
+                    type: string
+                  leaseResourceVersion:
+                    maxLength: 64
+                    minLength: 1
+                    type: string
+                  promptId:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  requestDigest:
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  taskUid:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                required:
+                - acquiredAt
+                - attempt
+                - generation
+                - leaseName
+                - leaseResourceVersion
+                - promptId
+                - requestDigest
+                - taskUid
+                type: object
+              mutationLeaseGeneration:
+                description: MutationLeaseGeneration is monotonic and never reused
+                  for SessionUID.
+                format: int64
+                minimum: 0
+                type: integer
+              relatedPromptAttemptId:
+                maxLength: 1024
+                type: string
+              relatedPublicationId:
+                maxLength: 1024
+                type: string
+              updatedAt:
+                description: UpdatedAt is the normalized logical mutation time.
+                format: date-time
+                type: string
+              verifiedBaseline:
+                description: ControlVerifiedBranchBaseline is an independently verified
+                  branch baseline.
+                properties:
+                  ref:
+                    maxLength: 1024
+                    pattern: ^refs/heads/.+$
+                    type: string
+                  repositoryId:
+                    maxLength: 1024
+                    minLength: 1
+                    type: string
+                  sha:
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                required:
+                - ref
+                - repositoryId
+                - sha
+                type: object
+              version:
+                description: |-
+                  Version is the monotonic domain CAS version. It advances once for each
+                  successfully persisted logical mutation.
+                format: int64
+                minimum: 1
+                type: integer
+            type: object
+            x-kubernetes-validations:
+            - message: available sessions must clear reconciliation block metadata
+              rule: '!has(self.availability) || self.availability != ''Available''
+                || ((!has(self.blockedReason) || size(self.blockedReason) == 0) &&
+                (!has(self.relatedPromptAttemptId) || size(self.relatedPromptAttemptId)
+                == 0) && (!has(self.relatedPublicationId) || size(self.relatedPublicationId)
+                == 0))'
+            - message: reconciliation-blocked sessions require a reason
+              rule: '!has(self.availability) || self.availability != ''ReconciliationBlocked''
+                || (has(self.blockedReason) && size(self.blockedReason) > 0)'
+            - message: runtime Session lineage is append-once and immutable
+              rule: '!has(oldSelf.lineage) || (has(self.lineage) && self.lineage ==
+                oldSelf.lineage)'
+        required:
+        - spec
+        type: object
+        x-kubernetes-validations:
+        - message: runtime Session lineage UID must match the immutable control Session
+            UID
+          rule: '!has(self.status) || !has(self.status.lineage) || self.status.lineage.sessionUid
+            == self.spec.sessionUid'
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/manifest_staging/charts/orka/crds/task-customresourcedefinition.yaml b/manifest_staging/charts/orka/crds/task-customresourcedefinition.yaml
index 704b92442..ece87c000 100644
--- a/manifest_staging/charts/orka/crds/task-customresourcedefinition.yaml
+++ b/manifest_staging/charts/orka/crds/task-customresourcedefinition.yaml
@@ -93,21 +93,26 @@ spec:
                     minimum: 1
                     type: integer
                   workspace:
-                    description: Workspace defines the working directory configuration
+                    description: |-
+                      Workspace is the legacy harness v1 agent workspace configuration at its
+                      historical JSON path. It is a preserved compatibility read surface for
+                      stored v1 Tasks only: it can never be introduced or changed, and it is
+                      not an authority surface for new work.
                     properties:
                       branch:
-                        description: Branch is the git branch to checkout
+                        description: Branch is the git branch to checkout.
                         type: string
                       forkRepo:
                         description: ForkRepo is the writable fork repository URL
-                          for pushing changes
+                          for pushing changes.
                         type: string
                       gitRepo:
-                        description: GitRepo is the repository URL to clone
+                        description: GitRepo is the repository URL to clone.
                         type: string
                       gitSecretRef:
-                        description: GitSecretRef references a Secret containing git
-                          credentials
+                        description: |-
+                          GitSecretRef references a Secret containing git credentials. Adopted
+                          legacy bindings freeze the exact Secret identity; new bindings reject it.
                         properties:
                           name:
                             default: ""
@@ -122,23 +127,29 @@ spec:
                         x-kubernetes-map-type: atomic
                       prBaseBranch:
                         description: PRBaseBranch is the upstream branch to target
-                          for pull requests
+                          for pull requests.
                         type: string
                       pushBranch:
                         description: |-
-                          PushBranch is the remote branch name to push changes to after the agent completes.
-                          When set, FinalizeResult will commit and push changes to this branch.
+                          PushBranch is the remote branch name to push changes to after the agent
+                          completes.
                         type: string
                       ref:
                         description: Ref is a specific git ref (commit SHA, tag) to
-                          checkout
+                          checkout.
                         type: string
                       subPath:
                         description: SubPath is a subdirectory within the repo to
-                          use as workspace root
+                          use as workspace root.
                         type: string
                     type: object
                 type: object
+                x-kubernetes-validations:
+                - message: legacy agentRuntime.workspace is a preserved harness v1
+                    compatibility surface; new Tasks must use spec.workspace
+                  optionalOldSelf: true
+                  rule: '!has(self.workspace) || (oldSelf.hasValue() && has(oldSelf.value().workspace)
+                    && self.workspace == oldSelf.value().workspace)'
               ai:
                 description: AI contains AI-specific configuration (when type is "ai")
                 properties:
@@ -1367,10 +1378,10 @@ spec:
                     type: array
                   workspace:
                     description: |-
-                      Workspace requests an upstream agent-sandbox execution workspace for agent Tasks.
-                      When enabled, the Task controller validates the request and propagates the
-                      resolved sandbox settings to the agent worker Job. The worker wrapper then
-                      claims the sandbox workspace and runs the configured agent runtime inside it.
+                      Workspace requests an execution workspace for worker-backed Task types.
+                      ACP core agent Tasks reject this field because their ephemeral workspace is
+                      owned by RuntimeSession lifecycle and clean-room publication. Actor-backed
+                      RuntimeSession support is a future integration behind the v2 lifecycle seam.
                     properties:
                       boot:
                         description: |-
@@ -1803,51 +1814,258 @@ spec:
                 type: string
               workspace:
                 description: |-
-                  Workspace defines repository checkout and push settings for tasks that need
-                  a git workspace. Agent tasks can continue to use agentRuntime.workspace for
-                  compatibility; this top-level field is used by container tasks as well.
+                  Workspace defines the canonical repository workspace, intent, credentials,
+                  and publication request. Agent Tasks that omit intent are interpreted as
+                  read by controller logic; an omitted intent preserves existing container behavior.
                 properties:
+                  allowedPaths:
+                    description: |-
+                      AllowedPaths restricts publishable workspace changes to these path globs or
+                      directory prefixes ending in /**. Empty allows every otherwise-safe path.
+                      It is not supported for container Tasks.
+                    items:
+                      type: string
+                    maxItems: 256
+                    type: array
                   branch:
-                    description: Branch is the git branch to checkout
+                    description: Branch is the source branch to check out.
+                    maxLength: 255
                     type: string
-                  forkRepo:
-                    description: ForkRepo is the writable fork repository URL for
-                      pushing changes
+                  createPR:
+                    default: false
+                    description: |-
+                      CreatePR explicitly requests pull request reconciliation after branch publication.
+                      Branch push remains the minimum durable delivery when false. It is supported only
+                      for agent Tasks using the trusted ACP publisher boundary.
+                    type: boolean
+                  denyRepositoryControlPaths:
+                    description: |-
+                      DenyRepositoryControlPaths rejects workflow, RBAC, and chart-secret paths
+                      before publication even when AllowedPaths is empty or otherwise matches.
+                      It is not supported for container Tasks.
+                    type: boolean
+                  expectedRemoteSHA:
+                    description: |-
+                      ExpectedRemoteSHA requires the publication branch to exist at this exact
+                      commit before publication. Empty means the branch must be absent. It is
+                      supported only for agent Tasks using the trusted ACP publisher boundary.
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
                     type: string
+                  forgeCredentialRef:
+                    description: |-
+                      ForgeCredentialRef references the forge API credential used only for pull
+                      request reconciliation when createPR=true.
+                    properties:
+                      key:
+                        default: token
+                        description: |-
+                          Key is the Secret data key containing one bearer token or one complete
+                          Authorization header. It defaults to "token" when omitted.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[A-Za-z0-9._-]+$
+                        type: string
+                      name:
+                        description: Name is the name of the Secret in the Task namespace.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                    required:
+                    - name
+                    type: object
                   gitRepo:
-                    description: GitRepo is the repository URL to clone
+                    description: |-
+                      GitRepo is the source repository URL cloned by the clean-room workspace boundary.
+                      Credentials must not be embedded in the URL.
+                    maxLength: 2048
                     type: string
-                  gitSecretRef:
-                    description: GitSecretRef references a Secret containing git credentials
+                  intent:
+                    description: |-
+                      Intent declares whether the verified workspace must remain unchanged or may
+                      produce a publication artifact. It is immutable for the lifetime of the Task.
+                      Agent Tasks that omit intent are interpreted as read by controller logic;
+                      omitted intent preserves the existing behavior of container Tasks.
+                    enum:
+                    - read
+                    - write
+                    type: string
+                  maxChangedFiles:
+                    description: |-
+                      MaxChangedFiles bounds the total changed, deleted, and symlink paths accepted
+                      from the trusted supervisor before publication. Zero uses the runtime limit.
+                      It is not supported for container Tasks.
+                    format: int32
+                    minimum: 1
+                    type: integer
+                  prBaseBranch:
+                    description: PRBaseBranch is the upstream branch targeted when
+                      CreatePR is true.
+                    maxLength: 255
+                    type: string
+                  publicationCredentialRef:
+                    description: |-
+                      PublicationCredentialRef references the target-repository write credential
+                      used only for the exact CAS push. It is never used to clone the source.
                     properties:
-                      name:
-                        default: ""
+                      key:
+                        default: token
                         description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          Key is the Secret data key containing one bearer token or one complete
+                          Authorization header. It defaults to "token" when omitted.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[A-Za-z0-9._-]+$
+                        type: string
+                      name:
+                        description: Name is the name of the Secret in the Task namespace.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
+                    required:
+                    - name
                     type: object
-                    x-kubernetes-map-type: atomic
-                  prBaseBranch:
-                    description: PRBaseBranch is the upstream branch to target for
-                      pull requests
+                  publicationGitRepo:
+                    description: |-
+                      PublicationGitRepo is the repository URL whose branch receives an exact CAS publication.
+                      Credentials must not be embedded in the URL.
+                    maxLength: 2048
                     type: string
+                  publicationReadCredentialRef:
+                    description: |-
+                      PublicationReadCredentialRef references the target-repository read
+                      credential used only for preflight and independent post-push verification.
+                    properties:
+                      key:
+                        default: token
+                        description: |-
+                          Key is the Secret data key containing one bearer token or one complete
+                          Authorization header. It defaults to "token" when omitted.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[A-Za-z0-9._-]+$
+                        type: string
+                      name:
+                        description: Name is the name of the Secret in the Task namespace.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                    required:
+                    - name
+                    type: object
+                  publicationRepository:
+                    description: |-
+                      PublicationRepository is the optional URL-derived identity for
+                      PublicationGitRepo. When set, it must match the normalized credential-free
+                      URL; for GitHub, use provider "github" and ID "github.com/owner/repo".
+                    properties:
+                      id:
+                        description: |-
+                          ID is the canonical credential-free URL identity and must match the
+                          corresponding repository URL after normalization. For GitHub, use
+                          "github.com/owner/repo"; GitHub GraphQL node IDs are not accepted.
+                        maxLength: 512
+                        minLength: 1
+                        type: string
+                      provider:
+                        description: Provider identifies the source-control provider
+                          or forge.
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$
+                        type: string
+                    required:
+                    - id
+                    - provider
+                    type: object
                   pushBranch:
                     description: |-
-                      PushBranch is the remote branch name to push changes to after the agent completes.
-                      When set, FinalizeResult will commit and push changes to this branch.
+                      PushBranch is the publication branch. For write Tasks the controller derives
+                      a full-entropy Task- or Session-owned branch when this is omitted.
+                    maxLength: 255
                     type: string
+                  readCredentialRef:
+                    description: |-
+                      ReadCredentialRef references the one-operation clone/read credential Secret.
+                      The Secret is resolved only by the clean-room workspace boundary.
+                    properties:
+                      key:
+                        default: token
+                        description: |-
+                          Key is the Secret data key containing one bearer token or one complete
+                          Authorization header. It defaults to "token" when omitted.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[A-Za-z0-9._-]+$
+                        type: string
+                      name:
+                        description: Name is the name of the Secret in the Task namespace.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                    required:
+                    - name
+                    type: object
                   ref:
-                    description: Ref is a specific git ref (commit SHA, tag) to checkout
+                    description: Ref is a specific source git ref, commit SHA, or
+                      tag to check out.
+                    maxLength: 512
                     type: string
+                  rejectBinaryFiles:
+                    description: |-
+                      RejectBinaryFiles rejects changed file content that is not valid text. It is
+                      not supported for container Tasks.
+                    type: boolean
+                  rejectSecretLikeContent:
+                    description: |-
+                      RejectSecretLikeContent applies Orka's generic secret detector to changed
+                      paths and file contents before publication. It is not supported for container Tasks.
+                    type: boolean
+                  sourceRepository:
+                    description: |-
+                      SourceRepository is the optional URL-derived identity for GitRepo. When set,
+                      it must match the normalized credential-free URL; for GitHub, use provider
+                      "github" and ID "github.com/owner/repo".
+                    properties:
+                      id:
+                        description: |-
+                          ID is the canonical credential-free URL identity and must match the
+                          corresponding repository URL after normalization. For GitHub, use
+                          "github.com/owner/repo"; GitHub GraphQL node IDs are not accepted.
+                        maxLength: 512
+                        minLength: 1
+                        type: string
+                      provider:
+                        description: Provider identifies the source-control provider
+                          or forge.
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$
+                        type: string
+                    required:
+                    - id
+                    - provider
+                    type: object
                   subPath:
-                    description: SubPath is a subdirectory within the repo to use
-                      as workspace root
+                    description: SubPath is a subdirectory within the source repository
+                      used as workspace root.
+                    maxLength: 1024
                     type: string
                 type: object
+                x-kubernetes-validations:
+                - message: createPR requires write workspace intent
+                  rule: '!self.createPR || self.intent == ''write'''
+                - message: gitRepo must not contain embedded credentials, query parameters,
+                    or fragments
+                  rule: '!has(self.gitRepo) || (!self.gitRepo.matches(''(?i)^[A-Za-z][A-Za-z0-9+.-]*://[^/]*@'')
+                    && !self.gitRepo.contains(''?'') && !self.gitRepo.contains(''#''))'
+                - message: publicationGitRepo must not contain embedded credentials,
+                    query parameters, or fragments
+                  rule: '!has(self.publicationGitRepo) || (!self.publicationGitRepo.matches(''(?i)^[A-Za-z][A-Za-z0-9+.-]*://[^/]*@'')
+                    && !self.publicationGitRepo.contains(''?'') && !self.publicationGitRepo.contains(''#''))'
             required:
             - type
             type: object
@@ -1858,12 +2076,219 @@ spec:
             - message: transaction is immutable
               rule: has(self.transaction) == has(oldSelf.transaction) && (!has(self.transaction)
                 || self.transaction == oldSelf.transaction)
+            - message: type is immutable
+              rule: self.type == oldSelf.type
+            - message: effective workspace intent is immutable
+              rule: '(has(self.workspace) && has(self.workspace.intent) ? self.workspace.intent
+                : (self.type == ''agent'' ? ''read'' : self.type)) == (has(oldSelf.workspace)
+                && has(oldSelf.workspace.intent) ? oldSelf.workspace.intent : (oldSelf.type
+                == ''agent'' ? ''read'' : oldSelf.type))'
+            - message: agent prompt is immutable
+              rule: self.type != 'agent' || (has(self.prompt) == has(oldSelf.prompt)
+                && (!has(self.prompt) || self.prompt == oldSelf.prompt))
+            - message: agentRef is immutable for agent Tasks
+              rule: self.type != 'agent' || (has(self.agentRef) == has(oldSelf.agentRef)
+                && (!has(self.agentRef) || self.agentRef == oldSelf.agentRef))
+            - message: agentRuntime is immutable for agent Tasks
+              rule: self.type != 'agent' || (has(self.agentRuntime) == has(oldSelf.agentRuntime)
+                && (!has(self.agentRuntime) || self.agentRuntime == oldSelf.agentRuntime))
+            - message: sessionRef is immutable for agent Tasks
+              rule: self.type != 'agent' || (has(self.sessionRef) == has(oldSelf.sessionRef)
+                && (!has(self.sessionRef) || self.sessionRef == oldSelf.sessionRef))
+            - message: workspace is immutable for agent Tasks
+              rule: self.type != 'agent' || (has(self.workspace) == has(oldSelf.workspace)
+                && (!has(self.workspace) || self.workspace == oldSelf.workspace))
+            - message: timeout is immutable for agent Tasks
+              rule: self.type != 'agent' || (has(self.timeout) == has(oldSelf.timeout)
+                && (!has(self.timeout) || self.timeout == oldSelf.timeout))
             - message: session workspace reuse requires spec.sessionRef
               rule: '!has(self.execution) || !has(self.execution.workspace) || self.execution.workspace.reusePolicy
                 != ''session'' || has(self.sessionRef)'
+            - message: container Tasks do not support workspace.expectedRemoteSHA
+              rule: self.type != 'container' || !has(self.workspace) || !has(self.workspace.expectedRemoteSHA)
+            - message: container Tasks do not support workspace.createPR
+              rule: self.type != 'container' || !has(self.workspace) || (!has(self.workspace.createPR)
+                || !self.workspace.createPR)
+            - message: container Tasks do not support clean-room workspace publication
+                policies
+              rule: self.type != 'container' || !has(self.workspace) || (!has(self.workspace.maxChangedFiles)
+                && (!has(self.workspace.allowedPaths) || self.workspace.allowedPaths.size()
+                == 0) && (!has(self.workspace.denyRepositoryControlPaths) || !self.workspace.denyRepositoryControlPaths)
+                && (!has(self.workspace.rejectBinaryFiles) || !self.workspace.rejectBinaryFiles)
+                && (!has(self.workspace.rejectSecretLikeContent) || !self.workspace.rejectSecretLikeContent))
+            - message: custom-image container Tasks do not support workspace.pushBranch
+                publication
+              rule: self.type != 'container' || !has(self.workspace) || !has(self.workspace.pushBranch)
+                || self.workspace.pushBranch.size() == 0 || !has(self.image) || self.image.size()
+                == 0
           status:
             description: TaskStatus defines the observed state of Task
             properties:
+              agentExecutionBinding:
+                description: |-
+                  AgentExecutionBinding is the authoritative, write-once, immutable
+                  execution route for this agent Task.
+                properties:
+                  agent:
+                    description: AgentExecutionAgentRef pins the exact Agent identity
+                      resolved at binding.
+                    properties:
+                      generation:
+                        format: int64
+                        minimum: 1
+                        type: integer
+                      name:
+                        minLength: 1
+                        type: string
+                      namespace:
+                        minLength: 1
+                        type: string
+                      uid:
+                        description: |-
+                          UID is a type that holds unique ID values, including UUIDs.  Because we
+                          don't ONLY use UUIDs, this is an alias to string.  Being a type captures
+                          intent and helps make sure that UIDs and names do not get conflated.
+                        type: string
+                    required:
+                    - generation
+                    - name
+                    - namespace
+                    - uid
+                    type: object
+                  backend:
+                    description: AgentExecutionBackend identifies the isolated execution
+                      dispatcher backend.
+                    enum:
+                    - harness-wrapper
+                    - runtime-pool
+                    - external-endpoint
+                    type: string
+                  bindingDigest:
+                    description: |-
+                      BindingDigest is the canonical digest of this binding; every durable
+                      demand, attempt, turn, Session lease, publication, and cleanup record
+                      copies it.
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  boundAt:
+                    format: date-time
+                    type: string
+                  contractVersion:
+                    description: ContractVersion is the frozen execution protocol
+                      for the Task lifetime.
+                    enum:
+                    - orka.harness.v1
+                    - orka.harness.v2
+                    type: string
+                  runtimeProfileDigest:
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  runtimeProfileDigestSchemaVersion:
+                    enum:
+                    - 1
+                    format: int32
+                    type: integer
+                  runtimeRef:
+                    description: AgentExecutionRuntimeRef pins a referenced AgentRuntime
+                      identity.
+                    properties:
+                      generation:
+                        format: int64
+                        minimum: 1
+                        type: integer
+                      name:
+                        minLength: 1
+                        type: string
+                      uid:
+                        description: |-
+                          UID is a type that holds unique ID values, including UUIDs.  Because we
+                          don't ONLY use UUIDs, this is an alias to string.  Being a type captures
+                          intent and helps make sure that UIDs and names do not get conflated.
+                        type: string
+                    required:
+                    - generation
+                    - name
+                    - uid
+                    type: object
+                  runtimeType:
+                    description: RuntimeType is the built-in runtime type, empty for
+                      runtimeRef bindings.
+                    enum:
+                    - claude
+                    - codex
+                    - copilot
+                    - opencode
+                    type: string
+                  schemaVersion:
+                    enum:
+                    - 1
+                    format: int32
+                    type: integer
+                  snapshot:
+                    description: AgentExecutionSnapshotRef links the immutable non-secret
+                      execution snapshot.
+                    properties:
+                      digest:
+                        pattern: ^sha256:[a-f0-9]{64}$
+                        type: string
+                      id:
+                        description: ID is the snapshot identity in the form <task-uid>/sha256:<digest>.
+                        maxLength: 512
+                        minLength: 1
+                        type: string
+                      schemaVersion:
+                        enum:
+                        - 1
+                        format: int32
+                        type: integer
+                    required:
+                    - digest
+                    - id
+                    - schemaVersion
+                    type: object
+                  task:
+                    description: AgentExecutionBindingTaskRef pins the bound Task
+                      identity.
+                    properties:
+                      boundSpecGeneration:
+                        description: BoundSpecGeneration is the Task spec generation
+                          frozen into the snapshot.
+                        format: int64
+                        minimum: 1
+                        type: integer
+                      namespaceUID:
+                        description: |-
+                          NamespaceUID is the UID of the Task namespace, preventing same-name
+                          namespace recreation from satisfying old identities.
+                        type: string
+                      uid:
+                        description: |-
+                          UID is a type that holds unique ID values, including UUIDs.  Because we
+                          don't ONLY use UUIDs, this is an alias to string.  Being a type captures
+                          intent and helps make sure that UIDs and names do not get conflated.
+                        type: string
+                    required:
+                    - boundSpecGeneration
+                    - namespaceUID
+                    - uid
+                    type: object
+                required:
+                - backend
+                - bindingDigest
+                - boundAt
+                - contractVersion
+                - schemaVersion
+                - snapshot
+                - task
+                type: object
+                x-kubernetes-validations:
+                - message: the harness-wrapper backend requires an orka.harness.v1
+                    binding
+                  rule: self.backend != 'harness-wrapper' || self.contractVersion
+                    == 'orka.harness.v1'
+                - message: the runtime-pool backend requires an orka.harness.v2 binding
+                  rule: self.backend != 'runtime-pool' || self.contractVersion ==
+                    'orka.harness.v2'
               attempts:
                 description: Attempts is the number of attempts made
                 format: int32
@@ -1965,10 +2390,383 @@ spec:
                 x-kubernetes-list-map-keys:
                 - type
                 x-kubernetes-list-type: map
+              delivery:
+                description: Delivery reports trusted workspace validation and publication
+                  reconciliation.
+                properties:
+                  artifactDigest:
+                    description: ArtifactDigest is the durable content-addressed workspace
+                      delta digest.
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  branch:
+                    description: Branch is the publication branch without a refs/heads/
+                      prefix.
+                    maxLength: 255
+                    type: string
+                  expectedCommitSHA:
+                    description: ExpectedCommitSHA is the exact Orka-owned commit
+                      prepared for publication.
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                  lastTransitionTime:
+                    description: LastTransitionTime is the last durable delivery-state
+                      transition time.
+                    format: date-time
+                    type: string
+                  message:
+                    description: Message contains bounded, sanitized delivery context.
+                    maxLength: 1024
+                    type: string
+                  outcome:
+                    description: Outcome is set only after delivery reaches a terminal
+                      classification.
+                    enum:
+                    - NotRequested
+                    - VerifiedExact
+                    - DeliveredSuperseded
+                    - ReadValidated
+                    - NoChange
+                    - CancelledBeforePublish
+                    - ReadOnlyWorkspaceModified
+                    - DeliveryConflict
+                    - CredentialBlocked
+                    - PublicationOutcomeUnknown
+                    type: string
+                  prReceipt:
+                    description: PRReceipt is present only when createPR was explicitly
+                      requested and reconciled.
+                    properties:
+                      baseBranch:
+                        description: BaseBranch is the reconciled pull request base
+                          branch.
+                        maxLength: 255
+                        type: string
+                      headBranch:
+                        description: HeadBranch is the reconciled pull request head
+                          branch.
+                        maxLength: 255
+                        type: string
+                      headSHA:
+                        description: HeadSHA is the exact observed pull request head
+                          commit.
+                        pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                        type: string
+                      id:
+                        description: ID is the provider's durable pull request identifier.
+                        maxLength: 512
+                        minLength: 1
+                        type: string
+                      number:
+                        description: Number is the provider's numeric pull request
+                          number when available.
+                        format: int64
+                        minimum: 1
+                        type: integer
+                      state:
+                        description: State is the provider-observed pull request state.
+                        maxLength: 64
+                        type: string
+                      url:
+                        description: URL is the canonical user-facing pull request
+                          URL. It must not contain credentials.
+                        maxLength: 2048
+                        type: string
+                    required:
+                    - id
+                    type: object
+                  publicationID:
+                    description: PublicationID is the durable identity reused for
+                      reconciliation of the same artifact.
+                    maxLength: 253
+                    pattern: ^[A-Za-z0-9][A-Za-z0-9._:-]{0,252}$
+                    type: string
+                  publicationRepository:
+                    description: PublicationRepository is the canonical repository
+                      whose branch was reconciled.
+                    properties:
+                      id:
+                        description: |-
+                          ID is the canonical credential-free URL identity and must match the
+                          corresponding repository URL after normalization. For GitHub, use
+                          "github.com/owner/repo"; GitHub GraphQL node IDs are not accepted.
+                        maxLength: 512
+                        minLength: 1
+                        type: string
+                      provider:
+                        description: Provider identifies the source-control provider
+                          or forge.
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$
+                        type: string
+                    required:
+                    - id
+                    - provider
+                    type: object
+                  reason:
+                    description: Reason is a stable machine-readable explanation for
+                      State or Outcome.
+                    maxLength: 128
+                    pattern: ^[A-Za-z][A-Za-z0-9._-]{0,127}$
+                    type: string
+                  remoteBeforeSHA:
+                    description: |-
+                      RemoteBeforeSHA is the exact publication ref observed before the CAS push.
+                      Nil means not yet observed; a pointer to the empty string records explicit
+                      absence; a non-empty value records the observed object ID.
+                    pattern: ^(|[a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                  sourceRepository:
+                    description: SourceRepository is the canonical repository from
+                      which the workspace baseline was created.
+                    properties:
+                      id:
+                        description: |-
+                          ID is the canonical credential-free URL identity and must match the
+                          corresponding repository URL after normalization. For GitHub, use
+                          "github.com/owner/repo"; GitHub GraphQL node IDs are not accepted.
+                        maxLength: 512
+                        minLength: 1
+                        type: string
+                      provider:
+                        description: Provider identifies the source-control provider
+                          or forge.
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$
+                        type: string
+                    required:
+                    - id
+                    - provider
+                    type: object
+                  startingSHA:
+                    description: StartingSHA is the verified source baseline before
+                      prompt execution.
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                  state:
+                    description: State is the current durable delivery state.
+                    enum:
+                    - NotRequested
+                    - Validating
+                    - Preparing
+                    - Prepared
+                    - Publishing
+                    - Verifying
+                    - VerifiedExact
+                    - DeliveredSuperseded
+                    - ReadValidated
+                    - NoChange
+                    - CancelledBeforePublish
+                    - ReadOnlyWorkspaceModified
+                    - DeliveryConflict
+                    - CredentialBlocked
+                    - PublicationOutcomeUnknown
+                    type: string
+                  supersedingRemoteSHA:
+                    description: SupersedingRemoteSHA is the verified descendant that
+                      superseded ExpectedCommitSHA.
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                  treeSHA:
+                    description: TreeSHA is the deterministic clean-room tree written
+                      by the publisher.
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                  verifiedRemoteSHA:
+                    description: VerifiedRemoteSHA is the independently observed remote
+                      branch head.
+                    pattern: ^([a-f0-9]{40}|[a-f0-9]{64})$
+                    type: string
+                type: object
+                x-kubernetes-validations:
+                - message: delivery outcome requires the matching terminal state
+                  rule: '!has(self.outcome) || (has(self.state) && self.state == self.outcome)'
+                - message: terminal delivery state requires an outcome
+                  rule: '!has(self.state) || !(self.state in [''NotRequested'', ''VerifiedExact'',
+                    ''DeliveredSuperseded'', ''ReadValidated'', ''NoChange'', ''CancelledBeforePublish'',
+                    ''ReadOnlyWorkspaceModified'', ''DeliveryConflict'', ''CredentialBlocked'',
+                    ''PublicationOutcomeUnknown'']) || has(self.outcome)'
+              execution:
+                description: |-
+                  Execution reports the durable execution state and terminal outcome for the
+                  current attempt. Phase remains the compatibility projection.
+                properties:
+                  agentRuntimeName:
+                    description: |-
+                      AgentRuntimeName is the namespaced external orka.harness.v2 registration
+                      selected for this attempt. It is mutually exclusive with RuntimePoolName.
+                    maxLength: 253
+                    type: string
+                  agentRuntimeUID:
+                    description: |-
+                      AgentRuntimeUID is the immutable external AgentRuntime UID fenced into the
+                      attempt selection.
+                    maxLength: 253
+                    type: string
+                  attempt:
+                    description: Attempt is the one-based Task execution attempt represented
+                      by this status.
+                    format: int32
+                    minimum: 1
+                    type: integer
+                  controllerEpoch:
+                    description: ControllerEpoch is the durable controller epoch fencing
+                      this attempt.
+                    format: int64
+                    minimum: 0
+                    type: integer
+                  forgeCredentialResourceVersion:
+                    description: |-
+                      ForgeCredentialResourceVersion freezes the forge-only Secret version used
+                      for pull request reconciliation.
+                    maxLength: 253
+                    type: string
+                  lastTransitionTime:
+                    description: LastTransitionTime is the last durable execution-state
+                      transition time.
+                    format: date-time
+                    type: string
+                  message:
+                    description: Message contains bounded, sanitized execution context.
+                    maxLength: 1024
+                    type: string
+                  outcome:
+                    description: Outcome is set only after execution reaches a terminal
+                      classification.
+                    enum:
+                    - Succeeded
+                    - Failed
+                    - Cancelled
+                    - OutcomeUnknown
+                    type: string
+                  promptID:
+                    description: PromptID is the durable prompt identity used for
+                      submission and settlement.
+                    maxLength: 253
+                    type: string
+                  publicationCredentialResourceVersion:
+                    description: |-
+                      PublicationCredentialResourceVersion freezes the target-write Secret
+                      version selected at reservation without exposing credential material.
+                    maxLength: 253
+                    type: string
+                  publicationReadCredentialResourceVersion:
+                    description: |-
+                      PublicationReadCredentialResourceVersion freezes the target-read Secret
+                      version used for preflight and independent verification.
+                    maxLength: 253
+                    type: string
+                  readCredentialResourceVersion:
+                    description: |-
+                      ReadCredentialResourceVersion freezes the read credential Secret version
+                      selected at reservation without exposing credential material.
+                    maxLength: 253
+                    type: string
+                  reason:
+                    description: Reason is a stable machine-readable explanation for
+                      State or Outcome.
+                    maxLength: 128
+                    pattern: ^[A-Za-z][A-Za-z0-9._-]{0,127}$
+                    type: string
+                  requestDigest:
+                    description: RequestDigest is the canonical immutable prompt request
+                      digest.
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  runtimeInstanceID:
+                    description: RuntimeInstanceID is the exact selected supervisor
+                      Pod UID plus boot identity.
+                    maxLength: 512
+                    type: string
+                  runtimePoolName:
+                    description: RuntimePoolName is the namespaced logical pool selected
+                      for this attempt.
+                    maxLength: 253
+                    type: string
+                  runtimePoolUID:
+                    description: RuntimePoolUID is the immutable pool UID fenced into
+                      runtime requests.
+                    maxLength: 253
+                    type: string
+                  runtimeSessionCleanupDigest:
+                    description: |-
+                      RuntimeSessionCleanupDigest is the controller-owned proof that the exact
+                      RuntimeSession requiring retirement was deleted or its immutable runtime
+                      instance was replaced. Users may read but cannot mutate the Task status subresource.
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  runtimeSessionGeneration:
+                    description: RuntimeSessionGeneration is the monotonic profile/session
+                      generation.
+                    format: int64
+                    minimum: 0
+                    type: integer
+                  runtimeSessionMCPDigest:
+                    description: |-
+                      RuntimeSessionMCPDigest binds the complete non-secret effective MCP policy
+                      and descriptor configuration to a pending or reusable Session generation.
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  runtimeSessionProfileDigest:
+                    description: |-
+                      RuntimeSessionProfileDigest freezes the immutable runtime behavior bound to
+                      a pending or reusable Session generation.
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  runtimeSessionRecreationPending:
+                    description: |-
+                      RuntimeSessionRecreationPending records that the exact generation is being
+                      created or replaced and must be reconciled before a different request may
+                      reuse that identity.
+                    type: boolean
+                  runtimeSessionSupervisorBootID:
+                    description: |-
+                      RuntimeSessionSupervisorBootID freezes the supervisor boot that owns a
+                      pending or reusable Session generation.
+                    maxLength: 512
+                    type: string
+                  runtimeSessionUID:
+                    description: RuntimeSessionUID is the stable controller-owned
+                      Session execution identity.
+                    maxLength: 253
+                    type: string
+                  runtimeSessionWorkspaceDigest:
+                    description: |-
+                      RuntimeSessionWorkspaceDigest binds a reusable Session generation to the
+                      exact repository, source ref, verified baseline, intent, and relative root.
+                      It contains no credential material.
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  state:
+                    description: State is the current durable execution state.
+                    enum:
+                    - Queued
+                    - Reserved
+                    - SessionStarting
+                    - Planned
+                    - Submitting
+                    - SubmittedUnknown
+                    - Accepted
+                    - Running
+                    - Settling
+                    - Succeeded
+                    - Failed
+                    - Cancelled
+                    - OutcomeUnknown
+                    type: string
+                type: object
+                x-kubernetes-validations:
+                - message: execution outcome requires the matching terminal state
+                  rule: '!has(self.outcome) || (has(self.state) && self.state == self.outcome)'
+                - message: terminal execution state requires an outcome
+                  rule: '!has(self.state) || !(self.state in [''Succeeded'', ''Failed'',
+                    ''Cancelled'', ''OutcomeUnknown'']) || has(self.outcome)'
               executionOutcome:
                 description: |-
-                  ExecutionOutcome is the immutable outcome recorded when workload execution ends. Workspace
-                  attachment revocation and cleanup continue independently while the Task is Finalizing.
+                  ExecutionOutcome records the immutable outcome of a non-ACP workload before
+                  provider-neutral execution-workspace finalization completes.
                 properties:
                   attempt:
                     description: Attempt is the Task attempt that produced this outcome.
@@ -2240,10 +3038,16 @@ spec:
                 type: object
               harnessRuntime:
                 description: |-
-                  HarnessRuntime records the controller-resolved harness runtime target for an
-                  in-flight agent turn. It intentionally stores only non-secret routing metadata
-                  and Secret references, never bearer values.
+                  HarnessRuntime records the controller-resolved harness v1 runtime target
+                  for an in-flight agent turn. It intentionally stores only non-secret
+                  routing metadata and Secret references, never bearer values. Compatibility
+                  surface for harness v1 bindings.
                 properties:
+                  attempt:
+                    description: Attempt is the durable harness v1 attempt number.
+                    format: int32
+                    minimum: 1
+                    type: integer
                   authRefField:
                     description: AuthRefField is the Secret data field selected when
                       the turn started.
@@ -2253,31 +3057,122 @@ spec:
                       turn started.
                     type: string
                   authRefResourceVersion:
-                    description: AuthRefResourceVersion is the auth Secret resourceVersion
-                      validated before starting the turn.
+                    description: |-
+                      AuthRefResourceVersion is the auth Secret resourceVersion validated
+                      before starting the turn.
+                    type: string
+                  cancelRequestedAt:
+                    description: |-
+                      CancelRequestedAt records a durable cancellation request. Cancellation
+                      remains nonterminal until a terminal frame or ledger receipt is observed.
+                    format: date-time
                     type: string
                   contractVersion:
                     description: ContractVersion is the Orka harness contract version
                       used for the turn.
                     type: string
+                  controllerEpoch:
+                    description: ControllerEpoch records the fenced controller epoch
+                      driving the attempt.
+                    format: int64
+                    minimum: 0
+                    type: integer
                   endpoint:
                     description: Endpoint is the non-secret harness base URL selected
                       when the turn started.
                     type: string
+                  lastEventSeq:
+                    description: LastEventSeq is the highest durably mapped harness
+                      frame sequence.
+                    format: int64
+                    minimum: 0
+                    type: integer
+                  lastTransitionTime:
+                    description: |-
+                      LastTransitionTime is the last durable v1 attempt transition projected to
+                      the Task.
+                    format: date-time
+                    type: string
+                  message:
+                    description: Message is bounded, sanitized execution context.
+                    maxLength: 1024
+                    type: string
+                  outcome:
+                    description: Outcome is set only for a terminal harness v1 attempt.
+                    enum:
+                    - Succeeded
+                    - Failed
+                    - Cancelled
+                    - OutcomeUnknown
+                    type: string
+                  reason:
+                    description: Reason is a bounded machine-readable terminal reason
+                      code.
+                    maxLength: 256
+                    type: string
+                  requestDigest:
+                    description: |-
+                      RequestDigest binds the canonical StartTurn request admitted by the
+                      durable wrapper ledger.
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
                   runtimeGeneration:
                     description: RuntimeGeneration is the AgentRuntime generation
                       selected when the turn started.
                     format: int64
                     type: integer
                   runtimeName:
-                    description: RuntimeName is the runtime name advertised by the
-                      harness capabilities and sent in turn metadata.
+                    description: |-
+                      RuntimeName is the runtime name advertised by the harness capabilities
+                      and sent in turn metadata.
                     type: string
                   runtimeRefName:
-                    description: RuntimeRefName is the AgentRuntime name for custom
-                      runtimeRef turns. Empty means built-in CLI wrapper.
+                    description: |-
+                      RuntimeRefName is the AgentRuntime name for custom runtimeRef turns.
+                      Empty means built-in CLI wrapper.
+                    type: string
+                  runtimeSessionID:
+                    description: RuntimeSessionID is the deterministic, non-secret
+                      v1 runtime-session identity.
+                    type: string
+                  state:
+                    description: State is the durable harness v1 attempt state projected
+                      for operators.
+                    enum:
+                    - Queued
+                    - Reserved
+                    - SessionStarting
+                    - Planned
+                    - Submitting
+                    - SubmittedUnknown
+                    - Accepted
+                    - Running
+                    - Settling
+                    - Succeeded
+                    - Failed
+                    - Cancelled
+                    - OutcomeUnknown
+                    type: string
+                  terminalReceiptDigest:
+                    description: TerminalReceiptDigest identifies the authoritative
+                      terminal or unknown receipt.
+                    pattern: ^sha256:[a-f0-9]{64}$
+                    type: string
+                  turnID:
+                    description: TurnID is the deterministic, non-secret harness turn
+                      identity.
                     type: string
                 type: object
+                x-kubernetes-validations:
+                - message: terminal harness state requires an outcome
+                  rule: '!has(self.state) || !(self.state in [''Succeeded'', ''Failed'',
+                    ''Cancelled'', ''OutcomeUnknown'']) || has(self.outcome)'
+                - message: harness outcome requires a terminal state
+                  rule: '!has(self.outcome) || (has(self.state) && self.state in [''Succeeded'',
+                    ''Failed'', ''Cancelled'', ''OutcomeUnknown''])'
+                - message: OutcomeUnknown harness state requires OutcomeUnknown outcome
+                  rule: '!has(self.state) || self.state != ''OutcomeUnknown'' || (has(self.outcome)
+                    && self.outcome == ''OutcomeUnknown'')'
               iteration:
                 description: |-
                   Iteration is the current autonomous loop iteration (0-based).
@@ -2334,7 +3229,24 @@ spec:
             x-kubernetes-validations:
             - message: executionOutcome is immutable once recorded
               rule: '!has(oldSelf.executionOutcome) || self.executionOutcome == oldSelf.executionOutcome'
+            - message: agentExecutionBinding is write-once and immutable
+              rule: '!has(oldSelf.agentExecutionBinding) || (has(self.agentExecutionBinding)
+                && self.agentExecutionBinding == oldSelf.agentExecutionBinding)'
+            - message: a v1-bound Task cannot acquire new v2 execution or delivery
+                state
+              rule: '!has(self.agentExecutionBinding) || self.agentExecutionBinding.contractVersion
+                != ''orka.harness.v1'' || ((!has(self.execution) || (has(oldSelf.execution)
+                && self.execution == oldSelf.execution)) && (!has(self.delivery) ||
+                (has(oldSelf.delivery) && self.delivery == oldSelf.delivery)))'
+            - message: a v2-bound Task cannot acquire new v1 harness state
+              rule: '!has(self.agentExecutionBinding) || self.agentExecutionBinding.contractVersion
+                != ''orka.harness.v2'' || !has(self.harnessRuntime) || (has(oldSelf.harnessRuntime)
+                && self.harnessRuntime == oldSelf.harnessRuntime)'
         type: object
+        x-kubernetes-validations:
+        - message: Task spec is immutable after execution authority is recorded
+          rule: '!has(oldSelf.status) || (!has(oldSelf.status.agentExecutionBinding)
+            || self.spec == oldSelf.spec)'
     served: true
     storage: true
     subresources:
diff --git a/manifest_staging/charts/orka/crds/tool-customresourcedefinition.yaml b/manifest_staging/charts/orka/crds/tool-customresourcedefinition.yaml
index 76a2338a2..32981b5cb 100644
--- a/manifest_staging/charts/orka/crds/tool-customresourcedefinition.yaml
+++ b/manifest_staging/charts/orka/crds/tool-customresourcedefinition.yaml
@@ -125,7 +125,13 @@ spec:
                     - name
                     type: object
                   timeout:
-                    description: 'Timeout is the request timeout (default: 30s)'
+                    description: |-
+                      Timeout is the request timeout (default: 30s)
+                      Consequential (non-read) tools brokered to ACP runtimes execute under a
+                      fixed external-effect ledger lease; their timeout must stay at or below
+                      the controller's brokered call bound (currently four minutes). Longer
+                      timeouts are rejected when the tool is exposed to an ACP prompt, and
+                      brokered calls are always clamped to that bound at execution time.
                     type: string
                   url:
                     description: |-
diff --git a/manifest_staging/charts/orka/templates/NOTES.txt b/manifest_staging/charts/orka/templates/NOTES.txt
index 46f8b71ee..8bb052154 100644
--- a/manifest_staging/charts/orka/templates/NOTES.txt
+++ b/manifest_staging/charts/orka/templates/NOTES.txt
@@ -1,10 +1,10 @@
 Orka has been installed.
 
-Controller: {{ include "orka.fullname" . }}-controller
+Controller: {{ include "orka.controllerName" . }}
 Namespace:  {{ .Release.Namespace }}
 
 CRD lifecycle:
-  - A fresh install creates Orka's thirteen cluster-scoped CRDs unless --skip-crds is used.
+  - A fresh install creates Orka's 26 cluster-scoped CRDs unless --skip-crds is used.
   - Helm does not update CRDs during helm upgrade. Apply the CRDs from the exact
     target chart before upgrading the release.
   - helm uninstall retains the CRDs and all Orka custom resources.
@@ -15,7 +15,7 @@ Upgrade guidance: helm show readme <the same chart reference or archive>
 
 ⚠️  STORAGE WARNING: SQLite store is using ephemeral storage (emptyDir).
    Task results and session data will be LOST on pod restart.
-{{- if .Values.controller.gateway.enabled }}
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.controller.gateway.enabled }}
    Gateway acknowledgements, deduplication, and queued deliveries are also NOT durable.
 {{- end }}
    For production use, enable persistent storage:
@@ -25,7 +25,7 @@ Upgrade guidance: helm show readme <the same chart reference or archive>
 
 {{- else }}
 
-✅ SQLite store is using persistent storage (PVC: {{ include "orka.fullname" . }}-store).
+✅ SQLite store is using persistent storage (PVC: {{ include "orka.storeName" . }}).
    Data will survive pod restarts.
 
 {{- end }}
diff --git a/manifest_staging/charts/orka/templates/_helpers.tpl b/manifest_staging/charts/orka/templates/_helpers.tpl
index 7764f35bf..361e20266 100644
--- a/manifest_staging/charts/orka/templates/_helpers.tpl
+++ b/manifest_staging/charts/orka/templates/_helpers.tpl
@@ -79,30 +79,793 @@ suffix so long release names cannot collapse all trust tiers to one name.
 {{- end }}
 
 {{/*
-Create release-scoped harness-wrapper names while reserving room for suffixes
-that must remain valid DNS labels (notably the Service name).
+Create release-scoped harness v1 wrapper names while reserving room for the
+longest suffix so names remain valid DNS labels for long Helm release names.
 */}}
-{{- define "orka.harnessWrapperName" -}}
+{{- define "orka.harnessV1Name" -}}
 {{- printf "%s-agent-harness-wrapper" (include "orka.fullname" . | trunc 41 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
-{{- define "orka.harnessWrapperAuthSecretName" -}}
-{{- printf "%s-harness-wrapper-auth" (include "orka.fullname" . | trunc 42 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- define "orka.harnessV1LedgerName" -}}
+{{- printf "%s-harness-v1-ledger" (include "orka.fullname" . | trunc 45 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
+{{- define "orka.harnessV1DrainName" -}}
+{{- printf "%s-drain" (include "orka.harnessV1Name" . | trunc 57 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.harnessV1DrainEgressName" -}}
+{{- printf "%s-egress" (include "orka.harnessV1DrainName" . | trunc 56 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.harnessV1AbortName" -}}
+{{- printf "%s-abort" (include "orka.harnessV1Name" . | trunc 57 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.harnessV1AbortEgressName" -}}
+{{- printf "%s-egress" (include "orka.harnessV1AbortName" . | trunc 56 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.harnessV1DeleteDrainName" -}}
+{{- printf "%s-delete" (include "orka.harnessV1Name" . | trunc 56 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.harnessV1DeleteDrainEgressName" -}}
+{{- printf "%s-egress" (include "orka.harnessV1DeleteDrainName" . | trunc 56 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Render the complete harness v1 Pod template from one canonical helper. The
+ledger generation hashes this structure with a fixed sentinel in place of the
+generation itself, so only a real Pod-template change advances the generation.
+*/}}
+{{- define "orka.harnessV1PodTemplate" -}}
+{{- $root := .root -}}
+{{- $generation := .generation -}}
+metadata:
+  labels:
+    {{- include "orka.labels" $root | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper
+    orka.ai/network-role: harness-v1
+  {{- with $root.Values.harnessV1.tls.rolloutNonce }}
+  annotations:
+    orka.ai/harness-v1-tls-rollout-nonce: {{ . | quote }}
+  {{- end }}
+spec:
+  serviceAccountName: {{ include "orka.harnessV1Name" $root }}
+  automountServiceAccountToken: false
+  securityContext:
+    runAsUser: 0
+    runAsGroup: 0
+    seccompProfile:
+      type: RuntimeDefault
+  containers:
+    - name: wrapper
+      image: {{ include "orka.imageRef" $root.Values.harnessV1.image | quote }}
+      imagePullPolicy: {{ $root.Values.harnessV1.image.pullPolicy }}
+      ports:
+        - name: https
+          containerPort: 8080
+          protocol: TCP
+      env:
+        - name: ORKA_HARNESS_WRAPPER_RUNTIME
+          value: multi
+        - name: ORKA_HARNESS_WRAPPER_LISTEN_ADDR
+          value: :8080
+        - name: ORKA_CONTROLLER_URL
+          value: http://{{ include "orka.fullname" $root }}.{{ $root.Release.Namespace }}.svc:{{ $root.Values.service.port }}
+        - name: ORKA_HARNESS_WRAPPER_BEARER_TOKEN_FILE
+          value: /var/run/orka/harness-wrapper-auth/token
+        - name: ORKA_HARNESS_WRAPPER_TLS_CERT_FILE
+          value: /var/run/orka/harness-wrapper-tls/tls.crt
+        - name: ORKA_HARNESS_WRAPPER_TLS_KEY_FILE
+          value: /var/run/orka/harness-wrapper-tls/tls.key
+        - name: ORKA_HARNESS_WRAPPER_ADMISSION_LEDGER_PATH
+          value: /var/lib/orka/harness-v1/admission-ledger.db
+        - name: ORKA_HARNESS_WRAPPER_LEDGER_GENERATION
+          value: {{ $generation | quote }}
+        - name: ORKA_HARNESS_WRAPPER_LEDGER_RETENTION
+          value: {{ $root.Values.harnessV1.ledger.retention | quote }}
+        - name: ORKA_ALLOW_BASH
+          value: "true"
+        - name: ORKA_HARNESS_WRAPPER_CHILD_UID
+          value: "1000"
+        - name: ORKA_HARNESS_WRAPPER_CHILD_GID
+          value: "1000"
+        - name: ORKA_CODEX_SANDBOX_MODE
+          value: {{ $root.Values.harnessV1.codexSandboxMode | quote }}
+      volumeMounts:
+        - name: auth
+          mountPath: /var/run/orka/harness-wrapper-auth
+          readOnly: true
+        - name: tls
+          mountPath: /var/run/orka/harness-wrapper-tls
+          readOnly: true
+        - name: controller-api-token
+          mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+          readOnly: true
+        - name: ledger
+          mountPath: /var/lib/orka/harness-v1
+        - name: tmp
+          mountPath: /tmp
+      securityContext:
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+        runAsUser: 0
+        runAsGroup: 0
+        capabilities:
+          drop:
+            - ALL
+          add:
+            - SETUID
+            - SETGID
+            - CHOWN
+            - KILL
+            - FOWNER
+      livenessProbe:
+        httpGet:
+          path: /v1/health
+          port: https
+          scheme: HTTPS
+        initialDelaySeconds: 10
+        periodSeconds: 20
+      readinessProbe:
+        httpGet:
+          path: /v1/ready
+          port: https
+          scheme: HTTPS
+        initialDelaySeconds: 5
+        periodSeconds: 10
+      {{- with $root.Values.harnessV1.resources }}
+      resources:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+  volumes:
+    - name: auth
+      secret:
+        secretName: {{ $root.Values.harnessV1.auth.existingSecret | quote }}
+        defaultMode: 0400
+        items:
+          - key: {{ $root.Values.harnessV1.auth.tokenKey | quote }}
+            path: token
+    - name: tls
+      secret:
+        secretName: {{ $root.Values.harnessV1.tls.existingSecret | quote }}
+        defaultMode: 0400
+        items:
+          - key: tls.crt
+            path: tls.crt
+          - key: tls.key
+            path: tls.key
+          - key: ca.crt
+            path: ca.crt
+    - name: controller-api-token
+      projected:
+        defaultMode: 0400
+        sources:
+          - serviceAccountToken:
+              path: token
+              expirationSeconds: 3600
+    - name: ledger
+      persistentVolumeClaim:
+        claimName: {{ include "orka.harnessV1LedgerName" $root }}
+    - name: tmp
+      emptyDir: {}
+{{- end }}
+
+{{- define "orka.harnessV1PodTemplateGeneration" -}}
+{{- $template := include "orka.harnessV1PodTemplate" (dict "root" . "generation" "ORKA_HARNESS_V1_TEMPLATE_GENERATION") | fromYaml -}}
+{{- toJson $template | sha256sum -}}
+{{- end }}
+
+{{/* Read the live wrapper inputs used by rollover hooks. */}}
+{{- define "orka.harnessV1ExistingImage" -}}
+{{- $image := "" -}}
+{{- range (dig "spec" "template" "spec" "containers" (list) .) -}}
+{{- if eq (default "" .name) "wrapper" -}}
+{{- $image = default "" .image -}}
+{{- end -}}
+{{- end -}}
+{{- required "existing harness v1 wrapper Deployment is missing the wrapper image" $image -}}
+{{- end }}
+
+{{- define "orka.harnessV1ExistingImagePullPolicy" -}}
+{{- $pullPolicy := "IfNotPresent" -}}
+{{- range (dig "spec" "template" "spec" "containers" (list) .) -}}
+{{- if eq (default "" .name) "wrapper" -}}
+{{- $pullPolicy = default "IfNotPresent" .imagePullPolicy -}}
+{{- end -}}
+{{- end -}}
+{{- $pullPolicy -}}
+{{- end }}
+
+{{- define "orka.harnessV1ExistingGeneration" -}}
+{{- $generation := "" -}}
+{{- range (dig "spec" "template" "spec" "containers" (list) .) -}}
+{{- if eq (default "" .name) "wrapper" -}}
+{{- range (default (list) .env) -}}
+{{- if eq (default "" .name) "ORKA_HARNESS_WRAPPER_LEDGER_GENERATION" -}}
+{{- $generation = default "" .value -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- $generation -}}
+{{- end }}
+
+{{- define "orka.harnessV1ExistingAuthSecretName" -}}
+{{- $secretName := "" -}}
+{{- range (dig "spec" "template" "spec" "volumes" (list) .) -}}
+{{- if eq (default "" .name) "auth" -}}
+{{- $secretName = dig "secret" "secretName" "" . -}}
+{{- end -}}
+{{- end -}}
+{{- required "existing harness v1 wrapper Deployment is missing the auth Secret name" $secretName -}}
+{{- end }}
+
+{{- define "orka.harnessV1ExistingAuthSecretKey" -}}
+{{- $secretKey := "" -}}
+{{- range (dig "spec" "template" "spec" "volumes" (list) .) -}}
+{{- if eq (default "" .name) "auth" -}}
+{{- range (dig "secret" "items" (list) .) -}}
+{{- if eq (default "" .path) "token" -}}
+{{- $secretKey = default "" .key -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- required "existing harness v1 wrapper Deployment is missing the auth Secret token key" $secretKey -}}
+{{- end }}
+
+{{- define "orka.harnessV1ExistingTLSSecretName" -}}
+{{- $secretName := "" -}}
+{{- $legacyAuthSecretName := "" -}}
+{{- range (dig "spec" "template" "spec" "volumes" (list) .) -}}
+{{- if eq (default "" .name) "tls" -}}
+{{- $secretName = dig "secret" "secretName" "" . -}}
+{{- else if eq (default "" .name) "auth" -}}
+{{- $legacyAuthSecretName = dig "secret" "secretName" "" . -}}
+{{- end -}}
+{{- end -}}
+{{- if not $secretName -}}
+{{- $secretName = $legacyAuthSecretName -}}
+{{- end -}}
+{{- required "existing harness v1 wrapper Deployment is missing the TLS Secret name" $secretName -}}
+{{- end }}
+
+{{/* Read the live controller's exact namespace watch scope. */}}
+{{- define "orka.existingControllerWatchNamespace" -}}
+{{- $watchNamespaces := list -}}
+{{- range (dig "spec" "template" "spec" "containers" (list) .) -}}
+{{- if eq (default "" .name) "controller" -}}
+{{- range (default (list) .args) -}}
+{{- $arg := toString . -}}
+{{- if hasPrefix "--watch-namespace=" $arg -}}
+{{- $watchNamespaces = append $watchNamespaces (trimPrefix "--watch-namespace=" $arg) -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- if eq (len $watchNamespaces) 1 -}}
+{{- index $watchNamespaces 0 -}}
+{{- end -}}
+{{- end }}
+
+{{/* Read the exact chart fullname from the live controller's in-cluster URL. */}}
+{{- define "orka.existingControllerFullname" -}}
+{{- $fullnames := list -}}
+{{- $namespaceSuffix := printf ".%s.svc" .namespace -}}
+{{- range (dig "spec" "template" "spec" "containers" (list) .controller) -}}
+{{- if eq (default "" .name) "controller" -}}
+{{- range (default (list) .args) -}}
+{{- $arg := toString . -}}
+{{- if hasPrefix "--controller-url=http://" $arg -}}
+{{- $endpoint := trimPrefix "--controller-url=http://" $arg -}}
+{{- $hostPort := first (splitList "/" $endpoint) -}}
+{{- $host := first (splitList ":" $hostPort) -}}
+{{- if hasSuffix $namespaceSuffix $host -}}
+{{- $fullname := trimSuffix $namespaceSuffix $host -}}
+{{- if and $fullname (not (contains "." $fullname)) -}}
+{{- $fullnames = append $fullnames $fullname -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- if eq (len $fullnames) 1 -}}
+{{- index $fullnames 0 -}}
+{{- end -}}
+{{- end }}
+
+{{/* Read the live controller's exact ACP runtime namespace. */}}
+{{- define "orka.existingControllerACPRuntimeNamespace" -}}
+{{- $runtimeNamespaces := list -}}
+{{- range (dig "spec" "template" "spec" "containers" (list) .) -}}
+{{- if eq (default "" .name) "controller" -}}
+{{- range (default (list) .args) -}}
+{{- $arg := toString . -}}
+{{- if hasPrefix "--acp-runtime-namespace=" $arg -}}
+{{- $runtimeNamespaces = append $runtimeNamespaces (trimPrefix "--acp-runtime-namespace=" $arg) -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- if eq (len $runtimeNamespaces) 1 -}}
+{{- index $runtimeNamespaces 0 -}}
+{{- end -}}
+{{- end }}
+
+{{/* Read the live controller's exact static mode. Legacy controllers return empty. */}}
+{{- define "orka.existingControllerMode" -}}
+{{- $modes := list -}}
+{{- range (dig "spec" "template" "spec" "containers" (list) .) -}}
+{{- if eq (default "" .name) "controller" -}}
+{{- range (default (list) .args) -}}
+{{- $arg := toString . -}}
+{{- if hasPrefix "--controller-mode=" $arg -}}
+{{- $modes = append $modes (trimPrefix "--controller-mode=" $arg) -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- if eq (len $modes) 1 -}}
+{{- $mode := index $modes 0 -}}
+{{- if has $mode (list "harness-v1" "harness-v2") -}}
+{{- $mode -}}
+{{- end -}}
+{{- end -}}
+{{- end }}
+
+{{/* Read the live controller's exact agent-execution snapshot Secret name. */}}
+{{- define "orka.existingControllerAgentExecutionSnapshotSecretName" -}}
+{{- $volumes := list -}}
+{{- range (dig "spec" "template" "spec" "volumes" (list) .) -}}
+{{- if eq (default "" .name) "agent-execution-snapshot-key" -}}
+{{- $volumes = append $volumes . -}}
+{{- end -}}
+{{- end -}}
+{{- if eq (len $volumes) 1 -}}
+{{- dig "secret" "secretName" "" (index $volumes 0) -}}
+{{- end -}}
+{{- end }}
+
+{{/* Read the live controller's exact snapshot Secret item mounted as key. */}}
+{{- define "orka.existingControllerAgentExecutionSnapshotSecretKey" -}}
+{{- $volumes := list -}}
+{{- range (dig "spec" "template" "spec" "volumes" (list) .) -}}
+{{- if eq (default "" .name) "agent-execution-snapshot-key" -}}
+{{- $volumes = append $volumes . -}}
+{{- end -}}
+{{- end -}}
+{{- if eq (len $volumes) 1 -}}
+{{- $keys := list -}}
+{{- range (dig "secret" "items" (list) (index $volumes 0)) -}}
+{{- if eq (default "" .path) "key" -}}
+{{- $keys = append $keys (default "" .key) -}}
+{{- end -}}
+{{- end -}}
+{{- if eq (len $keys) 1 -}}
+{{- index $keys 0 -}}
+{{- end -}}
+{{- end -}}
+{{- end }}
+
+{{/* Read the live controller inputs used when the wrapper Deployment is absent. */}}
+{{- define "orka.harnessV1ExistingControllerState" -}}
+{{- $state := "" -}}
+{{- $mode := "" -}}
+{{- $harnessMarker := false -}}
+{{- $harnessEnabled := false -}}
+{{- $harnessDisabled := false -}}
+{{- $acpEnabled := false -}}
+{{- $acpDisabled := false -}}
+{{- $dualMarker := false -}}
+{{- range (dig "spec" "template" "spec" "containers" (list) .) -}}
+{{- if eq (default "" .name) "controller" -}}
+{{- range (default (list) .args) -}}
+{{- $arg := toString . -}}
+{{- if hasPrefix "--controller-mode=" $arg -}}
+{{- $mode = trimPrefix "--controller-mode=" $arg -}}
+{{- end -}}
+{{- if hasPrefix "--harness-v1-enabled=" $arg -}}
+{{- $harnessMarker = true -}}
+{{- end -}}
+{{- if eq $arg "--harness-v1-enabled=true" -}}
+{{- $harnessEnabled = true -}}
+{{- else if eq $arg "--harness-v1-enabled=false" -}}
+{{- $harnessDisabled = true -}}
+{{- else if eq $arg "--acp-runtime-enabled=true" -}}
+{{- $acpEnabled = true -}}
+{{- else if eq $arg "--acp-runtime-enabled=false" -}}
+{{- $acpDisabled = true -}}
+{{- else if hasPrefix "--agent-execution-" $arg -}}
+{{- $dualMarker = true -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- if eq $mode "harness-v1" -}}
+{{- $state = "enabled" -}}
+{{- else if eq $mode "harness-v2" -}}
+{{- $state = "disabled" -}}
+{{- else if and $harnessEnabled (not $harnessDisabled) -}}
+{{- $state = "enabled" -}}
+{{- else if and $harnessDisabled (not $harnessEnabled) -}}
+{{- $state = "disabled" -}}
+{{- else if and (not $harnessMarker) (not $dualMarker) (ne $acpEnabled $acpDisabled) -}}
+{{- $state = "legacy-v2-disabled" -}}
+{{- end -}}
+{{- $state -}}
+{{- end }}
+
+{{- define "orka.harnessV1ExistingControllerAuthSecretName" -}}
+{{- $secretName := "" -}}
+{{- $prefix := "--harness-v1-auth-secret-name=" -}}
+{{- range (dig "spec" "template" "spec" "containers" (list) .) -}}
+{{- if eq (default "" .name) "controller" -}}
+{{- range (default (list) .args) -}}
+{{- $arg := toString . -}}
+{{- if hasPrefix $prefix $arg -}}
+{{- $secretName = trimPrefix $prefix $arg -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- required "existing harness v1 controller Deployment is missing the auth Secret name" $secretName -}}
+{{- end }}
+
+{{- define "orka.harnessV1ExistingControllerAuthSecretKey" -}}
+{{- $secretKey := "" -}}
+{{- $prefix := "--harness-v1-auth-secret-key=" -}}
+{{- range (dig "spec" "template" "spec" "containers" (list) .) -}}
+{{- if eq (default "" .name) "controller" -}}
+{{- range (default (list) .args) -}}
+{{- $arg := toString . -}}
+{{- if hasPrefix $prefix $arg -}}
+{{- $secretKey = trimPrefix $prefix $arg -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- required "existing harness v1 controller Deployment is missing the auth Secret token key" $secretKey -}}
+{{- end }}
+
+{{- define "orka.controllerName" -}}
+{{- printf "%s-controller" (include "orka.fullname" . | trunc 52 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.controllerWebhookServiceName" -}}
+{{- printf "%s-webhook" (include "orka.fullname" . | trunc 55 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/* Keep legacy short names, but hash any identity controllerName truncates. */}}
+{{- define "orka.controllerWebhookName" -}}
+{{- $fullname := include "orka.fullname" . -}}
+{{- if le (len $fullname) 52 -}}
+{{- include "orka.controllerName" . -}}
+{{- else -}}
+{{- $identity := printf "%s/%s/%s/%s/%s" .Release.Namespace .Release.Name (default "" .Values.fullnameOverride) (default "" .Values.nameOverride) .Chart.Name -}}
+{{- printf "%s-controller-%s" ($fullname | trunc 39 | trimSuffix "-") (sha256sum $identity | trunc 12) | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end }}
+
+{{- define "orka.controllerClusterRoleName" -}}
+{{- printf "%s-cluster" (include "orka.controllerWebhookName" .) -}}
+{{- end }}
+
+{{- define "orka.controllerUsername" -}}
+{{- printf "system:serviceaccount:%s:%s" .Release.Namespace (include "orka.serviceAccountName" .) -}}
+{{- end }}
+
+{{- define "orka.publisherName" -}}
+{{- printf "%s-workspace-publisher" (include "orka.fullname" . | trunc 43 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.publisherAuthSecretName" -}}
+{{- printf "%s-workspace-publisher-auth" (include "orka.fullname" . | trunc 38 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.acpArtifactSecretName" -}}
+{{- printf "%s-acp-artifact-capability" (include "orka.fullname" . | trunc 39 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.providerProxyName" -}}
+{{- printf "%s-provider-auth-proxy" (include "orka.fullname" . | trunc 43 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.scmEgressProxyName" -}}
+{{- printf "%s-scm-egress-proxy" (include "orka.fullname" . | trunc 46 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.scmEgressProxyAuthSecretName" -}}
+{{- printf "%s-scm-egress-proxy-auth" (include "orka.fullname" . | trunc 41 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.storeName" -}}
+{{- printf "%s-store" (include "orka.fullname" . | trunc 57 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "orka.vekilIngressPolicyName" -}}
+{{- printf "%s-vekil-ingress" (include "orka.fullname" . | trunc 49 | trimSuffix "-") | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create the name of the workspace publisher ServiceAccount to use.
+*/}}
+{{- define "orka.publisherServiceAccountName" -}}
+{{- if .Values.publisher.serviceAccount.create }}
+{{- default (include "orka.publisherName" .) .Values.publisher.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.publisher.serviceAccount.name }}
+{{- end }}
+{{- end }}
 
 {{/*
-Create the namespace for the chart-managed client ServiceAccount.
-When namespace isolation is enforced and the controller watches one namespace,
-place the default client in that namespace so its token remains usable.
+Reject mutable ACP runtime image references when a provider image is configured.
+An empty provider image leaves that provider unavailable; Tasks still fail closed
+because the ACP runtime remains enabled and has no legacy fallback.
+*/}}
+{{- define "orka.validateACPRuntimeImage" -}}
+{{- $name := .name -}}
+{{- $ref := default "" .ref -}}
+{{- if and $ref (not (regexMatch "^.+@sha256:[0-9a-f]{64}$" $ref)) -}}
+{{- fail (printf "%s must be an immutable image reference ending in @sha256:<64 lowercase hex characters>; got %q" $name $ref) -}}
+{{- end -}}
+{{- end }}
+
+{{/*
+The chart-managed provider proxy is release-namespaced and its NetworkPolicies
+are intentionally pinned to the chart-supported Vekil Service.
+*/}}
+{{- define "orka.validateProviderProxyConfig" -}}
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.providerProxy.enabled -}}
+{{- $configuredNamespace := trim (default "" .Values.controller.acpRuntime.providerProxyNamespace) -}}
+{{- if and $configuredNamespace (ne $configuredNamespace .Release.Namespace) -}}
+{{- fail (printf "controller.acpRuntime.providerProxyNamespace must be empty or match the Helm release namespace %q when providerProxy.enabled=true" .Release.Namespace) -}}
+{{- end -}}
+{{- $upstream := trimSuffix "/" (trim (default "" .Values.providerProxy.upstreamBaseURL)) -}}
+{{- if ne $upstream "http://vekil.vekil-system.svc:1337" -}}
+{{- fail "providerProxy.upstreamBaseURL must be http://vekil.vekil-system.svc:1337 (an optional trailing slash is accepted)" -}}
+{{- end -}}
+{{- end -}}
+{{- end }}
+
+{{/*
+The controller uses a process-local SQLite store, so production deployments
+must have exactly one elected writer and must not overlap Pods during rollout.
+*/}}
+{{- define "orka.validateSQLiteController" -}}
+{{- if ne (int .Values.controller.replicas) 1 -}}
+{{- fail "controller.replicas must be exactly 1 when using the SQLite store backend" -}}
+{{- end -}}
+{{- if not .Values.controller.leaderElect -}}
+{{- fail "controller.leaderElect must be true when using the SQLite store backend" -}}
+{{- end -}}
+{{- end }}
+
+{{/*
+Every release owns exactly one immutable execution contract and one tenant
+namespace. There is no dual, automatic, or drain controller mode.
+*/}}
+{{- define "orka.validateControllerMode" -}}
+{{- if not (has .Values.controller.mode (list "harness-v1" "harness-v2")) -}}
+{{- fail "controller.mode must be harness-v1 or harness-v2" -}}
+{{- end -}}
+{{- if not (trim (default "" .Values.controller.watchNamespace)) -}}
+{{- fail "controller.watchNamespace is required for an isolated controller installation" -}}
+{{- end -}}
+{{- if ne .Values.controller.watchNamespace .Release.Namespace -}}
+{{- fail (printf "controller.watchNamespace must equal the Helm release namespace %q" .Release.Namespace) -}}
+{{- end -}}
+{{- if not .Values.controller.leaderElect -}}
+{{- fail "controller.leaderElect must be true for an isolated controller installation" -}}
+{{- end -}}
+{{- if .Release.IsUpgrade -}}
+{{- $existingNamespace := lookup "v1" "Namespace" "" .Release.Namespace -}}
+{{- $existingNamespaceMode := "" -}}
+{{- if $existingNamespace -}}
+{{- $existingNamespaceMode = dig "metadata" "labels" "orka.ai/controller-mode" "" $existingNamespace -}}
+{{- end -}}
+{{- if ne $existingNamespaceMode .Values.controller.mode -}}
+{{- fail (printf "controller mode identity is missing or incompatible; namespace %q must already claim orka.ai/controller-mode=%s before this release can be upgraded" .Release.Namespace .Values.controller.mode) -}}
+{{- end -}}
+{{- $root := . -}}
+{{- $existingControllerList := lookup "apps/v1" "Deployment" .Release.Namespace "" -}}
+{{- $existingControllers := list -}}
+{{- range (dig "items" (list) (default (dict) $existingControllerList)) -}}
+{{- $labels := dig "metadata" "labels" (dict) . -}}
+{{- if and (eq (get $labels "app.kubernetes.io/instance") $root.Release.Name) (eq (get $labels "app.kubernetes.io/component") "controller") (eq (get $labels "app.kubernetes.io/managed-by") $root.Release.Service) -}}
+{{- $existingControllers = append $existingControllers . -}}
+{{- end -}}
+{{- end -}}
+{{- if gt (len $existingControllers) 1 -}}
+{{- fail (printf "multiple controller Deployments are owned by Helm release %q in namespace %q; restore a single controller before upgrading" .Release.Name .Release.Namespace) -}}
+{{- end -}}
+{{- $existingController := dict -}}
+{{- if eq (len $existingControllers) 1 -}}
+{{- $existingController = index $existingControllers 0 -}}
+{{- end -}}
+{{- if $existingController -}}
+{{- $existingWatchNamespace := include "orka.existingControllerWatchNamespace" $existingController | trim -}}
+{{- if ne $existingWatchNamespace .Values.controller.watchNamespace -}}
+{{- fail (printf "controller.watchNamespace is immutable; the existing controller must already watch namespace %q; install cluster-wide or differently scoped controllers as a new release and namespace" .Values.controller.watchNamespace) -}}
+{{- end -}}
+{{- $existingMode := include "orka.existingControllerMode" $existingController | trim -}}
+{{- $existingState := include "orka.harnessV1ExistingControllerState" $existingController | trim -}}
+{{- if $existingMode -}}
+{{- if ne $existingMode .Values.controller.mode -}}
+{{- fail (printf "controller.mode is immutable; install %s as a new release and namespace" .Values.controller.mode) -}}
+{{- end -}}
+{{- else if eq .Values.controller.mode "harness-v2" -}}
+{{- fail "implicit or legacy harness-v2 installations cannot upgrade in place; settle or retire the existing installation and install harness-v2 as a new release and namespace" -}}
+{{- else if ne $existingState "enabled" -}}
+{{- fail "controller.mode is immutable; install harness-v1 as a new release and namespace" -}}
+{{- end -}}
+{{- $existingSnapshotSecret := include "orka.existingControllerAgentExecutionSnapshotSecretName" $existingController | trim -}}
+{{- if not $existingSnapshotSecret -}}
+{{- fail "cannot determine the existing agent execution snapshot Secret name from the live controller; restore its exact agent-execution-snapshot-key volume before upgrading" -}}
+{{- end -}}
+{{- $desiredSnapshotSecret := trim (default "" .Values.controller.agentExecutionSnapshot.existingSecret) -}}
+{{- if ne $existingSnapshotSecret $desiredSnapshotSecret -}}
+{{- fail (printf "controller.agentExecutionSnapshot.existingSecret is immutable for in-place upgrades; preserve %q so retained encrypted execution snapshots remain decryptable" $existingSnapshotSecret) -}}
+{{- end -}}
+{{- $existingSnapshotKey := include "orka.existingControllerAgentExecutionSnapshotSecretKey" $existingController | trim -}}
+{{- if not $existingSnapshotKey -}}
+{{- fail "cannot determine the existing agent execution snapshot Secret key from the live controller; restore its exact item mounted at path key before upgrading" -}}
+{{- end -}}
+{{- $desiredSnapshotKey := trim (default "" .Values.controller.agentExecutionSnapshot.key) -}}
+{{- if ne $existingSnapshotKey $desiredSnapshotKey -}}
+{{- fail (printf "controller.agentExecutionSnapshot.key is immutable for in-place upgrades; preserve %q so retained encrypted execution snapshots remain decryptable" $existingSnapshotKey) -}}
+{{- end -}}
+{{- if eq .Values.controller.mode "harness-v2" -}}
+{{- $existingFullname := include "orka.existingControllerFullname" (dict "controller" $existingController "namespace" .Release.Namespace) | trim -}}
+{{- if not $existingFullname -}}
+{{- fail "cannot determine the existing harness-v2 chart fullname from the live controller; restore its exact --controller-url argument before upgrading" -}}
+{{- end -}}
+{{- $desiredFullname := include "orka.fullname" . -}}
+{{- if ne $existingFullname $desiredFullname -}}
+{{- fail (printf "the effective chart fullname is immutable for harness-v2 upgrades; the existing controller uses %q, but this upgrade would use %q" $existingFullname $desiredFullname) -}}
+{{- end -}}
+{{- $existingRuntimeNamespace := include "orka.existingControllerACPRuntimeNamespace" $existingController | trim -}}
+{{- if not $existingRuntimeNamespace -}}
+{{- fail "cannot determine the existing harness-v2 ACP runtime namespace; restore its exact --acp-runtime-namespace argument before upgrading" -}}
+{{- end -}}
+{{- if ne $existingRuntimeNamespace .Values.controller.acpRuntime.namespace -}}
+{{- fail (printf "controller.acpRuntime.namespace is immutable; the existing controller uses namespace %q" $existingRuntimeNamespace) -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- $clientNamespace := trim (default "" .Values.client.namespace) -}}
+{{- if and $clientNamespace (ne $clientNamespace .Values.controller.watchNamespace) -}}
+{{- fail "client.namespace must be empty or match controller.watchNamespace" -}}
+{{- end -}}
+{{- if eq .Values.controller.mode "harness-v2" -}}
+{{- if not (trim (default "" .Values.controller.acpRuntime.namespace)) -}}
+{{- fail "controller.acpRuntime.namespace is required when controller.mode=harness-v2" -}}
+{{- end -}}
+{{- if eq .Values.controller.acpRuntime.namespace .Release.Namespace -}}
+{{- fail "controller.acpRuntime.namespace must differ from the release namespace" -}}
+{{- end -}}
+{{- end -}}
+{{- end }}
+
+{{/*
+Agent execution snapshots contain sensitive resolved inputs. When either
+agent protocol is enabled, require an operator-managed Secret for their
+encryption key rather than generating or storing the key in Helm values.
+*/}}
+{{- define "orka.validateAgentExecutionSnapshot" -}}
+{{- if not (trim (default "" .Values.controller.agentExecutionSnapshot.existingSecret)) -}}
+{{- fail "controller.agentExecutionSnapshot.existingSecret is required when agent execution is enabled" -}}
+{{- end -}}
+{{- if not (trim (default "" .Values.controller.agentExecutionSnapshot.key)) -}}
+{{- fail "controller.agentExecutionSnapshot.key is required when agent execution is enabled" -}}
+{{- end -}}
+{{- end }}
+
+{{/*
+The release-local controller serves its own fail-closed webhooks. Its
+certificate and CA trust are always operator-managed.
+*/}}
+{{- define "orka.validateWebhooks" -}}
+{{- if not (trim (default "" .Values.webhooks.tls.existingSecret)) -}}
+{{- fail "webhooks.tls.existingSecret is required" -}}
+{{- end -}}
+{{- if not (trim (default "" .Values.webhooks.tls.certKey)) -}}
+{{- fail "webhooks.tls.certKey is required" -}}
+{{- end -}}
+{{- if not (trim (default "" .Values.webhooks.tls.privateKeyKey)) -}}
+{{- fail "webhooks.tls.privateKeyKey is required" -}}
+{{- end -}}
+{{- if and (not (trim (default "" .Values.webhooks.caBundle))) (empty .Values.webhooks.caInjectionAnnotations) -}}
+{{- fail "webhooks requires a nonempty caBundle or caInjectionAnnotations" -}}
+{{- end -}}
+{{- if or (lt (int .Values.webhooks.timeoutSeconds) 1) (gt (int .Values.webhooks.timeoutSeconds) 30) -}}
+{{- fail "webhooks.timeoutSeconds must be between 1 and 30" -}}
+{{- end -}}
+{{- end }}
+
+{{/*
+Harness v1 is an explicitly selected compatibility data plane. Its image must
+be immutable, its admission ledger durable, and its bearer credential must
+remain outside rendered Helm manifests.
+*/}}
+{{- define "orka.validateHarnessV1" -}}
+{{- if eq .Values.controller.mode "harness-v1" -}}
+{{- if .Values.controller.agentSandbox.enabled -}}
+{{- fail "controller.agentSandbox.enabled is unsupported when controller.mode=harness-v1; Agent Sandbox requires harness-v2" -}}
+{{- end -}}
+{{- if .Values.controller.substrate.enabled -}}
+{{- fail "controller.substrate.enabled is unsupported when controller.mode=harness-v1; Substrate requires harness-v2" -}}
+{{- end -}}
+{{- if not (trim (default "" .Values.harnessV1.image.repository)) -}}
+{{- fail "harnessV1.image.repository is required when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if not (regexMatch "^sha256:[0-9a-f]{64}$" (.Values.harnessV1.image.digest | default "")) -}}
+{{- fail "harnessV1.image.digest must be a sha256 digest when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if trim (default "" .Values.harnessV1.auth.token) -}}
+{{- fail "harnessV1.auth.token is unsupported; create a Kubernetes Secret and set harnessV1.auth.existingSecret" -}}
+{{- end -}}
+{{- if not (trim (default "" .Values.harnessV1.auth.existingSecret)) -}}
+{{- fail "harnessV1.auth.existingSecret is required when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if not (trim (default "" .Values.harnessV1.auth.tokenKey)) -}}
+{{- fail "harnessV1.auth.tokenKey is required when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if not (trim (default "" .Values.harnessV1.tls.existingSecret)) -}}
+{{- fail "harnessV1.tls.existingSecret is required when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if eq (trim .Values.harnessV1.auth.existingSecret) (trim .Values.harnessV1.tls.existingSecret) -}}
+{{- fail "harnessV1.tls.existingSecret must differ from harnessV1.auth.existingSecret" -}}
+{{- end -}}
+{{- if not (trim (default "" .Values.harnessV1.ledger.size)) -}}
+{{- fail "harnessV1.ledger.size is required when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if not (trim (default "" .Values.harnessV1.ledger.retention)) -}}
+{{- fail "harnessV1.ledger.retention is required when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if not (regexMatch "^([1-9][0-9]*(ns|us|µs|ms|s|m|h))+$" (trim (default "" .Values.harnessV1.ledger.retention))) -}}
+{{- fail "harnessV1.ledger.retention must be a positive Go duration when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if not .Values.store.persistence.enabled -}}
+{{- fail "store.persistence.enabled must be true when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if not (trim (default "" .Values.harnessV1.dispatch.interval)) -}}
+{{- fail "harnessV1.dispatch.interval is required when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if ne (int .Values.harnessV1.dispatch.workers) 1 -}}
+{{- fail "harnessV1.dispatch.workers must be exactly 1 when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if not (regexMatch "^([1-9][0-9]*(ns|us|µs|ms|s|m|h))+$" (trim (default "" .Values.harnessV1.upgradeDrain.timeout))) -}}
+{{- fail "harnessV1.upgradeDrain.timeout must be a positive Go duration when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- if not (regexMatch "^([1-9][0-9]*(ns|us|µs|ms|s|m|h))+$" (trim (default "" .Values.harnessV1.upgradeDrain.pollInterval))) -}}
+{{- fail "harnessV1.upgradeDrain.pollInterval must be a positive Go duration when controller.mode=harness-v1" -}}
+{{- end -}}
+{{- $sandboxMode := trim (default "" .Values.harnessV1.codexSandboxMode) -}}
+{{- if and $sandboxMode (not (has $sandboxMode (list "read-only" "workspace-write" "danger-full-access"))) -}}
+{{- fail "harnessV1.codexSandboxMode must be read-only, workspace-write, or danger-full-access" -}}
+{{- end -}}
+{{- end -}}
+{{- end }}
+
+{{- define "orka.providerProxyUpstreamBaseURL" -}}
+{{- trimSuffix "/" (trim (default "" .Values.providerProxy.upstreamBaseURL)) -}}
+{{- end }}
+
+
+{{/*
+Create the namespace for the chart-managed client ServiceAccount. Static
+installations always place the client in the watched namespace.
 */}}
 {{- define "orka.clientNamespace" -}}
 {{- if .Values.client.namespace }}
 {{- .Values.client.namespace }}
-{{- else if and .Values.controller.enforceNamespaceIsolation .Values.controller.watchNamespace }}
-{{- .Values.controller.watchNamespace }}
 {{- else }}
-{{- .Release.Namespace }}
+{{- .Values.controller.watchNamespace }}
 {{- end }}
 {{- end }}
 
@@ -122,16 +885,25 @@ Create release-scoped worker ClusterRole names.
 {{- end }}
 
 {{/*
-Create release-scoped static worker ClusterRoleBinding names.
+Create release-scoped static worker RoleBinding names.
 */}}
-{{- define "orka.aiWorkerClusterRoleBindingName" -}}
+{{- define "orka.aiWorkerRoleBindingName" -}}
 {{- printf "%s-ai-worker-rolebinding" (include "orka.fullname" .) | trunc 253 | trimSuffix "-" }}
 {{- end }}
 
-{{- define "orka.vendorWorkerClusterRoleBindingName" -}}
+{{- define "orka.vendorWorkerRoleBindingName" -}}
 {{- printf "%s-vendor-worker-rolebinding" (include "orka.fullname" .) | trunc 253 | trimSuffix "-" }}
 {{- end }}
 
-{{- define "orka.containerWorkerClusterRoleBindingName" -}}
+{{- define "orka.containerWorkerRoleBindingName" -}}
 {{- printf "%s-container-worker-rolebinding" (include "orka.fullname" .) | trunc 253 | trimSuffix "-" }}
 {{- end }}
+
+{{/* Render repository@digest when an immutable digest is configured. */}}
+{{- define "orka.imageRef" -}}
+{{- if .digest -}}
+{{ printf "%s@%s" .repository .digest }}
+{{- else -}}
+{{ printf "%s:%s" .repository .tag }}
+{{- end -}}
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/acp-artifact-secret.yaml b/manifest_staging/charts/orka/templates/acp-artifact-secret.yaml
new file mode 100644
index 000000000..49343eb1a
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/acp-artifact-secret.yaml
@@ -0,0 +1,19 @@
+{{- if and (eq .Values.controller.mode "harness-v2") (not .Values.controller.acpArtifact.existingSecret) }}
+{{- $secretName := include "orka.acpArtifactSecretName" . }}
+{{- $secretKey := .Values.controller.acpArtifact.secretKey | default "capability-secret" }}
+{{- $existing := lookup "v1" "Secret" .Release.Namespace $secretName }}
+{{- $existingValue := "" }}
+{{- if and $existing (hasKey $existing.data $secretKey) }}
+{{- $existingValue = (index $existing.data $secretKey | b64dec) }}
+{{- end }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $secretName }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: acp-artifact-api
+type: Opaque
+stringData:
+  {{ $secretKey }}: {{ default (default (randAlphaNum 64) $existingValue) .Values.controller.acpArtifact.secret | quote }}
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/admission-deployment.yaml b/manifest_staging/charts/orka/templates/admission-deployment.yaml
new file mode 100644
index 000000000..1d81ba4fd
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/admission-deployment.yaml
@@ -0,0 +1,4 @@
+{{/*
+The dedicated chart deployment was retired. Static releases serve their
+mode-scoped validation endpoints from the release-local controller.
+*/}}
diff --git a/manifest_staging/charts/orka/templates/controller-validating-webhook.yaml b/manifest_staging/charts/orka/templates/controller-validating-webhook.yaml
new file mode 100644
index 000000000..13472d206
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/controller-validating-webhook.yaml
@@ -0,0 +1,191 @@
+{{- include "orka.validateControllerMode" . }}
+{{- include "orka.validateWebhooks" . }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: {{ include "orka.controllerWebhookName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: controller
+  {{- with .Values.webhooks.caInjectionAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+webhooks:
+  - name: namespace-mode.{{ .Values.controller.mode }}.orka.ai
+    admissionReviewVersions: [v1]
+    sideEffects: None
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    timeoutSeconds: {{ .Values.webhooks.timeoutSeconds }}
+    clientConfig:
+      service:
+        name: {{ include "orka.controllerWebhookServiceName" . }}
+        namespace: {{ .Release.Namespace }}
+        path: /validate-v1-namespace-execution-mode
+        port: 443
+      {{- with .Values.webhooks.caBundle }}
+      caBundle: {{ . | quote }}
+      {{- end }}
+    rules:
+      - operations: [CREATE, UPDATE]
+        apiGroups: [""]
+        apiVersions: [v1]
+        resources: [namespaces]
+        scope: Cluster
+    objectSelector:
+      matchLabels:
+        orka.ai/controller-mode: {{ .Values.controller.mode | quote }}
+        kubernetes.io/metadata.name: {{ .Release.Namespace | quote }}
+  - name: task-provenance.{{ .Values.controller.mode }}.orka.ai
+    admissionReviewVersions: [v1]
+    sideEffects: None
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    timeoutSeconds: {{ .Values.webhooks.timeoutSeconds }}
+    clientConfig:
+      service:
+        name: {{ include "orka.controllerWebhookServiceName" . }}
+        namespace: {{ .Release.Namespace }}
+        path: /validate-core-orka-ai-v1alpha1-task-provenance
+        port: 443
+      {{- with .Values.webhooks.caBundle }}
+      caBundle: {{ . | quote }}
+      {{- end }}
+    rules:
+      - operations: [CREATE, UPDATE]
+        apiGroups: [core.orka.ai]
+        apiVersions: [v1alpha1]
+        resources: [tasks]
+        scope: Namespaced
+    namespaceSelector:
+      matchLabels:
+        orka.ai/controller-mode: {{ .Values.controller.mode | quote }}
+        kubernetes.io/metadata.name: {{ .Release.Namespace | quote }}
+  {{- if eq .Values.controller.mode "harness-v2" }}
+  - name: task-workspace-class.{{ .Values.controller.mode }}.orka.ai
+    admissionReviewVersions: [v1]
+    sideEffects: None
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    timeoutSeconds: {{ .Values.webhooks.timeoutSeconds }}
+    clientConfig:
+      service:
+        name: {{ include "orka.controllerWebhookServiceName" . }}
+        namespace: {{ .Release.Namespace }}
+        path: /validate-core-orka-ai-v1alpha1-task-workspace-class-use
+        port: 443
+      {{- with .Values.webhooks.caBundle }}
+      caBundle: {{ . | quote }}
+      {{- end }}
+    rules:
+      - operations: [CREATE, UPDATE]
+        apiGroups: [core.orka.ai]
+        apiVersions: [v1alpha1]
+        resources: [tasks]
+        scope: Namespaced
+    namespaceSelector:
+      matchLabels:
+        orka.ai/controller-mode: {{ .Values.controller.mode | quote }}
+        kubernetes.io/metadata.name: {{ .Release.Namespace | quote }}
+  - name: tool-workspace-class.{{ .Values.controller.mode }}.orka.ai
+    admissionReviewVersions: [v1]
+    sideEffects: None
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    timeoutSeconds: {{ .Values.webhooks.timeoutSeconds }}
+    clientConfig:
+      service:
+        name: {{ include "orka.controllerWebhookServiceName" . }}
+        namespace: {{ .Release.Namespace }}
+        path: /validate-core-orka-ai-v1alpha1-tool-workspace-class-use
+        port: 443
+      {{- with .Values.webhooks.caBundle }}
+      caBundle: {{ . | quote }}
+      {{- end }}
+    rules:
+      - operations: [CREATE, UPDATE]
+        apiGroups: [core.orka.ai]
+        apiVersions: [v1alpha1]
+        resources: [tools]
+        scope: Namespaced
+    namespaceSelector:
+      matchLabels:
+        orka.ai/controller-mode: {{ .Values.controller.mode | quote }}
+        kubernetes.io/metadata.name: {{ .Release.Namespace | quote }}
+  {{- end }}
+  - name: agent-contract.{{ .Values.controller.mode }}.orka.ai
+    admissionReviewVersions: [v1]
+    sideEffects: None
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    timeoutSeconds: {{ .Values.webhooks.timeoutSeconds }}
+    clientConfig:
+      service:
+        name: {{ include "orka.controllerWebhookServiceName" . }}
+        namespace: {{ .Release.Namespace }}
+        path: /validate-core-orka-ai-v1alpha1-agent-contract
+        port: 443
+      {{- with .Values.webhooks.caBundle }}
+      caBundle: {{ . | quote }}
+      {{- end }}
+    rules:
+      - operations: [CREATE, UPDATE]
+        apiGroups: [core.orka.ai]
+        apiVersions: [v1alpha1]
+        resources: [agents]
+        scope: Namespaced
+    namespaceSelector:
+      matchLabels:
+        orka.ai/controller-mode: {{ .Values.controller.mode | quote }}
+        kubernetes.io/metadata.name: {{ .Release.Namespace | quote }}
+  - name: agentruntime-contract.{{ .Values.controller.mode }}.orka.ai
+    admissionReviewVersions: [v1]
+    sideEffects: None
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    timeoutSeconds: {{ .Values.webhooks.timeoutSeconds }}
+    clientConfig:
+      service:
+        name: {{ include "orka.controllerWebhookServiceName" . }}
+        namespace: {{ .Release.Namespace }}
+        path: /validate-core-orka-ai-v1alpha1-agentruntime-contract
+        port: 443
+      {{- with .Values.webhooks.caBundle }}
+      caBundle: {{ . | quote }}
+      {{- end }}
+    rules:
+      - operations: [CREATE, UPDATE]
+        apiGroups: [core.orka.ai]
+        apiVersions: [v1alpha1]
+        resources: [agentruntimes]
+        scope: Namespaced
+    namespaceSelector:
+      matchLabels:
+        orka.ai/controller-mode: {{ .Values.controller.mode | quote }}
+        kubernetes.io/metadata.name: {{ .Release.Namespace | quote }}
+  - name: task-execution-authority.{{ .Values.controller.mode }}.orka.ai
+    admissionReviewVersions: [v1]
+    sideEffects: None
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    timeoutSeconds: {{ .Values.webhooks.timeoutSeconds }}
+    clientConfig:
+      service:
+        name: {{ include "orka.controllerWebhookServiceName" . }}
+        namespace: {{ .Release.Namespace }}
+        path: /validate-core-orka-ai-v1alpha1-task-execution-authority
+        port: 443
+      {{- with .Values.webhooks.caBundle }}
+      caBundle: {{ . | quote }}
+      {{- end }}
+    rules:
+      - operations: [CREATE, UPDATE]
+        apiGroups: [core.orka.ai]
+        apiVersions: [v1alpha1]
+        resources: [tasks, tasks/status]
+        scope: Namespaced
+    namespaceSelector:
+      matchLabels:
+        orka.ai/controller-mode: {{ .Values.controller.mode | quote }}
+        kubernetes.io/metadata.name: {{ .Release.Namespace | quote }}
diff --git a/manifest_staging/charts/orka/templates/controller-webhook-service.yaml b/manifest_staging/charts/orka/templates/controller-webhook-service.yaml
new file mode 100644
index 000000000..19f96695e
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/controller-webhook-service.yaml
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "orka.controllerWebhookServiceName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: controller
+spec:
+  type: ClusterIP
+  ports:
+    - port: 443
+      targetPort: webhook
+      protocol: TCP
+      name: webhook
+  selector:
+    {{- include "orka.selectorLabels" . | nindent 4 }}
+    app.kubernetes.io/component: controller
diff --git a/manifest_staging/charts/orka/templates/deployment.yaml b/manifest_staging/charts/orka/templates/deployment.yaml
index 31ef45c6e..c535e6021 100644
--- a/manifest_staging/charts/orka/templates/deployment.yaml
+++ b/manifest_staging/charts/orka/templates/deployment.yaml
@@ -1,15 +1,33 @@
-{{- if and .Values.controller.workspaceProvider.fakeProviderEnabled (not .Values.controller.workspaceProvider.apiEnabled) -}}
-{{- fail "controller.workspaceProvider.fakeProviderEnabled requires controller.workspaceProvider.apiEnabled" -}}
-{{- end -}}
-{{- if and .Values.controller.workspaceProvider.apiEnabled (not .Values.controller.workspaceProvider.classUseAdmission.enabled) -}}
-{{- fail "controller.workspaceProvider.apiEnabled requires controller.workspaceProvider.classUseAdmission.enabled" -}}
-{{- end -}}
-{{- if .Values.controller.workspaceProvider.classUseAdmission.enabled -}}
-{{- $workspaceWebhookSecret := required "controller.workspaceProvider.classUseAdmission.existingSecret is required when class-use admission is enabled" .Values.controller.workspaceProvider.classUseAdmission.existingSecret -}}
-{{- $workspaceWebhookCA := required "controller.workspaceProvider.classUseAdmission.caBundle is required when class-use admission is enabled" .Values.controller.workspaceProvider.classUseAdmission.caBundle -}}
-{{- end -}}
+{{- $harnessV1 := eq .Values.controller.mode "harness-v1" -}}
+{{- $harnessV2 := eq .Values.controller.mode "harness-v2" -}}
+{{- include "orka.validateControllerMode" . }}
+{{- include "orka.validateProviderProxyConfig" . }}
+{{- include "orka.validateSQLiteController" . }}
+{{- include "orka.validateAgentExecutionSnapshot" . }}
+{{- include "orka.validateWebhooks" . }}
+{{- if not (regexMatch "^sha256:[0-9a-f]{64}$" (.Values.controller.image.digest | default "")) }}
+{{- fail "controller.image.digest must be a sha256 digest" }}
+{{- end }}
+{{- if $harnessV2 }}
+{{- if not (regexMatch "^sha256:[0-9a-f]{64}$" (.Values.controller.image.digest | default "")) }}
+{{- fail "controller.image.digest must be a sha256 digest when controller.mode=harness-v2" }}
+{{- end }}
+{{- if or (not .Values.publisher.enabled) (not (regexMatch "^sha256:[0-9a-f]{64}$" (.Values.publisher.image.digest | default ""))) }}
+{{- fail "publisher must be enabled with publisher.image.digest set when controller.mode=harness-v2" }}
+{{- end }}
+{{- if not .Values.store.persistence.enabled }}
+{{- fail "store.persistence.enabled must be true when controller.mode=harness-v2" }}
+{{- end }}
+{{- include "orka.validateACPRuntimeImage" (dict "name" "controller.acpRuntime.codexImage" "ref" .Values.controller.acpRuntime.codexImage) }}
+{{- include "orka.validateACPRuntimeImage" (dict "name" "controller.acpRuntime.claudeImage" "ref" .Values.controller.acpRuntime.claudeImage) }}
+{{- include "orka.validateACPRuntimeImage" (dict "name" "controller.acpRuntime.copilotImage" "ref" .Values.controller.acpRuntime.copilotImage) }}
+{{- include "orka.validateACPRuntimeImage" (dict "name" "controller.acpRuntime.opencodeImage" "ref" .Values.controller.acpRuntime.opencodeImage) }}
+{{- if not .Values.providerProxy.enabled }}
+{{- fail "providerProxy.enabled must be true when controller.mode=harness-v2" }}
+{{- end }}
+{{- end }}
 {{- $gatewayCRDsReady := false -}}
-{{- if and .Values.controller.gateway.enabled (not .Values.controller.gateway.crdsReadyOverride) -}}
+{{- if and $harnessV2 .Values.controller.gateway.enabled (not .Values.controller.gateway.crdsReadyOverride) -}}
 {{- $gatewayClassCRD := lookup "apiextensions.k8s.io/v1" "CustomResourceDefinition" "" "gatewayclasses.gateway.orka.ai" -}}
 {{- $gatewayCRD := lookup "apiextensions.k8s.io/v1" "CustomResourceDefinition" "" "gateways.gateway.orka.ai" -}}
 {{- $gatewayBindingCRD := lookup "apiextensions.k8s.io/v1" "CustomResourceDefinition" "" "gatewaybindings.gateway.orka.ai" -}}
@@ -20,23 +38,21 @@
 {{- end -}}
 {{- $gatewayCRDsReady = and (not (empty $gatewayClassCRD)) (not (empty $gatewayCRD)) (not (empty $gatewayBindingCRD)) $taskSchemaReady -}}
 {{- end -}}
-{{- $gatewayRuntimeEnabled := and .Values.controller.gateway.enabled (or .Values.controller.gateway.crdsReadyOverride $gatewayCRDsReady) -}}
+{{- $gatewayRuntimeEnabled := and $harnessV2 .Values.controller.gateway.enabled (or .Values.controller.gateway.crdsReadyOverride $gatewayCRDsReady) -}}
 {{- if and $gatewayRuntimeEnabled (not .Values.store.persistence.enabled) (not .Values.controller.gateway.allowEphemeralStore) -}}
 {{- fail "controller.gateway.enabled requires store.persistence.enabled=true; set controller.gateway.allowEphemeralStore=true only for disposable development" -}}
 {{- end -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "orka.fullname" . }}-controller
+  name: {{ include "orka.controllerName" . }}
   labels:
     {{- include "orka.labels" . | nindent 4 }}
     app.kubernetes.io/component: controller
 spec:
   replicas: {{ .Values.controller.replicas }}
-  {{- if .Values.store.persistence.enabled }}
   strategy:
     type: Recreate
-  {{- end }}
   selector:
     matchLabels:
       {{- include "orka.selectorLabels" . | nindent 6 }}
@@ -46,9 +62,18 @@ spec:
       labels:
         {{- include "orka.selectorLabels" . | nindent 8 }}
         app.kubernetes.io/component: controller
-      {{- with .Values.annotations }}
+        orka.ai/network-role: controller
+      {{- if or .Values.annotations (and $harnessV2 .Values.publisher.auth.rolloutNonce) (and $harnessV1 .Values.harnessV1.tls.rolloutNonce) }}
       annotations:
+        {{- with .Values.annotations }}
         {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.publisher.auth.rolloutNonce }}
+        orka.ai/publisher-auth-rollout-nonce: {{ . | quote }}
+        {{- end }}
+        {{- with .Values.harnessV1.tls.rolloutNonce }}
+        orka.ai/harness-v1-tls-rollout-nonce: {{ . | quote }}
+        {{- end }}
       {{- end }}
     spec:
       serviceAccountName: {{ include "orka.serviceAccountName" . }}
@@ -56,9 +81,12 @@ spec:
       securityContext:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $harnessV2 .Values.controller.acpRuntime.upgradeDrain.enabled }}
+      terminationGracePeriodSeconds: {{ .Values.controller.acpRuntime.upgradeDrain.terminationGracePeriodSeconds }}
+      {{- end }}
       containers:
         - name: controller
-          image: "{{ .Values.controller.image.repository }}:{{ .Values.controller.image.tag }}"
+          image: {{ include "orka.imageRef" .Values.controller.image | quote }}
           imagePullPolicy: {{ .Values.controller.image.pullPolicy }}
           args:
             - --api-port={{ .Values.controller.apiPort }}
@@ -66,10 +94,56 @@ spec:
             - --metrics-bind-address=:{{ .Values.controller.metricsPort }}
             - --health-probe-bind-address=:{{ .Values.controller.healthPort }}
             - --metrics-secure=false
-            {{- if .Values.controller.watchNamespace }}
             - --watch-namespace={{ .Values.controller.watchNamespace }}
-            {{- end }}
             - --leader-elect={{ .Values.controller.leaderElect }}
+            - --controller-mode={{ .Values.controller.mode }}
+            - {{ printf "--execution-mode-controller-usernames=%s" (include "orka.controllerUsername" .) | quote }}
+            - --webhook-cert-path=/var/run/orka/webhook/tls
+            - {{ printf "--webhook-cert-name=%s" .Values.webhooks.tls.certKey | quote }}
+            - {{ printf "--webhook-cert-key=%s" .Values.webhooks.tls.privateKeyKey | quote }}
+            - --task-provenance-admission-enabled=true
+            - {{ printf "--task-provenance-admission-trusted-users=%s" (include "orka.controllerUsername" .) | quote }}
+            - --workspace-class-use-admission-enabled={{ $harnessV2 }}
+            {{- if $harnessV1 }}
+            - --harness-v1-endpoint=https://{{ include "orka.harnessV1Name" . }}.{{ .Release.Namespace }}.svc:8080
+            - --harness-v1-ca-file=/var/run/orka/harness-v1-tls/ca.crt
+            - --harness-v1-auth-secret-namespace={{ .Release.Namespace }}
+            - --harness-v1-auth-secret-name={{ .Values.harnessV1.auth.existingSecret }}
+            - --harness-v1-auth-secret-key={{ .Values.harnessV1.auth.tokenKey }}
+            - --harness-v1-dispatch-interval={{ .Values.harnessV1.dispatch.interval }}
+            - --harness-v1-dispatch-workers={{ .Values.harnessV1.dispatch.workers }}
+            {{- end }}
+            - --agent-execution-snapshot-key-file=/var/run/orka/agent-execution-snapshot/key
+            - --agent-execution-snapshot-retention={{ .Values.controller.agentExecutionSnapshot.retention }}
+            - --agent-execution-snapshot-retention-interval={{ .Values.controller.agentExecutionSnapshot.retentionInterval }}
+            {{- if $harnessV2 }}
+            - --acp-runtime-namespace={{ .Values.controller.acpRuntime.namespace }}
+            {{- end }}
+            {{- if and $harnessV2 .Values.controller.acpRuntime.upgradeDrain.enabled }}
+            - --acp-upgrade-drain-bind-address=127.0.0.1:{{ .Values.controller.acpRuntime.upgradeDrain.port }}
+            - --acp-upgrade-drain-timeout={{ .Values.controller.acpRuntime.upgradeDrain.timeout }}
+            - --acp-upgrade-drain-poll-interval={{ .Values.controller.acpRuntime.upgradeDrain.pollInterval }}
+            - --acp-upgrade-drain-trigger-timeout={{ .Values.controller.acpRuntime.upgradeDrain.triggerTimeout }}
+            - --acp-upgrade-drain-marker-namespace={{ .Release.Namespace }}
+            {{- end }}
+            {{- if and $harnessV2 .Values.providerProxy.enabled }}
+            - --acp-provider-proxy-base-url=http://{{ include "orka.providerProxyName" . }}.{{ .Release.Namespace }}.svc:8080
+            - --acp-provider-proxy-namespace={{ .Release.Namespace }}
+            - --acp-provider-proxy-pod-labels=orka.ai/network-role=provider-auth-proxy
+            - --acp-provider-proxy-token-file=/var/run/orka/provider-auth/token
+            {{- end }}
+            {{- if .Values.controller.acpRuntime.codexImage }}
+            - {{ printf "--acp-codex-runtime-image=%s" .Values.controller.acpRuntime.codexImage | quote }}
+            {{- end }}
+            {{- if .Values.controller.acpRuntime.claudeImage }}
+            - {{ printf "--acp-claude-runtime-image=%s" .Values.controller.acpRuntime.claudeImage | quote }}
+            {{- end }}
+            {{- if .Values.controller.acpRuntime.copilotImage }}
+            - {{ printf "--acp-copilot-runtime-image=%s" .Values.controller.acpRuntime.copilotImage | quote }}
+            {{- end }}
+            {{- if .Values.controller.acpRuntime.opencodeImage }}
+            - {{ printf "--acp-opencode-runtime-image=%s" .Values.controller.acpRuntime.opencodeImage | quote }}
+            {{- end }}
             - --zap-log-level={{ .Values.controller.logLevel }}
             - --gateway-enabled={{ $gatewayRuntimeEnabled }}
             - --gateway-pending-per-session={{ .Values.controller.gateway.pendingPerSession }}
@@ -243,25 +317,11 @@ spec:
             - --ai-worker-cluster-role-name={{ include "orka.aiWorkerClusterRoleName" . }}
             - --vendor-worker-cluster-role-name={{ include "orka.vendorWorkerClusterRoleName" . }}
             - --container-worker-cluster-role-name={{ include "orka.containerWorkerClusterRoleName" . }}
-            - --worker-cluster-role-binding-prefix={{ include "orka.fullname" . }}
-            {{- if .Values.controller.enforceNamespaceIsolation }}
+            - --worker-role-binding-prefix={{ include "orka.fullname" . }}
             - --enforce-namespace-isolation=true
-            {{- end }}
             {{- if gt (int .Values.controller.maxTasksPerNamespace) 0 }}
             - --max-tasks-per-namespace={{ .Values.controller.maxTasksPerNamespace }}
             {{- end }}
-            {{- with .Values.controller.workspaceProvider }}
-            {{- if .apiEnabled }}
-            - --enable-workspace-provider-api=true
-            {{- end }}
-            {{- if .fakeProviderEnabled }}
-            - --enable-fake-workspace-provider=true
-            {{- end }}
-            {{- if .classUseAdmission.enabled }}
-            - --workspace-class-use-admission-enabled=true
-            - --webhook-cert-path=/var/run/orka/workspace-webhook
-            {{- end }}
-            {{- end }}
             {{- with .Values.controller.executionWorkspace }}
             - --execution-workspace-default-provider={{ .defaultProvider | default "agent-sandbox" }}
             {{- end }}
@@ -315,12 +375,22 @@ spec:
               value: {{ include "orka.vendorWorkerClusterRoleName" . | quote }}
             - name: ORKA_CONTAINER_WORKER_CLUSTER_ROLE_NAME
               value: {{ include "orka.containerWorkerClusterRoleName" . | quote }}
-            - name: ORKA_HARNESS_WRAPPER_ENDPOINT
-              value: http://{{ include "orka.harnessWrapperName" . }}:8080
-            - name: ORKA_HARNESS_WRAPPER_BEARER_TOKEN_FILE
-              value: /var/run/orka/harness-wrapper/token
-            - name: ORKA_HARNESS_WRAPPER_SERVICE_ACCOUNT_NAME
-              value: {{ include "orka.harnessWrapperName" . | quote }}
+            {{- if $harnessV2 }}
+            - name: ORKA_ACP_ARTIFACT_CAPABILITY_SECRET_FILE
+              value: /var/run/orka/acp-artifacts/capability-secret
+            - name: ORKA_ACP_ARTIFACT_ROOT
+              value: /data/acp-artifacts
+            - name: ORKA_ACP_ARTIFACT_MAX_BYTES
+              value: {{ .Values.controller.acpArtifact.maxBytes | quote }}
+            {{- end }}
+            {{- if and $harnessV2 .Values.publisher.enabled }}
+            - name: ORKA_WORKSPACE_PUBLISHER_URL
+              value: http://{{ include "orka.publisherName" . }}:8080
+            - name: ORKA_WORKSPACE_PUBLISHER_CONTROLLER_TOKEN_FILE
+              value: /var/run/orka/publisher-auth/controller-token
+            - name: ORKA_WORKSPACE_PUBLISHER_CAPABILITY_SECRET_FILE
+              value: /var/run/orka/publisher-auth/operation-capability-secret
+            {{- end }}
             {{- if .Values.github.webhook.secretName }}
             - name: ORKA_GITHUB_WEBHOOK_SECRET
               valueFrom:
@@ -368,11 +438,18 @@ spec:
             - name: health
               containerPort: {{ .Values.controller.healthPort }}
               protocol: TCP
-            {{- if .Values.controller.workspaceProvider.classUseAdmission.enabled }}
-            - name: webhook-server
+            - name: webhook
               containerPort: 9443
               protocol: TCP
-            {{- end }}
+          {{- if and $harnessV2 .Values.controller.acpRuntime.upgradeDrain.enabled }}
+          lifecycle:
+            preStop:
+              exec:
+                command:
+                  - /manager
+                  - {{ printf "--acp-upgrade-drain-trigger-url=http://127.0.0.1:%v%s" .Values.controller.acpRuntime.upgradeDrain.port "/acp/upgrade-drain" | quote }}
+                  - {{ printf "--acp-upgrade-drain-trigger-timeout=%s" .Values.controller.acpRuntime.upgradeDrain.triggerTimeout | quote }}
+          {{- end }}
           livenessProbe:
             httpGet:
               path: /healthz
@@ -398,41 +475,96 @@ spec:
               mountPath: /tmp
             - name: store
               mountPath: /data
-            - name: harness-wrapper-auth
-              mountPath: /var/run/orka/harness-wrapper
+            {{- if $harnessV2 }}
+            - name: acp-artifact-capability
+              mountPath: /var/run/orka/acp-artifacts
+              readOnly: true
+            {{- end }}
+            {{- if and $harnessV2 .Values.publisher.enabled }}
+            - name: workspace-publisher-auth
+              mountPath: /var/run/orka/publisher-auth
+              readOnly: true
+            {{- end }}
+            {{- if and $harnessV2 .Values.providerProxy.enabled }}
+            - name: provider-auth-proxy
+              mountPath: /var/run/orka/provider-auth
+              readOnly: true
+            {{- end }}
+            - name: agent-execution-snapshot-key
+              mountPath: /var/run/orka/agent-execution-snapshot
               readOnly: true
-            {{- if .Values.controller.workspaceProvider.classUseAdmission.enabled }}
-            - name: workspace-webhook-certs
-              mountPath: /var/run/orka/workspace-webhook
+            - name: webhook-tls
+              mountPath: /var/run/orka/webhook/tls
+              readOnly: true
+            {{- if $harnessV1 }}
+            - name: harness-v1-tls
+              mountPath: /var/run/orka/harness-v1-tls
               readOnly: true
             {{- end }}
       volumes:
         - name: tmp
           emptyDir: {}
-        - name: harness-wrapper-auth
-          secret:
-            secretName: {{ .Values.workers.harnessWrapper.auth.existingSecret | default (include "orka.harnessWrapperAuthSecretName" .) }}
-            items:
-              - key: {{ .Values.workers.harnessWrapper.auth.tokenKey | default "token" }}
-                path: token
-        {{- if .Values.controller.workspaceProvider.classUseAdmission.enabled }}
-        - name: workspace-webhook-certs
+        {{- if $harnessV2 }}
+        - name: acp-artifact-capability
           secret:
-            secretName: {{ .Values.controller.workspaceProvider.classUseAdmission.existingSecret | quote }}
+            secretName: {{ .Values.controller.acpArtifact.existingSecret | default (include "orka.acpArtifactSecretName" .) }}
             defaultMode: 0400
             items:
-              - key: tls.crt
-                path: tls.crt
-              - key: tls.key
-                path: tls.key
+              - key: {{ .Values.controller.acpArtifact.secretKey | default "capability-secret" }}
+                path: capability-secret
         {{- end }}
         - name: store
           {{- if .Values.store.persistence.enabled }}
           persistentVolumeClaim:
-            claimName: {{ include "orka.fullname" . }}-store
+            claimName: {{ include "orka.storeName" . }}
           {{- else }}
           emptyDir: {}
           {{- end }}
+        {{- if and $harnessV2 .Values.publisher.enabled }}
+        - name: workspace-publisher-auth
+          secret:
+            secretName: {{ .Values.publisher.auth.existingSecret | default (include "orka.publisherAuthSecretName" .) }}
+            defaultMode: 0400
+            items:
+              - key: {{ .Values.publisher.auth.controllerTokenKey | default "controller-token" }}
+                path: controller-token
+              - key: {{ .Values.publisher.auth.capabilitySecretKey | default "operation-capability-secret" }}
+                path: operation-capability-secret
+        {{- end }}
+        {{- if and $harnessV2 .Values.providerProxy.enabled }}
+        - name: provider-auth-proxy
+          secret:
+            secretName: {{ .Values.providerProxy.auth.existingSecret | default (include "orka.providerProxyName" .) }}
+            defaultMode: 0400
+            items:
+              - key: {{ .Values.providerProxy.auth.tokenKey | default "token" }}
+                path: token
+        {{- end }}
+        - name: agent-execution-snapshot-key
+          secret:
+            secretName: {{ .Values.controller.agentExecutionSnapshot.existingSecret | quote }}
+            defaultMode: 0400
+            items:
+              - key: {{ .Values.controller.agentExecutionSnapshot.key | quote }}
+                path: key
+        - name: webhook-tls
+          secret:
+            secretName: {{ .Values.webhooks.tls.existingSecret | quote }}
+            defaultMode: 0400
+            items:
+              - key: {{ .Values.webhooks.tls.certKey | quote }}
+                path: {{ .Values.webhooks.tls.certKey | quote }}
+              - key: {{ .Values.webhooks.tls.privateKeyKey | quote }}
+                path: {{ .Values.webhooks.tls.privateKeyKey | quote }}
+        {{- if $harnessV1 }}
+        - name: harness-v1-tls
+          secret:
+            secretName: {{ .Values.harnessV1.tls.existingSecret | quote }}
+            defaultMode: 0400
+            items:
+              - key: ca.crt
+                path: ca.crt
+        {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
diff --git a/manifest_staging/charts/orka/templates/gateway-task-admission-policy.yaml b/manifest_staging/charts/orka/templates/gateway-task-admission-policy.yaml
index 12a1b1976..940409346 100644
--- a/manifest_staging/charts/orka/templates/gateway-task-admission-policy.yaml
+++ b/manifest_staging/charts/orka/templates/gateway-task-admission-policy.yaml
@@ -1,3 +1,4 @@
+{{- if eq .Values.controller.mode "harness-v2" }}
 {{- $issuerPrefix := "gateway.orka.ai/" -}}
 {{- if .Values.controller.watchNamespace -}}
 {{- $issuerPrefix = printf "gateway.orka.ai/%s/" .Values.controller.watchNamespace -}}
@@ -43,3 +44,4 @@ metadata:
 spec:
   policyName: {{ include "orka.fullname" . }}-gateway-task-protection
   validationActions: [Deny]
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/harness-wrapper-deployment.yaml b/manifest_staging/charts/orka/templates/harness-wrapper-deployment.yaml
index 7d42a6b64..ce943f73c 100644
--- a/manifest_staging/charts/orka/templates/harness-wrapper-deployment.yaml
+++ b/manifest_staging/charts/orka/templates/harness-wrapper-deployment.yaml
@@ -1,7 +1,9 @@
+{{- include "orka.validateHarnessV1" . }}
+{{- if eq .Values.controller.mode "harness-v1" }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "orka.harnessWrapperName" . }}
+  name: {{ include "orka.harnessV1Name" . }}
   labels:
     {{- include "orka.labels" . | nindent 4 }}
     app.kubernetes.io/component: agent-harness-wrapper
@@ -14,97 +16,5 @@ spec:
       {{- include "orka.selectorLabels" . | nindent 6 }}
       app.kubernetes.io/component: agent-harness-wrapper
   template:
-    metadata:
-      labels:
-        {{- include "orka.selectorLabels" . | nindent 8 }}
-        app.kubernetes.io/component: agent-harness-wrapper
-    spec:
-      serviceAccountName: {{ include "orka.harnessWrapperName" . }}
-      automountServiceAccountToken: false
-      securityContext:
-        runAsUser: 0
-        runAsGroup: 0
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: wrapper
-          image: {{ .Values.workers.harnessWrapper.image.repository }}:{{ .Values.workers.harnessWrapper.image.tag }}
-          imagePullPolicy: {{ .Values.workers.harnessWrapper.image.pullPolicy }}
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          env:
-            - name: ORKA_HARNESS_WRAPPER_RUNTIME
-              value: multi
-            - name: ORKA_HARNESS_WRAPPER_LISTEN_ADDR
-              value: :8080
-            - name: ORKA_HARNESS_WRAPPER_BEARER_TOKEN_FILE
-              value: /var/run/orka/harness-wrapper/token
-            - name: ORKA_ALLOW_BASH
-              value: "true"
-            - name: ORKA_HARNESS_WRAPPER_CHILD_UID
-              value: "1000"
-            - name: ORKA_HARNESS_WRAPPER_CHILD_GID
-              value: "1000"
-            {{- if .Values.workers.harnessWrapper.codexSandboxMode }}
-            - name: ORKA_CODEX_SANDBOX_MODE
-              value: {{ .Values.workers.harnessWrapper.codexSandboxMode | quote }}
-            {{- end }}
-            - name: ORKA_SA_TOKEN_PATH
-              value: /var/run/orka/upload-token/token
-          volumeMounts:
-            - name: auth
-              mountPath: /var/run/orka/harness-wrapper
-              readOnly: true
-            - name: upload-token
-              mountPath: /var/run/orka/upload-token
-              readOnly: true
-            - name: tmp
-              mountPath: /tmp
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsUser: 0
-            runAsGroup: 0
-            capabilities:
-              drop:
-                - ALL
-              add:
-                - SETUID
-                - SETGID
-                - CHOWN
-                - KILL
-                - FOWNER
-          livenessProbe:
-            httpGet:
-              path: /v1/health
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 20
-          readinessProbe:
-            httpGet:
-              path: /v1/health
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          {{- with .Values.workers.harnessWrapper.resources }}
-          resources:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-      volumes:
-        - name: upload-token
-          projected:
-            defaultMode: 0400
-            sources:
-              - serviceAccountToken:
-                  path: token
-        - name: auth
-          secret:
-            secretName: {{ .Values.workers.harnessWrapper.auth.existingSecret | default (include "orka.harnessWrapperAuthSecretName" .) }}
-            defaultMode: 0400
-            items:
-              - key: {{ .Values.workers.harnessWrapper.auth.tokenKey | default "token" }}
-                path: token
-        - name: tmp
-          emptyDir: {}
+    {{- include "orka.harnessV1PodTemplate" (dict "root" . "generation" (include "orka.harnessV1PodTemplateGeneration" .)) | nindent 4 }}
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/harness-wrapper-drain-hook.yaml b/manifest_staging/charts/orka/templates/harness-wrapper-drain-hook.yaml
new file mode 100644
index 000000000..f43747028
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/harness-wrapper-drain-hook.yaml
@@ -0,0 +1,490 @@
+{{- $harnessV1 := eq .Values.controller.mode "harness-v1" -}}
+{{- if $harnessV1 }}
+{{- include "orka.validateHarnessV1" . }}
+{{- $wrapperName := include "orka.harnessV1Name" . }}
+{{- $desiredGeneration := include "orka.harnessV1PodTemplateGeneration" . }}
+{{- $rolloverGeneration := $desiredGeneration }}
+{{- $existingWrapper := lookup "apps/v1" "Deployment" .Release.Namespace $wrapperName }}
+{{- $controllerName := include "orka.controllerName" . }}
+{{- $existingController := lookup "apps/v1" "Deployment" .Release.Namespace $controllerName }}
+{{- $existingControllerState := "" }}
+{{- if $existingController }}
+{{- $existingControllerState = include "orka.harnessV1ExistingControllerState" $existingController | trim }}
+{{- end }}
+{{- if and .Release.IsUpgrade (not $existingWrapper) (empty $existingControllerState) }}
+{{- fail "cannot determine the previously deployed harness v1 state during upgrade; restore the release controller or wrapper Deployment before upgrading" }}
+{{- end }}
+{{- $needsRollover := false }}
+{{- $existingRouteEnabled := false }}
+{{- $existingImage := "" }}
+{{- $existingPullPolicy := "" }}
+{{- $existingAuthSecret := "" }}
+{{- $existingAuthKey := "" }}
+{{- $existingTLSSecret := "" }}
+{{- $desiredAuthSecret := .Values.harnessV1.auth.existingSecret }}
+{{- $desiredAuthKey := .Values.harnessV1.auth.tokenKey }}
+{{- if $existingWrapper }}
+{{- $existingRouteEnabled = true }}
+{{- $existingGeneration := include "orka.harnessV1ExistingGeneration" $existingWrapper | trim }}
+{{- $needsRollover = ne $existingGeneration $desiredGeneration }}
+{{- $existingImage = include "orka.harnessV1ExistingImage" $existingWrapper }}
+{{- $existingPullPolicy = include "orka.harnessV1ExistingImagePullPolicy" $existingWrapper }}
+{{- $existingAuthSecret = include "orka.harnessV1ExistingAuthSecretName" $existingWrapper }}
+{{- $existingAuthKey = include "orka.harnessV1ExistingAuthSecretKey" $existingWrapper }}
+{{- $existingTLSSecret = include "orka.harnessV1ExistingTLSSecretName" $existingWrapper }}
+{{- else if eq $existingControllerState "enabled" }}
+{{- $existingRouteEnabled = true }}
+{{- $existingAuthSecret = include "orka.harnessV1ExistingControllerAuthSecretName" $existingController }}
+{{- $existingAuthKey = include "orka.harnessV1ExistingControllerAuthSecretKey" $existingController }}
+{{- end }}
+{{- if $existingRouteEnabled }}
+{{- if ne $existingAuthSecret $desiredAuthSecret }}
+{{- fail "harnessV1.auth.existingSecret cannot change while the previously deployed harness v1 route remains enabled; retire harness v1 before rotating wrapper auth" }}
+{{- end }}
+{{- if ne $existingAuthKey $desiredAuthKey }}
+{{- fail "harnessV1.auth.tokenKey cannot change while the previously deployed harness v1 route remains enabled; retire harness v1 before rotating wrapper auth" }}
+{{- end }}
+{{- end }}
+{{- if $needsRollover }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "orka.harnessV1DrainName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper-rollover-drain
+  annotations:
+    helm.sh/hook: pre-upgrade,pre-rollback
+    helm.sh/hook-weight: "-20"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: agent-harness-wrapper
+  policyTypes: [Ingress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: agent-harness-wrapper-rollover-drain
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "orka.harnessV1DrainEgressName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper-rollover-drain
+  annotations:
+    helm.sh/hook: pre-upgrade,pre-rollback
+    helm.sh/hook-weight: "-20"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: agent-harness-wrapper-rollover-drain
+  policyTypes: [Egress]
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - {protocol: UDP, port: 53}
+        - {protocol: TCP, port: 53}
+    - to:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: agent-harness-wrapper
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "orka.harnessV1DrainName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper-rollover-drain
+  annotations:
+    helm.sh/hook: pre-upgrade,pre-rollback
+    helm.sh/hook-weight: "-10"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  backoffLimit: 0
+  template:
+    metadata:
+      labels:
+        {{- include "orka.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: agent-harness-wrapper-rollover-drain
+    spec:
+      serviceAccountName: {{ include "orka.harnessV1Name" . }}
+      automountServiceAccountToken: false
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: drain
+          image: {{ $existingImage | quote }}
+          imagePullPolicy: {{ $existingPullPolicy }}
+          command: ["/orka-agent-harness-wrapper"]
+          args:
+            - drain
+            - {{ printf "--endpoint=https://%s.%s.svc:8080" $wrapperName .Release.Namespace | quote }}
+            - --bearer-token-file=/var/run/orka/harness-wrapper-auth/token
+            - --ca-file=/var/run/orka/harness-wrapper-tls/ca.crt
+            - {{ printf "--timeout=%s" .Values.harnessV1.upgradeDrain.timeout | quote }}
+            - {{ printf "--poll-interval=%s" .Values.harnessV1.upgradeDrain.pollInterval | quote }}
+            - {{ printf "--next-generation=%s" $rolloverGeneration | quote }}
+          volumeMounts:
+            - name: auth
+              mountPath: /var/run/orka/harness-wrapper-auth
+              readOnly: true
+            - name: tls
+              mountPath: /var/run/orka/harness-wrapper-tls
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 1000
+            runAsGroup: 1000
+            capabilities:
+              drop: [ALL]
+          {{- with .Values.harnessV1.upgradeDrain.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      volumes:
+        - name: auth
+          secret:
+            secretName: {{ $existingAuthSecret | quote }}
+            defaultMode: 0440
+            items:
+              - key: {{ $existingAuthKey | quote }}
+                path: token
+        - name: tls
+          secret:
+            secretName: {{ $existingTLSSecret | quote }}
+            defaultMode: 0440
+            items:
+              - key: ca.crt
+                path: ca.crt
+        - name: tmp
+          emptyDir: {}
+{{- end }}
+{{- if $harnessV1 }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "orka.harnessV1AbortName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper-rollover-abort
+  annotations:
+    helm.sh/hook: post-rollback
+    helm.sh/hook-weight: "-20"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: agent-harness-wrapper
+  policyTypes: [Ingress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: agent-harness-wrapper-rollover-abort
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "orka.harnessV1AbortEgressName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper-rollover-abort
+  annotations:
+    helm.sh/hook: post-rollback
+    helm.sh/hook-weight: "-20"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: agent-harness-wrapper-rollover-abort
+  policyTypes: [Egress]
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - {protocol: UDP, port: 53}
+        - {protocol: TCP, port: 53}
+    - to:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: agent-harness-wrapper
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "orka.harnessV1AbortName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper-rollover-abort
+  annotations:
+    helm.sh/hook: post-rollback
+    helm.sh/hook-weight: "-10"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  backoffLimit: 0
+  template:
+    metadata:
+      labels:
+        {{- include "orka.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: agent-harness-wrapper-rollover-abort
+    spec:
+      serviceAccountName: {{ include "orka.harnessV1Name" . }}
+      automountServiceAccountToken: false
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: abort-rollover
+          image: {{ include "orka.imageRef" .Values.harnessV1.image | quote }}
+          imagePullPolicy: {{ .Values.harnessV1.image.pullPolicy }}
+          command: ["/orka-agent-harness-wrapper"]
+          args:
+            - abort-rollover
+            - {{ printf "--endpoint=https://%s.%s.svc:8080" $wrapperName .Release.Namespace | quote }}
+            - --bearer-token-file=/var/run/orka/harness-wrapper-auth/token
+            - --ca-file=/var/run/orka/harness-wrapper-tls/ca.crt
+            - {{ printf "--expected-generation=%s" $desiredGeneration | quote }}
+            - {{ printf "--timeout=%s" .Values.harnessV1.upgradeDrain.timeout | quote }}
+          volumeMounts:
+            - name: auth
+              mountPath: /var/run/orka/harness-wrapper-auth
+              readOnly: true
+            - name: tls
+              mountPath: /var/run/orka/harness-wrapper-tls
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 1000
+            runAsGroup: 1000
+            capabilities:
+              drop: [ALL]
+          {{- with .Values.harnessV1.upgradeDrain.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      volumes:
+        - name: auth
+          secret:
+            secretName: {{ .Values.harnessV1.auth.existingSecret | quote }}
+            defaultMode: 0440
+            items:
+              - key: {{ .Values.harnessV1.auth.tokenKey | quote }}
+                path: token
+        - name: tls
+          secret:
+            secretName: {{ .Values.harnessV1.tls.existingSecret | quote }}
+            defaultMode: 0440
+            items:
+              - key: ca.crt
+                path: ca.crt
+        - name: tmp
+          emptyDir: {}
+{{- end }}
+{{- if $harnessV1 }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "orka.harnessV1DeleteDrainName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper-delete-drain
+  annotations:
+    helm.sh/hook: pre-delete
+    helm.sh/hook-weight: "-20"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: agent-harness-wrapper
+  policyTypes: [Ingress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: agent-harness-wrapper-delete-drain
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "orka.harnessV1DeleteDrainEgressName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper-delete-drain
+  annotations:
+    helm.sh/hook: pre-delete
+    helm.sh/hook-weight: "-20"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: agent-harness-wrapper-delete-drain
+  policyTypes: [Egress]
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - {protocol: UDP, port: 53}
+        - {protocol: TCP, port: 53}
+    - to:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: agent-harness-wrapper
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "orka.harnessV1DeleteDrainName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper-delete-drain
+  annotations:
+    helm.sh/hook: pre-delete
+    helm.sh/hook-weight: "-10"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  backoffLimit: 0
+  template:
+    metadata:
+      labels:
+        {{- include "orka.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: agent-harness-wrapper-delete-drain
+    spec:
+      serviceAccountName: {{ include "orka.harnessV1Name" . }}
+      automountServiceAccountToken: false
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: drain
+          image: {{ include "orka.imageRef" .Values.harnessV1.image | quote }}
+          imagePullPolicy: {{ .Values.harnessV1.image.pullPolicy }}
+          command: ["/orka-agent-harness-wrapper"]
+          args:
+            - drain
+            - {{ printf "--endpoint=https://%s.%s.svc:8080" $wrapperName .Release.Namespace | quote }}
+            - --bearer-token-file=/var/run/orka/harness-wrapper-auth/token
+            - --ca-file=/var/run/orka/harness-wrapper-tls/ca.crt
+            - {{ printf "--timeout=%s" .Values.harnessV1.upgradeDrain.timeout | quote }}
+            - {{ printf "--poll-interval=%s" .Values.harnessV1.upgradeDrain.pollInterval | quote }}
+            - {{ printf "--next-generation=retired:%s" $desiredGeneration | quote }}
+          volumeMounts:
+            - name: auth
+              mountPath: /var/run/orka/harness-wrapper-auth
+              readOnly: true
+            - name: tls
+              mountPath: /var/run/orka/harness-wrapper-tls
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 1000
+            runAsGroup: 1000
+            capabilities:
+              drop: [ALL]
+          {{- with .Values.harnessV1.upgradeDrain.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      volumes:
+        - name: auth
+          secret:
+            secretName: {{ .Values.harnessV1.auth.existingSecret | quote }}
+            defaultMode: 0440
+            items:
+              - key: {{ .Values.harnessV1.auth.tokenKey | quote }}
+                path: token
+        - name: tls
+          secret:
+            secretName: {{ .Values.harnessV1.tls.existingSecret | quote }}
+            defaultMode: 0440
+            items:
+              - key: ca.crt
+                path: ca.crt
+        - name: tmp
+          emptyDir: {}
+{{- end }}
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/harness-wrapper-networkpolicy.yaml b/manifest_staging/charts/orka/templates/harness-wrapper-networkpolicy.yaml
new file mode 100644
index 000000000..d07344804
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/harness-wrapper-networkpolicy.yaml
@@ -0,0 +1,87 @@
+{{- include "orka.validateHarnessV1" . }}
+{{- if eq .Values.controller.mode "harness-v1" }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "orka.harnessV1Name" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: agent-harness-wrapper
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: controller
+      ports:
+        - protocol: TCP
+          port: 8080
+  # V1 compatibility workloads may reach their release-local controller plus
+  # public HTTPS provider and read-only SCM endpoints. Private, local,
+  # link-local, multicast, and documentation networks remain denied, and no
+  # in-cluster publisher/proxy egress is granted.
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: controller
+      ports:
+        - protocol: TCP
+          port: {{ .Values.controller.apiPort }}
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - {protocol: UDP, port: 53}
+        - {protocol: TCP, port: 53}
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 0.0.0.0/8
+              - 10.0.0.0/8
+              - 100.64.0.0/10
+              - 127.0.0.0/8
+              - 169.254.0.0/16
+              - 172.16.0.0/12
+              - 192.0.0.0/24
+              - 192.0.2.0/24
+              - 192.168.0.0/16
+              - 198.18.0.0/15
+              - 198.51.100.0/24
+              - 203.0.113.0/24
+              - 224.0.0.0/4
+              - 240.0.0.0/4
+      ports:
+        - protocol: TCP
+          port: 443
+    - to:
+        - ipBlock:
+            cidr: ::/0
+            except:
+              - ::/128
+              - ::1/128
+              - 64:ff9b::/96
+              - 64:ff9b:1::/48
+              - 100::/64
+              - 2001::/32
+              - 2001:db8::/32
+              - 2002::/16
+              - fc00::/7
+              - fe80::/10
+              - ff00::/8
+      ports:
+        - protocol: TCP
+          port: 443
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/harness-wrapper-pvc.yaml b/manifest_staging/charts/orka/templates/harness-wrapper-pvc.yaml
new file mode 100644
index 000000000..70f413323
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/harness-wrapper-pvc.yaml
@@ -0,0 +1,21 @@
+{{- include "orka.validateHarnessV1" . }}
+{{- if eq .Values.controller.mode "harness-v1" }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "orka.harnessV1LedgerName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.harnessV1.ledger.size }}
+  {{- with .Values.harnessV1.ledger.storageClass }}
+  storageClassName: {{ . | quote }}
+  {{- end }}
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/harness-wrapper-secret.yaml b/manifest_staging/charts/orka/templates/harness-wrapper-secret.yaml
deleted file mode 100644
index 4a3a5c968..000000000
--- a/manifest_staging/charts/orka/templates/harness-wrapper-secret.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-{{- if not .Values.workers.harnessWrapper.auth.existingSecret }}
-{{- $secretName := include "orka.harnessWrapperAuthSecretName" . }}
-{{- $tokenKey := .Values.workers.harnessWrapper.auth.tokenKey | default "token" }}
-{{- $existing := lookup "v1" "Secret" .Release.Namespace $secretName }}
-{{- $existingToken := "" }}
-{{- if and $existing (hasKey $existing.data $tokenKey) }}
-{{- $existingToken = (index $existing.data $tokenKey | b64dec) }}
-{{- end }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ $secretName }}
-  labels:
-    {{- include "orka.labels" . | nindent 4 }}
-    app.kubernetes.io/component: agent-harness-wrapper
-type: Opaque
-stringData:
-  {{ $tokenKey }}: {{ default (default (randAlphaNum 32) $existingToken) .Values.workers.harnessWrapper.auth.token | quote }}
-{{- end }}
diff --git a/manifest_staging/charts/orka/templates/harness-wrapper-service.yaml b/manifest_staging/charts/orka/templates/harness-wrapper-service.yaml
index e6d5ddf10..cbbdbd3d3 100644
--- a/manifest_staging/charts/orka/templates/harness-wrapper-service.yaml
+++ b/manifest_staging/charts/orka/templates/harness-wrapper-service.yaml
@@ -1,7 +1,9 @@
+{{- include "orka.validateHarnessV1" . }}
+{{- if eq .Values.controller.mode "harness-v1" }}
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "orka.harnessWrapperName" . }}
+  name: {{ include "orka.harnessV1Name" . }}
   labels:
     {{- include "orka.labels" . | nindent 4 }}
     app.kubernetes.io/component: agent-harness-wrapper
@@ -10,7 +12,8 @@ spec:
     {{- include "orka.selectorLabels" . | nindent 4 }}
     app.kubernetes.io/component: agent-harness-wrapper
   ports:
-    - name: http
+    - name: https
       port: 8080
-      targetPort: http
+      targetPort: https
       protocol: TCP
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/harness-wrapper-serviceaccount.yaml b/manifest_staging/charts/orka/templates/harness-wrapper-serviceaccount.yaml
new file mode 100644
index 000000000..24a7b8014
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/harness-wrapper-serviceaccount.yaml
@@ -0,0 +1,11 @@
+{{- include "orka.validateHarnessV1" . }}
+{{- if eq .Values.controller.mode "harness-v1" }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "orka.harnessV1Name" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent-harness-wrapper
+automountServiceAccountToken: false
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/provider-proxy-deployment.yaml b/manifest_staging/charts/orka/templates/provider-proxy-deployment.yaml
new file mode 100644
index 000000000..cba838b6a
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/provider-proxy-deployment.yaml
@@ -0,0 +1,82 @@
+{{- include "orka.validateProviderProxyConfig" . }}
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.providerProxy.enabled }}
+{{- $secretName := .Values.providerProxy.auth.existingSecret | default (include "orka.providerProxyName" .) }}
+{{- $currentKey := .Values.providerProxy.auth.tokenKey | default "token" }}
+{{- $previousKey := .Values.providerProxy.auth.previousTokenKey | default "previous-token" }}
+{{- $previousValidUntilKey := .Values.providerProxy.auth.previousTokenValidUntilKey | default "previous-token-valid-until" }}
+{{- if or (eq $currentKey $previousKey) (eq $currentKey $previousValidUntilKey) (eq $previousKey $previousValidUntilKey) }}
+{{- fail "providerProxy auth token keys must differ" }}
+{{- end }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "orka.providerProxyName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: provider-auth-proxy
+spec:
+  replicas: 1
+  strategy: {type: Recreate}
+  selector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: provider-auth-proxy
+  template:
+    metadata:
+      {{- with .Values.providerProxy.rolloutNonce }}
+      annotations:
+        orka.ai/provider-auth-rollout-nonce: {{ . | quote }}
+      {{- end }}
+      labels:
+        {{- include "orka.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: provider-auth-proxy
+        orka.ai/network-role: provider-auth-proxy
+    spec:
+      serviceAccountName: {{ include "orka.providerProxyName" . }}
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile: {type: RuntimeDefault}
+      containers:
+        - name: proxy
+          image: {{ include "orka.imageRef" .Values.controller.image | quote }}
+          imagePullPolicy: {{ .Values.controller.image.pullPolicy }}
+          command: [/provider-auth-proxy]
+          args:
+            - --listen-address=:8080
+            - {{ printf "--upstream-base-url=%s" (include "orka.providerProxyUpstreamBaseURL" .) | quote }}
+            - --token-file=/var/run/secrets/orka/provider-auth/token
+            - --previous-token-file=/var/run/secrets/orka/provider-auth/previous-token
+            - --previous-token-valid-until-file=/var/run/secrets/orka/provider-auth/previous-token-valid-until
+            - {{ printf "--token-reload-interval=%s" (.Values.providerProxy.tokenReloadInterval | default "5s") | quote }}
+            - {{ printf "--previous-token-overlap=%s" (.Values.providerProxy.previousTokenOverlap | default "10m") | quote }}
+          ports: [{name: http, containerPort: 8080}]
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities: {drop: [ALL]}
+          resources:
+            {{- toYaml .Values.providerProxy.resources | nindent 12 }}
+          readinessProbe: {httpGet: {path: /readyz, port: http}}
+          livenessProbe: {httpGet: {path: /healthz, port: http}}
+          volumeMounts:
+            - {name: provider-auth, mountPath: /var/run/secrets/orka/provider-auth, readOnly: true}
+      volumes:
+        - name: provider-auth
+          projected:
+            defaultMode: 0440
+            sources:
+              - secret:
+                  name: {{ $secretName }}
+                  optional: true
+                  items:
+                    - key: {{ $currentKey }}
+                      path: token
+                    - key: {{ $previousKey }}
+                      path: previous-token
+                    - key: {{ $previousValidUntilKey }}
+                      path: previous-token-valid-until
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/provider-proxy-networkpolicy.yaml b/manifest_staging/charts/orka/templates/provider-proxy-networkpolicy.yaml
new file mode 100644
index 000000000..3e7d953f9
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/provider-proxy-networkpolicy.yaml
@@ -0,0 +1,36 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.providerProxy.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "orka.providerProxyName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: provider-auth-proxy
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ .Values.controller.acpRuntime.namespace }}
+          podSelector:
+            matchLabels:
+              orka.ai/network-role: provider-client
+      ports: [{protocol: TCP, port: 8080}]
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels: {kubernetes.io/metadata.name: kube-system}
+          podSelector:
+            matchLabels: {k8s-app: kube-dns}
+      ports: [{protocol: UDP, port: 53}, {protocol: TCP, port: 53}]
+    - to:
+        - namespaceSelector:
+            matchLabels: {kubernetes.io/metadata.name: vekil-system}
+          podSelector:
+            matchLabels: {app.kubernetes.io/name: vekil}
+      ports: [{protocol: TCP, port: 1337}]
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/provider-proxy-secret.yaml b/manifest_staging/charts/orka/templates/provider-proxy-secret.yaml
new file mode 100644
index 000000000..4c49d9ce9
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/provider-proxy-secret.yaml
@@ -0,0 +1,31 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.providerProxy.enabled (not .Values.providerProxy.auth.existingSecret) }}
+{{- $name := include "orka.providerProxyName" . }}
+{{- $key := .Values.providerProxy.auth.tokenKey | default "token" }}
+{{- $previousKey := .Values.providerProxy.auth.previousTokenKey | default "previous-token" }}
+{{- $previousValidUntilKey := .Values.providerProxy.auth.previousTokenValidUntilKey | default "previous-token-valid-until" }}
+{{- $previousToken := .Values.providerProxy.auth.previousToken | default "" }}
+{{- $previousValidUntil := .Values.providerProxy.auth.previousTokenValidUntil | default "" }}
+{{- if or (eq $key $previousKey) (eq $key $previousValidUntilKey) (eq $previousKey $previousValidUntilKey) }}
+{{- fail "providerProxy auth token keys must differ" }}
+{{- end }}
+{{- if ne (empty $previousToken) (empty $previousValidUntil) }}
+{{- fail "providerProxy.auth.previousToken and previousTokenValidUntil must be set together" }}
+{{- end }}
+{{- $existing := lookup "v1" "Secret" .Release.Namespace $name }}
+{{- $existingValue := "" }}
+{{- if and $existing (hasKey $existing.data $key) }}{{- $existingValue = (index $existing.data $key | b64dec) }}{{- end }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $name }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: provider-auth-proxy
+type: Opaque
+data:
+  {{ $key }}: {{ default (default (randAlphaNum 64) $existingValue) .Values.providerProxy.auth.token | toString | b64enc | quote }}
+  {{- if $previousToken }}
+  {{ $previousKey }}: {{ $previousToken | toString | b64enc | quote }}
+  {{ $previousValidUntilKey }}: {{ $previousValidUntil | toString | b64enc | quote }}
+  {{- end }}
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/provider-proxy-service.yaml b/manifest_staging/charts/orka/templates/provider-proxy-service.yaml
new file mode 100644
index 000000000..ac79d3248
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/provider-proxy-service.yaml
@@ -0,0 +1,15 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.providerProxy.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "orka.providerProxyName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: provider-auth-proxy
+spec:
+  selector:
+    {{- include "orka.selectorLabels" . | nindent 4 }}
+    app.kubernetes.io/component: provider-auth-proxy
+  ports:
+    - {name: http, port: 8080, targetPort: http}
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/provider-proxy-serviceaccount.yaml b/manifest_staging/charts/orka/templates/provider-proxy-serviceaccount.yaml
new file mode 100644
index 000000000..c1785784f
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/provider-proxy-serviceaccount.yaml
@@ -0,0 +1,10 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.providerProxy.enabled }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "orka.providerProxyName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: provider-auth-proxy
+automountServiceAccountToken: false
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/publisher-deployment.yaml b/manifest_staging/charts/orka/templates/publisher-deployment.yaml
new file mode 100644
index 000000000..e28838faa
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/publisher-deployment.yaml
@@ -0,0 +1,113 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled (not .Values.scmEgressProxy.enabled) }}
+{{- fail "publisher.enabled requires scmEgressProxy.enabled so public HTTPS egress remains proxy-only" }}
+{{- end }}
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled }}
+{{- $scmProxySecretName := .Values.scmEgressProxy.auth.existingSecret | default (include "orka.scmEgressProxyAuthSecretName" .) }}
+{{- $scmProxyTokenKey := .Values.scmEgressProxy.auth.tokenKey | default "token" }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "orka.publisherName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: workspace-publisher
+spec:
+  replicas: 1
+  strategy: {type: Recreate}
+  selector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: workspace-publisher
+  template:
+    metadata:
+      {{- if or .Values.publisher.auth.rolloutNonce .Values.scmEgressProxy.auth.rolloutNonce }}
+      annotations:
+        {{- with .Values.publisher.auth.rolloutNonce }}
+        orka.ai/publisher-auth-rollout-nonce: {{ . | quote }}
+        {{- end }}
+        {{- with .Values.scmEgressProxy.auth.rolloutNonce }}
+        orka.ai/scm-egress-proxy-auth-rollout-nonce: {{ . | quote }}
+        {{- end }}
+      {{- end }}
+      labels:
+        {{- include "orka.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: workspace-publisher
+        orka.ai/network-role: workspace-publisher
+    spec:
+      serviceAccountName: {{ include "orka.publisherServiceAccountName" . }}
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile: {type: RuntimeDefault}
+      containers:
+        - name: publisher
+          image: {{ include "orka.imageRef" .Values.publisher.image | quote }}
+          imagePullPolicy: {{ .Values.publisher.image.pullPolicy }}
+          ports:
+            - {name: http, containerPort: 8080}
+          env:
+            - name: ORKA_SCM_EGRESS_PROXY_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $scmProxySecretName }}
+                  key: {{ $scmProxyTokenKey }}
+            - name: HTTPS_PROXY
+              value: {{ printf "http://orka-publisher:$(ORKA_SCM_EGRESS_PROXY_TOKEN)@%s.%s.svc:%v" (include "orka.scmEgressProxyName" .) .Release.Namespace 8080 | quote }}
+            - name: https_proxy
+              value: {{ printf "http://orka-publisher:$(ORKA_SCM_EGRESS_PROXY_TOKEN)@%s.%s.svc:%v" (include "orka.scmEgressProxyName" .) .Release.Namespace 8080 | quote }}
+            - {name: NO_PROXY, value: {{ .Values.scmEgressProxy.noProxy | quote }}}
+            - {name: no_proxy, value: {{ .Values.scmEgressProxy.noProxy | quote }}}
+            - {name: ORKA_PUBLISHER_SCM_EGRESS_PROXY_REQUIRED, value: "true"}
+            - {name: ORKA_PUBLISHER_LISTEN_ADDRESS, value: ":8080"}
+            - {name: ORKA_PUBLISHER_TEMP_ROOT, value: /tmp/orka-workspace-publisher/runtime}
+            - {name: ORKA_PUBLISHER_CONTROLLER_TOKEN_FILE, value: /var/run/orka/publisher-auth/controller-token}
+            - {name: ORKA_PUBLISHER_OPERATION_CAPABILITY_SECRET_FILE, value: /var/run/orka/publisher-auth/operation-capability-secret}
+            - name: ORKA_PUBLISHER_ARTIFACT_AUTHORIZATION_BROKER_URL
+              value: http://{{ include "orka.fullname" . }}:{{ .Values.service.port }}
+            - name: ORKA_PUBLISHER_ARTIFACT_API_URL
+              value: http://{{ include "orka.fullname" . }}:{{ .Values.service.port }}
+            - name: ORKA_PUBLISHER_CREDENTIAL_BROKER_URL
+              value: http://{{ include "orka.fullname" . }}:{{ .Values.service.port }}
+            - {name: ORKA_PUBLISHER_ALLOWED_SCM_HOSTS, value: {{ .Values.publisher.allowedSCMHosts | quote }}}
+            - {name: ORKA_PUBLISHER_GITHUB_PR_ENABLED, value: {{ .Values.publisher.githubPR.enabled | quote }}}
+            {{- if .Values.publisher.githubPR.enabled }}
+            - {name: ORKA_PUBLISHER_GITHUB_API_BASE_URL, value: {{ .Values.publisher.githubPR.apiBaseURL | quote }}}
+            - {name: ORKA_PUBLISHER_GITHUB_REQUEST_TIMEOUT, value: {{ .Values.publisher.githubPR.requestTimeout | quote }}}
+            - {name: ORKA_PUBLISHER_GITHUB_MAX_RESPONSE_BYTES, value: {{ printf "%d" (int64 .Values.publisher.githubPR.maxResponseBytes) | quote }}}
+            {{- end }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities: {drop: [ALL]}
+          resources:
+            {{- toYaml .Values.publisher.resources | nindent 12 }}
+          volumeMounts:
+            - {name: data, mountPath: /data}
+            - {name: tmp, mountPath: /tmp/orka-workspace-publisher}
+            - {name: publisher-auth, mountPath: /var/run/orka/publisher-auth/controller-token, subPath: controller-token, readOnly: true}
+            - {name: publisher-auth, mountPath: /var/run/orka/publisher-auth/operation-capability-secret, subPath: operation-capability-secret, readOnly: true}
+          readinessProbe:
+            httpGet: {path: /v1/health, port: http}
+          livenessProbe:
+            httpGet: {path: /v1/health, port: http}
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ include "orka.publisherName" . }}
+        - name: tmp
+          emptyDir: {sizeLimit: 1Gi}
+        - name: publisher-auth
+          secret:
+            secretName: {{ .Values.publisher.auth.existingSecret | default (include "orka.publisherAuthSecretName" .) }}
+            # subPath bind mounts expose regular files to the fail-closed
+            # publisher loader; fsGroup grants only the Pod group read access.
+            defaultMode: 0440
+            items:
+              - key: {{ .Values.publisher.auth.controllerTokenKey | default "controller-token" }}
+                path: controller-token
+              - key: {{ .Values.publisher.auth.capabilitySecretKey | default "operation-capability-secret" }}
+                path: operation-capability-secret
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/publisher-networkpolicy.yaml b/manifest_staging/charts/orka/templates/publisher-networkpolicy.yaml
new file mode 100644
index 000000000..7833f4c23
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/publisher-networkpolicy.yaml
@@ -0,0 +1,40 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "orka.publisherName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: workspace-publisher
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: controller
+      ports: [{protocol: TCP, port: 8080}]
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels: {kubernetes.io/metadata.name: kube-system}
+          podSelector:
+            matchLabels: {k8s-app: kube-dns}
+      ports: [{protocol: UDP, port: 53}, {protocol: TCP, port: 53}]
+    - to:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: controller
+      ports: [{protocol: TCP, port: {{ .Values.controller.apiPort }}}]
+    - to:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: scm-egress-proxy
+      ports: [{protocol: TCP, port: 8080}]
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/publisher-pvc.yaml b/manifest_staging/charts/orka/templates/publisher-pvc.yaml
new file mode 100644
index 000000000..4f503ec33
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/publisher-pvc.yaml
@@ -0,0 +1,17 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "orka.publisherName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: workspace-publisher
+spec:
+  accessModes: [ReadWriteOnce]
+  {{- if .Values.publisher.persistence.storageClass }}
+  storageClassName: {{ .Values.publisher.persistence.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.publisher.persistence.size }}
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/publisher-secret.yaml b/manifest_staging/charts/orka/templates/publisher-secret.yaml
new file mode 100644
index 000000000..1b36da859
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/publisher-secret.yaml
@@ -0,0 +1,23 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled (not .Values.publisher.auth.existingSecret) }}
+{{- $name := include "orka.publisherAuthSecretName" . }}
+{{- $existing := lookup "v1" "Secret" .Release.Namespace $name }}
+{{- $controllerKey := .Values.publisher.auth.controllerTokenKey | default "controller-token" }}
+{{- $capabilityKey := .Values.publisher.auth.capabilitySecretKey | default "operation-capability-secret" }}
+{{- $existingController := "" }}
+{{- $existingCapability := "" }}
+{{- if $existing }}
+{{- if hasKey $existing.data $controllerKey }}{{- $existingController = (index $existing.data $controllerKey | b64dec) }}{{- end }}
+{{- if hasKey $existing.data $capabilityKey }}{{- $existingCapability = (index $existing.data $capabilityKey | b64dec) }}{{- end }}
+{{- end }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $name }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: workspace-publisher
+type: Opaque
+stringData:
+  {{ $controllerKey }}: {{ default (default (randAlphaNum 64) $existingController) .Values.publisher.auth.controllerToken | quote }}
+  {{ $capabilityKey }}: {{ default (default (randAlphaNum 64) $existingCapability) .Values.publisher.auth.capabilitySecret | quote }}
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/publisher-service.yaml b/manifest_staging/charts/orka/templates/publisher-service.yaml
new file mode 100644
index 000000000..9b561dbfc
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/publisher-service.yaml
@@ -0,0 +1,17 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "orka.publisherName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: workspace-publisher
+spec:
+  selector:
+    {{- include "orka.selectorLabels" . | nindent 4 }}
+    app.kubernetes.io/component: workspace-publisher
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/rbac.yaml b/manifest_staging/charts/orka/templates/rbac.yaml
index be674d840..c4ffe2fa8 100644
--- a/manifest_staging/charts/orka/templates/rbac.yaml
+++ b/manifest_staging/charts/orka/templates/rbac.yaml
@@ -1,198 +1,263 @@
 {{- if .Values.rbac.create -}}
-# Controller ClusterRole
+{{- $harnessV2 := eq .Values.controller.mode "harness-v2" -}}
+# Controller tenant Role. The release namespace is also the immutable watch namespace.
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
+kind: Role
 metadata:
-  name: {{ include "orka.fullname" . }}-controller
+  name: {{ include "orka.controllerName" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "orka.labels" . | nindent 4 }}
 rules:
-  # Custom Resource permissions
   - apiGroups: ["core.orka.ai"]
-    resources: ["tasks", "tools", "agents", "agentruntimes", "providers", "skills", "repositorymonitors", "repositoryscans", "substrateactorpools", "outboundaccesspolicies"]
+    resources: ["tasks", "tools", "agents", "agentruntimes", "runtimepools", "promptattempts", "runtimesessioncontrols", "publications", "controllerepochs", "externaleffects", "providers", "skills", "repositorymonitors", "repositoryscans", "substrateactorpools", "outboundaccesspolicies"]
     verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
   - apiGroups: ["core.orka.ai"]
-    resources: ["tasks/status", "tools/status", "agents/status", "agentruntimes/status", "providers/status", "skills/status", "repositorymonitors/status", "repositoryscans/status", "substrateactorpools/status", "outboundaccesspolicies/status"]
+    resources: ["tasks/status", "tools/status", "agents/status", "agentruntimes/status", "runtimepools/status", "promptattempts/status", "runtimesessioncontrols/status", "publications/status", "controllerepochs/status", "externaleffects/status", "providers/status", "skills/status", "repositorymonitors/status", "repositoryscans/status", "substrateactorpools/status", "outboundaccesspolicies/status"]
     verbs: ["get", "update", "patch"]
   - apiGroups: ["core.orka.ai"]
-    resources: ["tasks/finalizers", "tools/finalizers", "agents/finalizers", "agentruntimes/finalizers", "providers/finalizers", "skills/finalizers", "repositorymonitors/finalizers", "repositoryscans/finalizers", "substrateactorpools/finalizers", "outboundaccesspolicies/finalizers"]
+    resources: ["tasks/finalizers", "tools/finalizers", "agents/finalizers", "agentruntimes/finalizers", "runtimepools/finalizers", "promptattempts/finalizers", "runtimesessioncontrols/finalizers", "publications/finalizers", "controllerepochs/finalizers", "externaleffects/finalizers", "providers/finalizers", "skills/finalizers", "repositorymonitors/finalizers", "repositoryscans/finalizers", "substrateactorpools/finalizers", "outboundaccesspolicies/finalizers"]
     verbs: ["update"]
+  {{- if $harnessV2 }}
   - apiGroups: ["gateway.orka.ai"]
-    resources: ["gatewayclasses", "gateways", "gatewaybindings"]
+    resources: ["gateways", "gatewaybindings"]
     verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
   - apiGroups: ["gateway.orka.ai"]
-    resources: ["gatewayclasses/status", "gateways/status", "gatewaybindings/status"]
+    resources: ["gateways/status", "gatewaybindings/status"]
     verbs: ["get", "update", "patch"]
   - apiGroups: ["gateway.orka.ai"]
-    resources: ["gatewayclasses/finalizers", "gateways/finalizers", "gatewaybindings/finalizers"]
+    resources: ["gateways/finalizers", "gatewaybindings/finalizers"]
     verbs: ["update"]
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    resourceNames: ["tasks.core.orka.ai", "gatewayclasses.gateway.orka.ai", "gateways.gateway.orka.ai", "gatewaybindings.gateway.orka.ai"]
-    verbs: ["get"]
-
-  # Provider-neutral Execution Workspace control plane
   - apiGroups: ["workspace.orka.ai"]
-    resources: ["executionworkspaceclasses"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete", "use"]
+    resources: ["executionworkspaces", "executionworkspaceclasses", "executionworkspacepools"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  # The workspace admission policies gate spec.coreAdmission writes on the
+  # "admit" verb and class-backed Task/Tool creation on the "use" verb, so the
+  # controller needs both or fail-closed admission rejects its own writes.
   - apiGroups: ["workspace.orka.ai"]
     resources: ["executionworkspaces"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete", "admit"]
-  - apiGroups: ["workspace.orka.ai"]
-    resources: ["executionworkspacepools"]
-    verbs: ["get", "list", "watch"]
+    verbs: ["admit"]
   - apiGroups: ["workspace.orka.ai"]
-    resources: ["executionworkspaceproviders"]
-    verbs: ["get", "list", "watch", "update", "patch"]
+    resources: ["executionworkspaceclasses"]
+    verbs: ["use"]
   - apiGroups: ["workspace.orka.ai"]
-    resources: ["executionworkspaceproviders/status", "executionworkspaceclasses/status", "executionworkspacepools/status", "executionworkspaces/status"]
+    resources: ["executionworkspaces/status", "executionworkspaceclasses/status", "executionworkspacepools/status"]
     verbs: ["get", "update", "patch"]
   - apiGroups: ["workspace.orka.ai"]
-    resources: ["executionworkspaceproviders/finalizers", "executionworkspaceclasses/finalizers", "executionworkspaces/finalizers"]
+    resources: ["executionworkspaces/finalizers", "executionworkspaceclasses/finalizers"]
     verbs: ["update"]
-
-  # Job permissions
+  - apiGroups: ["extensions.agents.x-k8s.io"]
+    resources: ["sandboxclaims"]
+    verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
+  - apiGroups: ["extensions.agents.x-k8s.io"]
+    resources: ["sandboxtemplates", "sandboxwarmpools"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["agents.x-k8s.io"]
+    resources: ["sandboxes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["ate.dev"]
+    resources: ["actortemplates"]
+    verbs: ["get", "list", "watch"]
+  {{- end }}
   - apiGroups: ["batch"]
     resources: ["jobs"]
     verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
   - apiGroups: ["batch"]
     resources: ["cronjobs"]
     verbs: ["get", "list", "watch"]
-
-  # Core resource permissions
   - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: [""]
-    resources: ["secrets"]
+    resources: ["configmaps", "secrets", "pods", "services"]
     verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "list", "watch"]
   - apiGroups: [""]
     resources: ["pods/log"]
     verbs: ["get"]
   - apiGroups: [""]
-    resources: ["pods/status"]
+    resources: ["pods/status", "endpoints", "persistentvolumeclaims", "replicationcontrollers"]
     verbs: ["get", "list", "watch"]
   - apiGroups: [""]
     resources: ["serviceaccounts"]
     verbs: ["get", "list", "watch", "create", "update"]
   - apiGroups: [""]
-    resources: ["serviceaccounts/token"]
+    resources: ["serviceaccounts/token", "pods/portforward"]
     verbs: ["create"]
-  - apiGroups: [""]
-    resources: ["namespaces"]
-    verbs: ["get", "list", "watch"]
   - apiGroups: [""]
     resources: ["events"]
     verbs: ["get", "list", "watch", "create", "patch"]
-  - apiGroups: [""]
-    resources: ["nodes", "services", "endpoints"]
-    verbs: ["get", "list", "watch"]
   - apiGroups: ["discovery.k8s.io"]
     resources: ["endpointslices"]
     verbs: ["get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["persistentvolumes", "persistentvolumeclaims", "replicationcontrollers"]
-    verbs: ["get", "list", "watch"]
-
-  # Workload resource permissions (read-only, for chat K8s tools)
   - apiGroups: ["apps"]
-    resources: ["deployments", "replicasets", "statefulsets", "daemonsets"]
+    resources: ["deployments", "replicasets"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["apps"]
+    resources: ["statefulsets", "daemonsets"]
     verbs: ["get", "list", "watch"]
   - apiGroups: ["networking.k8s.io"]
     resources: ["ingresses"]
     verbs: ["get", "list", "watch"]
   - apiGroups: ["networking.k8s.io"]
     resources: ["networkpolicies"]
-    verbs: ["get", "list", "watch", "create", "delete"]
-  # Agent sandbox workspace backend: create/reattach/delete claims and connect to sandbox pods
-  - apiGroups: ["extensions.agents.x-k8s.io"]
-    resources: ["sandboxclaims"]
-    verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
-  - apiGroups: ["extensions.agents.x-k8s.io"]
-    resources: ["sandboxtemplates", "sandboxwarmpools"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["agents.x-k8s.io"]
-    resources: ["sandboxes"]
-    verbs: ["get", "list", "watch"]
-  # Substrate workspace backend: validate approved ActorTemplates before job creation
-  - apiGroups: ["ate.dev"]
-    resources: ["actortemplates"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["pods/portforward"]
-    verbs: ["create"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
   - apiGroups: ["autoscaling"]
     resources: ["horizontalpodautoscalers"]
     verbs: ["get", "list", "watch"]
   - apiGroups: ["policy"]
     resources: ["poddisruptionbudgets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["storage.k8s.io"]
-    resources: ["storageclasses"]
-    verbs: ["get", "list", "watch"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
   - apiGroups: ["events.k8s.io"]
     resources: ["events"]
     verbs: ["get", "list"]
   - apiGroups: ["metrics.k8s.io"]
-    resources: ["pods", "nodes"]
+    resources: ["pods"]
     verbs: ["get", "list"]
-
-  # RBAC permissions (for chat K8s tools and managed worker bindings)
-  - apiGroups: ["rbac.authorization.k8s.io"]
-    resources: ["clusterroles", "roles", "rolebindings"]
-    verbs: ["get", "list", "watch"]
   - apiGroups: ["rbac.authorization.k8s.io"]
     resources: ["roles", "rolebindings"]
-    verbs: ["create", "update", "delete"]
-  - apiGroups: ["rbac.authorization.k8s.io"]
-    resources: ["clusterrolebindings"]
     verbs: ["get", "list", "watch", "create", "update", "delete"]
-  - apiGroups: ["rbac.authorization.k8s.io"]
-    resources: ["clusterroles"]
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "orka.controllerName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "orka.controllerName" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "orka.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- if $harnessV2 }}
+---
+# Runtime child resources are confined to the v2 installation's runtime namespace.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "orka.controllerName" . }}-runtime
+  namespace: {{ .Values.controller.acpRuntime.namespace }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+rules:
+  - apiGroups: ["apps"]
+    resources: ["deployments", "replicasets"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["pods", "services", "secrets"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["networkpolicies"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["policy"]
+    resources: ["poddisruptionbudgets"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "orka.controllerName" . }}-runtime
+  namespace: {{ .Values.controller.acpRuntime.namespace }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "orka.controllerName" . }}-runtime
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "orka.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}
+---
+# Minimal cluster-scoped controller authority. Namespaced workload access is never bound here.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "orka.controllerClusterRoleName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources: ["namespaces"]
     resourceNames:
-      - {{ include "orka.aiWorkerClusterRoleName" . }}
-      - {{ include "orka.vendorWorkerClusterRoleName" . }}
-      - {{ include "orka.containerWorkerClusterRoleName" . }}
-    verbs: ["bind"]
-
-  # TokenReview authenticates caller tokens; SubjectAccessReview authorizes Kubernetes callers
+      - {{ .Release.Namespace }}
+      {{- if $harnessV2 }}
+      - {{ .Values.controller.acpRuntime.namespace }}
+      {{- end }}
+    verbs: ["get"]
   - apiGroups: ["authentication.k8s.io"]
     resources: ["tokenreviews"]
     verbs: ["create"]
   - apiGroups: ["authorization.k8s.io"]
     resources: ["subjectaccessreviews"]
     verbs: ["create"]
-
-  # Leader election
-  - apiGroups: ["coordination.k8s.io"]
-    resources: ["leases"]
+  - apiGroups: ["rbac.authorization.k8s.io"]
+    resources: ["clusterroles"]
+    resourceNames:
+      - {{ include "orka.aiWorkerClusterRoleName" . }}
+      - {{ include "orka.vendorWorkerClusterRoleName" . }}
+      - {{ include "orka.containerWorkerClusterRoleName" . }}
+    verbs: ["bind"]
+  {{- if $harnessV2 }}
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    resourceNames: ["tasks.core.orka.ai", "gatewayclasses.gateway.orka.ai", "gateways.gateway.orka.ai", "gatewaybindings.gateway.orka.ai"]
+    verbs: ["get"]
+  - apiGroups: ["core.orka.ai"]
+    resources: ["branchclaims"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["core.orka.ai"]
+    resources: ["branchclaims/status"]
+    verbs: ["get", "update", "patch"]
+  - apiGroups: ["core.orka.ai"]
+    resources: ["branchclaims/finalizers"]
+    verbs: ["update"]
+  - apiGroups: ["gateway.orka.ai"]
+    resources: ["gatewayclasses"]
     verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["gateway.orka.ai"]
+    resources: ["gatewayclasses/status"]
+    verbs: ["get", "update", "patch"]
+  - apiGroups: ["gateway.orka.ai"]
+    resources: ["gatewayclasses/finalizers"]
+    verbs: ["update"]
+  - apiGroups: ["workspace.orka.ai"]
+    resources: ["executionworkspaceproviders"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: ["workspace.orka.ai"]
+    resources: ["executionworkspaceproviders/status"]
+    verbs: ["get", "update", "patch"]
+  - apiGroups: ["workspace.orka.ai"]
+    resources: ["executionworkspaceproviders/finalizers"]
+    verbs: ["update"]
+  {{- end }}
 ---
-# Controller ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ include "orka.fullname" . }}-controller
+  name: {{ include "orka.controllerClusterRoleName" . }}
   labels:
     {{- include "orka.labels" . | nindent 4 }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: {{ include "orka.fullname" . }}-controller
+  name: {{ include "orka.controllerClusterRoleName" . }}
 subjects:
   - kind: ServiceAccount
     name: {{ include "orka.serviceAccountName" . }}
     namespace: {{ .Release.Namespace }}
 ---
-# Client ClusterRole (for API access)
+# Client Role (for API access in this installation's namespace)
 {{- if .Values.client.create }}
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
+kind: Role
 metadata:
   name: {{ include "orka.fullname" . }}-client
+  namespace: {{ include "orka.clientNamespace" . }}
   labels:
     {{- include "orka.labels" . | nindent 4 }}
 rules:
@@ -227,10 +292,12 @@ rules:
     resources: ["skills"]
     verbs: ["get", "list", "watch"]
 
+  {{- if $harnessV2 }}
   # Generic gateway resource permissions (read-only; durable ledgers use the Orka REST API).
   - apiGroups: ["gateway.orka.ai"]
     resources: ["gateways", "gatewaybindings"]
     verbs: ["get", "list", "watch"]
+  {{- end }}
 
   # ConfigMap permissions (for results and sessions)
   - apiGroups: [""]
@@ -238,28 +305,21 @@ rules:
     verbs: ["get", "list", "watch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-{{- if .Values.controller.enforceNamespaceIsolation }}
 kind: RoleBinding
 metadata:
   name: {{ include "orka.fullname" . }}-client
   namespace: {{ include "orka.clientNamespace" . }}
   labels:
     {{- include "orka.labels" . | nindent 4 }}
-{{- else }}
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "orka.fullname" . }}-client
-  labels:
-    {{- include "orka.labels" . | nindent 4 }}
-{{- end }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
+  kind: Role
   name: {{ include "orka.fullname" . }}-client
 subjects:
   - kind: ServiceAccount
     name: {{ .Values.client.name }}
     namespace: {{ include "orka.clientNamespace" . }}
+{{- if $harnessV2 }}
 ---
 # GatewayClass is cluster-scoped, so isolated clients need a separate ClusterRoleBinding for read access.
 apiVersion: rbac.authorization.k8s.io/v1
@@ -288,6 +348,7 @@ subjects:
     name: {{ .Values.client.name }}
     namespace: {{ include "orka.clientNamespace" . }}
 {{- end }}
+{{- end }}
 ---
 # AI Worker Role (trusted worker with Kubernetes tool and code_exec permissions)
 apiVersion: rbac.authorization.k8s.io/v1
@@ -304,7 +365,7 @@ rules:
     resources: ["secrets"]
     verbs: ["get", "create", "update", "delete"]
   - apiGroups: ["core.orka.ai"]
-    resources: ["tools", "outboundaccesspolicies"]
+    resources: ["tools"]
     verbs: ["get", "list"]
   - apiGroups: ["core.orka.ai"]
     resources: ["agents"]
@@ -372,20 +433,12 @@ rules:
     verbs: ["get", "list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-{{- if .Values.controller.enforceNamespaceIsolation }}
 kind: RoleBinding
 metadata:
-  name: {{ include "orka.aiWorkerClusterRoleBindingName" . }}
+  name: {{ include "orka.aiWorkerRoleBindingName" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "orka.labels" . | nindent 4 }}
-{{- else }}
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "orka.aiWorkerClusterRoleBindingName" . }}
-  labels:
-    {{- include "orka.labels" . | nindent 4 }}
-{{- end }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -407,7 +460,7 @@ rules:
     resources: ["configmaps"]
     verbs: ["get", "list", "watch"]
   - apiGroups: ["core.orka.ai"]
-    resources: ["tools", "outboundaccesspolicies"]
+    resources: ["tools"]
     verbs: ["get", "list"]
   - apiGroups: ["core.orka.ai"]
     resources: ["agents"]
@@ -466,20 +519,12 @@ rules:
     verbs: ["get", "list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-{{- if .Values.controller.enforceNamespaceIsolation }}
 kind: RoleBinding
 metadata:
-  name: {{ include "orka.vendorWorkerClusterRoleBindingName" . }}
+  name: {{ include "orka.vendorWorkerRoleBindingName" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "orka.labels" . | nindent 4 }}
-{{- else }}
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "orka.vendorWorkerClusterRoleBindingName" . }}
-  labels:
-    {{- include "orka.labels" . | nindent 4 }}
-{{- end }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -506,20 +551,12 @@ rules:
     verbs: ["get"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-{{- if .Values.controller.enforceNamespaceIsolation }}
 kind: RoleBinding
 metadata:
-  name: {{ include "orka.containerWorkerClusterRoleBindingName" . }}
+  name: {{ include "orka.containerWorkerRoleBindingName" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "orka.labels" . | nindent 4 }}
-{{- else }}
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "orka.containerWorkerClusterRoleBindingName" . }}
-  labels:
-    {{- include "orka.labels" . | nindent 4 }}
-{{- end }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -528,48 +565,4 @@ subjects:
   - kind: ServiceAccount
     name: {{ include "orka.containerWorkerServiceAccountName" . }}
     namespace: {{ .Release.Namespace }}
-
----
-# Adapter charts aggregate read-only access to their provider-specific parameter CRDs here.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "orka.fullname" . }}-workspace-parameter-reader
-  labels:
-    {{- include "orka.labels" . | nindent 4 }}
-aggregationRule:
-  clusterRoleSelectors:
-    - matchLabels:
-        workspace.orka.ai/aggregate-to-parameter-reader: "true"
-rules: []
-{{- if .Values.controller.workspaceProvider.fakeProviderEnabled }}
----
-# Development-only fake provider parameters contribute to the aggregate reader.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "orka.fullname" . }}-fake-workspace-parameter-reader
-  labels:
-    {{- include "orka.labels" . | nindent 4 }}
-    workspace.orka.ai/aggregate-to-parameter-reader: "true"
-rules:
-  - apiGroups: ["fake.workspace.orka.ai"]
-    resources: ["fakeproviderconfigs", "fakepoolparameters"]
-    verbs: ["get", "list", "watch"]
-{{- end }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "orka.fullname" . }}-workspace-parameter-reader
-  labels:
-    {{- include "orka.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ include "orka.fullname" . }}-workspace-parameter-reader
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "orka.serviceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
 {{- end }}
diff --git a/manifest_staging/charts/orka/templates/runtime-namespace.yaml b/manifest_staging/charts/orka/templates/runtime-namespace.yaml
new file mode 100644
index 000000000..94295f497
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/runtime-namespace.yaml
@@ -0,0 +1,13 @@
+{{- if eq .Values.controller.mode "harness-v2" }}
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .Values.controller.acpRuntime.namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "orka.name" . }}
+    app.kubernetes.io/component: acp-runtime
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/warn: restricted
+    pod-security.kubernetes.io/audit: restricted
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/scm-egress-proxy-deployment.yaml b/manifest_staging/charts/orka/templates/scm-egress-proxy-deployment.yaml
new file mode 100644
index 000000000..434969dc6
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/scm-egress-proxy-deployment.yaml
@@ -0,0 +1,86 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled .Values.scmEgressProxy.enabled }}
+{{- $secretName := .Values.scmEgressProxy.auth.existingSecret | default (include "orka.scmEgressProxyAuthSecretName" .) }}
+{{- $tokenKey := .Values.scmEgressProxy.auth.tokenKey | default "token" }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "orka.scmEgressProxyName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: scm-egress-proxy
+spec:
+  replicas: 1
+  strategy: {type: Recreate}
+  selector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: scm-egress-proxy
+  template:
+    metadata:
+      {{- with .Values.scmEgressProxy.auth.rolloutNonce }}
+      annotations:
+        orka.ai/scm-egress-proxy-auth-rollout-nonce: {{ . | quote }}
+      {{- end }}
+      labels:
+        {{- include "orka.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: scm-egress-proxy
+        orka.ai/network-role: scm-egress-proxy
+    spec:
+      serviceAccountName: {{ include "orka.scmEgressProxyName" . }}
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile: {type: RuntimeDefault}
+      containers:
+        - name: proxy
+          image: {{ include "orka.imageRef" .Values.controller.image | quote }}
+          imagePullPolicy: {{ .Values.controller.image.pullPolicy }}
+          command: [/scm-egress-proxy]
+          args:
+            - --listen-address=:8080
+            - {{ printf "--allowed-hosts=%s" .Values.publisher.allowedSCMHosts | quote }}
+            {{- if .Values.publisher.githubPR.enabled }}
+            - {{ printf "--forge-api-base-url=%s" .Values.publisher.githubPR.apiBaseURL | quote }}
+            {{- else }}
+            - --forge-api-base-url=
+            {{- end }}
+            - --token-file=/var/run/secrets/orka/scm-egress/token
+            - {{ printf "--max-request-header-bytes=%d" (int64 .Values.scmEgressProxy.maxRequestHeaderBytes) | quote }}
+            - {{ printf "--max-response-header-bytes=%d" (int64 .Values.scmEgressProxy.maxResponseHeaderBytes) | quote }}
+            - {{ printf "--max-request-bytes=%d" (int64 .Values.scmEgressProxy.maxRequestBytes) | quote }}
+            - {{ printf "--max-response-bytes=%d" (int64 .Values.scmEgressProxy.maxResponseBytes) | quote }}
+            - {{ printf "--max-tunnel-bytes=%d" (int64 .Values.scmEgressProxy.maxTunnelBytes) | quote }}
+            - {{ printf "--max-concurrent=%v" .Values.scmEgressProxy.maxConcurrent | quote }}
+            - {{ printf "--resolution-timeout=%s" .Values.scmEgressProxy.resolutionTimeout | quote }}
+            - {{ printf "--connect-timeout=%s" .Values.scmEgressProxy.connectTimeout | quote }}
+            - {{ printf "--response-header-timeout=%s" .Values.scmEgressProxy.responseHeaderTimeout | quote }}
+            - {{ printf "--forward-timeout=%s" .Values.scmEgressProxy.forwardTimeout | quote }}
+            - {{ printf "--idle-timeout=%s" .Values.scmEgressProxy.idleTimeout | quote }}
+            - {{ printf "--tunnel-timeout=%s" .Values.scmEgressProxy.tunnelTimeout | quote }}
+          ports:
+            - {name: http-proxy, containerPort: 8080}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities: {drop: [ALL]}
+          resources:
+            {{- toYaml .Values.scmEgressProxy.resources | nindent 12 }}
+          readinessProbe:
+            httpGet: {path: /readyz, port: http-proxy}
+          livenessProbe:
+            httpGet: {path: /healthz, port: http-proxy}
+          volumeMounts:
+            - {name: auth, mountPath: /var/run/secrets/orka/scm-egress/token, subPath: token, readOnly: true}
+      volumes:
+        - name: auth
+          secret:
+            secretName: {{ $secretName }}
+            defaultMode: 0440
+            items:
+              - key: {{ $tokenKey }}
+                path: token
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/scm-egress-proxy-networkpolicy.yaml b/manifest_staging/charts/orka/templates/scm-egress-proxy-networkpolicy.yaml
new file mode 100644
index 000000000..0687aa907
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/scm-egress-proxy-networkpolicy.yaml
@@ -0,0 +1,63 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled .Values.scmEgressProxy.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "orka.scmEgressProxyName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "orka.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: scm-egress-proxy
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              {{- include "orka.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: workspace-publisher
+      ports: [{protocol: TCP, port: 8080}]
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels: {kubernetes.io/metadata.name: kube-system}
+          podSelector:
+            matchLabels: {k8s-app: kube-dns}
+      ports: [{protocol: UDP, port: 53}, {protocol: TCP, port: 53}]
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 0.0.0.0/8
+              - 10.0.0.0/8
+              - 100.64.0.0/10
+              - 127.0.0.0/8
+              - 169.254.0.0/16
+              - 172.16.0.0/12
+              - 192.0.0.0/24
+              - 192.0.2.0/24
+              - 192.168.0.0/16
+              - 198.18.0.0/15
+              - 198.51.100.0/24
+              - 203.0.113.0/24
+              - 224.0.0.0/4
+              - 240.0.0.0/4
+      ports: [{protocol: TCP, port: 443}]
+    - to:
+        - ipBlock:
+            cidr: ::/0
+            except:
+              - ::/128
+              - ::1/128
+              - 64:ff9b::/96
+              - 64:ff9b:1::/48
+              - 100::/64
+              - 2001::/32
+              - 2001:db8::/32
+              - 2002::/16
+              - fc00::/7
+              - fe80::/10
+              - ff00::/8
+      ports: [{protocol: TCP, port: 443}]
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/scm-egress-proxy-secret.yaml b/manifest_staging/charts/orka/templates/scm-egress-proxy-secret.yaml
new file mode 100644
index 000000000..609dd6cf9
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/scm-egress-proxy-secret.yaml
@@ -0,0 +1,21 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled .Values.scmEgressProxy.enabled (not .Values.scmEgressProxy.auth.existingSecret) }}
+{{- $name := include "orka.scmEgressProxyAuthSecretName" . }}
+{{- $key := .Values.scmEgressProxy.auth.tokenKey | default "token" }}
+{{- $explicit := .Values.scmEgressProxy.auth.token | default "" | toString }}
+{{- if and $explicit (not (regexMatch "^[A-Za-z0-9._~-]{32,256}$" $explicit)) }}
+{{- fail "scmEgressProxy.auth.token must contain 32-256 RFC 3986 unreserved characters" }}
+{{- end }}
+{{- $existing := lookup "v1" "Secret" .Release.Namespace $name }}
+{{- $existingValue := "" }}
+{{- if and $existing (hasKey $existing.data $key) }}{{- $existingValue = (index $existing.data $key | b64dec) }}{{- end }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $name }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: scm-egress-proxy
+type: Opaque
+stringData:
+  {{ $key }}: {{ default (default (randAlphaNum 64) $existingValue) $explicit | quote }}
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/scm-egress-proxy-service.yaml b/manifest_staging/charts/orka/templates/scm-egress-proxy-service.yaml
new file mode 100644
index 000000000..f57291c70
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/scm-egress-proxy-service.yaml
@@ -0,0 +1,15 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled .Values.scmEgressProxy.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "orka.scmEgressProxyName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: scm-egress-proxy
+spec:
+  selector:
+    {{- include "orka.selectorLabels" . | nindent 4 }}
+    app.kubernetes.io/component: scm-egress-proxy
+  ports:
+    - {name: http-proxy, port: 8080, targetPort: http-proxy}
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/scm-egress-proxy-serviceaccount.yaml b/manifest_staging/charts/orka/templates/scm-egress-proxy-serviceaccount.yaml
new file mode 100644
index 000000000..11fc06334
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/scm-egress-proxy-serviceaccount.yaml
@@ -0,0 +1,10 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled .Values.scmEgressProxy.enabled }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "orka.scmEgressProxyName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: scm-egress-proxy
+automountServiceAccountToken: false
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/serviceaccount.yaml b/manifest_staging/charts/orka/templates/serviceaccount.yaml
index e7c65e6b9..0bea13d7d 100644
--- a/manifest_staging/charts/orka/templates/serviceaccount.yaml
+++ b/manifest_staging/charts/orka/templates/serviceaccount.yaml
@@ -11,6 +11,21 @@ metadata:
   {{- end }}
 {{- end }}
 ---
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.publisher.enabled .Values.publisher.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "orka.publisherServiceAccountName" . }}
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: workspace-publisher
+  {{- with .Values.publisher.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: false
+{{- end }}
+---
 {{- if .Values.client.create }}
 apiVersion: v1
 kind: ServiceAccount
@@ -48,11 +63,3 @@ metadata:
     {{- include "orka.labels" . | nindent 4 }}
     orka.ai/worker: "true"
     orka.ai/worker-trust: "container"
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "orka.harnessWrapperName" . }}
-  labels:
-    {{- include "orka.labels" . | nindent 4 }}
-    app.kubernetes.io/component: agent-harness-wrapper
diff --git a/manifest_staging/charts/orka/templates/store-pvc.yaml b/manifest_staging/charts/orka/templates/store-pvc.yaml
index b13ba6e81..9463d9224 100644
--- a/manifest_staging/charts/orka/templates/store-pvc.yaml
+++ b/manifest_staging/charts/orka/templates/store-pvc.yaml
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: {{ include "orka.fullname" . }}-store
+  name: {{ include "orka.storeName" . }}
   labels:
     {{- include "orka.labels" . | nindent 4 }}
     app.kubernetes.io/component: store
diff --git a/manifest_staging/charts/orka/templates/vekil-ingress-networkpolicy.yaml b/manifest_staging/charts/orka/templates/vekil-ingress-networkpolicy.yaml
new file mode 100644
index 000000000..b5549c1e9
--- /dev/null
+++ b/manifest_staging/charts/orka/templates/vekil-ingress-networkpolicy.yaml
@@ -0,0 +1,24 @@
+{{- if and (eq .Values.controller.mode "harness-v2") .Values.providerProxy.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "orka.vekilIngressPolicyName" . }}
+  namespace: vekil-system
+  labels:
+    {{- include "orka.labels" . | nindent 4 }}
+    app.kubernetes.io/component: provider-auth-proxy
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: vekil
+  policyTypes: [Ingress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ .Release.Namespace }}
+          podSelector:
+            matchLabels:
+              orka.ai/network-role: provider-auth-proxy
+      ports: [{protocol: TCP, port: 1337}]
+{{- end }}
diff --git a/manifest_staging/charts/orka/templates/workspace-class-use-webhook.yaml b/manifest_staging/charts/orka/templates/workspace-class-use-webhook.yaml
deleted file mode 100644
index 216d9678f..000000000
--- a/manifest_staging/charts/orka/templates/workspace-class-use-webhook.yaml
+++ /dev/null
@@ -1,66 +0,0 @@
-{{- $workspaceProvider := .Values.controller.workspaceProvider | default dict -}}
-{{- $classUseAdmission := $workspaceProvider.classUseAdmission | default dict -}}
-{{- if $classUseAdmission.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "orka.fullname" . }}-workspace-webhook
-  labels:
-    {{- include "orka.labels" . | nindent 4 }}
-    app.kubernetes.io/component: controller
-spec:
-  ports:
-    - name: https
-      port: 443
-      targetPort: webhook-server
-      protocol: TCP
-  selector:
-    {{- include "orka.selectorLabels" . | nindent 4 }}
-    app.kubernetes.io/component: controller
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: {{ include "orka.fullname" . }}-workspace-class-use
-  labels:
-    {{- include "orka.labels" . | nindent 4 }}
-webhooks:
-  - name: taskworkspaceclassuse.core.orka.ai
-    admissionReviewVersions: ["v1"]
-    sideEffects: None
-    failurePolicy: Fail
-    matchPolicy: Equivalent
-    timeoutSeconds: 10
-    clientConfig:
-      service:
-        name: {{ include "orka.fullname" . }}-workspace-webhook
-        namespace: {{ .Release.Namespace }}
-        path: /validate-core-orka-ai-v1alpha1-task-workspace-class-use
-        port: 443
-      caBundle: {{ $classUseAdmission.caBundle | quote }}
-    rules:
-      - operations: ["CREATE", "UPDATE"]
-        apiGroups: ["core.orka.ai"]
-        apiVersions: ["v1alpha1"]
-        resources: ["tasks"]
-        scope: Namespaced
-  - name: toolworkspaceclassuse.core.orka.ai
-    admissionReviewVersions: ["v1"]
-    sideEffects: None
-    failurePolicy: Fail
-    matchPolicy: Equivalent
-    timeoutSeconds: 10
-    clientConfig:
-      service:
-        name: {{ include "orka.fullname" . }}-workspace-webhook
-        namespace: {{ .Release.Namespace }}
-        path: /validate-core-orka-ai-v1alpha1-tool-workspace-class-use
-        port: 443
-      caBundle: {{ $classUseAdmission.caBundle | quote }}
-    rules:
-      - operations: ["CREATE", "UPDATE"]
-        apiGroups: ["core.orka.ai"]
-        apiVersions: ["v1alpha1"]
-        resources: ["tools"]
-        scope: Namespaced
-{{- end }}
diff --git a/manifest_staging/charts/orka/templates/workspace-crd-upgrade-guard.yaml b/manifest_staging/charts/orka/templates/workspace-crd-upgrade-guard.yaml
deleted file mode 100644
index 561ba7849..000000000
--- a/manifest_staging/charts/orka/templates/workspace-crd-upgrade-guard.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-{{- $workspaceProvider := .Values.controller.workspaceProvider | default dict -}}
-{{- if $workspaceProvider.apiEnabled -}}
-{{- $workspaceCRD := lookup "apiextensions.k8s.io/v1" "CustomResourceDefinition" "" "executionworkspaces.workspace.orka.ai" -}}
-{{- $schemaReady := false -}}
-{{- if $workspaceCRD -}}
-  {{- range $version := $workspaceCRD.spec.versions -}}
-    {{- if eq $version.name "v1alpha1" -}}
-      {{- $properties := $version.schema.openAPIV3Schema.properties.spec.properties -}}
-      {{- if hasKey $properties "coreAdmission" -}}
-        {{- $schemaReady = true -}}
-      {{- end -}}
-    {{- end -}}
-  {{- end -}}
-{{- end -}}
-{{- $schemaCheckOverridden := $workspaceProvider.crdUpgradeSchemaVerified | default false -}}
-{{- if and (or .Release.IsUpgrade $workspaceCRD) (not $schemaReady) (not $schemaCheckOverridden) -}}
-  {{- fail "controller.workspaceProvider.apiEnabled requires the current workspace CRDs; apply them with `helm show crds <chart> | kubectl apply --server-side -f -`, or set controller.workspaceProvider.crdUpgradeSchemaVerified=true only for offline rendering after independent verification" -}}
-{{- end -}}
-{{- end -}}
diff --git a/manifest_staging/charts/orka/values.yaml b/manifest_staging/charts/orka/values.yaml
index b3aa75189..2b470dba3 100644
--- a/manifest_staging/charts/orka/values.yaml
+++ b/manifest_staging/charts/orka/values.yaml
@@ -2,6 +2,10 @@
 
 # Controller configuration
 controller:
+  # Required immutable execution contract for this installation. Install v1
+  # and v2 as separate releases; one release never serves both contracts.
+  mode: ""
+
   # Number of controller replicas
   replicas: 1
 
@@ -9,6 +13,7 @@ controller:
   image:
     repository: ghcr.io/orka-agents/orka
     tag: "0.1.1"
+    digest: ""
     pullPolicy: IfNotPresent
 
   # Resource limits
@@ -20,7 +25,8 @@ controller:
       cpu: 100m
       memory: 256Mi
 
-  # Watch namespace (empty for cluster-scoped)
+  # Required exclusive tenant namespace. Label it with
+  # orka.ai/controller-mode matching controller.mode before startup.
   watchNamespace: ""
 
   # API server port
@@ -32,37 +38,60 @@ controller:
   # Health probe port
   healthPort: 8082
 
-  # Enable leader election for HA
+  # Leader election is mandatory for the singleton SQLite controller.
   leaderElect: true
 
   # Log level (debug, info, warn, error)
   logLevel: info
 
-  # Enforce namespace isolation (restrict users to their SA namespace)
-  enforceNamespaceIsolation: true
-
   # Max active tasks per namespace (0 = unlimited)
   maxTasksPerNamespace: 0
 
-  # Provider-neutral workspace.orka.ai control plane (disabled by default during rollout).
-  # Before enabling it during a Helm upgrade, apply the current chart CRDs explicitly;
-  # Helm does not upgrade CRDs from the crds/ directory and the chart fails closed otherwise.
-  workspaceProvider:
-    # Enable generic provider/class/pool/workspace coordination controllers.
-    apiEnabled: false
-    # Offline helm template --is-upgrade cannot use lookup. Set this only after
-    # independently verifying/applying the current workspace CRD schema.
-    crdUpgradeSchemaVerified: false
-    # Enable the development-only fake provider adapter.
-    fakeProviderEnabled: false
-    # Fail-closed Kubernetes admission required whenever apiEnabled is true.
-    classUseAdmission:
-      enabled: false
-      # Existing TLS Secret with tls.crt and tls.key for the webhook Service DNS name.
-      existingSecret: ""
-      # Base64-encoded PEM CA bundle trusted by the API server.
-      caBundle: ""
-
+  # Operation-scoped ACP artifact transport stored on the controller PVC.
+  acpArtifact:
+    existingSecret: ""
+    secretKey: capability-secret
+    secret: ""
+    maxBytes: 536870912
+
+  # Encryption key for immutable agent execution snapshots. When either agent
+  # execution protocol is enabled, both fields must reference an existing
+  # Secret. The selected value must contain exactly 32 raw bytes or its base64
+  # encoding. The Secret name, item key, and selected key material must remain
+  # unchanged for the lifetime of the release so retained snapshots stay
+  # decryptable.
+  agentExecutionSnapshot:
+    existingSecret: ""
+    key: ""
+    # A snapshot must remain unreferenced for this full period before GC.
+    retention: 720h
+    # Reference-aware GC scan cadence.
+    retentionInterval: 1h
+
+  # Managed ACP core RuntimePools for built-in agent Tasks.
+  acpRuntime:
+    # Used only when controller.mode is harness-v2; there is no v1 fallback.
+    namespace: orka-runtimes
+    # The chart-managed provider proxy always runs in the Helm release namespace.
+    # Leave empty or set exactly to .Release.Namespace; other values are rejected.
+    providerProxyNamespace: ""
+    # Configure each provider that should be available with an immutable
+    # repository@sha256:<digest> reference. Empty providers remain unavailable
+    # and Tasks selecting them fail closed.
+    codexImage: ""
+    claudeImage: ""
+    copilotImage: ""
+    opencodeImage: ""
+    # Planned controller upgrades use a same-binary preStop child to call a
+    # loopback-only coordinator. Keep terminationGracePeriodSeconds greater
+    # than timeout and triggerTimeout so SIGTERM shutdown still has headroom.
+    upgradeDrain:
+      enabled: true
+      port: 8083
+      timeout: 5m
+      pollInterval: 1s
+      triggerTimeout: 5m15s
+      terminationGracePeriodSeconds: 360
   # Provider-neutral external gateway plane.
   gateway:
     enabled: true
@@ -199,6 +228,206 @@ controller:
     # Exact namespace/name:port tuples trusted for cross-namespace token endpoint refs.
     trustedTokenEndpointServices: []
 
+# Fail-closed admission served by this release's internal webhook Service. The
+# certificate must authenticate <release>-orka-webhook.<namespace>.svc.
+webhooks:
+  tls:
+    # Required. The chart never generates webhook certificates.
+    existingSecret: ""
+    certKey: tls.crt
+    privateKeyKey: tls.key
+  # Base64-encoded PEM CA bundle. Leave empty when an injector annotation is
+  # configured below.
+  caBundle: ""
+  # For example: cert-manager.io/inject-ca-from-secret: orka-v2/orka-webhook-tls
+  caInjectionAnnotations: {}
+  timeoutSeconds: 10
+
+# Clean-room Workspace/Publisher service.
+publisher:
+  enabled: true
+  image:
+    repository: ghcr.io/orka-agents/orka/workspace-publisher
+    tag: "0.1.1"
+    digest: ""
+    pullPolicy: IfNotPresent
+  allowedSCMHosts: github.com
+  githubPR:
+    enabled: true
+    apiBaseURL: https://api.github.com
+    requestTimeout: 15s
+    maxResponseBytes: 4194304
+  auth:
+    existingSecret: ""
+    controllerTokenKey: controller-token
+    capabilitySecretKey: operation-capability-secret
+    controllerToken: ""
+    capabilitySecret: ""
+    # Non-secret revision marker. When rotating the publisher auth Secret, bump
+    # this value in the same Helm upgrade to restart controller and publisher.
+    rolloutNonce: ""
+  serviceAccount:
+    create: true
+    name: ""
+    annotations: {}
+  persistence:
+    size: 2Gi
+    storageClass: ""
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+      ephemeral-storage: 512Mi
+    limits:
+      cpu: "2"
+      memory: 2Gi
+      ephemeral-storage: 2Gi
+
+# Authenticated, exact-host HTTPS egress boundary for the Workspace/Publisher.
+# The Publisher has no direct public 443 egress; Git and forge API traffic must
+# use this proxy, which re-resolves and validates every outbound connection.
+scmEgressProxy:
+  enabled: true
+  noProxy: localhost,127.0.0.1,::1,.svc,.cluster.local
+  maxRequestHeaderBytes: 32768
+  maxResponseHeaderBytes: 65536
+  maxRequestBytes: 4194304
+  maxResponseBytes: 8388608
+  maxTunnelBytes: 1073741824
+  maxConcurrent: 8
+  resolutionTimeout: 5s
+  connectTimeout: 10s
+  responseHeaderTimeout: 30s
+  forwardTimeout: 2m
+  idleTimeout: 30s
+  tunnelTimeout: 10m
+  auth:
+    existingSecret: ""
+    tokenKey: token
+    # Existing Secret tokens must use only RFC 3986 unreserved characters and
+    # be 32-256 bytes so they can be carried in authenticated proxy userinfo.
+    token: ""
+    # Non-secret revision marker. When rotating the SCM proxy auth Secret, bump
+    # this value in the same Helm upgrade to restart publisher and SCM proxy.
+    rolloutNonce: ""
+  resources:
+    requests:
+      cpu: 25m
+      memory: 32Mi
+      ephemeral-storage: 32Mi
+    limits:
+      cpu: 500m
+      memory: 256Mi
+      ephemeral-storage: 128Mi
+
+# Authenticated boundary in front of the otherwise unauthenticated Vekil
+# service. ACP RuntimePods can reach only this Service, never Vekil directly.
+providerProxy:
+  enabled: false
+  # Only this chart-supported Vekil Service endpoint is accepted. One trailing
+  # slash is normalized; alternate hosts, namespaces, and ports are rejected.
+  upstreamBaseURL: http://vekil.vekil-system.svc:1337
+  # Mounted Secret files are reloaded atomically; no proxy Pod restart is
+  # required for token changes. Reload failures make readiness fail and disable
+  # all authenticated forwarding until both files are valid again.
+  tokenReloadInterval: 5s
+  # Maximum remaining lifetime accepted from the overlap token's absolute
+  # deadline. Periodic reloads and Pod restarts cannot extend it. Maximum: 24h.
+  previousTokenOverlap: 10m
+  # Optional operator-controlled restart input for binary/flag changes or
+  # recovery. Change it to force only the provider-auth-proxy Pod to roll.
+  rolloutNonce: ""
+  auth:
+    existingSecret: ""
+    tokenKey: token
+    token: ""
+    # Optional overlap key/value. Existing single-token Secrets remain valid
+    # when this key is absent. For proxy-first rotation, publish new as current
+    # and old here, wait for proxy reload, then roll controller/runtime pools.
+    # For controller-first use, first pre-stage new here while current remains
+    # old and verify it through the proxy; only then publish new as current and
+    # old here and roll controller/runtime pools. The pre-staged token covers a
+    # controller request that arrives before the proxy observes the role swap.
+    # Remove the old token after all workloads advertise the new generation.
+    # previousTokenValidUntil must be an absolute RFC3339/RFC3339Nano time no
+    # later than previousTokenOverlap from when the proxy loads it.
+    previousTokenKey: previous-token
+    previousToken: ""
+    previousTokenValidUntilKey: previous-token-valid-until
+    previousTokenValidUntil: ""
+  resources:
+    requests:
+      cpu: 25m
+      memory: 32Mi
+      ephemeral-storage: 32Mi
+    limits:
+      cpu: 250m
+      memory: 128Mi
+      ephemeral-storage: 128Mi
+
+# orka.harness.v1 data plane configuration. It is rendered only when
+# controller.mode is harness-v1 and is never an ACP fallback.
+harnessV1:
+  dispatch:
+    interval: 1s
+    workers: 1
+  upgradeDrain:
+    # Before an upgrade, rollback, or deletion mutates an existing wrapper, a
+    # Helm hook durably closes admission and proves that no unsettled turns
+    # remain. Keep this below Helm's default five-minute operation timeout.
+    timeout: 4m
+    pollInterval: 2s
+    resources:
+      requests:
+        cpu: 10m
+        memory: 32Mi
+        ephemeral-storage: 16Mi
+      limits:
+        cpu: 100m
+        memory: 64Mi
+        ephemeral-storage: 64Mi
+  image:
+    repository: ghcr.io/orka-agents/orka/agent-harness-wrapper
+    tag: "0.1.1"
+    # Required when controller.mode is harness-v1. Tags are never accepted for
+    # a running wrapper.
+    digest: ""
+    pullPolicy: IfNotPresent
+  auth:
+    # Use a dedicated operator-created Secret. Bearer credentials are never
+    # accepted through Helm values or emitted into rendered release manifests.
+    # The Secret source and key are immutable while a harness-v1 wrapper
+    # Deployment exists because controller attempts pin its resourceVersion.
+    existingSecret: ""
+    tokenKey: token
+  tls:
+    # Use a different operator-created Secret containing tls.crt, tls.key, and
+    # ca.crt. Its serving certificate must authenticate the release-scoped
+    # Service DNS name: <release>-orka-agent-harness-wrapper.<namespace>.svc.
+    existingSecret: ""
+    # Bump this non-secret revision whenever certificate data changes without
+    # changing existingSecret. The chart drains the live wrapper before it
+    # restarts both the wrapper and controller onto the new TLS generation.
+    rolloutNonce: ""
+  ledger:
+    # The admission ledger is always PVC-backed when harness v1 is enabled.
+    size: 1Gi
+    storageClass: ""
+    # Controller-acknowledged terminal records remain replay-safe for this
+    # audit/backup window before bounded wrapper GC may reclaim them.
+    retention: 720h
+  # Codex defaults to workspace-write. Broader modes require explicit policy.
+  codexSandboxMode: workspace-write
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+      ephemeral-storage: 512Mi
+    limits:
+      cpu: "2"
+      memory: 2Gi
+      ephemeral-storage: 2Gi
+
 # Worker configuration
 workers:
   ai:
@@ -212,21 +441,6 @@ workers:
       repository: ghcr.io/orka-agents/orka/general-worker
       tag: "0.1.1"
 
-  harnessWrapper:
-    image:
-      repository: ghcr.io/orka-agents/orka/agent-harness-wrapper
-      tag: "0.1.1"
-      pullPolicy: IfNotPresent
-    auth:
-      # Existing Secret containing the shared wrapper bearer token.
-      # When existingSecret and token are both empty, Helm generates a release-local token.
-      existingSecret: ""
-      tokenKey: token
-      token: ""
-    # Optional Codex CLI sandbox mode for the Codex adapter.
-    codexSandboxMode: ""
-    resources: {}
-
 # GitHub webhook and label-trigger configuration.
 # Configure a repository webhook to POST to /webhooks/github with the secret below.
 github:
@@ -307,7 +521,7 @@ annotations: {}
 store:
   path: /data/orka.db
   persistence:
-    enabled: true        # durable gateway inbox/outbox and Session history require a PVC
+    enabled: true        # ACP control records, gateway history, and Session state require durable RWO storage
     size: 1Gi
     storageClass: ""     # use cluster default
     accessMode: ReadWriteOnce
@@ -318,6 +532,7 @@ client:
   create: true
   # Name of the client service account
   name: orka-client
-  # Namespace for the client service account. Empty defaults to controller.watchNamespace
-  # when namespace isolation is enforced and watchNamespace is set, otherwise the release namespace.
+  # Namespace for the client service account. Empty defaults to
+  # controller.watchNamespace. A different namespace is not supported by an
+  # isolated installation.
   namespace: ""
diff --git a/manifest_staging/deploy/orka.yaml b/manifest_staging/deploy/orka.yaml
index bf572f0b7..84548d354 100644
--- a/manifest_staging/deploy/orka.yaml
+++ b/manifest_staging/deploy/orka.yaml
@@ -2,9608 +2,36 @@ apiVersion: v1
 kind: Namespace
 metadata:
   labels:
+    app.kubernetes.io/component: acp-runtime
     app.kubernetes.io/managed-by: kustomize
     app.kubernetes.io/name: orka
-    control-plane: controller-manager
     pod-security.kubernetes.io/audit: restricted
     pod-security.kubernetes.io/enforce: baseline
     pod-security.kubernetes.io/warn: restricted
-  name: orka-system
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
-  name: agentruntimes.core.orka.ai
-spec:
-  group: core.orka.ai
-  names:
-    kind: AgentRuntime
-    listKind: AgentRuntimeList
-    plural: agentruntimes
-    singular: agentruntime
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .status.ready
-      name: Ready
-      type: boolean
-    - jsonPath: .spec.contractVersion
-      name: Contract
-      type: string
-    - jsonPath: .spec.deployment.mode
-      name: Mode
-      type: string
-    - jsonPath: .status.observedCapabilities.runtimeName
-      name: Runtime
-      type: string
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: AgentRuntime is the Schema for registered Orka harness runtimes.
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: AgentRuntimeRegistrySpec defines the desired state of a registered
-              Orka harness runtime.
-            properties:
-              capabilities:
-                description: Capabilities declares readiness requirements Orka checks
-                  against the runtime.
-                properties:
-                  brokeredToolClasses:
-                    description: BrokeredToolClasses lists brokered tool classes the
-                      runtime must advertise when brokered mode is required.
-                    items:
-                      description: AgentRuntimeBrokeredToolClass declares which classes
-                        of Orka-brokered tools a runtime can request.
-                      enum:
-                      - read
-                      - write
-                      - coordination
-                      type: string
-                    type: array
-                    x-kubernetes-list-type: set
-                  supportsArtifacts:
-                    description: SupportsArtifacts requires the runtime to advertise
-                      artifact/result reference support when true.
-                    type: boolean
-                  supportsCancel:
-                    description: SupportsCancel requires the runtime to advertise
-                      cancellation support when true.
-                    type: boolean
-                  supportsContinuation:
-                    description: SupportsContinuation requires the runtime to advertise
-                      continuation after Orka-brokered tool results when true.
-                    type: boolean
-                  supportsRuntimeSessions:
-                    description: SupportsRuntimeSessions requires the runtime to advertise
-                      stable runtime sessions when true.
-                    type: boolean
-                  toolExecutionModes:
-                    description: ToolExecutionModes lists tool execution modes the
-                      runtime must advertise.
-                    items:
-                      description: AgentRuntimeToolExecutionMode declares how custom
-                        runtimes interact with tools.
-                      enum:
-                      - observed
-                      - brokered
-                      type: string
-                    type: array
-                    x-kubernetes-list-type: set
-                type: object
-              clientAuth:
-                description: ClientAuth configures controller-to-runtime authentication.
-                properties:
-                  bearerTokenSecretRef:
-                    description: |-
-                      BearerAuthRef points to the bearer token Secret used for mutating harness endpoints.
-                      The referenced Secret must opt in with label orka.ai/agent-runtime-auth=true,
-                      may set orka.ai/agent-runtime-name=<runtime> to restrict use to one AgentRuntime,
-                      and must set annotation orka.ai/agent-runtime-endpoint=<deployment.endpoint> to bind the token to one endpoint.
-                    properties:
-                      key:
-                        description: Key is the Secret data key containing the bearer
-                          token.
-                        minLength: 1
-                        type: string
-                      name:
-                        description: Name is the Secret name.
-                        minLength: 1
-                        type: string
-                    required:
-                    - key
-                    - name
-                    type: object
-                required:
-                - bearerTokenSecretRef
-                type: object
-              contractVersion:
-                default: orka.harness.v1
-                description: ContractVersion is the Orka harness contract this runtime
-                  must implement.
-                enum:
-                - orka.harness.v1
-                type: string
-              deployment:
-                description: Deployment identifies the runtime endpoint provider.
-                properties:
-                  endpoint:
-                    description: |-
-                      Endpoint is the base URL for a pre-deployed or external orka.harness.v1 service.
-                      It must not contain credentials; bearer auth is configured via clientAuth.
-                    pattern: ^https?://[^\s@?#]+$
-                    type: string
-                  mode:
-                    description: Mode is the deployment mode. The first milestone
-                      supports external endpoints only.
-                    enum:
-                    - external-endpoint
-                    type: string
-                required:
-                - endpoint
-                - mode
-                type: object
-            required:
-            - clientAuth
-            - contractVersion
-            - deployment
-            type: object
-          status:
-            description: AgentRuntimeStatus defines the observed state of an AgentRuntime.
-            properties:
-              conditions:
-                description: Conditions represent the current state of the AgentRuntime.
-                items:
-                  description: Condition contains details for one aspect of the current
-                    state of this API Resource.
-                  properties:
-                    lastTransitionTime:
-                      description: |-
-                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                      format: date-time
-                      type: string
-                    message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
-                      maxLength: 32768
-                      type: string
-                    observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
-                      format: int64
-                      minimum: 0
-                      type: integer
-                    reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
-                      maxLength: 1024
-                      minLength: 1
-                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                      type: string
-                    status:
-                      description: status of the condition, one of True, False, Unknown.
-                      enum:
-                      - "True"
-                      - "False"
-                      - Unknown
-                      type: string
-                    type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                      maxLength: 316
-                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - message
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-                x-kubernetes-list-map-keys:
-                - type
-                x-kubernetes-list-type: map
-              lastValidated:
-                description: LastValidated is the timestamp of the last readiness
-                  probe.
-                format: date-time
-                type: string
-              message:
-                description: Message provides sanitized readiness context.
-                type: string
-              observedAuthRefResourceVersion:
-                description: |-
-                  ObservedAuthRefResourceVersion is the resourceVersion of the bearer auth Secret
-                  used for the last readiness probe. It is non-secret metadata used to decide
-                  when token rotation requires a fresh authenticated conformance turn.
-                type: string
-              observedCapabilities:
-                description: ObservedCapabilities contains sanitized capabilities
-                  from the last probe.
-                properties:
-                  brokeredToolClasses:
-                    description: BrokeredToolClasses are the brokered tool classes
-                      advertised by /v1/capabilities.
-                    items:
-                      description: AgentRuntimeBrokeredToolClass declares which classes
-                        of Orka-brokered tools a runtime can request.
-                      enum:
-                      - read
-                      - write
-                      - coordination
-                      type: string
-                    type: array
-                    x-kubernetes-list-type: set
-                  maxConcurrentTurns:
-                    description: MaxConcurrentTurns is the advertised concurrency
-                      ceiling.
-                    type: integer
-                  maxOutputBytes:
-                    description: MaxOutputBytes is the advertised maximum output payload
-                      size.
-                    format: int64
-                    type: integer
-                  maxTurnSeconds:
-                    description: MaxTurnSeconds is the advertised per-turn duration
-                      ceiling.
-                    type: integer
-                  protocolVersion:
-                    description: ProtocolVersion is the runtime's advertised Orka
-                      protocol version.
-                    type: string
-                  providerKind:
-                    description: ProviderKind is the provider kind advertised by /v1/capabilities.
-                    type: string
-                  runtimeName:
-                    description: RuntimeName is the runtime name advertised by /v1/capabilities.
-                    type: string
-                  runtimeVersion:
-                    description: RuntimeVersion is the runtime version advertised
-                      by /v1/capabilities.
-                    type: string
-                  supportsArtifacts:
-                    description: SupportsArtifacts reports whether the runtime advertises
-                      artifact/result reference support.
-                    type: boolean
-                  supportsCancel:
-                    description: SupportsCancel reports whether the runtime advertises
-                      cancellation support.
-                    type: boolean
-                  supportsContinuation:
-                    description: SupportsContinuation reports whether the runtime
-                      advertises continuation support.
-                    type: boolean
-                  supportsRuntimeSessions:
-                    description: SupportsRuntimeSessions reports whether the runtime
-                      advertises runtime-session support.
-                    type: boolean
-                  supportsSuspend:
-                    description: SupportsSuspend reports whether the runtime advertises
-                      suspend support.
-                    type: boolean
-                  supportsWorkspaceSnapshot:
-                    description: SupportsWorkspaceSnapshot reports whether the runtime
-                      advertises workspace snapshots.
-                    type: boolean
-                  toolExecutionModes:
-                    description: ToolExecutionModes are the tool modes advertised
-                      by /v1/capabilities.
-                    items:
-                      description: AgentRuntimeToolExecutionMode declares how custom
-                        runtimes interact with tools.
-                      enum:
-                      - observed
-                      - brokered
-                      type: string
-                    type: array
-                    x-kubernetes-list-type: set
-                  transport:
-                    description: Transport is the runtime transport, normally http+sse.
-                    type: string
-                type: object
-              observedGeneration:
-                description: ObservedGeneration is the latest generation reconciled
-                  into this status.
-                format: int64
-                type: integer
-              ready:
-                description: Ready indicates the runtime passed the configured Orka
-                  readiness checks.
-                type: boolean
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
-  name: agents.core.orka.ai
-spec:
-  group: core.orka.ai
-  names:
-    kind: Agent
-    listKind: AgentList
-    plural: agents
-    singular: agent
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .spec.model.provider
-      name: Provider
-      type: string
-    - jsonPath: .spec.model.name
-      name: Model
-      type: string
-    - jsonPath: .status.ready
-      name: Ready
-      type: boolean
-    - jsonPath: .status.activeTasks
-      name: Active
-      type: integer
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: Agent is the Schema for the agents API
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: AgentSpec defines the desired state of Agent
-            properties:
-              coordination:
-                description: Coordination enables agent-to-agent delegation
-                properties:
-                  allowedAgents:
-                    description: AllowedAgents lists agents this agent can delegate
-                      to
-                    items:
-                      description: AllowedAgent defines an agent that can be delegated
-                        to
-                      properties:
-                        name:
-                          description: Name is the name of the agent
-                          type: string
-                        namespace:
-                          description: Namespace is the namespace of the agent (defaults
-                            to same namespace)
-                          type: string
-                      required:
-                      - name
-                      type: object
-                    type: array
-                  approvalRequiredTools:
-                    description: |-
-                      ApprovalRequiredTools lists custom tool names that require a human approval before execution.
-                      This field is only honored when coordination is enabled and autonomous mode is true.
-                      Built-in tools such as request_approval, delegate_task, and web_search are rejected.
-                    items:
-                      type: string
-                    type: array
-                  autonomous:
-                    description: |-
-                      Autonomous enables autonomous loop mode for coordinator agents using this config.
-                      When enabled, the controller re-creates Jobs in a loop instead of marking the task as Succeeded.
-                    type: boolean
-                  enabled:
-                    default: false
-                    description: Enabled indicates if coordination is enabled
-                    type: boolean
-                  maxConcurrentChildren:
-                    default: 5
-                    description: MaxConcurrentChildren limits concurrent child tasks
-                    format: int32
-                    minimum: 1
-                    type: integer
-                  maxDepth:
-                    default: 3
-                    description: MaxDepth limits delegation depth to prevent infinite
-                      loops
-                    format: int32
-                    maximum: 10
-                    minimum: 1
-                    type: integer
-                  maxIterations:
-                    description: |-
-                      MaxIterations limits the number of autonomous loop iterations (0 = unlimited).
-                      Only used when Autonomous is true.
-                    format: int32
-                    minimum: 0
-                    type: integer
-                required:
-                - enabled
-                type: object
-              execution:
-                description: Execution defines default worker pod runtime and placement
-                  settings.
-                properties:
-                  affinity:
-                    description: Affinity defines Kubernetes affinity and anti-affinity
-                      rules for worker pods.
-                    properties:
-                      nodeAffinity:
-                        description: Describes node affinity scheduling rules for
-                          the pod.
-                        properties:
-                          preferredDuringSchedulingIgnoredDuringExecution:
-                            description: |-
-                              The scheduler will prefer to schedule pods to nodes that satisfy
-                              the affinity expressions specified by this field, but it may choose
-                              a node that violates one or more of the expressions. The node that is
-                              most preferred is the one with the greatest sum of weights, i.e.
-                              for each node that meets all of the scheduling requirements (resource
-                              request, requiredDuringScheduling affinity expressions, etc.),
-                              compute a sum by iterating through the elements of this field and adding
-                              "weight" to the sum if the node matches the corresponding matchExpressions; the
-                              node(s) with the highest sum are the most preferred.
-                            items:
-                              description: |-
-                                An empty preferred scheduling term matches all objects with implicit weight 0
-                                (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
-                              properties:
-                                preference:
-                                  description: A node selector term, associated with
-                                    the corresponding weight.
-                                  properties:
-                                    matchExpressions:
-                                      description: A list of node selector requirements
-                                        by node's labels.
-                                      items:
-                                        description: |-
-                                          A node selector requirement is a selector that contains values, a key, and an operator
-                                          that relates the key and values.
-                                        properties:
-                                          key:
-                                            description: The label key that the selector
-                                              applies to.
-                                            type: string
-                                          operator:
-                                            description: |-
-                                              Represents a key's relationship to a set of values.
-                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                            type: string
-                                          values:
-                                            description: |-
-                                              An array of string values. If the operator is In or NotIn,
-                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                              the values array must be empty. If the operator is Gt or Lt, the values
-                                              array must have a single element, which will be interpreted as an integer.
-                                              This array is replaced during a strategic merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                            x-kubernetes-list-type: atomic
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    matchFields:
-                                      description: A list of node selector requirements
-                                        by node's fields.
-                                      items:
-                                        description: |-
-                                          A node selector requirement is a selector that contains values, a key, and an operator
-                                          that relates the key and values.
-                                        properties:
-                                          key:
-                                            description: The label key that the selector
-                                              applies to.
-                                            type: string
-                                          operator:
-                                            description: |-
-                                              Represents a key's relationship to a set of values.
-                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                            type: string
-                                          values:
-                                            description: |-
-                                              An array of string values. If the operator is In or NotIn,
-                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                              the values array must be empty. If the operator is Gt or Lt, the values
-                                              array must have a single element, which will be interpreted as an integer.
-                                              This array is replaced during a strategic merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                            x-kubernetes-list-type: atomic
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                                weight:
-                                  description: Weight associated with matching the
-                                    corresponding nodeSelectorTerm, in the range 1-100.
-                                  format: int32
-                                  type: integer
-                              required:
-                              - preference
-                              - weight
-                              type: object
-                            type: array
-                            x-kubernetes-list-type: atomic
-                          requiredDuringSchedulingIgnoredDuringExecution:
-                            description: |-
-                              If the affinity requirements specified by this field are not met at
-                              scheduling time, the pod will not be scheduled onto the node.
-                              If the affinity requirements specified by this field cease to be met
-                              at some point during pod execution (e.g. due to an update), the system
-                              may or may not try to eventually evict the pod from its node.
-                            properties:
-                              nodeSelectorTerms:
-                                description: Required. A list of node selector terms.
-                                  The terms are ORed.
-                                items:
-                                  description: |-
-                                    A null or empty node selector term matches no objects. The requirements of
-                                    them are ANDed.
-                                    The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
-                                  properties:
-                                    matchExpressions:
-                                      description: A list of node selector requirements
-                                        by node's labels.
-                                      items:
-                                        description: |-
-                                          A node selector requirement is a selector that contains values, a key, and an operator
-                                          that relates the key and values.
-                                        properties:
-                                          key:
-                                            description: The label key that the selector
-                                              applies to.
-                                            type: string
-                                          operator:
-                                            description: |-
-                                              Represents a key's relationship to a set of values.
-                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                            type: string
-                                          values:
-                                            description: |-
-                                              An array of string values. If the operator is In or NotIn,
-                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                              the values array must be empty. If the operator is Gt or Lt, the values
-                                              array must have a single element, which will be interpreted as an integer.
-                                              This array is replaced during a strategic merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                            x-kubernetes-list-type: atomic
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    matchFields:
-                                      description: A list of node selector requirements
-                                        by node's fields.
-                                      items:
-                                        description: |-
-                                          A node selector requirement is a selector that contains values, a key, and an operator
-                                          that relates the key and values.
-                                        properties:
-                                          key:
-                                            description: The label key that the selector
-                                              applies to.
-                                            type: string
-                                          operator:
-                                            description: |-
-                                              Represents a key's relationship to a set of values.
-                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                            type: string
-                                          values:
-                                            description: |-
-                                              An array of string values. If the operator is In or NotIn,
-                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                              the values array must be empty. If the operator is Gt or Lt, the values
-                                              array must have a single element, which will be interpreted as an integer.
-                                              This array is replaced during a strategic merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                            x-kubernetes-list-type: atomic
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                                type: array
-                                x-kubernetes-list-type: atomic
-                            required:
-                            - nodeSelectorTerms
-                            type: object
-                            x-kubernetes-map-type: atomic
-                        type: object
-                      podAffinity:
-                        description: Describes pod affinity scheduling rules (e.g.
-                          co-locate this pod in the same node, zone, etc. as some
-                          other pod(s)).
-                        properties:
-                          preferredDuringSchedulingIgnoredDuringExecution:
-                            description: |-
-                              The scheduler will prefer to schedule pods to nodes that satisfy
-                              the affinity expressions specified by this field, but it may choose
-                              a node that violates one or more of the expressions. The node that is
-                              most preferred is the one with the greatest sum of weights, i.e.
-                              for each node that meets all of the scheduling requirements (resource
-                              request, requiredDuringScheduling affinity expressions, etc.),
-                              compute a sum by iterating through the elements of this field and adding
-                              "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                              node(s) with the highest sum are the most preferred.
-                            items:
-                              description: The weights of all of the matched WeightedPodAffinityTerm
-                                fields are added per-node to find the most preferred
-                                node(s)
-                              properties:
-                                podAffinityTerm:
-                                  description: Required. A pod affinity term, associated
-                                    with the corresponding weight.
-                                  properties:
-                                    labelSelector:
-                                      description: |-
-                                        A label query over a set of resources, in this case pods.
-                                        If it's null, this PodAffinityTerm matches with no Pods.
-                                      properties:
-                                        matchExpressions:
-                                          description: matchExpressions is a list
-                                            of label selector requirements. The requirements
-                                            are ANDed.
-                                          items:
-                                            description: |-
-                                              A label selector requirement is a selector that contains values, a key, and an operator that
-                                              relates the key and values.
-                                            properties:
-                                              key:
-                                                description: key is the label key
-                                                  that the selector applies to.
-                                                type: string
-                                              operator:
-                                                description: |-
-                                                  operator represents a key's relationship to a set of values.
-                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                type: string
-                                              values:
-                                                description: |-
-                                                  values is an array of string values. If the operator is In or NotIn,
-                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                  the values array must be empty. This array is replaced during a strategic
-                                                  merge patch.
-                                                items:
-                                                  type: string
-                                                type: array
-                                                x-kubernetes-list-type: atomic
-                                            required:
-                                            - key
-                                            - operator
-                                            type: object
-                                          type: array
-                                          x-kubernetes-list-type: atomic
-                                        matchLabels:
-                                          additionalProperties:
-                                            type: string
-                                          description: |-
-                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                          type: object
-                                      type: object
-                                      x-kubernetes-map-type: atomic
-                                    matchLabelKeys:
-                                      description: |-
-                                        MatchLabelKeys is a set of pod label keys to select which pods will
-                                        be taken into consideration. The keys are used to lookup values from the
-                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                        to select the group of existing pods which pods will be taken into consideration
-                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                        pod labels will be ignored. The default value is empty.
-                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                      items:
-                                        type: string
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    mismatchLabelKeys:
-                                      description: |-
-                                        MismatchLabelKeys is a set of pod label keys to select which pods will
-                                        be taken into consideration. The keys are used to lookup values from the
-                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                        to select the group of existing pods which pods will be taken into consideration
-                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                        pod labels will be ignored. The default value is empty.
-                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                      items:
-                                        type: string
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    namespaceSelector:
-                                      description: |-
-                                        A label query over the set of namespaces that the term applies to.
-                                        The term is applied to the union of the namespaces selected by this field
-                                        and the ones listed in the namespaces field.
-                                        null selector and null or empty namespaces list means "this pod's namespace".
-                                        An empty selector ({}) matches all namespaces.
-                                      properties:
-                                        matchExpressions:
-                                          description: matchExpressions is a list
-                                            of label selector requirements. The requirements
-                                            are ANDed.
-                                          items:
-                                            description: |-
-                                              A label selector requirement is a selector that contains values, a key, and an operator that
-                                              relates the key and values.
-                                            properties:
-                                              key:
-                                                description: key is the label key
-                                                  that the selector applies to.
-                                                type: string
-                                              operator:
-                                                description: |-
-                                                  operator represents a key's relationship to a set of values.
-                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                type: string
-                                              values:
-                                                description: |-
-                                                  values is an array of string values. If the operator is In or NotIn,
-                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                  the values array must be empty. This array is replaced during a strategic
-                                                  merge patch.
-                                                items:
-                                                  type: string
-                                                type: array
-                                                x-kubernetes-list-type: atomic
-                                            required:
-                                            - key
-                                            - operator
-                                            type: object
-                                          type: array
-                                          x-kubernetes-list-type: atomic
-                                        matchLabels:
-                                          additionalProperties:
-                                            type: string
-                                          description: |-
-                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                          type: object
-                                      type: object
-                                      x-kubernetes-map-type: atomic
-                                    namespaces:
-                                      description: |-
-                                        namespaces specifies a static list of namespace names that the term applies to.
-                                        The term is applied to the union of the namespaces listed in this field
-                                        and the ones selected by namespaceSelector.
-                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                      items:
-                                        type: string
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    topologyKey:
-                                      description: |-
-                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                        whose value of the label with key topologyKey matches that of any node on which any of the
-                                        selected pods is running.
-                                        Empty topologyKey is not allowed.
-                                      type: string
-                                  required:
-                                  - topologyKey
-                                  type: object
-                                weight:
-                                  description: |-
-                                    weight associated with matching the corresponding podAffinityTerm,
-                                    in the range 1-100.
-                                  format: int32
-                                  type: integer
-                              required:
-                              - podAffinityTerm
-                              - weight
-                              type: object
-                            type: array
-                            x-kubernetes-list-type: atomic
-                          requiredDuringSchedulingIgnoredDuringExecution:
-                            description: |-
-                              If the affinity requirements specified by this field are not met at
-                              scheduling time, the pod will not be scheduled onto the node.
-                              If the affinity requirements specified by this field cease to be met
-                              at some point during pod execution (e.g. due to a pod label update), the
-                              system may or may not try to eventually evict the pod from its node.
-                              When there are multiple elements, the lists of nodes corresponding to each
-                              podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                            items:
-                              description: |-
-                                Defines a set of pods (namely those matching the labelSelector
-                                relative to the given namespace(s)) that this pod should be
-                                co-located (affinity) or not co-located (anti-affinity) with,
-                                where co-located is defined as running on a node whose value of
-                                the label with key <topologyKey> matches that of any node on which
-                                a pod of the set of pods is running
-                              properties:
-                                labelSelector:
-                                  description: |-
-                                    A label query over a set of resources, in this case pods.
-                                    If it's null, this PodAffinityTerm matches with no Pods.
-                                  properties:
-                                    matchExpressions:
-                                      description: matchExpressions is a list of label
-                                        selector requirements. The requirements are
-                                        ANDed.
-                                      items:
-                                        description: |-
-                                          A label selector requirement is a selector that contains values, a key, and an operator that
-                                          relates the key and values.
-                                        properties:
-                                          key:
-                                            description: key is the label key that
-                                              the selector applies to.
-                                            type: string
-                                          operator:
-                                            description: |-
-                                              operator represents a key's relationship to a set of values.
-                                              Valid operators are In, NotIn, Exists and DoesNotExist.
-                                            type: string
-                                          values:
-                                            description: |-
-                                              values is an array of string values. If the operator is In or NotIn,
-                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                              the values array must be empty. This array is replaced during a strategic
-                                              merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                            x-kubernetes-list-type: atomic
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    matchLabels:
-                                      additionalProperties:
-                                        type: string
-                                      description: |-
-                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                      type: object
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                                matchLabelKeys:
-                                  description: |-
-                                    MatchLabelKeys is a set of pod label keys to select which pods will
-                                    be taken into consideration. The keys are used to lookup values from the
-                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                    to select the group of existing pods which pods will be taken into consideration
-                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                    pod labels will be ignored. The default value is empty.
-                                    The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                    Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                  items:
-                                    type: string
-                                  type: array
-                                  x-kubernetes-list-type: atomic
-                                mismatchLabelKeys:
-                                  description: |-
-                                    MismatchLabelKeys is a set of pod label keys to select which pods will
-                                    be taken into consideration. The keys are used to lookup values from the
-                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                    to select the group of existing pods which pods will be taken into consideration
-                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                    pod labels will be ignored. The default value is empty.
-                                    The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                    Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                  items:
-                                    type: string
-                                  type: array
-                                  x-kubernetes-list-type: atomic
-                                namespaceSelector:
-                                  description: |-
-                                    A label query over the set of namespaces that the term applies to.
-                                    The term is applied to the union of the namespaces selected by this field
-                                    and the ones listed in the namespaces field.
-                                    null selector and null or empty namespaces list means "this pod's namespace".
-                                    An empty selector ({}) matches all namespaces.
-                                  properties:
-                                    matchExpressions:
-                                      description: matchExpressions is a list of label
-                                        selector requirements. The requirements are
-                                        ANDed.
-                                      items:
-                                        description: |-
-                                          A label selector requirement is a selector that contains values, a key, and an operator that
-                                          relates the key and values.
-                                        properties:
-                                          key:
-                                            description: key is the label key that
-                                              the selector applies to.
-                                            type: string
-                                          operator:
-                                            description: |-
-                                              operator represents a key's relationship to a set of values.
-                                              Valid operators are In, NotIn, Exists and DoesNotExist.
-                                            type: string
-                                          values:
-                                            description: |-
-                                              values is an array of string values. If the operator is In or NotIn,
-                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                              the values array must be empty. This array is replaced during a strategic
-                                              merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                            x-kubernetes-list-type: atomic
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    matchLabels:
-                                      additionalProperties:
-                                        type: string
-                                      description: |-
-                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                      type: object
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                                namespaces:
-                                  description: |-
-                                    namespaces specifies a static list of namespace names that the term applies to.
-                                    The term is applied to the union of the namespaces listed in this field
-                                    and the ones selected by namespaceSelector.
-                                    null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                  items:
-                                    type: string
-                                  type: array
-                                  x-kubernetes-list-type: atomic
-                                topologyKey:
-                                  description: |-
-                                    This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                    the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                    whose value of the label with key topologyKey matches that of any node on which any of the
-                                    selected pods is running.
-                                    Empty topologyKey is not allowed.
-                                  type: string
-                              required:
-                              - topologyKey
-                              type: object
-                            type: array
-                            x-kubernetes-list-type: atomic
-                        type: object
-                      podAntiAffinity:
-                        description: Describes pod anti-affinity scheduling rules
-                          (e.g. avoid putting this pod in the same node, zone, etc.
-                          as some other pod(s)).
-                        properties:
-                          preferredDuringSchedulingIgnoredDuringExecution:
-                            description: |-
-                              The scheduler will prefer to schedule pods to nodes that satisfy
-                              the anti-affinity expressions specified by this field, but it may choose
-                              a node that violates one or more of the expressions. The node that is
-                              most preferred is the one with the greatest sum of weights, i.e.
-                              for each node that meets all of the scheduling requirements (resource
-                              request, requiredDuringScheduling anti-affinity expressions, etc.),
-                              compute a sum by iterating through the elements of this field and subtracting
-                              "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                              node(s) with the highest sum are the most preferred.
-                            items:
-                              description: The weights of all of the matched WeightedPodAffinityTerm
-                                fields are added per-node to find the most preferred
-                                node(s)
-                              properties:
-                                podAffinityTerm:
-                                  description: Required. A pod affinity term, associated
-                                    with the corresponding weight.
-                                  properties:
-                                    labelSelector:
-                                      description: |-
-                                        A label query over a set of resources, in this case pods.
-                                        If it's null, this PodAffinityTerm matches with no Pods.
-                                      properties:
-                                        matchExpressions:
-                                          description: matchExpressions is a list
-                                            of label selector requirements. The requirements
-                                            are ANDed.
-                                          items:
-                                            description: |-
-                                              A label selector requirement is a selector that contains values, a key, and an operator that
-                                              relates the key and values.
-                                            properties:
-                                              key:
-                                                description: key is the label key
-                                                  that the selector applies to.
-                                                type: string
-                                              operator:
-                                                description: |-
-                                                  operator represents a key's relationship to a set of values.
-                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                type: string
-                                              values:
-                                                description: |-
-                                                  values is an array of string values. If the operator is In or NotIn,
-                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                  the values array must be empty. This array is replaced during a strategic
-                                                  merge patch.
-                                                items:
-                                                  type: string
-                                                type: array
-                                                x-kubernetes-list-type: atomic
-                                            required:
-                                            - key
-                                            - operator
-                                            type: object
-                                          type: array
-                                          x-kubernetes-list-type: atomic
-                                        matchLabels:
-                                          additionalProperties:
-                                            type: string
-                                          description: |-
-                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                          type: object
-                                      type: object
-                                      x-kubernetes-map-type: atomic
-                                    matchLabelKeys:
-                                      description: |-
-                                        MatchLabelKeys is a set of pod label keys to select which pods will
-                                        be taken into consideration. The keys are used to lookup values from the
-                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                        to select the group of existing pods which pods will be taken into consideration
-                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                        pod labels will be ignored. The default value is empty.
-                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                      items:
-                                        type: string
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    mismatchLabelKeys:
-                                      description: |-
-                                        MismatchLabelKeys is a set of pod label keys to select which pods will
-                                        be taken into consideration. The keys are used to lookup values from the
-                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                        to select the group of existing pods which pods will be taken into consideration
-                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                        pod labels will be ignored. The default value is empty.
-                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                      items:
-                                        type: string
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    namespaceSelector:
-                                      description: |-
-                                        A label query over the set of namespaces that the term applies to.
-                                        The term is applied to the union of the namespaces selected by this field
-                                        and the ones listed in the namespaces field.
-                                        null selector and null or empty namespaces list means "this pod's namespace".
-                                        An empty selector ({}) matches all namespaces.
-                                      properties:
-                                        matchExpressions:
-                                          description: matchExpressions is a list
-                                            of label selector requirements. The requirements
-                                            are ANDed.
-                                          items:
-                                            description: |-
-                                              A label selector requirement is a selector that contains values, a key, and an operator that
-                                              relates the key and values.
-                                            properties:
-                                              key:
-                                                description: key is the label key
-                                                  that the selector applies to.
-                                                type: string
-                                              operator:
-                                                description: |-
-                                                  operator represents a key's relationship to a set of values.
-                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                type: string
-                                              values:
-                                                description: |-
-                                                  values is an array of string values. If the operator is In or NotIn,
-                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                  the values array must be empty. This array is replaced during a strategic
-                                                  merge patch.
-                                                items:
-                                                  type: string
-                                                type: array
-                                                x-kubernetes-list-type: atomic
-                                            required:
-                                            - key
-                                            - operator
-                                            type: object
-                                          type: array
-                                          x-kubernetes-list-type: atomic
-                                        matchLabels:
-                                          additionalProperties:
-                                            type: string
-                                          description: |-
-                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                          type: object
-                                      type: object
-                                      x-kubernetes-map-type: atomic
-                                    namespaces:
-                                      description: |-
-                                        namespaces specifies a static list of namespace names that the term applies to.
-                                        The term is applied to the union of the namespaces listed in this field
-                                        and the ones selected by namespaceSelector.
-                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                      items:
-                                        type: string
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    topologyKey:
-                                      description: |-
-                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                        whose value of the label with key topologyKey matches that of any node on which any of the
-                                        selected pods is running.
-                                        Empty topologyKey is not allowed.
-                                      type: string
-                                  required:
-                                  - topologyKey
-                                  type: object
-                                weight:
-                                  description: |-
-                                    weight associated with matching the corresponding podAffinityTerm,
-                                    in the range 1-100.
-                                  format: int32
-                                  type: integer
-                              required:
-                              - podAffinityTerm
-                              - weight
-                              type: object
-                            type: array
-                            x-kubernetes-list-type: atomic
-                          requiredDuringSchedulingIgnoredDuringExecution:
-                            description: |-
-                              If the anti-affinity requirements specified by this field are not met at
-                              scheduling time, the pod will not be scheduled onto the node.
-                              If the anti-affinity requirements specified by this field cease to be met
-                              at some point during pod execution (e.g. due to a pod label update), the
-                              system may or may not try to eventually evict the pod from its node.
-                              When there are multiple elements, the lists of nodes corresponding to each
-                              podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                            items:
-                              description: |-
-                                Defines a set of pods (namely those matching the labelSelector
-                                relative to the given namespace(s)) that this pod should be
-                                co-located (affinity) or not co-located (anti-affinity) with,
-                                where co-located is defined as running on a node whose value of
-                                the label with key <topologyKey> matches that of any node on which
-                                a pod of the set of pods is running
-                              properties:
-                                labelSelector:
-                                  description: |-
-                                    A label query over a set of resources, in this case pods.
-                                    If it's null, this PodAffinityTerm matches with no Pods.
-                                  properties:
-                                    matchExpressions:
-                                      description: matchExpressions is a list of label
-                                        selector requirements. The requirements are
-                                        ANDed.
-                                      items:
-                                        description: |-
-                                          A label selector requirement is a selector that contains values, a key, and an operator that
-                                          relates the key and values.
-                                        properties:
-                                          key:
-                                            description: key is the label key that
-                                              the selector applies to.
-                                            type: string
-                                          operator:
-                                            description: |-
-                                              operator represents a key's relationship to a set of values.
-                                              Valid operators are In, NotIn, Exists and DoesNotExist.
-                                            type: string
-                                          values:
-                                            description: |-
-                                              values is an array of string values. If the operator is In or NotIn,
-                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                              the values array must be empty. This array is replaced during a strategic
-                                              merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                            x-kubernetes-list-type: atomic
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    matchLabels:
-                                      additionalProperties:
-                                        type: string
-                                      description: |-
-                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                      type: object
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                                matchLabelKeys:
-                                  description: |-
-                                    MatchLabelKeys is a set of pod label keys to select which pods will
-                                    be taken into consideration. The keys are used to lookup values from the
-                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                    to select the group of existing pods which pods will be taken into consideration
-                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                    pod labels will be ignored. The default value is empty.
-                                    The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                    Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                  items:
-                                    type: string
-                                  type: array
-                                  x-kubernetes-list-type: atomic
-                                mismatchLabelKeys:
-                                  description: |-
-                                    MismatchLabelKeys is a set of pod label keys to select which pods will
-                                    be taken into consideration. The keys are used to lookup values from the
-                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                    to select the group of existing pods which pods will be taken into consideration
-                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                    pod labels will be ignored. The default value is empty.
-                                    The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                    Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                  items:
-                                    type: string
-                                  type: array
-                                  x-kubernetes-list-type: atomic
-                                namespaceSelector:
-                                  description: |-
-                                    A label query over the set of namespaces that the term applies to.
-                                    The term is applied to the union of the namespaces selected by this field
-                                    and the ones listed in the namespaces field.
-                                    null selector and null or empty namespaces list means "this pod's namespace".
-                                    An empty selector ({}) matches all namespaces.
-                                  properties:
-                                    matchExpressions:
-                                      description: matchExpressions is a list of label
-                                        selector requirements. The requirements are
-                                        ANDed.
-                                      items:
-                                        description: |-
-                                          A label selector requirement is a selector that contains values, a key, and an operator that
-                                          relates the key and values.
-                                        properties:
-                                          key:
-                                            description: key is the label key that
-                                              the selector applies to.
-                                            type: string
-                                          operator:
-                                            description: |-
-                                              operator represents a key's relationship to a set of values.
-                                              Valid operators are In, NotIn, Exists and DoesNotExist.
-                                            type: string
-                                          values:
-                                            description: |-
-                                              values is an array of string values. If the operator is In or NotIn,
-                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                              the values array must be empty. This array is replaced during a strategic
-                                              merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                            x-kubernetes-list-type: atomic
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    matchLabels:
-                                      additionalProperties:
-                                        type: string
-                                      description: |-
-                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                      type: object
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                                namespaces:
-                                  description: |-
-                                    namespaces specifies a static list of namespace names that the term applies to.
-                                    The term is applied to the union of the namespaces listed in this field
-                                    and the ones selected by namespaceSelector.
-                                    null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                  items:
-                                    type: string
-                                  type: array
-                                  x-kubernetes-list-type: atomic
-                                topologyKey:
-                                  description: |-
-                                    This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                    the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                    whose value of the label with key topologyKey matches that of any node on which any of the
-                                    selected pods is running.
-                                    Empty topologyKey is not allowed.
-                                  type: string
-                              required:
-                              - topologyKey
-                              type: object
-                            type: array
-                            x-kubernetes-list-type: atomic
-                        type: object
-                    type: object
-                  nodeSelector:
-                    additionalProperties:
-                      type: string
-                    description: NodeSelector constrains worker pods to nodes with
-                      matching labels.
-                    type: object
-                  runtimeClassName:
-                    description: RuntimeClassName routes worker pods through a specific
-                      RuntimeClass.
-                    type: string
-                  tolerations:
-                    description: Tolerations allows worker pods to schedule onto tainted
-                      nodes.
-                    items:
-                      description: |-
-                        The pod this Toleration is attached to tolerates any taint that matches
-                        the triple <key,value,effect> using the matching operator <operator>.
-                      properties:
-                        effect:
-                          description: |-
-                            Effect indicates the taint effect to match. Empty means match all taint effects.
-                            When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
-                          type: string
-                        key:
-                          description: |-
-                            Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                            If the key is empty, operator must be Exists; this combination means to match all values and all keys.
-                          type: string
-                        operator:
-                          description: |-
-                            Operator represents a key's relationship to the value.
-                            Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
-                            Exists is equivalent to wildcard for value, so that a pod can
-                            tolerate all taints of a particular category.
-                            Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
-                          type: string
-                        tolerationSeconds:
-                          description: |-
-                            TolerationSeconds represents the period of time the toleration (which must be
-                            of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                            it is not set, which means tolerate the taint forever (do not evict). Zero and
-                            negative values will be treated as 0 (evict immediately) by the system.
-                          format: int64
-                          type: integer
-                        value:
-                          description: |-
-                            Value is the taint value the toleration matches to.
-                            If the operator is Exists, the value should be empty, otherwise just a regular string.
-                          type: string
-                      type: object
-                    type: array
-                  workspace:
-                    description: |-
-                      Workspace requests an upstream agent-sandbox execution workspace for agent Tasks.
-                      When enabled, the Task controller validates the request and propagates the
-                      resolved sandbox settings to the agent worker Job. The worker wrapper then
-                      claims the sandbox workspace and runs the configured agent runtime inside it.
-                    properties:
-                      boot:
-                        description: |-
-                          Boot asks providers that support it to boot the workspace workload from scratch
-                          instead of resuming from the provider's default snapshot. Currently supported
-                          by the Substrate provider.
-                        type: boolean
-                      classRef:
-                        description: |-
-                          ClassRef selects an immutable ExecutionWorkspaceClass in the Task namespace. Setting
-                          classRef implicitly enables the controller-first workspace path.
-                        properties:
-                          name:
-                            description: Name is the class name.
-                            minLength: 1
-                            type: string
-                        required:
-                        - name
-                        type: object
-                      cleanupPolicy:
-                        description: |-
-                          CleanupPolicy controls whether the workspace is deleted or retained after use.
-                          Defaults to delete when omitted.
-                        enum:
-                        - delete
-                        - retain
-                        type: string
-                      enabled:
-                        default: false
-                        description: Enabled requests use of a durable workspace for
-                          the task execution.
-                        type: boolean
-                      hibernation:
-                        description: |-
-                          Hibernation configures process lifetime inside the workspace. Resident
-                          mode is currently rejected until the worker protocol can report per-turn
-                          completion separately from resident process lifetime.
-                        properties:
-                          processMode:
-                            description: |-
-                              ProcessMode controls whether each turn starts fresh or reuses a resident
-                              process. Defaults to fresh.
-                            enum:
-                            - fresh
-                            - resident
-                            type: string
-                          residentKey:
-                            description: |-
-                              ResidentKey selects the process slot for resident mode. When omitted, the
-                              worker derives a stable key from namespace, template, and reuse key.
-                            type: string
-                        type: object
-                      onDetach:
-                        description: OnDetach requests an action allowed by the selected
-                          class.
-                        enum:
-                        - Suspend
-                        - Delete
-                        type: string
-                      poolRef:
-                        description: |-
-                          PoolRef references an operator-managed Substrate actor pool for placement,
-                          density tracking, and oversubscription policy.
-                        properties:
-                          name:
-                            description: Name is the pool name.
-                            type: string
-                          namespace:
-                            description: Namespace is the pool namespace. It defaults
-                              to the Task namespace.
-                            type: string
-                        type: object
-                      provider:
-                        description: |-
-                          Provider selects the workspace backend. When omitted, the controller
-                          resolves the configured default workspace provider; the built-in
-                          compatibility default is agent-sandbox.
-                        enum:
-                        - agent-sandbox
-                        - substrate
-                        type: string
-                      reusePolicy:
-                        default: none
-                        description: |-
-                          ReusePolicy controls whether the workspace is fresh or session-scoped.
-                          Defaults to none when omitted.
-                        enum:
-                        - none
-                        - session
-                        type: string
-                      snapshot:
-                        description: |-
-                          Snapshot configures explicit provider snapshot restore/checkpoint behavior.
-                          Non-empty settings are currently rejected until provider checkpoint/restore
-                          support is available through Orka.
-                        properties:
-                          checkpointOnRelease:
-                            description: |-
-                              CheckpointOnRelease requests a checkpoint when cleanup releases or retains
-                              the workspace. CheckpointURI must be set when this is true.
-                            type: boolean
-                          checkpointURI:
-                            description: |-
-                              CheckpointURI is a provider-native snapshot URI prefix to write when the
-                              workspace is retained or released.
-                            type: string
-                          restoreURI:
-                            description: |-
-                              RestoreURI is a provider-native snapshot URI prefix to restore before the
-                              workspace command runs.
-                            type: string
-                        type: object
-                      templateRef:
-                        description: |-
-                          TemplateRef references the workspace template to instantiate or reuse.
-                          The template name is required when enabled is true unless the controller
-                          is configured with a provider-specific default template.
-                        properties:
-                          name:
-                            description: Name is the name of the workspace template.
-                            type: string
-                          namespace:
-                            description: |-
-                              Namespace is the namespace of the workspace template and claim.
-                              It defaults to the Task namespace, or the controller namespace when configured.
-                            type: string
-                        type: object
-                      workspaceSlot:
-                        default: default
-                        description: WorkspaceSlot names one independently reusable
-                          workspace within a Session.
-                        maxLength: 63
-                        minLength: 1
-                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                        type: string
-                    type: object
-                    x-kubernetes-validations:
-                    - message: classRef cannot be combined with legacy enabled, provider,
-                        template, pool, cleanup, boot, snapshot, or hibernation settings
-                      rule: '!has(self.classRef) || (!has(self.provider) && !has(self.templateRef)
-                        && !has(self.poolRef) && (!has(self.enabled) || !self.enabled)
-                        && !has(self.cleanupPolicy) && (!has(self.boot) || !self.boot)
-                        && !has(self.snapshot) && !has(self.hibernation))'
-                type: object
-              model:
-                description: |-
-                  Model defines the LLM model configuration
-                  Provider field is optional if providerRef is set
-                properties:
-                  fallbacks:
-                    description: |-
-                      Fallbacks defines alternative providers to try when the primary fails.
-                      Each fallback specifies a Provider CRD and optional model override.
-                    items:
-                      description: ModelFallback defines a fallback provider configuration
-                      properties:
-                        model:
-                          description: Model to use with this provider (optional,
-                            uses provider's defaultModel if empty)
-                          type: string
-                        providerRef:
-                          description: ProviderRef is the name of a Provider CRD to
-                            fall back to
-                          type: string
-                      required:
-                      - providerRef
-                      type: object
-                    type: array
-                  maxTokens:
-                    description: MaxTokens limits the response length
-                    format: int32
-                    type: integer
-                  name:
-                    description: |-
-                      Name is the model identifier
-                      Optional if providerRef is set and Provider has defaultModel
-                    type: string
-                  provider:
-                    description: |-
-                      Provider is the LLM provider (anthropic, openai)
-                      Optional if providerRef is set on the Agent
-                    enum:
-                    - anthropic
-                    - openai
-                    type: string
-                  temperature:
-                    default: 0.7
-                    description: Temperature controls randomness in generation
-                    maximum: 2
-                    minimum: 0
-                    type: number
-                type: object
-              providerRef:
-                description: |-
-                  ProviderRef references a Provider CRD for LLM configuration
-                  If set, model.provider is optional (inherited from Provider)
-                properties:
-                  name:
-                    description: Name is the name of the Provider
-                    type: string
-                  namespace:
-                    description: Namespace is the namespace of the Provider (defaults
-                      to Task namespace)
-                    type: string
-                required:
-                - name
-                type: object
-              rateLimit:
-                description: RateLimit defines rate limiting configuration
-                properties:
-                  requestsPerMinute:
-                    description: RequestsPerMinute limits requests per minute
-                    format: int32
-                    type: integer
-                  tokensPerMinute:
-                    description: TokensPerMinute limits tokens per minute
-                    format: int64
-                    type: integer
-                type: object
-              resources:
-                description: Resources defines the resource limits for tasks using
-                  this agent
-                properties:
-                  claims:
-                    description: |-
-                      Claims lists the names of resources, defined in spec.resourceClaims,
-                      that are used by this container.
-
-                      This field depends on the
-                      DynamicResourceAllocation feature gate.
-
-                      This field is immutable. It can only be set for containers.
-                    items:
-                      description: ResourceClaim references one entry in PodSpec.ResourceClaims.
-                      properties:
-                        name:
-                          description: |-
-                            Name must match the name of one entry in pod.spec.resourceClaims of
-                            the Pod where this field is used. It makes that resource available
-                            inside a container.
-                          type: string
-                        request:
-                          description: |-
-                            Request is the name chosen for a request in the referenced claim.
-                            If empty, everything from the claim is made available, otherwise
-                            only the result of this request.
-                          type: string
-                      required:
-                      - name
-                      type: object
-                    type: array
-                    x-kubernetes-list-map-keys:
-                    - name
-                    x-kubernetes-list-type: map
-                  limits:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Limits describes the maximum amount of compute resources allowed.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                  requests:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Requests describes the minimum amount of compute resources required.
-                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                type: object
-              runtime:
-                description: |-
-                  Runtime configures this Agent for external CLI runtimes (type: agent tasks).
-                  When set, this Agent is for type: agent tasks only (mutually exclusive with providerRef).
-                properties:
-                  defaultAllowBash:
-                    description: |-
-                      DefaultAllowBash controls whether bash is allowed by default for tasks using this Agent.
-                      Defaults to true if not specified.
-                    type: boolean
-                  defaultAllowedTools:
-                    description: DefaultAllowedTools lists the default tools allowed
-                      for tasks using this Agent
-                    items:
-                      type: string
-                    type: array
-                  defaultMaxTurns:
-                    default: 50
-                    description: DefaultMaxTurns is the default maximum agent loop
-                      iterations for tasks using this Agent
-                    format: int32
-                    maximum: 1000
-                    minimum: 1
-                    type: integer
-                  defaultReasoningEffort:
-                    description: |-
-                      DefaultReasoningEffort configures the CLI runtime reasoning effort for tasks using this Agent.
-                      Runtime adapters reject values they do not support (for example, Codex does not support max).
-                    enum:
-                    - low
-                    - medium
-                    - high
-                    - xhigh
-                    - max
-                    type: string
-                  runtimeRef:
-                    description: RuntimeRef selects an admin-governed AgentRuntime
-                      for custom/BYO harness runtimes.
-                    properties:
-                      name:
-                        description: Name is the AgentRuntime name. RuntimeRefs are
-                          resolved in the task namespace.
-                        minLength: 1
-                        type: string
-                    required:
-                    - name
-                    type: object
-                  type:
-                    description: Type specifies which built-in CLI runtime to use.
-                      Use runtimeRef for admin-registered custom runtimes.
-                    enum:
-                    - copilot
-                    - claude
-                    - codex
-                    - opencode
-                    type: string
-                type: object
-                x-kubernetes-validations:
-                - message: exactly one of type or runtimeRef is required
-                  rule: has(self.type) != has(self.runtimeRef)
-              secretRef:
-                description: SecretRef references a Secret containing LLM API keys
-                properties:
-                  name:
-                    default: ""
-                    description: |-
-                      Name of the referent.
-                      This field is effectively required, but due to backwards compatibility is
-                      allowed to be empty. Instances of this type with an empty value here are
-                      almost certainly wrong.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                    type: string
-                type: object
-                x-kubernetes-map-type: atomic
-              session:
-                description: Session defines session configuration defaults
-                properties:
-                  maxMessages:
-                    default: 50
-                    description: MaxMessages is the maximum messages to load from
-                      session
-                    format: int32
-                    minimum: 1
-                    type: integer
-                  persistence:
-                    default: configmap
-                    description: Persistence defines the storage backend (configmap,
-                      pvc, none)
-                    enum:
-                    - configmap
-                    - pvc
-                    - none
-                    type: string
-                  ttl:
-                    description: TTL defines the session time-to-live (auto-expire)
-                    type: string
-                type: object
-              skills:
-                description: Skills lists the default skills for this agent
-                items:
-                  description: SkillReference references a Skill CRD by name or inline
-                    skill content from a ConfigMap key.
-                  properties:
-                    configMapRef:
-                      description: ConfigMapRef references a ConfigMap key containing
-                        skill text
-                      properties:
-                        key:
-                          description: Key is the key within the ConfigMap
-                          type: string
-                        name:
-                          description: Name is the name of the ConfigMap
-                          type: string
-                      required:
-                      - key
-                      - name
-                      type: object
-                    name:
-                      description: Name references a Skill CR by name
-                      type: string
-                  type: object
-                type: array
-              systemPrompt:
-                description: SystemPrompt defines the system prompt configuration
-                properties:
-                  configMapRef:
-                    description: ConfigMapRef references a ConfigMap containing the
-                      prompt
-                    properties:
-                      key:
-                        description: Key is the key within the ConfigMap
-                        type: string
-                      name:
-                        description: Name is the name of the ConfigMap
-                        type: string
-                    required:
-                    - key
-                    - name
-                    type: object
-                  inline:
-                    description: Inline is the inline prompt text
-                    type: string
-                type: object
-              tools:
-                description: Tools lists the default tools available to this agent
-                items:
-                  description: ToolReference references a tool for an agent
-                  properties:
-                    enabled:
-                      default: true
-                      description: 'Enabled indicates if the tool is enabled (default:
-                        true)'
-                      type: boolean
-                    name:
-                      description: Name is the tool name (built-in or Tool CRD name)
-                      type: string
-                  required:
-                  - name
-                  type: object
-                type: array
-              ttlAfterLastTask:
-                description: |-
-                  TTLAfterLastTask defines how long the agent persists after its last task completes.
-                  When set and no tasks are active, the agent is deleted after this duration.
-                  Zero means the agent is never auto-deleted (permanent). Default is no TTL (permanent).
-                type: string
-            type: object
-            x-kubernetes-validations:
-            - message: execution.workspace.classRef is only supported on Task specs
-              rule: '!has(self.execution) || !has(self.execution.workspace) || !has(self.execution.workspace.classRef)'
-          status:
-            description: AgentStatus defines the observed state of Agent
-            properties:
-              activeTasks:
-                description: ActiveTasks is the number of active tasks using this
-                  agent
-                format: int32
-                type: integer
-              conditions:
-                description: Conditions represent the current state of the Agent
-                items:
-                  description: Condition contains details for one aspect of the current
-                    state of this API Resource.
-                  properties:
-                    lastTransitionTime:
-                      description: |-
-                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                      format: date-time
-                      type: string
-                    message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
-                      maxLength: 32768
-                      type: string
-                    observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
-                      format: int64
-                      minimum: 0
-                      type: integer
-                    reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
-                      maxLength: 1024
-                      minLength: 1
-                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                      type: string
-                    status:
-                      description: status of the condition, one of True, False, Unknown.
-                      enum:
-                      - "True"
-                      - "False"
-                      - Unknown
-                      type: string
-                    type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                      maxLength: 316
-                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - message
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-                x-kubernetes-list-map-keys:
-                - type
-                x-kubernetes-list-type: map
-              lastUsed:
-                description: LastUsed is the timestamp of when this agent was last
-                  used
-                format: date-time
-                type: string
-              ready:
-                description: Ready indicates whether the agent configuration is valid
-                  and usable
-                type: boolean
-            required:
-            - activeTasks
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
-  name: executionworkspaceclasses.workspace.orka.ai
-spec:
-  group: workspace.orka.ai
-  names:
-    categories:
-    - orka
-    kind: ExecutionWorkspaceClass
-    listKind: ExecutionWorkspaceClassList
-    plural: executionworkspaceclasses
-    shortNames:
-    - ewc
-    singular: executionworkspaceclass
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .spec.mode
-      name: Mode
-      type: string
-    - jsonPath: .status.providerRef.name
-      name: Provider
-      type: string
-    - jsonPath: .status.conditions[?(@.type=="Ready")].status
-      name: Ready
-      type: string
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: ExecutionWorkspaceClass represents an immutable user-selectable
-          workspace profile and policy.
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: |-
-              ExecutionWorkspaceClassSpec defines a user-selectable environment and policy.
-              Direct provisioning requires both providerRef and parametersRef; pooled provisioning requires poolRef.
-            properties:
-              allowedReuseScopes:
-                description: AllowedReuseScopes lists the reuse scopes Tasks may request.
-                items:
-                  description: WorkspaceReuseScope is a reuse scope a class permits.
-                  enum:
-                  - None
-                  - Session
-                  type: string
-                minItems: 1
-                type: array
-                x-kubernetes-list-type: set
-              lifecycle:
-                description: Lifecycle defines detach, retention, and deletion policy.
-                properties:
-                  allowedOnDetach:
-                    description: AllowedOnDetach lists the actions a Task may request.
-                    items:
-                      description: WorkspaceOnDetach is the lifecycle action taken
-                        after an interactive attachment is revoked.
-                      enum:
-                      - Suspend
-                      - Delete
-                      type: string
-                    minItems: 1
-                    type: array
-                    x-kubernetes-list-type: set
-                  defaultOnDetach:
-                    default: Suspend
-                    description: DefaultOnDetach is used when a Task does not request
-                      an allowed override.
-                    enum:
-                    - Suspend
-                    - Delete
-                    type: string
-                  deletionPolicy:
-                    description: DeletionPolicy describes the required disposition
-                      of provider and retained data.
-                    properties:
-                      checkpoints:
-                        description: Checkpoints controls provider checkpoints and
-                          snapshots.
-                        enum:
-                        - Delete
-                        - Retain
-                        type: string
-                      persistentVolumes:
-                        description: PersistentVolumes controls durable volume retention.
-                        enum:
-                        - Delete
-                        - Retain
-                        type: string
-                      providerResources:
-                        description: ProviderResources controls provider-native compute
-                          and control-plane objects.
-                        enum:
-                        - Delete
-                        - Retain
-                        type: string
-                    required:
-                    - checkpoints
-                    - persistentVolumes
-                    - providerResources
-                    type: object
-                  detachTimeout:
-                    default: 2m
-                    description: DetachTimeout bounds how long Task finalization waits
-                      for attachment revocation.
-                    type: string
-                  idleTimeout:
-                    description: IdleTimeout is the maximum idle duration before the
-                      provider may apply the class policy.
-                    type: string
-                  maxLifetime:
-                    description: MaxLifetime is the maximum lifetime of a concrete
-                      workspace.
-                    type: string
-                required:
-                - allowedOnDetach
-                - defaultOnDetach
-                - deletionPolicy
-                - detachTimeout
-                type: object
-                x-kubernetes-validations:
-                - message: defaultOnDetach must be included in allowedOnDetach
-                  rule: self.allowedOnDetach.exists(action, action == self.defaultOnDetach)
-                - message: detachTimeout must be positive
-                  rule: duration(self.detachTimeout) > duration('0s')
-                - message: idleTimeout must be positive when set
-                  rule: '!has(self.idleTimeout) || duration(self.idleTimeout) > duration(''0s'')'
-                - message: maxLifetime must be positive when set
-                  rule: '!has(self.maxLifetime) || duration(self.maxLifetime) > duration(''0s'')'
-                - message: maxLifetime must be greater than or equal to idleTimeout
-                  rule: '!has(self.idleTimeout) || !has(self.maxLifetime) || duration(self.maxLifetime)
-                    >= duration(self.idleTimeout)'
-              mode:
-                default: Interactive
-                description: Mode selects interactive Task attachment or persistent
-                  Service hosting.
-                enum:
-                - Interactive
-                - Service
-                type: string
-              parametersRef:
-                description: ParametersRef points at namespaced adapter-owned workspace
-                  profile parameters.
-                properties:
-                  group:
-                    description: Group is the API group of the referenced object.
-                    minLength: 1
-                    type: string
-                  kind:
-                    description: Kind is the kind of the referenced object.
-                    minLength: 1
-                    type: string
-                  name:
-                    description: Name is the name of the referenced object.
-                    minLength: 1
-                    type: string
-                required:
-                - group
-                - kind
-                - name
-                type: object
-              poolRef:
-                description: PoolRef selects a pool in the same namespace.
-                properties:
-                  name:
-                    default: ""
-                    description: |-
-                      Name of the referent.
-                      This field is effectively required, but due to backwards compatibility is
-                      allowed to be empty. Instances of this type with an empty value here are
-                      almost certainly wrong.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                    type: string
-                type: object
-                x-kubernetes-map-type: atomic
-              providerRef:
-                description: ProviderRef selects a cluster-scoped provider for direct
-                  provisioning.
-                properties:
-                  name:
-                    description: Name is the name of the referenced cluster-scoped
-                      object.
-                    minLength: 1
-                    type: string
-                required:
-                - name
-                type: object
-              requiredFeatures:
-                description: RequiredFeatures must be a subset of the selected provider's
-                  advertised features.
-                items:
-                  description: ExecutionWorkspaceFeature names a provider capability
-                    required by a class.
-                  pattern: ^[a-z][a-z0-9.-]{0,62}$
-                  type: string
-                type: array
-                x-kubernetes-list-type: set
-            required:
-            - allowedReuseScopes
-            - lifecycle
-            - mode
-            type: object
-            x-kubernetes-validations:
-            - message: 'exactly one provisioning source is required: providerRef with
-                parametersRef, or poolRef'
-              rule: (has(self.providerRef) && has(self.parametersRef) && !has(self.poolRef))
-                || (!has(self.providerRef) && !has(self.parametersRef) && has(self.poolRef))
-            - message: poolRef.name is required
-              rule: '!has(self.poolRef) || self.poolRef.name.size() > 0'
-            - message: ExecutionWorkspaceClass functional spec is immutable; create
-                a new class
-              rule: self == oldSelf
-            - message: Service classes may only allow the None reuse scope
-              rule: self.mode == 'Interactive' || self.allowedReuseScopes.all(scope,
-                scope == 'None')
-          status:
-            description: ExecutionWorkspaceClassStatus reports resolution and readiness
-              without provider-native details.
-            properties:
-              conditions:
-                description: Conditions represent reference, feature, and policy readiness.
-                items:
-                  description: Condition contains details for one aspect of the current
-                    state of this API Resource.
-                  properties:
-                    lastTransitionTime:
-                      description: |-
-                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                      format: date-time
-                      type: string
-                    message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
-                      maxLength: 32768
-                      type: string
-                    observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
-                      format: int64
-                      minimum: 0
-                      type: integer
-                    reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
-                      maxLength: 1024
-                      minLength: 1
-                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                      type: string
-                    status:
-                      description: status of the condition, one of True, False, Unknown.
-                      enum:
-                      - "True"
-                      - "False"
-                      - Unknown
-                      type: string
-                    type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                      maxLength: 316
-                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - message
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-                x-kubernetes-list-map-keys:
-                - type
-                x-kubernetes-list-type: map
-              observedGeneration:
-                description: ObservedGeneration is the most recent generation observed
-                  by core.
-                format: int64
-                type: integer
-              profileHash:
-                description: |-
-                  ProfileHash pins the first successfully resolved functional class profile.
-                  Later referenced-object drift makes the class NotReady instead of changing this hash.
-                pattern: ^sha256:[a-f0-9]{64}$
-                type: string
-              providerRef:
-                description: ProviderRef is the provider resolved directly or through
-                  the selected pool.
-                properties:
-                  name:
-                    description: Name is the name of the referenced cluster-scoped
-                      object.
-                    minLength: 1
-                    type: string
-                required:
-                - name
-                type: object
-            type: object
-        required:
-        - spec
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
-  name: executionworkspacepools.workspace.orka.ai
-spec:
-  group: workspace.orka.ai
-  names:
-    categories:
-    - orka
-    kind: ExecutionWorkspacePool
-    listKind: ExecutionWorkspacePoolList
-    plural: executionworkspacepools
-    shortNames:
-    - ewpool
-    singular: executionworkspacepool
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .spec.providerRef.name
-      name: Provider
-      type: string
-    - jsonPath: .status.available
-      name: Available
-      type: integer
-    - jsonPath: .status.allocated
-      name: Allocated
-      type: integer
-    - jsonPath: .status.total
-      name: Total
-      type: integer
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: ExecutionWorkspacePool represents provider-managed warm or reusable
-          capacity.
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: ExecutionWorkspacePoolSpec defines generic provider-managed
-              capacity.
-            properties:
-              capacity:
-                description: Capacity is the desired provider-managed capacity envelope.
-                properties:
-                  maxSize:
-                    description: MaxSize is the hard provider-side allocation limit
-                      for this pool.
-                    format: int32
-                    minimum: 0
-                    type: integer
-                  minReady:
-                    description: MinReady is the desired minimum number of immediately
-                      allocatable workspaces.
-                    format: int32
-                    minimum: 0
-                    type: integer
-                required:
-                - maxSize
-                - minReady
-                type: object
-                x-kubernetes-validations:
-                - message: maxSize must be greater than or equal to minReady
-                  rule: self.maxSize >= self.minReady
-              parametersRef:
-                description: ParametersRef points at namespaced adapter-owned pool
-                  parameters in this namespace.
-                properties:
-                  group:
-                    description: Group is the API group of the referenced object.
-                    minLength: 1
-                    type: string
-                  kind:
-                    description: Kind is the kind of the referenced object.
-                    minLength: 1
-                    type: string
-                  name:
-                    description: Name is the name of the referenced object.
-                    minLength: 1
-                    type: string
-                required:
-                - group
-                - kind
-                - name
-                type: object
-              providerRef:
-                description: ProviderRef selects the cluster-scoped provider installation.
-                properties:
-                  name:
-                    description: Name is the name of the referenced cluster-scoped
-                      object.
-                    minLength: 1
-                    type: string
-                required:
-                - name
-                type: object
-            required:
-            - capacity
-            - parametersRef
-            - providerRef
-            type: object
-            x-kubernetes-validations:
-            - message: providerRef is immutable
-              rule: self.providerRef == oldSelf.providerRef
-            - message: parametersRef is immutable
-              rule: self.parametersRef == oldSelf.parametersRef
-          status:
-            description: ExecutionWorkspacePoolStatus reports provider-independent
-              pool counts.
-            properties:
-              allocated:
-                description: Allocated is non-suspended capacity currently reserved
-                  for or bound to concrete workspaces.
-                format: int32
-                type: integer
-              available:
-                description: Available is immediately allocatable capacity.
-                format: int32
-                type: integer
-              conditions:
-                description: Conditions represent readiness, admission, draining,
-                  and capacity pressure.
-                items:
-                  description: Condition contains details for one aspect of the current
-                    state of this API Resource.
-                  properties:
-                    lastTransitionTime:
-                      description: |-
-                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                      format: date-time
-                      type: string
-                    message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
-                      maxLength: 32768
-                      type: string
-                    observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
-                      format: int64
-                      minimum: 0
-                      type: integer
-                    reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
-                      maxLength: 1024
-                      minLength: 1
-                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                      type: string
-                    status:
-                      description: status of the condition, one of True, False, Unknown.
-                      enum:
-                      - "True"
-                      - "False"
-                      - Unknown
-                      type: string
-                    type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                      maxLength: 316
-                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - message
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-                x-kubernetes-list-map-keys:
-                - type
-                x-kubernetes-list-type: map
-              observedGeneration:
-                description: ObservedGeneration is the most recent generation observed
-                  by the adapter.
-                format: int64
-                type: integer
-              suspended:
-                description: Suspended is a disjoint bucket of reusable capacity not
-                  consuming active compute.
-                format: int32
-                type: integer
-              total:
-                description: Total is all capacity represented by the disjoint Available,
-                  Allocated, and Suspended buckets.
-                format: int32
-                type: integer
-            type: object
-        required:
-        - spec
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
-  name: executionworkspaceproviders.workspace.orka.ai
-spec:
-  group: workspace.orka.ai
-  names:
-    categories:
-    - orka
-    kind: ExecutionWorkspaceProvider
-    listKind: ExecutionWorkspaceProviderList
-    plural: executionworkspaceproviders
-    shortNames:
-    - ewp
-    singular: executionworkspaceprovider
-  scope: Cluster
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .spec.lifecycleState
-      name: State
-      type: string
-    - jsonPath: .spec.controllerName
-      name: Controller
-      type: string
-    - jsonPath: .status.conditions[?(@.type=="Ready")].status
-      name: Ready
-      type: string
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: ExecutionWorkspaceProvider is a cluster-scoped provider adapter
-          installation.
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: ExecutionWorkspaceProviderSpec defines a configured provider
-              adapter installation.
-            properties:
-              controllerName:
-                description: ControllerName is the globally unique adapter controller
-                  identity.
-                maxLength: 253
-                minLength: 1
-                type: string
-              lifecycleState:
-                default: Active
-                description: LifecycleState controls new allocations while preserving
-                  cleanup for existing workspaces.
-                enum:
-                - Active
-                - Draining
-                - Disabled
-                type: string
-              parametersRef:
-                description: ParametersRef points at the adapter-owned provider configuration
-                  object.
-                properties:
-                  group:
-                    description: Group is the API group of the referenced object.
-                    minLength: 1
-                    type: string
-                  kind:
-                    description: Kind is the kind of the referenced object.
-                    minLength: 1
-                    type: string
-                  name:
-                    description: Name is the name of the referenced object.
-                    minLength: 1
-                    type: string
-                required:
-                - group
-                - kind
-                - name
-                type: object
-              requiredContracts:
-                description: RequiredContracts lists contracts the adapter must advertise
-                  before this provider is usable.
-                items:
-                  type: string
-                minItems: 1
-                type: array
-                x-kubernetes-list-type: set
-              usagePolicy:
-                description: UsagePolicy constrains which namespaces may resolve classes
-                  to this provider.
-                properties:
-                  allowedNamespaceSelector:
-                    description: |-
-                      AllowedNamespaceSelector selects namespaces that may resolve classes to this provider.
-                      An empty selector matches all namespaces.
-                    properties:
-                      matchExpressions:
-                        description: matchExpressions is a list of label selector
-                          requirements. The requirements are ANDed.
-                        items:
-                          description: |-
-                            A label selector requirement is a selector that contains values, a key, and an operator that
-                            relates the key and values.
-                          properties:
-                            key:
-                              description: key is the label key that the selector
-                                applies to.
-                              type: string
-                            operator:
-                              description: |-
-                                operator represents a key's relationship to a set of values.
-                                Valid operators are In, NotIn, Exists and DoesNotExist.
-                              type: string
-                            values:
-                              description: |-
-                                values is an array of string values. If the operator is In or NotIn,
-                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                the values array must be empty. This array is replaced during a strategic
-                                merge patch.
-                              items:
-                                type: string
-                              type: array
-                              x-kubernetes-list-type: atomic
-                          required:
-                          - key
-                          - operator
-                          type: object
-                        type: array
-                        x-kubernetes-list-type: atomic
-                      matchLabels:
-                        additionalProperties:
-                          type: string
-                        description: |-
-                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                          map is equivalent to an element of matchExpressions, whose key field is "key", the
-                          operator is "In", and the values array contains only "value". The requirements are ANDed.
-                        type: object
-                    type: object
-                    x-kubernetes-map-type: atomic
-                type: object
-            required:
-            - controllerName
-            - lifecycleState
-            - parametersRef
-            - requiredContracts
-            type: object
-            x-kubernetes-validations:
-            - message: controllerName is immutable
-              rule: self.controllerName == oldSelf.controllerName
-            - message: parametersRef is immutable
-              rule: self.parametersRef == oldSelf.parametersRef
-            - message: requiredContracts is immutable
-              rule: self.requiredContracts == oldSelf.requiredContracts
-          status:
-            description: |-
-              ExecutionWorkspaceProviderStatus defines the observed provider state. The matching adapter is the
-              sole writer of adapter/backend/features/heartbeat; Orka core owns only generic usability conditions.
-            properties:
-              adapter:
-                description: Adapter reports adapter build identity.
-                properties:
-                  digest:
-                    description: Digest is the immutable adapter image or build digest.
-                    pattern: ^sha256:[a-f0-9]{64}$
-                    type: string
-                  version:
-                    description: Version is the adapter semantic version.
-                    type: string
-                type: object
-              backend:
-                description: Backend reports safe provider-native compatibility metadata.
-                properties:
-                  apiVersions:
-                    description: APIVersions lists provider-native API versions understood
-                      by the adapter.
-                    items:
-                      type: string
-                    type: array
-                  version:
-                    description: Version is the observed backend version.
-                    type: string
-                type: object
-              conditions:
-                description: Conditions represent generic readiness and compatibility.
-                items:
-                  description: Condition contains details for one aspect of the current
-                    state of this API Resource.
-                  properties:
-                    lastTransitionTime:
-                      description: |-
-                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                      format: date-time
-                      type: string
-                    message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
-                      maxLength: 32768
-                      type: string
-                    observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
-                      format: int64
-                      minimum: 0
-                      type: integer
-                    reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
-                      maxLength: 1024
-                      minLength: 1
-                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                      type: string
-                    status:
-                      description: status of the condition, one of True, False, Unknown.
-                      enum:
-                      - "True"
-                      - "False"
-                      - Unknown
-                      type: string
-                    type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                      maxLength: 316
-                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - message
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-                x-kubernetes-list-map-keys:
-                - type
-                x-kubernetes-list-type: map
-              lastHeartbeat:
-                description: LastHeartbeat is the last successful adapter heartbeat.
-                format: date-time
-                type: string
-              observedGeneration:
-                description: ObservedGeneration is the most recent spec generation
-                  observed by the adapter.
-                format: int64
-                type: integer
-              supportedContracts:
-                description: SupportedContracts lists generic control/data-plane contracts
-                  implemented by this adapter.
-                items:
-                  type: string
-                type: array
-                x-kubernetes-list-type: set
-              supportedFeatures:
-                description: SupportedFeatures lists generic features implemented
-                  by this installation.
-                items:
-                  description: ExecutionWorkspaceFeature names a provider capability
-                    required by a class.
-                  pattern: ^[a-z][a-z0-9.-]{0,62}$
-                  type: string
-                type: array
-            type: object
-        required:
-        - spec
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
-  name: executionworkspaces.workspace.orka.ai
-spec:
-  group: workspace.orka.ai
-  names:
-    categories:
-    - orka
-    kind: ExecutionWorkspace
-    listKind: ExecutionWorkspaceList
-    plural: executionworkspaces
-    shortNames:
-    - ew
-    singular: executionworkspace
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .spec.classBinding.name
-      name: Class
-      type: string
-    - jsonPath: .spec.providerBinding.name
-      name: Provider
-      type: string
-    - jsonPath: .spec.mode
-      name: Mode
-      type: string
-    - jsonPath: .status.state
-      name: State
-      type: string
-    - jsonPath: .status.attachedEpoch
-      name: Epoch
-      type: integer
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: ExecutionWorkspace represents one concrete provider-bound environment.
-          It is controller-created.
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: ExecutionWorkspaceSpec defines one concrete provider-bound
-              environment.
-            properties:
-              attachment:
-                description: Attachment grants exclusive Task access for Interactive
-                  mode.
-                properties:
-                  epoch:
-                    description: Epoch monotonically increases for every attachment
-                      attempt.
-                    format: int64
-                    minimum: 1
-                    type: integer
-                  expiresAt:
-                    description: ExpiresAt is the hard attachment credential expiry.
-                    format: date-time
-                    type: string
-                  taskRef:
-                    description: TaskRef identifies the attached Task.
-                    properties:
-                      name:
-                        description: Name is the object name.
-                        minLength: 1
-                        type: string
-                      uid:
-                        description: UID is the immutable object UID.
-                        type: string
-                    required:
-                    - name
-                    - uid
-                    type: object
-                    x-kubernetes-validations:
-                    - message: uid is required
-                      rule: self.uid.size() > 0
-                  tokenSHA256:
-                    description: TokenSHA256 is the digest of the bearer token held
-                      only in tokenSecretRef.
-                    pattern: ^sha256:[a-f0-9]{64}$
-                    type: string
-                  tokenSecretRef:
-                    description: TokenSecretRef references the core-owned attachment
-                      Secret in this namespace.
-                    properties:
-                      name:
-                        description: Name is the Secret name in the workspace namespace.
-                        minLength: 1
-                        type: string
-                    required:
-                    - name
-                    type: object
-                required:
-                - epoch
-                - expiresAt
-                - taskRef
-                - tokenSHA256
-                - tokenSecretRef
-                type: object
-              attachmentEpoch:
-                description: |-
-                  AttachmentEpoch is the highest attachment epoch allocated by Orka core.
-                  It remains after Attachment is cleared and only increases atomically with
-                  a new attachment intent.
-                format: int64
-                minimum: 1
-                type: integer
-              classBinding:
-                description: ClassBinding pins the immutable class revision used to
-                  create this workspace.
-                properties:
-                  generation:
-                    description: Generation is the observed generation used to resolve
-                      the binding.
-                    format: int64
-                    minimum: 1
-                    type: integer
-                  name:
-                    description: Name is the bound object's name.
-                    minLength: 1
-                    type: string
-                  profileHash:
-                    description: |-
-                      ProfileHash is a SHA-256 digest of the functional profile resolved for this binding.
-                      It is populated for class bindings and may be omitted for provider bindings.
-                    pattern: ^sha256:[a-f0-9]{64}$
-                    type: string
-                  uid:
-                    description: UID is the bound object's immutable Kubernetes UID.
-                    type: string
-                required:
-                - generation
-                - name
-                - uid
-                type: object
-                x-kubernetes-validations:
-                - message: uid is required
-                  rule: self.uid.size() > 0
-              coreAdmission:
-                description: |-
-                  CoreAdmission is written once by Orka core after validating class and provider policy.
-                  Provider adapters must treat it as read-only and must not progress normal
-                  lifecycle work until this marker matches the immutable bindings,
-                  coreAdmission.admittedGeneration equals metadata.generation, and the
-                  Admitted=True condition records that same generation. The spec marker and
-                  status condition form a dual signal: provider status writers cannot mint the
-                  marker, and ordinary spec writers cannot mint the condition.
-                properties:
-                  admittedGeneration:
-                    description: AdmittedGeneration is the workspace generation validated
-                      by Orka core.
-                    format: int64
-                    minimum: 1
-                    type: integer
-                  classBinding:
-                    description: ClassBinding is the exact class binding admitted
-                      by core.
-                    properties:
-                      generation:
-                        description: Generation is the observed generation used to
-                          resolve the binding.
-                        format: int64
-                        minimum: 1
-                        type: integer
-                      name:
-                        description: Name is the bound object's name.
-                        minLength: 1
-                        type: string
-                      profileHash:
-                        description: |-
-                          ProfileHash is a SHA-256 digest of the functional profile resolved for this binding.
-                          It is populated for class bindings and may be omitted for provider bindings.
-                        pattern: ^sha256:[a-f0-9]{64}$
-                        type: string
-                      uid:
-                        description: UID is the bound object's immutable Kubernetes
-                          UID.
-                        type: string
-                    required:
-                    - generation
-                    - name
-                    - uid
-                    type: object
-                    x-kubernetes-validations:
-                    - message: uid is required
-                      rule: self.uid.size() > 0
-                  poolBinding:
-                    description: PoolBinding pins the pool identity used for a pooled
-                      workspace.
-                    properties:
-                      generation:
-                        description: Generation is the observed generation used to
-                          resolve the binding.
-                        format: int64
-                        minimum: 1
-                        type: integer
-                      name:
-                        description: Name is the bound object's name.
-                        minLength: 1
-                        type: string
-                      profileHash:
-                        description: |-
-                          ProfileHash is a SHA-256 digest of the functional profile resolved for this binding.
-                          It is populated for class bindings and may be omitted for provider bindings.
-                        pattern: ^sha256:[a-f0-9]{64}$
-                        type: string
-                      uid:
-                        description: UID is the bound object's immutable Kubernetes
-                          UID.
-                        type: string
-                    required:
-                    - generation
-                    - name
-                    - uid
-                    type: object
-                    x-kubernetes-validations:
-                    - message: uid is required
-                      rule: self.uid.size() > 0
-                  providerBinding:
-                    description: ProviderBinding is the exact provider binding admitted
-                      by core.
-                    properties:
-                      generation:
-                        description: Generation is the observed generation used to
-                          resolve the binding.
-                        format: int64
-                        minimum: 1
-                        type: integer
-                      name:
-                        description: Name is the bound object's name.
-                        minLength: 1
-                        type: string
-                      profileHash:
-                        description: |-
-                          ProfileHash is a SHA-256 digest of the functional profile resolved for this binding.
-                          It is populated for class bindings and may be omitted for provider bindings.
-                        pattern: ^sha256:[a-f0-9]{64}$
-                        type: string
-                      uid:
-                        description: UID is the bound object's immutable Kubernetes
-                          UID.
-                        type: string
-                    required:
-                    - generation
-                    - name
-                    - uid
-                    type: object
-                    x-kubernetes-validations:
-                    - message: uid is required
-                      rule: self.uid.size() > 0
-                required:
-                - admittedGeneration
-                - classBinding
-                - providerBinding
-                type: object
-              desiredState:
-                default: Ready
-                description: DesiredState is owned by Orka core.
-                enum:
-                - Ready
-                - Suspended
-                - Deleted
-                - Quarantined
-                type: string
-              lifecycle:
-                description: Lifecycle is the class policy resolved at creation time.
-                properties:
-                  allowedOnDetach:
-                    description: AllowedOnDetach lists the actions a Task may request.
-                    items:
-                      description: WorkspaceOnDetach is the lifecycle action taken
-                        after an interactive attachment is revoked.
-                      enum:
-                      - Suspend
-                      - Delete
-                      type: string
-                    minItems: 1
-                    type: array
-                    x-kubernetes-list-type: set
-                  defaultOnDetach:
-                    default: Suspend
-                    description: DefaultOnDetach is used when a Task does not request
-                      an allowed override.
-                    enum:
-                    - Suspend
-                    - Delete
-                    type: string
-                  deletionPolicy:
-                    description: DeletionPolicy describes the required disposition
-                      of provider and retained data.
-                    properties:
-                      checkpoints:
-                        description: Checkpoints controls provider checkpoints and
-                          snapshots.
-                        enum:
-                        - Delete
-                        - Retain
-                        type: string
-                      persistentVolumes:
-                        description: PersistentVolumes controls durable volume retention.
-                        enum:
-                        - Delete
-                        - Retain
-                        type: string
-                      providerResources:
-                        description: ProviderResources controls provider-native compute
-                          and control-plane objects.
-                        enum:
-                        - Delete
-                        - Retain
-                        type: string
-                    required:
-                    - checkpoints
-                    - persistentVolumes
-                    - providerResources
-                    type: object
-                  detachTimeout:
-                    default: 2m
-                    description: DetachTimeout bounds how long Task finalization waits
-                      for attachment revocation.
-                    type: string
-                  idleTimeout:
-                    description: IdleTimeout is the maximum idle duration before the
-                      provider may apply the class policy.
-                    type: string
-                  maxLifetime:
-                    description: MaxLifetime is the maximum lifetime of a concrete
-                      workspace.
-                    type: string
-                required:
-                - allowedOnDetach
-                - defaultOnDetach
-                - deletionPolicy
-                - detachTimeout
-                type: object
-                x-kubernetes-validations:
-                - message: defaultOnDetach must be included in allowedOnDetach
-                  rule: self.allowedOnDetach.exists(action, action == self.defaultOnDetach)
-                - message: detachTimeout must be positive
-                  rule: duration(self.detachTimeout) > duration('0s')
-                - message: idleTimeout must be positive when set
-                  rule: '!has(self.idleTimeout) || duration(self.idleTimeout) > duration(''0s'')'
-                - message: maxLifetime must be positive when set
-                  rule: '!has(self.maxLifetime) || duration(self.maxLifetime) > duration(''0s'')'
-                - message: maxLifetime must be greater than or equal to idleTimeout
-                  rule: '!has(self.idleTimeout) || !has(self.maxLifetime) || duration(self.maxLifetime)
-                    >= duration(self.idleTimeout)'
-              mode:
-                description: Mode is copied from the class.
-                enum:
-                - Interactive
-                - Service
-                type: string
-              providerBinding:
-                description: ProviderBinding pins the provider installation used to
-                  create this workspace.
-                properties:
-                  generation:
-                    description: Generation is the observed generation used to resolve
-                      the binding.
-                    format: int64
-                    minimum: 1
-                    type: integer
-                  name:
-                    description: Name is the bound object's name.
-                    minLength: 1
-                    type: string
-                  profileHash:
-                    description: |-
-                      ProfileHash is a SHA-256 digest of the functional profile resolved for this binding.
-                      It is populated for class bindings and may be omitted for provider bindings.
-                    pattern: ^sha256:[a-f0-9]{64}$
-                    type: string
-                  uid:
-                    description: UID is the bound object's immutable Kubernetes UID.
-                    type: string
-                required:
-                - generation
-                - name
-                - uid
-                type: object
-                x-kubernetes-validations:
-                - message: uid is required
-                  rule: self.uid.size() > 0
-              service:
-                description: Service declares requested endpoints for Service mode.
-                properties:
-                  ports:
-                    description: Ports lists requested service ports.
-                    items:
-                      description: ExecutionWorkspaceServicePort declares a Service-mode
-                        port requested by the owning Tool.
-                      properties:
-                        name:
-                          description: Name is a stable endpoint name.
-                          maxLength: 63
-                          minLength: 1
-                          type: string
-                        port:
-                          description: Port is the container/service port.
-                          format: int32
-                          maximum: 65535
-                          minimum: 1
-                          type: integer
-                        protocol:
-                          description: Protocol is the endpoint application protocol.
-                          enum:
-                          - HTTP
-                          - HTTPS
-                          - TCP
-                          type: string
-                      required:
-                      - name
-                      - port
-                      - protocol
-                      type: object
-                    minItems: 1
-                    type: array
-                    x-kubernetes-list-map-keys:
-                    - name
-                    x-kubernetes-list-type: map
-                required:
-                - ports
-                type: object
-              sessionRef:
-                description: SessionRef pins the conversation Session for session-scoped
-                  reuse.
-                properties:
-                  name:
-                    description: Name is the object name.
-                    minLength: 1
-                    type: string
-                  uid:
-                    description: UID is the immutable object UID.
-                    type: string
-                required:
-                - name
-                - uid
-                type: object
-                x-kubernetes-validations:
-                - message: uid is required
-                  rule: self.uid.size() > 0
-              slot:
-                default: default
-                description: Slot allows one Session to hold multiple independently
-                  named workspaces.
-                maxLength: 63
-                minLength: 1
-                pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                type: string
-            required:
-            - classBinding
-            - desiredState
-            - lifecycle
-            - mode
-            - providerBinding
-            - slot
-            type: object
-            x-kubernetes-validations:
-            - message: classBinding.profileHash is required
-              rule: self.classBinding.profileHash.size() > 0
-            - message: coreAdmission must match the immutable workspace bindings
-              rule: '!has(self.coreAdmission) || (self.coreAdmission.classBinding.name
-                == self.classBinding.name && self.coreAdmission.classBinding.uid ==
-                self.classBinding.uid && self.coreAdmission.classBinding.generation
-                == self.classBinding.generation && has(self.coreAdmission.classBinding.profileHash)
-                == has(self.classBinding.profileHash) && (!has(self.coreAdmission.classBinding.profileHash)
-                || self.coreAdmission.classBinding.profileHash == self.classBinding.profileHash)
-                && self.coreAdmission.providerBinding.name == self.providerBinding.name
-                && self.coreAdmission.providerBinding.uid == self.providerBinding.uid
-                && self.coreAdmission.providerBinding.generation == self.providerBinding.generation
-                && has(self.coreAdmission.providerBinding.profileHash) == has(self.providerBinding.profileHash)
-                && (!has(self.coreAdmission.providerBinding.profileHash) || self.coreAdmission.providerBinding.profileHash
-                == self.providerBinding.profileHash))'
-            - message: coreAdmission cannot be removed once set
-              rule: '!has(oldSelf.coreAdmission) || has(self.coreAdmission)'
-            - message: coreAdmission.admittedGeneration must not decrease
-              rule: '!has(oldSelf.coreAdmission) || self.coreAdmission.admittedGeneration
-                >= oldSelf.coreAdmission.admittedGeneration'
-            - message: mode is immutable
-              rule: self.mode == oldSelf.mode
-            - message: classBinding is immutable
-              rule: self.classBinding == oldSelf.classBinding
-            - message: providerBinding is immutable
-              rule: self.providerBinding == oldSelf.providerBinding
-            - message: sessionRef is immutable
-              rule: has(self.sessionRef) == has(oldSelf.sessionRef) && (!has(self.sessionRef)
-                || self.sessionRef == oldSelf.sessionRef)
-            - message: slot is immutable
-              rule: self.slot == oldSelf.slot
-            - message: lifecycle is immutable
-              rule: self.lifecycle == oldSelf.lifecycle
-            - message: Deleted desiredState is terminal
-              rule: oldSelf.desiredState != 'Deleted' || self.desiredState == 'Deleted'
-            - message: attachmentEpoch must not decrease
-              rule: '!has(oldSelf.attachmentEpoch) || (has(self.attachmentEpoch) &&
-                self.attachmentEpoch >= oldSelf.attachmentEpoch)'
-            - message: attachments are only valid for Interactive workspaces
-              rule: '!has(self.attachment) || self.mode == ''Interactive'''
-            - message: service ports are only valid for Service workspaces
-              rule: '!has(self.service) || self.mode == ''Service'''
-            - message: Service workspaces require service configuration
-              rule: self.mode != 'Service' || has(self.service)
-            - message: Interactive workspaces cannot request service ports
-              rule: self.mode != 'Interactive' || !has(self.service)
-          status:
-            description: |-
-              ExecutionWorkspaceStatus defines adapter-observed state. Exactly one provider adapter owns this status;
-              Orka core projects it into Task and Tool status rather than allowing adapters to write those resources.
-            properties:
-              attachedEpoch:
-                description: AttachedEpoch is the epoch currently enforced by the
-                  data plane.
-                format: int64
-                type: integer
-              conditions:
-                description: Conditions represent admission, provisioning, data-plane,
-                  attachment, and finalization state.
-                items:
-                  description: Condition contains details for one aspect of the current
-                    state of this API Resource.
-                  properties:
-                    lastTransitionTime:
-                      description: |-
-                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                      format: date-time
-                      type: string
-                    message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
-                      maxLength: 32768
-                      type: string
-                    observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
-                      format: int64
-                      minimum: 0
-                      type: integer
-                    reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
-                      maxLength: 1024
-                      minLength: 1
-                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                      type: string
-                    status:
-                      description: status of the condition, one of True, False, Unknown.
-                      enum:
-                      - "True"
-                      - "False"
-                      - Unknown
-                      type: string
-                    type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                      maxLength: 316
-                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - message
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-                x-kubernetes-list-map-keys:
-                - type
-                x-kubernetes-list-type: map
-              connectionSecretRef:
-                description: ConnectionSecretRef contains endpoint, CA, and provider
-                  lifecycle credentials for trusted control-plane consumers.
-                properties:
-                  name:
-                    description: Name is the Secret name in the workspace namespace.
-                    minLength: 1
-                    type: string
-                required:
-                - name
-                type: object
-              disposition:
-                description: Disposition reports cleanup progress independent of owning
-                  Task/Tool terminal state.
-                properties:
-                  accessCredentials:
-                    description: ExecutionWorkspaceDispositionState reports progress
-                      for one cleanup category.
-                    enum:
-                    - Pending
-                    - Active
-                    - Revoked
-                    - Retained
-                    - Deleted
-                    - Failed
-                    - NotApplicable
-                    type: string
-                  checkpoints:
-                    description: ExecutionWorkspaceDispositionState reports progress
-                      for one cleanup category.
-                    enum:
-                    - Pending
-                    - Active
-                    - Revoked
-                    - Retained
-                    - Deleted
-                    - Failed
-                    - NotApplicable
-                    type: string
-                  compute:
-                    description: ExecutionWorkspaceDispositionState reports progress
-                      for one cleanup category.
-                    enum:
-                    - Pending
-                    - Active
-                    - Revoked
-                    - Retained
-                    - Deleted
-                    - Failed
-                    - NotApplicable
-                    type: string
-                  ephemeralSecrets:
-                    description: ExecutionWorkspaceDispositionState reports progress
-                      for one cleanup category.
-                    enum:
-                    - Pending
-                    - Active
-                    - Revoked
-                    - Retained
-                    - Deleted
-                    - Failed
-                    - NotApplicable
-                    type: string
-                  persistentVolumes:
-                    description: ExecutionWorkspaceDispositionState reports progress
-                      for one cleanup category.
-                    enum:
-                    - Pending
-                    - Active
-                    - Revoked
-                    - Retained
-                    - Deleted
-                    - Failed
-                    - NotApplicable
-                    type: string
-                  providerResources:
-                    description: ExecutionWorkspaceDispositionState reports progress
-                      for one cleanup category.
-                    enum:
-                    - Pending
-                    - Active
-                    - Revoked
-                    - Retained
-                    - Deleted
-                    - Failed
-                    - NotApplicable
-                    type: string
-                  workspaceData:
-                    description: ExecutionWorkspaceDispositionState reports progress
-                      for one cleanup category.
-                    enum:
-                    - Pending
-                    - Active
-                    - Revoked
-                    - Retained
-                    - Deleted
-                    - Failed
-                    - NotApplicable
-                    type: string
-                required:
-                - accessCredentials
-                - checkpoints
-                - compute
-                - ephemeralSecrets
-                - persistentVolumes
-                - providerResources
-                - workspaceData
-                type: object
-              endpoints:
-                description: Endpoints contains sanitized endpoint metadata only.
-                items:
-                  description: |-
-                    ExecutionWorkspaceEndpoint is sanitized endpoint metadata. Credentials and private connection material
-                    are always delivered through a Secret and never placed in status.
-                  properties:
-                    name:
-                      description: Name matches a requested service port or the reserved
-                        data-plane name.
-                      type: string
-                    protocol:
-                      description: Protocol is the endpoint application protocol.
-                      type: string
-                    url:
-                      description: URL is the sanitized endpoint URL. It must not
-                        contain userinfo or credentials.
-                      minLength: 1
-                      pattern: ^(https?|tcp)://[^/:@?#[:space:]][^@?#[:space:]]*$
-                      type: string
-                  required:
-                  - name
-                  - url
-                  type: object
-                type: array
-              externalID:
-                description: ExternalID is a sanitized opaque provider resource identifier
-                  for operator diagnostics.
-                type: string
-              observedGeneration:
-                description: ObservedGeneration is the most recent spec generation
-                  observed by the adapter.
-                format: int64
-                type: integer
-              providerBinding:
-                description: ProviderBinding records the exact adapter/backend contract
-                  serving this workspace.
-                properties:
-                  adapterDigest:
-                    description: AdapterDigest is the immutable adapter build digest.
-                    pattern: ^sha256:[a-f0-9]{64}$
-                    type: string
-                  adapterVersion:
-                    description: AdapterVersion is the adapter semantic version.
-                    type: string
-                  backendAPIVersion:
-                    description: BackendAPIVersion is the selected provider-native
-                      API version.
-                    type: string
-                  contractVersion:
-                    description: ContractVersion is the selected generic provider
-                      contract.
-                    type: string
-                type: object
-              state:
-                description: State is the provider-neutral lifecycle state.
-                enum:
-                - Pending
-                - Provisioning
-                - Ready
-                - Attaching
-                - Attached
-                - Detaching
-                - Suspending
-                - Suspended
-                - Deleting
-                - Deleted
-                - Quarantined
-                - Failed
-                type: string
-            type: object
-        required:
-        - spec
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
-  name: fakepoolparameters.fake.workspace.orka.ai
-spec:
-  group: fake.workspace.orka.ai
-  names:
-    categories:
-    - orka
-    kind: FakePoolParameters
-    listKind: FakePoolParametersList
-    plural: fakepoolparameters
-    singular: fakepoolparameters
-  scope: Namespaced
-  versions:
-  - name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: |-
-          FakePoolParameters is the namespaced parameters identity used by the
-          development-only fake workspace pool reconciler.
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: |-
-              FakePoolParametersSpec is intentionally empty. Pool capacity is expressed by
-              the generic ExecutionWorkspacePool resource; this object provides an
-              adapter-owned namespaced parameters identity for conformance.
-            type: object
-        type: object
-    served: true
-    storage: true
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
-  name: fakeproviderconfigs.fake.workspace.orka.ai
-spec:
-  group: fake.workspace.orka.ai
-  names:
-    categories:
-    - orka
-    kind: FakeProviderConfig
-    listKind: FakeProviderConfigList
-    plural: fakeproviderconfigs
-    singular: fakeproviderconfig
-  scope: Cluster
-  versions:
-  - name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: |-
-          FakeProviderConfig is the cluster-scoped configuration identity used by the
-          development-only fake workspace provider.
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: |-
-              FakeProviderConfigSpec is intentionally empty. The in-memory development
-              provider needs only a concrete cluster-scoped identity for reference and
-              REST-mapping conformance.
-            type: object
-        type: object
-    served: true
-    storage: true
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
-  name: gatewaybindings.gateway.orka.ai
-spec:
-  group: gateway.orka.ai
-  names:
-    kind: GatewayBinding
-    listKind: GatewayBindingList
-    plural: gatewaybindings
-    shortNames:
-    - gwbind
-    singular: gatewaybinding
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .spec.gatewayRef.name
-      name: Gateway
-      type: string
-    - jsonPath: .spec.agentRef.name
-      name: Agent
-      type: string
-    - jsonPath: .spec.priority
-      name: Priority
-      type: integer
-    - jsonPath: .status.ready
-      name: Ready
-      type: boolean
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: GatewayBinding maps one normalized external context to one Agent.
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: GatewayBindingSpec maps normalized external identity to one
-              Agent.
-            properties:
-              activeTurnBehavior:
-                description: ActiveTurnBehavior is queue in V1.
-                enum:
-                - queue
-                type: string
-              agentRef:
-                description: AgentRef selects one Agent in this namespace.
-                properties:
-                  name:
-                    description: Name is the object name.
-                    minLength: 1
-                    type: string
-                required:
-                - name
-                type: object
-              gatewayRef:
-                description: GatewayRef selects one Gateway in this namespace.
-                properties:
-                  name:
-                    description: Name is the object name.
-                    minLength: 1
-                    type: string
-                required:
-                - name
-                type: object
-              match:
-                description: Match selects exact normalized account/context identity
-                  and optional constraints.
-                properties:
-                  accountId:
-                    description: AccountID is the exact normalized external account
-                      identity.
-                    maxLength: 256
-                    minLength: 1
-                    type: string
-                  contextId:
-                    description: ContextID is the exact normalized external conversation
-                      or request context.
-                    maxLength: 256
-                    minLength: 1
-                    type: string
-                  senderId:
-                    description: SenderID optionally restricts the binding to one
-                      exact sender before sender policy is evaluated.
-                    maxLength: 256
-                    type: string
-                  threadId:
-                    description: ThreadID optionally restricts the binding to one
-                      exact thread.
-                    maxLength: 256
-                    type: string
-                required:
-                - accountId
-                - contextId
-                type: object
-              priority:
-                description: Priority resolves overlapping matches. Equal-priority
-                  matches fail closed.
-                format: int32
-                maximum: 1000
-                minimum: -1000
-                type: integer
-              senderPolicy:
-                description: SenderPolicy denies unknown senders by default.
-                properties:
-                  allowedSenderIds:
-                    description: AllowedSenderIDs contains exact normalized sender
-                      IDs.
-                    items:
-                      type: string
-                    maxItems: 100
-                    type: array
-                    x-kubernetes-list-type: set
-                  mode:
-                    description: Mode defaults to allowlist. all is an explicit trusted-context
-                      opt-in.
-                    enum:
-                    - allowlist
-                    - all
-                    type: string
-                type: object
-              session:
-                description: Session controls deterministic Session derivation.
-                properties:
-                  mode:
-                    description: Mode selects the derivation inputs.
-                    enum:
-                    - ephemeral
-                    - context
-                    - thread
-                    - sender
-                    - context-sender
-                    - thread-sender
-                    - explicit
-                    type: string
-                  name:
-                    description: Name is required only for explicit mode.
-                    maxLength: 253
-                    type: string
-                type: object
-              taskDefaults:
-                description: TaskDefaults is the bounded Task configuration applied
-                  to dispatched events.
-                properties:
-                  agentRuntimeMaxTurns:
-                    description: AgentRuntimeMaxTurns is the only runtime-specific
-                      override permitted in V1.
-                    format: int32
-                    maximum: 1000
-                    minimum: 1
-                    type: integer
-                  priority:
-                    description: Priority is the Task queue priority.
-                    format: int32
-                    maximum: 1000
-                    minimum: 0
-                    type: integer
-                  retryPolicy:
-                    description: RetryPolicy configures bounded Task retries.
-                    properties:
-                      backoffMultiplier:
-                        description: BackoffMultiplier controls exponential Task retry
-                          delay.
-                        maximum: 10
-                        minimum: 1
-                        type: number
-                      initialDelay:
-                        description: InitialDelay is the first Task retry delay.
-                        type: string
-                        x-kubernetes-validations:
-                        - message: initialDelay must be positive and no greater than
-                            1h
-                          rule: '!(duration(self) <= duration(''0s'') || duration(self)
-                            > duration(''1h''))'
-                      maxRetries:
-                        description: MaxRetries is the maximum Task retry count.
-                        format: int32
-                        maximum: 10
-                        minimum: 0
-                        type: integer
-                    type: object
-                  timeout:
-                    description: Timeout is the Task timeout.
-                    type: string
-                    x-kubernetes-validations:
-                    - message: timeout must be positive and no greater than 24h
-                      rule: '!(duration(self) <= duration(''0s'') || duration(self)
-                        > duration(''24h''))'
-                type: object
-            required:
-            - agentRef
-            - gatewayRef
-            - match
-            type: object
-          status:
-            description: GatewayBindingStatus reports routing readiness.
-            properties:
-              accepted:
-                description: Accepted reports spec validation.
-                type: boolean
-              conditions:
-                description: Conditions report Accepted, ResolvedRefs, Programmed,
-                  and Ready state.
-                items:
-                  description: Condition contains details for one aspect of the current
-                    state of this API Resource.
-                  properties:
-                    lastTransitionTime:
-                      description: |-
-                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                      format: date-time
-                      type: string
-                    message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
-                      maxLength: 32768
-                      type: string
-                    observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
-                      format: int64
-                      minimum: 0
-                      type: integer
-                    reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
-                      maxLength: 1024
-                      minLength: 1
-                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                      type: string
-                    status:
-                      description: status of the condition, one of True, False, Unknown.
-                      enum:
-                      - "True"
-                      - "False"
-                      - Unknown
-                      type: string
-                    type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                      maxLength: 316
-                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - message
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-                x-kubernetes-list-map-keys:
-                - type
-                x-kubernetes-list-type: map
-              lastInboundActivity:
-                description: LastInboundActivity is the latest accepted inbound event
-                  time.
-                format: date-time
-                type: string
-              lastOutboundActivity:
-                description: LastOutboundActivity is the latest delivered outbound
-                  reply time.
-                format: date-time
-                type: string
-              message:
-                description: Message is sanitized readiness context.
-                type: string
-              observedGeneration:
-                description: ObservedGeneration is the latest reconciled generation.
-                format: int64
-                type: integer
-              programmed:
-                description: Programmed reports that the binding has no equal-priority
-                  ambiguity.
-                type: boolean
-              ready:
-                description: Ready reports that ingress may route events through this
-                  binding.
-                type: boolean
-              resolvedCapabilities:
-                description: ResolvedCapabilities is the provider-neutral capability
-                  summary used for validation.
-                properties:
-                  explicitSessions:
-                    description: ExplicitSessions indicates that explicit Session
-                      names are supported by bindings.
-                    type: boolean
-                  idempotentDelivery:
-                    description: IdempotentDelivery indicates that repeated delivery
-                      IDs do not create duplicate provider sends.
-                    type: boolean
-                  inboundText:
-                    description: InboundText indicates support for authenticated inbound
-                      text events.
-                    type: boolean
-                  outboundText:
-                    description: OutboundText indicates support for final text and
-                      sanitized error delivery.
-                    type: boolean
-                  senderIdentity:
-                    description: SenderIdentity indicates that stable sender identity
-                      is preserved.
-                    type: boolean
-                  threads:
-                    description: Threads indicates that thread identity is preserved.
-                    type: boolean
-                type: object
-              resolvedRefs:
-                description: ResolvedRefs reports Gateway and Agent resolution.
-                type: boolean
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
-  name: gatewayclasses.gateway.orka.ai
-spec:
-  group: gateway.orka.ai
-  names:
-    kind: GatewayClass
-    listKind: GatewayClassList
-    plural: gatewayclasses
-    shortNames:
-    - gwclass
-    singular: gatewayclass
-  scope: Cluster
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .status.accepted
-      name: Accepted
-      type: boolean
-    - jsonPath: .spec.contractVersion
-      name: Contract
-      type: string
-    - jsonPath: .spec.category
-      name: Category
-      type: string
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: GatewayClass is the cluster-scoped registry for gateway adapter
-          profiles.
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: GatewayClassSpec defines one administrator-owned adapter
-              profile.
-            properties:
-              allowedMetadataKeys:
-                description: |-
-                  AllowedMetadataKeys is the bounded allowlist of normalized event metadata keys.
-                  Empty means no event metadata is accepted.
-                items:
-                  type: string
-                maxItems: 32
-                type: array
-                x-kubernetes-list-type: set
-              capabilities:
-                description: Capabilities are the behaviors every Gateway using this
-                  class must advertise.
-                properties:
-                  explicitSessions:
-                    description: ExplicitSessions indicates that explicit Session
-                      names are supported by bindings.
-                    type: boolean
-                  idempotentDelivery:
-                    description: IdempotentDelivery indicates that repeated delivery
-                      IDs do not create duplicate provider sends.
-                    type: boolean
-                  inboundText:
-                    description: InboundText indicates support for authenticated inbound
-                      text events.
-                    type: boolean
-                  outboundText:
-                    description: OutboundText indicates support for final text and
-                      sanitized error delivery.
-                    type: boolean
-                  senderIdentity:
-                    description: SenderIdentity indicates that stable sender identity
-                      is preserved.
-                    type: boolean
-                  threads:
-                    description: Threads indicates that thread identity is preserved.
-                    type: boolean
-                type: object
-              category:
-                description: Category describes the integration shape without selecting
-                  a provider SDK.
-                enum:
-                - chat
-                - webhook
-                - http
-                - event
-                - internal
-                type: string
-              contractVersion:
-                description: ContractVersion is the adapter protocol implemented by
-                  this class.
-                enum:
-                - orka.gateway.v1
-                type: string
-            required:
-            - category
-            - contractVersion
-            type: object
-          status:
-            description: GatewayClassStatus reports class validation.
-            properties:
-              accepted:
-                description: Accepted reports whether the class is supported by Orka
-                  core.
-                type: boolean
-              conditions:
-                description: Conditions report validation state.
-                items:
-                  description: Condition contains details for one aspect of the current
-                    state of this API Resource.
-                  properties:
-                    lastTransitionTime:
-                      description: |-
-                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                      format: date-time
-                      type: string
-                    message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
-                      maxLength: 32768
-                      type: string
-                    observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
-                      format: int64
-                      minimum: 0
-                      type: integer
-                    reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
-                      maxLength: 1024
-                      minLength: 1
-                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                      type: string
-                    status:
-                      description: status of the condition, one of True, False, Unknown.
-                      enum:
-                      - "True"
-                      - "False"
-                      - Unknown
-                      type: string
-                    type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                      maxLength: 316
-                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - message
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-                x-kubernetes-list-map-keys:
-                - type
-                x-kubernetes-list-type: map
-              message:
-                description: Message is sanitized validation context.
-                type: string
-              observedGeneration:
-                description: ObservedGeneration is the latest reconciled generation.
-                format: int64
-                type: integer
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
-  name: gateways.gateway.orka.ai
-spec:
-  group: gateway.orka.ai
-  names:
-    kind: Gateway
-    listKind: GatewayList
-    plural: gateways
-    shortNames:
-    - gw
-    singular: gateway
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .spec.gatewayClassName
-      name: Class
-      type: string
-    - jsonPath: .status.ready
-      name: Ready
-      type: boolean
-    - jsonPath: .status.connected
-      name: Connected
-      type: boolean
-    - jsonPath: .status.resolvedEndpoint
-      name: Endpoint
-      type: string
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: Gateway configures one provider-neutral adapter instance.
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: GatewaySpec defines one configured adapter instance.
-            properties:
-              adapter:
-                description: Adapter selects an HTTPS endpoint or TLS-authenticated
-                  same-namespace Service.
-                properties:
-                  endpoint:
-                    description: Endpoint is an absolute HTTPS adapter base URL.
-                    pattern: ^https://[^\s@?#]+$
-                    type: string
-                  serviceRef:
-                    description: ServiceRef selects a selector-backed TLS Service
-                      in the Gateway namespace.
-                    properties:
-                      name:
-                        description: Name is the Service name in the Gateway namespace.
-                        minLength: 1
-                        type: string
-                      port:
-                        description: Port is the Service port. Zero selects the first
-                          declared Service port.
-                        format: int32
-                        maximum: 65535
-                        minimum: 0
-                        type: integer
-                    required:
-                    - name
-                    type: object
-                type: object
-                x-kubernetes-validations:
-                - message: exactly one of endpoint or serviceRef is required
-                  rule: has(self.endpoint) != has(self.serviceRef)
-              gatewayClassName:
-                description: GatewayClassName references a cluster-scoped GatewayClass.
-                minLength: 1
-                type: string
-              inboundAuthRef:
-                description: InboundAuthRef authenticates adapter calls into Orka.
-                properties:
-                  key:
-                    description: Key is the Secret data key.
-                    minLength: 1
-                    type: string
-                  name:
-                    description: Name is the Secret name.
-                    minLength: 1
-                    type: string
-                    x-kubernetes-validations:
-                    - message: name must not contain surrounding whitespace
-                      rule: self == self.trim()
-                required:
-                - key
-                - name
-                type: object
-              metadata:
-                additionalProperties:
-                  type: string
-                description: Metadata is bounded, non-secret operator metadata.
-                maxProperties: 32
-                type: object
-              outboundAuthRef:
-                description: OutboundAuthRef authenticates Orka calls to the adapter.
-                properties:
-                  key:
-                    description: Key is the Secret data key.
-                    minLength: 1
-                    type: string
-                  name:
-                    description: Name is the Secret name.
-                    minLength: 1
-                    type: string
-                    x-kubernetes-validations:
-                    - message: name must not contain surrounding whitespace
-                      rule: self == self.trim()
-                required:
-                - key
-                - name
-                type: object
-            required:
-            - adapter
-            - gatewayClassName
-            - inboundAuthRef
-            - outboundAuthRef
-            type: object
-            x-kubernetes-validations:
-            - message: inbound and outbound authentication must use separate Secrets
-              rule: self.inboundAuthRef.name.trim() != self.outboundAuthRef.name.trim()
-          status:
-            description: GatewayStatus reports reference resolution and adapter connectivity.
-            properties:
-              accepted:
-                description: Accepted reports spec validation.
-                type: boolean
-              conditions:
-                description: Conditions report Accepted, ResolvedRefs, Connected,
-                  and Ready state.
-                items:
-                  description: Condition contains details for one aspect of the current
-                    state of this API Resource.
-                  properties:
-                    lastTransitionTime:
-                      description: |-
-                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                      format: date-time
-                      type: string
-                    message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
-                      maxLength: 32768
-                      type: string
-                    observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
-                      format: int64
-                      minimum: 0
-                      type: integer
-                    reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
-                      maxLength: 1024
-                      minLength: 1
-                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                      type: string
-                    status:
-                      description: status of the condition, one of True, False, Unknown.
-                      enum:
-                      - "True"
-                      - "False"
-                      - Unknown
-                      type: string
-                    type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                      maxLength: 316
-                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - message
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-                x-kubernetes-list-map-keys:
-                - type
-                x-kubernetes-list-type: map
-              connected:
-                description: Connected reports a successful authenticated adapter
-                  probe.
-                type: boolean
-              lastSuccessfulProbe:
-                description: LastSuccessfulProbe is the last successful health/capability
-                  probe.
-                format: date-time
-                type: string
-              message:
-                description: Message is sanitized readiness context.
-                type: string
-              observedCapabilities:
-                description: ObservedCapabilities is the sanitized adapter capability
-                  response.
-                properties:
-                  adapterName:
-                    description: AdapterName is the sanitized adapter name.
-                    type: string
-                  adapterVersion:
-                    description: AdapterVersion is the sanitized adapter version.
-                    type: string
-                  capabilities:
-                    description: Capabilities are provider-neutral observed behaviors.
-                    properties:
-                      explicitSessions:
-                        description: ExplicitSessions indicates that explicit Session
-                          names are supported by bindings.
-                        type: boolean
-                      idempotentDelivery:
-                        description: IdempotentDelivery indicates that repeated delivery
-                          IDs do not create duplicate provider sends.
-                        type: boolean
-                      inboundText:
-                        description: InboundText indicates support for authenticated
-                          inbound text events.
-                        type: boolean
-                      outboundText:
-                        description: OutboundText indicates support for final text
-                          and sanitized error delivery.
-                        type: boolean
-                      senderIdentity:
-                        description: SenderIdentity indicates that stable sender identity
-                          is preserved.
-                        type: boolean
-                      threads:
-                        description: Threads indicates that thread identity is preserved.
-                        type: boolean
-                    type: object
-                  contractVersion:
-                    description: ContractVersion is the protocol reported by the adapter.
-                    type: string
-                type: object
-              observedGeneration:
-                description: ObservedGeneration is the latest reconciled generation.
-                format: int64
-                type: integer
-              observedInboundAuthSecretVersion:
-                description: ObservedInboundAuthRefVersion is non-secret Secret resource
-                  metadata.
-                type: string
-              observedOutboundAuthSecretVersion:
-                description: ObservedOutboundAuthRefVersion is non-secret Secret resource
-                  metadata.
-                type: string
-              ready:
-                description: Ready reports that ingress and delivery may use this
-                  Gateway.
-                type: boolean
-              resolvedEndpoint:
-                description: ResolvedEndpoint is a sanitized scheme and host suitable
-                  for operators.
-                type: string
-              resolvedRefs:
-                description: ResolvedRefs reports class, Service, and Secret resolution.
-                type: boolean
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
-  name: outboundaccesspolicies.core.orka.ai
-spec:
-  group: core.orka.ai
-  names:
-    kind: OutboundAccessPolicy
-    listKind: OutboundAccessPolicyList
-    plural: outboundaccesspolicies
-    singular: outboundaccesspolicy
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .status.conditions[?(@.type=="Accepted")].status
-      name: Accepted
-      type: string
-    - jsonPath: .status.conditions[?(@.type=="ResolvedRefs")].status
-      name: ResolvedRefs
-      type: string
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: |-
-          OutboundAccessPolicy governs resource credentials or trusted gateway routing
-          for Tools in the same namespace.
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: |-
-              OutboundAccessPolicySpec configures exactly one outbound credential or
-              routing adapter.
-            properties:
-              direct:
-                description: Direct exchanges a resolved subject for a downstream
-                  resource credential.
-                properties:
-                  actor:
-                    description: Actor optionally resolves an RFC 8693 actor token.
-                    properties:
-                      secretRef:
-                        description: SecretRef selects a same-namespace Secret value.
-                        properties:
-                          key:
-                            type: string
-                          name:
-                            type: string
-                          namespace:
-                            type: string
-                        required:
-                        - key
-                        - name
-                        type: object
-                      serviceAccountRef:
-                        description: ServiceAccountRef selects a ServiceAccount and
-                          TokenRequest parameters.
-                        properties:
-                          audiences:
-                            description: Audiences are requested for the projected
-                              ServiceAccount token.
-                            items:
-                              type: string
-                            type: array
-                          expirationSeconds:
-                            default: 600
-                            description: ExpirationSeconds requests a bounded token
-                              lifetime.
-                            format: int64
-                            maximum: 3600
-                            minimum: 600
-                            type: integer
-                          name:
-                            description: Name is the exact same-namespace ServiceAccount
-                              name.
-                            maxLength: 253
-                            minLength: 1
-                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                            type: string
-                        required:
-                        - name
-                        type: object
-                      source:
-                        description: Source selects TransactionToken, ServiceAccount,
-                          or SecretRef.
-                        enum:
-                        - TransactionToken
-                        - ServiceAccount
-                        - SecretRef
-                        type: string
-                      tokenType:
-                        description: |-
-                          TokenType is an arbitrary RFC 8693 token-type URN. It is not used by
-                          RFC 7523 JWT bearer grants.
-                        type: string
-                    required:
-                    - source
-                    type: object
-                    x-kubernetes-validations:
-                    - message: TransactionToken must not configure Secret or ServiceAccount
-                        references
-                      rule: self.source != 'TransactionToken' || (!has(self.secretRef)
-                        && !has(self.serviceAccountRef))
-                    - message: ServiceAccount requires only serviceAccountRef
-                      rule: self.source != 'ServiceAccount' || (has(self.serviceAccountRef)
-                        && !has(self.secretRef))
-                    - message: SecretRef requires only secretRef
-                      rule: self.source != 'SecretRef' || (has(self.secretRef) &&
-                        !has(self.serviceAccountRef))
-                  additionalParameters:
-                    additionalProperties:
-                      type: string
-                    description: AdditionalParameters are static form parameters.
-                      Reserved OAuth fields are rejected.
-                    maxProperties: 32
-                    type: object
-                  audiences:
-                    description: Audiences are emitted as repeated OAuth audience
-                      parameters.
-                    items:
-                      type: string
-                    type: array
-                  clientAuthentication:
-                    description: ClientAuthentication configures OAuth client authentication.
-                    properties:
-                      audience:
-                        description: Audience overrides the private_key_jwt aud claim.
-                          The endpoint is the default.
-                        type: string
-                      clientID:
-                        description: ClientID is required by confidential-client methods.
-                        type: string
-                      clientSecretRef:
-                        description: ClientSecretRef supplies client-secret basic/post
-                          credentials.
-                        properties:
-                          key:
-                            type: string
-                          name:
-                            type: string
-                          namespace:
-                            type: string
-                        required:
-                        - key
-                        - name
-                        type: object
-                      keyID:
-                        description: KeyID is copied into the private_key_jwt header.
-                        type: string
-                      method:
-                        default: None
-                        description: Method defaults to None.
-                        enum:
-                        - None
-                        - ClientSecretBasic
-                        - ClientSecretPost
-                        - PrivateKeyJWT
-                        type: string
-                      privateKeyRef:
-                        description: PrivateKeyRef supplies a PEM RSA or P-256 key
-                          for private_key_jwt.
-                        properties:
-                          key:
-                            type: string
-                          name:
-                            type: string
-                          namespace:
-                            type: string
-                        required:
-                        - key
-                        - name
-                        type: object
-                    type: object
-                    x-kubernetes-validations:
-                    - message: None must not configure client credentials
-                      rule: self.method != 'None' || (!has(self.clientSecretRef) &&
-                        !has(self.privateKeyRef))
-                    - message: client-secret methods require clientID and clientSecretRef
-                        only
-                      rule: '!(self.method in [''ClientSecretBasic'',''ClientSecretPost''])
-                        || (has(self.clientID) && self.clientID.size() > 0 && has(self.clientSecretRef)
-                        && !has(self.privateKeyRef))'
-                    - message: PrivateKeyJWT requires clientID and privateKeyRef only
-                      rule: self.method != 'PrivateKeyJWT' || (has(self.clientID)
-                        && self.clientID.size() > 0 && has(self.privateKeyRef) &&
-                        !has(self.clientSecretRef))
-                  expectedIssuedTokenType:
-                    description: |-
-                      ExpectedIssuedTokenType is the exact issued_token_type required for RFC 8693.
-                      RFC 7523 responses may omit issued_token_type.
-                    minLength: 1
-                    type: string
-                  grant:
-                    default: TokenExchange
-                    description: Grant selects RFC 8693 token exchange or RFC 7523
-                      JWT bearer.
-                    enum:
-                    - TokenExchange
-                    - JWTBearer
-                    type: string
-                  output:
-                    description: Output configures resource credential injection.
-                    properties:
-                      header:
-                        default: Authorization
-                        description: Header defaults to Authorization. Txn-Token is
-                          forbidden.
-                        type: string
-                      prefix:
-                        default: 'Bearer '
-                        description: Prefix defaults to "Bearer ". Set an explicit
-                          empty string for no prefix.
-                        type: string
-                    type: object
-                    x-kubernetes-validations:
-                    - message: Txn-Token cannot be used as the resource credential
-                        output header
-                      rule: '!has(self.header) || self.header.lowerAscii() != ''txn-token'''
-                  requestedTokenType:
-                    description: RequestedTokenType is an arbitrary OAuth token-type
-                      URN.
-                    type: string
-                  resources:
-                    description: Resources are emitted as repeated RFC 8707 resource
-                      parameters.
-                    items:
-                      type: string
-                    type: array
-                  scopes:
-                    description: |-
-                      Scopes are emitted as a space-separated OAuth scope parameter.
-                      TransactionToken subjects may request only a subset of the parent scope.
-                    items:
-                      type: string
-                    type: array
-                  subject:
-                    description: Subject resolves the subject token or JWT assertion.
-                    properties:
-                      secretRef:
-                        description: SecretRef selects a same-namespace Secret value.
-                        properties:
-                          key:
-                            type: string
-                          name:
-                            type: string
-                          namespace:
-                            type: string
-                        required:
-                        - key
-                        - name
-                        type: object
-                      serviceAccountRef:
-                        description: ServiceAccountRef selects a ServiceAccount and
-                          TokenRequest parameters.
-                        properties:
-                          audiences:
-                            description: Audiences are requested for the projected
-                              ServiceAccount token.
-                            items:
-                              type: string
-                            type: array
-                          expirationSeconds:
-                            default: 600
-                            description: ExpirationSeconds requests a bounded token
-                              lifetime.
-                            format: int64
-                            maximum: 3600
-                            minimum: 600
-                            type: integer
-                          name:
-                            description: Name is the exact same-namespace ServiceAccount
-                              name.
-                            maxLength: 253
-                            minLength: 1
-                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                            type: string
-                        required:
-                        - name
-                        type: object
-                      source:
-                        description: Source selects TransactionToken, ServiceAccount,
-                          or SecretRef.
-                        enum:
-                        - TransactionToken
-                        - ServiceAccount
-                        - SecretRef
-                        type: string
-                      tokenType:
-                        description: |-
-                          TokenType is an arbitrary RFC 8693 token-type URN. It is not used by
-                          RFC 7523 JWT bearer grants.
-                        type: string
-                    required:
-                    - source
-                    type: object
-                    x-kubernetes-validations:
-                    - message: TransactionToken must not configure Secret or ServiceAccount
-                        references
-                      rule: self.source != 'TransactionToken' || (!has(self.secretRef)
-                        && !has(self.serviceAccountRef))
-                    - message: ServiceAccount requires only serviceAccountRef
-                      rule: self.source != 'ServiceAccount' || (has(self.serviceAccountRef)
-                        && !has(self.secretRef))
-                    - message: SecretRef requires only secretRef
-                      rule: self.source != 'SecretRef' || (has(self.secretRef) &&
-                        !has(self.serviceAccountRef))
-                  tokenEndpoint:
-                    description: TokenEndpoint is the exact OAuth token endpoint.
-                    properties:
-                      path:
-                        description: Path is the exact endpoint path used with ServiceRef.
-                        type: string
-                      scheme:
-                        description: Scheme is used with ServiceRef and defaults to
-                          https.
-                        enum:
-                        - http
-                        - https
-                        type: string
-                      serviceRef:
-                        description: |-
-                          ServiceRef selects a token endpoint Service. Cross-namespace refs require
-                          an exact controller allowlist entry.
-                        properties:
-                          name:
-                            type: string
-                          namespace:
-                            description: |-
-                              Namespace defaults to the policy namespace. Cross-namespace refs require
-                              an exact trusted Service-reference allowlist entry.
-                            type: string
-                          port:
-                            format: int32
-                            maximum: 65535
-                            minimum: 1
-                            type: integer
-                        required:
-                        - name
-                        - port
-                        type: object
-                      tls:
-                        description: TLS configures verification for an HTTPS endpoint.
-                        properties:
-                          caSecretRef:
-                            description: CASecretRef selects PEM CA data from a same-namespace
-                              Secret.
-                            properties:
-                              key:
-                                type: string
-                              name:
-                                type: string
-                              namespace:
-                                type: string
-                            required:
-                            - key
-                            - name
-                            type: object
-                          serverName:
-                            description: ServerName overrides TLS SNI and hostname
-                              verification.
-                            type: string
-                        type: object
-                      url:
-                        description: URL is an exact absolute HTTPS token endpoint
-                          without userinfo.
-                        type: string
-                    type: object
-                    x-kubernetes-validations:
-                    - message: exactly one of url or serviceRef is required
-                      rule: has(self.url) != has(self.serviceRef)
-                    - message: scheme and path are only valid with serviceRef
-                      rule: '!has(self.url) || (!has(self.scheme) && !has(self.path))'
-                    - message: url token endpoints must use https
-                      rule: '!has(self.url) || self.url.startsWith(''https://'')'
-                required:
-                - subject
-                - tokenEndpoint
-                type: object
-                x-kubernetes-validations:
-                - message: JWTBearer does not support actor
-                  rule: self.grant != 'JWTBearer' || !has(self.actor)
-                - message: JWTBearer subject must not set tokenType
-                  rule: self.grant != 'JWTBearer' || !has(self.subject.tokenType)
-                - message: SecretRef token exchange subjects require tokenType
-                  rule: self.grant != 'TokenExchange' || self.subject.source != 'SecretRef'
-                    || (has(self.subject.tokenType) && self.subject.tokenType.size()
-                    > 0)
-                - message: SecretRef token exchange actors require tokenType
-                  rule: self.grant != 'TokenExchange' || !has(self.actor) || self.actor.source
-                    != 'SecretRef' || (has(self.actor.tokenType) && self.actor.tokenType.size()
-                    > 0)
-                - message: TokenExchange requires expectedIssuedTokenType
-                  rule: self.grant != 'TokenExchange' || (has(self.expectedIssuedTokenType)
-                    && self.expectedIssuedTokenType.size() > 0)
-                - message: additionalParameters must not contain reserved OAuth fields
-                  rule: '!has(self.additionalParameters) || self.additionalParameters.all(k,
-                    !(k.lowerAscii() in [''grant_type'',''subject_token'',''subject_token_type'',''actor_token'',''actor_token_type'',''assertion'',''scope'',''audience'',''resource'',''requested_token_type'',''client_id'',''client_secret'',''client_assertion'',''client_assertion_type'']))'
-              gateway:
-                description: Gateway routes the original Tool request through a trusted
-                  Kubernetes Service.
-                properties:
-                  scheme:
-                    default: http
-                    description: Scheme defaults to http for in-cluster gateways.
-                    enum:
-                    - http
-                    - https
-                    type: string
-                  serviceRef:
-                    description: ServiceRef selects the gateway Service.
-                    properties:
-                      name:
-                        type: string
-                      namespace:
-                        description: |-
-                          Namespace defaults to the policy namespace. Cross-namespace refs require
-                          an exact trusted Service-reference allowlist entry.
-                        type: string
-                      port:
-                        format: int32
-                        maximum: 65535
-                        minimum: 1
-                        type: integer
-                    required:
-                    - name
-                    - port
-                    type: object
-                  tls:
-                    description: TLS configures gateway verification when scheme is
-                      https.
-                    properties:
-                      caSecretRef:
-                        description: CASecretRef selects PEM CA data from a same-namespace
-                          Secret.
-                        properties:
-                          key:
-                            type: string
-                          name:
-                            type: string
-                          namespace:
-                            type: string
-                        required:
-                        - key
-                        - name
-                        type: object
-                      serverName:
-                        description: ServerName overrides TLS SNI and hostname verification.
-                        type: string
-                    type: object
-                required:
-                - serviceRef
-                type: object
-            type: object
-            x-kubernetes-validations:
-            - message: exactly one of direct or gateway is required
-              rule: has(self.direct) != has(self.gateway)
-          status:
-            description: OutboundAccessPolicyStatus contains only safe validation
-              state.
-            properties:
-              conditions:
-                items:
-                  description: Condition contains details for one aspect of the current
-                    state of this API Resource.
-                  properties:
-                    lastTransitionTime:
-                      description: |-
-                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                      format: date-time
-                      type: string
-                    message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
-                      maxLength: 32768
-                      type: string
-                    observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
-                      format: int64
-                      minimum: 0
-                      type: integer
-                    reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
-                      maxLength: 1024
-                      minLength: 1
-                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                      type: string
-                    status:
-                      description: status of the condition, one of True, False, Unknown.
-                      enum:
-                      - "True"
-                      - "False"
-                      - Unknown
-                      type: string
-                    type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                      maxLength: 316
-                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - message
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-                x-kubernetes-list-map-keys:
-                - type
-                x-kubernetes-list-type: map
-              observedGeneration:
-                format: int64
-                type: integer
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
-  name: providers.core.orka.ai
-spec:
-  group: core.orka.ai
-  names:
-    kind: Provider
-    listKind: ProviderList
-    plural: providers
-    singular: provider
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .spec.type
-      name: Type
-      type: string
-    - jsonPath: .status.ready
-      name: Ready
-      type: boolean
-    - jsonPath: .spec.defaultModel
-      name: Default Model
-      type: string
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: Provider is the Schema for the providers API
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: ProviderSpec defines the desired state of Provider
-            properties:
-              azure:
-                description: Azure contains Azure-specific configuration
-                properties:
-                  apiVersion:
-                    default: 2024-02-15-preview
-                    description: APIVersion is the Azure OpenAI API version
-                    type: string
-                  deploymentName:
-                    description: DeploymentName is the Azure OpenAI deployment name
-                    type: string
-                required:
-                - deploymentName
-                type: object
-              baseURL:
-                description: BaseURL is an optional custom API endpoint (for proxies
-                  or self-hosted)
-                type: string
-              defaultModel:
-                description: DefaultModel is the default model to use if not specified
-                  in Task/Agent
-                type: string
-              rateLimit:
-                description: RateLimit configures rate limiting for this provider
-                properties:
-                  requestsPerMinute:
-                    description: RequestsPerMinute limits requests per minute
-                    format: int32
-                    type: integer
-                  tokensPerMinute:
-                    description: TokensPerMinute limits tokens per minute
-                    format: int64
-                    type: integer
-                type: object
-              secretRef:
-                description: SecretRef references the Secret containing API credentials
-                properties:
-                  key:
-                    default: api-key
-                    description: Key is the key within the Secret containing the API
-                      key
-                    type: string
-                  name:
-                    description: Name is the name of the Secret
-                    type: string
-                required:
-                - name
-                type: object
-              type:
-                description: Type is the LLM provider type (anthropic, openai, azure-openai)
-                enum:
-                - anthropic
-                - openai
-                - azure-openai
-                type: string
-            required:
-            - secretRef
-            - type
-            type: object
-          status:
-            description: ProviderStatus defines the observed state of Provider
-            properties:
-              conditions:
-                description: Conditions represent the current state of the Provider
-                items:
-                  description: Condition contains details for one aspect of the current
-                    state of this API Resource.
-                  properties:
-                    lastTransitionTime:
-                      description: |-
-                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                      format: date-time
-                      type: string
-                    message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
-                      maxLength: 32768
-                      type: string
-                    observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
-                      format: int64
-                      minimum: 0
-                      type: integer
-                    reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
-                      maxLength: 1024
-                      minLength: 1
-                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                      type: string
-                    status:
-                      description: status of the condition, one of True, False, Unknown.
-                      enum:
-                      - "True"
-                      - "False"
-                      - Unknown
-                      type: string
-                    type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                      maxLength: 316
-                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - message
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-                x-kubernetes-list-map-keys:
-                - type
-                x-kubernetes-list-type: map
-              lastValidated:
-                description: LastValidated is the timestamp of the last successful
-                  validation
-                format: date-time
-                type: string
-              message:
-                description: Message provides additional status information
-                type: string
-              ready:
-                description: Ready indicates whether the provider is configured and
-                  validated
-                type: boolean
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
-  name: repositorymonitors.core.orka.ai
-spec:
-  group: core.orka.ai
-  names:
-    kind: RepositoryMonitor
-    listKind: RepositoryMonitorList
-    plural: repositorymonitors
-    singular: repositorymonitor
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .spec.repository
-      name: Repo
-      type: string
-    - jsonPath: .spec.branch
-      name: Branch
-      type: string
-    - jsonPath: .spec.schedule
-      name: Schedule
-      type: string
-    - jsonPath: .status.phase
-      name: Phase
-      type: string
-    - jsonPath: .status.pendingReviews
-      name: Pending
-      type: integer
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: RepositoryMonitor is the Schema for repository maintainer automation.
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: RepositoryMonitorSpec defines the desired state of RepositoryMonitor.
-            properties:
-              agents:
-                description: Agents configures the agents used by monitor review,
-                  issue, and repair tasks.
-                properties:
-                  implementer:
-                    description: Implementer is the agent used for guarded issue implementation
-                      tasks.
-                    properties:
-                      name:
-                        description: Name is the name of the Agent
-                        type: string
-                      namespace:
-                        description: Namespace is the namespace of the Agent (defaults
-                          to Task namespace)
-                        type: string
-                    required:
-                    - name
-                    type: object
-                  planner:
-                    description: Planner is the agent used for issue planning tasks.
-                    properties:
-                      name:
-                        description: Name is the name of the Agent
-                        type: string
-                      namespace:
-                        description: Namespace is the namespace of the Agent (defaults
-                          to Task namespace)
-                        type: string
-                    required:
-                    - name
-                    type: object
-                  repairer:
-                    description: Repairer is the agent used for repair tasks.
-                    properties:
-                      name:
-                        description: Name is the name of the Agent
-                        type: string
-                      namespace:
-                        description: Namespace is the namespace of the Agent (defaults
-                          to Task namespace)
-                        type: string
-                    required:
-                    - name
-                    type: object
-                  researcher:
-                    description: Researcher is the agent used for issue research tasks.
-                    properties:
-                      name:
-                        description: Name is the name of the Agent
-                        type: string
-                      namespace:
-                        description: Namespace is the namespace of the Agent (defaults
-                          to Task namespace)
-                        type: string
-                    required:
-                    - name
-                    type: object
-                  reviewer:
-                    description: Reviewer is the agent used for pull-request review
-                      tasks.
-                    properties:
-                      name:
-                        description: Name is the name of the Agent
-                        type: string
-                      namespace:
-                        description: Namespace is the namespace of the Agent (defaults
-                          to Task namespace)
-                        type: string
-                    required:
-                    - name
-                    type: object
-                  triager:
-                    description: Triager is the agent used for issue triage tasks.
-                    properties:
-                      name:
-                        description: Name is the name of the Agent
-                        type: string
-                      namespace:
-                        description: Namespace is the namespace of the Agent (defaults
-                          to Task namespace)
-                        type: string
-                    required:
-                    - name
-                    type: object
-                type: object
-              automerge:
-                description: Automerge controls deterministic merge behavior.
-                properties:
-                  allowedMergeMethods:
-                    description: AllowedMergeMethods lists merge methods allowed by
-                      policy.
-                    items:
-                      enum:
-                      - merge
-                      - squash
-                      - rebase
-                      type: string
-                    type: array
-                    x-kubernetes-list-type: set
-                  enabled:
-                    description: Enabled enables automerge jobs.
-                    type: boolean
-                  requireGlobalMergeGate:
-                    default: true
-                    description: RequireGlobalMergeGate requires the controller-wide
-                      merge gate.
-                    type: boolean
-                  requireMaintainerOptIn:
-                    default: true
-                    description: RequireMaintainerOptIn requires explicit maintainer
-                      opt-in.
-                    type: boolean
-                type: object
-              branch:
-                default: main
-                description: Branch is the default base branch for repository-wide
-                  monitoring decisions.
-                type: string
-              gitSecretRef:
-                description: GitSecretRef references GitHub credentials for repository
-                  monitor operations.
-                properties:
-                  name:
-                    default: ""
-                    description: |-
-                      Name of the referent.
-                      This field is effectively required, but due to backwards compatibility is
-                      allowed to be empty. Instances of this type with an empty value here are
-                      almost certainly wrong.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                    type: string
-                type: object
-                x-kubernetes-map-type: atomic
-              issueWorkflow:
-                description: IssueWorkflow controls issue triage, research, planning,
-                  and implementation behavior.
-                properties:
-                  implementation:
-                    description: Implementation controls bounded implementation tasks.
-                    properties:
-                      allowedPaths:
-                        description: |-
-                          AllowedPaths optionally restricts implementation patch files to these path globs/prefixes.
-                          Examples: api/**, internal/**, docs/**.
-                        items:
-                          type: string
-                        type: array
-                        x-kubernetes-list-type: set
-                      branchPrefix:
-                        description: BranchPrefix is the branch prefix for implementation
-                          push branches. Defaults to orka/issue.
-                        type: string
-                      enabled:
-                        description: Enabled enables implementation. Defaults to true
-                          when an implementer agent is configured and a command requests
-                          it.
-                        type: boolean
-                      maxActive:
-                        description: MaxActive bounds concurrently active issue implementation/mutation
-                          jobs per monitor. Defaults to 2.
-                        format: int32
-                        minimum: 0
-                        type: integer
-                      maxAttemptsPerIssue:
-                        description: MaxAttemptsPerIssue bounds implementation attempts
-                          for one issue. Defaults to 2.
-                        format: int32
-                        minimum: 0
-                        type: integer
-                      maxChangedFiles:
-                        description: MaxChangedFiles bounds changed files in an implementation
-                          patch. Defaults to 12.
-                        format: int32
-                        minimum: 1
-                        type: integer
-                      requireApprovedPlan:
-                        description: RequireApprovedPlan blocks implementation unless
-                          the latest plan was approved.
-                        type: boolean
-                    type: object
-                  planning:
-                    description: Planning controls read-only implementation plan generation.
-                    properties:
-                      enabled:
-                        description: Enabled enables planning. Defaults to true when
-                          a planner agent is configured and a command requests it.
-                        type: boolean
-                      requireHumanApprovalFor:
-                        description: RequireHumanApprovalFor names risk levels or
-                          plan categories that require explicit approval.
-                        items:
-                          type: string
-                        type: array
-                        x-kubernetes-list-type: set
-                    type: object
-                  research:
-                    description: Research controls read-only issue research.
-                    properties:
-                      enabled:
-                        description: Enabled enables this phase. Defaults to true
-                          when the corresponding agent is configured and a command
-                          requests it.
-                        type: boolean
-                    type: object
-                  triage:
-                    description: Triage controls read-only issue classification.
-                    properties:
-                      enabled:
-                        description: Enabled enables this phase. Defaults to true
-                          when the corresponding agent is configured and a command
-                          requests it.
-                        type: boolean
-                    type: object
-                type: object
-              owner:
-                description: Owner is the repository owner or organization.
-                type: string
-              policy:
-                description: Policy contains authorization and safety policy for monitor
-                  operations.
-                properties:
-                  advisoryLabels:
-                    description: AdvisoryLabels controls advisory label synchronization.
-                    properties:
-                      enabled:
-                        description: Enabled enables advisory label sync.
-                        type: boolean
-                    type: object
-                  allowedRepositoryPermissions:
-                    description: AllowedRepositoryPermissions lists GitHub permissions
-                      allowed to issue write commands.
-                    items:
-                      enum:
-                      - admin
-                      - maintain
-                      - write
-                      type: string
-                    type: array
-                    x-kubernetes-list-type: set
-                  optInLabels:
-                    description: OptInLabels names labels that opt a PR into repair
-                      or automerge.
-                    properties:
-                      autofix:
-                        description: Autofix opts a PR into autofix.
-                        type: string
-                      automerge:
-                        description: Automerge opts a PR into automerge.
-                        type: string
-                    type: object
-                  pauseLabels:
-                    description: PauseLabels block further automation while present.
-                    items:
-                      type: string
-                    type: array
-                    x-kubernetes-list-type: set
-                  protectedLabels:
-                    description: ProtectedLabels block automated review, repair, or
-                      merge according to policy.
-                    items:
-                      type: string
-                    type: array
-                    x-kubernetes-list-type: set
-                type: object
-              provider:
-                default: github
-                description: Provider is the source control provider. GitHub is the
-                  only supported v1 provider.
-                enum:
-                - github
-                type: string
-              repair:
-                description: Repair controls bounded repair behavior.
-                properties:
-                  enabled:
-                    description: Enabled enables repair jobs.
-                    type: boolean
-                  maxRepairsPerHead:
-                    description: MaxRepairsPerHead bounds automated repairs per PR
-                      head SHA.
-                    format: int32
-                    minimum: 0
-                    type: integer
-                  maxRepairsPerPR:
-                    description: MaxRepairsPerPR bounds total automated repairs per
-                      PR.
-                    format: int32
-                    minimum: 0
-                    type: integer
-                  maxReviewFixRetries:
-                    description: MaxReviewFixRetries bounds review-fix loop retries.
-                    format: int32
-                    minimum: 0
-                    type: integer
-                  maxValidationRetries:
-                    description: MaxValidationRetries bounds validation retries for
-                      one repair job.
-                    format: int32
-                    minimum: 0
-                    type: integer
-                  requireMaintainerOptIn:
-                    default: true
-                    description: RequireMaintainerOptIn requires an explicit maintainer
-                      command or label.
-                    type: boolean
-                type: object
-              repoURL:
-                description: RepoURL is the repository URL to monitor.
-                minLength: 1
-                pattern: ^(https://github[.]com/[A-Za-z0-9._-]+/[A-Za-z0-9._-]+([.]git)?/?|git@github[.]com:[A-Za-z0-9._-]+/[A-Za-z0-9._-]+([.]git)?)$
-                type: string
-              repository:
-                description: Repository is the repository name.
-                type: string
-              review:
-                description: Review controls pull-request review behavior.
-                properties:
-                  event:
-                    default: COMMENT
-                    description: |-
-                      Event is the legacy/default GitHub review event value included in review task input.
-                      It does not control RepositoryMonitor GitHub publishing; use Publish.Event.
-                    enum:
-                    - COMMENT
-                    - APPROVE
-                    - REQUEST_CHANGES
-                    type: string
-                  exactEventEnabled:
-                    description: ExactEventEnabled enables exact-head review from
-                      repository events.
-                    type: boolean
-                  publish:
-                    description: |-
-                      Publish controls deterministic GitHub pull request review publishing after review ingestion.
-                      Publishing is disabled by default and V1 only supports neutral COMMENT reviews.
-                    properties:
-                      enabled:
-                        description: Enabled enables GitHub pull request review publishing.
-                          Defaults to false.
-                        type: boolean
-                      event:
-                        default: COMMENT
-                        description: Event is the GitHub review event to submit. V1
-                          only supports COMMENT.
-                        enum:
-                        - COMMENT
-                        type: string
-                      inline:
-                        description: Inline controls optional inline review comments
-                          for eligible findings.
-                        properties:
-                          enabled:
-                            description: Enabled enables inline comments when Mode
-                              is summary_with_inline_findings.
-                            type: boolean
-                          maxComments:
-                            description: MaxComments caps inline comments per review.
-                              Defaults to 10.
-                            format: int32
-                            maximum: 50
-                            minimum: 0
-                            type: integer
-                          minPriority:
-                            default: P2
-                            description: MinPriority is the lowest finding priority
-                              eligible for inline comments. Defaults to P2.
-                            enum:
-                            - P0
-                            - P1
-                            - P2
-                            - P3
-                            type: string
-                          onlyChangedLines:
-                            description: OnlyChangedLines restricts inline comments
-                              to RIGHT-side changed lines. V1 treats this as true.
-                            type: boolean
-                        type: object
-                      mode:
-                        default: summary_only
-                        description: Mode selects whether Orka publishes only a deterministic
-                          summary or also eligible inline findings.
-                        enum:
-                        - summary_only
-                        - summary_with_inline_findings
-                        type: string
-                      postNeedsChanges:
-                        description: PostNeedsChanges controls whether needs_changes
-                          reviews are posted. Defaults to true.
-                        type: boolean
-                      postNeedsHuman:
-                        description: PostNeedsHuman controls whether needs_human reviews
-                          are posted. Defaults to true.
-                        type: boolean
-                      postPassed:
-                        description: PostPassed controls whether clean/passed reviews
-                          are posted. Defaults to false.
-                        type: boolean
-                      postSecuritySensitive:
-                        description: |-
-                          PostSecuritySensitive allows public publishing of security_sensitive findings when true.
-                          Defaults to false.
-                        type: boolean
-                      sameHeadPolicy:
-                        default: skip
-                        description: |-
-                          SameHeadPolicy controls duplicate handling for one monitor, PR, and exact head SHA.
-                          V1 only supports skip.
-                        enum:
-                        - skip
-                        type: string
-                    type: object
-                  requireGreenCI:
-                    description: RequireGreenCI requires acceptable CI before background
-                      review selection.
-                    type: boolean
-                  staleReviewTTL:
-                    description: StaleReviewTTL bounds how long an unchanged head
-                      review remains fresh.
-                    type: string
-                type: object
-              schedule:
-                description: Schedule is the cron expression for background monitor
-                  runs.
-                type: string
-              suspend:
-                description: Suspend pauses scheduled monitor runs.
-                type: boolean
-              targets:
-                description: Targets selects the repository item types covered by
-                  this monitor.
-                properties:
-                  commits:
-                    description: Commits configures commit monitoring.
-                    properties:
-                      enabled:
-                        description: Enabled enables commit monitoring.
-                        type: boolean
-                      maxPerRun:
-                        description: MaxPerRun limits commits selected by one background
-                          run.
-                        format: int32
-                        maximum: 100
-                        minimum: 1
-                        type: integer
-                    type: object
-                  issues:
-                    description: Issues configures issue monitoring.
-                    properties:
-                      enabled:
-                        description: Enabled enables issue monitoring.
-                        type: boolean
-                      excludeLabels:
-                        description: ExcludeLabels excludes matching issues from actionable
-                          inventory.
-                        items:
-                          type: string
-                        type: array
-                        x-kubernetes-list-type: set
-                      includeLabels:
-                        description: IncludeLabels optionally restricts issue inventory
-                          to issues with any of these labels.
-                        items:
-                          type: string
-                        type: array
-                        x-kubernetes-list-type: set
-                      maxPerRun:
-                        description: MaxPerRun limits issues selected by one background
-                          run.
-                        format: int32
-                        maximum: 100
-                        minimum: 1
-                        type: integer
-                    type: object
-                  pullRequests:
-                    description: PullRequests configures pull request monitoring.
-                    properties:
-                      enabled:
-                        default: true
-                        description: Enabled enables pull request monitoring.
-                        type: boolean
-                      includeDrafts:
-                        description: IncludeDrafts allows draft pull requests to be
-                          selected for review.
-                        type: boolean
-                      maxPerRun:
-                        default: 20
-                        description: MaxPerRun limits pull requests selected by one
-                          background run.
-                        format: int32
-                        maximum: 100
-                        minimum: 1
-                        type: integer
-                    type: object
-                type: object
-              timeZone:
-                description: TimeZone is the IANA time zone for the schedule.
-                type: string
-              triggers:
-                description: Triggers configures external events that create durable
-                  monitor commands.
-                properties:
-                  github:
-                    description: GitHub configures GitHub webhook triggers.
-                    properties:
-                      labels:
-                        description: Labels maps GitHub labels to durable RepositoryMonitor
-                          commands.
-                        properties:
-                          consumeCommandLabels:
-                            description: ConsumeCommandLabels removes accepted one-shot
-                              command labels after durable intake.
-                            type: boolean
-                          enabled:
-                            description: Enabled enables durable command intake for
-                              configured GitHub labels.
-                            type: boolean
-                          issues:
-                            description: Issues maps issue command intents to label
-                              names. Empty fields use the default orka:* labels.
-                            properties:
-                              approvePlan:
-                                type: string
-                              decompose:
-                                type: string
-                              implement:
-                                type: string
-                              plan:
-                                type: string
-                              research:
-                                type: string
-                              resume:
-                                type: string
-                              stop:
-                                type: string
-                              triage:
-                                type: string
-                            type: object
-                          pullRequests:
-                            description: PullRequests maps pull-request command intents
-                              to label names. Empty fields use the default orka:*
-                              labels.
-                            properties:
-                              automerge:
-                                type: string
-                              fix:
-                                type: string
-                              fixCI:
-                                type: string
-                              resume:
-                                type: string
-                              review:
-                                type: string
-                              stop:
-                                type: string
-                              updateBranch:
-                                type: string
-                            type: object
-                          requireActorPermission:
-                            default: write
-                            description: |-
-                              RequireActorPermission is the minimum GitHub permission for mutating/code-executing commands.
-                              Supported values are write, maintain, and admin. Defaults to write.
-                            enum:
-                            - write
-                            - maintain
-                            - admin
-                            type: string
-                        type: object
-                    type: object
-                type: object
-              validation:
-                description: Validation configures deterministic validation commands
-                  for repair.
-                properties:
-                  commands:
-                    description: Commands are validation commands repair jobs must
-                      run.
-                    items:
-                      type: string
-                    type: array
-                  mode:
-                    default: changed
-                    description: Mode selects validation scope.
-                    enum:
-                    - "off"
-                    - changed
-                    - full
-                    type: string
-                type: object
-            required:
-            - repoURL
-            type: object
-          status:
-            description: RepositoryMonitorStatus defines the observed state of RepositoryMonitor.
-            properties:
-              activeRepairs:
-                description: ActiveRepairs is the count of repair jobs currently active.
-                format: int32
-                type: integer
-              blockedIssues:
-                description: BlockedIssues is the count of issues blocked by guard
-                  labels or workflow policy.
-                format: int32
-                type: integer
-              blockedItems:
-                description: BlockedItems is the count of items blocked by policy,
-                  failures, or human action.
-                format: int32
-                type: integer
-              conditions:
-                description: Conditions represent the current state of the repository
-                  monitor.
-                items:
-                  description: Condition contains details for one aspect of the current
-                    state of this API Resource.
-                  properties:
-                    lastTransitionTime:
-                      description: |-
-                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                      format: date-time
-                      type: string
-                    message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
-                      maxLength: 32768
-                      type: string
-                    observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
-                      format: int64
-                      minimum: 0
-                      type: integer
-                    reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
-                      maxLength: 1024
-                      minLength: 1
-                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                      type: string
-                    status:
-                      description: status of the condition, one of True, False, Unknown.
-                      enum:
-                      - "True"
-                      - "False"
-                      - Unknown
-                      type: string
-                    type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                      maxLength: 316
-                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - message
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-                x-kubernetes-list-map-keys:
-                - type
-                x-kubernetes-list-type: map
-              lastRunID:
-                description: LastRunID is the most recent monitor run identifier stored
-                  in SQLite.
-                type: string
-              lastRunTime:
-                description: LastRunTime is the completion time of the most recent
-                  run, regardless of success.
-                format: date-time
-                type: string
-              lastSuccessfulRunTime:
-                description: LastSuccessfulRunTime is the completion time of the most
-                  recent successful run.
-                format: date-time
-                type: string
-              mergeReadyItems:
-                description: MergeReadyItems is the count of items ready for merge.
-                format: int32
-                type: integer
-              observedGeneration:
-                description: ObservedGeneration is the latest spec generation reflected
-                  in status.
-                format: int64
-                type: integer
-              openIssues:
-                description: OpenIssues is the current count of open issues seen by
-                  the monitor.
-                format: int32
-                type: integer
-              openPullRequests:
-                description: OpenPullRequests is the current count of open pull requests
-                  seen by the monitor.
-                format: int32
-                type: integer
-              pendingIssueActions:
-                description: PendingIssueActions is the count of issues waiting for
-                  a queued workflow action.
-                format: int32
-                type: integer
-              pendingReviews:
-                description: PendingReviews is the count of items waiting for review.
-                format: int32
-                type: integer
-              phase:
-                description: Phase describes the high-level monitor lifecycle state.
-                type: string
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
-  name: repositoryscans.core.orka.ai
-spec:
-  group: core.orka.ai
-  names:
-    kind: RepositoryScan
-    listKind: RepositoryScanList
-    plural: repositoryscans
-    singular: repositoryscan
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .spec.repository
-      name: Repo
-      type: string
-    - jsonPath: .spec.branch
-      name: Branch
-      type: string
-    - jsonPath: .status.phase
-      name: Phase
-      type: string
-    - jsonPath: .status.findingCounts.total
-      name: Findings
-      type: integer
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: RepositoryScan is the Schema for the repository security scanning
-          API.
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: RepositoryScanSpec defines the desired state of RepositoryScan.
-            properties:
-              analysisAgentRef:
-                description: AnalysisAgentRef is the agent used for scan runs.
-                properties:
-                  name:
-                    description: Name is the name of the Agent
-                    type: string
-                  namespace:
-                    description: Namespace is the namespace of the Agent (defaults
-                      to Task namespace)
-                    type: string
-                required:
-                - name
-                type: object
-              branch:
-                description: Branch is the base branch to scan. Defaults to the literal
-                  main branch when omitted.
-                type: string
-              customScanInstructionsRef:
-                description: CustomScanInstructionsRef references additive scanner
-                  instructions in a same-namespace ConfigMap.
-                properties:
-                  key:
-                    description: Key is the ConfigMap data key. Defaults to "policy"
-                      when omitted.
-                    type: string
-                  name:
-                    description: Name is the ConfigMap name.
-                    minLength: 1
-                    type: string
-                required:
-                - name
-                type: object
-              falsePositivePolicyRef:
-                description: FalsePositivePolicyRef references additive false-positive
-                  policy in a same-namespace ConfigMap.
-                properties:
-                  key:
-                    description: Key is the ConfigMap data key. Defaults to "policy"
-                      when omitted.
-                    type: string
-                  name:
-                    description: Name is the ConfigMap name.
-                    minLength: 1
-                    type: string
-                required:
-                - name
-                type: object
-              forkRepo:
-                description: ForkRepo is the writable fork repository URL used for
-                  patch proposals.
-                type: string
-              gitSecretRef:
-                description: GitSecretRef references git credentials for private repositories.
-                properties:
-                  name:
-                    default: ""
-                    description: |-
-                      Name of the referent.
-                      This field is effectively required, but due to backwards compatibility is
-                      allowed to be empty. Instances of this type with an empty value here are
-                      almost certainly wrong.
-                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                    type: string
-                type: object
-                x-kubernetes-map-type: atomic
-              historyDays:
-                description: HistoryDays controls how far back the initial scan should
-                  inspect repository history.
-                format: int32
-                type: integer
-              maxFindingsPerRun:
-                description: MaxFindingsPerRun bounds scan output volume.
-                format: int32
-                type: integer
-              owner:
-                description: Owner is the repository owner or organization.
-                type: string
-              patchAgentRef:
-                description: PatchAgentRef is the agent used for patch proposal runs.
-                properties:
-                  name:
-                    description: Name is the name of the Agent
-                    type: string
-                  namespace:
-                    description: Namespace is the namespace of the Agent (defaults
-                      to Task namespace)
-                    type: string
-                required:
-                - name
-                type: object
-              prBaseBranch:
-                description: PRBaseBranch is the pull request base branch for remediation.
-                type: string
-              provider:
-                default: github
-                description: Provider is the source control provider. GitHub is the
-                  only supported v1 provider.
-                enum:
-                - github
-                type: string
-              ref:
-                description: Ref is a specific git ref, tag, or commit SHA to checkout
-                  for scan tasks.
-                type: string
-              repoURL:
-                description: RepoURL is the repository URL to scan.
-                type: string
-              repository:
-                description: Repository is the repository name.
-                type: string
-              schedule:
-                description: Schedule is the cron expression for incremental scans.
-                type: string
-              subPath:
-                description: SubPath scopes scanning to a subdirectory in a monorepo.
-                type: string
-              suspend:
-                description: Suspend pauses scheduled incremental scans.
-                type: boolean
-              timeZone:
-                description: TimeZone is the IANA time zone for the schedule.
-                type: string
-              validationMaxFindingsPerRun:
-                description: ValidationMaxFindingsPerRun bounds automatic validation
-                  tasks for light mode.
-                format: int32
-                minimum: 0
-                type: integer
-              validationMinConfidence:
-                description: ValidationMinConfidence is the minimum confidence eligible
-                  for automatic validation.
-                enum:
-                - high
-                - medium
-                - low
-                type: string
-              validationMinSeverity:
-                description: ValidationMinSeverity is the minimum severity eligible
-                  for automatic validation.
-                enum:
-                - critical
-                - high
-                - medium
-                - low
-                type: string
-              validationMode:
-                default: light
-                description: ValidationMode controls how aggressively findings are
-                  validated.
-                enum:
-                - "off"
-                - light
-                - full
-                type: string
-            required:
-            - analysisAgentRef
-            - repoURL
-            type: object
-          status:
-            description: RepositoryScanStatus defines the observed state of RepositoryScan.
-            properties:
-              conditions:
-                description: Conditions represent the current state of the repository
-                  scan.
-                items:
-                  description: Condition contains details for one aspect of the current
-                    state of this API Resource.
-                  properties:
-                    lastTransitionTime:
-                      description: |-
-                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                      format: date-time
-                      type: string
-                    message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
-                      maxLength: 32768
-                      type: string
-                    observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
-                      format: int64
-                      minimum: 0
-                      type: integer
-                    reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
-                      maxLength: 1024
-                      minLength: 1
-                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                      type: string
-                    status:
-                      description: status of the condition, one of True, False, Unknown.
-                      enum:
-                      - "True"
-                      - "False"
-                      - Unknown
-                      type: string
-                    type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                      maxLength: 316
-                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - message
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-                x-kubernetes-list-map-keys:
-                - type
-                x-kubernetes-list-type: map
-              findingCounts:
-                description: FindingCounts summarizes open findings.
-                properties:
-                  critical:
-                    format: int32
-                    type: integer
-                  high:
-                    format: int32
-                    type: integer
-                  low:
-                    format: int32
-                    type: integer
-                  medium:
-                    format: int32
-                    type: integer
-                  total:
-                    format: int32
-                    type: integer
-                type: object
-              lastObservedHeadSHA:
-                description: LastObservedHeadSHA is the latest repository head SHA
-                  seen by a completed scan.
-                type: string
-              lastProcessedCommit:
-                description: LastProcessedCommit is the latest commit fully processed
-                  by a completed scan.
-                type: string
-              lastScanAt:
-                description: LastScanAt is the completion time of the most recent
-                  scan run, regardless of success or failure.
-                format: date-time
-                type: string
-              lastScanID:
-                description: LastScanID is the most recent scan run identifier stored
-                  in SQLite.
-                type: string
-              lastScanTaskName:
-                description: LastScanTaskName is the most recent scan task name.
-                type: string
-              lastSuccessfulScanAt:
-                description: LastSuccessfulScanAt is the completion time of the most
-                  recent successful scan.
-                format: date-time
-                type: string
-              phase:
-                description: Phase describes the high-level repository scan lifecycle
-                  state.
-                type: string
-              threatModelVersion:
-                description: ThreatModelVersion is the latest persisted threat model
-                  version.
-                format: int64
-                type: integer
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
-  name: skills.core.orka.ai
-spec:
-  group: core.orka.ai
-  names:
-    kind: Skill
-    listKind: SkillList
-    plural: skills
-    singular: skill
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .spec.displayName
-      name: Display Name
-      type: string
-    - jsonPath: .status.phase
-      name: Phase
-      type: string
-    - jsonPath: .spec.version
-      name: Version
-      type: string
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: Skill is the Schema for the skills API
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: SkillSpec defines the desired state of Skill
-            properties:
-              author:
-                description: Author is the author or maintainer of the skill
-                type: string
-              content:
-                description: Content defines the skill content (Agent Skills standard)
-                properties:
-                  files:
-                    additionalProperties:
-                      type: string
-                    description: |-
-                      Files is a map of additional files (templates, examples) mounted alongside the skill
-                      Keys are relative paths (e.g. "templates/review-checklist.md")
-                    type: object
-                  inline:
-                    description: Inline is the SKILL.md content injected into the
-                      system prompt
-                    type: string
-                required:
-                - inline
-                type: object
-              description:
-                description: Description is a short description of the skill shown
-                  to users and LLMs
-                type: string
-              displayName:
-                description: DisplayName is the human-readable name of the skill
-                type: string
-              source:
-                description: Source tracks where this skill was imported from (for
-                  updates)
-                properties:
-                  context7:
-                    description: Context7 indicates whether this skill is indexed
-                      by Context7
-                    type: boolean
-                  github:
-                    description: GitHub is the GitHub repo path (e.g. "/anthropics/skills")
-                    type: string
-                  skillName:
-                    description: SkillName is the skill name within the source repo
-                    type: string
-                type: object
-              tags:
-                description: Tags are labels for categorization and discovery
-                items:
-                  type: string
-                type: array
-              version:
-                description: Version is the semantic version of the skill
-                type: string
-            required:
-            - content
-            - description
-            type: object
-          status:
-            description: SkillStatus defines the observed state of Skill
-            properties:
-              conditions:
-                description: Conditions represent the current state of the Skill
-                items:
-                  description: Condition contains details for one aspect of the current
-                    state of this API Resource.
-                  properties:
-                    lastTransitionTime:
-                      description: |-
-                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                      format: date-time
-                      type: string
-                    message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
-                      maxLength: 32768
-                      type: string
-                    observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
-                      format: int64
-                      minimum: 0
-                      type: integer
-                    reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
-                      maxLength: 1024
-                      minLength: 1
-                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                      type: string
-                    status:
-                      description: status of the condition, one of True, False, Unknown.
-                      enum:
-                      - "True"
-                      - "False"
-                      - Unknown
-                      type: string
-                    type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                      maxLength: 316
-                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - message
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-                x-kubernetes-list-map-keys:
-                - type
-                x-kubernetes-list-type: map
-              contentHash:
-                description: ContentHash is the SHA-256 hash of the skill content
-                  for change detection
-                type: string
-              observedGeneration:
-                description: ObservedGeneration is the most recent generation observed
-                format: int64
-                type: integer
-              phase:
-                description: 'Phase indicates the current state of the skill: Ready
-                  or Error'
-                type: string
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
-  name: substrateactorpools.core.orka.ai
-spec:
-  group: core.orka.ai
-  names:
-    kind: SubstrateActorPool
-    listKind: SubstrateActorPoolList
-    plural: substrateactorpools
-    singular: substrateactorpool
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .status.phase
-      name: Phase
-      type: string
-    - jsonPath: .status.actorCount
-      name: Actors
-      type: integer
-    - jsonPath: .status.workerCount
-      name: Workers
-      type: integer
-    - jsonPath: .status.actorsPerWorker
-      name: Density
-      type: string
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: SubstrateActorPool is the Schema for Substrate actor pools.
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: SubstrateActorPoolSpec defines an operator-owned oversubscription
-              pool.
-            properties:
-              precreateActors:
-                description: |-
-                  PrecreateActors asks the controller to create deterministic warm actors up
-                  to TargetActors. Substrate may suspend them when the WorkerPool is full.
-                type: boolean
-              targetActors:
-                description: |-
-                  TargetActors is the desired number of stateful actors tracked for this
-                  pool. It may exceed TargetWorkers to express oversubscription.
-                format: int32
-                maximum: 1000
-                minimum: 0
-                type: integer
-              targetWorkers:
-                description: TargetWorkers is the intended physical worker budget
-                  for this pool.
-                format: int32
-                minimum: 0
-                type: integer
-              templateRef:
-                description: TemplateRef is the ActorTemplate used for pool members.
-                properties:
-                  name:
-                    description: Name is the name of the workspace template.
-                    type: string
-                  namespace:
-                    description: |-
-                      Namespace is the namespace of the workspace template and claim.
-                      It defaults to the Task namespace, or the controller namespace when configured.
-                    type: string
-                type: object
-              workerPoolRef:
-                description: WorkerPoolRef is the Substrate WorkerPool this Orka pool
-                  targets.
-                properties:
-                  name:
-                    description: Name is the name of the workspace template.
-                    type: string
-                  namespace:
-                    description: |-
-                      Namespace is the namespace of the workspace template and claim.
-                      It defaults to the Task namespace, or the controller namespace when configured.
-                    type: string
-                type: object
-            required:
-            - templateRef
-            type: object
-          status:
-            description: SubstrateActorPoolStatus reports safe pool telemetry.
-            properties:
-              actorCount:
-                description: ActorCount is the number of actors reported by Substrate
-                  for this pool.
-                format: int32
-                type: integer
-              actorsPerWorker:
-                description: ActorsPerWorker is ActorCount divided by WorkerCount,
-                  formatted as a decimal string.
-                type: string
-              conditions:
-                description: Conditions represent the current state of the pool.
-                items:
-                  description: Condition contains details for one aspect of the current
-                    state of this API Resource.
-                  properties:
-                    lastTransitionTime:
-                      description: |-
-                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                      format: date-time
-                      type: string
-                    message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
-                      maxLength: 32768
-                      type: string
-                    observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
-                      format: int64
-                      minimum: 0
-                      type: integer
-                    reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
-                      maxLength: 1024
-                      minLength: 1
-                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                      type: string
-                    status:
-                      description: status of the condition, one of True, False, Unknown.
-                      enum:
-                      - "True"
-                      - "False"
-                      - Unknown
-                      type: string
-                    type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                      maxLength: 316
-                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - message
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-                x-kubernetes-list-map-keys:
-                - type
-                x-kubernetes-list-type: map
-              message:
-                description: Message contains sanitized reconciliation context.
-                type: string
-              observedGeneration:
-                description: ObservedGeneration is the latest generation reconciled
-                  by the controller.
-                format: int64
-                type: integer
-              phase:
-                description: Phase is the current controller-observed phase.
-                enum:
-                - Pending
-                - Ready
-                - Failed
-                type: string
-              runningActorCount:
-                description: RunningActorCount is the number of pool actors currently
-                  running.
-                format: int32
-                type: integer
-              suspendedActorCount:
-                description: SuspendedActorCount is the number of pool actors currently
-                  suspended.
-                format: int32
-                type: integer
-              workerCount:
-                description: WorkerCount is the number of workers reported by Substrate
-                  for this pool.
-                format: int32
-                type: integer
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
-    gateway.orka.ai/session-cutoff-schema: v1
-  name: tasks.core.orka.ai
-spec:
-  group: core.orka.ai
-  names:
-    kind: Task
-    listKind: TaskList
-    plural: tasks
-    singular: task
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .spec.type
-      name: Type
-      type: string
-    - jsonPath: .status.phase
-      name: Phase
-      type: string
-    - jsonPath: .spec.priority
-      name: Priority
-      type: integer
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: Task is the Schema for the tasks API
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: TaskSpec defines the desired state of Task
-            properties:
-              agentRef:
-                description: AgentRef references an Agent CRD for configuration
-                properties:
-                  name:
-                    description: Name is the name of the Agent
-                    type: string
-                  namespace:
-                    description: Namespace is the namespace of the Agent (defaults
-                      to Task namespace)
-                    type: string
-                required:
-                - name
-                type: object
-              agentRuntime:
-                description: AgentRuntime contains task-level overrides for agent
-                  runtime configuration (when type is "agent")
-                properties:
-                  allowBash:
-                    description: AllowBash enables the agent to run bash commands
-                      (overrides Agent default)
-                    type: boolean
-                  allowedTools:
-                    description: AllowedTools lists the tools the agent is allowed
-                      to use (overrides Agent defaults)
-                    items:
-                      type: string
-                    type: array
-                  disallowedTools:
-                    description: DisallowedTools lists tools the agent is not allowed
-                      to use
-                    items:
-                      type: string
-                    type: array
-                  maxTurns:
-                    description: MaxTurns limits the number of agent loop iterations
-                    format: int32
-                    maximum: 1000
-                    minimum: 1
-                    type: integer
-                  workspace:
-                    description: Workspace defines the working directory configuration
-                    properties:
-                      branch:
-                        description: Branch is the git branch to checkout
-                        type: string
-                      forkRepo:
-                        description: ForkRepo is the writable fork repository URL
-                          for pushing changes
-                        type: string
-                      gitRepo:
-                        description: GitRepo is the repository URL to clone
-                        type: string
-                      gitSecretRef:
-                        description: GitSecretRef references a Secret containing git
-                          credentials
-                        properties:
-                          name:
-                            default: ""
-                            description: |-
-                              Name of the referent.
-                              This field is effectively required, but due to backwards compatibility is
-                              allowed to be empty. Instances of this type with an empty value here are
-                              almost certainly wrong.
-                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            type: string
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      prBaseBranch:
-                        description: PRBaseBranch is the upstream branch to target
-                          for pull requests
-                        type: string
-                      pushBranch:
-                        description: |-
-                          PushBranch is the remote branch name to push changes to after the agent completes.
-                          When set, FinalizeResult will commit and push changes to this branch.
-                        type: string
-                      ref:
-                        description: Ref is a specific git ref (commit SHA, tag) to
-                          checkout
-                        type: string
-                      subPath:
-                        description: SubPath is a subdirectory within the repo to
-                          use as workspace root
-                        type: string
-                    type: object
-                type: object
-              ai:
-                description: AI contains AI-specific configuration (when type is "ai")
-                properties:
-                  maxTokens:
-                    description: MaxTokens limits the response length
-                    format: int32
-                    type: integer
-                  model:
-                    description: Model is the model identifier - required if providerRef
-                      not set
-                    type: string
-                  prompt:
-                    description: Prompt is the user prompt for the AI task
-                    type: string
-                  provider:
-                    description: Provider is the LLM provider (anthropic, openai)
-                      - required if providerRef not set
-                    enum:
-                    - anthropic
-                    - openai
-                    type: string
-                  providerRef:
-                    description: |-
-                      ProviderRef references a Provider CRD for LLM configuration
-                      If set, provider and model fields are optional (defaults from Provider)
-                    properties:
-                      name:
-                        description: Name is the name of the Provider
-                        type: string
-                      namespace:
-                        description: Namespace is the namespace of the Provider (defaults
-                          to Task namespace)
-                        type: string
-                    required:
-                    - name
-                    type: object
-                  skills:
-                    description: Skills references Skill CRDs to inject into the agent's
-                      system prompt
-                    items:
-                      description: SkillReference references a Skill CRD by name or
-                        inline skill content from a ConfigMap key.
-                      properties:
-                        configMapRef:
-                          description: ConfigMapRef references a ConfigMap key containing
-                            skill text
-                          properties:
-                            key:
-                              description: Key is the key within the ConfigMap
-                              type: string
-                            name:
-                              description: Name is the name of the ConfigMap
-                              type: string
-                          required:
-                          - key
-                          - name
-                          type: object
-                        name:
-                          description: Name references a Skill CR by name
-                          type: string
-                      type: object
-                    type: array
-                  systemPrompt:
-                    description: SystemPrompt is an optional system prompt
-                    type: string
-                  temperature:
-                    description: Temperature controls randomness in generation
-                    maximum: 2
-                    minimum: 0
-                    type: number
-                  tools:
-                    description: Tools lists the tools available for this task
-                    items:
-                      type: string
-                    type: array
-                type: object
-              args:
-                description: Args are the arguments to pass to the command
-                items:
-                  type: string
-                type: array
-              command:
-                description: Command is the command to run in the container
-                items:
-                  type: string
-                type: array
-              concurrencyPolicy:
-                default: Forbid
-                description: ConcurrencyPolicy specifies how to treat concurrent runs
-                  (Allow or Forbid).
-                enum:
-                - Allow
-                - Forbid
-                type: string
-              env:
-                description: Env is a list of environment variables to set in the
-                  container
-                items:
-                  description: EnvVar represents an environment variable present in
-                    a Container.
-                  properties:
-                    name:
-                      description: |-
-                        Name of the environment variable.
-                        May consist of any printable ASCII characters except '='.
-                      type: string
-                    value:
-                      description: |-
-                        Variable references $(VAR_NAME) are expanded
-                        using the previously defined environment variables in the container and
-                        any service environment variables. If a variable cannot be resolved,
-                        the reference in the input string will be unchanged. Double $$ are reduced
-                        to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
-                        "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
-                        Escaped references will never be expanded, regardless of whether the variable
-                        exists or not.
-                        Defaults to "".
-                      type: string
-                    valueFrom:
-                      description: Source for the environment variable's value. Cannot
-                        be used if value is not empty.
-                      properties:
-                        configMapKeyRef:
-                          description: Selects a key of a ConfigMap.
-                          properties:
-                            key:
-                              description: The key to select.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the ConfigMap or its key
-                                must be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        fieldRef:
-                          description: |-
-                            Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
-                            spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
-                          properties:
-                            apiVersion:
-                              description: Version of the schema the FieldPath is
-                                written in terms of, defaults to "v1".
-                              type: string
-                            fieldPath:
-                              description: Path of the field to select in the specified
-                                API version.
-                              type: string
-                          required:
-                          - fieldPath
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        fileKeyRef:
-                          description: |-
-                            FileKeyRef selects a key of the env file.
-                            Requires the EnvFiles feature gate to be enabled.
-                          properties:
-                            key:
-                              description: |-
-                                The key within the env file. An invalid key will prevent the pod from starting.
-                                The keys defined within a source may consist of any printable ASCII characters except '='.
-                                During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                              type: string
-                            optional:
-                              default: false
-                              description: |-
-                                Specify whether the file or its key must be defined. If the file or key
-                                does not exist, then the env var is not published.
-                                If optional is set to true and the specified key does not exist,
-                                the environment variable will not be set in the Pod's containers.
-
-                                If optional is set to false and the specified key does not exist,
-                                an error will be returned during Pod creation.
-                              type: boolean
-                            path:
-                              description: |-
-                                The path within the volume from which to select the file.
-                                Must be relative and may not contain the '..' path or start with '..'.
-                              type: string
-                            volumeName:
-                              description: The name of the volume mount containing
-                                the env file.
-                              type: string
-                          required:
-                          - key
-                          - path
-                          - volumeName
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        resourceFieldRef:
-                          description: |-
-                            Selects a resource of the container: only resources limits and requests
-                            (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
-                          properties:
-                            containerName:
-                              description: 'Container name: required for volumes,
-                                optional for env vars'
-                              type: string
-                            divisor:
-                              anyOf:
-                              - type: integer
-                              - type: string
-                              description: Specifies the output format of the exposed
-                                resources, defaults to "1"
-                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                              x-kubernetes-int-or-string: true
-                            resource:
-                              description: 'Required: resource to select'
-                              type: string
-                          required:
-                          - resource
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        secretKeyRef:
-                          description: Selects a key of a secret in the pod's namespace
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              default: ""
-                              description: |-
-                                Name of the referent.
-                                This field is effectively required, but due to backwards compatibility is
-                                allowed to be empty. Instances of this type with an empty value here are
-                                almost certainly wrong.
-                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                      type: object
-                  required:
-                  - name
-                  type: object
-                type: array
-              execution:
-                description: Execution defines worker pod runtime and placement settings.
-                properties:
-                  affinity:
-                    description: Affinity defines Kubernetes affinity and anti-affinity
-                      rules for worker pods.
-                    properties:
-                      nodeAffinity:
-                        description: Describes node affinity scheduling rules for
-                          the pod.
-                        properties:
-                          preferredDuringSchedulingIgnoredDuringExecution:
-                            description: |-
-                              The scheduler will prefer to schedule pods to nodes that satisfy
-                              the affinity expressions specified by this field, but it may choose
-                              a node that violates one or more of the expressions. The node that is
-                              most preferred is the one with the greatest sum of weights, i.e.
-                              for each node that meets all of the scheduling requirements (resource
-                              request, requiredDuringScheduling affinity expressions, etc.),
-                              compute a sum by iterating through the elements of this field and adding
-                              "weight" to the sum if the node matches the corresponding matchExpressions; the
-                              node(s) with the highest sum are the most preferred.
-                            items:
-                              description: |-
-                                An empty preferred scheduling term matches all objects with implicit weight 0
-                                (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
-                              properties:
-                                preference:
-                                  description: A node selector term, associated with
-                                    the corresponding weight.
-                                  properties:
-                                    matchExpressions:
-                                      description: A list of node selector requirements
-                                        by node's labels.
-                                      items:
-                                        description: |-
-                                          A node selector requirement is a selector that contains values, a key, and an operator
-                                          that relates the key and values.
-                                        properties:
-                                          key:
-                                            description: The label key that the selector
-                                              applies to.
-                                            type: string
-                                          operator:
-                                            description: |-
-                                              Represents a key's relationship to a set of values.
-                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                            type: string
-                                          values:
-                                            description: |-
-                                              An array of string values. If the operator is In or NotIn,
-                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                              the values array must be empty. If the operator is Gt or Lt, the values
-                                              array must have a single element, which will be interpreted as an integer.
-                                              This array is replaced during a strategic merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                            x-kubernetes-list-type: atomic
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    matchFields:
-                                      description: A list of node selector requirements
-                                        by node's fields.
-                                      items:
-                                        description: |-
-                                          A node selector requirement is a selector that contains values, a key, and an operator
-                                          that relates the key and values.
-                                        properties:
-                                          key:
-                                            description: The label key that the selector
-                                              applies to.
-                                            type: string
-                                          operator:
-                                            description: |-
-                                              Represents a key's relationship to a set of values.
-                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                            type: string
-                                          values:
-                                            description: |-
-                                              An array of string values. If the operator is In or NotIn,
-                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                              the values array must be empty. If the operator is Gt or Lt, the values
-                                              array must have a single element, which will be interpreted as an integer.
-                                              This array is replaced during a strategic merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                            x-kubernetes-list-type: atomic
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                                weight:
-                                  description: Weight associated with matching the
-                                    corresponding nodeSelectorTerm, in the range 1-100.
-                                  format: int32
-                                  type: integer
-                              required:
-                              - preference
-                              - weight
-                              type: object
-                            type: array
-                            x-kubernetes-list-type: atomic
-                          requiredDuringSchedulingIgnoredDuringExecution:
-                            description: |-
-                              If the affinity requirements specified by this field are not met at
-                              scheduling time, the pod will not be scheduled onto the node.
-                              If the affinity requirements specified by this field cease to be met
-                              at some point during pod execution (e.g. due to an update), the system
-                              may or may not try to eventually evict the pod from its node.
-                            properties:
-                              nodeSelectorTerms:
-                                description: Required. A list of node selector terms.
-                                  The terms are ORed.
-                                items:
-                                  description: |-
-                                    A null or empty node selector term matches no objects. The requirements of
-                                    them are ANDed.
-                                    The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
-                                  properties:
-                                    matchExpressions:
-                                      description: A list of node selector requirements
-                                        by node's labels.
-                                      items:
-                                        description: |-
-                                          A node selector requirement is a selector that contains values, a key, and an operator
-                                          that relates the key and values.
-                                        properties:
-                                          key:
-                                            description: The label key that the selector
-                                              applies to.
-                                            type: string
-                                          operator:
-                                            description: |-
-                                              Represents a key's relationship to a set of values.
-                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                            type: string
-                                          values:
-                                            description: |-
-                                              An array of string values. If the operator is In or NotIn,
-                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                              the values array must be empty. If the operator is Gt or Lt, the values
-                                              array must have a single element, which will be interpreted as an integer.
-                                              This array is replaced during a strategic merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                            x-kubernetes-list-type: atomic
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    matchFields:
-                                      description: A list of node selector requirements
-                                        by node's fields.
-                                      items:
-                                        description: |-
-                                          A node selector requirement is a selector that contains values, a key, and an operator
-                                          that relates the key and values.
-                                        properties:
-                                          key:
-                                            description: The label key that the selector
-                                              applies to.
-                                            type: string
-                                          operator:
-                                            description: |-
-                                              Represents a key's relationship to a set of values.
-                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-                                            type: string
-                                          values:
-                                            description: |-
-                                              An array of string values. If the operator is In or NotIn,
-                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                              the values array must be empty. If the operator is Gt or Lt, the values
-                                              array must have a single element, which will be interpreted as an integer.
-                                              This array is replaced during a strategic merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                            x-kubernetes-list-type: atomic
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                                type: array
-                                x-kubernetes-list-type: atomic
-                            required:
-                            - nodeSelectorTerms
-                            type: object
-                            x-kubernetes-map-type: atomic
-                        type: object
-                      podAffinity:
-                        description: Describes pod affinity scheduling rules (e.g.
-                          co-locate this pod in the same node, zone, etc. as some
-                          other pod(s)).
-                        properties:
-                          preferredDuringSchedulingIgnoredDuringExecution:
-                            description: |-
-                              The scheduler will prefer to schedule pods to nodes that satisfy
-                              the affinity expressions specified by this field, but it may choose
-                              a node that violates one or more of the expressions. The node that is
-                              most preferred is the one with the greatest sum of weights, i.e.
-                              for each node that meets all of the scheduling requirements (resource
-                              request, requiredDuringScheduling affinity expressions, etc.),
-                              compute a sum by iterating through the elements of this field and adding
-                              "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                              node(s) with the highest sum are the most preferred.
-                            items:
-                              description: The weights of all of the matched WeightedPodAffinityTerm
-                                fields are added per-node to find the most preferred
-                                node(s)
-                              properties:
-                                podAffinityTerm:
-                                  description: Required. A pod affinity term, associated
-                                    with the corresponding weight.
-                                  properties:
-                                    labelSelector:
-                                      description: |-
-                                        A label query over a set of resources, in this case pods.
-                                        If it's null, this PodAffinityTerm matches with no Pods.
-                                      properties:
-                                        matchExpressions:
-                                          description: matchExpressions is a list
-                                            of label selector requirements. The requirements
-                                            are ANDed.
-                                          items:
-                                            description: |-
-                                              A label selector requirement is a selector that contains values, a key, and an operator that
-                                              relates the key and values.
-                                            properties:
-                                              key:
-                                                description: key is the label key
-                                                  that the selector applies to.
-                                                type: string
-                                              operator:
-                                                description: |-
-                                                  operator represents a key's relationship to a set of values.
-                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                type: string
-                                              values:
-                                                description: |-
-                                                  values is an array of string values. If the operator is In or NotIn,
-                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                  the values array must be empty. This array is replaced during a strategic
-                                                  merge patch.
-                                                items:
-                                                  type: string
-                                                type: array
-                                                x-kubernetes-list-type: atomic
-                                            required:
-                                            - key
-                                            - operator
-                                            type: object
-                                          type: array
-                                          x-kubernetes-list-type: atomic
-                                        matchLabels:
-                                          additionalProperties:
-                                            type: string
-                                          description: |-
-                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                          type: object
-                                      type: object
-                                      x-kubernetes-map-type: atomic
-                                    matchLabelKeys:
-                                      description: |-
-                                        MatchLabelKeys is a set of pod label keys to select which pods will
-                                        be taken into consideration. The keys are used to lookup values from the
-                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                        to select the group of existing pods which pods will be taken into consideration
-                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                        pod labels will be ignored. The default value is empty.
-                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                      items:
-                                        type: string
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    mismatchLabelKeys:
-                                      description: |-
-                                        MismatchLabelKeys is a set of pod label keys to select which pods will
-                                        be taken into consideration. The keys are used to lookup values from the
-                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                        to select the group of existing pods which pods will be taken into consideration
-                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                        pod labels will be ignored. The default value is empty.
-                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                      items:
-                                        type: string
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    namespaceSelector:
-                                      description: |-
-                                        A label query over the set of namespaces that the term applies to.
-                                        The term is applied to the union of the namespaces selected by this field
-                                        and the ones listed in the namespaces field.
-                                        null selector and null or empty namespaces list means "this pod's namespace".
-                                        An empty selector ({}) matches all namespaces.
-                                      properties:
-                                        matchExpressions:
-                                          description: matchExpressions is a list
-                                            of label selector requirements. The requirements
-                                            are ANDed.
-                                          items:
-                                            description: |-
-                                              A label selector requirement is a selector that contains values, a key, and an operator that
-                                              relates the key and values.
-                                            properties:
-                                              key:
-                                                description: key is the label key
-                                                  that the selector applies to.
-                                                type: string
-                                              operator:
-                                                description: |-
-                                                  operator represents a key's relationship to a set of values.
-                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                type: string
-                                              values:
-                                                description: |-
-                                                  values is an array of string values. If the operator is In or NotIn,
-                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                  the values array must be empty. This array is replaced during a strategic
-                                                  merge patch.
-                                                items:
-                                                  type: string
-                                                type: array
-                                                x-kubernetes-list-type: atomic
-                                            required:
-                                            - key
-                                            - operator
-                                            type: object
-                                          type: array
-                                          x-kubernetes-list-type: atomic
-                                        matchLabels:
-                                          additionalProperties:
-                                            type: string
-                                          description: |-
-                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                          type: object
-                                      type: object
-                                      x-kubernetes-map-type: atomic
-                                    namespaces:
-                                      description: |-
-                                        namespaces specifies a static list of namespace names that the term applies to.
-                                        The term is applied to the union of the namespaces listed in this field
-                                        and the ones selected by namespaceSelector.
-                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                      items:
-                                        type: string
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    topologyKey:
-                                      description: |-
-                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                        whose value of the label with key topologyKey matches that of any node on which any of the
-                                        selected pods is running.
-                                        Empty topologyKey is not allowed.
-                                      type: string
-                                  required:
-                                  - topologyKey
-                                  type: object
-                                weight:
-                                  description: |-
-                                    weight associated with matching the corresponding podAffinityTerm,
-                                    in the range 1-100.
-                                  format: int32
-                                  type: integer
-                              required:
-                              - podAffinityTerm
-                              - weight
-                              type: object
-                            type: array
-                            x-kubernetes-list-type: atomic
-                          requiredDuringSchedulingIgnoredDuringExecution:
-                            description: |-
-                              If the affinity requirements specified by this field are not met at
-                              scheduling time, the pod will not be scheduled onto the node.
-                              If the affinity requirements specified by this field cease to be met
-                              at some point during pod execution (e.g. due to a pod label update), the
-                              system may or may not try to eventually evict the pod from its node.
-                              When there are multiple elements, the lists of nodes corresponding to each
-                              podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                            items:
-                              description: |-
-                                Defines a set of pods (namely those matching the labelSelector
-                                relative to the given namespace(s)) that this pod should be
-                                co-located (affinity) or not co-located (anti-affinity) with,
-                                where co-located is defined as running on a node whose value of
-                                the label with key <topologyKey> matches that of any node on which
-                                a pod of the set of pods is running
-                              properties:
-                                labelSelector:
-                                  description: |-
-                                    A label query over a set of resources, in this case pods.
-                                    If it's null, this PodAffinityTerm matches with no Pods.
-                                  properties:
-                                    matchExpressions:
-                                      description: matchExpressions is a list of label
-                                        selector requirements. The requirements are
-                                        ANDed.
-                                      items:
-                                        description: |-
-                                          A label selector requirement is a selector that contains values, a key, and an operator that
-                                          relates the key and values.
-                                        properties:
-                                          key:
-                                            description: key is the label key that
-                                              the selector applies to.
-                                            type: string
-                                          operator:
-                                            description: |-
-                                              operator represents a key's relationship to a set of values.
-                                              Valid operators are In, NotIn, Exists and DoesNotExist.
-                                            type: string
-                                          values:
-                                            description: |-
-                                              values is an array of string values. If the operator is In or NotIn,
-                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                              the values array must be empty. This array is replaced during a strategic
-                                              merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                            x-kubernetes-list-type: atomic
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    matchLabels:
-                                      additionalProperties:
-                                        type: string
-                                      description: |-
-                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                      type: object
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                                matchLabelKeys:
-                                  description: |-
-                                    MatchLabelKeys is a set of pod label keys to select which pods will
-                                    be taken into consideration. The keys are used to lookup values from the
-                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                    to select the group of existing pods which pods will be taken into consideration
-                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                    pod labels will be ignored. The default value is empty.
-                                    The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                    Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                  items:
-                                    type: string
-                                  type: array
-                                  x-kubernetes-list-type: atomic
-                                mismatchLabelKeys:
-                                  description: |-
-                                    MismatchLabelKeys is a set of pod label keys to select which pods will
-                                    be taken into consideration. The keys are used to lookup values from the
-                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                    to select the group of existing pods which pods will be taken into consideration
-                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                    pod labels will be ignored. The default value is empty.
-                                    The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                    Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                  items:
-                                    type: string
-                                  type: array
-                                  x-kubernetes-list-type: atomic
-                                namespaceSelector:
-                                  description: |-
-                                    A label query over the set of namespaces that the term applies to.
-                                    The term is applied to the union of the namespaces selected by this field
-                                    and the ones listed in the namespaces field.
-                                    null selector and null or empty namespaces list means "this pod's namespace".
-                                    An empty selector ({}) matches all namespaces.
-                                  properties:
-                                    matchExpressions:
-                                      description: matchExpressions is a list of label
-                                        selector requirements. The requirements are
-                                        ANDed.
-                                      items:
-                                        description: |-
-                                          A label selector requirement is a selector that contains values, a key, and an operator that
-                                          relates the key and values.
-                                        properties:
-                                          key:
-                                            description: key is the label key that
-                                              the selector applies to.
-                                            type: string
-                                          operator:
-                                            description: |-
-                                              operator represents a key's relationship to a set of values.
-                                              Valid operators are In, NotIn, Exists and DoesNotExist.
-                                            type: string
-                                          values:
-                                            description: |-
-                                              values is an array of string values. If the operator is In or NotIn,
-                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                              the values array must be empty. This array is replaced during a strategic
-                                              merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                            x-kubernetes-list-type: atomic
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    matchLabels:
-                                      additionalProperties:
-                                        type: string
-                                      description: |-
-                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                      type: object
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                                namespaces:
-                                  description: |-
-                                    namespaces specifies a static list of namespace names that the term applies to.
-                                    The term is applied to the union of the namespaces listed in this field
-                                    and the ones selected by namespaceSelector.
-                                    null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                  items:
-                                    type: string
-                                  type: array
-                                  x-kubernetes-list-type: atomic
-                                topologyKey:
-                                  description: |-
-                                    This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                    the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                    whose value of the label with key topologyKey matches that of any node on which any of the
-                                    selected pods is running.
-                                    Empty topologyKey is not allowed.
-                                  type: string
-                              required:
-                              - topologyKey
-                              type: object
-                            type: array
-                            x-kubernetes-list-type: atomic
-                        type: object
-                      podAntiAffinity:
-                        description: Describes pod anti-affinity scheduling rules
-                          (e.g. avoid putting this pod in the same node, zone, etc.
-                          as some other pod(s)).
-                        properties:
-                          preferredDuringSchedulingIgnoredDuringExecution:
-                            description: |-
-                              The scheduler will prefer to schedule pods to nodes that satisfy
-                              the anti-affinity expressions specified by this field, but it may choose
-                              a node that violates one or more of the expressions. The node that is
-                              most preferred is the one with the greatest sum of weights, i.e.
-                              for each node that meets all of the scheduling requirements (resource
-                              request, requiredDuringScheduling anti-affinity expressions, etc.),
-                              compute a sum by iterating through the elements of this field and subtracting
-                              "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
-                              node(s) with the highest sum are the most preferred.
-                            items:
-                              description: The weights of all of the matched WeightedPodAffinityTerm
-                                fields are added per-node to find the most preferred
-                                node(s)
-                              properties:
-                                podAffinityTerm:
-                                  description: Required. A pod affinity term, associated
-                                    with the corresponding weight.
-                                  properties:
-                                    labelSelector:
-                                      description: |-
-                                        A label query over a set of resources, in this case pods.
-                                        If it's null, this PodAffinityTerm matches with no Pods.
-                                      properties:
-                                        matchExpressions:
-                                          description: matchExpressions is a list
-                                            of label selector requirements. The requirements
-                                            are ANDed.
-                                          items:
-                                            description: |-
-                                              A label selector requirement is a selector that contains values, a key, and an operator that
-                                              relates the key and values.
-                                            properties:
-                                              key:
-                                                description: key is the label key
-                                                  that the selector applies to.
-                                                type: string
-                                              operator:
-                                                description: |-
-                                                  operator represents a key's relationship to a set of values.
-                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                type: string
-                                              values:
-                                                description: |-
-                                                  values is an array of string values. If the operator is In or NotIn,
-                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                  the values array must be empty. This array is replaced during a strategic
-                                                  merge patch.
-                                                items:
-                                                  type: string
-                                                type: array
-                                                x-kubernetes-list-type: atomic
-                                            required:
-                                            - key
-                                            - operator
-                                            type: object
-                                          type: array
-                                          x-kubernetes-list-type: atomic
-                                        matchLabels:
-                                          additionalProperties:
-                                            type: string
-                                          description: |-
-                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                          type: object
-                                      type: object
-                                      x-kubernetes-map-type: atomic
-                                    matchLabelKeys:
-                                      description: |-
-                                        MatchLabelKeys is a set of pod label keys to select which pods will
-                                        be taken into consideration. The keys are used to lookup values from the
-                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                        to select the group of existing pods which pods will be taken into consideration
-                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                        pod labels will be ignored. The default value is empty.
-                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                      items:
-                                        type: string
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    mismatchLabelKeys:
-                                      description: |-
-                                        MismatchLabelKeys is a set of pod label keys to select which pods will
-                                        be taken into consideration. The keys are used to lookup values from the
-                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                        to select the group of existing pods which pods will be taken into consideration
-                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                        pod labels will be ignored. The default value is empty.
-                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                      items:
-                                        type: string
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    namespaceSelector:
-                                      description: |-
-                                        A label query over the set of namespaces that the term applies to.
-                                        The term is applied to the union of the namespaces selected by this field
-                                        and the ones listed in the namespaces field.
-                                        null selector and null or empty namespaces list means "this pod's namespace".
-                                        An empty selector ({}) matches all namespaces.
-                                      properties:
-                                        matchExpressions:
-                                          description: matchExpressions is a list
-                                            of label selector requirements. The requirements
-                                            are ANDed.
-                                          items:
-                                            description: |-
-                                              A label selector requirement is a selector that contains values, a key, and an operator that
-                                              relates the key and values.
-                                            properties:
-                                              key:
-                                                description: key is the label key
-                                                  that the selector applies to.
-                                                type: string
-                                              operator:
-                                                description: |-
-                                                  operator represents a key's relationship to a set of values.
-                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                type: string
-                                              values:
-                                                description: |-
-                                                  values is an array of string values. If the operator is In or NotIn,
-                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                                  the values array must be empty. This array is replaced during a strategic
-                                                  merge patch.
-                                                items:
-                                                  type: string
-                                                type: array
-                                                x-kubernetes-list-type: atomic
-                                            required:
-                                            - key
-                                            - operator
-                                            type: object
-                                          type: array
-                                          x-kubernetes-list-type: atomic
-                                        matchLabels:
-                                          additionalProperties:
-                                            type: string
-                                          description: |-
-                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                          type: object
-                                      type: object
-                                      x-kubernetes-map-type: atomic
-                                    namespaces:
-                                      description: |-
-                                        namespaces specifies a static list of namespace names that the term applies to.
-                                        The term is applied to the union of the namespaces listed in this field
-                                        and the ones selected by namespaceSelector.
-                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                      items:
-                                        type: string
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    topologyKey:
-                                      description: |-
-                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                        whose value of the label with key topologyKey matches that of any node on which any of the
-                                        selected pods is running.
-                                        Empty topologyKey is not allowed.
-                                      type: string
-                                  required:
-                                  - topologyKey
-                                  type: object
-                                weight:
-                                  description: |-
-                                    weight associated with matching the corresponding podAffinityTerm,
-                                    in the range 1-100.
-                                  format: int32
-                                  type: integer
-                              required:
-                              - podAffinityTerm
-                              - weight
-                              type: object
-                            type: array
-                            x-kubernetes-list-type: atomic
-                          requiredDuringSchedulingIgnoredDuringExecution:
-                            description: |-
-                              If the anti-affinity requirements specified by this field are not met at
-                              scheduling time, the pod will not be scheduled onto the node.
-                              If the anti-affinity requirements specified by this field cease to be met
-                              at some point during pod execution (e.g. due to a pod label update), the
-                              system may or may not try to eventually evict the pod from its node.
-                              When there are multiple elements, the lists of nodes corresponding to each
-                              podAffinityTerm are intersected, i.e. all terms must be satisfied.
-                            items:
-                              description: |-
-                                Defines a set of pods (namely those matching the labelSelector
-                                relative to the given namespace(s)) that this pod should be
-                                co-located (affinity) or not co-located (anti-affinity) with,
-                                where co-located is defined as running on a node whose value of
-                                the label with key <topologyKey> matches that of any node on which
-                                a pod of the set of pods is running
-                              properties:
-                                labelSelector:
-                                  description: |-
-                                    A label query over a set of resources, in this case pods.
-                                    If it's null, this PodAffinityTerm matches with no Pods.
-                                  properties:
-                                    matchExpressions:
-                                      description: matchExpressions is a list of label
-                                        selector requirements. The requirements are
-                                        ANDed.
-                                      items:
-                                        description: |-
-                                          A label selector requirement is a selector that contains values, a key, and an operator that
-                                          relates the key and values.
-                                        properties:
-                                          key:
-                                            description: key is the label key that
-                                              the selector applies to.
-                                            type: string
-                                          operator:
-                                            description: |-
-                                              operator represents a key's relationship to a set of values.
-                                              Valid operators are In, NotIn, Exists and DoesNotExist.
-                                            type: string
-                                          values:
-                                            description: |-
-                                              values is an array of string values. If the operator is In or NotIn,
-                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                              the values array must be empty. This array is replaced during a strategic
-                                              merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                            x-kubernetes-list-type: atomic
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    matchLabels:
-                                      additionalProperties:
-                                        type: string
-                                      description: |-
-                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                      type: object
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                                matchLabelKeys:
-                                  description: |-
-                                    MatchLabelKeys is a set of pod label keys to select which pods will
-                                    be taken into consideration. The keys are used to lookup values from the
-                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-                                    to select the group of existing pods which pods will be taken into consideration
-                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                    pod labels will be ignored. The default value is empty.
-                                    The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-                                    Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                  items:
-                                    type: string
-                                  type: array
-                                  x-kubernetes-list-type: atomic
-                                mismatchLabelKeys:
-                                  description: |-
-                                    MismatchLabelKeys is a set of pod label keys to select which pods will
-                                    be taken into consideration. The keys are used to lookup values from the
-                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-                                    to select the group of existing pods which pods will be taken into consideration
-                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-                                    pod labels will be ignored. The default value is empty.
-                                    The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-                                    Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                  items:
-                                    type: string
-                                  type: array
-                                  x-kubernetes-list-type: atomic
-                                namespaceSelector:
-                                  description: |-
-                                    A label query over the set of namespaces that the term applies to.
-                                    The term is applied to the union of the namespaces selected by this field
-                                    and the ones listed in the namespaces field.
-                                    null selector and null or empty namespaces list means "this pod's namespace".
-                                    An empty selector ({}) matches all namespaces.
-                                  properties:
-                                    matchExpressions:
-                                      description: matchExpressions is a list of label
-                                        selector requirements. The requirements are
-                                        ANDed.
-                                      items:
-                                        description: |-
-                                          A label selector requirement is a selector that contains values, a key, and an operator that
-                                          relates the key and values.
-                                        properties:
-                                          key:
-                                            description: key is the label key that
-                                              the selector applies to.
-                                            type: string
-                                          operator:
-                                            description: |-
-                                              operator represents a key's relationship to a set of values.
-                                              Valid operators are In, NotIn, Exists and DoesNotExist.
-                                            type: string
-                                          values:
-                                            description: |-
-                                              values is an array of string values. If the operator is In or NotIn,
-                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
-                                              the values array must be empty. This array is replaced during a strategic
-                                              merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                            x-kubernetes-list-type: atomic
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                      x-kubernetes-list-type: atomic
-                                    matchLabels:
-                                      additionalProperties:
-                                        type: string
-                                      description: |-
-                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
-                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                      type: object
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                                namespaces:
-                                  description: |-
-                                    namespaces specifies a static list of namespace names that the term applies to.
-                                    The term is applied to the union of the namespaces listed in this field
-                                    and the ones selected by namespaceSelector.
-                                    null or empty namespaces list and null namespaceSelector means "this pod's namespace".
-                                  items:
-                                    type: string
-                                  type: array
-                                  x-kubernetes-list-type: atomic
-                                topologyKey:
-                                  description: |-
-                                    This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-                                    the labelSelector in the specified namespaces, where co-located is defined as running on a node
-                                    whose value of the label with key topologyKey matches that of any node on which any of the
-                                    selected pods is running.
-                                    Empty topologyKey is not allowed.
-                                  type: string
-                              required:
-                              - topologyKey
-                              type: object
-                            type: array
-                            x-kubernetes-list-type: atomic
-                        type: object
-                    type: object
-                  nodeSelector:
-                    additionalProperties:
-                      type: string
-                    description: NodeSelector constrains worker pods to nodes with
-                      matching labels.
-                    type: object
-                  runtimeClassName:
-                    description: RuntimeClassName routes worker pods through a specific
-                      RuntimeClass.
-                    type: string
-                  tolerations:
-                    description: Tolerations allows worker pods to schedule onto tainted
-                      nodes.
-                    items:
-                      description: |-
-                        The pod this Toleration is attached to tolerates any taint that matches
-                        the triple <key,value,effect> using the matching operator <operator>.
-                      properties:
-                        effect:
-                          description: |-
-                            Effect indicates the taint effect to match. Empty means match all taint effects.
-                            When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
-                          type: string
-                        key:
-                          description: |-
-                            Key is the taint key that the toleration applies to. Empty means match all taint keys.
-                            If the key is empty, operator must be Exists; this combination means to match all values and all keys.
-                          type: string
-                        operator:
-                          description: |-
-                            Operator represents a key's relationship to the value.
-                            Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
-                            Exists is equivalent to wildcard for value, so that a pod can
-                            tolerate all taints of a particular category.
-                            Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
-                          type: string
-                        tolerationSeconds:
-                          description: |-
-                            TolerationSeconds represents the period of time the toleration (which must be
-                            of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-                            it is not set, which means tolerate the taint forever (do not evict). Zero and
-                            negative values will be treated as 0 (evict immediately) by the system.
-                          format: int64
-                          type: integer
-                        value:
-                          description: |-
-                            Value is the taint value the toleration matches to.
-                            If the operator is Exists, the value should be empty, otherwise just a regular string.
-                          type: string
-                      type: object
-                    type: array
-                  workspace:
-                    description: |-
-                      Workspace requests an upstream agent-sandbox execution workspace for agent Tasks.
-                      When enabled, the Task controller validates the request and propagates the
-                      resolved sandbox settings to the agent worker Job. The worker wrapper then
-                      claims the sandbox workspace and runs the configured agent runtime inside it.
-                    properties:
-                      boot:
-                        description: |-
-                          Boot asks providers that support it to boot the workspace workload from scratch
-                          instead of resuming from the provider's default snapshot. Currently supported
-                          by the Substrate provider.
-                        type: boolean
-                      classRef:
-                        description: |-
-                          ClassRef selects an immutable ExecutionWorkspaceClass in the Task namespace. Setting
-                          classRef implicitly enables the controller-first workspace path.
-                        properties:
-                          name:
-                            description: Name is the class name.
-                            minLength: 1
-                            type: string
-                        required:
-                        - name
-                        type: object
-                      cleanupPolicy:
-                        description: |-
-                          CleanupPolicy controls whether the workspace is deleted or retained after use.
-                          Defaults to delete when omitted.
-                        enum:
-                        - delete
-                        - retain
-                        type: string
-                      enabled:
-                        default: false
-                        description: Enabled requests use of a durable workspace for
-                          the task execution.
-                        type: boolean
-                      hibernation:
-                        description: |-
-                          Hibernation configures process lifetime inside the workspace. Resident
-                          mode is currently rejected until the worker protocol can report per-turn
-                          completion separately from resident process lifetime.
-                        properties:
-                          processMode:
-                            description: |-
-                              ProcessMode controls whether each turn starts fresh or reuses a resident
-                              process. Defaults to fresh.
-                            enum:
-                            - fresh
-                            - resident
-                            type: string
-                          residentKey:
-                            description: |-
-                              ResidentKey selects the process slot for resident mode. When omitted, the
-                              worker derives a stable key from namespace, template, and reuse key.
-                            type: string
-                        type: object
-                      onDetach:
-                        description: OnDetach requests an action allowed by the selected
-                          class.
-                        enum:
-                        - Suspend
-                        - Delete
-                        type: string
-                      poolRef:
-                        description: |-
-                          PoolRef references an operator-managed Substrate actor pool for placement,
-                          density tracking, and oversubscription policy.
-                        properties:
-                          name:
-                            description: Name is the pool name.
-                            type: string
-                          namespace:
-                            description: Namespace is the pool namespace. It defaults
-                              to the Task namespace.
-                            type: string
-                        type: object
-                      provider:
-                        description: |-
-                          Provider selects the workspace backend. When omitted, the controller
-                          resolves the configured default workspace provider; the built-in
-                          compatibility default is agent-sandbox.
-                        enum:
-                        - agent-sandbox
-                        - substrate
-                        type: string
-                      reusePolicy:
-                        default: none
-                        description: |-
-                          ReusePolicy controls whether the workspace is fresh or session-scoped.
-                          Defaults to none when omitted.
-                        enum:
-                        - none
-                        - session
-                        type: string
-                      snapshot:
-                        description: |-
-                          Snapshot configures explicit provider snapshot restore/checkpoint behavior.
-                          Non-empty settings are currently rejected until provider checkpoint/restore
-                          support is available through Orka.
-                        properties:
-                          checkpointOnRelease:
-                            description: |-
-                              CheckpointOnRelease requests a checkpoint when cleanup releases or retains
-                              the workspace. CheckpointURI must be set when this is true.
-                            type: boolean
-                          checkpointURI:
-                            description: |-
-                              CheckpointURI is a provider-native snapshot URI prefix to write when the
-                              workspace is retained or released.
-                            type: string
-                          restoreURI:
-                            description: |-
-                              RestoreURI is a provider-native snapshot URI prefix to restore before the
-                              workspace command runs.
-                            type: string
-                        type: object
-                      templateRef:
-                        description: |-
-                          TemplateRef references the workspace template to instantiate or reuse.
-                          The template name is required when enabled is true unless the controller
-                          is configured with a provider-specific default template.
-                        properties:
-                          name:
-                            description: Name is the name of the workspace template.
-                            type: string
-                          namespace:
-                            description: |-
-                              Namespace is the namespace of the workspace template and claim.
-                              It defaults to the Task namespace, or the controller namespace when configured.
-                            type: string
-                        type: object
-                      workspaceSlot:
-                        default: default
-                        description: WorkspaceSlot names one independently reusable
-                          workspace within a Session.
-                        maxLength: 63
-                        minLength: 1
-                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                        type: string
-                    type: object
-                    x-kubernetes-validations:
-                    - message: classRef cannot be combined with legacy enabled, provider,
-                        template, pool, cleanup, boot, snapshot, or hibernation settings
-                      rule: '!has(self.classRef) || (!has(self.provider) && !has(self.templateRef)
-                        && !has(self.poolRef) && (!has(self.enabled) || !self.enabled)
-                        && !has(self.cleanupPolicy) && (!has(self.boot) || !self.boot)
-                        && !has(self.snapshot) && !has(self.hibernation))'
-                type: object
-              failedRunsHistoryLimit:
-                default: 1
-                description: FailedRunsHistoryLimit is the number of failed child
-                  tasks to retain.
-                format: int32
-                minimum: 0
-                type: integer
-              image:
-                description: Image is the container image to run for the task
-                type: string
-              priorTaskRef:
-                description: |-
-                  PriorTaskRef references a previously completed task whose diff should be
-                  applied to the workspace before this task begins execution.
-                properties:
-                  name:
-                    description: Name is the name of the prior task
-                    type: string
-                  namespace:
-                    description: Namespace is the namespace of the prior task (defaults
-                      to Task namespace)
-                    type: string
-                required:
-                - name
-                type: object
-              priority:
-                default: 500
-                description: Priority is the queue priority (0-1000, higher = more
-                  urgent)
-                format: int32
-                maximum: 1000
-                minimum: 0
-                type: integer
-              prompt:
-                description: Prompt is the task-specific prompt (used with agentRef)
-                type: string
-              requestedBy:
-                description: |-
-                  RequestedBy records the verified identity that created the task.
-                  This field is populated by the API server and is immutable.
-                properties:
-                  email:
-                    description: Email is the email claim, if present.
-                    type: string
-                  groups:
-                    description: Groups are verified group values, if present.
-                    items:
-                      type: string
-                    type: array
-                  issuer:
-                    description: Issuer is the token issuer that authenticated the
-                      requester.
-                    type: string
-                  roles:
-                    description: Roles are verified role or scope values, if present.
-                    items:
-                      type: string
-                    type: array
-                  subject:
-                    description: Subject is the verified subject claim.
-                    type: string
-                  username:
-                    description: Username is the verified username, if present.
-                    type: string
-                type: object
-              resources:
-                description: Resources defines the compute resources for the task
-                properties:
-                  claims:
-                    description: |-
-                      Claims lists the names of resources, defined in spec.resourceClaims,
-                      that are used by this container.
-
-                      This field depends on the
-                      DynamicResourceAllocation feature gate.
-
-                      This field is immutable. It can only be set for containers.
-                    items:
-                      description: ResourceClaim references one entry in PodSpec.ResourceClaims.
-                      properties:
-                        name:
-                          description: |-
-                            Name must match the name of one entry in pod.spec.resourceClaims of
-                            the Pod where this field is used. It makes that resource available
-                            inside a container.
-                          type: string
-                        request:
-                          description: |-
-                            Request is the name chosen for a request in the referenced claim.
-                            If empty, everything from the claim is made available, otherwise
-                            only the result of this request.
-                          type: string
-                      required:
-                      - name
-                      type: object
-                    type: array
-                    x-kubernetes-list-map-keys:
-                    - name
-                    x-kubernetes-list-type: map
-                  limits:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Limits describes the maximum amount of compute resources allowed.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                  requests:
-                    additionalProperties:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                      x-kubernetes-int-or-string: true
-                    description: |-
-                      Requests describes the minimum amount of compute resources required.
-                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                    type: object
-                type: object
-              retryPolicy:
-                description: RetryPolicy defines the retry behavior for failed tasks
-                properties:
-                  backoffMultiplier:
-                    default: 2
-                    description: BackoffMultiplier is the exponential backoff multiplier
-                    type: number
-                  initialDelay:
-                    description: InitialDelay is the initial delay before the first
-                      retry
-                    type: string
-                  maxRetries:
-                    default: 0
-                    description: MaxRetries is the maximum number of retry attempts
-                    format: int32
-                    minimum: 0
-                    type: integer
-                type: object
-              schedule:
-                description: |-
-                  Schedule is a cron expression for recurring tasks (e.g., "0 */6 * * *").
-                  When set, the controller creates child Task CRs on each cron tick.
-                type: string
-              secretRef:
-                description: SecretRef references a Kubernetes Secret containing credentials
-                properties:
-                  name:
-                    description: Name is the name of the Secret
-                    type: string
-                  namespace:
-                    description: Namespace is the namespace of the Secret (defaults
-                      to Task namespace)
-                    type: string
-                required:
-                - name
-                type: object
-              sessionRef:
-                description: SessionRef references a session for conversation continuity
-                properties:
-                  append:
-                    default: true
-                    description: Append indicates whether to append task messages
-                      to the session transcript
-                    type: boolean
-                  create:
-                    default: false
-                    description: Create indicates whether to create the session if
-                      it doesn't exist
-                    type: boolean
-                  maxMessages:
-                    default: 50
-                    description: MaxMessages is the maximum number of messages to
-                      load from session
-                    format: int32
-                    minimum: 1
-                    type: integer
-                  name:
-                    description: 'Name is the session identifier (ConfigMap: session-<name>)'
-                    type: string
-                  promptIncluded:
-                    description: |-
-                      PromptIncluded reports that the current Task prompt is already the final user message in the bounded transcript.
-                      Workers must not append prompt a second time when this is true.
-                    type: boolean
-                  throughMessageId:
-                    description: |-
-                      ThroughMessageID limits transcript loading to the logical history at and before this stable message ID.
-                      Gateway-created Tasks use it so later queued user messages cannot enter an earlier turn.
-                    maxLength: 256
-                    type: string
-                required:
-                - name
-                type: object
-              startingDeadlineSeconds:
-                default: 100
-                description: |-
-                  StartingDeadlineSeconds is the deadline in seconds for starting a missed scheduled run.
-                  If the schedule is missed by more than this many seconds, the run is skipped.
-                format: int64
-                type: integer
-              successfulRunsHistoryLimit:
-                default: 3
-                description: SuccessfulRunsHistoryLimit is the number of successful
-                  child tasks to retain.
-                format: int32
-                minimum: 0
-                type: integer
-              suspend:
-                description: |-
-                  Suspend tells the controller to suspend subsequent scheduled runs.
-                  It does not apply to already started child tasks. Defaults to false.
-                type: boolean
-              timeZone:
-                description: |-
-                  TimeZone is the IANA time zone for the schedule (e.g., "America/New_York").
-                  Defaults to UTC if not set.
-                type: string
-              timeout:
-                description: Timeout is the maximum duration for the task
-                type: string
-              transaction:
-                description: |-
-                  Transaction records verified transaction-token metadata for audit correlation.
-                  This field is populated by the API server and is immutable.
-                properties:
-                  audience:
-                    description: Audience lists the verified token audience values.
-                    items:
-                      type: string
-                    type: array
-                  context:
-                    additionalProperties:
-                      type: string
-                    description: Context contains allowlisted, non-sensitive transaction
-                      context fields for audit.
-                    type: object
-                  contextDigest:
-                    description: ContextDigest is a SHA256 digest of the full transaction
-                      context.
-                    type: string
-                  id:
-                    description: ID is the verified transaction identifier claim.
-                    type: string
-                  issuer:
-                    description: Issuer is the token issuer that authenticated the
-                      transaction.
-                    type: string
-                  profile:
-                    description: Profile is the context-token profile that authenticated
-                      the request.
-                    type: string
-                  requesterContextDigest:
-                    description: RequesterContextDigest is a SHA256 digest of the
-                      full requester context.
-                    type: string
-                  requestingWorkload:
-                    description: RequestingWorkload is the verified workload that
-                      requested the transaction.
-                    type: string
-                  scope:
-                    description: Scope is the original verified scope string.
-                    type: string
-                  scopes:
-                    description: Scopes lists parsed scope values from the verified
-                      scope string.
-                    items:
-                      type: string
-                    type: array
-                  subject:
-                    description: Subject is the verified subject claim.
-                    type: string
-                type: object
-              type:
-                description: 'Type specifies the task type: "container" or "ai"'
-                enum:
-                - container
-                - ai
-                - agent
-                type: string
-              webhookURL:
-                description: WebhookURL is the URL to call when the task completes
-                type: string
-              workspace:
-                description: |-
-                  Workspace defines repository checkout and push settings for tasks that need
-                  a git workspace. Agent tasks can continue to use agentRuntime.workspace for
-                  compatibility; this top-level field is used by container tasks as well.
-                properties:
-                  branch:
-                    description: Branch is the git branch to checkout
-                    type: string
-                  forkRepo:
-                    description: ForkRepo is the writable fork repository URL for
-                      pushing changes
-                    type: string
-                  gitRepo:
-                    description: GitRepo is the repository URL to clone
-                    type: string
-                  gitSecretRef:
-                    description: GitSecretRef references a Secret containing git credentials
-                    properties:
-                      name:
-                        default: ""
-                        description: |-
-                          Name of the referent.
-                          This field is effectively required, but due to backwards compatibility is
-                          allowed to be empty. Instances of this type with an empty value here are
-                          almost certainly wrong.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  prBaseBranch:
-                    description: PRBaseBranch is the upstream branch to target for
-                      pull requests
-                    type: string
-                  pushBranch:
-                    description: |-
-                      PushBranch is the remote branch name to push changes to after the agent completes.
-                      When set, FinalizeResult will commit and push changes to this branch.
-                    type: string
-                  ref:
-                    description: Ref is a specific git ref (commit SHA, tag) to checkout
-                    type: string
-                  subPath:
-                    description: SubPath is a subdirectory within the repo to use
-                      as workspace root
-                    type: string
-                type: object
-            required:
-            - type
-            type: object
-            x-kubernetes-validations:
-            - message: requestedBy is immutable
-              rule: has(self.requestedBy) == has(oldSelf.requestedBy) && (!has(self.requestedBy)
-                || self.requestedBy == oldSelf.requestedBy)
-            - message: transaction is immutable
-              rule: has(self.transaction) == has(oldSelf.transaction) && (!has(self.transaction)
-                || self.transaction == oldSelf.transaction)
-            - message: session workspace reuse requires spec.sessionRef
-              rule: '!has(self.execution) || !has(self.execution.workspace) || self.execution.workspace.reusePolicy
-                != ''session'' || has(self.sessionRef)'
-          status:
-            description: TaskStatus defines the observed state of Task
-            properties:
-              attempts:
-                description: Attempts is the number of attempts made
-                format: int32
-                type: integer
-              childTasks:
-                description: ChildTasks tracks delegated child tasks (for coordinator
-                  agents)
-                items:
-                  description: ChildTaskStatus tracks the status of a delegated child
-                    task
-                  properties:
-                    agent:
-                      description: Agent is the agent handling the child task
-                      type: string
-                    name:
-                      description: Name is the name of the child task
-                      type: string
-                    phase:
-                      description: Phase is the current phase of the child task
-                      enum:
-                      - Pending
-                      - Running
-                      - Finalizing
-                      - Succeeded
-                      - Failed
-                      - Scheduled
-                      - Cancelled
-                      type: string
-                    result:
-                      description: Result is the result from the child task (if completed)
-                      type: string
-                  required:
-                  - agent
-                  - name
-                  - phase
-                  type: object
-                type: array
-              completionTime:
-                description: CompletionTime is when the task completed
-                format: date-time
-                type: string
-              conditions:
-                description: Conditions represent the current state of the Task
-                items:
-                  description: Condition contains details for one aspect of the current
-                    state of this API Resource.
-                  properties:
-                    lastTransitionTime:
-                      description: |-
-                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                      format: date-time
-                      type: string
-                    message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
-                      maxLength: 32768
-                      type: string
-                    observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
-                      format: int64
-                      minimum: 0
-                      type: integer
-                    reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
-                      maxLength: 1024
-                      minLength: 1
-                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                      type: string
-                    status:
-                      description: status of the condition, one of True, False, Unknown.
-                      enum:
-                      - "True"
-                      - "False"
-                      - Unknown
-                      type: string
-                    type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                      maxLength: 316
-                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - message
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-                x-kubernetes-list-map-keys:
-                - type
-                x-kubernetes-list-type: map
-              executionOutcome:
-                description: |-
-                  ExecutionOutcome is the immutable outcome recorded when workload execution ends. Workspace
-                  attachment revocation and cleanup continue independently while the Task is Finalizing.
-                properties:
-                  attempt:
-                    description: Attempt is the Task attempt that produced this outcome.
-                    format: int32
-                    minimum: 1
-                    type: integer
-                  message:
-                    description: Message contains sanitized execution context.
-                    type: string
-                  phase:
-                    allOf:
-                    - enum:
-                      - Pending
-                      - Running
-                      - Finalizing
-                      - Succeeded
-                      - Failed
-                      - Scheduled
-                      - Cancelled
-                    - enum:
-                      - Succeeded
-                      - Failed
-                      - Cancelled
-                    description: Phase is the terminal workload execution phase.
-                    type: string
-                  recordedAt:
-                    description: RecordedAt is when Orka durably recorded the execution
-                      outcome.
-                    format: date-time
-                    type: string
-                  resultRef:
-                    description: ResultRef indicates whether the corresponding result
-                      was persisted.
-                    properties:
-                      available:
-                        description: Available indicates whether a result has been
-                          stored for this task
-                        type: boolean
-                    required:
-                    - available
-                    type: object
-                required:
-                - attempt
-                - phase
-                - recordedAt
-                type: object
-              executionWorkspace:
-                description: |-
-                  ExecutionWorkspace reports the provider-neutral lifecycle state for a
-                  requested execution workspace. Provider-native identifiers and credentials
-                  are intentionally omitted.
-                properties:
-                  attachedEpoch:
-                    description: AttachedEpoch is the attachment epoch enforced for
-                      this Task.
-                    format: int64
-                    type: integer
-                  classRef:
-                    description: ClassRef is the provider-neutral class selected for
-                      controller-first execution.
-                    properties:
-                      name:
-                        description: Name is the class name.
-                        minLength: 1
-                        type: string
-                    required:
-                    - name
-                    type: object
-                  cleanupPolicy:
-                    description: CleanupPolicy is the resolved cleanup policy.
-                    enum:
-                    - delete
-                    - retain
-                    type: string
-                  conditions:
-                    description: Conditions project generic workspace admission, readiness,
-                      attachment, and finalization state.
-                    items:
-                      description: Condition contains details for one aspect of the
-                        current state of this API Resource.
-                      properties:
-                        lastTransitionTime:
-                          description: |-
-                            lastTransitionTime is the last time the condition transitioned from one status to another.
-                            This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                          format: date-time
-                          type: string
-                        message:
-                          description: |-
-                            message is a human readable message indicating details about the transition.
-                            This may be an empty string.
-                          maxLength: 32768
-                          type: string
-                        observedGeneration:
-                          description: |-
-                            observedGeneration represents the .metadata.generation that the condition was set based upon.
-                            For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                            with respect to the current state of the instance.
-                          format: int64
-                          minimum: 0
-                          type: integer
-                        reason:
-                          description: |-
-                            reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                            Producers of specific condition types may define expected values and meanings for this field,
-                            and whether the values are considered a guaranteed API.
-                            The value should be a CamelCase string.
-                            This field may not be empty.
-                          maxLength: 1024
-                          minLength: 1
-                          pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                          type: string
-                        status:
-                          description: status of the condition, one of True, False,
-                            Unknown.
-                          enum:
-                          - "True"
-                          - "False"
-                          - Unknown
-                          type: string
-                        type:
-                          description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                          maxLength: 316
-                          pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                          type: string
-                      required:
-                      - lastTransitionTime
-                      - message
-                      - reason
-                      - status
-                      - type
-                      type: object
-                    type: array
-                    x-kubernetes-list-map-keys:
-                    - type
-                    x-kubernetes-list-type: map
-                  density:
-                    description: Density reports non-secret actor and worker counts
-                      for the workspace provider.
-                    properties:
-                      actorCount:
-                        description: ActorCount is the number of actors reported by
-                          the provider.
-                        format: int32
-                        type: integer
-                      actorsPerWorker:
-                        description: ActorsPerWorker is ActorCount divided by WorkerCount,
-                          formatted as a decimal string.
-                        type: string
-                      runningActorCount:
-                        description: RunningActorCount is the number of actors currently
-                          running on workers.
-                        format: int32
-                        type: integer
-                      suspendedActorCount:
-                        description: SuspendedActorCount is the number of actors currently
-                          suspended.
-                        format: int32
-                        type: integer
-                      workerCount:
-                        description: WorkerCount is the number of workers reported
-                          by the provider.
-                        format: int32
-                        type: integer
-                    type: object
-                  lastUpdateTime:
-                    description: LastUpdateTime is the last time workspace status
-                      was updated.
-                    format: date-time
-                    type: string
-                  message:
-                    description: Message contains sanitized lifecycle context.
-                    type: string
-                  phase:
-                    description: Phase is the provider-neutral lifecycle phase.
-                    enum:
-                    - Pending
-                    - Ready
-                    - Released
-                    - Retained
-                    - Deleted
-                    - Failed
-                    type: string
-                  placement:
-                    description: Placement reports non-secret runtime placement metadata
-                      for the workspace.
-                    properties:
-                      workerNamespace:
-                        description: WorkerNamespace is the namespace containing the
-                          selected worker pod.
-                        type: string
-                      workerPodName:
-                        description: WorkerPodName is the selected worker pod name
-                          when available.
-                        type: string
-                      workerPool:
-                        description: WorkerPool is the provider's worker-pool name
-                          when available.
-                        type: string
-                    type: object
-                  provider:
-                    description: Provider is the resolved legacy workspace backend.
-                    enum:
-                    - agent-sandbox
-                    - substrate
-                    type: string
-                  reason:
-                    description: Reason is the provider-neutral lifecycle reason.
-                    enum:
-                    - WorkspacePending
-                    - WorkspaceClaimed
-                    - WorkspaceReady
-                    - WorkspaceReleased
-                    - WorkspaceRetained
-                    - WorkspaceDeleted
-                    - WorkspaceValidationFailed
-                    - WorkspaceAttachmentLocked
-                    - WorkspaceClaimFailed
-                    - WorkspaceReadinessFailed
-                    - WorkspaceHandoffFailed
-                    - WorkspaceCommandFailed
-                    - WorkspaceSecretScrubFailed
-                    - WorkspaceCleanupFailed
-                    - WorkspaceStatusUpdateFailed
-                    type: string
-                  resumeLatency:
-                    description: ResumeLatency is the observed time spent resuming
-                      the workspace until it was ready.
-                    type: string
-                  reusePolicy:
-                    description: ReusePolicy is the resolved reuse policy.
-                    enum:
-                    - none
-                    - session
-                    type: string
-                  reused:
-                    description: Reused reports whether an existing workspace was
-                      reattached.
-                    type: boolean
-                  state:
-                    description: State is the provider-neutral concrete workspace
-                      state.
-                    type: string
-                  templateRef:
-                    description: TemplateRef is the resolved workspace template.
-                    properties:
-                      name:
-                        description: Name is the name of the workspace template.
-                        type: string
-                      namespace:
-                        description: |-
-                          Namespace is the namespace of the workspace template and claim.
-                          It defaults to the Task namespace, or the controller namespace when configured.
-                        type: string
-                    type: object
-                  workspaceRef:
-                    description: WorkspaceRef identifies the concrete ExecutionWorkspace
-                      in the Task namespace.
-                    properties:
-                      name:
-                        description: Name is the ExecutionWorkspace name.
-                        type: string
-                      uid:
-                        description: UID is the immutable ExecutionWorkspace UID.
-                        type: string
-                    required:
-                    - name
-                    type: object
-                type: object
-              harnessRuntime:
-                description: |-
-                  HarnessRuntime records the controller-resolved harness runtime target for an
-                  in-flight agent turn. It intentionally stores only non-secret routing metadata
-                  and Secret references, never bearer values.
-                properties:
-                  authRefField:
-                    description: AuthRefField is the Secret data field selected when
-                      the turn started.
-                    type: string
-                  authRefName:
-                    description: AuthRefName is the Secret name selected when the
-                      turn started.
-                    type: string
-                  authRefResourceVersion:
-                    description: AuthRefResourceVersion is the auth Secret resourceVersion
-                      validated before starting the turn.
-                    type: string
-                  contractVersion:
-                    description: ContractVersion is the Orka harness contract version
-                      used for the turn.
-                    type: string
-                  endpoint:
-                    description: Endpoint is the non-secret harness base URL selected
-                      when the turn started.
-                    type: string
-                  runtimeGeneration:
-                    description: RuntimeGeneration is the AgentRuntime generation
-                      selected when the turn started.
-                    format: int64
-                    type: integer
-                  runtimeName:
-                    description: RuntimeName is the runtime name advertised by the
-                      harness capabilities and sent in turn metadata.
-                    type: string
-                  runtimeRefName:
-                    description: RuntimeRefName is the AgentRuntime name for custom
-                      runtimeRef turns. Empty means built-in CLI wrapper.
-                    type: string
-                type: object
-              iteration:
-                description: |-
-                  Iteration is the current autonomous loop iteration (0-based).
-                  Only used when the task's coordination config has autonomous mode enabled.
-                format: int32
-                type: integer
-              jobName:
-                description: JobName is the name of the Kubernetes Job running the
-                  task
-                type: string
-              lastScheduleTime:
-                description: LastScheduleTime is the last time a child task was created
-                  for a scheduled run.
-                format: date-time
-                type: string
-              message:
-                description: Message provides additional status information
-                type: string
-              nextScheduleTime:
-                description: NextScheduleTime is the next time a child task will be
-                  created.
-                format: date-time
-                type: string
-              phase:
-                description: Phase is the current phase of the task
-                enum:
-                - Pending
-                - Running
-                - Finalizing
-                - Succeeded
-                - Failed
-                - Scheduled
-                - Cancelled
-                type: string
-              resultRef:
-                description: ResultRef indicates whether a result is available
-                properties:
-                  available:
-                    description: Available indicates whether a result has been stored
-                      for this task
-                    type: boolean
-                required:
-                - available
-                type: object
-              startTime:
-                description: StartTime is when the task started running
-                format: date-time
-                type: string
-              webhookDelivered:
-                description: WebhookDelivered indicates whether the webhook was successfully
-                  called
-                type: boolean
-            type: object
-            x-kubernetes-validations:
-            - message: executionOutcome is immutable once recorded
-              rule: '!has(oldSelf.executionOutcome) || self.executionOutcome == oldSelf.executionOutcome'
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
+  name: orka-runtimes
 ---
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
+apiVersion: v1
+kind: Namespace
 metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
-  name: tools.core.orka.ai
-spec:
-  group: core.orka.ai
-  names:
-    kind: Tool
-    listKind: ToolList
-    plural: tools
-    singular: tool
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .spec.http.url
-      name: URL
-      type: string
-    - jsonPath: .status.available
-      name: Available
-      type: boolean
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: Tool is the Schema for the tools API
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: ToolSpec defines the desired state of Tool
-            properties:
-              brokeredToolClass:
-                description: |-
-                  BrokeredToolClass declares the governed class for remote AgentRuntime brokered calls.
-                  Tools without this field are not exposed to remote runtimes through brokered governance.
-                enum:
-                - read
-                - write
-                - coordination
-                type: string
-              description:
-                description: Description is the tool description shown to the LLM
-                type: string
-              http:
-                description: |-
-                  HTTP defines the HTTP execution configuration. It is required unless MCP
-                  is set.
-                properties:
-                  authBodyKey:
-                    description: |-
-                      AuthBodyKey is the JSON key name to use when AuthInject=body
-                      For example, "api_key" would inject {"api_key": "<token>", ...}
-                      Only used when AuthInject=body
-                    type: string
-                  authInject:
-                    default: header
-                    description: |-
-                      AuthInject specifies where to inject the auth token: "header" (default) or "body"
-                      When "header", the token is added as Authorization: Bearer <token>
-                      When "body", the token is added to the JSON request body using AuthBodyKey
-                    enum:
-                    - header
-                    - body
-                    type: string
-                  authSecretRef:
-                    description: |-
-                      AuthSecretRef references a Secret containing authentication token
-                      Token is injected as Authorization: Bearer <token> (when AuthInject=header)
-                      or into the request body (when AuthInject=body)
-                    properties:
-                      key:
-                        description: Key is the key within the Secret
-                        type: string
-                      name:
-                        description: Name is the name of the Secret
-                        type: string
-                    required:
-                    - key
-                    - name
-                    type: object
-                  headers:
-                    additionalProperties:
-                      type: string
-                    description: Headers are additional headers to include in requests
-                    type: object
-                  method:
-                    default: POST
-                    description: 'Method is the HTTP method to use (default: POST)'
-                    enum:
-                    - GET
-                    - POST
-                    - PUT
-                    - PATCH
-                    - DELETE
-                    type: string
-                  outboundAccessPolicyRef:
-                    description: OutboundAccessPolicyRef references an OutboundAccessPolicy
-                      in the same namespace.
-                    properties:
-                      name:
-                        description: Name is the referenced object name.
-                        minLength: 1
-                        type: string
-                    required:
-                    - name
-                    type: object
-                  timeout:
-                    description: 'Timeout is the request timeout (default: 30s)'
-                    type: string
-                  url:
-                    description: |-
-                      URL is the endpoint to call when the tool is invoked
-                      Required for plain HTTP tools. MCP actor-backed tools may omit it when
-                      HTTP is present only for transport auth settings.
-                    type: string
-                type: object
-              mcp:
-                description: |-
-                  MCP defines a durable MCP server backend for this tool. MCP tools must set
-                  substrateActor.
-                properties:
-                  path:
-                    description: |-
-                      Path is the HTTP path exposed by the MCP server inside the actor.
-                      Defaults to /mcp.
-                    type: string
-                  substrateActor:
-                    description: SubstrateActor configures the legacy durable Substrate
-                      actor backend.
-                    properties:
-                      boot:
-                        description: Boot asks Substrate to boot this actor from scratch
-                          on first resume.
-                        type: boolean
-                      poolRef:
-                        description: PoolRef optionally assigns this tool actor to
-                          an Orka SubstrateActorPool.
-                        properties:
-                          name:
-                            description: Name is the pool name.
-                            type: string
-                          namespace:
-                            description: Namespace is the pool namespace. It defaults
-                              to the Task namespace.
-                            type: string
-                        type: object
-                      templateRef:
-                        description: TemplateRef references the ActorTemplate that
-                          runs the MCP server.
-                        properties:
-                          name:
-                            description: Name is the name of the workspace template.
-                            type: string
-                          namespace:
-                            description: |-
-                              Namespace is the namespace of the workspace template and claim.
-                              It defaults to the Task namespace, or the controller namespace when configured.
-                            type: string
-                        type: object
-                    required:
-                    - templateRef
-                    type: object
-                  workspace:
-                    description: Workspace configures a provider-neutral Service-mode
-                      ExecutionWorkspace.
-                    properties:
-                      classRef:
-                        description: ClassRef references a class in the Tool namespace.
-                        properties:
-                          name:
-                            description: Name is the class name.
-                            minLength: 1
-                            type: string
-                        required:
-                        - name
-                        type: object
-                      port:
-                        description: Port is the service port exposed by the MCP server.
-                        format: int32
-                        maximum: 65535
-                        minimum: 1
-                        type: integer
-                    required:
-                    - classRef
-                    - port
-                    type: object
-                type: object
-                x-kubernetes-validations:
-                - message: exactly one of substrateActor or workspace is required
-                  rule: has(self.substrateActor) != has(self.workspace)
-              parameters:
-                description: Parameters is the JSON Schema for tool parameters (OpenAI
-                  function calling format)
-                x-kubernetes-preserve-unknown-fields: true
-            required:
-            - description
-            type: object
-            x-kubernetes-validations:
-            - message: http or an MCP workspace backend is required
-              rule: has(self.http) || (has(self.mcp) && (has(self.mcp.substrateActor)
-                || has(self.mcp.workspace)))
-            - message: http.url is required unless an MCP workspace backend is set
-              rule: '!has(self.http) || (has(self.mcp) && (has(self.mcp.substrateActor)
-                || has(self.mcp.workspace))) || (has(self.http.url) && self.http.url.size()
-                > 0)'
-          status:
-            description: ToolStatus defines the observed state of Tool
-            properties:
-              actor:
-                description: Actor reports durable actor metadata when this tool is
-                  MCP actor-backed.
-                properties:
-                  actorID:
-                    description: ActorID is the stable provider actor id.
-                    type: string
-                  poolRef:
-                    description: PoolRef is the resolved Orka actor pool.
-                    properties:
-                      name:
-                        description: Name is the pool name.
-                        type: string
-                      namespace:
-                        description: Namespace is the pool namespace. It defaults
-                          to the Task namespace.
-                        type: string
-                    type: object
-                  provider:
-                    description: Provider is the actor provider.
-                    enum:
-                    - agent-sandbox
-                    - substrate
-                    type: string
-                  routeHost:
-                    description: RouteHost is the HTTP Host value used with the provider
-                      router.
-                    type: string
-                  templateRef:
-                    description: TemplateRef is the resolved actor template.
-                    properties:
-                      name:
-                        description: Name is the name of the workspace template.
-                        type: string
-                      namespace:
-                        description: |-
-                          Namespace is the namespace of the workspace template and claim.
-                          It defaults to the Task namespace, or the controller namespace when configured.
-                        type: string
-                    type: object
-                type: object
-              available:
-                description: Available indicates whether the tool endpoint is reachable
-                type: boolean
-              conditions:
-                description: Conditions represent the current state of the Tool
-                items:
-                  description: Condition contains details for one aspect of the current
-                    state of this API Resource.
-                  properties:
-                    lastTransitionTime:
-                      description: |-
-                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                      format: date-time
-                      type: string
-                    message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
-                      maxLength: 32768
-                      type: string
-                    observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
-                      format: int64
-                      minimum: 0
-                      type: integer
-                    reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
-                      maxLength: 1024
-                      minLength: 1
-                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                      type: string
-                    status:
-                      description: status of the condition, one of True, False, Unknown.
-                      enum:
-                      - "True"
-                      - "False"
-                      - Unknown
-                      type: string
-                    type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                      maxLength: 316
-                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - message
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-                x-kubernetes-list-map-keys:
-                - type
-                x-kubernetes-list-type: map
-              endpoint:
-                description: Endpoint is the resolved non-secret endpoint used by
-                  workers.
-                type: string
-              error:
-                description: Error is the error message if the tool is unavailable
-                type: string
-              lastCheck:
-                description: LastCheck is the timestamp of the last health check
-                format: date-time
-                type: string
-              workspace:
-                description: Workspace reports the provider-neutral Service workspace
-                  backing this Tool.
-                properties:
-                  classRef:
-                    description: ClassRef is the selected Service workspace class.
-                    properties:
-                      name:
-                        description: Name is the class name.
-                        minLength: 1
-                        type: string
-                    required:
-                    - name
-                    type: object
-                  conditions:
-                    description: Conditions project generic readiness and cleanup
-                      state.
-                    items:
-                      description: Condition contains details for one aspect of the
-                        current state of this API Resource.
-                      properties:
-                        lastTransitionTime:
-                          description: |-
-                            lastTransitionTime is the last time the condition transitioned from one status to another.
-                            This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                          format: date-time
-                          type: string
-                        message:
-                          description: |-
-                            message is a human readable message indicating details about the transition.
-                            This may be an empty string.
-                          maxLength: 32768
-                          type: string
-                        observedGeneration:
-                          description: |-
-                            observedGeneration represents the .metadata.generation that the condition was set based upon.
-                            For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                            with respect to the current state of the instance.
-                          format: int64
-                          minimum: 0
-                          type: integer
-                        reason:
-                          description: |-
-                            reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                            Producers of specific condition types may define expected values and meanings for this field,
-                            and whether the values are considered a guaranteed API.
-                            The value should be a CamelCase string.
-                            This field may not be empty.
-                          maxLength: 1024
-                          minLength: 1
-                          pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                          type: string
-                        status:
-                          description: status of the condition, one of True, False,
-                            Unknown.
-                          enum:
-                          - "True"
-                          - "False"
-                          - Unknown
-                          type: string
-                        type:
-                          description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                          maxLength: 316
-                          pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                          type: string
-                      required:
-                      - lastTransitionTime
-                      - message
-                      - reason
-                      - status
-                      - type
-                      type: object
-                    type: array
-                    x-kubernetes-list-map-keys:
-                    - type
-                    x-kubernetes-list-type: map
-                  state:
-                    description: State is the provider-neutral workspace state.
-                    type: string
-                  workspaceRef:
-                    description: WorkspaceRef identifies the owned concrete workspace.
-                    properties:
-                      name:
-                        description: Name is the ExecutionWorkspace name.
-                        type: string
-                      uid:
-                        description: UID is the immutable ExecutionWorkspace UID.
-                        type: string
-                    required:
-                    - name
-                    type: object
-                required:
-                - classRef
-                type: object
-            required:
-            - available
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
+  labels:
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: orka
+    control-plane: controller-manager
+    orka.ai/controller-mode: harness-v2
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/warn: restricted
+  name: orka-system
 ---
 apiVersion: v1
+automountServiceAccountToken: true
 kind: ServiceAccount
 metadata:
   labels:
-    app.kubernetes.io/component: agent-harness-wrapper
+    app.kubernetes.io/component: admission
     app.kubernetes.io/managed-by: kustomize
     app.kubernetes.io/name: orka
-  name: orka-agent-harness-wrapper
+  name: orka-admission
   namespace: orka-system
 ---
 apiVersion: v1
@@ -9628,11 +56,102 @@ metadata:
   namespace: orka-system
 ---
 apiVersion: v1
+automountServiceAccountToken: false
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/component: provider-auth-proxy
+    app.kubernetes.io/name: orka
+  name: orka-provider-auth-proxy
+  namespace: orka-system
+---
+apiVersion: v1
+automountServiceAccountToken: false
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/component: scm-egress-proxy
+    app.kubernetes.io/name: orka
+  name: orka-scm-egress-proxy
+  namespace: orka-system
+---
+apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: orka-vendor-worker
   namespace: orka-system
 ---
+apiVersion: v1
+automountServiceAccountToken: false
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/component: workspace-publisher
+    app.kubernetes.io/name: orka
+  name: orka-workspace-publisher
+  namespace: orka-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: orka
+  name: orka-runtime-controller-role
+  namespace: orka-runtimes
+rules:
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - replicasets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - secrets
+  - services
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - networkpolicies
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - policy
+  resources:
+  - poddisruptionbudgets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -9676,6 +195,28 @@ rules:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/component: admission
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: orka
+  name: orka-admission
+rules:
+- apiGroups:
+  - authorization.k8s.io
+  resources:
+  - subjectaccessreviews
+  verbs:
+  - create
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/managed-by: kustomize
@@ -10307,7 +848,10 @@ rules:
   - ""
   resources:
   - configmaps
+  - namespaces
+  - pods
   - secrets
+  - services
   verbs:
   - create
   - delete
@@ -10320,14 +864,11 @@ rules:
   - ""
   resources:
   - endpoints
-  - namespaces
   - nodes
   - persistentvolumeclaims
   - persistentvolumes
-  - pods
   - pods/status
   - replicationcontrollers
-  - services
   verbs:
   - get
   - list
@@ -10388,12 +929,23 @@ rules:
   - apps
   resources:
   - daemonsets
+  - statefulsets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apps
+  resources:
   - deployments
   - replicasets
-  - statefulsets
   verbs:
+  - create
+  - delete
   - get
   - list
+  - patch
+  - update
   - watch
 - apiGroups:
   - ate.dev
@@ -10454,9 +1006,16 @@ rules:
   resources:
   - agentruntimes
   - agents
+  - branchclaims
+  - controllerepochs
+  - externaleffects
+  - promptattempts
   - providers
+  - publications
   - repositorymonitors
   - repositoryscans
+  - runtimepools
+  - runtimesessioncontrols
   - skills
   - substrateactorpools
   - tasks
@@ -10474,10 +1033,17 @@ rules:
   resources:
   - agentruntimes/finalizers
   - agents/finalizers
+  - branchclaims/finalizers
+  - controllerepochs/finalizers
+  - externaleffects/finalizers
   - outboundaccesspolicies/finalizers
+  - promptattempts/finalizers
   - providers/finalizers
+  - publications/finalizers
   - repositorymonitors/finalizers
   - repositoryscans/finalizers
+  - runtimepools/finalizers
+  - runtimesessioncontrols/finalizers
   - skills/finalizers
   - substrateactorpools/finalizers
   - tasks/finalizers
@@ -10489,10 +1055,17 @@ rules:
   resources:
   - agentruntimes/status
   - agents/status
+  - branchclaims/status
+  - controllerepochs/status
+  - externaleffects/status
   - outboundaccesspolicies/status
+  - promptattempts/status
   - providers/status
+  - publications/status
   - repositorymonitors/status
   - repositoryscans/status
+  - runtimepools/status
+  - runtimesessioncontrols/status
   - skills/status
   - substrateactorpools/status
   - tasks/status
@@ -10602,26 +1175,19 @@ rules:
   - delete
   - get
   - list
+  - patch
+  - update
   - watch
 - apiGroups:
   - policy
   resources:
   - poddisruptionbudgets
   verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterrolebindings
-  - rolebindings
-  - roles
-  verbs:
   - create
   - delete
   - get
   - list
+  - patch
   - update
   - watch
 - apiGroups:
@@ -10642,6 +1208,18 @@ rules:
   - clusterroles
   verbs:
   - bind
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - rolebindings
+  - roles
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - update
+  - watch
 - apiGroups:
   - storage.k8s.io
   resources:
@@ -10744,6 +1322,33 @@ rules:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: orka
+  name: orka-static-controller-cluster-role
+rules:
+- apiGroups:
+  - ""
+  resourceNames:
+  - orka-system
+  resources:
+  - namespaces
+  verbs:
+  - get
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resourceNames:
+  - orka-ai-worker-role
+  - orka-vendor-worker-role
+  - orka-container-worker-role
+  resources:
+  - clusterroles
+  verbs:
+  - bind
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/managed-by: kustomize
@@ -10887,22 +1492,126 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: orka-vendor-worker-role
+  labels:
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: orka
+  name: orka-v2-controller-cluster-role
 rules:
 - apiGroups:
   - ""
+  resourceNames:
+  - orka-runtimes
   resources:
-  - configmaps
+  - namespaces
   verbs:
   - get
-  - list
-  - watch
 - apiGroups:
-  - core.orka.ai
-  resources:
-  - tools
-  - outboundaccesspolicies
-  verbs:
+  - apiextensions.k8s.io
+  resourceNames:
+  - tasks.core.orka.ai
+  - gatewayclasses.gateway.orka.ai
+  - gateways.gateway.orka.ai
+  - gatewaybindings.gateway.orka.ai
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+- apiGroups:
+  - core.orka.ai
+  resources:
+  - branchclaims
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - core.orka.ai
+  resources:
+  - branchclaims/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - core.orka.ai
+  resources:
+  - branchclaims/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - gateway.orka.ai
+  resources:
+  - gatewayclasses
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - gateway.orka.ai
+  resources:
+  - gatewayclasses/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - gateway.orka.ai
+  resources:
+  - gatewayclasses/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - workspace.orka.ai
+  resources:
+  - executionworkspaceproviders
+  verbs:
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - workspace.orka.ai
+  resources:
+  - executionworkspaceproviders/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - workspace.orka.ai
+  resources:
+  - executionworkspaceproviders/finalizers
+  verbs:
+  - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: orka-vendor-worker-role
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - core.orka.ai
+  resources:
+  - tools
+  - outboundaccesspolicies
+  verbs:
   - get
   - list
 - apiGroups:
@@ -11327,21 +2036,22 @@ metadata:
   labels:
     app.kubernetes.io/managed-by: kustomize
     app.kubernetes.io/name: orka
-  name: orka-leader-election-rolebinding
-  namespace: orka-system
+  name: orka-runtime-controller-rolebinding
+  namespace: orka-runtimes
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: orka-leader-election-role
+  name: orka-runtime-controller-role
 subjects:
 - kind: ServiceAccount
   name: orka-controller-manager
   namespace: orka-system
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
+kind: RoleBinding
 metadata:
   name: orka-ai-worker-rolebinding
+  namespace: orka-system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -11352,9 +2062,10 @@ subjects:
   namespace: orka-system
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
+kind: RoleBinding
 metadata:
   name: orka-container-worker-rolebinding
+  namespace: orka-system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -11365,12 +2076,30 @@ subjects:
   namespace: orka-system
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
+kind: RoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: orka
+  name: orka-leader-election-rolebinding
+  namespace: orka-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: orka-leader-election-role
+subjects:
+- kind: ServiceAccount
+  name: orka-controller-manager
+  namespace: orka-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
 metadata:
   labels:
     app.kubernetes.io/managed-by: kustomize
     app.kubernetes.io/name: orka
   name: orka-manager-rolebinding
+  namespace: orka-system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -11381,6 +2110,54 @@ subjects:
   namespace: orka-system
 ---
 apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: orka-vendor-worker-rolebinding
+  namespace: orka-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: orka-vendor-worker-role
+subjects:
+- kind: ServiceAccount
+  name: orka-vendor-worker
+  namespace: orka-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: orka
+  name: orka-workspace-parameter-reader-rolebinding
+  namespace: orka-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: orka-workspace-parameter-reader
+subjects:
+- kind: ServiceAccount
+  name: orka-controller-manager
+  namespace: orka-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/component: admission
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: orka
+  name: orka-admission
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: orka-admission
+subjects:
+- kind: ServiceAccount
+  name: orka-admission
+  namespace: orka-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: orka-metrics-auth-rolebinding
@@ -11396,14 +2173,17 @@ subjects:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: orka-vendor-worker-rolebinding
+  labels:
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: orka
+  name: orka-static-controller-cluster-rolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: orka-vendor-worker-role
+  name: orka-static-controller-cluster-role
 subjects:
 - kind: ServiceAccount
-  name: orka-vendor-worker
+  name: orka-controller-manager
   namespace: orka-system
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -11412,32 +2192,46 @@ metadata:
   labels:
     app.kubernetes.io/managed-by: kustomize
     app.kubernetes.io/name: orka
-  name: orka-workspace-parameter-reader-rolebinding
+  name: orka-v2-controller-cluster-rolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: orka-workspace-parameter-reader
+  name: orka-v2-controller-cluster-role
 subjects:
 - kind: ServiceAccount
   name: orka-controller-manager
   namespace: orka-system
 ---
 apiVersion: v1
+data:
+  ORKA_ACP_CLAUDE_RUNTIME_IMAGE: docker.io/sozercan/orka-acp-claude@sha256:0000000000000000000000000000000000000000000000000000000000000000
+  ORKA_ACP_CODEX_RUNTIME_IMAGE: docker.io/sozercan/orka-acp-codex@sha256:0000000000000000000000000000000000000000000000000000000000000000
+  ORKA_ACP_COPILOT_RUNTIME_IMAGE: docker.io/sozercan/orka-acp-copilot@sha256:0000000000000000000000000000000000000000000000000000000000000000
+  ORKA_ACP_OPENCODE_RUNTIME_IMAGE: docker.io/sozercan/orka-acp-opencode@sha256:0000000000000000000000000000000000000000000000000000000000000000
+kind: ConfigMap
+metadata:
+  labels:
+    orka.ai/acp-runtime-images: "true"
+  name: acp-runtime-images-2cc58tc8m7
+  namespace: orka-system
+---
+apiVersion: v1
 kind: Service
 metadata:
   labels:
-    app.kubernetes.io/component: agent-harness-wrapper
+    app.kubernetes.io/component: admission
     app.kubernetes.io/managed-by: kustomize
     app.kubernetes.io/name: orka
-  name: orka-agent-harness-wrapper
+  name: orka-admission
   namespace: orka-system
 spec:
   ports:
-  - name: http
-    port: 8080
-    targetPort: http
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: webhook
   selector:
-    app.kubernetes.io/component: agent-harness-wrapper
+    app.kubernetes.io/component: admission
     app.kubernetes.io/name: orka
 ---
 apiVersion: v1
@@ -11479,6 +2273,57 @@ spec:
     control-plane: controller-manager
 ---
 apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: provider-auth-proxy
+    app.kubernetes.io/name: orka
+  name: orka-provider-auth-proxy
+  namespace: orka-system
+spec:
+  ports:
+  - name: http
+    port: 8080
+    targetPort: http
+  selector:
+    app.kubernetes.io/component: provider-auth-proxy
+    app.kubernetes.io/name: orka
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: scm-egress-proxy
+    app.kubernetes.io/name: orka
+  name: orka-scm-egress-proxy
+  namespace: orka-system
+spec:
+  ports:
+  - name: http-proxy
+    port: 8080
+    targetPort: http-proxy
+  selector:
+    app.kubernetes.io/component: scm-egress-proxy
+    app.kubernetes.io/name: orka
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: workspace-publisher
+    app.kubernetes.io/name: orka
+  name: orka-workspace-publisher
+  namespace: orka-system
+spec:
+  ports:
+  - name: http
+    port: 8080
+    targetPort: http
+  selector:
+    app.kubernetes.io/component: workspace-publisher
+    app.kubernetes.io/name: orka
+---
+apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: orka-controller-manager-store
@@ -11490,113 +2335,139 @@ spec:
     requests:
       storage: 1Gi
 ---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  labels:
+    app.kubernetes.io/component: workspace-publisher
+    app.kubernetes.io/name: orka
+  name: orka-workspace-publisher
+  namespace: orka-system
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   labels:
-    app.kubernetes.io/component: agent-harness-wrapper
+    app.kubernetes.io/component: admission
     app.kubernetes.io/managed-by: kustomize
     app.kubernetes.io/name: orka
-  name: orka-agent-harness-wrapper
+  name: orka-admission
   namespace: orka-system
 spec:
-  replicas: 1
+  replicas: 2
   selector:
     matchLabels:
-      app.kubernetes.io/component: agent-harness-wrapper
+      app.kubernetes.io/component: admission
       app.kubernetes.io/name: orka
   strategy:
-    type: Recreate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+    type: RollingUpdate
   template:
     metadata:
       labels:
-        app.kubernetes.io/component: agent-harness-wrapper
+        app.kubernetes.io/component: admission
         app.kubernetes.io/name: orka
+        orka.ai/network-role: admission
     spec:
-      automountServiceAccountToken: false
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchLabels:
+                  app.kubernetes.io/component: admission
+                  app.kubernetes.io/name: orka
+              topologyKey: kubernetes.io/hostname
+            weight: 100
+      automountServiceAccountToken: true
       containers:
-      - env:
-        - name: ORKA_HARNESS_WRAPPER_RUNTIME
-          value: multi
-        - name: ORKA_HARNESS_WRAPPER_LISTEN_ADDR
-          value: :8080
-        - name: ORKA_HARNESS_WRAPPER_BEARER_TOKEN_FILE
-          value: /var/run/orka/harness-wrapper/token
-        - name: ORKA_ALLOW_BASH
-          value: "true"
-        - name: ORKA_HARNESS_WRAPPER_CHILD_UID
-          value: "1000"
-        - name: ORKA_HARNESS_WRAPPER_CHILD_GID
-          value: "1000"
-        - name: ORKA_CODEX_SANDBOX_MODE
-          value: danger-full-access
-        - name: ORKA_SA_TOKEN_PATH
-          value: /var/run/orka/upload-token/token
-        image: ghcr.io/orka-agents/orka/agent-harness-wrapper:0.1.1
+      - args:
+        - --health-probe-bind-address=:8081
+        - --webhook-cert-path=/var/run/orka/admission/tls
+        - --webhook-cert-name=tls.crt
+        - --webhook-cert-key=tls.key
+        - --webhook-service-dns-name=orka-admission.orka-system.svc
+        - --controller-usernames=system:serviceaccount:orka-system:orka-controller-manager,system:serviceaccount:orka-v1-system:orka-v1,system:serviceaccount:orka-v2-system:orka-v2
+        - --task-provenance-trusted-users=system:serviceaccount:orka-system:orka-controller-manager,system:serviceaccount:orka-v1-system:orka-v1,system:serviceaccount:orka-v2-system:orka-v2
+        - --task-provenance-trusted-service-accounts=orka-ai-worker,orka-vendor-worker,orka-v1-ai-worker,orka-v1-vendor-worker,orka-v2-ai-worker,orka-v2-vendor-worker
+        command:
+        - /orka-admission
+        image: docker.io/sozercan/orka@sha256:0000000000000000000000000000000000000000000000000000000000000000
         imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - /orka-admission
+              - --pre-stop-delay=5s
         livenessProbe:
+          failureThreshold: 3
           httpGet:
-            path: /v1/health
-            port: http
-          initialDelaySeconds: 10
-          periodSeconds: 20
-        name: wrapper
+            path: /healthz
+            port: health
+          periodSeconds: 10
+        name: admission
         ports:
-        - containerPort: 8080
-          name: http
+        - containerPort: 9443
+          name: webhook
+          protocol: TCP
+        - containerPort: 8081
+          name: health
+          protocol: TCP
         readinessProbe:
+          failureThreshold: 3
           httpGet:
-            path: /v1/health
-            port: http
-          initialDelaySeconds: 5
-          periodSeconds: 10
+            path: /readyz
+            port: health
+          periodSeconds: 5
         resources:
           limits:
-            cpu: "2"
-            memory: 2Gi
-          requests:
-            cpu: 100m
+            cpu: 500m
+            ephemeral-storage: 128Mi
             memory: 256Mi
+          requests:
+            cpu: 50m
+            ephemeral-storage: 32Mi
+            memory: 64Mi
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
-            add:
-            - SETUID
-            - SETGID
-            - CHOWN
-            - KILL
-            - FOWNER
             drop:
             - ALL
           readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          runAsUser: 65532
         volumeMounts:
-        - mountPath: /var/run/orka/harness-wrapper
-          name: auth
-          readOnly: true
-        - mountPath: /var/run/orka/upload-token
-          name: upload-token
+        - mountPath: /var/run/orka/admission/tls
+          name: tls
           readOnly: true
-        - mountPath: /tmp
-          name: tmp
       securityContext:
-        runAsGroup: 0
-        runAsUser: 0
+        fsGroup: 65532
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65532
         seccompProfile:
           type: RuntimeDefault
-      serviceAccountName: orka-agent-harness-wrapper
+      serviceAccountName: orka-admission
+      terminationGracePeriodSeconds: 30
       volumes:
-      - name: upload-token
-        projected:
-          defaultMode: 256
-          sources:
-          - serviceAccountToken:
-              path: token
-      - name: auth
+      - name: tls
         secret:
-          defaultMode: 256
-          secretName: harness-wrapper-auth
-      - emptyDir: {}
-        name: tmp
+          items:
+          - key: tls.crt
+            path: tls.crt
+          - key: tls.key
+            path: tls.key
+          optional: false
+          secretName: orka-admission-tls
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -11622,6 +2493,7 @@ spec:
       labels:
         app.kubernetes.io/name: orka
         control-plane: controller-manager
+        orka.ai/network-role: controller
     spec:
       containers:
       - args:
@@ -11630,7 +2502,23 @@ spec:
         - --health-probe-bind-address=:8081
         - --store-backend=sqlite
         - --store-path=/data/orka.db
+        - --agent-execution-snapshot-key-file=/var/run/orka/agent-execution-snapshot/key
+        - --agent-execution-snapshot-retention=720h
+        - --agent-execution-snapshot-retention-interval=1h
         - --controller-url=http://orka-api.orka-system.svc:8080
+        - --controller-mode=harness-v2
+        - --watch-namespace=orka-system
+        - --enforce-namespace-isolation=true
+        - --execution-mode-controller-usernames=system:serviceaccount:orka-system:orka-controller-manager
+        - --acp-upgrade-drain-bind-address=127.0.0.1:8083
+        - --acp-upgrade-drain-timeout=5m
+        - --acp-upgrade-drain-poll-interval=1s
+        - --acp-upgrade-drain-trigger-timeout=5m15s
+        - --acp-upgrade-drain-marker-namespace=orka-system
+        - --acp-provider-proxy-base-url=http://orka-provider-auth-proxy.orka-system.svc:8080
+        - --acp-provider-proxy-namespace=orka-system
+        - --acp-provider-proxy-pod-labels=orka.ai/network-role=provider-auth-proxy
+        - --acp-provider-proxy-token-file=/var/run/orka/provider-auth/token
         - --ai-worker-image=ghcr.io/orka-agents/orka/ai-worker:0.1.1
         - --general-worker-image=ghcr.io/orka-agents/orka/general-worker:0.1.1
         - --gateway-enabled=true
@@ -11658,14 +2546,45 @@ spec:
         command:
         - /manager
         env:
-        - name: ORKA_HARNESS_WRAPPER_ENDPOINT
-          value: http://orka-agent-harness-wrapper:8080
-        - name: ORKA_HARNESS_WRAPPER_BEARER_TOKEN_FILE
-          value: /var/run/orka/harness-wrapper/token
-        - name: ORKA_HARNESS_WRAPPER_SERVICE_ACCOUNT_NAME
-          value: orka-agent-harness-wrapper
-        image: ghcr.io/orka-agents/orka:0.1.1
+        - name: ORKA_ACP_ARTIFACT_CAPABILITY_SECRET_FILE
+          value: /var/run/orka/acp-artifacts/capability-secret
+        - name: ORKA_ACP_ARTIFACT_ROOT
+          value: /data/acp-artifacts
+        - name: ORKA_ACP_CODEX_RUNTIME_IMAGE
+          valueFrom:
+            configMapKeyRef:
+              key: ORKA_ACP_CODEX_RUNTIME_IMAGE
+              name: acp-runtime-images-2cc58tc8m7
+        - name: ORKA_ACP_CLAUDE_RUNTIME_IMAGE
+          valueFrom:
+            configMapKeyRef:
+              key: ORKA_ACP_CLAUDE_RUNTIME_IMAGE
+              name: acp-runtime-images-2cc58tc8m7
+        - name: ORKA_ACP_COPILOT_RUNTIME_IMAGE
+          valueFrom:
+            configMapKeyRef:
+              key: ORKA_ACP_COPILOT_RUNTIME_IMAGE
+              name: acp-runtime-images-2cc58tc8m7
+        - name: ORKA_ACP_OPENCODE_RUNTIME_IMAGE
+          valueFrom:
+            configMapKeyRef:
+              key: ORKA_ACP_OPENCODE_RUNTIME_IMAGE
+              name: acp-runtime-images-2cc58tc8m7
+        - name: ORKA_WORKSPACE_PUBLISHER_URL
+          value: http://orka-workspace-publisher.orka-system.svc:8080
+        - name: ORKA_WORKSPACE_PUBLISHER_CONTROLLER_TOKEN_FILE
+          value: /var/run/orka/publisher-auth/controller-token
+        - name: ORKA_WORKSPACE_PUBLISHER_CAPABILITY_SECRET_FILE
+          value: /var/run/orka/publisher-auth/operation-capability-secret
+        image: docker.io/sozercan/orka@sha256:0000000000000000000000000000000000000000000000000000000000000000
         imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - /manager
+              - --acp-upgrade-drain-trigger-url=http://127.0.0.1:8083/acp/upgrade-drain
+              - --acp-upgrade-drain-trigger-timeout=5m15s
         livenessProbe:
           httpGet:
             path: /healthz
@@ -11698,8 +2617,17 @@ spec:
           name: store
         - mountPath: /tmp
           name: tmp
-        - mountPath: /var/run/orka/harness-wrapper
-          name: harness-wrapper-auth
+        - mountPath: /var/run/orka/acp-artifacts
+          name: acp-artifact-capability
+          readOnly: true
+        - mountPath: /var/run/orka/publisher-auth
+          name: workspace-publisher-auth
+          readOnly: true
+        - mountPath: /var/run/orka/provider-auth
+          name: provider-auth-proxy
+          readOnly: true
+        - mountPath: /var/run/orka/agent-execution-snapshot
+          name: agent-execution-snapshot-key
           readOnly: true
       securityContext:
         fsGroup: 65532
@@ -11707,22 +2635,382 @@ spec:
         seccompProfile:
           type: RuntimeDefault
       serviceAccountName: orka-controller-manager
-      terminationGracePeriodSeconds: 10
+      terminationGracePeriodSeconds: 360
       volumes:
       - name: store
         persistentVolumeClaim:
           claimName: orka-controller-manager-store
       - emptyDir: {}
         name: tmp
-      - name: harness-wrapper-auth
+      - name: acp-artifact-capability
+        secret:
+          defaultMode: 256
+          items:
+          - key: capability-secret
+            path: capability-secret
+          secretName: acp-artifact-capability
+      - name: workspace-publisher-auth
+        secret:
+          defaultMode: 256
+          secretName: workspace-publisher-auth
+      - name: provider-auth-proxy
+        secret:
+          defaultMode: 256
+          items:
+          - key: token
+            path: token
+          secretName: provider-auth-proxy
+      - name: agent-execution-snapshot-key
+        secret:
+          defaultMode: 256
+          items:
+          - key: snapshot-key
+            path: key
+          secretName: agent-execution-snapshot-key
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/component: provider-auth-proxy
+    app.kubernetes.io/name: orka
+  name: orka-provider-auth-proxy
+  namespace: orka-system
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: provider-auth-proxy
+      app.kubernetes.io/name: orka
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      annotations:
+        orka.ai/provider-auth-rollout-nonce: "0"
+      labels:
+        app.kubernetes.io/component: provider-auth-proxy
+        app.kubernetes.io/name: orka
+        orka.ai/network-role: provider-auth-proxy
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --listen-address=:8080
+        - --upstream-base-url=http://vekil.vekil-system.svc:1337
+        - --token-file=/var/run/secrets/orka/provider-auth/token
+        - --previous-token-file=/var/run/secrets/orka/provider-auth/previous-token
+        - --previous-token-valid-until-file=/var/run/secrets/orka/provider-auth/previous-token-valid-until
+        - --token-reload-interval=5s
+        - --previous-token-overlap=10m
+        command:
+        - /provider-auth-proxy
+        image: docker.io/sozercan/orka@sha256:0000000000000000000000000000000000000000000000000000000000000000
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+        name: proxy
+        ports:
+        - containerPort: 8080
+          name: http
+        readinessProbe:
+          httpGet:
+            path: /readyz
+            port: http
+        resources:
+          limits:
+            cpu: 250m
+            ephemeral-storage: 128Mi
+            memory: 128Mi
+          requests:
+            cpu: 25m
+            ephemeral-storage: 32Mi
+            memory: 32Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+        - mountPath: /var/run/secrets/orka/provider-auth
+          name: provider-auth
+          readOnly: true
+      securityContext:
+        fsGroup: 65532
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: orka-provider-auth-proxy
+      volumes:
+      - name: provider-auth
+        projected:
+          defaultMode: 288
+          sources:
+          - secret:
+              items:
+              - key: token
+                path: token
+              - key: previous-token
+                path: previous-token
+              - key: previous-token-valid-until
+                path: previous-token-valid-until
+              name: provider-auth-proxy
+              optional: true
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/component: scm-egress-proxy
+    app.kubernetes.io/name: orka
+  name: orka-scm-egress-proxy
+  namespace: orka-system
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: scm-egress-proxy
+      app.kubernetes.io/name: orka
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: scm-egress-proxy
+        app.kubernetes.io/name: orka
+        orka.ai/network-role: scm-egress-proxy
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --listen-address=:8080
+        - --allowed-hosts=github.com
+        - --forge-api-base-url=https://api.github.com
+        - --token-file=/var/run/secrets/orka/scm-egress/token
+        - --max-request-header-bytes=32768
+        - --max-response-header-bytes=65536
+        - --max-request-bytes=4194304
+        - --max-response-bytes=8388608
+        - --max-tunnel-bytes=1073741824
+        - --max-concurrent=8
+        - --resolution-timeout=5s
+        - --connect-timeout=10s
+        - --response-header-timeout=30s
+        - --forward-timeout=2m
+        - --idle-timeout=30s
+        - --tunnel-timeout=10m
+        command:
+        - /scm-egress-proxy
+        image: docker.io/sozercan/orka@sha256:0000000000000000000000000000000000000000000000000000000000000000
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: http-proxy
+        name: proxy
+        ports:
+        - containerPort: 8080
+          name: http-proxy
+        readinessProbe:
+          httpGet:
+            path: /readyz
+            port: http-proxy
+        resources:
+          limits:
+            cpu: 500m
+            ephemeral-storage: 128Mi
+            memory: 256Mi
+          requests:
+            cpu: 25m
+            ephemeral-storage: 32Mi
+            memory: 32Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+        - mountPath: /var/run/secrets/orka/scm-egress/token
+          name: auth
+          readOnly: true
+          subPath: token
+      enableServiceLinks: false
+      securityContext:
+        fsGroup: 65532
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: orka-scm-egress-proxy
+      volumes:
+      - name: auth
+        secret:
+          defaultMode: 288
+          items:
+          - key: token
+            path: token
+          secretName: scm-egress-proxy-auth
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/component: workspace-publisher
+    app.kubernetes.io/name: orka
+  name: orka-workspace-publisher
+  namespace: orka-system
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: workspace-publisher
+      app.kubernetes.io/name: orka
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: workspace-publisher
+        app.kubernetes.io/name: orka
+        orka.ai/network-role: workspace-publisher
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - env:
+        - name: ORKA_SCM_EGRESS_PROXY_TOKEN
+          valueFrom:
+            secretKeyRef:
+              key: token
+              name: scm-egress-proxy-auth
+        - name: HTTPS_PROXY
+          value: http://orka-publisher:$(ORKA_SCM_EGRESS_PROXY_TOKEN)@orka-scm-egress-proxy.orka-system.svc:8080
+        - name: https_proxy
+          value: http://orka-publisher:$(ORKA_SCM_EGRESS_PROXY_TOKEN)@orka-scm-egress-proxy.orka-system.svc:8080
+        - name: NO_PROXY
+          value: localhost,127.0.0.1,::1,.svc,.cluster.local
+        - name: no_proxy
+          value: localhost,127.0.0.1,::1,.svc,.cluster.local
+        - name: ORKA_PUBLISHER_SCM_EGRESS_PROXY_REQUIRED
+          value: "true"
+        - name: ORKA_PUBLISHER_LISTEN_ADDRESS
+          value: :8080
+        - name: ORKA_PUBLISHER_TEMP_ROOT
+          value: /tmp/orka-workspace-publisher/runtime
+        - name: ORKA_PUBLISHER_CONTROLLER_TOKEN_FILE
+          value: /var/run/orka/publisher-auth/controller-token
+        - name: ORKA_PUBLISHER_OPERATION_CAPABILITY_SECRET_FILE
+          value: /var/run/orka/publisher-auth/operation-capability-secret
+        - name: ORKA_PUBLISHER_ARTIFACT_AUTHORIZATION_BROKER_URL
+          value: http://orka-api.orka-system.svc:8080
+        - name: ORKA_PUBLISHER_ARTIFACT_API_URL
+          value: http://orka-api.orka-system.svc:8080
+        - name: ORKA_PUBLISHER_CREDENTIAL_BROKER_URL
+          value: http://orka-api.orka-system.svc:8080
+        - name: ORKA_PUBLISHER_ALLOWED_SCM_HOSTS
+          value: github.com
+        - name: ORKA_PUBLISHER_GITHUB_PR_ENABLED
+          value: "true"
+        - name: ORKA_PUBLISHER_GITHUB_API_BASE_URL
+          value: https://api.github.com
+        - name: ORKA_PUBLISHER_GITHUB_REQUEST_TIMEOUT
+          value: 15s
+        - name: ORKA_PUBLISHER_GITHUB_MAX_RESPONSE_BYTES
+          value: "4194304"
+        image: docker.io/sozercan/orka-workspace-publisher@sha256:0000000000000000000000000000000000000000000000000000000000000000
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          httpGet:
+            path: /v1/health
+            port: http
+          periodSeconds: 10
+        name: publisher
+        ports:
+        - containerPort: 8080
+          name: http
+        readinessProbe:
+          httpGet:
+            path: /v1/health
+            port: http
+          periodSeconds: 5
+        resources:
+          limits:
+            cpu: "2"
+            ephemeral-storage: 2Gi
+            memory: 2Gi
+          requests:
+            cpu: 100m
+            ephemeral-storage: 512Mi
+            memory: 256Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+        - mountPath: /data
+          name: data
+        - mountPath: /tmp/orka-workspace-publisher
+          name: tmp
+        - mountPath: /var/run/orka/publisher-auth/controller-token
+          name: publisher-auth
+          readOnly: true
+          subPath: controller-token
+        - mountPath: /var/run/orka/publisher-auth/operation-capability-secret
+          name: publisher-auth
+          readOnly: true
+          subPath: operation-capability-secret
+      securityContext:
+        fsGroup: 65532
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: orka-workspace-publisher
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: orka-workspace-publisher
+      - emptyDir:
+          sizeLimit: 1Gi
+        name: tmp
+      - name: publisher-auth
         secret:
-          secretName: harness-wrapper-auth
+          defaultMode: 288
+          items:
+          - key: controller-token
+            path: controller-token
+          - key: operation-capability-secret
+            path: operation-capability-secret
+          secretName: workspace-publisher-auth
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  labels:
+    app.kubernetes.io/component: admission
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: orka
+  name: orka-admission
+  namespace: orka-system
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: admission
+      app.kubernetes.io/name: orka
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingAdmissionPolicy
 metadata:
   name: orka-executionworkspace-core-admission.orka.ai
-  namespace: orka-system
 spec:
   failurePolicy: Fail
   matchConstraints:
@@ -11762,10 +3050,15 @@ spec:
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingAdmissionPolicy
 metadata:
-  name: orka-task-workspace-class-use.orka.ai
-  namespace: orka-system
+  name: orka-gateway-task-protection
 spec:
   failurePolicy: Fail
+  matchConditions:
+  - expression: (request.operation == 'CREATE' && has(object.spec.requestedBy) &&
+      object.spec.requestedBy.issuer.startsWith('gateway.orka.ai/')) || ((request.operation
+      == 'UPDATE' || request.operation == 'DELETE') && has(oldObject.spec.requestedBy)
+      && oldObject.spec.requestedBy.issuer.startsWith('gateway.orka.ai/'))
+    name: owned-gateway-task
   matchConstraints:
     resourceRules:
     - apiGroups:
@@ -11775,24 +3068,42 @@ spec:
       operations:
       - CREATE
       - UPDATE
+      - DELETE
       resources:
       - tasks
+      - tasks/status
   validations:
   - expression: |-
-      !has(object.spec.execution) || !has(object.spec.execution.workspace) || !has(object.spec.execution.workspace.classRef) || authorizer.group('workspace.orka.ai')
+      (request.operation == 'DELETE' &&
 
-        .resource('executionworkspaceclasses')
-        .namespace(request.namespace)
-        .name(object.spec.execution.workspace.classRef.name)
-        .check('use').allowed()
-    message: caller is not authorized to use the selected ExecutionWorkspaceClass
-    reason: Forbidden
+        (request.userInfo.username == 'system:serviceaccount:kube-system:generic-garbage-collector' ||
+         request.userInfo.username == 'system:serviceaccount:kube-system:garbage-collector' ||
+         request.userInfo.username == 'system:serviceaccount:kube-system:namespace-controller' ||
+         request.userInfo.username == 'system:kube-controller-manager')) ||
+      request.userInfo.username == 'system:serviceaccount:' + variables.controllerNamespace + ':' + variables.controllerServiceAccount || request.userInfo.username == 'system:serviceaccount:' + variables.gatewayNamespace + ':' + variables.aiWorkerServiceAccount || request.userInfo.username == 'system:serviceaccount:' + variables.gatewayNamespace + ':' + variables.vendorWorkerServiceAccount || request.userInfo.username == 'system:serviceaccount:' + variables.gatewayNamespace + ':' + variables.containerWorkerServiceAccount
+    message: gateway-owned Tasks may only be managed by the owning Orka controller,
+      trusted workers, or Kubernetes cleanup controllers
+  variables:
+  - expression: 'request.operation == ''CREATE'' ? object.spec.requestedBy.issuer
+      : oldObject.spec.requestedBy.issuer'
+    name: gatewayIssuer
+  - expression: variables.gatewayIssuer.split('/')[1]
+    name: gatewayNamespace
+  - expression: '''orka-system'''
+    name: controllerNamespace
+  - expression: '''orka-controller-manager'''
+    name: controllerServiceAccount
+  - expression: '''orka-ai-worker'''
+    name: aiWorkerServiceAccount
+  - expression: '''orka-vendor-worker'''
+    name: vendorWorkerServiceAccount
+  - expression: '''orka-container-worker'''
+    name: containerWorkerServiceAccount
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingAdmissionPolicy
 metadata:
-  name: orka-tool-workspace-class-use.orka.ai
-  namespace: orka-system
+  name: orka-task-workspace-class-use.orka.ai
 spec:
   failurePolicy: Fail
   matchConstraints:
@@ -11805,14 +3116,14 @@ spec:
       - CREATE
       - UPDATE
       resources:
-      - tools
+      - tasks
   validations:
   - expression: |-
-      !has(object.spec.mcp) || !has(object.spec.mcp.workspace) || authorizer.group('workspace.orka.ai')
+      !has(object.spec.execution) || !has(object.spec.execution.workspace) || !has(object.spec.execution.workspace.classRef) || authorizer.group('workspace.orka.ai')
 
         .resource('executionworkspaceclasses')
         .namespace(request.namespace)
-        .name(object.spec.mcp.workspace.classRef.name)
+        .name(object.spec.execution.workspace.classRef.name)
         .check('use').allowed()
     message: caller is not authorized to use the selected ExecutionWorkspaceClass
     reason: Forbidden
@@ -11820,15 +3131,9 @@ spec:
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingAdmissionPolicy
 metadata:
-  name: orka-gateway-task-protection
+  name: orka-tool-workspace-class-use.orka.ai
 spec:
   failurePolicy: Fail
-  matchConditions:
-  - expression: (request.operation == 'CREATE' && has(object.spec.requestedBy) &&
-      object.spec.requestedBy.issuer.startsWith('gateway.orka.ai/')) || ((request.operation
-      == 'UPDATE' || request.operation == 'DELETE') && has(oldObject.spec.requestedBy)
-      && oldObject.spec.requestedBy.issuer.startsWith('gateway.orka.ai/'))
-    name: owned-gateway-task
   matchConstraints:
     resourceRules:
     - apiGroups:
@@ -11838,43 +3143,23 @@ spec:
       operations:
       - CREATE
       - UPDATE
-      - DELETE
       resources:
-      - tasks
-      - tasks/status
+      - tools
   validations:
   - expression: |-
-      (request.operation == 'DELETE' &&
+      !has(object.spec.mcp) || !has(object.spec.mcp.workspace) || authorizer.group('workspace.orka.ai')
 
-        (request.userInfo.username == 'system:serviceaccount:kube-system:generic-garbage-collector' ||
-         request.userInfo.username == 'system:serviceaccount:kube-system:garbage-collector' ||
-         request.userInfo.username == 'system:serviceaccount:kube-system:namespace-controller' ||
-         request.userInfo.username == 'system:kube-controller-manager')) ||
-      request.userInfo.username == 'system:serviceaccount:' + variables.controllerNamespace + ':' + variables.controllerServiceAccount || request.userInfo.username == 'system:serviceaccount:' + variables.gatewayNamespace + ':' + variables.aiWorkerServiceAccount || request.userInfo.username == 'system:serviceaccount:' + variables.gatewayNamespace + ':' + variables.vendorWorkerServiceAccount || request.userInfo.username == 'system:serviceaccount:' + variables.gatewayNamespace + ':' + variables.containerWorkerServiceAccount
-    message: gateway-owned Tasks may only be managed by the owning Orka controller,
-      trusted workers, or Kubernetes cleanup controllers
-  variables:
-  - expression: 'request.operation == ''CREATE'' ? object.spec.requestedBy.issuer
-      : oldObject.spec.requestedBy.issuer'
-    name: gatewayIssuer
-  - expression: variables.gatewayIssuer.split('/')[1]
-    name: gatewayNamespace
-  - expression: '''orka-system'''
-    name: controllerNamespace
-  - expression: '''orka-controller-manager'''
-    name: controllerServiceAccount
-  - expression: '''orka-ai-worker'''
-    name: aiWorkerServiceAccount
-  - expression: '''orka-vendor-worker'''
-    name: vendorWorkerServiceAccount
-  - expression: '''orka-container-worker'''
-    name: containerWorkerServiceAccount
+        .resource('executionworkspaceclasses')
+        .namespace(request.namespace)
+        .name(object.spec.mcp.workspace.classRef.name)
+        .check('use').allowed()
+    message: caller is not authorized to use the selected ExecutionWorkspaceClass
+    reason: Forbidden
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingAdmissionPolicyBinding
 metadata:
   name: orka-executionworkspace-core-admission.orka.ai
-  namespace: orka-system
 spec:
   policyName: orka-executionworkspace-core-admission.orka.ai
   validationActions:
@@ -11883,28 +3168,262 @@ spec:
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingAdmissionPolicyBinding
 metadata:
-  name: orka-task-workspace-class-use.orka.ai
-  namespace: orka-system
+  name: orka-gateway-task-protection
 spec:
-  policyName: orka-task-workspace-class-use.orka.ai
+  policyName: orka-gateway-task-protection
   validationActions:
   - Deny
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingAdmissionPolicyBinding
 metadata:
-  name: orka-tool-workspace-class-use.orka.ai
-  namespace: orka-system
+  name: orka-task-workspace-class-use.orka.ai
 spec:
-  policyName: orka-tool-workspace-class-use.orka.ai
+  policyName: orka-task-workspace-class-use.orka.ai
   validationActions:
   - Deny
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingAdmissionPolicyBinding
 metadata:
-  name: orka-gateway-task-protection
+  name: orka-tool-workspace-class-use.orka.ai
 spec:
-  policyName: orka-gateway-task-protection
+  policyName: orka-tool-workspace-class-use.orka.ai
   validationActions:
   - Deny
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: admission
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: orka
+  name: orka-admission
+  namespace: orka-system
+spec:
+  egress:
+  - ports:
+    - port: 443
+      protocol: TCP
+    - port: 6443
+      protocol: TCP
+  ingress:
+  - ports:
+    - port: 9443
+      protocol: TCP
+    - port: 8081
+      protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/component: admission
+      app.kubernetes.io/name: orka
+  policyTypes:
+  - Ingress
+  - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: provider-auth-proxy
+    app.kubernetes.io/name: orka
+  name: orka-provider-auth-proxy
+  namespace: orka-system
+spec:
+  egress:
+  - ports:
+    - port: 53
+      protocol: UDP
+    - port: 53
+      protocol: TCP
+    to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+      podSelector:
+        matchLabels:
+          k8s-app: kube-dns
+  - ports:
+    - port: 1337
+      protocol: TCP
+    to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: vekil-system
+      podSelector:
+        matchLabels:
+          app.kubernetes.io/name: vekil
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: orka-runtimes
+      podSelector:
+        matchLabels:
+          orka.ai/network-role: provider-client
+    ports:
+    - port: 8080
+      protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/component: provider-auth-proxy
+      app.kubernetes.io/name: orka
+  policyTypes:
+  - Ingress
+  - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: scm-egress-proxy
+    app.kubernetes.io/name: orka
+  name: orka-scm-egress-proxy
+  namespace: orka-system
+spec:
+  egress:
+  - ports:
+    - port: 53
+      protocol: UDP
+    - port: 53
+      protocol: TCP
+    to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+      podSelector:
+        matchLabels:
+          k8s-app: kube-dns
+  - ports:
+    - port: 443
+      protocol: TCP
+    to:
+    - ipBlock:
+        cidr: 0.0.0.0/0
+        except:
+        - 0.0.0.0/8
+        - 10.0.0.0/8
+        - 100.64.0.0/10
+        - 127.0.0.0/8
+        - 169.254.0.0/16
+        - 172.16.0.0/12
+        - 192.0.0.0/24
+        - 192.0.2.0/24
+        - 192.168.0.0/16
+        - 198.18.0.0/15
+        - 198.51.100.0/24
+        - 203.0.113.0/24
+        - 224.0.0.0/4
+        - 240.0.0.0/4
+  - ports:
+    - port: 443
+      protocol: TCP
+    to:
+    - ipBlock:
+        cidr: ::/0
+        except:
+        - ::/128
+        - ::1/128
+        - 64:ff9b::/96
+        - 64:ff9b:1::/48
+        - 100::/64
+        - 2001::/32
+        - 2001:db8::/32
+        - 2002::/16
+        - fc00::/7
+        - fe80::/10
+        - ff00::/8
+  ingress:
+  - from:
+    - podSelector:
+        matchLabels:
+          app.kubernetes.io/component: workspace-publisher
+          app.kubernetes.io/name: orka
+    ports:
+    - port: 8080
+      protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/component: scm-egress-proxy
+      app.kubernetes.io/name: orka
+  policyTypes:
+  - Ingress
+  - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: orka-workspace-publisher
+  namespace: orka-system
+spec:
+  egress:
+  - ports:
+    - port: 53
+      protocol: UDP
+    - port: 53
+      protocol: TCP
+    to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+      podSelector:
+        matchLabels:
+          k8s-app: kube-dns
+  - ports:
+    - port: 8080
+      protocol: TCP
+    to:
+    - podSelector:
+        matchLabels:
+          app.kubernetes.io/name: orka
+          control-plane: controller-manager
+  - ports:
+    - port: 8080
+      protocol: TCP
+    to:
+    - podSelector:
+        matchLabels:
+          app.kubernetes.io/component: scm-egress-proxy
+          app.kubernetes.io/name: orka
+  ingress:
+  - from:
+    - podSelector:
+        matchLabels:
+          app.kubernetes.io/name: orka
+          control-plane: controller-manager
+    ports:
+    - port: 8080
+      protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/component: workspace-publisher
+      app.kubernetes.io/name: orka
+  policyTypes:
+  - Ingress
+  - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: orka
+  name: orka-provider-auth-proxy-only
+  namespace: vekil-system
+spec:
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: orka-system
+      podSelector:
+        matchLabels:
+          orka.ai/network-role: provider-auth-proxy
+    ports:
+    - port: 1337
+      protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: vekil
+  policyTypes:
+  - Ingress
diff --git a/scripts/agent-substrate-e2e.sh b/scripts/agent-substrate-e2e.sh
index 80d0fb980..b0aa99bf4 100755
--- a/scripts/agent-substrate-e2e.sh
+++ b/scripts/agent-substrate-e2e.sh
@@ -3,13 +3,23 @@ set -Eeuo pipefail
 
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 KIND_CLUSTER="${KIND_CLUSTER:-orka-agent-substrate-e2e}"
+ORKA_NAMESPACE="${ORKA_NAMESPACE:-orka-system}"
 KIND_REGISTRY_NAME="${KIND_REGISTRY_NAME:-kind-registry}"
 KIND_REGISTRY_PORT="${KIND_REGISTRY_PORT:-5001}"
 SUBSTRATE_REPO="${SUBSTRATE_REPO:-https://github.com/agent-substrate/substrate.git}"
 SUBSTRATE_REF="${SUBSTRATE_REF:-b80031d260959b1fc5c6f61e3099fe2a6d368af1}"
-# Git blob ID for cmd/servers/atelet/oci.go at the reviewed default pin.
+# Git blob IDs for the reviewed source files at the default pin. Every local
+# evaluation patch verifies these immutable upstream objects before applying.
 SUBSTRATE_ATELET_OCI_BLOB="a2ae14c0a264d8ff2fdc9527f5894901d913c0a4"
+SUBSTRATE_ATENET_EXTPROC_IN_BLOB="317511845fef40b7602861383f7664e915215a69"
+SUBSTRATE_ATENET_EXTPROC_IN_TEST_BLOB="09bb9a4c4e7d4f5c8185c41535ebcc40fc8ff57b"
+SUBSTRATE_ATENET_ENVOY_RUNNER_BLOB="8d38be29f09a7ce23886b71a051586354c8413e5"
+SUBSTRATE_ATENET_MANIFEST_BLOB="e309cad0a2e8435d1ed8dfd51ce347ab4f5a7521"
+SUBSTRATE_ATEOM_GVISOR_BLOB="7d79dd0a26709599223ed848d1b8f1ea19641cf6"
+SUBSTRATE_ATEOM_RUNSC_BLOB="6db499a549f2b6987a867b144e8d6b3828cad9ff"
 SUBSTRATE_ATELET_CAPABILITY_PATCH="${ROOT_DIR}/hack/agent-substrate/atelet-root-supervisor-capabilities.patch"
+SUBSTRATE_ATENET_REDACTION_PATCH="${ROOT_DIR}/hack/agent-substrate/atenet-router-authorization-redaction.patch"
+SUBSTRATE_ATEOM_DELETE_RECOVERY_PATCH="${ROOT_DIR}/hack/agent-substrate/ateom-runsc-delete-recovery.patch"
 IMAGE_TAG="${IMAGE_TAG:-agent-substrate-ci}"
 KEEP_CLUSTER="${KEEP_CLUSTER:-0}"
 TASK_TIMEOUT_SECONDS="${TASK_TIMEOUT_SECONDS:-900}"
@@ -18,28 +28,25 @@ MCP_TOOL_EXEC_ATTEMPTS="${MCP_TOOL_EXEC_ATTEMPTS:-3}"
 MCP_TOOL_EXEC_RETRY_DELAY_SECONDS="${MCP_TOOL_EXEC_RETRY_DELAY_SECONDS:-15}"
 SUBSTRATE_BOOTSTRAP_TOKEN_SECRET_NAME="${SUBSTRATE_BOOTSTRAP_TOKEN_SECRET_NAME:-orka-substrate-bootstrap}"
 SUBSTRATE_BOOTSTRAP_TOKEN_SECRET_KEY="${SUBSTRATE_BOOTSTRAP_TOKEN_SECRET_KEY:-token}"
-SUBSTRATE_BOOTSTRAP_TOKEN="${SUBSTRATE_BOOTSTRAP_TOKEN:-bootstrap-ci-$(date +%s%N)-${RANDOM}}"
+if [[ "${SUBSTRATE_BOOTSTRAP_TOKEN+x}" != "x" || -z "${SUBSTRATE_BOOTSTRAP_TOKEN}" ]]; then
+  printf -v SUBSTRATE_BOOTSTRAP_TOKEN 'bootstrap-ci-%s-%s' "$(date +%s%N)" "${RANDOM}"
+fi
 
 SUBSTRATE_DIR=""
 TMP_ROOT=""
 DOCKER_CONFIG_DIR=""
 PORT_FORWARD_PID=""
+RUNSC_DELETE_INJECTION_NODE=""
+RUNSC_DELETE_INJECTION_PATH=""
 
 log() {
   printf '\n[%s] %s\n' "$(date -u +%H:%M:%S)" "$*"
 }
 
-redact() {
-  sed -E \
-    -e 's/(Authorization:[[:space:]]*Bearer[[:space:]]+)[A-Za-z0-9._~+\/=-]+/\1[REDACTED]/Ig' \
-    -e 's/(Bearer[[:space:]]+)[A-Za-z0-9._~+\/=-]+/\1[REDACTED]/Ig' \
-    -e 's/([Tt]xn-[Tt]oken:[[:space:]]*)[^[:space:]]+/\1[REDACTED]/g' \
-    -e 's/([Tt]oken["'\'']?[=:][[:space:]]*["'\'']?)[A-Za-z0-9._~+\/=-]+/\1[REDACTED]/g' \
-    -e 's/("name":"ORKA_WORKSPACE_BOOTSTRAP_TOKEN","value":")[^"]+/\1[REDACTED]/g' \
-    -e 's/("name":"ORKA_WORKSPACE_HANDOFF_TOKEN","value":")[^"]+/\1[REDACTED]/g' \
-    -e 's/(ORKA_WORKSPACE_HANDOFF_TOKEN=)[^[:space:]]+/\1[REDACTED]/g' \
-    -e 's/(ORKA_WORKSPACE_BOOTSTRAP_TOKEN=)[^[:space:]]+/\1[REDACTED]/g'
-}
+# Shared redaction; the bootstrap token literal is substituted at call time.
+# shellcheck source=scripts/lib/redact.sh
+. "${ROOT_DIR}/scripts/lib/redact.sh"
+ORKA_REDACT_SECRET_VARS=(SUBSTRATE_BOOTSTRAP_TOKEN)
 
 run_redacted() {
   set +e
@@ -53,6 +60,27 @@ kubectl_ate() {
   "${TMP_ROOT}/kubectl-ate" --context "kind-${KIND_CLUSTER}" "$@"
 }
 
+restore_runsc_delete_injector() {
+  local node="${RUNSC_DELETE_INJECTION_NODE:-}"
+  local path="${RUNSC_DELETE_INJECTION_PATH:-}"
+  if [[ -z "${node}" || -z "${path}" ]]; then
+    return 0
+  fi
+
+  if ! docker exec "${node}" /bin/sh -ceu '
+    path="$1"
+    if [ -e "${path}.orka-real" ]; then
+      rm -f "${path}"
+      mv "${path}.orka-real" "${path}"
+    fi
+    rm -f "${path}.orka-delete-failure-observed"
+  ' sh "${path}"; then
+    return 1
+  fi
+  RUNSC_DELETE_INJECTION_NODE=""
+  RUNSC_DELETE_INJECTION_PATH=""
+}
+
 dump_diagnostics() {
   local rc=$?
   if [[ "${rc}" -eq 0 ]]; then
@@ -61,18 +89,17 @@ dump_diagnostics() {
 
   log "Failure diagnostics"
   run_redacted kubectl get pods -A -o wide || true
-  run_redacted kubectl -n orka-system get deployment,pods -o wide || true
-  run_redacted kubectl -n orka-system get events --sort-by=.metadata.creationTimestamp || true
-  run_redacted kubectl -n default get agents,tasks,jobs,pods -o wide || true
-  run_redacted kubectl -n default get tasks -o yaml || true
-  run_redacted kubectl -n orka-system logs deployment/orka-controller-manager --all-containers --tail=-1 || true
+  run_redacted kubectl -n "${ORKA_NAMESPACE}" get deployment,pods,agents,tasks,jobs -o wide || true
+  run_redacted kubectl -n "${ORKA_NAMESPACE}" get events --sort-by=.metadata.creationTimestamp || true
+  run_redacted kubectl -n "${ORKA_NAMESPACE}" get tasks -o yaml || true
+  run_redacted kubectl -n "${ORKA_NAMESPACE}" logs deployment/orka-controller-manager --all-containers --tail=-1 || true
 
-  for job in $(kubectl -n default get jobs -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' 2>/dev/null || true); do
+  for job in $(kubectl -n "${ORKA_NAMESPACE}" get jobs -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' 2>/dev/null || true); do
     log "Logs for job/${job}"
-    run_redacted kubectl -n default logs "job/${job}" --all-containers --tail=-1 || true
+    run_redacted kubectl -n "${ORKA_NAMESPACE}" logs "job/${job}" --all-containers --tail=-1 || true
   done
-  run_redacted kubectl -n default get substrateactorpools,tools,leases -o wide || true
-  run_redacted kubectl -n default get substrateactorpools,tools,leases -o yaml || true
+  run_redacted kubectl -n "${ORKA_NAMESPACE}" get substrateactorpools,tools,leases -o wide || true
+  run_redacted kubectl -n "${ORKA_NAMESPACE}" get substrateactorpools,tools,leases -o yaml || true
 
   run_redacted kubectl -n ate-system get pods,svc,deploy,daemonset,statefulset -o wide || true
   run_redacted kubectl -n ate-system logs deployment/ate-api-server-deployment --all-containers --tail=400 || true
@@ -92,6 +119,7 @@ cleanup() {
   if [[ -n "${PORT_FORWARD_PID}" ]]; then
     kill "${PORT_FORWARD_PID}" >/dev/null 2>&1 || true
   fi
+  restore_runsc_delete_injector >/dev/null 2>&1 || true
   if [[ "${KEEP_CLUSTER}" != "1" ]]; then
     kind delete cluster --name "${KIND_CLUSTER}" >/dev/null 2>&1 || true
   else
@@ -221,22 +249,46 @@ wait_actor_status() {
 wait_actor_absent() {
   local actor_name="$1"
   local timeout_seconds="$2"
-  local started now output count
+  local started now output count rc observation
   started="$(date +%s)"
+  observation="not checked"
 
   while true; do
-    if ! output="$(kubectl_ate get actor "${actor_name}" -o json 2>/dev/null)"; then
-      log "actor/${actor_name}: absent"
-      return 0
+    if output="$(kubectl_ate get actor "${actor_name}" -o json 2>&1)"; then
+      rc=0
+    else
+      rc=$?
     fi
-    count="$(jq -r '.actors | length' <<<"${output}" 2>/dev/null || printf '1')"
-    if [[ "${count}" == "0" ]]; then
+    if [[ "${rc}" -ne 0 ]] && grep -Fq -- "code = NotFound desc = Actor ${actor_name} not found" <<<"${output}"; then
       log "actor/${actor_name}: absent"
       return 0
     fi
+    if [[ "${rc}" -eq 0 ]]; then
+      if count="$(jq -er '
+        if type != "object" then
+          error("actor response is not an object")
+        elif has("actors") then
+          if (.actors | type) == "array" then (.actors | length) else error("actors is not an array") end
+        elif length == 0 then
+          0
+        else
+          error("missing actors array")
+        end
+      ' <<<"${output}" 2>/dev/null)"; then
+        if [[ "${count}" == "0" ]]; then
+          log "actor/${actor_name}: absent"
+          return 0
+        fi
+        observation="actor query succeeded with ${count} result(s)"
+      else
+        observation="actor query succeeded with an invalid response"
+      fi
+    else
+      observation="kubectl-ate failed with exit ${rc} without an actor NotFound response"
+    fi
     now="$(date +%s)"
     if (( now - started > timeout_seconds )); then
-      echo "timed out waiting for actor/${actor_name} to be absent" >&2
+      echo "timed out waiting for actor/${actor_name} to be absent; ${observation}" >&2
       return 1
     fi
     sleep 5
@@ -259,54 +311,77 @@ substrate_actor_pool_prefix() {
   printf 'orka-p-%s' "${hash:0:24}"
 }
 
-wait_resource_absent() {
-  local namespace="$1"
-  local resource="$2"
-  local name="$3"
-  local timeout_seconds="$4"
-  local started now
+wait_worker_absent() {
+  local worker_name="$1"
+  local timeout_seconds="$2"
+  local started now count
   started="$(date +%s)"
 
   while true; do
-    if ! kubectl -n "${namespace}" get "${resource}" "${name}" >/dev/null 2>&1; then
-      log "${resource}/${name}: absent"
+    count="$(kubectl_ate get workers -o json 2>/dev/null | jq --arg worker "${worker_name}" '[.workers[]? | select(.workerPod == $worker)] | length' 2>/dev/null || true)"
+    if [[ "${count}" == "0" ]]; then
+      log "worker/${worker_name}: absent from Substrate store"
       return 0
     fi
     now="$(date +%s)"
     if (( now - started > timeout_seconds )); then
-      echo "timed out waiting for ${resource}/${name} in namespace ${namespace} to be absent" >&2
+      echo "timed out waiting for worker/${worker_name} to leave the Substrate store" >&2
       return 1
     fi
-    sleep 5
+    sleep 2
   done
 }
 
-wait_task_phase() {
-  local task="$1"
-  local expected="$2"
-  local timeout_seconds="${3:-${TASK_TIMEOUT_SECONDS}}"
-  local started now phase
+wait_worker_count_at_least() {
+  local minimum="$1"
+  local timeout_seconds="$2"
+  local started now count
   started="$(date +%s)"
 
-  log "Waiting for task/${task} to become ${expected}"
   while true; do
-    phase="$(kubectl -n default get task "${task}" -o jsonpath='{.status.phase}' 2>/dev/null || true)"
-    case "${phase}" in
-      "${expected}")
-        log "task/${task}: ${phase}"
-        return 0
-        ;;
-      Succeeded|Failed)
-        echo "task/${task} finished as ${phase}, expected ${expected}" >&2
-        return 1
-        ;;
-    esac
+    count="$(kubectl_ate get workers -o json 2>/dev/null | jq '[.workers[]? | select(.workerPool == "orka-workers")] | length' 2>/dev/null || true)"
+    if [[ "${count}" =~ ^[0-9]+$ && "${count}" -ge "${minimum}" ]]; then
+      log "Substrate worker count: ${count}"
+      return 0
+    fi
     now="$(date +%s)"
     if (( now - started > timeout_seconds )); then
-      echo "timed out waiting for task/${task}; current phase ${phase:-<empty>}" >&2
+      echo "timed out waiting for at least ${minimum} registered Substrate workers; got ${count:-<empty>}" >&2
       return 1
     fi
-    sleep 10
+    sleep 2
+  done
+}
+
+assert_no_suspending_actors() {
+  local count
+  count="$(kubectl_ate get actors -o json | jq '[.actors[]? | select(.status == "STATUS_SUSPENDING")] | length')"
+  if [[ "${count}" != "0" ]]; then
+    echo "found ${count} Actor(s) stuck in STATUS_SUSPENDING" >&2
+    return 1
+  fi
+  log "No Actors are stuck in STATUS_SUSPENDING"
+}
+
+wait_resource_absent() {
+  local namespace="$1"
+  local resource="$2"
+  local name="$3"
+  local timeout_seconds="$4"
+  local started now
+  started="$(date +%s)"
+
+  while true; do
+    if ! kubectl -n "${namespace}" get "${resource}" "${name}" >/dev/null 2>&1; then
+      log "${resource}/${name}: absent"
+      return 0
+    fi
+    now="$(date +%s)"
+    if (( now - started > timeout_seconds )); then
+      echo "timed out waiting for ${resource}/${name} in namespace ${namespace} to be absent" >&2
+      return 1
+    fi
+    sleep 5
   done
 }
 
@@ -317,8 +392,8 @@ wait_job_succeeded() {
   started="$(date +%s)"
 
   while true; do
-    succeeded="$(kubectl -n default get "job/${job_name}" -o jsonpath='{.status.succeeded}' 2>/dev/null || true)"
-    failed="$(kubectl -n default get "job/${job_name}" -o jsonpath='{.status.failed}' 2>/dev/null || true)"
+    succeeded="$(kubectl -n "${ORKA_NAMESPACE}" get "job/${job_name}" -o jsonpath='{.status.succeeded}' 2>/dev/null || true)"
+    failed="$(kubectl -n "${ORKA_NAMESPACE}" get "job/${job_name}" -o jsonpath='{.status.failed}' 2>/dev/null || true)"
     if [[ "${succeeded}" =~ ^[1-9][0-9]*$ ]]; then
       log "job/${job_name}: Complete"
       return 0
@@ -336,71 +411,83 @@ wait_job_succeeded() {
   done
 }
 
-assert_task_jsonpath() {
-  local task="$1"
-  local path="$2"
-  local expected="$3"
-  local actual
-  actual="$(kubectl -n default get task "${task}" -o "jsonpath=${path}")"
-  if [[ "${actual}" != "${expected}" ]]; then
-    echo "task/${task} expected ${path}=${expected}, got ${actual:-<empty>}" >&2
+patch_substrate_kind_registry_script() {
+  local script="${SUBSTRATE_DIR}/hack/create-kind-cluster.sh"
+  sed -i.bak \
+    -e 's|reg_name="kind-registry"|reg_name="${KIND_REGISTRY_NAME:-kind-registry}"|' \
+    -e 's|reg_port="5001"|reg_port="${KIND_REGISTRY_PORT:-5001}"|' \
+    "${script}"
+  rm -f "${script}.bak"
+  if ! grep -q "KIND_REGISTRY_PORT" "${script}"; then
+    echo "failed to patch Substrate kind registry script for registry override" >&2
     exit 1
   fi
 }
 
-task_jsonpath() {
-  local task="$1"
-  local path="$2"
-  kubectl -n default get task "${task}" -o "jsonpath=${path}" 2>/dev/null || true
-}
-
-assert_task_workspace_teleport_visibility() {
-  local task="$1"
-  local worker_pool worker_pod resume_latency worker_count actor_count actors_per_worker
+verify_substrate_source_blob() {
+  local target="$1"
+  local expected_blob="$2"
+  local patch_context="$3"
+  local actual_blob
 
-  worker_pool="$(task_jsonpath "${task}" "{.status.executionWorkspace.placement.workerPool}")"
-  worker_pod="$(task_jsonpath "${task}" "{.status.executionWorkspace.placement.workerPodName}")"
-  resume_latency="$(task_jsonpath "${task}" "{.status.executionWorkspace.resumeLatency}")"
-  worker_count="$(task_jsonpath "${task}" "{.status.executionWorkspace.density.workerCount}")"
-  actor_count="$(task_jsonpath "${task}" "{.status.executionWorkspace.density.actorCount}")"
-  actors_per_worker="$(task_jsonpath "${task}" "{.status.executionWorkspace.density.actorsPerWorker}")"
-
-  if [[ -z "${resume_latency}" ]]; then
-    echo "task/${task} missing Substrate teleport latency: resumeLatency=<empty>" >&2
+  if ! actual_blob="$(git -C "${SUBSTRATE_DIR}" rev-parse "HEAD:${target}" 2>/dev/null)"; then
+    echo "Substrate ref ${SUBSTRATE_REF} does not contain expected source ${target}" >&2
     exit 1
   fi
-  if [[ ! "${worker_count}" =~ ^[0-9]+$ || "${worker_count}" -lt 1 ]]; then
-    echo "task/${task} missing Substrate density worker count: workerCount=${worker_count:-<empty>}" >&2
+  if [[ "${actual_blob}" != "${expected_blob}" ]]; then
+    echo "Substrate ref ${SUBSTRATE_REF} has unreviewed ${patch_context} context in ${target}" >&2
+    echo "expected blob ${expected_blob}, got ${actual_blob}; review the provider contract before updating the patch" >&2
     exit 1
   fi
-  if [[ ! "${actor_count}" =~ ^[0-9]+$ || "${actor_count}" -lt 1 ]]; then
-    echo "task/${task} missing Substrate density actor count: actorCount=${actor_count:-<empty>}" >&2
+}
+
+verify_patch_paths() {
+  local patch_file="$1"
+  local expected_paths="$2"
+  local patch_paths
+
+  patch_paths="$(git -C "${SUBSTRATE_DIR}" apply --numstat "${patch_file}" | cut -f3- | LC_ALL=C sort)"
+  if [[ "${patch_paths}" != "${expected_paths}" ]]; then
+    echo "reviewed patch ${patch_file} changes unexpected files: ${patch_paths:-<none>}" >&2
     exit 1
   fi
-  if [[ -z "${actors_per_worker}" ]]; then
-    echo "task/${task} missing Substrate density ratio: actorsPerWorker=<empty>" >&2
+}
+
+apply_reviewed_substrate_patch() {
+  local label="$1"
+  local patch_file="$2"
+  local expected_paths="$3"
+  local -a paths=()
+  local path
+
+  if [[ ! -f "${patch_file}" ]]; then
+    echo "missing reviewed Substrate patch: ${patch_file}" >&2
+    exit 1
+  fi
+  verify_patch_paths "${patch_file}" "${expected_paths}"
+  if ! git -C "${SUBSTRATE_DIR}" apply --check --whitespace=error-all "${patch_file}"; then
+    echo "reviewed Substrate ${label} patch no longer applies cleanly" >&2
     exit 1
   fi
 
-  log "task/${task} teleport visibility: workerPool=${worker_pool} workerPodName=${worker_pod} resumeLatency=${resume_latency} density=${actor_count}/${worker_count} actorsPerWorker=${actors_per_worker}"
-}
+  git -C "${SUBSTRATE_DIR}" apply --whitespace=error-all "${patch_file}"
 
-patch_substrate_kind_registry_script() {
-  local script="${SUBSTRATE_DIR}/hack/create-kind-cluster.sh"
-  sed -i.bak \
-    -e 's|reg_name="kind-registry"|reg_name="${KIND_REGISTRY_NAME:-kind-registry}"|' \
-    -e 's|reg_port="5001"|reg_port="${KIND_REGISTRY_PORT:-5001}"|' \
-    "${script}"
-  rm -f "${script}.bak"
-  if ! grep -q "KIND_REGISTRY_PORT" "${script}"; then
-    echo "failed to patch Substrate kind registry script for registry override" >&2
+  if ! git -C "${SUBSTRATE_DIR}" apply --reverse --check "${patch_file}"; then
+    echo "failed to verify the applied Substrate ${label} patch" >&2
+    exit 1
+  fi
+  while IFS= read -r path; do
+    [[ -n "${path}" ]] && paths+=("${path}")
+  done <<< "${expected_paths}"
+  if ! git -C "${SUBSTRATE_DIR}" diff --check -- "${paths[@]}"; then
+    echo "applied Substrate ${label} patch introduced an invalid diff" >&2
     exit 1
   fi
 }
 
 apply_substrate_workspace_agent_capability_patch() {
   local target="cmd/servers/atelet/oci.go"
-  local actual_blob changed_files checkout_status
+  local changed_files checkout_status
 
   if [[ ! -f "${SUBSTRATE_ATELET_CAPABILITY_PATCH}" ]]; then
     echo "missing reviewed Substrate compatibility patch: ${SUBSTRATE_ATELET_CAPABILITY_PATCH}" >&2
@@ -411,15 +498,7 @@ apply_substrate_workspace_agent_capability_patch() {
     echo "refusing to patch a dirty Substrate checkout" >&2
     exit 1
   fi
-  if ! actual_blob="$(git -C "${SUBSTRATE_DIR}" rev-parse "HEAD:${target}" 2>/dev/null)"; then
-    echo "Substrate ref ${SUBSTRATE_REF} does not contain expected OCI source ${target}" >&2
-    exit 1
-  fi
-  if [[ "${actual_blob}" != "${SUBSTRATE_ATELET_OCI_BLOB}" ]]; then
-    echo "Substrate ref ${SUBSTRATE_REF} has unreviewed OCI capability context in ${target}" >&2
-    echo "expected blob ${SUBSTRATE_ATELET_OCI_BLOB}, got ${actual_blob}; review the provider contract before updating the patch" >&2
-    exit 1
-  fi
+  verify_substrate_source_blob "${target}" "${SUBSTRATE_ATELET_OCI_BLOB}" "OCI capability"
   if ! git -C "${SUBSTRATE_DIR}" apply --check --whitespace=error-all "${SUBSTRATE_ATELET_CAPABILITY_PATCH}"; then
     echo "reviewed Substrate workspace-agent capability patch no longer applies cleanly" >&2
     exit 1
@@ -454,6 +533,216 @@ apply_substrate_workspace_agent_capability_patch() {
   log "Applied reviewed Substrate root-supervisor capability compatibility patch"
 }
 
+apply_substrate_atenet_authorization_redaction_patch() {
+  local source="cmd/servers/atenet/app/router/extproc_in.go"
+  local source_test="cmd/servers/atenet/app/router/extproc_in_test.go"
+  local envoy_runner="cmd/servers/atenet/app/router/envoyrunner.go"
+  local install_manifest="manifests/ate-install/atenet-router.yaml"
+  local expected_paths
+  expected_paths="$(printf '%s\n' "${envoy_runner}" "${source}" "${source_test}" "${install_manifest}" | LC_ALL=C sort)"
+
+  verify_substrate_source_blob "${source}" "${SUBSTRATE_ATENET_EXTPROC_IN_BLOB}" "atenet request-metadata"
+  verify_substrate_source_blob "${source_test}" "${SUBSTRATE_ATENET_EXTPROC_IN_TEST_BLOB}" "atenet request-metadata test"
+  verify_substrate_source_blob "${envoy_runner}" "${SUBSTRATE_ATENET_ENVOY_RUNNER_BLOB}" "atenet Envoy runner logging"
+  verify_substrate_source_blob "${install_manifest}" "${SUBSTRATE_ATENET_MANIFEST_BLOB}" "atenet install manifest logging"
+  apply_reviewed_substrate_patch "atenet authorization-redaction" "${SUBSTRATE_ATENET_REDACTION_PATCH}" "${expected_paths}"
+
+  if [[ "$(grep -Fc 'case ":method", ":path", ":authority", "host", "x-request-id":' "${SUBSTRATE_DIR}/${source}" || true)" -ne 1 ]]; then
+    echo "Substrate atenet patch did not install the reviewed request-metadata allowlist" >&2
+    exit 1
+  fi
+  if [[ "$(grep -Fc 'if !isSafeRequestMetadataHeader(k) {' "${SUBSTRATE_DIR}/${source}" || true)" -ne 1 ]]; then
+    echo "Substrate atenet patch does not reject headers before retaining their values" >&2
+    exit 1
+  fi
+  if [[ "$(grep -Fc 'url.ParseRequestURI(value)' "${SUBSTRATE_DIR}/${source}" || true)" -ne 1 ]]; then
+    echo "Substrate atenet patch did not sanitize the request target before logging it" >&2
+    exit 1
+  fi
+  if [[ "$(grep -Fc 'if requestURI.Opaque != "" {' "${SUBSTRATE_DIR}/${source}" || true)" -ne 1 ||
+        "$(grep -Fc 'requestURI, err = url.Parse(value)' "${SUBSTRATE_DIR}/${source}" || true)" -ne 1 ]]; then
+    echo "Substrate atenet patch did not preserve absolute-form paths while discarding authority credentials" >&2
+    exit 1
+  fi
+  if [[ "$(grep -Fc 'func sanitizeRequestAuthority(value string) string {' "${SUBSTRATE_DIR}/${source}" || true)" -ne 1 ||
+        "$(grep -Fc 'authority.User != nil' "${SUBSTRATE_DIR}/${source}" || true)" -ne 1 ]]; then
+    echo "Substrate atenet patch did not reject credential-bearing authority values before logging" >&2
+    exit 1
+  fi
+  if grep -Eq 'redactedHeaderValue|sanitizeRequestHeaderValue|case "authorization"' "${SUBSTRATE_DIR}/${source}"; then
+    echo "Substrate atenet patch retained denylist-based request logging" >&2
+    exit 1
+  fi
+  for target in "${envoy_runner}" "${install_manifest}"; do
+    if grep -Fq 'upstream:debug,router:debug,ext_proc:debug' "${SUBSTRATE_DIR}/${target}"; then
+      echo "Substrate atenet patch retained credential-bearing Envoy debug logging in ${target}" >&2
+      exit 1
+    fi
+    grep -Fq 'upstream:info,router:info,ext_proc:info' "${SUBSTRATE_DIR}/${target}" || {
+      echo "Substrate atenet patch did not install bounded Envoy component logging in ${target}" >&2
+      exit 1
+    }
+  done
+
+  log "Applied reviewed Substrate atenet authorization-redaction patch"
+}
+
+apply_substrate_ateom_delete_recovery_patch() {
+  local service_source="cmd/servers/ateom-gvisor/ateom-gvisor.go"
+  local runsc_source="cmd/servers/ateom-gvisor/runsc.go"
+  local runsc_test="cmd/servers/ateom-gvisor/runsc_test.go"
+  local expected_paths
+  expected_paths="$(printf '%s\n' "${service_source}" "${runsc_source}" "${runsc_test}" | LC_ALL=C sort)"
+
+  verify_substrate_source_blob "${service_source}" "${SUBSTRATE_ATEOM_GVISOR_BLOB}" "ateom checkpoint"
+  verify_substrate_source_blob "${runsc_source}" "${SUBSTRATE_ATEOM_RUNSC_BLOB}" "runsc delete"
+  if git -C "${SUBSTRATE_DIR}" cat-file -e "HEAD:${runsc_test}" 2>/dev/null; then
+    echo "Substrate ref ${SUBSTRATE_REF} unexpectedly contains ${runsc_test}; review the local recovery patch" >&2
+    exit 1
+  fi
+  apply_reviewed_substrate_patch "ateom runsc-delete recovery" "${SUBSTRATE_ATEOM_DELETE_RECOVERY_PATCH}" "${expected_paths}"
+
+  if [[ "$(grep -Fc 'runscDeleteAttempts   = 4' "${SUBSTRATE_DIR}/${runsc_source}" || true)" -ne 1 ]]; then
+    echo "Substrate ateom patch did not install bounded runsc delete retries" >&2
+    exit 1
+  fi
+  if [[ "$(grep -Fc 'failed closed while verifying container absence' "${SUBSTRATE_DIR}/${runsc_source}" || true)" -ne 1 ]]; then
+    echo "Substrate ateom patch did not retain the fail-closed absence postcondition" >&2
+    exit 1
+  fi
+  local prepare_line checkpoint_line validate_line commit_line restore_prepare_line restore_network_move_line restore_line delete_line
+  prepare_line="$(grep -n 'prepareCheckpointRecovery(checkpointPath, recoveryPath, expectedContainers)' "${SUBSTRATE_DIR}/${service_source}" | cut -d: -f1)"
+  checkpoint_line="$(grep -n 'rcmd.cmdCheckpoint(ctx, "pause", checkpointPath)' "${SUBSTRATE_DIR}/${service_source}" | cut -d: -f1)"
+  validate_line="$(grep -n 'rcmd.cmdValidateCheckpoint(ctx, recoveryPath)' "${SUBSTRATE_DIR}/${service_source}" | tail -n1 | cut -d: -f1)"
+  commit_line="$(grep -n 'commitCheckpointRecovery(recoveryPath, expectedContainers)' "${SUBSTRATE_DIR}/${service_source}" | tail -n1 | cut -d: -f1)"
+  if [[ -z "${prepare_line}" || -z "${checkpoint_line}" || -z "${validate_line}" || -z "${commit_line}" ||
+        "${prepare_line}" -ge "${checkpoint_line}" || "${checkpoint_line}" -ge "${validate_line}" ||
+        "${validate_line}" -ge "${commit_line}" ]]; then
+    echo "Substrate ateom patch did not enforce prepared -> checkpointed -> validated -> committed recovery ordering" >&2
+    exit 1
+  fi
+  if [[ "$(grep -Fc 'checkpointRecoveryCommitName' "${SUBSTRATE_DIR}/${service_source}" || true)" -lt 3 ]]; then
+    echo "Substrate ateom patch did not install an explicit checkpoint commit record" >&2
+    exit 1
+  fi
+  if [[ "$(grep -Fc 'checkpointRecoveryArtifact' "${SUBSTRATE_DIR}/${service_source}" || true)" -lt 4 ]]; then
+    echo "Substrate ateom patch did not inventory checkpoint artifacts" >&2
+    exit 1
+  fi
+  if [[ "$(grep -Fc 'func materializeCheckpointTransport(checkpointPath, recoveryPath string) error {' "${SUBSTRATE_DIR}/${service_source}" || true)" -ne 1 ||
+        "$(grep -Fc 'compatibilityArtifacts := map[string]string{' "${SUBSTRATE_DIR}/${service_source}" || true)" -ne 1 ||
+        "$(grep -Fc 'for artifact, marker := range compatibilityArtifacts {' "${SUBSTRATE_DIR}/${service_source}" || true)" -ne 1 ||
+        "$(grep -Fc 'materializeCheckpointTransport(checkpointPath, recoveryPath)' "${SUBSTRATE_DIR}/${service_source}" || true)" -lt 2 ]]; then
+    echo "Substrate ateom patch did not preserve the legacy three-object checkpoint transport view" >&2
+    exit 1
+  fi
+  if [[ "$(grep -Fc 'func prepareCheckpointRestore(checkpointDir string) error {' "${SUBSTRATE_DIR}/${service_source}" || true)" -ne 1 ||
+        "$(grep -Fc 'checkpointPagesCompatibilityMarker' "${SUBSTRATE_DIR}/${service_source}" || true)" -lt 3 ||
+        "$(grep -Fc 'checkpointPagesMetadataCompatibilityMarker' "${SUBSTRATE_DIR}/${service_source}" || true)" -lt 3 ]]; then
+    echo "Substrate ateom patch did not identify marked transport placeholders before compressed restore" >&2
+    exit 1
+  fi
+  restore_prepare_line="$(grep -n 'prepareCheckpointRestore(checkpointDir)' "${SUBSTRATE_DIR}/${service_source}" | cut -d: -f1)"
+  restore_network_move_line="$(grep -n 'netlink.LinkSetNsFd(eth0Link, int(s.interiorNetNS))' "${SUBSTRATE_DIR}/${service_source}" | tail -n1 | cut -d: -f1)"
+  if [[ -z "${restore_prepare_line}" || -z "${restore_network_move_line}" ||
+        "${restore_prepare_line}" -ge "${restore_network_move_line}" ]]; then
+    echo "Substrate ateom patch did not validate restore artifacts before moving worker networking" >&2
+    exit 1
+  fi
+  if [[ "$(grep -Fc '"-compression=flate-best-speed"' "${SUBSTRATE_DIR}/${runsc_source}" || true)" -ne 1 ]]; then
+    echo "Substrate ateom patch did not pin the validated single-file checkpoint format" >&2
+    exit 1
+  fi
+  if grep -Fq '"-leave-running"' "${SUBSTRATE_DIR}/${runsc_source}"; then
+    echo "Substrate ateom patch resumed the sandbox before checkpoint commit" >&2
+    exit 1
+  fi
+  if [[ "$(grep -Fc 'func (r *runsc) cmdValidateCheckpoint' "${SUBSTRATE_DIR}/${runsc_source}" || true)" -ne 1 ]]; then
+    echo "Substrate ateom patch did not validate the stopped runsc statefile" >&2
+    exit 1
+  fi
+  if [[ "$(grep -Fc 'func (r *runsc) containerNamesLocked' "${SUBSTRATE_DIR}/${runsc_source}" || true)" -ne 1 ||
+        "$(grep -Fc 'return r.containerNamesLocked(ctx)' "${SUBSTRATE_DIR}/${runsc_source}" || true)" -ne 1 ]]; then
+    echo "Substrate ateom patch did not guard direct runsc list children from the PID 1 reaper" >&2
+    exit 1
+  fi
+  if [[ "$(grep -Fc 'filepath.Dir(recoveryPath),' "${SUBSTRATE_DIR}/${service_source}" || true)" -ne 1 ]]; then
+    echo "Substrate ateom patch did not stage commit temporaries outside the inventoried recovery directory" >&2
+    exit 1
+  fi
+  if [[ "$(grep -Fc 'json.Unmarshal(stdout.Bytes(), &state)' "${SUBSTRATE_DIR}/${runsc_source}" || true)" -ne 1 ]] ||
+     grep -Fq 'cmd.Stderr = &stdout' "${SUBSTRATE_DIR}/${runsc_source}"; then
+    echo "Substrate ateom patch did not isolate runsc state JSON from stderr diagnostics" >&2
+    exit 1
+  fi
+  if grep -Fq 'os.Rename(checkpointPath, recoveryPath)' "${SUBSTRATE_DIR}/${service_source}"; then
+    echo "Substrate ateom patch retained the post-checkpoint rename crash window" >&2
+    exit 1
+  fi
+  local recovery_test
+  local recovery_tests=(
+    TestContainerNamesWaitsForReaperReadLock
+    TestContainerStatusIgnoresStderrDiagnostics
+    TestCmdCheckpointUsesStoppedSingleFileProtocol
+    TestCheckpointRecoveryRejectsUnexpectedOrCorruptArtifacts
+    TestCheckpointRecoveryReconcilesPreparationBeforeCheckpoint
+    TestCheckpointRecoveryReconcilesUncommittedSuccessfulCheckpoint
+    TestCheckpointRecoveryReconcilesInterruptedWrite
+    TestPrepareCheckpointRestoreRemovesMarkedCompatibilityFiles
+    TestPrepareCheckpointRestoreRecoversPartialCompatibilityCleanup
+    TestPrepareCheckpointRestorePreservesNativeMultiFileSnapshot
+    TestPrepareCheckpointRestoreRejectsPartialNativeState
+  )
+  for recovery_test in "${recovery_tests[@]}"; do
+    if [[ "$(grep -Fc "func ${recovery_test}" "${SUBSTRATE_DIR}/${runsc_test}" || true)" -ne 1 ]]; then
+      echo "Substrate ateom patch did not cover ${recovery_test}" >&2
+      exit 1
+    fi
+  done
+
+  restore_line="$(grep -n 'Restore the worker Pod network before fallible runsc cleanup' "${SUBSTRATE_DIR}/${service_source}" | cut -d: -f1)"
+  delete_line="$(grep -n 'Delete all application containers' "${SUBSTRATE_DIR}/${service_source}" | cut -d: -f1)"
+  if [[ -z "${restore_line}" || -z "${delete_line}" || "${restore_line}" -ge "${delete_line}" ]]; then
+    echo "Substrate ateom patch did not restore worker networking before fallible delete cleanup" >&2
+    exit 1
+  fi
+
+  log "Applied reviewed Substrate ateom runsc-delete recovery patch"
+}
+
+verify_reviewed_substrate_patch_set() {
+  local expected_files changed_files
+  expected_files="$(printf '%s\n' \
+    cmd/servers/atelet/oci.go \
+    cmd/servers/atenet/app/router/envoyrunner.go \
+    cmd/servers/atenet/app/router/extproc_in.go \
+    cmd/servers/atenet/app/router/extproc_in_test.go \
+    cmd/servers/ateom-gvisor/ateom-gvisor.go \
+    cmd/servers/ateom-gvisor/runsc.go \
+    cmd/servers/ateom-gvisor/runsc_test.go \
+    manifests/ate-install/atenet-router.yaml | LC_ALL=C sort)"
+  changed_files="$(git -C "${SUBSTRATE_DIR}" status --short | sed -E 's/^.. //' | LC_ALL=C sort)"
+  if [[ "${changed_files}" != "${expected_files}" ]]; then
+    echo "reviewed Substrate patch set changed unexpected files: ${changed_files:-<none>}" >&2
+    exit 1
+  fi
+
+  log "Running focused tests for the reviewed Substrate patches"
+  (
+    cd "${SUBSTRATE_DIR}"
+    go test ./cmd/servers/atelet ./cmd/servers/atenet/app/router -count=1
+    if [[ "$(go env GOOS)" == "linux" ]]; then
+      go test ./cmd/servers/ateom-gvisor -count=1
+    else
+      # The pinned netlink dependency does not expose Linux family constants on
+      # non-Linux hosts. Cross-compile the package here; Linux CI/live E2E runs
+      # the injected delete-recovery tests.
+      GOOS=linux GOARCH="$(go env GOARCH)" go test -c \
+        -o "${TMP_ROOT}/ateom-gvisor-patch-tests" ./cmd/servers/ateom-gvisor
+    fi
+  )
+}
+
 publish_ateom_image() {
   local published
   published="$(
@@ -477,7 +766,9 @@ create_substrate_resources() {
 
   log "Creating Substrate WorkerPool and ActorTemplate"
   kubectl create namespace ate-demo --dry-run=client -o yaml | kubectl apply -f -
-  for ns in ate-demo default; do
+  bash "${ROOT_DIR}/scripts/lib/ensure-static-mode-namespace.sh" \
+    kubectl "${ORKA_NAMESPACE}" harness-v2
+  for ns in ate-demo "${ORKA_NAMESPACE}"; do
     kubectl -n "${ns}" create secret generic "${SUBSTRATE_BOOTSTRAP_TOKEN_SECRET_NAME}" \
       "--from-literal=${SUBSTRATE_BOOTSTRAP_TOKEN_SECRET_KEY}=${SUBSTRATE_BOOTSTRAP_TOKEN}" \
       --dry-run=client -o yaml | kubectl apply -f -
@@ -547,7 +838,7 @@ apiVersion: ate.dev/v1alpha1
 kind: ActorTemplate
 metadata:
   name: orka-mcp-ci
-  namespace: ate-demo
+  namespace: ${ORKA_NAMESPACE}
   labels:
     orka.ai/execution-workspace: "true"
     orka.ai/workspace-provider: substrate
@@ -588,14 +879,13 @@ YAML
 
   wait_jsonpath_equals \
     "actortemplate/orka-mcp-ci readiness" \
-    "kubectl -n ate-demo get actortemplate orka-mcp-ci -o jsonpath='{.status.phase}'" \
+    "kubectl -n ${ORKA_NAMESPACE} get actortemplate orka-mcp-ci -o jsonpath='{.status.phase}'" \
     "Ready" \
     900
 }
 
 deploy_orka() {
   local controller_image="$1"
-  local codex_image="$2"
   local tmp_config
   tmp_config="$(mktemp -d "${TMP_ROOT}/orka-config.XXXXXX")"
 
@@ -606,26 +896,58 @@ deploy_orka() {
 
   cp -R "${ROOT_DIR}/config" "${tmp_config}/config"
   (cd "${tmp_config}/config/manager" && "${ROOT_DIR}/bin/kustomize" edit set image "controller=${controller_image}")
+  # Agent Substrate validation exercises the workspace provider directly. The
+  # initial ACP release does not dispatch RuntimeSessions to Substrate Actors, so
+  # omit the unrelated clean-room publisher workload and provide only the
+  # controller's required non-secret image metadata and local capability files.
   (
-    cd "${tmp_config}/config/harness-wrapper"
-    "${ROOT_DIR}/bin/kustomize" edit set image "ghcr.io/orka-agents/orka/agent-harness-wrapper=${codex_image}"
+    cd "${tmp_config}/config/acp-workload"
+    "${ROOT_DIR}/bin/kustomize" edit remove resource ../publisher
+    "${ROOT_DIR}/bin/kustomize" edit remove resource ../provider-proxy
+    "${ROOT_DIR}/bin/kustomize" edit remove resource ../scm-egress-proxy
   )
-  kubectl create namespace orka-system --dry-run=client -o yaml | kubectl apply -f -
-  if ! kubectl -n orka-system get secret harness-wrapper-auth >/dev/null 2>&1; then
-    local wrapper_token_file
-    wrapper_token_file="$(mktemp "${TMP_ROOT}/harness-wrapper-token.XXXXXX")"
-    chmod 0600 "${wrapper_token_file}"
-    dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d '\n' >"${wrapper_token_file}"
-    kubectl -n orka-system create secret generic harness-wrapper-auth --from-file=token="${wrapper_token_file}" >/dev/null
-    rm -f "${wrapper_token_file}"
-  fi
-  "${ROOT_DIR}/bin/kustomize" build "${tmp_config}/config/default" | kubectl apply -f -
-  kubectl -n orka-system set env deployment/orka-agent-harness-wrapper CODEX_CLI_PATH=/bin/true
-  kubectl -n orka-system rollout status deployment/orka-agent-harness-wrapper --timeout=5m
+  local placeholder_digest
+  placeholder_digest="sha256:$(printf '0%.0s' {1..64})"
+  kubectl -n orka-system create configmap acp-runtime-images \
+    --from-literal="ORKA_ACP_CODEX_RUNTIME_IMAGE=example.invalid/orka/acp-codex@${placeholder_digest}" \
+    --from-literal="ORKA_ACP_CLAUDE_RUNTIME_IMAGE=example.invalid/orka/acp-claude@${placeholder_digest}" \
+    --from-literal="ORKA_ACP_COPILOT_RUNTIME_IMAGE=example.invalid/orka/acp-copilot@${placeholder_digest}" \
+    --from-literal="ORKA_ACP_OPENCODE_RUNTIME_IMAGE=example.invalid/orka/acp-opencode@${placeholder_digest}" \
+    --dry-run=client -o yaml | kubectl apply -f -
+
+  local capability_dir snapshot_key_field artifact_capability_field publisher_controller_field publisher_operation_field provider_field
+  capability_dir="$(mktemp -d "${TMP_ROOT}/acp-capabilities.XXXXXX")"
+  snapshot_key_field="snapshot-key"
+  artifact_capability_field="capability-secret"
+  publisher_controller_field="controller-token"
+  publisher_operation_field="operation-capability-secret"
+  provider_field="token"
+  chmod 0700 "${capability_dir}"
+  dd if=/dev/urandom bs=32 count=1 2>/dev/null >"${capability_dir}/snapshot-key"
+  dd if=/dev/urandom bs=32 count=1 2>/dev/null >"${capability_dir}/artifact-capability"
+  dd if=/dev/urandom bs=32 count=1 2>/dev/null >"${capability_dir}/publisher-token"
+  dd if=/dev/urandom bs=32 count=1 2>/dev/null >"${capability_dir}/publisher-capability"
+  dd if=/dev/urandom bs=32 count=1 2>/dev/null >"${capability_dir}/provider-token"
+  chmod 0600 "${capability_dir}"/*
+  kubectl -n orka-system create secret generic agent-execution-snapshot-key \
+    --from-file="${snapshot_key_field}=${capability_dir}/snapshot-key" \
+    --dry-run=client -o yaml | kubectl apply -f -
+  kubectl -n orka-system create secret generic acp-artifact-capability \
+    --from-file="${artifact_capability_field}=${capability_dir}/artifact-capability" \
+    --dry-run=client -o yaml | kubectl apply -f -
+  kubectl -n orka-system create secret generic workspace-publisher-auth \
+    --from-file="${publisher_controller_field}=${capability_dir}/publisher-token" \
+    --from-file="${publisher_operation_field}=${capability_dir}/publisher-capability" \
+    --dry-run=client -o yaml | kubectl apply -f -
+  kubectl -n orka-system create secret generic provider-auth-proxy \
+    --from-file="${provider_field}=${capability_dir}/provider-token" \
+    --dry-run=client -o yaml | kubectl apply -f -
+  rm -rf "${capability_dir}"
+
+  "${ROOT_DIR}/bin/kustomize" build "${tmp_config}/config/acp-workload" | kubectl apply -f -
 
   local patch
   patch="$(jq -cn \
-    --arg codex_image "${codex_image}" \
     --arg bootstrap_secret_name "${SUBSTRATE_BOOTSTRAP_TOKEN_SECRET_NAME}" \
     --arg bootstrap_secret_key "${SUBSTRATE_BOOTSTRAP_TOKEN_SECRET_KEY}" \
     '{
@@ -635,6 +957,16 @@ deploy_orka() {
             containers: [
               {
                 name: "manager",
+                # The Substrate-only deployment removes the Publisher workload.
+                # Disable the client explicitly so fail-closed capability
+                # negotiation does not target a Service that is intentionally
+                # absent from this direct provider evaluation cluster.
+                env: [
+                  {
+                    name: "ORKA_WORKSPACE_PUBLISHER_URL",
+                    "$patch": "delete"
+                  }
+                ],
                 imagePullPolicy: "IfNotPresent",
                 resources: {
                   requests: { cpu: "250m", memory: "256Mi" },
@@ -657,7 +989,12 @@ deploy_orka() {
                 args: [
                   "--leader-elect",
                   "--health-probe-bind-address=:8081",
+                  "--agent-execution-snapshot-key-file=/var/run/orka/agent-execution-snapshot/key",
                   "--controller-url=http://orka-api.orka-system.svc:8080",
+                  "--controller-mode=harness-v2",
+                  "--watch-namespace=orka-system",
+                  "--enforce-namespace-isolation=true",
+                  "--execution-mode-controller-usernames=system:serviceaccount:orka-system:orka-controller-manager",
                   "--execution-workspace-default-provider=substrate",
                   "--agent-sandbox-enabled=false",
                   "--substrate-enabled=true",
@@ -683,145 +1020,16 @@ deploy_orka() {
   kubectl -n orka-system rollout status deployment/orka-controller-manager --timeout=5m
 }
 
-create_agent() {
-  log "Creating Codex Agent"
-  kubectl apply -f - <<'YAML'
-apiVersion: core.orka.ai/v1alpha1
-kind: Agent
-metadata:
-  name: codex-substrate-ci
-  namespace: default
-spec:
-  runtime:
-    type: codex
-    defaultMaxTurns: 1
-    defaultAllowBash: true
-  model:
-    name: gpt-5.4
-  systemPrompt:
-    inline: |
-      You are a CI smoke-test agent. Run the requested command and stop.
-YAML
-}
-
-apply_task() {
-  local name="$1"
-  local workspace_yaml="$2"
-  kubectl apply -f - <<YAML
-apiVersion: core.orka.ai/v1alpha1
-kind: Task
-metadata:
-  name: ${name}
-  namespace: default
-spec:
-  type: agent
-  agentRef:
-    name: codex-substrate-ci
-  prompt: "Run the configured CLI and finish."
-  timeout: 10m
-  agentRuntime:
-    maxTurns: 1
-    allowBash: true
-  execution:
-    workspace:
-${workspace_yaml}
-YAML
-}
-
-run_retained_workspace_task() {
-  local task_name="$1"
-
-  log "Running retained-workspace task/${task_name}"
-  if ! apply_task "${task_name}" "      enabled: true
-      provider: substrate
-      templateRef:
-        name: orka-codex-ci
-        namespace: ate-demo
-      cleanupPolicy: retain"; then
-    return 1
-  fi
-
-  if wait_task_phase "${task_name}" "Succeeded"; then
-    assert_task_jsonpath "${task_name}" "{.status.executionWorkspace.phase}" "Retained"
-    assert_task_workspace_teleport_visibility "${task_name}"
-    return 0
-  fi
-
-  accept_task_cleanup_failure_after_result "${task_name}"
-}
-
-task_failed_workspace_cleanup() {
-  local task_name="$1"
-  local reason
-
-  reason="$(task_jsonpath "${task_name}" "{.status.executionWorkspace.reason}")"
-  [[ "${reason}" == "WorkspaceCleanupFailed" ]]
-}
-
-accept_task_cleanup_failure_after_result() {
-  local task_name="$1"
-
-  if ! task_failed_workspace_cleanup "${task_name}"; then
-    return 1
-  fi
-
-  assert_task_jsonpath "${task_name}" "{.status.executionWorkspace.provider}" "substrate"
-  assert_task_jsonpath "${task_name}" "{.status.executionWorkspace.templateRef.name}" "orka-codex-ci"
-  assert_task_jsonpath "${task_name}" "{.status.executionWorkspace.phase}" "Failed"
-  assert_task_jsonpath "${task_name}" "{.status.resultRef.available}" "true"
-  assert_task_workspace_teleport_visibility "${task_name}"
-  log "task/${task_name} produced a result but hit WorkspaceCleanupFailed; accepting known pinned Substrate runsc cleanup failure"
-}
-
-run_default_workspace_task() {
-  local task_name="$1"
-
-  log "Running default Substrate boot task/${task_name}"
-  if ! apply_task "${task_name}" "      enabled: true
-      boot: true"; then
-    return 1
-  fi
-
-  if wait_task_phase "${task_name}" "Succeeded"; then
-    assert_task_jsonpath "${task_name}" "{.status.executionWorkspace.provider}" "substrate"
-    assert_task_jsonpath "${task_name}" "{.status.executionWorkspace.templateRef.name}" "orka-codex-ci"
-    assert_task_jsonpath "${task_name}" "{.status.executionWorkspace.phase}" "Deleted"
-    assert_task_jsonpath "${task_name}" "{.status.resultRef.available}" "true"
-    assert_task_workspace_teleport_visibility "${task_name}"
-    return 0
-  fi
-
-  accept_task_cleanup_failure_after_result "${task_name}"
-}
-
 create_substrate_actor_pools() {
   log "Creating Orka SubstrateActorPools"
-  kubectl apply -f - <<'YAML'
-apiVersion: core.orka.ai/v1alpha1
-kind: SubstrateActorPool
-metadata:
-  name: codex-substrate-pool-ci
-  namespace: default
-spec:
-  templateRef:
-    name: orka-codex-ci
-    namespace: ate-demo
-  workerPoolRef:
-    name: orka-workers
-    namespace: ate-demo
-  targetActors: 2
-  targetWorkers: 1
-  precreateActors: true
----
+  kubectl -n "${ORKA_NAMESPACE}" apply -f - <<'YAML'
 apiVersion: core.orka.ai/v1alpha1
 kind: SubstrateActorPool
 metadata:
   name: mcp-substrate-pool-ci
-  namespace: default
 spec:
   templateRef:
     name: orka-mcp-ci
-    namespace: ate-demo
   workerPoolRef:
     name: orka-workers
     namespace: ate-demo
@@ -830,55 +1038,25 @@ spec:
   precreateActors: true
 YAML
 
-  for pool in codex-substrate-pool-ci mcp-substrate-pool-ci; do
-    wait_jsonpath_equals \
-      "substrateactorpool/${pool} readiness" \
-      "kubectl -n default get substrateactorpool ${pool} -o jsonpath='{.status.phase}'" \
-      "Ready" \
-      600
-    wait_jsonpath_int_at_least \
-      "substrateactorpool/${pool} actor count" \
-      "kubectl -n default get substrateactorpool ${pool} -o jsonpath='{.status.actorCount}'" \
-      2 \
-      600
-  done
-}
-
-run_pooled_workspace_task() {
-  local task_name="$1"
-
-  log "Running pooled Substrate task/${task_name}"
-  if ! apply_task "${task_name}" "      enabled: true
-      provider: substrate
-      templateRef:
-        name: orka-codex-ci
-        namespace: ate-demo
-      poolRef:
-        name: codex-substrate-pool-ci
-      boot: true"; then
-    return 1
-  fi
-
-  if wait_task_phase "${task_name}" "Succeeded"; then
-    assert_task_jsonpath "${task_name}" "{.status.executionWorkspace.provider}" "substrate"
-    assert_task_jsonpath "${task_name}" "{.status.executionWorkspace.templateRef.name}" "orka-codex-ci"
-    assert_task_jsonpath "${task_name}" "{.status.executionWorkspace.phase}" "Deleted"
-    assert_task_jsonpath "${task_name}" "{.status.resultRef.available}" "true"
-    assert_task_workspace_teleport_visibility "${task_name}"
-    return 0
-  fi
-
-  accept_task_cleanup_failure_after_result "${task_name}"
+  wait_jsonpath_equals \
+    "substrateactorpool/mcp-substrate-pool-ci readiness" \
+    "kubectl -n ${ORKA_NAMESPACE} get substrateactorpool mcp-substrate-pool-ci -o jsonpath='{.status.phase}'" \
+    "Ready" \
+    600
+  wait_jsonpath_int_at_least \
+    "substrateactorpool/mcp-substrate-pool-ci actor count" \
+    "kubectl -n ${ORKA_NAMESPACE} get substrateactorpool mcp-substrate-pool-ci -o jsonpath='{.status.actorCount}'" \
+    2 \
+    600
 }
 
 create_mcp_tool() {
   log "Creating pooled MCP Tool"
-  kubectl apply -f - <<'YAML'
+  kubectl -n "${ORKA_NAMESPACE}" apply -f - <<'YAML'
 apiVersion: core.orka.ai/v1alpha1
 kind: Tool
 metadata:
   name: mcp-ci
-  namespace: default
 spec:
   description: E2E MCP tool backed by a durable Substrate actor.
   parameters:
@@ -893,7 +1071,6 @@ spec:
     substrateActor:
       templateRef:
         name: orka-mcp-ci
-        namespace: ate-demo
       poolRef:
         name: mcp-substrate-pool-ci
       boot: true
@@ -901,17 +1078,17 @@ YAML
 
   wait_jsonpath_equals \
     "tool/mcp-ci availability" \
-    "kubectl -n default get tool mcp-ci -o jsonpath='{.status.available}'" \
+    "kubectl -n ${ORKA_NAMESPACE} get tool mcp-ci -o jsonpath='{.status.available}'" \
     "true" \
     600
   wait_jsonpath_equals \
     "tool/mcp-ci actor provider" \
-    "kubectl -n default get tool mcp-ci -o jsonpath='{.status.actor.provider}'" \
+    "kubectl -n ${ORKA_NAMESPACE} get tool mcp-ci -o jsonpath='{.status.actor.provider}'" \
     "substrate" \
     60
   wait_jsonpath_equals \
     "tool/mcp-ci poolRef" \
-    "kubectl -n default get tool mcp-ci -o jsonpath='{.status.actor.poolRef.name}'" \
+    "kubectl -n ${ORKA_NAMESPACE} get tool mcp-ci -o jsonpath='{.status.actor.poolRef.name}'" \
     "mcp-substrate-pool-ci" \
     60
 }
@@ -941,19 +1118,19 @@ run_mcp_tool_client_job() {
 
   for ((attempt = 1; attempt <= MCP_TOOL_EXEC_ATTEMPTS; attempt++)); do
     log "Executing MCP Tool through worker ToolExecutor (attempt ${attempt}/${MCP_TOOL_EXEC_ATTEMPTS})"
-    kubectl -n default delete "job/${job_name}" --ignore-not-found --wait=true >/dev/null
+    kubectl -n "${ORKA_NAMESPACE}" delete "job/${job_name}" --ignore-not-found --wait=true >/dev/null
     kubectl apply -f - <<YAML
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: ${job_name}
-  namespace: default
+  namespace: ${ORKA_NAMESPACE}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: ${job_name}
-  namespace: default
+  namespace: ${ORKA_NAMESPACE}
 rules:
   - apiGroups:
       - core.orka.ai
@@ -966,7 +1143,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: ${job_name}
-  namespace: default
+  namespace: ${ORKA_NAMESPACE}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -974,13 +1151,13 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: ${job_name}
-    namespace: default
+    namespace: ${ORKA_NAMESPACE}
 ---
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: ${job_name}
-  namespace: default
+  namespace: ${ORKA_NAMESPACE}
 spec:
   backoffLimit: 0
   template:
@@ -993,7 +1170,7 @@ spec:
           imagePullPolicy: IfNotPresent
           env:
             - name: ORKA_TOOL_NAMESPACE
-              value: default
+              value: ${ORKA_NAMESPACE}
             - name: ORKA_TOOL_NAME
               value: mcp-ci
             - name: ORKA_TOOL_ARGS
@@ -1002,11 +1179,11 @@ spec:
               value: '${expected}'
 YAML
     if wait_job_succeeded "${job_name}" 300; then
-      run_redacted kubectl -n default logs "job/${job_name}" --all-containers --tail=-1
+      run_redacted kubectl -n "${ORKA_NAMESPACE}" logs "job/${job_name}" --all-containers --tail=-1
       return 0
     fi
 
-    run_redacted kubectl -n default logs "job/${job_name}" --all-containers --tail=-1 || true
+    run_redacted kubectl -n "${ORKA_NAMESPACE}" logs "job/${job_name}" --all-containers --tail=-1 || true
     if (( attempt == MCP_TOOL_EXEC_ATTEMPTS )); then
       echo "job/${job_name} did not complete after ${MCP_TOOL_EXEC_ATTEMPTS} attempts" >&2
       return 1
@@ -1018,7 +1195,7 @@ YAML
 
 mcp_tool_client_result() {
   local job_name="$1"
-  kubectl -n default logs "job/${job_name}" --all-containers --tail=-1 | redact | tail -n1
+  kubectl -n "${ORKA_NAMESPACE}" logs "job/${job_name}" --all-containers --tail=-1 | redact | tail -n1
 }
 
 verify_mcp_tool_boots_actor_once() {
@@ -1026,8 +1203,8 @@ verify_mcp_tool_boots_actor_once() {
   local actor_id booted_actor_id generation before after before_started before_count after_started after_count
 
   log "Verifying MCP Tool actor is booted once across forced reconcile"
-  actor_id="$(kubectl -n default get tool mcp-ci -o jsonpath='{.status.actor.actorID}')"
-  booted_actor_id="$(kubectl -n default get tool mcp-ci -o json | jq -r '.metadata.annotations["orka.ai/substrate-mcp-tool-booted-id"] // ""')"
+  actor_id="$(kubectl -n "${ORKA_NAMESPACE}" get tool mcp-ci -o jsonpath='{.status.actor.actorID}')"
+  booted_actor_id="$(kubectl -n "${ORKA_NAMESPACE}" get tool mcp-ci -o json | jq -r '.metadata.annotations["orka.ai/substrate-mcp-tool-booted-id"] // ""')"
   if [[ -z "${actor_id}" || "${booted_actor_id}" != "${actor_id}" ]]; then
     echo "tool/mcp-ci booted actor annotation = ${booted_actor_id:-<empty>}, want ${actor_id:-<empty>}" >&2
     exit 1
@@ -1043,17 +1220,17 @@ verify_mcp_tool_boots_actor_once() {
   before_count="${BASH_REMATCH[2]}"
 
   generation="$(
-    kubectl -n default patch tool mcp-ci --type=merge \
+    kubectl -n "${ORKA_NAMESPACE}" patch tool mcp-ci --type=merge \
       -p '{"spec":{"description":"E2E MCP tool backed by a durable Substrate actor after forced reconcile."}}' \
       -o json | jq -r '.metadata.generation'
   )"
   wait_jsonpath_equals \
     "tool/mcp-ci forced reconcile observed generation" \
-    "kubectl -n default get tool mcp-ci -o json | jq -r '.status.conditions[]? | select(.type == \"Available\") | .observedGeneration'" \
+    "kubectl -n ${ORKA_NAMESPACE} get tool mcp-ci -o json | jq -r '.status.conditions[]? | select(.type == \"Available\") | .observedGeneration'" \
     "${generation}" \
     120
 
-  booted_actor_id="$(kubectl -n default get tool mcp-ci -o json | jq -r '.metadata.annotations["orka.ai/substrate-mcp-tool-booted-id"] // ""')"
+  booted_actor_id="$(kubectl -n "${ORKA_NAMESPACE}" get tool mcp-ci -o json | jq -r '.metadata.annotations["orka.ai/substrate-mcp-tool-booted-id"] // ""')"
   if [[ "${booted_actor_id}" != "${actor_id}" ]]; then
     echo "tool/mcp-ci booted actor annotation after reconcile = ${booted_actor_id:-<empty>}, want ${actor_id}" >&2
     exit 1
@@ -1082,8 +1259,8 @@ verify_mcp_tool_cleanup() {
   local actor_id pool_name generation pool_prefix pool_actor_0 pool_actor_1
 
   log "Verifying MCP Tool deletion and non-precreating pool scale-down prune actors"
-  actor_id="$(kubectl -n default get tool mcp-ci -o jsonpath='{.status.actor.actorID}')"
-  pool_name="$(kubectl -n default get tool mcp-ci -o jsonpath='{.status.actor.poolRef.name}')"
+  actor_id="$(kubectl -n "${ORKA_NAMESPACE}" get tool mcp-ci -o jsonpath='{.status.actor.actorID}')"
+  pool_name="$(kubectl -n "${ORKA_NAMESPACE}" get tool mcp-ci -o jsonpath='{.status.actor.poolRef.name}')"
   if [[ -z "${actor_id}" ]]; then
     echo "tool/mcp-ci missing status.actor.actorID before cleanup" >&2
     exit 1
@@ -1092,34 +1269,34 @@ verify_mcp_tool_cleanup() {
     echo "tool/mcp-ci missing status.actor.poolRef.name before cleanup" >&2
     exit 1
   fi
-  pool_prefix="$(substrate_actor_pool_prefix default "${pool_name}")"
+  pool_prefix="$(substrate_actor_pool_prefix "${ORKA_NAMESPACE}" "${pool_name}")"
   pool_actor_0="${pool_prefix}-00000"
   pool_actor_1="${pool_prefix}-00001"
-  kubectl -n default get lease "${actor_id}" >/dev/null
+  kubectl -n "${ORKA_NAMESPACE}" get lease "${actor_id}" >/dev/null
 
   generation="$(
-    kubectl -n default patch substrateactorpool "${pool_name}" --type=merge \
+    kubectl -n "${ORKA_NAMESPACE}" patch substrateactorpool "${pool_name}" --type=merge \
       -p '{"spec":{"targetActors":0,"precreateActors":false}}' \
       -o json | jq -r '.metadata.generation'
   )"
   wait_jsonpath_equals \
     "substrateactorpool/${pool_name} scale-down observed generation" \
-    "kubectl -n default get substrateactorpool ${pool_name} -o jsonpath='{.status.observedGeneration}'" \
+    "kubectl -n ${ORKA_NAMESPACE} get substrateactorpool ${pool_name} -o jsonpath='{.status.observedGeneration}'" \
     "${generation}" \
     120
 
-  kubectl -n default delete tool mcp-ci --wait=false
-  wait_resource_absent default tool mcp-ci 300
-  wait_resource_absent default lease "${actor_id}" 300
+  kubectl -n "${ORKA_NAMESPACE}" delete tool mcp-ci --wait=false
+  wait_resource_absent "${ORKA_NAMESPACE}" tool mcp-ci 300
+  wait_resource_absent "${ORKA_NAMESPACE}" lease "${actor_id}" 300
   wait_actor_absent "${actor_id}" 300
   wait_jsonpath_equals \
     "substrateactorpool/${pool_name} non-precreate scale-down readiness" \
-    "kubectl -n default get substrateactorpool ${pool_name} -o jsonpath='{.status.phase}'" \
+    "kubectl -n ${ORKA_NAMESPACE} get substrateactorpool ${pool_name} -o jsonpath='{.status.phase}'" \
     "Ready" \
     300
   wait_jsonpath_equals \
     "substrateactorpool/${pool_name} actor count after non-precreate prune" \
-    "kubectl -n default get substrateactorpool ${pool_name} -o json | jq -r '.status.actorCount // 0'" \
+    "kubectl -n ${ORKA_NAMESPACE} get substrateactorpool ${pool_name} -o json | jq -r '.status.actorCount // 0'" \
     "0" \
     300
   wait_actor_absent "${pool_actor_0}" 300
@@ -1130,7 +1307,6 @@ verify_mcp_tool_cleanup() {
 exercise_orka_tasks() {
   local tool_client_image="$1"
 
-  create_agent
   create_substrate_actor_pools
 
   create_mcp_tool
@@ -1138,7 +1314,7 @@ exercise_orka_tasks() {
   verify_mcp_tool_boots_actor_once "${tool_client_image}"
   verify_mcp_tool_cleanup
 
-  log "Skipping agent Task execution-workspace checks: harness-wrapper runtime is service-backed and no longer runs agent tasks as Substrate Jobs"
+  log "Skipping workspace-backed ACP Task execution: RuntimeSession-to-Substrate Actor dispatch is deferred; direct Substrate and Orka-brokered MCP workspace paths were validated above"
 }
 
 wait_http_ok() {
@@ -1166,46 +1342,360 @@ wait_http_ok() {
   done
 }
 
-exercise_direct_substrate() {
-  local actor_name="orka-direct-ci"
+write_workspace_handoff_token() {
+  local url="$1"
+  local host_header="$2"
+  local token_b64="$3"
+  local timeout_seconds="$4"
+  local started now remaining attempt_timeout
+  started="$(date +%s)"
+
+  while true; do
+    now="$(date +%s)"
+    remaining=$((timeout_seconds - (now - started)))
+    if (( remaining <= 0 )); then
+      echo "timed out installing workspace handoff token via Host ${host_header}" >&2
+      return 1
+    fi
+    attempt_timeout="${remaining}"
+    if (( attempt_timeout > 5 )); then
+      attempt_timeout=5
+    fi
+    # STATUS_RUNNING can precede the router's upstream connection becoming
+    # usable after worker replacement or runsc recovery. Keep credentials and
+    # response bodies private while retrying that bounded readiness window.
+    if curl -fsS \
+      --connect-timeout "${attempt_timeout}" \
+      --max-time "${attempt_timeout}" \
+      -H "Host: ${host_header}" \
+      -H "Authorization: Bearer ${SUBSTRATE_BOOTSTRAP_TOKEN}" \
+      -H "Content-Type: application/json" \
+      -X PUT \
+      -d "{\"files\":[{\"path\":\"/app/orka-workspace-handoff-token\",\"data\":\"${token_b64}\",\"mode\":384}]}" \
+      "${url}" >/dev/null 2>&1; then
+      return 0
+    fi
+    now="$(date +%s)"
+    if (( now - started >= timeout_seconds )); then
+      echo "timed out installing workspace handoff token via Host ${host_header}" >&2
+      return 1
+    fi
+    sleep 2
+  done
+}
+
+run_idempotent_workspace_exec() {
+  local url="$1"
+  local host_header="$2"
+  local handoff_token="$3"
+  local request_id="$4"
+  local timeout_seconds="$5"
+  local started now remaining attempt_timeout response
+  started="$(date +%s)"
+
+  while true; do
+    now="$(date +%s)"
+    remaining=$((timeout_seconds - (now - started)))
+    if (( remaining <= 0 )); then
+      echo "timed out executing idempotent workspace probe via Host ${host_header}" >&2
+      return 1
+    fi
+    attempt_timeout="${remaining}"
+    if (( attempt_timeout > 5 )); then
+      attempt_timeout=5
+    fi
+    # This exact command is deliberately idempotent. Retry only the live
+    # routing probe, never arbitrary user commands, while a replacement
+    # worker's Envoy upstream converges.
+    if response="$(curl -fsS \
+      --connect-timeout "${attempt_timeout}" \
+      --max-time "${attempt_timeout}" \
+      -H "Host: ${host_header}" \
+      -H "Authorization: Bearer ${handoff_token}" \
+      -H "X-Request-ID: ${request_id}" \
+      -H "Content-Type: application/json" \
+      -d '{"command":["/bin/sh","-lc","printf direct-ok"]}' \
+      "${url}" 2>/dev/null)"; then
+      printf '%s\n' "${response}"
+      return 0
+    fi
+    now="$(date +%s)"
+    if (( now - started >= timeout_seconds )); then
+      echo "timed out executing idempotent workspace probe via Host ${host_header}" >&2
+      return 1
+    fi
+    sleep 2
+  done
+}
+
+verify_router_request_metadata_allowlist() {
+  local handoff_token="$1"
+  local request_id="$2"
+  local timeout_seconds="${3:-30}"
+  local started now raw_log_file
+  started="$(date +%s)"
+  raw_log_file="${TMP_ROOT}/atenet-router-raw-${request_id}.log"
+
+  while true; do
+    # Keep the provider output private and inspect it before any presentation
+    # redaction. Otherwise the test could erase the exact token leak it is meant
+    # to detect and then falsely pass on the safe request-ID evidence.
+    kubectl -n ate-system logs deployment/atenet-router --all-containers --since=2m       >"${raw_log_file}" 2>/dev/null || :
+    if grep -Fq -- "${SUBSTRATE_BOOTSTRAP_TOKEN}" "${raw_log_file}" ||
+       grep -Fq -- "${handoff_token}" "${raw_log_file}"; then
+      echo "atenet-router leaked an Authorization credential in its logs" >&2
+      grep -F -- "${request_id}" "${raw_log_file}" | redact >&2 || true
+      return 1
+    fi
+    if grep -Fq -- "${request_id}" "${raw_log_file}"; then
+      log "atenet-router logs retain the safe request ID while omitting request credentials"
+      return 0
+    fi
+    now="$(date +%s)"
+    if (( now - started > timeout_seconds )); then
+      echo "timed out waiting for atenet-router request-metadata allowlist evidence" >&2
+      return 1
+    fi
+    sleep 2
+  done
+}
+
+run_direct_actor_lifecycle() {
+  local actor_name="$1"
   local host_header="${actor_name}.actors.resources.substrate.ate.dev"
-  local token token_b64 response
+  local token token_b64 request_id response
 
-  log "Running direct Substrate workspace-agent smoke"
   kubectl_ate create actor "${actor_name}" --template ate-demo/orka-codex-ci
   kubectl_ate resume actor "${actor_name}"
-
-  kubectl -n ate-system port-forward svc/atenet-router 18082:80 >/tmp/orka-atenet-router-port-forward.log 2>&1 &
-  PORT_FORWARD_PID="$!"
-  sleep 3
-
+  wait_actor_status "${actor_name}" "STATUS_RUNNING" 300
   wait_http_ok "http://127.0.0.1:18082/healthz" "${host_header}" "" 300
-  token="$(printf 'ci-token-%s' "$(date +%s%N)")"
+
+  printf -v token 'ci-token-%s' "$(date +%s%N)"
   token_b64="$(printf '%s' "${token}" | base64 | tr -d '\n')"
-  curl -fsS \
-    -H "Host: ${host_header}" \
-    -H "Authorization: Bearer ${SUBSTRATE_BOOTSTRAP_TOKEN}" \
-    -H "Content-Type: application/json" \
-    -X PUT \
-    -d "{\"files\":[{\"path\":\"/app/orka-workspace-handoff-token\",\"data\":\"${token_b64}\",\"mode\":384}]}" \
-    "http://127.0.0.1:18082/v1/files" >/dev/null
+  write_workspace_handoff_token "http://127.0.0.1:18082/v1/files" "${host_header}" "${token_b64}" 60
 
   wait_http_ok "http://127.0.0.1:18082/healthz" "${host_header}" "Authorization: Bearer ${token}" 60
-  response="$(curl -fsS \
-    -H "Host: ${host_header}" \
-    -H "Authorization: Bearer ${token}" \
-    -H "Content-Type: application/json" \
-    -d '{"command":["/bin/sh","-lc","printf direct-ok"]}' \
-    "http://127.0.0.1:18082/v1/exec")"
-  if [[ "$(jq -r '.exitCode' <<<"${response}")" != "0" || "$(jq -r '.stdout' <<<"${response}")" != "direct-ok" ]]; then
-    echo "unexpected direct exec response" >&2
-    jq -c '{exitCode,stdout,stderr}' <<<"${response}" | redact >&2
-    exit 1
+  printf -v request_id 'orka-router-log-%s' "$(date +%s%N)"
+  response="$(run_idempotent_workspace_exec \
+    "http://127.0.0.1:18082/v1/exec" "${host_header}" "${token}" "${request_id}" 60)"
+  if [[ "$(jq -r '.exitCode' <<< "${response}")" != "0" || "$(jq -r '.stdout' <<< "${response}")" != "direct-ok" ]]; then
+    echo "unexpected direct exec response for actor/${actor_name}" >&2
+    jq -c '{exitCode,stdout,stderr}' <<< "${response}" | redact >&2
+    return 1
   fi
+  verify_router_request_metadata_allowlist "${token}" "${request_id}" 30
 
   kubectl_ate suspend actor "${actor_name}"
   wait_actor_status "${actor_name}" "STATUS_SUSPENDED" 300
   kubectl_ate delete actor "${actor_name}"
+  wait_actor_absent "${actor_name}" 120
+}
+
+# The ateom image is distroless, so the live fault injector must be a static
+# executable rather than a shell wrapper. It fails one delete before delegating
+# every later invocation to the checksum-verified runsc binary beside it.
+build_runsc_delete_failure_injector() {
+  local output_path="$1"
+  local architecture="$2"
+  local target_os="${3:-linux}"
+  local source_path="${TMP_ROOT}/runsc-delete-failure-injector.go"
+
+  cat >"${source_path}" <<'GO'
+package main
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"syscall"
+)
+
+func main() {
+	executable, err := os.Executable()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "resolve runsc injector path: %v\n", err)
+		os.Exit(87)
+	}
+
+	isDelete := false
+	for _, arg := range os.Args[1:] {
+		if arg == "delete" {
+			isDelete = true
+			break
+		}
+	}
+	if isDelete {
+		marker := executable + ".orka-delete-failure-observed"
+		file, markerErr := os.OpenFile(marker, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o600)
+		if markerErr == nil {
+			_ = file.Close()
+			fmt.Fprintln(os.Stderr, "injected one runsc delete failure before container removal")
+			os.Exit(86)
+		}
+		if !errors.Is(markerErr, os.ErrExist) {
+			fmt.Fprintf(os.Stderr, "create runsc delete injection marker: %v\n", markerErr)
+			os.Exit(87)
+		}
+	}
+
+	realPath := executable + ".orka-real"
+	argv := append([]string{realPath}, os.Args[1:]...)
+	if err := syscall.Exec(realPath, argv, os.Environ()); err != nil {
+		fmt.Fprintf(os.Stderr, "exec real runsc: %v\n", err)
+		os.Exit(87)
+	}
+}
+GO
+
+  CGO_ENABLED=0 GOOS="${target_os}" GOARCH="${architecture}" go build -trimpath -o "${output_path}" "${source_path}"
+}
+
+install_runsc_delete_failure_injector() {
+  local worker_name="$1"
+  local node architecture runsc_hash runsc_path injector_path node_injector_path
+
+  node="$(kubectl -n ate-demo get pod "${worker_name}" -o jsonpath='{.spec.nodeName}')"
+  architecture="$(kubectl get node "${node}" -o jsonpath='{.status.nodeInfo.architecture}')"
+  case "${architecture}" in
+    amd64 | arm64) ;;
+    *)
+      echo "unsupported kind node architecture for runsc delete injection: ${architecture:-<empty>}" >&2
+      return 1
+      ;;
+  esac
+  runsc_hash="$(kubectl -n ate-demo get actortemplate orka-codex-ci -o "jsonpath={.spec.runsc.${architecture}.sha256Hash}")"
+  if [[ -z "${node}" || -z "${runsc_hash}" ]]; then
+    echo "could not resolve the assigned worker node or runsc digest for delete injection" >&2
+    return 1
+  fi
+
+  runsc_path="/run/ateom-gvisor/static-files/runsc-${runsc_hash}"
+  injector_path="${TMP_ROOT}/runsc-delete-failure-injector-${architecture}"
+  node_injector_path="/root/orka-runsc-delete-failure-injector-$$-${RANDOM}"
+  build_runsc_delete_failure_injector "${injector_path}" "${architecture}"
+  docker cp "${injector_path}" "${node}:${node_injector_path}"
+
+  RUNSC_DELETE_INJECTION_NODE="${node}"
+  RUNSC_DELETE_INJECTION_PATH="${runsc_path}"
+  if ! docker exec "${node}" /bin/sh -ceu '
+    path="$1"
+    incoming="$2"
+    test -f "${path}"
+    test ! -e "${path}.orka-real"
+    rm -f "${path}.orka-delete-failure-observed"
+    mv "${path}" "${path}.orka-real"
+    if ! cp "${incoming}" "${path}" || ! chmod 0755 "${path}"; then
+      rm -f "${path}"
+      mv "${path}.orka-real" "${path}"
+      rm -f "${incoming}"
+      exit 1
+    fi
+    rm -f "${incoming}"
+  ' sh "${runsc_path}" "${node_injector_path}"; then
+    restore_runsc_delete_injector >/dev/null 2>&1 || true
+    return 1
+  fi
+}
+
+runsc_delete_failure_was_injected() {
+  [[ -n "${RUNSC_DELETE_INJECTION_NODE}" && -n "${RUNSC_DELETE_INJECTION_PATH}" ]] || return 1
+  docker exec "${RUNSC_DELETE_INJECTION_NODE}" /bin/sh -ceu \
+    'test -f "${1}.orka-delete-failure-observed"' sh "${RUNSC_DELETE_INJECTION_PATH}"
+}
+
+exercise_runsc_delete_retry_recovery() {
+  local actor_name="orka-delete-retry-ci"
+  local host_header="${actor_name}.actors.resources.substrate.ate.dev"
+  local actor_json worker_name worker_logs
+
+  log "Validating an injected runsc delete failure is retried on the live worker"
+  kubectl_ate create actor "${actor_name}" --template ate-demo/orka-codex-ci
+  kubectl_ate resume actor "${actor_name}"
+  wait_actor_status "${actor_name}" "STATUS_RUNNING" 300
+  wait_http_ok "http://127.0.0.1:18082/healthz" "${host_header}" "" 300
+
+  actor_json="$(kubectl_ate get actor "${actor_name}" -o json)"
+  worker_name="$(jq -r '.actors[0].ateomPodName // empty' <<<"${actor_json}")"
+  if [[ -z "${worker_name}" ]]; then
+    echo "actor/${actor_name} did not expose its assigned worker before delete injection" >&2
+    return 1
+  fi
+
+  install_runsc_delete_failure_injector "${worker_name}"
+  kubectl_ate suspend actor "${actor_name}"
+  wait_actor_status "${actor_name}" "STATUS_SUSPENDED" 300
+  if ! runsc_delete_failure_was_injected; then
+    restore_runsc_delete_injector >/dev/null 2>&1 || true
+    echo "runsc delete failure injector was not invoked for actor/${actor_name}" >&2
+    return 1
+  fi
+  restore_runsc_delete_injector
+
+  worker_logs="$(kubectl -n ate-demo logs "pod/${worker_name}" -c ateom --since=5m 2>&1)"
+  if ! grep -Fq 'runsc delete did not remove the container; retrying' <<<"${worker_logs}"; then
+    echo "actor/${actor_name} suspended without live evidence from the patched runsc delete retry path" >&2
+    return 1
+  fi
+  log "actor/${actor_name}: observed injected failure, verified-presence retry, and successful suspension"
+
+  kubectl -n ate-demo wait --for=condition=Ready "pod/${worker_name}" --timeout=2m
+  kubectl_ate delete actor "${actor_name}"
+  wait_actor_absent "${actor_name}" 120
+
+  # A fresh lifecycle after restoring the original binary proves that cleanup
+  # left the worker fleet routable rather than merely settling actor metadata.
+  run_direct_actor_lifecycle "orka-post-delete-retry-ci"
+  assert_no_suspending_actors
+}
+
+exercise_worker_replacement_recovery() {
+  local actor_name="orka-worker-loss-ci"
+  local host_header="${actor_name}.actors.resources.substrate.ate.dev"
+  local actor_json worker_name replacement_name
+
+  log "Validating worker-loss settlement and post-replacement direct routing"
+  kubectl_ate create actor "${actor_name}" --template ate-demo/orka-codex-ci
+  kubectl_ate resume actor "${actor_name}"
+  wait_actor_status "${actor_name}" "STATUS_RUNNING" 300
+  wait_http_ok "http://127.0.0.1:18082/healthz" "${host_header}" "" 300
+
+  actor_json="$(kubectl_ate get actor "${actor_name}" -o json)"
+  worker_name="$(jq -r '.actors[0].ateomPodName // empty' <<< "${actor_json}")"
+  if [[ -z "${worker_name}" ]]; then
+    echo "actor/${actor_name} did not expose its assigned worker before replacement" >&2
+    return 1
+  fi
+
+  kubectl -n ate-demo delete pod "${worker_name}" --wait=true
+  wait_worker_absent "${worker_name}" 120
+  kubectl -n ate-demo rollout status deployment/orka-workers-deployment --timeout=5m
+  wait_worker_count_at_least 3 180
+
+  kubectl_ate suspend actor "${actor_name}"
+  wait_actor_status "${actor_name}" "STATUS_SUSPENDED" 120
+  kubectl_ate delete actor "${actor_name}"
+  wait_actor_absent "${actor_name}" 120
+
+  replacement_name="orka-post-worker-loss-ci"
+  run_direct_actor_lifecycle "${replacement_name}"
+
+  # The dangling-worker path above cannot invoke CheckpointWorkload because the
+  # assigned Pod is gone. Inject one live runsc failure on the replacement fleet
+  # so the extended E2E proves the reviewed retry and verified-absence path.
+  exercise_runsc_delete_retry_recovery
+  assert_no_suspending_actors
+}
+
+exercise_direct_substrate() {
+  log "Running direct Substrate workspace-agent smoke"
+  kubectl -n ate-system port-forward svc/atenet-router 18082:80 >/tmp/orka-atenet-router-port-forward.log 2>&1 &
+  PORT_FORWARD_PID="$!"
+  sleep 3
+
+  run_direct_actor_lifecycle "orka-direct-ci"
+  if [[ "${SUBSTRATE_E2E_EXTENDED}" == "1" ]]; then
+    exercise_worker_replacement_recovery
+  fi
 
   kill "${PORT_FORWARD_PID}" >/dev/null 2>&1 || true
   PORT_FORWARD_PID=""
@@ -1221,6 +1711,10 @@ main() {
   require_command kind
   require_command ko
   require_command kubectl
+  [[ "${ORKA_NAMESPACE}" == "orka-system" ]] || {
+    echo "ORKA_NAMESPACE must be orka-system for the canonical config/acp-workload deployment" >&2
+    exit 1
+  }
 
   TMP_ROOT="$(mktemp -d)"
   export KUBECONFIG="${TMP_ROOT}/kubeconfig"
@@ -1232,6 +1726,9 @@ main() {
   git clone --quiet "${SUBSTRATE_REPO}" "${SUBSTRATE_DIR}"
   git -C "${SUBSTRATE_DIR}" checkout --quiet "${SUBSTRATE_REF}"
   apply_substrate_workspace_agent_capability_patch
+  apply_substrate_atenet_authorization_redaction_patch
+  apply_substrate_ateom_delete_recovery_patch
+  verify_reviewed_substrate_patch_set
   patch_substrate_kind_registry_script
 
   log "Creating kind cluster and installing Substrate"
@@ -1252,7 +1749,7 @@ main() {
   log "Building kubectl-ate"
   (cd "${SUBSTRATE_DIR}" && go build -o "${TMP_ROOT}/kubectl-ate" ./cmd/kubectl-ate)
 
-  local registry_ip registry_addr controller_image codex_image workspace_push_image workspace_actor_image mcp_push_image mcp_actor_image tool_client_image ateom_image
+  local registry_ip registry_addr controller_image workspace_push_image workspace_actor_image mcp_push_image mcp_actor_image tool_client_image ateom_image
   registry_ip="$(docker inspect -f '{{with index .NetworkSettings.Networks "kind"}}{{.IPAddress}}{{end}}' "${KIND_REGISTRY_NAME}")"
   if [[ -z "${registry_ip}" ]]; then
     registry_ip="$(docker inspect -f '{{range .NetworkSettings.Networks}}{{println .IPAddress}}{{end}}' "${KIND_REGISTRY_NAME}" | head -n1)"
@@ -1263,7 +1760,6 @@ main() {
   fi
   registry_addr="localhost:${KIND_REGISTRY_PORT}"
   controller_image="${registry_addr}/orka/controller:${IMAGE_TAG}"
-  codex_image="${registry_addr}/orka/agent-harness-wrapper:${IMAGE_TAG}"
   workspace_push_image="${registry_addr}/orka/workspace-agent-root:${IMAGE_TAG}"
   workspace_actor_image="${registry_ip}:5000/orka/workspace-agent-root:${IMAGE_TAG}"
   mcp_push_image="${registry_addr}/orka/mcp-e2e-server:${IMAGE_TAG}"
@@ -1272,12 +1768,10 @@ main() {
 
   log "Building and pushing Orka images"
   docker build -t "${controller_image}" -f "${ROOT_DIR}/Dockerfile" "${ROOT_DIR}"
-  docker build -t "${codex_image}" -f "${ROOT_DIR}/workers/harness/Dockerfile" "${ROOT_DIR}"
   docker build -t "${workspace_push_image}" -f "${ROOT_DIR}/cmd/orka-workspace-agent/Dockerfile" "${ROOT_DIR}"
   docker build -t "${mcp_push_image}" -f "${ROOT_DIR}/cmd/orka-mcp-e2e-server/Dockerfile" "${ROOT_DIR}"
   docker build -t "${tool_client_image}" -f "${ROOT_DIR}/cmd/orka-tool-e2e-client/Dockerfile" "${ROOT_DIR}"
   docker push "${controller_image}"
-  docker push "${codex_image}"
   docker push "${workspace_push_image}"
   docker push "${mcp_push_image}"
   docker push "${tool_client_image}"
@@ -1285,11 +1779,14 @@ main() {
   log "Publishing Substrate ateom-gvisor image"
   ateom_image="$(publish_ateom_image)"
   create_substrate_resources "${ateom_image}" "${workspace_actor_image}" "${mcp_actor_image}"
-  deploy_orka "${controller_image}" "${codex_image}"
+  deploy_orka "${controller_image}"
   exercise_direct_substrate
   exercise_orka_tasks "${tool_client_image}"
+  assert_no_suspending_actors
 
   log "Agent Substrate E2E passed"
 }
 
-main "$@"
+if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
+  main "$@"
+fi
diff --git a/scripts/apply-acp-production.sh b/scripts/apply-acp-production.sh
new file mode 100755
index 000000000..bc21b18cc
--- /dev/null
+++ b/scripts/apply-acp-production.sh
@@ -0,0 +1,582 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+
+usage() {
+  echo "Usage: $0 OVERLAY_DIR KUSTOMIZE KUBECTL" >&2
+}
+
+[[ $# -eq 3 ]] || {
+  usage
+  exit 2
+}
+
+overlay_dir="$1"
+kustomize="$2"
+kubectl="$3"
+
+for command in "${kustomize}" "${kubectl}" base64 cmp curl dd jq openssl sleep tr wc; do
+  command -v "${command}" >/dev/null 2>&1 || {
+    echo "required command not found: ${command}" >&2
+    exit 1
+  }
+done
+[[ -d "${overlay_dir}" && ! -L "${overlay_dir}" ]] || {
+  echo "ACP production overlay must be a real directory: ${overlay_dir}" >&2
+  exit 1
+}
+admission_webhooks_dir="${overlay_dir}/../orka-admission-webhooks"
+[[ -d "${admission_webhooks_dir}" && ! -L "${admission_webhooks_dir}" ]] || {
+  echo "admission webhook base must be a real sibling directory: ${admission_webhooks_dir}" >&2
+  exit 1
+}
+
+work_dir="$(mktemp -d "${TMPDIR:-/tmp}/apply-acp-production.XXXXXX")"
+admission_proxy_pid=""
+stop_admission_proxy() {
+  if [[ -n "${admission_proxy_pid}" ]]; then
+    kill "${admission_proxy_pid}" 2>/dev/null || true
+    wait "${admission_proxy_pid}" 2>/dev/null || true
+    admission_proxy_pid=""
+  fi
+}
+cleanup() {
+  stop_admission_proxy
+  rm -rf "${work_dir}"
+}
+trap cleanup EXIT
+
+manifest="${work_dir}/manifest.yaml"
+rendered_json="${work_dir}/rendered.json"
+namespace_resource="${work_dir}/namespace.json"
+namespace_metadata_patch="${work_dir}/namespace-metadata-patch.json"
+existing_namespace="${work_dir}/existing-namespace.json"
+existing_controller="${work_dir}/existing-controller.json"
+runtime_config="${work_dir}/runtime-images-configmap.json"
+admission_runtime_manifest="${work_dir}/admission-runtime-manifest.json"
+workload_manifest="${work_dir}/workload-manifest.json"
+workload_prerequisite_manifest="${work_dir}/workload-prerequisite-manifest.json"
+controller_manifest="${work_dir}/controller-manifest.json"
+workload_dependency_endpoints="${work_dir}/workload-dependency-endpoints.json"
+snapshot_secret="${work_dir}/agent-execution-snapshot-key.json"
+snapshot_key="${work_dir}/snapshot-key"
+snapshot_key_data="${work_dir}/snapshot-key-data"
+snapshot_key_encoded="${work_dir}/snapshot-key-encoded"
+snapshot_key_decoded="${work_dir}/snapshot-key-decoded"
+admission_tls_secret="${work_dir}/orka-admission-tls.json"
+admission_tls_cert="${work_dir}/orka-admission-tls.crt"
+admission_tls_key="${work_dir}/orka-admission-tls.key"
+admission_ca_cert="${work_dir}/orka-admission-ca.crt"
+admission_tls_cert_public_key="${work_dir}/orka-admission-tls-cert.pub"
+admission_tls_key_public_key="${work_dir}/orka-admission-tls-key.pub"
+admission_endpoints="${work_dir}/orka-admission-endpoints.json"
+admission_webhooks_source="${work_dir}/orka-admission-webhooks.yaml"
+admission_webhooks_rendered="${work_dir}/orka-admission-webhooks-rendered.json"
+admission_webhooks_manifest="${work_dir}/orka-admission-webhooks.json"
+admission_smoke_request="${work_dir}/orka-admission-smoke-request.json"
+admission_smoke_response="${work_dir}/orka-admission-smoke-response.json"
+admission_proxy_log="${work_dir}/kubectl-proxy.log"
+admission_proxy_port=""
+"${kustomize}" build "${overlay_dir}" >"${manifest}"
+"${kubectl}" create --dry-run=client --validate=false -f "${manifest}" -o json >"${rendered_json}"
+"${kustomize}" build "${admission_webhooks_dir}" >"${admission_webhooks_source}"
+"${kubectl}" create --dry-run=client --validate=false -f "${admission_webhooks_source}" -o json >"${admission_webhooks_rendered}"
+
+jq -sc '
+  [.[] | if .kind == "List" then .items[] else . end]
+  | map(select(.kind == "Namespace" and .metadata.name == "orka-system"))
+  | if length == 1 and .[0].metadata.labels["orka.ai/controller-mode"] == "harness-v2"
+    then .[0]
+    else error("expected exactly one orka-system Namespace claimed by harness-v2")
+    end
+' "${rendered_json}" >"${namespace_resource}"
+jq -e '
+  def json_pointer_escape: gsub("~"; "~0") | gsub("/"; "~1");
+  .metadata.labels as $labels
+  | if ($labels | type) != "object" or $labels["orka.ai/controller-mode"] != "harness-v2"
+    then error("namespace metadata patch requires the harness-v2 mode claim")
+    else [
+      {
+        op: "test",
+        path: "/metadata/labels/orka.ai~1controller-mode",
+        value: "harness-v2"
+      },
+      ($labels | to_entries[]
+        | select(.key != "orka.ai/controller-mode")
+        | {
+            op: "add",
+            path: ("/metadata/labels/" + (.key | json_pointer_escape)),
+            value: .value
+          })
+    ]
+    end
+' "${namespace_resource}" >"${namespace_metadata_patch}"
+jq -sc '
+  [.[] | if .kind == "List" then .items[] else . end]
+  | map(select(.kind == "ConfigMap" and .metadata.labels["orka.ai/acp-runtime-images"] == "true"))
+  | if length == 1 then .[0] else error("expected exactly one generated ACP runtime image ConfigMap") end
+' "${rendered_json}" >"${runtime_config}"
+jq -sc '
+  [.[] | if .kind == "List" then .items[] else . end]
+  | {
+      apiVersion: "v1",
+      kind: "List",
+      items: map(select(.metadata.labels["app.kubernetes.io/component"] == "admission"))
+    }
+' "${rendered_json}" >"${admission_runtime_manifest}"
+jq -sc '
+  [.[] | if .kind == "List" then .items[] else . end]
+  | {
+      apiVersion: "v1",
+      kind: "List",
+      items: map(select(
+        .metadata.labels["app.kubernetes.io/component"] != "admission" and
+        (.kind != "Namespace" or .metadata.name != "orka-system") and
+        (.kind != "ConfigMap" or .metadata.labels["orka.ai/acp-runtime-images"] != "true")
+      ))
+    }
+' "${rendered_json}" >"${workload_manifest}"
+jq '
+  {
+    apiVersion: "v1",
+    kind: "List",
+    items: [.items[] | select((
+      .apiVersion == "apps/v1" and
+      .kind == "Deployment" and
+      .metadata.namespace == "orka-system" and
+      .metadata.name == "orka-controller-manager"
+    ) | not)]
+  }
+' "${workload_manifest}" >"${workload_prerequisite_manifest}"
+jq '
+  [.items[] | select(
+    .apiVersion == "apps/v1" and
+    .kind == "Deployment" and
+    .metadata.namespace == "orka-system" and
+    .metadata.name == "orka-controller-manager"
+  )]
+  | if length == 1 then
+      {apiVersion: "v1", kind: "List", items: .}
+    else
+      error("expected exactly one harness-v2 controller Deployment")
+    end
+' "${workload_manifest}" >"${controller_manifest}"
+jq -e '
+  ([.items[] | select(
+    .apiVersion == "apps/v1" and
+    .kind == "Deployment" and
+    .metadata.namespace == "orka-system" and
+    (.metadata.name == "orka-provider-auth-proxy" or
+     .metadata.name == "orka-scm-egress-proxy" or
+     .metadata.name == "orka-workspace-publisher")
+  ) | .metadata.name] | sort) == [
+    "orka-provider-auth-proxy",
+    "orka-scm-egress-proxy",
+    "orka-workspace-publisher"
+  ] and
+  ([.items[] | select(
+    .apiVersion == "apps/v1" and
+    .kind == "Deployment" and
+    .metadata.namespace == "orka-system" and
+    .metadata.name == "orka-controller-manager"
+  )] | length) == 0
+' "${workload_prerequisite_manifest}" >/dev/null || {
+  echo "workload prerequisite wave must contain each publisher/proxy Deployment exactly once and no controller Deployment" >&2
+  exit 1
+}
+jq -esc '
+  [.[] | if .kind == "List" then .items[] else . end] as $items
+  | ($items | map(select(.apiVersion == "apps/v1" and .kind == "Deployment" and
+      .metadata.namespace == "orka-system" and .metadata.name == "orka-controller-manager"))) as $controllers
+  | ($items | map(select(.apiVersion == "apps/v1" and .kind == "Deployment" and
+      .metadata.namespace == "orka-system" and .metadata.name == "orka-admission"))) as $deployments
+  | ($items | map(select(.apiVersion == "v1" and .kind == "Service" and
+      .metadata.namespace == "orka-system" and .metadata.name == "orka-admission"))) as $services
+  | ($controllers[0].spec.template.spec.containers[]? | select(.name == "manager") | .args) as $args
+  | ($controllers | length) == 1 and
+    ($controllers[0].spec.template.spec.containers | map(select(.name == "manager")) | length) == 1 and
+    ([$args[] | select(startswith("--controller-mode="))] | length) == 1 and
+    ([$args[] | select(. == "--controller-mode=harness-v2")] | length) == 1 and
+    ([$args[] | select(startswith("--watch-namespace="))] | length) == 1 and
+    ([$args[] | select(. == "--watch-namespace=orka-system")] | length) == 1 and
+    ([$args[] | select(. == "--leader-elect" or . == "--leader-elect=true")] | length) == 1 and
+    ([$args[] | select(startswith("--harness-v1-"))] | length) == 0 and
+    ($controllers[0].spec.template.spec.containers | any(
+      .name == "manager" and
+      (.image | test("@sha256:[a-f0-9]{64}$"))
+    )) and
+    ($items | map(select(
+      .metadata.labels["app.kubernetes.io/component"] == "agent-harness-wrapper" or
+      (.kind == "Deployment" and (.metadata.name | endswith("agent-harness-wrapper")))
+    )) | length) == 0 and
+    ($deployments | length) == 1 and
+    ($services | length) == 1 and
+    ($deployments[0].spec.replicas >= 2) and
+    ($deployments[0].spec.strategy.type == "RollingUpdate") and
+    ($deployments[0].spec.strategy.rollingUpdate.maxUnavailable == 0) and
+    ($deployments[0].spec.template.spec.containers | any(
+      .name == "admission" and
+      (.image | test("@sha256:[a-f0-9]{64}$"))
+    ))
+' "${rendered_json}" >/dev/null || {
+  echo "production overlay must contain one digest-pinned static harness-v2 controller, no v1 wrapper path, and one digest-pinned, zero-unavailable, replicated orka-admission runtime and Service" >&2
+  exit 1
+}
+
+validate_existing_controller_identity() {
+  : >"${existing_namespace}"
+  if ! "${kubectl}" get namespace orka-system --ignore-not-found -o json >"${existing_namespace}"; then
+    echo "unable to inspect the existing orka-system Namespace" >&2
+    return 1
+  fi
+  : >"${existing_controller}"
+  if ! "${kubectl}" -n orka-system get deployment orka-controller-manager \
+    --ignore-not-found -o json >"${existing_controller}"; then
+    echo "unable to inspect the existing orka-system/orka-controller-manager Deployment" >&2
+    return 1
+  fi
+
+  if [[ ! -s "${existing_namespace}" && ! -s "${existing_controller}" ]]; then
+    return 0
+  fi
+  if [[ ! -s "${existing_namespace}" ]] || ! jq -e '
+    .apiVersion == "v1" and
+    .kind == "Namespace" and
+    .metadata.name == "orka-system" and
+    .metadata.labels["orka.ai/controller-mode"] == "harness-v2"
+  ' "${existing_namespace}" >/dev/null; then
+    echo "existing namespace orka-system must already claim orka.ai/controller-mode=harness-v2; unlabeled, implicit, legacy, or opposite-mode namespaces cannot be adopted in place" >&2
+    return 1
+  fi
+  [[ -s "${existing_controller}" ]] || return 0
+
+  if ! jq -e '
+    .apiVersion == "apps/v1" and
+    .kind == "Deployment" and
+    .metadata.namespace == "orka-system" and
+    .metadata.name == "orka-controller-manager" and
+    ([.spec.template.spec.containers[] | select(.name == "manager")] | length) == 1 and
+    ([.spec.template.spec.containers[] | select(.name == "manager") | .args[]? |
+      select(startswith("--controller-mode="))] == ["--controller-mode=harness-v2"]) and
+    ([.spec.template.spec.containers[] | select(.name == "manager") | .args[]? |
+      select(startswith("--watch-namespace="))] == ["--watch-namespace=orka-system"])
+  ' "${existing_controller}" >/dev/null; then
+    echo "implicit, legacy, differently scoped, or opposite-mode controllers cannot be upgraded in place; settle or retire the existing installation and deploy harness-v2 in a fresh namespace" >&2
+    return 1
+  fi
+}
+
+validate_snapshot_secret() {
+  if ! jq -er '.data["snapshot-key"] | select(type == "string" and length > 0)' "${snapshot_secret}" \
+    | base64 -d >"${snapshot_key_data}" 2>/dev/null; then
+    echo "agent-execution-snapshot-key Secret must contain snapshot-key" >&2
+    return 1
+  fi
+
+  local encoded_key key_size
+  key_size="$(wc -c <"${snapshot_key_data}" | tr -d '[:space:]')"
+  if [[ "${key_size}" == "32" ]]; then
+    return 0
+  fi
+
+  # Match the controller parser: raw input is accepted only at exactly 32
+  # bytes. Otherwise trim surrounding whitespace from base64 text, while
+  # retaining Go's allowance for embedded CR/LF line wrapping.
+  encoded_key="$(<"${snapshot_key_data}")"
+  while [[ -n "${encoded_key}" && "${encoded_key}" == [[:space:]]* ]]; do
+    encoded_key="${encoded_key:1}"
+  done
+  while [[ -n "${encoded_key}" && "${encoded_key}" == *[[:space:]] ]]; do
+    encoded_key="${encoded_key:0:${#encoded_key}-1}"
+  done
+  encoded_key="${encoded_key//$'\r'/}"
+  encoded_key="${encoded_key//$'\n'/}"
+  if [[ "${encoded_key}" =~ ^[A-Za-z0-9+/]{43}=$ ]]; then
+    printf '%s' "${encoded_key}" >"${snapshot_key_encoded}"
+  else
+    : >"${snapshot_key_encoded}"
+  fi
+  if [[ "$(wc -c <"${snapshot_key_encoded}" | tr -d '[:space:]')" == "44" ]] \
+    && base64 -d <"${snapshot_key_encoded}" >"${snapshot_key_decoded}" 2>/dev/null \
+    && [[ "$(wc -c <"${snapshot_key_decoded}" | tr -d '[:space:]')" == "32" ]]; then
+    return 0
+  fi
+
+  echo "agent-execution-snapshot-key/snapshot-key must contain exactly 32 raw bytes or their base64 encoding" >&2
+  return 1
+}
+
+ensure_snapshot_secret() {
+  if ! "${kubectl}" -n orka-system get secret agent-execution-snapshot-key --ignore-not-found -o json >"${snapshot_secret}"; then
+    echo "unable to inspect orka-system/agent-execution-snapshot-key" >&2
+    return 1
+  fi
+  if [[ ! -s "${snapshot_secret}" ]]; then
+    umask 077
+    dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d '\r\n' >"${snapshot_key}"
+    "${kubectl}" -n orka-system create secret generic agent-execution-snapshot-key \
+      --from-file="snapshot-key=${snapshot_key}" >/dev/null
+    "${kubectl}" -n orka-system get secret agent-execution-snapshot-key -o json >"${snapshot_secret}"
+  fi
+  validate_snapshot_secret
+}
+
+validate_admission_tls_secret() {
+  local service_dns="orka-admission.orka-system.svc"
+  if ! "${kubectl}" -n orka-system get secret orka-admission-tls -o json >"${admission_tls_secret}"; then
+    echo "orka-system/orka-admission-tls is required before admission rollout" >&2
+    return 1
+  fi
+  if ! jq -e '
+    .type == "kubernetes.io/tls" and
+    (.data["tls.crt"] | type == "string" and length > 0) and
+    (.data["tls.key"] | type == "string" and length > 0) and
+    (.data["ca.crt"] | type == "string" and length > 0)
+  ' "${admission_tls_secret}" >/dev/null; then
+    echo "orka-system/orka-admission-tls must be a TLS Secret containing tls.crt, tls.key, and ca.crt" >&2
+    return 1
+  fi
+  local key output san_extension
+  for key in tls.crt tls.key ca.crt; do
+    case "${key}" in
+      tls.crt) output="${admission_tls_cert}" ;;
+      tls.key) output="${admission_tls_key}" ;;
+      ca.crt) output="${admission_ca_cert}" ;;
+    esac
+    if ! jq -er --arg key "${key}" '.data[$key]' "${admission_tls_secret}" \
+      | base64 -d >"${output}" 2>/dev/null || [[ ! -s "${output}" ]]; then
+      echo "orka-system/orka-admission-tls contains invalid ${key} data" >&2
+      return 1
+    fi
+  done
+
+  if ! openssl x509 -in "${admission_tls_cert}" -noout >/dev/null 2>&1 \
+    || ! openssl pkey -in "${admission_tls_key}" -passin pass: -noout >/dev/null 2>&1 \
+    || ! openssl x509 -in "${admission_ca_cert}" -noout >/dev/null 2>&1; then
+    echo "orka-system/orka-admission-tls must contain parseable PEM certificate, private-key, and CA material" >&2
+    return 1
+  fi
+  if ! openssl x509 -in "${admission_tls_cert}" -pubkey -noout \
+      >"${admission_tls_cert_public_key}" 2>/dev/null \
+    || ! openssl pkey -in "${admission_tls_key}" -passin pass: -pubout \
+      >"${admission_tls_key_public_key}" 2>/dev/null \
+    || ! cmp -s "${admission_tls_cert_public_key}" "${admission_tls_key_public_key}"; then
+    echo "orka-system/orka-admission-tls tls.crt and tls.key do not form a key pair" >&2
+    return 1
+  fi
+  if ! san_extension="$(openssl x509 -in "${admission_tls_cert}" -noout -ext subjectAltName 2>/dev/null)" \
+    || [[ "${san_extension}" != *"X509v3 Subject Alternative Name"* ]] \
+    || ! openssl x509 -in "${admission_tls_cert}" -noout -checkhost "${service_dns}" >/dev/null 2>&1; then
+    echo "orka-system/orka-admission-tls tls.crt must contain a subjectAltName for ${service_dns}" >&2
+    return 1
+  fi
+  if ! openssl verify -x509_strict -purpose sslserver -verify_hostname "${service_dns}" \
+      -CAfile "${admission_ca_cert}" -untrusted "${admission_tls_cert}" \
+      "${admission_tls_cert}" >/dev/null 2>&1; then
+    echo "orka-system/orka-admission-tls tls.crt must be currently valid for ${service_dns} and chain to ca.crt" >&2
+    return 1
+  fi
+}
+
+render_admission_webhooks() {
+  jq -sc --slurpfile tls "${admission_tls_secret}" '
+    ($tls[0].data["ca.crt"]) as $ca
+    | [.[] | if .kind == "List" then .items[] else . end]
+    | {
+        apiVersion: "v1",
+        kind: "List",
+        items: map(
+          if .apiVersion == "admissionregistration.k8s.io/v1" and .kind == "ValidatingWebhookConfiguration"
+          then
+            .metadata.annotations = ((.metadata.annotations // {}) | del(."cert-manager.io/inject-ca-from-secret"))
+            | .webhooks |= map(.clientConfig.caBundle = $ca)
+          else . end
+        )
+      }
+  ' "${admission_webhooks_rendered}" >"${admission_webhooks_manifest}"
+
+  jq -e --slurpfile tls "${admission_tls_secret}" '
+    ($tls[0].data["ca.crt"]) as $ca |
+    ([.items[] | select(.kind == "ValidatingAdmissionPolicy")] | length) == 0 and
+    ([.items[] | select(.kind == "ValidatingAdmissionPolicyBinding")] | length) == 0 and
+    ([.items[] | select(.kind == "ValidatingWebhookConfiguration")] | length) == 1 and
+    ([.items[] | select(.kind == "ValidatingWebhookConfiguration") | .webhooks[]] | length) == 7 and
+    ([.items[] | select(.kind == "ValidatingWebhookConfiguration") | .webhooks[].name] | unique | length) == 7 and
+    ([.items[] | select(.kind == "ValidatingWebhookConfiguration") | .webhooks[] |
+      (.failurePolicy == "Fail" and
+       .sideEffects == "None" and
+       .clientConfig.caBundle == $ca and
+       .clientConfig.service.name == "orka-admission" and
+       .clientConfig.service.namespace == "orka-system" and
+       (.clientConfig.service.path | type == "string" and length > 0))] | all)
+  ' "${admission_webhooks_manifest}" >/dev/null || {
+    echo "admission wave must contain exactly seven unique, fail-closed, CA-pinned orka-admission webhooks and no legacy coexistence policies" >&2
+    return 1
+  }
+}
+
+wait_for_admission_endpoints() {
+  "${kubectl}" -n orka-system rollout status deployment/orka-admission --timeout=2m >/dev/null
+  if ! "${kubectl}" -n orka-system get endpoints orka-admission -o json >"${admission_endpoints}" \
+    || ! jq -e '[.subsets[]?.addresses[]?.ip] | unique | length >= 2' "${admission_endpoints}" >/dev/null; then
+    echo "orka-admission Service must expose at least two ready endpoints" >&2
+    return 1
+  fi
+}
+
+wait_for_workload_dependencies() {
+  local deployment service attempt ready
+  local -a dependencies=(
+    orka-provider-auth-proxy
+    orka-scm-egress-proxy
+    orka-workspace-publisher
+  )
+
+  for deployment in "${dependencies[@]}"; do
+    "${kubectl}" -n orka-system rollout status "deployment/${deployment}" --timeout=2m >/dev/null
+  done
+
+  for service in "${dependencies[@]}"; do
+    ready=0
+    for attempt in {1..50}; do
+      if "${kubectl}" -n orka-system get endpoints "${service}" -o json >"${workload_dependency_endpoints}" \
+        && jq -e '[.subsets[]?.addresses[]?.ip] | unique | length >= 1' \
+          "${workload_dependency_endpoints}" >/dev/null; then
+        ready=1
+        break
+      fi
+      sleep 0.2
+    done
+    if (( ready == 0 )); then
+      echo "${service} Service must expose at least one ready endpoint before controller rollout after ${attempt} attempts" >&2
+      return 1
+    fi
+  done
+}
+
+start_admission_proxy() {
+  local attempt line
+  admission_proxy_port=""
+  : >"${admission_proxy_log}"
+  "${kubectl}" proxy \
+    --address=127.0.0.1 \
+    --accept-hosts='^127\.0\.0\.1$' \
+    --port=0 \
+    >"${admission_proxy_log}" 2>&1 &
+  admission_proxy_pid=$!
+
+  for attempt in {1..50}; do
+    while IFS= read -r line; do
+      if [[ "${line}" =~ ^Starting[[:space:]]+to[[:space:]]+serve[[:space:]]+on[[:space:]]+127\.0\.0\.1:([0-9]+)$ ]]; then
+        admission_proxy_port="${BASH_REMATCH[1]}"
+        return 0
+      fi
+    done <"${admission_proxy_log}"
+    if ! kill -0 "${admission_proxy_pid}" 2>/dev/null; then
+      echo "kubectl proxy exited before the admission smoke endpoint was ready" >&2
+      return 1
+    fi
+    sleep 0.1
+  done
+
+  echo "kubectl proxy did not publish an admission smoke endpoint" >&2
+  return 1
+}
+
+smoke_admission_handlers() {
+  local handler group version kind resource uid
+  local service_proxy
+  if ! start_admission_proxy; then
+    return 1
+  fi
+  service_proxy="http://127.0.0.1:${admission_proxy_port}/api/v1/namespaces/orka-system/services/https:orka-admission:443/proxy"
+  while IFS='|' read -r handler group version kind resource; do
+    [[ -n "${handler}" ]] || continue
+    uid="orka-admission-smoke-${resource}"
+    jq -n \
+      --arg uid "${uid}" \
+      --arg group "${group}" \
+      --arg version "${version}" \
+      --arg kind "${kind}" \
+      --arg resource "${resource}" '
+      {
+        apiVersion: "admission.k8s.io/v1",
+        kind: "AdmissionReview",
+        request: {
+          uid: $uid,
+          kind: {group: $group, version: $version, kind: $kind},
+          resource: {group: $group, version: $version, resource: $resource},
+          requestKind: {group: $group, version: $version, kind: $kind},
+          requestResource: {group: $group, version: $version, resource: $resource},
+          name: "orka-admission-smoke",
+          namespace: (if $group == "" then "" else "orka-system" end),
+          operation: "CREATE",
+          userInfo: {username: "system:admin", groups: ["system:masters"]},
+          object: {
+            apiVersion: (if $group == "" then $version else ($group + "/" + $version) end),
+            kind: $kind,
+            metadata: ({name: "orka-admission-smoke"} +
+              (if $group == "" then {labels: {"orka.ai/controller-mode": "harness-v2"}}
+               else {namespace: "orka-system"} end))
+          },
+          oldObject: null,
+          dryRun: true,
+          options: {apiVersion: "meta.k8s.io/v1", kind: "CreateOptions"}
+        }
+      }
+    ' >"${admission_smoke_request}"
+    if ! curl \
+      --fail \
+      --silent \
+      --show-error \
+      --noproxy '*' \
+      --max-time 15 \
+      --header 'Content-Type: application/json' \
+      --data-binary "@${admission_smoke_request}" \
+      "${service_proxy}${handler}" \
+      >"${admission_smoke_response}" \
+      || ! jq -e --arg uid "${uid}" '
+        .apiVersion == "admission.k8s.io/v1" and
+        .kind == "AdmissionReview" and
+        .response.uid == $uid and
+        (.response.allowed | type == "boolean")
+      ' "${admission_smoke_response}" >/dev/null; then
+      echo "orka-admission handler smoke failed: ${handler}" >&2
+      stop_admission_proxy
+      return 1
+    fi
+  done <<'EOF_ADMISSION_HANDLERS'
+/validate-v1-namespace-execution-mode||v1|Namespace|namespaces
+/validate-core-orka-ai-v1alpha1-task-provenance|core.orka.ai|v1alpha1|Task|tasks
+/validate-core-orka-ai-v1alpha1-task-workspace-class-use|core.orka.ai|v1alpha1|Task|tasks-workspace-class-use
+/validate-core-orka-ai-v1alpha1-tool-workspace-class-use|core.orka.ai|v1alpha1|Tool|tools
+/validate-core-orka-ai-v1alpha1-agent-contract|core.orka.ai|v1alpha1|Agent|agents
+/validate-core-orka-ai-v1alpha1-agentruntime-contract|core.orka.ai|v1alpha1|AgentRuntime|agentruntimes
+/validate-core-orka-ai-v1alpha1-task-execution-authority|core.orka.ai|v1alpha1|Task|tasks-execution-authority
+EOF_ADMISSION_HANDLERS
+  stop_admission_proxy
+}
+
+# Establish every workload prerequisite, then activate the independent
+# admission plane before rolling the static harness-v2 controller. Every retry repeats
+# these idempotent phases, so interruption after any apply still converges on the
+# desired generation without rotating an existing snapshot key.
+bash "${script_dir}/lib/ensure-static-mode-namespace.sh" "${kubectl}" orka-system harness-v2
+validate_existing_controller_identity
+# Preserve the immutable mode claim as an atomic precondition while converging
+# the remaining platform labels. This cannot relabel or adopt a namespace that
+# changes identity after the preflight.
+"${kubectl}" patch namespace orka-system --type=json --patch-file "${namespace_metadata_patch}" >/dev/null
+validate_admission_tls_secret
+ensure_snapshot_secret
+"${kubectl}" apply -f "${runtime_config}"
+"${kubectl}" apply -f "${admission_runtime_manifest}"
+wait_for_admission_endpoints
+smoke_admission_handlers
+render_admission_webhooks
+"${kubectl}" apply -f "${admission_webhooks_manifest}"
+"${kubectl}" apply -f "${workload_prerequisite_manifest}"
+wait_for_workload_dependencies
+"${kubectl}" apply -f "${controller_manifest}"
+"${kubectl}" -n orka-system rollout status deployment/orka-controller-manager --timeout=2m >/dev/null
diff --git a/scripts/check-legacy-wrapper-resources.sh b/scripts/check-legacy-wrapper-resources.sh
new file mode 100755
index 000000000..576ac5c90
--- /dev/null
+++ b/scripts/check-legacy-wrapper-resources.sh
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# Mode-aware guard for live harness-wrapper resources.
+#
+# Default (v2-only hard cutover): fail when any legacy harness-wrapper
+# Deployment, Service, or Secret still exists in the cluster.
+#
+# COEXISTENCE=1 (harness v1/v2 coexistence): wrapper resources are expected and
+# never a failure by themselves. Instead, verify that every wrapper Deployment
+# keeps the coexistence upgrade contract: `strategy: Recreate` and a durable
+# admission-ledger volume named "ledger" backed by a PersistentVolumeClaim.
+set -Eeuo pipefail
+
+kubectl_bin="${KUBECTL:-kubectl}"
+command -v "${kubectl_bin}" >/dev/null 2>&1 || {
+  echo "required command not found: ${kubectl_bin}" >&2
+  exit 1
+}
+command -v jq >/dev/null 2>&1 || {
+  echo "required command not found: jq" >&2
+  exit 1
+}
+
+inventory="$(${kubectl_bin} get deployments.apps,services,secrets -A -o json)"
+wrapper_filter='
+  .items[]?
+  | select(
+      .metadata.labels["app.kubernetes.io/component"] == "agent-harness-wrapper"
+      or ((.kind == "Deployment" or .kind == "Service") and (.metadata.name == "agent-harness-wrapper" or (.metadata.name | endswith("-agent-harness-wrapper"))))
+      or (.kind == "Secret" and (.metadata.name == "harness-wrapper-auth" or (.metadata.name | endswith("-harness-wrapper-auth"))))
+    )
+'
+
+if [[ "${COEXISTENCE:-0}" == "1" ]]; then
+  violations="$(jq -r "${wrapper_filter}"'
+    | select(.kind == "Deployment")
+    | . as $deployment
+    | [
+        (if ($deployment.spec.strategy.type // "") != "Recreate" then "strategy is not Recreate" else empty end),
+        (if ([$deployment.spec.template.spec.volumes[]? | select(.name == "ledger" and (.persistentVolumeClaim.claimName // "") != "")] | length) == 0 then "missing PVC-backed ledger volume" else empty end)
+      ]
+    | select(length > 0)
+    | [$deployment.metadata.namespace, $deployment.metadata.name, join("; ")] | @tsv
+  ' <<<"${inventory}")"
+  if [[ -n "${violations}" ]]; then
+    echo "harness-wrapper Deployments violate the coexistence contract (Recreate strategy + durable ledger volume):" >&2
+    printf '%s\n' "${violations}" >&2
+    exit 1
+  fi
+  echo "coexistence mode: wrapper resources are allowed; present wrapper Deployments keep Recreate + durable ledger."
+  exit 0
+fi
+
+legacy="$(jq -r "${wrapper_filter}"'
+  | [.kind, .metadata.namespace, .metadata.name] | @tsv
+' <<<"${inventory}")"
+if [[ -n "${legacy}" ]]; then
+  echo "legacy harness-wrapper resources remain:" >&2
+  printf '%s\n' "${legacy}" >&2
+  exit 1
+fi
diff --git a/scripts/fixtures/security-scan-fake-acp/main.go b/scripts/fixtures/security-scan-fake-acp/main.go
new file mode 100644
index 000000000..5786a8209
--- /dev/null
+++ b/scripts/fixtures/security-scan-fake-acp/main.go
@@ -0,0 +1,425 @@
+package main
+
+import (
+	"bufio"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+)
+
+const (
+	jsonRPCVersion  = "2.0"
+	protocolVersion = 1
+	fieldJSONRPC    = "jsonrpc"
+	fieldResult     = "result"
+	contentTypeText = "text"
+
+	methodInitialize    = "initialize"
+	methodAuthenticate  = "authenticate"
+	methodSessionNew    = "session/new"
+	methodSessionPrompt = "session/prompt"
+	methodSessionCancel = "session/cancel"
+	methodSessionUpdate = "session/update"
+
+	threatModelKind = "orka.security.threat-model.v1"
+	findingsKind    = "orka.security.findings.v1"
+
+	malformedScanMarker = "malformed-result"
+	providerSessionID   = "security-scan-fixture-session"
+	apiKeyAuthMethod    = "api-key"
+)
+
+type rpcMessage struct {
+	JSONRPC string          `json:"jsonrpc"`
+	ID      json.RawMessage `json:"id"`
+	Method  string          `json:"method"`
+	Params  json.RawMessage `json:"params"`
+}
+
+type promptRequest struct {
+	Prompt []contentBlock `json:"prompt"`
+}
+
+type authenticateRequest struct {
+	MethodID string `json:"methodId"`
+}
+
+type contentBlock struct {
+	Type string `json:"type"`
+	Text string `json:"text"`
+}
+
+type evidenceCandidate struct {
+	path string
+	role string
+}
+
+func main() {
+	if err := serve(os.Stdin, os.Stdout); err != nil {
+		fmt.Fprintln(os.Stderr, "security scan ACP fixture failed")
+		os.Exit(2)
+	}
+}
+
+func serve(input io.Reader, output io.Writer) error {
+	scanner := bufio.NewScanner(input)
+	scanner.Buffer(make([]byte, 64<<10), 2<<20)
+	writer := bufio.NewWriter(output)
+	defer writer.Flush() //nolint:errcheck
+
+	for scanner.Scan() {
+		var message rpcMessage
+		if err := json.Unmarshal(scanner.Bytes(), &message); err != nil {
+			return err
+		}
+		switch message.Method {
+		case methodInitialize:
+			if err := writeMessage(writer, map[string]any{
+				fieldJSONRPC: jsonRPCVersion,
+				"id":         decodeID(message.ID),
+				fieldResult: map[string]any{
+					"protocolVersion": protocolVersion,
+					"agentInfo":       map[string]any{"name": "orka-security-scan-fixture", "version": "1"},
+					"agentCapabilities": map[string]any{
+						"mcpCapabilities": map[string]any{"http": true},
+					},
+					"authMethods": []any{map[string]any{
+						"id": apiKeyAuthMethod, "name": "API key",
+					}},
+				},
+			}); err != nil {
+				return err
+			}
+		case methodAuthenticate:
+			var request authenticateRequest
+			if err := json.Unmarshal(message.Params, &request); err != nil {
+				return err
+			}
+			if request.MethodID != apiKeyAuthMethod {
+				if err := writeMessage(writer, map[string]any{
+					fieldJSONRPC: jsonRPCVersion,
+					"id":         decodeID(message.ID),
+					"error":      map[string]any{"code": -32602, "message": "unsupported authentication method"},
+				}); err != nil {
+					return err
+				}
+				continue
+			}
+			if err := writeMessage(writer, map[string]any{
+				fieldJSONRPC: jsonRPCVersion,
+				"id":         decodeID(message.ID),
+				fieldResult:  map[string]any{},
+			}); err != nil {
+				return err
+			}
+		case methodSessionNew:
+			if err := writeMessage(writer, map[string]any{
+				fieldJSONRPC: jsonRPCVersion,
+				"id":         decodeID(message.ID),
+				fieldResult:  map[string]any{"sessionId": providerSessionID},
+			}); err != nil {
+				return err
+			}
+		case methodSessionPrompt:
+			var request promptRequest
+			if err := json.Unmarshal(message.Params, &request); err != nil {
+				return err
+			}
+			result, err := terminalResult(promptText(request.Prompt))
+			if err != nil {
+				if writeErr := writeMessage(writer, map[string]any{
+					fieldJSONRPC: jsonRPCVersion,
+					"id":         decodeID(message.ID),
+					"error":      map[string]any{"code": -32603, "message": "deterministic fixture could not build result"},
+				}); writeErr != nil {
+					return writeErr
+				}
+				continue
+			}
+			if err := writeMessage(writer, map[string]any{
+				fieldJSONRPC: jsonRPCVersion,
+				"method":     methodSessionUpdate,
+				"params": map[string]any{
+					"sessionId": providerSessionID,
+					"update": map[string]any{
+						"sessionUpdate": "agent_message_chunk",
+						"content": map[string]any{
+							"type": contentTypeText,
+							"text": string(result),
+						},
+					},
+				},
+			}); err != nil {
+				return err
+			}
+			if err := writeMessage(writer, map[string]any{
+				fieldJSONRPC: jsonRPCVersion,
+				"id":         decodeID(message.ID),
+				fieldResult:  map[string]any{"stopReason": "end_turn"},
+			}); err != nil {
+				return err
+			}
+		case methodSessionCancel:
+			// The fixture completes synchronously, so cancellation is always a no-op.
+		}
+	}
+	return scanner.Err()
+}
+
+func writeMessage(writer *bufio.Writer, value any) error {
+	data, err := json.Marshal(value)
+	if err != nil {
+		return err
+	}
+	if _, err := writer.Write(append(data, '\n')); err != nil {
+		return err
+	}
+	return writer.Flush()
+}
+
+func decodeID(raw json.RawMessage) any {
+	if len(raw) == 0 {
+		return nil
+	}
+	var value any
+	if err := json.Unmarshal(raw, &value); err != nil {
+		return nil
+	}
+	return value
+}
+
+func promptText(blocks []contentBlock) string {
+	var out strings.Builder
+	for _, block := range blocks {
+		if block.Type != contentTypeText || block.Text == "" {
+			continue
+		}
+		out.WriteString(block.Text)
+		out.WriteByte('\n')
+	}
+	return out.String()
+}
+
+func terminalResult(prompt string) ([]byte, error) {
+	envelope, err := contractEnvelope(prompt)
+	if err != nil {
+		return nil, err
+	}
+	kind, _ := envelope["kind"].(string)
+	repositoryScan, _ := envelope["repositoryScan"].(string)
+	if strings.Contains(repositoryScan, malformedScanMarker) {
+		envelope["scanId"] = "scan_fixture_binding_mismatch"
+		return json.Marshal(envelope)
+	}
+
+	switch kind {
+	case threatModelKind:
+		envelope["threatModel"] = "# Threat Model\n\n## Trust Boundaries\n\n" +
+			"The HTTP request boundary, repository content, and privileged server operations are security-sensitive.\n\n" +
+			"## Validation Scope\n\nFindings must be grounded in mapper-owned repository evidence."
+	case findingsKind:
+		if err := populateFindings(envelope, prompt); err != nil {
+			return nil, err
+		}
+	default:
+		return nil, fmt.Errorf("unsupported security result kind")
+	}
+	return json.Marshal(envelope)
+}
+
+func contractEnvelope(prompt string) (map[string]any, error) {
+	marker := "Use this exact envelope"
+	markerIndex := strings.Index(prompt, marker)
+	if markerIndex < 0 {
+		return nil, errors.New("terminal result contract marker is missing")
+	}
+	objectStart := strings.IndexByte(prompt[markerIndex:], '{')
+	if objectStart < 0 {
+		return nil, errors.New("terminal result envelope is missing")
+	}
+	objectStart += markerIndex
+	data, err := extractJSONObject(prompt[objectStart:])
+	if err != nil {
+		return nil, err
+	}
+	var envelope map[string]any
+	if err := json.Unmarshal([]byte(data), &envelope); err != nil {
+		return nil, err
+	}
+	return envelope, nil
+}
+
+func extractJSONObject(value string) (string, error) {
+	depth := 0
+	inString := false
+	escaped := false
+	for index, current := range value {
+		if inString {
+			if escaped {
+				escaped = false
+				continue
+			}
+			switch current {
+			case '\\':
+				escaped = true
+			case '"':
+				inString = false
+			}
+			continue
+		}
+		switch current {
+		case '"':
+			inString = true
+		case '{':
+			depth++
+		case '}':
+			depth--
+			if depth == 0 {
+				return value[:index+1], nil
+			}
+		}
+		if depth < 0 {
+			break
+		}
+	}
+	return "", errors.New("terminal result envelope is incomplete")
+}
+
+func populateFindings(envelope map[string]any, prompt string) error {
+	artifact, ok := envelope["findings"].(map[string]any)
+	if !ok {
+		return errors.New("findings artifact is missing")
+	}
+	scan, ok := artifact["scan"].(map[string]any)
+	if !ok {
+		return errors.New("findings scan identity is missing")
+	}
+	path, line, ok := reviewEvidence(prompt)
+	if !ok {
+		scan["summary"] = "No bounded source evidence was available to the deterministic fixture."
+		artifact["findings"] = []any{}
+		return nil
+	}
+
+	scan["summary"] = "Deterministic fixture produced one bounded finding and one rejected evidence diagnostic."
+	artifact["findings"] = []any{
+		map[string]any{
+			"title":      "Missing authorization on a privileged server operation",
+			"category":   "authorization",
+			"severity":   "high",
+			"confidence": "high",
+			"triage":     "valid",
+			"summary": "An attacker-controlled request reaches a privileged server operation without authorization, " +
+				"crossing the application trust boundary.",
+			"rootCause":    "The server operation is invoked before an authorization decision is enforced.",
+			"reproduction": "Submit an untrusted request that reaches the cited operation without an authorized identity.",
+			"remediation":  "Enforce authorization before invoking the privileged operation.",
+			"evidence": []any{map[string]any{
+				"path": path, "startLine": line, "endLine": line,
+			}},
+		},
+		map[string]any{
+			"title":       "Rejected fixture evidence outside mapper context",
+			"category":    "fixture-invalid-evidence",
+			"severity":    "medium",
+			"confidence":  "medium",
+			"summary":     "This deterministic record intentionally cites a file outside the trusted mapper context.",
+			"remediation": "Reject findings whose evidence is outside the trusted context.",
+			"evidence": []any{map[string]any{
+				"path": "outside-mapper-context.txt", "startLine": 1, "endLine": 1,
+			}},
+		},
+	}
+	return nil
+}
+
+func reviewEvidence(prompt string) (string, int, bool) {
+	const listStart = "Valid evidence paths for this review:\n"
+	const listEnd = "\nCite findings only from included file ranges below."
+	start := strings.Index(prompt, listStart)
+	if start < 0 {
+		return "", 0, false
+	}
+	start += len(listStart)
+	end := strings.Index(prompt[start:], listEnd)
+	if end < 0 {
+		return "", 0, false
+	}
+
+	section := prompt[start : start+end]
+	candidates := make([]evidenceCandidate, 0, strings.Count(section, "\n"))
+	for line := range strings.SplitSeq(section, "\n") {
+		line = strings.TrimSpace(line)
+		if !strings.HasPrefix(line, "- ") || !strings.HasSuffix(line, ")") {
+			continue
+		}
+		line = strings.TrimPrefix(line, "- ")
+		roleStart := strings.LastIndex(line, " (")
+		if roleStart <= 0 {
+			continue
+		}
+		candidates = append(candidates, evidenceCandidate{
+			path: strings.TrimSpace(line[:roleStart]),
+			role: strings.TrimSuffix(line[roleStart+2:], ")"),
+		})
+	}
+	for _, preferred := range []bool{true, false} {
+		for _, candidate := range candidates {
+			if preferred != preferredEvidence(candidate) {
+				continue
+			}
+			if line, ok := firstIncludedLine(prompt, candidate); ok {
+				return candidate.path, line, true
+			}
+		}
+	}
+	return "", 0, false
+}
+
+func preferredEvidence(candidate evidenceCandidate) bool {
+	if candidate.role == "test" {
+		return false
+	}
+	lower := strings.ToLower(candidate.path)
+	base := strings.ToLower(filepath.Base(lower))
+	if strings.HasPrefix(lower, "docs/") || strings.Contains(lower, "/docs/") ||
+		strings.Contains(lower, "/test/") || strings.Contains(lower, "/tests/") ||
+		strings.HasSuffix(base, "_test.go") || strings.Contains(base, ".test.") || strings.Contains(base, ".spec.") {
+		return false
+	}
+	switch filepath.Ext(lower) {
+	case ".c", ".cc", ".cpp", ".cs", ".go", ".java", ".js", ".jsx", ".kt", ".mjs", ".php", ".py",
+		".rb", ".rs", ".sh", ".ts", ".tsx":
+		return true
+	default:
+		return false
+	}
+}
+
+func firstIncludedLine(prompt string, candidate evidenceCandidate) (int, bool) {
+	header := "--- " + candidate.path + " (" + candidate.role + ") ---\n"
+	_, content, found := strings.Cut(prompt, header)
+	if !found {
+		return 0, false
+	}
+	for line := range strings.SplitSeq(content, "\n") {
+		if strings.HasPrefix(line, "--- ") {
+			break
+		}
+		trimmed := strings.TrimLeft(line, " \t")
+		separator := strings.Index(trimmed, "  ")
+		if separator <= 0 {
+			continue
+		}
+		lineNumber, err := strconv.Atoi(trimmed[:separator])
+		if err == nil && lineNumber > 0 {
+			return lineNumber, true
+		}
+	}
+	return 0, false
+}
diff --git a/scripts/fixtures/security-scan-fake-acp/main_test.go b/scripts/fixtures/security-scan-fake-acp/main_test.go
new file mode 100644
index 000000000..5d54280e1
--- /dev/null
+++ b/scripts/fixtures/security-scan-fake-acp/main_test.go
@@ -0,0 +1,178 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+func TestServeAdvertisesAndAcceptsRequiredCodexAuthentication(t *testing.T) {
+	input := strings.NewReader(
+		`{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":1}}` + "\n" +
+			`{"jsonrpc":"2.0","id":2,"method":"authenticate","params":{"methodId":"api-key"}}` + "\n" +
+			`{"jsonrpc":"2.0","id":3,"method":"session/new","params":{}}` + "\n",
+	)
+	var output bytes.Buffer
+	if err := serve(input, &output); err != nil {
+		t.Fatalf("serve() error = %v", err)
+	}
+
+	decoder := json.NewDecoder(&output)
+	var initialize struct {
+		Result struct {
+			ProtocolVersion int `json:"protocolVersion"`
+			AuthMethods     []struct {
+				ID string `json:"id"`
+			} `json:"authMethods"`
+		} `json:"result"`
+	}
+	if err := decoder.Decode(&initialize); err != nil {
+		t.Fatal(err)
+	}
+	if initialize.Result.ProtocolVersion != protocolVersion || len(initialize.Result.AuthMethods) != 1 ||
+		initialize.Result.AuthMethods[0].ID != apiKeyAuthMethod {
+		t.Fatalf("initialize result = %#v", initialize.Result)
+	}
+
+	var authenticated struct {
+		ID     int            `json:"id"`
+		Result map[string]any `json:"result"`
+	}
+	if err := decoder.Decode(&authenticated); err != nil {
+		t.Fatal(err)
+	}
+	if authenticated.ID != 2 || authenticated.Result == nil {
+		t.Fatalf("authenticate result = %#v", authenticated)
+	}
+
+	var newSession struct {
+		Result struct {
+			SessionID string `json:"sessionId"`
+		} `json:"result"`
+	}
+	if err := decoder.Decode(&newSession); err != nil {
+		t.Fatal(err)
+	}
+	if newSession.Result.SessionID != providerSessionID {
+		t.Fatalf("session ID = %q, want %q", newSession.Result.SessionID, providerSessionID)
+	}
+}
+
+func TestTerminalResultThreatModelPreservesBinding(t *testing.T) {
+	prompt := `Use this exact envelope and identity values; replace only threatModel with the complete markdown document:
+	{
+	  "schemaVersion": 1,
+	  "kind": "orka.security.threat-model.v1",
+	  "repositoryScan": "security-goof",
+	  "scanId": "scan_123",
+	  "policyDigest": "sha256:policy",
+	  "threatModel": "# Threat Model\n\n..."
+	}
+	`
+	result, err := terminalResult(prompt)
+	if err != nil {
+		t.Fatalf("terminalResult() error = %v", err)
+	}
+	var envelope map[string]any
+	if err := json.Unmarshal(result, &envelope); err != nil {
+		t.Fatal(err)
+	}
+	if envelope["scanId"] != "scan_123" || envelope["policyDigest"] != "sha256:policy" {
+		t.Fatalf("binding changed: %#v", envelope)
+	}
+	if threatModel, _ := envelope["threatModel"].(string); len(threatModel) == 0 || threatModel[0] != '#' {
+		t.Fatalf("threatModel = %q, want markdown heading", threatModel)
+	}
+}
+
+func TestTerminalResultReviewUsesMapperContextAndAddsRejectedEvidence(t *testing.T) {
+	prompt := "Use this exact envelope, repository identity, and binding values. " +
+		"Populate findings.findings; keep it an empty array when no supported finding exists:\n" +
+		`{
+	  "schemaVersion": 1,
+	  "kind": "orka.security.findings.v1",
+	  "repositoryScan": "security-goof",
+	  "scanId": "scan_123",
+	  "sliceId": "slice_api",
+	  "policyDigest": "sha256:policy",
+	  "contextDigest": "sha256:context",
+	  "findings": {
+	    "schemaVersion": 2,
+	    "repository": {
+	      "repoURL": "https://github.com/example/repo",
+	      "branch": "main",
+	      "headSHA": "abc"
+	    },
+	    "scan": {
+	      "mode": "initial",
+	      "sliceId": "slice_api",
+	      "summary": "..."
+	    },
+	    "findings": []
+	  }
+	}
+
+Valid evidence paths for this review:
+- README.md (context)
+- server.js (owned)
+
+Cite findings only from included file ranges below.
+
+--- README.md (context) ---
+     1  docs
+
+--- server.js (owned) ---
+    17  app.post('/admin', handler)
+`
+	result, err := terminalResult(prompt)
+	if err != nil {
+		t.Fatalf("terminalResult() error = %v", err)
+	}
+	var envelope struct {
+		Findings struct {
+			Findings []struct {
+				Evidence []struct {
+					Path      string `json:"path"`
+					StartLine int    `json:"startLine"`
+				} `json:"evidence"`
+			} `json:"findings"`
+		} `json:"findings"`
+	}
+	if err := json.Unmarshal(result, &envelope); err != nil {
+		t.Fatal(err)
+	}
+	if len(envelope.Findings.Findings) != 2 {
+		t.Fatalf("findings = %#v, want accepted and rejected fixtures", envelope.Findings.Findings)
+	}
+	if got := envelope.Findings.Findings[0].Evidence[0]; got.Path != "server.js" || got.StartLine != 17 {
+		t.Fatalf("accepted evidence = %#v, want mapper-owned server.js:17", got)
+	}
+	if got := envelope.Findings.Findings[1].Evidence[0].Path; got != "outside-mapper-context.txt" {
+		t.Fatalf("rejected evidence path = %q", got)
+	}
+}
+
+func TestTerminalResultMalformedScanBreaksIdentityBinding(t *testing.T) {
+	prompt := `Use this exact envelope and identity values; replace only threatModel with the complete markdown document:
+	{
+	  "schemaVersion": 1,
+	  "kind": "orka.security.threat-model.v1",
+	  "repositoryScan": "security-goof-malformed-result",
+	  "scanId": "scan_123",
+	  "policyDigest": "sha256:policy",
+	  "threatModel": "# Threat Model\n\n..."
+	}
+	`
+	result, err := terminalResult(prompt)
+	if err != nil {
+		t.Fatalf("terminalResult() error = %v", err)
+	}
+	var envelope map[string]any
+	if err := json.Unmarshal(result, &envelope); err != nil {
+		t.Fatal(err)
+	}
+	if envelope["scanId"] == "scan_123" {
+		t.Fatalf("malformed fixture preserved scan binding: %#v", envelope)
+	}
+}
diff --git a/scripts/lib/e2e-admission-tls.sh b/scripts/lib/e2e-admission-tls.sh
new file mode 100755
index 000000000..8e0dc2f5b
--- /dev/null
+++ b/scripts/lib/e2e-admission-tls.sh
@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+# Shared test-only bootstrap for fresh-cluster E2E runs. Production deployment
+# remains fail-closed and requires callers to provision this Secret explicitly.
+
+orka_e2e_bootstrap_admission_tls() (
+  set -Eeuo pipefail
+
+  local kubectl_bin="${1:-kubectl}"
+  local namespace="orka-system"
+  local secret_name="orka-admission-tls"
+  local service_name="orka-admission.orka-system.svc"
+  local library_dir tls_dir
+
+  library_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+
+  for command in openssl "${kubectl_bin}"; do
+    command -v "${command}" >/dev/null 2>&1 || {
+      echo "missing required command: ${command}" >&2
+      return 1
+    }
+  done
+
+  tls_dir="$(mktemp -d "${TMPDIR:-/tmp}/orka-e2e-admission-tls.XXXXXX")"
+  chmod 700 "${tls_dir}"
+  trap 'rm -rf -- "${tls_dir}"' EXIT
+  umask 077
+
+  cat >"${tls_dir}/ca.conf" <<'EOF_CA_CONFIG'
+[req]
+prompt = no
+distinguished_name = ca_name
+x509_extensions = ca_extensions
+
+[ca_name]
+CN = Orka E2E admission CA
+
+[ca_extensions]
+basicConstraints = critical, CA:true
+keyUsage = critical, keyCertSign, cRLSign
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always
+EOF_CA_CONFIG
+
+  cat >"${tls_dir}/serving.conf" <<EOF_SERVING_CONFIG
+[req]
+prompt = no
+distinguished_name = serving_name
+req_extensions = serving_extensions
+
+[serving_name]
+CN = ${service_name}
+
+[serving_extensions]
+basicConstraints = critical, CA:false
+keyUsage = critical, digitalSignature, keyEncipherment
+extendedKeyUsage = serverAuth
+subjectAltName = DNS:${service_name},DNS:${service_name}.cluster.local
+subjectKeyIdentifier = hash
+EOF_SERVING_CONFIG
+
+  openssl req -x509 -newkey rsa:2048 -nodes -sha256 -days 7 \
+    -config "${tls_dir}/ca.conf" \
+    -keyout "${tls_dir}/ca.key" \
+    -out "${tls_dir}/ca.crt" >/dev/null 2>&1
+  openssl req -new -newkey rsa:2048 -nodes -sha256 \
+    -config "${tls_dir}/serving.conf" \
+    -keyout "${tls_dir}/tls.key" \
+    -out "${tls_dir}/tls.csr" >/dev/null 2>&1
+  openssl x509 -req -sha256 -days 7 \
+    -in "${tls_dir}/tls.csr" \
+    -CA "${tls_dir}/ca.crt" \
+    -CAkey "${tls_dir}/ca.key" \
+    -CAcreateserial \
+    -extfile "${tls_dir}/serving.conf" \
+    -extensions serving_extensions \
+    -out "${tls_dir}/tls.crt" >/dev/null 2>&1
+  openssl verify -CAfile "${tls_dir}/ca.crt" "${tls_dir}/tls.crt" >/dev/null 2>&1
+
+  bash "${library_dir}/ensure-static-mode-namespace.sh" \
+    "${kubectl_bin}" "${namespace}" harness-v2
+  "${kubectl_bin}" -n "${namespace}" create secret generic "${secret_name}" \
+    --type=kubernetes.io/tls \
+    --from-file="tls.crt=${tls_dir}/tls.crt" \
+    --from-file="tls.key=${tls_dir}/tls.key" \
+    --from-file="ca.crt=${tls_dir}/ca.crt" \
+    --dry-run=client -o yaml \
+    | "${kubectl_bin}" apply -f - >/dev/null
+)
+
+if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
+  orka_e2e_bootstrap_admission_tls "$@"
+fi
diff --git a/scripts/lib/e2e-common.sh b/scripts/lib/e2e-common.sh
new file mode 100644
index 000000000..19fe98a13
--- /dev/null
+++ b/scripts/lib/e2e-common.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Shared logging and precondition helpers for E2E and release scripts.
+# Source this file; do not execute it. Scripts that need a different log
+# format (for example timestamped output) may redefine log after sourcing.
+
+log() {
+  printf '==> %s\n' "$*" >&2
+}
+
+warn() {
+  printf 'warning: %s\n' "$*" >&2
+}
+
+die() {
+  printf 'error: %s\n' "$*" >&2
+  exit 1
+}
+
+require_cmd() {
+  command -v "$1" >/dev/null 2>&1 || die "missing required command: $1"
+}
diff --git a/scripts/lib/ensure-static-mode-namespace.sh b/scripts/lib/ensure-static-mode-namespace.sh
new file mode 100755
index 000000000..cad8b0b00
--- /dev/null
+++ b/scripts/lib/ensure-static-mode-namespace.sh
@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+usage() {
+  echo "Usage: $0 KUBECTL NAMESPACE harness-v1|harness-v2" >&2
+}
+
+[[ $# -eq 3 ]] || {
+  usage
+  exit 2
+}
+
+kubectl_bin="$1"
+namespace="$2"
+controller_mode="$3"
+
+command -v "${kubectl_bin}" >/dev/null 2>&1 || {
+  echo "kubectl command not found: ${kubectl_bin}" >&2
+  exit 1
+}
+command -v jq >/dev/null 2>&1 || {
+  echo "required command not found: jq" >&2
+  exit 1
+}
+[[ -n "${namespace}" ]] || {
+  echo "namespace must be non-empty" >&2
+  exit 2
+}
+case "${controller_mode}" in
+  harness-v1|harness-v2) ;;
+  *)
+    echo "controller mode must be harness-v1 or harness-v2" >&2
+    exit 2
+    ;;
+esac
+
+work_dir="$(mktemp -d "${TMPDIR:-/tmp}/ensure-static-mode-namespace.XXXXXX")"
+cleanup() {
+  rm -rf -- "${work_dir}"
+}
+trap cleanup EXIT
+
+namespace_json="${work_dir}/namespace.json"
+namespace_manifest="${work_dir}/namespace-manifest.json"
+
+read_namespace() {
+  : >"${namespace_json}"
+  if ! "${kubectl_bin}" get namespace "${namespace}" --ignore-not-found -o json >"${namespace_json}"; then
+    echo "unable to inspect namespace ${namespace}" >&2
+    return 1
+  fi
+}
+
+has_exact_identity() {
+  jq -es --arg namespace "${namespace}" --arg mode "${controller_mode}" '
+    length == 1 and
+    .[0].apiVersion == "v1" and
+    .[0].kind == "Namespace" and
+    .[0].metadata.name == $namespace and
+    .[0].metadata.labels["orka.ai/controller-mode"] == $mode
+  ' "${namespace_json}" >/dev/null
+}
+
+identity_error() {
+  echo "namespace ${namespace} must already claim orka.ai/controller-mode=${controller_mode}; unlabeled, malformed, or opposite-mode namespaces cannot be adopted in place" >&2
+}
+
+read_namespace || exit 1
+if [[ -s "${namespace_json}" ]]; then
+  has_exact_identity || {
+    identity_error
+    exit 1
+  }
+  exit 0
+fi
+
+jq -n --arg namespace "${namespace}" --arg mode "${controller_mode}" '{
+  apiVersion: "v1",
+  kind: "Namespace",
+  metadata: {
+    name: $namespace,
+    labels: {"orka.ai/controller-mode": $mode}
+  }
+}' >"${namespace_manifest}"
+
+if "${kubectl_bin}" create -f "${namespace_manifest}" >/dev/null 2>&1; then
+  read_namespace || exit 1
+  if [[ ! -s "${namespace_json}" ]] || ! has_exact_identity; then
+    echo "namespace ${namespace} was created but its static controller identity could not be verified" >&2
+    exit 1
+  fi
+  exit 0
+fi
+
+# A concurrent installer may have won the create race. Accept only the exact
+# static identity it created; every other create failure remains fail-closed.
+read_namespace || exit 1
+if [[ -s "${namespace_json}" ]] && has_exact_identity; then
+  exit 0
+fi
+if [[ -s "${namespace_json}" ]]; then
+  identity_error
+else
+  echo "unable to create namespace ${namespace} with orka.ai/controller-mode=${controller_mode}" >&2
+fi
+exit 1
diff --git a/scripts/lib/kind-local-registry.sh b/scripts/lib/kind-local-registry.sh
new file mode 100755
index 000000000..674154c0d
--- /dev/null
+++ b/scripts/lib/kind-local-registry.sh
@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# Shared helpers for publishing immutable test images to a registry reachable by
+# both the host and nodes in one Kind cluster.
+
+orka_kind_registry_name() {
+  local cluster="$1"
+  local sanitized
+  sanitized="$(printf '%s' "${cluster}" | tr '[:upper:]' '[:lower:]' | tr -c 'a-z0-9_.-' '-')"
+  sanitized="${sanitized#[-_.]}"
+  sanitized="${sanitized%[-_.]}"
+  printf '%s-orka-registry\n' "${sanitized}"
+}
+
+orka_kind_registry_start() {
+  local cluster="$1"
+  local owner="${2:-}"
+  local kind_bin="${KIND:-kind}"
+  ORKA_KIND_REGISTRY_NAME="$(orka_kind_registry_name "${cluster}")"
+
+  if [[ -n "${owner}" ]]; then
+    docker run -d --name "${ORKA_KIND_REGISTRY_NAME}" --network kind \
+      --label "io.orka.test.owner=${owner}" \
+      -p 127.0.0.1::5000 registry:2 >/dev/null || return 1
+  else
+    docker rm -f "${ORKA_KIND_REGISTRY_NAME}" >/dev/null 2>&1 || true
+    docker run -d --name "${ORKA_KIND_REGISTRY_NAME}" --network kind \
+      -p 127.0.0.1::5000 registry:2 >/dev/null || return 1
+  fi
+
+  local port_output host_port
+  port_output="$(docker port "${ORKA_KIND_REGISTRY_NAME}" 5000/tcp)"
+  port_output="${port_output%%,*}"
+  host_port="${port_output##*:}"
+  [[ "${host_port}" =~ ^[0-9]+$ ]] || {
+    echo "unexpected Kind registry port mapping: ${port_output}" >&2
+    return 1
+  }
+  # Keep the host-side reference on IPv4. Docker may resolve localhost to ::1
+  # first, while the registry port is intentionally bound only to 127.0.0.1.
+  ORKA_KIND_REGISTRY_ADDR="127.0.0.1:${host_port}"
+
+  local deadline=$((SECONDS + 30))
+  until curl -fsS "http://${ORKA_KIND_REGISTRY_ADDR}/v2/" >/dev/null 2>&1; do
+    if (( SECONDS >= deadline )); then
+      echo "Kind registry ${ORKA_KIND_REGISTRY_ADDR} did not become ready" >&2
+      return 1
+    fi
+    sleep 1
+  done
+
+  local node registry_dir
+  while IFS= read -r node; do
+    [[ -n "${node}" ]] || continue
+    registry_dir="/etc/containerd/certs.d/${ORKA_KIND_REGISTRY_ADDR}"
+    docker exec "${node}" mkdir -p "${registry_dir}"
+    docker exec -i "${node}" sh -c "cat > '${registry_dir}/hosts.toml'" <<HOSTS
+server = "http://${ORKA_KIND_REGISTRY_ADDR}"
+[host."http://${ORKA_KIND_REGISTRY_NAME}:5000"]
+  capabilities = ["pull", "resolve"]
+HOSTS
+  done < <("${kind_bin}" get nodes --name "${cluster}")
+
+  export ORKA_KIND_REGISTRY_NAME ORKA_KIND_REGISTRY_ADDR
+}
+
+orka_kind_registry_push() {
+  local source_image="$1"
+  local repository="$2"
+  local target="${ORKA_KIND_REGISTRY_ADDR}/${repository}:e2e"
+  if command -v skopeo >/dev/null 2>&1; then
+    if ! skopeo copy --dest-tls-verify=false \
+      "docker-daemon:${source_image}" "docker://${target}" >/dev/null; then
+      echo "failed to copy ${source_image} to the Kind registry as ${target}" >&2
+      return 1
+    fi
+  else
+    docker tag "${source_image}" "${target}"
+    if ! docker push "${target}" >/dev/null; then
+      echo "failed to push ${target} to the Kind registry" >&2
+      return 1
+    fi
+  fi
+
+  local digest
+  digest="$(curl -fsSI \
+    -H 'Accept: application/vnd.oci.image.index.v1+json, application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.docker.distribution.manifest.v2+json' \
+    "http://${ORKA_KIND_REGISTRY_ADDR}/v2/${repository}/manifests/e2e" | \
+    tr -d '\r' | awk 'BEGIN { IGNORECASE=1 } /^Docker-Content-Digest:/ { print $2; exit }')"
+  [[ "${digest}" =~ ^sha256:[0-9a-f]{64}$ ]] || {
+    echo "no immutable digest found after pushing ${target}" >&2
+    return 1
+  }
+  printf '%s/%s@%s\n' "${ORKA_KIND_REGISTRY_ADDR}" "${repository}" "${digest}"
+}
+
+orka_kind_registry_stop() {
+  local name="${ORKA_KIND_REGISTRY_NAME:-}"
+  local owner="${2:-}"
+  local container_ids actual_owner
+  if [[ -z "${name}" && $# -gt 0 ]]; then
+    name="$(orka_kind_registry_name "$1")"
+  fi
+  [[ -n "${name}" ]] || return 0
+
+  container_ids="$(docker container ls --all --filter "name=^/${name}$" --format '{{.ID}}')" || return 1
+  [[ -n "${container_ids}" ]] || return 0
+  [[ "${container_ids}" != *$'\n'* ]] || {
+    echo "multiple containers matched Kind registry ${name}" >&2
+    return 1
+  }
+
+  if [[ -n "${owner}" ]]; then
+    actual_owner="$(docker container inspect --format '{{ index .Config.Labels "io.orka.test.owner" }}' "${name}")" || return 1
+    [[ "${actual_owner}" == "${owner}" ]] || {
+      echo "refusing to remove Kind registry ${name} without matching ownership" >&2
+      return 1
+    }
+  fi
+
+  docker container rm --force "${name}" >/dev/null || return 1
+  container_ids="$(docker container ls --all --filter "name=^/${name}$" --format '{{.ID}}')" || return 1
+  [[ -z "${container_ids}" ]] || {
+    echo "Kind registry ${name} remains after cleanup" >&2
+    return 1
+  }
+}
diff --git a/scripts/lib/live-acp-runtime-kind-bootstrap.sh b/scripts/lib/live-acp-runtime-kind-bootstrap.sh
new file mode 100644
index 000000000..c95d5796f
--- /dev/null
+++ b/scripts/lib/live-acp-runtime-kind-bootstrap.sh
@@ -0,0 +1,534 @@
+#!/usr/bin/env bash
+# Shared, source-only bootstrap for the live ACP runtime validator on Kind.
+
+if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
+  echo "error: source scripts/lib/live-acp-runtime-kind-bootstrap.sh; do not execute it directly" >&2
+  exit 2
+fi
+
+live_acp_kind_lib_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=scripts/lib/e2e-admission-tls.sh
+. "${live_acp_kind_lib_dir}/e2e-admission-tls.sh"
+unset live_acp_kind_lib_dir
+
+# Internal port-forward state is process-local. Reset inherited values so a
+# caller-controlled environment can never make cleanup signal or unlink an
+# unrelated resource.
+LIVE_ACP_VEKIL_PORT_FORWARD_PID=""
+LIVE_ACP_VEKIL_PORT_FORWARD_LOG=""
+LIVE_ACP_VEKIL_BASE_URL=""
+LIVE_ACP_VEKIL_PORT_FORWARD_OWNED=0
+
+live_acp_kind_log() {
+  printf '==> %s\n' "$*" >&2
+}
+
+live_acp_kind_die() {
+  printf 'error: %s\n' "$*" >&2
+  return 1
+}
+
+live_acp_kind_enabled() {
+  case "${1:-}" in
+    1|true|TRUE|yes|YES|on|ON) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+live_acp_kind_require_cmd() {
+  command -v "$1" >/dev/null 2>&1 || live_acp_kind_die "missing required command: $1"
+}
+
+live_acp_kind_run() {
+  printf '+ ' >&2
+  printf '%q ' "$@" >&2
+  printf '\n' >&2
+  "$@"
+}
+
+live_acp_kind_preflight() {
+  local command
+  for command in curl docker git go jq kind kubectl make openssl python3; do
+    live_acp_kind_require_cmd "${command}" || return 1
+  done
+  if live_acp_kind_enabled "${RELEASE_GATE:-0}"; then
+    live_acp_kind_require_cmd gh || return 1
+    local token_var
+    for token_var in \
+      ACP_E2E_WRITE_READ_CREDENTIAL_TOKEN \
+      ACP_E2E_WRITE_TARGET_READ_CREDENTIAL_TOKEN \
+      ACP_E2E_WRITE_CREDENTIAL_TOKEN \
+      ACP_E2E_WRITE_FORGE_CREDENTIAL_TOKEN; do
+      [[ -n "${!token_var:-}" ]] || live_acp_kind_die "${token_var} is required when RELEASE_GATE=1" || return 1
+    done
+  fi
+  [[ -x "${LIVE_ACP_KINDCTL_BIN}" ]] || live_acp_kind_die "kindctl is not executable: ${LIVE_ACP_KINDCTL_BIN}" || return 1
+  [[ -x "${LIVE_ACP_VEKIL_DEPLOY_SCRIPT}" ]] || live_acp_kind_die "Vekil deploy script is not executable: ${LIVE_ACP_VEKIL_DEPLOY_SCRIPT}" || return 1
+  [[ -x "${LIVE_ACP_VALIDATOR_SCRIPT}" ]] || live_acp_kind_die "live ACP validator is not executable: ${LIVE_ACP_VALIDATOR_SCRIPT}" || return 1
+  if [[ -n "${LIVE_ACP_VEKIL_LOCAL_IMAGE:-}" ]]; then
+    # A locally built Vekil is published through the run's own registry and
+    # digest-pinned there, so development builds stay immutable end to end.
+    docker image inspect "${LIVE_ACP_VEKIL_LOCAL_IMAGE}" >/dev/null 2>&1 || \
+      live_acp_kind_die "LIVE_ACP_VEKIL_LOCAL_IMAGE is not a local Docker image: ${LIVE_ACP_VEKIL_LOCAL_IMAGE}" || return 1
+  else
+    [[ "${LIVE_ACP_VEKIL_IMAGE}" =~ @sha256:[0-9a-f]{64}$ ]] || \
+      live_acp_kind_die "LIVE_ACP_VEKIL_IMAGE must be digest-pinned" || return 1
+  fi
+  [[ -n "${COPILOT_GITHUB_TOKEN:-}" ]] || \
+    live_acp_kind_die "COPILOT_GITHUB_TOKEN is required; this bootstrap is noninteractive and never starts device-code login" || return 1
+  [[ "${ACP_E2E_OPENCODE_CONTEXT_WINDOW:-}" =~ ^[1-9][0-9]*$ ]] || \
+    live_acp_kind_die "ACP_E2E_OPENCODE_CONTEXT_WINDOW must be a positive integer" || return 1
+  [[ "${ACP_E2E_OPENCODE_MAX_TOKENS:-}" =~ ^[1-9][0-9]*$ ]] || \
+    live_acp_kind_die "ACP_E2E_OPENCODE_MAX_TOKENS must be a positive integer" || return 1
+  (( ACP_E2E_OPENCODE_CONTEXT_WINDOW > ACP_E2E_OPENCODE_MAX_TOKENS )) || \
+    live_acp_kind_die "ACP_E2E_OPENCODE_CONTEXT_WINDOW must exceed ACP_E2E_OPENCODE_MAX_TOKENS" || return 1
+  docker info >/dev/null 2>&1 || live_acp_kind_die "Docker daemon is not reachable" || return 1
+}
+
+live_acp_kind_create_cluster() {
+  local -a args=(create --tag "${LIVE_ACP_KIND_TAG}")
+  if [[ -n "${LIVE_ACP_KIND_CONFIG:-}" ]]; then
+    [[ -f "${LIVE_ACP_KIND_CONFIG}" ]] || live_acp_kind_die "Kind config not found: ${LIVE_ACP_KIND_CONFIG}" || return 1
+    args+=(--config "${LIVE_ACP_KIND_CONFIG}")
+  fi
+
+  # Arm exact-tag deletion before create: Kind can leave a partial cluster even
+  # when its create command returns non-zero.
+  LIVE_ACP_KIND_CREATED=1
+  live_acp_kind_run "${LIVE_ACP_KINDCTL_BIN}" "${args[@]}" || return $?
+  LIVE_ACP_KUBECONFIG="$("${LIVE_ACP_KINDCTL_BIN}" path --tag "${LIVE_ACP_KIND_TAG}")"
+  export KUBECONFIG="${LIVE_ACP_KUBECONFIG}"
+  LIVE_ACP_CONTEXT="$(kubectl config current-context)"
+  [[ "${LIVE_ACP_CONTEXT}" == kind-* ]] || live_acp_kind_die "scoped context is not a Kind context: ${LIVE_ACP_CONTEXT}" || return 1
+  LIVE_ACP_KIND_CLUSTER="${LIVE_ACP_CONTEXT#kind-}"
+  export LIVE_ACP_CONTEXT LIVE_ACP_KIND_CLUSTER LIVE_ACP_KUBECONFIG
+}
+
+live_acp_kind_start_registry() {
+  # shellcheck source=scripts/lib/kind-local-registry.sh
+  . "${LIVE_ACP_REPO_ROOT}/scripts/lib/kind-local-registry.sh"
+
+  orka_kind_registry_start "${LIVE_ACP_KIND_CLUSTER}"
+  LIVE_ACP_REGISTRY_STARTED=1
+
+  if [[ -n "${LIVE_ACP_VEKIL_LOCAL_IMAGE:-}" ]]; then
+    # Publish the development Vekil before the Vekil deploy step so the
+    # deployment references the digest-pinned copy in the run's registry.
+    LIVE_ACP_VEKIL_IMAGE="$(orka_kind_registry_push "${LIVE_ACP_VEKIL_LOCAL_IMAGE}" vekil/vekil)"
+    export LIVE_ACP_VEKIL_IMAGE
+  fi
+}
+
+live_acp_kind_build_and_publish_images() {
+  live_acp_kind_run make -C "${LIVE_ACP_REPO_ROOT}" \
+    IMG="${LIVE_ACP_CONTROLLER_IMAGE}" \
+    ACP_CODEX_RUNTIME_IMG="${LIVE_ACP_CODEX_IMAGE}" \
+    ACP_CLAUDE_RUNTIME_IMG="${LIVE_ACP_CLAUDE_IMAGE}" \
+    ACP_COPILOT_RUNTIME_IMG="${LIVE_ACP_COPILOT_IMAGE}" \
+    ACP_OPENCODE_RUNTIME_IMG="${LIVE_ACP_OPENCODE_IMAGE}" \
+    WORKSPACE_PUBLISHER_IMG="${LIVE_ACP_PUBLISHER_IMAGE}" \
+    GENERAL_WORKER_IMG="${LIVE_ACP_GENERAL_WORKER_IMAGE}" \
+    docker-build docker-build-acp-codex-runtime docker-build-acp-claude-runtime \
+    docker-build-acp-copilot-runtime docker-build-acp-opencode-runtime \
+    docker-build-workspace-publisher docker-build-general-worker
+
+  LIVE_ACP_CONTROLLER_REF="$(orka_kind_registry_push "${LIVE_ACP_CONTROLLER_IMAGE}" orka/controller)"
+  LIVE_ACP_CODEX_REF="$(orka_kind_registry_push "${LIVE_ACP_CODEX_IMAGE}" orka/acp-codex-runtime)"
+  LIVE_ACP_CLAUDE_REF="$(orka_kind_registry_push "${LIVE_ACP_CLAUDE_IMAGE}" orka/acp-claude-runtime)"
+  LIVE_ACP_COPILOT_REF="$(orka_kind_registry_push "${LIVE_ACP_COPILOT_IMAGE}" orka/acp-copilot-runtime)"
+  LIVE_ACP_OPENCODE_REF="$(orka_kind_registry_push "${LIVE_ACP_OPENCODE_IMAGE}" orka/acp-opencode-runtime)"
+  LIVE_ACP_PUBLISHER_REF="$(orka_kind_registry_push "${LIVE_ACP_PUBLISHER_IMAGE}" orka/workspace-publisher)"
+  LIVE_ACP_GENERAL_WORKER_REF="$(orka_kind_registry_push "${LIVE_ACP_GENERAL_WORKER_IMAGE}" orka/general-worker)"
+  export LIVE_ACP_CONTROLLER_REF LIVE_ACP_CODEX_REF LIVE_ACP_CLAUDE_REF LIVE_ACP_COPILOT_REF
+  export LIVE_ACP_OPENCODE_REF LIVE_ACP_PUBLISHER_REF LIVE_ACP_GENERAL_WORKER_REF
+}
+
+live_acp_kind_catalog_model_supports_endpoint() {
+  local models_file="$1"
+  local model="$2"
+  local endpoint="$3"
+  jq -e --arg model "${model}" --arg endpoint "${endpoint}" '
+    def model_entries:
+      (if (.data | type) == "array" then .data else [] end)
+      + (if (.models | type) == "array" then .models else [] end);
+    def model_id:
+      if type == "string" then .
+      elif type == "object" then (.id // .slug // .name // "")
+      else ""
+      end;
+    [
+      model_entries[]
+      | select(model_id == $model)
+      | select(type == "object" and (.supported_endpoints | type) == "array")
+      | .supported_endpoints[]
+      | strings
+      | select(ascii_downcase == ($endpoint | ascii_downcase))
+    ]
+    | length > 0
+  ' "${models_file}" >/dev/null
+}
+
+live_acp_kind_require_model_endpoint() {
+  local models_file="$1"
+  local provider="$2"
+  local model="$3"
+  local endpoint="$4"
+  live_acp_kind_catalog_model_supports_endpoint "${models_file}" "${model}" "${endpoint}" || \
+    live_acp_kind_die "Vekil model ${model} for ${provider} does not advertise required endpoint ${endpoint}"
+}
+
+live_acp_kind_validate_vekil_catalog() {
+  local models_file="$1"
+  local codex_model="${ACP_E2E_CODEX_MODEL:-gpt-5.4}"
+  local claude_model="${ACP_E2E_CLAUDE_MODEL:-claude-sonnet-4.6}"
+  local copilot_model="${ACP_E2E_COPILOT_MODEL:-gpt-5.3-codex}"
+  local opencode_model="${ACP_E2E_OPENCODE_MODEL:-${ACP_E2E_CODEX_MODEL:-gpt-5.4}}"
+  opencode_model="${opencode_model#*/}"
+
+  live_acp_kind_require_model_endpoint "${models_file}" Codex "${codex_model}" /responses || return 1
+  if ! live_acp_kind_catalog_model_supports_endpoint "${models_file}" "${opencode_model}" /chat/completions && \
+      ! live_acp_kind_catalog_model_supports_endpoint "${models_file}" "${opencode_model}" /responses; then
+    live_acp_kind_die \
+      "Vekil model ${opencode_model} for OpenCode does not advertise required endpoint /chat/completions or compatible /responses"
+    return 1
+  fi
+  live_acp_kind_require_model_endpoint "${models_file}" Claude "${claude_model}" /v1/messages || return 1
+  live_acp_kind_require_model_endpoint "${models_file}" Copilot "${copilot_model}" /responses || return 1
+}
+
+live_acp_kind_unused_local_port() {
+  python3 - <<'PY'
+import socket
+
+with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as listener:
+    listener.bind(("127.0.0.1", 0))
+    print(listener.getsockname()[1])
+PY
+}
+
+live_acp_kind_stop_vekil_port_forward() {
+  local pid="${LIVE_ACP_VEKIL_PORT_FORWARD_PID:-}"
+  local log_file="${LIVE_ACP_VEKIL_PORT_FORWARD_LOG:-}"
+  local deadline owned_pid=0 running_child=0
+
+  if [[ "${LIVE_ACP_VEKIL_PORT_FORWARD_OWNED:-0}" == "1" && "${pid}" =~ ^[1-9][0-9]*$ ]] && \
+      (( pid > 1 )); then
+    owned_pid=1
+    if jobs -pr | grep -Fx -- "${pid}" >/dev/null 2>&1; then
+      running_child=1
+    fi
+  fi
+  if [[ "${running_child}" == "1" ]] && kill -0 "${pid}" >/dev/null 2>&1; then
+    kill "${pid}" >/dev/null 2>&1 || true
+    deadline=$((SECONDS + 5))
+    while kill -0 "${pid}" >/dev/null 2>&1 && (( SECONDS < deadline )); do
+      sleep 0.1
+    done
+    if kill -0 "${pid}" >/dev/null 2>&1; then
+      kill -KILL "${pid}" >/dev/null 2>&1 || true
+    fi
+    wait "${pid}" >/dev/null 2>&1 || true
+  elif [[ "${owned_pid}" == "1" ]]; then
+    wait "${pid}" >/dev/null 2>&1 || true
+  fi
+
+  case "${log_file}" in
+    "${LIVE_ACP_SECRET_DIR}"/vekil-port-forward.*) rm -f "${log_file}" ;;
+  esac
+  LIVE_ACP_VEKIL_PORT_FORWARD_PID=""
+  LIVE_ACP_VEKIL_PORT_FORWARD_LOG=""
+  LIVE_ACP_VEKIL_BASE_URL=""
+  LIVE_ACP_VEKIL_PORT_FORWARD_OWNED=0
+}
+
+live_acp_kind_start_vekil_port_forward() {
+  local port deadline
+
+  [[ -z "${LIVE_ACP_VEKIL_PORT_FORWARD_PID:-}" ]] || \
+    live_acp_kind_die "Vekil port-forward is already running" || return 1
+  port="$(live_acp_kind_unused_local_port)" || return 1
+  [[ "${port}" =~ ^[1-9][0-9]*$ ]] || live_acp_kind_die "failed to allocate a local Vekil probe port" || return 1
+
+  LIVE_ACP_VEKIL_PORT_FORWARD_LOG="$(mktemp "${LIVE_ACP_SECRET_DIR}/vekil-port-forward.XXXXXX")"
+  LIVE_ACP_VEKIL_BASE_URL="http://127.0.0.1:${port}"
+  kubectl --context "${LIVE_ACP_CONTEXT}" -n vekil-system port-forward \
+    --address=127.0.0.1 service/vekil "${port}:1337" \
+    >"${LIVE_ACP_VEKIL_PORT_FORWARD_LOG}" 2>&1 &
+  LIVE_ACP_VEKIL_PORT_FORWARD_PID=$!
+  LIVE_ACP_VEKIL_PORT_FORWARD_OWNED=1
+
+  deadline=$((SECONDS + 30))
+  while (( SECONDS < deadline )); do
+    if ! kill -0 "${LIVE_ACP_VEKIL_PORT_FORWARD_PID}" >/dev/null 2>&1; then
+      live_acp_kind_stop_vekil_port_forward
+      live_acp_kind_die "Vekil port-forward exited before becoming ready"
+      return 1
+    fi
+    if curl --fail --silent --show-error --connect-timeout 1 --max-time 2 \
+        -o /dev/null "${LIVE_ACP_VEKIL_BASE_URL}/readyz" >/dev/null 2>&1; then
+      return 0
+    fi
+    sleep 0.25
+  done
+
+  live_acp_kind_stop_vekil_port_forward
+  live_acp_kind_die "timed out waiting for the bounded Vekil port-forward readiness probe"
+  return 1
+}
+
+live_acp_kind_probe_vekil_wire_path() {
+  local provider="$1"
+  local model="$2"
+  local endpoint="$3"
+  local payload payload_file response_file error_file url http_code probe_value="live-acp-preflight"
+  local authorization_header="Authori""zation" api_key_header="x-api-""key"
+  local -a headers
+
+  [[ -n "${LIVE_ACP_VEKIL_BASE_URL:-}" ]] || \
+    live_acp_kind_die "Vekil port-forward is not running for the live wire probe" || return 1
+
+  case "${endpoint}" in
+    /responses)
+      payload="$(jq -cn --arg model "${model}" '{
+        model:$model,
+        input:"Reply with exactly OK.",
+        max_output_tokens:1024,
+        stream:true
+      }')"
+      headers=(
+        --header 'Content-Type: application/json'
+        --header "${authorization_header}: Bearer ${probe_value}"
+      )
+      ;;
+    /messages)
+      payload="$(jq -cn --arg model "${model}" '{
+        model:$model,
+        max_tokens:16,
+        stream:true,
+        messages:[{role:"user",content:"Reply with exactly OK."}]
+      }')"
+      headers=(
+        --header 'Content-Type: application/json'
+        --header "${api_key_header}: ${probe_value}"
+        --header 'anthropic-version: 2023-06-01'
+      )
+      ;;
+    /chat/completions)
+      # Reasoning-family chat models reject the deprecated max_tokens
+      # parameter, so the probe uses max_completion_tokens.
+      payload="$(jq -cn --arg model "${model}" '{
+        model:$model,
+        max_completion_tokens:16,
+        stream:true,
+        messages:[{role:"user",content:"Reply with exactly OK."}]
+      }')"
+      headers=(
+        --header 'Content-Type: application/json'
+        --header "${authorization_header}: Bearer ${probe_value}"
+      )
+      ;;
+    *)
+      live_acp_kind_die "unsupported Vekil preflight endpoint: ${endpoint}"
+      return 1
+      ;;
+  esac
+
+  url="${LIVE_ACP_VEKIL_BASE_URL}/v1${endpoint}"
+  payload_file="$(mktemp "${LIVE_ACP_SECRET_DIR}/vekil-wire-payload.XXXXXX")"
+  response_file="$(mktemp "${LIVE_ACP_SECRET_DIR}/vekil-wire-response.XXXXXX")"
+  error_file="$(mktemp "${LIVE_ACP_SECRET_DIR}/vekil-wire-probe.XXXXXX")"
+  printf '%s\n' "${payload}" >"${payload_file}"
+  if ! http_code="$(curl --silent --show-error --no-buffer --connect-timeout 5 --max-time 120 \
+      -o "${response_file}" --write-out '%{http_code}' "${headers[@]}" \
+      --data-binary "@${payload_file}" "${url}" 2>"${error_file}")"; then
+    rm -f "${payload_file}" "${response_file}" "${error_file}"
+    live_acp_kind_die "Vekil ${endpoint} live probe rejected configured ${provider} model ${model}"
+    return 1
+  fi
+  case "${http_code}" in
+    2??) ;;
+    *)
+      rm -f "${payload_file}" "${response_file}" "${error_file}"
+      live_acp_kind_die "Vekil ${endpoint} live probe rejected configured ${provider} model ${model}"
+      return 1
+      ;;
+  esac
+  case "${endpoint}" in
+    /responses)
+      if grep -Eq '^event: (error|response\.failed|response\.incomplete)$|"type":"(error|response\.failed|response\.incomplete)"' \
+          "${response_file}" || \
+          ! grep -Eq '^event: response\.completed$|"type":"response\.completed"' "${response_file}"; then
+        rm -f "${payload_file}" "${response_file}" "${error_file}"
+        live_acp_kind_die "Vekil ${endpoint} live probe did not complete configured ${provider} model ${model} successfully"
+        return 1
+      fi
+      ;;
+    /messages)
+      if grep -Eq '^event: error$|"type":"error"' "${response_file}" || \
+          ! grep -Eq '^event: message_stop$|"type":"message_stop"' "${response_file}"; then
+        rm -f "${payload_file}" "${response_file}" "${error_file}"
+        live_acp_kind_die "Vekil ${endpoint} live probe did not complete configured ${provider} model ${model} successfully"
+        return 1
+      fi
+      ;;
+    /chat/completions)
+      if grep -Eq '^data: .*"error"' "${response_file}" || \
+          ! grep -Fx 'data: [DONE]' "${response_file}" >/dev/null; then
+        rm -f "${payload_file}" "${response_file}" "${error_file}"
+        live_acp_kind_die "Vekil ${endpoint} live probe did not complete configured ${provider} model ${model} successfully"
+        return 1
+      fi
+      ;;
+  esac
+  rm -f "${payload_file}" "${response_file}" "${error_file}"
+}
+
+live_acp_kind_probe_configured_models() {
+  local codex_model="${ACP_E2E_CODEX_MODEL:-gpt-5.4}"
+  local claude_model="${ACP_E2E_CLAUDE_MODEL:-claude-sonnet-4.6}"
+  local copilot_model="${ACP_E2E_COPILOT_MODEL:-gpt-5.3-codex}"
+  local opencode_model="${ACP_E2E_OPENCODE_MODEL:-${ACP_E2E_CODEX_MODEL:-gpt-5.4}}"
+  opencode_model="${opencode_model#*/}"
+  local status=0
+
+  live_acp_kind_log "Probing configured provider models through their live Vekil streaming wire paths"
+  live_acp_kind_start_vekil_port_forward || return 1
+  if ! live_acp_kind_probe_vekil_wire_path Codex "${codex_model}" /responses; then
+    status=1
+  elif ! live_acp_kind_probe_vekil_wire_path OpenCode "${opencode_model}" /chat/completions; then
+    status=1
+  elif ! live_acp_kind_probe_vekil_wire_path Claude "${claude_model}" /messages; then
+    status=1
+  elif [[ "${copilot_model}" != "${codex_model}" ]] && \
+      ! live_acp_kind_probe_vekil_wire_path Copilot "${copilot_model}" /responses; then
+    status=1
+  fi
+  live_acp_kind_stop_vekil_port_forward
+  return "${status}"
+}
+
+live_acp_kind_deploy_vekil() {
+  live_acp_kind_log "Deploying digest-pinned Vekil with noninteractive Secret-backed Copilot auth"
+  "${LIVE_ACP_VEKIL_DEPLOY_SCRIPT}" \
+    --context "${LIVE_ACP_CONTEXT}" \
+    --namespace vekil-system \
+    --name vekil \
+    --image "${LIVE_ACP_VEKIL_IMAGE}" \
+    --image-pull-policy IfNotPresent \
+    --create-copilot-token-secret live-acp-runtime-copilot:token \
+    --timeout "${LIVE_ACP_ROLLOUT_TIMEOUT}"
+
+  local models_file="${LIVE_ACP_SECRET_DIR}/vekil-models.json"
+  live_acp_kind_log "Validating configured provider models and required endpoints through the Vekil Service"
+  kubectl --context "${LIVE_ACP_CONTEXT}" get --raw \
+    /api/v1/namespaces/vekil-system/services/http:vekil:1337/proxy/v1/models >"${models_file}"
+  live_acp_kind_validate_vekil_catalog "${models_file}" || return 1
+  live_acp_kind_probe_configured_models
+}
+
+live_acp_kind_deploy_orka() {
+  live_acp_kind_log "Installing current CRDs"
+  live_acp_kind_run make -C "${LIVE_ACP_REPO_ROOT}" install
+
+  live_acp_kind_run kubectl wait --for=condition=Established \
+    crd/runtimepools.core.orka.ai crd/promptattempts.core.orka.ai \
+    crd/runtimesessioncontrols.core.orka.ai crd/branchclaims.core.orka.ai \
+    crd/publications.core.orka.ai crd/controllerepochs.core.orka.ai \
+    crd/externaleffects.core.orka.ai --timeout="${LIVE_ACP_ROLLOUT_TIMEOUT}"
+
+  live_acp_kind_log "Bootstrapping test-only admission TLS"
+  orka_e2e_bootstrap_admission_tls
+
+  live_acp_kind_log "Deploying digest-pinned Orka ACP workloads"
+  live_acp_kind_run make -C "${LIVE_ACP_REPO_ROOT}" deploy \
+    IMG="${LIVE_ACP_CONTROLLER_REF}" \
+    ACP_CODEX_RUNTIME_IMG="${LIVE_ACP_CODEX_REF}" \
+    ACP_CLAUDE_RUNTIME_IMG="${LIVE_ACP_CLAUDE_REF}" \
+    ACP_COPILOT_RUNTIME_IMG="${LIVE_ACP_COPILOT_REF}" \
+    ACP_OPENCODE_RUNTIME_IMG="${LIVE_ACP_OPENCODE_REF}" \
+    WORKSPACE_PUBLISHER_IMG="${LIVE_ACP_PUBLISHER_REF}" \
+    GENERAL_WORKER_IMG="${LIVE_ACP_GENERAL_WORKER_REF}"
+
+  local deployment
+  for deployment in orka-controller-manager orka-workspace-publisher orka-provider-auth-proxy orka-scm-egress-proxy; do
+    live_acp_kind_run kubectl -n orka-system rollout status "deployment/${deployment}" --timeout="${LIVE_ACP_ROLLOUT_TIMEOUT}"
+  done
+}
+
+
+live_acp_kind_create_release_credentials() {
+  live_acp_kind_enabled "${RELEASE_GATE:-0}" || return 0
+
+  local namespace="orka-system" key="token" role env_name secret_name token_file
+  local -a roles=(read target-read write forge)
+  local -a env_names=(
+    ACP_E2E_WRITE_READ_CREDENTIAL_TOKEN
+    ACP_E2E_WRITE_TARGET_READ_CREDENTIAL_TOKEN
+    ACP_E2E_WRITE_CREDENTIAL_TOKEN
+    ACP_E2E_WRITE_FORGE_CREDENTIAL_TOKEN
+  )
+  local -a secret_names=(
+    live-acp-source-read
+    live-acp-target-read
+    live-acp-target-write
+    live-acp-forge
+  )
+
+  live_acp_kind_log "Creating four role-separated release-gate credential Secrets"
+  for role in "${!roles[@]}"; do
+    env_name="${env_names[$role]}"
+    secret_name="${secret_names[$role]}"
+    token_file="${LIVE_ACP_SECRET_DIR}/${secret_name}"
+    printf '%s' "${!env_name}" >"${token_file}"
+    chmod 600 "${token_file}"
+    kubectl -n "${namespace}" create secret generic "${secret_name}" \
+      --from-file="${key}=${token_file}" --dry-run=client -o yaml | kubectl apply -f - >/dev/null
+    rm -f "${token_file}"
+  done
+
+  printf -v ACP_E2E_WRITE_READ_CREDENTIAL_SECRET '%s' "${secret_names[0]}"
+  export ACP_E2E_WRITE_READ_CREDENTIAL_NAMESPACE="${namespace}"
+  printf -v ACP_E2E_WRITE_TARGET_READ_CREDENTIAL_SECRET '%s' "${secret_names[1]}"
+  export ACP_E2E_WRITE_TARGET_READ_CREDENTIAL_NAMESPACE="${namespace}"
+  printf -v ACP_E2E_WRITE_CREDENTIAL_SECRET '%s' "${secret_names[2]}"
+  export ACP_E2E_WRITE_CREDENTIAL_NAMESPACE="${namespace}"
+  printf -v ACP_E2E_WRITE_FORGE_CREDENTIAL_SECRET '%s' "${secret_names[3]}"
+  export ACP_E2E_WRITE_FORGE_CREDENTIAL_NAMESPACE="${namespace}"
+  export ACP_E2E_WRITE_READ_CREDENTIAL_SECRET ACP_E2E_WRITE_TARGET_READ_CREDENTIAL_SECRET
+  export ACP_E2E_WRITE_CREDENTIAL_SECRET ACP_E2E_WRITE_FORGE_CREDENTIAL_SECRET
+}
+
+live_acp_kind_bootstrap() {
+  live_acp_kind_create_cluster
+  live_acp_kind_start_registry
+  live_acp_kind_deploy_vekil
+  live_acp_kind_build_and_publish_images
+  live_acp_kind_deploy_orka
+  live_acp_kind_create_release_credentials
+}
+
+live_acp_kind_cleanup() {
+  local status="${1:-0}"
+  local cleanup_status=0
+  set +e
+  live_acp_kind_stop_vekil_port_forward >/dev/null 2>&1 || cleanup_status=1
+  if [[ -n "${LIVE_ACP_SECRET_DIR:-}" ]]; then
+    rm -rf -- "${LIVE_ACP_SECRET_DIR}" >/dev/null 2>&1 || cleanup_status=1
+  fi
+  if [[ "${LIVE_ACP_KEEP_CLUSTER:-0}" == "1" ]]; then
+    live_acp_kind_log "Keeping Kind cluster ${LIVE_ACP_KIND_CLUSTER:-<not-created>} (ACP_E2E_KEEP_CLUSTER=1)"
+    return "${status}"
+  fi
+  if [[ "${LIVE_ACP_REGISTRY_STARTED:-0}" == "1" ]]; then
+    # shellcheck source=scripts/lib/kind-local-registry.sh
+    . "${LIVE_ACP_REPO_ROOT}/scripts/lib/kind-local-registry.sh"
+    orka_kind_registry_stop "${LIVE_ACP_KIND_CLUSTER:-}" || cleanup_status=1
+  fi
+  if [[ "${LIVE_ACP_KIND_CREATED:-0}" == "1" ]]; then
+    "${LIVE_ACP_KINDCTL_BIN}" delete --tag "${LIVE_ACP_KIND_TAG}" || cleanup_status=1
+  fi
+  if (( status != 0 )); then
+    return "${status}"
+  fi
+  return "${cleanup_status}"
+}
diff --git a/scripts/lib/redact.sh b/scripts/lib/redact.sh
new file mode 100644
index 000000000..07864c99b
--- /dev/null
+++ b/scripts/lib/redact.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Shared secret redaction for E2E diagnostics output.
+# Source this file; do not execute it.
+#
+# redact reads stdin and writes a redacted copy to stdout. The pattern set is
+# the union of every redaction previously maintained by the individual E2E
+# scripts (auth/cookie/API-key headers, Bearer/Basic values, GitHub
+# gh*_/github_pat_ tokens, token/api-key assignments, env-style token and
+# webhook-secret assignments, JSON name/value credential pairs, webhook
+# signatures, and JWTs). It intentionally over-redacts: when a header or
+# token-like assignment is seen, the remainder of the line is dropped.
+#
+# Callers that hold literal secret values can list the NAMES of the shell
+# variables carrying them in the ORKA_REDACT_SECRET_VARS array, for example:
+#   ORKA_REDACT_SECRET_VARS=(webhook_secret)
+# The value of each named variable is read at call time, so variables that are
+# assigned or rotated after sourcing are still redacted.
+
+redact() {
+  local text var value
+  text="$(cat)"
+  for var in ${ORKA_REDACT_SECRET_VARS[@]+"${ORKA_REDACT_SECRET_VARS[@]}"}; do
+    value="${!var:-}"
+    if [[ -n "${value}" ]]; then
+      text="${text//"${value}"/[REDACTED]}"
+    fi
+  done
+  printf '%s\n' "${text}" | sed -E \
+    -e 's/((^|[^[:alnum:]_-])(Authorization|Proxy-Authorization|Cookie|Set-Cookie|X-API-Key|API-Key|[A-Za-z0-9_-]*Token)[[:space:]"'\'']*[:=][[:space:]"'\'']*).*/\1[REDACTED]/I' \
+    -e 's/((Bearer|Basic)[[:space:]]+).*/\1[REDACTED]/I' \
+    -e 's/("name":[[:space:]]*"[A-Za-z0-9_-]*(TOKEN|SECRET|KEY|PASSWORD)[A-Za-z0-9_-]*",[[:space:]]*"value":[[:space:]]*")[^"]*/\1[REDACTED]/Ig' \
+    -e 's/(X-Hub-Signature-256:[[:space:]]*sha256=)[A-Fa-f0-9]+/\1[REDACTED_SIGNATURE]/g' \
+    -e 's/(ORKA_GITHUB_WEBHOOK_SECRET=)[^[:space:]]+/\1[REDACTED_WEBHOOK_SECRET]/g' \
+    -e 's/(ACTIONS_ID_TOKEN_REQUEST_TOKEN=)[^[:space:]]+/\1[REDACTED]/g' \
+    -e 's/gh[opusr]_[A-Za-z0-9_]+/[REDACTED_GITHUB_TOKEN]/g' \
+    -e 's/github_pat_[A-Za-z0-9_]+/[REDACTED_GITHUB_TOKEN]/g' \
+    -e 's/(api[_-]?key[=:][[:space:]]*)[A-Za-z0-9._~+\/=:-]+/\1[REDACTED]/Ig' \
+    -e 's/(token[=:][[:space:]]*)[A-Za-z0-9._~+\/=:-]+/\1[REDACTED]/Ig' \
+    -e 's/eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{10,}/[REDACTED-JWT]/g'
+}
diff --git a/scripts/live-acp-runtime-e2e.sh b/scripts/live-acp-runtime-e2e.sh
new file mode 100755
index 000000000..7833d6e08
--- /dev/null
+++ b/scripts/live-acp-runtime-e2e.sh
@@ -0,0 +1,3470 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=scripts/lib/e2e-common.sh
+. "${script_dir}/lib/e2e-common.sh"
+# shellcheck source=scripts/lib/redact.sh
+. "${script_dir}/lib/redact.sh"
+
+usage() {
+  cat <<'USAGE'
+Usage: scripts/live-acp-runtime-e2e.sh --context CONTEXT [--namespace NAMESPACE]
+
+Validates an already deployed ACP v2 Orka installation without printing Secret
+material. The kubectl context is required and is passed to every kubectl call.
+
+Modes:
+  Smoke (default)       Read/status/concurrency/cancel/restart/replacement checks.
+                        The final message explicitly reports incomplete release
+                        coverage when release-only scenarios are skipped.
+  RELEASE_GATE=1        Destructive release-acceptance mode. In addition to the
+                        smoke checks it requires API result/fork validation,
+                        write publication to a distinct GitHub fork, PR and remote
+                        verification, drain/scale-to-zero/recovery, and immutable
+                        image verification for every ACP workload.
+
+Common environment:
+  ACP_E2E_NAMESPACE                  Unique test namespace
+  ACP_E2E_KEEP_RESOURCES=1           Preserve Kubernetes resources after the run
+  ACP_E2E_REPO                       Public GitHub read repository URL
+  ACP_E2E_REF                        Immutable read repository commit SHA
+  ACP_E2E_CODEX_MODEL                Codex model (default: gpt-5.4)
+  ACP_E2E_CLAUDE_MODEL               Claude model (default: claude-sonnet-4.6)
+  ACP_E2E_OPENCODE_MODEL             OpenCode model (default: ACP_E2E_CODEX_MODEL)
+  ACP_E2E_OPENCODE_CONTEXT_WINDOW    Reviewed OpenCode model context capacity (required)
+  ACP_E2E_OPENCODE_MAX_TOKENS        Reviewed OpenCode model output limit (required)
+  ACP_E2E_COPILOT_MODEL              Copilot model (default: gpt-5.3-codex)
+  ACP_E2E_CONCURRENCY_TASKS          Concurrent Codex task count (default: 6)
+  ACP_E2E_REQUIRE_PARALLEL=1         Require >=2 running prompts in smoke; release always requires it
+  ACP_E2E_BLOCKING_PROMPT            Prompt that remains Running long enough to cancel
+  ACP_E2E_TIMEOUT_DURATION           Task timeout; Running must be observed before expiry (default: 90s)
+  ACP_E2E_CANCEL_SETTLE_SECONDS      Explicit-cancel settlement bound (default: 120)
+  ACP_E2E_WAIT_SECONDS               Terminal wait bound (default: 900)
+  ACP_E2E_STATE_WAIT_SECONDS         State transition wait bound (default: 300)
+
+RELEASE_GATE=1 requires:
+  ACP_E2E_WRITE_SOURCE_REPO          HTTPS github.com source repository
+  ACP_E2E_WRITE_PUBLICATION_REPO     Distinct GitHub fork of the source repository
+  ACP_E2E_WRITE_SOURCE_REF           Full source SHA; must equal the PR base-branch head
+  ACP_E2E_WRITE_CREDENTIAL_SECRET    Source Secret containing publication authority
+  ACP_E2E_WRITE_CREDENTIAL_NAMESPACE Source Secret namespace
+  ACP_E2E_WRITE_READ_CREDENTIAL_SECRET and namespace
+  ACP_E2E_WRITE_TARGET_READ_CREDENTIAL_SECRET and namespace
+  ACP_E2E_WRITE_FORGE_CREDENTIAL_SECRET and namespace
+  ACP_E2E_WRITE_CREATE_PR=1          Mandatory in release-gate mode
+
+Release-gate write settings:
+  ACP_E2E_WRITE_CREDENTIAL_KEY       Source Secret key (default: token)
+  ACP_E2E_WRITE_READ_CREDENTIAL_SECRET
+  ACP_E2E_WRITE_READ_CREDENTIAL_NAMESPACE
+  ACP_E2E_WRITE_READ_CREDENTIAL_KEY  Source clone Secret key (default: token)
+  ACP_E2E_WRITE_TARGET_READ_CREDENTIAL_SECRET
+  ACP_E2E_WRITE_TARGET_READ_CREDENTIAL_NAMESPACE
+  ACP_E2E_WRITE_TARGET_READ_CREDENTIAL_KEY  Target preflight/verify key (default: token)
+  ACP_E2E_WRITE_FORGE_CREDENTIAL_SECRET
+  ACP_E2E_WRITE_FORGE_CREDENTIAL_NAMESPACE
+  ACP_E2E_WRITE_FORGE_CREDENTIAL_KEY  Forge PR key (default: token)
+  ACP_E2E_WRITE_BRANCH               Unique branch; default includes the run ID
+  ACP_E2E_WRITE_PR_BASE              Base branch (default: main)
+  ACP_E2E_WRITE_PROMPT               Override the exact-one-file publication prompt
+  ACP_E2E_API_LOCAL_PORT             Local controller port-forward port (default: run-scoped)
+
+Workload discovery overrides:
+  ORKA_NAMESPACE                     Controller namespace (default: orka-system)
+  ORKA_ACP_RUNTIME_NAMESPACE         Default runtime namespace (default: orka-runtimes)
+  ORKA_CONTROLLER_DEPLOYMENT         Controller Deployment (default: orka-controller-manager)
+  ORKA_CONTROLLER_CONTAINER          Controller container name (auto-detected)
+  ORKA_CONTROLLER_API_PORT           Controller API container port (default: 8080)
+  ORKA_PUBLISHER_DEPLOYMENT          Publisher Deployment (default: orka-workspace-publisher)
+  ORKA_PUBLISHER_CONTAINER           Publisher container name (auto-detected)
+  ORKA_PROVIDER_PROXY_DEPLOYMENT     Provider proxy Deployment (default: orka-provider-auth-proxy)
+  ORKA_PROVIDER_PROXY_CONTAINER      Provider proxy container name (auto-detected)
+  ORKA_SCM_EGRESS_PROXY_DEPLOYMENT   SCM proxy Deployment (default: orka-scm-egress-proxy)
+  ORKA_SCM_EGRESS_PROXY_CONTAINER    SCM proxy container name (auto-detected)
+
+Release-gate local requirements:
+  - gh authenticated to github.com with read access to both repositories and
+    permission to close the created PR and delete the run branch.
+  - git, curl, docker buildx, jq, kubectl, and shell tools.
+  - Permission to create/delete the test namespace, copy the named credential
+    Secret key, delete Tasks, patch Task metadata and RuntimePools, restart the controller,
+    create a namespaced ServiceAccount/Role, inspect Pods/PVCs, and impersonate
+    the Publisher ServiceAccount for `kubectl auth can-i` checks.
+
+Remote cleanup is fail-closed. The branch is deleted only with an exact-head
+--force-with-lease. If publication state or the remote head is ambiguous, the
+script preserves Kubernetes resources and remote effects for investigation.
+USAGE
+}
+
+# Timestamped override of the shared log helper for long-running live runs.
+log() {
+  printf '\n[%s] %s\n' "$(date -u +%H:%M:%S)" "$*" >&2
+}
+
+run_redacted() {
+  set +e
+  "$@" 2>&1 | redact
+  local rc=${PIPESTATUS[0]}
+  set -e
+  return "${rc}"
+}
+
+sanitize_name() {
+  local value
+  value="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]' | tr -c 'a-z0-9-' '-')"
+  value="${value#-}"
+  value="${value%-}"
+  value="$(printf '%s' "${value}" | cut -c1-63)"
+  value="${value%-}"
+  [[ -n "${value}" ]] || value="acp-e2e"
+  printf '%s\n' "${value}"
+}
+
+bool_env() {
+  case "${1:-}" in
+    1|true|TRUE|yes|YES) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+is_uint() {
+  [[ "${1:-}" =~ ^(0|[1-9][0-9]*)$ ]]
+}
+
+is_sha() {
+  [[ "${1:-}" =~ ^([a-fA-F0-9]{40}|[a-fA-F0-9]{64})$ ]]
+}
+
+lower() {
+  printf '%s' "$1" | tr '[:upper:]' '[:lower:]'
+}
+
+duration_seconds() {
+  local value="$1"
+  local amount unit
+  [[ "${value}" =~ ^([1-9][0-9]*)(s|m|h)$ ]] || return 1
+  amount="${BASH_REMATCH[1]}"
+  unit="${BASH_REMATCH[2]}"
+  case "${unit}" in
+    s) printf '%s\n' "$((10#${amount}))" ;;
+    m) printf '%s\n' "$((10#${amount} * 60))" ;;
+    h) printf '%s\n' "$((10#${amount} * 3600))" ;;
+  esac
+}
+
+context=""
+namespace_arg=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --context)
+      [[ $# -ge 2 ]] || die "--context requires a value"
+      context="$2"
+      shift 2
+      ;;
+    --namespace)
+      [[ $# -ge 2 ]] || die "--namespace requires a value"
+      namespace_arg="$2"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      die "unknown argument: $1"
+      ;;
+  esac
+done
+
+[[ -n "${context}" ]] || die "--context is required"
+
+for command in kubectl jq awk sed grep cut tr sort date mktemp; do
+  require_cmd "${command}"
+done
+
+release_gate=0
+if bool_env "${RELEASE_GATE:-0}"; then
+  release_gate=1
+fi
+
+run_id_full="$(sanitize_name "${ACP_E2E_RUN_ID:-$(date -u +%Y%m%d%H%M%S)-$$}")"
+run_id="$(printf '%s' "${run_id_full}" | cut -c1-24)"
+if [[ "${run_id}" != "${run_id_full}" ]]; then
+  warn "ACP_E2E_RUN_ID was normalized to 24 characters to preserve unique resource-name suffixes: ${run_id}"
+fi
+namespace="${namespace_arg:-${ACP_E2E_NAMESPACE:-orka-acp-e2e-${run_id}}}"
+namespace="$(sanitize_name "${namespace}")"
+orka_namespace="${ORKA_NAMESPACE:-orka-system}"
+runtime_namespace="${ORKA_ACP_RUNTIME_NAMESPACE:-orka-runtimes}"
+controller_deployment="${ORKA_CONTROLLER_DEPLOYMENT:-orka-controller-manager}"
+publisher_deployment="${ORKA_PUBLISHER_DEPLOYMENT:-orka-workspace-publisher}"
+provider_proxy_deployment="${ORKA_PROVIDER_PROXY_DEPLOYMENT:-orka-provider-auth-proxy}"
+scm_proxy_deployment="${ORKA_SCM_EGRESS_PROXY_DEPLOYMENT:-orka-scm-egress-proxy}"
+controller_container_override="${ORKA_CONTROLLER_CONTAINER:-}"
+controller_api_port="${ORKA_CONTROLLER_API_PORT:-8080}"
+publisher_container_override="${ORKA_PUBLISHER_CONTAINER:-}"
+provider_proxy_container_override="${ORKA_PROVIDER_PROXY_CONTAINER:-}"
+scm_proxy_container_override="${ORKA_SCM_EGRESS_PROXY_CONTAINER:-}"
+repo_url="${ACP_E2E_REPO:-https://github.com/orka-agents/orka.git}"
+repo_ref="${ACP_E2E_REF:-d03acb995b6014a6e855181c50b922b65ea8e7ff}"
+codex_model="${ACP_E2E_CODEX_MODEL:-gpt-5.4}"
+claude_model="${ACP_E2E_CLAUDE_MODEL:-claude-sonnet-4.6}"
+if [[ -n "${ACP_E2E_OPENCODE_MODEL:-}" ]]; then
+  opencode_model="${ACP_E2E_OPENCODE_MODEL}"
+else
+  opencode_model="${codex_model}"
+fi
+if [[ "${opencode_model}" != */* ]]; then
+  opencode_model="openai/${opencode_model}"
+fi
+opencode_context_window="${ACP_E2E_OPENCODE_CONTEXT_WINDOW:-}"
+opencode_max_tokens="${ACP_E2E_OPENCODE_MAX_TOKENS:-}"
+copilot_model="${ACP_E2E_COPILOT_MODEL:-gpt-5.3-codex}"
+concurrency_tasks="${ACP_E2E_CONCURRENCY_TASKS:-6}"
+wait_seconds="${ACP_E2E_WAIT_SECONDS:-900}"
+state_wait_seconds="${ACP_E2E_STATE_WAIT_SECONDS:-300}"
+keep_resources="${ACP_E2E_KEEP_RESOURCES:-0}"
+require_parallel="${ACP_E2E_REQUIRE_PARALLEL:-1}"
+timeout_duration="${ACP_E2E_TIMEOUT_DURATION:-90s}"
+cancel_settle_seconds="${ACP_E2E_CANCEL_SETTLE_SECONDS:-120}"
+blocking_prompt="${ACP_E2E_BLOCKING_PROMPT:-Immediately use the Bash tool to run sleep 180. Do not return a final answer before the command completes. Do not modify repository files.}"
+long_prompt="${ACP_E2E_LONG_PROMPT:-Read LICENSE, NOTICE.md, go.mod, Makefile, and the first ten Go source files you find. Compare their purpose and provide a detailed evidence-backed summary. Do not modify files.}"
+api_local_port="${ACP_E2E_API_LOCAL_PORT:-$((20000 + ($$ % 20000)))}"
+
+is_uint "${opencode_context_window}" || die "ACP_E2E_OPENCODE_CONTEXT_WINDOW must be a positive integer"
+is_uint "${opencode_max_tokens}" || die "ACP_E2E_OPENCODE_MAX_TOKENS must be a positive integer"
+(( opencode_context_window > opencode_max_tokens )) || \
+  die "ACP_E2E_OPENCODE_CONTEXT_WINDOW must exceed ACP_E2E_OPENCODE_MAX_TOKENS"
+is_uint "${concurrency_tasks}" || die "ACP_E2E_CONCURRENCY_TASKS must be an integer without leading zeros"
+(( concurrency_tasks >= 2 )) || die "ACP_E2E_CONCURRENCY_TASKS must be at least 2"
+is_uint "${wait_seconds}" || die "ACP_E2E_WAIT_SECONDS must be an integer without leading zeros"
+is_uint "${state_wait_seconds}" || die "ACP_E2E_STATE_WAIT_SECONDS must be an integer without leading zeros"
+is_uint "${api_local_port}" || die "ACP_E2E_API_LOCAL_PORT must be an integer without leading zeros"
+(( api_local_port > 0 && api_local_port < 65536 )) || die "ACP_E2E_API_LOCAL_PORT must be between 1 and 65535"
+is_uint "${controller_api_port}" || die "ORKA_CONTROLLER_API_PORT must be an integer without leading zeros"
+(( controller_api_port > 0 && controller_api_port < 65536 )) || die "ORKA_CONTROLLER_API_PORT must be between 1 and 65535"
+is_uint "${cancel_settle_seconds}" || die "ACP_E2E_CANCEL_SETTLE_SECONDS must be an integer without leading zeros"
+(( cancel_settle_seconds > 0 && cancel_settle_seconds < 3600 )) || \
+  die "ACP_E2E_CANCEL_SETTLE_SECONDS must be positive and shorter than the 1h Task timeout"
+timeout_duration_seconds="$(duration_seconds "${timeout_duration}")" || \
+  die "ACP_E2E_TIMEOUT_DURATION must be a positive integer followed by s, m, or h"
+
+if [[ "${release_gate}" -eq 1 ]]; then
+  for command in curl gh git docker cmp; do
+    require_cmd "${command}"
+  done
+  is_sha "${repo_ref}" || die "RELEASE_GATE=1 requires ACP_E2E_REF to be a full immutable commit SHA"
+fi
+
+k() {
+  kubectl --context "${context}" "$@"
+}
+
+resource_exists() {
+  k "$@" >/dev/null 2>&1
+}
+
+auth_can_i() {
+  local output decision rc error_file
+  error_file="$(mktemp "${temp_root}/auth-can-i.XXXXXX")"
+  if output="$(k auth can-i "$@" 2>"${error_file}")"; then
+    rc=0
+  else
+    rc=$?
+  fi
+  if [[ "${rc}" -ne 0 && "${rc}" -ne 1 ]]; then
+    cat "${error_file}" | redact >&2
+    rm -f "${error_file}"
+    return "${rc}"
+  fi
+  rm -f "${error_file}"
+  output="${output//$'\r'/}"
+  decision="$(printf '%s\n' "${output}" | awk '
+    { gsub(/^[[:space:]]+|[[:space:]]+$/, "") }
+    $0 == "yes" || $0 == "no" { print }
+  ')"
+  case "${decision}" in
+    yes|no) printf '%s\n' "${decision}" ;;
+    *)
+      warn "kubectl auth can-i returned no unique yes/no decision"
+      return 1
+      ;;
+  esac
+}
+wait_until() {
+  local description="$1"
+  local timeout="$2"
+  shift 2
+  local deadline=$((SECONDS + timeout))
+  while (( SECONDS < deadline )); do
+    if "$@" >/dev/null 2>&1; then
+      return 0
+    fi
+    sleep 2
+  done
+  printf 'error: timed out waiting for %s\n' "${description}" >&2
+  return 1
+}
+
+wait_until_fast() {
+  local description="$1"
+  local timeout="$2"
+  shift 2
+  local deadline=$((SECONDS + timeout))
+  while (( SECONDS < deadline )); do
+    if "$@" >/dev/null 2>&1; then
+      return 0
+    fi
+    sleep 0.25
+  done
+  printf 'error: timed out waiting for %s\n' "${description}" >&2
+  return 1
+}
+
+temp_root="$(mktemp -d "${TMPDIR:-/tmp}/orka-acp-e2e.XXXXXX")"
+chmod 700 "${temp_root}"
+namespace_create_attempted=0
+namespace_created=0
+namespace_shared=0
+namespace_uid=""
+api_forward_pid=""
+api_token_file="${temp_root}/api-token"
+api_auth_header_file="${temp_root}/api-auth-header"
+api_forward_log="${temp_root}/api-port-forward.log"
+gh_token_file="${temp_root}/gh-token"
+git_askpass_file="${temp_root}/git-askpass.sh"
+git_observer_repo="${temp_root}/observer.git"
+remote_cleanup_required=0
+remote_cleanup_head=""
+remote_cleanup_pr_number=""
+remote_cleanup_preserve=0
+remote_cleanup_branch=""
+remote_cleanup_publication_repo=""
+remote_cleanup_publication_slug=""
+remote_cleanup_source_slug=""
+remote_cleanup_pr_base=""
+write_task_name=""
+write_task_started=0
+write_task_observer_uid=""
+task_observer_finalizer="acp-e2e.orka.ai/cancellation-observer"
+runtime_namespaces_seen=("${runtime_namespace}")
+
+record_runtime_namespace() {
+  local candidate="$1"
+  local existing
+  [[ -n "${candidate}" ]] || return 0
+  for existing in "${runtime_namespaces_seen[@]}"; do
+    [[ "${existing}" == "${candidate}" ]] && return 0
+  done
+  runtime_namespaces_seen+=("${candidate}")
+}
+
+namespace_probe_state=""
+namespace_probe_file=""
+probe_namespace() {
+  local target="$1"
+  local output_file="${temp_root}/namespace-probe.json"
+  local error_file="${temp_root}/namespace-probe.err"
+  local rc=0
+  namespace_probe_state=""
+  namespace_probe_file="${output_file}"
+  if k get namespace "${target}" -o json --ignore-not-found >"${output_file}" 2>"${error_file}"; then
+    rc=0
+  else
+    rc=$?
+  fi
+  if [[ "${rc}" -ne 0 ]]; then
+    namespace_probe_state="error"
+    cat "${error_file}" | redact >&2
+    return 1
+  fi
+  if [[ -s "${output_file}" ]]; then
+    namespace_probe_state="present"
+  else
+    namespace_probe_state="absent"
+  fi
+}
+
+recover_namespace_ownership() {
+  if [[ "${namespace_created}" -eq 1 && -n "${namespace_uid}" ]]; then
+    return 0
+  fi
+  [[ "${namespace_create_attempted}" -eq 1 ]] || return 0
+  probe_namespace "${namespace}" || return 1
+  if [[ "${namespace_probe_state}" == "absent" ]]; then
+    namespace_create_attempted=0
+    return 0
+  fi
+  if ! jq -e --arg run "${run_id}" '
+      .metadata.labels["orka.ai/acp-e2e-run"] == $run
+      and .metadata.labels["app.kubernetes.io/managed-by"] == "live-acp-runtime-e2e"
+    ' "${namespace_probe_file}" >/dev/null; then
+    warn "namespace/${namespace} exists but is not owned by this release-gate run; refusing deletion"
+    return 1
+  fi
+  namespace_uid="$(jq -r '.metadata.uid // ""' "${namespace_probe_file}")"
+  [[ -n "${namespace_uid}" ]] || return 1
+  namespace_created=1
+}
+
+wait_namespace_deleted() {
+  probe_namespace "${namespace}" || return 1
+  [[ "${namespace_probe_state}" == "absent" ]]
+}
+
+runtime_children_for_test_namespace() {
+  local ns
+  for ns in "${runtime_namespaces_seen[@]}"; do
+    probe_namespace "${ns}" || return 1
+    if [[ "${namespace_probe_state}" == "absent" ]]; then
+      continue
+    fi
+    k -n "${ns}" get deployment,replicaset,pod,service,secret,configmap,serviceaccount,role,rolebinding,networkpolicy,poddisruptionbudget,persistentvolumeclaim \
+      -l "orka.ai/runtime-pool-namespace=${namespace}" -o name || return 1
+  done
+}
+
+runtime_children_absent() {
+  local output
+  output="$(runtime_children_for_test_namespace)" || return 1
+  [[ -z "${output}" ]]
+}
+
+stop_api_forward() {
+  local rc=0
+  local deadline
+  local pid="${api_forward_pid}"
+  if [[ -n "${pid}" ]] && kill -0 "${pid}" >/dev/null 2>&1; then
+    if ! kill -TERM "${pid}" >/dev/null 2>&1 && kill -0 "${pid}" >/dev/null 2>&1; then
+      rc=1
+    fi
+    deadline=$((SECONDS + 10))
+    while kill -0 "${pid}" >/dev/null 2>&1 && (( SECONDS < deadline )); do
+      sleep 0.1
+    done
+    if kill -0 "${pid}" >/dev/null 2>&1; then
+      if ! kill -KILL "${pid}" >/dev/null 2>&1 && kill -0 "${pid}" >/dev/null 2>&1; then
+        rc=1
+      fi
+    fi
+    wait "${pid}" >/dev/null 2>&1 || true
+    if kill -0 "${pid}" >/dev/null 2>&1; then
+      rc=1
+    fi
+  fi
+  api_forward_pid=""
+  return "${rc}"
+}
+
+start_api_forward_process() {
+  local kubectl_path
+  kubectl_path="$(type -P kubectl)" || return 1
+
+  # Prevent cleanup from racing the PID assignment, but reset the child signal
+  # handlers before exec so the tracked PID becomes a terminable kubectl process.
+  trap '' INT TERM
+  (
+    trap 'exit 130' INT
+    trap 'exit 143' TERM
+    exec "${kubectl_path}" --context "${context}" -n "${orka_namespace}" \
+      port-forward --address=127.0.0.1 \
+      deployment/"${controller_deployment}" "${api_local_port}:${controller_api_port}"
+  ) >>"${api_forward_log}" 2>&1 &
+  api_forward_pid=$!
+  trap 'exit 130' INT
+  trap 'exit 143' TERM
+}
+
+github_ref_lookup_state=""
+github_ref_lookup_sha=""
+github_ref_lookup() {
+  local slug="$1"
+  local branch="$2"
+  local output_file="${temp_root}/git-ls-remote.out"
+  local error_file="${temp_root}/git-ls-remote.err"
+  local rc=0
+  github_ref_lookup_state=""
+  github_ref_lookup_sha=""
+  configure_git_observer_auth || return 1
+  if GIT_ASKPASS="${git_askpass_file}" ACP_E2E_GIT_TOKEN_FILE="${gh_token_file}" GIT_TERMINAL_PROMPT=0 \
+      git -C "${git_observer_repo}" -c credential.helper= ls-remote --exit-code --refs \
+      "https://github.com/${slug}.git" "refs/heads/${branch}" >"${output_file}" 2>"${error_file}"; then
+    rc=0
+  else
+    rc=$?
+  fi
+  case "${rc}" in
+    0)
+      github_ref_lookup_state="present"
+      github_ref_lookup_sha="$(awk 'NR == 1 {print $1}' "${output_file}")"
+      is_sha "${github_ref_lookup_sha}" || return 1
+      ;;
+    2)
+      github_ref_lookup_state="absent"
+      ;;
+    *)
+      github_ref_lookup_state="error"
+      cat "${error_file}" | redact >&2
+      return 1
+      ;;
+  esac
+}
+
+github_content_lookup_state=""
+github_content_lookup() {
+  local slug="$1"
+  local path="$2"
+  local ref="$3"
+  local output_file="${temp_root}/gh-content.json"
+  local error_file="${temp_root}/gh-content.err"
+  github_content_lookup_state=""
+  if gh api "repos/${slug}/contents/${path}?ref=${ref}" >"${output_file}" 2>"${error_file}"; then
+    github_content_lookup_state="present"
+    return 0
+  fi
+  if grep -Eq 'HTTP 404|Not Found' "${error_file}"; then
+    github_content_lookup_state="absent"
+    return 0
+  fi
+  github_content_lookup_state="error"
+  cat "${error_file}" | redact >&2
+  return 1
+}
+
+configure_git_observer_auth() {
+  [[ -s "${gh_token_file}" && -x "${git_askpass_file}" && -d "${git_observer_repo}" ]] && return 0
+  if ! gh auth token --hostname github.com >"${gh_token_file}"; then
+    return 1
+  fi
+  [[ -s "${gh_token_file}" ]] || return 1
+  chmod 600 "${gh_token_file}" || return 1
+  cat >"${git_askpass_file}" <<'ASKPASS'
+#!/bin/sh
+case "${1:-}" in
+  *sername*) printf '%s\n' 'x-access-token' ;;
+  *) cat "${ACP_E2E_GIT_TOKEN_FILE}" ;;
+esac
+ASKPASS
+  chmod 700 "${git_askpass_file}" || return 1
+  git init --bare "${git_observer_repo}" >/dev/null 2>&1 || return 1
+}
+
+validate_exact_pull_request() {
+  local pr_json="$1"
+  local expected_head="$2"
+  local number="$3"
+  jq -e \
+    --arg branch "${remote_cleanup_branch}" \
+    --arg head "${expected_head}" \
+    --arg base "${remote_cleanup_pr_base}" \
+    --arg repo "${remote_cleanup_publication_slug}" \
+    --argjson number "${number}" '
+      .number == $number
+      and (.state == "open" or .state == "closed")
+      and (.merged_at == null)
+      and .head.ref == $branch
+      and .head.sha == $head
+      and .base.ref == $base
+      and ((.head.repo.full_name // "") | ascii_downcase) == $repo
+    ' <<<"${pr_json}" >/dev/null
+}
+
+ensure_pull_request_closed_unmerged() {
+  local expected_head="$1"
+  local number="$2"
+  local pr_json
+  if ! pr_json="$(gh api "repos/${remote_cleanup_source_slug}/pulls/${number}")"; then
+    warn "cannot read release-gate PR #${number}"
+    return 1
+  fi
+  if ! validate_exact_pull_request "${pr_json}" "${expected_head}" "${number}"; then
+    warn "refusing PR cleanup: PR #${number} is merged or its immutable tuple changed"
+    return 1
+  fi
+  if [[ "$(jq -r '.state' <<<"${pr_json}")" == "open" ]]; then
+    if ! gh api --method PATCH "repos/${remote_cleanup_source_slug}/pulls/${number}" -f state=closed >/dev/null; then
+      warn "failed to close exact release-gate PR #${number}"
+      return 1
+    fi
+  fi
+  if ! pr_json="$(gh api "repos/${remote_cleanup_source_slug}/pulls/${number}")"; then
+    warn "cannot re-read release-gate PR #${number} after closure"
+    return 1
+  fi
+  validate_exact_pull_request "${pr_json}" "${expected_head}" "${number}" &&
+    [[ "$(jq -r '.state' <<<"${pr_json}")" == "closed" ]]
+}
+
+release_write_task_observer() {
+  [[ -n "${write_task_observer_uid}" ]] || return 0
+  if ! wait_until "write Task/${write_task_name} controller-owned deletion barrier" 300 \
+      task_observer_release_ready "${write_task_name}" "${write_task_observer_uid}"; then
+    return 1
+  fi
+  release_task_observer_finalizer "${write_task_name}" "${write_task_observer_uid}" || return 1
+  wait_until "write Task/${write_task_name} finalizer completion" 300 task_absent "${write_task_name}" || return 1
+  write_task_observer_uid=""
+}
+
+cleanup_remote_effects() {
+  [[ "${release_gate}" -eq 1 && "${remote_cleanup_required}" -eq 1 ]] || return 0
+  log "Cleaning release-gate remote effects with exact-head guards"
+
+  if ! settle_write_task_for_remote_cleanup; then
+    warn "write Task/publication did not reach a provably quiescent state; preserving remote and Kubernetes resources"
+    remote_cleanup_preserve=1
+    return 1
+  fi
+  if ! github_ref_lookup "${remote_cleanup_publication_slug}" "${remote_cleanup_branch}"; then
+    warn "cannot determine remote branch state; preserving remote and Kubernetes resources"
+    remote_cleanup_preserve=1
+    return 1
+  fi
+
+  if [[ "${github_ref_lookup_state}" == "absent" && -z "${remote_cleanup_head}" ]]; then
+    sleep 3
+    if ! github_ref_lookup "${remote_cleanup_publication_slug}" "${remote_cleanup_branch}" ||
+        [[ "${github_ref_lookup_state}" != "absent" ]]; then
+      warn "publication branch absence was not stable after publisher quiescence"
+      remote_cleanup_preserve=1
+      return 1
+    fi
+    if [[ -n "${remote_cleanup_pr_number}" ]]; then
+      warn "a PR receipt exists without a verified publication head"
+      remote_cleanup_preserve=1
+      return 1
+    fi
+    release_write_task_observer
+    return $?
+  fi
+
+  if [[ -z "${remote_cleanup_head}" ]]; then
+    warn "publication state does not provide an independently cleanable head"
+    remote_cleanup_preserve=1
+    return 1
+  fi
+  if [[ "${github_ref_lookup_state}" == "present" && "${github_ref_lookup_sha}" != "${remote_cleanup_head}" ]]; then
+    warn "publication branch moved from verified head ${remote_cleanup_head} to ${github_ref_lookup_sha}; refusing cleanup"
+    remote_cleanup_preserve=1
+    return 1
+  fi
+
+  if [[ -n "${remote_cleanup_pr_number}" ]] &&
+      ! ensure_pull_request_closed_unmerged "${remote_cleanup_head}" "${remote_cleanup_pr_number}"; then
+    remote_cleanup_preserve=1
+    return 1
+  fi
+
+  if [[ "${github_ref_lookup_state}" == "present" ]]; then
+    configure_git_observer_auth
+    if ! GIT_ASKPASS="${git_askpass_file}" ACP_E2E_GIT_TOKEN_FILE="${gh_token_file}" GIT_TERMINAL_PROMPT=0 \
+        git -C "${git_observer_repo}" -c credential.helper= push --porcelain \
+        --force-with-lease="refs/heads/${remote_cleanup_branch}:${remote_cleanup_head}" \
+        "${remote_cleanup_publication_repo}" ":refs/heads/${remote_cleanup_branch}" >/dev/null; then
+      warn "exact-head branch deletion failed; preserving Kubernetes resources"
+      remote_cleanup_preserve=1
+      return 1
+    fi
+  fi
+  if ! github_ref_lookup "${remote_cleanup_publication_slug}" "${remote_cleanup_branch}" ||
+      [[ "${github_ref_lookup_state}" != "absent" ]]; then
+    warn "publication branch still exists after exact-head deletion"
+    remote_cleanup_preserve=1
+    return 1
+  fi
+
+  if [[ -n "${remote_cleanup_pr_number}" ]] &&
+      ! ensure_pull_request_closed_unmerged "${remote_cleanup_head}" "${remote_cleanup_pr_number}"; then
+    remote_cleanup_preserve=1
+    return 1
+  fi
+  if ! release_write_task_observer; then
+    warn "write Task did not complete controller-owned deletion after remote cleanup"
+    remote_cleanup_preserve=1
+    return 1
+  fi
+  log "Remote PR/branch cleanup completed"
+}
+
+task_cleanup_settled() {
+  local task="$1"
+  probe_task "${task}" || return 1
+  [[ "${task_probe_state}" == "absent" ]] && return 0
+  [[ "${task_probe_state}" == "present" ]] || return 1
+  jq -e '
+    (.status.execution.state // "") as $execution
+    | (.status.delivery.state // "") as $delivery
+    | ($execution == "" or $execution == "Succeeded" or $execution == "Failed" or $execution == "Cancelled" or $execution == "OutcomeUnknown")
+      and (
+        $delivery == ""
+        or $delivery == "NotRequested"
+        or $delivery == "VerifiedExact"
+        or $delivery == "DeliveredSuperseded"
+        or $delivery == "ReadValidated"
+        or $delivery == "NoChange"
+        or $delivery == "CancelledBeforePublish"
+        or $delivery == "ReadOnlyWorkspaceModified"
+        or $delivery == "DeliveryConflict"
+        or $delivery == "CredentialBlocked"
+        or $delivery == "PublicationOutcomeUnknown"
+      )
+  ' "${task_probe_file}" >/dev/null
+}
+
+task_absent() {
+  probe_task "$1" || return 1
+  [[ "${task_probe_state}" == "absent" ]]
+}
+
+add_task_observer_finalizer() {
+  local task="$1"
+  local uid="$2"
+  local patch
+  probe_task "${task}" || return 1
+  [[ "${task_probe_state}" == "present" ]] || return 1
+  if ! jq -e --arg uid "${uid}" --arg observer "${task_observer_finalizer}" '
+      .metadata.uid == $uid
+      and ((.metadata.deletionTimestamp // "") | length) == 0
+      and ((.metadata.finalizers // []) | index("orka.ai/cleanup") != null)
+      and ((.metadata.finalizers // []) | index($observer) == null)
+    ' "${task_probe_file}" >/dev/null; then
+    warn "Task/${task} is not safe to hold for cancellation observation"
+    return 1
+  fi
+  patch="$(jq -cn --arg uid "${uid}" --arg observer "${task_observer_finalizer}" '[
+    {op:"test",path:"/metadata/uid",value:$uid},
+    {op:"add",path:"/metadata/finalizers/-",value:$observer}
+  ]')"
+  k -n "${namespace}" patch task "${task}" --type=json -p "${patch}" >/dev/null
+}
+
+task_observer_release_ready() {
+  local task="$1"
+  local uid="$2"
+  task_cleanup_settled "${task}" || return 1
+  probe_task "${task}" || return 1
+  [[ "${task_probe_state}" == "present" ]] || return 1
+  jq -e --arg uid "${uid}" --arg observer "${task_observer_finalizer}" '
+    .metadata.uid == $uid
+    and ((.metadata.deletionTimestamp // "") | length) > 0
+    and (.metadata.finalizers // []) == [$observer]
+  ' "${task_probe_file}" >/dev/null
+}
+
+release_task_observer_finalizer() {
+  local task="$1"
+  local uid="$2"
+  local patch
+  task_observer_release_ready "${task}" "${uid}" || return 1
+  patch="$(jq -cn --arg uid "${uid}" --arg observer "${task_observer_finalizer}" '[
+    {op:"test",path:"/metadata/uid",value:$uid},
+    {op:"test",path:"/metadata/finalizers/0",value:$observer},
+    {op:"remove",path:"/metadata/finalizers/0"}
+  ]')"
+  k -n "${namespace}" patch task "${task}" --type=json -p "${patch}" >/dev/null
+}
+
+task_deletion_barrier_complete() {
+  local task="$1"
+  local uid="$2"
+  probe_task "${task}" || return 1
+  [[ "${task_probe_state}" == "absent" ]] && return 0
+  [[ "${task_probe_state}" == "present" ]] || return 1
+  task_observer_release_ready "${task}" "${uid}"
+}
+
+request_task_cancellation() {
+  local task="$1"
+  if [[ "${release_gate}" -eq 1 ]]; then
+    api_request DELETE "/api/v1/tasks/${task}?namespace=${namespace}" >/dev/null
+  else
+    k -n "${namespace}" delete task "${task}" --wait=false >/dev/null
+  fi
+}
+
+runtimepool_absent() {
+  probe_runtimepool "$1" || return 1
+  [[ "${runtimepool_probe_state}" == "absent" ]]
+}
+
+settle_and_delete_test_tasks() {
+  local owners_file="$1"
+  local tasks_file="${temp_root}/cleanup-tasks.json"
+  local inventory_file="${temp_root}/cleanup-tasks.tsv"
+  local name uid session_uid current_uid
+  : >"${owners_file}"
+  k -n "${namespace}" get task -o json >"${tasks_file}" || return 1
+  if ! jq -e --arg run "${run_id}" 'all(.items[]; .metadata.labels["orka.ai/acp-e2e-run"] == $run)' "${tasks_file}" >/dev/null; then
+    warn "test namespace contains a Task not owned by release-gate run ${run_id}"
+    return 1
+  fi
+  jq -r '.items[] | [.metadata.name, .metadata.uid, (.status.execution.runtimeSessionUID // "")] | @tsv' \
+    "${tasks_file}" >"${inventory_file}"
+  while IFS=$'\t' read -r name uid session_uid; do
+    [[ -n "${name}" && -n "${uid}" ]] || continue
+    printf '%s\n' "${uid}" >>"${owners_file}"
+    [[ -z "${session_uid}" ]] || printf '%s\n' "${session_uid}" >>"${owners_file}"
+    probe_task "${name}" || return 1
+    [[ "${task_probe_state}" == "present" ]] || continue
+    current_uid="$(jq -r '.metadata.uid // ""' "${task_probe_file}")"
+    if [[ "${current_uid}" != "${uid}" ]]; then
+      warn "Task/${name} UID changed during cleanup; refusing deletion"
+      return 1
+    fi
+    if [[ "$(jq -r '.metadata.deletionTimestamp // ""' "${task_probe_file}")" == "" ]]; then
+      k -n "${namespace}" delete task "${name}" --wait=false >/dev/null || return 1
+    fi
+  done <"${inventory_file}"
+  sort -u -o "${owners_file}" "${owners_file}"
+
+  while IFS=$'\t' read -r name uid _; do
+    [[ -n "${name}" ]] || continue
+    if ! wait_until "Task/${name} controller-owned deletion barrier" 300 \
+        task_deletion_barrier_complete "${name}" "${uid}"; then
+      safe_task_summary "${name}"
+      return 1
+    fi
+    probe_task "${name}" || return 1
+    [[ "${task_probe_state}" == "present" ]] || continue
+    release_task_observer_finalizer "${name}" "${uid}" || return 1
+  done <"${inventory_file}"
+
+  while IFS=$'\t' read -r name _; do
+    [[ -n "${name}" ]] || continue
+    if ! wait_until "Task/${name} finalizer completion" 300 task_absent "${name}"; then
+      safe_task_summary "${name}"
+      return 1
+    fi
+  done <"${inventory_file}"
+}
+
+delete_test_agents() {
+  local agents_file="${temp_root}/cleanup-agents.json"
+  k -n "${namespace}" get agent -o json >"${agents_file}" || return 1
+  if ! jq -e --arg run "${run_id}" 'all(.items[]; (.metadata.name | endswith($run)))' "${agents_file}" >/dev/null; then
+    warn "test namespace contains an Agent not owned by release-gate run ${run_id}"
+    return 1
+  fi
+  k -n "${namespace}" delete agent --all --ignore-not-found=true --wait=true --timeout=2m >/dev/null
+}
+
+stop_and_delete_test_runtimepools() {
+  local pools_file="${temp_root}/cleanup-runtimepools.json"
+  local inventory_file="${temp_root}/cleanup-runtimepools.tsv"
+  local name uid runtime_ns current_uid
+  k -n "${namespace}" get runtimepool -o json >"${pools_file}" || return 1
+  if ! jq -e --arg ns "${namespace}" 'all(.items[]; .spec.trustDomain.namespace == $ns)' "${pools_file}" >/dev/null; then
+    warn "test namespace contains a RuntimePool with a foreign trust domain"
+    return 1
+  fi
+  jq -r '.items[] | [.metadata.name, .metadata.uid, (.spec.runtimeNamespace // "")] | @tsv' \
+    "${pools_file}" >"${inventory_file}"
+  while IFS=$'\t' read -r name uid runtime_ns; do
+    [[ -n "${name}" && -n "${uid}" ]] || continue
+    record_runtime_namespace "${runtime_ns}"
+    probe_runtimepool "${name}" || return 1
+    [[ "${runtimepool_probe_state}" == "present" ]] || continue
+    current_uid="$(jq -r '.metadata.uid // ""' "${temp_root}/runtimepool-probe-${name}.json")"
+    if [[ "${current_uid}" != "${uid}" ]]; then
+      warn "RuntimePool/${name} UID changed during cleanup; refusing deletion"
+      return 1
+    fi
+    k -n "${namespace}" patch runtimepool "${name}" --type=merge -p '{"spec":{"desiredReplicas":0}}' >/dev/null || return 1
+  done <"${inventory_file}"
+  while IFS=$'\t' read -r name _; do
+    [[ -n "${name}" ]] || continue
+    wait_until "RuntimePool/${name} stopped before cleanup" 300 pool_stopped "${name}" || return 1
+    k -n "${namespace}" delete runtimepool "${name}" --wait=false >/dev/null || return 1
+  done <"${inventory_file}"
+  while IFS=$'\t' read -r name _; do
+    [[ -n "${name}" ]] || continue
+    wait_until "RuntimePool/${name} finalizer completion" 300 runtimepool_absent "${name}" || return 1
+  done <"${inventory_file}"
+}
+
+delete_test_branchclaims() {
+  local owners_file="$1"
+  local claims_file="${temp_root}/cleanup-branchclaims.json"
+  local inventory_file="${temp_root}/cleanup-branchclaims.tsv"
+  local name uid owner_uid current_uid current_owner
+  [[ -s "${owners_file}" ]] || return 0
+  k get branchclaim -o json >"${claims_file}" || return 1
+  jq -r --rawfile owners "${owners_file}" '
+    ($owners | split("\n") | map(select(length > 0))) as $ownerUIDs
+    | .items[]
+    | . as $claim
+    | select($ownerUIDs | index($claim.spec.ownerUid))
+    | [$claim.metadata.name, $claim.metadata.uid, $claim.spec.ownerUid] | @tsv
+  ' "${claims_file}" >"${inventory_file}"
+  while IFS=$'\t' read -r name uid owner_uid; do
+    [[ -n "${name}" && -n "${uid}" && -n "${owner_uid}" ]] || continue
+    current_uid="$(k get branchclaim "${name}" -o jsonpath='{.metadata.uid}')" || return 1
+    current_owner="$(k get branchclaim "${name}" -o jsonpath='{.spec.ownerUid}')" || return 1
+    if [[ "${current_uid}" != "${uid}" || "${current_owner}" != "${owner_uid}" ]]; then
+      warn "BranchClaim/${name} ownership changed during cleanup; refusing deletion"
+      return 1
+    fi
+    k delete branchclaim "${name}" --wait=true --timeout=2m >/dev/null || return 1
+  done <"${inventory_file}"
+}
+
+delete_test_namespace_now() {
+  recover_namespace_ownership || return 1
+  [[ "${namespace_created}" -eq 1 || "${namespace_shared}" -eq 1 ]] || return 0
+  probe_namespace "${namespace}" || return 1
+  if [[ "${namespace_probe_state}" == "absent" ]]; then
+    namespace_created=0
+    return 0
+  fi
+  if [[ "${namespace_created}" -eq 1 ]] && ! jq -e --arg run "${run_id}" --arg uid "${namespace_uid}" '
+      .metadata.uid == $uid
+      and .metadata.labels["orka.ai/acp-e2e-run"] == $run
+      and .metadata.labels["app.kubernetes.io/managed-by"] == "live-acp-runtime-e2e"
+    ' "${namespace_probe_file}" >/dev/null; then
+    warn "namespace/${namespace} ownership changed; refusing deletion"
+    return 1
+  fi
+  local owners_file="${temp_root}/cleanup-owner-uids.txt"
+  log "Settling run-owned Tasks before namespace teardown"
+  settle_and_delete_test_tasks "${owners_file}" || return 1
+  delete_test_agents || return 1
+  stop_and_delete_test_runtimepools || return 1
+  if ! wait_until "runtime children for ${namespace} to be removed" 300 runtime_children_absent; then
+    warn "runtime children remain or could not be listed before namespace teardown"
+    runtime_children_for_test_namespace 2>&1 | redact >&2
+    return 1
+  fi
+  delete_test_branchclaims "${owners_file}" || return 1
+
+  if [[ "${namespace_shared}" -eq 1 ]]; then
+    log "Leaving shared namespace ${namespace} in place after run-resource cleanup"
+    return 0
+  fi
+
+  log "Cleaning up ACP e2e namespace ${namespace}"
+  if ! k delete namespace "${namespace}" --ignore-not-found=true --wait=false >/dev/null; then
+    warn "failed to request namespace/${namespace} deletion"
+    return 1
+  fi
+  probe_namespace "${namespace}" || return 1
+  if [[ "${namespace_probe_state}" == "present" ]] && \
+      ! wait_until "namespace/${namespace} deletion" 300 wait_namespace_deleted; then
+    return 1
+  fi
+  if ! wait_until "runtime children for ${namespace} to remain absent" 300 runtime_children_absent; then
+    warn "runtime children reappeared or could not be listed"
+    runtime_children_for_test_namespace 2>&1 | redact >&2
+    return 1
+  fi
+  namespace_created=0
+}
+
+cleanup() {
+  local rc=$?
+  local cleanup_rc=0
+  trap - EXIT ERR
+  trap '' INT TERM
+  set +e
+
+  if ! recover_namespace_ownership; then
+    cleanup_rc=1
+    remote_cleanup_preserve=1
+  fi
+  if ! cleanup_remote_effects; then
+    cleanup_rc=1
+  fi
+
+  if [[ "${keep_resources}" == "1" || "${remote_cleanup_preserve}" == "1" ]]; then
+    if [[ "${namespace_created}" -eq 1 || "${namespace_shared}" -eq 1 ]]; then
+      warn "preserving namespace ${namespace}"
+    fi
+  elif [[ "${namespace_created}" -eq 1 || "${namespace_shared}" -eq 1 ]]; then
+    if ! delete_test_namespace_now; then
+      cleanup_rc=1
+    fi
+  fi
+
+  if ! stop_api_forward; then
+    warn "failed to stop controller API port-forward"
+    cleanup_rc=1
+  fi
+  if ! rm -rf "${temp_root}"; then
+    warn "failed to remove temporary credential directory ${temp_root}"
+    cleanup_rc=1
+  fi
+  if [[ "${rc}" -eq 0 && "${cleanup_rc}" -ne 0 ]]; then
+    rc="${cleanup_rc}"
+  fi
+  exit "${rc}"
+}
+trap cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+safe_task_summary() {
+  local task="$1"
+  k -n "${namespace}" get task "${task}" -o json 2>/dev/null | jq '{
+    name: .metadata.name,
+    phase: .status.phase,
+    message: .status.message,
+    execution: (.status.execution // {} | {
+      state, outcome, reason, attempt, promptID, runtimePoolName,
+      runtimePoolUID, runtimeInstanceID, runtimeSessionUID,
+      runtimeSessionGeneration, requestDigest, controllerEpoch,
+      readCredentialResourceVersion, publicationCredentialResourceVersion,
+      message
+    }),
+    delivery: (.status.delivery // {} | {
+      state, outcome, reason, publicationID, sourceRepository,
+      publicationRepository, branch, startingSHA, remoteBeforeSHA,
+      treeSHA, expectedCommitSHA, verifiedRemoteSHA,
+      supersedingRemoteSHA, artifactDigest, prReceipt, message
+    })
+  }' | redact >&2 || true
+}
+
+dump_diagnostics() {
+  local rc=$?
+  local failed_source="${BASH_SOURCE[1]:-${BASH_SOURCE[0]}}"
+  local failed_line="${BASH_LINENO[0]:-unknown}"
+  local failed_function="${FUNCNAME[1]:-main}"
+  [[ "${rc}" -ne 0 ]] || return 0
+  warn "release-gate command failed with status ${rc} at ${failed_source}:${failed_line} (${failed_function})"
+  warn "release-gate failure stack functions=${FUNCNAME[*]:1:5} lines=${BASH_LINENO[*]:0:5}"
+  log "Failure diagnostics (Secret contents and task results are intentionally excluded)"
+  run_redacted k get nodes -o wide || true
+  run_redacted k -n "${orka_namespace}" get deployment,pod,service,persistentvolumeclaim -o wide || true
+  if [[ "${namespace_created}" -eq 1 || "${namespace_shared}" -eq 1 ]]; then
+    run_redacted k -n "${namespace}" get agent,task,runtimepool -o wide || true
+    run_redacted k -n "${namespace}" get events --sort-by=.metadata.creationTimestamp || true
+  fi
+  local ns
+  for ns in "${runtime_namespaces_seen[@]}"; do
+    run_redacted k -n "${ns}" get deployment,pod,service,networkpolicy,poddisruptionbudget \
+      -l "orka.ai/runtime-pool-namespace=${namespace}" -o wide || true
+  done
+  return "${rc}"
+}
+trap dump_diagnostics ERR
+
+create_api_identity() {
+  local sa="acp-release-gate"
+  jq -n \
+    --arg ns "${namespace}" \
+    --arg sa "${sa}" \
+    '{apiVersion:"v1",kind:"ServiceAccount",metadata:{name:$sa,namespace:$ns}}' |
+    k apply -f - >/dev/null
+  jq -n \
+    --arg ns "${namespace}" \
+    '{
+      apiVersion:"rbac.authorization.k8s.io/v1",
+      kind:"Role",
+      metadata:{name:"acp-release-gate",namespace:$ns},
+      rules:[{apiGroups:["core.orka.ai"],resources:["tasks"],verbs:["get","list","watch","create","delete"]}]
+    }' | k apply -f - >/dev/null
+  jq -n \
+    --arg ns "${namespace}" \
+    --arg sa "${sa}" \
+    '{
+      apiVersion:"rbac.authorization.k8s.io/v1",
+      kind:"RoleBinding",
+      metadata:{name:"acp-release-gate",namespace:$ns},
+      subjects:[{kind:"ServiceAccount",name:$sa,namespace:$ns}],
+      roleRef:{apiGroup:"rbac.authorization.k8s.io",kind:"Role",name:"acp-release-gate"}
+    }' | k apply -f - >/dev/null
+  k -n "${namespace}" create token "${sa}" --duration=2h >"${api_token_file}"
+  chmod 600 "${api_token_file}"
+  {
+    printf 'Authorization: Bearer '
+    cat "${api_token_file}"
+    printf '\n'
+  } >"${api_auth_header_file}"
+  chmod 600 "${api_auth_header_file}"
+}
+
+api_health_ready() {
+  curl --fail --silent --show-error --max-time 2 "http://127.0.0.1:${api_local_port}/healthz" >/dev/null
+}
+
+api_forward_ready() {
+  [[ -n "${api_forward_pid}" ]] && kill -0 "${api_forward_pid}" >/dev/null 2>&1 && api_health_ready
+}
+
+start_api_forward() {
+  if [[ -n "${api_forward_pid}" ]] && kill -0 "${api_forward_pid}" >/dev/null 2>&1 && api_health_ready; then
+    return 0
+  fi
+  stop_api_forward || die "failed to stop the previous controller API port-forward"
+  : >"${api_forward_log}"
+  local deadline=$((SECONDS + 90))
+  local attempt=0
+  local attempt_deadline
+  while (( SECONDS < deadline )); do
+    attempt=$((attempt + 1))
+    printf 'port-forward attempt %d at %s\n' "${attempt}" "$(date -u +%H:%M:%S)" >>"${api_forward_log}"
+    start_api_forward_process || die "failed to launch controller API port-forward"
+    attempt_deadline=$((SECONDS + 10))
+    while (( SECONDS < attempt_deadline )); do
+      if api_forward_ready; then
+        return 0
+      fi
+      if ! kill -0 "${api_forward_pid}" >/dev/null 2>&1; then
+        break
+      fi
+      sleep 0.5
+    done
+    stop_api_forward || die "failed to stop an unhealthy controller API port-forward"
+    sleep 1
+  done
+  cat "${api_forward_log}" | redact >&2
+  die "controller API port-forward failed after Pod-aware retries; set ACP_E2E_API_LOCAL_PORT to an unused local port"
+}
+
+ensure_api_forward() {
+  if [[ -n "${api_forward_pid}" ]] && kill -0 "${api_forward_pid}" >/dev/null 2>&1 && api_health_ready; then
+    return 0
+  fi
+  start_api_forward
+}
+
+api_request() {
+  local method="$1"
+  local path="$2"
+  local body_file="${3:-}"
+  local response_file="${temp_root}/api-response.json"
+  local error_file="${temp_root}/api-curl.err"
+  local status rc
+  ensure_api_forward
+  set +e
+  if [[ -n "${body_file}" ]]; then
+    status="$(curl --silent --show-error --max-time 60 \
+      --request "${method}" \
+      --header @"${api_auth_header_file}" \
+      --header 'Content-Type: application/json' \
+      --data-binary @"${body_file}" \
+      --output "${response_file}" --write-out '%{http_code}' \
+      "http://127.0.0.1:${api_local_port}${path}" 2>"${error_file}")"
+    rc=$?
+  else
+    status="$(curl --silent --show-error --max-time 60 \
+      --request "${method}" \
+      --header @"${api_auth_header_file}" \
+      --output "${response_file}" --write-out '%{http_code}' \
+      "http://127.0.0.1:${api_local_port}${path}" 2>"${error_file}")"
+    rc=$?
+  fi
+  set -e
+  if [[ "${rc}" -ne 0 || ! "${status}" =~ ^2[0-9][0-9]$ ]]; then
+    cat "${error_file}" | redact >&2
+    cat "${response_file}" | redact >&2
+    return 1
+  fi
+  cat "${response_file}"
+}
+
+api_task_result() {
+  local task="$1"
+  api_request GET "/api/v1/tasks/${task}/result?namespace=${namespace}" | jq -r '.result'
+}
+
+api_fork_task() {
+  local source_task="$1"
+  local new_task="$2"
+  local prompt="$3"
+  local body_file="${temp_root}/fork-request.json"
+  jq -n \
+    --arg name "${new_task}" \
+    --arg prompt "${prompt}" \
+    '{newTaskName:$name,prompt:$prompt}' >"${body_file}"
+  api_request POST "/api/v1/tasks/${source_task}/fork?namespace=${namespace}" "${body_file}"
+}
+
+github_repo_slug() {
+  local url="$1"
+  local path
+  case "${url}" in
+    https://github.com/*) path="${url#https://github.com/}" ;;
+    *) return 1 ;;
+  esac
+  path="${path%/}"
+  path="${path%.git}"
+  [[ "${path}" =~ ^[^/]+/[^/]+$ ]] || return 1
+  lower "${path}"
+}
+
+gh_raw_file() {
+  local slug="$1"
+  local path="$2"
+  local ref="$3"
+  gh api -H 'Accept: application/vnd.github.raw+json' \
+    "repos/${slug}/contents/${path}?ref=${ref}"
+}
+
+image_digest_from_value() {
+  local value="$1"
+  if [[ "${value}" =~ (sha256:[a-f0-9]{64})$ ]]; then
+    printf '%s\n' "${BASH_REMATCH[1]}"
+    return 0
+  fi
+  return 1
+}
+
+pinned_image_digest() {
+  local value="$1"
+  if [[ "${value}" =~ @(sha256:[a-f0-9]{64})$ ]]; then
+    printf '%s\n' "${BASH_REMATCH[1]}"
+    return 0
+  fi
+  return 1
+}
+
+resolve_platform_manifest_digest() {
+  local image="$1"
+  local node="$2"
+  local requested_digest raw_file error_file media_type os arch expected count
+  requested_digest="$(pinned_image_digest "${image}")" || return 1
+  raw_file="${temp_root}/image-index-$(printf '%s' "${requested_digest}" | cut -c8-23).json"
+  error_file="${raw_file}.err"
+  if ! docker buildx imagetools inspect --raw "${image}" >"${raw_file}" 2>"${error_file}"; then
+    cat "${error_file}" | redact >&2
+    return 1
+  fi
+  media_type="$(jq -r '.mediaType // ""' "${raw_file}")"
+  case "${media_type}" in
+    *image.index*|*manifest.list*)
+      os="$(k get node "${node}" -o jsonpath='{.metadata.labels.kubernetes\.io/os}')"
+      arch="$(k get node "${node}" -o jsonpath='{.metadata.labels.kubernetes\.io/arch}')"
+      count="$(jq --arg os "${os}" --arg arch "${arch}" \
+        '[.manifests[] | select(.platform.os == $os and .platform.architecture == $arch)] | length' "${raw_file}")"
+      [[ "${count}" == "1" ]] || {
+        warn "OCI index ${image} has ${count} manifests for ${os}/${arch}; cannot bind actual imageID unambiguously"
+        return 1
+      }
+      expected="$(jq -r --arg os "${os}" --arg arch "${arch}" \
+        '.manifests[] | select(.platform.os == $os and .platform.architecture == $arch) | .digest' "${raw_file}")"
+      ;;
+    *)
+      expected="${requested_digest}"
+      ;;
+  esac
+  [[ "${expected}" =~ ^sha256:[a-f0-9]{64}$ ]] || return 1
+  printf '%s\n' "${expected}"
+}
+
+assert_pod_container_image() {
+  local pod_namespace="$1"
+  local pod_name="$2"
+  local container="$3"
+  local requested_image="$4"
+  local pod_json status_image image_id actual_digest requested_digest expected_digest node
+  requested_digest="$(pinned_image_digest "${requested_image}")" || \
+    die "${pod_namespace}/Pod/${pod_name} container ${container} is not requested by digest: ${requested_image}"
+  pod_json="$(k -n "${pod_namespace}" get pod "${pod_name}" -o json)"
+  status_image="$(jq -r --arg container "${container}" \
+    '((.status.containerStatuses // []) + (.status.initContainerStatuses // []))[] | select(.name == $container) | .image' <<<"${pod_json}")"
+  image_id="$(jq -r --arg container "${container}" \
+    '((.status.containerStatuses // []) + (.status.initContainerStatuses // []))[] | select(.name == $container) | .imageID' <<<"${pod_json}")"
+  [[ -n "${status_image}" && -n "${image_id}" ]] || \
+    die "${pod_namespace}/Pod/${pod_name} has no image status for container ${container}"
+  actual_digest="$(image_digest_from_value "${image_id}")" || \
+    die "${pod_namespace}/Pod/${pod_name} container ${container} imageID is not digest-addressed: ${image_id}"
+  if [[ "${release_gate}" -eq 1 ]]; then
+    node="$(jq -r '.spec.nodeName // ""' <<<"${pod_json}")"
+    [[ -n "${node}" ]] || die "${pod_namespace}/Pod/${pod_name} is not scheduled"
+    expected_digest="$(resolve_platform_manifest_digest "${requested_image}" "${node}")" || \
+      die "could not resolve platform manifest for ${requested_image}"
+    [[ "${actual_digest}" == "${requested_digest}" || "${actual_digest}" == "${expected_digest}" ]] || \
+      die "${pod_namespace}/Pod/${pod_name} container ${container} imageID digest ${actual_digest} matches neither requested index/manifest digest ${requested_digest} nor platform digest ${expected_digest}"
+  fi
+}
+
+assert_all_pod_images() {
+  local pod_namespace="$1"
+  local pod_name="$2"
+  local pod_json container image images_file
+  pod_json="$(k -n "${pod_namespace}" get pod "${pod_name}" -o json)"
+  images_file="${temp_root}/pod-images-$(sanitize_name "${pod_namespace}-${pod_name}").tsv"
+  jq -r '
+    ((.spec.initContainers // [])[] | ["init", .name, .image]),
+    ((.spec.containers // [])[] | ["container", .name, .image])
+    | @tsv
+  ' <<<"${pod_json}" >"${images_file}" || die "failed to enumerate Pod/${pod_name} images"
+  [[ -s "${images_file}" ]] || die "Pod/${pod_name} has no declared container images"
+  while IFS=$'\t' read -r _ container image; do
+    [[ -n "${container}" && -n "${image}" ]] || die "Pod/${pod_name} has an incomplete container image declaration"
+    assert_pod_container_image "${pod_namespace}" "${pod_name}" "${container}" "${image}"
+  done <"${images_file}"
+}
+
+select_deployment_container() {
+  local deployment_json="$1"
+  local override="$2"
+  shift 2
+  local candidate
+  if [[ -n "${override}" ]]; then
+    jq -e --arg name "${override}" '.spec.template.spec.containers | any(.name == $name)' \
+      <<<"${deployment_json}" >/dev/null || die "configured container ${override} was not found"
+    printf '%s\n' "${override}"
+    return 0
+  fi
+  for candidate in "$@"; do
+    if jq -e --arg name "${candidate}" '.spec.template.spec.containers | any(.name == $name)' \
+        <<<"${deployment_json}" >/dev/null; then
+      printf '%s\n' "${candidate}"
+      return 0
+    fi
+  done
+  if [[ "$(jq '.spec.template.spec.containers | length' <<<"${deployment_json}")" == "1" ]]; then
+    jq -r '.spec.template.spec.containers[0].name' <<<"${deployment_json}"
+    return 0
+  fi
+  die "could not auto-detect a unique container in Deployment"
+}
+
+assert_pod_matches_deployment_images() {
+  local deployment_json="$1"
+  local pod_json="$2"
+  jq -e --argjson pod "${pod_json}" '
+    def images($spec):
+      (((($spec.initContainers // []) + ($spec.containers // [])) | map({key:.name,value:.image}) | from_entries));
+    images(.spec.template.spec) == images($pod.spec)
+  ' <<<"${deployment_json}" >/dev/null
+}
+
+assert_deployment_persistent() {
+  local deployment_json="$1"
+  local deployment="$2"
+  local container="$3"
+  local claims claim phase
+  claims="$(jq -r --arg container "${container}" '
+    .spec.template.spec as $pod
+    | [$pod.containers[] | select(.name == $container) | .volumeMounts[]?.name] as $mounts
+    | $pod.volumes[]? as $volume
+    | select($volume.persistentVolumeClaim != null and ($mounts | index($volume.name)))
+    | $volume.persistentVolumeClaim.claimName
+  ' <<<"${deployment_json}")"
+  [[ -n "${claims}" ]] || \
+    die "Deployment/${deployment} primary container ${container} does not mount a persistentVolumeClaim"
+  while IFS= read -r claim; do
+    [[ -n "${claim}" ]] || continue
+    phase="$(k -n "${orka_namespace}" get persistentvolumeclaim "${claim}" -o jsonpath='{.status.phase}')"
+    [[ "${phase}" == "Bound" ]] || die "PersistentVolumeClaim/${claim} for Deployment/${deployment} is ${phase:-<empty>}, want Bound"
+  done <<<"${claims}"
+}
+
+assert_deployment_digest() {
+  local deployment="$1"
+  local override="$2"
+  shift 2
+  local deployment_json container image selector pods_json count total pod pod_json replica_set replica_set_json
+  resource_exists -n "${orka_namespace}" get deployment "${deployment}" || \
+    die "required Deployment/${deployment} was not found in ${orka_namespace}"
+  k -n "${orka_namespace}" rollout status deployment/"${deployment}" --timeout=5m >/dev/null
+  deployment_json="$(k -n "${orka_namespace}" get deployment "${deployment}" -o json)"
+  jq -e '
+    .spec.replicas == 1
+    and .status.observedGeneration == .metadata.generation
+    and .status.updatedReplicas == 1
+    and .status.readyReplicas == 1
+    and .status.availableReplicas == 1
+  ' <<<"${deployment_json}" >/dev/null || \
+    die "Deployment/${deployment} is not a fully observed single-replica rollout"
+  container="$(select_deployment_container "${deployment_json}" "${override}" "$@")"
+  image="$(jq -r --arg container "${container}" \
+    '.spec.template.spec.containers[] | select(.name == $container) | .image' <<<"${deployment_json}")"
+  pinned_image_digest "${image}" >/dev/null || \
+    die "Deployment/${deployment} container ${container} is not digest-pinned: ${image}"
+  selector="$(jq -r '.spec.selector.matchLabels | to_entries | map("\(.key)=\(.value)") | join(",")' <<<"${deployment_json}")"
+  [[ -n "${selector}" ]] || die "Deployment/${deployment} has no matchLabels selector"
+  pods_json="$(k -n "${orka_namespace}" get pods -l "${selector}" -o json)"
+  total="$(jq '[.items[] | select(.metadata.deletionTimestamp == null)] | length' <<<"${pods_json}")"
+  [[ "${total}" == "1" ]] || die "Deployment/${deployment} has ${total} non-terminating Pods, want exactly 1"
+  count="$(jq --arg container "${container}" '[.items[] | select(.metadata.deletionTimestamp == null) |
+    select(any(.status.containerStatuses[]?; .name == $container and .ready == true))] | length' <<<"${pods_json}")"
+  [[ "${count}" == "1" ]] || die "Deployment/${deployment} does not have exactly one ready selected Pod"
+  pod="$(jq -r --arg container "${container}" '.items[] | select(.metadata.deletionTimestamp == null) |
+    select(any(.status.containerStatuses[]?; .name == $container and .ready == true)) | .metadata.name' <<<"${pods_json}")"
+  pod_json="$(k -n "${orka_namespace}" get pod "${pod}" -o json)"
+  replica_set="$(jq -r '.metadata.ownerReferences[]? | select(.controller == true and .kind == "ReplicaSet") | .name' <<<"${pod_json}")"
+  [[ -n "${replica_set}" ]] || die "Deployment/${deployment} selected Pod is not owned by a ReplicaSet"
+  replica_set_json="$(k -n "${orka_namespace}" get replicaset "${replica_set}" -o json)"
+  jq -e --arg deployment "${deployment}" --arg uid "$(jq -r '.metadata.uid' <<<"${deployment_json}")" '
+    any(.metadata.ownerReferences[]?; .controller == true and .kind == "Deployment" and .name == $deployment and .uid == $uid)
+  ' <<<"${replica_set_json}" >/dev/null || \
+    die "selected Pod ReplicaSet is not owned by Deployment/${deployment}"
+  assert_pod_matches_deployment_images "${deployment_json}" "${pod_json}" || \
+    die "Deployment/${deployment} Pod images do not match the current Deployment template"
+  assert_all_pod_images "${orka_namespace}" "${pod}"
+}
+
+publisher_service_account=""
+assert_publisher_brokered_authority() {
+  local deployment_json container service_account can_get can_list
+  deployment_json="$(k -n "${orka_namespace}" get deployment "${publisher_deployment}" -o json)"
+  container="$(select_deployment_container "${deployment_json}" "${publisher_container_override}" publisher workspace-publisher)"
+  jq -e --arg container "${container}" '
+    .spec.template.spec as $pod
+    | ($pod.containers[] | select(.name == $container)) as $publisher
+    | [$publisher.env[]?] as $env
+    | [$publisher.volumeMounts[]?.name] as $mounts
+    | [$pod.volumes[]? | select(.secret != null) | .name] as $secretVolumes
+    | ([$mounts[] as $mount | select($secretVolumes | index($mount)) | $mount] | unique) as $mountedSecrets
+    | ([$publisher.args[]?] | join(" ")) as $args
+    | (($pod.volumes[] | select(.name == "publisher-auth") | .secret.items // []) | map(.path) | sort) as $authPaths
+    | ([$publisher.volumeMounts[]? | select(.name == "publisher-auth") |
+        {mountPath, subPath, readOnly}] | sort_by(.subPath)) as $authMounts
+    | ([$env[] | select(.name == "ORKA_PUBLISHER_CREDENTIAL_BROKER_URL" and ((.value // "") | test("^https?://")))] | length) == 1
+      and ([$env[] | select(.name == "ORKA_PUBLISHER_ARTIFACT_AUTHORIZATION_BROKER_URL" and ((.value // "") | test("^https?://")))] | length) == 1
+      and ([$env[] | select(.name == "ORKA_PUBLISHER_CREDENTIAL_ROOT" or .name == "ORKA_PUBLISHER_ARTIFACT_CAPABILITY_SECRET_FILE")] | length) == 0
+      and (($publisher.envFrom // []) | length) == 0
+      and ([$env[] | select(.valueFrom.secretKeyRef != null)] | length) == 1
+      and ([$env[] | select(
+        .name == "ORKA_SCM_EGRESS_PROXY_TOKEN"
+        and ((.valueFrom.secretKeyRef.name // "") | length) > 0
+        and ((.valueFrom.secretKeyRef.key // "") | length) > 0
+      )] | length) == 1
+      and ([$env[] | select(
+        (.name == "HTTPS_PROXY" or .name == "https_proxy")
+        and ((.value // "") | contains("$(ORKA_SCM_EGRESS_PROXY_TOKEN)"))
+        and ((.value // "") | test("scm-egress-proxy"))
+      )] | length) == 2
+      and ([$env[] | select(.name == "ORKA_PUBLISHER_SCM_EGRESS_PROXY_REQUIRED" and .value == "true")] | length) == 1
+      and ($args | test("credential-root|artifact-capability-secret"; "i") | not)
+      and $mountedSecrets == ["publisher-auth"]
+      and $authPaths == ["controller-token", "operation-capability-secret"]
+      and $authMounts == [
+        {mountPath:"/var/run/orka/publisher-auth/controller-token", subPath:"controller-token", readOnly:true},
+        {mountPath:"/var/run/orka/publisher-auth/operation-capability-secret", subPath:"operation-capability-secret", readOnly:true}
+      ]
+  ' <<<"${deployment_json}" >/dev/null || \
+    die "Publisher must use nonempty controller brokers without direct workspace credential or artifact-signing authority"
+  service_account="$(jq -r '.spec.template.spec.serviceAccountName // "default"' <<<"${deployment_json}")"
+  publisher_service_account="${service_account}"
+  can_get="$(auth_can_i get secrets --as="system:serviceaccount:${orka_namespace}:${service_account}" --all-namespaces)"
+  can_list="$(auth_can_i list secrets --as="system:serviceaccount:${orka_namespace}:${service_account}" --all-namespaces)"
+  [[ "${can_get}" == "no" && "${can_list}" == "no" ]] || \
+    die "Publisher ServiceAccount ${service_account} has direct Kubernetes Secret read authority"
+}
+
+assert_publisher_cannot_access_secret() {
+  local secret_namespace="$1"
+  local secret_name="$2"
+  local identity="system:serviceaccount:${orka_namespace}:${publisher_service_account}"
+  local can_get can_list can_watch can_create_pods can_create_deployments can_create_jobs
+  can_get="$(auth_can_i get "secret/${secret_name}" -n "${secret_namespace}" --as="${identity}")"
+  can_list="$(auth_can_i list secrets -n "${secret_namespace}" --as="${identity}")"
+  can_watch="$(auth_can_i watch secrets -n "${secret_namespace}" --as="${identity}")"
+  can_create_pods="$(auth_can_i create pods -n "${secret_namespace}" --as="${identity}")"
+  can_create_deployments="$(auth_can_i create deployments.apps -n "${secret_namespace}" --as="${identity}")"
+  can_create_jobs="$(auth_can_i create jobs.batch -n "${secret_namespace}" --as="${identity}")"
+  [[ "${can_get}" == "no" && "${can_list}" == "no" && "${can_watch}" == "no" ]] || \
+    die "Publisher ServiceAccount can directly read credential Secret ${secret_namespace}/${secret_name}"
+  [[ "${can_create_pods}" == "no" && "${can_create_deployments}" == "no" && "${can_create_jobs}" == "no" ]] || \
+    die "Publisher ServiceAccount can create workloads that mount credential Secret ${secret_namespace}/${secret_name}"
+}
+
+apply_agent() {
+  local provider="$1"
+  local model="$2"
+  local name="$3"
+  local max_turns="${4:-12}"
+  local allow_bash="${5:-false}"
+  jq -n \
+    --arg provider "${provider}" \
+    --arg model "${model}" \
+    --arg name "${name}" \
+    --argjson maxTurns "${max_turns}" \
+    --argjson allowBash "${allow_bash}" \
+    --argjson opencodeContextWindow "${opencode_context_window}" \
+    --argjson opencodeMaxTokens "${opencode_max_tokens}" \
+    '{
+      apiVersion:"core.orka.ai/v1alpha1",
+      kind:"Agent",
+      metadata:{name:$name},
+      spec:{
+        runtime:({
+          type:$provider,
+          contractVersion:"orka.harness.v2",
+          defaultMaxTurns:$maxTurns
+        } + (if $provider == "codex" then {} else {
+          defaultAllowBash:$allowBash,
+          defaultAllowedTools:(
+            if $provider == "opencode" and $allowBash then ["Read","Write","Edit","Bash","Glob","Grep"]
+            elif $allowBash then ["Read","Glob","Grep","Bash"]
+            else ["Read","Glob","Grep"] end
+          )
+        } end)),
+        model:(
+          if $provider == "opencode" then
+            {name:$model,contextWindow:$opencodeContextWindow,maxTokens:$opencodeMaxTokens}
+          else {name:$model} end
+        )
+      }
+    }' | k -n "${namespace}" apply -f - >/dev/null
+}
+
+# Read tasks without Bash carry the restricted {Read,Glob,Grep} tool policy for
+# every provider, so codex exercises its native read-only agent mode live.
+# Codex cannot express restricted policies that include Bash, so the blocking
+# timeout/cancel tasks stay unrestricted for it.
+apply_read_task() {
+  local name="$1"
+  local agent="$2"
+  local session="$3"
+  local create="$4"
+  local prompt="$5"
+  local timeout="${6:-12m}"
+  local allow_bash="${7:-false}"
+  local source_identity="${read_repo_identity:-}"
+  local provider
+  provider="$(k -n "${namespace}" get agent "${agent}" -o jsonpath='{.spec.runtime.type}')"
+  jq -n \
+    --arg name "${name}" \
+    --arg run "${run_id}" \
+    --arg agent "${agent}" \
+    --arg session "${session}" \
+    --arg prompt "${prompt}" \
+    --arg repo "${repo_url}" \
+    --arg ref "${repo_ref}" \
+    --arg identity "${source_identity}" \
+    --arg timeout "${timeout}" \
+    --arg provider "${provider}" \
+    --argjson create "${create}" \
+    --argjson allowBash "${allow_bash}" \
+    '{
+      apiVersion:"core.orka.ai/v1alpha1",
+      kind:"Task",
+      metadata:{name:$name,labels:{"orka.ai/acp-e2e-run":$run}},
+      spec:({
+        type:"agent",
+        agentRef:{name:$agent},
+        prompt:$prompt,
+        workspace:({intent:"read",gitRepo:$repo,ref:$ref} +
+          (if ($identity|length)>0 then {sourceRepository:{provider:"github",id:$identity}} else {} end)),
+        agentRuntime:({maxTurns:12} + (
+          if $provider == "codex" and $allowBash then {} else {
+            allowBash:$allowBash,
+            allowedTools:(if $allowBash then ["Read","Glob","Grep","Bash"] else ["Read","Glob","Grep"] end)
+          } end)),
+        timeout:$timeout
+      } + (if ($session|length)>0 then {sessionRef:{name:$session,create:$create,append:true}} else {} end))
+    }' | k -n "${namespace}" apply -f - >/dev/null
+}
+
+apply_invalid_read_task() {
+  local name="$1"
+  local agent="$2"
+  local unsafe_repo="$3"
+  jq -n \
+    --arg name "${name}" \
+    --arg run "${run_id}" \
+    --arg agent "${agent}" \
+    --arg repo "${unsafe_repo}" \
+    --arg ref "${repo_ref}" \
+    '{
+      apiVersion:"core.orka.ai/v1alpha1",
+      kind:"Task",
+      metadata:{name:$name,labels:{"orka.ai/acp-e2e-run":$run}},
+      spec:{
+        type:"agent",
+        agentRef:{name:$agent},
+        prompt:"This request must be rejected before RuntimePool demand or prompt submission.",
+        workspace:{intent:"read",gitRepo:$repo,ref:$ref},
+        timeout:"2m"
+      }
+    }' | k -n "${namespace}" apply -f - >/dev/null
+}
+
+copy_secret_key_to_test_namespace() {
+  local source_namespace="$1"
+  local source_name="$2"
+  local source_key="$3"
+  local target_name="$4"
+  resource_exists -n "${source_namespace}" get secret "${source_name}" || \
+    die "Secret/${source_name} does not exist in namespace ${source_namespace}"
+  if ! k -n "${source_namespace}" get secret "${source_name}" -o json | \
+      jq -e --arg key "${source_key}" '(.data[$key] // "") | length > 0' >/dev/null; then
+    die "Secret/${source_name} key ${source_key} is missing or empty"
+  fi
+  k -n "${source_namespace}" get secret "${source_name}" -o json |
+    jq --arg ns "${namespace}" --arg name "${target_name}" --arg key "${source_key}" '{
+      apiVersion:"v1",
+      kind:"Secret",
+      metadata:{name:$name,namespace:$ns},
+      type:(.type // "Opaque"),
+      data:{($key):.data[$key]}
+    }' | k apply -f - >/dev/null
+}
+
+task_json() {
+  local task="$1"
+  local payload attempt
+  for ((attempt = 1; attempt <= 10; attempt++)); do
+    if payload="$(k -n "${namespace}" get task "${task}" -o json 2>/dev/null)"; then
+      printf '%s\n' "${payload}"
+      return 0
+    fi
+    sleep 0.25
+  done
+  k -n "${namespace}" get task "${task}" -o json
+}
+
+task_probe_state=""
+task_probe_file=""
+probe_task() {
+  local task="$1"
+  local output_file="${temp_root}/task-probe-${task}.json"
+  local error_file="${temp_root}/task-probe-${task}.err"
+  local rc=0
+  task_probe_state=""
+  task_probe_file="${output_file}"
+  if k -n "${namespace}" get task "${task}" -o json --ignore-not-found >"${output_file}" 2>"${error_file}"; then
+    rc=0
+  else
+    rc=$?
+  fi
+  if [[ "${rc}" -ne 0 ]]; then
+    task_probe_state="error"
+    cat "${error_file}" | redact >&2
+    return 1
+  fi
+  if [[ -s "${output_file}" ]]; then
+    task_probe_state="present"
+  else
+    task_probe_state="absent"
+  fi
+}
+
+runtimepool_probe_state=""
+probe_runtimepool() {
+  local pool="$1"
+  local output_file="${temp_root}/runtimepool-probe-${pool}.json"
+  local error_file="${temp_root}/runtimepool-probe-${pool}.err"
+  local rc=0
+  runtimepool_probe_state=""
+  if k -n "${namespace}" get runtimepool "${pool}" -o json --ignore-not-found >"${output_file}" 2>"${error_file}"; then
+    rc=0
+  else
+    rc=$?
+  fi
+  if [[ "${rc}" -ne 0 ]]; then
+    runtimepool_probe_state="error"
+    cat "${error_file}" | redact >&2
+    return 1
+  fi
+  if [[ -s "${output_file}" ]]; then
+    runtimepool_probe_state="present"
+  else
+    runtimepool_probe_state="absent"
+  fi
+}
+
+task_phase_is() {
+  local task="$1"
+  shift
+  local phase expected
+  phase="$(k -n "${namespace}" get task "${task}" -o jsonpath='{.status.phase}' 2>/dev/null)" || return 1
+  for expected in "$@"; do
+    [[ "${phase}" == "${expected}" ]] && return 0
+  done
+  return 1
+}
+
+task_execution_state_is() {
+  local task="$1"
+  shift
+  local state expected
+  state="$(k -n "${namespace}" get task "${task}" -o jsonpath='{.status.execution.state}' 2>/dev/null)" || return 1
+  for expected in "$@"; do
+    [[ "${state}" == "${expected}" ]] && return 0
+  done
+  return 1
+}
+
+task_execution_terminal() {
+  task_execution_state_is "$1" Succeeded Failed Cancelled OutcomeUnknown
+}
+
+task_terminal_projection_ready() {
+  local task="$1"
+  local payload
+  payload="$(k -n "${namespace}" get task "${task}" -o json 2>/dev/null)" || return 1
+  jq -e '
+    (.status.execution.state // "") as $state
+    | (.status.phase // "") as $phase
+    | ($state == "Succeeded" and $phase == "Succeeded")
+      or ($state == "Failed" and $phase == "Failed")
+      or ($state == "Cancelled" and $phase == "Cancelled")
+      or ($state == "OutcomeUnknown" and $phase == "Failed")
+  ' <<<"${payload}" >/dev/null
+}
+
+wait_task_terminal() {
+  local task="$1"
+  wait_until "Task/${task} terminal execution and phase projection" "${wait_seconds}" task_terminal_projection_ready "${task}"
+}
+
+wait_task_pool_name_value() {
+  local task="$1"
+  local name
+  name="$(k -n "${namespace}" get task "${task}" -o jsonpath='{.status.execution.runtimePoolName}' 2>/dev/null)" || return 1
+  [[ -n "${name}" ]] || return 1
+  printf '%s\n' "${name}"
+}
+
+pool_serving() {
+  local pool="$1"
+  local values
+  values="$(k -n "${namespace}" get runtimepool "${pool}" -o jsonpath='{.status.lifecycle}{"/"}{.status.admissionState}' 2>/dev/null)" || return 1
+  [[ "${values}" == "Serving/Accepting" ]]
+}
+
+wait_pool_serving() {
+  local pool="$1"
+  wait_until "RuntimePool/${pool} Serving/Accepting" "${wait_seconds}" pool_serving "${pool}"
+}
+
+pool_lifecycle_is() {
+  local pool="$1"
+  local lifecycle="$2"
+  local admission="${3:-}"
+  local payload
+  payload="$(k -n "${namespace}" get runtimepool "${pool}" -o json 2>/dev/null)" || return 1
+  [[ "$(jq -r '.status.lifecycle // ""' <<<"${payload}")" == "${lifecycle}" ]] || return 1
+  if [[ -n "${admission}" ]]; then
+    [[ "$(jq -r '.status.admissionState // ""' <<<"${payload}")" == "${admission}" ]] || return 1
+  fi
+}
+
+
+pool_lifecycle_reached() {
+  local pool="$1"
+  local target="$2"
+  local payload state
+  payload="$(k -n "${namespace}" get runtimepool "${pool}" -o json 2>/dev/null)" || return 1
+  state="$(jq -r '(.status.lifecycle // "") + "/" + (.status.admissionState // "")' <<<"${payload}")"
+  case "${target}:${state}" in
+    Draining:Draining/Draining|Draining:Quiescent/Draining|Draining:Stopping/Closed|Draining:Stopped/Closed | \
+    Quiescent:Quiescent/Draining|Quiescent:Stopping/Closed|Quiescent:Stopped/Closed | \
+    Stopping:Stopping/Closed|Stopping:Stopped/Closed | \
+    Stopped:Stopped/Closed)
+      return 0
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
+pool_instance_changed_and_serving() {
+  local pool="$1"
+  local previous_instance="$2"
+  local payload instance
+  payload="$(k -n "${namespace}" get runtimepool "${pool}" -o json 2>/dev/null)" || return 1
+  instance="$(jq -r '.status.activeInstance.runtimeInstanceID // ""' <<<"${payload}")"
+  [[ -n "${instance}" && "${instance}" != "${previous_instance}" ]] || return 1
+  jq -e '.status.lifecycle == "Serving" and .status.admissionState == "Accepting"' <<<"${payload}" >/dev/null
+}
+
+pool_transient_counters_zero() {
+  local pool="$1"
+  local expected_resident_sessions="${2:-0}"
+  local payload
+  is_uint "${expected_resident_sessions}" || return 1
+  payload="$(k -n "${namespace}" get runtimepool "${pool}" -o json 2>/dev/null)" || return 1
+  # Idle durable RuntimeSessions intentionally retain one provider process each.
+  # Callers must state the exact expected resident count so task-scoped leaks do
+  # not pass as quiescent; drained/stopped validation separately requires zero.
+  jq -e --argjson expected "${expected_resident_sessions}" '
+    (.status.capacity | type) == "object"
+    and (.status.capacity.maxResidentSessions // 0) > 0
+    and (.status.capacity.maxRunningPrompts // 0) > 0
+    and (.status.capacity.residentSessions // 0) == $expected
+    and (.status.capacity.runningPrompts // 0) == 0
+    and (.status.capacity.queuedTasks // 0) == 0
+    and (.status.capacity.reservedSessions // 0) == 0
+    and (.status.capacity.reservedPrompts // 0) == 0
+    and (.status.capacity.pendingPermissions // 0) == 0
+    and (.status.capacity.finalizingSessions // 0) == 0
+    and (.status.capacity.liveDescendants // 0) <= $expected
+    and ((.status.capacity.reservations // []) | length) == 0
+  ' <<<"${payload}" >/dev/null
+}
+
+pool_stopped() {
+  local pool="$1"
+  local payload pod_ns count
+  payload="$(k -n "${namespace}" get runtimepool "${pool}" -o json 2>/dev/null)" || return 1
+  jq -e '
+    .spec.desiredReplicas == 0
+    and (.status.desiredReplicas // 0) == 0
+    and (.status.currentReplicas // 0) == 0
+    and .status.lifecycle == "Stopped"
+    and .status.admissionState == "Closed"
+    and (.status.activeInstance == null)
+    and (.status.capacity.residentSessions // 0) == 0
+    and (.status.capacity.runningPrompts // 0) == 0
+    and (.status.capacity.queuedTasks // 0) == 0
+    and (.status.capacity.reservedSessions // 0) == 0
+    and (.status.capacity.reservedPrompts // 0) == 0
+    and (.status.capacity.pendingPermissions // 0) == 0
+    and (.status.capacity.finalizingSessions // 0) == 0
+    and (.status.capacity.liveDescendants // 0) == 0
+    and ((.status.capacity.reservations // []) | length) == 0
+  ' <<<"${payload}" >/dev/null || return 1
+  pod_ns="$(jq -r '.spec.runtimeNamespace // ""' <<<"${payload}")"
+  [[ -n "${pod_ns}" ]] || pod_ns="${runtime_namespace}"
+  count="$(k -n "${pod_ns}" get pods \
+    -l "orka.ai/runtime-pool-namespace=${namespace},orka.ai/runtime-pool-name=${pool}" \
+    -o json 2>/dev/null | jq '[.items[] | select(.metadata.deletionTimestamp == null)] | length')" || return 1
+  [[ "${count}" == "0" ]]
+}
+
+park_runtimepool() {
+  local pool="$1"
+  log "Parking RuntimePool/${pool} between profile-specific ACP checks"
+  k -n "${namespace}" patch runtimepool "${pool}" --type=merge \
+    -p '{"spec":{"desiredReplicas":0}}' >/dev/null
+  wait_until "RuntimePool/${pool} stopped after phase parking" "${state_wait_seconds}" pool_stopped "${pool}"
+}
+
+park_provider_runtimepools_except() {
+  local provider="$1"
+  local keep_pool="$2"
+  local pools pool
+  pools="$(k -n "${namespace}" get runtimepool -o json | jq -r \
+    --arg provider "${provider}" --arg keep "${keep_pool}" \
+    '.items[] | select(.metadata.name != $keep and .spec.runtime.profile.providerKind == $provider) | .metadata.name')"
+  [[ -n "${pools}" ]] || return 0
+  while IFS= read -r pool; do
+    [[ -n "${pool}" ]] || continue
+    park_runtimepool "${pool}"
+  done <<<"${pools}"
+}
+
+resume_runtimepool() {
+  local pool="$1"
+  log "Resuming RuntimePool/${pool} for continuation recovery checks"
+  k -n "${namespace}" patch runtimepool "${pool}" --type=merge \
+    -p '{"spec":{"desiredReplicas":1}}' >/dev/null
+  wait_pool_serving "${pool}"
+}
+
+pool_running_for_task() {
+  local task="$1"
+  local pool="$2"
+  task_execution_state_is "${task}" Running || return 1
+  local running
+  running="$(k -n "${namespace}" get runtimepool "${pool}" -o jsonpath='{.status.capacity.runningPrompts}' 2>/dev/null)" || return 1
+  is_uint "${running}" && (( running > 0 ))
+}
+
+pool_profile_projection_valid() {
+  local pool="$1"
+  local provider="$2"
+  local model="$3"
+  local intent="$4"
+  local payload="$5"
+  local pod_payload="$6"
+  jq -e \
+    --arg pool "${pool}" \
+    --arg provider "${provider}" \
+    --arg model "${model}" \
+    --arg intent "${intent}" \
+    --arg ns "${namespace}" \
+    --argjson pod "${pod_payload}" '
+      .spec.trustDomain.namespace == $ns
+      and .metadata.name == $pool
+      and (.metadata.name | test("^acp-" + $provider + "-[a-f0-9]{16}$"))
+      and .metadata.labels["orka.ai/acp-runtime-pool"] == "true"
+      and .metadata.labels["orka.ai/acp-trust-domain"] == $ns
+      and .metadata.labels["orka.ai/acp-profile"] ==
+        ((.spec.runtime.profile.digest | ltrimstr("sha256:"))[0:16])
+      and ((.metadata.uid // "") | length > 0)
+      and ((.metadata.generation // 0) > 0)
+      and .status.observedGeneration == .metadata.generation
+      and .spec.desiredReplicas == 1
+      and .spec.runtime.profile.protocolVersion == "orka.harness.v2"
+      and .spec.runtime.profile.providerKind == $provider
+      and .spec.runtime.profile.model == $model
+      and .spec.runtime.profile.workspaceIntent == $intent
+      and (.spec.runtime.image | test("@sha256:[a-f0-9]{64}$"))
+      and (.spec.runtime.profile.digest | test("^sha256:[a-f0-9]{64}$"))
+      and (.spec.runtime.profile.digestSchemaVersion | length > 0)
+      and (.spec.runtime.profile.adapterDigests | length > 0)
+      and ([.spec.runtime.profile.adapterDigests[] | test("^sha256:[a-f0-9]{64}$")] | all)
+      and (.spec.runtime.profile.agentConfigurationDigest | test("^sha256:[a-f0-9]{64}$"))
+      and (.spec.runtime.profile.toolPolicyDigest | test("^sha256:[a-f0-9]{64}$"))
+      and (.spec.runtime.profile.approvalPolicyDigest | test("^sha256:[a-f0-9]{64}$"))
+      and (.spec.runtime.profile.mcpConfigurationDigest | test("^sha256:[a-f0-9]{64}$"))
+      and (.spec.runtime.profile.proxyCredentialRole | length > 0)
+      and (.spec.runtime.profile.proxyCredentialScope | length > 0)
+      and .status.lifecycle == "Serving"
+      and .status.admissionState == "Accepting"
+      and .status.currentReplicas == 1
+      and .status.desiredReplicas == 1
+      and .status.controllerEpoch > 0
+      and .status.activeInstance.controllerEpoch == .status.controllerEpoch
+      and .status.activeInstance.protocolVersion == "orka.harness.v2"
+      and .status.activeInstance.profileDigest == .spec.runtime.profile.digest
+      and .status.activeInstance.profileDigestSchemaVersion == .spec.runtime.profile.digestSchemaVersion
+      and ((.status.activeInstance.providerTokenGeneration // "") | test("^[a-f0-9]{16}$"))
+      and (.status.activeInstance.bootID | length > 0)
+      and (.status.activeInstance.podNamespace | length > 0)
+      and (.status.activeInstance.podName | length > 0)
+      and (.status.activeInstance.podUID | length > 0)
+      and .status.activeInstance.runtimeInstanceID ==
+        (.status.activeInstance.podUID + "." + .status.activeInstance.bootID)
+      and (.status.activeInstance.podAddress | length > 0)
+      and ((.status.activeInstance.lastObservedTime // "") | length > 0)
+      and $pod.metadata.namespace == .status.activeInstance.podNamespace
+      and $pod.metadata.name == .status.activeInstance.podName
+      and $pod.metadata.uid == .status.activeInstance.podUID
+      and (($pod.metadata.annotations["orka.ai/provider-token-generation"] // "") |
+        test("^[a-f0-9]{16}$"))
+      and $pod.metadata.annotations["orka.ai/provider-token-generation"] ==
+        .status.activeInstance.providerTokenGeneration
+      and .status.capacity.maxResidentSessions >= 1
+      and .status.capacity.maxRunningPrompts >= 1
+      and .status.capacity.maxRunningPrompts <= .status.capacity.maxResidentSessions
+    ' <<<"${payload}" >/dev/null
+}
+
+pool_profile_projection_fingerprint() {
+  local payload="$1"
+  local pod_payload="$2"
+  jq -cS --argjson pod "${pod_payload}" '{
+    poolUID:.metadata.uid,
+    poolName:.metadata.name,
+    poolGeneration:.metadata.generation,
+    desiredReplicas:.spec.desiredReplicas,
+    trustDomain:.spec.trustDomain,
+    runtime:{
+      image:.spec.runtime.image,
+      profile:.spec.runtime.profile
+    },
+    status:{
+      lifecycle:.status.lifecycle,
+      admissionState:.status.admissionState,
+      currentReplicas:.status.currentReplicas,
+      desiredReplicas:.status.desiredReplicas,
+      observedGeneration:.status.observedGeneration,
+      controllerEpoch:.status.controllerEpoch,
+      activeInstance:{
+        controllerEpoch:.status.activeInstance.controllerEpoch,
+        protocolVersion:.status.activeInstance.protocolVersion,
+        profileDigest:.status.activeInstance.profileDigest,
+        profileDigestSchemaVersion:.status.activeInstance.profileDigestSchemaVersion,
+        providerTokenGeneration:.status.activeInstance.providerTokenGeneration,
+        runtimeInstanceID:.status.activeInstance.runtimeInstanceID,
+        bootID:.status.activeInstance.bootID,
+        podNamespace:.status.activeInstance.podNamespace,
+        podName:.status.activeInstance.podName,
+        podUID:.status.activeInstance.podUID,
+        podAddress:.status.activeInstance.podAddress
+      },
+      capacity:{
+        maxResidentSessions:.status.capacity.maxResidentSessions,
+        maxRunningPrompts:.status.capacity.maxRunningPrompts
+      }
+    },
+    selectedPod:{
+      namespace:$pod.metadata.namespace,
+      name:$pod.metadata.name,
+      uid:$pod.metadata.uid,
+      providerTokenGeneration:$pod.metadata.annotations["orka.ai/provider-token-generation"]
+    }
+  }' <<<"${payload}"
+}
+
+pool_profile_projection_stable() {
+  local pool="$1"
+  local provider="$2"
+  local model="$3"
+  local intent="$4"
+  local output_file="$5"
+  local first_payload first_pod_payload first_pod_ns first_pod_name
+  local second_payload second_pod_payload second_pod_ns second_pod_name
+  local first_fingerprint second_fingerprint candidate_file
+
+  first_payload="$(k -n "${namespace}" get runtimepool "${pool}" -o json 2>/dev/null)" || return 1
+  first_pod_ns="$(jq -r '.status.activeInstance.podNamespace // ""' <<<"${first_payload}")" || return 1
+  first_pod_name="$(jq -r '.status.activeInstance.podName // ""' <<<"${first_payload}")" || return 1
+  [[ -n "${first_pod_ns}" && -n "${first_pod_name}" ]] || return 1
+  first_pod_payload="$(k -n "${first_pod_ns}" get pod "${first_pod_name}" -o json 2>/dev/null)" || return 1
+  pool_profile_projection_valid \
+    "${pool}" "${provider}" "${model}" "${intent}" "${first_payload}" "${first_pod_payload}" || return 1
+  first_fingerprint="$(pool_profile_projection_fingerprint "${first_payload}" "${first_pod_payload}")" || return 1
+
+  sleep 0.25
+
+  second_payload="$(k -n "${namespace}" get runtimepool "${pool}" -o json 2>/dev/null)" || return 1
+  second_pod_ns="$(jq -r '.status.activeInstance.podNamespace // ""' <<<"${second_payload}")" || return 1
+  second_pod_name="$(jq -r '.status.activeInstance.podName // ""' <<<"${second_payload}")" || return 1
+  [[ -n "${second_pod_ns}" && -n "${second_pod_name}" ]] || return 1
+  second_pod_payload="$(k -n "${second_pod_ns}" get pod "${second_pod_name}" -o json 2>/dev/null)" || return 1
+  pool_profile_projection_valid \
+    "${pool}" "${provider}" "${model}" "${intent}" "${second_payload}" "${second_pod_payload}" || return 1
+  second_fingerprint="$(pool_profile_projection_fingerprint "${second_payload}" "${second_pod_payload}")" || return 1
+  [[ "${first_fingerprint}" == "${second_fingerprint}" ]] || return 1
+
+  candidate_file="${output_file}.candidate.$$"
+  printf '%s\n' "${second_payload}" >"${candidate_file}"
+  mv "${candidate_file}" "${output_file}"
+}
+
+wait_pool_profile_projection() {
+  local pool="$1"
+  local provider="$2"
+  local model="$3"
+  local intent="$4"
+  local output_file="$5"
+  wait_until_fast "RuntimePool/${pool} complete stable ACP v2 ${provider}/${intent} profile projection" \
+    "${wait_seconds}" pool_profile_projection_stable \
+    "${pool}" "${provider}" "${model}" "${intent}" "${output_file}" || \
+    die "RuntimePool/${pool} did not reach the expected stable ACP v2 ${provider}/${intent} profile projection"
+}
+
+capture_pool_snapshot() {
+  local pool="$1"
+  local provider="$2"
+  local model="$3"
+  local intent="$4"
+  local output_file="$5"
+  local pool_file pod_file pod_ns pod_name pool_uid pod_uid pod_ip pod_address image pod_runtime_image pod_count
+  pool_file="${temp_root}/pool-${pool}.json"
+  wait_pool_profile_projection "${pool}" "${provider}" "${model}" "${intent}" "${pool_file}"
+  pool_uid="$(jq -r '.metadata.uid // ""' "${pool_file}")"
+  pod_ns="$(jq -r '.status.activeInstance.podNamespace // ""' "${pool_file}")"
+  pod_name="$(jq -r '.status.activeInstance.podName // ""' "${pool_file}")"
+  pod_uid="$(jq -r '.status.activeInstance.podUID // ""' "${pool_file}")"
+  pod_address="$(jq -r '.status.activeInstance.podAddress // ""' "${pool_file}")"
+  image="$(jq -r '.spec.runtime.image // ""' "${pool_file}")"
+  [[ -n "${pool_uid}" && -n "${pod_ns}" && -n "${pod_name}" && -n "${pod_uid}" && -n "${pod_address}" ]] || \
+    die "RuntimePool/${pool} has an incomplete active-instance fence"
+  record_runtime_namespace "${pod_ns}"
+  pod_file="${temp_root}/pod-${pool}.json"
+  k -n "${pod_ns}" get pod "${pod_name}" -o json >"${pod_file}"
+  pod_ip="$(jq -r '.status.podIP // ""' "${pod_file}")"
+  pod_runtime_image="$(jq -r '.spec.containers[] | select(.name == "runtime") | .image' "${pod_file}")"
+  [[ "${pod_runtime_image}" == "${image}" ]] || \
+    die "RuntimePool/${pool} selected Pod runtime image does not match spec.runtime.image"
+  [[ "$(jq -r '.metadata.uid // ""' "${pod_file}")" == "${pod_uid}" ]] || \
+    die "RuntimePool/${pool} activeInstance.podUID does not match Pod/${pod_name} metadata.uid"
+  [[ "${pod_ip}" == "${pod_address}" ]] || \
+    die "RuntimePool/${pool} podAddress ${pod_address} is not the exact Pod IP ${pod_ip}"
+  pod_count="$(k -n "${pod_ns}" get pods \
+    -l "orka.ai/runtime-pool-namespace=${namespace},orka.ai/runtime-pool-name=${pool}" -o json |
+    jq '[.items[] | select(.metadata.deletionTimestamp == null)] | length')"
+  [[ "${pod_count}" == "1" ]] || die "RuntimePool/${pool} has ${pod_count} live Pods, want exactly 1"
+  assert_all_pod_images "${pod_ns}" "${pod_name}"
+  jq -n --slurpfile pool "${pool_file}" --slurpfile pod "${pod_file}" '{
+    poolName:$pool[0].metadata.name,
+    poolUID:$pool[0].metadata.uid,
+    controllerEpoch:$pool[0].status.controllerEpoch,
+    profileDigest:$pool[0].spec.runtime.profile.digest,
+    profileDigestSchemaVersion:$pool[0].spec.runtime.profile.digestSchemaVersion,
+    runtimeImage:$pool[0].spec.runtime.image,
+    runtimeInstanceID:$pool[0].status.activeInstance.runtimeInstanceID,
+    supervisorBootID:$pool[0].status.activeInstance.bootID,
+    podNamespace:$pool[0].status.activeInstance.podNamespace,
+    podName:$pool[0].status.activeInstance.podName,
+    podUID:$pool[0].status.activeInstance.podUID,
+    podAddress:$pool[0].status.activeInstance.podAddress,
+    podImageID:($pod[0].status.containerStatuses[] | select(.name == "runtime") | .imageID)
+  }' >"${output_file}"
+}
+
+assert_task_fence() {
+  local task="$1"
+  local snapshot="$2"
+  local payload_file="${temp_root}/task-${task}.json"
+  task_json "${task}" >"${payload_file}"
+  if ! jq -e --slurpfile snapshot "${snapshot}" '
+    $snapshot[0] as $s
+    | .status.execution as $e
+    | ($e.runtimePoolName == $s.poolName)
+      and (.metadata.labels["orka.ai/runtime-pool"] == $s.poolName)
+      and ($e.runtimePoolUID == $s.poolUID)
+      and ($e.runtimeInstanceID == $s.runtimeInstanceID)
+      and ($e.controllerEpoch == $s.controllerEpoch)
+      and (($e.promptID // "") | length > 0)
+      and (($e.requestDigest // "") | test("^sha256:[a-f0-9]{64}$"))
+      and (($e.runtimeSessionUID // "") | length > 0)
+      and (($e.runtimeSessionGeneration // 0) >= 1)
+      and (($e.attempt // 0) == 1)
+  ' "${payload_file}" >/dev/null; then
+    safe_task_summary "${task}"
+    die "Task/${task} execution fence does not match the exact RuntimePool/Pod/profile snapshot"
+  fi
+}
+
+
+assert_restart_task_fence() {
+  local task="$1"
+  local snapshot="$2"
+  local payload_file="${temp_root}/task-${task}.json"
+  task_json "${task}" >"${payload_file}"
+  if ! jq -e --slurpfile snapshot "${snapshot}" '
+    $snapshot[0] as $s
+    | .status.execution as $e
+    | ($e.runtimePoolName == $s.poolName)
+      and (.metadata.labels["orka.ai/runtime-pool"] == $s.poolName)
+      and ($e.runtimePoolUID == $s.poolUID)
+      and ($e.runtimeInstanceID == $s.runtimeInstanceID)
+      and (($e.controllerEpoch | type) == "number")
+      and (($s.controllerEpoch | type) == "number")
+      and (($e.controllerEpoch | floor) == $e.controllerEpoch)
+      and (($s.controllerEpoch | floor) == $s.controllerEpoch)
+      and ($e.controllerEpoch >= $s.controllerEpoch)
+      and (($e.promptID // "") | length > 0)
+      and (($e.requestDigest // "") | test("^sha256:[a-f0-9]{64}$"))
+      and (($e.runtimeSessionUID // "") | length > 0)
+      and (($e.runtimeSessionGeneration // 0) >= 1)
+      and (($e.attempt // 0) == 1)
+  ' "${payload_file}" >/dev/null; then
+    safe_task_summary "${task}"
+    die "Task/${task} restart recovery fence does not preserve the exact pre-restart runtime identity"
+  fi
+}
+
+mark_task_validated() {
+  local task="$1"
+  if ! k -n "${namespace}" patch task "${task}" --type=merge \
+      -p '{"metadata":{"labels":{"orka.ai/acp-e2e-validated":"true"}}}' >/dev/null; then
+    die "failed to mark Task/${task} as release-gate validated"
+  fi
+}
+
+assert_task_succeeded_read() {
+  local task="$1"
+  local snapshot="$2"
+  local expected_sha="$3"
+  local expected_nonce="${4:-}"
+  local expected_text="${5:-}"
+  local payload result
+  wait_task_terminal "${task}"
+  payload="$(task_json "${task}")"
+  if ! jq -e --arg sha "${expected_sha}" '
+    .status.phase == "Succeeded"
+    and .status.execution.state == "Succeeded"
+    and .status.execution.outcome == "Succeeded"
+    and .status.delivery.state == "ReadValidated"
+    and .status.delivery.outcome == "ReadValidated"
+    and .status.delivery.startingSHA == $sha
+    and (.status.resultRef.available == true)
+    and ((.status.jobName // "") == "")
+  ' <<<"${payload}" >/dev/null; then
+    safe_task_summary "${task}"
+    die "Task/${task} did not produce a successful ReadValidated result"
+  fi
+  assert_task_fence "${task}" "${snapshot}"
+  if [[ "${release_gate}" -eq 1 && ( -n "${expected_nonce}" || -n "${expected_text}" ) ]]; then
+    result="$(api_task_result "${task}")" || die "failed to fetch Task/${task} result from the authenticated API"
+    if [[ -n "${expected_nonce}" ]] && ! grep -Fq -- "${expected_nonce}" <<<"${result}"; then
+      die "Task/${task} result did not contain the release-gate nonce"
+    fi
+    if [[ -n "${expected_text}" ]] && ! grep -Fq -- "${expected_text}" <<<"${result}"; then
+      die "Task/${task} result did not contain independently observed repository content"
+    fi
+  fi
+  mark_task_validated "${task}"
+}
+
+assert_cancelled_task() {
+  local task="$1"
+  local snapshot="$2"
+  wait_task_terminal "${task}"
+  local payload
+  payload="$(task_json "${task}")"
+  if ! jq -e '
+    .status.phase == "Cancelled"
+    and .status.execution.state == "Cancelled"
+    and .status.execution.outcome == "Cancelled"
+    and .status.execution.reason == "Cancelled"
+    and ((.status.jobName // "") == "")
+  ' <<<"${payload}" >/dev/null; then
+    safe_task_summary "${task}"
+    die "Task/${task} cancellation did not settle as controller-owned Cancelled"
+  fi
+  assert_task_fence "${task}" "${snapshot}"
+  mark_task_validated "${task}"
+}
+
+assert_restart_task_settled() {
+  local task="$1"
+  local snapshot="$2"
+  wait_task_terminal "${task}"
+  local payload
+  payload="$(task_json "${task}")"
+  if ! jq -e '
+    (
+      .status.phase == "Succeeded"
+      and .status.execution.state == "Succeeded"
+      and .status.execution.outcome == "Succeeded"
+      and .status.delivery.state == "ReadValidated"
+      and .status.delivery.outcome == "ReadValidated"
+    )
+    or (
+      .status.phase == "Cancelled"
+      and .status.execution.state == "Cancelled"
+      and .status.execution.outcome == "Cancelled"
+    )
+    or (
+      .status.phase == "Failed"
+      and .status.execution.state == "OutcomeUnknown"
+      and .status.execution.outcome == "OutcomeUnknown"
+    )
+  ' <<<"${payload}" >/dev/null; then
+    safe_task_summary "${task}"
+    die "Task/${task} did not settle safely across controller restart"
+  fi
+  [[ "$(jq -r '.status.execution.attempt // 0' <<<"${payload}")" == "1" ]] || \
+    die "Task/${task} was replayed after controller restart"
+  assert_restart_task_fence "${task}" "${snapshot}"
+  mark_task_validated "${task}"
+}
+
+assert_all_tasks_validated() {
+  local unvalidated
+  unvalidated="$(k -n "${namespace}" get tasks -o json | jq -r '
+    .items[]
+    | select((.status.execution.state // "") != "" or (.status.phase // "") != "")
+    | select(.metadata.labels["orka.ai/acp-e2e-validated"] != "true")
+    | .metadata.name
+  ')"
+  if [[ -n "${unvalidated}" ]]; then
+    printf '%s\n' "${unvalidated}" >&2
+    die "one or more Tasks reached controller processing without exact fence/result validation"
+  fi
+}
+
+read_smoke_pool=""
+read_smoke_session_uid=""
+read_smoke_session_generation=""
+run_read_smoke() {
+  local provider="$1"
+  local model="$2"
+  local agent="$3"
+  local task="$4"
+  local session="$5"
+  local nonce="$6"
+  local expected_line="$7"
+  local continuation fork_task pool snapshot continuation_snapshot fork_snapshot fork_response fork_after_seq
+  apply_agent "${provider}" "${model}" "${agent}"
+  apply_read_task "${task}" "${agent}" "${session}" true \
+    "Read LICENSE. Remember the session nonce ${nonce}. Report the nonce and the first non-empty LICENSE line exactly. Do not modify any file." \
+    "12m" false
+  wait_until "Task/${task} RuntimePool assignment" "${state_wait_seconds}" wait_task_pool_name_value "${task}"
+  pool="$(wait_task_pool_name_value "${task}")"
+  snapshot="${temp_root}/${task}-pool.json"
+  capture_pool_snapshot "${pool}" "${provider}" "${model}" read "${snapshot}"
+  assert_task_succeeded_read "${task}" "${snapshot}" "${read_repo_commit}" "${nonce}" "${expected_line}"
+
+  continuation="$(sanitize_name "${task}-continue")"
+  [[ "${continuation}" != "${task}" ]] || die "continuation Task name collided with source Task name"
+  apply_read_task "${continuation}" "${agent}" "${session}" false \
+    "Continue the existing session. Return the session nonce from the prior turn and no repository-derived replacement. Do not modify files." \
+    "12m" false
+  wait_until "Task/${continuation} RuntimePool assignment" "${state_wait_seconds}" wait_task_pool_name_value "${continuation}"
+  [[ "$(wait_task_pool_name_value "${continuation}")" == "${pool}" ]] || \
+    die "continuation Task/${continuation} selected a different RuntimePool"
+  continuation_snapshot="${temp_root}/${continuation}-pool.json"
+  capture_pool_snapshot "${pool}" "${provider}" "${model}" read "${continuation_snapshot}"
+  assert_task_succeeded_read "${continuation}" "${continuation_snapshot}" "${read_repo_commit}" "${nonce}" ""
+
+  local first_uid first_generation continued_uid continued_generation
+  first_uid="$(k -n "${namespace}" get task "${task}" -o jsonpath='{.status.execution.runtimeSessionUID}')"
+  first_generation="$(k -n "${namespace}" get task "${task}" -o jsonpath='{.status.execution.runtimeSessionGeneration}')"
+  continued_uid="$(k -n "${namespace}" get task "${continuation}" -o jsonpath='{.status.execution.runtimeSessionUID}')"
+  continued_generation="$(k -n "${namespace}" get task "${continuation}" -o jsonpath='{.status.execution.runtimeSessionGeneration}')"
+  [[ -n "${first_uid}" && "${first_uid}" == "${continued_uid}" ]] || \
+    die "create:false continuation did not preserve RuntimeSession UID"
+  [[ "${first_generation}" == "${continued_generation}" ]] || \
+    die "create:false continuation unexpectedly changed RuntimeSession generation without replacement"
+
+  if [[ "${release_gate}" -eq 1 ]]; then
+    fork_task="$(sanitize_name "${task}-fork")"
+    [[ "${fork_task}" != "${task}" && "${fork_task}" != "${continuation}" ]] || \
+      die "forked Task name collided with source or continuation Task name"
+    fork_response="$(api_fork_task "${continuation}" "${fork_task}" \
+      "Return the session nonce represented in the source task timeline. Do not modify files.")" || \
+      die "Task fork API request failed"
+    jq -e --arg source "${continuation}" --arg fork "${fork_task}" --arg ns "${namespace}" '
+      .namespace == $ns and .sourceTaskName == $source and .newTaskName == $fork and .afterSeq >= 1
+    ' <<<"${fork_response}" >/dev/null || die "Task fork API response did not identify the requested checkpoint fork"
+    fork_after_seq="$(jq -r '.afterSeq' <<<"${fork_response}")"
+    if ! k -n "${namespace}" patch task "${fork_task}" --type=merge \
+        -p "$(jq -cn --arg run "${run_id}" '{metadata:{labels:{"orka.ai/acp-e2e-run":$run}}}')" >/dev/null; then
+      die "failed to mark forked Task/${fork_task} as owned by this release-gate run"
+    fi
+    wait_until "forked Task/${fork_task} RuntimePool assignment" "${state_wait_seconds}" wait_task_pool_name_value "${fork_task}"
+    [[ "$(wait_task_pool_name_value "${fork_task}")" == "${pool}" ]] || \
+      die "forked Task/${fork_task} selected a different RuntimePool"
+    fork_snapshot="${temp_root}/${fork_task}-pool.json"
+    capture_pool_snapshot "${pool}" "${provider}" "${model}" read "${fork_snapshot}"
+    assert_task_succeeded_read "${fork_task}" "${fork_snapshot}" "${read_repo_commit}" "${nonce}" ""
+    jq -e --arg source "${continuation}" --arg seq "${fork_after_seq}" '
+      .metadata.annotations["orka.ai/fork-source-task"] == $source
+      and .metadata.annotations["orka.ai/fork-source-seq"] == $seq
+    ' < <(task_json "${fork_task}") >/dev/null || die "forked Task/${fork_task} does not bind to the API checkpoint sequence"
+  fi
+
+  read_smoke_pool="${pool}"
+  read_smoke_session_uid="${continued_uid}"
+  read_smoke_session_generation="${continued_generation}"
+}
+
+run_opencode_read_policy_check() {
+  local agent="$1"
+  local model="$2"
+  local task session pool snapshot
+  task="$(sanitize_name "acp-opencode-policy-${run_id}")"
+  session="$(sanitize_name "acp-opencode-policy-session-${run_id}")"
+  apply_read_task "${task}" "${agent}" "${session}" true \
+    "Attempt to use Bash and a file-mutation tool to create SHOULD_NOT_EXIST.txt. Those tools must be unavailable in this read-intent session. Then read LICENSE and report its first non-empty line without modifying any file." \
+    "12m" true
+  wait_until "Task/${task} RuntimePool assignment" "${state_wait_seconds}" wait_task_pool_name_value "${task}"
+  pool="$(wait_task_pool_name_value "${task}")"
+  snapshot="${temp_root}/${task}-pool.json"
+  capture_pool_snapshot "${pool}" opencode "${model}" read "${snapshot}"
+  assert_task_succeeded_read "${task}" "${snapshot}" "${read_repo_commit}" "" "${expected_license_line}"
+}
+
+server_dry_run_manifest() {
+  k apply --dry-run=server -f - >/dev/null
+}
+
+assert_dry_run_rejected() {
+  local manifest_file="$1"
+  local field="$2"
+  local expected_message="$3"
+  local output_file="${temp_root}/unsafe-output.txt"
+  local rc
+  if k apply --dry-run=server -f "${manifest_file}" >"${output_file}" 2>&1; then
+    rc=0
+  else
+    rc=$?
+  fi
+  if [[ "${rc}" -eq 0 ]]; then
+    die "unsafe workspace manifest ${manifest_file} was accepted"
+  fi
+  if ! grep -Fq -- "${field}" "${output_file}" || ! grep -Fq -- "${expected_message}" "${output_file}"; then
+    cat "${output_file}" | redact >&2
+    die "unsafe workspace rejection did not identify ${field} with the exact validation reason"
+  fi
+}
+
+build_read_manifest() {
+  local name="$1"
+  local agent="$2"
+  local git_repo="$3"
+  local output_file="$4"
+  jq -n \
+    --arg ns "${namespace}" --arg name "${name}" --arg agent "${agent}" \
+    --arg repo "${git_repo}" --arg ref "${repo_ref}" '{
+      apiVersion:"core.orka.ai/v1alpha1",kind:"Task",metadata:{name:$name,namespace:$ns},
+      spec:{type:"agent",agentRef:{name:$agent},prompt:"dry-run URL validation",workspace:{intent:"read",gitRepo:$repo,ref:$ref}}
+    }' >"${output_file}"
+}
+
+build_write_manifest() {
+  local name="$1"
+  local agent="$2"
+  local source_repo="$3"
+  local publication_repo="$4"
+  local output_file="$5"
+  jq -n \
+    --arg ns "${namespace}" --arg name "${name}" --arg agent "${agent}" \
+    --arg source "${source_repo}" --arg publication "${publication_repo}" \
+    --arg ref "${write_source_commit:-${repo_ref}}" --arg credential "${write_credential_target:-dry-run-credential}" '{
+      apiVersion:"core.orka.ai/v1alpha1",kind:"Task",metadata:{name:$name,namespace:$ns},
+      spec:{
+        type:"agent",agentRef:{name:$agent},prompt:"dry-run publication URL validation",
+        workspace:{
+          intent:"write",gitRepo:$source,ref:$ref,publicationGitRepo:$publication,
+          publicationCredentialRef:{name:$credential},pushBranch:"dry-run",prBaseBranch:"main",createPR:false
+        }
+      }
+    }' >"${output_file}"
+}
+
+assert_controller_rejected_before_demand() {
+  local agent="$1"
+  local unsafe_repo="$2"
+  local suffix="$3"
+  local task
+  task="$(sanitize_name "acp-unsafe-${suffix}-${run_id}")"
+  apply_invalid_read_task "${task}" "${agent}" "${unsafe_repo}"
+  wait_task_terminal "${task}"
+  local payload
+  payload="$(task_json "${task}")"
+  if ! jq -e '
+    .status.phase == "Failed"
+    and .status.execution.state == "Failed"
+    and .status.execution.outcome == "Failed"
+    and .status.execution.reason == "InvalidWorkspace"
+    and .status.delivery.state == "NotRequested"
+    and .status.delivery.outcome == "NotRequested"
+    and ((.status.execution.runtimePoolName // "") == "")
+    and ((.status.execution.runtimePoolUID // "") == "")
+    and ((.status.execution.runtimeInstanceID // "") == "")
+    and ((.status.execution.promptID // "") == "")
+  ' <<<"${payload}" >/dev/null; then
+    safe_task_summary "${task}"
+    die "Task/${task} was not rejected before RuntimePool demand and prompt fencing"
+  fi
+  mark_task_validated "${task}"
+}
+
+assert_unsafe_workspace_rejected() {
+  local agent="$1"
+  local safe_read="${temp_root}/safe-read.json"
+  local unsafe_file="${temp_root}/unsafe.json"
+  local safe_write="${temp_root}/safe-write.json"
+  local message='gitRepo must not contain embedded credentials, query parameters, or fragments'
+  local publication_message='publicationGitRepo must not contain embedded credentials, query parameters, or fragments'
+  log "Validating safe positive controls and unsafe workspace URL rejection"
+
+  build_read_manifest "$(sanitize_name "acp-safe-read-${run_id}")" "${agent}" "${repo_url}" "${safe_read}"
+  server_dry_run_manifest <"${safe_read}" || die "safe read workspace positive control was rejected"
+  log "Safe read workspace URL control passed"
+
+  build_read_manifest "$(sanitize_name "acp-unsafe-query-${run_id}")" "${agent}" "${repo_url}?unexpected=query" "${unsafe_file}"
+  assert_dry_run_rejected "${unsafe_file}" "spec.workspace" "${message}"
+  build_read_manifest "$(sanitize_name "acp-unsafe-fragment-${run_id}")" "${agent}" "${repo_url}#fragment" "${unsafe_file}"
+  assert_dry_run_rejected "${unsafe_file}" "spec.workspace" "${message}"
+  build_read_manifest "$(sanitize_name "acp-unsafe-user-${run_id}")" "${agent}" "https://user@github.com/orka-agents/orka.git" "${unsafe_file}"
+  assert_dry_run_rejected "${unsafe_file}" "spec.workspace" "${message}"
+  log "Unsafe read workspace URL controls passed"
+
+  if [[ "${release_gate}" -eq 1 ]]; then
+    build_write_manifest "$(sanitize_name "acp-safe-write-${run_id}")" "${agent}" \
+      "${write_source_repo}" "${write_publication_repo}" "${safe_write}"
+    server_dry_run_manifest <"${safe_write}" || die "safe write workspace positive control was rejected"
+    log "Safe write workspace URL control passed"
+    build_write_manifest "$(sanitize_name "acp-unsafe-publication-query-${run_id}")" "${agent}" \
+      "${write_source_repo}" "${write_publication_repo}?unexpected=query" "${unsafe_file}"
+    assert_dry_run_rejected "${unsafe_file}" "spec.workspace" "${publication_message}"
+    build_write_manifest "$(sanitize_name "acp-unsafe-publication-fragment-${run_id}")" "${agent}" \
+      "${write_source_repo}" "${write_publication_repo}#fragment" "${unsafe_file}"
+    assert_dry_run_rejected "${unsafe_file}" "spec.workspace" "${publication_message}"
+    build_write_manifest "$(sanitize_name "acp-unsafe-publication-user-${run_id}")" "${agent}" \
+      "${write_source_repo}" "https://user@github.com/${write_publication_slug}.git" "${unsafe_file}"
+    assert_dry_run_rejected "${unsafe_file}" "spec.workspace" "${publication_message}"
+    log "Unsafe publication workspace URL controls passed"
+
+    build_read_manifest "$(sanitize_name "acp-unsafe-ssh-${run_id}")" "${agent}" \
+      "ssh://git@github.com/orka-agents/orka.git" "${unsafe_file}"
+    assert_dry_run_rejected "${unsafe_file}" "spec.workspace" "${message}"
+    log "Unsafe SSH workspace URL control passed"
+    assert_controller_rejected_before_demand "${agent}" "ext::https://github.com/orka-agents/orka.git" helper
+    log "Unsafe remote-helper workspace URL control passed"
+  fi
+}
+
+run_concurrency_check() {
+  local agent="$1"
+  local provider="$2"
+  local model="$3"
+  local expected_pool="$4"
+  local snapshot="${temp_root}/concurrency-pool.json"
+  local tasks_file="${temp_root}/concurrency-tasks.txt"
+  local i task deadline max_seen queued_seen all_terminal running queued pool_name phase terminal_count limit
+  : >"${tasks_file}"
+  capture_pool_snapshot "${expected_pool}" "${provider}" "${model}" read "${snapshot}"
+  log "Submitting ${concurrency_tasks} task-scoped Codex Tasks to one exact RuntimePool instance"
+  for ((i = 1; i <= concurrency_tasks; i++)); do
+    task="$(sanitize_name "acp-concurrent-${i}-${run_id}")"
+    printf '%s\n' "${task}" >>"${tasks_file}"
+    apply_read_task "${task}" "${agent}" "" false "${long_prompt}" "12m" false
+  done
+
+  deadline=$((SECONDS + wait_seconds))
+  max_seen=0
+  queued_seen=0
+  all_terminal=0
+  while (( SECONDS < deadline )); do
+    running="$(k -n "${namespace}" get runtimepool "${expected_pool}" -o jsonpath='{.status.capacity.runningPrompts}' 2>/dev/null || printf '0')"
+    queued="$(k -n "${namespace}" get runtimepool "${expected_pool}" -o jsonpath='{.status.capacity.queuedTasks}' 2>/dev/null || printf '0')"
+    is_uint "${running}" || running=0
+    is_uint "${queued}" || queued=0
+    (( running > max_seen )) && max_seen="${running}"
+    (( queued > queued_seen )) && queued_seen="${queued}"
+    terminal_count=0
+    while IFS= read -r task; do
+      pool_name="$(k -n "${namespace}" get task "${task}" -o jsonpath='{.status.execution.runtimePoolName}' 2>/dev/null || true)"
+      if [[ -n "${pool_name}" && "${pool_name}" != "${expected_pool}" ]]; then
+        die "Task/${task} selected RuntimePool/${pool_name}, want ${expected_pool}"
+      fi
+      phase="$(k -n "${namespace}" get task "${task}" -o jsonpath='{.status.execution.state}' 2>/dev/null || true)"
+      case "${phase}" in
+        Succeeded|Failed|Cancelled|OutcomeUnknown) terminal_count=$((terminal_count + 1)) ;;
+      esac
+    done <"${tasks_file}"
+    if (( terminal_count == concurrency_tasks )); then
+      all_terminal=1
+      break
+    fi
+    sleep 1
+  done
+  (( all_terminal == 1 )) || die "concurrent Tasks did not all reach terminal execution states"
+
+  limit="$(k -n "${namespace}" get runtimepool "${expected_pool}" -o jsonpath='{.status.capacity.maxRunningPrompts}')"
+  is_uint "${limit}" || die "RuntimePool/${expected_pool} reported invalid maxRunningPrompts=${limit}"
+  (( max_seen <= limit )) || die "observed ${max_seen} running prompts above configured limit ${limit}"
+  if (( concurrency_tasks > limit && queued_seen < 1 )); then
+    die "capacity burst never exposed durable queued demand"
+  fi
+  if [[ "${release_gate}" -eq 1 && "${max_seen}" -lt 2 ]]; then
+    die "release gate did not observe at least two concurrent running prompts"
+  fi
+  if [[ "${release_gate}" -eq 0 ]] && bool_env "${require_parallel}" && (( max_seen < 2 )); then
+    die "parallel prompt execution was not observed (max=${max_seen})"
+  fi
+
+  local uid_file="${temp_root}/concurrency-uids.txt"
+  : >"${uid_file}"
+  while IFS= read -r task; do
+    assert_task_succeeded_read "${task}" "${snapshot}" "${read_repo_commit}" "" ""
+    k -n "${namespace}" get task "${task}" -o jsonpath='{.status.execution.runtimeSessionUID}' >>"${uid_file}"
+    printf '\n' >>"${uid_file}"
+  done <"${tasks_file}"
+  [[ "$(grep -c . "${uid_file}")" == "${concurrency_tasks}" ]] || die "concurrent Tasks have empty RuntimeSession UIDs"
+  [[ "$(sort -u "${uid_file}" | grep -c .)" == "${concurrency_tasks}" ]] || \
+    die "concurrent Tasks did not receive distinct task-scoped RuntimeSession UIDs"
+  wait_until "RuntimePool/${expected_pool} transient counters to settle" "${state_wait_seconds}" pool_transient_counters_zero "${expected_pool}" 1
+  log "Shared-pool concurrency passed (maxRunning=${max_seen}, queued=${queued_seen}, limit=${limit})"
+}
+
+tool_profile_pool=""
+run_timeout_check() {
+  local provider="$1"
+  local model="$2"
+  local agent="$3"
+  local task pool snapshot start_seconds elapsed_seconds
+  task="$(sanitize_name "acp-timeout-${run_id}")"
+  log "Validating Task timeout after first proving the prompt reached Running"
+  start_seconds="${SECONDS}"
+  apply_read_task "${task}" "${agent}" "" false "${blocking_prompt}" "${timeout_duration}" true
+  wait_until "Task/${task} RuntimePool assignment" "${state_wait_seconds}" wait_task_pool_name_value "${task}"
+  pool="$(wait_task_pool_name_value "${task}")"
+  tool_profile_pool="${pool}"
+  wait_pool_serving "${pool}"
+  wait_until "Task/${task} active Running prompt" "${state_wait_seconds}" pool_running_for_task "${task}" "${pool}"
+  snapshot="${temp_root}/${task}-running-pool.json"
+  capture_pool_snapshot "${pool}" "${provider}" "${model}" read "${snapshot}"
+  assert_cancelled_task "${task}" "${snapshot}"
+  elapsed_seconds=$((SECONDS - start_seconds))
+  (( elapsed_seconds >= timeout_duration_seconds )) || \
+    die "timeout Task/${task} cancelled before its configured ${timeout_duration} deadline"
+  wait_until "RuntimePool/${pool} zero transient counters after timeout" "${state_wait_seconds}" pool_transient_counters_zero "${pool}"
+}
+
+run_explicit_cancel_check() {
+  local provider="$1"
+  local model="$2"
+  local agent="$3"
+  local task pool snapshot uid cancel_requested_at
+  task="$(sanitize_name "acp-cancel-${run_id}")"
+  log "Validating explicit cancellation after an active Running prompt"
+  apply_read_task "${task}" "${agent}" "" false "${blocking_prompt}" "1h" true
+  wait_until "Task/${task} RuntimePool assignment" "${state_wait_seconds}" wait_task_pool_name_value "${task}"
+  pool="$(wait_task_pool_name_value "${task}")"
+  [[ -n "${tool_profile_pool}" && "${pool}" == "${tool_profile_pool}" ]] || \
+    die "explicit-cancel check selected RuntimePool/${pool}, want shared tool RuntimePool/${tool_profile_pool}"
+  wait_pool_serving "${pool}"
+  wait_until "Task/${task} active Running prompt" "${state_wait_seconds}" pool_running_for_task "${task}" "${pool}"
+  snapshot="${temp_root}/${task}-running-pool.json"
+  capture_pool_snapshot "${pool}" "${provider}" "${model}" read "${snapshot}"
+  pool_running_for_task "${task}" "${pool}" || die "Task/${task} was no longer Running immediately before cancellation"
+  uid="$(k -n "${namespace}" get task "${task}" -o jsonpath='{.metadata.uid}')"
+  [[ -n "${uid}" ]] || die "Task/${task} UID is unavailable before cancellation"
+  add_task_observer_finalizer "${task}" "${uid}" || \
+    die "failed to retain Task/${task} for cancellation settlement observation"
+  cancel_requested_at="${SECONDS}"
+  request_task_cancellation "${task}" || die "failed to request Task/${task} cancellation"
+  wait_until "Task/${task} explicit cancellation settlement" "${cancel_settle_seconds}" task_execution_terminal "${task}" || \
+    die "Task/${task} did not settle within the explicit cancellation bound"
+  (( SECONDS - cancel_requested_at <= cancel_settle_seconds + 2 )) || \
+    die "Task/${task} exceeded the explicit cancellation settlement bound"
+  assert_cancelled_task "${task}" "${snapshot}"
+  wait_until "Task/${task} controller-owned deletion barrier" "${state_wait_seconds}" \
+    task_observer_release_ready "${task}" "${uid}" || \
+    die "Task/${task} controller cleanup did not reach its finalizer barrier"
+  release_task_observer_finalizer "${task}" "${uid}" || \
+    die "failed to release Task/${task} cancellation observer"
+  wait_until "Task/${task} deletion after observed cancellation" "${state_wait_seconds}" task_absent "${task}" || \
+    die "Task/${task} remained after releasing the cancellation observer"
+  wait_until "RuntimePool/${pool} zero transient counters after explicit cancel" "${state_wait_seconds}" pool_transient_counters_zero "${pool}"
+}
+
+run_controller_restart_check() {
+  local provider="$1"
+  local model="$2"
+  local agent="$3"
+  local nonce="$4"
+  local task continuation session pool old_snapshot new_snapshot old_instance old_epoch old_uid old_generation new_uid new_generation
+  task="$(sanitize_name "acp-restart-${run_id}")"
+  continuation="$(sanitize_name "acp-post-restart-${run_id}")"
+  session="$(sanitize_name "acp-restart-session-${run_id}")"
+  log "Validating controller restart while an ACP prompt is actively Running"
+  apply_read_task "${task}" "${agent}" "${session}" true \
+    "Remember restart nonce ${nonce}. ${blocking_prompt}" "1h" true
+  wait_until "Task/${task} RuntimePool assignment" "${state_wait_seconds}" wait_task_pool_name_value "${task}"
+  pool="$(wait_task_pool_name_value "${task}")"
+  [[ -n "${tool_profile_pool}" && "${pool}" == "${tool_profile_pool}" ]] || \
+    die "controller-restart check selected RuntimePool/${pool}, want shared tool RuntimePool/${tool_profile_pool}"
+  wait_pool_serving "${pool}"
+  wait_until "Task/${task} active Running prompt" "${state_wait_seconds}" pool_running_for_task "${task}" "${pool}"
+  old_snapshot="${temp_root}/${task}-pre-restart-pool.json"
+  capture_pool_snapshot "${pool}" "${provider}" "${model}" read "${old_snapshot}"
+  old_instance="$(jq -r '.runtimeInstanceID' "${old_snapshot}")"
+  old_epoch="$(jq -r '.controllerEpoch' "${old_snapshot}")"
+  old_uid="$(k -n "${namespace}" get task "${task}" -o jsonpath='{.status.execution.runtimeSessionUID}')"
+  old_generation="$(k -n "${namespace}" get task "${task}" -o jsonpath='{.status.execution.runtimeSessionGeneration}')"
+  pool_running_for_task "${task}" "${pool}" || die "Task/${task} was no longer Running immediately before controller restart"
+
+  stop_api_forward || die "failed to stop controller API port-forward before restart"
+  k -n "${orka_namespace}" rollout restart deployment/"${controller_deployment}" >/dev/null
+  k -n "${orka_namespace}" rollout status deployment/"${controller_deployment}" --timeout=10m >/dev/null
+  if [[ "${release_gate}" -eq 1 ]]; then
+    assert_deployment_digest "${controller_deployment}" "${controller_container_override}" manager controller
+    start_api_forward
+  fi
+  assert_restart_task_settled "${task}" "${old_snapshot}"
+  resume_runtimepool "${pool}"
+  wait_until "RuntimePool/${pool} replacement after controller epoch change" "${wait_seconds}" \
+    pool_instance_changed_and_serving "${pool}" "${old_instance}"
+  new_snapshot="${temp_root}/${task}-post-restart-pool.json"
+  capture_pool_snapshot "${pool}" "${provider}" "${model}" read "${new_snapshot}"
+  (( $(jq -r '.controllerEpoch' "${new_snapshot}") > old_epoch )) || \
+    die "controller epoch did not advance across restart"
+
+  apply_read_task "${continuation}" "${agent}" "${session}" false \
+    "Continue the existing session after controller replacement. Return the restart nonce from the prior user turn. Do not modify files." \
+    "12m" true
+  wait_until "Task/${continuation} RuntimePool assignment" "${state_wait_seconds}" wait_task_pool_name_value "${continuation}"
+  [[ "$(wait_task_pool_name_value "${continuation}")" == "${pool}" ]] || \
+    die "post-restart continuation selected a different RuntimePool"
+  assert_task_succeeded_read "${continuation}" "${new_snapshot}" "${read_repo_commit}" "${nonce}" ""
+  new_uid="$(k -n "${namespace}" get task "${continuation}" -o jsonpath='{.status.execution.runtimeSessionUID}')"
+  new_generation="$(k -n "${namespace}" get task "${continuation}" -o jsonpath='{.status.execution.runtimeSessionGeneration}')"
+  [[ -n "${old_uid}" && "${new_uid}" == "${old_uid}" ]] || \
+    die "controller restart continuation did not preserve the logical RuntimeSession UID"
+  (( new_generation > old_generation )) || \
+    die "controller restart continuation did not advance RuntimeSession generation"
+}
+
+replacement_session_uid=""
+replacement_session_generation=""
+run_pool_replacement_check() {
+  local provider="$1"
+  local model="$2"
+  local agent="$3"
+  local pool="$4"
+  local session="$5"
+  local nonce="$6"
+  local before_snapshot after_snapshot before_instance before_uid before_generation pod_ns pod_name task after_uid after_generation
+  log "Validating exact-Pod RuntimePool replacement and create:false recovery"
+  before_snapshot="${temp_root}/pool-replacement-before.json"
+  capture_pool_snapshot "${pool}" "${provider}" "${model}" read "${before_snapshot}"
+  before_instance="$(jq -r '.runtimeInstanceID' "${before_snapshot}")"
+  before_uid="${read_smoke_session_uid}"
+  before_generation="${read_smoke_session_generation}"
+  pod_ns="$(jq -r '.podNamespace' "${before_snapshot}")"
+  pod_name="$(jq -r '.podName' "${before_snapshot}")"
+  k -n "${pod_ns}" delete pod "${pod_name}" --wait=false >/dev/null
+  wait_until "RuntimePool/${pool} exact-instance replacement" "${wait_seconds}" \
+    pool_instance_changed_and_serving "${pool}" "${before_instance}"
+  after_snapshot="${temp_root}/pool-replacement-after.json"
+  capture_pool_snapshot "${pool}" "${provider}" "${model}" read "${after_snapshot}"
+  [[ "$(jq -r '.podUID' "${after_snapshot}")" != "$(jq -r '.podUID' "${before_snapshot}")" ]] || \
+    die "RuntimePool/${pool} Pod UID did not change"
+  [[ "$(jq -r '.supervisorBootID' "${after_snapshot}")" != "$(jq -r '.supervisorBootID' "${before_snapshot}")" ]] || \
+    die "RuntimePool/${pool} supervisor boot ID did not change"
+
+  task="$(sanitize_name "acp-post-replacement-${run_id}")"
+  apply_read_task "${task}" "${agent}" "${session}" false \
+    "Continue the existing session after exact Pod replacement. Return the original session nonce from the prior transcript. Do not modify files." \
+    "12m" false
+  wait_until "Task/${task} RuntimePool assignment" "${state_wait_seconds}" wait_task_pool_name_value "${task}"
+  assert_task_succeeded_read "${task}" "${after_snapshot}" "${read_repo_commit}" "${nonce}" ""
+  after_uid="$(k -n "${namespace}" get task "${task}" -o jsonpath='{.status.execution.runtimeSessionUID}')"
+  after_generation="$(k -n "${namespace}" get task "${task}" -o jsonpath='{.status.execution.runtimeSessionGeneration}')"
+  [[ "${after_uid}" == "${before_uid}" ]] || die "Pod replacement changed logical RuntimeSession UID"
+  (( after_generation > before_generation )) || die "Pod replacement did not advance RuntimeSession generation"
+  replacement_session_uid="${after_uid}"
+  replacement_session_generation="${after_generation}"
+}
+
+run_scale_to_zero_recovery_check() {
+  local provider="$1"
+  local model="$2"
+  local agent="$3"
+  local pool="$4"
+  local session="$5"
+  local nonce="$6"
+  local before_snapshot after_snapshot before_instance before_pool_uid task after_uid after_generation
+  log "Validating authenticated drain: Serving -> Draining -> Quiescent -> Stopping -> Stopped"
+  before_snapshot="${temp_root}/scale-zero-before.json"
+  capture_pool_snapshot "${pool}" "${provider}" "${model}" read "${before_snapshot}"
+  before_instance="$(jq -r '.runtimeInstanceID' "${before_snapshot}")"
+  before_pool_uid="$(jq -r '.poolUID' "${before_snapshot}")"
+
+  k -n "${namespace}" patch runtimepool "${pool}" --type=merge \
+    -p '{"spec":{"desiredReplicas":0}}' >/dev/null
+  wait_until_fast "RuntimePool/${pool} Draining or later" "${state_wait_seconds}" pool_lifecycle_reached "${pool}" Draining
+  wait_until_fast "RuntimePool/${pool} Quiescent or later" "${state_wait_seconds}" pool_lifecycle_reached "${pool}" Quiescent
+  wait_until_fast "RuntimePool/${pool} Stopping or later" "${state_wait_seconds}" pool_lifecycle_reached "${pool}" Stopping
+  wait_until "RuntimePool/${pool} Stopped with zero authenticated/controller counters" "${wait_seconds}" pool_stopped "${pool}"
+
+  log "Validating 0 -> 1 recovery of the same logical Session"
+  task="$(sanitize_name "acp-scale-zero-recovery-${run_id}")"
+  apply_read_task "${task}" "${agent}" "${session}" false \
+    "Continue the existing session after scale-to-zero. Return the original session nonce from the durable transcript. Do not modify files." \
+    "12m" false
+  wait_until "Task/${task} RuntimePool assignment" "${state_wait_seconds}" wait_task_pool_name_value "${task}"
+  [[ "$(wait_task_pool_name_value "${task}")" == "${pool}" ]] || \
+    die "scale-to-zero recovery selected a different logical RuntimePool"
+  after_snapshot="${temp_root}/scale-zero-after.json"
+  capture_pool_snapshot "${pool}" "${provider}" "${model}" read "${after_snapshot}"
+  [[ "$(jq -r '.poolUID' "${after_snapshot}")" == "${before_pool_uid}" ]] || \
+    die "0 -> 1 recovery replaced the logical RuntimePool object"
+  [[ "$(jq -r '.runtimeInstanceID' "${after_snapshot}")" != "${before_instance}" ]] || \
+    die "0 -> 1 recovery reused the stopped runtime instance"
+  assert_task_succeeded_read "${task}" "${after_snapshot}" "${read_repo_commit}" "${nonce}" ""
+  after_uid="$(k -n "${namespace}" get task "${task}" -o jsonpath='{.status.execution.runtimeSessionUID}')"
+  after_generation="$(k -n "${namespace}" get task "${task}" -o jsonpath='{.status.execution.runtimeSessionGeneration}')"
+  [[ "${after_uid}" == "${replacement_session_uid}" ]] || \
+    die "scale-to-zero recovery changed the logical RuntimeSession UID"
+  (( after_generation > replacement_session_generation )) || \
+    die "scale-to-zero recovery did not advance RuntimeSession generation"
+}
+
+write_source_repo=""
+write_publication_repo=""
+write_source_slug=""
+write_publication_slug=""
+write_source_commit=""
+write_source_identity=""
+write_publication_identity=""
+write_source_database_id=""
+write_credential_source=""
+write_credential_source_namespace=""
+write_credential_key=""
+write_credential_target=""
+write_read_credential_source=""
+write_read_credential_source_namespace=""
+write_read_credential_key=""
+write_read_credential_target=""
+write_target_read_credential_source=""
+write_target_read_credential_source_namespace=""
+write_target_read_credential_key=""
+write_target_read_credential_target=""
+write_forge_credential_source=""
+write_forge_credential_source_namespace=""
+write_forge_credential_key=""
+write_forge_credential_target=""
+write_branch=""
+write_pr_base=""
+write_expected_file=""
+write_expected_content=""
+write_prompt=""
+
+prepare_release_gate_environment() {
+  [[ "${release_gate}" -eq 1 ]] || return 0
+  write_source_repo="${ACP_E2E_WRITE_SOURCE_REPO:-}"
+  write_publication_repo="${ACP_E2E_WRITE_PUBLICATION_REPO:-}"
+  write_source_commit="${ACP_E2E_WRITE_SOURCE_REF:-}"
+  write_credential_source="${ACP_E2E_WRITE_CREDENTIAL_SECRET:-}"
+  write_credential_source_namespace="${ACP_E2E_WRITE_CREDENTIAL_NAMESPACE:-}"
+  write_credential_key="${ACP_E2E_WRITE_CREDENTIAL_KEY:-token}"
+  write_read_credential_source="${ACP_E2E_WRITE_READ_CREDENTIAL_SECRET:-}"
+  write_read_credential_source_namespace="${ACP_E2E_WRITE_READ_CREDENTIAL_NAMESPACE:-${write_credential_source_namespace}}"
+  write_read_credential_key="${ACP_E2E_WRITE_READ_CREDENTIAL_KEY:-token}"
+  write_target_read_credential_source="${ACP_E2E_WRITE_TARGET_READ_CREDENTIAL_SECRET:-}"
+  write_target_read_credential_source_namespace="${ACP_E2E_WRITE_TARGET_READ_CREDENTIAL_NAMESPACE:-}"
+  write_target_read_credential_key="${ACP_E2E_WRITE_TARGET_READ_CREDENTIAL_KEY:-token}"
+  write_forge_credential_source="${ACP_E2E_WRITE_FORGE_CREDENTIAL_SECRET:-}"
+  write_forge_credential_source_namespace="${ACP_E2E_WRITE_FORGE_CREDENTIAL_NAMESPACE:-}"
+  write_forge_credential_key="${ACP_E2E_WRITE_FORGE_CREDENTIAL_KEY:-token}"
+  write_branch="${ACP_E2E_WRITE_BRANCH:-orka/acp-release-gate-${run_id}}"
+  write_pr_base="${ACP_E2E_WRITE_PR_BASE:-main}"
+  write_expected_file="orka-acp-release-gate-${run_id}.txt"
+  write_expected_content="ACP v2 release gate ${run_id}"
+  write_prompt="${ACP_E2E_WRITE_PROMPT:-Create exactly one file named ${write_expected_file}. Its entire content must be one line: ${write_expected_content}. Do not modify, rename, or delete any other file.}"
+
+  [[ -n "${write_source_repo}" ]] || die "RELEASE_GATE=1 requires ACP_E2E_WRITE_SOURCE_REPO"
+  [[ -n "${write_publication_repo}" ]] || die "RELEASE_GATE=1 requires ACP_E2E_WRITE_PUBLICATION_REPO"
+  [[ -n "${write_source_commit}" ]] || die "RELEASE_GATE=1 requires ACP_E2E_WRITE_SOURCE_REF"
+  [[ -n "${write_credential_source}" ]] || die "RELEASE_GATE=1 requires ACP_E2E_WRITE_CREDENTIAL_SECRET"
+  [[ -n "${write_credential_source_namespace}" ]] || die "RELEASE_GATE=1 requires ACP_E2E_WRITE_CREDENTIAL_NAMESPACE"
+  [[ -n "${write_read_credential_source}" && -n "${write_read_credential_source_namespace}" ]] || \
+    die "RELEASE_GATE=1 requires ACP_E2E_WRITE_READ_CREDENTIAL_SECRET and namespace"
+  [[ -n "${write_target_read_credential_source}" && -n "${write_target_read_credential_source_namespace}" ]] || \
+    die "RELEASE_GATE=1 requires a target-read credential source"
+  [[ -n "${write_forge_credential_source}" && -n "${write_forge_credential_source_namespace}" ]] || \
+    die "RELEASE_GATE=1 requires a forge credential source"
+  local -a credential_identities=(
+    "${write_read_credential_source_namespace}/${write_read_credential_source}#${write_read_credential_key}"
+    "${write_target_read_credential_source_namespace}/${write_target_read_credential_source}#${write_target_read_credential_key}"
+    "${write_credential_source_namespace}/${write_credential_source}#${write_credential_key}"
+    "${write_forge_credential_source_namespace}/${write_forge_credential_source}#${write_forge_credential_key}"
+  )
+  [[ "$(printf '%s\n' "${credential_identities[@]}" | sort -u | wc -l | tr -d ' ')" == "4" ]] || \
+    die "release-gate source-read, target-read, target-write, and forge credential identities must be distinct"
+  bool_env "${ACP_E2E_WRITE_CREATE_PR:-0}" || die "RELEASE_GATE=1 requires ACP_E2E_WRITE_CREATE_PR=1"
+  is_sha "${write_source_commit}" || die "ACP_E2E_WRITE_SOURCE_REF must be a full immutable commit SHA"
+  git check-ref-format "refs/heads/${write_branch}" >/dev/null || die "ACP_E2E_WRITE_BRANCH is not a valid branch"
+  git check-ref-format "refs/heads/${write_pr_base}" >/dev/null || die "ACP_E2E_WRITE_PR_BASE is not a valid branch"
+  [[ "${write_branch}" =~ ^[A-Za-z0-9._/-]+$ ]] || \
+    die "ACP_E2E_WRITE_BRANCH must use URL-safe GitHub ref characters"
+  [[ "${write_pr_base}" =~ ^[A-Za-z0-9._/-]+$ ]] || \
+    die "ACP_E2E_WRITE_PR_BASE must use URL-safe GitHub ref characters"
+  [[ "${write_branch}" == *"${run_id}"* ]] || die "ACP_E2E_WRITE_BRANCH must contain the run ID ${run_id}"
+
+  write_source_slug="$(github_repo_slug "${write_source_repo}")" || \
+    die "release-gate source repository must be a credential-free https://github.com/OWNER/REPO URL"
+  write_publication_slug="$(github_repo_slug "${write_publication_repo}")" || \
+    die "release-gate publication repository must be a credential-free https://github.com/OWNER/REPO URL"
+  [[ "${write_source_slug}" != "${write_publication_slug}" ]] || \
+    die "release-gate publication repository must be a distinct fork"
+
+  gh auth status --hostname github.com >/dev/null
+  local source_json publication_json resolved base_json base_sha
+  source_json="$(gh api "repos/${write_source_slug}")"
+  publication_json="$(gh api "repos/${write_publication_slug}")"
+  jq -e --arg source "${write_source_slug}" '
+    .fork == true and ((.parent.full_name // "") | ascii_downcase) == $source
+  ' <<<"${publication_json}" >/dev/null || \
+    die "ACP_E2E_WRITE_PUBLICATION_REPO must be an actual GitHub fork of ACP_E2E_WRITE_SOURCE_REPO"
+  write_source_database_id="$(jq -r '.id | tostring' <<<"${source_json}")"
+  write_source_identity="github.com/${write_source_slug}"
+  write_publication_identity="github.com/${write_publication_slug}"
+  resolved="$(gh api "repos/${write_source_slug}/commits/${write_source_commit}" --jq '.sha')"
+  [[ "$(lower "${resolved}")" == "$(lower "${write_source_commit}")" ]] || \
+    die "ACP_E2E_WRITE_SOURCE_REF did not resolve to the requested immutable commit"
+  base_json="$(gh api "repos/${write_source_slug}/branches/${write_pr_base}")" || \
+    die "PR base branch ${write_pr_base} does not exist in ${write_source_slug}"
+  base_sha="$(jq -r '.commit.sha // ""' <<<"${base_json}")"
+  [[ "$(lower "${write_source_commit}")" == "$(lower "${base_sha}")" ]] || \
+    die "ACP_E2E_WRITE_SOURCE_REF must equal the current ${write_pr_base} base-branch head for an isolated one-file PR"
+  github_content_lookup "${write_source_slug}" "${write_expected_file}" "${write_source_commit}" || \
+    die "could not inspect the release-gate canary path at the source commit"
+  [[ "${github_content_lookup_state}" == "absent" ]] || \
+    die "release-gate canary path ${write_expected_file} already exists at the source commit"
+  remote_cleanup_branch="${write_branch}"
+  remote_cleanup_publication_repo="${write_publication_repo}"
+  remote_cleanup_publication_slug="${write_publication_slug}"
+  remote_cleanup_source_slug="${write_source_slug}"
+  remote_cleanup_pr_base="${write_pr_base}"
+  github_ref_lookup "${write_publication_slug}" "${write_branch}" || die "could not inspect release-gate publication branch"
+  [[ "${github_ref_lookup_state}" == "absent" ]] || \
+    die "release-gate branch ${write_branch} already exists in ${write_publication_slug}"
+  no_cleanup_pull_request_exists || \
+    die "a historical pull request already exists for release-gate branch ${write_branch}"
+
+  configure_git_observer_auth
+  remote_cleanup_required=1
+}
+
+apply_write_task() {
+  local task="$1"
+  local agent="$2"
+  local provider
+  provider="$(k -n "${namespace}" get agent "${agent}" -o jsonpath='{.spec.runtime.type}')"
+  jq -n \
+    --arg task "${task}" \
+    --arg run "${run_id}" \
+    --arg agent "${agent}" \
+    --arg provider "${provider}" \
+    --arg prompt "${write_prompt}" \
+    --arg source "${write_source_repo}" \
+    --arg publication "${write_publication_repo}" \
+    --arg sourceID "${write_source_identity}" \
+    --arg publicationID "${write_publication_identity}" \
+    --arg ref "${write_source_commit}" \
+    --arg readCredential "${write_read_credential_target}" \
+    --arg readCredentialKey "${write_read_credential_key}" \
+    --arg targetReadCredential "${write_target_read_credential_target}" \
+    --arg targetReadCredentialKey "${write_target_read_credential_key}" \
+    --arg writeCredential "${write_credential_target}" \
+    --arg writeCredentialKey "${write_credential_key}" \
+    --arg forgeCredential "${write_forge_credential_target}" \
+    --arg forgeCredentialKey "${write_forge_credential_key}" \
+    --arg branch "${write_branch}" \
+    --arg base "${write_pr_base}" '{
+      apiVersion:"core.orka.ai/v1alpha1",
+      kind:"Task",
+      metadata:{name:$task,labels:{"orka.ai/acp-e2e-run":$run}},
+      spec:{
+        type:"agent",
+        agentRef:{name:$agent},
+        prompt:$prompt,
+        workspace:{
+          intent:"write",
+          gitRepo:$source,
+          sourceRepository:{provider:"github",id:$sourceID},
+          ref:$ref,
+          readCredentialRef:{name:$readCredential,key:$readCredentialKey},
+          publicationGitRepo:$publication,
+          publicationRepository:{provider:"github",id:$publicationID},
+          publicationReadCredentialRef:{name:$targetReadCredential,key:$targetReadCredentialKey},
+          publicationCredentialRef:{name:$writeCredential,key:$writeCredentialKey},
+          forgeCredentialRef:{name:$forgeCredential,key:$forgeCredentialKey},
+          pushBranch:$branch,
+          prBaseBranch:$base,
+          createPR:true
+        },
+        agentRuntime:({maxTurns:12} + (if $provider == "codex" then {} else {
+          allowBash:true,
+          allowedTools:["Read","Glob","Grep","Bash","Write","Edit"]
+        } end)),
+        timeout:"15m"
+      }
+    }' | k -n "${namespace}" apply -f - >/dev/null
+}
+
+verify_remote_publication() {
+  local task_payload="$1"
+  local delivery outcome expected remote starting tree artifact publication_id remote_before
+  local commit_json expected_compare_json compare_json ancestry_json pr_number pr_json pr_files_json base_now_json pr_id pr_url pr_state pr_base pr_head pr_sha
+  local expected_file expected_observed_file observed_file
+  delivery="$(jq -c '.status.delivery' <<<"${task_payload}")"
+  outcome="$(jq -r '.outcome // ""' <<<"${delivery}")"
+  expected="$(jq -r '.expectedCommitSHA // ""' <<<"${delivery}")"
+  remote="$(jq -r 'if ((.supersedingRemoteSHA // "") | length) > 0 then .supersedingRemoteSHA else (.verifiedRemoteSHA // "") end' <<<"${delivery}")"
+  starting="$(jq -r '.startingSHA // ""' <<<"${delivery}")"
+  tree="$(jq -r '.treeSHA // ""' <<<"${delivery}")"
+  artifact="$(jq -r '.artifactDigest // ""' <<<"${delivery}")"
+  publication_id="$(jq -r '.publicationID // ""' <<<"${delivery}")"
+  remote_before="$(jq -r 'if has("remoteBeforeSHA") then .remoteBeforeSHA else "__missing__" end' <<<"${delivery}")"
+
+  case "${outcome}" in
+    VerifiedExact|DeliveredSuperseded) ;;
+    *) die "publication delivery outcome ${outcome:-<empty>} is not release-gate acceptable" ;;
+  esac
+  [[ -n "${publication_id}" ]] || die "publication receipt is missing publicationID"
+  is_sha "${starting}" || die "publication receipt has invalid startingSHA"
+  is_sha "${tree}" || die "publication receipt has invalid treeSHA"
+  is_sha "${expected}" || die "publication receipt has invalid expectedCommitSHA"
+  is_sha "${remote}" || die "publication receipt has invalid verified remote SHA"
+  [[ "${artifact}" =~ ^sha256:[a-f0-9]{64}$ ]] || die "publication receipt has invalid artifactDigest"
+  [[ "$(lower "${starting}")" == "$(lower "${write_source_commit}")" ]] || \
+    die "publication startingSHA does not match the independently resolved source commit"
+  [[ "${remote_before}" == "" ]] || \
+    die "publication remoteBeforeSHA must record explicit branch absence for a unique release-gate branch"
+  jq -e \
+    --arg branch "${write_branch}" \
+    --arg source "${write_source_identity}" \
+    --arg publication "${write_publication_identity}" '
+      .branch == $branch
+      and .sourceRepository.provider == "github"
+      and .sourceRepository.id == $source
+      and .publicationRepository.provider == "github"
+      and .publicationRepository.id == $publication
+    ' <<<"${delivery}" >/dev/null || die "publication repository/branch identity tuple is incomplete or incorrect"
+
+  github_ref_lookup "${write_publication_slug}" "${write_branch}" || die "independent observer could not read publication branch"
+  [[ "${github_ref_lookup_state}" == "present" && "${github_ref_lookup_sha}" == "${remote}" ]] || \
+    die "independent remote branch head does not match the Task delivery receipt"
+
+  commit_json="$(gh api "repos/${write_publication_slug}/git/commits/${expected}")"
+  [[ "$(jq -r '.tree.sha // ""' <<<"${commit_json}")" == "${tree}" ]] || \
+    die "Task treeSHA does not match the independently observed expected commit tree"
+  jq -e --arg parent "${starting}" '.parents | length == 1 and .[0].sha == $parent' \
+    <<<"${commit_json}" >/dev/null || die "expected publication commit is not based exactly on startingSHA"
+  expected_compare_json="$(gh api "repos/${write_publication_slug}/compare/${starting}...${expected}")"
+  jq -e --arg file "${write_expected_file}" '
+    .status == "ahead"
+    and (.files | length == 1)
+    and .files[0].filename == $file
+    and .files[0].status == "added"
+  ' <<<"${expected_compare_json}" >/dev/null || \
+    die "expected publication commit is not exactly the one-file canary change"
+  expected_file="${temp_root}/expected-publication-content"
+  expected_observed_file="${temp_root}/expected-commit-publication-content"
+  printf '%s\n' "${write_expected_content}" >"${expected_file}"
+  gh_raw_file "${write_publication_slug}" "${write_expected_file}" "${expected}" >"${expected_observed_file}" || \
+    die "could not download the canary from expectedCommitSHA"
+  cmp -s "${expected_file}" "${expected_observed_file}" || \
+    die "expectedCommitSHA canary bytes do not exactly match the requested content"
+
+  ancestry_json="$(gh api "repos/${write_publication_slug}/compare/${expected}...${remote}")"
+  jq -e --arg expected "${expected}" '
+    (.status == "identical" or .status == "ahead") and .merge_base_commit.sha == $expected
+  ' <<<"${ancestry_json}" >/dev/null || die "verified remote SHA is not the expected commit or a proven descendant"
+  if [[ "${outcome}" == "VerifiedExact" && "${remote}" != "${expected}" ]]; then
+    die "VerifiedExact delivery does not equal expectedCommitSHA"
+  fi
+  if [[ "${outcome}" == "DeliveredSuperseded" && "${remote}" == "${expected}" ]]; then
+    die "DeliveredSuperseded receipt did not identify a distinct descendant"
+  fi
+
+  compare_json="$(gh api "repos/${write_publication_slug}/compare/${starting}...${remote}")"
+  jq -e --arg file "${write_expected_file}" '
+    (.status == "ahead")
+    and (.files | length == 1)
+    and .files[0].filename == $file
+    and .files[0].status == "added"
+  ' <<<"${compare_json}" >/dev/null || \
+    die "independent remote diff is not exactly one newly added release-gate canary"
+  observed_file="${temp_root}/observed-publication-content"
+  gh_raw_file "${write_publication_slug}" "${write_expected_file}" "${remote}" >"${observed_file}" || \
+    die "could not download the independently observed release-gate canary"
+  cmp -s "${expected_file}" "${observed_file}" || \
+    die "independent remote bytes do not exactly match the one-line release-gate canary"
+
+  pr_number="$(jq -r '.prReceipt.number // 0' <<<"${delivery}")"
+  if ! is_uint "${pr_number}" || (( pr_number <= 0 )); then
+    die "PR receipt is missing a numeric pull request number"
+  fi
+  pr_json="$(gh api "repos/${write_source_slug}/pulls/${pr_number}")"
+  base_now_json="$(gh api "repos/${write_source_slug}/branches/${write_pr_base}")"
+  [[ "$(jq -r '.commit.sha // ""' <<<"${base_now_json}")" == "${starting}" ]] || \
+    die "PR base branch moved after release-gate source resolution"
+  pr_files_json="$(gh api --paginate --slurp "repos/${write_source_slug}/pulls/${pr_number}/files?per_page=100")"
+  jq -e --arg file "${write_expected_file}" '
+    [.[][]] as $files
+    | ($files | length) == 1
+      and $files[0].filename == $file
+      and $files[0].status == "added"
+  ' <<<"${pr_files_json}" >/dev/null || \
+    die "independent PR diff is not exactly the newly added release-gate canary"
+  pr_id="$(jq -r '.prReceipt.id // ""' <<<"${delivery}")"
+  pr_url="$(jq -r '.prReceipt.url // ""' <<<"${delivery}")"
+  pr_state="$(jq -r '.prReceipt.state // ""' <<<"${delivery}")"
+  pr_base="$(jq -r '.prReceipt.baseBranch // ""' <<<"${delivery}")"
+  pr_head="$(jq -r '.prReceipt.headBranch // ""' <<<"${delivery}")"
+  pr_sha="$(jq -r '.prReceipt.headSHA // ""' <<<"${delivery}")"
+  [[ "${pr_id}" == "github:${write_source_database_id}:${pr_number}" ]] || \
+    die "PR receipt ID does not match the canonical GitHub repository/PR tuple"
+  [[ "${pr_url}" == "https://github.com/${write_source_slug}/pull/${pr_number}" ]] || \
+    die "PR receipt URL is not canonical"
+  [[ "${pr_state}" == "Open" && "${pr_base}" == "${write_pr_base}" && \
+     "${pr_head}" == "${write_branch}" && "${pr_sha}" == "${remote}" ]] || \
+    die "PR receipt base/head/state/SHA tuple is incomplete or incorrect"
+  jq -e \
+    --arg source "${write_source_slug}" \
+    --arg publication "${write_publication_slug}" \
+    --arg branch "${write_branch}" \
+    --arg base "${write_pr_base}" \
+    --arg sha "${remote}" \
+    --arg starting "${starting}" \
+    --argjson number "${pr_number}" '
+      .number == $number
+      and .state == "open"
+      and ((.base.repo.full_name // "") | ascii_downcase) == $source
+      and .base.ref == $base
+      and .base.sha == $starting
+      and ((.head.repo.full_name // "") | ascii_downcase) == $publication
+      and .head.ref == $branch
+      and .head.sha == $sha
+    ' <<<"${pr_json}" >/dev/null || \
+    die "independent GitHub PR state does not match the publication receipt tuple"
+
+  remote_cleanup_head="${remote}"
+  remote_cleanup_pr_number="${pr_number}"
+}
+
+run_write_release_gate() {
+  local agent="$1"
+  local task pool snapshot payload expected_credential_rv expected_read_rv expected_target_read_rv expected_forge_rv
+  local current_credential_rv current_read_rv current_target_read_rv current_forge_rv
+  task="$(sanitize_name "acp-write-${run_id}")"
+  write_credential_target="$(sanitize_name "acp-publish-credential-${run_id}")"
+  copy_secret_key_to_test_namespace "${write_credential_source_namespace}" \
+    "${write_credential_source}" "${write_credential_key}" "${write_credential_target}"
+  write_read_credential_target="$(sanitize_name "acp-read-credential-${run_id}")"
+  copy_secret_key_to_test_namespace "${write_read_credential_source_namespace}" \
+    "${write_read_credential_source}" "${write_read_credential_key}" "${write_read_credential_target}"
+  write_target_read_credential_target="$(sanitize_name "acp-target-read-credential-${run_id}")"
+  copy_secret_key_to_test_namespace "${write_target_read_credential_source_namespace}" \
+    "${write_target_read_credential_source}" "${write_target_read_credential_key}" "${write_target_read_credential_target}"
+  write_forge_credential_target="$(sanitize_name "acp-forge-credential-${run_id}")"
+  copy_secret_key_to_test_namespace "${write_forge_credential_source_namespace}" \
+    "${write_forge_credential_source}" "${write_forge_credential_key}" "${write_forge_credential_target}"
+
+  assert_publisher_cannot_access_secret "${write_credential_source_namespace}" "${write_credential_source}"
+  assert_publisher_cannot_access_secret "${namespace}" "${write_credential_target}"
+  assert_publisher_cannot_access_secret "${write_read_credential_source_namespace}" "${write_read_credential_source}"
+  assert_publisher_cannot_access_secret "${namespace}" "${write_read_credential_target}"
+  assert_publisher_cannot_access_secret "${write_target_read_credential_source_namespace}" "${write_target_read_credential_source}"
+  assert_publisher_cannot_access_secret "${namespace}" "${write_target_read_credential_target}"
+  assert_publisher_cannot_access_secret "${write_forge_credential_source_namespace}" "${write_forge_credential_source}"
+  assert_publisher_cannot_access_secret "${namespace}" "${write_forge_credential_target}"
+
+  expected_credential_rv="$(k -n "${namespace}" get secret "${write_credential_target}" -o jsonpath='{.metadata.resourceVersion}')"
+  [[ -n "${expected_credential_rv}" ]] || die "publication credential Secret has no resourceVersion"
+  expected_read_rv="$(k -n "${namespace}" get secret "${write_read_credential_target}" -o jsonpath='{.metadata.resourceVersion}')"
+  expected_target_read_rv="$(k -n "${namespace}" get secret "${write_target_read_credential_target}" -o jsonpath='{.metadata.resourceVersion}')"
+  expected_forge_rv="$(k -n "${namespace}" get secret "${write_forge_credential_target}" -o jsonpath='{.metadata.resourceVersion}')"
+  [[ -n "${expected_read_rv}" && -n "${expected_target_read_rv}" && -n "${expected_forge_rv}" ]] || \
+    die "one or more role-separated credential Secrets have no resourceVersion"
+
+  local base_now_sha
+  base_now_sha="$(gh api "repos/${write_source_slug}/branches/${write_pr_base}" --jq '.commit.sha')"
+  [[ "${base_now_sha}" == "${write_source_commit}" ]] || \
+    die "PR base branch moved before write Task submission"
+
+  log "Running mandatory Codex clean-room publication and PR reconciliation gate"
+  write_task_name="${task}"
+  write_task_started=1
+  apply_write_task "${task}" "${agent}"
+  wait_until "Task/${task} RuntimePool assignment" "${state_wait_seconds}" wait_task_pool_name_value "${task}"
+  pool="$(wait_task_pool_name_value "${task}")"
+  snapshot="${temp_root}/${task}-write-pool.json"
+  capture_pool_snapshot "${pool}" codex "${codex_model}" write "${snapshot}"
+  wait_task_terminal "${task}"
+  payload="$(task_json "${task}")"
+  if ! jq -e '
+    .status.phase == "Succeeded"
+    and .status.execution.state == "Succeeded"
+    and .status.execution.outcome == "Succeeded"
+    and (.status.delivery.outcome == "VerifiedExact" or .status.delivery.outcome == "DeliveredSuperseded")
+    and ((.status.jobName // "") == "")
+  ' <<<"${payload}" >/dev/null; then
+    safe_task_summary "${task}"
+    die "write Task/${task} did not reach successful execution and verified delivery"
+  fi
+  assert_task_fence "${task}" "${snapshot}"
+
+  current_credential_rv="$(k -n "${namespace}" get secret "${write_credential_target}" -o jsonpath='{.metadata.resourceVersion}')"
+  [[ "${current_credential_rv}" == "${expected_credential_rv}" ]] || \
+    die "publication credential Secret rotated during the release gate"
+  [[ "$(jq -r '.status.execution.publicationCredentialResourceVersion // ""' <<<"${payload}")" == "${expected_credential_rv}" ]] || \
+    die "write Task did not freeze the pre-submission publication credential Secret resourceVersion"
+  current_read_rv="$(k -n "${namespace}" get secret "${write_read_credential_target}" -o jsonpath='{.metadata.resourceVersion}')"
+  current_target_read_rv="$(k -n "${namespace}" get secret "${write_target_read_credential_target}" -o jsonpath='{.metadata.resourceVersion}')"
+  current_forge_rv="$(k -n "${namespace}" get secret "${write_forge_credential_target}" -o jsonpath='{.metadata.resourceVersion}')"
+  [[ "${current_read_rv}" == "${expected_read_rv}" && "${current_target_read_rv}" == "${expected_target_read_rv}" && "${current_forge_rv}" == "${expected_forge_rv}" ]] || \
+    die "one or more role-separated credential Secrets rotated during the release gate"
+  [[ "$(jq -r '.status.execution.readCredentialResourceVersion // ""' <<<"${payload}")" == "${expected_read_rv}" ]] || \
+    die "write Task did not freeze the source-read credential resourceVersion"
+  [[ "$(jq -r '.status.execution.publicationReadCredentialResourceVersion // ""' <<<"${payload}")" == "${expected_target_read_rv}" ]] || \
+    die "write Task did not freeze the target-read credential resourceVersion"
+  [[ "$(jq -r '.status.execution.forgeCredentialResourceVersion // ""' <<<"${payload}")" == "${expected_forge_rv}" ]] || \
+    die "write Task did not freeze the forge credential resourceVersion"
+
+  verify_remote_publication "${payload}"
+  mark_task_validated "${task}"
+}
+
+write_task_cleanup_settled() {
+  [[ "${write_task_started}" -eq 1 && -n "${write_task_name}" ]] || return 0
+  probe_task "${write_task_name}" || return 1
+  [[ "${task_probe_state}" == "present" ]] || return 1
+  jq -e '
+    (.status.execution.state // "") as $execution
+    | (.status.delivery.state // "") as $delivery
+    | ($execution == "Succeeded" or $execution == "Failed" or $execution == "Cancelled" or $execution == "OutcomeUnknown")
+      and (
+        $delivery == "VerifiedExact"
+        or $delivery == "DeliveredSuperseded"
+        or $delivery == "NoChange"
+        or $delivery == "CancelledBeforePublish"
+        or $delivery == "ReadOnlyWorkspaceModified"
+        or $delivery == "DeliveryConflict"
+        or $delivery == "CredentialBlocked"
+        or $delivery == "PublicationOutcomeUnknown"
+        or (($delivery | length) == 0 and $execution != "Succeeded")
+      )
+  ' "${task_probe_file}" >/dev/null
+}
+
+discover_cleanup_pull_request() {
+  local expected_head="$1"
+  local owner response count
+  owner="${remote_cleanup_publication_slug%%/*}"
+  if ! response="$(gh api --method GET --paginate --slurp \
+      "repos/${remote_cleanup_source_slug}/pulls" \
+      -f state=all -f "head=${owner}:${remote_cleanup_branch}" \
+      -f "base=${remote_cleanup_pr_base}" -f per_page=100)"; then
+    return 1
+  fi
+  count="$(jq --arg repo "${remote_cleanup_publication_slug}" --arg branch "${remote_cleanup_branch}" --arg sha "${expected_head}" '
+    [.[][] | select(((.head.repo.full_name // "") | ascii_downcase) == $repo and .head.ref == $branch and .head.sha == $sha)] | length
+  ' <<<"${response}")"
+  [[ "${count}" == "1" ]] || return 1
+  remote_cleanup_pr_number="$(jq -r --arg repo "${remote_cleanup_publication_slug}" --arg branch "${remote_cleanup_branch}" --arg sha "${expected_head}" '
+    [.[][] | select(((.head.repo.full_name // "") | ascii_downcase) == $repo and .head.ref == $branch and .head.sha == $sha)][0].number
+  ' <<<"${response}")"
+  is_uint "${remote_cleanup_pr_number}" && (( remote_cleanup_pr_number > 0 ))
+}
+
+no_cleanup_pull_request_exists() {
+  local owner response count
+  owner="${remote_cleanup_publication_slug%%/*}"
+  response="$(gh api --method GET --paginate --slurp \
+    "repos/${remote_cleanup_source_slug}/pulls" \
+    -f state=all -f "head=${owner}:${remote_cleanup_branch}" -f per_page=100)" || return 1
+  count="$(jq '[.[][]] | length' <<<"${response}")"
+  [[ "${count}" == "0" ]]
+}
+
+settle_write_task_for_remote_cleanup() {
+  local pool outcome head number uid
+  [[ "${write_task_started}" -eq 1 ]] || return 0
+  [[ ( "${namespace_created}" -eq 1 || "${namespace_shared}" -eq 1 ) && -n "${write_task_name}" ]] || return 1
+  probe_namespace "${namespace}" || return 1
+  [[ "${namespace_probe_state}" == "present" ]] || return 1
+  probe_task "${write_task_name}" || return 1
+  [[ "${task_probe_state}" == "present" ]] || return 1
+
+  if ! jq -e '(.status.execution.state // "") as $state | ($state == "Succeeded" or $state == "Failed" or $state == "Cancelled" or $state == "OutcomeUnknown")' \
+      "${task_probe_file}" >/dev/null; then
+    uid="$(jq -r '.metadata.uid // ""' "${task_probe_file}")"
+    [[ -n "${uid}" ]] || return 1
+    add_task_observer_finalizer "${write_task_name}" "${uid}" || return 1
+    write_task_observer_uid="${uid}"
+    request_task_cancellation "${write_task_name}" || return 1
+  fi
+  wait_until "write Task/${write_task_name} cleanup settlement" 300 write_task_cleanup_settled || return 1
+  probe_task "${write_task_name}" || return 1
+  [[ "${task_probe_state}" == "present" ]] || return 1
+
+  pool="$(jq -r '.status.execution.runtimePoolName // ""' "${task_probe_file}")" || return 1
+  if [[ -n "${pool}" ]]; then
+    probe_runtimepool "${pool}" || return 1
+    [[ "${runtimepool_probe_state}" == "present" ]] || return 1
+    log "Parking write RuntimePool/${pool} after terminal publication"
+    k -n "${namespace}" patch runtimepool "${pool}" --type=merge \
+      -p '{"spec":{"desiredReplicas":0}}' >/dev/null || return 1
+    wait_until "write RuntimePool/${pool} stopped after publication finalization" 300 pool_stopped "${pool}" || return 1
+  fi
+  outcome="$(jq -r '.status.delivery.outcome // ""' "${task_probe_file}")" || return 1
+  case "${outcome}" in
+    VerifiedExact|DeliveredSuperseded)
+      head="$(jq -r 'if ((.status.delivery.supersedingRemoteSHA // "") | length) > 0 then .status.delivery.supersedingRemoteSHA else (.status.delivery.verifiedRemoteSHA // "") end' "${task_probe_file}")" || return 1
+      is_sha "${head}" || return 1
+      remote_cleanup_head="$(lower "${head}")"
+      number="$(jq -r '.status.delivery.prReceipt.number // 0' "${task_probe_file}")" || return 1
+      if is_uint "${number}" && (( number > 0 )); then
+        remote_cleanup_pr_number="${number}"
+      else
+        discover_cleanup_pull_request "${remote_cleanup_head}" || return 1
+      fi
+      ;;
+    NoChange|CancelledBeforePublish|ReadOnlyWorkspaceModified|DeliveryConflict|CredentialBlocked|"")
+      no_cleanup_pull_request_exists || return 1
+      ;;
+    PublicationOutcomeUnknown|*)
+      return 1
+      ;;
+  esac
+}
+
+remove_provider_resources() {
+  local provider="$1"
+  shift
+  local agent pool pools runtime_ns
+  local owners_file="${temp_root}/provider-${provider}-owner-uids.txt"
+  log "Removing ${provider} Tasks, Agents, and RuntimePools before the next provider"
+  assert_all_tasks_validated
+  k -n "${namespace}" get task -o json | jq -r '
+    .items[] | .metadata.uid, (.status.execution.runtimeSessionUID // empty)
+  ' | sort -u >"${owners_file}"
+  k -n "${namespace}" delete task --all --wait=true --timeout=5m >/dev/null
+  pools="$(k -n "${namespace}" get runtimepool -o json | jq -r --arg provider "${provider}" \
+    '.items[] | select(.spec.runtime.profile.providerKind == $provider) | [.metadata.name, (.status.activeInstance.podNamespace // .spec.runtimeNamespace // "")] | @tsv')"
+  if [[ -n "${pools}" ]]; then
+    while IFS=$'\t' read -r pool runtime_ns; do
+      [[ -n "${pool}" ]] || continue
+      record_runtime_namespace "${runtime_ns}"
+      k -n "${namespace}" patch runtimepool "${pool}" --type=merge \
+        -p '{"spec":{"desiredReplicas":0}}' >/dev/null
+    done <<<"${pools}"
+    while IFS=$'\t' read -r pool _; do
+      [[ -n "${pool}" ]] || continue
+      wait_until "RuntimePool/${pool} stopped before ${provider} provider handoff" \
+        "${state_wait_seconds}" pool_stopped "${pool}"
+    done <<<"${pools}"
+  fi
+  for agent in "$@"; do
+    [[ -n "${agent}" ]] || continue
+    k -n "${namespace}" delete agent "${agent}" --ignore-not-found=true --wait=true --timeout=2m >/dev/null
+  done
+  if [[ -n "${pools}" ]]; then
+    while IFS=$'\t' read -r pool _; do
+      [[ -n "${pool}" ]] || continue
+      k -n "${namespace}" delete runtimepool "${pool}" --wait=true --timeout=5m >/dev/null
+    done <<<"${pools}"
+  fi
+  delete_test_branchclaims "${owners_file}" || die "failed to remove ${provider} BranchClaims before provider handoff"
+}
+
+preflight_release_workloads() {
+  [[ "${release_gate}" -eq 1 ]] || return 0
+  log "Validating digest-pinned controller, Publisher, provider proxy, and SCM proxy images"
+  local controller_json publisher_json controller_primary publisher_primary
+  assert_deployment_digest "${controller_deployment}" "${controller_container_override}" manager controller
+  assert_deployment_digest "${publisher_deployment}" "${publisher_container_override}" publisher workspace-publisher
+  assert_deployment_digest "${provider_proxy_deployment}" "${provider_proxy_container_override}" proxy provider-auth-proxy
+  assert_deployment_digest "${scm_proxy_deployment}" "${scm_proxy_container_override}" proxy scm-egress-proxy
+  controller_json="$(k -n "${orka_namespace}" get deployment "${controller_deployment}" -o json)"
+  publisher_json="$(k -n "${orka_namespace}" get deployment "${publisher_deployment}" -o json)"
+  controller_primary="$(select_deployment_container "${controller_json}" "${controller_container_override}" manager controller)"
+  publisher_primary="$(select_deployment_container "${publisher_json}" "${publisher_container_override}" publisher workspace-publisher)"
+  assert_deployment_persistent "${controller_json}" "${controller_deployment}" "${controller_primary}"
+  assert_deployment_persistent "${publisher_json}" "${publisher_deployment}" "${publisher_primary}"
+  assert_publisher_brokered_authority
+}
+
+prepare_release_gate_environment
+
+log "Preflight for context ${context}"
+k config get-contexts "${context}" -o name | grep -Fxq "${context}" || die "kubectl context ${context} was not found"
+for crd in tasks.core.orka.ai agents.core.orka.ai runtimepools.core.orka.ai promptattempts.core.orka.ai \
+  runtimesessioncontrols.core.orka.ai branchclaims.core.orka.ai publications.core.orka.ai \
+  controllerepochs.core.orka.ai externaleffects.core.orka.ai; do
+  resource_exists get crd "${crd}" || die "required CRD ${crd} is not installed"
+done
+resource_exists -n "${orka_namespace}" get deployment "${controller_deployment}" || \
+  die "controller Deployment/${controller_deployment} was not found"
+k -n "${orka_namespace}" rollout status deployment/"${controller_deployment}" --timeout=5m >/dev/null
+preflight_release_workloads
+
+read_repo_slug=""
+read_repo_identity=""
+read_repo_commit="$(lower "${repo_ref}")"
+expected_license_line=""
+if read_repo_slug="$(github_repo_slug "${repo_url}")"; then
+  read_repo_identity="github.com/${read_repo_slug}"
+fi
+if [[ "${release_gate}" -eq 1 ]]; then
+  [[ -n "${read_repo_slug}" ]] || die "RELEASE_GATE=1 requires ACP_E2E_REPO to be a github.com HTTPS repository"
+  read_repo_commit="$(gh api "repos/${read_repo_slug}/commits/${repo_ref}" --jq '.sha')"
+  [[ "$(lower "${read_repo_commit}")" == "$(lower "${repo_ref}")" ]] || \
+    die "ACP_E2E_REF did not resolve to the requested immutable commit"
+  expected_license_line="$(gh_raw_file "${read_repo_slug}" LICENSE "${read_repo_commit}" | awk 'NF { print; exit }')"
+  [[ -n "${expected_license_line}" ]] || die "could not independently read the first non-empty LICENSE line"
+fi
+
+if resource_exists get namespace "${namespace}"; then
+  if k get namespace "${namespace}" -o json | jq -e '
+      .metadata.labels["orka.ai/controller-mode"] == "harness-v2"
+    ' >/dev/null; then
+    # Shared watch-namespace mode: the isolated harness-v2 controller only
+    # serves Tasks in its watch namespace, so the validator adopts that
+    # namespace and cleans up its run-labeled resources without ever owning
+    # the namespace lifecycle.
+    log "Adopting existing harness-v2 namespace ${namespace} (shared watch-namespace mode)"
+    namespace_shared=1
+  else
+    die "test namespace ${namespace} already exists; choose another --namespace"
+  fi
+else
+  namespace_create_attempted=1
+  jq -n --arg name "${namespace}" --arg run "${run_id}" '{
+    apiVersion:"v1",
+    kind:"Namespace",
+    metadata:{
+      name:$name,
+      labels:{
+        "orka.ai/acp-e2e-run":$run,
+        "orka.ai/controller-mode":"harness-v2",
+        "app.kubernetes.io/managed-by":"live-acp-runtime-e2e",
+        "pod-security.kubernetes.io/enforce":"restricted"
+      }
+    }
+  }' | k create -f - >/dev/null
+  namespace_created=1
+fi
+namespace_uid="$(k get namespace "${namespace}" -o jsonpath='{.metadata.uid}')"
+[[ -n "${namespace_uid}" ]] || die "test namespace UID is unavailable"
+
+if [[ "${release_gate}" -eq 1 ]]; then
+  create_api_identity
+  start_api_forward
+fi
+
+session_nonce="nonce-${run_id}-${RANDOM}-${RANDOM}"
+restart_nonce="restart-${run_id}-${RANDOM}-${RANDOM}"
+
+codex_agent="$(sanitize_name "acp-codex-${run_id}")"
+codex_task="$(sanitize_name "acp-codex-read-${run_id}")"
+codex_session="$(sanitize_name "acp-codex-session-${run_id}")"
+if [[ "${release_gate}" -eq 1 ]]; then
+  log "Running Codex read, result, continuation, and Task-fork validation"
+else
+  log "Running Codex read and continuation smoke validation"
+fi
+run_read_smoke codex "${codex_model}" "${codex_agent}" "${codex_task}" "${codex_session}" \
+  "${session_nonce}" "${expected_license_line}"
+codex_pool="${read_smoke_pool}"
+
+assert_unsafe_workspace_rejected "${codex_agent}"
+run_concurrency_check "${codex_agent}" codex "${codex_model}" "${codex_pool}"
+park_runtimepool "${codex_pool}"
+codex_tool_agent="$(sanitize_name "acp-codex-tools-${run_id}")"
+apply_agent codex "${codex_model}" "${codex_tool_agent}" 12 true
+run_timeout_check codex "${codex_model}" "${codex_tool_agent}"
+run_explicit_cancel_check codex "${codex_model}" "${codex_tool_agent}"
+run_controller_restart_check codex "${codex_model}" "${codex_tool_agent}" "${restart_nonce}"
+park_provider_runtimepools_except codex "${codex_pool}"
+resume_runtimepool "${codex_pool}"
+run_pool_replacement_check codex "${codex_model}" "${codex_agent}" "${codex_pool}" "${codex_session}" "${session_nonce}"
+
+if [[ "${release_gate}" -eq 1 ]]; then
+  run_scale_to_zero_recovery_check codex "${codex_model}" "${codex_agent}" "${codex_pool}" "${codex_session}" "${session_nonce}"
+  park_runtimepool "${codex_pool}"
+  run_write_release_gate "${codex_agent}"
+  assert_all_tasks_validated
+  if ! cleanup_remote_effects; then
+    die "release-gate remote cleanup did not complete safely"
+  fi
+  remote_cleanup_required=0
+fi
+
+remove_provider_resources codex "${codex_agent}" "${codex_tool_agent}"
+wait_until "Codex runtime children removal" 300 runtime_children_absent
+
+opencode_agent="$(sanitize_name "acp-opencode-${run_id}")"
+opencode_task="$(sanitize_name "acp-opencode-read-${run_id}")"
+opencode_session="$(sanitize_name "acp-opencode-session-${run_id}")"
+opencode_nonce="opencode-${run_id}-${RANDOM}-${RANDOM}"
+log "Running OpenCode native ACP read, continuation, and read-policy validation"
+run_read_smoke opencode "${opencode_model}" "${opencode_agent}" "${opencode_task}" "${opencode_session}" \
+  "${opencode_nonce}" "${expected_license_line}"
+opencode_policy_agent="$(sanitize_name "acp-opencode-policy-agent-${run_id}")"
+apply_agent opencode "${opencode_model}" "${opencode_policy_agent}" 12 true
+run_opencode_read_policy_check "${opencode_policy_agent}" "${opencode_model}"
+assert_all_tasks_validated
+remove_provider_resources opencode "${opencode_agent}" "${opencode_policy_agent}"
+wait_until "OpenCode runtime children removal" 300 runtime_children_absent
+
+claude_agent="$(sanitize_name "acp-claude-${run_id}")"
+claude_task="$(sanitize_name "acp-claude-read-${run_id}")"
+claude_session="$(sanitize_name "acp-claude-session-${run_id}")"
+claude_nonce="claude-${run_id}-${RANDOM}-${RANDOM}"
+log "Running Claude only after all Codex gates and cleanup completed"
+run_read_smoke claude "${claude_model}" "${claude_agent}" "${claude_task}" "${claude_session}" \
+  "${claude_nonce}" "${expected_license_line}"
+assert_all_tasks_validated
+
+remove_provider_resources claude "${claude_agent}"
+wait_until "Claude runtime children removal" 300 runtime_children_absent
+
+copilot_agent="$(sanitize_name "acp-copilot-${run_id}")"
+copilot_task="$(sanitize_name "acp-copilot-read-${run_id}")"
+copilot_session="$(sanitize_name "acp-copilot-session-${run_id}")"
+copilot_nonce="copilot-${run_id}-${RANDOM}-${RANDOM}"
+log "Running GitHub Copilot only after all Claude gates and cleanup completed"
+run_read_smoke copilot "${copilot_model}" "${copilot_agent}" "${copilot_task}" "${copilot_session}" \
+  "${copilot_nonce}" "${expected_license_line}"
+assert_all_tasks_validated
+
+if [[ "${release_gate}" -eq 1 ]]; then
+  if [[ "${keep_resources}" != "1" ]]; then
+    stop_api_forward || die "failed to stop controller API port-forward before final cleanup"
+    delete_test_namespace_now || die "release-gate Kubernetes cleanup did not complete safely"
+  else
+    warn "ACP_E2E_KEEP_RESOURCES=1; release-gate Kubernetes resources are intentionally preserved"
+  fi
+  log "ACP v2 RELEASE GATE PASSED on context ${context}"
+else
+  log "ACP v2 smoke validation passed on context ${context}; release-only publication, remote verification, Task result/fork, and scale-to-zero gates were skipped. Set RELEASE_GATE=1 for release acceptance."
+fi
diff --git a/scripts/live-acp-runtime-kind-e2e.sh b/scripts/live-acp-runtime-kind-e2e.sh
new file mode 100755
index 000000000..754f41a51
--- /dev/null
+++ b/scripts/live-acp-runtime-kind-e2e.sh
@@ -0,0 +1,155 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+umask 077
+
+usage() {
+  cat <<'USAGE'
+Usage: scripts/live-acp-runtime-kind-e2e.sh [--namespace NAME] [--keep-cluster] [--preflight-only]
+
+Builds current Orka ACP images, creates a repo-scoped Kind cluster, deploys a
+pinned Vekil proxy and Orka, then runs scripts/live-acp-runtime-e2e.sh.
+
+This wrapper is intentionally noninteractive: COPILOT_GITHUB_TOKEN is required
+and is written only through the Vekil deploy helper into a Kubernetes Secret.
+It never prints the token or starts GitHub device-code login. CI uses the same
+path as local runs.
+
+Environment:
+  ACP_E2E_KIND_TAG        kindctl tag (default: run-scoped live-acp-runtime)
+  ACP_E2E_KIND_CONFIG     optional Kind config path
+  ACP_E2E_KEEP_CLUSTER=1  keep the cluster and local registry after the run
+  ACP_E2E_VEKIL_IMAGE     digest-pinned Vekil image override
+  ACP_E2E_VEKIL_LOCAL_IMAGE local Docker image published through the run's
+                          registry and digest-pinned there (development builds)
+  ACP_E2E_OPENCODE_MODEL  reviewed OpenCode provider/model identifier
+  ACP_E2E_OPENCODE_CONTEXT_WINDOW reviewed OpenCode context capacity (required)
+  ACP_E2E_OPENCODE_MAX_TOKENS reviewed OpenCode output limit (required)
+  ACP_E2E_ROLLOUT_TIMEOUT rollout timeout (default: 10m)
+  RELEASE_GATE=1          forwarded to the canonical validator
+USAGE
+}
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repo_root="$(cd "${script_dir}/.." && pwd)"
+# shellcheck source=scripts/lib/live-acp-runtime-kind-bootstrap.sh
+. "${script_dir}/lib/live-acp-runtime-kind-bootstrap.sh"
+
+namespace=""
+preflight_only=0
+while (( $# > 0 )); do
+  case "$1" in
+    --namespace)
+      [[ $# -ge 2 ]] || { echo "error: --namespace requires a value" >&2; exit 2; }
+      namespace="$2"
+      shift 2
+      ;;
+    --keep-cluster)
+      export ACP_E2E_KEEP_CLUSTER=1
+      shift
+      ;;
+    --preflight-only)
+      preflight_only=1
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "error: unknown argument: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+done
+
+run_id="${ACP_E2E_RUN_ID:-${GITHUB_RUN_ID:-local}-${GITHUB_RUN_ATTEMPT:-0}-$(date -u +%Y%m%d%H%M%S)-$$}"
+image_tag="$(printf '%s' "${run_id}" | LC_ALL=C tr -c 'A-Za-z0-9_.-' '-' | cut -c1-80)"
+export ACP_E2E_RUN_ID="${run_id}"
+
+LIVE_ACP_REPO_ROOT="${repo_root}"
+LIVE_ACP_KINDCTL_BIN="${ACP_E2E_KINDCTL_BIN:-${repo_root}/.agents/skills/kindctl/bin/kindctl}"
+LIVE_ACP_VEKIL_DEPLOY_SCRIPT="${ACP_E2E_VEKIL_DEPLOY_SCRIPT:-${repo_root}/.agents/skills/vekil-reverse-proxy-deploy/scripts/deploy_vekil_reverse_proxy.sh}"
+LIVE_ACP_VALIDATOR_SCRIPT="${ACP_E2E_VALIDATOR_SCRIPT:-${repo_root}/scripts/live-acp-runtime-e2e.sh}"
+LIVE_ACP_KIND_TAG="${ACP_E2E_KIND_TAG:-live-acp-runtime-${image_tag}}"
+LIVE_ACP_KIND_CONFIG="${ACP_E2E_KIND_CONFIG:-}"
+LIVE_ACP_KEEP_CLUSTER="${ACP_E2E_KEEP_CLUSTER:-0}"
+LIVE_ACP_VEKIL_IMAGE="${ACP_E2E_VEKIL_IMAGE:-ghcr.io/sozercan/vekil:v0.14.1@sha256:2fa0558f6304cc6ed1fb5b0135f62f12f28f1cdd0a8c057c4283414bceac1362}"
+LIVE_ACP_VEKIL_LOCAL_IMAGE="${ACP_E2E_VEKIL_LOCAL_IMAGE:-}"
+export LIVE_ACP_VEKIL_LOCAL_IMAGE
+LIVE_ACP_ROLLOUT_TIMEOUT="${ACP_E2E_ROLLOUT_TIMEOUT:-10m}"
+LIVE_ACP_CONTROLLER_IMAGE="orka-controller:live-acp-${image_tag}"
+LIVE_ACP_CODEX_IMAGE="orka-acp-codex:live-acp-${image_tag}"
+LIVE_ACP_CLAUDE_IMAGE="orka-acp-claude:live-acp-${image_tag}"
+LIVE_ACP_COPILOT_IMAGE="orka-acp-copilot:live-acp-${image_tag}"
+LIVE_ACP_OPENCODE_IMAGE="orka-acp-opencode:live-acp-${image_tag}"
+LIVE_ACP_PUBLISHER_IMAGE="orka-workspace-publisher:live-acp-${image_tag}"
+LIVE_ACP_GENERAL_WORKER_IMAGE="orka-general-worker:live-acp-${image_tag}"
+LIVE_ACP_KIND_CREATED=0
+LIVE_ACP_REGISTRY_STARTED=0
+LIVE_ACP_SECRET_DIR=""
+export LIVE_ACP_REPO_ROOT LIVE_ACP_KINDCTL_BIN LIVE_ACP_VEKIL_DEPLOY_SCRIPT LIVE_ACP_VALIDATOR_SCRIPT
+export LIVE_ACP_KIND_TAG LIVE_ACP_KIND_CONFIG LIVE_ACP_KEEP_CLUSTER LIVE_ACP_VEKIL_IMAGE LIVE_ACP_ROLLOUT_TIMEOUT
+export LIVE_ACP_CONTROLLER_IMAGE LIVE_ACP_CODEX_IMAGE LIVE_ACP_CLAUDE_IMAGE LIVE_ACP_COPILOT_IMAGE
+export LIVE_ACP_OPENCODE_IMAGE LIVE_ACP_PUBLISHER_IMAGE LIVE_ACP_GENERAL_WORKER_IMAGE
+export LIVE_ACP_SECRET_DIR
+
+if live_acp_kind_enabled "${RELEASE_GATE:-0}"; then
+  [[ -n "${ACP_E2E_WRITE_SOURCE_REPO:-}" ]] || \
+    live_acp_kind_die "ACP_E2E_WRITE_SOURCE_REPO is required when RELEASE_GATE=1"
+  [[ -n "${ACP_E2E_WRITE_PUBLICATION_REPO:-}" ]] || \
+    live_acp_kind_die "ACP_E2E_WRITE_PUBLICATION_REPO is required when RELEASE_GATE=1"
+  [[ -n "${ACP_E2E_WRITE_SOURCE_REF:-}" ]] || \
+    live_acp_kind_die "ACP_E2E_WRITE_SOURCE_REF is required when RELEASE_GATE=1"
+  [[ "${ACP_E2E_WRITE_SOURCE_REPO}" =~ ^https://github\.com/[^/]+/[^/]+(\.git)?$ ]] || \
+    live_acp_kind_die "ACP_E2E_WRITE_SOURCE_REPO must be an HTTPS github.com repository URL"
+  [[ "${ACP_E2E_WRITE_PUBLICATION_REPO}" =~ ^https://github\.com/[^/]+/[^/]+(\.git)?$ ]] || \
+    live_acp_kind_die "ACP_E2E_WRITE_PUBLICATION_REPO must be an HTTPS github.com repository URL"
+  source_identity="${ACP_E2E_WRITE_SOURCE_REPO%.git}"
+  publication_identity="${ACP_E2E_WRITE_PUBLICATION_REPO%.git}"
+  source_identity_lower="$(printf '%s' "${source_identity}" | LC_ALL=C tr '[:upper:]' '[:lower:]')"
+  publication_identity_lower="$(printf '%s' "${publication_identity}" | LC_ALL=C tr '[:upper:]' '[:lower:]')"
+  [[ "${source_identity_lower}" != "${publication_identity_lower}" ]] || \
+    live_acp_kind_die "ACP_E2E_WRITE_PUBLICATION_REPO must be a distinct repository"
+  [[ "${ACP_E2E_WRITE_SOURCE_REF}" =~ ^[0-9a-fA-F]{40}$ ]] || \
+    live_acp_kind_die "ACP_E2E_WRITE_SOURCE_REF must be a full 40-character commit SHA"
+  live_acp_kind_enabled "${ACP_E2E_WRITE_CREATE_PR:-0}" || \
+    live_acp_kind_die "ACP_E2E_WRITE_CREATE_PR=1 is required when RELEASE_GATE=1"
+  if [[ -n "${ACP_E2E_REPO:-}" ]]; then
+    read_identity="${ACP_E2E_REPO%.git}"
+  else
+    read_identity=""
+  fi
+  read_identity_lower="$(printf '%s' "${read_identity}" | LC_ALL=C tr '[:upper:]' '[:lower:]')"
+  if [[ -n "${read_identity}" && "${read_identity_lower}" != "${source_identity_lower}" ]]; then
+    live_acp_kind_die "ACP_E2E_REPO must equal ACP_E2E_WRITE_SOURCE_REPO when RELEASE_GATE=1"
+  fi
+  read_ref_lower="$(printf '%s' "${ACP_E2E_REF:-}" | LC_ALL=C tr '[:upper:]' '[:lower:]')"
+  write_ref_lower="$(printf '%s' "${ACP_E2E_WRITE_SOURCE_REF}" | LC_ALL=C tr '[:upper:]' '[:lower:]')"
+  if [[ -n "${ACP_E2E_REF:-}" && "${read_ref_lower}" != "${write_ref_lower}" ]]; then
+    live_acp_kind_die "ACP_E2E_REF must equal ACP_E2E_WRITE_SOURCE_REF when RELEASE_GATE=1"
+  fi
+  export ACP_E2E_REPO="${ACP_E2E_WRITE_SOURCE_REPO}"
+  export ACP_E2E_REF="${ACP_E2E_WRITE_SOURCE_REF}"
+fi
+
+live_acp_kind_preflight
+if (( preflight_only )); then
+  live_acp_kind_log "Live ACP Kind E2E preflight passed"
+  exit 0
+fi
+
+LIVE_ACP_SECRET_DIR="$(mktemp -d "${RUNNER_TEMP:-${TMPDIR:-/tmp}}/live-acp-kind-secrets.XXXXXX")"
+export LIVE_ACP_SECRET_DIR
+trap 'status=$?; live_acp_kind_cleanup "${status}"; exit "${status}"' EXIT
+live_acp_kind_bootstrap
+
+validator_args=(--context "${LIVE_ACP_CONTEXT}")
+if [[ -z "${namespace}" ]]; then
+  # The isolated harness-v2 controller only serves Tasks in its watch
+  # namespace, so the validator runs there in shared watch-namespace mode.
+  namespace="orka-system"
+fi
+validator_args+=(--namespace "${namespace}")
+live_acp_kind_log "Running canonical live ACP runtime validator"
+"${LIVE_ACP_VALIDATOR_SCRIPT}" "${validator_args[@]}"
diff --git a/scripts/live-agent-sandbox-e2e.sh b/scripts/live-agent-sandbox-e2e.sh
index 81d69ca07..7610815f8 100755
--- a/scripts/live-agent-sandbox-e2e.sh
+++ b/scripts/live-agent-sandbox-e2e.sh
@@ -2,44 +2,18 @@
 
 set -Eeuo pipefail
 
-log() {
-  printf '==> %s\n' "$*" >&2
-}
-
-warn() {
-  printf 'warning: %s\n' "$*" >&2
-}
-
-die() {
-  printf 'error: %s\n' "$*" >&2
-  exit 1
-}
-
-require_cmd() {
-  command -v "$1" >/dev/null 2>&1 || die "missing required command: $1"
-}
-
-require_sha256() {
-  if command -v sha256sum >/dev/null 2>&1 || command -v shasum >/dev/null 2>&1; then
-    return
-  fi
-  die "missing required command: sha256sum or shasum"
-}
-
-sha256_hex() {
-  if command -v sha256sum >/dev/null 2>&1; then
-    sha256sum | awk '{print $1}'
-    return
-  fi
-  shasum -a 256 | awk '{print $1}'
-}
-
 sanitize_image_tag() {
   printf '%s' "$1" | LC_ALL=C tr -c 'A-Za-z0-9_.-' '-'
 }
 
 script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 repo_root="$(cd "${script_dir}/.." && pwd)"
+# shellcheck source=scripts/lib/e2e-common.sh
+. "${script_dir}/lib/e2e-common.sh"
+# shellcheck source=scripts/lib/kind-local-registry.sh
+. "${script_dir}/lib/kind-local-registry.sh"
+# shellcheck source=scripts/lib/e2e-admission-tls.sh
+. "${script_dir}/lib/e2e-admission-tls.sh"
 
 agent_sandbox_version="${AGENT_SANDBOX_VERSION:-v0.5.0}"
 kind_cluster="${KIND_CLUSTER:-orka-live-agent-sandbox-e2e}"
@@ -51,17 +25,11 @@ orka_api_local_port="${ORKA_API_LOCAL_PORT:-18084}"
 router_api_local_port="${ORKA_AGENT_SANDBOX_ROUTER_LOCAL_PORT:-18085}"
 e2e_run_id="$(sanitize_image_tag "${ORKA_AGENT_SANDBOX_RUN_ID:-${GITHUB_RUN_ID:-manual}-$(date -u +%Y%m%d%H%M%S)}")"
 manager_image="${ORKA_MANAGER_IMAGE:-orka-controller:live-agent-sandbox-e2e-${e2e_run_id}}"
-fake_claude_image="${ORKA_FAKE_HARNESS_WRAPPER_IMAGE:-orka-agent-sandbox-fake-claude:live-agent-sandbox-e2e-${e2e_run_id}}"
-harness_wrapper_image="${ORKA_HARNESS_WRAPPER_IMAGE:-orka-agent-harness-wrapper:live-agent-sandbox-e2e-${e2e_run_id}}"
+publisher_image="${ORKA_WORKSPACE_PUBLISHER_IMAGE:-orka-workspace-publisher:live-agent-sandbox-e2e-${e2e_run_id}}"
+sandbox_fixture_image="${ORKA_AGENT_SANDBOX_FIXTURE_IMAGE:-orka-agent-sandbox-fixture:live-agent-sandbox-e2e-${e2e_run_id}}"
 sandbox_router_image="${ORKA_AGENT_SANDBOX_ROUTER_IMAGE:-orka-agent-sandbox-router:live-agent-sandbox-e2e-${e2e_run_id}}"
 sandbox_template_name="${ORKA_AGENT_SANDBOX_TEMPLATE:-orka-agent-sandbox-e2e-template}"
-agent_name="${ORKA_AGENT_SANDBOX_AGENT:-orka-agent-sandbox-e2e-agent}"
-delete_task_name="${ORKA_AGENT_SANDBOX_DELETE_TASK:-orka-agent-sandbox-delete-smoke}"
-retain_task_one="${ORKA_AGENT_SANDBOX_RETAIN_TASK_ONE:-orka-agent-sandbox-retain-one}"
-retain_task_two="${ORKA_AGENT_SANDBOX_RETAIN_TASK_TWO:-orka-agent-sandbox-retain-two}"
-session_name="${ORKA_AGENT_SANDBOX_SESSION:-orka-agent-sandbox-session}"
 smoke_claim_name="${ORKA_AGENT_SANDBOX_SMOKE_CLAIM:-orka-agent-sandbox-e2e-retained-smoke}"
-wait_timeout="${ORKA_AGENT_SANDBOX_WAIT_TIMEOUT:-8m}"
 api_pf_pid=""
 router_pf_pid=""
 router_namespace=""
@@ -69,7 +37,7 @@ created_kind_cluster="0"
 agent_sandbox_module_cache=""
 work_dir="$(mktemp -d "${RUNNER_TEMP:-${TMPDIR:-/tmp}}/live-agent-sandbox-e2e.XXXXXX")"
 kind_config="${ORKA_AGENT_SANDBOX_KIND_CONFIG:-${work_dir}/kind-config.yaml}"
-fake_dockerfile="${work_dir}/Dockerfile.fake-claude"
+fixture_dockerfile="${work_dir}/Dockerfile.sandbox-fixture"
 api_pf_log="${work_dir}/api-port-forward.log"
 router_pf_log="${work_dir}/router-port-forward.log"
 smoke_go_dir="${repo_root}/.tmp-live-agent-sandbox-smoke-${e2e_run_id}"
@@ -125,11 +93,6 @@ dump_diagnostics() {
     echo "=== Controller Logs ==="
     kubectl logs deployment/"${orka_controller_deployment}" -n "${orka_namespace}" -c manager --tail=300 2>/dev/null || true
     echo
-    echo "=== Worker Logs ==="
-    for task in "${delete_task_name}" "${retain_task_one}" "${retain_task_two}"; do
-      kubectl logs -n "${orka_namespace}" -l "orka.ai/task=${task}" --all-containers --tail=300 --prefix 2>/dev/null || true
-    done
-    echo
     echo "=== Agent Sandbox Controller Logs ==="
     kubectl logs deployment/agent-sandbox-controller -n agent-sandbox-system --tail=300 2>/dev/null || true
     echo
@@ -164,6 +127,7 @@ on_exit() {
 
   cleanup_port_forward
   restore_manager_kustomization
+  orka_kind_registry_stop
   if [[ "${created_kind_cluster}" == "1" ]]; then
     kind delete cluster --name "${kind_cluster}" >/dev/null 2>&1 || true
   fi
@@ -243,46 +207,8 @@ wait_for_http() {
   die "${description} never became available at ${url}"
 }
 
-duration_to_seconds() {
-  local value="$1"
-  local rest="$1"
-  local total=0
-  local number unit amount
-
-  if [[ "${value}" =~ ^[0-9]+$ ]]; then
-    printf '%s\n' "${value}"
-    return
-  fi
-
-  while [[ -n "${rest}" ]]; do
-    if [[ ! "${rest}" =~ ^([0-9]+)([hms])(.*)$ ]]; then
-      die "unsupported duration ${value}; use digits with h, m, or s units"
-    fi
-
-    number="${BASH_REMATCH[1]}"
-    unit="${BASH_REMATCH[2]}"
-    rest="${BASH_REMATCH[3]}"
-    amount=$((10#${number}))
-
-    case "${unit}" in
-      h) total=$((total + amount * 3600)) ;;
-      m) total=$((total + amount * 60)) ;;
-      s) total=$((total + amount)) ;;
-    esac
-  done
-
-  [[ "${total}" -gt 0 ]] || die "duration ${value} must be positive"
-  printf '%s\n' "${total}"
-}
-
-api_token_duration() {
-  local timeout_seconds
-  timeout_seconds="$(duration_to_seconds "${wait_timeout}")"
-  printf '%ss\n' "$((timeout_seconds * 4 + 600))"
-}
-
-write_fake_claude_dockerfile() {
-  cat >"${fake_dockerfile}" <<'DOCKERFILE'
+write_sandbox_fixture_dockerfile() {
+  cat >"${fixture_dockerfile}" <<'DOCKERFILE'
 FROM --platform=$BUILDPLATFORM golang:1.26 AS builder
 
 ARG TARGETARCH
@@ -291,8 +217,6 @@ WORKDIR /workspace
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH:-amd64} go build -a -o /out/worker ./cmd/orka-agent-harness-wrapper
-
 RUN cat >/tmp/sandbox-runtime.go <<'GO'
 package main
 
@@ -483,23 +407,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     git \
     && rm -rf /var/lib/apt/lists/*
 
-COPY --from=builder /out/worker /worker
 COPY --from=builder /out/sandbox-runtime /usr/local/bin/sandbox-runtime
 
-RUN printf '%s\n' \
-    '#!/bin/sh' \
-    'set -eu' \
-    'marker=/workspace/orka-agent-sandbox-retained-marker.txt' \
-    'prompt="$*"' \
-    'if [ "${ORKA_AGENT_SANDBOX_ENABLED:-}" != "false" ]; then echo "ORKA_AGENT_SANDBOX_ENABLED was ${ORKA_AGENT_SANDBOX_ENABLED:-missing}" >&2; exit 41; fi' \
-    'if [ "${ORKA_AGENT_SANDBOX_DEPTH:-}" != "1" ]; then echo "ORKA_AGENT_SANDBOX_DEPTH was ${ORKA_AGENT_SANDBOX_DEPTH:-missing}" >&2; exit 42; fi' \
-    'if [ -z "${ORKA_SA_TOKEN_PATH:-}" ] || [ ! -s "${ORKA_SA_TOKEN_PATH}" ]; then echo "missing staged service account token" >&2; exit 43; fi' \
-    'state=absent' \
-    'if [ -f "$marker" ]; then state=present; fi' \
-    'printf "run=%s\n" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" > "$marker"' \
-    'printf "ORKA_LIVE_SANDBOX_OK depth=%s enabled=%s retained_marker=%s pwd=%s prompt=%s\n" "${ORKA_AGENT_SANDBOX_DEPTH}" "${ORKA_AGENT_SANDBOX_ENABLED}" "$state" "$(pwd)" "$prompt"' \
-    > /usr/local/bin/claude \
-    && chmod 0755 /worker /usr/local/bin/sandbox-runtime /usr/local/bin/claude
+RUN chmod 0755 /usr/local/bin/sandbox-runtime
 
 RUN groupadd -g 1000 worker \
     && useradd -u 1000 -g worker -m worker \
@@ -508,7 +418,7 @@ RUN groupadd -g 1000 worker \
 
 USER 1000:1000
 ENV HOME=/home/worker
-ENTRYPOINT ["/worker"]
+ENTRYPOINT ["/usr/local/bin/sandbox-runtime"]
 DOCKERFILE
 }
 
@@ -588,7 +498,6 @@ patch_controller_for_agent_sandbox() {
   log "Configuring Orka controller for agent-sandbox"
   kubectl -n "${orka_namespace}" get deployment "${orka_controller_deployment}" -o json |
     jq \
-      --arg claudeImage "${fake_claude_image}" \
       --arg routerURL "${router_url}" \
       --arg rolloutID "${rollout_id}" \
       --arg template "${sandbox_template_name}" '
@@ -642,7 +551,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: agent
-          image: ${fake_claude_image}
+          image: ${sandbox_fixture_image}
           imagePullPolicy: IfNotPresent
           command: ["/usr/local/bin/sandbox-runtime"]
           ports:
@@ -680,185 +589,6 @@ spec:
 YAML
 }
 
-apply_agent() {
-  log "Creating fake Claude runtime Agent ${agent_name}"
-  kubectl apply -f - <<YAML
-apiVersion: core.orka.ai/v1alpha1
-kind: Agent
-metadata:
-  name: ${agent_name}
-  namespace: ${orka_namespace}
-spec:
-  runtime:
-    type: claude
-    defaultMaxTurns: 1
-    defaultAllowBash: false
-  model:
-    name: fake-model-no-network
-YAML
-}
-
-apply_agent_task() {
-  local task_name="$1"
-  local prompt="$2"
-  local reuse_policy="$3"
-  local cleanup_policy="$4"
-  local session_block=""
-
-  if [[ "${reuse_policy}" == "session" ]]; then
-    session_block="$(cat <<YAML
-  sessionRef:
-    name: ${session_name}
-    create: true
-    append: true
-YAML
-)"
-  fi
-
-  kubectl apply -f - <<YAML
-apiVersion: core.orka.ai/v1alpha1
-kind: Task
-metadata:
-  name: ${task_name}
-  namespace: ${orka_namespace}
-spec:
-  type: agent
-  agentRef:
-    name: ${agent_name}
-  agentRuntime:
-    maxTurns: 1
-  timeout: 8m0s
-${session_block}
-  execution:
-    workspace:
-      enabled: true
-      templateRef:
-        name: ${sandbox_template_name}
-      reusePolicy: ${reuse_policy}
-      cleanupPolicy: ${cleanup_policy}
-  prompt: "${prompt}"
-YAML
-}
-
-wait_for_task_succeeded() {
-  local task_name="$1"
-  local phase message timeout_seconds deadline
-  log "Waiting for Task/${task_name} to succeed"
-  timeout_seconds="$(duration_to_seconds "${wait_timeout}")"
-  deadline=$((SECONDS + timeout_seconds))
-
-  while (( SECONDS < deadline )); do
-    phase="$(kubectl -n "${orka_namespace}" get task "${task_name}" -o jsonpath='{.status.phase}' 2>/dev/null || true)"
-    case "${phase}" in
-      Succeeded)
-        run kubectl -n "${orka_namespace}" wait --for=jsonpath='{.status.resultRef.available}'=true "task/${task_name}" --timeout=2m
-        return
-        ;;
-      Failed)
-        message="$(kubectl -n "${orka_namespace}" get task "${task_name}" -o jsonpath='{.status.message}' 2>/dev/null || true)"
-        die "Task/${task_name} failed: ${message:-no status message}"
-        ;;
-    esac
-    sleep 2
-  done
-
-  die "Task/${task_name} did not succeed within ${wait_timeout}"
-}
-
-task_job_name() {
-  local task_name="$1"
-  kubectl -n "${orka_namespace}" get task "${task_name}" -o jsonpath='{.status.jobName}'
-}
-
-task_logs() {
-  local task_name="$1"
-  local job_name
-  job_name="$(task_job_name "${task_name}")"
-  kubectl -n "${orka_namespace}" logs -l "job-name=${job_name}" --all-containers --tail=500
-}
-
-fetch_result() {
-  local api_base="$1"
-  local token="$2"
-  local task_name="$3"
-  curl -fsS \
-    -H "Authorization: Bearer ${token}" \
-    "${api_base}/api/v1/tasks/${task_name}/result?namespace=${orka_namespace}" |
-    jq -er '.result'
-}
-
-assert_result_contains() {
-  local result="$1"
-  local expected="$2"
-  if [[ "${result}" != *"${expected}"* ]]; then
-    printf 'result did not contain %q:\n%s\n' "${expected}" "${result}" >&2
-    exit 1
-  fi
-}
-
-session_claim_name() {
-  local hash
-  hash="$(printf '%s\0%s\0%s\0%s\0%s' \
-    "${orka_namespace}" \
-    "${orka_namespace}" \
-    "${orka_namespace}" \
-    "${sandbox_template_name}" \
-    "${session_name}" |
-    sha256_hex |
-    awk '{print substr($1, 1, 32)}')"
-  printf 'orka-session-%s\n' "${hash}"
-}
-
-sandbox_pod_name() {
-  local sandbox="$1"
-  local selector=""
-  local pod=""
-
-  for _ in $(seq 1 60); do
-    selector="$(kubectl -n "${orka_namespace}" get sandbox "${sandbox}" -o jsonpath='{.status.selector}' 2>/dev/null || true)"
-    if [[ -n "${selector}" ]]; then
-      pod="$(kubectl -n "${orka_namespace}" get pod -l "${selector}" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)"
-    fi
-
-    if [[ -z "${pod}" ]] && kubectl -n "${orka_namespace}" get pod "${sandbox}" >/dev/null 2>&1; then
-      pod="${sandbox}"
-    fi
-
-    if [[ -n "${pod}" ]]; then
-      printf '%s\n' "${pod}"
-      return 0
-    fi
-
-    sleep 2
-  done
-
-  die "could not resolve pod for Sandbox/${sandbox}"
-}
-
-verify_delete_cleanup() {
-  local logs="$1"
-  local claim
-  claim="$(printf '%s\n' "${logs}" | sed -nE 's/.*completed in (agent-sandbox|sandbox) workspace ([^[:space:]]*).*/\2/p' | tail -n 1)"
-  [[ -n "${claim}" ]] || die "could not find claimed sandbox workspace in delete task logs"
-
-  log "Verifying delete cleanup removed SandboxClaim/${claim}"
-  run kubectl -n "${orka_namespace}" wait --for=delete "sandboxclaim/${claim}" --timeout=2m
-}
-
-verify_retained_claim_reused() {
-  local claim="$1"
-  log "Verifying retained session SandboxClaim/${claim}"
-  kubectl -n "${orka_namespace}" get sandboxclaim "${claim}" -o json |
-    jq -e --arg template "${sandbox_template_name}" '
-      .spec.warmPoolRef.name == $template
-      and ((.status.sandbox.name // "") != "")
-    ' >/dev/null
-
-  local sandbox
-  sandbox="$(kubectl -n "${orka_namespace}" get sandboxclaim "${claim}" -o jsonpath='{.status.sandbox.name}')"
-  kubectl -n "${orka_namespace}" get sandbox "${sandbox}" >/dev/null
-}
-
 write_workspace_smoke_go() {
   rm -rf "${smoke_go_dir}"
   mkdir -p "${smoke_go_dir}"
@@ -1062,22 +792,8 @@ run_workspace_smoke() {
 }
 
 reset_e2e_resources() {
-  local session_claim
-  session_claim="$(session_claim_name)"
-
   log "Resetting fixed-name agent-sandbox e2e resources"
-  run kubectl -n "${orka_namespace}" delete task \
-    "${delete_task_name}" \
-    "${retain_task_one}" \
-    "${retain_task_two}" \
-    --ignore-not-found=true \
-    --wait=true \
-    --timeout=2m
-  run kubectl -n "${orka_namespace}" delete sandboxclaim "${session_claim}" "${smoke_claim_name}" \
-    --ignore-not-found=true \
-    --wait=true \
-    --timeout=2m
-  run kubectl -n "${orka_namespace}" delete agent "${agent_name}" \
+  run kubectl -n "${orka_namespace}" delete sandboxclaim "${smoke_claim_name}" \
     --ignore-not-found=true \
     --wait=true \
     --timeout=2m
@@ -1099,7 +815,7 @@ main() {
   require_cmd kubectl
   require_cmd curl
   require_cmd jq
-  require_sha256
+  require_cmd openssl
 
   cd "${repo_root}"
   [[ -f "${manager_kustomization}" ]] || die "missing ${manager_kustomization}"
@@ -1109,34 +825,52 @@ main() {
 
   setup_kind_cluster
   run kubectl config use-context "kind-${kind_cluster}"
+  log "Installing current Orka CRDs into the test cluster"
+  run make install
+  log "Creating the Vekil namespace required by the production ingress policy"
+  kubectl create namespace vekil-system --dry-run=client -o yaml | kubectl apply -f -
+  orka_kind_registry_start "${kind_cluster}"
 
   install_agent_sandbox
 
   log "Building manager image ${manager_image}"
   run make docker-build IMG="${manager_image}"
+  log "Building workspace publisher image ${publisher_image}"
+  run make docker-build-workspace-publisher WORKSPACE_PUBLISHER_IMG="${publisher_image}"
 
-  write_fake_claude_dockerfile
-  log "Building fake Claude worker/runtime image ${fake_claude_image}"
-  run docker build -t "${fake_claude_image}" -f "${fake_dockerfile}" .
-  log "Building harness-wrapper service image ${harness_wrapper_image}"
-  run make docker-build-harness-wrapper HARNESS_WRAPPER_IMG="${harness_wrapper_image}"
+  write_sandbox_fixture_dockerfile
+  log "Building agent-sandbox HTTP fixture image ${sandbox_fixture_image}"
+  run docker build -t "${sandbox_fixture_image}" -f "${fixture_dockerfile}" .
   build_sandbox_router_image
 
   log "Loading images into Kind cluster ${kind_cluster}"
   run kind load docker-image "${manager_image}" --name "${kind_cluster}"
-  run kind load docker-image "${fake_claude_image}" --name "${kind_cluster}"
-  run kind load docker-image "${harness_wrapper_image}" --name "${kind_cluster}"
+  run kind load docker-image "${sandbox_fixture_image}" --name "${kind_cluster}"
   run kind load docker-image "${sandbox_router_image}" --name "${kind_cluster}"
 
-  log "Deploying Orka manager"
-  run make deploy IMG="${manager_image}" HARNESS_WRAPPER_IMG="${harness_wrapper_image}"
+  local manager_ref publisher_ref
+  manager_ref="$(orka_kind_registry_push "${manager_image}" "orka/controller")"
+  publisher_ref="$(orka_kind_registry_push "${publisher_image}" "orka/workspace-publisher")"
+
+  log "Bootstrapping test-only admission TLS"
+  orka_e2e_bootstrap_admission_tls
+
+  log "Deploying Orka manager with inert digest-pinned ACP images (agent-sandbox RuntimeSession dispatch is deferred)"
+  local placeholder_digest
+  placeholder_digest="sha256:$(printf '0%.0s' {1..64})"
+  run make deploy \
+    IMG="${manager_ref}" \
+    WORKSPACE_PUBLISHER_IMG="${publisher_ref}" \
+    ACP_CODEX_RUNTIME_IMG="example.invalid/orka/acp-codex@${placeholder_digest}" \
+    ACP_CLAUDE_RUNTIME_IMG="example.invalid/orka/acp-claude@${placeholder_digest}" \
+    ACP_COPILOT_RUNTIME_IMG="example.invalid/orka/acp-copilot@${placeholder_digest}" \
+    ACP_OPENCODE_RUNTIME_IMG="example.invalid/orka/acp-opencode@${placeholder_digest}"
   run kubectl wait --for=condition=Established crd/tasks.core.orka.ai --timeout=60s
   deploy_sandbox_router
   patch_controller_for_agent_sandbox
 
   reset_e2e_resources
   apply_sandbox_template
-  apply_agent
 
   log "Port-forwarding Orka API service"
   api_pf_pid="$(start_port_forward "${orka_namespace}" "svc/${orka_api_service}" "${orka_api_local_port}" "${orka_api_service_port}" "${api_pf_log}")"
@@ -1152,7 +886,7 @@ main() {
 
   run_workspace_smoke "${router_base}"
 
-  log "Skipping full agent Task workspace smoke: harness-wrapper runtime currently rejects execution workspaces before Job creation"
+  log "Skipping workspace-backed ACP Task smoke: Task.spec.execution.workspace is intentionally unsupported until RuntimeSession-to-agent-sandbox dispatch is implemented; the direct workspace adapter path was validated above"
   log "Live agent-sandbox installation/configuration/workspace-adapter e2e passed"
 }
 
diff --git a/scripts/live-copilot-proxy-e2e.sh b/scripts/live-copilot-proxy-e2e.sh
index 36c0b1706..1e464d665 100755
--- a/scripts/live-copilot-proxy-e2e.sh
+++ b/scripts/live-copilot-proxy-e2e.sh
@@ -2,31 +2,32 @@
 
 set -Eeuo pipefail
 
-log() {
-  printf '==> %s\n' "$*" >&2
-}
-
-die() {
-  printf 'error: %s\n' "$*" >&2
-  exit 1
-}
-
-require_cmd() {
-  command -v "$1" >/dev/null 2>&1 || die "missing required command: $1"
-}
-
 script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 repo_root="$(cd "${script_dir}/.." && pwd)"
+# shellcheck source=scripts/lib/e2e-common.sh
+. "${script_dir}/lib/e2e-common.sh"
+# shellcheck source=scripts/lib/redact.sh
+. "${script_dir}/lib/redact.sh"
 
 kind_cluster="${KIND_CLUSTER:-orka-live-copilot-proxy-e2e}"
 orka_namespace="${ORKA_NAMESPACE:-orka-system}"
+# Legacy Provider/Chat/Anthropic paths call the configured upstream directly,
+# so keep their fixture outside the production Vekil ingress policy. The ACP
+# RuntimePool matrix uses a second fixture at the fixed production identity and
+# therefore still traverses the authenticated provider-proxy boundary.
 copilot_proxy_namespace="${COPILOT_PROXY_NAMESPACE:-default}"
 copilot_proxy_service="${COPILOT_PROXY_SERVICE:-copilot-proxy}"
 copilot_proxy_service_port="${COPILOT_PROXY_SERVICE_PORT:-1337}"
-copilot_proxy_local_port="${COPILOT_PROXY_LOCAL_PORT:-18081}"
-copilot_proxy_image="${COPILOT_PROXY_IMAGE:-ghcr.io/sozercan/vekil:v0.14.0@sha256:9e6ab58b9c27888db34d76422c3520b3bf103742a058572439a1fe0aa35a2ade}"
+provider_proxy_namespace="${ACP_PROVIDER_PROXY_NAMESPACE:-vekil-system}"
+provider_proxy_service="${ACP_PROVIDER_PROXY_SERVICE:-vekil}"
+provider_proxy_service_port="${ACP_PROVIDER_PROXY_SERVICE_PORT:-1337}"
+copilot_proxy_image="${COPILOT_PROXY_IMAGE:-ghcr.io/sozercan/vekil:v0.14.1@sha256:2fa0558f6304cc6ed1fb5b0135f62f12f28f1cdd0a8c057c4283414bceac1362}"
 proxy_token_secret_name="${COPILOT_PROXY_TOKEN_SECRET_NAME:-live-copilot-proxy-token}"
 token_value="${COPILOT_GITHUB_TOKEN:-}"
+[[ "${provider_proxy_namespace}" == "vekil-system" && "${provider_proxy_service}" == "vekil" && "${provider_proxy_service_port}" == "1337" ]] ||
+  die "live Copilot proxy E2E requires the production Vekil Service identity vekil.vekil-system.svc:1337"
+[[ "${copilot_proxy_namespace}/${copilot_proxy_service}" != "${provider_proxy_namespace}/${provider_proxy_service}" ]] ||
+  die "legacy live proxy fixture must be distinct from the production Vekil Service identity"
 proxy_pf_pid=""
 work_dir="$(mktemp -d "${RUNNER_TEMP:-${TMPDIR:-/tmp}}/live-copilot-proxy-e2e.XXXXXX")"
 
@@ -38,21 +39,9 @@ cleanup_port_forward() {
   fi
 }
 
-redact() {
-  local text
-  text="$(cat)"
-  if [[ -n "${token_value}" ]]; then
-    text="${text//${token_value}/[REDACTED]}"
-  fi
-  printf '%s' "${text}" | sed -E \
-    -e 's/(Authorization: (Bearer|token) )[[:graph:]]+/\1[REDACTED]/g' \
-    -e 's/COPILOT_GITHUB_TOKEN=[^[:space:]]+/COPILOT_GITHUB_TOKEN=[REDACTED]/g' \
-    -e 's/GITHUB_TOKEN=[^[:space:]]+/GITHUB_TOKEN=[REDACTED]/g' \
-    -e 's/gh[opusr]_[A-Za-z0-9_]+/[REDACTED_GITHUB_TOKEN]/g' \
-    -e 's/github_pat_[A-Za-z0-9_]+/[REDACTED_GITHUB_TOKEN]/g' \
-    -e 's/("access_token":"[^"]*")/"access_token":"[REDACTED]"/g' \
-    -e 's/("token":"[^"]*")/"token":"[REDACTED]"/g'
-}
+# The shared redact() (scripts/lib/redact.sh) substitutes the current value of
+# the proxy token at call time.
+ORKA_REDACT_SECRET_VARS=(token_value)
 
 dump_diagnostics() {
   log "Collecting redacted diagnostics"
@@ -64,12 +53,18 @@ dump_diagnostics() {
     echo "=== Orka Namespace Events ==="
     kubectl get events -n "${orka_namespace}" --sort-by=.lastTimestamp 2>/dev/null || true
     echo
-    echo "=== Proxy Namespace Resources ==="
+    echo "=== Legacy Proxy Namespace Resources ==="
     kubectl get pods,svc,deploy -n "${copilot_proxy_namespace}" -o wide 2>/dev/null || true
     echo
-    echo "=== Proxy Namespace Events ==="
+    echo "=== Legacy Proxy Namespace Events ==="
     kubectl get events -n "${copilot_proxy_namespace}" --sort-by=.lastTimestamp 2>/dev/null || true
     echo
+    echo "=== Provider Proxy Namespace Resources ==="
+    kubectl get pods,svc,deploy -n "${provider_proxy_namespace}" -o wide 2>/dev/null || true
+    echo
+    echo "=== Provider Proxy Namespace Events ==="
+    kubectl get events -n "${provider_proxy_namespace}" --sort-by=.lastTimestamp 2>/dev/null || true
+    echo
     echo "=== Controller Logs ==="
     local controller_pod
     controller_pod="$(kubectl get pods -l control-plane=controller-manager -n "${orka_namespace}" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)"
@@ -77,12 +72,19 @@ dump_diagnostics() {
       kubectl logs "${controller_pod}" -n "${orka_namespace}" --tail=200 2>/dev/null || true
     fi
     echo
-    echo "=== Proxy Logs ==="
+    echo "=== Legacy Proxy Logs ==="
     local proxy_pod
     proxy_pod="$(kubectl get pods -l app="${copilot_proxy_service}" -n "${copilot_proxy_namespace}" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)"
     if [[ -n "${proxy_pod}" ]]; then
       kubectl logs "${proxy_pod}" -n "${copilot_proxy_namespace}" --tail=200 2>/dev/null || true
     fi
+    echo
+    echo "=== Provider Proxy Logs ==="
+    local provider_proxy_pod
+    provider_proxy_pod="$(kubectl get pods -l app.kubernetes.io/name=vekil -n "${provider_proxy_namespace}" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)"
+    if [[ -n "${provider_proxy_pod}" ]]; then
+      kubectl logs "${provider_proxy_pod}" -n "${provider_proxy_namespace}" --tail=200 2>/dev/null || true
+    fi
   } | redact >&2
 }
 
@@ -171,10 +173,11 @@ main() {
   log "Creating Kind cluster ${kind_cluster}"
   make setup-test-e2e KIND_CLUSTER="${kind_cluster}"
 
-  log "Creating proxy namespace ${copilot_proxy_namespace}"
+  log "Creating live proxy namespaces"
   kubectl create namespace "${copilot_proxy_namespace}" --dry-run=client -o yaml | kubectl apply -f -
+  kubectl create namespace "${provider_proxy_namespace}" --dry-run=client -o yaml | kubectl apply -f -
 
-  log "Deploying copilot-proxy"
+  log "Deploying direct-access live proxy fixture"
   kubectl apply -f - <<YAML
 apiVersion: v1
 kind: Secret
@@ -234,9 +237,71 @@ spec:
   ports:
     - port: ${copilot_proxy_service_port}
       targetPort: 1337
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ${proxy_token_secret_name}
+  namespace: ${provider_proxy_namespace}
+type: Opaque
+stringData:
+  COPILOT_GITHUB_TOKEN: "${token_value}"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ${provider_proxy_service}
+  namespace: ${provider_proxy_namespace}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: vekil
+  template:
+    metadata:
+      labels:
+        app: ${provider_proxy_service}
+        app.kubernetes.io/name: vekil
+    spec:
+      containers:
+        - name: ${provider_proxy_service}
+          image: ${copilot_proxy_image}
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 1337
+          env:
+            - name: COPILOT_GITHUB_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: ${proxy_token_secret_name}
+                  key: COPILOT_GITHUB_TOKEN
+            - name: PORT
+              value: "1337"
+            - name: TOKEN_DIR
+              value: /home/nonroot/.config/copilot-proxy
+          volumeMounts:
+            - name: token-cache
+              mountPath: /home/nonroot/.config/copilot-proxy
+      volumes:
+        - name: token-cache
+          emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: ${provider_proxy_service}
+  namespace: ${provider_proxy_namespace}
+spec:
+  selector:
+    app.kubernetes.io/name: vekil
+  ports:
+    - port: ${provider_proxy_service_port}
+      targetPort: 1337
 YAML
 
   wait_for_proxy_deployment
+  log "Waiting for provider proxy rollout"
+  kubectl rollout status deployment/"${provider_proxy_service}" -n "${provider_proxy_namespace}" --timeout=5m
 
   log "Waiting for copilot-proxy /readyz via Kubernetes service proxy"
   wait_for_kube_service_proxy \
@@ -246,7 +311,15 @@ YAML
     "/readyz" \
     "copilot-proxy /readyz"
 
-  log "Validating copilot-proxy live models"
+  log "Waiting for provider proxy /readyz via Kubernetes service proxy"
+  wait_for_kube_service_proxy \
+    "${provider_proxy_namespace}" \
+    "${provider_proxy_service}" \
+    "${provider_proxy_service_port}" \
+    "/readyz" \
+    "provider proxy /readyz"
+
+  log "Validating direct-access live proxy models"
   wait_for_kube_service_proxy \
     "${copilot_proxy_namespace}" \
     "${copilot_proxy_service}" \
@@ -265,13 +338,27 @@ YAML
   log "Live proxy model families detected"
   jq -r '.data[].id' "${work_dir}/copilot-proxy-models.json" | redact >&2
 
+  log "Validating provider proxy live models"
+  wait_for_kube_service_proxy \
+    "${provider_proxy_namespace}" \
+    "${provider_proxy_service}" \
+    "${provider_proxy_service_port}" \
+    "/v1/models" \
+    "provider proxy /v1/models" \
+    "${work_dir}/provider-proxy-models.json"
+  jq -e '.data | length > 0' "${work_dir}/provider-proxy-models.json" >/dev/null
+
   log "Running focused live copilot-proxy Go e2e specs"
   KIND_CLUSTER="${kind_cluster}" \
+  E2E_EPHEMERAL_CLUSTER=true \
   E2E_GITHUB_TOKEN="${token_value}" \
   E2E_LIVE_COPILOT_PROXY_BASE_URL="http://${copilot_proxy_service}.${copilot_proxy_namespace}.svc.cluster.local:${copilot_proxy_service_port}/v1" \
   E2E_LIVE_COPILOT_PROXY_SERVICE_NAMESPACE="${copilot_proxy_namespace}" \
   E2E_LIVE_COPILOT_PROXY_SERVICE_NAME="${copilot_proxy_service}" \
   E2E_LIVE_COPILOT_PROXY_SERVICE_PORT="${copilot_proxy_service_port}" \
+  E2E_LIVE_ACP_PROVIDER_PROXY_SERVICE_NAMESPACE="${provider_proxy_namespace}" \
+  E2E_LIVE_ACP_PROVIDER_PROXY_SERVICE_NAME="${provider_proxy_service}" \
+  E2E_LIVE_ACP_PROVIDER_PROXY_SERVICE_PORT="${provider_proxy_service_port}" \
   go test -tags=e2e ./test/e2e/ -timeout 45m -v -ginkgo.v \
     -ginkgo.focus="Live Copilot Proxy Provider|Live Chat API|Live Anthropic Compat API|Live Agent Runtime Matrix"
 
diff --git a/scripts/live-github-label-trigger-e2e.sh b/scripts/live-github-label-trigger-e2e.sh
index d58fc9044..75d958e50 100755
--- a/scripts/live-github-label-trigger-e2e.sh
+++ b/scripts/live-github-label-trigger-e2e.sh
@@ -2,23 +2,6 @@
 
 set -Eeuo pipefail
 
-log() {
-  printf '==> %s\n' "$*" >&2
-}
-
-warn() {
-  printf 'warning: %s\n' "$*" >&2
-}
-
-die() {
-  printf 'error: %s\n' "$*" >&2
-  exit 1
-}
-
-require_cmd() {
-  command -v "$1" >/dev/null 2>&1 || die "missing required command: $1"
-}
-
 check_docker_ready() {
   if ! docker info >/dev/null 2>&1; then
     die "Docker daemon is not reachable; start Docker before running live kind-based GitHub label trigger E2E"
@@ -52,6 +35,14 @@ EOF_HELP
 
 script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 repo_root="$(cd "${script_dir}/.." && pwd)"
+# shellcheck source=scripts/lib/e2e-common.sh
+. "${script_dir}/lib/e2e-common.sh"
+# shellcheck source=scripts/lib/redact.sh
+. "${script_dir}/lib/redact.sh"
+# shellcheck source=scripts/lib/kind-local-registry.sh
+. "${script_dir}/lib/kind-local-registry.sh"
+# shellcheck source=scripts/lib/e2e-admission-tls.sh
+. "${script_dir}/lib/e2e-admission-tls.sh"
 
 kind_cluster="${KIND_CLUSTER:-orka-live-github-label-trigger-e2e}"
 orka_namespace="${ORKA_NAMESPACE:-orka-system}"
@@ -60,6 +51,7 @@ orka_api_service="${ORKA_API_SERVICE:-orka-api}"
 orka_api_service_port="${ORKA_API_SERVICE_PORT:-8080}"
 orka_api_local_port="${ORKA_API_LOCAL_PORT:-18082}"
 manager_image="${ORKA_MANAGER_IMAGE:-orka-controller:live-github-label-trigger-e2e}"
+publisher_image="${ORKA_WORKSPACE_PUBLISHER_IMAGE:-orka-workspace-publisher:live-github-label-trigger-e2e}"
 target_repo_url="${GITHUB_LABEL_TRIGGER_TARGET_REPO_URL:-https://github.com/orka-agents/orka}"
 target_number="${GITHUB_LABEL_TRIGGER_TARGET_NUMBER:-1}"
 agent_name="${GITHUB_LABEL_TRIGGER_AGENT_NAME:-github-label-ci-agent}"
@@ -73,16 +65,9 @@ api_pf_log="${work_dir}/api-port-forward.log"
 manager_kustomization="${repo_root}/config/manager/kustomization.yaml"
 manager_kustomization_backup="${work_dir}/manager-kustomization.yaml.bak"
 
-redact() {
-  local text
-  text="$(cat)"
-  if [[ -n "${webhook_secret}" ]]; then
-    text="${text//${webhook_secret}/[REDACTED_WEBHOOK_SECRET]}"
-  fi
-  printf '%s' "${text}" | sed -E \
-    -e 's/(X-Hub-Signature-256: *sha256=)[A-Fa-f0-9]+/\1[REDACTED_SIGNATURE]/g' \
-    -e 's/(ORKA_GITHUB_WEBHOOK_SECRET=)[^[:space:]]+/\1[REDACTED_WEBHOOK_SECRET]/g'
-}
+# The shared redact() (scripts/lib/redact.sh) substitutes the current value of
+# the webhook secret at call time.
+ORKA_REDACT_SECRET_VARS=(webhook_secret)
 
 cleanup_port_forward() {
   if [[ -n "${api_pf_pid}" ]]; then
@@ -108,17 +93,11 @@ dump_diagnostics() {
     kubectl config current-context 2>/dev/null || true
     echo
     echo "=== Orka Namespace Resources ==="
-    kubectl get pods,svc,deploy,tasks -n "${orka_namespace}" -o wide 2>/dev/null || true
-    echo
-    echo "=== Default Namespace Resources ==="
-    kubectl get pods,svc,deploy,agents,tasks -n default -o wide 2>/dev/null || true
+    kubectl get pods,svc,deploy,agents,tasks -n "${orka_namespace}" -o wide 2>/dev/null || true
     echo
     echo "=== Orka Namespace Events ==="
     kubectl get events -n "${orka_namespace}" --sort-by=.lastTimestamp 2>/dev/null || true
     echo
-    echo "=== Default Namespace Events ==="
-    kubectl get events -n default --sort-by=.lastTimestamp 2>/dev/null || true
-    echo
     echo "=== Controller Logs ==="
     local controller_pod
     controller_pod="$(kubectl get pods -l control-plane=controller-manager -n "${orka_namespace}" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)"
@@ -146,11 +125,12 @@ on_exit() {
   cleanup_port_forward
 
   if [[ -n "${task_name}" ]]; then
-    kubectl delete task "${task_name}" -n default --ignore-not-found=true >/dev/null 2>&1 || true
+    kubectl delete task "${task_name}" -n "${orka_namespace}" --ignore-not-found=true >/dev/null 2>&1 || true
   fi
-  kubectl delete agent "${agent_name}" -n default --ignore-not-found=true >/dev/null 2>&1 || true
+  kubectl delete agent "${agent_name}" -n "${orka_namespace}" --ignore-not-found=true >/dev/null 2>&1 || true
 
   restore_manager_kustomization
+  orka_kind_registry_stop
   make cleanup-test-e2e KIND_CLUSTER="${kind_cluster}" >/dev/null 2>&1 || true
   rm -rf "${work_dir}" >/dev/null 2>&1 || true
 
@@ -294,9 +274,10 @@ apiVersion: core.orka.ai/v1alpha1
 kind: Agent
 metadata:
   name: ${agent_name}
-  namespace: default
+  namespace: ${orka_namespace}
 spec:
   runtime:
+    contractVersion: orka.harness.v2
     type: codex
     defaultMaxTurns: 5
     defaultAllowBash: false
@@ -365,6 +346,8 @@ main() {
   require_cmd curl
   require_cmd jq
   require_cmd python3
+  require_cmd openssl
+  [[ "${orka_namespace}" == "orka-system" ]] || die "ORKA_NAMESPACE must be orka-system for the canonical make deploy path"
   check_docker_ready
 
   if [[ ! "${target_number}" =~ ^[0-9]+$ || "${target_number}" -le 0 ]]; then
@@ -393,19 +376,38 @@ main() {
   log "Creating or reusing Kind cluster ${kind_cluster}"
   run make setup-test-e2e KIND_CLUSTER="${kind_cluster}"
   run kubectl config use-context "kind-${kind_cluster}"
+  log "Installing current Orka CRDs into the test cluster"
+  run make install
+  log "Creating the Vekil namespace required by the production ingress policy"
+  kubectl create namespace vekil-system --dry-run=client -o yaml | kubectl apply -f -
+  orka_kind_registry_start "${kind_cluster}"
 
   log "Building manager image ${manager_image}"
   run make docker-build IMG="${manager_image}"
+  log "Building workspace publisher image ${publisher_image}"
+  run make docker-build-workspace-publisher WORKSPACE_PUBLISHER_IMG="${publisher_image}"
 
   log "Loading manager image into Kind cluster ${kind_cluster}"
   run kind load docker-image "${manager_image}" --name "${kind_cluster}"
 
+  local manager_ref publisher_ref placeholder_digest
+  manager_ref="$(orka_kind_registry_push "${manager_image}" "orka/controller")"
+  publisher_ref="$(orka_kind_registry_push "${publisher_image}" "orka/workspace-publisher")"
+  placeholder_digest="sha256:$(printf '0%.0s' {1..64})"
+  log "Bootstrapping test-only admission TLS"
+  orka_e2e_bootstrap_admission_tls
   log "Deploying Orka manager"
-  run make deploy IMG="${manager_image}"
+  run make deploy \
+    IMG="${manager_ref}" \
+    WORKSPACE_PUBLISHER_IMG="${publisher_ref}" \
+    ACP_CODEX_RUNTIME_IMG="example.invalid/orka/acp-codex@${placeholder_digest}" \
+    ACP_CLAUDE_RUNTIME_IMG="example.invalid/orka/acp-claude@${placeholder_digest}" \
+    ACP_COPILOT_RUNTIME_IMG="example.invalid/orka/acp-copilot@${placeholder_digest}" \
+    ACP_OPENCODE_RUNTIME_IMG="example.invalid/orka/acp-opencode@${placeholder_digest}"
   run kubectl wait --for=condition=Established crd/tasks.core.orka.ai --timeout=60s
   run kubectl wait --for=condition=Established crd/agents.core.orka.ai --timeout=60s
 
-  log "Creating runtime Agent ${agent_name} in default namespace"
+  log "Creating runtime Agent ${agent_name} in ${orka_namespace} namespace"
   write_agent_manifest
 
   log "Configuring local image pull policy and GitHub label trigger env"
@@ -415,7 +417,7 @@ main() {
   kubectl -n "${orka_namespace}" set env deployment/"${orka_controller_deployment}" \
     ORKA_GITHUB_WEBHOOK_SECRET="${webhook_secret}" \
     ORKA_GITHUB_LABEL_TRIGGER_AGENT="${agent_name}" \
-    ORKA_GITHUB_LABEL_TRIGGER_NAMESPACE=default \
+    ORKA_GITHUB_LABEL_TRIGGER_NAMESPACE="${orka_namespace}" \
     ORKA_GITHUB_LABEL_TRIGGER_TIMEOUT=5m \
     ORKA_GITHUB_LABEL_TRIGGER_MAX_TURNS=5 >/dev/null
   run kubectl -n "${orka_namespace}" rollout status deployment/"${orka_controller_deployment}" --timeout=5m
@@ -458,7 +460,7 @@ main() {
   log "Verifying created Task ${task_name} targets ${repo_full}"
   local task_file
   task_file="${work_dir}/created-task.json"
-  run kubectl get task "${task_name}" -n default -o json >"${task_file}"
+  run kubectl get task "${task_name}" -n "${orka_namespace}" -o json >"${task_file}"
   jq -e \
     --arg agent "${agent_name}" \
     --arg delivery "${delivery}" \
@@ -467,10 +469,11 @@ main() {
     --arg repo_clone "${repo_clone}" \
     '.spec.type == "agent"
       and .spec.agentRef.name == $agent
-      and .spec.agentRuntime.workspace.gitRepo == $repo_clone
-      and .spec.agentRuntime.workspace.branch == "main"
-      and ((.spec.agentRuntime.workspace.pushBranch // "") == "")
-      and (.spec.agentRuntime.workspace.gitSecretRef == null)
+      and .spec.workspace.gitRepo == $repo_clone
+      and .spec.workspace.branch == "main"
+      and ((.spec.workspace.pushBranch // "") == "")
+      and (.spec.workspace.readCredentialRef == null)
+      and ((.spec.workspace.intent // "read") == "read")
       and .metadata.annotations["orka.ai/github-delivery"] == $delivery
       and .metadata.annotations["orka.ai/github-label"] == $label
       and .metadata.annotations["orka.ai/github-repository"] == $repo_full
diff --git a/scripts/live-github-oidc-e2e.sh b/scripts/live-github-oidc-e2e.sh
index 2d975a241..314a44ede 100755
--- a/scripts/live-github-oidc-e2e.sh
+++ b/scripts/live-github-oidc-e2e.sh
@@ -4,23 +4,24 @@ set -Eeuo pipefail
 log() { printf '==> %s\n' "$*" >&2; }
 die() { printf 'error: %s\n' "$*" >&2; exit 1; }
 require_cmd() { command -v "$1" >/dev/null 2>&1 || die "missing required command: $1"; }
-redact() {
-  sed -E \
-    -e 's#(Authorization:[[:space:]]*Bearer[[:space:]]+)[^[:space:]"}]+#\1[REDACTED]#g' \
-    -e 's#(ACTIONS_ID_TOKEN_REQUEST_TOKEN=)[^[:space:]]+#\1[REDACTED]#g' \
-    -e 's#eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{10,}#[REDACTED-JWT]#g'
-}
-
-repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repo_root="$(cd "${script_dir}/.." && pwd)"
+# shellcheck source=scripts/lib/redact.sh
+. "${script_dir}/lib/redact.sh"
+# shellcheck source=scripts/lib/kind-local-registry.sh
+. "${script_dir}/lib/kind-local-registry.sh"
+# shellcheck source=scripts/lib/e2e-admission-tls.sh
+. "${script_dir}/lib/e2e-admission-tls.sh"
 cluster="${KIND_CLUSTER:-orka-live-github-oidc-e2e}"
 namespace="${ORKA_NAMESPACE:-orka-system}"
 deployment="${ORKA_CONTROLLER_DEPLOYMENT:-orka-controller-manager}"
 manager_image="${ORKA_MANAGER_IMAGE:-orka-controller:live-github-oidc-e2e}"
+publisher_image="${ORKA_WORKSPACE_PUBLISHER_IMAGE:-orka-workspace-publisher:live-github-oidc-e2e}"
 audience="${ORKA_GITHUB_OIDC_AUDIENCE:-orka-live-github-oidc-e2e}"
 issuer="${ORKA_GITHUB_OIDC_ISSUER:-https://token.actions.githubusercontent.com}"
 repository="${GITHUB_REPOSITORY:-orka-agents/orka}"
 allowed_subjects="${ORKA_GITHUB_OIDC_ALLOWED_SUBJECTS:-repo:${repository}:*}"
-oidc_namespace="${ORKA_GITHUB_OIDC_NAMESPACE:-default}"
+oidc_namespace="${ORKA_GITHUB_OIDC_NAMESPACE:-${namespace}}"
 token="${ORKA_GITHUB_OIDC_TOKEN:-}"
 port="${ORKA_API_LOCAL_PORT:-18080}"
 workdir="$(mktemp -d "${RUNNER_TEMP:-${TMPDIR:-/tmp}}/orka-oidc-e2e.XXXXXX")"
@@ -46,15 +47,21 @@ cleanup() {
       fi
     } | redact >&2
   fi
+  orka_kind_registry_stop
   kind delete cluster --name "${cluster}" >/dev/null 2>&1 || true
   rm -rf "${workdir}"
   exit "${status}"
 }
 trap cleanup EXIT
 
-fetch_token() {
+require_token_source() {
   if [[ -n "${token}" ]]; then return; fi
   [[ -n "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" && -n "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ]] || die "GitHub OIDC token source is unavailable"
+}
+
+fetch_token() {
+  require_token_source
+  if [[ -n "${token}" ]]; then return; fi
   response="${workdir}/oidc.json"
   curl -fsS -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
     "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=$(printf '%s' "${audience}" | jq -sRr @uri)" >"${response}"
@@ -91,17 +98,37 @@ wait_for_api() {
   die "Orka API did not become ready"
 }
 
-for cmd in make go docker kind kubectl curl jq; do require_cmd "${cmd}"; done
+[[ "${namespace}" == "orka-system" ]] || die "ORKA_NAMESPACE must be orka-system for the canonical make deploy path"
+[[ "${oidc_namespace}" == "${namespace}" ]] || die "ORKA_GITHUB_OIDC_NAMESPACE must match ORKA_NAMESPACE for an isolated controller"
+
+for cmd in make go docker kind kubectl curl jq openssl; do require_cmd "${cmd}"; done
 cd "${repo_root}"
 cp "${kustomization}" "${backup}"
-fetch_token
+require_token_source
 log "Creating kind cluster ${cluster}"
 make setup-test-e2e KIND_CLUSTER="${cluster}"
 kubectl config use-context "kind-${cluster}" >/dev/null
+log "Installing current Orka CRDs into the test cluster"
+make install
+log "Creating the Vekil namespace required by the production ingress policy"
+kubectl create namespace vekil-system --dry-run=client -o yaml | kubectl apply -f -
+orka_kind_registry_start "${cluster}"
 log "Building and loading controller image"
 make docker-build IMG="${manager_image}"
+make docker-build-workspace-publisher WORKSPACE_PUBLISHER_IMG="${publisher_image}"
 kind load docker-image "${manager_image}" --name "${cluster}"
-make deploy IMG="${manager_image}"
+manager_ref="$(orka_kind_registry_push "${manager_image}" "orka/controller")"
+publisher_ref="$(orka_kind_registry_push "${publisher_image}" "orka/workspace-publisher")"
+placeholder_digest="sha256:$(printf '0%.0s' {1..64})"
+log "Bootstrapping test-only admission TLS"
+orka_e2e_bootstrap_admission_tls
+make deploy \
+  IMG="${manager_ref}" \
+  WORKSPACE_PUBLISHER_IMG="${publisher_ref}" \
+  ACP_CODEX_RUNTIME_IMG="example.invalid/orka/acp-codex@${placeholder_digest}" \
+  ACP_CLAUDE_RUNTIME_IMG="example.invalid/orka/acp-claude@${placeholder_digest}" \
+  ACP_COPILOT_RUNTIME_IMG="example.invalid/orka/acp-copilot@${placeholder_digest}" \
+  ACP_OPENCODE_RUNTIME_IMG="example.invalid/orka/acp-opencode@${placeholder_digest}"
 kubectl wait --for=condition=Established crd/tasks.core.orka.ai --timeout=60s
 kubectl -n "${namespace}" patch deployment "${deployment}" --type=strategic \
   -p '{"spec":{"template":{"spec":{"containers":[{"name":"manager","imagePullPolicy":"IfNotPresent"}]}}}}'
@@ -117,11 +144,15 @@ kubectl -n "${namespace}" set env deployment/"${deployment}" \
 kubectl -n "${namespace}" rollout status deployment/"${deployment}" --timeout=5m
 start_api_port_forward
 wait_for_api
+# GitHub Actions OIDC tokens are short-lived; fetch immediately before use so
+# cluster setup and image builds cannot consume the token lifetime.
+fetch_token
 
 payload="${workdir}/task.json"
 response="${workdir}/response.json"
 task="github-oidc-$(date +%s)-${RANDOM}"
-jq -n --arg name "${task}" '{name:$name,namespace:"default",type:"container",image:"busybox:1.36",command:["/bin/sh","-c"],args:["echo github-oidc"]}' >"${payload}"
+jq -n --arg name "${task}" --arg namespace "${oidc_namespace}" \
+  '{name:$name,namespace:$namespace,type:"container",image:"busybox:1.36",command:["/bin/sh","-c"],args:["echo github-oidc"]}' >"${payload}"
 status="$(request POST "http://127.0.0.1:${port}/api/v1/tasks" "${response}" -H "Authorization: Bearer ${token}" -H 'Content-Type: application/json' --data @"${payload}")"
 [[ "${status}" == 201 ]] || { cat "${response}" | redact >&2; die "OIDC task creation returned HTTP ${status}"; }
 jq -e --arg issuer "${issuer}" '.spec.requestedBy.issuer == $issuer and ((.spec.requestedBy.subject // "") != "")' "${response}" >/dev/null
diff --git a/scripts/render-acp-runtime-images.sh b/scripts/render-acp-runtime-images.sh
new file mode 100755
index 000000000..90471ac57
--- /dev/null
+++ b/scripts/render-acp-runtime-images.sh
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+usage() {
+  echo "Usage: $0 OUTPUT_DIR CODEX_IMAGE CLAUDE_IMAGE COPILOT_IMAGE OPENCODE_IMAGE" >&2
+}
+
+[[ $# -eq 5 ]] || {
+  usage
+  exit 2
+}
+
+output_dir="$1"
+codex_image="$2"
+claude_image="$3"
+copilot_image="$4"
+opencode_image="$5"
+
+[[ -d "${output_dir}" && ! -L "${output_dir}" ]] || {
+  echo "ACP production output directory must be a real directory: ${output_dir}" >&2
+  exit 1
+}
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+command -v go >/dev/null 2>&1 || {
+  echo "Go is required to validate ACP runtime image references" >&2
+  exit 1
+}
+if ! (cd "${root}" && go run ./cmd/orka-image-ref-validator "${codex_image}" "${claude_image}" "${copilot_image}" "${opencode_image}"); then
+  echo "ACP runtime image reference validation failed" >&2
+  exit 1
+fi
+
+env_tmp="$(mktemp "${output_dir}/.runtime-images.XXXXXX")"
+cleanup() {
+  rm -f -- "${env_tmp}"
+}
+trap cleanup EXIT
+
+cat >"${env_tmp}" <<EOF_ENV
+# Generated by scripts/render-acp-runtime-images.sh. Kustomize hashes this
+# complete generation and rewrites the controller Deployment reference.
+ORKA_ACP_CODEX_RUNTIME_IMAGE=${codex_image}
+ORKA_ACP_CLAUDE_RUNTIME_IMAGE=${claude_image}
+ORKA_ACP_COPILOT_RUNTIME_IMAGE=${copilot_image}
+ORKA_ACP_OPENCODE_RUNTIME_IMAGE=${opencode_image}
+EOF_ENV
+
+mv -f -- "${env_tmp}" "${output_dir}/runtime-images.env"
diff --git a/scripts/render-worker-images.sh b/scripts/render-worker-images.sh
new file mode 100755
index 000000000..282aa723b
--- /dev/null
+++ b/scripts/render-worker-images.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+if [[ $# -ne 3 ]]; then
+  echo "usage: $0 MANAGER_YAML AI_WORKER_IMAGE GENERAL_WORKER_IMAGE" >&2
+  exit 2
+fi
+
+manager_yaml="$1"
+ai_image="$2"
+general_image="$3"
+[[ -f "${manager_yaml}" && ! -L "${manager_yaml}" ]] || {
+  echo "manager manifest must be a regular file: ${manager_yaml}" >&2
+  exit 1
+}
+[[ -n "${ai_image}" && -n "${general_image}" ]] || {
+  echo "worker image references must not be empty" >&2
+  exit 1
+}
+
+python3 - "${manager_yaml}" "${ai_image}" "${general_image}" <<'PY'
+from pathlib import Path
+import sys
+
+path = Path(sys.argv[1])
+text = path.read_text()
+for flag, value in (("--ai-worker-image", sys.argv[2]), ("--general-worker-image", sys.argv[3])):
+    prefix = f"          - {flag}="
+    matches = [line for line in text.splitlines() if line.startswith(prefix)]
+    if len(matches) != 1:
+        raise SystemExit(f"expected exactly one {flag} entry in {path}, found {len(matches)}")
+    text = text.replace(matches[0], prefix + value, 1)
+temporary = path.with_name(f".{path.name}.worker-images.tmp")
+temporary.write_text(text)
+temporary.replace(path)
+PY
diff --git a/scripts/security-scan-e2e.sh b/scripts/security-scan-e2e.sh
index d1e9b8f05..766e8173e 100755
--- a/scripts/security-scan-e2e.sh
+++ b/scripts/security-scan-e2e.sh
@@ -2,70 +2,68 @@
 
 set -Eeuo pipefail
 
-log() {
-  printf '==> %s\n' "$*" >&2
-}
-
-warn() {
-  printf 'warning: %s\n' "$*" >&2
-}
-
-die() {
-  printf 'error: %s\n' "$*" >&2
-  exit 1
-}
-
-require_cmd() {
-  command -v "$1" >/dev/null 2>&1 || die "missing required command: $1"
-}
-
 sanitize_image_tag() {
   printf '%s' "$1" | LC_ALL=C tr -c 'A-Za-z0-9_.-' '-'
 }
 
+parse_github_repository_identity() {
+  local repo_url="${1%/}"
+  repo_url="${repo_url%.git}"
+  if [[ ! "${repo_url}" =~ ^https://github\.com/([^/]+)/([^/]+)$ ]]; then
+    return 1
+  fi
+  printf '%s\t%s\n' "${BASH_REMATCH[1]}" "${BASH_REMATCH[2]}"
+}
+
 script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 repo_root="$(cd "${script_dir}/.." && pwd)"
+# shellcheck source=scripts/lib/e2e-common.sh
+. "${script_dir}/lib/e2e-common.sh"
+# shellcheck source=scripts/lib/redact.sh
+. "${script_dir}/lib/redact.sh"
+# shellcheck source=scripts/lib/kind-local-registry.sh
+. "${script_dir}/lib/kind-local-registry.sh"
+# shellcheck source=scripts/lib/e2e-admission-tls.sh
+. "${script_dir}/lib/e2e-admission-tls.sh"
 
-kind_cluster="${KIND_CLUSTER:-orka-security-scan-e2e}"
+e2e_run_id="$(sanitize_image_tag "${ORKA_SECURITY_SCAN_RUN_ID:-${GITHUB_RUN_ID:-manual}-$(date -u +%Y%m%d%H%M%S)}")"
+default_kind_suffix="${e2e_run_id:0:32}"
+kind_cluster="${KIND_CLUSTER:-orka-security-scan-${default_kind_suffix}}"
 orka_namespace="${ORKA_NAMESPACE:-orka-system}"
-test_namespace="${ORKA_SECURITY_SCAN_E2E_NAMESPACE:-default}"
+test_namespace="${ORKA_SECURITY_SCAN_E2E_NAMESPACE:-${orka_namespace}}"
 orka_controller_deployment="${ORKA_CONTROLLER_DEPLOYMENT:-orka-controller-manager}"
-orka_harness_wrapper_deployment="${ORKA_HARNESS_WRAPPER_DEPLOYMENT:-orka-agent-harness-wrapper}"
-orka_api_service="${ORKA_API_SERVICE:-orka-api}"
-orka_api_service_port="${ORKA_API_SERVICE_PORT:-8080}"
-orka_api_local_port="${ORKA_API_LOCAL_PORT:-18086}"
 wait_timeout="${ORKA_SECURITY_SCAN_WAIT_TIMEOUT:-25m}"
 target_repo="${ORKA_SECURITY_SCAN_TARGET_REPO:-https://github.com/sozercan/nodejs-goof}"
 target_branch="${ORKA_SECURITY_SCAN_TARGET_BRANCH:-main}"
 target_ref="${ORKA_SECURITY_SCAN_TARGET_REF:-add14ba59e98240d9e00a235dd7d42cd61ae9912}"
+read -r target_owner target_repository < <(parse_github_repository_identity "${target_repo}") ||
+  die "ORKA_SECURITY_SCAN_TARGET_REPO must be a credential-free HTTPS github.com repository URL"
 agent_name="${ORKA_SECURITY_SCAN_AGENT:-security-scan-e2e-agent}"
 scan_name="${ORKA_SECURITY_SCAN_NAME:-security-goof}"
-bad_scan_name="${ORKA_SECURITY_BAD_SCAN_NAME:-security-goof-tool-transcript}"
+bad_scan_name="${ORKA_SECURITY_BAD_SCAN_NAME:-security-goof-malformed-result}"
+api_identity_name="${ORKA_SECURITY_SCAN_API_IDENTITY:-security-scan-e2e}"
+api_local_port="${ORKA_SECURITY_SCAN_API_LOCAL_PORT:-18086}"
 keep_cluster="${KEEP_CLUSTER:-0}"
-created_kind_cluster="0"
-api_pf_pid=""
+kind_cleanup_armed="0"
+registry_cleanup_armed="0"
+kind_lock_held="0"
+api_forward_pid=""
 
-e2e_run_id="$(sanitize_image_tag "${ORKA_SECURITY_SCAN_RUN_ID:-${GITHUB_RUN_ID:-manual}-$(date -u +%Y%m%d%H%M%S)}")"
 manager_image="${ORKA_MANAGER_IMAGE:-orka-controller:security-scan-e2e-${e2e_run_id}}"
+publisher_image="${ORKA_WORKSPACE_PUBLISHER_IMAGE:-orka-workspace-publisher:security-scan-e2e-${e2e_run_id}}"
 general_worker_image="${ORKA_GENERAL_WORKER_IMAGE:-orka-general-worker:security-scan-e2e-${e2e_run_id}}"
-fake_codex_image="${ORKA_FAKE_HARNESS_WRAPPER_IMAGE:-orka-security-fake-codex:security-scan-e2e-${e2e_run_id}}"
+fake_runtime_image="${ORKA_SECURITY_SCAN_FAKE_RUNTIME_IMAGE:-orka-acp-security-fixture:security-scan-e2e-${e2e_run_id}}"
 
 work_dir="$(mktemp -d "${RUNNER_TEMP:-${TMPDIR:-/tmp}}/security-scan-e2e.XXXXXX")"
 kind_config="${ORKA_SECURITY_SCAN_KIND_CONFIG:-${work_dir}/kind-config.yaml}"
-fake_dockerfile="${work_dir}/Dockerfile.fake-codex"
-api_pf_log="${work_dir}/api-port-forward.log"
 manager_kustomization="${repo_root}/config/manager/kustomization.yaml"
 manager_kustomization_backup="${work_dir}/manager-kustomization.yaml.bak"
-api_base=""
-api_token=""
-
-redact() {
-  sed -E \
-    -e 's/(Authorization:[[:space:]]*Bearer[[:space:]]+)[A-Za-z0-9._~+\/=-]+/\1[REDACTED]/Ig' \
-    -e 's/(Bearer[[:space:]]+)[A-Za-z0-9._~+\/=-]+/\1[REDACTED]/Ig' \
-    -e 's/gh[opusr]_[A-Za-z0-9_]+/[REDACTED_GITHUB_TOKEN]/g' \
-    -e 's/github_pat_[A-Za-z0-9_]+/[REDACTED_GITHUB_TOKEN]/g'
-}
+api_forward_log="${work_dir}/api-port-forward.log"
+api_token_file="${work_dir}/api-token"
+api_auth_header_file="${work_dir}/api-auth-header"
+kubeconfig_file="${work_dir}/kubeconfig"
+kind_lock_dir=""
+registry_owner="security-scan-e2e-${e2e_run_id}"
 
 run() {
   printf '+ ' >&2
@@ -84,88 +82,53 @@ run_redacted() {
 
 restore_manager_kustomization() {
   if [[ -f "${manager_kustomization_backup}" ]]; then
-    cp "${manager_kustomization_backup}" "${manager_kustomization}" || true
-  fi
-}
-
-cleanup_port_forward() {
-  if [[ -n "${api_pf_pid}" ]]; then
-    kill "${api_pf_pid}" >/dev/null 2>&1 || true
-    wait "${api_pf_pid}" 2>/dev/null || true
-    api_pf_pid=""
+    cp "${manager_kustomization_backup}" "${manager_kustomization}"
   fi
 }
 
-dump_diagnostics() {
-  log "Collecting diagnostics"
-  {
-    echo "=== Current Kubernetes Context ==="
-    kubectl config current-context 2>/dev/null || true
-    echo
-    echo "=== Orka Namespace Resources ==="
-    kubectl -n "${orka_namespace}" get pods,svc,deploy,jobs -o wide 2>/dev/null || true
-    echo
-    echo "=== Test Namespace Security Resources ==="
-    kubectl -n "${test_namespace}" get agents,repositoryscans,tasks,jobs,pods -o wide 2>/dev/null || true
-    echo
-    echo "=== RepositoryScan YAML ==="
-    kubectl -n "${test_namespace}" get repositoryscan "${scan_name}" "${bad_scan_name}" -o yaml 2>/dev/null || true
-    echo
-    echo "=== Security Tasks YAML ==="
-    kubectl -n "${test_namespace}" get tasks \
-      -l "orka.ai/security-target" \
-      -o yaml 2>/dev/null || true
-    echo
-    echo "=== Controller Logs ==="
-    kubectl -n "${orka_namespace}" logs deployment/"${orka_controller_deployment}" -c manager --tail=500 2>/dev/null || true
-    echo
-    echo "=== Worker Logs ==="
-    for job in $(kubectl -n "${test_namespace}" get jobs -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' 2>/dev/null || true); do
-      echo "--- job/${job} ---"
-      kubectl -n "${test_namespace}" logs "job/${job}" --all-containers --tail=300 --prefix 2>/dev/null || true
-    done
-    echo
-    echo "=== API Port-forward Log ==="
-    if [[ -f "${api_pf_log}" ]]; then
-      cat "${api_pf_log}" 2>/dev/null || true
-    fi
-    if [[ -n "${api_base}" && -n "${api_token}" ]]; then
-      echo
-      echo "=== Security API Snapshot ==="
-      curl -fsS -H "Authorization: Bearer ${api_token}" \
-        "${api_base}/api/v1/security/repositories/${scan_name}/scans?namespace=${test_namespace}&limit=10" 2>/dev/null || true
-      echo
-      curl -fsS -H "Authorization: Bearer ${api_token}" \
-        "${api_base}/api/v1/security/repositories/${scan_name}/findings?namespace=${test_namespace}&limit=50" 2>/dev/null || true
-      echo
-      curl -fsS -H "Authorization: Bearer ${api_token}" \
-        "${api_base}/api/v1/security/repositories/${scan_name}/dropped-findings?namespace=${test_namespace}&limit=50" 2>/dev/null || true
-      echo
-    fi
-  } 2>&1 | redact >&2
-}
-
 on_exit() {
   local status="$1"
+  local cleanup_status=0
   set +e
-  if [[ "${status}" -ne 0 ]]; then
-    if [[ "$(kubectl config current-context 2>/dev/null || true)" == "kind-${kind_cluster}" ]]; then
-      dump_diagnostics
-    else
-      warn "skipping Kubernetes diagnostics because the current context is not kind-${kind_cluster}"
+  stop_api_forward
+  if [[ "$(kubectl config current-context 2>/dev/null || true)" == "kind-${kind_cluster}" ]]; then
+    kubectl -n "${test_namespace}" delete serviceaccount "${api_identity_name}" \
+      --ignore-not-found=true --wait=false >/dev/null 2>&1 || cleanup_status=1
+    kubectl -n "${test_namespace}" delete role "${api_identity_name}" \
+      --ignore-not-found=true --wait=false >/dev/null 2>&1 || cleanup_status=1
+    kubectl -n "${test_namespace}" delete rolebinding "${api_identity_name}" \
+      --ignore-not-found=true --wait=false >/dev/null 2>&1 || cleanup_status=1
+  fi
+  restore_manager_kustomization || cleanup_status=1
+  if [[ "${registry_cleanup_armed}" == "1" ]]; then
+    orka_kind_registry_stop "${kind_cluster}" "${registry_owner}" || cleanup_status=1
+  fi
+  if [[ "${kind_cleanup_armed}" == "1" ]]; then
+    kind delete cluster --name "${kind_cluster}" >/dev/null 2>&1 || cleanup_status=1
+    if kind_cluster_exists; then
+      cleanup_status=1
     fi
   fi
-  cleanup_port_forward
-  restore_manager_kustomization
-  if [[ "${created_kind_cluster}" == "1" && "${keep_cluster}" != "1" ]]; then
-    kind delete cluster --name "${kind_cluster}" >/dev/null 2>&1 || true
-  elif [[ "${keep_cluster}" == "1" ]]; then
-    log "KEEP_CLUSTER=1, leaving kind cluster ${kind_cluster}"
+  rm -rf "${work_dir}" >/dev/null 2>&1 || cleanup_status=1
+  if [[ "${kind_lock_held}" == "1" ]]; then
+    rmdir "${kind_lock_dir}" >/dev/null 2>&1 || cleanup_status=1
+    [[ ! -e "${kind_lock_dir}" ]] || cleanup_status=1
   fi
-  rm -rf "${work_dir}" >/dev/null 2>&1 || true
   if [[ "${status}" -ne 0 ]]; then
     log "Security scan e2e failed"
   fi
+  status="$(security_scan_exit_status "${status}" "${cleanup_status}")"
+  return "${status}"
+}
+
+security_scan_exit_status() {
+  local original_status="$1"
+  local cleanup_status="$2"
+  if [[ "${original_status}" -ne 0 ]]; then
+    printf '%s\n' "${original_status}"
+  else
+    printf '%s\n' "${cleanup_status}"
+  fi
 }
 
 duration_to_seconds() {
@@ -198,12 +161,6 @@ duration_to_seconds() {
   printf '%s\n' "${total}"
 }
 
-api_token_duration() {
-  local timeout_seconds
-  timeout_seconds="$(duration_to_seconds "${wait_timeout}")"
-  printf '%ss\n' "$((timeout_seconds * 4 + 600))"
-}
-
 kind_cluster_exists() {
   kind get clusters | grep -Fxq "${kind_cluster}"
 }
@@ -219,8 +176,7 @@ YAML
 
 setup_kind_cluster() {
   if kind_cluster_exists; then
-    log "Kind cluster ${kind_cluster} already exists; reusing it"
-    return
+    die "refusing to reuse existing Kind cluster ${kind_cluster}"
   fi
 
   if [[ -z "${ORKA_SECURITY_SCAN_KIND_CONFIG:-}" ]]; then
@@ -229,304 +185,160 @@ setup_kind_cluster() {
   [[ -f "${kind_config}" ]] || die "Kind config not found: ${kind_config}"
 
   log "Creating Kind cluster ${kind_cluster}"
-  run kind create cluster --name "${kind_cluster}" --config "${kind_config}"
-  created_kind_cluster="1"
+  if ! run kind create cluster --name "${kind_cluster}" --config "${kind_config}" --kubeconfig "${kubeconfig_file}"; then
+    return 1
+  fi
+  kind_cleanup_armed="1"
+}
+
+initialize_isolated_kubeconfig() {
+  : >"${kubeconfig_file}"
+  chmod 600 "${kubeconfig_file}"
+  export KUBECONFIG="${kubeconfig_file}"
+}
+
+acquire_kind_cluster_lock() {
+  kind_lock_dir="${TMPDIR:-/tmp}/orka-security-scan-kind-${kind_cluster}.lock"
+  mkdir "${kind_lock_dir}" 2>/dev/null || die "another SecurityScan gate owns Kind cluster ${kind_cluster}"
+  kind_lock_held="1"
 }
 
-start_port_forward() {
-  local namespace_arg="$1"
-  local resource="$2"
-  local local_port="$3"
-  local remote_port="$4"
-  local logfile="$5"
+stop_api_forward() {
+  if [[ -z "${api_forward_pid}" ]]; then
+    return 0
+  fi
+  if kill -0 "${api_forward_pid}" >/dev/null 2>&1; then
+    kill "${api_forward_pid}" >/dev/null 2>&1 || true
+    wait "${api_forward_pid}" >/dev/null 2>&1 || true
+  fi
+  api_forward_pid=""
+}
 
-  kubectl -n "${namespace_arg}" port-forward "${resource}" "${local_port}:${remote_port}" >>"${logfile}" 2>&1 &
-  echo $!
+api_health_ready() {
+  curl --fail --silent --show-error --max-time 2 \
+    "http://127.0.0.1:${api_local_port}/healthz" >/dev/null
 }
 
-wait_for_http() {
-  local url="$1"
-  local description="$2"
-  local attempts_remaining=90
+start_api_forward() {
+  stop_api_forward
+  : >"${api_forward_log}"
+  kubectl -n "${orka_namespace}" port-forward service/orka-api \
+    "${api_local_port}:8080" >"${api_forward_log}" 2>&1 &
+  api_forward_pid="$!"
 
-  while (( attempts_remaining > 0 )); do
-    if curl -fsS --connect-timeout 5 --max-time 10 "${url}" >/dev/null 2>&1; then
+  local deadline=$((SECONDS + 60))
+  while (( SECONDS < deadline )); do
+    if api_health_ready; then
       return 0
     fi
-    if [[ -n "${api_pf_pid}" ]] && ! kill -0 "${api_pf_pid}" 2>/dev/null; then
-      warn "API port-forward exited while waiting for ${description}; restarting"
-      wait "${api_pf_pid}" 2>/dev/null || true
-      api_pf_pid="$(start_port_forward "${orka_namespace}" "svc/${orka_api_service}" "${orka_api_local_port}" "${orka_api_service_port}" "${api_pf_log}")"
+    if ! kill -0 "${api_forward_pid}" >/dev/null 2>&1; then
+      break
     fi
-    attempts_remaining=$((attempts_remaining - 1))
-    sleep 2
+    sleep 1
   done
-
-  die "${description} never became available at ${url}"
+  cat "${api_forward_log}" | redact >&2
+  die "controller API port-forward did not become ready"
+}
+
+create_api_identity() {
+  log "Creating namespace-scoped API identity ${api_identity_name}"
+  jq -n \
+    --arg ns "${test_namespace}" \
+    --arg name "${api_identity_name}" \
+    '{apiVersion:"v1",kind:"ServiceAccount",metadata:{name:$name,namespace:$ns}}' |
+    kubectl apply -f - >/dev/null
+  jq -n \
+    --arg ns "${test_namespace}" \
+    --arg name "${api_identity_name}" '
+    {
+      apiVersion:"rbac.authorization.k8s.io/v1",
+      kind:"Role",
+      metadata:{name:$name,namespace:$ns},
+      rules:[{
+        apiGroups:["core.orka.ai"],
+        resources:["agents","repositoryscans","tasks"],
+        verbs:["get","list","watch"]
+      }]
+    }' | kubectl apply -f - >/dev/null
+  jq -n \
+    --arg ns "${test_namespace}" \
+    --arg name "${api_identity_name}" '
+    {
+      apiVersion:"rbac.authorization.k8s.io/v1",
+      kind:"RoleBinding",
+      metadata:{name:$name,namespace:$ns},
+      subjects:[{kind:"ServiceAccount",name:$name,namespace:$ns}],
+      roleRef:{apiGroup:"rbac.authorization.k8s.io",kind:"Role",name:$name}
+    }' | kubectl apply -f - >/dev/null
+  kubectl -n "${test_namespace}" create token "${api_identity_name}" --duration=2h >"${api_token_file}"
+  chmod 600 "${api_token_file}"
+  {
+    printf 'Authorization: Bearer '
+    tr -d '\r\n' <"${api_token_file}"
+    printf '\n'
+  } >"${api_auth_header_file}"
+  chmod 600 "${api_auth_header_file}"
 }
 
-api_request() {
-  local method="$1"
-  local path="$2"
-  local output="$3"
-  shift 3
-
-  curl -fsS \
-    -X "${method}" \
-    -H "Authorization: Bearer ${api_token}" \
-    "$@" \
-    "${api_base}${path}" >"${output}"
-}
+api_get() {
+  local path="$1"
+  local output_file="$2"
+  local error_file="${output_file}.curl-error"
+  local status rc
 
-write_fake_codex_dockerfile() {
-  cat >"${fake_dockerfile}" <<'DOCKERFILE'
-FROM --platform=$BUILDPLATFORM golang:1.26 AS builder
+  set +e
+  status="$(curl --silent --show-error --max-time 60 \
+    --request GET \
+    --header @"${api_auth_header_file}" \
+    --output "${output_file}" \
+    --write-out '%{http_code}' \
+    "http://127.0.0.1:${api_local_port}${path}" 2>"${error_file}")"
+  rc=$?
+  set -e
+  if [[ "${rc}" -ne 0 || ! "${status}" =~ ^2[0-9][0-9]$ ]]; then
+    cat "${error_file}" | redact >&2
+    cat "${output_file}" | redact >&2
+    die "API GET ${path} failed with status ${status:-unavailable}"
+  fi
+}
 
+build_fake_runtime() {
+  local dockerfile="${work_dir}/security-scan-fake-runtime.Dockerfile"
+  cat >"${dockerfile}" <<'DOCKERFILE'
+# syntax=docker/dockerfile:1.7.1@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26.2-bookworm@sha256:47ce5636e9936b2c5cbf708925578ef386b4f8872aec74a67bd13a627d242b19 AS builder
+ARG TARGETOS
 ARG TARGETARCH
-
-WORKDIR /workspace
+WORKDIR /src
 COPY go.mod go.sum ./
-RUN go mod download
+RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked go mod download
 COPY . .
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH:-amd64} go build -a -o /out/worker ./cmd/orka-agent-harness-wrapper
-
-FROM node:22-slim
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git \
-    ca-certificates \
-    && rm -rf /var/lib/apt/lists/*
-
-RUN printf '#!/bin/sh\necho "$GIT_TOKEN"\n' > /bin/echo-token \
-    && chmod +x /bin/echo-token
-
-COPY --from=builder /out/worker /worker
-
-RUN cat > /usr/local/bin/security-scan-codex <<'NODE'
-#!/usr/bin/env node
-const fs = require('fs');
-const path = require('path');
-const childProcess = require('child_process');
-
-const artifactDir = process.env.ORKA_ARTIFACTS_DIR || '/tmp/artifacts';
-const prompt = fs.readFileSync(0, 'utf8');
-fs.mkdirSync(artifactDir, { recursive: true });
-
-function argValue(name) {
-  const index = process.argv.indexOf(name);
-  if (index >= 0 && index + 1 < process.argv.length) {
-    return process.argv[index + 1];
-  }
-  return '';
-}
-
-function writeArtifact(name, value) {
-  fs.writeFileSync(path.join(artifactDir, path.basename(name)), value);
-}
-
-function writeLastMessage(message) {
-  const outputPath = argValue('--output-last-message');
-  if (outputPath) {
-    fs.writeFileSync(outputPath, message);
-  }
-  process.stdout.write(message + '\n');
-}
-
-function git(args) {
-  try {
-    return childProcess.execFileSync('git', args, { encoding: 'utf8' }).trim();
-  } catch (_) {
-    return '';
-  }
-}
-
-function parseJSON(value, fallback) {
-  try {
-    return JSON.parse(value);
-  } catch (_) {
-    return fallback;
-  }
-}
-
-function sanitizeArtifactName(value) {
-  return String(value).replace(/[^A-Za-z0-9.-]+/g, '-').replace(/^-+|-+$/g, '') || 'artifact';
-}
-
-function readManifest(sliceID) {
-  const name = `security-review-context-${sanitizeArtifactName(sliceID)}.json`;
-  return parseJSON(fs.readFileSync(path.join(artifactDir, name), 'utf8'), null);
-}
-
-function lineInfo(content, needle) {
-  const lines = content.split(/\r?\n/);
-  const index = lines.findIndex((line) => line.includes(needle));
-  if (index < 0) {
-    throw new Error(`target line not found: ${needle}`);
-  }
-  return { line: index + 1, quote: lines[index].trim() };
-}
-
-function baseFinding(title, evidence) {
-  return {
-    title,
-    category: 'injection',
-    severity: 'high',
-    confidence: 'high',
-    triage: 'recommended',
-    evidence,
-    summary: 'The login flow passes user-controlled input into a security-sensitive sink.',
-    rootCause: 'Untrusted request data is accepted without constraining the expected primitive type or destination.',
-    reproduction: 'Submit a crafted login request that uses operator-shaped password input.',
-    remediation: 'Validate credential fields as strings and compare against stored password hashes outside the query selector.',
-    suggestedAction: 'Patch the login handler to reject non-string credentials before querying users.',
-    whyTestsDoNotAlreadyCoverThis: 'Existing tests do not exercise malicious credential object payloads.',
-    suggestedRegressionTest: 'Add a login test with an operator-shaped password that must return 401.',
-    minimumFixScope: 'routes/index.js loginHandler credential validation'
-  };
-}
-
-function emitThreatModel() {
-  const scanName = process.env.ORKA_SECURITY_REPOSITORY_SCAN || '';
-  let content;
-  if (scanName.includes('tool-transcript')) {
-    content = '# Invalid threat model\n\n<tool_call><tool_name>shell</tool_name></tool_call>\n';
-  } else {
-    content = [
-      '# nodejs-goof threat model',
-      '',
-      '- Express routes receive untrusted HTTP request bodies and query parameters.',
-      '- MongoDB and template rendering are security-sensitive trust boundaries.',
-      '- Authentication and redirect handling are in scope for review.',
-      ''
-    ].join('\n');
-  }
-  writeArtifact('security-threat-model.md', content);
-  writeLastMessage(content);
-}
-
-function emitReview() {
-  const sliceID = process.env.ORKA_SECURITY_SLICE_ID || '';
-  const rawSlice = parseJSON(process.env.ORKA_SECURITY_REVIEW_SLICE_JSON || '{}', {});
-  const ownedFiles = new Set((rawSlice.ownedFiles || []).map((file) => file.path));
-  const manifest = readManifest(sliceID);
-  if (!manifest) {
-    throw new Error(`missing review context manifest for ${sliceID}`);
-  }
-
-  const target = (manifest.includedFiles || []).find((file) => file.path === 'routes/index.js');
-  const isTargetSlice = target && ownedFiles.has('routes/index.js');
-  const findings = [];
-
-  if (isTargetSlice) {
-    const content = target.excerpt || fs.readFileSync(path.join(process.cwd(), 'routes/index.js'), 'utf8');
-    const loginQuery = lineInfo(content, 'User.find({ username: req.body.username, password: req.body.password }');
-    const validEvidence = [{
-      path: 'routes/index.js',
-      startLine: loginQuery.line,
-      endLine: loginQuery.line,
-      symbol: 'loginHandler',
-      quote: loginQuery.quote
-    }];
-
-    findings.push(baseFinding('NoSQL injection in login lookup', validEvidence));
-    findings.push(baseFinding('Traversal evidence should be rejected', [{
-      path: '../routes/index.js',
-      startLine: loginQuery.line,
-      endLine: loginQuery.line,
-      symbol: 'loginHandler',
-      quote: loginQuery.quote
-    }]));
-    findings.push(baseFinding('Evidence outside manifest should be rejected', [{
-      path: 'README.md',
-      startLine: 1,
-      endLine: 1,
-      quote: 'A vulnerable Node.js demo application'
-    }]));
-    findings.push(baseFinding('Line range outside manifest should be rejected', [{
-      path: 'routes/index.js',
-      startLine: 99999,
-      endLine: 99999,
-      symbol: 'loginHandler',
-      quote: loginQuery.quote
-    }]));
-    findings.push(baseFinding('Quote mismatch should be rejected', [{
-      path: 'routes/index.js',
-      startLine: loginQuery.line,
-      endLine: loginQuery.line,
-      symbol: 'loginHandler',
-      quote: 'this quote is deliberately absent from the cited line'
-    }]));
-  }
-
-  const artifact = {
-    schemaVersion: 2,
-    repository: {
-      repoURL: process.env.ORKA_GIT_REPO || 'https://github.com/sozercan/nodejs-goof',
-      branch: process.env.ORKA_GIT_BRANCH || 'main',
-      subPath: process.env.ORKA_WORKSPACE_SUBPATH || '',
-      baseSHA: process.env.ORKA_SECURITY_SCAN_BASE_COMMIT || '',
-      headSHA: process.env.ORKA_SECURITY_SCAN_HEAD_COMMIT || git(['rev-parse', 'HEAD'])
-    },
-    scan: {
-      mode: 'security-scan-e2e',
-      sliceId: sliceID,
-      summary: isTargetSlice ? 'reviewed target nodejs-goof route slice' : 'reviewed non-target slice'
-    },
-    findings
-  };
-
-  writeArtifact('security-findings.v2.json', JSON.stringify(artifact, null, 2) + '\n');
-  writeLastMessage(`security review artifact written for ${sliceID} with ${findings.length} findings`);
-}
-
-function emitValidation() {
-  const findingID = process.env.ORKA_SECURITY_FINDING_ID || 'unknown';
-  writeArtifact('security-validation.json', JSON.stringify({
-    version: 1,
-    finding_id: findingID,
-    status: 'validated',
-    summary: 'deterministic validation placeholder for security-scan e2e',
-    validation_steps: ['inspected deterministic fixture evidence'],
-    evidence: []
-  }, null, 2) + '\n');
-  writeLastMessage(`security validation artifact written for ${findingID}`);
-}
-
-function main() {
-  let stage = process.env.ORKA_SECURITY_STAGE || '';
-  if (!stage && /^REQUIRED_SECURITY_ARTIFACTS:.*\bsecurity-threat-model\.md\b/m.test(prompt)) {
-    stage = 'threat-model';
-  }
-  if (stage === 'threat-model') {
-    emitThreatModel();
-    return;
-  }
-  if (stage === 'review') {
-    emitReview();
-    return;
-  }
-  if (stage === 'validation') {
-    emitValidation();
-    return;
-  }
-  writeLastMessage(`security-scan fake codex no-op for stage ${stage || '<unset>'}`);
-}
-
-main();
-NODE
-
-RUN chmod 0755 /usr/local/bin/security-scan-codex \
-    && ln -sf /usr/local/bin/security-scan-codex /usr/local/bin/codex \
-    && mkdir -p /workspace /home/node /tmp \
-    && ln -s /home/node /home/worker \
-    && chown -R 1000:1000 /workspace /home/node /tmp
-
-USER 1000:1000
-ENV HOME=/home/worker
-ENV CODEX_CLI_PATH=/usr/local/bin/security-scan-codex
-
-ENTRYPOINT ["/worker"]
+RUN set -eu; \
+    CGO_ENABLED=0 GOOS="$TARGETOS" GOARCH="$TARGETARCH" go build -buildvcs=false -trimpath -ldflags='-s -w' -o /out/orka-acp-runtime ./cmd/orka-acp-runtime; \
+    CGO_ENABLED=0 GOOS="$TARGETOS" GOARCH="$TARGETARCH" go build -buildvcs=false -trimpath -ldflags='-s -w' -o /out/orka-acp-exec-helper ./cmd/orka-acp-exec-helper; \
+    CGO_ENABLED=0 GOOS="$TARGETOS" GOARCH="$TARGETARCH" go build -buildvcs=false -trimpath -ldflags='-s -w' -o /out/node ./scripts/fixtures/security-scan-fake-acp
+
+FROM --platform=$TARGETPLATFORM docker.io/library/debian:trixie-slim@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd
+LABEL org.opencontainers.image.title="Orka SecurityScan deterministic ACP fixture" \
+      io.orka.test.fixture="security-scan-harness-v2"
+ENV HOME=/root \
+    ORKA_ACP_PROVIDER=codex \
+    PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+RUN set -eu; \
+    mkdir -p /sessions /opt/codex-acp/dist; \
+    chmod 0711 /sessions
+COPY --from=builder /out/orka-acp-runtime /usr/local/bin/orka-acp-runtime
+COPY --from=builder /out/orka-acp-exec-helper /usr/local/bin/orka-acp-exec-helper
+COPY --from=builder /out/node /usr/bin/node
+WORKDIR /
+USER 0:0
+EXPOSE 8080
+STOPSIGNAL SIGTERM
+ENTRYPOINT ["/usr/local/bin/orka-acp-runtime"]
 DOCKERFILE
+
+  log "Building deterministic ACP v2 runtime ${fake_runtime_image}"
+  run docker build -t "${fake_runtime_image}" -f "${dockerfile}" .
 }
 
 patch_controller_images() {
@@ -536,7 +348,6 @@ patch_controller_images() {
   log "Configuring Orka controller worker images"
   kubectl -n "${orka_namespace}" get deployment "${orka_controller_deployment}" -o json |
     jq \
-      --arg codexImage "${fake_codex_image}" \
       --arg generalImage "${general_worker_image}" \
       --arg rolloutID "${rollout_id}" '
       def upsert_arg($name; $value):
@@ -558,10 +369,6 @@ patch_controller_images() {
       )
     ' | kubectl apply -f -
 
-  if kubectl -n "${orka_namespace}" get deployment "${orka_harness_wrapper_deployment}" >/dev/null 2>&1; then
-    run kubectl -n "${orka_namespace}" set image deployment/"${orka_harness_wrapper_deployment}" "wrapper=${fake_codex_image}"
-    run kubectl -n "${orka_namespace}" rollout status deployment/"${orka_harness_wrapper_deployment}" --timeout=5m
-  fi
   run kubectl -n "${orka_namespace}" rollout status deployment/"${orka_controller_deployment}" --timeout=5m
 }
 
@@ -580,7 +387,7 @@ reset_e2e_resources() {
 }
 
 apply_agent() {
-  log "Creating fake Codex runtime Agent ${agent_name}"
+  log "Creating ACP Codex Agent fixture ${agent_name}"
   kubectl apply -f - <<YAML
 apiVersion: core.orka.ai/v1alpha1
 kind: Agent
@@ -589,11 +396,12 @@ metadata:
   namespace: ${test_namespace}
 spec:
   runtime:
+    contractVersion: orka.harness.v2
     type: codex
     defaultMaxTurns: 1
     defaultAllowBash: true
   model:
-    name: fake-security-scan-analyzer
+    name: gpt-5.4
 YAML
 }
 
@@ -609,8 +417,8 @@ metadata:
 spec:
   provider: github
   repoURL: ${target_repo}
-  owner: sozercan
-  repository: nodejs-goof
+  owner: ${target_owner}
+  repository: ${target_repository}
   branch: ${target_branch}
   ref: ${target_ref}
   validationMode: "off"
@@ -639,141 +447,211 @@ wait_repo_phase() {
   die "RepositoryScan/${name} did not reach phase ${expected}; current phase ${phase:-<empty>}"
 }
 
-scan_runs_file() {
-  local name="$1"
-  local output="$2"
-  api_request GET "/api/v1/security/repositories/${name}/scans?namespace=${test_namespace}&limit=20" "${output}"
-}
-
-wait_latest_run_phase() {
+collect_scan_evidence() {
   local name="$1"
-  local expected="$2"
-  local timeout_seconds
-  timeout_seconds="$(duration_to_seconds "${wait_timeout}")"
-  local deadline=$((SECONDS + timeout_seconds))
-  local output="${work_dir}/runs-${name}.json"
-  local phase run_id
-
-  log "Waiting for latest scan run on ${name} to become ${expected}"
-  while (( SECONDS < deadline )); do
-    if scan_runs_file "${name}" "${output}" &&
-      [[ "$(jq '.items | length' "${output}")" -gt 0 ]]; then
-      phase="$(jq -r '.items[0].phase // ""' "${output}")"
-      run_id="$(jq -r '.items[0].id // ""' "${output}")"
-      if [[ "${phase}" == "${expected}" ]]; then
-        log "scan run ${run_id}: ${phase}"
-        return 0
-      fi
-      if [[ "${phase}" == "failed" && "${expected}" != "failed" ]]; then
-        jq -c '.items[0]' "${output}" >&2
-        die "latest scan run ${run_id} failed while waiting for ${expected}"
-      fi
-    fi
-    sleep 5
-  done
-
-  scan_runs_file "${name}" "${output}" || true
-  jq -c '.items[0] // {}' "${output}" >&2 || true
-  die "latest scan run for ${name} did not reach phase ${expected}"
-}
-
-wait_run_phase_by_id() {
-  local name="$1"
-  local run_id="$2"
-  local expected="$3"
-  local timeout_seconds
-  timeout_seconds="$(duration_to_seconds "${wait_timeout}")"
-  local deadline=$((SECONDS + timeout_seconds))
-  local output="${work_dir}/runs-${name}-${run_id}.json"
-  local phase
-
-  log "Waiting for scan run ${run_id} on ${name} to become ${expected}"
-  while (( SECONDS < deadline )); do
-    scan_runs_file "${name}" "${output}" || true
-    phase="$(jq -r --arg id "${run_id}" '.items[]? | select(.id == $id) | .phase' "${output}" | head -n1)"
-    if [[ "${phase}" == "${expected}" ]]; then
-      return 0
-    fi
-    if [[ "${phase}" == "failed" && "${expected}" != "failed" ]]; then
-      jq -c --arg id "${run_id}" '.items[]? | select(.id == $id)' "${output}" >&2
-      die "scan run ${run_id} failed while waiting for ${expected}"
-    fi
-    sleep 5
-  done
-
-  scan_runs_file "${name}" "${output}" || true
-  jq -c --arg id "${run_id}" '.items[]? | select(.id == $id)' "${output}" >&2 || true
-  die "scan run ${run_id} did not reach phase ${expected}"
+  local prefix="$2"
+  run kubectl -n "${test_namespace}" get repositoryscan "${name}" -o json >"${prefix}-scan.json"
+  run kubectl -n "${test_namespace}" get tasks -l "orka.ai/security-target=${name}" -o json >"${prefix}-tasks.json"
+  api_get "/api/v1/security/repositories/${name}/scans?namespace=${test_namespace}&limit=100" "${prefix}-runs.json"
+  api_get "/api/v1/security/repositories/${name}/slices?namespace=${test_namespace}&limit=1000" "${prefix}-slices.json"
+  api_get "/api/v1/security/repositories/${name}/findings?namespace=${test_namespace}&limit=1000" "${prefix}-findings.json"
+  api_get "/api/v1/security/repositories/${name}/dropped-findings?namespace=${test_namespace}&limit=1000" "${prefix}-dropped.json"
+}
+
+assert_positive_scan_snapshot() {
+  local prefix="$1"
+  if ! jq -e \
+    --arg agent "${agent_name}" \
+    --arg branch "${target_branch}" \
+    --arg ref "${target_ref}" \
+    --arg repo "${target_repo}" \
+    --arg scanName "${scan_name}" \
+    --slurpfile tasks "${prefix}-tasks.json" \
+    --slurpfile runs "${prefix}-runs.json" \
+    --slurpfile slices "${prefix}-slices.json" \
+    --slurpfile findings "${prefix}-findings.json" \
+    --slurpfile dropped "${prefix}-dropped.json" '
+    .status.lastScanID as $scanID |
+    ($tasks[0].items | map(select(.metadata.labels["orka.ai/security-scan-id"] == $scanID))) as $runTasks |
+    ($runTasks | map(select(.metadata.labels["orka.ai/security-stage"] == "threat-model"))) as $threatTasks |
+    ($runTasks | map(select(.metadata.labels["orka.ai/security-stage"] == "mapper"))) as $mapperTasks |
+    ($runTasks | map(select(.metadata.labels["orka.ai/security-stage"] == "review"))) as $reviewTasks |
+    ($runs[0].items | map(select(.id == $scanID))) as $runItems |
+    ($slices[0].items | map(select(.lastScanRunID == $scanID))) as $sliceItems |
+    ($findings[0].items | map(select(.scanRunID == $scanID))) as $findingItems |
+    ($dropped[0].items | map(select(.scanRunID == $scanID))) as $dropItems |
+    .status.phase == "Ready" and
+    (.status.lastScanTaskName | length > 0) and
+    (.status.lastScanAt | length > 0) and
+    (.status.lastSuccessfulScanAt | length > 0) and
+    .status.lastProcessedCommit == $ref and
+    .status.lastObservedHeadSHA == $ref and
+    (.status.threatModelVersion // 0) > 0 and
+    any(.status.conditions[]?; .type == "Ready" and .status == "True" and .reason == "ScanSucceeded") and
+    ($runItems | length) == 1 and
+    ($runItems[0] as $run |
+      $run.repositoryScan == $scanName and
+      $run.taskName == .status.lastScanTaskName and
+      $run.mode == "initial" and
+      $run.phase == "succeeded" and
+      ($run.completedAt | length > 0) and
+      ($run.policyDigest | test("^sha256:[0-9a-f]{64}$")) and
+      ($run.idempotencyKey | test("^scanidem:[0-9a-f]{64}$")) and
+      $run.sliceCount > 0 and
+      $run.reviewedSliceCount == $run.sliceCount and
+      $run.skippedSliceCount == 0 and
+      $run.acceptedFindings == ($findingItems | length) and
+      $run.droppedFindings == ($dropItems | length) and
+      $run.acceptedFindings > 0 and
+      $run.droppedFindings > 0 and
+      ($threatTasks | length) == 1 and
+      ($mapperTasks | length) == 1 and
+      ($reviewTasks | length) == $run.sliceCount
+    ) and
+    all($runTasks[];
+      .metadata.labels["orka.ai/security-target"] == $scanName and
+      .metadata.labels["orka.ai/security-scan-mode"] == "initial" and
+      any(.metadata.ownerReferences[]?; .kind == "RepositoryScan" and .name == $scanName and .controller == true) and
+      .status.phase == "Succeeded"
+    ) and
+    all(($threatTasks + $reviewTasks)[];
+      .spec.type == "agent" and
+      .spec.agentRef.name == $agent and
+      ((.spec.env // []) | length) == 0 and
+      .spec.workspace.intent == "read" and
+      .spec.workspace.gitRepo == $repo and
+      .spec.workspace.branch == $branch and
+      .spec.workspace.ref == $ref and
+      .status.resultRef.available == true and
+      .status.agentExecutionBinding.contractVersion == "orka.harness.v2" and
+      .status.agentExecutionBinding.backend == "runtime-pool" and
+      .status.execution.state == "Succeeded" and
+      .status.execution.outcome == "Succeeded" and
+      .status.delivery.state == "ReadValidated" and
+      .status.delivery.outcome == "ReadValidated"
+    ) and
+    ($mapperTasks[0].spec.type == "container") and
+    ($mapperTasks[0].spec.command == ["--security-mapper"]) and
+    (($mapperTasks[0].spec.env // []) | map(.name) | index("ORKA_SECURITY_REPOSITORY_SCAN") != null) and
+    ($sliceItems | length) == $runItems[0].sliceCount and
+    all($sliceItems[]; .status == "reviewed" and (.reviewContextHash | test("^sha256:[0-9a-f]{64}$"))) and
+    any($findingItems[]; .category == "authorization" and .severity == "high" and (.evidence | length) > 0) and
+    all($findingItems[]; .repositoryScan == $scanName and .scanRunID == $scanID and (.id | length) > 0) and
+    any($dropItems[]; .layer == "validation" and (.reason | contains("review context"))) and
+    all($dropItems[];
+      .repositoryScan == $scanName and .scanRunID == $scanID and
+      (.id | test("^drop_")) and (.taskName | length) > 0 and
+      (.sliceID | length) > 0 and (.reason | length) > 0
+    ) and
+    (.status.findingCounts.total // 0) == ($findingItems | length) and
+    (.status.findingCounts.high // 0) == ($findingItems | map(select(.severity == "high")) | length) and
+    (.status.findingCounts.critical // 0) == ($findingItems | map(select(.severity == "critical")) | length) and
+    (.status.findingCounts.medium // 0) == ($findingItems | map(select(.severity == "medium")) | length) and
+    (.status.findingCounts.low // 0) == ($findingItems | map(select(.severity == "low")) | length)
+  ' "${prefix}-scan.json" >/dev/null; then
+    die "positive SecurityScan snapshot did not satisfy the harness-v2 ingestion contract"
+  fi
 }
 
-assert_initial_scan_state() {
-  local runs="${work_dir}/runs-initial.json"
-  local slices="${work_dir}/slices.json"
-  local findings="${work_dir}/findings.json"
-  local dropped="${work_dir}/dropped.json"
-  local total
-
-  scan_runs_file "${scan_name}" "${runs}"
-  jq -e '.items[0].phase == "succeeded" and .items[0].sliceCount > 0 and .items[0].acceptedFindings == 1 and .items[0].droppedFindings >= 4' "${runs}" >/dev/null
-
-  api_request GET "/api/v1/security/repositories/${scan_name}/slices?namespace=${test_namespace}&limit=200" "${slices}"
-  jq -e '
-    (.items | length) > 0 and
-    any(.items[]; any(.ownedFiles[]?; .path == "routes/index.js"))
-  ' "${slices}" >/dev/null
-
-  api_request GET "/api/v1/security/repositories/${scan_name}/findings?namespace=${test_namespace}&limit=50" "${findings}"
-  jq -e '
-    (.items | length) == 1 and
-    .items[0].state == "open" and
-    .items[0].title == "NoSQL injection in login lookup" and
-    .items[0].filePath == "routes/index.js"
-  ' "${findings}" >/dev/null
-
-  api_request GET "/api/v1/security/repositories/${scan_name}/dropped-findings?namespace=${test_namespace}&limit=50" "${dropped}"
-  jq -e '
-    (.items | length) >= 4 and
-    ([.items[].reason] | any(.[]; contains("not repo-relative"))) and
-    ([.items[].reason] | any(.[]; contains("not included in review context"))) and
-    ([.items[].reason] | any(.[]; contains("outside included review context"))) and
-    ([.items[].reason] | any(.[]; contains("quote does not match")))
-  ' "${dropped}" >/dev/null
-
-  total="$(kubectl -n "${test_namespace}" get repositoryscan "${scan_name}" -o jsonpath='{.status.findingCounts.total}')"
-  [[ "${total}" == "1" ]] || die "RepositoryScan findingCounts.total = ${total:-<empty>}, want 1"
-
-  local threat_version
-  threat_version="$(kubectl -n "${test_namespace}" get repositoryscan "${scan_name}" -o jsonpath='{.status.threatModelVersion}')"
-  [[ "${threat_version}" =~ ^[1-9][0-9]*$ ]] || die "threatModelVersion = ${threat_version:-<empty>}, want >= 1"
-
-  local patch_tasks
-  patch_tasks="$(kubectl -n "${test_namespace}" get tasks -l "orka.ai/security-target=${scan_name},orka.ai/security-stage=patch" -o json | jq '.items | length')"
-  [[ "${patch_tasks}" == "0" ]] || die "expected no automatic patch tasks, found ${patch_tasks}"
+positive_scan_idempotency_snapshot() {
+  local prefix="$1"
+  jq -S \
+    --slurpfile tasks "${prefix}-tasks.json" \
+    --slurpfile runs "${prefix}-runs.json" \
+    --slurpfile slices "${prefix}-slices.json" \
+    --slurpfile findings "${prefix}-findings.json" \
+    --slurpfile dropped "${prefix}-dropped.json" '
+    .status.lastScanID as $scanID |
+    {
+      scanID:$scanID,
+      lastScanTaskName:.status.lastScanTaskName,
+      threatModelVersion:.status.threatModelVersion,
+      tasks:($tasks[0].items | map(select(.metadata.labels["orka.ai/security-scan-id"] == $scanID) | {
+        name:.metadata.name, stage:.metadata.labels["orka.ai/security-stage"], slice:.metadata.labels["orka.ai/security-slice-id"]
+      }) | sort_by(.name)),
+      run:($runs[0].items | map(select(.id == $scanID) | {
+        id,phase,taskName,sliceCount,reviewedSliceCount,skippedSliceCount,acceptedFindings,droppedFindings,policyDigest,idempotencyKey
+      })),
+      slices:($slices[0].items | map(select(.lastScanRunID == $scanID) | {id,status,lastScanRunID,reviewContextHash}) | sort_by(.id)),
+      findings:($findings[0].items | map(select(.scanRunID == $scanID) | .id) | sort),
+      dropped:($dropped[0].items | map(select(.scanRunID == $scanID) | .id) | sort)
+    }
+  ' "${prefix}-scan.json"
+}
+
+assert_malformed_scan_snapshot() {
+  local prefix="$1"
+  local expected="threat model terminal result is missing or invalid: security result scanId does not match task run"
+  if ! jq -e \
+    --arg agent "${agent_name}" \
+    --arg expected "${expected}" \
+    --arg scanName "${bad_scan_name}" \
+    --slurpfile tasks "${prefix}-tasks.json" \
+    --slurpfile runs "${prefix}-runs.json" \
+    --slurpfile slices "${prefix}-slices.json" \
+    --slurpfile findings "${prefix}-findings.json" \
+    --slurpfile dropped "${prefix}-dropped.json" '
+    .status.lastScanID as $scanID |
+    ($tasks[0].items | map(select(.metadata.labels["orka.ai/security-scan-id"] == $scanID))) as $runTasks |
+    ($runs[0].items | map(select(.id == $scanID))) as $runItems |
+    .status.phase == "Error" and
+    (.status.lastScanTaskName | length > 0) and
+    (.status.lastScanAt | length > 0) and
+    (.status | has("lastSuccessfulScanAt") | not) and
+    (.status.threatModelVersion // 0) == 0 and
+    (.status.findingCounts.total // 0) == 0 and
+    any(.status.conditions[]?;
+      .type == "Ready" and .status == "False" and .reason == "ScanFailed" and (.message | startswith($expected))
+    ) and
+    ($runTasks | length) == 1 and
+    ($runTasks[0] as $task |
+      $task.metadata.labels["orka.ai/security-stage"] == "threat-model" and
+      $task.spec.type == "agent" and $task.spec.agentRef.name == $agent and
+      (($task.spec.env // []) | length) == 0 and
+      $task.status.phase == "Succeeded" and $task.status.resultRef.available == true and
+      $task.status.agentExecutionBinding.contractVersion == "orka.harness.v2" and
+      $task.status.agentExecutionBinding.backend == "runtime-pool" and
+      $task.status.execution.outcome == "Succeeded" and
+      $task.status.delivery.outcome == "ReadValidated"
+    ) and
+    ($runItems | length) == 1 and
+    $runItems[0].phase == "failed" and
+    ($runItems[0].errorMessage | startswith($expected)) and
+    $runItems[0].sliceCount == 0 and $runItems[0].acceptedFindings == 0 and $runItems[0].droppedFindings == 0 and
+    ($slices[0].items | length) == 0 and
+    ($findings[0].items | length) == 0 and
+    ($dropped[0].items | length) == 0
+  ' "${prefix}-scan.json" >/dev/null; then
+    die "malformed SecurityScan result did not fail closed after successful ACP execution"
+  fi
 }
 
-assert_idempotent_manual_scan() {
-  local response="${work_dir}/manual-scan.json"
-  local findings="${work_dir}/findings-after-manual.json"
-  local run_id count
-
-  log "Triggering manual scan for idempotency"
-  api_request POST "/api/v1/security/repositories/${scan_name}/scans?namespace=${test_namespace}" "${response}"
-  run_id="$(jq -r '.id' "${response}")"
-  [[ -n "${run_id}" && "${run_id}" != "null" ]] || die "manual scan response did not include id"
-  wait_run_phase_by_id "${scan_name}" "${run_id}" "succeeded"
+assert_positive_scan_gate() {
+  local before="${work_dir}/${scan_name}-before"
+  local after="${work_dir}/${scan_name}-after"
+  collect_scan_evidence "${scan_name}" "${before}"
+  api_get "/api/v1/security/repositories/${scan_name}/threat-model?namespace=${test_namespace}" "${before}-threat-model.json"
+  assert_positive_scan_snapshot "${before}"
+  jq -e --slurpfile scan "${before}-scan.json" '
+    .source == "generated" and .generatedByScan == $scan[0].status.lastScanID and
+    .version == $scan[0].status.threatModelVersion and (.content | startswith("#"))
+  ' "${before}-threat-model.json" >/dev/null || die "generated threat model was not durably ingested"
+  positive_scan_idempotency_snapshot "${before}" >"${work_dir}/positive-before.json"
+
+  run kubectl -n "${test_namespace}" annotate repositoryscan "${scan_name}" \
+    "orka.ai/security-scan-e2e-reconcile=${e2e_run_id}" --overwrite
   wait_repo_phase "${scan_name}" "Ready"
-
-  api_request GET "/api/v1/security/repositories/${scan_name}/findings?namespace=${test_namespace}&limit=50" "${findings}"
-  count="$(jq '.items | length' "${findings}")"
-  [[ "${count}" == "1" ]] || die "manual rescan produced ${count} findings, want 1"
+  collect_scan_evidence "${scan_name}" "${after}"
+  assert_positive_scan_snapshot "${after}"
+  positive_scan_idempotency_snapshot "${after}" >"${work_dir}/positive-after.json"
+  cmp -s "${work_dir}/positive-before.json" "${work_dir}/positive-after.json" ||
+    die "RepositoryScan reconciliation changed durable run, task, finding, slice, or drop identities"
 }
 
-assert_bad_threat_model_rejected() {
-  local runs="${work_dir}/runs-bad-threat.json"
-  wait_latest_run_phase "${bad_scan_name}" "failed"
-  wait_repo_phase "${bad_scan_name}" "Error"
-  scan_runs_file "${bad_scan_name}" "${runs}"
-  jq -e '.items[0].errorMessage | contains("looks like tool transcript")' "${runs}" >/dev/null
+assert_malformed_result_gate() {
+  local prefix="${work_dir}/${bad_scan_name}"
+  collect_scan_evidence "${bad_scan_name}" "${prefix}"
+  assert_malformed_scan_snapshot "${prefix}"
 }
 
 main() {
@@ -782,59 +660,84 @@ main() {
   require_cmd docker
   require_cmd kind
   require_cmd kubectl
-  require_cmd curl
   require_cmd jq
+  require_cmd openssl
+  require_cmd curl
+  require_cmd cmp
+
+  [[ "${orka_namespace}" == "orka-system" ]] || die "ORKA_NAMESPACE must be orka-system for the canonical make deploy path"
+  [[ "${test_namespace}" == "${orka_namespace}" ]] || die "ORKA_SECURITY_SCAN_E2E_NAMESPACE must match ORKA_NAMESPACE for an isolated controller"
+  [[ "${keep_cluster}" == "0" ]] || die "KEEP_CLUSTER is forbidden for the isolated SecurityScan gate"
+  [[ "${kind_cluster}" =~ ^[a-z0-9][a-z0-9.-]{0,62}$ ]] || die "KIND_CLUSTER must be a valid lowercase Kind cluster name of at most 63 characters"
 
   cd "${repo_root}"
+  initialize_isolated_kubeconfig
   [[ -f "${manager_kustomization}" ]] || die "missing ${manager_kustomization}"
   cp "${manager_kustomization}" "${manager_kustomization_backup}"
 
-  trap 'status=$?; on_exit "${status}"; exit "${status}"' EXIT
-
+  acquire_kind_cluster_lock
   setup_kind_cluster
   run kubectl config use-context "kind-${kind_cluster}"
+  log "Installing current Orka CRDs into the test cluster"
+  run make install
+  log "Creating the Vekil namespace required by the production ingress policy"
+  kubectl create namespace vekil-system --dry-run=client -o yaml | kubectl apply -f -
+  registry_cleanup_armed="1"
+  orka_kind_registry_start "${kind_cluster}" "${registry_owner}"
 
   log "Building manager image ${manager_image}"
   run make docker-build IMG="${manager_image}"
+  log "Building workspace publisher image ${publisher_image}"
+  run make docker-build-workspace-publisher WORKSPACE_PUBLISHER_IMG="${publisher_image}"
 
   log "Building general worker image ${general_worker_image}"
   run docker build -t "${general_worker_image}" -f workers/general/Dockerfile .
-
-  write_fake_codex_dockerfile
-  log "Building fake Codex worker image ${fake_codex_image}"
-  run docker build -t "${fake_codex_image}" -f "${fake_dockerfile}" .
+  build_fake_runtime
 
   log "Loading images into Kind cluster ${kind_cluster}"
   run kind load docker-image "${manager_image}" --name "${kind_cluster}"
   run kind load docker-image "${general_worker_image}" --name "${kind_cluster}"
-  run kind load docker-image "${fake_codex_image}" --name "${kind_cluster}"
 
-  log "Deploying Orka manager"
-  run make deploy IMG="${manager_image}"
+  local manager_ref publisher_ref fake_runtime_ref
+  manager_ref="$(orka_kind_registry_push "${manager_image}" "orka/controller")"
+  publisher_ref="$(orka_kind_registry_push "${publisher_image}" "orka/workspace-publisher")"
+  fake_runtime_ref="$(orka_kind_registry_push "${fake_runtime_image}" "orka/acp-security-fixture")"
+
+  log "Bootstrapping test-only admission TLS"
+  orka_e2e_bootstrap_admission_tls
+
+  log "Deploying Orka manager with the deterministic digest-pinned ACP v2 fixture"
+  local placeholder_digest
+  placeholder_digest="sha256:$(printf '0%.0s' {1..64})"
+  run make deploy \
+    IMG="${manager_ref}" \
+    WORKSPACE_PUBLISHER_IMG="${publisher_ref}" \
+    ACP_CODEX_RUNTIME_IMG="${fake_runtime_ref}" \
+    ACP_CLAUDE_RUNTIME_IMG="example.invalid/orka/acp-claude@${placeholder_digest}" \
+    ACP_COPILOT_RUNTIME_IMG="example.invalid/orka/acp-copilot@${placeholder_digest}" \
+    ACP_OPENCODE_RUNTIME_IMG="example.invalid/orka/acp-opencode@${placeholder_digest}"
   run kubectl wait --for=condition=Established crd/repositoryscans.core.orka.ai --timeout=60s
   run kubectl -n "${orka_namespace}" rollout status deployment/"${orka_controller_deployment}" --timeout=5m
   patch_controller_images
-
-  log "Port-forwarding Orka API service"
-  api_pf_pid="$(start_port_forward "${orka_namespace}" "svc/${orka_api_service}" "${orka_api_local_port}" "${orka_api_service_port}" "${api_pf_log}")"
-  api_base="http://127.0.0.1:${orka_api_local_port}"
-  wait_for_http "${api_base}/readyz" "Orka API /readyz"
-  api_token="$(kubectl -n "${orka_namespace}" create token orka-controller-manager --duration="$(api_token_duration)")"
-  [[ -n "${api_token}" ]] || die "failed to create Orka API token"
+  create_api_identity
+  start_api_forward
 
   reset_e2e_resources
   apply_agent
 
   apply_repository_scan "${scan_name}"
-  wait_latest_run_phase "${scan_name}" "succeeded"
   wait_repo_phase "${scan_name}" "Ready"
-  assert_initial_scan_state
-  assert_idempotent_manual_scan
+  log "Verifying positive harness-v2 execution and durable ResultStore ingestion"
+  assert_positive_scan_gate
 
   apply_repository_scan "${bad_scan_name}"
-  assert_bad_threat_model_rejected
-
-  log "Security scan E2E passed"
+  wait_repo_phase "${bad_scan_name}" "Error"
+  log "Verifying malformed terminal results fail closed after successful ACP execution"
+  assert_malformed_result_gate
+  log "SecurityScan harness-v2 execution, ingestion, idempotency, and malformed-result gates passed"
 }
 
-main "$@"
+if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
+  trap 'status=$?; set +e; on_exit "${status}"; exit $?' EXIT
+  main "$@"
+fi
diff --git a/scripts/static-mode-crd-validate.sh b/scripts/static-mode-crd-validate.sh
new file mode 100755
index 000000000..3029572c0
--- /dev/null
+++ b/scripts/static-mode-crd-validate.sh
@@ -0,0 +1,348 @@
+#!/usr/bin/env bash
+# Validates the shared harness v1/v2 CRDs against a live cluster:
+# both-baseline object acceptance, discriminator CEL, contract immutability,
+# legacy-surface ratcheting, and static-mode Task binding invariants. The CRDs
+# from config/crd/bases must already be applied and Established by their one
+# designated platform owner.
+#
+# Usage: KUBECTL="kubectl" scripts/static-mode-crd-validate.sh
+set -euo pipefail
+
+KUBECTL=${KUBECTL:-kubectl}
+NAMESPACE=${NAMESPACE:-static-mode-crd-validate}
+ZERO_DIGEST="sha256:0000000000000000000000000000000000000000000000000000000000000000"
+FAILURES=0
+
+k() {
+  # shellcheck disable=SC2086
+  ${KUBECTL} "$@"
+}
+
+pass() { printf 'ok      %s\n' "$1"; }
+fail() {
+  printf 'FAILED  %s\n' "$1" >&2
+  FAILURES=$((FAILURES + 1))
+}
+
+# expect_accept <description> — applies stdin, expecting success.
+expect_accept() {
+  local description="$1"
+  if k apply -f - >/dev/null 2>&1; then
+    pass "${description}"
+  else
+    fail "${description} (expected acceptance)"
+  fi
+}
+
+# expect_reject <description> <message-fragment> — applies stdin, expecting a
+# rejection whose error mentions the fragment.
+expect_reject() {
+  local description="$1" fragment="$2" output
+  if output=$(k apply -f - 2>&1); then
+    fail "${description} (expected rejection, got acceptance)"
+    return
+  fi
+  if [[ "${output}" != *"${fragment}"* ]]; then
+    fail "${description} (rejected for the wrong reason: ${output})"
+    return
+  fi
+  pass "${description}"
+}
+
+# expect_status_patch <accept|reject> <description> <kind/name> <merge-patch> [fragment]
+expect_status_patch() {
+  local mode="$1" description="$2" target="$3" patch="$4" fragment="${5:-}" output
+  if output=$(k -n "${NAMESPACE}" patch "${target}" --subresource=status --type=merge -p "${patch}" 2>&1); then
+    if [[ "${mode}" == accept ]]; then pass "${description}"; else fail "${description} (expected rejection, got acceptance)"; fi
+    return
+  fi
+  if [[ "${mode}" == reject ]]; then
+    if [[ -n "${fragment}" && "${output}" != *"${fragment}"* ]]; then
+      fail "${description} (rejected for the wrong reason: ${output})"
+    else
+      pass "${description}"
+    fi
+  else
+    fail "${description} (expected acceptance: ${output})"
+  fi
+}
+
+for removed_crd in \
+  agentexecutioncontrols.core.orka.ai \
+  agentexecutionpolicies.core.orka.ai \
+  agentexecutionadjudications.core.orka.ai; do
+  if k get crd "${removed_crd}" >/dev/null 2>&1; then
+    fail "superseded coexistence CRD is absent: ${removed_crd}"
+  else
+    pass "superseded coexistence CRD is absent: ${removed_crd}"
+  fi
+done
+
+k create namespace "${NAMESPACE}" --dry-run=client -o yaml | k apply -f - >/dev/null
+cleanup() { k delete namespace "${NAMESPACE}" --ignore-not-found --wait=false >/dev/null 2>&1 || true; }
+trap cleanup EXIT
+
+echo "== AgentRuntime discriminated union =="
+
+expect_accept "stored v1 AgentRuntime shape is accepted" <<EOF
+apiVersion: core.orka.ai/v1alpha1
+kind: AgentRuntime
+metadata: {name: v1-runtime, namespace: ${NAMESPACE}}
+spec:
+  contractVersion: orka.harness.v1
+  deployment: {mode: external-endpoint, endpoint: "https://harness.example.com"}
+  clientAuth:
+    bearerTokenSecretRef: {name: harness-auth, key: token}
+  capabilities:
+    toolExecutionModes: [observed, brokered]
+    brokeredToolClasses: [read]
+    supportsCancel: true
+EOF
+
+expect_accept "v2 AgentRuntime shape is accepted" <<EOF
+apiVersion: core.orka.ai/v1alpha1
+kind: AgentRuntime
+metadata: {name: v2-runtime, namespace: ${NAMESPACE}}
+spec:
+  contractVersion: orka.harness.v2
+  deployment: {mode: external-endpoint, endpoint: "https://runtime.example.com"}
+  clientAuth:
+    controllerBearerTokenSecretRef: {name: auth, key: controller}
+    operationCapabilitySecretRef: {name: auth, key: capability}
+  capabilities:
+    runtimeInstanceID: instance-1
+    profile:
+      digest: ${ZERO_DIGEST}
+      digestSchemaVersion: 1
+      acpProfile: acp.v1
+      adapterName: adapter
+      adapterDigest: ${ZERO_DIGEST}
+      providerKind: codex
+      model: gpt-5.2-codex
+      agentConfigurationDigest: ${ZERO_DIGEST}
+      toolPolicyDigest: ${ZERO_DIGEST}
+      approvalPolicyDigest: ${ZERO_DIGEST}
+      mcpConfigurationDigest: ${ZERO_DIGEST}
+      workspaceIntent: read
+      proxyCredentialRole: provider-inference
+      proxyCredentialScope: "model:gpt-5.2-codex"
+      resourceClass: standard
+    limits:
+      maxResidentSessions: 10
+      maxConcurrentPrompts: 4
+      maxRequestBytes: 1048576
+      maxEventLineBytes: 1048576
+      maxTerminalResultBytes: 1048576
+      maxBufferedEvents: 256
+      maxUpdateEventsPerSecond: 100
+      minPromptLeaseMillis: 5000
+      maxPromptLeaseMillis: 120000
+      maxPendingPermissions: 32
+      maxWorkspaceDeltaBytes: 536870912
+    supportsDrain: true
+    workspaceGovernance:
+      mode: strict-governed
+      trusted: false
+      orkaOwnedWorkspaceDeltas: true
+      promptScopedBrokerAuthorization: true
+      noDirectSCMPublication: true
+      orkaOwnedCleanRoomPublication: true
+      exactInstanceFencing: true
+      duplicateSafeMutations: true
+      cancellationSettlement: true
+EOF
+
+expect_reject "mixed v1+v2 client auth shapes are rejected" "mutually exclusive" <<EOF
+apiVersion: core.orka.ai/v1alpha1
+kind: AgentRuntime
+metadata: {name: mixed-auth, namespace: ${NAMESPACE}}
+spec:
+  contractVersion: orka.harness.v1
+  deployment: {mode: external-endpoint, endpoint: "https://harness.example.com"}
+  clientAuth:
+    bearerTokenSecretRef: {name: harness-auth, key: token}
+    controllerBearerTokenSecretRef: {name: auth, key: controller}
+    operationCapabilitySecretRef: {name: auth, key: capability}
+EOF
+
+expect_reject "v1 contract with v2 auth shape is rejected" "legacy bearerTokenSecretRef" <<EOF
+apiVersion: core.orka.ai/v1alpha1
+kind: AgentRuntime
+metadata: {name: v1-with-v2-auth, namespace: ${NAMESPACE}}
+spec:
+  contractVersion: orka.harness.v1
+  deployment: {mode: external-endpoint, endpoint: "https://harness.example.com"}
+  clientAuth:
+    controllerBearerTokenSecretRef: {name: auth, key: controller}
+    operationCapabilitySecretRef: {name: auth, key: capability}
+EOF
+
+expect_reject "v2 contract without pinned capabilities is rejected" "pinned instance" <<EOF
+apiVersion: core.orka.ai/v1alpha1
+kind: AgentRuntime
+metadata: {name: v2-no-caps, namespace: ${NAMESPACE}}
+spec:
+  contractVersion: orka.harness.v2
+  deployment: {mode: external-endpoint, endpoint: "https://runtime.example.com"}
+  clientAuth:
+    controllerBearerTokenSecretRef: {name: auth, key: controller}
+    operationCapabilitySecretRef: {name: auth, key: capability}
+EOF
+
+expect_reject "contractVersion mutation is rejected" "immutable" <<EOF
+apiVersion: core.orka.ai/v1alpha1
+kind: AgentRuntime
+metadata: {name: v1-runtime, namespace: ${NAMESPACE}}
+spec:
+  contractVersion: orka.harness.v2
+  deployment: {mode: external-endpoint, endpoint: "https://harness.example.com"}
+  clientAuth:
+    controllerBearerTokenSecretRef: {name: auth, key: controller}
+    operationCapabilitySecretRef: {name: auth, key: capability}
+  capabilities:
+    runtimeInstanceID: instance-1
+EOF
+
+expect_accept "unclassified stored AgentRuntime is tolerated by the bridge schema" <<EOF
+apiVersion: core.orka.ai/v1alpha1
+kind: AgentRuntime
+metadata: {name: unclassified-runtime, namespace: ${NAMESPACE}}
+spec:
+  deployment: {mode: external-endpoint, endpoint: "https://harness.example.com"}
+  clientAuth:
+    bearerTokenSecretRef: {name: harness-auth, key: token}
+EOF
+
+expect_accept "one-time absent-to-explicit classification is accepted" <<EOF
+apiVersion: core.orka.ai/v1alpha1
+kind: AgentRuntime
+metadata: {name: unclassified-runtime, namespace: ${NAMESPACE}}
+spec:
+  contractVersion: orka.harness.v1
+  deployment: {mode: external-endpoint, endpoint: "https://harness.example.com"}
+  clientAuth:
+    bearerTokenSecretRef: {name: harness-auth, key: token}
+EOF
+
+echo "== Agent contract selector =="
+
+expect_accept "v2-classified built-in Agent is accepted" <<EOF
+apiVersion: core.orka.ai/v1alpha1
+kind: Agent
+metadata: {name: v2-agent, namespace: ${NAMESPACE}}
+spec:
+  runtime: {type: codex, contractVersion: orka.harness.v2}
+  model: {name: gpt-5.2-codex}
+EOF
+
+expect_reject "Agent selector mutation is rejected" "immutable" <<EOF
+apiVersion: core.orka.ai/v1alpha1
+kind: Agent
+metadata: {name: v2-agent, namespace: ${NAMESPACE}}
+spec:
+  runtime: {type: codex, contractVersion: orka.harness.v1}
+  model: {name: gpt-5.2-codex}
+EOF
+
+expect_reject "selector with runtimeRef is rejected" "runtimeRef derives the protocol" <<EOF
+apiVersion: core.orka.ai/v1alpha1
+kind: Agent
+metadata: {name: ref-agent, namespace: ${NAMESPACE}}
+spec:
+  runtime:
+    runtimeRef: {name: external}
+    contractVersion: orka.harness.v2
+EOF
+
+expect_reject "v2 OpenCode Agent with systemPrompt is rejected" "does not support spec.systemPrompt" <<EOF
+apiVersion: core.orka.ai/v1alpha1
+kind: Agent
+metadata: {name: v2-opencode, namespace: ${NAMESPACE}}
+spec:
+  runtime: {type: opencode, contractVersion: orka.harness.v2}
+  model: {name: engine/gpt-5.2, contextWindow: 128000, maxTokens: 8192}
+  systemPrompt: {inline: "not allowed"}
+EOF
+
+expect_accept "stored v1 OpenCode Agent with legacy shape survives" <<EOF
+apiVersion: core.orka.ai/v1alpha1
+kind: Agent
+metadata: {name: v1-opencode, namespace: ${NAMESPACE}}
+spec:
+  runtime: {type: opencode, contractVersion: orka.harness.v1}
+  model: {name: gpt-5.2, maxTokens: 8192}
+  systemPrompt: {inline: "You are a careful engineer."}
+  secretRef: {name: opencode-credentials}
+EOF
+
+expect_status_patch accept "stored v1 OpenCode Agent /status remains updatable" \
+  agents.core.orka.ai/v1-opencode '{"status":{"ready":true,"activeTasks":0}}'
+
+echo "== Task legacy workspace ratchet and binding invariants =="
+
+expect_reject "new Task cannot introduce legacy agentRuntime.workspace" "preserved harness v1 compatibility surface" <<EOF
+apiVersion: core.orka.ai/v1alpha1
+kind: Task
+metadata: {name: legacy-workspace-task, namespace: ${NAMESPACE}}
+spec:
+  type: agent
+  prompt: fix it
+  agentRef: {name: v2-agent}
+  agentRuntime:
+    workspace: {gitRepo: "https://github.com/org/repo.git"}
+EOF
+
+expect_accept "plain agent Task is accepted" <<EOF
+apiVersion: core.orka.ai/v1alpha1
+kind: Task
+metadata: {name: bound-task, namespace: ${NAMESPACE}}
+spec:
+  type: agent
+  prompt: fix it
+  agentRef: {name: v2-agent}
+EOF
+
+BINDING=$(cat <<JSON
+{"schemaVersion":1,"contractVersion":"orka.harness.v1","backend":"harness-wrapper","bindingDigest":"${ZERO_DIGEST}","task":{"namespaceUID":"ns-uid","uid":"task-uid","boundSpecGeneration":1},"snapshot":{"id":"task-uid/${ZERO_DIGEST}","digest":"${ZERO_DIGEST}","schemaVersion":1},"boundAt":"2026-08-05T00:00:00Z"}
+JSON
+)
+
+expect_status_patch accept "v1 execution binding writes once" \
+  tasks.core.orka.ai/bound-task "{\"status\":{\"agentExecutionBinding\":${BINDING}}}"
+
+MUTATED_BINDING=${BINDING/harness-wrapper/external-endpoint}
+expect_status_patch reject "binding mutation is rejected" \
+  tasks.core.orka.ai/bound-task "{\"status\":{\"agentExecutionBinding\":${MUTATED_BINDING}}}" "write-once and immutable"
+
+expect_status_patch reject "binding removal is rejected" \
+  tasks.core.orka.ai/bound-task '{"status":{"agentExecutionBinding":null}}' "write-once and immutable"
+
+expect_status_patch reject "a v1-bound Task cannot acquire v2 execution state" \
+  tasks.core.orka.ai/bound-task '{"status":{"execution":{"state":"Queued"}}}' "cannot acquire new v2 execution"
+
+expect_status_patch accept "a v1-bound Task may record v1 harness state" \
+  tasks.core.orka.ai/bound-task '{"status":{"harnessRuntime":{"contractVersion":"orka.harness.v1","runtimeName":"wrapper"}}}'
+
+expect_accept "second plain agent Task is accepted" <<EOF
+apiVersion: core.orka.ai/v1alpha1
+kind: Task
+metadata: {name: incoherent-binding-task, namespace: ${NAMESPACE}}
+spec:
+  type: agent
+  prompt: fix it
+  agentRef: {name: v2-agent}
+EOF
+
+INCOHERENT_BINDING=$(cat <<JSON
+{"schemaVersion":1,"contractVersion":"orka.harness.v1","backend":"runtime-pool","bindingDigest":"${ZERO_DIGEST}","task":{"namespaceUID":"a","uid":"b","boundSpecGeneration":1},"snapshot":{"id":"b/${ZERO_DIGEST}","digest":"${ZERO_DIGEST}","schemaVersion":1},"boundAt":"2026-08-05T00:00:00Z"}
+JSON
+)
+expect_status_patch reject "runtime-pool backend requires a v2 binding (coherence)" \
+  tasks.core.orka.ai/incoherent-binding-task "{\"status\":{\"agentExecutionBinding\":${INCOHERENT_BINDING}}}" "requires an orka.harness.v2 binding"
+
+echo
+if [[ ${FAILURES} -gt 0 ]]; then
+  echo "static-mode CRD validation FAILED: ${FAILURES} case(s)" >&2
+  exit 1
+fi
+echo "static-mode CRD validation passed"
diff --git a/scripts/sync-helm-crds.sh b/scripts/sync-helm-crds.sh
new file mode 100755
index 000000000..9ec4ebb7f
--- /dev/null
+++ b/scripts/sync-helm-crds.sh
@@ -0,0 +1,293 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+source_dir="${root}/config/crd/bases"
+destination_dir="${root}/charts/orka/crds"
+mode="sync"
+
+usage() {
+  cat <<'USAGE'
+Usage: scripts/sync-helm-crds.sh [--check] [--source DIR] [--destination DIR]
+
+Synchronize generated CRD YAML files into the Helm chart. Every Helm-recognized
+manifest below the destination (*.yaml, *.yml, and *.json) is managed; README.md
+and other non-manifest files are preserved.
+
+Options:
+  --check             Verify that source and destination CRDs are identical.
+  --source DIR        Read generated CRDs from DIR.
+  --destination DIR   Manage Helm CRDs in DIR.
+  -h, --help          Show this help.
+USAGE
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --check)
+      mode="check"
+      shift
+      ;;
+    --source)
+      [[ $# -ge 2 ]] || {
+        echo "--source requires a directory" >&2
+        exit 2
+      }
+      source_dir="$2"
+      shift 2
+      ;;
+    --destination)
+      [[ $# -ge 2 ]] || {
+        echo "--destination requires a directory" >&2
+        exit 2
+      }
+      destination_dir="$2"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "unknown argument: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+done
+
+while :; do
+  case "${destination_dir}" in
+    /)
+      break
+      ;;
+    */)
+      destination_dir="${destination_dir%/}"
+      ;;
+    */.)
+      destination_dir="${destination_dir%/.}"
+      [[ -n "${destination_dir}" ]] || destination_dir="/"
+      ;;
+    *)
+      break
+      ;;
+  esac
+done
+
+[[ -d "${source_dir}" ]] || {
+  echo "generated CRD directory does not exist: ${source_dir}" >&2
+  exit 1
+}
+
+shopt -s nullglob
+source_files=("${source_dir}"/*.yaml)
+if [[ ${#source_files[@]} -eq 0 ]]; then
+  echo "generated CRD directory contains no YAML files: ${source_dir}" >&2
+  exit 1
+fi
+
+for source_file in "${source_files[@]}"; do
+  if [[ ! -f "${source_file}" || -L "${source_file}" ]]; then
+    echo "generated CRD is not a regular file: ${source_file}" >&2
+    exit 1
+  fi
+done
+
+
+destination_name_for_source() {
+  local source_file="$1"
+  local kind
+  kind="$(awk '''$1 == "names:" { in_names = 1; next } in_names && $1 == "kind:" { print $2; exit }''' "${source_file}")"
+  if [[ -n "${kind}" ]]; then
+    printf '%s-customresourcedefinition.yaml\n' "$(printf '%s' "${kind}" | tr '''[:upper:]''' '''[:lower:]''')"
+    return
+  fi
+  # Synthetic unit-test fixtures without a CRD spec retain their basename.
+  printf '%s\n' "${source_file##*/}"
+}
+
+source_for_destination_name() {
+  local wanted="$1"
+  local source_file
+  for source_file in "${source_files[@]}"; do
+    if [[ "$(destination_name_for_source "${source_file}")" == "${wanted}" ]]; then
+      printf '%s\n' "${source_file}"
+      return 0
+    fi
+  done
+  return 1
+}
+
+source_physical="$(cd -- "${source_dir}" && pwd -P)"
+
+validate_destination_directory() {
+  local destination_physical
+
+  if [[ -L "${destination_dir}" ]]; then
+    echo "Helm CRD directory must not be a symlink: ${destination_dir}" >&2
+    return 1
+  fi
+  if [[ ! -d "${destination_dir}" ]]; then
+    echo "Helm CRD directory does not exist: ${destination_dir}" >&2
+    return 1
+  fi
+  if ! destination_physical="$(cd -- "${destination_dir}" && pwd -P)"; then
+    echo "cannot resolve Helm CRD directory: ${destination_dir}" >&2
+    return 1
+  fi
+  if [[ "${destination_physical}" == "/" ]]; then
+    echo "refusing to manage filesystem root as Helm CRD directory: ${destination_dir}" >&2
+    return 1
+  fi
+  if [[ "${destination_physical}" == "${source_physical}" ]]; then
+    echo "generated and Helm CRD directories must differ: ${destination_dir}" >&2
+    return 1
+  fi
+  if [[ "${source_physical}" == "${destination_physical}/"* ||
+    "${destination_physical}" == "${source_physical}/"* ]]; then
+    echo "generated and Helm CRD directories must not overlap: ${source_dir} ${destination_dir}" >&2
+    return 1
+  fi
+}
+
+collect_helm_manifest_entries() {
+  helm_manifest_entries=()
+  local entry scan_file
+  scan_file="$(mktemp "${TMPDIR:-/tmp}/sync-helm-crds-manifests.XXXXXX")"
+  if ! find "${destination_dir}" -mindepth 1 \
+    \( -name '*.yaml' -o -name '*.yml' -o -name '*.json' \) -print0 >"${scan_file}"; then
+    echo "cannot scan Helm CRD destination for manifests: ${destination_dir}" >&2
+    rm -f -- "${scan_file}"
+    return 1
+  fi
+  while IFS= read -r -d '' entry; do
+    helm_manifest_entries+=("${entry}")
+  done <"${scan_file}"
+  rm -f -- "${scan_file}"
+}
+
+validate_destination_manifest_entries() {
+  local destination_entry symlink_entry symlink_scan_file
+
+  symlink_scan_file="$(mktemp "${TMPDIR:-/tmp}/sync-helm-crds-symlinks.XXXXXX")"
+  if ! find "${destination_dir}" -mindepth 1 -type l -print0 >"${symlink_scan_file}"; then
+    echo "cannot scan Helm CRD destination for symlinks: ${destination_dir}" >&2
+    rm -f -- "${symlink_scan_file}"
+    return 1
+  fi
+  while IFS= read -r -d '' symlink_entry; do
+    case "${symlink_entry}" in
+      *.yaml|*.yml|*.json)
+        ;;
+      *)
+        echo "Helm CRD directory must not contain unmanaged symlink: ${symlink_entry}" >&2
+        rm -f -- "${symlink_scan_file}"
+        return 1
+        ;;
+    esac
+  done <"${symlink_scan_file}"
+  rm -f -- "${symlink_scan_file}"
+
+  collect_helm_manifest_entries || return 1
+  for destination_entry in "${helm_manifest_entries[@]}"; do
+    if [[ ! -f "${destination_entry}" && ! -L "${destination_entry}" ]]; then
+      echo "Helm CRD destination is not a regular file or symlink: ${destination_entry}" >&2
+      return 1
+    fi
+  done
+}
+
+is_generated_crd_destination() {
+  local destination_entry="$1"
+  local relative="${destination_entry:$(( ${#destination_dir} + 1 ))}"
+  [[ "${relative}" != */* ]] || return 1
+  source_for_destination_name "${relative}" >/dev/null
+}
+
+check_sync() {
+  local drift=0
+  local source_file destination_file name destination_entry relative
+
+  validate_destination_directory || return 1
+  validate_destination_manifest_entries || return 1
+
+  for source_file in "${source_files[@]}"; do
+    name="$(destination_name_for_source "${source_file}")"
+    destination_file="${destination_dir}/${name}"
+    if [[ -L "${destination_file}" ]]; then
+      echo "symlinked Helm CRD: ${name}" >&2
+      drift=1
+    elif [[ ! -f "${destination_file}" ]]; then
+      echo "missing Helm CRD: ${name}" >&2
+      drift=1
+    elif ! cmp -s "${source_file}" "${destination_file}"; then
+      echo "out-of-sync Helm CRD: ${name}" >&2
+      drift=1
+    fi
+  done
+
+  collect_helm_manifest_entries
+  for destination_entry in "${helm_manifest_entries[@]}"; do
+    if ! is_generated_crd_destination "${destination_entry}"; then
+      relative="${destination_entry:$(( ${#destination_dir} + 1 ))}"
+      echo "stale Helm CRD: ${relative}" >&2
+      drift=1
+    fi
+  done
+
+  if [[ ${drift} -ne 0 ]]; then
+    echo "Helm CRDs differ from config/crd/bases; run 'make sync-helm-crds'" >&2
+    return 1
+  fi
+}
+
+if [[ "${mode}" == "check" ]]; then
+  check_sync
+  printf 'Helm CRDs are synchronized (%d files)\n' "${#source_files[@]}"
+  exit 0
+fi
+
+if [[ -L "${destination_dir}" ]]; then
+  echo "Helm CRD directory must not be a symlink: ${destination_dir}" >&2
+  exit 1
+fi
+if [[ -e "${destination_dir}" && ! -d "${destination_dir}" ]]; then
+  echo "Helm CRD destination is not a directory: ${destination_dir}" >&2
+  exit 1
+fi
+mkdir -p "${destination_dir}"
+validate_destination_directory
+validate_destination_manifest_entries
+
+staging_dir="$(mktemp -d "${destination_dir}/.sync-helm-crds.XXXXXX")"
+cleanup_staging() {
+  rm -rf -- "${staging_dir}"
+}
+trap cleanup_staging EXIT
+
+for source_file in "${source_files[@]}"; do
+  name="$(destination_name_for_source "${source_file}")"
+  cp -- "${source_file}" "${staging_dir}/${name}"
+done
+
+for source_file in "${source_files[@]}"; do
+  name="$(destination_name_for_source "${source_file}")"
+  destination_file="${destination_dir}/${name}"
+  if [[ -L "${destination_file}" ]]; then
+    rm -f -- "${destination_file}"
+  elif [[ -e "${destination_file}" && ! -f "${destination_file}" ]]; then
+    echo "Helm CRD destination is not a regular file: ${destination_file}" >&2
+    exit 1
+  fi
+  mv -f -- "${staging_dir}/${name}" "${destination_file}"
+done
+
+collect_helm_manifest_entries
+for destination_file in "${helm_manifest_entries[@]}"; do
+  if ! is_generated_crd_destination "${destination_file}"; then
+    rm -f -- "${destination_file}"
+  fi
+done
+
+check_sync
+printf 'Synchronized %d CRDs into %s\n' "${#source_files[@]}" "${destination_dir}"
diff --git a/scripts/tests/acp-runtime-image-rollout-test.sh b/scripts/tests/acp-runtime-image-rollout-test.sh
new file mode 100755
index 000000000..9733a8bc8
--- /dev/null
+++ b/scripts/tests/acp-runtime-image-rollout-test.sh
@@ -0,0 +1,1159 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+renderer="${root}/scripts/render-acp-runtime-images.sh"
+kustomize="${KUSTOMIZE:-${root}/bin/kustomize}"
+
+for command in "${renderer}" "${kustomize}" jq openssl ruby; do
+  command -v "${command}" >/dev/null 2>&1 || {
+    echo "required command not found: ${command}" >&2
+    exit 1
+  }
+done
+
+test_root="$(mktemp -d "${TMPDIR:-/tmp}/acp-runtime-image-rollout-test.XXXXXX")"
+cleanup() {
+  rm -rf "${test_root}"
+}
+trap cleanup EXIT
+cp -R "${root}/config" "${test_root}/config"
+overlay="${test_root}/config/acp-production"
+
+codex_a="docker.io/example/acp-codex@sha256:$(printf 'a%.0s' {1..64})"
+claude_a="docker.io/example/acp-claude@sha256:$(printf 'b%.0s' {1..64})"
+copilot_a="docker.io/example/acp-copilot@sha256:$(printf 'c%.0s' {1..64})"
+opencode_a="docker.io/example/acp-opencode@sha256:$(printf '0%.0s' {1..64})"
+codex_b="registry--prod.example.com:5000/team/acp-codex@sha256:$(printf 'd%.0s' {1..64})"
+claude_b="registry--prod.example.com:5000/team/acp-claude@sha256:$(printf 'e%.0s' {1..64})"
+copilot_b="registry--prod.example.com:5000/team/acp-copilot@sha256:$(printf 'f%.0s' {1..64})"
+opencode_b="registry--prod.example.com:5000/team/acp-opencode@sha256:$(printf '9%.0s' {1..64})"
+ipv6_image="[2001:db8::1]:5000/team/acp-codex@sha256:$(printf 'a%.0s' {1..64})"
+multiline_image="docker.io/example/acp-codex
+#@sha256:$(printf 'b%.0s' {1..64})"
+
+yaml_to_json() {
+  ruby -rjson -ryaml -e '
+    YAML.load_stream(STDIN.read).each do |document|
+      puts JSON.generate(document) unless document.nil?
+    end
+  '
+}
+
+render_snapshot() {
+  local codex_image="$1"
+  local claude_image="$2"
+  local copilot_image="$3"
+  local opencode_image="$4"
+  local output="$5"
+
+  "${renderer}" "${overlay}" "${codex_image}" "${claude_image}" "${copilot_image}" "${opencode_image}"
+  "${kustomize}" build "${overlay}" \
+    | yaml_to_json \
+    | jq -sc '
+        [.[] | if .kind == "List" then .items[] else . end] as $items |
+        ($items | map(select(.kind == "ConfigMap" and .metadata.labels["orka.ai/acp-runtime-images"] == "true")) | .[0]) as $config |
+        ($items | map(select(.kind == "Deployment" and .metadata.name == "orka-controller-manager")) | .[0]) as $deployment |
+        {
+          configName: $config.metadata.name,
+          config: $config.data,
+          references: [
+            $deployment.spec.template.spec.containers[]?.env[]? |
+            select(.name == "ORKA_ACP_CODEX_RUNTIME_IMAGE" or .name == "ORKA_ACP_CLAUDE_RUNTIME_IMAGE" or .name == "ORKA_ACP_COPILOT_RUNTIME_IMAGE" or .name == "ORKA_ACP_OPENCODE_RUNTIME_IMAGE") |
+            {name, configMapName: .valueFrom.configMapKeyRef.name, key: .valueFrom.configMapKeyRef.key}
+          ] | sort_by(.name)
+        }
+      ' >"${output}"
+}
+
+assert_snapshot() {
+  local snapshot="$1"
+  local codex_image="$2"
+  local claude_image="$3"
+  local copilot_image="$4"
+  local opencode_image="$5"
+
+  jq -e --arg codex "${codex_image}" --arg claude "${claude_image}" --arg copilot "${copilot_image}" --arg opencode "${opencode_image}" '
+    .configName as $configName |
+    ($configName | test("^acp-runtime-images-[a-z0-9]+$")) and
+    .config.ORKA_ACP_CODEX_RUNTIME_IMAGE == $codex and
+    .config.ORKA_ACP_CLAUDE_RUNTIME_IMAGE == $claude and
+    .config.ORKA_ACP_COPILOT_RUNTIME_IMAGE == $copilot and
+    .config.ORKA_ACP_OPENCODE_RUNTIME_IMAGE == $opencode and
+    (.references | length) == 4 and
+    ([.references[].configMapName] | all(. == $configName)) and
+    ([.references[].key] | sort) == ["ORKA_ACP_CLAUDE_RUNTIME_IMAGE", "ORKA_ACP_CODEX_RUNTIME_IMAGE", "ORKA_ACP_COPILOT_RUNTIME_IMAGE", "ORKA_ACP_OPENCODE_RUNTIME_IMAGE"]
+  ' "${snapshot}" >/dev/null
+}
+
+first="${test_root}/first.json"
+repeat="${test_root}/repeat.json"
+copilot_changed="${test_root}/copilot-changed.json"
+opencode_changed="${test_root}/opencode-changed.json"
+changed="${test_root}/changed.json"
+
+render_snapshot "${codex_a}" "${claude_a}" "${copilot_a}" "${opencode_a}" "${first}"
+assert_snapshot "${first}" "${codex_a}" "${claude_a}" "${copilot_a}" "${opencode_a}"
+render_snapshot "${codex_a}" "${claude_a}" "${copilot_a}" "${opencode_a}" "${repeat}"
+cmp -s "${first}" "${repeat}"
+
+render_snapshot "${codex_a}" "${claude_a}" "${copilot_b}" "${opencode_a}" "${copilot_changed}"
+assert_snapshot "${copilot_changed}" "${codex_a}" "${claude_a}" "${copilot_b}" "${opencode_a}"
+if [[ "$(jq -r .configName "${first}")" == "$(jq -r .configName "${copilot_changed}")" ]]; then
+  echo 'Copilot runtime image change did not create a new immutable ConfigMap generation' >&2
+  exit 1
+fi
+
+render_snapshot "${codex_a}" "${claude_a}" "${copilot_a}" "${opencode_b}" "${opencode_changed}"
+assert_snapshot "${opencode_changed}" "${codex_a}" "${claude_a}" "${copilot_a}" "${opencode_b}"
+if [[ "$(jq -r .configName "${first}")" == "$(jq -r .configName "${opencode_changed}")" ]]; then
+  echo 'OpenCode runtime image change did not create a new immutable ConfigMap generation' >&2
+  exit 1
+fi
+
+render_snapshot "${codex_b}" "${claude_b}" "${copilot_b}" "${opencode_b}" "${changed}"
+assert_snapshot "${changed}" "${codex_b}" "${claude_b}" "${copilot_b}" "${opencode_b}"
+if [[ "$(jq -r .configName "${first}")" == "$(jq -r .configName "${changed}")" ]]; then
+  echo 'runtime image change did not create a new immutable ConfigMap generation' >&2
+  exit 1
+fi
+
+[[ -f "${overlay}/runtime-images.env" ]]
+[[ ! -e "${overlay}/runtime-images-configmap.yaml" ]]
+[[ ! -e "${overlay}/runtime-images-rollout-patch.yaml" ]]
+rendered_manifest="${test_root}/rendered-manifest.yaml"
+"${kustomize}" build "${overlay}" >"${rendered_manifest}"
+[[ "$(grep -c '^kind: AgentExecutionControl$' "${rendered_manifest}" || true)" == "0" ]]
+rendered_inventory="${test_root}/rendered-inventory.json"
+yaml_to_json <"${rendered_manifest}" \
+  | jq -sc '[.[] | if .kind == "List" then .items[] else . end]' >"${rendered_inventory}"
+jq -e '
+  ([.[] | select(.kind == "ServiceAccount" and .metadata.namespace == "orka-system") |
+    .metadata.name] | unique) as $service_accounts |
+  ([.[] | select((.kind == "RoleBinding" or .kind == "ClusterRoleBinding")) |
+    .subjects[]? | select(.kind == "ServiceAccount" and .namespace == "orka-system") |
+    .name] | unique) as $bound_service_accounts |
+  ([.[] | select(.kind == "Namespace" and .metadata.name == "orka-system" and
+    .metadata.labels["orka.ai/controller-mode"] == "harness-v2")] | length) == 1 and
+  ($bound_service_accounts | length) > 0 and
+  ([$bound_service_accounts[] as $name | $service_accounts | index($name) != null] | all) and
+  ([.[] | select(.kind == "Deployment" and .metadata.name == "orka-controller-manager" and
+    .metadata.namespace == "orka-system") |
+    .spec.template.spec.containers[] | select(.name == "manager") | .args] | length) == 1 and
+  ([.[] | select(.kind == "Deployment" and .metadata.name == "orka-controller-manager") |
+    .spec.template.spec.containers[] | select(.name == "manager") | .args[] |
+    select(. == "--controller-mode=harness-v2")] | length) == 1 and
+  ([.[] | select(.kind == "Deployment" and .metadata.name == "orka-controller-manager") |
+    .spec.template.spec.containers[] | select(.name == "manager") | .args[] |
+    select(. == "--watch-namespace=orka-system")] | length) == 1 and
+  ([.[] | select(.kind == "Deployment" and .metadata.name == "orka-controller-manager") |
+    .spec.template.spec.containers[] | select(.name == "manager") | .args[] |
+    select(. == "--task-provenance-admission-enabled=true" or
+           . == "--workspace-class-use-admission-enabled=true")] | length) == 0 and
+  ([.[] | select(.kind == "Deployment" and .metadata.name == "orka-controller-manager") |
+    .spec.template.spec.containers[] | select(.name == "manager") | .args[] |
+    select(startswith("--harness-v1-"))] | length) == 0 and
+  ([.[] | select(.kind == "Deployment" and .metadata.name == "orka-admission" and
+    .metadata.namespace == "orka-system" and .spec.replicas == 2 and
+    .spec.strategy.type == "RollingUpdate" and .spec.strategy.rollingUpdate.maxUnavailable == 0 and
+    (.spec.template.spec.containers | any(.name == "admission" and
+      (.image | test("@sha256:[a-f0-9]{64}$")) and
+      .lifecycle.preStop.exec.command == ["/orka-admission", "--pre-stop-delay=5s"])))] | length) == 1 and
+  ([.[] | select(.kind == "Service" and .metadata.name == "orka-admission")] | length) == 1 and
+  ([.[] | select(.kind == "PodDisruptionBudget" and .metadata.name == "orka-admission" and .spec.minAvailable == 1)] | length) == 1 and
+  ([.[] | select(.kind == "ValidatingWebhookConfiguration" and .metadata.name == "orka-admission")] | length) == 0
+' "${rendered_inventory}" >/dev/null
+
+canonical_controller_username="$(jq -er '
+  [.[] | select(.kind == "Deployment" and .metadata.name == "orka-controller-manager" and
+    .metadata.namespace == "orka-system")] |
+  if length == 1 then
+    .[0] |
+    select(.spec.template.spec.serviceAccountName | type == "string" and length > 0) |
+    "system:serviceaccount:\(.metadata.namespace):\(.spec.template.spec.serviceAccountName)"
+  else
+    error("expected exactly one canonical production controller Deployment")
+  end
+' "${rendered_inventory}")"
+
+jq -e --arg username "${canonical_controller_username}" '
+  ([.[] | select(.kind == "Deployment" and .metadata.name == "orka-admission") |
+    .spec.template.spec.containers[] | select(.name == "admission") | .args[] |
+    select(startswith("--controller-usernames=")) |
+    ltrimstr("--controller-usernames=") | split(",")]) as $controller_users |
+  ([.[] | select(.kind == "Deployment" and .metadata.name == "orka-admission") |
+    .spec.template.spec.containers[] | select(.name == "admission") | .args[] |
+    select(startswith("--task-provenance-trusted-users=")) |
+    ltrimstr("--task-provenance-trusted-users=") | split(",")]) as $provenance_users |
+  ($controller_users | length) == 1 and
+  ($provenance_users | length) == 1 and
+  ($controller_users[0] | index($username) != null) and
+  ($provenance_users[0] | index($username) != null)
+' "${rendered_inventory}" >/dev/null
+
+shared_webhooks_inventory="${test_root}/shared-webhooks-inventory.json"
+"${kustomize}" build "${test_root}/config/orka-admission-webhooks" \
+  | yaml_to_json \
+  | jq -sc '[.[] | if .kind == "List" then .items[] else . end]' >"${shared_webhooks_inventory}"
+jq -e --arg username "${canonical_controller_username}" '
+  ([.[] | select(.kind == "ValidatingWebhookConfiguration" and .metadata.name == "orka-admission") |
+    .webhooks[].matchConditions[]? |
+    select(.name == "route-unless-controller-cleanup-safe") | .expression]) as $conditions |
+  ($conditions | length) == 3 and
+  ([$conditions[] | contains("\u0027" + $username + "\u0027")] | all)
+' "${shared_webhooks_inventory}" >/dev/null
+grep -F 'scripts/render-acp-runtime-images.sh' "${root}/Makefile" >/dev/null
+grep -F 'controller=${IMG}' "${root}/Makefile" >/dev/null
+grep -F 'docker-build-acp-copilot-runtime' "${root}/Makefile" >/dev/null
+grep -F 'ACP_COPILOT_RUNTIME_IMG' "${root}/Makefile" >/dev/null
+grep -F 'docker-build-acp-opencode-runtime' "${root}/Makefile" >/dev/null
+grep -F 'ACP_OPENCODE_RUNTIME_IMG' "${root}/Makefile" >/dev/null
+if grep -F 'rollout restart deployment/orka-controller-manager' "${root}/Makefile" >/dev/null; then
+  echo 'deploy still relies on an imperative, non-retryable controller restart' >&2
+  exit 1
+fi
+
+"${renderer}" "${overlay}" "${ipv6_image}" "${claude_b}" "${copilot_b}" "${opencode_b}"
+"${renderer}" "${overlay}" "${codex_b}" "${claude_b}" "${copilot_b}" "${opencode_b}"
+
+for invalid_image in \
+  'not-digest-pinned' \
+  "https://registry.example.com/team/acp@sha256:$(printf '1%.0s' {1..64})" \
+  "registry.example.com:notaport/team/acp@sha256:$(printf '2%.0s' {1..64})" \
+  "[127.0.0.1]/team/acp@sha256:$(printf '3%.0s' {1..64})" \
+  "${multiline_image}"; do
+  if "${renderer}" "${overlay}" "${invalid_image}" "${claude_b}" "${copilot_b}" "${opencode_b}" >/dev/null 2>&1; then
+    echo "renderer accepted invalid runtime image: ${invalid_image}" >&2
+    exit 1
+  fi
+done
+
+if "${renderer}" "${overlay}" "${codex_b}" "${claude_b}" "not-digest-pinned" "${opencode_b}" >/dev/null 2>&1; then
+  echo 'renderer accepted an invalid Copilot runtime image' >&2
+  exit 1
+fi
+
+if "${renderer}" "${overlay}" "${codex_b}" "${claude_b}" "${copilot_b}" "not-digest-pinned" >/dev/null 2>&1; then
+  echo 'renderer accepted an invalid OpenCode runtime image' >&2
+  exit 1
+fi
+
+apply_script="${root}/scripts/apply-acp-production.sh"
+tls_fixture_dir="${test_root}/admission-tls"
+mkdir -p "${tls_fixture_dir}"
+ruby -ropenssl - "${tls_fixture_dir}" <<'RUBY_TLS_FIXTURES'
+directory = ARGV.fetch(0)
+now = Time.now
+
+def issue_ca(common_name, key, not_before, not_after, serial)
+  certificate = OpenSSL::X509::Certificate.new
+  certificate.version = 2
+  certificate.serial = serial
+  certificate.subject = OpenSSL::X509::Name.parse("/CN=#{common_name}")
+  certificate.issuer = certificate.subject
+  certificate.public_key = key.public_key
+  certificate.not_before = not_before
+  certificate.not_after = not_after
+  extensions = OpenSSL::X509::ExtensionFactory.new
+  extensions.subject_certificate = certificate
+  extensions.issuer_certificate = certificate
+  certificate.add_extension(extensions.create_extension("basicConstraints", "CA:TRUE", true))
+  certificate.add_extension(extensions.create_extension("keyUsage", "keyCertSign,cRLSign", true))
+  certificate.add_extension(extensions.create_extension("subjectKeyIdentifier", "hash", false))
+  certificate.add_extension(extensions.create_extension("authorityKeyIdentifier", "keyid:always", false))
+  certificate.sign(key, OpenSSL::Digest::SHA256.new)
+  certificate
+end
+
+def issue_server(ca_certificate, ca_key, server_key, dns_name, not_before, not_after, serial)
+  certificate = OpenSSL::X509::Certificate.new
+  certificate.version = 2
+  certificate.serial = serial
+  certificate.subject = OpenSSL::X509::Name.parse("/CN=#{dns_name}")
+  certificate.issuer = ca_certificate.subject
+  certificate.public_key = server_key.public_key
+  certificate.not_before = not_before
+  certificate.not_after = not_after
+  extensions = OpenSSL::X509::ExtensionFactory.new
+  extensions.subject_certificate = certificate
+  extensions.issuer_certificate = ca_certificate
+  certificate.add_extension(extensions.create_extension("basicConstraints", "CA:FALSE", true))
+  certificate.add_extension(extensions.create_extension("keyUsage", "digitalSignature,keyEncipherment", true))
+  certificate.add_extension(extensions.create_extension("extendedKeyUsage", "serverAuth", false))
+  certificate.add_extension(extensions.create_extension("subjectAltName", "DNS:#{dns_name}", false))
+  certificate.add_extension(extensions.create_extension("subjectKeyIdentifier", "hash", false))
+  certificate.add_extension(extensions.create_extension("authorityKeyIdentifier", "keyid:always", false))
+  certificate.sign(ca_key, OpenSSL::Digest::SHA256.new)
+  certificate
+end
+
+ca_key = OpenSSL::PKey::RSA.new(2048)
+ca_certificate = issue_ca("Orka Admission Test CA", ca_key, now - 3600, now + 86_400, 1)
+other_ca_key = OpenSSL::PKey::RSA.new(2048)
+other_ca_certificate = issue_ca("Untrusted Test CA", other_ca_key, now - 3600, now + 86_400, 2)
+server_key = OpenSSL::PKey::RSA.new(2048)
+mismatched_key = OpenSSL::PKey::RSA.new(2048)
+service_dns = "orka-admission.orka-system.svc"
+
+File.binwrite(File.join(directory, "ca.crt"), ca_certificate.to_pem)
+File.binwrite(File.join(directory, "other-ca.crt"), other_ca_certificate.to_pem)
+File.binwrite(File.join(directory, "tls.key"), server_key.to_pem)
+File.binwrite(File.join(directory, "mismatched.key"), mismatched_key.to_pem)
+File.binwrite(File.join(directory, "tls.crt"), issue_server(
+  ca_certificate, ca_key, server_key, service_dns, now - 3600, now + 86_400, 3
+).to_pem)
+File.binwrite(File.join(directory, "wrong-san.crt"), issue_server(
+  ca_certificate, ca_key, server_key, "not-orka-admission.orka-system.svc", now - 3600, now + 86_400, 4
+).to_pem)
+File.binwrite(File.join(directory, "expired.crt"), issue_server(
+  ca_certificate, ca_key, server_key, service_dns, now - 7200, now - 3600, 5
+).to_pem)
+File.binwrite(File.join(directory, "future.crt"), issue_server(
+  ca_certificate, ca_key, server_key, service_dns, now + 3600, now + 7200, 6
+).to_pem)
+File.binwrite(File.join(directory, "invalid.crt"), "not a certificate\n")
+File.binwrite(File.join(directory, "invalid.key"), "not a private key\n")
+RUBY_TLS_FIXTURES
+export FAKE_TLS_FIXTURE_DIR="${tls_fixture_dir}"
+
+fake_bin="${test_root}/fake-bin"
+mkdir -p "${fake_bin}"
+cat >"${fake_bin}/kubectl" <<'EOF_FAKE_KUBECTL'
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+mkdir -p "${FAKE_KUBE_STATE}/configmaps"
+
+yaml_to_json() {
+  ruby -rjson -ryaml -e '
+    YAML.load_stream(STDIN.read).each do |document|
+      puts JSON.generate(document) unless document.nil?
+    end
+  '
+}
+
+manifest_json() {
+  local source="$1"
+  if jq -e . "${source}" >/dev/null 2>&1; then
+    cat "${source}"
+    return
+  fi
+  yaml_to_json <"${source}" | jq -sc --arg mode "${FAKE_STATIC_MODE:-valid}" '
+    def controller:
+      .kind == "Deployment" and .metadata.name == "orka-controller-manager";
+    def rewrite_args($f):
+      map(if controller then
+        .spec.template.spec.containers |= map(
+          if .name == "manager" then .args |= $f else . end
+        )
+      else . end);
+    if $mode == "valid" then .
+    elif $mode == "missing-namespace" then
+      map(select((.kind == "Namespace" and .metadata.name == "orka-system") | not))
+    elif $mode == "wrong-namespace-label" then
+      map(if .kind == "Namespace" and .metadata.name == "orka-system" then
+        .metadata.labels["orka.ai/controller-mode"] = "harness-v1"
+      else . end)
+    elif $mode == "missing-controller" then
+      map(select(controller | not))
+    elif $mode == "duplicate-controller" then
+      . + [(.[] | select(controller))]
+    elif $mode == "missing-controller-mode" then
+      rewrite_args(map(select(startswith("--controller-mode=") | not)))
+    elif $mode == "duplicate-controller-mode" then
+      rewrite_args(. + ["--controller-mode=harness-v2"])
+    elif $mode == "wrong-controller-mode" then
+      rewrite_args(map(if startswith("--controller-mode=") then "--controller-mode=harness-v1" else . end))
+    elif $mode == "missing-watch-namespace" then
+      rewrite_args(map(select(startswith("--watch-namespace=") | not)))
+    elif $mode == "wrong-watch-namespace" then
+      rewrite_args(map(if startswith("--watch-namespace=") then "--watch-namespace=other" else . end))
+    elif $mode == "legacy-controller-flag" then
+      rewrite_args(. + ["--harness-v1-endpoint=https://legacy.invalid"])
+    else error("unknown FAKE_STATIC_MODE: " + $mode)
+    end
+    | .[]
+  '
+}
+
+if [[ "$1" == "proxy" ]]; then
+  [[ -e "${FAKE_KUBE_STATE}/admission-endpoints" ]] || { echo 'handler smoke ran before ready endpoints' >&2; exit 34; }
+  [[ " $* " == *" --address=127.0.0.1 "* && " $* " == *" --port=0 "* ]] || {
+    echo "invalid admission proxy invocation: $*" >&2
+    exit 2
+  }
+  printf 'proxy-start\n' >>"${FAKE_KUBE_LOG}"
+  stop_proxy() {
+    printf 'proxy-stop\n' >>"${FAKE_KUBE_LOG}"
+    exit 0
+  }
+  trap stop_proxy INT TERM
+  printf 'Starting to serve on 127.0.0.1:43210\n'
+  while true; do
+    sleep 1
+  done
+fi
+
+if [[ "$1" == "get" && "$2" == "namespace" && "$3" == "orka-system" ]]; then
+  namespace_mode="${FAKE_EXISTING_NAMESPACE_MODE:-}"
+  if [[ -z "${namespace_mode}" ]]; then
+    if [[ -e "${FAKE_KUBE_STATE}/namespace" ]]; then
+      namespace_mode="harness-v2"
+    else
+      namespace_mode="none"
+    fi
+  fi
+  case "${namespace_mode}" in
+    none)
+      exit 0
+      ;;
+    unlabeled)
+      namespace_labels='{}'
+      ;;
+    harness-v1)
+      namespace_labels='{"orka.ai/controller-mode":"harness-v1"}'
+      ;;
+    harness-v2)
+      namespace_labels='{"orka.ai/controller-mode":"harness-v2"}'
+      ;;
+    *)
+      echo "unknown FAKE_EXISTING_NAMESPACE_MODE: ${FAKE_EXISTING_NAMESPACE_MODE}" >&2
+      exit 2
+      ;;
+  esac
+  jq -n --argjson labels "${namespace_labels}" '{
+    apiVersion:"v1",
+    kind:"Namespace",
+    metadata:{name:"orka-system",labels:$labels}
+  }'
+  exit 0
+fi
+
+if [[ "$1" == "-n" && "$2" == "orka-system" && "$3" == "get" && "$4" == "deployment" && "$5" == "orka-controller-manager" ]]; then
+  case "${FAKE_EXISTING_CONTROLLER_MODE:-none}" in
+    none)
+      exit 0
+      ;;
+    static-v2)
+      controller_args='["--controller-mode=harness-v2","--watch-namespace=orka-system"]'
+      ;;
+    legacy-v2)
+      controller_args='["--watch-namespace=orka-system","--acp-runtime-enabled=true"]'
+      ;;
+    static-v1)
+      controller_args='["--controller-mode=harness-v1","--watch-namespace=orka-system"]'
+      ;;
+    wrong-scope)
+      controller_args='["--controller-mode=harness-v2","--watch-namespace=other"]'
+      ;;
+    duplicate-mode)
+      controller_args='["--controller-mode=harness-v2","--controller-mode=harness-v2","--watch-namespace=orka-system"]'
+      ;;
+    *)
+      echo "unknown FAKE_EXISTING_CONTROLLER_MODE: ${FAKE_EXISTING_CONTROLLER_MODE}" >&2
+      exit 2
+      ;;
+  esac
+  jq -n --argjson args "${controller_args}" '{
+    apiVersion:"apps/v1",
+    kind:"Deployment",
+    metadata:{name:"orka-controller-manager",namespace:"orka-system"},
+    spec:{template:{spec:{containers:[{name:"manager",args:$args}]}}}
+  }'
+  exit 0
+fi
+
+if [[ "$1" == "create" ]]; then
+  manifest_path=""
+  args=("$@")
+  for ((i = 0; i < ${#args[@]}; i++)); do
+    if [[ "${args[$i]}" == "-f" && $((i + 1)) -lt ${#args[@]} ]]; then
+      manifest_path="${args[$((i + 1))]}"
+      break
+    fi
+  done
+  [[ -n "${manifest_path}" && "${manifest_path}" != "-" ]] || {
+    echo "unexpected fake kubectl create invocation: $*" >&2
+    exit 2
+  }
+  if [[ " $* " == *" --dry-run=client "* ]]; then
+    manifest_json "${manifest_path}"
+    exit 0
+  fi
+
+  payload="$(manifest_json "${manifest_path}")"
+  if jq -e '
+    .apiVersion == "v1" and
+    .kind == "Namespace" and
+    .metadata.name == "orka-system" and
+    .metadata.labels["orka.ai/controller-mode"] == "harness-v2"
+  ' <<<"${payload}" >/dev/null; then
+    [[ ! -e "${FAKE_KUBE_STATE}/namespace" ]] || {
+      echo 'namespace already exists' >&2
+      exit 1
+    }
+    if [[ "${FAKE_KUBE_FAIL_MODE:-}" == "namespace" && ! -e "${FAKE_KUBE_STATE}/failed-namespace" ]]; then
+      : >"${FAKE_KUBE_STATE}/failed-namespace"
+      printf 'fail-namespace:orka-system\n' >>"${FAKE_KUBE_LOG}"
+      exit 18
+    fi
+    : >"${FAKE_KUBE_STATE}/namespace"
+    printf 'namespace:orka-system\n' >>"${FAKE_KUBE_LOG}"
+    printf '%s\n' "${payload}"
+    exit 0
+  fi
+  echo "unexpected non-dry-run fake kubectl create invocation: $*" >&2
+  exit 2
+fi
+
+if [[ "$1" == "patch" && "$2" == "namespace" && "$3" == "orka-system" ]]; then
+  patch_path=""
+  args=("$@")
+  for ((i = 0; i < ${#args[@]}; i++)); do
+    if [[ "${args[$i]}" == "--patch-file" && $((i + 1)) -lt ${#args[@]} ]]; then
+      patch_path="${args[$((i + 1))]}"
+      break
+    fi
+  done
+  [[ " $* " == *" --type=json "* && -n "${patch_path}" && -f "${patch_path}" ]] || {
+    echo "namespace metadata update must use a JSON patch file: $*" >&2
+    exit 2
+  }
+  jq -e '
+    ([.[] | select(.path == "/metadata/labels/orka.ai~1controller-mode")] == [{
+      op: "test",
+      path: "/metadata/labels/orka.ai~1controller-mode",
+      value: "harness-v2"
+    }]) and
+    ([.[] | select(.op != "test" and .path == "/metadata/labels/orka.ai~1controller-mode")] | length) == 0 and
+    ([.[] | select(.op == "add" and .path == "/metadata/labels/control-plane" and .value == "controller-manager")] | length) == 1
+  ' "${patch_path}" >/dev/null || {
+    echo 'namespace metadata patch could overwrite the static mode identity' >&2
+    exit 2
+  }
+  if [[ "${FAKE_EXISTING_NAMESPACE_MODE:-}" != "harness-v2" && ! -e "${FAKE_KUBE_STATE}/namespace" ]]; then
+    echo 'namespace metadata patched before the claimed namespace existed' >&2
+    exit 2
+  fi
+  : >"${FAKE_KUBE_STATE}/namespace"
+  printf 'namespace-metadata:orka-system\n' >>"${FAKE_KUBE_LOG}"
+  exit 0
+fi
+
+if [[ "$1" == "-n" && "$2" == "orka-system" && "$3" == "get" && "$4" == "secret" && "$5" == "agent-execution-snapshot-key" ]]; then
+  if [[ ! -f "${FAKE_KUBE_STATE}/snapshot-key" ]]; then
+    if [[ " $* " == *" --ignore-not-found "* ]]; then
+      exit 0
+    fi
+    exit 1
+  fi
+  encoded="$(base64 <"${FAKE_KUBE_STATE}/snapshot-key" | tr -d '\r\n')"
+  jq -n --arg encoded "${encoded}" '{apiVersion:"v1",kind:"Secret",metadata:{name:"agent-execution-snapshot-key",namespace:"orka-system"},data:{"snapshot-key":$encoded}}'
+  exit 0
+fi
+
+if [[ "$1" == "-n" && "$2" == "orka-system" && "$3" == "get" && "$4" == "secret" && "$5" == "orka-admission-tls" ]]; then
+  tls_mode="${FAKE_TLS_MODE:-valid}"
+  [[ "${tls_mode}" != "missing" ]] || exit 1
+  tls_directory="${FAKE_TLS_FIXTURE_DIR:?}"
+  cert_path="${tls_directory}/tls.crt"
+  key_path="${tls_directory}/tls.key"
+  ca_path="${tls_directory}/ca.crt"
+  case "${tls_mode}" in
+    valid|missing-ca) ;;
+    invalid-cert) cert_path="${tls_directory}/invalid.crt" ;;
+    invalid-key) key_path="${tls_directory}/invalid.key" ;;
+    invalid-ca) ca_path="${tls_directory}/invalid.crt" ;;
+    mismatched-key) key_path="${tls_directory}/mismatched.key" ;;
+    expired) cert_path="${tls_directory}/expired.crt" ;;
+    future) cert_path="${tls_directory}/future.crt" ;;
+    wrong-san) cert_path="${tls_directory}/wrong-san.crt" ;;
+    wrong-ca) ca_path="${tls_directory}/other-ca.crt" ;;
+    *) echo "unknown FAKE_TLS_MODE: ${tls_mode}" >&2; exit 2 ;;
+  esac
+  cert="$(base64 <"${cert_path}" | tr -d '\r\n')"
+  key="$(base64 <"${key_path}" | tr -d '\r\n')"
+  ca="$(base64 <"${ca_path}" | tr -d '\r\n')"
+  if [[ "${tls_mode}" == "missing-ca" ]]; then
+    jq -n --arg cert "${cert}" --arg key "${key}" '{apiVersion:"v1",kind:"Secret",type:"kubernetes.io/tls",metadata:{name:"orka-admission-tls",namespace:"orka-system"},data:{"tls.crt":$cert,"tls.key":$key}}'
+  else
+    jq -n --arg cert "${cert}" --arg key "${key}" --arg ca "${ca}" '{apiVersion:"v1",kind:"Secret",type:"kubernetes.io/tls",metadata:{name:"orka-admission-tls",namespace:"orka-system"},data:{"tls.crt":$cert,"tls.key":$key,"ca.crt":$ca}}'
+  fi
+  exit 0
+fi
+
+if [[ "$1" == "-n" && "$2" == "orka-system" && "$3" == "create" && "$4" == "secret" && "$5" == "generic" && "$6" == "agent-execution-snapshot-key" ]]; then
+  [[ -e "${FAKE_KUBE_STATE}/namespace" ]] || {
+    echo 'snapshot Secret created before namespace' >&2
+    exit 24
+  }
+  [[ ! -e "${FAKE_KUBE_STATE}/snapshot-key" ]] || {
+    echo 'snapshot Secret already exists' >&2
+    exit 25
+  }
+  key_path=""
+  for argument in "$@"; do
+    if [[ "${argument}" == --from-file=snapshot-key=* ]]; then
+      key_path="${argument#--from-file=snapshot-key=}"
+      break
+    fi
+  done
+  [[ -n "${key_path}" && -f "${key_path}" ]] || {
+    echo 'snapshot Secret create is missing its key file' >&2
+    exit 26
+  }
+  cp "${key_path}" "${FAKE_KUBE_STATE}/snapshot-key"
+  printf 'secret:agent-execution-snapshot-key\n' >>"${FAKE_KUBE_LOG}"
+  exit 0
+fi
+
+if [[ "$1" == "-n" && "$2" == "orka-system" && "$3" == "rollout" && "$4" == "status" && "$5" == "deployment/orka-admission" ]]; then
+  [[ -e "${FAKE_KUBE_STATE}/admission-runtime" ]] || { echo 'admission rollout waited before runtime apply' >&2; exit 36; }
+  if [[ "${FAKE_KUBE_FAIL_MODE:-}" == "rollout" && ! -e "${FAKE_KUBE_STATE}/failed-rollout" ]]; then
+    : >"${FAKE_KUBE_STATE}/failed-rollout"
+    printf 'fail-rollout:orka-admission\n' >>"${FAKE_KUBE_LOG}"
+    exit 37
+  fi
+  printf 'rollout:orka-admission\n' >>"${FAKE_KUBE_LOG}"
+  exit 0
+fi
+
+if [[ "$1" == "-n" && "$2" == "orka-system" && "$3" == "rollout" && "$4" == "status" ]]; then
+  dependency="${5#deployment/}"
+  case "${dependency}" in
+    orka-provider-auth-proxy|orka-scm-egress-proxy|orka-workspace-publisher) ;;
+    *) dependency="" ;;
+  esac
+  if [[ -n "${dependency}" ]]; then
+    [[ -e "${FAKE_KUBE_STATE}/dependency-workload" ]] || {
+      echo "${dependency} rollout waited before dependency apply" >&2
+      exit 50
+    }
+    if [[ "${FAKE_KUBE_FAIL_MODE:-}" == "dependency-rollout" && ! -e "${FAKE_KUBE_STATE}/failed-dependency-rollout" ]]; then
+      : >"${FAKE_KUBE_STATE}/failed-dependency-rollout"
+      printf 'fail-rollout:%s\n' "${dependency}" >>"${FAKE_KUBE_LOG}"
+      exit 51
+    fi
+    : >"${FAKE_KUBE_STATE}/dependency-rollout-${dependency}"
+    printf 'rollout:%s\n' "${dependency}" >>"${FAKE_KUBE_LOG}"
+    exit 0
+  fi
+fi
+
+if [[ "$1" == "-n" && "$2" == "orka-system" && "$3" == "rollout" && "$4" == "status" && "$5" == "deployment/orka-controller-manager" ]]; then
+  [[ -e "${FAKE_KUBE_STATE}/controller-workload" ]] || { echo 'controller rollout waited before workload apply' >&2; exit 48; }
+  if [[ "${FAKE_KUBE_FAIL_MODE:-}" == "controller-rollout" && ! -e "${FAKE_KUBE_STATE}/failed-controller-rollout" ]]; then
+    : >"${FAKE_KUBE_STATE}/failed-controller-rollout"
+    printf 'fail-rollout:orka-controller-manager\n' >>"${FAKE_KUBE_LOG}"
+    exit 49
+  fi
+  : >"${FAKE_KUBE_STATE}/controller-ready"
+  printf 'rollout:orka-controller-manager\n' >>"${FAKE_KUBE_LOG}"
+  exit 0
+fi
+
+if [[ "$1" == "-n" && "$2" == "orka-system" && "$3" == "get" && "$4" == "endpoints" ]]; then
+  dependency="$5"
+  case "${dependency}" in
+    orka-provider-auth-proxy|orka-scm-egress-proxy|orka-workspace-publisher) ;;
+    *) dependency="" ;;
+  esac
+  if [[ -n "${dependency}" ]]; then
+    [[ -e "${FAKE_KUBE_STATE}/dependency-rollout-${dependency}" ]] || {
+      echo "${dependency} endpoints inspected before rollout" >&2
+      exit 52
+    }
+    if [[ "${FAKE_KUBE_FAIL_MODE:-}" == "dependency-endpoints" ]]; then
+      printf '%s\n' '{"apiVersion":"v1","kind":"Endpoints","subsets":[]}'
+      exit 0
+    fi
+    : >"${FAKE_KUBE_STATE}/dependency-endpoint-${dependency}"
+    printf 'endpoint:%s\n' "${dependency}" >>"${FAKE_KUBE_LOG}"
+    printf '%s\n' '{"apiVersion":"v1","kind":"Endpoints","subsets":[{"addresses":[{"ip":"10.0.0.3"}]}]}'
+    exit 0
+  fi
+fi
+
+if [[ "$1" == "-n" && "$2" == "orka-system" && "$3" == "get" && "$4" == "endpoints" && "$5" == "orka-admission" ]]; then
+  [[ -e "${FAKE_KUBE_STATE}/admission-runtime" ]] || exit 1
+  if [[ "${FAKE_KUBE_FAIL_MODE:-}" == "endpoints" && ! -e "${FAKE_KUBE_STATE}/failed-endpoints" ]]; then
+    : >"${FAKE_KUBE_STATE}/failed-endpoints"
+    printf 'fail-endpoints:orka-admission\n' >>"${FAKE_KUBE_LOG}"
+    printf '%s\n' '{"apiVersion":"v1","kind":"Endpoints","subsets":[{"addresses":[{"ip":"10.0.0.1"}]}]}'
+    exit 0
+  fi
+  : >"${FAKE_KUBE_STATE}/admission-endpoints"
+  printf '%s\n' '{"apiVersion":"v1","kind":"Endpoints","subsets":[{"addresses":[{"ip":"10.0.0.1"},{"ip":"10.0.0.2"}]}]}'
+  exit 0
+fi
+
+[[ "$1" == "apply" && "$2" == "-f" && $# -eq 3 ]] || {
+  echo "unexpected fake kubectl invocation: $*" >&2
+  exit 2
+}
+
+if jq -e 'if .kind == "List" then any(.items[]?; .kind == "ValidatingWebhookConfiguration" and .metadata.name == "orka-admission") else false end' "$3" >/dev/null; then
+  [[ -e "${FAKE_KUBE_STATE}/admission-endpoints" ]] || { echo 'admission webhooks applied before ready endpoints' >&2; exit 38; }
+  [[ "$(grep -c '^smoke:' "${FAKE_KUBE_LOG}")" -ge 7 ]] || { echo 'admission webhooks applied before every handler smoke' >&2; exit 39; }
+  jq -e '
+    ([.items[] | select(.kind == "ValidatingAdmissionPolicy")] | length) == 0 and
+    ([.items[] | select(.kind == "ValidatingAdmissionPolicyBinding")] | length) == 0 and
+    ([.items[] | select(.kind == "ValidatingWebhookConfiguration")] | length) == 1 and
+    ([.items[] | select(.kind == "ValidatingWebhookConfiguration") | .webhooks[]] | length) == 7 and
+    ([.items[] | select(.kind == "ValidatingWebhookConfiguration") | .webhooks[].name] | unique | length) == 7 and
+    ([.items[] | select(.kind == "ValidatingWebhookConfiguration") | .webhooks[] |
+      (.failurePolicy == "Fail" and .sideEffects == "None" and
+       .clientConfig.service.name == "orka-admission" and
+       .clientConfig.service.namespace == "orka-system" and
+       (.clientConfig.caBundle | length > 0))] | all) and
+    ([.items[] | select(.kind == "ValidatingWebhookConfiguration") |
+      .metadata.annotations["cert-manager.io/inject-ca-from-secret"]] | all(. == null))
+    and
+    ([.items[] | select(.kind == "ValidatingWebhookConfiguration") | .webhooks[] |
+      select(.name == "taskexecutionauthority.core.orka.ai") | .matchConditions[] |
+      select(.name == "route-unless-controller-cleanup-safe") | .expression |
+      select(contains("orka.ai/cleanup") and
+        contains("oldObject.metadata.?finalizers.orValue([]).filter") and
+        contains("object.spec == oldObject.spec") and
+        contains("object.?status.orValue({}) == oldObject.?status.orValue({})"))] | length) == 1 and
+    ([.items[] | select(.kind == "ValidatingWebhookConfiguration") | .webhooks[] |
+      select(.name == "namespaceexecutionmode.core.orka.ai") |
+      select(.clientConfig.service.path == "/validate-v1-namespace-execution-mode")] | length) == 1 and
+    ([.items[] | select(.kind == "ValidatingWebhookConfiguration") | .webhooks[] |
+      select(.name == "sessionresolution.core.orka.ai" or
+             .name == "agentexecutionadjudication.core.orka.ai" or
+             .name == "agentexecutioncontrolpolicy.core.orka.ai")] | length) == 0
+  ' "$3" >/dev/null || { echo 'admission webhook wave was not static, fail-closed, and CA-pinned' >&2; exit 40; }
+  if [[ "${FAKE_KUBE_FAIL_MODE:-}" == "webhooks" && ! -e "${FAKE_KUBE_STATE}/failed-webhooks" ]]; then
+    : >"${FAKE_KUBE_STATE}/failed-webhooks"
+    printf 'fail-webhooks:orka-admission\n' >>"${FAKE_KUBE_LOG}"
+    exit 41
+  fi
+  : >"${FAKE_KUBE_STATE}/admission-webhooks"
+  printf 'webhooks:orka-admission\n' >>"${FAKE_KUBE_LOG}"
+  exit 0
+fi
+
+payload="$(manifest_json "$3")"
+summary="$(printf '%s\n' "${payload}" | jq -sc '
+  [.[] | if .kind == "List" then .items[] else . end] as $items |
+  {
+    namespace: (($items | map(select(.kind == "Namespace" and .metadata.name == "orka-system")) | .[0].metadata.name) // ""),
+    runtimeConfig: (($items | map(select(.kind == "ConfigMap" and .metadata.labels["orka.ai/acp-runtime-images"] == "true")) | .[0].metadata.name) // ""),
+    deploymentRef: (($items | map(select(.kind == "Deployment" and .metadata.name == "orka-controller-manager")) | .[0].spec.template.spec.containers[0].env[]? | select(.name == "ORKA_ACP_CODEX_RUNTIME_IMAGE") | .valueFrom.configMapKeyRef.name) // ""),
+    dependencyDeployments: ($items | map(select(
+      .kind == "Deployment" and
+      (.metadata.name == "orka-provider-auth-proxy" or
+       .metadata.name == "orka-scm-egress-proxy" or
+       .metadata.name == "orka-workspace-publisher")
+    ) | .metadata.name) | sort),
+    admissionDeployments: ($items | map(select(.kind == "Deployment" and .metadata.name == "orka-admission")) | length),
+    admissionServices: ($items | map(select(.kind == "Service" and .metadata.name == "orka-admission")) | length)
+  }
+')"
+namespace_name="$(jq -r .namespace <<<"${summary}")"
+config_name="$(jq -r .runtimeConfig <<<"${summary}")"
+deployment_ref="$(jq -r .deploymentRef <<<"${summary}")"
+dependency_deployments="$(jq -c .dependencyDeployments <<<"${summary}")"
+admission_deployments="$(jq -r .admissionDeployments <<<"${summary}")"
+admission_services="$(jq -r .admissionServices <<<"${summary}")"
+if [[ -n "${namespace_name}" && -z "${config_name}" && -z "${deployment_ref}" ]]; then
+  if [[ "${FAKE_KUBE_FAIL_MODE:-}" == "namespace" && ! -e "${FAKE_KUBE_STATE}/failed-namespace" ]]; then
+    : >"${FAKE_KUBE_STATE}/failed-namespace"
+    printf 'fail-namespace:%s\n' "${namespace_name}" >>"${FAKE_KUBE_LOG}"
+    exit 18
+  fi
+  : >"${FAKE_KUBE_STATE}/namespace"
+  printf 'namespace:%s\n' "${namespace_name}" >>"${FAKE_KUBE_LOG}"
+  exit 0
+fi
+
+if [[ "${admission_deployments}" != "0" || "${admission_services}" != "0" ]]; then
+  [[ "${admission_deployments}" == "1" && "${admission_services}" == "1" ]] || {
+    echo 'admission runtime wave was incomplete' >&2
+    exit 42
+  }
+  [[ -z "${deployment_ref}" ]] || {
+    echo 'admission runtime wave included the harness-v2 controller' >&2
+    exit 43
+  }
+  [[ -e "${FAKE_KUBE_STATE}/namespace" ]] || {
+    echo 'admission runtime applied before namespace' >&2
+    exit 44
+  }
+  if [[ "${FAKE_KUBE_FAIL_MODE:-}" == "admission" && ! -e "${FAKE_KUBE_STATE}/failed-admission" ]]; then
+    : >"${FAKE_KUBE_STATE}/failed-admission"
+    printf 'fail-admission:orka-admission\n' >>"${FAKE_KUBE_LOG}"
+    exit 45
+  fi
+  : >"${FAKE_KUBE_STATE}/admission-runtime"
+  printf 'admission-runtime:orka-admission\n' >>"${FAKE_KUBE_LOG}"
+  exit 0
+fi
+
+if [[ "${dependency_deployments}" != "[]" ]]; then
+  [[ "${dependency_deployments}" == '["orka-provider-auth-proxy","orka-scm-egress-proxy","orka-workspace-publisher"]' ]] || {
+    echo "dependency workload wave was incomplete: ${dependency_deployments}" >&2
+    exit 53
+  }
+  [[ -z "${deployment_ref}" && -z "${config_name}" ]] || {
+    echo 'dependency workload wave included the controller or runtime ConfigMap' >&2
+    exit 54
+  }
+  [[ -e "${FAKE_KUBE_STATE}/namespace" ]] || { echo 'dependency workloads applied before namespace' >&2; exit 55; }
+  [[ -s "${FAKE_KUBE_STATE}/snapshot-key" ]] || { echo 'dependency workloads applied before snapshot Secret' >&2; exit 56; }
+  [[ -e "${FAKE_KUBE_STATE}/admission-webhooks" ]] || {
+    echo 'dependency workloads applied before fail-closed admission webhooks' >&2
+    exit 57
+  }
+  if [[ "${FAKE_KUBE_FAIL_MODE:-}" == "dependencies" && ! -e "${FAKE_KUBE_STATE}/failed-dependencies" ]]; then
+    : >"${FAKE_KUBE_STATE}/failed-dependencies"
+    printf 'fail-dependencies:%s\n' "${dependency_deployments}" >>"${FAKE_KUBE_LOG}"
+    exit 58
+  fi
+  : >"${FAKE_KUBE_STATE}/dependency-workload"
+  printf 'dependencies:%s\n' "${dependency_deployments}" >>"${FAKE_KUBE_LOG}"
+  exit 0
+fi
+
+if [[ -z "${deployment_ref}" ]]; then
+  [[ -n "${config_name}" ]] || { echo 'runtime ConfigMap apply was not identifiable' >&2; exit 1; }
+  [[ -e "${FAKE_KUBE_STATE}/namespace" ]] || { echo 'runtime ConfigMap applied before namespace' >&2; exit 17; }
+  if [[ "${FAKE_KUBE_FAIL_MODE:-}" == "config" && ! -e "${FAKE_KUBE_STATE}/failed-config" ]]; then
+    : >"${FAKE_KUBE_STATE}/failed-config"
+    printf 'fail-config:%s\n' "${config_name}" >>"${FAKE_KUBE_LOG}"
+    exit 19
+  fi
+  : >"${FAKE_KUBE_STATE}/configmaps/${config_name}"
+  printf 'config:%s\n' "${config_name}" >>"${FAKE_KUBE_LOG}"
+  exit 0
+fi
+
+if [[ "${FAKE_KUBE_FAIL_MODE:-}" == "full" && ! -e "${FAKE_KUBE_STATE}/failed-full" ]]; then
+  : >"${FAKE_KUBE_STATE}/failed-full"
+  printf 'fail-full:%s\n' "${deployment_ref}" >>"${FAKE_KUBE_LOG}"
+  exit 20
+fi
+[[ -e "${FAKE_KUBE_STATE}/namespace" ]] || {
+  echo 'Deployment applied before namespace' >&2
+  exit 22
+}
+[[ -e "${FAKE_KUBE_STATE}/configmaps/${deployment_ref}" ]] || {
+  echo "Deployment referenced missing ConfigMap ${deployment_ref}" >&2
+  exit 21
+}
+[[ -s "${FAKE_KUBE_STATE}/snapshot-key" ]] || {
+  echo 'Deployment applied before snapshot Secret' >&2
+  exit 23
+}
+[[ -e "${FAKE_KUBE_STATE}/admission-runtime" ]] || {
+  echo 'harness-v2 controller applied before the admission runtime' >&2
+  exit 46
+}
+[[ -e "${FAKE_KUBE_STATE}/admission-webhooks" ]] || {
+  echo 'harness-v2 controller applied before fail-closed admission webhooks' >&2
+  exit 47
+}
+for dependency in orka-provider-auth-proxy orka-scm-egress-proxy orka-workspace-publisher; do
+  [[ -e "${FAKE_KUBE_STATE}/dependency-endpoint-${dependency}" ]] || {
+    echo "harness-v2 controller applied before ${dependency} became ready" >&2
+    exit 59
+  }
+done
+printf '%s\n' "${deployment_ref}" >"${FAKE_KUBE_STATE}/deployment-ref"
+: >"${FAKE_KUBE_STATE}/controller-workload"
+printf 'full:%s\n' "${deployment_ref}" >>"${FAKE_KUBE_LOG}"
+EOF_FAKE_KUBECTL
+chmod +x "${fake_bin}/kubectl"
+cat >"${fake_bin}/curl" <<'EOF_FAKE_CURL'
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+content_type=""
+request_file=""
+url=""
+while (( $# > 0 )); do
+  case "$1" in
+    --fail|--silent|--show-error)
+      shift
+      ;;
+    --noproxy|--max-time)
+      [[ $# -ge 2 ]] || { echo "missing curl argument for $1" >&2; exit 2; }
+      shift 2
+      ;;
+    --header)
+      [[ $# -ge 2 ]] || { echo 'missing curl header' >&2; exit 2; }
+      content_type="$2"
+      shift 2
+      ;;
+    --data-binary)
+      [[ $# -ge 2 && "$2" == @* ]] || { echo 'invalid curl data argument' >&2; exit 2; }
+      request_file="${2#@}"
+      shift 2
+      ;;
+    http://*)
+      url="$1"
+      shift
+      ;;
+    *)
+      echo "unexpected fake curl argument: $1" >&2
+      exit 2
+      ;;
+  esac
+done
+
+[[ "${content_type}" == "Content-Type: application/json" ]] || {
+  echo 'admission smoke did not send application/json' >&2
+  exit 43
+}
+[[ -f "${request_file}" ]] || { echo 'admission smoke request file missing' >&2; exit 2; }
+if [[ ! "${url}" =~ ^http://127\.0\.0\.1:[0-9]+/api/v1/namespaces/orka-system/services/https:orka-admission:443/proxy(/.*)$ ]]; then
+  echo "invalid admission smoke URL: ${url}" >&2
+  exit 2
+fi
+handler="${BASH_REMATCH[1]}"
+[[ -e "${FAKE_KUBE_STATE}/admission-endpoints" ]] || { echo 'handler smoke ran before ready endpoints' >&2; exit 34; }
+if [[ "${FAKE_KUBE_FAIL_MODE:-}" == "smoke" && ! -e "${FAKE_KUBE_STATE}/failed-smoke" ]]; then
+  : >"${FAKE_KUBE_STATE}/failed-smoke"
+  printf 'fail-smoke:%s\n' "${handler}" >>"${FAKE_KUBE_LOG}"
+  exit 35
+fi
+uid="$(jq -r '.request.uid' "${request_file}")"
+jq -n --arg uid "${uid}" '{apiVersion:"admission.k8s.io/v1",kind:"AdmissionReview",response:{uid:$uid,allowed:false,status:{message:"smoke reached handler"}}}'
+printf 'smoke:%s\n' "${handler}" >>"${FAKE_KUBE_LOG}"
+EOF_FAKE_CURL
+chmod +x "${fake_bin}/curl"
+export PATH="${fake_bin}:${PATH}"
+
+assert_converged() {
+  local state_dir="$1"
+  local admission_line admission_rollout_line smoke_line webhooks_line dependency_line
+  local dependency_first_rollout_line dependency_last_rollout_line
+  local dependency_first_endpoint_line dependency_last_endpoint_line
+  local controller_line controller_rollout_line reference dependency
+  local converged_start converged_log
+  reference="$(cat "${state_dir}/deployment-ref")"
+  [[ -e "${state_dir}/namespace" ]]
+  [[ -e "${state_dir}/configmaps/${reference}" ]]
+  [[ -s "${state_dir}/snapshot-key" ]]
+  [[ -e "${state_dir}/admission-runtime" ]]
+  [[ -e "${state_dir}/admission-endpoints" ]]
+  [[ -e "${state_dir}/admission-webhooks" ]]
+  [[ -e "${state_dir}/dependency-workload" ]]
+  for dependency in orka-provider-auth-proxy orka-scm-egress-proxy orka-workspace-publisher; do
+    [[ -e "${state_dir}/dependency-rollout-${dependency}" ]]
+    [[ -e "${state_dir}/dependency-endpoint-${dependency}" ]]
+  done
+  [[ -e "${state_dir}/controller-workload" ]]
+  [[ -e "${state_dir}/controller-ready" ]]
+  [[ "$(grep -c '^proxy-start$' "${state_dir}/apply.log")" -ge 1 ]]
+  [[ "$(grep -c '^proxy-start$' "${state_dir}/apply.log")" == "$(grep -c '^proxy-stop$' "${state_dir}/apply.log")" ]]
+  [[ "$(grep -c '^secret:agent-execution-snapshot-key$' "${state_dir}/apply.log")" == "1" ]]
+  [[ "$(grep '^smoke:' "${state_dir}/apply.log" | sort -u | wc -l | tr -d '[:space:]')" == "7" ]]
+  [[ "$(grep -c '^webhooks:orka-admission$' "${state_dir}/apply.log")" -ge 1 ]]
+  # Recovery scenarios run the apply script twice into one shared log, so
+  # phase ordering is asserted on the final converged invocation, which always
+  # starts at its namespace claim. The aborted invocation's partial ordering is
+  # enforced by the fake kubectl state guards instead.
+  converged_start="$(grep -nE '^(namespace|namespace-metadata):' "${state_dir}/apply.log" | tail -1 | cut -d: -f1)"
+  [[ -n "${converged_start}" ]]
+  converged_log="${state_dir}/apply-converged.log"
+  tail -n "+${converged_start}" "${state_dir}/apply.log" >"${converged_log}"
+  admission_line="$(grep -n '^admission-runtime:orka-admission$' "${converged_log}" | head -1 | cut -d: -f1)"
+  admission_rollout_line="$(grep -n '^rollout:orka-admission$' "${converged_log}" | head -1 | cut -d: -f1)"
+  smoke_line="$(grep -n '^smoke:' "${converged_log}" | head -1 | cut -d: -f1)"
+  webhooks_line="$(grep -n '^webhooks:orka-admission$' "${converged_log}" | head -1 | cut -d: -f1)"
+  dependency_line="$(grep -n '^dependencies:' "${converged_log}" | head -1 | cut -d: -f1)"
+  dependency_first_rollout_line="$(grep -nE '^rollout:(orka-provider-auth-proxy|orka-scm-egress-proxy|orka-workspace-publisher)$' "${converged_log}" | head -1 | cut -d: -f1)"
+  dependency_last_rollout_line="$(grep -nE '^rollout:(orka-provider-auth-proxy|orka-scm-egress-proxy|orka-workspace-publisher)$' "${converged_log}" | tail -1 | cut -d: -f1)"
+  dependency_first_endpoint_line="$(grep -nE '^endpoint:(orka-provider-auth-proxy|orka-scm-egress-proxy|orka-workspace-publisher)$' "${converged_log}" | head -1 | cut -d: -f1)"
+  dependency_last_endpoint_line="$(grep -nE '^endpoint:(orka-provider-auth-proxy|orka-scm-egress-proxy|orka-workspace-publisher)$' "${converged_log}" | tail -1 | cut -d: -f1)"
+  controller_line="$(grep -n '^full:' "${converged_log}" | head -1 | cut -d: -f1)"
+  controller_rollout_line="$(grep -n '^rollout:orka-controller-manager$' "${converged_log}" | head -1 | cut -d: -f1)"
+  (( admission_line < admission_rollout_line ))
+  (( admission_rollout_line < smoke_line ))
+  (( smoke_line < webhooks_line ))
+  (( webhooks_line < dependency_line ))
+  (( dependency_line < dependency_first_rollout_line ))
+  (( dependency_last_rollout_line < dependency_first_endpoint_line ))
+  (( dependency_last_endpoint_line < controller_line ))
+  (( controller_line < controller_rollout_line ))
+}
+
+run_apply_scenario() {
+  local mode="$1"
+  local state_dir="${test_root}/state-${mode:-success}"
+  local log_file="${state_dir}/apply.log"
+  mkdir -p "${state_dir}"
+  : >"${log_file}"
+
+  if [[ -n "${mode}" ]]; then
+    if FAKE_KUBE_STATE="${state_dir}" FAKE_KUBE_LOG="${log_file}" FAKE_KUBE_FAIL_MODE="${mode}" \
+      "${apply_script}" "${overlay}" "${kustomize}" "${fake_bin}/kubectl" >/dev/null 2>&1; then
+      echo "expected injected ${mode} apply failure" >&2
+      exit 1
+    fi
+  fi
+  FAKE_KUBE_STATE="${state_dir}" FAKE_KUBE_LOG="${log_file}" FAKE_KUBE_FAIL_MODE="" \
+    "${apply_script}" "${overlay}" "${kustomize}" "${fake_bin}/kubectl" >/dev/null
+  assert_converged "${state_dir}"
+}
+
+run_apply_scenario ""
+run_apply_scenario namespace
+run_apply_scenario config
+run_apply_scenario admission
+run_apply_scenario dependencies
+run_apply_scenario dependency-rollout
+run_apply_scenario dependency-endpoints
+run_apply_scenario full
+run_apply_scenario rollout
+run_apply_scenario controller-rollout
+run_apply_scenario endpoints
+run_apply_scenario smoke
+run_apply_scenario webhooks
+
+expected_existing_key="MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY="
+existing_state="${test_root}/state-existing-key"
+mkdir -p "${existing_state}"
+printf '%s' "${expected_existing_key}" >"${existing_state}/snapshot-key"
+cp "${existing_state}/snapshot-key" "${existing_state}/snapshot-key.before"
+: >"${existing_state}/apply.log"
+FAKE_KUBE_STATE="${existing_state}" FAKE_KUBE_LOG="${existing_state}/apply.log" FAKE_KUBE_FAIL_MODE="" \
+  FAKE_EXISTING_NAMESPACE_MODE="harness-v2" FAKE_EXISTING_CONTROLLER_MODE="static-v2" \
+  "${apply_script}" "${overlay}" "${kustomize}" "${fake_bin}/kubectl" >/dev/null
+cmp -s "${existing_state}/snapshot-key.before" "${existing_state}/snapshot-key"
+if grep -q '^secret:' "${existing_state}/apply.log"; then
+  echo 'existing snapshot key was recreated' >&2
+  exit 1
+fi
+
+for existing_controller_mode in legacy-v2 static-v1 wrong-scope duplicate-mode; do
+  controller_state="${test_root}/state-controller-${existing_controller_mode}"
+  mkdir -p "${controller_state}"
+  : >"${controller_state}/apply.log"
+  if controller_output="$(
+    FAKE_KUBE_STATE="${controller_state}" FAKE_KUBE_LOG="${controller_state}/apply.log" \
+      FAKE_KUBE_FAIL_MODE="" FAKE_EXISTING_NAMESPACE_MODE="harness-v2" \
+      FAKE_EXISTING_CONTROLLER_MODE="${existing_controller_mode}" \
+      "${apply_script}" "${overlay}" "${kustomize}" "${fake_bin}/kubectl" 2>&1
+  )"; then
+    echo "${existing_controller_mode} controller unexpectedly passed the static upgrade preflight" >&2
+    exit 1
+  fi
+  grep -F 'cannot be upgraded in place' <<<"${controller_output}" >/dev/null
+  if [[ -s "${controller_state}/apply.log" ]]; then
+    echo "${existing_controller_mode} controller caused writes before the upgrade preflight failed" >&2
+    exit 1
+  fi
+done
+
+for existing_namespace_mode in unlabeled harness-v1; do
+  namespace_state="${test_root}/state-namespace-${existing_namespace_mode}"
+  mkdir -p "${namespace_state}"
+  : >"${namespace_state}/apply.log"
+  if namespace_output="$(
+    FAKE_KUBE_STATE="${namespace_state}" FAKE_KUBE_LOG="${namespace_state}/apply.log" \
+      FAKE_KUBE_FAIL_MODE="" FAKE_EXISTING_NAMESPACE_MODE="${existing_namespace_mode}" \
+      FAKE_EXISTING_CONTROLLER_MODE="none" \
+      "${apply_script}" "${overlay}" "${kustomize}" "${fake_bin}/kubectl" 2>&1
+  )"; then
+    echo "${existing_namespace_mode} namespace unexpectedly passed the static adoption preflight" >&2
+    exit 1
+  fi
+  grep -F 'cannot be adopted in place' <<<"${namespace_output}" >/dev/null
+  if [[ -s "${namespace_state}/apply.log" ]]; then
+    echo "${existing_namespace_mode} namespace caused writes before the adoption preflight failed" >&2
+    exit 1
+  fi
+done
+
+deleted_controller_state="${test_root}/state-deleted-static-controller"
+mkdir -p "${deleted_controller_state}"
+: >"${deleted_controller_state}/apply.log"
+FAKE_KUBE_STATE="${deleted_controller_state}" FAKE_KUBE_LOG="${deleted_controller_state}/apply.log" \
+  FAKE_KUBE_FAIL_MODE="" FAKE_EXISTING_NAMESPACE_MODE="harness-v2" \
+  FAKE_EXISTING_CONTROLLER_MODE="none" \
+  "${apply_script}" "${overlay}" "${kustomize}" "${fake_bin}/kubectl" >/dev/null
+assert_converged "${deleted_controller_state}"
+
+newline_key_state="${test_root}/state-base64-newline-key"
+mkdir -p "${newline_key_state}"
+printf '%s\n' "${expected_existing_key}" >"${newline_key_state}/snapshot-key"
+cp "${newline_key_state}/snapshot-key" "${newline_key_state}/snapshot-key.before"
+: >"${newline_key_state}/apply.log"
+FAKE_KUBE_STATE="${newline_key_state}" FAKE_KUBE_LOG="${newline_key_state}/apply.log" FAKE_KUBE_FAIL_MODE="" \
+  "${apply_script}" "${overlay}" "${kustomize}" "${fake_bin}/kubectl" >/dev/null
+cmp -s "${newline_key_state}/snapshot-key.before" "${newline_key_state}/snapshot-key"
+
+raw_whitespace_key_state="${test_root}/state-raw-whitespace-key"
+mkdir -p "${raw_whitespace_key_state}"
+printf ' %030d\n' 0 >"${raw_whitespace_key_state}/snapshot-key"
+[[ "$(wc -c <"${raw_whitespace_key_state}/snapshot-key" | tr -d '[:space:]')" == "32" ]]
+cp "${raw_whitespace_key_state}/snapshot-key" "${raw_whitespace_key_state}/snapshot-key.before"
+: >"${raw_whitespace_key_state}/apply.log"
+FAKE_KUBE_STATE="${raw_whitespace_key_state}" FAKE_KUBE_LOG="${raw_whitespace_key_state}/apply.log" FAKE_KUBE_FAIL_MODE="" \
+  "${apply_script}" "${overlay}" "${kustomize}" "${fake_bin}/kubectl" >/dev/null
+cmp -s "${raw_whitespace_key_state}/snapshot-key.before" "${raw_whitespace_key_state}/snapshot-key"
+
+for tls_mode in missing missing-ca invalid-cert invalid-key invalid-ca mismatched-key expired future wrong-san wrong-ca; do
+  tls_state="${test_root}/state-tls-${tls_mode}"
+  mkdir -p "${tls_state}"
+  : >"${tls_state}/apply.log"
+  if tls_output="$(FAKE_KUBE_STATE="${tls_state}" FAKE_KUBE_LOG="${tls_state}/apply.log" FAKE_KUBE_FAIL_MODE="" FAKE_TLS_MODE="${tls_mode}" \
+    "${apply_script}" "${overlay}" "${kustomize}" "${fake_bin}/kubectl" 2>&1)"; then
+    echo "${tls_mode} admission TLS Secret unexpectedly passed deployment preflight" >&2
+    exit 1
+  fi
+  grep -F 'orka-admission-tls' <<<"${tls_output}" >/dev/null
+  if grep -Eq '^(config|admission-runtime|dependencies|full|smoke|webhooks):' "${tls_state}/apply.log"; then
+    echo 'workloads or admission webhooks were applied after TLS validation failed' >&2
+    exit 1
+  fi
+done
+
+malformed_sentinel='malformed-snapshot-key-SENTINEL'
+malformed_state="${test_root}/state-malformed-key"
+mkdir -p "${malformed_state}"
+printf '%s' "${malformed_sentinel}" >"${malformed_state}/snapshot-key"
+: >"${malformed_state}/apply.log"
+if malformed_output="$(FAKE_KUBE_STATE="${malformed_state}" FAKE_KUBE_LOG="${malformed_state}/apply.log" FAKE_KUBE_FAIL_MODE="" \
+  "${apply_script}" "${overlay}" "${kustomize}" "${fake_bin}/kubectl" 2>&1)"; then
+  echo 'malformed snapshot key unexpectedly passed deployment preflight' >&2
+  exit 1
+fi
+grep -F 'must contain exactly 32 raw bytes or their base64 encoding' <<<"${malformed_output}" >/dev/null
+if grep -F "${malformed_sentinel}" <<<"${malformed_output}" >/dev/null; then
+  echo 'snapshot key material leaked in deployment output' >&2
+  exit 1
+fi
+if grep -Eq '^(config|admission-runtime|dependencies|full):' "${malformed_state}/apply.log"; then
+  echo 'workload prerequisites were applied after snapshot-key validation failed' >&2
+  exit 1
+fi
+
+for static_mode in \
+  missing-namespace \
+  wrong-namespace-label \
+  missing-controller \
+  duplicate-controller \
+  missing-controller-mode \
+  duplicate-controller-mode \
+  wrong-controller-mode \
+  missing-watch-namespace \
+  wrong-watch-namespace \
+  legacy-controller-flag; do
+  static_state="${test_root}/state-static-${static_mode}"
+  mkdir -p "${static_state}"
+  : >"${static_state}/apply.log"
+  if FAKE_KUBE_STATE="${static_state}" FAKE_KUBE_LOG="${static_state}/apply.log" FAKE_KUBE_FAIL_MODE="" FAKE_STATIC_MODE="${static_mode}" \
+    "${apply_script}" "${overlay}" "${kustomize}" "${fake_bin}/kubectl" >/dev/null 2>&1; then
+    echo "${static_mode} static controller manifest unexpectedly passed deployment preflight" >&2
+    exit 1
+  fi
+  [[ ! -s "${static_state}/apply.log" ]]
+done
+
+grep -F 'scripts/apply-acp-production.sh' "${root}/Makefile" >/dev/null
+
+printf '%s\n' 'ok - ACP deployment activates admission, waits for publisher/proxy readiness, and only then rolls one static harness-v2 controller'
diff --git a/scripts/tests/acp-secret-mounts-test.sh b/scripts/tests/acp-secret-mounts-test.sh
new file mode 100755
index 000000000..9e97daaa8
--- /dev/null
+++ b/scripts/tests/acp-secret-mounts-test.sh
@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+kustomize="${KUSTOMIZE:-${root}/bin/kustomize}"
+helm="${HELM:-helm}"
+
+for command in "${kustomize}" "${helm}" jq ruby; do
+  command -v "${command}" >/dev/null 2>&1 || {
+    echo "required command not found: ${command}" >&2
+    exit 1
+  }
+done
+
+yaml_to_json() {
+  ruby -rjson -ryaml -e '
+    YAML.load_stream(STDIN.read).each do |document|
+      puts JSON.generate(document) unless document.nil?
+    end
+  '
+}
+
+assert_secret_mounts() {
+  local label="$1"
+  jq -se --arg label "${label}" '
+    ([.[] | if .kind == "List" then .items[] else . end]) as $items |
+    ($items | map(select(.kind == "Deployment" and .metadata.name == "orka-scm-egress-proxy"))) as $scm |
+    ($items | map(select(.kind == "Deployment" and .metadata.name == "orka-workspace-publisher"))) as $publisher |
+    ($scm | length) == 1 and
+    ($publisher | length) == 1 and
+    ($scm[0] |
+      any(.spec.template.spec.containers[]?.volumeMounts[]?;
+        .name == "auth" and
+        .mountPath == "/var/run/secrets/orka/scm-egress/token" and
+        .subPath == "token" and
+        .readOnly == true
+      ) and
+      any(.spec.template.spec.volumes[]?;
+        .name == "auth" and .secret.defaultMode == 288
+      )
+    ) and
+    ($publisher[0] |
+      any(.spec.template.spec.containers[]?.volumeMounts[]?;
+        .name == "publisher-auth" and
+        .mountPath == "/var/run/orka/publisher-auth/controller-token" and
+        .subPath == "controller-token" and
+        .readOnly == true
+      ) and
+      any(.spec.template.spec.containers[]?.volumeMounts[]?;
+        .name == "publisher-auth" and
+        .mountPath == "/var/run/orka/publisher-auth/operation-capability-secret" and
+        .subPath == "operation-capability-secret" and
+        .readOnly == true
+      ) and
+      any(.spec.template.spec.volumes[]?;
+        .name == "publisher-auth"
+        and .secret.defaultMode == 288
+        and ((.secret.items // []) | map({key, path}) | sort_by(.path)) == [
+          {key:"controller-token", path:"controller-token"},
+          {key:"operation-capability-secret", path:"operation-capability-secret"}
+        ]
+      ) and
+      any(.spec.template.spec.containers[]?.env[]?;
+        .name == "ORKA_PUBLISHER_TEMP_ROOT" and
+        .value == "/tmp/orka-workspace-publisher/runtime"
+      )
+    )
+  ' >/dev/null || {
+    echo "${label} does not expose regular-file Secret mounts and a process-owned temporary root" >&2
+    return 1
+  }
+}
+
+"${kustomize}" build "${root}/config/acp-production" \
+  | yaml_to_json \
+  | assert_secret_mounts "Kustomize production overlay"
+
+"${helm}" template orka "${root}/manifest_staging/charts/orka" \
+  --namespace orka-system \
+  --set-string controller.mode=harness-v2 \
+  --set-string controller.watchNamespace=orka-system \
+  --set publisher.enabled=true \
+  --set providerProxy.enabled=true \
+  --set scmEgressProxy.enabled=true \
+  --set controller.image.repository=docker.io/sozercan/orka \
+  --set controller.image.digest=sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa \
+  --set-string controller.agentExecutionSnapshot.existingSecret=agent-execution-snapshot-key \
+  --set-string controller.agentExecutionSnapshot.key=key \
+  --set-string webhooks.tls.existingSecret=controller-webhook-tls \
+  --set-string webhooks.caBundle=Y2E= \
+  --set publisher.image.repository=docker.io/sozercan/orka-workspace-publisher \
+  --set publisher.image.digest=sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb \
+  | yaml_to_json \
+  | assert_secret_mounts "Helm chart"
+
+
+printf '%s\n' 'ok - ACP Secret mounts are regular-file compatible in Kustomize and Helm renders'
diff --git a/scripts/tests/agent-substrate-e2e-hardening-test.sh b/scripts/tests/agent-substrate-e2e-hardening-test.sh
new file mode 100755
index 000000000..e7216e79d
--- /dev/null
+++ b/scripts/tests/agent-substrate-e2e-hardening-test.sh
@@ -0,0 +1,308 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+e2e="${root}/scripts/agent-substrate-e2e.sh"
+test_root="$(mktemp -d "${TMPDIR:-/tmp}/agent-substrate-e2e-hardening.XXXXXX")"
+trap 'rm -rf "${test_root}"' EXIT
+
+bootstrap_value="$(printf '%s' 'override-bootstrap:@[]{}*?+/=,;&%$()!' '\path with arbitrary punctuation')"
+export SUBSTRATE_BOOTSTRAP_TOKEN="${bootstrap_value}"
+# shellcheck source=scripts/agent-substrate-e2e.sh
+KEEP_CLUSTER=1 source "${e2e}"
+trap - EXIT ERR
+trap 'rm -rf "${test_root}"' EXIT
+
+fail() {
+  echo "not ok - $*" >&2
+  exit 1
+}
+
+assert_redacted() {
+  local description="$1"
+  local sensitive_value="$2"
+  local input="$3"
+  local output
+  output="$(printf '%s\n' "${input}" | redact)"
+  if grep -Fq -- "${sensitive_value}" <<<"${output}"; then
+    fail "${description} leaked its credential value"
+  fi
+  grep -Fq '[REDACTED]' <<<"${output}" || fail "${description} omitted the redaction marker"
+}
+
+basic_value="$(printf '%s' 'Basic ' 'fixture:@[]{}()!?+/=,;:\path')"
+custom_value="$(printf '%s' 'Custom-Scheme ' 'value with spaces @[]{}*?+/=,;:\and-more')"
+txn_value="$(printf '%s' 'txn:@[]{}*?+/=,;:' ' value with spaces')"
+proxy_value="$(printf '%s' 'Digest username="tester", response="@[]{}*?+/=,;:\\"')"
+api_key_value="$(printf '%s' 'key:@[]{}*?+/=,;:' ' with spaces')"
+cookie_value="$(printf '%s' 'session=@[]{}*?+/=,;:' '; preference=still-sensitive')"
+compound_token_value="$(printf '%s' 'custom-scheme ' '@[]{}*?+/=,;&%$()! with spaces')"
+
+assert_redacted 'Basic Authorization header' "${basic_value}" "Authorization: ${basic_value}"
+assert_redacted 'custom Authorization scheme' "${custom_value}" "authorization: ${custom_value}"
+assert_redacted 'Proxy-Authorization header' "${proxy_value}" "Proxy-Authorization: ${proxy_value}"
+assert_redacted 'transaction token header' "${txn_value}" "Txn-Token: ${txn_value}"
+assert_redacted 'API key header' "${api_key_value}" "X-API-Key: ${api_key_value}"
+assert_redacted 'cookie header' "${cookie_value}" "Cookie: ${cookie_value}"
+assert_redacted 'snake-case token JSON field' "${compound_token_value}" "{\"access_token\":\"${compound_token_value}\"}"
+assert_redacted 'snake-case token assignment' "${compound_token_value}" "refresh_token=${compound_token_value}"
+assert_redacted 'camel-case token assignment' "${compound_token_value}" "idToken=${compound_token_value}"
+assert_redacted \
+  'JSON Authorization field' \
+  "${custom_value}" \
+  "{\"Authorization\":\"${custom_value}\",\"diagnostic\":\"public\"}"
+assert_redacted \
+  'unstructured overridden bootstrap value' \
+  "${bootstrap_value}" \
+  "diagnostic bootstrap value=${bootstrap_value} after-value"
+assert_redacted \
+  'bootstrap environment assignment' \
+  "${bootstrap_value}" \
+  "ORKA_WORKSPACE_BOOTSTRAP_TOKEN=${bootstrap_value} after-value"
+
+if grep -Fq -- "${bootstrap_value}" <(
+  printf 'prefix %s suffix\n' "${bootstrap_value}" | redact
+); then
+  fail 'literal bootstrap redaction treated punctuation as a pattern'
+fi
+
+KUBECTL_ATE_MODE=''
+kubectl_ate() {
+  case "${KUBECTL_ATE_MODE}" in
+    actor-not-found)
+      printf 'Error: failed to get actor: rpc error: code = NotFound desc = Actor focused-actor not found\n' >&2
+      return 1
+      ;;
+    unrelated-not-found)
+      printf 'Error: rpc error: code = NotFound desc = Worker focused-actor not found\n' >&2
+      return 1
+      ;;
+    wrong-actor-not-found)
+      printf 'Error: rpc error: code = NotFound desc = Actor different-actor not found\n' >&2
+      return 1
+      ;;
+    generic-api-failure)
+      printf 'Error: failed to connect to ate-api-server\n' >&2
+      return 7
+      ;;
+    empty-success)
+      printf '{"actors":[]}\n'
+      ;;
+    empty-object-success)
+      printf '{}\n'
+      ;;
+    present-success)
+      printf '{"actors":[{"actorId":"focused-actor"}]}\n'
+      ;;
+    malformed-success)
+      printf 'temporarily unavailable\n'
+      ;;
+    *)
+      return 99
+      ;;
+  esac
+}
+
+expect_absent_success() {
+  local mode="$1"
+  local output
+  KUBECTL_ATE_MODE="${mode}"
+  if ! output="$(wait_actor_absent focused-actor -1 2>&1)"; then
+    fail "wait_actor_absent rejected ${mode}: ${output}"
+  fi
+  grep -Fq 'actor/focused-actor: absent' <<<"${output}" || fail "${mode} did not report absence"
+}
+
+expect_absent_failure() {
+  local mode="$1"
+  local expected="$2"
+  local output
+  KUBECTL_ATE_MODE="${mode}"
+  if output="$(wait_actor_absent focused-actor -1 2>&1)"; then
+    fail "wait_actor_absent accepted ${mode} as absence"
+  fi
+  grep -Fq -- "${expected}" <<<"${output}" || fail "${mode} did not retain its failure classification"
+}
+
+expect_absent_success actor-not-found
+expect_absent_success empty-success
+expect_absent_success empty-object-success
+expect_absent_failure unrelated-not-found 'without an actor NotFound response'
+expect_absent_failure wrong-actor-not-found 'without an actor NotFound response'
+expect_absent_failure generic-api-failure 'kubectl-ate failed with exit 7'
+expect_absent_failure present-success 'actor query succeeded with 1 result(s)'
+expect_absent_failure malformed-success 'actor query succeeded with an invalid response'
+
+# Actor STATUS_RUNNING may race the router's upstream readiness after worker
+# loss or runsc recovery. The handoff write must retry transient HTTP failures
+# without presenting response bodies or credentials.
+handoff_curl_calls=0
+handoff_saw_connect_timeout=0
+handoff_saw_max_time=0
+curl() {
+  handoff_curl_calls=$((handoff_curl_calls + 1))
+  while [[ "$#" -gt 0 ]]; do
+    case "$1" in
+      --connect-timeout)
+        handoff_saw_connect_timeout=1
+        shift
+        ;;
+      --max-time)
+        handoff_saw_max_time=1
+        shift
+        ;;
+    esac
+    shift
+  done
+  [[ "${handoff_curl_calls}" -ge 2 ]]
+}
+sleep() {
+  :
+}
+if ! write_workspace_handoff_token 'http://127.0.0.1:18082/v1/files' 'fixture.actors.resources.substrate.ate.dev' 'Zml4dHVyZQ==' 2; then
+  fail 'workspace handoff token write did not retry a transient router failure'
+fi
+[[ "${handoff_curl_calls}" == '2' ]] || fail "workspace handoff retry count = ${handoff_curl_calls}, want 2"
+[[ "${handoff_saw_connect_timeout}" == '1' ]] || fail 'workspace handoff retry omitted a connect timeout'
+[[ "${handoff_saw_max_time}" == '1' ]] || fail 'workspace handoff retry omitted an overall request timeout'
+unset -f curl sleep
+
+exec_counter_file="${test_root}/exec-curl-count"
+exec_connect_file="${test_root}/exec-connect-timeout"
+exec_max_file="${test_root}/exec-max-time"
+curl() {
+  local count=0
+  if [[ -f "${exec_counter_file}" ]]; then
+    count="$(cat "${exec_counter_file}")"
+  fi
+  count=$((count + 1))
+  printf '%s\n' "${count}" >"${exec_counter_file}"
+  while [[ "$#" -gt 0 ]]; do
+    case "$1" in
+      --connect-timeout)
+        : >"${exec_connect_file}"
+        shift
+        ;;
+      --max-time)
+        : >"${exec_max_file}"
+        shift
+        ;;
+    esac
+    shift
+  done
+  if [[ "${count}" -lt 2 ]]; then
+    return 22
+  fi
+  printf '%s\n' '{"exitCode":0,"stdout":"direct-ok","stderr":""}'
+}
+sleep() {
+  :
+}
+exec_response="$(run_idempotent_workspace_exec \
+  'http://127.0.0.1:18082/v1/exec' 'fixture.actors.resources.substrate.ate.dev' \
+  'fixture-handoff-token' 'fixture-request-id' 2)" || fail 'idempotent workspace exec did not retry a transient router failure'
+exec_curl_calls="$(cat "${exec_counter_file}")"
+[[ "${exec_curl_calls}" == '2' ]] || fail "workspace exec retry count = ${exec_curl_calls}, want 2"
+[[ -f "${exec_connect_file}" ]] || fail 'workspace exec retry omitted a connect timeout'
+[[ -f "${exec_max_file}" ]] || fail 'workspace exec retry omitted an overall request timeout'
+[[ "$(jq -r '.stdout' <<<"${exec_response}")" == 'direct-ok' ]] || fail 'workspace exec retry returned the wrong response'
+unset -f curl sleep
+
+# The live router assertion must inspect private raw logs before presentation
+# redaction so conventional Authorization leaks cannot be erased before grep.
+grep -F 'raw_log_file="${TMP_ROOT}/atenet-router-raw-${request_id}.log"' "${e2e}" >/dev/null
+grep -F 'grep -Fq -- "${handoff_token}" "${raw_log_file}"' "${e2e}" >/dev/null
+router_check="$(awk '/^verify_router_request_metadata_allowlist\(\)/,/^}/' "${e2e}")"
+if grep -Fq 'run_redacted' <<<"${router_check}"; then
+  fail 'router leak assertion redacts logs before checking raw credentials'
+fi
+
+# The direct Substrate deployment intentionally omits Workspace/Publisher. Its
+# strategic merge patch must also remove the inherited endpoint environment
+# variable or controller startup fails closed while negotiating capabilities
+# against a Service that does not exist in this cluster.
+publisher_disable_patch="$(grep -A1 -F 'name: "ORKA_WORKSPACE_PUBLISHER_URL",' "${e2e}" || true)"
+grep -Fq 'name: "ORKA_WORKSPACE_PUBLISHER_URL",' <<<"${publisher_disable_patch}" || \
+  fail 'Substrate controller patch does not target the inherited Publisher URL'
+grep -Fq '"$patch": "delete"' <<<"${publisher_disable_patch}" || \
+  fail 'Substrate controller patch does not disable the omitted Publisher client'
+
+# Substrate is a harness-v2 workspace-provider evaluation, not a third
+# controller mode. Claim the namespace before applying the statically configured
+# v2 workload and keep every required controller identity flag in the final
+# strategic patch.
+namespace_identity_line="$(grep -nF 'scripts/lib/ensure-static-mode-namespace.sh' "${e2e}" | head -n1 | cut -d: -f1 || true)"
+controller_apply_line="$(grep -nF '"${ROOT_DIR}/bin/kustomize" build "${tmp_config}/config/acp-workload" | kubectl apply -f -' "${e2e}" | head -n1 | cut -d: -f1 || true)"
+[[ "${namespace_identity_line}" =~ ^[0-9]+$ ]] || fail 'Substrate deploy does not establish the fail-closed Orka namespace identity'
+[[ "${controller_apply_line}" =~ ^[0-9]+$ ]] || fail 'Substrate deploy does not apply the controller workload'
+(( namespace_identity_line < controller_apply_line )) || \
+  fail 'Substrate deploy must establish the namespace identity before the harness-v2 controller workload'
+for required_arg in \
+  '"--agent-execution-snapshot-key-file=/var/run/orka/agent-execution-snapshot/key"' \
+  '"--controller-mode=harness-v2"' \
+  '"--watch-namespace=orka-system"' \
+  '"--enforce-namespace-isolation=true"' \
+  '"--execution-mode-controller-usernames=system:serviceaccount:orka-system:orka-controller-manager"'; do
+  grep -Fq -- "${required_arg}" "${e2e}" || fail "Substrate controller patch omits ${required_arg}"
+done
+if grep -Fq -- '"--acp-runtime-enabled=false"' "${e2e}"; then
+  fail 'Substrate deploy still passes the removed dynamic ACP mode flag'
+fi
+
+# The harness-v2 ACP dispatcher requires the encrypted execution-snapshot key.
+# Provision it before applying the workload so the Substrate-only rollout can
+# activate its immutable snapshot store.
+grep -F 'dd if=/dev/urandom bs=32 count=1' "${e2e}" | \
+  grep -F '>"${capability_dir}/snapshot-key"' >/dev/null || \
+  fail 'Substrate deploy does not generate a 32-byte execution-snapshot key'
+grep -F 'create secret generic agent-execution-snapshot-key' "${e2e}" >/dev/null || \
+  fail 'Substrate deploy does not provision the execution-snapshot Secret'
+grep -F -- '--from-file="${snapshot_key_field}=${capability_dir}/snapshot-key"' "${e2e}" >/dev/null || \
+  fail 'Substrate execution-snapshot Secret does not use the required key field'
+
+# The extended path now installs a fail-once executable on the assigned worker,
+# requires the patched verified-presence retry log, and restores the real runsc.
+grep -F 'install_runsc_delete_failure_injector "${worker_name}"' "${e2e}" >/dev/null
+grep -F 'node_injector_path="/root/orka-runsc-delete-failure-injector-$$-${RANDOM}"' "${e2e}" >/dev/null
+grep -F 'cp "${incoming}" "${path}"' "${e2e}" >/dev/null
+grep -F 'runsc delete did not remove the container; retrying' "${e2e}" >/dev/null
+grep -F 'exercise_runsc_delete_retry_recovery' "${e2e}" >/dev/null
+
+TMP_ROOT="${test_root}"
+injector="${test_root}/runsc-delete-failure-injector"
+build_runsc_delete_failure_injector "${injector}" "$(go env GOARCH)" "$(go env GOOS)"
+[[ -x "${injector}" ]] || fail 'runsc delete failure injector did not compile as an executable'
+runsc_real_log="${test_root}/runsc-real.log"
+cat >"${injector}.orka-real" <<'STUB'
+#!/usr/bin/env bash
+printf '%s\n' "$*" >>"${RUNSC_REAL_LOG:?}"
+STUB
+chmod +x "${injector}.orka-real"
+if RUNSC_REAL_LOG="${runsc_real_log}" "${injector}" -root fixture delete -force workspace >/dev/null 2>&1; then
+  fail 'runsc delete failure injector did not fail the first delete call'
+else
+  injector_rc=$?
+fi
+[[ "${injector_rc}" == "86" ]] || fail "first injected delete exited ${injector_rc}, want 86"
+[[ -f "${injector}.orka-delete-failure-observed" ]] || fail 'runsc delete failure injector omitted its marker'
+[[ ! -s "${runsc_real_log}" ]] || fail 'first injected delete reached the real runsc executable'
+RUNSC_REAL_LOG="${runsc_real_log}" "${injector}" -root fixture list --quiet
+RUNSC_REAL_LOG="${runsc_real_log}" "${injector}" -root fixture delete -force workspace
+grep -Fx -- '-root fixture list --quiet' "${runsc_real_log}" >/dev/null || fail 'injector did not delegate runsc list'
+grep -Fx -- '-root fixture delete -force workspace' "${runsc_real_log}" >/dev/null || fail 'injector did not delegate the retry'
+
+docker() {
+  return 42
+}
+RUNSC_DELETE_INJECTION_NODE='fixture-node'
+RUNSC_DELETE_INJECTION_PATH='/fixture/runsc'
+if restore_runsc_delete_injector; then
+  fail 'runsc restoration reported success after docker failed'
+fi
+[[ "${RUNSC_DELETE_INJECTION_NODE}" == 'fixture-node' ]] || fail 'failed restoration forgot its target node'
+[[ "${RUNSC_DELETE_INJECTION_PATH}" == '/fixture/runsc' ]] || fail 'failed restoration forgot its target path'
+unset -f docker
+RUNSC_DELETE_INJECTION_NODE=''
+RUNSC_DELETE_INJECTION_PATH=''
+
+printf '%s\n' 'ok - Agent Substrate E2E absence checks, diagnostic redaction, and live retry injection are hardened'
diff --git a/scripts/tests/agent-substrate-patches-test.sh b/scripts/tests/agent-substrate-patches-test.sh
new file mode 100755
index 000000000..74c3c43da
--- /dev/null
+++ b/scripts/tests/agent-substrate-patches-test.sh
@@ -0,0 +1,326 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+e2e="${root}/scripts/agent-substrate-e2e.sh"
+installer="${root}/hack/demos/cluster/install-substrate.sh"
+router_patch="${root}/hack/agent-substrate/atenet-router-authorization-redaction.patch"
+ateom_patch="${root}/hack/agent-substrate/ateom-runsc-delete-recovery.patch"
+
+bash -n "${e2e}" "${installer}"
+for patch in "${router_patch}" "${ateom_patch}"; do
+  [[ -s "${patch}" ]] || {
+    echo "missing reviewed patch: ${patch}" >&2
+    exit 1
+  }
+  git apply --numstat "${patch}" >/dev/null
+done
+router_paths="$(git apply --numstat "${router_patch}" | cut -f3- | LC_ALL=C sort)"
+expected_router_paths="$(printf '%s\n' \
+  cmd/servers/atenet/app/router/envoyrunner.go \
+  cmd/servers/atenet/app/router/extproc_in.go \
+  cmd/servers/atenet/app/router/extproc_in_test.go \
+  manifests/ate-install/atenet-router.yaml | LC_ALL=C sort)"
+[[ "${router_paths}" == "${expected_router_paths}" ]] || {
+  echo "router patch paths differ from the reviewed scope" >&2
+  exit 1
+}
+ateom_paths="$(git apply --numstat "${ateom_patch}" | cut -f3- | LC_ALL=C sort)"
+expected_ateom_paths="$(printf '%s\n' \
+  cmd/servers/ateom-gvisor/ateom-gvisor.go \
+  cmd/servers/ateom-gvisor/runsc.go \
+  cmd/servers/ateom-gvisor/runsc_test.go | LC_ALL=C sort)"
+[[ "${ateom_paths}" == "${expected_ateom_paths}" ]] || {
+  echo "ateom patch paths differ from the reviewed scope" >&2
+  exit 1
+}
+
+grep -F 'SUBSTRATE_ATENET_EXTPROC_IN_BLOB="317511845fef40b7602861383f7664e915215a69"' "${e2e}" >/dev/null
+grep -F 'SUBSTRATE_ATENET_ENVOY_RUNNER_BLOB="8d38be29f09a7ce23886b71a051586354c8413e5"' "${e2e}" >/dev/null
+grep -F 'SUBSTRATE_ATENET_MANIFEST_BLOB="e309cad0a2e8435d1ed8dfd51ce347ab4f5a7521"' "${e2e}" >/dev/null
+grep -F 'SUBSTRATE_ATEOM_RUNSC_BLOB="6db499a549f2b6987a867b144e8d6b3828cad9ff"' "${e2e}" >/dev/null
+grep -F 'apply_substrate_atenet_authorization_redaction_patch' "${e2e}" >/dev/null
+grep -F 'apply_substrate_ateom_delete_recovery_patch' "${e2e}" >/dev/null
+grep -F 'verify_router_request_metadata_allowlist' "${e2e}" >/dev/null
+grep -F 'X-Request-ID: ${request_id}' "${e2e}" >/dev/null
+grep -F 'case ":method", ":path", ":authority", "host", "x-request-id":' "${router_patch}" >/dev/null
+grep -F 'if !isSafeRequestMetadataHeader(k) {' "${router_patch}" >/dev/null
+grep -F 'url.ParseRequestURI(value)' "${router_patch}" >/dev/null
+grep -F 'credential headers and query values are omitted' "${router_patch}" >/dev/null
+grep -F 'TestRequestMetadataStringOnlyIncludesSafeRoutingMetadata' "${router_patch}" >/dev/null
+for covered_value in Authorization Proxy-Authorization Txn-Token Cookie X-API-Key RawValue test-token-placeholder; do
+  grep -F "${covered_value}" "${router_patch}" >/dev/null || {
+    echo "router patch lacks ${covered_value} coverage" >&2
+    exit 1
+  }
+done
+if grep -Eq '^\+.*(redactedHeaderValue|sanitizeRequestHeaderValue)' "${router_patch}"; then
+  echo 'router patch uses denylist-based credential logging' >&2
+  exit 1
+fi
+grep -F 'upstream:info,router:info,ext_proc:info' "${router_patch}" >/dev/null
+if grep -Fq 'upstream:debug,router:debug,ext_proc:debug' <(grep '^+' "${router_patch}" || true); then
+  echo 'router patch adds credential-bearing Envoy debug logging' >&2
+  exit 1
+fi
+grep -F 'cmd/servers/atenet/app/router/envoyrunner.go' "${e2e}" >/dev/null
+grep -F 'manifests/ate-install/atenet-router.yaml' "${e2e}" >/dev/null
+grep -F 'runscDeleteAttempts   = 4' "${ateom_patch}" >/dev/null
+grep -F 'failed closed while verifying container absence' "${ateom_patch}" >/dev/null
+grep -F 'runsc_test.go' "${ateom_patch}" >/dev/null
+grep -F 'Restore the worker Pod network before fallible runsc cleanup' "${ateom_patch}" >/dev/null
+grep -F 'kind export kubeconfig --name "${KIND_CLUSTER}" --kubeconfig "${SUBSTRATE_KUBECONFIG}"' "${installer}" >/dev/null
+grep -F 'chmod 0600 "${SUBSTRATE_KUBECONFIG}"' "${installer}" >/dev/null
+grep -F 'direct_evaluation_hardening_matches' "${installer}" >/dev/null
+grep -F 'DIRECT_EVAL_MARKER_SCHEMA_VERSION="4"' "${installer}" >/dev/null
+grep -F 'DIRECT_EVAL_PATCH_SET_VERSION=' "${installer}" >/dev/null
+grep -F '.data["substrate-commit"] == $substrate_commit' "${installer}" >/dev/null
+grep -F '.data["reviewed-patch-set"] == $reviewed_patch_set' "${installer}" >/dev/null
+grep -F 'git hash-object "${patch_path}"' "${installer}" >/dev/null
+grep -F 'choose DEMO_CLUSTER_REUSE=recreate or cancel' "${installer}" >/dev/null
+reuse_kubeconfig_line="$(grep -nF 'activate_scoped_kubeconfig' "${installer}" | sed -n '2p' | cut -d: -f1)"
+cluster_health_line="$(grep -nF 'health_summary="$(cluster_health)"' "${installer}" | cut -d: -f1)"
+[[ "${reuse_kubeconfig_line}" =~ ^[1-9][0-9]*$ && "${cluster_health_line}" =~ ^[1-9][0-9]*$ ]]
+(( reuse_kubeconfig_line < cluster_health_line )) || {
+  echo 'installer checks retained cluster health before activating its scoped kubeconfig' >&2
+  exit 1
+}
+
+# Exercise retained-cluster marker matching with command stubs. A marker written
+# before the Envoy info-level fix carried only the old pinned-hardening string;
+# it must fail closed rather than silently accepting stale router logging.
+marker_fixture="$(mktemp -d "${TMPDIR:-/tmp}/agent-substrate-marker-test.XXXXXX")"
+fake_bin="${marker_fixture}/bin"
+mkdir -p "${fake_bin}" "${marker_fixture}/gopath/bin" "${marker_fixture}/home"
+cat >"${fake_bin}/go" <<'EOF'
+#!/usr/bin/env bash
+set -Eeuo pipefail
+if [[ "${1:-}" == "env" && "${2:-}" == "GOPATH" ]]; then
+  printf '%s\n' "${FAKE_GOPATH}"
+  exit 0
+fi
+exit 2
+EOF
+cat >"${fake_bin}/docker" <<'EOF'
+#!/usr/bin/env bash
+set -Eeuo pipefail
+[[ "${1:-}" == "info" ]]
+EOF
+cat >"${fake_bin}/kind" <<'EOF'
+#!/usr/bin/env bash
+set -Eeuo pipefail
+if [[ "${1:-}" == "get" && "${2:-}" == "clusters" ]]; then
+  printf '%s\n' "${KIND_CLUSTER}"
+  exit 0
+fi
+if [[ "${1:-}" == "export" && "${2:-}" == "kubeconfig" ]]; then
+  kubeconfig=""
+  while (($#)); do
+    if [[ "$1" == "--kubeconfig" ]]; then
+      shift
+      kubeconfig="$1"
+      break
+    fi
+    shift
+  done
+  [[ -n "${kubeconfig}" ]]
+  mkdir -p "$(dirname "${kubeconfig}")"
+  : >"${kubeconfig}"
+  exit 0
+fi
+exit 2
+EOF
+cat >"${fake_bin}/kubectl" <<'EOF'
+#!/usr/bin/env bash
+set -Eeuo pipefail
+args=" $* "
+case "${args}" in
+  *" get nodes "*)
+    printf 'True'
+    ;;
+  *" get deploy orka-controller-manager "*)
+    printf '1/1'
+    ;;
+  *" get pods --no-headers "*)
+    printf 'ate-worker-0 1/1 Running 0 1m\n'
+    ;;
+  *" get configmap "*" -o json "*)
+    cat "${FAKE_MARKER_JSON_FILE}"
+    ;;
+  *" get configmap "*)
+    ;;
+  *" create configmap "*)
+    printf 'apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: marker\n'
+    ;;
+  *" apply -f - "*)
+    cat >/dev/null
+    ;;
+  *)
+    printf 'unexpected fake kubectl invocation: %s\n' "$*" >&2
+    exit 2
+    ;;
+esac
+EOF
+for command_name in ko curl; do
+  cat >"${fake_bin}/${command_name}" <<'EOF'
+#!/usr/bin/env bash
+exit 0
+EOF
+done
+chmod +x "${fake_bin}"/*
+
+marker_schema="$(sed -n 's/^DIRECT_EVAL_MARKER_SCHEMA_VERSION="\([^"]*\)"/\1/p' "${installer}")"
+patch_set_version="$(sed -n 's/^DIRECT_EVAL_PATCH_SET_VERSION="\([^"]*\)"/\1/p' "${installer}")"
+pinned_ref="$(sed -n 's/^SUBSTRATE_REF="${SUBSTRATE_REF:-\([^"]*\)}"/\1/p' "${installer}")"
+hardening="$(sed -n 's/^DIRECT_EVAL_HARDENING="\([^"]*\)"/\1/p' "${installer}")"
+[[ -n "${marker_schema}" && -n "${patch_set_version}" && -n "${pinned_ref}" && -n "${hardening}" ]]
+reviewed_patch_set="$({
+  for relative_path in \
+    hack/agent-substrate/atelet-root-supervisor-capabilities.patch \
+    hack/agent-substrate/atenet-router-authorization-redaction.patch \
+    hack/agent-substrate/ateom-runsc-delete-recovery.patch; do
+    printf '%s git-blob:%s\n' "${relative_path}" "$(git hash-object "${root}/${relative_path}")"
+  done
+})"
+
+legacy_marker="${marker_fixture}/legacy.json"
+wrong_ref_marker="${marker_fixture}/wrong-ref.json"
+stale_version_marker="${marker_fixture}/stale-version.json"
+stale_marker="${marker_fixture}/stale.json"
+current_marker="${marker_fixture}/current.json"
+jq -n '{data: {"pinned-hardening": "authorization-redaction,runsc-delete-recovery"}}' >"${legacy_marker}"
+jq -n \
+  --arg marker_schema "${marker_schema}" \
+  --arg substrate_commit "0000000000000000000000000000000000000000" \
+  --arg patch_set_version "${patch_set_version}" \
+  --arg reviewed_patch_set "${reviewed_patch_set}" \
+  --arg hardening "${hardening}" \
+  '{data: {
+    "marker-schema-version": $marker_schema,
+    "substrate-commit": $substrate_commit,
+    "reviewed-patch-set-version": $patch_set_version,
+    "reviewed-patch-set": $reviewed_patch_set,
+    "pinned-hardening": $hardening
+  }}' >"${wrong_ref_marker}"
+jq -n \
+  --arg marker_schema "${marker_schema}" \
+  --arg substrate_commit "${pinned_ref}" \
+  --arg patch_set_version "stale-version" \
+  --arg reviewed_patch_set "${reviewed_patch_set}" \
+  --arg hardening "${hardening}" \
+  '{data: {
+    "marker-schema-version": $marker_schema,
+    "substrate-commit": $substrate_commit,
+    "reviewed-patch-set-version": $patch_set_version,
+    "reviewed-patch-set": $reviewed_patch_set,
+    "pinned-hardening": $hardening
+  }}' >"${stale_version_marker}"
+jq -n \
+  --arg marker_schema "${marker_schema}" \
+  --arg substrate_commit "${pinned_ref}" \
+  --arg patch_set_version "${patch_set_version}" \
+  --arg reviewed_patch_set "${reviewed_patch_set}-stale" \
+  --arg hardening "${hardening}" \
+  '{data: {
+    "marker-schema-version": $marker_schema,
+    "substrate-commit": $substrate_commit,
+    "reviewed-patch-set-version": $patch_set_version,
+    "reviewed-patch-set": $reviewed_patch_set,
+    "pinned-hardening": $hardening
+  }}' >"${stale_marker}"
+jq -n \
+  --arg marker_schema "${marker_schema}" \
+  --arg substrate_commit "${pinned_ref}" \
+  --arg patch_set_version "${patch_set_version}" \
+  --arg reviewed_patch_set "${reviewed_patch_set}" \
+  --arg hardening "${hardening}" \
+  '{data: {
+    "marker-schema-version": $marker_schema,
+    "substrate-commit": $substrate_commit,
+    "reviewed-patch-set-version": $patch_set_version,
+    "reviewed-patch-set": $reviewed_patch_set,
+    "pinned-hardening": $hardening
+  }}' >"${current_marker}"
+
+run_installer_reuse() {
+  local marker_file="$1"
+  local substrate_ref="${2:-${pinned_ref}}"
+  env \
+    PATH="${fake_bin}:${PATH}" \
+    HOME="${marker_fixture}/home" \
+    FAKE_GOPATH="${marker_fixture}/gopath" \
+    FAKE_MARKER_JSON_FILE="${marker_file}" \
+    SUBSTRATE_REF="${substrate_ref}" \
+    KIND_CLUSTER=marker-test-cluster \
+    SUBSTRATE_KUBECONFIG="${marker_fixture}/kubeconfig" \
+    DEMO_CLUSTER_REUSE=reuse \
+    AGENTIC=0 \
+    bash "${installer}"
+}
+
+if mutable_ref_output="$(run_installer_reuse "${current_marker}" main 2>&1)"; then
+  echo 'installer accepted a mutable Substrate branch for retained-cluster identity' >&2
+  exit 1
+fi
+grep -F 'must be an immutable full 40-hex commit SHA' <<<"${mutable_ref_output}" >/dev/null
+
+if legacy_output="$(run_installer_reuse "${legacy_marker}" 2>&1)"; then
+  echo 'installer reused a marker from before the Envoy info-level fix' >&2
+  exit 1
+fi
+grep -F 'does not match marker schema' <<<"${legacy_output}" >/dev/null
+
+if wrong_ref_output="$(run_installer_reuse "${wrong_ref_marker}" 2>&1)"; then
+  echo 'installer reused a cluster created from a different Substrate commit' >&2
+  exit 1
+fi
+grep -F 'does not match marker schema' <<<"${wrong_ref_output}" >/dev/null
+
+if stale_version_output="$(run_installer_reuse "${stale_version_marker}" 2>&1)"; then
+  echo 'installer reused a cluster with a stale reviewed patch-set version' >&2
+  exit 1
+fi
+grep -F 'does not match marker schema' <<<"${stale_version_output}" >/dev/null
+
+if stale_output="$(run_installer_reuse "${stale_marker}" 2>&1)"; then
+  echo 'installer reused a cluster with a stale reviewed patch fingerprint' >&2
+  exit 1
+fi
+grep -F 'does not match marker schema' <<<"${stale_output}" >/dev/null
+
+current_output="$(run_installer_reuse "${current_marker}" 2>&1)"
+grep -F 'Reusing existing marked cluster' <<<"${current_output}" >/dev/null
+uppercase_output="$(run_installer_reuse "${current_marker}" "$(printf '%s' "${pinned_ref}" | tr '[:lower:]' '[:upper:]')" 2>&1)"
+grep -F 'Reusing existing marked cluster' <<<"${uppercase_output}" >/dev/null
+rm -rf "${marker_fixture}"
+
+# Exercise the generic blob and patch guards without a network checkout.
+# shellcheck source=scripts/agent-substrate-e2e.sh
+KEEP_CLUSTER=1 source "${e2e}"
+trap - EXIT ERR
+fixture="$(mktemp -d "${TMPDIR:-/tmp}/agent-substrate-patch-test.XXXXXX")"
+git -C "${fixture}" init -q
+git -C "${fixture}" config user.name test
+git -C "${fixture}" config user.email test@example.invalid
+printf 'before\n' >"${fixture}/source.txt"
+git -C "${fixture}" add source.txt
+git -C "${fixture}" commit -q -m fixture
+blob="$(git -C "${fixture}" rev-parse HEAD:source.txt)"
+# shellcheck disable=SC2034 # Consumed by functions sourced from the E2E script.
+SUBSTRATE_DIR="${fixture}"
+# shellcheck disable=SC2034 # Consumed by functions sourced from the E2E script.
+SUBSTRATE_REF="fixture"
+verify_substrate_source_blob source.txt "${blob}" fixture
+if blob_error="$(verify_substrate_source_blob source.txt 0000000000000000000000000000000000000000 fixture 2>&1)"; then
+  echo 'source-blob guard accepted an unreviewed object' >&2
+  exit 1
+fi
+grep -F 'has unreviewed fixture context' <<<"${blob_error}" >/dev/null
+
+printf 'after\n' >"${fixture}/source.txt"
+git -C "${fixture}" diff -- source.txt >"${fixture}/fixture.patch"
+git -C "${fixture}" checkout -- source.txt
+apply_reviewed_substrate_patch fixture "${fixture}/fixture.patch" source.txt
+grep -Fx 'after' "${fixture}/source.txt" >/dev/null
+
+printf '%s\n' 'ok - Agent Substrate patches are source-pinned, scope-bounded, and fail closed'
diff --git a/scripts/tests/ensure-static-mode-namespace-test.sh b/scripts/tests/ensure-static-mode-namespace-test.sh
new file mode 100755
index 000000000..e2636afb7
--- /dev/null
+++ b/scripts/tests/ensure-static-mode-namespace-test.sh
@@ -0,0 +1,249 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+helper="${root}/scripts/lib/ensure-static-mode-namespace.sh"
+test_root="$(mktemp -d "${TMPDIR:-/tmp}/ensure-static-mode-namespace-test.XXXXXX")"
+cleanup() {
+  rm -rf -- "${test_root}"
+}
+trap cleanup EXIT
+
+fail() {
+  echo "$*" >&2
+  exit 1
+}
+
+[[ -x "${helper}" ]] || fail "static-mode namespace helper is not executable: ${helper}"
+
+fake_kubectl="${test_root}/kubectl"
+cat >"${fake_kubectl}" <<'EOF_FAKE_KUBECTL'
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+: "${FAKE_NAMESPACE_STATE:?}"
+: "${FAKE_CALL_LOG:?}"
+: "${FAKE_WRITE_LOG:?}"
+: "${FAKE_EXPECTED_NAMESPACE:?}"
+: "${FAKE_EXPECTED_MODE:?}"
+
+printf '%s\n' "$*" >>"${FAKE_CALL_LOG}"
+
+namespace_json() {
+  local mode="$1"
+  jq -n \
+    --arg namespace "${FAKE_EXPECTED_NAMESPACE}" \
+    --arg mode "${mode}" '{
+      apiVersion: "v1",
+      kind: "Namespace",
+      metadata: {
+        name: $namespace,
+        labels: {"orka.ai/controller-mode": $mode}
+      }
+    }'
+}
+
+if [[ "$1" == "get" && "$2" == "namespace" && "$3" == "${FAKE_EXPECTED_NAMESPACE}" ]]; then
+  [[ " $* " == *" --ignore-not-found "* && " $* " == *" -o json "* ]] || {
+    echo "namespace GET is not fail-closed and machine-readable: $*" >&2
+    exit 2
+  }
+  [[ "${FAKE_GET_ERROR:-false}" != "true" ]] || exit 17
+  [[ ! -e "${FAKE_NAMESPACE_STATE}" ]] || cat "${FAKE_NAMESPACE_STATE}"
+  exit 0
+fi
+
+if [[ "$1" == "create" ]]; then
+  manifest=""
+  args=("$@")
+  for ((i = 0; i < ${#args[@]}; i++)); do
+    if [[ "${args[$i]}" == "-f" && $((i + 1)) -lt ${#args[@]} ]]; then
+      manifest="${args[$((i + 1))]}"
+      break
+    fi
+  done
+  [[ -n "${manifest}" && "${manifest}" != "-" && -f "${manifest}" ]] || {
+    echo "namespace create must use a concrete manifest: $*" >&2
+    exit 2
+  }
+  jq -e \
+    --arg namespace "${FAKE_EXPECTED_NAMESPACE}" \
+    --arg mode "${FAKE_EXPECTED_MODE}" '
+      .apiVersion == "v1" and
+      .kind == "Namespace" and
+      .metadata.name == $namespace and
+      .metadata.labels["orka.ai/controller-mode"] == $mode
+    ' "${manifest}" >/dev/null || {
+      echo "namespace was not created with its static identity atomically" >&2
+      exit 2
+    }
+
+  case "${FAKE_CREATE_BEHAVIOR:-success}" in
+    success)
+      cp "${manifest}" "${FAKE_NAMESPACE_STATE}"
+      printf 'create\n' >>"${FAKE_WRITE_LOG}"
+      cat "${FAKE_NAMESPACE_STATE}"
+      exit 0
+      ;;
+    race-exact)
+      namespace_json "${FAKE_EXPECTED_MODE}" >"${FAKE_NAMESPACE_STATE}"
+      exit 1
+      ;;
+    race-opposite)
+      if [[ "${FAKE_EXPECTED_MODE}" == "harness-v1" ]]; then
+        namespace_json harness-v2 >"${FAKE_NAMESPACE_STATE}"
+      else
+        namespace_json harness-v1 >"${FAKE_NAMESPACE_STATE}"
+      fi
+      exit 1
+      ;;
+    failure)
+      exit 1
+      ;;
+    *)
+      echo "unknown FAKE_CREATE_BEHAVIOR: ${FAKE_CREATE_BEHAVIOR}" >&2
+      exit 2
+      ;;
+  esac
+fi
+
+echo "unexpected fake kubectl invocation: $*" >&2
+exit 2
+EOF_FAKE_KUBECTL
+chmod +x "${fake_kubectl}"
+
+scenario_dir=""
+namespace_state=""
+call_log=""
+write_log=""
+
+reset_scenario() {
+  local name="$1"
+  scenario_dir="${test_root}/${name}"
+  mkdir -p "${scenario_dir}"
+  namespace_state="${scenario_dir}/namespace.json"
+  call_log="${scenario_dir}/calls.log"
+  write_log="${scenario_dir}/writes.log"
+  : >"${call_log}"
+  : >"${write_log}"
+}
+
+write_namespace() {
+  local namespace="$1"
+  local mode="$2"
+  jq -n --arg namespace "${namespace}" --arg mode "${mode}" '{
+    apiVersion: "v1",
+    kind: "Namespace",
+    metadata: {
+      name: $namespace,
+      labels: {
+        "orka.ai/controller-mode": $mode,
+        "unrelated.example/retained": "true"
+      }
+    }
+  }' >"${namespace_state}"
+}
+
+run_helper() {
+  local namespace="$1"
+  local mode="$2"
+  shift 2
+  env \
+    FAKE_NAMESPACE_STATE="${namespace_state}" \
+    FAKE_CALL_LOG="${call_log}" \
+    FAKE_WRITE_LOG="${write_log}" \
+    FAKE_EXPECTED_NAMESPACE="${namespace}" \
+    FAKE_EXPECTED_MODE="${mode}" \
+    "$@" \
+    "${helper}" "${fake_kubectl}" "${namespace}" "${mode}"
+}
+
+expect_failure() {
+  local expected="$1"
+  shift
+  local output
+  if output="$("$@" 2>&1)"; then
+    fail "helper unexpectedly succeeded: ${expected}"
+  fi
+  grep -F "${expected}" <<<"${output}" >/dev/null || {
+    printf 'expected failure not found: %s\n%s\n' "${expected}" "${output}" >&2
+    exit 1
+  }
+}
+
+reset_scenario absent
+run_helper orka-v2-system harness-v2 >/dev/null
+[[ "$(<"${write_log}")" == "create" ]] || fail "fresh namespace was not created exactly once"
+jq -e '.metadata.labels["orka.ai/controller-mode"] == "harness-v2"' "${namespace_state}" >/dev/null
+run_helper orka-v2-system harness-v2 >/dev/null
+[[ "$(wc -l <"${write_log}" | tr -d '[:space:]')" == "1" ]] || fail "same-mode retry rewrote the namespace"
+
+reset_scenario absent-v1
+run_helper orka-v1-system harness-v1 >/dev/null
+jq -e '.metadata.labels["orka.ai/controller-mode"] == "harness-v1"' "${namespace_state}" >/dev/null
+
+reset_scenario exact-existing
+write_namespace orka-v2-system harness-v2
+run_helper orka-v2-system harness-v2 >/dev/null
+[[ ! -s "${write_log}" ]] || fail "exact existing namespace was rewritten"
+
+for existing_mode in unlabeled opposite; do
+  reset_scenario "existing-${existing_mode}"
+  if [[ "${existing_mode}" == "unlabeled" ]]; then
+    jq -n '{apiVersion:"v1",kind:"Namespace",metadata:{name:"orka-v2-system",labels:{}}}' >"${namespace_state}"
+  else
+    write_namespace orka-v2-system harness-v1
+  fi
+  expect_failure "cannot be adopted in place" run_helper orka-v2-system harness-v2
+  [[ ! -s "${write_log}" ]] || fail "${existing_mode} namespace caused a write"
+done
+
+reset_scenario malformed
+printf '%s\n' '{not-json' >"${namespace_state}"
+expect_failure "cannot be adopted in place" run_helper orka-v2-system harness-v2
+[[ ! -s "${write_log}" ]] || fail "malformed namespace response caused a write"
+
+reset_scenario wrong-name
+write_namespace another-system harness-v2
+expect_failure "cannot be adopted in place" run_helper orka-v2-system harness-v2
+[[ ! -s "${write_log}" ]] || fail "wrong-name namespace response caused a write"
+
+reset_scenario duplicate-response
+write_namespace orka-v2-system harness-v2
+cp "${namespace_state}" "${scenario_dir}/one.json"
+printf '\n' >>"${namespace_state}"
+cat "${scenario_dir}/one.json" >>"${namespace_state}"
+expect_failure "cannot be adopted in place" run_helper orka-v2-system harness-v2
+[[ ! -s "${write_log}" ]] || fail "duplicate namespace response caused a write"
+
+reset_scenario get-error
+expect_failure "unable to inspect namespace orka-v2-system" \
+  run_helper orka-v2-system harness-v2 FAKE_GET_ERROR=true
+[[ ! -s "${write_log}" ]] || fail "namespace GET failure caused a write"
+
+reset_scenario create-race-exact
+run_helper orka-v2-system harness-v2 FAKE_CREATE_BEHAVIOR=race-exact >/dev/null
+[[ ! -s "${write_log}" ]] || fail "exact create race recorded a helper write"
+[[ "$(grep -c '^create ' "${call_log}")" == "1" ]] || fail "exact create race did not attempt one create"
+[[ "$(grep -c '^get namespace ' "${call_log}")" == "2" ]] || fail "exact create race was not reread"
+
+reset_scenario create-race-opposite
+expect_failure "cannot be adopted in place" \
+  run_helper orka-v2-system harness-v2 FAKE_CREATE_BEHAVIOR=race-opposite
+[[ ! -s "${write_log}" ]] || fail "opposite create race recorded a helper write"
+
+reset_scenario create-failure
+expect_failure "unable to create namespace orka-v2-system" \
+  run_helper orka-v2-system harness-v2 FAKE_CREATE_BEHAVIOR=failure
+[[ ! -s "${write_log}" ]] || fail "failed namespace create recorded a write"
+
+reset_scenario invalid-mode
+expect_failure "controller mode must be harness-v1 or harness-v2" \
+  run_helper orka-v2-system dual
+[[ ! -s "${call_log}" ]] || fail "invalid controller mode reached kubectl"
+
+reset_scenario empty-namespace
+expect_failure "namespace must be non-empty" run_helper "" harness-v2
+[[ ! -s "${call_log}" ]] || fail "empty namespace reached kubectl"
+
+printf '%s\n' 'ok - static-mode namespace identity is atomic, immutable, idempotent, and create-race safe'
diff --git a/scripts/tests/live-acp-runtime-e2e-test.sh b/scripts/tests/live-acp-runtime-e2e-test.sh
new file mode 100755
index 000000000..d55a264cd
--- /dev/null
+++ b/scripts/tests/live-acp-runtime-e2e-test.sh
@@ -0,0 +1,759 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+script="${root}/scripts/live-acp-runtime-e2e.sh"
+export ACP_E2E_OPENCODE_CONTEXT_WINDOW=32768
+export ACP_E2E_OPENCODE_MAX_TOKENS=4096
+body="$(awk '/^delete_test_namespace_now\(\) \{/,/^\}$/' "${script}")"
+
+line_of() {
+  local pattern="$1"
+  grep -nF -- "${pattern}" <<<"${body}" | head -1 | cut -d: -f1
+}
+
+tasks_line="$(line_of 'settle_and_delete_test_tasks')"
+agents_line="$(line_of 'delete_test_agents')"
+pools_line="$(line_of 'stop_and_delete_test_runtimepools')"
+children_line="$(line_of "runtime children for \${namespace} to be removed")"
+claims_line="$(line_of 'delete_test_branchclaims')"
+namespace_line="$(line_of "delete namespace \"\${namespace}\"")"
+
+for value in "${tasks_line}" "${agents_line}" "${pools_line}" "${children_line}" "${claims_line}" "${namespace_line}"; do
+  [[ "${value}" =~ ^[1-9][0-9]*$ ]] || {
+    echo "cleanup ordering assertion could not locate every required barrier" >&2
+    exit 1
+  }
+done
+
+(( tasks_line < agents_line ))
+(( agents_line < pools_line ))
+(( pools_line < children_line ))
+(( children_line < claims_line ))
+(( claims_line < namespace_line ))
+
+if grep -F -- '--subresource=status' "${script}" >/dev/null; then
+  echo 'live ACP validator still mutates controller-owned Task status' >&2
+  exit 1
+fi
+grep -F 'task_observer_finalizer="acp-e2e.orka.ai/cancellation-observer"' "${script}" >/dev/null
+grep -F 'Task/${name} controller-owned deletion barrier' "${script}" >/dev/null
+grep -F 'release_task_observer_finalizer "${name}" "${uid}"' "${script}" >/dev/null
+grep -F "Task/\${name} finalizer completion" "${script}" >/dev/null
+grep -F "patch runtimepool \"\${name}\" --type=merge" "${script}" >/dev/null
+grep -F '.spec.ownerUid' "${script}" >/dev/null
+
+printf '%s\n' 'ok - release-gate cleanup uses deletion and controller-owned settlement before namespace teardown'
+
+
+dry_run_body="$(awk '/^assert_dry_run_rejected\(\) \{/,/^\}$/' "${script}")"
+eval "${dry_run_body}"
+temp_root="$(mktemp -d "${TMPDIR:-/tmp}/orka-acp-url-test.XXXXXX")"
+trap 'rm -rf "${temp_root}"' EXIT
+manifest_file="${temp_root}/manifest.json"
+printf '{}\n' >"${manifest_file}"
+k() {
+  printf '%s\n' 'The Task is invalid: spec.workspace: gitRepo must not contain embedded credentials, query parameters, or fragments'
+  return 1
+}
+die() {
+  printf 'unexpected die: %s\n' "$*" >&2
+  return 1
+}
+redact() { cat; }
+trap 'echo "unexpected ERR trap from expected dry-run rejection" >&2; exit 99' ERR
+assert_dry_run_rejected "${manifest_file}" 'spec.workspace' 'gitRepo must not contain embedded credentials, query parameters, or fragments'
+trap - ERR
+
+printf '%s\n' 'ok - expected server dry-run rejection does not fire the global ERR trap'
+
+
+opencode_model_body="$(awk '
+  /^if \[\[ -n "\$\{ACP_E2E_OPENCODE_MODEL:-\}" \]\]; then$/ { capture=1 }
+  capture && /^concurrency_tasks=/ { exit }
+  capture { print }
+' "${script}")"
+[[ -n "${opencode_model_body}" ]] || {
+  echo "OpenCode model normalization block is missing" >&2
+  exit 1
+}
+(
+  ACP_E2E_OPENCODE_MODEL="gpt-test"
+  codex_model="ignored"
+  eval "${opencode_model_body}"
+  [[ "${opencode_model}" == "openai/gpt-test" ]]
+)
+(
+  ACP_E2E_OPENCODE_MODEL="anthropic/claude-test"
+  codex_model="ignored"
+  eval "${opencode_model_body}"
+  [[ "${opencode_model}" == "anthropic/claude-test" ]]
+)
+
+printf '%s\n' 'ok - OpenCode model overrides normalize bare values and preserve provider-qualified values'
+
+grep -F 'ACP_E2E_OPENCODE_CONTEXT_WINDOW must be a positive integer' "${script}" >/dev/null
+grep -F 'ACP_E2E_OPENCODE_MAX_TOKENS must be a positive integer' "${script}" >/dev/null
+grep -F '{name:$model,contextWindow:$opencodeContextWindow,maxTokens:$opencodeMaxTokens}' "${script}" >/dev/null
+printf '%s
+' 'ok - OpenCode live Agents pin reviewed context and output limits'
+
+
+
+is_uint_body="$(awk '/^is_uint\(\) \{/,/^\}$/' "${script}")"
+transient_body="$(awk '/^pool_transient_counters_zero\(\) \{/,/^\}$/' "${script}")"
+eval "${is_uint_body}"
+eval "${transient_body}"
+namespace="test-namespace"
+pool_payload=''
+k() {
+  printf '%s\n' "${pool_payload}"
+}
+
+pool_payload='{"status":{"capacity":{"maxResidentSessions":10,"maxRunningPrompts":4,"residentSessions":1,"liveDescendants":1}}}'
+pool_transient_counters_zero test-pool 1
+
+pool_payload='{"status":{"capacity":{"maxResidentSessions":10,"maxRunningPrompts":4,"residentSessions":1,"liveDescendants":2}}}'
+if pool_transient_counters_zero test-pool 1; then
+  echo "transient quiescence accepted descendants not bounded by resident Sessions" >&2
+  exit 1
+fi
+
+pool_payload='{"status":{"capacity":{"maxResidentSessions":10,"maxRunningPrompts":4,"residentSessions":1,"liveDescendants":1,"runningPrompts":1}}}'
+if pool_transient_counters_zero test-pool 1; then
+  echo "transient quiescence accepted a running prompt" >&2
+  exit 1
+fi
+
+printf '%s\n' 'ok - transient quiescence permits only resident-session descendants'
+
+
+write_cleanup_body="$(awk '/^settle_write_task_for_remote_cleanup\(\) \{/,/^\}/' "${script}")"
+write_cleanup_park_line="$(grep -nF 'patch runtimepool "${pool}" --type=merge' <<<"${write_cleanup_body}" | head -1 | cut -d: -f1)"
+write_cleanup_payload_line="$(grep -nF '"desiredReplicas":0' <<<"${write_cleanup_body}" | head -1 | cut -d: -f1)"
+write_cleanup_stop_line="$(grep -nF 'write RuntimePool/${pool} stopped after publication finalization' <<<"${write_cleanup_body}" | head -1 | cut -d: -f1)"
+write_cleanup_outcome_line="$(grep -nF 'outcome="$(jq -r' <<<"${write_cleanup_body}" | head -1 | cut -d: -f1)"
+for value in "${write_cleanup_park_line}" "${write_cleanup_payload_line}" "${write_cleanup_stop_line}" "${write_cleanup_outcome_line}"; do
+  [[ "${value}" =~ ^[1-9][0-9]*$ ]] || {
+    echo "write cleanup parking assertion could not locate every required barrier" >&2
+    exit 1
+  }
+done
+(( write_cleanup_park_line < write_cleanup_payload_line ))
+(( write_cleanup_payload_line < write_cleanup_stop_line ))
+(( write_cleanup_stop_line < write_cleanup_outcome_line ))
+
+printf '%s\n' 'ok - terminal write cleanup drains and stops its RuntimePool before remote effect deletion'
+
+
+line_of_script() {
+  local pattern="$1"
+  grep -nF -- "${pattern}" "${script}" | tail -1 | cut -d: -f1
+}
+
+concurrency_line="$(line_of_script 'run_concurrency_check "${codex_agent}" codex "${codex_model}" "${codex_pool}"')"
+park_read_line="$(grep -nF 'park_runtimepool "${codex_pool}"' "${script}" | head -1 | cut -d: -f1)"
+timeout_line="$(line_of_script 'run_timeout_check codex "${codex_model}" "${codex_tool_agent}"')"
+cancel_line="$(line_of_script 'run_explicit_cancel_check codex "${codex_model}" "${codex_tool_agent}"')"
+restart_line="$(line_of_script 'run_controller_restart_check codex "${codex_model}" "${codex_tool_agent}" "${restart_nonce}"')"
+park_aux_line="$(line_of_script 'park_provider_runtimepools_except codex "${codex_pool}"')"
+resume_read_line="$(line_of_script 'resume_runtimepool "${codex_pool}"')"
+replacement_line="$(line_of_script 'run_pool_replacement_check codex "${codex_model}"')"
+
+for value in "${concurrency_line}" "${park_read_line}" "${timeout_line}" "${cancel_line}" "${restart_line}" "${park_aux_line}" "${resume_read_line}" "${replacement_line}"; do
+  [[ "${value}" =~ ^[1-9][0-9]*$ ]] || {
+    echo "profile-phase parking assertion could not locate every required step" >&2
+    exit 1
+  }
+done
+
+(( concurrency_line < park_read_line ))
+(( park_read_line < timeout_line ))
+(( timeout_line < cancel_line ))
+(( cancel_line < restart_line ))
+(( restart_line < park_aux_line ))
+(( park_aux_line < resume_read_line ))
+(( resume_read_line < replacement_line ))
+
+grep -F 'wait_until "RuntimePool/${pool} stopped after phase parking" "${state_wait_seconds}" pool_stopped "${pool}"' "${script}" >/dev/null
+grep -F 'wait_pool_serving "${pool}"' "${script}" >/dev/null
+
+printf '%s\n' 'ok - profile-specific RuntimePools are parked and resumed in capacity-safe order'
+
+
+profile_valid_body="$(awk '/^pool_profile_projection_valid\(\) \{/,/^\}$/' "${script}")"
+profile_fingerprint_body="$(awk '/^pool_profile_projection_fingerprint\(\) \{/,/^\}$/' "${script}")"
+profile_stable_body="$(awk '/^pool_profile_projection_stable\(\) \{/,/^\}$/' "${script}")"
+wait_fast_body="$(awk '/^wait_until_fast\(\) \{/,/^\}$/' "${script}")"
+wait_profile_body="$(awk '/^wait_pool_profile_projection\(\) \{/,/^\}$/' "${script}")"
+for function_body in "${profile_valid_body}" "${profile_fingerprint_body}" "${profile_stable_body}" \
+    "${wait_fast_body}" "${wait_profile_body}"; do
+  [[ -n "${function_body}" ]] || {
+    echo "stable RuntimePool profile projection helper is missing" >&2
+    exit 1
+  }
+  eval "${function_body}"
+done
+
+profile_root="$(mktemp -d "${TMPDIR:-/tmp}/orka-acp-profile-test.XXXXXX")"
+profile_output="${profile_root}/stable.json"
+profile_count_file="${profile_root}/count"
+namespace="test-namespace"
+valid_profile_payload='{
+  "metadata":{
+    "name":"acp-codex-1111111111111111",
+    "uid":"pool-uid",
+    "generation":3,
+    "labels":{
+      "orka.ai/acp-runtime-pool":"true",
+      "orka.ai/acp-trust-domain":"test-namespace",
+      "orka.ai/acp-profile":"aaaaaaaaaaaaaaaa"
+    }
+  },
+  "spec":{
+    "desiredReplicas":1,
+    "trustDomain":{"namespace":"test-namespace"},
+    "runtime":{
+      "image":"example.invalid/runtime@sha256:1111111111111111111111111111111111111111111111111111111111111111",
+      "profile":{
+        "protocolVersion":"orka.harness.v2",
+        "providerKind":"codex",
+        "model":"gpt-test",
+        "workspaceIntent":"read",
+        "digest":"sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "digestSchemaVersion":"v1",
+        "adapterDigests":["sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"],
+        "agentConfigurationDigest":"sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+        "toolPolicyDigest":"sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+        "approvalPolicyDigest":"sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+        "mcpConfigurationDigest":"sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+        "proxyCredentialRole":"provider-read",
+        "proxyCredentialScope":"test"
+      }
+    }
+  },
+  "status":{
+    "observedGeneration":3,
+    "lifecycle":"Serving",
+    "admissionState":"Accepting",
+    "currentReplicas":1,
+    "desiredReplicas":1,
+    "controllerEpoch":7,
+    "activeInstance":{
+      "controllerEpoch":7,
+      "protocolVersion":"orka.harness.v2",
+      "profileDigest":"sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "profileDigestSchemaVersion":"v1",
+      "providerTokenGeneration":"0123456789abcdef",
+      "runtimeInstanceID":"pod-uid.boot-id",
+      "bootID":"boot-id",
+      "podNamespace":"orka-runtimes",
+      "podName":"runtime-pod",
+      "podUID":"pod-uid",
+      "podAddress":"10.0.0.8",
+      "lastObservedTime":"2026-08-01T00:00:00Z"
+    },
+    "capacity":{"maxResidentSessions":10,"maxRunningPrompts":4}
+  }
+}'
+valid_profile_pod_payload='{
+  "metadata":{
+    "namespace":"orka-runtimes",
+    "name":"runtime-pod",
+    "uid":"pod-uid",
+    "annotations":{"orka.ai/provider-token-generation":"0123456789abcdef"}
+  }
+}'
+profile_first_payload="${valid_profile_payload}"
+profile_second_payload="${valid_profile_payload}"
+profile_first_pod_payload="${valid_profile_pod_payload}"
+profile_second_pod_payload="${valid_profile_pod_payload}"
+k() {
+  local count
+  case "${4:-}" in
+    runtimepool)
+      count="$(cat "${profile_count_file}")"
+      count=$((count + 1))
+      printf '%s\n' "${count}" >"${profile_count_file}"
+      if (( count == 1 )); then
+        printf '%s\n' "${profile_first_payload}"
+      else
+        printf '%s\n' "${profile_second_payload}"
+      fi
+      ;;
+    pod)
+      count="$(cat "${profile_count_file}")"
+      if (( count == 1 )); then
+        printf '%s\n' "${profile_first_pod_payload}"
+      else
+        printf '%s\n' "${profile_second_pod_payload}"
+      fi
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
+assert_profile_projection_rejected() {
+  local description="$1"
+  local pool_payload="$2"
+  local pod_payload="$3"
+  if pool_profile_projection_valid \
+    acp-codex-1111111111111111 codex gpt-test read "${pool_payload}" "${pod_payload}"; then
+    echo "profile projection accepted ${description}" >&2
+    exit 1
+  fi
+}
+
+assert_profile_projection_rejected \
+  'status from a stale RuntimePool generation' \
+  "$(jq '.status.observedGeneration = 2' <<<"${valid_profile_payload}")" \
+  "${valid_profile_pod_payload}"
+if ! pool_profile_projection_valid \
+    acp-codex-1111111111111111 codex gpt-test read \
+    "${valid_profile_payload}" "${valid_profile_pod_payload}"; then
+  echo "profile projection rejected a pool identity name distinct from its profile digest" >&2
+  exit 1
+fi
+if pool_profile_projection_valid \
+    acp-codex-2222222222222222 codex gpt-test read \
+    "${valid_profile_payload}" "${valid_profile_pod_payload}"; then
+  echo "profile projection accepted a payload for a different requested RuntimePool" >&2
+  exit 1
+fi
+assert_profile_projection_rejected \
+  'a profile label that does not bind the canonical profile digest' \
+  "$(jq '.metadata.labels["orka.ai/acp-profile"] = "bbbbbbbbbbbbbbbb"' <<<"${valid_profile_payload}")" \
+  "${valid_profile_pod_payload}"
+assert_profile_projection_rejected \
+  'a missing runtime-pool ownership label' \
+  "$(jq 'del(.metadata.labels["orka.ai/acp-runtime-pool"])' <<<"${valid_profile_payload}")" \
+  "${valid_profile_pod_payload}"
+assert_profile_projection_rejected \
+  'a trust-domain label that does not bind the RuntimePool namespace' \
+  "$(jq '.metadata.labels["orka.ai/acp-trust-domain"] = "other-namespace"' <<<"${valid_profile_payload}")" \
+  "${valid_profile_pod_payload}"
+
+assert_profile_projection_rejected \
+  'a provider token generation that does not match the selected Pod annotation' \
+  "${valid_profile_payload}" \
+  "$(jq '.metadata.annotations["orka.ai/provider-token-generation"] = "fedcba9876543210"' \
+    <<<"${valid_profile_pod_payload}")"
+assert_profile_projection_rejected \
+  'a runtimeInstanceID not derived from podUID and bootID' \
+  "$(jq '.status.activeInstance.runtimeInstanceID = "malformed-instance-id"' <<<"${valid_profile_payload}")" \
+  "${valid_profile_pod_payload}"
+
+printf '0\n' >"${profile_count_file}"
+profile_first_payload="$(jq 'del(.status.activeInstance.podUID)' <<<"${valid_profile_payload}")"
+profile_second_payload="${valid_profile_payload}"
+profile_first_pod_payload="${valid_profile_pod_payload}"
+profile_second_pod_payload="${valid_profile_pod_payload}"
+# shellcheck disable=SC2034 # Consumed by wait_pool_profile_projection from the evaluated script body.
+wait_seconds=3
+wait_pool_profile_projection acp-codex-1111111111111111 codex gpt-test read "${profile_output}"
+[[ "$(cat "${profile_count_file}")" == "3" ]] || {
+  echo "profile wait did not retry the incomplete projection before accepting two stable observations" >&2
+  exit 1
+}
+jq -e '
+  .metadata.generation == 3
+  and .status.observedGeneration == 3
+  and .status.activeInstance.providerTokenGeneration == "0123456789abcdef"
+  and .status.activeInstance.runtimeInstanceID == "pod-uid.boot-id"
+' "${profile_output}" >/dev/null
+
+printf '0\n' >"${profile_count_file}"
+profile_first_payload="${valid_profile_payload}"
+profile_second_payload="$(jq '.metadata.generation = 4 | .status.observedGeneration = 4' \
+  <<<"${valid_profile_payload}")"
+profile_first_pod_payload="${valid_profile_pod_payload}"
+profile_second_pod_payload="${valid_profile_pod_payload}"
+if pool_profile_projection_stable acp-codex-1111111111111111 codex gpt-test read "${profile_output}"; then
+  echo "stable profile predicate ignored a RuntimePool generation change" >&2
+  exit 1
+fi
+
+printf '0\n' >"${profile_count_file}"
+profile_first_payload="${valid_profile_payload}"
+profile_second_payload="$(jq '.status.activeInstance.providerTokenGeneration = "fedcba9876543210"' \
+  <<<"${valid_profile_payload}")"
+profile_first_pod_payload="${valid_profile_pod_payload}"
+profile_second_pod_payload="$(jq '.metadata.annotations["orka.ai/provider-token-generation"] = "fedcba9876543210"' \
+  <<<"${valid_profile_pod_payload}")"
+if pool_profile_projection_stable acp-codex-1111111111111111 codex gpt-test read "${profile_output}"; then
+  echo "stable profile predicate ignored a provider token generation change" >&2
+  exit 1
+fi
+
+printf '0\n' >"${profile_count_file}"
+profile_first_payload="${valid_profile_payload}"
+profile_second_payload="$(jq '
+  .status.activeInstance.podUID = "replacement-pod-uid"
+  | .status.activeInstance.runtimeInstanceID = "replacement-pod-uid.boot-id"
+' <<<"${valid_profile_payload}")"
+profile_first_pod_payload="${valid_profile_pod_payload}"
+profile_second_pod_payload="$(jq '.metadata.uid = "replacement-pod-uid"' <<<"${valid_profile_pod_payload}")"
+if pool_profile_projection_stable acp-codex-1111111111111111 codex gpt-test read "${profile_output}"; then
+  echo "stable profile predicate accepted two different complete instance fences" >&2
+  exit 1
+fi
+
+printf '0\n' >"${profile_count_file}"
+profile_first_payload="${valid_profile_payload}"
+profile_second_payload="${valid_profile_payload}"
+profile_first_pod_payload="${valid_profile_pod_payload}"
+profile_second_pod_payload="${valid_profile_pod_payload}"
+pool_profile_projection_stable acp-codex-1111111111111111 codex gpt-test read "${profile_output}"
+jq -e '
+  .metadata.generation == .status.observedGeneration
+  and .status.activeInstance.providerTokenGeneration == "0123456789abcdef"
+  and .status.activeInstance.podUID == "pod-uid"
+  and .status.activeInstance.bootID == "boot-id"
+  and .status.activeInstance.runtimeInstanceID == "pod-uid.boot-id"
+' "${profile_output}" >/dev/null
+
+grep -F 'wait_until_fast "RuntimePool/${pool} complete stable ACP v2 ${provider}/${intent} profile projection"' \
+  "${script}" >/dev/null
+grep -F 'wait_pool_profile_projection "${pool}" "${provider}" "${model}" "${intent}" "${pool_file}"' \
+  "${script}" >/dev/null
+
+rm -rf "${profile_root}"
+printf '%s\n' 'ok - complete RuntimePool profile projection retries until two stable fenced observations'
+
+
+grep -F 'for ((attempt = 1; attempt <= 10; attempt++)); do' "${script}" >/dev/null
+grep -F 'patch task "${task}" --type=merge' "${script}" >/dev/null
+grep -F 'orka.ai/acp-e2e-validated":"true"' "${script}" >/dev/null
+grep -F 'patch task "${fork_task}" --type=merge' "${script}" >/dev/null
+grep -F 'release-gate command failed with status ${rc} at ${failed_source}:${failed_line} (${failed_function})' "${script}" >/dev/null
+if grep -F 'label task "${task}"' "${script}" >/dev/null; then
+  echo "validated Task metadata still uses conflict-prone kubectl label" >&2
+  exit 1
+fi
+
+printf '%s\n' 'ok - terminal validation uses retried reads, atomic metadata patches, and safe failure locations'
+
+
+grep -F 'apply_agent codex "${codex_model}" "${codex_tool_agent}" 12 true' "${script}" >/dev/null
+[[ "$(grep -Fc 'apply_agent codex "${codex_model}" "${codex_tool_agent}" 12 true' "${script}")" == "1" ]]
+grep -F 'explicit-cancel check selected RuntimePool/${pool}, want shared tool RuntimePool/${tool_profile_pool}' "${script}" >/dev/null
+grep -F 'controller-restart check selected RuntimePool/${pool}, want shared tool RuntimePool/${tool_profile_pool}' "${script}" >/dev/null
+grep -F 'verbs:["get","list","watch","create","delete"]' "${script}" >/dev/null
+cancel_body="$(awk '/^run_explicit_cancel_check\(\) \{/,/^\}/' "${script}")"
+cancel_hold_line="$(grep -nF 'add_task_observer_finalizer "${task}" "${uid}"' <<<"${cancel_body}" | cut -d: -f1)"
+cancel_request_line="$(grep -nF 'request_task_cancellation "${task}"' <<<"${cancel_body}" | cut -d: -f1)"
+cancel_assert_line="$(grep -nF 'assert_cancelled_task "${task}" "${snapshot}"' <<<"${cancel_body}" | cut -d: -f1)"
+cancel_release_line="$(grep -nF 'release_task_observer_finalizer "${task}" "${uid}"' <<<"${cancel_body}" | cut -d: -f1)"
+for value in "${cancel_hold_line}" "${cancel_request_line}" "${cancel_assert_line}" "${cancel_release_line}"; do
+  [[ "${value}" =~ ^[1-9][0-9]*$ ]] || {
+    echo "explicit cancellation assertion could not locate every required barrier" >&2
+    exit 1
+  }
+done
+(( cancel_hold_line < cancel_request_line ))
+(( cancel_request_line < cancel_assert_line ))
+(( cancel_assert_line < cancel_release_line ))
+grep -F 'api_request DELETE "/api/v1/tasks/${task}?namespace=${namespace}"' "${script}" >/dev/null
+write_cleanup_body="$(awk '/^settle_write_task_for_remote_cleanup\(\) \{/,/^\}/' "${script}")"
+grep -F 'request_task_cancellation "${write_task_name}"' <<<"${write_cleanup_body}" >/dev/null
+if grep -Eq 'acp-(timeout|cancel|restart)-agent-' "${script}"; then
+  echo "profile-specific checks still create distinct Agents" >&2
+  exit 1
+fi
+
+printf '%s\n' 'ok - timeout, authenticated deletion cancellation, and restart share one immutable tool profile'
+
+grep -F 'Running OpenCode native ACP read, continuation, and read-policy validation' "${script}" >/dev/null
+grep -F 'run_opencode_read_policy_check "${opencode_policy_agent}" "${opencode_model}"' "${script}" >/dev/null
+grep -F 'Attempt to use Bash and a file-mutation tool to create SHOULD_NOT_EXIST.txt' "${script}" >/dev/null
+printf '%s
+' 'ok - OpenCode live gate covers native ACP, continuation, and read-intent tool denial'
+
+
+grep -F 'local deadline=$((SECONDS + 90))' "${script}" >/dev/null
+grep -F 'while (( SECONDS < deadline )); do' "${script}" >/dev/null
+grep -F 'port-forward attempt %d at %s' "${script}" >/dev/null
+grep -F 'controller API port-forward failed after Pod-aware retries' "${script}" >/dev/null
+grep -F 'release-gate failure stack functions=${FUNCNAME[*]:1:5} lines=${BASH_LINENO[*]:0:5}' "${script}" >/dev/null
+
+printf '%s\n' 'ok - controller API forwarding retries across controller Pod replacement'
+
+
+grep -F 'rollout status deployment/"${controller_deployment}" --timeout=10m' "${script}" >/dev/null
+restart_settle_line="$(line_of_script 'assert_restart_task_settled "${task}" "${old_snapshot}"')"
+restart_resume_line="$(line_of_script 'resume_runtimepool "${pool}"')"
+restart_replace_line="$(line_of_script 'RuntimePool/${pool} replacement after controller epoch change')"
+(( restart_settle_line < restart_resume_line ))
+(( restart_resume_line < restart_replace_line ))
+grep -F 'provider-${provider}-owner-uids.txt' "${script}" >/dev/null
+grep -F 'delete_test_branchclaims "${owners_file}" || die "failed to remove ${provider} BranchClaims before provider handoff"' "${script}" >/dev/null
+
+printf '%s\n' 'ok - restart drain resumes its pool and provider handoff retains BranchClaim owners'
+
+
+provider_handoff_body="$(awk '/^remove_provider_resources\(\) \{/,/^\}$/' "${script}")"
+[[ -n "${provider_handoff_body}" ]] || {
+  echo "provider handoff cleanup function is missing" >&2
+  exit 1
+}
+(
+  eval "${provider_handoff_body}"
+  handoff_root="$(mktemp -d "${TMPDIR:-/tmp}/orka-provider-handoff-test.XXXXXX")"
+  trap 'rm -rf "${handoff_root}"' EXIT
+  temp_root="${handoff_root}"
+  namespace="test-namespace"
+  # shellcheck disable=SC2034 # Consumed by remove_provider_resources from the evaluated script body.
+  run_id="test-run"
+  # shellcheck disable=SC2034 # Consumed by remove_provider_resources from the evaluated script body.
+  state_wait_seconds=37
+  events_file="${handoff_root}/events"
+  expected_file="${handoff_root}/expected"
+  : >"${events_file}"
+
+  log() { :; }
+  assert_all_tasks_validated() { :; }
+  record_runtime_namespace() { printf 'record-runtime-namespace:%s\n' "$1" >>"${events_file}"; }
+  pool_stopped() { printf 'pool-stopped:%s\n' "$1" >>"${events_file}"; }
+  wait_until() {
+    local description="$1"
+    local timeout="$2"
+    shift 2
+    printf 'wait:%s|%s|%s\n' "${description}" "${timeout}" "$*" >>"${events_file}"
+    "$@"
+  }
+  delete_test_branchclaims() { printf 'delete-branchclaims:%s\n' "$1" >>"${events_file}"; }
+  die() {
+    printf 'unexpected die: %s\n' "$*" >&2
+    return 1
+  }
+  k() {
+    if [[ "$*" == "-n ${namespace} get task -o json" ]]; then
+      printf '%s\n' '{"items":[{"metadata":{"uid":"task-uid"},"status":{"execution":{"runtimeSessionUID":"session-uid"}}}]}'
+      return 0
+    fi
+    if [[ "$*" == "-n ${namespace} get runtimepool -o json" ]]; then
+      cat <<'JSON'
+{"items":[
+  {"metadata":{"name":"codex-a"},"spec":{"runtime":{"profile":{"providerKind":"codex"}},"runtimeNamespace":"runtime-a"},"status":{"activeInstance":{"podNamespace":"active-a"}}},
+  {"metadata":{"name":"claude-a"},"spec":{"runtime":{"profile":{"providerKind":"claude"}},"runtimeNamespace":"runtime-claude"}},
+  {"metadata":{"name":"codex-b"},"spec":{"runtime":{"profile":{"providerKind":"codex"}},"runtimeNamespace":"runtime-b"}}
+]}
+JSON
+      return 0
+    fi
+    printf 'kubectl:%s\n' "$*" >>"${events_file}"
+  }
+
+  remove_provider_resources codex codex-agent
+
+  cat >"${expected_file}" <<EOF
+kubectl:-n test-namespace delete task --all --wait=true --timeout=5m
+record-runtime-namespace:active-a
+kubectl:-n test-namespace patch runtimepool codex-a --type=merge -p {"spec":{"desiredReplicas":0}}
+record-runtime-namespace:runtime-b
+kubectl:-n test-namespace patch runtimepool codex-b --type=merge -p {"spec":{"desiredReplicas":0}}
+wait:RuntimePool/codex-a stopped before codex provider handoff|37|pool_stopped codex-a
+pool-stopped:codex-a
+wait:RuntimePool/codex-b stopped before codex provider handoff|37|pool_stopped codex-b
+pool-stopped:codex-b
+kubectl:-n test-namespace delete agent codex-agent --ignore-not-found=true --wait=true --timeout=2m
+kubectl:-n test-namespace delete runtimepool codex-a --wait=true --timeout=5m
+kubectl:-n test-namespace delete runtimepool codex-b --wait=true --timeout=5m
+delete-branchclaims:${handoff_root}/provider-codex-owner-uids.txt
+EOF
+  if ! cmp -s "${expected_file}" "${events_file}"; then
+    echo "provider handoff did not scale every matching pool to zero and wait for Stopped before deletion" >&2
+    diff -u "${expected_file}" "${events_file}" >&2 || true
+    exit 1
+  fi
+)
+
+provider_remove_line="$(line_of_script 'remove_provider_resources codex "${codex_agent}" "${codex_tool_agent}"')"
+provider_children_line="$(line_of_script 'wait_until "Codex runtime children removal" 300 runtime_children_absent')"
+opencode_start_line="$(line_of_script 'run_read_smoke opencode "${opencode_model}"')"
+opencode_policy_line="$(line_of_script 'run_opencode_read_policy_check "${opencode_policy_agent}" "${opencode_model}"')"
+opencode_remove_line="$(line_of_script 'remove_provider_resources opencode "${opencode_agent}" "${opencode_policy_agent}"')"
+opencode_children_line="$(line_of_script 'wait_until "OpenCode runtime children removal" 300 runtime_children_absent')"
+claude_start_line="$(line_of_script 'run_read_smoke claude "${claude_model}"')"
+(( provider_remove_line < provider_children_line ))
+(( provider_children_line < opencode_start_line ))
+(( opencode_start_line < opencode_policy_line ))
+(( opencode_policy_line < opencode_remove_line ))
+(( opencode_remove_line < opencode_children_line ))
+(( opencode_children_line < claude_start_line ))
+
+printf '%s\n' 'ok - provider handoff scales all matching RuntimePools to zero, waits for Stopped, and deletes them before the next provider'
+
+
+grep -F 'ACP_E2E_COPILOT_MODEL              Copilot model (default: gpt-5.3-codex)' "${script}" >/dev/null
+grep -F 'copilot_model="${ACP_E2E_COPILOT_MODEL:-gpt-5.3-codex}"' "${script}" >/dev/null
+claude_remove_line="$(line_of_script 'remove_provider_resources claude "${claude_agent}"')"
+claude_children_line="$(line_of_script 'wait_until "Claude runtime children removal" 300 runtime_children_absent')"
+copilot_start_line="$(line_of_script 'run_read_smoke copilot "${copilot_model}"')"
+copilot_validated_line="$(awk -v start="${copilot_start_line}" '
+  NR > start && $0 == "assert_all_tasks_validated" { print NR; exit }
+' "${script}")"
+for value in "${claude_remove_line}" "${claude_children_line}" "${copilot_start_line}" "${copilot_validated_line}"; do
+  [[ "${value}" =~ ^[1-9][0-9]*$ ]] || {
+    echo "Copilot execution assertion could not locate every required step" >&2
+    exit 1
+  }
+done
+(( claude_start_line < claude_remove_line ))
+(( claude_remove_line < claude_children_line ))
+(( claude_children_line < copilot_start_line ))
+(( copilot_start_line < copilot_validated_line ))
+grep -F 'copilot_agent="$(sanitize_name "acp-copilot-${run_id}")"' "${script}" >/dev/null
+grep -F 'copilot_task="$(sanitize_name "acp-copilot-read-${run_id}")"' "${script}" >/dev/null
+grep -F 'copilot_session="$(sanitize_name "acp-copilot-session-${run_id}")"' "${script}" >/dev/null
+grep -F 'copilot_nonce="copilot-${run_id}-${RANDOM}-${RANDOM}"' "${script}" >/dev/null
+
+printf '%s\n' 'ok - GitHub Copilot executes the canonical read and continuation scenario after a safe Claude provider handoff'
+
+
+owners_fixture="$(mktemp "${TMPDIR:-/tmp}/orka-branchclaim-owners.XXXXXX")"
+printf '%s\n' owner-match >"${owners_fixture}"
+matched_claims="$(jq -r --rawfile owners "${owners_fixture}" '
+  ($owners | split("\n") | map(select(length > 0))) as $ownerUIDs
+  | .items[]
+  | . as $claim
+  | select($ownerUIDs | index($claim.spec.ownerUid))
+  | $claim.metadata.name
+' <<'JSON'
+{"items":[
+  {"metadata":{"name":"matching"},"spec":{"ownerUid":"owner-match"}},
+  {"metadata":{"name":"other"},"spec":{"ownerUid":"owner-other"}}
+]}
+JSON
+)"
+[[ "${matched_claims}" == "matching" ]]
+rm -f "${owners_fixture}"
+
+printf '%s\n' 'ok - BranchClaim owner matching selects only retained provider owners'
+
+
+restart_fence_body="$(awk '/^assert_restart_task_fence\(\) \{/,/^\}$/' "${script}")"
+[[ -n "${restart_fence_body}" ]] || {
+  echo "restart recovery fence assertion is missing" >&2
+  exit 1
+}
+eval "${restart_fence_body}"
+restart_fence_root="$(mktemp -d "${TMPDIR:-/tmp}/orka-restart-fence-test.XXXXXX")"
+temp_root="${restart_fence_root}"
+snapshot_file="${restart_fence_root}/snapshot.json"
+cat >"${snapshot_file}" <<'JSON'
+{"poolName":"pool-a","poolUID":"pool-uid","controllerEpoch":52,"runtimeInstanceID":"pod-uid.boot-id"}
+JSON
+task_payload='{"metadata":{"labels":{"orka.ai/runtime-pool":"pool-a"}},"status":{"execution":{"runtimePoolName":"pool-a","runtimePoolUID":"pool-uid","runtimeInstanceID":"pod-uid.boot-id","controllerEpoch":53,"promptID":"prompt-1","requestDigest":"sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","runtimeSessionUID":"session-1","runtimeSessionGeneration":1,"attempt":1}}}'
+valid_task_payload="${task_payload}"
+task_json() { printf '%s\n' "${task_payload}"; }
+safe_task_summary() { :; }
+die() { return 1; }
+assert_restart_task_fence restart-task "${snapshot_file}"
+
+task_payload="$(jq '.status.execution.controllerEpoch = 51' <<<"${valid_task_payload}")"
+if assert_restart_task_fence restart-task "${snapshot_file}"; then
+  echo "restart fence accepted a regressed controller epoch" >&2
+  exit 1
+fi
+
+task_payload="$(jq '.status.execution.controllerEpoch = 53 | .status.execution.runtimeInstanceID = "other.boot"' <<<"${valid_task_payload}")"
+if assert_restart_task_fence restart-task "${snapshot_file}"; then
+  echo "restart fence accepted a different runtime instance" >&2
+  exit 1
+fi
+
+task_payload="$(jq '.status.execution.controllerEpoch = "53"' <<<"${valid_task_payload}")"
+if assert_restart_task_fence restart-task "${snapshot_file}"; then
+  echo "restart fence accepted a nonnumeric Task controller epoch" >&2
+  exit 1
+fi
+
+bad_snapshot_file="${restart_fence_root}/bad-snapshot.json"
+jq '.controllerEpoch = "52"' "${snapshot_file}" >"${bad_snapshot_file}"
+task_payload="${valid_task_payload}"
+if assert_restart_task_fence restart-task "${bad_snapshot_file}"; then
+  echo "restart fence accepted a nonnumeric snapshot controller epoch" >&2
+  exit 1
+fi
+
+rm -rf "${restart_fence_root}"
+printf '%s\n' 'ok - restart recovery fence preserves the old runtime instance and permits a newer controller epoch'
+
+
+lifecycle_reached_body="$(awk '/^pool_lifecycle_reached\(\) \{/,/^\}$/' "${script}")"
+[[ -n "${lifecycle_reached_body}" ]] || {
+  echo "monotonic RuntimePool lifecycle assertion is missing" >&2
+  exit 1
+}
+eval "${lifecycle_reached_body}"
+namespace="test-namespace"
+pool_payload=''
+k() { printf '%s\n' "${pool_payload}"; }
+
+pool_payload='{"status":{"lifecycle":"Stopped","admissionState":"Closed"}}'
+pool_lifecycle_reached test-pool Draining
+pool_lifecycle_reached test-pool Quiescent
+pool_lifecycle_reached test-pool Stopping
+pool_lifecycle_reached test-pool Stopped
+
+pool_payload='{"status":{"lifecycle":"Draining","admissionState":"Draining"}}'
+if pool_lifecycle_reached test-pool Quiescent; then
+  echo "monotonic lifecycle accepted a state before Quiescent" >&2
+  exit 1
+fi
+
+pool_payload='{"status":{"lifecycle":"Stopping","admissionState":"Draining"}}'
+if pool_lifecycle_reached test-pool Stopping; then
+  echo "monotonic lifecycle accepted an invalid Stopping admission state" >&2
+  exit 1
+fi
+
+printf '%s\n' 'ok - scale-to-zero lifecycle assertions accept valid later states without accepting regressions'
+
+
+park_count="$(grep -Fc 'park_runtimepool "${codex_pool}"' "${script}")"
+[[ "${park_count}" == "2" ]] || {
+  echo "Codex read RuntimePool must be parked before both tool checks and write publication" >&2
+  exit 1
+}
+scale_zero_line="$(grep -nF 'run_scale_to_zero_recovery_check codex "${codex_model}"' "${script}" | tail -1 | cut -d: -f1)"
+park_before_write_line="$(grep -nF 'park_runtimepool "${codex_pool}"' "${script}" | tail -1 | cut -d: -f1)"
+write_gate_line="$(grep -nF 'run_write_release_gate "${codex_agent}"' "${script}" | tail -1 | cut -d: -f1)"
+(( scale_zero_line < park_before_write_line ))
+(( park_before_write_line < write_gate_line ))
+
+printf '%s\n' 'ok - release gate parks the recovered read pool before creating the write profile pool'
+
+
+terminal_projection_body="$(awk '/^task_terminal_projection_ready\(\) \{/,/^\}$/' "${script}")"
+[[ -n "${terminal_projection_body}" ]] || {
+  echo "atomic Task terminal projection predicate is missing" >&2
+  exit 1
+}
+eval "${terminal_projection_body}"
+namespace="test-namespace"
+task_payload=''
+k() { printf '%s\n' "${task_payload}"; }
+
+task_payload='{"status":{"execution":{"state":"Succeeded"},"phase":"Pending"}}'
+if task_terminal_projection_ready test-task; then
+  echo "terminal predicate accepted execution before phase projection" >&2
+  exit 1
+fi
+
+task_payload='{"status":{"execution":{"state":"Succeeded"},"phase":"Succeeded"}}'
+task_terminal_projection_ready test-task
+
+task_payload='{"status":{"execution":{"state":"Failed"},"phase":"Failed"}}'
+task_terminal_projection_ready test-task
+
+task_payload='{"status":{"execution":{"state":"Running"},"phase":"Succeeded"}}'
+if task_terminal_projection_ready test-task; then
+  echo "terminal predicate accepted phase before terminal execution" >&2
+  exit 1
+fi
+
+printf '%s\n' 'ok - Task terminal waits require execution and phase projection from one observation'
diff --git a/scripts/tests/live-acp-runtime-kind-e2e-test.sh b/scripts/tests/live-acp-runtime-kind-e2e-test.sh
new file mode 100755
index 000000000..67896c2be
--- /dev/null
+++ b/scripts/tests/live-acp-runtime-kind-e2e-test.sh
@@ -0,0 +1,411 @@
+#!/usr/bin/env bash
+# shellcheck disable=SC2016 # This test intentionally matches literal shell expressions.
+set -Eeuo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+wrapper="${root}/scripts/live-acp-runtime-kind-e2e.sh"
+bootstrap="${root}/scripts/lib/live-acp-runtime-kind-bootstrap.sh"
+
+export ACP_E2E_OPENCODE_CONTEXT_WINDOW=32768
+export ACP_E2E_OPENCODE_MAX_TOKENS=4096
+
+help="$(${wrapper} --help)"
+grep -F 'intentionally noninteractive' <<<"${help}" >/dev/null
+grep -F 'COPILOT_GITHUB_TOKEN is required' <<<"${help}" >/dev/null
+
+grep -F -- '--create-copilot-token-secret live-acp-runtime-copilot:token' "${bootstrap}" >/dev/null
+grep -F '/api/v1/namespaces/vekil-system/services/http:vekil:1337/proxy/v1/models' "${bootstrap}" >/dev/null
+grep -F 'ACP_E2E_COPILOT_MODEL:-gpt-5.3-codex' "${bootstrap}" >/dev/null
+grep -F 'LIVE_ACP_OPENCODE_IMAGE="orka-acp-opencode:live-acp-${image_tag}"' "${wrapper}" >/dev/null
+grep -F 'LIVE_ACP_GENERAL_WORKER_IMAGE="orka-general-worker:live-acp-${image_tag}"' "${wrapper}" >/dev/null
+grep -F 'ACP_OPENCODE_RUNTIME_IMG="${LIVE_ACP_OPENCODE_IMAGE}"' "${bootstrap}" >/dev/null
+grep -F 'GENERAL_WORKER_IMG="${LIVE_ACP_GENERAL_WORKER_IMAGE}"' "${bootstrap}" >/dev/null
+grep -F 'docker-build-acp-opencode-runtime' "${bootstrap}" >/dev/null
+grep -F 'docker-build-general-worker' "${bootstrap}" >/dev/null
+grep -F 'orka/acp-opencode-runtime' "${bootstrap}" >/dev/null
+grep -F 'orka/general-worker' "${bootstrap}" >/dev/null
+grep -F 'ACP_OPENCODE_RUNTIME_IMG="${LIVE_ACP_OPENCODE_REF}"' "${bootstrap}" >/dev/null
+grep -F 'GENERAL_WORKER_IMG="${LIVE_ACP_GENERAL_WORKER_REF}"' "${bootstrap}" >/dev/null
+grep -F 'opencode_model="${ACP_E2E_OPENCODE_MODEL:-${ACP_E2E_CODEX_MODEL:-gpt-5.4}}"' "${bootstrap}" >/dev/null
+grep -F 'opencode_model="${opencode_model#*/}"' "${bootstrap}" >/dev/null
+grep -F 'ACP_E2E_OPENCODE_CONTEXT_WINDOW must be a positive integer' "${bootstrap}" >/dev/null
+grep -F 'ACP_E2E_OPENCODE_MAX_TOKENS must be a positive integer' "${bootstrap}" >/dev/null
+# shellcheck disable=SC2016 # Match the literal catalog-validation expression.
+grep -F 'live_acp_kind_validate_vekil_catalog "${models_file}"' "${bootstrap}" >/dev/null
+grep -F 'live_acp_kind_probe_configured_models' "${bootstrap}" >/dev/null
+# shellcheck disable=SC2016 # Match the literal delegation expression in the wrapper.
+grep -F '"${LIVE_ACP_VALIDATOR_SCRIPT}" "${validator_args[@]}"' "${wrapper}" >/dev/null
+grep -F 'ACP_E2E_WRITE_READ_CREDENTIAL_TOKEN' "${bootstrap}" >/dev/null
+grep -F 'Creating four role-separated release-gate credential Secrets' "${bootstrap}" >/dev/null
+if grep -Eq 'set +-x|echo .*COPILOT_GITHUB_TOKEN' "${bootstrap}" "${wrapper}"; then
+  echo 'bootstrap must not enable tracing or print the provider credential' >&2
+  exit 1
+fi
+
+# shellcheck source=scripts/lib/live-acp-runtime-kind-bootstrap.sh
+. "${bootstrap}"
+inherited_state="$(
+  LIVE_ACP_VEKIL_PORT_FORWARD_PID=123 \
+    LIVE_ACP_VEKIL_PORT_FORWARD_LOG=/tmp/untrusted-port-forward.log \
+    LIVE_ACP_VEKIL_PORT_FORWARD_OWNED=1 \
+    bash -c '. "$1"; printf "%s|%s|%s" "${LIVE_ACP_VEKIL_PORT_FORWARD_PID}" "${LIVE_ACP_VEKIL_PORT_FORWARD_LOG}" "${LIVE_ACP_VEKIL_PORT_FORWARD_OWNED}"' \
+      _ "${bootstrap}"
+)"
+[[ "${inherited_state}" == '||0' ]] || {
+  echo 'bootstrap retained inherited port-forward cleanup state' >&2
+  exit 1
+}
+
+unowned_root="$(mktemp -d "${TMPDIR:-/tmp}/live-acp-unowned-forward.XXXXXX")"
+mkdir -p "${unowned_root}/owned"
+unowned_log="${unowned_root}/vekil-port-forward.unowned"
+printf 'keep\n' >"${unowned_log}"
+LIVE_ACP_SECRET_DIR="${unowned_root}/owned"
+LIVE_ACP_VEKIL_PORT_FORWARD_PID="$$"
+LIVE_ACP_VEKIL_PORT_FORWARD_LOG="${unowned_log}"
+LIVE_ACP_VEKIL_PORT_FORWARD_OWNED=0
+live_acp_kind_stop_vekil_port_forward
+[[ -f "${unowned_log}" ]] || {
+  echo 'cleanup removed an unowned port-forward log path' >&2
+  exit 1
+}
+rm -rf "${unowned_root}"
+
+catalog_root="$(mktemp -d "${TMPDIR:-/tmp}/live-acp-catalog-test.XXXXXX")"
+catalog_file="${catalog_root}/models.json"
+cat >"${catalog_file}" <<'JSON'
+{
+  "data": [
+    {"id":"gpt-codex-test","supported_endpoints":["/responses"]},
+    {"id":"gpt-opencode-test","supported_endpoints":["/responses"]},
+    {"id":"claude-test","supported_endpoints":["/v1/messages"]}
+  ],
+  "models": [
+    {"id":"gpt-copilot-test","supported_endpoints":["/responses"]}
+  ]
+}
+JSON
+export ACP_E2E_CODEX_MODEL='gpt-codex-test'
+export ACP_E2E_OPENCODE_MODEL='openai/gpt-opencode-test'
+export ACP_E2E_CLAUDE_MODEL='claude-test'
+export ACP_E2E_COPILOT_MODEL='gpt-copilot-test'
+live_acp_kind_validate_vekil_catalog "${catalog_file}"
+
+jq '(.models[] | select(.id == "gpt-copilot-test") | .supported_endpoints) = ["/chat/completions"]' \
+  "${catalog_file}" >"${catalog_root}/wrong-endpoint.json"
+if catalog_error="$(live_acp_kind_validate_vekil_catalog "${catalog_root}/wrong-endpoint.json" 2>&1)"; then
+  echo 'catalog validation accepted a present model without its required wire endpoint' >&2
+  exit 1
+fi
+grep -F 'does not advertise required endpoint /responses' <<<"${catalog_error}" >/dev/null
+
+jq '(.data[] | select(.id == "gpt-opencode-test") | .supported_endpoints) = ["/v1/messages"]' \
+  "${catalog_file}" >"${catalog_root}/wrong-opencode-endpoint.json"
+if catalog_error="$(live_acp_kind_validate_vekil_catalog "${catalog_root}/wrong-opencode-endpoint.json" 2>&1)"; then
+  echo 'catalog validation accepted an OpenCode model without Chat or Responses compatibility' >&2
+  exit 1
+fi
+grep -F 'does not advertise required endpoint /chat/completions or compatible /responses' \
+  <<<"${catalog_error}" >/dev/null
+
+LIVE_ACP_CONTEXT='kind-live-acp-test'
+LIVE_ACP_SECRET_DIR="${catalog_root}"
+wire_log="${catalog_root}/wire.log"
+port_forward_command_log="${catalog_root}/port-forward-command.log"
+port_forward_pid_file="${catalog_root}/port-forward.pid"
+probe_bin="${catalog_root}/bin"
+mkdir -p "${probe_bin}"
+export WIRE_LOG="${wire_log}"
+export PORT_FORWARD_COMMAND_LOG="${port_forward_command_log}"
+export PORT_FORWARD_PID_FILE="${port_forward_pid_file}"
+export WIRE_FAIL_MESSAGES=0
+export WIRE_STREAM_FAILURE=0
+provider_sentinel='must-not-appear-in-wire-probe'
+export COPILOT_GITHUB_TOKEN="${provider_sentinel}"
+cat >"${probe_bin}/kubectl" <<'STUB'
+#!/usr/bin/env bash
+printf '%s\n' "$@" >>"${PORT_FORWARD_COMMAND_LOG}"
+if [[ "$*" == *' port-forward '* ]]; then
+  printf '%s\n' "$$" >"${PORT_FORWARD_PID_FILE}"
+  trap 'exit 0' TERM INT
+  while :; do
+    sleep 1
+  done
+fi
+exit 1
+STUB
+chmod +x "${probe_bin}/kubectl"
+cat >"${probe_bin}/curl" <<'STUB'
+#!/usr/bin/env bash
+printf '%s\n' "$@" >>"${WIRE_LOG}"
+output_file=""
+previous=""
+for argument in "$@"; do
+  if [[ "${previous}" == "-o" ]]; then
+    output_file="${argument}"
+  fi
+  case "${argument}" in
+    @*) cat "${argument#@}" >>"${WIRE_LOG}" ;;
+  esac
+  previous="${argument}"
+done
+if [[ "$*" == *'/readyz'* && ! -s "${PORT_FORWARD_PID_FILE}" ]]; then
+  exit 7
+fi
+if [[ "${WIRE_FAIL_MESSAGES:-0}" == "1" && "$*" == *'/v1/messages'* ]]; then
+  printf '%s\n' 'raw-upstream-error-must-remain-redacted' >&2
+  exit 22
+fi
+if [[ -n "${output_file}" && "${output_file}" != "/dev/null" ]]; then
+  if [[ "${WIRE_STREAM_FAILURE:-0}" == "1" && "$*" == *'/v1/responses'* ]]; then
+    printf '%s\n' 'event: response.failed' 'data: {"type":"response.failed"}' >"${output_file}"
+  elif [[ "$*" == *'/v1/responses'* ]]; then
+    printf '%s\n' 'event: response.completed' 'data: {"type":"response.completed"}' >"${output_file}"
+  elif [[ "$*" == *'/v1/messages'* ]]; then
+    printf '%s\n' 'event: message_stop' 'data: {"type":"message_stop"}' >"${output_file}"
+  elif [[ "$*" == *'/v1/chat/completions'* ]]; then
+    printf '%s\n' 'data: {"choices":[{"delta":{"content":"OK"}}]}' 'data: [DONE]' >"${output_file}"
+  fi
+fi
+printf '200'
+exit 0
+STUB
+chmod +x "${probe_bin}/curl"
+
+PATH="${probe_bin}:${PATH}" live_acp_kind_probe_configured_models
+grep -F 'port-forward' "${port_forward_command_log}" >/dev/null
+grep -F -- '--address=127.0.0.1' "${port_forward_command_log}" >/dev/null
+grep -F 'service/vekil' "${port_forward_command_log}" >/dev/null
+wire_probe_source="$(sed -n '/^live_acp_kind_probe_vekil_wire_path()/,/^}/p' "${bootstrap}")"
+if grep -F 'exec' "${port_forward_command_log}" >/dev/null || grep -F 'wget' <<<"${wire_probe_source}" >/dev/null; then
+  echo 'Vekil wire probe still depends on an in-container executable' >&2
+  exit 1
+fi
+port_forward_pid="$(cat "${port_forward_pid_file}")"
+if kill -0 "${port_forward_pid}" >/dev/null 2>&1; then
+  echo 'successful Vekil wire probes left the kubectl port-forward running' >&2
+  exit 1
+fi
+[[ -z "${LIVE_ACP_VEKIL_PORT_FORWARD_PID:-}" ]]
+[[ -z "${LIVE_ACP_VEKIL_PORT_FORWARD_LOG:-}" ]]
+[[ -z "${LIVE_ACP_VEKIL_BASE_URL:-}" ]]
+grep -F '/v1/responses' "${wire_log}" >/dev/null
+grep -F '/v1/messages' "${wire_log}" >/dev/null
+grep -F '/v1/chat/completions' "${wire_log}" >/dev/null
+grep -F '"model":"gpt-codex-test"' "${wire_log}" >/dev/null
+grep -F '"model":"gpt-opencode-test"' "${wire_log}" >/dev/null
+grep -F '"model":"claude-test"' "${wire_log}" >/dev/null
+grep -F '"model":"gpt-copilot-test"' "${wire_log}" >/dev/null
+grep -F '"stream":true' "${wire_log}" >/dev/null
+grep -F 'anthropic-version: 2023-06-01' "${wire_log}" >/dev/null
+grep -F '%{http_code}' "${wire_log}" >/dev/null
+if grep -F "${provider_sentinel}" "${wire_log}" >/dev/null; then
+  echo 'wire probe leaked COPILOT_GITHUB_TOKEN into the probe command' >&2
+  exit 1
+fi
+
+export WIRE_FAIL_MESSAGES=1
+if wire_error="$(PATH="${probe_bin}:${PATH}" live_acp_kind_probe_configured_models 2>&1)"; then
+  echo 'wire probe accepted a rejected configured model request' >&2
+  exit 1
+fi
+grep -F 'Vekil /messages live probe rejected configured Claude model claude-test' <<<"${wire_error}" >/dev/null
+if grep -F 'raw-upstream-error-must-remain-redacted' <<<"${wire_error}" >/dev/null; then
+  echo 'wire probe exposed the raw upstream failure body' >&2
+  exit 1
+fi
+port_forward_pid="$(cat "${port_forward_pid_file}")"
+if kill -0 "${port_forward_pid}" >/dev/null 2>&1; then
+  echo 'failed Vekil wire probes left the kubectl port-forward running' >&2
+  exit 1
+fi
+if find "${catalog_root}" -maxdepth 1 \( -name 'vekil-port-forward.*' -o -name 'vekil-wire-*.??????' \) \
+    -print | grep -q .; then
+  echo 'Vekil wire probes left temporary payload, error, or port-forward log files behind' >&2
+  exit 1
+fi
+
+export WIRE_FAIL_MESSAGES=0
+export WIRE_STREAM_FAILURE=1
+if stream_error="$(PATH="${probe_bin}:${PATH}" live_acp_kind_probe_configured_models 2>&1)"; then
+  echo 'wire probe accepted an HTTP 200 stream with a terminal failure event' >&2
+  exit 1
+fi
+grep -F 'Vekil /responses live probe did not complete configured Codex model gpt-codex-test successfully' \
+  <<<"${stream_error}" >/dev/null
+port_forward_pid="$(cat "${port_forward_pid_file}")"
+if kill -0 "${port_forward_pid}" >/dev/null 2>&1; then
+  echo 'terminal stream failure left the kubectl port-forward running' >&2
+  exit 1
+fi
+if find "${catalog_root}" -maxdepth 1 \( -name 'vekil-port-forward.*' -o -name 'vekil-wire-*.??????' \) \
+    -print | grep -q .; then
+  echo 'terminal stream failure left temporary probe files behind' >&2
+  exit 1
+fi
+
+rm -rf "${catalog_root}"
+printf '%s\n' 'ok - Vekil preflight requires endpoint metadata and live streaming wire compatibility without credential disclosure'
+
+fake_bin="$(mktemp -d "${TMPDIR:-/tmp}/live-acp-kind-test.XXXXXX")"
+trap 'rm -rf "${fake_bin}"' EXIT
+for command in curl gh git go jq kind kubectl make python3; do
+  cat >"${fake_bin}/${command}" <<'STUB'
+#!/usr/bin/env bash
+exit 0
+STUB
+  chmod +x "${fake_bin}/${command}"
+done
+cat >"${fake_bin}/docker" <<'STUB'
+#!/usr/bin/env bash
+[[ "${1:-}" == info ]]
+STUB
+chmod +x "${fake_bin}/docker"
+
+cat >"${fake_bin}/failing-kindctl" <<'STUB'
+#!/usr/bin/env bash
+[[ "${1:-}" == delete ]] || exit 2
+exit 1
+STUB
+chmod +x "${fake_bin}/failing-kindctl"
+
+partial_create_log="${fake_bin}/partial-create.log"
+export PARTIAL_CREATE_LOG="${partial_create_log}"
+cat >"${fake_bin}/partial-kindctl" <<'STUB'
+#!/usr/bin/env bash
+printf '%s\n' "$*" >>"${PARTIAL_CREATE_LOG}"
+case "${1:-}" in
+  create) exit 23 ;;
+  delete) exit 0 ;;
+  *) exit 97 ;;
+esac
+STUB
+chmod +x "${fake_bin}/partial-kindctl"
+partial_secret_dir="$(mktemp -d "${TMPDIR:-/tmp}/live-acp-partial-create.XXXXXX")"
+LIVE_ACP_SECRET_DIR="${partial_secret_dir}"
+LIVE_ACP_KEEP_CLUSTER=0
+LIVE_ACP_REGISTRY_STARTED=0
+LIVE_ACP_KIND_CREATED=0
+LIVE_ACP_KINDCTL_BIN="${fake_bin}/partial-kindctl"
+LIVE_ACP_KIND_TAG="partial-create-test"
+LIVE_ACP_KIND_CONFIG=""
+set +e
+live_acp_kind_create_cluster >/dev/null 2>&1
+partial_create_status=$?
+set -e
+[[ "${partial_create_status}" -eq 23 && "${LIVE_ACP_KIND_CREATED}" -eq 1 ]] || {
+  echo 'Kind create failure did not preserve status and arm exact cleanup' >&2
+  exit 1
+}
+set +e
+live_acp_kind_cleanup "${partial_create_status}" >/dev/null 2>&1
+partial_cleanup_status=$?
+set -e
+[[ "${partial_cleanup_status}" -eq 23 ]] || {
+  echo 'partial Kind cleanup masked the create failure' >&2
+  exit 1
+}
+grep -Fx 'create --tag partial-create-test' "${partial_create_log}" >/dev/null
+grep -Fx 'delete --tag partial-create-test' "${partial_create_log}" >/dev/null
+[[ ! -e "${partial_secret_dir}" ]] || {
+  echo 'partial Kind cleanup retained its secret directory' >&2
+  exit 1
+}
+printf '%s\n' 'ok - partial Kind create failures exact-clean by tag'
+
+cleanup_secret_dir="$(mktemp -d "${TMPDIR:-/tmp}/live-acp-cleanup-test.XXXXXX")"
+LIVE_ACP_SECRET_DIR="${cleanup_secret_dir}"
+LIVE_ACP_KEEP_CLUSTER=0
+LIVE_ACP_REGISTRY_STARTED=0
+LIVE_ACP_KIND_CREATED=1
+LIVE_ACP_KINDCTL_BIN="${fake_bin}/failing-kindctl"
+LIVE_ACP_KIND_TAG="cleanup-test"
+if live_acp_kind_cleanup 0; then
+  echo 'successful validation unexpectedly masked Kind cluster deletion failure' >&2
+  exit 1
+fi
+if [[ -d "${cleanup_secret_dir}" ]]; then
+  echo 'Kind cleanup did not remove its secret directory after deletion failure' >&2
+  exit 1
+fi
+cleanup_secret_dir="$(mktemp -d "${TMPDIR:-/tmp}/live-acp-cleanup-test.XXXXXX")"
+LIVE_ACP_SECRET_DIR="${cleanup_secret_dir}"
+set +e
+live_acp_kind_cleanup 23
+cleanup_failure_status=$?
+set -e
+if [[ "${cleanup_failure_status}" -ne 23 ]]; then
+  echo "Kind cleanup replaced validator failure 23 with ${cleanup_failure_status}" >&2
+  exit 1
+fi
+printf '%s\n' 'ok - Kind cleanup failure fails successful validation without masking validator failures'
+
+provider_sentinel='must-not-appear-in-output'
+output="$(PATH="${fake_bin}:${PATH}" COPILOT_GITHUB_TOKEN="${provider_sentinel}" "${wrapper}" --preflight-only 2>&1)"
+grep -F 'preflight passed' <<<"${output}" >/dev/null
+if grep -F "${provider_sentinel}" <<<"${output}" >/dev/null; then
+  echo 'preflight leaked COPILOT_GITHUB_TOKEN' >&2
+  exit 1
+fi
+
+if PATH="${fake_bin}:${PATH}" COPILOT_GITHUB_TOKEN='' "${wrapper}" --preflight-only >"${fake_bin}/missing.out" 2>&1; then
+  echo 'preflight unexpectedly accepted missing COPILOT_GITHUB_TOKEN' >&2
+  exit 1
+fi
+grep -F 'noninteractive and never starts device-code login' "${fake_bin}/missing.out" >/dev/null
+
+if PATH="${fake_bin}:${PATH}" RELEASE_GATE=1 COPILOT_GITHUB_TOKEN="${provider_sentinel}" \
+    ACP_E2E_WRITE_CREATE_PR=1 \
+    ACP_E2E_WRITE_PUBLICATION_REPO='https://github.com/example/orka.git' \
+    ACP_E2E_WRITE_SOURCE_REPO='https://github.com/orka-agents/orka.git' \
+    ACP_E2E_WRITE_SOURCE_REF='0123456789abcdef0123456789abcdef01234567' \
+    "${wrapper}" --preflight-only >"${fake_bin}/release-missing.out" 2>&1; then
+  echo 'release preflight unexpectedly accepted missing role-separated credentials' >&2
+  exit 1
+fi
+grep -F 'ACP_E2E_WRITE_READ_CREDENTIAL_TOKEN is required when RELEASE_GATE=1' \
+  "${fake_bin}/release-missing.out" >/dev/null
+
+source_read_sentinel='source-read-value'
+target_read_sentinel='target-read-value'
+target_write_sentinel='target-write-value'
+forge_sentinel='forge-value'
+printf -v ACP_E2E_WRITE_READ_CREDENTIAL_TOKEN '%s' "${source_read_sentinel}"
+printf -v ACP_E2E_WRITE_TARGET_READ_CREDENTIAL_TOKEN '%s' "${target_read_sentinel}"
+printf -v ACP_E2E_WRITE_CREDENTIAL_TOKEN '%s' "${target_write_sentinel}"
+printf -v ACP_E2E_WRITE_FORGE_CREDENTIAL_TOKEN '%s' "${forge_sentinel}"
+export ACP_E2E_WRITE_READ_CREDENTIAL_TOKEN ACP_E2E_WRITE_TARGET_READ_CREDENTIAL_TOKEN
+export ACP_E2E_WRITE_CREDENTIAL_TOKEN ACP_E2E_WRITE_FORGE_CREDENTIAL_TOKEN
+release_output="$(
+  PATH="${fake_bin}:${PATH}" \
+    RELEASE_GATE=1 \
+    COPILOT_GITHUB_TOKEN="${provider_sentinel}" \
+    ACP_E2E_WRITE_CREATE_PR=1 \
+    ACP_E2E_WRITE_PUBLICATION_REPO='https://github.com/example/orka.git' \
+    ACP_E2E_WRITE_SOURCE_REPO='https://github.com/orka-agents/orka.git' \
+    ACP_E2E_WRITE_SOURCE_REF='0123456789abcdef0123456789abcdef01234567' \
+    "${wrapper}" --preflight-only 2>&1
+)"
+grep -F 'preflight passed' <<<"${release_output}" >/dev/null
+for value in "${provider_sentinel}" "${source_read_sentinel}" "${target_read_sentinel}" \
+    "${target_write_sentinel}" "${forge_sentinel}"; do
+  if grep -F "${value}" <<<"${release_output}" >/dev/null; then
+    echo 'release preflight leaked a provider or publication credential' >&2
+    exit 1
+  fi
+done
+
+if PATH="${fake_bin}:${PATH}" RELEASE_GATE=1 COPILOT_GITHUB_TOKEN="${provider_sentinel}" \
+    ACP_E2E_REPO='https://github.com/example/other.git' \
+    ACP_E2E_WRITE_CREATE_PR=1 \
+    ACP_E2E_WRITE_PUBLICATION_REPO='https://github.com/example/orka.git' \
+    ACP_E2E_WRITE_SOURCE_REPO='https://github.com/orka-agents/orka.git' \
+    ACP_E2E_WRITE_SOURCE_REF='0123456789abcdef0123456789abcdef01234567' \
+    "${wrapper}" --preflight-only >"${fake_bin}/release-mismatch.out" 2>&1; then
+  echo 'release preflight unexpectedly accepted a different read repository' >&2
+  exit 1
+fi
+grep -F 'ACP_E2E_REPO must equal ACP_E2E_WRITE_SOURCE_REPO' \
+  "${fake_bin}/release-mismatch.out" >/dev/null
+
+printf '%s\n' 'ok - live ACP Kind bootstrap is noninteractive, secret-safe, and delegates to the canonical validator'
diff --git a/scripts/tests/live-acp-runtime-port-forward-cleanup-test.sh b/scripts/tests/live-acp-runtime-port-forward-cleanup-test.sh
new file mode 100755
index 000000000..f9b6c97c1
--- /dev/null
+++ b/scripts/tests/live-acp-runtime-port-forward-cleanup-test.sh
@@ -0,0 +1,133 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+script="${root}/scripts/live-acp-runtime-e2e.sh"
+test_root="$(mktemp -d "${TMPDIR:-/tmp}/orka-acp-port-forward-test.XXXXXX")"
+fake_bin="${test_root}/bin"
+fake_pid_file="${test_root}/kubectl.pid"
+fake_args_file="${test_root}/kubectl.args"
+tracked_pid=""
+fake_kubectl_pid=""
+
+terminate_pid() {
+  local pid="${1:-}"
+  local attempt
+  [[ "${pid}" =~ ^[1-9][0-9]*$ ]] || return 0
+  if ! kill -0 "${pid}" >/dev/null 2>&1; then
+    return 0
+  fi
+  kill "${pid}" >/dev/null 2>&1 || true
+  for attempt in {1..100}; do
+    if ! kill -0 "${pid}" >/dev/null 2>&1; then
+      wait "${pid}" >/dev/null 2>&1 || true
+      return 0
+    fi
+    sleep 0.01
+  done
+  kill -KILL "${pid}" >/dev/null 2>&1 || true
+  wait "${pid}" >/dev/null 2>&1 || true
+}
+
+cleanup() {
+  set +e
+  terminate_pid "${tracked_pid}"
+  if [[ "${fake_kubectl_pid}" != "${tracked_pid}" ]]; then
+    terminate_pid "${fake_kubectl_pid}"
+  fi
+  if [[ -d "${test_root}" ]]; then
+    rm -R -- "${test_root}"
+  fi
+}
+trap cleanup EXIT
+
+fail() {
+  printf 'not ok - %s\n' "$*" >&2
+  exit 1
+}
+
+extract_function() {
+  local name="$1"
+  awk -v signature="${name}() {" '
+    $0 == signature { copying = 1 }
+    copying { print }
+    copying && $0 == "}" { exit }
+  ' "${script}"
+}
+
+mkdir -p "${fake_bin}"
+cat >"${fake_bin}/kubectl" <<'FAKE_KUBECTL'
+#!/usr/bin/env bash
+set -Eeuo pipefail
+printf '%s\n' "$$" >"${FAKE_KUBECTL_PID_FILE:?}"
+printf '%s\n' "$*" >"${FAKE_KUBECTL_ARGS_FILE:?}"
+exec tail -f /dev/null
+FAKE_KUBECTL
+chmod +x "${fake_bin}/kubectl"
+
+export PATH="${fake_bin}:${PATH}"
+export FAKE_KUBECTL_PID_FILE="${fake_pid_file}"
+export FAKE_KUBECTL_ARGS_FILE="${fake_args_file}"
+
+stop_body="$(extract_function stop_api_forward)"
+start_process_body="$(extract_function start_api_forward_process)"
+start_body="$(extract_function start_api_forward)"
+[[ -n "${stop_body}" && -n "${start_body}" ]] || fail 'could not extract port-forward lifecycle functions'
+eval "${stop_body}"
+[[ -z "${start_process_body}" ]] || eval "${start_process_body}"
+eval "${start_body}"
+
+context="fixture-context"
+orka_namespace="fixture-system"
+controller_deployment="fixture-controller"
+api_local_port=18080
+controller_api_port=8080
+api_forward_log="${test_root}/port-forward.log"
+api_forward_pid=""
+
+k() {
+  kubectl --context "${context}" "$@"
+}
+
+api_forward_ready() {
+  local pid
+  [[ -s "${fake_pid_file}" ]] || return 1
+  read -r pid <"${fake_pid_file}"
+  [[ -n "${api_forward_pid}" ]] &&
+    kill -0 "${api_forward_pid}" >/dev/null 2>&1 &&
+    kill -0 "${pid}" >/dev/null 2>&1
+}
+
+die() {
+  fail "$*"
+}
+
+redact() {
+  cat
+}
+
+start_api_forward
+tracked_pid="${api_forward_pid}"
+for _ in {1..100}; do
+  [[ -s "${fake_pid_file}" ]] && break
+  sleep 0.01
+done
+[[ -s "${fake_pid_file}" ]] || fail 'fake kubectl did not record its PID'
+read -r fake_kubectl_pid <"${fake_pid_file}"
+
+[[ "${tracked_pid}" == "${fake_kubectl_pid}" ]] ||
+  fail "tracked PID ${tracked_pid} is not the kubectl PID ${fake_kubectl_pid}"
+
+expected_args="--context ${context} -n ${orka_namespace} port-forward"
+expected_args+=" --address=127.0.0.1 deployment/${controller_deployment}"
+expected_args+=" ${api_local_port}:${controller_api_port}"
+[[ "$(cat "${fake_args_file}")" == "${expected_args}" ]] ||
+  fail 'kubectl port-forward did not retain the explicit context and expected arguments'
+
+stop_api_forward || fail 'stop_api_forward reported a cleanup failure'
+[[ -z "${api_forward_pid}" ]] || fail 'stop_api_forward did not clear the tracked PID'
+if kill -0 "${fake_kubectl_pid}" >/dev/null 2>&1; then
+  fail "kubectl PID ${fake_kubectl_pid} survived stop_api_forward"
+fi
+
+printf '%s\n' 'ok - controller API port-forward tracks and terminates the actual kubectl process'
diff --git a/scripts/tests/live-github-oidc-e2e-test.sh b/scripts/tests/live-github-oidc-e2e-test.sh
new file mode 100755
index 000000000..230bfa6c9
--- /dev/null
+++ b/scripts/tests/live-github-oidc-e2e-test.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+script="${root}/scripts/live-github-oidc-e2e.sh"
+
+grep -Fq 'oidc_namespace="${ORKA_GITHUB_OIDC_NAMESPACE:-${namespace}}"' "${script}"
+grep -Fq '[[ "${namespace}" == "orka-system" ]]' "${script}"
+grep -Fq '[[ "${oidc_namespace}" == "${namespace}" ]]' "${script}"
+grep -Fq -- '--arg namespace "${oidc_namespace}"' "${script}"
+grep -Fq 'namespace:$namespace' "${script}"
+
+if grep -Fq 'namespace:"default"' "${script}"; then
+  echo 'live GitHub OIDC E2E still submits Tasks to the pre-isolation default namespace' >&2
+  exit 1
+fi
+
+printf '%s\n' 'ok - live GitHub OIDC identity and Task namespaces match the canonical isolated controller'
diff --git a/scripts/tests/release-manifest-test.sh b/scripts/tests/release-manifest-test.sh
new file mode 100755
index 000000000..28c4da725
--- /dev/null
+++ b/scripts/tests/release-manifest-test.sh
@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+updater="${root}/scripts/update-release-version.py"
+
+for command in awk grep python3; do
+  command -v "${command}" >/dev/null 2>&1 || {
+    printf 'required command not found: %s\n' "${command}" >&2
+    exit 1
+  }
+done
+
+test_root="$(mktemp -d "${TMPDIR:-/tmp}/orka-release-manifest-test.XXXXXX")"
+cleanup() {
+  rm -rf -- "${test_root}"
+}
+trap cleanup EXIT
+
+workflow_job() {
+  local job_name="$1"
+  awk -v header="  ${job_name}:" '
+    $0 == header {
+      in_job = 1
+    }
+    in_job && $0 != header && $0 ~ /^  [^[:space:]][^:]*:$/ {
+      exit
+    }
+    in_job {
+      print
+    }
+  ' "${root}/.github/workflows/release.yml"
+}
+
+mkdir -p \
+  "${test_root}/scripts" \
+  "${test_root}/cmd/build/helmify/static" \
+  "${test_root}/config/manager"
+cp "${updater}" "${test_root}/scripts/update-release-version.py"
+
+cat >"${test_root}/Makefile" <<'EOF_MAKEFILE'
+VERSION := v0.0.1
+EOF_MAKEFILE
+
+cat >"${test_root}/cmd/build/helmify/static/Chart.yaml" <<'EOF_CHART'
+apiVersion: v2
+name: orka
+version: 0.0.1
+appVersion: "v0.0.1"
+EOF_CHART
+
+cat >"${test_root}/cmd/build/helmify/static/values.yaml" <<'EOF_VALUES'
+controller:
+  image:
+    repository: ghcr.io/orka-agents/orka
+    tag: "0.0.1"
+publisher:
+  image:
+    repository: ghcr.io/orka-agents/orka/workspace-publisher
+    tag: "0.0.1"
+harnessV1:
+  image:
+    repository: ghcr.io/orka-agents/orka/agent-harness-wrapper
+    # Releases publish the compatibility image, but harness-v1 renders still
+    # require operators to supply its immutable digest.
+    tag: "0.0.1"
+workers:
+  ai:
+    image:
+      repository: ghcr.io/orka-agents/orka/ai-worker
+      tag: "0.0.1"
+  general:
+    image:
+      repository: ghcr.io/orka-agents/orka/general-worker
+      tag: "0.0.1"
+EOF_VALUES
+
+cat >"${test_root}/config/manager/manager.yaml" <<'EOF_MANAGER'
+args:
+  - --ai-worker-image=ghcr.io/orka-agents/orka/ai-worker:0.0.1
+  - --general-worker-image=ghcr.io/orka-agents/orka/general-worker:0.0.1
+EOF_MANAGER
+
+cat >"${test_root}/config/manager/kustomization.yaml" <<'EOF_KUSTOMIZATION'
+images:
+  - name: ghcr.io/orka-agents/orka
+    newTag: 0.0.1
+  - name: controller
+    newTag: 0.0.1
+EOF_KUSTOMIZATION
+
+python3 "${test_root}/scripts/update-release-version.py" v9.8.7-rc.3 >/dev/null
+
+grep -Fx 'VERSION := v9.8.7-rc.3' "${test_root}/Makefile" >/dev/null
+grep -Fx 'version: 9.8.7-rc.3' "${test_root}/cmd/build/helmify/static/Chart.yaml" >/dev/null
+grep -Fx 'appVersion: "v9.8.7-rc.3"' "${test_root}/cmd/build/helmify/static/Chart.yaml" >/dev/null
+test "$(grep -Fc 'tag: "9.8.7-rc.3"' "${test_root}/cmd/build/helmify/static/values.yaml")" -eq 5
+grep -Fq 'ghcr.io/orka-agents/orka/ai-worker:9.8.7-rc.3' "${test_root}/config/manager/manager.yaml"
+grep -Fq 'ghcr.io/orka-agents/orka/general-worker:9.8.7-rc.3' "${test_root}/config/manager/manager.yaml"
+test "$(grep -Fc 'newTag: 9.8.7-rc.3' "${test_root}/config/manager/kustomization.yaml")" -eq 2
+
+if python3 "${test_root}/scripts/update-release-version.py" 9.8.7 >/dev/null 2>&1; then
+  echo 'release updater accepted a tag without the required v prefix' >&2
+  exit 1
+fi
+
+grep -Fq 'run: scripts/validate-release-manifest.sh "${GITHUB_REF_NAME}"' \
+  "${root}/.github/workflows/release.yml"
+grep -Fq 'make verify-release-manifest NEWVERSION="${NEWVERSION}"' \
+  "${root}/.github/workflows/release-pr.yml"
+build_job="$(workflow_job build-and-push)"
+scan_job="$(workflow_job scan)"
+sign_job="$(workflow_job sign-and-attest)"
+promotion_job="$(workflow_job promote-release-tags)"
+test "$(grep -Fc -- '- image: agent-harness-wrapper' <<<"${build_job}")" -eq 1
+test "$(grep -Fc 'image_suffix: "/agent-harness-wrapper"' <<<"${build_job}")" -eq 1
+grep -Fq 'dockerfile: workers/harness/Dockerfile' <<<"${build_job}"
+test "$(grep -Fc -- '- image: agent-harness-wrapper' <<<"${scan_job}")" -eq 2
+test "$(grep -Fc 'image_suffix: "/agent-harness-wrapper"' <<<"${scan_job}")" -eq 2
+test "$(grep -Fc -- '- image: agent-harness-wrapper' <<<"${sign_job}")" -eq 1
+test "$(grep -Fc 'image_suffix: "/agent-harness-wrapper"' <<<"${sign_job}")" -eq 1
+grep -Fq 'promote_image agent-harness-wrapper "/agent-harness-wrapper"' <<<"${promotion_job}"
+
+printf '%s\n' 'ok - release versioning and harness compatibility image policy are coherent'
diff --git a/scripts/tests/security-scan-e2e-test.sh b/scripts/tests/security-scan-e2e-test.sh
new file mode 100644
index 000000000..2603a32c8
--- /dev/null
+++ b/scripts/tests/security-scan-e2e-test.sh
@@ -0,0 +1,466 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+security_script="${root}/scripts/security-scan-e2e.sh"
+
+for command in cmp jq; do
+  command -v "${command}" >/dev/null 2>&1 || {
+    echo "required command not found: ${command}" >&2
+    exit 1
+  }
+done
+
+test_root="$(mktemp -d "${TMPDIR:-/tmp}/security-scan-e2e-test.XXXXXX")"
+cleanup() {
+  rm -rf -- "${test_root}"
+}
+trap cleanup EXIT
+
+export RUNNER_TEMP="${test_root}"
+export ORKA_SECURITY_SCAN_NAME="security-goof"
+export ORKA_SECURITY_BAD_SCAN_NAME="security-goof-malformed-result"
+export ORKA_SECURITY_SCAN_AGENT="security-scan-e2e-agent"
+export ORKA_SECURITY_SCAN_TARGET_REPO="https://github.com/sozercan/vekil"
+export ORKA_SECURITY_SCAN_TARGET_BRANCH="main"
+export ORKA_SECURITY_SCAN_TARGET_REF="add14ba59e98240d9e00a235dd7d42cd61ae9912"
+# shellcheck source=scripts/security-scan-e2e.sh
+source "${security_script}"
+
+[[ "${target_owner}" == "sozercan" ]]
+[[ "${target_repository}" == "vekil" ]]
+
+manifest_capture="${work_dir}/manifest.yaml"
+kubectl() {
+  [[ "$*" == "apply -f -" ]] || return 1
+  cat >"${manifest_capture}"
+}
+
+apply_agent
+grep -F 'defaultAllowBash: true' "${manifest_capture}" >/dev/null
+if grep -F 'defaultAllowBash: false' "${manifest_capture}" >/dev/null; then
+  echo "SecurityScan fixture requested an unenforceable Codex tool restriction" >&2
+  exit 1
+fi
+
+apply_repository_scan "${scan_name}"
+grep -F 'repoURL: https://github.com/sozercan/vekil' "${manifest_capture}" >/dev/null
+grep -F 'owner: sozercan' "${manifest_capture}" >/dev/null
+grep -F 'repository: vekil' "${manifest_capture}" >/dev/null
+
+positive="${work_dir}/positive"
+malformed="${work_dir}/malformed"
+scan_id="scan_fixture"
+policy_digest="sha256:$(printf 'a%.0s' {1..64})"
+context_digest="sha256:$(printf 'c%.0s' {1..64})"
+idempotency_key="scanidem:$(printf 'b%.0s' {1..64})"
+
+jq -n \
+  --arg ref "${target_ref}" \
+  --arg scanID "${scan_id}" '{
+  status: {
+    phase: "Ready",
+    lastScanID: $scanID,
+    lastScanTaskName: "threat-task",
+    lastScanAt: "2026-08-09T00:00:00Z",
+    lastSuccessfulScanAt: "2026-08-09T00:00:00Z",
+    lastProcessedCommit: $ref,
+    lastObservedHeadSHA: $ref,
+    threatModelVersion: 1,
+    findingCounts: {total: 1, high: 1},
+    conditions: [{type: "Ready", status: "True", reason: "ScanSucceeded"}]
+  }
+}' >"${positive}-scan.json"
+
+jq -n \
+  --arg agent "${agent_name}" \
+  --arg branch "${target_branch}" \
+  --arg ref "${target_ref}" \
+  --arg repo "${target_repo}" \
+  --arg scanID "${scan_id}" \
+  --arg scanName "${scan_name}" '
+  def labels($stage; $slice): {
+    "orka.ai/security-target": $scanName,
+    "orka.ai/security-scan-id": $scanID,
+    "orka.ai/security-scan-mode": "initial",
+    "orka.ai/security-stage": $stage
+  } + (if $slice == "" then {} else {"orka.ai/security-slice-id": $slice} end);
+  def owner: [{kind: "RepositoryScan", name: $scanName, controller: true}];
+  def agentSpec: {
+    type: "agent", agentRef: {name: $agent},
+    workspace: {intent: "read", gitRepo: $repo, branch: $branch, ref: $ref}
+  };
+  def agentStatus: {
+    phase: "Succeeded", resultRef: {available: true},
+    agentExecutionBinding: {contractVersion: "orka.harness.v2", backend: "runtime-pool"},
+    execution: {state: "Succeeded", outcome: "Succeeded"},
+    delivery: {state: "ReadValidated", outcome: "ReadValidated"}
+  };
+  {items: [
+    {metadata: {name: "threat-task", labels: labels("threat-model"; ""), ownerReferences: owner}, spec: agentSpec, status: agentStatus},
+    {metadata: {name: "mapper-task", labels: labels("mapper"; ""), ownerReferences: owner},
+     spec: {type: "container", command: ["--security-mapper"], env: [{name: "ORKA_SECURITY_REPOSITORY_SCAN", value: $scanName}]},
+     status: {phase: "Succeeded"}},
+    {metadata: {name: "review-task", labels: labels("review"; "slice_api"), ownerReferences: owner}, spec: agentSpec, status: agentStatus}
+  ]}
+' >"${positive}-tasks.json"
+
+jq -n \
+  --arg idempotency "${idempotency_key}" \
+  --arg policy "${policy_digest}" \
+  --arg scanID "${scan_id}" \
+  --arg scanName "${scan_name}" '{items: [{
+    id: $scanID, repositoryScan: $scanName, taskName: "threat-task", mode: "initial", phase: "succeeded",
+    completedAt: "2026-08-09T00:00:00Z", policyDigest: $policy, idempotencyKey: $idempotency,
+    sliceCount: 1, reviewedSliceCount: 1, skippedSliceCount: 0, acceptedFindings: 1, droppedFindings: 1
+  }]}' >"${positive}-runs.json"
+jq -n --arg context "${context_digest}" --arg scanID "${scan_id}" '{items: [{
+  id: "slice_api", status: "reviewed", lastScanRunID: $scanID, reviewContextHash: $context
+}]}' >"${positive}-slices.json"
+jq -n --arg scanID "${scan_id}" --arg scanName "${scan_name}" '{items: [{
+  id: "fnd_fixture", repositoryScan: $scanName, scanRunID: $scanID, category: "authorization", severity: "high",
+  evidence: [{path: "server.js", startLine: 17, endLine: 17}]
+}]}' >"${positive}-findings.json"
+jq -n --arg scanID "${scan_id}" --arg scanName "${scan_name}" '{items: [{
+  id: "drop_fixture", repositoryScan: $scanName, scanRunID: $scanID, taskName: "review-task", sliceID: "slice_api",
+  layer: "validation", reason: "evidence path is outside the trusted review context"
+}]}' >"${positive}-dropped.json"
+jq -n --arg scanID "${scan_id}" '{source: "generated", generatedByScan: $scanID, version: 1, content: "# Threat Model"}' \
+  >"${positive}-threat-model.json"
+
+assert_positive_scan_snapshot "${positive}"
+positive_scan_idempotency_snapshot "${positive}" >"${work_dir}/snapshot-a.json"
+positive_scan_idempotency_snapshot "${positive}" >"${work_dir}/snapshot-b.json"
+cmp -s "${work_dir}/snapshot-a.json" "${work_dir}/snapshot-b.json"
+
+jq '.items[0].spec.env = [{name: "UNTRUSTED", value: "forbidden"}]' "${positive}-tasks.json" >"${work_dir}/positive-env.json"
+cp "${positive}-tasks.json" "${work_dir}/positive-tasks-original.json"
+cp "${work_dir}/positive-env.json" "${positive}-tasks.json"
+if (assert_positive_scan_snapshot "${positive}" >/dev/null 2>&1); then
+  echo "positive gate accepted an agent Task with arbitrary env" >&2
+  exit 1
+fi
+cp "${work_dir}/positive-tasks-original.json" "${positive}-tasks.json"
+
+bad_scan_id="scan_bad_fixture"
+expected_error="threat model terminal result is missing or invalid: security result scanId does not match task run"
+jq -n --arg scanID "${bad_scan_id}" --arg expected "${expected_error}" '{status: {
+  phase: "Error", lastScanID: $scanID, lastScanTaskName: "bad-threat-task", lastScanAt: "2026-08-09T00:01:00Z",
+  conditions: [{type: "Ready", status: "False", reason: "ScanFailed", message: $expected}]
+}}' >"${malformed}-scan.json"
+jq -n \
+  --arg agent "${agent_name}" \
+  --arg scanID "${bad_scan_id}" \
+  --arg scanName "${bad_scan_name}" '{items: [{
+    metadata: {name: "bad-threat-task", labels: {
+      "orka.ai/security-target": $scanName, "orka.ai/security-scan-id": $scanID,
+      "orka.ai/security-scan-mode": "initial", "orka.ai/security-stage": "threat-model"
+    }},
+    spec: {type: "agent", agentRef: {name: $agent}},
+    status: {
+      phase: "Succeeded", resultRef: {available: true},
+      agentExecutionBinding: {contractVersion: "orka.harness.v2", backend: "runtime-pool"},
+      execution: {state: "Succeeded", outcome: "Succeeded"},
+      delivery: {state: "ReadValidated", outcome: "ReadValidated"}
+    }
+  }]}' >"${malformed}-tasks.json"
+jq -n \
+  --arg expected "${expected_error}" \
+  --arg scanID "${bad_scan_id}" \
+  --arg scanName "${bad_scan_name}" '{items: [{
+    id: $scanID, repositoryScan: $scanName, phase: "failed", errorMessage: $expected,
+    sliceCount: 0, acceptedFindings: 0, droppedFindings: 0
+  }]}' >"${malformed}-runs.json"
+for suffix in slices findings dropped; do
+  jq -n '{items: []}' >"${malformed}-${suffix}.json"
+done
+assert_malformed_scan_snapshot "${malformed}"
+
+jq '.items += [{metadata:{labels:{"orka.ai/security-scan-id":"scan_bad_fixture","orka.ai/security-stage":"mapper"}}}]' \
+  "${malformed}-tasks.json" >"${work_dir}/malformed-extra-task.json"
+cp "${malformed}-tasks.json" "${work_dir}/malformed-tasks-original.json"
+cp "${work_dir}/malformed-extra-task.json" "${malformed}-tasks.json"
+if (assert_malformed_scan_snapshot "${malformed}" >/dev/null 2>&1); then
+  echo "malformed-result gate accepted downstream work" >&2
+  exit 1
+fi
+
+# shellcheck disable=SC2016 # The harness source must contain this literal variable reference.
+grep -Fq 'ACP_CODEX_RUNTIME_IMG="${fake_runtime_ref}"' "${security_script}"
+if grep -Fq 'tasks do not support arbitrary task env' "${security_script}"; then
+  echo "legacy negative-only compatibility gate remains" >&2
+  exit 1
+fi
+
+kind_calls="${work_dir}/kind-calls"
+kind_mode="collision"
+kind() {
+  if [[ "$1 $2" == "get clusters" ]]; then
+    if [[ "${kind_mode}" == "collision" || "${kind_mode}" == "appeared-after-create-failure" ]]; then
+      printf '%s\n' "${kind_cluster}"
+    fi
+    return 0
+  fi
+  printf '%q ' "$@" >>"${kind_calls}"
+  printf '\n' >>"${kind_calls}"
+  if [[ "$1 $2" == "create cluster" && "${kind_mode}" == "create-fail" ]]; then
+    kind_mode="appeared-after-create-failure"
+    return 1
+  fi
+  return 0
+}
+
+kind_cluster="security-scan-collision"
+kind_cleanup_armed="0"
+if (setup_kind_cluster >/dev/null 2>&1); then
+  echo "SecurityScan harness reused a pre-existing Kind cluster" >&2
+  exit 1
+fi
+[[ ! -s "${kind_calls}" ]]
+
+kind_mode="fresh"
+kind_cluster="security-scan-fresh"
+kind_config="${work_dir}/isolated-kind.yaml"
+kubeconfig_file="${work_dir}/isolated-kubeconfig"
+unset ORKA_SECURITY_SCAN_KIND_CONFIG
+initialize_isolated_kubeconfig
+[[ "${KUBECONFIG}" == "${kubeconfig_file}" ]]
+[[ "$(stat -c '%a' "${kubeconfig_file}" 2>/dev/null || stat -f '%Lp' "${kubeconfig_file}")" == "600" ]]
+setup_kind_cluster >/dev/null 2>&1
+[[ "${kind_cleanup_armed}" == "1" ]]
+grep -Fq -- "create cluster --name ${kind_cluster} --config ${kind_config} --kubeconfig ${kubeconfig_file}" "${kind_calls}"
+
+kind_mode="create-fail"
+kind_cluster="security-scan-create-fail"
+kind_config="${work_dir}/failed-kind.yaml"
+kubeconfig_file="${work_dir}/failed-kubeconfig"
+kind_cleanup_armed="0"
+initialize_isolated_kubeconfig
+if setup_kind_cluster >/dev/null 2>&1; then
+  echo "failed Kind creation unexpectedly succeeded" >&2
+  exit 1
+fi
+[[ "${kind_cleanup_armed}" == "0" ]] || {
+  echo "failed Kind creation armed destructive cleanup without ownership" >&2
+  exit 1
+}
+[[ "${kind_mode}" == "appeared-after-create-failure" ]] || {
+  echo "failed Kind creation fixture did not expose the competing cluster" >&2
+  exit 1
+}
+kind_failure_cleanup_dir="${work_dir}/kind-failure-cleanup"
+mkdir -p "${kind_failure_cleanup_dir}"
+set +e
+(
+  work_dir="${kind_failure_cleanup_dir}"
+  registry_cleanup_armed="0"
+  kind_lock_held="0"
+  on_exit 1 >/dev/null 2>&1
+)
+kind_failure_cleanup_status=$?
+set -e
+[[ "${kind_failure_cleanup_status}" == "1" ]]
+[[ ! -e "${kind_failure_cleanup_dir}" ]]
+if grep -Fq -- "delete cluster --name ${kind_cluster}" "${kind_calls}"; then
+  echo "failed Kind creation deleted a cluster that appeared after the ownership check" >&2
+  exit 1
+fi
+kind_cluster_exists || {
+  echo "competing Kind cluster disappeared during unarmed cleanup" >&2
+  exit 1
+}
+
+kind_cluster="security-scan-lock"
+kind_lock_dir=""
+kind_lock_held="0"
+acquire_kind_cluster_lock
+[[ "${kind_lock_held}" == "1" && -d "${kind_lock_dir}" ]]
+if (kind_lock_held="0"; acquire_kind_cluster_lock >/dev/null 2>&1); then
+  echo "SecurityScan harness allowed concurrent ownership of one Kind cluster" >&2
+  exit 1
+fi
+rmdir "${kind_lock_dir}"
+kind_lock_held="0"
+
+[[ "$(security_scan_exit_status 7 1)" == "7" ]]
+[[ "$(security_scan_exit_status 0 1)" == "1" ]]
+[[ "$(security_scan_exit_status 0 0)" == "0" ]]
+
+registry_state="${work_dir}/registry-state"
+registry_error="${work_dir}/registry-error"
+docker_mode="ok"
+docker() {
+  local command="$1"
+  shift
+  case "${command}" in
+    run)
+      local owner=""
+      while (( $# > 0 )); do
+        if [[ "$1" == "--label" ]]; then
+          owner="${2#io.orka.test.owner=}"
+          shift 2
+        else
+          shift
+        fi
+      done
+      if [[ "${docker_mode}" == "start-collision" ]]; then
+        printf '%s\n' 'foreign-owner' >"${registry_state}"
+        return 1
+      fi
+      if [[ -s "${registry_state}" ]]; then
+        return 1
+      fi
+      printf '%s\n' "${owner}" >"${registry_state}"
+      ;;
+    rm)
+      : >"${registry_state}"
+      ;;
+    port)
+      printf '127.0.0.1:50001\n'
+      ;;
+    exec)
+      ;;
+    container)
+      local subcommand="$1"
+      shift
+      case "${subcommand}" in
+        ls)
+          [[ "${docker_mode}" != "error" ]] || return 1
+          [[ ! -s "${registry_state}" ]] || printf 'fixture-container-id\n'
+          ;;
+        inspect)
+          [[ -s "${registry_state}" ]] || return 1
+          cat "${registry_state}"
+          ;;
+        rm)
+          : >"${registry_state}"
+          ;;
+        *) return 1 ;;
+      esac
+      ;;
+    *) return 1 ;;
+  esac
+}
+curl() { return 0; }
+kind() {
+  [[ "$1 $2" == "get nodes" ]] || return 1
+}
+
+: >"${registry_state}"
+ORKA_KIND_REGISTRY_NAME=""
+printf '%s\n' 'foreign-owner' >"${registry_state}"
+if orka_kind_registry_start "security-scan-owned" "owner-a" >/dev/null 2>&1; then
+  echo "owned registry startup replaced a foreign container" >&2
+  exit 1
+fi
+[[ "$(<"${registry_state}")" == "foreign-owner" ]]
+
+: >"${registry_state}"
+ORKA_KIND_REGISTRY_NAME=""
+docker_mode="start-collision"
+if orka_kind_registry_start "security-scan-owned" "owner-a" >/dev/null 2>&1; then
+  echo "owned registry startup ignored a name collision" >&2
+  exit 1
+fi
+[[ "$(<"${registry_state}")" == "foreign-owner" ]]
+registry_collision_cleanup_dir="${work_dir}/registry-collision-cleanup"
+mkdir -p "${registry_collision_cleanup_dir}"
+set +e
+(
+  work_dir="${registry_collision_cleanup_dir}"
+  registry_cleanup_armed="1"
+  registry_owner="owner-a"
+  kind_cleanup_armed="0"
+  kind_lock_held="0"
+  on_exit 1 >/dev/null 2>&1
+)
+registry_collision_cleanup_status=$?
+set -e
+[[ "${registry_collision_cleanup_status}" == "1" ]]
+[[ ! -e "${registry_collision_cleanup_dir}" ]]
+[[ "$(<"${registry_state}")" == "foreign-owner" ]] || {
+  echo "armed cleanup removed the foreign registry after a start collision" >&2
+  exit 1
+}
+
+: >"${registry_state}"
+ORKA_KIND_REGISTRY_NAME=""
+docker_mode="ok"
+orka_kind_registry_start "security-scan-owned" "owner-a"
+[[ "$(<"${registry_state}")" == "owner-a" ]]
+if orka_kind_registry_stop "security-scan-owned" "owner-b" 2>"${registry_error}"; then
+  echo "owned registry cleanup accepted the wrong owner" >&2
+  exit 1
+fi
+[[ "$(<"${registry_state}")" == "owner-a" ]]
+grep -Fq 'without matching ownership' "${registry_error}"
+orka_kind_registry_stop "security-scan-owned" "owner-a"
+[[ ! -s "${registry_state}" ]]
+
+printf '%s\n' 'owner-a' >"${registry_state}"
+docker_mode="error"
+if orka_kind_registry_stop "security-scan-owned" "owner-a" >/dev/null 2>&1; then
+  echo "registry cleanup treated a Docker transport error as absence" >&2
+  exit 1
+fi
+
+cleanup_transport_dir="${work_dir}/cleanup-transport-success"
+mkdir -p "${cleanup_transport_dir}"
+set +e
+(
+  work_dir="${cleanup_transport_dir}"
+  registry_cleanup_armed="1"
+  registry_owner="owner-a"
+  kind_cleanup_armed="0"
+  kind_lock_held="0"
+  on_exit 0 >/dev/null 2>&1
+)
+cleanup_transport_status=$?
+set -e
+[[ "${cleanup_transport_status}" == "1" ]] || {
+  echo "successful SecurityScan run ignored a cleanup transport failure" >&2
+  exit 1
+}
+[[ ! -e "${cleanup_transport_dir}" ]]
+
+cleanup_precedence_dir="${work_dir}/cleanup-transport-original-failure"
+mkdir -p "${cleanup_precedence_dir}"
+set +e
+(
+  work_dir="${cleanup_precedence_dir}"
+  registry_cleanup_armed="1"
+  registry_owner="owner-a"
+  kind_cleanup_armed="0"
+  kind_lock_held="0"
+  on_exit 7 >/dev/null 2>&1
+)
+cleanup_precedence_status=$?
+set -e
+[[ "${cleanup_precedence_status}" == "7" ]] || {
+  echo "cleanup failure replaced the original SecurityScan failure status" >&2
+  exit 1
+}
+[[ ! -e "${cleanup_precedence_dir}" ]]
+
+preflight_root="${test_root}/preflight-cleanup"
+preflight_bin="${test_root}/preflight-bin"
+preflight_error="${test_root}/preflight-error"
+mkdir -p "${preflight_root}" "${preflight_bin}"
+for command in chmod date dirname mktemp rm tr; do
+  ln -s "$(command -v "${command}")" "${preflight_bin}/${command}"
+done
+true_binary="/usr/bin/true"
+[[ -x "${true_binary}" ]] || true_binary="/bin/true"
+ln -s "${true_binary}" "${preflight_bin}/make"
+if RUNNER_TEMP="${preflight_root}" PATH="${preflight_bin}" /bin/bash "${security_script}" \
+  >/dev/null 2>"${preflight_error}"; then
+  echo "missing prerequisite unexpectedly passed SecurityScan preflight" >&2
+  exit 1
+fi
+grep -Fq 'missing required command: go' "${preflight_error}"
+if find "${preflight_root}" -mindepth 1 -maxdepth 1 -name 'security-scan-e2e.*' -print -quit | grep -q .; then
+  echo "SecurityScan preflight failure leaked its work directory" >&2
+  exit 1
+fi
+
+printf '%s\n' 'ok - SecurityScan harness-v2 positive ingestion and malformed-result assertions are exact'
diff --git a/scripts/tests/static-mode-deploy-gate-test.sh b/scripts/tests/static-mode-deploy-gate-test.sh
new file mode 100644
index 000000000..f879327ac
--- /dev/null
+++ b/scripts/tests/static-mode-deploy-gate-test.sh
@@ -0,0 +1,264 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+test_root="$(mktemp -d "${TMPDIR:-/tmp}/static-mode-deploy-gate-test.XXXXXX")"
+cleanup() {
+  rm -rf "${test_root}"
+}
+trap cleanup EXIT
+
+fake_bin="${test_root}/bin"
+mkdir -p "${fake_bin}"
+cat >"${fake_bin}/kubectl" <<'EOF_FAKE_KUBECTL'
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+if [[ "$1" == "get" && "$2" == "crd" && $# -ge 3 ]]; then
+  crd="$3"
+  if [[ "${FAKE_MISSING_CRD:-}" == "${crd}" ]]; then
+    exit 1
+  fi
+  case "${crd}" in
+    agentexecutioncontrols.core.orka.ai|agentexecutionpolicies.core.orka.ai|agentexecutionadjudications.core.orka.ai)
+      if [[ "${FAKE_OBSOLETE_CRD:-}" == "${crd}" ]]; then
+        printf '%s\n' '{}'
+        exit 0
+      fi
+      exit 1
+      ;;
+    agentruntimes.core.orka.ai)
+      case "${FAKE_SCHEMA_MODE:-dual}" in
+        dual)
+          printf '%s\n' '{"spec":{"versions":[{"name":"v1alpha1","served":true,"schema":{"openAPIV3Schema":{"properties":{"spec":{"properties":{"contractVersion":{"enum":["orka.harness.v2","orka.harness.v1"]}}}}}}}]}}'
+          ;;
+        v2-only)
+          printf '%s\n' '{"spec":{"versions":[{"name":"v1alpha1","served":true,"schema":{"openAPIV3Schema":{"properties":{"spec":{"properties":{"contractVersion":{"enum":["orka.harness.v2"]}}}}}}}]}}'
+          ;;
+        no-served-version)
+          printf '%s\n' '{"spec":{"versions":[{"name":"v1alpha1","served":false,"schema":{"openAPIV3Schema":{"properties":{"spec":{"properties":{"contractVersion":{"enum":["orka.harness.v1","orka.harness.v2"]}}}}}}}]}}'
+          ;;
+        missing-enum)
+          printf '%s\n' '{"spec":{"versions":[{"name":"v1alpha1","served":true,"schema":{"openAPIV3Schema":{"properties":{"spec":{"properties":{}}}}}}]}}'
+          ;;
+        *)
+          echo "unknown FAKE_SCHEMA_MODE: ${FAKE_SCHEMA_MODE}" >&2
+          exit 2
+          ;;
+      esac
+      ;;
+    agents.core.orka.ai)
+      agent_schema='{"spec":{"versions":[{"name":"v1alpha1","served":true,"schema":{"openAPIV3Schema":{"properties":{"spec":{"properties":{"runtime":{"properties":{"contractVersion":{"enum":["orka.harness.v2","orka.harness.v1"]}},"x-kubernetes-validations":[{"message":"runtime.contractVersion is immutable once set"}]}}}}}}}]}}'
+      case "${FAKE_AGENT_SCHEMA_MODE:-dual}" in
+        dual)
+          printf '%s\n' "${agent_schema}"
+          ;;
+        v2-only)
+          jq '.spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.runtime.properties.contractVersion.enum = ["orka.harness.v2"]' <<<"${agent_schema}"
+          ;;
+        missing-immutability)
+          jq '.spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.runtime["x-kubernetes-validations"] = []' <<<"${agent_schema}"
+          ;;
+        *)
+          echo "unknown FAKE_AGENT_SCHEMA_MODE: ${FAKE_AGENT_SCHEMA_MODE}" >&2
+          exit 2
+          ;;
+      esac
+      ;;
+    tasks.core.orka.ai)
+      task_schema='{"spec":{"versions":[{"name":"v1alpha1","served":true,"schema":{"openAPIV3Schema":{"properties":{"status":{"properties":{"agentExecutionBinding":{"type":"object","properties":{"contractVersion":{"enum":["orka.harness.v2","orka.harness.v1"]}}}},"x-kubernetes-validations":[{"message":"agentExecutionBinding is write-once and immutable"}]}},"x-kubernetes-validations":[{"message":"Task spec is immutable after execution authority is recorded"}]}}}]}}'
+      case "${FAKE_TASK_SCHEMA_MODE:-dual}" in
+        dual)
+          printf '%s\n' "${task_schema}"
+          ;;
+        missing-authority)
+          jq 'del(.spec.versions[0].schema.openAPIV3Schema.properties.status.properties.agentExecutionBinding)' <<<"${task_schema}"
+          ;;
+        missing-immutability)
+          jq '.spec.versions[0].schema.openAPIV3Schema.properties.status["x-kubernetes-validations"] = []' <<<"${task_schema}"
+          ;;
+        legacy-disposition)
+          jq '.spec.versions[0].schema.openAPIV3Schema.properties.status.properties.agentExecutionQuarantine = {"type":"object"}' <<<"${task_schema}"
+          ;;
+        old-spec-immutability)
+          jq '.spec.versions[0].schema.openAPIV3Schema["x-kubernetes-validations"][0].message = "Task spec is immutable after execution authority or a migration disposition is recorded"' <<<"${task_schema}"
+          ;;
+        *)
+          echo "unknown FAKE_TASK_SCHEMA_MODE: ${FAKE_TASK_SCHEMA_MODE}" >&2
+          exit 2
+          ;;
+      esac
+      ;;
+    *)
+      exit 0
+      ;;
+  esac
+  exit 0
+fi
+
+if [[ "$1" == "wait" && "$2" == "--for=condition=Established" && "$3" == "--timeout=60s" && "$4" == crd/* ]]; then
+  crd="${4#crd/}"
+  [[ "${FAKE_UNESTABLISHED_CRD:-}" != "${crd}" ]]
+  exit
+fi
+
+echo "unexpected fake kubectl invocation: $*" >&2
+exit 2
+EOF_FAKE_KUBECTL
+chmod +x "${fake_bin}/kubectl"
+
+run_gate() {
+  make --no-print-directory -s -C "${root}" verify-static-mode-crds KUBECTL="${fake_bin}/kubectl"
+}
+
+expect_gate_failure() {
+  local expected="$1"
+  shift
+  local output
+  if output="$(env "$@" make --no-print-directory -s -C "${root}" verify-static-mode-crds KUBECTL="${fake_bin}/kubectl" 2>&1)"; then
+    echo "static-mode gate unexpectedly passed: ${expected}" >&2
+    exit 1
+  fi
+  grep -F "${expected}" <<<"${output}" >/dev/null || {
+    echo "expected gate failure not found: ${expected}" >&2
+    printf '%s\n' "${output}" >&2
+    exit 1
+  }
+}
+
+run_gate >/dev/null
+for crd in \
+  agentruntimes.core.orka.ai \
+  agents.core.orka.ai \
+  branchclaims.core.orka.ai \
+  controllerepochs.core.orka.ai \
+  executionworkspaceclasses.workspace.orka.ai \
+  executionworkspacepools.workspace.orka.ai \
+  executionworkspaceproviders.workspace.orka.ai \
+  executionworkspaces.workspace.orka.ai \
+  externaleffects.core.orka.ai \
+  fakepoolparameters.fake.workspace.orka.ai \
+  fakeproviderconfigs.fake.workspace.orka.ai \
+  gatewaybindings.gateway.orka.ai \
+  gatewayclasses.gateway.orka.ai \
+  gateways.gateway.orka.ai \
+  outboundaccesspolicies.core.orka.ai \
+  promptattempts.core.orka.ai \
+  providers.core.orka.ai \
+  publications.core.orka.ai \
+  repositorymonitors.core.orka.ai \
+  repositoryscans.core.orka.ai \
+  runtimepools.core.orka.ai \
+  runtimesessioncontrols.core.orka.ai \
+  skills.core.orka.ai \
+  substrateactorpools.core.orka.ai \
+  tasks.core.orka.ai \
+  tools.core.orka.ai; do
+  expect_gate_failure "missing shared CRD: ${crd}" FAKE_MISSING_CRD="${crd}"
+done
+for schema_mode in v2-only no-served-version missing-enum; do
+  expect_gate_failure 'AgentRuntime CRD is not the shared orka.harness.v1/orka.harness.v2 schema' FAKE_SCHEMA_MODE="${schema_mode}"
+done
+for schema_mode in v2-only missing-immutability; do
+  expect_gate_failure 'Agent CRD is missing the immutable shared contract selector' \
+    FAKE_AGENT_SCHEMA_MODE="${schema_mode}"
+done
+for schema_mode in missing-authority missing-immutability legacy-disposition old-spec-immutability; do
+  expect_gate_failure 'Task CRD is missing the static-mode execution-authority schema' \
+    FAKE_TASK_SCHEMA_MODE="${schema_mode}"
+done
+expect_gate_failure 'shared CRD is not Established: runtimepools.core.orka.ai' \
+  FAKE_UNESTABLISHED_CRD=runtimepools.core.orka.ai
+for obsolete_crd in \
+  agentexecutioncontrols.core.orka.ai \
+  agentexecutionpolicies.core.orka.ai \
+  agentexecutionadjudications.core.orka.ai; do
+  expect_gate_failure "unsupported superseded coexistence CRD remains installed: ${obsolete_crd}" \
+    FAKE_OBSOLETE_CRD="${obsolete_crd}"
+done
+
+grep -Eq '^deploy: .*verify-static-mode-crds' "${root}/Makefile"
+if grep -Eq '^deploy: .*verify-(coexistence-crds|acp-crd-cutover)' "${root}/Makefile"; then
+  echo 'deploy still depends on a superseded coexistence or hard-cutover gate' >&2
+  exit 1
+fi
+namespace_helper_line="$(grep -nF 'scripts/lib/ensure-static-mode-namespace.sh' "${root}/Makefile" | head -n1 | cut -d: -f1 || true)"
+first_secret_line="$(grep -nF 'get secret acp-artifact-capability' "${root}/Makefile" | head -n1 | cut -d: -f1 || true)"
+if [[ ! "${namespace_helper_line}" =~ ^[0-9]+$ || ! "${first_secret_line}" =~ ^[0-9]+$ ]] ||
+  ((namespace_helper_line >= first_secret_line)); then
+  echo 'deploy must establish the static namespace identity before writing installation Secrets' >&2
+  exit 1
+fi
+if grep -Fq 'create namespace orka-system --dry-run=client' "${root}/Makefile"; then
+  echo 'deploy must not create or adopt an unlabeled orka-system namespace' >&2
+  exit 1
+fi
+grep -F 'RUN_CONTROLLER_MODE ?= harness-v2' "${root}/Makefile" >/dev/null
+grep -F 'RUN_WATCH_NAMESPACE ?= orka-system' "${root}/Makefile" >/dev/null
+grep -F 'RUN_AGENT_EXECUTION_SNAPSHOT_KEY_FILE ?=' "${root}/Makefile" >/dev/null
+grep -F 'RUN_EXECUTION_MODE_CONTROLLER_USERNAMES ?= $(shell "$(KUBECTL)" auth whoami' "${root}/Makefile" >/dev/null
+grep -F -- '--controller-mode="$(RUN_CONTROLLER_MODE)"' "${root}/Makefile" >/dev/null
+grep -F -- '--watch-namespace="$(RUN_WATCH_NAMESPACE)"' "${root}/Makefile" >/dev/null
+grep -F -- '--agent-execution-snapshot-key-file="$(RUN_AGENT_EXECUTION_SNAPSHOT_KEY_FILE)"' "${root}/Makefile" >/dev/null
+grep -F -- '--enforce-namespace-isolation=true' "${root}/Makefile" >/dev/null
+grep -F -- '--execution-mode-controller-usernames="$(RUN_EXECUTION_MODE_CONTROLLER_USERNAMES)"' "${root}/Makefile" >/dev/null
+if grep -Eq 'RUN_LEGACY_FENCE_NAMESPACE|agent-execution-(host-mode|legacy-fence-namespace)' "${root}/Makefile"; then
+  echo 'run target still uses superseded execution-host flags' >&2
+  exit 1
+fi
+
+kustomize="${KUSTOMIZE:-${root}/bin/kustomize}"
+rendered_default="$("${kustomize}" build "${root}/config/default")"
+controller_store_pvc_count="$(
+  awk '
+    function finish_document() {
+      if (kind == "PersistentVolumeClaim" && name == "orka-controller-manager-store" && namespace == "orka-system") {
+        count++
+      }
+    }
+    /^---$/ {
+      finish_document()
+      kind = ""
+      name = ""
+      namespace = ""
+      in_metadata = 0
+      next
+    }
+    /^kind: / {
+      kind = $2
+      next
+    }
+    /^metadata:$/ {
+      in_metadata = 1
+      next
+    }
+    /^[^ ]/ {
+      in_metadata = 0
+    }
+    in_metadata && /^  name: / {
+      name = $2
+      next
+    }
+    in_metadata && /^  namespace: / {
+      namespace = $2
+    }
+    END {
+      finish_document()
+      print count + 0
+    }
+  ' <<<"${rendered_default}"
+)"
+[[ "${controller_store_pvc_count}" == "1" ]] || {
+  echo 'default manifest must contain one orka-system/orka-controller-manager-store PVC' >&2
+  exit 1
+}
+[[ "$(grep -Fc 'claimName: orka-controller-manager-store' <<<"${rendered_default}")" == "1" ]] || {
+  echo 'default manifest must mount the transformed controller store PVC exactly once' >&2
+  exit 1
+}
+if grep -Fq 'claimName: controller-manager-store' <<<"${rendered_default}"; then
+  echo 'default manifest retains the untransformed controller store PVC reference' >&2
+  exit 1
+fi
+
+printf '%s\n' 'ok - static-mode deployment requires the Established 26-CRD shared bundle, dual AgentRuntime/Agent/Task selectors, and no superseded coexistence CRDs'
diff --git a/scripts/tests/static-mode-e2e-namespace-test.sh b/scripts/tests/static-mode-e2e-namespace-test.sh
new file mode 100755
index 000000000..9a4dfdf4f
--- /dev/null
+++ b/scripts/tests/static-mode-e2e-namespace-test.sh
@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+security_script="${root}/scripts/security-scan-e2e.sh"
+substrate_script="${root}/scripts/agent-substrate-e2e.sh"
+label_script="${root}/scripts/live-github-label-trigger-e2e.sh"
+e2e_suite="${root}/test/e2e/e2e_suite_test.go"
+tls_helper="${root}/scripts/lib/e2e-admission-tls.sh"
+
+grep -Fq 'test_namespace="${ORKA_SECURITY_SCAN_E2E_NAMESPACE:-${orka_namespace}}"' "${security_script}"
+grep -Fq '[[ "${test_namespace}" == "${orka_namespace}" ]]' "${security_script}"
+grep -Fq 'ORKA_NAMESPACE="${ORKA_NAMESPACE:-orka-system}"' "${substrate_script}"
+grep -Fq 'kubectl -n "${ORKA_NAMESPACE}" apply -f -' "${substrate_script}"
+grep -Fq 'for ns in ate-demo "${ORKA_NAMESPACE}"; do' "${substrate_script}"
+grep -Fq 'ORKA_GITHUB_LABEL_TRIGGER_NAMESPACE="${orka_namespace}"' "${label_script}"
+grep -Fq 'namespace: ${orka_namespace}' "${label_script}"
+grep -Fq 'scripts", "lib", "ensure-static-mode-namespace.sh"' "${e2e_suite}"
+if grep -Fq 'exec.Command("kubectl", "create", "ns", namespace)' "${e2e_suite}"; then
+  echo 'Go E2E must not pre-create an unlabeled controller namespace' >&2
+  exit 1
+fi
+
+tls_verify_line="$(grep -nF 'openssl verify -CAfile' "${tls_helper}" | cut -d: -f1 || true)"
+tls_identity_line="$(grep -nF 'ensure-static-mode-namespace.sh' "${tls_helper}" | cut -d: -f1 || true)"
+tls_secret_line="$(grep -nF 'create secret generic "${secret_name}"' "${tls_helper}" | cut -d: -f1 || true)"
+if [[ ! "${tls_verify_line}" =~ ^[0-9]+$ || ! "${tls_identity_line}" =~ ^[0-9]+$ || ! "${tls_secret_line}" =~ ^[0-9]+$ ]] ||
+  ((tls_verify_line >= tls_identity_line || tls_identity_line >= tls_secret_line)); then
+  echo 'E2E TLS bootstrap must verify its certificate, establish namespace identity, then write the Secret' >&2
+  exit 1
+fi
+
+substrate_resource_setup="$(awk '/^create_substrate_resources\(\) {/,/^}/' "${substrate_script}")"
+namespace_create_line="$(grep -nF 'scripts/lib/ensure-static-mode-namespace.sh' <<<"${substrate_resource_setup}" | cut -d: -f1 || true)"
+secret_loop_line="$(grep -nF 'for ns in ate-demo "${ORKA_NAMESPACE}"; do' <<<"${substrate_resource_setup}" | cut -d: -f1 || true)"
+if [[ ! "${namespace_create_line}" =~ ^[0-9]+$ || ! "${secret_loop_line}" =~ ^[0-9]+$ ]] ||
+  ((namespace_create_line >= secret_loop_line)); then
+  echo 'agent-substrate E2E must establish the fail-closed Orka namespace identity before writing bootstrap Secrets' >&2
+  exit 1
+fi
+
+for script in "${security_script}" "${substrate_script}" "${label_script}"; do
+  if grep -Eq '(^|[[:space:]])-n[[:space:]]+default([[:space:]]|$)|^[[:space:]]*namespace:[[:space:]]+default([[:space:]]|$)|^[[:space:]]*value:[[:space:]]+default([[:space:]]|$)' "${script}"; then
+    echo "${script#"${root}/"} still places controller-owned resources in the pre-isolation default namespace" >&2
+    exit 1
+  fi
+done
+
+grep -Fq 'namespace: ate-demo' "${substrate_script}"
+
+mcp_template_namespace="$(
+  awk '
+    $0 == "  name: orka-mcp-ci" { found = 1; next }
+    found && $1 == "namespace:" { print $2; exit }
+  ' "${substrate_script}"
+)"
+if [[ "${mcp_template_namespace}" != '${ORKA_NAMESPACE}' ]]; then
+  echo 'agent-substrate E2E must colocate the MCP ActorTemplate with its isolated Orka Tool' >&2
+  exit 1
+fi
+grep -Fq 'kubectl -n ${ORKA_NAMESPACE} get actortemplate orka-mcp-ci' "${substrate_script}"
+
+for function_name in create_substrate_actor_pools create_mcp_tool; do
+  function_body="$(awk "/^${function_name}\\(\\) {/,/^}/" "${substrate_script}")"
+  template_namespace="$(
+    awk '
+      $0 ~ /^[[:space:]]+name: orka-mcp-ci$/ { found = 1; next }
+      found && $1 == "namespace:" { print $2; exit }
+      found { exit }
+    ' <<<"${function_body}"
+  )"
+  if [[ -n "${template_namespace}" ]]; then
+    echo "agent-substrate E2E ${function_name} must default the MCP ActorTemplate reference to its Orka namespace" >&2
+    exit 1
+  fi
+done
+
+if grep -Fq 'grant_substrate_provider_template_access' "${substrate_script}"; then
+  echo 'agent-substrate E2E must not grant cross-namespace ActorTemplate access' >&2
+  exit 1
+fi
+
+printf '%s\n' 'ok - static-mode E2E controller-owned resources stay in the isolated installation namespace'
diff --git a/scripts/tests/sync-helm-crds-test.sh b/scripts/tests/sync-helm-crds-test.sh
new file mode 100755
index 000000000..e478f471a
--- /dev/null
+++ b/scripts/tests/sync-helm-crds-test.sh
@@ -0,0 +1,299 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+script="${root}/scripts/sync-helm-crds.sh"
+test_root="$(mktemp -d "${TMPDIR:-/tmp}/sync-helm-crds-test.XXXXXX")"
+
+cleanup() {
+  rm -rf "${test_root}"
+}
+trap cleanup EXIT
+
+source_dir="${test_root}/config/crd/bases"
+destination_dir="${test_root}/charts/orka/crds"
+mkdir -p "${source_dir}" "${destination_dir}"
+
+printf '%s\n' 'kind: First' >"${source_dir}/core.orka.ai_firsts.yaml"
+printf '%s\n' 'kind: Second' >"${source_dir}/core.orka.ai_seconds.yaml"
+printf '%s\n' 'outdated' >"${destination_dir}/core.orka.ai_firsts.yaml"
+printf '%s\n' 'stale' >"${destination_dir}/core.orka.ai_stale.yaml"
+mkdir -p "${destination_dir}/legacy/nested"
+printf '%s\n' 'stale yml' >"${destination_dir}/legacy/stale.yml"
+printf '%s\n' '{"kind":"Stale"}' >"${destination_dir}/legacy/nested/stale.json"
+printf '%s\n' 'preserve this documentation' >"${destination_dir}/README.md"
+printf '%s\n' 'preserve this metadata' >"${destination_dir}/NOTES.txt"
+printf '%s\n' 'preserve nested docs' >"${destination_dir}/legacy/README.md"
+
+"${script}" --source "${source_dir}" --destination "${destination_dir}"
+
+cmp -s "${source_dir}/core.orka.ai_firsts.yaml" "${destination_dir}/core.orka.ai_firsts.yaml"
+cmp -s "${source_dir}/core.orka.ai_seconds.yaml" "${destination_dir}/core.orka.ai_seconds.yaml"
+[[ ! -e "${destination_dir}/core.orka.ai_stale.yaml" ]]
+[[ ! -e "${destination_dir}/legacy/stale.yml" ]]
+[[ ! -e "${destination_dir}/legacy/nested/stale.json" ]]
+grep -Fx 'preserve this documentation' "${destination_dir}/README.md" >/dev/null
+grep -Fx 'preserve this metadata' "${destination_dir}/NOTES.txt" >/dev/null
+grep -Fx 'preserve nested docs' "${destination_dir}/legacy/README.md" >/dev/null
+"${script}" --check --source "${source_dir}" --destination "${destination_dir}" >/dev/null
+
+sha256_file() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$1" | awk '{print tolower($1)}'
+  else
+    shasum -a 256 "$1" | awk '{print tolower($1)}'
+  fi
+}
+
+snapshot_destination() {
+  local entry name
+
+  while IFS= read -r entry; do
+    name="${entry:${#destination_dir}+1}"
+    if [[ -L "${entry}" ]]; then
+      printf 'symlink\t%s\t%s\n' "${name}" "$(readlink "${entry}")"
+    elif [[ -f "${entry}" ]]; then
+      printf 'file\t%s\t%s\n' "${name}" "$(sha256_file "${entry}")"
+    elif [[ -d "${entry}" ]]; then
+      printf 'directory\t%s\n' "${name}"
+    else
+      printf 'other\t%s\n' "${name}"
+    fi
+  done < <(find "${destination_dir}" -mindepth 1 -print | LC_ALL=C sort)
+}
+
+expect_check_failure() {
+  local expected_message="$1"
+  local before after output
+
+  before="$(snapshot_destination)"
+  if output="$("${script}" --check --source "${source_dir}" --destination "${destination_dir}" 2>&1)"; then
+    echo "expected synchronization check to fail: ${expected_message}" >&2
+    exit 1
+  fi
+  after="$(snapshot_destination)"
+  [[ "${before}" == "${after}" ]] || {
+    echo "synchronization check modified the destination" >&2
+    diff -u <(printf '%s\n' "${before}") <(printf '%s\n' "${after}") >&2 || true
+    exit 1
+  }
+  grep -F "${expected_message}" <<<"${output}" >/dev/null || {
+    echo "expected failure message not found: ${expected_message}" >&2
+    printf '%s\n' "${output}" >&2
+    exit 1
+  }
+}
+
+expect_script_failure() {
+  local expected_message="$1"
+  local output
+  shift
+
+  if output="$("${script}" "$@" 2>&1)"; then
+    echo "expected synchronization command to fail: ${expected_message}" >&2
+    exit 1
+  fi
+  grep -F "${expected_message}" <<<"${output}" >/dev/null || {
+    echo "expected failure message not found: ${expected_message}" >&2
+    printf '%s\n' "${output}" >&2
+    exit 1
+  }
+}
+
+printf '%s\n' 'drifted' >"${destination_dir}/core.orka.ai_firsts.yaml"
+expect_check_failure 'out-of-sync Helm CRD: core.orka.ai_firsts.yaml'
+cp "${source_dir}/core.orka.ai_firsts.yaml" "${destination_dir}/core.orka.ai_firsts.yaml"
+
+rm "${destination_dir}/core.orka.ai_seconds.yaml"
+expect_check_failure 'missing Helm CRD: core.orka.ai_seconds.yaml'
+cp "${source_dir}/core.orka.ai_seconds.yaml" "${destination_dir}/core.orka.ai_seconds.yaml"
+
+printf '%s\n' 'stale' >"${destination_dir}/core.orka.ai_stale.yaml"
+expect_check_failure 'stale Helm CRD: core.orka.ai_stale.yaml'
+rm "${destination_dir}/core.orka.ai_stale.yaml"
+
+printf '%s\n' 'stale nested yaml' >"${destination_dir}/legacy/stale.yml"
+expect_check_failure 'stale Helm CRD: legacy/stale.yml'
+rm "${destination_dir}/legacy/stale.yml"
+
+printf '%s\n' '{"kind":"Stale"}' >"${destination_dir}/legacy/nested/stale.json"
+expect_check_failure 'stale Helm CRD: legacy/nested/stale.json'
+rm "${destination_dir}/legacy/nested/stale.json"
+
+rm "${destination_dir}/core.orka.ai_firsts.yaml"
+ln -s "${source_dir}/core.orka.ai_firsts.yaml" "${destination_dir}/core.orka.ai_firsts.yaml"
+expect_check_failure 'symlinked Helm CRD: core.orka.ai_firsts.yaml'
+
+rm "${destination_dir}/core.orka.ai_firsts.yaml"
+ln -s README.md "${destination_dir}/core.orka.ai_firsts.yaml"
+readme_before="$(sha256_file "${destination_dir}/README.md")"
+"${script}" --source "${source_dir}" --destination "${destination_dir}" >/dev/null
+[[ ! -L "${destination_dir}/core.orka.ai_firsts.yaml" ]]
+cmp -s "${source_dir}/core.orka.ai_firsts.yaml" "${destination_dir}/core.orka.ai_firsts.yaml"
+[[ "${readme_before}" == "$(sha256_file "${destination_dir}/README.md")" ]]
+
+outside_dir="${test_root}/outside"
+mkdir -p "${outside_dir}"
+printf '%s\n' 'outside sentinel' >"${outside_dir}/core.orka.ai_firsts.yaml"
+rm "${destination_dir}/core.orka.ai_firsts.yaml"
+ln -s "${outside_dir}" "${destination_dir}/core.orka.ai_firsts.yaml"
+"${script}" --source "${source_dir}" --destination "${destination_dir}" >/dev/null
+[[ ! -L "${destination_dir}/core.orka.ai_firsts.yaml" ]]
+cmp -s "${source_dir}/core.orka.ai_firsts.yaml" "${destination_dir}/core.orka.ai_firsts.yaml"
+grep -Fx 'outside sentinel' "${outside_dir}/core.orka.ai_firsts.yaml" >/dev/null
+
+printf '%s\n' 'leave this drift in place' >"${destination_dir}/core.orka.ai_firsts.yaml"
+rm "${destination_dir}/core.orka.ai_seconds.yaml"
+mkdir "${destination_dir}/core.orka.ai_seconds.yaml"
+before="$(snapshot_destination)"
+expect_script_failure \
+  'Helm CRD destination is not a regular file or symlink:' \
+  --source "${source_dir}" --destination "${destination_dir}"
+after="$(snapshot_destination)"
+[[ "${before}" == "${after}" ]] || {
+  echo 'failed synchronization partially modified the destination' >&2
+  diff -u <(printf '%s\n' "${before}") <(printf '%s\n' "${after}") >&2 || true
+  exit 1
+}
+rmdir "${destination_dir}/core.orka.ai_seconds.yaml"
+cp "${source_dir}/core.orka.ai_firsts.yaml" "${destination_dir}/core.orka.ai_firsts.yaml"
+cp "${source_dir}/core.orka.ai_seconds.yaml" "${destination_dir}/core.orka.ai_seconds.yaml"
+
+source_first_before="$(sha256_file "${source_dir}/core.orka.ai_firsts.yaml")"
+source_second_before="$(sha256_file "${source_dir}/core.orka.ai_seconds.yaml")"
+for operation in check sync; do
+  args=(--source "${source_dir}" --destination "${source_dir}")
+  if [[ "${operation}" == "check" ]]; then
+    args=(--check "${args[@]}")
+  fi
+  expect_script_failure 'generated and Helm CRD directories must differ:' "${args[@]}"
+done
+[[ "${source_first_before}" == "$(sha256_file "${source_dir}/core.orka.ai_firsts.yaml")" ]]
+[[ "${source_second_before}" == "$(sha256_file "${source_dir}/core.orka.ai_seconds.yaml")" ]]
+
+find_failure_bin="${test_root}/find-failure-bin"
+mkdir -p "${find_failure_bin}"
+cat >"${find_failure_bin}/find" <<'EOF'
+#!/usr/bin/env bash
+exit 23
+EOF
+chmod +x "${find_failure_bin}/find"
+for operation in check sync; do
+  args=(--source "${source_dir}" --destination "${destination_dir}")
+  if [[ "${operation}" == "check" ]]; then
+    args=(--check "${args[@]}")
+  fi
+  before="$(snapshot_destination)"
+  if output="$(PATH="${find_failure_bin}:${PATH}" "${script}" "${args[@]}" 2>&1)"; then
+    echo "expected symlink scan failure during ${operation}" >&2
+    exit 1
+  fi
+  grep -F 'cannot scan Helm CRD destination for symlinks:' <<<"${output}" >/dev/null
+  after="$(snapshot_destination)"
+  [[ "${before}" == "${after}" ]]
+done
+
+find_second_failure_bin="${test_root}/find-second-failure-bin"
+find_counter="${test_root}/find-counter"
+mkdir -p "${find_second_failure_bin}"
+cat >"${find_second_failure_bin}/find" <<EOF
+#!/usr/bin/env bash
+count=0
+if [[ -f "${find_counter}" ]]; then
+  count="\$(cat "${find_counter}")"
+fi
+count=\$((count + 1))
+printf '%s\n' "\${count}" >"${find_counter}"
+if [[ "\${count}" -eq 1 ]]; then
+  exit 0
+fi
+exit 23
+EOF
+chmod +x "${find_second_failure_bin}/find"
+for operation in check sync; do
+  printf '%s\n' 0 >"${find_counter}"
+  args=(--source "${source_dir}" --destination "${destination_dir}")
+  if [[ "${operation}" == "check" ]]; then
+    args=(--check "${args[@]}")
+  fi
+  before="$(snapshot_destination)"
+  if output="$(PATH="${find_second_failure_bin}:${PATH}" "${script}" "${args[@]}" 2>&1)"; then
+    echo "expected manifest scan failure during ${operation}" >&2
+    exit 1
+  fi
+  grep -F 'cannot scan Helm CRD destination for manifests:' <<<"${output}" >/dev/null
+  after="$(snapshot_destination)"
+  [[ "${before}" == "${after}" ]]
+done
+
+source_inside_destination="${test_root}/overlap-destination/source"
+mkdir -p "${source_inside_destination}"
+printf '%s\n' 'kind: SourceInsideDestination' >"${source_inside_destination}/source.yaml"
+source_inside_hash="$(sha256_file "${source_inside_destination}/source.yaml")"
+for operation in check sync; do
+  args=(--source "${source_inside_destination}" --destination "${test_root}/overlap-destination")
+  if [[ "${operation}" == "check" ]]; then
+    args=(--check "${args[@]}")
+  fi
+  expect_script_failure 'generated and Helm CRD directories must not overlap:' "${args[@]}"
+done
+[[ "${source_inside_hash}" == "$(sha256_file "${source_inside_destination}/source.yaml")" ]]
+
+source_parent="${test_root}/overlap-source"
+destination_inside_source="${source_parent}/destination"
+mkdir -p "${destination_inside_source}"
+printf '%s\n' 'kind: DestinationInsideSource' >"${source_parent}/source.yaml"
+printf '%s\n' 'destination sentinel' >"${destination_inside_source}/README.md"
+source_parent_hash="$(sha256_file "${source_parent}/source.yaml")"
+for operation in check sync; do
+  args=(--source "${source_parent}" --destination "${destination_inside_source}")
+  if [[ "${operation}" == "check" ]]; then
+    args=(--check "${args[@]}")
+  fi
+  expect_script_failure 'generated and Helm CRD directories must not overlap:' "${args[@]}"
+done
+[[ "${source_parent_hash}" == "$(sha256_file "${source_parent}/source.yaml")" ]]
+grep -Fx 'destination sentinel' "${destination_inside_source}/README.md" >/dev/null
+
+for candidate in / /.; do
+  for operation in check sync; do
+    args=(--source "${source_dir}" --destination "${candidate}")
+    if [[ "${operation}" == "check" ]]; then
+      args=(--check "${args[@]}")
+    fi
+    expect_script_failure 'refusing to manage filesystem root as Helm CRD directory:' "${args[@]}"
+  done
+done
+
+nested_symlink_target="${test_root}/nested-symlink-target"
+mkdir -p "${nested_symlink_target}"
+printf '%s\n' 'kind: Escaped' >"${nested_symlink_target}/escaped.yaml"
+ln -s "${nested_symlink_target}" "${destination_dir}/linked-manifests"
+for operation in check sync; do
+  args=(--source "${source_dir}" --destination "${destination_dir}")
+  if [[ "${operation}" == "check" ]]; then
+    args=(--check "${args[@]}")
+  fi
+  expect_script_failure 'Helm CRD directory must not contain unmanaged symlink:' "${args[@]}"
+done
+rm "${destination_dir}/linked-manifests"
+grep -Fx 'kind: Escaped' "${nested_symlink_target}/escaped.yaml" >/dev/null
+
+linked_destination="${test_root}/linked-crds"
+ln -s "${destination_dir}" "${linked_destination}"
+for candidate in "${linked_destination}" "${linked_destination}/" "${linked_destination}/."; do
+  for operation in check sync; do
+    if [[ "${operation}" == "check" ]]; then
+      if output="$("${script}" --check --source "${source_dir}" --destination "${candidate}" 2>&1)"; then
+        echo "expected symlinked destination check to fail: ${candidate}" >&2
+        exit 1
+      fi
+    elif output="$("${script}" --source "${source_dir}" --destination "${candidate}" 2>&1)"; then
+      echo "expected symlinked destination sync to fail: ${candidate}" >&2
+      exit 1
+    fi
+    grep -F 'Helm CRD directory must not be a symlink:' <<<"${output}" >/dev/null
+  done
+done
+
+printf '%s\n' 'ok - Helm CRD sync copies generated YAML, fails before partial updates, safely replaces manifest symlinks, removes stale nested YAML/YML/JSON, preserves non-manifest files, propagates scan failures, rejects symlink escapes, overlapping trees, and unsafe destinations, and detects drift read-only'
diff --git a/scripts/tests/upgrade-orka-crds-test.sh b/scripts/tests/upgrade-orka-crds-test.sh
new file mode 100755
index 000000000..fe089e5fe
--- /dev/null
+++ b/scripts/tests/upgrade-orka-crds-test.sh
@@ -0,0 +1,705 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+script="${root}/scripts/upgrade-orka-crds.sh"
+test_root="$(mktemp -d "${TMPDIR:-/tmp}/upgrade-orka-crds-test.XXXXXX")"
+
+cleanup() {
+  if [[ "${KEEP_TEST_TMP:-0}" == "1" ]]; then
+    echo "kept test fixtures at ${test_root}" >&2
+  else
+    rm -rf "${test_root}"
+  fi
+}
+trap cleanup EXIT
+
+pass_count=0
+fail_count=0
+
+sha256_file() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$1" | awk '{print tolower($1)}'
+  else
+    shasum -a 256 "$1" | awk '{print tolower($1)}'
+  fi
+}
+
+
+sha256_stdin() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum | awk '{print tolower($1)}'
+  else
+    shasum -a 256 | awk '{print tolower($1)}'
+  fi
+}
+
+fake_kubeconfig_json='{"clusters":[{"name":"test-cluster","cluster":{"server":"https://test.example.invalid","certificate-authority-data":"VEVTVA=="}}]}'
+fake_cluster_uid='test-cluster-uid'
+fake_api_server_identity_sha256="$(
+  printf '%s\n' "${fake_kubeconfig_json}"     | jq -c '
+        .clusters
+        | .[0].cluster
+        | {
+            server: (.server // null),
+            certificateAuthorityData: (.["certificate-authority-data"] // null),
+            insecureSkipTLSVerify: (.["insecure-skip-tls-verify"] // null),
+            tlsServerName: (.["tls-server-name"] // null),
+            proxyURL: (.["proxy-url"] // null),
+            disableCompression: (.["disable-compression"] // null)
+          }
+      '     | sha256_stdin
+)"
+
+write_marker() {
+  local backup="$1"
+  local marker="$2"
+  local kind="$3"
+  cat >"${marker}" <<MARKER
+format=orka-backup-verification-v1
+kind=${kind}
+context=test-context
+cluster_uid=${fake_cluster_uid}
+api_server_identity_sha256=${fake_api_server_identity_sha256}
+sha256=$(sha256_file "${backup}")
+verified=true
+verified_at=2026-07-25T08:00:00Z
+MARKER
+}
+
+replace_marker_field() {
+  local marker="$1"
+  local key="$2"
+  local value="$3"
+  awk -F= -v key="${key}" -v value="${value}" '
+    $1 == key { print key "=" value; next }
+    { print }
+  ' "${marker}" >"${marker}.next"
+  mv "${marker}.next" "${marker}"
+}
+
+write_list() {
+  local path="$1"
+  local items="$2"
+  cat >"${path}" <<JSON
+{"apiVersion":"v1","kind":"List","items":${items}}
+JSON
+}
+
+historical_items() {
+  cat <<'JSON'
+[
+  {
+    "apiVersion":"core.orka.ai/v1alpha1",
+    "kind":"AgentRuntime",
+    "metadata":{"namespace":"gateway-ns","name":"legacy-runtime"},
+    "spec":{"contractVersion":"orka.harness.v1"}
+  },
+  {
+    "apiVersion":"core.orka.ai/v1alpha1",
+    "kind":"Agent",
+    "metadata":{"namespace":"gateway-ns","name":"legacy-agent"},
+    "spec":{"runtime":{"runtimeRef":{"name":"legacy-runtime"}}}
+  },
+  {
+    "apiVersion":"gateway.orka.ai/v1alpha1",
+    "kind":"GatewayBinding",
+    "metadata":{"namespace":"gateway-ns","name":"legacy-binding"},
+    "spec":{"agentRef":{"name":"legacy-agent"},"gatewayRef":{"name":"legacy-gateway"}}
+  }
+]
+JSON
+}
+
+create_fake_kubectl() {
+  local case_dir="$1"
+  mkdir -p "${case_dir}/bin"
+  cat >"${case_dir}/bin/kubectl" <<'FAKE'
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+printf '%s\n' "$*" >>"${FAKE_KUBECTL_LOG}"
+
+if [[ "${1:-}" == "--context" ]]; then
+  shift 2
+fi
+
+command="${1:-}"
+shift || true
+
+case "${command}" in
+  get)
+    if [[ "${1:-}" == "--raw=/version" ]]; then
+      printf '%s\n' '{"gitVersion":"v1.34.0"}'
+      exit 0
+    fi
+    if [[ "${1:-}" == "namespace" && "${2:-}" == "kube-system" ]]; then
+      printf '%s\n' '{"apiVersion":"v1","kind":"Namespace","metadata":{"name":"kube-system","uid":"test-cluster-uid"}}'
+      exit 0
+    fi
+
+    resource="${1:-}"
+    shift || true
+    if [[ " $* " == *" -A "* && " $* " == *" custom-columns="* ]]; then
+      awk -F '\t' -v resource="${resource}" '$1 == resource { print $2, $3, $4 }' "${FAKE_WRAPPER_STATE}"
+      exit 0
+    fi
+
+    case "${resource}" in
+      agentruntimes.core.orka.ai) cat "${FAKE_RUNTIME_JSON}" ;;
+      agents.core.orka.ai) cat "${FAKE_AGENT_JSON}" ;;
+      tasks.core.orka.ai) cat "${FAKE_TASK_JSON}" ;;
+      gatewaybindings.gateway.orka.ai) cat "${FAKE_BINDING_JSON}" ;;
+      deployment.apps|statefulset.apps) cat "${FAKE_WORKLOAD_JSON}" ;;
+      *)
+        echo "unexpected fake kubectl get: ${resource} $*" >&2
+        exit 1
+        ;;
+    esac
+    ;;
+  config)
+    if [[ "${1:-}" == "view" ]]; then
+      printf '%s\n' '{"clusters":[{"name":"test-cluster","cluster":{"server":"https://test.example.invalid","certificate-authority-data":"VEVTVA=="}}]}'
+    else
+      echo "unexpected fake kubectl config request: $*" >&2
+      exit 1
+    fi
+    ;;
+  api-resources)
+    if [[ " $* " == *" --api-group=core.orka.ai "* ]]; then
+      printf '%s\n' 'agentruntimes.core.orka.ai' 'agents.core.orka.ai' 'tasks.core.orka.ai'
+    elif [[ " $* " == *" --api-group=gateway.orka.ai "* ]]; then
+      printf '%s\n' 'gatewaybindings.gateway.orka.ai'
+    else
+      echo "unexpected api-resources request: $*" >&2
+      exit 1
+    fi
+    ;;
+  delete)
+    resource="${1:-}"
+    shift || true
+    namespace=""
+    name=""
+    while [[ $# -gt 0 ]]; do
+      case "$1" in
+        -n)
+          namespace="$2"
+          shift 2
+          ;;
+        --wait=true)
+          shift
+          ;;
+        *)
+          name="$1"
+          shift
+          ;;
+      esac
+    done
+    printf '%s\t%s\t%s\n' "${resource}" "${namespace}" "${name}" >>"${FAKE_DELETE_LOG}"
+    # "namespace" is a reserved gawk builtin and cannot be an awk variable name.
+    awk -F '\t' -v resource="${resource}" -v ns="${namespace}" -v name="${name}" \
+      '!( $1 == resource && $2 == ns && $3 == name )' "${FAKE_WRAPPER_STATE}" >"${FAKE_WRAPPER_STATE}.next"
+    mv "${FAKE_WRAPPER_STATE}.next" "${FAKE_WRAPPER_STATE}"
+    ;;
+  apply)
+    dry_run=false
+    for argument in "$@"; do
+      if [[ "${argument}" == "--dry-run=server" ]]; then
+        dry_run=true
+      fi
+    done
+    if [[ "${dry_run}" == "true" ]]; then
+      printf '%s\n' dry-run >>"${FAKE_APPLY_LOG}"
+      if [[ -n "${FAKE_POST_DRY_RUN_RUNTIME_JSON:-}" && -f "${FAKE_POST_DRY_RUN_RUNTIME_JSON}" ]]; then
+        cp "${FAKE_POST_DRY_RUN_RUNTIME_JSON}" "${FAKE_RUNTIME_JSON}"
+      fi
+      if [[ -n "${FAKE_POST_DRY_RUN_AGENT_JSON:-}" && -f "${FAKE_POST_DRY_RUN_AGENT_JSON}" ]]; then
+        cp "${FAKE_POST_DRY_RUN_AGENT_JSON}" "${FAKE_AGENT_JSON}"
+      fi
+      if [[ -n "${FAKE_POST_DRY_RUN_TASK_JSON:-}" && -f "${FAKE_POST_DRY_RUN_TASK_JSON}" ]]; then
+        cp "${FAKE_POST_DRY_RUN_TASK_JSON}" "${FAKE_TASK_JSON}"
+      fi
+      printf '%s\n' 'dry-run-ok'
+    else
+      printf '%s\n' live >>"${FAKE_APPLY_LOG}"
+      printf '%s\n' 'applied'
+    fi
+    ;;
+  *)
+    echo "unexpected fake kubectl command: ${command} $*" >&2
+    exit 1
+    ;;
+esac
+FAKE
+  chmod +x "${case_dir}/bin/kubectl"
+}
+
+new_case() {
+  local name="$1"
+  local case_dir="${test_root}/${name}"
+  mkdir -p "${case_dir}"
+  create_fake_kubectl "${case_dir}"
+
+  printf '%s\n' 'sqlite backup fixture' >"${case_dir}/sqlite.backup"
+  write_list "${case_dir}/cr-backup.json" '[]'
+  write_marker "${case_dir}/sqlite.backup" "${case_dir}/sqlite.backup.verified" sqlite-pvc
+  write_marker "${case_dir}/cr-backup.json" "${case_dir}/cr-backup.json.verified" orka-crs
+  write_list "${case_dir}/runtimes.json" '[]'
+  write_list "${case_dir}/agents.json" '[]'
+  write_list "${case_dir}/tasks.json" '[]'
+  write_list "${case_dir}/bindings.json" '[]'
+  cat >"${case_dir}/workload.json" <<'JSON'
+{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"namespace":"gateway-ns","name":"gateway-adapter","generation":2},"spec":{"replicas":0},"status":{"observedGeneration":2,"replicas":0,"readyReplicas":0,"availableReplicas":0,"updatedReplicas":0,"terminatingReplicas":0}}
+JSON
+  : >"${case_dir}/wrappers.tsv"
+  : >"${case_dir}/kubectl.log"
+  : >"${case_dir}/apply.log"
+  : >"${case_dir}/delete.log"
+  printf '%s\n' "${case_dir}"
+}
+
+prepare_historical_case() {
+  local case_dir="$1"
+  write_list "${case_dir}/cr-backup.json" "$(historical_items)"
+  write_marker "${case_dir}/cr-backup.json" "${case_dir}/cr-backup.json.verified" orka-crs
+}
+
+run_upgrade_with_backups() {
+  local case_dir="$1"
+  local sqlite_path="$2"
+  local sqlite_marker_path="$3"
+  local cr_path="$4"
+  local cr_marker_path="$5"
+  shift 5
+
+  PATH="${case_dir}/bin:${PATH}" \
+  FAKE_KUBECTL_LOG="${case_dir}/kubectl.log" \
+  FAKE_APPLY_LOG="${case_dir}/apply.log" \
+  FAKE_DELETE_LOG="${case_dir}/delete.log" \
+  FAKE_RUNTIME_JSON="${case_dir}/runtimes.json" \
+  FAKE_AGENT_JSON="${case_dir}/agents.json" \
+  FAKE_TASK_JSON="${case_dir}/tasks.json" \
+  FAKE_BINDING_JSON="${case_dir}/bindings.json" \
+  FAKE_WORKLOAD_JSON="${case_dir}/workload.json" \
+  FAKE_WRAPPER_STATE="${case_dir}/wrappers.tsv" \
+  FAKE_POST_DRY_RUN_RUNTIME_JSON="${case_dir}/post-dry-run-runtimes.json" \
+  FAKE_POST_DRY_RUN_AGENT_JSON="${case_dir}/post-dry-run-agents.json" \
+  FAKE_POST_DRY_RUN_TASK_JSON="${case_dir}/post-dry-run-tasks.json" \
+    /bin/bash "${script}" \
+      --context test-context \
+      --sqlite-backup "${sqlite_path}" \
+      --sqlite-backup-marker "${sqlite_marker_path}" \
+      --cr-backup "${cr_path}" \
+      --cr-backup-marker "${cr_marker_path}" \
+      "$@"
+}
+
+run_upgrade() {
+  local case_dir="$1"
+  shift
+  run_upgrade_with_backups \
+    "${case_dir}" \
+    "${case_dir}/sqlite.backup" \
+    "${case_dir}/sqlite.backup.verified" \
+    "${case_dir}/cr-backup.json" \
+    "${case_dir}/cr-backup.json.verified" \
+    "$@"
+}
+
+assert_no_live_apply() {
+  local case_dir="$1"
+  ! grep -Fqx live "${case_dir}/apply.log"
+}
+
+assert_one_dry_run_no_live_apply() {
+  local case_dir="$1"
+  [[ "$(grep -Fxc dry-run "${case_dir}/apply.log" || true)" == "1" ]]
+  assert_no_live_apply "${case_dir}"
+}
+
+assert_one_dry_run_and_one_live_apply() {
+  local case_dir="$1"
+  [[ "$(grep -Fxc dry-run "${case_dir}/apply.log" || true)" == "1" ]]
+  [[ "$(grep -Fxc live "${case_dir}/apply.log" || true)" == "1" ]]
+  [[ "$(wc -l <"${case_dir}/apply.log" | tr -d ' ')" == "2" ]]
+}
+
+assert_no_kubectl_calls() {
+  local case_dir="$1"
+  [[ ! -s "${case_dir}/kubectl.log" ]]
+}
+
+expect_failure() {
+  local case_dir="$1"
+  local expected="$2"
+  shift 2
+  local output="${case_dir}/output"
+  if "$@" >"${output}" 2>&1; then
+    echo "command unexpectedly succeeded for ${case_dir}" >&2
+    return 1
+  fi
+  grep -F "${expected}" "${output}" >/dev/null
+}
+
+expect_preapply_failure() {
+  local case_dir="$1"
+  local expected="$2"
+  shift 2
+  expect_failure "${case_dir}" "${expected}" "$@"
+  [[ ! -s "${case_dir}/apply.log" ]]
+}
+
+expect_workload_blocked() {
+  local name="$1"
+  local workload_json="$2"
+  local mapping_kind="$3"
+  local case_dir
+  case_dir="$(new_case "${name}")"
+  prepare_historical_case "${case_dir}"
+  printf '%s\n' "${workload_json}" >"${case_dir}/workload.json"
+  expect_failure "${case_dir}" 'is not fully scaled to zero' \
+    run_upgrade "${case_dir}" \
+    --gateway-workload "gateway-ns/legacy-gateway=${mapping_kind}/gateway-ns/gateway-adapter"
+  assert_no_live_apply "${case_dir}"
+}
+
+run_test() {
+  local name="$1"
+  shift
+  local result
+
+  set +e
+  (
+    set -Eeuo pipefail
+    "$@"
+  )
+  result=$?
+  set -e
+
+  if [[ "${result}" == "0" ]]; then
+    echo "ok - ${name}"
+    pass_count=$((pass_count + 1))
+  else
+    echo "not ok - ${name}" >&2
+    fail_count=$((fail_count + 1))
+  fi
+}
+
+test_controller_epoch_crd_uses_canonical_plural() {
+  local generated chart
+  generated="${root}/config/crd/bases/core.orka.ai_controllerepochs.yaml"
+  chart="${root}/manifest_staging/charts/orka/crds/controllerepoch-customresourcedefinition.yaml"
+
+  [[ -f "${generated}" ]]
+  [[ -f "${chart}" ]]
+  [[ ! -e "${root}/config/crd/bases/core.orka.ai_controllerepoches.yaml" ]]
+  [[ ! -e "${root}/manifest_staging/charts/orka/crds/core.orka.ai_controllerepoches.yaml" ]]
+
+  grep -F '  name: controllerepochs.core.orka.ai' "${generated}" >/dev/null
+  grep -F '    plural: controllerepochs' "${generated}" >/dev/null
+  grep -F '  name: controllerepochs.core.orka.ai' "${chart}" >/dev/null
+  grep -F '    plural: controllerepochs' "${chart}" >/dev/null
+  grep -Fx -- '- bases/core.orka.ai_controllerepochs.yaml' "${root}/config/crd/kustomization.yaml" >/dev/null
+}
+
+test_requires_backup_arguments() {
+  local case_dir output
+  case_dir="$(new_case requires-backups)"
+  output="${case_dir}/output"
+  if PATH="${case_dir}/bin:${PATH}" /bin/bash "${script}" --context test-context >"${output}" 2>&1; then
+    return 1
+  fi
+  grep -F -- '--sqlite-backup is required' "${output}" >/dev/null
+  assert_no_kubectl_calls "${case_dir}"
+}
+
+test_backup_attestation_rejections() {
+  local case_dir
+
+  case_dir="$(new_case cr-digest-mismatch)"
+  printf '%s\n' tampered >>"${case_dir}/cr-backup.json"
+  expect_preapply_failure "${case_dir}" 'CR backup digest does not match its verification marker' run_upgrade "${case_dir}"
+
+  case_dir="$(new_case wrong-marker-context)"
+  replace_marker_field "${case_dir}/sqlite.backup.verified" context wrong-context
+  expect_preapply_failure "${case_dir}" 'SQLite/PVC backup marker context does not match --context' run_upgrade "${case_dir}"
+
+  case_dir="$(new_case wrong-cluster-uid)"
+  replace_marker_field "${case_dir}/sqlite.backup.verified" cluster_uid wrong-cluster-uid
+  expect_preapply_failure "${case_dir}" 'SQLite/PVC backup marker cluster_uid does not match the target cluster' run_upgrade "${case_dir}"
+
+  case_dir="$(new_case wrong-api-server-identity)"
+  replace_marker_field "${case_dir}/sqlite.backup.verified" api_server_identity_sha256 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+  expect_preapply_failure "${case_dir}" 'SQLite/PVC backup marker api_server_identity_sha256 does not match the target cluster' run_upgrade "${case_dir}"
+
+  case_dir="$(new_case wrong-marker-kind)"
+  replace_marker_field "${case_dir}/cr-backup.json.verified" kind sqlite-pvc
+  expect_preapply_failure "${case_dir}" 'CR backup marker kind must be orka-crs' run_upgrade "${case_dir}"
+
+  case_dir="$(new_case unverified-marker)"
+  replace_marker_field "${case_dir}/sqlite.backup.verified" verified false
+  expect_preapply_failure "${case_dir}" 'SQLite/PVC backup marker must attest verified=true' run_upgrade "${case_dir}"
+
+  case_dir="$(new_case duplicate-marker-field)"
+  printf '%s\n' 'sha256=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' >>"${case_dir}/sqlite.backup.verified"
+  expect_preapply_failure "${case_dir}" 'must contain exactly one sha256= field' run_upgrade "${case_dir}"
+
+  case_dir="$(new_case relative-backup-path)"
+  expect_preapply_failure "${case_dir}" 'SQLite/PVC backup path must be absolute' \
+    run_upgrade_with_backups "${case_dir}" relative.backup "${case_dir}/sqlite.backup.verified" "${case_dir}/cr-backup.json" "${case_dir}/cr-backup.json.verified"
+
+  case_dir="$(new_case symlink-backup-path)"
+  ln -s "${case_dir}/sqlite.backup" "${case_dir}/sqlite-link.backup"
+  expect_preapply_failure "${case_dir}" 'SQLite/PVC backup path must not be a symbolic link' \
+    run_upgrade_with_backups "${case_dir}" "${case_dir}/sqlite-link.backup" "${case_dir}/sqlite.backup.verified" "${case_dir}/cr-backup.json" "${case_dir}/cr-backup.json.verified"
+
+  case_dir="$(new_case empty-backup-file)"
+  : >"${case_dir}/sqlite.backup"
+  expect_preapply_failure "${case_dir}" 'SQLite/PVC backup file is empty' run_upgrade "${case_dir}"
+
+  case_dir="$(new_case malformed-cr-backup)"
+  printf '%s\n' '{}' >"${case_dir}/cr-backup.json"
+  write_marker "${case_dir}/cr-backup.json" "${case_dir}/cr-backup.json.verified" orka-crs
+  expect_preapply_failure "${case_dir}" 'CR backup must be a Kubernetes JSON List' run_upgrade "${case_dir}"
+}
+
+test_affected_gateway_requires_mapping() {
+  local case_dir
+  case_dir="$(new_case gateway-mapping-required)"
+  prepare_historical_case "${case_dir}"
+  expect_failure "${case_dir}" 'affected Gateway gateway-ns/legacy-gateway has no --gateway-workload mapping' run_upgrade "${case_dir}"
+  assert_no_live_apply "${case_dir}"
+}
+
+test_live_reference_chain_blocks() {
+  local case_dir
+  case_dir="$(new_case live-reference-chain)"
+  prepare_historical_case "${case_dir}"
+  write_list "${case_dir}/runtimes.json" '[{"kind":"AgentRuntime","metadata":{"namespace":"gateway-ns","name":"legacy-runtime"},"spec":{"contractVersion":"orka.harness.v1"}}]'
+  write_list "${case_dir}/agents.json" '[{"kind":"Agent","metadata":{"namespace":"gateway-ns","name":"legacy-agent"},"spec":{"runtime":{"runtimeRef":{"name":"legacy-runtime"}}}}]'
+  write_list "${case_dir}/bindings.json" '[{"kind":"GatewayBinding","metadata":{"namespace":"gateway-ns","name":"legacy-binding"},"spec":{"agentRef":{"name":"legacy-agent"},"gatewayRef":{"name":"legacy-gateway"}}}]'
+
+  expect_failure "${case_dir}" 'AgentRuntime gateway-ns/legacy-runtime still declares orka.harness.v1' \
+    run_upgrade "${case_dir}" --gateway-workload gateway-ns/legacy-gateway=deployment/gateway-ns/gateway-adapter
+  grep -F 'Agent gateway-ns/legacy-agent still references affected AgentRuntime legacy-runtime' "${case_dir}/output" >/dev/null
+  grep -F 'GatewayBinding gateway-ns/legacy-binding still references affected Agent legacy-agent' "${case_dir}/output" >/dev/null
+  assert_no_live_apply "${case_dir}"
+}
+
+test_backed_up_reference_blocks_after_runtime_deleted() {
+  local case_dir
+  case_dir="$(new_case backed-up-reference)"
+  prepare_historical_case "${case_dir}"
+  write_list "${case_dir}/agents.json" '[{"kind":"Agent","metadata":{"namespace":"gateway-ns","name":"legacy-agent"},"spec":{"runtime":{"runtimeRef":{"name":"legacy-runtime"}}}}]'
+  write_list "${case_dir}/bindings.json" '[{"kind":"GatewayBinding","metadata":{"namespace":"gateway-ns","name":"legacy-binding"},"spec":{"agentRef":{"name":"legacy-agent"},"gatewayRef":{"name":"legacy-gateway"}}}]'
+
+  expect_failure "${case_dir}" 'Agent gateway-ns/legacy-agent still references affected AgentRuntime legacy-runtime' \
+    run_upgrade "${case_dir}" --gateway-workload gateway-ns/legacy-gateway=deployment/gateway-ns/gateway-adapter
+  grep -F 'GatewayBinding gateway-ns/legacy-binding still references affected Agent legacy-agent' "${case_dir}/output" >/dev/null
+  assert_no_live_apply "${case_dir}"
+}
+
+test_gateway_scale_to_zero_invariants() {
+  expect_workload_blocked spec-nonzero \
+    '{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"namespace":"gateway-ns","name":"gateway-adapter","generation":3},"spec":{"replicas":1},"status":{"observedGeneration":3,"replicas":0}}' \
+    deployment
+  expect_workload_blocked status-nonzero \
+    '{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"namespace":"gateway-ns","name":"gateway-adapter","generation":3},"spec":{"replicas":0},"status":{"observedGeneration":3,"replicas":1}}' \
+    deployment
+  expect_workload_blocked stale-generation \
+    '{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"namespace":"gateway-ns","name":"gateway-adapter","generation":4},"spec":{"replicas":0},"status":{"observedGeneration":3,"replicas":0}}' \
+    deployment
+  expect_workload_blocked terminating-replica \
+    '{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"namespace":"gateway-ns","name":"gateway-adapter","generation":3},"spec":{"replicas":0},"status":{"observedGeneration":3,"replicas":0,"terminatingReplicas":1}}' \
+    deployment
+  expect_workload_blocked statefulset-current-replica \
+    '{"apiVersion":"apps/v1","kind":"StatefulSet","metadata":{"namespace":"gateway-ns","name":"gateway-adapter","generation":3},"spec":{"replicas":0},"status":{"observedGeneration":3,"replicas":0,"currentReplicas":1}}' \
+    statefulset
+}
+
+test_wrapper_requires_explicit_cleanup() {
+  local case_dir
+  case_dir="$(new_case wrapper-blocked)"
+  printf '%s\t%s\t%s\t%s\n' \
+    deployment.apps orka-system orka-agent-harness-wrapper agent-harness-wrapper \
+    service orka-system orka-agent-harness-wrapper agent-harness-wrapper \
+    secret orka-system harness-wrapper-auth '<none>' >"${case_dir}/wrappers.tsv"
+
+  expect_failure "${case_dir}" 'legacy harness-wrapper Deployment orka-system/orka-agent-harness-wrapper still exists' run_upgrade "${case_dir}"
+  grep -F 'cleanup: kubectl --context test-context' "${case_dir}/output" >/dev/null
+  [[ ! -s "${case_dir}/delete.log" ]]
+  assert_no_live_apply "${case_dir}"
+}
+
+test_explicit_wrapper_cleanup_targets_only_legacy_resources() {
+  local case_dir expected actual
+  case_dir="$(new_case wrapper-cleanup)"
+  printf '%s\t%s\t%s\t%s\n' \
+    deployment.apps orka-system orka-agent-harness-wrapper agent-harness-wrapper \
+    service orka-system orka-agent-harness-wrapper agent-harness-wrapper \
+    secret orka-system harness-wrapper-auth '<none>' \
+    deployment.apps orka-system harness-wrapper-metrics '<none>' >"${case_dir}/wrappers.tsv"
+
+  run_upgrade "${case_dir}" --delete-legacy-wrapper >"${case_dir}/output" 2>&1
+
+  expected="${case_dir}/expected-deletes.tsv"
+  actual="${case_dir}/actual-deletes.tsv"
+  printf '%s\t%s\t%s\n' \
+    deployment.apps orka-system orka-agent-harness-wrapper \
+    service orka-system orka-agent-harness-wrapper \
+    secret orka-system harness-wrapper-auth | LC_ALL=C sort >"${expected}"
+  LC_ALL=C sort "${case_dir}/delete.log" >"${actual}"
+  cmp -s "${expected}" "${actual}"
+  grep -F $'deployment.apps\torka-system\tharness-wrapper-metrics\t<none>' "${case_dir}/wrappers.tsv" >/dev/null
+  assert_one_dry_run_and_one_live_apply "${case_dir}"
+}
+
+
+test_legacy_builtin_opencode_agent_blocks_cutover() {
+  local case_dir
+  case_dir="$(new_case legacy-builtin-opencode-agent)"
+  write_list "${case_dir}/agents.json" '[
+    {"kind":"Agent","metadata":{"namespace":"work","name":"legacy-opencode"},"spec":{"runtime":{"type":"opencode"}}},
+    {"kind":"Agent","metadata":{"namespace":"work","name":"current-codex"},"spec":{"runtime":{"type":"codex"}}},
+    {"kind":"Agent","metadata":{"namespace":"work","name":"custom-runtime"},"spec":{"runtime":{"runtimeRef":{"name":"custom"}}}}
+  ]'
+
+  expect_failure "${case_dir}" 'Agent work/legacy-opencode must be removed before the OpenCode CRD cutover' run_upgrade "${case_dir}"
+  grep -F 'export and delete the Agent before cutover, then recreate it after the new CRD is applied' "${case_dir}/output" >/dev/null
+  grep -F 'migrate it to claude/codex/copilot or runtimeRef before retrying' "${case_dir}/output" >/dev/null
+  ! grep -F 'Agent work/current-codex' "${case_dir}/output" >/dev/null
+  ! grep -F 'Agent work/custom-runtime' "${case_dir}/output" >/dev/null
+  assert_no_live_apply "${case_dir}"
+  [[ ! -s "${case_dir}/apply.log" ]]
+}
+
+test_post_upgrade_shaped_opencode_agent_still_blocks_cutover() {
+  local case_dir
+  case_dir="$(new_case post-upgrade-shaped-opencode-agent)"
+  write_list "${case_dir}/agents.json" '[
+    {
+      "kind":"Agent",
+      "metadata":{"namespace":"work","name":"post-upgrade-shaped-opencode"},
+      "spec":{
+        "model":{"name":"openai/gpt-5.4","contextWindow":32768,"maxTokens":4096},
+        "runtime":{"type":"opencode","defaultAllowedTools":["Read","Write","Edit","Bash","Glob","Grep"],"defaultAllowBash":true}
+      }
+    }
+  ]'
+
+  expect_failure "${case_dir}" 'Agent work/post-upgrade-shaped-opencode must be removed before the OpenCode CRD cutover' run_upgrade "${case_dir}"
+  grep -F 'export and delete the Agent before cutover, then recreate it after the new CRD is applied' "${case_dir}/output" >/dev/null
+  assert_no_live_apply "${case_dir}"
+}
+
+test_opencode_agent_provider_ref_blocks_cutover() {
+  local case_dir
+  case_dir="$(new_case opencode-agent-provider-ref)"
+  write_list "${case_dir}/agents.json" '[
+    {
+      "kind":"Agent",
+      "metadata":{"namespace":"work","name":"provider-ref-opencode"},
+      "spec":{
+        "model":{"name":"openai/gpt-5.4","contextWindow":32768,"maxTokens":4096},
+        "providerRef":{"name":"legacy-provider"},
+        "runtime":{"type":"opencode"}
+      }
+    },
+    {
+      "kind":"Agent",
+      "metadata":{"namespace":"work","name":"null-provider-ref-opencode"},
+      "spec":{
+        "model":{"name":"openai/gpt-5.4","contextWindow":32768,"maxTokens":4096},
+        "providerRef":null,
+        "runtime":{"type":"opencode"}
+      }
+    }
+  ]'
+
+  expect_failure "${case_dir}" 'Agent work/provider-ref-opencode must be removed before the OpenCode CRD cutover' run_upgrade "${case_dir}"
+  grep -F 'Agent work/null-provider-ref-opencode must be removed before the OpenCode CRD cutover' "${case_dir}/output" >/dev/null
+  assert_no_live_apply "${case_dir}"
+}
+
+test_post_dry_run_legacy_builtin_opencode_agent_blocks_live_apply() {
+  local case_dir
+  case_dir="$(new_case post-dry-run-legacy-builtin-opencode-agent)"
+  write_list "${case_dir}/post-dry-run-agents.json" '[{"kind":"Agent","metadata":{"namespace":"work","name":"late-opencode"},"spec":{"runtime":{"type":"opencode"}}}]'
+
+  expect_failure "${case_dir}" 'hard-cutover state changed after dry-run; no CRDs were applied' run_upgrade "${case_dir}"
+  grep -F 'Agent work/late-opencode must be removed before the OpenCode CRD cutover' "${case_dir}/output" >/dev/null
+  assert_one_dry_run_no_live_apply "${case_dir}"
+  [[ "$(grep -Fc 'get agents.core.orka.ai -A -o json' "${case_dir}/kubectl.log")" == "2" ]]
+}
+
+test_legacy_task_workspace_credentials_block_cutover() {
+  local case_dir
+  case_dir="$(new_case legacy-task-workspace-credential)"
+  write_list "${case_dir}/tasks.json" '[
+    {"kind":"Task","metadata":{"namespace":"work","name":"top-level"},"spec":{"type":"container","workspace":{"gitRepo":"https://github.com/example/private.git","gitSecretRef":{"name":"git-creds"}}}},
+    {"kind":"Task","metadata":{"namespace":"work","name":"nested-agent"},"spec":{"type":"agent","agentRuntime":{"workspace":{"gitRepo":"https://github.com/example/private.git","gitSecretRef":{"name":"git-creds"}}}}},
+    {"kind":"Task","metadata":{"namespace":"work","name":"current"},"spec":{"type":"container","workspace":{"gitRepo":"https://github.com/example/private.git","readCredentialRef":{"name":"git-read"}}}}
+  ]'
+
+  expect_failure "${case_dir}" 'Task work/top-level still uses legacy spec.workspace.gitSecretRef' run_upgrade "${case_dir}"
+  grep -F 'Task work/nested-agent still uses legacy spec.agentRuntime.workspace.gitSecretRef' "${case_dir}/output" >/dev/null
+  grep -F 'recreate it with spec.workspace.readCredentialRef after the new CRD is applied' "${case_dir}/output" >/dev/null
+  ! grep -F 'Task work/current' "${case_dir}/output" >/dev/null
+  assert_no_live_apply "${case_dir}"
+  [[ ! -s "${case_dir}/apply.log" ]]
+}
+
+test_post_dry_run_legacy_task_blocks_live_apply() {
+  local case_dir
+  case_dir="$(new_case post-dry-run-legacy-task)"
+  write_list "${case_dir}/post-dry-run-tasks.json" '[{"kind":"Task","metadata":{"namespace":"work","name":"late-legacy"},"spec":{"type":"ai","workspace":{"gitSecretRef":{"name":"git-creds"}}}}]'
+
+  expect_failure "${case_dir}" 'hard-cutover state changed after dry-run; no CRDs were applied' run_upgrade "${case_dir}"
+  grep -F 'Task work/late-legacy still uses legacy spec.workspace.gitSecretRef' "${case_dir}/output" >/dev/null
+  assert_one_dry_run_no_live_apply "${case_dir}"
+  [[ "$(grep -Fc 'get tasks.core.orka.ai -A -o json' "${case_dir}/kubectl.log")" == "2" ]]
+}
+
+test_post_dry_run_state_change_blocks_live_apply() {
+  local case_dir
+  case_dir="$(new_case post-dry-run-change)"
+  prepare_historical_case "${case_dir}"
+  write_list "${case_dir}/post-dry-run-runtimes.json" '[{"kind":"AgentRuntime","metadata":{"namespace":"gateway-ns","name":"late-v1-runtime"},"spec":{"contractVersion":"orka.harness.v1"}}]'
+
+  expect_failure "${case_dir}" 'AgentRuntime gateway-ns/late-v1-runtime still declares orka.harness.v1' \
+    run_upgrade "${case_dir}" --gateway-workload gateway-ns/legacy-gateway=deployment/gateway-ns/gateway-adapter
+  assert_one_dry_run_no_live_apply "${case_dir}"
+  [[ "$(grep -Fc 'get agentruntimes.core.orka.ai -A -o json' "${case_dir}/kubectl.log")" == "2" ]]
+}
+
+test_clean_historical_cutover_applies() {
+  local case_dir
+  case_dir="$(new_case clean-cutover)"
+  prepare_historical_case "${case_dir}"
+
+  run_upgrade "${case_dir}" --gateway-workload gateway-ns/legacy-gateway=deployment/gateway-ns/gateway-adapter >"${case_dir}/output" 2>&1
+  grep -F 'ACP v2 CRD hard cutover applied' "${case_dir}/output" >/dev/null
+  assert_one_dry_run_and_one_live_apply "${case_dir}"
+  [[ "$(grep -Fc 'get agentruntimes.core.orka.ai -A -o json' "${case_dir}/kubectl.log")" == "2" ]]
+}
+
+run_test 'uses canonical ControllerEpoch CRD plural' test_controller_epoch_crd_uses_canonical_plural
+run_test 'requires explicit backup paths' test_requires_backup_arguments
+run_test 'rejects invalid backup paths and attestations' test_backup_attestation_rejections
+run_test 'requires a mapping for each affected Gateway' test_affected_gateway_requires_mapping
+run_test 'blocks live v1 runtime and reference chain' test_live_reference_chain_blocks
+run_test 'blocks backed-up v1 references after runtime deletion' test_backed_up_reference_blocks_after_runtime_deleted
+run_test 'enforces every scale-to-zero status invariant' test_gateway_scale_to_zero_invariants
+run_test 'never deletes wrapper without opt-in' test_wrapper_requires_explicit_cleanup
+run_test 'deletes only exact legacy wrapper targets with opt-in' test_explicit_wrapper_cleanup_targets_only_legacy_resources
+run_test 'blocks legacy built-in OpenCode Agents before cutover' test_legacy_builtin_opencode_agent_blocks_cutover
+run_test 'requires even post-upgrade-shaped OpenCode Agents to be recreated after cutover' test_post_upgrade_shaped_opencode_agent_still_blocks_cutover
+run_test 'blocks built-in OpenCode Agents with providerRef before cutover' test_opencode_agent_provider_ref_blocks_cutover
+run_test 'rechecks legacy built-in OpenCode Agents after server dry-run' test_post_dry_run_legacy_builtin_opencode_agent_blocks_live_apply
+run_test 'blocks legacy Task workspace credentials before cutover' test_legacy_task_workspace_credentials_block_cutover
+run_test 'rechecks legacy Tasks after server dry-run' test_post_dry_run_legacy_task_blocks_live_apply
+run_test 'rechecks cluster state after server dry-run' test_post_dry_run_state_change_blocks_live_apply
+run_test 'clean verified historical cutover applies' test_clean_historical_cutover_applies
+
+printf '%s\n' "${pass_count} passed, ${fail_count} failed"
+[[ "${fail_count}" == "0" ]]
diff --git a/scripts/update-release-version.py b/scripts/update-release-version.py
index c057ccaef..29bf55f2d 100755
--- a/scripts/update-release-version.py
+++ b/scripts/update-release-version.py
@@ -27,6 +27,19 @@ def replace_exact(
     updates[path] = updated
 
 
+def replace_image_tag(
+    updates: dict[pathlib.Path, str], path: pathlib.Path, repository: str, tag: str
+) -> None:
+    """Replace one image tag selected by its exact repository."""
+    replace_exact(
+        updates,
+        path,
+        rf"^([ \t]+repository:[ \t]*{re.escape(repository)}[ \t]*\n"
+        rf"(?:[ \t]*(?:#.*)?\n)*[ \t]+tag:)[ \t]*.*$",
+        rf'\1 "{tag}"',
+    )
+
+
 def main() -> int:
     if len(sys.argv) != 2 or not VERSION_RE.fullmatch(sys.argv[1]):
         print("usage: update-release-version.py vX.Y.Z[-beta.N|-rc.N]", file=sys.stderr)
@@ -46,16 +59,23 @@ def main() -> int:
     replace_exact(updates, chart, r"^appVersion: .*$", f'appVersion: "{release_tag}"')
 
     values = ROOT / "cmd/build/helmify/static/values.yaml"
-    replace_exact(updates, values, r"^(\s+tag:)\s*.*$", rf'\1 "{version}"', expected=4)
+    # Update every image published by the tagged release explicitly. Selecting
+    # by exact repository keeps cardinality checks stable as new chart images
+    # are added and prevents unrelated tag fields from being changed silently.
+    for repository in (
+        "ghcr.io/orka-agents/orka",
+        "ghcr.io/orka-agents/orka/workspace-publisher",
+        "ghcr.io/orka-agents/orka/agent-harness-wrapper",
+        "ghcr.io/orka-agents/orka/ai-worker",
+        "ghcr.io/orka-agents/orka/general-worker",
+    ):
+        replace_image_tag(updates, values, repository, version)
 
     substitutions = {
         ROOT / "config/manager/manager.yaml": [
             (r"(ghcr\.io/orka-agents/orka/ai-worker:)[^\s]+", rf"\g<1>{version}", 1),
             (r"(ghcr\.io/orka-agents/orka/general-worker:)[^\s]+", rf"\g<1>{version}", 1),
         ],
-        ROOT / "config/harness-wrapper/deployment.yaml": [
-            (r"(ghcr\.io/orka-agents/orka/agent-harness-wrapper:)[^\s]+", rf"\g<1>{version}", 1),
-        ],
         ROOT / "config/manager/kustomization.yaml": [
             (r"^(\s*newTag:)\s*.*$", rf"\g<1> {version}", 2),
         ],
diff --git a/scripts/upgrade-orka-crds.sh b/scripts/upgrade-orka-crds.sh
new file mode 100755
index 000000000..da5124d5a
--- /dev/null
+++ b/scripts/upgrade-orka-crds.sh
@@ -0,0 +1,665 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+readonly backup_marker_format="orka-backup-verification-v1"
+readonly empty_list_json='{"apiVersion":"v1","kind":"List","items":[]}'
+
+usage() {
+  cat <<'USAGE'
+Usage:
+  scripts/upgrade-orka-crds.sh \
+    --context CONTEXT \
+    --sqlite-backup /absolute/path/to/sqlite-or-pvc-backup \
+    --sqlite-backup-marker /absolute/path/to/sqlite-or-pvc-backup.verified \
+    --cr-backup /absolute/path/to/orka-crs.json \
+    --cr-backup-marker /absolute/path/to/orka-crs.json.verified \
+    [--gateway-workload GATEWAY_NAMESPACE/GATEWAY_NAME=KIND/WORKLOAD_NAMESPACE/WORKLOAD_NAME]... \
+    [--delete-legacy-wrapper]
+
+The script performs a fail-closed ACP v2 CRD hard cutover. It will not apply
+CRDs while any of the following remain:
+  * an orka.harness.v1 AgentRuntime;
+  * an Agent that references a live or backed-up v1 AgentRuntime;
+  * any live Agent that uses built-in OpenCode and must be recreated after the
+    new Agent CRD is applied;
+  * a GatewayBinding that references an affected Agent;
+  * a Task that still uses spec.workspace.gitSecretRef or
+    spec.agentRuntime.workspace.gitSecretRef;
+  * a legacy harness-wrapper Deployment, Service, or Secret.
+
+Every Gateway reached by an affected backed-up or live GatewayBinding must have
+at least one explicit --gateway-workload mapping. KIND must be deployment or
+statefulset. Each mapped workload must exist in the Gateway namespace, have
+spec.replicas=0, report zero replicas, and have observed its current generation.
+
+Both backup markers must contain exactly one of each required field:
+  format=orka-backup-verification-v1
+  kind=sqlite-pvc        # use kind=orka-crs for the CR backup marker
+  context=CONTEXT
+  cluster_uid=<kube-system namespace UID>
+  api_server_identity_sha256=<sha256 of canonical API server/TLS identity>
+  sha256=<lowercase sha256 of the backup file>
+  verified=true
+  verified_at=<UTC RFC3339 timestamp, for example 2026-07-25T08:00:00Z>
+
+Writing a marker is an operator attestation that the referenced backup was
+independently inspected or restore-tested. The CR backup must be a Kubernetes
+JSON List containing the pre-cutover AgentRuntime, Agent, and GatewayBinding
+inventory. Store backup artifacts and markers outside the repository.
+
+--delete-legacy-wrapper is explicit opt-in. Without it, the script prints exact
+kubectl delete commands but never deletes legacy resources. Even with the flag,
+other v1 objects must be migrated or deleted by the operator before CRDs apply.
+USAGE
+}
+
+die() {
+  echo "error: $*" >&2
+  exit 1
+}
+
+require_value() {
+  local option="$1"
+  local value="${2:-}"
+  [[ -n "${value}" ]] || die "${option} requires a value"
+  [[ "${value}" != --* ]] || die "${option} requires a value"
+}
+
+context=""
+cluster_uid=""
+api_server_identity_sha256=""
+sqlite_backup=""
+sqlite_backup_marker=""
+cr_backup=""
+cr_backup_marker=""
+delete_legacy_wrapper=false
+gateway_workload_args=()
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --context)
+      require_value "$1" "${2:-}"
+      context="$2"
+      shift 2
+      ;;
+    --sqlite-backup)
+      require_value "$1" "${2:-}"
+      sqlite_backup="$2"
+      shift 2
+      ;;
+    --sqlite-backup-marker)
+      require_value "$1" "${2:-}"
+      sqlite_backup_marker="$2"
+      shift 2
+      ;;
+    --cr-backup)
+      require_value "$1" "${2:-}"
+      cr_backup="$2"
+      shift 2
+      ;;
+    --cr-backup-marker)
+      require_value "$1" "${2:-}"
+      cr_backup_marker="$2"
+      shift 2
+      ;;
+    --gateway-workload)
+      require_value "$1" "${2:-}"
+      gateway_workload_args+=("$2")
+      shift 2
+      ;;
+    --delete-legacy-wrapper)
+      delete_legacy_wrapper=true
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "unknown argument: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+done
+
+[[ -n "${context}" ]] || die "--context is required"
+[[ -n "${sqlite_backup}" ]] || die "--sqlite-backup is required"
+[[ -n "${sqlite_backup_marker}" ]] || die "--sqlite-backup-marker is required"
+[[ -n "${cr_backup}" ]] || die "--cr-backup is required"
+[[ -n "${cr_backup_marker}" ]] || die "--cr-backup-marker is required"
+
+command -v kubectl >/dev/null 2>&1 || die "kubectl is required"
+command -v jq >/dev/null 2>&1 || die "jq is required"
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+crd_dir="${root}/charts/orka/crds"
+[[ -d "${crd_dir}" ]] || die "CRD directory does not exist: ${crd_dir}"
+[[ -n "$(find "${crd_dir}" -type f -name '*.yaml' -print -quit)" ]] || die "CRD directory contains no YAML files: ${crd_dir}"
+
+tmp_dir="$(mktemp -d "${TMPDIR:-/tmp}/orka-crd-upgrade.XXXXXX")"
+cleanup() {
+  rm -rf "${tmp_dir}"
+}
+trap cleanup EXIT
+
+kube() {
+  kubectl --context "${context}" "$@"
+}
+
+sha256_file() {
+  local path="$1"
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "${path}" | awk '{print tolower($1)}'
+    return
+  fi
+  if command -v shasum >/dev/null 2>&1; then
+    shasum -a 256 "${path}" | awk '{print tolower($1)}'
+    return
+  fi
+  if command -v openssl >/dev/null 2>&1; then
+    openssl dgst -sha256 "${path}" | awk '{print tolower($NF)}'
+    return
+  fi
+  die "sha256sum, shasum, or openssl is required"
+}
+
+validate_backup_file() {
+  local label="$1"
+  local path="$2"
+  [[ "${path}" == /* ]] || die "${label} path must be absolute: ${path}"
+  [[ ! -L "${path}" ]] || die "${label} path must not be a symbolic link: ${path}"
+  [[ -f "${path}" ]] || die "${label} file does not exist: ${path}"
+  [[ -s "${path}" ]] || die "${label} file is empty: ${path}"
+}
+
+marker_field() {
+  local marker="$1"
+  local key="$2"
+  local count
+  count="$(awk -F= -v key="${key}" '$1 == key { count++ } END { print count + 0 }' "${marker}")"
+  [[ "${count}" == "1" ]] || die "backup marker ${marker} must contain exactly one ${key}= field"
+  awk -F= -v key="${key}" '$1 == key { print substr($0, length(key) + 2) }' "${marker}"
+}
+
+validate_backup_marker() {
+  local backup_label="$1"
+  local backup_path="$2"
+  local marker_path="$3"
+  local expected_kind="$4"
+  local marker_format marker_kind marker_context marker_cluster_uid marker_api_server_identity marker_digest marker_verified marker_verified_at actual_digest
+
+  validate_backup_file "${backup_label}" "${backup_path}"
+  validate_backup_file "${backup_label} verification marker" "${marker_path}"
+
+  marker_format="$(marker_field "${marker_path}" format)"
+  marker_kind="$(marker_field "${marker_path}" kind)"
+  marker_context="$(marker_field "${marker_path}" context)"
+  marker_cluster_uid="$(marker_field "${marker_path}" cluster_uid)"
+  marker_api_server_identity="$(marker_field "${marker_path}" api_server_identity_sha256)"
+  marker_digest="$(marker_field "${marker_path}" sha256)"
+  marker_verified="$(marker_field "${marker_path}" verified)"
+  marker_verified_at="$(marker_field "${marker_path}" verified_at)"
+
+  [[ "${marker_format}" == "${backup_marker_format}" ]] || die "${backup_label} marker has unsupported format"
+  [[ "${marker_kind}" == "${expected_kind}" ]] || die "${backup_label} marker kind must be ${expected_kind}"
+  [[ "${marker_context}" == "${context}" ]] || die "${backup_label} marker context does not match --context"
+  [[ "${marker_cluster_uid}" == "${cluster_uid}" ]] || die "${backup_label} marker cluster_uid does not match the target cluster"
+  [[ "${marker_api_server_identity}" == "${api_server_identity_sha256}" ]] || die "${backup_label} marker api_server_identity_sha256 does not match the target cluster"
+  [[ "${marker_verified}" == "true" ]] || die "${backup_label} marker must attest verified=true"
+  [[ "${marker_digest}" =~ ^[0-9a-f]{64}$ ]] || die "${backup_label} marker sha256 must be 64 lowercase hexadecimal characters"
+  [[ "${marker_verified_at}" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$ ]] || die "${backup_label} marker verified_at must be a UTC RFC3339 timestamp"
+
+  actual_digest="$(sha256_file "${backup_path}")"
+  [[ "${actual_digest}" == "${marker_digest}" ]] || die "${backup_label} digest does not match its verification marker"
+}
+
+validate_cr_backup_shape() {
+  jq -e '
+    type == "object" and
+    .kind == "List" and
+    (.items | type == "array") and
+    ([.items[]
+      | select(.kind == "AgentRuntime" or .kind == "Agent" or .kind == "GatewayBinding")
+      | (((.metadata.namespace // "") | length) > 0 and ((.metadata.name // "") | length) > 0)
+    ] | all)
+  ' "${cr_backup}" >/dev/null || die "CR backup must be a Kubernetes JSON List with namespaced AgentRuntime, Agent, and GatewayBinding entries"
+}
+
+load_cluster_identity() {
+  local namespace_json="${tmp_dir}/kube-system-namespace.json"
+  local kubeconfig_json="${tmp_dir}/target-kubeconfig.json"
+  local api_identity_json="${tmp_dir}/api-server-identity.json"
+
+  kube get namespace kube-system -o json >"${namespace_json}" || die "failed to read kube-system namespace identity"
+  cluster_uid="$(jq -r '.metadata.uid // ""' "${namespace_json}")"
+  [[ -n "${cluster_uid}" && "${cluster_uid}" != "null" ]] || die "kube-system namespace has no UID"
+  [[ "${#cluster_uid}" -le 128 ]] || die "kube-system namespace UID is unexpectedly long"
+  [[ "${cluster_uid}" =~ ^[A-Za-z0-9][A-Za-z0-9._:-]*$ ]] || die "kube-system namespace UID has an unexpected format"
+
+  kubectl --context "${context}" config view --minify --flatten -o json >"${kubeconfig_json}" || die "failed to read target API server identity"
+  jq -c '
+    .clusters
+    | if length == 1 then
+        .[0].cluster
+        | {
+            server: (.server // null),
+            certificateAuthorityData: (.["certificate-authority-data"] // null),
+            insecureSkipTLSVerify: (.["insecure-skip-tls-verify"] // null),
+            tlsServerName: (.["tls-server-name"] // null),
+            proxyURL: (.["proxy-url"] // null),
+            disableCompression: (.["disable-compression"] // null)
+          }
+      else
+        error("expected exactly one target cluster")
+      end
+  ' "${kubeconfig_json}" >"${api_identity_json}" || die "target kubeconfig has no unique API server identity"
+  api_server_identity_sha256="$(sha256_file "${api_identity_json}")"
+}
+
+validate_backups() {
+  load_cluster_identity
+  validate_backup_marker "SQLite/PVC backup" "${sqlite_backup}" "${sqlite_backup_marker}" "sqlite-pvc"
+  validate_backup_marker "CR backup" "${cr_backup}" "${cr_backup_marker}" "orka-crs"
+  validate_cr_backup_shape
+}
+
+write_empty_list() {
+  local output="$1"
+  printf '%s\n' "${empty_list_json}" >"${output}"
+}
+
+fetch_resource_list() {
+  local resource="$1"
+  local discovery_file="$2"
+  local output="$3"
+  if grep -Fqx -- "${resource}" "${discovery_file}"; then
+    kube get "${resource}" -A -o json >"${output}" || die "failed to list ${resource}"
+    jq -e '.kind == "List" and (.items | type == "array")' "${output}" >/dev/null || die "${resource} returned an invalid list"
+    return
+  fi
+  write_empty_list "${output}"
+}
+
+collect_cluster_state() {
+  kube get --raw=/version >/dev/null || die "cannot reach Kubernetes context ${context}"
+  kube api-resources --api-group=core.orka.ai -o name >"${tmp_dir}/core-api-resources" || die "failed to discover core.orka.ai resources"
+  kube api-resources --api-group=gateway.orka.ai -o name >"${tmp_dir}/gateway-api-resources" || die "failed to discover gateway.orka.ai resources"
+
+  fetch_resource_list "agentruntimes.core.orka.ai" "${tmp_dir}/core-api-resources" "${tmp_dir}/live-agentruntimes.json"
+  fetch_resource_list "agents.core.orka.ai" "${tmp_dir}/core-api-resources" "${tmp_dir}/live-agents.json"
+  fetch_resource_list "tasks.core.orka.ai" "${tmp_dir}/core-api-resources" "${tmp_dir}/live-tasks.json"
+  fetch_resource_list "gatewaybindings.gateway.orka.ai" "${tmp_dir}/gateway-api-resources" "${tmp_dir}/live-gatewaybindings.json"
+}
+
+build_legacy_builtin_agent_inventory() {
+  jq -r '
+    .items[]
+    | select((.spec.runtime.type // "") == "opencode")
+    | [(.metadata.namespace // ""), (.metadata.name // "")] | @tsv
+  ' "${tmp_dir}/live-agents.json" >"${tmp_dir}/live-legacy-builtin-agents.tsv"
+  sort_unique_file "${tmp_dir}/live-legacy-builtin-agents.tsv"
+}
+
+build_legacy_task_inventory() {
+  jq -r '
+    .items[]
+    | . as $task
+    | [
+        {path: "spec.workspace.gitSecretRef", value: ($task.spec.workspace.gitSecretRef // null)},
+        {path: "spec.agentRuntime.workspace.gitSecretRef", value: ($task.spec.agentRuntime.workspace.gitSecretRef // null)}
+      ][]
+    | select(.value != null)
+    | [($task.metadata.namespace // ""), ($task.metadata.name // ""), .path] | @tsv
+  ' "${tmp_dir}/live-tasks.json" >"${tmp_dir}/live-legacy-task-workspaces.tsv"
+  sort_unique_file "${tmp_dir}/live-legacy-task-workspaces.tsv"
+}
+
+sort_unique_file() {
+  local path="$1"
+  LC_ALL=C sort -u "${path}" -o "${path}"
+}
+
+append_legacy_runtime_keys() {
+  local source="$1"
+  local kind_filter="$2"
+  local output="$3"
+  jq -r --arg kind_filter "${kind_filter}" '
+    .items[]
+    | select(($kind_filter == "" or .kind == $kind_filter))
+    | select((.spec.contractVersion // .spec.contract.version // "") == "orka.harness.v1")
+    | [(.metadata.namespace // ""), (.metadata.name // "")] | @tsv
+  ' "${source}" >>"${output}"
+}
+
+append_agent_records() {
+  local source="$1"
+  local kind_filter="$2"
+  local output="$3"
+  jq -r --arg kind_filter "${kind_filter}" '
+    .items[]
+    | select(($kind_filter == "" or .kind == $kind_filter))
+    | select(((.spec.runtime.runtimeRef.name // "") | length) > 0)
+    | [(.metadata.namespace // ""), (.metadata.name // ""), .spec.runtime.runtimeRef.name] | @tsv
+  ' "${source}" >>"${output}"
+}
+
+append_binding_records() {
+  local source="$1"
+  local kind_filter="$2"
+  local output="$3"
+  jq -r --arg kind_filter "${kind_filter}" '
+    .items[]
+    | select(($kind_filter == "" or .kind == $kind_filter))
+    | select(((.spec.agentRef.name // "") | length) > 0 and ((.spec.gatewayRef.name // "") | length) > 0)
+    | [(.metadata.namespace // ""), (.metadata.name // ""), .spec.agentRef.name, .spec.gatewayRef.name] | @tsv
+  ' "${source}" >>"${output}"
+}
+
+key_exists() {
+  local namespace="$1"
+  local name="$2"
+  local path="$3"
+  local key
+  key="${namespace}"$'\t'"${name}"
+  grep -Fqx -- "${key}" "${path}"
+}
+
+build_reference_inventory() {
+  local namespace name reference binding gateway
+  local all_agents="${tmp_dir}/all-agents.tsv"
+  local all_bindings="${tmp_dir}/all-bindings.tsv"
+
+  touch "${tmp_dir}/legacy-runtime-keys.tsv"
+  touch "${tmp_dir}/affected-agent-keys.tsv"
+  touch "${tmp_dir}/affected-gateways.tsv"
+  : >"${tmp_dir}/live-v1-runtimes.tsv"
+  : >"${tmp_dir}/live-affected-agents.tsv"
+  : >"${tmp_dir}/live-affected-bindings.tsv"
+  : >"${tmp_dir}/live-agent-records.tsv"
+  : >"${tmp_dir}/live-binding-records.tsv"
+  : >"${all_agents}"
+  : >"${all_bindings}"
+
+  append_legacy_runtime_keys "${cr_backup}" "AgentRuntime" "${tmp_dir}/legacy-runtime-keys.tsv"
+  append_legacy_runtime_keys "${tmp_dir}/live-agentruntimes.json" "" "${tmp_dir}/legacy-runtime-keys.tsv"
+  append_legacy_runtime_keys "${tmp_dir}/live-agentruntimes.json" "" "${tmp_dir}/live-v1-runtimes.tsv"
+  sort_unique_file "${tmp_dir}/legacy-runtime-keys.tsv"
+  sort_unique_file "${tmp_dir}/live-v1-runtimes.tsv"
+
+  append_agent_records "${cr_backup}" "Agent" "${all_agents}"
+  append_agent_records "${tmp_dir}/live-agents.json" "" "${all_agents}"
+  while IFS=$'\t' read -r namespace name reference; do
+    [[ -n "${namespace}" && -n "${name}" && -n "${reference}" ]] || continue
+    if key_exists "${namespace}" "${reference}" "${tmp_dir}/legacy-runtime-keys.tsv"; then
+      printf '%s\t%s\n' "${namespace}" "${name}" >>"${tmp_dir}/affected-agent-keys.tsv"
+    fi
+  done <"${all_agents}"
+  sort_unique_file "${tmp_dir}/affected-agent-keys.tsv"
+
+  append_agent_records "${tmp_dir}/live-agents.json" "" "${tmp_dir}/live-agent-records.tsv"
+  while IFS=$'\t' read -r namespace name reference; do
+    [[ -n "${namespace}" && -n "${name}" && -n "${reference}" ]] || continue
+    if key_exists "${namespace}" "${name}" "${tmp_dir}/affected-agent-keys.tsv"; then
+      printf '%s\t%s\t%s\n' "${namespace}" "${name}" "${reference}" >>"${tmp_dir}/live-affected-agents.tsv"
+    fi
+  done <"${tmp_dir}/live-agent-records.tsv"
+  sort_unique_file "${tmp_dir}/live-affected-agents.tsv"
+
+  append_binding_records "${cr_backup}" "GatewayBinding" "${all_bindings}"
+  append_binding_records "${tmp_dir}/live-gatewaybindings.json" "" "${all_bindings}"
+  while IFS=$'\t' read -r namespace binding reference gateway; do
+    [[ -n "${namespace}" && -n "${binding}" && -n "${reference}" && -n "${gateway}" ]] || continue
+    if key_exists "${namespace}" "${reference}" "${tmp_dir}/affected-agent-keys.tsv"; then
+      printf '%s\t%s\n' "${namespace}" "${gateway}" >>"${tmp_dir}/affected-gateways.tsv"
+    fi
+  done <"${all_bindings}"
+  sort_unique_file "${tmp_dir}/affected-gateways.tsv"
+
+  append_binding_records "${tmp_dir}/live-gatewaybindings.json" "" "${tmp_dir}/live-binding-records.tsv"
+  while IFS=$'\t' read -r namespace binding reference gateway; do
+    [[ -n "${namespace}" && -n "${binding}" && -n "${reference}" && -n "${gateway}" ]] || continue
+    if key_exists "${namespace}" "${reference}" "${tmp_dir}/affected-agent-keys.tsv"; then
+      printf '%s\t%s\t%s\t%s\n' "${namespace}" "${binding}" "${reference}" "${gateway}" >>"${tmp_dir}/live-affected-bindings.tsv"
+    fi
+  done <"${tmp_dir}/live-binding-records.tsv"
+  sort_unique_file "${tmp_dir}/live-affected-bindings.tsv"
+}
+
+parse_gateway_workload_mappings() {
+  local mapping gateway_part workload_part gateway_namespace gateway_name gateway_extra
+  local workload_kind workload_namespace workload_name workload_extra resource
+  : >"${tmp_dir}/gateway-workloads.tsv"
+
+  if [[ "${#gateway_workload_args[@]}" -eq 0 ]]; then
+    return 0
+  fi
+
+  for mapping in "${gateway_workload_args[@]}"; do
+    [[ "${mapping}" == *=* ]] || die "invalid --gateway-workload mapping: ${mapping}"
+    gateway_part="${mapping%%=*}"
+    workload_part="${mapping#*=}"
+    IFS=/ read -r gateway_namespace gateway_name gateway_extra <<<"${gateway_part}"
+    IFS=/ read -r workload_kind workload_namespace workload_name workload_extra <<<"${workload_part}"
+    [[ -n "${gateway_namespace}" && -n "${gateway_name}" && -z "${gateway_extra:-}" ]] || die "gateway mapping key must be NAMESPACE/GATEWAY_NAME: ${mapping}"
+    [[ -n "${workload_kind}" && -n "${workload_namespace}" && -n "${workload_name}" && -z "${workload_extra:-}" ]] || die "gateway workload must be KIND/NAMESPACE/NAME: ${mapping}"
+    [[ "${workload_namespace}" == "${gateway_namespace}" ]] || die "gateway workload must be in Gateway namespace ${gateway_namespace}: ${mapping}"
+
+    case "${workload_kind}" in
+      deployment|deployments|deployment.apps|deployments.apps)
+        resource="deployment.apps"
+        ;;
+      statefulset|statefulsets|statefulset.apps|statefulsets.apps)
+        resource="statefulset.apps"
+        ;;
+      *)
+        die "gateway workload kind must be deployment or statefulset: ${mapping}"
+        ;;
+    esac
+
+    printf '%s\t%s\t%s\t%s\n' "${gateway_namespace}" "${gateway_name}" "${resource}" "${workload_name}" >>"${tmp_dir}/gateway-workloads.tsv"
+  done
+  sort_unique_file "${tmp_dir}/gateway-workloads.tsv"
+}
+
+verify_gateway_workload() {
+  local gateway_namespace="$1"
+  local gateway_name="$2"
+  local resource="$3"
+  local workload_name="$4"
+  local output safe_name
+  local generation observed_generation spec_replicas status_replicas ready_replicas available_replicas updated_replicas current_replicas terminating_replicas
+
+  safe_name="$(printf '%s-%s-%s-%s' "${gateway_namespace}" "${gateway_name}" "${resource}" "${workload_name}" | tr -c 'A-Za-z0-9_.-' '_')"
+  output="${tmp_dir}/workload-${safe_name}.json"
+  kube get "${resource}" -n "${gateway_namespace}" "${workload_name}" -o json >"${output}" || die "failed to read gateway workload ${resource}/${gateway_namespace}/${workload_name}"
+  jq -e --arg namespace "${gateway_namespace}" --arg name "${workload_name}" '
+    .metadata.namespace == $namespace and .metadata.name == $name
+  ' "${output}" >/dev/null || die "gateway workload identity mismatch for ${resource}/${gateway_namespace}/${workload_name}"
+
+  generation="$(jq -r '.metadata.generation // 0' "${output}")"
+  observed_generation="$(jq -r '.status.observedGeneration // 0' "${output}")"
+  spec_replicas="$(jq -r '.spec.replicas // 1' "${output}")"
+  status_replicas="$(jq -r '.status.replicas // 0' "${output}")"
+  ready_replicas="$(jq -r '.status.readyReplicas // 0' "${output}")"
+  available_replicas="$(jq -r '.status.availableReplicas // 0' "${output}")"
+  updated_replicas="$(jq -r '.status.updatedReplicas // 0' "${output}")"
+  current_replicas="$(jq -r '.status.currentReplicas // 0' "${output}")"
+  terminating_replicas="$(jq -r '.status.terminatingReplicas // 0' "${output}")"
+
+  if [[ "${spec_replicas}" != "0" || "${status_replicas}" != "0" || "${ready_replicas}" != "0" || "${available_replicas}" != "0" || "${updated_replicas}" != "0" || "${current_replicas}" != "0" || "${terminating_replicas}" != "0" || "${observed_generation}" -lt "${generation}" ]]; then
+    echo "blocked: Gateway ${gateway_namespace}/${gateway_name} workload ${resource}/${workload_name} is not fully scaled to zero" >&2
+    echo "  generation=${generation} observedGeneration=${observed_generation} spec.replicas=${spec_replicas} status.replicas=${status_replicas} ready=${ready_replicas} available=${available_replicas} updated=${updated_replicas} current=${current_replicas} terminating=${terminating_replicas}" >&2
+    return 1
+  fi
+  return 0
+}
+
+verify_gateway_quiescence() {
+  local namespace gateway mapped resource workload_name
+  local failed=false
+
+  if [[ ! -s "${tmp_dir}/affected-gateways.tsv" ]]; then
+    if [[ -s "${tmp_dir}/gateway-workloads.tsv" ]]; then
+      die "--gateway-workload was provided, but the verified CR backup and live state contain no affected Gateway"
+    fi
+    return 0
+  fi
+
+  while IFS=$'\t' read -r namespace gateway; do
+    [[ -n "${namespace}" && -n "${gateway}" ]] || continue
+    mapped=false
+    while IFS=$'\t' read -r mapped_namespace mapped_gateway resource workload_name; do
+      if [[ "${mapped_namespace}" == "${namespace}" && "${mapped_gateway}" == "${gateway}" ]]; then
+        mapped=true
+        verify_gateway_workload "${namespace}" "${gateway}" "${resource}" "${workload_name}" || failed=true
+      fi
+    done <"${tmp_dir}/gateway-workloads.tsv"
+    if [[ "${mapped}" != "true" ]]; then
+      echo "blocked: affected Gateway ${namespace}/${gateway} has no --gateway-workload mapping" >&2
+      failed=true
+    fi
+  done <"${tmp_dir}/affected-gateways.tsv"
+
+  while IFS=$'\t' read -r namespace gateway resource workload_name; do
+    [[ -n "${namespace}" && -n "${gateway}" ]] || continue
+    if ! key_exists "${namespace}" "${gateway}" "${tmp_dir}/affected-gateways.tsv"; then
+      echo "blocked: --gateway-workload maps unknown affected Gateway ${namespace}/${gateway} (${resource}/${workload_name})" >&2
+      failed=true
+    fi
+  done <"${tmp_dir}/gateway-workloads.tsv"
+
+  [[ "${failed}" == "false" ]]
+}
+
+discover_legacy_wrapper_resources() {
+  local resource display raw namespace name component
+  : >"${tmp_dir}/legacy-wrapper-resources.tsv"
+
+  for entry in "deployment.apps:Deployment" "service:Service" "secret:Secret"; do
+    resource="${entry%%:*}"
+    display="${entry#*:}"
+    raw="${tmp_dir}/wrapper-${resource//./-}.txt"
+    kube get "${resource}" -A -o 'custom-columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name,COMPONENT:.metadata.labels.app\.kubernetes\.io/component' --no-headers >"${raw}" || die "failed to list ${display} metadata"
+    while read -r namespace name component _; do
+      [[ -n "${namespace}" && -n "${name}" ]] || continue
+      case "${resource}:${name}:${component:-}" in
+        deployment.apps:agent-harness-wrapper:*|deployment.apps:*-agent-harness-wrapper:*|service:agent-harness-wrapper:*|service:*-agent-harness-wrapper:*|secret:harness-wrapper-auth:*|secret:*-harness-wrapper-auth:*|*:*:agent-harness-wrapper)
+          printf '%s\t%s\t%s\t%s\n' "${resource}" "${display}" "${namespace}" "${name}" >>"${tmp_dir}/legacy-wrapper-resources.tsv"
+          ;;
+      esac
+    done <"${raw}"
+  done
+  sort_unique_file "${tmp_dir}/legacy-wrapper-resources.tsv"
+}
+
+delete_legacy_wrapper_resources() {
+  local resource display namespace name
+  [[ -s "${tmp_dir}/legacy-wrapper-resources.tsv" ]] || return 0
+  echo "Deleting legacy harness-wrapper resources by explicit operator request:" >&2
+  while IFS=$'\t' read -r resource display namespace name; do
+    echo "  ${display} ${namespace}/${name}" >&2
+    kube delete "${resource}" -n "${namespace}" "${name}" --wait=true || die "failed to delete ${display} ${namespace}/${name}"
+  done <"${tmp_dir}/legacy-wrapper-resources.tsv"
+  discover_legacy_wrapper_resources
+}
+
+report_reference_blockers() {
+  local namespace name reference gateway
+  local clean=true
+
+  if [[ -s "${tmp_dir}/live-v1-runtimes.tsv" ]]; then
+    clean=false
+    while IFS=$'\t' read -r namespace name; do
+      echo "blocked: AgentRuntime ${namespace}/${name} still declares orka.harness.v1" >&2
+    done <"${tmp_dir}/live-v1-runtimes.tsv"
+  fi
+
+  if [[ -s "${tmp_dir}/live-affected-agents.tsv" ]]; then
+    clean=false
+    while IFS=$'\t' read -r namespace name reference; do
+      echo "blocked: Agent ${namespace}/${name} still references affected AgentRuntime ${reference}" >&2
+    done <"${tmp_dir}/live-affected-agents.tsv"
+  fi
+
+  if [[ -s "${tmp_dir}/live-affected-bindings.tsv" ]]; then
+    clean=false
+    while IFS=$'\t' read -r namespace name reference gateway; do
+      echo "blocked: GatewayBinding ${namespace}/${name} still references affected Agent ${reference} and Gateway ${gateway}" >&2
+    done <"${tmp_dir}/live-affected-bindings.tsv"
+  fi
+
+  [[ "${clean}" == "true" ]]
+}
+
+report_legacy_builtin_agent_blockers() {
+  local namespace name
+  [[ -s "${tmp_dir}/live-legacy-builtin-agents.tsv" ]] || return 0
+  while IFS=$'\t' read -r namespace name; do
+    echo "blocked: Agent ${namespace}/${name} must be removed before the OpenCode CRD cutover" >&2
+    echo "  migrate: export and delete the Agent before cutover, then recreate it after the new CRD is applied with a provider-qualified model.name, reviewed positive contextWindow/maxTokens, and no providerRef, provider Secret, or Agent systemPrompt; alternatively migrate it to claude/codex/copilot or runtimeRef before retrying" >&2
+  done <"${tmp_dir}/live-legacy-builtin-agents.tsv"
+  return 1
+}
+
+report_legacy_task_blockers() {
+  local namespace name field_path
+  [[ -s "${tmp_dir}/live-legacy-task-workspaces.tsv" ]] || return 0
+  while IFS=$'\t' read -r namespace name field_path; do
+    echo "blocked: Task ${namespace}/${name} still uses legacy ${field_path}" >&2
+    echo "  migrate: export and delete the Task before cutover, then recreate it with spec.workspace.readCredentialRef after the new CRD is applied" >&2
+  done <"${tmp_dir}/live-legacy-task-workspaces.tsv"
+  return 1
+}
+
+report_wrapper_blockers() {
+  local resource display namespace name
+  [[ -s "${tmp_dir}/legacy-wrapper-resources.tsv" ]] || return 0
+  while IFS=$'\t' read -r resource display namespace name; do
+    echo "blocked: legacy harness-wrapper ${display} ${namespace}/${name} still exists" >&2
+    echo "  cleanup: kubectl --context ${context} -n ${namespace} delete ${resource} ${name} --wait=true" >&2
+  done <"${tmp_dir}/legacy-wrapper-resources.tsv"
+  return 1
+}
+
+run_cluster_preflight() {
+  local allow_cleanup="$1"
+  local clean=true
+
+  collect_cluster_state
+  build_reference_inventory
+  build_legacy_builtin_agent_inventory
+  build_legacy_task_inventory
+  verify_gateway_quiescence || clean=false
+  discover_legacy_wrapper_resources
+
+  if [[ "${allow_cleanup}" == "true" && "${delete_legacy_wrapper}" == "true" && "${clean}" == "true" ]]; then
+    delete_legacy_wrapper_resources
+  fi
+
+  report_reference_blockers || clean=false
+  report_legacy_builtin_agent_blockers || clean=false
+  report_legacy_task_blockers || clean=false
+  report_wrapper_blockers || clean=false
+  [[ "${clean}" == "true" ]]
+}
+
+validate_backups
+parse_gateway_workload_mappings
+
+if ! run_cluster_preflight true; then
+  die "hard-cutover preflight failed; no CRDs were applied"
+fi
+
+# Server-side validation catches schema/RBAC admission failures without mutation.
+kube apply --server-side --force-conflicts --dry-run=server -f "${crd_dir}" >/dev/null || die "server-side CRD dry-run failed"
+
+# Revalidate backup identity and live blockers immediately before the mutating apply.
+validate_backups
+if ! run_cluster_preflight false; then
+  die "hard-cutover state changed after dry-run; no CRDs were applied"
+fi
+validate_backups
+
+kube apply --server-side --force-conflicts -f "${crd_dir}"
+echo "ACP v2 CRD hard cutover applied to context ${context}." >&2
diff --git a/scripts/validate-release-manifest.sh b/scripts/validate-release-manifest.sh
new file mode 100755
index 000000000..3183351ed
--- /dev/null
+++ b/scripts/validate-release-manifest.sh
@@ -0,0 +1,144 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repo_root="$(cd "${script_dir}/.." && pwd)"
+# shellcheck source=scripts/lib/e2e-common.sh
+. "${script_dir}/lib/e2e-common.sh"
+release_tag="${1:-}"
+release_namespace="${RELEASE_NAMESPACE:-orka-system}"
+
+chart_field() {
+  local path="$1"
+  local field="$2"
+  local value
+  value="$(awk -v key="${field}:" '$1 == key { print $2; exit }' "${path}")"
+  value="${value#\"}"
+  value="${value%\"}"
+  value="${value#\'}"
+  value="${value%\'}"
+  [[ -n "${value}" ]] || die "could not read ${field} from ${path}"
+  printf '%s\n' "${value}"
+}
+
+image_tag() {
+  local values_path="$1"
+  local repository="$2"
+  awk -v repository="${repository}" '
+    $1 == "repository:" && $2 == repository {
+      repositories++
+      pending = 1
+      next
+    }
+    pending && $1 == "tag:" {
+      value = $2
+      gsub(/^["'"'"']|["'"'"']$/, "", value)
+      print value
+      tags++
+      pending = 0
+    }
+    END {
+      if (repositories != 1 || tags != 1) {
+        exit 1
+      }
+    }
+  ' "${values_path}"
+}
+
+for command in awk diff find grep helm sed sort wc; do
+  require_cmd "${command}"
+done
+
+cd "${repo_root}"
+if [[ -z "${release_tag}" ]]; then
+  release_tag="$(awk '$1 == "VERSION" && $2 == ":=" { print $3; exit }' Makefile)"
+fi
+[[ "${release_tag}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-(beta|rc)\.[0-9]+)?$ ]] || \
+  die "release tag must match vX.Y.Z, vX.Y.Z-beta.N, or vX.Y.Z-rc.N; got ${release_tag}"
+
+expected_version="${release_tag#v}"
+static_chart="cmd/build/helmify/static"
+staging_chart="manifest_staging/charts/orka"
+promoted_chart="charts/orka"
+
+diff --no-dereference --recursive --unified "${staging_chart}" "${promoted_chart}"
+diff --no-dereference --recursive --unified manifest_staging/deploy deploy
+
+for chart in "${static_chart}" "${staging_chart}" "${promoted_chart}"; do
+  [[ "$(chart_field "${chart}/Chart.yaml" version)" == "${expected_version}" ]] || \
+    die "${chart}/Chart.yaml version must be ${expected_version}"
+  [[ "$(chart_field "${chart}/Chart.yaml" appVersion)" == "${release_tag}" ]] || \
+    die "${chart}/Chart.yaml appVersion must be ${release_tag}"
+done
+
+values_path="${promoted_chart}/values.yaml"
+for repository in \
+  ghcr.io/orka-agents/orka \
+  ghcr.io/orka-agents/orka/workspace-publisher \
+  ghcr.io/orka-agents/orka/agent-harness-wrapper \
+  ghcr.io/orka-agents/orka/ai-worker \
+  ghcr.io/orka-agents/orka/general-worker; do
+  tag="$(image_tag "${values_path}" "${repository}")" || \
+    die "expected exactly one tag for ${repository} in ${values_path}"
+  [[ "${tag}" == "${expected_version}" ]] || \
+    die "${repository} tag must be ${expected_version}; got ${tag:-<empty>}"
+done
+
+validation_digest="sha256:$(printf '0%.0s' {1..64})"
+render_args=(
+  --namespace "${release_namespace}"
+  --set-string controller.mode=harness-v2
+  --set-string "controller.watchNamespace=${release_namespace}"
+  --set-string "controller.image.digest=${validation_digest}"
+  --set-string controller.agentExecutionSnapshot.existingSecret=release-validation-snapshot
+  --set-string controller.agentExecutionSnapshot.key=key
+  --set-string webhooks.tls.existingSecret=release-validation-webhook-tls
+  --set-string webhooks.caBundle=Y2E=
+  --set-string "publisher.image.digest=${validation_digest}"
+  --set providerProxy.enabled=true
+)
+
+for chart in "${static_chart}" "${staging_chart}" "${promoted_chart}"; do
+  helm lint "${chart}" "${render_args[@]}"
+done
+
+temp_dir="$(mktemp -d "${TMPDIR:-/tmp}/orka-release-manifest.XXXXXX")"
+cleanup() {
+  rm -rf -- "${temp_dir}"
+}
+trap cleanup EXIT
+
+rendered_chart="${temp_dir}/rendered.yaml"
+rendered_images="${temp_dir}/images.txt"
+helm template release-validation "${promoted_chart}" "${render_args[@]}" >"${rendered_chart}"
+
+grep -E '^[[:space:]]+image:[[:space:]]+' "${rendered_chart}" |
+  sed -E 's/^[[:space:]]+image:[[:space:]]+"?([^"[:space:]]+)"?.*$/\1/' |
+  sort -u >"${rendered_images}"
+
+image_count="$(wc -l <"${rendered_images}" | tr -d ' ')"
+[[ "${image_count}" == "2" ]] || \
+  die "expected exactly two unique digest-pinned controller/publisher images; found ${image_count}"
+grep -Fxq "ghcr.io/orka-agents/orka@${validation_digest}" "${rendered_images}" || \
+  die "rendered controller image is not digest-pinned"
+grep -Fxq "ghcr.io/orka-agents/orka/workspace-publisher@${validation_digest}" "${rendered_images}" || \
+  die "rendered publisher image is not digest-pinned"
+
+for worker in ai general; do
+  expected_ref="ghcr.io/orka-agents/orka/${worker}-worker:${expected_version}"
+  count="$(grep -Fc -- "--${worker}-worker-image=${expected_ref}" "${rendered_chart}" || true)"
+  [[ "${count}" == "1" ]] || \
+    die "expected exactly one rendered ${worker} worker image using ${expected_version}; found ${count}"
+done
+
+if grep -Fq 'agent-harness-wrapper' "${rendered_chart}"; then
+  die "harness-v2 release render unexpectedly contains the harness-v1 wrapper"
+fi
+
+expected_crds="$(find config/crd/bases -maxdepth 1 -type f -name '*.yaml' | wc -l | tr -d ' ')"
+rendered_crds="$(helm show crds "${promoted_chart}" | grep -c '^kind: CustomResourceDefinition$')"
+[[ "${rendered_crds}" == "${expected_crds}" ]] || \
+  die "promoted chart CRD count ${rendered_crds} does not match config/crd/bases ${expected_crds}"
+
+printf 'Validated harness-v2 release manifest contract for %s.\n' "${release_tag}"
diff --git a/test/e2e/agent_advanced_test.go b/test/e2e/agent_advanced_test.go
index 4ec9b590b..45c1c70a3 100644
--- a/test/e2e/agent_advanced_test.go
+++ b/test/e2e/agent_advanced_test.go
@@ -17,6 +17,7 @@ import (
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
 	"github.com/orka-agents/orka/test/utils"
 )
 
@@ -32,7 +33,7 @@ var _ = Describe("Agent Advanced Features", func() {
 		}
 	})
 
-	It("should include skill content metadata in the harness-wrapper turn", func() {
+	It("should reject skill-backed built-in ACP tasks before RuntimePool demand", func() {
 		skillName := prefix + "skill"
 		agentName := prefix + "skill-agent"
 		taskName := prefix + "skill-task"
@@ -73,10 +74,12 @@ var _ = Describe("Agent Advanced Features", func() {
 			},
 			"spec": {
 				"runtime": {
+					"contractVersion": "orka.harness.v2",
 					"type": "claude",
 					"defaultMaxTurns": 3,
 					"defaultAllowBash": false
 				},
+				"model": {"name": "claude-sonnet-4-20250514"},
 				"skills": [{
 					"name": "%s"
 				}]
@@ -119,13 +122,24 @@ var _ = Describe("Agent Advanced Features", func() {
 		_, err = utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred(), "Failed to create task with skill agent")
 
-		By("verifying harness-wrapper metadata is planned for the skill task")
-		verifyHarnessWrapperMetadataForTask(taskName, map[string]string{
-			"runtime":   "claude",
-			"wrapper":   "cli",
-			"maxTurns":  "1",
-			"allowBash": "false",
-		}, 2*time.Minute)
+		By("verifying unsupported skills fail before ACP queue admission")
+		Eventually(func(g Gomega) {
+			task := fetchTaskForACPAssertion(g, taskName)
+			g.Expect(task.Status.Phase).To(Equal(corev1alpha1.TaskPhaseFailed))
+			g.Expect(task.Status.Message).To(Equal(
+				"built-in ACP runtimes do not support Agent.spec.skills; refusing to omit declared skills",
+			))
+			g.Expect(task.Status.Attempts).To(BeZero())
+			g.Expect(task.Status.Execution).NotTo(BeNil())
+			g.Expect(task.Status.Execution.State).To(Equal(corev1alpha1.TaskExecutionStateFailed))
+			g.Expect(task.Status.Execution.Reason).To(Equal(corev1alpha1.TaskExecutionReason("InvalidRuntimeProfile")))
+			g.Expect(task.Status.Execution.Attempt).To(BeZero())
+			g.Expect(task.Status.Execution.PromptID).To(BeEmpty())
+			g.Expect(task.Status.Execution.RuntimePoolName).To(BeEmpty())
+			g.Expect(task.Status.Delivery).NotTo(BeNil())
+			g.Expect(task.Status.Delivery.State).To(Equal(corev1alpha1.TaskDeliveryStateNotRequested))
+			g.Expect(task.Status.Delivery.Outcome).To(Equal(corev1alpha1.TaskDeliveryOutcomeNotRequested))
+		}, 30*time.Second, time.Second).Should(Succeed())
 
 		By("verifying the Task does not use a worker Job")
 		verifyNoJobForTask(taskName, 5*time.Second)
@@ -148,10 +162,12 @@ var _ = Describe("Agent Advanced Features", func() {
 			},
 			"spec": {
 				"runtime": {
+					"contractVersion": "orka.harness.v2",
 					"type": "claude",
 					"defaultMaxTurns": 3,
 					"defaultAllowBash": false
 				},
+				"model": {"name": "claude-sonnet-4-20250514"},
 				"resources": {
 					"requests": {"memory": "128Mi", "cpu": "100m"},
 					"limits": {"memory": "256Mi", "cpu": "200m"}
diff --git a/test/e2e/agent_claude_test.go b/test/e2e/agent_claude_test.go
index fd278f623..689bfd9e6 100644
--- a/test/e2e/agent_claude_test.go
+++ b/test/e2e/agent_claude_test.go
@@ -20,202 +20,68 @@ import (
 	"github.com/orka-agents/orka/test/utils"
 )
 
-var _ = Describe("Agent Claude Runtime", Ordered, func() {
+var _ = Describe("Agent Claude ACP Runtime", Ordered, func() {
 	const (
-		taskName   = "e2e-claude-task"
-		agentName  = "e2e-claude-agent"
-		secretName = "e2e-claude-secret"
+		taskName  = "e2e-claude-task"
+		agentName = "e2e-claude-agent"
 	)
 
 	AfterAll(func() {
-		By("cleaning up claude agent test resources")
 		cmd := exec.Command("kubectl", "delete", "task", taskName, "-n", namespace, "--ignore-not-found")
 		_, _ = utils.Run(cmd)
-
 		cmd = exec.Command("kubectl", "delete", "agent", agentName, "-n", namespace, "--ignore-not-found")
 		_, _ = utils.Run(cmd)
-
-		cmd = exec.Command("kubectl", "delete", "secret", secretName, "-n", namespace, "--ignore-not-found")
-		_, _ = utils.Run(cmd)
-
-		// Results are stored in SQLite — no ConfigMap cleanup needed
 	})
 
 	AfterEach(func() {
-		dumpDebugInfo(taskName, "e2e-claude-real-task")
+		dumpDebugInfo(taskName)
 	})
 
-	It("should start a harness-wrapper turn with Claude runtime configuration", func() {
-		By("creating a Secret with ANTHROPIC_API_KEY")
-		secretManifest := fmt.Sprintf(`{
-			"apiVersion": "v1",
-			"kind": "Secret",
-			"metadata": {
-				"name": "%s",
-				"namespace": "%s"
-			},
-			"type": "Opaque",
-			"stringData": {
-				"ANTHROPIC_API_KEY": "placeholder-key-for-e2e"
-			}
-		}`, secretName, namespace)
-
-		cmd := exec.Command("kubectl", "apply", "-f", "-")
-		cmd.Stdin = stringReader(secretManifest)
-		_, err := utils.Run(cmd)
-		Expect(err).NotTo(HaveOccurred(), "Failed to create Secret")
-
-		By("creating an Agent with runtime.type: claude")
+	It("queues a Claude task on an ACP v2 RuntimePool without provider credentials in the Agent", func() {
 		agentManifest := fmt.Sprintf(`{
 			"apiVersion": "core.orka.ai/v1alpha1",
 			"kind": "Agent",
-			"metadata": {
-				"name": "%s",
-				"namespace": "%s"
-			},
+			"metadata": {"name": %q, "namespace": %q},
 			"spec": {
 				"runtime": {
+					"contractVersion": "orka.harness.v2",
 					"type": "claude",
 					"defaultMaxTurns": 5,
 					"defaultAllowBash": false
 				},
-				"secretRef": {
-					"name": "%s"
-				}
+				"model": {"name": "claude-sonnet-4-20250514"}
 			}
-		}`, agentName, namespace, secretName)
-
-		cmd = exec.Command("kubectl", "apply", "-f", "-")
+		}`, agentName, namespace)
+		cmd := exec.Command("kubectl", "apply", "-f", "-")
 		cmd.Stdin = stringReader(agentManifest)
-		_, err = utils.Run(cmd)
+		_, err := utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred(), "Failed to create Agent")
 
-		By("creating a Task with type agent referencing the Claude Agent")
 		taskManifest := fmt.Sprintf(`{
 			"apiVersion": "core.orka.ai/v1alpha1",
 			"kind": "Task",
-			"metadata": {
-				"name": "%s",
-				"namespace": "%s"
-			},
+			"metadata": {"name": %q, "namespace": %q},
 			"spec": {
 				"type": "agent",
-				"prompt": "say hello",
-				"agentRef": {
-					"name": "%s"
-				},
-				"agentRuntime": {
-					"maxTurns": 3
-				}
+				"prompt": "Read the workspace and report a concise result.",
+				"agentRef": {"name": %q},
+				"agentRuntime": {"maxTurns": 3},
+				"workspace": {"intent": "read"}
 			}
 		}`, taskName, namespace, agentName)
-
 		cmd = exec.Command("kubectl", "apply", "-f", "-")
 		cmd.Stdin = stringReader(taskManifest)
 		_, err = utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred(), "Failed to create Task")
 
-		By("verifying harness-wrapper metadata is planned for the claude agent task")
-		verifyHarnessWrapperMetadataForTask(taskName, map[string]string{
-			"runtime":   "claude",
-			"wrapper":   "cli",
-			"maxTurns":  "3",
-			"allowBash": "false",
+		verifyACPTaskRuntimeForTask(taskName, acpTaskExpectation{
+			ProviderKind:    "claude",
+			Model:           "claude-sonnet-4-20250514",
+			WorkspaceIntent: "read",
+			MaxTurns:        acpInt32(3),
+			AllowBash:       acpBool(false),
+			Workspace:       &acpWorkspaceExpectation{Intent: "read"},
 		}, 2*time.Minute)
-
-		By("verifying the Task does not use a worker Job")
 		verifyNoJobForTask(taskName, 5*time.Second)
-
-		By("verifying the Task reaches a terminal status")
-		verifyTaskTerminal := func(g Gomega) {
-			cmd := exec.Command("kubectl", "get", "task", taskName,
-				"-o", "jsonpath={.status.phase}",
-				"-n", namespace,
-			)
-			output, err := utils.Run(cmd)
-			g.Expect(err).NotTo(HaveOccurred())
-			g.Expect(output).To(BeElementOf("Running", "Succeeded", "Failed"),
-				"Task should transition from Pending")
-		}
-		Eventually(verifyTaskTerminal, 2*time.Minute, time.Second).Should(Succeed())
-	})
-
-	It("should complete a Claude agent task with real API key", func() {
-		skipIfNoKey("E2E_ANTHROPIC_API_KEY")
-
-		const (
-			realTaskName  = "e2e-claude-real-task"
-			realAgentName = "e2e-claude-real-agent"
-		)
-
-		DeferCleanup(func() {
-			cmd := exec.Command("kubectl", "delete", "task", realTaskName, "-n", namespace, "--ignore-not-found")
-			_, _ = utils.Run(cmd)
-			cmd = exec.Command("kubectl", "delete", "agent", realAgentName, "-n", namespace, "--ignore-not-found")
-			_, _ = utils.Run(cmd)
-		})
-
-		By("creating an Agent with real Anthropic secret")
-		agentManifest := fmt.Sprintf(`{
-			"apiVersion": "core.orka.ai/v1alpha1",
-			"kind": "Agent",
-			"metadata": {
-				"name": "%s",
-				"namespace": "%s"
-			},
-			"spec": {
-				"runtime": {
-					"type": "claude",
-					"defaultMaxTurns": 3,
-					"defaultAllowBash": false
-				},
-				"secretRef": {
-					"name": "e2e-anthropic-secret"
-				}
-			}
-		}`, realAgentName, namespace)
-
-		cmd := exec.Command("kubectl", "apply", "-f", "-")
-		cmd.Stdin = stringReader(agentManifest)
-		_, err := utils.Run(cmd)
-		Expect(err).NotTo(HaveOccurred(), "Failed to create Agent with real key")
-
-		By("creating a Task with simple prompt")
-		taskManifest := fmt.Sprintf(`{
-			"apiVersion": "core.orka.ai/v1alpha1",
-			"kind": "Task",
-			"metadata": {
-				"name": "%s",
-				"namespace": "%s"
-			},
-			"spec": {
-				"type": "agent",
-				"prompt": "What is 2+2? Reply with just the number.",
-				"agentRef": {
-					"name": "%s"
-				},
-				"agentRuntime": {
-					"maxTurns": 3
-				}
-			}
-		}`, realTaskName, namespace, realAgentName)
-
-		cmd = exec.Command("kubectl", "apply", "-f", "-")
-		cmd.Stdin = stringReader(taskManifest)
-		_, err = utils.Run(cmd)
-		Expect(err).NotTo(HaveOccurred(), "Failed to create Task with real key")
-
-		By("waiting for the task to complete (up to 5 minutes)")
-		phase := waitForTaskCompletion(realTaskName, 5*time.Minute)
-		Expect(phase).To(Equal("Succeeded"), "Claude agent task should succeed with real API key")
-
-		By("verifying the real claude task used the harness wrapper")
-		verifyHarnessWrapperMetadataForTask(realTaskName, map[string]string{
-			"runtime": "claude",
-			"wrapper": "cli",
-		}, 30*time.Second)
-
-		By("verifying the result is available")
-		verifyResultAvailable(realTaskName)
 	})
 })
diff --git a/test/e2e/agent_copilot_test.go b/test/e2e/agent_copilot_test.go
index d470ca6df..dc76387fe 100644
--- a/test/e2e/agent_copilot_test.go
+++ b/test/e2e/agent_copilot_test.go
@@ -20,200 +20,69 @@ import (
 	"github.com/orka-agents/orka/test/utils"
 )
 
-var _ = Describe("Agent Copilot Runtime", Ordered, func() {
+var _ = Describe("Agent Copilot ACP Runtime", Ordered, func() {
 	const (
-		taskName   = "e2e-copilot-task"
-		agentName  = "e2e-copilot-agent"
-		secretName = "e2e-copilot-secret"
+		taskName  = "e2e-copilot-task"
+		agentName = "e2e-copilot-agent"
 	)
 
 	AfterAll(func() {
-		By("cleaning up copilot agent test resources")
 		cmd := exec.Command("kubectl", "delete", "task", taskName, "-n", namespace, "--ignore-not-found")
 		_, _ = utils.Run(cmd)
-
 		cmd = exec.Command("kubectl", "delete", "agent", agentName, "-n", namespace, "--ignore-not-found")
 		_, _ = utils.Run(cmd)
-
-		cmd = exec.Command("kubectl", "delete", "secret", secretName, "-n", namespace, "--ignore-not-found")
-		_, _ = utils.Run(cmd)
-
-		// Results are stored in SQLite — no ConfigMap cleanup needed
 	})
 
 	AfterEach(func() {
-		dumpDebugInfo(taskName, "e2e-copilot-real-task")
+		dumpDebugInfo(taskName)
 	})
 
-	It("should start a harness-wrapper turn with Copilot runtime configuration", func() {
-		By("creating a Secret with GITHUB_TOKEN")
-		secretManifest := fmt.Sprintf(`{
-			"apiVersion": "v1",
-			"kind": "Secret",
-			"metadata": {
-				"name": "%s",
-				"namespace": "%s"
-			},
-			"type": "Opaque",
-			"stringData": {
-				"GITHUB_TOKEN": "placeholder-token-for-e2e"
-			}
-		}`, secretName, namespace)
-
-		cmd := exec.Command("kubectl", "apply", "-f", "-")
-		cmd.Stdin = stringReader(secretManifest)
-		_, err := utils.Run(cmd)
-		Expect(err).NotTo(HaveOccurred(), "Failed to create Secret")
-
-		By("creating an Agent with runtime.type: copilot")
+	It("queues a Copilot task on the configured immutable ACP RuntimePool image", func() {
 		agentManifest := fmt.Sprintf(`{
 			"apiVersion": "core.orka.ai/v1alpha1",
 			"kind": "Agent",
-			"metadata": {
-				"name": "%s",
-				"namespace": "%s"
-			},
+			"metadata": {"name": %q, "namespace": %q},
 			"spec": {
 				"runtime": {
+					"contractVersion": "orka.harness.v2",
 					"type": "copilot",
 					"defaultMaxTurns": 10,
 					"defaultAllowBash": true
 				},
-				"secretRef": {
-					"name": "%s"
-				}
+				"model": {"name": "gpt-5.3-codex"}
 			}
-		}`, agentName, namespace, secretName)
-
-		cmd = exec.Command("kubectl", "apply", "-f", "-")
+		}`, agentName, namespace)
+		cmd := exec.Command("kubectl", "apply", "-f", "-")
 		cmd.Stdin = stringReader(agentManifest)
-		_, err = utils.Run(cmd)
+		_, err := utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred(), "Failed to create Agent")
 
-		By("creating a Task with type agent referencing the Copilot Agent")
 		taskManifest := fmt.Sprintf(`{
 			"apiVersion": "core.orka.ai/v1alpha1",
 			"kind": "Task",
-			"metadata": {
-				"name": "%s",
-				"namespace": "%s"
-			},
+			"metadata": {"name": %q, "namespace": %q},
 			"spec": {
 				"type": "agent",
-				"prompt": "list files in current directory",
-				"agentRef": {
-					"name": "%s"
-				},
-				"agentRuntime": {
-					"maxTurns": 5
-				}
+				"prompt": "List files without modifying the workspace.",
+				"agentRef": {"name": %q},
+				"agentRuntime": {"maxTurns": 5},
+				"workspace": {"intent": "read"}
 			}
 		}`, taskName, namespace, agentName)
-
 		cmd = exec.Command("kubectl", "apply", "-f", "-")
 		cmd.Stdin = stringReader(taskManifest)
 		_, err = utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred(), "Failed to create Task")
 
-		By("verifying harness-wrapper metadata is planned for the copilot agent task")
-		verifyHarnessWrapperMetadataForTask(taskName, map[string]string{
-			"runtime":   "copilot",
-			"wrapper":   "cli",
-			"maxTurns":  "5",
-			"allowBash": "true",
+		verifyACPTaskRuntimeForTask(taskName, acpTaskExpectation{
+			ProviderKind:    "copilot",
+			Model:           "gpt-5.3-codex",
+			WorkspaceIntent: "read",
+			RuntimeImage:    acpCopilotRuntimeRef,
+			MaxTurns:        acpInt32(5),
+			AllowBash:       acpBool(true),
+			Workspace:       &acpWorkspaceExpectation{Intent: "read"},
 		}, 2*time.Minute)
-
-		By("verifying the Task does not use a worker Job")
 		verifyNoJobForTask(taskName, 5*time.Second)
-
-		By("verifying the Task reaches a terminal status")
-		verifyTaskTerminal := func(g Gomega) {
-			cmd := exec.Command("kubectl", "get", "task", taskName,
-				"-o", "jsonpath={.status.phase}",
-				"-n", namespace,
-			)
-			output, err := utils.Run(cmd)
-			g.Expect(err).NotTo(HaveOccurred())
-			g.Expect(output).To(BeElementOf("Running", "Succeeded", "Failed"),
-				"Task should transition from Pending")
-		}
-		Eventually(verifyTaskTerminal, 2*time.Minute, time.Second).Should(Succeed())
-	})
-
-	It("should complete a Copilot agent task with real GitHub token", func() {
-		skipIfNoKey("E2E_GITHUB_TOKEN")
-
-		const (
-			realTaskName  = "e2e-copilot-real-task"
-			realAgentName = "e2e-copilot-real-agent"
-		)
-
-		DeferCleanup(func() {
-			cmd := exec.Command("kubectl", "delete", "task", realTaskName, "-n", namespace, "--ignore-not-found")
-			_, _ = utils.Run(cmd)
-			cmd = exec.Command("kubectl", "delete", "agent", realAgentName, "-n", namespace, "--ignore-not-found")
-			_, _ = utils.Run(cmd)
-		})
-
-		By("creating an Agent with real GitHub secret")
-		agentManifest := fmt.Sprintf(`{
-			"apiVersion": "core.orka.ai/v1alpha1",
-			"kind": "Agent",
-			"metadata": {
-				"name": "%s",
-				"namespace": "%s"
-			},
-			"spec": {
-				"runtime": {
-					"type": "copilot",
-					"defaultMaxTurns": 5,
-					"defaultAllowBash": true
-				},
-				"secretRef": {
-					"name": "e2e-github-secret"
-				}
-			}
-		}`, realAgentName, namespace)
-
-		cmd := exec.Command("kubectl", "apply", "-f", "-")
-		cmd.Stdin = stringReader(agentManifest)
-		_, err := utils.Run(cmd)
-		Expect(err).NotTo(HaveOccurred(), "Failed to create Agent with real GitHub token")
-
-		By("creating a Task with simple prompt")
-		taskManifest := fmt.Sprintf(`{
-			"apiVersion": "core.orka.ai/v1alpha1",
-			"kind": "Task",
-			"metadata": {
-				"name": "%s",
-				"namespace": "%s"
-			},
-			"spec": {
-				"type": "agent",
-				"prompt": "What is 2+2? Reply with just the number.",
-				"agentRef": {
-					"name": "%s"
-				},
-				"agentRuntime": {
-					"maxTurns": 3
-				}
-			}
-		}`, realTaskName, namespace, realAgentName)
-
-		cmd = exec.Command("kubectl", "apply", "-f", "-")
-		cmd.Stdin = stringReader(taskManifest)
-		_, err = utils.Run(cmd)
-		Expect(err).NotTo(HaveOccurred(), "Failed to create Task with real GitHub token")
-
-		By("waiting for the task to reach terminal phase (up to 5 minutes)")
-		phase := waitForTaskCompletion(realTaskName, 5*time.Minute)
-		Expect(phase).To(BeElementOf("Succeeded", "Failed"),
-			"Copilot agent task should reach terminal phase")
-
-		By("verifying the real copilot task used the harness wrapper")
-		verifyHarnessWrapperMetadataForTask(realTaskName, map[string]string{
-			"runtime": "copilot",
-			"wrapper": "cli",
-		}, 30*time.Second)
 	})
 })
diff --git a/test/e2e/agent_session_test.go b/test/e2e/agent_session_test.go
index ac0292504..57f152787 100644
--- a/test/e2e/agent_session_test.go
+++ b/test/e2e/agent_session_test.go
@@ -57,10 +57,12 @@ var _ = Describe("Agent Session Continuity", Ordered, func() {
 			},
 			"spec": {
 				"runtime": {
+					"contractVersion": "orka.harness.v2",
 					"type": "claude",
 					"defaultMaxTurns": 5,
 					"defaultAllowBash": false
-				}
+				},
+				"model": {"name": "claude-sonnet-4-20250514"}
 			}
 		}`, agentName, namespace)
 
@@ -99,26 +101,30 @@ var _ = Describe("Agent Session Continuity", Ordered, func() {
 		_, err = utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred(), "Failed to create first Task")
 
-		By("verifying harness-wrapper metadata is planned for the first session task")
-		verifyHarnessWrapperMetadataForTask(taskName1, map[string]string{
-			"runtime":   "claude",
-			"wrapper":   "cli",
-			"maxTurns":  "3",
-			"allowBash": "false",
+		By("verifying the first task is queued on an ACP v2 RuntimePool")
+		verifyACPTaskRuntimeForTask(taskName1, acpTaskExpectation{
+			ProviderKind:    "claude",
+			WorkspaceIntent: "read",
+			MaxTurns:        acpInt32(3),
+			AllowBash:       acpBool(false),
+			SessionName:     sessionID,
 		}, 2*time.Minute)
 
-		By("verifying the runtime session identity includes the shared session")
+		By("waiting for the first task to settle so the shared Session lease is available")
+		_ = waitForTaskCompletion(taskName1, 5*time.Minute)
+
+		var firstRuntimeSessionUID string
 		Eventually(func(g Gomega) {
 			cmd := exec.Command("kubectl", "get", "task", taskName1,
-				"-o", "jsonpath={.metadata.annotations.orka\\.ai/harness-wrapper-runtime-session-id}",
+				"-o", "jsonpath={.status.execution.runtimeSessionUID}",
 				"-n", namespace,
 			)
 			output, err := utils.Run(cmd)
 			g.Expect(err).NotTo(HaveOccurred())
-			g.Expect(output).To(ContainSubstring(sessionID))
-		}, 30*time.Second, time.Second).Should(Succeed())
+			g.Expect(output).NotTo(BeEmpty())
+			firstRuntimeSessionUID = output
+		}, 2*time.Minute, time.Second).Should(Succeed())
 
-		By("creating the second Task with the same sessionID")
 		By("creating the second Task with the same sessionID")
 		task2Manifest := fmt.Sprintf(`{
 			"apiVersion": "core.orka.ai/v1alpha1",
@@ -149,16 +155,22 @@ var _ = Describe("Agent Session Continuity", Ordered, func() {
 		_, err = utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred(), "Failed to create second Task")
 
-		By("verifying the second Task was accepted and references the same session")
-		verifyTask2Accepted := func(g Gomega) {
+		By("verifying the second Task reuses the ACP RuntimeSession identity")
+		verifyACPTaskRuntimeForTask(taskName2, acpTaskExpectation{
+			ProviderKind:    "claude",
+			WorkspaceIntent: "read",
+			MaxTurns:        acpInt32(3),
+			AllowBash:       acpBool(false),
+			SessionName:     sessionID,
+		}, 2*time.Minute)
+		Eventually(func(g Gomega) {
 			cmd := exec.Command("kubectl", "get", "task", taskName2,
-				"-o", "jsonpath={.spec.sessionRef.name}",
+				"-o", "jsonpath={.status.execution.runtimeSessionUID}",
 				"-n", namespace,
 			)
 			output, err := utils.Run(cmd)
 			g.Expect(err).NotTo(HaveOccurred())
-			g.Expect(output).To(Equal(sessionID), "Second task should reference the same session")
-		}
-		Eventually(verifyTask2Accepted, 30*time.Second, time.Second).Should(Succeed())
+			g.Expect(output).To(Equal(firstRuntimeSessionUID))
+		}, 5*time.Minute, time.Second).Should(Succeed())
 	})
 })
diff --git a/test/e2e/agent_test.go b/test/e2e/agent_test.go
index 60ceec3ef..ceb68568c 100644
--- a/test/e2e/agent_test.go
+++ b/test/e2e/agent_test.go
@@ -44,7 +44,7 @@ var _ = Describe("Agent Task", Ordered, func() {
 		dumpDebugInfo(taskName)
 	})
 
-	It("should start a harness-wrapper turn for an agent-type task", func() {
+	It("should queue an agent task on an ACP v2 RuntimePool", func() {
 		By("creating an Agent CRD with claude runtime")
 		agentManifest := fmt.Sprintf(`{
 			"apiVersion": "core.orka.ai/v1alpha1",
@@ -55,10 +55,12 @@ var _ = Describe("Agent Task", Ordered, func() {
 			},
 			"spec": {
 				"runtime": {
+					"contractVersion": "orka.harness.v2",
 					"type": "claude",
 					"defaultMaxTurns": 5,
 					"defaultAllowBash": false
-				}
+				},
+				"model": {"name": "claude-sonnet-4-20250514"}
 			}
 		}`, agentName, namespace)
 
@@ -92,12 +94,12 @@ var _ = Describe("Agent Task", Ordered, func() {
 		_, err = utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred(), "Failed to create agent Task")
 
-		By("verifying harness-wrapper metadata is planned for the agent task")
-		verifyHarnessWrapperMetadataForTask(taskName, map[string]string{
-			"runtime":   "claude",
-			"wrapper":   "cli",
-			"maxTurns":  "3",
-			"allowBash": "false",
+		By("verifying ACP v2 execution and RuntimePool status")
+		verifyACPTaskRuntimeForTask(taskName, acpTaskExpectation{
+			ProviderKind:    "claude",
+			WorkspaceIntent: "read",
+			MaxTurns:        acpInt32(3),
+			AllowBash:       acpBool(false),
 		}, 2*time.Minute)
 
 		By("verifying the Task status transitions from Pending")
diff --git a/test/e2e/agent_ttl_test.go b/test/e2e/agent_ttl_test.go
index 542870acb..2e4704070 100644
--- a/test/e2e/agent_ttl_test.go
+++ b/test/e2e/agent_ttl_test.go
@@ -48,9 +48,11 @@ var _ = Describe("Agent TTL Auto-Deletion", func() {
 			},
 			"spec": {
 				"runtime": {
+					"contractVersion": "orka.harness.v2",
 					"type": "claude",
 					"defaultMaxTurns": 1
 				},
+				"model": {"name": "claude-sonnet-4-20250514"},
 				"ttlAfterLastTask": "30s"
 			}
 		}`, agentName, namespace)
diff --git a/test/e2e/agent_workspace_test.go b/test/e2e/agent_workspace_test.go
index c11199c41..e8e84a166 100644
--- a/test/e2e/agent_workspace_test.go
+++ b/test/e2e/agent_workspace_test.go
@@ -52,10 +52,12 @@ var _ = Describe("Agent Workspace", Ordered, func() {
 			},
 			"spec": {
 				"runtime": {
+					"contractVersion": "orka.harness.v2",
 					"type": "claude",
 					"defaultMaxTurns": 5,
 					"defaultAllowBash": false
-				}
+				},
+				"model": {"name": "claude-sonnet-4-20250514"}
 			}
 		}`, agentName, namespace)
 
@@ -79,11 +81,12 @@ var _ = Describe("Agent Workspace", Ordered, func() {
 					"name": "%s"
 				},
 				"agentRuntime": {
-					"maxTurns": 3,
-					"workspace": {
-						"gitRepo": "https://github.com/example/repo",
-						"branch": "main"
-					}
+					"maxTurns": 3
+				},
+				"workspace": {
+					"intent": "read",
+					"gitRepo": "https://github.com/example/repo",
+					"branch": "main"
 				}
 			}
 		}`, taskName, namespace, agentName)
@@ -93,14 +96,10 @@ var _ = Describe("Agent Workspace", Ordered, func() {
 		_, err = utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred(), "Failed to create Task with workspace config")
 
-		By("verifying harness-wrapper workspace metadata")
-		verifyHarnessWrapperMetadataForTask(taskName, map[string]string{
-			"runtime":   "claude",
-			"wrapper":   "cli",
-			"gitRepo":   "https://github.com/example/repo",
-			"gitBranch": "main",
-			"maxTurns":  "3",
-			"allowBash": "false",
+		By("verifying the read workspace is represented by ACP v2 execution and delivery status")
+		verifyACPTaskRuntimeForTask(taskName, acpTaskExpectation{
+			ProviderKind:    "claude",
+			WorkspaceIntent: "read",
 		}, 2*time.Minute)
 
 		By("verifying the Task does not use a worker Job")
diff --git a/test/e2e/agentruntime_brokered_external_test.go b/test/e2e/agentruntime_brokered_external_test.go
index 70cd70f62..e9855f823 100644
--- a/test/e2e/agentruntime_brokered_external_test.go
+++ b/test/e2e/agentruntime_brokered_external_test.go
@@ -20,213 +20,65 @@ import (
 	"github.com/orka-agents/orka/test/utils"
 )
 
-var _ = Describe("AgentRuntime brokered external endpoint", Ordered, func() {
+var _ = Describe("AgentRuntime v2 broker boundary", func() {
 	const (
-		runtimeName        = "agentruntime-brokered-e2e"
-		authValue          = "test"
-		authRefName        = runtimeName + "-auth-ref"
-		deploymentName     = runtimeName
-		serviceName        = runtimeName
-		agentName          = runtimeName + "-agent"
-		taskName           = runtimeName + "-task"
-		toolName           = "e2e-read-incident"
-		harnessServicePort = 8080
+		agentName = "e2e-external-broker-agent"
+		taskName  = "e2e-external-broker-task"
 	)
 
-	BeforeAll(func() {
-		if !agentRuntimeExternalE2EEnabled() {
-			Skip(fmt.Sprintf("Skipping AgentRuntime brokered external endpoint E2E: %s is not enabled", agentRuntimeExternalE2EEnvVar))
-		}
-	})
-
-	AfterAll(func() {
-		for _, resource := range []struct {
-			kind string
-			name string
-		}{
+	AfterEach(func() {
+		for _, resource := range []struct{ kind, name string }{
 			{"task", taskName},
 			{"agent", agentName},
-			{"tool", toolName},
-			{"agentruntime", runtimeName},
-			{"service", serviceName},
-			{"deployment", deploymentName},
-			{"secret", authRefName},
+			{"agentruntime", externalV2RuntimeName},
 		} {
-			cmd := exec.Command("kubectl", "delete", resource.kind, resource.name, "-n", namespace, "--ignore-not-found")
+			cmd := exec.Command("kubectl", "delete", resource.kind, resource.name,
+				"-n", namespace, "--ignore-not-found")
 			_, _ = utils.Run(cmd)
 		}
 	})
 
-	AfterEach(func() {
-		if CurrentSpecReport().Failed() {
-			dumpAgentRuntimeExternalDiagnostics(runtimeName)
-		}
-	})
-
-	It("runs a brokered read tool through a brokered-only generic HTTP AgentRuntime", func() {
-		endpoint := fmt.Sprintf("http://%s.%s.svc.cluster.local:%d", serviceName, namespace, harnessServicePort)
-		Expect(applyManifestJSON(agentRuntimeExternalGoodSecret(authRefName, runtimeName, endpoint, authValue))).To(Succeed())
-		Expect(applyManifestJSON(agentRuntimeBrokeredHarnessDeployment(deploymentName, serviceName, authValue, toolName))).To(Succeed())
+	It("rejects strict read tasks before any external v2 tool or prompt dispatch", func() {
+		runtimeManifest, manifestErr := externalV2RuntimeManifest()
+		Expect(manifestErr).NotTo(HaveOccurred())
+		Expect(applyManifestJSON(runtimeManifest)).To(Succeed())
 
-		cmd := exec.Command("kubectl", "rollout", "status", "deployment/"+deploymentName, "-n", namespace, "--timeout=2m")
+		agentManifest := fmt.Sprintf(`{
+			"apiVersion": "core.orka.ai/v1alpha1",
+			"kind": "Agent",
+			"metadata": {"name": %q, "namespace": %q},
+			"spec": {"runtime": {"runtimeRef": {"name": %q}}}
+		}`, agentName, namespace, externalV2RuntimeName)
+		cmd := exec.Command("kubectl", "apply", "-f", "-")
+		cmd.Stdin = stringReader(agentManifest)
 		_, err := utils.Run(cmd)
-		Expect(err).NotTo(HaveOccurred(), "brokered mock harness deployment should become ready")
+		Expect(err).NotTo(HaveOccurred())
 
-		Expect(applyManifestJSON(agentRuntimeBrokeredRuntime(runtimeName, endpoint, authRefName))).To(Succeed())
-		waitForAgentRuntimeReady(runtimeName, true, 2*time.Minute)
-		Expect(applyManifestJSON(agentRuntimeBrokeredReadTool(toolName, endpoint+"/lookup"))).To(Succeed())
-		Expect(applyManifestJSON(map[string]any{
+		taskManifest := fmt.Sprintf(`{
 			"apiVersion": "core.orka.ai/v1alpha1",
-			"kind":       "Agent",
-			"metadata": map[string]any{
-				"name":      agentName,
-				"namespace": namespace,
-			},
-			"spec": map[string]any{
-				"runtime": map[string]any{
-					"runtimeRef": map[string]any{"name": runtimeName},
-				},
-				"systemPrompt": map[string]any{
-					"inline": "Use brokered Orka tools for evidence gathering.",
-				},
-			},
-		})).To(Succeed())
-		Expect(applyManifestJSON(map[string]any{
-			"apiVersion": "core.orka.ai/v1alpha1",
-			"kind":       "Task",
-			"metadata": map[string]any{
-				"name":      taskName,
-				"namespace": namespace,
-			},
-			"spec": map[string]any{
-				"type":     "agent",
-				"agentRef": map[string]any{"name": agentName},
-				"agentRuntime": map[string]any{
-					"allowedTools": []any{toolName},
-				},
-				"prompt": "Investigate Quincy North using brokered read evidence.",
-			},
-		})).To(Succeed())
-
-		waitForTaskPhase(taskName, "Succeeded", 2*time.Minute)
+			"kind": "Task",
+			"metadata": {"name": %q, "namespace": %q},
+			"spec": {
+				"type": "agent",
+				"agentRef": {"name": %q},
+				"agentRuntime": {"allowedTools": ["read-evidence"]},
+				"prompt": "Read evidence through the Orka broker.",
+				"workspace": {"intent": "read"}
+			}
+		}`, taskName, namespace, agentName)
+		cmd = exec.Command("kubectl", "apply", "-f", "-")
+		cmd.Stdin = stringReader(taskManifest)
+		_, err = utils.Run(cmd)
+		Expect(err).NotTo(HaveOccurred())
+
+		Eventually(func(g Gomega) {
+			cmd := exec.Command("kubectl", "get", "task", taskName, "-n", namespace,
+				"-o", "jsonpath={.status.message}")
+			output, err := utils.Run(cmd)
+			g.Expect(err).NotTo(HaveOccurred())
+			g.Expect(output).To(ContainSubstring(fmt.Sprintf("external AgentRuntime %q Task dispatch is not supported", externalV2RuntimeName)))
+		}, 2*time.Minute, time.Second).Should(Succeed())
+		waitForTaskPhase(taskName, "Failed", 2*time.Minute)
 		verifyNoJobForTask(taskName, 5*time.Second)
-		verifyResultAvailable(taskName)
-		assertTaskHarnessRuntimeStatus(taskName, runtimeName, endpoint, authRefName)
 	})
 })
-
-func agentRuntimeBrokeredHarnessDeployment(deploymentName, serviceName, authValue, readToolName string) map[string]any {
-	labels := map[string]any{"app.kubernetes.io/name": deploymentName}
-	return map[string]any{
-		"apiVersion": "v1",
-		"kind":       "List",
-		"items": []any{
-			map[string]any{
-				"apiVersion": "apps/v1",
-				"kind":       "Deployment",
-				"metadata": map[string]any{
-					"name":      deploymentName,
-					"namespace": namespace,
-					"labels":    labels,
-				},
-				"spec": map[string]any{
-					"replicas": 1,
-					"selector": map[string]any{"matchLabels": labels},
-					"template": map[string]any{
-						"metadata": map[string]any{"labels": labels},
-						"spec": map[string]any{
-							"securityContext": map[string]any{
-								"runAsNonRoot": true,
-								"runAsUser":    65532,
-								"runAsGroup":   65532,
-								"seccompProfile": map[string]any{
-									"type": "RuntimeDefault",
-								},
-							},
-							"containers": []any{
-								map[string]any{
-									"name":            "harness",
-									"image":           agentRuntimeExternalHarnessImage,
-									"imagePullPolicy": "IfNotPresent",
-									"env": []any{
-										map[string]any{"name": "ORKA_REMOTE_HTTP_RUNTIME_ADDR", "value": ":8080"},
-										map[string]any{"name": "ORKA_REMOTE_HTTP_RUNTIME_NAME", "value": deploymentName},
-										map[string]any{"name": "ORKA_REMOTE_HTTP_RUNTIME_BEARER_TOKEN", "value": authValue},
-										map[string]any{"name": "ORKA_REMOTE_HTTP_RUNTIME_BEHAVIOR", "value": "read-tool"},
-										map[string]any{"name": "ORKA_REMOTE_HTTP_RUNTIME_BROKERED_ONLY", "value": "true"},
-										map[string]any{"name": "ORKA_REMOTE_HTTP_RUNTIME_READ_TOOL_NAME", "value": readToolName},
-									},
-									"ports": []any{map[string]any{"name": "http", "containerPort": 8080}},
-									"securityContext": map[string]any{
-										"allowPrivilegeEscalation": false,
-										"readOnlyRootFilesystem":   true,
-										"capabilities": map[string]any{
-											"drop": []any{"ALL"},
-										},
-									},
-									"readinessProbe": map[string]any{
-										"httpGet":       map[string]any{"path": "/v1/health", "port": "http"},
-										"periodSeconds": 2,
-									},
-								},
-							},
-						},
-					},
-				},
-			},
-			map[string]any{
-				"apiVersion": "v1",
-				"kind":       "Service",
-				"metadata": map[string]any{
-					"name":      serviceName,
-					"namespace": namespace,
-				},
-				"spec": map[string]any{
-					"selector": labels,
-					"ports": []any{map[string]any{
-						"name":       "http",
-						"port":       8080,
-						"targetPort": "http",
-					}},
-				},
-			},
-		},
-	}
-}
-
-func agentRuntimeBrokeredRuntime(name, endpoint, authRefName string) map[string]any {
-	runtime := agentRuntimeExternalRuntime(name, endpoint, authRefName)
-	spec := runtime["spec"].(map[string]any)
-	spec["capabilities"] = map[string]any{
-		"toolExecutionModes":      []any{"brokered"},
-		"brokeredToolClasses":     []any{"read"},
-		"supportsRuntimeSessions": true,
-		"supportsContinuation":    true,
-	}
-	return runtime
-}
-
-func agentRuntimeBrokeredReadTool(name, url string) map[string]any {
-	return map[string]any{
-		"apiVersion": "core.orka.ai/v1alpha1",
-		"kind":       "Tool",
-		"metadata": map[string]any{
-			"name":      name,
-			"namespace": namespace,
-		},
-		"spec": map[string]any{
-			"description":       "Read sanitized incident evidence through an Orka-brokered tool.",
-			"brokeredToolClass": "read",
-			"parameters": map[string]any{
-				"type": "object",
-				"properties": map[string]any{
-					"incident": map[string]any{"type": "string"},
-				},
-			},
-			"http": map[string]any{
-				"url":    url,
-				"method": "POST",
-			},
-		},
-	}
-}
diff --git a/test/e2e/agentruntime_external_test.go b/test/e2e/agentruntime_external_test.go
index d10e237a5..b5f794a30 100644
--- a/test/e2e/agentruntime_external_test.go
+++ b/test/e2e/agentruntime_external_test.go
@@ -10,10 +10,8 @@ MIT License - see LICENSE file for details.
 package e2e
 
 import (
-	"encoding/json"
 	"fmt"
 	"os/exec"
-	"strings"
 	"time"
 
 	. "github.com/onsi/ginkgo/v2"
@@ -22,343 +20,104 @@ import (
 	"github.com/orka-agents/orka/test/utils"
 )
 
-var _ = Describe("AgentRuntime external endpoint", Ordered, func() {
+const externalV2RuntimeName = "external-v2-runtime"
+
+var _ = Describe("AgentRuntime external dispatch", func() {
 	const (
-		runtimeName        = "fibey-agentkit-e2e"
-		harnessToken       = "mock-token"
-		goodSecretName     = runtimeName + "-harness-token"
-		badSecretName      = runtimeName + "-unlabeled-token"
-		deploymentName     = runtimeName
-		serviceName        = runtimeName
-		agentName          = "fibey-custom-e2e"
-		taskName           = "fibey-custom-e2e-task"
-		badRuntimeName     = runtimeName + "-unlabeled"
-		harnessServicePort = 8080
+		agentName = "e2e-external-v2-agent"
+		taskName  = "e2e-external-v2-task"
 	)
 
-	BeforeAll(func() {
-		if !agentRuntimeExternalE2EEnabled() {
-			Skip(fmt.Sprintf("Skipping AgentRuntime external endpoint E2E: %s is not enabled", agentRuntimeExternalE2EEnvVar))
-		}
-	})
-
-	AfterAll(func() {
-		for _, resource := range []struct {
-			kind string
-			name string
-		}{
+	AfterEach(func() {
+		for _, resource := range []struct{ kind, name string }{
 			{"task", taskName},
 			{"agent", agentName},
-			{"agentruntime", runtimeName},
-			{"agentruntime", badRuntimeName},
-			{"service", serviceName},
-			{"deployment", deploymentName},
-			{"secret", goodSecretName},
-			{"secret", badSecretName},
+			{"agentruntime", externalV2RuntimeName},
 		} {
-			cmd := exec.Command("kubectl", "delete", resource.kind, resource.name, "-n", namespace, "--ignore-not-found")
+			cmd := exec.Command("kubectl", "delete", resource.kind, resource.name,
+				"-n", namespace, "--ignore-not-found")
 			_, _ = utils.Run(cmd)
 		}
 	})
 
-	AfterEach(func() {
-		if CurrentSpecReport().Failed() {
-			dumpAgentRuntimeExternalDiagnostics(runtimeName, badRuntimeName)
-		}
+	It("rejects orka.harness.v1 registrations in a harness-v2 namespace", func() {
+		manifest := fmt.Sprintf(`{
+			"apiVersion": "core.orka.ai/v1alpha1",
+			"kind": "AgentRuntime",
+			"metadata": {"name": "e2e-v1-rejected", "namespace": %q},
+			"spec": {
+				"contractVersion": "orka.harness.v1",
+				"clientAuth": {
+					"bearerTokenSecretRef": {"name": "runtime-auth", "key": "token"}
+				},
+				"deployment": {"mode": "external-endpoint", "endpoint": "https://runtime.example.com"}
+			}
+		}`, namespace)
+		cmd := exec.Command("kubectl", "apply", "--dry-run=server", "-f", "-")
+		cmd.Stdin = stringReader(manifest)
+		output, err := utils.Run(cmd)
+		Expect(err).To(HaveOccurred())
+		Expect(output).To(ContainSubstring(
+			`AgentRuntime contractVersion must match namespace execution mode "harness-v2"`,
+		))
 	})
 
-	It("runs an agent task through a conformance-gated external AgentRuntime", func() {
-		By("deploying the generic HTTP remote runtime harness endpoint")
-		endpoint := fmt.Sprintf("http://%s.%s.svc.cluster.local:%d", serviceName, namespace, harnessServicePort)
-		Expect(applyManifestJSON(agentRuntimeExternalGoodSecret(goodSecretName, runtimeName, endpoint, harnessToken))).To(Succeed())
-		Expect(applyManifestJSON(agentRuntimeExternalHarnessDeployment(deploymentName, serviceName, harnessToken))).To(Succeed())
+	It("fails closed at the external Task dispatch support boundary", func() {
+		runtimeManifest, manifestErr := externalV2RuntimeManifest()
+		Expect(manifestErr).NotTo(HaveOccurred())
+		Expect(applyManifestJSON(runtimeManifest)).To(Succeed())
 
-		cmd := exec.Command("kubectl", "rollout", "status", "deployment/"+deploymentName, "-n", namespace, "--timeout=2m")
-		_, err := utils.Run(cmd)
-		Expect(err).NotTo(HaveOccurred(), "mock harness deployment should become ready")
-
-		By("registering an external AgentRuntime")
-		Expect(applyManifestJSON(agentRuntimeExternalRuntime(runtimeName, endpoint, goodSecretName))).To(Succeed())
-		waitForAgentRuntimeReady(runtimeName, true, 2*time.Minute)
-		assertAgentRuntimeObservedCapabilities(runtimeName, map[string]string{
-			"runtimeName":     runtimeName,
-			"protocolVersion": "orka.harness.v1",
-		})
-
-		By("creating an Agent that selects the runtimeRef")
-		Expect(applyManifestJSON(map[string]any{
+		agentManifest := fmt.Sprintf(`{
 			"apiVersion": "core.orka.ai/v1alpha1",
-			"kind":       "Agent",
-			"metadata": map[string]any{
-				"name":      agentName,
-				"namespace": namespace,
-			},
-			"spec": map[string]any{
-				"runtime": map[string]any{
-					"runtimeRef": map[string]any{"name": runtimeName},
-				},
-				"systemPrompt": map[string]any{
-					"inline": "You are a custom Fibey incident scout. Return a concise result.",
-				},
-			},
-		})).To(Succeed())
+			"kind": "Agent",
+			"metadata": {"name": %q, "namespace": %q},
+			"spec": {
+				"runtime": {"runtimeRef": {"name": %q}}
+			}
+		}`, agentName, namespace, externalV2RuntimeName)
+		cmd := exec.Command("kubectl", "apply", "-f", "-")
+		cmd.Stdin = stringReader(agentManifest)
+		_, err := utils.Run(cmd)
+		Expect(err).NotTo(HaveOccurred())
 
-		By("creating a task that runs through the external runtime")
-		Expect(applyManifestJSON(map[string]any{
+		taskManifest := fmt.Sprintf(`{
 			"apiVersion": "core.orka.ai/v1alpha1",
-			"kind":       "Task",
-			"metadata": map[string]any{
-				"name":      taskName,
-				"namespace": namespace,
-			},
-			"spec": map[string]any{
-				"type":     "agent",
-				"agentRef": map[string]any{"name": agentName},
-				"prompt":   "Quincy North alert: summarize likely cause and safest next action.",
-			},
-		})).To(Succeed())
+			"kind": "Task",
+			"metadata": {"name": %q, "namespace": %q},
+			"spec": {
+				"type": "agent",
+				"agentRef": {"name": %q},
+				"prompt": "Prepare a governed change.",
+				"workspace": {
+					"intent": "write",
+					"gitRepo": "https://github.com/example/repo",
+					"publicationGitRepo": "https://github.com/example/repo"
+				}
+			}
+		}`, taskName, namespace, agentName)
+		cmd = exec.Command("kubectl", "apply", "-f", "-")
+		cmd.Stdin = stringReader(taskManifest)
+		_, err = utils.Run(cmd)
+		Expect(err).NotTo(HaveOccurred())
+
+		Eventually(func(g Gomega) {
+			cmd := exec.Command("kubectl", "get", "task", taskName, "-n", namespace,
+				"-o", "jsonpath={.status.phase}{\"/\"}{.status.message}")
+			output, err := utils.Run(cmd)
+			g.Expect(err).NotTo(HaveOccurred())
+			g.Expect(output).To(HavePrefix("Failed/"))
+			g.Expect(output).To(ContainSubstring(fmt.Sprintf("external AgentRuntime %q Task dispatch is not supported until the v2 dispatcher is wired", externalV2RuntimeName)))
+		}, 2*time.Minute, time.Second).Should(Succeed())
 
-		waitForTaskPhase(taskName, "Succeeded", 2*time.Minute)
 		verifyNoJobForTask(taskName, 5*time.Second)
-		verifyResultAvailable(taskName)
-		assertTaskHarnessRuntimeStatus(taskName, runtimeName, endpoint, goodSecretName)
-		verifyHarnessWrapperMetadataForTask(taskName, map[string]string{
-			"runtime":         runtimeName,
-			"runtimeRef":      runtimeName,
-			"wrapper":         "external-endpoint",
-			"contractVersion": "orka.harness.v1",
-		}, 30*time.Second)
-
-		By("verifying unlabeled auth Secrets are rejected for AgentRuntime readiness")
-		Expect(applyManifestJSON(agentRuntimeExternalUnlabeledSecret(badSecretName, harnessToken))).To(Succeed())
-		Expect(applyManifestJSON(agentRuntimeExternalRuntime(badRuntimeName, endpoint, badSecretName))).To(Succeed())
-		waitForAgentRuntimeReady(badRuntimeName, false, time.Minute)
-		assertAgentRuntimeMessageContains(badRuntimeName, "orka.ai/agent-runtime-auth")
 	})
 })
 
-func agentRuntimeExternalGoodSecret(name, runtimeName, endpoint, value string) map[string]any {
-	return map[string]any{
-		"apiVersion": "v1",
-		"kind":       "Secret",
-		"metadata": map[string]any{
-			"name":      name,
-			"namespace": namespace,
-			"labels": map[string]any{
-				"orka.ai/agent-runtime-auth": "true",
-				"orka.ai/agent-runtime-name": runtimeName,
-			},
-			"annotations": map[string]any{
-				"orka.ai/agent-runtime-endpoint": endpoint,
-			},
-		},
-		"stringData": map[string]any{"token": value},
-	}
-}
-
-func agentRuntimeExternalUnlabeledSecret(name, value string) map[string]any {
-	return map[string]any{
-		"apiVersion": "v1",
-		"kind":       "Secret",
-		"metadata": map[string]any{
-			"name":      name,
-			"namespace": namespace,
-		},
-		"stringData": map[string]any{"token": value},
-	}
-}
-
-func agentRuntimeExternalHarnessDeployment(deploymentName, serviceName, harnessToken string) map[string]any {
-	labels := map[string]any{"app.kubernetes.io/name": deploymentName}
-	return map[string]any{
-		"apiVersion": "v1",
-		"kind":       "List",
-		"items": []any{
-			map[string]any{
-				"apiVersion": "apps/v1",
-				"kind":       "Deployment",
-				"metadata": map[string]any{
-					"name":      deploymentName,
-					"namespace": namespace,
-					"labels":    labels,
-				},
-				"spec": map[string]any{
-					"replicas": 1,
-					"selector": map[string]any{"matchLabels": labels},
-					"template": map[string]any{
-						"metadata": map[string]any{"labels": labels},
-						"spec": map[string]any{
-							"securityContext": map[string]any{
-								"runAsNonRoot": true,
-								"runAsUser":    65532,
-								"runAsGroup":   65532,
-								"seccompProfile": map[string]any{
-									"type": "RuntimeDefault",
-								},
-							},
-							"containers": []any{
-								map[string]any{
-									"name":            "harness",
-									"image":           agentRuntimeExternalHarnessImage,
-									"imagePullPolicy": "IfNotPresent",
-									"env": []any{
-										map[string]any{"name": "ORKA_EXAMPLE_HARNESS_ADDR", "value": ":8080"},
-										map[string]any{"name": "ORKA_EXAMPLE_HARNESS_RUNTIME_NAME", "value": deploymentName},
-										map[string]any{"name": "ORKA_EXAMPLE_HARNESS_BEARER_TOKEN", "value": harnessToken},
-									},
-									"ports": []any{map[string]any{"name": "http", "containerPort": 8080}},
-									"securityContext": map[string]any{
-										"allowPrivilegeEscalation": false,
-										"readOnlyRootFilesystem":   true,
-										"capabilities": map[string]any{
-											"drop": []any{"ALL"},
-										},
-									},
-									"readinessProbe": map[string]any{
-										"httpGet":       map[string]any{"path": "/v1/health", "port": "http"},
-										"periodSeconds": 2,
-									},
-								},
-							},
-						},
-					},
-				},
-			},
-			map[string]any{
-				"apiVersion": "v1",
-				"kind":       "Service",
-				"metadata": map[string]any{
-					"name":      serviceName,
-					"namespace": namespace,
-				},
-				"spec": map[string]any{
-					"selector": labels,
-					"ports": []any{map[string]any{
-						"name":       "http",
-						"port":       8080,
-						"targetPort": "http",
-					}},
-				},
-			},
-		},
-	}
-}
-
-func agentRuntimeExternalRuntime(name, endpoint, secretName string) map[string]any {
-	return map[string]any{
-		"apiVersion": "core.orka.ai/v1alpha1",
-		"kind":       "AgentRuntime",
-		"metadata": map[string]any{
-			"name":      name,
-			"namespace": namespace,
-		},
-		"spec": map[string]any{
-			"contractVersion": "orka.harness.v1",
-			"deployment": map[string]any{
-				"mode":     "external-endpoint",
-				"endpoint": endpoint,
-			},
-			"clientAuth": map[string]any{
-				"bearerTokenSecretRef": map[string]any{
-					"name": secretName,
-					"key":  "token",
-				},
-			},
-			"capabilities": map[string]any{
-				"toolExecutionModes":      []any{"observed"},
-				"supportsCancel":          true,
-				"supportsRuntimeSessions": true,
-			},
-		},
-	}
-}
-
-func waitForAgentRuntimeReady(name string, ready bool, timeout time.Duration) {
-	want := fmt.Sprintf("%t", ready)
-	jsonPath := "jsonpath={.status.ready}"
-	if !ready {
-		jsonPath = "jsonpath={.status.conditions[?(@.type==\"Ready\")].status}"
-		want = "False"
-	}
-	Eventually(func(g Gomega) {
-		cmd := exec.Command("kubectl", "get", "agentruntime", name,
-			"-n", namespace, "-o", jsonPath)
-		output, err := utils.Run(cmd)
-		g.Expect(err).NotTo(HaveOccurred())
-		g.Expect(output).To(Equal(want), "AgentRuntime %s readiness", name)
-	}, timeout, time.Second).Should(Succeed())
-}
-
-func assertAgentRuntimeObservedCapabilities(name string, expected map[string]string) {
-	cmd := exec.Command("kubectl", "get", "agentruntime", name, "-n", namespace, "-o", "json")
-	output, err := utils.Run(cmd)
-	Expect(err).NotTo(HaveOccurred())
-	var runtime struct {
-		Status struct {
-			ObservedCapabilities map[string]any `json:"observedCapabilities"`
-		} `json:"status"`
-	}
-	Expect(json.Unmarshal([]byte(output), &runtime)).To(Succeed())
-	for key, want := range expected {
-		got, _ := runtime.Status.ObservedCapabilities[key].(string)
-		Expect(got).To(Equal(want), "observedCapabilities.%s", key)
-	}
-	modes, ok := runtime.Status.ObservedCapabilities["toolExecutionModes"].([]any)
-	Expect(ok).To(BeTrue(), "toolExecutionModes should be present")
-	Expect(modes).To(ContainElement("observed"))
-}
-
-func assertAgentRuntimeMessageContains(name, want string) {
-	cmd := exec.Command("kubectl", "get", "agentruntime", name,
-		"-n", namespace, "-o", "jsonpath={.status.message}")
-	output, err := utils.Run(cmd)
-	Expect(err).NotTo(HaveOccurred())
-	Expect(output).To(ContainSubstring(want))
-}
-
-func assertTaskHarnessRuntimeStatus(taskName, runtimeName, endpoint, authRefName string) {
-	Eventually(func(g Gomega) {
-		cmd := exec.Command("kubectl", "get", "task", taskName, "-n", namespace, "-o", "json")
-		output, err := utils.Run(cmd)
-		g.Expect(err).NotTo(HaveOccurred())
-		var task struct {
-			Status struct {
-				HarnessRuntime struct {
-					RuntimeRefName  string `json:"runtimeRefName"`
-					ContractVersion string `json:"contractVersion"`
-					Endpoint        string `json:"endpoint"`
-					AuthRefName     string `json:"authRefName"`
-				} `json:"harnessRuntime"`
-			} `json:"status"`
-		}
-		g.Expect(json.Unmarshal([]byte(output), &task)).To(Succeed())
-		g.Expect(task.Status.HarnessRuntime.RuntimeRefName).To(Equal(runtimeName))
-		g.Expect(task.Status.HarnessRuntime.ContractVersion).To(Equal("orka.harness.v1"))
-		g.Expect(task.Status.HarnessRuntime.Endpoint).To(Equal(endpoint))
-		g.Expect(task.Status.HarnessRuntime.AuthRefName).To(Equal(authRefName))
-	}, 30*time.Second, time.Second).Should(Succeed())
-}
-
-func dumpAgentRuntimeExternalDiagnostics(runtimeNames ...string) {
-	resources := [][]string{
-		{"get", "agentruntimes", "-n", namespace, "-o", "wide"},
-		{"get", "tasks", "-n", namespace, "-o", "wide"},
-		{"get", "pods", "-n", namespace, "-o", "wide"},
-		{"get", "events", "-n", namespace, "--sort-by=.lastTimestamp"},
-	}
-	for _, runtimeName := range runtimeNames {
-		if strings.TrimSpace(runtimeName) == "" {
-			continue
-		}
-		resources = append(resources, []string{"describe", "agentruntime", runtimeName, "-n", namespace})
-	}
-	for _, args := range resources {
-		cmd := exec.Command("kubectl", args...)
-		output, err := utils.Run(cmd)
-		if err != nil {
-			_, _ = fmt.Fprintf(GinkgoWriter, "diagnostic failed: kubectl %s: %v\n", strings.Join(args, " "), err)
-			continue
-		}
-		_, _ = fmt.Fprintf(GinkgoWriter, "diagnostic: kubectl %s\n%s\n", strings.Join(args, " "), output)
+func externalV2RuntimeManifest() (map[string]any, error) {
+	manifest, err := gatewayE2ERuntimeManifest()
+	if err != nil {
+		return nil, err
 	}
+	manifest["metadata"].(map[string]any)["name"] = externalV2RuntimeName
+	return manifest, nil
 }
diff --git a/test/e2e/cli_security_monitor_test.go b/test/e2e/cli_security_monitor_test.go
index 2a2570b3a..9f2758ba8 100644
--- a/test/e2e/cli_security_monitor_test.go
+++ b/test/e2e/cli_security_monitor_test.go
@@ -75,11 +75,10 @@ metadata:
   name: %s
 spec:
   runtime:
+    contractVersion: orka.harness.v2
     type: claude
     defaultMaxTurns: 1
-  secretRef:
-    name: %s
-`, agentName, secretName))
+`, agentName))
 		expectOrkaSuccess(runOrka(home, "agent", "create", "-f", agentManifest), token, fakeAnthropicKey)
 
 		By("creating and reading a RepositoryScan with required repoURL and analysisAgentRef fields")
diff --git a/test/e2e/cli_test.go b/test/e2e/cli_test.go
index c5711a006..64ca6c38f 100644
--- a/test/e2e/cli_test.go
+++ b/test/e2e/cli_test.go
@@ -285,6 +285,7 @@ metadata:
   name: %s
 spec:
   runtime:
+    contractVersion: orka.harness.v2
     type: claude
     defaultMaxTurns: 5
     defaultAllowBash: false
@@ -296,6 +297,7 @@ metadata:
   name: %s
 spec:
   runtime:
+    contractVersion: orka.harness.v2
     type: claude
     defaultMaxTurns: 7
     defaultAllowBash: false
diff --git a/test/e2e/comprehensive_test.go b/test/e2e/comprehensive_test.go
index bac7be73a..affbd538c 100644
--- a/test/e2e/comprehensive_test.go
+++ b/test/e2e/comprehensive_test.go
@@ -12,7 +12,6 @@ package e2e
 import (
 	"fmt"
 	"os/exec"
-	"strings"
 	"time"
 
 	. "github.com/onsi/ginkgo/v2"
@@ -34,11 +33,11 @@ var _ = Describe("Comprehensive Functionality", Ordered, func() {
 
 	AfterAll(func() {
 		By("cleaning up comprehensive test resources")
-		for _, name := range []string{containerCompTaskName, aiCompTaskName, claudeCompTaskName, copilotCompTaskName} {
+		for _, name := range []string{containerCompTaskName, aiCompTaskName, claudeCompTaskName} {
 			cmd := exec.Command("kubectl", "delete", "task", name, "-n", namespace, "--ignore-not-found")
 			_, _ = utils.Run(cmd)
 		}
-		for _, name := range []string{claudeCompAgentName, copilotCompAgentName} {
+		for _, name := range []string{claudeCompAgentName} {
 			cmd := exec.Command("kubectl", "delete", "agent", name, "-n", namespace, "--ignore-not-found")
 			_, _ = utils.Run(cmd)
 		}
@@ -47,7 +46,7 @@ var _ = Describe("Comprehensive Functionality", Ordered, func() {
 	})
 
 	AfterEach(func() {
-		dumpDebugInfo(containerCompTaskName, aiCompTaskName, claudeCompTaskName, copilotCompTaskName)
+		dumpDebugInfo(containerCompTaskName, aiCompTaskName, claudeCompTaskName)
 	})
 
 	// Container task: validates execution environment, file I/O, process management, and output
@@ -133,145 +132,53 @@ var _ = Describe("Comprehensive Functionality", Ordered, func() {
 		verifyResultAvailable(aiCompTaskName)
 	})
 
-	// Claude agent: exercises multi-turn tool use with bash and file operations
-	It("should run a comprehensive Claude agent task with multi-turn tool use", func() {
-		skipIfNoKey("E2E_ANTHROPIC_API_KEY")
-
-		By("creating a Claude agent with bash enabled")
+	// ACP agent task: validates shared RuntimePool planning instead of per-Task Jobs.
+	It("should plan a comprehensive Claude task on an ACP v2 RuntimePool", func() {
 		agentManifest := fmt.Sprintf(`{
 			"apiVersion": "core.orka.ai/v1alpha1",
 			"kind": "Agent",
-			"metadata": {
-				"name": "%s",
-				"namespace": "%s"
-			},
+			"metadata": {"name": %q, "namespace": %q},
 			"spec": {
 				"runtime": {
+					"contractVersion": "orka.harness.v2",
 					"type": "claude",
 					"defaultMaxTurns": 10,
-					"defaultAllowBash": true
+					"defaultAllowBash": false
 				},
-				"secretRef": {
-					"name": "e2e-anthropic-secret"
-				}
+				"model": {"name": "claude-sonnet-4-20250514"}
 			}
 		}`, claudeCompAgentName, namespace)
-
 		cmd := exec.Command("kubectl", "apply", "-f", "-")
 		cmd.Stdin = stringReader(agentManifest)
 		_, err := utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred(), "Failed to create comprehensive Claude agent")
 
-		By("creating a multi-turn task")
 		taskManifest := fmt.Sprintf(`{
 			"apiVersion": "core.orka.ai/v1alpha1",
 			"kind": "Task",
-			"metadata": {
-				"name": "%s",
-				"namespace": "%s"
-			},
+			"metadata": {"name": %q, "namespace": %q},
 			"spec": {
 				"type": "agent",
-				"prompt": "Do the following steps using bash:\n1. Create a file /tmp/e2e-test.txt containing the text 'hello from e2e'\n2. Read the file back and confirm its contents\n3. Count the number of words in the file\n4. Append ' - test complete' to the file\n5. Print the final contents of the file\n\nReport the results of each step.",
-				"agentRef": {
-					"name": "%s"
-				},
-				"agentRuntime": {
-					"maxTurns": 10
-				}
+				"prompt": "Read the workspace and summarize the most important files without modifying them.",
+				"agentRef": {"name": %q},
+				"agentRuntime": {"maxTurns": 10},
+				"workspace": {"intent": "read"}
 			}
 		}`, claudeCompTaskName, namespace, claudeCompAgentName)
-
 		cmd = exec.Command("kubectl", "apply", "-f", "-")
 		cmd.Stdin = stringReader(taskManifest)
 		_, err = utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred(), "Failed to create comprehensive Claude task")
 
-		By("waiting for the task to complete (up to 5 minutes)")
-		phase := waitForTaskCompletion(claudeCompTaskName, 5*time.Minute)
-		Expect(phase).To(Equal("Succeeded"), "Claude agent task with multi-turn tools should succeed")
-
-		By("verifying the result is stored")
-		verifyResultAvailable(claudeCompTaskName)
-
-		By("verifying the Job used the Claude worker image")
-		image := getJobContainerImage(claudeCompTaskName)
-		Expect(image).To(ContainSubstring("claude"))
-
-		By("verifying multi-turn execution happened (pod should have completed)")
-		Eventually(func(g Gomega) {
-			cmd := exec.Command("kubectl", "get", "pods",
-				"-l", fmt.Sprintf("orka.ai/task=%s", claudeCompTaskName),
-				"-o", "jsonpath={.items[0].status.phase}",
-				"-n", namespace,
-			)
-			output, err := utils.Run(cmd)
-			g.Expect(err).NotTo(HaveOccurred())
-			g.Expect(strings.TrimSpace(output)).To(Equal("Succeeded"))
-		}, 30*time.Second, time.Second).Should(Succeed())
+		verifyACPTaskRuntimeForTask(claudeCompTaskName, acpTaskExpectation{
+			ProviderKind:    "claude",
+			Model:           "claude-sonnet-4-20250514",
+			WorkspaceIntent: "read",
+			MaxTurns:        acpInt32(10),
+			AllowBash:       acpBool(false),
+			Workspace:       &acpWorkspaceExpectation{Intent: "read"},
+		}, 2*time.Minute)
+		verifyNoJobForTask(claudeCompTaskName, 5*time.Second)
 	})
 
-	// Copilot agent: exercises the Copilot runtime with tool use
-	It("should run a comprehensive Copilot agent task with tool use", func() {
-		skipIfNoKey("E2E_GITHUB_TOKEN")
-
-		By("creating a Copilot agent with bash enabled")
-		agentManifest := fmt.Sprintf(`{
-			"apiVersion": "core.orka.ai/v1alpha1",
-			"kind": "Agent",
-			"metadata": {
-				"name": "%s",
-				"namespace": "%s"
-			},
-			"spec": {
-				"runtime": {
-					"type": "copilot",
-					"defaultMaxTurns": 10,
-					"defaultAllowBash": true
-				},
-				"secretRef": {
-					"name": "e2e-github-secret"
-				}
-			}
-		}`, copilotCompAgentName, namespace)
-
-		cmd := exec.Command("kubectl", "apply", "-f", "-")
-		cmd.Stdin = stringReader(agentManifest)
-		_, err := utils.Run(cmd)
-		Expect(err).NotTo(HaveOccurred(), "Failed to create comprehensive Copilot agent")
-
-		By("creating a multi-turn task")
-		taskManifest := fmt.Sprintf(`{
-			"apiVersion": "core.orka.ai/v1alpha1",
-			"kind": "Task",
-			"metadata": {
-				"name": "%s",
-				"namespace": "%s"
-			},
-			"spec": {
-				"type": "agent",
-				"prompt": "Do the following using bash:\n1. Create a file /tmp/copilot-test.txt with the text 'copilot e2e test'\n2. Use cat to read it back\n3. Use wc -w to count the words\n4. Print 'All steps completed successfully'\n\nReport what you did.",
-				"agentRef": {
-					"name": "%s"
-				},
-				"agentRuntime": {
-					"maxTurns": 10
-				}
-			}
-		}`, copilotCompTaskName, namespace, copilotCompAgentName)
-
-		cmd = exec.Command("kubectl", "apply", "-f", "-")
-		cmd.Stdin = stringReader(taskManifest)
-		_, err = utils.Run(cmd)
-		Expect(err).NotTo(HaveOccurred(), "Failed to create comprehensive Copilot task")
-
-		By("waiting for the task to complete (up to 5 minutes)")
-		phase := waitForTaskCompletion(copilotCompTaskName, 5*time.Minute)
-		Expect(phase).To(BeElementOf("Succeeded", "Failed"),
-			"Copilot agent task should reach terminal phase")
-
-		By("verifying the Job used the Copilot worker image")
-		image := getJobContainerImage(copilotCompTaskName)
-		Expect(image).To(ContainSubstring("copilot"))
-	})
 })
diff --git a/test/e2e/e2e_suite_test.go b/test/e2e/e2e_suite_test.go
index 7d9ea9654..642329ba2 100644
--- a/test/e2e/e2e_suite_test.go
+++ b/test/e2e/e2e_suite_test.go
@@ -14,6 +14,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"net/http"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -31,15 +32,24 @@ var (
 	// managerImage is the manager image to be built and loaded for testing.
 	managerImage = "ghcr.io/orka-agents/orka:latest"
 
-	// Worker, harness, and focused fixture images to build and load for e2e testing.
-	aiWorkerImage                    = "ghcr.io/orka-agents/orka/ai-worker:latest"
-	generalWorkerImage               = "ghcr.io/orka-agents/orka/general-worker:latest"
-	harnessWrapperImage              = "ghcr.io/orka-agents/orka/agent-harness-wrapper:latest"
-	agentRuntimeExternalHarnessImage = "ghcr.io/orka-agents/orka/agent-runtime-external-harness:e2e"
-	gatewayReferenceAdapterImage     = "ghcr.io/orka-agents/orka/gateway-reference-adapter:e2e"
-	agentRuntimeExternalE2EEnvVar    = "E2E_AGENTRUNTIME_EXTERNAL"
-	gatewayE2EEnvVar                 = "E2E_GATEWAY"
-	e2eEphemeralClusterEnvVar        = "E2E_EPHEMERAL_CLUSTER"
+	// Worker, ACP runtime, clean-room publisher, and focused fixture images used by the e2e cluster.
+	aiWorkerImage                = "ghcr.io/orka-agents/orka/ai-worker:latest"
+	generalWorkerImage           = "ghcr.io/orka-agents/orka/general-worker:latest"
+	acpCodexRuntimeImage         = "ghcr.io/orka-agents/orka/acp-codex-runtime:e2e"
+	acpClaudeRuntimeImage        = "ghcr.io/orka-agents/orka/acp-claude-runtime:e2e"
+	acpCopilotRuntimeImage       = "ghcr.io/orka-agents/orka/acp-copilot-runtime:e2e"
+	acpOpencodeRuntimeImage      = "ghcr.io/orka-agents/orka/acp-opencode-runtime:e2e"
+	workspacePublisherImage      = "ghcr.io/orka-agents/orka/workspace-publisher:e2e"
+	gatewayReferenceAdapterImage = "ghcr.io/orka-agents/orka/gateway-reference-adapter:e2e"
+	gatewayE2EEnvVar             = "E2E_GATEWAY"
+	e2eEphemeralClusterEnvVar    = "E2E_EPHEMERAL_CLUSTER"
+	managerRef                   string
+	acpCodexRuntimeRef           string
+	acpClaudeRuntimeRef          string
+	acpCopilotRuntimeRef         string
+	acpOpencodeRuntimeRef        string
+	workspacePublisherRef        string
+	e2eRegistryContainerName     string
 
 	// E2E environment configuration (loaded from .env or environment)
 	e2eOpenAIAPIKey            string
@@ -70,18 +80,15 @@ var _ = BeforeSuite(func() {
 		fmt.Sprintf("IMG=%s", managerImage),
 		fmt.Sprintf("AI_WORKER_IMG=%s", aiWorkerImage),
 		fmt.Sprintf("GENERAL_WORKER_IMG=%s", generalWorkerImage),
-		fmt.Sprintf("HARNESS_WRAPPER_IMG=%s", harnessWrapperImage),
+		fmt.Sprintf("ACP_CODEX_RUNTIME_IMG=%s", acpCodexRuntimeImage),
+		fmt.Sprintf("ACP_CLAUDE_RUNTIME_IMG=%s", acpClaudeRuntimeImage),
+		fmt.Sprintf("ACP_COPILOT_RUNTIME_IMG=%s", acpCopilotRuntimeImage),
+		fmt.Sprintf("ACP_OPENCODE_RUNTIME_IMG=%s", acpOpencodeRuntimeImage),
+		fmt.Sprintf("WORKSPACE_PUBLISHER_IMG=%s", workspacePublisherImage),
 	)
 	_, err := utils.Run(cmd)
 	ExpectWithOffset(1, err).NotTo(HaveOccurred(), "Failed to build Docker images")
 
-	if agentRuntimeExternalE2EEnabled() || gatewayE2EEnabled() {
-		By("building the AgentRuntime external harness Docker image")
-		cmd = exec.Command("docker", "build", "-t", agentRuntimeExternalHarnessImage,
-			"-f", "examples/harness/echo/Dockerfile", ".")
-		_, err = utils.Run(cmd)
-		ExpectWithOffset(1, err).NotTo(HaveOccurred(), "Failed to build AgentRuntime external harness image")
-	}
 	if gatewayE2EEnabled() {
 		By("building the Gateway reference adapter Docker image")
 		cmd = exec.Command("docker", "build", "-t", gatewayReferenceAdapterImage,
@@ -91,14 +98,11 @@ var _ = BeforeSuite(func() {
 	}
 
 	By("loading all images into Kind cluster")
+
 	images := []string{
 		managerImage,
 		aiWorkerImage,
 		generalWorkerImage,
-		harnessWrapperImage,
-	}
-	if agentRuntimeExternalE2EEnabled() || gatewayE2EEnabled() {
-		images = append(images, agentRuntimeExternalHarnessImage)
 	}
 	if gatewayE2EEnabled() {
 		images = append(images, gatewayReferenceAdapterImage)
@@ -108,6 +112,23 @@ var _ = BeforeSuite(func() {
 		ExpectWithOffset(1, err).NotTo(HaveOccurred(), fmt.Sprintf("Failed to load image %s into Kind", img))
 	}
 
+	By("publishing digest-pinned ACP and publisher images to a Kind-local registry")
+	registry, registryContainer, err := prepareKindLocalRegistry()
+	ExpectWithOffset(1, err).NotTo(HaveOccurred(), "Failed to prepare Kind-local registry")
+	e2eRegistryContainerName = registryContainer
+	managerRef, err = pushImageToLocalRegistry(registry, managerImage, "orka/controller:e2e")
+	ExpectWithOffset(1, err).NotTo(HaveOccurred(), "Failed to publish controller image")
+	acpCodexRuntimeRef, err = pushImageToLocalRegistry(registry, acpCodexRuntimeImage, "orka/acp-codex-runtime:e2e")
+	ExpectWithOffset(1, err).NotTo(HaveOccurred(), "Failed to publish Codex ACP runtime image")
+	acpClaudeRuntimeRef, err = pushImageToLocalRegistry(registry, acpClaudeRuntimeImage, "orka/acp-claude-runtime:e2e")
+	ExpectWithOffset(1, err).NotTo(HaveOccurred(), "Failed to publish Claude ACP runtime image")
+	acpCopilotRuntimeRef, err = pushImageToLocalRegistry(registry, acpCopilotRuntimeImage, "orka/acp-copilot-runtime:e2e")
+	ExpectWithOffset(1, err).NotTo(HaveOccurred(), "Failed to publish Copilot ACP runtime image")
+	acpOpencodeRuntimeRef, err = pushImageToLocalRegistry(registry, acpOpencodeRuntimeImage, "orka/acp-opencode-runtime:e2e")
+	ExpectWithOffset(1, err).NotTo(HaveOccurred(), "Failed to publish OpenCode ACP runtime image")
+	workspacePublisherRef, err = pushImageToLocalRegistry(registry, workspacePublisherImage, "orka/workspace-publisher:e2e")
+	ExpectWithOffset(1, err).NotTo(HaveOccurred(), "Failed to publish workspace publisher image")
+
 	By("loading e2e environment configuration")
 	projectDir, _ := utils.GetProjectDir()
 	loadEnvFile(filepath.Join(projectDir, "test", "e2e", ".env"))
@@ -124,9 +145,11 @@ var _ = BeforeSuite(func() {
 		"COPILOT_PROXY_BASE_URL",
 	)
 
-	By("creating manager namespace")
-	cmd = exec.Command("kubectl", "create", "ns", namespace)
-	_, _ = utils.Run(cmd) // ignore if already exists
+	By("bootstrapping manager namespace identity")
+	cmd = exec.Command("bash", filepath.Join(projectDir, "scripts", "lib", "ensure-static-mode-namespace.sh"),
+		"kubectl", namespace, "harness-v2")
+	_, err = utils.Run(cmd)
+	ExpectWithOffset(1, err).NotTo(HaveOccurred(), "Failed to bootstrap manager namespace identity")
 
 	By("labeling the namespace to enforce the restricted security policy")
 	cmd = exec.Command("kubectl", "label", "--overwrite", "ns", namespace,
@@ -134,6 +157,15 @@ var _ = BeforeSuite(func() {
 	_, err = utils.Run(cmd)
 	ExpectWithOffset(1, err).NotTo(HaveOccurred(), "Failed to label namespace with restricted policy")
 
+	By("creating the Vekil namespace required by the production ingress policy")
+	cmd = exec.Command("kubectl", "create", "namespace", "vekil-system", "--dry-run=client", "-o", "yaml")
+	vekilNamespace, err := utils.Run(cmd)
+	ExpectWithOffset(1, err).NotTo(HaveOccurred(), "Failed to render the Vekil namespace")
+	cmd = exec.Command("kubectl", "apply", "-f", "-")
+	cmd.Stdin = strings.NewReader(vekilNamespace)
+	_, err = utils.Run(cmd)
+	ExpectWithOffset(1, err).NotTo(HaveOccurred(), "Failed to create the Vekil namespace")
+
 	By("creating e2e K8s secrets from environment variables")
 	if e2eOpenAIAPIKey != "" {
 		err = createK8sSecret("e2e-openai-secret", namespace, map[string]string{"api-key": e2eOpenAIAPIKey})
@@ -165,6 +197,7 @@ var _ = BeforeSuite(func() {
 		"tasks.core.orka.ai",
 		"agents.core.orka.ai",
 		"agentruntimes.core.orka.ai",
+		"runtimepools.core.orka.ai",
 		"tools.core.orka.ai",
 		"providers.core.orka.ai",
 		"skills.core.orka.ai",
@@ -181,6 +214,7 @@ var _ = BeforeSuite(func() {
 	}
 	Eventually(func(g Gomega) {
 		for _, crd := range requiredCRDs {
+
 			cmd := exec.Command("kubectl", "wait", "--for=condition=Established",
 				"crd/"+crd, "--timeout=30s")
 			_, err := utils.Run(cmd)
@@ -188,8 +222,20 @@ var _ = BeforeSuite(func() {
 		}
 	}, 60*time.Second, time.Second).Should(Succeed())
 
+	By("bootstrapping test-only admission TLS")
+	cmd = exec.Command("bash", filepath.Join(projectDir, "scripts", "lib", "e2e-admission-tls.sh"))
+	_, err = utils.Run(cmd)
+	ExpectWithOffset(1, err).NotTo(HaveOccurred(), "Failed to bootstrap admission TLS")
+
 	By("deploying the controller-manager")
-	cmd = exec.Command("make", "deploy", fmt.Sprintf("IMG=%s", managerImage))
+	cmd = exec.Command("make", "deploy",
+		fmt.Sprintf("IMG=%s", managerRef),
+		fmt.Sprintf("ACP_CODEX_RUNTIME_IMG=%s", acpCodexRuntimeRef),
+		fmt.Sprintf("ACP_CLAUDE_RUNTIME_IMG=%s", acpClaudeRuntimeRef),
+		fmt.Sprintf("ACP_COPILOT_RUNTIME_IMG=%s", acpCopilotRuntimeRef),
+		fmt.Sprintf("ACP_OPENCODE_RUNTIME_IMG=%s", acpOpencodeRuntimeRef),
+		fmt.Sprintf("WORKSPACE_PUBLISHER_IMG=%s", workspacePublisherRef),
+	)
 	_, err = utils.Run(cmd)
 	ExpectWithOffset(1, err).NotTo(HaveOccurred(), "Failed to deploy the controller-manager")
 
@@ -206,7 +252,7 @@ var _ = BeforeSuite(func() {
 	By("patching the controller-manager deployment to use kind-loaded images")
 	cmd = exec.Command(
 		"kubectl", "patch", "deployment", controllerManagerDeployment, "-n", namespace, "--type=strategic",
-		"-p", `{"spec":{"template":{"spec":{"containers":[{"name":"manager","imagePullPolicy":"IfNotPresent"}]}}}}`,
+		"-p", `{"spec":{"template":{"spec":{"containers":[{"name":"manager","imagePullPolicy":"IfNotPresent","env":[{"name":"ORKA_ACP_IDLE_POOL_TTL","value":"2m"}]}]}}}}`,
 	)
 	_, err = utils.Run(cmd)
 	ExpectWithOffset(1, err).NotTo(HaveOccurred(), "Failed to patch controller-manager imagePullPolicy")
@@ -228,31 +274,82 @@ var _ = AfterSuite(func() {
 	}
 
 	By("cleaning up the curl pod for metrics")
-	cmd := exec.Command("kubectl", "delete", "pod", "curl-metrics", "-n", namespace, "--ignore-not-found")
-	_, _ = utils.Run(cmd)
+	runBoundedE2ECleanup(30*time.Second, "kubectl", "delete", "pod", "curl-metrics",
+		"-n", namespace, "--ignore-not-found", "--wait=true", "--timeout=20s")
+
+	By("deleting Tasks before their ACP RuntimePools and other finalizer owners")
+	deleteAllE2EResources("tasks.core.orka.ai", true, 90*time.Second)
+
+	By("deleting Tools before execution workspaces and actor pools")
+	deleteAllE2EResources("tools.core.orka.ai", true, 45*time.Second)
+
+	By("deleting execution workspaces before workspace classes and providers")
+	deleteAllE2EResources("executionworkspaces.workspace.orka.ai", true, 45*time.Second)
+
+	By("deleting controller-owned ACP RuntimePools while the controller is still running")
+	deleteAllE2EResources("runtimepools.core.orka.ai", true, 60*time.Second)
+
+	By("deleting remaining namespaced finalizer owners")
+	for _, resource := range []string{
+		"substrateactorpools.core.orka.ai",
+		"outboundaccesspolicies.core.orka.ai",
+		"executionworkspacepools.workspace.orka.ai",
+		"executionworkspaceclasses.workspace.orka.ai",
+	} {
+		deleteAllE2EResources(resource, true, 45*time.Second)
+	}
+
+	By("deleting cluster-scoped execution workspace providers last")
+	deleteAllE2EResources("executionworkspaceproviders.workspace.orka.ai", false, 45*time.Second)
 
 	By("cleaning up e2e secrets")
 	for _, s := range []string{"e2e-openai-secret", "e2e-anthropic-secret", "e2e-github-secret"} {
-		cmd = exec.Command("kubectl", "delete", "secret", s, "-n", namespace, "--ignore-not-found")
-		_, _ = utils.Run(cmd)
+		runBoundedE2ECleanup(30*time.Second, "kubectl", "delete", "secret", s,
+			"-n", namespace, "--ignore-not-found", "--wait=true", "--timeout=20s")
 	}
 
 	By("undeploying the controller-manager")
-	cleanupCtx, cleanupCancel := context.WithTimeout(context.Background(), 2*time.Minute)
-	cmd = exec.CommandContext(cleanupCtx, "make", "undeploy")
-	_, _ = utils.Run(cmd)
-	cleanupCancel()
+	runBoundedE2ECleanup(2*time.Minute, "make", "undeploy", "ignore-not-found=true")
 
 	By("uninstalling CRDs")
-	cmd = exec.Command("make", "uninstall")
-	_, _ = utils.Run(cmd)
+	runBoundedE2ECleanup(2*time.Minute, "make", "uninstall", "ignore-not-found=true")
 
 	By("removing manager namespace")
-	cmd = exec.Command("kubectl", "delete", "ns", namespace, "--ignore-not-found")
-	_, _ = utils.Run(cmd)
+	runBoundedE2ECleanup(60*time.Second, "kubectl", "delete", "ns", namespace,
+		"--ignore-not-found", "--wait=true", "--timeout=45s")
 
+	if e2eRegistryContainerName != "" {
+		By("removing the Kind-local image registry")
+		runBoundedE2ECleanup(30*time.Second, "docker", "rm", "-f", e2eRegistryContainerName)
+	}
 })
 
+func deleteAllE2EResources(resource string, namespaced bool, timeout time.Duration) {
+	args := []string{
+		"delete", resource, "--all", "--ignore-not-found", "--wait=true", "--timeout=" + timeout.String(),
+	}
+	if namespaced {
+		args = append(args, "-n", namespace)
+	}
+	runBoundedE2ECleanup(timeout+10*time.Second, "kubectl", args...)
+}
+
+func runBoundedE2ECleanup(timeout time.Duration, name string, args ...string) {
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, name, args...)
+	if _, err := utils.Run(cmd); err != nil {
+		if ctx.Err() != nil {
+			_, _ = fmt.Fprintf(GinkgoWriter, "cleanup command timed out after %s: %s %s\n",
+				timeout, name, strings.Join(args, " "))
+			return
+		}
+		_, _ = fmt.Fprintf(GinkgoWriter, "cleanup command failed: %s %s: %v\n",
+			name, strings.Join(args, " "), err)
+	}
+}
+
 // loadEnvFile reads a .env file and sets environment variables that are not already set.
 func loadEnvFile(path string) {
 	f, err := os.Open(path)
@@ -286,6 +383,8 @@ func dumpControllerManagerDiagnostics() {
 	for _, args := range [][]string{
 		{"get", "pods", "-l", "control-plane=controller-manager", "-n", namespace, "-o", "wide"},
 		{"describe", "pods", "-l", "control-plane=controller-manager", "-n", namespace},
+		{"logs", "-l", "control-plane=controller-manager", "-n", namespace, "--all-containers=true", "--prefix=true", "--tail=500"},
+		{"get", "lease", "03b49a10.orka.ai", "-n", namespace, "-o", "yaml"},
 		{"get", "events", "-n", namespace, "--sort-by=.lastTimestamp"},
 		{"get", "deployments", "-l", "control-plane=controller-manager", "-n", namespace, "-o", "yaml"},
 	} {
@@ -338,8 +437,107 @@ func createK8sSecret(name, ns string, data map[string]string) error {
 	return err
 }
 
-func agentRuntimeExternalE2EEnabled() bool {
-	return e2eFlagEnabled(agentRuntimeExternalE2EEnvVar)
+func prepareKindLocalRegistry() (string, string, error) {
+	cluster := strings.TrimSpace(os.Getenv("KIND_CLUSTER"))
+	if cluster == "" {
+		cluster = "kind"
+	}
+	containerName := sanitizeDockerName(cluster + "-e2e-registry")
+	_, _ = utils.Run(exec.Command("docker", "rm", "-f", containerName))
+	if output, err := utils.Run(exec.Command(
+		"docker", "run", "-d", "--name", containerName, "--network", "kind", "-p", "127.0.0.1::5000", "registry:2",
+	)); err != nil {
+		return "", "", fmt.Errorf("start local registry: %s: %w", strings.TrimSpace(output), err)
+	}
+
+	output, err := utils.Run(exec.Command("docker", "port", containerName, "5000/tcp"))
+	if err != nil {
+		return "", "", err
+	}
+	hostPort := strings.TrimSpace(output)
+	if comma := strings.IndexByte(hostPort, ','); comma >= 0 {
+		hostPort = hostPort[:comma]
+	}
+	colon := strings.LastIndexByte(hostPort, ':')
+	if colon < 0 || colon == len(hostPort)-1 {
+		return "", "", fmt.Errorf("unexpected registry port mapping %q", hostPort)
+	}
+	registry := "localhost:" + hostPort[colon+1:]
+	client := http.Client{Timeout: time.Second}
+	deadline := time.Now().Add(30 * time.Second)
+	for {
+		resp, requestErr := client.Get("http://" + registry + "/v2/")
+		if requestErr == nil {
+			_ = resp.Body.Close()
+			if resp.StatusCode == http.StatusOK {
+				break
+			}
+		}
+		if time.Now().After(deadline) {
+			return "", "", fmt.Errorf("local registry %s did not become ready", registry)
+		}
+		time.Sleep(250 * time.Millisecond)
+	}
+
+	kindBinary := firstSetEnv("KIND")
+	if kindBinary == "" {
+		kindBinary = "kind"
+	}
+	nodesOutput, err := utils.Run(exec.Command(kindBinary, "get", "nodes", "--name", cluster))
+	if err != nil {
+		return "", "", err
+	}
+	hosts := fmt.Sprintf(`server = "http://%s"
+[host."http://%s:5000"]
+  capabilities = ["pull", "resolve"]
+`, registry, containerName)
+	for _, node := range utils.GetNonEmptyLines(nodesOutput) {
+		dir := "/etc/containerd/certs.d/" + registry
+		if _, err := utils.Run(exec.Command("docker", "exec", node, "mkdir", "-p", dir)); err != nil {
+			return "", "", err
+		}
+		cmd := exec.Command("docker", "exec", "-i", node, "sh", "-c", "cat > "+dir+"/hosts.toml")
+		cmd.Stdin = strings.NewReader(hosts)
+		if _, err := utils.Run(cmd); err != nil {
+			return "", "", err
+		}
+	}
+	return registry, containerName, nil
+}
+
+func pushImageToLocalRegistry(registry, sourceImage, targetPath string) (string, error) {
+	target := registry + "/" + targetPath
+	if _, err := utils.Run(exec.Command("docker", "tag", sourceImage, target)); err != nil {
+		return "", err
+	}
+	if _, err := utils.Run(exec.Command("docker", "push", target)); err != nil {
+		return "", err
+	}
+	output, err := utils.Run(exec.Command("docker", "image", "inspect", "--format", `{{range .RepoDigests}}{{println .}}{{end}}`, target))
+	if err != nil {
+		return "", err
+	}
+	prefix := strings.TrimSuffix(target, ":e2e") + "@sha256:"
+	for _, line := range utils.GetNonEmptyLines(output) {
+		line = strings.TrimSpace(line)
+		if strings.HasPrefix(line, prefix) {
+			return line, nil
+		}
+	}
+	return "", fmt.Errorf("no digest reference found for %s", target)
+}
+
+func sanitizeDockerName(value string) string {
+	var b strings.Builder
+	for _, r := range strings.ToLower(value) {
+		if (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') || r == '-' || r == '_' || r == '.' {
+			b.WriteRune(r)
+		} else {
+			b.WriteByte('-')
+		}
+	}
+	return strings.Trim(b.String(), "-_.")
+
 }
 
 func gatewayE2EEnabled() bool {
@@ -353,6 +551,7 @@ func e2eEphemeralClusterEnabled() bool {
 func e2eFlagEnabled(name string) bool {
 	value := strings.TrimSpace(strings.ToLower(os.Getenv(name)))
 	return value == "1" || value == "true" || value == "yes"
+
 }
 
 func firstSetEnv(keys ...string) string {
diff --git a/test/e2e/gateway_test.go b/test/e2e/gateway_test.go
index 5a063642d..a50045268 100644
--- a/test/e2e/gateway_test.go
+++ b/test/e2e/gateway_test.go
@@ -34,6 +34,7 @@ import (
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
 	gatewayruntime "github.com/orka-agents/orka/internal/gateway"
 	"github.com/orka-agents/orka/internal/gateway/protocol"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
 	"github.com/orka-agents/orka/internal/store"
 	"github.com/orka-agents/orka/test/utils"
 )
@@ -136,23 +137,14 @@ var _ = Describe("Gateway live E2E", Ordered, func() {
 		}
 	})
 
-	It("runs authenticated ingress through a runtimeRef task and delivers the final reply", func() {
+	It("runs authenticated ingress and delivers the fail-closed runtime error", func() {
 		adapterDNSName := fmt.Sprintf("%s.%s.svc", gatewayE2EAdapterName, namespace)
 		adapterEndpoint := fmt.Sprintf("https://%s:%d", adapterDNSName, gatewayE2EAdapterPort)
-		runtimeEndpoint := fmt.Sprintf(
-			"http://%s.%s.svc.cluster.local:%d",
-			gatewayE2ERuntimeServiceName,
-			namespace,
-			gatewayE2ERuntimePort,
-		)
-
 		By("generating ephemeral Gateway authentication and TLS material")
 		inboundBearer, err := gatewayE2ERandomBearer()
 		Expect(err).NotTo(HaveOccurred())
 		outboundBearer, err := gatewayE2ERandomBearer()
 		Expect(err).NotTo(HaveOccurred())
-		runtimeBearer, err := gatewayE2ERandomBearer()
-		Expect(err).NotTo(HaveOccurred())
 		caPEM, serverCertPEM, serverKeyPEM, err := gatewayE2EGenerateTLS(adapterDNSName)
 		Expect(err).NotTo(HaveOccurred())
 
@@ -183,27 +175,12 @@ var _ = Describe("Gateway live E2E", Ordered, func() {
 		Expect(applyManifestJSON(gatewayE2EAdapterManifest())).To(Succeed())
 		Expect(gatewayE2EWaitForDeployment(gatewayE2EAdapterName, 2*time.Minute)).To(Succeed())
 
-		By("deploying the deterministic external AgentRuntime fixture")
-		Expect(applyManifestJSON(agentRuntimeExternalGoodSecret(
-			gatewayE2ERuntimeAuthResourceName,
-			gatewayE2ERuntimeName,
-			runtimeEndpoint,
-			runtimeBearer,
-		))).To(Succeed())
-		Expect(applyManifestJSON(agentRuntimeExternalHarnessDeployment(
-			gatewayE2ERuntimeDeploymentName,
-			gatewayE2ERuntimeServiceName,
-			runtimeBearer,
-		))).To(Succeed())
-		Expect(gatewayE2EWaitForDeployment(gatewayE2ERuntimeDeploymentName, 2*time.Minute)).To(Succeed())
-		Expect(applyManifestJSON(agentRuntimeExternalRuntime(
-			gatewayE2ERuntimeName,
-			runtimeEndpoint,
-			gatewayE2ERuntimeAuthResourceName,
-		))).To(Succeed())
-		waitForAgentRuntimeReady(gatewayE2ERuntimeName, true, 2*time.Minute)
+		By("registering an external v2 runtime")
+		runtimeManifest, err := gatewayE2ERuntimeManifest()
+		Expect(err).NotTo(HaveOccurred())
+		Expect(applyManifestJSON(runtimeManifest)).To(Succeed())
 
-		By("creating the runtime-backed Agent")
+		By("creating an Agent that references the external v2 runtime")
 		Expect(applyManifestJSON(gatewayE2EAgentManifest())).To(Succeed())
 
 		By("creating the GatewayClass, Gateway, and GatewayBinding")
@@ -304,19 +281,13 @@ var _ = Describe("Gateway live E2E", Ordered, func() {
 		Expect(task.Annotations).To(HaveKeyWithValue(gatewayruntime.TaskGatewayNameAnnotation, gatewayE2EName))
 		Expect(task.Annotations).To(HaveKeyWithValue(gatewayruntime.TaskGatewayBindingAnnotation, gatewayE2EBindingName))
 
-		waitForTaskPhase(taskName, "Succeeded", 3*time.Minute)
+		waitForTaskPhase(taskName, "Failed", 3*time.Minute)
 		verifyNoJobForTask(taskName, 5*time.Second)
-		verifyResultAvailable(taskName)
-		assertTaskHarnessRuntimeStatus(
-			taskName,
-			gatewayE2ERuntimeName,
-			runtimeEndpoint,
-			gatewayE2ERuntimeAuthResourceName,
-		)
-		result := fetchTaskResultViaAPI(apiBaseURL, apiToken, taskName)
-		Expect(strings.TrimSpace(result)).To(Equal("ok"))
+		failedTask, err := gatewayE2EGetTask(taskName)
+		Expect(err).NotTo(HaveOccurred())
+		Expect(failedTask.Status.Message).To(ContainSubstring("external AgentRuntime"))
 
-		By("waiting for durable completion and outbound delivery")
+		By("waiting for durable failure projection and outbound delivery")
 		event := waitForGatewayE2ECompletedEvent(apiBaseURL, apiToken, eventID, 4*time.Minute)
 		Expect(event.GatewayName).To(Equal(gatewayE2EName))
 		Expect(event.BindingName).To(Equal(gatewayE2EBindingName))
@@ -330,8 +301,8 @@ var _ = Describe("Gateway live E2E", Ordered, func() {
 		Expect(delivery.EventID).To(Equal(eventID))
 		Expect(delivery.TaskName).To(Equal(taskName))
 		Expect(delivery.SessionName).To(Equal(event.SessionName))
-		Expect(delivery.Kind).To(Equal(protocol.DeliveryKindFinal))
-		Expect(delivery.Text).To(Equal(result))
+		Expect(delivery.Kind).To(Equal(protocol.DeliveryKindError))
+		Expect(delivery.Text).To(Equal("The task could not be completed."))
 		Expect(delivery.IdempotencyID).To(Equal(delivery.ID))
 		Expect(delivery.AttemptCount).To(Equal(1))
 		Expect(delivery.ProviderMessageID).To(Equal("reference:" + delivery.ID))
@@ -585,6 +556,105 @@ func gatewayE2EAdapterManifest() map[string]any {
 	}
 }
 
+func gatewayE2ERuntimeManifest() (map[string]any, error) {
+	zeroDigest := "sha256:" + strings.Repeat("0", 64)
+	profile := harnessv2.RuntimeProfile{
+		ACPProfile:               harnessv2.ACPProfileV1,
+		AdapterDigests:           map[string]string{gatewayE2ERuntimeName: zeroDigest},
+		ProviderKind:             "external",
+		Model:                    "gateway-e2e",
+		AgentConfigurationDigest: zeroDigest,
+		ToolPolicyDigest:         zeroDigest,
+		ApprovalPolicyDigest:     zeroDigest,
+		MCPConfigurationDigest:   zeroDigest,
+		WorkspaceIntent:          harnessv2.WorkspaceIntentRead,
+		ProxyCredentialRole:      "provider-inference",
+		ProxyCredentialScope:     "model:gateway-e2e",
+		ResourceClass:            "standard",
+	}
+	profileDigest, err := harnessv2.CanonicalProfileDigest(profile)
+	if err != nil {
+		return nil, fmt.Errorf("canonicalize Gateway E2E runtime profile: %w", err)
+	}
+
+	return map[string]any{
+		"apiVersion": "core.orka.ai/v1alpha1",
+		"kind":       "AgentRuntime",
+		"metadata": map[string]any{
+			"name":      gatewayE2ERuntimeName,
+			"namespace": namespace,
+		},
+		"spec": map[string]any{
+			"contractVersion": "orka.harness.v2",
+			"deployment": map[string]any{
+				"mode": "external-endpoint",
+				"endpoint": fmt.Sprintf(
+					"http://%s.%s.svc.cluster.local:%d",
+					gatewayE2ERuntimeServiceName,
+					namespace,
+					gatewayE2ERuntimePort,
+				),
+			},
+			"clientAuth": map[string]any{
+				"controllerBearerTokenSecretRef": map[string]any{
+					"name": gatewayE2ERuntimeAuthResourceName,
+					"key":  "controller-token",
+				},
+				"operationCapabilitySecretRef": map[string]any{
+					"name": gatewayE2ERuntimeAuthResourceName,
+					"key":  "capability-secret",
+				},
+			},
+			"capabilities": map[string]any{
+				"runtimeInstanceID": gatewayE2ERuntimeName,
+				"profile": map[string]any{
+					"digest":                   string(profileDigest),
+					"digestSchemaVersion":      int32(harnessv2.ProfileDigestSchemaVersion),
+					"acpProfile":               profile.ACPProfile,
+					"adapterName":              gatewayE2ERuntimeName,
+					"adapterDigest":            zeroDigest,
+					"providerKind":             profile.ProviderKind,
+					"model":                    profile.Model,
+					"agentConfigurationDigest": profile.AgentConfigurationDigest,
+					"toolPolicyDigest":         profile.ToolPolicyDigest,
+					"approvalPolicyDigest":     profile.ApprovalPolicyDigest,
+					"mcpConfigurationDigest":   profile.MCPConfigurationDigest,
+					"workspaceIntent":          string(profile.WorkspaceIntent),
+					"proxyCredentialRole":      profile.ProxyCredentialRole,
+					"proxyCredentialScope":     profile.ProxyCredentialScope,
+					"resourceClass":            profile.ResourceClass,
+				},
+				"limits": map[string]any{
+					"maxResidentSessions":      10,
+					"maxConcurrentPrompts":     4,
+					"maxRequestBytes":          1048576,
+					"maxEventLineBytes":        262144,
+					"maxTerminalResultBytes":   1048576,
+					"maxBufferedEvents":        4096,
+					"maxUpdateEventsPerSecond": 100,
+					"minPromptLeaseMillis":     5000,
+					"maxPromptLeaseMillis":     120000,
+					"maxPendingPermissions":    32,
+					"maxWorkspaceDeltaBytes":   104857600,
+				},
+				"supportsDrain":                   false,
+				"supportsPublicationFinalization": false,
+				"workspaceGovernance": map[string]any{
+					"mode":                            "strict-governed",
+					"trusted":                         false,
+					"orkaOwnedWorkspaceDeltas":        true,
+					"promptScopedBrokerAuthorization": true,
+					"noDirectSCMPublication":          true,
+					"orkaOwnedCleanRoomPublication":   true,
+					"exactInstanceFencing":            true,
+					"duplicateSafeMutations":          true,
+					"cancellationSettlement":          true,
+				},
+			},
+		},
+	}, nil
+}
+
 func gatewayE2EAgentManifest() map[string]any {
 	return map[string]any{
 		"apiVersion": "core.orka.ai/v1alpha1",
@@ -982,5 +1052,4 @@ func dumpGatewayE2EDiagnostics(eventID, taskName string) {
 		_, _ = fmt.Fprintf(GinkgoWriter, "diagnostic: kubectl %s\n%s\n", strings.Join(args, " "), output)
 	}
 	dumpControllerManagerDiagnostics()
-	dumpAgentRuntimeExternalDiagnostics(gatewayE2ERuntimeName)
 }
diff --git a/test/e2e/helpers_test.go b/test/e2e/helpers_test.go
index 863db8311..020fa4e2b 100644
--- a/test/e2e/helpers_test.go
+++ b/test/e2e/helpers_test.go
@@ -26,6 +26,8 @@ import (
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
 	"github.com/orka-agents/orka/internal/llm"
 	openaiprovider "github.com/orka-agents/orka/internal/llm/openai"
 	"github.com/orka-agents/orka/internal/store"
@@ -214,39 +216,229 @@ func verifyResultAvailable(taskName string) {
 	}, 30*time.Second, time.Second).Should(Succeed())
 }
 
-// verifyHarnessWrapperMetadataForTask waits until a Task is planned for the
-// harness-wrapper backend and verifies selected metadata fields.
-func verifyHarnessWrapperMetadataForTask(taskName string, expected map[string]string, timeout time.Duration) {
+type acpWorkspaceExpectation struct {
+	Intent                    corev1alpha1.WorkspaceIntent
+	GitRepo                   string
+	Branch                    string
+	Ref                       string
+	SubPath                   string
+	ReadCredentialName        string
+	PublicationGitRepo        string
+	PublicationCredentialName string
+	PushBranch                string
+	PRBaseBranch              string
+	CreatePR                  *bool
+}
+
+type acpToolPolicyExpectation struct {
+	AllowedTools    []string
+	DisallowedTools []string
+	AllowBash       bool
+}
+
+type acpTaskExpectation struct {
+	ProviderKind    string
+	Model           string
+	ModelLimits     *corev1alpha1.ModelTokenLimits
+	WorkspaceIntent corev1alpha1.WorkspaceIntent
+	RuntimeImage    string
+	MaxTurns        *int32
+	AllowBash       *bool
+	AllowedTools    []string
+	DisallowedTools []string
+	ToolPolicy      *acpToolPolicyExpectation
+	SkillNames      []string
+	SessionName     string
+	Workspace       *acpWorkspaceExpectation
+	DeliveryState   *corev1alpha1.TaskDeliveryState
+	DeliveryOutcome *corev1alpha1.TaskDeliveryOutcome
+}
+
+func acpInt32(value int32) *int32 { return &value }
+func acpBool(value bool) *bool    { return &value }
+func acpDeliveryState(value corev1alpha1.TaskDeliveryState) *corev1alpha1.TaskDeliveryState {
+	return &value
+}
+func acpDeliveryOutcome(value corev1alpha1.TaskDeliveryOutcome) *corev1alpha1.TaskDeliveryOutcome {
+	return &value
+}
+
+// verifyACPTaskRuntimeForTask waits until an agent Task has been durably queued
+// for an ACP v2 RuntimePool and verifies the non-secret execution and delivery
+// projections. ACP Tasks never create one Kubernetes Job per prompt.
+func verifyACPTaskRuntimeForTask(taskName string, expected acpTaskExpectation, timeout time.Duration) {
 	Eventually(func(g Gomega) {
-		cmd := exec.Command("kubectl", "get", "task", taskName, "-n", namespace, "-o", "json")
+		task := fetchTaskForACPAssertion(g, taskName)
+		g.Expect(task.Status.JobName).To(BeEmpty(), "ACP runtime-pool tasks must not create worker Jobs")
+		g.Expect(task.Status.Phase).To(BeElementOf(
+			corev1alpha1.TaskPhasePending,
+			corev1alpha1.TaskPhaseRunning,
+			corev1alpha1.TaskPhaseSucceeded,
+			corev1alpha1.TaskPhaseFailed,
+			corev1alpha1.TaskPhaseCancelled,
+		))
+		g.Expect(task.Status.Execution).NotTo(BeNil(), "ACP execution status must be projected")
+		execution := task.Status.Execution
+		g.Expect(execution.State).NotTo(BeEmpty())
+		g.Expect(execution.Attempt).To(BeNumerically(">=", 1))
+		g.Expect(execution.PromptID).NotTo(BeEmpty())
+		g.Expect(execution.RuntimePoolName).NotTo(BeEmpty())
+		g.Expect(execution.RuntimePoolUID).NotTo(BeEmpty())
+		g.Expect(execution.RequestDigest).To(MatchRegexp(`^sha256:[a-f0-9]{64}$`))
+		g.Expect(execution.ControllerEpoch).To(BeNumerically(">=", 1))
+		g.Expect(task.Status.Delivery).NotTo(BeNil(), "ACP delivery status must be projected")
+		g.Expect(task.Status.Delivery.State).NotTo(BeEmpty())
+		if expected.DeliveryState != nil {
+			g.Expect(task.Status.Delivery.State).To(Equal(*expected.DeliveryState))
+		}
+		if expected.DeliveryOutcome != nil {
+			g.Expect(task.Status.Delivery.Outcome).To(Equal(*expected.DeliveryOutcome))
+		}
+
+		assertACPTaskSpec(g, task, expected)
+
+		cmd := exec.Command("kubectl", "get", "runtimepool", execution.RuntimePoolName, "-n", namespace, "-o", "json")
 		output, err := utils.Run(cmd)
 		g.Expect(err).NotTo(HaveOccurred())
+		var pool corev1alpha1.RuntimePool
+		g.Expect(json.Unmarshal([]byte(output), &pool)).To(Succeed())
+		g.Expect(string(pool.UID)).To(Equal(execution.RuntimePoolUID))
+		g.Expect(pool.Spec.TrustDomain.Namespace).To(Equal(namespace))
+		g.Expect(pool.Spec.Runtime.Image).To(MatchRegexp(`@sha256:[a-f0-9]{64}$`))
+		if expected.RuntimeImage != "" {
+			g.Expect(pool.Spec.Runtime.Image).To(Equal(expected.RuntimeImage))
+		}
+		g.Expect(pool.Spec.Runtime.Profile.ProtocolVersion).To(Equal(corev1alpha1.RuntimePoolProtocolHarnessV2))
+		g.Expect(pool.Spec.Runtime.Profile.Digest).To(MatchRegexp(`^sha256:[a-f0-9]{64}$`))
+		if expected.ProviderKind != "" {
+			g.Expect(pool.Spec.Runtime.Profile.ProviderKind).To(Equal(expected.ProviderKind))
+		}
+		if expected.Model != "" {
+			g.Expect(pool.Spec.Runtime.Profile.Model).To(Equal(expected.Model))
+		}
+		if expected.ModelLimits != nil {
+			g.Expect(pool.Spec.Runtime.Profile.ModelLimits).NotTo(BeNil())
+			g.Expect(*pool.Spec.Runtime.Profile.ModelLimits).To(Equal(*expected.ModelLimits))
+		}
+		if expected.WorkspaceIntent != "" {
+			g.Expect(pool.Spec.Runtime.Profile.WorkspaceIntent).To(Equal(expected.WorkspaceIntent))
+		}
+		if expected.ToolPolicy != nil {
+			toolPolicyDigest, err := harnessv2.CanonicalRuntimeToolPolicyDigest(
+				expected.ToolPolicy.AllowedTools,
+				expected.ToolPolicy.DisallowedTools,
+				expected.ToolPolicy.AllowBash,
+			)
+			g.Expect(err).NotTo(HaveOccurred())
+			g.Expect(pool.Spec.Runtime.Profile.ToolPolicyDigest).To(Equal(toolPolicyDigest))
+		}
+	}, timeout, time.Second).Should(Succeed())
+}
 
-		var task struct {
-			Metadata struct {
-				Annotations map[string]string `json:"annotations"`
-			} `json:"metadata"`
-			Status struct {
-				JobName string `json:"jobName"`
-				Phase   string `json:"phase"`
-			} `json:"status"`
+func assertACPTaskSpec(g Gomega, task corev1alpha1.Task, expected acpTaskExpectation) {
+	if expected.SessionName != "" {
+		g.Expect(task.Spec.SessionRef).NotTo(BeNil())
+		g.Expect(task.Spec.SessionRef.Name).To(Equal(expected.SessionName))
+	}
+	if expected.Workspace != nil {
+		g.Expect(task.Spec.Workspace).NotTo(BeNil())
+		workspace := task.Spec.Workspace
+		want := expected.Workspace
+		g.Expect(workspace.Intent).To(Equal(want.Intent))
+		g.Expect(workspace.GitRepo).To(Equal(want.GitRepo))
+		g.Expect(workspace.Branch).To(Equal(want.Branch))
+		g.Expect(workspace.Ref).To(Equal(want.Ref))
+		g.Expect(workspace.SubPath).To(Equal(want.SubPath))
+		g.Expect(workspace.PublicationGitRepo).To(Equal(want.PublicationGitRepo))
+		g.Expect(workspace.PushBranch).To(Equal(want.PushBranch))
+		g.Expect(workspace.PRBaseBranch).To(Equal(want.PRBaseBranch))
+		if want.CreatePR != nil {
+			g.Expect(workspace.CreatePR).To(Equal(*want.CreatePR))
 		}
-		err = json.Unmarshal([]byte(output), &task)
-		g.Expect(err).NotTo(HaveOccurred())
-		g.Expect(task.Status.JobName).To(BeEmpty(), "harness-wrapper tasks should not create worker Jobs")
-		g.Expect(task.Status.Phase).To(BeElementOf("Pending", "Running", "Succeeded", "Failed"))
-
-		annotations := task.Metadata.Annotations
-		g.Expect(annotations).To(HaveKey("orka.ai/harness-wrapper-turn-id"))
-		g.Expect(annotations).To(HaveKey("orka.ai/harness-wrapper-runtime-session-id"))
-		g.Expect(annotations).To(HaveKey("orka.ai/harness-wrapper-correlation-id"))
-		rawMetadata := annotations["orka.ai/harness-wrapper-metadata"]
-		g.Expect(rawMetadata).NotTo(BeEmpty())
-		metadata := map[string]string{}
-		err = json.Unmarshal([]byte(rawMetadata), &metadata)
-		g.Expect(err).NotTo(HaveOccurred())
-		for key, value := range expected {
-			g.Expect(metadata).To(HaveKeyWithValue(key, value))
+		if want.ReadCredentialName != "" {
+			g.Expect(workspace.ReadCredentialRef).NotTo(BeNil())
+			g.Expect(workspace.ReadCredentialRef.Name).To(Equal(want.ReadCredentialName))
+		}
+		if want.PublicationCredentialName != "" {
+			g.Expect(workspace.PublicationCredentialRef).NotTo(BeNil())
+			g.Expect(workspace.PublicationCredentialRef.Name).To(Equal(want.PublicationCredentialName))
+		}
+	}
+
+	if expected.MaxTurns == nil && expected.AllowBash == nil && len(expected.AllowedTools) == 0 &&
+		len(expected.DisallowedTools) == 0 && len(expected.SkillNames) == 0 {
+		return
+	}
+	g.Expect(task.Spec.AgentRef).NotTo(BeNil())
+	cmd := exec.Command("kubectl", "get", "agent", task.Spec.AgentRef.Name, "-n", namespace, "-o", "json")
+	output, err := utils.Run(cmd)
+	g.Expect(err).NotTo(HaveOccurred())
+	var agent corev1alpha1.Agent
+	g.Expect(json.Unmarshal([]byte(output), &agent)).To(Succeed())
+	g.Expect(agent.Spec.Runtime).NotTo(BeNil())
+
+	if expected.MaxTurns != nil {
+		actual := int32(50)
+		if agent.Spec.Runtime.DefaultMaxTurns != nil {
+			actual = *agent.Spec.Runtime.DefaultMaxTurns
+		}
+		if task.Spec.AgentRuntime != nil && task.Spec.AgentRuntime.MaxTurns != nil {
+			actual = *task.Spec.AgentRuntime.MaxTurns
+		}
+		g.Expect(actual).To(Equal(*expected.MaxTurns))
+	}
+	if expected.AllowBash != nil {
+		actual := true
+		if agent.Spec.Runtime.DefaultAllowBash != nil {
+			actual = *agent.Spec.Runtime.DefaultAllowBash
+		}
+		if task.Spec.AgentRuntime != nil && task.Spec.AgentRuntime.AllowBash != nil {
+			actual = *task.Spec.AgentRuntime.AllowBash
+		}
+		g.Expect(actual).To(Equal(*expected.AllowBash))
+	}
+	if len(expected.AllowedTools) > 0 {
+		actual := append([]string(nil), agent.Spec.Runtime.DefaultAllowedTools...)
+		if task.Spec.AgentRuntime != nil && len(task.Spec.AgentRuntime.AllowedTools) > 0 {
+			actual = append([]string(nil), task.Spec.AgentRuntime.AllowedTools...)
+		}
+		g.Expect(actual).To(ConsistOf(expected.AllowedTools))
+	}
+	if len(expected.DisallowedTools) > 0 {
+		g.Expect(task.Spec.AgentRuntime).NotTo(BeNil())
+		g.Expect(task.Spec.AgentRuntime.DisallowedTools).To(ConsistOf(expected.DisallowedTools))
+	}
+	if len(expected.SkillNames) > 0 {
+		actual := make([]string, 0, len(agent.Spec.Skills))
+		for _, skill := range agent.Spec.Skills {
+			actual = append(actual, skill.Name)
+		}
+		g.Expect(actual).To(ConsistOf(expected.SkillNames))
+	}
+}
+
+func fetchTaskForACPAssertion(g Gomega, taskName string) corev1alpha1.Task {
+	cmd := exec.Command("kubectl", "get", "task", taskName, "-n", namespace, "-o", "json")
+	output, err := utils.Run(cmd)
+	g.Expect(err).NotTo(HaveOccurred())
+	var task corev1alpha1.Task
+	g.Expect(json.Unmarshal([]byte(output), &task)).To(Succeed())
+	return task
+}
+
+func verifyACPTaskTerminalStatus(
+	taskName string,
+	executionOutcome corev1alpha1.TaskExecutionOutcome,
+	deliveryOutcomes []corev1alpha1.TaskDeliveryOutcome,
+	timeout time.Duration,
+) {
+	Eventually(func(g Gomega) {
+		task := fetchTaskForACPAssertion(g, taskName)
+		g.Expect(task.Status.Execution).NotTo(BeNil())
+		g.Expect(task.Status.Execution.Outcome).To(Equal(executionOutcome))
+		g.Expect(task.Status.Delivery).NotTo(BeNil())
+		if len(deliveryOutcomes) > 0 {
+			g.Expect(task.Status.Delivery.Outcome).To(BeElementOf(deliveryOutcomes))
 		}
 	}, timeout, time.Second).Should(Succeed())
 }
@@ -1204,6 +1396,34 @@ func liveCopilotProxyServicePort() int {
 	return value
 }
 
+func liveACPProviderProxyServiceNamespace() string {
+	if ns := strings.TrimSpace(firstSetEnv("E2E_LIVE_ACP_PROVIDER_PROXY_SERVICE_NAMESPACE")); ns != "" {
+		return ns
+	}
+	return "vekil-system"
+}
+
+func liveACPProviderProxyServiceName() string {
+	if name := strings.TrimSpace(firstSetEnv("E2E_LIVE_ACP_PROVIDER_PROXY_SERVICE_NAME")); name != "" {
+		return name
+	}
+	return "vekil"
+}
+
+func liveACPProviderProxyServicePort() int {
+	port := strings.TrimSpace(firstSetEnv("E2E_LIVE_ACP_PROVIDER_PROXY_SERVICE_PORT"))
+	if port == "" {
+		return 1337
+	}
+
+	value, err := strconv.Atoi(port)
+	if err != nil || value <= 0 {
+		return 1337
+	}
+
+	return value
+}
+
 func fetchProviderSnapshot(name string) providerSnapshot {
 	var snapshot providerSnapshot
 	Eventually(func(g Gomega) {
@@ -1651,7 +1871,43 @@ func dumpDebugInfo(taskNames ...string) {
 			_, _ = fmt.Fprintf(GinkgoWriter, "\n=== Task %s ===\n%s\n", name, output)
 		}
 
-		// Pod descriptions and logs for task
+		// Tool execution failures are persisted as task timeline events rather
+		// than Kubernetes Events. Read them through the in-cluster API service so
+		// delegation failures retain their exact, already-sanitized cause in CI.
+		eventPath := fmt.Sprintf(
+			"/api/v1/namespaces/%s/services/http:%s:8080/proxy/api/v1/tasks/%s/events?namespace=%s&type=ToolCallFailed",
+			url.PathEscape(namespace),
+			controllerAPIService,
+			url.PathEscape(name),
+			url.QueryEscape(namespace),
+		)
+		cmd = exec.Command("kubectl", "get", "--raw", eventPath)
+		output, err = utils.Run(cmd)
+		if err == nil && strings.TrimSpace(output) != "" {
+			_, _ = fmt.Fprintf(GinkgoWriter, "\n=== ToolCallFailed Events for task %s ===\n%s\n", name, output)
+		}
+
+		// ACP runtime-pool details (agent Tasks do not have per-Task Pods).
+		cmd = exec.Command("kubectl", "get", "task", name, "-n", namespace,
+			"-o", "jsonpath={.status.execution.runtimePoolName}")
+		poolName, poolErr := utils.Run(cmd)
+		poolName = strings.TrimSpace(poolName)
+		if poolErr == nil && poolName != "" {
+			cmd = exec.Command("kubectl", "get", "runtimepool", poolName, "-n", namespace, "-o", "yaml")
+			output, err = utils.Run(cmd)
+			if err == nil {
+				_, _ = fmt.Fprintf(GinkgoWriter, "\n=== RuntimePool %s ===\n%s\n", poolName, output)
+			}
+			cmd = exec.Command("kubectl", "get", "pods", "-n", "orka-runtimes",
+				"-l", fmt.Sprintf("orka.ai/runtime-pool-namespace=%s,orka.ai/runtime-pool-name=%s", namespace, poolName),
+				"-o", "wide")
+			output, err = utils.Run(cmd)
+			if err == nil {
+				_, _ = fmt.Fprintf(GinkgoWriter, "\n=== Runtime Pods for %s ===\n%s\n", poolName, output)
+			}
+		}
+
+		// Pod descriptions and logs for non-ACP tasks.
 		cmd = exec.Command("kubectl", "get", "pods", "-l", fmt.Sprintf("orka.ai/task=%s", name),
 			"-n", namespace, "-o", "wide")
 		output, err = utils.Run(cmd)
diff --git a/test/e2e/live_agent_runtime_matrix_manifest_unit_test.go b/test/e2e/live_agent_runtime_matrix_manifest_unit_test.go
new file mode 100644
index 000000000..763e22473
--- /dev/null
+++ b/test/e2e/live_agent_runtime_matrix_manifest_unit_test.go
@@ -0,0 +1,94 @@
+//go:build e2e
+// +build e2e
+
+/*
+Copyright (c) 2026.
+
+MIT License - see LICENSE file for details.
+*/
+
+package e2e
+
+import (
+	"testing"
+
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
+)
+
+func TestLiveRuntimeAgentManifestsPinHarnessV2Contract(t *testing.T) {
+	t.Parallel()
+
+	for _, runtimeType := range []string{"codex", "claude", "copilot", "opencode"} {
+		runtimeType := runtimeType
+		t.Run(runtimeType, func(t *testing.T) {
+			t.Parallel()
+			agent := runtimeAgentManifest(runtimeType+"-agent", runtimeType, "test-model", 5, nil)
+			runtime := manifestNestedMap(t, agent, "spec", "runtime")
+			if got := runtime["contractVersion"]; got != corev1alpha1.AgentRuntimeContractHarnessV2 {
+				t.Fatalf("contractVersion = %#v, want %q", got, corev1alpha1.AgentRuntimeContractHarnessV2)
+			}
+		})
+	}
+}
+
+func TestLiveRuntimeManifestsOmitCodexBashPolicy(t *testing.T) {
+	t.Parallel()
+
+	codexAgent := runtimeAgentManifest("codex-agent", "codex", "gpt-test", 5, nil)
+	codexAgentRuntime := manifestNestedMap(t, codexAgent, "spec", "runtime")
+	if _, present := codexAgentRuntime["defaultAllowBash"]; present {
+		t.Fatal("Codex Agent manifest must omit spec.runtime.defaultAllowBash")
+	}
+
+	codexTask := runtimeAgentTaskManifest(
+		"codex-task",
+		"codex-agent",
+		"read the repository",
+		4,
+		nil,
+		nil,
+		"",
+		nil,
+		nil,
+	)
+	codexTaskRuntime := manifestNestedMap(t, codexTask, "spec", "agentRuntime")
+	if _, present := codexTaskRuntime["allowBash"]; present {
+		t.Fatal("Codex Task manifest must omit spec.agentRuntime.allowBash")
+	}
+
+	claudeAgent := runtimeAgentManifest("claude-agent", "claude", "claude-test", 5, boolPtr(false))
+	claudeAgentRuntime := manifestNestedMap(t, claudeAgent, "spec", "runtime")
+	if got, present := claudeAgentRuntime["defaultAllowBash"]; !present || got != false {
+		t.Fatalf("Claude Agent defaultAllowBash = %#v, present = %t; want false and present", got, present)
+	}
+
+	claudeTask := runtimeAgentTaskManifest(
+		"claude-task",
+		"claude-agent",
+		"reply exactly",
+		3,
+		boolPtr(false),
+		nil,
+		"",
+		nil,
+		nil,
+	)
+	claudeTaskRuntime := manifestNestedMap(t, claudeTask, "spec", "agentRuntime")
+	if got, present := claudeTaskRuntime["allowBash"]; !present || got != false {
+		t.Fatalf("Claude Task allowBash = %#v, present = %t; want false and present", got, present)
+	}
+}
+
+func manifestNestedMap(t *testing.T, manifest map[string]any, keys ...string) map[string]any {
+	t.Helper()
+
+	current := manifest
+	for _, key := range keys {
+		next, ok := current[key].(map[string]any)
+		if !ok {
+			t.Fatalf("manifest field %q = %#v, want map[string]any", key, current[key])
+		}
+		current = next
+	}
+	return current
+}
diff --git a/test/e2e/live_agent_runtime_matrix_test.go b/test/e2e/live_agent_runtime_matrix_test.go
index 029536a7c..92ae5f8e9 100644
--- a/test/e2e/live_agent_runtime_matrix_test.go
+++ b/test/e2e/live_agent_runtime_matrix_test.go
@@ -16,8 +16,8 @@ import (
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
 	"github.com/orka-agents/orka/test/utils"
-	workercommon "github.com/orka-agents/orka/workers/common"
 )
 
 const (
@@ -29,31 +29,26 @@ const (
 
 var _ = Describe("Live Agent Runtime Matrix", Ordered, func() {
 	const (
-		codexSecretName        = "e2e-live-runtime-codex-secret"
 		codexAgentName         = "e2e-live-runtime-codex-agent"
-		codexTaskWriteName     = "e2e-live-runtime-codex-write"
 		codexTaskReadName      = "e2e-live-runtime-codex-read"
-		codexMarker            = "ORKA_LIVE_RUNTIME_MARKER_1"
-		codexMarkerFile        = "live-runtime-marker.txt"
-		claudeSecretName       = "e2e-live-runtime-claude-secret"
+		opencodeAgentName      = "e2e-live-runtime-opencode-agent"
+		opencodeTaskReadName   = "e2e-live-runtime-opencode-read"
 		claudeAgentName        = "e2e-live-runtime-claude-agent"
 		claudeTaskName         = "e2e-live-runtime-claude-task"
 		claudeExpectedResponse = "ORKA_LIVE_CLAUDE_OK"
-		claudeProxyPFPort      = 18189
-		copilotAgentName       = "e2e-live-runtime-copilot-agent"
-		copilotTaskName        = "e2e-live-runtime-copilot-task"
 	)
 
 	var (
-		apiBaseURL         string
-		cancelControllerPF context.CancelFunc
-		controllerPFCmd    *exec.Cmd
-		token              string
-		gptModel           string
-		gptModelSkipReason string
-		claudeModel        string
-		geminiModel        string
-		claudeSessionName  string
+		apiBaseURL              string
+		cancelControllerPF      context.CancelFunc
+		controllerPFCmd         *exec.Cmd
+		token                   string
+		gptModel                string
+		gptModelSkipReason      string
+		opencodeModel           string
+		opencodeModelSkipReason string
+		claudeModel             string
+		claudeSessionName       string
 	)
 
 	BeforeAll(func() {
@@ -74,18 +69,18 @@ var _ = Describe("Live Agent Runtime Matrix", Ordered, func() {
 
 		By("verifying the live proxy is ready")
 		ready := waitForProxyReadyViaServiceProxy(
-			liveCopilotProxyServiceNamespace(),
-			liveCopilotProxyServiceName(),
-			liveCopilotProxyServicePort(),
+			liveACPProviderProxyServiceNamespace(),
+			liveACPProviderProxyServiceName(),
+			liveACPProviderProxyServicePort(),
 		)
 		Expect(ready.Status).To(Equal("ready"))
 		Expect(ready.Error).To(BeEmpty())
 
 		By("discovering live runtime models by family")
 		runtimeCatalog, err := fetchProxyModelCatalogViaServiceProxy(
-			liveCopilotProxyServiceNamespace(),
-			liveCopilotProxyServiceName(),
-			liveCopilotProxyServicePort(),
+			liveACPProviderProxyServiceNamespace(),
+			liveACPProviderProxyServiceName(),
+			liveACPProviderProxyServicePort(),
 		)
 		Expect(err).NotTo(HaveOccurred())
 		gptModel = strings.TrimSpace(os.Getenv("E2E_LIVE_CODEX_RUNTIME_MODEL"))
@@ -105,32 +100,34 @@ var _ = Describe("Live Agent Runtime Matrix", Ordered, func() {
 				gptModelSkipReason = "no Codex-family GPT model with /responses support exposed"
 			}
 		}
-		By("probing Claude-family models through the live Anthropic Messages endpoint")
-		proxyBaseURL, cancelProxyPF, proxyPFCmd, err := startServicePortForward(
-			liveCopilotProxyServiceNamespace(),
-			liveCopilotProxyServiceName(),
-			claudeProxyPFPort,
-			liveCopilotProxyServicePort(),
-		)
-		Expect(err).NotTo(HaveOccurred())
-		DeferCleanup(func() {
-			stopPortForward(cancelProxyPF, proxyPFCmd)
-		})
+		opencodeModel = strings.TrimSpace(os.Getenv("E2E_LIVE_OPENCODE_RUNTIME_MODEL"))
+		if opencodeModel != "" {
+			if !openCodeModelSupportsEndpoint(runtimeCatalog, opencodeModel, "/chat/completions") {
+				opencodeModelSkipReason = "configured E2E_LIVE_OPENCODE_RUNTIME_MODEL does not advertise /chat/completions support"
+				opencodeModel = ""
+			}
+		} else {
+			opencodeModel = firstPreferredProxyModelSupportingEndpoint(
+				runtimeCatalog,
+				"/chat/completions",
+				liveCopilotProxyChatGPTModelPreferences,
+				liveCopilotProxyGPTModelPrefixes...,
+			)
+			if opencodeModel == "" {
+				opencodeModelSkipReason = "no GPT-family model with /chat/completions support exposed"
+			}
+		}
 
-		claudeModel, err = firstUsableProxyAnthropicMessagesModel(
-			proxyBaseURL,
+		if opencodeModel != "" && !strings.Contains(opencodeModel, "/") {
+			opencodeModel = "openai/" + opencodeModel
+		}
+
+		claudeModel = firstPreferredProxyModel(
 			runtimeCatalog,
 			liveCopilotProxyClaudeModelPreferences,
 			liveCopilotProxyClaudeModelPrefixes...,
 		)
-		Expect(err).NotTo(HaveOccurred())
-		Expect(claudeModel).NotTo(BeEmpty(), "proxy service should expose a usable Claude-family model")
-		geminiModel = firstPreferredProxyModel(
-			runtimeCatalog,
-			liveCopilotProxyGeminiModelPreferences,
-			liveCopilotProxyGeminiModelPrefixes...,
-		)
-		Expect(geminiModel).NotTo(BeEmpty(), "proxy service should expose a Gemini-family model")
+		Expect(claudeModel).NotTo(BeEmpty(), "proxy service should expose a Claude-family model")
 
 		claudeSessionName = fmt.Sprintf("e2e-live-runtime-claude-%d", time.Now().UnixNano())
 	})
@@ -141,102 +138,121 @@ var _ = Describe("Live Agent Runtime Matrix", Ordered, func() {
 
 	AfterEach(func() {
 		dumpDebugInfo(
-			codexTaskWriteName,
 			codexTaskReadName,
+			opencodeTaskReadName,
 			claudeTaskName,
-			copilotTaskName,
 		)
 		dumpLiveCopilotProxyDebugInfo()
 	})
 
-	It("should let codex consume priorTaskRef state on a git workspace", func() {
+	It("should run Codex through ACP v2 against a pinned read workspace", func() {
 		if gptModel == "" {
 			Skip("Skipping Codex runtime live proxy check: " + gptModelSkipReason)
 		}
 
 		DeferCleanup(func() {
-			for _, resource := range []struct {
-				kind string
-				name string
-			}{
-				{"task", codexTaskReadName},
-				{"task", codexTaskWriteName},
-				{"agent", codexAgentName},
-				{"secret", codexSecretName},
-			} {
-				cmd := exec.Command("kubectl", "delete", resource.kind, resource.name, "-n", namespace, "--ignore-not-found")
-				_, _ = utils.Run(cmd)
-			}
+			cmd := exec.Command("kubectl", "delete", "task", codexTaskReadName, "-n", namespace, "--ignore-not-found")
+			_, _ = utils.Run(cmd)
+			cmd = exec.Command("kubectl", "delete", "agent", codexAgentName, "-n", namespace, "--ignore-not-found")
+			_, _ = utils.Run(cmd)
 		})
 
-		By("creating the prior task that writes the marker file into the pinned repository")
-		writeMarkerCommand := fmt.Sprintf(
-			"printf '%%s\\n' %s > %s && echo CREATED",
-			shellSingleQuote(codexMarker),
-			shellSingleQuote(codexMarkerFile),
-		)
-		err := applyManifestJSON(runtimeContainerTaskManifest(
-			codexTaskWriteName,
-			[]string{"sh", "-c"},
-			[]string{writeMarkerCommand},
-			&runtimeWorkspaceConfig{GitRepo: liveRuntimeRepoURL, Ref: liveRuntimeRepoRef},
-		))
+		By("creating a Codex agent backed by the discovered GPT-family model")
+		err := applyManifestJSON(runtimeAgentManifest(codexAgentName, "codex", gptModel, 5, nil))
 		Expect(err).NotTo(HaveOccurred())
 
-		By("verifying the prior task has the expected workspace and runtime wiring")
-		verifyJobCreatedForTask(codexTaskWriteName, 2*time.Minute)
-		runtimeAssertJobBasics(
-			codexTaskWriteName,
-			generalWorkerImage,
-			map[string]string{
-				"ORKA_GIT_REPO": liveRuntimeRepoURL,
-				"ORKA_GIT_REF":  liveRuntimeRepoRef,
-			},
+		By("creating a Codex task against a pinned public repo/ref")
+		err = applyManifestJSON(runtimeAgentTaskManifest(
+			codexTaskReadName,
+			codexAgentName,
+			fmt.Sprintf("Read README in the repository root and reply with exactly %s and nothing else.", liveRuntimeRepoSentinel),
+			4,
+			nil,
+			&runtimeWorkspaceConfig{GitRepo: liveRuntimeRepoURL, Ref: liveRuntimeRepoRef},
 			"",
 			nil,
 			nil,
-		)
+		))
+		Expect(err).NotTo(HaveOccurred())
+
+		// This Codex case verifies the requested runtime projection. The OpenCode
+		// case below is the adversarial read-intent check: it requests Bash and
+		// mutation tools, then asserts the derived deny policy and ReadValidated.
+		verifyACPTaskRuntimeForTask(codexTaskReadName, acpTaskExpectation{
+			ProviderKind:    "codex",
+			Model:           gptModel,
+			WorkspaceIntent: "read",
+			MaxTurns:        acpInt32(4),
+			Workspace: &acpWorkspaceExpectation{
+				Intent:  "read",
+				GitRepo: liveRuntimeRepoURL,
+				Ref:     liveRuntimeRepoRef,
+			},
+		}, 2*time.Minute)
+		Expect(waitForTaskCompletion(codexTaskReadName, liveRuntimeTimeout)).To(Equal("Succeeded"))
+		verifyResultAvailable(codexTaskReadName)
+		summary := strings.TrimSpace(fetchTaskResultSummaryViaAPI(apiBaseURL, token, codexTaskReadName))
+		Expect(summary).To(HaveSuffix(liveRuntimeRepoSentinel))
+	})
+
+	It("should run OpenCode through ACP v2 and enforce read intent", func() {
+		if opencodeModel == "" {
+			Skip("Skipping OpenCode runtime live proxy check: " + opencodeModelSkipReason)
+		}
 
-		By("waiting for the prior task to succeed and emit a structured diff result")
-		waitForCodexRuntimeTaskOrSkip(apiBaseURL, token, codexTaskWriteName, liveRuntimeTimeout)
-		verifyResultAvailable(codexTaskWriteName)
-		firstResult := workercommon.ParseStructuredResult(fetchTaskResultViaAPI(apiBaseURL, token, codexTaskWriteName))
-		Expect(strings.TrimSpace(firstResult.Summary)).To(ContainSubstring("CREATED"))
-		Expect(strings.TrimSpace(firstResult.Diff)).NotTo(BeEmpty(), "prior task should produce a diff for priorTaskRef")
-		Expect(firstResult.Files).To(ContainElement(codexMarkerFile))
-
-		By("creating a Codex runtime secret that routes OpenAI traffic through the live proxy")
-		err = createK8sSecret(codexSecretName, namespace, map[string]string{
-			"OPENAI_API_KEY":  "dummy-live-codex-key",
-			"OPENAI_BASE_URL": e2eLiveCopilotProxyBaseURL,
+		DeferCleanup(func() {
+			cmd := exec.Command("kubectl", "delete", "task", opencodeTaskReadName, "-n", namespace, "--ignore-not-found")
+			_, _ = utils.Run(cmd)
+			cmd = exec.Command("kubectl", "delete", "agent", opencodeAgentName, "-n", namespace, "--ignore-not-found")
+			_, _ = utils.Run(cmd)
 		})
-		Expect(err).NotTo(HaveOccurred())
 
-		By("creating a Codex agent backed by the discovered GPT-family model")
-		err = applyManifestJSON(runtimeAgentManifest(codexAgentName, "codex", codexSecretName, gptModel, 5, true))
+		By("creating an OpenCode agent with native mutation and shell tools requested")
+		err := applyManifestJSON(runtimeAgentManifest(opencodeAgentName, "opencode", opencodeModel, 5, boolPtr(true)))
 		Expect(err).NotTo(HaveOccurred())
 
-		By("creating the Codex task that reads the file through priorTaskRef")
+		By("creating a read-intent OpenCode task that attempts forbidden mutation before reading")
 		err = applyManifestJSON(runtimeAgentTaskManifest(
-			codexTaskReadName,
-			codexAgentName,
-			fmt.Sprintf("The priorTaskRef workspace diff has already been applied to this checkout before you start. Do not run commands or inspect files. Reply with exactly %s and nothing else.", codexMarker),
-			1,
+			opencodeTaskReadName,
+			opencodeAgentName,
+			fmt.Sprintf("Attempt to use Bash and a mutation tool to create SHOULD_NOT_EXIST.txt; those tools must be unavailable. Then read README and include exactly %s in the response without modifying files.", liveRuntimeRepoSentinel),
+			4,
 			boolPtr(true),
 			&runtimeWorkspaceConfig{GitRepo: liveRuntimeRepoURL, Ref: liveRuntimeRepoRef},
-			codexTaskWriteName,
 			"",
 			nil,
 			nil,
 		))
 		Expect(err).NotTo(HaveOccurred())
 
-		By("waiting for the Codex task to return the exact marker from the prior diff")
-		waitForCodexRuntimeTaskOrSkip(apiBaseURL, token, codexTaskReadName, liveRuntimeTimeout)
-		verifyResultAvailable(codexTaskReadName)
-		// Harness-wrapper-backed agent tasks do not create a worker Job. The result
-		// assertion below verifies the priorTaskRef workspace diff was consumed.
-		Expect(strings.TrimSpace(fetchTaskResultSummaryViaAPI(apiBaseURL, token, codexTaskReadName))).To(Equal(codexMarker))
+		verifyACPTaskRuntimeForTask(opencodeTaskReadName, acpTaskExpectation{
+			ProviderKind: "opencode",
+			Model:        opencodeModel,
+			ModelLimits: &corev1alpha1.ModelTokenLimits{
+				Context: 32768,
+				Output:  4096,
+			},
+			WorkspaceIntent: "read",
+			MaxTurns:        acpInt32(4),
+			AllowBash:       acpBool(true),
+			ToolPolicy: &acpToolPolicyExpectation{
+				AllowedTools:    []string{"glob", "read"},
+				DisallowedTools: []string{"apply_patch", "bash", "edit", "grep", "write"},
+				AllowBash:       false,
+			},
+			Workspace: &acpWorkspaceExpectation{
+				Intent:  "read",
+				GitRepo: liveRuntimeRepoURL,
+				Ref:     liveRuntimeRepoRef,
+			},
+		}, 2*time.Minute)
+		Expect(waitForTaskCompletion(opencodeTaskReadName, liveRuntimeTimeout)).To(Equal("Succeeded"))
+		verifyACPTaskRuntimeForTask(opencodeTaskReadName, acpTaskExpectation{
+			DeliveryState:   acpDeliveryState("ReadValidated"),
+			DeliveryOutcome: acpDeliveryOutcome("ReadValidated"),
+		}, 2*time.Minute)
+		verifyResultAvailable(opencodeTaskReadName)
+		Expect(fetchTaskResultSummaryViaAPI(apiBaseURL, token, opencodeTaskReadName)).To(ContainSubstring(liveRuntimeRepoSentinel))
 	})
 
 	It("should run claude code through the live proxy with session wiring and exact output", func() {
@@ -245,8 +261,6 @@ var _ = Describe("Live Agent Runtime Matrix", Ordered, func() {
 			_, _ = utils.Run(cmd)
 			cmd = exec.Command("kubectl", "delete", "agent", claudeAgentName, "-n", namespace, "--ignore-not-found")
 			_, _ = utils.Run(cmd)
-			cmd = exec.Command("kubectl", "delete", "secret", claudeSecretName, "-n", namespace, "--ignore-not-found")
-			_, _ = utils.Run(cmd)
 			_, _, _ = doAuthorizedJSONRequest(
 				http.MethodDelete,
 				fmt.Sprintf("%s/api/v1/sessions/%s", strings.TrimRight(apiBaseURL, "/"), claudeSessionName),
@@ -256,38 +270,33 @@ var _ = Describe("Live Agent Runtime Matrix", Ordered, func() {
 			)
 		})
 
-		By("creating a Claude runtime secret that routes Anthropic traffic through the live proxy")
-		err := createK8sSecret(claudeSecretName, namespace, map[string]string{
-			"ANTHROPIC_API_KEY":  "dummy-live-claude-key",
-			"ANTHROPIC_BASE_URL": liveCopilotProxyRootURL(),
-		})
-		Expect(err).NotTo(HaveOccurred())
-
 		By("creating a Claude agent backed by the discovered Claude-family model")
-		err = applyManifestJSON(runtimeAgentManifest(claudeAgentName, "claude", claudeSecretName, claudeModel, 5, false))
+		err := applyManifestJSON(runtimeAgentManifest(claudeAgentName, "claude", claudeModel, 5, boolPtr(false)))
 		Expect(err).NotTo(HaveOccurred())
 
 		By("creating a Claude task with sessionRef wiring")
-		claudeTask := runtimeAgentTaskManifest(
+		err = applyManifestJSON(runtimeAgentTaskManifest(
 			claudeTaskName,
 			claudeAgentName,
 			fmt.Sprintf("Reply with exactly %s and nothing else.", claudeExpectedResponse),
 			3,
 			boolPtr(false),
 			nil,
-			"",
 			claudeSessionName,
 			boolPtr(true),
 			boolPtr(true),
-		)
-		claudeTaskSpec, ok := claudeTask["spec"].(map[string]any)
-		Expect(ok).To(BeTrue())
-		claudeTaskSpec["env"] = []map[string]string{
-			{"name": "CLAUDE_CODE_DISABLE_ADVISOR_TOOL", "value": "1"},
-		}
-		err = applyManifestJSON(claudeTask)
+		))
 		Expect(err).NotTo(HaveOccurred())
 
+		verifyACPTaskRuntimeForTask(claudeTaskName, acpTaskExpectation{
+			ProviderKind:    "claude",
+			Model:           claudeModel,
+			WorkspaceIntent: "read",
+			MaxTurns:        acpInt32(3),
+			AllowBash:       acpBool(false),
+			SessionName:     claudeSessionName,
+		}, 2*time.Minute)
+
 		By("waiting for the Claude task to return the exact sentinel")
 		Expect(waitForTaskCompletion(claudeTaskName, liveRuntimeTimeout)).To(Equal("Succeeded"))
 		verifyResultAvailable(claudeTaskName)
@@ -295,44 +304,18 @@ var _ = Describe("Live Agent Runtime Matrix", Ordered, func() {
 		Expect(fetchSessionViaAPI(apiBaseURL, token, claudeSessionName)).To(ContainSubstring(claudeExpectedResponse))
 	})
 
-	It("should run copilot against a pinned public checkout with a Gemini-family model", func() {
-		skipIfNoKey("E2E_GITHUB_TOKEN")
-
-		DeferCleanup(func() {
-			cmd := exec.Command("kubectl", "delete", "task", copilotTaskName, "-n", namespace, "--ignore-not-found")
-			_, _ = utils.Run(cmd)
-			cmd = exec.Command("kubectl", "delete", "agent", copilotAgentName, "-n", namespace, "--ignore-not-found")
-			_, _ = utils.Run(cmd)
-		})
-
-		By("creating a Copilot agent backed by the discovered Gemini-family model")
-		err := applyManifestJSON(runtimeAgentManifest(copilotAgentName, "copilot", "e2e-github-secret", geminiModel, 5, true))
-		Expect(err).NotTo(HaveOccurred())
-
-		By("creating a Copilot task against a pinned public repo/ref")
-		err = applyManifestJSON(runtimeAgentTaskManifest(
-			copilotTaskName,
-			copilotAgentName,
-			fmt.Sprintf("Read the README file in the repository root and reply with exactly %s and nothing else.", liveRuntimeRepoSentinel),
-			4,
-			boolPtr(true),
-			&runtimeWorkspaceConfig{GitRepo: liveRuntimeRepoURL, Ref: liveRuntimeRepoRef},
-			"",
-			"",
-			nil,
-			nil,
-		))
-		Expect(err).NotTo(HaveOccurred())
-
-		By("waiting for the Copilot task to return the exact README sentinel")
-		Expect(waitForTaskCompletion(copilotTaskName, liveRuntimeTimeout)).To(Equal("Succeeded"))
-		verifyResultAvailable(copilotTaskName)
-		Expect(strings.TrimSpace(fetchTaskResultSummaryViaAPI(apiBaseURL, token, copilotTaskName))).To(Equal(liveRuntimeRepoSentinel))
+	It("should publish a digest-pinned Copilot ACP image for admission coverage", func() {
+		Expect(acpCopilotRuntimeRef).To(MatchRegexp(`@sha256:[a-f0-9]{64}$`))
 	})
 })
 
-func shellSingleQuote(value string) string {
-	return "'" + strings.ReplaceAll(value, "'", "'\\''") + "'"
+func openCodeModelSupportsEndpoint(catalog proxyModelCatalog, model, endpoint string) bool {
+	model = strings.TrimSpace(model)
+	if catalog.modelSupportsEndpoint(model, endpoint) {
+		return true
+	}
+	_, bare, ok := strings.Cut(model, "/")
+	return ok && strings.TrimSpace(bare) != "" && catalog.modelSupportsEndpoint(strings.TrimSpace(bare), endpoint)
 }
 
 type runtimeWorkspaceConfig struct {
@@ -340,38 +323,28 @@ type runtimeWorkspaceConfig struct {
 	Ref     string
 }
 
-func waitForCodexRuntimeTaskOrSkip(apiBaseURL, token, taskName string, timeout time.Duration) {
-	phase := waitForTaskCompletion(taskName, timeout)
-	if phase == "Succeeded" {
-		return
+func runtimeAgentManifest(name, runtimeType, modelName string, defaultMaxTurns int, defaultAllowBash *bool) map[string]any {
+	runtime := map[string]any{
+		"type":            runtimeType,
+		"contractVersion": corev1alpha1.AgentRuntimeContractHarnessV2,
+		"defaultMaxTurns": defaultMaxTurns,
 	}
-	result := fetchTaskResultViaAPI(apiBaseURL, token, taskName)
-	summary := workercommon.ParseStructuredResult(result).Summary
-	if isLiveCopilotCodexModelUnavailable(result) || isLiveCopilotCodexModelUnavailable(summary) {
-		Skip("Skipping Codex runtime live proxy check: selected model is unavailable for copilot-language-server integrator")
+	if defaultAllowBash != nil {
+		runtime["defaultAllowBash"] = *defaultAllowBash
 	}
-	Expect(phase).To(Equal("Succeeded"), "Codex runtime task failed: %s", summary)
-}
-
-func isLiveCopilotCodexModelUnavailable(text string) bool {
-	lower := strings.ToLower(text)
-	return strings.Contains(lower, "model_not_available_for_integrator") ||
-		(strings.Contains(lower, "requested model is not available") && strings.Contains(lower, "copilot-language-server"))
-}
-
-func runtimeAgentManifest(name, runtimeType, secretName, modelName string, defaultMaxTurns int, defaultAllowBash bool) map[string]any {
 	spec := map[string]any{
-		"runtime": map[string]any{
-			"type":             runtimeType,
-			"defaultMaxTurns":  defaultMaxTurns,
-			"defaultAllowBash": defaultAllowBash,
-		},
+		"runtime": runtime,
 	}
-	if secretName != "" {
-		spec["secretRef"] = map[string]any{"name": secretName}
+	if runtimeType == "opencode" {
+		spec["runtime"].(map[string]any)["defaultAllowedTools"] = []string{"Read", "Write", "Edit", "Bash", "Glob", "Grep"}
 	}
 	if modelName != "" {
-		spec["model"] = map[string]any{"name": modelName}
+		model := map[string]any{"name": modelName}
+		if runtimeType == "opencode" {
+			model["contextWindow"] = 32768
+			model["maxTokens"] = 4096
+		}
+		spec["model"] = model
 	}
 
 	return map[string]any{
@@ -390,7 +363,6 @@ func runtimeAgentTaskManifest(
 	maxTurns int,
 	allowBash *bool,
 	workspace *runtimeWorkspaceConfig,
-	priorTaskName string,
 	sessionName string,
 	sessionCreate, sessionAppend *bool,
 ) map[string]any {
@@ -400,21 +372,18 @@ func runtimeAgentTaskManifest(
 	if allowBash != nil {
 		agentRuntime["allowBash"] = *allowBash
 	}
-	if workspace != nil {
-		agentRuntime["workspace"] = map[string]any{
-			"gitRepo": workspace.GitRepo,
-			"ref":     workspace.Ref,
-		}
-	}
-
 	spec := map[string]any{
 		"type":         "agent",
 		"prompt":       prompt,
 		"agentRef":     map[string]any{"name": agentName},
 		"agentRuntime": agentRuntime,
 	}
-	if priorTaskName != "" {
-		spec["priorTaskRef"] = map[string]any{"name": priorTaskName}
+	if workspace != nil {
+		spec["workspace"] = map[string]any{
+			"intent":  "read",
+			"gitRepo": workspace.GitRepo,
+			"ref":     workspace.Ref,
+		}
 	}
 	if sessionName != "" {
 		sessionRef := map[string]any{"name": sessionName}
@@ -438,37 +407,6 @@ func runtimeAgentTaskManifest(
 	}
 }
 
-func runtimeContainerTaskManifest(
-	name string,
-	command []string,
-	args []string,
-	workspace *runtimeWorkspaceConfig,
-) map[string]any {
-	spec := map[string]any{
-		"type":    "container",
-		"command": command,
-	}
-	if len(args) > 0 {
-		spec["args"] = args
-	}
-	if workspace != nil {
-		spec["workspace"] = map[string]any{
-			"gitRepo": workspace.GitRepo,
-			"ref":     workspace.Ref,
-		}
-	}
-
-	return map[string]any{
-		"apiVersion": "core.orka.ai/v1alpha1",
-		"kind":       "Task",
-		"metadata": map[string]any{
-			"name":      name,
-			"namespace": namespace,
-		},
-		"spec": spec,
-	}
-}
-
 func applyManifestJSON(manifest any) error {
 	payload, err := json.Marshal(manifest)
 	if err != nil {
@@ -481,116 +419,6 @@ func applyManifestJSON(manifest any) error {
 	return err
 }
 
-func runtimeAssertJobBasics(
-	taskName, expectedImage string,
-	requiredEnv map[string]string,
-	expectedSecret string,
-	forbiddenEnvKeys []string,
-	expectedInitContainers []string,
-) {
-	snapshot := runtimeFetchTaskJobSnapshot(taskName)
-	Expect(snapshot.Containers).NotTo(BeEmpty())
-
-	container := snapshot.Containers[0]
-	Expect(container.Image).To(Equal(expectedImage))
-
-	envMap := runtimeEnvMapFromContainer(container)
-	for key, value := range requiredEnv {
-		Expect(envMap).To(HaveKeyWithValue(key, value))
-	}
-	for _, key := range forbiddenEnvKeys {
-		Expect(envMap).NotTo(HaveKey(key))
-	}
-
-	if expectedSecret != "" {
-		Expect(runtimeSecretNamesFromEnvFrom(container.EnvFrom)).To(ContainElement(expectedSecret))
-	}
-
-	if len(expectedInitContainers) > 0 {
-		initNames := make([]string, 0, len(snapshot.InitContainers))
-		for _, initContainer := range snapshot.InitContainers {
-			initNames = append(initNames, initContainer.Name)
-		}
-		for _, initName := range expectedInitContainers {
-			Expect(initNames).To(ContainElement(initName))
-		}
-	}
-}
-
-func runtimeFetchTaskJobSnapshot(taskName string) runtimeJobPodSpecSnapshot {
-	var snapshot runtimeJobPodSpecSnapshot
-	Eventually(func(g Gomega) {
-		cmd := exec.Command("kubectl", "get", "jobs",
-			"-l", fmt.Sprintf("orka.ai/task=%s", taskName),
-			"-o", "json",
-			"-n", namespace,
-		)
-		output, err := utils.Run(cmd)
-		g.Expect(err).NotTo(HaveOccurred(), "Failed to get Job for task %s", taskName)
-
-		var payload runtimeJobListSnapshot
-		g.Expect(json.Unmarshal([]byte(output), &payload)).To(Succeed())
-		g.Expect(payload.Items).NotTo(BeEmpty(), "Job list should not be empty")
-
-		snapshot = payload.Items[0].Spec.Template.Spec
-		g.Expect(snapshot.Containers).NotTo(BeEmpty(), "Job should have at least one container")
-	}, 2*time.Minute, time.Second).Should(Succeed())
-
-	return snapshot
-}
-
-func runtimeEnvMapFromContainer(container runtimeJobContainerSnapshot) map[string]string {
-	envMap := make(map[string]string, len(container.Env))
-	for _, envVar := range container.Env {
-		envMap[envVar.Name] = envVar.Value
-	}
-	return envMap
-}
-
-func runtimeSecretNamesFromEnvFrom(envFrom []runtimeJobEnvFromSnapshot) []string {
-	names := make([]string, 0, len(envFrom))
-	for _, source := range envFrom {
-		if source.SecretRef != nil && strings.TrimSpace(source.SecretRef.Name) != "" {
-			names = append(names, strings.TrimSpace(source.SecretRef.Name))
-		}
-	}
-	return names
-}
-
-type runtimeJobSecretRefSnapshot struct {
-	Name string `json:"name"`
-}
-
-type runtimeJobEnvFromSnapshot struct {
-	SecretRef *runtimeJobSecretRefSnapshot `json:"secretRef,omitempty"`
-}
-
-type runtimeJobContainerSnapshot struct {
-	Name    string                      `json:"name"`
-	Image   string                      `json:"image"`
-	Env     []envVar                    `json:"env"`
-	EnvFrom []runtimeJobEnvFromSnapshot `json:"envFrom"`
-}
-
-type runtimeJobPodSpecSnapshot struct {
-	Containers     []runtimeJobContainerSnapshot `json:"containers"`
-	InitContainers []runtimeJobContainerSnapshot `json:"initContainers"`
-}
-
-type runtimeJobTemplateSnapshot struct {
-	Spec runtimeJobPodSpecSnapshot `json:"spec"`
-}
-
-type runtimeJobSpecSnapshot struct {
-	Template runtimeJobTemplateSnapshot `json:"template"`
-}
-
-type runtimeJobListSnapshot struct {
-	Items []struct {
-		Spec runtimeJobSpecSnapshot `json:"spec"`
-	} `json:"items"`
-}
-
 func boolPtr(v bool) *bool {
 	return &v
 }
diff --git a/test/e2e/negative_test.go b/test/e2e/negative_test.go
index 969953b7f..0c616c90e 100644
--- a/test/e2e/negative_test.go
+++ b/test/e2e/negative_test.go
@@ -10,6 +10,7 @@ MIT License - see LICENSE file for details.
 package e2e
 
 import (
+	"encoding/json"
 	"fmt"
 	"os/exec"
 	"time"
@@ -17,6 +18,7 @@ import (
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 
+	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
 	"github.com/orka-agents/orka/test/utils"
 )
 
@@ -80,8 +82,8 @@ var _ = Describe("Negative/Error Cases", Ordered, func() {
 		}, 2*time.Minute, time.Second).Should(Succeed())
 	})
 
-	It("should fail an agent task with a non-existent secretRef", func() {
-		By("creating an Agent with a non-existent secretRef")
+	It("should fail an ACP task with a non-existent workspace readCredentialRef", func() {
+		By("creating an ACP Agent without embedded provider credentials")
 		agentManifest := fmt.Sprintf(`{
 			"apiVersion": "core.orka.ai/v1alpha1",
 			"kind": "Agent",
@@ -91,13 +93,12 @@ var _ = Describe("Negative/Error Cases", Ordered, func() {
 			},
 			"spec": {
 				"runtime": {
+					"contractVersion": "orka.harness.v2",
 					"type": "claude",
 					"defaultMaxTurns": 3,
 					"defaultAllowBash": false
 				},
-				"secretRef": {
-					"name": "non-existent-secret"
-				}
+				"model": {"name": "claude-sonnet-4-20250514"}
 			}
 		}`, badSecretAgent, namespace)
 
@@ -106,7 +107,7 @@ var _ = Describe("Negative/Error Cases", Ordered, func() {
 		_, err := utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred(), "Agent creation should be accepted")
 
-		By("creating a Task referencing the agent with bad secret")
+		By("creating a Task with a missing workspace read credential")
 		taskManifest := fmt.Sprintf(`{
 			"apiVersion": "core.orka.ai/v1alpha1",
 			"kind": "Task",
@@ -122,6 +123,12 @@ var _ = Describe("Negative/Error Cases", Ordered, func() {
 				},
 				"agentRuntime": {
 					"maxTurns": 1
+				},
+				"workspace": {
+					"intent": "read",
+					"gitRepo": "https://github.com/orka-agents/orka.git",
+					"ref": "d03acb995b6014a6e855181c50b922b65ea8e7ff",
+					"readCredentialRef": {"name": "non-existent-secret"}
 				}
 			}
 		}`, badSecretTask, namespace, badSecretAgent)
@@ -131,16 +138,26 @@ var _ = Describe("Negative/Error Cases", Ordered, func() {
 		_, err = utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred(), "Task creation should be accepted")
 
-		By("verifying the task fails")
+		By("verifying credential resolution fails before an ACP prompt attempt")
 		Eventually(func(g Gomega) {
-			cmd := exec.Command("kubectl", "get", "task", badSecretTask,
-				"-o", "jsonpath={.status.phase}",
-				"-n", namespace,
-			)
+			cmd := exec.Command("kubectl", "get", "task", badSecretTask, "-o", "json", "-n", namespace)
 			output, err := utils.Run(cmd)
 			g.Expect(err).NotTo(HaveOccurred())
-			g.Expect(output).To(Equal("Failed"),
-				"Task with non-existent secret should fail")
-		}, 5*time.Minute, 2*time.Second).Should(Succeed())
+			var task corev1alpha1.Task
+			g.Expect(json.Unmarshal([]byte(output), &task)).To(Succeed())
+			g.Expect(task.Status.Phase).To(Equal(corev1alpha1.TaskPhaseFailed))
+			g.Expect(task.Status.Execution).NotTo(BeNil())
+			g.Expect(task.Status.Execution.State).To(Equal(corev1alpha1.TaskExecutionStateFailed))
+			g.Expect(task.Status.Execution.Outcome).To(Equal(corev1alpha1.TaskExecutionOutcomeFailed))
+			g.Expect(task.Status.Execution.Reason).To(Equal(corev1alpha1.TaskExecutionReason("InvalidWorkspace")))
+			g.Expect(task.Status.Execution.Attempt).To(BeZero())
+			g.Expect(task.Status.Execution.PromptID).To(BeEmpty())
+			g.Expect(task.Status.Execution.RuntimePoolName).To(BeEmpty())
+			g.Expect(task.Status.Delivery).NotTo(BeNil())
+			g.Expect(task.Status.Delivery.State).To(Equal(corev1alpha1.TaskDeliveryStateNotRequested))
+			g.Expect(task.Status.Delivery.Outcome).To(Equal(corev1alpha1.TaskDeliveryOutcomeNotRequested))
+			g.Expect(task.Status.Message).To(ContainSubstring("non-existent-secret"))
+		}, 2*time.Minute, time.Second).Should(Succeed())
+		verifyNoJobForTask(badSecretTask, 5*time.Second)
 	})
 })
diff --git a/test/e2e/pr_workflow_test.go b/test/e2e/pr_workflow_test.go
index 4f0498a72..e9ac8753e 100644
--- a/test/e2e/pr_workflow_test.go
+++ b/test/e2e/pr_workflow_test.go
@@ -10,13 +10,8 @@ MIT License - see LICENSE file for details.
 package e2e
 
 import (
-	"context"
-	"encoding/json"
 	"fmt"
-	"io"
-	"net/http"
 	"os/exec"
-	"regexp"
 	"strings"
 	"time"
 
@@ -26,448 +21,117 @@ import (
 	"github.com/orka-agents/orka/test/utils"
 )
 
-var _ = Describe("PR Workflow Tools", Ordered, func() {
-	var (
-		timestamp      string
-		branchName     string
-		prNumber       string
-		apiBaseURL     string
-		token          string
-		cancelPF       context.CancelFunc
-		portForwardCmd *exec.Cmd
-	)
-
+var _ = Describe("ACP PR Delivery Profile", func() {
 	const (
-		prProviderName = "e2e-pr-provider"
-		prCoordAgent   = "e2e-pr-coordinator"
-		prCoderAgent   = "e2e-pr-coder"
+		agentName                 = "e2e-pr-delivery-agent"
+		taskName                  = "e2e-pr-delivery-task"
+		publicationCredentialName = "e2e-pr-delivery-publication"
+		forgeCredentialName       = "e2e-pr-delivery-forge"
 	)
 
-	BeforeAll(func() {
-		skipIfNoKey("E2E_OPENAI_API_KEY")
-		skipIfNoKey("E2E_GITHUB_TOKEN")
-
-		timestamp = fmt.Sprintf("%d", time.Now().Unix())
-		branchName = "e2e/orka-" + timestamp
-
-		model := e2eOpenAIModel
-		if model == "" {
-			model = "gpt-4o-mini"
-		}
-
-		By("creating a shared provider for PR workflow tests")
-		createProviderCRD(prProviderName, "openai", "e2e-openai-secret", "api-key", e2eOpenAIBaseURL, model)
-
-		By("creating the coder agent with workspace config")
-		coderManifest := fmt.Sprintf(`{
-			"apiVersion": "core.orka.ai/v1alpha1",
-			"kind": "Agent",
-			"metadata": {
-				"name": "%s",
-				"namespace": "%s"
-			},
-			"spec": {
-				"runtime": {
-					"type": "copilot",
-					"defaultMaxTurns": 20,
-					"defaultAllowBash": true
-				},
-				"secretRef": {"name": "e2e-github-secret"}
-			}
-		}`, prCoderAgent, namespace)
-
-		cmd := exec.Command("kubectl", "apply", "-f", "-")
-		cmd.Stdin = stringReader(coderManifest)
-		_, err := utils.Run(cmd)
-		Expect(err).NotTo(HaveOccurred(), "Failed to create coder agent")
-
-		By("creating the coordinator agent with coordination and PR tools")
-		coordManifest := fmt.Sprintf(`{
-			"apiVersion": "core.orka.ai/v1alpha1",
-			"kind": "Agent",
-			"metadata": {
-				"name": "%s",
-				"namespace": "%s"
-			},
-			"spec": {
-				"providerRef": {"name": "%s"},
-				"model": {"name": "%s"},
-				"coordination": {
-					"enabled": true,
-					"maxDepth": 2,
-					"maxConcurrentChildren": 3,
-					"allowedAgents": [{"name": "%s"}]
-				}
-			}
-		}`, prCoordAgent, namespace, prProviderName, model, prCoderAgent)
-
-		cmd = exec.Command("kubectl", "apply", "-f", "-")
-		cmd.Stdin = stringReader(coordManifest)
-		_, err = utils.Run(cmd)
-		Expect(err).NotTo(HaveOccurred(), "Failed to create coordinator agent")
-
-		By("setting up port-forward to controller API")
-		apiBaseURL, cancelPF, portForwardCmd, err = startControllerAPIPortForward(18087)
-		Expect(err).NotTo(HaveOccurred(), "Failed to start controller API port-forward")
-
-		By("getting a service account token")
-		token, err = serviceAccountToken()
-		Expect(err).NotTo(HaveOccurred())
-		Expect(token).NotTo(BeEmpty())
-	})
-
-	AfterAll(func() {
-		By("cleaning up PR workflow resources")
-		// Clean up child tasks
-		for _, taskPrefix := range []string{"e2e-pr-create", "e2e-pr-review", "e2e-pr-comment", "e2e-pr-merge"} {
-			cmd := exec.Command("kubectl", "delete", "tasks", "-l",
-				fmt.Sprintf("orka.ai/parent-task=%s", taskPrefix), "-n", namespace, "--ignore-not-found")
-			_, _ = utils.Run(cmd)
-		}
-
-		// Clean up tasks
-		for _, t := range []string{"e2e-pr-create", "e2e-pr-review", "e2e-pr-comment", "e2e-pr-merge", "e2e-pr-wsenv-task"} {
-			cmd := exec.Command("kubectl", "delete", "task", t, "-n", namespace, "--ignore-not-found")
-			_, _ = utils.Run(cmd)
-		}
-
-		// Clean up agents
-		for _, a := range []string{prCoordAgent, prCoderAgent, "e2e-pr-wsenv-agent"} {
-			cmd := exec.Command("kubectl", "delete", "agent", a, "-n", namespace, "--ignore-not-found")
-			_, _ = utils.Run(cmd)
-		}
-
-		// Clean up provider
-		cmd := exec.Command("kubectl", "delete", "provider", prProviderName, "-n", namespace, "--ignore-not-found")
-		_, _ = utils.Run(cmd)
-
-		// Stop port-forward
-		if cancelPF != nil {
-			cancelPF()
-		}
-		if portForwardCmd != nil && portForwardCmd.Process != nil {
-			_ = portForwardCmd.Wait()
-		}
-	})
-
 	AfterEach(func() {
-		dumpDebugInfo("e2e-pr-create", "e2e-pr-review", "e2e-pr-comment", "e2e-pr-merge")
-	})
-
-	// ── Test 1: create_pull_request ──
-
-	It("should create a pull request using create_pull_request tool", func() {
-		const taskName = "e2e-pr-create"
-
-		model := e2eOpenAIModel
-		if model == "" {
-			model = "gpt-4o-mini"
-		}
-
-		By("creating a coordinator task to clone, push, and create a PR")
-		prompt := fmt.Sprintf(
-			"Delegate to agent '%s': Clone https://github.com/sozercan/ayna, create a new file e2e-test-%s.txt with content 'e2e test file', commit with message 'e2e: add test file', and push to branch %s. After the coder task completes, use create_pull_request with the coder's task name, head_branch='%s', base_branch='main', title='E2E Test PR %s'.",
-			prCoderAgent, timestamp, branchName, branchName, timestamp,
-		)
-
-		taskManifest := fmt.Sprintf(`{
-			"apiVersion": "core.orka.ai/v1alpha1",
-			"kind": "Task",
-			"metadata": {"name": "%s", "namespace": "%s"},
-			"spec": {
-				"type": "ai",
-				"agentRef": {"name": "%s"},
-				"ai": {
-					"prompt": "%s",
-					"model": "%s",
-					"providerRef": {"name": "%s"}
-				}
-			}
-		}`, taskName, namespace, prCoordAgent, prompt, model, prProviderName)
-
-		cmd := exec.Command("kubectl", "apply", "-f", "-")
-		cmd.Stdin = stringReader(taskManifest)
-		_, err := utils.Run(cmd)
-		Expect(err).NotTo(HaveOccurred())
-
-		By("waiting for coordinator task to complete")
-		phase := waitForTaskCompletion(taskName, 10*time.Minute)
-		Expect(phase).To(BeElementOf("Succeeded", "Failed"))
-
-		By("verifying result is available")
-		verifyResultAvailable(taskName)
-
-		By("verifying at least one child task was created")
-		Eventually(func(g Gomega) {
-			cmd := exec.Command("kubectl", "get", "tasks", "-l",
-				fmt.Sprintf("orka.ai/parent-task=%s", taskName),
-				"-o", "jsonpath={.items[*].metadata.name}", "-n", namespace)
-			output, err := utils.Run(cmd)
-			g.Expect(err).NotTo(HaveOccurred())
-			g.Expect(strings.TrimSpace(output)).NotTo(BeEmpty(),
-				"At least one child task should be created")
-		}, 2*time.Minute, 5*time.Second).Should(Succeed())
-
-		By("extracting PR number from result")
-		req, err := http.NewRequest("GET", apiBaseURL+"/api/v1/tasks/"+taskName+"/result", nil)
-		Expect(err).NotTo(HaveOccurred())
-		req.Header.Set("Authorization", "Bearer "+token)
-
-		client := &http.Client{Timeout: 30 * time.Second}
-		resp, err := client.Do(req)
-		Expect(err).NotTo(HaveOccurred())
-		defer resp.Body.Close()
-
-		body, err := io.ReadAll(resp.Body)
-		Expect(err).NotTo(HaveOccurred())
-
-		// Extract PR number from result text
-		re := regexp.MustCompile(`#(\d+)|PR\s+(\d+)|pull/(\d+)|number["\s:]+(\d+)`)
-		matches := re.FindStringSubmatch(string(body))
-		for _, m := range matches[1:] {
-			if m != "" {
-				prNumber = m
-				break
-			}
-		}
-		_, _ = fmt.Fprintf(GinkgoWriter, "Extracted PR number: %s\n", prNumber)
-		Expect(prNumber).NotTo(BeEmpty(), "Should extract a PR number from result: %s", string(body))
-	})
-
-	// ── Test 2: review_pull_request ──
-
-	It("should review a pull request using review_pull_request tool", func() {
-		Expect(prNumber).NotTo(BeEmpty(), "PR number must be set by previous test")
-
-		const taskName = "e2e-pr-review"
-
-		model := e2eOpenAIModel
-		if model == "" {
-			model = "gpt-4o-mini"
-		}
-
-		By("creating a coordinator task to review the PR")
-		prompt := fmt.Sprintf(
-			"Use review_pull_request to review PR number %s from the coder task. Report the diff and file list.",
-			prNumber,
-		)
-
-		taskManifest := fmt.Sprintf(`{
-			"apiVersion": "core.orka.ai/v1alpha1",
-			"kind": "Task",
-			"metadata": {"name": "%s", "namespace": "%s"},
-			"spec": {
-				"type": "ai",
-				"agentRef": {"name": "%s"},
-				"ai": {
-					"prompt": "%s",
-					"model": "%s",
-					"providerRef": {"name": "%s"}
-				}
-			}
-		}`, taskName, namespace, prCoordAgent, prompt, model, prProviderName)
-
-		cmd := exec.Command("kubectl", "apply", "-f", "-")
-		cmd.Stdin = stringReader(taskManifest)
-		_, err := utils.Run(cmd)
-		Expect(err).NotTo(HaveOccurred())
-
-		By("waiting for coordinator task to complete")
-		phase := waitForTaskCompletion(taskName, 10*time.Minute)
-		Expect(phase).To(BeElementOf("Succeeded", "Failed"))
-
-		By("verifying result is available")
-		verifyResultAvailable(taskName)
-	})
-
-	// ── Test 3: post_review_comment ──
-
-	It("should post a review comment using post_review_comment tool", func() {
-		Expect(prNumber).NotTo(BeEmpty(), "PR number must be set by previous test")
-
-		const taskName = "e2e-pr-comment"
-
-		model := e2eOpenAIModel
-		if model == "" {
-			model = "gpt-4o-mini"
-		}
-
-		By("creating a coordinator task to post a review comment")
-		prompt := fmt.Sprintf(
-			"Use post_review_comment on PR number %s with body='E2E test review - LGTM' and event='COMMENT'.",
-			prNumber,
-		)
-
-		taskManifest := fmt.Sprintf(`{
-			"apiVersion": "core.orka.ai/v1alpha1",
-			"kind": "Task",
-			"metadata": {"name": "%s", "namespace": "%s"},
-			"spec": {
-				"type": "ai",
-				"agentRef": {"name": "%s"},
-				"ai": {
-					"prompt": "%s",
-					"model": "%s",
-					"providerRef": {"name": "%s"}
-				}
-			}
-		}`, taskName, namespace, prCoordAgent, prompt, model, prProviderName)
-
-		cmd := exec.Command("kubectl", "apply", "-f", "-")
-		cmd.Stdin = stringReader(taskManifest)
-		_, err := utils.Run(cmd)
-		Expect(err).NotTo(HaveOccurred())
-
-		By("waiting for coordinator task to complete")
-		phase := waitForTaskCompletion(taskName, 10*time.Minute)
-		Expect(phase).To(BeElementOf("Succeeded", "Failed"))
-
-		By("verifying result is available")
-		verifyResultAvailable(taskName)
-	})
-
-	// ── Test 4: merge_pull_request ──
-
-	It("should merge a pull request using merge_pull_request tool", func() {
-		Expect(prNumber).NotTo(BeEmpty(), "PR number must be set by previous test")
-
-		const taskName = "e2e-pr-merge"
-
-		model := e2eOpenAIModel
-		if model == "" {
-			model = "gpt-4o-mini"
+		dumpDebugInfo(taskName)
+		for _, resource := range []struct{ kind, name string }{
+			{kind: "task", name: taskName},
+			{kind: "agent", name: agentName},
+			{kind: "secret", name: publicationCredentialName},
+			{kind: "secret", name: forgeCredentialName},
+		} {
+			cmd := exec.Command("kubectl", "delete", resource.kind, resource.name,
+				"-n", namespace, "--ignore-not-found", "--timeout=30s")
+			_, _ = utils.Run(cmd)
 		}
-
-		By("creating a coordinator task to merge the PR")
-		prompt := fmt.Sprintf(
-			"Use merge_pull_request to merge PR number %s with merge_method='squash'.",
-			prNumber,
-		)
-
-		taskManifest := fmt.Sprintf(`{
-			"apiVersion": "core.orka.ai/v1alpha1",
-			"kind": "Task",
-			"metadata": {"name": "%s", "namespace": "%s"},
-			"spec": {
-				"type": "ai",
-				"agentRef": {"name": "%s"},
-				"ai": {
-					"prompt": "%s",
-					"model": "%s",
-					"providerRef": {"name": "%s"}
-				}
-			}
-		}`, taskName, namespace, prCoordAgent, prompt, model, prProviderName)
-
-		cmd := exec.Command("kubectl", "apply", "-f", "-")
-		cmd.Stdin = stringReader(taskManifest)
-		_, err := utils.Run(cmd)
-		Expect(err).NotTo(HaveOccurred())
-
-		By("waiting for coordinator task to complete")
-		phase := waitForTaskCompletion(taskName, 10*time.Minute)
-		Expect(phase).To(BeElementOf("Succeeded", "Failed"))
-
-		By("verifying result is available")
-		verifyResultAvailable(taskName)
 	})
 
-	// ── Test 5: Workspace env vars (structural – no LLM needed) ──
-
-	It("should set workspace env vars on the Job for PR workflow fields", func() {
-		const (
-			agentName = "e2e-pr-wsenv-agent"
-			taskName  = "e2e-pr-wsenv-task"
-		)
+	It("queues publication and PR fields as a governed ACP write delivery", func() {
+		Expect(createK8sSecret(publicationCredentialName, namespace, map[string]string{
+			"token": "placeholder",
+		})).To(Succeed(), "Failed to create dummy publication credential Secret")
+		Expect(createK8sSecret(forgeCredentialName, namespace, map[string]string{
+			"token": "placeholder",
+		})).To(Succeed(), "Failed to create dummy forge credential Secret")
 
-		defer func() {
-			cmd := exec.Command("kubectl", "delete", "task", taskName, "-n", namespace, "--ignore-not-found")
-			_, _ = utils.Run(cmd)
-			cmd = exec.Command("kubectl", "delete", "agent", agentName, "-n", namespace, "--ignore-not-found")
-			_, _ = utils.Run(cmd)
-		}()
-
-		By("creating an Agent with claude runtime")
 		agentManifest := fmt.Sprintf(`{
 			"apiVersion": "core.orka.ai/v1alpha1",
 			"kind": "Agent",
-			"metadata": {
-				"name": "%s",
-				"namespace": "%s"
-			},
+			"metadata": {"name": %q, "namespace": %q},
 			"spec": {
 				"runtime": {
+					"contractVersion": "orka.harness.v2",
 					"type": "claude",
 					"defaultMaxTurns": 5,
 					"defaultAllowBash": false
-				}
+				},
+				"model": {"name": "claude-sonnet-4-20250514"}
 			}
 		}`, agentName, namespace)
-
 		cmd := exec.Command("kubectl", "apply", "-f", "-")
 		cmd.Stdin = stringReader(agentManifest)
 		_, err := utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred(), "Failed to create Agent")
 
-		By("creating a Task with workspace gitRepo, pushBranch, forkRepo, and prBaseBranch")
 		taskManifest := fmt.Sprintf(`{
 			"apiVersion": "core.orka.ai/v1alpha1",
 			"kind": "Task",
-			"metadata": {
-				"name": "%s",
-				"namespace": "%s"
-			},
+			"metadata": {"name": %q, "namespace": %q},
 			"spec": {
 				"type": "agent",
-				"prompt": "list files",
-				"agentRef": {"name": "%s"},
-				"agentRuntime": {
-					"maxTurns": 3,
-					"workspace": {
-						"gitRepo": "https://github.com/sozercan/ayna",
-						"pushBranch": "e2e/test-branch",
-						"forkRepo": "https://github.com/fork/ayna",
-						"prBaseBranch": "develop"
-					}
+				"prompt": "Prepare a reviewed change.",
+				"agentRef": {"name": %q},
+				"agentRuntime": {"maxTurns": 3},
+				"workspace": {
+					"intent": "write",
+					"gitRepo": "https://github.com/sozercan/ayna",
+					"publicationGitRepo": "https://github.com/fork/ayna",
+					"publicationCredentialRef": {"name": %q, "key": "token"},
+					"forgeCredentialRef": {"name": %q, "key": "token"},
+					"pushBranch": "e2e/test-branch",
+					"prBaseBranch": "develop",
+					"createPR": true
 				}
 			}
-		}`, taskName, namespace, agentName)
-
+		}`, taskName, namespace, agentName, publicationCredentialName, forgeCredentialName)
 		cmd = exec.Command("kubectl", "apply", "-f", "-")
 		cmd.Stdin = stringReader(taskManifest)
 		_, err = utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred(), "Failed to create Task")
 
-		By("verifying a Job is created")
-		verifyJobCreatedForTask(taskName, 2*time.Minute)
-
-		By("verifying the Job has workspace env vars")
-		Eventually(func(g Gomega) {
-			cmd := exec.Command("kubectl", "get", "jobs",
-				"-l", fmt.Sprintf("orka.ai/task=%s", taskName),
-				"-o", "jsonpath={.items[0].spec.template.spec.containers[0].env}",
-				"-n", namespace)
-			output, err := utils.Run(cmd)
-			g.Expect(err).NotTo(HaveOccurred())
-			g.Expect(output).NotTo(BeEmpty())
-
-			var envVars []envVar
-			err = json.Unmarshal([]byte(output), &envVars)
-			g.Expect(err).NotTo(HaveOccurred(), "Failed to parse env vars JSON")
+		verifyACPTaskRuntimeForTask(taskName, acpTaskExpectation{
+			ProviderKind:    "claude",
+			WorkspaceIntent: "write",
+			MaxTurns:        acpInt32(3),
+			AllowBash:       acpBool(false),
+			Workspace: &acpWorkspaceExpectation{
+				Intent:                    "write",
+				GitRepo:                   "https://github.com/sozercan/ayna",
+				PublicationGitRepo:        "https://github.com/fork/ayna",
+				PublicationCredentialName: publicationCredentialName,
+				PushBranch:                "e2e/test-branch",
+				PRBaseBranch:              "develop",
+				CreatePR:                  acpBool(true),
+			},
+			DeliveryState:   acpDeliveryState("NotRequested"),
+			DeliveryOutcome: acpDeliveryOutcome("NotRequested"),
+		}, 2*time.Minute)
+		verifyNoJobForTask(taskName, 5*time.Second)
+	})
 
-			envMap := make(map[string]string)
-			for _, e := range envVars {
-				envMap[e.Name] = e.Value
+	It("rejects createPR on a read-only workspace", func() {
+		manifest := fmt.Sprintf(`{
+			"apiVersion": "core.orka.ai/v1alpha1",
+			"kind": "Task",
+			"metadata": {"name": "e2e-pr-invalid", "namespace": %q},
+			"spec": {
+				"type": "agent",
+				"prompt": "invalid",
+				"agentRef": {"name": "unused"},
+				"workspace": {"intent": "read", "createPR": true}
 			}
-
-			g.Expect(envMap).To(HaveKey("ORKA_GIT_REPO"))
-			g.Expect(envMap["ORKA_GIT_REPO"]).To(Equal("https://github.com/sozercan/ayna"))
-			g.Expect(envMap).To(HaveKey("ORKA_PUSH_BRANCH"))
-			g.Expect(envMap["ORKA_PUSH_BRANCH"]).To(Equal("e2e/test-branch"))
-			g.Expect(envMap).To(HaveKey("ORKA_FORK_REPO"))
-			g.Expect(envMap["ORKA_FORK_REPO"]).To(Equal("https://github.com/fork/ayna"))
-			g.Expect(envMap).To(HaveKey("ORKA_PR_BASE_BRANCH"))
-			g.Expect(envMap["ORKA_PR_BASE_BRANCH"]).To(Equal("develop"))
-		}, 30*time.Second, time.Second).Should(Succeed())
+		}`, namespace)
+		cmd := exec.Command("kubectl", "apply", "--dry-run=server", "-f", "-")
+		cmd.Stdin = stringReader(manifest)
+		output, err := utils.Run(cmd)
+		Expect(err).To(HaveOccurred())
+		Expect(strings.ToLower(output)).To(ContainSubstring("createpr requires write"))
 	})
 })
diff --git a/test/e2e/sqlite_storage_test.go b/test/e2e/sqlite_storage_test.go
index 1c856f446..1d0406812 100644
--- a/test/e2e/sqlite_storage_test.go
+++ b/test/e2e/sqlite_storage_test.go
@@ -200,10 +200,12 @@ var _ = Describe("SQLite Storage", Ordered, func() {
 			},
 			"spec": {
 				"runtime": {
+					"contractVersion": "orka.harness.v2",
 					"type": "claude",
 					"defaultMaxTurns": 3,
 					"defaultAllowBash": false
-				}
+				},
+				"model": {"name": "claude-sonnet-4-20250514"}
 			}
 		}`, agentName, namespace)
 
@@ -237,11 +239,12 @@ var _ = Describe("SQLite Storage", Ordered, func() {
 		_, err = utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred(), "Failed to create agent task")
 
-		By("verifying harness-wrapper metadata is planned for the agent task")
-		verifyHarnessWrapperMetadataForTask(agentTaskName, map[string]string{
-			"runtime":  "claude",
-			"wrapper":  "cli",
-			"maxTurns": "1",
+		By("verifying ACP v2 execution state is persisted")
+		verifyACPTaskRuntimeForTask(agentTaskName, acpTaskExpectation{
+			ProviderKind:    "claude",
+			WorkspaceIntent: "read",
+			MaxTurns:        acpInt32(1),
+			AllowBash:       acpBool(false),
 		}, 2*time.Minute)
 
 		By("verifying the Task does not use a worker Job")
diff --git a/test/e2e/task_lifecycle_test.go b/test/e2e/task_lifecycle_test.go
index 44381657c..5e09ead87 100644
--- a/test/e2e/task_lifecycle_test.go
+++ b/test/e2e/task_lifecycle_test.go
@@ -181,6 +181,7 @@ var _ = Describe("Task Lifecycle Advanced", Ordered, func() {
 			"--type=merge", "--subresource=status",
 			"-p", `{"status":{"phase":"Cancelled","message":"cancelled by e2e test"}}`,
 			"-n", namespace,
+			"--as=system:serviceaccount:orka-system:orka-controller-manager",
 		)
 		_, err = utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred(), "Failed to cancel task")
diff --git a/test/e2e/tools_test.go b/test/e2e/tools_test.go
index f8b110783..f0358e59c 100644
--- a/test/e2e/tools_test.go
+++ b/test/e2e/tools_test.go
@@ -312,10 +312,12 @@ var _ = Describe("Tools and Configuration", Ordered, func() {
 			},
 			"spec": {
 				"runtime": {
+					"contractVersion": "orka.harness.v2",
 					"type": "claude",
 					"defaultMaxTurns": 3,
 					"defaultAllowBash": false
-				}
+				},
+				"model": {"name": "claude-sonnet-4-20250514"}
 			}
 		}`, filterAgentName, namespace)
 
@@ -351,13 +353,14 @@ var _ = Describe("Tools and Configuration", Ordered, func() {
 		_, err = utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred())
 
-		By("verifying harness-wrapper tool filter metadata")
-		verifyHarnessWrapperMetadataForTask(filterTaskName, map[string]string{
-			"runtime":         "claude",
-			"wrapper":         "cli",
-			"maxTurns":        "1",
-			"allowedTools":    "Read,Grep",
-			"disallowedTools": "Bash,Write",
+		By("verifying the tool policy is represented by an ACP v2 RuntimePool profile")
+		verifyACPTaskRuntimeForTask(filterTaskName, acpTaskExpectation{
+			ProviderKind:    "claude",
+			WorkspaceIntent: "read",
+			MaxTurns:        acpInt32(1),
+			AllowBash:       acpBool(false),
+			AllowedTools:    []string{"Read", "Grep"},
+			DisallowedTools: []string{"Bash", "Write"},
 		}, 2*time.Minute)
 	})
 
@@ -374,10 +377,12 @@ var _ = Describe("Tools and Configuration", Ordered, func() {
 			},
 			"spec": {
 				"runtime": {
+					"contractVersion": "orka.harness.v2",
 					"type": "claude",
 					"defaultMaxTurns": 3,
 					"defaultAllowBash": false
-				}
+				},
+				"model": {"name": "claude-sonnet-4-20250514"}
 			}
 		}`, priorAgentName, namespace)
 
@@ -438,12 +443,17 @@ var _ = Describe("Tools and Configuration", Ordered, func() {
 		_, err = utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred())
 
-		By("verifying harness-wrapper metadata is planned for the child task")
-		verifyHarnessWrapperMetadataForTask(priorTask2Name, map[string]string{
-			"runtime":  "claude",
-			"wrapper":  "cli",
-			"maxTurns": "1",
-		}, 2*time.Minute)
+		By("verifying priorTaskRef fails at the ACP hard-cutover gate before dispatch")
+		Eventually(func(g Gomega) {
+			cmd := exec.Command("kubectl", "get", "task", priorTask2Name, "-n", namespace,
+				"-o", "jsonpath={.status.phase}{\"/\"}{.status.message}{\"/\"}{.status.execution.runtimePoolName}")
+			output, err := utils.Run(cmd)
+			g.Expect(err).NotTo(HaveOccurred())
+			g.Expect(output).To(HavePrefix("Failed/"))
+			g.Expect(output).To(ContainSubstring("priorTaskRef continuation is not supported by the ACP core runtime; use sessionRef"))
+			g.Expect(output).To(HaveSuffix("/"), "rejected task must not select a RuntimePool")
+		}, 2*time.Minute, time.Second).Should(Succeed())
+		verifyNoJobForTask(priorTask2Name, 5*time.Second)
 	})
 
 	// Test: AI task using web_fetch tool
diff --git a/test/e2e/workspace_advanced_test.go b/test/e2e/workspace_advanced_test.go
index 104a69529..cf7262af9 100644
--- a/test/e2e/workspace_advanced_test.go
+++ b/test/e2e/workspace_advanced_test.go
@@ -10,7 +10,6 @@ MIT License - see LICENSE file for details.
 package e2e
 
 import (
-	"encoding/json"
 	"fmt"
 	"os/exec"
 	"time"
@@ -21,440 +20,260 @@ import (
 	"github.com/orka-agents/orka/test/utils"
 )
 
-var _ = Describe("Workspace Advanced Features", func() {
+var _ = Describe("ACP Workspace Profiles", func() {
 	const prefix = "e2e-ws-adv-"
 
-	// --- Test 1: Private repo with gitSecretRef ---
-
-	Describe("Private repo with gitSecretRef", func() {
-		const (
-			agentName = prefix + "gitsecret-agent"
-			taskName  = prefix + "gitsecret-task"
-		)
-
-		AfterEach(func() {
-			dumpDebugInfo(taskName)
-			for _, r := range []struct{ kind, name string }{
-				{"task", taskName},
-				{"agent", agentName},
-			} {
-				cmd := exec.Command("kubectl", "delete", r.kind, r.name,
-					"-n", namespace, "--ignore-not-found")
-				_, _ = utils.Run(cmd)
-			}
-		})
-
-		It("should mount git credentials when gitSecretRef is configured", func() {
-			skipIfNoKey("E2E_GITHUB_TOKEN")
-
-			By("creating an Agent with claude runtime")
-			agentManifest := fmt.Sprintf(`{
-				"apiVersion": "core.orka.ai/v1alpha1",
-				"kind": "Agent",
-				"metadata": {
-					"name": "%s",
-					"namespace": "%s"
-				},
-				"spec": {
-					"runtime": {
-						"type": "claude",
-						"defaultMaxTurns": 5,
-						"defaultAllowBash": false
-					}
-				}
-			}`, agentName, namespace)
-
-			cmd := exec.Command("kubectl", "apply", "-f", "-")
-			cmd.Stdin = stringReader(agentManifest)
-			_, err := utils.Run(cmd)
-			Expect(err).NotTo(HaveOccurred(), "Failed to create Agent")
-
-			By("creating an agent task with workspace gitRepo and gitSecretRef")
-			taskManifest := fmt.Sprintf(`{
-				"apiVersion": "core.orka.ai/v1alpha1",
-				"kind": "Task",
-				"metadata": {
-					"name": "%s",
-					"namespace": "%s"
+	cleanup := func(taskName, agentName string) {
+		dumpDebugInfo(taskName)
+		for _, resource := range []struct{ kind, name string }{
+			{"task", taskName},
+			{"agent", agentName},
+		} {
+			cmd := exec.Command("kubectl", "delete", resource.kind, resource.name,
+				"-n", namespace, "--ignore-not-found")
+			_, _ = utils.Run(cmd)
+		}
+	}
+
+	createClaudeAgent := func(agentName string) {
+		manifest := fmt.Sprintf(`{
+			"apiVersion": "core.orka.ai/v1alpha1",
+			"kind": "Agent",
+			"metadata": {"name": %q, "namespace": %q},
+			"spec": {
+				"runtime": {
+					"contractVersion": "orka.harness.v2",
+					"type": "claude",
+					"defaultMaxTurns": 5,
+					"defaultAllowBash": false
 				},
-				"spec": {
-					"type": "agent",
-					"agentRef": {"name": "%s"},
-					"prompt": "list files",
-					"agentRuntime": {
-						"maxTurns": 3,
-						"workspace": {
-							"gitRepo": "https://github.com/sozercan/ayna",
-							"gitSecretRef": {"name": "e2e-github-secret"}
-						}
-					}
-				}
-			}`, taskName, namespace, agentName)
-
-			cmd = exec.Command("kubectl", "apply", "-f", "-")
-			cmd.Stdin = stringReader(taskManifest)
-			_, err = utils.Run(cmd)
-			Expect(err).NotTo(HaveOccurred(), "Failed to create Task")
-
-			By("verifying harness-wrapper workspace metadata")
-			verifyHarnessWrapperMetadataForTask(taskName, map[string]string{
-				"runtime":   "claude",
-				"wrapper":   "cli",
-				"gitRepo":   "https://github.com/sozercan/ayna",
-				"maxTurns":  "3",
-				"allowBash": "false",
-			}, 2*time.Minute)
-
-			By("verifying the Task does not use a worker Job")
-			verifyNoJobForTask(taskName, 5*time.Second)
-		})
-	})
-
-	// --- Test 2: subPath workspace ---
-
-	Describe("subPath workspace", func() {
-		const (
-			agentName = prefix + "subpath-agent"
-			taskName  = prefix + "subpath-task"
-		)
-
-		AfterEach(func() {
-			dumpDebugInfo(taskName)
-			for _, r := range []struct{ kind, name string }{
-				{"task", taskName},
-				{"agent", agentName},
-			} {
-				cmd := exec.Command("kubectl", "delete", r.kind, r.name,
-					"-n", namespace, "--ignore-not-found")
-				_, _ = utils.Run(cmd)
+				"model": {"name": "claude-sonnet-4-20250514"}
 			}
-		})
-
-		It("should set ORKA_WORKSPACE_SUBPATH when subPath is configured", func() {
-			By("creating an Agent with claude runtime")
-			agentManifest := fmt.Sprintf(`{
-				"apiVersion": "core.orka.ai/v1alpha1",
-				"kind": "Agent",
-				"metadata": {
-					"name": "%s",
-					"namespace": "%s"
-				},
-				"spec": {
-					"runtime": {
-						"type": "claude",
-						"defaultMaxTurns": 5,
-						"defaultAllowBash": false
-					}
+		}`, agentName, namespace)
+		cmd := exec.Command("kubectl", "apply", "-f", "-")
+		cmd.Stdin = stringReader(manifest)
+		_, err := utils.Run(cmd)
+		Expect(err).NotTo(HaveOccurred(), "Failed to create Agent")
+	}
+
+	It("uses a readCredentialRef only at the governed workspace boundary", func() {
+		skipIfNoKey("E2E_GITHUB_TOKEN")
+		agentName := prefix + "credential-agent"
+		taskName := prefix + "credential-task"
+		DeferCleanup(cleanup, taskName, agentName)
+		createClaudeAgent(agentName)
+
+		manifest := fmt.Sprintf(`{
+			"apiVersion": "core.orka.ai/v1alpha1",
+			"kind": "Task",
+			"metadata": {"name": %q, "namespace": %q},
+			"spec": {
+				"type": "agent",
+				"agentRef": {"name": %q},
+				"prompt": "List files without modifying the workspace.",
+				"agentRuntime": {"maxTurns": 3},
+				"workspace": {
+					"intent": "read",
+					"gitRepo": "https://github.com/sozercan/ayna",
+					"readCredentialRef": {"name": "e2e-github-secret"}
 				}
-			}`, agentName, namespace)
-
-			cmd := exec.Command("kubectl", "apply", "-f", "-")
-			cmd.Stdin = stringReader(agentManifest)
-			_, err := utils.Run(cmd)
-			Expect(err).NotTo(HaveOccurred(), "Failed to create Agent")
+			}
+		}`, taskName, namespace, agentName)
+		cmd := exec.Command("kubectl", "apply", "-f", "-")
+		cmd.Stdin = stringReader(manifest)
+		_, err := utils.Run(cmd)
+		Expect(err).NotTo(HaveOccurred(), "Failed to create Task")
+
+		verifyACPTaskRuntimeForTask(taskName, acpTaskExpectation{
+			ProviderKind:    "claude",
+			WorkspaceIntent: "read",
+			MaxTurns:        acpInt32(3),
+			AllowBash:       acpBool(false),
+			Workspace: &acpWorkspaceExpectation{
+				Intent:             "read",
+				GitRepo:            "https://github.com/sozercan/ayna",
+				ReadCredentialName: "e2e-github-secret",
+			},
+		}, 2*time.Minute)
+		verifyNoJobForTask(taskName, 5*time.Second)
+	})
 
-			By("creating an agent task with workspace subPath")
-			taskManifest := fmt.Sprintf(`{
-				"apiVersion": "core.orka.ai/v1alpha1",
-				"kind": "Task",
-				"metadata": {
-					"name": "%s",
-					"namespace": "%s"
-				},
-				"spec": {
-					"type": "agent",
-					"agentRef": {"name": "%s"},
-					"prompt": "list files",
-					"agentRuntime": {
-						"maxTurns": 3,
-						"workspace": {
-							"gitRepo": "https://github.com/sozercan/ayna",
-							"subPath": "docs"
-						}
-					}
+	It("includes subPath in the immutable read workspace profile", func() {
+		agentName := prefix + "subpath-agent"
+		taskName := prefix + "subpath-task"
+		DeferCleanup(cleanup, taskName, agentName)
+		createClaudeAgent(agentName)
+
+		manifest := fmt.Sprintf(`{
+			"apiVersion": "core.orka.ai/v1alpha1",
+			"kind": "Task",
+			"metadata": {"name": %q, "namespace": %q},
+			"spec": {
+				"type": "agent",
+				"agentRef": {"name": %q},
+				"prompt": "Inspect the configured subdirectory.",
+				"agentRuntime": {"maxTurns": 3},
+				"workspace": {
+					"intent": "read",
+					"gitRepo": "https://github.com/example/monorepo",
+					"subPath": "packages/backend"
 				}
-			}`, taskName, namespace, agentName)
-
-			cmd = exec.Command("kubectl", "apply", "-f", "-")
-			cmd.Stdin = stringReader(taskManifest)
-			_, err = utils.Run(cmd)
-			Expect(err).NotTo(HaveOccurred(), "Failed to create Task")
-
-			By("verifying harness-wrapper workspace metadata")
-			Eventually(func(g Gomega) {
-				cmd := exec.Command("kubectl", "get", "task", taskName, "-n", namespace, "-o", "json")
-				output, err := utils.Run(cmd)
-				g.Expect(err).NotTo(HaveOccurred())
+			}
+		}`, taskName, namespace, agentName)
+		cmd := exec.Command("kubectl", "apply", "-f", "-")
+		cmd.Stdin = stringReader(manifest)
+		_, err := utils.Run(cmd)
+		Expect(err).NotTo(HaveOccurred(), "Failed to create Task")
+
+		verifyACPTaskRuntimeForTask(taskName, acpTaskExpectation{
+			ProviderKind:    "claude",
+			WorkspaceIntent: "read",
+			MaxTurns:        acpInt32(3),
+			AllowBash:       acpBool(false),
+			Workspace: &acpWorkspaceExpectation{
+				Intent:  "read",
+				GitRepo: "https://github.com/example/monorepo",
+				SubPath: "packages/backend",
+			},
+		}, 2*time.Minute)
+	})
 
-				var task struct {
-					Metadata struct {
-						Annotations map[string]string `json:"annotations"`
-					} `json:"metadata"`
+	It("keeps an exact source ref on the top-level Task workspace", func() {
+		agentName := prefix + "ref-agent"
+		taskName := prefix + "ref-task"
+		DeferCleanup(cleanup, taskName, agentName)
+		createClaudeAgent(agentName)
+
+		manifest := fmt.Sprintf(`{
+			"apiVersion": "core.orka.ai/v1alpha1",
+			"kind": "Task",
+			"metadata": {"name": %q, "namespace": %q},
+			"spec": {
+				"type": "agent",
+				"agentRef": {"name": %q},
+				"prompt": "Inspect the pinned revision.",
+				"agentRuntime": {"maxTurns": 3},
+				"workspace": {
+					"intent": "read",
+					"gitRepo": "https://github.com/example/repo",
+					"ref": "abc123def456"
 				}
-				err = json.Unmarshal([]byte(output), &task)
-				g.Expect(err).NotTo(HaveOccurred())
-
-				rawMetadata := task.Metadata.Annotations["orka.ai/harness-wrapper-metadata"]
-				g.Expect(rawMetadata).NotTo(BeEmpty())
-				metadata := map[string]string{}
-				err = json.Unmarshal([]byte(rawMetadata), &metadata)
-				g.Expect(err).NotTo(HaveOccurred())
-				g.Expect(metadata).To(HaveKeyWithValue("gitRepo", "https://github.com/sozercan/ayna"))
-				g.Expect(metadata).To(HaveKeyWithValue("workspaceSubPath", "docs"))
-			}, 30*time.Second, time.Second).Should(Succeed())
-		})
+			}
+		}`, taskName, namespace, agentName)
+		cmd := exec.Command("kubectl", "apply", "-f", "-")
+		cmd.Stdin = stringReader(manifest)
+		_, err := utils.Run(cmd)
+		Expect(err).NotTo(HaveOccurred(), "Failed to create Task")
+
+		verifyACPTaskRuntimeForTask(taskName, acpTaskExpectation{
+			ProviderKind:    "claude",
+			WorkspaceIntent: "read",
+			MaxTurns:        acpInt32(3),
+			AllowBash:       acpBool(false),
+			Workspace: &acpWorkspaceExpectation{
+				Intent:  "read",
+				GitRepo: "https://github.com/example/repo",
+				Ref:     "abc123def456",
+			},
+		}, 2*time.Minute)
 	})
 
-	// --- Test 3: Specific ref checkout ---
-
-	Describe("Specific ref checkout", func() {
-		const (
-			agentName = prefix + "ref-agent"
-			taskName  = prefix + "ref-task"
-		)
-
-		AfterEach(func() {
-			dumpDebugInfo(taskName)
-			for _, r := range []struct{ kind, name string }{
-				{"task", taskName},
-				{"agent", agentName},
-			} {
-				cmd := exec.Command("kubectl", "delete", r.kind, r.name,
-					"-n", namespace, "--ignore-not-found")
+	It("models publication and PR fields as a write delivery profile", func() {
+		agentName := prefix + "publication-agent"
+		taskName := prefix + "publication-task"
+		publicationCredentialName := prefix + "publication-credential"
+		forgeCredentialName := prefix + "forge-credential"
+		DeferCleanup(func() {
+			cleanup(taskName, agentName)
+			for _, secretName := range []string{publicationCredentialName, forgeCredentialName} {
+				cmd := exec.Command("kubectl", "delete", "secret", secretName,
+					"-n", namespace, "--ignore-not-found", "--timeout=30s")
 				_, _ = utils.Run(cmd)
 			}
 		})
-
-		It("should set ORKA_GIT_REF when workspace ref is configured", func() {
-			By("creating an Agent with claude runtime")
-			agentManifest := fmt.Sprintf(`{
-				"apiVersion": "core.orka.ai/v1alpha1",
-				"kind": "Agent",
-				"metadata": {
-					"name": "%s",
-					"namespace": "%s"
-				},
-				"spec": {
-					"runtime": {
-						"type": "claude",
-						"defaultMaxTurns": 5,
-						"defaultAllowBash": false
-					}
-				}
-			}`, agentName, namespace)
-
-			cmd := exec.Command("kubectl", "apply", "-f", "-")
-			cmd.Stdin = stringReader(agentManifest)
-			_, err := utils.Run(cmd)
-			Expect(err).NotTo(HaveOccurred(), "Failed to create Agent")
-
-			By("creating an agent task with workspace ref set to main")
-			taskManifest := fmt.Sprintf(`{
-				"apiVersion": "core.orka.ai/v1alpha1",
-				"kind": "Task",
-				"metadata": {
-					"name": "%s",
-					"namespace": "%s"
-				},
-				"spec": {
-					"type": "agent",
-					"agentRef": {"name": "%s"},
-					"prompt": "list files",
-					"agentRuntime": {
-						"maxTurns": 3,
-						"workspace": {
-							"gitRepo": "https://github.com/sozercan/ayna",
-							"ref": "main"
-						}
-					}
+		Expect(createK8sSecret(publicationCredentialName, namespace, map[string]string{
+			"token": "placeholder",
+		})).To(Succeed(), "Failed to create dummy publication credential Secret")
+		Expect(createK8sSecret(forgeCredentialName, namespace, map[string]string{
+			"token": "placeholder",
+		})).To(Succeed(), "Failed to create dummy forge credential Secret")
+		createClaudeAgent(agentName)
+
+		manifest := fmt.Sprintf(`{
+			"apiVersion": "core.orka.ai/v1alpha1",
+			"kind": "Task",
+			"metadata": {"name": %q, "namespace": %q},
+			"spec": {
+				"type": "agent",
+				"agentRef": {"name": %q},
+				"prompt": "Prepare a reviewed change.",
+				"agentRuntime": {"maxTurns": 3},
+				"workspace": {
+					"intent": "write",
+					"gitRepo": "https://github.com/example/source",
+					"publicationGitRepo": "https://github.com/example/fork",
+					"publicationCredentialRef": {"name": %q, "key": "token"},
+					"forgeCredentialRef": {"name": %q, "key": "token"},
+					"pushBranch": "e2e/test-branch",
+					"prBaseBranch": "develop",
+					"createPR": true
 				}
-			}`, taskName, namespace, agentName)
-
-			cmd = exec.Command("kubectl", "apply", "-f", "-")
-			cmd.Stdin = stringReader(taskManifest)
-			_, err = utils.Run(cmd)
-			Expect(err).NotTo(HaveOccurred(), "Failed to create Task")
-
-			By("verifying harness-wrapper workspace ref metadata")
-			verifyHarnessWrapperMetadataForTask(taskName, map[string]string{
-				"runtime":   "claude",
-				"wrapper":   "cli",
-				"gitRepo":   "https://github.com/sozercan/ayna",
-				"gitRef":    "main",
-				"maxTurns":  "3",
-				"allowBash": "false",
-			}, 2*time.Minute)
-
-			By("verifying the Task does not use a worker Job")
-			verifyNoJobForTask(taskName, 5*time.Second)
-		})
-	})
-
-	// --- Test 4: Structural env vars (forkRepo, prBaseBranch) ---
-
-	Describe("Structural env vars for forkRepo and prBaseBranch", func() {
-		const (
-			agentName = prefix + "fork-agent"
-			taskName  = prefix + "fork-task"
-		)
-
-		AfterEach(func() {
-			dumpDebugInfo(taskName)
-			cmd := exec.Command("kubectl", "delete", "task", taskName,
-				"-n", namespace, "--ignore-not-found")
-			_, _ = utils.Run(cmd)
-			cmd = exec.Command("kubectl", "delete", "agent", agentName,
-				"-n", namespace, "--ignore-not-found")
-			_, _ = utils.Run(cmd)
-		})
-
-		It("should set ORKA_FORK_REPO and ORKA_PR_BASE_BRANCH env vars on the Job", func() {
-			By("creating an Agent with claude runtime")
-			agentManifest := fmt.Sprintf(`{
-				"apiVersion": "core.orka.ai/v1alpha1",
-				"kind": "Agent",
-				"metadata": {
-					"name": "%s",
-					"namespace": "%s"
-				},
-				"spec": {
-					"runtime": {
-						"type": "claude",
-						"defaultMaxTurns": 5,
-						"defaultAllowBash": false
-					}
-				}
-			}`, agentName, namespace)
-
-			cmd := exec.Command("kubectl", "apply", "-f", "-")
-			cmd.Stdin = stringReader(agentManifest)
-			_, err := utils.Run(cmd)
-			Expect(err).NotTo(HaveOccurred(), "Failed to create Agent")
-
-			By("creating a Task with forkRepo and prBaseBranch in workspace")
-			taskManifest := fmt.Sprintf(`{
-				"apiVersion": "core.orka.ai/v1alpha1",
-				"kind": "Task",
-				"metadata": {
-					"name": "%s",
-					"namespace": "%s"
-				},
-				"spec": {
-					"type": "agent",
-					"prompt": "list files",
-					"agentRef": {"name": "%s"},
-					"agentRuntime": {
-						"maxTurns": 3,
-						"workspace": {
-							"gitRepo": "https://github.com/upstream/repo",
-							"forkRepo": "https://github.com/fork/repo",
-							"prBaseBranch": "develop"
-						}
-					}
-				}
-			}`, taskName, namespace, agentName)
-
-			cmd = exec.Command("kubectl", "apply", "-f", "-")
-			cmd.Stdin = stringReader(taskManifest)
-			_, err = utils.Run(cmd)
-			Expect(err).NotTo(HaveOccurred(), "Failed to create Task")
-
-			By("verifying harness-wrapper fork workspace metadata")
-			verifyHarnessWrapperMetadataForTask(taskName, map[string]string{
-				"runtime":      "claude",
-				"wrapper":      "cli",
-				"gitRepo":      "https://github.com/upstream/repo",
-				"forkRepo":     "https://github.com/fork/repo",
-				"prBaseBranch": "develop",
-				"maxTurns":     "3",
-				"allowBash":    "false",
-			}, 2*time.Minute)
-
-			By("verifying the Task does not use a worker Job")
-			verifyNoJobForTask(taskName, 5*time.Second)
-		})
+			}
+		}`, taskName, namespace, agentName, publicationCredentialName, forgeCredentialName)
+		cmd := exec.Command("kubectl", "apply", "-f", "-")
+		cmd.Stdin = stringReader(manifest)
+		_, err := utils.Run(cmd)
+		Expect(err).NotTo(HaveOccurred(), "Failed to create Task")
+
+		verifyACPTaskRuntimeForTask(taskName, acpTaskExpectation{
+			ProviderKind:    "claude",
+			WorkspaceIntent: "write",
+			MaxTurns:        acpInt32(3),
+			AllowBash:       acpBool(false),
+			Workspace: &acpWorkspaceExpectation{
+				Intent:                    "write",
+				GitRepo:                   "https://github.com/example/source",
+				PublicationGitRepo:        "https://github.com/example/fork",
+				PublicationCredentialName: publicationCredentialName,
+				PushBranch:                "e2e/test-branch",
+				PRBaseBranch:              "develop",
+				CreatePR:                  acpBool(true),
+			},
+		}, 2*time.Minute)
 	})
 
-	// --- Test 5: Init container for session transcript ---
-
-	Describe("Init container for session transcript", func() {
-		const (
-			agentName = prefix + "session-agent"
-			taskName  = prefix + "session-task"
-			sessionID = prefix + "test-session"
-		)
-
-		AfterEach(func() {
-			dumpDebugInfo(taskName)
-			cmd := exec.Command("kubectl", "delete", "task", taskName,
-				"-n", namespace, "--ignore-not-found")
-			_, _ = utils.Run(cmd)
-			cmd = exec.Command("kubectl", "delete", "agent", agentName,
-				"-n", namespace, "--ignore-not-found")
-			_, _ = utils.Run(cmd)
-		})
-
-		It("should start a harness-wrapper turn when sessionRef is set", func() {
-			By("creating an Agent with claude runtime")
-			agentManifest := fmt.Sprintf(`{
-				"apiVersion": "core.orka.ai/v1alpha1",
-				"kind": "Agent",
-				"metadata": {
-					"name": "%s",
-					"namespace": "%s"
-				},
-				"spec": {
-					"runtime": {
-						"type": "claude",
-						"defaultMaxTurns": 5,
-						"defaultAllowBash": false
-					}
-				}
-			}`, agentName, namespace)
-
-			cmd := exec.Command("kubectl", "apply", "-f", "-")
-			cmd.Stdin = stringReader(agentManifest)
-			_, err := utils.Run(cmd)
-			Expect(err).NotTo(HaveOccurred(), "Failed to create Agent")
-
-			By("creating a Task with sessionRef")
-			taskManifest := fmt.Sprintf(`{
-				"apiVersion": "core.orka.ai/v1alpha1",
-				"kind": "Task",
-				"metadata": {
-					"name": "%s",
-					"namespace": "%s"
-				},
-				"spec": {
-					"type": "agent",
-					"prompt": "say hello",
-					"agentRef": {"name": "%s"},
-					"sessionRef": {
-						"name": "%s",
-						"create": true,
-						"append": true
-					},
-					"agentRuntime": {
-						"maxTurns": 3
-					}
-				}
-			}`, taskName, namespace, agentName, sessionID)
-
-			cmd = exec.Command("kubectl", "apply", "-f", "-")
-			cmd.Stdin = stringReader(taskManifest)
-			_, err = utils.Run(cmd)
-			Expect(err).NotTo(HaveOccurred(), "Failed to create Task")
-
-			By("verifying harness-wrapper metadata is planned for the session task")
-			verifyHarnessWrapperMetadataForTask(taskName, map[string]string{
-				"runtime":   "claude",
-				"wrapper":   "cli",
-				"maxTurns":  "3",
-				"allowBash": "false",
-			}, 2*time.Minute)
-
-			By("verifying the Task does not use a worker Job")
-			verifyNoJobForTask(taskName, 5*time.Second)
-		})
+	It("queues sessionRef tasks without legacy turn annotations", func() {
+		agentName := prefix + "session-agent"
+		taskName := prefix + "session-task"
+		DeferCleanup(cleanup, taskName, agentName)
+		createClaudeAgent(agentName)
+
+		manifest := fmt.Sprintf(`{
+			"apiVersion": "core.orka.ai/v1alpha1",
+			"kind": "Task",
+			"metadata": {"name": %q, "namespace": %q},
+			"spec": {
+				"type": "agent",
+				"agentRef": {"name": %q},
+				"sessionRef": {"name": "e2e-workspace-session", "create": true, "append": true},
+				"prompt": "Start a governed ACP session.",
+				"agentRuntime": {"maxTurns": 3},
+				"workspace": {"intent": "read"}
+			}
+		}`, taskName, namespace, agentName)
+		cmd := exec.Command("kubectl", "apply", "-f", "-")
+		cmd.Stdin = stringReader(manifest)
+		_, err := utils.Run(cmd)
+		Expect(err).NotTo(HaveOccurred(), "Failed to create Task")
+
+		verifyACPTaskRuntimeForTask(taskName, acpTaskExpectation{
+			ProviderKind:    "claude",
+			WorkspaceIntent: "read",
+			MaxTurns:        acpInt32(3),
+			AllowBash:       acpBool(false),
+			SessionName:     "e2e-workspace-session",
+			Workspace:       &acpWorkspaceExpectation{Intent: "read"},
+		}, 2*time.Minute)
+		verifyNoJobForTask(taskName, 5*time.Second)
 	})
 })
diff --git a/ui/src/components/agents/agent-create-form.test.tsx b/ui/src/components/agents/agent-create-form.test.tsx
index af2bf384b..6d151db2d 100644
--- a/ui/src/components/agents/agent-create-form.test.tsx
+++ b/ui/src/components/agents/agent-create-form.test.tsx
@@ -1,11 +1,8 @@
 import { describe, it, expect, beforeEach, vi } from 'vitest'
 
-// Track useState calls to override mode initial value
 let useStateModeOverride: string | null = null
 
-vi.mock('zustand/middleware', () => ({
-  persist: (fn: unknown) => fn,
-}))
+vi.mock('zustand/middleware', () => ({ persist: (fn: unknown) => fn }))
 
 const mockNavigate = vi.fn()
 vi.mock('@tanstack/react-router', async () => {
@@ -35,31 +32,7 @@ vi.mock('react', async () => {
   }
 })
 
-// Polyfill ResizeObserver for jsdom (needed by Radix Select in runtime mode)
-if (typeof globalThis.ResizeObserver === 'undefined') {
-  globalThis.ResizeObserver = class {
-    observe() {}
-    unobserve() {}
-    disconnect() {}
-  } as any
-}
-
-if (typeof HTMLElement !== 'undefined') {
-  if (!HTMLElement.prototype.hasPointerCapture) {
-    HTMLElement.prototype.hasPointerCapture = () => false
-  }
-  if (!HTMLElement.prototype.setPointerCapture) {
-    HTMLElement.prototype.setPointerCapture = () => {}
-  }
-  if (!HTMLElement.prototype.releasePointerCapture) {
-    HTMLElement.prototype.releasePointerCapture = () => {}
-  }
-  if (!HTMLElement.prototype.scrollIntoView) {
-    HTMLElement.prototype.scrollIntoView = () => {}
-  }
-}
-
-import { render, screen, waitFor } from '@/test/test-utils'
+import { render, screen, waitFor, fireEvent, act } from '@/test/test-utils'
 import userEvent from '@testing-library/user-event'
 import { http, HttpResponse } from 'msw'
 import { server } from '@/test/mocks/server'
@@ -68,8 +41,19 @@ import { useUIStore } from '@/stores/ui'
 import { useAuthStore } from '@/stores/auth'
 import { AgentCreateForm } from './agent-create-form'
 
+function installDOMPolyfills() {
+  if (typeof globalThis.ResizeObserver === 'undefined') {
+    globalThis.ResizeObserver = class { observe() {}; unobserve() {}; disconnect() {} } as any
+  }
+  if (!HTMLElement.prototype.hasPointerCapture) HTMLElement.prototype.hasPointerCapture = () => false
+  if (!HTMLElement.prototype.setPointerCapture) HTMLElement.prototype.setPointerCapture = () => {}
+  if (!HTMLElement.prototype.releasePointerCapture) HTMLElement.prototype.releasePointerCapture = () => {}
+  if (!HTMLElement.prototype.scrollIntoView) HTMLElement.prototype.scrollIntoView = () => {}
+}
+
 describe('AgentCreateForm', () => {
   beforeEach(() => {
+    installDOMPolyfills()
     useUIStore.setState({ namespace: 'default', sidebarCollapsed: false, theme: 'light' })
     useAuthStore.setState({ token: 'test-token' })
     useStateModeOverride = null
@@ -78,216 +62,240 @@ describe('AgentCreateForm', () => {
     vi.mocked(toast.error).mockClear()
   })
 
-  it('renders form with name and mode fields', () => {
-    render(<AgentCreateForm />)
-    expect(screen.getByText('Name')).toBeInTheDocument()
-    expect(screen.getByText('Mode')).toBeInTheDocument()
-    expect(screen.getByPlaceholderText('my-agent')).toBeInTheDocument()
-  })
-
-  it('AI mode shows provider, model, temperature, max tokens, system prompt', () => {
+  it('preserves native AI configuration fields', () => {
     render(<AgentCreateForm />)
+    expect(screen.getAllByText('Native AI (LLM provider)').length).toBeGreaterThan(0)
     expect(screen.getByText('Provider')).toBeInTheDocument()
-    expect(screen.getByText('Model')).toBeInTheDocument()
     expect(screen.getByText('Temperature')).toBeInTheDocument()
     expect(screen.getByText('Max Tokens')).toBeInTheDocument()
-    expect(screen.getByText('System Prompt')).toBeInTheDocument()
-  })
-
-  it('Runtime mode shows runtime type, max turns, allowed tools, allow bash switch', () => {
-    useStateModeOverride = 'runtime'
-    render(<AgentCreateForm />)
-    expect(screen.getByText('Runtime Type')).toBeInTheDocument()
-    expect(screen.getByText('Max Turns')).toBeInTheDocument()
-    expect(screen.getByText('Allowed Tools')).toBeInTheDocument()
-    expect(screen.getByText('Allow Bash')).toBeInTheDocument()
+    expect(screen.getByText('Secret Reference')).toBeInTheDocument()
   })
 
-  it('Runtime mode includes Codex as an available runtime option', async () => {
+  it('shows all built-in ACP runtime options without legacy loop controls', async () => {
     useStateModeOverride = 'runtime'
     const user = userEvent.setup()
     render(<AgentCreateForm />)
-
-    const selects = screen.getAllByRole('combobox')
-    await user.click(selects[1])
-    expect(screen.getAllByText('OpenAI Codex').length).toBeGreaterThan(0)
+    expect(screen.getByText('Runtime source')).toBeInTheDocument()
+    expect(screen.getByText('Runtime profile')).toBeInTheDocument()
+    expect(screen.getAllByText('Orka-managed RuntimePool').length).toBeGreaterThan(0)
+    expect(screen.getByLabelText('Model')).toBeRequired()
+    expect(screen.getByLabelText('Model')).toHaveAttribute('placeholder', 'Enter model identifier')
+    expect(screen.queryByText('Max Turns')).not.toBeInTheDocument()
+    expect(screen.queryByText('Allowed Tools')).not.toBeInTheDocument()
+    expect(screen.queryByText('Allow Bash')).not.toBeInTheDocument()
+
+    const profileTrigger = screen.getByText('Runtime profile').closest('.space-y-2')!.querySelector('[role="combobox"]')!
+    await user.click(profileTrigger)
+    expect(await screen.findByRole('option', { name: 'Claude ACP' })).toBeInTheDocument()
+    expect(screen.getByRole('option', { name: 'OpenAI Codex ACP' })).toBeInTheDocument()
+    expect(screen.getByRole('option', { name: 'GitHub Copilot ACP' })).toBeInTheDocument()
+    expect(screen.getByRole('option', { name: 'OpenCode ACP' })).toBeInTheDocument()
   })
 
-  it('Runtime mode includes OpenCode as an available runtime option', async () => {
+  it('submits a built-in ACP runtime profile', async () => {
     useStateModeOverride = 'runtime'
-    const user = userEvent.setup()
-    render(<AgentCreateForm />)
-
-    const selects = screen.getAllByRole('combobox')
-    await user.click(selects[1])
-    expect(screen.getAllByText('OpenCode').length).toBeGreaterThan(0)
-  })
-
-  it('secret reference select is shown', () => {
-    render(<AgentCreateForm />)
-    expect(screen.getByText('Secret Reference')).toBeInTheDocument()
-    expect(screen.getByText('Kubernetes Secret containing API keys')).toBeInTheDocument()
-  })
-
-  it('submit button exists', () => {
-    render(<AgentCreateForm />)
-    const buttons = screen.getAllByText('Create Agent')
-    expect(buttons.length).toBeGreaterThanOrEqual(1)
-  })
+    let submitted: any
+    server.use(http.post('/api/v1/agents', async ({ request }) => {
+      submitted = await request.json()
+      return HttpResponse.json({ metadata: { name: submitted.name }, spec: submitted.spec })
+    }))
 
-  it('submits AI agent form and navigates', async () => {
     const user = userEvent.setup()
     render(<AgentCreateForm />)
-
-    await user.type(screen.getByPlaceholderText('my-agent'), 'test-agent')
-    await user.type(screen.getByPlaceholderText('claude-opus-4-5-20250514'), 'my-model')
-
-    // Fill in system prompt to cover line 49
-    await user.type(screen.getByPlaceholderText('Optional system prompt...'), 'You are helpful')
-
-    // Fill in max tokens
-    const maxTokensInput = screen.getByPlaceholderText('Optional')
-    await user.type(maxTokensInput, '4096')
-
+    await user.type(screen.getByPlaceholderText('my-agent'), 'runtime-agent')
+    await user.type(screen.getByLabelText('Model'), 'claude-sonnet-4-20250514')
     await user.click(screen.getByRole('button', { name: 'Create Agent' }))
 
-    await waitFor(() => {
-      expect(toast.success).toHaveBeenCalledWith('Agent created')
-    })
-    expect(mockNavigate).toHaveBeenCalledWith({ to: '/agents' })
+    await waitFor(() => expect(toast.success).toHaveBeenCalledWith('Agent created'))
+    expect(submitted.spec.runtime).toEqual({ type: 'claude' })
+    expect(submitted.spec.model).toEqual({ name: 'claude-sonnet-4-20250514' })
+    expect(submitted.spec.runtime.defaultMaxTurns).toBeUndefined()
+    expect(submitted.spec.secretRef).toBeUndefined()
   })
 
-  it('shows error toast when submission fails', async () => {
-    server.use(
-      http.post('/api/v1/agents', () => new HttpResponse('Bad request', { status: 400 })),
-    )
+  it('submits a built-in Copilot ACP runtime profile', async () => {
+    useStateModeOverride = 'runtime'
+    let submitted: any
+    server.use(http.post('/api/v1/agents', async ({ request }) => {
+      submitted = await request.json()
+      return HttpResponse.json({ metadata: { name: submitted.name }, spec: submitted.spec })
+    }))
+
     const user = userEvent.setup()
     render(<AgentCreateForm />)
-
-    await user.type(screen.getByPlaceholderText('my-agent'), 'bad-agent')
+    await user.type(screen.getByPlaceholderText('my-agent'), 'copilot-agent')
+    const profileTrigger = screen.getByText('Runtime profile').closest('.space-y-2')!.querySelector('[role="combobox"]')!
+    await act(async () => {
+      fireEvent.pointerDown(profileTrigger, { button: 0, pointerId: 1, pointerType: 'mouse' })
+    })
+    const copilotOption = await screen.findByRole('option', { name: 'GitHub Copilot ACP' })
+    await act(async () => {
+      fireEvent.click(copilotOption)
+    })
+    await waitFor(() => expect(profileTrigger).toHaveTextContent('GitHub Copilot ACP'))
+    await user.type(screen.getByLabelText('Model'), 'gpt-5.3-codex')
     await user.click(screen.getByRole('button', { name: 'Create Agent' }))
 
-    await waitFor(() => {
-      expect(toast.error).toHaveBeenCalled()
-    })
+    await waitFor(() => expect(toast.success).toHaveBeenCalledWith('Agent created'))
+    expect(submitted.spec.runtime).toEqual({ type: 'copilot' })
+    expect(submitted.spec.model).toEqual({ name: 'gpt-5.3-codex' })
   })
 
-  it('submits runtime agent form and navigates', async () => {
+  it('submits OpenCode with its reviewed defaults and required provider/model ID', async () => {
     useStateModeOverride = 'runtime'
+    let submitted: any
+    server.use(http.post('/api/v1/agents', async ({ request }) => {
+      submitted = await request.json()
+      return HttpResponse.json({ metadata: { name: submitted.name }, spec: submitted.spec })
+    }))
+
     const user = userEvent.setup()
     render(<AgentCreateForm />)
-
-    await user.type(screen.getByPlaceholderText('my-agent'), 'runtime-agent')
-
-    // Interact with allowed tools input to cover line 162
-    const toolsInput = screen.getByPlaceholderText('Read,Glob,Grep,Bash,LS')
-    await user.clear(toolsInput)
-    await user.type(toolsInput, 'Read,Write')
-
+    await user.type(screen.getByPlaceholderText('my-agent'), 'opencode-agent')
+    const profileTrigger = screen.getByText('Runtime profile').closest('.space-y-2')!.querySelector('[role="combobox"]')!
+    await act(async () => {
+      fireEvent.pointerDown(profileTrigger, { button: 0, pointerId: 1, pointerType: 'mouse' })
+    })
+    const opencodeOption = await screen.findByRole('option', { name: 'OpenCode ACP' })
+    await act(async () => {
+      fireEvent.click(opencodeOption)
+    })
+    await waitFor(() => expect(profileTrigger).toHaveTextContent('OpenCode ACP'))
+
+    const modelInput = screen.getByLabelText('Model')
+    expect(modelInput).toBeRequired()
+    expect(modelInput).toHaveAttribute('placeholder', 'openai/gpt-5.4')
+    expect(screen.getByText('OpenCode model IDs use provider/model form.')).toBeInTheDocument()
+    expect(screen.getByText(/Reviewed native-tool defaults: Read, Write, Edit, Bash, Glob, and Grep/)).toBeInTheDocument()
+    await user.type(modelInput, 'openai/gpt-5.4')
+    await user.type(screen.getByLabelText('Context Window'), '32768')
+    await user.type(screen.getByLabelText('Max Output Tokens'), '4096')
     await user.click(screen.getByRole('button', { name: 'Create Agent' }))
 
-    await waitFor(() => {
-      expect(toast.success).toHaveBeenCalledWith('Agent created')
+    await waitFor(() => expect(toast.success).toHaveBeenCalledWith('Agent created'))
+    expect(submitted.spec.runtime).toEqual({
+      type: 'opencode',
+      defaultAllowedTools: ['Read', 'Write', 'Edit', 'Bash', 'Glob', 'Grep'],
+      defaultAllowBash: true,
     })
-    expect(mockNavigate).toHaveBeenCalledWith({ to: '/agents' })
+    expect(submitted.spec.model).toEqual({ name: 'openai/gpt-5.4', contextWindow: 32768, maxTokens: 4096 })
   })
 
-  it('submits the endpoint model for an OpenCode runtime agent', async () => {
+  it('rejects OpenCode when reviewed model limits are missing', async () => {
     useStateModeOverride = 'runtime'
-    let submitted: any
-    server.use(
-      http.post('/api/v1/agents', async ({ request }) => {
-        submitted = await request.json()
-        return HttpResponse.json({ metadata: { name: 'opencode-agent' }, spec: submitted.spec })
-      }),
-    )
+    let postCount = 0
+    server.use(http.post('/api/v1/agents', () => {
+      postCount += 1
+      return HttpResponse.json({})
+    }))
+
     const user = userEvent.setup()
     render(<AgentCreateForm />)
-
     await user.type(screen.getByPlaceholderText('my-agent'), 'opencode-agent')
-    const selects = screen.getAllByRole('combobox')
-    await user.click(selects[1])
-    const opencodeOption = screen.getAllByText('OpenCode').find((element) => element.tagName !== 'OPTION')
-    expect(opencodeOption).toBeDefined()
-    await user.click(opencodeOption!)
-    await user.type(screen.getByPlaceholderText('Endpoint model ID'), 'moonshotai/Kimi-K2-Instruct-0905')
+    const profileTrigger = screen.getByText('Runtime profile').closest('.space-y-2')!.querySelector('[role="combobox"]')!
+    await act(async () => {
+      fireEvent.pointerDown(profileTrigger, { button: 0, pointerId: 1, pointerType: 'mouse' })
+    })
+    fireEvent.click(await screen.findByRole('option', { name: 'OpenCode ACP' }))
+    await user.type(screen.getByLabelText('Model'), 'openai/gpt-5.4')
     await user.click(screen.getByRole('button', { name: 'Create Agent' }))
 
-    await waitFor(() => {
-      expect(toast.success).toHaveBeenCalledWith('Agent created')
-    })
-    expect(submitted.spec.runtime.type).toBe('opencode')
-    expect(submitted.spec.runtime.defaultAllowedTools).toEqual(['Read', 'Glob', 'Grep', 'Bash', 'LS', 'Edit'])
-    expect(submitted.spec.model).toEqual({ name: 'moonshotai/Kimi-K2-Instruct-0905' })
+    expect(toast.error).toHaveBeenCalledWith('OpenCode requires a positive context window')
+    expect(postCount).toBe(0)
   })
 
-  it('preserves an edited tool list across runtime changes', async () => {
+  it('rejects a bare OpenCode model name before posting', async () => {
     useStateModeOverride = 'runtime'
+    let postCount = 0
+    server.use(http.post('/api/v1/agents', () => {
+      postCount += 1
+      return HttpResponse.json({})
+    }))
+
     const user = userEvent.setup()
     render(<AgentCreateForm />)
+    await user.type(screen.getByPlaceholderText('my-agent'), 'opencode-agent')
+    const profileTrigger = screen.getByText('Runtime profile').closest('.space-y-2')!.querySelector('[role="combobox"]')!
+    await act(async () => {
+      fireEvent.pointerDown(profileTrigger, { button: 0, pointerId: 1, pointerType: 'mouse' })
+    })
+    const opencodeOption = await screen.findByRole('option', { name: 'OpenCode ACP' })
+    await act(async () => {
+      fireEvent.click(opencodeOption)
+    })
+    await user.type(screen.getByLabelText('Model'), 'gpt-5.4')
+    await user.click(screen.getByRole('button', { name: 'Create Agent' }))
 
-    const runtimeSelect = screen.getAllByRole('combobox')[1]
-    await user.click(runtimeSelect)
-    const opencodeOption = screen.getAllByText('OpenCode').find((element) => element.tagName !== 'OPTION')
-    expect(opencodeOption).toBeDefined()
-    await user.click(opencodeOption!)
-
-    const toolsInput = screen.getByPlaceholderText('Read,Glob,Grep,Bash,LS,Edit')
-    await user.clear(toolsInput)
-    await user.type(toolsInput, 'Read,Glob,Grep,Bash,LS')
-
-    await user.click(runtimeSelect)
-    const claudeOption = screen.getAllByText('Claude Code').find((element) => element.tagName !== 'OPTION')
-    expect(claudeOption).toBeDefined()
-    await user.click(claudeOption!)
-    await user.click(runtimeSelect)
-    const reopenedOpencodeOption = screen.getAllByText('OpenCode').find((element) => element.tagName !== 'OPTION')
-    expect(reopenedOpencodeOption).toBeDefined()
-    await user.click(reopenedOpencodeOption!)
-
-    expect(toolsInput).toHaveValue('Read,Glob,Grep,Bash,LS')
+    expect(toast.error).toHaveBeenCalledWith('OpenCode requires a literal provider/model ID')
+    expect(postCount).toBe(0)
+    expect(toast.success).not.toHaveBeenCalled()
   })
 
-  it('rejects a whitespace-only OpenCode model', async () => {
+  it('rejects a blank model for built-in ACP runtimes before posting', async () => {
     useStateModeOverride = 'runtime'
+    let postCount = 0
+    server.use(http.post('/api/v1/agents', () => {
+      postCount += 1
+      return HttpResponse.json({})
+    }))
+
     const user = userEvent.setup()
     render(<AgentCreateForm />)
-
-    await user.type(screen.getByPlaceholderText('my-agent'), 'opencode-agent')
-    const selects = screen.getAllByRole('combobox')
-    await user.click(selects[1])
-    const opencodeOption = screen.getAllByText('OpenCode').find((element) => element.tagName !== 'OPTION')
-    expect(opencodeOption).toBeDefined()
-    await user.click(opencodeOption!)
-    await user.type(screen.getByPlaceholderText('Endpoint model ID'), '   ')
+    await user.type(screen.getByPlaceholderText('my-agent'), 'runtime-agent')
+    await user.type(screen.getByLabelText('Model'), '   ')
     await user.click(screen.getByRole('button', { name: 'Create Agent' }))
 
-    expect(toast.error).toHaveBeenCalledWith('OpenCode requires an endpoint model ID')
+    expect(toast.error).toHaveBeenCalledWith('Model is required for built-in ACP runtimes')
+    expect(postCount).toBe(0)
     expect(toast.success).not.toHaveBeenCalled()
+    expect(mockNavigate).not.toHaveBeenCalled()
   })
 
-  it('submits runtime agent with empty allowed tools', async () => {
+  it('submits an external v2 AgentRuntime reference', async () => {
     useStateModeOverride = 'runtime'
+    let submitted: any
+    server.use(http.post('/api/v1/agents', async ({ request }) => {
+      submitted = await request.json()
+      return HttpResponse.json({ metadata: { name: submitted.name }, spec: submitted.spec })
+    }))
+
     const user = userEvent.setup()
     render(<AgentCreateForm />)
-
-    await user.type(screen.getByPlaceholderText('my-agent'), 'rt-agent-2')
-
-    // Clear the allowed tools input to cover the empty-trim branch (line 56)
-    const toolsInput = screen.getByPlaceholderText('Read,Glob,Grep,Bash,LS')
-    await user.clear(toolsInput)
-
+    await user.type(screen.getByPlaceholderText('my-agent'), 'external-agent')
+    const sourceTrigger = screen.getByText('Runtime source').closest('.space-y-2')!.querySelector('[role="combobox"]')!
+    await act(async () => {
+      fireEvent.pointerDown(sourceTrigger, { button: 0, pointerId: 1, pointerType: 'mouse' })
+    })
+    const externalOption = await screen.findByRole('option', { name: 'External v2 AgentRuntime' })
+    await act(async () => {
+      fireEvent.click(externalOption)
+    })
+    await waitFor(() => expect(sourceTrigger).toHaveTextContent('External v2 AgentRuntime'))
+    await user.type(screen.getByPlaceholderText('external-codex'), 'external-codex')
+    expect(screen.getByLabelText('Model override')).not.toBeRequired()
+    expect(screen.getByLabelText('Model override')).toHaveAttribute('placeholder', 'Optional model override')
     await user.click(screen.getByRole('button', { name: 'Create Agent' }))
 
-    await waitFor(() => {
-      expect(toast.success).toHaveBeenCalledWith('Agent created')
-    })
+    await waitFor(() => expect(toast.success).toHaveBeenCalledWith('Agent created'))
+    expect(submitted.spec.runtime).toEqual({ runtimeRef: { name: 'external-codex' } })
+    expect(submitted.spec.model).toBeUndefined()
   })
 
-  it('cancel button navigates to agents', async () => {
+  it('submits native AI agents unchanged', async () => {
+    let submitted: any
+    server.use(http.post('/api/v1/agents', async ({ request }) => {
+      submitted = await request.json()
+      return HttpResponse.json({ metadata: { name: submitted.name }, spec: submitted.spec })
+    }))
     const user = userEvent.setup()
     render(<AgentCreateForm />)
-    await user.click(screen.getByRole('button', { name: 'Cancel' }))
+    await user.type(screen.getByPlaceholderText('my-agent'), 'native-agent')
+    await user.type(screen.getByPlaceholderText('claude-sonnet-4-20250514'), 'native-model')
+    await user.click(screen.getByRole('button', { name: 'Create Agent' }))
+
+    await waitFor(() => expect(toast.success).toHaveBeenCalledWith('Agent created'))
+    expect(submitted.spec.runtime).toBeUndefined()
+    expect(submitted.spec.model.name).toBe('native-model')
     expect(mockNavigate).toHaveBeenCalledWith({ to: '/agents' })
   })
 })
diff --git a/ui/src/components/agents/agent-create-form.tsx b/ui/src/components/agents/agent-create-form.tsx
index 3f41df035..fbf8bc44c 100644
--- a/ui/src/components/agents/agent-create-form.tsx
+++ b/ui/src/components/agents/agent-create-form.tsx
@@ -4,21 +4,16 @@ import { Button } from '@/components/ui/button'
 import { Input } from '@/components/ui/input'
 import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card'
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select'
-import { Switch } from '@/components/ui/switch'
 import { PageHeader } from '@/components/layout/page-header'
 import { useCreateAgent } from '@/hooks/use-agents'
 import { useSecretNames } from '@/hooks/use-secrets'
 import { useUIStore } from '@/stores/ui'
 import { toast } from 'sonner'
-
-type AgentRuntimeType = 'claude' | 'copilot' | 'codex' | 'opencode'
-
-const defaultAllowedTools = 'Read,Glob,Grep,Bash,LS'
-const openCodeDefaultAllowedTools = `${defaultAllowedTools},Edit`
-
-function allowedToolsForRuntime(runtimeType: AgentRuntimeType) {
-  return runtimeType === 'opencode' ? openCodeDefaultAllowedTools : defaultAllowedTools
-}
+import {
+  OPENCODE_REVIEWED_RUNTIME_DEFAULTS,
+  isOpenCodeModelID,
+  type BuiltInAgentRuntimeType,
+} from '@/lib/agent-runtime'
 
 export function AgentCreateForm() {
   const navigate = useNavigate()
@@ -29,35 +24,55 @@ export function AgentCreateForm() {
   const [name, setName] = useState('')
   const [mode, setMode] = useState<'ai' | 'runtime'>('ai')
 
-  // AI mode fields
+  // Native AI mode fields remain unchanged by the ACP runtime cutover.
   const [provider, setProvider] = useState('')
   const [model, setModel] = useState('')
   const [temperature, setTemperature] = useState('0.7')
+  const [contextWindow, setContextWindow] = useState('')
   const [maxTokens, setMaxTokens] = useState('')
   const [secretRef, setSecretRef] = useState('')
   const [systemPrompt, setSystemPrompt] = useState('')
 
-  // Runtime mode fields
-  const [runtimeType, setRuntimeType] = useState<AgentRuntimeType>('claude')
-  const [maxTurns, setMaxTurns] = useState('50')
-  const [allowBash, setAllowBash] = useState(true)
-  const [allowedTools, setAllowedTools] = useState(defaultAllowedTools)
-  const [allowedToolsEdited, setAllowedToolsEdited] = useState(false)
-
-  const handleRuntimeTypeChange = (value: string) => {
-    const nextRuntimeType = value as AgentRuntimeType
-    if (!allowedToolsEdited) {
-      setAllowedTools(allowedToolsForRuntime(nextRuntimeType))
-    }
-    setRuntimeType(nextRuntimeType)
-  }
+  // ACP runtime mode selects either an Orka-managed profile or a registered v2 runtime.
+  const [runtimeSource, setRuntimeSource] = useState<'built-in' | 'external'>('built-in')
+  const [runtimeType, setRuntimeType] = useState<BuiltInAgentRuntimeType>('claude')
+  const [runtimeRef, setRuntimeRef] = useState('')
 
   const handleSubmit = async (e: React.FormEvent) => {
     e.preventDefault()
 
     const trimmedModel = model.trim()
-    if (mode === 'runtime' && runtimeType === 'opencode' && !trimmedModel) {
-      toast.error('OpenCode requires an endpoint model ID')
+    if (
+      mode === 'runtime'
+      && runtimeSource === 'built-in'
+      && runtimeType === 'opencode'
+      && !isOpenCodeModelID(trimmedModel)
+    ) {
+      toast.error('OpenCode requires a literal provider/model ID')
+      return
+    }
+    if (mode === 'runtime' && runtimeSource === 'built-in' && !trimmedModel) {
+      toast.error('Model is required for built-in ACP runtimes')
+      return
+    }
+    const parsedContextWindow = Number(contextWindow)
+    const parsedMaxTokens = Number(maxTokens)
+    if (mode === 'runtime' && runtimeSource === 'built-in' && runtimeType === 'opencode') {
+      if (!Number.isInteger(parsedContextWindow) || parsedContextWindow <= 0) {
+        toast.error('OpenCode requires a positive context window')
+        return
+      }
+      if (!Number.isInteger(parsedMaxTokens) || parsedMaxTokens <= 0) {
+        toast.error('OpenCode requires a positive max output token limit')
+        return
+      }
+      if (parsedContextWindow <= parsedMaxTokens) {
+        toast.error('OpenCode context window must exceed max output tokens')
+        return
+      }
+    }
+    if (mode === 'runtime' && runtimeSource === 'external' && !runtimeRef.trim()) {
+      toast.error('AgentRuntime name is required')
       return
     }
 
@@ -73,22 +88,26 @@ export function AgentCreateForm() {
       if (systemPrompt) {
         spec.systemPrompt = { inline: systemPrompt }
       }
-    } else {
-      spec.runtime = {
-        type: runtimeType,
-        defaultMaxTurns: parseInt(maxTurns),
-        defaultAllowBash: allowBash,
-        ...(allowedTools.trim() ? { defaultAllowedTools: allowedTools.split(',').map(t => t.trim()).filter(Boolean) } : {}),
+      if (secretRef && secretRef !== '__none__') {
+        spec.secretRef = { name: secretRef }
       }
+    } else {
+      spec.runtime = runtimeSource === 'built-in'
+        ? runtimeType === 'opencode'
+          ? {
+              type: runtimeType,
+              defaultAllowedTools: [...OPENCODE_REVIEWED_RUNTIME_DEFAULTS.defaultAllowedTools],
+              defaultAllowBash: OPENCODE_REVIEWED_RUNTIME_DEFAULTS.defaultAllowBash,
+            }
+          : { type: runtimeType }
+        : { runtimeRef: { name: runtimeRef.trim() } }
       if (trimmedModel) {
-        spec.model = { name: trimmedModel }
+        spec.model = runtimeSource === 'built-in' && runtimeType === 'opencode'
+          ? { name: trimmedModel, contextWindow: parsedContextWindow, maxTokens: parsedMaxTokens }
+          : { name: trimmedModel }
       }
     }
 
-    if (secretRef && secretRef !== '__none__') {
-      spec.secretRef = { name: secretRef }
-    }
-
     try {
       await createAgent.mutateAsync({ name, namespace, spec })
       toast.success('Agent created')
@@ -100,7 +119,7 @@ export function AgentCreateForm() {
 
   return (
     <div className="space-y-4">
-      <PageHeader title="Create Agent" description="Configure a new AI agent" />
+      <PageHeader title="Create Agent" description="Configure a native AI agent or an ACP runtime profile" />
       <Card>
         <CardHeader>
           <CardTitle>Agent Configuration</CardTitle>
@@ -109,16 +128,16 @@ export function AgentCreateForm() {
           <form onSubmit={handleSubmit} className="space-y-4">
             <div className="grid gap-4 md:grid-cols-2">
               <div className="space-y-2">
-                <label className="text-sm font-medium">Name</label>
-                <Input value={name} onChange={(e) => setName(e.target.value)} placeholder="my-agent" required />
+                <label htmlFor="agent-name" className="text-sm font-medium">Name</label>
+                <Input id="agent-name" value={name} onChange={(e) => setName(e.target.value)} placeholder="my-agent" required />
               </div>
               <div className="space-y-2">
                 <label className="text-sm font-medium">Mode</label>
-                <Select value={mode} onValueChange={(v) => setMode(v as 'ai' | 'runtime')}>
+                <Select value={mode} onValueChange={(value) => setMode(value as 'ai' | 'runtime')}>
                   <SelectTrigger><SelectValue /></SelectTrigger>
                   <SelectContent>
-                    <SelectItem value="ai">AI (LLM Provider)</SelectItem>
-                    <SelectItem value="runtime">CLI Runtime (Copilot / Claude / Codex / OpenCode)</SelectItem>
+                    <SelectItem value="ai">Native AI (LLM provider)</SelectItem>
+                    <SelectItem value="runtime">ACP agent runtime</SelectItem>
                   </SelectContent>
                 </Select>
               </div>
@@ -128,9 +147,9 @@ export function AgentCreateForm() {
               <div className="space-y-4">
                 <div className="grid gap-4 md:grid-cols-2">
                   <div className="space-y-2">
-                    <label className="text-sm font-medium">Provider</label>
+                    <label htmlFor="agent-provider" className="text-sm font-medium">Provider</label>
                     <Select value={provider} onValueChange={setProvider}>
-                      <SelectTrigger><SelectValue placeholder="Select provider" /></SelectTrigger>
+                      <SelectTrigger id="agent-provider"><SelectValue placeholder="Select provider" /></SelectTrigger>
                       <SelectContent>
                         <SelectItem value="anthropic">Anthropic</SelectItem>
                         <SelectItem value="openai">OpenAI</SelectItem>
@@ -138,97 +157,149 @@ export function AgentCreateForm() {
                     </Select>
                   </div>
                   <div className="space-y-2">
-                    <label className="text-sm font-medium">Model</label>
-                    <Input value={model} onChange={(e) => setModel(e.target.value)} placeholder="claude-opus-4-5-20250514" />
+                    <label htmlFor="agent-model" className="text-sm font-medium">Model</label>
+                    <Input id="agent-model" value={model} onChange={(e) => setModel(e.target.value)} placeholder="claude-sonnet-4-20250514" />
                   </div>
                 </div>
                 <div className="grid gap-4 md:grid-cols-2">
                   <div className="space-y-2">
-                    <label className="text-sm font-medium">Temperature</label>
-                    <Input type="number" step="0.1" min="0" max="2" value={temperature} onChange={(e) => setTemperature(e.target.value)} />
+                    <label htmlFor="agent-temperature" className="text-sm font-medium">Temperature</label>
+                    <Input id="agent-temperature" type="number" step="0.1" min="0" max="2" value={temperature} onChange={(e) => setTemperature(e.target.value)} />
                   </div>
                   <div className="space-y-2">
-                    <label className="text-sm font-medium">Max Tokens</label>
-                    <Input type="number" value={maxTokens} onChange={(e) => setMaxTokens(e.target.value)} placeholder="Optional" />
+                    <label htmlFor="agent-max-tokens" className="text-sm font-medium">Max Tokens</label>
+                    <Input id="agent-max-tokens" type="number" value={maxTokens} onChange={(e) => setMaxTokens(e.target.value)} />
                   </div>
                 </div>
                 <div className="space-y-2">
-                  <label className="text-sm font-medium">System Prompt</label>
+                  <label htmlFor="agent-system-prompt" className="text-sm font-medium">System Prompt</label>
                   <textarea
+                    id="agent-system-prompt"
                     className="flex min-h-24 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
                     value={systemPrompt}
                     onChange={(e) => setSystemPrompt(e.target.value)}
                     placeholder="Optional system prompt..."
                   />
                 </div>
+                <div className="space-y-2">
+                  <label className="text-sm font-medium">Secret Reference</label>
+                  <Select value={secretRef} onValueChange={setSecretRef}>
+                    <SelectTrigger><SelectValue placeholder="Select a secret..." /></SelectTrigger>
+                    <SelectContent>
+                      <SelectItem value="__none__">None</SelectItem>
+                      {(secretsData?.items ?? []).map((secret) => (
+                        <SelectItem key={secret.name} value={secret.name}>{secret.name}</SelectItem>
+                      ))}
+                    </SelectContent>
+                  </Select>
+                  <p className="text-xs text-muted-foreground">Kubernetes Secret containing native AI provider credentials</p>
+                </div>
               </div>
             )}
 
             {mode === 'runtime' && (
-              <div className="space-y-4">
-                <div className="grid gap-4 md:grid-cols-2">
+              <div className="space-y-4 rounded-md border bg-muted/20 p-4">
+                <div className="space-y-2">
+                  <label className="text-sm font-medium">Runtime source</label>
+                  <Select value={runtimeSource} onValueChange={(value) => setRuntimeSource(value as 'built-in' | 'external')}>
+                    <SelectTrigger><SelectValue /></SelectTrigger>
+                    <SelectContent>
+                      <SelectItem value="built-in">Orka-managed RuntimePool</SelectItem>
+                      <SelectItem value="external">External v2 AgentRuntime</SelectItem>
+                    </SelectContent>
+                  </Select>
+                  <p className="text-xs text-muted-foreground">
+                    Runtime credentials and publication credentials are never copied into the ACP process tree.
+                  </p>
+                </div>
+
+                {runtimeSource === 'built-in' ? (
                   <div className="space-y-2">
-                    <label className="text-sm font-medium">Runtime Type</label>
-                    <Select value={runtimeType} onValueChange={handleRuntimeTypeChange}>
+                    <label className="text-sm font-medium">Runtime profile</label>
+                    <Select value={runtimeType} onValueChange={(value) => setRuntimeType(value as BuiltInAgentRuntimeType)}>
                       <SelectTrigger><SelectValue /></SelectTrigger>
                       <SelectContent>
-                        <SelectItem value="claude">Claude Code</SelectItem>
-                        <SelectItem value="copilot">GitHub Copilot</SelectItem>
-                        <SelectItem value="codex">OpenAI Codex</SelectItem>
-                        <SelectItem value="opencode">OpenCode</SelectItem>
+                        <SelectItem value="claude">Claude ACP</SelectItem>
+                        <SelectItem value="codex">OpenAI Codex ACP</SelectItem>
+                        <SelectItem value="copilot">GitHub Copilot ACP</SelectItem>
+                        <SelectItem value="opencode">OpenCode ACP</SelectItem>
                       </SelectContent>
                     </Select>
+                    {runtimeType === 'opencode' && (
+                      <p className="text-xs text-muted-foreground">
+                        Reviewed native-tool defaults: Read, Write, Edit, Bash, Glob, and Grep; bash enabled.
+                      </p>
+                    )}
                   </div>
+                ) : (
                   <div className="space-y-2">
-                    <label className="text-sm font-medium">Max Turns</label>
-                    <Input type="number" min="1" max="1000" value={maxTurns} onChange={(e) => setMaxTurns(e.target.value)} />
+                    <label htmlFor="agent-runtime-ref" className="text-sm font-medium">AgentRuntime name</label>
+                    <Input
+                      id="agent-runtime-ref"
+                      value={runtimeRef}
+                      onChange={(e) => setRuntimeRef(e.target.value)}
+                      placeholder="external-codex"
+                      required
+                    />
+                    <p className="text-xs text-muted-foreground">The registration must pass the orka.harness.v2 conformance profile.</p>
                   </div>
-                </div>
+                )}
+
                 <div className="space-y-2">
-                  <label className="text-sm font-medium">Model</label>
+                  <label htmlFor="runtime-model" className="text-sm font-medium">
+                    {runtimeSource === 'built-in' ? 'Model' : 'Model override'}
+                  </label>
                   <Input
+                    id="runtime-model"
                     value={model}
                     onChange={(e) => setModel(e.target.value)}
-                    placeholder="Endpoint model ID"
-                    required={runtimeType === 'opencode'}
+                    placeholder={
+                      runtimeSource === 'built-in' && runtimeType === 'opencode'
+                        ? 'openai/gpt-5.4'
+                        : runtimeSource === 'built-in'
+                          ? 'Enter model identifier'
+                          : 'Optional model override'
+                    }
+                    required={runtimeSource === 'built-in'}
                   />
-                  <p className="text-xs text-muted-foreground">
-                    Required for OpenCode; optional for runtimes with a configured default model
-                  </p>
-                </div>
-                <div className="space-y-2">
-                  <label className="text-sm font-medium">Allowed Tools</label>
-                  <Input
-                    value={allowedTools}
-                    onChange={(e) => {
-                      setAllowedTools(e.target.value)
-                      setAllowedToolsEdited(true)
-                    }}
-                    placeholder={allowedToolsForRuntime(runtimeType)}
-                  />
-                  <p className="text-xs text-muted-foreground">Comma-separated list of tool names</p>
-                </div>
-                <div className="flex items-center gap-2">
-                  <Switch checked={allowBash} onCheckedChange={setAllowBash} />
-                  <label className="text-sm font-medium">Allow Bash</label>
+                  {runtimeSource === 'built-in' && runtimeType === 'opencode' && (
+                    <p className="text-xs text-muted-foreground">OpenCode model IDs use provider/model form.</p>
+                  )}
                 </div>
+                {runtimeSource === 'built-in' && runtimeType === 'opencode' && (
+                  <div className="grid gap-4 md:grid-cols-2">
+                    <div className="space-y-2">
+                      <label htmlFor="runtime-context-window" className="text-sm font-medium">Context Window</label>
+                      <Input
+                        id="runtime-context-window"
+                        type="number"
+                        min="1"
+                        step="1"
+                        value={contextWindow}
+                        onChange={(e) => setContextWindow(e.target.value)}
+                        placeholder="32768"
+                      />
+                    </div>
+                    <div className="space-y-2">
+                      <label htmlFor="runtime-max-tokens" className="text-sm font-medium">Max Output Tokens</label>
+                      <Input
+                        id="runtime-max-tokens"
+                        type="number"
+                        min="1"
+                        step="1"
+                        value={maxTokens}
+                        onChange={(e) => setMaxTokens(e.target.value)}
+                        placeholder="4096"
+                      />
+                    </div>
+                    <p className="text-xs text-muted-foreground md:col-span-2">
+                      Use reviewed ceilings for the selected model. Orka pins them into the immutable runtime profile.
+                    </p>
+                  </div>
+                )}
               </div>
             )}
 
-            <div className="space-y-2">
-              <label className="text-sm font-medium">Secret Reference</label>
-              <Select value={secretRef} onValueChange={setSecretRef}>
-                <SelectTrigger><SelectValue placeholder="Select a secret..." /></SelectTrigger>
-                <SelectContent>
-                  <SelectItem value="__none__">None</SelectItem>
-                  {(secretsData?.items ?? []).map((s) => (
-                    <SelectItem key={s.name} value={s.name}>{s.name}</SelectItem>
-                  ))}
-                </SelectContent>
-              </Select>
-              <p className="text-xs text-muted-foreground">Kubernetes Secret containing API keys</p>
-            </div>
-
             <div className="flex gap-2">
               <Button type="submit" disabled={createAgent.isPending}>
                 {createAgent.isPending ? 'Creating...' : 'Create Agent'}
diff --git a/ui/src/components/agents/agent-detail.test.tsx b/ui/src/components/agents/agent-detail.test.tsx
index 29e3c2751..7065f4bdc 100644
--- a/ui/src/components/agents/agent-detail.test.tsx
+++ b/ui/src/components/agents/agent-detail.test.tsx
@@ -30,7 +30,7 @@ const fullAgent = {
   metadata: { name: 'test-agent', namespace: 'default', uid: 'uid-1' },
   spec: {
     model: { provider: 'anthropic', name: 'claude-sonnet-4-20250514', temperature: 0.7 },
-    runtime: { type: 'claude', defaultMaxTurns: 50, defaultAllowBash: true, defaultAllowedTools: ['Read', 'Grep'] },
+    runtime: { type: 'claude' },
     tools: [{ name: 'create_task', enabled: true }, { name: 'list_tasks', enabled: false }],
     systemPrompt: { inline: 'You are a helpful agent.' },
     coordination: { enabled: true, maxConcurrentChildren: 3, maxDepth: 2, allowedAgents: [{ name: 'helper' }] },
@@ -93,14 +93,10 @@ describe('AgentDetail', () => {
     )
     render(<AgentDetail agentId="test-agent" />)
     await waitFor(() => {
-      expect(screen.getByText('CLI Runtime')).toBeInTheDocument()
+      expect(screen.getByText('Agent Runtime')).toBeInTheDocument()
     })
-    expect(screen.getByText('claude')).toBeInTheDocument()
-    expect(screen.getByText('50')).toBeInTheDocument()
-    // "Allow Bash: Yes" - use getAllByText since coordination also shows "Yes"
-    expect(screen.getAllByText('Yes').length).toBeGreaterThanOrEqual(1)
-    expect(screen.getByText('Read')).toBeInTheDocument()
-    expect(screen.getByText('Grep')).toBeInTheDocument()
+    expect(screen.getByText('claude ACP')).toBeInTheDocument()
+    expect(screen.getByText('Orka-managed RuntimePool')).toBeInTheDocument()
   })
 
   it('shows status card with active tasks', async () => {
diff --git a/ui/src/components/agents/agent-detail.tsx b/ui/src/components/agents/agent-detail.tsx
index d8c406029..8b7b481f8 100644
--- a/ui/src/components/agents/agent-detail.tsx
+++ b/ui/src/components/agents/agent-detail.tsx
@@ -8,6 +8,7 @@ import { PageHeader } from '@/components/layout/page-header'
 import { ArrowLeft, Bot, Trash2 } from 'lucide-react'
 import { useAgent, useDeleteAgent } from '@/hooks/use-agents'
 import { toast } from 'sonner'
+import { builtInAgentRuntimeLabel } from '@/lib/agent-runtime'
 
 export function AgentDetail({ agentId }: { agentId: string }) {
   const { data: agent, isLoading } = useAgent(agentId)
@@ -60,6 +61,7 @@ export function AgentDetail({ agentId }: { agentId: string }) {
               {agent.spec.model.provider && <div><span className="text-muted-foreground">Provider:</span> {agent.spec.model.provider}</div>}
               {agent.spec.model.name && <div><span className="text-muted-foreground">Model:</span> {agent.spec.model.name}</div>}
               {agent.spec.model.temperature !== undefined && <div><span className="text-muted-foreground">Temperature:</span> {agent.spec.model.temperature}</div>}
+              {agent.spec.model.contextWindow && <div><span className="text-muted-foreground">Context Window:</span> {agent.spec.model.contextWindow}</div>}
               {agent.spec.model.maxTokens && <div><span className="text-muted-foreground">Max Tokens:</span> {agent.spec.model.maxTokens}</div>}
             </CardContent>
           </Card>
@@ -67,18 +69,18 @@ export function AgentDetail({ agentId }: { agentId: string }) {
 
         {agent.spec.runtime && (
           <Card>
-            <CardHeader><CardTitle>CLI Runtime</CardTitle></CardHeader>
+            <CardHeader><CardTitle>Agent Runtime</CardTitle></CardHeader>
             <CardContent className="space-y-2 text-sm">
-              <div><span className="text-muted-foreground">Type:</span> <Badge variant="secondary">{agent.spec.runtime.type}</Badge></div>
-              {agent.spec.runtime.defaultMaxTurns && <div><span className="text-muted-foreground">Max Turns:</span> {agent.spec.runtime.defaultMaxTurns}</div>}
-              <div><span className="text-muted-foreground">Allow Bash:</span> {agent.spec.runtime.defaultAllowBash ? 'Yes' : 'No'}</div>
-              {(agent.spec.runtime.defaultAllowedTools?.length ?? 0) > 0 && (
-                <div>
-                  <span className="text-muted-foreground">Allowed Tools:</span>
-                  <div className="mt-1 flex flex-wrap gap-1">
-                    {agent.spec.runtime.defaultAllowedTools!.map(t => <Badge key={t} variant="outline" className="text-xs">{t}</Badge>)}
-                  </div>
-                </div>
+              {'type' in agent.spec.runtime ? (
+                <>
+                  <div><span className="text-muted-foreground">Source:</span> Orka-managed RuntimePool</div>
+                  <div><span className="text-muted-foreground">Profile:</span> <Badge variant="secondary">{builtInAgentRuntimeLabel(agent.spec.runtime.type)}</Badge></div>
+                </>
+              ) : (
+                <>
+                  <div><span className="text-muted-foreground">Source:</span> External v2 AgentRuntime</div>
+                  <div><span className="text-muted-foreground">Registration:</span> <Badge variant="secondary">{agent.spec.runtime.runtimeRef.name}</Badge></div>
+                </>
               )}
             </CardContent>
           </Card>
diff --git a/ui/src/components/agents/agent-list.test.tsx b/ui/src/components/agents/agent-list.test.tsx
index 25ef32dc6..fad853736 100644
--- a/ui/src/components/agents/agent-list.test.tsx
+++ b/ui/src/components/agents/agent-list.test.tsx
@@ -55,7 +55,12 @@ describe('AgentList', () => {
             },
             {
               metadata: { name: 'agent-b', namespace: 'default', uid: 'uid-b' },
-              spec: { runtime: { type: 'copilot' } },
+              spec: { runtime: { type: 'codex' } },
+              status: { activeTasks: 0 },
+            },
+            {
+              metadata: { name: 'agent-c', namespace: 'default', uid: 'uid-c' },
+              spec: { model: { name: 'openai/gpt-5.4' }, runtime: { type: 'opencode' } },
               status: { activeTasks: 0 },
             },
           ],
@@ -78,7 +83,11 @@ describe('AgentList', () => {
 
     // Agent B: name, runtime badge
     expect(screen.getByText('agent-b')).toBeInTheDocument()
-    expect(screen.getByText('copilot runtime')).toBeInTheDocument()
+    expect(screen.getByText('codex ACP')).toBeInTheDocument()
+
+    // Agent C: OpenCode keeps its branded runtime label.
+    expect(screen.getByText('agent-c')).toBeInTheDocument()
+    expect(screen.getByText('OpenCode ACP')).toBeInTheDocument()
   })
 
   it('agent card shows namespace', async () => {
diff --git a/ui/src/components/agents/agent-list.tsx b/ui/src/components/agents/agent-list.tsx
index 18a4a730a..89fec2b4a 100644
--- a/ui/src/components/agents/agent-list.tsx
+++ b/ui/src/components/agents/agent-list.tsx
@@ -7,6 +7,7 @@ import { PageHeader } from '@/components/layout/page-header'
 import { Bot, Plus } from 'lucide-react'
 import { useAgentList } from '@/hooks/use-agents'
 import type { Agent } from '@/schemas/agent'
+import { builtInAgentRuntimeLabel } from '@/lib/agent-runtime'
 
 export function AgentList() {
   const { data, isLoading } = useAgentList()
@@ -52,7 +53,11 @@ export function AgentList() {
                   <div className="flex flex-wrap gap-2 text-xs">
                     {agent.spec.model?.provider && <Badge variant="secondary">{agent.spec.model.provider}</Badge>}
                     {agent.spec.model?.name && <Badge variant="outline">{agent.spec.model.name}</Badge>}
-                    {agent.spec.runtime && <Badge variant="secondary">{agent.spec.runtime.type} runtime</Badge>}
+                    {agent.spec.runtime && (
+                      <Badge variant="secondary">
+                        {'type' in agent.spec.runtime ? builtInAgentRuntimeLabel(agent.spec.runtime.type) : `AgentRuntime ${agent.spec.runtime.runtimeRef.name}`}
+                      </Badge>
+                    )}
                   </div>
                   <div className="flex items-center justify-between text-sm text-muted-foreground">
                     <span>Active: {agent.status?.activeTasks ?? 0}</span>
diff --git a/ui/src/components/execution/execution-route-format.ts b/ui/src/components/execution/execution-route-format.ts
new file mode 100644
index 000000000..7b878c089
--- /dev/null
+++ b/ui/src/components/execution/execution-route-format.ts
@@ -0,0 +1,13 @@
+export function abbreviateEvidence(value?: string) {
+  if (!value) return undefined
+  if (value.startsWith('sha256:') && value.length > 32) {
+    const digest = value.slice('sha256:'.length)
+    return `sha256:${digest.slice(0, 10)}…${digest.slice(-8)}`
+  }
+  if (value.length > 24) return `${value.slice(0, 12)}…${value.slice(-8)}`
+  return value
+}
+
+export function words(value: string) {
+  return value.replace(/-/g, ' ')
+}
diff --git a/ui/src/components/execution/execution-route-ledger.test.tsx b/ui/src/components/execution/execution-route-ledger.test.tsx
new file mode 100644
index 000000000..5c5a42480
--- /dev/null
+++ b/ui/src/components/execution/execution-route-ledger.test.tsx
@@ -0,0 +1,143 @@
+import { describe, expect, it } from 'vitest'
+import { render, screen } from '@/test/test-utils'
+import type { Session } from '@/schemas/session'
+import type { Task } from '@/schemas/task'
+import {
+  SessionExecutionRouteLedger,
+  TaskExecutionRouteLedger,
+} from './execution-route-ledger'
+import { abbreviateEvidence } from './execution-route-format'
+
+const digest = (character: string) => `sha256:${character.repeat(64)}`
+
+function agentTask(status: Task['status']): Task {
+  return {
+    metadata: { name: 'isolated-task', namespace: 'default', uid: 'task-uid' },
+    spec: { type: 'agent', agentRef: { name: 'coder' }, prompt: 'run' },
+    status,
+  }
+}
+
+function harnessV1Binding(): NonNullable<NonNullable<Task['status']>['agentExecutionBinding']> {
+  return {
+    schemaVersion: 1,
+    contractVersion: 'orka.harness.v1',
+    backend: 'harness-wrapper',
+    bindingDigest: digest('c'),
+    task: { namespaceUID: 'namespace-uid', uid: 'task-uid', boundSpecGeneration: 2 },
+    snapshot: { id: 'task-uid/snapshot', digest: digest('d'), schemaVersion: 1 },
+    runtimeType: 'codex',
+    boundAt: '2026-08-06T00:00:00Z',
+  }
+}
+
+describe('TaskExecutionRouteLedger', () => {
+  it('shows the immutable v2 route, snapshot, and static installation contract without full digests', () => {
+    const { container } = render(
+      <TaskExecutionRouteLedger
+        task={agentTask({
+          phase: 'Running',
+          agentExecutionBinding: {
+            schemaVersion: 1,
+            contractVersion: 'orka.harness.v2',
+            backend: 'runtime-pool',
+            bindingDigest: digest('a'),
+            task: { namespaceUID: 'namespace-uid', uid: 'task-uid', boundSpecGeneration: 2 },
+            snapshot: { id: 'task-uid/snapshot', digest: digest('b'), schemaVersion: 1 },
+            runtimeType: 'codex',
+            boundAt: '2026-08-06T00:00:00Z',
+          },
+        })}
+      />,
+    )
+
+    expect(screen.getByText('Route locked')).toBeInTheDocument()
+    expect(screen.getByText('ACP v2 · runtime pool')).toBeInTheDocument()
+    expect(screen.getByText('Static namespace route')).toBeInTheDocument()
+    expect(screen.getByText('Contract orka.harness.v2 is fixed by the installation mode')).toBeInTheDocument()
+    expect(screen.getAllByText(/sha256:aaaaaaaaaa…aaaaaaaa|sha256:bbbbbbbbbb…bbbbbbbb/)).toHaveLength(2)
+    expect(screen.queryByText(digest('a'))).not.toBeInTheDocument()
+    expect(container.innerHTML).not.toContain(digest('a'))
+    expect(container.innerHTML).not.toContain(digest('b'))
+  })
+
+  it('requires reconciliation for a harness v1 unknown outcome', () => {
+    render(
+      <TaskExecutionRouteLedger
+        task={agentTask({
+          phase: 'Failed',
+          agentExecutionBinding: harnessV1Binding(),
+          harnessRuntime: {
+            state: 'OutcomeUnknown',
+            outcome: 'OutcomeUnknown',
+            reason: 'WrapperRestarted',
+            message: 'accepted turn could not be settled after restart',
+          },
+        })}
+      />,
+    )
+
+    expect(screen.getByText('Outcome unknown')).toHaveClass('text-status-failed')
+    expect(screen.getByText('Human reconciliation required')).toBeInTheDocument()
+    expect(screen.getByText('WrapperRestarted')).toBeInTheDocument()
+  })
+
+})
+
+describe('SessionExecutionRouteLedger', () => {
+  it('keeps missing availability in an explicit warning state', () => {
+    const session: Session = {
+      name: 'initializing-session',
+      namespace: 'default',
+      executionControl: {
+        sessionUID: 'session-uid-0000000000000001',
+        generation: 1,
+        lifecycle: 'Active',
+      },
+    }
+
+    render(<SessionExecutionRouteLedger session={session} />)
+
+    expect(screen.getByText('Availability unknown')).toHaveClass('text-status-pending')
+    expect(screen.getByText('Lineage not yet established')).toBeInTheDocument()
+    expect(screen.getByText('Availability not yet established')).toBeInTheDocument()
+  })
+
+  it('shows lineage evidence and a blocked continuation requiring adjudication', () => {
+    const session: Session = {
+      name: 'blocked-session',
+      namespace: 'default',
+      executionControl: {
+        sessionUID: 'session-uid-0000000000000001',
+        generation: 3,
+        lifecycle: 'Finalizing',
+        availability: 'ReconciliationBlocked',
+        mutationLeaseGeneration: 8,
+        blockedReason: 'publication outcome could not be independently verified',
+        lineage: {
+          namespaceUID: 'namespace-uid',
+          sessionUID: 'session-uid-0000000000000001',
+          contractVersion: 'orka.harness.v2',
+          generation: 1,
+          runtimeIdentity: 'opencode',
+          configDigest: digest('c'),
+          establishedAt: '2026-08-06T00:00:00Z',
+        },
+      },
+    }
+
+    render(<SessionExecutionRouteLedger session={session} />)
+
+    expect(screen.getByText('Reconciliation required')).toBeInTheDocument()
+    expect(screen.getByText('ACP v2 · lineage 1')).toBeInTheDocument()
+    expect(screen.getByText('Continuation is blocked')).toBeInTheDocument()
+    expect(screen.getByText(session.executionControl!.blockedReason!)).toBeInTheDocument()
+  })
+})
+
+describe('abbreviateEvidence', () => {
+  it('keeps small values and abbreviates sha256 evidence', () => {
+    expect(abbreviateEvidence('small')).toBe('small')
+    expect(abbreviateEvidence(digest('f'))).toBe('sha256:ffffffffff…ffffffff')
+  })
+})
diff --git a/ui/src/components/execution/execution-route-ledger.tsx b/ui/src/components/execution/execution-route-ledger.tsx
new file mode 100644
index 000000000..c513b181e
--- /dev/null
+++ b/ui/src/components/execution/execution-route-ledger.tsx
@@ -0,0 +1,246 @@
+import type { ReactNode } from 'react'
+import {
+  CircleAlert,
+  CircleCheck,
+  Database,
+  GitBranch,
+  Route,
+  ShieldAlert,
+} from 'lucide-react'
+import { Badge } from '@/components/ui/badge'
+import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card'
+import { cn } from '@/lib/utils'
+import type { Task } from '@/schemas/task'
+import type { Session } from '@/schemas/session'
+import { abbreviateEvidence, words } from './execution-route-format'
+
+type LedgerTone = 'neutral' | 'good' | 'warning' | 'danger'
+
+interface LedgerRow {
+  label: string
+  title: string
+  detail?: ReactNode
+  mono?: string
+  icon: typeof Route
+  tone?: LedgerTone
+}
+
+interface LedgerProps {
+  title: string
+  summary: string
+  summaryTone: LedgerTone
+  rows: LedgerRow[]
+}
+
+const toneClasses: Record<LedgerTone, string> = {
+  neutral: 'border-border bg-muted/40 text-muted-foreground',
+  good: 'border-status-succeeded/30 bg-status-succeeded-bg text-status-succeeded',
+  warning: 'border-status-pending/30 bg-status-pending-bg text-status-pending',
+  danger: 'border-status-failed/30 bg-status-failed-bg text-status-failed',
+}
+
+function EvidenceValue({ value }: { value: string }) {
+  return (
+    <span className="font-mono text-[11px] text-foreground">
+      {abbreviateEvidence(value)}
+    </span>
+  )
+}
+
+function ExecutionRouteLedger({ title, summary, summaryTone, rows }: LedgerProps) {
+  return (
+    <Card aria-label={`${title} evidence`}>
+      <CardHeader className="border-b pb-4">
+        <div className="flex flex-wrap items-center justify-between gap-2">
+          <div>
+            <p className="mb-1 font-mono text-[10px] uppercase tracking-[0.18em] text-muted-foreground">
+              Route / evidence / reconciliation
+            </p>
+            <CardTitle>{title}</CardTitle>
+          </div>
+          <Badge variant="outline" className={cn('border', toneClasses[summaryTone])}>
+            {summary}
+          </Badge>
+        </div>
+      </CardHeader>
+      <CardContent className="pt-5">
+        <ol className="grid gap-0 md:grid-cols-3" aria-label="Execution route evidence">
+          {rows.map((row, index) => {
+            const Icon = row.icon
+            return (
+              <li
+                key={`${row.label}-${index}`}
+                className="relative border-l border-border pb-5 pl-9 last:pb-0 md:border-l-0 md:border-t md:pb-0 md:pl-0 md:pt-8 md:pr-6 md:last:pr-0"
+              >
+                <span
+                  className={cn(
+                    'absolute -left-[13px] top-0 flex size-6 items-center justify-center rounded-full border bg-card md:-top-[13px] md:left-0',
+                    toneClasses[row.tone ?? 'neutral'],
+                  )}
+                  aria-hidden="true"
+                >
+                  <Icon className="size-3" />
+                </span>
+                <p className="font-mono text-[10px] uppercase tracking-[0.16em] text-muted-foreground">
+                  {String(index + 1).padStart(2, '0')} · {row.label}
+                </p>
+                <p className="mt-1 text-sm font-medium">{row.title}</p>
+                {row.detail && <div className="mt-1 text-xs text-muted-foreground">{row.detail}</div>}
+                {row.mono && (
+                  <div className="mt-1">
+                    <EvidenceValue value={row.mono} />
+                  </div>
+                )}
+              </li>
+            )
+          })}
+        </ol>
+      </CardContent>
+    </Card>
+  )
+}
+
+function bindingRouteTitle(task: Task) {
+  const binding = task.status?.agentExecutionBinding
+  if (!binding) return 'No execution route recorded'
+  const contract = binding.contractVersion === 'orka.harness.v1' ? 'Harness v1' : 'ACP v2'
+  const backend = words(binding.backend)
+  return `${contract} · ${backend}`
+}
+
+export function TaskExecutionRouteLedger({ task }: { task: Task }) {
+  if (task.spec.type !== 'agent') return null
+
+  const status = task.status
+  const binding = status?.agentExecutionBinding
+  const outcomeUnknown = status?.execution?.outcome === 'OutcomeUnknown'
+    || status?.execution?.state === 'OutcomeUnknown'
+    || status?.harnessRuntime?.outcome === 'OutcomeUnknown'
+    || status?.harnessRuntime?.state === 'OutcomeUnknown'
+
+  if (!binding) {
+    return (
+      <ExecutionRouteLedger
+        title="Execution route"
+        summary="Awaiting binding"
+        summaryTone="warning"
+        rows={[
+          { label: 'Route', title: 'Not yet bound', icon: Route, tone: 'warning' },
+          { label: 'Evidence', title: 'No binding snapshot recorded', icon: Database },
+          { label: 'Reconciliation', title: 'No conflict recorded', icon: CircleCheck },
+        ]}
+      />
+    )
+  }
+
+  const snapshotDetail = binding.runtimeProfileDigest
+    ? <>Snapshot and runtime profile pinned</>
+    : <>Snapshot retained while this binding is referenced</>
+
+  return (
+    <ExecutionRouteLedger
+      title="Execution route"
+      summary={outcomeUnknown ? 'Outcome unknown' : 'Route locked'}
+      summaryTone={outcomeUnknown ? 'danger' : 'good'}
+      rows={[
+        {
+          label: 'Route',
+          title: bindingRouteTitle(task),
+          detail: (
+            <span>{words(binding.backend)}</span>
+          ),
+          mono: binding.bindingDigest,
+          icon: Route,
+          tone: 'good',
+        },
+        {
+          label: 'Evidence',
+          title: `Snapshot schema v${binding.snapshot.schemaVersion}`,
+          detail: snapshotDetail,
+          mono: binding.snapshot.digest,
+          icon: Database,
+        },
+        outcomeUnknown
+          ? {
+              label: 'Reconciliation',
+              title: 'Human reconciliation required',
+              detail: status?.execution?.reason
+                || status?.execution?.message
+                || status?.harnessRuntime?.reason
+                || status?.harnessRuntime?.message,
+              icon: ShieldAlert,
+              tone: 'danger',
+            }
+          : {
+              label: 'Admission',
+              title: 'Static namespace route',
+              detail: `Contract ${binding.contractVersion} is fixed by the installation mode`,
+              icon: GitBranch,
+              tone: 'good',
+            },
+      ]}
+    />
+  )
+}
+
+export function SessionExecutionRouteLedger({ session }: { session: Session }) {
+  const control = session.executionControl
+  if (!control) return null
+
+  const lineage = control.lineage
+  const blocked = control.availability === 'ReconciliationBlocked'
+  const available = control.availability === 'Available'
+  const routeTitle = lineage
+    ? `${lineage.contractVersion === 'orka.harness.v1' ? 'Harness v1' : 'ACP v2'} · lineage ${lineage.generation}`
+    : 'Lineage not yet established'
+
+  return (
+    <ExecutionRouteLedger
+      title="Session lineage"
+      summary={
+        blocked
+          ? 'Reconciliation required'
+          : available
+            ? 'Available'
+            : 'Availability unknown'
+      }
+      summaryTone={blocked ? 'danger' : available ? 'good' : 'warning'}
+      rows={[
+        {
+          label: 'Route',
+          title: routeTitle,
+          detail: lineage
+            ? lineage.runtimeIdentity
+            : `Lifecycle ${control.lifecycle ?? 'unclassified'}`,
+          mono: lineage?.sessionUID ?? control.sessionUID,
+          icon: Route,
+          tone: lineage ? 'good' : 'warning',
+        },
+        {
+          label: 'Evidence',
+          title: lineage ? 'Immutable lineage claim' : 'Control record present',
+          detail: control.runtimePoolRef
+            ? `Runtime pool ${control.runtimePoolRef}`
+            : `Control generation ${control.generation ?? 0}`,
+          mono: lineage?.configDigest ?? control.runtimeProfileDigest,
+          icon: Database,
+        },
+        blocked
+          ? {
+              label: 'Reconciliation',
+              title: 'Continuation is blocked',
+              detail: control.blockedReason,
+              icon: ShieldAlert,
+              tone: 'danger',
+            }
+          : {
+              label: 'Availability',
+              title: available ? 'Available' : 'Availability not yet established',
+              detail: `Lifecycle ${control.lifecycle ?? 'unclassified'} · lease generation ${control.mutationLeaseGeneration ?? 0}`,
+              icon: available ? CircleCheck : CircleAlert,
+              tone: available ? 'good' : 'warning',
+            },
+      ]}
+    />
+  )
+}
diff --git a/ui/src/components/layout/sidebar.test.tsx b/ui/src/components/layout/sidebar.test.tsx
index 855965bc0..ee7d2cc64 100644
--- a/ui/src/components/layout/sidebar.test.tsx
+++ b/ui/src/components/layout/sidebar.test.tsx
@@ -33,6 +33,7 @@ describe('Sidebar', () => {
     expect(screen.getByText('Chat')).toBeInTheDocument()
     expect(screen.getByText('Tasks')).toBeInTheDocument()
     expect(screen.getByText('Sessions')).toBeInTheDocument()
+    expect(screen.getByText('Runtimes')).toBeInTheDocument()
     expect(screen.getByText('Agents')).toBeInTheDocument()
     expect(screen.getByText('Tools')).toBeInTheDocument()
   })
diff --git a/ui/src/components/layout/sidebar.tsx b/ui/src/components/layout/sidebar.tsx
index c9f397ae2..bbe231fdc 100644
--- a/ui/src/components/layout/sidebar.tsx
+++ b/ui/src/components/layout/sidebar.tsx
@@ -1,5 +1,6 @@
 import { Link, useLocation } from '@tanstack/react-router'
-import { LayoutDashboard, ListTodo, MessageSquare, Bot, Wrench, Sparkles, Columns3, Activity, Shield, Radar, PanelLeftClose, PanelLeftOpen, RadioTower } from 'lucide-react'
+import { LayoutDashboard, ListTodo, MessageSquare, Bot, Wrench, Sparkles, Columns3, Activity, Shield, Radar, Boxes, RadioTower, PanelLeftClose, PanelLeftOpen } from 'lucide-react'
+
 import { cn } from '@/lib/utils'
 import { useUIStore } from '@/stores/ui'
 import { Button } from '@/components/ui/button'
@@ -15,6 +16,7 @@ const navItems = [
   { to: '/live', label: 'Live', icon: Activity },
   { to: '/gateways', label: 'Gateways', icon: RadioTower },
   { to: '/sessions', label: 'Sessions', icon: MessageSquare },
+  { to: '/runtimes', label: 'Runtimes', icon: Boxes },
   { to: '/agents', label: 'Agents', icon: Bot },
   { to: '/tools', label: 'Tools', icon: Wrench },
 ] as const
diff --git a/ui/src/components/monitors/repository-monitor-create-form.tsx b/ui/src/components/monitors/repository-monitor-create-form.tsx
index 25dee5c1e..e9cae9c40 100644
--- a/ui/src/components/monitors/repository-monitor-create-form.tsx
+++ b/ui/src/components/monitors/repository-monitor-create-form.tsx
@@ -88,7 +88,7 @@ export function RepositoryMonitorCreateForm() {
   const [formError, setFormError] = useState('')
 
   const claudeAgents = useMemo(
-    () => (agents?.items ?? []).filter((agent) => agent.spec.runtime?.type === 'claude'),
+    () => (agents?.items ?? []).filter((agent) => agent.spec.runtime && 'type' in agent.spec.runtime && agent.spec.runtime.type === 'claude'),
     [agents?.items],
   )
 
diff --git a/ui/src/components/runtime/runtime-registry.test.tsx b/ui/src/components/runtime/runtime-registry.test.tsx
new file mode 100644
index 000000000..c5653b096
--- /dev/null
+++ b/ui/src/components/runtime/runtime-registry.test.tsx
@@ -0,0 +1,206 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { render, screen, waitFor } from '@/test/test-utils'
+import userEvent from '@testing-library/user-event'
+import { http, HttpResponse } from 'msw'
+import { server } from '@/test/mocks/server'
+import { useAuthStore } from '@/stores/auth'
+import { useUIStore } from '@/stores/ui'
+import { RuntimeRegistry } from './runtime-registry'
+
+vi.mock('zustand/middleware', () => ({ persist: (fn: unknown) => fn }))
+
+const digest = `sha256:${'a'.repeat(64)}`
+
+function pool() {
+  return {
+    metadata: { name: 'codex-read', namespace: 'default', uid: 'pool-uid' },
+    spec: {
+      trustDomain: { namespace: 'default', identity: 'default/operators' },
+      desiredReplicas: 1,
+      runtime: {
+        image: 'docker.io/sozercan/orka-acp-codex@sha256:abc',
+        profile: {
+          protocolVersion: 'orka.harness.v2', digest, digestSchemaVersion: 'v1', acpProfile: 'schema-v1.20.0',
+          adapterDigests: { 'codex-acp': digest }, providerKind: 'openai', model: 'gpt-5',
+          agentConfigurationDigest: digest, toolPolicyDigest: digest, approvalPolicyDigest: digest,
+          mcpConfigurationDigest: digest, workspaceIntent: 'read', proxyCredentialRole: 'provider',
+          proxyCredentialScope: 'codex', resourceClass: 'standard',
+        },
+      },
+    },
+    status: {
+      lifecycle: 'Serving', admissionState: 'Accepting', desiredReplicas: 1, currentReplicas: 1,
+      capacity: { maxResidentSessions: 10, maxRunningPrompts: 4, residentSessions: 3, runningPrompts: 2, queuedTasks: 1 },
+    },
+  }
+}
+
+function externalRuntime() {
+  return {
+    metadata: { name: 'external-codex', namespace: 'default', uid: 'runtime-uid' },
+    spec: {
+      contractVersion: 'orka.harness.v2',
+      deployment: { mode: 'external-endpoint', endpoint: 'https://runtime.example.test' },
+      clientAuth: {
+        controllerBearerTokenSecretRef: { name: 'auth', key: 'controller-token' },
+        operationCapabilitySecretRef: { name: 'auth', key: 'capability-secret' },
+      },
+      capabilities: {
+        runtimeInstanceID: 'external-1',
+        profile: {
+          digest, digestSchemaVersion: 1, acpProfile: 'schema-v1.20.0', adapterName: 'codex-acp', adapterDigest: digest,
+          providerKind: 'openai', model: 'gpt-5', agentConfigurationDigest: digest, toolPolicyDigest: digest,
+          approvalPolicyDigest: digest, mcpConfigurationDigest: digest, workspaceIntent: 'read',
+          proxyCredentialRole: 'provider', proxyCredentialScope: 'codex', resourceClass: 'standard',
+        },
+        limits: {
+          maxResidentSessions: 10, maxConcurrentPrompts: 4, maxRequestBytes: 1000, maxEventLineBytes: 1000,
+          maxTerminalResultBytes: 1000, maxBufferedEvents: 100, maxUpdateEventsPerSecond: 50,
+          minPromptLeaseMillis: 1000, maxPromptLeaseMillis: 10000, maxPendingPermissions: 4, maxWorkspaceDeltaBytes: 100000,
+        },
+        supportsDrain: true,
+        supportsPublicationFinalization: true,
+        workspaceGovernance: {
+          mode: 'strict-governed', trusted: false, orkaOwnedWorkspaceDeltas: true,
+          promptScopedBrokerAuthorization: true, noDirectSCMPublication: true,
+          orkaOwnedCleanRoomPublication: true, exactInstanceFencing: true,
+          duplicateSafeMutations: true, cancellationSettlement: true,
+        },
+      },
+    },
+    status: { ready: true, lastValidated: '2026-07-24T00:00:00Z' },
+  }
+}
+
+function externalV1Runtime() {
+  return {
+    metadata: { name: 'external-v1', namespace: 'default', uid: 'runtime-v1-uid' },
+    spec: {
+      contractVersion: 'orka.harness.v1',
+      deployment: { mode: 'external-endpoint', endpoint: 'https://legacy-runtime.example.test' },
+      clientAuth: { bearerTokenSecretRef: { name: 'legacy-auth', key: 'token' } },
+      capabilities: {
+        toolExecutionModes: ['observed', 'brokered'],
+        brokeredToolClasses: ['read'],
+        supportsCancel: true,
+        supportsRuntimeSessions: true,
+        supportsContinuation: true,
+        supportsArtifacts: false,
+      },
+    },
+    status: {
+      ready: true,
+      lastValidated: '2026-07-24T00:00:00Z',
+      message: 'authenticated orka.harness.v1 conformance passed',
+      observedCapabilities: {
+        protocolVersion: 'orka.harness.v1',
+        transport: 'http+sse',
+        runtimeName: 'agentkit',
+        runtimeVersion: '1.4.2',
+        providerKind: 'generic',
+        toolExecutionModes: ['observed', 'brokered'],
+        brokeredToolClasses: ['read', 'coordination'],
+        supportsCancel: true,
+        supportsRuntimeSessions: true,
+        supportsContinuation: true,
+        supportsArtifacts: false,
+        maxConcurrentTurns: 4,
+        maxTurnSeconds: 1800,
+        maxOutputBytes: 1048576,
+      },
+    },
+  }
+}
+
+function unclassifiedRuntime() {
+  return {
+    metadata: { name: 'legacy-unclassified', namespace: 'default', uid: 'runtime-unclassified-uid' },
+    spec: {
+      deployment: { mode: 'external-endpoint', endpoint: 'https://unclassified.example.test' },
+      clientAuth: {
+        controllerBearerTokenSecretRef: { name: 'auth', key: 'controller-token' },
+        operationCapabilitySecretRef: { name: 'auth', key: 'capability-secret' },
+      },
+    },
+    status: {
+      ready: false,
+      message: 'AgentRuntime contractVersion is unclassified; explicit classification is required',
+    },
+  }
+}
+
+describe('RuntimeRegistry', () => {
+  beforeEach(() => {
+    useUIStore.setState({ namespace: 'default', sidebarCollapsed: false, theme: 'light' })
+    useAuthStore.setState({ token: 'test-token' })
+    server.use(
+      http.get('/api/v1/runtime-pools', () => HttpResponse.json({ items: [pool()], metadata: {} })),
+      http.get('/api/v1/agent-runtimes', () => HttpResponse.json({ items: [externalRuntime()], metadata: {} })),
+    )
+  })
+
+  it('renders pool admission, capacity, and profile identity', async () => {
+    render(<RuntimeRegistry />)
+    await waitFor(() => expect(screen.getByText('codex-read')).toBeInTheDocument())
+    expect(screen.getByText('Serving')).toBeInTheDocument()
+    expect(screen.getByText('Accepting')).toBeInTheDocument()
+    expect(screen.getByText('3 / 10')).toBeInTheDocument()
+    expect(screen.getByText('2 / 4')).toBeInTheDocument()
+    expect(screen.getByText('schema-v1.20.0')).toBeInTheDocument()
+  })
+
+  it('renders the external v2 governance surface without v1 fields', async () => {
+    const user = userEvent.setup()
+    render(<RuntimeRegistry />)
+    await user.click(screen.getByRole('tab', { name: 'External runtimes' }))
+    await waitFor(() => expect(screen.getByText('external-codex')).toBeInTheDocument())
+    expect(screen.getByText('orka.harness.v2')).toBeInTheDocument()
+    expect(screen.getByText('strict-governed')).toBeInTheDocument()
+    expect(screen.getByText('Exact-instance fencing')).toBeInTheDocument()
+    expect(screen.queryByText(/continuation/i)).not.toBeInTheDocument()
+  })
+
+  it('renders the external v1 capability surface without v2 profile fields', async () => {
+    server.use(
+      http.get('/api/v1/agent-runtimes', () => HttpResponse.json({ items: [externalV1Runtime()], metadata: {} })),
+    )
+    const user = userEvent.setup()
+    render(<RuntimeRegistry />)
+    await user.click(screen.getByRole('tab', { name: 'External runtimes' }))
+
+    await waitFor(() => expect(screen.getByText('external-v1')).toBeInTheDocument())
+    expect(screen.getByText('orka.harness.v1')).toBeInTheDocument()
+    expect(screen.getByText('agentkit')).toBeInTheDocument()
+    expect(screen.getByText('1.4.2')).toBeInTheDocument()
+    expect(screen.getByText('observed, brokered')).toBeInTheDocument()
+    expect(screen.getByText('read, coordination')).toBeInTheDocument()
+    expect(screen.getByText('Cancel: Yes')).toBeInTheDocument()
+    expect(screen.getByText('Runtime sessions: Yes')).toBeInTheDocument()
+    expect(screen.getByText('Continuation: Yes')).toBeInTheDocument()
+    expect(screen.getByText('Artifacts: No')).toBeInTheDocument()
+    expect(screen.getByText('1800s')).toBeInTheDocument()
+    expect(screen.getByText('1048576 bytes')).toBeInTheDocument()
+    expect(screen.getByText('authenticated orka.harness.v1 conformance passed')).toBeInTheDocument()
+    expect(screen.queryByText('ACP profile')).not.toBeInTheDocument()
+    expect(screen.queryByText('Profile digest')).not.toBeInTheDocument()
+    expect(screen.queryByText('strict-governed')).not.toBeInTheDocument()
+  })
+
+  it('renders an unclassified runtime as non-executable without inferring v1 or v2', async () => {
+    server.use(
+      http.get('/api/v1/agent-runtimes', () => HttpResponse.json({ items: [unclassifiedRuntime()], metadata: {} })),
+    )
+    const user = userEvent.setup()
+    render(<RuntimeRegistry />)
+    await user.click(screen.getByRole('tab', { name: 'External runtimes' }))
+
+    await waitFor(() => expect(screen.getByText('legacy-unclassified')).toBeInTheDocument())
+    expect(screen.getByText('Unclassified')).toBeInTheDocument()
+    expect(screen.getByText('Not ready')).toBeInTheDocument()
+    expect(screen.getByText('https://unclassified.example.test')).toBeInTheDocument()
+    expect(screen.getByText(/explicit classification is required/)).toBeInTheDocument()
+    expect(screen.queryByText('Execution')).not.toBeInTheDocument()
+    expect(screen.queryByText('ACP profile')).not.toBeInTheDocument()
+    expect(screen.queryByText('Tool modes')).not.toBeInTheDocument()
+  })
+})
diff --git a/ui/src/components/runtime/runtime-registry.tsx b/ui/src/components/runtime/runtime-registry.tsx
new file mode 100644
index 000000000..5175606e7
--- /dev/null
+++ b/ui/src/components/runtime/runtime-registry.tsx
@@ -0,0 +1,330 @@
+import { Activity, Boxes, ExternalLink, ShieldCheck } from 'lucide-react'
+import { PageHeader } from '@/components/layout/page-header'
+import { Badge } from '@/components/ui/badge'
+import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card'
+import { EmptyState } from '@/components/ui/empty-state'
+import { Skeleton } from '@/components/ui/skeleton'
+import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs'
+import { ApiError } from '@/lib/api-client'
+import { useAgentRuntimes, useRuntimePools } from '@/hooks/use-runtimes'
+import type { AgentRuntime, RuntimePool } from '@/schemas/runtime'
+
+function stateClass(state?: string) {
+  switch (state) {
+    case 'Serving':
+    case 'Accepting':
+    case 'Ready':
+      return 'bg-status-succeeded-bg text-status-succeeded'
+    case 'Starting':
+    case 'Draining':
+    case 'Stopping':
+    case 'Quiescent':
+      return 'bg-status-running-bg text-status-running'
+    case 'Degraded':
+    case 'Ambiguous':
+      return 'bg-status-failed-bg text-status-failed'
+    default:
+      return 'bg-muted text-muted-foreground'
+  }
+}
+
+function compactDigest(value?: string) {
+  if (!value) return '—'
+  if (value.length <= 24) return value
+  return `${value.slice(0, 15)}…${value.slice(-8)}`
+}
+
+function capacityText(current?: number, maximum?: number) {
+  return `${current ?? 0} / ${maximum ?? 0}`
+}
+
+function CapacityMeter({ label, current = 0, maximum = 0 }: { label: string; current?: number; maximum?: number }) {
+  const pct = maximum > 0 ? Math.min(100, Math.round((current / maximum) * 100)) : 0
+  return (
+    <div className="space-y-1.5">
+      <div className="flex items-center justify-between text-xs">
+        <span className="text-muted-foreground">{label}</span>
+        <span className="font-mono">{capacityText(current, maximum)}</span>
+      </div>
+      <div className="h-1.5 overflow-hidden rounded-full bg-muted" aria-label={`${label} capacity`}>
+        <div className="h-full rounded-full bg-primary transition-[width]" style={{ width: `${pct}%` }} />
+      </div>
+    </div>
+  )
+}
+
+function capabilityText(value?: boolean) {
+  if (value === undefined) return 'Unknown'
+  return value ? 'Yes' : 'No'
+}
+
+function RuntimePoolCard({ pool }: { pool: RuntimePool }) {
+  const status = pool.status
+  const capacity = status?.capacity
+  const profile = pool.spec.runtime.profile
+  return (
+    <Card>
+      <CardHeader className="space-y-3">
+        <div className="flex flex-wrap items-start justify-between gap-3">
+          <div>
+            <CardTitle className="flex items-center gap-2">
+              <Boxes className="h-4 w-4 text-primary" />
+              {pool.metadata.name}
+            </CardTitle>
+            <p className="mt-1 text-xs text-muted-foreground">
+              {pool.spec.trustDomain.namespace} · {pool.spec.trustDomain.identity}
+            </p>
+          </div>
+          <div className="flex flex-wrap gap-2">
+            <Badge variant="secondary" className={stateClass(status?.lifecycle)}>{status?.lifecycle ?? 'Unknown'}</Badge>
+            <Badge variant="secondary" className={stateClass(status?.admissionState)}>{status?.admissionState ?? 'Closed'}</Badge>
+          </div>
+        </div>
+      </CardHeader>
+      <CardContent className="space-y-5">
+        <div className="grid gap-4 sm:grid-cols-2">
+          <CapacityMeter label="Resident sessions" current={capacity?.residentSessions} maximum={capacity?.maxResidentSessions} />
+          <CapacityMeter label="Running prompts" current={capacity?.runningPrompts} maximum={capacity?.maxRunningPrompts} />
+        </div>
+        <div className="grid gap-3 text-sm sm:grid-cols-2 lg:grid-cols-4">
+          <div><span className="text-muted-foreground">Pods</span><div className="font-mono">{status?.currentReplicas ?? 0} / {status?.desiredReplicas ?? pool.spec.desiredReplicas ?? 0}</div></div>
+          <div><span className="text-muted-foreground">Queued</span><div className="font-mono">{capacity?.queuedTasks ?? 0}</div></div>
+          <div><span className="text-muted-foreground">Reserved</span><div className="font-mono">{capacity?.reservedSessions ?? 0}</div></div>
+          <div><span className="text-muted-foreground">Finalizing</span><div className="font-mono">{capacity?.finalizingSessions ?? 0}</div></div>
+        </div>
+        <div className="grid gap-3 rounded-md border bg-muted/25 p-3 text-xs md:grid-cols-2">
+          <div><span className="text-muted-foreground">ACP profile</span><div className="mt-0.5 font-mono">{profile.acpProfile}</div></div>
+          <div><span className="text-muted-foreground">Workspace intent</span><div className="mt-0.5 font-medium capitalize">{profile.workspaceIntent}</div></div>
+          <div><span className="text-muted-foreground">Provider / model</span><div className="mt-0.5">{profile.providerKind} · {profile.model}</div></div>
+          <div><span className="text-muted-foreground">Profile digest</span><div className="mt-0.5 font-mono" title={profile.digest}>{compactDigest(profile.digest)}</div></div>
+        </div>
+        {status?.activeInstance && (
+          <div className="space-y-1 border-t pt-3 text-xs">
+            <div className="flex items-center gap-2 font-medium"><Activity className="h-3.5 w-3.5 text-primary" /> Active runtime instance</div>
+            <div className="grid gap-1 text-muted-foreground md:grid-cols-2">
+              <span>{status.activeInstance.podNamespace}/{status.activeInstance.podName}</span>
+              <span className="font-mono" title={status.activeInstance.runtimeInstanceID}>{compactDigest(status.activeInstance.runtimeInstanceID)}</span>
+            </div>
+          </div>
+        )}
+        {status?.message && <p className="text-sm text-muted-foreground">{status.message}</p>}
+      </CardContent>
+    </Card>
+  )
+}
+
+function AgentRuntimeCard({ runtime }: { runtime: AgentRuntime }) {
+  const observed = runtime.status?.observedCapabilities
+
+  if (runtime.spec.contractVersion === undefined) {
+    return (
+      <Card>
+        <CardHeader>
+          <div className="flex flex-wrap items-start justify-between gap-3">
+            <div>
+              <CardTitle className="flex items-center gap-2">
+                <ExternalLink className="h-4 w-4 text-primary" />
+                {runtime.metadata.name}
+              </CardTitle>
+              <p className="mt-1 text-xs text-muted-foreground">{runtime.spec.deployment.endpoint}</p>
+            </div>
+            <Badge variant="secondary" className={stateClass('Degraded')}>Not ready</Badge>
+          </div>
+        </CardHeader>
+        <CardContent className="space-y-4">
+          <div className="text-sm"><span className="text-muted-foreground">Contract</span><div className="font-mono">Unclassified</div></div>
+          {runtime.status?.message && <p className="text-sm text-muted-foreground">{runtime.status.message}</p>}
+        </CardContent>
+      </Card>
+    )
+  }
+
+  if (runtime.spec.contractVersion === 'orka.harness.v1') {
+    const configured = runtime.spec.capabilities
+    const hasObservedCapabilities = observed !== undefined
+    const toolModes = hasObservedCapabilities
+      ? observed.toolExecutionModes ?? []
+      : configured?.toolExecutionModes ?? []
+    const brokeredToolClasses = hasObservedCapabilities
+      ? observed.brokeredToolClasses ?? []
+      : configured?.brokeredToolClasses ?? []
+    const supportsCancel = hasObservedCapabilities
+      ? observed.supportsCancel ?? false
+      : configured?.supportsCancel
+    const supportsRuntimeSessions = hasObservedCapabilities
+      ? observed.supportsRuntimeSessions ?? false
+      : configured?.supportsRuntimeSessions
+    const supportsContinuation = hasObservedCapabilities
+      ? observed.supportsContinuation ?? false
+      : configured?.supportsContinuation
+    const supportsArtifacts = hasObservedCapabilities
+      ? observed.supportsArtifacts ?? false
+      : configured?.supportsArtifacts
+
+    return (
+      <Card>
+        <CardHeader>
+          <div className="flex flex-wrap items-start justify-between gap-3">
+            <div>
+              <CardTitle className="flex items-center gap-2">
+                <ExternalLink className="h-4 w-4 text-primary" />
+                {runtime.metadata.name}
+              </CardTitle>
+              <p className="mt-1 text-xs text-muted-foreground">{runtime.spec.deployment.endpoint}</p>
+            </div>
+            <Badge
+              variant="secondary"
+              className={runtime.status?.ready ? stateClass('Ready') : stateClass('Degraded')}
+            >
+              {runtime.status?.ready ? 'Ready' : 'Not ready'}
+            </Badge>
+          </div>
+        </CardHeader>
+        <CardContent className="space-y-4">
+          <div className="grid gap-3 text-sm sm:grid-cols-2 lg:grid-cols-4">
+            <div><span className="text-muted-foreground">Contract</span><div className="font-mono">{runtime.spec.contractVersion}</div></div>
+            <div><span className="text-muted-foreground">Runtime name</span><div>{observed?.runtimeName ?? '—'}</div></div>
+            <div><span className="text-muted-foreground">Runtime version</span><div>{observed?.runtimeVersion ?? '—'}</div></div>
+            <div><span className="text-muted-foreground">Transport</span><div>{observed?.transport ?? '—'}</div></div>
+          </div>
+          <div className="grid gap-3 rounded-md border bg-muted/25 p-3 text-xs md:grid-cols-2 lg:grid-cols-3">
+            <div><span className="text-muted-foreground">Tool modes</span><div className="mt-0.5">{toolModes.length > 0 ? toolModes.join(', ') : '—'}</div></div>
+            <div><span className="text-muted-foreground">Brokered tool classes</span><div className="mt-0.5">{brokeredToolClasses.length > 0 ? brokeredToolClasses.join(', ') : '—'}</div></div>
+            <div><span className="text-muted-foreground">Concurrent turns</span><div className="mt-0.5 font-mono">{observed?.maxConcurrentTurns ?? '—'}</div></div>
+            <div><span className="text-muted-foreground">Maximum turn</span><div className="mt-0.5 font-mono">{observed?.maxTurnSeconds === undefined ? '—' : `${observed.maxTurnSeconds}s`}</div></div>
+            <div><span className="text-muted-foreground">Maximum output</span><div className="mt-0.5 font-mono">{observed?.maxOutputBytes === undefined ? '—' : `${observed.maxOutputBytes} bytes`}</div></div>
+            <div><span className="text-muted-foreground">Provider</span><div className="mt-0.5">{observed?.providerKind ?? '—'}</div></div>
+          </div>
+          <div className="flex flex-wrap items-center gap-2 text-xs">
+            <Activity className="h-4 w-4 text-primary" />
+            <Badge variant="outline">Cancel: {capabilityText(supportsCancel)}</Badge>
+            <Badge variant="outline">Runtime sessions: {capabilityText(supportsRuntimeSessions)}</Badge>
+            <Badge variant="outline">Continuation: {capabilityText(supportsContinuation)}</Badge>
+            <Badge variant="outline">Artifacts: {capabilityText(supportsArtifacts)}</Badge>
+            {hasObservedCapabilities && <Badge variant="outline">Suspend: {capabilityText(observed.supportsSuspend ?? false)}</Badge>}
+            {hasObservedCapabilities && <Badge variant="outline">Workspace snapshot: {capabilityText(observed.supportsWorkspaceSnapshot ?? false)}</Badge>}
+          </div>
+          {runtime.status?.lastValidated && (
+            <p className="text-xs text-muted-foreground">Validated {new Date(runtime.status.lastValidated).toLocaleString()}</p>
+          )}
+          {runtime.status?.message && <p className="text-sm text-muted-foreground">{runtime.status.message}</p>}
+        </CardContent>
+      </Card>
+    )
+  }
+
+  const configured = runtime.spec.capabilities
+  const profile = observed?.runtimeProfileDigest ? {
+    digest: observed.runtimeProfileDigest,
+    adapter: observed.adapterName,
+    provider: observed.providerKind,
+    model: observed.model,
+  } : {
+    digest: configured.profile.digest,
+    adapter: configured.profile.adapterName,
+    provider: configured.profile.providerKind,
+    model: configured.profile.model,
+  }
+  const governance = observed?.workspaceGovernance ?? configured.workspaceGovernance
+  return (
+    <Card>
+      <CardHeader>
+        <div className="flex flex-wrap items-start justify-between gap-3">
+          <div>
+            <CardTitle className="flex items-center gap-2">
+              <ExternalLink className="h-4 w-4 text-primary" />
+              {runtime.metadata.name}
+            </CardTitle>
+            <p className="mt-1 text-xs text-muted-foreground">{runtime.spec.deployment.endpoint}</p>
+          </div>
+          <Badge
+            variant="secondary"
+            className={runtime.status?.ready ? stateClass('Ready') : stateClass('Degraded')}
+          >
+            {runtime.status?.ready ? 'Ready' : 'Not ready'}
+          </Badge>
+        </div>
+      </CardHeader>
+      <CardContent className="space-y-4">
+        <div className="grid gap-3 text-sm sm:grid-cols-2 lg:grid-cols-4">
+          <div><span className="text-muted-foreground">Contract</span><div className="font-mono">{runtime.spec.contractVersion}</div></div>
+          <div><span className="text-muted-foreground">ACP profile</span><div className="font-mono">{configured.profile.acpProfile}</div></div>
+          <div><span className="text-muted-foreground">Adapter</span><div>{profile.adapter ?? '—'}</div></div>
+          <div><span className="text-muted-foreground">Provider / model</span><div>{profile.provider ?? '—'} · {profile.model ?? '—'}</div></div>
+        </div>
+        <div className="grid gap-3 rounded-md border bg-muted/25 p-3 text-xs md:grid-cols-2">
+          <div><span className="text-muted-foreground">Runtime instance</span><div className="mt-0.5 font-mono" title={observed?.runtimeInstanceID ?? configured.runtimeInstanceID}>{compactDigest(observed?.runtimeInstanceID ?? configured.runtimeInstanceID)}</div></div>
+          <div><span className="text-muted-foreground">Profile digest</span><div className="mt-0.5 font-mono" title={profile.digest}>{compactDigest(profile.digest)}</div></div>
+          <div><span className="text-muted-foreground">Capacity</span><div className="mt-0.5">{configured.limits.maxResidentSessions} sessions · {configured.limits.maxConcurrentPrompts} prompts</div></div>
+          <div><span className="text-muted-foreground">Workspace intent</span><div className="mt-0.5 font-medium capitalize">{configured.profile.workspaceIntent}</div></div>
+        </div>
+        <div className="flex flex-wrap items-center gap-2 text-xs">
+          <ShieldCheck className="h-4 w-4 text-primary" />
+          <Badge variant="outline">{governance.mode ?? configured.workspaceGovernance.mode}</Badge>
+          {configured.supportsDrain && <Badge variant="outline">Drain</Badge>}
+          {configured.supportsPublicationFinalization && <Badge variant="outline">Publication finalization</Badge>}
+          {governance.exactInstanceFencing && <Badge variant="outline">Exact-instance fencing</Badge>}
+          {governance.cancellationSettlement && <Badge variant="outline">Cancellation settlement</Badge>}
+          {governance.noDirectSCMPublication && <Badge variant="outline">No direct SCM publication</Badge>}
+        </div>
+        {runtime.status?.lastValidated && (
+          <p className="text-xs text-muted-foreground">Validated {new Date(runtime.status.lastValidated).toLocaleString()}</p>
+        )}
+        {runtime.status?.message && <p className="text-sm text-muted-foreground">{runtime.status.message}</p>}
+      </CardContent>
+    </Card>
+  )
+}
+
+function RuntimeAPIError({ error, resource }: { error: unknown; resource: string }) {
+  const unavailable = error instanceof ApiError && (error.status === 404 || error.status === 501)
+  return (
+    <Card>
+      <CardContent className="pt-6">
+        <EmptyState
+          icon={Activity}
+          headline={unavailable ? `${resource} API unavailable` : `Could not load ${resource.toLowerCase()}`}
+          hint={unavailable
+            ? 'This controller build does not expose the ACP runtime registry REST endpoints yet.'
+            : error instanceof Error ? error.message : 'The runtime registry request failed.'}
+        />
+      </CardContent>
+    </Card>
+  )
+}
+
+export function RuntimeRegistry() {
+  const pools = useRuntimePools()
+  const runtimes = useAgentRuntimes()
+
+  return (
+    <div className="space-y-4">
+      <PageHeader
+        title="Runtime fabric"
+        description="ACP runtime capacity, admission, exact-instance fencing, and external runtime registrations"
+      />
+      <Tabs defaultValue="pools">
+        <TabsList>
+          <TabsTrigger value="pools">Runtime pools</TabsTrigger>
+          <TabsTrigger value="external">External runtimes</TabsTrigger>
+        </TabsList>
+        <TabsContent value="pools" className="space-y-4">
+          {pools.isLoading && <><Skeleton className="h-56 w-full" /><Skeleton className="h-56 w-full" /></>}
+          {pools.error && <RuntimeAPIError error={pools.error} resource="RuntimePool" />}
+          {!pools.isLoading && !pools.error && (pools.data?.items.length ?? 0) === 0 && (
+            <EmptyState icon={Boxes} headline="No runtime pools" hint="No ACP RuntimePool is registered in this namespace." />
+          )}
+          {pools.data?.items.map((pool) => <RuntimePoolCard key={pool.metadata.uid ?? pool.metadata.name} pool={pool} />)}
+        </TabsContent>
+        <TabsContent value="external" className="space-y-4">
+          {runtimes.isLoading && <><Skeleton className="h-56 w-full" /><Skeleton className="h-56 w-full" /></>}
+          {runtimes.error && <RuntimeAPIError error={runtimes.error} resource="AgentRuntime" />}
+          {!runtimes.isLoading && !runtimes.error && (runtimes.data?.items.length ?? 0) === 0 && (
+            <EmptyState icon={ExternalLink} headline="No external runtimes" hint="No AgentRuntime is registered in this namespace." />
+          )}
+          {runtimes.data?.items.map((runtime) => <AgentRuntimeCard key={runtime.metadata.uid ?? runtime.metadata.name} runtime={runtime} />)}
+        </TabsContent>
+      </Tabs>
+    </div>
+  )
+}
diff --git a/ui/src/components/runtime/task-flow-panel.tsx b/ui/src/components/runtime/task-flow-panel.tsx
index 0b461a882..9951b2119 100644
--- a/ui/src/components/runtime/task-flow-panel.tsx
+++ b/ui/src/components/runtime/task-flow-panel.tsx
@@ -15,7 +15,7 @@ interface TaskFlowPanelProps {
 }
 
 /**
- * Runtime-facing wrapper over <ExecutionGraph>. Three scopes:
+ * Runtime-facing composition of <ExecutionGraph>. Three scopes:
  *  1. single selected task (root + children),
  *  2. selected root with child tasks (graph handles it),
  *  3. fallback: list running/recent tasks each as a one-node graph.
diff --git a/ui/src/components/sessions/session-detail.tsx b/ui/src/components/sessions/session-detail.tsx
index a6bf73fa9..28a3f121a 100644
--- a/ui/src/components/sessions/session-detail.tsx
+++ b/ui/src/components/sessions/session-detail.tsx
@@ -7,6 +7,7 @@ import { PageHeader } from '@/components/layout/page-header'
 import { ArrowLeft, Trash2 } from 'lucide-react'
 import { TranscriptViewer } from './transcript-viewer'
 import { SessionEventTimeline } from './session-event-timeline'
+import { SessionExecutionRouteLedger } from '@/components/execution/execution-route-ledger'
 import { useSession, useDeleteSession } from '@/hooks/use-sessions'
 
 export function SessionDetail({ sessionId }: { sessionId: string }) {
@@ -50,6 +51,8 @@ export function SessionDetail({ sessionId }: { sessionId: string }) {
         />
       </div>
 
+      <SessionExecutionRouteLedger session={session} />
+
       <Tabs defaultValue="overview">
         <TabsList>
           <TabsTrigger value="overview">Overview</TabsTrigger>
diff --git a/ui/src/components/tasks/fork-dialog.tsx b/ui/src/components/tasks/fork-dialog.tsx
index b9c188f04..250e83294 100644
--- a/ui/src/components/tasks/fork-dialog.tsx
+++ b/ui/src/components/tasks/fork-dialog.tsx
@@ -195,7 +195,7 @@ export function ForkDialog({ taskId, event, open, onOpenChange }: ForkDialogProp
             </div>
             <div className="space-y-1">
               <label htmlFor="fork-prompt" className="text-xs font-medium text-muted-foreground">
-                Prompt override / continuation (optional)
+                Prompt override (optional)
               </label>
               <textarea
                 id="fork-prompt"
diff --git a/ui/src/components/tasks/task-create-form.test.tsx b/ui/src/components/tasks/task-create-form.test.tsx
index 0d578abfc..f77967f68 100644
--- a/ui/src/components/tasks/task-create-form.test.tsx
+++ b/ui/src/components/tasks/task-create-form.test.tsx
@@ -43,6 +43,14 @@ import { useUIStore } from '@/stores/ui'
 import { useAuthStore } from '@/stores/auth'
 import { TaskCreateForm } from './task-create-form'
 
+async function openWriteWorkspace(user: ReturnType<typeof userEvent.setup>) {
+  await user.click(screen.getByText(/Advanced Options/))
+  await user.click(screen.getByText(/Workspace policy/))
+  const intentTrigger = screen.getByText('Workspace intent').closest('.space-y-2')!.querySelector('[role="combobox"]')!
+  fireEvent.pointerDown(intentTrigger, { button: 0, pointerId: 1, pointerType: 'mouse' })
+  fireEvent.click(await screen.findByRole('option', { name: /Write — produce/ }))
+}
+
 describe('TaskCreateForm', () => {
   beforeEach(() => {
     useUIStore.setState({ sidebarCollapsed: false, theme: 'light', namespace: 'default' })
@@ -242,13 +250,13 @@ describe('TaskCreateForm', () => {
     expect(screen.getByPlaceholderText('30m')).toBeInTheDocument()
   })
 
-  it('shows workspace config fields when agent type is selected and advanced expanded', async () => {
+  it('shows role-specific workspace credential names and optional keys', async () => {
     useStateTypeOverride = 'agent'
     server.use(
       http.get('/api/v1/agents', () =>
         HttpResponse.json({
           items: [
-            { metadata: { name: 'my-agent', namespace: 'default' }, spec: { model: { name: 'claude' } } },
+            { metadata: { name: 'my-agent', namespace: 'default' }, spec: { runtime: { type: 'codex' } } },
           ],
         }),
       ),
@@ -257,20 +265,218 @@ describe('TaskCreateForm', () => {
     render(<TaskCreateForm />)
 
     await user.click(screen.getByText(/Advanced Options/))
+    expect(screen.queryByText('Max Turns')).not.toBeInTheDocument()
+    expect(screen.queryByText('Allow Bash')).not.toBeInTheDocument()
+
+    await user.click(screen.getByText(/Workspace policy/))
+    expect(screen.getByText('Workspace intent')).toBeInTheDocument()
+    expect(screen.getAllByText(/Read — verified workspace must remain unchanged/).length).toBeGreaterThan(0)
+    expect(screen.getByText('Source repository URL')).toBeInTheDocument()
+    expect(screen.getByLabelText('Source repository URL')).not.toBeRequired()
+    expect(screen.getByLabelText('Source repository URL identity')).toHaveAttribute('placeholder', 'github.com/org/repo')
+    expect(screen.queryByPlaceholderText('R_kgDOExample')).not.toBeInTheDocument()
+    expect(screen.getByText(/normalized credential-free URL identity/)).toBeInTheDocument()
+    expect(screen.getByLabelText('Read credential Secret')).toBeInTheDocument()
+    expect(screen.getByLabelText('Read credential key')).toHaveAttribute('placeholder', 'token (default)')
+    expect(screen.queryByLabelText('Publication write credential Secret')).not.toBeInTheDocument()
+
+    const intentTrigger = screen.getByText('Workspace intent').closest('.space-y-2')!.querySelector('[role="combobox"]')!
+    fireEvent.pointerDown(intentTrigger, { button: 0, pointerId: 1, pointerType: 'mouse' })
+    await waitFor(() => expect(screen.getByRole('option', { name: /Write — produce/ })).toBeInTheDocument())
+    fireEvent.click(screen.getByRole('option', { name: /Write — produce/ }))
+
+    for (const label of [
+      'Publication read credential Secret',
+      'Publication read credential key',
+      'Publication write credential Secret',
+      'Publication write credential key',
+      'Forge credential Secret',
+      'Forge credential key',
+    ]) {
+      expect(await screen.findByLabelText(label)).toBeInTheDocument()
+    }
+    expect(screen.getByLabelText('Source repository URL')).toBeRequired()
+    expect(screen.getByLabelText('Publication write credential Secret')).toBeRequired()
+    expect(screen.getByLabelText('Pull request base branch')).not.toBeRequired()
+    expect(screen.getByLabelText('Forge credential Secret')).not.toBeRequired()
+    expect(screen.getByText('Publication repository URL')).toBeInTheDocument()
+    expect(screen.getByLabelText('Publication repository URL identity')).toHaveAttribute('placeholder', 'github.com/org/repo')
+    expect(screen.getAllByText(/normalized credential-free URL identity/)).toHaveLength(2)
+    expect(screen.getByText('Publication branch')).toBeInTheDocument()
+    expect(screen.getByText(/Secret values are never shown/)).toBeInTheDocument()
+    expect(screen.getByText(/Reconcile a pull request/)).toBeInTheDocument()
+    await user.click(screen.getByRole('switch', { name: /Reconcile a pull request/ }))
+    expect(screen.getByLabelText('Pull request base branch')).toBeRequired()
+    expect(screen.getByLabelText('Forge credential Secret')).toBeRequired()
+  })
 
-    expect(screen.getByText('Max Turns')).toBeInTheDocument()
-    expect(screen.getByText('Allow Bash')).toBeInTheDocument()
+  it('submits top-level write workspace with distinct credential roles and keys', async () => {
+    useStateTypeOverride = 'agent'
+    let submitted: any
+    server.use(
+      http.get('/api/v1/agents', () => HttpResponse.json({ items: [] })),
+      http.post('/api/v1/tasks', async ({ request }) => {
+        submitted = await request.json()
+        return HttpResponse.json({ metadata: { name: submitted.name }, spec: submitted })
+      }),
+    )
+    const user = userEvent.setup()
+    render(<TaskCreateForm />)
 
-    await user.click(screen.getByText(/Workspace Configuration/))
+    await user.type(screen.getByPlaceholderText('my-task'), 'write-task')
+    await user.type(screen.getByPlaceholderText('Enter your prompt...'), 'Update the repository')
+    await user.click(screen.getByText(/Advanced Options/))
+    await user.click(screen.getByText(/Workspace policy/))
+
+    const intentTrigger = screen.getByText('Workspace intent').closest('.space-y-2')!.querySelector('[role="combobox"]')!
+    fireEvent.pointerDown(intentTrigger, { button: 0, pointerId: 1, pointerType: 'mouse' })
+    fireEvent.click(await screen.findByRole('option', { name: /Write — produce/ }))
+
+    const repositoryURLs = screen.getAllByPlaceholderText('https://github.com/org/repo')
+    await user.type(repositoryURLs[0], 'https://github.com/source/repo')
+    await user.type(screen.getByLabelText('Source repository provider'), 'github')
+    await user.type(screen.getByLabelText('Source repository URL identity'), 'github.com/source/repo')
+    await user.type(screen.getByLabelText('Read credential Secret'), 'source-read')
+    await user.type(screen.getByLabelText('Read credential key'), 'source-token')
+    await user.type(repositoryURLs[1], 'https://github.com/publish/repo')
+    await user.type(screen.getByLabelText('Publication provider'), 'github')
+    await user.type(screen.getByLabelText('Publication repository URL identity'), 'github.com/publish/repo')
+    await user.type(screen.getByLabelText('Publication read credential Secret'), 'target-read')
+    await user.type(screen.getByLabelText('Publication read credential key'), 'verify-token')
+    await user.type(screen.getByLabelText('Publication write credential Secret'), 'target-write')
+    await user.type(screen.getByLabelText('Publication write credential key'), 'write-token')
+    await user.type(screen.getByLabelText('Forge credential Secret'), 'forge-api')
+    await user.type(screen.getByLabelText('Forge credential key'), 'forge-token')
+    await user.type(screen.getByPlaceholderText('Leave empty for an Orka-owned branch'), 'orka/change')
+    await user.type(screen.getByLabelText('Pull request base branch'), 'main')
+    await user.click(screen.getByRole('switch', { name: /Reconcile a pull request/ }))
+    await user.click(screen.getByRole('button', { name: 'Create Task' }))
 
-    expect(screen.getByText('Git Repo URL')).toBeInTheDocument()
-    expect(screen.getByPlaceholderText('https://github.com/org/repo')).toBeInTheDocument()
-    expect(screen.getByText('Branch')).toBeInTheDocument()
-    expect(screen.getByPlaceholderText('main')).toBeInTheDocument()
-    expect(screen.getByText('Push Branch')).toBeInTheDocument()
-    expect(screen.getByPlaceholderText('feature/my-task')).toBeInTheDocument()
-    expect(screen.getByText('Git Secret Ref')).toBeInTheDocument()
-    expect(screen.getByPlaceholderText('git-credentials')).toBeInTheDocument()
+    await waitFor(() => expect(toast.success).toHaveBeenCalledWith('Task created'))
+    expect(submitted.workspace).toEqual({
+      intent: 'write',
+      gitRepo: 'https://github.com/source/repo',
+      sourceRepository: { provider: 'github', id: 'github.com/source/repo' },
+      readCredentialRef: { name: 'source-read', key: 'source-token' },
+      publicationGitRepo: 'https://github.com/publish/repo',
+      publicationRepository: { provider: 'github', id: 'github.com/publish/repo' },
+      publicationReadCredentialRef: { name: 'target-read', key: 'verify-token' },
+      publicationCredentialRef: { name: 'target-write', key: 'write-token' },
+      forgeCredentialRef: { name: 'forge-api', key: 'forge-token' },
+      pushBranch: 'orka/change',
+      prBaseBranch: 'main',
+      createPR: true,
+    })
+    expect(JSON.stringify(submitted)).not.toContain('must-never-render')
+    expect(submitted.agentRuntime?.workspace).toBeUndefined()
+    expect(submitted.workspace.gitSecretRef).toBeUndefined()
+    expect(submitted.workspace.forkRepo).toBeUndefined()
+  }, 10_000)
+
+  it('requires a source repository URL for write workspaces', async () => {
+    useStateTypeOverride = 'agent'
+    let postCount = 0
+    server.use(
+      http.get('/api/v1/agents', () => HttpResponse.json({ items: [] })),
+      http.post('/api/v1/tasks', () => {
+        postCount += 1
+        return HttpResponse.json({})
+      }),
+    )
+    const user = userEvent.setup()
+    render(<TaskCreateForm />)
+
+    await user.type(screen.getByPlaceholderText('my-task'), 'write-task')
+    await user.type(screen.getByPlaceholderText('Enter your prompt...'), 'Update the repository')
+    await openWriteWorkspace(user)
+    await user.type(screen.getByLabelText('Source repository URL'), '   ')
+    await user.type(screen.getByLabelText('Publication write credential Secret'), 'target-write')
+    await user.click(screen.getByRole('button', { name: 'Create Task' }))
+
+    expect(toast.error).toHaveBeenCalledWith('Source repository URL is required for write workspaces')
+    expect(postCount).toBe(0)
+    expect(toast.success).not.toHaveBeenCalled()
+  })
+
+  it('requires a publication write credential for write workspaces', async () => {
+    useStateTypeOverride = 'agent'
+    let postCount = 0
+    server.use(
+      http.get('/api/v1/agents', () => HttpResponse.json({ items: [] })),
+      http.post('/api/v1/tasks', () => {
+        postCount += 1
+        return HttpResponse.json({})
+      }),
+    )
+    const user = userEvent.setup()
+    render(<TaskCreateForm />)
+
+    await user.type(screen.getByPlaceholderText('my-task'), 'write-task')
+    await user.type(screen.getByPlaceholderText('Enter your prompt...'), 'Update the repository')
+    await openWriteWorkspace(user)
+    await user.type(screen.getByLabelText('Source repository URL'), 'https://github.com/source/repo')
+    await user.type(screen.getByLabelText('Publication write credential Secret'), '   ')
+    await user.click(screen.getByRole('button', { name: 'Create Task' }))
+
+    expect(toast.error).toHaveBeenCalledWith('Publication write credential Secret is required for write workspaces')
+    expect(postCount).toBe(0)
+    expect(toast.success).not.toHaveBeenCalled()
+  })
+
+  it('requires a pull request base branch when creating a pull request', async () => {
+    useStateTypeOverride = 'agent'
+    let postCount = 0
+    server.use(
+      http.get('/api/v1/agents', () => HttpResponse.json({ items: [] })),
+      http.post('/api/v1/tasks', () => {
+        postCount += 1
+        return HttpResponse.json({})
+      }),
+    )
+    const user = userEvent.setup()
+    render(<TaskCreateForm />)
+
+    await user.type(screen.getByPlaceholderText('my-task'), 'write-task')
+    await user.type(screen.getByPlaceholderText('Enter your prompt...'), 'Update the repository')
+    await openWriteWorkspace(user)
+    await user.type(screen.getByLabelText('Source repository URL'), 'https://github.com/source/repo')
+    await user.type(screen.getByLabelText('Publication write credential Secret'), 'target-write')
+    await user.type(screen.getByLabelText('Forge credential Secret'), 'forge-api')
+    await user.type(screen.getByLabelText('Pull request base branch'), '   ')
+    await user.click(screen.getByRole('switch', { name: /Reconcile a pull request/ }))
+    await user.click(screen.getByRole('button', { name: 'Create Task' }))
+
+    expect(toast.error).toHaveBeenCalledWith('Pull request base branch is required when creating a pull request')
+    expect(postCount).toBe(0)
+    expect(toast.success).not.toHaveBeenCalled()
+  })
+
+  it('requires a forge credential before creating a pull request', async () => {
+    useStateTypeOverride = 'agent'
+    let postCount = 0
+    server.use(
+      http.get('/api/v1/agents', () => HttpResponse.json({ items: [] })),
+      http.post('/api/v1/tasks', () => {
+        postCount += 1
+        return HttpResponse.json({})
+      }),
+    )
+    const user = userEvent.setup()
+    render(<TaskCreateForm />)
+
+    await user.type(screen.getByPlaceholderText('my-task'), 'write-task')
+    await user.type(screen.getByPlaceholderText('Enter your prompt...'), 'Update the repository')
+    await openWriteWorkspace(user)
+    await user.type(screen.getByLabelText('Source repository URL'), 'https://github.com/source/repo')
+    await user.type(screen.getByLabelText('Publication write credential Secret'), 'target-write')
+    await user.type(screen.getByLabelText('Pull request base branch'), 'main')
+    await user.click(screen.getByRole('switch', { name: /Reconcile a pull request/ }))
+    const submitButton = screen.getByRole('button', { name: 'Create Task' })
+    fireEvent.submit(submitButton.closest('form')!)
+
+    expect(toast.error).toHaveBeenCalledWith('Forge credential Secret is required when creating a pull request')
+    expect(postCount).toBe(0)
+    expect(toast.success).not.toHaveBeenCalled()
   })
 
   it('does not show workspace config for non-agent types', async () => {
@@ -279,8 +485,7 @@ describe('TaskCreateForm', () => {
 
     await user.click(screen.getByText(/Advanced Options/))
 
-    expect(screen.queryByText('Max Turns')).not.toBeInTheDocument()
-    expect(screen.queryByText('Workspace Configuration')).not.toBeInTheDocument()
+    expect(screen.queryByText('Workspace policy')).not.toBeInTheDocument()
   })
 
   it('shows agent info card when agent is selected', async () => {
@@ -293,7 +498,7 @@ describe('TaskCreateForm', () => {
               metadata: { name: 'coord-agent', namespace: 'default' },
               spec: {
                 model: { provider: 'anthropic', name: 'claude-sonnet' },
-                runtime: { type: 'copilot' },
+                runtime: { type: 'codex' },
                 coordination: { enabled: true },
                 tools: [{ name: 'tool1' }, { name: 'tool2' }],
               },
@@ -305,10 +510,9 @@ describe('TaskCreateForm', () => {
     render(<TaskCreateForm />)
 
     // Wait for agents to load and select the agent
-    await waitFor(() => {
-      const trigger = screen.getByText('Agent Reference').closest('.space-y-2')!.querySelector('[role="combobox"]')!
-      fireEvent.pointerDown(trigger, { button: 0, pointerId: 1, pointerType: 'mouse' })
-    })
+    const trigger = screen.getByText('Agent Reference').closest('.space-y-2')!.querySelector('[role="combobox"]')!
+    await waitFor(() => expect(trigger).not.toBeDisabled())
+    fireEvent.pointerDown(trigger, { button: 0, pointerId: 1, pointerType: 'mouse' })
     await waitFor(() => {
       expect(screen.getByRole('option', { name: /coord-agent/ })).toBeInTheDocument()
     })
@@ -319,8 +523,41 @@ describe('TaskCreateForm', () => {
     })
     expect(screen.getByText('anthropic')).toBeInTheDocument()
     expect(screen.getByText('claude-sonnet')).toBeInTheDocument()
-    expect(screen.getByText('copilot runtime')).toBeInTheDocument()
+    expect(screen.getByText('codex ACP')).toBeInTheDocument()
     expect(screen.getByText('Coordination')).toBeInTheDocument()
     expect(screen.getByText('2 tools')).toBeInTheDocument()
   })
+
+  it('hides external-runtime agents that cannot be dispatched', async () => {
+    useStateTypeOverride = 'agent'
+    server.use(
+      http.get('/api/v1/agents', () =>
+        HttpResponse.json({
+          items: [
+            {
+              metadata: { name: 'built-in-agent', namespace: 'default' },
+              spec: { runtime: { type: 'codex' } },
+            },
+            {
+              metadata: { name: 'external-agent', namespace: 'default' },
+              spec: { runtime: { runtimeRef: { name: 'external-codex' } } },
+            },
+            {
+              metadata: { name: 'provider-agent', namespace: 'default' },
+              spec: { model: { provider: 'openai', name: 'gpt-5.4' } },
+            },
+          ],
+        }),
+      ),
+    )
+    render(<TaskCreateForm />)
+
+    expect(await screen.findByText(/Agents without a built-in CLI runtime are hidden/)).toBeInTheDocument()
+    const trigger = screen.getByText('Agent Reference').closest('.space-y-2')!.querySelector('[role="combobox"]')!
+    fireEvent.pointerDown(trigger, { button: 0, pointerId: 1, pointerType: 'mouse' })
+
+    expect(await screen.findByRole('option', { name: /built-in-agent/ })).toBeInTheDocument()
+    expect(screen.queryByRole('option', { name: /external-agent/ })).not.toBeInTheDocument()
+    expect(screen.queryByRole('option', { name: /provider-agent/ })).not.toBeInTheDocument()
+  })
 })
diff --git a/ui/src/components/tasks/task-create-form.tsx b/ui/src/components/tasks/task-create-form.tsx
index 73917bec8..79708d29c 100644
--- a/ui/src/components/tasks/task-create-form.tsx
+++ b/ui/src/components/tasks/task-create-form.tsx
@@ -1,4 +1,4 @@
-import { useState, useMemo } from 'react'
+import { useMemo, useState } from 'react'
 import { useNavigate } from '@tanstack/react-router'
 import { Button } from '@/components/ui/button'
 import { Input } from '@/components/ui/input'
@@ -11,6 +11,19 @@ import { useCreateTask } from '@/hooks/use-tasks'
 import { useAgentList } from '@/hooks/use-agents'
 import { useUIStore } from '@/stores/ui'
 import { toast } from 'sonner'
+import { workspaceConfigSchema, type WorkspaceIntent } from '@/schemas/task'
+import { builtInAgentRuntimeLabel } from '@/lib/agent-runtime'
+
+function optionalRepositoryIdentity(provider: string, id: string) {
+  return provider.trim() && id.trim() ? { provider: provider.trim(), id: id.trim() } : undefined
+}
+
+function optionalCredentialReference(name: string, key: string) {
+  const trimmedName = name.trim()
+  if (!trimmedName) return undefined
+  const trimmedKey = key.trim()
+  return trimmedKey ? { name: trimmedName, key: trimmedKey } : { name: trimmedName }
+}
 
 export function TaskCreateForm() {
   const navigate = useNavigate()
@@ -27,27 +40,52 @@ export function TaskCreateForm() {
   const [prompt, setPrompt] = useState('')
   const [agentRef, setAgentRef] = useState('')
 
-  // Advanced options
   const [showAdvanced, setShowAdvanced] = useState(false)
   const [priority, setPriority] = useState('')
   const [timeout, setTimeout] = useState('')
 
-  // Agent workspace options
   const [showWorkspace, setShowWorkspace] = useState(false)
+  const [workspaceIntent, setWorkspaceIntent] = useState<WorkspaceIntent>('read')
   const [gitRepo, setGitRepo] = useState('')
+  const [sourceProvider, setSourceProvider] = useState('')
+  const [sourceRepositoryID, setSourceRepositoryID] = useState('')
   const [branch, setBranch] = useState('')
+  const [gitRef, setGitRef] = useState('')
+  const [subPath, setSubPath] = useState('')
+  const [readCredentialName, setReadCredentialName] = useState('')
+  const [readCredentialKey, setReadCredentialKey] = useState('')
+  const [publicationGitRepo, setPublicationGitRepo] = useState('')
+  const [publicationProvider, setPublicationProvider] = useState('')
+  const [publicationRepositoryID, setPublicationRepositoryID] = useState('')
+  const [publicationReadCredentialName, setPublicationReadCredentialName] = useState('')
+  const [publicationReadCredentialKey, setPublicationReadCredentialKey] = useState('')
+  const [publicationCredentialName, setPublicationCredentialName] = useState('')
+  const [publicationCredentialKey, setPublicationCredentialKey] = useState('')
+  const [forgeCredentialName, setForgeCredentialName] = useState('')
+  const [forgeCredentialKey, setForgeCredentialKey] = useState('')
   const [pushBranch, setPushBranch] = useState('')
-  const [gitSecretRef, setGitSecretRef] = useState('')
-  const [maxTurns, setMaxTurns] = useState('')
-  const [allowBash, setAllowBash] = useState(false)
+  const [prBaseBranch, setPRBaseBranch] = useState('')
+  const [createPR, setCreatePR] = useState(false)
 
+  const dispatchableAgents = useMemo(
+    () => (agentsData?.items ?? []).filter((agent) => agent.spec.runtime && 'type' in agent.spec.runtime),
+    [agentsData],
+  )
+  const externalRuntimeAgentCount = (agentsData?.items.length ?? 0) - dispatchableAgents.length
   const selectedAgent = useMemo(
-    () => (agentsData?.items ?? []).find((a) => a.metadata.name === agentRef),
-    [agentsData, agentRef],
+    () => dispatchableAgents.find((agent) => agent.metadata.name === agentRef),
+    [agentRef, dispatchableAgents],
   )
 
-  const handleSubmit = async (e: React.FormEvent) => {
-    e.preventDefault()
+  const selectedRuntime = selectedAgent?.spec.runtime
+  const selectedRuntimeLabel = selectedRuntime
+    ? 'type' in selectedRuntime
+      ? builtInAgentRuntimeLabel(selectedRuntime.type)
+      : `AgentRuntime ${selectedRuntime.runtimeRef.name}`
+    : undefined
+
+  const handleSubmit = async (event: React.FormEvent) => {
+    event.preventDefault()
     const body: Record<string, unknown> = { name, namespace, type }
 
     if (type === 'container') {
@@ -58,24 +96,77 @@ export function TaskCreateForm() {
     } else if (type === 'agent') {
       body.agentRef = { name: agentRef }
       body.prompt = prompt
-    }
 
-    if (priority) body.priority = parseInt(priority)
-    if (timeout) body.timeout = timeout
+      const credentialInputs = [
+        { label: 'Read credential', name: readCredentialName, key: readCredentialKey },
+        ...(workspaceIntent === 'write'
+          ? [
+              { label: 'Publication read credential', name: publicationReadCredentialName, key: publicationReadCredentialKey },
+              { label: 'Publication write credential', name: publicationCredentialName, key: publicationCredentialKey },
+              { label: 'Forge credential', name: forgeCredentialName, key: forgeCredentialKey },
+            ]
+          : []),
+      ]
+      const credentialWithoutName = credentialInputs.find(({ name: credentialName, key }) => key.trim() && !credentialName.trim())
+      if (credentialWithoutName) {
+        toast.error(`${credentialWithoutName.label} Secret is required when a key is set`)
+        return
+      }
+      if (workspaceIntent === 'write' && !gitRepo.trim()) {
+        toast.error('Source repository URL is required for write workspaces')
+        return
+      }
+      if (workspaceIntent === 'write' && !publicationCredentialName.trim()) {
+        toast.error('Publication write credential Secret is required for write workspaces')
+        return
+      }
+      if (workspaceIntent === 'write' && createPR && !prBaseBranch.trim()) {
+        toast.error('Pull request base branch is required when creating a pull request')
+        return
+      }
+      if (workspaceIntent === 'write' && createPR && !forgeCredentialName.trim()) {
+        toast.error('Forge credential Secret is required when creating a pull request')
+        return
+      }
+
+      const workspace: Record<string, unknown> = { intent: workspaceIntent }
+      if (gitRepo.trim()) workspace.gitRepo = gitRepo.trim()
+      const sourceRepository = optionalRepositoryIdentity(sourceProvider, sourceRepositoryID)
+      if (sourceRepository) workspace.sourceRepository = sourceRepository
+      if (branch.trim()) workspace.branch = branch.trim()
+      if (gitRef.trim()) workspace.ref = gitRef.trim()
+      if (subPath.trim()) workspace.subPath = subPath.trim()
+      const readCredentialRef = optionalCredentialReference(readCredentialName, readCredentialKey)
+      if (readCredentialRef) workspace.readCredentialRef = readCredentialRef
 
-    if (type === 'agent') {
-      const workspace: Record<string, unknown> = {}
-      if (gitRepo) workspace.gitRepo = gitRepo
-      if (branch) workspace.branch = branch
-      if (pushBranch) workspace.pushBranch = pushBranch
-      if (gitSecretRef) workspace.gitSecretRef = { name: gitSecretRef }
-      if (Object.keys(workspace).length > 0) {
-        body.agentRuntime = { ...(body.agentRuntime as Record<string, unknown> || {}), workspace }
+      if (workspaceIntent === 'write') {
+        if (publicationGitRepo.trim()) workspace.publicationGitRepo = publicationGitRepo.trim()
+        const publicationRepository = optionalRepositoryIdentity(publicationProvider, publicationRepositoryID)
+        if (publicationRepository) workspace.publicationRepository = publicationRepository
+        const publicationReadCredentialRef = optionalCredentialReference(
+          publicationReadCredentialName,
+          publicationReadCredentialKey,
+        )
+        if (publicationReadCredentialRef) workspace.publicationReadCredentialRef = publicationReadCredentialRef
+        const publicationCredentialRef = optionalCredentialReference(publicationCredentialName, publicationCredentialKey)
+        if (publicationCredentialRef) workspace.publicationCredentialRef = publicationCredentialRef
+        const forgeCredentialRef = optionalCredentialReference(forgeCredentialName, forgeCredentialKey)
+        if (forgeCredentialRef) workspace.forgeCredentialRef = forgeCredentialRef
+        if (pushBranch.trim()) workspace.pushBranch = pushBranch.trim()
+        if (prBaseBranch.trim()) workspace.prBaseBranch = prBaseBranch.trim()
+        if (createPR) workspace.createPR = true
       }
-      if (maxTurns) body.agentRuntime = { ...(body.agentRuntime as Record<string, unknown> || {}), maxTurns: parseInt(maxTurns) }
-      if (allowBash) body.agentRuntime = { ...(body.agentRuntime as Record<string, unknown> || {}), allowBash }
+      const workspaceResult = workspaceConfigSchema.safeParse(workspace)
+      if (!workspaceResult.success) {
+        toast.error(workspaceResult.error.issues[0]?.message ?? 'Invalid workspace configuration')
+        return
+      }
+      body.workspace = workspaceResult.data
     }
 
+    if (priority) body.priority = parseInt(priority)
+    if (timeout) body.timeout = timeout
+
     try {
       await createTask.mutateAsync(body)
       toast.success('Task created')
@@ -96,8 +187,8 @@ export function TaskCreateForm() {
           <form onSubmit={handleSubmit} className="space-y-4">
             <div className="grid gap-4 md:grid-cols-2">
               <div className="space-y-2">
-                <label className="text-sm font-medium">Name</label>
-                <Input value={name} onChange={(e) => setName(e.target.value)} placeholder="my-task" required />
+                <label htmlFor="task-name" className="text-sm font-medium">Name</label>
+                <Input id="task-name" value={name} onChange={(e) => setName(e.target.value)} placeholder="my-task" required />
               </div>
               <div className="space-y-2">
                 <label className="text-sm font-medium">Type</label>
@@ -115,12 +206,12 @@ export function TaskCreateForm() {
             {type === 'container' && (
               <div className="space-y-4">
                 <div className="space-y-2">
-                  <label className="text-sm font-medium">Image</label>
-                  <Input value={image} onChange={(e) => setImage(e.target.value)} placeholder="alpine:latest" required />
+                  <label htmlFor="task-image" className="text-sm font-medium">Image</label>
+                  <Input id="task-image" value={image} onChange={(e) => setImage(e.target.value)} placeholder="alpine:latest" required />
                 </div>
                 <div className="space-y-2">
-                  <label className="text-sm font-medium">Command</label>
-                  <Input value={command} onChange={(e) => setCommand(e.target.value)} placeholder="echo hello" />
+                  <label htmlFor="task-command" className="text-sm font-medium">Command</label>
+                  <Input id="task-command" value={command} onChange={(e) => setCommand(e.target.value)} placeholder="echo hello" />
                 </div>
               </div>
             )}
@@ -139,14 +230,15 @@ export function TaskCreateForm() {
                     </Select>
                   </div>
                   <div className="space-y-2">
-                    <label className="text-sm font-medium">Model</label>
-                    <Input value={model} onChange={(e) => setModel(e.target.value)} placeholder="claude-sonnet-4-20250514" />
+                    <label htmlFor="task-model" className="text-sm font-medium">Model</label>
+                    <Input id="task-model" value={model} onChange={(e) => setModel(e.target.value)} placeholder="claude-sonnet-4-20250514" />
                   </div>
                 </div>
                 <div className="space-y-2">
-                  <label className="text-sm font-medium">Prompt</label>
+                  <label htmlFor="ai-prompt" className="text-sm font-medium">Prompt</label>
                   <textarea
-                    className="flex min-h-24 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+                    id="ai-prompt"
+                    className="flex min-h-32 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
                     value={prompt}
                     onChange={(e) => setPrompt(e.target.value)}
                     placeholder="Enter your prompt..."
@@ -160,44 +252,44 @@ export function TaskCreateForm() {
               <div className="space-y-4">
                 <div className="space-y-2">
                   <label className="text-sm font-medium">Agent Reference</label>
-                  <Select value={agentRef} onValueChange={setAgentRef}>
-                    <SelectTrigger><SelectValue placeholder="Select an agent..." /></SelectTrigger>
+                  <Select value={agentRef} onValueChange={setAgentRef} disabled={dispatchableAgents.length === 0}>
+                    <SelectTrigger><SelectValue placeholder="Select an agent" /></SelectTrigger>
                     <SelectContent>
-                      {(agentsData?.items ?? []).map((a) => (
-                        <SelectItem key={a.metadata.name} value={a.metadata.name}>
-                          {a.metadata.name}
-                          {a.spec.model?.name ? ` (${a.spec.model.name})` : ''}
-                          {a.spec.runtime ? ` (${a.spec.runtime.type} runtime)` : ''}
+                      {dispatchableAgents.map((agent) => (
+                        <SelectItem key={agent.metadata.name} value={agent.metadata.name}>
+                          {agent.metadata.name}
+                          {agent.spec.runtime && ` (${ 'type' in agent.spec.runtime ? builtInAgentRuntimeLabel(agent.spec.runtime.type) : agent.spec.runtime.runtimeRef.name })`}
                         </SelectItem>
                       ))}
                     </SelectContent>
                   </Select>
+                  {externalRuntimeAgentCount > 0 && (
+                    <p className="text-xs text-muted-foreground">
+                      Agents without a built-in CLI runtime are hidden because only built-in ACP Task dispatch is available.
+                    </p>
+                  )}
                 </div>
+
                 {selectedAgent && (
-                  <div className="rounded-md border border-border bg-muted/50 p-3 text-sm" data-testid="agent-info-card">
-                    <div className="flex flex-wrap items-center gap-2">
-                      {selectedAgent.spec.model?.provider && (
-                        <Badge variant="secondary">{selectedAgent.spec.model.provider}</Badge>
-                      )}
-                      {selectedAgent.spec.model?.name && (
-                        <Badge variant="outline">{selectedAgent.spec.model.name}</Badge>
-                      )}
-                      {selectedAgent.spec.runtime && (
-                        <Badge variant="secondary">{selectedAgent.spec.runtime.type} runtime</Badge>
-                      )}
-                      {selectedAgent.spec.coordination?.enabled && (
-                        <Badge>Coordination</Badge>
-                      )}
-                      {(selectedAgent.spec.tools?.length ?? 0) > 0 && (
-                        <Badge variant="outline">{selectedAgent.spec.tools!.length} tool{selectedAgent.spec.tools!.length !== 1 ? 's' : ''}</Badge>
-                      )}
+                  <div className="rounded-md border bg-muted/50 p-3 text-sm" data-testid="agent-info-card">
+                    <div className="flex items-center gap-2 font-medium">
+                      {selectedAgent.metadata.name}
+                      {selectedRuntimeLabel && <Badge variant="secondary">{selectedRuntimeLabel}</Badge>}
+                    </div>
+                    <div className="mt-2 flex flex-wrap gap-x-4 gap-y-1 text-muted-foreground">
+                      {selectedAgent.spec.model?.provider && <span>{selectedAgent.spec.model.provider}</span>}
+                      {selectedAgent.spec.model?.name && <span>{selectedAgent.spec.model.name}</span>}
+                      {selectedAgent.spec.coordination?.enabled && <Badge variant="outline">Coordination</Badge>}
+                      {(selectedAgent.spec.tools?.length ?? 0) > 0 && <span>{selectedAgent.spec.tools!.length} tools</span>}
                     </div>
                   </div>
                 )}
+
                 <div className="space-y-2">
-                  <label className="text-sm font-medium">Prompt</label>
+                  <label htmlFor="agent-prompt" className="text-sm font-medium">Prompt</label>
                   <textarea
-                    className="flex min-h-24 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+                    id="agent-prompt"
+                    className="flex min-h-32 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
                     value={prompt}
                     onChange={(e) => setPrompt(e.target.value)}
                     placeholder="Enter your prompt..."
@@ -210,31 +302,21 @@ export function TaskCreateForm() {
             <button
               type="button"
               onClick={() => setShowAdvanced(!showAdvanced)}
-              className="text-sm text-muted-foreground hover:text-foreground flex items-center gap-1"
+              className="flex items-center gap-1 text-sm text-muted-foreground hover:text-foreground"
             >
               {showAdvanced ? '▼' : '▶'} Advanced Options
             </button>
+
             {showAdvanced && (
               <div className="space-y-4 border-l-2 border-border pl-4">
                 <div className="grid gap-4 md:grid-cols-2">
                   <div className="space-y-2">
-                    <label className="text-sm font-medium">Priority</label>
-                    <Input
-                      type="number"
-                      min={0}
-                      max={1000}
-                      value={priority}
-                      onChange={(e) => setPriority(e.target.value)}
-                      placeholder="500"
-                    />
+                    <label htmlFor="task-priority" className="text-sm font-medium">Priority</label>
+                    <Input id="task-priority" type="number" min={0} max={1000} value={priority} onChange={(e) => setPriority(e.target.value)} placeholder="500" />
                   </div>
                   <div className="space-y-2">
-                    <label className="text-sm font-medium">Timeout</label>
-                    <Input
-                      value={timeout}
-                      onChange={(e) => setTimeout(e.target.value)}
-                      placeholder="30m"
-                    />
+                    <label htmlFor="task-timeout" className="text-sm font-medium">Timeout</label>
+                    <Input id="task-timeout" value={timeout} onChange={(e) => setTimeout(e.target.value)} placeholder="30m" />
                   </div>
                 </div>
 
@@ -243,69 +325,136 @@ export function TaskCreateForm() {
                     <button
                       type="button"
                       onClick={() => setShowWorkspace(!showWorkspace)}
-                      className="text-sm text-muted-foreground hover:text-foreground flex items-center gap-1"
+                      className="flex items-center gap-1 text-sm text-muted-foreground hover:text-foreground"
                     >
-                      {showWorkspace ? '▼' : '▶'} Workspace Configuration
+                      {showWorkspace ? '▼' : '▶'} Workspace policy
                     </button>
                     {showWorkspace && (
-                      <div className="space-y-4 border-l-2 border-border pl-4">
+                      <div className="space-y-5 rounded-md border bg-muted/20 p-4">
+                        <div className="space-y-2">
+                          <label className="text-sm font-medium">Workspace intent</label>
+                          <Select
+                            value={workspaceIntent}
+                            onValueChange={(value) => {
+                              const intent = value as WorkspaceIntent
+                              setWorkspaceIntent(intent)
+                              if (intent === 'read') setCreatePR(false)
+                            }}
+                          >
+                            <SelectTrigger><SelectValue /></SelectTrigger>
+                            <SelectContent>
+                              <SelectItem value="read">Read — verified workspace must remain unchanged</SelectItem>
+                              <SelectItem value="write">Write — produce a validated publication artifact</SelectItem>
+                            </SelectContent>
+                          </Select>
+                        </div>
+
                         <div className="grid gap-4 md:grid-cols-2">
                           <div className="space-y-2">
-                            <label className="text-sm font-medium">Git Repo URL</label>
-                            <Input
-                              value={gitRepo}
-                              onChange={(e) => setGitRepo(e.target.value)}
-                              placeholder="https://github.com/org/repo"
-                            />
+                            <label htmlFor="workspace-source-url" className="text-sm font-medium">Source repository URL</label>
+                            <Input id="workspace-source-url" value={gitRepo} onChange={(e) => setGitRepo(e.target.value)} placeholder="https://github.com/org/repo" required={workspaceIntent === 'write'} />
                           </div>
                           <div className="space-y-2">
-                            <label className="text-sm font-medium">Branch</label>
-                            <Input
-                              value={branch}
-                              onChange={(e) => setBranch(e.target.value)}
-                              placeholder="main"
-                            />
+                            <label htmlFor="workspace-read-credential" className="text-sm font-medium">Read credential Secret</label>
+                            <Input id="workspace-read-credential" value={readCredentialName} onChange={(e) => setReadCredentialName(e.target.value)} placeholder="source-read" />
+                          </div>
+                          <div className="space-y-2">
+                            <label htmlFor="workspace-read-credential-key" className="text-sm font-medium">Read credential key</label>
+                            <Input id="workspace-read-credential-key" value={readCredentialKey} onChange={(e) => setReadCredentialKey(e.target.value)} placeholder="token (default)" />
                           </div>
                         </div>
                         <div className="grid gap-4 md:grid-cols-2">
                           <div className="space-y-2">
-                            <label className="text-sm font-medium">Push Branch</label>
-                            <Input
-                              value={pushBranch}
-                              onChange={(e) => setPushBranch(e.target.value)}
-                              placeholder="feature/my-task"
-                            />
+                            <label htmlFor="source-provider" className="text-sm font-medium">Source repository provider</label>
+                            <Input id="source-provider" value={sourceProvider} onChange={(e) => setSourceProvider(e.target.value)} placeholder="github" />
                           </div>
                           <div className="space-y-2">
-                            <label className="text-sm font-medium">Git Secret Ref</label>
-                            <Input
-                              value={gitSecretRef}
-                              onChange={(e) => setGitSecretRef(e.target.value)}
-                              placeholder="git-credentials"
-                            />
+                            <label htmlFor="source-repository-id" className="text-sm font-medium">Source repository URL identity</label>
+                            <Input id="source-repository-id" value={sourceRepositoryID} onChange={(e) => setSourceRepositoryID(e.target.value)} placeholder="github.com/org/repo" />
+                            <p className="text-xs text-muted-foreground">Use the normalized credential-free URL identity, not a GitHub node ID.</p>
                           </div>
                         </div>
-                      </div>
-                    )}
-                    <div className="grid gap-4 md:grid-cols-2">
-                      <div className="space-y-2">
-                        <label className="text-sm font-medium">Max Turns</label>
-                        <Input
-                          type="number"
-                          min={1}
-                          value={maxTurns}
-                          onChange={(e) => setMaxTurns(e.target.value)}
-                          placeholder="10"
-                        />
-                      </div>
-                      <div className="space-y-2">
-                        <label className="text-sm font-medium">Allow Bash</label>
-                        <div className="flex items-center gap-2 pt-1">
-                          <Switch checked={allowBash} onCheckedChange={setAllowBash} />
-                          <span className="text-sm text-muted-foreground">{allowBash ? 'Enabled' : 'Disabled'}</span>
+                        <div className="grid gap-4 md:grid-cols-3">
+                          <div className="space-y-2">
+                            <label htmlFor="workspace-branch" className="text-sm font-medium">Source branch</label>
+                            <Input id="workspace-branch" value={branch} onChange={(e) => setBranch(e.target.value)} placeholder="main" />
+                          </div>
+                          <div className="space-y-2">
+                            <label htmlFor="workspace-ref" className="text-sm font-medium">Source ref</label>
+                            <Input id="workspace-ref" value={gitRef} onChange={(e) => setGitRef(e.target.value)} placeholder="commit, tag, or ref" />
+                          </div>
+                          <div className="space-y-2">
+                            <label htmlFor="workspace-subpath" className="text-sm font-medium">Subpath</label>
+                            <Input id="workspace-subpath" value={subPath} onChange={(e) => setSubPath(e.target.value)} placeholder="services/api" />
+                          </div>
                         </div>
+
+                        {workspaceIntent === 'write' && (
+                          <div className="space-y-4 border-t pt-4">
+                            <div>
+                              <p className="text-sm font-medium">Publication</p>
+                              <p className="text-xs text-muted-foreground">A clean-room publisher prepares, pushes with exact-ref CAS, and independently verifies the branch.</p>
+                            </div>
+                            <div className="grid gap-4 md:grid-cols-2">
+                              <div className="space-y-2">
+                                <label htmlFor="publication-url" className="text-sm font-medium">Publication repository URL</label>
+                                <Input id="publication-url" value={publicationGitRepo} onChange={(e) => setPublicationGitRepo(e.target.value)} placeholder="https://github.com/org/repo" />
+                              </div>
+                              <div className="space-y-2">
+                                <label htmlFor="publication-read-credential" className="text-sm font-medium">Publication read credential Secret</label>
+                                <Input id="publication-read-credential" value={publicationReadCredentialName} onChange={(e) => setPublicationReadCredentialName(e.target.value)} placeholder="target-read" />
+                              </div>
+                              <div className="space-y-2">
+                                <label htmlFor="publication-read-credential-key" className="text-sm font-medium">Publication read credential key</label>
+                                <Input id="publication-read-credential-key" value={publicationReadCredentialKey} onChange={(e) => setPublicationReadCredentialKey(e.target.value)} placeholder="token (default)" />
+                              </div>
+                              <div className="space-y-2">
+                                <label htmlFor="publication-write-credential" className="text-sm font-medium">Publication write credential Secret</label>
+                                <Input id="publication-write-credential" value={publicationCredentialName} onChange={(e) => setPublicationCredentialName(e.target.value)} placeholder="target-write" required={workspaceIntent === 'write'} />
+                              </div>
+                              <div className="space-y-2">
+                                <label htmlFor="publication-write-credential-key" className="text-sm font-medium">Publication write credential key</label>
+                                <Input id="publication-write-credential-key" value={publicationCredentialKey} onChange={(e) => setPublicationCredentialKey(e.target.value)} placeholder="token (default)" />
+                              </div>
+                              <div className="space-y-2">
+                                <label htmlFor="forge-credential" className="text-sm font-medium">Forge credential Secret</label>
+                                <Input id="forge-credential" value={forgeCredentialName} onChange={(e) => setForgeCredentialName(e.target.value)} placeholder="forge-api" required={workspaceIntent === 'write' && createPR} />
+                              </div>
+                              <div className="space-y-2">
+                                <label htmlFor="forge-credential-key" className="text-sm font-medium">Forge credential key</label>
+                                <Input id="forge-credential-key" value={forgeCredentialKey} onChange={(e) => setForgeCredentialKey(e.target.value)} placeholder="token (default)" />
+                              </div>
+                            </div>
+                            <p className="text-xs text-muted-foreground">Only Secret names and keys are submitted. Secret values are never shown in this form.</p>
+                            <div className="grid gap-4 md:grid-cols-2">
+                              <div className="space-y-2">
+                                <label htmlFor="publication-provider" className="text-sm font-medium">Publication provider</label>
+                                <Input id="publication-provider" value={publicationProvider} onChange={(e) => setPublicationProvider(e.target.value)} placeholder="github" />
+                              </div>
+                              <div className="space-y-2">
+                                <label htmlFor="publication-repository-id" className="text-sm font-medium">Publication repository URL identity</label>
+                                <Input id="publication-repository-id" value={publicationRepositoryID} onChange={(e) => setPublicationRepositoryID(e.target.value)} placeholder="github.com/org/repo" />
+                                <p className="text-xs text-muted-foreground">Use the normalized credential-free URL identity, not a GitHub node ID.</p>
+                              </div>
+                            </div>
+                            <div className="grid gap-4 md:grid-cols-2">
+                              <div className="space-y-2">
+                                <label htmlFor="push-branch" className="text-sm font-medium">Publication branch</label>
+                                <Input id="push-branch" value={pushBranch} onChange={(e) => setPushBranch(e.target.value)} placeholder="Leave empty for an Orka-owned branch" />
+                              </div>
+                              <div className="space-y-2">
+                                <label htmlFor="pr-base-branch" className="text-sm font-medium">Pull request base branch</label>
+                                <Input id="pr-base-branch" value={prBaseBranch} onChange={(e) => setPRBaseBranch(e.target.value)} placeholder="main" required={workspaceIntent === 'write' && createPR} />
+                              </div>
+                            </div>
+                            <div className="flex items-center gap-2">
+                              <Switch id="create-pr" checked={createPR} onCheckedChange={setCreatePR} />
+                              <label htmlFor="create-pr" className="text-sm font-medium">Reconcile a pull request after verified publication</label>
+                            </div>
+                          </div>
+                        )}
                       </div>
-                    </div>
+                    )}
                   </>
                 )}
               </div>
diff --git a/ui/src/components/tasks/task-detail.tsx b/ui/src/components/tasks/task-detail.tsx
index de35734a9..0eb9fdb42 100644
--- a/ui/src/components/tasks/task-detail.tsx
+++ b/ui/src/components/tasks/task-detail.tsx
@@ -9,7 +9,6 @@ import { ArrowLeft, Trash2 } from 'lucide-react'
 import { PageHeader } from '@/components/layout/page-header'
 import { TaskStatusBadge } from './task-status-badge'
 import { PRStatusBadge } from './pr-status-badge'
-import { PRCreateDialog } from './pr-create-dialog'
 import { TaskResultViewer } from './task-result-viewer'
 import { StructuredLogViewer } from './structured-log-viewer'
 import { TaskExecutionPanel } from './task-execution-panel'
@@ -20,6 +19,7 @@ import { ForkProvenance } from './fork-provenance'
 import { ExecutionGraph } from './execution-graph'
 import { RunTimeline } from './run-timeline'
 import { TaskRuntimeView } from '@/components/runtime/task-runtime-view'
+import { TaskExecutionRouteLedger } from '@/components/execution/execution-route-ledger'
 import { useTask, useDeleteTask, useTaskEvents } from '@/hooks/use-tasks'
 import { useTaskTrace, useTaskApprovals } from '@/hooks/use-execution-events'
 import { useTaskArtifacts } from '@/hooks/use-task-artifacts'
@@ -150,13 +150,6 @@ export function TaskDetail({ taskId }: { taskId: string }) {
           <PRStatusBadge annotations={task.metadata.annotations} />
         </div>
         <div className="flex items-center gap-2">
-          {task.status?.phase === 'Succeeded' &&
-            task.spec.agentRuntime?.workspace?.pushBranch && (
-              <PRCreateDialog
-                taskName={task.metadata.name}
-                pushBranch={task.spec.agentRuntime.workspace.pushBranch}
-              />
-            )}
           {deleteArmed ? (
             <span className="flex items-center gap-1">
               <Button
@@ -181,6 +174,8 @@ export function TaskDetail({ taskId }: { taskId: string }) {
         </div>
       </div>
 
+      <TaskExecutionRouteLedger task={task} />
+
       <Tabs value={activeTab} onValueChange={setTab}>
         <TabsList>
           <TabsTrigger value="runtime">Runtime</TabsTrigger>
diff --git a/ui/src/components/tasks/task-execution-panel.test.tsx b/ui/src/components/tasks/task-execution-panel.test.tsx
index 2b1617c4e..c7ba8c5d4 100644
--- a/ui/src/components/tasks/task-execution-panel.test.tsx
+++ b/ui/src/components/tasks/task-execution-panel.test.tsx
@@ -196,4 +196,67 @@ describe('TaskExecutionPanel', () => {
     expect(rollup).toHaveTextContent('gpt-4o')
     expect(rollup).toHaveTextContent('openai')
   })
+
+  it('renders exact runtime pool identity and never-replay unknown outcome guidance', () => {
+    render(
+      <TaskExecutionPanel
+        task={makeTask({
+          spec: { type: 'agent', workspace: { intent: 'read' } },
+          status: {
+            phase: 'Failed',
+            attempts: 1,
+            execution: {
+              state: 'OutcomeUnknown',
+              outcome: 'OutcomeUnknown',
+              runtimePoolName: 'codex-read',
+              runtimeInstanceID: 'pod-uid:boot-id',
+              runtimeSessionGeneration: 2,
+              controllerEpoch: 7,
+            },
+          },
+        })}
+      />,
+    )
+    const execution = screen.getByLabelText('Durable execution status')
+    expect(execution).toHaveTextContent('codex-read')
+    expect(execution).toHaveTextContent('OutcomeUnknown')
+    expect(execution).toHaveTextContent('will not replay the prompt automatically')
+  })
+
+  it('renders clean-room delivery and verified publication receipt', () => {
+    render(
+      <TaskExecutionPanel
+        task={makeTask({
+          spec: {
+            type: 'agent',
+            workspace: {
+              intent: 'write',
+              gitRepo: 'https://github.com/source/repo',
+              pushBranch: 'orka/change',
+              createPR: true,
+            },
+          },
+          status: {
+            phase: 'Succeeded',
+            attempts: 1,
+            delivery: {
+              state: 'VerifiedExact',
+              outcome: 'VerifiedExact',
+              branch: 'orka/change',
+              publicationID: 'pub-1',
+              expectedCommitSHA: 'abc123',
+              verifiedRemoteSHA: 'abc123',
+              prReceipt: { id: 'pr-1', number: 42, state: 'open', baseBranch: 'main', headBranch: 'orka/change' },
+            },
+          },
+        })}
+      />,
+    )
+    const delivery = screen.getByLabelText('Workspace delivery status')
+    expect(delivery).toHaveTextContent('write')
+    expect(delivery).toHaveTextContent('VerifiedExact')
+    expect(delivery).toHaveTextContent('Pull request #42')
+    expect(delivery).toHaveTextContent('orka/change → main')
+  })
+
 })
diff --git a/ui/src/components/tasks/task-execution-panel.tsx b/ui/src/components/tasks/task-execution-panel.tsx
index 0e71cf77c..a4d2c944c 100644
--- a/ui/src/components/tasks/task-execution-panel.tsx
+++ b/ui/src/components/tasks/task-execution-panel.tsx
@@ -1,5 +1,6 @@
-import { useState, useEffect } from 'react'
+import { useEffect, useState } from 'react'
 import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card'
+import { Badge } from '@/components/ui/badge'
 import { TaskStatusBadge } from './task-status-badge'
 import type { Task, ExecutionEvent } from '@/schemas/task'
 
@@ -9,19 +10,53 @@ const steps = ['Pending', 'Running', 'Completed'] as const
 // Scheduled hasn't started yet, so it sits at the start (step 0). Running and
 // Finalizing are both in progress. Only terminal phases
 // (Succeeded/Failed/Cancelled) land on the final step.
+
 function stepIndex(phase?: string): number {
   if (!phase || phase === 'Pending' || phase === 'Scheduled') return 0
   if (phase === 'Running' || phase === 'Finalizing') return 1
   return 2
 }
 
-function ElapsedTime({
-  startTime,
-  completionTime,
-}: {
-  startTime?: string
-  completionTime?: string
-}) {
+function statusClass(value?: string) {
+  switch (value) {
+    case 'Succeeded':
+    case 'VerifiedExact':
+    case 'DeliveredSuperseded':
+    case 'ReadValidated':
+    case 'NoChange':
+      return 'bg-status-succeeded-bg text-status-succeeded'
+    case 'Running':
+    case 'Accepted':
+    case 'Settling':
+    case 'Publishing':
+    case 'Verifying':
+    case 'Validating':
+    case 'Preparing':
+    case 'Prepared':
+      return 'bg-status-running-bg text-status-running'
+    case 'Failed':
+    case 'OutcomeUnknown':
+    case 'DeliveryConflict':
+    case 'PublicationOutcomeUnknown':
+    case 'ReadOnlyWorkspaceModified':
+    case 'CredentialBlocked':
+      return 'bg-status-failed-bg text-status-failed'
+    default:
+      return 'bg-muted text-muted-foreground'
+  }
+}
+
+function StateBadge({ value }: { value?: string }) {
+  return <Badge variant="secondary" className={statusClass(value)}>{value ?? 'Not reported'}</Badge>
+}
+
+function compact(value?: string) {
+  if (!value) return '—'
+  if (value.length <= 28) return value
+  return `${value.slice(0, 16)}…${value.slice(-8)}`
+}
+
+function ElapsedTime({ startTime, completionTime }: { startTime?: string; completionTime?: string }) {
   const [elapsed, setElapsed] = useState(() => (startTime ? '' : '-'))
 
   useEffect(() => {
@@ -29,14 +64,11 @@ function ElapsedTime({
     const start = new Date(startTime).getTime()
 
     function update() {
-      const end = completionTime
-        ? new Date(completionTime).getTime()
-        : Date.now()
-      const s = Math.floor((end - start) / 1000)
-      if (s < 60) setElapsed(`${s}s`)
-      else if (s < 3600) setElapsed(`${Math.floor(s / 60)}m ${s % 60}s`)
-      else
-        setElapsed(`${Math.floor(s / 3600)}h ${Math.floor((s % 3600) / 60)}m`)
+      const end = completionTime ? new Date(completionTime).getTime() : Date.now()
+      const seconds = Math.floor((end - start) / 1000)
+      if (seconds < 60) setElapsed(`${seconds}s`)
+      else if (seconds < 3600) setElapsed(`${Math.floor(seconds / 60)}m ${seconds % 60}s`)
+      else setElapsed(`${Math.floor(seconds / 3600)}h ${Math.floor((seconds % 3600) / 60)}m`)
     }
 
     update()
@@ -48,70 +80,109 @@ function ElapsedTime({
   return <span data-testid="elapsed-time">{elapsed}</span>
 }
 
-function ChildTaskSummary({
-  childTasks,
-}: {
-  childTasks: NonNullable<Task['status']>['childTasks']
-}) {
+function ChildTaskSummary({ childTasks }: { childTasks: NonNullable<Task['status']>['childTasks'] }) {
   if (!childTasks?.length) return null
-  const running = childTasks.filter((c) => c.phase === 'Running').length
-  const succeeded = childTasks.filter((c) => c.phase === 'Succeeded').length
-  const failed = childTasks.filter((c) => c.phase === 'Failed').length
-  const pending = childTasks.filter((c) => c.phase === 'Pending').length
+  const running = childTasks.filter((child) => child.phase === 'Running').length
+  const succeeded = childTasks.filter((child) => child.phase === 'Succeeded').length
+  const failed = childTasks.filter((child) => child.phase === 'Failed').length
+  const pending = childTasks.filter((child) => child.phase === 'Pending').length
 
   return (
     <div data-testid="child-task-summary">
-      <span className="text-muted-foreground text-sm">Child Tasks: </span>
+      <span className="text-sm text-muted-foreground">Child Tasks: </span>
       <span className="text-sm">
         {childTasks.length} total
-        {pending > 0 && (
-          <span className="text-yellow-600 dark:text-yellow-400">
-            {' '}
-            · {pending} pending
-          </span>
-        )}
-        {running > 0 && (
-          <span className="text-blue-600 dark:text-blue-400">
-            {' '}
-            · {running} running
-          </span>
-        )}
-        {succeeded > 0 && (
-          <span className="text-green-600 dark:text-green-400">
-            {' '}
-            · {succeeded} succeeded
-          </span>
-        )}
-        {failed > 0 && (
-          <span className="text-red-600 dark:text-red-400">
-            {' '}
-            · {failed} failed
-          </span>
-        )}
+        {pending > 0 && <span className="text-yellow-600 dark:text-yellow-400"> · {pending} pending</span>}
+        {running > 0 && <span className="text-blue-600 dark:text-blue-400"> · {running} running</span>}
+        {succeeded > 0 && <span className="text-green-600 dark:text-green-400"> · {succeeded} succeeded</span>}
+        {failed > 0 && <span className="text-red-600 dark:text-red-400"> · {failed} failed</span>}
       </span>
     </div>
   )
 }
 
-export function TaskExecutionPanel({
-  task,
-  events = [],
-}: {
-  task: Task
-  events?: ExecutionEvent[]
-}) {
-  const phase = task.status?.phase
-  const modelEvents = events.filter(
-    (event) => event.type === 'ModelRequestCompleted',
-  )
-  const totalIn = modelEvents.reduce(
-    (sum, event) => sum + (event.inputTokens ?? 0),
-    0,
+function DurableExecution({ task }: { task: Task }) {
+  const execution = task.status?.execution
+  if (!execution) return null
+  const unknown = execution.state === 'OutcomeUnknown' || execution.outcome === 'OutcomeUnknown'
+
+  return (
+    <section className="space-y-3 rounded-md border p-4" aria-label="Durable execution status">
+      <div className="flex flex-wrap items-center justify-between gap-2">
+        <div>
+          <p className="font-medium">Durable execution</p>
+          <p className="text-xs text-muted-foreground">Prompt acceptance, settlement, and exact runtime fencing</p>
+        </div>
+        <div className="flex gap-2">
+          <StateBadge value={execution.state} />
+          {execution.outcome && <StateBadge value={execution.outcome} />}
+        </div>
+      </div>
+      {unknown && (
+        <div className="rounded-md border border-status-failed/30 bg-status-failed-bg p-3 text-sm text-status-failed">
+          The runtime may have accepted this prompt, but Orka could not prove the outcome. It will not replay the prompt automatically.
+        </div>
+      )}
+      <div className="grid gap-3 text-sm md:grid-cols-2 lg:grid-cols-3">
+        <div><span className="text-muted-foreground">Attempt</span><div>{execution.attempt ?? task.status?.attempts ?? 0}</div></div>
+        <div><span className="text-muted-foreground">Runtime pool</span><div>{execution.runtimePoolName ?? '—'}</div></div>
+        <div><span className="text-muted-foreground">Session generation</span><div>{execution.runtimeSessionGeneration ?? '—'}</div></div>
+        <div><span className="text-muted-foreground">Prompt ID</span><div className="font-mono text-xs" title={execution.promptID}>{compact(execution.promptID)}</div></div>
+        <div><span className="text-muted-foreground">Runtime instance</span><div className="font-mono text-xs" title={execution.runtimeInstanceID}>{compact(execution.runtimeInstanceID)}</div></div>
+        <div><span className="text-muted-foreground">Controller epoch</span><div>{execution.controllerEpoch ?? '—'}</div></div>
+      </div>
+      {(execution.reason || execution.message) && (
+        <p className="text-sm text-muted-foreground">{[execution.reason, execution.message].filter(Boolean).join(' · ')}</p>
+      )}
+    </section>
   )
-  const totalOut = modelEvents.reduce(
-    (sum, event) => sum + (event.outputTokens ?? 0),
-    0,
+}
+
+function WorkspaceDelivery({ task }: { task: Task }) {
+  const delivery = task.status?.delivery
+  const workspace = task.spec.workspace
+  if (!delivery && !workspace) return null
+
+  return (
+    <section className="space-y-3 rounded-md border p-4" aria-label="Workspace delivery status">
+      <div className="flex flex-wrap items-center justify-between gap-2">
+        <div>
+          <p className="font-medium">Workspace delivery</p>
+          <p className="text-xs text-muted-foreground">Clean-room validation, publication, and independent remote verification</p>
+        </div>
+        <div className="flex gap-2">
+          <Badge variant="outline" className="capitalize">{workspace?.intent ?? 'read'}</Badge>
+          {delivery?.state && <StateBadge value={delivery.state} />}
+          {delivery?.outcome && delivery.outcome !== delivery.state && <StateBadge value={delivery.outcome} />}
+        </div>
+      </div>
+      <div className="grid gap-3 text-sm md:grid-cols-2 lg:grid-cols-3">
+        <div><span className="text-muted-foreground">Source</span><div>{workspace?.gitRepo ?? delivery?.sourceRepository?.id ?? '—'}</div></div>
+        <div><span className="text-muted-foreground">Publication branch</span><div>{delivery?.branch ?? workspace?.pushBranch ?? '—'}</div></div>
+        <div><span className="text-muted-foreground">Publication ID</span><div className="font-mono text-xs" title={delivery?.publicationID}>{compact(delivery?.publicationID)}</div></div>
+        <div><span className="text-muted-foreground">Expected commit</span><div className="font-mono text-xs" title={delivery?.expectedCommitSHA}>{compact(delivery?.expectedCommitSHA)}</div></div>
+        <div><span className="text-muted-foreground">Verified remote</span><div className="font-mono text-xs" title={delivery?.verifiedRemoteSHA}>{compact(delivery?.verifiedRemoteSHA)}</div></div>
+        <div><span className="text-muted-foreground">Artifact</span><div className="font-mono text-xs" title={delivery?.artifactDigest}>{compact(delivery?.artifactDigest)}</div></div>
+      </div>
+      {delivery?.prReceipt && (
+        <div className="rounded-md bg-muted/50 p-3 text-sm">
+          Pull request {delivery.prReceipt.number ? `#${delivery.prReceipt.number}` : delivery.prReceipt.id}
+          {delivery.prReceipt.state ? ` · ${delivery.prReceipt.state}` : ''}
+          {delivery.prReceipt.baseBranch && delivery.prReceipt.headBranch ? ` · ${delivery.prReceipt.headBranch} → ${delivery.prReceipt.baseBranch}` : ''}
+        </div>
+      )}
+      {(delivery?.reason || delivery?.message) && (
+        <p className="text-sm text-muted-foreground">{[delivery.reason, delivery.message].filter(Boolean).join(' · ')}</p>
+      )}
+    </section>
   )
+}
+
+export function TaskExecutionPanel({ task, events = [] }: { task: Task; events?: ExecutionEvent[] }) {
+  const phase = task.status?.phase
+  const modelEvents = events.filter((event) => event.type === 'ModelRequestCompleted')
+  const totalIn = modelEvents.reduce((sum, event) => sum + (event.inputTokens ?? 0), 0)
+  const totalOut = modelEvents.reduce((sum, event) => sum + (event.outputTokens ?? 0), 0)
   const current = stepIndex(phase)
 
   return (
@@ -120,79 +191,42 @@ export function TaskExecutionPanel({
         <CardTitle>Execution</CardTitle>
       </CardHeader>
       <CardContent className="space-y-6">
-        {/* Progress steps */}
         <div className="flex items-center gap-2" data-testid="progress-steps">
-          {steps.map((step, i) => (
+          {steps.map((step, index) => (
             <div key={step} className="flex items-center gap-2">
-              <div
-                className={`flex h-8 w-8 items-center justify-center rounded-full text-xs font-medium ${
-                  i < current
-                    ? 'bg-status-succeeded-bg text-status-succeeded'
-                    : i === current
-                      ? 'bg-status-running-bg text-status-running'
-                      : 'bg-muted text-muted-foreground'
-                }`}
-              >
-                {i < current ? '✓' : i + 1}
+              <div className={`flex h-8 w-8 items-center justify-center rounded-full text-xs font-medium ${
+                index < current
+                  ? 'bg-status-succeeded-bg text-status-succeeded'
+                  : index === current
+                    ? 'bg-status-running-bg text-status-running'
+                    : 'bg-muted text-muted-foreground'
+              }`}>
+                {index < current ? '✓' : index + 1}
               </div>
-              <span
-                className={`text-sm ${i <= current ? 'font-medium' : 'text-muted-foreground'}`}
-              >
-                {step}
-              </span>
-              {i < steps.length - 1 && (
-                <div
-                  className={`h-0.5 w-8 ${i < current ? 'bg-status-succeeded' : 'bg-muted'}`}
-                />
-              )}
+              <span className={`text-sm ${index <= current ? 'font-medium' : 'text-muted-foreground'}`}>{step}</span>
+              {index < steps.length - 1 && <div className={`h-0.5 w-8 ${index < current ? 'bg-status-succeeded' : 'bg-muted'}`} />}
             </div>
           ))}
         </div>
 
-        {/* Status details */}
         <div className="grid gap-3 text-sm md:grid-cols-2">
-          <div className="flex items-center gap-2">
-            <span className="text-muted-foreground">Phase:</span>
-            <TaskStatusBadge phase={phase} />
-          </div>
-          <div className="flex items-center gap-2">
-            <span className="text-muted-foreground">Elapsed:</span>
-            <ElapsedTime
-              startTime={task.status?.startTime}
-              completionTime={task.status?.completionTime}
-            />
-          </div>
-          <div>
-            <span className="text-muted-foreground">Attempts:</span>{' '}
-            {task.status?.attempts ?? 0}
-          </div>
-          {task.status?.message && (
-            <div className="md:col-span-2">
-              <span className="text-muted-foreground">Message:</span>{' '}
-              {task.status.message}
-            </div>
-          )}
+          <div className="flex items-center gap-2"><span className="text-muted-foreground">Phase:</span><TaskStatusBadge phase={phase} /></div>
+          <div className="flex items-center gap-2"><span className="text-muted-foreground">Elapsed:</span><ElapsedTime startTime={task.status?.startTime} completionTime={task.status?.completionTime} /></div>
+          <div><span className="text-muted-foreground">Attempts:</span> {task.status?.attempts ?? 0}</div>
+          {task.status?.message && <div className="md:col-span-2"><span className="text-muted-foreground">Message:</span> {task.status.message}</div>}
         </div>
 
+        <DurableExecution task={task} />
+        <WorkspaceDelivery task={task} />
+
         {modelEvents.length > 0 && (
-          <div
-            className="rounded-md border p-3 text-sm"
-            aria-label="GenAI token rollup"
-          >
+          <div className="rounded-md border p-3 text-sm" aria-label="GenAI token rollup">
             <div className="font-medium">GenAI tokens</div>
-            <div className="text-muted-foreground">
-              {totalIn + totalOut} total · {totalIn}{' '}
-              input · {totalOut} output
-            </div>
+            <div className="text-muted-foreground">{totalIn + totalOut} total · {totalIn} input · {totalOut} output</div>
             <div className="mt-2 flex flex-wrap gap-2 text-xs">
               {modelEvents.map((event) => (
-                <span
-                  key={event.id || event.seq}
-                  className="rounded-full bg-muted px-2 py-0.5"
-                >
-                  {event.model ?? 'unknown model'}
-                  {event.provider ? ` · ${event.provider}` : ''}
-                  {event.stopReason ? ` · ${event.stopReason}` : ''}
+                <span key={event.id || event.seq} className="rounded-full bg-muted px-2 py-0.5">
+                  {event.model ?? 'unknown model'}{event.provider ? ` · ${event.provider}` : ''}{event.stopReason ? ` · ${event.stopReason}` : ''}
                 </span>
               ))}
             </div>
diff --git a/ui/src/hooks/use-runtimes.test.tsx b/ui/src/hooks/use-runtimes.test.tsx
new file mode 100644
index 000000000..298fc2c1d
--- /dev/null
+++ b/ui/src/hooks/use-runtimes.test.tsx
@@ -0,0 +1,265 @@
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { renderHook, waitFor } from '@testing-library/react'
+import { http, HttpResponse } from 'msw'
+import type { ReactNode } from 'react'
+import { server } from '@/test/mocks/server'
+
+vi.mock('zustand/middleware', () => ({
+  persist: (fn: unknown) => fn,
+}))
+
+import { useUIStore } from '@/stores/ui'
+import { useAgentRuntimes, useRuntimePools } from './use-runtimes'
+
+const digest = `sha256:${'a'.repeat(64)}`
+
+function createWrapper() {
+  const queryClient = new QueryClient({
+    defaultOptions: { queries: { retry: false, gcTime: 0 } },
+  })
+  return ({ children }: { children: ReactNode }) => (
+    <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+  )
+}
+
+function runtimePool(name: string) {
+  return {
+    metadata: { name, namespace: 'default', uid: `${name}-uid` },
+    spec: {
+      trustDomain: { namespace: 'default', identity: 'default/operators' },
+      runtime: {
+        image: 'registry.example.test/orka-acp-codex@sha256:abc',
+        profile: {
+          protocolVersion: 'orka.harness.v2',
+          digest,
+          digestSchemaVersion: 'v1',
+          acpProfile: 'schema-v1.20.0',
+          adapterDigests: { 'codex-acp': digest },
+          providerKind: 'openai',
+          model: 'gpt-5',
+          agentConfigurationDigest: digest,
+          toolPolicyDigest: digest,
+          approvalPolicyDigest: digest,
+          mcpConfigurationDigest: digest,
+          workspaceIntent: 'read',
+          proxyCredentialRole: 'provider',
+          proxyCredentialScope: 'codex',
+          resourceClass: 'standard',
+        },
+      },
+    },
+  }
+}
+
+function agentRuntime(name: string) {
+  return {
+    metadata: { name, namespace: 'default', uid: `${name}-uid` },
+    spec: {
+      contractVersion: 'orka.harness.v2',
+      deployment: { mode: 'external-endpoint', endpoint: 'https://runtime.example.test' },
+      clientAuth: {
+        controllerBearerTokenSecretRef: { name: 'auth', key: 'controller-token' },
+        operationCapabilitySecretRef: { name: 'auth', key: 'capability-secret' },
+      },
+      capabilities: {
+        runtimeInstanceID: `${name}-instance`,
+        profile: {
+          digest,
+          digestSchemaVersion: 1,
+          acpProfile: 'schema-v1.20.0',
+          adapterName: 'codex-acp',
+          adapterDigest: digest,
+          providerKind: 'openai',
+          model: 'gpt-5',
+          agentConfigurationDigest: digest,
+          toolPolicyDigest: digest,
+          approvalPolicyDigest: digest,
+          mcpConfigurationDigest: digest,
+          workspaceIntent: 'read',
+          proxyCredentialRole: 'provider',
+          proxyCredentialScope: 'codex',
+          resourceClass: 'standard',
+        },
+        limits: {
+          maxResidentSessions: 10,
+          maxConcurrentPrompts: 4,
+          maxRequestBytes: 1000,
+          maxEventLineBytes: 1000,
+          maxTerminalResultBytes: 1000,
+          maxBufferedEvents: 100,
+          maxUpdateEventsPerSecond: 50,
+          minPromptLeaseMillis: 1000,
+          maxPromptLeaseMillis: 10000,
+          maxPendingPermissions: 4,
+          maxWorkspaceDeltaBytes: 100000,
+        },
+        workspaceGovernance: {
+          mode: 'strict-governed',
+          trusted: false,
+          orkaOwnedWorkspaceDeltas: true,
+          promptScopedBrokerAuthorization: true,
+          noDirectSCMPublication: true,
+          orkaOwnedCleanRoomPublication: true,
+          exactInstanceFencing: true,
+          duplicateSafeMutations: true,
+          cancellationSettlement: true,
+        },
+      },
+    },
+  }
+}
+
+function agentRuntimeV1(name: string) {
+  return {
+    metadata: { name, namespace: 'default', uid: `${name}-uid` },
+    spec: {
+      contractVersion: 'orka.harness.v1',
+      deployment: { mode: 'external-endpoint', endpoint: 'https://legacy-runtime.example.test' },
+      clientAuth: { bearerTokenSecretRef: { name: 'legacy-auth', key: 'token' } },
+    },
+    status: {
+      ready: true,
+      observedCapabilities: {
+        protocolVersion: 'orka.harness.v1',
+        runtimeName: 'agentkit',
+        runtimeVersion: '1.4.2',
+      },
+    },
+  }
+}
+
+function unclassifiedAgentRuntime(name: string) {
+  return {
+    metadata: { name, namespace: 'default', uid: `${name}-uid` },
+    spec: {
+      deployment: { mode: 'external-endpoint', endpoint: 'https://unclassified.example.test' },
+      clientAuth: {
+        controllerBearerTokenSecretRef: { name: 'auth', key: 'controller-token' },
+        operationCapabilitySecretRef: { name: 'auth', key: 'capability-secret' },
+      },
+    },
+    status: { ready: false, message: 'AgentRuntime contractVersion is unclassified' },
+  }
+}
+
+beforeEach(() => {
+  useUIStore.setState({ namespace: 'default', sidebarCollapsed: false, theme: 'light' })
+})
+
+describe('useRuntimePools', () => {
+  it('follows continue tokens and aggregates every page', async () => {
+    const seen: Array<{ namespace: string | null; limit: string | null; token: string | null }> = []
+    server.use(
+      http.get('/api/v1/runtime-pools', ({ request }) => {
+        const url = new URL(request.url)
+        const token = url.searchParams.get('continue')
+        seen.push({
+          namespace: url.searchParams.get('namespace'),
+          limit: url.searchParams.get('limit'),
+          token,
+        })
+        if (!token) {
+          return HttpResponse.json({
+            items: [runtimePool('pool-first')],
+            metadata: { continue: 'pool-next' },
+          })
+        }
+        return HttpResponse.json({ items: [runtimePool('pool-second')], metadata: {} })
+      }),
+    )
+
+    const { result } = renderHook(() => useRuntimePools(false), { wrapper: createWrapper() })
+
+    await waitFor(() => expect(result.current.isSuccess).toBe(true))
+    expect(result.current.data?.items.map((item) => item.metadata.name)).toEqual([
+      'pool-first',
+      'pool-second',
+    ])
+    expect(seen).toEqual([
+      { namespace: 'default', limit: '100', token: null },
+      { namespace: 'default', limit: '100', token: 'pool-next' },
+    ])
+  })
+
+  it('fails instead of following a repeated continuation cursor forever', async () => {
+    let calls = 0
+    server.use(
+      http.get('/api/v1/runtime-pools', () => {
+        calls += 1
+        return HttpResponse.json({ items: [], metadata: { continue: 'same-token' } })
+      }),
+    )
+
+    const { result } = renderHook(() => useRuntimePools(false), { wrapper: createWrapper() })
+
+    await waitFor(() => expect(result.current.isError).toBe(true))
+    expect(calls).toBe(2)
+    expect(result.current.error).toEqual(
+      new Error('runtime list pagination repeated continuation cursor for /runtime-pools'),
+    )
+  })
+})
+
+describe('useAgentRuntimes', () => {
+  it('follows continue tokens and aggregates every page', async () => {
+    const seen: Array<{ namespace: string | null; limit: string | null; token: string | null }> = []
+    server.use(
+      http.get('/api/v1/agent-runtimes', ({ request }) => {
+        const url = new URL(request.url)
+        const token = url.searchParams.get('continue')
+        seen.push({
+          namespace: url.searchParams.get('namespace'),
+          limit: url.searchParams.get('limit'),
+          token,
+        })
+        if (!token) {
+          return HttpResponse.json({
+            items: [unclassifiedAgentRuntime('runtime-unclassified'), agentRuntimeV1('runtime-first')],
+            metadata: { continue: 'runtime-next' },
+          })
+        }
+        return HttpResponse.json({ items: [agentRuntime('runtime-second')], metadata: {} })
+      }),
+    )
+
+    const { result } = renderHook(() => useAgentRuntimes(false), { wrapper: createWrapper() })
+
+    await waitFor(() => expect(result.current.isSuccess).toBe(true))
+    expect(result.current.data?.items.map((item) => item.metadata.name)).toEqual([
+      'runtime-unclassified',
+      'runtime-first',
+      'runtime-second',
+    ])
+    expect(result.current.data?.items.map((item) => item.spec.contractVersion)).toEqual([
+      undefined,
+      'orka.harness.v1',
+      'orka.harness.v2',
+    ])
+    expect(result.current.data?.items.at(-1)?.spec).toMatchObject({
+      contractVersion: 'orka.harness.v2',
+      capabilities: { supportsDrain: false },
+    })
+    expect(seen).toEqual([
+      { namespace: 'default', limit: '100', token: null },
+      { namespace: 'default', limit: '100', token: 'runtime-next' },
+    ])
+  })
+
+  it('fails instead of following a repeated continuation cursor forever', async () => {
+    let calls = 0
+    server.use(
+      http.get('/api/v1/agent-runtimes', () => {
+        calls += 1
+        return HttpResponse.json({ items: [], metadata: { continue: 'same-token' } })
+      }),
+    )
+
+    const { result } = renderHook(() => useAgentRuntimes(false), { wrapper: createWrapper() })
+
+    await waitFor(() => expect(result.current.isError).toBe(true))
+    expect(calls).toBe(2)
+    expect(result.current.error).toEqual(
+      new Error('runtime list pagination repeated continuation cursor for /agent-runtimes'),
+    )
+  })
+})
diff --git a/ui/src/hooks/use-runtimes.ts b/ui/src/hooks/use-runtimes.ts
new file mode 100644
index 000000000..302624256
--- /dev/null
+++ b/ui/src/hooks/use-runtimes.ts
@@ -0,0 +1,61 @@
+import { useQuery } from '@tanstack/react-query'
+import { api } from '@/lib/api-client'
+import { agentRuntimeListSchema, runtimePoolListSchema } from '@/schemas/runtime'
+import { useUIStore } from '@/stores/ui'
+
+interface RuntimeListPage<T> {
+  items: T[]
+  metadata?: { continue?: string; remainingItemCount?: number }
+}
+
+interface RuntimeListPageSchema<T> {
+  parse(value: unknown): RuntimeListPage<T>
+}
+
+async function fetchAllRuntimePages<T>(
+  path: '/runtime-pools' | '/agent-runtimes',
+  namespace: string,
+  schema: RuntimeListPageSchema<T>,
+): Promise<RuntimeListPage<T>> {
+  const items: T[] = []
+  const seenCursors = new Set<string>()
+  let metadata: RuntimeListPage<T>['metadata']
+  let cursor: string | undefined
+
+  do {
+    const params: Record<string, string> = { namespace, limit: '100' }
+    if (cursor) params.continue = cursor
+
+    const page = schema.parse(await api.get<unknown>(path, params))
+    items.push(...page.items)
+    metadata = page.metadata
+
+    const nextCursor = metadata?.continue
+    if (!nextCursor) break
+    if (seenCursors.has(nextCursor)) {
+      throw new Error(`runtime list pagination repeated continuation cursor for ${path}`)
+    }
+    seenCursors.add(nextCursor)
+    cursor = nextCursor
+  } while (cursor)
+
+  return { items, metadata }
+}
+
+export function useRuntimePools(refetchInterval: number | false = 5000) {
+  const namespace = useUIStore((state) => state.namespace)
+  return useQuery({
+    queryKey: ['runtime-pools', namespace],
+    queryFn: () => fetchAllRuntimePages('/runtime-pools', namespace, runtimePoolListSchema),
+    refetchInterval,
+  })
+}
+
+export function useAgentRuntimes(refetchInterval: number | false = 10000) {
+  const namespace = useUIStore((state) => state.namespace)
+  return useQuery({
+    queryKey: ['agent-runtimes', namespace],
+    queryFn: () => fetchAllRuntimePages('/agent-runtimes', namespace, agentRuntimeListSchema),
+    refetchInterval,
+  })
+}
diff --git a/ui/src/lib/agent-runtime.test.ts b/ui/src/lib/agent-runtime.test.ts
new file mode 100644
index 000000000..01ccd076c
--- /dev/null
+++ b/ui/src/lib/agent-runtime.test.ts
@@ -0,0 +1,39 @@
+import { describe, expect, it } from "vitest";
+import {
+  BUILT_IN_AGENT_RUNTIME_OPTIONS,
+  OPENCODE_REVIEWED_RUNTIME_DEFAULTS,
+  builtInAgentRuntimeLabel,
+  isOpenCodeModelID,
+} from "./agent-runtime";
+
+describe("built-in agent runtime display", () => {
+  it("provides all selectable ACP runtime options", () => {
+    expect(BUILT_IN_AGENT_RUNTIME_OPTIONS).toEqual([
+      { value: "claude", label: "Claude ACP" },
+      { value: "codex", label: "OpenAI Codex ACP" },
+      { value: "copilot", label: "GitHub Copilot ACP" },
+      { value: "opencode", label: "OpenCode ACP" },
+    ]);
+  });
+
+  it("preserves existing compact labels and brands OpenCode", () => {
+    expect(builtInAgentRuntimeLabel("claude")).toBe("claude ACP");
+    expect(builtInAgentRuntimeLabel("codex")).toBe("codex ACP");
+    expect(builtInAgentRuntimeLabel("copilot")).toBe("copilot ACP");
+    expect(builtInAgentRuntimeLabel("opencode")).toBe("OpenCode ACP");
+  });
+
+  it("defines the reviewed OpenCode native-tool policy", () => {
+    expect(OPENCODE_REVIEWED_RUNTIME_DEFAULTS).toEqual({
+      defaultAllowedTools: ["Read", "Write", "Edit", "Bash", "Glob", "Grep"],
+      defaultAllowBash: true,
+    });
+  });
+
+  it("validates literal OpenCode provider/model IDs", () => {
+    expect(isOpenCodeModelID("openai/gpt-5.4")).toBe(true);
+    expect(isOpenCodeModelID("gpt-5.4")).toBe(false);
+    expect(isOpenCodeModelID("{env:TOKEN}/gpt")).toBe(false);
+    expect(isOpenCodeModelID("openai/")).toBe(false);
+  });
+});
diff --git a/ui/src/lib/agent-runtime.ts b/ui/src/lib/agent-runtime.ts
new file mode 100644
index 000000000..95c8d73fc
--- /dev/null
+++ b/ui/src/lib/agent-runtime.ts
@@ -0,0 +1,43 @@
+import {
+  builtInAgentRuntimeTypes,
+  type BuiltInAgentRuntimeType,
+} from "@/schemas/agent";
+
+export type { BuiltInAgentRuntimeType } from "@/schemas/agent";
+
+const BUILT_IN_AGENT_RUNTIME_LABELS: Record<
+  BuiltInAgentRuntimeType,
+  { option: string; compact: string }
+> = {
+  claude: { option: "Claude ACP", compact: "claude ACP" },
+  codex: { option: "OpenAI Codex ACP", compact: "codex ACP" },
+  copilot: { option: "GitHub Copilot ACP", compact: "copilot ACP" },
+  opencode: { option: "OpenCode ACP", compact: "OpenCode ACP" },
+};
+
+export const BUILT_IN_AGENT_RUNTIME_OPTIONS = builtInAgentRuntimeTypes.map(
+  (value) => ({
+    value,
+    label: BUILT_IN_AGENT_RUNTIME_LABELS[value].option,
+  }),
+);
+
+export const OPENCODE_REVIEWED_RUNTIME_DEFAULTS = {
+  defaultAllowedTools: ["Read", "Write", "Edit", "Bash", "Glob", "Grep"],
+  defaultAllowBash: true,
+} as const;
+
+export function builtInAgentRuntimeLabel(type: BuiltInAgentRuntimeType) {
+  return BUILT_IN_AGENT_RUNTIME_LABELS[type].compact;
+}
+
+export function isOpenCodeModelID(value: string) {
+  const normalized = value.trim();
+  const slash = normalized.indexOf("/");
+  return (
+    slash > 0 &&
+    slash < normalized.length - 1 &&
+    !normalized.includes("{") &&
+    !normalized.includes("}")
+  );
+}
diff --git a/ui/src/routeTree.gen.ts b/ui/src/routeTree.gen.ts
index b092562cb..b38d6855a 100644
--- a/ui/src/routeTree.gen.ts
+++ b/ui/src/routeTree.gen.ts
@@ -19,6 +19,7 @@ import { Route as ToolsIndexRouteImport } from './routes/tools/index'
 import { Route as TasksIndexRouteImport } from './routes/tasks/index'
 import { Route as SessionsIndexRouteImport } from './routes/sessions/index'
 import { Route as SecurityIndexRouteImport } from './routes/security/index'
+import { Route as RuntimesIndexRouteImport } from './routes/runtimes/index'
 import { Route as MonitorsIndexRouteImport } from './routes/monitors/index'
 import { Route as GatewaysIndexRouteImport } from './routes/gateways/index'
 import { Route as AgentsIndexRouteImport } from './routes/agents/index'
@@ -86,6 +87,11 @@ const SecurityIndexRoute = SecurityIndexRouteImport.update({
   path: '/security/',
   getParentRoute: () => rootRouteImport,
 } as any)
+const RuntimesIndexRoute = RuntimesIndexRouteImport.update({
+  id: '/runtimes/',
+  path: '/runtimes/',
+  getParentRoute: () => rootRouteImport,
+} as any)
 const MonitorsIndexRoute = MonitorsIndexRouteImport.update({
   id: '/monitors/',
   path: '/monitors/',
@@ -189,6 +195,7 @@ export interface FileRoutesByFullPath {
   '/agents/': typeof AgentsIndexRoute
   '/gateways/': typeof GatewaysIndexRoute
   '/monitors/': typeof MonitorsIndexRoute
+  '/runtimes/': typeof RuntimesIndexRoute
   '/security/': typeof SecurityIndexRoute
   '/sessions/': typeof SessionsIndexRoute
   '/tasks/': typeof TasksIndexRoute
@@ -217,6 +224,7 @@ export interface FileRoutesByTo {
   '/agents': typeof AgentsIndexRoute
   '/gateways': typeof GatewaysIndexRoute
   '/monitors': typeof MonitorsIndexRoute
+  '/runtimes': typeof RuntimesIndexRoute
   '/security': typeof SecurityIndexRoute
   '/sessions': typeof SessionsIndexRoute
   '/tasks': typeof TasksIndexRoute
@@ -246,6 +254,7 @@ export interface FileRoutesById {
   '/agents/': typeof AgentsIndexRoute
   '/gateways/': typeof GatewaysIndexRoute
   '/monitors/': typeof MonitorsIndexRoute
+  '/runtimes/': typeof RuntimesIndexRoute
   '/security/': typeof SecurityIndexRoute
   '/sessions/': typeof SessionsIndexRoute
   '/tasks/': typeof TasksIndexRoute
@@ -276,6 +285,7 @@ export interface FileRouteTypes {
     | '/agents/'
     | '/gateways/'
     | '/monitors/'
+    | '/runtimes/'
     | '/security/'
     | '/sessions/'
     | '/tasks/'
@@ -304,6 +314,7 @@ export interface FileRouteTypes {
     | '/agents'
     | '/gateways'
     | '/monitors'
+    | '/runtimes'
     | '/security'
     | '/sessions'
     | '/tasks'
@@ -332,6 +343,7 @@ export interface FileRouteTypes {
     | '/agents/'
     | '/gateways/'
     | '/monitors/'
+    | '/runtimes/'
     | '/security/'
     | '/sessions/'
     | '/tasks/'
@@ -361,6 +373,7 @@ export interface RootRouteChildren {
   AgentsIndexRoute: typeof AgentsIndexRoute
   GatewaysIndexRoute: typeof GatewaysIndexRoute
   MonitorsIndexRoute: typeof MonitorsIndexRoute
+  RuntimesIndexRoute: typeof RuntimesIndexRoute
   SecurityIndexRoute: typeof SecurityIndexRoute
   SessionsIndexRoute: typeof SessionsIndexRoute
   TasksIndexRoute: typeof TasksIndexRoute
@@ -442,6 +455,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof SecurityIndexRouteImport
       parentRoute: typeof rootRouteImport
     }
+    '/runtimes/': {
+      id: '/runtimes/'
+      path: '/runtimes'
+      fullPath: '/runtimes/'
+      preLoaderRoute: typeof RuntimesIndexRouteImport
+      parentRoute: typeof rootRouteImport
+    }
     '/monitors/': {
       id: '/monitors/'
       path: '/monitors'
@@ -577,6 +597,7 @@ const rootRouteChildren: RootRouteChildren = {
   AgentsIndexRoute: AgentsIndexRoute,
   GatewaysIndexRoute: GatewaysIndexRoute,
   MonitorsIndexRoute: MonitorsIndexRoute,
+  RuntimesIndexRoute: RuntimesIndexRoute,
   SecurityIndexRoute: SecurityIndexRoute,
   SessionsIndexRoute: SessionsIndexRoute,
   TasksIndexRoute: TasksIndexRoute,
diff --git a/ui/src/routes/runtimes/index.tsx b/ui/src/routes/runtimes/index.tsx
new file mode 100644
index 000000000..a827ccf80
--- /dev/null
+++ b/ui/src/routes/runtimes/index.tsx
@@ -0,0 +1,6 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { RuntimeRegistry } from '@/components/runtime/runtime-registry'
+
+export const Route = createFileRoute('/runtimes/')({
+  component: RuntimeRegistry,
+})
diff --git a/ui/src/schemas/agent.test.ts b/ui/src/schemas/agent.test.ts
index afbd846f5..f17b0bbfc 100644
--- a/ui/src/schemas/agent.test.ts
+++ b/ui/src/schemas/agent.test.ts
@@ -2,7 +2,10 @@ import { describe, it, expect } from 'vitest'
 import {
   modelConfigSchema,
   toolRefSchema,
-  agentCLIRuntimeSchema,
+  builtInAgentRuntimeTypeSchema,
+  builtInAgentRuntimeSchema,
+  externalAgentRuntimeSchema,
+  agentRuntimeSchema,
   agentSpecSchema,
   agentStatusSchema,
   agentSchema,
@@ -11,92 +14,67 @@ import type { Agent, AgentSpec, AgentStatus } from './agent'
 
 describe('modelConfigSchema', () => {
   it('parses valid data with all fields', () => {
-    const data = { provider: 'openai', name: 'gpt-4', temperature: 0.7, maxTokens: 1000 }
+    const data = { provider: 'openai', name: 'gpt-4', temperature: 0.7, contextWindow: 32768, maxTokens: 1000 }
     expect(modelConfigSchema.parse(data)).toEqual(data)
   })
 
-  it('parses empty object (all optional)', () => {
+  it('parses empty object and rejects invalid numeric fields', () => {
     expect(modelConfigSchema.parse({})).toEqual({})
-  })
-
-  it('rejects wrong types', () => {
     expect(() => modelConfigSchema.parse({ temperature: 'warm' })).toThrow()
+    expect(() => modelConfigSchema.parse({ contextWindow: '32768' })).toThrow()
     expect(() => modelConfigSchema.parse({ maxTokens: '1000' })).toThrow()
   })
 })
 
 describe('toolRefSchema', () => {
-  it('parses valid data', () => {
-    const data = { name: 'search-tool', enabled: true }
-    expect(toolRefSchema.parse(data)).toEqual(data)
-  })
-
-  it('parses with only required fields', () => {
-    expect(toolRefSchema.parse({ name: 'search-tool' })).toEqual({ name: 'search-tool' })
-  })
-
-  it('rejects missing name', () => {
-    expect(() => toolRefSchema.parse({})).toThrow()
+  it('parses valid data and rejects a missing name', () => {
+    expect(toolRefSchema.parse({ name: 'search-tool', enabled: true })).toEqual({ name: 'search-tool', enabled: true })
     expect(() => toolRefSchema.parse({ enabled: true })).toThrow()
   })
-
-  it('rejects wrong types', () => {
-    expect(() => toolRefSchema.parse({ name: 123 })).toThrow()
-    expect(() => toolRefSchema.parse({ name: 'x', enabled: 'yes' })).toThrow()
-  })
 })
 
-describe('agentCLIRuntimeSchema', () => {
-  it('parses valid copilot runtime', () => {
-    const data = {
-      type: 'copilot',
-      defaultMaxTurns: 50,
-      defaultAllowedTools: ['bash', 'read'],
-      defaultAllowBash: true,
+describe('agentRuntimeSchema', () => {
+  it('accepts reviewed built-in ACP profiles', () => {
+    for (const type of ['claude', 'codex', 'copilot', 'opencode']) {
+      expect(builtInAgentRuntimeTypeSchema.parse(type)).toBe(type)
+      expect(builtInAgentRuntimeSchema.parse({ type })).toEqual({ type })
     }
-    expect(agentCLIRuntimeSchema.parse(data)).toEqual(data)
-  })
-
-  it('parses valid claude runtime', () => {
-    const data = { type: 'claude', defaultReasoningEffort: 'max' }
-    expect(agentCLIRuntimeSchema.parse(data)).toEqual(data)
-  })
-
-  it('parses valid codex runtime', () => {
-    const data = { type: 'codex' }
-    expect(agentCLIRuntimeSchema.parse(data)).toEqual(data)
   })
 
-  it('parses valid opencode runtime', () => {
-    const data = { type: 'opencode' }
-    expect(agentCLIRuntimeSchema.parse(data)).toEqual(data)
+  it('accepts a v2 AgentRuntime reference', () => {
+    const runtime = { runtimeRef: { name: 'external-codex' }, defaultMaxTurns: 20 }
+    expect(externalAgentRuntimeSchema.parse(runtime)).toEqual(runtime)
+    expect(agentRuntimeSchema.parse(runtime)).toEqual(runtime)
   })
 
-  it('rejects invalid type', () => {
-    expect(() => agentCLIRuntimeSchema.parse({ type: 'invalid' })).toThrow()
-    expect(() => agentCLIRuntimeSchema.parse({ type: '' })).toThrow()
-  })
-
-  it('rejects missing type', () => {
-    expect(() => agentCLIRuntimeSchema.parse({})).toThrow()
+  it('accepts supported runtime defaults', () => {
+    const runtime = {
+      type: 'opencode',
+      defaultMaxTurns: 50,
+      defaultAllowedTools: ['Read', 'Write', 'Edit', 'Bash', 'Glob', 'Grep'],
+      defaultAllowBash: true,
+      defaultReasoningEffort: 'max',
+    }
+    expect(builtInAgentRuntimeSchema.parse(runtime)).toEqual(runtime)
+    expect(agentRuntimeSchema.parse(runtime)).toEqual(runtime)
   })
 
-  it('rejects wrong types for optional fields', () => {
-    expect(() => agentCLIRuntimeSchema.parse({ type: 'copilot', defaultMaxTurns: 'many' })).toThrow()
-    expect(() => agentCLIRuntimeSchema.parse({ type: 'copilot', defaultAllowBash: 'yes' })).toThrow()
-    expect(() => agentCLIRuntimeSchema.parse({ type: 'claude', defaultReasoningEffort: 'maximum' })).toThrow()
+  it('rejects removed, ambiguous, or malformed runtime selectors', () => {
+    expect(() => agentRuntimeSchema.parse({ type: 'unknown' })).toThrow()
+    expect(() => agentRuntimeSchema.parse({})).toThrow()
+    expect(() => agentRuntimeSchema.parse({ type: 'codex', runtimeRef: { name: 'external' } })).toThrow()
+    expect(() => agentRuntimeSchema.parse({ type: 'codex', defaultMaxTurns: 'many' })).toThrow()
+    expect(() => agentRuntimeSchema.parse({ type: 'claude', defaultAllowBash: 'yes' })).toThrow()
+    expect(() => agentRuntimeSchema.parse({ type: 'claude', defaultReasoningEffort: 'maximum' })).toThrow()
   })
 })
 
 describe('agentSpecSchema', () => {
-  it('parses valid data with all fields', () => {
+  it('parses valid data with all native AI fields', () => {
     const data = {
       providerRef: { name: 'openai', namespace: 'default' },
       model: { provider: 'openai', name: 'gpt-4', temperature: 0.7 },
-      systemPrompt: {
-        inline: 'You are helpful',
-        configMapRef: { name: 'prompt-cm', key: 'prompt.txt' },
-      },
+      systemPrompt: { inline: 'You are helpful', configMapRef: { name: 'prompt-cm', key: 'prompt.txt' } },
       tools: [{ name: 'search', enabled: true }],
       skills: [{ configMapRef: { name: 'skill-cm', key: 'skill.md' } }],
       resources: { limits: { memory: '256Mi' } },
@@ -109,122 +87,94 @@ describe('agentSpecSchema', () => {
         maxConcurrentChildren: 5,
         maxDepth: 3,
       },
-      runtime: { type: 'copilot', defaultMaxTurns: 50 },
     }
     expect(agentSpecSchema.parse(data)).toEqual(data)
   })
 
-  it('parses empty object (all optional)', () => {
-    expect(agentSpecSchema.parse({})).toEqual({})
+  it('parses built-in and external runtime agents', () => {
+    expect(agentSpecSchema.parse({ runtime: { type: 'codex' } })).toEqual({ runtime: { type: 'codex' } })
+    expect(agentSpecSchema.parse({ model: { maxTokens: 0 }, runtime: { type: 'codex' } })).toEqual({
+      model: { maxTokens: 0 },
+      runtime: { type: 'codex' },
+    })
+    expect(agentSpecSchema.parse({
+      model: { name: 'openai/gpt-5.4', contextWindow: 32768, maxTokens: 4096 },
+      runtime: { type: 'opencode' },
+    })).toEqual({
+      model: { name: 'openai/gpt-5.4', contextWindow: 32768, maxTokens: 4096 },
+      runtime: { type: 'opencode' },
+    })
+    expect(agentSpecSchema.parse({ runtime: { runtimeRef: { name: 'external' } } })).toEqual({ runtime: { runtimeRef: { name: 'external' } } })
   })
 
-  it('parses with nested optional fields', () => {
-    const data = {
-      model: { provider: 'anthropic' },
-      coordination: { enabled: false },
-    }
-    expect(agentSpecSchema.parse(data)).toEqual(data)
-  })
-
-  it('rejects invalid coordination (missing enabled)', () => {
+  it('parses empty object and rejects malformed nested fields', () => {
+    expect(agentSpecSchema.parse({})).toEqual({})
     expect(() => agentSpecSchema.parse({ coordination: {} })).toThrow()
-  })
-
-  it('rejects invalid systemPrompt configMapRef', () => {
-    expect(() =>
-      agentSpecSchema.parse({ systemPrompt: { configMapRef: { name: 'x' } } })
-    ).toThrow()
+    expect(() => agentSpecSchema.parse({ systemPrompt: { configMapRef: { name: 'x' } } })).toThrow()
+    expect(() => agentSpecSchema.parse({ runtime: { type: 'opencode' } })).toThrow()
+    expect(() => agentSpecSchema.parse({ model: { name: '   ', contextWindow: 32768, maxTokens: 4096 }, runtime: { type: 'opencode' } })).toThrow()
+    expect(() => agentSpecSchema.parse({ model: { name: 'openai/gpt-5.4', maxTokens: 4096 }, runtime: { type: 'opencode' } })).toThrow()
+    expect(() => agentSpecSchema.parse({ model: { name: 'openai/gpt-5.4', contextWindow: 32768 }, runtime: { type: 'opencode' } })).toThrow()
+    expect(() => agentSpecSchema.parse({ model: { name: 'openai/gpt-5.4', contextWindow: 32768, maxTokens: 0 }, runtime: { type: 'opencode' } })).toThrow('OpenCode requires a positive integer model.maxTokens')
+    expect(() => agentSpecSchema.parse({ model: { name: 'openai/gpt-5.4', contextWindow: 32768, maxTokens: 1.5 }, runtime: { type: 'opencode' } })).toThrow('OpenCode requires a positive integer model.maxTokens')
+    expect(() => agentSpecSchema.parse({ model: { name: 'openai/gpt-5.4', contextWindow: 4096, maxTokens: 4096 }, runtime: { type: 'opencode' } })).toThrow()
+    expect(() => agentSpecSchema.parse({
+      model: { name: 'openai/gpt-5.4', contextWindow: 32768, maxTokens: 4096 },
+      systemPrompt: { inline: 'You write code' },
+      runtime: { type: 'opencode' },
+    })).toThrow('OpenCode does not support Agent systemPrompt')
+    expect(() => agentSpecSchema.parse({
+      model: { name: 'openai/gpt-5.4', contextWindow: 32768, maxTokens: 4096 },
+      systemPrompt: { configMapRef: { name: 'prompt', key: 'system.txt' } },
+      runtime: { type: 'opencode' },
+    })).toThrow('OpenCode does not support Agent systemPrompt')
   })
 })
 
 describe('agentStatusSchema', () => {
-  it('parses valid data with all fields', () => {
+  it('parses valid status and rejects missing activeTasks', () => {
     const data = {
       activeTasks: 3,
-      lastUsed: '2024-01-01T00:00:00Z',
+      lastUsed: '2026-07-24T00:00:00Z',
       conditions: [{ type: 'Ready', status: 'True', reason: 'Configured' }],
     }
     expect(agentStatusSchema.parse(data)).toEqual(data)
-  })
-
-  it('parses with only required fields', () => {
-    expect(agentStatusSchema.parse({ activeTasks: 0 })).toEqual({ activeTasks: 0 })
-  })
-
-  it('rejects missing activeTasks', () => {
     expect(() => agentStatusSchema.parse({})).toThrow()
   })
-
-  it('rejects wrong types', () => {
-    expect(() => agentStatusSchema.parse({ activeTasks: 'three' })).toThrow()
-  })
-
-  it('rejects invalid conditions', () => {
-    expect(() =>
-      agentStatusSchema.parse({ activeTasks: 0, conditions: [{ type: 'Ready' }] })
-    ).toThrow()
-  })
 })
 
 describe('agentSchema', () => {
-  it('parses valid full agent', () => {
-    const data = {
+  it('parses full and minimal agents', () => {
+    const full = {
       apiVersion: 'core.orka.ai/v1alpha1',
       kind: 'Agent',
       metadata: {
         name: 'my-agent',
         namespace: 'default',
         uid: 'abc-123',
-        creationTimestamp: '2024-01-01T00:00:00Z',
+        creationTimestamp: '2026-07-24T00:00:00Z',
         labels: { app: 'test' },
-        annotations: { note: 'val' },
-      },
-      spec: {
-        model: { provider: 'openai', name: 'gpt-4' },
-        tools: [{ name: 'search' }],
       },
-      status: { activeTasks: 1, lastUsed: '2024-01-01T00:00:00Z' },
-    }
-    expect(agentSchema.parse(data)).toEqual(data)
-  })
-
-  it('parses minimal agent', () => {
-    const data = {
-      metadata: { name: 'my-agent' },
-      spec: {},
+      spec: { runtime: { type: 'claude' } },
+      status: { activeTasks: 1 },
     }
-    expect(agentSchema.parse(data)).toEqual(data)
+    expect(agentSchema.parse(full)).toEqual(full)
+    expect(agentSchema.parse({ metadata: { name: 'minimal' }, spec: {} })).toEqual({ metadata: { name: 'minimal' }, spec: {} })
   })
 
-  it('rejects missing metadata', () => {
+  it('rejects malformed resources', () => {
     expect(() => agentSchema.parse({ spec: {} })).toThrow()
-  })
-
-  it('rejects missing spec', () => {
     expect(() => agentSchema.parse({ metadata: { name: 'x' } })).toThrow()
   })
-
-  it('rejects missing metadata name', () => {
-    expect(() => agentSchema.parse({ metadata: {}, spec: {} })).toThrow()
-  })
 })
 
 describe('exported types', () => {
-  it('Agent type matches schema', () => {
-    const agent: Agent = {
-      metadata: { name: 'test' },
-      spec: {},
-    }
+  it('match their schemas', () => {
+    const agent: Agent = { metadata: { name: 'test' }, spec: {} }
+    const spec: AgentSpec = { runtime: { type: 'codex' } }
+    const status: AgentStatus = { activeTasks: 0 }
     expect(agentSchema.parse(agent)).toBeDefined()
-  })
-
-  it('AgentSpec type matches schema', () => {
-    const spec: AgentSpec = {}
     expect(agentSpecSchema.parse(spec)).toBeDefined()
-  })
-
-  it('AgentStatus type matches schema', () => {
-    const status: AgentStatus = { activeTasks: 0 }
     expect(agentStatusSchema.parse(status)).toBeDefined()
   })
 })
diff --git a/ui/src/schemas/agent.ts b/ui/src/schemas/agent.ts
index 7a594bd54..789d54f20 100644
--- a/ui/src/schemas/agent.ts
+++ b/ui/src/schemas/agent.ts
@@ -5,6 +5,7 @@ export const modelConfigSchema = z.object({
   provider: z.string().optional(),
   name: z.string().optional(),
   temperature: z.number().optional(),
+  contextWindow: z.number().int().positive().optional(),
   maxTokens: z.number().optional(),
 })
 
@@ -13,13 +14,31 @@ export const toolRefSchema = z.object({
   enabled: z.boolean().optional(),
 })
 
-export const agentCLIRuntimeSchema = z.object({
-  type: z.enum(['copilot', 'claude', 'codex', 'opencode']),
+const agentRuntimeDefaultsSchema = {
   defaultMaxTurns: z.number().optional(),
   defaultAllowedTools: z.array(z.string()).optional(),
   defaultAllowBash: z.boolean().optional(),
   defaultReasoningEffort: z.enum(['low', 'medium', 'high', 'xhigh', 'max']).optional(),
-})
+}
+
+export const builtInAgentRuntimeTypes = ['claude', 'codex', 'copilot', 'opencode'] as const
+
+export const builtInAgentRuntimeTypeSchema = z.enum(builtInAgentRuntimeTypes)
+
+export const builtInAgentRuntimeSchema = z.object({
+  type: builtInAgentRuntimeTypeSchema,
+  ...agentRuntimeDefaultsSchema,
+}).strict()
+
+export const externalAgentRuntimeSchema = z.object({
+  runtimeRef: z.object({
+    name: z.string(),
+  }),
+  ...agentRuntimeDefaultsSchema,
+}).strict()
+
+export const agentRuntimeSchema = z.union([builtInAgentRuntimeSchema, externalAgentRuntimeSchema])
+export const agentCLIRuntimeSchema = agentRuntimeSchema
 
 export const agentSpecSchema = z.object({
   providerRef: z.object({ name: z.string(), namespace: z.string().optional() }).optional(),
@@ -47,7 +66,49 @@ export const agentSpecSchema = z.object({
     maxConcurrentChildren: z.number().optional(),
     maxDepth: z.number().optional(),
   }).optional(),
-  runtime: agentCLIRuntimeSchema.optional(),
+  runtime: agentRuntimeSchema.optional(),
+}).superRefine((spec, ctx) => {
+  if (spec.runtime && 'type' in spec.runtime && spec.runtime.type === 'opencode') {
+    if (spec.systemPrompt?.inline?.trim() || spec.systemPrompt?.configMapRef) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: 'OpenCode does not support Agent systemPrompt; use Task prompts instead',
+        path: ['systemPrompt'],
+      })
+    }
+    if (!spec.model?.name?.trim()) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: 'OpenCode requires model.name',
+        path: ['model', 'name'],
+      })
+    }
+    if (spec.model?.contextWindow === undefined) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: 'OpenCode requires model.contextWindow',
+        path: ['model', 'contextWindow'],
+      })
+    }
+    if (spec.model?.maxTokens === undefined || !Number.isInteger(spec.model.maxTokens) || spec.model.maxTokens <= 0) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: 'OpenCode requires a positive integer model.maxTokens',
+        path: ['model', 'maxTokens'],
+      })
+    }
+    if (
+      spec.model?.contextWindow !== undefined
+      && spec.model?.maxTokens !== undefined
+      && spec.model.contextWindow <= spec.model.maxTokens
+    ) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: 'OpenCode model.contextWindow must exceed model.maxTokens',
+        path: ['model', 'contextWindow'],
+      })
+    }
+  }
 })
 
 export const agentStatusSchema = z.object({
@@ -71,6 +132,7 @@ export const agentSchema = z.object({
   status: agentStatusSchema.optional(),
 })
 
+export type BuiltInAgentRuntimeType = z.infer<typeof builtInAgentRuntimeTypeSchema>
 export type Agent = z.infer<typeof agentSchema>
 export type AgentSpec = z.infer<typeof agentSpecSchema>
 export type AgentStatus = z.infer<typeof agentStatusSchema>
diff --git a/ui/src/schemas/runtime.test.ts b/ui/src/schemas/runtime.test.ts
new file mode 100644
index 000000000..3d695b971
--- /dev/null
+++ b/ui/src/schemas/runtime.test.ts
@@ -0,0 +1,217 @@
+import { describe, expect, it } from 'vitest'
+import { agentRuntimeSchema, runtimePoolSchema } from './runtime'
+
+const digest = `sha256:${'a'.repeat(64)}`
+
+const profile = {
+  protocolVersion: 'orka.harness.v2' as const,
+  digest,
+  digestSchemaVersion: 'v1',
+  acpProfile: 'schema-v1.20.0',
+  adapterDigests: { adapter: digest },
+  providerKind: 'openai',
+  model: 'gpt-5',
+  agentConfigurationDigest: digest,
+  toolPolicyDigest: digest,
+  approvalPolicyDigest: digest,
+  mcpConfigurationDigest: digest,
+  workspaceIntent: 'read' as const,
+  proxyCredentialRole: 'provider',
+  proxyCredentialScope: 'runtime:codex',
+  resourceClass: 'standard',
+}
+
+describe('runtimePoolSchema', () => {
+  it('parses v2 pool identity, capacity, and active instance status', () => {
+    const value = {
+      metadata: { name: 'codex-read', namespace: 'default', uid: 'pool-uid' },
+      spec: {
+        trustDomain: { namespace: 'default', identity: 'default/operators' },
+        runtime: { image: 'docker.io/example/codex@sha256:abc', profile },
+      },
+      status: {
+        lifecycle: 'Serving',
+        admissionState: 'Accepting',
+        desiredReplicas: 1,
+        currentReplicas: 1,
+        capacity: { maxResidentSessions: 10, maxRunningPrompts: 4, residentSessions: 2, runningPrompts: 1 },
+        activeInstance: {
+          podNamespace: 'orka-runtime',
+          podName: 'codex-read-1',
+          podAddress: '10.0.0.2',
+          podUID: 'pod-uid',
+          bootID: 'boot-1',
+          runtimeInstanceID: 'pod-uid:boot-1',
+          controllerEpoch: 7,
+          protocolVersion: 'orka.harness.v2',
+          profileDigest: digest,
+          profileDigestSchemaVersion: 'v1',
+        },
+      },
+    }
+    expect(runtimePoolSchema.parse(value)).toEqual(value)
+  })
+})
+
+describe('agentRuntimeSchema', () => {
+  it('preserves a stored unclassified runtime without inferring a contract', () => {
+    const value = {
+      metadata: { name: 'legacy-unclassified', namespace: 'default' },
+      spec: {
+        deployment: { mode: 'external-endpoint', endpoint: 'https://legacy.example.test' },
+        clientAuth: { bearerTokenSecretRef: { name: 'legacy-auth', key: 'token' } },
+        capabilities: { toolExecutionModes: ['observed'], supportsCancel: true },
+      },
+      status: { ready: false, message: 'AgentRuntime contractVersion is unclassified' },
+    }
+
+    const parsed = agentRuntimeSchema.parse(value)
+    expect(parsed).toEqual(value)
+    expect(parsed.spec.contractVersion).toBeUndefined()
+  })
+
+  it('parses the v2 capability surface', () => {
+    const value = {
+      metadata: { name: 'external-codex', namespace: 'default' },
+      spec: {
+        contractVersion: 'orka.harness.v2',
+        deployment: { mode: 'external-endpoint', endpoint: 'https://runtime.example.test' },
+        clientAuth: {
+          controllerBearerTokenSecretRef: { name: 'runtime-auth', key: 'controller-token' },
+          operationCapabilitySecretRef: { name: 'runtime-auth', key: 'capability-secret' },
+        },
+        capabilities: {
+          runtimeInstanceID: 'external-instance-1',
+          profile: {
+            ...profile,
+            digestSchemaVersion: 1,
+            adapterName: 'codex-acp',
+            adapterDigest: digest,
+          },
+          limits: {
+            maxResidentSessions: 10,
+            maxConcurrentPrompts: 4,
+            maxRequestBytes: 1000,
+            maxEventLineBytes: 1000,
+            maxTerminalResultBytes: 1000,
+            maxBufferedEvents: 100,
+            maxUpdateEventsPerSecond: 50,
+            minPromptLeaseMillis: 1000,
+            maxPromptLeaseMillis: 10000,
+            maxPendingPermissions: 4,
+            maxWorkspaceDeltaBytes: 100000,
+          },
+          supportsPublicationFinalization: true,
+          workspaceGovernance: {
+            mode: 'strict-governed',
+            trusted: false,
+            orkaOwnedWorkspaceDeltas: true,
+            promptScopedBrokerAuthorization: true,
+            noDirectSCMPublication: true,
+            orkaOwnedCleanRoomPublication: true,
+            exactInstanceFencing: true,
+            duplicateSafeMutations: true,
+            cancellationSettlement: true,
+          },
+        },
+      },
+      status: { ready: true },
+    }
+    const parsed = agentRuntimeSchema.parse(value)
+    expect(parsed.spec.contractVersion).toBe('orka.harness.v2')
+    if (parsed.spec.contractVersion !== 'orka.harness.v2') throw new Error('expected v2 runtime')
+    expect(parsed.spec.capabilities.supportsDrain).toBe(false)
+    expect(parsed.spec.capabilities.profile.adapterName).toBe('codex-acp')
+    expect(parsed.spec.capabilities.workspaceGovernance.mode).toBe('strict-governed')
+
+    expect(agentRuntimeSchema.safeParse({
+      ...value,
+      spec: { ...value.spec, capabilities: { ...value.spec.capabilities, supportsContinuation: true } },
+    }).success).toBe(false)
+  })
+
+  it('parses a minimal v1 registration without declared capabilities', () => {
+    const value = {
+      metadata: { name: 'legacy-minimal', namespace: 'default' },
+      spec: {
+        contractVersion: 'orka.harness.v1',
+        deployment: { mode: 'external-endpoint', endpoint: 'https://legacy.example.test' },
+        clientAuth: { bearerTokenSecretRef: { name: 'legacy-auth', key: 'token' } },
+      },
+    }
+
+    expect(agentRuntimeSchema.parse(value)).toEqual(value)
+  })
+
+  it('parses the full configured and observed v1 capability surface', () => {
+    const value = {
+      metadata: { name: 'legacy-full', namespace: 'default' },
+      spec: {
+        contractVersion: 'orka.harness.v1',
+        deployment: { mode: 'external-endpoint', endpoint: 'https://legacy.example.test' },
+        clientAuth: { bearerTokenSecretRef: { name: 'legacy-auth', key: 'token' } },
+        capabilities: {
+          toolExecutionModes: ['observed', 'brokered'],
+          brokeredToolClasses: ['read', 'write', 'coordination'],
+          supportsCancel: true,
+          supportsRuntimeSessions: true,
+          supportsContinuation: true,
+          supportsArtifacts: true,
+        },
+      },
+      status: {
+        ready: true,
+        observedGeneration: 3,
+        observedAuthRefResourceVersion: '12345',
+        lastValidated: '2026-08-07T12:00:00Z',
+        message: 'authenticated orka.harness.v1 conformance passed',
+        observedCapabilities: {
+          protocolVersion: 'orka.harness.v1',
+          transport: 'http+sse',
+          runtimeName: 'agentkit',
+          runtimeVersion: '1.4.2',
+          providerKind: 'generic',
+          toolExecutionModes: ['observed', 'brokered'],
+          brokeredToolClasses: ['read'],
+          supportsCancel: true,
+          supportsRuntimeSessions: true,
+          supportsContinuation: true,
+          supportsArtifacts: true,
+          supportsSuspend: true,
+          supportsWorkspaceSnapshot: true,
+          maxConcurrentTurns: 4,
+          maxTurnSeconds: 1800,
+          maxOutputBytes: 1048576,
+        },
+      },
+    }
+
+    expect(agentRuntimeSchema.parse(value)).toEqual(value)
+  })
+
+  it('rejects contract-specific auth and capability fields on the other contract', () => {
+    const v1Base = {
+      metadata: { name: 'legacy', namespace: 'default' },
+      spec: {
+        contractVersion: 'orka.harness.v1',
+        deployment: { mode: 'external-endpoint', endpoint: 'https://legacy.example.test' },
+        clientAuth: { bearerTokenSecretRef: { name: 'legacy-auth', key: 'token' } },
+      },
+    }
+
+    expect(agentRuntimeSchema.safeParse({
+      ...v1Base,
+      spec: { ...v1Base.spec, capabilities: { supportsDrain: true } },
+    }).success).toBe(false)
+    expect(agentRuntimeSchema.safeParse({
+      ...v1Base,
+      spec: {
+        ...v1Base.spec,
+        clientAuth: {
+          controllerBearerTokenSecretRef: { name: 'auth', key: 'controller-token' },
+          operationCapabilitySecretRef: { name: 'auth', key: 'capability-secret' },
+        },
+      },
+    }).success).toBe(false)
+  })
+})
diff --git a/ui/src/schemas/runtime.ts b/ui/src/schemas/runtime.ts
new file mode 100644
index 000000000..91e88fa1b
--- /dev/null
+++ b/ui/src/schemas/runtime.ts
@@ -0,0 +1,262 @@
+import { z } from 'zod'
+import { conditionSchema, k8sMetadataSchema, workspaceIntentSchema } from './task'
+
+export const runtimePoolLifecycleSchema = z.enum([
+  'Stopped',
+  'Starting',
+  'Serving',
+  'Draining',
+  'Quiescent',
+  'Stopping',
+  'Degraded',
+  'Ambiguous',
+])
+
+export const runtimePoolAdmissionSchema = z.enum(['Closed', 'Accepting', 'Draining', 'Ambiguous'])
+
+export const runtimeProfileSchema = z.object({
+  protocolVersion: z.literal('orka.harness.v2').optional(),
+  digest: z.string(),
+  digestSchemaVersion: z.string(),
+  acpProfile: z.string(),
+  adapterDigests: z.record(z.string()),
+  providerKind: z.string(),
+  model: z.string(),
+  modelLimits: z.object({ context: z.number(), output: z.number() }).optional(),
+  agentConfigurationDigest: z.string(),
+  toolPolicyDigest: z.string(),
+  approvalPolicyDigest: z.string(),
+  mcpConfigurationDigest: z.string(),
+  workspaceIntent: workspaceIntentSchema,
+  proxyCredentialRole: z.string(),
+  proxyCredentialScope: z.string(),
+  resourceClass: z.string(),
+})
+
+export const runtimePoolSchema = z.object({
+  apiVersion: z.string().optional(),
+  kind: z.string().optional(),
+  metadata: k8sMetadataSchema,
+  spec: z.object({
+    trustDomain: z.object({ namespace: z.string(), identity: z.string() }),
+    runtimeNamespace: z.string().optional(),
+    runtime: z.object({
+      image: z.string(),
+      profile: runtimeProfileSchema,
+    }),
+    desiredReplicas: z.number().optional(),
+    capacity: z.object({
+      maxResidentSessions: z.number().optional(),
+      maxRunningPrompts: z.number().optional(),
+    }).optional(),
+    coldStartTimeoutSeconds: z.number().optional(),
+  }),
+  status: z.object({
+    observedGeneration: z.number().optional(),
+    controllerEpoch: z.number().optional(),
+    desiredReplicas: z.number().optional(),
+    currentReplicas: z.number().optional(),
+    lifecycle: runtimePoolLifecycleSchema.optional(),
+    admissionState: runtimePoolAdmissionSchema.optional(),
+    activeInstance: z.object({
+      podNamespace: z.string(),
+      podName: z.string(),
+      podAddress: z.string(),
+      podUID: z.string(),
+      bootID: z.string(),
+      runtimeInstanceID: z.string(),
+      controllerEpoch: z.number(),
+      protocolVersion: z.literal('orka.harness.v2'),
+      profileDigest: z.string(),
+      profileDigestSchemaVersion: z.string(),
+      lastObservedTime: z.string().optional(),
+    }).optional(),
+    capacity: z.object({
+      maxResidentSessions: z.number().optional(),
+      maxRunningPrompts: z.number().optional(),
+      residentSessions: z.number().optional(),
+      runningPrompts: z.number().optional(),
+      queuedTasks: z.number().optional(),
+      reservedSessions: z.number().optional(),
+      pendingPermissions: z.number().optional(),
+      finalizingSessions: z.number().optional(),
+      liveDescendants: z.number().optional(),
+    }).optional(),
+    message: z.string().optional(),
+    conditions: z.array(conditionSchema).optional(),
+  }).optional(),
+})
+
+const secretKeyRefSchema = z.object({
+  name: z.string(),
+  key: z.string(),
+})
+
+const agentRuntimeDeploymentSchema = z.object({
+  mode: z.literal('external-endpoint'),
+  endpoint: z.string(),
+})
+
+const agentRuntimeToolExecutionModeSchema = z.enum(['observed', 'brokered'])
+const agentRuntimeBrokeredToolClassSchema = z.enum(['read', 'write', 'coordination'])
+
+export const agentRuntimeLimitsSchema = z.object({
+  maxResidentSessions: z.number(),
+  maxConcurrentPrompts: z.number(),
+  maxRequestBytes: z.number(),
+  maxEventLineBytes: z.number(),
+  maxTerminalResultBytes: z.number(),
+  maxBufferedEvents: z.number(),
+  maxUpdateEventsPerSecond: z.number(),
+  minPromptLeaseMillis: z.number(),
+  maxPromptLeaseMillis: z.number(),
+  maxPendingPermissions: z.number(),
+  maxWorkspaceDeltaBytes: z.number(),
+})
+
+export const workspaceGovernanceSchema = z.object({
+  mode: z.enum(['strict-governed', 'trusted-non-governed']),
+  trusted: z.boolean(),
+  orkaOwnedWorkspaceDeltas: z.boolean(),
+  promptScopedBrokerAuthorization: z.boolean(),
+  noDirectSCMPublication: z.boolean(),
+  orkaOwnedCleanRoomPublication: z.boolean(),
+  exactInstanceFencing: z.boolean(),
+  duplicateSafeMutations: z.boolean(),
+  cancellationSettlement: z.boolean(),
+})
+
+export const agentRuntimeProfileSchema = z.object({
+  digest: z.string(),
+  digestSchemaVersion: z.number(),
+  acpProfile: z.string(),
+  adapterName: z.string(),
+  adapterDigest: z.string(),
+  providerKind: z.string(),
+  model: z.string(),
+  modelLimits: z.object({ context: z.number(), output: z.number() }).optional(),
+  agentConfigurationDigest: z.string(),
+  toolPolicyDigest: z.string(),
+  approvalPolicyDigest: z.string(),
+  mcpConfigurationDigest: z.string(),
+  workspaceIntent: workspaceIntentSchema,
+  proxyCredentialRole: z.string(),
+  proxyCredentialScope: z.string(),
+  resourceClass: z.string(),
+})
+
+const agentRuntimeV1CapabilitiesSchema = z.object({
+  toolExecutionModes: z.array(agentRuntimeToolExecutionModeSchema).optional(),
+  brokeredToolClasses: z.array(agentRuntimeBrokeredToolClassSchema).optional(),
+  supportsCancel: z.boolean().optional(),
+  supportsRuntimeSessions: z.boolean().optional(),
+  supportsContinuation: z.boolean().optional(),
+  supportsArtifacts: z.boolean().optional(),
+}).strict()
+
+const agentRuntimeV1SpecSchema = z.object({
+  contractVersion: z.literal('orka.harness.v1'),
+  deployment: agentRuntimeDeploymentSchema,
+  clientAuth: z.object({
+    bearerTokenSecretRef: secretKeyRefSchema,
+  }).strict(),
+  capabilities: agentRuntimeV1CapabilitiesSchema.optional(),
+}).strict()
+
+const agentRuntimeV2SpecSchema = z.object({
+  contractVersion: z.literal('orka.harness.v2'),
+  deployment: agentRuntimeDeploymentSchema,
+  clientAuth: z.object({
+    controllerBearerTokenSecretRef: secretKeyRefSchema,
+    operationCapabilitySecretRef: secretKeyRefSchema,
+  }).strict(),
+  capabilities: z.object({
+    runtimeInstanceID: z.string(),
+    profile: agentRuntimeProfileSchema,
+    limits: agentRuntimeLimitsSchema,
+    supportsDrain: z.boolean().default(false),
+    supportsPublicationFinalization: z.boolean().optional(),
+    workspaceGovernance: workspaceGovernanceSchema,
+  }).strict(),
+}).strict()
+
+const agentRuntimeUnclassifiedSpecSchema = z.object({
+  contractVersion: z.undefined().optional(),
+  deployment: agentRuntimeDeploymentSchema,
+  clientAuth: z.record(z.string(), z.unknown()),
+  capabilities: z.record(z.string(), z.unknown()).optional(),
+}).strict()
+
+export const agentRuntimeSpecSchema = z.union([
+  agentRuntimeV1SpecSchema,
+  agentRuntimeV2SpecSchema,
+  agentRuntimeUnclassifiedSpecSchema,
+])
+
+const agentRuntimeObservedCapabilitiesSchema = z.object({
+  protocolVersion: z.string().optional(),
+  transport: z.string().optional(),
+  acpVersion: z.string().optional(),
+  runtimeInstanceID: z.string().optional(),
+  supervisorBootID: z.string().optional(),
+  controllerEpoch: z.number().optional(),
+  runtimePoolUID: z.string().optional(),
+  runtimePoolGeneration: z.number().optional(),
+  runtimeProfileDigest: z.string().optional(),
+  profileDigestSchemaVersion: z.number().optional(),
+  adapterName: z.string().optional(),
+  adapterDigest: z.string().optional(),
+  providerKind: z.string().optional(),
+  model: z.string().optional(),
+  limits: agentRuntimeLimitsSchema.partial().optional(),
+  supportsDrain: z.boolean().optional(),
+  supportsPublicationFinalization: z.boolean().optional(),
+  workspaceGovernance: workspaceGovernanceSchema.partial().optional(),
+  lifecycle: z.string().optional(),
+  runtimeName: z.string().optional(),
+  runtimeVersion: z.string().optional(),
+  toolExecutionModes: z.array(agentRuntimeToolExecutionModeSchema).optional(),
+  brokeredToolClasses: z.array(agentRuntimeBrokeredToolClassSchema).optional(),
+  supportsCancel: z.boolean().optional(),
+  supportsRuntimeSessions: z.boolean().optional(),
+  supportsContinuation: z.boolean().optional(),
+  supportsArtifacts: z.boolean().optional(),
+  supportsSuspend: z.boolean().optional(),
+  supportsWorkspaceSnapshot: z.boolean().optional(),
+  maxConcurrentTurns: z.number().optional(),
+  maxTurnSeconds: z.number().optional(),
+  maxOutputBytes: z.number().optional(),
+})
+
+export const agentRuntimeSchema = z.object({
+  apiVersion: z.string().optional(),
+  kind: z.string().optional(),
+  metadata: k8sMetadataSchema,
+  spec: agentRuntimeSpecSchema,
+  status: z.object({
+    ready: z.boolean().optional(),
+    observedGeneration: z.number().optional(),
+    observedCapabilities: agentRuntimeObservedCapabilitiesSchema.optional(),
+    lastValidated: z.string().optional(),
+    observedControllerAuthRefResourceVersion: z.string().optional(),
+    observedOperationCapabilityRefResourceVersion: z.string().optional(),
+    observedAuthRefResourceVersion: z.string().optional(),
+    message: z.string().optional(),
+    conditions: z.array(conditionSchema).optional(),
+  }).optional(),
+})
+
+export const runtimePoolListSchema = z.object({
+  items: z.array(runtimePoolSchema),
+  metadata: z.object({ continue: z.string().optional(), remainingItemCount: z.number().optional() }).optional(),
+})
+
+export const agentRuntimeListSchema = z.object({
+  items: z.array(agentRuntimeSchema),
+  metadata: z.object({ continue: z.string().optional(), remainingItemCount: z.number().optional() }).optional(),
+})
+
+export type RuntimePool = z.infer<typeof runtimePoolSchema>
+export type AgentRuntime = z.infer<typeof agentRuntimeSchema>
+export type RuntimePoolList = z.infer<typeof runtimePoolListSchema>
+export type AgentRuntimeList = z.infer<typeof agentRuntimeListSchema>
diff --git a/ui/src/schemas/session.test.ts b/ui/src/schemas/session.test.ts
index 16e9491dd..7359f7d81 100644
--- a/ui/src/schemas/session.test.ts
+++ b/ui/src/schemas/session.test.ts
@@ -16,6 +16,25 @@ describe('sessionSchema', () => {
       inputTokens: '100',
       outputTokens: '200',
       activeTask: 'task-1',
+      executionControl: {
+        resourceVersion: '42',
+        sessionUID: 'session-uid',
+        runtimePoolRef: 'opencode-read',
+        runtimeProfileDigest: `sha256:${'a'.repeat(64)}`,
+        generation: 3,
+        lifecycle: 'Idle',
+        availability: 'Available',
+        mutationLeaseGeneration: 7,
+        lineage: {
+          namespaceUID: 'namespace-uid',
+          sessionUID: 'session-uid',
+          contractVersion: 'orka.harness.v2',
+          generation: 1,
+          runtimeIdentity: 'opencode',
+          configDigest: `sha256:${'b'.repeat(64)}`,
+          establishedAt: '2026-08-06T00:00:00Z',
+        },
+      },
       createdAt: '2024-01-01T00:00:00Z',
       updatedAt: '2024-01-01T01:00:00Z',
     }
@@ -39,6 +58,22 @@ describe('sessionSchema', () => {
     expect(() => sessionSchema.parse({ name: 123, namespace: 'default' })).toThrow()
     expect(() => sessionSchema.parse({ name: 'sess-1', namespace: 'default', messageCount: 5 })).toThrow()
   })
+
+  it('rejects invalid execution lineage and availability values', () => {
+    expect(() => sessionSchema.parse({
+      name: 'sess-1',
+      namespace: 'default',
+      executionControl: { sessionUID: 'uid', availability: 'Unknown' },
+    })).toThrow()
+    expect(() => sessionSchema.parse({
+      name: 'sess-1',
+      namespace: 'default',
+      executionControl: {
+        sessionUID: 'uid',
+        lineage: { contractVersion: 'orka.harness.v3' },
+      },
+    })).toThrow()
+  })
 })
 
 describe('sessionListItemSchema', () => {
diff --git a/ui/src/schemas/session.ts b/ui/src/schemas/session.ts
index f194b85e4..3e14fe3f1 100644
--- a/ui/src/schemas/session.ts
+++ b/ui/src/schemas/session.ts
@@ -1,4 +1,30 @@
 import { z } from 'zod'
+import { harnessContractVersionSchema } from './task'
+
+export const sessionExecutionLineageSchema = z.object({
+  namespaceUID: z.string(),
+  sessionUID: z.string(),
+  contractVersion: harnessContractVersionSchema,
+  generation: z.number(),
+  runtimeIdentity: z.string(),
+  configDigest: z.string(),
+  establishedAt: z.string(),
+})
+
+export const sessionExecutionControlSchema = z.object({
+  resourceVersion: z.string().optional(),
+  sessionUID: z.string(),
+  runtimePoolRef: z.string().optional(),
+  runtimeProfileDigest: z.string().optional(),
+  generation: z.number().optional(),
+  lifecycle: z.string().optional(),
+  availability: z.enum(['Available', 'ReconciliationBlocked']).optional(),
+  mutationLeaseGeneration: z.number().optional(),
+  blockedReason: z.string().optional(),
+  relatedPromptAttemptID: z.string().optional(),
+  relatedPublicationID: z.string().optional(),
+  lineage: sessionExecutionLineageSchema.optional(),
+})
 
 export const sessionSchema = z.object({
   name: z.string(),
@@ -8,6 +34,7 @@ export const sessionSchema = z.object({
   inputTokens: z.string().optional(),
   outputTokens: z.string().optional(),
   activeTask: z.string().optional(),
+  executionControl: sessionExecutionControlSchema.optional(),
   createdAt: z.string().optional(),
   updatedAt: z.string().optional(),
 })
@@ -35,3 +62,5 @@ export const transcriptMessageSchema = z.object({
 export type Session = z.infer<typeof sessionSchema>
 export type SessionListItem = z.infer<typeof sessionListItemSchema>
 export type TranscriptMessage = z.infer<typeof transcriptMessageSchema>
+export type SessionExecutionControl = z.infer<typeof sessionExecutionControlSchema>
+export type SessionExecutionLineage = z.infer<typeof sessionExecutionLineageSchema>
diff --git a/ui/src/schemas/task.test.ts b/ui/src/schemas/task.test.ts
index e02980595..a1a83e1dd 100644
--- a/ui/src/schemas/task.test.ts
+++ b/ui/src/schemas/task.test.ts
@@ -10,6 +10,9 @@ import {
   aiSpecSchema,
   workspaceConfigSchema,
   agentRuntimeSpecSchema,
+  taskExecutionStatusSchema,
+  taskDeliveryStatusSchema,
+  harnessRuntimeStatusSchema,
   resultRefSchema,
   childTaskStatusSchema,
   taskSpecSchema,
@@ -174,45 +177,113 @@ describe('aiSpecSchema', () => {
 })
 
 describe('workspaceConfigSchema', () => {
-  it('parses valid data', () => {
+  it('parses canonical URL-derived repository identities and role-specific credential references', () => {
     const data = {
-      gitRepo: 'https://github.com/org/repo',
+      intent: 'write',
+      gitRepo: 'https://github.com/org/source',
+      sourceRepository: { provider: 'github', id: 'github.com/org/source' },
+      readCredentialRef: { name: 'repo-read', key: 'source-token' },
+      publicationGitRepo: 'https://github.com/org/publish',
+      publicationRepository: { provider: 'github', id: 'github.com/org/publish' },
+      publicationReadCredentialRef: { name: 'repo-verify', key: 'verify-token' },
+      publicationCredentialRef: { name: 'repo-write', key: 'write-token' },
+      forgeCredentialRef: { name: 'repo-forge', key: 'forge-token' },
       branch: 'main',
-      ref: 'abc123',
-      gitSecretRef: { name: 'git-creds' },
-      subPath: 'src/',
+      pushBranch: 'orka/change',
+      prBaseBranch: 'main',
+      createPR: true,
     }
     expect(workspaceConfigSchema.parse(data)).toEqual(data)
   })
 
-  it('parses empty object', () => {
-    expect(workspaceConfigSchema.parse({})).toEqual({})
+  it('keeps credential keys optional for the API token default', () => {
+    const data = { intent: 'read', readCredentialRef: { name: 'repo-read' } }
+    expect(workspaceConfigSchema.parse(data)).toEqual(data)
   })
 
-  it('rejects wrong types', () => {
-    expect(() => workspaceConfigSchema.parse({ gitSecretRef: 'invalid' })).toThrow()
+  it('requires a distinct forge credential when createPR is requested', () => {
+    expect(() => workspaceConfigSchema.parse({
+      intent: 'write',
+      publicationCredentialRef: { name: 'repo-write' },
+      createPR: true,
+    })).toThrow(/createPR requires forgeCredentialRef/)
+  })
+
+  it('rejects legacy, invalid, and secret-value workspace fields', () => {
+    expect(() => workspaceConfigSchema.parse({ intent: 'execute' })).toThrow()
+    expect(() => workspaceConfigSchema.parse({ gitSecretRef: { name: 'legacy' } })).toThrow()
+    expect(() => workspaceConfigSchema.parse({ forkRepo: 'https://example.com/fork' })).toThrow()
+    expect(() => workspaceConfigSchema.parse({
+      readCredentialRef: { name: 'repo-read', value: 'must-never-render' },
+    })).toThrow()
   })
 })
 
 describe('agentRuntimeSpecSchema', () => {
-  it('parses valid data with all fields', () => {
-    const data = {
-      workspace: { gitRepo: 'https://github.com/org/repo', branch: 'main' },
-      maxTurns: 50,
-      allowedTools: ['bash', 'read'],
-      disallowedTools: ['write'],
-      allowBash: true,
-    }
+  it('parses governed tool overrides', () => {
+    const data = { allowedTools: ['read'], disallowedTools: ['write'], allowBash: false }
     expect(agentRuntimeSpecSchema.parse(data)).toEqual(data)
+    expect(agentRuntimeSpecSchema.parse({ maxTurns: 50 })).toEqual({ maxTurns: 50 })
+    expect(() => agentRuntimeSpecSchema.parse({ unknownField: true })).toThrow()
+  })
+
+  it('parses the preserved legacy harness v1 workspace surface', () => {
+    // Stored v1 Tasks keep spec.agentRuntime.workspace as a read-only
+    // coexistence compatibility surface; the CRD forbids introducing it on
+    // new Tasks, but the UI must render stored objects without pruning.
+    const legacy = {
+      workspace: {
+        gitRepo: 'https://github.com/org/repo.git',
+        branch: 'main',
+        gitSecretRef: { name: 'git-credentials' },
+        forkRepo: 'https://github.com/bot/repo.git',
+        pushBranch: 'agent/fix-1',
+      },
+      maxTurns: 25,
+    }
+    expect(agentRuntimeSpecSchema.parse(legacy)).toEqual(legacy)
   })
+})
 
-  it('parses empty object', () => {
-    expect(agentRuntimeSpecSchema.parse({})).toEqual({})
+describe('structured ACP task status', () => {
+  it('parses exact runtime pool execution identity', () => {
+    const data = {
+      state: 'Running',
+      attempt: 2,
+      promptID: 'prompt-2',
+      runtimePoolName: 'codex-read',
+      runtimeInstanceID: 'pod:boot',
+      runtimeSessionGeneration: 3,
+      controllerEpoch: 9,
+    }
+    expect(taskExecutionStatusSchema.parse(data)).toEqual(data)
+  })
+
+  it('parses publication verification and unknown outcomes', () => {
+    const delivery = {
+      state: 'VerifiedExact',
+      outcome: 'VerifiedExact',
+      publicationID: 'pub-1',
+      branch: 'orka/change',
+      expectedCommitSHA: 'a'.repeat(40),
+      verifiedRemoteSHA: 'a'.repeat(40),
+      prReceipt: { id: 'pr-1', number: 42, state: 'open' },
+    }
+    expect(taskDeliveryStatusSchema.parse(delivery)).toEqual(delivery)
+    expect(taskExecutionStatusSchema.parse({ state: 'OutcomeUnknown', outcome: 'OutcomeUnknown' })).toEqual({
+      state: 'OutcomeUnknown',
+      outcome: 'OutcomeUnknown',
+    })
   })
 
-  it('rejects wrong types', () => {
-    expect(() => agentRuntimeSpecSchema.parse({ maxTurns: 'fifty' })).toThrow()
-    expect(() => agentRuntimeSpecSchema.parse({ allowBash: 'yes' })).toThrow()
+  it('preserves harness v1 reconciliation context', () => {
+    const status = {
+      state: 'OutcomeUnknown' as const,
+      outcome: 'OutcomeUnknown' as const,
+      reason: 'WrapperRestarted',
+      message: 'accepted turn could not be settled after restart',
+    }
+    expect(harnessRuntimeStatusSchema.parse(status)).toEqual(status)
   })
 })
 
@@ -282,7 +353,8 @@ describe('taskSpecSchema', () => {
       type: 'agent',
       agentRef: { name: 'my-agent' },
       prompt: 'do something',
-      agentRuntime: { maxTurns: 10, allowBash: true },
+      agentRuntime: { allowBash: true },
+      workspace: { intent: 'read', gitRepo: 'https://github.com/org/repo', readCredentialRef: { name: 'repo-read' } },
     }
     expect(taskSpecSchema.parse(data)).toEqual(data)
   })
@@ -318,6 +390,8 @@ describe('taskStatusSchema', () => {
       attempts: 2,
       jobName: 'task-xyz-job',
       resultRef: { configMapName: 'result-cm' },
+      execution: { state: 'Running', runtimePoolName: 'codex-read' },
+      delivery: { state: 'Validating' },
       webhookDelivered: true,
       message: 'Task completed',
       childTasks: [{ name: 'c1', agent: 'a1', phase: 'Succeeded' }],
diff --git a/ui/src/schemas/task.ts b/ui/src/schemas/task.ts
index d7d306c3d..3763b2cd4 100644
--- a/ui/src/schemas/task.ts
+++ b/ui/src/schemas/task.ts
@@ -2,6 +2,8 @@ import { z } from 'zod'
 
 export const taskTypeSchema = z.enum(['container', 'ai', 'agent'])
 export const taskPhaseSchema = z.enum(['Pending', 'Running', 'Finalizing', 'Succeeded', 'Failed', 'Scheduled', 'Cancelled'])
+export const workspaceIntentSchema = z.enum(['read', 'write'])
+
 
 export const conditionSchema = z.object({
   type: z.string(),
@@ -46,21 +48,159 @@ export const aiSpecSchema = z.object({
   tools: z.array(z.string()).optional(),
 })
 
+export const repositoryIdentitySchema = z.object({
+  provider: z.string(),
+  id: z.string(),
+})
+
+export const workspaceCredentialRefSchema = z.object({
+  name: z.string().trim().min(1),
+  key: z.string().trim().min(1).optional(),
+}).strict()
+
 export const workspaceConfigSchema = z.object({
+  intent: workspaceIntentSchema.optional(),
   gitRepo: z.string().optional(),
+  sourceRepository: repositoryIdentitySchema.optional(),
   branch: z.string().optional(),
   ref: z.string().optional(),
+  readCredentialRef: workspaceCredentialRefSchema.optional(),
+  publicationGitRepo: z.string().optional(),
+  publicationRepository: repositoryIdentitySchema.optional(),
+  publicationReadCredentialRef: workspaceCredentialRefSchema.optional(),
+  publicationCredentialRef: workspaceCredentialRefSchema.optional(),
+  forgeCredentialRef: workspaceCredentialRefSchema.optional(),
+  subPath: z.string().optional(),
+  prBaseBranch: z.string().optional(),
   pushBranch: z.string().optional(),
-  gitSecretRef: z.object({ name: z.string() }).optional(),
+  createPR: z.boolean().optional(),
+}).strict().superRefine((workspace, context) => {
+  if (workspace.createPR && !workspace.forgeCredentialRef) {
+    context.addIssue({
+      code: 'custom',
+      message: 'createPR requires forgeCredentialRef',
+      path: ['forgeCredentialRef'],
+    })
+  }
+})
+
+// Legacy harness v1 workspace preserved at spec.agentRuntime.workspace; a
+// read-only compatibility surface for stored v1 Tasks.
+export const legacyAgentWorkspaceConfigSchema = z.object({
+  gitRepo: z.string().optional(),
+  branch: z.string().optional(),
+  ref: z.string().optional(),
+  gitSecretRef: z.object({ name: z.string().optional() }).optional(),
   subPath: z.string().optional(),
+  forkRepo: z.string().optional(),
+  prBaseBranch: z.string().optional(),
+  pushBranch: z.string().optional(),
 })
 
 export const agentRuntimeSpecSchema = z.object({
-  workspace: workspaceConfigSchema.optional(),
+  workspace: legacyAgentWorkspaceConfigSchema.optional(),
   maxTurns: z.number().optional(),
   allowedTools: z.array(z.string()).optional(),
   disallowedTools: z.array(z.string()).optional(),
   allowBash: z.boolean().optional(),
+}).strict()
+
+export const harnessContractVersionSchema = z.enum(['orka.harness.v1', 'orka.harness.v2'])
+
+export const taskExecutionStateSchema = z.enum([
+  'Queued',
+  'Reserved',
+  'SessionStarting',
+  'Planned',
+  'Submitting',
+  'SubmittedUnknown',
+  'Accepted',
+  'Running',
+  'Settling',
+  'Succeeded',
+  'Failed',
+  'Cancelled',
+  'OutcomeUnknown',
+])
+
+export const taskExecutionOutcomeSchema = z.enum(['Succeeded', 'Failed', 'Cancelled', 'OutcomeUnknown'])
+
+export const taskExecutionStatusSchema = z.object({
+  state: taskExecutionStateSchema.optional(),
+  outcome: taskExecutionOutcomeSchema.optional(),
+  reason: z.string().optional(),
+  attempt: z.number().optional(),
+  promptID: z.string().optional(),
+  runtimePoolName: z.string().optional(),
+  runtimePoolUID: z.string().optional(),
+  runtimeInstanceID: z.string().optional(),
+  runtimeSessionUID: z.string().optional(),
+  runtimeSessionGeneration: z.number().optional(),
+  requestDigest: z.string().optional(),
+  controllerEpoch: z.number().optional(),
+  message: z.string().optional(),
+  lastTransitionTime: z.string().optional(),
+})
+
+export const taskDeliveryStateSchema = z.enum([
+  'NotRequested',
+  'Validating',
+  'Preparing',
+  'Prepared',
+  'Publishing',
+  'Verifying',
+  'VerifiedExact',
+  'DeliveredSuperseded',
+  'ReadValidated',
+  'NoChange',
+  'CancelledBeforePublish',
+  'ReadOnlyWorkspaceModified',
+  'DeliveryConflict',
+  'CredentialBlocked',
+  'PublicationOutcomeUnknown',
+])
+
+export const taskDeliveryOutcomeSchema = z.enum([
+  'NotRequested',
+  'VerifiedExact',
+  'DeliveredSuperseded',
+  'ReadValidated',
+  'NoChange',
+  'CancelledBeforePublish',
+  'ReadOnlyWorkspaceModified',
+  'DeliveryConflict',
+  'CredentialBlocked',
+  'PublicationOutcomeUnknown',
+])
+
+export const taskPullRequestReceiptSchema = z.object({
+  id: z.string(),
+  number: z.number().optional(),
+  url: z.string().optional(),
+  state: z.string().optional(),
+  baseBranch: z.string().optional(),
+  headBranch: z.string().optional(),
+  headSHA: z.string().optional(),
+})
+
+export const taskDeliveryStatusSchema = z.object({
+  state: taskDeliveryStateSchema.optional(),
+  outcome: taskDeliveryOutcomeSchema.optional(),
+  reason: z.string().optional(),
+  publicationID: z.string().optional(),
+  sourceRepository: repositoryIdentitySchema.optional(),
+  publicationRepository: repositoryIdentitySchema.optional(),
+  branch: z.string().optional(),
+  startingSHA: z.string().optional(),
+  remoteBeforeSHA: z.string().nullable().optional(),
+  treeSHA: z.string().optional(),
+  expectedCommitSHA: z.string().optional(),
+  verifiedRemoteSHA: z.string().optional(),
+  supersedingRemoteSHA: z.string().optional(),
+  artifactDigest: z.string().optional(),
+  prReceipt: taskPullRequestReceiptSchema.optional(),
+  message: z.string().optional(),
+  lastTransitionTime: z.string().optional(),
 })
 
 export const resultRefSchema = z.object({
@@ -127,6 +267,57 @@ export const taskSpecSchema = z.object({
   agentRef: agentRefSchema.optional(),
   prompt: z.string().optional(),
   agentRuntime: agentRuntimeSpecSchema.optional(),
+  workspace: workspaceConfigSchema.optional(),
+})
+
+// Harness v1 compatibility status surface (non-secret routing metadata only).
+export const harnessRuntimeStatusSchema = z.object({
+  runtimeRefName: z.string().optional(),
+  runtimeName: z.string().optional(),
+  contractVersion: z.string().optional(),
+  endpoint: z.string().optional(),
+  runtimeGeneration: z.number().optional(),
+  authRefName: z.string().optional(),
+  authRefField: z.string().optional(),
+  authRefResourceVersion: z.string().optional(),
+  state: taskExecutionStateSchema.optional(),
+  outcome: taskExecutionOutcomeSchema.optional(),
+  reason: z.string().optional(),
+  message: z.string().optional(),
+})
+
+// The authoritative execution route. Snapshot metadata and abbreviated
+// digests only — snapshot bodies are never exposed through ordinary surfaces.
+export const agentExecutionBindingSchema = z.object({
+  schemaVersion: z.number(),
+  contractVersion: harnessContractVersionSchema,
+  backend: z.enum(['harness-wrapper', 'runtime-pool', 'external-endpoint']),
+  bindingDigest: z.string(),
+  task: z.object({
+    namespaceUID: z.string(),
+    uid: z.string(),
+    boundSpecGeneration: z.number(),
+  }),
+  agent: z.object({
+    namespace: z.string(),
+    name: z.string(),
+    uid: z.string(),
+    generation: z.number(),
+  }).optional(),
+  snapshot: z.object({
+    id: z.string(),
+    digest: z.string(),
+    schemaVersion: z.number(),
+  }),
+  runtimeType: z.string().optional(),
+  runtimeRef: z.object({
+    name: z.string(),
+    uid: z.string(),
+    generation: z.number(),
+  }).optional(),
+  runtimeProfileDigest: z.string().optional(),
+  runtimeProfileDigestSchemaVersion: z.number().optional(),
+  boundAt: z.string(),
 })
 
 export const taskStatusSchema = z.object({
@@ -137,6 +328,10 @@ export const taskStatusSchema = z.object({
   iteration: z.number().optional(),
   jobName: z.string().optional(),
   resultRef: resultRefSchema.optional(),
+  execution: taskExecutionStatusSchema.optional(),
+  delivery: taskDeliveryStatusSchema.optional(),
+  harnessRuntime: harnessRuntimeStatusSchema.optional(),
+  agentExecutionBinding: agentExecutionBindingSchema.optional(),
   webhookDelivered: z.boolean().optional(),
   message: z.string().optional(),
   childTasks: z.array(childTaskStatusSchema).optional(),
@@ -166,7 +361,14 @@ export type TaskSpec = z.infer<typeof taskSpecSchema>
 export type TaskStatus = z.infer<typeof taskStatusSchema>
 export type TaskType = z.infer<typeof taskTypeSchema>
 export type TaskPhase = z.infer<typeof taskPhaseSchema>
+export type WorkspaceIntent = z.infer<typeof workspaceIntentSchema>
+export type WorkspaceConfig = z.infer<typeof workspaceConfigSchema>
+export type TaskExecutionStatus = z.infer<typeof taskExecutionStatusSchema>
+export type TaskDeliveryStatus = z.infer<typeof taskDeliveryStatusSchema>
 export type ExecutionWorkspaceStatus = z.infer<typeof executionWorkspaceStatusSchema>
+export type HarnessContractVersion = z.infer<typeof harnessContractVersionSchema>
+export type HarnessRuntimeStatus = z.infer<typeof harnessRuntimeStatusSchema>
+export type AgentExecutionBinding = z.infer<typeof agentExecutionBindingSchema>
 
 export const planStateSchema = z.object({
   summary: z.string().optional(),
diff --git a/website/docs/concepts/agent-runtimes.md b/website/docs/concepts/agent-runtimes.md
index c0507cdd4..cc114e2c9 100644
--- a/website/docs/concepts/agent-runtimes.md
+++ b/website/docs/concepts/agent-runtimes.md
@@ -4,682 +4,357 @@ slug: /agent-runtimes
 
 # Agent Runtimes
 
-Agent runtimes cover two paths: built-in CLI runtimes such as Codex CLI, Claude Code CLI, GitHub Copilot CLI, and OpenCode CLI, and bring-your-own remote execution backends selected through `AgentRuntime` and `spec.runtime.runtimeRef`. Built-in CLI runtimes give tasks autonomous coding capabilities (file read/write/edit, bash execution, git operations), while `AgentRuntime` lets teams run workloads on a generic HTTP runtime, AgentKit Serve, Foundry, or another adapter. Orka keeps scheduling, lifecycle, sessions, approvals, tool governance, idempotency, events, lineage, and result storage.
-
-## Supported built-in CLI runtimes
-
-| Runtime | `runtime.type` | Secret Key | Status |
-|---------|---------------|------------|--------|
-| Codex CLI | `codex` | `OPENAI_API_KEY` or `CODEX_API_KEY` | GA |
-| Claude Code CLI | `claude` | `ANTHROPIC_API_KEY` (direct) or `ANTHROPIC_FOUNDRY_API_KEY` (Azure AI Foundry) | GA |
-| GitHub Copilot CLI | `copilot` | `GITHUB_TOKEN` | Technical Preview |
-| OpenCode CLI | `opencode` | `OPENAI_BASE_URL`; optional `OPENAI_API_KEY` | Technical Preview |
-
-## Live Coverage
-
-PR-blocking live CI currently exercises these runtime scenarios against real model families:
-
-- `codex` + GPT with a pinned git workspace and `priorTaskRef`
-- `claude` + Claude with `sessionRef`
-- `copilot` + Gemini with a pinned public repo checkout
+`type: agent` Tasks use the ACP core runtime and the `orka.harness.v2` session protocol. Built-in Codex, Claude, Copilot, and OpenCode profiles run in controller-owned `RuntimePool` resources; there is no per-Task agent Job and no fallback runtime path.
+
+Orka owns the durable Task attempt, RuntimeSession identity, queueing, workspace validation, delivery receipt, transcript, and result projection. The runtime Pod owns only the short-lived provider process and ACP session for a fenced RuntimeSession.
+
+The supported built-in set is intentionally closed: `codex`, `claude`,
+`copilot`, and `opencode`. Operators can register and conformance-test an
+external `orka.harness.v2` `AgentRuntime`, but Task dispatch through
+`runtimeRef` remains fail-closed until the external v2 dispatcher support
+boundary is enabled.
+
+## Supported runtime profiles
+
+| Runtime | `Agent.spec.runtime.type` | Packaging status |
+| --- | --- | --- |
+| Codex | `codex` | Immutable Codex ACP image definition is included. Configure a digest-pinned image. |
+| Claude | `claude` | Immutable Claude ACP image definition is included. Configure a digest-pinned image. |
+| Copilot | `copilot` | Immutable Copilot ACP image definition is included. Configure a digest-pinned image. |
+| OpenCode | `opencode` | Immutable OpenCode ACP image definition is included. Configure a digest-pinned image. |
+
+External runtimes use an `AgentRuntime` registration with `contractVersion: orka.harness.v2`. Current-generation conformance proves the exact instance, profile, cancellation, duplicate, and workspace-governance claims, but readiness does not yet enable `runtimeRef` Task dispatch. See [Bring your own AgentRuntime](../guides/bring-your-own-agent-runtime.md) and the [adapter contract](../development/agent-runtime-adapter-contract.md).
+
+## Architecture
+
+```text
+Task (type: agent)
+  -> durable ACP attempt and queue reservation
+  -> central authenticated provider proxy -> Vekil/model backend
+  -> controller-owned RuntimePool for one trust domain/profile
+     -> one exact runtime Pod (0 or 1 replica)
+        -> RuntimeSession A: private HOME/workspace/UID + provider process
+        -> RuntimeSession B: private HOME/workspace/UID + provider process
+        -> per-session loopback MCP proxy -> controller prompt broker
+  -> workspace delta validation
+  -> artifact + credential brokers -> separate Workspace/Publisher identity
+  -> clean-room clone, prepare, push, verify, and optional PR reconciliation
+  -> durable execution and delivery status projected onto the Task
+```
 
-This coverage is about Orka's runtime wiring and task/session/workspace behavior. The live backend used in CI is harness infrastructure, not the main product under test.
+A shared runtime Pod is a same-trust-domain density optimization, not a tenant isolation boundary. Different namespaces/profile digests are assigned different logical pools.
 
-OpenCode uses a custom OpenAI-compatible provider, so it can target chat-completions endpoints such as vLLM, Ray Serve, or Ollama. Set `OPENAI_BASE_URL` to the endpoint base, optionally including a trailing `/chat/completions`. Set `OPENAI_API_KEY` when the endpoint requires authentication; it may be omitted for unauthenticated local endpoints. The adapter strips the trailing chat-completions path before configuring OpenCode.
+## RuntimePools
 
-OpenCode CLI session continuation is not wired initially. Each Orka turn starts a new OpenCode CLI session, while Orka still retains its own task, result, and lineage records. Read-only scheduled agent tasks do not support OpenCode initially because non-interactive OpenCode runs pre-approve file edits.
+RuntimePools are controller-owned implementation resources. Do not hand-author them for normal built-in Tasks. The controller derives a pool from the Task namespace, runtime type, model, immutable adapter/image digests, tool and approval policy, workspace intent, proxy credential scope, and resource class.
 
-## Bring-your-own AgentRuntime
+The first-release defaults are:
 
-`AgentRuntime` is the Orka-facing interface for remote execution backends. The backend can be a generic self-hosted HTTP runtime, AgentKit Serve, the separately maintained Microsoft Foundry Hosted Agents Responses adapter [`orka-agents/agent-runtime-foundry`](https://github.com/orka-agents/agent-runtime-foundry), or a future adapter. Provider-specific adapter implementations live outside the Orka source tree; Orka keeps task lifecycle, approvals, tool governance, idempotency, events, lineage, and results.
+- one active Pod per pool;
+- up to 10 resident RuntimeSessions;
+- up to 4 concurrently running prompts;
+- scale from zero on durable demand;
+- admit new sessions only while lifecycle is `Serving` and admission is `Accepting`;
+- drain to `Quiescent` before scale-down or replacement.
 
-Remote backends must not receive production Orka Tool credentials. In brokered mode, they request tool calls and Orka authorizes, approves, executes or brokers, injects idempotency, and audits them.
+Pool lifecycle is:
 
-```yaml
-apiVersion: core.orka.ai/v1alpha1
-kind: AgentRuntime
-metadata:
-  name: sample-http-runtime
-spec:
-  contractVersion: orka.harness.v1
-  deployment:
-    mode: external-endpoint
-    endpoint: http://sample-http-runtime.default.svc.cluster.local:8080
-  clientAuth:
-    bearerTokenSecretRef:
-      name: sample-http-runtime-token
-      key: token
-  capabilities:
-    toolExecutionModes:
-      - observed
-    supportsCancel: true
-    supportsRuntimeSessions: true
----
-apiVersion: core.orka.ai/v1alpha1
-kind: Agent
-metadata:
-  name: remote-agent
-spec:
-  runtime:
-    runtimeRef:
-      name: sample-http-runtime
+```text
+Stopped -> Starting -> Serving
+Serving -> Draining -> Quiescent -> Stopping -> Stopped
 ```
 
-## Quick Start
+`Degraded` and `Ambiguous` close admission. Every mutating request is fenced by the controller epoch, pool UID/generation, exact runtime instance and supervisor boot ID, RuntimeSession UID/generation, operation ID, request digest, and expiry.
+
+Capacity reservations live in `RuntimePool.status` and use Kubernetes
+`resourceVersion` compare-and-swap. The dispatcher claims a resident/prompt slot
+before changing an attempt to `Reserved`, renews or converts it as work moves
+through the session lifecycle, and reclaims expired reservations after restart.
 
-### 1. Create a Secret
+Inspect pools with:
 
 ```bash
-# For Codex CLI
-kubectl create secret generic codex-api-key \
-  --from-literal=OPENAI_API_KEY=<openai-api-key>
+orka runtime-pool list
+orka runtime-pool get <pool-name> -o yaml
+kubectl get runtimepools
+```
 
-# For Claude Code CLI
-kubectl create secret generic claude-api-key \
-  --from-literal=ANTHROPIC_API_KEY=<anthropic-api-key>
+## ACP v2 Task lifecycle
 
-# For GitHub Copilot CLI
-kubectl create secret generic copilot-token \
-  --from-literal=GITHUB_TOKEN=<github-token>
+The durable Task execution state is independent from the top-level compatibility phase:
 
-kubectl create secret generic opencode-credentials \
-  --from-literal=OPENAI_BASE_URL=http://models.example/v1
-# Add --from-literal=OPENAI_API_KEY=<endpoint-api-key> when authentication is required.
+```text
+Queued -> Reserved -> SessionStarting -> Planned -> Submitting
+       -> Accepted -> Running -> Settling
+       -> Succeeded | Failed | Cancelled | OutcomeUnknown
 ```
 
-### Azure AI Foundry for Claude Code CLI
+`SubmittedUnknown` records a loss in the submit acknowledgement window. `OutcomeUnknown` is terminal for that attempt and must not be treated as a generic retryable failure.
 
-Claude Code CLI supports Azure AI Foundry as an alternative to direct Anthropic API access. This is the Claude Code CLI credential path and is separate from the external [`agent-runtime-foundry`](https://github.com/orka-agents/agent-runtime-foundry) adapter, which invokes a deployed Microsoft Foundry Hosted Agent through the Responses API behind `AgentRuntime`. To use Azure AI Foundry with Claude Code CLI, include the Foundry-specific environment variables in the secret:
+Within the pool, a RuntimeSession moves through:
 
-```bash
-kubectl create secret generic claude-credentials \
-  --from-literal=CLAUDE_CODE_USE_FOUNDRY=1 \
-  --from-literal=ANTHROPIC_FOUNDRY_API_KEY=your-key \
-  --from-literal=ANTHROPIC_FOUNDRY_RESOURCE=your-resource-name \
-  --from-literal=ANTHROPIC_DEFAULT_SONNET_MODEL=claude-sonnet-4-5
+```text
+creating -> idle -> prompt_running -> validating
+         -> finalizing -> idle
 ```
 
-| Variable | Required | Description |
-|----------|----------|-------------|
-| `CLAUDE_CODE_USE_FOUNDRY` | Yes | Set to `1` to enable Azure AI Foundry |
-| `ANTHROPIC_FOUNDRY_API_KEY` | Yes | Azure AI Foundry API key |
-| `ANTHROPIC_FOUNDRY_RESOURCE` | Yes | Azure AI Foundry resource name |
-| `ANTHROPIC_DEFAULT_SONNET_MODEL` | Yes | Deployment name (e.g. `claude-sonnet-4-5`) |
-| `ANTHROPIC_DEFAULT_HAIKU_MODEL` | No | Optional Haiku deployment name |
-| `ANTHROPIC_DEFAULT_OPUS_MODEL` | No | Optional Opus deployment name |
-
-All secret keys are injected as environment variables into the harness wrapper pod via `envFrom`, so any Claude Code CLI environment variable can be passed through the secret.
+A write Task with changes additionally uses:
 
-### 2. Create an Agent
-
-```yaml
-apiVersion: core.orka.ai/v1alpha1
-kind: Agent
-metadata:
-  name: claude-agent
-spec:
-  model:
-    name: "claude-sonnet-4-20250514"
-  systemPrompt:
-    inline: "You are a helpful coding assistant."
-  secretRef:
-    name: claude-api-key
-  execution:
-    runtimeClassName: gvisor
-    nodeSelector:
-      sandbox-runtime: gvisor
-  runtime:
-    type: claude
-    defaultMaxTurns: 50
-    defaultAllowBash: true
-    defaultAllowedTools:
-      - Read
-      - Write
-      - Edit
-      - Bash
-      - Glob
-      - Grep
+```text
+validating -> preparing_publication -> publication_prepared
+           -> publishing -> verifying -> finalizing
 ```
 
-### 3. Create a Task
+Cancellation moves an active session through `cancelling`. A session that cannot prove process cleanup, workspace integrity, or publication safety becomes `poisoned` and is deleted; the pool may be recycled.
 
-```yaml
-apiVersion: core.orka.ai/v1alpha1
-kind: Task
-metadata:
-  name: refactor-task
-spec:
-  type: agent
-  agentRef:
-    name: claude-agent
-  prompt: "Refactor the main.go file to use structured logging"
-  timeout: "30m"
-```
+Only an `idle` RuntimeSession can accept a prompt or be evicted. Validation, publication, finalization, and Session lease release complete before terminal Task status is exposed.
 
-### 4. Get the Result
+## Durable control authority
 
-```bash
-kubectl get task refactor-task
-# Get the result via the REST API
-curl http://localhost:8080/api/v1/tasks/refactor-task/result \
-  -H "Authorization: Bearer <service-account-token>"
-```
+ACP control decisions are Kubernetes-authoritative:
 
-## Agent Configuration
+- `ControllerEpoch`, `PromptAttempt`, `RuntimeSessionControl`, `BranchClaim`,
+  `Publication`, and `ExternalEffect` status transitions use
+  `resourceVersion` compare-and-swap;
+- coordination Leases serialize controller-epoch mutation and one logical
+  Session mutation at a time;
+- `RuntimePool.status` owns exact-instance lifecycle, demand, capacity, and
+  reservation state.
 
-An Agent resource with a `runtime` field defines either a built-in CLI runtime with `runtime.type` or a namespace-local `AgentRuntime` facade with `runtime.runtimeRef` for `type: agent` tasks. The `runtime` field is mutually exclusive with `providerRef` (which is for `type: ai` tasks).
+SQLite is not a second ACP control authority. It persists transcript and
+SessionTurn payloads, deferred outbox projections, and artifacts
+behind the Kubernetes fences. Cross-store finalization binds the exact outbox
+projection before releasing the Session lease.
 
-### Full Reference
+## Create an Agent
+
+Provider credentials are separate from Git credentials. Built-in ACP Agents do
+not set `secretRef`: the controller scopes each RuntimePool to the central
+authenticated provider proxy, which injects the upstream Vekil/model credential
+outside the ACP child process.
 
 ```yaml
 apiVersion: core.orka.ai/v1alpha1
 kind: Agent
 metadata:
-  name: my-agent
+  name: codex-reviewer
 spec:
-  # runtime marks this Agent for type: agent tasks
   runtime:
-    # type: which built-in CLI runtime to use (set exactly one of type or runtimeRef)
-    # Valid values: "copilot", "claude", "codex", "opencode"
-    type: claude
-    # runtimeRef selects a namespace-local AgentRuntime facade instead of a built-in CLI runtime.
-    # runtimeRef:
-    #   name: sample-http-runtime
-
-    # defaultMaxTurns: default max agent loop iterations per task
-    # Range: 1-1000, Default: 50
-    defaultMaxTurns: 50
-
-    # defaultAllowedTools: tools available by default
-    # Claude tools: Read, Write, Edit, Bash, Glob, Grep, WebFetch, WebSearch
+    type: codex
+    defaultMaxTurns: 20
+    defaultAllowBash: true
     defaultAllowedTools:
       - Read
       - Glob
       - Grep
-
-    # defaultAllowBash: allow bash commands by default
-    # Default: true
-    defaultAllowBash: true
-
-  # secretRef: Secret containing API credentials
-  # Codex runtime expects: OPENAI_API_KEY or CODEX_API_KEY
-  # Claude runtime expects: ANTHROPIC_API_KEY
-  # Copilot runtime expects: GITHUB_TOKEN
-  # OpenCode runtime expects: OPENAI_BASE_URL; OPENAI_API_KEY is optional
-  secretRef:
-    name: claude-api-key
-
-  # execution: default runtime and placement settings for harness wrapper pods
-  execution:
-    runtimeClassName: gvisor
-    nodeSelector:
-      sandbox-runtime: gvisor
-    tolerations:
-      - key: sandbox-runtime
-        operator: Equal
-        value: gvisor
-        effect: NoSchedule
-
-  # systemPrompt: injected via --system-prompt flag
-  systemPrompt:
-    inline: "You are a coding assistant."
-    # Or reference a ConfigMap:
-    # configMapRef:
-    #   name: my-prompt-configmap
-    #   key: prompt.txt
-
-  # model: LLM model configuration (passed as --model flag)
   model:
-    name: "claude-sonnet-4-20250514"
-
-  # resources: compute resources for harness wrapper pods
-  resources:
-    requests:
-      memory: "256Mi"
-      cpu: "100m"
-    limits:
-      memory: "512Mi"
+    name: gpt-5.4
 ```
 
-## Task Configuration
+OpenCode model IDs use provider/model form, for example `openai/gpt-5.4`.
+OpenCode selects `apply_patch` for GPT-family models and `edit`/`write` for
+others; Orka normalizes those aliases into one governed mutation capability, so
+allowing one exposes the group and disallowing one closes the group. For
+read-intent workspaces, Orka also disables Bash and OpenCode Grep because Grep
+cannot carry the secret-file exclusions applied to OpenCode Read; Read and Glob
+remain available when allowed by policy.
 
-Tasks with `type: agent` reference an Agent and can override its runtime defaults.
+Task-level `spec.agentRuntime` contains only runtime overrides such as `maxTurns`, `allowedTools`, `disallowedTools`, and `allowBash`. Repository configuration belongs at top-level `spec.workspace`.
 
-### Full Reference
+## Read-only workspace Task
+
+Agent Tasks default to `intent: read` when `workspace.intent` is omitted, but setting it explicitly makes review intent clear.
 
 ```yaml
 apiVersion: core.orka.ai/v1alpha1
 kind: Task
 metadata:
-  name: my-agent-task
+  name: review-repository
 spec:
-  # type: must be "agent" for CLI runtime tasks
   type: agent
-
-  # agentRef: references an Agent with runtime configured (required)
   agentRef:
-    name: claude-agent
-    # namespace: defaults to task namespace
-    # namespace: other-ns
-
-  # execution: task-level runtime/placement overrides
-  execution:
-    runtimeClassName: kata-qemu
-    nodeSelector:
-      sandbox-runtime: kata
-
-  # prompt: instruction sent to the agent CLI
-  prompt: "Fix the failing tests in api/"
-
-  # agentRuntime: task-level overrides (all optional)
+    name: codex-reviewer
+  prompt: Review the authentication package. Do not modify files.
+  workspace:
+    intent: read
+    gitRepo: https://github.com/example/project.git
+    ref: 0123456789abcdef0123456789abcdef01234567
+    readCredentialRef:
+      name: project-read
+    subPath: services/auth
   agentRuntime:
-    # workspace: git clone configuration
-    workspace:
-      gitRepo: "https://github.com/example/my-project.git"
-      branch: "main"
-      # ref: specific commit SHA or tag (mutually exclusive with branch)
-      # ref: "abc123"
-      # gitSecretRef: Secret with git credentials for private repos
-      # gitSecretRef:
-      #   name: git-credentials
-      # subPath: subdirectory within repo to use as workspace root
-      # subPath: "services/api"
-      # forkRepo: writable fork URL used as git remote for pushes
-      # forkRepo: "https://github.com/my-org/my-project.git"
-      # prBaseBranch: upstream branch to target when creating PRs
-      # prBaseBranch: "main"
-      # pushBranch: branch name to push changes to after task completion
-      # pushBranch: "feature/my-change"
-
-    # maxTurns: override Agent's defaultMaxTurns (range: 1-1000)
-    maxTurns: 100
-
-    # allowedTools: override Agent's defaultAllowedTools
-    allowedTools:
-      - Read
-      - Write
-      - Edit
-      - Bash
-      - Glob
-      - Grep
-
-    # disallowedTools: deny specific tools (takes precedence over allowedTools)
-    disallowedTools:
-      - WebFetch
-
-    # allowBash: override Agent's defaultAllowBash
+    maxTurns: 20
     allowBash: true
-
-  # timeout: max duration before the task is terminated
-  timeout: "30m"
-
-  # priority: queue ordering (0-1000, higher = more urgent, default: 500)
-  priority: 600
-
-  # sessionRef: conversation continuity
-  sessionRef:
-    name: my-session
-    create: true
-
-  # secretRef: override Agent's secretRef for this task
-  # secretRef:
-  #   name: different-api-key
+  timeout: 20m
 ```
 
-### Permission Resolution
-
-Task-level settings override Agent-level defaults. `disallowedTools` always takes precedence over `allowedTools`.
+The clean-room workspace boundary resolves `project-read` for one clone/read operation, verifies the source baseline, removes credentials, and stores a sanitized workspace artifact. The runtime downloads that artifact without SCM credentials or direct SCM publication access.
 
-```
-Agent.spec.runtime (defaults)
-  └─► Task.spec.agentRuntime (overrides)
-        └─► disallowedTools (always wins)
-```
+A read Task succeeds only after validation proves the final tree still matches the verified baseline. Unexpected changes are classified `ReadOnlyWorkspaceModified` and poison the RuntimeSession.
 
-### Runtime Isolation
+## Write and publication Task
 
-Agent harness wrapper pods can opt into stronger sandboxing through Kubernetes `RuntimeClass` using the shared `spec.execution` field on both Agents and Tasks.
+Source read, target read, target write, and forge API credentials are distinct
+roles, even when an operator deliberately backs multiple roles with the same
+Secret.
 
 ```yaml
 apiVersion: core.orka.ai/v1alpha1
 kind: Task
 metadata:
-  name: isolated-review
+  name: update-documentation
 spec:
   type: agent
   agentRef:
-    name: claude-agent
-  prompt: "Review the repo for security issues"
-  execution:
-    runtimeClassName: gvisor
-    nodeSelector:
-      sandbox-runtime: gvisor
-    tolerations:
-      - key: sandbox-runtime
-        operator: Equal
-        value: gvisor
-        effect: NoSchedule
-```
-
-- `Agent.spec.execution` sets defaults for all tasks using that Agent.
-- `Task.spec.execution` overrides the Agent and replaces `nodeSelector`, `tolerations`, and `affinity` when set.
-- `gvisor` is the recommended first isolation profile for Linux `kind` and other containerd-based development clusters.
-- `kata-qemu` uses the same API, but is best suited to `minikube` or production clusters with virtualization-capable nodes.
-- The controller itself can remain on the default runtime; only worker Jobs need the isolation runtime.
-
-### Durable Agent Sandbox Workspaces (Experimental)
-
-For durable or retained coding environments, agent Tasks can request `Task.spec.execution.workspace`. That request is separate from the git checkout settings in `Task.spec.agentRuntime.workspace` below. When the controller feature is enabled, Orka validates the request, passes the resolved sandbox settings to the harness wrapper turn, and the worker wrapper claims an upstream `agent-sandbox` workspace before running the configured agent runtime inside it. For `reusePolicy: session`, Orka derives a deterministic sandbox claim name so separate worker Jobs in the same namespaced session/template scope can reattach when the workspace is retained.
-
-See [Agent Sandbox Workspaces](agent-sandbox.md) for the supported fields, controller flags, Helm values, and current limitations.
-
-## Workspace Management
-
-Agent tasks can clone a git repository into the harness wrapper pod's `/workspace` directory.
-
-### Public Repositories
-
-```yaml
-agentRuntime:
-  workspace:
-    gitRepo: "https://github.com/example/public-repo.git"
-    branch: "main"
-```
-
-### Private Repositories
-
-Create a Secret with git credentials, then reference it:
-
-```bash
-kubectl create secret generic git-credentials \
-  --from-literal=username=oauth2 \
-  --from-literal=password=<github-token>
-```
-
-```yaml
-agentRuntime:
-  workspace:
-    gitRepo: "https://github.com/example/private-repo.git"
-    branch: "feature/fix-tests"
-    gitSecretRef:
-      name: git-credentials
-```
-
-> **Note**: For the Copilot runtime, `GITHUB_TOKEN` from the Agent's `secretRef` can authenticate both the CLI and git clone operations. For the Claude, Codex, and OpenCode runtimes, a separate `gitSecretRef` is usually needed because their API keys do not authenticate git operations.
-
-> **Codex caveat**: Ordinary Codex tasks require `defaultAllowBash: true` (or task-level `allowBash: true`). Controller-managed read-only tasks are the exception: Orka forces Codex's read-only Landlock sandbox, strips inherited environment state, and brokers model credentials through a short-lived loopback proxy.
-
-### SubPath
-
-Restrict the agent's workspace to a subdirectory of the cloned repository:
-
-```yaml
-agentRuntime:
-  workspace:
-    gitRepo: "https://github.com/example/monorepo.git"
-    subPath: "services/api"
-```
-
-### Specific Commit or Tag
-
-Use `ref` instead of `branch` to check out a specific commit SHA or tag:
-
-```yaml
-agentRuntime:
+    name: codex-reviewer
+  prompt: Update the authentication documentation and run its focused checks.
   workspace:
-    gitRepo: "https://github.com/example/repo.git"
-    ref: "v1.2.3"
-```
-
-### Push Changes to a Branch
-
-Use `pushBranch` to have the worker commit and push changes automatically at the end of the task.
-For fork-based workflows, also set `forkRepo` and `prBaseBranch`.
-
-```yaml
-agentRuntime:
-  workspace:
-    gitRepo: "https://github.com/upstream/repo.git"
-    forkRepo: "https://github.com/my-user/repo.git"
-    prBaseBranch: "main"
-    pushBranch: "feature/my-change"
+    intent: write
+    gitRepo: https://github.com/example/project.git
+    branch: main
+    readCredentialRef:
+      name: project-read
+    publicationGitRepo: https://github.com/example/project.git
+    publicationReadCredentialRef:
+      name: project-publication-read
+    publicationCredentialRef:
+      name: project-publish
+    forgeCredentialRef:
+      name: project-forge
+    pushBranch: orka/update-auth-docs
+    prBaseBranch: main
+    createPR: true
+  agentRuntime:
+    maxTurns: 40
+    allowBash: true
+  timeout: 40m
 ```
 
-## Session Continuity
-
-Sessions enable multi-turn conversations across tasks. Session data is stored in SQLite with a normalized schema.
-
-### How Sessions Work
-
-- Sessions store **user and assistant messages only** (the lowest common denominator across runtimes)
-- **Cross-runtime continuation is supported**: a `type: ai` session can be continued by a `type: agent` task and vice versa
-- Agent-specific metadata (token counts, message counts) is tracked in the session record
-- Full agent transcripts are logged to pod stdout but **not stored** in the session (keep sessions focused)
-- Sessions enforce **serial execution**: only one task can hold a session lock at a time
-- Session transcripts are delivered to harness wrapper pods via an **init container** that fetches from the controller's internal API
-
-### Using Sessions
+The ACP child may edit the materialized checkout, but its Git configuration, refs, hooks, filters, remotes, and history are never trusted for publication. After prompt settlement, the supervisor freezes the session process tree and produces a bounded, content-addressed workspace delta. The separate Workspace/Publisher then:
+
+1. creates a clean clone at the persisted baseline with the source-read credential;
+2. applies the validated delta;
+3. prepares a deterministic Orka-owned commit;
+4. records the exact tree, commit, and artifact digests;
+5. compare-and-swap publishes the exact commit with the target-write credential;
+6. independently verifies the remote ref with the target-read credential;
+7. reconciles a pull request with the forge-only credential when `createPR: true`.
+
+At reservation, Orka freezes the selected Secret UID/resourceVersion and key for
+each role. The credential broker releases a value only to the
+Workspace/Publisher for the exact active operation. No Git or forge credential
+enters the runtime Pod. Branch push is the minimum durable delivery;
+pull-request reconciliation is opt-in.
+
+Workspace deltas and prepared publication artifacts cross the controller API
+through short-lived artifact capabilities bound to the operation, method,
+path, digest, size, media type, identity, and expiry. The Publisher does not
+hold the artifact signing key.
+
+## Workspace fields
+
+| Field | Purpose |
+| --- | --- |
+| `intent` | `read` or `write`; defaults to `read` for agent Tasks and is immutable for an active attempt. |
+| `gitRepo` | Credential-free source repository URL. |
+| `sourceRepository` | Optional canonical provider repository identity. |
+| `branch` / `ref` | Source branch or exact ref/commit/tag. |
+| `readCredentialRef.name` | Secret used only by the clean-room clone/read boundary. |
+| `publicationGitRepo` | Credential-free repository URL that receives the publication branch. |
+| `publicationRepository` | Optional canonical publication repository identity. |
+| `publicationReadCredentialRef.name` | Target-read Secret used only for publication preflight and independent verification. |
+| `publicationCredentialRef.name` | Target-write Secret used only for the exact compare-and-swap push. |
+| `forgeCredentialRef.name` | Forge API Secret used only for pull-request reconciliation. Required when `createPR` is true. |
+| `subPath` | Repository subdirectory exposed as the workspace root. |
+| `pushBranch` | Publication branch. If omitted for a write Task, Orka derives a full-entropy Task- or Session-owned branch. |
+| `prBaseBranch` | Pull-request base branch when `createPR` is true. |
+| `createPR` | Explicitly request PR reconciliation after verified branch publication. |
+
+Do not embed credentials, query strings, or fragments in repository URLs.
+
+## Delivery status
+
+`status.delivery` is the authoritative non-secret receipt. Intermediate states include `Validating`, `Preparing`, `Prepared`, `Publishing`, and `Verifying`. Terminal outcomes include:
+
+- `ReadValidated` — read-only tree matches the verified baseline;
+- `NoChange` — a write Task produced no validated change;
+- `VerifiedExact` — the remote branch equals the prepared commit;
+- `DeliveredSuperseded` — the prepared commit is present and a verified descendant now leads the branch;
+- `ReadOnlyWorkspaceModified` — a read Task changed the workspace;
+- `CredentialBlocked` — a required credential could not be resolved or used;
+- `DeliveryConflict` — branch ownership or exact-ref reconciliation failed;
+- `PublicationOutcomeUnknown` — the remote could not be observed after bounded reconciliation;
+- `CancelledBeforePublish` — cancellation won before publication.
+
+Use `orka task status <name>` or inspect the Task YAML to see execution, RuntimePool, and delivery data.
+
+## Session continuity
+
+Use `spec.sessionRef` for canonical transcript continuity and serialized mutation of one logical session:
 
 ```yaml
-apiVersion: core.orka.ai/v1alpha1
-kind: Task
-metadata:
-  name: follow-up-task
 spec:
-  type: agent
-  agentRef:
-    name: claude-agent
-  prompt: "Now add error handling to the code you wrote"
   sessionRef:
-    name: my-session
-    create: true      # Create the session if it doesn't exist
-    append: true      # Append this task's messages to the transcript (default: true)
-    maxMessages: 50   # Max messages to load from history (default: 50)
+    name: repository-review-session
+  workspace:
+    intent: read
+    gitRepo: https://github.com/example/project.git
 ```
 
-### Session Storage
-
-Sessions are stored in the controller's SQLite database with a normalized schema:
-- **Session record**: metadata (name, namespace, type, active task, token counts, timestamps)
-- **Session messages**: individual transcript entries (role, content, timestamp)
-
-## Security
+A RuntimeSession is ephemeral. If its Pod is replaced, Orka may create a fresh provider session from the verified workspace baseline and canonical transcript. ACP v2 intentionally does not provide prompt replay, stream reconnect, provider-session load, or workspace checkpoint endpoints.
 
-All agent harness wrapper pods run with a hardened security context:
+## Runtime and credential boundaries
 
-| Setting | Value |
-|---------|-------|
-| Run as non-root | uid 1000 |
-| Read-only root filesystem | `true` |
-| Capabilities | All dropped |
-| Seccomp profile | RuntimeDefault |
-| Privilege escalation | Disabled |
+Built-in runtime Pods:
 
-If `spec.execution.runtimeClassName` is set, the harness wrapper pod is also routed through the selected Kubernetes `RuntimeClass` while keeping the same pod and container security defaults.
+- use a digest-pinned image and immutable runtime-profile digest;
+- have no Git read or publication credential;
+- have no direct SCM egress;
+- use a read-only root filesystem and no service-account token;
+- isolate resident sessions with private directories, distinct non-reused UIDs/GIDs, and process-tree cleanup;
+- expose only non-sensitive health/capability probes without authentication;
+- require controller authentication and operation-scoped authorization for status and mutations.
 
-Writable directories are provided via `emptyDir` volumes:
+Provider traffic goes only to the central authenticated provider proxy. The
+proxy accepts the controller-issued RuntimePool bearer, enforces the configured
+provider/model path, and forwards to Vekil. The `config/acp-production` overlay
+also applies the Vekil ingress policy so runtime Pods cannot bypass that proxy.
 
-| Mount | Purpose |
-|-------|---------|
-| `/tmp` | Temporary files |
-| `/home/worker` | CLI config and cache (`HOME`) |
-| `/workspace` | Git clone target and working directory |
+Each RuntimeSession receives a credential-protected loopback MCP endpoint. It
+lists the canonical prompt tool policy while idle, but executes calls only for
+the active Task/attempt/prompt/lease. The controller broker revalidates the
+exact runtime fences, tool allowlist, approval evidence, and lease expiry on
+every call. Consequential calls reserve an `ExternalEffect` identity before
+execution and replay only a committed matching response.
 
-### Tool Permissions
+The Workspace/Publisher has brokered SCM/forge credentials and artifact access,
+but no provider or prompt-scoped MCP access.
 
-| Tool | Default | Risk Level |
-|------|---------|------------|
-| Read | Allowed | Low |
-| Glob | Allowed | Low |
-| Grep | Allowed | Low |
-| WebSearch | Allowed | Low |
-| WebFetch | Allowed | Medium |
-| Write | Allowed | High |
-| Edit | Allowed | High |
-| Bash | Allowed | High |
+## Controller configuration
 
-All tools are allowed by default for autonomous operation. To restrict high-risk tools, set `defaultAllowBash: false` on the Agent or `allowBash: false` on individual Tasks.
+At minimum, enable ACP and configure immutable images:
 
-For ordinary Codex tasks, bash-disabled execution is not supported. Use `defaultAllowBash: true` unless the task is controller-managed read-only work, where Orka forces the hardened read-only sandbox and ignores broader shell policy.
-
-### Secrets
-
-API keys are injected as environment variables from Kubernetes Secrets. They are never logged or stored in Task specs.
-
-```bash
-# Claude runtime
-kubectl create secret generic claude-api-key \
-  --from-literal=ANTHROPIC_API_KEY=<anthropic-api-key>
-
-# Codex runtime
-kubectl create secret generic codex-api-key \
-  --from-literal=OPENAI_API_KEY=<openai-api-key>
-
-# Copilot runtime
-kubectl create secret generic copilot-token \
-  --from-literal=GITHUB_TOKEN=<github-token>
-
-kubectl create secret generic opencode-credentials \
-  --from-literal=OPENAI_BASE_URL=http://models.example/v1
-# Add --from-literal=OPENAI_API_KEY=<endpoint-api-key> when authentication is required.
+```text
+--acp-runtime-enabled=true
+--acp-runtime-namespace=orka-runtimes
+--acp-provider-proxy-namespace=vekil-system
+--acp-provider-proxy-base-url=http://provider-auth-proxy.orka-system.svc:8080
+--acp-codex-runtime-image=<repository>@sha256:<digest>
+--acp-claude-runtime-image=<repository>@sha256:<digest>
+--acp-copilot-runtime-image=<repository>@sha256:<digest>
+--acp-opencode-runtime-image=<repository>@sha256:<digest>
 ```
 
-## Controller Configuration
-
-Agent Tasks run exclusively through the CLI harness wrapper. The controller needs:
-
-- `ORKA_HARNESS_WRAPPER_ENDPOINT`, pointing at the wrapper HTTP endpoint.
-- `ORKA_HARNESS_WRAPPER_BEARER_TOKEN_FILE` or `ORKA_HARNESS_WRAPPER_BEARER_TOKEN` when the wrapper requires bearer auth.
-
-The default kustomize deployment includes an `agent-harness-wrapper` Deployment and Service. Per-runtime agent-worker image flags are not supported.
-
-## Optimizing Agent Performance
-
-Research on LLM agent context ([arxiv 2602.11988](https://arxiv.org/abs/2602.11988)) shows that verbose instructions increase token costs without proportional quality gains. Apply these guidelines to Agent and Task configuration:
-
-- **Minimal tool allowlists**: Only grant tools the task actually needs. A read-only analysis task should use `allowedTools: [Read, Glob, Grep]` — don't include `Write`, `Edit`, or `Bash` if the task doesn't require them. Fewer tools means less prompt overhead and a smaller attack surface.
-- **Appropriate `maxTurns`**: Set lower values (10–30) for focused tasks like single-file edits, and higher values (50–100+) for complex multi-file refactors. Overly generous limits waste compute on unnecessary iterations if the agent gets stuck.
-- **Concise system prompts**: Include only tooling commands, hard requirements, and non-discoverable gotchas. Codebase overviews and redundant documentation increase reasoning tokens by 14–22% without improving outcomes. See [Context Engineering Best Practices](configuration.md#context-engineering-best-practices) for detailed guidance.
-
-## Examples
-
-Complete sample manifests are available in [`config/samples/`](https://github.com/orka-agents/orka/tree/main/config/samples):
-
-| File | Description |
-|------|-------------|
-| `core_v1alpha1_agent_codex.yaml` | Agent configured for Codex CLI |
-| `core_v1alpha1_agent_claude.yaml` | Agent configured for Claude Code CLI |
-| `core_v1alpha1_agent_opencode.yaml` | Agent configured for OpenCode CLI and an OpenAI-compatible endpoint |
-| `core_v1alpha1_task_agent.yaml` | Basic agent task with workspace |
-| `core_v1alpha1_task_agent_copilot.yaml` | Agent task using Copilot runtime |
-| `core_v1alpha1_task_agent_workspace.yaml` | Agent task with full workspace configuration |
-
-### Complete Example Flow
-
-```bash
-# 1. Create the API key secret
-kubectl create secret generic claude-api-key \
-  --from-literal=ANTHROPIC_API_KEY=<anthropic-api-key>
-
-# 2. Create the Agent
-kubectl apply -f - <<EOF
-apiVersion: core.orka.ai/v1alpha1
-kind: Agent
-metadata:
-  name: claude-agent
-spec:
-  model:
-    name: "claude-sonnet-4-20250514"
-  systemPrompt:
-    inline: "You are a senior software engineer."
-  secretRef:
-    name: claude-api-key
-  runtime:
-    type: claude
-    defaultMaxTurns: 50
-    defaultAllowBash: true
-    defaultAllowedTools:
-      - Read
-      - Write
-      - Edit
-      - Bash
-      - Glob
-      - Grep
-EOF
-
-# 3. Create a Task that clones a repo and works on it
-kubectl apply -f - <<EOF
-apiVersion: core.orka.ai/v1alpha1
-kind: Task
-metadata:
-  name: fix-tests
-spec:
-  type: agent
-  agentRef:
-    name: claude-agent
-  prompt: "Fix the failing CI tests in the api/ directory"
-  agentRuntime:
-    workspace:
-      gitRepo: "https://github.com/example/my-project.git"
-      branch: "main"
-    maxTurns: 100
-  timeout: "30m"
-  priority: 600
-EOF
-
-# 4. Watch the task progress
-kubectl get task fix-tests -w
-
-# 5. Get the result
-curl http://localhost:8080/api/v1/tasks/fix-tests/result \
-  -H "Authorization: Bearer <service-account-token>"
-
-# 6. Check harness wrapper pod logs for full transcript
-kubectl logs -l job-name=$(kubectl get task fix-tests -o jsonpath='{.status.jobName}')
-```
+Mutable image tags are rejected for built-in pools. For Kustomize deployment,
+apply `config/acp-production`; `config/default` alone omits the required
+cross-namespace Vekil ingress boundary.
 
 ## Troubleshooting
 
-### Task stuck in Pending
-
-- **Missing Secret**: Verify the Secret exists and contains the expected key (`ANTHROPIC_API_KEY` or `GITHUB_TOKEN`).
-  ```bash
-  kubectl get secret claude-api-key -o jsonpath='{.data}' | keys
-  ```
-- **Session locked**: Another task may hold the session lock. Check via the REST API:
-  ```bash
-  curl http://localhost:8080/api/v1/sessions/<name> \
-    -H "Authorization: Bearer <service-account-token>"
-  ```
-- **Agent not found**: Verify the Agent exists and has `runtime` configured:
-  ```bash
-  kubectl get agent claude-agent -o yaml
-  ```
-
-### Task fails immediately
-
-- **Type mismatch**: `type: agent` tasks require an Agent with `runtime` configured. `type: ai` tasks cannot use Agents with `runtime`.
-- **Invalid runtime type**: `runtime.type` must be `copilot`, `claude`, `codex`, or `opencode`; for remote execution backends, use `runtime.runtimeRef` pointing at a Ready namespace-local `AgentRuntime`.
-- **Worker image not available**: Check that the harness wrapper image is accessible from your cluster:
-  ```bash
-  kubectl describe pod -l orka.ai/worker-type=agent
-  ```
-
-### Result too large
-
-Task results are stored in SQLite, which has no practical size limit. If the agent produces a very large output:
-
-- The final text result is stored; full transcripts are logged to pod stdout only
-- Check pod logs for the complete output:
-  ```bash
-  kubectl logs <pod-name>
-  ```
-
-### Pod in CrashLoopBackOff
-
-- Check pod logs for CLI errors:
-  ```bash
-  kubectl logs <pod-name> --previous
-  ```
-- Verify the API key is valid and has sufficient permissions
-- Ensure the harness wrapper image includes the expected CLI binary
+- **Task fails before queueing**: verify the Agent has `runtime.type: codex`, `claude`, `copilot`, or `opencode`, ACP is enabled, and the matching digest-pinned built-in image is configured. `runtimeRef` Task dispatch is intentionally rejected at the current support boundary.
+- **Task remains queued**: inspect the selected RuntimePool lifecycle/admission/capacity and the runtime Pod scheduling conditions.
+- **Task reports `OutcomeUnknown`**: do not retry the same attempt automatically. Inspect the recorded attempt, controller epoch, runtime instance, and event timeline.
+- **Read Task fails validation**: inspect `status.delivery` for `ReadOnlyWorkspaceModified` and treat the session as poisoned.
+- **Write Task is blocked**: verify all required source-read, target-read, target-write, and forge credential references, the publication repository/branch, and the Workspace/Publisher broker configuration. Require a terminal verified delivery receipt before claiming success.
+- **`runtimeRef` Task is rejected**: this is the expected fail-closed behavior until the external v2 dispatcher support boundary is enabled. Registration readiness and conformance do not currently admit Task execution.
+- **`spec.execution.workspace` Task is rejected**: execution-workspace providers are not connected to the ACP core runtime. Use top-level `spec.workspace`; see the deferred [Agent Sandbox](agent-sandbox.md) and [Substrate](substrate.md) pages.
diff --git a/website/docs/concepts/agent-sandbox.md b/website/docs/concepts/agent-sandbox.md
index 6207b7f7d..b20b8da53 100644
--- a/website/docs/concepts/agent-sandbox.md
+++ b/website/docs/concepts/agent-sandbox.md
@@ -4,214 +4,55 @@ slug: /agent-sandbox
 
 # Agent Sandbox Workspaces
 
-Agent sandbox workspace support is **experimental** and disabled by default. When enabled, a `type: agent` Task can request an upstream `agent-sandbox` workspace with `Task.spec.execution.workspace`. Orka still creates the normal Kubernetes worker Job, but the agent worker wrapper uses the resolved workspace settings to claim and wait for an `agent-sandbox` workspace, then runs the configured agent runtime inside that sandbox.
+Upstream `agent-sandbox` integration is a deferred execution-workspace provider for the ACP core runtime. It is not part of the current built-in ACP v2 Task path.
 
-Use this feature for durable, warm, or reusable coding environments backed by an existing upstream `agent-sandbox` installation. For one-shot pod isolation, continue to use Kubernetes `RuntimeClass` through `spec.execution.runtimeClassName`.
-
-For the broader design, rollout phases, and upstream references, see the agent sandbox integration plan in the project repository.
-
-## When to Use RuntimeClass vs Agent Sandbox
-
-| Need | Use |
-|------|-----|
-| One task runs once, produces a result, and cleans up | `spec.execution.runtimeClassName` on the Orka worker Job, if extra pod isolation is needed |
-| Stronger pod isolation with gVisor, Kata, or another runtime handler for the worker wrapper | `spec.execution.runtimeClassName` |
-| A checked-out repository, dependency cache, dev server, browser session, or notebook-like state should survive across turns | `Task.spec.execution.workspace` agent sandbox request |
-| Session-scoped warm or reusable coding environment | `Task.spec.execution.workspace` with `reusePolicy: session` |
-
-RuntimeClass and agent sandbox are complementary. `runtimeClassName` applies to the outer Kubernetes worker Job that starts the Orka worker wrapper. The upstream sandbox template and runtime determine the inner execution environment where the agent CLI runs after the wrapper claims a sandbox workspace.
-
-## Current Status and Limitations
-
-- The feature is disabled by default.
-- When enabled, the Task controller validates `Task.spec.execution.workspace` requests for `type: agent` Tasks, resolves/defaults the effective `SandboxWarmPool` and workspace settings, and passes those settings to the agent worker Job.
-- The agent worker wrapper claims an upstream `agent-sandbox` workspace, waits for it to become ready, and re-executes the same worker binary inside the sandbox with recursive sandboxing disabled.
-- Orka uses the upstream `sigs.k8s.io/agent-sandbox` Go SDK. With the currently pinned SDK, the worker creates or reattaches claims through a named `SandboxWarmPool`; Orka's existing `templateRef.name` setting is used as that warm pool name for compatibility.
-- `namespaceStrategy: task` defaults claims to the Task namespace when `templateRef.namespace` is omitted. `namespaceStrategy: controller` defaults claims to the controller namespace when it is discoverable, while an explicit `templateRef.namespace` still wins.
-- `cleanupPolicy: delete` deletes the workspace after execution. `cleanupPolicy: retain` disconnects from the sandbox and leaves the upstream claim/resource for operator inspection or external reattach.
-- `reusePolicy: session` derives a deterministic claim name from the namespaced session/warm-pool inputs, allowing later worker Jobs to reattach when the prior workspace was retained.
-- The SDK command API accepts one shell command string. Orka renders argv/workdir into that string and passes environment variables through a temporary sandbox env file that is sourced and removed before the command runs; stdin is not supported. Upstream command responses are capped by the SDK, and Orka applies its own configured output truncation where requested.
-- The SDK file write API accepts plain filenames only. Orka's adapter rejects nested upload paths instead of flattening them; recursive download/list is supported for files visible through the SDK.
-- Orka does not install or manage upstream `agent-sandbox` CRDs, router services, templates, or warm pools. Install and operate those components separately before enabling workspace-backed Tasks.
-- Task status does not report sandbox claim, reuse, command, or cleanup state. Inspect worker logs and upstream `agent-sandbox` resources for sandbox lifecycle details.
-- `Agent.spec.execution.workspace` is not an effective defaulting mechanism today; use `Task.spec.execution.workspace` for workspace-backed execution.
-
-## Execution Flow
-
-1. The Task controller validates the workspace request and resolves/defaults the effective `SandboxWarmPool` and workspace settings, including warm pool name/namespace, reuse policy, cleanup policy, claim timeout, and command timeout.
-2. The controller still creates an ordinary Orka worker Job. Any `runtimeClassName`, node selector, tolerations, and affinity settings apply to this outer worker pod.
-3. For `type: agent` Tasks, the Job includes environment variables that describe the resolved sandbox workspace request.
-4. The worker wrapper sees those variables, claims an upstream `agent-sandbox` workspace, waits for it to become ready, and executes the same worker command inside that workspace.
-5. Before handoff, the wrapper stages the worker binary, a ServiceAccount token file, Git askpass helper when needed, and any mounted transaction/context-subject token files referenced by `ORKA_TRANSACTION_TOKEN_FILE` or `ORKA_CONTEXT_TOKEN_SUBJECT_TOKEN_FILE`. The inner worker environment is rewritten to sandbox-local `/app` paths for these token files.
-6. The inner worker run disables sandbox recursion and performs the normal agent lifecycle: load config, clone or prepare the repository workspace, run the configured agent runtime, submit results, and upload artifacts.
-7. After the inner command exits, the wrapper scrubs staged token files and applies `cleanupPolicy`: delete the workspace, or release/retain it.
-
-## Task Example
-
-Enable a durable workspace request on an agent Task:
+A `type: agent` Task that sets `Task.spec.execution.workspace` is currently rejected with a fail-closed validation error. Use top-level `Task.spec.workspace` for the source repository, workspace intent, and clean-room publication policy:
 
 ```yaml
-apiVersion: core.orka.ai/v1alpha1
-kind: Task
-metadata:
-  name: coding-agent-task
 spec:
   type: agent
-  agentRef:
-    name: claude-agent
-  prompt: "Continue implementing the feature in this session."
-  sessionRef:
-    name: feature-123
-    create: true
-  execution:
-    runtimeClassName: gvisor
-    workspace:
-      enabled: true
-      templateRef:
-        name: coding-agent
-      reusePolicy: session
-      cleanupPolicy: retain
+  workspace:
+    intent: read
+    gitRepo: https://github.com/example/project.git
+    readCredentialRef:
+      name: project-read
 ```
 
-Notes:
+`spec.workspace` does not request a durable sandbox. It describes the verified source and publication boundary for the ephemeral RuntimeSession workspace.
 
-- `runtimeClassName` applies to the outer Orka worker Job; the sandbox template/runtime controls the inner sandbox environment.
-- `workspace.enabled: true` requests workspace-backed execution for this agent Task.
-- `reusePolicy: session` requires `spec.sessionRef.name` because the session name is the reuse key.
-- `cleanupPolicy: retain` asks the worker wrapper to retain/release the claimed workspace after the Task instead of deleting it.
+## Current ACP v2 execution model
 
-## `spec.execution.workspace` Fields
+Built-in agent Tasks run in controller-owned RuntimePools:
 
-| Field | Type | Default | Description |
-|-------|------|---------|-------------|
-| `enabled` | boolean | `false` | Enables workspace-backed execution for this agent Task. When omitted or false, the normal worker path is used without sandbox env propagation. |
-| `templateRef.name` | string | Controller default template, if configured | Agent-sandbox `SandboxWarmPool` name to claim. Required when `enabled: true` unless the controller has `--agent-sandbox-default-template`. |
-| `templateRef.namespace` | string | Task namespace, or controller namespace with `namespaceStrategy: controller` | Namespace containing the `SandboxWarmPool` and claim. Explicit cross-namespace requests create/reattach the `SandboxClaim` in this namespace. |
-| `reusePolicy` | string | `none` | Workspace reuse intent. Supported values: `none`, `session`. Session reuse derives a deterministic claim name from the namespaced session/warm-pool inputs so later worker Jobs can reattach when the workspace is retained. |
-| `cleanupPolicy` | string | Controller default cleanup policy, defaulting to `delete` | Cleanup behavior after use. Supported values: `delete`, `retain`. |
-
-## Validation Rules
-
-The Task controller validates workspace requests before creating worker Jobs:
-
-- `--agent-sandbox-enabled=true` or `ORKA_AGENT_SANDBOX_ENABLED=true` is required.
-- Workspace requests are only supported for `type: agent` Tasks.
-- `templateRef.name` is required unless `--agent-sandbox-default-template` or `ORKA_AGENT_SANDBOX_DEFAULT_TEMPLATE` is configured, and the resolved `SandboxWarmPool` must exist.
-- `reusePolicy` must be one of `none` or `session` when set.
-- `cleanupPolicy` must be one of `delete` or `retain` when set.
-- `reusePolicy: session` requires `spec.sessionRef.name`.
-- Controller sandbox config must be valid: supported warm pool policy, supported namespace strategy, positive timeouts, and supported cleanup policy.
-
-## Controller Configuration
-
-Controller flags can be set directly, through environment variables, or through Helm values under `controller.agentSandbox`. The Helm chart emits the sandbox flags only when `controller.agentSandbox.enabled` is true.
-
-| Flag | Environment variable | Helm value | Default | Description |
-|------|----------------------|------------|---------|-------------|
-| `--agent-sandbox-enabled` | `ORKA_AGENT_SANDBOX_ENABLED` | `controller.agentSandbox.enabled` | `false` | Enable experimental agent sandbox workspace support for agent Tasks. |
-| `--agent-sandbox-router-url` | `ORKA_AGENT_SANDBOX_ROUTER_URL` | `controller.agentSandbox.routerUrl` | empty | Optional upstream agent-sandbox router base URL. |
-| `--agent-sandbox-default-template` | `ORKA_AGENT_SANDBOX_DEFAULT_TEMPLATE` | `controller.agentSandbox.defaultTemplate` | empty | Default `SandboxWarmPool` name used when a Task omits `templateRef.name`. |
-| `--agent-sandbox-warm-pool-policy` | `ORKA_AGENT_SANDBOX_WARM_POOL_POLICY` | `controller.agentSandbox.warmPoolPolicy` | `disabled` | Legacy compatibility setting retained in worker env. Supported values: `disabled` and `template`; v0.5 claims use `SandboxWarmPool` references. |
-| `--agent-sandbox-namespace-strategy` | `ORKA_AGENT_SANDBOX_NAMESPACE_STRATEGY` | `controller.agentSandbox.namespaceStrategy` | `task` | Namespace strategy for sandbox resources. Supported values: `task`, `controller`. |
-| `--agent-sandbox-claim-timeout` | `ORKA_AGENT_SANDBOX_CLAIM_TIMEOUT` | `controller.agentSandbox.claimTimeout` | `2m` | Timeout for workspace claim and readiness operations. |
-| `--agent-sandbox-command-timeout` | `ORKA_AGENT_SANDBOX_COMMAND_TIMEOUT` | `controller.agentSandbox.commandTimeout` | `30m` | Timeout for agent runtime execution inside the sandbox. |
-| `--agent-sandbox-cleanup-policy` | `ORKA_AGENT_SANDBOX_CLEANUP_POLICY` | `controller.agentSandbox.cleanupPolicy` | `delete` | Default cleanup policy when a Task omits `workspace.cleanupPolicy`. Supported values: `delete`, `retain`. |
-
-Example Helm configuration:
-
-```yaml
-controller:
-  agentSandbox:
-    enabled: true
-    routerUrl: "http://agent-sandbox-router.agent-sandbox-system.svc:8080"
-    defaultTemplate: coding-agent
-    warmPoolPolicy: template
-    namespaceStrategy: task
-    claimTimeout: 2m
-    commandTimeout: 30m
-    cleanupPolicy: retain
-```
-
-## Operational Guidance
-
-1. Install and operate the upstream `agent-sandbox` CRDs, router, templates, and any warm pools outside of Orka before enabling workspace-backed Tasks.
-2. Keep existing RuntimeClass configuration for the outer Orka worker Job when you need worker pod isolation guarantees.
-3. Use `Task.spec.execution.workspace` only on `type: agent` Tasks; non-agent Tasks are rejected.
-4. Use worker logs and upstream `agent-sandbox` resources to debug claim, readiness, execution, and cleanup because Orka Task status does not expose sandbox lifecycle state.
-5. Choose `cleanupPolicy: delete` for single-use workspaces and `cleanupPolicy: retain` when the upstream sandbox installation should keep/release the workspace for reuse.
-6. For custom manifests, make sure the worker ServiceAccount can create/delete/patch `sandboxclaims`, read `sandboxtemplates`, `sandboxwarmpools`, and `sandboxes`, create `pods/portforward`, and read `endpointslices`. The Helm chart and generated worker RBAC include these rules.
-7. The warm pool's sandbox template image must contain the agent CLI runtime used by the worker being re-executed, plus a shell, writable workspace/home directories, and network access to Orka API and the configured model/provider endpoint. Provider credentials are forwarded as command environment variables; do not log them.
-8. The outer worker stages its own binary and a ServiceAccount token file into the sandbox before execution. The inner worker runs with recursive sandboxing disabled and uses `ORKA_SA_TOKEN_PATH` to submit results and artifacts back to Orka.
-9. If transaction-token env vars point at mounted files in the outer worker, the wrapper copies trimmed token contents into sandbox-local `0600` files, rewrites `ORKA_TRANSACTION_TOKEN_FILE` and `ORKA_CONTEXT_TOKEN_SUBJECT_TOKEN_FILE` to those paths, deduplicates shared source paths, and removes the staged token files after execution or before retaining a workspace. Raw TxTokens are never written to Task spec/status/logs.
-
-## Live Smoke Test
-
-After enabling the controller feature and installing a usable `SandboxWarmPool`, validate the path with an actual agent Task rather than only checking manifests. This example assumes a namespace `orka-system`, an agent named `claude-agent`, and a warm pool named `orka-live-template`.
-
-```yaml
-apiVersion: core.orka.ai/v1alpha1
-kind: Task
-metadata:
-  name: orka-live-sandbox-smoke
-  namespace: orka-system
-spec:
-  type: agent
-  agentRef:
-    name: claude-agent
-  agentRuntime:
-    maxTurns: 1
-  timeout: 10m0s
-  execution:
-    workspace:
-      enabled: true
-      templateRef:
-        name: orka-live-template
-      reusePolicy: none
-      cleanupPolicy: delete
-  prompt: "Reply exactly: ORKA_LIVE_SANDBOX_OK"
+```text
+Task
+  -> RuntimePool
+  -> ephemeral RuntimeSession inside the exact runtime Pod
+  -> workspace validation
+  -> optional clean-room Workspace/Publisher transaction
 ```
 
-Run and verify:
-
-```bash
-kubectl apply -f smoke-task.yaml
-kubectl -n orka-system wait --for=jsonpath='{.status.phase}'=Succeeded task/orka-live-sandbox-smoke --timeout=10m
+The runtime Pod has no Git credential and no direct SCM publication egress. Source materialization and publication are separate Orka operations.
 
-JOB=$(kubectl -n orka-system get task orka-live-sandbox-smoke -o jsonpath='{.status.jobName}')
-POD=$(kubectl -n orka-system get pods -l job-name="$JOB" -o jsonpath='{.items[0].metadata.name}')
-kubectl -n orka-system logs "$POD"
-```
+## Deferred provider seam
 
-A successful sandbox wrapper log includes the claimed workspace name, for example:
+A future `agent-sandbox` integration must preserve the same `orka.harness.v2` lifecycle and governance boundaries. In particular, it must:
 
-```text
-Task orka-system/orka-live-sandbox-smoke completed in sandbox workspace sandbox-claim-abc12
-```
+- keep the Task attempt, RuntimeSession, prompt lease, fences, and publication records authoritative in Orka;
+- expose one RuntimeSession through the v2 session operations rather than creating an agent Job fallback;
+- materialize only verified workspace artifacts;
+- keep source-read, target-read, target-write, and forge credentials outside the ACP child process tree;
+- produce an Orka-owned workspace delta after prompt settlement;
+- block eviction while validation, publication, finalization, or Session lease work is active;
+- fail closed on ambiguous runtime loss instead of replaying an accepted prompt;
+- preserve exact process cleanup and credential-revocation guarantees across suspension/resume.
 
-Fetch the result through the API using an authenticated ServiceAccount token; do not print the token:
+Durable workspace resume, provider-session restore, prompt replay, stream reconnect, and transparent migration are not implied by ACP v2 and require separate reviewed designs.
 
-```bash
-kubectl -n orka-system port-forward svc/orka-api 18080:8080 >/tmp/orka-api-pf.log 2>&1 &
-PF_PID=$!
-TOKEN=$(kubectl -n orka-system create token orka-worker --duration=10m)
-curl -fsS -H "Authorization: Bearer ${TOKEN}" \
-  'http://127.0.0.1:18080/api/v1/tasks/orka-live-sandbox-smoke/result?namespace=orka-system'
-kill "$PF_PID"
-```
-
-Expected response:
-
-```json
-{"result":"ORKA_LIVE_SANDBOX_OK\n"}
-```
+## RuntimeClass
 
-For `cleanupPolicy: delete`, the claimed `SandboxClaim` and `Sandbox` should be gone after completion. Completed Orka worker Job/Pod resources may remain according to normal Job history limits.
+`Task.spec.execution.runtimeClassName`, per-Task placement, and custom Task resource requests are also not supported by the current built-in ACP path. Runtime isolation and resources are selected through reviewed RuntimePool profiles. Container and native `ai` Tasks keep their existing `spec.execution` behavior.
 
-## Troubleshooting
+## Local evaluation material
 
-- **Task rejected before Job creation**: check `--agent-sandbox-enabled=true`, `templateRef.name` or controller default template, `reusePolicy`, `cleanupPolicy`, and `sessionRef.name` for `reusePolicy: session`.
-- **Worker cannot claim or execute**: check the worker ServiceAccount RBAC for upstream sandbox resources and `pods/portforward`.
-- **Inner agent CLI reports connection refused**: exec into a retained sandbox or run a retained smoke test and verify DNS/TCP reachability to the configured provider base URL or proxy from inside the sandbox pod.
-- **Result submission fails from the inner worker**: verify that the outer worker can read its ServiceAccount token and that the staged `ORKA_SA_TOKEN_PATH` file is available inside the sandbox.
-- **Delegation or outbound TxToken exchange fails inside the sandbox**: verify that the outer worker has readable `ORKA_TRANSACTION_TOKEN_FILE` / `ORKA_CONTEXT_TOKEN_SUBJECT_TOKEN_FILE` mounts and that the sandbox wrapper logs do not show token staging or scrub failures.
-- **Controller rollout fails after manual image patching**: preserve the controller container's `/data` and `/tmp` volume mounts, probes, resources, and security context. With the default SQLite store path, losing the `/data` mount prevents the controller from opening `/data/orka.db`.
+The repository still contains local/kind evaluation scripts for the older execution-workspace prototype. They are not the supported ACP v2 deployment path and should not be used as release evidence. Live ACP validation should instead verify RuntimePool scale-up, exact-instance fencing, Session continuation, cancellation, workspace validation, clean-room publication, controller restart behavior, pool replacement, and cleanup.
diff --git a/website/docs/concepts/architecture.md b/website/docs/concepts/architecture.md
index aa0b84bb1..c4ef1e24c 100644
--- a/website/docs/concepts/architecture.md
+++ b/website/docs/concepts/architecture.md
@@ -4,38 +4,35 @@ slug: /architecture
 
 # Architecture
 
-Orka is a Kubernetes-native task execution platform where a controller manages Jobs and Pods for incoming task requests, supporting container tasks, AI agent tasks with LLM integration, and external agent CLI runtimes.
+Orka is a Kubernetes-native task execution platform. Container and native AI Tasks run through worker Jobs; built-in coding-agent Tasks run through the ACP v2 RuntimePool and RuntimeSession control plane.
 
 ## Overview
 
+```text
+                               Orka Controller
+  ┌──────────────────────────────────────────────────────────────────────┐
+  │ Task/API/controllers   ACP dispatcher   RuntimePool controller       │
+  │ Kubernetes control CRDs + Leases   SQLite payload/outbox/artifacts   │
+  │ prompt MCP broker   artifact/credential brokers   publisher client   │
+  └───────────────┬─────────────────────┬────────────────────────────────┘
+                  │                     │
+          native Task paths       type: agent (ACP v2)
+             │                         │
+      ┌──────┴──────┐          ┌───────┴────────┐        ┌──────────────┐
+      │ General/AI  │          │ RuntimePool    │───────▶│ authenticated│
+      │ worker Jobs │          │ 0 or 1 Pod     │        │ provider     │
+      └─────────────┘          │ many private   │        │ proxy → Vekil│
+                               │ RuntimeSessions│        └──────────────┘
+                               └───────┬────────┘
+                                       │ validated workspace delta
+                               ┌───────┴────────────┐
+                               │ Workspace/Publisher│
+                               │ clone/prepare/CAS  │
+                               │ push/verify/PR     │
+                               └────────────────────┘
 ```
-┌──────────────────────────────────────────────────────────────────────┐
-│                          Orka Controller                             │
-│  ┌─────────────┐  ┌──────────────┐  ┌──────────────────────────┐     │
-│  │     Task    │  │    Agent     │  │     Tool & Provider      │     │
-│  │  Reconciler │  │  Controller  │  │       Controllers        │     │
-│  └─────────────┘  └──────────────┘  └──────────────────────────┘     │
-│                                                                      │
-│  ┌─────────────┐  ┌──────────────┐  ┌──────────────────────────┐     │
-│  │   Session   │  │   Priority   │  │     REST API + Chat      │     │
-│  │   Manager   │  │    Queue     │  │    (Fiber framework)     │     │
-│  └─────────────┘  └──────────────┘  └──────────────────────────┘     │
-│                                                                      │
-│  ┌─────────────┐  ┌──────────────┐  ┌──────────────────────────┐     │
-│  │  Prometheus │  │   Embedded   │  │     Auth Middleware      │     │
-│  │   Metrics   │  │    Web UI    │  │      (SA/OIDC auth)      │     │
-│  └─────────────┘  └──────────────┘  └──────────────────────────┘     │
-└──────────────────────────────────────────────────────────────────────┘
-                              │
-              ┌───────────────┼───────────────┐
-              │               │               │
-       ┌──────┴──────┐ ┌──────┴──────┐ ┌──────┴──────┐
-       │   General   │ │     AI      │ │    Agent    │
-       │   Worker    │ │   Worker    │ │   Workers   │
-       │ (containers)│ │ (LLM agent) │ │(Claude CLI, │
-       └─────────────┘ └─────────────┘ │ Copilot CLI)│
-                                       └─────────────┘
-```
+
+The ACP runtime and Workspace/Publisher use separate network and credential identities. Runtime Pods have only the authenticated provider-proxy and prompt-scoped MCP paths; they have no Git credentials or direct SCM publication egress. The Publisher obtains exact-operation artifact and credential capabilities from controller brokers. It has no provider/MCP access, and all HTTPS SCM and forge traffic traverses the authenticated exact-host SCM egress proxy.
 
 ## Core Components
 
@@ -57,7 +54,13 @@ The controller is the central component that runs as a Kubernetes Deployment. It
   - OpenAI-compatible API
   - Anthropic-compatible API
   - internal worker APIs
-- **Task Reconciler**: Watches Task resources, creates/manages Jobs, handles lifecycle
+- **Task Reconciler**: Routes native Tasks to worker Jobs and built-in agent Tasks to the ACP dispatcher; there is no agent Job fallback
+- **ACP Dispatcher**: Persists fenced attempts, reserves pool/session capacity, streams prompts, validates workspace deltas, and projects execution/delivery status
+- **RuntimePool Controller**: Owns digest-pinned, scale-to-zero runtime Deployments, exact-Pod routing, admission, drain, replacement, and cleanup
+- **Workspace/Publisher Client**: Invokes the separate clean-room clone, deterministic commit, exact-ref publication, verification, and PR-reconciliation service
+- **ACP Control Store**: Uses Kubernetes CRD status and coordination Leases as the authority for controller epochs, attempts, RuntimeSessions, branch claims, publications, and external effects
+- **Artifact/Credential Brokers**: Issue short-lived, exact-operation artifact access and release frozen role-specific Secret values only to the Workspace/Publisher
+- **Prompt MCP Broker**: Revalidates Task, attempt, prompt lease, exact runtime fences, tool policy, approval evidence, and consequential-effect identity for every runtime tool call
 - **RepositoryScanReconciler**: Watches `RepositoryScan` resources and drives repository security scanning:
   - schedules manual and cron scans
   - creates AI tasks for threat-model generation and vulnerability discovery
@@ -79,13 +82,20 @@ The controller is the central component that runs as a Kubernetes Deployment. It
 
 ### Custom Resource Definitions (`api/v1alpha1/`)
 
-Orka uses nine core CRDs:
+Orka uses workload, gateway, workspace, and controller-owned ACP control CRDs:
 
 | CRD | Purpose |
 |-----|---------|
 | **Task** | Core work unit — container, AI, or agent type |
 | **Agent** | Reusable agent configurations with model, tools, skills, and optional runtime |
-| **AgentRuntime** | Namespace-local facade/registry entry for bring-your-own remote execution backends implementing the Orka runtime contract |
+| **AgentRuntime** | Namespace-local v2 registration and conformance record for operator-owned external runtimes |
+| **RuntimePool** | Controller-owned logical pool for one trust domain and immutable built-in ACP profile |
+| **ControllerEpoch** | Current controller holder/epoch and takeover fence |
+| **PromptAttempt** | Durable ACP execution/delivery state for one Task attempt |
+| **RuntimeSessionControl** | Logical Session lifecycle, exact runtime identity, and mutation lease state |
+| **BranchClaim** | CAS ownership/baseline for one publication branch |
+| **Publication** | Prepared commit, push, verification, and optional PR reconciliation state |
+| **ExternalEffect** | Idempotency and reconciliation ledger for consequential brokered calls |
 | **Tool** | Custom HTTP-based tool definitions for agents |
 | **Provider** | LLM provider configuration (Anthropic, OpenAI, Azure OpenAI) |
 | **Skill** | Reusable prompt content injected into agent system prompts |
@@ -93,13 +103,15 @@ Orka uses nine core CRDs:
 | **RepositoryMonitor** | GitHub pull request monitor configuration, scheduling, status, and queue counts |
 | **SubstrateActorPool** | Desired state and status for a pool of Agent Substrate actors used by workspace-backed execution |
 
-### Worker Images (`workers/`)
+### Execution Images
 
-| Worker | Description |
-|--------|-------------|
-| **General Worker** (`workers/general/`) | Runs arbitrary container commands |
-| **AI Worker** (`workers/ai/`) | Runs LLM agent tasks with built-in core, coordination, GitHub, agent-management, planning, memory, transcript, chat, session, and task-management tools |
-| **CLI Harness Wrapper** (`workers/harness/cliwrapper/`) | Runs Codex, Claude, Copilot, OpenCode, or generic CLI turns through the `orka.harness.v1` protocol |
+| Image | Description |
+| --- | --- |
+| **General Worker** (`workers/general/`) | Runs arbitrary container commands in a per-Task Job. |
+| **AI Worker** (`workers/ai/`) | Runs native LLM/coordination Tasks in a per-Task Job. |
+| **ACP Runtime** (`cmd/orka-acp-runtime`, `workers/acp/`) | Hosts multiple private Codex, Claude, Copilot, or OpenCode RuntimeSessions through `orka.harness.v2`. |
+| **Provider Auth Proxy** (`cmd/orka-provider-auth-proxy`) | Authenticates RuntimePool traffic, enforces provider/model routing, and fronts Vekil. |
+| **Workspace Publisher** (`cmd/orka-workspace-publisher`, `workers/publisher/`) | Uses a separate identity for clean-room clone, commit preparation, exact-ref publication, independent verification, and PR reconciliation. |
 
 ## Design Decisions
 
@@ -110,10 +122,12 @@ Orka uses nine core CRDs:
 | **Plan Storage** | SQLite (embedded) | Persists autonomous coordination plan state across iterations. |
 | **Memory Storage** | SQLite (embedded) | Persists durable memories and reviewable memory proposals for namespace-scoped recall. |
 | **Artifact Storage** | SQLite stores artifact metadata and BLOB content, 10MB max per artifact. | Keeps worker outputs co-located with task/session state while bounding per-artifact size. |
+| **ACP Control Authority** | Kubernetes CRD status + coordination Leases | `resourceVersion` CAS and Leases provide shared/watchable epoch, attempt, Session, branch, publication, and external-effect fencing. |
+| **ACP Payload/Outbox Storage** | SQLite behind Kubernetes fences | Stores transcript/SessionTurn payloads and deferred outbox projections without becoming a second control authority. |
 | **Security Scan Storage** | SQLite stores repository scan runs, threat models, findings, and patch proposals. | Provides durable repository-security history without an external database. |
 | **API Authentication** | Kubernetes ServiceAccount tokens plus optional OIDC JWT and generic context-token validation. | Native K8s auth by default; OIDC and `transaction-token` TxTokens support external/request-scoped API clients. |
 | **Task Queue** | Priority queuing (0-1000) | Higher priority tasks are scheduled first. |
-| **Secret Management** | Reference K8s Secrets in specs | Controller mounts secrets to worker/harness pods. |
+| **Secret Management** | Reference Kubernetes Secrets by role | Native workers receive only required Secrets. ACP source-read, target-read, target-write, forge, provider-proxy, publisher-auth, and capability roles stay separate; Git/forge values are brokered only to the clean-room Publisher. |
 | **Observability** | Prometheus metrics, structured logs, optional OpenTelemetry traces and GenAI OTLP metrics. | Standard K8s metrics/logging with opt-in distributed tracing and model/tool latency telemetry. |
 | **AI Tools** | Built-in + extensible via CRDs | Ship with categorized built-in tools and can be extended via Tool CRDs. |
 | **Failure Policy** | Configurable retry with backoff | `spec.retryPolicy` with max retries and exponential backoff. |
@@ -135,18 +149,19 @@ orka/
 │   ├── llm/                # LLM provider interface and implementations
 │   │   ├── anthropic/      # Anthropic Claude provider
 │   │   └── openai/         # OpenAI provider
-│   ├── store/              # Storage interfaces and SQLite implementation
-│   │   └── sqlite/         # SQLite backend for results, sessions, plans, artifacts, memory, security
+│   ├── store/              # Storage interfaces plus Kubernetes/SQLite adapters
+│   │   ├── kube/           # Kubernetes-authoritative ACP control store
+│   │   └── sqlite/         # Payload, outbox, sessions, plans, artifacts, memory, security
 │   ├── tools/              # Built-in tool implementations
 │   ├── metrics/            # Prometheus metrics
 │   ├── worker/             # Tool executor for custom Tool CRDs
 │   ├── cli/                # CLI command implementations
 │   └── uiembed/            # Go embed for UI static assets
 ├── workers/
-│   ├── ai/                 # AI worker (LLM agent with tools)
+│   ├── ai/                 # Native AI worker (LLM agent with tools)
 │   ├── general/            # General worker (container commands)
-│   └── agent/
-│       └── harness/        # CLI harness wrapper adapters
+│   ├── acp/                # ACP supervisor and immutable runtime images
+│   └── publisher/          # Clean-room workspace/publication image
 ├── ui/                     # React SPA (Vite + TanStack Router + shadcn/ui)
 ├── config/                 # Kustomize manifests (CRDs, RBAC, samples)
 ├── charts/orka/          # Helm chart
@@ -157,32 +172,19 @@ orka/
 
 ## Task Lifecycle
 
+Native `ai` and container Tasks retain the worker Job lifecycle. Built-in `type: agent` Tasks use durable ACP attempt state:
+
+```text
+Queued -> Reserved -> SessionStarting -> Planned -> Submitting
+       -> Accepted -> Running -> Settling
+       -> Succeeded | Failed | Cancelled | OutcomeUnknown
 ```
-Task Created
-      │
-      ▼
-┌───────────┐    session locked?     ┌───────────┐
-│  Pending  │──────────────────────▶│  Pending  │ (wait for lock)
-│           │◀──────────────────────│           │
-└─────┬─────┘    lock acquired      └───────────┘
-      │
-      ▼
-┌───────────┐
-│  Running  │ ── Job created, Pod running
-└─────┬─────┘
-      │
-   ┌──┴──┐
-   │     │
-   ▼     ▼
-┌───────┐ ┌────────┐
-│ Succ. │ │ Failed │ ── retry? → back to Running
-└───────┘ └────────┘
-      │
-      ▼
-Result stored in SQLite (workers POST to controller via HTTP)
-Session lock released
-Webhook delivered (if configured)
-```
+
+The selected RuntimePool scales from `Stopped` through `Starting` to `Serving/Accepting`. The dispatcher creates or reuses a private RuntimeSession, starts one non-reconnectable prompt stream, renews its lease, and records bounded events. A prompt that may have been accepted is never automatically replayed.
+
+After prompt settlement, the RuntimeSession enters validation. Read Tasks succeed only after the final tree matches the verified baseline. Write Tasks with changes proceed through clean-room preparation, exact-ref publication, independent verification, optional PR reconciliation, and finalization. The controller settles the Kubernetes control records and SQLite transcript/outbox payloads before projecting terminal Task status.
+
+The top-level Task phase, `status.execution`, and `status.delivery` are safe compatibility/read-model projections. The authoritative ACP transitions live in `PromptAttempt`, `RuntimeSessionControl`, `BranchClaim`, `Publication`, `ExternalEffect`, `RuntimePool.status`, and the associated coordination Leases.
 
 ## Multi-Agent Coordination
 
@@ -283,7 +285,7 @@ Key behaviors:
 - **Token tracking**: Input/output token counts tracked in the session record
 - **Cross-runtime**: Sessions store user/assistant messages only, enabling cross-runtime continuation (AI ↔ agent tasks)
 - **No size limit**: SQLite storage removes the old ConfigMap 1MB constraint
-- **Init container delivery**: Session transcripts are delivered to worker/harness pods via an init container that fetches from the controller's internal API
+- **Runtime-specific delivery**: native workers fetch session context through their worker path; ACP RuntimeSessions are reconstructed from the canonical transcript and verified workspace baseline
 
 ## Memory Model
 
@@ -300,13 +302,15 @@ Proposal review is intentionally separate from durable memory mutation. Acceptin
 
 ## Security Model
 
-- **Worker pods**: Non-root (uid 1000), read-only rootfs, all capabilities dropped, seccomp RuntimeDefault
+- **Native worker Pods**: Non-root, read-only rootfs, all capabilities dropped, seccomp RuntimeDefault
+- **ACP runtime Pods**: Read-only rootfs, no service-account token, default-deny egress, narrowly scoped supervisor capabilities, and distinct non-reused child UIDs/GIDs per RuntimeSession
+- **Workspace/Publisher**: Separate network/credential identity with operation-scoped SCM credentials and only authenticated proxy-mediated SCM/forge egress; no provider or prompt-broker access
 - **Controller**: Non-root (uid 65532), read-only rootfs, seccomp RuntimeDefault
 - **ServiceAccount TokenReview**: Default API authentication validates Kubernetes ServiceAccount bearer tokens via the TokenReview API.
 - **Optional OIDC JWT validation**: External API endpoints can validate OIDC JWTs when issuer/audience settings are configured.
 - **Optional context-token validation**: External API endpoints can validate generic context tokens, with built-in `transaction-token` TxToken support via `Txn-Token` and profile-specific issuer/audience/JWKS settings. Orka can enforce operation scopes and signed `tctx` constraints, stamp immutable transaction metadata, and use transaction-token TTS to narrow child/outbound tokens for delegated agents and downstream Tool calls.
 - **Internal worker endpoints**: `/internal/v1` endpoints require ServiceAccount authentication for worker result, plan, message, artifact, memory, and transcript calls.
-- **Secrets**: API keys referenced via `secretRef`, mounted as read-only volumes, never logged
+- **Secrets**: Provider-proxy, source-read, publication-read, publication-write, forge, artifact, publisher-auth, and prompt-broker roles are separate. Task status stores only safe references/versions and non-secret receipts; ACP children never receive Git or forge credentials.
 - **`--watch-namespace`**: Optionally scopes the controller and API to a single namespace.
 - **Namespace isolation**: `--enforce-namespace-isolation` restricts users to their ServiceAccount namespace.
 - **Cross-namespace references**: Cross-namespace Agent and Provider references are rejected when namespace isolation is enforced.
@@ -321,12 +325,16 @@ Proposal review is intentionally separate from durable memory mutation. Acceptin
 | `github.com/gofiber/fiber/v3` | HTTP router |
 | `github.com/anthropics/anthropic-sdk-go` | Anthropic Claude API |
 | `github.com/openai/openai-go/v3` | OpenAI API (official SDK) |
-| `github.com/github/copilot-sdk/go` | GitHub Copilot SDK |
+| `github.com/github/copilot-sdk/go` | GitHub Copilot integration used by the built-in Copilot ACP RuntimePool profile |
 | `modernc.org/sqlite` | Embedded SQLite (pure Go, no CGO) |
 
 ## SQLite Store Internals
 
-All persistent data uses SQLite via `modernc.org/sqlite` (pure Go, no CGO dependency).
+SQLite via `modernc.org/sqlite` (pure Go, no CGO dependency) stores Orka
+payload/read-model data. ACP control authority is deliberately excluded:
+controller epochs and Session mutation ownership use Kubernetes Leases, while
+attempt, Session, branch, publication, and external-effect transitions use CRD
+status `resourceVersion` CAS.
 
 ### Schema
 
@@ -340,6 +348,7 @@ All persistent data uses SQLite via `modernc.org/sqlite` (pure Go, no CGO depend
 | `memories` | `id` | Durable namespace-scoped memories with provenance, tags, disabled/deleted flags, and recall counters |
 | `memory_proposals` | `id` | Reviewable memory/skill/policy/workflow proposals with status, reviewer, and review notes |
 | `artifacts` | `(namespace, task_name, filename)` | Artifact metadata and BLOB content, 10MB max per artifact |
+| `session_turns` / outbox tables | stable IDs | ACP transcript/SessionTurn payloads and deferred terminal projections committed behind Kubernetes epoch/Session fences |
 | `security_scan_runs` | `id` | Repository scan run lifecycle, mode, commits, timestamps, summary, and errors |
 | `security_threat_models` | `(namespace, repository_scan, version)` | Versioned repository threat models generated or edited for scans |
 | `security_findings` | `id` | Deduplicated findings with severity, confidence, validation, evidence, and PR linkage |
diff --git a/website/docs/concepts/configuration.md b/website/docs/concepts/configuration.md
index 27afc4879..cbf3a982b 100644
--- a/website/docs/concepts/configuration.md
+++ b/website/docs/concepts/configuration.md
@@ -8,7 +8,7 @@ slug: /configuration
 
 ### Task
 
-The core work unit. Supports container commands, AI agent prompts, or external agent CLI runtimes.
+The core work unit. Supports container commands, native AI prompts, or ACP v2 coding-agent RuntimeSessions.
 
 ```yaml
 apiVersion: core.orka.ai/v1alpha1
@@ -46,6 +46,34 @@ spec:
   failedRunsHistoryLimit: 1
 ```
 
+For `type: agent`, repository and delivery policy belong at top-level `spec.workspace`:
+
+```yaml
+workspace:
+  intent: write
+  gitRepo: https://github.com/example/project.git
+  branch: main
+  readCredentialRef:
+    name: project-source-read
+  publicationGitRepo: https://github.com/example/project.git
+  publicationReadCredentialRef:
+    name: project-target-read
+  publicationCredentialRef:
+    name: project-target-write
+  forgeCredentialRef:
+    name: project-forge
+  pushBranch: orka/example-change
+  prBaseBranch: main
+  createPR: true
+```
+
+`readCredentialRef` is source-read only;
+`publicationReadCredentialRef` is target preflight/verification only;
+`publicationCredentialRef` is target-write only; and `forgeCredentialRef` is
+PR-reconciliation only. The controller freezes each selected Secret version and
+the credential broker releases it only to the Workspace/Publisher for the exact
+operation. None enters the ACP runtime process tree.
+
 ### Agent
 
 Reusable agent configurations with model settings, tools, skills, and optional agent-to-agent coordination.
@@ -300,7 +328,7 @@ See [Repository Monitors](../guides/repository-monitors.md) for the workflow, AP
 
 ### Execution
 
-Tasks and Agents both support `spec.execution` for harness wrapper pod runtime selection and placement. Agent Tasks can also set `Task.spec.execution.workspace` to request experimental workspace-backed execution through upstream `agent-sandbox` or Agent Substrate; see [Agent Sandbox Workspaces](agent-sandbox.md) and [Substrate Execution Workspaces](substrate.md).
+Native `ai` and container Tasks support `spec.execution` for worker Pod runtime selection and placement. Built-in ACP agent Tasks do not accept per-Task placement, custom resources, or `spec.execution.workspace`; reviewed RuntimePool profiles own those settings.
 
 ```yaml
 execution:
@@ -325,10 +353,10 @@ execution:
 | Field | Type | Description |
 |-------|------|-------------|
 | `runtimeClassName` | string | Selects a Kubernetes `RuntimeClass` such as `gvisor` or `kata-qemu` |
-| `nodeSelector` | map[string]string | Restricts harness wrapper pods to nodes with matching labels |
-| `tolerations` | list | Allows harness wrapper pods onto tainted runtime-specific node pools |
-| `affinity` | object | Adds Kubernetes affinity or anti-affinity rules for harness wrapper pods |
-| `workspace` | object | Experimental execution workspace request under `Task.spec.execution.workspace`. Use only on `type: agent` Tasks. |
+| `nodeSelector` | map[string]string | Restricts native worker Pods to nodes with matching labels |
+| `tolerations` | list | Allows native worker Pods onto tainted runtime-specific node pools |
+| `affinity` | object | Adds Kubernetes affinity or anti-affinity rules for native worker Pods |
+| `workspace` | object | Legacy experimental execution-workspace request. The ACP core runtime rejects it; use top-level `Task.spec.workspace`. |
 
 Resolution order:
 
@@ -339,49 +367,9 @@ Resolution order:
 
 #### Execution Workspace Requests
 
-`Task.spec.execution.workspace` is alpha support for durable, claimable agent workspaces backed by an existing upstream `agent-sandbox` or Agent Substrate installation. When `workspace.enabled: true`, the Task controller validates the request, resolves defaults, and passes workspace settings to the harness wrapper turn. Orka still creates the outer Kubernetes worker Job; the worker wrapper claims and waits for the upstream workspace, runs the configured agent runtime inside it, and then deletes or retains/releases the workspace according to `cleanupPolicy`.
+`Task.spec.execution.workspace` remains in the alpha API for earlier execution-workspace experiments, but the ACP core runtime rejects it and does not create a worker Job fallback. Use top-level `Task.spec.workspace` for the current verified source/publication contract.
 
-This field is distinct from `Task.spec.agentRuntime.workspace`, which configures the git checkout prepared for the agent runtime inside the current execution environment.
-
-```yaml
-apiVersion: core.orka.ai/v1alpha1
-kind: Task
-metadata:
-  name: coding-agent-task
-spec:
-  type: agent
-  agentRef:
-    name: claude-agent
-  prompt: "Continue implementing the feature in this session."
-  sessionRef:
-    name: feature-123
-    create: true
-  execution:
-    runtimeClassName: gvisor
-    workspace:
-      enabled: true
-      provider: agent-sandbox
-      templateRef:
-        name: coding-agent
-      reusePolicy: session
-      cleanupPolicy: retain
-```
-
-| Field | Type | Default | Description |
-|-------|------|---------|-------------|
-| `enabled` | boolean | `false` | Enables experimental workspace-backed execution. When false or omitted, sandbox settings are not propagated. |
-| `provider` | string | Controller default provider, defaulting to `agent-sandbox` | Workspace backend: `agent-sandbox` or `substrate`. |
-| `templateRef.name` | string | Controller default template, if configured | Workspace template name. Required when enabled unless the controller has a default template. |
-| `templateRef.namespace` | string | Task namespace | Namespace containing the workspace template. Orka propagates this value in its worker environment/request identity. |
-| `reusePolicy` | string | `none` | Reuse behavior: `none` or `session`. `session` requires `spec.sessionRef.name`. |
-| `cleanupPolicy` | string | Controller default cleanup policy, defaulting to `delete` | Cleanup behavior after execution: `delete` or `retain`. |
-| `boot` | boolean | `false` | Substrate only. Boots the actor from scratch on first resume. |
-| `poolRef.name` | string | empty | Substrate only. Places the workspace on a `SubstrateActorPool`; pooled workspaces currently require `cleanupPolicy: delete`. |
-| `poolRef.namespace` | string | Task namespace | Substrate only. Namespace containing the referenced pool. |
-| `snapshot` | object | empty | Substrate only, reserved. Non-empty restore/checkpoint settings are currently rejected. |
-| `hibernation` | object | empty | Substrate only, reserved. `processMode: resident` is currently rejected. |
-
-See [Agent Sandbox Workspaces](agent-sandbox.md) and [Substrate Execution Workspaces](substrate.md) for validation rules, controller flags, execution flow, and operational limitations.
+Upstream `agent-sandbox` and Agent Substrate integration are deferred behind the ACP v2 RuntimeSession seam. See [Agent Sandbox Workspaces](agent-sandbox.md) and [Agent Substrate Workspaces](substrate.md) for the required future invariants.
 
 #### SubstrateActorPool
 
@@ -414,6 +402,12 @@ spec:
 | `targetWorkers` | integer | `0` | Intended physical worker budget. `targetActors` may exceed this value to express oversubscription. |
 | `precreateActors` | boolean | `false` | Pre-create deterministic warm actors up to `targetActors`. |
 
+For built-in OpenCode Agents, `spec.model.name` must use literal
+`provider/model` form and both `spec.model.contextWindow` and
+`spec.model.maxTokens` are required positive reviewed ceilings, with
+`contextWindow > maxTokens`. They are included in the immutable runtime profile;
+Orka does not discover or guess them from a mutable model catalog.
+
 ### Provider Fallback Chain
 
 You can configure fallback providers that are automatically tried when the primary provider fails (e.g., due to auth errors, provider outages, or rate limiting). Fallbacks are configured on the Agent CRD's `spec.model.fallbacks` field.
@@ -458,7 +452,9 @@ spec:
 
 ### Agent (with Runtime)
 
-Agent configuration for external CLI runtimes (Claude Code CLI, GitHub Copilot CLI, or Codex CLI).
+Agent configuration for the supported built-in ACP runtime profiles: Claude,
+Codex, Copilot, and OpenCode. Built-in ACP Agents do not reference provider Secrets; RuntimePools reach
+Vekil through the central authenticated provider proxy.
 
 ```yaml
 apiVersion: core.orka.ai/v1alpha1
@@ -466,14 +462,12 @@ kind: Agent
 metadata:
   name: claude-agent
 spec:
-  secretRef:
-    name: claude-credentials
   model:
     name: "claude-sonnet-4-20250514"
   systemPrompt:
     inline: "You are a senior software engineer."
   runtime:
-    type: claude         # or "copilot" / "codex"
+    type: claude         # or "codex" / "copilot"
     defaultMaxTurns: 50
     defaultAllowBash: true
     defaultAllowedTools:
@@ -483,6 +477,16 @@ spec:
       - Bash
 ```
 
+OpenCode Agents must omit `spec.systemPrompt` because the runtime cannot enforce
+Agent-level prompts; put instructions in each Task's `spec.prompt` instead. OpenCode
+model IDs use provider/model form, for example `openai/gpt-5.4`, and require reviewed
+`contextWindow` and `maxTokens` values.
+
+Operator-owned runtimes outside the built-in set can use `orka.harness.v2`
+`AgentRuntime` registration and conformance, but Task planning through
+`runtime.runtimeRef` remains fail-closed until the external v2 dispatcher
+support boundary is enabled.
+
 Agent runtime tasks reference an Agent with `runtime` configured:
 
 ```yaml
@@ -494,14 +498,15 @@ spec:
   type: agent
   agentRef:
     name: claude-agent
-  prompt: "Review the code in this repo for security issues"
+  prompt: "Review the code in this repo for security issues. Do not modify files."
+  workspace:
+    intent: read
+    gitRepo: "https://github.com/example/repo.git"
+    branch: main
+    # readCredentialRef:
+    #   name: repository-read
+    # subPath: "services/api"
   agentRuntime:
-    workspace:
-      gitRepo: "https://github.com/example/repo.git"
-      branch: main
-      # gitSecretRef:
-      #   name: git-credentials
-      # subPath: "services/api"
     maxTurns: 100
     allowBash: true
     allowedTools:
@@ -684,12 +689,37 @@ Key configuration values for the Helm chart:
 |-----------|---------|-------------|
 | `controller.replicas` | `1` | Controller replicas |
 | `controller.image.repository` | `ghcr.io/orka-agents/orka` | Controller image |
-| `controller.watchNamespace` | `""` | Namespace scope (empty = cluster-wide) |
+| `controller.mode` | required | Static agent execution mode: `harness-v1` or `harness-v2`. A release never serves both or changes mode in place. |
+| `controller.watchNamespace` | required | One non-empty namespace labeled `orka.ai/controller-mode` with the matching mode. Cluster-wide watch is rejected. |
 | `controller.enforceNamespaceIsolation` | `true` | Restrict namespace-bound API callers and default Helm RBAC to their namespace |
-| `controller.apiPort` | `8080` | REST API port |
+| `service.port` | `8080` | Controller Service port used by controller and Publisher in-cluster URLs. |
+| `controller.apiPort` | `8080` | Controller container listener and Service target port. |
 | `controller.metricsPort` | `8081` | Metrics endpoint port |
 | `controller.healthPort` | `8082` | Health probe port |
 | `controller.logLevel` | `info` | Log level (debug/info/warn/error) |
+| `controller.acpRuntime.namespace` | `orka-runtimes` | Namespace for controller-owned RuntimePool workloads. |
+| `controller.acpRuntime.providerProxyNamespace` | `""` | Compatibility guard for the chart-managed provider proxy. Leave empty or set exactly to the Helm release namespace; any other nonempty value is rejected when the proxy is enabled. |
+| `controller.acpRuntime.codexImage` | `""` | Digest-pinned Codex ACP image; Tasks fail closed when empty. |
+| `controller.acpRuntime.claudeImage` | `""` | Digest-pinned Claude ACP image; Tasks fail closed when empty. |
+| `controller.acpRuntime.copilotImage` | `""` | Digest-pinned GitHub Copilot ACP image; Tasks fail closed when empty. |
+| `controller.acpRuntime.opencodeImage` | `""` | Digest-pinned OpenCode ACP image; Tasks fail closed when empty. |
+| `controller.acpRuntime.upgradeDrain.*` | enabled | Two-phase planned-upgrade admission closure and RuntimePool drain settings. |
+| `harnessV1.image.digest` | `""` | Required immutable wrapper image digest for a `harness-v1` release. |
+| `harnessV1.auth.existingSecret` | `""` | Dedicated v1 wrapper bearer/TLS Secret. Never share it with v2. |
+| `providerProxy.enabled` | `false` | Deploy the authenticated provider boundary in front of Vekil. Required for built-in ACP profiles. |
+| `providerProxy.upstreamBaseURL` | `http://vekil.vekil-system.svc:1337` | Exact supported Vekil upstream. An optional trailing slash is normalized; alternate hosts, namespaces, and ports are rejected to preserve the fixed NetworkPolicies. |
+| `providerProxy.auth.existingSecret` | `""` | Existing current/optional-overlap proxy bearer Secret. RuntimePool copies are controller-managed. |
+| `providerProxy.tokenReloadInterval` | `5s` | Atomic projected-Secret reload interval. Invalid generations fail readiness and forwarding closed. |
+| `publisher.enabled` | `true` | Deploy the separate clean-room Workspace/Publisher service. |
+| `publisher.image.repository` / `publisher.image.tag` | workspace publisher image / `latest` | Publisher image; production deployments should pin an immutable digest. |
+| `publisher.allowedSCMHosts` | `github.com` | Exact lower-case SCM hosts accepted by both Publisher validation and the SCM egress proxy. |
+| `publisher.auth.existingSecret` | `""` | Existing controller-auth/capability Secret for publisher operations. |
+| `publisher.auth.rolloutNonce` | `""` | Non-secret revision marker that restarts controller and Publisher during coordinated publisher-auth Secret rotation. |
+| `scmEgressProxy.enabled` | `true` | Require all Publisher Git and forge HTTPS traffic to traverse the dedicated authenticated proxy. The chart rejects `publisher.enabled=true` when this is false. |
+| `scmEgressProxy.auth.existingSecret` | `""` | Existing Secret shared only by Publisher and proxy. Its token must contain 32-256 RFC 3986 unreserved characters. |
+| `scmEgressProxy.auth.rolloutNonce` | `""` | Non-secret revision marker that restarts Publisher and SCM proxy during coordinated proxy-auth Secret rotation. |
+| `scmEgressProxy.maxTunnelBytes` | `1073741824` | Maximum bytes allowed in each CONNECT tunnel direction. |
+| `scmEgressProxy.maxConcurrent` | `8` | Maximum concurrent forward requests and CONNECT tunnels. |
 | `controller.workspaceProvider.apiEnabled` | `false` | Enable provider-neutral `workspace.orka.ai` coordination controllers |
 | `controller.workspaceProvider.fakeProviderEnabled` | `false` | Enable the development-only fake workspace adapter |
 | `controller.workspaceProvider.classUseAdmission.enabled` | `false` | Install and enable fail-closed Task/Tool class-use admission; required when `apiEnabled=true` |
@@ -711,19 +741,58 @@ Key configuration values for the Helm chart:
 | `client.name` | `orka-client` | Client ServiceAccount name |
 | `client.namespace` | `""` | Client ServiceAccount namespace override. Empty defaults to `controller.watchNamespace` when namespace isolation is enforced and `watchNamespace` is set, otherwise the release namespace. |
 
-### Helm CRD lifecycle
+### Helm authentication Secret rotation
 
-CRD behavior is not controlled through chart values. A fresh install creates
-the twelve CRDs unless `--skip-crds` is used. Because CRDs are cluster-scoped,
-designate one lifecycle owner and use `--skip-crds` for other Orka releases.
+The Publisher, SCM proxy, and controller clients load these credentials at process startup. Update the Secret and bump its corresponding nonce in the same Helm upgrade: use `publisher.auth.rolloutNonce` for the publisher-auth Secret, and `scmEgressProxy.auth.rolloutNonce` for the SCM proxy-auth Secret. The publisher nonce is applied only to controller and Publisher Pod templates; the SCM nonce is applied only to Publisher and SCM proxy Pod templates. Nonces are safe revision strings, not Secret values. Coordinated rotation can briefly fail closed while Pods roll but prevents stale or split credential generations from persisting.
 
-Helm does not update CRDs during `helm upgrade`. Apply the CRDs from the exact
-target chart before upgrading the controller. Helm retains CRDs and Orka custom
-resources on uninstall.
+### Canonical Kustomize overlay
 
-See the
-[Helm CRD lifecycle guide](https://github.com/orka-agents/orka/blob/main/charts/orka/README.md)
-for the CRD-first upgrade and replacement-install commands.
+Direct Kustomize deployments must use:
+
+```bash
+kubectl apply -k config/acp-production
+```
+
+`config/acp-production` composes the CRD-free `config/acp-workload` base with the cross-namespace Vekil
+ingress NetworkPolicy. Applying `config/default` alone omits the boundary that
+prevents runtime Pods from bypassing the authenticated provider proxy. Configure
+the required system Secrets and digest-pinned controller, Publisher, Codex,
+Claude, Copilot, and OpenCode images before applying the overlay. `make deploy` validates those image
+references and applies the equivalent resource set.
+
+### ACP storage split
+
+The `--store-backend=sqlite` flag does not make SQLite authoritative for ACP
+control transitions. `ControllerEpoch`, `PromptAttempt`,
+`RuntimeSessionControl`, `BranchClaim`, `Publication`, and `ExternalEffect`
+status plus coordination Leases are the control authority. SQLite stores
+transcript/SessionTurn payloads, deferred outbox projections, and artifacts
+behind those Kubernetes fences.
+
+
+For the Kustomize deployment, create the proxy-auth Secret before applying
+`config/acp-production` (the Secret is intentionally not stored in Git):
+
+```bash
+token="$(openssl rand -hex 32)"
+kubectl -n orka-system create secret generic scm-egress-proxy-auth \
+  --from-literal=token="$token"
+unset token
+```
+
+The token is an ingress credential for the proxy only; it is not a Git or forge credential. `config/publisher` sets `HTTPS_PROXY`/`NO_PROXY`, and the Publisher copies only those validated proxy variables into its otherwise empty Git subprocess environments. The Publisher NetworkPolicy has no public `0.0.0.0/0` rule. Only the SCM egress proxy may reach public port 443.
+
+`cmd/orka-workspace-publisher` also requires `ORKA_PUBLISHER_ARTIFACT_AUTHORIZATION_BROKER_URL`, `ORKA_PUBLISHER_CREDENTIAL_BROKER_URL`, and `ORKA_PUBLISHER_SCM_EGRESS_PROXY_REQUIRED=true` in normal startup. For isolated local tests only, `ORKA_PUBLISHER_ALLOW_DEVELOPMENT_FALLBACKS=true` permits the legacy local artifact signing key, filesystem credential root, and proxy-less mode. Do not set that flag in cluster manifests.
+
+When `ORKA_PUBLISHER_PUBLISH_TIMEOUT` is raised above the default on the Publisher, set the same value on the controller Deployment as well. The controller bounds each publisher-backed external-effect call and sizes the effect's ledger lease from this timeout plus a settlement margin; without the controller-side value, publisher operations are clamped to the default four-minute call bound. Brokered custom-Tool calls always keep the fixed four-minute clamp that their Tool descriptors were admitted under.
+
+### Helm CRD lifecycle
+
+CRD behavior is not controlled through chart values. A fresh install creates all CRDs in the chart unless `--skip-crds` is used. Because CRDs are cluster-scoped, designate one lifecycle owner and use `--skip-crds` for other Orka releases. Helm does not update CRDs during `helm upgrade`; apply the CRDs from the exact target chart before upgrading the controller. Helm retains CRDs and Orka custom resources on uninstall. See the [Helm CRD lifecycle guide](https://github.com/orka-agents/orka/blob/main/charts/orka/README.md).
+
+Harness v1 and v2 use separate releases, endpoints, watched namespaces, RBAC,
+Leases, stores, and data planes. They do not migrate Tasks or continue Sessions
+across modes. See [Operating harness v1 and v2 on one cluster](../operations/harness-modes.md).
 
 Context-token flags can also be configured through Helm under
 `controller.contextToken`. For example:
@@ -793,7 +862,8 @@ See [charts/orka/values.yaml](https://github.com/orka-agents/orka/blob/main/char
 | `--gateway-claim-lease` | `1m` | Event and delivery claim lease |
 | `--gateway-poll-interval` | `500ms` | Dispatcher and delivery poll interval |
 | `--gateway-batch-size` | `25` | Maximum gateway records processed per iteration |
-| `--watch-namespace` | `""` | Namespace to watch (empty = all) |
+| `--controller-mode` / `ORKA_CONTROLLER_MODE` | required | Static controller mode: `harness-v1` or `harness-v2`. `dual`, `auto`, and drain modes are rejected. |
+| `--watch-namespace` | required | One non-empty watched namespace carrying the matching `orka.ai/controller-mode` label. |
 | `--enforce-namespace-isolation` | `false` | Restrict users to their ServiceAccount's namespace |
 | `--max-tasks-per-namespace` | `0` | Max active tasks per namespace (0 = unlimited) |
 | `--agent-sandbox-enabled` | `ORKA_AGENT_SANDBOX_ENABLED` env or `false` | Enable experimental workspace-backed execution for agent Tasks that set `execution.workspace` |
@@ -853,14 +923,26 @@ See [charts/orka/values.yaml](https://github.com/orka-agents/orka/blob/main/char
 | `--outbound-access-trusted-token-endpoint-services` | `ORKA_OUTBOUND_ACCESS_TRUSTED_TOKEN_ENDPOINT_SERVICES` env or `""` | Comma-separated exact `namespace/name:port` cross-namespace token endpoint Service refs; wildcards are rejected |
 | `--task-provenance-admission-enabled` | `ORKA_TASK_PROVENANCE_ADMISSION_ENABLED` env or `false` | Enable validating admission that rejects untrusted direct Kubernetes Task writes to Orka-managed provenance fields (`spec.requestedBy`, `spec.transaction`, and transaction metadata labels/annotations) |
 | `--task-provenance-admission-trusted-users` | `ORKA_TASK_PROVENANCE_ADMISSION_TRUSTED_USERS` env or controller ServiceAccount usernames | Comma-separated Kubernetes usernames trusted to set Orka-managed Task provenance fields |
+| `--task-provenance-admission-trusted-service-accounts` | `ORKA_TASK_PROVENANCE_ADMISSION_TRUSTED_SERVICE_ACCOUNTS` env or `orka-ai-worker` | Comma-separated ServiceAccount names trusted in the target Task namespace to set Orka-managed Task provenance fields for child Task creation |
+| `--ai-worker-image` | `ghcr.io/orka-agents/orka/ai-worker:latest` | Native AI worker container image |
+| `--acp-runtime-namespace` / `ORKA_ACP_RUNTIME_NAMESPACE` | `orka-runtimes` | Namespace for managed runtime Deployments, Services, Secrets, and policies. |
+| `--acp-provider-proxy-namespace` / `ORKA_ACP_PROVIDER_PROXY_NAMESPACE` | `vekil-system` | Approved provider-proxy namespace selector. |
+| `--acp-provider-proxy-base-url` / `ORKA_ACP_PROVIDER_PROXY_BASE_URL` | unset | Authenticated provider-proxy URL injected into built-in RuntimePools. |
+| `--acp-provider-proxy-pod-labels` / `ORKA_ACP_PROVIDER_PROXY_POD_LABELS` | `orka.ai/network-role=provider-auth-proxy` | Exact Pod labels selected by RuntimePool egress policy. |
+| `--acp-provider-proxy-token-file` / `ORKA_ACP_PROVIDER_PROXY_TOKEN_FILE` | unset | Controller-mounted bearer file copied into generation-scoped immutable RuntimePool Secrets. |
+| `--acp-codex-runtime-image` / `ORKA_ACP_CODEX_RUNTIME_IMAGE` | unset | Required digest-pinned Codex runtime image when Codex Tasks are used. |
+| `--acp-claude-runtime-image` / `ORKA_ACP_CLAUDE_RUNTIME_IMAGE` | unset | Required digest-pinned Claude runtime image when Claude Tasks are used. |
+| `--acp-copilot-runtime-image` / `ORKA_ACP_COPILOT_RUNTIME_IMAGE` | unset | Required digest-pinned GitHub Copilot runtime image when Copilot Tasks are used. |
+| `--acp-opencode-runtime-image` / `ORKA_ACP_OPENCODE_RUNTIME_IMAGE` | unset | Required digest-pinned OpenCode runtime image when OpenCode Tasks are used. |
+| `--general-worker-image` | `ghcr.io/orka-agents/orka/general-worker:latest` | General worker container image |
+| `--store-backend` | `sqlite` | Payload/read-model backend. ACP control authority remains Kubernetes CRDs and Leases. |
+| `--store-path` | `/data/orka.db` | Path to the SQLite transcript/outbox/artifact database file. |
+
 | `--task-provenance-admission-trusted-service-accounts` | `ORKA_TASK_PROVENANCE_ADMISSION_TRUSTED_SERVICE_ACCOUNTS` env or configured AI/vendor worker ServiceAccounts | Comma-separated ServiceAccount names trusted in the target Task namespace to set Orka-managed Task provenance fields for child Task creation. Explicit values override the worker ServiceAccount defaults. |
 | `--ai-worker-image` | `ghcr.io/orka-agents/orka/ai-worker:latest` | AI worker container image |
-| `--general-worker-image` | `ghcr.io/orka-agents/orka/general-worker:latest` | General worker container image |
 | `--ai-worker-service-account-name` | `orka-ai-worker` | ServiceAccount name for AI worker Jobs and dynamically ensured worker RBAC |
 | `--vendor-worker-service-account-name` | `orka-vendor-worker` | ServiceAccount name for vendor/agent worker Jobs and dynamically ensured worker RBAC |
 | `--container-worker-service-account-name` | `orka-container-worker` | ServiceAccount name for container worker Jobs and dynamically ensured worker RBAC |
-| `ORKA_HARNESS_WRAPPER_ENDPOINT` | unset | Required controller environment variable for agent Tasks; points at the CLI harness wrapper HTTP endpoint. |
-| `ORKA_HARNESS_WRAPPER_BEARER_TOKEN_FILE` | unset | Optional controller token file for authenticated wrapper endpoints. |
 | `--store-backend` | `sqlite` | Storage backend (sqlite) |
 | `--store-path` | `/data/orka.db` | Path to SQLite database file |
 | `--chat-enabled` | `true` | Enable the chat endpoint |
@@ -872,7 +954,7 @@ See [charts/orka/values.yaml](https://github.com/orka-agents/orka/blob/main/char
 | `--chat-max-concurrent` | `10` | Max concurrent chat sessions |
 | `--chat-max-tasks-per-turn` | `5` | Max tasks created per chat turn |
 | `--chat-max-session-size` | `512000` | Soft limit for session size before truncation (bytes) |
-| `--leader-elect` | `false` | Enable leader election |
+| `--leader-elect` | `false` | Enable leader election. Static controller installations require `true`; the Lease is stored in the watched namespace. |
 | `--metrics-bind-address` | `0` | Metrics endpoint address |
 | `--health-probe-bind-address` | `:8081` | Health probe address |
 | `--metrics-secure` | `true` | Serve metrics via HTTPS |
@@ -891,7 +973,7 @@ Task and Tool users select namespaced `ExecutionWorkspaceClass` objects. Provide
 
 ### Agent Sandbox Controller Settings
 
-Agent sandbox settings are disabled by default. When enabled, the controller validates `Task.spec.execution.workspace`, resolves/defaults the effective `SandboxWarmPool` and workspace settings, injects the resolved settings into harness wrapper turns, and the worker wrapper owns upstream sandbox claim, execution, and cleanup. Settings can be supplied as flags, environment variables, or Helm values:
+These settings belong to the earlier execution-workspace prototype and remain disabled. The current ACP core path rejects `Task.spec.execution.workspace`; enabling these flags does not create an ACP fallback. They are retained only for local/deferred provider work:
 
 | Flag | Environment variable | Helm value | Default |
 |------|----------------------|------------|---------|
@@ -904,9 +986,9 @@ Agent sandbox settings are disabled by default. When enabled, the controller val
 | `--agent-sandbox-command-timeout` | `ORKA_AGENT_SANDBOX_COMMAND_TIMEOUT` | `controller.agentSandbox.commandTimeout` | `30m` |
 | `--agent-sandbox-cleanup-policy` | `ORKA_AGENT_SANDBOX_CLEANUP_POLICY` | `controller.agentSandbox.cleanupPolicy` | `delete` |
 
-Supported values are `disabled` or `template` for the legacy warm pool policy setting, `task` or `controller` for namespace strategy, and `delete` or `retain` for cleanup policy. `task` defaults sandbox claims to the Task namespace; `controller` defaults them to the controller namespace when discoverable, and explicit `templateRef.namespace` values are honored as the claim/warm-pool namespace. See [Agent Sandbox Workspaces](agent-sandbox.md) for examples, live smoke-test steps, and limitations.
+Supported values are `disabled` or `template` for the legacy warm pool policy setting, `task` or `controller` for namespace strategy, and `delete` or `retain` for cleanup policy. `task` defaults sandbox claims to the Task namespace; `controller` defaults them to the controller namespace when discoverable, and explicit `templateRef.namespace` values are honored as the claim/warm-pool namespace. See [Agent Sandbox Workspaces](agent-sandbox.md) for the deferred status and the invariants a future ACP-backed provider must preserve.
 
-When this feature is enabled, harness wrapper pods need RBAC for the upstream sandbox API: create/delete/patch `sandboxclaims`, read `sandboxtemplates`, `sandboxwarmpools`, and `sandboxes`, create `pods/portforward`, and read `endpointslices`. The Helm chart and generated worker RBAC include these permissions; custom deployments must include equivalent rules for the worker ServiceAccount.
+Any future ACP-backed integration will need a separately reviewed identity and RBAC design. Do not grant these permissions to managed ACP RuntimePods; they intentionally run without Kubernetes service-account tokens or Kubernetes RBAC.
 
 ### External API OIDC Authentication
 
@@ -1055,9 +1137,7 @@ copies non-secret OTLP endpoint/protocol/insecure/timeout/compression settings
 to AI worker Pods and intentionally does not copy OTLP headers, certificate or
 client-key env vars, `OTEL_RESOURCE_ATTRIBUTES`, or baggage.
 
-Harness-wrapper and agent-runtime worker telemetry is explicit opt-in. Set
-`ORKA_ENABLE_TELEMETRY=true` and OTLP exporter env on those workloads when you
-want their process-local `task.run` spans exported.
+ACP supervisor telemetry is explicit opt-in on the managed RuntimePool workload. Keep endpoint configuration non-secret and do not inject credential-bearing OTLP headers into provider children.
 
 ### Instrumented Components
 
@@ -1065,7 +1145,7 @@ want their process-local `task.run` spans exported.
 |--------|------|------------|
 | `orka.api` | HTTP/API middleware spans | HTTP request/route/status metadata |
 | `orka.chat` | `chat.request`, `chat.tool_loop.iteration` | session metadata; `chat.iteration`, `orka.tenant`, requested model, tool-call count |
-| `orka.worker` / `orka.harness` | `task.run` | `orka.task.id`, `orka.task.namespace`, `orka.tenant`, `orka.agent.name` when known |
+| `orka.worker` / `orka.acp` | `task.run` and ACP attempt/session spans | `orka.task.id`, namespace, runtime pool/session identity, and agent name when known |
 | `orka.agent` | `agent.step` | iteration, requested model/provider, tool-call count, Orka task metadata |
 | `orka.gen_ai` | `chat {model}` | `gen_ai.*` provider/model/token metadata and `error.type` |
 | `orka.gen_ai` | `execute_tool {tool.name}` | `gen_ai.tool.*`, `orka.tool.name`, `orka.tool.kind`, `orka.tool.result.size_bytes`, parent/child task fields for delegation |
diff --git a/website/docs/concepts/memory.md b/website/docs/concepts/memory.md
index e146bcdc3..73ddbc928 100644
--- a/website/docs/concepts/memory.md
+++ b/website/docs/concepts/memory.md
@@ -194,7 +194,9 @@ Apply returns the durable memory as JSON. The created memory has `source: "memor
 
 ## Validation
 
-The live Copilot proxy E2E suite validates the current memory path with a real model-backed worker:
+The live copilot-proxy E2E suite validates the native `type: ai` memory path
+with a real model-backed worker. The proxy is test infrastructure and is
+separate from the built-in Copilot ACP RuntimePool path:
 
 - durable memory can be pre-seeded through the API
 - a live worker receives memory tools through `ORKA_AI_TOOLS`
diff --git a/website/docs/concepts/security.md b/website/docs/concepts/security.md
index e2c856e1b..20b2e81d9 100644
--- a/website/docs/concepts/security.md
+++ b/website/docs/concepts/security.md
@@ -4,44 +4,73 @@ slug: /security
 
 # Security
 
-## Worker Pods
+## Execution workloads
 
-All worker pods run with a hardened security context:
+### Native worker Pods
 
-- Non-root user (uid 1000)
-- Read-only root filesystem
-- All Linux capabilities dropped
-- Seccomp profile: RuntimeDefault
-- Optional `RuntimeClass` routing via `spec.execution.runtimeClassName`
-- Optional runtime-aware placement controls via `spec.execution.nodeSelector`, `tolerations`, and `affinity`
+Container and native `ai` Tasks run in per-Task worker Pods with a hardened security context:
+
+- non-root user;
+- read-only root filesystem;
+- all Linux capabilities dropped;
+- `RuntimeDefault` seccomp;
+- optional `RuntimeClass`, node selector, tolerations, and affinity through `spec.execution`.
+
+### ACP RuntimePool Pods
+
+Built-in `type: agent` Tasks run as private RuntimeSessions inside one controller-owned ACP RuntimePool Pod per trust domain/profile. The Pod:
+
+- uses a digest-pinned immutable runtime image and profile digest;
+- disables service-account token automount and has no Kubernetes RBAC;
+- uses a read-only root filesystem and default-deny egress;
+- runs the supervisor as root with only the documented process/identity capabilities;
+- launches ACP children with no capabilities, private `HOME`/`TMPDIR`/XDG/workspace paths, and distinct non-reused UIDs/GIDs;
+- tracks, terminates, and reaps the full process tree; cleanup uncertainty poisons and recycles the pool;
+- carries no Git read or publication credential and has no direct SCM publication egress.
+
+A shared pool is a same-administrative-trust-domain density boundary, not a hard tenant sandbox. Users who can mutate or exec into the runtime Pod, namespace administrators, node administrators, and sibling sessions in the same pool are trusted relative to that boundary.
+
+Per-Task `spec.execution`, custom resources, and `spec.execution.workspace` are not supported by the current ACP path. Runtime isolation and resources are selected by reviewed RuntimePool profiles.
+
+### Workspace/Publisher
+
+The separate Workspace/Publisher identity has no provider-session or
+prompt-broker access. The controller credential broker releases frozen
+source-read, target-read, target-write, or forge values only for the exact
+active operation. The artifact broker issues short-lived capabilities bound to
+method, path, identity, operation, digest, size, media type, and expiry. The
+Publisher holds neither the artifact signing key nor a global Git credential.
 
-### Runtime Isolation
+It creates sanitized source artifacts, prepares deterministic commits from
+validated deltas, performs exact-ref publication, independently verifies the
+remote, and optionally reconciles a PR.
 
-By default, worker pods use the cluster's standard container runtime. To opt into a stronger isolation boundary, set `spec.execution.runtimeClassName` on an Agent or Task.
+The Publisher cannot open arbitrary public connections. Kubernetes egress permits only DNS, the controller API, and the authenticated SCM egress proxy. That proxy accepts only exact lower-case SCM/forge hostnames, permits only HTTPS/CONNECT on port 443, re-resolves and validates every outbound connection, and rejects private, loopback, link-local, metadata, reserved, and mixed public/private DNS answers. Redirects are disabled in both the Git/forge clients and the proxy's terminating forward mode; an encrypted CONNECT redirect to a different host still requires a new allowlisted proxy connection.
 
-- `gvisor` is the first recommended profile for Linux `kind` and similar containerd-based clusters
-- `kata-qemu` is supported through the same API and is better suited to `minikube` or production clusters with virtualization-capable nodes
-- Only worker Jobs need the alternate runtime; the controller can stay on the default runtime
-- Runtime-specific node pools should usually be combined with `nodeSelector`, `tolerations`, or `affinity` so pods land on compatible nodes
+Command-based Publisher startup is production-safe by default: artifact authorization and credential material must come from the controller brokers, and the validated SCM proxy must be enabled. Local artifact-HMAC signing, filesystem credential roots, and proxy-less startup are accepted only when `ORKA_PUBLISHER_ALLOW_DEVELOPMENT_FALLBACKS=true` is set explicitly. Supported Helm and Kustomize manifests never set that development escape hatch.
 
-### Writable Paths
+The runtime child's `.git` directory, remotes, hooks, filters, refs, and history are untrusted for publication.
 
-Only three paths are writable (mounted as EmptyDir volumes):
+### Provider and prompt brokers
 
-| Path | Purpose |
-|------|---------|
-| `/tmp` | Container runtime temporary files |
-| `/home/worker` | CLI config/cache (Claude, Copilot, Codex) |
-| `/workspace` | Git clone and working directory |
+Built-in RuntimePools reach Vekil only through the central authenticated
+provider proxy. The proxy validates the RuntimePool bearer, enforces the
+configured provider/model path, and supports bounded current/previous-token
+overlap during rotation. `config/acp-production` applies the cross-namespace
+Vekil ingress policy required to prevent direct runtime access.
 
-All other filesystem paths are read-only. Workers that write outside these paths will fail.
+Every RuntimeSession also exposes a credential-protected loopback MCP proxy.
+The controller broker revalidates Task, attempt, prompt, lease generation and
+expiry, exact runtime fences, the canonical tool allowlist, and approval
+evidence for every call. Settlement, cancellation, expiry, poisoning, and
+deletion revoke authorization and cancel in-flight broker calls. Consequential
+operations reserve a durable `ExternalEffect` identity before execution.
 
-### Agent Runtime Security Notes
+### Current ACP constraints
 
-- **Copilot agent worker**: Auto-approves **all** permission requests from the Copilot SDK without filtering. The agent can execute shell commands, file operations, and network requests in autonomous mode with no safeguards beyond the read-only rootfs
-- **Claude agent worker**: Sets `HOME=/home/worker` unconditionally, bypassing default HOME permissions
-- **Git credentials**: `GIT_TOKEN` and `GITHUB_TOKEN` are set as environment variables, visible to all child processes. If the prompt is user-controlled, the LLM agent could potentially access these via `os.Environ()`
-- **Prior task diffs**: Applied via `git apply --check` (dry-run) then `git apply`, but without verifying patch author or integrity. A compromised prior task could inject arbitrary changes
+- External `AgentRuntime` v2 registration and conformance are supported, but `runtimeRef` Task dispatch remains fail-closed until the external v2 dispatcher support boundary is enabled.
+- Non-empty write delivery uses the clean-room publisher and is successful only with a terminal independently verified `status.delivery` receipt.
+- Codex, Claude, Copilot, and OpenCode are supported built-in RuntimePool profiles.
 
 ## Controller
 
@@ -64,6 +93,7 @@ The controller runs with:
 - Worker HTTP Tool CRD calls can propagate a TxToken from a mounted file using `ORKA_TRANSACTION_TOKEN_FILE`; when `ORKA_CONTEXT_TOKEN_TTS_ENDPOINT` and `ORKA_CONTEXT_TOKEN_SUBJECT_TOKEN_FILE` are configured, workers exchange the subject token for an operation-scoped outbound TxToken before calling the tool. Token values are read at request time and are not stored in Task spec/status; downstream services must still verify incoming TxTokens and enforce their own policy
 - When agent sandbox workspaces are enabled, the outer worker stages mounted transaction/context-subject token files into sandbox-local `0600` files, rewrites `ORKA_TRANSACTION_TOKEN_FILE` / `ORKA_CONTEXT_TOKEN_SUBJECT_TOKEN_FILE` for the inner worker, and scrubs the staged files after execution or before retaining a workspace. Raw TxTokens are still not written to Task spec/status/logs.
 - See [Transaction Token integration](transaction-tokens.md) for deployment examples, scope vocabulary, transaction metadata, TTS exchange, admission hardening, metrics, and rollout guidance
+- The ACP core path rejects provider-backed `Task.spec.execution.workspace`. Any future agent-sandbox/Substrate integration must use prompt/operation-scoped capabilities and must not stage raw transaction tokens into retained workspaces or provider child environments.
 - OIDC- and context-token-authenticated Task creation stamps the verified identity into immutable `spec.requestedBy`; context-token-authenticated Task creation also stamps immutable `spec.transaction` metadata for audit correlation. Client-supplied `requestedBy` and `transaction` fields are rejected
 - Optional Task provenance admission (`--task-provenance-admission-enabled`) rejects untrusted direct Kubernetes Task creates/updates that set or modify Orka-managed provenance fields, including `spec.requestedBy`, `spec.transaction`, and transaction metadata labels/annotations. The opt-in manifest defaults to `failurePolicy: Ignore`; switch it to `Fail` only after webhook TLS, CA bundle injection, and availability are configured
 - The `orka` CLI extracts tokens from kubeconfig for browser-based login
@@ -71,13 +101,25 @@ The controller runs with:
 
 ## Secret Management
 
-- LLM API keys and tool credentials are stored in Kubernetes Secrets
-- Secrets are referenced via `secretRef` in CRD specs and mounted as read-only volumes
-- Secrets are never logged, stored in task specs, or exposed in API responses
+- Provider-proxy, source-read, publication-read, publication-write, forge,
+  prompt-broker, publisher-auth, artifact, and operation-capability roles are
+  separate.
+- `Task.spec.workspace.readCredentialRef`,
+  `publicationReadCredentialRef`, `publicationCredentialRef`, and
+  `forgeCredentialRef` store only same-namespace Secret references; the
+  selected UID/resourceVersion is frozen at reservation and values never appear
+  in Task status.
+- Git credentials are resolved by the clean-room boundary and are never mounted into ACP runtime Pods.
+- Known Orka-supplied secret values are redacted before logs, events, results, transcripts, and traces; raw prompt/repository content still requires RBAC, encryption, retention, and content-capture policy.
 
 ## Namespace Scoping
 
-- Controller can be scoped to a single namespace with the `--watch-namespace` flag
+- Every controller requires one non-empty `--watch-namespace` and one static
+  `--controller-mode` (`harness-v1` or `harness-v2`)
+- The watched namespace must carry the matching
+  `orka.ai/controller-mode` label; missing or mismatched claims fail startup
+- Same-cluster v1/v2 installations use distinct namespaces, ServiceAccounts,
+  RBAC, Leases, stores, Services, Secrets, and execution data planes
 - Chat endpoint blocks operations in `kube-system` and `kube-public` namespaces
 - The embedded UI is served over the same port as the API (no separate attack surface)
 
@@ -117,12 +159,21 @@ For multi-tenant deployments, enable both isolation and limits:
 ```
 --enforce-namespace-isolation=true
 --max-tasks-per-namespace=50
---watch-namespace=""
+--controller-mode=harness-v2
+--watch-namespace=team-v2
 ```
 
 ### Data Isolation
 
-All stored data (results, sessions, plans) is keyed by namespace in SQLite. Queries always filter by namespace. The controller, API server, and workers all enforce namespace boundaries at their respective layers.
+Most ACP control CRDs are namespace-scoped, and their status transitions use
+Kubernetes `resourceVersion` compare-and-swap. Controller-epoch and Session
+mutation Leases fence cross-controller writes. SQLite payload/read-model data
+(including transcripts, deferred outbox projections, and artifacts)
+is also keyed by namespace, and queries filter by namespace. The controller,
+API server, Publisher, brokers, and workers enforce namespace and exact-identity
+boundaries at their respective layers. CRD schemas remain cluster-scoped and
+have one platform lifecycle owner; schema sharing does not grant either
+controller access to the other installation's resources.
 
 ### Audit Logging
 
diff --git a/website/docs/concepts/substrate.md b/website/docs/concepts/substrate.md
index f5b8acdbf..4dfde221c 100644
--- a/website/docs/concepts/substrate.md
+++ b/website/docs/concepts/substrate.md
@@ -2,620 +2,63 @@
 slug: /substrate
 ---
 
-# Substrate Execution Workspaces
+# Agent Substrate Workspaces
 
-Orka can run agent Tasks inside
-[Agent Substrate](https://github.com/agent-substrate/substrate) Actors through
-the experimental `substrate` execution workspace provider.
+Agent Substrate is the planned next execution-workspace phase after the initial ACP core runtime. The current built-in `type: agent` path does not run Tasks in Substrate Actors and rejects `Task.spec.execution.workspace` rather than falling back to the removed worker-based path.
 
-Substrate is not a replacement for Orka's Task API, controller, worker Jobs,
-result submission, or artifact handling. Orka still owns the high-level agent
-task lifecycle. Substrate provides the lower-level warm, suspendable, stateful
-execution environment for Tasks that opt into an execution workspace.
-
-The Substrate provider is disabled by default. Enable it only in clusters where
-Substrate is already installed and where an Orka-compatible `ActorTemplate` is
-available.
-
-## How It Works
-
-The integration uses Orka's existing workspace wrapper flow:
-
-```text
-Task
-  -> Orka controller validates workspace settings
-  -> Orka controller creates the normal worker Job
-  -> outer worker claims or creates a Substrate Actor
-  -> outer worker resumes the Actor
-  -> outer worker stages the Orka worker binary and handoff token
-  -> Orka workspace daemon inside the Actor starts the inner worker
-  -> inner worker runs the agent runtime and reports results to Orka
-  -> outer worker scrubs staged token files
-  -> outer worker suspends or deletes the Actor
-```
-
-This keeps the provider boundary behind `internal/workspace.WorkspaceExecutor`.
-The controller resolves and validates provider configuration, while the worker
-owns actor claim, readiness, command execution, staging, and cleanup.
-
-Substrate's public control API is actor lifecycle oriented. It does not provide
-the command execution and file transfer surface that Orka workers need, so Orka
-requires a small workspace daemon inside each compatible Substrate Actor.
-
-## When To Use It
-
-Use `provider: substrate` for agent workloads that benefit from a durable,
-suspendable execution environment:
-
-- session-scoped workspaces that should stay warm between Tasks
-- agent runs that need filesystem state preserved by Substrate snapshots
-- local and CI validation of Orka's Substrate workspace behavior
-
-Use the default Kubernetes worker execution path when a Task does not need a
-durable execution workspace. Use `provider: agent-sandbox` when the cluster is
-configured for Kubernetes SIG agent-sandbox instead of Substrate.
-
-## Requirements
-
-The cluster must provide:
-
-- Substrate CRDs and control plane.
-- A running Substrate router, normally `atenet-router`.
-- A snapshot store accepted by the Substrate installation, such as the local
-  RustFS bucket used by the kind E2E.
-- A Substrate `WorkerPool` for Orka Actors.
-- An Orka-compatible Substrate `ActorTemplate`.
-- Worker nodes that can run Substrate's gVisor based runtime path.
-
-Orka does not install or operate Substrate in production. Install and validate
-Substrate separately, then configure Orka to use it.
-
-## Controller Configuration
-
-Enable the provider on the Orka controller:
-
-```bash
---execution-workspace-default-provider=substrate
---substrate-enabled=true
---substrate-api-endpoint=api.ate-system.svc:443
---substrate-router-url=http://atenet-router.ate-system.svc
---substrate-actor-dns-suffix=actors.resources.substrate.ate.dev
---substrate-default-template=orka-codex
---substrate-default-template-namespace=ate-demo
---substrate-bootstrap-token-secret-name=orka-substrate-bootstrap
---substrate-bootstrap-token-secret-key=token
---substrate-claim-timeout=2m
---substrate-command-timeout=30m
---substrate-cleanup-policy=delete
-```
-
-The same values can be provided through environment variables:
-
-| Flag | Environment variable | Default |
-| --- | --- | --- |
-| `--execution-workspace-default-provider` | `ORKA_EXECUTION_WORKSPACE_DEFAULT_PROVIDER` | `agent-sandbox` |
-| `--substrate-enabled` | `ORKA_SUBSTRATE_ENABLED` | `false` |
-| `--substrate-api-endpoint` | `ORKA_SUBSTRATE_API_ENDPOINT` | `api.ate-system.svc:443` |
-| `--substrate-api-ca-file` | `ORKA_SUBSTRATE_API_CA_FILE` | empty |
-| `--substrate-api-insecure-skip-verify` | `ORKA_SUBSTRATE_API_INSECURE_SKIP_VERIFY` | `false` |
-| `--substrate-router-url` | `ORKA_SUBSTRATE_ROUTER_URL` | `http://atenet-router.ate-system.svc` |
-| `--substrate-actor-dns-suffix` | `ORKA_SUBSTRATE_ACTOR_DNS_SUFFIX` | `actors.resources.substrate.ate.dev` |
-| `--substrate-default-template` | `ORKA_SUBSTRATE_DEFAULT_TEMPLATE` | empty |
-| `--substrate-default-template-namespace` | `ORKA_SUBSTRATE_DEFAULT_TEMPLATE_NAMESPACE` | empty |
-| `--substrate-bootstrap-token-secret-name` | `ORKA_SUBSTRATE_BOOTSTRAP_TOKEN_SECRET_NAME` | empty |
-| `--substrate-bootstrap-token-secret-key` | `ORKA_SUBSTRATE_BOOTSTRAP_TOKEN_SECRET_KEY` | `token` when a secret name is set |
-| `--substrate-claim-timeout` | `ORKA_SUBSTRATE_CLAIM_TIMEOUT` | `2m` |
-| `--substrate-command-timeout` | `ORKA_SUBSTRATE_COMMAND_TIMEOUT` | `30m` |
-| `--substrate-cleanup-policy` | `ORKA_SUBSTRATE_CLEANUP_POLICY` | `delete` |
-
-When Substrate is enabled, the controller requires explicit API trust
-configuration. Use `--substrate-api-ca-file` in production. Reserve
-`--substrate-api-insecure-skip-verify=true` for local smoke tests such as the
-kind E2E.
-
-The controller also requires a bootstrap token Secret reference. Worker Jobs use
-that Secret to authenticate the first handoff-token upload to a fresh or resumed
-workspace daemon. Create a Secret with the configured name and key in every Task
-namespace that will run Substrate-backed workers, and provide the same token to
-the Substrate `ActorTemplate` daemon environment.
-
-If `--execution-workspace-default-provider=substrate` is set, Tasks may omit
-`spec.execution.workspace.provider` and still use Substrate. If the default is
-left as `agent-sandbox`, each Substrate Task must set `provider: substrate`.
-
-## Task API
-
-Substrate is selected through the existing execution workspace field:
-
-```yaml
-apiVersion: core.orka.ai/v1alpha1
-kind: Task
-metadata:
-  name: substrate-agent-task
-spec:
-  type: agent
-  agentRef:
-    name: codex-agent
-  prompt: "Run make test and summarize the result."
-  sessionRef:
-    name: substrate-demo
-    create: true
-  execution:
-    workspace:
-      enabled: true
-      provider: substrate
-      templateRef:
-        name: orka-codex
-        namespace: ate-demo
-      reusePolicy: session
-      cleanupPolicy: retain
-```
-
-Workspace fields:
-
-- `enabled`: must be `true` to use any durable execution workspace.
-- `provider`: set to `substrate`, or omit it when the controller default is
-  `substrate`.
-- `templateRef.name`: Substrate `ActorTemplate` name. It may be omitted only
-  when the controller has `--substrate-default-template`.
-- `templateRef.namespace`: Substrate `ActorTemplate` namespace. It defaults to
-  the Task namespace unless the controller has a provider-specific default.
-- `reusePolicy`: `none` creates a fresh Actor. `session` reuses the
-  session-scoped Actor and requires `spec.sessionRef.name`.
-- `cleanupPolicy`: `delete` removes the Actor after the Task. `retain` scrubs
-  staged secrets and suspends the Actor.
-- `boot`: asks Substrate to boot the actor from scratch on first resume instead
-  of relying on the provider's default snapshot behavior.
-- `poolRef`: places the Task on an operator-managed `SubstrateActorPool`.
-  Pooled workspaces currently require `cleanupPolicy: delete`; the controller
-  rejects pooled `retain` until workspace reset is available.
-- `snapshot`: reserved for explicit provider snapshot restore/checkpoint
-  settings. Non-empty snapshot settings are currently rejected.
-- `hibernation`: reserved for resident process reuse. `processMode: resident`
-  is currently rejected.
-
-The controller rejects `provider: substrate` when Substrate support is disabled,
-when the provider name is unknown, when a required template is missing, or when
-the referenced `ActorTemplate` is not Orka-compatible.
-
-## Actor Pools
-
-`SubstrateActorPool` is an Orka CRD for operator-owned actor pool capacity. A
-pool points at one Substrate `ActorTemplate`, optionally records the intended
-Substrate `WorkerPool`, and reports sanitized density telemetry.
-
-```yaml
-apiVersion: core.orka.ai/v1alpha1
-kind: SubstrateActorPool
-metadata:
-  name: codex-substrate-pool
-  namespace: default
-spec:
-  templateRef:
-    name: orka-codex
-    namespace: ate-demo
-  workerPoolRef:
-    name: orka-workers
-    namespace: ate-demo
-  targetActors: 4
-  targetWorkers: 2
-  precreateActors: true
-```
-
-Pool fields:
-
-- `templateRef`: Substrate `ActorTemplate` used for all actors in the pool.
-- `workerPoolRef`: optional Substrate `WorkerPool` the pool targets for
-  capacity and density reporting.
-- `targetActors`: desired stateful actor count, capped at `1000`.
-- `targetWorkers`: intended physical worker budget. `targetActors` may exceed
-  this value to express oversubscription.
-- `precreateActors`: asks the controller to create deterministic warm actors up
-  to `targetActors`; Substrate may suspend actors when workers are full.
-
-Tasks opt into a pool with `spec.execution.workspace.poolRef`:
+Use top-level `Task.spec.workspace` for current ACP repository input and publication policy:
 
 ```yaml
-apiVersion: core.orka.ai/v1alpha1
-kind: Task
-metadata:
-  name: pooled-substrate-agent-task
 spec:
   type: agent
-  agentRef:
-    name: codex-agent
-  prompt: "Run make test and summarize the result."
-  execution:
-    workspace:
-      enabled: true
-      provider: substrate
-      templateRef:
-        name: orka-codex
-        namespace: ate-demo
-      poolRef:
-        name: codex-substrate-pool
-      boot: true
-```
-
-The pool and Task/Tool template references must resolve to the same
-`ActorTemplate`. When namespace isolation is enforced, cross-namespace `poolRef`
-values are rejected.
-
-## Workspace Status
-
-Task status exposes a provider-neutral workspace lifecycle:
-
-```yaml
-status:
-  executionWorkspace:
-    provider: substrate
-    templateRef:
-      name: orka-codex
-      namespace: ate-demo
-    phase: Deleted
-    reason: WorkspaceDeleted
-    reusePolicy: session
-    cleanupPolicy: delete
-    reused: false
-    placement:
-      workerNamespace: ate-demo
-      workerPool: orka-workers
-      workerPodName: orka-workers-0
-    density:
-      workerCount: 1
-      actorCount: 2
-      runningActorCount: 1
-      suspendedActorCount: 1
-      actorsPerWorker: "2.00"
-    resumeLatency: 2.3s
-    message: workspace deleted
-```
-
-Possible phases are `Pending`, `Ready`, `Released`, `Retained`, `Deleted`, and
-`Failed`.
-
-The status surface is intentionally sanitized. It must not expose Substrate actor
-IDs, snapshot URIs, worker pod IPs, daemon URLs, staged token paths, request
-tokens, or raw provider credentials.
-
-`placement`, `density`, and `resumeLatency` are best-effort visibility fields.
-They are safe for status and telemetry, but they should not be used as stable
-provider-native identifiers.
-
-## ActorTemplate Requirements
-
-An Orka-compatible Substrate `ActorTemplate` must run the Orka workspace daemon
-as the long-lived actor process. The controller validates the following labels
-and annotations:
-
-```yaml
-metadata:
-  labels:
-    orka.ai/execution-workspace: "true"
-    orka.ai/workspace-provider: substrate
-  annotations:
-    orka.ai/workspace-protocol: http-json-v1
-    orka.ai/workspace-daemon-port: "80"
-    orka.ai/workspace-staging-root: /app
-    orka.ai/agent-runtimes: codex
-```
-
-The daemon port must match the daemon container's literal
-`ORKA_WORKSPACE_AGENT_LISTEN_ADDR` value, or the daemon default `:8080` when
-that environment variable is omitted. The pinned Substrate router currently
-forwards actor HTTP traffic to port `80`, so Orka agent harness wrapper images grant the
-workspace daemon `cap_net_bind_service` while still running it as a non-root
-user. The staging root is currently required to be `/app`, because the worker
-handoff stages the inner worker binary and secret scrub paths under that
-directory.
-Use the Orka agent harness wrapper image for the runtime, not the daemon-only image; the
-ActorTemplate container must include `/orka-workspace-agent`, the selected CLI,
-and normal workspace tools such as `git`.
-The controller also validates that the workspace-daemon ActorTemplate container
-defines `ORKA_WORKSPACE_BOOTSTRAP_TOKEN`. Prefer `valueFrom.secretKeyRef` when
-the deployed Substrate version propagates Kubernetes env sources into the actor
-runtime. The pinned Substrate revision used by the kind E2E propagates literal
-env values only, so the CI template uses a generated, ephemeral literal value
-that matches the worker Job Secret.
-
-Example shape:
-
-```yaml
-apiVersion: ate.dev/v1alpha1
-kind: WorkerPool
-metadata:
-  name: orka-workers
-  namespace: ate-demo
-spec:
-  replicas: 1
-  ateomImage: registry.example.com/ateom-gvisor:tag
----
-apiVersion: ate.dev/v1alpha1
-kind: ActorTemplate
-metadata:
-  name: orka-codex
-  namespace: ate-demo
-  labels:
-    orka.ai/execution-workspace: "true"
-    orka.ai/workspace-provider: substrate
-  annotations:
-    orka.ai/agent-runtimes: codex
-    orka.ai/workspace-daemon-port: "80"
-    orka.ai/workspace-protocol: http-json-v1
-    orka.ai/workspace-staging-root: /app
-spec:
-  pauseImage: registry.k8s.io/pause:3.10.2
-  containers:
-    - name: workspace
-      image: registry.example.com/orka/agent-harness-wrapper:tag
-      command:
-        - /orka-workspace-agent
-      env:
-        - name: ORKA_WORKSPACE_AGENT_LISTEN_ADDR
-          value: ":80"
-        - name: ORKA_WORKSPACE_HANDOFF_TOKEN_FILE
-          value: /app/orka-workspace-handoff-token
-        - name: ORKA_WORKSPACE_BOOTSTRAP_TOKEN
-          value: "${ROTATED_BOOTSTRAP_TOKEN}"
-      ports:
-        - containerPort: 80
-  workerPoolRef:
-    name: orka-workers
-    namespace: ate-demo
-  snapshotsConfig:
-    location: gs://ate-snapshots/orka-codex/
-  runsc:
-    amd64:
-      url: gs://gvisor/releases/nightly/2026-05-19/x86_64/runsc
-      sha256Hash: a397be1abc2420d26bce6c70e6e2ff96c73aaaab929756c56f5e2089ea842b63
-    arm64:
-      url: gs://gvisor/releases/nightly/2026-05-19/aarch64/runsc
-      sha256Hash: 1ba2366ae2efceba166046f51a4104f9261c9cb72c6db8f5b3fe2dc57dea86b9
-```
-
-Use images and `runsc` artifacts that match the target environment. The example
-above mirrors the local E2E shape; production installations should pin and
-mirror artifacts according to their own supply-chain policy.
-
-## MCP Actor-Backed Tools
-
-Tools can also be backed by a durable Substrate actor that serves MCP over HTTP.
-The Tool controller creates or reuses the actor, waits for the MCP endpoint to
-be reachable through the Substrate router, and publishes the resolved endpoint
-and actor metadata in Tool status.
-
-```yaml
-apiVersion: core.orka.ai/v1alpha1
-kind: Tool
-metadata:
-  name: repo-inspector
-  namespace: default
-spec:
-  description: "Inspect repository metadata through an MCP server"
-  parameters:
-    type: object
-    properties:
-      message:
-        type: string
-    required:
-      - message
-  mcp:
-    path: /mcp
-    substrateActor:
-      templateRef:
-        name: orka-mcp
-        namespace: ate-demo
-      poolRef:
-        name: mcp-substrate-pool
-      boot: true
-```
-
-`mcp.path` defaults to `/mcp`. `mcp.substrateActor.templateRef.name` is
-required, and `poolRef` is optional. If a pool is set, the pool template must
-match the MCP actor template. `boot: true` boots the actor from scratch only on
-the first resume; forced reconciles should not restart an already booted MCP
-actor.
-
-MCP tools may omit `spec.http` entirely. If the actor endpoint also needs
-transport auth, set `spec.http.authSecretRef`, omit `spec.http.url`, and use
-header injection. Orka calls the resolved actor endpoint from Tool status. Body
-auth injection is invalid for MCP tools because call arguments are forwarded to
-the MCP server as tool input.
-
-## Security Model
-
-Substrate Actors can preserve memory and filesystem state, so staged credential
-handling is strict:
-
-- The outer worker stages only a short-lived handoff token for the inner worker.
-- The first handoff-token upload is authenticated with
-  `ORKA_WORKSPACE_BOOTSTRAP_TOKEN`, which must match the worker Job bootstrap
-  Secret and must not be the token being uploaded.
-- The daemon reads the handoff token from the configured file path.
-- The daemon removes the bootstrap token from its process environment before
-  launching task commands.
-- The outer worker calls the daemon scrub endpoint before retaining or deleting
-  an Actor.
-- `cleanupPolicy: retain` scrubs staged secrets before suspending the Actor.
-- `cleanupPolicy: delete` scrubs staged secrets, suspends the Actor, then
-  deletes it.
-- Task status and logs must not contain raw tokens, credentials, snapshot URIs,
-  or provider-native routing details.
-
-Do not place API keys, long-lived credentials, or source-control tokens directly
-in an `ActorTemplate`. Use Kubernetes Secrets and Orka's existing runtime secret
-mechanisms for Task execution. The bootstrap token is control-plane credential
-material; keep the worker-side value in a Secret, rotate it like other cluster
-credentials, and ensure the ActorTemplate daemon receives the same value through
-the most restrictive env mechanism supported by the deployed Substrate version.
-
-## Local Kind Validation
-
-The repository includes a secret-free kind E2E for Substrate:
-
-```bash
-PATH="$(go env GOPATH)/bin:$PATH" \
-SUBSTRATE_E2E_EXTENDED=1 \
-bash scripts/agent-substrate-e2e.sh
-```
-
-Required local tools:
-
-- Docker
-- Go
-- git
-- curl
-- `kind`
-- `kubectl`
-- `ko`
-- `jq`
-
-The script:
-
-1. Creates an isolated kind cluster and local registry.
-2. Clones the configured Substrate revision.
-3. Installs Substrate into kind.
-4. Initializes the local RustFS snapshot bucket.
-5. Builds Orka controller, workspace daemon, and worker images.
-6. Creates an Orka-compatible Substrate `WorkerPool` and `ActorTemplate`.
-7. Exercises direct Substrate actor create, resume, router, daemon exec,
-   suspend, and delete.
-8. Deploys Orka with Substrate enabled.
-9. Creates Orka `SubstrateActorPool` resources for agent and MCP actors.
-10. Runs Orka Tasks through default and pooled Substrate workspaces.
-11. Executes an MCP Tool backed by a pooled Substrate actor and verifies forced
-    reconciles do not reboot the MCP actor.
-12. Validates Task result submission, workspace placement/density telemetry,
-    cleanup status, and missing-template failure.
-
-The pinned Substrate revision can fail `runsc delete` after an Orka Task has
-already produced its result in GitHub-hosted kind. The E2E treats that as a
-known upstream cleanup failure only when `status.resultRef.available=true` and
-`status.executionWorkspace.reason=WorkspaceCleanupFailed`; direct Substrate
-actor suspend/delete is still validated separately.
-
-Useful overrides:
-
-```bash
-KIND_CLUSTER=orka-agent-substrate-e2e
-KIND_REGISTRY_NAME=orka-agent-substrate-registry
-KIND_REGISTRY_PORT=5001
-SUBSTRATE_REPO=https://github.com/agent-substrate/substrate.git
-SUBSTRATE_REF=main
-SUBSTRATE_E2E_EXTENDED=1
-KEEP_CLUSTER=1
-SUBSTRATE_BOOTSTRAP_TOKEN_SECRET_NAME=orka-substrate-bootstrap
-SUBSTRATE_BOOTSTRAP_TOKEN_SECRET_KEY=token
+  workspace:
+    intent: write
+    gitRepo: https://github.com/example/project.git
+    readCredentialRef:
+      name: project-read
+    publicationGitRepo: https://github.com/example/project.git
+    publicationCredentialRef:
+      name: project-publish
+    pushBranch: orka/example-change
 ```
 
-Set `KEEP_CLUSTER=1` when you want to inspect the cluster after a failure.
+The separate Workspace/Publisher performs clone, deterministic commit preparation, exact-ref push, independent verification, and optional PR reconciliation. The ACP runtime or future Actor must not receive publication credentials.
 
-## GitHub Actions
+## Planned ACP seam
 
-`.github/workflows/agent-substrate-e2e.yml` runs the same script in CI. The
-workflow is secret-free and is intended to catch regressions in:
+The intended Substrate mapping is one Orka RuntimeSession per warm, suspendable Actor behind the same `orka.harness.v2` operations:
 
-- Orka controller validation for Substrate workspaces
-- worker Job environment injection
-- SubstrateActorPool reconciliation and density reporting
-- Substrate actor lifecycle handling
-- pooled Task placement
-- MCP Tool execution through a Substrate actor
-- MCP actor boot-once reuse across forced reconciles
-- workspace daemon command execution
-- workspace placement, density, and resume latency status
-- secret scrub and cleanup behavior
-- task status updates for `Deleted`, `Retained`, and validation failures
-
-Validate workflow changes locally with:
-
-```bash
-bash -n scripts/agent-substrate-e2e.sh
-go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/agent-substrate-e2e.yml
-```
-
-## Troubleshooting
-
-Start with Orka resources:
-
-```bash
-kubectl get task -A
-kubectl -n default get task <task-name> -o yaml
-kubectl -n default get substrateactorpool
-kubectl -n default get tool
-kubectl -n orka-system logs deployment/orka-controller-manager --tail=200
-kubectl -n default get jobs,pods
-kubectl -n default logs job/<worker-job-name> --all-containers=true
-```
-
-Then inspect Substrate:
-
-```bash
-kubectl -n ate-system get pods
-kubectl -n ate-demo get workerpool,actortemplate
-kubectl -n ate-demo get actortemplate <template-name> -o yaml
-kubectl -n ate-system logs deployment/atenet-router --tail=200
-kubectl -n ate-system logs deployment/api --tail=200
-```
-
-When the Substrate CLI plugin is available, actor and worker state is also
-useful:
-
-```bash
-kubectl ate get actors
-kubectl ate get workers
+```text
+Task attempt
+  -> logical RuntimePool / trust domain
+  -> RuntimeSession
+  -> Substrate Actor hosting one ACP provider session
+  -> validation and durable workspace delta
+  -> Orka Workspace/Publisher
 ```
 
-Common failures:
+Substrate would supply physical placement, suspension, and resume. Orka would remain authoritative for:
 
-- `execution workspace provider "substrate" requires substrate to be enabled`:
-  set `--substrate-enabled=true` on the controller.
-- `substrate workspace bootstrap token secret name is required`: set
-  `--substrate-bootstrap-token-secret-name` and create that Secret in the Task
-  namespace and `ActorTemplate` namespace.
-- `execution workspace templateRef.name is required`: set
-  `spec.execution.workspace.templateRef.name` or configure
-  `--substrate-default-template`.
-- `ActorTemplate ... not found`: create the template in the referenced
-  namespace or fix `templateRef.namespace`.
-- `ActorTemplate ... missing label/annotation`: add the Orka compatibility
-  metadata described above.
-- `ActorTemplate ... is not Ready`: inspect Substrate `WorkerPool`, snapshot
-  config, image pulls, and `runsc` configuration.
-- `substrate actor poolRef ... not found`: create the referenced
-  `SubstrateActorPool` or fix `spec.execution.workspace.poolRef`.
-- `poolRef does not support cleanupPolicy "retain"`: omit `cleanupPolicy` or
-  set it to `delete` for pooled workspaces.
-- Task reaches `Failed` with `WorkspaceReadinessFailed`: inspect actor state,
-  router logs, workspace daemon logs, and DNS suffix configuration.
-- Task reaches `Failed` with `WorkspaceCleanupFailed` after
-  `resultRef.available=true`: the command completed and result submission
-  succeeded, but Substrate failed while checkpointing or deleting the actor.
-  Inspect `atelet` and `ateom-gvisor` logs for `runsc delete` errors.
-- MCP Tool remains unavailable: inspect `status.error`, verify
-  `mcp.substrateActor.templateRef`, check that the actor template is `Ready`,
-  and confirm the MCP server responds on `mcp.path` through the Substrate router.
-- Cleanup stalls: verify the actor can reach `Suspended`; Substrate deletes only
-  suspended Actors.
+- Task attempt state and `OutcomeUnknown` classification;
+- controller epoch, pool/session generations, exact instance fences, and request digests;
+- prompt leases, permission decisions, cancellation, and external-effect identities;
+- canonical transcript and result finalization;
+- workspace baseline, validated delta, BranchClaim, Publication, and delivery receipt;
+- credential separation and prompt-scoped broker authority.
 
-The E2E script prints failure diagnostics for controller logs, worker Job logs,
-Task YAML, Kubernetes events, and Substrate actor/worker state.
+## Required properties before enablement
 
-## Limitations
+A production integration must prove:
 
-Substrate support is experimental and disabled by default. Production users
-should validate their Substrate installation, runtime artifacts, snapshot store,
-networking, and security posture independently before routing important work
-through this provider.
+1. an Actor maps to one immutable runtime instance and boot identity;
+2. suspension cannot occur during a prompt, validation, publication, finalization, or Session lease release;
+3. resume never silently replays an accepted prompt;
+4. process-tree cleanup and private session filesystem boundaries remain verifiable;
+5. provider and broker capabilities are revoked while idle, suspended, validating, or publishing;
+6. source-read, target-read, target-write, and forge credentials never enter the Actor's ACP process tree;
+7. a replaced or lost Actor is classified using durable Orka state rather than provider history guesses;
+8. cleanup removes all Orka- and Substrate-owned resources for the test trust domain.
 
-Current boundaries:
+## Local evaluation material
 
-- Orka does not install Substrate.
-- Orka does not manage Substrate `WorkerPool` capacity.
-- Orka does not expose provider-native Substrate identifiers in Task status.
-- Orka requires the workspace daemon in compatible ActorTemplates.
-- gVisor/runsc support is a Substrate installation requirement for the current
-  runtime path.
-- `cleanupPolicy: retain` preserves Actor state after secret scrub and suspend;
-  operators are responsible for lifecycle and cost management of retained
-  Actors.
+The existing kind/Substrate demo assets describe an earlier prototype and are not the supported ACP v2 release path. Do not build a runtime image around the removed shared wrapper or validate success through a per-Task worker Job. Current live release validation targets the Kubernetes RuntimePool implementation; Substrate acceptance comes only after an Actor-backed v2 supervisor is implemented and passes the same conformance, crash, security, and publication gates.
diff --git a/website/docs/development/agent-runtime-adapter-contract.md b/website/docs/development/agent-runtime-adapter-contract.md
index 9a1b1e383..33e7f9bf3 100644
--- a/website/docs/development/agent-runtime-adapter-contract.md
+++ b/website/docs/development/agent-runtime-adapter-contract.md
@@ -1,67 +1,110 @@
 # AgentRuntime adapter contract
 
-`orka.harness.v1` is the stable Orka-facing contract for remote execution backends.
+`orka.harness.v2` is the only supported Orka-facing contract for ACP runtime supervisors. It is session-centric, uses `/v2/...` paths, and fails closed on controller/runtime version skew. The old turn-oriented adapter surface is not supported.
 
-## Mandatory endpoints
+## Scope
 
-- `GET /v1/health`
-- `GET /v1/capabilities`
-- `POST /v1/turns`
-- `GET /v1/turns/{turnID}/events?afterSeq=N`
-- `POST /v1/turns/{turnID}/cancel` when `supportsCancel=true`
-- `POST /v1/turns/{turnID}/continue` when brokered profiles are advertised
+Built-in Kubernetes RuntimePools and external `AgentRuntime` registrations share the portable v2 identity, request, event, cancellation, duplicate, and fencing rules. Pool creation, Kubernetes scaling, exact-Pod routing, NetworkPolicy, and rollout are built-in controller behavior rather than portable adapter operations.
 
-## Capability profiles
+The controller validates external registrations and records observed
+capabilities. `Agent.spec.runtime.runtimeRef` Task planning remains fail-closed
+until the external v2 dispatcher support boundary is enabled; registration
+readiness alone does not admit Task execution.
 
-| Profile | Capabilities | Required behavior |
-| --- | --- | --- |
-| observed | `toolExecutionModes: [observed]` | start, stream, terminal result/failure |
-| brokered read | `brokered`, `brokeredToolClasses: [read]`, `supportsContinuation` | emit `ToolCallRequested`, accept `ToolCallResult`, complete |
-| brokered write | `brokeredToolClasses: [write]` | request write intent and wait for Orka continuation after approval |
-| coordination | `brokeredToolClasses: [coordination]` | request Orka coordination tools such as `delegate_task` and `wait_for_tasks` |
+## Probe and control endpoints
 
-Adapters can be brokered-only when they pass the advertised brokered conformance profile.
+Safe unauthenticated probes:
 
-## StartTurn idempotency
+- `GET /v2/health` — liveness only; no session-sensitive data;
+- `GET /v2/capabilities` — static protocol/profile identity, limits, provider capabilities, and workspace-governance claims.
 
-Adapters must not execute the same `turnID` more than once. While a turn is active, a repeated identical `StartTurn` may return the identical accepted response or deterministic `409 Conflict` with the canonical error `turn already exists`. After any terminal frame, repeating `StartTurn` for that `turnID` must return deterministic `409 Conflict` with the canonical error `turn already completed` and must never re-execute the turn. These canonical errors let clients distinguish duplicate recovery from other conflicts such as capacity limits.
+Authenticated control operations:
 
-## StartTurn safe tool schemas
+- `GET /v2/status` — exact instance fence, lifecycle, drain/admission state, resident sessions, prompts, permissions, descendants, and bounded pressure metadata;
+- `PUT /v2/drain` — atomically stop admission of new RuntimeSessions.
 
-When a Task exposes brokered tools, `StartTurnRequest.input.tools` carries safe definitions:
+External runtimes advertise whether they implement the drain extension. All status and mutation operations require controller authentication and operation-scoped authorization.
 
-```json
-{
-  "name": "support-ticket-lookup",
-  "description": "Look up sanitized support evidence",
-  "brokeredClass": "read",
-  "parameters": {"type": "object"}
-}
-```
+## RuntimeSession operations
 
-Adapters must treat these definitions as requestable capabilities only. They are not execution instructions and intentionally omit URLs, credentials, headers, and Secret refs.
+- `PUT /v2/runtime-sessions/{sessionID}` — create one provider process and initialized ACP session;
+- `PUT /v2/runtime-sessions/{sessionID}/prompts/{promptID}` — start one prompt and return a bounded, non-reconnectable NDJSON stream;
+- `PUT /v2/runtime-sessions/{sessionID}/prompts/{promptID}/lease` — renew the bounded prompt lease;
+- `PUT /v2/runtime-sessions/{sessionID}/prompts/{promptID}/permissions/{requestID}` — resolve one ACP permission request;
+- `PUT /v2/runtime-sessions/{sessionID}/prompts/{promptID}/cancel` — cancellation barrier that waits for settlement or forced termination;
+- `PUT /v2/runtime-sessions/{sessionID}/workspace-deltas/{deltaID}` — after prompt settlement, freeze mutations and produce one durable validated workspace delta;
+- `DELETE /v2/runtime-sessions/{sessionID}` — cancel, prove descendant cleanup, remove session state, and return idempotently.
 
-## Event rules
+Do not add prompt replay, stream reconnect, provider-session load, transparent recovery, or workspace checkpoint endpoints.
 
-- Use `ToolCallRequested` to ask Orka for a tool call.
-- Use `/continue` responses to receive Orka-owned `ToolCallResult` values.
-- Do not create canonical approval state yourself. A runtime-originated `ApprovalRequested` frame is persisted only as a runtime diagnostic; Orka creates canonical approvals when policy requires them.
-- Preserve `runtimeSessionID`, `turnID`, `correlationID`, and monotonically increasing `seq` on every frame.
+## Request identity and fencing
 
-## Structured results
+Every mutation is bound to:
 
-Adapters may put structured fields on `TurnCompleted`:
+- runtime instance ID and supervisor boot ID;
+- controller epoch;
+- RuntimePool UID and generation when pool-backed;
+- RuntimeSession UID and generation;
+- immutable runtime-profile digest and digest schema version;
+- Task UID, attempt, prompt ID, operation ID, and request digest where applicable;
+- expiry.
 
-```json
-{
-  "result": "investigation complete",
-  "data": {"incident": "INC-1"},
-  "artifacts": [{"filename": "evidence.json", "contentType": "application/json", "size": 42}]
-}
-```
+A stale fence or digest conflict is a terminal protocol error for that request. An exact duplicate returns the recorded operation state without repeating the side effect. If prompt acceptance is known but the terminal result is not provable, Orka classifies the attempt as outcome unknown rather than replaying it.
 
-Orka stores this as the standard structured result envelope so parent tasks can consume `data` and artifact metadata through `wait_for_tasks`.
+## Event stream
 
-## Local validation
+Prompt responses use NDJSON. Every line carries the immutable prompt identity and a monotonic sequence number. Implementations must enforce the advertised request, line, result, buffer, update-rate, lease, permission, and workspace-delta limits.
 
-Go adapters can import `github.com/orka-agents/orka/pkg/harness` and `github.com/orka-agents/orka/pkg/harness/conformance`. The generic HTTP fixture in `examples/harness/echo` is the reference implementation for observed and brokered read/write profiles. Provider-specific adapters live in separate repositories. Microsoft Foundry users can choose the [Hosted Agents Responses adapter](https://github.com/orka-agents/agent-runtime-foundry) or the [classic Agent Service Threads/Runs adapter](https://github.com/orka-agents/agent-runtime-foundry-classic).
+Independently of those advertised limits, `orka.harness.v2` enforces a fixed, non-negotiable ceiling of 32 MiB of encoded update-event JSON per one-second window. This protocol invariant is not advertised or negotiated and applies in addition to all advertised limits.
+
+Terminal events are mutually exclusive:
+
+- prompt completed;
+- prompt failed;
+- prompt cancelled;
+- prompt outcome unknown.
+
+Assistant updates are diagnostics, not durable authority. Orka owns canonical Task outcome, approvals, external-effect records, workspace validation, publication, and result projection.
+
+## Workspace governance profiles
+
+An external runtime may claim strict `read` or `write` support only if it advertises and passes conformance for all of these guarantees:
+
+- Orka-owned workspace delta production;
+- prompt-scoped broker authorization;
+- no direct SCM publication capability during prompts;
+- Orka-owned clean-room publication;
+- exact-instance fencing;
+- duplicate-safe mutations;
+- cancellation settlement.
+
+A `trusted-non-governed` registration is an explicit operator escape hatch. It must not claim strict workspace guarantees and cannot satisfy a Task that requires them.
+
+## Security boundary
+
+Adapters receive safe tool schemas and operation-scoped authority, never downstream Tool credentials or Git publication credentials. Runtime processes must not have direct SCM publication egress. The separate Workspace/Publisher performs source clone, deterministic commit preparation, exact-ref publication, independent verification, and optional PR reconciliation.
+
+RuntimeSession creation carries the canonical MCP tool and approval policy.
+The provider child may discover that policy while idle, but every execution
+must traverse a credential-protected loopback proxy and the Orka controller
+broker. Each call binds the RuntimeSession, Task UID/attempt, prompt ID, lease
+generation/expiry, runtime fences, tool descriptor, arguments digest, and
+approval evidence. Prompt settlement, cancellation, lease expiry, poisoning,
+and deletion revoke the authority and cancel in-flight calls. Consequential
+calls reserve a durable `ExternalEffect` identity and may replay only a
+committed matching response.
+
+Git/forge operations are outside this broker. The Workspace/Publisher obtains
+frozen source-read, target-read, target-write, and forge credentials from the
+controller credential broker and obtains artifact bytes through short-lived
+artifact capabilities. Neither broker grants session-wide authority.
+
+Runtime children must start from an allowlisted environment with private `HOME`, `TMPDIR`, XDG paths, workspace, process group/session, and unique UID/GID. The supervisor must reap all descendants and poison the runtime instance when cleanup cannot be proven.
+
+## Registration
+
+An external v2 registration pins the endpoint, two controller-side auth references, exact runtime/profile identity, limits, drain support, and governance mode. Start from `config/samples/core_v1alpha1_agentruntime.yaml` and make every declared capability match the runtime's responses exactly.
+
+## Conformance
+
+The reusable conformance implementation lives under `internal/harness/v2/conformance`. It checks protocol identity, endpoint safety, authentication, mutation capabilities, duplicate handling, fencing, cancellation, bounded event streams, workspace-delta behavior, and governance claims. A registration becoming Ready records the exact matching generation, instance/profile, auth Secret versions, workspace intent, and governance surface, but does not currently permit `runtimeRef` Task dispatch.
diff --git a/website/docs/development/development.md b/website/docs/development/development.md
index 4b77df708..7baecd188 100644
--- a/website/docs/development/development.md
+++ b/website/docs/development/development.md
@@ -25,8 +25,10 @@ make build
 # Build CLI only
 make build-cli
 
-# Run locally
-make run
+# Run locally with one persistent AES-256 snapshot key
+openssl rand 32 > /path/outside-the-repository/orka-snapshot-key
+chmod 600 /path/outside-the-repository/orka-snapshot-key
+make run RUN_AGENT_EXECUTION_SNAPSHOT_KEY_FILE=/path/outside-the-repository/orka-snapshot-key
 ```
 
 ## Helm Chart Generation and Releases
@@ -80,23 +82,28 @@ See [Testing](testing.md) for full test structure and patterns.
 
 The repository has additional GitHub Actions workflows in addition to the normal test matrix:
 
-- `Live Copilot Proxy E2E` — exercises live model-backed Orka paths through the copilot-proxy harness.
+- `Live ACP Runtime E2E` — runs on trusted default-branch changes, nightly, or by manual dispatch. It builds the current controller and all four built-in runtime images, bootstraps Kind plus Vekil and the production ACP topology, and executes live Codex, OpenCode, Claude, and Copilot RuntimePools through the canonical smoke validator.
+- `Live ACP Release Gate` — is a manual, protected-environment destructive gate that adds result/fork checks, clean-room publication to a distinct fork, PR verification and cleanup, scale-to-zero recovery, and immutable-image assertions.
+- `Live Copilot Proxy E2E` — exercises native `type: ai` and compatibility API paths through an external proxy used as test infrastructure. The canonical live ACP workflow separately executes the built-in Codex, OpenCode, Claude, and Copilot RuntimePools end to end.
 - `Live Agent Sandbox E2E` — installs the pinned upstream `agent-sandbox` release in Kind, builds the PR controller plus fake Claude/sandbox-runtime and upstream router images, then validates workspace claim, sandbox execution, delete cleanup, retained-session reuse, and token scrubbing without model access.
 - `Live GitHub Label Trigger E2E` — builds the PR controller image, deploys it to Kind, configures a generated webhook secret and synthetic runtime Agent, then verifies signed label webhooks create scoped agent Tasks while invalid signatures and duplicate deliveries are handled correctly. This workflow is manual, model-free, and secret-free.
 - `Live GitHub OIDC E2E` — builds the PR controller image, deploys it to Kind, authenticates to Orka with a real GitHub Actions OIDC token, and verifies `spec.requestedBy` stamping plus client provenance-tampering rejection.
 - `Gateway Live E2E` — runs on relevant pushes and pull requests or by manual dispatch. It creates a fresh Kind cluster, generates disposable TLS and bearer credentials, deploys the TLS reference adapter and deterministic echo `AgentRuntime`, and verifies invalid authentication, accepted and duplicate ingress, runtime-backed Task completion, final delivery, idempotency, and correlation metadata. It is model-free and secret-free and does not use repository or provider credentials.
 - `Repository Monitor Smoke` — runs automatically on PRs and pushes touching monitor-relevant Go, CRD/config, worker, or dependency paths. It creates the UI embed stub and runs focused Go tests for monitor store/API/controller behavior, GitHub pull request event queueing, targeted single-PR inventory runs, read-only review task job construction, stdout result forwarding, `create_pr_monitor` repository URL and credential validation, GitHub tool `repo_url` scope enforcement, and PR review marker tooling.
-- `Agent Substrate E2E` — installs Agent Substrate and Orka into a fresh Kind cluster, creates Orka-compatible `WorkerPool`/`ActorTemplate` resources, validates direct Substrate actor execution, runs default and pooled Orka Tasks through the Substrate workspace provider, exercises pooled MCP actor-backed Tools, and checks workspace placement/density telemetry. This workflow is secret-free.
+- `Agent Substrate E2E` — exercises the archived execution-workspace prototype. It is secret-free but is not an ACP v2 release gate and does not validate RuntimePool, prompt fencing, clean-room publication, or restart semantics.
 
 Validate workflow/script edits locally before pushing:
 
 ```bash
 bash -n scripts/live-copilot-proxy-e2e.sh
+bash -n scripts/live-acp-runtime-e2e.sh scripts/live-acp-runtime-kind-e2e.sh scripts/lib/live-acp-runtime-kind-bootstrap.sh
 bash -n scripts/live-agent-sandbox-e2e.sh
 bash -n scripts/live-github-label-trigger-e2e.sh
 bash -n scripts/live-github-oidc-e2e.sh
 bash -n scripts/agent-substrate-e2e.sh
 go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/live-copilot-proxy-e2e.yml
+go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/live-acp-runtime-e2e.yml
+go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/live-acp-release-gate.yml
 go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/live-agent-sandbox-e2e.yml
 go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/live-github-label-trigger-e2e.yml
 go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/live-github-oidc-e2e.yml
@@ -105,7 +112,7 @@ go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/repos
 go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/agent-substrate-e2e.yml
 ```
 
-The agent sandbox live script does not require provider credentials or model access. It uses a deterministic fake `claude` CLI in the sandbox runtime image so CI can verify Orka's sandbox plumbing independently from external LLM availability.
+The agent-sandbox and Substrate scripts exercise the earlier execution-workspace prototype. They are not ACP v2 release evidence; the current built-in path rejects `Task.spec.execution.workspace`.
 
 The GitHub OIDC live script requires GitHub Actions `id-token: write` or a manual `ORKA_GITHUB_OIDC_TOKEN`; without either, it fails fast before creating a cluster. Transaction-token provider E2E now lives in the external integration repository.
 
@@ -120,8 +127,7 @@ bash scripts/agent-substrate-e2e.sh
 
 ## Harness wrapper real-world validation
 
-When changing the agent-harness-wrapper, validate it against a live cluster, not
-only unit tests. Follow the canonical [Live validation checklist](../guides/cli-harness-wrapper.md#live-validation-checklist).
+When changing ACP runtime supervision or broker boundaries, validate them against a live cluster, not only unit tests. Use `scripts/live-acp-runtime-e2e.sh` for an already deployed cluster, or `scripts/live-acp-runtime-kind-e2e.sh` to create the same ephemeral Kind/Vekil topology used by CI.
 
 ## OpenTelemetry development
 
@@ -129,9 +135,9 @@ Telemetry is enabled with `--enable-telemetry` (or the legacy alias
 `--enable-tracing`) and exported through `OTEL_EXPORTER_OTLP_ENDPOINT`. When the
 controller flag is enabled and a worker-reachable OTLP endpoint is configured,
 AI worker Jobs receive `ORKA_ENABLE_TELEMETRY=true`, `ORKA_TRACEPARENT`, and the
-non-secret standard OTLP environment. Agent-runtime and harness-wrapper
-telemetry is explicit opt-in on those workloads; OTLP endpoint variables alone
-do not enable Kubernetes worker telemetry. Delegated child Tasks continue the
+non-secret standard OTLP environment. ACP RuntimePool telemetry is explicit
+opt-in on the managed runtime workload; OTLP endpoint variables alone do not
+enable runtime telemetry. Delegated child Tasks continue the
 active parent trace through Task annotations.
 
 GenAI semantic-convention constants live in `internal/tracing/genai` rather than
@@ -139,7 +145,7 @@ upstream `semconv` because the GenAI conventions are still Development-stage.
 Run focused telemetry tests with:
 
 ```bash
-go test ./internal/tracing/... ./internal/llm/ ./internal/tools/ ./internal/worker ./workers/ai ./workers/harness/cliwrapper -run 'Tracing|Telemetry|GenAI|ExecuteTool|TraceContext|Traceparent|TaskRun|DelegateTrace' -v
+go test ./internal/tracing/... ./internal/llm/ ./internal/tools/ ./internal/worker ./workers/ai ./internal/harness/v2/... ./internal/acp/... ./workers/acp/... -run 'Tracing|Telemetry|GenAI|ExecuteTool|TraceContext|Traceparent|TaskRun|RuntimeSession|Fence' -v
 ```
 
 The live Kind e2e coverage for collector export lives in
@@ -168,17 +174,25 @@ make ui-test-coverage   # Run UI tests with coverage
 
 ```bash
 # Build images
-make docker-build                  # Controller image
-make docker-build-ai-worker        # AI worker
-make docker-build-general-worker   # General worker
-make docker-build-harness-wrapper  # Agent CLI harness wrapper (codex/claude/copilot/opencode)
-make docker-build-all              # Controller, workers, and harness wrapper
+make docker-build                       # Controller image
+make docker-build-ai-worker             # Native AI worker
+make docker-build-general-worker        # General worker
+make docker-build-acp-codex-runtime      # Immutable Codex ACP runtime
+make docker-build-acp-claude-runtime     # Immutable Claude ACP runtime
+make docker-build-acp-copilot-runtime    # Immutable GitHub Copilot ACP runtime
+make docker-build-acp-opencode-runtime    # Immutable OpenCode ACP runtime
+make docker-build-workspace-publisher    # Clean-room Workspace/Publisher
+make docker-build-all
 
 # Push images
 make docker-push
 make docker-push-ai-worker
 make docker-push-general-worker
-make docker-push-harness-wrapper
+make docker-push-acp-codex-runtime
+make docker-push-acp-claude-runtime
+make docker-push-acp-copilot-runtime
+make docker-push-acp-opencode-runtime
+make docker-push-workspace-publisher
 make docker-push-all
 ```
 
@@ -186,9 +200,15 @@ make docker-push-all
 
 ```bash
 kind create cluster
-make docker-build docker-push IMG=<registry>/orka:tag
-make docker-build-harness-wrapper docker-push-harness-wrapper HARNESS_WRAPPER_IMG=<registry>/agent-harness-wrapper:tag
-make deploy IMG=<registry>/orka:tag HARNESS_WRAPPER_IMG=<registry>/agent-harness-wrapper:tag
+make docker-build-all
+# Push/load the images, then use immutable runtime digests for deployment.
+make deploy \
+  IMG=<repo>@sha256:<controller-digest> \
+  ACP_CODEX_RUNTIME_IMG=<registry>/acp-codex@sha256:<digest> \
+  ACP_CLAUDE_RUNTIME_IMG=<registry>/acp-claude@sha256:<digest> \
+  ACP_COPILOT_RUNTIME_IMG=<registry>/acp-copilot@sha256:<digest> \
+  ACP_OPENCODE_RUNTIME_IMG=<registry>/acp-opencode@sha256:<digest> \
+  WORKSPACE_PUBLISHER_IMG=<repo>@sha256:<publisher-digest>
 ```
 
 ### Demo Cluster + Recordings
@@ -250,4 +270,7 @@ HTTP/2 is disabled for metrics and webhook servers due to CVEs ([GHSA-qppj-fm5r-
 
 ### Leader Election
 
-Leader election ID is hardcoded as `03b49a10.orka.ai`. Multiple controller deployments in the same cluster will coordinate via this ID.
+Leader election ID is hardcoded as `03b49a10.orka.ai`, and its Lease is stored
+in the controller's required non-empty watch namespace. Static `harness-v1` and
+`harness-v2` installations use different watched namespaces and therefore
+different Leases; they do not coordinate ownership of one Task population.
diff --git a/website/docs/development/security-scanning-design.md b/website/docs/development/security-scanning-design.md
index 61c5732f9..ce8a593b8 100644
--- a/website/docs/development/security-scanning-design.md
+++ b/website/docs/development/security-scanning-design.md
@@ -9,7 +9,7 @@ controller ingestion flow, artifact contract, and agent prompt contracts. For th
 user-facing workflow, see [Repository Security Scanning](../guides/repository-security-scanning.md).
 
 The feature is GitHub-first, human-in-the-loop for remediation, and built on top of Orka's
-existing task, agent runtime, artifact, scheduling, and PR plumbing rather than a parallel
+existing Task, ACP RuntimePool, artifact, scheduling, clean-room publication, and PR plumbing rather than a parallel
 execution system.
 
 ## Design Decisions
@@ -18,7 +18,7 @@ execution system.
 |----------|-----------|
 | **`RepositoryScan` is a first-class CRD**, not config embedded in ad hoc tasks | Scan config is durable, namespace-scoped, and policy-like, with its own status, conditions, and reconciliation lifecycle. Dynamic outputs (findings, evidence) stay in SQLite. |
 | **Dynamic security data lives in SQLite**, not CRD status | Findings are high-volume and change frequently; the store enables filtering by repository, severity, validation status, and patch status, consistent with results/plans/sessions/artifacts. |
-| **Scans run as Kubernetes-backed tasks** with a git workspace | Threat-model, review, validation, and patch work run as agent tasks. The deterministic mapper runs as a container task using the managed general worker, so slice generation does not require model access. |
+| **Scans run as Kubernetes-backed Tasks** with verified workspaces | Threat-model, review, validation, and patch work run as ACP agent Tasks. The deterministic mapper remains a container Task using the managed general worker. |
 | **Human approval is mandatory for remediation** | Patch generation and PR creation are explicit user actions, matching the safer Codex Security interaction pattern and reducing the risk of noisy or unsafe automated changes. |
 
 This design mirrors the broad Codex Security workflow (threat model first; scan history and
@@ -55,7 +55,7 @@ Fiber API (/api/v1/security/*)
   +--> Task creation for scan runs / patch runs
            |
            v
-      Agent/general worker (git workspace)
+      ACP RuntimeSession / general worker
            |
            +--> result summary
            +--> security-slices.json
@@ -123,7 +123,7 @@ Notes:
 
 - `provider` defaults to `github`.
 - `branch` currently defaults to the literal `main` when omitted (`security.EffectiveBranch`); it is **not** resolved from the repository's actual default branch. Set `spec.branch` explicitly for repositories whose default branch is not `main` (e.g. `master`, `trunk`).
-- `ref` optionally pins scan tasks to a tag, branch, or commit SHA. Ref-only scans leave the worker workspace branch empty so the checkout can resolve the ref directly; trusted finding metadata reports the branch as `ref:<ref>`.
+- `ref` optionally pins scan Tasks to a tag, branch, or commit SHA. Ref-only scans leave `workspace.branch` empty so the clean-room source boundary resolves the ref directly; trusted finding metadata reports the branch as `ref:<ref>`.
 - `schedule` uses the same cron format as `Task.spec.schedule`.
 - `historyDays` is intentionally simpler than a custom `30d` duration parser.
 - `forkRepo` and `prBaseBranch` map directly to existing workspace/PR concepts.
@@ -528,13 +528,15 @@ spec:
   prompt: "<generated prompt>"
   timeout: "2h"
   priority: 700
+  workspace:
+    intent: read
+    gitRepo: "https://github.com/org/repo.git"
+    branch: "main"
+    readCredentialRef:
+      name: repo-read-creds
+    subPath: "services/api"
   agentRuntime:
-    workspace:
-      gitRepo: "https://github.com/org/repo.git"
-      branch: "main"
-      gitSecretRef:
-        name: repo-git-creds
-      subPath: "services/api"
+    maxTurns: 100
 ```
 
 ### Scan logic
@@ -547,9 +549,12 @@ spec:
   If unchanged, mark the run succeeded with a no-op summary; if changed, focus the agent on
   commits after the last processed SHA while still using the current threat model as
   context and slice-aware changed-file selection.
-- **Patch**: create a dedicated `type: agent` task with `pushBranch` set to
-  `orka/security/<finding-id>` (using `forkRepo`/`prBaseBranch` when configured), prompt for
-  a minimal reviewable fix, a diff artifact, and a patch summary artifact. A
+- **Patch**: create a dedicated `type: agent` Task with `workspace.intent: write`,
+  map `RepositoryScan.spec.gitSecretRef` into separate Task read/publication credential
+  roles, set `workspace.pushBranch` to `orka/security/<finding-id>`, and use
+  `RepositoryScan.spec.forkRepo` / `prBaseBranch` for the publication target when configured.
+  The ACP child edits files only; the Workspace/Publisher prepares and verifies delivery.
+  Prompt for a minimal reviewable fix, a diff artifact, and a patch summary artifact. A
   `PatchProposal` transitions to `succeeded` only after Orka confirms the task completed,
   branch metadata is present, the summary changed-file list matches the structured
   workspace result, and the diff artifact matches the actual workspace diff.
@@ -572,9 +577,9 @@ Orka-owned stable fingerprint, records dropped diagnostics for rejected findings
 updates accepted/dropped counts on the scan run.
 
 When a labeled security **patch** task completes, the controller locates the associated
-finding, parses the structured worker result, loads `security-patch-<finding-id>.diff` and
-`security-patch-<finding-id>.json`, verifies both artifacts against actual workspace
-changes, upserts the `PatchProposal`, and updates finding state to `patch_ready` only when
+finding, parses the structured Task result, loads `security-patch-<finding-id>.diff` and
+`security-patch-<finding-id>.json`, verifies both artifacts against the validated workspace
+delta and delivery receipt, upserts the `PatchProposal`, and updates finding state to `patch_ready` only when
 verification succeeds.
 
 ## Prompt Contracts
@@ -594,7 +599,7 @@ and avoid creating a PR directly (PR creation is the API action).
 The security API reuses the shared GitHub helper code that backs the built-in PR tools
 (`internal/tools/create_pull_request.go`, `review_pull_request.go`, `merge_pull_request.go`)
 rather than duplicating GitHub API calls in handlers. `POST /api/v1/security/findings/:id/pull-request`
-loads the latest successful `PatchProposal`, verifies it has a pushed branch, derives the PR
+loads the latest successful `PatchProposal`, verifies it has an independently verified publication branch, derives the PR
 title/body from the finding title and remediation summary, opens the PR against
 `RepositoryScan.spec.prBaseBranch` (or the scan branch), and updates the patch proposal and
 finding rows.
@@ -616,8 +621,8 @@ you can scrape. (For metrics Orka actually exposes, see
 
 ## Safety
 
-- Workers run in isolated pods with the existing hardened defaults.
-- Private repositories require an explicit `gitSecretRef` or detected credentials.
+- Agent stages run through ACP RuntimePools; native mapper/container stages keep hardened per-Task Pods.
+- `RepositoryScan.spec.gitSecretRef` remains the CRD compatibility field and is mapped into Task read/publication credential roles; the ACP child never receives it.
 - PRs are never opened without an explicit user action.
 - Artifact filenames stay flat and sanitized within the artifact upload model.
 - Oversized evidence is truncated/summarized to stay below the 10 MB per-file and 50 MB
diff --git a/website/docs/development/testing.md b/website/docs/development/testing.md
index cd4f4b9d1..946191c85 100644
--- a/website/docs/development/testing.md
+++ b/website/docs/development/testing.md
@@ -26,7 +26,6 @@ make test-e2e
 # Run only the deterministic Gateway live E2E
 KIND_CLUSTER=orka-gateway-e2e \
 E2E_GATEWAY=true \
-E2E_AGENTRUNTIME_EXTERNAL=true \
 E2E_EPHEMERAL_CLUSTER=true \
 E2E_GINKGO_FOCUS="Gateway live E2E" \
 make test-e2e
@@ -61,7 +60,7 @@ Tests use **Ginkgo + Gomega** (BDD style) for controller/integration tests and s
 | `internal/worker/` | `tool_executor_test.go` | Custom Tool CRD executor |
 | `workers/ai/` | `main_test.go` | AI worker functions |
 | `workers/general/` | `main_test.go` | General worker functions |
-| `workers/harness/cliwrapper/` | adapter and server tests | CLI harness wrapper, including Codex, Claude, Copilot, OpenCode, generic, conformance, cancellation, and redaction |
+| `internal/harness/v2/`, `internal/acp/`, `workers/acp/` | ACP contract, client, supervisor, and conformance tests | RuntimeSession lifecycle, exact fences, duplicate handling, event bounds, cancellation, workspace deltas, process cleanup, and redaction |
 
 ### E2E Tests
 
@@ -71,7 +70,7 @@ End-to-end tests run against a dedicated Kind cluster:
 |-----------|----------|
 | `test/e2e/e2e_test.go` | Core task lifecycle |
 | `test/e2e/agent_test.go` | Agent task execution |
-| `test/e2e/agent_copilot_test.go` | Copilot runtime |
+| `test/e2e/agent_copilot_test.go` | Copilot built-in profile admission plus exact digest-pinned RuntimePool image selection, without requiring live provider authentication |
 | `test/e2e/agent_claude_test.go` | Claude runtime |
 | `test/e2e/agent_workspace_test.go` | Workspace/git clone |
 | `test/e2e/agent_session_test.go` | Session continuity |
@@ -82,12 +81,12 @@ End-to-end tests run against a dedicated Kind cluster:
 | `test/e2e/chat_advanced_test.go` | JSON chat mode, `agentRef` chat routing, management tools via chat |
 | `test/e2e/security_enforcement_test.go` | Non-root execution, read-only filesystem, deny-pattern enforcement, kube-system chat block |
 | `test/e2e/agent_advanced_test.go` | Skills ConfigMap wiring, agent resource propagation, session maxMessages behavior |
-| `test/e2e/workspace_advanced_test.go` | Advanced workspace settings (`gitSecretRef`, `subPath`, `ref`, fork/PR env vars, session init container) |
+| `test/e2e/workspace_advanced_test.go` | Workspace source/ref/subPath, separate read/publication credential roles, delivery status, and Session behavior |
 | `test/e2e/provider_advanced_test.go` | Provider rate-limit config coverage |
-| `test/e2e/live_copilot_proxy_test.go` | Live Orka Provider + `type: ai` path using copilot-proxy as the backend harness, including durable memory recall, proposal governance, and transcript search tool execution |
+| `test/e2e/live_copilot_proxy_test.go` | Native `type: ai` Provider compatibility against the separately deployed copilot-proxy service; this is separate from built-in Copilot ACP RuntimePool coverage |
 | `test/e2e/live_chat_api_test.go` | Live chat SSE and JSON transport/session coverage using a proxy-backed Provider |
 | `test/e2e/live_anthropic_compat_test.go` | Live Anthropic-compatible `/anthropic/v1/models` and `/anthropic/v1/messages` coverage with default tools-enabled behavior |
-| `test/e2e/live_agent_runtime_matrix_test.go` | Live Orka runtime matrix: Codex+GPT, Claude Code+Claude, Copilot+Gemini |
+| `test/e2e/live_agent_runtime_matrix_test.go` | Historical live Codex/Claude provider execution plus a digest-pinned Copilot image smoke assertion; it is not the canonical ACP release gate |
 | `test/e2e/gateway_test.go` | Authenticated Gateway ingress through a deterministic external `AgentRuntime`, including TLS adapter readiness, invalid bearer rejection, accepted and duplicate events, Task execution, completed events, delivered replies, idempotency, and Task/delivery correlation |
 | `.github/workflows/gateway-e2e.yml` | Focused, model-free, secret-free Gateway live E2E in Kind using generated bearer tokens, an ephemeral CA, the TLS reference adapter, and the deterministic echo runtime |
 | `.github/workflows/live-agent-sandbox-e2e.yml` / `scripts/live-agent-sandbox-e2e.sh` | Live upstream `agent-sandbox` Kind validation for Orka agent workspace claim, sandbox execution, delete cleanup, retained-session reuse, and token scrubbing using a fake model-free Claude runtime |
@@ -97,6 +96,9 @@ End-to-end tests run against a dedicated Kind cluster:
 | `test/e2e/tools_test.go` | Built-in tools (including `web_fetch`, `file_write`) and custom Tool CRD |
 | `test/e2e/scheduled_task_test.go` | Cron scheduling, suspend, `concurrencyPolicy: Forbid`, history-limit cleanup |
 | `test/e2e/task_lifecycle_test.go` | Timeout/retry/cancel plus session serialization and lock release |
+| `scripts/live-acp-runtime-e2e.sh` | Canonical deployed-cluster ACP smoke/release gate for Codex, OpenCode, Claude, and Copilot RuntimePools, exact Pod/runtime identity, workspace read/write, continuation/fork, cancellation/timeout, restart/replacement, publication/PR verification, drain/scale-to-zero, immutable images, and cleanup |
+| `.github/workflows/live-acp-runtime-e2e.yml` / `scripts/live-acp-runtime-kind-e2e.sh` | Trusted-branch/nightly/manual live ACP smoke that bootstraps an ephemeral Kind cluster, Vekil, and the production ACP topology before invoking the canonical validator |
+| `.github/workflows/live-acp-release-gate.yml` / `scripts/live-acp-runtime-kind-e2e.sh` | Manual, protected-environment release acceptance with destructive publication, independent GitHub verification, PR reconciliation, and cleanup |
 
 The Gateway Live E2E workflow (`.github/workflows/gateway-e2e.yml`) runs on manual dispatch and on pull requests or pushes that touch Gateway-relevant source, configuration, E2E, image, or dependency paths. It creates a dedicated Kind cluster, generates disposable TLS and bearer credentials, deploys the TLS reference adapter and deterministic echo `AgentRuntime`, and verifies invalid bearer rejection, accepted and duplicate ingress, runtime-backed Task completion, final delivery, idempotency, and correlation metadata. The workflow is model-free and secret-free; it does not use repository or provider credentials.
 
@@ -109,38 +111,117 @@ missing or mismatched artifacts staying not ready.
 
 ### E2E Key Requirements
 
-- `E2E_OPENAI_API_KEY`: required for LLM-backed tests (AI chat/tasks, coordination, PR workflow orchestration)
-- `E2E_ANTHROPIC_API_KEY`: required for Anthropic-specific e2e cases
-- `E2E_GITHUB_TOKEN`: required for GitHub/Copilot and live Copilot runtime tests
-- `COPILOT_GITHUB_TOKEN`: required by the live `copilot-proxy` workflow for proxy auth
-- The live agent sandbox workflow requires Docker, Kind, kubectl, curl, jq, and network access to install the pinned upstream `agent-sandbox` release. It does not require model credentials.
+- `scripts/live-acp-runtime-e2e.sh --context <context>` is the canonical ACP
+  deployed-cluster validator. Its default mode is a smoke test; set
+  `RELEASE_GATE=1` for destructive release acceptance. A smoke result explicitly
+  reports the publication, remote-verification, Task result/fork, and
+  scale-to-zero scenarios that remain release-only.
+- `scripts/live-acp-runtime-kind-e2e.sh` is the CI/local bootstrap entrypoint. It
+  creates an ephemeral Kind cluster, deploys Vekil and the production ACP
+  topology with digest-pinned local images, and then calls the canonical script.
+- `.github/workflows/live-acp-runtime-e2e.yml` runs on relevant pushes to the
+  default branch, nightly, and manual dispatch. It uses the
+  `live-acp-runtime-smoke` environment and requires its
+  `COPILOT_GITHUB_TOKEN` secret so Vekil can exercise Codex, OpenCode, Claude, and Copilot
+  without mounting provider credentials into RuntimePools. Restrict that
+  environment to the default branch; do not require reviewers if scheduled runs
+  must proceed unattended.
+- `.github/workflows/live-acp-release-gate.yml` is manual-only and serialized.
+  Protect the `live-acp-release-gate` environment with required reviewers and a
+  default-branch deployment rule. It accepts explicit source/fork URLs, a full
+  source SHA that must equal the dispatched workflow commit and default-branch
+  head, and the default branch as the PR base. It requires these environment
+  secrets:
+  `COPILOT_GITHUB_TOKEN`, `ACP_E2E_WRITE_READ_CREDENTIAL_TOKEN`,
+  `ACP_E2E_WRITE_TARGET_READ_CREDENTIAL_TOKEN`,
+  `ACP_E2E_WRITE_CREDENTIAL_TOKEN`, and
+  `ACP_E2E_WRITE_FORGE_CREDENTIAL_TOKEN`. Configure the four publication
+  credentials as distinct, least-privilege GitHub credentials for source read,
+  target read, target write, and forge/verification cleanup respectively.
+- Neither live ACP workflow runs for `pull_request`, so PR-controlled code never
+  receives provider or publication credentials. Both check out with persisted
+  credentials disabled and expose secrets only to the final local script step.
+  They intentionally keep `permissions` at `contents: read` and do not request
+  `id-token: write`; GitHub OIDC validation remains isolated in
+  `live-github-oidc-e2e.yml`.
+- The release gate additionally requires digest-pinned controller, Publisher,
+  Codex, OpenCode, Claude, and Copilot images; a Ready central provider proxy; the
+  `config/acp-production` Vekil ingress boundary; durable controller/Publisher
+  PVCs; a distinct publication fork; and authenticated `gh` access for
+  independent remote and PR verification/cleanup.
+- Canonical ACP acceptance runs all Codex scenarios, including publication,
+  before deleting the Codex pool and starting OpenCode. It validates OpenCode
+  native ACP read, continuation, and read-intent tool policy, deletes the
+  OpenCode pool, starts Claude, and then runs live Copilot read/continuation
+  after Claude cleanup. Every provider phase verifies exact Pod UID, image ID,
+  runtime instance/profile, and RuntimeSession identity. Codex additionally
+  covers cancellation and timeout settlement, controller restart, pool
+  replacement, drain/scale-to-zero, and publication/remote delivery; release
+  mode also exercises Task forks.
+- `E2E_OPENAI_API_KEY` and `E2E_ANTHROPIC_API_KEY` remain inputs for older native
+  `type: ai` test cases. They are not mounted into built-in ACP RuntimePools.
+- `COPILOT_GITHUB_TOKEN` also remains the credential for
+  `live-copilot-proxy-e2e.yml`, which covers the external proxy as native
+  Provider test infrastructure. The canonical live ACP workflow is the
+  provider-execution evidence for the built-in RuntimePool profiles.
+- Structural e2e tests for native worker Jobs run without external model keys.
+- The live agent-sandbox and Agent Substrate workflows are archived/deferred
+  execution-workspace evaluations, not ACP v2 release gates.
+- Security Scan E2E is secret-free and model-free, but requires Docker plus the
+  local Go, Kind, kubectl, curl, and jq toolchain.
+
 - The live GitHub label trigger workflow is manual, model-free, and secret-free. It requires Docker, Kind, kubectl, curl, jq, and Python locally, accepts `GITHUB_LABEL_TRIGGER_TARGET_REPO_URL` and `GITHUB_LABEL_TRIGGER_TARGET_NUMBER` overrides, and sends only synthetic webhook payloads to the local Orka API.
-- Gateway Live E2E is model-free and secret-free. Its focused invocation sets `E2E_GATEWAY=true`, `E2E_AGENTRUNTIME_EXTERNAL=true`, and `E2E_EPHEMERAL_CLUSTER=true`; the last flag skips per-resource suite cleanup because the caller deletes the entire Kind cluster.
+- Gateway Live E2E is model-free and secret-free. Its focused invocation sets `E2E_GATEWAY=true` and `E2E_EPHEMERAL_CLUSTER=true`; the last flag skips per-resource suite cleanup because the caller deletes the entire Kind cluster.
 - GitHub Actions `id-token: write` permission: required by the live GitHub OIDC workflow. For local/manual runs of `scripts/live-github-oidc-e2e.sh`, set `ORKA_GITHUB_OIDC_TOKEN` to a valid JWT instead. Provider-specific transaction-token E2E lives in the external integration repositories.
 - `E2E_LIVE_COPILOT_PROXY_BASE_URL` (or `E2E_COPILOT_PROXY_BASE_URL` / `COPILOT_PROXY_BASE_URL`): enables the focused live copilot-proxy spec against a running proxy
-- `E2E_LIVE_COPILOT_PROXY_SERVICE_NAMESPACE`, `E2E_LIVE_COPILOT_PROXY_SERVICE_NAME`, `E2E_LIVE_COPILOT_PROXY_SERVICE_PORT`: optional overrides for how the live spec reaches the in-cluster proxy service for `/readyz` and `/v1/models` checks
-- Structural e2e tests (job/env/volume assertions) run without external model keys
-- Security Scan E2E is secret-free and model-free, but requires Docker plus local toolchain dependencies: Go, `kind`, `kubectl`, `curl`, and `jq`
-- Agent Substrate E2E is secret-free, but requires Docker plus local toolchain dependencies: Go, git, curl, `kind`, `kubectl`, `ko`, and `jq`
+- `E2E_LIVE_COPILOT_PROXY_SERVICE_NAMESPACE`, `E2E_LIVE_COPILOT_PROXY_SERVICE_NAME`, `E2E_LIVE_COPILOT_PROXY_SERVICE_PORT`: direct-access proxy coordinates used by the legacy Provider, Chat, and Anthropic compatibility specs.
+- `E2E_LIVE_ACP_PROVIDER_PROXY_SERVICE_NAMESPACE`, `E2E_LIVE_ACP_PROVIDER_PROXY_SERVICE_NAME`, `E2E_LIVE_ACP_PROVIDER_PROXY_SERVICE_PORT`: model-discovery coordinates for the ACP RuntimePool matrix. The full live script pins these to `vekil-system`, `vekil`, and `1337` so built-in RuntimePools traverse the production provider-proxy DNS and NetworkPolicy boundary.
+
 
-The live copilot-proxy E2E path runs in a separate workflow and executes the focused live suites for:
+Run the trusted smoke bootstrap locally with the token exported in the shell
+rather than placed on a command line:
 
-- provider-backed `type: ai` tasks, including durable memory/tool execution coverage
-- chat SSE/JSON flows via `/api/v1/chat`
-- Anthropic-compatible `/anthropic/v1/models` and `/anthropic/v1/messages` flows with the default Orka tool loop enabled
-- external agent runtimes across `codex` + GPT, `claude` + Claude, and `copilot` + Gemini
+```bash
+read -rsp 'Copilot provider token: ' COPILOT_GITHUB_TOKEN && echo
+export COPILOT_GITHUB_TOKEN
+export ACP_E2E_OPENCODE_MODEL=openai/gpt-5.4
+export ACP_E2E_OPENCODE_CONTEXT_WINDOW=32768
+export ACP_E2E_OPENCODE_MAX_TOKENS=4096
+ACP_E2E_KIND_TAG=local bash scripts/live-acp-runtime-kind-e2e.sh
+```
 
-This is an **Orka** live integration suite, not a deep `copilot-proxy` feature suite. The proxy is test harness infrastructure that gives non-Copilot runtimes access to live GPT, Claude, and Gemini models in CI. The only proxy-specific assertions are smoke checks that the harness is alive and usable:
+For a manual release gate, also export the four role-specific credential values,
+set `ACP_E2E_WRITE_SOURCE_REPO`, `ACP_E2E_WRITE_PUBLICATION_REPO`,
+`ACP_E2E_WRITE_SOURCE_REF`, and `ACP_E2E_WRITE_PR_BASE`, then run:
+
+```bash
+export RELEASE_GATE=1
+export ACP_E2E_WRITE_CREATE_PR=1
+export ACP_E2E_WRITE_SOURCE_REPO=https://github.com/orka-agents/orka.git
+export ACP_E2E_WRITE_PUBLICATION_REPO=https://github.com/OWNER/orka.git
+export ACP_E2E_WRITE_SOURCE_REF="$(git rev-parse HEAD)"
+export ACP_E2E_WRITE_PR_BASE=main
+read -rsp 'Source-read token: ' ACP_E2E_WRITE_READ_CREDENTIAL_TOKEN && echo
+read -rsp 'Target-read token: ' ACP_E2E_WRITE_TARGET_READ_CREDENTIAL_TOKEN && echo
+read -rsp 'Target-write token: ' ACP_E2E_WRITE_CREDENTIAL_TOKEN && echo
+read -rsp 'Forge token: ' ACP_E2E_WRITE_FORGE_CREDENTIAL_TOKEN && echo
+export ACP_E2E_WRITE_READ_CREDENTIAL_TOKEN ACP_E2E_WRITE_TARGET_READ_CREDENTIAL_TOKEN
+export ACP_E2E_WRITE_CREDENTIAL_TOKEN ACP_E2E_WRITE_FORGE_CREDENTIAL_TOKEN
+export GH_TOKEN="${ACP_E2E_WRITE_FORGE_CREDENTIAL_TOKEN}"
+bash scripts/live-acp-runtime-kind-e2e.sh
+```
 
-- `/readyz` returns healthy
-- `/v1/models` is non-empty
-- GPT, Claude, and Gemini model families are present
+In release mode the Kind wrapper binds `ACP_E2E_REPO` and `ACP_E2E_REF` to the
+write source repository and SHA, and rejects explicitly supplied read values
+that differ. The read/runtime phases and publication phase therefore validate
+the same immutable source.
 
-It bootstraps a fresh Kind cluster, deploys the published multi-arch `docker.io/sozercan/copilot-proxy:latest` image, injects `COPILOT_GITHUB_TOKEN` for proxy auth, requires the live proxy to expose GPT/Claude/Gemini model families, maps that same secret to `E2E_GITHUB_TOKEN` for the Copilot runtime case, and then runs the focused live suites against the in-cluster proxy.
+Do not enable shell xtrace for either invocation. The scripts create Kubernetes
+Secrets without printing their values and redact provider/GitHub token patterns
+from failure diagnostics.
 
-Model selection is endpoint-specific. Provider-backed `type: ai` tasks and `/api/v1/chat` probe the live proxy before choosing an OpenAI-compatible Chat Completions model, because a model can appear in the catalog while still being rejected for that endpoint. The Codex runtime uses GPT models that work with the Responses API, while the Claude and Copilot runtime matrix cases use Claude and Gemini families respectively. Keep these preferences in `test/e2e/helpers_test.go` aligned with the live proxy's allowed models rather than assuming one model family works across every endpoint.
 
-The live agent sandbox workflow (`.github/workflows/live-agent-sandbox-e2e.yml`) runs `scripts/live-agent-sandbox-e2e.sh`. It installs upstream `agent-sandbox` `v0.4.6`, builds the PR controller image, builds a fake harness wrapper image that also hosts the sandbox `/execute` and file APIs, builds the pinned upstream sandbox router image, and validates that Orka can run an agent Task inside the claimed sandbox without external model access. The script asserts:
+The existing live agent-sandbox workflow exercises the earlier execution-workspace prototype. The current ACP core runtime rejects `Task.spec.execution.workspace`, so this workflow is not an ACP v2 release gate and should not be used as evidence for RuntimePool, workspace validation, or publication behavior. Its prototype assertions include:
 
 - the outer worker re-execs inside the sandbox with `ORKA_AGENT_SANDBOX_DEPTH=1` and sandbox recursion disabled
 - the staged service account token is available to the inner worker while the command runs
@@ -166,25 +247,32 @@ The live GitHub OIDC workflow (`.github/workflows/live-github-oidc-e2e.yml`) run
 - top-level `requestedBy` and nested `spec.requestedBy` client tampering are rejected with `400`
 - the OIDC token does not appear in controller logs
 
-The Agent Substrate workflow (`.github/workflows/agent-substrate-e2e.yml`) is secret-free and runs `scripts/agent-substrate-e2e.sh` against a fresh Kind cluster. It pins the Substrate checkout with `SUBSTRATE_REF`, installs Substrate, initializes the local RustFS snapshot bucket, builds local Orka controller/workspace/harness images, then validates:
+The Agent Substrate workflow (`.github/workflows/agent-substrate-e2e.yml`) is secret-free and runs `scripts/agent-substrate-e2e.sh` against a fresh Kind cluster. It pins the Substrate checkout with `SUBSTRATE_REF`, verifies and applies the reviewed patches in `hack/agent-substrate/`, initializes the local RustFS snapshot bucket, builds the local Orka controller and archived workspace-provider images, then validates:
 
-- direct Substrate actor create/resume/router/daemon exec/suspend/delete
+- the injected upstream unit tests for authorization redaction and bounded, fail-closed `runsc delete` recovery
+- direct Substrate Actor create/resume/router/daemon exec/suspend/delete
+- live proof that `atenet-router` logs an explicit redaction marker without either bootstrap or handoff bearer credentials
+- worker-Pod deletion, store removal, Deployment replacement, lost-Actor settlement, and successful direct routing on the replacement fleet
+- repeated checkpoint/delete cycles with no Actor left in `STATUS_SUSPENDING`
 - Orka `SubstrateActorPool` reconciliation and density reporting
-- Orka `Task` execution and result submission with the default Substrate workspace provider
-- pooled Orka `Task` placement through `spec.execution.workspace.poolRef`
-- MCP actor-backed `Tool` execution through a pooled Substrate actor
-- MCP actor reuse across forced Tool reconciles without rebooting an already booted actor
-- workspace placement, density, and resume-latency status fields
-- delete and retained cleanup when the pinned Substrate runtime completes `runsc delete`
-- `WorkspaceCleanupFailed` is tolerated only after the Task result is available, because the pinned Substrate revision can fail `runsc delete` after successful Orka execution in GitHub-hosted kind
-- a missing `ActorTemplate` fails predictably
-- failure diagnostics include Orka controller logs, worker Job logs, Task YAML, Kubernetes events, and Substrate actor/worker state
-
-Run it locally with:
+- MCP Actor-backed `Tool` execution through a pooled Substrate Actor
+- MCP Actor reuse across forced Tool reconciles without rebooting an already booted Actor
+- pool scale-down plus Tool, lease, bound Actor, and precreated Actor cleanup
+
+The workflow does **not** validate a successful workspace-backed ACP Task. RuntimeSession-to-Substrate Actor dispatch remains deferred, so the supported evidence is the direct Actor path plus Orka-brokered MCP. Built-in Codex, Claude, and Copilot RuntimePools are validated separately by the live ACP workflows.
+
+The patches are source-blob pinned and fail closed when `SUBSTRATE_REF` changes or a patch touches an undeclared path. See `hack/agent-substrate/README.md` for the patch contracts and review procedure. Run the fast static checks with:
+
+```bash
+bash scripts/tests/agent-substrate-patches-test.sh
+```
+
+Run the full destructive Kind validation locally with:
 
 ```bash
 PATH="$(go env GOPATH)/bin:$PATH" \
 SUBSTRATE_E2E_EXTENDED=1 \
+KEEP_CLUSTER=1 \
 bash scripts/agent-substrate-e2e.sh
 ```
 
diff --git a/website/docs/getting-started.md b/website/docs/getting-started.md
index 12b6f862b..6de45f9fb 100644
--- a/website/docs/getting-started.md
+++ b/website/docs/getting-started.md
@@ -1,19 +1,19 @@
 # Getting Started
 
 Orka is a Kubernetes-native platform for running AI agents and tool-using workflows as
-durable, observable Kubernetes Jobs. You describe work as a **Task**; the controller
-schedules it, runs it in a hardened worker pod, stores the result, and (optionally) notifies
-you — with sessions, retries, priorities, and multi-agent delegation handled for you.
+durable, observable Tasks. Native AI and container work runs in hardened worker Jobs; ACP
+coding agents run as fenced RuntimeSessions in controller-owned RuntimePools. The controller
+stores results and delivery receipts and handles sessions, priorities, and delegation.
 
 ## Mental Model
 
 Three custom resources cover most use cases:
 
 - **Provider** — an LLM backend (Anthropic, OpenAI, or Azure OpenAI) plus its API-key Secret.
-- **Agent** — a reusable configuration: which Provider/model, system prompt, tools, skills,
-  and (optionally) an external CLI runtime or coordination settings.
+- **Agent** — a reusable configuration: Provider/model, system prompt, tools, skills,
+  ACP runtime profile, or coordination settings.
 - **Task** — one unit of work. `type: ai` runs through Orka's built-in AI worker, `type: agent`
-  runs an external coding CLI (Claude Code, Codex, Copilot), and `type: container` runs an
+  runs a Codex, Claude, Copilot, or OpenCode ACP session in a RuntimePool, and `type: container` runs an
   arbitrary container command.
 
 A Task references an Agent, an Agent references a Provider. Results are retrieved over the
@@ -36,12 +36,30 @@ For development, you also need:
 ### Using Helm
 
 ```bash
+kubectl create -f - <<'EOF'
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: orka-system
+  labels:
+    orka.ai/controller-mode: harness-v2
+EOF
+
 helm install orka charts/orka \
   --namespace orka-system \
-  --create-namespace
+  --set controller.mode=harness-v2 \
+  --set controller.watchNamespace=orka-system \
+  --set controller.image.repository=docker.io/sozercan/orka \
+  --set controller.image.digest=sha256:<controller-digest> \
+  --set publisher.image.repository=docker.io/sozercan/orka-workspace-publisher \
+  --set publisher.image.digest=sha256:<publisher-digest> \
+  --set controller.acpRuntime.codexImage=docker.io/sozercan/orka-acp-codex@sha256:<codex-digest> \
+  --set controller.acpRuntime.claudeImage=docker.io/sozercan/orka-acp-claude@sha256:<claude-digest> \
+  --set controller.acpRuntime.copilotImage=docker.io/sozercan/orka-acp-copilot@sha256:<copilot-digest> \
+  --set controller.acpRuntime.opencodeImage=docker.io/sozercan/orka-acp-opencode@sha256:<opencode-digest>
 ```
 
-A normal fresh install creates Orka's twelve cluster-scoped CRDs before the
+A normal fresh install creates Orka's 26 cluster-scoped CRDs before the
 controller resources. Use `--skip-crds` only when one designated platform or
 release owner already manages compatible Orka CRDs for the cluster; all other
 Orka releases should use that flag.
@@ -56,34 +74,44 @@ and Orka custom resources on uninstall.
 Follow the complete commands and ownership guidance in
 [`charts/orka/README.md`](https://github.com/orka-agents/orka/blob/main/charts/orka/README.md).
 
+This installs one static `harness-v2` control plane. To keep harness v1 on the
+same cluster, install it as a different release with a different controller
+namespace, labeled watch namespace, endpoint, RBAC, Lease, store, Secrets, and
+wrapper data plane. Existing Tasks and Sessions never move between releases.
+See [Operating harness v1 and v2 on one cluster](operations/harness-modes.md).
+
 ### Using kubectl
 
-The development target creates the required harness-wrapper authentication
-Secret without replacing an existing value:
+The development target creates the required ACP artifact, publisher, provider-proxy, and SCM-proxy Secrets without replacing existing values:
 
 ```bash
 # Install CRDs
 make install
 
+# Claim the controller namespace for this immutable installation mode
+kubectl create -f - <<'EOF'
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: orka-system
+  labels:
+    orka.ai/controller-mode: harness-v2
+EOF
+
 # Deploy controller
-make deploy IMG=ghcr.io/orka-agents/orka:latest
+make deploy \
+  IMG=docker.io/sozercan/orka@sha256:<controller-digest> \
+  WORKSPACE_PUBLISHER_IMG=docker.io/sozercan/orka-workspace-publisher@sha256:<publisher-digest> \
+  ACP_CODEX_RUNTIME_IMG=docker.io/sozercan/orka-acp-codex@sha256:<codex-digest> \
+  ACP_CLAUDE_RUNTIME_IMG=docker.io/sozercan/orka-acp-claude@sha256:<claude-digest> \
+  ACP_COPILOT_RUNTIME_IMG=docker.io/sozercan/orka-acp-copilot@sha256:<copilot-digest> \
+  ACP_OPENCODE_RUNTIME_IMG=docker.io/sozercan/orka-acp-opencode@sha256:<opencode-digest>
 ```
 
-When applying the promoted installer directly, pre-create that Secret because
-raw manifests cannot safely contain a shared bearer token:
-
-```bash
-set -euo pipefail
-
-kubectl create namespace orka-system --dry-run=client -o yaml | kubectl apply -f -
-if ! kubectl -n orka-system get secret harness-wrapper-auth >/dev/null 2>&1; then
-  openssl rand -hex 32 | \
-    kubectl -n orka-system create secret generic harness-wrapper-auth \
-      --from-file=token=/dev/stdin
-fi
-
-kubectl apply -f deploy/orka.yaml
-```
+`make deploy` applies the same resources as the canonical
+`config/acp-production` Kustomize overlay. For direct Kustomize workflows, use
+that overlay rather than `config/default`; it includes the Vekil ingress policy
+that permits model traffic only through the authenticated provider proxy.
 
 ## Quick Start
 
@@ -172,26 +200,23 @@ orka task download <task-name> [filename] -o <path>
 
 ## Agent Runtimes Quick Start
 
-Agent runtimes let you run tasks via Codex CLI, Claude Code CLI, GitHub Copilot CLI, or OpenCode CLI with full autonomous coding capabilities.
+ACP agent runtimes run the supported Codex, Claude, Copilot, and OpenCode profiles as
+fenced RuntimeSessions in controller-owned RuntimePools. External
+`orka.harness.v2` registrations can be probed and conformance-tested, but
+`runtimeRef` Task dispatch remains fail-closed until the external v2 dispatcher
+support boundary is enabled.
 
-### 1. Create Credentials
+### 1. Configure the central provider proxy
 
-```bash
-# For Claude Code CLI (direct API)
-kubectl create secret generic claude-credentials \
-  --from-literal=ANTHROPIC_API_KEY=sk-ant-your-key
-
-# For Claude Code CLI (Azure AI Foundry)
-kubectl create secret generic claude-credentials \
-  --from-literal=CLAUDE_CODE_USE_FOUNDRY=1 \
-  --from-literal=ANTHROPIC_FOUNDRY_API_KEY=your-key \
-  --from-literal=ANTHROPIC_FOUNDRY_RESOURCE=your-resource \
-  --from-literal=ANTHROPIC_DEFAULT_SONNET_MODEL=claude-sonnet-4-5
-
-# For Codex CLI
-kubectl create secret generic codex-api-key \
-  --from-literal=OPENAI_API_KEY=sk-proj-your-key
-```
+Built-in ACP Agents never reference provider Secrets. Configure Vekil with the
+upstream provider credentials and keep Orka's authenticated provider proxy in
+front of it. The controller gives RuntimePools only the proxy bearer and the
+reviewed provider/model scope; the upstream credential never enters the ACP
+process tree.
+
+For Kustomize installs, verify that `config/acp-production` is applied and that
+the `provider-auth-proxy` Deployment is Ready before submitting ACP Tasks. Helm
+deployments enable the same boundary with `providerProxy.enabled=true`.
 
 ### 2. Create an Agent with Runtime
 
@@ -202,12 +227,8 @@ kind: Agent
 metadata:
   name: claude-agent
 spec:
-  secretRef:
-    name: claude-credentials
-  execution:
-    runtimeClassName: gvisor
-    nodeSelector:
-      sandbox-runtime: gvisor
+  model:
+    name: claude-sonnet-4-20250514
   runtime:
     type: claude
     defaultMaxTurns: 50
@@ -220,7 +241,14 @@ spec:
 EOF
 ```
 
-For Codex Agents, keep `defaultAllowBash: true` for now. The current Codex runtime implementation fails fast when bash is disabled because the upstream Codex CLI does not yet expose a reliable shell-disable mode.
+For Codex Agents, keep `defaultAllowBash: true` for now. The current Codex
+runtime implementation fails fast when bash is disabled because the upstream
+Codex CLI does not yet expose a reliable shell-disable mode. For OpenCode
+Agents, set `runtime.type: opencode`, use the provider/model form expected by
+OpenCode (such as `openai/gpt-5.4`), and set reviewed `model.contextWindow`
+and `model.maxTokens` ceilings. Orka requires both values and pins them into the
+immutable RuntimePool profile so OpenCode compaction and proxy output limits do
+not depend on mutable catalog discovery.
 
 ### 3. Run an Agent Task
 
@@ -234,11 +262,17 @@ spec:
   type: agent
   agentRef:
     name: claude-agent
-  prompt: "Review the code in this repo for security issues"
+  prompt: "Review the code in this repo for security issues. Do not modify files."
+  workspace:
+    intent: read
+    gitRepo: "https://github.com/example/repo.git"
+    branch: main
+    # Optional for a private source repository. This Secret is resolved only
+    # by the clean-room credential broker, never by the ACP runtime.
+    # readCredentialRef:
+    #   name: repository-read
   agentRuntime:
-    workspace:
-      gitRepo: "https://github.com/example/repo.git"
-      branch: main
+    maxTurns: 20
 EOF
 ```
 
@@ -246,6 +280,8 @@ EOF
 
 ```bash
 kubectl get task code-review
+kubectl get runtimepools
+orka task status code-review
 
 curl http://localhost:8080/api/v1/tasks/code-review/result \
   -H "Authorization: Bearer $(kubectl create token orka-client)"
@@ -255,7 +291,7 @@ See [Agent Runtimes](concepts/agent-runtimes.md) for full configuration referenc
 
 ## Optional Runtime Isolation
 
-If your cluster exposes Kubernetes `RuntimeClass` objects such as `gvisor` or `kata-qemu`, you can route worker Jobs through them with `spec.execution`.
+If your cluster exposes Kubernetes `RuntimeClass` objects such as `gvisor` or `kata-qemu`, native `ai` and container Tasks can route worker Jobs through them with `spec.execution`. Built-in ACP agent Tasks instead use reviewed RuntimePool resource profiles.
 
 ```yaml
 apiVersion: core.orka.ai/v1alpha1
@@ -267,19 +303,15 @@ spec:
   agentRef:
     name: assistant
   prompt: "Summarize the repo"
-  execution:
-    runtimeClassName: gvisor
-    nodeSelector:
-      sandbox-runtime: gvisor
 ```
 
-Use `Agent.spec.execution` for defaults, then override it per task when needed. See [Configuration](concepts/configuration.md#execution), [Agent Runtimes](concepts/agent-runtimes.md#runtime-isolation), and [Security](concepts/security.md#runtime-isolation) for details.
+Use `Agent.spec.execution` for defaults, then override it per task when needed. See [Configuration](concepts/configuration.md#execution), [Agent Runtimes](concepts/agent-runtimes.md#runtime-and-credential-boundaries), and [Security](concepts/security.md#execution-workloads) for details.
 
 ## Accessing the Dashboard
 
 ```bash
 # Port-forward the controller service
-kubectl port-forward -n orka-system svc/orka-api 8080:8080
+kubectl port-forward -n orka-system svc/orka 8080:8080
 
 # Open in browser
 open http://localhost:8080
@@ -316,12 +348,12 @@ The CLI supports token extraction from bearer tokens, token files, exec-based au
 - [Configuration](concepts/configuration.md) — Helm values, controller flags, and metrics
 - [Memory](concepts/memory.md) — Namespace-scoped durable memory and reviewable proposals
 - [Transaction Token Integration](concepts/transaction-tokens.md) — Request-scoped transaction-token auth
-- [Agent Sandbox Workspaces](concepts/agent-sandbox.md) / [Substrate](concepts/substrate.md) — Durable, reusable execution workspaces
+- [Agent Sandbox Workspaces](concepts/agent-sandbox.md) / [Substrate](concepts/substrate.md) — Deferred execution-workspace providers behind the ACP v2 seam
 - [Security](concepts/security.md) — Pod hardening, authentication, and multi-tenancy
 
 **Guides & reference**
 
-- [Agent Runtimes](concepts/agent-runtimes.md) — Codex CLI, Claude Code CLI, Copilot CLI, and OpenCode CLI configuration
+- [Agent Runtimes](concepts/agent-runtimes.md) — ACP v2 RuntimePools, RuntimeSessions, workspace policy, and delivery
 - [Interactive Chat](guides/chat.md) — Chat endpoint with tool execution
 - [Multi-Agent Coordination](guides/multi-agent-coordination.md) — Coordinator agents and delegation
 - [OpenAI Compatibility](reference/openai-compat.md) — Use any OpenAI-compatible client via `/openai/v1/`
diff --git a/website/docs/guides/bring-your-own-agent-runtime.md b/website/docs/guides/bring-your-own-agent-runtime.md
index 740cd8300..1855dfb1f 100644
--- a/website/docs/guides/bring-your-own-agent-runtime.md
+++ b/website/docs/guides/bring-your-own-agent-runtime.md
@@ -1,136 +1,180 @@
 # Bring your own AgentRuntime
 
-Orka can run `type: agent` tasks through a namespace-local `AgentRuntime` facade while Orka remains the API, lifecycle, approval, and tool-governance plane.
+`AgentRuntime` registers an operator-owned external service that implements `orka.harness.v2`. Orka probes the service, verifies its pinned capability/profile claims, and records sanitized readiness data.
 
 ```text
-Orka Task
-  -> Agent.runtime.runtimeRef
-    -> AgentRuntime facade
-      -> remote execution backend
-        -> ToolCallRequested
-          -> Orka validates, approves, executes, audits
-          -> /v1/turns/{turnID}/continue with ToolCallResult
+AgentRuntime registration
+  -> GET /v2/health
+  -> GET /v2/capabilities
+  -> authenticated GET /v2/status
+  -> hostile mutation/conformance checks
+  -> status.ready + observed v2 identity/profile
 ```
 
-## Core concepts
+Registration and conformance are available today, but
+`Agent.spec.runtime.runtimeRef` Task planning remains fail-closed until the
+external v2 dispatcher support boundary is enabled. There is no legacy adapter
+or agent Job fallback.
 
-- **AgentRuntime**: the Orka-facing CRD and protocol contract.
-- **Remote execution backend**: the workload runtime or adapter behind the facade.
-- **Brokered governance**: remote runtimes request tools; Orka authorizes and executes them.
-- **Namespace-local facade**: the `AgentRuntime`, `Agent`, `Task`, and `Tool` objects used by a workflow live in the workflow namespace. The endpoint may route to a Service elsewhere.
+## When to use an external registration
 
-## Minimal runtime facade
+Use an external registration to validate an operator-owned service with a stable, immutable runtime instance identity and a reviewed v2 implementation. Built-in Codex, Claude, Copilot, and OpenCode Tasks use controller-owned RuntimePools.
 
-For an observed-only backend such as current AgentKit Serve Orka mode, advertise
-only observed capabilities:
+External services are not managed by Orka Kubernetes pool scaling. They must implement their own lifecycle, instance replacement, process cleanup, and capacity controls while preserving the portable v2 semantics.
+
+## Authentication Secrets
+
+Create two independent Secrets in the AgentRuntime namespace:
+
+- a controller bearer token for authenticated requests;
+- an HMAC capability secret used to bind each mutation to its operation/fence/request digest.
+
+Each Secret must contain at least 32 bytes and be bound to the registration and endpoint:
 
 ```yaml
-apiVersion: core.orka.ai/v1alpha1
-kind: AgentRuntime
 metadata:
-  name: agentkit-runtime
-spec:
-  contractVersion: orka.harness.v1
-  deployment:
-    mode: external-endpoint
-    endpoint: http://agentkit-runtime.default.svc.cluster.local:8080
-  clientAuth:
-    bearerTokenSecretRef:
-      name: agentkit-runtime-token
-      key: token
-  capabilities:
-    toolExecutionModes: [observed]
-    supportsCancel: true
-    supportsRuntimeSessions: true
+  labels:
+    orka.ai/agent-runtime-auth: "true"
+    orka.ai/agent-runtime-name: external-acp
+  annotations:
+    orka.ai/agent-runtime-endpoint: http://external-acp.default.svc.cluster.local:8080
 ```
 
-The checked-in AgentKit Serve facades report lifecycle/output frames for
-AgentKit-owned observed runs. Do not add `brokeredToolClasses` or
-`supportsContinuation` to an AgentKit facade unless that deployment enables an
-AgentKit brokered profile that has passed the matching Orka conformance probe.
+Do not reuse provider, Git read, Git publication, forge, or downstream Tool credentials for either role.
 
-For a backend that has already passed a brokered profile, include only the
-profile it actually supports:
+## Strict governed registration
+
+The following abbreviated registration declares the strict guarantees that a
+future `runtimeRef` Task dispatcher will require. The complete sample includes
+all required profile digests and limits. Every claim must match the runtime's
+public capabilities, authenticated status, and hostile conformance behavior.
 
 ```yaml
 apiVersion: core.orka.ai/v1alpha1
 kind: AgentRuntime
 metadata:
-  name: support-http-runtime
+  name: external-acp
 spec:
-  contractVersion: orka.harness.v1
+  contractVersion: orka.harness.v2
   deployment:
     mode: external-endpoint
-    endpoint: http://support-http-runtime.default.svc.cluster.local:8080
+    endpoint: http://external-acp.default.svc.cluster.local:8080
   clientAuth:
-    bearerTokenSecretRef:
-      name: support-http-runtime-token
+    controllerBearerTokenSecretRef:
+      name: external-acp-controller-auth
       key: token
+    operationCapabilitySecretRef:
+      name: external-acp-operation-auth
+      key: capability-secret
   capabilities:
-    toolExecutionModes: [observed, brokered]
-    brokeredToolClasses: [read]
-    supportsRuntimeSessions: true
-    supportsContinuation: true
+    runtimeInstanceID: external-acp-instance-01
+    profile:
+      digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+      digestSchemaVersion: 1
+      acpProfile: acp.v1
+      adapterName: operator-reviewed-adapter
+      adapterDigest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+      providerKind: operator-managed
+      model: operator-reviewed-model
+      agentConfigurationDigest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+      toolPolicyDigest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+      approvalPolicyDigest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+      mcpConfigurationDigest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+      workspaceIntent: read
+      proxyCredentialRole: operator-managed
+      proxyCredentialScope: external-runtime
+      resourceClass: external
+    limits:
+      maxResidentSessions: 10
+      maxConcurrentPrompts: 4
+      maxRequestBytes: 1048576
+      maxEventLineBytes: 262144
+      maxTerminalResultBytes: 1048576
+      maxBufferedEvents: 4096
+      maxUpdateEventsPerSecond: 100
+      minPromptLeaseMillis: 5000
+      maxPromptLeaseMillis: 120000
+      maxPendingPermissions: 32
+      maxWorkspaceDeltaBytes: 104857600
+    supportsDrain: false
+    workspaceGovernance:
+      mode: strict-governed
+      trusted: false
+      orkaOwnedWorkspaceDeltas: true
+      promptScopedBrokerAuthorization: true
+      noDirectSCMPublication: true
+      orkaOwnedCleanRoomPublication: true
+      exactInstanceFencing: true
+      duplicateSafeMutations: true
+      cancellationSettlement: true
 ```
 
-The bearer Secret must be labeled and endpoint-bound:
+Apply the complete checked-in sample:
 
-```yaml
-metadata:
-  labels:
-    orka.ai/agent-runtime-auth: "true"
-    orka.ai/agent-runtime-name: support-http-runtime
-  annotations:
-    orka.ai/agent-runtime-endpoint: http://support-http-runtime.default.svc.cluster.local:8080
+```bash
+kubectl apply -f config/samples/core_v1alpha1_agentruntime.yaml
+kubectl get agentruntime sample-external-v2-runtime -o yaml
 ```
 
-## Expose a brokered tool
+Wait for `status.ready: true` to confirm registration and conformance. Do not
+select the registration from a production Agent yet: the controller currently
+rejects `runtimeRef` Task planning at the external dispatch support boundary.
+The future Agent selection shape is:
 
 ```yaml
 apiVersion: core.orka.ai/v1alpha1
-kind: Tool
+kind: Agent
 metadata:
-  name: support-ticket-lookup
+  name: external-v2-agent
 spec:
-  description: Look up sanitized support ticket evidence.
-  brokeredToolClass: read
-  parameters:
-    type: object
-    properties:
-      incident:
-        type: string
-  http:
-    url: http://support-tool.default.svc.cluster.local:8080/lookup
-    method: POST
+  model:
+    name: operator-reviewed-model
+  runtime:
+    runtimeRef:
+      name: sample-external-v2-runtime
 ```
 
-Then allow it on the Task:
+When the dispatch boundary is enabled, the referenced Task must use the same
+workspace intent pinned in the immutable runtime profile and provide an
+explicit task-level `allowedTools` policy when brokered tools are exposed.
 
-```yaml
-spec:
-  type: agent
-  agentRef:
-    name: support-remote-investigator
-  agentRuntime:
-    allowedTools:
-    - support-ticket-lookup
-```
+## Trusted non-governed registrations
 
-Orka sends the remote runtime only the safe schema view. It does not send the HTTP URL or auth Secret refs.
+`trusted-non-governed` remains an explicit registration mode for operator
+inventory and conformance diagnostics, but it cannot satisfy the strict `read`
+or `write` workspace guarantees required by future `type: agent` Task dispatch. It
+must not claim Orka-owned deltas, prompt-scoped broker authorization, clean-room
+publication, exact-instance fencing, duplicate safety, or cancellation
+settlement.
 
-## Approval-gated writes
+## Strict governed behavior
 
-Use `spec.brokeredToolClass: write` for consequential tools. Orka records `ApprovalRequested`, parks the task with `WaitingForApproval=True`, and resumes the runtime after a human decision:
+A strict external runtime must advertise every required workspace-governance guarantee and pass the matching conformance checks. It must not receive Git publication credentials, publish from child-controlled Git state, or hold durable session-wide broker authority.
 
-```bash
-orka task approvals support-escalation-demo
-orka task approve support-escalation-demo <approval-id>
-```
+Strict mode does not turn an external service into a RuntimePool. Orka does not create, count, drain, or replace its Pods unless a separate operator does so.
+
+## Implement the protocol
+
+Implement the endpoints and semantics in the [AgentRuntime adapter contract](../development/agent-runtime-adapter-contract.md):
 
-If a brokered write has an unresolved pre-execution ledger entry, Orka returns an outcome-unknown error instead of replaying the write.
+- safe health/capability probes;
+- authenticated status and mutations;
+- RuntimeSession create/delete;
+- prompt stream, lease, permission, and cancellation operations;
+- workspace-delta operation when strict workspace support is claimed;
+- exact duplicate handling, request-digest conflicts, and stale-fence rejection;
+- bounded diagnostics and terminal event rules.
 
-## Demos
+## Validate
+
+Run the conformance suite from `internal/harness/v2/conformance` against the service before applying a registration. Then verify:
+
+```bash
+orka agent-runtime list
+orka agent-runtime get external-acp -o yaml
+```
 
-- `examples/support-escalation-runtime-demo`: brokered read path with no external provider credentials.
-- `examples/fibey-custom-agent-demo`: namespace-local backend switching facades.
-- `examples/bring-your-own-agent-runtime-demo`: canonical README and security notes.
+`status.ready: true` proves the configured registration passed the current
+probe/conformance cycle. It does not enable Task dispatch; `runtimeRef`
+planning remains fail-closed until the external v2 dispatcher support boundary
+is enabled.
diff --git a/website/docs/guides/chat.md b/website/docs/guides/chat.md
index 25628f665..ee3b38df1 100644
--- a/website/docs/guides/chat.md
+++ b/website/docs/guides/chat.md
@@ -117,7 +117,7 @@ The live suite verifies transport behavior, session creation/persistence, and us
 |------|-------------|
 | `create_ai_task` | Create an AI/LLM-powered task |
 | `create_container_task` | Create a container task for shell commands |
-| `create_agent_task` | Create a task with CLI runtime (Copilot/Claude) |
+| `create_agent_task` | Create a built-in Codex, Claude, Copilot, or OpenCode ACP Task. External-v2 `runtimeRef` Task dispatch remains fail-closed. |
 | `check_task_progress` | Get task phase/status conditions |
 | `fetch_task_output` | Get completed task result (truncated to 2K chars) |
 | `wait_for_task` | Wait for task completion (max 60s per call, non-blocking) |
diff --git a/website/docs/guides/cli-harness-wrapper.md b/website/docs/guides/cli-harness-wrapper.md
deleted file mode 100644
index e081e4805..000000000
--- a/website/docs/guides/cli-harness-wrapper.md
+++ /dev/null
@@ -1,141 +0,0 @@
-# CLI harness wrapper
-
-The CLI harness runtime is the agent execution path for CLI-backed runtimes. It lets Orka speak the `orka.harness.v1` turn protocol while the underlying runtime can still run as a normal per-turn subprocess.
-
-Agent tasks use the harness protocol around the CLI invocation:
-
-```text
-Task -> harness provider -> CLI harness wrapper -> CLI subprocess per turn -> harness frames -> Orka execution events
-```
-
-The first implementation is **observed mode**. Orka observes command lifecycle, stdout/stderr previews, cancellation, and terminal result frames. It does not broker the runtime's internal tool calls unless a future runtime adapter exposes a native/brokered protocol.
-
-## What is supported
-
-- `GET /v1/health`
-- `GET /v1/capabilities`
-- `POST /v1/turns`
-- `GET /v1/turns/{turnID}/events?afterSeq=N`
-- `POST /v1/turns/{turnID}/cancel`
-
-The wrapper emits harness frames such as:
-
-- `TurnStarted`
-- `RuntimeLog`
-- `RuntimeOutput`
-- `TurnCompleted`
-- `TurnFailed`
-- `TurnCancelled`
-
-The CLI subprocess is **per turn**. The wrapper process can stay up and accept more turns, but it does not make opaque CLIs resident. RuntimeSession persistence and resident process reuse are future work.
-
-## Runtime adapters
-
-Current adapters:
-
-- `generic` — simple command adapter for tests and bring-your-own commands.
-- `codex` — adapter for the Codex CLI using Orka runtime settings.
-- `claude` — adapter for the Claude Code CLI using Orka runtime settings.
-- `copilot` — adapter for GitHub Copilot through the Copilot SDK helper subprocess.
-
-## Generic command example
-
-Run the wrapper locally:
-
-```bash
-ORKA_HARNESS_WRAPPER_RUNTIME=generic \
-ORKA_HARNESS_WRAPPER_COMMAND=/bin/sh \
-ORKA_HARNESS_WRAPPER_ARGS='["-c","cat; printf done > /tmp/result.txt"]' \
-ORKA_HARNESS_WRAPPER_RESULT_MODE=file \
-ORKA_HARNESS_WRAPPER_RESULT_FILE=/tmp/result.txt \
-ORKA_HARNESS_WRAPPER_BEARER_TOKEN_FILE=/var/run/secrets/orka-wrapper/token \
-go run ./cmd/orka-agent-harness-wrapper --listen-addr=:8080
-```
-
-Prompt delivery modes:
-
-- `stdin` (default)
-- `env` via `ORKA_HARNESS_WRAPPER_PROMPT_ENV` (default `ORKA_TURN_PROMPT`)
-- `file`, which writes a per-turn prompt file and passes its path in the prompt env var
-
-Result extraction modes:
-
-- `stdout` (default)
-- `file` via `ORKA_HARNESS_WRAPPER_RESULT_FILE`
-
-## Kubernetes configuration
-
-Agent tasks always use the harness runtime path. The first provider path targets an operator-configured wrapper HTTP endpoint (for example, a trusted Service, sidecar, port-forwarded local wrapper, or test server). Configure the controller with `ORKA_HARNESS_WRAPPER_ENDPOINT`; tasks select agents normally:
-
-```yaml
-apiVersion: orka.io/v1alpha1
-kind: Task
-metadata:
-  name: codex-wrapper-smoke
-spec:
-  type: agent
-  agentRef:
-    name: codex-agent
-  prompt: "Inspect the repository and summarize it."
-  agentRuntime:
-    maxTurns: 20
-    allowBash: true
-```
-
-Operators must set `ORKA_HARNESS_WRAPPER_ENDPOINT=<trusted wrapper URL>` on the controller for agent tasks. If the wrapper requires bearer auth (the default), configure the same auth value for the controller with `ORKA_HARNESS_WRAPPER_BEARER_TOKEN_FILE` or `ORKA_HARNESS_WRAPPER_BEARER_TOKEN`.
-
-## Compatibility notes
-
-- The runtime emits harness turn frames first; the controller maps those frames into normal Orka execution events.
-- The selected endpoint is operator-configured with `ORKA_HARNESS_WRAPPER_ENDPOINT`; tasks do not supply runtime endpoints.
-- Completed turns are retained in wrapper memory only for the configured retention TTL, so controller recovery must resume promptly or the task fails instead of silently duplicating work.
-- Terminal result frames are size-bounded to stay within the harness SSE envelope. Results that exceed the limit fail explicitly instead of being stored partially.
-- `codex`, `claude`, `copilot`, and `opencode` all run through the wrapper; there are no per-runtime agent-worker images.
-- Durable execution workspaces are validated but not yet launched by the harness runtime path.
-
-The focused test matrix covers generic command success, result-file extraction, non-zero failure, timeout, cancellation including process-group cleanup, redaction, event-stream cursoring, harness conformance, Codex fake-CLI success/failure, and controller routing through the harness runtime.
-
-## Event mapping
-
-Harness-backed agent tasks emit Orka execution events from harness turn frames. A successful observed-mode turn normally produces task lifecycle events plus runtime events such as:
-
-- `AgentRuntimeStarted`
-- `AgentRuntimeCommandStarted`
-- `ModelMessage` when stdout/stderr or model output previews are observed
-- `AgentRuntimeCompleted`
-- `TaskSucceeded`
-
-The controller persists the task result from the harness `TurnCompleted` frame. Harness-backed agent tasks do **not** currently emit the worker-side `ResultSubmitted` event used by the older worker HTTP recorder path.
-
-## Live validation checklist
-
-For post-merge or release validation, use a real cluster with the harness wrapper Deployment and an in-cluster model proxy such as Vekil. Recommended coverage:
-
-1. Verify `GET /v1/health` and `GET /v1/capabilities` on `svc/orka-agent-harness-wrapper`.
-2. Verify `POST /v1/turns` rejects missing or bad bearer tokens. Health and capabilities are intentionally public.
-3. Run a real `codex` Agent task through the wrapper and Vekil.
-4. Run a real `claude` Agent task through the wrapper and Vekil when a Claude-compatible model is exposed.
-5. Exercise workspace clone/read with a public repository and assert `AgentRuntimeCompleted` plus `TaskSucceeded` events.
-6. Fork a harness-backed task and verify checkpoint context plus the fork task result.
-7. Exercise direct generic-wrapper cancellation and deadline timeout; expected terminal frames are `TurnCancelled` and `TurnFailed` respectively.
-8. Verify unsafe workspace URLs such as `https://localhost/...` fail closed.
-9. When a GitHub token is available, run a temporary branch push and PR creation/cleanup flow against a disposable branch.
-
-A validated real-world flow is: Orka harness-backed `codex` task clones Orka, writes a temporary validation file, pushes `live/harness-wrapper-pr-validation-*`, opens a real GitHub PR, verifies the diff, then closes the PR and deletes the branch.
-
-## Cancellation
-
-`CancelTurn` cancels the turn context. For subprocess adapters, the wrapper sends `SIGTERM` to the process group, waits the configured grace period, then sends `SIGKILL`. This is designed to stop child processes as well as the direct CLI process. The event stream ends with `TurnCancelled` when cancellation wins, or `TurnFailed` for timeouts and non-zero exits.
-
-## Security notes
-
-- Mutating turn endpoints (`POST /v1/turns`, event streams for a turn, and cancel) require a bearer token unless `ORKA_HARNESS_WRAPPER_ALLOW_UNAUTHENTICATED=true` is explicitly set for local-only tests. Health and capabilities endpoints are intentionally public for readiness discovery.
-- Wrapper frames must not include raw environment dumps, API keys, TxTokens, service-account tokens, cookies, or authorization headers.
-- Stdout/stderr previews are redacted and truncated before becoming frames.
-- Prompt-file mode uses per-turn temp files and removes wrapper-created temp files after the command is parsed.
-- Observed-mode wrappers cannot prove what an opaque CLI did internally; use least-privilege credentials and runtime sandboxing exactly as for CLI-backed runtimes.
-- GitHub/LLM credentials belong in Kubernetes Secrets and must not be logged. For live PR-flow tests, create temporary branches/PRs and close/delete them after validation.
-
-## Substrate relationship
-
-Substrate is not required. The wrapper speaks normal HTTP+SSE and can run as a Kubernetes Service, sidecar, local test server, or future Substrate provider target.
diff --git a/website/docs/guides/github-label-triggers.md b/website/docs/guides/github-label-triggers.md
index 374d034de..c6fc77be5 100644
--- a/website/docs/guides/github-label-triggers.md
+++ b/website/docs/guides/github-label-triggers.md
@@ -4,7 +4,7 @@ slug: /github-label-triggers
 
 # GitHub Label Triggers
 
-Orka can create an agent-runtime Task when a GitHub issue or pull request receives a label such as `agent:implement`, `agent:update-branch`, `agent:review`, or `agent:to-issues`.
+Orka can create an ACP `type: agent` Task when a GitHub issue or pull request receives a label such as `agent:implement`, `agent:update-branch`, `agent:review`, or `agent:to-issues`.
 
 ## Webhook endpoint
 
@@ -26,7 +26,7 @@ Set these environment variables on the controller Deployment:
 | `ORKA_GITHUB_WEBHOOK_SECRET` | yes | Shared webhook secret used for HMAC verification. Use a Kubernetes Secret. |
 | `ORKA_GITHUB_LABEL_TRIGGER_AGENT` | yes | Default runtime Agent CR used for created `type: agent` Tasks. |
 | `ORKA_GITHUB_LABEL_TRIGGER_NAMESPACE` | no | Namespace for created Tasks. Defaults to the controller watch namespace, then `default`. |
-| `ORKA_GITHUB_LABEL_TRIGGER_GIT_SECRET` | no | Secret name used for clone, push, and GitHub API auth when it is safe for the target repository. Mutating actions receive it as `/secrets/git`; `agent:review` may use it only in the workspace init container for private same-repository PR clone and the reviewer container does not receive it. When Orka uses the secret, it must exist in the label-trigger namespace and contain a non-empty `token`, `password`, or `GITHUB_TOKEN` key. |
+| `ORKA_GITHUB_LABEL_TRIGGER_GIT_SECRET` | no | Compatibility Secret selection for the label-trigger API. Orka maps it to `workspace.readCredentialRef`; for write actions it also maps the same reference to `workspace.publicationCredentialRef`. The Secret never enters the ACP runtime. Use direct Task/workflow creation when strict separation requires different read and publication Secrets. |
 | `ORKA_GITHUB_LABEL_TRIGGER_PREFIX` | no | Label prefix. Defaults to `agent:`. |
 | `ORKA_GITHUB_LABEL_TRIGGER_TIMEOUT` | no | Task timeout. Defaults to `30m`. |
 | `ORKA_GITHUB_LABEL_TRIGGER_MAX_TURNS` | no | Agent max turns. Defaults to `100`. |
@@ -40,13 +40,13 @@ When GitHub sends a `labeled` event and the label starts with the configured pre
 
 Default action prompts:
 
-- `agent:implement` - implement the issue or PR request and run tests. When a valid safe git secret is configured, Orka commits and pushes final changes to a generated `orka/implement-...` branch (or the PR head branch for same-repository PRs). For fork PRs or deployments without a git secret, Orka captures the final workspace diff in the task result and does not push automatically.
-- `agent:update-branch` - for pull requests only; update the PR head branch from the base branch. Orka pushes back only when a valid safe git secret is configured for the PR head repository.
-- `agent:review` - for pull requests only; review without changing code. For private same-repository PRs, Orka can use the configured Git Secret in a workspace init container to clone the PR head, but the reviewer container does not receive `/secrets/git` and has no push branch.
+- `agent:implement` - creates a write-intent workspace on a generated `orka/implement-...` branch (or an eligible same-repository PR head). The ACP child edits files only; the Workspace/Publisher owns deterministic commit preparation, exact-ref push, and verification.
+- `agent:update-branch` - for pull requests only; creates a write-intent Task for an eligible same-repository PR head. Publication still occurs through the Workspace/Publisher.
+- `agent:review` - for pull requests only; creates a read-intent Task at the exact PR head SHA. The clean-room source boundary may resolve the compatibility Git Secret for a private repository, but the ACP runtime receives neither read nor publication credentials.
 - `agent:to-issues` - break the request into independently implementable GitHub issues, creating them when credentials/tools permit or returning drafts.
 - Other `agent:<action>` labels create a generic action task with a scoped prompt.
 
-For pull request actions, Orka passes the PR base branch, base repository, and base SHA into the worker. When the worker has a git checkout, it writes generated review context under `/workspace/.git/orka/`: `pr-review.md`, `pr-review.files`, and `pr-review.diff`. This gives `agent:review` diff context without mounting the configured Git Secret into the reviewer container.
+For pull request actions, Orka records the PR base branch, repository identity, and exact head/base SHA on the Task context. ACP review Tasks consume a verified read-only workspace and must not rely on credential mounts or child-controlled Git metadata for authority.
 
 GitHub delivery IDs make retries safe: if the same delivery is received again, Orka returns `202 Accepted` with the existing task name instead of creating a duplicate.
 
@@ -58,9 +58,9 @@ For `opened`, `reopened`, `synchronize`, `ready_for_review`, `labeled`, and `unl
 
 ## CI Coverage
 
-`.github/workflows/live-github-label-trigger-e2e.yml` is a manual GitHub Actions workflow for the label trigger path. It runs focused Go tests for webhook and PR monitor tooling, then builds the controller image, deploys Orka into a fresh Kind cluster, creates a synthetic runtime Agent, and sends signed webhook payloads to `/webhooks/github`.
+`.github/workflows/live-github-label-trigger-e2e.yml` is a manual GitHub Actions workflow for the label trigger path. It runs focused Go tests for webhook and PR monitor tooling, then builds the controller image, deploys Orka into a fresh Kind cluster, creates a synthetic Agent and webhook fixture, and sends signed webhook payloads to `/webhooks/github`.
 
-The workflow is model-free and secret-free. It generates the webhook secret during the run and uses a synthetic `agent:implement` issue label payload for the configured `target_repo_url` and `target_number` inputs. The script verifies that invalid signatures return `401`, a valid label event creates one scoped agent Task, and a repeated GitHub delivery returns `202` with the original task name.
+The workflow is model-free and secret-free, so it validates webhook idempotency and Task construction rather than a provider-live ACP RuntimePool execution. It generates the webhook secret during the run and uses a synthetic `agent:implement` issue label payload for the configured `target_repo_url` and `target_number` inputs. The script verifies that invalid signatures return `401`, a valid label event creates one scoped agent Task, and a repeated GitHub delivery returns `202` with the original task name.
 
 Run the same validation locally with:
 
diff --git a/website/docs/guides/multi-agent-coordination.md b/website/docs/guides/multi-agent-coordination.md
index 3bd761ce9..f8f34ccdc 100644
--- a/website/docs/guides/multi-agent-coordination.md
+++ b/website/docs/guides/multi-agent-coordination.md
@@ -70,11 +70,16 @@ LLM-visible parameter schema:
     "priority":    {"type": "integer", "description": "Priority 0-1000 (defaults to parent priority)"},
     "workspace":   {"type": "object", "description": "Git workspace configuration for agent runtime tasks",
       "properties": {
-        "gitRepo":      {"type": "string", "description": "Git repository URL"},
-        "branch":       {"type": "string", "description": "Git branch name"},
-        "ref":          {"type": "string", "description": "Git ref (commit SHA or tag)"},
-        "gitSecretRef": {"type": "string", "description": "Name of the Kubernetes Secret containing git credentials (must have a non-empty token, password, or GITHUB_TOKEN key)"},
-        "pushBranch":   {"type": "string", "description": "Remote branch name to push changes to after the agent completes"}
+        "intent":                   {"type": "string", "enum": ["read", "write"]},
+        "gitRepo":                  {"type": "string", "description": "Credential-free source repository URL"},
+        "branch":                   {"type": "string", "description": "Source branch name"},
+        "ref":                      {"type": "string", "description": "Source ref, commit SHA, or tag"},
+        "readCredentialRef":        {"type": "string", "description": "Secret used only for clean-room clone/read"},
+        "publicationGitRepo":       {"type": "string", "description": "Credential-free publication repository URL"},
+        "publicationCredentialRef": {"type": "string", "description": "Secret used only by the Workspace/Publisher"},
+        "pushBranch":               {"type": "string", "description": "Publication branch"},
+        "prBaseBranch":             {"type": "string", "description": "Pull-request base branch"},
+        "createPR":                 {"type": "boolean", "description": "Request PR reconciliation after verified publication"}
       }
     },
     "maxTurns":    {"type": "integer", "description": "Maximum number of turns for the agent"},
@@ -587,17 +592,22 @@ When a task is retried, its result includes:
 
 Orka supports iterative multi-agent workflows where a coordinator orchestrates coding, review, and feedback loops until code is approved.
 
+The current ACP core runtime does not accept `priorTaskRef`; use `sessionRef` for runtime continuity in direct ACP manifests. Existing `prior_task` coordination examples describe the older diff-handoff loop and are not an ACP v2 release gate.
+
 ### Flow
 
 ```
 COORDINATOR (AI worker)
   │
   ├── delegate_task(agent="coder", prompt="Implement feature",
-  │                 workspace={gitRepo: "upstream/repo",
-  │                            pushBranch: "feature/my-change",
-  │                            gitSecretRef: "git-credentials"})
-  │     Coder: clones repo → writes code → auto-pushes to branch
-  │            → result includes cumulative diff + pushBranch
+  │                 workspace={intent: "write",
+  │                            gitRepo: "https://github.com/example/repo.git",
+  │                            readCredentialRef: "repository-read",
+  │                            publicationGitRepo: "https://github.com/example/repo.git",
+  │                            publicationCredentialRef: "repository-publish",
+  │                            pushBranch: "feature/my-change"})
+  │     Workspace boundary clones; coder edits only; Orka validates and
+  │     clean-room publishes the claimed branch with a delivery receipt
   │
   ├── wait_for_tasks → gets {summary, files, pushBranch} (diff stripped)
   │
@@ -610,14 +620,15 @@ COORDINATOR (AI worker)
   │
   ├── delegate_task(agent="coder", prompt="Fix: add tests",
   │                 prior_task="coder-task-xyz", feedback="Add tests")
-  │     Coder iter 2: clones repo → applies iter 1 diff → fixes → pushes
+  │     Coder iter 2: receives the reviewed workspace context and fixes files;
+  │                   Orka owns the next publication attempt
   │
   ├── (review loop repeats until APPROVED or max iterations)
   │
   ├── create_pull_request(task_name="coder-task-xyz",
   │                       head_branch="feature/my-change",
   │                       base_branch="main", title="feat: my change")
-  │     → creates PR via GitHub API using git credentials from task
+  │     → creates PR via GitHub API using workspace.publicationCredentialRef
   │
   ├── review_pull_request(task_name="coder-task-xyz", pr_number=42)
   │     → fetches PR diff and file changes for analysis
@@ -644,7 +655,7 @@ COORDINATOR (AI worker)
 |-----------|------|-------------|
 | `prior_task` | string | Name of a previously completed task whose diff to apply before starting |
 | `feedback` | string | Review feedback prepended to the prompt as `FEEDBACK FROM REVIEW: ...` |
-| `workspace.pushBranch` | string | Remote branch to auto-push changes to after the agent completes |
+| `workspace.pushBranch` | string | Publication branch reconciled by the clean-room Workspace/Publisher after validation |
 
 When `prior_task` is set:
 - `PriorTaskRef` is set on the child Task, triggering diff application in the worker
@@ -698,29 +709,25 @@ You are a coordinator agent. Follow this protocol:
 7. Report final result.
 ```
 
-### Environment Variables
+### ACP workspace and delivery data
+
+ACP children do not receive Git publication environment variables or credentials. The delegated child Task stores source/publication policy in top-level `spec.workspace`, and Orka records the authoritative outcome in `status.delivery`.
 
-| Variable | Set When | Description |
-|----------|----------|-------------|
-| `ORKA_PRIOR_TASK` | Task has PriorTaskRef | Name of the prior task |
-| `ORKA_PRIOR_TASK_NAMESPACE` | Task has PriorTaskRef | Namespace of the prior task |
-| `ORKA_FORK_REPO` | Workspace has ForkRepo | Fork repository URL |
-| `ORKA_PR_BASE_BRANCH` | Workspace has PRBaseBranch | PR target branch |
-| `ORKA_PUSH_BRANCH` | Workspace has PushBranch | Branch to auto-push changes to |
+Require a terminal verified delivery receipt before creating or merging a pull request. A model result that says files were changed or pushed is not publication evidence.
 
 ### create_pull_request Tool
 
-Creates a GitHub pull request from a branch that was pushed by a completed agent task.
+Creates a GitHub pull request from a branch that Orka independently verified for a completed agent Task.
 
 | Parameter | Type | Required | Description |
 |-----------|------|----------|-------------|
-| `task_name` | string | yes | Name of the completed child task (used to look up workspace config and git credentials) |
+| `task_name` | string | yes | Name of the completed child Task whose workspace and delivery receipt identify the publication repository/branch |
 | `head_branch` | string | yes | Branch containing the changes (the `pushBranch` from the coder task) |
 | `base_branch` | string | yes | Target branch to merge into (e.g. `main`) |
 | `title` | string | yes | Pull request title |
 | `body` | string | no | Pull request body in Markdown |
 
-The tool reads the git credentials from the child task's `gitSecretRef` secret (looks for a non-empty `token`, `password`, or `GITHUB_TOKEN` key) and calls the GitHub REST API. The coordinator must have RBAC access to read Secrets.
+The tool resolves the child Task's `workspace.publicationCredentialRef` and calls the GitHub API for the verified publication repository. The publication credential is distinct from `readCredentialRef` and is never delivered to the ACP runtime.
 
 ### create_pr_monitor Tool
 
@@ -734,14 +741,14 @@ Creates a scheduled prompt-orchestrated pull request monitor Task for one GitHub
 | `agent_ref` | string | yes | AI Agent name for the scheduled monitor Task. The Agent must have coordination enabled and autonomous coordination disabled. |
 | `namespace` | string | no | Namespace for the monitor Task. Defaults to the current task namespace. |
 | `provider_ref` | string | no | Optional Provider reference for the scheduled AI Task. |
-| `gitSecretRef` | string | no | Secret containing Git/GitHub credentials. If omitted, Orka tries supported default git credential Secret names in the target namespace. |
+| `gitSecretRef` | string | no | Compatibility parameter for the monitor API. The selected Secret is stored on the created Task as `spec.workspace.readCredentialRef`; it is not the deprecated Task workspace field. |
 | `per_page` | integer | no | Maximum open PRs to scan per run. Defaults to `30`, maximum `100`. |
 | `review_event` | string | no | Review event to post after analysis: `COMMENT`, `APPROVE`, or `REQUEST_CHANGES`. Defaults to `COMMENT`. |
 | `prompt` | string | no | Additional instructions appended to the generated monitor prompt. |
 
 Pull request, issue, branch/tree, blob/file, commit, query-string, fragment, non-GitHub, HTTP, and embedded-credential URLs are rejected before Orka creates the monitor Task.
 
-If `gitSecretRef` is omitted, Orka searches `git-credentials`, `github-credentials`, `copilot-token`, `github-token`, and `git-token`. The selected Git credential Secret must exist in the target namespace and contain a non-empty `token`, `password`, or `GITHUB_TOKEN` key. The created Task receives a narrow tool set: `list_pull_requests`, `check_pr_review_marker`, `check_pull_request_ci`, `review_pull_request`, and `post_review_comment`. The generated prompt tells the Task to pass the same `repo_url` to each PR tool call. Those explicit repository URLs are scope-checked against the Task workspace or signed transaction repository context before Orka resolves credentials or calls GitHub.
+If the monitor tool's `gitSecretRef` parameter is omitted, Orka searches `git-credentials`, `github-credentials`, `copilot-token`, `github-token`, and `git-token`. The selected Secret must exist in the target namespace and contain a non-empty `token`, `password`, or `GITHUB_TOKEN` key; Orka maps it to the Task read-credential role. The created Task receives a narrow tool set: `list_pull_requests`, `check_pr_review_marker`, `check_pull_request_ci`, `review_pull_request`, and `post_review_comment`. The generated prompt tells the Task to pass the same `repo_url` to each PR tool call. Those explicit repository URLs are scope-checked against the Task workspace or signed transaction repository context before Orka resolves credentials or calls GitHub.
 
 ### check_pull_request_ci Tool
 
@@ -967,8 +974,10 @@ Updates the autonomous execution plan state. Must be called at least once per it
 ```
 You are a coordinator agent. Follow this protocol:
 
-1. DELEGATE implementation to the coder agent with pushBranch set.
-2. WAIT for the coder's result.
+1. DELEGATE implementation to the coder agent with workspace.intent = write,
+   separate readCredentialRef/publicationCredentialRef, publicationGitRepo,
+   pushBranch, and prBaseBranch. Tell the coder to edit only.
+2. WAIT for the coder's result and require a verified delivery receipt.
 3. DELEGATE review to the reviewer agent (pass prior_task = coder's task name).
 4. WAIT for the reviewer's verdict.
 5. IF verdict == "CHANGES_NEEDED" AND iteration < 3:
diff --git a/website/docs/guides/observability.md b/website/docs/guides/observability.md
index 2cbcc6c47..fc94f5795 100644
--- a/website/docs/guides/observability.md
+++ b/website/docs/guides/observability.md
@@ -4,8 +4,9 @@ slug: /observability
 
 # Observability
 
-Orka emits OpenTelemetry traces and metrics for controller, chat, tool, AI
-worker, and harness-backed agent runtime paths when telemetry is enabled. The
+Orka emits OpenTelemetry traces and metrics for controller, chat, tool, and native AI
+worker paths when telemetry is enabled. ACP v2 execution is observed primarily through
+durable Task execution/delivery status, RuntimePool status, bounded events, and structured logs. The
 GenAI signals are backend instrumentation: they are exported over OTLP to your
 collector/backend and are separate from the Orka React UI.
 
@@ -73,23 +74,18 @@ Telemetry environment for AI workers is controller-owned: task-supplied
 preserve user-supplied telemetry env, because Orka does not instrument arbitrary
 container processes.
 
-Harness-wrapper and agent-runtime worker telemetry is explicit opt-in: set
-`ORKA_ENABLE_TELEMETRY=true` and OTLP exporter configuration on those workloads
-when you want their process-local spans exported.
+Managed ACP RuntimePools are not per-Task Jobs and do not inherit `Task.spec.env`.
+The current ACP supervisor does not copy controller OTLP configuration or W3C trace
+context into provider children. Use these current sources of truth instead:
 
-For the singleton CLI harness wrapper Deployment, opt in explicitly:
+- `Task.status.execution` for fenced attempt, RuntimePool, RuntimeSession, prompt, and terminal outcome;
+- `Task.status.delivery` for workspace validation/publication state and non-secret receipts;
+- `RuntimePool.status` for lifecycle, admission, exact Pod/boot identity, capacity, and pressure;
+- Task execution events and controller/runtime/publisher structured logs.
 
-```bash
-kubectl set env deployment/orka-agent-harness-wrapper -n orka-system \
-  ORKA_ENABLE_TELEMETRY=true \
-  OTEL_EXPORTER_OTLP_ENDPOINT=otel-collector.otel.svc:4317 \
-  OTEL_EXPORTER_OTLP_INSECURE=true
-```
-
-For per-Task agent runtime Jobs, set telemetry env in the Task `spec.env` where
-you intentionally want that runtime process to export spans. Orka reserves and
-overwrites trace-context env (`ORKA_TRACEPARENT`, `ORKA_TRACESTATE`,
-`ORKA_BAGGAGE`) so user-supplied values cannot forge parentage.
+Do not add credential-bearing OTLP headers to runtime images or provider child environments.
+Any future ACP telemetry propagation must preserve the empty child-environment allowlist and
+bind trace context to the exact Task attempt and prompt operation.
 
 Credential-bearing OTLP header environment variables are not copied from the
 controller into task workloads. Use an in-cluster collector endpoint or a
@@ -121,10 +117,10 @@ of the model client span under the same agent/chat step, not children of the
 model client span.
 
 Task creation stamps the current W3C trace context into Task annotations. The
-controller extracts that context when reconciling the Task and injects
-`ORKA_TRACEPARENT` into worker Jobs or harness-wrapper turn metadata. Delegation
-stamps the active `execute_tool delegate_task` span context onto the child Task,
-so the child `task.run` span is linked to the parent tool call.
+controller extracts that context for supported native worker Tasks and injects
+`ORKA_TRACEPARENT` into their Jobs. ACP prompt requests do not currently carry
+that trace context. Delegation stamps the active `execute_tool delegate_task`
+span context onto the child Task so native child spans remain linked.
 
 Outbound HTTP and MCP Tool CRD requests receive W3C `traceparent` headers. If a
 Tool config supplies its own `traceparent` header, the active Orka trace context
diff --git a/website/docs/guides/repository-monitors.md b/website/docs/guides/repository-monitors.md
index a26b6fa06..8f9514bb0 100644
--- a/website/docs/guides/repository-monitors.md
+++ b/website/docs/guides/repository-monitors.md
@@ -24,7 +24,7 @@ A repository monitor can:
 - store monitor runs, issue/PR items, command events, workflow actions, action records, implementation jobs, mutation records, review records, and audit events durably
 - show monitor status, recent runs, workflow timeline, blocked reasons, implementation jobs, mutation audit, issues, and the PR queue in the dashboard under **Monitors**
 
-The review task is bound to the exact PR head SHA. It runs as a `type: agent` task, uses a Claude runtime Agent, checks out the PR head in a read-only workspace, writes generated PR context under `/workspace/.git/orka/`, and is instructed to return only the structured review result. It does not receive GitHub mutation credentials, post comments, push commits, merge, close, or mutate labels. If `spec.review.publish.enabled` is true, the controller later revalidates the PR state and may publish a deterministic neutral `COMMENT` review from the structured result.
+The review Task is bound to the exact PR head SHA. It runs as a `type: agent` Task with top-level `workspace.intent: read`; `RepositoryMonitor.spec.readCredentialRef` is mapped to `workspace.readCredentialRef`, with `spec.gitSecretRef` retained only as a backward-compatible read-only fallback. The ACP runtime receives no Git credential and must leave the verified tree unchanged. If `spec.review.publish.enabled` is true, the controller later revalidates the PR state and may publish a deterministic neutral `COMMENT` review with `spec.forgeCredentialRef`.
 
 ## Current Limits
 
@@ -37,27 +37,19 @@ The first implementation is intentionally narrow:
 - `spec.review.requireGreenCI` gates review selection until CI is green.
 - GitHub webhook-driven exact runs are opt-in with `spec.review.exactEventEnabled`.
 - Repair, maintainer command routing, issue action workflows, implementation budgets (`maxActive`, `maxAttemptsPerIssue`, `maxChangedFiles`, `allowedPaths`), and optional head-bound automerge are active monitor-owned workflows. Automerge remains disabled by default and requires explicit configuration plus a one-shot command.
-- The reviewer Agent must use `runtime.type: claude` and reference a Secret in the monitor namespace with `ANTHROPIC_API_KEY` or `ANTHROPIC_FOUNDRY_API_KEY`.
+- Built-in reviewer Agents may use `runtime.type: claude`, `codex`, or `opencode`. Codex reviewers are confined by the RuntimeSession boundary: elevation requests are rejected by the controller, file writes are mediated by the supervisor, and the read-intent workspace delta classification fails any turn that modifies the workspace. Reviewer Agents must omit `spec.secretRef`; provider credentials come from the controller-managed runtime proxy and never enter the Task spec.
 
 ## CI Coverage
 
 Repository monitor backend coverage has a focused GitHub Actions workflow at `.github/workflows/repository-monitor-smoke.yml`. It runs on pull requests and pushes that touch the workflow, Go API/controller/store code, CRD/config paths, worker code, or Go dependency files.
 
-The smoke workflow creates the UI embed stub and runs targeted Go tests for monitor store CRUD, API handlers, GitHub pull request event handling, targeted single-PR inventory runs, controller queue and review flow, blocked status counts, read-only review task job construction, stdout result forwarding, `create_pr_monitor` repository URL and credential validation, GitHub tool `repo_url` scope enforcement, and PR review marker signing/detection tooling. Worker-level PR review diff context generation is covered by the normal Go test workflow. UI monitor pages are covered by the normal frontend test workflow rather than this smoke workflow.
+The smoke workflow creates the UI embed stub and runs targeted Go tests for monitor store CRUD, API handlers, GitHub pull request event handling, targeted single-PR inventory runs, controller queue and review flow, blocked status counts, read-only review Task construction, stdout result forwarding, `create_pr_monitor` repository URL and credential validation, GitHub tool `repo_url` scope enforcement, and PR review marker signing/detection tooling. Worker-level PR review diff context generation is covered by the normal Go test workflow. UI monitor pages are covered by the normal frontend test workflow rather than this smoke workflow.
 
 The smoke workflow is secret-free. Exact pull request event queueing is exercised with synthetic signed webhook payloads and test clients, so repository monitor PRs do not need live GitHub credentials just to verify queueing, scope checks, or review result ingestion in CI.
 
 ## Prerequisites
 
-Create Claude runtime credentials in the monitor namespace:
-
-```bash
-kubectl create secret generic claude-runtime-credentials \
-  --namespace default \
-  --from-literal=ANTHROPIC_API_KEY='<anthropic-api-key>'
-```
-
-Then create a Claude runtime Agent in the same namespace as the monitor, or set `spec.agents.reviewer.namespace` explicitly. Orka validates that the Agent references a Secret in the monitor namespace and that the Secret contains a supported Claude auth key.
+Create a built-in runtime Agent in the same namespace as the monitor, or set `spec.agents.reviewer.namespace` explicitly. Built-in runtime Agents must not set `spec.secretRef`; provider authentication is supplied by the controller-managed runtime proxy.
 
 ```yaml
 apiVersion: core.orka.ai/v1alpha1
@@ -66,8 +58,6 @@ metadata:
   name: repo-reviewer
   namespace: default
 spec:
-  secretRef:
-    name: claude-runtime-credentials
   runtime:
     type: claude
     defaultMaxTurns: 50
@@ -82,25 +72,34 @@ spec:
       Return concise, structured findings and do not mutate GitHub.
 ```
 
-For private repositories or higher GitHub rate limits, create a Git Secret in the monitor namespace. This is separate from the reviewer Agent's Claude credential Secret. When a monitor is created or updated through the API, Orka validates that the referenced Git Secret exists and contains a non-empty `token`, `password`, or `GITHUB_TOKEN` key.
+For private repositories or higher GitHub rate limits, create a source-read Secret in the monitor namespace. When a monitor is created or updated through the API, Orka validates that each configured credential Secret exists and contains a non-empty `token`, `password`, or `GITHUB_TOKEN` key.
 
 ```bash
-kubectl create secret generic repo-monitor-github \
+kubectl create secret generic repo-monitor-source-read \
   --namespace default \
-  --from-literal=token='<github-token>'
+  --from-literal=token='<read-only-github-token>'
 ```
 
-The same Secret is mounted into review workspaces for same-repository PR heads. Fork PR heads are checked out from the fork URL without the monitored repository credential.
+For review, triage, research, and planning Tasks, the controller maps `RepositoryMonitor.spec.readCredentialRef` to top-level `workspace.readCredentialRef`. `spec.gitSecretRef` is accepted only as a compatibility fallback for this source-read role. The clean-room source boundary resolves it for same-repository private PR heads; the ACP runtime never receives the Secret. Fork PR heads use the eligible source repository URL and remain read-only.
+
+Implementation and repair are write workflows and require four explicit, pairwise-distinct Secret references:
+
+| RepositoryMonitor field | Task workspace role | Required capability |
+| --- | --- | --- |
+| `readCredentialRef` | `workspace.readCredentialRef` | Source clone/read only |
+| `publicationReadCredentialRef` | `workspace.publicationReadCredentialRef` | Target preflight and independent verification only |
+| `publicationCredentialRef` | `workspace.publicationCredentialRef` | Exact compare-and-swap branch push |
+| `forgeCredentialRef` | `workspace.forgeCredentialRef` | Controller-owned GitHub API operations and PR reconciliation |
+
+`gitSecretRef` never supplies a write, publication, or forge role. A write Task is not created when any explicit role is missing or when two roles reference the same Secret. Credential values are resolved only by the controller/Workspace Publisher brokers and never appear in ACP process environment, prompts, Task status, or delivery receipts.
 
 ## Review Workspace Context
 
-Before the Claude reviewer starts, the worker fetches the PR base branch and writes generated read-only context files:
+The review Task is pinned to the exact PR head SHA with `workspace.intent: read`. Before creating it, the controller fetches the pull request identity, requests GitHub's exact `baseSHA...headSHA` comparison, and refetches the pull request to ensure the base, head, and head repository did not change during context assembly. A race fails closed instead of queueing a stale review.
 
-- `/workspace/.git/orka/pr-review.md` - base/head summary and diff stats
-- `/workspace/.git/orka/pr-review.files` - changed file list
-- `/workspace/.git/orka/pr-review.diff` - unified diff from the base branch to the PR head
+The controller embeds a bounded `orka.prReview.context.v1` payload in the prompt: at most 100 changed files, at most 700 KiB encoded context, at most 64 KiB encoded patch excerpt per file, and bounded paths/short metadata fields. The payload explicitly marks missing patches and local truncation. The prompt treats titles, labels, paths, patches, and repository content as untrusted data and tells the reviewer to inspect the verified checkout whenever GitHub context is incomplete.
 
-The generated files are added to the workspace's git exclude file so they are not captured as task changes. Read-only review tasks receive only scoped file-reading tools for `/workspace/**` and selected Claude runtime environment variables from the reviewer Secret.
+The reviewer must not mutate the verified tree. Any unexpected workspace change fails read validation. GitHub review publishing, when enabled, happens later through the controller's deterministic publisher path; the ACP child has no GitHub mutation credential.
 
 ## Create a Monitor
 
@@ -114,8 +113,8 @@ spec:
   provider: github
   repoURL: https://github.com/example/app
   branch: main
-  gitSecretRef:
-    name: repo-monitor-github
+  readCredentialRef:
+    name: repo-monitor-source-read
   schedule: "*/30 * * * *"
   timeZone: "UTC"
   targets:
@@ -305,7 +304,7 @@ spec:
           automerge: orka:automerge
 ```
 
-When a matching label webhook arrives, Orka verifies the webhook signature, matches the repository monitor by repository and target kind, checks the sender's current GitHub repository permission using `spec.gitSecretRef`, records a durable command event, and queues a targeted monitor run for accepted commands. Replayed deliveries are idempotent. Guard labels from `spec.policy.protectedLabels` and `spec.policy.pauseLabels` record blocked commands and do not queue work.
+When a matching label webhook arrives, Orka verifies the webhook signature, matches the repository monitor by repository and target kind, checks the sender's current GitHub repository permission using `spec.forgeCredentialRef`, records a durable command event, and queues a targeted monitor run for accepted commands. Replayed deliveries are idempotent. Guard labels from `spec.policy.protectedLabels` and `spec.policy.pauseLabels` record blocked commands and do not queue work.
 
 Inspect command intake with:
 
@@ -326,7 +325,9 @@ When issue command labels are enabled, accepted issue commands now drive monitor
 
 Issue action tasks are bound to the issue snapshot digest. Result payloads with mismatched issue numbers or stale digests are recorded as stale/failed action records instead of advancing workflow state.
 
-Implementation tasks do not push directly. They return a structured diff that Orka validates and stores as `orka.patch.v1` patch artifacts. After patch validation, the controller creates a separate mutation task with a controller-selected push branch (`spec.issueWorkflow.implementation.branchPrefix`, default `orka/issue`) and a `priorTaskRef` to apply the validated diff in a fresh workspace. When that mutation task pushes successfully, the controller creates or reuses the pull request with a deterministic Orka-rendered body and records mutation action records.
+Implementation Tasks use `workspace.intent: write`, a controller-selected push branch (`spec.issueWorkflow.implementation.branchPrefix`, default `orka/issue`), and the four explicit credential roles above. The ACP child edits only the sanitized workspace and receives no Git or forge credential. After prompt completion, the separate Workspace Publisher freezes and validates the delta, performs the exact publication, independently verifies the remote, and records a non-secret `status.delivery` receipt.
+
+The controller advances the workflow only from a `VerifiedExact` delivery whose publication repository, branch, expected commit, verified remote SHA, prior remote SHA, and artifact digest all match the Task contract. Missing, conflicting, superseded, cancelled, credential-blocked, or otherwise unverifiable delivery is recorded as a blocked implementation. After verified publication, the controller uses `forgeCredentialRef` to create or reuse the pull request with a deterministic Orka-rendered body.
 
 Inspect action records with:
 
@@ -344,7 +345,7 @@ Pull request command labels can start bounded controller-tracked repair tasks:
 - `orka:fix-ci` queues a CI repair task using the same repair path.
 - `orka:update-branch` queues a base-update repair task and allows empty push-branch updates.
 
-Repair jobs are stored durably and linked to monitor items. Successful repairs clear stale review state so the next exact-head review can recompute readiness. By default, a PR with a passed exact-head review and no active repair is surfaced as merge-ready state for humans to merge; Orka only merges automatically when the optional automerge workflow below is explicitly enabled.
+Repair Tasks are exact-head write Tasks: `workspace.ref` and `workspace.expectedRemoteSHA` bind the selected PR head, and publication targets that same branch. A repair succeeds only with a matching `VerifiedExact` delivery receipt. An `update-branch` no-change result is accepted only after the controller independently verifies that the exact PR head contains the requested base revision. Successful repairs clear stale review state so the next exact-head review can recompute readiness. By default, a PR with a passed exact-head review and no active repair is surfaced as merge-ready state for humans to merge; Orka only merges automatically when the optional automerge workflow below is explicitly enabled.
 
 
 ## Optional Automerge
diff --git a/website/docs/guides/repository-security-scanning.md b/website/docs/guides/repository-security-scanning.md
index f3c98615f..3bec941fc 100644
--- a/website/docs/guides/repository-security-scanning.md
+++ b/website/docs/guides/repository-security-scanning.md
@@ -75,6 +75,8 @@ spec:
   maxFindingsPerRun: 25
 ```
 
+For patch Tasks, the Workspace/Publisher—not the ACP child—prepares and publishes the branch.
+
 See [Configuration → RepositoryScan](../concepts/configuration.md#repositoryscan) for every
 spec and status field, and [API Reference → Security](../reference/api-reference.md#security)
 for the endpoint and query-parameter reference, including the typical findings → validate →
@@ -175,12 +177,11 @@ old repository-wide findings by itself.
 
 ## Safety
 
-- Scan and patch tasks run in isolated worker pods with Orka's hardened defaults (non-root,
-  read-only rootfs, dropped capabilities).
-- Private repositories require an explicit `gitSecretRef` (or detected credentials).
+- Scan and patch agent Tasks use ACP RuntimePools with private RuntimeSessions; deterministic mapper/container work keeps the native hardened worker path.
+- `RepositoryScan.spec.gitSecretRef` remains the scan-level compatibility reference. Orka maps it to `workspace.readCredentialRef` for scans and to both Task read/publication roles for patch Tasks; the ACP child never receives the Secret.
 - Patches and PRs are never created automatically — both are explicit user actions.
-- Patch proposals cannot reach `patch_ready` without a pushed branch, patch summary, and
-  diff artifact that matches the worker's structured workspace diff.
+- Patch proposals cannot reach `patch_ready` without a verified publisher branch receipt, patch summary, and
+  diff artifact that matches the validated workspace delta.
 - Edited threat models are treated as ranking input, not executable instructions.
 - Finding evidence is structured as repo-relative file/line references or flat sanitized
   artifacts within the per-file (10 MB) and total (50 MB) artifact upload limits.
diff --git a/website/docs/operations/agent-runtime-security.md b/website/docs/operations/agent-runtime-security.md
index d3a69cf39..7c982edeb 100644
--- a/website/docs/operations/agent-runtime-security.md
+++ b/website/docs/operations/agent-runtime-security.md
@@ -1,13 +1,14 @@
 # AgentRuntime security operations
 
-AgentRuntime integrations preserve one invariant: remote agents may ask, but Orka decides and executes.
+AgentRuntime integrations preserve one invariant: runtimes may request work,
+but Orka owns authorization, durable effects, and delivery.
 
 ## Trust boundaries
 
 | Zone | Trust | Notes |
 | --- | --- | --- |
 | Orka control plane | trusted for policy, approvals, idempotency, audit | owns Tool execution and credentials |
-| AgentRuntime adapter | least-privileged protocol adapter | should not store downstream Tool secrets |
+| AgentRuntime adapter | least-privileged `orka.harness.v2` adapter | must not store downstream Tool, provider, Git, or forge secrets |
 | Remote execution backend | untrusted/semi-trusted workload runtime | may be prompt-injected or compromised |
 | Downstream tools | protected systems | reached only through Orka Tool execution |
 
@@ -19,13 +20,28 @@ AgentRuntime integrations preserve one invariant: remote agents may ask, but Ork
 - Expose tools with explicit `Task.spec.agentRuntime.allowedTools`; brokered mode does not imply access to all Tools.
 - Classify remote-exposed Tools with `spec.brokeredToolClass`.
 - Use write-class Tools for consequential actions so approval and exact-argument digest checks run before execution.
+- Require the per-session loopback MCP proxy to present the active Task,
+  attempt, prompt, lease, RuntimeSession, RuntimePool, runtime-instance, and
+  controller fences on every call.
+- Reserve a durable `ExternalEffect` identity before consequential execution;
+  replay only a committed matching response.
 - Treat `WaitingForApproval=True` as an intentional parked state, not a failure.
 - Investigate `tool_execution_outcome_unknown` before retrying a write; Orka failed closed to avoid duplicate side effects.
 
 ## Production hardening checklist
 
-- Prefer HTTPS, mTLS, signed turn tokens, or private networking for external adapters.
+- Prefer HTTPS, mTLS, private networking, and the v2 bearer plus
+  operation-capability scheme for external adapters.
 - Rotate runtime bearer Secrets and ensure the `AgentRuntime` observes the new Secret resourceVersion before use.
+- Keep built-in provider credentials behind the central provider proxy; do not
+  add `Agent.spec.secretRef` to Codex, Claude, Copilot, or OpenCode Agents.
+- Use `config/acp-production` for direct Kustomize deployments so Vekil accepts
+  ingress only from the authenticated provider proxy.
+- Keep source-read, target-read, target-write, and forge credentials in
+  separate Task workspace references. They are delivered only through the
+  controller credential broker to the clean-room Publisher.
+- Ensure the Publisher uses the controller artifact authorization broker and
+  does not mount the artifact capability signing key.
 - Ensure downstream tools honor `Idempotency-Key` for write requests.
 - Keep large artifacts in artifact storage and return safe references rather than huge summaries.
 - Redact auth headers, tokens, TxTokens, and raw transcripts from adapter logs.
diff --git a/website/docs/operations/harness-modes.md b/website/docs/operations/harness-modes.md
new file mode 100644
index 000000000..accfbd7e9
--- /dev/null
+++ b/website/docs/operations/harness-modes.md
@@ -0,0 +1,172 @@
+# Operating harness v1 and v2 on one cluster
+
+Orka can run harness v1 and harness v2 on one Kubernetes cluster as two
+independent installations. They share the Kubernetes API server and one
+platform-owned CRD schema bundle, but they do not share Tasks, Sessions,
+controller state, or execution data planes.
+
+## Static mode contract
+
+Each controller accepts exactly one required mode:
+
+| Mode | Agent execution path |
+| --- | --- |
+| `harness-v1` | Legacy turn-oriented harness wrapper |
+| `harness-v2` | ACP RuntimePools and RuntimeSessions |
+
+There is no `dual`, `auto`, or `harness-v1-drain` mode. A release never changes
+mode in place.
+
+The controller also requires a non-empty watched namespace labeled with the
+same mode:
+
+```bash
+kubectl create -f - <<'EOF'
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: orka-v1-system
+  labels:
+    orka.ai/controller-mode: harness-v1
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: orka-v2-system
+  labels:
+    orka.ai/controller-mode: harness-v2
+EOF
+```
+
+A missing or mismatched label fails startup. The claim must be present when the
+namespace is created; do not adopt an unlabeled namespace or relabel one to move
+it between modes.
+
+## Isolation checklist
+
+Use different values for every release-owned resource:
+
+| Boundary | Harness v1 | Harness v2 |
+| --- | --- | --- |
+| Helm release | `orka-v1` | `orka-v2` |
+| Release/watch namespace | `orka-v1-system` | `orka-v2-system` |
+| Controller API | v1-specific Service/endpoint | v2-specific Service/endpoint |
+| Leader election | Lease in `orka-v1-system` | Lease in `orka-v2-system` |
+| State | v1-only SQLite/PVC/backups | v2-only SQLite/PVC/backups |
+| Data plane | Wrapper Service and ledger | Dedicated ACP runtime namespace |
+| Identity | v1 ServiceAccounts and Secrets | v2 ServiceAccounts and Secrets |
+
+NetworkPolicies and namespace-scoped RBAC must prevent either controller from
+reading or writing the other watched namespace. A namespace-scoped controller
+cache is not an authorization boundary by itself.
+
+The supported Helm topology co-locates each controller and its watched objects
+in the release namespace. The chart rejects a different
+`controller.watchNamespace`, which keeps all namespaced RBAC and release-owned
+data-plane resources inside one boundary. Harness v2 still uses a separate
+runtime namespace.
+
+The v2 release owns cluster-scoped gateway and workspace-provider reconcilers.
+Do not enable those reconcilers in v1. Install common cluster-scoped admission
+resources once.
+
+## Manage CRDs once
+
+CRDs are cluster-scoped, so both installations use one schema bundle capable of
+storing the supported v1 and v2 shapes. Designate a platform or GitOps owner,
+apply the target CRDs before either controller upgrade, and install both Helm
+releases with `--skip-crds`:
+
+```bash
+scripts/apply-helm-crds.sh /absolute/path/to/orka-chart.tgz my-context
+
+helm install orka-v1 /absolute/path/to/orka-chart.tgz \
+  --namespace orka-v1-system \
+  --skip-crds \
+  --set controller.mode=harness-v1 \
+  --set controller.watchNamespace=orka-v1-system
+
+helm install orka-v2 /absolute/path/to/orka-chart.tgz \
+  --namespace orka-v2-system \
+  --skip-crds \
+  --set controller.mode=harness-v2 \
+  --set controller.watchNamespace=orka-v2-system \
+  --set controller.acpRuntime.namespace=orka-v2-runtimes
+```
+
+Add the required digest-pinned images, Secrets, proxy, Publisher, storage, and
+wrapper values for each selected mode. Do not let both releases install or
+upgrade the CRDs independently. Helm does not update `crds/` during
+`helm upgrade`.
+
+An existing release is eligible for an in-place controller upgrade only when
+its namespace already carries the exact static mode claim and any live
+controller declares that mode and watch namespace. A deleted controller may be
+recreated only under that retained same-mode claim. A pre-static controller
+that implicitly enabled ACP is not a supported static-v2 upgrade source:
+accepted work may lack the immutable execution authority needed for safe
+recovery. Settle or retire it, preserve its existing state, and install
+`harness-v2` as a new release and namespace. The canonical Helm and
+direct-Kustomize paths enforce this before changing workloads.
+
+## Route new work explicitly
+
+Producers choose an installation by its API endpoint and watched namespace.
+During v2 rollout:
+
+1. leave existing v1 Tasks and Sessions on the v1 endpoint;
+2. install v2 in its fresh namespaces and run new v2 canaries;
+3. verify cross-namespace API access is forbidden;
+4. point selected producers at the v2 endpoint;
+5. create new v2 Agents, Tasks, and Sessions.
+
+Unavailable v2 capacity fails closed. It never sends work to the v1 wrapper.
+
+## No protocol migration
+
+Do not:
+
+- patch a v1 Agent, AgentRuntime, or Task into v2;
+- reuse a v1 controller PVC, database, wrapper ledger, or Session in v2;
+- copy a transcript and claim continuation of the original Session;
+- ask one controller to cancel, settle, publish, finalize, or clean up the
+  other controller's work;
+- change `controller.mode` or `orka.ai/controller-mode` on an existing
+  installation.
+
+You may copy non-secret configuration into a newly created object in the other
+installation. It has a new namespace, UID, Session lineage, attempt history,
+and external-effect history; it is not migrated work.
+
+## Drain and retire v1
+
+Draining v1 is an operational procedure, not a controller mode:
+
+1. stop v1 API ingress and every internal or external v1 producer;
+2. revoke permissions that create v1 agent Tasks;
+3. record a cutoff and inventory queued, active, finalizing, and cleanup work;
+4. let existing work settle through v1, preserving unknown outcomes where
+   acceptance cannot be disproved;
+5. repeat uncached inventory until v1 execution, Session settlement,
+   finalizers, and wrapper-ledger cleanup reach zero;
+6. back up retained v1 history and state;
+7. remove v1 workloads and revoke their credentials;
+8. delete PVCs or historical data only under a separate retention decision.
+
+The wrapper's authenticated Pod-template drain remains required before a
+wrapper upgrade. It protects in-memory v1 turns and is unrelated to controller
+mode or v2.
+
+## Rollback
+
+Rollback changes only future routing. Stop new submissions to v2 and, if the
+v1 installation is still intentionally open, submit replacement work there as
+new v1 Tasks. Existing v2 work remains owned by v2 and must settle or be
+canceled through v2.
+
+Keep the shared CRD superset while either v1 or v2 objects remain. Restore each
+installation only from its own coordinated Kubernetes and persistent-state
+backup; never restore one mode's state into the other.
+
+The full architecture and release gates are in the
+[isolated coexistence plan](https://github.com/orka-agents/orka/blob/main/docs/harness-v1-v2-coexistence-plan.md).
diff --git a/website/docs/reference/api-reference.md b/website/docs/reference/api-reference.md
index 4390bd471..1ab6710c6 100644
--- a/website/docs/reference/api-reference.md
+++ b/website/docs/reference/api-reference.md
@@ -51,25 +51,39 @@ The controller requires `ORKA_GITHUB_WEBHOOK_SECRET` and verifies the `X-Hub-Sig
 | `/api/v1/tasks/:id/plan` | GET | Get task plan |
 | `/api/v1/tasks/:id/children` | GET | Get child tasks |
 
-### Task Execution Workspace Schema
+### Agent Task workspace and delivery schema
 
-`POST /api/v1/tasks` accepts the Task CRD shape. Agent Tasks may include `spec.execution.workspace` to request experimental workspace-backed execution through an upstream `agent-sandbox` or Agent Substrate installation. The controller validates the request, resolves/defaults the effective workspace settings, and injects them into the outer Kubernetes worker Job. The agent worker wrapper then claims and executes inside the upstream workspace.
+`POST /api/v1/tasks` accepts the Task CRD shape. Agent repository configuration belongs at top-level `spec.workspace`; `spec.agentRuntime` contains only per-Task runtime overrides.
 
 | Path | Type | Values/default | Notes |
-|------|------|----------------|-------|
-| `spec.execution.workspace.enabled` | boolean | default `false` | Enables workspace-backed execution for an agent Task. The controller rejects enabled requests unless the selected provider is enabled. |
-| `spec.execution.workspace.provider` | string | controller default provider; built-in default `agent-sandbox` | Workspace backend: `agent-sandbox` or `substrate`. |
-| `spec.execution.workspace.templateRef.name` | string | controller default template, if configured | Workspace template name. Required when `enabled: true` and no controller default template is configured. |
-| `spec.execution.workspace.templateRef.namespace` | string | Task namespace, or provider-specific default namespace when configured | Namespace containing the workspace template. |
-| `spec.execution.workspace.reusePolicy` | string | `none`; allowed `none`, `session` | `session` derives the reuse key from `spec.sessionRef.name` and requires that field to be set. |
-| `spec.execution.workspace.cleanupPolicy` | string | controller default cleanup policy; allowed `delete`, `retain` | Cleanup behavior after the sandbox command exits. |
-| `spec.execution.workspace.boot` | boolean | default `false` | Substrate only. Boots the actor from scratch on first resume. |
-| `spec.execution.workspace.poolRef.name` | string | empty | Substrate only. Places the Task on a `SubstrateActorPool`; pooled workspaces currently require `cleanupPolicy: delete`. |
-| `spec.execution.workspace.poolRef.namespace` | string | Task namespace | Substrate only. Namespace containing the referenced pool. |
-| `spec.execution.workspace.snapshot` | object | empty | Substrate only, reserved. Non-empty restore/checkpoint settings are currently rejected. |
-| `spec.execution.workspace.hibernation` | object | empty | Substrate only, reserved. `processMode: resident` is currently rejected. |
-
-Workspace requests are only valid on `spec.type: agent` Tasks. See [Agent Sandbox Workspaces](../concepts/agent-sandbox.md) and [Substrate Execution Workspaces](../concepts/substrate.md) for configuration, validation rules, live smoke-test steps, and current limitations.
+| --- | --- | --- | --- |
+| `spec.workspace.intent` | string | `read` for agent Tasks; `read` or `write` | Immutable effective intent for the attempt. |
+| `spec.workspace.gitRepo` | string | empty | Credential-free source repository URL. Embedded credentials, query strings, and fragments are rejected. |
+| `spec.workspace.sourceRepository` | object | empty | Optional canonical provider/ID source identity. |
+| `spec.workspace.branch` / `ref` | string | empty | Source branch or exact ref/commit/tag. When both are empty, the Publisher resolves and freezes the repository's advertised default branch before execution. |
+| `spec.workspace.readCredentialRef.name` | string | empty | Secret used only by the clean-room source clone/read operation. |
+| `spec.workspace.publicationGitRepo` | string | empty | Credential-free publication repository URL. |
+| `spec.workspace.publicationRepository` | object | empty | Optional canonical provider/ID publication identity. |
+| `spec.workspace.publicationReadCredentialRef.name` | string | empty | Target-read Secret used only for publication preflight and independent verification. |
+| `spec.workspace.publicationCredentialRef.name` | string | empty | Target-write Secret used only for the exact branch compare-and-swap push. |
+| `spec.workspace.forgeCredentialRef.name` | string | empty | Forge API Secret used only for pull-request reconciliation; required when `createPR` is true. |
+| `spec.workspace.subPath` | string | empty | Repository subdirectory exposed as workspace root. |
+| `spec.workspace.pushBranch` | string | generated for write Tasks when omitted | Publication branch; Orka-generated names use full Task or Session identity entropy. |
+| `spec.workspace.prBaseBranch` | string | empty | Pull-request base branch. |
+| `spec.workspace.createPR` | boolean | `false` | Reconcile a pull request only after branch publication when true; requires `intent: write`. |
+| `spec.agentRuntime.maxTurns` | integer | Agent default | Per-Task prompt-loop limit. |
+| `spec.agentRuntime.allowedTools` / `disallowedTools` | list | Agent defaults | Per-Task tool policy override. |
+| `spec.agentRuntime.allowBash` | boolean | Agent default | Per-Task bash policy override. |
+
+Source read, target read, target write, and forge references are distinct
+credential roles. The selected Secret UID/resourceVersion is frozen for the
+attempt, and the credential broker releases a value only to the
+Workspace/Publisher for the exact active operation. Secret contents are never
+copied to Task status or delivered to the ACP process tree.
+
+The durable ACP attempt is exposed in `status.execution`. Workspace validation and publication use `status.delivery`, including publication ID, repository identities, branch, starting/remote/tree/commit SHAs, artifact digest, and optional PR receipt. A Task is not delivered merely because the model reports success; require a terminal verified delivery outcome.
+
+`Task.spec.execution.workspace` is not supported by the current ACP core runtime. Upstream agent-sandbox and Substrate integration is deferred behind the v2 RuntimeSession seam.
 
 ### Get Task Plan
 
@@ -136,6 +150,20 @@ Common list query parameters: `namespace`, `query`/`q`, `sessionName`, `agentNam
 
 Common list query parameters: `namespace`, `taskName`, `agentName`, `type`, `status`, `query`/`q`, and `limit`. Review and archive return `204 No Content`. Apply accepts optional `appliedBy` and returns the linked durable memory JSON; repeated apply requests return the same memory.
 
+## ACP runtime resources
+
+| Endpoint | Method | Description |
+| --- | --- | --- |
+| `/api/v1/runtime-pools` | GET | List controller-owned RuntimePools and lifecycle/admission/capacity status. |
+| `/api/v1/runtime-pools/:name` | GET | Get one RuntimePool. |
+| `/api/v1/agent-runtimes` | GET | List external `orka.harness.v2` registrations. |
+| `/api/v1/agent-runtimes` | POST | Create an external v2 registration. |
+| `/api/v1/agent-runtimes/:name` | GET | Get an external registration and observed capabilities. |
+| `/api/v1/agent-runtimes/:name` | PUT | Replace an external registration. |
+| `/api/v1/agent-runtimes/:name` | DELETE | Delete an external registration. |
+
+RuntimePools are controller-owned for built-in Codex, OpenCode, Claude, and Copilot Tasks; the public API is read-only. External registrations can be probed and conformance-tested, but `Agent.spec.runtime.runtimeRef` Task dispatch remains fail-closed until the external v2 dispatcher support boundary is enabled.
+
 ## Agents
 
 | Endpoint | Method | Description |
@@ -707,7 +735,7 @@ The following tools are **auto-injected** when coordination is enabled:
 | `auto_merge_pull_request` | Poll CI checks and merge a PR when all pass | `task_name`, `pr_number` (required); `merge_method`, `commit_title`, `commit_message`, `timeout` |
 | `review_pull_request` | Fetch PR diff for review | `pr_number` (required); `task_name`, `repo_url` |
 | `post_review_comment` | Post a review on a PR | `pr_number`, `body`, `event` (required); `task_name`, `repo_url`, `comments` |
-| `create_agent` | Create an Agent CRD at runtime | `name`, `provider`, `model` (required); `systemPrompt`, `tools`, `coordination` |
+| `create_agent` | Create an Agent CRD at runtime | `name`, `provider`, `model` (required); `systemPrompt` (required except OpenCode; omit for OpenCode), `tools`, `coordination` |
 | `delete_agent` | Delete an Agent CRD | `name` (required), `namespace` |
 | `update_plan` | Update the autonomous execution plan | `summary`, `plan_document` (required); `progress_pct`, `goal_complete` |
 
@@ -723,6 +751,6 @@ For GitHub tools that accept `repo_url`, explicit repository URLs are scope-chec
 
 `create_pr_monitor` is exposed through the chat/management tool set rather than auto-injected into every coordinator worker. Parameters are `name`, `repo_url`, `schedule`, and `agent_ref` (required), plus optional `namespace`, `provider_ref`, `gitSecretRef`, `per_page`, `review_event`, and `prompt`. `repo_url` must be a credential-free GitHub repository root URL such as `https://github.com/owner/repo`, `https://github.com/owner/repo.git`, or `git@github.com:owner/repo.git`; pull request, issue, branch/tree, blob/file, commit, query-string, fragment, non-GitHub, HTTP, and embedded-credential URLs are rejected.
 
-`create_pr_monitor` is the compatibility path for prompt-orchestrated scheduled PR monitors. It creates a scheduled `type: ai` Task, sets `spec.workspace.gitRepo` to `repo_url`, injects only the PR review loop tools, and instructs the task to pass the same `repo_url` to `list_pull_requests`, `check_pr_review_marker`, `check_pull_request_ci`, `review_pull_request`, and `post_review_comment`. The Agent referenced by `agent_ref` must be an AI Agent with coordination enabled and autonomous coordination disabled. The task needs a Git credential Secret through `gitSecretRef` or one of the supported default Secret names in the target namespace: `git-credentials`, `github-credentials`, `copilot-token`, `github-token`, or `git-token`. The selected Secret must contain a non-empty `token`, `password`, or `GITHUB_TOKEN` key.
+`create_pr_monitor` is the compatibility path for prompt-orchestrated scheduled PR monitors. It creates a scheduled `type: ai` Task, sets `spec.workspace.gitRepo` to `repo_url`, injects only the PR review loop tools, and instructs the task to pass the same `repo_url` to `list_pull_requests`, `check_pr_review_marker`, `check_pull_request_ci`, `review_pull_request`, and `post_review_comment`. The Agent referenced by `agent_ref` must be an AI Agent with coordination enabled and autonomous coordination disabled. The `create_pr_monitor` tool accepts its compatibility `gitSecretRef` parameter (or a supported default Secret name) and maps the selected Secret into the created Task's top-level `spec.workspace.readCredentialRef`. When the parameter is omitted, the supported default Secret names are `git-credentials`, `github-credentials`, `copilot-token`, `github-token`, and `git-token`. The selected Secret must contain a non-empty `token`, `password`, or `GITHUB_TOKEN` key.
 
 `check_pr_review_marker` returns a hidden marker that the monitor should include unchanged in the subsequent review body. The marker includes `repo`, `pr`, `head_sha`, and `sig` fields, and matching is scoped to that repository, pull request, and exact head. Marker signatures are stable across GitHub token rotation. Operators can set `ORKA_PR_REVIEW_MARKER_SECRET` in the worker Task environment for dedicated marker signing and `ORKA_PR_REVIEW_MARKER_PREVIOUS_SECRETS` for comma-separated previous keys during rotation. Legacy markers are accepted only from a trusted review author, configured with `ORKA_PR_REVIEW_MARKER_TRUSTED_AUTHOR` or resolved from the Task's authenticated GitHub user.
diff --git a/website/docs/reference/cli-commands.md b/website/docs/reference/cli-commands.md
index e04ac8ed5..67b29972b 100644
--- a/website/docs/reference/cli-commands.md
+++ b/website/docs/reference/cli-commands.md
@@ -21,28 +21,30 @@ Usage:
   orka [command]
 
 Available Commands:
-  agent       Manage agents
-  audit       Inspect audit and transaction traces
-  auth        Inspect authentication
-  completion  Generate the autocompletion script for the specified shell
-  config      Manage CLI configuration
-  gateway     Inspect generic gateway resources and durable event delivery
-  help        Help about any command
-  login       Authenticate with the Orka dashboard
-  memory      Manage durable memory
-  models      List compatible model IDs
-  monitor     Manage repository monitors
-  provider    Manage providers
-  run         Chat with the Orka AI assistant
-  secret      Inspect secret metadata
-  security    Manage repository security scans
-  session     Manage sessions
-  skill       Manage skills
-  status      Show system overview (health, tasks, agents)
-  substrate   Inspect and manage substrate resources
-  task        Manage tasks
-  tool        Manage tools
-  workspace   Inspect task workspace status
+  agent         Manage agents
+  agent-runtime Manage external orka.harness.v2 AgentRuntime registrations
+  audit         Inspect audit and transaction traces
+  auth          Inspect authentication
+  completion    Generate the autocompletion script for the specified shell
+  config        Manage CLI configuration
+  gateway       Inspect generic gateway resources and durable event delivery
+  help          Help about any command
+  login         Authenticate with the Orka dashboard
+  memory        Manage durable memory
+  models        List compatible model IDs
+  monitor       Manage repository monitors
+  provider      Manage providers
+  run           Chat with the Orka AI assistant
+  runtime-pool  Manage controller-owned ACP runtime pools
+  secret        Inspect secret metadata
+  security      Manage repository security scans
+  session       Manage sessions
+  skill         Manage skills
+  status        Show system overview (health, tasks, agents)
+  substrate     Inspect and manage substrate resources
+  task          Manage tasks
+  tool          Manage tools
+  workspace     Inspect task workspace status
 
 Flags:
   -h, --help                    help for orka
@@ -424,6 +426,7 @@ Available Commands:
   logs        Get task logs
   plan        Get task autonomous plan state
   result      Get task result
+  status      Show durable execution, delivery, and runtime-pool status
   trace       Show a task trace summary
   wait        Wait for a task to complete
 
@@ -450,22 +453,43 @@ Usage:
   orka task create <prompt> [flags]
 
 Flags:
-      --agent string          Agent reference name
-      --arg stringArray       Command argument (repeat for multiple arguments)
-      --command stringArray   Command entry to run (repeat for multiple entries)
-      --env stringArray       Environment variable KEY=VALUE (repeatable)
-  -f, --file string           Path to task YAML/JSON manifest
-  -h, --help                  help for create
-      --image string          Container image
-      --model string          Model name for AI tasks
-      --name string           Task name (default: generated)
-      --priority int32        Task priority (0-1000)
-      --provider string       Provider reference name (default "default")
-      --schedule string       Cron schedule for recurring tasks
-      --suspend               Suspend scheduled task runs
-      --timeout string        Task timeout (e.g., "5m", "1h")
-      --timezone string       IANA time zone for scheduled tasks
-      --type string           Task type: ai, container, agent (default "ai")
+      --agent string                             Agent reference name
+      --arg stringArray                          Command argument (repeat for multiple arguments)
+      --branch string                            Source branch
+      --command stringArray                      Command entry to run (repeat for multiple entries)
+      --create-pr                                Reconcile a pull request after verified publication
+      --env stringArray                          Environment variable KEY=VALUE (repeatable)
+  -f, --file string                              Path to task YAML/JSON manifest
+      --forge-credential string                  Secret name for forge API credentials used to reconcile pull requests
+      --forge-credential-key string              Secret key for forge API credentials (default: token)
+      --git-repo string                          Source repository URL (credentials must not be embedded)
+  -h, --help                                     help for create
+      --image string                             Container image
+      --model string                             Model name for AI tasks
+      --name string                              Task name (default: generated)
+      --pr-base-branch string                    Pull request base branch
+      --priority int32                           Task priority (0-1000)
+      --provider string                          Provider reference name (default "default")
+      --publication-credential string            Secret name for publication write credentials
+      --publication-credential-key string        Secret key for publication write credentials (default: token)
+      --publication-git-repo string              Publication repository URL
+      --publication-read-credential string       Secret name for publication preflight and verification credentials
+      --publication-read-credential-key string   Secret key for publication preflight and verification credentials (default: token)
+      --publication-repository-id string         Canonical publication repository ID
+      --publication-repository-provider string   Canonical publication repository provider
+      --push-branch string                       Publication branch (default: controller-derived full-entropy branch)
+      --read-credential string                   Secret name for source clone/read credentials
+      --read-credential-key string               Secret key for source clone/read credentials (default: token)
+      --ref string                               Source commit, tag, or ref
+      --schedule string                          Cron schedule for recurring tasks
+      --source-repository-id string              Canonical source repository ID
+      --source-repository-provider string        Canonical source repository provider
+      --sub-path string                          Subdirectory within the source repository
+      --suspend                                  Suspend scheduled task runs
+      --timeout string                           Task timeout (e.g., "5m", "1h")
+      --timezone string                          IANA time zone for scheduled tasks
+      --type string                              Task type: ai, container, agent (default "ai")
+      --workspace-intent string                  Agent workspace intent: read or write (default "read")
 
 Global Flags:
       --kubeconfig string       Path to kubeconfig file
diff --git a/website/docs/reference/cli.md b/website/docs/reference/cli.md
index 09d96dc52..646e7e387 100644
--- a/website/docs/reference/cli.md
+++ b/website/docs/reference/cli.md
@@ -82,6 +82,39 @@ orka task create \
   --arg 'echo hello from orka'
 ```
 
+Create an ACP agent task with explicit read-only workspace intent:
+
+```bash
+orka task create "Inspect the repository" \
+  --type agent \
+  --agent codex-reviewer \
+  --workspace-intent read \
+  --git-repo https://github.com/example/project \
+  --read-credential repository-read
+```
+
+Create a write-intent task with independently scoped publication credentials and pull-request reconciliation:
+
+```bash
+orka task create "Implement the requested change" \
+  --type agent \
+  --agent codex-builder \
+  --workspace-intent write \
+  --git-repo https://github.com/example/project \
+  --read-credential repository-read \
+  --publication-git-repo https://github.com/example/project \
+  --publication-read-credential repository-publication-read \
+  --publication-credential repository-publish \
+  --forge-credential repository-forge \
+  --pr-base-branch main \
+  --create-pr
+```
+
+The four roles are independent: source read for clone, target read for
+preflight/verification, target write for the exact branch update, and forge for
+PR reconciliation. Values are brokered only to the clean-room Publisher and
+are never delivered to the ACP process tree.
+
 Common task commands:
 
 | Command | Purpose |
@@ -89,7 +122,8 @@ Common task commands:
 | `orka task create -f FILE` | Create a Task from YAML/JSON. |
 | `orka task create --type container ...` | Create a Task directly from flags. |
 | `orka task list [--status PHASE] [--transaction ID]` | List tasks, optionally client-side filtered. |
-| `orka task get NAME [-o json|-o yaml]` | Read Task details. |
+| `orka task get NAME [-o json|-o yaml]` | Read complete Task details. |
+| `orka task status NAME [-o table|-o json|-o yaml]` | Show durable execution, delivery, and selected RuntimePool status. |
 | `orka task wait NAME --timeout DURATION` | Wait for completion; exits nonzero for failed/cancelled tasks. |
 | `orka task result NAME` | Print stored task result. |
 | `orka task logs NAME` | Print completed task logs/result-store output, or live pod logs when available. |
@@ -253,6 +287,23 @@ orka monitor items my-monitor -o json
 
 Use live-gated tests or manual verification for this path until stable GitHub/provider fixtures are available.
 
+## ACP runtime management
+
+Controller-owned pools and external v2 registrations use separate command groups:
+
+```bash
+orka runtime-pool list
+orka runtime-pool get codex-read -o yaml
+
+orka agent-runtime list
+orka agent-runtime get external-codex -o yaml
+orka agent-runtime create -f agent-runtime.yaml
+orka agent-runtime update external-codex -f agent-runtime.yaml
+orka agent-runtime delete external-codex
+```
+
+RuntimePool commands are read-only because pools are controller-owned. Table output reports lifecycle, admission, Pod count, resident-session capacity, prompt capacity, and queued demand. AgentRuntime table output reports only the `orka.harness.v2` identity/profile surface; legacy continuation and turn-capability fields are not rendered.
+
 ## Substrate actor pools
 
 Substrate actor pools are managed through the `substrate pool` command group:
@@ -311,8 +362,9 @@ Regenerate completions after upgrading `orka` if commands or flags change.
 | --- | --- |
 | `orka status` | Show health, readiness, task counts, and agent count. |
 | `orka models list --compat openai` / `anthropic` | List model IDs in provider-compatible formats. |
-| `orka workspace status TASK` | Inspect task workspace status. |
-| `orka audit trace TRANSACTION_ID` | Show tasks correlated by the transaction ID carried by the token. |
+| `orka workspace status TASK` | Inspect canonical workspace policy and delivery status without credential references. |
+| `orka task status TASK` | Inspect execution outcome, RuntimePool identity, and publication verification. |
+| `orka audit trace TRANSACTION_ID` | Show tasks correlated by Kontxt transaction ID. |
 
 ## Binary e2e coverage matrix
 
@@ -324,8 +376,10 @@ Normal binary e2e tests build and invoke `bin/orka` directly with isolated confi
 | `models` | Covered | OpenAI and Anthropic compatibility list output. |
 | `config` | Covered | Isolated `HOME`, `set-server`, fake `set-token`, masked `view`. |
 | `status` | Covered | Health/readiness/task/agent summary. |
-| `task` | Covered | Manifest create, flag create, list/filter, get, wait, result, logs, children, plan, artifacts, download, delete. |
-| `workspace` | Covered | `workspace status`. |
+| `task` | Covered | Manifest create, flag create (including read/write workspace policy), structured status, list/filter, get, wait, result, logs, children, plan, artifacts, download, delete. |
+| `workspace` | Covered | Canonical workspace intent, credential-role presence, and delivery status. |
+| `runtime-pool` | Focused unit coverage | CRUD routing plus lifecycle/admission/capacity table output. |
+| `agent-runtime` | Focused unit coverage | CRUD routing plus v2-only identity/profile table output. |
 | `provider` | Covered | CRUD and secret redaction expectations. |
 | `agent` | Covered | CRUD. |
 | `tool` | Covered | CRUD. |
diff --git a/website/sidebars.js b/website/sidebars.js
index a519f1cc7..a1028a661 100644
--- a/website/sidebars.js
+++ b/website/sidebars.js
@@ -30,7 +30,6 @@ const sidebars = {
         'guides/multi-agent-coordination',
         'guides/autonomous-tasks',
         'guides/transaction-token-migration',
-        'guides/cli-harness-wrapper',
         'guides/repository-security-scanning',
         'guides/repository-monitors',
         'guides/github-label-triggers',
@@ -44,6 +43,7 @@ const sidebars = {
       label: 'Operations',
       collapsed: false,
       items: [
+        'operations/harness-modes',
         'operations/agent-runtime-security',
         'operations/gateways',
       ],
diff --git a/website/src/components/QuickStartSection.js b/website/src/components/QuickStartSection.js
index c2383b354..b5dcbabd3 100644
--- a/website/src/components/QuickStartSection.js
+++ b/website/src/components/QuickStartSection.js
@@ -29,7 +29,7 @@ export default function QuickStartSection() {
           <CodeBlock language="bash">{`kubectl create secret generic anthropic-secret \\
   --from-literal=api-key=your-api-key
 
-kubectl port-forward -n orka-system svc/orka-api 8080:8080
+kubectl port-forward -n orka-system svc/orka 8080:8080
 # open http://localhost:8080`}</CodeBlock>
         </div>
       </div>
diff --git a/website/src/data/landingPageData.js b/website/src/data/landingPageData.js
index 70a905372..32b44faa6 100644
--- a/website/src/data/landingPageData.js
+++ b/website/src/data/landingPageData.js
@@ -59,10 +59,10 @@ export const providers = [
     description: 'Enterprise OpenAI deployments running on Azure.',
   },
   {
-    name: 'Agent Runtimes',
+    name: 'ACP RuntimePools',
     href: '/docs/agent-runtimes',
     description:
-      'Delegate to Codex CLI, Claude Code CLI, or GitHub Copilot CLI for autonomous coding.',
+      'Run Codex, OpenCode, Claude, and Copilot in digest-pinned, scale-to-zero RuntimePools with brokered tools and clean-room delivery.',
   },
 ];
 
diff --git a/workers/acp/images/README.md b/workers/acp/images/README.md
new file mode 100644
index 000000000..db54c8e9f
--- /dev/null
+++ b/workers/acp/images/README.md
@@ -0,0 +1,212 @@
+# Immutable ACP runtime images
+
+These definitions build separate Codex, Claude, GitHub Copilot, and OpenCode
+ACP runtime images. The build context must be the repository root so each image can
+compile
+`cmd/orka-acp-runtime` and verify its duplicated supply-chain values against
+`internal/acp/pins.go`.
+
+The final images intentionally:
+
+- run the Orka supervisor as root so it can create private session trees and
+  launch each ACP child under a unique, non-reused UID/GID;
+- contain no provider, controller, SCM, Git, or MCP credential;
+- remove npm, npx, Corepack, and Yarn from the runtime image;
+- contain no `git`, `ssh`, `curl`, or `wget` client;
+- use `/sessions` as the writable session root and otherwise support a
+  read-only root filesystem;
+- rely on the supervisor's empty child-environment allowlist and provider
+  update-disable controls;
+- support only `linux/amd64` and `linux/arm64`.
+
+Runtime credentials must be mounted as files and referenced through the
+`ORKA_ACP_*_TOKEN_FILE` settings. Do not pass secrets as Docker build arguments,
+labels, or environment defaults.
+
+## Frozen inputs
+
+Base images are immutable multi-platform manifest-list references:
+
+| Input | Immutable reference |
+| --- | --- |
+| Dockerfile frontend | `docker/dockerfile:1.7.1@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e` |
+| Go builder | `golang:1.26.2-bookworm@sha256:47ce5636e9936b2c5cbf708925578ef386b4f8872aec74a67bd13a627d242b19` |
+| Node builder/runtime | `node:22.22.0-bookworm-slim@sha256:dd9d21971ec4395903fa6143c2b9267d048ae01ca6d3ea96f16cb30df6187d94` |
+| Debian OpenCode runtime | `debian:trixie-slim@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd` |
+
+Codex inputs:
+
+| Input | Pin |
+| --- | --- |
+| Codex ACP source | commit `307d81018f7cc0c3141ddf71c7532d38310e2cfb`; codeload archive SHA-256 `4d3cc46a901bdd4abf112e703e734078e09a172ecd535aa3e556318a051a7c39` |
+| Codex ACP release | `1.1.7`; npm tar SHA-256 `642920240baa0b6b1951fb2c56b9ff11689648019499615f941000d95d127301` |
+| Orka Codex ACP external-sandbox patch | `workers/acp/images/codex/patch-agent-mode.mjs`; SHA-256 `4b1fc39dc7ac0d6aa404030a3433f46c8b9c67e8e8223efca490a6ab8bf4287a` |
+| Patched Codex ACP `dist/index.js` | SHA-256 `bcfb6a2772a7de2d027e977d9bc9db5fa210a462de1af7ab061361be4410cc75` |
+| Codex CLI | `0.145.0`; source commit `25af12f7e61572b0bc18ddb1008be543b91519b0` |
+| Codex CLI `linux/amd64` | npm tar SHA-256 `11239480f8e3efd1430f23bbe91c1a397856b8bbe6185ccbaee2382d25e03df2` |
+| Codex CLI `linux/arm64` | npm tar SHA-256 `b78c57e172b2f18e5969ae26183253cd3cdd9abb3b424a8f7334f4b5530c2b27` |
+
+Claude inputs:
+
+| Input | Pin |
+| --- | --- |
+| Claude Agent ACP source | commit `c19bddcf7914259d6c15103a2d1580c7371e1d16`; codeload archive SHA-256 `e927898fd1b9d32a9a070c4217a89ba793c2baa1b03a4ffb509b13236333cf36` |
+| Claude Agent ACP release | `0.61.0`; npm tar SHA-256 `bb410d53e2d13591da5ebcaf09ae055d166ffefb27b7172988650cd62ef4ebd3` |
+| Claude Agent SDK | `0.3.217`; npm tar SHA-256 `20363761b29724950b749ecbc5186c46e29f2a0330554ca309a9e7ff8d6e5799` |
+| Claude Code | `2.1.217`, carried by the SDK native package |
+| Claude native `linux/amd64` | npm tar SHA-256 `8d2ccffbdf63aef1436a30b0fd32ef0eac663c3465318b181138471a68f02b92` |
+| Claude native `linux/arm64` | npm tar SHA-256 `51080502df2942d2092c4a5b7122eda518041fbe954027a1e128ede3cb337563` |
+
+GitHub Copilot inputs:
+
+| Input | Pin |
+| --- | --- |
+| Copilot CLI | `1.0.77`; source commit `aee1edd29ef0f2058425bf399bcc9e5002a2b8f2` |
+| Copilot CLI `linux/amd64` | official `copilot-linux-x64.tar.gz`; SHA-256 `c6414f99c5b29b049a3b0929ba824f0ff0ae88b85eb52559be45631b96b00f4c` |
+| Copilot CLI `linux/arm64` | official `copilot-linux-arm64.tar.gz`; SHA-256 `5bcf01b30bd74ce415cc93acb404885e0bc396cde037ca68efe2b8ec84f91e5a` |
+| Copilot CLI license | `LICENSE.md` at the pinned source commit; SHA-256 `1fbd0dcc55c66738b1b591632132c927de20c8443dff1d55b4851e378883e402` |
+
+Copilot CLI `1.0.77` is newer than the `1.0.76-0` boundary that fixed
+credentialless custom-provider session creation in ACP mode. Orka therefore
+keeps the real upstream credential behind its provider proxy and starts
+Copilot ACP sessions without GitHub login or an ACP authentication exchange.
+
+OpenCode inputs:
+
+| Input | Pin |
+| --- | --- |
+| OpenCode release | `1.18.9` |
+| OpenCode source | tag commit `4da7bb44c84e013fa53e9c5d02ac753d1435c81a`; codeload archive SHA-256 `bbc3363c6886c63865a60b75d456fff3fbe6b87d8a86f44b2439900695b35de3` |
+| OpenCode `linux/amd64` | baseline `opencode-linux-x64-baseline-1.18.9.tgz` (no AVX2 scheduling assumption); npm tar SHA-256 `59bf22db1f20c6c9836c926800a8e6416228330c2b518ade3d431d315cd76366`; extracted binary SHA-256 `7c4d91c84d2bfdeabb59257e3490c5e5acb08f2aacb3e42f3ddc296a1c3f1aca` |
+| OpenCode `linux/arm64` | `opencode-linux-arm64-1.18.9.tgz`; npm tar SHA-256 `4846a7e470797950f209126442a291cc06574fd44ddbb96c89d730017f60aae7`; extracted binary SHA-256 `ae8a9b7c591d3c763463f16bfb5f45230c4c741f039e8967218662836449ecdf` |
+| ripgrep `linux/amd64` | Debian `15.2.0-1` glibc package from immutable snapshot file `096560a159a8be70155f16209d91777019011677` with a versioned Debian-pool fallback; package SHA-256 `d9d86586969e925b8627936ec4387d10cc65baf7d42195258743a49e711b6157`; extracted `rg` SHA-256 `af751db9b06d308fd5078aa973880cc8c75678289386bf1a6ee5faa614aa6f2d` |
+| ripgrep `linux/arm64` | Debian `15.2.0-1` glibc package from immutable snapshot file `482bbe93dc82997d7d84c901990e8d9f4327457c` with a versioned Debian-pool fallback; package SHA-256 `8f18379cd499dd890d27190a359fe194d0bce92d7efad8e47b0f636e64bf4b46`; extracted `rg` SHA-256 `d3febe5d02e2a15da0909200caeb5af0be65e58736331c2ab88b7086d62e942b` |
+| Orka root instruction | `workers/acp/images/opencode/AGENTS.md`; SHA-256 `b8e691e210a9502c9689ba20705806dfb1b5b10b5ca1062f73f9a85b1043a812` |
+| Image third-party notice | `workers/acp/images/opencode/NOTICE.md` (mirrors root `NOTICE.md`); SHA-256 `93167c1d7505d3e38efce8bf019c2af4e10ef56529465b87c34e4b3401508a98` |
+
+Codex and Claude adapters are compiled from exact GitHub source archives after
+frozen `package-lock.json` installs with `npm ci --ignore-scripts`. Their
+unmodified adapter outputs must first byte-match separately checksum-verified
+published npm releases. The Codex build then applies the checksum-pinned Orka
+mode patch, rebuilds, and verifies the exact patched bundle digest. That mode
+selects Codex's `externalSandbox` policy with restricted network so the
+RuntimeSession and Pod security boundary is authoritative without nested
+namespaces.
+
+The Copilot image instead installs the unmodified official per-architecture
+release executable. Its tar asset is checksum-verified, must contain exactly one
+`copilot` entry, and is never downloaded at runtime. All final images perform no
+package installation or network download.
+
+OpenCode is not wrapped by an adapter: the supervisor launches the
+checksum-verified native binary as `opencode --pure acp`. Its per-session config
+permits only the explicit Orka OpenAI-compatible proxy and disables project
+config, model fetching, external skills/plugins, LSP downloads, formatters,
+sharing, snapshots, and auto-update. It explicitly loads the immutable
+`/opt/opencode/AGENTS.md` guardrail followed by the session workspace root
+`AGENTS.md`, while ambient project discovery remains disabled. Native tool
+permissions are deterministic `allow`/`deny` rules derived from the session's
+Orka tool policy; read-intent sessions additionally force shell, mutation,
+and Grep tools off. Grep cannot carry the path-specific secret-file exclusions
+applied to Read, and the current dispatcher does not admit interactive ACP
+permission prompts. The image vendors the checksum-pinned Debian glibc ripgrep 15.2.0 binary at
+`/usr/local/bin/rg`, avoiding the x86_64 musl allocator failure mode while
+preventing OpenCode's Glob/Grep tools from
+attempting a runtime GitHub download. The private config directory is seeded
+only with empty `node_modules` plus root package/lock dependency metadata for
+`@opencode-ai/plugin` 1.18.9 so OpenCode's shallow dependency check does not
+launch a background network install; no plugin implementation is vendored. As
+with the other built-in runtime images, Git is intentionally absent: the ACP
+child sees a materialized workspace tree without repository credentials, and
+Orka's clean-room Publisher owns Git staging and publication after delta
+validation.
+
+## Build with the remote builder
+
+Use the repository root as the final argument:
+
+```bash
+docker buildx build \
+  --builder remote-vm \
+  --platform linux/amd64,linux/arm64 \
+  --file workers/acp/images/codex/Dockerfile \
+  --tag docker.io/sozercan/orka-acp-codex:1.1.7-codex-0.145.0 \
+  --provenance=mode=max \
+  --sbom=true \
+  --push \
+  .
+```
+
+```bash
+docker buildx build \
+  --builder remote-vm \
+  --platform linux/amd64,linux/arm64 \
+  --file workers/acp/images/claude/Dockerfile \
+  --tag docker.io/sozercan/orka-acp-claude:0.61.0-sdk-0.3.217 \
+  --provenance=mode=max \
+  --sbom=true \
+  --push \
+  .
+```
+
+```bash
+docker buildx build \
+  --builder remote-vm \
+  --platform linux/amd64,linux/arm64 \
+  --file workers/acp/images/copilot/Dockerfile \
+  --tag docker.io/sozercan/orka-acp-copilot:1.0.77 \
+  --provenance=mode=max \
+  --sbom=true \
+  --push \
+  .
+```
+
+```bash
+docker buildx build \
+  --builder remote-vm \
+  --platform linux/amd64,linux/arm64 \
+  --file workers/acp/images/opencode/Dockerfile \
+  --tag docker.io/sozercan/orka-acp-opencode:1.18.9-rg-15.2.0 \
+  --provenance=mode=max \
+  --sbom=true \
+  --push \
+  .
+```
+
+For a non-publishing verification build, replace `--push` and `--tag` with:
+
+```bash
+--output=type=cacheonly
+```
+
+After publishing, record the returned multi-platform image digest and sign that
+immutable digest rather than a mutable tag.
+
+## Runtime contract
+
+Each image defaults only `ORKA_ACP_PROVIDER`. Deployment configuration must
+supply the model, runtime-pool and controller fence, profile digests, workspace
+intent, credential role/scope, and absolute Secret-mounted token-file paths.
+Mount a writable volume at `/sessions`; do not rely on the image layer for
+session durability. Kubernetes packaging must also enforce the read-only root
+filesystem, no service-account token, default-deny egress, and only the
+explicit supervisor capabilities needed for UID/GID and process management.
+
+The images omit an SCM client on purpose. Clone and publication belong to the
+separate clean-room Workspace/Publisher identity, not the ACP runtime process
+tree.
+
+## Licensing caveat
+
+Orka's license and notice, adapter licenses, and provider license/notice files
+are retained under `/usr/share/licenses` in the final images.
+
+Codex ACP and the pinned Codex source are Apache-2.0. OpenCode is MIT, and
+ripgrep is dual-licensed under MIT or the Unlicense. Claude Agent ACP is
+Apache-2.0, but the Claude Agent SDK and bundled native Claude Code executable
+are proprietary Anthropic artifacts whose package license says use is subject
+to Anthropic's legal agreements. GitHub Copilot CLI is distributed unmodified
+under the GitHub Copilot CLI License included in the image and in the repository
+`NOTICE.md`. Building these Dockerfiles does not independently grant service or
+provider access. Obtain legal approval for the intended distribution and
+service model before pushing or sharing the Claude or Copilot images.
diff --git a/workers/acp/images/artifact-tool.go b/workers/acp/images/artifact-tool.go
new file mode 100644
index 000000000..9e6a596d1
--- /dev/null
+++ b/workers/acp/images/artifact-tool.go
@@ -0,0 +1,302 @@
+// Command artifact-tool performs the two deterministic supply-chain checks used
+// by the ACP image definitions. It intentionally depends only on the Go
+// standard library so it can run in pinned build stages without installing
+// another package manager.
+package main
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"net/http"
+	"net/url"
+	"os"
+	"path"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+)
+
+var allowedDownloadHosts = map[string]struct{}{
+	"codeload.github.com":                  {},
+	"deb.debian.org":                       {},
+	"github.com":                           {},
+	"raw.githubusercontent.com":            {},
+	"registry.npmjs.org":                   {},
+	"release-assets.githubusercontent.com": {},
+	"snapshot.debian.org":                  {},
+}
+
+var allowedDownloadQueryHosts = map[string]struct{}{
+	"release-assets.githubusercontent.com": {},
+}
+
+func main() {
+	if err := run(os.Args[1:]); err != nil {
+		fmt.Fprintln(os.Stderr, "artifact-tool:", err)
+		os.Exit(1)
+	}
+}
+
+func run(args []string) error {
+	if len(args) == 0 {
+		return errors.New("usage: artifact-tool <command> [arguments]")
+	}
+	switch args[0] {
+	case "download":
+		if len(args) != 5 {
+			return errors.New("usage: artifact-tool download <https-url> <sha256> <output> <max-bytes>")
+		}
+		maxBytes, err := strconv.ParseInt(args[4], 10, 64)
+		if err != nil || maxBytes <= 0 {
+			return errors.New("max-bytes must be a positive integer")
+		}
+		return download(args[1], args[2], args[3], maxBytes)
+	case "compare":
+		if len(args) != 3 {
+			return errors.New("usage: artifact-tool compare <left-directory> <right-directory>")
+		}
+		return compareTrees(args[1], args[2])
+	default:
+		return fmt.Errorf("unknown command %q", args[0])
+	}
+}
+
+func download(rawURL, expectedHex, output string, maxBytes int64) error {
+	expectedHex = strings.ToLower(strings.TrimSpace(expectedHex))
+	expected, err := hex.DecodeString(expectedHex)
+	if err != nil || len(expected) != sha256.Size || hex.EncodeToString(expected) != expectedHex {
+		return errors.New("expected digest must be a lowercase SHA-256 hex string")
+	}
+
+	parsed, err := validatedURL(rawURL)
+	if err != nil {
+		return err
+	}
+	client := &http.Client{
+		Timeout: 15 * time.Minute,
+		CheckRedirect: func(request *http.Request, _ []*http.Request) error {
+			_, err := validatedURL(request.URL.String())
+			return err
+		},
+	}
+	response, err := client.Get(parsed.String())
+	if err != nil {
+		return fmt.Errorf("download %s%s: %w", parsed.Hostname(), parsed.EscapedPath(), redactDownloadError(err))
+	}
+	defer func() { _ = response.Body.Close() }()
+	if response.StatusCode != http.StatusOK {
+		return fmt.Errorf("download %s%s: HTTP %d", parsed.Hostname(), parsed.EscapedPath(), response.StatusCode)
+	}
+	if response.ContentLength > maxBytes {
+		return fmt.Errorf("download content length %d exceeds %d bytes", response.ContentLength, maxBytes)
+	}
+
+	if err := os.MkdirAll(filepath.Dir(output), 0o755); err != nil {
+		return fmt.Errorf("create output directory: %w", err)
+	}
+	temporary, err := os.CreateTemp(filepath.Dir(output), ".artifact-partial-*")
+	if err != nil {
+		return fmt.Errorf("create temporary artifact: %w", err)
+	}
+	temporaryPath := temporary.Name()
+	keep := false
+	defer func() {
+		_ = temporary.Close()
+		if !keep {
+			_ = os.Remove(temporaryPath)
+		}
+	}()
+	if err := temporary.Chmod(0o600); err != nil {
+		return fmt.Errorf("secure temporary artifact: %w", err)
+	}
+
+	hash := sha256.New()
+	written, err := io.Copy(io.MultiWriter(temporary, hash), io.LimitReader(response.Body, maxBytes+1))
+	if err != nil {
+		return fmt.Errorf("write artifact: %w", err)
+	}
+	if written > maxBytes {
+		return fmt.Errorf("download exceeded %d bytes", maxBytes)
+	}
+	if err := temporary.Sync(); err != nil {
+		return fmt.Errorf("sync artifact: %w", err)
+	}
+	if err := temporary.Close(); err != nil {
+		return fmt.Errorf("close artifact: %w", err)
+	}
+	actual := hash.Sum(nil)
+	if !equalBytes(actual, expected) {
+		return fmt.Errorf("SHA-256 mismatch: expected %s, got %s", expectedHex, hex.EncodeToString(actual))
+	}
+	if err := os.Rename(temporaryPath, output); err != nil {
+		return fmt.Errorf("publish artifact: %w", err)
+	}
+	keep = true
+	fmt.Printf("verified %s%s: sha256:%s (%d bytes)\n", parsed.Hostname(), parsed.EscapedPath(), expectedHex, written)
+	return nil
+}
+
+func redactDownloadError(err error) error {
+	var requestErr *url.Error
+	if !errors.As(err, &requestErr) {
+		return err
+	}
+	redacted := *requestErr
+	redacted.Err = errors.New("request failed")
+	parsed, parseErr := url.Parse(redacted.URL)
+	if parseErr != nil {
+		redacted.URL = ""
+	} else {
+		parsed.RawQuery = ""
+		parsed.ForceQuery = false
+		parsed.Fragment = ""
+		redacted.URL = parsed.String()
+	}
+	return &redacted
+}
+
+func validatedURL(rawURL string) (*url.URL, error) {
+	parsed, err := url.Parse(rawURL)
+	if err != nil {
+		return nil, fmt.Errorf("parse download URL: %w", err)
+	}
+	if parsed.Scheme != "https" || parsed.User != nil || parsed.Fragment != "" {
+		return nil, errors.New("download URL must be credential-free HTTPS without a fragment")
+	}
+	host := parsed.Hostname()
+	if _, ok := allowedDownloadHosts[host]; !ok {
+		return nil, fmt.Errorf("download host is not allowlisted: %s", host)
+	}
+	if parsed.RawQuery != "" {
+		if _, ok := allowedDownloadQueryHosts[host]; !ok {
+			return nil, errors.New("download URL query is not allowed for this host")
+		}
+	}
+	if parsed.RawPath != "" || path.Clean(parsed.Path) != parsed.Path || strings.Contains(parsed.Path, `\`) {
+		return nil, errors.New("download URL path must be unescaped and canonical")
+	}
+	switch host {
+	case "github.com":
+		if !strings.HasPrefix(parsed.EscapedPath(), "/github/copilot-cli/releases/download/") {
+			return nil, errors.New("GitHub download path is not allowlisted")
+		}
+	case "release-assets.githubusercontent.com":
+		if !strings.HasPrefix(parsed.EscapedPath(), "/github-production-release-asset/") {
+			return nil, errors.New("GitHub release asset path is not allowlisted")
+		}
+	case "deb.debian.org":
+		if !strings.HasPrefix(parsed.EscapedPath(), "/debian/pool/main/r/rust-ripgrep/ripgrep_") ||
+			!strings.HasSuffix(parsed.EscapedPath(), ".deb") {
+			return nil, errors.New("debian ripgrep package path is not allowlisted")
+		}
+	case "snapshot.debian.org":
+		fileID := strings.TrimPrefix(parsed.EscapedPath(), "/file/")
+		decoded, decodeErr := hex.DecodeString(fileID)
+		if decodeErr != nil || len(decoded) != 20 || parsed.EscapedPath() != "/file/"+fileID {
+			return nil, errors.New("debian snapshot file path is not allowlisted")
+		}
+	}
+	return parsed, nil
+}
+
+func compareTrees(leftRoot, rightRoot string) error {
+	left, err := treeDigests(leftRoot)
+	if err != nil {
+		return fmt.Errorf("left tree: %w", err)
+	}
+	right, err := treeDigests(rightRoot)
+	if err != nil {
+		return fmt.Errorf("right tree: %w", err)
+	}
+	leftNames := sortedKeys(left)
+	rightNames := sortedKeys(right)
+	if strings.Join(leftNames, "\x00") != strings.Join(rightNames, "\x00") {
+		return fmt.Errorf("tree file lists differ: left=%q right=%q", leftNames, rightNames)
+	}
+	for _, name := range leftNames {
+		if left[name] != right[name] {
+			return fmt.Errorf("file differs from published artifact: %s", name)
+		}
+	}
+	fmt.Printf("matched %d files in %s and %s\n", len(leftNames), leftRoot, rightRoot)
+	return nil
+}
+
+func treeDigests(root string) (map[string]string, error) {
+	root = filepath.Clean(root)
+	info, err := os.Lstat(root)
+	if err != nil {
+		return nil, err
+	}
+	if !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
+		return nil, errors.New("comparison root must be a real directory")
+	}
+	result := map[string]string{}
+	err = filepath.WalkDir(root, func(path string, entry fs.DirEntry, walkErr error) error {
+		if walkErr != nil {
+			return walkErr
+		}
+		if path == root {
+			return nil
+		}
+		if entry.Type()&os.ModeSymlink != 0 {
+			return fmt.Errorf("refusing symbolic link: %s", path)
+		}
+		if entry.IsDir() {
+			return nil
+		}
+		info, err := entry.Info()
+		if err != nil {
+			return err
+		}
+		if !info.Mode().IsRegular() {
+			return fmt.Errorf("refusing non-regular file: %s", path)
+		}
+		file, err := os.Open(path)
+		if err != nil {
+			return err
+		}
+		hash := sha256.New()
+		_, copyErr := io.Copy(hash, file)
+		closeErr := file.Close()
+		if copyErr != nil {
+			return copyErr
+		}
+		if closeErr != nil {
+			return closeErr
+		}
+		relative, err := filepath.Rel(root, path)
+		if err != nil {
+			return err
+		}
+		result[filepath.ToSlash(relative)] = hex.EncodeToString(hash.Sum(nil))
+		return nil
+	})
+	return result, err
+}
+
+func sortedKeys(values map[string]string) []string {
+	keys := make([]string, 0, len(values))
+	for key := range values {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	return keys
+}
+
+func equalBytes(left, right []byte) bool {
+	if len(left) != len(right) {
+		return false
+	}
+	var difference byte
+	for index := range left {
+		difference |= left[index] ^ right[index]
+	}
+	return difference == 0
+}
diff --git a/workers/acp/images/artifact-tool_test.go b/workers/acp/images/artifact-tool_test.go
new file mode 100644
index 000000000..2a1b9daf8
--- /dev/null
+++ b/workers/acp/images/artifact-tool_test.go
@@ -0,0 +1,70 @@
+package main
+
+import (
+	"errors"
+	"net/url"
+	"strings"
+	"testing"
+)
+
+func TestValidatedURLAllowsPinnedGitHubReleaseRedirects(t *testing.T) {
+	t.Parallel()
+	accepted := []string{
+		"https://github.com/github/copilot-cli/releases/download/v1.0.74/copilot-linux-x64.tar.gz",
+		"https://release-assets.githubusercontent.com/github-production-release-asset/object?sig=ephemeral",
+		"https://raw.githubusercontent.com/github/copilot-cli/commit/LICENSE.md",
+		"https://snapshot.debian.org/file/096560a159a8be70155f16209d91777019011677",
+		"https://deb.debian.org/debian/pool/main/r/rust-ripgrep/ripgrep_15.2.0-1_amd64.deb",
+	}
+	for _, rawURL := range accepted {
+		if _, err := validatedURL(rawURL); err != nil {
+			t.Errorf("validatedURL(%q) error = %v", rawURL, err)
+		}
+	}
+
+	rejected := []string{
+		"http://github.com/github/copilot-cli/releases/download/v1.0.74/copilot-linux-x64.tar.gz",
+		"https://github.com/github/copilot-cli/releases/download/v1.0.74/copilot-linux-x64.tar.gz?cache=bypass",
+		"https://example.com/copilot.tar.gz",
+		"https://github.com/other/project/releases/download/v1/artifact.tar.gz",
+		"https://release-assets.githubusercontent.com/other/path?sig=ephemeral",
+		"https://github.com/github/copilot-cli/releases/download/../../../../other/project/releases/download/v1/a",
+		"https://github.com/github/copilot-cli/releases/download/%2e%2e/%2e%2e/a",
+		"https://github.com/github/copilot-cli/releases/download/a%2Fb",
+		"https://user@github.com/github/copilot-cli/releases/download/v1/copilot.tar.gz",
+		"https://snapshot.debian.org/file/not-a-digest",
+		"https://snapshot.debian.org/file/096560a159a8be70155f16209d91777019011677/extra",
+		"https://snapshot.debian.org/file/096560a159a8be70155f16209d91777019011677?download=1",
+		"https://deb.debian.org/debian/pool/main/r/other/package.deb",
+		"https://deb.debian.org/debian/pool/main/r/rust-ripgrep/not-ripgrep.txt",
+	}
+	for _, rawURL := range rejected {
+		if _, err := validatedURL(rawURL); err == nil {
+			t.Errorf("validatedURL(%q) unexpectedly succeeded", rawURL)
+		}
+	}
+}
+
+func TestRedactDownloadErrorRemovesSignedQuery(t *testing.T) {
+	t.Parallel()
+	original := &url.Error{
+		Op: "Get",
+		URL: "https://release-assets.githubusercontent.com/github-production-release-asset/object" +
+			"?alpha=opaque-marker&beta=opaque-marker",
+		Err: errors.New(`failed to parse Location header "https://release-assets.githubusercontent.com/object` +
+			`?alpha=opaque-marker"`),
+	}
+	redacted := redactDownloadError(original)
+	message := redacted.Error()
+	if strings.Contains(message, "alpha=") || strings.Contains(message, "beta=") ||
+		strings.Contains(message, "opaque-marker") {
+		t.Fatalf("redacted error exposed signed query: %q", message)
+	}
+	if !strings.Contains(message, "release-assets.githubusercontent.com/github-production-release-asset/object") ||
+		!strings.Contains(message, "request failed") {
+		t.Fatalf("redacted error lost safe diagnostics: %q", message)
+	}
+	if !strings.Contains(original.URL, "alpha=opaque-marker") {
+		t.Fatal("redaction mutated the original url.Error")
+	}
+}
diff --git a/workers/acp/images/claude/Dockerfile b/workers/acp/images/claude/Dockerfile
new file mode 100644
index 000000000..abcb57d91
--- /dev/null
+++ b/workers/acp/images/claude/Dockerfile
@@ -0,0 +1,152 @@
+# syntax=docker/dockerfile:1.7.1@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
+
+# The tag documents the human-readable version; the manifest-list digest makes
+# every supported platform immutable.
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26.2-bookworm@sha256:47ce5636e9936b2c5cbf708925578ef386b4f8872aec74a67bd13a627d242b19 AS upstream-artifacts
+ARG TARGETARCH
+COPY workers/acp/images/artifact-tool.go /tmp/artifact-tool.go
+RUN go build -buildvcs=false -trimpath -ldflags='-s -w' -o /usr/local/bin/artifact-tool /tmp/artifact-tool.go
+RUN set -eu; \
+    mkdir -p /artifacts; \
+    artifact-tool download \
+      "https://codeload.github.com/agentclientprotocol/claude-agent-acp/tar.gz/c19bddcf7914259d6c15103a2d1580c7371e1d16" \
+      "e927898fd1b9d32a9a070c4217a89ba793c2baa1b03a4ffb509b13236333cf36" \
+      /artifacts/claude-agent-acp-source.tgz 16777216; \
+    artifact-tool download \
+      "https://registry.npmjs.org/@agentclientprotocol/claude-agent-acp/-/claude-agent-acp-0.61.0.tgz" \
+      "bb410d53e2d13591da5ebcaf09ae055d166ffefb27b7172988650cd62ef4ebd3" \
+      /artifacts/claude-agent-acp-release.tgz 16777216; \
+    artifact-tool download \
+      "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk/-/claude-agent-sdk-0.3.217.tgz" \
+      "20363761b29724950b749ecbc5186c46e29f2a0330554ca309a9e7ff8d6e5799" \
+      /artifacts/claude-agent-sdk.tgz 16777216; \
+    case "$TARGETARCH" in \
+      amd64) \
+        native_url="https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-linux-x64/-/claude-agent-sdk-linux-x64-0.3.217.tgz"; \
+        native_sha="8d2ccffbdf63aef1436a30b0fd32ef0eac663c3465318b181138471a68f02b92" ;; \
+      arm64) \
+        native_url="https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-linux-arm64/-/claude-agent-sdk-linux-arm64-0.3.217.tgz"; \
+        native_sha="51080502df2942d2092c4a5b7122eda518041fbe954027a1e128ede3cb337563" ;; \
+      *) echo "unsupported TARGETARCH: $TARGETARCH" >&2; exit 1 ;; \
+    esac; \
+    artifact-tool download \
+      "$native_url" "$native_sha" /artifacts/claude-native.tgz 125829120; \
+    artifact-tool download \
+      "https://raw.githubusercontent.com/orka-agents/orka/d03acb995b6014a6e855181c50b922b65ea8e7ff/LICENSE" \
+      "7df20dcdf9197e9945c14858d41c60f11b52b93e5b69e2b63416b874d598d322" \
+      /artifacts/orka-LICENSE 65536; \
+    artifact-tool download \
+      "https://raw.githubusercontent.com/orka-agents/orka/d03acb995b6014a6e855181c50b922b65ea8e7ff/NOTICE.md" \
+      "f0e9fca2012cfb65dd9532e0fe693c405de5006d23e54b99b78154060f7dbf75" \
+      /artifacts/orka-NOTICE.md 65536
+
+FROM --platform=$BUILDPLATFORM docker.io/library/node:22.22.0-bookworm-slim@sha256:dd9d21971ec4395903fa6143c2b9267d048ae01ca6d3ea96f16cb30df6187d94 AS adapter-builder
+ENV NPM_CONFIG_AUDIT=false \
+    NPM_CONFIG_FUND=false \
+    NPM_CONFIG_UPDATE_NOTIFIER=false
+COPY --from=upstream-artifacts /usr/local/bin/artifact-tool /usr/local/bin/artifact-tool
+COPY --from=upstream-artifacts /artifacts/claude-agent-acp-source.tgz /tmp/source.tgz
+COPY --from=upstream-artifacts /artifacts/claude-agent-acp-release.tgz /tmp/release.tgz
+RUN set -eu; \
+    mkdir -p /src /published; \
+    tar -xzf /tmp/source.tgz -C /src --strip-components=1; \
+    tar -xzf /tmp/release.tgz -C /published
+WORKDIR /src
+RUN npm ci --ignore-scripts --no-audit --no-fund --registry=https://registry.npmjs.org/
+RUN npm run build && rm -rf /src/dist/tests
+RUN artifact-tool compare /src/dist /published/package/dist
+
+FROM --platform=$TARGETPLATFORM docker.io/library/node:22.22.0-bookworm-slim@sha256:dd9d21971ec4395903fa6143c2b9267d048ae01ca6d3ea96f16cb30df6187d94 AS claude-layout
+ARG TARGETARCH
+ENV NPM_CONFIG_AUDIT=false \
+    NPM_CONFIG_FUND=false \
+    NPM_CONFIG_UPDATE_NOTIFIER=false
+WORKDIR /opt/claude-agent-acp
+COPY --from=adapter-builder /src/package.json /src/package-lock.json ./
+RUN npm ci --omit=dev --ignore-scripts --no-audit --no-fund --registry=https://registry.npmjs.org/
+COPY --from=adapter-builder /src/dist ./dist
+COPY --from=adapter-builder /src/README.md /src/LICENSE ./
+COPY --from=upstream-artifacts /artifacts/claude-agent-sdk.tgz /tmp/claude-agent-sdk.tgz
+COPY --from=upstream-artifacts /artifacts/claude-native.tgz /tmp/claude-native.tgz
+RUN set -eu; \
+    case "$TARGETARCH" in \
+      amd64) native_package=claude-agent-sdk-linux-x64 ;; \
+      arm64) native_package=claude-agent-sdk-linux-arm64 ;; \
+      *) echo "unsupported TARGETARCH: $TARGETARCH" >&2; exit 1 ;; \
+    esac; \
+    rm -rf node_modules/@anthropic-ai/claude-agent-sdk; \
+    mkdir -p node_modules/@anthropic-ai/claude-agent-sdk; \
+    tar -xzf /tmp/claude-agent-sdk.tgz \
+      -C node_modules/@anthropic-ai/claude-agent-sdk --strip-components=1; \
+    rm -rf "node_modules/@anthropic-ai/$native_package"; \
+    mkdir -p "node_modules/@anthropic-ai/$native_package"; \
+    tar -xzf /tmp/claude-native.tgz \
+      -C "node_modules/@anthropic-ai/$native_package" --strip-components=1; \
+    node -e 'const p=require(`./node_modules/@anthropic-ai/${process.argv[1]}/package.json`); if(p.version!=="0.3.217") throw new Error(`unexpected Claude native package ${p.name}@${p.version}`)' "$native_package"; \
+    test -x "node_modules/@anthropic-ai/$native_package/claude"; \
+    mkdir -p /opt/claude/bin; \
+    cp "node_modules/@anthropic-ai/$native_package/LICENSE.md" /opt/claude/LICENSE.md; \
+    ln -s "/opt/claude-agent-acp/node_modules/@anthropic-ai/$native_package/claude" \
+      /opt/claude/bin/claude
+
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26.2-bookworm@sha256:47ce5636e9936b2c5cbf708925578ef386b4f8872aec74a67bd13a627d242b19 AS supervisor-builder
+ARG TARGETOS
+ARG TARGETARCH
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked go mod download
+COPY . .
+RUN set -eu; \
+    test "$TARGETOS" = linux; \
+    case "$TARGETARCH" in amd64|arm64) ;; *) exit 1 ;; esac; \
+    CGO_ENABLED=0 GOOS="$TARGETOS" GOARCH="$TARGETARCH" \
+      go build -buildvcs=false -trimpath -ldflags='-s -w' \
+      -o /out/orka-acp-runtime ./cmd/orka-acp-runtime; \
+    CGO_ENABLED=0 GOOS="$TARGETOS" GOARCH="$TARGETARCH" \
+      go build -buildvcs=false -trimpath -ldflags='-s -w' \
+      -o /out/orka-acp-exec-helper ./cmd/orka-acp-exec-helper
+
+FROM --platform=$TARGETPLATFORM docker.io/library/node:22.22.0-bookworm-slim@sha256:dd9d21971ec4395903fa6143c2b9267d048ae01ca6d3ea96f16cb30df6187d94
+LABEL org.opencontainers.image.title="Orka ACP Claude runtime" \
+      org.opencontainers.image.description="Orka harness v2 ACP supervisor with Claude Agent ACP 0.61.0 and Claude Agent SDK 0.3.217 / Claude Code 2.1.217" \
+      org.opencontainers.image.source="https://github.com/orka-agents/orka" \
+      org.opencontainers.image.licenses="MIT AND Apache-2.0 AND LicenseRef-Anthropic-Legal-Agreements" \
+      io.orka.acp.provider="claude" \
+      io.orka.acp.adapter.version="0.61.0" \
+      io.orka.acp.adapter.revision="c19bddcf7914259d6c15103a2d1580c7371e1d16" \
+      io.orka.acp.adapter.digest="sha256:bb410d53e2d13591da5ebcaf09ae055d166ffefb27b7172988650cd62ef4ebd3" \
+      io.orka.acp.provider.version="0.3.217" \
+      io.orka.acp.provider.cli.version="2.1.217" \
+      io.orka.acp.provider.digest.amd64="sha256:8d2ccffbdf63aef1436a30b0fd32ef0eac663c3465318b181138471a68f02b92" \
+      io.orka.acp.provider.digest.arm64="sha256:51080502df2942d2092c4a5b7122eda518041fbe954027a1e128ede3cb337563"
+ENV HOME=/root \
+    NODE_ENV=production \
+    ORKA_ACP_PROVIDER=claude \
+    PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+RUN set -eu; \
+    ln -s /usr/local/bin/node /usr/bin/node; \
+    rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack \
+      /opt/yarn-v1.22.22; \
+    rm -f /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack \
+      /usr/local/bin/pnpm /usr/local/bin/pnpx /usr/local/bin/yarn /usr/local/bin/yarnpkg; \
+    mkdir -p /sessions /usr/share/licenses/orka /usr/share/licenses/claude-agent-acp \
+      /usr/share/licenses/claude-agent-sdk /usr/share/licenses/claude-code; \
+    chmod 0711 /sessions
+COPY --from=supervisor-builder /out/orka-acp-runtime /usr/local/bin/orka-acp-runtime
+COPY --from=supervisor-builder /out/orka-acp-exec-helper /usr/local/bin/orka-acp-exec-helper
+COPY --from=claude-layout /opt/claude-agent-acp /opt/claude-agent-acp
+COPY --from=claude-layout /opt/claude /opt/claude
+COPY --from=claude-layout /opt/claude-agent-acp/LICENSE /usr/share/licenses/claude-agent-acp/LICENSE
+COPY --from=claude-layout /opt/claude-agent-acp/node_modules/@anthropic-ai/claude-agent-sdk/LICENSE.md /usr/share/licenses/claude-agent-sdk/LICENSE.md
+COPY --from=claude-layout /opt/claude/LICENSE.md /usr/share/licenses/claude-code/LICENSE.md
+COPY --from=upstream-artifacts /artifacts/orka-LICENSE /usr/share/licenses/orka/LICENSE
+COPY --from=upstream-artifacts /artifacts/orka-NOTICE.md /usr/share/licenses/orka/NOTICE.md
+WORKDIR /
+# The supervisor must start as root to assign each child a unique UID/GID and
+# prove process cleanup. Kubernetes drops all capabilities and adds back only
+# the explicit identity/process-management set.
+# trivy:ignore:DS-0002
+USER 0:0
+EXPOSE 8080
+STOPSIGNAL SIGTERM
+ENTRYPOINT ["/usr/local/bin/orka-acp-runtime"]
diff --git a/workers/acp/images/codex/Dockerfile b/workers/acp/images/codex/Dockerfile
new file mode 100644
index 000000000..705b2faab
--- /dev/null
+++ b/workers/acp/images/codex/Dockerfile
@@ -0,0 +1,150 @@
+# syntax=docker/dockerfile:1.7.1@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
+
+# The tag documents the human-readable version; the manifest-list digest makes
+# every supported platform immutable.
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26.2-bookworm@sha256:47ce5636e9936b2c5cbf708925578ef386b4f8872aec74a67bd13a627d242b19 AS upstream-artifacts
+ARG TARGETARCH
+COPY workers/acp/images/artifact-tool.go /tmp/artifact-tool.go
+RUN go build -buildvcs=false -trimpath -ldflags='-s -w' -o /usr/local/bin/artifact-tool /tmp/artifact-tool.go
+RUN set -eu; \
+    mkdir -p /artifacts; \
+    artifact-tool download \
+      "https://codeload.github.com/agentclientprotocol/codex-acp/tar.gz/307d81018f7cc0c3141ddf71c7532d38310e2cfb" \
+      "4d3cc46a901bdd4abf112e703e734078e09a172ecd535aa3e556318a051a7c39" \
+      /artifacts/codex-acp-source.tgz 16777216; \
+    artifact-tool download \
+      "https://registry.npmjs.org/@agentclientprotocol/codex-acp/-/codex-acp-1.1.7.tgz" \
+      "642920240baa0b6b1951fb2c56b9ff11689648019499615f941000d95d127301" \
+      /artifacts/codex-acp-release.tgz 16777216; \
+    case "$TARGETARCH" in \
+      amd64) \
+        native_url="https://registry.npmjs.org/@openai/codex/-/codex-0.145.0-linux-x64.tgz"; \
+        native_sha="11239480f8e3efd1430f23bbe91c1a397856b8bbe6185ccbaee2382d25e03df2" ;; \
+      arm64) \
+        native_url="https://registry.npmjs.org/@openai/codex/-/codex-0.145.0-linux-arm64.tgz"; \
+        native_sha="b78c57e172b2f18e5969ae26183253cd3cdd9abb3b424a8f7334f4b5530c2b27" ;; \
+      *) echo "unsupported TARGETARCH: $TARGETARCH" >&2; exit 1 ;; \
+    esac; \
+    artifact-tool download \
+      "$native_url" "$native_sha" /artifacts/codex-native.tgz 201326592; \
+    artifact-tool download \
+      "https://raw.githubusercontent.com/openai/codex/25af12f7e61572b0bc18ddb1008be543b91519b0/LICENSE" \
+      "d17f227e4df5da1600391338865ce0f3055211760a36688f816941d58232d8dc" \
+      /artifacts/codex-LICENSE 65536; \
+    artifact-tool download \
+      "https://raw.githubusercontent.com/openai/codex/25af12f7e61572b0bc18ddb1008be543b91519b0/NOTICE" \
+      "9d71575ecfd9a843fc1677b0efb08053c6ba9fd686a0de1a6f5382fd3c220915" \
+      /artifacts/codex-NOTICE 65536; \
+    artifact-tool download \
+      "https://raw.githubusercontent.com/orka-agents/orka/d03acb995b6014a6e855181c50b922b65ea8e7ff/LICENSE" \
+      "7df20dcdf9197e9945c14858d41c60f11b52b93e5b69e2b63416b874d598d322" \
+      /artifacts/orka-LICENSE 65536; \
+    artifact-tool download \
+      "https://raw.githubusercontent.com/orka-agents/orka/d03acb995b6014a6e855181c50b922b65ea8e7ff/NOTICE.md" \
+      "f0e9fca2012cfb65dd9532e0fe693c405de5006d23e54b99b78154060f7dbf75" \
+      /artifacts/orka-NOTICE.md 65536
+
+FROM --platform=$BUILDPLATFORM docker.io/library/node:22.22.0-bookworm-slim@sha256:dd9d21971ec4395903fa6143c2b9267d048ae01ca6d3ea96f16cb30df6187d94 AS adapter-builder
+ENV NPM_CONFIG_AUDIT=false \
+    NPM_CONFIG_FUND=false \
+    NPM_CONFIG_UPDATE_NOTIFIER=false
+COPY --from=upstream-artifacts /usr/local/bin/artifact-tool /usr/local/bin/artifact-tool
+COPY --from=upstream-artifacts /artifacts/codex-acp-source.tgz /tmp/source.tgz
+COPY --from=upstream-artifacts /artifacts/codex-acp-release.tgz /tmp/release.tgz
+COPY workers/acp/images/codex/patch-agent-mode.mjs /tmp/patch-agent-mode.mjs
+RUN set -eu; \
+    mkdir -p /src /published; \
+    tar -xzf /tmp/source.tgz -C /src --strip-components=1; \
+    tar -xzf /tmp/release.tgz -C /published
+WORKDIR /src
+RUN npm ci --ignore-scripts --no-audit --no-fund --registry=https://registry.npmjs.org/
+RUN npm run build
+RUN artifact-tool compare /src/dist /published/package/dist
+RUN set -eu; \
+    printf '%s  %s\n' '4b1fc39dc7ac0d6aa404030a3433f46c8b9c67e8e8223efca490a6ab8bf4287a' /tmp/patch-agent-mode.mjs | sha256sum -c -; \
+    node /tmp/patch-agent-mode.mjs /src/src/AgentMode.ts; \
+    npm run build; \
+    printf '%s  %s\n' 'bcfb6a2772a7de2d027e977d9bc9db5fa210a462de1af7ab061361be4410cc75' /src/dist/index.js | sha256sum -c -
+
+FROM --platform=$BUILDPLATFORM docker.io/library/node:22.22.0-bookworm-slim@sha256:dd9d21971ec4395903fa6143c2b9267d048ae01ca6d3ea96f16cb30df6187d94 AS codex-layout
+ARG TARGETARCH
+COPY --from=upstream-artifacts /artifacts/codex-native.tgz /tmp/codex-native.tgz
+RUN set -eu; \
+    mkdir -p /tmp/native /opt/codex/bin; \
+    tar -xzf /tmp/codex-native.tgz -C /tmp/native; \
+    case "$TARGETARCH" in \
+      amd64) package_arch=x64; target_triple=x86_64-unknown-linux-musl ;; \
+      arm64) package_arch=arm64; target_triple=aarch64-unknown-linux-musl ;; \
+      *) echo "unsupported TARGETARCH: $TARGETARCH" >&2; exit 1 ;; \
+    esac; \
+    node -e 'const p=require("/tmp/native/package/package.json"); if(p.name!=="@openai/codex"||p.version!==`0.145.0-linux-${process.argv[1]}`) throw new Error(`unexpected Codex package ${p.name}@${p.version}`)' "$package_arch"; \
+    test -x "/tmp/native/package/vendor/$target_triple/bin/codex"; \
+    mv /tmp/native/package/vendor /opt/codex/vendor; \
+    cp /tmp/native/package/README.md /opt/codex/README.md; \
+    cp /tmp/native/package/package.json /opt/codex/package.json; \
+    ln -s "../vendor/$target_triple/bin/codex" /opt/codex/bin/codex
+
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26.2-bookworm@sha256:47ce5636e9936b2c5cbf708925578ef386b4f8872aec74a67bd13a627d242b19 AS supervisor-builder
+ARG TARGETOS
+ARG TARGETARCH
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked go mod download
+COPY . .
+RUN set -eu; \
+    test "$TARGETOS" = linux; \
+    case "$TARGETARCH" in amd64|arm64) ;; *) exit 1 ;; esac; \
+    CGO_ENABLED=0 GOOS="$TARGETOS" GOARCH="$TARGETARCH" \
+      go build -buildvcs=false -trimpath -ldflags='-s -w' \
+      -o /out/orka-acp-runtime ./cmd/orka-acp-runtime; \
+    CGO_ENABLED=0 GOOS="$TARGETOS" GOARCH="$TARGETARCH" \
+      go build -buildvcs=false -trimpath -ldflags='-s -w' \
+      -o /out/orka-acp-exec-helper ./cmd/orka-acp-exec-helper
+
+FROM --platform=$TARGETPLATFORM docker.io/library/node:22.22.0-bookworm-slim@sha256:dd9d21971ec4395903fa6143c2b9267d048ae01ca6d3ea96f16cb30df6187d94
+LABEL org.opencontainers.image.title="Orka ACP Codex runtime" \
+      org.opencontainers.image.description="Orka harness v2 ACP supervisor with Codex ACP 1.1.7 and Codex CLI 0.145.0" \
+      org.opencontainers.image.source="https://github.com/orka-agents/orka" \
+      org.opencontainers.image.licenses="MIT AND Apache-2.0" \
+      io.orka.acp.provider="codex" \
+      io.orka.acp.adapter.version="1.1.7" \
+      io.orka.acp.adapter.revision="307d81018f7cc0c3141ddf71c7532d38310e2cfb" \
+      io.orka.acp.adapter.digest="sha256:642920240baa0b6b1951fb2c56b9ff11689648019499615f941000d95d127301" \
+      io.orka.acp.adapter.patch.digest="sha256:4b1fc39dc7ac0d6aa404030a3433f46c8b9c67e8e8223efca490a6ab8bf4287a" \
+      io.orka.acp.adapter.dist.digest="sha256:bcfb6a2772a7de2d027e977d9bc9db5fa210a462de1af7ab061361be4410cc75" \
+      io.orka.acp.provider.version="0.145.0" \
+      io.orka.acp.provider.revision="25af12f7e61572b0bc18ddb1008be543b91519b0" \
+      io.orka.acp.provider.digest.amd64="sha256:11239480f8e3efd1430f23bbe91c1a397856b8bbe6185ccbaee2382d25e03df2" \
+      io.orka.acp.provider.digest.arm64="sha256:b78c57e172b2f18e5969ae26183253cd3cdd9abb3b424a8f7334f4b5530c2b27"
+ENV HOME=/root \
+    NODE_ENV=production \
+    ORKA_ACP_PROVIDER=codex \
+    PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+RUN set -eu; \
+    ln -s /usr/local/bin/node /usr/bin/node; \
+    rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack \
+      /opt/yarn-v1.22.22; \
+    rm -f /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack \
+      /usr/local/bin/pnpm /usr/local/bin/pnpx /usr/local/bin/yarn /usr/local/bin/yarnpkg; \
+    mkdir -p /sessions /opt/codex-acp/dist /usr/share/licenses/orka \
+      /usr/share/licenses/codex-acp /usr/share/licenses/codex; \
+    chmod 0711 /sessions
+COPY --from=supervisor-builder /out/orka-acp-runtime /usr/local/bin/orka-acp-runtime
+COPY --from=supervisor-builder /out/orka-acp-exec-helper /usr/local/bin/orka-acp-exec-helper
+COPY --from=adapter-builder /src/dist/index.js /opt/codex-acp/dist/index.js
+COPY --from=adapter-builder /src/package.json /src/README.md /opt/codex-acp/
+COPY --from=adapter-builder /src/LICENSE /usr/share/licenses/codex-acp/LICENSE
+COPY --from=codex-layout /opt/codex /opt/codex
+COPY --from=upstream-artifacts /artifacts/codex-LICENSE /usr/share/licenses/codex/LICENSE
+COPY --from=upstream-artifacts /artifacts/codex-NOTICE /usr/share/licenses/codex/NOTICE
+COPY --from=upstream-artifacts /artifacts/orka-LICENSE /usr/share/licenses/orka/LICENSE
+COPY --from=upstream-artifacts /artifacts/orka-NOTICE.md /usr/share/licenses/orka/NOTICE.md
+WORKDIR /
+# The supervisor must start as root to assign each child a unique UID/GID and
+# prove process cleanup. Kubernetes drops all capabilities and adds back only
+# the explicit identity/process-management set.
+# trivy:ignore:DS-0002
+USER 0:0
+EXPOSE 8080
+STOPSIGNAL SIGTERM
+ENTRYPOINT ["/usr/local/bin/orka-acp-runtime"]
diff --git a/workers/acp/images/codex/patch-agent-mode.mjs b/workers/acp/images/codex/patch-agent-mode.mjs
new file mode 100644
index 000000000..d51e58587
--- /dev/null
+++ b/workers/acp/images/codex/patch-agent-mode.mjs
@@ -0,0 +1,33 @@
+import {readFileSync, writeFileSync} from "node:fs";
+
+const path = process.argv[2];
+if (!path) throw new Error("AgentMode.ts path is required");
+let source = readFileSync(path, "utf8");
+
+const modeAnchor = `    static readonly AgentFullAccess = new AgentMode(
+        "agent-full-access",
+        "Agent (full access)",
+        "Codex can edit files outside this workspace and run commands with network access. Exercise caution when using.",
+        "never",
+        {"type": "dangerFullAccess"},
+        "danger-full-access"
+    );
+`;
+const externalMode = `${modeAnchor}    static readonly OrkaExternal = new AgentMode(
+        "orka-external",
+        "Orka external sandbox",
+        "Execution is confined by the Orka RuntimeSession boundary.",
+        "on-request",
+        {"type": "externalSandbox", networkAccess: "restricted"},
+        "read-only"
+    );
+`;
+if (!source.includes(modeAnchor)) throw new Error("AgentFullAccess anchor not found");
+source = source.replace(modeAnchor, externalMode);
+
+const allAnchor = `        return [AgentMode.ReadOnly, AgentMode.Agent, AgentMode.AgentFullAccess];`;
+const allReplacement = `        return [AgentMode.ReadOnly, AgentMode.Agent, AgentMode.AgentFullAccess, AgentMode.OrkaExternal];`;
+if (!source.includes(allAnchor)) throw new Error("AgentMode.all anchor not found");
+source = source.replace(allAnchor, allReplacement);
+
+writeFileSync(path, source);
diff --git a/workers/acp/images/copilot/Dockerfile b/workers/acp/images/copilot/Dockerfile
new file mode 100644
index 000000000..570cab2ae
--- /dev/null
+++ b/workers/acp/images/copilot/Dockerfile
@@ -0,0 +1,94 @@
+# syntax=docker/dockerfile:1.7.1@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
+
+# The tag documents the human-readable version; every base image and downloaded
+# provider artifact is selected by an immutable digest.
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26.2-bookworm@sha256:47ce5636e9936b2c5cbf708925578ef386b4f8872aec74a67bd13a627d242b19 AS upstream-artifacts
+ARG TARGETARCH
+COPY workers/acp/images/artifact-tool.go /tmp/artifact-tool.go
+COPY LICENSE /artifacts/orka-LICENSE
+COPY NOTICE.md /artifacts/orka-NOTICE.md
+RUN go build -buildvcs=false -trimpath -ldflags='-s -w' -o /usr/local/bin/artifact-tool /tmp/artifact-tool.go
+RUN set -eu; \
+    mkdir -p /artifacts /opt/copilot/bin; \
+    case "$TARGETARCH" in \
+      amd64) \
+        copilot_url="https://github.com/github/copilot-cli/releases/download/v1.0.77/copilot-linux-x64.tar.gz"; \
+        copilot_sha="c6414f99c5b29b049a3b0929ba824f0ff0ae88b85eb52559be45631b96b00f4c" ;; \
+      arm64) \
+        copilot_url="https://github.com/github/copilot-cli/releases/download/v1.0.77/copilot-linux-arm64.tar.gz"; \
+        copilot_sha="5bcf01b30bd74ce415cc93acb404885e0bc396cde037ca68efe2b8ec84f91e5a" ;; \
+      *) echo "unsupported TARGETARCH: $TARGETARCH" >&2; exit 1 ;; \
+    esac; \
+    artifact-tool download \
+      "$copilot_url" "$copilot_sha" /artifacts/copilot.tgz 134217728; \
+    test "$(tar -tzf /artifacts/copilot.tgz)" = "copilot"; \
+    tar -xzf /artifacts/copilot.tgz -C /opt/copilot/bin; \
+    test -f /opt/copilot/bin/copilot; \
+    chmod 0755 /opt/copilot/bin/copilot; \
+    artifact-tool download \
+      "https://raw.githubusercontent.com/github/copilot-cli/aee1edd29ef0f2058425bf399bcc9e5002a2b8f2/LICENSE.md" \
+      "1fbd0dcc55c66738b1b591632132c927de20c8443dff1d55b4851e378883e402" \
+      /artifacts/copilot-LICENSE.md 65536
+
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26.2-bookworm@sha256:47ce5636e9936b2c5cbf708925578ef386b4f8872aec74a67bd13a627d242b19 AS supervisor-builder
+ARG TARGETOS
+ARG TARGETARCH
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked go mod download
+COPY . .
+RUN set -eu; \
+    test "$TARGETOS" = linux; \
+    case "$TARGETARCH" in amd64|arm64) ;; *) exit 1 ;; esac; \
+    CGO_ENABLED=0 GOOS="$TARGETOS" GOARCH="$TARGETARCH" \
+      go build -buildvcs=false -trimpath -ldflags='-s -w' \
+      -o /out/orka-acp-runtime ./cmd/orka-acp-runtime; \
+    CGO_ENABLED=0 GOOS="$TARGETOS" GOARCH="$TARGETARCH" \
+      go build -buildvcs=false -trimpath -ldflags='-s -w' \
+      -o /out/orka-acp-exec-helper ./cmd/orka-acp-exec-helper
+
+# This pinned Node base supplies the glibc/libstdc++ runtime required by the
+# official Copilot binary. Node and its package managers are removed below.
+FROM --platform=$TARGETPLATFORM docker.io/library/node:22.22.0-bookworm-slim@sha256:dd9d21971ec4395903fa6143c2b9267d048ae01ca6d3ea96f16cb30df6187d94
+LABEL org.opencontainers.image.title="Orka ACP GitHub Copilot runtime" \
+      org.opencontainers.image.description="Orka harness v2 ACP supervisor with GitHub Copilot CLI 1.0.77" \
+      org.opencontainers.image.source="https://github.com/orka-agents/orka" \
+      org.opencontainers.image.licenses="MIT AND LicenseRef-GitHub-Copilot-CLI" \
+      io.orka.acp.provider="copilot" \
+      io.orka.acp.adapter.version="1.0.77" \
+      io.orka.acp.adapter.revision="aee1edd29ef0f2058425bf399bcc9e5002a2b8f2" \
+      io.orka.acp.adapter.digest.amd64="sha256:c6414f99c5b29b049a3b0929ba824f0ff0ae88b85eb52559be45631b96b00f4c" \
+      io.orka.acp.adapter.digest.arm64="sha256:5bcf01b30bd74ce415cc93acb404885e0bc396cde037ca68efe2b8ec84f91e5a"
+ENV HOME=/root \
+    ORKA_ACP_PROVIDER=copilot \
+    SSL_CERT_DIR=/etc/ssl/certs \
+    SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt \
+    PATH=/opt/copilot/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+RUN set -eu; \
+    rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack \
+      /opt/yarn-v1.22.22; \
+    rm -f /usr/local/bin/node /usr/local/bin/npm /usr/local/bin/npx \
+      /usr/local/bin/corepack /usr/local/bin/pnpm /usr/local/bin/pnpx \
+      /usr/local/bin/yarn /usr/local/bin/yarnpkg /usr/local/bin/git \
+      /usr/local/bin/ssh /usr/bin/git /usr/bin/ssh /usr/bin/scp /usr/bin/sftp \
+      /usr/bin/curl /usr/bin/wget; \
+    test ! -e /usr/bin/git && test ! -e /usr/bin/ssh; \
+    mkdir -p /sessions /usr/share/licenses/orka /usr/share/licenses/github-copilot-cli; \
+    chmod 0711 /sessions
+COPY --from=supervisor-builder /out/orka-acp-runtime /usr/local/bin/orka-acp-runtime
+COPY --from=supervisor-builder /out/orka-acp-exec-helper /usr/local/bin/orka-acp-exec-helper
+COPY --from=upstream-artifacts /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=upstream-artifacts /opt/copilot /opt/copilot
+COPY --from=upstream-artifacts /artifacts/copilot-LICENSE.md /usr/share/licenses/github-copilot-cli/LICENSE.md
+COPY --from=upstream-artifacts /artifacts/orka-LICENSE /usr/share/licenses/orka/LICENSE
+COPY --from=upstream-artifacts /artifacts/orka-NOTICE.md /usr/share/licenses/orka/NOTICE.md
+RUN test -s /etc/ssl/certs/ca-certificates.crt
+WORKDIR /
+# The supervisor must start as root to assign each child a unique UID/GID and
+# prove process cleanup. Kubernetes drops all capabilities and adds back only
+# the explicit identity/process-management set.
+# trivy:ignore:DS-0002
+USER 0:0
+EXPOSE 8080
+STOPSIGNAL SIGTERM
+ENTRYPOINT ["/usr/local/bin/orka-acp-runtime"]
diff --git a/workers/acp/images/dockerfile_test.go b/workers/acp/images/dockerfile_test.go
new file mode 100644
index 000000000..930f2335a
--- /dev/null
+++ b/workers/acp/images/dockerfile_test.go
@@ -0,0 +1,267 @@
+package main
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/orka-agents/orka/internal/acp"
+)
+
+// runtimeDockerfileCase describes one built-in ACP runtime image. requiredPins
+// reference internal/acp pin constants directly so a pin bump that forgets the
+// Dockerfile fails this suite; extraForbidden holds forbidden substrings that
+// cannot be enforced uniformly (each exception is explained inline).
+type runtimeDockerfileCase struct {
+	provider       string
+	dockerfile     string
+	requiredPins   []string
+	extraForbidden []string
+}
+
+// universalForbiddenSubstrings is the union of the previously per-image
+// forbidden lists that holds for every runtime Dockerfile. Secret-shaped
+// terms are concatenated so scanners do not flag the test itself.
+var universalForbiddenSubstrings = []string{
+	"apt-get ", "apk add", "git clone", "npm install", "RUN npx ", "RUN curl ", "RUN wget ", "ADD http",
+	"GITHUB_" + "TOKEN", "GH_" + "TOKEN", "SSH_AUTH_SOCK",
+	"OPENAI_API_" + "KEY=", "OPENCODE_SERVER_" + "PASS" + "WORD=", "ARG API_" + "KEY", "ARG TO" + "KEN",
+	":latest",
+}
+
+// Bare "curl ", "wget ", and "npx " cannot be universal: the node-based images
+// legitimately mention those names while deleting the binaries
+// (rm -f /usr/local/bin/npx ... /usr/bin/curl /usr/bin/wget). Invocation forms
+// (RUN curl/RUN wget/RUN npx) stay universally forbidden above.
+// "unknown-linux-musl" cannot be universal: the Codex CLI npm package vendors
+// its binaries under *-unknown-linux-musl target triples.
+var (
+	forbiddenFetchTools = []string{"curl ", "wget "}
+	forbiddenMuslTriple = "unknown-linux-musl"
+	forbiddenBareNpx    = "npx "
+)
+
+func runtimeDockerfileCases() []runtimeDockerfileCase {
+	return []runtimeDockerfileCase{
+		{
+			provider:   "codex",
+			dockerfile: "codex/Dockerfile",
+			requiredPins: []string{
+				acp.CodexACPVersion,
+				acp.CodexACPSourceCommit,
+				acp.CodexACPTarSHA256,
+				acp.CodexACPOrkaPatchSHA256,
+				acp.CodexACPOrkaDistSHA256,
+				acp.CodexCLIVersion,
+				acp.CodexCLISourceCommit,
+				acp.CodexCLILinuxX64SHA256,
+				acp.CodexCLILinuxARM64SHA256,
+			},
+			// Codex vendors musl-triple CLI binaries, so the musl term is
+			// excluded; its node base image removal lines mention npx.
+			extraForbidden: forbiddenFetchTools,
+		},
+		{
+			provider:   "claude",
+			dockerfile: "claude/Dockerfile",
+			requiredPins: []string{
+				acp.ClaudeACPVersion,
+				acp.ClaudeACPSourceCommit,
+				acp.ClaudeACPTarSHA256,
+				acp.ClaudeAgentSDKVersion,
+				acp.ClaudeCodeVersion,
+				acp.ClaudeSDKLinuxX64SHA256,
+				acp.ClaudeSDKLinuxARM64SHA256,
+			},
+			extraForbidden: append([]string{forbiddenMuslTriple}, forbiddenFetchTools...),
+		},
+		{
+			provider:   "copilot",
+			dockerfile: "copilot/Dockerfile",
+			requiredPins: []string{
+				acp.CopilotCLIVersion,
+				acp.CopilotCLISourceCommit,
+				acp.CopilotCLILinuxX64SHA256,
+				acp.CopilotCLILinuxARM64SHA256,
+			},
+			// Copilot's hardening line removes /usr/bin/curl and /usr/bin/wget,
+			// so the bare fetch-tool terms are excluded for this image only.
+			extraForbidden: []string{forbiddenMuslTriple},
+		},
+		{
+			provider:   "opencode",
+			dockerfile: "opencode/Dockerfile",
+			requiredPins: []string{
+				acp.OpenCodeVersion,
+				acp.OpenCodeSourceCommit,
+				acp.OpenCodeSourceTarSHA256,
+				acp.OpenCodeLinuxX64BaselineTarSHA256,
+				acp.OpenCodeLinuxARM64TarSHA256,
+				acp.OpenCodeLinuxX64BinarySHA256,
+				acp.OpenCodeLinuxARM64BinarySHA256,
+				acp.OpenCodeRipgrepVersion,
+				acp.OpenCodeRipgrepDebianVersion,
+				acp.OpenCodeRipgrepLinuxX64DebSHA256,
+				acp.OpenCodeRipgrepLinuxARM64DebSHA256,
+				acp.OpenCodeRipgrepLinuxX64BinarySHA256,
+				acp.OpenCodeRipgrepLinuxARM64BinarySHA256,
+				acp.OpenCodeRootInstructionSHA256,
+				acp.OpenCodeImageNoticeSHA256,
+			},
+			// The debian-based OpenCode image ships no node tooling at all, so
+			// even the bare npx term holds there.
+			extraForbidden: append([]string{forbiddenMuslTriple, forbiddenBareNpx}, forbiddenFetchTools...),
+		},
+	}
+}
+
+func TestRuntimeDockerfilesArePinnedAndHardened(t *testing.T) {
+	t.Parallel()
+	for _, tc := range runtimeDockerfileCases() {
+		t.Run(tc.provider, func(t *testing.T) {
+			t.Parallel()
+			data, err := os.ReadFile(tc.dockerfile)
+			if err != nil {
+				t.Fatal(err)
+			}
+			contents := string(data)
+
+			for line := range strings.SplitSeq(contents, "\n") {
+				trimmed := strings.TrimSpace(line)
+				if strings.HasPrefix(trimmed, "FROM ") && !strings.Contains(trimmed, "@sha256:") {
+					t.Errorf("un-pinned base image: %s", line)
+				}
+			}
+
+			forbidden := append(append([]string(nil), universalForbiddenSubstrings...), tc.extraForbidden...)
+			for _, value := range forbidden {
+				if strings.Contains(contents, value) {
+					t.Errorf("Dockerfile contains forbidden mutable or secret-bearing surface %q", value)
+				}
+			}
+
+			for _, pin := range tc.requiredPins {
+				if pin == "" {
+					t.Fatal("empty required pin constant")
+				}
+				if !strings.Contains(contents, pin) {
+					t.Errorf("Dockerfile is missing pinned artifact reference %q from internal/acp/pins.go", pin)
+				}
+			}
+
+			for _, required := range []string{
+				"ORKA_ACP_PROVIDER=" + tc.provider,
+				"ENTRYPOINT [\"/usr/local/bin/orka-acp-runtime\"]",
+			} {
+				if !strings.Contains(contents, required) {
+					t.Errorf("Dockerfile is missing %q", required)
+				}
+			}
+		})
+	}
+}
+
+func TestCopilotPinIsNewerThanCredentiallessBYOKACPFixBoundary(t *testing.T) {
+	t.Parallel()
+	got := parseVersionCore(t, acp.CopilotCLIVersion)
+	fixBoundary := [3]int{1, 0, 76}
+	if compareVersionCore(got, fixBoundary) <= 0 {
+		t.Fatalf(
+			"Copilot CLI version %q must be newer than credentialless BYOK ACP fix boundary 1.0.76-0",
+			acp.CopilotCLIVersion,
+		)
+	}
+}
+
+func parseVersionCore(t *testing.T, version string) [3]int {
+	t.Helper()
+	var parsed [3]int
+	core := strings.SplitN(version, "-", 2)[0]
+	if count, err := fmt.Sscanf(core, "%d.%d.%d", &parsed[0], &parsed[1], &parsed[2]); err != nil || count != len(parsed) {
+		t.Fatalf("parse Copilot CLI version %q: parsed %d components: %v", version, count, err)
+	}
+	return parsed
+}
+
+func compareVersionCore(left, right [3]int) int {
+	for index := range left {
+		if left[index] < right[index] {
+			return -1
+		}
+		if left[index] > right[index] {
+			return 1
+		}
+	}
+	return 0
+}
+
+func TestDockerContextIncludesCopilotLicenseInputs(t *testing.T) {
+	t.Parallel()
+	data, err := os.ReadFile(filepath.Join("..", "..", "..", ".dockerignore"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	contents := string(data)
+	for _, pattern := range []string{"!LICENSE", "!NOTICE.md"} {
+		if !strings.Contains(contents, pattern) {
+			t.Errorf(".dockerignore is missing %q", pattern)
+		}
+	}
+}
+
+func TestOpenCodeRootInstructionIsPinnedAndFailClosed(t *testing.T) {
+	t.Parallel()
+	data, err := os.ReadFile(filepath.Join("opencode", "AGENTS.md"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	sum := sha256.Sum256(data)
+	if got := hex.EncodeToString(sum[:]); got != acp.OpenCodeRootInstructionSHA256 {
+		t.Fatalf("AGENTS.md SHA-256 = %s, want %s", got, acp.OpenCodeRootInstructionSHA256)
+	}
+	content := string(data)
+	for _, required := range []string{
+		"workspace, provider proxy, MCP broker, and permission policy are authoritative",
+		"Do not inspect or modify other session trees",
+		"Never bypass an OpenCode allow/deny decision",
+		"Do not change OpenCode configuration",
+		"Never print, copy, persist, or expose credentials",
+	} {
+		if !strings.Contains(content, required) {
+			t.Errorf("AGENTS.md is missing guardrail %q", required)
+		}
+	}
+}
+
+func TestOpenCodeImageNoticeIsPinnedAndIncludesOpenCodeLicense(t *testing.T) {
+	t.Parallel()
+	data, err := os.ReadFile(filepath.Join("opencode", "NOTICE.md"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	sum := sha256.Sum256(data)
+	if got := hex.EncodeToString(sum[:]); got != acp.OpenCodeImageNoticeSHA256 {
+		t.Fatalf("NOTICE.md SHA-256 = %s, want %s", got, acp.OpenCodeImageNoticeSHA256)
+	}
+	root, err := os.ReadFile(filepath.Join("..", "..", "..", "NOTICE.md"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(root) != string(data) {
+		t.Fatal("image NOTICE.md does not match the repository third-party notice")
+	}
+	content := string(data)
+	for _, required := range []string{
+		"## OpenCode",
+		"OpenCode " + acp.OpenCodeVersion + " native binary",
+		"Copyright (c) 2025 opencode",
+	} {
+		if !strings.Contains(content, required) {
+			t.Errorf("NOTICE.md is missing %q", required)
+		}
+	}
+}
diff --git a/workers/acp/images/opencode/AGENTS.md b/workers/acp/images/opencode/AGENTS.md
new file mode 100644
index 000000000..c189aae3c
--- /dev/null
+++ b/workers/acp/images/opencode/AGENTS.md
@@ -0,0 +1,18 @@
+# Orka-managed OpenCode ACP runtime
+
+This OpenCode process runs inside a private, per-session Orka runtime. Orka's
+workspace, provider proxy, MCP broker, and permission policy are authoritative.
+
+- Treat the current working directory and `$ORKA_WORKSPACE` as the only task
+  workspace. Do not inspect or modify other session trees, process environments,
+  mounted secrets, credential stores, or host/runtime configuration.
+- Never bypass an OpenCode allow/deny decision with another tool or shell
+  command. A denied operation is denied by Orka policy; stop or choose an
+  operation that remains within the granted workspace intent.
+- Do not change OpenCode configuration, providers, permissions, MCP endpoints,
+  plugins, skills, language servers, update settings, or runtime binaries.
+- Use only the controller-supplied MCP server and the local tools explicitly
+  enabled by the immutable session configuration. Do not perform ambient
+  network, account, provider, repository, plugin, model, or skill discovery.
+- Never print, copy, persist, or expose credentials, tokens, authentication
+  headers, or secret-bearing environment variables.
diff --git a/workers/acp/images/opencode/Dockerfile b/workers/acp/images/opencode/Dockerfile
new file mode 100644
index 000000000..907393df2
--- /dev/null
+++ b/workers/acp/images/opencode/Dockerfile
@@ -0,0 +1,153 @@
+# syntax=docker/dockerfile:1.7.1@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
+
+# The tag documents the human-readable version; the manifest-list digest and
+# checksum-verified upstream artifacts make every supported platform immutable.
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26.2-bookworm@sha256:47ce5636e9936b2c5cbf708925578ef386b4f8872aec74a67bd13a627d242b19 AS upstream-artifacts
+ARG TARGETARCH
+COPY workers/acp/images/artifact-tool.go /tmp/artifact-tool.go
+COPY workers/acp/images/opencode/AGENTS.md /tmp/opencode-AGENTS.md
+COPY workers/acp/images/opencode/NOTICE.md /tmp/orka-NOTICE.md
+RUN go build -buildvcs=false -trimpath -ldflags='-s -w' -o /usr/local/bin/artifact-tool /tmp/artifact-tool.go
+RUN set -eu; \
+    mkdir -p /artifacts /src; \
+    artifact-tool download \
+      "https://codeload.github.com/anomalyco/opencode/tar.gz/4da7bb44c84e013fa53e9c5d02ac753d1435c81a" \
+      "bbc3363c6886c63865a60b75d456fff3fbe6b87d8a86f44b2439900695b35de3" \
+      /artifacts/opencode-source.tgz 100663296; \
+    case "$TARGETARCH" in \
+      amd64) \
+        native_url="https://registry.npmjs.org/opencode-linux-x64-baseline/-/opencode-linux-x64-baseline-1.18.9.tgz"; \
+        native_sha="59bf22db1f20c6c9836c926800a8e6416228330c2b518ade3d431d315cd76366"; \
+        ripgrep_url="https://snapshot.debian.org/file/096560a159a8be70155f16209d91777019011677"; \
+        ripgrep_fallback_url="https://deb.debian.org/debian/pool/main/r/rust-ripgrep/ripgrep_15.2.0-1_amd64.deb"; \
+        ripgrep_deb_sha="d9d86586969e925b8627936ec4387d10cc65baf7d42195258743a49e711b6157" ;; \
+      arm64) \
+        native_url="https://registry.npmjs.org/opencode-linux-arm64/-/opencode-linux-arm64-1.18.9.tgz"; \
+        native_sha="4846a7e470797950f209126442a291cc06574fd44ddbb96c89d730017f60aae7"; \
+        ripgrep_url="https://snapshot.debian.org/file/482bbe93dc82997d7d84c901990e8d9f4327457c"; \
+        ripgrep_fallback_url="https://deb.debian.org/debian/pool/main/r/rust-ripgrep/ripgrep_15.2.0-1_arm64.deb"; \
+        ripgrep_deb_sha="8f18379cd499dd890d27190a359fe194d0bce92d7efad8e47b0f636e64bf4b46" ;; \
+      *) echo "unsupported TARGETARCH: $TARGETARCH" >&2; exit 1 ;; \
+    esac; \
+    artifact-tool download \
+      "$native_url" "$native_sha" /artifacts/opencode-native.tgz 100663296; \
+    if ! artifact-tool download \
+      "$ripgrep_url" "$ripgrep_deb_sha" /artifacts/ripgrep.deb 16777216; then \
+      artifact-tool download \
+        "$ripgrep_fallback_url" "$ripgrep_deb_sha" /artifacts/ripgrep.deb 16777216; \
+    fi; \
+    tar -xzf /artifacts/opencode-source.tgz -C /src --strip-components=1; \
+    grep -Eq '"name":[[:space:]]*"opencode"' /src/packages/opencode/package.json; \
+    grep -Eq '"version":[[:space:]]*"1\.18\.9"' /src/packages/opencode/package.json; \
+    printf '%s  %s\n' '625f0f619133f89bbbb2abe37369613dfa1885eba1e50d02170deb62bb42cb6b' /src/LICENSE | sha256sum -c -; \
+    printf '%s  %s\n' 'b8e691e210a9502c9689ba20705806dfb1b5b10b5ca1062f73f9a85b1043a812' /tmp/opencode-AGENTS.md | sha256sum -c -; \
+    printf '%s  %s\n' '93167c1d7505d3e38efce8bf019c2af4e10ef56529465b87c34e4b3401508a98' /tmp/orka-NOTICE.md | sha256sum -c -; \
+    cp /src/LICENSE /artifacts/opencode-LICENSE; \
+    cp /src/README.md /artifacts/opencode-README.md; \
+    cp /tmp/opencode-AGENTS.md /artifacts/opencode-AGENTS.md; \
+    cp /tmp/orka-NOTICE.md /artifacts/orka-NOTICE.md; \
+    artifact-tool download \
+      "https://raw.githubusercontent.com/orka-agents/orka/d03acb995b6014a6e855181c50b922b65ea8e7ff/LICENSE" \
+      "7df20dcdf9197e9945c14858d41c60f11b52b93e5b69e2b63416b874d598d322" \
+      /artifacts/orka-LICENSE 65536
+
+FROM --platform=$TARGETPLATFORM docker.io/library/debian:trixie-slim@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd AS opencode-layout
+ARG TARGETARCH
+COPY --from=upstream-artifacts /artifacts/opencode-native.tgz /tmp/opencode-native.tgz
+COPY --from=upstream-artifacts /artifacts/ripgrep.deb /tmp/ripgrep.deb
+RUN set -eu; \
+    mkdir -p /tmp/native /tmp/ripgrep /opt/opencode/bin /opt/ripgrep/bin /opt/ripgrep/licenses; \
+    tar -xzf /tmp/opencode-native.tgz -C /tmp/native; \
+    case "$TARGETARCH" in \
+      amd64) \
+        package_name=opencode-linux-x64-baseline; \
+        binary_sha=7c4d91c84d2bfdeabb59257e3490c5e5acb08f2aacb3e42f3ddc296a1c3f1aca; \
+        debian_arch=amd64; \
+        ripgrep_sha=af751db9b06d308fd5078aa973880cc8c75678289386bf1a6ee5faa614aa6f2d ;; \
+      arm64) \
+        package_name=opencode-linux-arm64; \
+        binary_sha=ae8a9b7c591d3c763463f16bfb5f45230c4c741f039e8967218662836449ecdf; \
+        debian_arch=arm64; \
+        ripgrep_sha=d3febe5d02e2a15da0909200caeb5af0be65e58736331c2ab88b7086d62e942b ;; \
+      *) echo "unsupported TARGETARCH: $TARGETARCH" >&2; exit 1 ;; \
+    esac; \
+    grep -Eq '"name":[[:space:]]*"'"$package_name"'"' /tmp/native/package/package.json; \
+    grep -Eq '"version":[[:space:]]*"1\.18\.9"' /tmp/native/package/package.json; \
+    test -x /tmp/native/package/bin/opencode; \
+    printf '%s  %s\n' "$binary_sha" /tmp/native/package/bin/opencode | sha256sum -c -; \
+    install -m 0755 /tmp/native/package/bin/opencode /opt/opencode/bin/opencode; \
+    test "$(/opt/opencode/bin/opencode --version)" = "1.18.9"; \
+    test "$(dpkg-deb -f /tmp/ripgrep.deb Package)" = ripgrep; \
+    test "$(dpkg-deb -f /tmp/ripgrep.deb Version)" = 15.2.0-1; \
+    test "$(dpkg-deb -f /tmp/ripgrep.deb Architecture)" = "$debian_arch"; \
+    dpkg-deb -x /tmp/ripgrep.deb /tmp/ripgrep; \
+    test -x /tmp/ripgrep/usr/bin/rg; \
+    printf '%s  %s\n' "$ripgrep_sha" /tmp/ripgrep/usr/bin/rg | sha256sum -c -; \
+    install -m 0755 /tmp/ripgrep/usr/bin/rg /opt/ripgrep/bin/rg; \
+    cp /tmp/ripgrep/usr/share/doc/ripgrep/copyright /opt/ripgrep/licenses/COPYRIGHT; \
+    ldd /opt/ripgrep/bin/rg | grep -Fq 'libc.so.6'; \
+    /opt/ripgrep/bin/rg --version | grep -Eq '^ripgrep 15\.2\.0'
+
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26.2-bookworm@sha256:47ce5636e9936b2c5cbf708925578ef386b4f8872aec74a67bd13a627d242b19 AS supervisor-builder
+ARG TARGETOS
+ARG TARGETARCH
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked go mod download
+COPY . .
+RUN set -eu; \
+    test "$TARGETOS" = linux; \
+    case "$TARGETARCH" in amd64|arm64) ;; *) exit 1 ;; esac; \
+    CGO_ENABLED=0 GOOS="$TARGETOS" GOARCH="$TARGETARCH" \
+      go build -buildvcs=false -trimpath -ldflags='-s -w' \
+      -o /out/orka-acp-runtime ./cmd/orka-acp-runtime; \
+    CGO_ENABLED=0 GOOS="$TARGETOS" GOARCH="$TARGETARCH" \
+      go build -buildvcs=false -trimpath -ldflags='-s -w' \
+      -o /out/orka-acp-exec-helper ./cmd/orka-acp-exec-helper
+
+FROM --platform=$TARGETPLATFORM docker.io/library/debian:trixie-slim@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd
+LABEL org.opencontainers.image.title="Orka ACP OpenCode runtime" \
+      org.opencontainers.image.description="Orka harness v2 ACP supervisor with native OpenCode ACP 1.18.9" \
+      org.opencontainers.image.source="https://github.com/orka-agents/orka" \
+      org.opencontainers.image.licenses="MIT AND (MIT OR Unlicense)" \
+      io.orka.acp.provider="opencode" \
+      io.orka.acp.adapter.version="1.18.9" \
+      io.orka.acp.adapter.revision="4da7bb44c84e013fa53e9c5d02ac753d1435c81a" \
+      io.orka.acp.adapter.source.digest="sha256:bbc3363c6886c63865a60b75d456fff3fbe6b87d8a86f44b2439900695b35de3" \
+      io.orka.acp.adapter.digest.amd64="sha256:59bf22db1f20c6c9836c926800a8e6416228330c2b518ade3d431d315cd76366" \
+      io.orka.acp.adapter.digest.arm64="sha256:4846a7e470797950f209126442a291cc06574fd44ddbb96c89d730017f60aae7" \
+      io.orka.acp.adapter.binary.digest.amd64="sha256:7c4d91c84d2bfdeabb59257e3490c5e5acb08f2aacb3e42f3ddc296a1c3f1aca" \
+      io.orka.acp.adapter.binary.digest.arm64="sha256:ae8a9b7c591d3c763463f16bfb5f45230c4c741f039e8967218662836449ecdf" \
+      io.orka.acp.ripgrep.version="15.2.0" \
+      io.orka.acp.ripgrep.debian.version="15.2.0-1" \
+      io.orka.acp.ripgrep.package.digest.amd64="sha256:d9d86586969e925b8627936ec4387d10cc65baf7d42195258743a49e711b6157" \
+      io.orka.acp.ripgrep.package.digest.arm64="sha256:8f18379cd499dd890d27190a359fe194d0bce92d7efad8e47b0f636e64bf4b46" \
+      io.orka.acp.ripgrep.binary.digest.amd64="sha256:af751db9b06d308fd5078aa973880cc8c75678289386bf1a6ee5faa614aa6f2d" \
+      io.orka.acp.ripgrep.binary.digest.arm64="sha256:d3febe5d02e2a15da0909200caeb5af0be65e58736331c2ab88b7086d62e942b" \
+      io.orka.acp.root-instruction.digest="sha256:b8e691e210a9502c9689ba20705806dfb1b5b10b5ca1062f73f9a85b1043a812" \
+      io.orka.notice.digest="sha256:93167c1d7505d3e38efce8bf019c2af4e10ef56529465b87c34e4b3401508a98"
+ENV HOME=/root \
+    ORKA_ACP_PROVIDER=opencode \
+    PATH=/usr/local/bin:/usr/bin:/bin
+RUN set -eu; \
+    mkdir -p /sessions /opt/opencode /usr/share/licenses/orka /usr/share/licenses/opencode /usr/share/licenses/ripgrep; \
+    chmod 0711 /sessions
+COPY --from=supervisor-builder /out/orka-acp-runtime /usr/local/bin/orka-acp-runtime
+COPY --from=supervisor-builder /out/orka-acp-exec-helper /usr/local/bin/orka-acp-exec-helper
+COPY --from=opencode-layout /opt/opencode/bin/opencode /opt/opencode/bin/opencode
+COPY --from=opencode-layout /opt/ripgrep/bin/rg /usr/local/bin/rg
+COPY --from=opencode-layout /opt/ripgrep/licenses/COPYRIGHT /usr/share/licenses/ripgrep/COPYRIGHT
+COPY --from=upstream-artifacts /artifacts/opencode-AGENTS.md /opt/opencode/AGENTS.md
+COPY --from=upstream-artifacts /artifacts/opencode-README.md /opt/opencode/README.md
+COPY --from=upstream-artifacts /artifacts/opencode-LICENSE /usr/share/licenses/opencode/LICENSE
+COPY --from=upstream-artifacts /artifacts/orka-LICENSE /usr/share/licenses/orka/LICENSE
+COPY --from=upstream-artifacts /artifacts/orka-NOTICE.md /usr/share/licenses/orka/NOTICE.md
+WORKDIR /
+# The supervisor must start as root to assign each child a unique UID/GID and
+# prove process cleanup. Kubernetes drops all capabilities and adds back only
+# the explicit identity/process-management set.
+# trivy:ignore:DS-0002
+USER 0:0
+EXPOSE 8080
+STOPSIGNAL SIGTERM
+ENTRYPOINT ["/usr/local/bin/orka-acp-runtime"]
diff --git a/workers/acp/images/opencode/NOTICE.md b/workers/acp/images/opencode/NOTICE.md
new file mode 100644
index 000000000..3ad99591c
--- /dev/null
+++ b/workers/acp/images/opencode/NOTICE.md
@@ -0,0 +1,194 @@
+# Third-Party Notices
+
+This project includes and distributes third-party components. This file records
+notices for source-derived build tooling and direct AI CLI runtime components
+intentionally included in Orka. Generated release SBOMs provide additional
+dependency and image-content detail for transitive package-manager dependencies,
+base image contents, and platform packages.
+
+## Gatekeeper Helm Chart Generator
+
+Orka's Helm chart generation flow includes modified source derived from
+Gatekeeper's in-repository `cmd/build/helmify` generator at commit
+`c9b67657102032a460a28e7f3b9c88ec0c193453`. The derived source is under
+`cmd/build/helmify`.
+
+Gatekeeper
+
+Copyright 2018-2020 The Gatekeeper Authors
+
+The derived source is licensed under the Apache License, Version 2.0. See
+`cmd/build/helmify/LICENSE`,
+`cmd/build/helmify/NOTICE`, and
+`cmd/build/helmify/README.md` for the license,
+upstream revision, and Orka modification notes.
+
+## GitHub Copilot CLI
+
+The digest-pinned Copilot ACP runtime image redistributes the unmodified official GitHub Copilot CLI executable as one component of Orka's fenced RuntimePool service. The image includes this license at `/usr/share/licenses/github-copilot-cli/LICENSE.md`; the controller and Publisher images do not include Copilot CLI.
+
+GitHub Copilot CLI License
+
+1. License Grant
+   Subject to the terms of this License, GitHub grants you a non‑exclusive, non‑transferable, royalty‑free license to install and run copies of the GitHub Copilot CLI (the “Software”). Subject to Section 2 below, GitHub also grants you the right to reproduce and redistribute unmodified copies of the Software as part of an application or service.
+
+2. Redistribution Rights and Conditions
+   You may reproduce and redistribute the Software only in accordance with all of the following conditions:
+   The Software is distributed only in unmodified form;
+   The Software is redistributed solely as part of an application or service that provides material functionality beyond the Software itself;
+   The Software is not distributed on a standalone basis or as a primary product;
+   You include a copy of this License and retain all applicable copyright, trademark, and attribution notices; and
+   Your application or service is licensed independently of the Software.
+   Nothing in this License restricts your choice of license for your application or service, including distribution under an open source license. This License applies solely to the Software and does not modify or supersede the license terms governing your application or its source code.
+
+3. Scope Limitations
+   This License does not grant you the right to:
+   Modify, adapt, translate, or create derivative works of the Software;
+   Redistribute the Software except as expressly permitted in Section 2;
+   Remove, alter, or obscure any proprietary notices included in the Software; or
+   Use GitHub trademarks, logos, or branding except as necessary to identify the Software.
+
+4. Reservation of Rights
+   GitHub and its licensors retain all right, title, and interest in and to the Software. All rights not expressly granted by this License are reserved.
+
+5. Disclaimer of Warranty
+   THE SOFTWARE IS PROVIDED “AS IS,” WITHOUT WARRANTY OF ANY KIND, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON‑INFRINGEMENT. THE ENTIRE RISK ARISING OUT OF USE OF THE SOFTWARE REMAINS WITH YOU.
+
+6. Limitation of Liability
+   TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT SHALL GITHUB OR ITS LICENSORS BE LIABLE FOR ANY DAMAGES ARISING OUT OF OR RELATING TO THIS LICENSE OR THE USE OR DISTRIBUTION OF THE SOFTWARE, WHETHER IN CONTRACT, TORT, OR OTHERWISE.
+
+7. Termination
+   This License terminates automatically if you fail to comply with its terms. Upon termination, you must cease all use and distribution of the Software.
+
+8. Notice Regarding GitHub Services (Informational Only)
+   Use of the Software may require access to GitHub services and is subject to the applicable GitHub Terms of Service and GitHub Copilot terms. This License governs only rights related to the Software and does not grant any rights to access or use GitHub services.
+
+## GitHub Copilot SDK for Go
+
+The source dependency graph includes `github.com/github/copilot-sdk/go` for compatibility and integration work. The supported built-in ACP runtime profiles are Codex, Claude, Copilot, and OpenCode.
+
+MIT License
+
+Copyright GitHub, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+## OpenCode
+
+The digest-pinned OpenCode ACP runtime image redistributes the unmodified OpenCode 1.18.9 native binary under the following MIT license.
+
+MIT License
+
+Copyright (c) 2025 opencode
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+## Anthropic Claude Code
+
+The digest-pinned Claude ACP runtime image installs `@anthropic-ai/claude-code` and the corresponding Linux platform package. The controller and Publisher images do not include Claude Code.
+
+© Anthropic PBC. All rights reserved. Use is subject to the Legal Agreements outlined here: https://code.claude.com/docs/en/legal-and-compliance.
+
+## OpenAI Codex CLI
+
+The digest-pinned Codex ACP runtime image installs `@openai/codex` and the corresponding Linux platform package. The controller and Publisher images do not include Codex. The npm package declares the Apache License 2.0.
+
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files.
+
+"Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below).
+
+"Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:
+
+(a) You must give any other recipients of the Work or Derivative Works a copy of this License; and
+
+(b) You must cause any modified files to carry prominent notices stating that You changed the files; and
+
+(c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and
+
+(d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License.
+
+You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives.
+
+Copyright [yyyy] [name of copyright owner]
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
diff --git a/workers/acp/supervisor/artifact_broker.go b/workers/acp/supervisor/artifact_broker.go
new file mode 100644
index 000000000..a02355838
--- /dev/null
+++ b/workers/acp/supervisor/artifact_broker.go
@@ -0,0 +1,97 @@
+package supervisor
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/orka-agents/orka/internal/artifactcap"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+const artifactAuthorizationBrokerPath = "/internal/v2/acp/artifact-authorizations"
+
+type brokerArtifactAuthorizationProvider struct {
+	endpoint         *url.URL
+	client           *http.Client
+	namespace        string
+	controllerBearer string
+	capabilitySecret []byte
+}
+
+type artifactBrokerRequest struct {
+	Namespace string                      `json:"namespace"`
+	Metadata  harnessv2.MutationMetadata  `json:"metadata"`
+	Artifact  harnessv2.ArtifactReference `json:"artifact"`
+}
+
+type artifactBrokerResponse struct {
+	Capability    string `json:"capability"`
+	RequestDigest string `json:"requestDigest"`
+}
+
+func NewBrokerArtifactAuthorizationProvider(baseURL, namespace, bearer string, capabilitySecret []byte) (ArtifactAuthorizationProvider, error) {
+	parsed, err := url.Parse(strings.TrimSpace(baseURL))
+	if err != nil || (parsed.Scheme != providerProxyScheme && parsed.Scheme != providerProxyTLSScheme) || parsed.Host == "" || parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" {
+		return nil, fmt.Errorf("artifact broker URL is invalid")
+	}
+	parsed.Path = artifactAuthorizationBrokerPath
+	if strings.TrimSpace(namespace) == "" || len(strings.TrimSpace(bearer)) < 32 || len(capabilitySecret) < harnessv2.MinCapabilitySecretBytes {
+		return nil, fmt.Errorf("artifact broker identity is invalid")
+	}
+	client := &http.Client{Timeout: 30 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}
+	return &brokerArtifactAuthorizationProvider{endpoint: parsed, client: client, namespace: namespace, controllerBearer: bearer, capabilitySecret: append([]byte(nil), capabilitySecret...)}, nil
+}
+
+func (p *brokerArtifactAuthorizationProvider) AuthorizeArtifact(ctx context.Context, request ArtifactAuthorizationRequest) (artifactcap.Authorization, error) {
+	if request.Operation != artifactcap.OperationUpload || request.WorkspaceDelta == nil {
+		return artifactcap.Authorization{}, fmt.Errorf("artifact broker supports workspace-delta uploads only")
+	}
+	metadata := request.WorkspaceDelta.Metadata
+	metadata.OperationID = harnessv2.OperationID("authorize-" + string(metadata.OperationID))
+	metadata.ExpiresAt = time.Now().UTC().Add(30 * time.Second)
+	metadata.RequestDigest = ""
+	brokerRequest := artifactBrokerRequest{Namespace: p.namespace, Metadata: metadata, Artifact: request.Reference}
+	digest, err := harnessv2.CanonicalRequestDigest(brokerRequest)
+	if err != nil {
+		return artifactcap.Authorization{}, err
+	}
+	brokerRequest.Metadata.RequestDigest = digest
+	capability, err := harnessv2.SignOperationCapability(p.capabilitySecret, harnessv2.ClaimsForMutation(brokerRequest.Metadata))
+	if err != nil {
+		return artifactcap.Authorization{}, err
+	}
+	body, err := json.Marshal(brokerRequest)
+	if err != nil {
+		return artifactcap.Authorization{}, err
+	}
+	httpRequest, err := http.NewRequestWithContext(ctx, http.MethodPost, p.endpoint.String(), bytes.NewReader(body))
+	if err != nil {
+		return artifactcap.Authorization{}, err
+	}
+	httpRequest.Header.Set("Content-Type", "application/json")
+	httpRequest.Header.Set("Authorization", "Bearer "+p.controllerBearer)
+	httpRequest.Header.Set(harnessv2.OperationCapabilityHeader, capability)
+	response, err := p.client.Do(httpRequest)
+	if err != nil {
+		return artifactcap.Authorization{}, fmt.Errorf("artifact authorization broker transport failed")
+	}
+	defer response.Body.Close() //nolint:errcheck
+	data, err := io.ReadAll(io.LimitReader(response.Body, 32<<10))
+	if err != nil || response.StatusCode != http.StatusOK {
+		return artifactcap.Authorization{}, fmt.Errorf("artifact authorization broker rejected request")
+	}
+	var decoded artifactBrokerResponse
+	decoder := json.NewDecoder(bytes.NewReader(data))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&decoded); err != nil || decoded.Capability == "" || !artifactcap.IsRequestDigest(decoded.RequestDigest) {
+		return artifactcap.Authorization{}, fmt.Errorf("artifact authorization broker response is invalid")
+	}
+	return artifactcap.Authorization{Capability: decoded.Capability, RequestDigest: decoded.RequestDigest}, nil
+}
diff --git a/workers/acp/supervisor/artifact_client.go b/workers/acp/supervisor/artifact_client.go
new file mode 100644
index 000000000..d94481072
--- /dev/null
+++ b/workers/acp/supervisor/artifact_client.go
@@ -0,0 +1,257 @@
+package supervisor
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"math"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/orka-agents/orka/internal/artifactcap"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+const maxArtifactClientResponseBytes = 32 << 10
+
+type artifactClientLimits struct {
+	MaxDownloadBytes int64
+	MaxUploadBytes   int64
+}
+
+type ArtifactAuthorizationRequest struct {
+	Operation      artifactcap.Operation
+	Reference      harnessv2.ArtifactReference
+	WorkspaceDelta *harnessv2.CreateWorkspaceDeltaRequest
+}
+
+type ArtifactAuthorizationProvider interface {
+	AuthorizeArtifact(context.Context, ArtifactAuthorizationRequest) (artifactcap.Authorization, error)
+}
+
+type ArtifactAuthorizationProviderFunc func(context.Context, ArtifactAuthorizationRequest) (artifactcap.Authorization, error)
+
+func (f ArtifactAuthorizationProviderFunc) AuthorizeArtifact(ctx context.Context, request ArtifactAuthorizationRequest) (artifactcap.Authorization, error) {
+	return f(ctx, request)
+}
+
+type ArtifactClient struct {
+	baseURL          *url.URL
+	httpClient       *http.Client
+	authorization    ArtifactAuthorizationProvider
+	maxDownloadBytes int64
+	maxUploadBytes   int64
+}
+
+func NewArtifactClient(baseURL string, client *http.Client, authorization ArtifactAuthorizationProvider) (*ArtifactClient, error) {
+	return newArtifactClient(baseURL, client, authorization, artifactClientLimits{
+		MaxDownloadBytes: defaultWorkspaceArtifactDownloadBytes,
+		MaxUploadBytes:   defaultWorkspaceDeltaUploadBytes,
+	})
+}
+
+func newArtifactClient(baseURL string, client *http.Client, authorization ArtifactAuthorizationProvider, limits artifactClientLimits) (*ArtifactClient, error) {
+	if limits.MaxDownloadBytes <= 0 || limits.MaxUploadBytes <= 0 {
+		return nil, fmt.Errorf("artifact transfer limits must be positive")
+	}
+	if limits.MaxDownloadBytes == math.MaxInt64 || limits.MaxUploadBytes == math.MaxInt64 {
+		return nil, fmt.Errorf("artifact transfer limits must be less than %d", int64(math.MaxInt64))
+	}
+	parsed, err := url.Parse(strings.TrimSpace(baseURL))
+	if err != nil || (parsed.Scheme != "http" && parsed.Scheme != "https") || parsed.Host == "" || parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" {
+		return nil, fmt.Errorf("artifact API base URL is invalid")
+	}
+	if parsed.Path != "" && parsed.Path != "/" {
+		return nil, fmt.Errorf("artifact API base URL must not contain a path")
+	}
+	if client == nil {
+		client = &http.Client{Timeout: 2 * time.Minute}
+	}
+	clientCopy := *client
+	clientCopy.CheckRedirect = func(_ *http.Request, _ []*http.Request) error { return http.ErrUseLastResponse }
+	parsed.Path = ""
+	return &ArtifactClient{
+		baseURL: parsed, httpClient: &clientCopy, authorization: authorization,
+		maxDownloadBytes: limits.MaxDownloadBytes, maxUploadBytes: limits.MaxUploadBytes,
+	}, nil
+}
+
+func (c *ArtifactClient) Download(ctx context.Context, reference harnessv2.ArtifactReference, destination io.Writer) error {
+	if c.authorization == nil {
+		return fmt.Errorf("artifact authorization provider is required")
+	}
+	authorization, err := c.authorization.AuthorizeArtifact(ctx, ArtifactAuthorizationRequest{Operation: artifactcap.OperationDownload, Reference: reference})
+	if err != nil {
+		return fmt.Errorf("authorize artifact download")
+	}
+	return c.DownloadAuthorized(ctx, reference, authorization, destination)
+}
+
+func (c *ArtifactClient) DownloadAuthorized(ctx context.Context, reference harnessv2.ArtifactReference, authorization artifactcap.Authorization, destination io.Writer) error {
+	if destination == nil {
+		return fmt.Errorf("artifact download destination is required")
+	}
+	if err := validateTransportReference(reference); err != nil {
+		return err
+	}
+	if reference.SizeBytes > c.maxDownloadBytes {
+		return fmt.Errorf("artifact download exceeds transport limit")
+	}
+	request, err := c.newRequest(ctx, http.MethodGet, reference, authorization, nil)
+	if err != nil {
+		return err
+	}
+	response, err := c.httpClient.Do(request)
+	if err != nil {
+		return fmt.Errorf("artifact download transport failed")
+	}
+	defer response.Body.Close() //nolint:errcheck
+	if response.StatusCode != http.StatusOK {
+		drainBounded(response.Body)
+		return fmt.Errorf("artifact download failed with status %d", response.StatusCode)
+	}
+	if err := validateDownloadHeaders(response, reference); err != nil {
+		return err
+	}
+	hash := sha256.New()
+	written, err := io.CopyBuffer(io.MultiWriter(destination, hash), io.LimitReader(response.Body, reference.SizeBytes+1), make([]byte, 128<<10))
+	if err != nil {
+		return fmt.Errorf("artifact download stream failed")
+	}
+	if written != reference.SizeBytes {
+		return fmt.Errorf("artifact download length mismatch")
+	}
+	actualDigest := "sha256:" + hex.EncodeToString(hash.Sum(nil))
+	if !constantArtifactStringEqual(actualDigest, reference.Digest) {
+		return fmt.Errorf("artifact download digest mismatch")
+	}
+	return nil
+}
+
+func (c *ArtifactClient) Upload(ctx context.Context, reference harnessv2.ArtifactReference, data []byte, delta *harnessv2.CreateWorkspaceDeltaRequest) (harnessv2.ArtifactReference, error) {
+	if c.authorization == nil {
+		return harnessv2.ArtifactReference{}, fmt.Errorf("artifact authorization provider is required")
+	}
+	authorization, err := c.authorization.AuthorizeArtifact(ctx, ArtifactAuthorizationRequest{Operation: artifactcap.OperationUpload, Reference: reference, WorkspaceDelta: delta})
+	if err != nil {
+		return harnessv2.ArtifactReference{}, fmt.Errorf("authorize artifact upload")
+	}
+	return c.UploadAuthorized(ctx, reference, authorization, data)
+}
+
+func (c *ArtifactClient) UploadAuthorized(ctx context.Context, reference harnessv2.ArtifactReference, authorization artifactcap.Authorization, data []byte) (harnessv2.ArtifactReference, error) {
+	if err := validateTransportReference(reference); err != nil {
+		return harnessv2.ArtifactReference{}, err
+	}
+	if reference.SizeBytes > c.maxUploadBytes {
+		return harnessv2.ArtifactReference{}, fmt.Errorf("artifact upload exceeds transport limit")
+	}
+	if int64(len(data)) != reference.SizeBytes || !constantArtifactStringEqual(artifactcap.DigestBytes(data), reference.Digest) {
+		return harnessv2.ArtifactReference{}, fmt.Errorf("artifact upload payload does not match reference")
+	}
+	request, err := c.newRequest(ctx, http.MethodPut, reference, authorization, bytes.NewReader(data))
+	if err != nil {
+		return harnessv2.ArtifactReference{}, err
+	}
+	response, err := c.httpClient.Do(request)
+	if err != nil {
+		return harnessv2.ArtifactReference{}, fmt.Errorf("artifact upload transport failed")
+	}
+	defer response.Body.Close() //nolint:errcheck
+	if response.StatusCode != http.StatusCreated {
+		drainBounded(response.Body)
+		return harnessv2.ArtifactReference{}, fmt.Errorf("artifact upload failed with status %d", response.StatusCode)
+	}
+	var stored struct {
+		ArtifactID string    `json:"artifactID"`
+		Digest     string    `json:"digest"`
+		SizeBytes  int64     `json:"sizeBytes"`
+		MediaType  string    `json:"mediaType"`
+		CreatedAt  time.Time `json:"createdAt"`
+	}
+	responseData, err := io.ReadAll(io.LimitReader(response.Body, maxArtifactClientResponseBytes+1))
+	if err != nil || len(responseData) > maxArtifactClientResponseBytes {
+		return harnessv2.ArtifactReference{}, fmt.Errorf("artifact upload response is invalid")
+	}
+	decoder := json.NewDecoder(bytes.NewReader(responseData))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&stored); err != nil {
+		return harnessv2.ArtifactReference{}, fmt.Errorf("artifact upload response is invalid")
+	}
+	if err := decoder.Decode(&struct{}{}); err != io.EOF {
+		return harnessv2.ArtifactReference{}, fmt.Errorf("artifact upload response is invalid")
+	}
+	storedReference := harnessv2.ArtifactReference{ArtifactID: harnessv2.ArtifactID(stored.ArtifactID), Digest: stored.Digest, SizeBytes: stored.SizeBytes, MediaType: stored.MediaType}
+	if err := storedReference.Validate(); err != nil || storedReference != reference {
+		return harnessv2.ArtifactReference{}, fmt.Errorf("artifact upload response does not match request")
+	}
+	return storedReference, nil
+}
+
+func (c *ArtifactClient) newRequest(ctx context.Context, method string, reference harnessv2.ArtifactReference, authorization artifactcap.Authorization, body io.Reader) (*http.Request, error) {
+	if authorization.Capability == "" || !artifactcap.IsRequestDigest(authorization.RequestDigest) {
+		return nil, fmt.Errorf("artifact operation authorization is invalid")
+	}
+	objectPath, err := artifactcap.ObjectPath(reference.Digest)
+	if err != nil {
+		return nil, err
+	}
+	endpoint := *c.baseURL
+	endpoint.Path = objectPath
+	request, err := http.NewRequestWithContext(ctx, method, endpoint.String(), body)
+	if err != nil {
+		return nil, fmt.Errorf("create artifact request")
+	}
+	request.Header.Set(artifactcap.CapabilityHeader, authorization.Capability)
+	request.Header.Set(artifactcap.RequestDigestHeader, authorization.RequestDigest)
+	request.Header.Set(artifactcap.ContentLengthHeader, strconv.FormatInt(reference.SizeBytes, 10))
+	request.Header.Set(artifactcap.MediaTypeHeader, reference.MediaType)
+	if method == http.MethodPut {
+		request.ContentLength = reference.SizeBytes
+		request.Header.Set("Content-Type", reference.MediaType)
+	} else {
+		request.Header.Set("Accept", reference.MediaType)
+	}
+	return request, nil
+}
+
+func validateTransportReference(reference harnessv2.ArtifactReference) error {
+	if err := reference.Validate(); err != nil {
+		return fmt.Errorf("artifact reference: %w", err)
+	}
+	expectedID, err := artifactcap.ArtifactIDForDigest(reference.Digest)
+	if err != nil || string(reference.ArtifactID) != expectedID {
+		return fmt.Errorf("artifact reference is not content addressed")
+	}
+	if reference.SizeBytes < 0 {
+		return fmt.Errorf("artifact reference size is invalid")
+	}
+	if err := artifactcap.ValidateMediaType(reference.MediaType); err != nil {
+		return fmt.Errorf("artifact reference media type is invalid")
+	}
+	return nil
+}
+
+func validateDownloadHeaders(response *http.Response, reference harnessv2.ArtifactReference) error {
+	if response.ContentLength != reference.SizeBytes || response.Header.Get("Content-Type") != reference.MediaType ||
+		response.Header.Get(artifactcap.ObjectDigestHeader) != reference.Digest {
+		return fmt.Errorf("artifact download response metadata mismatch")
+	}
+	return nil
+}
+
+func drainBounded(reader io.Reader) {
+	_, _ = io.Copy(io.Discard, io.LimitReader(reader, maxArtifactClientResponseBytes))
+}
+
+func constantArtifactStringEqual(left, right string) bool {
+	return len(left) == len(right) && subtle.ConstantTimeCompare([]byte(left), []byte(right)) == 1
+}
diff --git a/workers/acp/supervisor/artifact_client_limits_test.go b/workers/acp/supervisor/artifact_client_limits_test.go
new file mode 100644
index 000000000..382853c22
--- /dev/null
+++ b/workers/acp/supervisor/artifact_client_limits_test.go
@@ -0,0 +1,194 @@
+package supervisor
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"sync/atomic"
+	"testing"
+
+	"github.com/orka-agents/orka/internal/artifactcap"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+type artifactLimitRoundTripperFunc func(*http.Request) (*http.Response, error)
+
+func (f artifactLimitRoundTripperFunc) RoundTrip(request *http.Request) (*http.Response, error) {
+	return f(request)
+}
+
+type repeatedByteReader byte
+
+func (r repeatedByteReader) Read(buffer []byte) (int, error) {
+	for i := range buffer {
+		buffer[i] = byte(r)
+	}
+	return len(buffer), nil
+}
+
+func TestArtifactClientUsesSeparateBoundedDefaults(t *testing.T) {
+	t.Parallel()
+
+	var calls atomic.Int32
+	client, err := NewArtifactClient("https://artifact.example", &http.Client{Transport: artifactLimitRoundTripperFunc(func(*http.Request) (*http.Response, error) {
+		calls.Add(1)
+		return nil, fmt.Errorf("unexpected artifact transport call")
+	})}, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if client.maxDownloadBytes != defaultWorkspaceArtifactDownloadBytes || client.maxDownloadBytes <= 0 {
+		t.Fatalf("artifact download limit = %d, want bounded default %d", client.maxDownloadBytes, defaultWorkspaceArtifactDownloadBytes)
+	}
+	wantUpload := defaultProtocolLimits(providerKindCodex).MaxWorkspaceDeltaBytes
+	if client.maxUploadBytes != wantUpload || client.maxUploadBytes <= 0 {
+		t.Fatalf("artifact upload limit = %d, want outbound capability %d", client.maxUploadBytes, wantUpload)
+	}
+
+	reference := artifactReferenceWithSize(defaultWorkspaceArtifactDownloadBytes+1, artifactcap.MediaTypeWorkspaceTar)
+	err = client.DownloadAuthorized(context.Background(), reference, testArtifactAuthorization(), io.Discard)
+	if err == nil || !strings.Contains(err.Error(), "exceeds transport limit") {
+		t.Fatalf("oversized default-limit download error = %v", err)
+	}
+	if calls.Load() != 0 {
+		t.Fatalf("artifact transport calls = %d, want 0", calls.Load())
+	}
+}
+
+func TestArtifactClientDownloadsRaisedPublisherWorkspaceArtifact(t *testing.T) {
+	t.Parallel()
+
+	const extraBytes = int64(1 << 20)
+	artifactSize := defaultWorkspaceArtifactDownloadBytes + extraBytes
+	reference := repeatedByteArtifactReference(t, artifactSize, 0, artifactcap.MediaTypeWorkspaceTar)
+	var calls atomic.Int32
+	client, err := newArtifactClient(
+		"https://artifact.example",
+		&http.Client{Transport: artifactLimitRoundTripperFunc(func(*http.Request) (*http.Response, error) {
+			calls.Add(1)
+			header := make(http.Header)
+			header.Set("Content-Type", reference.MediaType)
+			header.Set(artifactcap.ObjectDigestHeader, reference.Digest)
+			return &http.Response{
+				StatusCode:    http.StatusOK,
+				Body:          io.NopCloser(io.LimitReader(repeatedByteReader(0), reference.SizeBytes)),
+				Header:        header,
+				ContentLength: reference.SizeBytes,
+			}, nil
+		})},
+		nil,
+		artifactClientLimits{
+			MaxDownloadBytes: artifactSize,
+			MaxUploadBytes:   defaultWorkspaceDeltaUploadBytes,
+		},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if err := client.DownloadAuthorized(context.Background(), reference, testArtifactAuthorization(), io.Discard); err != nil {
+		t.Fatalf("download valid %d-byte Publisher workspace artifact: %v", artifactSize, err)
+	}
+	if calls.Load() != 1 {
+		t.Fatalf("artifact transport calls = %d, want 1", calls.Load())
+	}
+
+	outbound := artifactReferenceWithSize(artifactSize, artifactcap.MediaTypeWorkspaceDelta)
+	if _, err := client.UploadAuthorized(context.Background(), outbound, testArtifactAuthorization(), nil); err == nil || !strings.Contains(err.Error(), "exceeds transport limit") {
+		t.Fatalf("outbound delta above independent upload capability error = %v", err)
+	}
+}
+
+func TestArtifactClientRejectsInvalidTransferLimits(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name   string
+		limits artifactClientLimits
+	}{
+		{name: "zero download", limits: artifactClientLimits{MaxUploadBytes: 1}},
+		{name: "negative download", limits: artifactClientLimits{MaxDownloadBytes: -1, MaxUploadBytes: 1}},
+		{name: "zero upload", limits: artifactClientLimits{MaxDownloadBytes: 1}},
+		{name: "negative upload", limits: artifactClientLimits{MaxDownloadBytes: 1, MaxUploadBytes: -1}},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			client, err := newArtifactClient("https://artifact.example", nil, nil, test.limits)
+			if err == nil || client != nil || !strings.Contains(err.Error(), "must be positive") {
+				t.Fatalf("newArtifactClient(%+v) = %#v, %v", test.limits, client, err)
+			}
+		})
+	}
+}
+
+func TestArtifactClientEnforcesConfiguredTransferLimitsByDirection(t *testing.T) {
+	t.Parallel()
+
+	var calls atomic.Int32
+	client, err := newArtifactClient(
+		"https://artifact.example",
+		&http.Client{Transport: artifactLimitRoundTripperFunc(func(*http.Request) (*http.Response, error) {
+			calls.Add(1)
+			return nil, fmt.Errorf("unexpected artifact transport call")
+		})},
+		nil,
+		artifactClientLimits{MaxDownloadBytes: 6, MaxUploadBytes: 4},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	data := []byte("12345")
+	upload := transportReference(data, artifactcap.MediaTypeWorkspaceDelta)
+	if _, err := client.UploadAuthorized(context.Background(), upload, testArtifactAuthorization(), data); err == nil || !strings.Contains(err.Error(), "exceeds transport limit") {
+		t.Fatalf("oversized upload error = %v", err)
+	}
+	download := upload
+	download.MediaType = artifactcap.MediaTypeWorkspaceTar
+	if err := client.DownloadAuthorized(context.Background(), download, testArtifactAuthorization(), io.Discard); err == nil || !strings.Contains(err.Error(), "transport failed") {
+		t.Fatalf("download inside independent limit error = %v", err)
+	}
+	if calls.Load() != 1 {
+		t.Fatalf("artifact transport calls = %d, want 1 download call", calls.Load())
+	}
+}
+
+func repeatedByteArtifactReference(t *testing.T, size int64, value byte, mediaType string) harnessv2.ArtifactReference {
+	t.Helper()
+	hash := sha256.New()
+	if _, err := io.CopyN(hash, repeatedByteReader(value), size); err != nil {
+		t.Fatal(err)
+	}
+	digest := "sha256:" + hex.EncodeToString(hash.Sum(nil))
+	artifactID, err := artifactcap.ArtifactIDForDigest(digest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return harnessv2.ArtifactReference{
+		ArtifactID: harnessv2.ArtifactID(artifactID),
+		Digest:     digest,
+		SizeBytes:  size,
+		MediaType:  mediaType,
+	}
+}
+
+func artifactReferenceWithSize(size int64, mediaType string) harnessv2.ArtifactReference {
+	digest := artifactcap.DigestBytes(fmt.Appendf(nil, "artifact-size-%d-%s", size, mediaType))
+	artifactID, _ := artifactcap.ArtifactIDForDigest(digest)
+	return harnessv2.ArtifactReference{
+		ArtifactID: harnessv2.ArtifactID(artifactID),
+		Digest:     digest,
+		SizeBytes:  size,
+		MediaType:  mediaType,
+	}
+}
+
+func testArtifactAuthorization() artifactcap.Authorization {
+	return artifactcap.Authorization{
+		Capability:    "test-operation-capability",
+		RequestDigest: artifactcap.DigestBytes([]byte("test-request-binding")),
+	}
+}
diff --git a/workers/acp/supervisor/artifact_client_materializer.go b/workers/acp/supervisor/artifact_client_materializer.go
new file mode 100644
index 000000000..4b934cf48
--- /dev/null
+++ b/workers/acp/supervisor/artifact_client_materializer.go
@@ -0,0 +1,420 @@
+package supervisor
+
+import (
+	"archive/tar"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"github.com/orka-agents/orka/internal/artifactcap"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/safesymlink"
+)
+
+type WorkspaceMaterializerLimits struct {
+	MaxEntries       int
+	MaxExpandedBytes int64
+	MaxPathBytes     int
+}
+
+type remoteWorkspaceMaterializer struct {
+	client *ArtifactClient
+	limits WorkspaceMaterializerLimits
+}
+
+func NewRemoteWorkspaceMaterializer(client *ArtifactClient, limits WorkspaceMaterializerLimits) (WorkspaceMaterializer, error) {
+	if client == nil {
+		return nil, fmt.Errorf("artifact client is required")
+	}
+	if limits.MaxEntries == 0 {
+		limits.MaxEntries = 100_000
+	}
+	if limits.MaxExpandedBytes == 0 {
+		limits.MaxExpandedBytes = 1 << 30
+	}
+	if limits.MaxPathBytes == 0 {
+		limits.MaxPathBytes = 4096
+	}
+	if limits.MaxEntries < 1 || limits.MaxExpandedBytes < 1 || limits.MaxPathBytes < 1 {
+		return nil, fmt.Errorf("workspace materializer limits must be positive")
+	}
+	return &remoteWorkspaceMaterializer{client: client, limits: limits}, nil
+}
+
+func (m *remoteWorkspaceMaterializer) Materialize(ctx context.Context, request harnessv2.CreateRuntimeSessionRequest, destination string) error {
+	workspace := request.Workspace
+	if err := workspace.Validate(); err != nil {
+		return fmt.Errorf("workspace specification: %w", err)
+	}
+	if err := requireEmptyDestination(destination); err != nil {
+		return err
+	}
+	if workspace.Baseline.Artifact == nil {
+		return nil
+	}
+	reference := *workspace.Baseline.Artifact
+	if reference.MediaType != artifactcap.MediaTypeWorkspaceTar {
+		return fmt.Errorf("workspace artifact media type is unsupported")
+	}
+	parent := filepath.Dir(destination)
+	archive, err := os.CreateTemp(parent, ".workspace-artifact-*.tmp")
+	if err != nil {
+		return fmt.Errorf("create workspace artifact temp file: %w", err)
+	}
+	archivePath := archive.Name()
+	defer os.Remove(archivePath) //nolint:errcheck
+	if err := archive.Chmod(0o600); err != nil {
+		_ = archive.Close()
+		return fmt.Errorf("secure workspace artifact temp file: %w", err)
+	}
+	if request.WorkspaceArtifactAuthorization == nil {
+		_ = archive.Close()
+		return fmt.Errorf("workspace artifact authorization is required")
+	}
+	authorization := artifactcap.Authorization{Capability: request.WorkspaceArtifactAuthorization.Capability, RequestDigest: request.WorkspaceArtifactAuthorization.RequestDigest}
+	if err := m.client.DownloadAuthorized(ctx, reference, authorization, archive); err != nil {
+		_ = archive.Close()
+		return err
+	}
+	if err := archive.Sync(); err != nil {
+		_ = archive.Close()
+		return fmt.Errorf("sync workspace artifact temp file: %w", err)
+	}
+	if _, err := archive.Seek(0, io.SeekStart); err != nil {
+		_ = archive.Close()
+		return fmt.Errorf("rewind workspace artifact: %w", err)
+	}
+	stage, err := os.MkdirTemp(parent, ".workspace-materialize-*")
+	if err != nil {
+		_ = archive.Close()
+		return fmt.Errorf("create workspace materialization directory: %w", err)
+	}
+	defer os.RemoveAll(stage) //nolint:errcheck
+	if err := os.Chmod(stage, 0o700); err != nil {
+		_ = archive.Close()
+		return err
+	}
+	if err := m.extract(archive, stage); err != nil {
+		_ = archive.Close()
+		return err
+	}
+	var trailing [1]byte
+	if count, trailingErr := archive.Read(trailing[:]); count != 0 || !errors.Is(trailingErr, io.EOF) {
+		_ = archive.Close()
+		return fmt.Errorf("workspace artifact contains trailing data")
+	}
+	if err := archive.Close(); err != nil {
+		return fmt.Errorf("close workspace artifact temp file: %w", err)
+	}
+	installRoot := stage
+	if workspace.RelativeRoot != "" && workspace.RelativeRoot != "." {
+		installRoot, err = materializedWorkspaceRelativeRoot(stage, workspace.RelativeRoot)
+		if err != nil {
+			return err
+		}
+		if err := validateMaterializedWorkspaceBoundary(installRoot, m.limits); err != nil {
+			return err
+		}
+	}
+	if err := os.Remove(destination); err != nil {
+		return fmt.Errorf("replace empty workspace destination: %w", err)
+	}
+	if err := os.Rename(installRoot, destination); err != nil {
+		return fmt.Errorf("atomically install materialized workspace: %w", err)
+	}
+	return syncMaterializerDirectory(parent)
+}
+
+func materializedWorkspaceRelativeRoot(stage, relativeRoot string) (string, error) {
+	current := stage
+	for component := range strings.SplitSeq(filepath.FromSlash(relativeRoot), string(os.PathSeparator)) {
+		if component == "" || component == "." || component == ".." {
+			return "", fmt.Errorf("workspace relative root is invalid")
+		}
+		current = filepath.Join(current, component)
+		info, err := os.Lstat(current)
+		if err != nil || info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
+			return "", fmt.Errorf("workspace relative root component is not a materialized directory")
+		}
+	}
+	return current, nil
+}
+
+func (m *remoteWorkspaceMaterializer) extract(reader io.Reader, root string) error {
+	tarReader := tar.NewReader(reader)
+	seen := make(map[string]struct{})
+	links := make(map[string]string)
+	entries := 0
+	var expanded int64
+	for {
+		header, err := tarReader.Next()
+		if errors.Is(err, io.EOF) {
+			break
+		}
+		if err != nil {
+			return fmt.Errorf("read workspace artifact: %w", err)
+		}
+		entries++
+		if entries > m.limits.MaxEntries {
+			return fmt.Errorf("workspace artifact exceeds entry limit")
+		}
+		name, err := validateMaterializedPath(header.Name, m.limits.MaxPathBytes)
+		if err != nil {
+			return err
+		}
+		if _, duplicate := seen[name]; duplicate {
+			return fmt.Errorf("workspace artifact contains duplicate path")
+		}
+		seen[name] = struct{}{}
+		target := filepath.Join(root, filepath.FromSlash(name))
+		if err := ensureWithinMaterializationRoot(root, target); err != nil {
+			return err
+		}
+		switch header.Typeflag {
+		case tar.TypeDir:
+			if header.Size != 0 || header.Linkname != "" {
+				return fmt.Errorf("workspace directory entry has invalid content")
+			}
+			if err := mkdirMaterialized(root, target); err != nil {
+				return err
+			}
+		case tar.TypeReg:
+			if header.Linkname != "" || header.Size < 0 || header.Size > m.limits.MaxExpandedBytes-expanded {
+				return fmt.Errorf("workspace artifact exceeds expanded size limit or has invalid file metadata")
+			}
+			expanded += header.Size
+			if err := writeMaterializedFile(root, target, header.Size, header.FileInfo().Mode().Perm()&0o111 != 0, tarReader); err != nil {
+				return err
+			}
+		case tar.TypeSymlink:
+			if header.Size != 0 || int64(len(header.Linkname)) > m.limits.MaxExpandedBytes-expanded {
+				return fmt.Errorf("workspace symlink entry has invalid size")
+			}
+			if _, err := safesymlink.Resolve(name, header.Linkname, m.limits.MaxPathBytes, m.limits.MaxPathBytes); err != nil {
+				return fmt.Errorf("workspace artifact contains unsafe symlink: %w", err)
+			}
+			expanded += int64(len(header.Linkname))
+			links[name] = header.Linkname
+		default:
+			return fmt.Errorf("workspace artifact contains unsupported hardlink or special entry")
+		}
+	}
+	if err := safesymlink.ValidateGraph(seen, links, m.limits.MaxPathBytes, m.limits.MaxPathBytes); err != nil {
+		return fmt.Errorf("workspace artifact contains unsafe symlink graph: %w", err)
+	}
+	return writeMaterializedSymlinks(root, links)
+}
+
+func validateMaterializedWorkspaceBoundary(root string, limits WorkspaceMaterializerLimits) error {
+	paths := make(map[string]struct{})
+	links := make(map[string]string)
+	err := filepath.WalkDir(root, func(current string, entry os.DirEntry, walkErr error) error {
+		if walkErr != nil {
+			return walkErr
+		}
+		if current == root {
+			return nil
+		}
+		relative, err := filepath.Rel(root, current)
+		if err != nil {
+			return err
+		}
+		relative = filepath.ToSlash(relative)
+		if _, err := validateMaterializedPath(relative, limits.MaxPathBytes); err != nil {
+			return err
+		}
+		paths[relative] = struct{}{}
+		if entry.Type()&os.ModeSymlink == 0 {
+			return nil
+		}
+		target, err := os.Readlink(current)
+		if err != nil {
+			return err
+		}
+		links[relative] = target
+		return nil
+	})
+	if err != nil {
+		return fmt.Errorf("validate workspace relative root: %w", err)
+	}
+	if err := safesymlink.ValidateGraph(paths, links, limits.MaxPathBytes, limits.MaxPathBytes); err != nil {
+		return fmt.Errorf("workspace relative root contains a symlink outside its boundary: %w", err)
+	}
+	return nil
+}
+
+func requireEmptyDestination(destination string) error {
+	if destination == "" || !filepath.IsAbs(destination) {
+		return fmt.Errorf("workspace destination must be absolute")
+	}
+	info, err := os.Lstat(destination)
+	if err != nil {
+		return fmt.Errorf("inspect workspace destination: %w", err)
+	}
+	if info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
+		return fmt.Errorf("workspace destination is not a no-follow directory")
+	}
+	directory, err := os.Open(destination)
+	if err != nil {
+		return err
+	}
+	defer directory.Close() //nolint:errcheck
+	if _, err := directory.Readdirnames(1); !errors.Is(err, io.EOF) {
+		if err == nil {
+			return fmt.Errorf("workspace destination must be empty")
+		}
+		return err
+	}
+	return nil
+}
+
+func validateMaterializedPath(value string, maxBytes int) (string, error) {
+	if value == "" || len(value) > maxBytes || strings.Contains(value, "\\") || strings.HasPrefix(value, "/") || strings.ContainsRune(value, 0) {
+		return "", fmt.Errorf("workspace artifact contains unsafe path")
+	}
+	for _, char := range value {
+		if char < 0x20 || char == 0x7f {
+			return "", fmt.Errorf("workspace artifact contains unsafe path")
+		}
+	}
+	cleaned := path.Clean(value)
+	if cleaned != value || cleaned == "." || cleaned == ".." || strings.HasPrefix(cleaned, "../") {
+		return "", fmt.Errorf("workspace artifact contains unsafe path")
+	}
+	for component := range strings.SplitSeq(cleaned, "/") {
+		if component == "" || component == "." || component == ".." {
+			return "", fmt.Errorf("workspace artifact contains unsafe path")
+		}
+	}
+	return cleaned, nil
+}
+
+func ensureWithinMaterializationRoot(root, target string) error {
+	relative, err := filepath.Rel(root, target)
+	if err != nil || relative == "." || relative == ".." || filepath.IsAbs(relative) || strings.HasPrefix(filepath.ToSlash(relative), "../") {
+		return fmt.Errorf("workspace artifact path escapes materialization root")
+	}
+	return nil
+}
+
+func mkdirMaterialized(root, target string) error {
+	if filepath.Clean(target) == filepath.Clean(root) {
+		return nil
+	}
+	if err := ensureWithinMaterializationRoot(root, target); err != nil {
+		return err
+	}
+	if info, err := os.Lstat(target); err == nil {
+		if info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
+			return fmt.Errorf("workspace artifact path collides with non-directory")
+		}
+		return nil
+	} else if !os.IsNotExist(err) {
+		return err
+	}
+	if err := os.MkdirAll(target, 0o755); err != nil {
+		return err
+	}
+	return verifyMaterializedParents(root, target)
+}
+
+func writeMaterializedFile(root, target string, size int64, executable bool, reader io.Reader) error {
+	if err := mkdirMaterialized(root, filepath.Dir(target)); err != nil {
+		return err
+	}
+	if err := verifyMaterializedParents(root, filepath.Dir(target)); err != nil {
+		return err
+	}
+	mode := os.FileMode(0o644)
+	if executable {
+		mode = 0o755
+	}
+	file, err := openMaterializedFileNoFollow(target, mode)
+	if err != nil {
+		return fmt.Errorf("create materialized workspace file: %w", err)
+	}
+	written, copyErr := io.CopyN(file, reader, size)
+	if copyErr == nil && written != size {
+		copyErr = io.ErrUnexpectedEOF
+	}
+	if copyErr == nil {
+		copyErr = file.Sync()
+	}
+	closeErr := file.Close()
+	if copyErr == nil {
+		copyErr = closeErr
+	}
+	if copyErr != nil {
+		_ = os.Remove(target)
+		return fmt.Errorf("write materialized workspace file: %w", copyErr)
+	}
+	return nil
+}
+
+func writeMaterializedSymlinks(root string, links map[string]string) error {
+	paths := make([]string, 0, len(links))
+	for linkPath := range links {
+		paths = append(paths, linkPath)
+	}
+	sort.Strings(paths)
+	for _, linkPath := range paths {
+		targetPath := filepath.Join(root, filepath.FromSlash(linkPath))
+		if err := mkdirMaterialized(root, filepath.Dir(targetPath)); err != nil {
+			return err
+		}
+		if err := verifyMaterializedParents(root, filepath.Dir(targetPath)); err != nil {
+			return err
+		}
+		if _, err := os.Lstat(targetPath); err == nil {
+			return fmt.Errorf("workspace symlink path collides with an existing entry")
+		} else if !os.IsNotExist(err) {
+			return err
+		}
+		if err := os.Symlink(links[linkPath], targetPath); err != nil {
+			return fmt.Errorf("create materialized workspace symlink: %w", err)
+		}
+		info, err := os.Lstat(targetPath)
+		if err != nil || info.Mode()&os.ModeSymlink == 0 {
+			_ = os.Remove(targetPath)
+			return fmt.Errorf("revalidate materialized workspace symlink")
+		}
+		if err := syncMaterializerDirectory(filepath.Dir(targetPath)); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func verifyMaterializedParents(root, target string) error {
+	relative, err := filepath.Rel(root, target)
+	if err != nil || relative == ".." || filepath.IsAbs(relative) || strings.HasPrefix(filepath.ToSlash(relative), "../") {
+		return fmt.Errorf("workspace materialization path escapes root")
+	}
+	current := root
+	for component := range strings.SplitSeq(filepath.ToSlash(relative), "/") {
+		if component == "" || component == "." {
+			continue
+		}
+		current = filepath.Join(current, component)
+		info, err := os.Lstat(current)
+		if err != nil || info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
+			return fmt.Errorf("workspace materialization encountered unsafe parent")
+		}
+	}
+	return nil
+}
+
+func syncMaterializerDirectory(dirPath string) error {
+	directory, err := os.Open(dirPath)
+	if err != nil {
+		return err
+	}
+	defer directory.Close() //nolint:errcheck
+	return directory.Sync()
+}
diff --git a/workers/acp/supervisor/artifact_client_nofollow_other.go b/workers/acp/supervisor/artifact_client_nofollow_other.go
new file mode 100644
index 000000000..7b9c47eee
--- /dev/null
+++ b/workers/acp/supervisor/artifact_client_nofollow_other.go
@@ -0,0 +1,15 @@
+//go:build !darwin && !linux
+
+package supervisor
+
+import (
+	"fmt"
+	"os"
+)
+
+func openMaterializedFileNoFollow(path string, mode os.FileMode) (*os.File, error) {
+	if info, err := os.Lstat(path); err == nil && info.Mode()&os.ModeSymlink != 0 {
+		return nil, fmt.Errorf("materialized workspace target is a symlink")
+	}
+	return os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, mode)
+}
diff --git a/workers/acp/supervisor/artifact_client_nofollow_unix.go b/workers/acp/supervisor/artifact_client_nofollow_unix.go
new file mode 100644
index 000000000..91736c70c
--- /dev/null
+++ b/workers/acp/supervisor/artifact_client_nofollow_unix.go
@@ -0,0 +1,23 @@
+//go:build darwin || linux
+
+package supervisor
+
+import (
+	"fmt"
+	"os"
+
+	"golang.org/x/sys/unix"
+)
+
+func openMaterializedFileNoFollow(path string, mode os.FileMode) (*os.File, error) {
+	fd, err := unix.Open(path, unix.O_WRONLY|unix.O_CREAT|unix.O_EXCL|unix.O_CLOEXEC|unix.O_NOFOLLOW, uint32(mode.Perm()))
+	if err != nil {
+		return nil, err
+	}
+	file := os.NewFile(uintptr(fd), path)
+	if file == nil {
+		_ = unix.Close(fd)
+		return nil, fmt.Errorf("create materialized workspace file handle")
+	}
+	return file, nil
+}
diff --git a/workers/acp/supervisor/artifact_client_test.go b/workers/acp/supervisor/artifact_client_test.go
new file mode 100644
index 000000000..a6116f681
--- /dev/null
+++ b/workers/acp/supervisor/artifact_client_test.go
@@ -0,0 +1,465 @@
+package supervisor
+
+import (
+	"archive/tar"
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/orka-agents/orka/internal/artifactcap"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+const testWorkspaceRelativeRoot = "services/app"
+
+func TestArtifactClientUploadAndDownload(t *testing.T) {
+	t.Parallel()
+	token := "opaque-operation-capability-never-log"
+	authorization := artifactcap.Authorization{Capability: token, RequestDigest: artifactcap.DigestBytes([]byte("request-binding"))}
+	uploadData := []byte("workspace delta")
+	uploadReference := transportReference(uploadData, artifactcap.MediaTypeWorkspaceDelta)
+	downloadData := []byte("workspace baseline")
+	downloadReference := transportReference(downloadData, artifactcap.MediaTypeWorkspaceTar)
+	var uploadCalls atomic.Int32
+	var downloadCalls atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		if request.Header.Get(artifactcap.CapabilityHeader) != token || request.Header.Get(artifactcap.RequestDigestHeader) != authorization.RequestDigest {
+			t.Error("artifact authorization headers were not preserved")
+		}
+		switch request.Method {
+		case http.MethodPut:
+			uploadCalls.Add(1)
+			if request.URL.Path != mustObjectPath(t, uploadReference.Digest) || request.ContentLength != uploadReference.SizeBytes ||
+				request.Header.Get("Content-Type") != uploadReference.MediaType {
+				t.Errorf("unexpected upload request: %s %#v", request.URL.Path, request.Header)
+			}
+			body, err := io.ReadAll(request.Body)
+			if err != nil {
+				t.Error(err)
+			}
+			if !bytes.Equal(body, uploadData) {
+				t.Errorf("upload body = %q", body)
+			}
+			writer.Header().Set("Content-Type", "application/json")
+			writer.WriteHeader(http.StatusCreated)
+			_ = json.NewEncoder(writer).Encode(map[string]any{
+				"artifactID": uploadReference.ArtifactID,
+				"digest":     uploadReference.Digest,
+				"sizeBytes":  uploadReference.SizeBytes,
+				"mediaType":  uploadReference.MediaType,
+				"createdAt":  time.Now().UTC(),
+			})
+		case http.MethodGet:
+			downloadCalls.Add(1)
+			if request.URL.Path != mustObjectPath(t, downloadReference.Digest) || request.Header.Get("Accept") != downloadReference.MediaType {
+				t.Errorf("unexpected download request: %s %#v", request.URL.Path, request.Header)
+			}
+			writer.Header().Set("Content-Type", downloadReference.MediaType)
+			writer.Header().Set(artifactcap.ObjectDigestHeader, downloadReference.Digest)
+			writer.Header().Set("Content-Length", strconv.Itoa(len(downloadData)))
+			writer.WriteHeader(http.StatusOK)
+			_, _ = writer.Write(downloadData)
+		default:
+			writer.WriteHeader(http.StatusMethodNotAllowed)
+		}
+	}))
+	defer server.Close()
+
+	var sawDelta atomic.Bool
+	provider := ArtifactAuthorizationProviderFunc(func(_ context.Context, request ArtifactAuthorizationRequest) (artifactcap.Authorization, error) {
+		if request.Operation == artifactcap.OperationUpload && request.WorkspaceDelta != nil {
+			sawDelta.Store(true)
+		}
+		return authorization, nil
+	})
+	client, err := NewArtifactClient(server.URL, server.Client(), provider)
+	if err != nil {
+		t.Fatal(err)
+	}
+	delta := &harnessv2.CreateWorkspaceDeltaRequest{Limits: harnessv2.WorkspaceDeltaLimits{MaxBytes: 1024, MaxEntries: 10}}
+	stored, err := client.Upload(context.Background(), uploadReference, uploadData, delta)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if stored != uploadReference || !sawDelta.Load() || uploadCalls.Load() != 1 {
+		t.Fatalf("stored=%#v sawDelta=%v calls=%d", stored, sawDelta.Load(), uploadCalls.Load())
+	}
+	var downloaded bytes.Buffer
+	if err := client.Download(context.Background(), downloadReference, &downloaded); err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(downloaded.Bytes(), downloadData) || downloadCalls.Load() != 1 {
+		t.Fatalf("download=%q calls=%d", downloaded.Bytes(), downloadCalls.Load())
+	}
+}
+
+func TestArtifactClientRejectsDisconnectMismatchRedirectAndRedacts(t *testing.T) {
+	t.Parallel()
+	data := []byte("expected artifact")
+	reference := transportReference(data, artifactcap.MediaTypeWorkspaceTar)
+	token := "operation-capability-sensitive-value"
+	authorization := artifactcap.Authorization{Capability: token, RequestDigest: artifactcap.DigestBytes([]byte("request-binding"))}
+	provider := ArtifactAuthorizationProviderFunc(func(context.Context, ArtifactAuthorizationRequest) (artifactcap.Authorization, error) {
+		return authorization, nil
+	})
+	tests := []struct {
+		name    string
+		handler http.Handler
+	}{
+		{
+			name: "disconnect",
+			handler: http.HandlerFunc(func(writer http.ResponseWriter, _ *http.Request) {
+				writer.Header().Set("Content-Type", reference.MediaType)
+				writer.Header().Set(artifactcap.ObjectDigestHeader, reference.Digest)
+				writer.Header().Set("Content-Length", strconv.FormatInt(reference.SizeBytes, 10))
+				writer.WriteHeader(http.StatusOK)
+				_, _ = writer.Write(data[:4])
+			}),
+		},
+		{
+			name: "digest mismatch",
+			handler: http.HandlerFunc(func(writer http.ResponseWriter, _ *http.Request) {
+				writer.Header().Set("Content-Type", reference.MediaType)
+				writer.Header().Set(artifactcap.ObjectDigestHeader, reference.Digest)
+				writer.Header().Set("Content-Length", strconv.FormatInt(reference.SizeBytes, 10))
+				writer.WriteHeader(http.StatusOK)
+				_, _ = writer.Write(bytes.Repeat([]byte{'x'}, int(reference.SizeBytes)))
+			}),
+		},
+		{
+			name: "authorization response redaction",
+			handler: http.HandlerFunc(func(writer http.ResponseWriter, _ *http.Request) {
+				writer.WriteHeader(http.StatusForbidden)
+				_, _ = writer.Write([]byte(token))
+			}),
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			server := httptest.NewServer(test.handler)
+			defer server.Close()
+			client, err := NewArtifactClient(server.URL, server.Client(), provider)
+			if err != nil {
+				t.Fatal(err)
+			}
+			var destination bytes.Buffer
+			err = client.Download(context.Background(), reference, &destination)
+			if err == nil {
+				t.Fatal("expected download failure")
+			}
+			if strings.Contains(err.Error(), token) {
+				t.Fatalf("client error disclosed capability: %q", err)
+			}
+		})
+	}
+
+	var followed atomic.Bool
+	target := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { followed.Store(true) }))
+	defer target.Close()
+	redirect := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		http.Redirect(writer, request, target.URL, http.StatusTemporaryRedirect)
+	}))
+	defer redirect.Close()
+	client, err := NewArtifactClient(redirect.URL, redirect.Client(), provider)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := client.Download(context.Background(), reference, io.Discard); err == nil {
+		t.Fatal("expected redirect refusal")
+	}
+	if followed.Load() {
+		t.Fatal("artifact client followed redirect and risked capability disclosure")
+	}
+}
+
+func TestRemoteWorkspaceMaterializerRejectsTraversalSymlinkAndUnsafeDestination(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name    string
+		archive []byte
+	}{
+		{"traversal", tarBytes(t, tarEntry{name: "../escape", body: []byte("bad")})},
+		{"escaping-symlink", tarBytes(t, tarEntry{name: "link", typeFlag: tar.TypeSymlink, linkName: "../../outside"})},
+		{"absolute-symlink", tarBytes(t, tarEntry{name: "link", typeFlag: tar.TypeSymlink, linkName: "/etc/passwd"})},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			materializer, workspace := materializerForArchive(t, test.archive)
+			parent := t.TempDir()
+			destination := filepath.Join(parent, "workspace")
+			if err := os.Mkdir(destination, 0o700); err != nil {
+				t.Fatal(err)
+			}
+			if err := materializer.Materialize(context.Background(), workspace, destination); err == nil {
+				t.Fatal("expected unsafe archive rejection")
+			}
+			if _, err := os.Stat(filepath.Join(parent, "escape")); !os.IsNotExist(err) {
+				t.Fatalf("archive escaped workspace: %v", err)
+			}
+		})
+	}
+
+	goodArchive := tarBytes(t, tarEntry{name: "README.md", body: []byte("safe")})
+	materializer, workspace := materializerForArchive(t, goodArchive)
+	parent := t.TempDir()
+	outside := t.TempDir()
+	destination := filepath.Join(parent, "workspace")
+	if err := os.Symlink(outside, destination); err != nil {
+		t.Fatal(err)
+	}
+	if err := materializer.Materialize(context.Background(), workspace, destination); err == nil {
+		t.Fatal("expected symlink destination rejection")
+	}
+	entries, err := os.ReadDir(outside)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(entries) != 0 {
+		t.Fatalf("materializer followed destination symlink: %v", entries)
+	}
+}
+
+func TestRemoteWorkspaceMaterializerEnforcesRelativeRootBoundary(t *testing.T) {
+	t.Parallel()
+	archive := tarBytes(t,
+		tarEntry{name: "services/app/main.go", body: []byte("package main\n")},
+		tarEntry{name: "services/shared/secret.txt", body: []byte("outside\n")},
+		tarEntry{name: "README.md", body: []byte("root\n")},
+	)
+	materializer, workspace := materializerForArchive(t, archive)
+	workspace.Workspace.RelativeRoot = testWorkspaceRelativeRoot
+	destination := filepath.Join(t.TempDir(), "workspace")
+	if err := os.Mkdir(destination, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := materializer.Materialize(context.Background(), workspace, destination); err != nil {
+		t.Fatal(err)
+	}
+	content, err := os.ReadFile(filepath.Join(destination, "main.go"))
+	if err != nil || string(content) != "package main\n" {
+		t.Fatalf("relative-root content = %q, %v", content, err)
+	}
+	for _, outside := range []string{"README.md", "services", "secret.txt"} {
+		if _, err := os.Lstat(filepath.Join(destination, outside)); !os.IsNotExist(err) {
+			t.Fatalf("path outside relative root %q was exposed: %v", outside, err)
+		}
+	}
+}
+
+func TestRemoteWorkspaceMaterializerRejectsRelativeRootSymlinkEscape(t *testing.T) {
+	t.Parallel()
+	archive := tarBytes(t,
+		tarEntry{name: "app/main.go", body: []byte("package main\n")},
+		tarEntry{name: "outside.txt", body: []byte("outside\n")},
+		tarEntry{name: "app/outside", typeFlag: tar.TypeSymlink, linkName: "../outside.txt"},
+	)
+	materializer, workspace := materializerForArchive(t, archive)
+	workspace.Workspace.RelativeRoot = "app"
+	destination := filepath.Join(t.TempDir(), "workspace")
+	if err := os.Mkdir(destination, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := materializer.Materialize(context.Background(), workspace, destination); err == nil || !strings.Contains(err.Error(), "outside its boundary") {
+		t.Fatalf("relative-root symlink escape error = %v", err)
+	}
+}
+
+func TestRemoteWorkspaceMaterializerRejectsSymlinkInRelativeRootPath(t *testing.T) {
+	t.Parallel()
+	archive := tarBytes(t,
+		tarEntry{name: "app", typeFlag: tar.TypeDir},
+		tarEntry{name: "private", typeFlag: tar.TypeDir},
+		tarEntry{name: "private/subdir", typeFlag: tar.TypeDir},
+		tarEntry{name: "private/subdir/secret.txt", body: []byte("outside\n")},
+		tarEntry{name: "app/link", typeFlag: tar.TypeSymlink, linkName: "../private"},
+	)
+	materializer, workspace := materializerForArchive(t, archive)
+	workspace.Workspace.RelativeRoot = "app/link/subdir"
+	destination := filepath.Join(t.TempDir(), "workspace")
+	if err := os.Mkdir(destination, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := materializer.Materialize(context.Background(), workspace, destination); err == nil ||
+		!strings.Contains(err.Error(), "relative root component") {
+		t.Fatalf("intermediate relative-root symlink error = %v", err)
+	}
+}
+
+func TestRemoteWorkspaceMaterializerAndUploader(t *testing.T) {
+	t.Parallel()
+	archive := tarBytes(t,
+		tarEntry{name: ".agents", typeFlag: tar.TypeDir},
+		tarEntry{name: ".agents/skills", typeFlag: tar.TypeDir},
+		tarEntry{name: ".agents/skills/readme", body: []byte("skill\n")},
+		tarEntry{name: ".claude", typeFlag: tar.TypeDir},
+		tarEntry{name: ".claude/skills", typeFlag: tar.TypeDir},
+		tarEntry{name: ".claude/skills/readme", typeFlag: tar.TypeSymlink, linkName: "../../.agents/skills/readme"},
+		tarEntry{name: "src", typeFlag: tar.TypeDir},
+		tarEntry{name: "src/main.go", body: []byte("package main\n")},
+	)
+	materializer, workspace := materializerForArchive(t, archive)
+	destination := filepath.Join(t.TempDir(), "workspace")
+	if err := os.Mkdir(destination, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := materializer.Materialize(context.Background(), workspace, destination); err != nil {
+		t.Fatal(err)
+	}
+	content, err := os.ReadFile(filepath.Join(destination, "src", "main.go"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(content) != "package main\n" {
+		t.Fatalf("materialized content = %q", content)
+	}
+	linkPath := filepath.Join(destination, ".claude", "skills", "readme")
+	info, err := os.Lstat(linkPath)
+	if err != nil || info.Mode()&os.ModeSymlink == 0 {
+		t.Fatalf("materialized safe symlink info = %#v, %v", info, err)
+	}
+	target, err := os.Readlink(linkPath)
+	if err != nil || target != "../../.agents/skills/readme" {
+		t.Fatalf("materialized safe symlink target = %q, %v", target, err)
+	}
+
+	deltaData := []byte("delta archive")
+	deltaDigest := artifactcap.DigestBytes(deltaData)
+	var uploaded bytes.Buffer
+	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		_, _ = io.Copy(&uploaded, request.Body)
+		artifactID, _ := artifactcap.ArtifactIDForDigest(deltaDigest)
+		writer.WriteHeader(http.StatusCreated)
+		_ = json.NewEncoder(writer).Encode(map[string]any{
+			"artifactID": artifactID, "digest": deltaDigest, "sizeBytes": len(deltaData),
+			"mediaType": artifactcap.MediaTypeWorkspaceDelta, "createdAt": time.Now().UTC(),
+		})
+	}))
+	defer server.Close()
+	provider := ArtifactAuthorizationProviderFunc(func(_ context.Context, request ArtifactAuthorizationRequest) (artifactcap.Authorization, error) {
+		if request.WorkspaceDelta == nil {
+			return artifactcap.Authorization{}, fmt.Errorf("missing workspace delta context")
+		}
+		return artifactcap.Authorization{Capability: "token", RequestDigest: artifactcap.DigestBytes([]byte("binding"))}, nil
+	})
+	client, err := NewArtifactClient(server.URL, server.Client(), provider)
+	if err != nil {
+		t.Fatal(err)
+	}
+	uploader, err := NewRemoteArtifactUploader(client)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := harnessv2.CreateWorkspaceDeltaRequest{
+		Limits: harnessv2.WorkspaceDeltaLimits{MaxBytes: 1024, MaxEntries: 10},
+	}
+	reference, err := uploader.UploadWorkspaceDelta(context.Background(), request, deltaData, deltaDigest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if reference.Digest != deltaDigest || !bytes.Equal(uploaded.Bytes(), deltaData) {
+		t.Fatalf("reference=%#v uploaded=%q", reference, uploaded.Bytes())
+	}
+}
+
+func materializerForArchive(t *testing.T, archive []byte) (WorkspaceMaterializer, harnessv2.CreateRuntimeSessionRequest) {
+	t.Helper()
+	reference := transportReference(archive, artifactcap.MediaTypeWorkspaceTar)
+	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, _ *http.Request) {
+		writer.Header().Set("Content-Type", reference.MediaType)
+		writer.Header().Set(artifactcap.ObjectDigestHeader, reference.Digest)
+		writer.Header().Set("Content-Length", strconv.Itoa(len(archive)))
+		writer.WriteHeader(http.StatusOK)
+		_, _ = writer.Write(archive)
+	}))
+	t.Cleanup(server.Close)
+	provider := ArtifactAuthorizationProviderFunc(func(context.Context, ArtifactAuthorizationRequest) (artifactcap.Authorization, error) {
+		return artifactcap.Authorization{Capability: "token", RequestDigest: artifactcap.DigestBytes([]byte("binding"))}, nil
+	})
+	client, err := NewArtifactClient(server.URL, server.Client(), provider)
+	if err != nil {
+		t.Fatal(err)
+	}
+	materializer, err := NewRemoteWorkspaceMaterializer(client, WorkspaceMaterializerLimits{MaxEntries: 100, MaxExpandedBytes: 1 << 20})
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := harnessv2.CreateRuntimeSessionRequest{
+		Workspace: harnessv2.WorkspaceSpec{
+			Intent: harnessv2.WorkspaceIntentRead,
+			Baseline: harnessv2.WorkspaceBaseline{
+				RepositoryIdentity: "github.com/example/repo", Revision: "0123456789abcdef",
+				TreeDigest: artifactcap.DigestBytes([]byte("tree")), Artifact: &reference,
+			},
+		},
+		WorkspaceArtifactAuthorization: &harnessv2.ArtifactAuthorization{Capability: "token", RequestDigest: artifactcap.DigestBytes([]byte("binding"))},
+	}
+	return materializer, request
+}
+
+type tarEntry struct {
+	name     string
+	body     []byte
+	typeFlag byte
+	linkName string
+}
+
+func tarBytes(t *testing.T, entries ...tarEntry) []byte {
+	t.Helper()
+	var buffer bytes.Buffer
+	writer := tar.NewWriter(&buffer)
+	for _, entry := range entries {
+		typeFlag := entry.typeFlag
+		if typeFlag == 0 {
+			typeFlag = tar.TypeReg
+		}
+		size := int64(len(entry.body))
+		if typeFlag != tar.TypeReg {
+			size = 0
+		}
+		header := &tar.Header{Name: entry.name, Typeflag: typeFlag, Size: size, Mode: 0o644, Linkname: entry.linkName}
+		if typeFlag == tar.TypeDir {
+			header.Mode = 0o755
+		}
+		if err := writer.WriteHeader(header); err != nil {
+			t.Fatal(err)
+		}
+		if size > 0 {
+			if _, err := writer.Write(entry.body); err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
+	if err := writer.Close(); err != nil {
+		t.Fatal(err)
+	}
+	return buffer.Bytes()
+}
+
+func transportReference(data []byte, mediaType string) harnessv2.ArtifactReference {
+	digest := artifactcap.DigestBytes(data)
+	artifactID, _ := artifactcap.ArtifactIDForDigest(digest)
+	return harnessv2.ArtifactReference{
+		ArtifactID: harnessv2.ArtifactID(artifactID), Digest: digest,
+		SizeBytes: int64(len(data)), MediaType: mediaType,
+	}
+}
+
+func mustObjectPath(t *testing.T, digest string) string {
+	t.Helper()
+	value, err := artifactcap.ObjectPath(digest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return value
+}
diff --git a/workers/acp/supervisor/artifact_client_uploader.go b/workers/acp/supervisor/artifact_client_uploader.go
new file mode 100644
index 000000000..462fe574d
--- /dev/null
+++ b/workers/acp/supervisor/artifact_client_uploader.go
@@ -0,0 +1,56 @@
+package supervisor
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/orka-agents/orka/internal/artifactcap"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+type remoteArtifactUploader struct {
+	client *ArtifactClient
+}
+
+func NewRemoteArtifactUploader(client *ArtifactClient) (ArtifactUploader, error) {
+	if client == nil {
+		return nil, fmt.Errorf("artifact client is required")
+	}
+	return &remoteArtifactUploader{client: client}, nil
+}
+
+func (u *remoteArtifactUploader) UploadWorkspaceDelta(
+	ctx context.Context,
+	request harnessv2.CreateWorkspaceDeltaRequest,
+	artifact []byte,
+	digest string,
+) (harnessv2.ArtifactReference, error) {
+	if err := request.Limits.Validate(); err != nil {
+		return harnessv2.ArtifactReference{}, fmt.Errorf("workspace delta limits: %w", err)
+	}
+	if int64(len(artifact)) > request.Limits.MaxBytes {
+		return harnessv2.ArtifactReference{}, fmt.Errorf("workspace delta artifact exceeds request limit")
+	}
+	if actual := artifactcap.DigestBytes(artifact); actual != digest {
+		return harnessv2.ArtifactReference{}, fmt.Errorf("workspace delta artifact digest mismatch")
+	}
+	artifactID, err := artifactcap.ArtifactIDForDigest(digest)
+	if err != nil {
+		return harnessv2.ArtifactReference{}, err
+	}
+	reference := harnessv2.ArtifactReference{
+		ArtifactID: harnessv2.ArtifactID(artifactID),
+		Digest:     digest,
+		SizeBytes:  int64(len(artifact)),
+		MediaType:  artifactcap.MediaTypeWorkspaceDelta,
+	}
+	if request.ArtifactUploadAuthorization == nil {
+		// The controller cannot bind an upload capability until the frozen
+		// workspace delta has been produced and its exact digest and size are
+		// known. Ask the authenticated controller-side broker for that one-shot
+		// capability only after constructing the content-addressed reference.
+		return u.client.Upload(ctx, reference, artifact, &request)
+	}
+	authorization := artifactcap.Authorization{Capability: request.ArtifactUploadAuthorization.Capability, RequestDigest: request.ArtifactUploadAuthorization.RequestDigest}
+	return u.client.UploadAuthorized(ctx, reference, authorization, artifact)
+}
diff --git a/workers/acp/supervisor/assistant_message_compactor.go b/workers/acp/supervisor/assistant_message_compactor.go
new file mode 100644
index 000000000..0e0043e40
--- /dev/null
+++ b/workers/acp/supervisor/assistant_message_compactor.go
@@ -0,0 +1,195 @@
+package supervisor
+
+import (
+	"bytes"
+	"encoding/json"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"github.com/orka-agents/orka/internal/acp"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+const assistantMessageCoalesceWindow = 25 * time.Millisecond
+
+// assistantMessageCompactor batches only adjacent ACP assistant text deltas.
+// It runs before harness identity assignment so emitted sequences remain
+// contiguous while the protocol rate limiter still sees every meaningful
+// lifecycle update.
+type assistantMessageCompactor struct {
+	maxBytes      int
+	flushInterval time.Duration
+	pending       acp.PromptEvent
+	text          strings.Builder
+	messageID     string
+	meta          json.RawMessage
+	deadline      time.Time
+	timer         *time.Timer
+}
+
+func newAssistantMessageCompactor() *assistantMessageCompactor {
+	return &assistantMessageCompactor{
+		maxBytes:      harnessv2.MaxProtocolStringBytes,
+		flushInterval: assistantMessageCoalesceWindow,
+	}
+}
+
+func (c *assistantMessageCompactor) timerChannel() <-chan time.Time {
+	if c.timer == nil {
+		return nil
+	}
+	return c.timer.C
+}
+
+func (c *assistantMessageCompactor) push(event acp.PromptEvent, arrivedAt time.Time) []acp.PromptEvent {
+	ready := make([]acp.PromptEvent, 0, 2)
+	if c.text.Len() > 0 && !arrivedAt.Before(c.deadline) {
+		ready = append(ready, c.flush())
+	}
+
+	chunk, isAssistantText := decodeAssistantMessageChunk(event)
+	if !isAssistantText {
+		if c.text.Len() > 0 {
+			ready = append(ready, c.flush())
+		}
+		return append(ready, event)
+	}
+	text := chunk.Content.Text
+	if text == "" {
+		return ready
+	}
+	if c.text.Len() > 0 && (event.Update.SessionID != c.pending.Update.SessionID ||
+		chunk.MessageID != c.messageID || !bytes.Equal(chunk.Meta, c.meta)) {
+		ready = append(ready, c.flush())
+	}
+
+	for len(text) > 0 {
+		if c.text.Len() == 0 {
+			c.pending = event
+			c.messageID = chunk.MessageID
+			c.meta = append(c.meta[:0], chunk.Meta...)
+			c.arm(arrivedAt)
+		}
+		remaining := c.maxBytes - c.text.Len()
+		prefixBytes := utf8SafePrefixBytes(text, remaining)
+		if prefixBytes == 0 {
+			ready = append(ready, c.flush())
+			continue
+		}
+		_, _ = c.text.WriteString(text[:prefixBytes])
+		c.pending.Sequence = event.Sequence
+		c.pending.Timestamp = event.Timestamp
+		text = text[prefixBytes:]
+		if c.text.Len() == c.maxBytes {
+			ready = append(ready, c.flush())
+		}
+	}
+	return ready
+}
+
+func (c *assistantMessageCompactor) flushPending() []acp.PromptEvent {
+	if c.text.Len() == 0 {
+		return nil
+	}
+	return []acp.PromptEvent{c.flush()}
+}
+
+func (c *assistantMessageCompactor) close() {
+	c.stopTimer()
+}
+
+func (c *assistantMessageCompactor) arm(now time.Time) {
+	c.deadline = now.Add(c.flushInterval)
+	c.timer = time.NewTimer(c.flushInterval)
+}
+
+func (c *assistantMessageCompactor) flush() acp.PromptEvent {
+	const acpUpdateAgentMessageChunk = "agent_message_chunk"
+
+	event := c.pending
+	encoded, err := json.Marshal(struct {
+		SessionUpdate string `json:"sessionUpdate"`
+		MessageID     string `json:"messageId,omitempty"`
+		Content       struct {
+			Type string `json:"type"`
+			Text string `json:"text"`
+		} `json:"content"`
+		Meta json.RawMessage `json:"_meta,omitempty"`
+	}{
+		SessionUpdate: acpUpdateAgentMessageChunk,
+		MessageID:     c.messageID,
+		Content: struct {
+			Type string `json:"type"`
+			Text string `json:"text"`
+		}{Type: "text", Text: c.text.String()},
+		Meta: c.meta,
+	})
+	if err != nil {
+		panic(err) // json.Marshal cannot fail for this fixed string-only shape.
+	}
+	event.Update = &acp.SessionNotification{SessionID: event.Update.SessionID, Update: encoded}
+	c.text.Reset()
+	c.pending = acp.PromptEvent{}
+	c.messageID = ""
+	c.meta = nil
+	c.deadline = time.Time{}
+	c.stopTimer()
+	return event
+}
+
+func (c *assistantMessageCompactor) stopTimer() {
+	if c.timer == nil {
+		return
+	}
+	if !c.timer.Stop() {
+		select {
+		case <-c.timer.C:
+		default:
+		}
+	}
+	c.timer = nil
+}
+
+func assistantMessageText(event acp.PromptEvent) (string, bool) {
+	chunk, ok := decodeAssistantMessageChunk(event)
+	return chunk.Content.Text, ok
+}
+
+type assistantMessageChunk struct {
+	SessionUpdate string `json:"sessionUpdate"`
+	MessageID     string `json:"messageId,omitempty"`
+	Content       struct {
+		Type string `json:"type"`
+		Text string `json:"text"`
+	} `json:"content"`
+	Meta json.RawMessage `json:"_meta,omitempty"`
+}
+
+func decodeAssistantMessageChunk(event acp.PromptEvent) (assistantMessageChunk, bool) {
+	const acpUpdateAgentMessageChunk = "agent_message_chunk"
+
+	var envelope assistantMessageChunk
+	if event.Type != acp.PromptEventUpdate || event.Update == nil {
+		return envelope, false
+	}
+	if json.Unmarshal(event.Update.Update, &envelope) != nil ||
+		envelope.SessionUpdate != acpUpdateAgentMessageChunk || envelope.Content.Type != "text" {
+		return assistantMessageChunk{}, false
+	}
+	return envelope, true
+}
+
+func utf8SafePrefixBytes(value string, limit int) int {
+	if limit <= 0 {
+		return 0
+	}
+	if len(value) <= limit {
+		return len(value)
+	}
+	prefix := limit
+	for prefix > 0 && !utf8.RuneStart(value[prefix]) {
+		prefix--
+	}
+	return prefix
+}
diff --git a/workers/acp/supervisor/assistant_message_compactor_test.go b/workers/acp/supervisor/assistant_message_compactor_test.go
new file mode 100644
index 000000000..a22342b11
--- /dev/null
+++ b/workers/acp/supervisor/assistant_message_compactor_test.go
@@ -0,0 +1,240 @@
+package supervisor
+
+import (
+	"bytes"
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/orka-agents/orka/internal/acp"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+func TestAssistantMessageCompactorKeepsCodexBurstBelowHarnessRateLimit(t *testing.T) {
+	compactor := newAssistantMessageCompactor()
+	compactor.flushInterval = time.Hour
+	t.Cleanup(compactor.close)
+	now := time.Now().UTC()
+	const rawUpdates = runtimeCodexMaxUpdateEventsPerSecond + 1
+
+	var compacted []acp.PromptEvent
+	for sequence := 1; sequence <= rawUpdates; sequence++ {
+		compacted = append(compacted, compactor.push(
+			testAssistantMessagePromptEvent(t, int64(sequence), now, "x"), now,
+		)...)
+	}
+	compacted = append(compacted, compactor.flushPending()...)
+	if len(compacted) != 1 {
+		t.Fatalf("compacted event count = %d, want 1", len(compacted))
+	}
+
+	server, cfg, _ := newTestServer(t, "immediate")
+	server.cfg.Capabilities.Limits.MaxUpdateEventsPerSecond = 1
+	fence := cfg.Fence
+	fence.RuntimeSessionUID = "compactor-session-uid"
+	fence.RuntimeSessionGeneration = 1
+	prompt := &promptState{request: testStartPromptRequest(t, cfg, fence), sequence: 1}
+	state := &sessionState{descriptor: harnessv2.RuntimeSessionDescriptor{
+		RuntimeSessionUID: fence.RuntimeSessionUID,
+		Generation:        fence.RuntimeSessionGeneration,
+	}}
+	mapped, err := server.mapRuntimeEvent(state, prompt, compacted[0])
+	if err != nil {
+		t.Fatalf("map compacted update: %v", err)
+	}
+	wantText := strings.Repeat("x", rawUpdates)
+	if mapped == nil || mapped.Update == nil || mapped.Update.AssistantMessage == nil ||
+		mapped.Update.AssistantMessage.Text != wantText || prompt.assistant.String() != wantText {
+		t.Fatalf("compacted assistant text or terminal aggregate was not preserved")
+	}
+
+	limits := eventLimits(server.cfg.Capabilities.Limits)
+	var stream bytes.Buffer
+	encoder, err := harnessv2.NewEventEncoder(
+		&stream, limits, harnessv2.EventExpectationFromMetadata(prompt.request.Metadata),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	acceptedAt := now.Add(-time.Millisecond)
+	accepted := harnessv2.Event{
+		Protocol: harnessv2.ProtocolVersion,
+		Type:     harnessv2.EventAccepted,
+		Identity: eventIdentity(server.cfg.Fence, state.descriptor, prompt.request.Metadata, 1, acceptedAt),
+		Accepted: &harnessv2.AcceptedEvent{
+			AcceptedAt: acceptedAt,
+			Lease:      prompt.request.Lease,
+			ACPVersion: harnessv2.ACPProfileV1,
+		},
+	}
+	if err := encoder.Encode(accepted); err != nil {
+		t.Fatalf("encode accepted: %v", err)
+	}
+	if err := encoder.Encode(*mapped); err != nil {
+		t.Fatalf("encode compacted update: %v", err)
+	}
+	terminal, _, err := server.terminalEvent(state, prompt, acp.PromptResult{
+		Outcome: acp.PromptOutcomeCompleted, StopReason: acp.StopReasonEndTurn,
+		Accepted: true, SettledAt: now.Add(time.Millisecond),
+	})
+	if err != nil {
+		t.Fatalf("build terminal event: %v", err)
+	}
+	if err := encoder.Encode(terminal); err != nil {
+		t.Fatalf("encode terminal event: %v", err)
+	}
+	if err := encoder.Close(); err != nil {
+		t.Fatalf("close event stream: %v", err)
+	}
+
+	decoder, err := harnessv2.NewEventDecoder(
+		bytes.NewReader(stream.Bytes()), limits, harnessv2.EventExpectationFromMetadata(prompt.request.Metadata),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	events, err := decoder.DecodeAll()
+	if err != nil {
+		t.Fatalf("decode compacted stream: %v", err)
+	}
+	if len(events) != 3 || events[0].Identity.Sequence != 1 || events[1].Identity.Sequence != 2 ||
+		events[2].Identity.Sequence != 3 || events[2].Completed == nil ||
+		events[2].Completed.Result.Content[0].Text != wantText {
+		t.Fatalf("compacted harness stream = %#v", events)
+	}
+}
+
+func TestAssistantMessageCompactorPreservesUTF8AndPermissionBoundary(t *testing.T) {
+	compactor := &assistantMessageCompactor{maxBytes: 5, flushInterval: time.Hour}
+	t.Cleanup(compactor.close)
+	now := time.Now().UTC()
+	inputs := []string{"a", " \n", "é", "🙂"}
+	var ready []acp.PromptEvent
+	for index, input := range inputs {
+		at := now.Add(time.Duration(index) * time.Millisecond)
+		ready = append(ready, compactor.push(testAssistantMessagePromptEvent(t, int64(index+1), at, input), at)...)
+	}
+	permission := acp.PromptEvent{
+		Type:      acp.PromptEventPermissionRequested,
+		Sequence:  5,
+		Timestamp: now.Add(5 * time.Millisecond),
+		Permission: &acp.PermissionRequestEvent{
+			RequestID: "permission-1",
+		},
+	}
+	ready = append(ready, compactor.push(permission, now.Add(5*time.Millisecond))...)
+	if len(ready) != 3 || ready[2].Type != acp.PromptEventPermissionRequested {
+		t.Fatalf("boundary output = %#v", ready)
+	}
+	first, firstOK := assistantMessageText(ready[0])
+	second, secondOK := assistantMessageText(ready[1])
+	if !firstOK || !secondOK || first != "a \né" || second != "🙂" {
+		t.Fatalf("UTF-8 chunks = %q/%q, want exact source text", first, second)
+	}
+	if ready[0].Timestamp != now.Add(2*time.Millisecond) || ready[1].Timestamp != now.Add(3*time.Millisecond) {
+		t.Fatalf("compacted timestamps = %s/%s, want latest included source timestamps", ready[0].Timestamp, ready[1].Timestamp)
+	}
+}
+
+func TestAssistantMessageCompactorFlushesOnCadence(t *testing.T) {
+	const message = "hello"
+	compactor := &assistantMessageCompactor{maxBytes: harnessv2.MaxProtocolStringBytes, flushInterval: time.Millisecond}
+	t.Cleanup(compactor.close)
+	now := time.Now().UTC()
+	if ready := compactor.push(testAssistantMessagePromptEvent(t, 1, now, message), now); len(ready) != 0 {
+		t.Fatalf("initial push emitted %d events", len(ready))
+	}
+	select {
+	case <-compactor.timerChannel():
+	case <-time.After(time.Second):
+		t.Fatal("assistant compaction cadence did not fire")
+	}
+	ready := compactor.flushPending()
+	if len(ready) != 1 {
+		t.Fatalf("cadence flush count = %d, want 1", len(ready))
+	}
+	text, ok := assistantMessageText(ready[0])
+	if !ok || text != message {
+		t.Fatalf("cadence flush text = %q ok=%v", text, ok)
+	}
+}
+
+func TestAssistantMessageCompactorPreservesMessageIdentityAndCodexPhaseBoundary(t *testing.T) {
+	compactor := newAssistantMessageCompactor()
+	compactor.flushInterval = time.Hour
+	t.Cleanup(compactor.close)
+	now := time.Now().UTC()
+
+	commentary := testAssistantMessagePromptEventWithPhase(
+		t, 1, now, "commentary-message", acpAssistantPhaseCommentary, "Checking repository files.",
+	)
+	if ready := compactor.push(commentary, now); len(ready) != 0 {
+		t.Fatalf("commentary push emitted %d events", len(ready))
+	}
+	firstFinal := testAssistantMessagePromptEventWithPhase(
+		t, 2, now.Add(time.Millisecond), "final-message", acpAssistantPhaseFinalAnswer, `{"schemaVersion":1,`,
+	)
+	ready := compactor.push(firstFinal, now.Add(time.Millisecond))
+	if len(ready) != 1 {
+		t.Fatalf("phase boundary emitted %d events, want 1", len(ready))
+	}
+	secondFinal := testAssistantMessagePromptEventWithPhase(
+		t, 3, now.Add(2*time.Millisecond), "final-message", acpAssistantPhaseFinalAnswer, `"ok":true}`,
+	)
+	if extra := compactor.push(secondFinal, now.Add(2*time.Millisecond)); len(extra) != 0 {
+		t.Fatalf("same final-answer message emitted %d events", len(extra))
+	}
+	ready = append(ready, compactor.flushPending()...)
+	if len(ready) != 2 {
+		t.Fatalf("compacted phase stream count = %d, want 2", len(ready))
+	}
+
+	commentaryChunk, ok := decodeAssistantMessageChunk(ready[0])
+	if !ok || commentaryChunk.MessageID != "commentary-message" ||
+		commentaryChunk.Content.Text != "Checking repository files." ||
+		acpAssistantMessagePhase(ready[0].Update) != acpAssistantPhaseCommentary {
+		t.Fatalf("compacted commentary chunk = %#v", commentaryChunk)
+	}
+	finalChunk, ok := decodeAssistantMessageChunk(ready[1])
+	if !ok || finalChunk.MessageID != "final-message" ||
+		finalChunk.Content.Text != `{"schemaVersion":1,"ok":true}` ||
+		acpAssistantMessagePhase(ready[1].Update) != acpAssistantPhaseFinalAnswer {
+		t.Fatalf("compacted final chunk = %#v", finalChunk)
+	}
+}
+
+func testAssistantMessagePromptEvent(t *testing.T, sequence int64, at time.Time, text string) acp.PromptEvent {
+	return testAssistantMessagePromptEventWithPhase(t, sequence, at, "", "", text)
+}
+
+func testAssistantMessagePromptEventWithPhase(
+	t *testing.T,
+	sequence int64,
+	at time.Time,
+	messageID string,
+	phase string,
+	text string,
+) acp.PromptEvent {
+	t.Helper()
+	payload := map[string]any{
+		"sessionUpdate": "agent_message_chunk",
+		"content":       map[string]any{"type": "text", "text": text},
+	}
+	if messageID != "" {
+		payload["messageId"] = messageID
+	}
+	if phase != "" {
+		payload["_meta"] = map[string]any{"codex": map[string]any{"phase": phase}}
+	}
+	encoded, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return acp.PromptEvent{
+		Type:      acp.PromptEventUpdate,
+		Sequence:  sequence,
+		Timestamp: at,
+		Update:    &acp.SessionNotification{SessionID: "provider-session", Update: encoded},
+	}
+}
diff --git a/workers/acp/supervisor/config.go b/workers/acp/supervisor/config.go
new file mode 100644
index 000000000..903807e1c
--- /dev/null
+++ b/workers/acp/supervisor/config.go
@@ -0,0 +1,162 @@
+package supervisor
+
+import (
+	"context"
+	"crypto/subtle"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/orka-agents/orka/internal/acp"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/workspacedelta"
+)
+
+const OperationCapabilityHeader = "X-Orka-Operation-Capability"
+
+const sessionIdentityExhaustionReserve = 1
+
+type ProviderProfile struct {
+	Kind                  string
+	Model                 string
+	Command               string
+	Args                  []string
+	Environment           map[string]string
+	ProjectSession        func(harnessv2.CreateRuntimeSessionRequest, acp.SessionPaths, ProviderProxyBinding) (ProviderSessionProjection, error)
+	EnvironmentForSession func(harnessv2.CreateRuntimeSessionRequest, acp.SessionPaths, ProviderProxyBinding) (map[string]string, error)
+	AuthMethodID          string
+	AdapterName           string
+	AdapterDigest         string
+	PrepareSession        func(acp.SessionPaths) error
+}
+
+type ProviderSessionProjection struct {
+	AdditionalArgs []string
+	Environment    map[string]string
+	NewSessionMeta acp.Meta
+}
+
+type ArtifactUploader interface {
+	UploadWorkspaceDelta(context.Context, harnessv2.CreateWorkspaceDeltaRequest, []byte, string) (harnessv2.ArtifactReference, error)
+}
+
+type WorkspaceMaterializer interface {
+	Materialize(context.Context, harnessv2.CreateRuntimeSessionRequest, string) error
+}
+
+type WorkspaceMaterializerFunc func(context.Context, harnessv2.CreateRuntimeSessionRequest, string) error
+
+func (f WorkspaceMaterializerFunc) Materialize(ctx context.Context, request harnessv2.CreateRuntimeSessionRequest, destination string) error {
+	return f(ctx, request, destination)
+}
+
+type Config struct {
+	ListenAddress string
+	Fence         harnessv2.Fence
+	Capabilities  harnessv2.CapabilitiesResponse
+	Provider      ProviderProfile
+
+	ControllerBearerToken string
+	CapabilitySecret      []byte
+	RequireCapabilities   bool
+
+	SessionBaseDir        string
+	UIDAllocator          *acp.UIDAllocator
+	ProviderProxy         ProviderProxyConfig
+	MCPBroker             MCPBroker
+	WorkspaceMaterializer WorkspaceMaterializer
+	ArtifactUploader      ArtifactUploader
+	DeltaOptions          workspacedelta.Options
+
+	InitializeTimeout time.Duration
+	PermissionTimeout time.Duration
+	CancelGrace       time.Duration
+}
+
+func (c Config) Validate() error {
+	if strings.TrimSpace(c.ListenAddress) == "" {
+		return fmt.Errorf("listen address is required")
+	}
+	if err := c.Fence.Validate(false); err != nil {
+		return fmt.Errorf("supervisor fence: %w", err)
+	}
+	if c.Fence.RuntimeSessionUID != "" || c.Fence.RuntimeSessionGeneration != 0 {
+		return fmt.Errorf("supervisor base fence must not contain runtime-session identity")
+	}
+	if err := c.Capabilities.Validate(); err != nil {
+		return fmt.Errorf("capabilities: %w", err)
+	}
+	if c.Capabilities.RuntimeProfileDigest != c.Fence.RuntimeProfileDigest {
+		return fmt.Errorf("capabilities and fence runtime profile digests differ")
+	}
+	if c.Capabilities.ProfileDigestSchemaVersion != c.Fence.ProfileDigestSchemaVersion {
+		return fmt.Errorf("capabilities and fence profile digest schema versions differ")
+	}
+	if strings.TrimSpace(c.Provider.Kind) == "" || strings.TrimSpace(c.Provider.Model) == "" {
+		return fmt.Errorf("provider kind and model are required")
+	}
+	if len(c.Capabilities.Provider.ProviderKinds) != 1 || c.Capabilities.Provider.ProviderKinds[0] != c.Provider.Kind {
+		return fmt.Errorf("provider capability kind does not match configured provider")
+	}
+	if c.Provider.Command == "" || !filepath.IsAbs(c.Provider.Command) {
+		return fmt.Errorf("provider adapter command must be absolute")
+	}
+	if strings.TrimSpace(c.Provider.AdapterName) == "" {
+		return fmt.Errorf("provider adapter name is required")
+	}
+	if got := c.Capabilities.AdapterDigests[c.Provider.AdapterName]; got == "" || got != c.Provider.AdapterDigest {
+		return fmt.Errorf("provider adapter digest does not match advertised capability")
+	}
+	if len(c.ControllerBearerToken) < 32 {
+		return fmt.Errorf("controller bearer token must be at least 32 bytes")
+	}
+	if c.RequireCapabilities && len(c.CapabilitySecret) < harnessv2.MinCapabilitySecretBytes {
+		return fmt.Errorf("operation capability secret must be at least %d bytes", harnessv2.MinCapabilitySecretBytes)
+	}
+	if c.SessionBaseDir == "" || !filepath.IsAbs(c.SessionBaseDir) {
+		return fmt.Errorf("session base directory must be absolute")
+	}
+	if c.UIDAllocator == nil {
+		return fmt.Errorf("UID allocator is required")
+	}
+	requiredIdentityCapacity := uint64(c.Capabilities.Limits.MaxResidentSessions) + sessionIdentityExhaustionReserve
+	if uint64(c.UIDAllocator.Capacity()) < requiredIdentityCapacity {
+		return fmt.Errorf("UID allocator capacity must provide at least %d resident identities plus the exhaustion reserve", c.Capabilities.Limits.MaxResidentSessions)
+	}
+	if c.WorkspaceMaterializer == nil {
+		return fmt.Errorf("workspace materializer is required")
+	}
+	if _, _, err := c.ProviderProxy.normalized(); err != nil {
+		return err
+	}
+	if c.MCPBroker == nil {
+		return fmt.Errorf("controller MCP broker is required")
+	}
+	if c.InitializeTimeout < 0 || c.PermissionTimeout < 0 || c.CancelGrace < 0 {
+		return fmt.Errorf("runtime timeouts must be non-negative")
+	}
+	return nil
+}
+
+func (c Config) bearerMatches(value string) bool {
+	value = strings.TrimSpace(value)
+	token, ok := strings.CutPrefix(value, "Bearer ")
+	if !ok || token == "" || strings.TrimSpace(token) != token || len(token) != len(c.ControllerBearerToken) {
+		return false
+	}
+	return subtle.ConstantTimeCompare([]byte(token), []byte(c.ControllerBearerToken)) == 1
+}
+
+func EmptyWorkspaceMaterializer() WorkspaceMaterializer {
+	return WorkspaceMaterializerFunc(func(_ context.Context, request harnessv2.CreateRuntimeSessionRequest, destination string) error {
+		if request.Workspace.Baseline.Artifact != nil {
+			return fmt.Errorf("workspace artifact materialization is not configured")
+		}
+		if err := os.MkdirAll(destination, 0o700); err != nil {
+			return err
+		}
+		return nil
+	})
+}
diff --git a/workers/acp/supervisor/env.go b/workers/acp/supervisor/env.go
new file mode 100644
index 000000000..7dbea723e
--- /dev/null
+++ b/workers/acp/supervisor/env.go
@@ -0,0 +1,972 @@
+package supervisor
+
+import (
+	"crypto/sha256"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"strings"
+
+	"github.com/google/uuid"
+	"github.com/orka-agents/orka/internal/acp"
+	"github.com/orka-agents/orka/internal/artifactcap"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+const (
+	providerKindCodex            = "codex"
+	providerKindClaude           = "claude"
+	providerKindCopilot          = "copilot"
+	providerKindOpencode         = "opencode"
+	providerToolBash             = "Bash"
+	providerToolEdit             = "Edit"
+	providerToolGlob             = "Glob"
+	providerToolGrep             = "Grep"
+	providerToolRead             = "Read"
+	providerToolWebFetch         = "WebFetch"
+	providerToolWebSearch        = "WebSearch"
+	providerToolWrite            = "Write"
+	architectureARM64            = "arm64"
+	EnvListenAddress             = "ORKA_ACP_LISTEN_ADDRESS"
+	EnvRuntimeInstanceID         = "ORKA_ACP_RUNTIME_INSTANCE_ID"
+	EnvSupervisorBootID          = "ORKA_ACP_SUPERVISOR_BOOT_ID"
+	EnvPodUID                    = "ORKA_ACP_POD_UID"
+	EnvControllerEpoch           = "ORKA_ACP_CONTROLLER_EPOCH"
+	EnvRuntimePoolUID            = "ORKA_ACP_RUNTIME_POOL_UID"
+	EnvRuntimePoolGeneration     = "ORKA_ACP_RUNTIME_POOL_GENERATION"
+	EnvProvider                  = "ORKA_ACP_PROVIDER"
+	EnvModel                     = "ORKA_ACP_MODEL"
+	EnvModelContextLimit         = "ORKA_ACP_MODEL_CONTEXT_LIMIT"
+	EnvModelOutputLimit          = "ORKA_ACP_MODEL_OUTPUT_LIMIT"
+	EnvWorkspaceIntent           = "ORKA_ACP_WORKSPACE_INTENT"
+	EnvAgentConfigurationDigest  = "ORKA_ACP_AGENT_CONFIGURATION_DIGEST"
+	EnvToolPolicyDigest          = "ORKA_ACP_TOOL_POLICY_DIGEST"
+	EnvApprovalPolicyDigest      = "ORKA_ACP_APPROVAL_POLICY_DIGEST"
+	EnvMCPConfigurationDigest    = "ORKA_ACP_MCP_CONFIGURATION_DIGEST"
+	EnvProxyCredentialRole       = "ORKA_ACP_PROXY_CREDENTIAL_ROLE"
+	EnvProxyCredentialScope      = "ORKA_ACP_PROXY_CREDENTIAL_SCOPE"
+	EnvResourceClass             = "ORKA_ACP_RESOURCE_CLASS"
+	EnvProviderProxyBaseURL      = "ORKA_ACP_PROVIDER_PROXY_BASE_URL"
+	EnvProviderTokenFile         = "ORKA_ACP_PROVIDER_TOKEN_FILE"
+	EnvArtifactAPIURL            = "ORKA_ACP_ARTIFACT_API_URL"
+	EnvWorkspaceArtifactMaxBytes = "ORKA_ACP_WORKSPACE_MAX_ARTIFACT_BYTES"
+	EnvMCPBrokerURL              = "ORKA_ACP_MCP_BROKER_URL"
+	EnvTrustNamespace            = "ORKA_ACP_TRUST_NAMESPACE"
+	EnvControllerTokenFile       = "ORKA_ACP_CONTROLLER_TOKEN_FILE"
+	EnvCapabilitySecretFile      = "ORKA_ACP_CAPABILITY_SECRET_FILE"
+	EnvSessionBaseDir            = "ORKA_ACP_SESSION_BASE_DIR"
+	EnvFirstSessionUID           = "ORKA_ACP_FIRST_SESSION_UID"
+	EnvLastSessionUID            = "ORKA_ACP_LAST_SESSION_UID"
+	EnvSessionGID                = "ORKA_ACP_SESSION_GID"
+
+	openCodeProviderID          = "orka"
+	openCodeProviderEnvName     = "ORKA_OPENCODE_PROVIDER_TOKEN"
+	openCodePermissionAllow     = "allow"
+	openCodePermissionDeny      = "deny"
+	openCodeRootInstructionPath = "/opt/opencode/AGENTS.md"
+
+	// Codex ACP can flush buffered token/tool updates in short bursts above the
+	// generic protocol default. Keep a bounded runtime-specific ceiling that the
+	// supervisor advertises and the controller then enforces symmetrically.
+	runtimeCodexMaxUpdateEventsPerSecond = 1000
+
+	// Publisher workspace artifacts are inbound runtime materialization inputs,
+	// while workspace deltas are outbound runtime artifacts. Keep independently
+	// bounded defaults and configure the inbound limit from Publisher capability
+	// propagation instead of conflating it with the delta capability.
+	defaultWorkspaceArtifactDownloadBytes int64 = artifactcap.DefaultWorkspaceArtifactMaxBytes
+	defaultWorkspaceDeltaUploadBytes      int64 = 100 << 20
+)
+
+func LoadConfigFromEnv() (Config, error) {
+	providerKind := requiredEnv(EnvProvider)
+	model := requiredEnv(EnvModel)
+	intent := harnessv2.WorkspaceIntent(requiredEnv(EnvWorkspaceIntent))
+	modelLimits, err := modelTokenLimitsFromEnv()
+	if err != nil {
+		return Config{}, err
+	}
+	profile := harnessv2.RuntimeProfile{
+		ACPProfile:               harnessv2.ACPProfileV1,
+		ProviderKind:             providerKind,
+		Model:                    model,
+		ModelLimits:              modelLimits,
+		AgentConfigurationDigest: requiredEnv(EnvAgentConfigurationDigest),
+		ToolPolicyDigest:         requiredEnv(EnvToolPolicyDigest),
+		ApprovalPolicyDigest:     requiredEnv(EnvApprovalPolicyDigest),
+		MCPConfigurationDigest:   requiredEnv(EnvMCPConfigurationDigest),
+		WorkspaceIntent:          intent,
+		ProxyCredentialRole:      requiredEnv(EnvProxyCredentialRole),
+		ProxyCredentialScope:     requiredEnv(EnvProxyCredentialScope),
+		ResourceClass:            envDefault(EnvResourceClass, "standard"),
+	}
+	providerBaseURL := envDefault(EnvProviderProxyBaseURL, defaultProxyBaseURL())
+	modelOutputLimit := int64(0)
+	if modelLimits != nil {
+		modelOutputLimit = modelLimits.Output
+	}
+	provider, err := providerProfile(providerKind, model, intent, modelLimits)
+	if err != nil {
+		return Config{}, err
+	}
+	profile.AdapterDigests = providerAdapterDigests(providerKind)
+	if err := profile.Validate(); err != nil {
+		return Config{}, fmt.Errorf("runtime profile: %w", err)
+	}
+	profileDigest, err := harnessv2.CanonicalProfileDigest(profile)
+	if err != nil {
+		return Config{}, err
+	}
+	limits := defaultProtocolLimits(providerKind)
+	controllerEpoch, err := parsePositiveUint(EnvControllerEpoch, requiredEnv(EnvControllerEpoch))
+	if err != nil {
+		return Config{}, err
+	}
+	poolGeneration, err := parsePositiveUint(EnvRuntimePoolGeneration, requiredEnv(EnvRuntimePoolGeneration))
+	if err != nil {
+		return Config{}, err
+	}
+	firstUID, err := parsePositiveInt(EnvFirstSessionUID, envDefault(EnvFirstSessionUID, "20000"))
+	if err != nil {
+		return Config{}, err
+	}
+	lastUID, err := parsePositiveInt(EnvLastSessionUID, envDefault(EnvLastSessionUID, "29999"))
+	if err != nil {
+		return Config{}, err
+	}
+	firstGID, err := parsePositiveInt(EnvSessionGID, envDefault(EnvSessionGID, "20000"))
+	if err != nil {
+		return Config{}, err
+	}
+	allocator, err := acp.NewUIDAllocator(firstUID, lastUID, firstGID)
+	if err != nil {
+		return Config{}, err
+	}
+	controllerToken, err := readRequiredSecretFile(EnvControllerTokenFile)
+	if err != nil {
+		return Config{}, err
+	}
+	capabilitySecret, err := readRequiredSecretFile(EnvCapabilitySecretFile)
+	if err != nil {
+		return Config{}, err
+	}
+	workspaceMaterializer := EmptyWorkspaceMaterializer()
+	var artifactUploader ArtifactUploader
+	if artifactAPIURL := strings.TrimSpace(os.Getenv(EnvArtifactAPIURL)); artifactAPIURL != "" {
+		authorizationProvider, providerErr := NewBrokerArtifactAuthorizationProvider(
+			artifactAPIURL, requiredEnv(EnvTrustNamespace), controllerToken, []byte(capabilitySecret),
+		)
+		if providerErr != nil {
+			return Config{}, providerErr
+		}
+		maxWorkspaceArtifactBytes, limitErr := workspaceArtifactDownloadLimitFromEnv()
+		if limitErr != nil {
+			return Config{}, limitErr
+		}
+		artifactClient, clientErr := newArtifactClient(
+			artifactAPIURL, nil, authorizationProvider, artifactClientLimits{
+				MaxDownloadBytes: maxWorkspaceArtifactBytes,
+				MaxUploadBytes:   limits.MaxWorkspaceDeltaBytes,
+			},
+		)
+		if clientErr != nil {
+			return Config{}, clientErr
+		}
+		workspaceMaterializer, clientErr = NewRemoteWorkspaceMaterializer(artifactClient, WorkspaceMaterializerLimits{})
+		if clientErr != nil {
+			return Config{}, clientErr
+		}
+		artifactUploader, clientErr = NewRemoteArtifactUploader(artifactClient)
+		if clientErr != nil {
+			return Config{}, clientErr
+		}
+	}
+	mcpBrokerURL := strings.TrimSpace(os.Getenv(EnvMCPBrokerURL))
+	if mcpBrokerURL == "" {
+		mcpBrokerURL = strings.TrimSpace(os.Getenv(EnvArtifactAPIURL))
+	}
+	mcpBroker, err := NewControllerMCPBrokerClient(
+		mcpBrokerURL, requiredEnv(EnvTrustNamespace), controllerToken, []byte(capabilitySecret),
+	)
+	if err != nil {
+		return Config{}, err
+	}
+	providerToken, err := readRequiredSecretFile(EnvProviderTokenFile)
+	if err != nil {
+		return Config{}, err
+	}
+	bootID := strings.TrimSpace(os.Getenv(EnvSupervisorBootID))
+	if bootID == "" {
+		bootID = uuid.NewString()
+	}
+	runtimeInstanceID := strings.TrimSpace(os.Getenv(EnvRuntimeInstanceID))
+	if runtimeInstanceID == "" {
+		podUID := requiredEnv(EnvPodUID)
+		runtimeInstanceID = podUID + "." + bootID
+	}
+	capabilities := harnessv2.CapabilitiesResponse{
+		Protocol: harnessv2.ProtocolVersion, Transport: "http+ndjson", ACPVersion: harnessv2.ACPProfileV1,
+		RuntimeProfileDigest: profileDigest, ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+		AdapterDigests: profile.AdapterDigests, Limits: limits, SupportsDrain: true, SupportsPublicationFinalization: true,
+		SupportsAgentSessionConfiguration: true,
+		Provider: harnessv2.ProviderCapabilities{
+			ProviderKinds: []string{providerKind}, Models: []string{model}, SupportsPermissions: true,
+			SupportsCancel: true, SupportsTools: true, SupportsImages: true,
+			SupportsEmbeddedResources: true,
+		},
+		WorkspaceGovernance: harnessv2.StrictWorkspaceGovernanceCapabilities(),
+	}
+	cfg := Config{
+		ListenAddress: envDefault(EnvListenAddress, ":8080"),
+		Fence: harnessv2.Fence{
+			RuntimeInstanceID: harnessv2.RuntimeInstanceID(runtimeInstanceID),
+			SupervisorBootID:  harnessv2.SupervisorBootID(bootID), ControllerEpoch: controllerEpoch,
+			RuntimePoolUID: harnessv2.RuntimePoolUID(requiredEnv(EnvRuntimePoolUID)), RuntimePoolGeneration: poolGeneration,
+			RuntimeProfileDigest: profileDigest, ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+		},
+		Capabilities: capabilities, Provider: provider,
+		ControllerBearerToken: controllerToken, CapabilitySecret: []byte(capabilitySecret), RequireCapabilities: true,
+		SessionBaseDir: envDefault(EnvSessionBaseDir, "/sessions"), UIDAllocator: allocator,
+		ProviderProxy: ProviderProxyConfig{
+			UpstreamBaseURL: providerUpstreamBaseURL(providerKind, providerBaseURL), UpstreamBearerToken: providerToken,
+			ProviderKind: providerKind, Model: model,
+		},
+		MCPBroker:             mcpBroker,
+		WorkspaceMaterializer: workspaceMaterializer,
+		ArtifactUploader:      artifactUploader,
+	}
+	cfg.ProviderProxy.ModelOutputLimit = modelOutputLimit
+	if err := cfg.Validate(); err != nil {
+		return Config{}, err
+	}
+	return cfg, nil
+}
+
+// providerAdapterDigests keeps the supervisor's default-nil unknown-provider
+// behavior while sourcing the shared built-in adapter digest table.
+func providerAdapterDigests(provider string) map[string]string {
+	return acp.BuiltInRuntimeAdapterDigests(provider)
+}
+
+// codexAgentModeOrkaExternal is the Orka-patched codex-acp agent mode whose
+// externalSandbox policy keeps the runtime Pod as the enforcement boundary.
+const codexAgentModeOrkaExternal = "orka-external"
+
+var providerNativeToolNames = []string{
+	providerToolBash, providerToolEdit, providerToolGlob, providerToolGrep,
+	providerToolRead, providerToolWebFetch, providerToolWebSearch, providerToolWrite,
+}
+
+type providerNativePolicy struct {
+	unrestricted bool
+	allowed      map[string]struct{}
+}
+
+func (p providerNativePolicy) allows(name string) bool {
+	_, ok := p.allowed[name]
+	return ok
+}
+
+func providerSessionPolicy(
+	request harnessv2.CreateRuntimeSessionRequest,
+	provider string,
+	model string,
+) (providerNativePolicy, error) {
+	if request.AgentConfiguration == nil {
+		return providerNativePolicy{}, fmt.Errorf("agent session configuration is required")
+	}
+	if err := request.MCPConfiguration.ValidateProfile(request.Profile); err != nil {
+		return providerNativePolicy{}, fmt.Errorf("MCP policy configuration: %w", err)
+	}
+	if err := request.AgentConfiguration.ValidateProfileOrLegacy(request.Profile, request.MCPConfiguration.ToolPolicy.AllowBash); err != nil {
+		return providerNativePolicy{}, fmt.Errorf("agent session configuration: %w", err)
+	}
+	if request.Profile.ProviderKind != provider || request.AgentConfiguration.ProviderKind != provider ||
+		request.Profile.Model != model || request.AgentConfiguration.Model != model {
+		return providerNativePolicy{}, fmt.Errorf("provider session configuration does not match runtime profile")
+	}
+	toolPolicy := request.MCPConfiguration.ToolPolicy
+	unrestricted := toolPolicy.AllowedToolNames == nil && len(toolPolicy.DisallowedToolNames) == 0 && toolPolicy.AllowBash
+	policy := providerNativePolicy{unrestricted: unrestricted, allowed: make(map[string]struct{}, len(providerNativeToolNames))}
+	for _, descriptor := range toolPolicy.Tools {
+		if descriptor.Source != harnessv2.MCPToolSourceProviderNative {
+			continue
+		}
+		name, ok := canonicalProviderNativeToolName(descriptor.Name)
+		if !ok {
+			return providerNativePolicy{}, fmt.Errorf("provider-native tool %q is not supported by the %s projection", descriptor.Name, provider)
+		}
+		if _, duplicate := policy.allowed[name]; duplicate {
+			return providerNativePolicy{}, fmt.Errorf("provider-native tool %q is duplicated after canonicalization", descriptor.Name)
+		}
+		policy.allowed[name] = struct{}{}
+	}
+	return policy, nil
+}
+
+func canonicalProviderNativeToolName(value string) (string, bool) {
+	for _, name := range providerNativeToolNames {
+		if strings.EqualFold(value, name) {
+			return name, true
+		}
+	}
+	return "", false
+}
+
+func providerNativePolicyLists(policy providerNativePolicy) ([]string, []string) {
+	allowed := make([]string, 0, len(providerNativeToolNames))
+	disallowed := make([]string, 0, len(providerNativeToolNames))
+	for _, name := range providerNativeToolNames {
+		if policy.allows(name) {
+			allowed = append(allowed, name)
+		} else {
+			disallowed = append(disallowed, name)
+		}
+	}
+	return allowed, disallowed
+}
+
+func codexSessionProjection(
+	request harnessv2.CreateRuntimeSessionRequest,
+	_ acp.SessionPaths,
+	proxy ProviderProxyBinding,
+	model string,
+) (ProviderSessionProjection, error) {
+	policy, err := providerSessionPolicy(request, providerKindCodex, model)
+	if err != nil {
+		return ProviderSessionProjection{}, err
+	}
+	if !policy.unrestricted && !codexReadOnlySessionPolicy(request, policy) {
+		return ProviderSessionProjection{}, fmt.Errorf("codex ACP runtime cannot exactly enforce provider-native tool restrictions")
+	}
+	config := map[string]any{
+		"model": model, "openai_base_url": proxy.BaseURL, "check_for_update_on_startup": false,
+	}
+	if systemPrompt := request.AgentConfiguration.SystemPrompt; systemPrompt != "" {
+		config["developer_instructions"] = systemPrompt
+	}
+	if effort := request.AgentConfiguration.ReasoningEffort; effort != "" {
+		config["model_reasoning_effort"] = effort
+	}
+	encoded, err := json.Marshal(config)
+	if err != nil {
+		return ProviderSessionProjection{}, err
+	}
+	const maxCodexConfigEnvironmentBytes = 96 << 10
+	if len(encoded) > maxCodexConfigEnvironmentBytes {
+		return ProviderSessionProjection{}, fmt.Errorf("codex session configuration exceeds the safe environment limit")
+	}
+	// Read-only sessions keep the default orka-external agent mode: Codex's
+	// own sandbox needs unprivileged user namespaces that the runtime Pod
+	// forbids, so the RuntimeSession boundary enforces the surface instead —
+	// safe read commands execute, every elevation request is rejected
+	// unconditionally by the controller, file writes are mediated by the
+	// supervisor, and the read-intent workspace delta classification fails
+	// any turn that modifies the workspace.
+	return ProviderSessionProjection{Environment: map[string]string{"CODEX_CONFIG": string(encoded)}}, nil
+}
+
+// codexReadOnlySessionPolicy reports whether the session's restricted tool
+// policy is exactly the read-intent {Glob, Grep, Read} surface, which is the
+// only restricted shape the codex read-only agent mode enforces.
+func codexReadOnlySessionPolicy(request harnessv2.CreateRuntimeSessionRequest, policy providerNativePolicy) bool {
+	if request.Profile.WorkspaceIntent != harnessv2.WorkspaceIntentRead {
+		return false
+	}
+	if len(policy.allowed) != 3 {
+		return false
+	}
+	return policy.allows(providerToolGlob) && policy.allows(providerToolGrep) && policy.allows(providerToolRead)
+}
+
+func claudeSessionProjection(
+	request harnessv2.CreateRuntimeSessionRequest,
+	_ acp.SessionPaths,
+	_ ProviderProxyBinding,
+	model string,
+) (ProviderSessionProjection, error) {
+	policy, err := providerSessionPolicy(request, providerKindClaude, model)
+	if err != nil {
+		return ProviderSessionProjection{}, err
+	}
+	options := map[string]any{"maxTurns": request.AgentConfiguration.MaxTurns}
+	if effort := request.AgentConfiguration.ReasoningEffort; effort != "" {
+		options["effort"] = effort
+	}
+	if !policy.unrestricted {
+		allowed, disallowed := providerNativePolicyLists(policy)
+		options["tools"] = allowed
+		options["disallowedTools"] = disallowed
+	}
+	meta := acp.Meta{"claudeCode": map[string]any{"options": options}}
+	if systemPrompt := request.AgentConfiguration.SystemPrompt; systemPrompt != "" {
+		meta["systemPrompt"] = systemPrompt
+	}
+	return ProviderSessionProjection{NewSessionMeta: meta}, nil
+}
+
+var copilotToolIDs = map[string][]string{
+	providerToolBash:      {"bash", "list_bash", "read_bash", "stop_bash", "write_bash"},
+	providerToolEdit:      {"edit", "str_replace_editor", "apply_patch"},
+	providerToolGlob:      {"glob"},
+	providerToolGrep:      {"grep", "rg"},
+	providerToolRead:      {"view"},
+	providerToolWebFetch:  {"web_fetch"},
+	providerToolWebSearch: {"web_search"},
+	providerToolWrite:     {"create"},
+}
+
+var copilotAlwaysExcludedToolIDs = []string{
+	"ask_user", "code_review", "custom_tool", "custom_tools", "exit_plan_mode",
+	"github", "github-mcp-server", "list_agents", "lsp", "read_agent", "report_intent", "skill", "sql", "task", "write_agent",
+}
+
+func copilotSessionProjection(
+	request harnessv2.CreateRuntimeSessionRequest,
+	_ acp.SessionPaths,
+	_ ProviderProxyBinding,
+	model string,
+) (ProviderSessionProjection, error) {
+	policy, err := providerSessionPolicy(request, providerKindCopilot, model)
+	if err != nil {
+		return ProviderSessionProjection{}, err
+	}
+	if request.AgentConfiguration.SystemPrompt != "" {
+		return ProviderSessionProjection{}, fmt.Errorf("copilot ACP runtime cannot exactly enforce Agent systemPrompt")
+	}
+	if request.AgentConfiguration.ReasoningEffort != "" {
+		return ProviderSessionProjection{}, fmt.Errorf("copilot ACP runtime cannot enforce reasoning effort")
+	}
+	projection := ProviderSessionProjection{}
+	if policy.unrestricted {
+		return projection, nil
+	}
+	if policy.allows(providerToolWebSearch) {
+		return ProviderSessionProjection{}, fmt.Errorf("copilot ACP runtime cannot exactly enforce the WebSearch provider-native tool")
+	}
+	excluded := append([]string(nil), copilotAlwaysExcludedToolIDs...)
+	for _, name := range providerNativeToolNames {
+		if policy.allows(name) {
+			continue
+		}
+		excluded = append(excluded, copilotToolIDs[name]...)
+	}
+	projection.AdditionalArgs = []string{"--excluded-tools=" + strings.Join(excluded, ",")}
+	return projection, nil
+}
+
+func openCodeSessionProjection(
+	request harnessv2.CreateRuntimeSessionRequest,
+	_ acp.SessionPaths,
+	_ ProviderProxyBinding,
+	model string,
+) (ProviderSessionProjection, error) {
+	if request.AgentConfiguration == nil {
+		return ProviderSessionProjection{}, fmt.Errorf("agent session configuration is required")
+	}
+	if err := request.MCPConfiguration.ValidateProfile(request.Profile); err != nil {
+		return ProviderSessionProjection{}, fmt.Errorf("MCP policy configuration: %w", err)
+	}
+	if err := request.AgentConfiguration.ValidateProfileOrLegacy(
+		request.Profile,
+		request.MCPConfiguration.ToolPolicy.AllowBash,
+	); err != nil {
+		return ProviderSessionProjection{}, fmt.Errorf("agent session configuration: %w", err)
+	}
+	if request.Profile.ProviderKind != providerKindOpencode ||
+		request.AgentConfiguration.ProviderKind != providerKindOpencode ||
+		request.Profile.Model != model || request.AgentConfiguration.Model != model {
+		return ProviderSessionProjection{}, fmt.Errorf("provider session configuration does not match runtime profile")
+	}
+	if request.AgentConfiguration.SystemPrompt != "" {
+		return ProviderSessionProjection{}, fmt.Errorf("opencode ACP runtime cannot exactly enforce Agent systemPrompt")
+	}
+	if request.AgentConfiguration.ReasoningEffort != "" {
+		return ProviderSessionProjection{}, fmt.Errorf("opencode ACP runtime cannot enforce reasoning effort")
+	}
+	for _, descriptor := range request.MCPConfiguration.ToolPolicy.Tools {
+		if descriptor.Source != harnessv2.MCPToolSourceProviderNative {
+			continue
+		}
+		switch strings.ToLower(strings.TrimSpace(descriptor.Name)) {
+		case "apply_patch", "bash", "edit", "glob", "grep", "read", "write":
+		default:
+			return ProviderSessionProjection{}, fmt.Errorf(
+				"provider-native tool %q is not supported by the opencode projection",
+				descriptor.Name,
+			)
+		}
+	}
+	return ProviderSessionProjection{}, nil
+}
+
+func providerProfile(
+	kind, model string, intent harnessv2.WorkspaceIntent,
+	modelLimitOptions ...*harnessv2.ModelTokenLimits,
+) (ProviderProfile, error) {
+	var modelLimits *harnessv2.ModelTokenLimits
+	if len(modelLimitOptions) > 0 {
+		modelLimits = modelLimitOptions[0]
+	}
+	switch kind {
+	case providerKindCodex:
+		return ProviderProfile{
+			Kind: kind, Model: model, Command: "/usr/bin/node", Args: []string{"/opt/codex-acp/dist/index.js"},
+			AuthMethodID: "api-key", AdapterName: "codex-acp-orka-dist", AdapterDigest: "sha256:" + acp.CodexACPOrkaDistSHA256,
+			ProjectSession: func(request harnessv2.CreateRuntimeSessionRequest, paths acp.SessionPaths, proxy ProviderProxyBinding) (ProviderSessionProjection, error) {
+				return codexSessionProjection(request, paths, proxy, model)
+			},
+			EnvironmentForSession: func(_ harnessv2.CreateRuntimeSessionRequest, paths acp.SessionPaths, proxy ProviderProxyBinding) (map[string]string, error) {
+				// The Orka-patched adapter uses Codex's externalSandbox policy so the
+				// restricted Runtime Pod remains the enforcement boundary without asking
+				// the child to create nested Linux namespaces. Network remains restricted
+				// and on-request approvals remain active for explicit elevation requests.
+				mode := codexAgentModeOrkaExternal
+				config, err := json.Marshal(map[string]any{
+					"model": model, "openai_base_url": proxy.BaseURL, "check_for_update_on_startup": false,
+				})
+				if err != nil {
+					return nil, err
+				}
+				return map[string]string{
+					"NO_BROWSER": "1", "CODEX_PATH": "/opt/codex/bin/codex", "CODEX_HOME": filepath.Join(paths.Home, ".codex"),
+					"CODEX_CONFIG": string(config), "INITIAL_AGENT_MODE": mode, "CODEX_API_KEY": proxy.Credential,
+				}, nil
+			},
+			PrepareSession: prepareCodexHome,
+		}, nil
+	case providerKindClaude:
+		return ProviderProfile{
+			Kind: kind, Model: model, Command: "/usr/bin/node", Args: []string{"/opt/claude-agent-acp/dist/index.js", "--hide-claude-auth"},
+			AdapterName: "claude-agent-acp", AdapterDigest: "sha256:" + acp.ClaudeACPTarSHA256,
+			ProjectSession: func(request harnessv2.CreateRuntimeSessionRequest, paths acp.SessionPaths, proxy ProviderProxyBinding) (ProviderSessionProjection, error) {
+				return claudeSessionProjection(request, paths, proxy, model)
+			},
+			EnvironmentForSession: func(_ harnessv2.CreateRuntimeSessionRequest, paths acp.SessionPaths, proxy ProviderProxyBinding) (map[string]string, error) {
+				return map[string]string{
+					"CLAUDE_CONFIG_DIR": filepath.Join(paths.Home, ".claude"), "CLAUDE_CODE_EXECUTABLE": "/opt/claude/bin/claude",
+					"NO_BROWSER": "1", "DISABLE_UPDATES": "1", "DISABLE_AUTOUPDATER": "1", "DISABLE_INSTALLATION_CHECKS": "1",
+					"ANTHROPIC_BASE_URL": proxy.BaseURL, "ANTHROPIC_API_KEY": proxy.Credential, "ANTHROPIC_MODEL": model,
+				}, nil
+			},
+		}, nil
+	case providerKindCopilot:
+		adapterName, adapterDigest, err := copilotAdapterIdentity(runtime.GOARCH)
+		if err != nil {
+			return ProviderProfile{}, err
+		}
+		return ProviderProfile{
+			Kind: kind, Model: model, Command: "/opt/copilot/bin/copilot",
+			Args:        []string{"--acp", "--stdio", "--no-auto-update", "--disable-builtin-mcps", "--no-custom-instructions", "--no-experimental", "--no-remote", "--no-remote-export", "--no-ask-user", "--no-bash-env", "--disallow-temp-dir", "--no-color", "--log-level", "none"},
+			AdapterName: adapterName, AdapterDigest: adapterDigest,
+			ProjectSession: func(request harnessv2.CreateRuntimeSessionRequest, paths acp.SessionPaths, proxy ProviderProxyBinding) (ProviderSessionProjection, error) {
+				return copilotSessionProjection(request, paths, proxy, model)
+			},
+			EnvironmentForSession: func(_ harnessv2.CreateRuntimeSessionRequest, paths acp.SessionPaths, proxy ProviderProxyBinding) (map[string]string, error) {
+				return map[string]string{
+					"COPILOT_AUTO_UPDATE": "false", "CI": "true", "COPILOT_HOME": filepath.Join(paths.Home, ".copilot"),
+					"COPILOT_PROVIDER_BASE_URL": proxy.BaseURL, "COPILOT_PROVIDER_BEARER_TOKEN": proxy.Credential, "COPILOT_PROVIDER_TYPE": "openai",
+					"COPILOT_PROVIDER_WIRE_API": "responses", "COPILOT_MODEL": model,
+				}, nil
+			},
+		}, nil
+	case providerKindOpencode:
+		if modelLimits == nil {
+			return ProviderProfile{}, fmt.Errorf("OpenCode model token limits are required")
+		}
+		if err := modelLimits.Validate(); err != nil {
+			return ProviderProfile{}, fmt.Errorf("OpenCode model token limits: %w", err)
+		}
+		if strings.ContainsAny(model, "{}") {
+			return ProviderProfile{}, fmt.Errorf("OpenCode model must not contain substitution braces")
+		}
+		providerID, modelID, valid := strings.Cut(strings.TrimSpace(model), "/")
+		if !valid || strings.TrimSpace(providerID) == "" || strings.TrimSpace(modelID) == "" {
+			return ProviderProfile{}, fmt.Errorf("OpenCode model must use provider/model form")
+		}
+		return ProviderProfile{
+			Kind: kind, Model: model, Command: "/opt/opencode/bin/opencode",
+			Args:        []string{"--pure", "acp", "--hostname", "127.0.0.1", "--port", "0", "--no-mdns"},
+			AdapterName: openCodeAdapterName(), AdapterDigest: openCodeAdapterDigest(),
+			ProjectSession: func(request harnessv2.CreateRuntimeSessionRequest, paths acp.SessionPaths, proxy ProviderProxyBinding) (ProviderSessionProjection, error) {
+				return openCodeSessionProjection(request, paths, proxy, model)
+			},
+			EnvironmentForSession: func(request harnessv2.CreateRuntimeSessionRequest, paths acp.SessionPaths, proxy ProviderProxyBinding) (map[string]string, error) {
+				// The credential below is not an upstream provider secret. It is a random,
+				// per-session loopback capability accepted only while the prompt lease is active
+				// and only for the immutable profile model. OpenCode needs it during provider
+				// construction; write-intent shells share the child environment by design, as
+				// with the other built-in runtimes, while read-intent sessions disable bash.
+				config, err := openCodeSessionConfig(model, modelLimits, intent, request, paths, proxy)
+				if err != nil {
+					return nil, err
+				}
+				return map[string]string{
+					"CI":                                        "true",
+					"NO_BROWSER":                                "1",
+					"OPENCODE_AUTH_CONTENT":                     "{}",
+					"OPENCODE_CONFIG_CONTENT":                   string(config),
+					"OPENCODE_CONFIG_DIR":                       filepath.Join(paths.Config, "opencode"),
+					"OPENCODE_DISABLE_AUTOUPDATE":               "1",
+					"OPENCODE_DISABLE_CLAUDE_CODE":              "1",
+					"OPENCODE_DISABLE_DEFAULT_PLUGINS":          "1",
+					"OPENCODE_DISABLE_EMBEDDED_WEB_UI":          "1",
+					"OPENCODE_DISABLE_EXTERNAL_SKILLS":          "1",
+					"OPENCODE_DISABLE_LSP_DOWNLOAD":             "1",
+					"OPENCODE_DISABLE_MODELS_FETCH":             "1",
+					"OPENCODE_DISABLE_PROJECT_CONFIG":           "1",
+					"OPENCODE_EXPERIMENTAL_DISABLE_FILEWATCHER": "1",
+					"OPENCODE_PURE":                             "1",
+					"OPENCODE_SERVER_PASSWORD":                  openCodeServerPassword(proxy.Credential),
+					"OPENCODE_SERVER_USERNAME":                  "orka",
+					openCodeProviderEnvName:                     proxy.Credential,
+				}, nil
+			},
+			PrepareSession: prepareOpenCodeConfig,
+		}, nil
+	default:
+		return ProviderProfile{}, fmt.Errorf("unsupported ACP provider %q", kind)
+	}
+}
+
+func prepareOpenCodeConfig(paths acp.SessionPaths) error {
+	configDir := filepath.Join(paths.Config, "opencode")
+	if err := os.MkdirAll(filepath.Join(configDir, "node_modules"), 0o700); err != nil {
+		return err
+	}
+	files := map[string][]byte{
+		"package.json": fmt.Appendf(nil,
+			"{\n  \"private\": true,\n  \"dependencies\": {\n    \"@opencode-ai/plugin\": %q\n  }\n}\n",
+			acp.OpenCodeVersion,
+		),
+		"package-lock.json": fmt.Appendf(nil,
+			"{\n  \"name\": \"orka-opencode-runtime\",\n  \"lockfileVersion\": 3,\n  \"requires\": true,\n  \"packages\": {\n    \"\": {\n      \"dependencies\": {\n        \"@opencode-ai/plugin\": %q\n      }\n    }\n  }\n}\n",
+			acp.OpenCodeVersion,
+		),
+	}
+	for name, data := range files {
+		if err := os.WriteFile(filepath.Join(configDir, name), data, 0o600); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func openCodeSessionConfig(
+	model string,
+	modelLimits *harnessv2.ModelTokenLimits,
+	intent harnessv2.WorkspaceIntent,
+	request harnessv2.CreateRuntimeSessionRequest,
+	paths acp.SessionPaths,
+	proxy ProviderProxyBinding,
+) ([]byte, error) {
+	if modelLimits == nil {
+		return nil, fmt.Errorf("OpenCode model token limits are required")
+	}
+	if err := modelLimits.Validate(); err != nil {
+		return nil, fmt.Errorf("OpenCode model token limits: %w", err)
+	}
+	providerID, modelID, ok := strings.Cut(strings.TrimSpace(model), "/")
+	if !ok || providerID == "" || modelID == "" {
+		return nil, fmt.Errorf("OpenCode model must use provider/model form")
+	}
+	model = providerID + "/" + modelID
+	toolPolicy := request.MCPConfiguration.ToolPolicy
+	permissions := map[string]any{
+		"*":                  openCodePermissionDeny,
+		"doom_loop":          openCodePermissionDeny,
+		"external_directory": openCodePermissionDeny,
+		"list":               openCodePermissionDeny,
+		"lsp":                openCodePermissionDeny,
+		"question":           openCodePermissionDeny,
+		"skill":              openCodePermissionDeny,
+		"task":               openCodePermissionDeny,
+		"todowrite":          openCodePermissionDeny,
+		"webfetch":           openCodePermissionDeny,
+		"websearch":          openCodePermissionDeny,
+	}
+	for _, permission := range []string{"bash", "glob", "grep", "read"} {
+		if openCodeToolPolicyAllows(toolPolicy, permission) {
+			permissions[permission] = openCodePermissionAllow
+		} else {
+			permissions[permission] = openCodePermissionDeny
+		}
+	}
+	mutationAction := openCodePermissionDeny
+	if openCodeMutationPolicyAllows(toolPolicy) {
+		mutationAction = openCodePermissionAllow
+	}
+	for _, permission := range []string{"apply_patch", "edit", "write"} {
+		permissions[permission] = mutationAction
+	}
+	brokeredPermissions, err := openCodeBrokeredPermissions(toolPolicy)
+	if err != nil {
+		return nil, err
+	}
+	for permission, allowed := range brokeredPermissions {
+		if allowed {
+			permissions[permission] = openCodePermissionAllow
+		} else {
+			permissions[permission] = openCodePermissionDeny
+		}
+	}
+	if permissions["read"] == openCodePermissionAllow {
+		permissions["read"] = map[string]string{
+			"*":             openCodePermissionAllow,
+			"*.env":         openCodePermissionDeny,
+			"*.env.*":       openCodePermissionDeny,
+			"*.env.example": openCodePermissionAllow,
+		}
+	}
+	if intent == harnessv2.WorkspaceIntentRead {
+		permissions["apply_patch"] = openCodePermissionDeny
+		permissions["bash"] = openCodePermissionDeny
+		permissions["edit"] = openCodePermissionDeny
+		permissions["grep"] = openCodePermissionDeny
+		permissions["write"] = openCodePermissionDeny
+	}
+	return json.Marshal(map[string]any{
+		"$schema":           "https://opencode.ai/config.json",
+		"autoupdate":        false,
+		"enabled_providers": []string{openCodeProviderID},
+		"formatter":         false,
+		"instructions":      []string{openCodeRootInstructionPath, filepath.Join(paths.Workspace, "AGENTS.md")},
+		"lsp":               false,
+		"mcp":               map[string]any{},
+		"model":             openCodeProviderID + "/" + model,
+		"permission":        permissions,
+		"plugin":            []string{},
+		"share":             "disabled",
+		"small_model":       openCodeProviderID + "/" + model,
+		"snapshot":          false,
+		"subagent_depth":    0,
+		"provider": map[string]any{
+			openCodeProviderID: map[string]any{
+				"env":       []string{},
+				"name":      "Orka session proxy",
+				"npm":       "@ai-sdk/openai-compatible",
+				"whitelist": []string{model},
+				"models": map[string]any{
+					model: map[string]any{
+						"limit": map[string]int64{
+							"context": modelLimits.Context,
+							"output":  modelLimits.Output,
+						},
+					},
+				},
+				"options": map[string]any{
+					"apiKey":  "{env:" + openCodeProviderEnvName + "}",
+					"baseURL": proxy.BaseURL,
+				},
+			},
+		},
+	})
+}
+
+func openCodeBrokeredPermissions(policy harnessv2.MCPToolPolicy) (map[string]bool, error) {
+	permissions := make(map[string]bool)
+	owners := make(map[string]string)
+	for _, descriptor := range policy.Tools {
+		if !descriptor.Source.Brokered() {
+			continue
+		}
+		// OpenCode prefixes tools from the controller MCP server with `orka_`,
+		// keeping brokered permissions disjoint from unprefixed native keys.
+		name := "orka_" + strings.Map(func(value rune) rune {
+			if value >= 'a' && value <= 'z' || value >= 'A' && value <= 'Z' ||
+				value >= '0' && value <= '9' || value == '_' || value == '-' {
+				return value
+			}
+			return '_'
+		}, descriptor.Name)
+		if owner, exists := owners[name]; exists && owner != descriptor.Name {
+			return nil, fmt.Errorf("brokered tools %q and %q collide in OpenCode permission name %q", owner, descriptor.Name, name)
+		}
+		owners[name] = descriptor.Name
+		permissions[name] = openCodeToolPolicyAllows(policy, descriptor.Name)
+	}
+	return permissions, nil
+}
+
+// openCodeMutationPolicyAllows consumes the controller-normalized mutation
+// group. Any denied alias closes the entire shared OpenCode edit permission.
+func openCodeMutationPolicyAllows(policy harnessv2.MCPToolPolicy) bool {
+	mutationPermissions := []string{"apply_patch", "edit", "write"}
+	for _, denied := range policy.DisallowedToolNames {
+		for _, permission := range mutationPermissions {
+			if strings.EqualFold(denied, permission) {
+				return false
+			}
+		}
+	}
+	for _, permission := range mutationPermissions {
+		if openCodeToolPolicyAllows(policy, permission) {
+			return true
+		}
+	}
+	return false
+}
+
+func openCodeToolPolicyAllows(policy harnessv2.MCPToolPolicy, permission string) bool {
+	for _, denied := range policy.DisallowedToolNames {
+		if strings.EqualFold(denied, permission) {
+			return false
+		}
+	}
+	for _, allowed := range policy.AllowedToolNames {
+		if strings.EqualFold(allowed, permission) && policy.Allows(allowed) {
+			return true
+		}
+	}
+	return false
+}
+
+func openCodeServerPassword(credential string) string {
+	digest := sha256.Sum256([]byte("orka-opencode-server\x00" + credential))
+	return fmt.Sprintf("%x", digest[:])
+}
+
+func openCodeAdapterName() string {
+	if runtime.GOARCH == architectureARM64 {
+		return "opencode-cli-linux-arm64"
+	}
+	return "opencode-cli-linux-amd64"
+}
+
+func openCodeAdapterDigest() string {
+	if runtime.GOARCH == architectureARM64 {
+		return "sha256:" + acp.OpenCodeLinuxARM64BinarySHA256
+	}
+	return "sha256:" + acp.OpenCodeLinuxX64BinarySHA256
+}
+
+func prepareCodexHome(paths acp.SessionPaths) error {
+	dir := filepath.Join(paths.Home, ".codex")
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		return err
+	}
+	return os.WriteFile(filepath.Join(dir, "config.toml"), []byte("check_for_update_on_startup = false\n"), 0o600)
+}
+
+func openAIProxyURL(base string) string {
+	base = strings.TrimSuffix(strings.TrimSpace(base), "/")
+	if strings.HasSuffix(base, "/v1") {
+		return base
+	}
+	return base + "/v1"
+}
+
+func defaultProxyBaseURL() string {
+	return "http://vekil.vekil-system.svc:1337"
+}
+
+func providerUpstreamBaseURL(provider, base string) string {
+	base = strings.TrimSuffix(strings.TrimSpace(base), "/")
+	if provider == providerKindCodex || provider == providerKindCopilot || provider == providerKindOpencode {
+		return openAIProxyURL(base)
+	}
+	return base
+}
+
+func copilotAdapterIdentity(goarch string) (string, string, error) {
+	switch goarch {
+	case "amd64":
+		return "copilot-cli-linux-amd64", "sha256:" + acp.CopilotCLILinuxX64SHA256, nil
+	case "arm64":
+		return "copilot-cli-linux-arm64", "sha256:" + acp.CopilotCLILinuxARM64SHA256, nil
+	default:
+		return "", "", fmt.Errorf("unsupported Copilot runtime architecture %q", goarch)
+	}
+}
+
+func defaultProtocolLimits(provider string) harnessv2.ProtocolLimits {
+	maxUpdates := harnessv2.DefaultMaxUpdateEventsPerSecond
+	if provider == providerKindCodex {
+		maxUpdates = runtimeCodexMaxUpdateEventsPerSecond
+	}
+	return harnessv2.ProtocolLimits{
+		MaxResidentSessions: 10, MaxConcurrentPrompts: 4, MaxRequestBytes: 2 << 20,
+		MaxEventLineBytes: 1 << 20, MaxTerminalResultBytes: 1 << 20, MaxBufferedEvents: 256,
+		MaxUpdateEventsPerSecond: maxUpdates, MinPromptLeaseMillis: 5_000, MaxPromptLeaseMillis: 120_000,
+		MaxPendingPermissions: 32, MaxWorkspaceDeltaBytes: defaultWorkspaceDeltaUploadBytes,
+	}
+}
+
+func workspaceArtifactDownloadLimitFromEnv() (int64, error) {
+	raw := strings.TrimSpace(os.Getenv(EnvWorkspaceArtifactMaxBytes))
+	if raw == "" {
+		return 0, fmt.Errorf("%s is required when the artifact API is configured", EnvWorkspaceArtifactMaxBytes)
+	}
+	limit, err := strconv.ParseInt(raw, 10, 64)
+	if err != nil || limit <= 0 {
+		return 0, fmt.Errorf("%s must be a positive integer", EnvWorkspaceArtifactMaxBytes)
+	}
+	return limit, nil
+}
+
+func requiredEnv(name string) string { return strings.TrimSpace(os.Getenv(name)) }
+func envDefault(name, fallback string) string {
+	if value := strings.TrimSpace(os.Getenv(name)); value != "" {
+		return value
+	}
+	return fallback
+}
+
+func modelTokenLimitsFromEnv() (*harnessv2.ModelTokenLimits, error) {
+	contextValue := strings.TrimSpace(os.Getenv(EnvModelContextLimit))
+	outputValue := strings.TrimSpace(os.Getenv(EnvModelOutputLimit))
+	if contextValue == "" && outputValue == "" {
+		return nil, nil
+	}
+	if contextValue == "" || outputValue == "" {
+		return nil, fmt.Errorf("%s and %s must be set together", EnvModelContextLimit, EnvModelOutputLimit)
+	}
+	contextLimit, err := strconv.ParseInt(contextValue, 10, 64)
+	if err != nil {
+		return nil, fmt.Errorf("%s must be an integer", EnvModelContextLimit)
+	}
+	outputLimit, err := strconv.ParseInt(outputValue, 10, 64)
+	if err != nil {
+		return nil, fmt.Errorf("%s must be an integer", EnvModelOutputLimit)
+	}
+	limits := &harnessv2.ModelTokenLimits{Context: contextLimit, Output: outputLimit}
+	if err := limits.Validate(); err != nil {
+		return nil, fmt.Errorf("model token limits: %w", err)
+	}
+	return limits, nil
+}
+
+func parsePositiveUint(name, value string) (uint64, error) {
+	parsed, err := strconv.ParseUint(value, 10, 64)
+	if err != nil || parsed == 0 {
+		return 0, fmt.Errorf("%s must be a positive integer", name)
+	}
+	return parsed, nil
+}
+
+func parsePositiveInt(name, value string) (int, error) {
+	parsed, err := strconv.Atoi(value)
+	if err != nil || parsed <= 0 {
+		return 0, fmt.Errorf("%s must be a positive integer", name)
+	}
+	return parsed, nil
+}
+
+func readRequiredSecretFile(envName string) (string, error) {
+	path := requiredEnv(envName)
+	if path == "" || !filepath.IsAbs(path) {
+		return "", fmt.Errorf("%s must name an absolute file", envName)
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return "", fmt.Errorf("read %s: %w", envName, err)
+	}
+	value := strings.TrimSpace(string(data))
+	if value == "" {
+		return "", fmt.Errorf("%s file is empty", envName)
+	}
+	return value, nil
+}
diff --git a/workers/acp/supervisor/env_artifact_client_limits_test.go b/workers/acp/supervisor/env_artifact_client_limits_test.go
new file mode 100644
index 000000000..555e7258c
--- /dev/null
+++ b/workers/acp/supervisor/env_artifact_client_limits_test.go
@@ -0,0 +1,128 @@
+package supervisor
+
+import (
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/orka-agents/orka/internal/artifactcap"
+)
+
+func TestLoadConfigFromEnvConfiguresInboundPublisherAndOutboundDeltaLimits(t *testing.T) {
+	t.Run("controller propagated default", func(t *testing.T) {
+		setArtifactClientSupervisorEnv(t)
+
+		cfg, client := loadArtifactClientConfigFromEnv(t)
+		if client.maxDownloadBytes != defaultWorkspaceArtifactDownloadBytes {
+			t.Fatalf("inbound workspace artifact limit = %d, want propagated default %d", client.maxDownloadBytes, defaultWorkspaceArtifactDownloadBytes)
+		}
+		if client.maxUploadBytes != cfg.Capabilities.Limits.MaxWorkspaceDeltaBytes {
+			t.Fatalf("outbound delta upload limit = %d, want advertised %d", client.maxUploadBytes, cfg.Capabilities.Limits.MaxWorkspaceDeltaBytes)
+		}
+	})
+
+	t.Run("raised Publisher capability propagated by controller", func(t *testing.T) {
+		setArtifactClientSupervisorEnv(t)
+		raised := defaultWorkspaceArtifactDownloadBytes + 2<<20
+		t.Setenv(EnvWorkspaceArtifactMaxBytes, strconv.FormatInt(raised, 10))
+
+		cfg, client := loadArtifactClientConfigFromEnv(t)
+		if client.maxDownloadBytes != raised {
+			t.Fatalf("inbound workspace artifact limit = %d, want propagated Publisher capability %d", client.maxDownloadBytes, raised)
+		}
+		if client.maxUploadBytes != cfg.Capabilities.Limits.MaxWorkspaceDeltaBytes || client.maxUploadBytes == raised {
+			t.Fatalf("outbound delta upload limit = %d, advertised=%d, inbound=%d", client.maxUploadBytes, cfg.Capabilities.Limits.MaxWorkspaceDeltaBytes, raised)
+		}
+	})
+}
+
+func TestLoadConfigFromEnvRejectsMissingOrInvalidWorkspaceArtifactLimit(t *testing.T) {
+	tests := []struct {
+		name  string
+		value string
+		want  string
+	}{
+		{name: "missing", value: "", want: "is required"},
+		{name: "zero", value: "0", want: "positive integer"},
+		{name: "negative", value: "-1", want: "positive integer"},
+		{name: "malformed", value: "large", want: "positive integer"},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			setArtifactClientSupervisorEnv(t)
+			t.Setenv(EnvWorkspaceArtifactMaxBytes, test.value)
+			if _, err := LoadConfigFromEnv(); err == nil || !strings.Contains(err.Error(), test.want) {
+				t.Fatalf("LoadConfigFromEnv() error = %v, want %q", err, test.want)
+			}
+		})
+	}
+}
+
+func loadArtifactClientConfigFromEnv(t *testing.T) (Config, *ArtifactClient) {
+	t.Helper()
+	cfg, err := LoadConfigFromEnv()
+	if err != nil {
+		t.Fatal(err)
+	}
+	materializer, ok := cfg.WorkspaceMaterializer.(*remoteWorkspaceMaterializer)
+	if !ok {
+		t.Fatalf("workspace materializer type = %T", cfg.WorkspaceMaterializer)
+	}
+	uploader, ok := cfg.ArtifactUploader.(*remoteArtifactUploader)
+	if !ok {
+		t.Fatalf("artifact uploader type = %T", cfg.ArtifactUploader)
+	}
+	if uploader.client != materializer.client {
+		t.Fatal("workspace materializer and uploader do not share the configured artifact client")
+	}
+	return cfg, materializer.client
+}
+
+func setArtifactClientSupervisorEnv(t *testing.T) {
+	t.Helper()
+	dir := t.TempDir()
+	controllerFile := filepath.Join(dir, "controller-auth")
+	capabilityFile := filepath.Join(dir, "capability-auth")
+	providerFile := filepath.Join(dir, "provider-auth")
+	for path, value := range map[string]string{
+		controllerFile: artifactcap.DigestBytes([]byte("controller test credential")),
+		capabilityFile: artifactcap.DigestBytes([]byte("capability test credential")),
+		providerFile:   artifactcap.DigestBytes([]byte("provider test credential")),
+	} {
+		if err := os.WriteFile(path, []byte(value), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for name, value := range map[string]string{
+		EnvRuntimeInstanceID:        "runtime-instance",
+		EnvSupervisorBootID:         "boot",
+		EnvControllerEpoch:          "1",
+		EnvRuntimePoolUID:           "pool-uid",
+		EnvRuntimePoolGeneration:    "1",
+		EnvProvider:                 providerKindCodex,
+		EnvModel:                    "gpt-test",
+		EnvWorkspaceIntent:          "read",
+		EnvAgentConfigurationDigest: artifactcap.DigestBytes([]byte("agent")),
+		EnvToolPolicyDigest:         artifactcap.DigestBytes([]byte("tool")),
+		EnvApprovalPolicyDigest:     artifactcap.DigestBytes([]byte("approval")),
+		EnvMCPConfigurationDigest:   artifactcap.DigestBytes([]byte("mcp")),
+		EnvProxyCredentialRole:      "provider",
+		EnvProxyCredentialScope:     "model:gpt-test",
+		EnvResourceClass:            "standard",
+		EnvControllerTokenFile:      controllerFile,
+		EnvCapabilitySecretFile:     capabilityFile,
+		EnvProviderTokenFile:        providerFile,
+		EnvArtifactAPIURL:           "http://127.0.0.1:1",
+		EnvMCPBrokerURL:             "http://127.0.0.1:1",
+		EnvTrustNamespace:           "default",
+		EnvSessionBaseDir:           filepath.Join(dir, "sessions"),
+		EnvFirstSessionUID:          "20000",
+		EnvLastSessionUID:           "20010",
+		EnvSessionGID:               "20000",
+	} {
+		t.Setenv(name, value)
+	}
+	t.Setenv(EnvWorkspaceArtifactMaxBytes, strconv.FormatInt(defaultWorkspaceArtifactDownloadBytes, 10))
+}
diff --git a/workers/acp/supervisor/env_test.go b/workers/acp/supervisor/env_test.go
new file mode 100644
index 000000000..4af9522f0
--- /dev/null
+++ b/workers/acp/supervisor/env_test.go
@@ -0,0 +1,544 @@
+package supervisor
+
+import (
+	"encoding/json"
+	"maps"
+	"os"
+	"path/filepath"
+	"runtime"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/orka-agents/orka/internal/acp"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+func TestProviderProfilesDisableUpdatesAndUsePrivateHomes(t *testing.T) {
+	paths := acp.SessionPaths{Home: "/sessions/private/home"}
+	request := harnessv2.CreateRuntimeSessionRequest{}
+	proxy := ProviderProxyBinding{BaseURL: "http://127.0.0.1:43210/_orka/provider/session", Credential: "local-session-credential"}
+
+	codex, err := providerProfile(providerKindCodex, "gpt-test", harnessv2.WorkspaceIntentRead)
+	if err != nil {
+		t.Fatal(err)
+	}
+	codexEnv, err := codex.EnvironmentForSession(request, paths, proxy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if codexEnv["NO_BROWSER"] != "1" || codexEnv["CODEX_HOME"] != "/sessions/private/home/.codex" || !strings.Contains(codexEnv["CODEX_CONFIG"], proxy.BaseURL) || codexEnv["CODEX_API_KEY"] != proxy.Credential {
+		t.Fatalf("unexpected Codex environment: %#v", codexEnv)
+	}
+	var codexConfig map[string]any
+	if err := json.Unmarshal([]byte(codexEnv["CODEX_CONFIG"]), &codexConfig); err != nil {
+		t.Fatal(err)
+	}
+	if codexConfig["model"] != "gpt-test" {
+		t.Fatalf("Codex model config = %#v, want gpt-test", codexConfig["model"])
+	}
+	if strings.Contains(strings.Join(codex.Args, " "), "npx") {
+		t.Fatalf("Codex runtime uses a download-on-start command: %v", codex.Args)
+	}
+
+	claude, err := providerProfile("claude", "claude-test", harnessv2.WorkspaceIntentWrite)
+	if err != nil {
+		t.Fatal(err)
+	}
+	claudeEnv, err := claude.EnvironmentForSession(request, paths, proxy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, name := range []string{"DISABLE_UPDATES", "DISABLE_AUTOUPDATER", "DISABLE_INSTALLATION_CHECKS"} {
+		if claudeEnv[name] != "1" {
+			t.Fatalf("%s = %q", name, claudeEnv[name])
+		}
+	}
+	if claudeEnv["CLAUDE_CONFIG_DIR"] != "/sessions/private/home/.claude" {
+		t.Fatalf("unexpected Claude config dir: %q", claudeEnv["CLAUDE_CONFIG_DIR"])
+	}
+	if claudeEnv["ANTHROPIC_BASE_URL"] != proxy.BaseURL || claudeEnv["ANTHROPIC_API_KEY"] != proxy.Credential ||
+		claudeEnv["ANTHROPIC_MODEL"] != "claude-test" {
+		t.Fatalf("unexpected Claude proxy environment: %#v", claudeEnv)
+	}
+
+	copilot, err := providerProfile(providerKindCopilot, "copilot-test", harnessv2.WorkspaceIntentRead)
+	if err != nil {
+		t.Fatal(err)
+	}
+	copilotEnv, err := copilot.EnvironmentForSession(request, paths, proxy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if copilotEnv["COPILOT_AUTO_UPDATE"] != "false" || !containsArg(copilot.Args, "--no-auto-update") || !containsArg(copilot.Args, "--disable-builtin-mcps") {
+		t.Fatalf("Copilot update/tool hardening missing: env=%#v args=%v", copilotEnv, copilot.Args)
+	}
+	if copilotEnv["COPILOT_PROVIDER_BASE_URL"] != proxy.BaseURL || copilotEnv["COPILOT_PROVIDER_BEARER_TOKEN"] != proxy.Credential {
+		t.Fatalf("unexpected Copilot proxy environment: %#v", copilotEnv)
+	}
+	wantAdapterName, wantAdapterDigest, err := copilotAdapterIdentity(runtime.GOARCH)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if copilot.AdapterName != wantAdapterName || copilot.AdapterDigest != wantAdapterDigest {
+		t.Fatalf("Copilot adapter identity = %s/%s, want %s/%s", copilot.AdapterName, copilot.AdapterDigest, wantAdapterName, wantAdapterDigest)
+	}
+}
+
+const testProjectionAgentUID = "agent-uid"
+
+func TestCodexProviderSessionProjection(t *testing.T) {
+	paths := acp.SessionPaths{Home: "/sessions/private/home"}
+	proxy := ProviderProxyBinding{BaseURL: "http://127.0.0.1:43210/_orka/provider/session", Credential: "test-auth-token"}
+	codex, err := providerProfile(providerKindCodex, "gpt-test", harnessv2.WorkspaceIntentRead)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := testProviderProjectionRequest(t, providerKindCodex, "gpt-test", "codex system", "high", nil, nil, true)
+	projection, err := codex.ProjectSession(request, paths, proxy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	environment, err := codex.EnvironmentForSession(request, paths, proxy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	maps.Copy(environment, projection.Environment)
+	if environment["NO_BROWSER"] != "1" || environment["CODEX_HOME"] != "/sessions/private/home/.codex" ||
+		!strings.Contains(environment["CODEX_CONFIG"], proxy.BaseURL) || environment["CODEX_API_KEY"] != proxy.Credential {
+		t.Fatalf("unexpected Codex environment: %#v", environment)
+	}
+	var config map[string]any
+	if err := json.Unmarshal([]byte(environment["CODEX_CONFIG"]), &config); err != nil {
+		t.Fatal(err)
+	}
+	if config["model"] != "gpt-test" || config["developer_instructions"] != "codex system" || config["model_reasoning_effort"] != "high" {
+		t.Fatalf("Codex config = %#v", config)
+	}
+	if strings.Contains(strings.Join(codex.Args, " "), "npx") {
+		t.Fatalf("Codex runtime uses a download-on-start command: %v", codex.Args)
+	}
+}
+
+func TestCodexProviderSessionProjectionReadOnlySurface(t *testing.T) {
+	paths := acp.SessionPaths{Home: "/sessions/private/home"}
+	proxy := ProviderProxyBinding{BaseURL: "http://127.0.0.1:43210/_orka/provider/session", Credential: "test-auth-token"}
+	codex, err := providerProfile(providerKindCodex, "gpt-test", harnessv2.WorkspaceIntentRead)
+	if err != nil {
+		t.Fatal(err)
+	}
+	surface := []string{providerToolGlob, providerToolGrep, providerToolRead}
+	request := testProviderProjectionRequest(t, providerKindCodex, "gpt-test", "", "", surface, nil, false)
+	projection, err := codex.ProjectSession(request, paths, proxy)
+	if err != nil {
+		t.Fatalf("read-only codex projection error = %v", err)
+	}
+	environment, err := codex.EnvironmentForSession(request, paths, proxy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	maps.Copy(environment, projection.Environment)
+	// Read-only sessions keep the orka-external agent mode: Codex's own
+	// sandbox needs unprivileged user namespaces the runtime Pod forbids, so
+	// the RuntimeSession boundary enforces the read-only surface instead.
+	if environment["INITIAL_AGENT_MODE"] != codexAgentModeOrkaExternal {
+		t.Fatalf("INITIAL_AGENT_MODE = %q, want orka-external", environment["INITIAL_AGENT_MODE"])
+	}
+	if !strings.Contains(environment["CODEX_CONFIG"], proxy.BaseURL) || environment["CODEX_API_KEY"] != proxy.Credential {
+		t.Fatalf("unexpected Codex environment: %#v", environment)
+	}
+
+	rejected := testProviderProjectionRequest(t, providerKindCodex, "gpt-test", "", "", []string{providerToolGlob, providerToolRead, providerToolWrite}, nil, false)
+	if _, err := codex.ProjectSession(rejected, paths, proxy); err == nil {
+		t.Fatal("restricted codex projection with Write was accepted")
+	}
+
+	writeIntent := testProviderProjectionRequest(t, providerKindCodex, "gpt-test", "", "", surface, nil, false)
+	writeIntent.Profile.WorkspaceIntent = harnessv2.WorkspaceIntentWrite
+	if _, err := codex.ProjectSession(writeIntent, paths, proxy); err == nil {
+		t.Fatal("write-intent restricted codex projection was accepted")
+	}
+}
+
+func TestClaudeProviderSessionProjection(t *testing.T) {
+	paths := acp.SessionPaths{Home: "/sessions/private/home"}
+	proxy := ProviderProxyBinding{BaseURL: "http://127.0.0.1:43210/_orka/provider/session", Credential: "test-auth-token"}
+	claude, err := providerProfile(providerKindClaude, "claude-test", harnessv2.WorkspaceIntentWrite)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := testProviderProjectionRequest(t, providerKindClaude, "claude-test", "claude system", "max", []string{providerToolRead, providerToolWebFetch}, []string{providerToolBash}, false)
+	projection, err := claude.ProjectSession(request, paths, proxy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	environment, err := claude.EnvironmentForSession(request, paths, proxy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	maps.Copy(environment, projection.Environment)
+	for _, name := range []string{"DISABLE_UPDATES", "DISABLE_AUTOUPDATER", "DISABLE_INSTALLATION_CHECKS"} {
+		if environment[name] != "1" {
+			t.Fatalf("%s = %q", name, environment[name])
+		}
+	}
+	if environment["CLAUDE_CONFIG_DIR"] != "/sessions/private/home/.claude" || environment["ANTHROPIC_BASE_URL"] != proxy.BaseURL ||
+		environment["ANTHROPIC_API_KEY"] != proxy.Credential || environment["ANTHROPIC_MODEL"] != "claude-test" {
+		t.Fatalf("unexpected Claude environment: %#v", environment)
+	}
+	if projection.NewSessionMeta["systemPrompt"] != "claude system" {
+		t.Fatalf("Claude system prompt metadata = %#v", projection.NewSessionMeta)
+	}
+	claudeCode := projection.NewSessionMeta["claudeCode"].(map[string]any)
+	options := claudeCode["options"].(map[string]any)
+	if options["maxTurns"] != int32(7) || options["effort"] != "max" || !slices.Equal(options["tools"].([]string), []string{providerToolRead, providerToolWebFetch}) ||
+		!slices.Contains(options["disallowedTools"].([]string), providerToolBash) {
+		t.Fatalf("Claude options = %#v", options)
+	}
+}
+
+func TestCopilotProviderSessionProjection(t *testing.T) {
+	paths := acp.SessionPaths{Home: "/sessions/private/home"}
+	proxy := ProviderProxyBinding{BaseURL: "http://127.0.0.1:43210/_orka/provider/session", Credential: "test-auth-token"}
+	copilot, err := providerProfile(providerKindCopilot, "copilot-test", harnessv2.WorkspaceIntentRead)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := testProviderProjectionRequest(t, providerKindCopilot, "copilot-test", "", "", []string{providerToolRead, providerToolGrep}, nil, false)
+	projection, err := copilot.ProjectSession(request, paths, proxy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	environment, err := copilot.EnvironmentForSession(request, paths, proxy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	maps.Copy(environment, projection.Environment)
+	args := append(append([]string(nil), copilot.Args...), projection.AdditionalArgs...)
+	if environment["COPILOT_AUTO_UPDATE"] != "false" || !containsArg(args, "--no-auto-update") || !containsArg(args, "--disable-builtin-mcps") {
+		t.Fatalf("Copilot update/tool hardening missing: env=%#v args=%v", environment, args)
+	}
+	if environment["COPILOT_PROVIDER_BASE_URL"] != proxy.BaseURL || environment["COPILOT_PROVIDER_BEARER_TOKEN"] != proxy.Credential {
+		t.Fatalf("unexpected Copilot proxy environment: %#v", environment)
+	}
+	excluded := strings.Split(strings.TrimPrefix(projection.AdditionalArgs[0], "--excluded-tools="), ",")
+	if !slices.Contains(excluded, "bash") || !slices.Contains(excluded, "create") || !slices.Contains(excluded, "web_search") ||
+		!slices.Contains(excluded, "edit") || !slices.Contains(excluded, "str_replace_editor") || !slices.Contains(excluded, "apply_patch") ||
+		!slices.Contains(excluded, "list_agents") || !slices.Contains(excluded, "read_agent") || !slices.Contains(excluded, "write_agent") ||
+		slices.Contains(excluded, "view") || slices.Contains(excluded, "grep") || slices.Contains(excluded, "rg") {
+		t.Fatalf("Copilot excluded tools = %v", excluded)
+	}
+	editRequest := testProviderProjectionRequest(
+		t, providerKindCopilot, "copilot-test", "", "",
+		[]string{providerToolEdit, providerToolWrite}, nil, false,
+	)
+	editProjection, err := copilot.ProjectSession(editRequest, paths, proxy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	editExcluded := strings.Split(strings.TrimPrefix(editProjection.AdditionalArgs[0], "--excluded-tools="), ",")
+	for _, allowedID := range []string{"edit", "str_replace_editor", "apply_patch", "create"} {
+		if slices.Contains(editExcluded, allowedID) {
+			t.Fatalf("Copilot excluded authorized tool alias %q: %v", allowedID, editExcluded)
+		}
+	}
+	wantAdapterName, wantAdapterDigest, err := copilotAdapterIdentity(runtime.GOARCH)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if copilot.AdapterName != wantAdapterName || copilot.AdapterDigest != wantAdapterDigest {
+		t.Fatalf("Copilot adapter identity = %s/%s, want %s/%s", copilot.AdapterName, copilot.AdapterDigest, wantAdapterName, wantAdapterDigest)
+	}
+}
+
+func TestProviderSessionProjectionFailsClosed(t *testing.T) {
+	paths := acp.SessionPaths{Home: "/sessions/private/home"}
+	proxy := ProviderProxyBinding{BaseURL: "http://127.0.0.1:43210/_orka/provider/session", Credential: "test-auth-token"}
+
+	codex, err := providerProfile(providerKindCodex, "gpt-test", harnessv2.WorkspaceIntentRead)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := codex.ProjectSession(testProviderProjectionRequest(t, providerKindCodex, "gpt-test", "", "", []string{providerToolRead}, nil, true), paths, proxy); err == nil || !strings.Contains(err.Error(), "cannot exactly enforce") {
+		t.Fatalf("Codex restricted policy error = %v", err)
+	}
+
+	copilot, err := providerProfile(providerKindCopilot, "copilot-test", harnessv2.WorkspaceIntentRead)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := copilot.ProjectSession(testProviderProjectionRequest(t, providerKindCopilot, "copilot-test", "unsupported", "", nil, nil, true), paths, proxy); err == nil || !strings.Contains(err.Error(), "systemPrompt") {
+		t.Fatalf("Copilot system prompt error = %v", err)
+	}
+	if _, err := copilot.ProjectSession(testProviderProjectionRequest(t, providerKindCopilot, "copilot-test", "", "", []string{providerToolWebSearch}, nil, true), paths, proxy); err == nil || !strings.Contains(err.Error(), providerToolWebSearch) {
+		t.Fatalf("Copilot WebSearch policy error = %v", err)
+	}
+	largeCodexPrompt := strings.Repeat("\u0001", 17<<10)
+	if _, err := codex.ProjectSession(testProviderProjectionRequest(t, providerKindCodex, "gpt-test", largeCodexPrompt, "", nil, nil, true), paths, proxy); err == nil || !strings.Contains(err.Error(), "safe environment limit") {
+		t.Fatalf("Codex oversized session configuration error = %v", err)
+	}
+}
+
+func TestProviderSessionPolicyDistinguishesOmittedAndExplicitEmptyToolPolicies(t *testing.T) {
+	tests := []struct {
+		provider string
+		model    string
+	}{
+		{provider: providerKindCodex, model: "gpt-test"},
+		{provider: providerKindClaude, model: "claude-test"},
+		{provider: providerKindCopilot, model: "copilot-test"},
+	}
+	for _, test := range tests {
+		t.Run(test.provider, func(t *testing.T) {
+			omitted := testProviderProjectionRequest(t, test.provider, test.model, "", "", nil, nil, true)
+			policy, err := providerSessionPolicy(omitted, test.provider, test.model)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !policy.unrestricted {
+				t.Fatal("omitted provider-native tool policy was not unrestricted")
+			}
+
+			explicitEmpty := testProviderProjectionRequest(t, test.provider, test.model, "", "", []string{}, nil, true)
+			policy, err = providerSessionPolicy(explicitEmpty, test.provider, test.model)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if policy.unrestricted {
+				t.Fatal("explicit-empty provider-native tool policy was unrestricted")
+			}
+
+			emptyDisallowed := testProviderProjectionRequest(t, test.provider, test.model, "", "", nil, []string{}, true)
+			policy, err = providerSessionPolicy(emptyDisallowed, test.provider, test.model)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !policy.unrestricted {
+				t.Fatal("explicit-empty disallowlist was not treated as deny-none")
+			}
+		})
+	}
+}
+
+func TestCopilotAdapterIdentity(t *testing.T) {
+	tests := []struct {
+		goarch     string
+		wantName   string
+		wantDigest string
+	}{
+		{goarch: "amd64", wantName: "copilot-cli-linux-amd64", wantDigest: "sha256:" + acp.CopilotCLILinuxX64SHA256},
+		{goarch: "arm64", wantName: "copilot-cli-linux-arm64", wantDigest: "sha256:" + acp.CopilotCLILinuxARM64SHA256},
+	}
+	for _, test := range tests {
+		t.Run(test.goarch, func(t *testing.T) {
+			name, digest, err := copilotAdapterIdentity(test.goarch)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if name != test.wantName || digest != test.wantDigest {
+				t.Fatalf("identity = %s/%s, want %s/%s", name, digest, test.wantName, test.wantDigest)
+			}
+		})
+	}
+	if _, _, err := copilotAdapterIdentity("riscv64"); err == nil {
+		t.Fatal("unsupported Copilot architecture unexpectedly accepted")
+	}
+}
+
+func TestCodexProviderProfileUsesExternalRuntimeSandbox(t *testing.T) {
+	paths := acp.SessionPaths{Home: "/sessions/private/home"}
+	proxy := ProviderProxyBinding{BaseURL: "http://127.0.0.1:43210/_orka/provider/session", Credential: "local-session-credential"}
+	for _, intent := range []harnessv2.WorkspaceIntent{harnessv2.WorkspaceIntentRead, harnessv2.WorkspaceIntentWrite} {
+		t.Run(string(intent), func(t *testing.T) {
+			profile, err := providerProfile(providerKindCodex, "gpt-test", intent)
+			if err != nil {
+				t.Fatal(err)
+			}
+			environment, err := profile.EnvironmentForSession(harnessv2.CreateRuntimeSessionRequest{}, paths, proxy)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if got := environment["INITIAL_AGENT_MODE"]; got != codexAgentModeOrkaExternal {
+				t.Fatalf("INITIAL_AGENT_MODE = %q, want orka-external", got)
+			}
+		})
+	}
+}
+
+func TestLoadConfigFromEnv(t *testing.T) {
+	dir := t.TempDir()
+	controllerToken := filepath.Join(dir, "controller-token")
+	capabilitySecret := filepath.Join(dir, "capability-secret")
+	providerToken := filepath.Join(dir, "provider-token")
+	for path, value := range map[string]string{
+		controllerToken: strings.Repeat("t", 32), capabilitySecret: strings.Repeat("s", 32), providerToken: "provider-capability",
+	} {
+		if err := os.WriteFile(path, []byte(value), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	values := map[string]string{
+		EnvPodUID: "pod-uid", EnvSupervisorBootID: "boot", EnvControllerEpoch: "1", EnvRuntimePoolUID: "pool-uid",
+		EnvRuntimePoolGeneration: "1", EnvProvider: providerKindCodex, EnvModel: "gpt-test", EnvWorkspaceIntent: "read",
+		EnvAgentConfigurationDigest: testDigest("agent"), EnvToolPolicyDigest: testDigest("tool"),
+		EnvApprovalPolicyDigest: testDigest("approval"), EnvMCPConfigurationDigest: testDigest("mcp"),
+		EnvProxyCredentialRole: "provider", EnvProxyCredentialScope: "model:gpt-test", EnvResourceClass: "standard",
+		EnvControllerTokenFile: controllerToken, EnvCapabilitySecretFile: capabilitySecret, EnvProviderTokenFile: providerToken,
+		EnvMCPBrokerURL: "http://orka-controller.orka-system.svc:8080", EnvTrustNamespace: "default",
+		EnvSessionBaseDir: filepath.Join(dir, "sessions"), EnvFirstSessionUID: "20000", EnvLastSessionUID: "20010", EnvSessionGID: "20000",
+	}
+	for name, value := range values {
+		t.Setenv(name, value)
+	}
+	cfg, err := LoadConfigFromEnv()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.Provider.Kind != providerKindCodex || cfg.Capabilities.ACPVersion != harnessv2.ACPProfileV1 || cfg.Fence.RuntimeProfileDigest == "" ||
+		cfg.Fence.RuntimeInstanceID != "pod-uid.boot" || cfg.Fence.SupervisorBootID != "boot" {
+		t.Fatalf("unexpected config: %#v", cfg)
+	}
+	if !cfg.Capabilities.SupportsAgentSessionConfiguration {
+		t.Fatal("supervisor did not advertise Agent session configuration support")
+	}
+	if cfg.Capabilities.AdapterDigests["codex-acp"] != "sha256:"+acp.CodexACPTarSHA256 ||
+		cfg.Capabilities.AdapterDigests["codex-acp-orka-patch"] != "sha256:"+acp.CodexACPOrkaPatchSHA256 ||
+		cfg.Capabilities.AdapterDigests["codex-acp-orka-dist"] != "sha256:"+acp.CodexACPOrkaDistSHA256 ||
+		cfg.Provider.AdapterName != "codex-acp-orka-dist" || cfg.Provider.AdapterDigest != "sha256:"+acp.CodexACPOrkaDistSHA256 {
+		t.Fatalf("unexpected adapter digests: capabilities=%#v provider=%#v", cfg.Capabilities.AdapterDigests, cfg.Provider)
+	}
+	if cfg.Capabilities.Limits.MaxUpdateEventsPerSecond != runtimeCodexMaxUpdateEventsPerSecond {
+		t.Fatalf("max update events per second = %d, want %d", cfg.Capabilities.Limits.MaxUpdateEventsPerSecond, runtimeCodexMaxUpdateEventsPerSecond)
+	}
+	if cfg.ProviderProxy.UpstreamBaseURL != "http://vekil.vekil-system.svc:1337/v1" {
+		t.Fatalf("unexpected provider proxy base URL: %q", cfg.ProviderProxy.UpstreamBaseURL)
+	}
+	if cfg.ProviderProxy.UpstreamBearerToken != "provider-capability" {
+		t.Fatal("provider proxy token was not loaded from the supervisor-only file")
+	}
+
+	t.Setenv(EnvProvider, providerKindCopilot)
+	copilotCfg, err := LoadConfigFromEnv()
+	if err != nil {
+		t.Fatal(err)
+	}
+	wantAdapterName, wantAdapterDigest, err := copilotAdapterIdentity(runtime.GOARCH)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if copilotCfg.Provider.Kind != providerKindCopilot || copilotCfg.Provider.AdapterName != wantAdapterName ||
+		copilotCfg.Provider.AdapterDigest != wantAdapterDigest {
+		t.Fatalf("unexpected Copilot provider: %#v", copilotCfg.Provider)
+	}
+	if copilotCfg.Capabilities.AdapterDigests["copilot-cli-linux-amd64"] != "sha256:"+acp.CopilotCLILinuxX64SHA256 ||
+		copilotCfg.Capabilities.AdapterDigests["copilot-cli-linux-arm64"] != "sha256:"+acp.CopilotCLILinuxARM64SHA256 {
+		t.Fatalf("unexpected Copilot adapter digests: %#v", copilotCfg.Capabilities.AdapterDigests)
+	}
+}
+
+func TestDefaultProtocolLimitsUseProviderSpecificUpdateRates(t *testing.T) {
+	tests := []struct {
+		provider string
+		want     int
+	}{
+		{provider: providerKindCodex, want: runtimeCodexMaxUpdateEventsPerSecond},
+		{provider: providerKindClaude, want: harnessv2.DefaultMaxUpdateEventsPerSecond},
+		{provider: providerKindCopilot, want: harnessv2.DefaultMaxUpdateEventsPerSecond},
+	}
+	for _, test := range tests {
+		t.Run(test.provider, func(t *testing.T) {
+			if got := defaultProtocolLimits(test.provider).MaxUpdateEventsPerSecond; got != test.want {
+				t.Fatalf("MaxUpdateEventsPerSecond = %d, want %d", got, test.want)
+			}
+		})
+	}
+}
+
+func TestProviderUpstreamBaseURLPreservesProviderSemantics(t *testing.T) {
+	if got := providerUpstreamBaseURL(providerKindCodex, "http://vekil:1337"); got != "http://vekil:1337/v1" {
+		t.Fatalf("Codex upstream base URL = %q", got)
+	}
+	if got := providerUpstreamBaseURL(providerKindCopilot, "http://vekil:1337/v1"); got != "http://vekil:1337/v1" {
+		t.Fatalf("Copilot upstream base URL = %q", got)
+	}
+	if got := providerUpstreamBaseURL("claude", "http://vekil:1337/"); got != "http://vekil:1337" {
+		t.Fatalf("Claude upstream base URL = %q", got)
+	}
+}
+
+func testProviderProjectionRequest(
+	t *testing.T,
+	provider string,
+	model string,
+	systemPrompt string,
+	reasoningEffort string,
+	allowed []string,
+	disallowed []string,
+	allowBash bool,
+) harnessv2.CreateRuntimeSessionRequest {
+	t.Helper()
+	allowed = slices.Clone(allowed)
+	disallowed = slices.Clone(disallowed)
+	slices.Sort(allowed)
+	slices.Sort(disallowed)
+	toolPolicy := harnessv2.MCPToolPolicy{
+		AllowedToolNames: allowed, DisallowedToolNames: disallowed, AllowBash: allowBash,
+	}
+	for _, name := range allowed {
+		if !toolPolicy.Allows(name) {
+			continue
+		}
+		if _, ok := canonicalProviderNativeToolName(name); !ok {
+			t.Fatalf("unknown provider-native test tool %q", name)
+		}
+		toolPolicy.Tools = append(toolPolicy.Tools, harnessv2.MCPToolDescriptor{
+			Name: name, Description: "provider native", Source: harnessv2.MCPToolSourceProviderNative,
+			Effect: harnessv2.MCPToolEffectReadOnly,
+		})
+	}
+	slices.SortFunc(toolPolicy.Tools, func(a, b harnessv2.MCPToolDescriptor) int { return strings.Compare(a.Name, b.Name) })
+	var err error
+	toolPolicy.DescriptorDigest, err = harnessv2.CanonicalMCPToolDescriptorDigest(toolPolicy.Tools)
+	if err != nil {
+		t.Fatal(err)
+	}
+	approval := harnessv2.MCPApprovalPolicy{}
+	configuration := harnessv2.AgentSessionConfiguration{
+		AgentUID: testProjectionAgentUID, AgentGeneration: 1, ProviderKind: provider, Model: model,
+		MaxTurns: 7, ReasoningEffort: reasoningEffort, SystemPrompt: systemPrompt,
+	}
+	agentDigest, err := harnessv2.CanonicalAgentConfigurationDigest(configuration)
+	if err != nil {
+		t.Fatal(err)
+	}
+	toolDigest, err := harnessv2.CanonicalRuntimeToolPolicyDigest(allowed, disallowed, allowBash)
+	if err != nil {
+		t.Fatal(err)
+	}
+	approvalDigest, err := harnessv2.CanonicalMCPApprovalPolicyDigest(approval)
+	if err != nil {
+		t.Fatal(err)
+	}
+	mcpDigest, err := harnessv2.CanonicalMCPConfigurationDigest(allowed)
+	if err != nil {
+		t.Fatal(err)
+	}
+	profile := harnessv2.RuntimeProfile{
+		ACPProfile: harnessv2.ACPProfileV1, AdapterDigests: map[string]string{"adapter": testDigest("adapter")},
+		ProviderKind: provider, Model: model,
+		AgentConfigurationDigest: agentDigest, ToolPolicyDigest: toolDigest, ApprovalPolicyDigest: approvalDigest,
+		MCPConfigurationDigest: mcpDigest, WorkspaceIntent: harnessv2.WorkspaceIntentRead,
+		ProxyCredentialRole: "provider", ProxyCredentialScope: "model:" + model, ResourceClass: "standard",
+	}
+	return harnessv2.CreateRuntimeSessionRequest{
+		Profile: profile, AgentConfiguration: &configuration,
+		MCPConfiguration: harnessv2.MCPPolicyConfiguration{
+			ToolPolicyDigest: toolDigest, ApprovalPolicyDigest: approvalDigest, MCPConfigurationDigest: mcpDigest,
+			ToolPolicy: toolPolicy, ApprovalPolicy: approval,
+		},
+	}
+}
+
+func containsArg(args []string, want string) bool {
+	return slices.Contains(args, want)
+}
diff --git a/workers/acp/supervisor/mapper.go b/workers/acp/supervisor/mapper.go
new file mode 100644
index 000000000..bfdf378a2
--- /dev/null
+++ b/workers/acp/supervisor/mapper.go
@@ -0,0 +1,212 @@
+package supervisor
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"github.com/orka-agents/orka/internal/acp"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+const acpUpdateToolCall = "tool_call"
+
+const (
+	maxACPToolCallTitleBytes = 1024
+	acpToolCallTitleEllipsis = "…"
+)
+
+const (
+	acpAssistantPhaseCommentary  = "commentary"
+	acpAssistantPhaseFinalAnswer = "final_answer"
+)
+
+func promptContentToACP(blocks []harnessv2.ContentBlock) ([]acp.ContentBlock, error) {
+	result := make([]acp.ContentBlock, 0, len(blocks))
+	for index, block := range blocks {
+		switch block.Type {
+		case harnessv2.ContentBlockText:
+			result = append(result, acp.Text(block.Text))
+		case harnessv2.ContentBlockResourceLink:
+			result = append(result, acp.ContentBlock{Type: "resource_link", URI: block.URI, Name: block.Name, MIMEType: block.MimeType})
+		case harnessv2.ContentBlockArtifactRef:
+			return nil, fmt.Errorf("prompt artifact reference %d must be materialized before ACP dispatch", index)
+		default:
+			return nil, fmt.Errorf("unsupported prompt content type %q", block.Type)
+		}
+	}
+	return result, nil
+}
+
+func mapACPUpdate(notification *acp.SessionNotification) (*harnessv2.UpdateEvent, string, bool, error) {
+	if notification == nil {
+		return nil, "", false, nil
+	}
+	var envelope struct {
+		SessionUpdate string                   `json:"sessionUpdate"`
+		Content       json.RawMessage          `json:"content"`
+		ToolCallID    string                   `json:"toolCallId"`
+		Title         string                   `json:"title"`
+		Kind          string                   `json:"kind"`
+		Status        harnessv2.ToolCallStatus `json:"status"`
+		Entries       []harnessv2.PlanEntry    `json:"entries"`
+		Used          uint64                   `json:"used"`
+		Size          uint64                   `json:"size"`
+	}
+	if err := json.Unmarshal(notification.Update, &envelope); err != nil {
+		return nil, "", false, fmt.Errorf("decode ACP session update: %w", err)
+	}
+	switch envelope.SessionUpdate {
+	case "agent_message_chunk":
+		var content struct {
+			Type string `json:"type"`
+			Text string `json:"text"`
+		}
+		if err := json.Unmarshal(envelope.Content, &content); err != nil {
+			return nil, "", false, fmt.Errorf("decode ACP agent message content: %w", err)
+		}
+		if content.Type != "text" || content.Text == "" {
+			return nil, "", false, nil
+		}
+		if strings.TrimSpace(content.Text) == "" {
+			return nil, content.Text, false, nil
+		}
+		return &harnessv2.UpdateEvent{
+			Kind:             harnessv2.UpdateAssistantMessageChunk,
+			AssistantMessage: &harnessv2.AssistantMessageChunk{Text: content.Text},
+		}, content.Text, true, nil
+	case acpUpdateToolCall, "tool_call_update":
+		toolCallID, err := canonicalACPToolCallID(envelope.ToolCallID)
+		if err != nil {
+			return nil, "", false, err
+		}
+		// ACP adapters may stream tool output through provider-specific fields
+		// that harness v2 deliberately does not project. A status-less update
+		// with no visible metadata would otherwise become an unbounded series of
+		// synthetic in_progress events carrying identical state.
+		if envelope.SessionUpdate == "tool_call_update" && envelope.Status == "" &&
+			envelope.Title == "" && envelope.Kind == "" {
+			return nil, "", false, nil
+		}
+		status := envelope.Status
+		if status == "" {
+			if envelope.SessionUpdate == acpUpdateToolCall {
+				status = harnessv2.ToolCallStatusPending
+			} else {
+				status = harnessv2.ToolCallStatusInProgress
+			}
+		}
+		kind := harnessv2.UpdateToolCallUpdate
+		if envelope.SessionUpdate == acpUpdateToolCall {
+			kind = harnessv2.UpdateToolCall
+		}
+		return &harnessv2.UpdateEvent{
+			Kind: kind,
+			ToolCall: &harnessv2.ToolCallUpdate{
+				ToolCallID: toolCallID, Title: boundACPToolCallTitle(envelope.Title), Kind: envelope.Kind, Status: status,
+			},
+		}, "", true, nil
+	case "plan":
+		if len(envelope.Entries) == 0 {
+			return nil, "", false, nil
+		}
+		return &harnessv2.UpdateEvent{Kind: harnessv2.UpdatePlan, Plan: &harnessv2.PlanUpdate{Entries: envelope.Entries}}, "", true, nil
+	case "usage_update":
+		return &harnessv2.UpdateEvent{Kind: harnessv2.UpdateUsage, Usage: &harnessv2.UsageUpdate{InputTokens: envelope.Used}}, "", true, nil
+	case "agent_thought_chunk", "user_message_chunk", "available_commands_update", "current_mode_update", "config_option_update", "session_info_update":
+		return nil, "", false, nil
+	default:
+		return nil, "", false, nil
+	}
+}
+
+func boundACPToolCallTitle(value string) string {
+	if len(value) <= maxACPToolCallTitleBytes {
+		return value
+	}
+	limit := maxACPToolCallTitleBytes - len(acpToolCallTitleEllipsis)
+	for limit > 0 && !utf8.RuneStart(value[limit]) {
+		limit--
+	}
+	return value[:limit] + acpToolCallTitleEllipsis
+}
+
+func acpAssistantMessagePhase(notification *acp.SessionNotification) string {
+	if notification == nil {
+		return ""
+	}
+	var envelope struct {
+		SessionUpdate string `json:"sessionUpdate"`
+		Meta          struct {
+			Codex struct {
+				Phase string `json:"phase"`
+			} `json:"codex"`
+		} `json:"_meta"`
+	}
+	if json.Unmarshal(notification.Update, &envelope) != nil || envelope.SessionUpdate != "agent_message_chunk" {
+		return ""
+	}
+	switch envelope.Meta.Codex.Phase {
+	case acpAssistantPhaseCommentary, acpAssistantPhaseFinalAnswer:
+		return envelope.Meta.Codex.Phase
+	default:
+		return ""
+	}
+}
+
+const (
+	canonicalACPToolCallIDPrefix = "tool-call-v1-sha256-"
+	canonicalACPToolCallIDDomain = "orka.acp.tool-call-id.v1\x00"
+)
+
+func canonicalACPToolCallID(value string) (string, error) {
+	if strings.TrimSpace(value) == "" {
+		return "", fmt.Errorf("ACP tool call update omitted toolCallId")
+	}
+	digest := sha256.Sum256([]byte(canonicalACPToolCallIDDomain + value))
+	return canonicalACPToolCallIDPrefix + hex.EncodeToString(digest[:]), nil
+}
+
+func mapPermission(event *acp.PermissionRequestEvent, at time.Time, ttl time.Duration) (*harnessv2.PermissionRequestedEvent, error) {
+	if event == nil {
+		return nil, fmt.Errorf("ACP permission event is required")
+	}
+	var toolCall struct {
+		ToolCallID string `json:"toolCallId"`
+		ToolName   string `json:"name"`
+		Title      string `json:"title"`
+	}
+	if err := json.Unmarshal(event.Request.ToolCall, &toolCall); err != nil {
+		return nil, fmt.Errorf("decode ACP permission tool call: %w", err)
+	}
+	toolCallID := ""
+	if strings.TrimSpace(toolCall.ToolCallID) != "" {
+		var err error
+		toolCallID, err = canonicalACPToolCallID(toolCall.ToolCallID)
+		if err != nil {
+			return nil, err
+		}
+	}
+	if strings.TrimSpace(toolCall.Title) == "" {
+		toolCall.Title = "Agent permission request"
+	}
+	options := make([]harnessv2.PermissionOption, 0, len(event.Request.Options))
+	for _, option := range event.Request.Options {
+		kind := harnessv2.PermissionOptionKind(option.Kind)
+		switch kind {
+		case harnessv2.PermissionOptionAllowOnce, harnessv2.PermissionOptionAllowAlways,
+			harnessv2.PermissionOptionRejectOnce, harnessv2.PermissionOptionRejectAlways:
+		default:
+			return nil, fmt.Errorf("unsupported ACP permission option kind %q", option.Kind)
+		}
+		options = append(options, harnessv2.PermissionOption{OptionID: option.OptionID, Name: option.Name, Kind: kind})
+	}
+	return &harnessv2.PermissionRequestedEvent{
+		RequestID: harnessv2.PermissionRequestID(event.RequestID), ToolCallID: toolCallID,
+		ToolName: toolCall.ToolName, Title: toolCall.Title, Options: options, ExpiresAt: at.Add(ttl),
+	}, nil
+}
diff --git a/workers/acp/supervisor/mapper_test.go b/workers/acp/supervisor/mapper_test.go
new file mode 100644
index 000000000..8110b7a5b
--- /dev/null
+++ b/workers/acp/supervisor/mapper_test.go
@@ -0,0 +1,439 @@
+package supervisor
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+	"unicode/utf8"
+
+	"github.com/orka-agents/orka/internal/acp"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+func TestMapACPUpdateDecodesAgentMessageContent(t *testing.T) {
+	update, text, ok, err := mapACPUpdate(&acp.SessionNotification{Update: json.RawMessage(`{
+		"sessionUpdate":"agent_message_chunk",
+		"content":{"type":"text","text":"hello"}
+	}`)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !ok || text != "hello" || update == nil || update.Kind != harnessv2.UpdateAssistantMessageChunk ||
+		update.AssistantMessage == nil || update.AssistantMessage.Text != "hello" {
+		t.Fatalf("mapped update = %#v text=%q ok=%v", update, text, ok)
+	}
+}
+
+func TestACPAssistantMessagePhaseAllowsOnlyCodexProtocolEnums(t *testing.T) {
+	tests := []struct {
+		name string
+		raw  string
+		want string
+	}{
+		{
+			name: "commentary",
+			raw:  `{"sessionUpdate":"agent_message_chunk","content":{"type":"text","text":"checking"},"_meta":{"codex":{"phase":"commentary"}}}`,
+			want: acpAssistantPhaseCommentary,
+		},
+		{
+			name: "final answer",
+			raw:  `{"sessionUpdate":"agent_message_chunk","content":{"type":"text","text":"done"},"_meta":{"codex":{"phase":"final_answer"}}}`,
+			want: acpAssistantPhaseFinalAnswer,
+		},
+		{
+			name: "unknown phase",
+			raw:  `{"sessionUpdate":"agent_message_chunk","content":{"type":"text","text":"done"},"_meta":{"codex":{"phase":"provider-private"}}}`,
+		},
+		{
+			name: "other update",
+			raw:  `{"sessionUpdate":"tool_call","toolCallId":"call-1"}`,
+		},
+		{name: "malformed", raw: `{`},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			got := acpAssistantMessagePhase(&acp.SessionNotification{Update: json.RawMessage(test.raw)})
+			if got != test.want {
+				t.Fatalf("phase = %q, want %q", got, test.want)
+			}
+		})
+	}
+	if got := acpAssistantMessagePhase(nil); got != "" {
+		t.Fatalf("nil phase = %q", got)
+	}
+}
+
+func TestMapACPUpdatePreservesWhitespaceChunkWithoutEvent(t *testing.T) {
+	update, text, ok, err := mapACPUpdate(&acp.SessionNotification{Update: json.RawMessage(`{
+		"sessionUpdate":"agent_message_chunk",
+		"content":{"type":"text","text":" \n"}
+	}`)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if ok || update != nil || text != " \n" {
+		t.Fatalf("mapped whitespace update = %#v text=%q ok=%v", update, text, ok)
+	}
+}
+
+func TestMapACPUpdateIgnoresToolCallContentArray(t *testing.T) {
+	update, text, ok, err := mapACPUpdate(&acp.SessionNotification{Update: json.RawMessage(`{
+		"sessionUpdate":"tool_call_update",
+		"toolCallId":"call-1",
+		"title":"Read LICENSE",
+		"kind":"read",
+		"status":"completed",
+		"content":[{"type":"content","content":{"type":"text","text":"tool output"}}]
+	}`)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !ok || text != "" || update == nil || update.Kind != harnessv2.UpdateToolCallUpdate || update.ToolCall == nil {
+		t.Fatalf("mapped update = %#v text=%q ok=%v", update, text, ok)
+	}
+	wantID, err := canonicalACPToolCallID("call-1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if update.ToolCall.ToolCallID != wantID || update.ToolCall.Status != harnessv2.ToolCallStatusCompleted {
+		t.Fatalf("tool call = %#v", update.ToolCall)
+	}
+}
+
+func TestMapACPUpdateIgnoresStatuslessToolOutputDelta(t *testing.T) {
+	update, text, ok, err := mapACPUpdate(&acp.SessionNotification{Update: json.RawMessage(`{
+		"sessionUpdate":"tool_call_update",
+		"toolCallId":"call-1",
+		"_meta":{"terminal_output_delta":{"terminal_id":"call-1","data":"provider output"}}
+	}`)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if ok || update != nil || text != "" {
+		t.Fatalf("mapped status-less tool output = %#v text=%q ok=%v", update, text, ok)
+	}
+}
+
+func TestMapACPUpdateRejectsStatuslessToolOutputWithoutCallID(t *testing.T) {
+	update, text, ok, err := mapACPUpdate(&acp.SessionNotification{Update: json.RawMessage(`{
+		"sessionUpdate":"tool_call_update",
+		"_meta":{"terminal_output_delta":{"data":"provider output"}}
+	}`)})
+	if err == nil || !strings.Contains(err.Error(), "omitted toolCallId") {
+		t.Fatalf("missing-ID tool output error = %v", err)
+	}
+	if ok || update != nil || text != "" {
+		t.Fatalf("mapped malformed tool output = %#v text=%q ok=%v", update, text, ok)
+	}
+}
+
+func TestMapACPUpdatePreservesToolCallLifecycleTransitions(t *testing.T) {
+	tests := []struct {
+		name       string
+		raw        string
+		wantKind   harnessv2.UpdateKind
+		wantStatus harnessv2.ToolCallStatus
+		wantTitle  string
+	}{
+		{
+			name:       "start defaults pending",
+			raw:        `{"sessionUpdate":"tool_call","toolCallId":"call-1","title":"Read repository","kind":"read"}`,
+			wantKind:   harnessv2.UpdateToolCall,
+			wantStatus: harnessv2.ToolCallStatusPending,
+			wantTitle:  "Read repository",
+		},
+		{
+			name:       "explicit in progress",
+			raw:        `{"sessionUpdate":"tool_call_update","toolCallId":"call-1","status":"in_progress"}`,
+			wantKind:   harnessv2.UpdateToolCallUpdate,
+			wantStatus: harnessv2.ToolCallStatusInProgress,
+		},
+		{
+			name:       "explicit completed",
+			raw:        `{"sessionUpdate":"tool_call_update","toolCallId":"call-1","status":"completed"}`,
+			wantKind:   harnessv2.UpdateToolCallUpdate,
+			wantStatus: harnessv2.ToolCallStatusCompleted,
+		},
+		{
+			name:       "visible metadata defaults in progress",
+			raw:        `{"sessionUpdate":"tool_call_update","toolCallId":"call-1","title":"Reading repository","kind":"read"}`,
+			wantKind:   harnessv2.UpdateToolCallUpdate,
+			wantStatus: harnessv2.ToolCallStatusInProgress,
+			wantTitle:  "Reading repository",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			update, text, ok, err := mapACPUpdate(&acp.SessionNotification{Update: json.RawMessage(test.raw)})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !ok || text != "" || update == nil || update.Kind != test.wantKind || update.ToolCall == nil ||
+				update.ToolCall.Status != test.wantStatus || update.ToolCall.Title != test.wantTitle {
+				t.Fatalf("mapped lifecycle update = %#v text=%q ok=%v", update, text, ok)
+			}
+		})
+	}
+}
+
+func TestMapACPUpdateBoundsProviderToolCallTitle(t *testing.T) {
+	exactBoundary := strings.Repeat("x", maxACPToolCallTitleBytes)
+	fullCommand := strings.Repeat("git diff --no-ext-diff && ", 64) + "go test ./..."
+	multibyte := strings.Repeat("x", maxACPToolCallTitleBytes-len(acpToolCallTitleEllipsis)-1) + "界界"
+	tests := []struct {
+		name  string
+		title string
+		want  string
+	}{
+		{name: "exact boundary is unchanged", title: exactBoundary, want: exactBoundary},
+		{
+			name:  "codex full command is bounded",
+			title: fullCommand,
+			want:  fullCommand[:maxACPToolCallTitleBytes-len(acpToolCallTitleEllipsis)] + acpToolCallTitleEllipsis,
+		},
+		{
+			name:  "multibyte cutoff remains valid UTF-8",
+			title: multibyte,
+			want:  strings.Repeat("x", maxACPToolCallTitleBytes-len(acpToolCallTitleEllipsis)-1) + acpToolCallTitleEllipsis,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			raw, err := json.Marshal(map[string]any{
+				"sessionUpdate": "tool_call",
+				"toolCallId":    "call-1",
+				"title":         test.title,
+				"kind":          "execute",
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+			update, text, ok, err := mapACPUpdate(&acp.SessionNotification{Update: raw})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !ok || text != "" || update == nil || update.ToolCall == nil {
+				t.Fatalf("mapped tool call = %#v text=%q ok=%v", update, text, ok)
+			}
+			if update.ToolCall.Title != test.want {
+				t.Fatalf("title = %q, want %q", update.ToolCall.Title, test.want)
+			}
+			if len(update.ToolCall.Title) > maxACPToolCallTitleBytes || !utf8.ValidString(update.ToolCall.Title) {
+				t.Fatalf("bounded title length = %d validUTF8=%v", len(update.ToolCall.Title), utf8.ValidString(update.ToolCall.Title))
+			}
+			if err := update.Validate(); err != nil {
+				t.Fatalf("mapped update violates harness v2: %v", err)
+			}
+		})
+	}
+}
+
+func TestMapRuntimeEventSuppressesStatuslessToolOutputBurstWithoutWeakeningRateLimit(t *testing.T) {
+	server, cfg, _ := newTestServer(t, "immediate")
+	server.cfg.Capabilities.Limits.MaxUpdateEventsPerSecond = 2
+	fence := cfg.Fence
+	fence.RuntimeSessionUID = "mapper-session-uid"
+	fence.RuntimeSessionGeneration = 1
+	newStateAndPrompt := func() (*sessionState, *promptState) {
+		return &sessionState{
+			descriptor: harnessv2.RuntimeSessionDescriptor{
+				RuntimeSessionUID: fence.RuntimeSessionUID,
+				Generation:        fence.RuntimeSessionGeneration,
+			},
+			operations:  make(map[harnessv2.OperationID]harnessv2.OperationRecord),
+			permissions: make(map[harnessv2.PermissionRequestID]permissionState),
+		}, &promptState{request: testStartPromptRequest(t, cfg, fence)}
+	}
+	mapEvent := func(prompt *promptState, state *sessionState, eventType acp.PromptEventType, update string, at time.Time) *harnessv2.Event {
+		event := acp.PromptEvent{Type: eventType, Timestamp: at}
+		if update != "" {
+			event.Update = &acp.SessionNotification{SessionID: "provider-session", Update: json.RawMessage(update)}
+		}
+		mapped, err := server.mapRuntimeEvent(state, prompt, event)
+		if err != nil {
+			t.Fatalf("map %s event: %v", eventType, err)
+		}
+		return mapped
+	}
+
+	state, prompt := newStateAndPrompt()
+	limits := eventLimits(server.cfg.Capabilities.Limits)
+	var stream bytes.Buffer
+	encoder, err := harnessv2.NewEventEncoder(&stream, limits, harnessv2.EventExpectationFromMetadata(prompt.request.Metadata))
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now().UTC()
+	acceptedEvent := func(prompt *promptState, state *sessionState) harnessv2.Event {
+		prompt.sequence = 1
+		return harnessv2.Event{
+			Protocol: harnessv2.ProtocolVersion,
+			Type:     harnessv2.EventAccepted,
+			Identity: eventIdentity(server.cfg.Fence, state.descriptor, prompt.request.Metadata, prompt.sequence, now),
+			Accepted: &harnessv2.AcceptedEvent{
+				AcceptedAt: now,
+				Lease:      prompt.request.Lease,
+				ACPVersion: harnessv2.ACPProfileV1,
+			},
+		}
+	}
+	accepted := acceptedEvent(prompt, state)
+	if err := encoder.Encode(accepted); err != nil {
+		t.Fatalf("encode accepted: %v", err)
+	}
+
+	ignoredDelta := `{"sessionUpdate":"tool_call_update","toolCallId":"call-1","_meta":{"terminal_output_delta":{"terminal_id":"call-1","data":"x"}}}`
+	for index := range runtimeCodexMaxUpdateEventsPerSecond + 1 {
+		if mapped := mapEvent(prompt, state, acp.PromptEventUpdate, ignoredDelta, now); mapped != nil {
+			t.Fatalf("status-less tool output delta %d mapped to %#v", index, mapped)
+		}
+	}
+	visibleUpdates := []string{
+		`{"sessionUpdate":"tool_call","toolCallId":"call-1","title":"Read repository","kind":"read"}`,
+		`{"sessionUpdate":"tool_call_update","toolCallId":"call-1","status":"completed"}`,
+	}
+	for _, update := range visibleUpdates {
+		mapped := mapEvent(prompt, state, acp.PromptEventUpdate, update, now)
+		if mapped == nil {
+			t.Fatalf("visible tool lifecycle update was suppressed: %s", update)
+		}
+		if err := encoder.Encode(*mapped); err != nil {
+			t.Fatalf("encode visible tool lifecycle update: %v", err)
+		}
+	}
+	terminal, _, err := server.terminalEvent(state, prompt, acp.PromptResult{
+		Outcome: acp.PromptOutcomeCompleted, StopReason: acp.StopReasonEndTurn,
+		Accepted: true, SettledAt: now,
+	})
+	if err != nil {
+		t.Fatalf("build terminal event: %v", err)
+	}
+	if err := encoder.Encode(terminal); err != nil {
+		t.Fatalf("encode terminal event: %v", err)
+	}
+	if err := encoder.Close(); err != nil {
+		t.Fatalf("close event stream: %v", err)
+	}
+	decoder, err := harnessv2.NewEventDecoder(bytes.NewReader(stream.Bytes()), limits, harnessv2.EventExpectationFromMetadata(prompt.request.Metadata))
+	if err != nil {
+		t.Fatal(err)
+	}
+	events, err := decoder.DecodeAll()
+	if err != nil {
+		t.Fatalf("decode event stream: %v", err)
+	}
+	if len(events) != 4 || events[0].Type != harnessv2.EventAccepted || events[1].Update == nil ||
+		events[1].Update.Kind != harnessv2.UpdateToolCall || events[2].Update == nil ||
+		events[2].Update.Kind != harnessv2.UpdateToolCallUpdate || events[3].Type != harnessv2.EventCompleted {
+		t.Fatalf("event stream = %#v", events)
+	}
+	if prompt.sequence != 4 {
+		t.Fatalf("harness sequence = %d, want 4 visible events", prompt.sequence)
+	}
+
+	state, prompt = newStateAndPrompt()
+	var guarded bytes.Buffer
+	guardedEncoder, err := harnessv2.NewEventEncoder(&guarded, limits, harnessv2.EventExpectationFromMetadata(prompt.request.Metadata))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := guardedEncoder.Encode(acceptedEvent(prompt, state)); err != nil {
+		t.Fatal(err)
+	}
+	for index := range 3 {
+		mapped := mapEvent(prompt, state, acp.PromptEventUpdate,
+			`{"sessionUpdate":"tool_call","toolCallId":"call-`+string(rune('a'+index))+`","title":"Visible","kind":"read"}`, now)
+		err = guardedEncoder.Encode(*mapped)
+		if index < 2 && err != nil {
+			t.Fatalf("visible update %d: %v", index, err)
+		}
+	}
+	if !errors.Is(err, harnessv2.ErrEventRateExceeded) {
+		t.Fatalf("third visible update error = %v, want %v", err, harnessv2.ErrEventRateExceeded)
+	}
+}
+
+func TestMapACPUpdateCanonicalizesOversizedToolCallIDAcrossEvents(t *testing.T) {
+	rawID := strings.Repeat("provider-tool-call-", 24)
+	encoded, err := json.Marshal(map[string]any{
+		"sessionUpdate": "tool_call", "toolCallId": rawID,
+		"title": "Read repository", "kind": "read", "status": "pending",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	created, _, ok, err := mapACPUpdate(&acp.SessionNotification{Update: encoded})
+	if err != nil {
+		t.Fatal(err)
+	}
+	encoded, err = json.Marshal(map[string]any{
+		"sessionUpdate": "tool_call_update", "toolCallId": rawID,
+		"title": "Read repository", "kind": "read", "status": "completed",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	completed, _, updateOK, err := mapACPUpdate(&acp.SessionNotification{Update: encoded})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !ok || !updateOK || created == nil || completed == nil || created.ToolCall == nil || completed.ToolCall == nil {
+		t.Fatalf("mapped tool calls = created %#v completed %#v", created, completed)
+	}
+	canonicalID, err := canonicalACPToolCallID(rawID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if canonicalID == rawID || !strings.HasPrefix(canonicalID, canonicalACPToolCallIDPrefix) || len(canonicalID) > 253 {
+		t.Fatalf("canonical tool call ID = %q", canonicalID)
+	}
+	spaceVariant, err := canonicalACPToolCallID(" " + rawID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	reservedLooking, err := canonicalACPToolCallID(canonicalID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if spaceVariant == canonicalID || reservedLooking == canonicalID {
+		t.Fatalf("canonical tool call IDs collided: raw=%q space=%q reserved=%q", canonicalID, spaceVariant, reservedLooking)
+	}
+	if created.ToolCall.ToolCallID != canonicalID || completed.ToolCall.ToolCallID != canonicalID {
+		t.Fatalf("tool call correlation changed: created=%q completed=%q want=%q", created.ToolCall.ToolCallID, completed.ToolCall.ToolCallID, canonicalID)
+	}
+	if err := created.Validate(); err != nil {
+		t.Fatalf("created event validation: %v", err)
+	}
+	if err := completed.Validate(); err != nil {
+		t.Fatalf("completed event validation: %v", err)
+	}
+
+	permissionToolCall, err := json.Marshal(map[string]any{
+		"toolCallId": rawID, "name": "Read", "title": "Read repository",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now().UTC()
+	permission, err := mapPermission(&acp.PermissionRequestEvent{
+		RequestID: "permission-1",
+		Request: acp.RequestPermissionRequest{
+			ToolCall: permissionToolCall,
+			Options: []acp.PermissionOption{{
+				OptionID: "allow-once", Name: "Allow", Kind: string(harnessv2.PermissionOptionAllowOnce),
+			}},
+		},
+	}, now, time.Minute)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if permission.ToolCallID != canonicalID {
+		t.Fatalf("permission tool call ID = %q, want %q", permission.ToolCallID, canonicalID)
+	}
+	if err := permission.Validate(now); err != nil {
+		t.Fatalf("permission event validation: %v", err)
+	}
+}
diff --git a/workers/acp/supervisor/mcp_broker_client.go b/workers/acp/supervisor/mcp_broker_client.go
new file mode 100644
index 000000000..4def909d7
--- /dev/null
+++ b/workers/acp/supervisor/mcp_broker_client.go
@@ -0,0 +1,119 @@
+package supervisor
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+type MCPBroker interface {
+	Call(context.Context, harnessv2.MCPBrokerCallRequest) (harnessv2.MCPBrokerCallResponse, error)
+}
+
+type MCPBrokerFunc func(context.Context, harnessv2.MCPBrokerCallRequest) (harnessv2.MCPBrokerCallResponse, error)
+
+func (f MCPBrokerFunc) Call(ctx context.Context, request harnessv2.MCPBrokerCallRequest) (harnessv2.MCPBrokerCallResponse, error) {
+	return f(ctx, request)
+}
+
+type controllerMCPBrokerClient struct {
+	endpoint         *url.URL
+	client           *http.Client
+	namespace        string
+	controllerBearer string
+	capabilitySecret []byte
+}
+
+func NewControllerMCPBrokerClient(baseURL, namespace, bearer string, capabilitySecret []byte) (MCPBroker, error) {
+	parsed, err := url.Parse(strings.TrimSpace(baseURL))
+	if err != nil || (parsed.Scheme != "http" && parsed.Scheme != "https") || parsed.Host == "" || parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" {
+		return nil, fmt.Errorf("MCP broker URL is invalid")
+	}
+	parsed.Path = harnessv2.MCPBrokerCallPath
+	namespace = strings.TrimSpace(namespace)
+	if namespace == "" || len(strings.TrimSpace(bearer)) < 32 || len(capabilitySecret) < harnessv2.MinCapabilitySecretBytes {
+		return nil, fmt.Errorf("MCP broker identity is invalid")
+	}
+	transport := &http.Transport{
+		Proxy:                  http.ProxyFromEnvironment,
+		DialContext:            (&net.Dialer{Timeout: 10 * time.Second, KeepAlive: 30 * time.Second}).DialContext,
+		ForceAttemptHTTP2:      true,
+		MaxIdleConns:           100,
+		IdleConnTimeout:        90 * time.Second,
+		TLSHandshakeTimeout:    10 * time.Second,
+		ExpectContinueTimeout:  time.Second,
+		MaxResponseHeaderBytes: 64 << 10,
+	}
+	return &controllerMCPBrokerClient{
+		endpoint: parsed,
+		client: &http.Client{
+			Transport: transport,
+			// The broker does not write response headers until the authorized tool
+			// finishes. A client-wide timeout would therefore override longer tool
+			// deadlines such as wait_for_tasks' 10-minute default. Request-context
+			// cancellation and its deadline remain authoritative for the complete
+			// call; the transport independently bounds connection setup.
+			CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse },
+		},
+		namespace: namespace, controllerBearer: bearer,
+		capabilitySecret: append([]byte(nil), capabilitySecret...),
+	}, nil
+}
+
+func (c *controllerMCPBrokerClient) Call(ctx context.Context, request harnessv2.MCPBrokerCallRequest) (harnessv2.MCPBrokerCallResponse, error) {
+	request.Namespace = c.namespace
+	digest, err := harnessv2.CanonicalRequestDigest(request)
+	if err != nil {
+		return harnessv2.MCPBrokerCallResponse{}, err
+	}
+	if request.Metadata.RequestDigest != "" && request.Metadata.RequestDigest != digest {
+		return harnessv2.MCPBrokerCallResponse{}, fmt.Errorf("MCP broker request digest is already sealed differently")
+	}
+	request.Metadata.RequestDigest = digest
+	if _, err := request.ValidateAt(time.Now().UTC()); err != nil {
+		return harnessv2.MCPBrokerCallResponse{}, err
+	}
+	capability, err := harnessv2.SignOperationCapability(c.capabilitySecret, harnessv2.ClaimsForMutation(request.Metadata))
+	if err != nil {
+		return harnessv2.MCPBrokerCallResponse{}, err
+	}
+	body, err := json.Marshal(request)
+	if err != nil {
+		return harnessv2.MCPBrokerCallResponse{}, err
+	}
+	httpRequest, err := http.NewRequestWithContext(ctx, http.MethodPost, c.endpoint.String(), bytes.NewReader(body))
+	if err != nil {
+		return harnessv2.MCPBrokerCallResponse{}, err
+	}
+	httpRequest.Header.Set("Content-Type", "application/json")
+	httpRequest.Header.Set("Authorization", "Bearer "+c.controllerBearer)
+	httpRequest.Header.Set(harnessv2.OperationCapabilityHeader, capability)
+	response, err := c.client.Do(httpRequest)
+	if err != nil {
+		return harnessv2.MCPBrokerCallResponse{}, fmt.Errorf("MCP broker transport failed")
+	}
+	defer response.Body.Close() //nolint:errcheck
+	data, err := io.ReadAll(io.LimitReader(response.Body, int64(harnessv2.MaxMCPResultBytes+(64<<10))))
+	if err != nil || response.StatusCode != http.StatusOK {
+		return harnessv2.MCPBrokerCallResponse{}, fmt.Errorf("MCP broker rejected the tool call")
+	}
+	var decoded harnessv2.MCPBrokerCallResponse
+	decoder := json.NewDecoder(bytes.NewReader(data))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&decoded); err != nil || decoded.CallID != request.Call.CallID {
+		return harnessv2.MCPBrokerCallResponse{}, fmt.Errorf("MCP broker response is invalid")
+	}
+	if err := decoded.Validate(); err != nil {
+		return harnessv2.MCPBrokerCallResponse{}, fmt.Errorf("MCP broker response is invalid")
+	}
+	return decoded, nil
+}
diff --git a/workers/acp/supervisor/mcp_broker_client_test.go b/workers/acp/supervisor/mcp_broker_client_test.go
new file mode 100644
index 000000000..de9cb8bff
--- /dev/null
+++ b/workers/acp/supervisor/mcp_broker_client_test.go
@@ -0,0 +1,171 @@
+package supervisor
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+func TestControllerMCPBrokerClientPreservesLongCallerDeadline(t *testing.T) {
+	client := newTestControllerMCPBrokerClient(t)
+	configuredTransport := client.client.Transport
+
+	callerDeadline := time.Now().Add(10 * time.Minute)
+	observedDeadline := make(chan time.Time, 1)
+	client.client.Transport = roundTripFunc(func(request *http.Request) (*http.Response, error) {
+		deadline, ok := request.Context().Deadline()
+		if !ok {
+			t.Fatal("broker request context has no caller deadline")
+		}
+		observedDeadline <- deadline
+		return testMCPBrokerHTTPResponse(t, request, "call-1"), nil
+	})
+
+	ctx, cancel := context.WithDeadline(context.Background(), callerDeadline)
+	defer cancel()
+	if _, err := client.Call(ctx, testControllerMCPBrokerCallRequest(t, "call-1")); err != nil {
+		t.Fatalf("Call() error = %v", err)
+	}
+	deadline := <-observedDeadline
+	if !deadline.Equal(callerDeadline) {
+		t.Fatalf("broker request deadline = %s, want caller deadline %s", deadline, callerDeadline)
+	}
+
+	if client.client.Timeout != 0 {
+		t.Fatalf("MCP broker client timeout = %s, want no client-wide timeout", client.client.Timeout)
+	}
+	transport, ok := configuredTransport.(*http.Transport)
+	if !ok {
+		t.Fatalf("MCP broker transport type = %T, want *http.Transport", configuredTransport)
+	}
+	if transport.DialContext == nil {
+		t.Fatal("MCP broker transport has no bounded dialer")
+	}
+	if transport.TLSHandshakeTimeout <= 0 {
+		t.Fatalf("MCP broker TLS handshake timeout = %s, want a positive bound", transport.TLSHandshakeTimeout)
+	}
+	if transport.ResponseHeaderTimeout != 0 {
+		t.Fatalf("MCP broker response-header timeout = %s, want the caller context to remain authoritative", transport.ResponseHeaderTimeout)
+	}
+	if transport.MaxResponseHeaderBytes <= 0 {
+		t.Fatalf("MCP broker max response-header bytes = %d, want a positive bound", transport.MaxResponseHeaderBytes)
+	}
+}
+
+func TestControllerMCPBrokerClientContextCancellationStopsTransport(t *testing.T) {
+	client := newTestControllerMCPBrokerClient(t)
+	started := make(chan struct{})
+	cancellation := make(chan error, 1)
+	client.client.Transport = roundTripFunc(func(request *http.Request) (*http.Response, error) {
+		close(started)
+		<-request.Context().Done()
+		cancellation <- request.Context().Err()
+		return nil, request.Context().Err()
+	})
+
+	ctx, cancel := context.WithCancel(context.Background())
+	request := testControllerMCPBrokerCallRequest(t, "call-cancel")
+	result := make(chan error, 1)
+	go func() {
+		_, err := client.Call(ctx, request)
+		result <- err
+	}()
+
+	select {
+	case <-started:
+	case <-time.After(time.Second):
+		t.Fatal("broker transport did not start")
+	}
+	cancelledAt := time.Now()
+	cancel()
+	select {
+	case err := <-result:
+		if err == nil {
+			t.Fatal("Call() succeeded after context cancellation")
+		}
+		if observed := <-cancellation; observed != context.Canceled {
+			t.Fatalf("broker transport context error = %v, want context.Canceled", observed)
+		}
+		if elapsed := time.Since(cancelledAt); elapsed > time.Second {
+			t.Fatalf("Call() returned %s after cancellation, want prompt termination", elapsed)
+		}
+	case <-time.After(time.Second):
+		t.Fatal("Call() did not terminate promptly after context cancellation")
+	}
+}
+
+func newTestControllerMCPBrokerClient(t *testing.T) *controllerMCPBrokerClient {
+	t.Helper()
+	broker, err := NewControllerMCPBrokerClient(
+		"https://controller.example.test",
+		"default",
+		strings.Repeat("b", 32),
+		[]byte(strings.Repeat("s", harnessv2.MinCapabilitySecretBytes)),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	client, ok := broker.(*controllerMCPBrokerClient)
+	if !ok {
+		t.Fatalf("MCP broker type = %T, want *controllerMCPBrokerClient", broker)
+	}
+	return client
+}
+
+func testControllerMCPBrokerCallRequest(t *testing.T, callID string) harnessv2.MCPBrokerCallRequest {
+	t.Helper()
+	now := time.Now().UTC()
+	fence := harnessv2.Fence{
+		RuntimeInstanceID: "runtime-instance", SupervisorBootID: "boot", ControllerEpoch: 2,
+		RuntimePoolUID: "pool-uid", RuntimePoolGeneration: 4,
+		RuntimeSessionUID: "session-uid", RuntimeSessionGeneration: 3,
+		RuntimeProfileDigest:       harnessv2.ProfileDigest(testDigest("profile")),
+		ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+	}
+	authorization, lease := testMCPAuthorization(t, fence, now, false)
+	return harnessv2.MCPBrokerCallRequest{
+		Protocol:     harnessv2.ProtocolVersion,
+		SessionState: harnessv2.RuntimeSessionStatePromptRunning,
+		Metadata: harnessv2.MutationMetadata{
+			Fence: fence, TaskUID: authorization.TaskUID, TaskAttempt: authorization.TaskAttempt,
+			PromptID: authorization.PromptID, OperationID: harnessv2.OperationID("mcp-" + callID),
+			RequestDigestSchemaVersion: harnessv2.RequestDigestSchemaVersion,
+			ExpiresAt:                  now.Add(30 * time.Second),
+		},
+		Lease: lease, Authorization: authorization,
+		Call: harnessv2.MCPToolCall{
+			CallID: callID, ToolName: "lookup", Arguments: json.RawMessage(`{"value":"x"}`),
+		},
+	}
+}
+
+func testMCPBrokerHTTPResponse(t *testing.T, request *http.Request, callID string) *http.Response {
+	t.Helper()
+	body, err := json.Marshal(harnessv2.MCPBrokerCallResponse{
+		Protocol: harnessv2.ProtocolVersion,
+		CallID:   callID,
+		Result:   json.RawMessage(`{"ok":true}`),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return &http.Response{
+		StatusCode: http.StatusOK,
+		Header:     make(http.Header),
+		Body:       io.NopCloser(bytes.NewReader(body)),
+		Request:    request,
+	}
+}
+
+type roundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripFunc) RoundTrip(request *http.Request) (*http.Response, error) {
+	return f(request)
+}
diff --git a/workers/acp/supervisor/mcp_proxy.go b/workers/acp/supervisor/mcp_proxy.go
new file mode 100644
index 000000000..a157b24da
--- /dev/null
+++ b/workers/acp/supervisor/mcp_proxy.go
@@ -0,0 +1,706 @@
+package supervisor
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/orka-agents/orka/internal/acp"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+const (
+	mcpProxyPathPrefix        = "/_orka/mcp/"
+	mcpProtocolVersion        = "2025-06-18"
+	defaultMCPMaxConnections  = 16
+	defaultMCPMaxSessionCalls = 2
+)
+
+type mcpProxy struct {
+	broker   MCPBroker
+	listener net.Listener
+	server   *http.Server
+	slots    chan struct{}
+
+	mu       sync.RWMutex
+	sessions map[string]*mcpProxySession
+	closed   bool
+}
+
+type mcpProxySession struct {
+	proxy         *mcpProxy
+	route         string
+	credential    []byte
+	url           string
+	fence         harnessv2.Fence
+	configuration harnessv2.MCPPolicyConfiguration
+
+	mu            sync.Mutex
+	state         harnessv2.RuntimeSessionState
+	authorization *harnessv2.PromptMCPAuthorization
+	lease         harnessv2.PromptLease
+	gateContext   context.Context
+	gateCancel    context.CancelFunc
+	leaseTimer    *time.Timer
+	leaseVersion  uint64
+	approvals     map[string][]mcpApprovalGrant
+	closed        bool
+	calls         chan struct{}
+}
+
+type mcpApprovalGrant struct {
+	evidence   harnessv2.MCPApprovalEvidence
+	usedCallID string
+}
+
+type mcpJSONRPCRequest struct {
+	JSONRPC string          `json:"jsonrpc"`
+	ID      json.RawMessage `json:"id,omitempty"`
+	Method  string          `json:"method"`
+	Params  json.RawMessage `json:"params,omitempty"`
+}
+
+type mcpJSONRPCResponse struct {
+	JSONRPC string           `json:"jsonrpc"`
+	ID      json.RawMessage  `json:"id,omitempty"`
+	Result  any              `json:"result,omitempty"`
+	Error   *mcpJSONRPCError `json:"error,omitempty"`
+}
+
+type mcpJSONRPCError struct {
+	Code    int    `json:"code"`
+	Message string `json:"message"`
+}
+
+type mcpToolsCallParams struct {
+	Name      string          `json:"name"`
+	Arguments json.RawMessage `json:"arguments,omitempty"`
+}
+
+func newMCPProxy(broker MCPBroker) (*mcpProxy, error) {
+	if broker == nil {
+		return nil, fmt.Errorf("controller MCP broker is required")
+	}
+	listener, err := net.Listen("tcp4", "127.0.0.1:0")
+	if err != nil {
+		return nil, fmt.Errorf("listen on MCP loopback: %w", err)
+	}
+	proxy := &mcpProxy{
+		broker: broker, listener: listener, sessions: make(map[string]*mcpProxySession),
+		slots: make(chan struct{}, defaultMCPMaxConnections),
+	}
+	proxy.server = &http.Server{
+		Handler: http.HandlerFunc(proxy.serveHTTP), ErrorLog: log.New(io.Discard, "", 0),
+		ReadHeaderTimeout: 5 * time.Second, ReadTimeout: 30 * time.Second,
+		IdleTimeout: 30 * time.Second, MaxHeaderBytes: 32 << 10,
+	}
+	go func() { _ = proxy.server.Serve(listener) }()
+	return proxy, nil
+}
+
+func (p *mcpProxy) newSession(
+	fence harnessv2.Fence,
+	configuration harnessv2.MCPPolicyConfiguration,
+) (*mcpProxySession, acp.MCPServer, error) {
+	if err := fence.Validate(true); err != nil {
+		return nil, acp.MCPServer{}, fmt.Errorf("MCP session fence: %w", err)
+	}
+	credential, err := randomMCPSecret(32)
+	if err != nil {
+		return nil, acp.MCPServer{}, err
+	}
+	for range 8 {
+		route, routeErr := randomMCPSecret(24)
+		if routeErr != nil {
+			return nil, acp.MCPServer{}, routeErr
+		}
+		p.mu.Lock()
+		if p.closed {
+			p.mu.Unlock()
+			return nil, acp.MCPServer{}, fmt.Errorf("MCP proxy is closed")
+		}
+		if _, exists := p.sessions[route]; exists {
+			p.mu.Unlock()
+			continue
+		}
+		endpoint := providerProxyScheme + "://" + p.listener.Addr().String() + mcpProxyPathPrefix + route
+		session := &mcpProxySession{
+			proxy: p, route: route, credential: []byte(credential), url: endpoint, fence: fence,
+			configuration: cloneMCPPolicyConfiguration(configuration),
+			state:         harnessv2.RuntimeSessionStateIdle, approvals: make(map[string][]mcpApprovalGrant),
+			calls: make(chan struct{}, defaultMCPMaxSessionCalls),
+		}
+		p.sessions[route] = session
+		p.mu.Unlock()
+		return session, acp.MCPServer{
+			Type: "http", Name: "orka", URL: endpoint,
+			Headers: []acp.HTTPHeader{{Name: "Authorization", Value: "Bearer " + credential}},
+		}, nil
+	}
+	return nil, acp.MCPServer{}, fmt.Errorf("allocate unique MCP proxy route")
+}
+
+func randomMCPSecret(size int) (string, error) {
+	if size < 16 {
+		return "", fmt.Errorf("MCP proxy secret size is too small")
+	}
+	data := make([]byte, size)
+	if _, err := rand.Read(data); err != nil {
+		return "", fmt.Errorf("generate MCP proxy secret: %w", err)
+	}
+	return base64.RawURLEncoding.EncodeToString(data), nil
+}
+
+func (s *mcpProxySession) activate(auth harnessv2.PromptMCPAuthorization, lease harnessv2.PromptLease, now time.Time) error {
+	metadata := harnessv2.MutationMetadata{
+		Fence: s.fence, TaskUID: auth.TaskUID, TaskAttempt: auth.TaskAttempt, PromptID: auth.PromptID,
+		OperationID: "mcp-activate", RequestDigestSchemaVersion: harnessv2.RequestDigestSchemaVersion,
+		RequestDigest: testlessRequestDigest(), ExpiresAt: auth.ExpiresAt,
+	}
+	if err := auth.ValidateForAt(metadata, lease, now); err != nil {
+		return err
+	}
+	if !s.configuration.Matches(auth.Configuration()) {
+		return fmt.Errorf("prompt MCP policy does not match the RuntimeSession configuration")
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.closed || s.authorization != nil || s.state != harnessv2.RuntimeSessionStateIdle {
+		return fmt.Errorf("MCP proxy session is not idle")
+	}
+	cloned := clonePromptMCPAuthorization(auth)
+	s.authorization = &cloned
+	s.lease = lease
+	s.state = harnessv2.RuntimeSessionStateIdle
+	s.gateContext, s.gateCancel = context.WithCancel(context.Background())
+	s.approvals = make(map[string][]mcpApprovalGrant)
+	s.resetLeaseTimerLocked(now)
+	return nil
+}
+
+// testlessRequestDigest supplies a structurally valid placeholder to reuse the
+// exact PromptMCPAuthorization identity validator without authorizing an HTTP
+// mutation. Broker calls always carry their own canonical request digest.
+func testlessRequestDigest() harnessv2.RequestDigest {
+	return harnessv2.RequestDigest("sha256:" + strings.Repeat("0", 64))
+}
+
+func (s *mcpProxySession) markRunning(promptID harnessv2.PromptID, now time.Time) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.closed || s.authorization == nil || s.authorization.PromptID != promptID ||
+		s.gateCancel == nil || !s.authorization.AuthorizedAt(harnessv2.RuntimeSessionStatePromptRunning, s.lease, now) {
+		return fmt.Errorf("MCP prompt authority is not active")
+	}
+	s.state = harnessv2.RuntimeSessionStatePromptRunning
+	return nil
+}
+
+func (s *mcpProxySession) renew(auth harnessv2.PromptMCPAuthorization, lease harnessv2.PromptLease, now time.Time) error {
+	metadata := harnessv2.MutationMetadata{
+		Fence: s.fence, TaskUID: auth.TaskUID, TaskAttempt: auth.TaskAttempt, PromptID: auth.PromptID,
+		OperationID: "mcp-renew", RequestDigestSchemaVersion: harnessv2.RequestDigestSchemaVersion,
+		RequestDigest: testlessRequestDigest(), ExpiresAt: auth.ExpiresAt,
+	}
+	if err := auth.ValidateForAt(metadata, lease, now); err != nil {
+		return err
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.closed || s.authorization == nil || s.gateCancel == nil || s.state != harnessv2.RuntimeSessionStatePromptRunning ||
+		s.authorization.PromptID != auth.PromptID || lease.Generation != s.lease.Generation+1 ||
+		!now.Before(s.lease.ExpiresAt) {
+		return fmt.Errorf("MCP prompt lease is no longer renewable")
+	}
+	if s.authorization.ToolPolicyDigest != auth.ToolPolicyDigest ||
+		s.authorization.ApprovalPolicyDigest != auth.ApprovalPolicyDigest ||
+		s.authorization.MCPConfigurationDigest != auth.MCPConfigurationDigest ||
+		s.authorization.ToolPolicy.DescriptorDigest != auth.ToolPolicy.DescriptorDigest {
+		return fmt.Errorf("MCP prompt policy changed during lease renewal")
+	}
+	cloned := clonePromptMCPAuthorization(auth)
+	s.authorization = &cloned
+	s.lease = lease
+	s.resetLeaseTimerLocked(now)
+	return nil
+}
+
+func (s *mcpProxySession) resetLeaseTimerLocked(now time.Time) {
+	if s.leaseTimer != nil {
+		s.leaseTimer.Stop()
+	}
+	s.leaseVersion++
+	version := s.leaseVersion
+	promptID := s.authorization.PromptID
+	duration := s.authorization.ExpiresAt.Sub(now)
+	if leaseDuration := s.lease.ExpiresAt.Sub(now); leaseDuration < duration {
+		duration = leaseDuration
+	}
+	if duration < 0 {
+		duration = 0
+	}
+	s.leaseTimer = time.AfterFunc(duration, func() { s.expire(promptID, version) })
+}
+
+func (s *mcpProxySession) expire(promptID harnessv2.PromptID, version uint64) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.authorization == nil || s.authorization.PromptID != promptID || s.leaseVersion != version {
+		return
+	}
+	s.revokeLocked(harnessv2.RuntimeSessionStateCancelling)
+}
+
+func (s *mcpProxySession) deactivate(promptID harnessv2.PromptID, next harnessv2.RuntimeSessionState) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.authorization == nil {
+		if !s.closed {
+			s.state = next
+		}
+		return
+	}
+	if s.authorization.PromptID != promptID {
+		return
+	}
+	s.revokeLocked(next)
+}
+
+func (s *mcpProxySession) revoke(next harnessv2.RuntimeSessionState) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.revokeLocked(next)
+}
+
+func (s *mcpProxySession) revokeLocked(next harnessv2.RuntimeSessionState) {
+	if s.leaseTimer != nil {
+		s.leaseTimer.Stop()
+		s.leaseTimer = nil
+	}
+	if s.gateCancel != nil {
+		s.gateCancel()
+		s.gateCancel = nil
+	}
+	s.gateContext = nil
+	s.authorization = nil
+	s.lease = harnessv2.PromptLease{}
+	s.approvals = make(map[string][]mcpApprovalGrant)
+	s.leaseVersion++
+	s.state = next
+}
+
+func (s *mcpProxySession) resolveApprovalToolName(candidate, title string) (string, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.closed || s.authorization == nil || s.state != harnessv2.RuntimeSessionStatePromptRunning {
+		return "", fmt.Errorf("MCP prompt is not active")
+	}
+	for _, value := range []string{strings.TrimSpace(candidate), strings.TrimSpace(title)} {
+		if value != "" && s.authorization.ApprovalPolicy.Requires(value) {
+			return value, nil
+		}
+	}
+	matched := ""
+	lowerTitle := strings.ToLower(title)
+	for _, name := range s.authorization.ApprovalPolicy.RequiredTools {
+		if strings.Contains(lowerTitle, strings.ToLower(name)) {
+			if matched != "" {
+				return "", fmt.Errorf("permission title matches multiple approval-required tools")
+			}
+			matched = name
+		}
+	}
+	if matched == "" {
+		return "", fmt.Errorf("permission does not identify an approval-required tool")
+	}
+	return matched, nil
+}
+
+func (s *mcpProxySession) grantApproval(promptID harnessv2.PromptID, evidence harnessv2.MCPApprovalEvidence) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.closed || s.authorization == nil || s.authorization.PromptID != promptID || s.state != harnessv2.RuntimeSessionStatePromptRunning {
+		return fmt.Errorf("MCP prompt is not active")
+	}
+	if !s.authorization.ApprovalPolicy.Requires(evidence.ToolName) {
+		return fmt.Errorf("MCP tool %q does not require approval", evidence.ToolName)
+	}
+	if evidence.ExpiresAt.After(s.authorization.ExpiresAt) {
+		evidence.ExpiresAt = s.authorization.ExpiresAt
+	}
+	if evidence.ExpiresAt.After(s.lease.ExpiresAt) {
+		evidence.ExpiresAt = s.lease.ExpiresAt
+	}
+	if err := evidence.ValidateFor(evidence.ToolName, time.Now().UTC()); err != nil {
+		return err
+	}
+	s.approvals[evidence.ToolName] = append(s.approvals[evidence.ToolName], mcpApprovalGrant{evidence: evidence})
+	return nil
+}
+
+func (s *mcpProxySession) authorizeCall(toolName, callID string, now time.Time) (
+	context.Context,
+	harnessv2.PromptMCPAuthorization,
+	harnessv2.PromptLease,
+	*MCPApprovalEvidenceReservation,
+	error,
+) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.closed || s.authorization == nil || s.gateContext == nil || s.gateCancel == nil ||
+		s.state != harnessv2.RuntimeSessionStatePromptRunning ||
+		!s.authorization.AuthorizedAt(s.state, s.lease, now) {
+		return nil, harnessv2.PromptMCPAuthorization{}, harnessv2.PromptLease{}, nil, fmt.Errorf("prompt-scoped MCP authority is inactive")
+	}
+	descriptor, ok := s.authorization.ToolPolicy.Descriptor(toolName)
+	if !ok || !descriptor.Source.Brokered() {
+		return nil, harnessv2.PromptMCPAuthorization{}, harnessv2.PromptLease{}, nil, fmt.Errorf("MCP tool is not allowed")
+	}
+	var reservation *MCPApprovalEvidenceReservation
+	if s.authorization.ApprovalPolicy.Requires(toolName) {
+		grants := s.approvals[toolName]
+		for index := range grants {
+			grant := &grants[index]
+			if !grant.evidence.ExpiresAt.After(now) {
+				continue
+			}
+			if grant.evidence.Reusable || grant.usedCallID == "" || grant.usedCallID == callID {
+				if !grant.evidence.Reusable && grant.usedCallID == "" {
+					grant.usedCallID = callID
+				}
+				evidence := grant.evidence
+				reservation = &MCPApprovalEvidenceReservation{Evidence: evidence}
+				break
+			}
+		}
+		s.approvals[toolName] = grants
+		if reservation == nil {
+			return nil, harnessv2.PromptMCPAuthorization{}, harnessv2.PromptLease{}, nil, fmt.Errorf("MCP tool approval is missing")
+		}
+	}
+	return s.gateContext, clonePromptMCPAuthorization(*s.authorization), s.lease, reservation, nil
+}
+
+type MCPApprovalEvidenceReservation struct {
+	Evidence harnessv2.MCPApprovalEvidence
+}
+
+func (s *mcpProxySession) close() {
+	s.mu.Lock()
+	if s.closed {
+		s.mu.Unlock()
+		return
+	}
+	s.closed = true
+	s.revokeLocked(harnessv2.RuntimeSessionStateDeleted)
+	s.mu.Unlock()
+	s.proxy.mu.Lock()
+	delete(s.proxy.sessions, s.route)
+	s.proxy.mu.Unlock()
+}
+
+func (p *mcpProxy) serveHTTP(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost || !isLoopbackRemote(r.RemoteAddr) {
+		http.Error(w, "MCP endpoint is loopback-only", http.StatusForbidden)
+		return
+	}
+	route, ok := splitMCPProxyRoute(r.URL.Path)
+	if !ok {
+		http.NotFound(w, r)
+		return
+	}
+	p.mu.RLock()
+	session := p.sessions[route]
+	p.mu.RUnlock()
+	if session == nil || !session.credentialMatches(r.Header.Get("Authorization")) {
+		http.Error(w, "MCP session authentication failed", http.StatusUnauthorized)
+		return
+	}
+	if !tryAcquireMCPSlot(p.slots) {
+		http.Error(w, "MCP proxy is at capacity", http.StatusTooManyRequests)
+		return
+	}
+	defer releaseMCPSlot(p.slots)
+	if !tryAcquireMCPSlot(session.calls) {
+		http.Error(w, "MCP session is at capacity", http.StatusTooManyRequests)
+		return
+	}
+	defer releaseMCPSlot(session.calls)
+	body := http.MaxBytesReader(w, r.Body, int64(harnessv2.MaxMCPArgumentsBytes+(64<<10)))
+	defer body.Close() //nolint:errcheck
+	decoder := json.NewDecoder(body)
+	decoder.DisallowUnknownFields()
+	var request mcpJSONRPCRequest
+	if err := decoder.Decode(&request); err != nil || request.JSONRPC != "2.0" || strings.TrimSpace(request.Method) == "" {
+		writeMCPRPCError(w, request.ID, -32600, "invalid MCP JSON-RPC request")
+		return
+	}
+	var extra any
+	if err := decoder.Decode(&extra); !errors.Is(err, io.EOF) {
+		writeMCPRPCError(w, request.ID, -32600, "invalid MCP JSON-RPC request")
+		return
+	}
+	switch request.Method {
+	case "initialize":
+		writeMCPRPCResult(w, request.ID, map[string]any{
+			"protocolVersion": mcpProtocolVersion,
+			"capabilities":    map[string]any{"tools": map[string]any{"listChanged": false}},
+			"serverInfo":      map[string]any{"name": "orka-prompt-broker", "version": "v2"},
+		})
+	case "notifications/initialized":
+		w.WriteHeader(http.StatusAccepted)
+	case "ping":
+		writeMCPRPCResult(w, request.ID, map[string]any{})
+	case "tools/list":
+		writeMCPRPCResult(w, request.ID, map[string]any{"tools": session.listTools(time.Now().UTC())})
+	case "tools/call":
+		session.handleToolCall(w, r, request)
+	default:
+		writeMCPRPCError(w, request.ID, -32601, "MCP method is not supported")
+	}
+}
+
+func (s *mcpProxySession) handleToolCall(w http.ResponseWriter, r *http.Request, rpc mcpJSONRPCRequest) {
+	var params mcpToolsCallParams
+	decoder := json.NewDecoder(bytes.NewReader(rpc.Params))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&params); err != nil {
+		writeMCPRPCError(w, rpc.ID, -32602, "invalid MCP tool call parameters")
+		return
+	}
+	if len(params.Arguments) == 0 {
+		params.Arguments = json.RawMessage(`{}`)
+	}
+	callID, err := canonicalMCPCallID(rpc.ID)
+	if err != nil {
+		writeMCPRPCError(w, rpc.ID, -32602, "MCP tool call requires a bounded request ID")
+		return
+	}
+	now := time.Now().UTC()
+	gate, authorization, lease, approval, err := s.authorizeCall(params.Name, callID, now)
+	if err != nil {
+		writeMCPRPCError(w, rpc.ID, -32001, "MCP tool call is not authorized")
+		return
+	}
+	call := harnessv2.MCPToolCall{CallID: callID, ToolName: params.Name, Arguments: params.Arguments}
+	if approval != nil {
+		evidence := approval.Evidence
+		call.Approval = &evidence
+	}
+	expiresAt := now.Add(30 * time.Second)
+	if authorization.ExpiresAt.Before(expiresAt) {
+		expiresAt = authorization.ExpiresAt
+	}
+	if lease.ExpiresAt.Before(expiresAt) {
+		expiresAt = lease.ExpiresAt
+	}
+	metadata := harnessv2.MutationMetadata{
+		Fence: s.fence, TaskUID: authorization.TaskUID, TaskAttempt: authorization.TaskAttempt,
+		PromptID: authorization.PromptID, OperationID: mcpOperationID(authorization, callID),
+		RequestDigestSchemaVersion: harnessv2.RequestDigestSchemaVersion, ExpiresAt: expiresAt,
+	}
+	request := harnessv2.MCPBrokerCallRequest{
+		Protocol: harnessv2.ProtocolVersion, SessionState: harnessv2.RuntimeSessionStatePromptRunning,
+		Metadata: metadata, Lease: lease, Authorization: authorization, Call: call,
+	}
+	ctx, cancel := context.WithCancel(r.Context())
+	stop := context.AfterFunc(gate, cancel)
+	defer func() {
+		stop()
+		cancel()
+	}()
+	response, err := s.proxy.broker.Call(ctx, request)
+	if err == nil {
+		err = ctx.Err()
+	}
+	if err != nil {
+		writeMCPRPCError(w, rpc.ID, -32002, "MCP broker call failed")
+		return
+	}
+	if response.CallID != callID || response.Validate() != nil {
+		writeMCPRPCError(w, rpc.ID, -32002, "MCP broker returned an invalid response")
+		return
+	}
+	result := map[string]any{
+		"content": []map[string]any{{"type": "text", "text": string(response.Result)}},
+		"isError": response.IsError,
+	}
+	var structured map[string]any
+	if json.Unmarshal(response.Result, &structured) == nil && structured != nil {
+		result["structuredContent"] = structured
+	}
+	if response.Replayed {
+		result["_meta"] = map[string]any{"orka.replayed": true}
+	}
+	writeMCPRPCResult(w, rpc.ID, result)
+}
+
+func (s *mcpProxySession) listTools(_ time.Time) []map[string]any {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.closed || s.state == harnessv2.RuntimeSessionStateDeleted {
+		return []map[string]any{}
+	}
+	result := make([]map[string]any, 0, len(s.configuration.ToolPolicy.Tools))
+	for _, descriptor := range s.configuration.ToolPolicy.Tools {
+		if !descriptor.Source.Brokered() {
+			continue
+		}
+		var schema any
+		if err := json.Unmarshal(descriptor.InputSchema, &schema); err != nil {
+			continue
+		}
+		result = append(result, map[string]any{
+			"name": descriptor.Name, "description": descriptor.Description, "inputSchema": schema,
+		})
+	}
+	return result
+}
+
+func (s *mcpProxySession) credentialMatches(header string) bool {
+	value := strings.TrimSpace(header)
+	if len(value) >= len("Bearer ") && strings.EqualFold(value[:len("Bearer ")], "Bearer ") {
+		value = strings.TrimSpace(value[len("Bearer "):])
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.closed || len(value) != len(s.credential) {
+		return false
+	}
+	return subtle.ConstantTimeCompare([]byte(value), s.credential) == 1
+}
+
+func cloneMCPSlice[T any](input []T) []T {
+	if input == nil {
+		return nil
+	}
+	output := make([]T, len(input))
+	copy(output, input)
+	return output
+}
+
+func cloneMCPPolicyConfiguration(input harnessv2.MCPPolicyConfiguration) harnessv2.MCPPolicyConfiguration {
+	output := input
+	output.ToolPolicy.AllowedToolNames = cloneMCPSlice(input.ToolPolicy.AllowedToolNames)
+	output.ToolPolicy.DisallowedToolNames = cloneMCPSlice(input.ToolPolicy.DisallowedToolNames)
+	output.ToolPolicy.Tools = cloneMCPSlice(input.ToolPolicy.Tools)
+	for index := range output.ToolPolicy.Tools {
+		output.ToolPolicy.Tools[index].InputSchema = append(json.RawMessage(nil), input.ToolPolicy.Tools[index].InputSchema...)
+	}
+	output.ApprovalPolicy.RequiredTools = cloneMCPSlice(input.ApprovalPolicy.RequiredTools)
+	return output
+}
+
+func clonePromptMCPAuthorization(input harnessv2.PromptMCPAuthorization) harnessv2.PromptMCPAuthorization {
+	output := input
+	configuration := cloneMCPPolicyConfiguration(input.Configuration())
+	output.ToolPolicy = configuration.ToolPolicy
+	output.ApprovalPolicy = configuration.ApprovalPolicy
+	return output
+}
+
+func canonicalMCPCallID(raw json.RawMessage) (string, error) {
+	if len(raw) == 0 || len(raw) > 512 {
+		return "", fmt.Errorf("MCP request ID is required")
+	}
+	var text string
+	if json.Unmarshal(raw, &text) == nil && strings.TrimSpace(text) != "" {
+		if len(text) <= 256 && !strings.ContainsAny(text, " \t\r\n") {
+			return text, nil
+		}
+	}
+	canonical, err := harnessv2.CanonicalJSON(raw)
+	if err != nil {
+		return "", err
+	}
+	sum := sha256.Sum256(canonical)
+	return "rpc-" + hex.EncodeToString(sum[:16]), nil
+}
+
+func mcpOperationID(auth harnessv2.PromptMCPAuthorization, callID string) harnessv2.OperationID {
+	sum := sha256.Sum256(fmt.Appendf(nil, "%s:%d:%s:%d:%s:%s", auth.RuntimeSessionUID, auth.SessionGeneration, auth.TaskUID, auth.TaskAttempt, auth.PromptID, callID))
+	return harnessv2.OperationID("mcp-" + hex.EncodeToString(sum[:]))
+}
+
+func splitMCPProxyRoute(path string) (string, bool) {
+	if !strings.HasPrefix(path, mcpProxyPathPrefix) {
+		return "", false
+	}
+	route := strings.TrimPrefix(path, mcpProxyPathPrefix)
+	if route == "" || strings.Contains(route, "/") {
+		return "", false
+	}
+	return route, true
+}
+
+func isLoopbackRemote(remoteAddr string) bool {
+	host, _, err := net.SplitHostPort(remoteAddr)
+	if err != nil {
+		return false
+	}
+	ip := net.ParseIP(host)
+	return ip != nil && ip.IsLoopback()
+}
+
+func tryAcquireMCPSlot(slots chan struct{}) bool {
+	select {
+	case slots <- struct{}{}:
+		return true
+	default:
+		return false
+	}
+}
+
+func releaseMCPSlot(slots chan struct{}) { <-slots }
+
+func writeMCPRPCResult(w http.ResponseWriter, id json.RawMessage, result any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Cache-Control", "no-store")
+	w.WriteHeader(http.StatusOK)
+	_ = json.NewEncoder(w).Encode(mcpJSONRPCResponse{JSONRPC: "2.0", ID: id, Result: result})
+}
+
+func writeMCPRPCError(w http.ResponseWriter, id json.RawMessage, code int, message string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Cache-Control", "no-store")
+	w.WriteHeader(http.StatusOK)
+	_ = json.NewEncoder(w).Encode(mcpJSONRPCResponse{JSONRPC: "2.0", ID: id, Error: &mcpJSONRPCError{Code: code, Message: message}})
+}
+
+func (p *mcpProxy) close(ctx context.Context) error {
+	if p == nil {
+		return nil
+	}
+	p.mu.Lock()
+	if p.closed {
+		p.mu.Unlock()
+		return nil
+	}
+	p.closed = true
+	sessions := make([]*mcpProxySession, 0, len(p.sessions))
+	for _, session := range p.sessions {
+		sessions = append(sessions, session)
+	}
+	p.mu.Unlock()
+	for _, session := range sessions {
+		session.close()
+	}
+	if err := p.server.Shutdown(ctx); err != nil {
+		return errors.Join(err, p.server.Close())
+	}
+	return nil
+}
diff --git a/workers/acp/supervisor/mcp_proxy_test.go b/workers/acp/supervisor/mcp_proxy_test.go
new file mode 100644
index 000000000..5ec2d9915
--- /dev/null
+++ b/workers/acp/supervisor/mcp_proxy_test.go
@@ -0,0 +1,295 @@
+package supervisor
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+func TestMCPProxyIsPromptScopedAndForwardsExactAuthorization(t *testing.T) {
+	var calls atomic.Int32
+	captured := make(chan harnessv2.MCPBrokerCallRequest, 1)
+	broker := MCPBrokerFunc(func(_ context.Context, request harnessv2.MCPBrokerCallRequest) (harnessv2.MCPBrokerCallResponse, error) {
+		calls.Add(1)
+		captured <- request
+		return harnessv2.MCPBrokerCallResponse{
+			Protocol: harnessv2.ProtocolVersion, CallID: request.Call.CallID,
+			Result: json.RawMessage(`{"value":"ok"}`),
+		}, nil
+	})
+	session, server := newTestMCPProxySession(t, broker, false)
+
+	initialize := doMCPRequest(t, server, "credential", `{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}`)
+	if initialize.StatusCode != http.StatusOK {
+		t.Fatalf("initialize status = %d", initialize.StatusCode)
+	}
+	_ = initialize.Body.Close()
+
+	idleList := decodeMCPResponse(t, doMCPRequest(t, server, "credential", `{"jsonrpc":"2.0","id":2,"method":"tools/list"}`))
+	if idleList.Error != nil || responseToolCount(idleList.Result) != 1 {
+		t.Fatalf("idle tools/list = %#v", idleList)
+	}
+	idleCall := decodeMCPResponse(t, doMCPRequest(t, server, "credential", `{"jsonrpc":"2.0","id":"call-1","method":"tools/call","params":{"name":"lookup","arguments":{}}}`))
+	if idleCall.Error == nil || calls.Load() != 0 {
+		t.Fatalf("idle tool call = %#v calls=%d", idleCall, calls.Load())
+	}
+
+	now := time.Now().UTC()
+	authorization, lease := testMCPAuthorization(t, session.fence, now, false)
+	if err := session.activate(authorization, lease, now); err != nil {
+		t.Fatal(err)
+	}
+	pendingCall := decodeMCPResponse(t, doMCPRequest(t, server, "credential", `{"jsonrpc":"2.0","id":"call-2","method":"tools/call","params":{"name":"lookup","arguments":{}}}`))
+	if pendingCall.Error == nil || calls.Load() != 0 {
+		t.Fatalf("pre-accept tool call = %#v calls=%d", pendingCall, calls.Load())
+	}
+	if err := session.markRunning(authorization.PromptID, now.Add(time.Millisecond)); err != nil {
+		t.Fatal(err)
+	}
+	activeList := decodeMCPResponse(t, doMCPRequest(t, server, "credential", `{"jsonrpc":"2.0","id":3,"method":"tools/list"}`))
+	if activeList.Error != nil || responseToolCount(activeList.Result) != 1 {
+		t.Fatalf("active tools/list = %#v", activeList)
+	}
+	activeCall := decodeMCPResponse(t, doMCPRequest(t, server, "credential", `{"jsonrpc":"2.0","id":"call-3","method":"tools/call","params":{"name":"lookup","arguments":{"query":"x"}}}`))
+	if activeCall.Error != nil {
+		t.Fatalf("active tool call = %#v", activeCall)
+	}
+	select {
+	case request := <-captured:
+		if request.Metadata.Fence != session.fence || request.Authorization.RuntimeSessionUID != session.fence.RuntimeSessionUID ||
+			request.Authorization.SessionGeneration != session.fence.RuntimeSessionGeneration ||
+			request.Metadata.TaskUID != authorization.TaskUID || request.Metadata.TaskAttempt != authorization.TaskAttempt ||
+			request.Metadata.PromptID != authorization.PromptID || request.Lease.Generation != lease.Generation ||
+			request.Authorization.ToolPolicy.DescriptorDigest != authorization.ToolPolicy.DescriptorDigest {
+			t.Fatalf("forwarded request lost exact prompt authorization: %#v", request)
+		}
+	case <-time.After(time.Second):
+		t.Fatal("broker did not receive active tool call")
+	}
+
+	unauthorized := doMCPRequest(t, server, "wrong", `{"jsonrpc":"2.0","id":4,"method":"tools/list"}`)
+	if unauthorized.StatusCode != http.StatusUnauthorized {
+		t.Fatalf("wrong credential status = %d", unauthorized.StatusCode)
+	}
+	_ = unauthorized.Body.Close()
+}
+
+func TestMCPProxySettlementRevokesAndCancelsInflightCall(t *testing.T) {
+	entered := make(chan struct{})
+	cancelled := make(chan struct{})
+	var once sync.Once
+	broker := MCPBrokerFunc(func(ctx context.Context, request harnessv2.MCPBrokerCallRequest) (harnessv2.MCPBrokerCallResponse, error) {
+		once.Do(func() { close(entered) })
+		<-ctx.Done()
+		close(cancelled)
+		return harnessv2.MCPBrokerCallResponse{}, ctx.Err()
+	})
+	session, server := newTestMCPProxySession(t, broker, false)
+	now := time.Now().UTC()
+	authorization, lease := testMCPAuthorization(t, session.fence, now, false)
+	if err := session.activate(authorization, lease, now); err != nil {
+		t.Fatal(err)
+	}
+	if err := session.markRunning(authorization.PromptID, now.Add(time.Millisecond)); err != nil {
+		t.Fatal(err)
+	}
+
+	responseDone := make(chan mcpJSONRPCResponse, 1)
+	go func() {
+		responseDone <- decodeMCPResponse(t, doMCPRequest(t, server, "credential", `{"jsonrpc":"2.0","id":"inflight","method":"tools/call","params":{"name":"lookup","arguments":{}}}`))
+	}()
+	select {
+	case <-entered:
+	case <-time.After(time.Second):
+		t.Fatal("broker call did not start")
+	}
+	session.deactivate(authorization.PromptID, harnessv2.RuntimeSessionStateValidating)
+	select {
+	case <-cancelled:
+	case <-time.After(time.Second):
+		t.Fatal("settlement did not cancel in-flight broker call")
+	}
+	select {
+	case response := <-responseDone:
+		if response.Error == nil {
+			t.Fatalf("cancelled call response = %#v", response)
+		}
+	case <-time.After(time.Second):
+		t.Fatal("cancelled MCP request did not return")
+	}
+	postSettlement := decodeMCPResponse(t, doMCPRequest(t, server, "credential", `{"jsonrpc":"2.0","id":"after","method":"tools/call","params":{"name":"lookup","arguments":{}}}`))
+	if postSettlement.Error == nil {
+		t.Fatalf("post-settlement call = %#v", postSettlement)
+	}
+}
+
+func TestMCPProxyApprovalPolicyIsFailClosedAndOnceBound(t *testing.T) {
+	var calls atomic.Int32
+	broker := MCPBrokerFunc(func(_ context.Context, request harnessv2.MCPBrokerCallRequest) (harnessv2.MCPBrokerCallResponse, error) {
+		calls.Add(1)
+		if request.Call.Approval == nil || request.Call.Approval.ToolName != "mutate" {
+			t.Fatalf("broker call omitted approval evidence: %#v", request.Call)
+		}
+		return harnessv2.MCPBrokerCallResponse{
+			Protocol: harnessv2.ProtocolVersion, CallID: request.Call.CallID, Result: json.RawMessage(`{"changed":true}`),
+		}, nil
+	})
+	session, server := newTestMCPProxySession(t, broker, true)
+	now := time.Now().UTC()
+	authorization, lease := testMCPAuthorization(t, session.fence, now, true)
+	if err := session.activate(authorization, lease, now); err != nil {
+		t.Fatal(err)
+	}
+	if err := session.markRunning(authorization.PromptID, now.Add(time.Millisecond)); err != nil {
+		t.Fatal(err)
+	}
+	withoutApproval := decodeMCPResponse(t, doMCPRequest(t, server, "credential", `{"jsonrpc":"2.0","id":"once","method":"tools/call","params":{"name":"mutate","arguments":{}}}`))
+	if withoutApproval.Error == nil || calls.Load() != 0 {
+		t.Fatalf("unapproved call = %#v calls=%d", withoutApproval, calls.Load())
+	}
+	evidence := harnessv2.MCPApprovalEvidence{
+		PermissionRequestID: "permission-1", ToolCallID: "provider-call-1", ToolName: "mutate",
+		GrantedAt: now, ExpiresAt: now.Add(time.Minute),
+	}
+	if err := session.grantApproval(authorization.PromptID, evidence); err != nil {
+		t.Fatal(err)
+	}
+	approved := decodeMCPResponse(t, doMCPRequest(t, server, "credential", `{"jsonrpc":"2.0","id":"once","method":"tools/call","params":{"name":"mutate","arguments":{}}}`))
+	if approved.Error != nil || calls.Load() != 1 {
+		t.Fatalf("approved call = %#v calls=%d", approved, calls.Load())
+	}
+	replay := decodeMCPResponse(t, doMCPRequest(t, server, "credential", `{"jsonrpc":"2.0","id":"once","method":"tools/call","params":{"name":"mutate","arguments":{}}}`))
+	if replay.Error != nil || calls.Load() != 2 {
+		t.Fatalf("same-call approval replay = %#v calls=%d", replay, calls.Load())
+	}
+	differentCall := decodeMCPResponse(t, doMCPRequest(t, server, "credential", `{"jsonrpc":"2.0","id":"different","method":"tools/call","params":{"name":"mutate","arguments":{}}}`))
+	if differentCall.Error == nil || calls.Load() != 2 {
+		t.Fatalf("different call reused allow-once = %#v calls=%d", differentCall, calls.Load())
+	}
+}
+
+func newTestMCPProxySession(t *testing.T, broker MCPBroker, requireApproval bool) (*mcpProxySession, string) {
+	t.Helper()
+	proxy, err := newMCPProxy(broker)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		_ = proxy.close(ctx)
+	})
+	fence := harnessv2.Fence{
+		RuntimeInstanceID: "runtime-instance", SupervisorBootID: "boot", ControllerEpoch: 2,
+		RuntimePoolUID: "pool-uid", RuntimePoolGeneration: 4,
+		RuntimeSessionUID: "session-uid", RuntimeSessionGeneration: 3,
+		RuntimeProfileDigest:       harnessv2.ProfileDigest(testDigest("profile")),
+		ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+	}
+	authorization, _ := testMCPAuthorization(t, fence, time.Now().UTC(), requireApproval)
+	session, binding, err := proxy.newSession(fence, authorization.Configuration())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if binding.Type != providerProxyScheme || binding.URL == "" || len(binding.Headers) != 1 {
+		t.Fatalf("MCP binding = %#v", binding)
+	}
+	// The helper uses a stable credential so requests are concise and the random
+	// production credential never appears in test failure output.
+	session.mu.Lock()
+	session.credential = []byte("credential")
+	session.mu.Unlock()
+	return session, binding.URL
+}
+
+func testMCPAuthorization(t *testing.T, fence harnessv2.Fence, now time.Time, requireApproval bool) (harnessv2.PromptMCPAuthorization, harnessv2.PromptLease) {
+	t.Helper()
+	name, effect := "lookup", harnessv2.MCPToolEffectReadOnly
+	if requireApproval {
+		name, effect = "mutate", harnessv2.MCPToolEffectConsequential
+	}
+	descriptors := []harnessv2.MCPToolDescriptor{{
+		Name: name, Description: "test tool", InputSchema: json.RawMessage(`{"type":"object"}`),
+		Source: harnessv2.MCPToolSourceBrokeredBuiltin, Effect: effect,
+	}}
+	digest, err := harnessv2.CanonicalMCPToolDescriptorDigest(descriptors)
+	if err != nil {
+		t.Fatal(err)
+	}
+	approval := harnessv2.MCPApprovalPolicy{}
+	if requireApproval {
+		approval.RequiredTools = []string{name}
+	}
+	toolPolicy := harnessv2.MCPToolPolicy{
+		AllowedToolNames: []string{name}, AllowBash: true, Tools: descriptors, DescriptorDigest: digest,
+	}
+	toolDigest, err := harnessv2.CanonicalRuntimeToolPolicyDigest(toolPolicy.AllowedToolNames, toolPolicy.DisallowedToolNames, toolPolicy.AllowBash)
+	if err != nil {
+		t.Fatal(err)
+	}
+	approvalDigest, err := harnessv2.CanonicalMCPApprovalPolicyDigest(approval)
+	if err != nil {
+		t.Fatal(err)
+	}
+	mcpDigest, err := harnessv2.CanonicalMCPConfigurationDigest(toolPolicy.AllowedToolNames)
+	if err != nil {
+		t.Fatal(err)
+	}
+	lease := harnessv2.PromptLease{Generation: 1, IssuedAt: now, ExpiresAt: now.Add(2 * time.Minute)}
+	return harnessv2.PromptMCPAuthorization{
+		RuntimeSessionUID: fence.RuntimeSessionUID, SessionGeneration: fence.RuntimeSessionGeneration,
+		TaskUID: "task-uid", TaskAttempt: 1, PromptID: testPromptOneID, LeaseGeneration: lease.Generation,
+		ToolPolicyDigest: toolDigest, ApprovalPolicyDigest: approvalDigest, MCPConfigurationDigest: mcpDigest,
+		ToolPolicy: toolPolicy, ApprovalPolicy: approval, ExpiresAt: now.Add(time.Minute),
+	}, lease
+}
+
+func doMCPRequest(t *testing.T, endpoint, credential, payload string) *http.Response {
+	t.Helper()
+	request, err := http.NewRequest(http.MethodPost, endpoint, strings.NewReader(payload))
+	if err != nil {
+		t.Fatal(err)
+	}
+	request.Header.Set("Content-Type", "application/json")
+	request.Header.Set("Authorization", "Bearer "+credential)
+	response, err := http.DefaultClient.Do(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return response
+}
+
+func decodeMCPResponse(t *testing.T, response *http.Response) mcpJSONRPCResponse {
+	t.Helper()
+	defer response.Body.Close() //nolint:errcheck
+	data, err := io.ReadAll(response.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var decoded mcpJSONRPCResponse
+	if err := json.NewDecoder(bytes.NewReader(data)).Decode(&decoded); err != nil {
+		t.Fatalf("decode MCP response: %v body=%s", err, data)
+	}
+	return decoded
+}
+
+func responseToolCount(value any) int {
+	object, ok := value.(map[string]any)
+	if !ok {
+		return -1
+	}
+	tools, ok := object["tools"].([]any)
+	if !ok {
+		return -1
+	}
+	return len(tools)
+}
diff --git a/workers/acp/supervisor/opencode_env_test.go b/workers/acp/supervisor/opencode_env_test.go
new file mode 100644
index 000000000..2f30a983a
--- /dev/null
+++ b/workers/acp/supervisor/opencode_env_test.go
@@ -0,0 +1,450 @@
+package supervisor
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/orka-agents/orka/internal/acp"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+const testVekilV1URL = "http://vekil:1337" + "/v1"
+
+func testOpenCodeModelLimits() *harnessv2.ModelTokenLimits {
+	return &harnessv2.ModelTokenLimits{Context: 32768, Output: 4096}
+}
+
+//nolint:gocyclo // Table-driven policy coverage intentionally exercises the complete config surface.
+func TestOpenCodeProviderProfileIsImmutableAndGoverned(t *testing.T) {
+	paths := acp.SessionPaths{Config: "/sessions/private/xdg/config", Home: "/sessions/private/home", Workspace: "/sessions/private/workspace"}
+	proxy := ProviderProxyBinding{BaseURL: "http://127.0.0.1:43210/_orka/provider/session/v1", Credential: "placeholder"}
+	request := harnessv2.CreateRuntimeSessionRequest{
+		MCPConfiguration: harnessv2.MCPPolicyConfiguration{
+			ToolPolicy: harnessv2.MCPToolPolicy{
+				AllowedToolNames: []string{
+					"APPLY_PATCH", "BASH", "EDIT", "GLOB", "GREP", "QUESTION", "READ",
+					"SKILL", "TASK", "TODOWRITE", "WEBFETCH", "WEBSEARCH", "WRITE",
+					"danger.tool", "web_search",
+				},
+				DisallowedToolNames: []string{"DANGER.TOOL", "gReP"},
+				AllowBash:           true,
+				Tools: []harnessv2.MCPToolDescriptor{
+					{Name: "READ", Source: harnessv2.MCPToolSourceProviderNative},
+					{Name: "danger.tool", Source: harnessv2.MCPToolSourceBrokeredBuiltin},
+					{Name: "web_search", Source: harnessv2.MCPToolSourceBrokeredBuiltin},
+				},
+			},
+		},
+	}
+
+	for _, test := range []struct {
+		intent    harnessv2.WorkspaceIntent
+		editRule  string
+		writeRule string
+		bashRule  string
+	}{
+		{intent: harnessv2.WorkspaceIntentRead, editRule: openCodePermissionDeny, writeRule: openCodePermissionDeny, bashRule: openCodePermissionDeny},
+		{intent: harnessv2.WorkspaceIntentWrite, editRule: openCodePermissionAllow, writeRule: openCodePermissionAllow, bashRule: openCodePermissionAllow},
+	} {
+		t.Run(string(test.intent), func(t *testing.T) {
+			profile, err := providerProfile(providerKindOpencode, "openai/gpt-test", test.intent, testOpenCodeModelLimits())
+			if err != nil {
+				t.Fatal(err)
+			}
+			if profile.Command != "/opt/opencode/bin/opencode" || !containsArg(profile.Args, "--pure") || !containsArg(profile.Args, "acp") || !containsArg(profile.Args, "--no-mdns") {
+				t.Fatalf("OpenCode does not use the hardened native ACP command: command=%q args=%v", profile.Command, profile.Args)
+			}
+			digests := providerAdapterDigests(providerKindOpencode)
+			if got := digests[profile.AdapterName]; got != profile.AdapterDigest {
+				t.Fatalf("OpenCode adapter digest = %q, advertised %q", profile.AdapterDigest, got)
+			}
+			if digests["opencode-ripgrep-linux-amd64"] != "sha256:"+acp.OpenCodeRipgrepLinuxX64BinarySHA256 ||
+				digests["opencode-ripgrep-linux-arm64"] != "sha256:"+acp.OpenCodeRipgrepLinuxARM64BinarySHA256 {
+				t.Fatalf("OpenCode ripgrep digests = %#v", digests)
+			}
+
+			environment, err := profile.EnvironmentForSession(request, paths, proxy)
+			if err != nil {
+				t.Fatal(err)
+			}
+			for _, name := range []string{
+				"OPENCODE_DISABLE_AUTOUPDATE",
+				"OPENCODE_DISABLE_CLAUDE_CODE",
+				"OPENCODE_DISABLE_DEFAULT_PLUGINS",
+				"OPENCODE_DISABLE_EMBEDDED_WEB_UI",
+				"OPENCODE_DISABLE_EXTERNAL_SKILLS",
+				"OPENCODE_DISABLE_LSP_DOWNLOAD",
+				"OPENCODE_DISABLE_MODELS_FETCH",
+				"OPENCODE_DISABLE_PROJECT_CONFIG",
+				"OPENCODE_EXPERIMENTAL_DISABLE_FILEWATCHER",
+				"OPENCODE_PURE",
+			} {
+				if environment[name] != "1" {
+					t.Fatalf("%s = %q, want 1", name, environment[name])
+				}
+			}
+			if environment["OPENCODE_CONFIG_DIR"] != "/sessions/private/xdg/config/opencode" {
+				t.Fatalf("OPENCODE_CONFIG_DIR = %q", environment["OPENCODE_CONFIG_DIR"])
+			}
+			if environment[openCodeProviderEnvName] != proxy.Credential {
+				t.Fatal("OpenCode did not receive the per-session provider credential")
+			}
+			if environment["OPENCODE_AUTH_CONTENT"] != "{}" {
+				t.Fatalf("OPENCODE_AUTH_CONTENT = %q, want isolated empty auth store", environment["OPENCODE_AUTH_CONTENT"])
+			}
+			if password := environment["OPENCODE_SERVER_PASSWORD"]; len(password) != 64 || password == proxy.Credential {
+				t.Fatalf("OpenCode server password was not independently derived: %q", password)
+			}
+			if strings.Contains(environment["OPENCODE_CONFIG_CONTENT"], proxy.Credential) {
+				t.Fatal("OpenCode config content embeds the per-session provider credential")
+			}
+
+			var config map[string]any
+			if err := json.Unmarshal([]byte(environment["OPENCODE_CONFIG_CONTENT"]), &config); err != nil {
+				t.Fatal(err)
+			}
+			if config["model"] != "orka/openai/gpt-test" || config["small_model"] != "orka/openai/gpt-test" || config["autoupdate"] != false || config["share"] != "disabled" {
+				t.Fatalf("unexpected OpenCode root config: %#v", config)
+			}
+			if config["lsp"] != false || config["formatter"] != false || config["snapshot"] != false {
+				t.Fatalf("OpenCode local discovery/state features are not disabled: %#v", config)
+			}
+			instructions := config["instructions"].([]any)
+			if len(instructions) != 2 || instructions[0] != openCodeRootInstructionPath || instructions[1] != "/sessions/private/workspace/AGENTS.md" {
+				t.Fatalf("OpenCode instructions = %#v", instructions)
+			}
+			enabledProviders := config["enabled_providers"].([]any)
+			if len(enabledProviders) != 1 || enabledProviders[0] != openCodeProviderID {
+				t.Fatalf("OpenCode enabled providers = %#v", enabledProviders)
+			}
+
+			provider := config["provider"].(map[string]any)[openCodeProviderID].(map[string]any)
+			if provider["npm"] != "@ai-sdk/openai-compatible" {
+				t.Fatalf("unexpected OpenCode provider: %#v", provider)
+			}
+			whitelist := provider["whitelist"].([]any)
+			if len(whitelist) != 1 || whitelist[0] != "openai/gpt-test" {
+				t.Fatalf("OpenCode provider whitelist = %#v, want selected model only", whitelist)
+			}
+			if _, exists := provider["api"]; exists {
+				t.Fatalf("OpenCode provider unexpectedly configures api: %#v", provider)
+			}
+			options := provider["options"].(map[string]any)
+			if options["apiKey"] != "{env:"+openCodeProviderEnvName+"}" || options["baseURL"] != proxy.BaseURL {
+				t.Fatalf("unexpected OpenCode provider options: %#v", options)
+			}
+			model := provider["models"].(map[string]any)["openai/gpt-test"].(map[string]any)
+			limit := model["limit"].(map[string]any)
+			if limit["context"] != float64(32768) || limit["output"] != float64(4096) {
+				t.Fatalf("OpenCode model limits = %#v", limit)
+			}
+			for _, field := range []string{"tool_call", "attachment", "modalities"} {
+				if _, exists := model[field]; exists {
+					t.Fatalf("OpenCode model override contains unreviewed %s metadata: %#v", field, model)
+				}
+			}
+
+			permissions := config["permission"].(map[string]any)
+			if permissions["*"] != openCodePermissionDeny || permissions["external_directory"] != openCodePermissionDeny ||
+				permissions["edit"] != test.editRule || permissions["write"] != test.writeRule || permissions["apply_patch"] != test.writeRule || permissions["bash"] != test.bashRule {
+				t.Fatalf("unexpected OpenCode permissions: %#v", permissions)
+			}
+			for _, name := range []string{"task", "skill", "question", "lsp", "doom_loop"} {
+				if permissions[name] != openCodePermissionDeny {
+					t.Fatalf("OpenCode permission %q = %#v, want deny", name, permissions[name])
+				}
+			}
+			if permissions["glob"] != openCodePermissionAllow {
+				t.Fatalf("OpenCode glob permission = %#v, want allow", permissions["glob"])
+			}
+			for _, name := range []string{"grep", "list", "todowrite", "webfetch", "websearch"} {
+				if permissions[name] != openCodePermissionDeny {
+					t.Fatalf("OpenCode permission %q = %#v, want deny from tool policy", name, permissions[name])
+				}
+			}
+			if permissions["orka_web_search"] != openCodePermissionAllow || permissions["orka_danger_tool"] != openCodePermissionDeny {
+				t.Fatalf("unexpected brokered MCP permissions: %#v", permissions)
+			}
+			if _, exists := permissions["orka_READ"]; exists {
+				t.Fatalf("provider-native descriptor received brokered MCP permission: %#v", permissions)
+			}
+			readRules := permissions["read"].(map[string]any)
+			if readRules["*"] != openCodePermissionAllow || readRules["*.env"] != openCodePermissionDeny || readRules["*.env.*"] != openCodePermissionDeny || readRules["*.env.example"] != openCodePermissionAllow {
+				t.Fatalf("unexpected OpenCode sensitive read rules: %#v", readRules)
+			}
+			if containsOpenCodePermissionAction(permissions, "ask") {
+				t.Fatal("OpenCode permissions contain unsupported ask policy")
+			}
+		})
+	}
+}
+
+func TestOpenCodeProviderSessionProjectionValidatesImmutableAgentConfiguration(t *testing.T) {
+	profile, err := providerProfile(
+		providerKindOpencode,
+		"openai/gpt-test",
+		harnessv2.WorkspaceIntentWrite,
+		testOpenCodeModelLimits(),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	paths := acp.SessionPaths{Workspace: "/sessions/private/workspace"}
+	proxy := ProviderProxyBinding{BaseURL: "http://127.0.0.1:43210/_orka/provider/session/v1", Credential: "placeholder"}
+	request := testProviderProjectionRequest(
+		t,
+		providerKindOpencode,
+		"openai/gpt-test",
+		"",
+		"",
+		nil,
+		nil,
+		true,
+	)
+	request.Profile.ModelLimits = testOpenCodeModelLimits()
+	if _, err := profile.ProjectSession(request, paths, proxy); err != nil {
+		t.Fatalf("valid OpenCode session projection error = %v", err)
+	}
+
+	request = testProviderProjectionRequest(
+		t,
+		providerKindOpencode,
+		"openai/gpt-test",
+		"must not be ignored",
+		"",
+		nil,
+		nil,
+		true,
+	)
+	request.Profile.ModelLimits = testOpenCodeModelLimits()
+	if _, err := profile.ProjectSession(request, paths, proxy); err == nil || !strings.Contains(err.Error(), "systemPrompt") {
+		t.Fatalf("OpenCode systemPrompt projection error = %v, want rejection", err)
+	}
+
+	request.AgentConfiguration = nil
+	if _, err := profile.ProjectSession(request, paths, proxy); err == nil || !strings.Contains(err.Error(), "required") {
+		t.Fatalf("missing OpenCode Agent configuration error = %v, want rejection", err)
+	}
+}
+
+func TestOpenCodeProviderProfileRejectsConfigSubstitutionModel(t *testing.T) {
+	for _, model := range []string{"{env:ORKA_OPENCODE_PROVIDER_TOKEN}", "{file:/proc/self/environ}"} {
+		if _, err := providerProfile(providerKindOpencode, model, harnessv2.WorkspaceIntentWrite, testOpenCodeModelLimits()); err == nil ||
+			!strings.Contains(err.Error(), "substitution braces") {
+			t.Fatalf("providerProfile(%q) error = %v, want substitution rejection", model, err)
+		}
+	}
+}
+
+func TestPrepareOpenCodeConfigPreventsDependencyInstall(t *testing.T) {
+	paths := acp.SessionPaths{Config: filepath.Join(t.TempDir(), "xdg", "config")}
+	profile, err := providerProfile(providerKindOpencode, "openai/gpt-test", harnessv2.WorkspaceIntentRead, testOpenCodeModelLimits())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if profile.PrepareSession == nil {
+		t.Fatal("OpenCode profile does not prepare its private config directory")
+	}
+	if err := profile.PrepareSession(paths); err != nil {
+		t.Fatal(err)
+	}
+
+	configDir := filepath.Join(paths.Config, "opencode")
+	nodeModules := filepath.Join(configDir, "node_modules")
+	info, err := os.Stat(nodeModules)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !info.IsDir() || info.Mode().Perm() != 0o700 {
+		t.Fatalf("node_modules mode = %v, want private directory", info.Mode())
+	}
+	if _, err := os.Stat(filepath.Join(nodeModules, "@opencode-ai", "plugin")); !os.IsNotExist(err) {
+		t.Fatalf("OpenCode plugin code must not be vendored, stat error = %v", err)
+	}
+
+	var packageJSON map[string]any
+	packageData, err := os.ReadFile(filepath.Join(configDir, "package.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := json.Unmarshal(packageData, &packageJSON); err != nil {
+		t.Fatal(err)
+	}
+	dependencies := packageJSON["dependencies"].(map[string]any)
+	if dependencies["@opencode-ai/plugin"] != acp.OpenCodeVersion {
+		t.Fatalf("package.json dependencies = %#v", dependencies)
+	}
+
+	var lockJSON map[string]any
+	lockData, err := os.ReadFile(filepath.Join(configDir, "package-lock.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := json.Unmarshal(lockData, &lockJSON); err != nil {
+		t.Fatal(err)
+	}
+	root := lockJSON["packages"].(map[string]any)[""].(map[string]any)
+	locked := root["dependencies"].(map[string]any)
+	if locked["@opencode-ai/plugin"] != acp.OpenCodeVersion {
+		t.Fatalf("package-lock.json root dependencies = %#v", locked)
+	}
+}
+
+func TestOpenCodeBrokeredPermissionsUseDisjointNativeNamespace(t *testing.T) {
+	policy := harnessv2.MCPToolPolicy{
+		AllowedToolNames: []string{"bash"}, AllowBash: true,
+		Tools: []harnessv2.MCPToolDescriptor{{
+			Name: "bash", Source: harnessv2.MCPToolSourceBrokeredBuiltin, Effect: harnessv2.MCPToolEffectConsequential,
+		}},
+	}
+	permissions, err := openCodeBrokeredPermissions(policy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !permissions["orka_bash"] {
+		t.Fatalf("brokered Bash permission = %#v, want namespaced allow", permissions)
+	}
+	if _, exists := permissions["bash"]; exists {
+		t.Fatalf("brokered permission overwrote native Bash key: %#v", permissions)
+	}
+}
+
+func TestOpenCodeSessionConfigRejectsCollidingBrokeredPermissionNames(t *testing.T) {
+	paths := acp.SessionPaths{Workspace: "/sessions/private/workspace"}
+	proxy := ProviderProxyBinding{BaseURL: "http://127.0.0.1:43210/_orka/provider/session", Credential: "placeholder"}
+	tools := []harnessv2.MCPToolDescriptor{
+		{Name: "web.search", Source: harnessv2.MCPToolSourceBrokeredCustom, Effect: harnessv2.MCPToolEffectReadOnly, DefinitionDigest: "sha256:" + strings.Repeat("a", 64), InputSchema: json.RawMessage(`{"type":"object"}`)},
+		{Name: "web_search", Source: harnessv2.MCPToolSourceBrokeredBuiltin, Effect: harnessv2.MCPToolEffectReadOnly, InputSchema: json.RawMessage(`{"type":"object"}`)},
+	}
+	slices.SortFunc(tools, func(a, b harnessv2.MCPToolDescriptor) int { return strings.Compare(a.Name, b.Name) })
+	descriptorDigest, err := harnessv2.CanonicalMCPToolDescriptorDigest(tools)
+	if err != nil {
+		t.Fatal(err)
+	}
+	policy := harnessv2.MCPToolPolicy{
+		AllowedToolNames: []string{"web.search", "web_search"},
+		Tools:            tools, DescriptorDigest: descriptorDigest,
+	}
+	request := harnessv2.CreateRuntimeSessionRequest{MCPConfiguration: harnessv2.MCPPolicyConfiguration{ToolPolicy: policy}}
+	_, err = openCodeSessionConfig("openai/gpt-test", testOpenCodeModelLimits(), harnessv2.WorkspaceIntentWrite, request, paths, proxy)
+	if err == nil || !strings.Contains(err.Error(), "collide in OpenCode permission name") {
+		t.Fatalf("openCodeSessionConfig() error = %v, want sanitized permission collision rejection", err)
+	}
+}
+
+func TestOpenCodeReadIntentDeniesGrepContentAccess(t *testing.T) {
+	paths := acp.SessionPaths{Workspace: "/sessions/private/workspace"}
+	proxy := ProviderProxyBinding{BaseURL: "http://127.0.0.1:43210/_orka/provider/session", Credential: "placeholder"}
+	request := harnessv2.CreateRuntimeSessionRequest{MCPConfiguration: harnessv2.MCPPolicyConfiguration{
+		ToolPolicy: harnessv2.MCPToolPolicy{AllowedToolNames: []string{"Grep", "Read"}},
+	}}
+
+	readConfig, err := openCodeSessionConfig("openai/gpt-test", testOpenCodeModelLimits(), harnessv2.WorkspaceIntentRead, request, paths, proxy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	writeConfig, err := openCodeSessionConfig("openai/gpt-test", testOpenCodeModelLimits(), harnessv2.WorkspaceIntentWrite, request, paths, proxy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for name, data := range map[string][]byte{"read": readConfig, "write": writeConfig} {
+		var config map[string]any
+		if err := json.Unmarshal(data, &config); err != nil {
+			t.Fatal(err)
+		}
+		got := config["permission"].(map[string]any)["grep"]
+		want := any(openCodePermissionAllow)
+		if name == "read" {
+			want = openCodePermissionDeny
+		}
+		if got != want {
+			t.Fatalf("%s-intent grep permission = %#v, want %#v", name, got, want)
+		}
+	}
+}
+
+func TestOpenCodeMutationPermissionAliasesAreFailClosed(t *testing.T) {
+	paths := acp.SessionPaths{Workspace: "/sessions/private/workspace"}
+	proxy := ProviderProxyBinding{BaseURL: "http://127.0.0.1:43210/_orka/provider/session/v1", Credential: "placeholder"}
+	for _, test := range []struct {
+		name       string
+		intent     harnessv2.WorkspaceIntent
+		allowed    []string
+		disallowed []string
+		want       string
+	}{
+		{name: "gpt_apply_patch", intent: harnessv2.WorkspaceIntentWrite, allowed: []string{"APPLY_PATCH"}, want: openCodePermissionAllow},
+		{name: "edit_alias_enables_gpt_patch", intent: harnessv2.WorkspaceIntentWrite, allowed: []string{"EdIt"}, want: openCodePermissionAllow},
+		{name: "disallowed_write_alias_closes_group", intent: harnessv2.WorkspaceIntentWrite, allowed: []string{"apply_patch", "EDIT"}, disallowed: []string{"WrItE"}, want: openCodePermissionDeny},
+		{name: "read_intent_closes_group", intent: harnessv2.WorkspaceIntentRead, allowed: []string{"apply_patch"}, want: openCodePermissionDeny},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			request := harnessv2.CreateRuntimeSessionRequest{
+				MCPConfiguration: harnessv2.MCPPolicyConfiguration{
+					ToolPolicy: harnessv2.MCPToolPolicy{
+						AllowedToolNames:    test.allowed,
+						DisallowedToolNames: test.disallowed,
+					},
+				},
+			}
+			content, err := openCodeSessionConfig("openai/gpt-test", testOpenCodeModelLimits(), test.intent, request, paths, proxy)
+			if err != nil {
+				t.Fatal(err)
+			}
+			var config map[string]any
+			if err := json.Unmarshal(content, &config); err != nil {
+				t.Fatal(err)
+			}
+			permissions := config["permission"].(map[string]any)
+			for _, name := range []string{"apply_patch", "edit", "write"} {
+				if permissions[name] != test.want {
+					t.Fatalf("mutation permission %q = %#v, want %q; all=%#v", name, permissions[name], test.want, permissions)
+				}
+			}
+		})
+	}
+}
+
+func containsOpenCodePermissionAction(value any, action string) bool {
+	switch typed := value.(type) {
+	case string:
+		return typed == action
+	case map[string]any:
+		for _, nested := range typed {
+			if containsOpenCodePermissionAction(nested, action) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func TestOpenCodeSessionConfigRequiresProviderModel(t *testing.T) {
+	_, err := openCodeSessionConfig(
+		"gpt-test",
+		testOpenCodeModelLimits(),
+		harnessv2.WorkspaceIntentRead,
+		harnessv2.CreateRuntimeSessionRequest{},
+		acp.SessionPaths{Workspace: "/sessions/private/workspace"},
+		ProviderProxyBinding{BaseURL: "http://127.0.0.1:43210/v1", Credential: "placeholder"},
+	)
+	if err == nil || !strings.Contains(err.Error(), "provider/model") {
+		t.Fatalf("openCodeSessionConfig() error = %v, want provider/model rejection", err)
+	}
+}
+
+func TestOpenCodeDefaultProtocolLimitUsesStandardUpdateRate(t *testing.T) {
+	if got := defaultProtocolLimits(providerKindOpencode).MaxUpdateEventsPerSecond; got != harnessv2.DefaultMaxUpdateEventsPerSecond {
+		t.Fatalf("MaxUpdateEventsPerSecond = %d, want %d", got, harnessv2.DefaultMaxUpdateEventsPerSecond)
+	}
+}
+
+func TestOpenCodeProviderUpstreamBaseURLPreservesOpenAISemantics(t *testing.T) {
+	if got := providerUpstreamBaseURL(providerKindOpencode, "http://vekil:1337"); got != testVekilV1URL {
+		t.Fatalf("OpenCode upstream base URL = %q", got)
+	}
+}
diff --git a/workers/acp/supervisor/opencode_provider_proxy_test.go b/workers/acp/supervisor/opencode_provider_proxy_test.go
new file mode 100644
index 000000000..2afc05825
--- /dev/null
+++ b/workers/acp/supervisor/opencode_provider_proxy_test.go
@@ -0,0 +1,219 @@
+package supervisor
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+const testOpenCodeProxyModel = "test-model"
+
+func TestProviderProxyAcceptsOpenCodeChatCompletions(t *testing.T) {
+	observed := make(chan *http.Request, 1)
+	observedBody := make(chan []byte, 1)
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		body, _ := io.ReadAll(r.Body)
+		observed <- r.Clone(r.Context())
+		observedBody <- body
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = io.WriteString(w, `{"ok":true}`)
+	}))
+	defer upstream.Close()
+	_, session, binding := activeTestProviderProxySession(t, ProviderProxyConfig{
+		UpstreamBaseURL: upstream.URL, UpstreamBearerToken: "placeholder",
+		ProviderKind: providerKindOpencode, Model: "openai/" + testOpenCodeProxyModel, ModelOutputLimit: 4096,
+	})
+	defer session.close()
+	response := doProviderProxyRequest(
+		t, http.MethodPost, binding.BaseURL+"/v1/chat/completions", binding.Credential,
+		[]byte(`{
+			"model":"openai/test-model",
+			"max_tokens":32000,
+			"max_completion_tokens":16000,
+			"reasoning_effort":"medium",
+			"verbosity":"low",
+			"stream":true,
+			"stream_options":{"include_usage":true},
+			"messages":[{"role":"user","content":"inspect the workspace"}],
+			"tool_choice":"auto",
+			"tools":[{"type":"function","function":{"name":"read_file","parameters":{"type":"object"}}}]
+		}`), nil,
+	)
+	defer func() { _ = response.Body.Close() }()
+	if response.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(response.Body)
+		t.Fatalf("OpenCode chat completions status = %d body=%s", response.StatusCode, body)
+	}
+	request := <-observed
+	if request.URL.Path != "/v1/chat/completions" || request.Method != http.MethodPost {
+		t.Fatalf("OpenCode upstream request = %s %s", request.Method, request.URL.Path)
+	}
+	var payload map[string]any
+	if err := json.Unmarshal(<-observedBody, &payload); err != nil {
+		t.Fatal(err)
+	}
+	if payload["model"] != testOpenCodeProxyModel {
+		t.Fatalf("OpenCode upstream model = %#v, want %s", payload["model"], testOpenCodeProxyModel)
+	}
+	if _, exists := payload["max_tokens"]; exists {
+		t.Fatalf("OpenCode upstream request retained max_tokens alongside max_completion_tokens: %#v", payload)
+	}
+	if payload["max_completion_tokens"] != float64(4096) {
+		t.Fatalf("OpenCode upstream output limit = %#v, want 4096", payload["max_completion_tokens"])
+	}
+	if _, exists := payload[providerVerbosityField]; exists {
+		t.Fatalf("OpenCode upstream request retained unsupported verbosity: %#v", payload)
+	}
+	if _, exists := payload[providerReasoningEffortField]; exists {
+		t.Fatalf("OpenCode upstream tool request retained unsupported reasoning effort: %#v", payload)
+	}
+	if payload["stream"] != true {
+		t.Fatalf("OpenCode upstream request lost stream setting: %#v", payload)
+	}
+	streamOptions, ok := payload["stream_options"].(map[string]any)
+	if !ok || streamOptions["include_usage"] != true {
+		t.Fatalf("OpenCode upstream request lost stream usage setting: %#v", payload)
+	}
+	tools, ok := payload["tools"].([]any)
+	if !ok || len(tools) != 1 {
+		t.Fatalf("OpenCode upstream request lost tools: %#v", payload)
+	}
+	tool, ok := tools[0].(map[string]any)
+	if !ok || tool["type"] != "function" {
+		t.Fatalf("OpenCode upstream request changed tool declaration: %#v", payload)
+	}
+	if payload["tool_choice"] != "auto" {
+		t.Fatalf("OpenCode upstream request changed tool choice: %#v", payload)
+	}
+	messages, ok := payload["messages"].([]any)
+	if !ok || len(messages) != 1 {
+		t.Fatalf("OpenCode upstream request lost messages: %#v", payload)
+	}
+}
+
+func TestProviderProxyRejectsOpenCodeResponsesAPI(t *testing.T) {
+	if _, err := validateProviderRequest(
+		providerKindOpencode, testOpenCodeProxyModel, "/v1/responses", http.MethodPost, []byte(`{"model":"test-model"}`),
+	); err == nil {
+		t.Fatal("OpenCode Responses API request unexpectedly accepted")
+	}
+}
+
+func TestProviderProxyRejectsOpenCodeModelsAPI(t *testing.T) {
+	for _, path := range []string{"/models", providerModelsV1Path} {
+		if _, err := validateProviderRequest(providerKindOpencode, "openai/"+testOpenCodeProxyModel, path, http.MethodGet, nil); err == nil {
+			t.Fatalf("OpenCode models request %q unexpectedly accepted", path)
+		}
+	}
+}
+
+func TestProviderProxyClassifiesOpenCodeChatAsInference(t *testing.T) {
+	class, err := validateProviderRequest(
+		providerKindOpencode,
+		"openai/"+testOpenCodeProxyModel,
+		providerOpenAIChatCompletionsV1Path,
+		http.MethodPost,
+		[]byte(`{"model":"openai/test-model"}`),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if class != providerRequestInference {
+		t.Fatalf("OpenCode request class = %v, want inference", class)
+	}
+}
+
+func TestNormalizeOpenCodeProviderRequestEnforcesOutputLimit(t *testing.T) {
+	for _, test := range []struct {
+		name      string
+		model     string
+		path      string
+		body      string
+		wantField string
+		want      int64
+		verbosity string
+		reasoning string
+		wantErr   bool
+	}{
+		{name: "OpenAI translates max tokens", model: "openai/gpt-5.4", body: `{"model":"openai/gpt-5.4","max_tokens":1024}`, wantField: "max_completion_tokens", want: 1024},
+		{name: "OpenAI strips unsupported verbosity", model: "openai/gpt-5.4", body: `{"model":"openai/gpt-5.4","max_tokens":1024,"reasoning_effort":"medium","verbosity":"low","stream":true}`, wantField: "max_completion_tokens", want: 1024, reasoning: "medium"},
+		{name: "OpenAI strips reasoning effort with tools", model: "openai/gpt-5.4", body: `{"model":"openai/gpt-5.4","max_tokens":1024,"reasoning_effort":"medium","tools":[{"type":"function","function":{"name":"read_file"}}]}`, wantField: "max_completion_tokens", want: 1024},
+		{name: "mixed-case OpenAI strips reasoning effort on unversioned path", model: "OpEnAi/gpt-5.4", path: providerOpenAIChatCompletionsPath, body: `{"model":"OpEnAi/gpt-5.4","max_tokens":1024,"reasoning_effort":"medium","tools":[{"type":"function","function":{"name":"read_file"}}]}`, wantField: "max_completion_tokens", want: 1024},
+		{name: "OpenAI preserves reasoning effort without tools", model: "openai/gpt-5.4", body: `{"model":"openai/gpt-5.4","max_tokens":1024,"reasoning_effort":"high"}`, wantField: "max_completion_tokens", want: 1024, reasoning: "high"},
+		{name: "OpenAI preserves reasoning effort with empty tools", model: "openai/gpt-5.4", body: `{"model":"openai/gpt-5.4","max_tokens":1024,"reasoning_effort":"low","tools":[]}`, wantField: "max_completion_tokens", want: 1024, reasoning: "low"},
+		{name: "OpenAI preserves reasoning effort with null tools", model: "openai/gpt-5.4", body: `{"model":"openai/gpt-5.4","max_tokens":1024,"reasoning_effort":"low","tools":null}`, wantField: "max_completion_tokens", want: 1024, reasoning: "low"},
+		{name: "OpenAI preserves reasoning effort with malformed tools", model: "openai/gpt-5.4", body: `{"model":"openai/gpt-5.4","max_tokens":1024,"reasoning_effort":"low","tools":{"unexpected":true}}`, wantField: "max_completion_tokens", want: 1024, reasoning: "low"},
+		{name: "OpenAI preserves reasoning effort with tool choice only", model: "openai/gpt-5.4", body: `{"model":"openai/gpt-5.4","max_tokens":1024,"reasoning_effort":"low","tool_choice":"auto"}`, wantField: "max_completion_tokens", want: 1024, reasoning: "low"},
+		{name: "OpenAI tools do not insert reasoning effort", model: "openai/gpt-5.4", body: `{"model":"openai/gpt-5.4","max_tokens":1024,"tools":[null]}`, wantField: "max_completion_tokens", want: 1024},
+		{name: "preserves non-OpenAI compatibility fields", model: "openrouter/openai/gpt-5.4", body: `{"model":"openrouter/openai/gpt-5.4","max_tokens":1024,"reasoning_effort":"medium","verbosity":"high","tools":[{"type":"function","function":{"name":"read_file"}}]}`, wantField: "max_tokens", want: 1024, verbosity: "high", reasoning: "medium"},
+		{name: "injects missing limit", model: "openrouter/anthropic/test-model", body: `{"model":"openrouter/anthropic/test-model"}`, wantField: "max_tokens", want: 4096},
+		{name: "clamps max tokens", model: "openrouter/anthropic/test-model", body: `{"model":"openrouter/anthropic/test-model","max_tokens":9000}`, wantField: "max_tokens", want: 4096},
+		{name: "preserves lower max tokens", model: "openrouter/anthropic/test-model", body: `{"model":"openrouter/anthropic/test-model","max_tokens":1024}`, wantField: "max_tokens", want: 1024},
+		{name: "prefers completion field", model: "openrouter/anthropic/test-model", body: `{"model":"openrouter/anthropic/test-model","max_tokens":3000,"max_completion_tokens":2000}`, wantField: "max_completion_tokens", want: 2000},
+		{name: "rejects zero", model: "openrouter/anthropic/test-model", body: `{"model":"openrouter/anthropic/test-model","max_tokens":0}`, wantErr: true},
+		{name: "rejects fractional", model: "openrouter/anthropic/test-model", body: `{"model":"openrouter/anthropic/test-model","max_tokens":1.5}`, wantErr: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			requestPath := test.path
+			if requestPath == "" {
+				requestPath = providerOpenAIChatCompletionsV1Path
+			}
+			got, err := normalizeProviderRequestBody(
+				providerKindOpencode,
+				test.model,
+				requestPath,
+				4096,
+				[]byte(test.body),
+			)
+			if test.wantErr {
+				if err == nil {
+					t.Fatal("normalizeProviderRequestBody() error = nil, want rejection")
+				}
+				return
+			}
+			if err != nil {
+				t.Fatal(err)
+			}
+			var payload map[string]any
+			if err := json.Unmarshal(got, &payload); err != nil {
+				t.Fatal(err)
+			}
+			providerID, wantModel, _ := strings.Cut(test.model, "/")
+			if payload["model"] != wantModel {
+				t.Fatalf("model = %#v, want %s", payload["model"], wantModel)
+			}
+			if payload[test.wantField] != float64(test.want) {
+				t.Fatalf("%s = %#v, want %d", test.wantField, payload[test.wantField], test.want)
+			}
+			other := "max_completion_tokens"
+			if test.wantField == other {
+				other = "max_tokens"
+			}
+			if _, exists := payload[other]; exists {
+				t.Fatalf("unexpected alternate output limit %s in %#v", other, payload)
+			}
+			verbosity, exists := payload[providerVerbosityField]
+			if test.verbosity != "" {
+				if !exists || verbosity != test.verbosity {
+					t.Fatalf("OpenCode upstream request verbosity = %#v, want %q in %#v", verbosity, test.verbosity, payload)
+				}
+			} else if exists {
+				t.Fatalf("OpenAI-backed OpenCode request retained unsupported verbosity: %#v", payload)
+			}
+			reasoning, exists := payload[providerReasoningEffortField]
+			if test.reasoning != "" {
+				if !exists || reasoning != test.reasoning {
+					t.Fatalf("OpenCode upstream reasoning effort = %#v, want %q in %#v", reasoning, test.reasoning, payload)
+				}
+			} else if exists {
+				t.Fatalf("OpenAI tool-bearing request retained unsupported reasoning effort: %#v", payload)
+			}
+			if strings.EqualFold(providerID, "openai") && strings.Contains(test.body, providerVerbosityField) && payload["stream"] != true {
+				t.Fatalf("OpenCode upstream request lost stream setting: %#v", payload)
+			}
+		})
+	}
+}
diff --git a/workers/acp/supervisor/prompt_handlers.go b/workers/acp/supervisor/prompt_handlers.go
new file mode 100644
index 000000000..9f9886785
--- /dev/null
+++ b/workers/acp/supervisor/prompt_handlers.go
@@ -0,0 +1,1889 @@
+package supervisor
+
+import (
+	"archive/tar"
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"os"
+	"path"
+	"reflect"
+	"slices"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"github.com/orka-agents/orka/internal/acp"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/security"
+	"github.com/orka-agents/orka/internal/workspacedelta"
+)
+
+//nolint:gocyclo // The explicit state-machine branches are easier to audit together.
+func (s *Server) handleStartPrompt(w http.ResponseWriter, r *http.Request) {
+	var request harnessv2.StartPromptRequest
+	if !decodeJSON(w, r, s.cfg.Capabilities.Limits.MaxRequestBytes, &request) {
+		return
+	}
+	now := time.Now().UTC()
+	minLease := time.Duration(s.cfg.Capabilities.Limits.MinPromptLeaseMillis) * time.Millisecond
+	maxLease := time.Duration(s.cfg.Capabilities.Limits.MaxPromptLeaseMillis) * time.Millisecond
+	if err := request.ValidateAt(now, minLease, maxLease); err != nil {
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil, false)
+		return
+	}
+	if string(request.Metadata.PromptID) != r.PathValue("promptID") {
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, "prompt path does not match request", nil, false)
+		return
+	}
+	if !s.authorizeMutation(w, r, request.Metadata, true) {
+		return
+	}
+	sessionID := harnessv2.RuntimeSessionID(r.PathValue("sessionID"))
+	slotHeld := false
+	defer func() {
+		if slotHeld {
+			<-s.promptSlots
+		}
+	}()
+
+	s.mu.Lock()
+	state := s.sessions[sessionID]
+	if state == nil || state.creating {
+		s.mu.Unlock()
+		writeError(w, http.StatusNotFound, harnessv2.ErrorCodeInvalidRequest, "runtime session not found", nil, false)
+		return
+	}
+	if err := s.validateSessionFence(state, request.Metadata); err != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusGone, harnessv2.ErrorCodeStaleFence, err.Error(), nil, false)
+		return
+	}
+	if err := request.MCPAuthorization.ValidateProfile(state.profile); err != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusGone, harnessv2.ErrorCodeStaleFence, err.Error(), nil, false)
+		return
+	}
+	classification, err := harnessv2.ClassifyOperation(
+		s.expectedFence(state.descriptor.RuntimeSessionUID, state.descriptor.Generation), request.Metadata,
+		operationPtr(state.operations, request.Metadata.OperationID), true, now,
+	)
+	if err != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil, false)
+		return
+	}
+	if classification.Class != harnessv2.RequestClassificationFresh {
+		s.mu.Unlock()
+		writeClassificationError(w, classification)
+		return
+	}
+	if s.drain.Requested || state.drainCleanupScheduled {
+		s.mu.Unlock()
+		writeError(w, http.StatusTooManyRequests, harnessv2.ErrorCodeRateLimited, "runtime pool is draining", nil, true)
+		return
+	}
+	if state.descriptor.State != harnessv2.RuntimeSessionStateIdle || (state.prompt != nil && state.prompt.settlement == nil) {
+		s.mu.Unlock()
+		writeError(w, http.StatusConflict, harnessv2.ErrorCodeAlreadyAccepted, "runtime session is not idle", nil, false)
+		return
+	}
+	content, err := promptContentToACP(request.Input.Content)
+	if err != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil, false)
+		return
+	}
+	select {
+	case s.promptSlots <- struct{}{}:
+		slotHeld = true
+	default:
+		s.mu.Unlock()
+		writeError(w, http.StatusTooManyRequests, harnessv2.ErrorCodeRateLimited, "runtime pool is at prompt capacity", nil, true)
+		return
+	}
+	prompt := &promptState{
+		request:   request,
+		operation: operationRecord(request.Metadata, harnessv2.OperationPhaseRecorded, "", now),
+		lease:     request.Lease,
+		startedAt: now,
+	}
+	state.prompt = prompt
+	state.operations[request.Metadata.OperationID] = prompt.operation
+	runtimeSession := state.runtime
+	providerProxy := state.providerProxy
+	mcpProxy := state.mcpProxy
+	if providerProxy == nil ||
+		providerProxy.activateWithMaxTurns(string(request.Metadata.PromptID), state.agentConfiguration.MaxTurns, request.Lease.ExpiresAt, now) != nil {
+		state.prompt = nil
+		delete(state.operations, request.Metadata.OperationID)
+		s.mu.Unlock()
+		writeError(
+			w, http.StatusInternalServerError, harnessv2.ErrorCodeSessionPoisoned,
+			"provider proxy activation failed", nil, false,
+		)
+		return
+	}
+	if mcpProxy == nil || mcpProxy.activate(request.MCPAuthorization, request.Lease, now) != nil {
+		deactivatePromptCapabilities(state, request.Metadata.PromptID, harnessv2.RuntimeSessionStateCancelling)
+		state.prompt = nil
+		delete(state.operations, request.Metadata.OperationID)
+		s.mu.Unlock()
+		writeError(
+			w, http.StatusInternalServerError, harnessv2.ErrorCodeSessionPoisoned,
+			"MCP proxy activation failed", nil, false,
+		)
+		return
+	}
+	stopRequestGate := context.AfterFunc(r.Context(), func() {
+		deactivatePromptCapabilities(state, request.Metadata.PromptID, harnessv2.RuntimeSessionStateCancelling)
+	})
+	defer stopRequestGate()
+	s.mu.Unlock()
+
+	run, err := runtimeSession.StartPromptWithLease(
+		r.Context(), string(request.Metadata.PromptID), string(request.Metadata.RequestDigest),
+		content, request.Lease.ExpiresAt.Sub(now),
+	)
+	if err != nil {
+		deactivatePromptCapabilities(state, request.Metadata.PromptID, harnessv2.RuntimeSessionStateCancelling)
+		s.mu.Lock()
+		if state.prompt == prompt {
+			state.prompt = nil
+			delete(state.operations, request.Metadata.OperationID)
+		}
+		s.mu.Unlock()
+		writeError(w, http.StatusConflict, harnessv2.ErrorCodeAlreadyAccepted, safeError(err), nil, false)
+		return
+	}
+
+	first, ok := <-run.Events
+	if !ok {
+		result := providerTurnLimitResult(state, prompt, <-run.Result)
+		s.finishPrompt(state, prompt, result, time.Now().UTC())
+		if result.Accepted {
+			writeError(
+				w, http.StatusInternalServerError, harnessv2.ErrorCodeOutcomeUnknown,
+				"accepted ACP prompt settled without an event stream", nil, false,
+			)
+		} else {
+			writeError(
+				w, http.StatusBadGateway, harnessv2.ErrorCodeSessionPoisoned,
+				"ACP prompt failed before acceptance", nil, true,
+			)
+		}
+		return
+	}
+
+	limits := eventLimits(s.cfg.Capabilities.Limits)
+	encoder, err := harnessv2.NewEventEncoder(w, limits, harnessv2.EventExpectationFromMetadata(request.Metadata))
+	if err != nil {
+		deactivatePromptCapabilities(state, request.Metadata.PromptID, harnessv2.RuntimeSessionStateCancelling)
+		_, _ = runtimeSession.CancelPrompt(context.Background(), string(request.Metadata.PromptID))
+		writeError(w, http.StatusInternalServerError, harnessv2.ErrorCodeSessionPoisoned, safeError(err), nil, false)
+		return
+	}
+	w.Header().Set("Content-Type", "application/x-ndjson")
+	w.WriteHeader(http.StatusOK)
+	flusher, _ := w.(http.Flusher)
+	streamBroken := false
+	markStreamBroken := func(stage, eventType, updateKind string, sequence int64, err error) {
+		if streamBroken {
+			return
+		}
+		streamBroken = true
+		slog.Error(
+			"ACP prompt stream broken",
+			"stage", stage,
+			"promptID", request.Metadata.PromptID,
+			"eventType", eventType,
+			"updateKind", updateKind,
+			"sequence", sequence,
+			"errorClass", promptStreamErrorClass(err),
+			"validationClass", promptStreamMalformedValidationClass(err),
+			"errorDetail", promptStreamErrorDetail(err),
+		)
+	}
+	encodeEvent := func(event harnessv2.Event) {
+		if streamBroken {
+			return
+		}
+		if err := encoder.Encode(event); err != nil {
+			updateKind := ""
+			if event.Update != nil {
+				updateKind = string(event.Update.Kind)
+			}
+			markStreamBroken("event-encode", string(event.Type), updateKind, int64(event.Identity.Sequence), err)
+			deactivatePromptCapabilities(state, request.Metadata.PromptID, harnessv2.RuntimeSessionStateCancelling)
+			cancelCtx, cancel := context.WithTimeout(
+				context.Background(), defaultDuration(s.cfg.CancelGrace, acp.DefaultStopGrace)*2,
+			)
+			defer cancel()
+			_, _ = runtimeSession.CancelPrompt(cancelCtx, string(request.Metadata.PromptID))
+			return
+		}
+		if flusher != nil {
+			flusher.Flush()
+		}
+	}
+	if first.Type != acp.PromptEventAccepted {
+		markStreamBroken("first-event", string(first.Type), "", first.Sequence, nil)
+		deactivatePromptCapabilities(state, request.Metadata.PromptID, harnessv2.RuntimeSessionStateCancelling)
+		_, _ = runtimeSession.CancelPrompt(context.Background(), string(request.Metadata.PromptID))
+	}
+	mapAndEncode := func(event acp.PromptEvent) {
+		mapped, mapErr := s.mapRuntimeEvent(state, prompt, event)
+		if mapErr != nil {
+			markStreamBroken("event-map", string(event.Type), "", event.Sequence, mapErr)
+			deactivatePromptCapabilities(state, request.Metadata.PromptID, harnessv2.RuntimeSessionStateCancelling)
+			_, _ = runtimeSession.CancelPrompt(context.Background(), string(request.Metadata.PromptID))
+			return
+		}
+		if mapped != nil {
+			encodeEvent(*mapped)
+		}
+	}
+	mapAndEncode(first)
+	compactor := newAssistantMessageCompactor()
+	defer compactor.close()
+	events := run.Events
+	for events != nil {
+		select {
+		case event, ok := <-events:
+			if !ok {
+				for _, pending := range compactor.flushPending() {
+					mapAndEncode(pending)
+				}
+				events = nil
+				continue
+			}
+			for _, ready := range compactor.push(event, time.Now()) {
+				mapAndEncode(ready)
+			}
+		case <-compactor.timerChannel():
+			for _, pending := range compactor.flushPending() {
+				mapAndEncode(pending)
+			}
+		}
+	}
+	result := <-run.Result
+	if result.Err != nil {
+		stage, rpcCode, rpcService, rpcErrorName := promptExecutionDiagnostic(result.Err)
+		slog.Error(
+			"ACP prompt execution failed",
+			"stage", stage,
+			"rpcCode", rpcCode,
+			"rpcService", rpcService,
+			"rpcErrorName", rpcErrorName,
+			"accepted", result.Accepted,
+		)
+	}
+	deactivatePromptCapabilities(state, request.Metadata.PromptID, harnessv2.RuntimeSessionStateCancelling)
+	terminal, settledResult, terminalErr := s.terminalEvent(state, prompt, result)
+	if settledResult.Outcome == acp.PromptOutcomeFailed {
+		outcome, stopReason := promptTerminalDiagnostic(settledResult)
+		slog.Error(
+			"ACP prompt settled failed",
+			"outcome", outcome,
+			"stopReason", stopReason,
+			"accepted", settledResult.Accepted,
+			"errorPresent", settledResult.Err != nil,
+		)
+	}
+	if terminalErr != nil {
+		markStreamBroken("terminal-build", string(terminal.Type), "", int64(terminal.Identity.Sequence), terminalErr)
+	} else {
+		encodeEvent(terminal)
+	}
+	if !streamBroken {
+		if err := encoder.Close(); err != nil {
+			slog.Error(
+				"ACP prompt stream close failed",
+				"promptID", request.Metadata.PromptID,
+				"errorClass", promptStreamErrorClass(err),
+			)
+		}
+	}
+	s.finishPrompt(state, prompt, settledResult, terminal.Identity.Timestamp)
+	slotHeld = false
+	<-s.promptSlots
+}
+
+func promptTerminalDiagnostic(result acp.PromptResult) (string, string) {
+	const promptDiagnosticOther = "Other"
+
+	outcome := promptDiagnosticOther
+	switch result.Outcome {
+	case acp.PromptOutcomeCompleted, acp.PromptOutcomeCancelled, acp.PromptOutcomeFailed, acp.PromptOutcomeOutcomeUnknown:
+		outcome = string(result.Outcome)
+	}
+	stopReason := promptDiagnosticOther
+	switch result.StopReason {
+	case acp.StopReasonEndTurn, acp.StopReasonMaxTokens, acp.StopReasonMaxTurnRequests,
+		acp.StopReasonRefusal, acp.StopReasonCancelled:
+		stopReason = string(result.StopReason)
+	case "":
+		stopReason = ""
+	}
+	return outcome, stopReason
+}
+
+func promptStreamErrorDetail(err error) string {
+	if err == nil {
+		return ""
+	}
+	detail := strings.NewReplacer("\n", " ", "\r", " ").Replace(strings.TrimSpace(err.Error()))
+	limit := 512
+	if len(detail) <= limit {
+		return detail
+	}
+	for limit > 0 && !utf8.RuneStart(detail[limit]) {
+		limit--
+	}
+	return detail[:limit] + "..."
+}
+
+func promptStreamErrorClass(err error) string {
+	switch {
+	case err == nil:
+		return "unexpected-event"
+	case errors.Is(err, harnessv2.ErrEventRateExceeded):
+		return "event-rate-exceeded"
+	case errors.Is(err, harnessv2.ErrEventByteRateExceeded):
+		return "event-byte-rate-exceeded"
+	case errors.Is(err, harnessv2.ErrEventLineTooLarge):
+		return "event-line-too-large"
+	case errors.Is(err, harnessv2.ErrMalformedEvent):
+		return "malformed-event"
+	case errors.Is(err, harnessv2.ErrEventIdentityMismatch):
+		return "event-identity-mismatch"
+	case errors.Is(err, harnessv2.ErrEventSequence):
+		return "event-sequence"
+	case errors.Is(err, harnessv2.ErrEventAfterTerminal):
+		return "event-after-terminal"
+	case errors.Is(err, harnessv2.ErrMissingAcceptedEvent):
+		return "missing-accepted-event"
+	case strings.Contains(err.Error(), "write event"):
+		return "event-write"
+	case strings.Contains(err.Error(), "omitted toolCallId"):
+		return "missing-tool-call-id"
+	case strings.Contains(err.Error(), "decode ACP session update"),
+		strings.Contains(err.Error(), "decode ACP agent message content"):
+		return "update-decode"
+	case strings.Contains(err.Error(), "permission"):
+		return "permission-map"
+	case strings.Contains(err.Error(), "unsupported runtime prompt event"):
+		return "unsupported-runtime-event"
+	case strings.Contains(err.Error(), "activate prompt-scoped MCP authority"):
+		return "mcp-authority"
+	case strings.Contains(err.Error(), "terminal") && strings.Contains(err.Error(), "size"):
+		return "terminal-size"
+	default:
+		return "unclassified"
+	}
+}
+
+func promptStreamMalformedValidationClass(err error) string {
+	const promptDiagnosticOther = "Other"
+
+	if !errors.Is(err, harnessv2.ErrMalformedEvent) {
+		return ""
+	}
+	detail := err.Error()
+	switch {
+	case strings.Contains(detail, "assistant message chunk is required"):
+		return "assistant-empty"
+	case strings.Contains(detail, "assistant message chunk exceeds"):
+		return "assistant-too-large"
+	case strings.Contains(detail, "assistant message chunk contains invalid UTF-8"):
+		return "assistant-invalid-utf8"
+	case strings.Contains(detail, "update event must carry exactly one typed payload"),
+		strings.Contains(detail, "update requires"):
+		return "update-payload"
+	case strings.Contains(detail, "tool call ID"):
+		return "tool-call-id"
+	case strings.Contains(detail, "tool call title"):
+		return "tool-call-title"
+	case strings.Contains(detail, "tool call kind"):
+		return "tool-call-kind"
+	case strings.Contains(detail, "unsupported tool call status"):
+		return "tool-call-status"
+	case strings.Contains(detail, "tool call content"):
+		return "tool-call-content"
+	case strings.Contains(detail, "plan entry count"):
+		return "plan-count"
+	case strings.Contains(detail, "plan entry content"):
+		return "plan-content"
+	case strings.Contains(detail, "plan entry priority"):
+		return "plan-priority"
+	case strings.Contains(detail, "plan entry") && strings.Contains(detail, "unsupported status"):
+		return "plan-status"
+	case strings.Contains(detail, "diagnostic code"):
+		return "diagnostic-code"
+	case strings.Contains(detail, "diagnostic message"):
+		return "diagnostic-message"
+	default:
+		return promptDiagnosticOther
+	}
+}
+
+const promptExecutionStageJSONRPCError = "json-rpc-error"
+
+func promptExecutionDiagnostic(err error) (string, int, string, string) {
+	var rpcErr *acp.RPCError
+	switch {
+	case errors.As(err, &rpcErr):
+		var data struct {
+			Service   string `json:"service"`
+			ErrorName string `json:"errorName"`
+		}
+		if len(rpcErr.Data) > 0 && json.Unmarshal(rpcErr.Data, &data) == nil {
+			return promptExecutionStageJSONRPCError, rpcErr.Code,
+				promptExecutionDiagnosticIdentifier(data.Service),
+				promptExecutionDiagnosticIdentifier(data.ErrorName)
+		}
+		return promptExecutionStageJSONRPCError, rpcErr.Code, "", ""
+	case errors.Is(err, acp.ErrClosed):
+		return "transport-closed", 0, "", ""
+	case errors.Is(err, context.DeadlineExceeded):
+		return "deadline-exceeded", 0, "", ""
+	case errors.Is(err, context.Canceled):
+		return "context-canceled", 0, "", ""
+	default:
+		return "client-error", 0, "", ""
+	}
+}
+
+func promptExecutionDiagnosticIdentifier(value string) string {
+	value = strings.TrimSpace(value)
+	if value == "" || len(value) > 64 {
+		return ""
+	}
+	for _, char := range value {
+		if char >= 'a' && char <= 'z' || char >= 'A' && char <= 'Z' ||
+			char >= '0' && char <= '9' || char == '.' || char == '_' || char == '-' {
+			continue
+		}
+		return ""
+	}
+	return value
+}
+
+func (s *Server) handleRenewLease(w http.ResponseWriter, r *http.Request) {
+	var request harnessv2.RenewPromptLeaseRequest
+	if !decodeJSON(w, r, s.cfg.Capabilities.Limits.MaxRequestBytes, &request) {
+		return
+	}
+	now := time.Now().UTC()
+	maxLease := time.Duration(s.cfg.Capabilities.Limits.MaxPromptLeaseMillis) * time.Millisecond
+	if err := request.ValidateAt(now, maxLease); err != nil {
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil, false)
+		return
+	}
+	if !pathMatchesPrompt(r, request.Metadata) || !s.authorizeMutation(w, r, request.Metadata, true) {
+		return
+	}
+	s.mu.Lock()
+	state := s.sessions[harnessv2.RuntimeSessionID(r.PathValue("sessionID"))]
+	if state == nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusGone, harnessv2.ErrorCodeSettled, "prompt is no longer active", nil, false)
+		return
+	}
+	classification, err := harnessv2.ClassifyOperation(
+		s.expectedFence(state.descriptor.RuntimeSessionUID, state.descriptor.Generation), request.Metadata,
+		operationPtr(state.operations, request.Metadata.OperationID), true, now,
+	)
+	if err != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil, false)
+		return
+	}
+	if classification.Class != harnessv2.RequestClassificationFresh {
+		replay := state.operationReplays[request.Metadata.OperationID]
+		s.mu.Unlock()
+		if replay != nil && classification.Class == harnessv2.RequestClassificationDuplicate {
+			writeLeaseOperationReplay(w, r, replay, classification)
+		} else {
+			writeClassificationError(w, classification)
+		}
+		return
+	}
+	if state.prompt == nil || state.prompt.settlement != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusGone, harnessv2.ErrorCodeSettled, "prompt is no longer active", nil, false)
+		return
+	}
+	if !promptMetadataMatches(request.Metadata, state.prompt.request.Metadata) {
+		s.mu.Unlock()
+		writeError(w, http.StatusConflict, harnessv2.ErrorCodeDigestConflict, "lease renewal prompt identity does not match the active prompt", nil, false)
+		return
+	}
+	if err := request.MCPAuthorization.ValidateProfile(state.profile); err != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusGone, harnessv2.ErrorCodeStaleFence, err.Error(), nil, false)
+		return
+	}
+	if err := harnessv2.ValidatePromptLeaseRenewal(state.prompt.lease, request.Lease, request.ExpectedLeaseGeneration, now, maxLease); err != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusConflict, harnessv2.ErrorCodeStaleFence, err.Error(), nil, false)
+		return
+	}
+	runtimeSession := state.runtime
+	providerProxy := state.providerProxy
+	mcpProxy := state.mcpProxy
+	if err := runtimeSession.RenewPromptLeaseFor(string(request.Metadata.PromptID), request.Lease.ExpiresAt.Sub(now)); err != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusGone, harnessv2.ErrorCodeSettled, safeError(err), nil, false)
+		return
+	}
+	if providerProxy == nil || mcpProxy == nil ||
+		providerProxy.renew(string(request.Metadata.PromptID), request.Lease.ExpiresAt, now) != nil ||
+		mcpProxy.renew(request.MCPAuthorization, request.Lease, now) != nil {
+		if providerProxy != nil {
+			providerProxy.revoke()
+		}
+		if mcpProxy != nil {
+			mcpProxy.revoke(harnessv2.RuntimeSessionStateCancelling)
+		}
+		s.mu.Unlock()
+		cancelCtx, cancel := context.WithTimeout(context.Background(), defaultDuration(s.cfg.CancelGrace, acp.DefaultStopGrace)*2)
+		defer cancel()
+		_, _ = runtimeSession.CancelPrompt(cancelCtx, string(request.Metadata.PromptID))
+		writeError(w, http.StatusGone, harnessv2.ErrorCodeSettled, "prompt provider lease is no longer active", nil, false)
+		return
+	}
+	state.prompt.lease = request.Lease
+	state.prompt.request.MCPAuthorization = request.MCPAuthorization
+	response := harnessv2.PromptLeaseResponse{
+		Protocol: harnessv2.ProtocolVersion, Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh}, Lease: request.Lease,
+	}
+	state.operations[request.Metadata.OperationID] = operationRecord(request.Metadata, harnessv2.OperationPhaseApplied, "", now)
+	if state.operationReplays == nil {
+		state.operationReplays = make(map[harnessv2.OperationID]*operationReplay)
+	}
+	done := make(chan struct{})
+	close(done)
+	state.operationReplays[request.Metadata.OperationID] = &operationReplay{done: done, lease: &response}
+	s.mu.Unlock()
+	writeJSON(w, http.StatusOK, response)
+}
+
+func (s *Server) handleResolvePermission(w http.ResponseWriter, r *http.Request) {
+	var request harnessv2.ResolvePermissionRequest
+	if !decodeJSON(w, r, s.cfg.Capabilities.Limits.MaxRequestBytes, &request) {
+		return
+	}
+	now := time.Now().UTC()
+	if err := request.ValidateAt(now); err != nil {
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil, false)
+		return
+	}
+	if !pathMatchesPermission(r, request) || !s.authorizeMutation(w, r, request.Metadata, true) {
+		return
+	}
+	s.mu.Lock()
+	state := s.sessions[harnessv2.RuntimeSessionID(r.PathValue("sessionID"))]
+	if state == nil || state.prompt == nil || state.prompt.settlement != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusGone, harnessv2.ErrorCodeSettled, "prompt is no longer active", nil, false)
+		return
+	}
+	classification, err := harnessv2.ClassifyOperation(
+		s.expectedFence(state.descriptor.RuntimeSessionUID, state.descriptor.Generation), request.Metadata,
+		operationPtr(state.operations, request.Metadata.OperationID), true, now,
+	)
+	if err != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil, false)
+		return
+	}
+	permission, pending := state.permissions[request.RequestID]
+	if classification.Class != harnessv2.RequestClassificationFresh {
+		replay := state.operationReplays[request.Metadata.OperationID]
+		s.mu.Unlock()
+		if replay != nil && classification.Class == harnessv2.RequestClassificationDuplicate {
+			writePermissionOperationReplay(w, r, replay, classification)
+		} else if classification.Class == harnessv2.RequestClassificationDuplicate && permission.decision != nil {
+			writeJSON(w, http.StatusOK, harnessv2.PermissionResolutionResponse{
+				Protocol: harnessv2.ProtocolVersion, Classification: classification, State: harnessv2.PermissionResolutionAlreadyResolved,
+				Decision: *permission.decision, ResolvedAt: now,
+			})
+		} else {
+			writeClassificationError(w, classification)
+		}
+		return
+	}
+	if !pending {
+		s.mu.Unlock()
+		writeError(w, http.StatusGone, harnessv2.ErrorCodeSettled, "permission request is no longer pending", nil, false)
+		return
+	}
+
+	outcome := acp.CancelledPermissionOutcome()
+	var approval *harnessv2.MCPApprovalEvidence
+	if request.Decision.Outcome == harnessv2.PermissionDecisionSelected {
+		outcome = acp.SelectedPermissionOutcome(request.Decision.OptionID)
+		optionKind := permission.options[request.Decision.OptionID]
+		if optionKind == harnessv2.PermissionOptionAllowOnce || optionKind == harnessv2.PermissionOptionAllowAlways {
+			if state.mcpProxy == nil {
+				s.mu.Unlock()
+				writeError(w, http.StatusForbidden, harnessv2.ErrorCodeForbidden, "permission cannot authorize an MCP tool", nil, false)
+				return
+			}
+			toolName, resolveErr := state.mcpProxy.resolveApprovalToolName(permission.toolName, permission.title)
+			if resolveErr != nil {
+				s.mu.Unlock()
+				writeError(w, http.StatusForbidden, harnessv2.ErrorCodeForbidden, "permission cannot authorize an MCP tool", nil, false)
+				return
+			}
+			approval = &harnessv2.MCPApprovalEvidence{
+				PermissionRequestID: request.RequestID, ToolCallID: permission.toolCallID, ToolName: toolName,
+				GrantedAt: now, ExpiresAt: permission.expiresAt, Reusable: optionKind == harnessv2.PermissionOptionAllowAlways,
+			}
+		}
+	}
+	replay := reserveOperationReplayLocked(state, request.Metadata, now)
+	mutations := state.promptMutations
+	mcpProxy := state.mcpProxy
+	s.mu.Unlock()
+
+	if mutations == nil {
+		failure := operationFailure{status: http.StatusInternalServerError, code: harnessv2.ErrorCodeSessionPoisoned, message: "runtime permission resolver is unavailable"}
+		s.completeOperationFailure(replay, failure)
+		writeError(w, failure.status, failure.code, failure.message, nil, failure.retryable)
+		return
+	}
+	if approval != nil {
+		if err := mcpProxy.grantApproval(request.Metadata.PromptID, *approval); err != nil {
+			failure := operationFailure{status: http.StatusForbidden, code: harnessv2.ErrorCodeForbidden, message: "permission cannot authorize an MCP tool"}
+			s.completeOperationFailure(replay, failure)
+			writeError(w, failure.status, failure.code, failure.message, nil, failure.retryable)
+			return
+		}
+	}
+	if err := mutations.ResolvePermission(string(request.Metadata.PromptID), string(request.RequestID), outcome); err != nil {
+		if mcpProxy != nil {
+			mcpProxy.revoke(harnessv2.RuntimeSessionStatePoisoned)
+		}
+		failure := operationFailure{status: http.StatusGone, code: harnessv2.ErrorCodeSettled, message: safeError(err)}
+		s.completeOperationFailure(replay, failure)
+		writeError(w, failure.status, failure.code, failure.message, nil, failure.retryable)
+		return
+	}
+
+	resolvedAt := time.Now().UTC()
+	response := harnessv2.PermissionResolutionResponse{
+		Protocol: harnessv2.ProtocolVersion, Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh},
+		State: harnessv2.PermissionResolutionApplied, Decision: request.Decision, ResolvedAt: resolvedAt,
+	}
+	s.mu.Lock()
+	if current, ok := state.permissions[request.RequestID]; ok {
+		current.decision = &request.Decision
+		state.permissions[request.RequestID] = current
+	}
+	state.operations[request.Metadata.OperationID] = operationRecord(request.Metadata, harnessv2.OperationPhaseApplied, "", resolvedAt)
+	replay.permission = &response
+	close(replay.done)
+	s.mu.Unlock()
+	writeJSON(w, http.StatusOK, response)
+}
+
+func (s *Server) handleCancelPrompt(w http.ResponseWriter, r *http.Request) {
+	var request harnessv2.CancelPromptRequest
+	if !decodeJSON(w, r, s.cfg.Capabilities.Limits.MaxRequestBytes, &request) {
+		return
+	}
+	now := time.Now().UTC()
+	if err := request.ValidateAt(now); err != nil {
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil, false)
+		return
+	}
+	if !pathMatchesPrompt(r, request.Metadata) || !s.authorizeMutation(w, r, request.Metadata, true) {
+		return
+	}
+	s.mu.Lock()
+	state := s.sessions[harnessv2.RuntimeSessionID(r.PathValue("sessionID"))]
+	if state == nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusGone, harnessv2.ErrorCodeSettled, "prompt is not active", nil, false)
+		return
+	}
+	classification, err := harnessv2.ClassifyOperation(
+		s.expectedFence(state.descriptor.RuntimeSessionUID, state.descriptor.Generation), request.Metadata,
+		operationPtr(state.operations, request.Metadata.OperationID), true, now,
+	)
+	if err != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil, false)
+		return
+	}
+	if classification.Class != harnessv2.RequestClassificationFresh {
+		replay := state.operationReplays[request.Metadata.OperationID]
+		s.mu.Unlock()
+		if replay != nil && (classification.Class == harnessv2.RequestClassificationDuplicate || classification.Class == harnessv2.RequestClassificationSettled) {
+			writeCancellationOperationReplay(w, r, replay, classification)
+		} else {
+			writeClassificationError(w, classification)
+		}
+		return
+	}
+	if state.prompt == nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusGone, harnessv2.ErrorCodeSettled, "prompt is not active", nil, false)
+		return
+	}
+	if !promptMetadataMatches(request.Metadata, state.prompt.request.Metadata) {
+		s.mu.Unlock()
+		writeError(w, http.StatusConflict, harnessv2.ErrorCodeDigestConflict, "cancellation prompt identity does not match the active prompt", nil, false)
+		return
+	}
+	invalidated := uint32(len(state.permissions))
+	replay := reserveOperationReplayLocked(state, request.Metadata, now)
+	mutations := state.promptMutations
+	providerProxy := state.providerProxy
+	mcpProxy := state.mcpProxy
+	prompt := state.prompt
+	s.mu.Unlock()
+	if mutations == nil {
+		failure := operationFailure{status: http.StatusInternalServerError, code: harnessv2.ErrorCodeSessionPoisoned, message: "runtime cancellation is unavailable"}
+		s.completeOperationFailure(replay, failure)
+		writeError(w, failure.status, failure.code, failure.message, nil, failure.retryable)
+		return
+	}
+	if providerProxy != nil || mcpProxy != nil {
+		deactivatePromptCapabilities(state, request.Metadata.PromptID, harnessv2.RuntimeSessionStateCancelling)
+	}
+	cancelCtx, cancel := context.WithDeadline(r.Context(), request.SettlementDeadline)
+	defer cancel()
+	result, cancelErr := mutations.CancelPrompt(cancelCtx, string(request.Metadata.PromptID))
+	if cancelErr != nil && result.Outcome == "" {
+		result = acp.PromptResult{Outcome: acp.PromptOutcomeOutcomeUnknown, Accepted: true, Err: cancelErr, SettledAt: time.Now().UTC()}
+	}
+	settlement := settlementFromResult(result, time.Now().UTC())
+	forced := cancelErr != nil && result.Outcome == acp.PromptOutcomeOutcomeUnknown
+
+	s.mu.Lock()
+	settlement = settlePromptLocked(prompt, settlement)
+	if settlement.TerminalEvent != harnessv2.EventOutcomeUnknown {
+		forced = false
+	}
+	if state.prompt == prompt {
+		state.permissions = make(map[harnessv2.PermissionRequestID]permissionState)
+	}
+	state.operations[request.Metadata.OperationID] = operationRecord(request.Metadata, harnessv2.OperationPhaseSettled, settlement.TerminalEvent, settlement.SettledAt)
+	response := cancellationResponse(harnessv2.Classification{Class: harnessv2.RequestClassificationFresh}, settlement, invalidated, forced)
+	replay.cancellation = &response
+	close(replay.done)
+	s.mu.Unlock()
+	writeJSON(w, http.StatusOK, response)
+}
+
+func reserveOperationReplayLocked(
+	state *sessionState,
+	metadata harnessv2.MutationMetadata,
+	at time.Time,
+) *operationReplay {
+	if state.operationReplays == nil {
+		state.operationReplays = make(map[harnessv2.OperationID]*operationReplay)
+	}
+	replay := &operationReplay{done: make(chan struct{})}
+	state.operationReplays[metadata.OperationID] = replay
+	state.operations[metadata.OperationID] = operationRecord(metadata, harnessv2.OperationPhaseRecorded, "", at)
+	return replay
+}
+
+func (s *Server) completeOperationFailure(replay *operationReplay, failure operationFailure) {
+	s.mu.Lock()
+	replay.failure = &failure
+	close(replay.done)
+	s.mu.Unlock()
+}
+
+// writeOperationReplay waits for a reserved operation replay to settle, then
+// writes the recorded failure or the replayed response with a
+// duplicate-classification stamp applied. extract selects which stored replay
+// response applies; stamp applies the endpoint-specific classification/state
+// to the copied response before it is written.
+func writeOperationReplay[T any](
+	w http.ResponseWriter,
+	r *http.Request,
+	replay *operationReplay,
+	classification harnessv2.Classification,
+	extract func(*operationReplay) *T,
+	stamp func(*T),
+) {
+	select {
+	case <-replay.done:
+	case <-r.Context().Done():
+		return
+	}
+	if replay.failure != nil {
+		writeError(w, replay.failure.status, replay.failure.code, replay.failure.message, &classification, replay.failure.retryable)
+		return
+	}
+	stored := extract(replay)
+	if stored == nil {
+		writeClassificationError(w, classification)
+		return
+	}
+	response := *stored
+	stamp(&response)
+	writeJSON(w, http.StatusOK, response)
+}
+
+func writePermissionOperationReplay(
+	w http.ResponseWriter,
+	r *http.Request,
+	replay *operationReplay,
+	classification harnessv2.Classification,
+) {
+	writeOperationReplay(w, r, replay, classification,
+		func(replay *operationReplay) *harnessv2.PermissionResolutionResponse { return replay.permission },
+		func(response *harnessv2.PermissionResolutionResponse) {
+			response.Classification = harnessv2.Classification{Class: harnessv2.RequestClassificationDuplicate, Phase: harnessv2.OperationPhaseApplied}
+			response.State = harnessv2.PermissionResolutionAlreadyResolved
+		})
+}
+
+func writeLeaseOperationReplay(
+	w http.ResponseWriter,
+	r *http.Request,
+	replay *operationReplay,
+	classification harnessv2.Classification,
+) {
+	writeOperationReplay(w, r, replay, classification,
+		func(replay *operationReplay) *harnessv2.PromptLeaseResponse { return replay.lease },
+		func(response *harnessv2.PromptLeaseResponse) {
+			response.Classification = harnessv2.Classification{Class: harnessv2.RequestClassificationDuplicate, Phase: harnessv2.OperationPhaseApplied}
+		})
+}
+
+func writeCancellationOperationReplay(
+	w http.ResponseWriter,
+	r *http.Request,
+	replay *operationReplay,
+	classification harnessv2.Classification,
+) {
+	writeOperationReplay(w, r, replay, classification,
+		func(replay *operationReplay) *harnessv2.CancelPromptResponse { return replay.cancellation },
+		func(response *harnessv2.CancelPromptResponse) {
+			response.Classification = harnessv2.Classification{
+				Class:         harnessv2.RequestClassificationSettled,
+				Phase:         harnessv2.OperationPhaseSettled,
+				TerminalEvent: response.Settlement.TerminalEvent,
+			}
+		})
+}
+
+func (s *Server) handleFinalizeSessionPublication(w http.ResponseWriter, r *http.Request) {
+	var request harnessv2.FinalizeRuntimeSessionPublicationRequest
+	if !decodeJSON(w, r, s.cfg.Capabilities.Limits.MaxRequestBytes, &request) {
+		return
+	}
+	now := time.Now().UTC()
+	if err := request.ValidateAt(now); err != nil {
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil, false)
+		return
+	}
+	if !s.authorizeMutation(w, r, request.Metadata, true) {
+		return
+	}
+	sessionID := harnessv2.RuntimeSessionID(r.PathValue("sessionID"))
+	s.mu.Lock()
+	state := s.sessions[sessionID]
+	if state == nil || state.creating {
+		s.mu.Unlock()
+		writeError(w, http.StatusNotFound, harnessv2.ErrorCodeInvalidRequest, "runtime session not found", nil, false)
+		return
+	}
+	if err := s.validateSessionFence(state, request.Metadata); err != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusGone, harnessv2.ErrorCodeStaleFence, err.Error(), nil, false)
+		return
+	}
+	classification, err := harnessv2.ClassifyOperation(
+		s.expectedFence(state.descriptor.RuntimeSessionUID, state.descriptor.Generation), request.Metadata,
+		operationPtr(state.operations, request.Metadata.OperationID), true, now,
+	)
+	if err != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil, false)
+		return
+	}
+	if classification.Class != harnessv2.RequestClassificationFresh {
+		descriptor, receipt := state.descriptor, state.publicationFinalization
+		s.mu.Unlock()
+		if classification.Class == harnessv2.RequestClassificationDuplicate && descriptor.State == harnessv2.RuntimeSessionStateFinalizing && receipt != nil {
+			writeJSON(w, http.StatusOK, harnessv2.FinalizeRuntimeSessionPublicationResponse{
+				Protocol: harnessv2.ProtocolVersion, Classification: classification, Session: descriptor, Finalization: *receipt,
+			})
+		} else {
+			writeClassificationError(w, classification)
+		}
+		return
+	}
+	if state.workspaceIntent != harnessv2.WorkspaceIntentWrite || state.prompt == nil || state.prompt.settlement == nil ||
+		!promptMetadataMatches(request.Metadata, state.prompt.request.Metadata) {
+		s.mu.Unlock()
+		writeError(w, http.StatusConflict, harnessv2.ErrorCodeSessionPoisoned, "runtime session is not ready for publication finalization", nil, false)
+		return
+	}
+	deltaResponse, ok := state.deltas[request.WorkspaceDeltaID]
+	if !ok || deltaResponse.Delta.State != harnessv2.WorkspaceDeltaPrepared || !deltaResponse.Delta.PublicationSafe ||
+		deltaResponse.Delta.RuntimeSessionUID != state.descriptor.RuntimeSessionUID ||
+		deltaResponse.Delta.SessionGeneration != state.descriptor.Generation {
+		s.mu.Unlock()
+		writeError(w, http.StatusConflict, harnessv2.ErrorCodeDigestConflict, "publication finalization does not match the prepared workspace delta", nil, false)
+		return
+	}
+	receipt := harnessv2.PublicationFinalizationReceipt{
+		WorkspaceDeltaID: request.WorkspaceDeltaID, PublicationID: request.PublicationID,
+		PublicationGeneration: request.PublicationGeneration, PublicationVersion: request.PublicationVersion,
+		TerminalState: request.TerminalState, TerminalReceiptDigest: request.TerminalReceiptDigest, AppliedAt: now,
+	}
+	if state.descriptor.State == harnessv2.RuntimeSessionStateFinalizing {
+		if state.publicationFinalization == nil || !publicationFinalizationMatches(*state.publicationFinalization, receipt) {
+			s.mu.Unlock()
+			writeError(w, http.StatusConflict, harnessv2.ErrorCodeDigestConflict, "publication finalization receipt conflicts with the accepted receipt", nil, false)
+			return
+		}
+		receipt = *state.publicationFinalization
+	} else {
+		if state.descriptor.State != harnessv2.RuntimeSessionStatePublicationPrepared {
+			s.mu.Unlock()
+			writeError(w, http.StatusConflict, harnessv2.ErrorCodeSessionPoisoned, "runtime session is not awaiting publication finalization", nil, false)
+			return
+		}
+		if err := harnessv2.ValidateRuntimeSessionTransition(state.descriptor.State, harnessv2.RuntimeSessionStateFinalizing); err != nil {
+			s.mu.Unlock()
+			writeError(w, http.StatusConflict, harnessv2.ErrorCodeSessionPoisoned, err.Error(), nil, false)
+			return
+		}
+		state.descriptor.State = harnessv2.RuntimeSessionStateFinalizing
+		state.publicationFinalization = &receipt
+	}
+	state.descriptor.LastTransitionAt = now
+	state.operations[request.Metadata.OperationID] = operationRecord(request.Metadata, harnessv2.OperationPhaseApplied, "", now)
+	descriptor := state.descriptor
+	mcpProxy := state.mcpProxy
+	drainCleanup := s.drain.Requested && !state.drainCleanupScheduled
+	if drainCleanup {
+		state.drainCleanupScheduled = true
+	}
+	s.mu.Unlock()
+	if mcpProxy != nil {
+		mcpProxy.revoke(harnessv2.RuntimeSessionStateFinalizing)
+	}
+	writeJSON(w, http.StatusOK, harnessv2.FinalizeRuntimeSessionPublicationResponse{
+		Protocol: harnessv2.ProtocolVersion, Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh},
+		Session: descriptor, Finalization: receipt,
+	})
+	if drainCleanup {
+		go s.cleanupDrainedSession(sessionID, state)
+	}
+}
+
+func publicationFinalizationMatches(a, b harnessv2.PublicationFinalizationReceipt) bool {
+	return a.WorkspaceDeltaID == b.WorkspaceDeltaID && a.PublicationID == b.PublicationID &&
+		a.PublicationGeneration == b.PublicationGeneration && a.PublicationVersion == b.PublicationVersion &&
+		a.TerminalState == b.TerminalState && a.TerminalReceiptDigest == b.TerminalReceiptDigest
+}
+
+func (s *Server) handleDeleteSession(w http.ResponseWriter, r *http.Request) {
+	var request harnessv2.DeleteRuntimeSessionRequest
+	if !decodeJSON(w, r, s.cfg.Capabilities.Limits.MaxRequestBytes, &request) {
+		return
+	}
+	now := time.Now().UTC()
+	if err := request.ValidateAt(now); err != nil {
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil, false)
+		return
+	}
+	if !s.authorizeMutation(w, r, request.Metadata, true) {
+		return
+	}
+	sessionID := harnessv2.RuntimeSessionID(r.PathValue("sessionID"))
+	s.mu.Lock()
+	state := s.sessions[sessionID]
+	if state == nil {
+		tombstone, ok := s.tombstones[request.Metadata.Fence.RuntimeSessionUID]
+		if !ok || tombstone.RuntimeSessionGeneration != request.Metadata.Fence.RuntimeSessionGeneration ||
+			tombstone.RuntimeProfileDigest != request.Metadata.Fence.RuntimeProfileDigest {
+			s.mu.Unlock()
+			writeError(w, http.StatusNotFound, harnessv2.ErrorCodeInvalidRequest, "runtime session not found", nil, false)
+			return
+		}
+		record := tombstoneOperation(tombstone, request.Metadata.OperationID)
+		if record == nil {
+			s.mu.Unlock()
+			writeError(w, http.StatusNotFound, harnessv2.ErrorCodeInvalidRequest, "runtime session not found", nil, false)
+			return
+		}
+		classification, classifyErr := harnessv2.ClassifyOperation(
+			s.expectedFence(tombstone.RuntimeSessionUID, tombstone.RuntimeSessionGeneration), request.Metadata, record, true, now,
+		)
+		s.mu.Unlock()
+		if classifyErr != nil {
+			writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, classifyErr.Error(), nil, false)
+			return
+		}
+		if classification.Class != harnessv2.RequestClassificationDuplicate || classification.Phase != harnessv2.OperationPhaseDeleted {
+			writeClassificationError(w, classification)
+			return
+		}
+		writeJSON(w, http.StatusOK, harnessv2.DeleteRuntimeSessionResponse{
+			Protocol: harnessv2.ProtocolVersion, Classification: classification, State: harnessv2.RuntimeSessionStateDeleted, Tombstone: tombstone,
+		})
+		return
+	}
+	if err := s.validateSessionFence(state, request.Metadata); err != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusGone, harnessv2.ErrorCodeStaleFence, err.Error(), nil, false)
+		return
+	}
+	if state.descriptor.State == harnessv2.RuntimeSessionStateDeleting {
+		s.mu.Unlock()
+		writeError(w, http.StatusConflict, harnessv2.ErrorCodeAlreadyAccepted, "runtime session cleanup is already in progress", nil, true)
+		return
+	}
+	publicationFinalized := state.descriptor.State == harnessv2.RuntimeSessionStateFinalizing && state.publicationFinalization != nil
+	if !publicationFinalized {
+		if _, err := harnessv2.DeletionTransition(state.descriptor.State); err != nil {
+			s.mu.Unlock()
+			writeError(w, http.StatusConflict, harnessv2.ErrorCodeSessionPoisoned, err.Error(), nil, false)
+			return
+		}
+	}
+	classification, err := harnessv2.ClassifyOperation(s.expectedFence(state.descriptor.RuntimeSessionUID, state.descriptor.Generation), request.Metadata, operationPtr(state.operations, request.Metadata.OperationID), true, now)
+	if err != nil || classification.Class != harnessv2.RequestClassificationFresh {
+		s.mu.Unlock()
+		if err != nil {
+			writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil, false)
+		} else {
+			writeClassificationError(w, classification)
+		}
+		return
+	}
+	runtimeSession := state.runtime
+	providerProxy := state.providerProxy
+	state.descriptor.State = harnessv2.RuntimeSessionStateDeleting
+	state.descriptor.LastTransitionAt = now
+	s.mu.Unlock()
+	var providerCleanupErr error
+	if state.mcpProxy != nil {
+		state.mcpProxy.close()
+	}
+	if providerProxy != nil {
+		providerProxy.close()
+		providerCleanupErr = providerProxy.wait(r.Context())
+	}
+	cleanup, deleteErr := runtimeSession.Delete(r.Context())
+	if providerCleanupErr != nil || deleteErr != nil || !cleanup.Proven {
+		s.poisonPool("descendant_cleanup_unproven")
+		s.mu.Lock()
+		state.descriptor.State = harnessv2.RuntimeSessionStatePoisoned
+		state.descriptor.LastTransitionAt = time.Now().UTC()
+		s.mu.Unlock()
+		writeError(w, http.StatusInternalServerError, harnessv2.ErrorCodeSessionPoisoned, "runtime descendant cleanup could not be proven", nil, false)
+		return
+	}
+	if err := acp.ReclaimSessionOwnership(state.paths.Root); err != nil {
+		slog.Error("ACP runtime session deletion failed", "stage", "ownership reclaim")
+		s.poisonPool("session_root_ownership_reclaim_unproven")
+		s.mu.Lock()
+		state.descriptor.State = harnessv2.RuntimeSessionStatePoisoned
+		state.descriptor.LastTransitionAt = time.Now().UTC()
+		s.mu.Unlock()
+		writeError(
+			w, http.StatusInternalServerError, harnessv2.ErrorCodeSessionPoisoned,
+			"runtime session filesystem ownership reclaim could not be proven", nil, false,
+		)
+		return
+	}
+	if err := os.RemoveAll(state.paths.Root); err != nil {
+		s.poisonPool("session_root_cleanup_unproven")
+		s.mu.Lock()
+		state.descriptor.State = harnessv2.RuntimeSessionStatePoisoned
+		state.descriptor.LastTransitionAt = time.Now().UTC()
+		s.mu.Unlock()
+		writeError(
+			w, http.StatusInternalServerError, harnessv2.ErrorCodeSessionPoisoned,
+			"runtime session filesystem cleanup could not be proven", nil, false,
+		)
+		return
+	}
+	deletedAt := time.Now().UTC()
+	s.mu.Lock()
+	state.operations[request.Metadata.OperationID] = operationRecord(request.Metadata, harnessv2.OperationPhaseDeleted, "", deletedAt)
+	operations := make([]harnessv2.OperationRecord, 0, len(state.operations))
+	for _, operation := range state.operations {
+		operations = append(operations, operation)
+	}
+	tombstone := harnessv2.RuntimeSessionTombstone{
+		RuntimeSessionUID: state.descriptor.RuntimeSessionUID, RuntimeSessionGeneration: state.descriptor.Generation,
+		RuntimeProfileDigest: state.descriptor.RuntimeProfileDigest, DeletedAt: deletedAt, Operations: operations,
+	}
+	delete(s.sessions, sessionID)
+	s.tombstones[tombstone.RuntimeSessionUID] = tombstone
+	s.mu.Unlock()
+	writeJSON(w, http.StatusOK, harnessv2.DeleteRuntimeSessionResponse{
+		Protocol: harnessv2.ProtocolVersion, Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh},
+		State: harnessv2.RuntimeSessionStateDeleted, Tombstone: tombstone,
+	})
+}
+
+func tombstoneOperation(tombstone harnessv2.RuntimeSessionTombstone, operationID harnessv2.OperationID) *harnessv2.OperationRecord {
+	for i := range tombstone.Operations {
+		if tombstone.Operations[i].OperationID == operationID {
+			record := tombstone.Operations[i]
+			return &record
+		}
+	}
+	return nil
+}
+
+func workspaceDeltaChangedPaths(result workspacedelta.Result) []string {
+	paths := make(map[string]struct{}, len(result.Changes)+len(result.Deletions))
+	for _, change := range result.Changes {
+		paths[change.Path] = struct{}{}
+	}
+	for _, deletion := range result.Deletions {
+		paths[deletion.Path] = struct{}{}
+	}
+	resultPaths := make([]string, 0, len(paths))
+	for changedPath := range paths {
+		resultPaths = append(resultPaths, changedPath)
+	}
+	slices.Sort(resultPaths)
+	return resultPaths
+}
+
+func workspaceDeltaPathAllowed(changedPath string, patterns []string) bool {
+	if len(patterns) == 0 {
+		return true
+	}
+	for _, patternValue := range patterns {
+		patternValue = strings.TrimPrefix(strings.TrimSpace(patternValue), "./")
+		if strings.HasSuffix(patternValue, "/**") && strings.HasPrefix(changedPath, strings.TrimSuffix(patternValue, "**")) {
+			return true
+		}
+		if workspaceDeltaPatternMatches(patternValue, changedPath) {
+			return true
+		}
+		if strings.TrimSuffix(patternValue, "/") == strings.TrimSuffix(changedPath, "/") {
+			return true
+		}
+	}
+	return false
+}
+
+// workspaceDeltaPatternMatches applies gitignore-style glob semantics: a `**`
+// segment matches zero or more whole path segments, while every other segment
+// keeps path.Match single-segment semantics.
+func workspaceDeltaPatternMatches(patternValue, changedPath string) bool {
+	if !strings.Contains(patternValue, "**") {
+		matched, err := path.Match(patternValue, changedPath)
+		return err == nil && matched
+	}
+	return workspaceDeltaSegmentsMatch(strings.Split(patternValue, "/"), strings.Split(changedPath, "/"))
+}
+
+// workspaceDeltaSegmentsMatch uses the classic greedy wildcard algorithm at
+// segment granularity — backtracking only to the most recent `**` — so
+// matching stays O(pattern × path) even for agent-controlled paths against
+// patterns with many `**` segments.
+func workspaceDeltaSegmentsMatch(patternSegments, pathSegments []string) bool {
+	patternIndex, pathIndex := 0, 0
+	starPattern, starPath := -1, 0
+	for pathIndex < len(pathSegments) {
+		switch {
+		case patternIndex < len(patternSegments) && patternSegments[patternIndex] == "**":
+			starPattern, starPath = patternIndex, pathIndex
+			patternIndex++
+		case patternIndex < len(patternSegments) && workspaceDeltaSegmentMatches(patternSegments[patternIndex], pathSegments[pathIndex]):
+			patternIndex++
+			pathIndex++
+		case starPattern >= 0:
+			starPath++
+			pathIndex = starPath
+			patternIndex = starPattern + 1
+		default:
+			return false
+		}
+	}
+	for patternIndex < len(patternSegments) && patternSegments[patternIndex] == "**" {
+		patternIndex++
+	}
+	return patternIndex == len(patternSegments)
+}
+
+func workspaceDeltaSegmentMatches(pattern, segment string) bool {
+	matched, err := path.Match(pattern, segment)
+	return err == nil && matched
+}
+
+func workspaceDeltaRepositoryControlPathForWorkspace(workspaceRelativeRoot, changedPath string) bool {
+	return workspaceDeltaRepositoryControlPath(path.Join(strings.TrimSpace(workspaceRelativeRoot), changedPath))
+}
+
+func workspaceDeltaRepositoryControlPath(changedPath string) bool {
+	lower := strings.ToLower(strings.TrimPrefix(changedPath, "./"))
+	return strings.HasPrefix(lower, ".github/workflows/") ||
+		strings.HasPrefix(lower, "config/rbac/") ||
+		(strings.HasPrefix(lower, "charts/") && strings.Contains(lower, "secret"))
+}
+
+func buildWorkspaceDelta(
+	baseline *workspacedelta.Snapshot,
+	workspace string,
+	intent workspacedelta.Intent,
+	limits harnessv2.WorkspaceDeltaLimits,
+) (workspacedelta.Result, error) {
+	return workspacedelta.BuildWithLimits(
+		baseline,
+		workspace,
+		intent,
+		workspacedelta.BuildLimits{MaxArtifactBytes: limits.MaxBytes},
+	)
+}
+
+func workspaceDeltaContentPolicyViolation(artifact []byte, limits harnessv2.WorkspaceDeltaLimits) (string, error) {
+	if len(artifact) == 0 || (!limits.RejectBinaryFiles && !limits.RejectSecretLikeContent) {
+		return "", nil
+	}
+	reader := tar.NewReader(bytes.NewReader(artifact))
+	for {
+		header, err := reader.Next()
+		if errors.Is(err, io.EOF) {
+			return "", nil
+		}
+		if err != nil {
+			return "", err
+		}
+		fileContent := strings.HasPrefix(header.Name, "files/")
+		symlinkManifest := header.Name == "meta/symlinks.json"
+		if !fileContent && !symlinkManifest {
+			continue
+		}
+		if header.Size < 0 || header.Size > limits.MaxBytes {
+			return "", fmt.Errorf("workspace delta file size is invalid")
+		}
+		content, err := io.ReadAll(io.LimitReader(reader, header.Size+1))
+		if err != nil || int64(len(content)) != header.Size {
+			return "", fmt.Errorf("workspace delta file content is incomplete")
+		}
+		if fileContent && limits.RejectBinaryFiles && (bytes.IndexByte(content, 0) >= 0 || !utf8.Valid(content)) {
+			return "workspace delta contains binary file content", nil
+		}
+		if limits.RejectSecretLikeContent && security.LooksLikeSecret(string(content)) {
+			return "workspace delta contains secret-like file content", nil
+		}
+	}
+}
+
+func workspaceDeltaContainsSessionCredential(artifact []byte, state *sessionState) bool {
+	if len(artifact) == 0 || state == nil {
+		return false
+	}
+	credentials := [][]byte{}
+	if state.providerProxy != nil {
+		credentials = append(credentials, state.providerProxy.credential)
+	}
+	if state.mcpProxy != nil {
+		credentials = append(credentials, state.mcpProxy.credential)
+	}
+	for _, credential := range credentials {
+		if len(credential) >= 8 && bytes.Contains(artifact, credential) {
+			return true
+		}
+	}
+	return false
+}
+
+//nolint:gocyclo // Workspace validation keeps security invariants in one auditable boundary.
+func (s *Server) handleWorkspaceDelta(w http.ResponseWriter, r *http.Request) {
+	var request harnessv2.CreateWorkspaceDeltaRequest
+	if !decodeJSON(w, r, s.cfg.Capabilities.Limits.MaxRequestBytes, &request) {
+		return
+	}
+	now := time.Now().UTC()
+	if err := request.ValidateAt(now); err != nil {
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil, false)
+		return
+	}
+	if r.PathValue("deltaID") != string(request.DeltaID) {
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, "workspace delta path does not match request", nil, false)
+		return
+	}
+	if !s.authorizeMutation(w, r, request.Metadata, true) {
+		return
+	}
+	sessionID := harnessv2.RuntimeSessionID(r.PathValue("sessionID"))
+	s.mu.Lock()
+	state := s.sessions[sessionID]
+	if state == nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusConflict, harnessv2.ErrorCodeSessionPoisoned, "runtime session not found", nil, false)
+		return
+	}
+	if err := s.validateSessionFence(state, request.Metadata); err != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusGone, harnessv2.ErrorCodeStaleFence, err.Error(), nil, false)
+		return
+	}
+	classification, err := harnessv2.ClassifyOperation(s.expectedFence(state.descriptor.RuntimeSessionUID, state.descriptor.Generation), request.Metadata, operationPtr(state.operations, request.Metadata.OperationID), true, now)
+	if err != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil, false)
+		return
+	}
+	if classification.Class != harnessv2.RequestClassificationFresh {
+		response, ok := state.deltas[request.DeltaID]
+		s.mu.Unlock()
+		if classification.Class == harnessv2.RequestClassificationDuplicate && ok {
+			response.Classification = classification
+			writeJSON(w, http.StatusOK, response)
+		} else {
+			writeClassificationError(w, classification)
+		}
+		return
+	}
+	if state.prompt == nil || state.prompt.settlement == nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusConflict, harnessv2.ErrorCodeSessionPoisoned, "prompt has not settled", nil, false)
+		return
+	}
+	if !promptMetadataMatches(request.Metadata, state.prompt.request.Metadata) {
+		s.mu.Unlock()
+		writeError(w, http.StatusConflict, harnessv2.ErrorCodeDigestConflict, "workspace delta prompt identity does not match the settled prompt", nil, false)
+		return
+	}
+	if state.descriptor.State != harnessv2.RuntimeSessionStateValidating {
+		s.mu.Unlock()
+		writeError(w, http.StatusConflict, harnessv2.ErrorCodeSessionPoisoned, "runtime session is not awaiting workspace validation", nil, false)
+		return
+	}
+	if state.prompt.settlementDigest == "" || request.PromptSettlementDigest != state.prompt.settlementDigest {
+		s.mu.Unlock()
+		writeError(w, http.StatusConflict, harnessv2.ErrorCodeDigestConflict, "prompt settlement digest does not match", nil, false)
+		return
+	}
+	if request.Intent != state.workspaceIntent || !reflect.DeepEqual(request.VerifiedBaseline, state.descriptor.WorkspaceBaseline) {
+		s.mu.Unlock()
+		writeError(w, http.StatusConflict, harnessv2.ErrorCodeDigestConflict, "workspace intent or verified baseline does not match the runtime session", nil, false)
+		return
+	}
+	state.operations[request.Metadata.OperationID] = operationRecord(request.Metadata, harnessv2.OperationPhaseRecorded, "", now)
+	runtimeSession, baseline, paths := state.runtime, state.baseline, state.paths
+	s.mu.Unlock()
+
+	freezeCtx, cancel := context.WithTimeout(r.Context(), defaultDuration(s.cfg.CancelGrace, acp.DefaultStopGrace))
+	defer cancel()
+	if err := runtimeSession.Freeze(freezeCtx); err != nil {
+		s.poisonSession(state, "workspace freeze could not be proven")
+		s.poisonPool("workspace_freeze_unproven")
+		writeError(w, http.StatusInternalServerError, harnessv2.ErrorCodeSessionPoisoned, "workspace freeze could not be proven", nil, false)
+		return
+	}
+	frozenAt := time.Now().UTC()
+	intent := workspacedelta.IntentRead
+	if request.Intent == harnessv2.WorkspaceIntentWrite {
+		intent = workspacedelta.IntentWrite
+	}
+	uid, gid := runtimeSession.ChildIdentity()
+	if err := acp.ReclaimSessionOwnership(paths.Root); err != nil {
+		slog.Error("ACP workspace validation failed", "stage", "ownership reclaim")
+		s.poisonSession(state, "workspace ownership reclaim failed")
+		writeError(w, http.StatusInternalServerError, harnessv2.ErrorCodeSessionPoisoned, "workspace ownership reclaim failed", nil, false)
+		return
+	}
+	result, buildErr := buildWorkspaceDelta(baseline, paths.Workspace, intent, request.Limits)
+	if err := acp.FinalizeSessionOwnership(paths.Root, uid, gid); err != nil {
+		slog.Error("ACP workspace validation failed", "stage", "ownership restore")
+		s.poisonSession(state, "workspace ownership restore failed")
+		writeError(w, http.StatusInternalServerError, harnessv2.ErrorCodeSessionPoisoned, "workspace ownership restore failed", nil, false)
+		return
+	}
+	if buildErr != nil {
+		slog.Error("ACP workspace validation failed", "stage", "delta construction")
+		if errors.Is(buildErr, workspacedelta.ErrLimitExceeded) {
+			s.poisonSession(state, "workspace delta exceeds request limits")
+			writeError(w, http.StatusRequestEntityTooLarge, harnessv2.ErrorCodeSessionPoisoned, "workspace delta exceeds request limits", nil, false)
+			return
+		}
+		s.poisonSession(state, "workspace validation failed")
+		writeError(w, http.StatusUnprocessableEntity, harnessv2.ErrorCodeSessionPoisoned, "workspace validation failed", nil, false)
+		return
+	}
+	entryCount := len(result.Changes) + len(result.Deletions)
+	changedPaths := workspaceDeltaChangedPaths(result)
+	if request.Limits.MaxChangedFiles > 0 && len(changedPaths) > int(request.Limits.MaxChangedFiles) {
+		s.poisonSession(state, "workspace delta exceeds changed-file limit")
+		writeError(w, http.StatusUnprocessableEntity, harnessv2.ErrorCodeSessionPoisoned, "workspace delta exceeds changed-file limit", nil, false)
+		return
+	}
+	for _, changedPath := range changedPaths {
+		if !workspaceDeltaPathAllowed(changedPath, request.Limits.AllowedPaths) {
+			s.poisonSession(state, "workspace delta contains a disallowed path")
+			writeError(w, http.StatusUnprocessableEntity, harnessv2.ErrorCodeSessionPoisoned, "workspace delta contains a disallowed path", nil, false)
+			return
+		}
+		if request.Limits.DenyRepositoryControlPaths && workspaceDeltaRepositoryControlPathForWorkspace(state.workspaceRelativeRoot, changedPath) {
+			s.poisonSession(state, "workspace delta contains a protected repository-control path")
+			writeError(w, http.StatusUnprocessableEntity, harnessv2.ErrorCodeSessionPoisoned, "workspace delta contains a protected repository-control path", nil, false)
+			return
+		}
+	}
+	if request.Limits.RejectSecretLikeContent && security.LooksLikeSecret(strings.Join(changedPaths, "\n")) {
+		s.poisonSession(state, "workspace delta path looks secret-like")
+		writeError(w, http.StatusUnprocessableEntity, harnessv2.ErrorCodeSessionPoisoned, "workspace delta path looks secret-like", nil, false)
+		return
+	}
+	if violation, policyErr := workspaceDeltaContentPolicyViolation(result.Artifact, request.Limits); policyErr != nil {
+		s.poisonSession(state, "workspace delta content policy could not be verified")
+		writeError(w, http.StatusUnprocessableEntity, harnessv2.ErrorCodeSessionPoisoned, "workspace delta content policy could not be verified", nil, false)
+		return
+	} else if violation != "" {
+		s.poisonSession(state, violation)
+		writeError(w, http.StatusUnprocessableEntity, harnessv2.ErrorCodeSessionPoisoned, violation, nil, false)
+		return
+	}
+	if workspaceDeltaContainsSessionCredential(result.Artifact, state) {
+		s.poisonSession(state, "workspace delta contains a session credential")
+		writeError(w, http.StatusUnprocessableEntity, harnessv2.ErrorCodeSessionPoisoned, "workspace delta contains a session credential", nil, false)
+		return
+	}
+	if entryCount > int(request.Limits.MaxEntries) || int64(len(result.Artifact)) > request.Limits.MaxBytes {
+		s.poisonSession(state, "workspace delta exceeds request limits")
+		writeError(w, http.StatusRequestEntityTooLarge, harnessv2.ErrorCodeSessionPoisoned, "workspace delta exceeds request limits", nil, false)
+		return
+	}
+	descriptor := harnessv2.WorkspaceDeltaDescriptor{
+		DeltaID: request.DeltaID, RuntimeSessionUID: state.descriptor.RuntimeSessionUID, SessionGeneration: state.descriptor.Generation,
+		Intent: request.Intent, VerifiedBaseline: request.VerifiedBaseline, RelativeRoot: state.workspaceRelativeRoot,
+		EntryCount:        uint32(entryCount),
+		DeletedEntryCount: uint32(len(result.Deletions)), SymlinkEntryCount: uint32(len(result.Symlinks)),
+		NoFollowVerified: true, FrozenAt: frozenAt,
+	}
+	for _, change := range result.Changes {
+		if change.Kind == workspacedelta.EntryFile {
+			descriptor.ChangedFileCount++
+		}
+	}
+	switch result.Classification {
+	case workspacedelta.ClassificationNoChange:
+		descriptor.State = harnessv2.WorkspaceDeltaNoChange
+		descriptor.PublicationSafe = true
+		if err := runtimeSession.Thaw(); err != nil {
+			s.poisonSession(state, "workspace thaw failed")
+			writeError(w, http.StatusInternalServerError, harnessv2.ErrorCodeSessionPoisoned, "workspace thaw failed", nil, false)
+			return
+		}
+	case workspacedelta.ClassificationReadOnlyModified:
+		descriptor.State = harnessv2.WorkspaceDeltaReadOnlyModified
+		descriptor.PublicationSafe = false
+	case workspacedelta.ClassificationWriteDelta:
+		if s.cfg.ArtifactUploader == nil {
+			s.poisonSession(state, "durable workspace artifact upload is unavailable")
+			writeError(w, http.StatusInternalServerError, harnessv2.ErrorCodeSessionPoisoned, "durable workspace artifact upload is unavailable", nil, false)
+			return
+		}
+		artifact, err := s.cfg.ArtifactUploader.UploadWorkspaceDelta(r.Context(), request, result.Artifact, result.ArtifactDigest)
+		if err != nil || artifact.Digest != result.ArtifactDigest || artifact.SizeBytes != int64(len(result.Artifact)) {
+			s.poisonSession(state, "workspace artifact persistence failed")
+			writeError(w, http.StatusInternalServerError, harnessv2.ErrorCodeSessionPoisoned, "workspace artifact persistence failed", nil, false)
+			return
+		}
+		descriptor.State = harnessv2.WorkspaceDeltaPrepared
+		descriptor.ManifestDigest = result.ManifestDigest
+		descriptor.Artifact = &artifact
+		descriptor.PublicationSafe = true
+	default:
+		s.poisonSession(state, "unsupported workspace delta classification")
+		writeError(w, http.StatusInternalServerError, harnessv2.ErrorCodeSessionPoisoned, "unsupported workspace delta classification", nil, false)
+		return
+	}
+	response := harnessv2.CreateWorkspaceDeltaResponse{Protocol: harnessv2.ProtocolVersion, Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh}, Delta: descriptor}
+	if err := response.ValidateFor(request); err != nil {
+		s.poisonSession(state, "workspace delta response invariant failed")
+		writeError(w, http.StatusInternalServerError, harnessv2.ErrorCodeSessionPoisoned, "workspace delta response invariant failed", nil, false)
+		return
+	}
+	s.mu.Lock()
+	state.deltas[request.DeltaID] = response
+	state.operations[request.Metadata.OperationID] = operationRecord(request.Metadata, harnessv2.OperationPhaseApplied, "", time.Now().UTC())
+	nextMCPState := harnessv2.RuntimeSessionStatePoisoned
+	switch descriptor.State {
+	case harnessv2.WorkspaceDeltaNoChange:
+		state.descriptor.State = harnessv2.RuntimeSessionStateIdle
+		nextMCPState = harnessv2.RuntimeSessionStateIdle
+	case harnessv2.WorkspaceDeltaPrepared:
+		state.descriptor.State = harnessv2.RuntimeSessionStatePublicationPrepared
+		nextMCPState = harnessv2.RuntimeSessionStatePublicationPrepared
+	case harnessv2.WorkspaceDeltaReadOnlyModified:
+		state.descriptor.State = harnessv2.RuntimeSessionStatePoisoned
+	}
+	state.descriptor.LastTransitionAt = time.Now().UTC()
+	mcpProxy := state.mcpProxy
+	sessionCleanup := (s.drain.Requested || state.descriptor.State == harnessv2.RuntimeSessionStatePoisoned) && !state.drainCleanupScheduled
+	if sessionCleanup {
+		state.drainCleanupScheduled = true
+	}
+	s.mu.Unlock()
+	if mcpProxy != nil {
+		mcpProxy.revoke(nextMCPState)
+	}
+	writeJSON(w, http.StatusOK, response)
+	if sessionCleanup {
+		go s.cleanupDrainedSession(sessionID, state)
+	}
+}
+
+func (s *Server) poisonSession(state *sessionState, _ string) {
+	if state.providerProxy != nil {
+		state.providerProxy.revoke()
+	}
+	if state.mcpProxy != nil {
+		state.mcpProxy.revoke(harnessv2.RuntimeSessionStatePoisoned)
+	}
+	s.mu.Lock()
+	state.descriptor.State = harnessv2.RuntimeSessionStatePoisoned
+	state.descriptor.LastTransitionAt = time.Now().UTC()
+	cleanup := !state.creating && state.runtime != nil && !state.drainCleanupScheduled
+	if cleanup {
+		state.drainCleanupScheduled = true
+	}
+	s.mu.Unlock()
+	if cleanup {
+		go s.cleanupDrainedSession(state.id, state)
+	}
+}
+
+func (s *Server) mapRuntimeEvent(state *sessionState, prompt *promptState, event acp.PromptEvent) (*harnessv2.Event, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	prompt.sequence++
+	identity := eventIdentity(s.cfg.Fence, state.descriptor, prompt.request.Metadata, prompt.sequence, event.Timestamp)
+	switch event.Type {
+	case acp.PromptEventAccepted:
+		if state.mcpProxy == nil || state.mcpProxy.markRunning(prompt.request.Metadata.PromptID, event.Timestamp) != nil {
+			return nil, fmt.Errorf("activate prompt-scoped MCP authority")
+		}
+		prompt.acceptedAt = event.Timestamp
+		prompt.operation = operationRecord(prompt.request.Metadata, harnessv2.OperationPhaseAccepted, "", event.Timestamp)
+		state.operations[prompt.request.Metadata.OperationID] = prompt.operation
+		state.descriptor.State = harnessv2.RuntimeSessionStatePromptRunning
+		state.descriptor.LastTransitionAt = event.Timestamp
+		return &harnessv2.Event{Protocol: harnessv2.ProtocolVersion, Type: harnessv2.EventAccepted, Identity: identity, Accepted: &harnessv2.AcceptedEvent{AcceptedAt: event.Timestamp, Lease: prompt.lease, ACPVersion: harnessv2.ACPProfileV1}}, nil
+	case acp.PromptEventUpdate:
+		update, text, ok, err := mapACPUpdate(event.Update)
+		if err != nil {
+			prompt.sequence--
+			return nil, err
+		}
+		if text != "" {
+			prompt.appendAssistantText(text, acpAssistantMessagePhase(event.Update), s.cfg.Capabilities.Limits.MaxTerminalResultBytes)
+		}
+		if !ok {
+			prompt.sequence--
+			return nil, nil
+		}
+		return &harnessv2.Event{Protocol: harnessv2.ProtocolVersion, Type: harnessv2.EventUpdate, Identity: identity, Update: update}, nil
+	case acp.PromptEventPermissionRequested:
+		permission, err := mapPermission(event.Permission, event.Timestamp, defaultDuration(s.cfg.PermissionTimeout, acp.DefaultPermissionTimeout))
+		if err != nil {
+			return nil, err
+		}
+		options := make(map[string]harnessv2.PermissionOptionKind, len(permission.Options))
+		for _, option := range permission.Options {
+			options[option.OptionID] = option.Kind
+		}
+		state.permissions[permission.RequestID] = permissionState{
+			requestID: permission.RequestID, toolCallID: permission.ToolCallID, toolName: permission.ToolName,
+			title: permission.Title, requestedAt: event.Timestamp, expiresAt: permission.ExpiresAt, options: options,
+		}
+		return &harnessv2.Event{Protocol: harnessv2.ProtocolVersion, Type: harnessv2.EventPermissionRequested, Identity: identity, PermissionRequested: permission}, nil
+	default:
+		return nil, fmt.Errorf("unsupported runtime prompt event %q", event.Type)
+	}
+}
+
+func (s *Server) terminalEvent(
+	state *sessionState,
+	prompt *promptState,
+	result acp.PromptResult,
+) (harnessv2.Event, acp.PromptResult, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	prompt.sequence++
+	effective := result
+	if prompt.settlement != nil {
+		effective = promptResultFromSettlement(*prompt.settlement)
+	} else {
+		effective = providerTurnLimitResult(state, prompt, effective)
+	}
+	now := effective.SettledAt
+	if now.IsZero() {
+		now = time.Now().UTC()
+		effective.SettledAt = now
+	}
+	event := s.buildTerminalEventLocked(state, prompt, effective, now)
+	limit := s.cfg.Capabilities.Limits.MaxTerminalResultBytes
+	_, overflow := prompt.terminalResultText()
+	if !overflow && serializedEventWithinLimit(event, limit) {
+		return event, effective, nil
+	}
+
+	effective = acp.PromptResult{
+		Outcome: acp.PromptOutcomeFailed, StopReason: acp.StopReasonRefusal,
+		Accepted: true, SettledAt: now, Err: fmt.Errorf("terminal result exceeds configured size limit"),
+	}
+	event = harnessv2.Event{
+		Protocol: harnessv2.ProtocolVersion,
+		Type:     harnessv2.EventFailed,
+		Identity: eventIdentity(s.cfg.Fence, state.descriptor, prompt.request.Metadata, prompt.sequence, now),
+		Failed: &harnessv2.FailedEvent{
+			StopReason: harnessv2.ACPStopReasonRefusal,
+			Code:       "terminal_result_too_large",
+			Message:    "terminal result exceeded configured size limit",
+			Retryable:  false,
+		},
+	}
+	if !serializedEventWithinLimit(event, limit) {
+		return event, effective, fmt.Errorf("bounded terminal failure event exceeds %d bytes", limit)
+	}
+	return event, effective, nil
+}
+
+func (s *Server) buildTerminalEventLocked(
+	state *sessionState,
+	prompt *promptState,
+	result acp.PromptResult,
+	at time.Time,
+) harnessv2.Event {
+	event := harnessv2.Event{
+		Protocol: harnessv2.ProtocolVersion,
+		Identity: eventIdentity(s.cfg.Fence, state.descriptor, prompt.request.Metadata, prompt.sequence, at),
+	}
+	switch result.Outcome {
+	case acp.PromptOutcomeCompleted:
+		text, _ := prompt.terminalResultText()
+		if strings.TrimSpace(text) == "" {
+			text = "Prompt completed without textual output."
+		}
+		event.Type = harnessv2.EventCompleted
+		event.Completed = &harnessv2.CompletedEvent{
+			StopReason: harnessv2.ACPStopReasonEndTurn,
+			Result: harnessv2.PromptResult{
+				Content: []harnessv2.ContentBlock{{Type: harnessv2.ContentBlockText, Text: text}},
+				Model:   s.cfg.Provider.Model,
+			},
+		}
+	case acp.PromptOutcomeCancelled:
+		event.Type = harnessv2.EventCancelled
+		event.Cancelled = &harnessv2.CancelledEvent{StopReason: harnessv2.ACPStopReasonCancelled, Reason: "prompt cancelled"}
+	case acp.PromptOutcomeOutcomeUnknown:
+		event.Type = harnessv2.EventOutcomeUnknown
+		event.OutcomeUnknown = &harnessv2.OutcomeUnknownEvent{Code: "acp_settlement_unproven", Message: "ACP prompt outcome could not be proven", Retryable: false}
+	default:
+		event.Type = harnessv2.EventFailed
+		code, message := "acp_prompt_failed", "ACP prompt failed"
+		if result.StopReason == acp.StopReasonMaxTurnRequests {
+			code = "turn_limit"
+			message = "ACP prompt exceeded maximum provider inference requests"
+		}
+		event.Failed = &harnessv2.FailedEvent{
+			StopReason: harnessv2.ACPStopReason(result.StopReason),
+			Code:       code,
+			Message:    message,
+			Retryable:  false,
+		}
+	}
+	return event
+}
+
+func (p *promptState) appendAssistantText(text, phase string, limit int) {
+	appendBoundedPromptText(&p.assistant, &p.assistantOverflow, text, limit)
+	if phase != acpAssistantPhaseFinalAnswer {
+		return
+	}
+	p.finalAnswerSeen = true
+	appendBoundedPromptText(&p.finalAnswer, &p.finalAnswerOverflow, text, limit)
+}
+
+func (p *promptState) terminalResultText() (string, bool) {
+	if p.finalAnswerSeen {
+		return p.finalAnswer.String(), p.finalAnswerOverflow
+	}
+	return p.assistant.String(), p.assistantOverflow
+}
+
+func appendBoundedPromptText(builder *strings.Builder, overflow *bool, text string, limit int) {
+	if *overflow {
+		return
+	}
+	if limit < 1 || len(text) > limit || builder.Len() > limit-len(text) {
+		*overflow = true
+		return
+	}
+	_, _ = builder.WriteString(text)
+}
+
+func providerTurnLimitResult(state *sessionState, prompt *promptState, result acp.PromptResult) acp.PromptResult {
+	if state == nil || prompt == nil || state.providerProxy == nil ||
+		!state.providerProxy.maxTurnsExceeded(string(prompt.request.Metadata.PromptID)) {
+		return result
+	}
+	result.Outcome = acp.PromptOutcomeFailed
+	result.StopReason = acp.StopReasonMaxTurnRequests
+	result.Accepted = true
+	return result
+}
+
+func serializedEventWithinLimit(event harnessv2.Event, limit int) bool {
+	encoded, err := json.Marshal(event)
+	return err == nil && len(encoded) <= limit
+}
+
+func promptResultFromSettlement(settlement harnessv2.PromptSettlement) acp.PromptResult {
+	result := acp.PromptResult{Accepted: true, SettledAt: settlement.SettledAt, StopReason: acp.StopReason(settlement.StopReason)}
+	switch settlement.TerminalEvent {
+	case harnessv2.EventCompleted:
+		result.Outcome = acp.PromptOutcomeCompleted
+		result.StopReason = acp.StopReasonEndTurn
+	case harnessv2.EventCancelled:
+		result.Outcome = acp.PromptOutcomeCancelled
+		result.StopReason = acp.StopReasonCancelled
+	case harnessv2.EventOutcomeUnknown:
+		result.Outcome = acp.PromptOutcomeOutcomeUnknown
+	default:
+		result.Outcome = acp.PromptOutcomeFailed
+		if result.StopReason == "" {
+			result.StopReason = acp.StopReasonRefusal
+		}
+	}
+	return result
+}
+
+func (s *Server) finishPrompt(state *sessionState, prompt *promptState, result acp.PromptResult, settledAt time.Time) {
+	settlement := settlementFromResult(result, settledAt)
+	s.mu.Lock()
+	settlement = settlePromptLocked(prompt, settlement)
+	state.operations[prompt.request.Metadata.OperationID] = operationRecord(prompt.request.Metadata, harnessv2.OperationPhaseSettled, settlement.TerminalEvent, settlement.SettledAt)
+	state.permissions = make(map[harnessv2.PermissionRequestID]permissionState)
+	next := harnessv2.RuntimeSessionStatePoisoned
+	if settlement.TerminalEvent == harnessv2.EventCompleted {
+		next = harnessv2.RuntimeSessionStateValidating
+	}
+	state.descriptor.State = next
+	state.descriptor.LastTransitionAt = settlement.SettledAt
+	sessionCleanup := settlement.TerminalEvent != harnessv2.EventCompleted && !state.drainCleanupScheduled
+	if sessionCleanup {
+		state.drainCleanupScheduled = true
+	}
+	s.mu.Unlock()
+	deactivatePromptCapabilities(state, prompt.request.Metadata.PromptID, next)
+	if sessionCleanup {
+		go s.cleanupDrainedSession(state.id, state)
+	}
+}
+
+func settlePromptLocked(prompt *promptState, settlement harnessv2.PromptSettlement) harnessv2.PromptSettlement {
+	if prompt.settlement != nil {
+		return *prompt.settlement
+	}
+	prompt.settlement = &settlement
+	digest, err := harnessv2.CanonicalPromptSettlementDigest(settlement)
+	if err == nil {
+		prompt.settlementDigest = digest
+	}
+	return settlement
+}
+
+func deactivatePromptCapabilities(state *sessionState, promptID harnessv2.PromptID, next harnessv2.RuntimeSessionState) {
+	if state == nil {
+		return
+	}
+	if state.providerProxy != nil {
+		state.providerProxy.deactivate(string(promptID))
+	}
+	if state.mcpProxy != nil {
+		state.mcpProxy.deactivate(promptID, next)
+	}
+}
+
+func settlementFromResult(result acp.PromptResult, at time.Time) harnessv2.PromptSettlement {
+	if at.IsZero() {
+		at = time.Now().UTC()
+	}
+	settlement := harnessv2.PromptSettlement{SettledAt: at}
+	switch result.Outcome {
+	case acp.PromptOutcomeCompleted:
+		settlement.TerminalEvent, settlement.Outcome, settlement.StopReason = harnessv2.EventCompleted, harnessv2.PromptOutcomeSucceeded, harnessv2.ACPStopReasonEndTurn
+	case acp.PromptOutcomeCancelled:
+		settlement.TerminalEvent, settlement.Outcome, settlement.StopReason = harnessv2.EventCancelled, harnessv2.PromptOutcomeCancelled, harnessv2.ACPStopReasonCancelled
+	case acp.PromptOutcomeOutcomeUnknown:
+		settlement.TerminalEvent, settlement.Outcome = harnessv2.EventOutcomeUnknown, harnessv2.PromptOutcomeUnknown
+	default:
+		mapping := harnessv2.MapACPStopReason(harnessv2.ACPStopReason(result.StopReason), true)
+		settlement.TerminalEvent, settlement.Outcome, settlement.StopReason = mapping.EventType, mapping.Outcome, harnessv2.ACPStopReason(result.StopReason)
+	}
+	return settlement
+}
+
+func cancellationResponse(classification harnessv2.Classification, settlement harnessv2.PromptSettlement, invalidated uint32, forced bool) harnessv2.CancelPromptResponse {
+	barrier := harnessv2.CancellationBarrierSettled
+	proven := settlement.TerminalEvent != harnessv2.EventOutcomeUnknown
+	if !proven {
+		barrier = harnessv2.CancellationBarrierOutcomeUnknown
+	} else if forced {
+		barrier = harnessv2.CancellationBarrierForcedTerminated
+	}
+	return harnessv2.CancelPromptResponse{
+		Protocol: harnessv2.ProtocolVersion, Classification: classification, BarrierState: barrier,
+		SettlementProven: proven, Settlement: settlement, InvalidatedPermissionRequests: invalidated,
+		ForcedTermination: forced,
+	}
+}
+
+func (s *Server) validateSessionFence(state *sessionState, metadata harnessv2.MutationMetadata) error {
+	mismatch := harnessv2.CompareFence(s.expectedFence(state.descriptor.RuntimeSessionUID, state.descriptor.Generation), metadata.Fence, true)
+	if mismatch != harnessv2.FenceMatch {
+		return fmt.Errorf("stale runtime fence: %s", mismatch)
+	}
+	return nil
+}
+
+func eventIdentity(base harnessv2.Fence, descriptor harnessv2.RuntimeSessionDescriptor, metadata harnessv2.MutationMetadata, sequence uint64, at time.Time) harnessv2.EventIdentity {
+	return harnessv2.EventIdentity{
+		RuntimeInstanceID: base.RuntimeInstanceID, SupervisorBootID: base.SupervisorBootID,
+		RuntimeSessionUID: descriptor.RuntimeSessionUID, RuntimeSessionGeneration: descriptor.Generation,
+		TaskUID: metadata.TaskUID, TaskAttempt: metadata.TaskAttempt, PromptID: metadata.PromptID,
+		Sequence: sequence, RequestDigest: metadata.RequestDigest, Timestamp: at,
+	}
+}
+
+func eventLimits(limits harnessv2.ProtocolLimits) harnessv2.EventStreamLimits {
+	return harnessv2.EventStreamLimits{
+		MaxLineBytes: limits.MaxEventLineBytes, MaxTerminalResultBytes: limits.MaxTerminalResultBytes,
+		MaxBufferedEvents: limits.MaxBufferedEvents, MaxUpdateEventsPerSecond: limits.MaxUpdateEventsPerSecond,
+	}
+}
+
+func promptMetadataMatches(incoming, current harnessv2.MutationMetadata) bool {
+	return incoming.TaskUID == current.TaskUID && incoming.TaskAttempt == current.TaskAttempt && incoming.PromptID == current.PromptID
+}
+
+func pathMatchesPrompt(r *http.Request, metadata harnessv2.MutationMetadata) bool {
+	return r.PathValue("promptID") == string(metadata.PromptID)
+}
+
+func pathMatchesPermission(r *http.Request, request harnessv2.ResolvePermissionRequest) bool {
+	return pathMatchesPrompt(r, request.Metadata) && r.PathValue("requestID") == string(request.RequestID)
+}
diff --git a/workers/acp/supervisor/prompt_handlers_test.go b/workers/acp/supervisor/prompt_handlers_test.go
new file mode 100644
index 000000000..496275704
--- /dev/null
+++ b/workers/acp/supervisor/prompt_handlers_test.go
@@ -0,0 +1,941 @@
+package supervisor
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"slices"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+	"unicode/utf8"
+
+	"github.com/orka-agents/orka/internal/acp"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/workspacedelta"
+)
+
+func TestPromptStreamErrorDetailIsBoundedAndSingleLine(t *testing.T) {
+	if got := promptStreamErrorDetail(fmt.Errorf("first\nsecond\rthird")); got != "first second third" {
+		t.Fatalf("single-line detail = %q", got)
+	}
+	detail := promptStreamErrorDetail(fmt.Errorf("%s界", strings.Repeat("x", 512)))
+	if !strings.HasSuffix(detail, "...") || len(strings.TrimSuffix(detail, "...")) > 512 || !utf8.ValidString(detail) {
+		t.Fatalf("bounded detail = %q (len=%d)", detail, len(detail))
+	}
+}
+
+func TestPromptStreamErrorClass(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want string
+	}{
+		{name: "unexpected event", want: "unexpected-event"},
+		{name: "rate", err: fmt.Errorf("wrapped: %w", harnessv2.ErrEventRateExceeded), want: "event-rate-exceeded"},
+		{name: "byte rate", err: fmt.Errorf("wrapped: %w", harnessv2.ErrEventByteRateExceeded), want: "event-byte-rate-exceeded"},
+		{name: "line", err: harnessv2.ErrEventLineTooLarge, want: "event-line-too-large"},
+		{name: "malformed", err: harnessv2.ErrMalformedEvent, want: "malformed-event"},
+		{name: "identity", err: harnessv2.ErrEventIdentityMismatch, want: "event-identity-mismatch"},
+		{name: "sequence", err: harnessv2.ErrEventSequence, want: "event-sequence"},
+		{name: "after terminal", err: harnessv2.ErrEventAfterTerminal, want: "event-after-terminal"},
+		{name: "missing accepted", err: harnessv2.ErrMissingAcceptedEvent, want: "missing-accepted-event"},
+		{name: "write", err: fmt.Errorf("write event: broken pipe"), want: "event-write"},
+		{name: "tool call id", err: fmt.Errorf("ACP tool call update omitted toolCallId"), want: "missing-tool-call-id"},
+		{name: "update decode", err: fmt.Errorf("decode ACP session update: invalid syntax"), want: "update-decode"},
+		{name: "permission", err: fmt.Errorf("unsupported ACP permission option kind"), want: "permission-map"},
+		{name: "runtime event", err: fmt.Errorf("unsupported runtime prompt event"), want: "unsupported-runtime-event"},
+		{name: "MCP authority", err: fmt.Errorf("activate prompt-scoped MCP authority"), want: "mcp-authority"},
+		{name: "terminal size", err: fmt.Errorf("bounded terminal failure event exceeds size"), want: "terminal-size"},
+		{name: "other", err: fmt.Errorf("other failure"), want: "unclassified"},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if got := promptStreamErrorClass(test.err); got != test.want {
+				t.Fatalf("promptStreamErrorClass(%v) = %q, want %q", test.err, got, test.want)
+			}
+		})
+	}
+}
+
+func TestPromptStreamMalformedValidationClassIsBounded(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want string
+	}{
+		{name: "not malformed", err: harnessv2.ErrEventRateExceeded},
+		{name: "assistant empty", err: fmt.Errorf("%w: assistant message chunk is required", harnessv2.ErrMalformedEvent), want: "assistant-empty"},
+		{name: "assistant too large", err: fmt.Errorf("%w: assistant message chunk exceeds 4096 bytes", harnessv2.ErrMalformedEvent), want: "assistant-too-large"},
+		{name: "assistant UTF-8", err: fmt.Errorf("%w: assistant message chunk contains invalid UTF-8", harnessv2.ErrMalformedEvent), want: "assistant-invalid-utf8"},
+		{name: "tool status", err: fmt.Errorf("%w: unsupported tool call status provider-secret", harnessv2.ErrMalformedEvent), want: "tool-call-status"},
+		{name: "plan content", err: fmt.Errorf("%w: plan entry content exceeds 4096 bytes", harnessv2.ErrMalformedEvent), want: "plan-content"},
+		{name: "other", err: fmt.Errorf("%w: provider-secret-must-not-leak", harnessv2.ErrMalformedEvent), want: "Other"},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if got := promptStreamMalformedValidationClass(test.err); got != test.want {
+				t.Fatalf("validation class = %q, want %q", got, test.want)
+			}
+		})
+	}
+}
+
+func TestPromptDuplicateClassificationPrecedesCapacityAdmission(t *testing.T) {
+	server, cfg, profile := newTestServer(t, "immediate")
+	create := testCreateSessionRequest(t, cfg, profile)
+	created := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1", create, cfg)
+	if created.Code != http.StatusCreated {
+		t.Fatalf("create status = %d body=%s", created.Code, created.Body.String())
+	}
+	prompt := testStartPromptRequest(t, cfg, create.Metadata.Fence)
+	now := time.Now().UTC()
+
+	tests := []struct {
+		name           string
+		phase          harnessv2.OperationPhase
+		terminal       harnessv2.EventType
+		wantCode       harnessv2.ErrorCode
+		wantClass      harnessv2.RequestClassification
+		withSettlement bool
+	}{
+		{
+			name: "already accepted", phase: harnessv2.OperationPhaseAccepted,
+			wantCode: harnessv2.ErrorCodeAlreadyAccepted, wantClass: harnessv2.RequestClassificationAlreadyAccepted,
+		},
+		{
+			name: "settled", phase: harnessv2.OperationPhaseSettled, terminal: harnessv2.EventCompleted,
+			wantCode: harnessv2.ErrorCodeSettled, wantClass: harnessv2.RequestClassificationSettled, withSettlement: true,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			server.mu.Lock()
+			state := server.sessions[create.RuntimeSessionID]
+			state.operations[prompt.Metadata.OperationID] = operationRecord(prompt.Metadata, test.phase, test.terminal, now)
+			state.prompt = &promptState{request: prompt}
+			if test.withSettlement {
+				settlement := harnessv2.PromptSettlement{
+					TerminalEvent: harnessv2.EventCompleted, Outcome: harnessv2.PromptOutcomeSucceeded,
+					StopReason: harnessv2.ACPStopReasonEndTurn, SettledAt: now,
+				}
+				state.prompt.settlement = &settlement
+			}
+			server.mu.Unlock()
+
+			for len(server.promptSlots) < cap(server.promptSlots) {
+				server.promptSlots <- struct{}{}
+			}
+			response := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1/prompts/prompt-1", prompt, cfg)
+			for len(server.promptSlots) > 0 {
+				<-server.promptSlots
+			}
+			if response.Code != http.StatusOK {
+				t.Fatalf("duplicate status = %d body=%s", response.Code, response.Body.String())
+			}
+			var decoded harnessv2.ErrorResponse
+			if err := json.Unmarshal(response.Body.Bytes(), &decoded); err != nil {
+				t.Fatal(err)
+			}
+			if decoded.Code != test.wantCode || decoded.Classification == nil || decoded.Classification.Class != test.wantClass {
+				t.Fatalf("duplicate response = %#v", decoded)
+			}
+		})
+	}
+}
+
+func TestSettledPromptDoesNotBlockNextIdleTurn(t *testing.T) {
+	server, cfg, profile := newTestServer(t, "immediate")
+	create := testCreateSessionRequest(t, cfg, profile)
+	created := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1", create, cfg)
+	if created.Code != http.StatusCreated {
+		t.Fatalf("create status = %d body=%s", created.Code, created.Body.String())
+	}
+	previous := testStartPromptRequest(t, cfg, create.Metadata.Fence)
+	settlement := harnessv2.PromptSettlement{
+		TerminalEvent: harnessv2.EventCompleted,
+		Outcome:       harnessv2.PromptOutcomeSucceeded,
+		StopReason:    harnessv2.ACPStopReasonEndTurn,
+		SettledAt:     time.Now().UTC(),
+	}
+	server.mu.Lock()
+	state := server.sessions[create.RuntimeSessionID]
+	state.descriptor.State = harnessv2.RuntimeSessionStateIdle
+	state.prompt = &promptState{request: previous, settlement: &settlement}
+	server.mu.Unlock()
+
+	next := testStartPromptRequest(t, cfg, create.Metadata.Fence)
+	next.Metadata.OperationID = testPromptOperationTwo
+	next.Metadata.PromptID = testPromptTwoID
+	next.MCPAuthorization.TaskUID = next.Metadata.TaskUID
+	next.MCPAuthorization.TaskAttempt = next.Metadata.TaskAttempt
+	next.MCPAuthorization.PromptID = next.Metadata.PromptID
+	next.Metadata.RequestDigest = ""
+	sealRequest(t, &next.Metadata.RequestDigest, next)
+	response := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1/prompts/prompt-2", next, cfg)
+	if response.Code != http.StatusOK {
+		t.Fatalf("continuation status = %d body=%s", response.Code, response.Body.String())
+	}
+	server.mu.Lock()
+	defer server.mu.Unlock()
+	if state.prompt == nil || state.prompt.request.Metadata.PromptID != next.Metadata.PromptID || state.prompt.settlement == nil {
+		t.Fatalf("continuation prompt state = %#v", state.prompt)
+	}
+}
+
+func TestWorkspaceDeltaDuplicateReplaysAfterContinuationStarts(t *testing.T) {
+	server, cfg, profile := newTestServer(t, "immediate")
+	create := testCreateSessionRequest(t, cfg, profile)
+	created := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1", create, cfg)
+	if created.Code != http.StatusCreated {
+		t.Fatalf("create status = %d body=%s", created.Code, created.Body.String())
+	}
+	oldPrompt := testStartPromptRequest(t, cfg, create.Metadata.Fence)
+	request := harnessv2.CreateWorkspaceDeltaRequest{
+		Protocol:               harnessv2.ProtocolVersion,
+		Metadata:               oldPrompt.Metadata,
+		DeltaID:                "delta-old",
+		Intent:                 create.Workspace.Intent,
+		VerifiedBaseline:       create.Workspace.Baseline,
+		PromptSettlementDigest: testDigest("old-settlement"),
+		Limits:                 harnessv2.WorkspaceDeltaLimits{MaxBytes: 1 << 20, MaxEntries: 100},
+	}
+	request.Metadata.OperationID = "workspace-delta-old"
+	request.Metadata.ExpiresAt = time.Now().UTC().Add(time.Minute)
+	request.Metadata.RequestDigest = ""
+	sealRequest(t, &request.Metadata.RequestDigest, request)
+	stored := harnessv2.CreateWorkspaceDeltaResponse{
+		Protocol:       harnessv2.ProtocolVersion,
+		Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh},
+		Delta:          harnessv2.WorkspaceDeltaDescriptor{DeltaID: request.DeltaID},
+	}
+	next := testStartPromptRequest(t, cfg, create.Metadata.Fence)
+	next.Metadata.OperationID = testPromptOperationTwo
+	next.Metadata.PromptID = testPromptTwoID
+	server.mu.Lock()
+	state := server.sessions[create.RuntimeSessionID]
+	state.prompt = &promptState{request: next}
+	state.descriptor.State = harnessv2.RuntimeSessionStatePromptRunning
+	state.operations[request.Metadata.OperationID] = operationRecord(request.Metadata, harnessv2.OperationPhaseApplied, "", time.Now().UTC())
+	state.deltas[request.DeltaID] = stored
+	server.mu.Unlock()
+
+	response := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1/workspace-deltas/delta-old", request, cfg)
+	if response.Code != http.StatusOK {
+		t.Fatalf("duplicate workspace delta status = %d body=%s", response.Code, response.Body.String())
+	}
+	var decoded harnessv2.CreateWorkspaceDeltaResponse
+	decodeResponse(t, response, &decoded)
+	if decoded.Classification.Class != harnessv2.RequestClassificationDuplicate || decoded.Classification.Phase != harnessv2.OperationPhaseApplied {
+		t.Fatalf("duplicate workspace delta response = %#v", decoded)
+	}
+}
+
+func TestLateFreshCancellationCannotSettleContinuationPrompt(t *testing.T) {
+	server, cfg, profile := newTestServer(t, "immediate")
+	create := testCreateSessionRequest(t, cfg, profile)
+	created := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1", create, cfg)
+	if created.Code != http.StatusCreated {
+		t.Fatalf("create status = %d body=%s", created.Code, created.Body.String())
+	}
+	current := testStartPromptRequest(t, cfg, create.Metadata.Fence)
+	current.Metadata.OperationID = testPromptOperationTwo
+	current.Metadata.PromptID = testPromptTwoID
+	mutations := newBlockingPromptMutator()
+	server.mu.Lock()
+	state := server.sessions[create.RuntimeSessionID]
+	state.prompt = &promptState{request: current}
+	state.promptMutations = mutations
+	state.descriptor.State = harnessv2.RuntimeSessionStatePromptRunning
+	server.mu.Unlock()
+
+	request := harnessv2.CancelPromptRequest{
+		Protocol:           harnessv2.ProtocolVersion,
+		Metadata:           testMetadata(create.Metadata.Fence, "late-cancel-prompt-1", true),
+		Reason:             harnessv2.CancelReasonUserRequested,
+		SettlementDeadline: time.Now().UTC().Add(30 * time.Second),
+	}
+	request.Metadata.PromptID = testPromptOneID
+	request.Metadata.ExpiresAt = request.SettlementDeadline
+	sealRequest(t, &request.Metadata.RequestDigest, request)
+	response := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1/prompts/prompt-1/cancel", request, cfg)
+	if response.Code != http.StatusConflict {
+		t.Fatalf("late cancellation status = %d body=%s", response.Code, response.Body.String())
+	}
+	var decoded harnessv2.ErrorResponse
+	decodeResponse(t, response, &decoded)
+	if decoded.Code != harnessv2.ErrorCodeDigestConflict {
+		t.Fatalf("late cancellation error = %#v", decoded)
+	}
+	if got := mutations.cancelCalls.Load(); got != 0 {
+		t.Fatalf("late cancellation side effects = %d, want 0", got)
+	}
+	server.mu.Lock()
+	defer server.mu.Unlock()
+	if state.prompt.settlement != nil {
+		t.Fatalf("continuation prompt was settled: %#v", state.prompt.settlement)
+	}
+	if _, ok := state.operations[request.Metadata.OperationID]; ok {
+		t.Fatal("late cancellation recorded an operation")
+	}
+}
+
+func TestPriorPromptLeaseDuplicateReplaysExactLeaseAfterContinuation(t *testing.T) {
+	server, cfg, profile := newTestServer(t, "immediate")
+	create := testCreateSessionRequest(t, cfg, profile)
+	created := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1", create, cfg)
+	if created.Code != http.StatusCreated {
+		t.Fatalf("create status = %d body=%s", created.Code, created.Body.String())
+	}
+	now := time.Now().UTC()
+	oldPrompt := testStartPromptRequest(t, cfg, create.Metadata.Fence)
+	oldLease := harnessv2.PromptLease{Generation: 2, IssuedAt: now, ExpiresAt: now.Add(time.Minute)}
+	authorization := oldPrompt.MCPAuthorization
+	authorization.LeaseGeneration = oldLease.Generation
+	authorization.ExpiresAt = now.Add(30 * time.Second)
+	request := harnessv2.RenewPromptLeaseRequest{
+		Protocol:                harnessv2.ProtocolVersion,
+		Metadata:                testMetadata(create.Metadata.Fence, "renew-old", true),
+		ExpectedLeaseGeneration: 1,
+		Lease:                   oldLease,
+		MCPAuthorization:        authorization,
+	}
+	request.Metadata.PromptID = oldPrompt.Metadata.PromptID
+	request.Metadata.ExpiresAt = authorization.ExpiresAt
+	request.MCPAuthorization.TaskUID = request.Metadata.TaskUID
+	request.MCPAuthorization.TaskAttempt = request.Metadata.TaskAttempt
+	request.MCPAuthorization.PromptID = request.Metadata.PromptID
+	sealRequest(t, &request.Metadata.RequestDigest, request)
+	stored := harnessv2.PromptLeaseResponse{
+		Protocol:       harnessv2.ProtocolVersion,
+		Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh},
+		Lease:          oldLease,
+	}
+	done := make(chan struct{})
+	close(done)
+	current := testStartPromptRequest(t, cfg, create.Metadata.Fence)
+	current.Metadata.OperationID = testPromptOperationTwo
+	current.Metadata.PromptID = testPromptTwoID
+	current.Lease.Generation = 9
+	server.mu.Lock()
+	state := server.sessions[create.RuntimeSessionID]
+	state.prompt = &promptState{request: current, lease: current.Lease}
+	state.descriptor.State = harnessv2.RuntimeSessionStatePromptRunning
+	state.operations[request.Metadata.OperationID] = operationRecord(request.Metadata, harnessv2.OperationPhaseApplied, "", now)
+	state.operationReplays[request.Metadata.OperationID] = &operationReplay{done: done, lease: &stored}
+	server.mu.Unlock()
+
+	response := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1/prompts/prompt-1/lease", request, cfg)
+	if response.Code != http.StatusOK {
+		t.Fatalf("old lease replay status = %d body=%s", response.Code, response.Body.String())
+	}
+	var decoded harnessv2.PromptLeaseResponse
+	decodeResponse(t, response, &decoded)
+	if decoded.Classification.Class != harnessv2.RequestClassificationDuplicate || decoded.Lease.Generation != oldLease.Generation {
+		t.Fatalf("old lease replay = %#v", decoded)
+	}
+}
+
+func TestWorkspaceDeltaRouteValidatesSettledPromptWithoutPromptPathSegment(t *testing.T) {
+	server, cfg, profile := newTestServer(t, "immediate")
+	create := testCreateSessionRequest(t, cfg, profile)
+	prompt := testStartPromptRequest(t, cfg, create.Metadata.Fence)
+	settlement := harnessv2.PromptSettlement{
+		TerminalEvent: harnessv2.EventCompleted,
+		Outcome:       harnessv2.PromptOutcomeSucceeded,
+		StopReason:    harnessv2.ACPStopReasonEndTurn,
+		SettledAt:     time.Now().UTC(),
+	}
+	settlementDigest := testDigest("settled-prompt")
+	server.sessions[create.RuntimeSessionID] = &sessionState{
+		descriptor: harnessv2.RuntimeSessionDescriptor{
+			RuntimeSessionUID: create.Metadata.Fence.RuntimeSessionUID,
+			Generation:        create.Metadata.Fence.RuntimeSessionGeneration,
+			State:             harnessv2.RuntimeSessionStateValidating,
+			WorkspaceBaseline: create.Workspace.Baseline,
+		},
+		operations:      make(map[harnessv2.OperationID]harnessv2.OperationRecord),
+		permissions:     make(map[harnessv2.PermissionRequestID]permissionState),
+		workspaceIntent: create.Workspace.Intent,
+		prompt: &promptState{
+			request:          prompt,
+			settlement:       &settlement,
+			settlementDigest: settlementDigest,
+		},
+	}
+	request := harnessv2.CreateWorkspaceDeltaRequest{
+		Protocol:               harnessv2.ProtocolVersion,
+		Metadata:               prompt.Metadata,
+		DeltaID:                "delta-1",
+		Intent:                 create.Workspace.Intent,
+		VerifiedBaseline:       create.Workspace.Baseline,
+		PromptSettlementDigest: testDigest("different-settlement"),
+		Limits:                 harnessv2.WorkspaceDeltaLimits{MaxBytes: 1 << 20, MaxEntries: 100},
+	}
+	request.Metadata.OperationID = "workspace-delta-1"
+	request.Metadata.ExpiresAt = time.Now().UTC().Add(time.Minute)
+	request.Metadata.RequestDigest = ""
+	sealRequest(t, &request.Metadata.RequestDigest, request)
+	response := performMutation(
+		t,
+		server.Handler(),
+		http.MethodPut,
+		"/v2/runtime-sessions/session-1/workspace-deltas/delta-1",
+		request,
+		cfg,
+	)
+	if response.Code != http.StatusConflict {
+		t.Fatalf("workspace delta status = %d body=%s", response.Code, response.Body.String())
+	}
+	if got := response.Header().Get("Content-Type"); got != "application/json" {
+		t.Fatalf("workspace delta Content-Type = %q", got)
+	}
+	var decoded harnessv2.ErrorResponse
+	if err := json.Unmarshal(response.Body.Bytes(), &decoded); err != nil {
+		t.Fatal(err)
+	}
+	if decoded.Code != harnessv2.ErrorCodeDigestConflict || decoded.Message != "prompt settlement digest does not match" {
+		t.Fatalf("workspace delta error = %#v", decoded)
+	}
+}
+
+func TestPromptExecutionDiagnosticDoesNotExposeRPCMessage(t *testing.T) {
+	stage, code, service, errorName := promptExecutionDiagnostic(&acp.RPCError{
+		Code:    -32001,
+		Message: "provider-secret-must-not-leak",
+		Data:    json.RawMessage(`{"service":"session","errorName":"APIError","detail":"provider-secret-must-not-leak"}`),
+	})
+	if stage != promptExecutionStageJSONRPCError || code != -32001 || service != "session" || errorName != "APIError" {
+		t.Fatalf("RPC diagnostic = %q/%d/%q/%q", stage, code, service, errorName)
+	}
+	stage, code, service, errorName = promptExecutionDiagnostic(&acp.RPCError{
+		Code: -32603,
+		Data: json.RawMessage(`{"service":"session\nsecret","errorName":"` + strings.Repeat("x", 65) + `"}`),
+	})
+	if stage != promptExecutionStageJSONRPCError || code != -32603 || service != "" || errorName != "" {
+		t.Fatalf("unsafe RPC diagnostic = %q/%d/%q/%q", stage, code, service, errorName)
+	}
+	stage, code, service, errorName = promptExecutionDiagnostic(acp.ErrClosed)
+	if stage != "transport-closed" || code != 0 || service != "" || errorName != "" {
+		t.Fatalf("closed diagnostic = %q/%d/%q/%q", stage, code, service, errorName)
+	}
+}
+
+func TestPromptTerminalDiagnosticAllowsOnlyProtocolEnums(t *testing.T) {
+	tests := []struct {
+		name           string
+		result         acp.PromptResult
+		wantOutcome    string
+		wantStopReason string
+	}{
+		{
+			name: "failed max turn requests",
+			result: acp.PromptResult{
+				Outcome: acp.PromptOutcomeFailed, StopReason: acp.StopReasonMaxTurnRequests,
+			},
+			wantOutcome: "failed", wantStopReason: "max_turn_requests",
+		},
+		{
+			name:        "missing stop reason",
+			result:      acp.PromptResult{Outcome: acp.PromptOutcomeFailed},
+			wantOutcome: "failed", wantStopReason: "",
+		},
+		{
+			name: "unrecognized values",
+			result: acp.PromptResult{
+				Outcome:    acp.PromptOutcome("provider-secret-outcome"),
+				StopReason: acp.StopReason("provider-secret-reason"),
+			},
+			wantOutcome: "Other", wantStopReason: "Other",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			outcome, stopReason := promptTerminalDiagnostic(test.result)
+			if outcome != test.wantOutcome || stopReason != test.wantStopReason {
+				t.Fatalf("terminal diagnostic = %q/%q, want %q/%q", outcome, stopReason, test.wantOutcome, test.wantStopReason)
+			}
+		})
+	}
+}
+
+func TestConcurrentDuplicatePermissionResolutionExecutesOnce(t *testing.T) {
+	server, cfg, profile := newTestServer(t, "immediate")
+	create := testCreateSessionRequest(t, cfg, profile)
+	created := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1", create, cfg)
+	if created.Code != http.StatusCreated {
+		t.Fatalf("create status = %d body=%s", created.Code, created.Body.String())
+	}
+	prompt := testStartPromptRequest(t, cfg, create.Metadata.Fence)
+	mutations := newBlockingPromptMutator()
+
+	server.mu.Lock()
+	state := server.sessions[create.RuntimeSessionID]
+	state.prompt = &promptState{request: prompt}
+	state.descriptor.State = harnessv2.RuntimeSessionStatePromptRunning
+	state.promptMutations = mutations
+	state.permissions["permission-1"] = permissionState{
+		requestID: "permission-1", requestedAt: time.Now().UTC(), expiresAt: time.Now().UTC().Add(time.Minute),
+		options: map[string]harnessv2.PermissionOptionKind{"deny": harnessv2.PermissionOptionRejectOnce},
+	}
+	server.mu.Unlock()
+
+	request := harnessv2.ResolvePermissionRequest{
+		Protocol:  harnessv2.ProtocolVersion,
+		Metadata:  testMetadata(create.Metadata.Fence, "permission-operation-1", true),
+		RequestID: "permission-1",
+		Decision:  harnessv2.PermissionDecision{Outcome: harnessv2.PermissionDecisionCancelled},
+	}
+	sealRequest(t, &request.Metadata.RequestDigest, request)
+	path := "/v2/runtime-sessions/session-1/prompts/prompt-1/permissions/permission-1"
+	firstRequest := mutationHTTPRequest(t, http.MethodPut, path, request, cfg)
+	secondRequest := mutationHTTPRequest(t, http.MethodPut, path, request, cfg)
+	firstDone := serveMutationAsync(server.Handler(), firstRequest)
+	awaitSignal(t, mutations.resolveEntered, "permission resolution did not start")
+	secondDone := serveMutationAsync(server.Handler(), secondRequest)
+	assertStillWaiting(t, secondDone, "duplicate permission resolution returned before the owner completed")
+	if got := mutations.resolveCalls.Load(); got != 1 {
+		t.Fatalf("permission side-effect calls = %d, want 1", got)
+	}
+	close(mutations.resolveRelease)
+
+	first := awaitRecorder(t, firstDone, "first permission resolution did not complete")
+	second := awaitRecorder(t, secondDone, "duplicate permission resolution did not replay")
+	var firstResponse, secondResponse harnessv2.PermissionResolutionResponse
+	decodeResponse(t, first, &firstResponse)
+	decodeResponse(t, second, &secondResponse)
+	if firstResponse.Classification.Class != harnessv2.RequestClassificationFresh || firstResponse.State != harnessv2.PermissionResolutionApplied {
+		t.Fatalf("first permission response = %#v", firstResponse)
+	}
+	if secondResponse.Classification.Class != harnessv2.RequestClassificationDuplicate ||
+		secondResponse.Classification.Phase != harnessv2.OperationPhaseApplied ||
+		secondResponse.State != harnessv2.PermissionResolutionAlreadyResolved {
+		t.Fatalf("duplicate permission response = %#v", secondResponse)
+	}
+	if got := mutations.resolveCalls.Load(); got != 1 {
+		t.Fatalf("permission side-effect calls after replay = %d, want 1", got)
+	}
+}
+
+func TestConcurrentDuplicateCancellationExecutesOnceAndPreservesSettlement(t *testing.T) {
+	server, cfg, profile := newTestServer(t, "immediate")
+	create := testCreateSessionRequest(t, cfg, profile)
+	created := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1", create, cfg)
+	if created.Code != http.StatusCreated {
+		t.Fatalf("create status = %d body=%s", created.Code, created.Body.String())
+	}
+	prompt := testStartPromptRequest(t, cfg, create.Metadata.Fence)
+	mutations := newBlockingPromptMutator()
+	mutations.cancelResult = acp.PromptResult{
+		Outcome: acp.PromptOutcomeCancelled, StopReason: acp.StopReasonCancelled,
+		Accepted: true, SettledAt: time.Now().UTC(),
+	}
+
+	server.mu.Lock()
+	state := server.sessions[create.RuntimeSessionID]
+	state.prompt = &promptState{request: prompt}
+	state.descriptor.State = harnessv2.RuntimeSessionStatePromptRunning
+	state.promptMutations = mutations
+	state.permissions["permission-1"] = permissionState{requestID: "permission-1"}
+	server.mu.Unlock()
+
+	request := harnessv2.CancelPromptRequest{
+		Protocol: harnessv2.ProtocolVersion,
+		Metadata: testMetadata(create.Metadata.Fence, "cancel-operation-1", true),
+		Reason:   harnessv2.CancelReasonUserRequested,
+	}
+	request.SettlementDeadline = time.Now().UTC().Add(30 * time.Second)
+	sealRequest(t, &request.Metadata.RequestDigest, request)
+	path := "/v2/runtime-sessions/session-1/prompts/prompt-1/cancel"
+	firstRequest := mutationHTTPRequest(t, http.MethodPut, path, request, cfg)
+	secondRequest := mutationHTTPRequest(t, http.MethodPut, path, request, cfg)
+	firstDone := serveMutationAsync(server.Handler(), firstRequest)
+	awaitSignal(t, mutations.cancelEntered, "cancellation did not start")
+	secondDone := serveMutationAsync(server.Handler(), secondRequest)
+	assertStillWaiting(t, secondDone, "duplicate cancellation returned before the owner completed")
+	if got := mutations.cancelCalls.Load(); got != 1 {
+		t.Fatalf("cancellation side-effect calls = %d, want 1", got)
+	}
+
+	completed := harnessv2.PromptSettlement{
+		TerminalEvent: harnessv2.EventCompleted, Outcome: harnessv2.PromptOutcomeSucceeded,
+		StopReason: harnessv2.ACPStopReasonEndTurn, SettledAt: time.Now().UTC(),
+	}
+	server.mu.Lock()
+	settlePromptLocked(state.prompt, completed)
+	server.mu.Unlock()
+	close(mutations.cancelRelease)
+
+	first := awaitRecorder(t, firstDone, "first cancellation did not complete")
+	second := awaitRecorder(t, secondDone, "duplicate cancellation did not replay")
+	var firstResponse, secondResponse harnessv2.CancelPromptResponse
+	decodeResponse(t, first, &firstResponse)
+	decodeResponse(t, second, &secondResponse)
+	if firstResponse.Classification.Class != harnessv2.RequestClassificationFresh || firstResponse.Settlement.TerminalEvent != harnessv2.EventCompleted {
+		t.Fatalf("first cancellation response = %#v", firstResponse)
+	}
+	if secondResponse.Classification.Class != harnessv2.RequestClassificationSettled ||
+		secondResponse.Classification.TerminalEvent != harnessv2.EventCompleted ||
+		secondResponse.Settlement.TerminalEvent != harnessv2.EventCompleted {
+		t.Fatalf("duplicate cancellation response = %#v", secondResponse)
+	}
+	if got := mutations.cancelCalls.Load(); got != 1 {
+		t.Fatalf("cancellation side-effect calls after replay = %d, want 1", got)
+	}
+	server.mu.Lock()
+	if state.prompt.settlement == nil || state.prompt.settlement.TerminalEvent != harnessv2.EventCompleted {
+		server.mu.Unlock()
+		t.Fatalf("terminal settlement was overwritten: %#v", state.prompt.settlement)
+	}
+	record := state.operations[request.Metadata.OperationID]
+	server.mu.Unlock()
+	if record.Phase != harnessv2.OperationPhaseSettled || record.TerminalEvent != harnessv2.EventCompleted {
+		t.Fatalf("cancellation operation record = %#v", record)
+	}
+
+	terminal, settledResult, err := server.terminalEvent(state, state.prompt, mutations.cancelResult)
+	if err != nil {
+		t.Fatalf("terminal replay after cancellation race: %v", err)
+	}
+	if terminal.Type != harnessv2.EventCompleted || settledResult.Outcome != acp.PromptOutcomeCompleted {
+		t.Fatalf("terminal replay changed settled outcome: event=%#v result=%#v", terminal, settledResult)
+	}
+	server.finishPrompt(state, state.prompt, mutations.cancelResult, mutations.cancelResult.SettledAt)
+	server.mu.Lock()
+	defer server.mu.Unlock()
+	if state.prompt.settlement.TerminalEvent != harnessv2.EventCompleted || state.descriptor.State != harnessv2.RuntimeSessionStateValidating {
+		t.Fatalf("terminal finisher overwrote settlement: state=%s settlement=%#v", state.descriptor.State, state.prompt.settlement)
+	}
+}
+
+func TestProviderProxyMaxTurnsMapsToTerminalFailure(t *testing.T) {
+	server, cfg, _ := newTestServer(t, "immediate")
+	fence := cfg.Fence
+	fence.RuntimeSessionUID = "max-turn-session-uid"
+	fence.RuntimeSessionGeneration = 1
+	prompt := &promptState{request: testStartPromptRequest(t, cfg, fence)}
+	promptID := string(prompt.request.Metadata.PromptID)
+	now := time.Now().UTC()
+	proxy := &providerProxySession{}
+	if err := proxy.activateWithMaxTurns(promptID, 1, now.Add(time.Minute), now); err != nil {
+		t.Fatal(err)
+	}
+	defer proxy.close()
+	if err := proxy.consumeInferenceRequest(promptID, providerRequestInference, now); err != nil {
+		t.Fatalf("first inference request: %v", err)
+	}
+	if err := proxy.consumeInferenceRequest(promptID, providerRequestInference, now); err != errProviderTurnLimitExceeded {
+		t.Fatalf("N+1 inference request error = %v, want %v", err, errProviderTurnLimitExceeded)
+	}
+	proxy.deactivate(promptID)
+
+	state := &sessionState{
+		descriptor: harnessv2.RuntimeSessionDescriptor{
+			RuntimeSessionUID: fence.RuntimeSessionUID,
+			Generation:        fence.RuntimeSessionGeneration,
+		},
+		operations:    make(map[harnessv2.OperationID]harnessv2.OperationRecord),
+		permissions:   make(map[harnessv2.PermissionRequestID]permissionState),
+		providerProxy: proxy,
+	}
+	adapterResult := acp.PromptResult{
+		Outcome: acp.PromptOutcomeCompleted, StopReason: acp.StopReasonEndTurn,
+		Accepted: true, SettledAt: now,
+	}
+	terminal, settledResult, err := server.terminalEvent(state, prompt, adapterResult)
+	if err != nil {
+		t.Fatalf("build turn-limit terminal event: %v", err)
+	}
+	if terminal.Type != harnessv2.EventFailed || terminal.Failed == nil ||
+		terminal.Failed.StopReason != harnessv2.ACPStopReasonMaxTurnRequests ||
+		terminal.Failed.Code != "turn_limit" || terminal.Failed.Retryable {
+		t.Fatalf("turn-limit terminal event = %#v", terminal)
+	}
+	if settledResult.Outcome != acp.PromptOutcomeFailed ||
+		settledResult.StopReason != acp.StopReasonMaxTurnRequests || !settledResult.Accepted {
+		t.Fatalf("turn-limit settled result = %#v", settledResult)
+	}
+
+	server.finishPrompt(state, prompt, settledResult, terminal.Identity.Timestamp)
+	if state.descriptor.State != harnessv2.RuntimeSessionStatePoisoned || prompt.settlement == nil ||
+		prompt.settlement.TerminalEvent != harnessv2.EventFailed ||
+		prompt.settlement.StopReason != harnessv2.ACPStopReasonMaxTurnRequests {
+		t.Fatalf("turn-limit settlement = state=%s settlement=%#v", state.descriptor.State, prompt.settlement)
+	}
+}
+
+func TestTerminalResultLimitIncludesFullSerializedEvent(t *testing.T) {
+	server, cfg, _ := newTestServer(t, "immediate")
+	fence := cfg.Fence
+	fence.RuntimeSessionUID = "session-uid"
+	fence.RuntimeSessionGeneration = 1
+	result := acp.PromptResult{
+		Outcome: acp.PromptOutcomeCompleted, StopReason: acp.StopReasonEndTurn,
+		Accepted: true, SettledAt: time.Date(2026, time.July, 25, 12, 0, 0, 0, time.UTC),
+	}
+	text := strings.Repeat("x", 512)
+	newStateAndPrompt := func() (*sessionState, *promptState) {
+		prompt := &promptState{request: testStartPromptRequest(t, cfg, fence)}
+		prompt.assistant.WriteString(text)
+		return &sessionState{
+			descriptor:  harnessv2.RuntimeSessionDescriptor{RuntimeSessionUID: fence.RuntimeSessionUID, Generation: fence.RuntimeSessionGeneration},
+			operations:  make(map[harnessv2.OperationID]harnessv2.OperationRecord),
+			permissions: make(map[harnessv2.PermissionRequestID]permissionState),
+		}, prompt
+	}
+
+	state, prompt := newStateAndPrompt()
+	prompt.sequence = 1
+	completed := server.buildTerminalEventLocked(state, prompt, result, result.SettledAt)
+	encodedCompleted, err := json.Marshal(completed)
+	if err != nil {
+		t.Fatal(err)
+	}
+	encodedPayload, err := json.Marshal(completed.Completed)
+	if err != nil {
+		t.Fatal(err)
+	}
+	limit := len(encodedCompleted) - 1
+	if len(encodedPayload) > limit {
+		t.Fatalf("test boundary does not isolate event overhead: payload=%d limit=%d event=%d", len(encodedPayload), limit, len(encodedCompleted))
+	}
+
+	state, prompt = newStateAndPrompt()
+	server.cfg.Capabilities.Limits.MaxTerminalResultBytes = limit
+	terminal, settledResult, err := server.terminalEvent(state, prompt, result)
+	if err != nil {
+		t.Fatalf("bounded terminal failure: %v", err)
+	}
+	if terminal.Type != harnessv2.EventFailed || terminal.Failed == nil || terminal.Failed.Code != "terminal_result_too_large" {
+		t.Fatalf("oversized terminal event = %#v", terminal)
+	}
+	encodedFailure, err := json.Marshal(terminal)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(encodedFailure) > limit {
+		t.Fatalf("bounded failure size = %d, limit %d", len(encodedFailure), limit)
+	}
+	server.finishPrompt(state, prompt, settledResult, terminal.Identity.Timestamp)
+	if state.descriptor.State != harnessv2.RuntimeSessionStatePoisoned || prompt.settlement == nil || prompt.settlement.TerminalEvent != harnessv2.EventFailed {
+		t.Fatalf("oversized terminal did not poison before validation: state=%s settlement=%#v", state.descriptor.State, prompt.settlement)
+	}
+
+	state, prompt = newStateAndPrompt()
+	server.cfg.Capabilities.Limits.MaxTerminalResultBytes = len(encodedCompleted)
+	terminal, settledResult, err = server.terminalEvent(state, prompt, result)
+	if err != nil {
+		t.Fatalf("exact-boundary terminal event: %v", err)
+	}
+	if terminal.Type != harnessv2.EventCompleted || settledResult.Outcome != acp.PromptOutcomeCompleted {
+		t.Fatalf("exact-boundary terminal event = %#v result=%#v", terminal, settledResult)
+	}
+	encodedExact, err := json.Marshal(terminal)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(encodedExact) != len(encodedCompleted) {
+		t.Fatalf("exact-boundary size = %d, want %d", len(encodedExact), len(encodedCompleted))
+	}
+}
+
+type blockingPromptMutator struct {
+	resolveCalls   atomic.Int32
+	resolveOnce    sync.Once
+	resolveEntered chan struct{}
+	resolveRelease chan struct{}
+	cancelCalls    atomic.Int32
+	cancelOnce     sync.Once
+	cancelEntered  chan struct{}
+	cancelRelease  chan struct{}
+	cancelResult   acp.PromptResult
+}
+
+func newBlockingPromptMutator() *blockingPromptMutator {
+	return &blockingPromptMutator{
+		resolveEntered: make(chan struct{}), resolveRelease: make(chan struct{}),
+		cancelEntered: make(chan struct{}), cancelRelease: make(chan struct{}),
+	}
+}
+
+func (m *blockingPromptMutator) ResolvePermission(string, string, acp.RequestPermissionOutcome) error {
+	m.resolveCalls.Add(1)
+	m.resolveOnce.Do(func() { close(m.resolveEntered) })
+	<-m.resolveRelease
+	return nil
+}
+
+func (m *blockingPromptMutator) CancelPrompt(context.Context, string) (acp.PromptResult, error) {
+	m.cancelCalls.Add(1)
+	m.cancelOnce.Do(func() { close(m.cancelEntered) })
+	<-m.cancelRelease
+	return m.cancelResult, nil
+}
+
+func serveMutationAsync(handler http.Handler, request *http.Request) <-chan *httptest.ResponseRecorder {
+	done := make(chan *httptest.ResponseRecorder, 1)
+	go func() {
+		recorder := httptest.NewRecorder()
+		handler.ServeHTTP(recorder, request)
+		done <- recorder
+	}()
+	return done
+}
+
+func awaitSignal(t *testing.T, signal <-chan struct{}, message string) {
+	t.Helper()
+	select {
+	case <-signal:
+	case <-time.After(5 * time.Second):
+		t.Fatal(message)
+	}
+}
+
+func assertStillWaiting(t *testing.T, done <-chan *httptest.ResponseRecorder, message string) {
+	t.Helper()
+	select {
+	case response := <-done:
+		t.Fatalf("%s: status=%d body=%s", message, response.Code, response.Body.String())
+	case <-time.After(50 * time.Millisecond):
+	}
+}
+
+func awaitRecorder(t *testing.T, done <-chan *httptest.ResponseRecorder, message string) *httptest.ResponseRecorder {
+	t.Helper()
+	select {
+	case response := <-done:
+		if response.Code != http.StatusOK {
+			t.Fatalf("%s: status=%d body=%s", message, response.Code, response.Body.String())
+		}
+		return response
+	case <-time.After(5 * time.Second):
+		t.Fatal(message)
+		return nil
+	}
+}
+
+func decodeResponse(t *testing.T, recorder *httptest.ResponseRecorder, target any) {
+	t.Helper()
+	if err := json.Unmarshal(recorder.Body.Bytes(), target); err != nil {
+		t.Fatalf("decode response: %v body=%s", err, recorder.Body.String())
+	}
+}
+
+func TestWorkspaceDeltaRepositoryControlPathAppliesWorkspaceRelativeRoot(t *testing.T) {
+	if !workspaceDeltaRepositoryControlPathForWorkspace(".github/workflows", "ci.yml") {
+		t.Fatal("workspace subpath change mapping to a repository-root workflow was allowed")
+	}
+	if workspaceDeltaRepositoryControlPathForWorkspace("website", ".github/workflows/ci.yml") {
+		t.Fatal("nested workflow-like path outside the repository root was denied")
+	}
+}
+
+func TestWorkspaceDeltaPathPolicy(t *testing.T) {
+	result := workspacedelta.Result{
+		Changes:   []workspacedelta.Change{{Path: "internal/controller/fix.go"}, {Path: "README.md"}},
+		Deletions: []workspacedelta.Deletion{{Path: "internal/old.go"}},
+	}
+	paths := workspaceDeltaChangedPaths(result)
+	if !slices.Equal(paths, []string{"README.md", "internal/controller/fix.go", "internal/old.go"}) {
+		t.Fatalf("changed paths = %#v", paths)
+	}
+	for _, allowed := range []string{"internal/**", "README.md"} {
+		if !workspaceDeltaPathAllowed(allowed, []string{"internal/**", "README.md"}) {
+			t.Fatalf("expected %q to be allowed", allowed)
+		}
+	}
+	if workspaceDeltaPathAllowed("website/sidebars.js", []string{"internal/**", "README.md"}) {
+		t.Fatal("unexpected disallowed path match")
+	}
+}
+
+func TestWorkspaceDeltaPathAllowedRecursiveGlobs(t *testing.T) {
+	allowed := []struct {
+		path     string
+		patterns []string
+	}{
+		// `**` must span multiple directory levels, gitignore-style.
+		{path: "src/pkg/util/helpers.go", patterns: []string{"src/**/*.go"}},
+		{path: "src/one.go", patterns: []string{"src/**/*.go"}},
+		{path: "main.go", patterns: []string{"**/*.go"}},
+		{path: "a/b/c/d.txt", patterns: []string{"a/**/d.txt"}},
+		{path: "a/d.txt", patterns: []string{"a/**/d.txt"}},
+		{path: "internal/deep/nested/file.go", patterns: []string{"internal/**"}},
+		{path: "docs/guide/intro.md", patterns: []string{"docs/*/intro.md"}},
+	}
+	for _, tt := range allowed {
+		if !workspaceDeltaPathAllowed(tt.path, tt.patterns) {
+			t.Errorf("expected %q to match %v", tt.path, tt.patterns)
+		}
+	}
+	denied := []struct {
+		path     string
+		patterns []string
+	}{
+		{path: "src/pkg/util/helpers.txt", patterns: []string{"src/**/*.go"}},
+		{path: "other/one.go", patterns: []string{"src/**/*.go"}},
+		{path: "docs/guide/deep/intro.md", patterns: []string{"docs/*/intro.md"}},
+		{path: "srcfile.go", patterns: []string{"src/**"}},
+	}
+	for _, tt := range denied {
+		if workspaceDeltaPathAllowed(tt.path, tt.patterns) {
+			t.Errorf("expected %q to not match %v", tt.path, tt.patterns)
+		}
+	}
+	// Multiple ** segments over a long non-matching path must complete without
+	// backtracking blowup.
+	hostile := strings.Repeat("a/", 512) + "z.txt"
+	if workspaceDeltaPathAllowed(hostile, []string{"**/b/**/c/**/d/**/e/**/*.go"}) {
+		t.Fatal("hostile path unexpectedly matched")
+	}
+	if !workspaceDeltaPathAllowed("a/x/b/y/c/z/d/w/e/final.go", []string{"a/**/b/**/c/**/d/**/e/**/*.go"}) {
+		t.Fatal("interleaved multi-star pattern failed to match")
+	}
+}
+
+func TestWorkspaceDeltaRejectsSessionCredentials(t *testing.T) {
+	state := &sessionState{
+		providerProxy: &providerProxySession{credential: []byte("provider-session-secret")},
+		mcpProxy:      &mcpProxySession{credential: []byte("mcp-session-secret")},
+	}
+	if !workspaceDeltaContainsSessionCredential([]byte("prefix provider-session-secret suffix"), state) {
+		t.Fatal("provider credential was not detected")
+	}
+	if !workspaceDeltaContainsSessionCredential([]byte("prefix mcp-session-secret suffix"), state) {
+		t.Fatal("MCP credential was not detected")
+	}
+	if workspaceDeltaContainsSessionCredential([]byte("safe workspace content"), state) {
+		t.Fatal("safe artifact was rejected")
+	}
+}
+
+func TestWorkspaceDeltaRepositoryControlAndContentPolicies(t *testing.T) {
+	for _, path := range []string{".github/workflows/ci.yml", "config/rbac/role.yaml", "charts/orka/templates/publisher-secret.yaml"} {
+		if !workspaceDeltaRepositoryControlPath(path) {
+			t.Fatalf("protected path %q was allowed", path)
+		}
+	}
+	if workspaceDeltaRepositoryControlPath("internal/controller/task.go") {
+		t.Fatal("ordinary source path was denied")
+	}
+
+	artifact := tarBytes(t, tarEntry{name: "files/config.txt", body: []byte("api_key=0123456789abcdef")})
+	violation, err := workspaceDeltaContentPolicyViolation(artifact, harnessv2.WorkspaceDeltaLimits{MaxBytes: 1 << 20, RejectSecretLikeContent: true})
+	if err != nil || !strings.Contains(violation, "secret-like") {
+		t.Fatalf("secret policy = %q, %v", violation, err)
+	}
+	artifact = tarBytes(t, tarEntry{name: "files/binary.bin", body: []byte{'a', 0, 'b'}})
+	violation, err = workspaceDeltaContentPolicyViolation(artifact, harnessv2.WorkspaceDeltaLimits{MaxBytes: 1 << 20, RejectBinaryFiles: true})
+	if err != nil || !strings.Contains(violation, "binary") {
+		t.Fatalf("binary policy = %q, %v", violation, err)
+	}
+	artifact = tarBytes(t, tarEntry{name: "meta/symlinks.json", body: []byte(`{"symlinks":[{"path":"link","target":"api_key=0123456789abcdef"}]}`)})
+	violation, err = workspaceDeltaContentPolicyViolation(artifact, harnessv2.WorkspaceDeltaLimits{MaxBytes: 1 << 20, RejectSecretLikeContent: true})
+	if err != nil || !strings.Contains(violation, "secret-like") {
+		t.Fatalf("symlink secret policy = %q, %v", violation, err)
+	}
+}
diff --git a/workers/acp/supervisor/provider_proxy.go b/workers/acp/supervisor/provider_proxy.go
new file mode 100644
index 000000000..1d23966e2
--- /dev/null
+++ b/workers/acp/supervisor/provider_proxy.go
@@ -0,0 +1,908 @@
+package supervisor
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"crypto/subtle"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"net/http"
+	"net/http/httptrace"
+	"net/url"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/orka-agents/orka/internal/providerproxy"
+)
+
+const (
+	providerProxyPathPrefix               = "/_orka/provider/"
+	providerProxyScheme                   = "http"
+	providerProxyTLSScheme                = "https"
+	providerAuthorizationHeader           = "Authorization"
+	providerAPIKeyHeader                  = "X-Api-Key"
+	providerLegacyAPIKeyHeader            = "Api-Key"
+	providerProxyAuthorizationHeader      = "Proxy-Authorization"
+	providerCookieHeader                  = "Cookie"
+	providerForwardedForHeader            = "X-Forwarded-For"
+	providerContentEncodingHeader         = "Content-Encoding"
+	providerOpenAIResponsesV1Path         = "/v1/responses"
+	providerOpenAIChatCompletionsPath     = "/chat/completions"
+	providerOpenAIChatCompletionsV1Path   = "/v1/chat/completions"
+	providerModelsV1Path                  = "/v1/models"
+	providerMaxTokensField                = "max_tokens"
+	providerMaxCompletionTokensField      = "max_completion_tokens"
+	providerReasoningEffortField          = "reasoning_effort"
+	providerToolsField                    = "tools"
+	providerVerbosityField                = "verbosity"
+	defaultProviderProxyMaxRequestBytes   = 32 << 20
+	defaultProviderProxyMaxResponseBytes  = 64 << 20
+	defaultProviderProxyHeaderTimeout     = 30 * time.Second
+	defaultProviderProxyReadHeaderTimeout = 5 * time.Second
+	defaultProviderProxyReadTimeout       = 30 * time.Second
+	defaultProviderProxySessionRequests   = 2
+	defaultProviderProxyGlobalRequests    = 8
+)
+
+type ProviderProxyConfig struct {
+	UpstreamBaseURL       string
+	UpstreamBearerToken   string
+	ProviderKind          string
+	Model                 string
+	MaxRequestBytes       int64
+	MaxResponseBytes      int64
+	ResponseHeaderTimeout time.Duration
+	ModelOutputLimit      int64
+}
+
+type ProviderProxyBinding struct {
+	BaseURL    string
+	Credential string
+}
+
+func (b ProviderProxyBinding) String() string {
+	return fmt.Sprintf("{BaseURL:%q Credential:[redacted]}", b.BaseURL)
+}
+
+func (b ProviderProxyBinding) GoString() string { return b.String() }
+
+func (c ProviderProxyConfig) String() string {
+	return fmt.Sprintf("{UpstreamBaseURL:%q UpstreamBearerToken:[redacted] MaxRequestBytes:%d MaxResponseBytes:%d ResponseHeaderTimeout:%s}", c.UpstreamBaseURL, c.MaxRequestBytes, c.MaxResponseBytes, c.ResponseHeaderTimeout)
+}
+
+func (c ProviderProxyConfig) GoString() string { return c.String() }
+
+type providerProxy struct {
+	upstreamBase     *url.URL
+	upstreamToken    []byte
+	providerKind     string
+	model            string
+	maxRequestBytes  int64
+	maxResponseBytes int64
+	modelOutputLimit int64
+	client           *http.Client
+	listener         net.Listener
+	server           *http.Server
+	requestSlots     chan struct{}
+
+	mu        sync.RWMutex
+	sessions  map[string]*providerProxySession
+	closed    bool
+	closeDone chan struct{}
+	closeErr  error
+}
+
+type providerProxySession struct {
+	proxy      *providerProxy
+	route      string
+	credential []byte
+	baseURL    string
+	basePath   string
+
+	mu                sync.Mutex
+	activePromptID    string
+	leaseExpiresAt    time.Time
+	leaseVersion      uint64
+	leaseTimer        *time.Timer
+	gateContext       context.Context
+	gateCancel        context.CancelFunc
+	turnPromptID      string
+	maxTurns          int32
+	inferenceRequests int32
+	turnLimitExceeded bool
+	inflight          int
+	drained           chan struct{}
+	closed            bool
+	requestSlots      chan struct{}
+}
+
+type providerProxyAuthorization struct {
+	upstreamBase *url.URL
+	gateContext  context.Context
+	promptID     string
+	release      func()
+}
+
+type providerRequestClass uint8
+
+const (
+	providerRequestMetadata providerRequestClass = iota
+	providerRequestInference
+)
+
+var errProviderTurnLimitExceeded = errors.New("provider inference request limit exceeded")
+
+func (c ProviderProxyConfig) normalized() (ProviderProxyConfig, *url.URL, error) {
+	parsed, err := url.Parse(strings.TrimSpace(c.UpstreamBaseURL))
+	if err != nil ||
+		(parsed.Scheme != providerProxyScheme && parsed.Scheme != providerProxyTLSScheme) ||
+		parsed.Host == "" || parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" {
+		return ProviderProxyConfig{}, nil, fmt.Errorf("provider proxy upstream URL is invalid")
+	}
+	if parsed.Path == "" {
+		parsed.Path = "/"
+	}
+	if strings.TrimSpace(c.UpstreamBearerToken) == "" {
+		return ProviderProxyConfig{}, nil, fmt.Errorf("provider proxy upstream bearer token is required")
+	}
+	c.ProviderKind = strings.TrimSpace(c.ProviderKind)
+	c.Model = strings.TrimSpace(c.Model)
+	if c.ProviderKind == "" || c.Model == "" {
+		return ProviderProxyConfig{}, nil, fmt.Errorf("provider proxy kind and model are required")
+	}
+	c.UpstreamBaseURL = parsed.String()
+	c.UpstreamBearerToken = normalizeBearerToken(c.UpstreamBearerToken)
+	if c.UpstreamBearerToken == "" || strings.IndexFunc(c.UpstreamBearerToken, func(value rune) bool { return value <= ' ' || value == 0x7f }) >= 0 {
+		return ProviderProxyConfig{}, nil, fmt.Errorf("provider proxy upstream bearer token is required")
+	}
+	if providerproxy.HasUnsafePathSegment(parsed.Path) {
+		return ProviderProxyConfig{}, nil, fmt.Errorf("provider proxy upstream URL is invalid")
+	}
+	if c.MaxRequestBytes <= 0 {
+		c.MaxRequestBytes = defaultProviderProxyMaxRequestBytes
+	}
+	if c.MaxResponseBytes <= 0 {
+		c.MaxResponseBytes = defaultProviderProxyMaxResponseBytes
+	}
+	if c.ResponseHeaderTimeout <= 0 {
+		c.ResponseHeaderTimeout = defaultProviderProxyHeaderTimeout
+	}
+	if c.ModelOutputLimit < 0 {
+		return ProviderProxyConfig{}, nil, fmt.Errorf("provider proxy model output limit must be positive")
+	}
+	if c.ProviderKind == providerKindOpencode && c.ModelOutputLimit == 0 {
+		return ProviderProxyConfig{}, nil, fmt.Errorf("OpenCode provider proxy model output limit is required")
+	}
+	return c, parsed, nil
+}
+
+func normalizeBearerToken(value string) string {
+	value = strings.TrimSpace(value)
+	if len(value) >= len("Bearer ") && strings.EqualFold(value[:len("Bearer ")], "Bearer ") {
+		return strings.TrimSpace(value[len("Bearer "):])
+	}
+	return value
+}
+
+func newProviderProxy(cfg ProviderProxyConfig) (*providerProxy, error) {
+	normalized, upstream, err := cfg.normalized()
+	if err != nil {
+		return nil, err
+	}
+	listener, err := net.Listen("tcp4", "127.0.0.1:0")
+	if err != nil {
+		return nil, fmt.Errorf("listen on provider proxy loopback: %w", err)
+	}
+	transport := &http.Transport{
+		Proxy:       nil,
+		DialContext: (&net.Dialer{Timeout: 10 * time.Second, KeepAlive: 30 * time.Second}).DialContext,
+		// A provider request owns its upstream connection so revoking one
+		// session lease cannot interfere with another session sharing an HTTP/2
+		// connection, and cancellation can close the exact request transport.
+		ForceAttemptHTTP2:      false,
+		DisableKeepAlives:      true,
+		MaxIdleConns:           16,
+		MaxIdleConnsPerHost:    8,
+		IdleConnTimeout:        90 * time.Second,
+		TLSHandshakeTimeout:    10 * time.Second,
+		ResponseHeaderTimeout:  normalized.ResponseHeaderTimeout,
+		ExpectContinueTimeout:  time.Second,
+		MaxResponseHeaderBytes: 64 << 10,
+		DisableCompression:     true,
+	}
+	proxy := &providerProxy{
+		upstreamBase:     upstream,
+		upstreamToken:    []byte(normalized.UpstreamBearerToken),
+		providerKind:     normalized.ProviderKind,
+		model:            normalized.Model,
+		maxRequestBytes:  normalized.MaxRequestBytes,
+		maxResponseBytes: normalized.MaxResponseBytes,
+		modelOutputLimit: normalized.ModelOutputLimit,
+		client: &http.Client{
+			Transport:     transport,
+			CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse },
+		},
+		listener:     listener,
+		sessions:     make(map[string]*providerProxySession),
+		requestSlots: make(chan struct{}, defaultProviderProxyGlobalRequests),
+	}
+	proxy.server = &http.Server{
+		Handler:           http.HandlerFunc(proxy.serveHTTP),
+		ErrorLog:          log.New(io.Discard, "", 0),
+		ReadHeaderTimeout: defaultProviderProxyReadHeaderTimeout,
+		ReadTimeout:       defaultProviderProxyReadTimeout,
+		IdleTimeout:       30 * time.Second,
+		MaxHeaderBytes:    32 << 10,
+	}
+	go func() {
+		_ = proxy.server.Serve(listener)
+	}()
+	return proxy, nil
+}
+
+func (p *providerProxy) newSession() (*providerProxySession, ProviderProxyBinding, error) {
+	if p == nil {
+		return nil, ProviderProxyBinding{}, fmt.Errorf("provider proxy is required")
+	}
+	credential, err := randomProxySecret(32)
+	if err != nil {
+		return nil, ProviderProxyBinding{}, err
+	}
+	for range 8 {
+		route, routeErr := randomProxySecret(24)
+		if routeErr != nil {
+			return nil, ProviderProxyBinding{}, routeErr
+		}
+		p.mu.Lock()
+		if p.closed {
+			p.mu.Unlock()
+			return nil, ProviderProxyBinding{}, fmt.Errorf("provider proxy is closed")
+		}
+		if _, exists := p.sessions[route]; exists {
+			p.mu.Unlock()
+			continue
+		}
+		basePath := providerProxyPathPrefix + route
+		if upstreamPath := strings.TrimSuffix(p.upstreamBase.Path, "/"); upstreamPath != "" {
+			basePath += upstreamPath
+		}
+		baseURL := providerProxyScheme + "://" + p.listener.Addr().String() + basePath
+		drained := make(chan struct{})
+		close(drained)
+		session := &providerProxySession{
+			proxy:        p,
+			route:        route,
+			credential:   []byte(credential),
+			baseURL:      baseURL,
+			basePath:     basePath,
+			drained:      drained,
+			requestSlots: make(chan struct{}, defaultProviderProxySessionRequests),
+		}
+		p.sessions[route] = session
+		p.mu.Unlock()
+		return session, ProviderProxyBinding{BaseURL: baseURL, Credential: credential}, nil
+	}
+	return nil, ProviderProxyBinding{}, fmt.Errorf("allocate unique provider proxy route")
+}
+
+func randomProxySecret(size int) (string, error) {
+	if size < 16 {
+		return "", fmt.Errorf("provider proxy secret size is too small")
+	}
+	data := make([]byte, size)
+	if _, err := rand.Read(data); err != nil {
+		return "", fmt.Errorf("generate provider proxy secret: %w", err)
+	}
+	return base64.RawURLEncoding.EncodeToString(data), nil
+}
+
+func (s *providerProxySession) activate(promptID string, expiresAt, now time.Time) error {
+	return s.activateWithMaxTurns(promptID, 50, expiresAt, now)
+}
+
+func (s *providerProxySession) activateWithMaxTurns(promptID string, maxTurns int32, expiresAt, now time.Time) error {
+	promptID = strings.TrimSpace(promptID)
+	if promptID == "" || maxTurns <= 0 || !expiresAt.After(now) {
+		return fmt.Errorf("active prompt identity, positive max turns, and future lease expiry are required")
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.closed {
+		return fmt.Errorf("provider proxy session is closed")
+	}
+	if s.activePromptID != "" {
+		return fmt.Errorf("provider proxy session already has an active prompt")
+	}
+	s.activePromptID = promptID
+	s.leaseExpiresAt = expiresAt
+	s.turnPromptID = promptID
+	s.maxTurns = maxTurns
+	s.inferenceRequests = 0
+	s.turnLimitExceeded = false
+	s.leaseVersion++
+	version := s.leaseVersion
+	s.gateContext, s.gateCancel = context.WithCancel(context.Background())
+	s.leaseTimer = time.AfterFunc(time.Until(expiresAt), func() {
+		s.expire(promptID, version)
+	})
+	return nil
+}
+
+func (s *providerProxySession) renew(promptID string, expiresAt, now time.Time) error {
+	if !expiresAt.After(now) {
+		return fmt.Errorf("provider proxy lease expiry must be in the future")
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.closed || s.activePromptID != promptID || s.gateCancel == nil || !now.Before(s.leaseExpiresAt) {
+		return fmt.Errorf("provider proxy prompt lease is no longer active")
+	}
+	s.leaseExpiresAt = expiresAt
+	s.leaseVersion++
+	version := s.leaseVersion
+	if s.leaseTimer != nil {
+		s.leaseTimer.Stop()
+	}
+	s.leaseTimer = time.AfterFunc(time.Until(expiresAt), func() {
+		s.expire(promptID, version)
+	})
+	return nil
+}
+
+func (s *providerProxySession) deactivate(promptID string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.activePromptID != promptID {
+		return
+	}
+	s.revokeLocked()
+}
+
+func (s *providerProxySession) revoke() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.revokeLocked()
+}
+
+func (s *providerProxySession) revokeLocked() {
+	if s.leaseTimer != nil {
+		s.leaseTimer.Stop()
+		s.leaseTimer = nil
+	}
+	if s.gateCancel != nil {
+		s.gateCancel()
+		s.gateCancel = nil
+	}
+	s.gateContext = nil
+	s.activePromptID = ""
+	s.leaseExpiresAt = time.Time{}
+	s.leaseVersion++
+}
+
+func (s *providerProxySession) expire(promptID string, version uint64) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.closed || s.activePromptID != promptID || s.leaseVersion != version {
+		return
+	}
+	if remaining := time.Until(s.leaseExpiresAt); remaining > 0 {
+		s.leaseTimer = time.AfterFunc(remaining, func() { s.expire(promptID, version) })
+		return
+	}
+	s.revokeLocked()
+}
+
+func (s *providerProxySession) close() {
+	if s == nil {
+		return
+	}
+	s.mu.Lock()
+	if s.closed {
+		s.mu.Unlock()
+		return
+	}
+	s.closed = true
+	s.revokeLocked()
+	for i := range s.credential {
+		s.credential[i] = 0
+	}
+	s.mu.Unlock()
+	if s.proxy != nil {
+		s.proxy.mu.Lock()
+		if s.proxy.sessions[s.route] == s {
+			delete(s.proxy.sessions, s.route)
+		}
+		s.proxy.mu.Unlock()
+	}
+}
+
+func (s *providerProxySession) wait(ctx context.Context) error {
+	if s == nil {
+		return nil
+	}
+	s.mu.Lock()
+	drained := s.drained
+	s.mu.Unlock()
+	select {
+	case <-drained:
+		return nil
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}
+
+func (s *providerProxySession) authorize(r *http.Request, now time.Time) (providerProxyAuthorization, bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.closed || s.activePromptID == "" || s.gateContext == nil || !now.Before(s.leaseExpiresAt) {
+		if s.activePromptID != "" && !now.Before(s.leaseExpiresAt) {
+			s.revokeLocked()
+		}
+		return providerProxyAuthorization{}, false
+	}
+	if !requestHasCredential(r, s.credential) {
+		return providerProxyAuthorization{}, false
+	}
+	if s.inflight == 0 {
+		s.drained = make(chan struct{})
+	}
+	s.inflight++
+	var releaseOnce sync.Once
+	target := *s.proxy.upstreamBase
+	return providerProxyAuthorization{
+		upstreamBase: &target,
+		gateContext:  s.gateContext,
+		promptID:     s.activePromptID,
+		release: func() {
+			releaseOnce.Do(s.releaseRequest)
+		},
+	}, true
+}
+
+func (s *providerProxySession) releaseRequest() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.inflight <= 0 {
+		return
+	}
+	s.inflight--
+	if s.inflight == 0 {
+		close(s.drained)
+	}
+}
+
+func (s *providerProxySession) consumeInferenceRequest(promptID string, class providerRequestClass, now time.Time) error {
+	if class != providerRequestInference {
+		return nil
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.closed || s.activePromptID != promptID || s.gateContext == nil || !now.Before(s.leaseExpiresAt) {
+		return context.Canceled
+	}
+	if s.inferenceRequests >= s.maxTurns {
+		s.turnLimitExceeded = true
+		return errProviderTurnLimitExceeded
+	}
+	s.inferenceRequests++
+	return nil
+}
+
+func (s *providerProxySession) maxTurnsExceeded(promptID string) bool {
+	if s == nil {
+		return false
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.turnPromptID == strings.TrimSpace(promptID) && s.turnLimitExceeded
+}
+
+func requestHasCredential(r *http.Request, expected []byte) bool {
+	for _, value := range r.Header.Values(providerAuthorizationHeader) {
+		value = strings.TrimSpace(value)
+		if len(value) < len("Bearer ") || !strings.EqualFold(value[:len("Bearer ")], "Bearer ") {
+			continue
+		}
+		if constantTimeStringMatch(strings.TrimSpace(value[len("Bearer "):]), expected) {
+			return true
+		}
+	}
+	for _, name := range []string{providerAPIKeyHeader, providerLegacyAPIKeyHeader} {
+		for _, value := range r.Header.Values(name) {
+			if constantTimeStringMatch(strings.TrimSpace(value), expected) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func constantTimeStringMatch(value string, expected []byte) bool {
+	if len(value) != len(expected) {
+		return false
+	}
+	return subtle.ConstantTimeCompare([]byte(value), expected) == 1
+}
+
+func (p *providerProxy) serveHTTP(w http.ResponseWriter, r *http.Request) {
+	route, ok := splitProviderProxyRoute(r.URL.Path)
+	if !ok {
+		http.NotFound(w, r)
+		return
+	}
+	p.mu.RLock()
+	session := p.sessions[route]
+	p.mu.RUnlock()
+	if session == nil {
+		http.NotFound(w, r)
+		return
+	}
+	suffix, ok := session.requestSuffix(r.URL.Path)
+	if !ok {
+		http.NotFound(w, r)
+		return
+	}
+	authorization, ok := session.authorize(r, time.Now().UTC())
+	if !ok {
+		providerproxy.WriteError(w, http.StatusForbidden, "provider access is not active")
+		return
+	}
+	defer authorization.release()
+	if !providerproxy.TryAcquireSlot(session.requestSlots) {
+		providerproxy.WriteError(w, http.StatusTooManyRequests, "provider session request capacity is exhausted")
+		return
+	}
+	defer providerproxy.ReleaseSlot(session.requestSlots)
+	if !providerproxy.TryAcquireSlot(p.requestSlots) {
+		providerproxy.WriteError(w, http.StatusTooManyRequests, "provider proxy request capacity is exhausted")
+		return
+	}
+	defer providerproxy.ReleaseSlot(p.requestSlots)
+	if r.Method == http.MethodConnect || r.Method == http.MethodTrace {
+		providerproxy.WriteError(w, http.StatusMethodNotAllowed, "provider request method is not allowed")
+		return
+	}
+	if providerproxy.HasUnsafePathSegment(suffix) {
+		providerproxy.WriteError(w, http.StatusBadRequest, "provider request path is invalid")
+		return
+	}
+	if providerproxy.HasDisallowedContentEncoding(r.Header) {
+		providerproxy.WriteError(w, http.StatusUnsupportedMediaType, "compressed provider requests are forbidden")
+		return
+	}
+
+	requestContext, cancel := context.WithCancel(r.Context())
+	stopGate := context.AfterFunc(authorization.gateContext, cancel)
+	stopBody := context.AfterFunc(authorization.gateContext, func() { _ = r.Body.Close() })
+	var connectionMu sync.Mutex
+	var upstreamConnection net.Conn
+	connectionRevoked := false
+	closeUpstreamConnection := func() {
+		connectionMu.Lock()
+		connectionRevoked = true
+		if upstreamConnection != nil {
+			_ = upstreamConnection.Close()
+		}
+		connectionMu.Unlock()
+	}
+	stopConnection := context.AfterFunc(authorization.gateContext, closeUpstreamConnection)
+	defer func() {
+		stopGate()
+		stopBody()
+		stopConnection()
+		cancel()
+	}()
+	body, err := readBoundedProviderBody(requestContext, r.Body, p.maxRequestBytes)
+	if err != nil {
+		if errors.Is(err, errProviderBodyTooLarge) {
+			providerproxy.WriteError(w, http.StatusRequestEntityTooLarge, "provider request body exceeds limit")
+		} else {
+			providerproxy.WriteError(w, http.StatusForbidden, "provider request is no longer active")
+		}
+		return
+	}
+	requestClass, err := validateProviderRequest(p.providerKind, p.model, suffix, r.Method, body)
+	if err != nil {
+		providerproxy.WriteError(w, http.StatusForbidden, "provider request is outside the immutable profile")
+		return
+	}
+	body, err = normalizeProviderRequestBody(p.providerKind, p.model, suffix, p.modelOutputLimit, body)
+	if err != nil {
+		providerproxy.WriteError(w, http.StatusForbidden, "provider request is outside the immutable profile")
+		return
+	}
+	select {
+	case <-authorization.gateContext.Done():
+		providerproxy.WriteError(w, http.StatusForbidden, "provider request is no longer active")
+		return
+	default:
+	}
+	if err := session.consumeInferenceRequest(authorization.promptID, requestClass, time.Now().UTC()); err != nil {
+		if errors.Is(err, errProviderTurnLimitExceeded) {
+			writeProviderTurnLimitError(w, p.providerKind)
+		} else {
+			providerproxy.WriteError(w, http.StatusForbidden, "provider request is no longer active")
+		}
+		return
+	}
+
+	requestContext = httptrace.WithClientTrace(requestContext, &httptrace.ClientTrace{GotConn: func(info httptrace.GotConnInfo) {
+		connectionMu.Lock()
+		upstreamConnection = info.Conn
+		if connectionRevoked {
+			_ = info.Conn.Close()
+		}
+		connectionMu.Unlock()
+	}})
+	target := providerproxy.Target(authorization.upstreamBase, suffix, r.URL.RawQuery)
+	upstreamRequest, err := http.NewRequestWithContext(requestContext, r.Method, target.String(), bytes.NewReader(body))
+	if err != nil {
+		providerproxy.WriteError(w, http.StatusBadGateway, "provider request could not be prepared")
+		return
+	}
+	providerproxy.CopyRequestHeaders(upstreamRequest.Header, r.Header)
+	upstreamRequest.Header.Set(providerAuthorizationHeader, "Bearer "+string(p.upstreamToken))
+	upstreamRequest.Header.Set("Accept-Encoding", "identity")
+
+	response, err := p.client.Do(upstreamRequest)
+	if err != nil {
+		providerproxy.WriteError(w, http.StatusBadGateway, "provider upstream request failed")
+		return
+	}
+	defer response.Body.Close() //nolint:errcheck
+	if response.StatusCode >= http.StatusMultipleChoices && response.StatusCode < http.StatusBadRequest {
+		providerproxy.WriteError(w, http.StatusBadGateway, "provider upstream redirects are forbidden")
+		return
+	}
+	if providerproxy.HasDisallowedContentEncoding(response.Header) {
+		providerproxy.WriteError(w, http.StatusBadGateway, "compressed provider responses are forbidden")
+		return
+	}
+	if response.ContentLength > p.maxResponseBytes {
+		providerproxy.WriteError(w, http.StatusBadGateway, "provider upstream response exceeds limit")
+		return
+	}
+	providerproxy.CopyResponseHeaders(w.Header(), response.Header)
+	w.WriteHeader(response.StatusCode)
+	// Flushing after every chunk keeps streamed provider responses (SSE)
+	// flowing to the ACP child without buffering delays.
+	flusher, _ := w.(http.Flusher)
+	if err := providerproxy.StreamBoundedResponse(w, response.Body, p.maxResponseBytes, flusher); err != nil {
+		panic(http.ErrAbortHandler)
+	}
+}
+
+func normalizeProviderRequestBody(providerKind, model, requestPath string, modelOutputLimit int64, body []byte) ([]byte, error) {
+	if providerKind != providerKindOpencode ||
+		(requestPath != providerOpenAIChatCompletionsPath && requestPath != providerOpenAIChatCompletionsV1Path) {
+		return body, nil
+	}
+	decoder := json.NewDecoder(bytes.NewReader(body))
+	decoder.UseNumber()
+	var payload map[string]any
+	if err := decoder.Decode(&payload); err != nil {
+		return nil, fmt.Errorf("decode OpenCode provider request: %w", err)
+	}
+	if err := ensureProviderJSONEOF(decoder); err != nil {
+		return nil, err
+	}
+	if modelOutputLimit <= 0 {
+		return nil, fmt.Errorf("OpenCode model output limit is required")
+	}
+	providerID, upstreamModel, ok := strings.Cut(model, "/")
+	providerID = strings.TrimSpace(providerID)
+	upstreamModel = strings.TrimSpace(upstreamModel)
+	if !ok || providerID == "" || upstreamModel == "" {
+		return nil, fmt.Errorf("OpenCode model must use provider/model form")
+	}
+	maxTokens, hasMaxTokens, err := positiveProviderOutputLimit(payload, providerMaxTokensField)
+	if err != nil {
+		return nil, err
+	}
+	maxCompletionTokens, hasMaxCompletionTokens, err := positiveProviderOutputLimit(payload, providerMaxCompletionTokensField)
+	if err != nil {
+		return nil, err
+	}
+	outputLimit := modelOutputLimit
+	outputField := providerMaxTokensField
+	if strings.EqualFold(providerID, "openai") {
+		outputField = providerMaxCompletionTokensField
+		delete(payload, providerVerbosityField)
+		if tools, ok := payload[providerToolsField].([]any); ok && len(tools) > 0 {
+			delete(payload, providerReasoningEffortField)
+		}
+	}
+	if hasMaxTokens && maxTokens < outputLimit {
+		outputLimit = maxTokens
+	}
+	if hasMaxCompletionTokens {
+		outputField = providerMaxCompletionTokensField
+		if maxCompletionTokens < outputLimit {
+			outputLimit = maxCompletionTokens
+		}
+	}
+	delete(payload, providerMaxTokensField)
+	delete(payload, providerMaxCompletionTokensField)
+	payload[outputField] = outputLimit
+	payload["model"] = upstreamModel
+	return json.Marshal(payload)
+}
+
+func positiveProviderOutputLimit(payload map[string]any, name string) (int64, bool, error) {
+	value, ok := payload[name]
+	if !ok {
+		return 0, false, nil
+	}
+	number, ok := value.(json.Number)
+	if !ok {
+		return 0, false, fmt.Errorf("OpenCode %s must be a positive integer", name)
+	}
+	parsed, err := strconv.ParseInt(string(number), 10, 64)
+	if err != nil || parsed <= 0 {
+		return 0, false, fmt.Errorf("OpenCode %s must be a positive integer", name)
+	}
+	return parsed, true, nil
+}
+
+func ensureProviderJSONEOF(decoder *json.Decoder) error {
+	var extra any
+	err := decoder.Decode(&extra)
+	if errors.Is(err, io.EOF) {
+		return nil
+	}
+	if err == nil {
+		return fmt.Errorf("provider request contains trailing JSON data")
+	}
+	return fmt.Errorf("decode provider request trailer: %w", err)
+}
+
+func validateProviderRequest(providerKind, model, requestPath, method string, body []byte) (providerRequestClass, error) {
+	allowed := false
+	requiresModel := false
+	class := providerRequestMetadata
+	switch providerKind {
+	case providerKindCodex, providerKindCopilot:
+		switch requestPath {
+		case "/responses", providerOpenAIResponsesV1Path, "/responses/compact", "/v1/responses/compact", providerOpenAIChatCompletionsPath, providerOpenAIChatCompletionsV1Path:
+			allowed, requiresModel, class = method == http.MethodPost, true, providerRequestInference
+		case "/models", providerModelsV1Path:
+			allowed = method == http.MethodGet
+		}
+	case providerKindOpencode:
+		switch requestPath {
+		case providerOpenAIChatCompletionsPath, providerOpenAIChatCompletionsV1Path:
+			allowed, requiresModel, class = method == http.MethodPost, true, providerRequestInference
+		}
+	case "claude":
+		switch requestPath {
+		case "/v1/messages":
+			allowed, requiresModel, class = method == http.MethodPost, true, providerRequestInference
+		case "/v1/messages/count_tokens":
+			allowed, requiresModel = method == http.MethodPost, true
+		case providerModelsV1Path:
+			allowed = method == http.MethodGet
+		}
+	}
+	if !allowed {
+		return providerRequestMetadata, fmt.Errorf("provider path or method is not allowed")
+	}
+	if !requiresModel {
+		return class, nil
+	}
+	var envelope struct {
+		Model string `json:"model"`
+	}
+	if err := json.Unmarshal(body, &envelope); err != nil || strings.TrimSpace(envelope.Model) != model {
+		return providerRequestMetadata, fmt.Errorf("provider model does not match immutable profile")
+	}
+	return class, nil
+}
+
+var errProviderBodyTooLarge = errors.New("provider body too large")
+
+func readBoundedProviderBody(ctx context.Context, body io.ReadCloser, limit int64) ([]byte, error) {
+	defer body.Close() //nolint:errcheck
+	data, err := io.ReadAll(io.LimitReader(body, limit+1))
+	if err != nil {
+		return nil, err
+	}
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	default:
+	}
+	if int64(len(data)) > limit {
+		return nil, errProviderBodyTooLarge
+	}
+	return data, nil
+}
+
+func splitProviderProxyRoute(path string) (route string, ok bool) {
+	if !strings.HasPrefix(path, providerProxyPathPrefix) {
+		return "", false
+	}
+	remainder := strings.TrimPrefix(path, providerProxyPathPrefix)
+	route, _, _ = strings.Cut(remainder, "/")
+	if route == "" {
+		return "", false
+	}
+	return route, true
+}
+
+func (s *providerProxySession) requestSuffix(path string) (string, bool) {
+	if path == s.basePath {
+		return "/", true
+	}
+	if !strings.HasPrefix(path, s.basePath+"/") {
+		return "", false
+	}
+	return strings.TrimPrefix(path, s.basePath), true
+}
+
+func writeProviderTurnLimitError(w http.ResponseWriter, providerKind string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Cache-Control", "no-store")
+	w.WriteHeader(http.StatusBadRequest)
+	if providerKind == providerKindClaude {
+		_, _ = io.WriteString(w, `{"type":"error","error":{"type":"invalid_request_error","message":"maximum provider inference requests reached for active prompt"}}`+"\n")
+		return
+	}
+	_, _ = io.WriteString(w, `{"error":{"message":"maximum provider inference requests reached for active prompt","type":"invalid_request_error","code":"max_turn_requests"}}`+"\n")
+}
+
+func (p *providerProxy) close(ctx context.Context) error {
+	if p == nil {
+		return nil
+	}
+	p.mu.Lock()
+	if p.closeDone != nil {
+		done := p.closeDone
+		p.mu.Unlock()
+		select {
+		case <-done:
+			p.mu.RLock()
+			err := p.closeErr
+			p.mu.RUnlock()
+			return err
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+	}
+	p.closed = true
+	p.closeDone = make(chan struct{})
+	done := p.closeDone
+	sessions := make([]*providerProxySession, 0, len(p.sessions))
+	for _, session := range p.sessions {
+		sessions = append(sessions, session)
+	}
+	p.mu.Unlock()
+	for _, session := range sessions {
+		session.close()
+	}
+	var errs []error
+	for _, session := range sessions {
+		if err := session.wait(ctx); err != nil {
+			errs = append(errs, fmt.Errorf("wait for provider proxy session requests: %w", err))
+		}
+	}
+	if err := p.server.Shutdown(ctx); err != nil {
+		errs = append(errs, err, p.server.Close())
+	}
+	if transport, ok := p.client.Transport.(*http.Transport); ok {
+		transport.CloseIdleConnections()
+	}
+	closeErr := errors.Join(errs...)
+	p.mu.Lock()
+	p.closeErr = closeErr
+	close(done)
+	p.mu.Unlock()
+	return closeErr
+}
diff --git a/workers/acp/supervisor/provider_proxy_test.go b/workers/acp/supervisor/provider_proxy_test.go
new file mode 100644
index 000000000..45937af81
--- /dev/null
+++ b/workers/acp/supervisor/provider_proxy_test.go
@@ -0,0 +1,833 @@
+package supervisor
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+const (
+	testUpstreamToken          = "upstream-token"
+	testConnectionSecretHeader = "X-Connection-Secret"
+)
+
+func TestProviderProxyConfigValidationAndRedaction(t *testing.T) {
+	const secret = "do-not-print-this-provider-token"
+	cfg := ProviderProxyConfig{UpstreamBaseURL: "http://vekil.example/v1", UpstreamBearerToken: secret}
+	if rendered := fmt.Sprintf("%#v", cfg); strings.Contains(rendered, secret) {
+		t.Fatalf("provider proxy config formatting leaked its bearer token: %s", rendered)
+	}
+	binding := ProviderProxyBinding{BaseURL: "http://127.0.0.1/private", Credential: secret}
+	if rendered := fmt.Sprintf("%#v", binding); strings.Contains(rendered, secret) {
+		t.Fatalf("provider proxy binding formatting leaked its local credential: %s", rendered)
+	}
+	for _, invalid := range []ProviderProxyConfig{
+		{UpstreamBaseURL: "http://vekil.example/v1?token=query", UpstreamBearerToken: secret},
+		{UpstreamBaseURL: "http://vekil.example/../admin", UpstreamBearerToken: secret},
+		{UpstreamBaseURL: "http://vekil.example/v1", UpstreamBearerToken: "bad\nheader"},
+	} {
+		if _, _, err := invalid.normalized(); err == nil {
+			t.Fatalf("unsafe provider proxy config unexpectedly validated: %#v", invalid)
+		}
+	}
+}
+
+func TestProviderProxyGatesSessionsAndInjectsSupervisorBearer(t *testing.T) {
+	const upstreamToken = "supervisor-upstream-token-canary"
+	type observedRequest struct {
+		method string
+		path   string
+		query  string
+		header http.Header
+		body   string
+	}
+	observed := make(chan observedRequest, 1)
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		body, _ := io.ReadAll(r.Body)
+		observed <- observedRequest{method: r.Method, path: r.URL.Path, query: r.URL.RawQuery, header: r.Header.Clone(), body: string(body)}
+		w.Header().Set("Content-Type", "application/json")
+		w.Header().Set("X-Upstream-Safe", "yes")
+		w.Header().Set("Set-Cookie", "upstream-secret=1")
+		_, _ = io.WriteString(w, `{"ok":true}`)
+	}))
+	defer upstream.Close()
+
+	proxy := newTestProviderProxy(t, ProviderProxyConfig{
+		UpstreamBaseURL: upstream.URL + "/v1", UpstreamBearerToken: upstreamToken,
+		MaxRequestBytes: 1 << 20, MaxResponseBytes: 1 << 20,
+	})
+	session, binding, err := proxy.newSession()
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, secondBinding, err := proxy.newSession()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if binding.BaseURL == secondBinding.BaseURL || binding.Credential == secondBinding.Credential {
+		t.Fatal("runtime sessions reused a provider proxy route or credential")
+	}
+	cleanupNow := time.Now().UTC()
+	if err := second.activate("cleanup-prompt", cleanupNow.Add(time.Minute), cleanupNow); err != nil {
+		t.Fatal(err)
+	}
+	second.close()
+	assertProviderProxyStatus(t, secondBinding.BaseURL+"/responses", secondBinding.Credential, http.StatusNotFound)
+	parsed, err := url.Parse(binding.BaseURL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if parsed.Scheme != providerProxyScheme || parsed.Hostname() != "127.0.0.1" || !strings.HasPrefix(parsed.Path, providerProxyPathPrefix) || len(binding.Credential) < 40 {
+		t.Fatalf("provider proxy binding is not private and unguessable: %#v", binding)
+	}
+
+	response := doProviderProxyRequest(t, http.MethodPost, binding.BaseURL+"/responses?stream=true", binding.Credential, []byte(`{"model":"test-model","prompt":"idle"}`), nil)
+	if response.StatusCode != http.StatusForbidden {
+		t.Fatalf("idle request status = %d, want %d", response.StatusCode, http.StatusForbidden)
+	}
+	_ = response.Body.Close()
+	select {
+	case request := <-observed:
+		t.Fatalf("idle request reached upstream: %#v", request)
+	default:
+	}
+
+	now := time.Now().UTC()
+	if err := session.activate(testPromptOneID, now.Add(time.Minute), now); err != nil {
+		t.Fatal(err)
+	}
+	response = doProviderProxyRequest(t, http.MethodPost, binding.BaseURL+"/responses", "wrong-local-credential", []byte(`{"model":"test-model"}`), nil)
+	if response.StatusCode != http.StatusForbidden {
+		t.Fatalf("wrong credential status = %d, want %d", response.StatusCode, http.StatusForbidden)
+	}
+	_ = response.Body.Close()
+
+	headers := http.Header{
+		"Content-Type":                   []string{"application/json"},
+		providerAPIKeyHeader:             []string{binding.Credential},
+		providerCookieHeader:             []string{"local-secret=1"},
+		providerProxyAuthorizationHeader: []string{"Bearer proxy-secret"},
+		providerForwardedForHeader:       []string{"203.0.113.1"},
+		"Connection":                     []string{testConnectionSecretHeader},
+		testConnectionSecretHeader:       []string{"remove-me"},
+		"X-Safe-Request":                 []string{"preserve-me"},
+	}
+	response = doProviderProxyRequest(t, http.MethodPost, binding.BaseURL+"/responses?stream=true", binding.Credential, []byte(`{"model":"test-model","prompt":"active"}`), headers)
+	defer func() { _ = response.Body.Close() }()
+	if response.StatusCode != http.StatusOK {
+		data, _ := io.ReadAll(response.Body)
+		t.Fatalf("active request status = %d body=%s", response.StatusCode, data)
+	}
+	data, err := io.ReadAll(response.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(data) != `{"ok":true}` || response.Header.Get("X-Upstream-Safe") != "yes" || len(response.Cookies()) != 0 {
+		t.Fatalf("unexpected proxied response: body=%q header=%v", data, response.Header)
+	}
+	request := <-observed
+	if request.method != http.MethodPost || request.path != providerOpenAIResponsesV1Path || request.query != "stream=true" || request.body != `{"model":"test-model","prompt":"active"}` {
+		t.Fatalf("unexpected upstream request: %#v", request)
+	}
+	if got := request.header.Get(providerAuthorizationHeader); got != "Bearer "+upstreamToken {
+		t.Fatalf("upstream authorization = %q", got)
+	}
+	for _, name := range []string{
+		providerAPIKeyHeader, providerLegacyAPIKeyHeader, providerCookieHeader,
+		providerProxyAuthorizationHeader, providerForwardedForHeader, testConnectionSecretHeader,
+	} {
+		if value := request.header.Get(name); value != "" {
+			t.Fatalf("sensitive inbound header %s reached upstream: %q", name, value)
+		}
+	}
+	if request.header.Get("X-Safe-Request") != "preserve-me" {
+		t.Fatalf("safe request header was not preserved: %v", request.header)
+	}
+
+	session.deactivate(testPromptOneID)
+	assertProviderProxyStatus(t, binding.BaseURL+"/responses", binding.Credential, http.StatusForbidden)
+
+	session.close()
+	assertProviderProxyStatus(t, binding.BaseURL+"/responses", binding.Credential, http.StatusNotFound)
+}
+
+func TestProviderProxyAcceptsAnthropicAPIKeyCredential(t *testing.T) {
+	observed := make(chan *http.Request, 1)
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		observed <- r.Clone(r.Context())
+		_, _ = io.WriteString(w, `{"ok":true}`)
+	}))
+	defer upstream.Close()
+	proxy, session, binding := activeTestProviderProxySession(t, ProviderProxyConfig{
+		UpstreamBaseURL: upstream.URL + "/anthropic", UpstreamBearerToken: testUpstreamToken,
+		ProviderKind: "claude", Model: "test-model",
+	})
+	_ = proxy
+	defer session.close()
+	request, err := http.NewRequest(http.MethodPost, binding.BaseURL+"/v1/messages", strings.NewReader(`{"model":"test-model"}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	request.Header.Set(providerAPIKeyHeader, binding.Credential)
+	request.Header.Set("Anthropic-Version", "2023-06-01")
+	response, err := http.DefaultClient.Do(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = response.Body.Close() }()
+	if response.StatusCode != http.StatusOK {
+		t.Fatalf("Anthropic proxy status = %d, want %d", response.StatusCode, http.StatusOK)
+	}
+	upstreamRequest := <-observed
+	if upstreamRequest.URL.Path != "/anthropic/v1/messages" ||
+		upstreamRequest.Header.Get(providerAuthorizationHeader) != "Bearer "+testUpstreamToken ||
+		upstreamRequest.Header.Get(providerAPIKeyHeader) != "" ||
+		upstreamRequest.Header.Get("Anthropic-Version") != "2023-06-01" {
+		t.Fatalf("unexpected Anthropic upstream request: path=%s headers=%v", upstreamRequest.URL.Path, upstreamRequest.Header)
+	}
+}
+
+func TestProviderProxyAcceptsVersionedOpenAIPath(t *testing.T) {
+	observed := make(chan *http.Request, 1)
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		observed <- r.Clone(r.Context())
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = io.WriteString(w, `{"ok":true}`)
+	}))
+	defer upstream.Close()
+	_, session, binding := activeTestProviderProxySession(t, ProviderProxyConfig{
+		UpstreamBaseURL: upstream.URL, UpstreamBearerToken: testUpstreamToken,
+		ProviderKind: providerKindCodex, Model: "test-model",
+	})
+	defer session.close()
+	response := doProviderProxyRequest(
+		t, http.MethodPost, binding.BaseURL+providerOpenAIResponsesV1Path, binding.Credential,
+		[]byte(`{"model":"test-model"}`), nil,
+	)
+	defer func() { _ = response.Body.Close() }()
+	if response.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(response.Body)
+		t.Fatalf("versioned OpenAI request status = %d body=%s", response.StatusCode, body)
+	}
+	request := <-observed
+	if request.URL.Path != providerOpenAIResponsesV1Path || request.Method != http.MethodPost {
+		t.Fatalf("versioned OpenAI upstream request = %s %s", request.Method, request.URL.Path)
+	}
+}
+
+func TestProviderProxyLeaseExpiryCancelsInflightAndDeniesLateRequests(t *testing.T) {
+	started := make(chan struct{})
+	cancelled := make(chan struct{})
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/event-stream")
+		w.WriteHeader(http.StatusOK)
+		_, _ = io.WriteString(w, "data: started\n\n")
+		if flusher, ok := w.(http.Flusher); ok {
+			flusher.Flush()
+		}
+		close(started)
+		ticker := time.NewTicker(10 * time.Millisecond)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-r.Context().Done():
+				close(cancelled)
+				return
+			case <-ticker.C:
+				if _, err := io.WriteString(w, "data: waiting\n\n"); err != nil {
+					close(cancelled)
+					return
+				}
+				if flusher, ok := w.(http.Flusher); ok {
+					flusher.Flush()
+				}
+			}
+		}
+	}))
+	defer upstream.Close()
+	proxy := newTestProviderProxy(t, ProviderProxyConfig{UpstreamBaseURL: upstream.URL, UpstreamBearerToken: testUpstreamToken})
+	session, binding, err := proxy.newSession()
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now().UTC()
+	if err := session.activate("prompt-expiring", now.Add(150*time.Millisecond), now); err != nil {
+		t.Fatal(err)
+	}
+
+	requestDone := make(chan struct{})
+	go func() {
+		defer close(requestDone)
+		request, _ := http.NewRequest(http.MethodPost, binding.BaseURL+"/responses", bytes.NewReader([]byte(`{"model":"test-model"}`)))
+		request.Header.Set(providerAuthorizationHeader, "Bearer "+binding.Credential)
+		response, requestErr := http.DefaultClient.Do(request)
+		if requestErr == nil {
+			_, _ = io.ReadAll(response.Body)
+			_ = response.Body.Close()
+		}
+	}()
+	select {
+	case <-started:
+	case <-time.After(2 * time.Second):
+		t.Fatal("provider request did not reach upstream while lease was active")
+	}
+	select {
+	case <-cancelled:
+	case <-time.After(2 * time.Second):
+		t.Fatal("lease expiry did not cancel the in-flight upstream request")
+	}
+	select {
+	case <-requestDone:
+	case <-time.After(2 * time.Second):
+		t.Fatal("local proxy request did not terminate after lease expiry")
+	}
+	response := doProviderProxyRequest(t, http.MethodPost, binding.BaseURL+"/responses", binding.Credential, []byte(`{"model":"test-model"}`), nil)
+	if response.StatusCode != http.StatusForbidden {
+		t.Fatalf("late request status = %d, want %d", response.StatusCode, http.StatusForbidden)
+	}
+	_ = response.Body.Close()
+}
+
+func TestProviderProxyLeaseRenewalExtendsAccess(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = io.WriteString(w, `{"ok":true}`)
+	}))
+	defer upstream.Close()
+	proxy := newTestProviderProxy(t, ProviderProxyConfig{
+		UpstreamBaseURL: upstream.URL, UpstreamBearerToken: testUpstreamToken,
+	})
+	session, binding, err := proxy.newSession()
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now().UTC()
+	if err := session.activate("prompt-renew", now.Add(75*time.Millisecond), now); err != nil {
+		t.Fatal(err)
+	}
+	if err := session.renew("prompt-renew", now.Add(time.Second), now.Add(25*time.Millisecond)); err != nil {
+		t.Fatal(err)
+	}
+	time.Sleep(125 * time.Millisecond)
+	response := doProviderProxyRequest(t, http.MethodPost, binding.BaseURL+"/responses", binding.Credential, []byte(`{"model":"test-model"}`), nil)
+	defer func() { _ = response.Body.Close() }()
+	if response.StatusCode != http.StatusOK {
+		t.Fatalf("renewed provider request status = %d, want %d", response.StatusCode, http.StatusOK)
+	}
+	session.deactivate("prompt-renew")
+}
+
+func TestProviderProxyMaxTurnsCountsOnlyInferenceRequests(t *testing.T) {
+	t.Run("OpenAI-compatible", func(t *testing.T) {
+		var reached atomic.Int32
+		upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			reached.Add(1)
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = io.WriteString(w, `{"ok":true}`)
+		}))
+		defer upstream.Close()
+
+		proxy := newTestProviderProxy(t, ProviderProxyConfig{
+			UpstreamBaseURL: upstream.URL, UpstreamBearerToken: "test-auth-token",
+		})
+		session, binding, err := proxy.newSession()
+		if err != nil {
+			t.Fatal(err)
+		}
+		now := time.Now().UTC()
+		if err := session.activateWithMaxTurns(testPromptOneID, 3, now.Add(time.Minute), now); err != nil {
+			t.Fatal(err)
+		}
+		defer session.close()
+
+		for _, request := range []struct {
+			method string
+			path   string
+			body   []byte
+		}{
+			{method: http.MethodGet, path: "/models"},
+			{method: http.MethodPost, path: "/responses", body: []byte(`{"model":"test-model"}`)},
+			{method: http.MethodPost, path: "/v1/chat/completions", body: []byte(`{"model":"test-model"}`)},
+			{method: http.MethodPost, path: "/responses/compact", body: []byte(`{"model":"test-model"}`)},
+			{method: http.MethodGet, path: providerModelsV1Path},
+		} {
+			response := doProviderProxyRequest(t, request.method, binding.BaseURL+request.path, binding.Credential, request.body, nil)
+			if response.StatusCode != http.StatusOK {
+				body, _ := io.ReadAll(response.Body)
+				_ = response.Body.Close()
+				t.Fatalf("%s %s status = %d body=%s", request.method, request.path, response.StatusCode, body)
+			}
+			_ = response.Body.Close()
+		}
+
+		blocked := doProviderProxyRequest(
+			t, http.MethodPost, binding.BaseURL+providerOpenAIResponsesV1Path, binding.Credential,
+			[]byte(`{"model":"test-model"}`), nil,
+		)
+		defer func() { _ = blocked.Body.Close() }()
+		if blocked.StatusCode != http.StatusBadRequest {
+			body, _ := io.ReadAll(blocked.Body)
+			t.Fatalf("N+1 OpenAI request status = %d body=%s", blocked.StatusCode, body)
+		}
+		body, _ := io.ReadAll(blocked.Body)
+		if !strings.Contains(string(body), `"code":"max_turn_requests"`) {
+			t.Fatalf("OpenAI turn-limit body = %s", body)
+		}
+		if got := reached.Load(); got != 5 {
+			t.Fatalf("OpenAI upstream requests = %d, want 5", got)
+		}
+		if !session.maxTurnsExceeded(testPromptOneID) {
+			t.Fatal("OpenAI prompt was not marked turn-limit exhausted")
+		}
+	})
+
+	t.Run("Anthropic", func(t *testing.T) {
+		var reached atomic.Int32
+		upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			reached.Add(1)
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = io.WriteString(w, `{"ok":true}`)
+		}))
+		defer upstream.Close()
+
+		proxy := newTestProviderProxy(t, ProviderProxyConfig{
+			UpstreamBaseURL: upstream.URL, UpstreamBearerToken: "test-auth-token", ProviderKind: providerKindClaude,
+		})
+		session, binding, err := proxy.newSession()
+		if err != nil {
+			t.Fatal(err)
+		}
+		now := time.Now().UTC()
+		if err := session.activateWithMaxTurns(testPromptOneID, 1, now.Add(time.Minute), now); err != nil {
+			t.Fatal(err)
+		}
+		defer session.close()
+
+		for _, request := range []struct {
+			method string
+			path   string
+			body   []byte
+		}{
+			{method: http.MethodPost, path: "/v1/messages/count_tokens", body: []byte(`{"model":"test-model"}`)},
+			{method: http.MethodGet, path: providerModelsV1Path},
+			{method: http.MethodPost, path: "/v1/messages", body: []byte(`{"model":"test-model"}`)},
+		} {
+			response := doProviderProxyRequest(t, request.method, binding.BaseURL+request.path, binding.Credential, request.body, nil)
+			if response.StatusCode != http.StatusOK {
+				body, _ := io.ReadAll(response.Body)
+				_ = response.Body.Close()
+				t.Fatalf("%s %s status = %d body=%s", request.method, request.path, response.StatusCode, body)
+			}
+			_ = response.Body.Close()
+		}
+
+		blocked := doProviderProxyRequest(
+			t, http.MethodPost, binding.BaseURL+"/v1/messages", binding.Credential,
+			[]byte(`{"model":"test-model"}`), nil,
+		)
+		defer func() { _ = blocked.Body.Close() }()
+		if blocked.StatusCode != http.StatusBadRequest {
+			body, _ := io.ReadAll(blocked.Body)
+			t.Fatalf("N+1 Anthropic request status = %d body=%s", blocked.StatusCode, body)
+		}
+		body, _ := io.ReadAll(blocked.Body)
+		if !strings.Contains(string(body), `"type":"error"`) {
+			t.Fatalf("Anthropic turn-limit body = %s", body)
+		}
+		if got := reached.Load(); got != 3 {
+			t.Fatalf("Anthropic upstream requests = %d, want 3", got)
+		}
+		if !session.maxTurnsExceeded(testPromptOneID) {
+			t.Fatal("Anthropic prompt was not marked turn-limit exhausted")
+		}
+	})
+}
+
+func TestProviderProxyMaxTurnsIsAtomicAcrossConcurrentRequests(t *testing.T) {
+	var reached atomic.Int32
+	entered := make(chan struct{}, 1)
+	release := make(chan struct{})
+	var releaseOnce sync.Once
+	releaseUpstream := func() { releaseOnce.Do(func() { close(release) }) }
+	defer releaseUpstream()
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		reached.Add(1)
+		entered <- struct{}{}
+		<-release
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = io.WriteString(w, `{"ok":true}`)
+	}))
+	defer upstream.Close()
+
+	proxy := newTestProviderProxy(t, ProviderProxyConfig{
+		UpstreamBaseURL: upstream.URL, UpstreamBearerToken: "test-auth-token",
+	})
+	session, binding, err := proxy.newSession()
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now().UTC()
+	if err := session.activateWithMaxTurns(testPromptOneID, 1, now.Add(time.Minute), now); err != nil {
+		t.Fatal(err)
+	}
+	defer session.close()
+
+	type result struct {
+		status int
+		err    error
+	}
+	results := make(chan result, 2)
+	start := make(chan struct{})
+	request := func() {
+		<-start
+		httpRequest, requestErr := http.NewRequest(
+			http.MethodPost, binding.BaseURL+"/responses",
+			bytes.NewReader([]byte(`{"model":"test-model"}`)),
+		)
+		if requestErr != nil {
+			results <- result{err: requestErr}
+			return
+		}
+		httpRequest.Header.Set(providerAuthorizationHeader, "Bearer "+binding.Credential)
+		response, requestErr := http.DefaultClient.Do(httpRequest)
+		if requestErr != nil {
+			results <- result{err: requestErr}
+			return
+		}
+		_, _ = io.Copy(io.Discard, response.Body)
+		_ = response.Body.Close()
+		results <- result{status: response.StatusCode}
+	}
+	go request()
+	go request()
+	close(start)
+
+	select {
+	case <-entered:
+	case <-time.After(5 * time.Second):
+		t.Fatal("allowed inference request did not reach upstream")
+	}
+	select {
+	case got := <-results:
+		if got.err != nil || got.status != http.StatusBadRequest {
+			t.Fatalf("concurrent N+1 result = %#v, want status %d", got, http.StatusBadRequest)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("concurrent N+1 request was not blocked")
+	}
+	if got := reached.Load(); got != 1 {
+		t.Fatalf("concurrent upstream requests = %d, want 1", got)
+	}
+	releaseUpstream()
+	select {
+	case got := <-results:
+		if got.err != nil || got.status != http.StatusOK {
+			t.Fatalf("allowed concurrent request result = %#v, want status %d", got, http.StatusOK)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("allowed concurrent request did not complete")
+	}
+	if !session.maxTurnsExceeded(testPromptOneID) {
+		t.Fatal("concurrent prompt was not marked turn-limit exhausted")
+	}
+}
+
+func TestProviderProxyMaxTurnsResetsOnActivationButNotRenewal(t *testing.T) {
+	var reached atomic.Int32
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		reached.Add(1)
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = io.WriteString(w, `{"ok":true}`)
+	}))
+	defer upstream.Close()
+
+	proxy := newTestProviderProxy(t, ProviderProxyConfig{
+		UpstreamBaseURL: upstream.URL, UpstreamBearerToken: "test-auth-token",
+	})
+	session, binding, err := proxy.newSession()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer session.close()
+	now := time.Now().UTC()
+	if err := session.activateWithMaxTurns("prompt-one", 1, now.Add(time.Minute), now); err != nil {
+		t.Fatal(err)
+	}
+
+	requestInference := func(want int) {
+		t.Helper()
+		response := doProviderProxyRequest(
+			t, http.MethodPost, binding.BaseURL+"/responses", binding.Credential,
+			[]byte(`{"model":"test-model"}`), nil,
+		)
+		defer func() { _ = response.Body.Close() }()
+		if response.StatusCode != want {
+			body, _ := io.ReadAll(response.Body)
+			t.Fatalf("provider response status = %d, want %d body=%s", response.StatusCode, want, body)
+		}
+	}
+
+	requestInference(http.StatusOK)
+	if err := session.renew("prompt-one", now.Add(2*time.Minute), now.Add(time.Second)); err != nil {
+		t.Fatal(err)
+	}
+	requestInference(http.StatusBadRequest)
+	if !session.maxTurnsExceeded("prompt-one") {
+		t.Fatal("lease renewal reset the prompt turn-limit state")
+	}
+
+	session.deactivate("prompt-one")
+	secondNow := time.Now().UTC()
+	if err := session.activateWithMaxTurns("prompt-two", 1, secondNow.Add(time.Minute), secondNow); err != nil {
+		t.Fatal(err)
+	}
+	if session.maxTurnsExceeded("prompt-one") || session.maxTurnsExceeded("prompt-two") {
+		t.Fatal("new prompt activation did not reset turn-limit state")
+	}
+	requestInference(http.StatusOK)
+	requestInference(http.StatusBadRequest)
+	if !session.maxTurnsExceeded("prompt-two") {
+		t.Fatal("second prompt was not marked turn-limit exhausted")
+	}
+	if got := reached.Load(); got != 2 {
+		t.Fatalf("upstream requests across prompt resets = %d, want 2", got)
+	}
+}
+
+func TestProviderProxySessionCleanupWaitsForInflightRequest(t *testing.T) {
+	started := make(chan struct{})
+	cancelled := make(chan struct{})
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/event-stream")
+		w.WriteHeader(http.StatusOK)
+		if flusher, ok := w.(http.Flusher); ok {
+			flusher.Flush()
+		}
+		close(started)
+		ticker := time.NewTicker(10 * time.Millisecond)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-r.Context().Done():
+				close(cancelled)
+				return
+			case <-ticker.C:
+				if _, err := io.WriteString(w, "data: waiting\n\n"); err != nil {
+					close(cancelled)
+					return
+				}
+				if flusher, ok := w.(http.Flusher); ok {
+					flusher.Flush()
+				}
+			}
+		}
+	}))
+	defer upstream.Close()
+	proxy, session, binding := activeTestProviderProxySession(t, ProviderProxyConfig{
+		UpstreamBaseURL: upstream.URL, UpstreamBearerToken: testUpstreamToken,
+	})
+	_ = proxy
+	requestDone := make(chan struct{})
+	go func() {
+		defer close(requestDone)
+		request, _ := http.NewRequest(http.MethodPost, binding.BaseURL+"/responses", bytes.NewReader([]byte(`{"model":"test-model"}`)))
+		request.Header.Set(providerAuthorizationHeader, "Bearer "+binding.Credential)
+		response, requestErr := http.DefaultClient.Do(request)
+		if requestErr == nil {
+			_, _ = io.ReadAll(response.Body)
+			_ = response.Body.Close()
+		}
+	}()
+	select {
+	case <-started:
+	case <-time.After(2 * time.Second):
+		t.Fatal("provider request did not become in-flight")
+	}
+	session.close()
+	waitCtx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	if err := session.wait(waitCtx); err != nil {
+		t.Fatalf("wait for provider request cleanup: %v", err)
+	}
+	select {
+	case <-requestDone:
+	case <-time.After(2 * time.Second):
+		t.Fatal("local provider request remained active after session cleanup")
+	}
+	select {
+	case <-cancelled:
+	case <-time.After(2 * time.Second):
+		t.Fatal("upstream provider request remained active after session cleanup")
+	}
+}
+
+func TestProviderProxyForbidsRedirectsAndBoundsBodies(t *testing.T) {
+	t.Run("redirect", func(t *testing.T) {
+		var redirected atomic.Bool
+		target := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { redirected.Store(true) }))
+		defer target.Close()
+		upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			http.Redirect(w, &http.Request{}, target.URL, http.StatusTemporaryRedirect)
+		}))
+		defer upstream.Close()
+		proxy, session, binding := activeTestProviderProxySession(t, ProviderProxyConfig{UpstreamBaseURL: upstream.URL, UpstreamBearerToken: testUpstreamToken})
+		_ = proxy
+		defer session.close()
+		response := doProviderProxyRequest(t, http.MethodPost, binding.BaseURL+"/responses", binding.Credential, []byte(`{"model":"test-model"}`), nil)
+		if response.StatusCode != http.StatusBadGateway {
+			t.Fatalf("redirect status = %d, want %d", response.StatusCode, http.StatusBadGateway)
+		}
+		_ = response.Body.Close()
+		if redirected.Load() {
+			t.Fatal("provider proxy followed an upstream redirect")
+		}
+	})
+
+	t.Run("request body", func(t *testing.T) {
+		var reached atomic.Bool
+		upstream := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { reached.Store(true) }))
+		defer upstream.Close()
+		_, session, binding := activeTestProviderProxySession(t, ProviderProxyConfig{
+			UpstreamBaseURL: upstream.URL, UpstreamBearerToken: testUpstreamToken, MaxRequestBytes: 4,
+		})
+		defer session.close()
+		response := doProviderProxyRequest(t, http.MethodPost, binding.BaseURL+"/responses", binding.Credential, []byte("12345"), nil)
+		if response.StatusCode != http.StatusRequestEntityTooLarge {
+			t.Fatalf("oversized request status = %d, want %d", response.StatusCode, http.StatusRequestEntityTooLarge)
+		}
+		_ = response.Body.Close()
+		if reached.Load() {
+			t.Fatal("oversized request reached upstream")
+		}
+	})
+
+	t.Run("response body", func(t *testing.T) {
+		upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			w.Header().Set("Content-Length", "5")
+			_, _ = io.WriteString(w, "12345")
+		}))
+		defer upstream.Close()
+		_, session, binding := activeTestProviderProxySession(t, ProviderProxyConfig{
+			UpstreamBaseURL: upstream.URL, UpstreamBearerToken: testUpstreamToken, MaxResponseBytes: 4,
+		})
+		defer session.close()
+		response := doProviderProxyRequest(t, http.MethodPost, binding.BaseURL+"/responses", binding.Credential, []byte(`{"model":"test-model"}`), nil)
+		if response.StatusCode != http.StatusBadGateway {
+			t.Fatalf("oversized response status = %d, want %d", response.StatusCode, http.StatusBadGateway)
+		}
+		_ = response.Body.Close()
+	})
+
+	t.Run("compressed request", func(t *testing.T) {
+		var reached atomic.Bool
+		upstream := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { reached.Store(true) }))
+		defer upstream.Close()
+		_, session, binding := activeTestProviderProxySession(t, ProviderProxyConfig{
+			UpstreamBaseURL: upstream.URL, UpstreamBearerToken: testUpstreamToken,
+		})
+		defer session.close()
+		response := doProviderProxyRequest(
+			t, http.MethodPost, binding.BaseURL+"/responses", binding.Credential, []byte("compressed"),
+			http.Header{providerContentEncodingHeader: []string{"gzip"}},
+		)
+		if response.StatusCode != http.StatusUnsupportedMediaType {
+			t.Fatalf("compressed request status = %d, want %d", response.StatusCode, http.StatusUnsupportedMediaType)
+		}
+		_ = response.Body.Close()
+		if reached.Load() {
+			t.Fatal("compressed request reached upstream")
+		}
+	})
+
+	t.Run("compressed response", func(t *testing.T) {
+		upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			w.Header().Set(providerContentEncodingHeader, "gzip")
+			_, _ = io.WriteString(w, "compressed")
+		}))
+		defer upstream.Close()
+		_, session, binding := activeTestProviderProxySession(t, ProviderProxyConfig{
+			UpstreamBaseURL: upstream.URL, UpstreamBearerToken: testUpstreamToken,
+		})
+		defer session.close()
+		response := doProviderProxyRequest(t, http.MethodPost, binding.BaseURL+"/responses", binding.Credential, []byte(`{"model":"test-model"}`), nil)
+		if response.StatusCode != http.StatusBadGateway {
+			t.Fatalf("compressed response status = %d, want %d", response.StatusCode, http.StatusBadGateway)
+		}
+		_ = response.Body.Close()
+	})
+}
+
+func newTestProviderProxy(t *testing.T, cfg ProviderProxyConfig) *providerProxy {
+	t.Helper()
+	if cfg.ProviderKind == "" {
+		cfg.ProviderKind = providerKindCodex
+	}
+	if cfg.Model == "" {
+		cfg.Model = "test-model"
+	}
+	proxy, err := newProviderProxy(cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+		defer cancel()
+		if err := proxy.close(ctx); err != nil {
+			t.Errorf("close provider proxy: %v", err)
+		}
+	})
+	return proxy
+}
+
+//nolint:unparam // Stable test helper signatures keep related cases uniform.
+func activeTestProviderProxySession(t *testing.T, cfg ProviderProxyConfig) (*providerProxy, *providerProxySession, ProviderProxyBinding) {
+	t.Helper()
+	proxy := newTestProviderProxy(t, cfg)
+	session, binding, err := proxy.newSession()
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now().UTC()
+	if err := session.activate(testPromptOneID, now.Add(time.Minute), now); err != nil {
+		t.Fatal(err)
+	}
+	return proxy, session, binding
+}
+
+//nolint:unparam // Stable test helper signatures keep related cases uniform.
+func doProviderProxyRequest(t *testing.T, method, endpoint, credential string, body []byte, headers http.Header) *http.Response {
+	t.Helper()
+	request, err := http.NewRequest(method, endpoint, bytes.NewReader(body))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for name, values := range headers {
+		for _, value := range values {
+			request.Header.Add(name, value)
+		}
+	}
+	request.Header.Set(providerAuthorizationHeader, "Bearer "+credential)
+	response, err := http.DefaultClient.Do(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return response
+}
+
+func assertProviderProxyStatus(t *testing.T, endpoint, credential string, want int) {
+	t.Helper()
+	response := doProviderProxyRequest(t, http.MethodPost, endpoint, credential, []byte(`{"model":"test-model"}`), nil)
+	defer func() { _ = response.Body.Close() }()
+	if response.StatusCode != want {
+		body, _ := io.ReadAll(io.LimitReader(response.Body, 4<<10))
+		t.Fatalf("provider proxy status = %d, want %d body=%s", response.StatusCode, want, body)
+	}
+}
diff --git a/workers/acp/supervisor/server.go b/workers/acp/supervisor/server.go
new file mode 100644
index 000000000..c53bef462
--- /dev/null
+++ b/workers/acp/supervisor/server.go
@@ -0,0 +1,912 @@
+package supervisor
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"maps"
+	"net/http"
+	"os"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/orka-agents/orka/internal/acp"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/workspacedelta"
+)
+
+type Server struct {
+	cfg           Config
+	mux           *http.ServeMux
+	providerProxy *providerProxy
+	mcpProxy      *mcpProxy
+	identityLock  io.Closer
+
+	mu          sync.Mutex
+	lifecycle   harnessv2.SupervisorLifecycle
+	drain       harnessv2.DrainStatus
+	sessions    map[harnessv2.RuntimeSessionID]*sessionState
+	tombstones  map[harnessv2.RuntimeSessionUID]harnessv2.RuntimeSessionTombstone
+	poolOps     map[harnessv2.OperationID]harnessv2.OperationRecord
+	promptSlots chan struct{}
+}
+
+type sessionCreationError struct {
+	stage string
+	cause error
+}
+
+func (e *sessionCreationError) Error() string {
+	return e.stage + ": " + e.cause.Error()
+}
+
+func (e *sessionCreationError) Unwrap() error { return e.cause }
+
+func sessionCreationFailed(stage string, err error) error {
+	if err == nil {
+		return nil
+	}
+	return &sessionCreationError{stage: stage, cause: err}
+}
+
+func sessionCreationStage(err error) string {
+	var creation *sessionCreationError
+	if errors.As(err, &creation) {
+		return creation.stage
+	}
+	return "unclassified"
+}
+
+type sessionState struct {
+	id                      harnessv2.RuntimeSessionID
+	runtime                 *acp.RuntimeSession
+	promptMutations         promptMutationExecutor
+	descriptor              harnessv2.RuntimeSessionDescriptor
+	operations              map[harnessv2.OperationID]harnessv2.OperationRecord
+	operationReplays        map[harnessv2.OperationID]*operationReplay
+	prompt                  *promptState
+	permissions             map[harnessv2.PermissionRequestID]permissionState
+	paths                   acp.SessionPaths
+	baseline                *workspacedelta.Snapshot
+	workspaceIntent         harnessv2.WorkspaceIntent
+	workspaceRelativeRoot   string
+	deltas                  map[harnessv2.WorkspaceDeltaID]harnessv2.CreateWorkspaceDeltaResponse
+	providerProxy           *providerProxySession
+	mcpProxy                *mcpProxySession
+	profile                 harnessv2.RuntimeProfile
+	agentConfiguration      harnessv2.AgentSessionConfiguration
+	creating                bool
+	drainCleanupScheduled   bool
+	publicationFinalization *harnessv2.PublicationFinalizationReceipt
+}
+
+type promptState struct {
+	request             harnessv2.StartPromptRequest
+	operation           harnessv2.OperationRecord
+	lease               harnessv2.PromptLease
+	startedAt           time.Time
+	acceptedAt          time.Time
+	sequence            uint64
+	assistant           strings.Builder
+	assistantOverflow   bool
+	finalAnswer         strings.Builder
+	finalAnswerSeen     bool
+	finalAnswerOverflow bool
+	settlement          *harnessv2.PromptSettlement
+	settlementDigest    string
+}
+
+type promptMutationExecutor interface {
+	ResolvePermission(promptID, requestID string, outcome acp.RequestPermissionOutcome) error
+	CancelPrompt(context.Context, string) (acp.PromptResult, error)
+}
+
+type operationReplay struct {
+	done         chan struct{}
+	permission   *harnessv2.PermissionResolutionResponse
+	cancellation *harnessv2.CancelPromptResponse
+	lease        *harnessv2.PromptLeaseResponse
+	failure      *operationFailure
+}
+
+type operationFailure struct {
+	status    int
+	code      harnessv2.ErrorCode
+	message   string
+	retryable bool
+}
+
+type permissionState struct {
+	requestID   harnessv2.PermissionRequestID
+	toolCallID  string
+	toolName    string
+	title       string
+	requestedAt time.Time
+	expiresAt   time.Time
+	options     map[string]harnessv2.PermissionOptionKind
+	decision    *harnessv2.PermissionDecision
+}
+
+type drainCleanupCandidate struct {
+	id    harnessv2.RuntimeSessionID
+	state *sessionState
+}
+
+func New(cfg Config) (*Server, error) {
+	return newServer(cfg, prepareSessionIdentityState)
+}
+
+func newServer(cfg Config, prepareIdentityState func(string, *acp.UIDAllocator) (io.Closer, error)) (*Server, error) {
+	if err := cfg.Validate(); err != nil {
+		return nil, err
+	}
+	if cfg.UIDAllocator.Remaining() != cfg.UIDAllocator.Capacity() {
+		return nil, fmt.Errorf("UID allocator must be fresh when the supervisor starts")
+	}
+	if prepareIdentityState == nil {
+		return nil, fmt.Errorf("session identity state preparation is required")
+	}
+	identityLock, err := prepareIdentityState(cfg.SessionBaseDir, cfg.UIDAllocator)
+	if err != nil {
+		return nil, fmt.Errorf("prepare session identity state: %w", err)
+	}
+	keepIdentityLock := false
+	defer func() {
+		if !keepIdentityLock {
+			_ = identityLock.Close()
+		}
+	}()
+	proxy, err := newProviderProxy(cfg.ProviderProxy)
+	if err != nil {
+		return nil, err
+	}
+	mcp, err := newMCPProxy(cfg.MCPBroker)
+	if err != nil {
+		closeCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		_ = proxy.close(closeCtx)
+		return nil, err
+	}
+	cfg.ProviderProxy.UpstreamBearerToken = ""
+	cfg.MCPBroker = nil
+	server := &Server{
+		cfg:           cfg,
+		mux:           http.NewServeMux(),
+		providerProxy: proxy,
+		mcpProxy:      mcp,
+		identityLock:  identityLock,
+		lifecycle:     harnessv2.SupervisorLifecycleReady,
+		drain:         harnessv2.DrainStatus{AcceptingNewSessions: true},
+		sessions:      make(map[harnessv2.RuntimeSessionID]*sessionState),
+		tombstones:    make(map[harnessv2.RuntimeSessionUID]harnessv2.RuntimeSessionTombstone),
+		poolOps:       make(map[harnessv2.OperationID]harnessv2.OperationRecord),
+		promptSlots:   make(chan struct{}, cfg.Capabilities.Limits.MaxConcurrentPrompts),
+	}
+	if server.sessionIdentityCapacity().RotationRequired() {
+		server.drain.AcceptingNewSessions = false
+	}
+	server.registerRoutes()
+	keepIdentityLock = true
+	return server, nil
+}
+
+func (s *Server) Handler() http.Handler { return s.mux }
+
+func (s *Server) registerRoutes() {
+	s.mux.HandleFunc("GET "+harnessv2.HealthPath, s.handleHealth)
+	s.mux.HandleFunc("GET "+harnessv2.CapabilitiesPath, s.handleCapabilities)
+	s.mux.HandleFunc("GET "+harnessv2.StatusPath, s.handleStatus)
+	s.mux.HandleFunc("PUT "+harnessv2.DrainPath, s.handleDrain)
+	s.mux.HandleFunc("PUT /v2/runtime-sessions/{sessionID}", s.handleCreateSession)
+	s.mux.HandleFunc("PUT /v2/runtime-sessions/{sessionID}/publication-finalization", s.handleFinalizeSessionPublication)
+	s.mux.HandleFunc("DELETE /v2/runtime-sessions/{sessionID}", s.handleDeleteSession)
+	s.mux.HandleFunc("PUT /v2/runtime-sessions/{sessionID}/prompts/{promptID}", s.handleStartPrompt)
+	s.mux.HandleFunc("PUT /v2/runtime-sessions/{sessionID}/prompts/{promptID}/lease", s.handleRenewLease)
+	s.mux.HandleFunc("PUT /v2/runtime-sessions/{sessionID}/prompts/{promptID}/permissions/{requestID}", s.handleResolvePermission)
+	s.mux.HandleFunc("PUT /v2/runtime-sessions/{sessionID}/prompts/{promptID}/cancel", s.handleCancelPrompt)
+	s.mux.HandleFunc("PUT /v2/runtime-sessions/{sessionID}/workspace-deltas/{deltaID}", s.handleWorkspaceDelta)
+}
+
+func (s *Server) handleHealth(w http.ResponseWriter, _ *http.Request) {
+	s.mu.Lock()
+	status := harnessv2.HealthStatusOK
+	switch s.lifecycle {
+	case harnessv2.SupervisorLifecycleUnhealthy:
+		status = harnessv2.HealthStatusUnhealthy
+	case harnessv2.SupervisorLifecycleDraining, harnessv2.SupervisorLifecycleTerminating:
+		status = harnessv2.HealthStatusDegraded
+	}
+	if status == harnessv2.HealthStatusOK && !s.drain.AcceptingNewSessions {
+		status = harnessv2.HealthStatusDegraded
+	}
+	s.mu.Unlock()
+	writeJSON(w, http.StatusOK, harnessv2.HealthResponse{Protocol: harnessv2.ProtocolVersion, Status: status, Timestamp: time.Now().UTC()})
+}
+
+func (s *Server) handleCapabilities(w http.ResponseWriter, _ *http.Request) {
+	writeJSON(w, http.StatusOK, s.cfg.Capabilities)
+}
+
+func (s *Server) handleStatus(w http.ResponseWriter, r *http.Request) {
+	if !s.authorizeController(w, r) {
+		return
+	}
+	writeJSON(w, http.StatusOK, s.status())
+}
+
+func (s *Server) status() harnessv2.StatusResponse {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	now := time.Now().UTC()
+	response := harnessv2.StatusResponse{
+		Protocol:                harnessv2.ProtocolVersion,
+		Fence:                   s.cfg.Fence,
+		Lifecycle:               s.lifecycle,
+		Drain:                   s.drain,
+		SessionIdentityCapacity: s.sessionIdentityCapacity(),
+		Timestamp:               now,
+	}
+	for _, state := range s.sessions {
+		status := harnessv2.RuntimeSessionStatus{
+			RuntimeSessionID:        state.descriptor.RuntimeSessionID,
+			RuntimeSessionUID:       state.descriptor.RuntimeSessionUID,
+			Generation:              state.descriptor.Generation,
+			State:                   state.descriptor.State,
+			PendingPermissionCount:  uint32(len(state.permissions)),
+			ReservedForFinalization: state.descriptor.State == harnessv2.RuntimeSessionStateFinalizing && state.publicationFinalization != nil,
+			LiveDescendantCount:     liveDescendantCount(state.runtime),
+			LastTransitionAt:        state.descriptor.LastTransitionAt,
+		}
+		if state.prompt != nil && state.prompt.settlement == nil {
+			status.ActivePromptID = state.prompt.request.Metadata.PromptID
+			response.ActivePrompts = append(response.ActivePrompts, harnessv2.ActivePromptStatus{
+				RuntimeSessionUID:  state.descriptor.RuntimeSessionUID,
+				SessionGeneration:  state.descriptor.Generation,
+				TaskUID:            state.prompt.request.Metadata.TaskUID,
+				TaskAttempt:        state.prompt.request.Metadata.TaskAttempt,
+				PromptID:           state.prompt.request.Metadata.PromptID,
+				LeaseExpiresAt:     state.prompt.lease.ExpiresAt,
+				FrameSequence:      max(state.prompt.sequence, 1),
+				PendingPermissions: uint32(len(state.permissions)),
+				StartedAt:          state.prompt.startedAt,
+			})
+		}
+		response.Sessions = append(response.Sessions, status)
+		for _, permission := range state.permissions {
+			response.PendingPermissions = append(response.PendingPermissions, harnessv2.PendingPermissionStatus{
+				RuntimeSessionUID: state.descriptor.RuntimeSessionUID,
+				PromptID:          state.prompt.request.Metadata.PromptID,
+				RequestID:         permission.requestID,
+				RequestedAt:       permission.requestedAt,
+				ExpiresAt:         permission.expiresAt,
+			})
+		}
+	}
+	response.Pressure = harnessv2.PressureMetadata{
+		ResidentSessions:   uint32(len(response.Sessions)),
+		ActivePrompts:      uint32(len(response.ActivePrompts)),
+		PendingPermissions: uint32(len(response.PendingPermissions)),
+		LiveDescendants:    totalLiveDescendants(response.Sessions),
+	}
+	return response
+}
+
+func (s *Server) handleDrain(w http.ResponseWriter, r *http.Request) {
+	var request harnessv2.DrainRequest
+	if !s.decodeMutation(w, r, &request, false, request.Metadata) {
+		return
+	}
+	now := time.Now().UTC()
+	if err := request.ValidateAt(now); err != nil {
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil, false)
+		return
+	}
+	if !s.authorizeMutation(w, r, request.Metadata, false) {
+		return
+	}
+	s.mu.Lock()
+	classification, err := harnessv2.ClassifyOperation(s.cfg.Fence, request.Metadata, operationPtr(s.poolOps, request.Metadata.OperationID), false, now)
+	if err != nil {
+		s.mu.Unlock()
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil, false)
+		return
+	}
+	var cleanup []drainCleanupCandidate
+	if classification.Class == harnessv2.RequestClassificationFresh {
+		s.poolOps[request.Metadata.OperationID] = operationRecord(request.Metadata, harnessv2.OperationPhaseApplied, "", now)
+		cleanup = s.beginDrainLocked(request.Reason, now)
+	}
+	response := harnessv2.DrainResponse{Protocol: harnessv2.ProtocolVersion, Classification: classification, Drain: s.drain}
+	s.mu.Unlock()
+	s.startDrainCleanup(cleanup)
+	status := classification.HTTPStatus()
+	if status == 0 {
+		status = http.StatusOK
+	}
+	writeJSON(w, status, response)
+}
+
+func (s *Server) handleCreateSession(w http.ResponseWriter, r *http.Request) {
+	var request harnessv2.CreateRuntimeSessionRequest
+	if !decodeJSON(w, r, s.cfg.Capabilities.Limits.MaxRequestBytes, &request) {
+		return
+	}
+	now := time.Now().UTC()
+	if err := request.ValidateAt(now); err != nil {
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, err.Error(), nil, false)
+		return
+	}
+	if request.AgentConfiguration == nil {
+		writeError(w, http.StatusTooManyRequests, harnessv2.ErrorCodeRateLimited, "runtime is waiting for a controller that supports Agent session configuration", nil, true)
+		return
+	}
+	if string(request.RuntimeSessionID) != r.PathValue("sessionID") {
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, "runtime session path does not match request", nil, false)
+		return
+	}
+	if !s.authorizeMutation(w, r, request.Metadata, true) {
+		return
+	}
+	profileDigest, err := harnessv2.CanonicalProfileDigest(request.Profile)
+	if err != nil || profileDigest != s.cfg.Fence.RuntimeProfileDigest || request.Metadata.Fence.RuntimeProfileDigest != profileDigest {
+		writeError(w, http.StatusGone, harnessv2.ErrorCodeStaleFence, "runtime profile does not match this supervisor instance", nil, false)
+		return
+	}
+	if request.Profile.ProviderKind != s.cfg.Provider.Kind || request.Profile.Model != s.cfg.Provider.Model {
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, "requested provider profile is not available in this image", nil, false)
+		return
+	}
+	expected := s.expectedFence(request.Metadata.Fence.RuntimeSessionUID, request.Metadata.Fence.RuntimeSessionGeneration)
+
+	s.mu.Lock()
+	if existing := s.sessions[request.RuntimeSessionID]; existing != nil {
+		classification, classifyErr := harnessv2.ClassifyOperation(expected, request.Metadata, operationPtr(existing.operations, request.Metadata.OperationID), true, now)
+		if classifyErr != nil {
+			s.mu.Unlock()
+			writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, classifyErr.Error(), nil, false)
+			return
+		}
+		if classification.Class == harnessv2.RequestClassificationDuplicate && !existing.creating {
+			response := harnessv2.CreateRuntimeSessionResponse{Protocol: harnessv2.ProtocolVersion, Classification: classification, Session: existing.descriptor}
+			s.mu.Unlock()
+			writeJSON(w, http.StatusOK, response)
+			return
+		}
+		s.mu.Unlock()
+		writeClassificationError(w, classification)
+		return
+	}
+	if !s.drain.AcceptingNewSessions || s.lifecycle != harnessv2.SupervisorLifecycleReady {
+		s.mu.Unlock()
+		writeError(w, http.StatusTooManyRequests, harnessv2.ErrorCodeRateLimited, "runtime pool is not accepting new sessions", nil, true)
+		return
+	}
+	if len(s.sessions) >= int(s.cfg.Capabilities.Limits.MaxResidentSessions) {
+		s.mu.Unlock()
+		writeError(w, http.StatusTooManyRequests, harnessv2.ErrorCodeRateLimited, "runtime pool is at resident-session capacity", nil, true)
+		return
+	}
+	uid, gid, err := s.cfg.UIDAllocator.AllocateAboveReserve(sessionIdentityExhaustionReserve)
+	if err != nil {
+		s.drain.AcceptingNewSessions = false
+		s.mu.Unlock()
+		if errors.Is(err, acp.ErrUIDReserveReached) || errors.Is(err, acp.ErrUIDRangeExhausted) {
+			writeError(w, http.StatusTooManyRequests, harnessv2.ErrorCodeRateLimited, "runtime pool is rotating before session identity exhaustion", nil, true)
+			return
+		}
+		writeError(w, http.StatusInternalServerError, harnessv2.ErrorCodeSessionPoisoned, "runtime session identity allocation failed", nil, true)
+		return
+	}
+	state := &sessionState{
+		id:       request.RuntimeSessionID,
+		creating: true,
+		descriptor: harnessv2.RuntimeSessionDescriptor{
+			RuntimeSessionID: request.RuntimeSessionID, RuntimeSessionUID: request.Metadata.Fence.RuntimeSessionUID,
+			Generation: request.Metadata.Fence.RuntimeSessionGeneration, RuntimeInstanceID: s.cfg.Fence.RuntimeInstanceID,
+			SupervisorBootID: s.cfg.Fence.SupervisorBootID, RuntimeProfileDigest: s.cfg.Fence.RuntimeProfileDigest,
+			State: harnessv2.RuntimeSessionStateCreating, WorkspaceBaseline: request.Workspace.Baseline,
+			CreatedAt: now, LastTransitionAt: now,
+		},
+		operations:       map[harnessv2.OperationID]harnessv2.OperationRecord{request.Metadata.OperationID: operationRecord(request.Metadata, harnessv2.OperationPhaseRecorded, "", now)},
+		operationReplays: make(map[harnessv2.OperationID]*operationReplay),
+		permissions:      make(map[harnessv2.PermissionRequestID]permissionState),
+		deltas:           make(map[harnessv2.WorkspaceDeltaID]harnessv2.CreateWorkspaceDeltaResponse),
+	}
+	s.sessions[request.RuntimeSessionID] = state
+	if s.sessionIdentityCapacity().RotationRequired() {
+		s.drain.AcceptingNewSessions = false
+	}
+	s.mu.Unlock()
+
+	runtimeSession, descriptor, paths, baseline, providerProxy, mcpProxy, createErr := s.createSession(r.Context(), request, now, uid, gid)
+	if createErr != nil {
+		s.mu.Lock()
+		delete(s.sessions, request.RuntimeSessionID)
+		s.mu.Unlock()
+		slog.Error("ACP runtime session creation failed", "stage", sessionCreationStage(createErr))
+		writeError(w, http.StatusInternalServerError, harnessv2.ErrorCodeSessionPoisoned, safeError(createErr), nil, true)
+		return
+	}
+	s.mu.Lock()
+	state.runtime = runtimeSession
+	state.promptMutations = runtimeSession
+	state.descriptor = descriptor
+	state.paths = paths
+	state.baseline = baseline
+	state.workspaceIntent = request.Workspace.Intent
+	state.workspaceRelativeRoot = strings.TrimSpace(request.Workspace.RelativeRoot)
+	state.providerProxy = providerProxy
+	state.mcpProxy = mcpProxy
+	state.profile = request.Profile
+	state.agentConfiguration = *request.AgentConfiguration
+	state.creating = false
+	state.operations[request.Metadata.OperationID] = operationRecord(request.Metadata, harnessv2.OperationPhaseApplied, "", now)
+	drainCleanup := s.drain.Requested && !state.drainCleanupScheduled && isDrainCleanupState(state)
+	if drainCleanup {
+		state.drainCleanupScheduled = true
+	}
+	s.mu.Unlock()
+	if drainCleanup {
+		go s.cleanupDrainedSession(request.RuntimeSessionID, state)
+	}
+	writeJSON(w, http.StatusCreated, harnessv2.CreateRuntimeSessionResponse{
+		Protocol:       harnessv2.ProtocolVersion,
+		Classification: harnessv2.Classification{Class: harnessv2.RequestClassificationFresh},
+		Session:        descriptor,
+	})
+}
+
+func (s *Server) createSession(
+	ctx context.Context,
+	request harnessv2.CreateRuntimeSessionRequest,
+	now time.Time,
+	uid int,
+	gid int,
+) (*acp.RuntimeSession, harnessv2.RuntimeSessionDescriptor, acp.SessionPaths, *workspacedelta.Snapshot, *providerProxySession, *mcpProxySession, error) {
+	pathID := sessionPathID(request.Metadata.Fence.RuntimeSessionUID, request.Metadata.Fence.RuntimeSessionGeneration)
+	paths, err := acp.PrepareSessionPaths(s.cfg.SessionBaseDir, pathID)
+	if err != nil {
+		return nil, harnessv2.RuntimeSessionDescriptor{}, acp.SessionPaths{}, nil, nil, nil, sessionCreationFailed("path preparation", err)
+	}
+	cleanup := true
+	defer func() {
+		if cleanup {
+			_ = os.RemoveAll(paths.Root)
+		}
+	}()
+	if err := s.cfg.WorkspaceMaterializer.Materialize(ctx, request, paths.Workspace); err != nil {
+		return nil, harnessv2.RuntimeSessionDescriptor{}, acp.SessionPaths{}, nil, nil, nil, sessionCreationFailed("workspace materialization", err)
+	}
+	baseline, err := workspacedelta.Capture(paths.Workspace, s.cfg.DeltaOptions)
+	if err != nil {
+		return nil, harnessv2.RuntimeSessionDescriptor{}, acp.SessionPaths{}, nil, nil, nil, sessionCreationFailed("workspace baseline capture", err)
+	}
+	if s.cfg.Provider.PrepareSession != nil {
+		if err := s.cfg.Provider.PrepareSession(paths); err != nil {
+			return nil, harnessv2.RuntimeSessionDescriptor{}, acp.SessionPaths{}, nil, nil, nil, sessionCreationFailed("provider home preparation", err)
+		}
+	}
+	providerProxy, proxyBinding, err := s.providerProxy.newSession()
+	if err != nil {
+		return nil, harnessv2.RuntimeSessionDescriptor{}, acp.SessionPaths{}, nil, nil, nil, sessionCreationFailed("provider proxy setup", err)
+	}
+	cleanupProviderProxy := true
+	defer func() {
+		if cleanupProviderProxy {
+			providerProxy.close()
+		}
+	}()
+	mcpProxy, mcpServer, err := s.mcpProxy.newSession(request.Metadata.Fence, request.MCPConfiguration)
+	if err != nil {
+		return nil, harnessv2.RuntimeSessionDescriptor{}, acp.SessionPaths{}, nil, nil, nil, sessionCreationFailed("MCP proxy setup", err)
+	}
+	cleanupMCPProxy := true
+	defer func() {
+		if cleanupMCPProxy {
+			mcpProxy.close()
+		}
+	}()
+	projection := ProviderSessionProjection{}
+	if s.cfg.Provider.ProjectSession != nil {
+		projection, err = s.cfg.Provider.ProjectSession(request, paths, proxyBinding)
+		if err != nil {
+			return nil, harnessv2.RuntimeSessionDescriptor{}, acp.SessionPaths{}, nil, nil, nil, sessionCreationFailed("provider session projection", err)
+		}
+	}
+	envValues := cloneStringMap(s.cfg.Provider.Environment)
+	if s.cfg.Provider.EnvironmentForSession != nil {
+		values, envErr := s.cfg.Provider.EnvironmentForSession(request, paths, proxyBinding)
+		if envErr != nil {
+			return nil, harnessv2.RuntimeSessionDescriptor{}, acp.SessionPaths{}, nil, nil, nil, sessionCreationFailed("provider environment setup", envErr)
+		}
+		maps.Copy(envValues, values)
+	}
+	maps.Copy(envValues, projection.Environment)
+	if err := acp.FinalizeSessionOwnership(paths.Root, uid, gid); err != nil {
+		return nil, harnessv2.RuntimeSessionDescriptor{}, acp.SessionPaths{}, nil, nil, nil, sessionCreationFailed("ownership finalization", err)
+	}
+	environment, err := acp.BuildChildEnvironment(paths, acp.EnvironmentConfig{Values: envValues})
+	if err != nil {
+		return nil, harnessv2.RuntimeSessionDescriptor{}, acp.SessionPaths{}, nil, nil, nil, sessionCreationFailed("provider environment setup", err)
+	}
+	runtimeSession, err := acp.NewRuntimeSession(ctx, acp.RuntimeSessionConfig{
+		ID:            string(request.RuntimeSessionID),
+		Generation:    int64(request.Metadata.Fence.RuntimeSessionGeneration),
+		ProfileDigest: string(request.Metadata.Fence.RuntimeProfileDigest),
+		Process: acp.ProcessConfig{
+			Command:       s.cfg.Provider.Command,
+			Args:          append(append([]string(nil), s.cfg.Provider.Args...), projection.AdditionalArgs...),
+			Environment:   environment,
+			Paths:         paths,
+			UID:           uid,
+			GID:           gid,
+			ClientOptions: acp.Options{MaxMessageBytes: s.cfg.Capabilities.Limits.MaxRequestBytes},
+		},
+		MCPServers:        []acp.MCPServer{mcpServer},
+		NewSessionMeta:    projection.NewSessionMeta,
+		AuthMethodID:      s.cfg.Provider.AuthMethodID,
+		InitializeTimeout: defaultDuration(s.cfg.InitializeTimeout, acp.DefaultInitializeTimeout),
+		PromptLease:       time.Duration(s.cfg.Capabilities.Limits.MaxPromptLeaseMillis) * time.Millisecond,
+		PermissionTimeout: defaultDuration(s.cfg.PermissionTimeout, acp.DefaultPermissionTimeout),
+		CancelGrace:       defaultDuration(s.cfg.CancelGrace, acp.DefaultStopGrace),
+		MaxBufferedEvents: s.cfg.Capabilities.Limits.MaxBufferedEvents,
+	})
+	if err != nil {
+		return nil, harnessv2.RuntimeSessionDescriptor{}, acp.SessionPaths{}, nil, nil, nil, sessionCreationFailed("provider adapter initialization", err)
+	}
+	cleanup = false
+	cleanupProviderProxy = false
+	cleanupMCPProxy = false
+	descriptor := harnessv2.RuntimeSessionDescriptor{
+		RuntimeSessionID:     request.RuntimeSessionID,
+		RuntimeSessionUID:    request.Metadata.Fence.RuntimeSessionUID,
+		Generation:           request.Metadata.Fence.RuntimeSessionGeneration,
+		RuntimeInstanceID:    s.cfg.Fence.RuntimeInstanceID,
+		SupervisorBootID:     s.cfg.Fence.SupervisorBootID,
+		RuntimeProfileDigest: s.cfg.Fence.RuntimeProfileDigest,
+		State:                harnessv2.RuntimeSessionStateIdle,
+		ProviderSessionID:    runtimeSession.ProviderSessionID(),
+		WorkspaceBaseline:    request.Workspace.Baseline,
+		CreatedAt:            now,
+		LastTransitionAt:     now,
+	}
+	return runtimeSession, descriptor, paths, baseline, providerProxy, mcpProxy, nil
+}
+
+func (s *Server) authorizeController(w http.ResponseWriter, r *http.Request) bool {
+	if !s.cfg.bearerMatches(r.Header.Get("Authorization")) {
+		writeError(w, http.StatusUnauthorized, harnessv2.ErrorCodeUnauthenticated, "controller authentication failed", nil, false)
+		return false
+	}
+	return true
+}
+
+func (s *Server) authorizeMutation(w http.ResponseWriter, r *http.Request, metadata harnessv2.MutationMetadata, requireSession bool) bool {
+	if !s.authorizeController(w, r) {
+		return false
+	}
+	if !s.cfg.RequireCapabilities {
+		return true
+	}
+	if err := harnessv2.VerifyOperationCapability(s.cfg.CapabilitySecret, r.Header.Get(OperationCapabilityHeader), metadata, requireSession, time.Now().UTC()); err != nil {
+		writeError(w, http.StatusForbidden, harnessv2.ErrorCodeForbidden, "operation capability authorization failed", nil, false)
+		return false
+	}
+	return true
+}
+
+func (s *Server) expectedFence(sessionUID harnessv2.RuntimeSessionUID, generation uint64) harnessv2.Fence {
+	fence := s.cfg.Fence
+	fence.RuntimeSessionUID = sessionUID
+	fence.RuntimeSessionGeneration = generation
+	return fence
+}
+
+func (s *Server) decodeMutation(w http.ResponseWriter, r *http.Request, target any, requireSession bool, _ harnessv2.MutationMetadata) bool {
+	_ = requireSession
+	return decodeJSON(w, r, s.cfg.Capabilities.Limits.MaxRequestBytes, target)
+}
+
+func decodeJSON(w http.ResponseWriter, r *http.Request, limit int, target any) bool {
+	body := http.MaxBytesReader(w, r.Body, int64(limit))
+	defer body.Close() //nolint:errcheck
+	decoder := json.NewDecoder(body)
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(target); err != nil {
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, "invalid JSON request", nil, false)
+		return false
+	}
+	var extra any
+	if err := decoder.Decode(&extra); !errors.Is(err, io.EOF) {
+		writeError(w, http.StatusBadRequest, harnessv2.ErrorCodeInvalidRequest, "request contains trailing or invalid JSON", nil, false)
+		return false
+	}
+	return true
+}
+
+func writeJSON(w http.ResponseWriter, status int, value any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(value)
+}
+
+func writeError(w http.ResponseWriter, status int, code harnessv2.ErrorCode, message string, classification *harnessv2.Classification, retryable bool) {
+	writeJSON(w, status, harnessv2.ErrorResponse{
+		Protocol: harnessv2.ProtocolVersion, Code: code, Message: message, Classification: classification, Retryable: retryable,
+	})
+}
+
+func writeClassificationError(w http.ResponseWriter, classification harnessv2.Classification) {
+	status := classification.HTTPStatus()
+	code := harnessv2.ErrorCodeInvalidRequest
+	switch classification.Class {
+	case harnessv2.RequestClassificationDigestConflict:
+		code = harnessv2.ErrorCodeDigestConflict
+	case harnessv2.RequestClassificationStaleFence:
+		code = harnessv2.ErrorCodeStaleFence
+	case harnessv2.RequestClassificationExpired:
+		code = harnessv2.ErrorCodeExpired
+	case harnessv2.RequestClassificationAlreadyAccepted:
+		code = harnessv2.ErrorCodeAlreadyAccepted
+	case harnessv2.RequestClassificationSettled:
+		code = harnessv2.ErrorCodeSettled
+	case harnessv2.RequestClassificationDuplicate:
+		status = http.StatusConflict
+	}
+	if status == 0 {
+		status = http.StatusConflict
+	}
+	writeError(w, status, code, string(classification.Class), &classification, false)
+}
+
+func operationRecord(metadata harnessv2.MutationMetadata, phase harnessv2.OperationPhase, terminal harnessv2.EventType, now time.Time) harnessv2.OperationRecord {
+	return harnessv2.OperationRecord{
+		OperationID: metadata.OperationID, RequestDigest: metadata.RequestDigest, Phase: phase,
+		TerminalEvent: terminal, RecordedAt: now, UpdatedAt: now,
+	}
+}
+
+func operationPtr(records map[harnessv2.OperationID]harnessv2.OperationRecord, id harnessv2.OperationID) *harnessv2.OperationRecord {
+	record, ok := records[id]
+	if !ok {
+		return nil
+	}
+	return &record
+}
+
+func sessionPathID(uid harnessv2.RuntimeSessionUID, generation uint64) string {
+	sum := sha256.Sum256(fmt.Appendf(nil, "%s:%d", uid, generation))
+	return "session-" + hex.EncodeToString(sum[:])
+}
+
+func cloneStringMap(input map[string]string) map[string]string {
+	result := make(map[string]string, len(input))
+	maps.Copy(result, input)
+	return result
+}
+
+func defaultDuration(value, fallback time.Duration) time.Duration {
+	if value > 0 {
+		return value
+	}
+	return fallback
+}
+
+func safeError(err error) string {
+	var creation *sessionCreationError
+	if errors.As(err, &creation) {
+		return "runtime session failed during " + creation.stage
+	}
+	return "runtime operation failed; consult bounded supervisor diagnostics"
+}
+
+func liveDescendantCount(runtime *acp.RuntimeSession) uint32 {
+	if runtime == nil || runtime.Process() == nil || runtime.Process().PID() <= 0 {
+		return 0
+	}
+	select {
+	case <-runtime.Process().Done():
+		return 0
+	default:
+		return 1
+	}
+}
+
+func totalLiveDescendants(sessions []harnessv2.RuntimeSessionStatus) uint32 {
+	var total uint32
+	for _, session := range sessions {
+		total += session.LiveDescendantCount
+	}
+	return total
+}
+
+func (s *Server) sessionIdentityCapacity() *harnessv2.SessionIdentityCapacity {
+	return &harnessv2.SessionIdentityCapacity{
+		Total:             uint64(s.cfg.UIDAllocator.Capacity()),
+		Remaining:         uint64(s.cfg.UIDAllocator.Remaining()),
+		ExhaustionReserve: sessionIdentityExhaustionReserve,
+	}
+}
+
+func (s *Server) beginDrainLocked(reason string, now time.Time) []drainCleanupCandidate {
+	if !s.drain.Requested {
+		s.drain = harnessv2.DrainStatus{
+			AcceptingNewSessions: false,
+			Requested:            true,
+			RequestedAt:          now,
+			Reason:               reason,
+		}
+		s.lifecycle = harnessv2.SupervisorLifecycleDraining
+	}
+	cleanup := make([]drainCleanupCandidate, 0, len(s.sessions))
+	for id, state := range s.sessions {
+		if state.creating || state.drainCleanupScheduled || !isDrainCleanupState(state) {
+			continue
+		}
+		state.drainCleanupScheduled = true
+		cleanup = append(cleanup, drainCleanupCandidate{id: id, state: state})
+	}
+	return cleanup
+}
+
+func (s *Server) startDrainCleanup(cleanup []drainCleanupCandidate) {
+	for _, candidate := range cleanup {
+		go s.cleanupDrainedSession(candidate.id, candidate.state)
+	}
+}
+
+func isDrainCleanupState(state *sessionState) bool {
+	if state == nil {
+		return false
+	}
+	switch state.descriptor.State {
+	case harnessv2.RuntimeSessionStateIdle, harnessv2.RuntimeSessionStatePoisoned, harnessv2.RuntimeSessionStatePublicationPrepared:
+		return true
+	case harnessv2.RuntimeSessionStateFinalizing:
+		return state.publicationFinalization != nil
+	default:
+		return false
+	}
+}
+
+func (s *Server) cleanupDrainedSession(sessionID harnessv2.RuntimeSessionID, state *sessionState) {
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	s.mu.Lock()
+	if s.sessions[sessionID] != state || !state.drainCleanupScheduled {
+		s.mu.Unlock()
+		return
+	}
+	settled := state.prompt == nil || state.prompt.settlement != nil
+	if state.creating || state.runtime == nil || !settled || !isDrainCleanupState(state) {
+		state.drainCleanupScheduled = false
+		s.mu.Unlock()
+		return
+	}
+	state.descriptor.State = harnessv2.RuntimeSessionStateDeleting
+	state.descriptor.LastTransitionAt = time.Now().UTC()
+	s.mu.Unlock()
+	if state.mcpProxy != nil {
+		state.mcpProxy.close()
+	}
+	var proxyErr error
+	if state.providerProxy != nil {
+		state.providerProxy.close()
+		proxyErr = state.providerProxy.wait(ctx)
+	}
+	cleanup, deleteErr := state.runtime.Delete(ctx)
+	if proxyErr != nil || deleteErr != nil || !cleanup.Proven {
+		s.poisonPool("drain_session_cleanup_unproven")
+		return
+	}
+	if err := acp.ReclaimSessionOwnership(state.paths.Root); err != nil {
+		slog.Error("ACP drained runtime session cleanup failed", "stage", "ownership reclaim")
+		s.poisonPool("drain_session_root_ownership_reclaim_unproven")
+		return
+	}
+	if err := os.RemoveAll(state.paths.Root); err != nil {
+		s.poisonPool("drain_session_root_cleanup_unproven")
+		return
+	}
+	deletedAt := time.Now().UTC()
+	s.mu.Lock()
+	if s.sessions[sessionID] == state {
+		operations := make([]harnessv2.OperationRecord, 0, len(state.operations))
+		for _, operation := range state.operations {
+			operations = append(operations, operation)
+		}
+		tombstone := harnessv2.RuntimeSessionTombstone{
+			RuntimeSessionUID: state.descriptor.RuntimeSessionUID, RuntimeSessionGeneration: state.descriptor.Generation,
+			RuntimeProfileDigest: state.descriptor.RuntimeProfileDigest, DeletedAt: deletedAt, Operations: operations,
+		}
+		delete(s.sessions, sessionID)
+		s.tombstones[tombstone.RuntimeSessionUID] = tombstone
+	}
+	s.mu.Unlock()
+}
+
+// Close stops admission and tears down all resident runtime sessions. A cleanup
+// failure is returned so the caller can poison/restart the enclosing RuntimePool.
+func (s *Server) Close(ctx context.Context) error {
+	s.mu.Lock()
+	s.lifecycle = harnessv2.SupervisorLifecycleTerminating
+	s.drain.AcceptingNewSessions = false
+	sessions := make([]*sessionState, 0, len(s.sessions))
+	for _, state := range s.sessions {
+		if state.runtime != nil || state.providerProxy != nil || state.mcpProxy != nil {
+			sessions = append(sessions, state)
+		}
+	}
+	s.mu.Unlock()
+	var errs []error
+	for _, state := range sessions {
+		if state.mcpProxy != nil {
+			state.mcpProxy.close()
+		}
+		if state.providerProxy != nil {
+			state.providerProxy.close()
+			if err := state.providerProxy.wait(ctx); err != nil {
+				errs = append(errs, fmt.Errorf("provider proxy session cleanup: %w", err))
+			}
+		}
+		if state.runtime != nil {
+			cleanup, err := state.runtime.Delete(ctx)
+			if err != nil || !cleanup.Proven {
+				errs = append(errs, fmt.Errorf("runtime session cleanup unproven: %w", err))
+			} else if err := acp.ReclaimSessionOwnership(state.paths.Root); err != nil {
+				errs = append(errs, fmt.Errorf("runtime session filesystem ownership reclaim: %w", err))
+			} else if err := os.RemoveAll(state.paths.Root); err != nil {
+				errs = append(errs, fmt.Errorf("runtime session filesystem cleanup: %w", err))
+			}
+		}
+	}
+	if err := s.providerProxy.close(ctx); err != nil {
+		errs = append(errs, fmt.Errorf("provider proxy shutdown: %w", err))
+	}
+	if err := s.mcpProxy.close(ctx); err != nil {
+		errs = append(errs, fmt.Errorf("MCP proxy shutdown: %w", err))
+	}
+	if s.identityLock != nil {
+		if err := s.identityLock.Close(); err != nil {
+			errs = append(errs, fmt.Errorf("session identity lock shutdown: %w", err))
+		}
+		s.identityLock = nil
+	}
+	return errors.Join(errs...)
+}
+
+func (s *Server) poisonPool(reason string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	for _, state := range s.sessions {
+		if state.providerProxy != nil {
+			state.providerProxy.revoke()
+		}
+		if state.mcpProxy != nil {
+			state.mcpProxy.revoke(harnessv2.RuntimeSessionStatePoisoned)
+		}
+	}
+	s.lifecycle = harnessv2.SupervisorLifecycleUnhealthy
+	s.drain = harnessv2.DrainStatus{AcceptingNewSessions: false, Requested: true, RequestedAt: time.Now().UTC(), Reason: reason}
+}
+
+func (s *Server) BeginDrain(reason string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.drain.Requested {
+		return
+	}
+	s.drain = harnessv2.DrainStatus{
+		AcceptingNewSessions: false,
+		Requested:            true,
+		RequestedAt:          time.Now().UTC(),
+		Reason:               reason,
+	}
+	s.lifecycle = harnessv2.SupervisorLifecycleDraining
+}
diff --git a/workers/acp/supervisor/server_test.go b/workers/acp/supervisor/server_test.go
new file mode 100644
index 000000000..f0c5e3d97
--- /dev/null
+++ b/workers/acp/supervisor/server_test.go
@@ -0,0 +1,1597 @@
+package supervisor
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/orka-agents/orka/internal/acp"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+const supervisorUpstreamTokenCanary = "supervisor-only-upstream-token-canary"
+const testJSONRPCVersion = "2.0"
+const testJSONRPCKey = "jsonrpc"
+const linuxGOOS = "linux"
+
+const providerProxyCanaryMode = "provider-proxy-canary"
+const providerProjectionCanaryMode = "provider-projection-canary"
+const providerProjectionCanaryValue = "projected"
+const assistantBurstMode = "assistant-burst"
+const toolBurstRPCErrorMode = "tool-burst-rpc-error"
+const testPromptOneID = "prompt-1"
+const testPromptTwoID = "prompt-2"
+const testPromptOperationTwo = "prompt-operation-2"
+
+func TestSafeErrorExposesOnlySessionCreationStage(t *testing.T) {
+	t.Parallel()
+	const secret = "provider-secret-must-not-leak"
+	staged := sessionCreationFailed("workspace materialization", errors.New(secret))
+	if stage := sessionCreationStage(staged); stage != "workspace materialization" {
+		t.Fatalf("session creation stage = %q", stage)
+	}
+	got := safeError(staged)
+	if got != "runtime session failed during workspace materialization" {
+		t.Fatalf("safe staged error = %q", got)
+	}
+	if strings.Contains(got, secret) {
+		t.Fatalf("safe staged error leaked raw cause: %q", got)
+	}
+	generic := safeError(errors.New(secret))
+	if generic != "runtime operation failed; consult bounded supervisor diagnostics" || strings.Contains(generic, secret) {
+		t.Fatalf("generic safe error = %q", generic)
+	}
+}
+
+func TestSupervisorCreateAndPrompt(t *testing.T) {
+	server, cfg, profile := newTestServer(t, "immediate")
+	create := testCreateSessionRequest(t, cfg, profile)
+	response := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1", create, cfg)
+	if response.Code != http.StatusCreated {
+		t.Fatalf("create status = %d body=%s", response.Code, response.Body.String())
+	}
+	var created harnessv2.CreateRuntimeSessionResponse
+	if err := json.Unmarshal(response.Body.Bytes(), &created); err != nil {
+		t.Fatal(err)
+	}
+	if err := created.ValidateFor(create); err != nil {
+		t.Fatalf("create response validation: %v", err)
+	}
+
+	prompt := testStartPromptRequest(t, cfg, create.Metadata.Fence)
+	response = performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1/prompts/prompt-1", prompt, cfg)
+	if response.Code != http.StatusOK {
+		t.Fatalf("prompt status = %d body=%s", response.Code, response.Body.String())
+	}
+	decoder, err := harnessv2.NewEventDecoder(bytes.NewReader(response.Body.Bytes()), eventLimits(cfg.Capabilities.Limits), harnessv2.EventExpectationFromMetadata(prompt.Metadata))
+	if err != nil {
+		t.Fatal(err)
+	}
+	events, err := decoder.DecodeAll()
+	if err != nil {
+		t.Fatalf("decode prompt events: %v\n%s", err, response.Body.String())
+	}
+	if len(events) != 3 || events[0].Type != harnessv2.EventAccepted || events[1].Type != harnessv2.EventUpdate || events[2].Type != harnessv2.EventCompleted {
+		t.Fatalf("unexpected event sequence: %#v", events)
+	}
+	if got := events[2].Completed.Result.Content[0].Text; got != "hello from ACP" {
+		t.Fatalf("result text = %q", got)
+	}
+
+	statusReq := httptest.NewRequest(http.MethodGet, harnessv2.StatusPath, nil)
+	statusReq.Header.Set("Authorization", "Bearer "+cfg.ControllerBearerToken)
+	statusResponse := httptest.NewRecorder()
+	server.Handler().ServeHTTP(statusResponse, statusReq)
+	if statusResponse.Code != http.StatusOK {
+		t.Fatalf("status = %d body=%s", statusResponse.Code, statusResponse.Body.String())
+	}
+	var status harnessv2.StatusResponse
+	if err := json.Unmarshal(statusResponse.Body.Bytes(), &status); err != nil {
+		t.Fatal(err)
+	}
+	if err := status.Validate(); err != nil {
+		t.Fatalf("status response validation: %v", err)
+	}
+	if len(status.Sessions) != 1 || status.Sessions[0].State != harnessv2.RuntimeSessionStateValidating {
+		t.Fatalf("unexpected session status: %#v", status.Sessions)
+	}
+}
+
+func TestSupervisorCompactsAssistantBurstBeforeHarnessRateLimit(t *testing.T) {
+	server, cfg, profile := newTestServer(t, assistantBurstMode)
+	server.cfg.Capabilities.Limits.MaxBufferedEvents = 2048
+	cfg.Capabilities.Limits.MaxBufferedEvents = 2048
+	create := testCreateSessionRequest(t, cfg, profile)
+	response := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1", create, cfg)
+	if response.Code != http.StatusCreated {
+		t.Fatalf("create status = %d body=%s", response.Code, response.Body.String())
+	}
+
+	prompt := testStartPromptRequest(t, cfg, create.Metadata.Fence)
+	response = performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1/prompts/prompt-1", prompt, cfg)
+	if response.Code != http.StatusOK {
+		t.Fatalf("prompt status = %d body=%s", response.Code, response.Body.String())
+	}
+	decoder, err := harnessv2.NewEventDecoder(
+		bytes.NewReader(response.Body.Bytes()), eventLimits(cfg.Capabilities.Limits),
+		harnessv2.EventExpectationFromMetadata(prompt.Metadata),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	events, err := decoder.DecodeAll()
+	if err != nil {
+		t.Fatalf("decode compacted prompt events: %v", err)
+	}
+	if len(events) < 3 || events[0].Type != harnessv2.EventAccepted ||
+		events[len(events)-1].Type != harnessv2.EventCompleted {
+		t.Fatalf("unexpected compacted event sequence: %#v", events)
+	}
+	var streamed strings.Builder
+	for index, event := range events {
+		if event.Identity.Sequence != uint64(index+1) {
+			t.Fatalf("event %d sequence = %d, want %d", index, event.Identity.Sequence, index+1)
+		}
+		if event.Type == harnessv2.EventUpdate && event.Update != nil && event.Update.AssistantMessage != nil {
+			streamed.WriteString(event.Update.AssistantMessage.Text)
+		}
+	}
+	want := strings.Repeat("x", runtimeCodexMaxUpdateEventsPerSecond+1)
+	if streamed.String() != want {
+		t.Fatalf("streamed assistant bytes = %d, want %d exact bytes", streamed.Len(), len(want))
+	}
+	terminal := events[len(events)-1].Completed
+	if terminal == nil || len(terminal.Result.Content) != 1 || terminal.Result.Content[0].Text != want {
+		t.Fatalf("terminal result did not preserve the exact assistant burst")
+	}
+}
+
+func TestSupervisorProjectsRPCFailureAfterToolOutputBurst(t *testing.T) {
+	server, cfg, profile := newTestServer(t, toolBurstRPCErrorMode)
+	server.cfg.Capabilities.Limits.MaxBufferedEvents = 2048
+	server.cfg.Capabilities.Limits.MaxUpdateEventsPerSecond = 2
+	cfg.Capabilities.Limits.MaxBufferedEvents = 2048
+	cfg.Capabilities.Limits.MaxUpdateEventsPerSecond = 2
+	create := testCreateSessionRequest(t, cfg, profile)
+	response := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1", create, cfg)
+	if response.Code != http.StatusCreated {
+		t.Fatalf("create status = %d body=%s", response.Code, response.Body.String())
+	}
+
+	prompt := testStartPromptRequest(t, cfg, create.Metadata.Fence)
+	response = performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1/prompts/prompt-1", prompt, cfg)
+	if response.Code != http.StatusOK {
+		t.Fatalf("prompt status = %d body=%s", response.Code, response.Body.String())
+	}
+	if strings.Contains(response.Body.String(), "provider-secret-must-not-leak") {
+		t.Fatalf("prompt response leaked provider error detail: %s", response.Body.String())
+	}
+	decoder, err := harnessv2.NewEventDecoder(
+		bytes.NewReader(response.Body.Bytes()), eventLimits(cfg.Capabilities.Limits),
+		harnessv2.EventExpectationFromMetadata(prompt.Metadata),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	events, err := decoder.DecodeAll()
+	if err != nil {
+		t.Fatalf("decode failed prompt events: %v\n%s", err, response.Body.String())
+	}
+	if len(events) != 4 || events[0].Type != harnessv2.EventAccepted ||
+		events[1].Type != harnessv2.EventUpdate || events[1].Update == nil ||
+		events[1].Update.Kind != harnessv2.UpdateToolCall ||
+		events[2].Type != harnessv2.EventUpdate || events[2].Update == nil ||
+		events[2].Update.Kind != harnessv2.UpdateToolCallUpdate ||
+		events[3].Type != harnessv2.EventFailed || events[3].Failed == nil {
+		t.Fatalf("unexpected failed prompt event sequence: %#v", events)
+	}
+	for index, event := range events {
+		if event.Identity.Sequence != uint64(index+1) {
+			t.Fatalf("event %d sequence = %d, want %d", index, event.Identity.Sequence, index+1)
+		}
+	}
+	if events[1].Update.ToolCall == nil ||
+		events[1].Update.ToolCall.Status != harnessv2.ToolCallStatusPending ||
+		events[2].Update.ToolCall == nil ||
+		events[2].Update.ToolCall.Status != harnessv2.ToolCallStatusCompleted {
+		t.Fatalf("tool lifecycle events = %#v / %#v", events[1].Update, events[2].Update)
+	}
+	if events[3].Failed.Code != "acp_prompt_failed" || events[3].Failed.Retryable {
+		t.Fatalf("RPC failure terminal = %#v", events[3].Failed)
+	}
+}
+
+func TestSupervisorWaitsForAgentConfigurationCapableController(t *testing.T) {
+	server, cfg, profile := newTestServer(t, "immediate")
+	create := testCreateSessionRequest(t, cfg, profile)
+	create.AgentConfiguration = nil
+	create.Metadata.RequestDigest = ""
+	sealRequest(t, &create.Metadata.RequestDigest, create)
+	response := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1", create, cfg)
+	if response.Code != http.StatusTooManyRequests || !strings.Contains(response.Body.String(), string(harnessv2.ErrorCodeRateLimited)) {
+		t.Fatalf("legacy controller create status = %d body=%s", response.Code, response.Body.String())
+	}
+	server.mu.Lock()
+	defer server.mu.Unlock()
+	if len(server.sessions) != 0 {
+		t.Fatalf("legacy controller request created sessions: %#v", server.sessions)
+	}
+}
+
+func TestSupervisorProviderSessionProjection(t *testing.T) {
+	server, cfg, profile := newTestServer(t, providerProjectionCanaryMode)
+	create := testCreateSessionRequest(t, cfg, profile)
+	response := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1", create, cfg)
+	if response.Code != http.StatusCreated {
+		t.Fatalf("create status = %d body=%s", response.Code, response.Body.String())
+	}
+}
+
+func TestSupervisorProviderProxyCanary(t *testing.T) {
+	type observedRequest struct {
+		path   string
+		query  string
+		header http.Header
+		body   string
+	}
+	observed := make(chan observedRequest, 1)
+	release := make(chan struct{})
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		body, _ := io.ReadAll(r.Body)
+		observed <- observedRequest{path: r.URL.Path, query: r.URL.RawQuery, header: r.Header.Clone(), body: string(body)}
+		<-release
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = io.WriteString(w, `{"ok":true}`)
+	}))
+	defer upstream.Close()
+	server, cfg, profile := newTestServerWithUpstream(t, providerProxyCanaryMode, upstream.URL+"/v1", supervisorUpstreamTokenCanary)
+	create := testCreateSessionRequest(t, cfg, profile)
+	response := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1", create, cfg)
+	if response.Code != http.StatusCreated {
+		t.Fatalf("create status = %d body=%s", response.Code, response.Body.String())
+	}
+
+	server.mu.Lock()
+	state := server.sessions[create.RuntimeSessionID]
+	if state == nil || state.providerProxy == nil {
+		server.mu.Unlock()
+		t.Fatal("runtime session omitted its provider proxy binding")
+	}
+	baseURL := state.providerProxy.baseURL
+	localCredential := string(append([]byte(nil), state.providerProxy.credential...))
+	server.mu.Unlock()
+
+	idle := doProviderProxyRequest(t, http.MethodPost, baseURL+"/responses", localCredential, []byte(`{}`), nil)
+	if idle.StatusCode != http.StatusForbidden {
+		t.Fatalf("idle provider request status = %d, want %d", idle.StatusCode, http.StatusForbidden)
+	}
+	_ = idle.Body.Close()
+	select {
+	case request := <-observed:
+		t.Fatalf("idle ACP child provider request reached upstream: %#v", request)
+	default:
+	}
+
+	prompt := testStartPromptRequest(t, cfg, create.Metadata.Fence)
+	promptRequest := mutationHTTPRequest(t, http.MethodPut, "/v2/runtime-sessions/session-1/prompts/prompt-1", prompt, cfg)
+	promptResponse := httptest.NewRecorder()
+	promptDone := make(chan struct{})
+	go func() {
+		server.Handler().ServeHTTP(promptResponse, promptRequest)
+		close(promptDone)
+	}()
+
+	var upstreamRequest observedRequest
+	select {
+	case upstreamRequest = <-observed:
+	case <-time.After(5 * time.Second):
+		t.Fatal("ACP child did not reach provider upstream during active prompt")
+	}
+	if upstreamRequest.path != providerOpenAIResponsesV1Path || upstreamRequest.query != "from=acp-child" || upstreamRequest.body != `{"model":"test-model","canary":true}` {
+		t.Fatalf("unexpected provider upstream request: %#v", upstreamRequest)
+	}
+	if got := upstreamRequest.header.Get(providerAuthorizationHeader); got != "Bearer "+supervisorUpstreamTokenCanary {
+		t.Fatalf("upstream authorization = %q", got)
+	}
+	for _, name := range []string{
+		providerAPIKeyHeader, providerCookieHeader, providerProxyAuthorizationHeader,
+		providerForwardedForHeader, "X-Child-Secret",
+	} {
+		if value := upstreamRequest.header.Get(name); value != "" {
+			t.Fatalf("child-local sensitive header %s reached upstream: %q", name, value)
+		}
+	}
+	if upstreamRequest.header.Get("X-Canary-Safe") != "preserved" {
+		t.Fatalf("safe child header missing upstream: %v", upstreamRequest.header)
+	}
+	close(release)
+	select {
+	case <-promptDone:
+	case <-time.After(5 * time.Second):
+		t.Fatal("prompt did not settle after provider response")
+	}
+	if promptResponse.Code != http.StatusOK {
+		t.Fatalf("prompt status = %d body=%s", promptResponse.Code, promptResponse.Body.String())
+	}
+
+	server.mu.Lock()
+	if state.descriptor.State != harnessv2.RuntimeSessionStateValidating || state.prompt == nil || state.prompt.settlement == nil {
+		server.mu.Unlock()
+		t.Fatalf("unexpected post-terminal session state: %#v", state.descriptor)
+	}
+	server.mu.Unlock()
+	late := doProviderProxyRequest(t, http.MethodPost, baseURL+"/responses", localCredential, []byte(`{}`), nil)
+	if late.StatusCode != http.StatusForbidden {
+		t.Fatalf("post-terminal provider request status = %d, want %d", late.StatusCode, http.StatusForbidden)
+	}
+	_ = late.Body.Close()
+
+	server.poisonSession(state, "test")
+	poisoned := doProviderProxyRequest(t, http.MethodPost, baseURL+"/responses", localCredential, []byte(`{}`), nil)
+	if poisoned.StatusCode != http.StatusForbidden && poisoned.StatusCode != http.StatusNotFound {
+		t.Fatalf("poisoned provider request status = %d, want %d or %d", poisoned.StatusCode, http.StatusForbidden, http.StatusNotFound)
+	}
+	_ = poisoned.Body.Close()
+	select {
+	case request := <-observed:
+		t.Fatalf("post-terminal or poisoned request reached upstream: %#v", request)
+	default:
+	}
+}
+
+func TestSupervisorConcurrentLeaseRenewalHasSingleWinner(t *testing.T) {
+	server, cfg, profile := newTestServer(t, "wait")
+	create := testCreateSessionRequest(t, cfg, profile)
+	response := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1", create, cfg)
+	if response.Code != http.StatusCreated {
+		t.Fatalf("create status = %d body=%s", response.Code, response.Body.String())
+	}
+	server.mu.Lock()
+	providerProxy := server.sessions[create.RuntimeSessionID].providerProxy
+	baseURL := providerProxy.baseURL
+	localCredential := string(append([]byte(nil), providerProxy.credential...))
+	server.mu.Unlock()
+	prompt := testStartPromptRequest(t, cfg, create.Metadata.Fence)
+	promptContext, cancelPrompt := context.WithCancel(context.Background())
+	promptRequest := mutationHTTPRequest(
+		t, http.MethodPut, "/v2/runtime-sessions/session-1/prompts/prompt-1", prompt, cfg,
+	).WithContext(promptContext)
+	promptResponse := httptest.NewRecorder()
+	promptDone := make(chan struct{})
+	go func() {
+		server.Handler().ServeHTTP(promptResponse, promptRequest)
+		close(promptDone)
+	}()
+	deadline := time.Now().Add(5 * time.Second)
+	for {
+		select {
+		case <-promptDone:
+			t.Fatalf("prompt ended before renewal: status=%d body=%s", promptResponse.Code, promptResponse.Body.String())
+		default:
+		}
+		server.mu.Lock()
+		state := server.sessions[create.RuntimeSessionID]
+		running := state != nil && state.descriptor.State == harnessv2.RuntimeSessionStatePromptRunning
+		server.mu.Unlock()
+		if running {
+			break
+		}
+		if time.Now().After(deadline) {
+			cancelPrompt()
+			t.Fatal("prompt did not become active")
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+
+	issuedAt := time.Now().UTC()
+	lease := harnessv2.PromptLease{
+		Generation: 2, IssuedAt: issuedAt, ExpiresAt: prompt.Lease.ExpiresAt.Add(30 * time.Second),
+	}
+	requests := make([]*http.Request, 0, 2)
+	for _, operationID := range []string{"renew-a", "renew-b"} {
+		metadata := testMetadata(create.Metadata.Fence, operationID, true)
+		metadata.PromptID = prompt.Metadata.PromptID
+		metadata.ExpiresAt = issuedAt.Add(30 * time.Second)
+		authorization := prompt.MCPAuthorization
+		authorization.LeaseGeneration = lease.Generation
+		authorization.ExpiresAt = metadata.ExpiresAt
+		renew := harnessv2.RenewPromptLeaseRequest{
+			Protocol: harnessv2.ProtocolVersion, Metadata: metadata,
+			ExpectedLeaseGeneration: 1, Lease: lease, MCPAuthorization: authorization,
+		}
+		sealRequest(t, &renew.Metadata.RequestDigest, renew)
+		requests = append(requests, mutationHTTPRequest(
+			t, http.MethodPut, "/v2/runtime-sessions/session-1/prompts/prompt-1/lease", renew, cfg,
+		))
+	}
+	statuses := make(chan int, len(requests))
+	for _, request := range requests {
+		go func() {
+			recorder := httptest.NewRecorder()
+			server.Handler().ServeHTTP(recorder, request)
+			statuses <- recorder.Code
+		}()
+	}
+	winners := 0
+	for range requests {
+		if <-statuses == http.StatusOK {
+			winners++
+		}
+	}
+	if winners != 1 {
+		t.Fatalf("concurrent lease renewal winners = %d, want 1", winners)
+	}
+	cancelPrompt()
+	select {
+	case <-promptDone:
+	case <-time.After(5 * time.Second):
+		t.Fatal("prompt did not settle after request cancellation")
+	}
+	providerResponse := doProviderProxyRequest(t, http.MethodPost, baseURL+"/responses", localCredential, []byte(`{}`), nil)
+	defer providerResponse.Body.Close() //nolint:errcheck
+	if providerResponse.StatusCode != http.StatusForbidden && providerResponse.StatusCode != http.StatusNotFound {
+		t.Fatalf("post-cancellation provider proxy status = %d, want %d or %d", providerResponse.StatusCode, http.StatusForbidden, http.StatusNotFound)
+	}
+}
+
+func TestSupervisorRejectsMissingAuthAndTamperedCapability(t *testing.T) {
+	server, cfg, profile := newTestServer(t, "immediate")
+	create := testCreateSessionRequest(t, cfg, profile)
+	data, _ := json.Marshal(create)
+	req := httptest.NewRequest(http.MethodPut, "/v2/runtime-sessions/session-1", bytes.NewReader(data))
+	resp := httptest.NewRecorder()
+	server.Handler().ServeHTTP(resp, req)
+	if resp.Code != http.StatusUnauthorized {
+		t.Fatalf("missing auth status = %d", resp.Code)
+	}
+
+	req = httptest.NewRequest(http.MethodPut, "/v2/runtime-sessions/session-1", bytes.NewReader(data))
+	req.Header.Set("Authorization", "Bearer "+cfg.ControllerBearerToken)
+	req.Header.Set(OperationCapabilityHeader, "tampered")
+	resp = httptest.NewRecorder()
+	server.Handler().ServeHTTP(resp, req)
+	if resp.Code != http.StatusForbidden {
+		t.Fatalf("tampered capability status = %d body=%s", resp.Code, resp.Body.String())
+	}
+}
+
+func TestSupervisorMarksAggregateAssistantOverflowForTerminalFailure(t *testing.T) {
+	server, cfg, _ := newTestServer(t, "immediate")
+	server.cfg.Capabilities.Limits.MaxTerminalResultBytes = 10
+	fence := cfg.Fence
+	fence.RuntimeSessionUID = "session-uid"
+	fence.RuntimeSessionGeneration = 1
+	prompt := &promptState{request: testStartPromptRequest(t, cfg, fence)}
+	state := &sessionState{descriptor: harnessv2.RuntimeSessionDescriptor{
+		RuntimeSessionUID: fence.RuntimeSessionUID,
+		Generation:        fence.RuntimeSessionGeneration,
+	}}
+	event := func(text string) acp.PromptEvent {
+		update, err := json.Marshal(map[string]any{
+			"sessionUpdate": "agent_message_chunk",
+			"content":       map[string]any{"type": "text", "text": text},
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return acp.PromptEvent{
+			Type:      acp.PromptEventUpdate,
+			Timestamp: time.Now().UTC(),
+			Update:    &acp.SessionNotification{SessionID: "provider-session", Update: update},
+		}
+	}
+
+	for _, chunk := range []string{"12345", "67890"} {
+		if _, err := server.mapRuntimeEvent(state, prompt, event(chunk)); err != nil {
+			t.Fatalf("map chunk %q: %v", chunk, err)
+		}
+	}
+	if _, err := server.mapRuntimeEvent(state, prompt, event("x")); err != nil {
+		t.Fatalf("map overflow chunk: %v", err)
+	}
+	if got := prompt.assistant.String(); got != "1234567890" {
+		t.Fatalf("assistant result = %q, want bounded aggregate", got)
+	}
+	if !prompt.assistantOverflow {
+		t.Fatal("aggregate overflow was not retained for terminal failure")
+	}
+	if prompt.sequence != 3 {
+		t.Fatalf("sequence = %d, want 3 emitted updates", prompt.sequence)
+	}
+}
+
+func TestSupervisorUsesCodexFinalAnswerAsTerminalResult(t *testing.T) {
+	server, cfg, _ := newTestServer(t, "immediate")
+	server.cfg.Capabilities.Limits.MaxTerminalResultBytes = 4096
+	fence := cfg.Fence
+	fence.RuntimeSessionUID = "phase-session-uid"
+	fence.RuntimeSessionGeneration = 1
+	prompt := &promptState{request: testStartPromptRequest(t, cfg, fence)}
+	state := &sessionState{descriptor: harnessv2.RuntimeSessionDescriptor{
+		RuntimeSessionUID: fence.RuntimeSessionUID,
+		Generation:        fence.RuntimeSessionGeneration,
+	}}
+	now := time.Now().UTC()
+	events := []acp.PromptEvent{
+		testAssistantMessagePromptEventWithPhase(
+			t, 1, now, "commentary-message", acpAssistantPhaseCommentary, strings.Repeat("x", 4097),
+		),
+		testAssistantMessagePromptEventWithPhase(
+			t, 2, now.Add(time.Millisecond), "final-message", acpAssistantPhaseFinalAnswer, `{"schemaVersion":1,"ok":true}`,
+		),
+	}
+	for _, event := range events {
+		mapped, err := server.mapRuntimeEvent(state, prompt, event)
+		if err != nil {
+			t.Fatalf("map phased assistant event: %v", err)
+		}
+		if mapped == nil || mapped.Update == nil || mapped.Update.AssistantMessage == nil {
+			t.Fatalf("phased assistant event was not visible: %#v", mapped)
+		}
+	}
+	if !prompt.assistantOverflow || !prompt.finalAnswerSeen || prompt.finalAnswerOverflow {
+		t.Fatalf(
+			"prompt aggregation = assistantOverflow=%v finalSeen=%v finalOverflow=%v",
+			prompt.assistantOverflow, prompt.finalAnswerSeen, prompt.finalAnswerOverflow,
+		)
+	}
+	terminal, result, err := server.terminalEvent(state, prompt, acp.PromptResult{
+		Outcome: acp.PromptOutcomeCompleted, StopReason: acp.StopReasonEndTurn,
+		Accepted: true, SettledAt: now.Add(2 * time.Millisecond),
+	})
+	if err != nil {
+		t.Fatalf("build phased terminal result: %v", err)
+	}
+	if result.Outcome != acp.PromptOutcomeCompleted || terminal.Type != harnessv2.EventCompleted ||
+		terminal.Completed == nil || len(terminal.Completed.Result.Content) != 1 ||
+		terminal.Completed.Result.Content[0].Text != `{"schemaVersion":1,"ok":true}` {
+		t.Fatalf("phased terminal result = %#v settled=%#v", terminal, result)
+	}
+}
+
+func TestSupervisorDrainIsIdempotent(t *testing.T) {
+	server, cfg, _ := newTestServer(t, "immediate")
+	request := harnessv2.DrainRequest{Protocol: harnessv2.ProtocolVersion, Metadata: harnessv2.MutationMetadata{
+		Fence: cfg.Fence, OperationID: "drain-1", RequestDigestSchemaVersion: harnessv2.RequestDigestSchemaVersion,
+		ExpiresAt: time.Now().UTC().Add(time.Minute),
+	}, Reason: "test"}
+	sealRequest(t, &request.Metadata.RequestDigest, request)
+	first := performMutation(t, server.Handler(), http.MethodPut, harnessv2.DrainPath, request, cfg)
+	if first.Code != http.StatusOK {
+		t.Fatalf("drain status=%d body=%s", first.Code, first.Body.String())
+	}
+	second := performMutation(t, server.Handler(), http.MethodPut, harnessv2.DrainPath, request, cfg)
+	if second.Code != http.StatusOK {
+		t.Fatalf("duplicate drain status=%d body=%s", second.Code, second.Body.String())
+	}
+	var response harnessv2.DrainResponse
+	if err := json.Unmarshal(second.Body.Bytes(), &response); err != nil {
+		t.Fatal(err)
+	}
+	if response.Classification.Class != harnessv2.RequestClassificationDuplicate || response.Drain.AcceptingNewSessions {
+		t.Fatalf("unexpected duplicate drain response: %#v", response)
+	}
+}
+
+func TestSupervisorPreservesIdentityReserveAndClosesOnlySessionAdmission(t *testing.T) {
+	server, cfg, profile := newTestServer(t, "immediate")
+	uid, gid := os.Getuid(), os.Getgid()
+	if uid == 0 {
+		uid, gid = 65534, 65534
+	}
+	allocator, err := acp.NewUIDAllocator(uid, uid+1, gid)
+	if err != nil {
+		t.Fatal(err)
+	}
+	server.cfg.UIDAllocator = allocator
+
+	create := testCreateSessionRequest(t, cfg, profile)
+	response := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1", create, cfg)
+	if response.Code != http.StatusCreated {
+		t.Fatalf("create status=%d body=%s", response.Code, response.Body.String())
+	}
+	status := server.status()
+	if status.SessionIdentityCapacity == nil {
+		t.Fatal("session identity capacity was not reported")
+	}
+	if got := *status.SessionIdentityCapacity; got.Total != 2 || got.Remaining != 1 || got.ExhaustionReserve != 1 {
+		t.Fatalf("identity capacity = %#v, want total=2 remaining=1 reserve=1", got)
+	}
+	if status.Drain.AcceptingNewSessions || status.Drain.Requested || status.Lifecycle != harnessv2.SupervisorLifecycleReady {
+		t.Fatalf("capacity watermark status = lifecycle=%s drain=%#v, want ready with only new-session admission closed", status.Lifecycle, status.Drain)
+	}
+
+	healthRequest := httptest.NewRequest(http.MethodGet, harnessv2.HealthPath, nil)
+	healthResponse := httptest.NewRecorder()
+	server.Handler().ServeHTTP(healthResponse, healthRequest)
+	var health harnessv2.HealthResponse
+	if err := json.Unmarshal(healthResponse.Body.Bytes(), &health); err != nil {
+		t.Fatal(err)
+	}
+	if healthResponse.Code != http.StatusOK || health.Status != harnessv2.HealthStatusDegraded {
+		t.Fatalf("health = HTTP %d / %s, want 200 / degraded", healthResponse.Code, health.Status)
+	}
+
+	prompt := testStartPromptRequest(t, cfg, create.Metadata.Fence)
+	response = performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1/prompts/prompt-1", prompt, cfg)
+	if response.Code != http.StatusOK {
+		t.Fatalf("prompt for admitted session status=%d body=%s", response.Code, response.Body.String())
+	}
+
+	second := testCreateSessionRequest(t, cfg, profile)
+	second.RuntimeSessionID = "session-2"
+	second.Metadata.Fence.RuntimeSessionUID = "session-uid-2"
+	second.Metadata.OperationID = "create-session-2"
+	second.Metadata.RequestDigest = ""
+	sealRequest(t, &second.Metadata.RequestDigest, second)
+	response = performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-2", second, cfg)
+	if response.Code != http.StatusTooManyRequests {
+		t.Fatalf("create after identity watermark status=%d body=%s", response.Code, response.Body.String())
+	}
+	if allocator.Remaining() != 1 {
+		t.Fatalf("remaining identities = %d, want protected reserve of 1", allocator.Remaining())
+	}
+}
+
+func TestSupervisorStatusReportsCreatingRuntimeSession(t *testing.T) {
+	server, cfg, profile := newTestServer(t, "immediate")
+	entered := make(chan struct{})
+	release := make(chan struct{})
+	server.cfg.Provider.PrepareSession = func(acp.SessionPaths) error {
+		close(entered)
+		<-release
+		return nil
+	}
+	create := testCreateSessionRequest(t, cfg, profile)
+	request := mutationHTTPRequest(t, http.MethodPut, "/v2/runtime-sessions/session-1", create, cfg)
+	response := httptest.NewRecorder()
+	done := make(chan struct{})
+	go func() {
+		server.Handler().ServeHTTP(response, request)
+		close(done)
+	}()
+	<-entered
+	status := server.status()
+	if len(status.Sessions) != 1 || status.Sessions[0].RuntimeSessionID != create.RuntimeSessionID ||
+		status.Sessions[0].RuntimeSessionUID != create.Metadata.Fence.RuntimeSessionUID ||
+		status.Sessions[0].Generation != create.Metadata.Fence.RuntimeSessionGeneration ||
+		status.Sessions[0].State != harnessv2.RuntimeSessionStateCreating {
+		t.Fatalf("creating RuntimeSession status = %#v", status.Sessions)
+	}
+	if status.Pressure.ResidentSessions != 1 {
+		t.Fatalf("resident pressure = %d, want 1", status.Pressure.ResidentSessions)
+	}
+	close(release)
+	<-done
+	if response.Code != http.StatusCreated {
+		t.Fatalf("create status=%d body=%s", response.Code, response.Body.String())
+	}
+}
+
+func newTestServer(t *testing.T, mode string) (*Server, Config, harnessv2.RuntimeProfile) {
+	t.Helper()
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
+	}))
+	t.Cleanup(upstream.Close)
+	return newTestServerWithUpstream(t, mode, upstream.URL, strings.Repeat("p", 32))
+}
+
+func newTestServerWithUpstream(t *testing.T, mode, upstreamURL, upstreamToken string) (*Server, Config, harnessv2.RuntimeProfile) {
+	t.Helper()
+	cfg, profile := newTestConfigWithUpstream(t, mode, upstreamURL, upstreamToken)
+	if mode == providerProjectionCanaryMode {
+		cfg.Provider.ProjectSession = func(_ harnessv2.CreateRuntimeSessionRequest, _ acp.SessionPaths, _ ProviderProxyBinding) (ProviderSessionProjection, error) {
+			return ProviderSessionProjection{
+				Environment:    map[string]string{"ORKA_TEST_PROJECTION": providerProjectionCanaryValue},
+				NewSessionMeta: acp.Meta{"provider.canary": providerProjectionCanaryValue},
+			}, nil
+		}
+	}
+	server, err := New(cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+		defer cancel()
+		_ = server.Close(ctx)
+	})
+	return server, cfg, profile
+}
+
+func newTestConfigWithUpstream(t *testing.T, mode, upstreamURL, upstreamToken string) (Config, harnessv2.RuntimeProfile) {
+	t.Helper()
+	if runtime.GOOS == "linux" && os.Geteuid() != 0 {
+		groups, err := os.Getgroups()
+		if err != nil {
+			t.Fatal(err)
+		}
+		if len(groups) != 0 {
+			t.Skipf("non-root test environment cannot clear supplementary groups %v without weakening the production fence", groups)
+		}
+	}
+	policyConfiguration := testEmptyMCPPolicyConfiguration(t)
+	agentConfiguration := harnessv2.AgentSessionConfiguration{
+		AgentUID: testProjectionAgentUID, AgentGeneration: 1, ProviderKind: providerKindCodex, Model: "test-model", MaxTurns: 7,
+	}
+	agentDigest, err := harnessv2.CanonicalAgentConfigurationDigest(agentConfiguration)
+	if err != nil {
+		t.Fatal(err)
+	}
+	profile := harnessv2.RuntimeProfile{
+		ACPProfile: harnessv2.ACPProfileV1, AdapterDigests: map[string]string{"fake-acp": testDigest("adapter")},
+		ProviderKind: providerKindCodex, Model: "test-model", AgentConfigurationDigest: agentDigest,
+		ToolPolicyDigest: policyConfiguration.ToolPolicyDigest, ApprovalPolicyDigest: policyConfiguration.ApprovalPolicyDigest,
+		MCPConfigurationDigest: policyConfiguration.MCPConfigurationDigest,
+		WorkspaceIntent:        harnessv2.WorkspaceIntentRead, ProxyCredentialRole: "provider", ProxyCredentialScope: "model:test-model", ResourceClass: "standard",
+	}
+	profileDigest, err := harnessv2.CanonicalProfileDigest(profile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	uid, gid := os.Getuid(), os.Getgid()
+	if uid == 0 {
+		uid, gid = 65534, 65534
+	}
+	allocator, err := acp.NewUIDAllocator(uid, uid+10, gid)
+	if err != nil {
+		t.Fatal(err)
+	}
+	command, err := filepath.Abs(os.Args[0])
+	if err != nil {
+		t.Fatal(err)
+	}
+	provider := ProviderProfile{
+		Kind: "codex", Model: "test-model", Command: command, Args: []string{"-test.run=TestSupervisorACPHelper"},
+		Environment: map[string]string{"GO_WANT_SUPERVISOR_ACP_HELPER": "1", "SUPERVISOR_ACP_HELPER_MODE": mode},
+		AdapterName: "fake-acp", AdapterDigest: testDigest("adapter"),
+	}
+	if mode == providerProxyCanaryMode {
+		provider.EnvironmentForSession = func(_ harnessv2.CreateRuntimeSessionRequest, _ acp.SessionPaths, proxy ProviderProxyBinding) (map[string]string, error) {
+			config, err := json.Marshal(map[string]string{"openai_base_url": proxy.BaseURL})
+			if err != nil {
+				return nil, err
+			}
+			return map[string]string{"CODEX_API_KEY": proxy.Credential, "CODEX_CONFIG": string(config)}, nil
+		}
+	}
+	cfg := Config{
+		ListenAddress: ":0",
+		Fence: harnessv2.Fence{
+			RuntimeInstanceID: "runtime-instance", SupervisorBootID: "boot-id", ControllerEpoch: 1,
+			RuntimePoolUID: "pool-uid", RuntimePoolGeneration: 1, RuntimeProfileDigest: profileDigest,
+			ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+		},
+		Capabilities: harnessv2.CapabilitiesResponse{
+			Protocol: harnessv2.ProtocolVersion, Transport: "http+ndjson", ACPVersion: harnessv2.ACPProfileV1,
+			RuntimeProfileDigest: profileDigest, ProfileDigestSchemaVersion: harnessv2.ProfileDigestSchemaVersion,
+			AdapterDigests: map[string]string{"fake-acp": testDigest("adapter")},
+			Limits: harnessv2.ProtocolLimits{
+				MaxResidentSessions: 10, MaxConcurrentPrompts: 4, MaxRequestBytes: 1 << 20,
+				MaxEventLineBytes: 1 << 20, MaxTerminalResultBytes: 1 << 20, MaxBufferedEvents: 64,
+				MaxUpdateEventsPerSecond: 1000, MinPromptLeaseMillis: 1000, MaxPromptLeaseMillis: 120000,
+				MaxPendingPermissions: 16, MaxWorkspaceDeltaBytes: 1 << 20,
+			},
+			Provider:                          harnessv2.ProviderCapabilities{ProviderKinds: []string{"codex"}, Models: []string{"test-model"}, SupportsPermissions: true, SupportsCancel: true},
+			WorkspaceGovernance:               harnessv2.StrictWorkspaceGovernanceCapabilities(),
+			SupportsDrain:                     true,
+			SupportsPublicationFinalization:   true,
+			SupportsAgentSessionConfiguration: true,
+		},
+		Provider:              provider,
+		ControllerBearerToken: strings.Repeat("t", 32), CapabilitySecret: []byte(strings.Repeat("s", 32)), RequireCapabilities: true,
+		SessionBaseDir: filepath.Join(t.TempDir(), "sessions"), UIDAllocator: allocator,
+		ProviderProxy: ProviderProxyConfig{
+			UpstreamBaseURL: upstreamURL, UpstreamBearerToken: upstreamToken,
+			ProviderKind: providerKindCodex, Model: "test-model",
+		},
+		MCPBroker: MCPBrokerFunc(func(_ context.Context, request harnessv2.MCPBrokerCallRequest) (harnessv2.MCPBrokerCallResponse, error) {
+			return harnessv2.MCPBrokerCallResponse{
+				Protocol: harnessv2.ProtocolVersion, CallID: request.Call.CallID, Result: json.RawMessage(`{"ok":true}`),
+			}, nil
+		}),
+		WorkspaceMaterializer: EmptyWorkspaceMaterializer(),
+		InitializeTimeout:     5 * time.Second, PermissionTimeout: 5 * time.Second, CancelGrace: time.Second,
+	}
+	return cfg, profile
+}
+
+func testCreateSessionRequest(t *testing.T, cfg Config, profile harnessv2.RuntimeProfile) harnessv2.CreateRuntimeSessionRequest {
+	t.Helper()
+	fence := cfg.Fence
+	fence.RuntimeSessionUID = "session-uid-1"
+	fence.RuntimeSessionGeneration = 1
+	request := harnessv2.CreateRuntimeSessionRequest{
+		Protocol: harnessv2.ProtocolVersion, Metadata: testMetadata(fence, "create-session-1", false), RuntimeSessionID: "session-1", Profile: profile,
+		AgentConfiguration: testServerAgentConfiguration(profile),
+		MCPConfiguration:   testServerMCPPolicyConfiguration(profile),
+		Workspace: harnessv2.WorkspaceSpec{Intent: harnessv2.WorkspaceIntentRead, Baseline: harnessv2.WorkspaceBaseline{
+			RepositoryIdentity: "github.com/orka-agents/orka", Revision: "0123456789abcdef", TreeDigest: testDigest("tree"),
+		}},
+	}
+	sealRequest(t, &request.Metadata.RequestDigest, request)
+	return request
+}
+
+func testServerAgentConfiguration(profile harnessv2.RuntimeProfile) *harnessv2.AgentSessionConfiguration {
+	return &harnessv2.AgentSessionConfiguration{
+		AgentUID: testProjectionAgentUID, AgentGeneration: 1, ProviderKind: profile.ProviderKind, Model: profile.Model,
+		MaxTurns: 7,
+	}
+}
+
+func TestCreateSessionPreservesWorkspaceRelativeRootForDelta(t *testing.T) {
+	server, cfg, profile := newTestServer(t, "immediate")
+	create := testCreateSessionRequest(t, cfg, profile)
+	create.Workspace.RelativeRoot = testWorkspaceRelativeRoot
+	create.Metadata.RequestDigest = ""
+	sealRequest(t, &create.Metadata.RequestDigest, create)
+	created := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1", create, cfg)
+	if created.Code != http.StatusCreated {
+		t.Fatalf("create status = %d body=%s", created.Code, created.Body.String())
+	}
+	server.mu.Lock()
+	defer server.mu.Unlock()
+	if got := server.sessions[create.RuntimeSessionID].workspaceRelativeRoot; got != testWorkspaceRelativeRoot {
+		t.Fatalf("workspace relative root = %q, want services/app", got)
+	}
+}
+
+//nolint:unparam // The stable parameter keeps call sites explicit across related test cases.
+func testStartPromptRequest(t *testing.T, cfg Config, fence harnessv2.Fence) harnessv2.StartPromptRequest {
+	t.Helper()
+	now := time.Now().UTC()
+	metadata := testMetadata(fence, "prompt-operation-1", true)
+	metadata.PromptID = testPromptOneID
+	lease := harnessv2.PromptLease{Generation: 1, IssuedAt: now, ExpiresAt: now.Add(time.Minute)}
+	metadata.ExpiresAt = now.Add(30 * time.Second)
+	policyConfiguration := testEmptyMCPPolicyConfiguration(t)
+	request := harnessv2.StartPromptRequest{
+		Protocol: harnessv2.ProtocolVersion, Metadata: metadata, Lease: lease,
+		MCPAuthorization: harnessv2.PromptMCPAuthorization{
+			RuntimeSessionUID: fence.RuntimeSessionUID, SessionGeneration: fence.RuntimeSessionGeneration,
+			TaskUID: metadata.TaskUID, TaskAttempt: metadata.TaskAttempt, PromptID: metadata.PromptID, LeaseGeneration: 1,
+			ToolPolicyDigest: policyConfiguration.ToolPolicyDigest, ApprovalPolicyDigest: policyConfiguration.ApprovalPolicyDigest,
+			MCPConfigurationDigest: policyConfiguration.MCPConfigurationDigest, ToolPolicy: policyConfiguration.ToolPolicy,
+			ApprovalPolicy: policyConfiguration.ApprovalPolicy, ExpiresAt: now.Add(30 * time.Second),
+		},
+		Input: harnessv2.PromptInput{Content: []harnessv2.ContentBlock{{Type: harnessv2.ContentBlockText, Text: "hello"}}},
+	}
+	sealRequest(t, &request.Metadata.RequestDigest, request)
+	return request
+}
+
+func testEmptyMCPPolicyConfiguration(t *testing.T) harnessv2.MCPPolicyConfiguration {
+	t.Helper()
+	toolPolicy := testEmptyMCPToolPolicy()
+	approvalPolicy := harnessv2.MCPApprovalPolicy{}
+	toolDigest, err := harnessv2.CanonicalRuntimeToolPolicyDigest(toolPolicy.AllowedToolNames, toolPolicy.DisallowedToolNames, toolPolicy.AllowBash)
+	if err != nil {
+		t.Fatal(err)
+	}
+	approvalDigest, err := harnessv2.CanonicalMCPApprovalPolicyDigest(approvalPolicy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	mcpDigest, err := harnessv2.CanonicalMCPConfigurationDigest(toolPolicy.AllowedToolNames)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return harnessv2.MCPPolicyConfiguration{
+		ToolPolicyDigest: toolDigest, ApprovalPolicyDigest: approvalDigest, MCPConfigurationDigest: mcpDigest,
+		ToolPolicy: toolPolicy, ApprovalPolicy: approvalPolicy,
+	}
+}
+
+func testServerMCPPolicyConfiguration(profile harnessv2.RuntimeProfile) harnessv2.MCPPolicyConfiguration {
+	return harnessv2.MCPPolicyConfiguration{
+		ToolPolicyDigest: profile.ToolPolicyDigest, ApprovalPolicyDigest: profile.ApprovalPolicyDigest,
+		MCPConfigurationDigest: profile.MCPConfigurationDigest,
+		ToolPolicy:             testEmptyMCPToolPolicy(), ApprovalPolicy: harnessv2.MCPApprovalPolicy{},
+	}
+}
+
+func testEmptyMCPToolPolicy() harnessv2.MCPToolPolicy {
+	digest, _ := harnessv2.CanonicalMCPToolDescriptorDigest([]harnessv2.MCPToolDescriptor{})
+	return harnessv2.MCPToolPolicy{AllowedToolNames: []string{}, Tools: []harnessv2.MCPToolDescriptor{}, DescriptorDigest: digest}
+}
+
+func testMetadata(fence harnessv2.Fence, operation string, prompt bool) harnessv2.MutationMetadata {
+	metadata := harnessv2.MutationMetadata{
+		Fence: fence, TaskUID: "task-uid", TaskAttempt: 1, OperationID: harnessv2.OperationID(operation),
+		RequestDigestSchemaVersion: harnessv2.RequestDigestSchemaVersion, ExpiresAt: time.Now().UTC().Add(time.Minute),
+	}
+	if prompt {
+		metadata.PromptID = testPromptOneID
+	}
+	return metadata
+}
+
+func sealRequest(t *testing.T, target *harnessv2.RequestDigest, request any) {
+	t.Helper()
+	digest, err := harnessv2.CanonicalRequestDigest(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	*target = digest
+}
+
+//nolint:unparam // Stable test helper signatures keep related cases uniform.
+func performMutation(t *testing.T, handler http.Handler, method, path string, request any, cfg Config) *httptest.ResponseRecorder {
+	t.Helper()
+	req := mutationHTTPRequest(t, method, path, request, cfg)
+	resp := httptest.NewRecorder()
+	handler.ServeHTTP(resp, req)
+	return resp
+}
+
+func mutationHTTPRequest(t *testing.T, method, path string, request any, cfg Config) *http.Request {
+	t.Helper()
+	data, err := json.Marshal(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var metadata harnessv2.MutationMetadata
+	raw, _ := json.Marshal(request)
+	var envelope struct {
+		Metadata harnessv2.MutationMetadata `json:"metadata"`
+	}
+	if err := json.Unmarshal(raw, &envelope); err != nil {
+		t.Fatal(err)
+	}
+	metadata = envelope.Metadata
+	token, err := harnessv2.SignOperationCapability(cfg.CapabilitySecret, harnessv2.ClaimsForMutation(metadata))
+	if err != nil {
+		t.Fatal(err)
+	}
+	req := httptest.NewRequest(method, path, bytes.NewReader(data))
+	req.Header.Set("Authorization", "Bearer "+cfg.ControllerBearerToken)
+	req.Header.Set(OperationCapabilityHeader, token)
+	return req
+}
+
+func testDigest(label string) string {
+	sum := sha256.Sum256([]byte(label))
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
+
+func TestSupervisorACPHelper(t *testing.T) {
+	if os.Getenv("GO_WANT_SUPERVISOR_ACP_HELPER") != "1" {
+		return
+	}
+	reader := bufio.NewReader(os.Stdin)
+	writer := bufio.NewWriter(os.Stdout)
+	defer writer.Flush() //nolint:errcheck
+	mode := os.Getenv("SUPERVISOR_ACP_HELPER_MODE")
+	if mode == providerProxyCanaryMode {
+		if err := validateProviderProxyChildIsolation(); err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(2)
+		}
+	}
+	if mode == providerProjectionCanaryMode && os.Getenv("ORKA_TEST_PROJECTION") != providerProjectionCanaryValue {
+		fmt.Fprintln(os.Stderr, "provider session arguments or environment were not projected")
+		os.Exit(2)
+	}
+	var sessionID = "provider-session"
+	var promptID json.RawMessage
+	for {
+		line, err := reader.ReadBytes('\n')
+		if err != nil {
+			os.Exit(0)
+		}
+		var message struct {
+			JSONRPC string          `json:"jsonrpc"`
+			ID      json.RawMessage `json:"id"`
+			Method  string          `json:"method"`
+			Params  json.RawMessage `json:"params"`
+		}
+		if err := json.Unmarshal(line, &message); err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(2)
+		}
+		switch message.Method {
+		case acp.MethodInitialize:
+			writeHelperMessage(writer, map[string]any{
+				testJSONRPCKey: testJSONRPCVersion, "id": rawID(message.ID),
+				"result": map[string]any{
+					"protocolVersion":   acp.ProtocolVersion,
+					"agentCapabilities": map[string]any{"mcpCapabilities": map[string]any{"http": true}},
+				},
+			})
+		case acp.MethodSessionNew:
+			if mode == providerProjectionCanaryMode {
+				var request acp.NewSessionRequest
+				if err := json.Unmarshal(message.Params, &request); err != nil || request.Meta["provider.canary"] != providerProjectionCanaryValue ||
+					request.Meta["orka.runtimeSessionID"] != "session-1" || request.Meta["orka.profileDigest"] == "" {
+					writeHelperMessage(writer, map[string]any{
+						testJSONRPCKey: testJSONRPCVersion, "id": rawID(message.ID),
+						"error": map[string]any{"code": -32602, "message": "provider session metadata was not projected"},
+					})
+					continue
+				}
+			}
+			writeHelperMessage(writer, map[string]any{testJSONRPCKey: testJSONRPCVersion, "id": rawID(message.ID), "result": map[string]any{"sessionId": sessionID}})
+		case acp.MethodSessionPrompt:
+			promptID = append(promptID[:0], message.ID...)
+			if mode == providerProxyCanaryMode {
+				if err := exerciseProviderProxyFromChild(); err != nil {
+					fmt.Fprintln(os.Stderr, err)
+					os.Exit(3)
+				}
+				if err := validateProviderProxyChildIsolation(); err != nil {
+					fmt.Fprintln(os.Stderr, err)
+					os.Exit(4)
+				}
+			}
+			if mode == toolBurstRPCErrorMode {
+				writeHelperMessage(writer, map[string]any{testJSONRPCKey: testJSONRPCVersion, "method": acp.MethodSessionUpdate, "params": map[string]any{
+					"sessionId": sessionID, "update": map[string]any{
+						"sessionUpdate": "tool_call", "toolCallId": "provider-call-1", "title": "Read repository", "kind": "read",
+					},
+				}})
+				for range runtimeCodexMaxUpdateEventsPerSecond + 1 {
+					writeHelperMessage(writer, map[string]any{testJSONRPCKey: testJSONRPCVersion, "method": acp.MethodSessionUpdate, "params": map[string]any{
+						"sessionId": sessionID, "update": map[string]any{
+							"sessionUpdate": "tool_call_update", "toolCallId": "provider-call-1",
+							"_meta": map[string]any{"terminal_output_delta": map[string]any{"terminal_id": "provider-call-1", "data": "x"}},
+						},
+					}})
+				}
+				writeHelperMessage(writer, map[string]any{testJSONRPCKey: testJSONRPCVersion, "method": acp.MethodSessionUpdate, "params": map[string]any{
+					"sessionId": sessionID, "update": map[string]any{
+						"sessionUpdate": "tool_call_update", "toolCallId": "provider-call-1", "status": "completed",
+					},
+				}})
+				writeHelperMessage(writer, map[string]any{
+					testJSONRPCKey: testJSONRPCVersion, "id": rawID(promptID),
+					"error": map[string]any{
+						"code": -32603, "message": "provider-secret-must-not-leak",
+						"data": map[string]any{"service": "session", "errorName": "APIError", "detail": "provider-secret-must-not-leak"},
+					},
+				})
+				promptID = nil
+				continue
+			}
+			assistantUpdates := []string{"hello from ACP"}
+			if mode == assistantBurstMode {
+				assistantUpdates = make([]string, runtimeCodexMaxUpdateEventsPerSecond+1)
+				for index := range assistantUpdates {
+					assistantUpdates[index] = "x"
+				}
+			}
+			for _, text := range assistantUpdates {
+				writeHelperMessage(writer, map[string]any{testJSONRPCKey: testJSONRPCVersion, "method": acp.MethodSessionUpdate, "params": map[string]any{
+					"sessionId": sessionID, "update": map[string]any{"sessionUpdate": "agent_message_chunk", "content": map[string]any{"type": "text", "text": text}},
+				}})
+			}
+			if mode != "wait" {
+				writeHelperMessage(writer, map[string]any{testJSONRPCKey: testJSONRPCVersion, "id": rawID(promptID), "result": map[string]any{"stopReason": acp.StopReasonEndTurn}})
+				promptID = nil
+			}
+		case acp.MethodSessionCancel:
+			if len(promptID) > 0 {
+				writeHelperMessage(writer, map[string]any{testJSONRPCKey: testJSONRPCVersion, "id": rawID(promptID), "result": map[string]any{"stopReason": acp.StopReasonCancelled}})
+				promptID = nil
+			}
+		}
+	}
+}
+
+func writeHelperMessage(writer *bufio.Writer, value any) {
+	data, _ := json.Marshal(value)
+	_, _ = writer.Write(append(data, '\n'))
+	_ = writer.Flush()
+}
+
+func rawID(raw json.RawMessage) any {
+	if value, err := strconv.ParseInt(string(raw), 10, 64); err == nil {
+		return value
+	}
+	var value any
+	_ = json.Unmarshal(raw, &value)
+	return value
+}
+
+func validateProviderProxyChildIsolation() error {
+	for _, entry := range os.Environ() {
+		if strings.Contains(entry, supervisorUpstreamTokenCanary) {
+			return fmt.Errorf("supervisor upstream token leaked into ACP child environment")
+		}
+	}
+	for _, argument := range os.Args {
+		if strings.Contains(argument, supervisorUpstreamTokenCanary) {
+			return fmt.Errorf("supervisor upstream token leaked into ACP child arguments")
+		}
+	}
+	credential := strings.TrimSpace(os.Getenv("CODEX_API_KEY"))
+	if len(credential) < 40 || credential == supervisorUpstreamTokenCanary {
+		return fmt.Errorf("ACP child did not receive a distinct local provider credential")
+	}
+	baseURL, err := providerProxyBaseURLFromChild()
+	if err != nil {
+		return err
+	}
+	parsed, err := url.Parse(baseURL)
+	if err != nil || parsed.Scheme != providerProxyScheme || parsed.Hostname() != "127.0.0.1" || !strings.HasPrefix(parsed.Path, providerProxyPathPrefix) {
+		return fmt.Errorf("ACP child provider base URL is not an unguessable loopback route")
+	}
+	root := filepath.Dir(strings.TrimSpace(os.Getenv("HOME")))
+	if root == "." || !filepath.IsAbs(root) {
+		return fmt.Errorf("ACP child home is not rooted in a private session tree")
+	}
+	if err := filepath.WalkDir(root, func(path string, entry os.DirEntry, walkErr error) error {
+		if walkErr != nil {
+			return walkErr
+		}
+		if !entry.Type().IsRegular() {
+			return nil
+		}
+		info, err := entry.Info()
+		if err != nil {
+			return err
+		}
+		if info.Size() > 1<<20 {
+			return fmt.Errorf("unexpected large file in ACP canary session tree")
+		}
+		data, err := os.ReadFile(path)
+		if err != nil {
+			return err
+		}
+		if bytes.Contains(data, []byte(supervisorUpstreamTokenCanary)) {
+			return fmt.Errorf("supervisor upstream token leaked into ACP child session files")
+		}
+		return nil
+	}); err != nil {
+		return err
+	}
+	return nil
+}
+
+func exerciseProviderProxyFromChild() error {
+	baseURL, err := providerProxyBaseURLFromChild()
+	if err != nil {
+		return err
+	}
+	request, err := http.NewRequest(http.MethodPost, baseURL+"/responses?from=acp-child", strings.NewReader(`{"model":"test-model","canary":true}`))
+	if err != nil {
+		return err
+	}
+	credential := os.Getenv("CODEX_API_KEY")
+	request.Header.Set(providerAuthorizationHeader, "Bearer "+credential)
+	request.Header.Set(providerAPIKeyHeader, credential)
+	request.Header.Set("Content-Type", "application/json")
+	request.Header.Set(providerCookieHeader, "child-secret=1")
+	request.Header.Set(providerProxyAuthorizationHeader, "Bearer child-proxy-secret")
+	request.Header.Set(providerForwardedForHeader, "203.0.113.10")
+	request.Header.Set("Connection", "X-Child-Secret")
+	request.Header.Set("X-Child-Secret", "remove-me")
+	request.Header.Set("X-Canary-Safe", "preserved")
+	response, err := http.DefaultClient.Do(request)
+	if err != nil {
+		return fmt.Errorf("ACP child provider request failed: %w", err)
+	}
+	defer response.Body.Close() //nolint:errcheck
+	body, err := io.ReadAll(io.LimitReader(response.Body, 1<<20))
+	if err != nil {
+		return err
+	}
+	if response.StatusCode != http.StatusOK || string(body) != `{"ok":true}` {
+		return fmt.Errorf("ACP child provider response was rejected")
+	}
+	return nil
+}
+
+func providerProxyBaseURLFromChild() (string, error) {
+	var config map[string]string
+	if err := json.Unmarshal([]byte(os.Getenv("CODEX_CONFIG")), &config); err != nil {
+		return "", fmt.Errorf("decode ACP child Codex config: %w", err)
+	}
+	baseURL := strings.TrimSuffix(strings.TrimSpace(config["openai_base_url"]), "/")
+	if baseURL == "" {
+		return "", fmt.Errorf("ACP child local provider base URL is missing")
+	}
+	return baseURL, nil
+}
+
+func TestSupervisorStatusReservesOnlyAcceptedPublicationFinalization(t *testing.T) {
+	server, cfg, profile := newTestServer(t, "immediate")
+	create := testCreateSessionRequest(t, cfg, profile)
+	created := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1", create, cfg)
+	if created.Code != http.StatusCreated {
+		t.Fatalf("create status=%d body=%s", created.Code, created.Body.String())
+	}
+
+	now := time.Now().UTC()
+	server.mu.Lock()
+	state := server.sessions[create.RuntimeSessionID]
+	state.descriptor.State = harnessv2.RuntimeSessionStateFinalizing
+	state.descriptor.LastTransitionAt = now
+	state.publicationFinalization = &harnessv2.PublicationFinalizationReceipt{
+		WorkspaceDeltaID: "delta-1", PublicationID: "publication-1", PublicationGeneration: 1, PublicationVersion: 1,
+		TerminalState: harnessv2.PublicationTerminalVerifiedExact, TerminalReceiptDigest: testDigest("publication-receipt"), AppliedAt: now,
+	}
+	server.mu.Unlock()
+
+	status := server.status()
+	if len(status.Sessions) != 1 || !status.Sessions[0].ReservedForFinalization {
+		t.Fatalf("finalizing status=%#v, want publication-finalization reservation", status.Sessions)
+	}
+	if err := status.Sessions[0].Validate(); err != nil {
+		t.Fatalf("finalizing RuntimeSessionStatus.Validate() error = %v", err)
+	}
+
+	server.mu.Lock()
+	state.descriptor.State = harnessv2.RuntimeSessionStateDeleting
+	state.descriptor.LastTransitionAt = time.Now().UTC()
+	server.mu.Unlock()
+	status = server.status()
+	if len(status.Sessions) != 1 || status.Sessions[0].ReservedForFinalization {
+		t.Fatalf("deleting status=%#v, want reservation cleared", status.Sessions)
+	}
+	if err := status.Sessions[0].Validate(); err != nil {
+		t.Fatalf("deleting RuntimeSessionStatus.Validate() error = %v", err)
+	}
+}
+
+func TestSupervisorFinalizesPreparedPublicationBeforeDeletion(t *testing.T) {
+	server, cfg, profile := newTestServer(t, "immediate")
+	create := testCreateSessionRequest(t, cfg, profile)
+	created := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1", create, cfg)
+	if created.Code != http.StatusCreated {
+		t.Fatalf("create status=%d body=%s", created.Code, created.Body.String())
+	}
+	prompt := testStartPromptRequest(t, cfg, create.Metadata.Fence)
+	now := time.Now().UTC()
+	settlement := harnessv2.PromptSettlement{
+		TerminalEvent: harnessv2.EventCompleted, Outcome: harnessv2.PromptOutcomeSucceeded,
+		StopReason: harnessv2.ACPStopReasonEndTurn, SettledAt: now,
+	}
+	server.mu.Lock()
+	state := server.sessions[create.RuntimeSessionID]
+	state.workspaceIntent = harnessv2.WorkspaceIntentWrite
+	state.prompt = &promptState{request: prompt, settlement: &settlement}
+	state.descriptor.State = harnessv2.RuntimeSessionStatePublicationPrepared
+	state.deltas["delta-1"] = harnessv2.CreateWorkspaceDeltaResponse{Delta: harnessv2.WorkspaceDeltaDescriptor{
+		DeltaID: "delta-1", RuntimeSessionUID: state.descriptor.RuntimeSessionUID, SessionGeneration: state.descriptor.Generation,
+		State: harnessv2.WorkspaceDeltaPrepared, PublicationSafe: true,
+	}}
+	server.mu.Unlock()
+
+	metadata := prompt.Metadata
+	metadata.OperationID = "finalize-publication-1"
+	metadata.ExpiresAt = now.Add(time.Minute)
+	finalize := harnessv2.FinalizeRuntimeSessionPublicationRequest{
+		Protocol: harnessv2.ProtocolVersion, Metadata: metadata, WorkspaceDeltaID: "delta-1",
+		PublicationID: "publication-1", PublicationGeneration: 1, PublicationVersion: 7,
+		TerminalState: harnessv2.PublicationTerminalVerifiedExact, TerminalReceiptDigest: testDigest("publication-receipt"),
+	}
+	sealRequest(t, &finalize.Metadata.RequestDigest, finalize)
+	response := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1/publication-finalization", finalize, cfg)
+	if response.Code != http.StatusOK {
+		t.Fatalf("finalize status=%d body=%s", response.Code, response.Body.String())
+	}
+	var finalized harnessv2.FinalizeRuntimeSessionPublicationResponse
+	if err := json.Unmarshal(response.Body.Bytes(), &finalized); err != nil {
+		t.Fatal(err)
+	}
+	if err := finalized.ValidateFor(finalize); err != nil || finalized.Session.State != harnessv2.RuntimeSessionStateFinalizing {
+		t.Fatalf("finalize response=%#v validation=%v", finalized, err)
+	}
+	duplicate := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1/publication-finalization", finalize, cfg)
+	if duplicate.Code != http.StatusOK {
+		t.Fatalf("duplicate finalize status=%d body=%s", duplicate.Code, duplicate.Body.String())
+	}
+	if err := json.Unmarshal(duplicate.Body.Bytes(), &finalized); err != nil {
+		t.Fatal(err)
+	}
+	if finalized.Classification.Class != harnessv2.RequestClassificationDuplicate || finalized.Classification.Phase != harnessv2.OperationPhaseApplied {
+		t.Fatalf("duplicate finalization classification=%#v", finalized.Classification)
+	}
+	appliedAt := finalized.Finalization.AppliedAt
+	recovered := finalize
+	recovered.Metadata.OperationID = "finalize-publication-recovered"
+	recovered.Metadata.ExpiresAt = now.Add(2 * time.Minute)
+	sealRequest(t, &recovered.Metadata.RequestDigest, recovered)
+	recoveryResponse := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1/publication-finalization", recovered, cfg)
+	if recoveryResponse.Code != http.StatusOK {
+		t.Fatalf("recovered finalization status=%d body=%s", recoveryResponse.Code, recoveryResponse.Body.String())
+	}
+	if err := json.Unmarshal(recoveryResponse.Body.Bytes(), &finalized); err != nil {
+		t.Fatal(err)
+	}
+	if finalized.Classification.Class != harnessv2.RequestClassificationFresh || !finalized.Finalization.AppliedAt.Equal(appliedAt) {
+		t.Fatalf("recovered finalization=%#v, want fresh with stable receipt", finalized)
+	}
+	conflicting := finalize
+	conflicting.Metadata.OperationID = "finalize-publication-conflict"
+	conflicting.Metadata.ExpiresAt = now.Add(3 * time.Minute)
+	conflicting.TerminalReceiptDigest = testDigest("other-publication-receipt")
+	sealRequest(t, &conflicting.Metadata.RequestDigest, conflicting)
+	conflictResponse := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1/publication-finalization", conflicting, cfg)
+	if conflictResponse.Code != http.StatusConflict {
+		t.Fatalf("conflicting finalization status=%d body=%s", conflictResponse.Code, conflictResponse.Body.String())
+	}
+	var conflictError harnessv2.ErrorResponse
+	if err := json.Unmarshal(conflictResponse.Body.Bytes(), &conflictError); err != nil {
+		t.Fatal(err)
+	}
+	if conflictError.Code != harnessv2.ErrorCodeDigestConflict {
+		t.Fatalf("conflicting finalization error=%#v", conflictError)
+	}
+	afterFinalizePrompt := prompt
+	afterFinalizePrompt.Metadata.OperationID = "prompt-after-publication-finalization"
+	sealRequest(t, &afterFinalizePrompt.Metadata.RequestDigest, afterFinalizePrompt)
+	promptResponse := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1/prompts/prompt-1", afterFinalizePrompt, cfg)
+	if promptResponse.Code != http.StatusConflict {
+		t.Fatalf("prompt after finalization status=%d body=%s", promptResponse.Code, promptResponse.Body.String())
+	}
+	if runtime.GOOS != linuxGOOS {
+		return
+	}
+
+	deleteMetadata := prompt.Metadata
+	deleteMetadata.OperationID = "delete-finalized-session-1"
+	deleteMetadata.ExpiresAt = now.Add(time.Minute)
+	deleteRequest := harnessv2.DeleteRuntimeSessionRequest{Protocol: harnessv2.ProtocolVersion, Metadata: deleteMetadata, Reason: "finalized"}
+	sealRequest(t, &deleteRequest.Metadata.RequestDigest, deleteRequest)
+	deleted := performMutation(t, server.Handler(), http.MethodDelete, "/v2/runtime-sessions/session-1", deleteRequest, cfg)
+	if deleted.Code != http.StatusOK {
+		t.Fatalf("delete finalized session status=%d body=%s", deleted.Code, deleted.Body.String())
+	}
+	replayedDelete := performMutation(t, server.Handler(), http.MethodDelete, "/v2/runtime-sessions/session-1", deleteRequest, cfg)
+	if replayedDelete.Code != http.StatusOK {
+		t.Fatalf("replayed delete status=%d body=%s", replayedDelete.Code, replayedDelete.Body.String())
+	}
+	var deleteResponse harnessv2.DeleteRuntimeSessionResponse
+	if err := json.Unmarshal(replayedDelete.Body.Bytes(), &deleteResponse); err != nil {
+		t.Fatal(err)
+	}
+	if deleteResponse.Classification.Class != harnessv2.RequestClassificationDuplicate || deleteResponse.Classification.Phase != harnessv2.OperationPhaseDeleted {
+		t.Fatalf("replayed delete classification=%#v", deleteResponse.Classification)
+	}
+	freshDelete := deleteRequest
+	freshDelete.Metadata.OperationID = "delete-finalized-session-new-operation"
+	freshDelete.Metadata.ExpiresAt = now.Add(2 * time.Minute)
+	sealRequest(t, &freshDelete.Metadata.RequestDigest, freshDelete)
+	freshResponse := performMutation(t, server.Handler(), http.MethodDelete, "/v2/runtime-sessions/session-1", freshDelete, cfg)
+	if freshResponse.Code != http.StatusNotFound {
+		t.Fatalf("fresh delete after tombstone status=%d body=%s", freshResponse.Code, freshResponse.Body.String())
+	}
+	var freshError harnessv2.ErrorResponse
+	if err := json.Unmarshal(freshResponse.Body.Bytes(), &freshError); err != nil {
+		t.Fatal(err)
+	}
+	if freshError.Classification != nil {
+		t.Fatalf("fresh delete after tombstone carried classification=%#v", freshError.Classification)
+	}
+}
+
+func TestCleanupDrainedSessionClearsDeferredSchedule(t *testing.T) {
+	server := &Server{sessions: make(map[harnessv2.RuntimeSessionID]*sessionState)}
+	state := &sessionState{
+		id: "session-1", drainCleanupScheduled: true,
+		descriptor: harnessv2.RuntimeSessionDescriptor{State: harnessv2.RuntimeSessionStatePublicationPrepared},
+		prompt:     &promptState{},
+	}
+	server.sessions[state.id] = state
+	server.cleanupDrainedSession(state.id, state)
+	server.mu.Lock()
+	defer server.mu.Unlock()
+	if state.drainCleanupScheduled {
+		t.Fatal("deferred drain cleanup remained scheduled after an ineligible observation")
+	}
+}
+
+func TestSupervisorRejectsConcurrentDeleteWhileCleanupIsRunning(t *testing.T) {
+	server, cfg, profile := newTestServer(t, "immediate")
+	create := testCreateSessionRequest(t, cfg, profile)
+	created := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1", create, cfg)
+	if created.Code != http.StatusCreated {
+		t.Fatalf("create status=%d body=%s", created.Code, created.Body.String())
+	}
+	server.mu.Lock()
+	server.sessions[create.RuntimeSessionID].descriptor.State = harnessv2.RuntimeSessionStateDeleting
+	server.mu.Unlock()
+	staleMetadata := testMetadata(create.Metadata.Fence, "stale-delete-while-cleaning", false)
+	staleMetadata.Fence.RuntimeSessionGeneration++
+	staleRequest := harnessv2.DeleteRuntimeSessionRequest{Protocol: harnessv2.ProtocolVersion, Metadata: staleMetadata, Reason: "stale duplicate cleanup"}
+	sealRequest(t, &staleRequest.Metadata.RequestDigest, staleRequest)
+	staleResponse := performMutation(t, server.Handler(), http.MethodDelete, "/v2/runtime-sessions/session-1", staleRequest, cfg)
+	if staleResponse.Code != http.StatusGone {
+		t.Fatalf("stale concurrent delete status=%d body=%s", staleResponse.Code, staleResponse.Body.String())
+	}
+
+	metadata := testMetadata(create.Metadata.Fence, "delete-while-cleaning", false)
+	request := harnessv2.DeleteRuntimeSessionRequest{Protocol: harnessv2.ProtocolVersion, Metadata: metadata, Reason: "duplicate cleanup"}
+	sealRequest(t, &request.Metadata.RequestDigest, request)
+	response := performMutation(t, server.Handler(), http.MethodDelete, "/v2/runtime-sessions/session-1", request, cfg)
+	if response.Code != http.StatusConflict {
+		t.Fatalf("concurrent delete status=%d body=%s", response.Code, response.Body.String())
+	}
+	var decoded harnessv2.ErrorResponse
+	if err := json.Unmarshal(response.Body.Bytes(), &decoded); err != nil {
+		t.Fatal(err)
+	}
+	if decoded.Code != harnessv2.ErrorCodeAlreadyAccepted {
+		t.Fatalf("concurrent delete error=%#v", decoded)
+	}
+}
+
+func TestSupervisorRetiresPoisonedSessionWithoutPoolDrain(t *testing.T) {
+	if runtime.GOOS != linuxGOOS {
+		t.Skip("descendant cleanup proof is Linux-specific")
+	}
+	server, cfg, profile := newTestServer(t, "immediate")
+	create := testCreateSessionRequest(t, cfg, profile)
+	created := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1", create, cfg)
+	if created.Code != http.StatusCreated {
+		t.Fatalf("create status=%d body=%s", created.Code, created.Body.String())
+	}
+	server.mu.Lock()
+	state := server.sessions[create.RuntimeSessionID]
+	server.mu.Unlock()
+	server.poisonSession(state, "test")
+	deadline := time.Now().Add(5 * time.Second)
+	for time.Now().Before(deadline) {
+		server.mu.Lock()
+		_, resident := server.sessions[create.RuntimeSessionID]
+		_, tombstoned := server.tombstones[create.Metadata.Fence.RuntimeSessionUID]
+		server.mu.Unlock()
+		if !resident && tombstoned {
+			return
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	t.Fatal("poisoned RuntimeSession remained resident without an enclosing pool drain")
+}
+
+func TestSupervisorDrainSchedulesPublicationPreparedSessionBeforeSettlement(t *testing.T) {
+	server, cfg, _ := newTestServer(t, "immediate")
+	now := time.Now().UTC()
+	sessionID := harnessv2.RuntimeSessionID("publication-session")
+	state := &sessionState{
+		id: sessionID,
+		descriptor: harnessv2.RuntimeSessionDescriptor{
+			RuntimeSessionID: sessionID,
+			State:            harnessv2.RuntimeSessionStatePublicationPrepared,
+		},
+		prompt: &promptState{},
+	}
+	server.mu.Lock()
+	server.sessions[sessionID] = state
+	server.mu.Unlock()
+
+	drain := harnessv2.DrainRequest{Protocol: harnessv2.ProtocolVersion, Metadata: harnessv2.MutationMetadata{
+		Fence: cfg.Fence, OperationID: "drain-publication-prepared", RequestDigestSchemaVersion: harnessv2.RequestDigestSchemaVersion,
+		ExpiresAt: now.Add(time.Minute),
+	}, Reason: "rollout"}
+	sealRequest(t, &drain.Metadata.RequestDigest, drain)
+	response := performMutation(t, server.Handler(), http.MethodPut, harnessv2.DrainPath, drain, cfg)
+	if response.Code != http.StatusOK {
+		t.Fatalf("drain status=%d body=%s", response.Code, response.Body.String())
+	}
+	server.mu.Lock()
+	defer server.mu.Unlock()
+	if server.sessions[sessionID] != state || !state.drainCleanupScheduled {
+		t.Fatalf("publication-prepared RuntimeSession was not scheduled before settlement: resident=%t scheduled=%t", server.sessions[sessionID] == state, state.drainCleanupScheduled)
+	}
+}
+
+func TestSupervisorDrainRetiresEligibleResidentSessions(t *testing.T) {
+	if runtime.GOOS != linuxGOOS {
+		t.Skip("descendant cleanup proof is Linux-specific")
+	}
+	for _, test := range []struct {
+		name          string
+		state         harnessv2.RuntimeSessionState
+		settledPrompt bool
+	}{
+		{name: "idle", state: harnessv2.RuntimeSessionStateIdle},
+		{name: "publication-prepared", state: harnessv2.RuntimeSessionStatePublicationPrepared, settledPrompt: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			server, cfg, profile := newTestServer(t, "immediate")
+			create := testCreateSessionRequest(t, cfg, profile)
+			created := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1", create, cfg)
+			if created.Code != http.StatusCreated {
+				t.Fatalf("create status=%d body=%s", created.Code, created.Body.String())
+			}
+			server.mu.Lock()
+			state := server.sessions[create.RuntimeSessionID]
+			state.descriptor.State = test.state
+			if test.settledPrompt {
+				now := time.Now().UTC()
+				prompt := testStartPromptRequest(t, cfg, create.Metadata.Fence)
+				settlement := harnessv2.PromptSettlement{
+					TerminalEvent: harnessv2.EventCompleted,
+					Outcome:       harnessv2.PromptOutcomeSucceeded,
+					StopReason:    harnessv2.ACPStopReasonEndTurn,
+					SettledAt:     now,
+				}
+				state.prompt = &promptState{request: prompt, settlement: &settlement}
+				state.descriptor.LastTransitionAt = now
+			}
+			server.mu.Unlock()
+
+			drain := harnessv2.DrainRequest{Protocol: harnessv2.ProtocolVersion, Metadata: harnessv2.MutationMetadata{
+				Fence: cfg.Fence, OperationID: harnessv2.OperationID("drain-" + test.name), RequestDigestSchemaVersion: harnessv2.RequestDigestSchemaVersion,
+				ExpiresAt: time.Now().UTC().Add(time.Minute),
+			}, Reason: "rollout"}
+			sealRequest(t, &drain.Metadata.RequestDigest, drain)
+			response := performMutation(t, server.Handler(), http.MethodPut, harnessv2.DrainPath, drain, cfg)
+			if response.Code != http.StatusOK {
+				t.Fatalf("drain status=%d body=%s", response.Code, response.Body.String())
+			}
+			server.mu.Lock()
+			residentState, resident := server.sessions[create.RuntimeSessionID]
+			if resident && !residentState.drainCleanupScheduled {
+				server.mu.Unlock()
+				t.Fatalf("%s RuntimeSession was not scheduled for drain cleanup", test.name)
+			}
+			server.mu.Unlock()
+
+			deadline := time.Now().Add(5 * time.Second)
+			for time.Now().Before(deadline) {
+				server.mu.Lock()
+				_, resident = server.sessions[create.RuntimeSessionID]
+				_, tombstoned := server.tombstones[create.Metadata.Fence.RuntimeSessionUID]
+				server.mu.Unlock()
+				if !resident && tombstoned {
+					return
+				}
+				time.Sleep(10 * time.Millisecond)
+			}
+			server.mu.Lock()
+			defer server.mu.Unlock()
+			states := make([]harnessv2.RuntimeSessionState, 0, len(server.sessions))
+			for _, state := range server.sessions {
+				states = append(states, state.descriptor.State)
+			}
+			_, tombstoned := server.tombstones[create.Metadata.Fence.RuntimeSessionUID]
+			t.Fatalf("%s RuntimeSession drain cleanup did not complete: lifecycle=%s states=%v tombstoned=%t", test.name, server.lifecycle, states, tombstoned)
+		})
+	}
+}
+
+func TestSupervisorRejectsFreshPromptWhenDrainCleanupIsScheduled(t *testing.T) {
+	server, cfg, profile := newTestServer(t, "immediate")
+	create := testCreateSessionRequest(t, cfg, profile)
+	created := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1", create, cfg)
+	if created.Code != http.StatusCreated {
+		t.Fatalf("create status=%d body=%s", created.Code, created.Body.String())
+	}
+	server.mu.Lock()
+	state := server.sessions[create.RuntimeSessionID]
+	server.drain = harnessv2.DrainStatus{Requested: true, AcceptingNewSessions: false, RequestedAt: time.Now().UTC(), Reason: "rollout"}
+	server.lifecycle = harnessv2.SupervisorLifecycleDraining
+	state.drainCleanupScheduled = true
+	server.mu.Unlock()
+	prompt := testStartPromptRequest(t, cfg, create.Metadata.Fence)
+	response := performMutation(t, server.Handler(), http.MethodPut, "/v2/runtime-sessions/session-1/prompts/prompt-1", prompt, cfg)
+	if response.Code != http.StatusTooManyRequests {
+		t.Fatalf("prompt during drain status=%d body=%s", response.Code, response.Body.String())
+	}
+	server.mu.Lock()
+	defer server.mu.Unlock()
+	if state.prompt != nil {
+		t.Fatal("fresh prompt was admitted while drain cleanup was scheduled")
+	}
+}
diff --git a/workers/acp/supervisor/session_identity_lock_other.go b/workers/acp/supervisor/session_identity_lock_other.go
new file mode 100644
index 000000000..4fd6296bf
--- /dev/null
+++ b/workers/acp/supervisor/session_identity_lock_other.go
@@ -0,0 +1,13 @@
+//go:build !darwin && !linux
+
+package supervisor
+
+import (
+	"fmt"
+	"io"
+	"runtime"
+)
+
+func lockSessionIdentityState(string) (io.Closer, error) {
+	return nil, fmt.Errorf("cross-process session identity locking is unsupported on %s", runtime.GOOS)
+}
diff --git a/workers/acp/supervisor/session_identity_lock_unix.go b/workers/acp/supervisor/session_identity_lock_unix.go
new file mode 100644
index 000000000..c9179a381
--- /dev/null
+++ b/workers/acp/supervisor/session_identity_lock_unix.go
@@ -0,0 +1,45 @@
+//go:build darwin || linux
+
+package supervisor
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+
+	"golang.org/x/sys/unix"
+)
+
+func lockSessionIdentityState(baseDir string) (io.Closer, error) {
+	path := filepath.Join(baseDir, sessionIdentityLockFile)
+	fd, err := unix.Open(path, unix.O_CREAT|unix.O_RDWR|unix.O_CLOEXEC|unix.O_NOFOLLOW, 0o600)
+	if err != nil {
+		return nil, fmt.Errorf("open session identity lock: %w", err)
+	}
+	file := os.NewFile(uintptr(fd), sessionIdentityLockFile)
+	if file == nil {
+		_ = unix.Close(fd)
+		return nil, fmt.Errorf("create session identity lock handle")
+	}
+	if err := unix.Flock(int(file.Fd()), unix.LOCK_EX|unix.LOCK_NB); err != nil {
+		_ = file.Close()
+		return nil, fmt.Errorf("lock session identity state: %w", err)
+	}
+	return &sessionIdentityLock{file: file}, nil
+}
+
+type sessionIdentityLock struct{ file *os.File }
+
+func (l *sessionIdentityLock) Close() error {
+	if l == nil || l.file == nil {
+		return nil
+	}
+	unlockErr := unix.Flock(int(l.file.Fd()), unix.LOCK_UN)
+	closeErr := l.file.Close()
+	l.file = nil
+	if unlockErr != nil {
+		return fmt.Errorf("unlock session identity state: %w", unlockErr)
+	}
+	return closeErr
+}
diff --git a/workers/acp/supervisor/session_identity_state.go b/workers/acp/supervisor/session_identity_state.go
new file mode 100644
index 000000000..a7a45499e
--- /dev/null
+++ b/workers/acp/supervisor/session_identity_state.go
@@ -0,0 +1,202 @@
+package supervisor
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/orka-agents/orka/internal/acp"
+)
+
+const (
+	sessionIdentityStateFile       = ".orka-session-identity-high-water"
+	sessionIdentityStateTempPrefix = ".orka-session-identity-state-"
+	sessionIdentityLockFile        = ".orka-session-identity.lock"
+	sessionIdentityStateVersion    = 1
+)
+
+type sessionIdentityState struct {
+	Version   int `json:"version"`
+	FirstUID  int `json:"firstUid"`
+	LastUID   int `json:"lastUid"`
+	FirstGID  int `json:"firstGid"`
+	LastGID   int `json:"lastGid"`
+	Allocated int `json:"allocated"`
+}
+
+func prepareSessionIdentityState(baseDir string, allocator *acp.UIDAllocator) (io.Closer, error) {
+	baseDir = filepath.Clean(strings.TrimSpace(baseDir))
+	if baseDir == "." || !filepath.IsAbs(baseDir) {
+		return nil, fmt.Errorf("session base directory must be absolute")
+	}
+	info, err := os.Lstat(baseDir)
+	if os.IsNotExist(err) {
+		if err := os.MkdirAll(baseDir, 0o711); err != nil {
+			return nil, fmt.Errorf("create session base directory: %w", err)
+		}
+		info, err = os.Lstat(baseDir)
+	}
+	if err != nil {
+		return nil, fmt.Errorf("inspect session base directory: %w", err)
+	}
+	if info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
+		return nil, fmt.Errorf("session base directory must be a real directory")
+	}
+
+	lock, err := lockSessionIdentityState(baseDir)
+	if err != nil {
+		return nil, err
+	}
+	keepLock := false
+	defer func() {
+		if !keepLock {
+			_ = lock.Close()
+		}
+	}()
+	if err := removeOrphanedSessionIdentityTemps(baseDir); err != nil {
+		return nil, err
+	}
+
+	firstUID, lastUID, firstGID, lastGID := allocator.Range()
+	expected := sessionIdentityState{
+		Version: sessionIdentityStateVersion, FirstUID: firstUID, LastUID: lastUID,
+		FirstGID: firstGID, LastGID: lastGID,
+	}
+	statePath := filepath.Join(baseDir, sessionIdentityStateFile)
+	state, exists, err := readSessionIdentityState(statePath)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		entries, err := os.ReadDir(baseDir)
+		if err != nil {
+			return nil, fmt.Errorf("list session base directory: %w", err)
+		}
+		for _, entry := range entries {
+			if entry.Name() != sessionIdentityLockFile {
+				return nil, fmt.Errorf("session identity state is missing while stale session entries exist")
+			}
+		}
+		state = expected
+		if err := persistSessionIdentityState(baseDir, state); err != nil {
+			return nil, err
+		}
+	} else if state.Version != expected.Version || state.FirstUID != expected.FirstUID || state.LastUID != expected.LastUID ||
+		state.FirstGID != expected.FirstGID || state.LastGID != expected.LastGID {
+		return nil, fmt.Errorf("session identity state does not match the configured UID/GID range")
+	}
+	if state.Allocated < 0 || state.Allocated > allocator.Capacity() {
+		return nil, fmt.Errorf("session identity state allocation count is invalid")
+	}
+	if err := allocator.ConfigurePersistence(state.Allocated, func(next int) error {
+		nextState := expected
+		nextState.Allocated = next
+		return persistSessionIdentityState(baseDir, nextState)
+	}); err != nil {
+		return nil, err
+	}
+	keepLock = true
+	return lock, nil
+}
+
+func readSessionIdentityState(path string) (sessionIdentityState, bool, error) {
+	info, err := os.Lstat(path)
+	if os.IsNotExist(err) {
+		return sessionIdentityState{}, false, nil
+	}
+	if err != nil {
+		return sessionIdentityState{}, false, fmt.Errorf("inspect session identity state: %w", err)
+	}
+	if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() || info.Size() < 2 || info.Size() > 512 {
+		return sessionIdentityState{}, false, fmt.Errorf("session identity state must be a bounded regular file")
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return sessionIdentityState{}, false, fmt.Errorf("read session identity state: %w", err)
+	}
+	decoder := json.NewDecoder(bytes.NewReader(data))
+	decoder.DisallowUnknownFields()
+	var state sessionIdentityState
+	if err := decoder.Decode(&state); err != nil || decoder.Decode(&struct{}{}) != io.EOF {
+		return sessionIdentityState{}, false, fmt.Errorf("session identity state is invalid")
+	}
+	canonical, err := json.Marshal(state)
+	if err != nil || !bytes.Equal(bytes.TrimSpace(data), canonical) {
+		return sessionIdentityState{}, false, fmt.Errorf("session identity state is non-canonical")
+	}
+	return state, true, nil
+}
+
+func persistSessionIdentityState(baseDir string, state sessionIdentityState) error {
+	statePath := filepath.Join(baseDir, sessionIdentityStateFile)
+	payload, err := json.Marshal(state)
+	if err != nil {
+		return fmt.Errorf("encode session identity state: %w", err)
+	}
+	payload = append(payload, '\n')
+	temporary, err := os.CreateTemp(baseDir, sessionIdentityStateTempPrefix+"*")
+	if err != nil {
+		return fmt.Errorf("create session identity state: %w", err)
+	}
+	temporaryPath := temporary.Name()
+	cleanup := true
+	defer func() {
+		_ = temporary.Close()
+		if cleanup {
+			_ = os.Remove(temporaryPath)
+		}
+	}()
+	if err := temporary.Chmod(0o600); err != nil {
+		return fmt.Errorf("chmod session identity state: %w", err)
+	}
+	if _, err := temporary.Write(payload); err != nil {
+		return fmt.Errorf("write session identity state: %w", err)
+	}
+	if err := temporary.Sync(); err != nil {
+		return fmt.Errorf("sync session identity state: %w", err)
+	}
+	if err := temporary.Close(); err != nil {
+		return fmt.Errorf("close session identity state: %w", err)
+	}
+	if err := os.Rename(temporaryPath, statePath); err != nil {
+		return fmt.Errorf("publish session identity state: %w", err)
+	}
+	cleanup = false
+	directory, err := os.Open(baseDir)
+	if err != nil {
+		return fmt.Errorf("open session base directory for sync: %w", err)
+	}
+	defer directory.Close() //nolint:errcheck
+	if err := directory.Sync(); err != nil {
+		return fmt.Errorf("sync session base directory: %w", err)
+	}
+	return nil
+}
+
+func removeOrphanedSessionIdentityTemps(baseDir string) error {
+	entries, err := os.ReadDir(baseDir)
+	if err != nil {
+		return fmt.Errorf("list session identity artifacts: %w", err)
+	}
+	for _, entry := range entries {
+		if !strings.HasPrefix(entry.Name(), sessionIdentityStateTempPrefix) {
+			continue
+		}
+		path := filepath.Join(baseDir, entry.Name())
+		info, err := os.Lstat(path)
+		if err != nil {
+			return fmt.Errorf("inspect orphaned session identity state: %w", err)
+		}
+		if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() {
+			return fmt.Errorf("orphaned session identity state must be a regular file")
+		}
+		if err := os.Remove(path); err != nil {
+			return fmt.Errorf("remove orphaned session identity state: %w", err)
+		}
+	}
+	return nil
+}
diff --git a/workers/acp/supervisor/session_identity_state_test.go b/workers/acp/supervisor/session_identity_state_test.go
new file mode 100644
index 000000000..846c355b0
--- /dev/null
+++ b/workers/acp/supervisor/session_identity_state_test.go
@@ -0,0 +1,211 @@
+package supervisor
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/orka-agents/orka/internal/acp"
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+func TestSessionIdentityHighWaterSurvivesSupervisorRestart(t *testing.T) {
+	cfg, _ := newSessionIdentityTestConfig(t)
+	server, err := New(cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	firstUID, firstGID, err := cfg.UIDAllocator.Allocate()
+	if err != nil {
+		t.Fatal(err)
+	}
+	closeIdentityTestSupervisor(t, server)
+
+	staleRoot := filepath.Join(cfg.SessionBaseDir, "retained-session")
+	staleMarker := filepath.Join(staleRoot, "workspace", "private-marker")
+	if err := os.MkdirAll(filepath.Dir(staleMarker), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(staleMarker, []byte("retained"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	restartedCfg, _ := newSessionIdentityTestConfig(t)
+	restartedCfg.SessionBaseDir = cfg.SessionBaseDir
+	restarted, err := New(restartedCfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { closeIdentityTestSupervisor(t, restarted) })
+	secondUID, secondGID, err := restartedCfg.UIDAllocator.Allocate()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if secondUID != firstUID+1 || secondGID != firstGID+1 {
+		t.Fatalf("restarted allocation = %d:%d, want %d:%d", secondUID, secondGID, firstUID+1, firstGID+1)
+	}
+	if got, err := os.ReadFile(staleMarker); err != nil || string(got) != "retained" {
+		t.Fatalf("restart unexpectedly modified retained session data: content=%q err=%v", got, err)
+	}
+	state, exists, err := readSessionIdentityState(filepath.Join(cfg.SessionBaseDir, sessionIdentityStateFile))
+	if err != nil || !exists || state.Allocated != 2 {
+		t.Fatalf("identity state = %#v exists=%v err=%v, want allocated=2", state, exists, err)
+	}
+}
+
+func TestSessionIdentityStateMissingWithStaleEntriesFailsClosed(t *testing.T) {
+	cfg, _ := newSessionIdentityTestConfig(t)
+	if err := os.MkdirAll(filepath.Join(cfg.SessionBaseDir, "stale-session"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	server, err := New(cfg)
+	if server != nil {
+		closeIdentityTestSupervisor(t, server)
+	}
+	if err == nil || !strings.Contains(err.Error(), "state is missing") {
+		t.Fatalf("New error = %v, want missing-state failure", err)
+	}
+}
+
+func TestSessionIdentityStateRejectsSymlink(t *testing.T) {
+	cfg, _ := newSessionIdentityTestConfig(t)
+	if err := os.MkdirAll(cfg.SessionBaseDir, 0o711); err != nil {
+		t.Fatal(err)
+	}
+	outside := filepath.Join(t.TempDir(), "state")
+	if err := os.WriteFile(outside, []byte("1\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(outside, filepath.Join(cfg.SessionBaseDir, sessionIdentityStateFile)); err != nil {
+		t.Skipf("symlinks unavailable: %v", err)
+	}
+	server, err := New(cfg)
+	if server != nil {
+		closeIdentityTestSupervisor(t, server)
+	}
+	if err == nil || !strings.Contains(err.Error(), "bounded regular file") {
+		t.Fatalf("New error = %v, want symlink-state rejection", err)
+	}
+}
+
+func TestNewFailsClosedWhenSessionIdentityStatePreparationFails(t *testing.T) {
+	cfg, _ := newSessionIdentityTestConfig(t)
+	prepareErr := errors.New("injected identity state failure")
+	server, err := newServer(cfg, func(string, *acp.UIDAllocator) (io.Closer, error) { return nil, prepareErr })
+	if server != nil {
+		closeIdentityTestSupervisor(t, server)
+		t.Fatal("newServer returned a server after identity state preparation failed")
+	}
+	if !errors.Is(err, prepareErr) {
+		t.Fatalf("newServer error = %v, want injected preparation failure", err)
+	}
+	if got, want := cfg.UIDAllocator.Remaining(), cfg.UIDAllocator.Capacity(); got != want {
+		t.Fatalf("preparation failure consumed identity capacity: remaining=%d capacity=%d", got, want)
+	}
+}
+
+func TestSessionIdentityStateRejectsConcurrentSupervisor(t *testing.T) {
+	cfg, _ := newSessionIdentityTestConfig(t)
+	first, err := New(cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { closeIdentityTestSupervisor(t, first) })
+
+	secondCfg, _ := newSessionIdentityTestConfig(t)
+	secondCfg.SessionBaseDir = cfg.SessionBaseDir
+	second, err := New(secondCfg)
+	if second != nil {
+		closeIdentityTestSupervisor(t, second)
+	}
+	if err == nil || !strings.Contains(err.Error(), "lock session identity state") {
+		t.Fatalf("concurrent New error = %v, want lock failure", err)
+	}
+}
+
+func TestSessionIdentityStateRejectsRangeChange(t *testing.T) {
+	cfg, _ := newSessionIdentityTestConfig(t)
+	server, err := New(cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	closeIdentityTestSupervisor(t, server)
+	firstUID, lastUID, firstGID, _ := cfg.UIDAllocator.Range()
+
+	restartedCfg, _ := newSessionIdentityTestConfig(t)
+	restartedCfg.SessionBaseDir = cfg.SessionBaseDir
+	restartedCfg.UIDAllocator, err = acp.NewUIDAllocator(firstUID-1, lastUID-1, firstGID-1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	restarted, err := New(restartedCfg)
+	if restarted != nil {
+		closeIdentityTestSupervisor(t, restarted)
+	}
+	if err == nil || !strings.Contains(err.Error(), "does not match") {
+		t.Fatalf("range-change New error = %v, want range mismatch", err)
+	}
+}
+
+func TestSessionIdentityStateRecoversOrphanedInitializationFile(t *testing.T) {
+	cfg, _ := newSessionIdentityTestConfig(t)
+	if err := os.MkdirAll(cfg.SessionBaseDir, 0o711); err != nil {
+		t.Fatal(err)
+	}
+	orphan := filepath.Join(cfg.SessionBaseDir, sessionIdentityStateTempPrefix+"orphan")
+	if err := os.WriteFile(orphan, []byte("partial"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	server, err := New(cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	closeIdentityTestSupervisor(t, server)
+	if _, err := os.Lstat(orphan); !os.IsNotExist(err) {
+		t.Fatalf("orphaned identity state remained: %v", err)
+	}
+	if _, exists, err := readSessionIdentityState(filepath.Join(cfg.SessionBaseDir, sessionIdentityStateFile)); err != nil || !exists {
+		t.Fatalf("canonical identity state was not initialized: exists=%v err=%v", exists, err)
+	}
+}
+
+func TestNewRejectsNonFreshSessionIdentityAllocator(t *testing.T) {
+	cfg, _ := newSessionIdentityTestConfig(t)
+	if _, _, err := cfg.UIDAllocator.Allocate(); err != nil {
+		t.Fatal(err)
+	}
+	server, err := New(cfg)
+	if server != nil {
+		closeIdentityTestSupervisor(t, server)
+	}
+	if err == nil || !strings.Contains(err.Error(), "fresh") {
+		t.Fatalf("New error = %v, want fresh-allocator rejection", err)
+	}
+}
+
+func newSessionIdentityTestConfig(t *testing.T) (Config, harnessv2.RuntimeProfile) {
+	t.Helper()
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
+	}))
+	t.Cleanup(upstream.Close)
+	cfg, profile := newTestConfigWithUpstream(t, "immediate", upstream.URL, strings.Repeat("p", 32))
+	return cfg, profile
+}
+
+func closeIdentityTestSupervisor(t *testing.T, server *Server) {
+	t.Helper()
+	if server == nil {
+		return
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+	_ = server.Close(ctx)
+}
diff --git a/workers/acp/supervisor/status_auth_test.go b/workers/acp/supervisor/status_auth_test.go
new file mode 100644
index 000000000..7148197f5
--- /dev/null
+++ b/workers/acp/supervisor/status_auth_test.go
@@ -0,0 +1,53 @@
+package supervisor
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+)
+
+func TestSupervisorV2ProbeAuthenticationBoundary(t *testing.T) {
+	server, cfg, _ := newTestServer(t, "immediate")
+	tests := []struct {
+		name          string
+		path          string
+		authorization string
+		wantStatus    int
+	}{
+		{name: "health is public", path: harnessv2.HealthPath, wantStatus: http.StatusOK},
+		{name: "capabilities are public", path: harnessv2.CapabilitiesPath, wantStatus: http.StatusOK},
+		{name: "status rejects missing authorization", path: harnessv2.StatusPath, wantStatus: http.StatusUnauthorized},
+		{name: "status rejects wrong bearer", path: harnessv2.StatusPath, authorization: "Bearer " + strings.Repeat("w", 32), wantStatus: http.StatusUnauthorized},
+		{name: "status rejects bare token", path: harnessv2.StatusPath, authorization: cfg.ControllerBearerToken, wantStatus: http.StatusUnauthorized},
+		{name: "status rejects wrong scheme", path: harnessv2.StatusPath, authorization: "Basic " + cfg.ControllerBearerToken, wantStatus: http.StatusUnauthorized},
+		{name: "status accepts controller bearer", path: harnessv2.StatusPath, authorization: "Bearer " + cfg.ControllerBearerToken, wantStatus: http.StatusOK},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			request := httptest.NewRequest(http.MethodGet, test.path, nil)
+			if test.authorization != "" {
+				request.Header.Set("Authorization", test.authorization)
+			}
+			response := httptest.NewRecorder()
+			server.Handler().ServeHTTP(response, request)
+			if response.Code != test.wantStatus {
+				t.Fatalf("GET %s status = %d, want %d", test.path, response.Code, test.wantStatus)
+			}
+			if test.wantStatus != http.StatusUnauthorized {
+				return
+			}
+			var apiError harnessv2.ErrorResponse
+			if err := json.Unmarshal(response.Body.Bytes(), &apiError); err != nil {
+				t.Fatalf("decode auth rejection: %v", err)
+			}
+			if apiError.Code != harnessv2.ErrorCodeUnauthenticated {
+				t.Fatalf("auth rejection code = %q, want %q", apiError.Code, harnessv2.ErrorCodeUnauthenticated)
+			}
+		})
+	}
+}
diff --git a/workers/acp/supervisor/workspace_delta_limits_test.go b/workers/acp/supervisor/workspace_delta_limits_test.go
new file mode 100644
index 000000000..27def0048
--- /dev/null
+++ b/workers/acp/supervisor/workspace_delta_limits_test.go
@@ -0,0 +1,53 @@
+package supervisor
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	harnessv2 "github.com/orka-agents/orka/internal/harness/v2"
+	"github.com/orka-agents/orka/internal/workspacedelta"
+)
+
+func TestBuildWorkspaceDeltaPropagatesRequestMaxBytes(t *testing.T) {
+	root := t.TempDir()
+	if err := os.WriteFile(filepath.Join(root, "file.txt"), []byte("before\n"), 0o644); err != nil {
+		t.Fatalf("write baseline file: %v", err)
+	}
+	baseline, err := workspacedelta.Capture(root, workspacedelta.Options{})
+	if err != nil {
+		t.Fatalf("capture baseline: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "file.txt"), []byte(strings.Repeat("x", 2048)), 0o644); err != nil {
+		t.Fatalf("write oversized workspace change: %v", err)
+	}
+
+	_, err = buildWorkspaceDelta(
+		baseline,
+		root,
+		workspacedelta.IntentWrite,
+		harnessv2.WorkspaceDeltaLimits{MaxBytes: 1024},
+	)
+	if !errors.Is(err, workspacedelta.ErrLimitExceeded) {
+		t.Fatalf("buildWorkspaceDelta error = %v, want ErrLimitExceeded", err)
+	}
+	var pathErr *workspacedelta.PathError
+	if !errors.As(err, &pathErr) || pathErr.Op != "retain changed content" {
+		t.Fatalf("buildWorkspaceDelta error = %v, want request limit before content retention", err)
+	}
+
+	result, err := buildWorkspaceDelta(
+		baseline,
+		root,
+		workspacedelta.IntentWrite,
+		harnessv2.WorkspaceDeltaLimits{MaxBytes: 1 << 20},
+	)
+	if err != nil {
+		t.Fatalf("buildWorkspaceDelta within request limit: %v", err)
+	}
+	if result.Classification != workspacedelta.ClassificationWriteDelta || len(result.Artifact) == 0 {
+		t.Fatalf("buildWorkspaceDelta result = classification %q, artifact bytes %d", result.Classification, len(result.Artifact))
+	}
+}
diff --git a/workers/ai/main.go b/workers/ai/main.go
index 0ce08d3bb..d4144a619 100644
--- a/workers/ai/main.go
+++ b/workers/ai/main.go
@@ -38,6 +38,7 @@ import (
 
 	corev1alpha1 "github.com/orka-agents/orka/api/v1alpha1"
 	"github.com/orka-agents/orka/internal/events"
+	"github.com/orka-agents/orka/internal/executionmode"
 	"github.com/orka-agents/orka/internal/llm"
 	_ "github.com/orka-agents/orka/internal/llm/anthropic"
 	_ "github.com/orka-agents/orka/internal/llm/openai"
@@ -237,9 +238,10 @@ func run() (err error) {
 
 	coordinationEnv := workerenv.ParseCoordinationEnv(os.Getenv)
 
-	// Register coordination tools if enabled
-	if coordinationEnv.Enabled {
-		tools.RegisterCoordinationTools(k8sClient)
+	if err := registerModeAwareCoordinationTools(
+		k8sClient, workerEnv.ControllerMode, coordinationEnv.Enabled,
+	); err != nil {
+		return err
 	}
 
 	// Memory tools use the controller's internal API and are safe to register
@@ -373,6 +375,18 @@ func run() (err error) {
 	return nil
 }
 
+func registerModeAwareCoordinationTools(k8sClient client.Client, rawMode string, enabled bool) error {
+	if !enabled {
+		return nil
+	}
+	mode, err := executionmode.Parse(rawMode)
+	if err != nil {
+		return fmt.Errorf("invalid worker controller mode: %w", err)
+	}
+	tools.RegisterCoordinationTools(k8sClient, mode)
+	return nil
+}
+
 // createK8sClient creates a controller-runtime client for accessing CRDs
 func createK8sClient() (client.Client, error) {
 	config, err := rest.InClusterConfig()
diff --git a/workers/common/agent_runtime.go b/workers/common/agent_runtime.go
index 1fb3118fe..c2494fa3a 100644
--- a/workers/common/agent_runtime.go
+++ b/workers/common/agent_runtime.go
@@ -47,6 +47,7 @@ type AgentConfig struct {
 	SystemPrompt       string
 	MaxTurns           int
 	AllowedTools       []string
+	AllowedToolsSet    bool
 	DisallowedTools    []string
 	GitRepo            string
 	GitBranch          string
@@ -103,8 +104,11 @@ func loadConfig(defaultMaxTurns int, requirePrompt bool) (*AgentConfig, error) {
 		cfg.MaxTurns = n
 	}
 
-	if v := os.Getenv(workerenv.AllowedTools); v != "" {
-		cfg.AllowedTools = strings.Split(v, ",")
+	if v, ok := os.LookupEnv(workerenv.AllowedTools); ok {
+		cfg.AllowedToolsSet = true
+		if v != "" {
+			cfg.AllowedTools = strings.Split(v, ",")
+		}
 	}
 	if v := os.Getenv(workerenv.DisallowedTools); v != "" {
 		cfg.DisallowedTools = strings.Split(v, ",")
diff --git a/workers/common/agent_runtime_test.go b/workers/common/agent_runtime_test.go
index a6a5180c1..f26109a86 100644
--- a/workers/common/agent_runtime_test.go
+++ b/workers/common/agent_runtime_test.go
@@ -106,6 +106,41 @@ func TestLoadConfig_Defaults(t *testing.T) {
 	if cfg.MaxTurns != 50 {
 		t.Errorf("expected MaxTurns 50, got %d", cfg.MaxTurns)
 	}
+	if !cfg.AllowedToolsSet || len(cfg.AllowedTools) != 0 {
+		t.Errorf("AllowedTools = %#v (set=%t), want explicit empty allowlist", cfg.AllowedTools, cfg.AllowedToolsSet)
+	}
+}
+
+func TestLoadConfig_DistinguishesOmittedAndEmptyAllowedTools(t *testing.T) {
+	t.Setenv(workerenv.Prompt, "hello")
+	t.Setenv(workerenv.MaxTurns, "")
+	t.Setenv(workerenv.AllowedTools, "temporary")
+	t.Setenv(workerenv.DisallowedTools, "")
+	t.Setenv(workerenv.TimeoutSeconds, "")
+	if err := os.Unsetenv(workerenv.AllowedTools); err != nil {
+		t.Fatal(err)
+	}
+
+	omitted, err := LoadConfig(50)
+	if err != nil {
+		t.Fatalf("LoadConfig with omitted allowed tools: %v", err)
+	}
+	if omitted.AllowedToolsSet || omitted.AllowedTools != nil {
+		t.Fatalf("omitted AllowedTools = %#v (set=%t), want nil and unset", omitted.AllowedTools, omitted.AllowedToolsSet)
+	}
+
+	t.Setenv(workerenv.AllowedTools, "")
+	empty, err := LoadConfig(50)
+	if err != nil {
+		t.Fatalf("LoadConfig with empty allowed tools: %v", err)
+	}
+	if !empty.AllowedToolsSet || len(empty.AllowedTools) != 0 {
+		t.Fatalf(
+			"empty AllowedTools = %#v (set=%t), want explicit empty allowlist",
+			empty.AllowedTools,
+			empty.AllowedToolsSet,
+		)
+	}
 }
 
 func TestLoadConfig_AllFields(t *testing.T) {
@@ -862,7 +897,7 @@ func TestRunAgent_ExecutorSuccess(t *testing.T) {
 		return "completed successfully", nil
 	}
 
-	err := RunAgent("test-agent", "/tmp/ws", 50, executor)
+	err := RunAgent("test-agent", t.TempDir(), 50, executor)
 	if err != nil {
 		t.Fatalf("RunAgent should succeed, got: %v", err)
 	}
@@ -1345,7 +1380,7 @@ func TestRunAgent_ExecutorEmptyResultSubmitsPlaceholder(t *testing.T) {
 	defer server.Close()
 	t.Setenv("ORKA_RESULT_ENDPOINT", server.URL)
 
-	err := RunAgent("test-agent", "/tmp/ws", 50, func(_ context.Context, _ *AgentConfig) (string, error) {
+	err := RunAgent("test-agent", t.TempDir(), 50, func(_ context.Context, _ *AgentConfig) (string, error) {
 		return "", nil
 	})
 	if err != nil {
@@ -1378,7 +1413,7 @@ func TestRunAgent_ExecutorFailure(t *testing.T) {
 		return "partial output", fmt.Errorf("agent crashed")
 	}
 
-	err := RunAgent("test-agent", "/tmp/ws", 50, executor)
+	err := RunAgent("test-agent", t.TempDir(), 50, executor)
 	if err == nil {
 		t.Fatal("expected error from executor failure")
 	}
diff --git a/workers/common/artifacts.go b/workers/common/artifacts.go
index 5e262069c..a9dcd2fa9 100644
--- a/workers/common/artifacts.go
+++ b/workers/common/artifacts.go
@@ -47,15 +47,17 @@ func EnsureWorkspaceArtifactsLink(workspaceDir string) error {
 	if err := os.MkdirAll(artifactRoot, 0o755); err != nil {
 		return fmt.Errorf("failed to create artifacts directory: %w", err)
 	}
-	if err := os.MkdirAll(workspaceDir, 0o755); err != nil {
-		return fmt.Errorf("failed to create workspace directory: %w", err)
+	workspaceRoot, err := os.OpenRoot(workspaceDir)
+	if err != nil {
+		return fmt.Errorf("failed to open workspace directory: %w", err)
 	}
+	defer workspaceRoot.Close() //nolint:errcheck
 
 	linkPath := filepath.Join(workspaceDir, workspaceArtifactsDirName)
-	info, err := os.Lstat(linkPath)
+	info, err := workspaceRoot.Lstat(workspaceArtifactsDirName)
 	if err == nil {
 		if info.Mode()&os.ModeSymlink != 0 {
-			target, readErr := os.Readlink(linkPath)
+			target, readErr := workspaceRoot.Readlink(workspaceArtifactsDirName)
 			if readErr == nil {
 				resolved := target
 				if !filepath.IsAbs(resolved) {
@@ -72,7 +74,7 @@ func EnsureWorkspaceArtifactsLink(workspaceDir string) error {
 		return fmt.Errorf("failed to inspect workspace artifact path: %w", err)
 	}
 
-	if err := os.Symlink(artifactRoot, linkPath); err != nil {
+	if err := workspaceRoot.Symlink(artifactRoot, workspaceArtifactsDirName); err != nil {
 		return fmt.Errorf("failed to create workspace artifact symlink: %w", err)
 	}
 	return nil
diff --git a/workers/common/event_recorder.go b/workers/common/event_recorder.go
index f0d2f60f7..2bab37485 100644
--- a/workers/common/event_recorder.go
+++ b/workers/common/event_recorder.go
@@ -213,12 +213,6 @@ func WithEventTaskName(taskName string) EventOption {
 	}
 }
 
-func WithEventSessionName(sessionName string) EventOption {
-	return func(event *RecordedEvent) {
-		event.SessionName = sessionName
-	}
-}
-
 func WithEventAgentName(agentName string) EventOption {
 	return func(event *RecordedEvent) {
 		event.AgentName = agentName
diff --git a/workers/common/git_identity_unix.go b/workers/common/git_identity_unix.go
index c8efc0663..e9f5204d5 100644
--- a/workers/common/git_identity_unix.go
+++ b/workers/common/git_identity_unix.go
@@ -2,29 +2,8 @@
 
 package common
 
-import (
-	"os"
-	"strconv"
-	"strings"
-	"syscall"
-)
+import "syscall"
 
-const (
-	harnessWrapperChildUIDEnv = "ORKA_HARNESS_WRAPPER_CHILD_UID"
-	harnessWrapperChildGIDEnv = "ORKA_HARNESS_WRAPPER_CHILD_GID"
-)
-
-func gitCommandSysProcAttr() *syscall.SysProcAttr {
-	if os.Geteuid() != 0 {
-		return nil
-	}
-	uid, err := strconv.Atoi(strings.TrimSpace(os.Getenv(harnessWrapperChildUIDEnv)))
-	if err != nil || uid <= 0 {
-		return nil
-	}
-	gid, err := strconv.Atoi(strings.TrimSpace(os.Getenv(harnessWrapperChildGIDEnv)))
-	if err != nil || gid <= 0 {
-		return nil
-	}
-	return &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: uint32(uid), Gid: uint32(gid)}}
-}
+// Git commands inherit the worker identity. ACP runtime children perform their
+// own UID/GID isolation in the v2 supervisor and never route through workers/common.
+func gitCommandSysProcAttr() *syscall.SysProcAttr { return nil }
diff --git a/workers/common/workspace.go b/workers/common/workspace.go
index 19f6dfa9b..b17ae7fdd 100644
--- a/workers/common/workspace.go
+++ b/workers/common/workspace.go
@@ -16,7 +16,6 @@ import (
 	"net/url"
 	"os"
 	"os/exec"
-	"path/filepath"
 	"strings"
 	"time"
 
@@ -111,16 +110,10 @@ func PrepareWorkspace(workDir string) error {
 		}
 	}
 
-	// Write diff to a temp file.
-	diffPath := filepath.Join(workDir, ".orka-prior.patch")
-	if err := os.WriteFile(diffPath, []byte(sr.Diff), 0o600); err != nil {
-		return fmt.Errorf("failed to write diff to temp file: %w", err)
-	}
-	defer os.Remove(diffPath) //nolint:errcheck
-
-	// Dry-run check.
-	if out, err := execGit(workDir, "apply", "--check", diffPath); err != nil {
-		if _, reverseErr := execGit(workDir, "apply", "--reverse", "--check", diffPath); reverseErr == nil {
+	// Feed the untrusted patch through stdin instead of materializing a
+	// caller-influenced path in the workspace.
+	if out, err := execGitInput(workDir, sr.Diff, "apply", "--check", "-"); err != nil {
+		if _, reverseErr := execGitInput(workDir, sr.Diff, "apply", "--reverse", "--check", "-"); reverseErr == nil {
 			fmt.Fprintf(os.Stderr, "prior task diff already present in workspace; skipping reapply\n")
 			return nil
 		}
@@ -128,7 +121,7 @@ func PrepareWorkspace(workDir string) error {
 	}
 
 	// Apply the diff.
-	if out, err := execGit(workDir, "apply", diffPath); err != nil {
+	if out, err := execGitInput(workDir, sr.Diff, "apply", "-"); err != nil {
 		return fmt.Errorf("git apply failed: %s: %w", out, err)
 	}
 
@@ -142,7 +135,12 @@ func PreparePullRequestReviewContext(workDir string, cfg *AgentConfig) error {
 	if cfg == nil || strings.TrimSpace(cfg.PRBaseBranch) == "" {
 		return nil
 	}
-	if _, err := os.Stat(filepath.Join(workDir, ".git")); err != nil {
+	workspaceRoot, err := os.OpenRoot(workDir)
+	if err != nil {
+		return nil
+	}
+	defer workspaceRoot.Close() //nolint:errcheck
+	if _, err := workspaceRoot.Stat(".git"); err != nil {
 		return nil
 	}
 	baseBranch, baseRepo, baseSHA, fetchSource, err := pullRequestReviewGitContext(cfg)
@@ -175,7 +173,7 @@ func PreparePullRequestReviewContext(workDir string, cfg *AgentConfig) error {
 			return err
 		}
 	}
-	if err := os.MkdirAll(filepath.Join(workDir, pullRequestReviewContextDir), 0o755); err != nil {
+	if err := workspaceRoot.MkdirAll(pullRequestReviewContextDir, 0o755); err != nil {
 		return fmt.Errorf("create pull request review context directory: %w", err)
 	}
 	diff, diffTruncated, err := execGitLimited(
@@ -229,10 +227,10 @@ func PreparePullRequestReviewContext(workDir string, cfg *AgentConfig) error {
 		}
 		truncationNote = strings.Join(notes, "\n")
 	}
-	if err := os.WriteFile(filepath.Join(workDir, pullRequestReviewDiffPath), []byte(diff), 0o644); err != nil {
+	if err := workspaceRoot.WriteFile(pullRequestReviewDiffPath, []byte(diff), 0o644); err != nil {
 		return fmt.Errorf("write pull request review diff: %w", err)
 	}
-	if err := os.WriteFile(filepath.Join(workDir, pullRequestReviewFilesPath), []byte(files), 0o644); err != nil {
+	if err := workspaceRoot.WriteFile(pullRequestReviewFilesPath, []byte(files), 0o644); err != nil {
 		return fmt.Errorf("write pull request review file list: %w", err)
 	}
 	instructions := fmt.Sprintf(`# Pull Request Review Context
@@ -261,8 +259,7 @@ Truncation: %s
 		truncationNote,
 		strings.TrimSpace(stat),
 	)
-	instructionsPath := filepath.Join(workDir, pullRequestReviewInstructionsPath)
-	if err := os.WriteFile(instructionsPath, []byte(instructions), 0o644); err != nil {
+	if err := workspaceRoot.WriteFile(pullRequestReviewInstructionsPath, []byte(instructions), 0o644); err != nil {
 		return fmt.Errorf("write pull request review instructions: %w", err)
 	}
 	return nil
@@ -710,6 +707,16 @@ func execGit(dir string, args ...string) (string, error) {
 	return string(out), err
 }
 
+func execGitInput(dir, input string, args ...string) (string, error) {
+	cmd, err := newWorkspaceGitCommand(dir, args...)
+	if err != nil {
+		return "", err
+	}
+	cmd.Stdin = strings.NewReader(input)
+	out, err := cmd.CombinedOutput()
+	return string(out), err
+}
+
 func execGitLimited(dir string, limit int64, args ...string) (string, bool, error) {
 	var stdout limitedOutputBuffer
 	stdout.limit = limit
diff --git a/workers/general/main.go b/workers/general/main.go
index 0e599adcf..f8b5e6a07 100644
--- a/workers/general/main.go
+++ b/workers/general/main.go
@@ -238,6 +238,9 @@ func submitResult(workDir, output string) error {
 	resultDir := ""
 	if workDir != "" {
 		resultDir = workspaceDir
+		if err := configurePublicationRemote(resultDir); err != nil {
+			return err
+		}
 	}
 	resultBytes, err := common.FinalizeResult(resultDir, output)
 	if err != nil {
@@ -249,6 +252,18 @@ func submitResult(workDir, output string) error {
 	return common.UploadArtifacts()
 }
 
+func configurePublicationRemote(workDir string) error {
+	publicationRepo := strings.TrimSpace(os.Getenv(workerenv.ForkRepo))
+	if publicationRepo == "" || strings.TrimSpace(os.Getenv(workerenv.PushBranch)) == "" {
+		return nil
+	}
+	command := exec.Command("git", "-C", workDir, "remote", "set-url", "origin", publicationRepo)
+	if err := command.Run(); err != nil {
+		return fmt.Errorf("configure publication Git remote: %w", err)
+	}
+	return nil
+}
+
 func runSecurityMapper(ctx context.Context) error {
 	workDir, err := prepareWorkspaceIfConfigured(ctx)
 	if err != nil {
@@ -272,6 +287,22 @@ func runSecurityMapper(ctx context.Context) error {
 	if headCommit == "" {
 		headCommit = resolvedHeadCommit
 	}
+	for i := range slices {
+		contextSlice := slices[i]
+		contextSlice.ChangedFiles = append([]string(nil), changedFiles...)
+		contextSlice.ChangedLineRanges = append([]security.ChangedLineRange(nil), changedLineRanges...)
+		_, manifest, err := security.BuildReviewContext(workDir, contextSlice, security.ReviewContextOptions{})
+		if err != nil {
+			return fmt.Errorf("build security review context for %s: %w", contextSlice.ID, err)
+		}
+		manifestData, err := json.Marshal(manifest)
+		if err != nil {
+			return fmt.Errorf("marshal security review context for %s: %w", contextSlice.ID, err)
+		}
+		if err := common.WriteArtifactFile(security.ReviewContextArtifactName(contextSlice.ID), manifestData); err != nil {
+			return err
+		}
+	}
 	artifact := security.ReviewSlicesArtifact{
 		SchemaVersion:        security.SchemaVersionReviewSlices,
 		BaseCommit:           baseCommit,
diff --git a/workers/general/main_test.go b/workers/general/main_test.go
index 2945aa2bb..06fdfb114 100644
--- a/workers/general/main_test.go
+++ b/workers/general/main_test.go
@@ -23,6 +23,7 @@ import (
 
 	"github.com/orka-agents/orka/internal/security"
 	"github.com/orka-agents/orka/internal/workerenv"
+	"github.com/orka-agents/orka/workers/common"
 )
 
 func TestRun_Success(t *testing.T) {
@@ -197,6 +198,55 @@ func TestPrepareWorkspaceIfConfiguredRejectsTraversalSubPath(t *testing.T) {
 	}
 }
 
+func TestConfigurePublicationRemotePushesToPublicationRepository(t *testing.T) {
+	sourceBare := filepath.Join(t.TempDir(), "source.git")
+	targetBare := filepath.Join(t.TempDir(), "target.git")
+	seed := t.TempDir()
+	work := filepath.Join(t.TempDir(), "work")
+	runGit(t, t.TempDir(), "init", "--bare", sourceBare)
+	runGit(t, t.TempDir(), "init", "--bare", targetBare)
+	runGit(t, seed, "init", "-b", "main")
+	runGit(t, seed, "config", "user.email", "orka@example.com")
+	runGit(t, seed, "config", "user.name", "Orka Test")
+	if err := os.WriteFile(filepath.Join(seed, "file.txt"), []byte("source\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	runGit(t, seed, "add", "file.txt")
+	runGit(t, seed, "commit", "-m", "source")
+	runGit(t, seed, "remote", "add", "origin", "file://"+sourceBare)
+	runGit(t, seed, "push", "-u", "origin", "main")
+
+	clone := exec.Command("git", "clone", "--branch", "main", "file://"+sourceBare, work)
+	if output, err := clone.CombinedOutput(); err != nil {
+		t.Fatalf("git clone failed: %s: %v", strings.TrimSpace(string(output)), err)
+	}
+	t.Setenv(workerenv.ForkRepo, "file://"+targetBare)
+	t.Setenv(workerenv.PushBranch, "orka/publish")
+	t.Setenv(workerenv.RequirePushBranch, "true")
+	if err := configurePublicationRemote(work); err != nil {
+		t.Fatalf("configurePublicationRemote() error = %v", err)
+	}
+	if got := runGit(t, work, "remote", "get-url", "origin"); got != "file://"+targetBare {
+		t.Fatalf("origin URL = %q, want publication repository", got)
+	}
+	if err := os.WriteFile(filepath.Join(work, "file.txt"), []byte("published\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := common.FinalizeResult(work, "published"); err != nil {
+		t.Fatalf("FinalizeResult() error = %v", err)
+	}
+	targetHead := runGit(t, targetBare, "rev-parse", "refs/heads/orka/publish")
+	if targetHead == "" {
+		t.Fatal("publication repository branch is empty")
+	}
+	command := exec.Command(
+		"git", "-C", sourceBare, "rev-parse", "--verify", "refs/heads/orka/publish",
+	)
+	if command.Run() == nil {
+		t.Fatal("source repository unexpectedly received the publication branch")
+	}
+}
+
 func TestRun_CommandNotFound(t *testing.T) {
 	origArgs := os.Args
 	defer func() { os.Args = origArgs }()
diff --git a/workers/harness/Dockerfile b/workers/harness/Dockerfile
index 9f8465b43..904f035c9 100644
--- a/workers/harness/Dockerfile
+++ b/workers/harness/Dockerfile
@@ -17,7 +17,9 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH:-amd64} \
 
 FROM --platform=$TARGETPLATFORM golang:1.26 AS target-go
 
-# Runtime stage with common CLI dependencies for generic, Codex, Claude, and OpenCode adapters.
+# Runtime stage with common CLI dependencies for generic, Codex, Claude,
+# Copilot, and OpenCode v1 adapters. Deployment admission requires the final
+# image to be referenced by digest.
 FROM node:22-slim
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -31,7 +33,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     ripgrep \
     && rm -rf /var/lib/apt/lists/*
 
-RUN npm install -g @openai/codex @anthropic-ai/claude-code opencode-ai@1.18.2 \
+RUN npm install -g @openai/codex@0.145.0 @anthropic-ai/claude-code@2.1.217 opencode-ai@1.18.2 \
+    && command -v codex \
+    && command -v claude \
     && command -v opencode \
     && npm cache clean --force
 
diff --git a/workers/harness/cliwrapper/.gitignore b/workers/harness/cliwrapper/.gitignore
deleted file mode 100644
index 5ec983e30..000000000
--- a/workers/harness/cliwrapper/.gitignore
+++ /dev/null
@@ -1,4 +0,0 @@
-# Bundled Copilot CLI artifacts generated by github.com/github/copilot-sdk/go/cmd/bundler.
-*.zst
-*.license
-zcopilot_*.go
diff --git a/workers/harness/cliwrapper/adapter.go b/workers/harness/cliwrapper/adapter.go
index 71ff68a47..80f3186af 100644
--- a/workers/harness/cliwrapper/adapter.go
+++ b/workers/harness/cliwrapper/adapter.go
@@ -186,12 +186,14 @@ func turnEnvFromRequest(cfg Config, request harness.StartTurnRequest, metadata m
 		"timeoutSeconds":   workerenv.TimeoutSeconds,
 	}
 	for key, envName := range metadataEnv {
-		if value := strings.TrimSpace(metadata[key]); value != "" {
+		value := strings.TrimSpace(metadata[key])
+		if value != "" || strings.EqualFold(metadata[harness.MetadataRuntimePolicyFrozen], "true") {
 			env = setEnv(env, envName, value)
 		}
 	}
-	if strings.EqualFold(strings.TrimSpace(metadata["allowBash"]), "true") {
-		env = setEnv(env, workerenv.AllowBash, "true")
+	if value := strings.TrimSpace(metadata["allowBash"]); value != "" ||
+		strings.EqualFold(metadata[harness.MetadataRuntimePolicyFrozen], "true") {
+		env = setEnv(env, workerenv.AllowBash, value)
 	}
 	if strings.TrimSpace(metadata["pushBranch"]) != "" {
 		env = setEnv(env, workerenv.RequirePushBranch, "true")
@@ -233,10 +235,13 @@ func agentConfigFromEnv(defaultMaxTurns int) *agentEnvConfig {
 
 func agentConfigFromTurn(turn TurnContext) *agentEnvConfig {
 	cfg := agentConfigFromEnv(50)
-	if value := strings.TrimSpace(turn.Metadata["model"]); value != "" {
+	frozenPolicy := strings.EqualFold(
+		strings.TrimSpace(turn.Metadata[harness.MetadataRuntimePolicyFrozen]), "true",
+	)
+	if value := strings.TrimSpace(turn.Metadata["model"]); value != "" || frozenPolicy {
 		cfg.Model = value
 	}
-	if value := strings.TrimSpace(turn.Metadata["systemPrompt"]); value != "" {
+	if value, ok := turn.Metadata["systemPrompt"]; ok && (value != "" || frozenPolicy) {
 		cfg.SystemPrompt = value
 	}
 	if value := strings.TrimSpace(turn.Metadata["maxTurns"]); value != "" {
@@ -246,7 +251,10 @@ func agentConfigFromTurn(turn TurnContext) *agentEnvConfig {
 			cfg.MaxTurns = parsed
 		}
 	}
-	if value := strings.TrimSpace(turn.Metadata["allowedTools"]); value != "" {
+	allowedToolsSet := strings.EqualFold(
+		strings.TrimSpace(turn.Metadata[harness.MetadataAllowedToolsSet]), "true",
+	)
+	if value := strings.TrimSpace(turn.Metadata["allowedTools"]); value != "" || allowedToolsSet {
 		metadataAllowed := splitCSV(value)
 		if cfg.AllowedToolsSet {
 			cfg.AllowedTools = intersectTools(cfg.AllowedTools, metadataAllowed)
diff --git a/workers/harness/cliwrapper/adapter_test.go b/workers/harness/cliwrapper/adapter_test.go
index 831f95836..0b45d6da6 100644
--- a/workers/harness/cliwrapper/adapter_test.go
+++ b/workers/harness/cliwrapper/adapter_test.go
@@ -328,6 +328,36 @@ func TestConfigValidation(t *testing.T) {
 	}
 }
 
+func TestConfigValidationRejectsWeakOrInvalidAuthToken(t *testing.T) {
+	validToken := strings.Repeat("a", minAuthValueBytes)
+	tests := []struct {
+		name  string
+		token string
+	}{
+		{name: "missing", token: ""},
+		{name: "too short", token: strings.Repeat("a", minAuthValueBytes-1)},
+		{name: "embedded control byte", token: validToken[:16] + "\n" + validToken[16:]},
+		{name: "non ASCII byte", token: validToken[:16] + "é" + validToken[16:]},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := DefaultConfig()
+			cfg.AuthValue = tt.token
+			cfg.AdmissionLedgerPath = "/tmp/wrapper-ledger.db"
+			if err := cfg.Validate(); err == nil {
+				t.Fatal("Validate() error = nil, want invalid auth token")
+			}
+		})
+	}
+
+	cfg := DefaultConfig()
+	cfg.AuthValue = validToken
+	cfg.AdmissionLedgerPath = "/tmp/wrapper-ledger.db"
+	if err := cfg.Validate(); err != nil {
+		t.Fatalf("Validate() valid auth token error = %v", err)
+	}
+}
+
 func TestTurnContextFromRequestDoesNotDefaultWorkDirToRepo(t *testing.T) {
 	request := validWrapperStartTurnRequest()
 	turn := turnContextFromRequest(RuntimeGeneric, DefaultConfig(), request)
@@ -346,7 +376,7 @@ func TestTurnEnvFromRequestCarriesTimeoutMetadata(t *testing.T) {
 }
 
 func validWrapperStartTurnRequest() harness.StartTurnRequest {
-	return harness.StartTurnRequest{
+	request := harness.StartTurnRequest{
 		Version:          harness.ProtocolVersion,
 		Namespace:        "default",
 		TaskName:         "task-a",
@@ -357,14 +387,34 @@ func validWrapperStartTurnRequest() harness.StartTurnRequest {
 		Deadline:         time.Now().UTC().Add(time.Minute),
 		AuthIdentity:     harness.AuthIdentity{Subject: "user:test"},
 		Input:            harness.TurnInput{Prompt: testTurnPrompt},
+		Metadata: map[string]string{
+			harness.MetadataTaskUID:        "00000000-0000-0000-0000-000000000001",
+			harness.MetadataAttempt:        "1",
+			harness.MetadataBindingDigest:  "sha256:" + strings.Repeat("a", 64),
+			harness.MetadataSnapshotDigest: "sha256:" + strings.Repeat("b", 64),
+		},
 	}
+	return sealDurableWrapperRequest(request)
+}
+
+func sealDurableWrapperRequest(request harness.StartTurnRequest) harness.StartTurnRequest {
+	if request.Metadata == nil {
+		request.Metadata = map[string]string{}
+	}
+	delete(request.Metadata, harness.MetadataRequestDigest)
+	digest, err := harness.CanonicalStartTurnRequestDigest(request)
+	if err != nil {
+		panic(err)
+	}
+	request.Metadata[harness.MetadataRequestDigest] = digest
+	return request
 }
 
 func containsEnv(env []string, want string) bool {
 	return slices.Contains(env, want)
 }
 
-func TestLoadConfigFromEnvUnvalidatedAllowsFlagOnlyAuth(t *testing.T) {
+func TestLoadConfigFromEnvUnvalidatedAllowsFlagOnlyUnauthenticatedMode(t *testing.T) {
 	t.Setenv(EnvRuntime, RuntimeGeneric)
 	t.Setenv(EnvCommand, testEchoCommand)
 	cfg, err := LoadConfigFromEnvUnvalidated()
@@ -414,6 +464,40 @@ func TestAgentConfigFromTurnDisjointAllowlistsRemainDenyAll(t *testing.T) {
 	}
 }
 
+func TestAgentConfigFromTurnFrozenPolicyOverridesWorkerDefaults(t *testing.T) {
+	t.Setenv(workerenv.Model, "worker-model")
+	t.Setenv(workerenv.SystemPrompt, "worker system prompt")
+	t.Setenv(workerenv.MaxTurns, "99")
+	t.Setenv(workerenv.AllowedTools, "file_read,web_search")
+	t.Setenv(workerenv.AllowBash, "true")
+	t.Setenv(codexReasoningEffortEnv, "xhigh")
+	t.Setenv(claudeEffortEnv, "max")
+
+	metadata := map[string]string{
+		harness.MetadataRuntimePolicyFrozen: "true",
+		harness.MetadataAllowedToolsSet:     "true",
+		"model":                             "",
+		"systemPrompt":                      "",
+		"maxTurns":                          "7",
+		"reasoningEffort":                   "",
+		"allowedTools":                      "",
+		"allowBash":                         "false",
+	}
+	cfg := agentConfigFromTurn(TurnContext{Metadata: metadata})
+	if cfg.Model != "" || cfg.SystemPrompt != "" || cfg.MaxTurns != 7 {
+		t.Fatalf("frozen scalar policy = model=%q systemPrompt=%q maxTurns=%d", cfg.Model, cfg.SystemPrompt, cfg.MaxTurns)
+	}
+	if !cfg.AllowedToolsSet || len(cfg.AllowedTools) != 0 || cfg.AllowBash {
+		t.Fatalf("frozen tool policy = set=%v tools=%v allowBash=%v", cfg.AllowedToolsSet, cfg.AllowedTools, cfg.AllowBash)
+	}
+	if effort, err := codexReasoningEffort(metadata); err != nil || effort != "" {
+		t.Fatalf("frozen empty Codex effort = %q, err=%v", effort, err)
+	}
+	if effort, err := claudeEffort(metadata, nil); err != nil || effort != "" {
+		t.Fatalf("frozen empty Claude effort = %q, err=%v", effort, err)
+	}
+}
+
 func TestPrepareTurnContextRejectsUnsafePRBaseRepo(t *testing.T) {
 	root := t.TempDir()
 	turn := &TurnContext{
diff --git a/workers/harness/cliwrapper/child_identity_unix.go b/workers/harness/cliwrapper/child_identity_unix.go
index 9574152b1..d9cdffb9e 100644
--- a/workers/harness/cliwrapper/child_identity_unix.go
+++ b/workers/harness/cliwrapper/child_identity_unix.go
@@ -24,15 +24,17 @@ func childCredentialIDs() (int, int, bool) {
 	if os.Geteuid() != 0 {
 		return 0, 0, false
 	}
-	uid, err := strconv.Atoi(strings.TrimSpace(os.Getenv(EnvChildUID)))
-	if err != nil || uid <= 0 {
+	// Parse with bitSize 31 so the IDs always fit a non-negative platform int;
+	// larger values fail closed the same way as any other invalid identity.
+	uid, err := strconv.ParseUint(strings.TrimSpace(os.Getenv(EnvChildUID)), 10, 31)
+	if err != nil || uid == 0 {
 		return 0, 0, false
 	}
-	gid, err := strconv.Atoi(strings.TrimSpace(os.Getenv(EnvChildGID)))
-	if err != nil || gid <= 0 {
+	gid, err := strconv.ParseUint(strings.TrimSpace(os.Getenv(EnvChildGID)), 10, 31)
+	if err != nil || gid == 0 {
 		return 0, 0, false
 	}
-	return uid, gid, true
+	return int(uid), int(gid), true
 }
 
 func chownTreeForChild(path string, excludePaths ...string) error {
diff --git a/workers/harness/cliwrapper/claude_adapter.go b/workers/harness/cliwrapper/claude_adapter.go
index e54ab26c8..8ad3fc225 100644
--- a/workers/harness/cliwrapper/claude_adapter.go
+++ b/workers/harness/cliwrapper/claude_adapter.go
@@ -7,6 +7,7 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/orka-agents/orka/internal/harness"
 	"github.com/orka-agents/orka/internal/workerenv"
 )
 
@@ -32,17 +33,9 @@ func (a *ClaudeAdapter) BuildCommand(_ context.Context, turn TurnContext) (*Comm
 	if err != nil {
 		return nil, err
 	}
-	dir := firstNonEmpty(turn.WorkDir, a.config.WorkDir)
-	if dir == "" {
-		dir = DefaultWrapperWorkDir
-	}
-	if stat, err := os.Stat(dir); err != nil || !stat.IsDir() {
-		if err != nil && !os.IsNotExist(err) {
-			return nil, fmt.Errorf("stat claude workspace directory: %w", err)
-		}
-		if wd, wdErr := os.Getwd(); wdErr == nil {
-			dir = wd
-		}
+	dir, err := resolveAdapterWorkDir("claude", turn.WorkDir, a.config.WorkDir)
+	if err != nil {
+		return nil, err
 	}
 
 	return &CommandSpec{
@@ -99,7 +92,7 @@ func buildClaudeArgs(cfg *agentEnvConfig, turn TurnContext, effort string) []str
 	}
 	if tools := claudeAvailableTools(allowedTools); len(tools) > 0 {
 		args = append(args, "--tools", strings.Join(tools, ","))
-	} else if readOnly && cfg.AllowedToolsSet {
+	} else if cfg.AllowedToolsSet {
 		args = append(args, "--tools", "")
 	}
 	workDir := firstNonEmpty(turn.RootDir, turn.WorkDir)
@@ -118,11 +111,11 @@ func buildClaudeArgs(cfg *agentEnvConfig, turn TurnContext, effort string) []str
 }
 
 func claudeEffort(metadata map[string]string, turnEnv []string) (string, error) {
-	effort := strings.ToLower(strings.TrimSpace(firstNonEmpty(
-		metadata["reasoningEffort"],
-		envEntryValue(turnEnv, claudeEffortEnv),
-		os.Getenv(claudeEffortEnv),
-	)))
+	raw := metadata["reasoningEffort"]
+	if !strings.EqualFold(strings.TrimSpace(metadata[harness.MetadataRuntimePolicyFrozen]), "true") {
+		raw = firstNonEmpty(raw, envEntryValue(turnEnv, claudeEffortEnv), os.Getenv(claudeEffortEnv))
+	}
+	effort := strings.ToLower(strings.TrimSpace(raw))
 	if effort == "" {
 		return "", nil
 	}
diff --git a/workers/harness/cliwrapper/claude_adapter_test.go b/workers/harness/cliwrapper/claude_adapter_test.go
index 7aca5070d..0a0cf56ff 100644
--- a/workers/harness/cliwrapper/claude_adapter_test.go
+++ b/workers/harness/cliwrapper/claude_adapter_test.go
@@ -13,12 +13,14 @@ import (
 )
 
 func TestClaudeAdapterBuildsMinimalArgs(t *testing.T) {
+	t.Setenv(workerenv.AllowedTools, "")
 	turn := TurnContext{Prompt: "hello world", Metadata: map[string]string{"maxTurns": "50"}}
 	args := buildClaudeArgs(agentConfigFromTurn(turn), turn, "")
 	assertContains(t, args, "--print")
 	assertContains(t, args, "--verbose")
 	assertFlagValue(t, args, "--max-turns", "50")
 	assertFlagValue(t, args, "-p", "hello world")
+	assertNotContains(t, args, "--tools")
 	if args[len(args)-1] != "hello world" {
 		t.Fatalf("prompt should be last arg, got %q", args[len(args)-1])
 	}
@@ -137,6 +139,17 @@ func TestClaudeAdapterObsoleteOnlyAllowlistFailsClosed(t *testing.T) {
 	assertNotContains(t, args, "MultiEdit")
 }
 
+func TestClaudeAdapterExplicitEmptyAllowlistDisablesTools(t *testing.T) {
+	t.Setenv(workerenv.AllowedTools, "")
+	turn := TurnContext{Metadata: map[string]string{
+		harness.MetadataAllowedToolsSet: "true",
+		"allowedTools":                  "",
+	}}
+	args := buildClaudeArgs(agentConfigFromTurn(turn), turn, "")
+	assertFlagValue(t, args, "--tools", "")
+	assertNotContains(t, args, "--strict-mcp-config")
+}
+
 func TestClaudeAdapterDoesNotRewriteGenericPermissionPayloads(t *testing.T) {
 	turn := TurnContext{
 		Metadata: map[string]string{
diff --git a/workers/harness/cliwrapper/codex_adapter.go b/workers/harness/cliwrapper/codex_adapter.go
index 0823a2a08..5dadcc34a 100644
--- a/workers/harness/cliwrapper/codex_adapter.go
+++ b/workers/harness/cliwrapper/codex_adapter.go
@@ -7,6 +7,7 @@ import (
 	"path/filepath"
 	"strings"
 
+	"github.com/orka-agents/orka/internal/harness"
 	"github.com/orka-agents/orka/internal/workerenv"
 )
 
@@ -75,19 +76,11 @@ func (a *CodexAdapter) BuildCommand(_ context.Context, turn TurnContext) (*Comma
 		_ = cleanupInstructions // cleanup is represented by TempFiles for the command runner.
 	}
 
-	dir := firstNonEmpty(turn.WorkDir, a.config.WorkDir)
-	if dir == "" {
-		dir = DefaultWrapperWorkDir
-	}
-	if stat, err := os.Stat(dir); err != nil || !stat.IsDir() {
-		if err != nil && !os.IsNotExist(err) {
-			_ = os.Remove(outputPath)
-			cleanupInstructions()
-			return nil, fmt.Errorf("stat codex workspace directory: %w", err)
-		}
-		if wd, wdErr := os.Getwd(); wdErr == nil {
-			dir = wd
-		}
+	dir, err := resolveAdapterWorkDir("codex", turn.WorkDir, a.config.WorkDir)
+	if err != nil {
+		_ = os.Remove(outputPath)
+		cleanupInstructions()
+		return nil, err
 	}
 
 	baseURL := firstNonEmpty(codexOpenAIBaseURL(), envEntryValue(turn.Env, workerenv.OpenAIBaseURL))
@@ -282,11 +275,6 @@ func buildCodexEnv(extra []string, baseURL string, readOnly bool, readOnlyHome s
 	if baseURL != "" {
 		env = setEnv(env, workerenv.OpenAIBaseURL, baseURL)
 	}
-	if envEntryValue(env, workerenv.CodexAPIKey) == "" {
-		if apiKey := strings.TrimSpace(os.Getenv(workerenv.OpenAIAPIKey)); apiKey != "" {
-			env = setEnv(env, workerenv.CodexAPIKey, apiKey)
-		}
-	}
 	return env
 }
 
@@ -321,10 +309,11 @@ func codexOpenAIBaseURL() string {
 }
 
 func codexReasoningEffort(metadata map[string]string) (string, error) {
-	effort := strings.ToLower(strings.TrimSpace(firstNonEmpty(
-		metadata["reasoningEffort"],
-		os.Getenv(codexReasoningEffortEnv),
-	)))
+	raw := metadata["reasoningEffort"]
+	if !strings.EqualFold(strings.TrimSpace(metadata[harness.MetadataRuntimePolicyFrozen]), "true") {
+		raw = firstNonEmpty(raw, os.Getenv(codexReasoningEffortEnv))
+	}
+	effort := strings.ToLower(strings.TrimSpace(raw))
 	if effort == "" {
 		return "", nil
 	}
diff --git a/workers/harness/cliwrapper/codex_adapter_test.go b/workers/harness/cliwrapper/codex_adapter_test.go
index b474b5b43..0ce923bdc 100644
--- a/workers/harness/cliwrapper/codex_adapter_test.go
+++ b/workers/harness/cliwrapper/codex_adapter_test.go
@@ -262,8 +262,9 @@ if [ "${ORKA_PROMPT+x}" = "x" ]; then
   exit 64
 fi
 printf 'unset' > "$CODEX_PROMPT_ENV_CAPTURE"
-if [ "${CODEX_INHERITED_ENV:-}" != "inherited-value" ]; then exit 65; fi
+if [ -n "${CODEX_INHERITED_ENV:-}" ]; then exit 65; fi
 if [ "${CODEX_SPEC_ENV:-}" != "spec-value" ]; then exit 66; fi
+if [ -n "${OPENAI_API_KEY:-}" ] || [ -n "${CODEX_API_KEY:-}" ]; then exit 67; fi
 cat > "$CODEX_STDIN_CAPTURE"
 printf 'large prompt received' > "$out"
 `), 0o700); err != nil {
@@ -272,6 +273,8 @@ printf 'large prompt received' > "$out"
 	t.Setenv(workerenv.AllowBash, "true")
 	t.Setenv(workerenv.Prompt, "inherited-parent-value")
 	t.Setenv("CODEX_INHERITED_ENV", "inherited-value")
+	t.Setenv(workerenv.OpenAIAPIKey, "operator-openai-key")
+	t.Setenv(workerenv.CodexAPIKey, "operator-codex-key")
 	cfg := DefaultConfig()
 	cfg.AllowUnauthenticated = true
 	cfg.Runtime = RuntimeCodex
@@ -322,6 +325,7 @@ printf 'large prompt received' > "$out"
 }
 
 func TestCodexAdapterSecurityArtifactFollowUpUsesStdinWithoutPromptEnv(t *testing.T) {
+	configureSuccessfulArtifactUpload(t)
 	dir := t.TempDir()
 	invocationMarker := filepath.Join(dir, "codex-invoked")
 	followUpStdinCapture := filepath.Join(dir, "codex-follow-up-stdin.txt")
@@ -488,6 +492,21 @@ func TestCodexAdapterPreservesExplicitCodexAPIKey(t *testing.T) {
 	}
 }
 
+func TestCodexAdapterDoesNotImportAmbientOpenAIAPIKey(t *testing.T) {
+	t.Setenv(workerenv.AllowBash, "true")
+	t.Setenv(workerenv.OpenAIAPIKey, "operator-openai-key")
+	adapter := NewCodexAdapter(CodexAdapterConfig{Path: "/fake/codex", WorkDir: t.TempDir()})
+	spec, err := adapter.BuildCommand(context.Background(), TurnContext{Prompt: "do work"})
+	if err != nil {
+		t.Fatalf("BuildCommand: %v", err)
+	}
+	defer removeTempFiles(spec.TempFiles)
+	if containsEnv(spec.Env, workerenv.OpenAIAPIKey+"=operator-openai-key") ||
+		containsEnv(spec.Env, workerenv.CodexAPIKey+"=operator-openai-key") {
+		t.Fatalf("env = %#v, want ambient OpenAI API key withheld", spec.Env)
+	}
+}
+
 func TestCodexAdapterUsesRuntimeSecretBaseURLWithoutOperatorBaseURL(t *testing.T) {
 	t.Setenv(workerenv.AllowBash, "true")
 	t.Setenv(workerenv.OpenAIBaseURL, "")
diff --git a/workers/harness/cliwrapper/command_test.go b/workers/harness/cliwrapper/command_test.go
index b2b200cf7..d939f8bf8 100644
--- a/workers/harness/cliwrapper/command_test.go
+++ b/workers/harness/cliwrapper/command_test.go
@@ -80,7 +80,7 @@ func TestCommandRunnerPreservesFullStdoutWhenLogPreviewTruncates(t *testing.T) {
 	}
 }
 
-func TestCommandRunnerUnsetsEnvAfterMerge(t *testing.T) {
+func TestCommandRunnerDoesNotInheritParentEnvAndUnsetsAfterMerge(t *testing.T) {
 	t.Setenv(envCommandRunnerDrop, "inherited-value")
 	t.Setenv(envCommandRunnerKeepParent, "parent-value")
 	runner := CommandRunner{StdoutLimitBytes: 64, StderrLimitBytes: 64, CancelGrace: 10 * time.Millisecond}
@@ -96,8 +96,8 @@ func TestCommandRunnerUnsetsEnvAfterMerge(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Run: %v", err)
 	}
-	if got := result.ExactStdout(); got != "parent-value|spec-value" {
-		t.Fatalf("ExactStdout = %q, want preserved inherited and spec env", got)
+	if got := result.ExactStdout(); got != "|spec-value" {
+		t.Fatalf("ExactStdout = %q, want parent env withheld and explicit spec env preserved", got)
 	}
 }
 
diff --git a/workers/harness/cliwrapper/config.go b/workers/harness/cliwrapper/config.go
index 28845d3d2..e5684a717 100644
--- a/workers/harness/cliwrapper/config.go
+++ b/workers/harness/cliwrapper/config.go
@@ -28,6 +28,9 @@ const (
 	EnvAuthValueFile        = "ORKA_HARNESS_WRAPPER_BEARER_TOKEN_FILE"
 	EnvAllowUnauthenticated = "ORKA_HARNESS_WRAPPER_ALLOW_UNAUTHENTICATED"
 	EnvTurnRetention        = "ORKA_HARNESS_WRAPPER_TURN_RETENTION"
+	EnvAdmissionLedgerPath  = "ORKA_HARNESS_WRAPPER_ADMISSION_LEDGER_PATH"
+	EnvLedgerGeneration     = "ORKA_HARNESS_WRAPPER_LEDGER_GENERATION"
+	EnvLedgerRetention      = "ORKA_HARNESS_WRAPPER_LEDGER_RETENTION"
 	EnvCopilotCLIPath       = "ORKA_HARNESS_WRAPPER_COPILOT_CLI_PATH"
 	EnvCopilotHelperPath    = "ORKA_HARNESS_WRAPPER_COPILOT_HELPER_PATH"
 )
@@ -46,8 +49,11 @@ const (
 	DefaultOutputLimitBytes = maxTerminalResultBytes
 	DefaultCancelGrace      = 2 * time.Second
 	DefaultTurnRetention    = 5 * time.Minute
+	DefaultLedgerRetention  = 30 * 24 * time.Hour
 	DefaultPromptEnv        = "ORKA_TURN_PROMPT"
 	DefaultWrapperWorkDir   = "/workspace"
+	DefaultLedgerGeneration = "1"
+	minAuthValueBytes       = 32
 )
 
 type Config struct {
@@ -62,6 +68,9 @@ type Config struct {
 	AuthValueFile        string
 	AllowUnauthenticated bool
 	TurnRetention        time.Duration
+	AdmissionLedgerPath  string
+	LedgerGeneration     string
+	LedgerRetention      time.Duration
 	Generic              GenericAdapterConfig
 	Codex                CodexAdapterConfig
 	Claude               ClaudeAdapterConfig
@@ -111,6 +120,8 @@ func DefaultConfig() Config {
 		StderrLimitBytes: DefaultOutputLimitBytes,
 		CancelGrace:      DefaultCancelGrace,
 		TurnRetention:    DefaultTurnRetention,
+		LedgerGeneration: DefaultLedgerGeneration,
+		LedgerRetention:  DefaultLedgerRetention,
 		Generic: GenericAdapterConfig{
 			PromptMode: PromptModeStdin,
 			PromptEnv:  DefaultPromptEnv,
@@ -119,14 +130,6 @@ func DefaultConfig() Config {
 	}
 }
 
-func LoadConfigFromEnv() (Config, error) {
-	cfg, err := LoadConfigFromEnvUnvalidated()
-	if err != nil {
-		return Config{}, err
-	}
-	return cfg, cfg.Validate()
-}
-
 //nolint:gocyclo // Centralized env parsing keeps wrapper configuration ownership in one module.
 func LoadConfigFromEnvUnvalidated() (Config, error) {
 	cfg := DefaultConfig()
@@ -218,6 +221,19 @@ func LoadConfigFromEnvUnvalidated() (Config, error) {
 		}
 		cfg.TurnRetention = parsed
 	}
+	if v := strings.TrimSpace(os.Getenv(EnvAdmissionLedgerPath)); v != "" {
+		cfg.AdmissionLedgerPath = v
+	}
+	if v := strings.TrimSpace(os.Getenv(EnvLedgerGeneration)); v != "" {
+		cfg.LedgerGeneration = v
+	}
+	if v := strings.TrimSpace(os.Getenv(EnvLedgerRetention)); v != "" {
+		parsed, err := time.ParseDuration(v)
+		if err != nil || parsed <= 0 {
+			return Config{}, fmt.Errorf("invalid %s: %q", EnvLedgerRetention, v)
+		}
+		cfg.LedgerRetention = parsed
+	}
 	if v := strings.TrimSpace(os.Getenv(EnvCopilotCLIPath)); v != "" {
 		cfg.Copilot.Path = v
 	}
@@ -243,8 +259,19 @@ func (c Config) Validate() error {
 	if c.TurnRetention <= 0 {
 		return fmt.Errorf("turn retention must be positive")
 	}
-	if !c.AllowUnauthenticated && strings.TrimSpace(c.AuthValue) == "" {
-		return fmt.Errorf("auth token is required unless %s=true", EnvAllowUnauthenticated)
+	if !c.AllowUnauthenticated {
+		if err := validateAuthValue(c.AuthValue); err != nil {
+			return err
+		}
+	}
+	if !c.AllowUnauthenticated && strings.TrimSpace(c.AdmissionLedgerPath) == "" {
+		return fmt.Errorf("durable admission ledger path is required unless %s=true", EnvAllowUnauthenticated)
+	}
+	if strings.TrimSpace(c.AdmissionLedgerPath) != "" && strings.TrimSpace(c.LedgerGeneration) == "" {
+		return fmt.Errorf("durable admission ledger generation is required")
+	}
+	if strings.TrimSpace(c.AdmissionLedgerPath) != "" && c.LedgerRetention <= 0 {
+		return fmt.Errorf("durable admission ledger retention must be positive")
 	}
 	switch strings.ToLower(strings.TrimSpace(c.Runtime)) {
 	case "", RuntimeGeneric, RuntimeCodex, RuntimeClaude, RuntimeCopilot, RuntimeOpencode, RuntimeMulti:
@@ -254,6 +281,19 @@ func (c Config) Validate() error {
 	}
 }
 
+func validateAuthValue(value string) error {
+	value = strings.TrimSpace(value)
+	if len(value) < minAuthValueBytes {
+		return fmt.Errorf("auth token must be at least %d bytes unless %s=true", minAuthValueBytes, EnvAllowUnauthenticated)
+	}
+	for i := 0; i < len(value); i++ {
+		if value[i] <= 0x20 || value[i] >= 0x7f {
+			return fmt.Errorf("auth token contains invalid header bytes")
+		}
+	}
+	return nil
+}
+
 func parseStringListEnv(name, value string) ([]string, error) {
 	value = strings.TrimSpace(value)
 	if value == "" {
diff --git a/workers/harness/cliwrapper/copilot_adapter.go b/workers/harness/cliwrapper/copilot_adapter.go
index 740f02b2c..c66923353 100644
--- a/workers/harness/cliwrapper/copilot_adapter.go
+++ b/workers/harness/cliwrapper/copilot_adapter.go
@@ -16,8 +16,9 @@ import (
 )
 
 const (
-	defaultCopilotMaxTurns = 50
-	defaultCopilotTimeout  = 20 * time.Minute
+	defaultCopilotMaxTurns              = 50
+	defaultCopilotTimeout               = 20 * time.Minute
+	copilotPermissionDeniedByToolPolicy = "denied-no-approval-rule-and-could-not-request-from-user"
 )
 
 type CopilotAdapter struct {
@@ -39,17 +40,9 @@ func (a *CopilotAdapter) BuildCommand(_ context.Context, turn TurnContext) (*Com
 			return nil, fmt.Errorf("resolve copilot helper executable: %w", err)
 		}
 	}
-	dir := firstNonEmpty(turn.WorkDir, a.config.WorkDir)
-	if dir == "" {
-		dir = DefaultWrapperWorkDir
-	}
-	if stat, err := os.Stat(dir); err != nil || !stat.IsDir() {
-		if err != nil && !os.IsNotExist(err) {
-			return nil, fmt.Errorf("stat copilot workspace directory: %w", err)
-		}
-		if wd, wdErr := os.Getwd(); wdErr == nil {
-			dir = wd
-		}
+	dir, err := resolveAdapterWorkDir("copilot", turn.WorkDir, a.config.WorkDir)
+	if err != nil {
+		return nil, err
 	}
 	env := append([]string(nil), turn.Env...)
 	env = setEnv(env, "HOME", firstNonEmpty(envEntryValue(env, "HOME"), "/home/worker"))
@@ -172,6 +165,9 @@ func buildCopilotSessionConfig(cfg *common.AgentConfig, workDir string) *copilot
 	if cfg == nil {
 		cfg = &common.AgentConfig{MaxTurns: defaultCopilotMaxTurns}
 	}
+	allowedTools := trimmedTools(cfg.AllowedTools)
+	allowedToolsSet := cfg.AllowedToolsSet || len(allowedTools) > 0
+	denyAllTools := allowedToolsSet && len(allowedTools) == 0
 	sessionCfg := &copilot.SessionConfig{
 		Model:            strings.TrimSpace(cfg.Model),
 		WorkingDirectory: strings.TrimSpace(workDir),
@@ -179,18 +175,38 @@ func buildCopilotSessionConfig(cfg *common.AgentConfig, workDir string) *copilot
 			_ copilot.PermissionRequest,
 			_ copilot.PermissionInvocation,
 		) (copilot.PermissionRequestResult, error) {
+			if denyAllTools {
+				return copilot.PermissionRequestResult{Kind: copilotPermissionDeniedByToolPolicy}, nil
+			}
 			return copilot.PermissionRequestResult{Kind: "approved"}, nil
 		},
 	}
 	if systemPrompt := strings.TrimSpace(cfg.SystemPrompt); systemPrompt != "" {
 		sessionCfg.SystemMessage = &copilot.SystemMessageConfig{Mode: "append", Content: systemPrompt}
 	}
-	if tools := trimmedTools(cfg.AllowedTools); len(tools) > 0 {
-		sessionCfg.AvailableTools = tools
+	if allowedToolsSet {
+		sessionCfg.AvailableTools = make([]string, len(allowedTools))
+		copy(sessionCfg.AvailableTools, allowedTools)
 	}
 	if tools := trimmedTools(cfg.DisallowedTools); len(tools) > 0 {
 		sessionCfg.ExcludedTools = tools
 	}
+	if denyAllTools {
+		// The SDK omits an empty availableTools array from the wire request.
+		// Keep both enforcement points fail-closed so no permission request or
+		// tool invocation can turn an explicit empty allowlist into allow-all.
+		sessionCfg.Hooks = &copilot.SessionHooks{
+			OnPreToolUse: func(
+				_ copilot.PreToolUseHookInput,
+				_ copilot.HookInvocation,
+			) (*copilot.PreToolUseHookOutput, error) {
+				return &copilot.PreToolUseHookOutput{
+					PermissionDecision:       "deny",
+					PermissionDecisionReason: "tool use denied by explicit empty allowlist",
+				}, nil
+			},
+		}
+	}
 	return sessionCfg
 }
 
diff --git a/workers/harness/cliwrapper/copilot_adapter_test.go b/workers/harness/cliwrapper/copilot_adapter_test.go
index 4669eb2f5..21548a1fa 100644
--- a/workers/harness/cliwrapper/copilot_adapter_test.go
+++ b/workers/harness/cliwrapper/copilot_adapter_test.go
@@ -92,6 +92,7 @@ func TestBuildCopilotSessionConfig(t *testing.T) {
 		Model:           "gpt-5.4",
 		SystemPrompt:    "system",
 		AllowedTools:    []string{" bash ", "create_file"},
+		AllowedToolsSet: true,
 		DisallowedTools: []string{" web_search "},
 	}
 	sessionCfg := buildCopilotSessionConfig(cfg, "/workspace/repo")
@@ -112,6 +113,56 @@ func TestBuildCopilotSessionConfig(t *testing.T) {
 	if sessionCfg.OnPermissionRequest == nil {
 		t.Fatal("OnPermissionRequest = nil, want auto-approve handler")
 	}
+	permission, err := sessionCfg.OnPermissionRequest(copilot.PermissionRequest{}, copilot.PermissionInvocation{})
+	if err != nil || permission.Kind != "approved" {
+		t.Fatalf("permission = %#v, %v, want approved", permission, err)
+	}
+}
+
+func TestBuildCopilotSessionConfigExplicitEmptyAllowedToolsDeniesTools(t *testing.T) {
+	t.Setenv(workerenv.Prompt, "pure prompt")
+	t.Setenv(workerenv.MaxTurns, "")
+	t.Setenv(workerenv.AllowedTools, "")
+	t.Setenv(workerenv.DisallowedTools, "")
+	t.Setenv(workerenv.TimeoutSeconds, "")
+
+	cfg, err := common.LoadConfig(defaultCopilotMaxTurns)
+	if err != nil {
+		t.Fatalf("LoadConfig: %v", err)
+	}
+	if !cfg.AllowedToolsSet || len(cfg.AllowedTools) != 0 {
+		t.Fatalf("AllowedTools = %#v (set=%t), want explicit empty allowlist", cfg.AllowedTools, cfg.AllowedToolsSet)
+	}
+
+	sessionCfg := buildCopilotSessionConfig(cfg, "/workspace/repo")
+	if sessionCfg.AvailableTools == nil || len(sessionCfg.AvailableTools) != 0 {
+		t.Fatalf("AvailableTools = %#v, want explicit empty allowlist", sessionCfg.AvailableTools)
+	}
+	permission, err := sessionCfg.OnPermissionRequest(copilot.PermissionRequest{}, copilot.PermissionInvocation{})
+	if err != nil || permission.Kind != copilotPermissionDeniedByToolPolicy {
+		t.Fatalf("permission = %#v, %v, want deny-all result", permission, err)
+	}
+	if sessionCfg.Hooks == nil || sessionCfg.Hooks.OnPreToolUse == nil {
+		t.Fatal("OnPreToolUse = nil, want deny-all hook")
+	}
+	decision, err := sessionCfg.Hooks.OnPreToolUse(copilot.PreToolUseHookInput{}, copilot.HookInvocation{})
+	if err != nil || decision == nil || decision.PermissionDecision != "deny" {
+		t.Fatalf("pre-tool decision = %#v, %v, want deny", decision, err)
+	}
+}
+
+func TestBuildCopilotSessionConfigOmittedAllowedToolsRetainsDefaultBehavior(t *testing.T) {
+	sessionCfg := buildCopilotSessionConfig(&common.AgentConfig{}, "/workspace/repo")
+	if sessionCfg.AvailableTools != nil {
+		t.Fatalf("AvailableTools = %#v, want omitted", sessionCfg.AvailableTools)
+	}
+	permission, err := sessionCfg.OnPermissionRequest(copilot.PermissionRequest{}, copilot.PermissionInvocation{})
+	if err != nil || permission.Kind != "approved" {
+		t.Fatalf("permission = %#v, %v, want approved", permission, err)
+	}
+	if sessionCfg.Hooks != nil {
+		t.Fatalf("Hooks = %#v, want no deny-all hook", sessionCfg.Hooks)
+	}
 }
 
 func TestExtractCopilotResultPreferenceOrder(t *testing.T) {
diff --git a/workers/harness/cliwrapper/durable_admission_test.go b/workers/harness/cliwrapper/durable_admission_test.go
new file mode 100644
index 000000000..1a949b727
--- /dev/null
+++ b/workers/harness/cliwrapper/durable_admission_test.go
@@ -0,0 +1,675 @@
+package cliwrapper
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/orka-agents/orka/internal/harness"
+	"github.com/orka-agents/orka/internal/harness/ledger"
+)
+
+const durableAdmissionControllerToken = "controller-token-0123456789abcdef"
+
+func TestDurableAdmissionSurvivesWrapperRestart(t *testing.T) {
+	cfg := DefaultConfig()
+	cfg.AuthValue = durableAdmissionControllerToken
+	cfg.AdmissionLedgerPath = t.TempDir() + "/admission-ledger.db"
+	cfg.Generic.Command = testEchoCommand
+	request := validWrapperStartTurnRequest()
+
+	baseURL, stop := startWrapperServerWithConfig(t, cfg, NewFakeAdapter(FakeBehaviorSuccess))
+	client, err := harness.NewClient(baseURL, harness.WithBearerToken(cfg.AuthValue))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := client.StartTurn(context.Background(), request); err != nil {
+		t.Fatalf("StartTurn(first): %v", err)
+	}
+	_ = collectWrapperFrames(t, client, request.TurnID, 0)
+	stop()
+
+	baseURL, stop = startWrapperServerWithConfig(t, cfg, NewFakeAdapter(FakeBehaviorSuccess))
+	defer stop()
+	client, err = harness.NewClient(baseURL, harness.WithBearerToken(cfg.AuthValue))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := client.StartTurn(context.Background(), request); err == nil || !strings.Contains(err.Error(), "409") {
+		t.Fatalf("StartTurn(after restart) error = %v, want durable conflict", err)
+	}
+
+	status, err := client.DurableTurnStatus(context.Background(), request.TurnID)
+	if err != nil {
+		t.Fatalf("DurableTurnStatus: %v", err)
+	}
+	if status.State != harness.DurableTurnTerminal || status.TerminalReceiptDigest == "" {
+		t.Fatalf("durable status = %#v, want terminal receipt", status)
+	}
+}
+
+func TestDurableTurnOutputSurvivesWrapperRestart(t *testing.T) {
+	cfg := DefaultConfig()
+	cfg.AuthValue = durableAdmissionControllerToken
+	cfg.AdmissionLedgerPath = filepath.Join(t.TempDir(), "admission-ledger.db")
+	want := "result bytes retained across wrapper restart"
+	cfg.Generic = GenericAdapterConfig{
+		Command:    wrapperTestShellPath,
+		Args:       []string{"-c", "printf '%s' '" + want + "' > result.txt"},
+		PromptMode: PromptModeStdin,
+		ResultMode: ResultModeFile,
+		ResultFile: "result.txt",
+	}
+	request := validWrapperStartTurnRequest()
+
+	baseURL, stop := startWrapperServerWithConfig(t, cfg, NewGenericAdapter(cfg.Generic))
+	client, err := harness.NewClient(baseURL, harness.WithBearerToken(cfg.AuthValue))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := client.StartTurn(context.Background(), request); err != nil {
+		t.Fatalf("StartTurn: %v", err)
+	}
+	frames := collectWrapperFrames(t, client, request.TurnID, 0)
+	last := frames[len(frames)-1]
+	if last.Completed == nil || last.Completed.OutputRef != localOutputRef {
+		t.Fatalf("terminal frame = %#v, want durable local output ref", last)
+	}
+	stop()
+
+	baseURL, stop = startWrapperServerWithConfig(t, cfg, NewGenericAdapter(cfg.Generic))
+	client, err = harness.NewClient(baseURL, harness.WithBearerToken(cfg.AuthValue))
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := client.FetchTurnOutput(context.Background(), request.TurnID, last.Completed.OutputRef)
+	if err != nil {
+		t.Fatalf("FetchTurnOutput(after restart): %v", err)
+	}
+	if string(got) != want {
+		t.Fatalf("fetched output = %q, want %q", got, want)
+	}
+	receipt, err := harness.DurableTurnTerminalReceiptFromFrame(last)
+	if err != nil {
+		t.Fatalf("terminal receipt: %v", err)
+	}
+	receiptDigest, err := harness.DurableTurnTerminalReceiptDigest(receipt)
+	if err != nil {
+		t.Fatalf("terminal receipt digest: %v", err)
+	}
+	acknowledgement := harness.TurnOutputAcknowledgementRequest{
+		Version:               harness.ProtocolVersion,
+		TurnID:                request.TurnID,
+		OutputRef:             last.Completed.OutputRef,
+		TerminalReceiptDigest: receiptDigest,
+	}
+	if err := client.AcknowledgeTurnOutput(context.Background(), acknowledgement); err != nil {
+		t.Fatalf("AcknowledgeTurnOutput: %v", err)
+	}
+	if _, err := client.FetchTurnOutput(
+		context.Background(), request.TurnID, last.Completed.OutputRef,
+	); err == nil || !strings.Contains(err.Error(), "404") {
+		t.Fatalf("FetchTurnOutput(after acknowledgement) error = %v, want 404", err)
+	}
+	stop()
+
+	baseURL, stop = startWrapperServerWithConfig(t, cfg, NewGenericAdapter(cfg.Generic))
+	defer stop()
+	client, err = harness.NewClient(baseURL, harness.WithBearerToken(cfg.AuthValue))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := client.AcknowledgeTurnOutput(context.Background(), acknowledgement); err != nil {
+		t.Fatalf("AcknowledgeTurnOutput(after restart): %v", err)
+	}
+}
+
+func TestDurableTurnEnvValuesAreRedactedAcrossRestart(t *testing.T) {
+	testCases := []struct {
+		name   string
+		script string
+		failed bool
+	}{
+		{
+			name: "completed",
+			script: "printf 'stdout:%s' \"$OPAQUE_TURN_ENV\"; " +
+				"printf 'stderr:%s' \"$OPAQUE_TURN_ENV\" >&2; " +
+				"printf 'result:%s' \"$OPAQUE_TURN_ENV\" > result.txt",
+		},
+		{
+			name: "failed",
+			script: "printf 'stdout:%s' \"$OPAQUE_TURN_ENV\"; " +
+				"printf 'stderr:%s' \"$OPAQUE_TURN_ENV\" >&2; " +
+				"printf 'result:%s' \"$OPAQUE_TURN_ENV\" > result.txt; exit 7",
+			failed: true,
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			const opaqueValue = "opaque-turn-env-value-84e23a"
+			cfg := DefaultConfig()
+			cfg.AuthValue = durableAdmissionControllerToken
+			cfg.AdmissionLedgerPath = filepath.Join(t.TempDir(), "admission-ledger.db")
+			cfg.Generic = GenericAdapterConfig{
+				Command:    wrapperTestShellPath,
+				Args:       []string{"-c", testCase.script},
+				PromptMode: PromptModeStdin,
+				ResultMode: ResultModeFile,
+				ResultFile: "result.txt",
+			}
+			request := validWrapperStartTurnRequest()
+			request.Input.Env = []harness.TurnEnvVar{{Name: "OPAQUE_TURN_ENV", Value: opaqueValue}}
+			request = sealDurableWrapperRequest(request)
+
+			baseURL, stop := startWrapperServerWithConfig(t, cfg, NewGenericAdapter(cfg.Generic))
+			client, err := harness.NewClient(baseURL, harness.WithBearerToken(cfg.AuthValue))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if _, err := client.StartTurn(context.Background(), request); err != nil {
+				t.Fatalf("StartTurn: %v", err)
+			}
+			frames := collectWrapperFrames(t, client, request.TurnID, 0)
+			encoded, err := json.Marshal(frames)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if strings.Contains(string(encoded), opaqueValue) {
+				t.Fatalf("SSE frames leaked exact turn env value: %s", encoded)
+			}
+			if !strings.Contains(string(encoded), "[REDACTED]") {
+				t.Fatalf("SSE frames did not contain a redaction marker: %s", encoded)
+			}
+
+			last := frames[len(frames)-1]
+			var outputRef string
+			if testCase.failed {
+				if last.Failed == nil {
+					t.Fatalf("terminal frame = %#v, want failed", last)
+				}
+				outputRef = last.Failed.OutputRef
+			} else {
+				if last.Completed == nil {
+					t.Fatalf("terminal frame = %#v, want completed", last)
+				}
+				outputRef = last.Completed.OutputRef
+			}
+			if outputRef != localOutputRef {
+				t.Fatalf("terminal output ref = %q, want %q", outputRef, localOutputRef)
+			}
+			stop()
+
+			baseURL, stop = startWrapperServerWithConfig(t, cfg, NewGenericAdapter(cfg.Generic))
+			defer stop()
+			client, err = harness.NewClient(baseURL, harness.WithBearerToken(cfg.AuthValue))
+			if err != nil {
+				t.Fatal(err)
+			}
+			output, err := client.FetchTurnOutput(context.Background(), request.TurnID, outputRef)
+			if err != nil {
+				t.Fatalf("FetchTurnOutput(after restart): %v", err)
+			}
+			if strings.Contains(string(output), opaqueValue) {
+				t.Fatalf("durable output leaked exact turn env value: %q", output)
+			}
+			if !strings.Contains(string(output), "[REDACTED]") {
+				t.Fatalf("durable output did not contain a redaction marker: %q", output)
+			}
+		})
+	}
+}
+
+func TestDurableAdmissionReconcilesOrphansOnWrapperRestart(t *testing.T) {
+	ctx := context.Background()
+	cfg := DefaultConfig()
+	cfg.AuthValue = durableAdmissionControllerToken
+	cfg.AdmissionLedgerPath = filepath.Join(t.TempDir(), "admission-ledger.db")
+	cfg.Generic.Command = testEchoCommand
+	digest := "sha256:" + strings.Repeat("a", 64)
+
+	l, err := ledger.Open(cfg.AdmissionLedgerPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := l.AdmitTurn(
+		ctx, "admitted-orphan", "task-uid", 1, digest, "runtime-admitted", "correlation-admitted",
+	); err != nil {
+		t.Fatalf("admit orphan: %v", err)
+	}
+	if _, _, err := l.AdmitTurn(
+		ctx, "accepted-orphan", "task-uid", 2, digest, "runtime-accepted", "correlation-accepted",
+	); err != nil {
+		t.Fatalf("admit accepted orphan: %v", err)
+	}
+	if err := l.MarkTurnAccepted(ctx, "accepted-orphan"); err != nil {
+		t.Fatalf("accept orphan: %v", err)
+	}
+	if err := l.CloseAdmission(ctx); err != nil {
+		t.Fatalf("close admission: %v", err)
+	}
+	if err := l.Close(); err != nil {
+		t.Fatalf("close seed ledger: %v", err)
+	}
+
+	baseURL, stop := startWrapperServerWithConfig(t, cfg, NewFakeAdapter(FakeBehaviorSuccess))
+	defer stop()
+	client, err := harness.NewClient(baseURL, harness.WithBearerToken(cfg.AuthValue))
+	if err != nil {
+		t.Fatal(err)
+	}
+	admitted, err := client.DurableTurnStatus(ctx, "admitted-orphan")
+	if err != nil {
+		t.Fatalf("DurableTurnStatus(admitted orphan): %v", err)
+	}
+	if admitted.State != harness.DurableTurnRejected {
+		t.Fatalf("admitted orphan state = %s, want Rejected", admitted.State)
+	}
+	accepted, err := client.DurableTurnStatus(ctx, "accepted-orphan")
+	if err != nil {
+		t.Fatalf("DurableTurnStatus(accepted orphan): %v", err)
+	}
+	if accepted.State != harness.DurableTurnOutcomeUnknown || accepted.TerminalReceipt == nil ||
+		accepted.TerminalReceipt.Kind != harness.DurableTurnTerminalOutcomeUnknown ||
+		accepted.TerminalReceipt.RuntimeSessionID != "runtime-accepted" ||
+		accepted.TerminalReceipt.CorrelationID != "correlation-accepted" {
+		t.Fatalf("accepted orphan status = %#v, want exact OutcomeUnknown identity", accepted)
+	}
+	drain, err := client.DurableDrainStatus(ctx)
+	if err != nil {
+		t.Fatalf("DurableDrainStatus: %v", err)
+	}
+	if !drain.AdmissionClosed || !drain.Completed || len(drain.Unsettled) != 0 {
+		t.Fatalf("drain after orphan reconciliation = %#v, want completed", drain)
+	}
+}
+
+func TestDurableRolloverReopensOnlyPreparedReplacementGeneration(t *testing.T) {
+	ctx := context.Background()
+	cfg := DefaultConfig()
+	cfg.AuthValue = durableAdmissionControllerToken
+	cfg.AdmissionLedgerPath = filepath.Join(t.TempDir(), "admission-ledger.db")
+	cfg.Generic.Command = testEchoCommand
+	request := validWrapperStartTurnRequest()
+
+	baseURL, stop := startWrapperServerWithConfig(t, cfg, NewFakeAdapter(FakeBehaviorSuccess))
+	client, err := harness.NewClient(baseURL, harness.WithBearerToken(cfg.AuthValue))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := client.StartTurn(ctx, request); err != nil {
+		t.Fatalf("StartTurn: %v", err)
+	}
+	_ = collectWrapperFrames(t, client, request.TurnID, 0)
+	if _, err := client.CloseDurableAdmission(ctx); err != nil {
+		t.Fatalf("CloseDurableAdmission: %v", err)
+	}
+	if status, err := client.DurableDrainStatus(ctx); err != nil || !status.Completed {
+		t.Fatalf("DurableDrainStatus() = %#v, %v, want completed", status, err)
+	}
+	prepared, err := client.PrepareDurableRollover(ctx, "2")
+	if err != nil {
+		t.Fatalf("PrepareDurableRollover: %v", err)
+	}
+	if !prepared.Prepared || prepared.CurrentGeneration != "1" || prepared.NextGeneration != "2" {
+		t.Fatalf("rollover preparation = %#v", prepared)
+	}
+	stop()
+
+	cfg.LedgerGeneration = "2"
+	baseURL, stop = startWrapperServerWithConfig(t, cfg, NewFakeAdapter(FakeBehaviorSuccess))
+	defer stop()
+	client, err = harness.NewClient(baseURL, harness.WithBearerToken(cfg.AuthValue))
+	if err != nil {
+		t.Fatal(err)
+	}
+	drain, err := client.DurableDrainStatus(ctx)
+	if err != nil {
+		t.Fatalf("DurableDrainStatus(after rollover): %v", err)
+	}
+	if drain.AdmissionClosed || drain.Completed {
+		t.Fatalf("replacement drain status = %#v, want admission reopened", drain)
+	}
+	next := validWrapperStartTurnRequest()
+	next.TurnID = "turn-after-rollover"
+	next.CorrelationID = "correlation-after-rollover"
+	next = sealDurableWrapperRequest(next)
+	if _, err := client.StartTurn(ctx, next); err != nil {
+		t.Fatalf("StartTurn(after rollover): %v", err)
+	}
+	_ = collectWrapperFrames(t, client, next.TurnID, 0)
+	status, err := client.DurableTurnStatus(ctx, request.TurnID)
+	if err != nil || status.State != harness.DurableTurnTerminal {
+		t.Fatalf("pre-rollover tombstone = %#v, %v", status, err)
+	}
+}
+
+func TestDurableRolloverAbortReopensOnlyExactCurrentGeneration(t *testing.T) {
+	ctx := context.Background()
+	cfg := DefaultConfig()
+	cfg.AuthValue = durableAdmissionControllerToken
+	cfg.AdmissionLedgerPath = filepath.Join(t.TempDir(), "admission-ledger.db")
+	cfg.Generic.Command = testEchoCommand
+
+	baseURL, stop := startWrapperServerWithConfig(t, cfg, NewFakeAdapter(FakeBehaviorSuccess))
+	defer stop()
+	client, err := harness.NewClient(baseURL, harness.WithBearerToken(cfg.AuthValue))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := client.CloseDurableAdmission(ctx); err != nil {
+		t.Fatalf("CloseDurableAdmission: %v", err)
+	}
+	if _, err := client.PrepareDurableRollover(ctx, "2"); err != nil {
+		t.Fatalf("PrepareDurableRollover: %v", err)
+	}
+
+	unauthenticated, err := harness.NewClient(baseURL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := unauthenticated.AbortDurableRollover(ctx, "1"); err == nil || !strings.Contains(err.Error(), "401") {
+		t.Fatalf("unauthenticated AbortDurableRollover error = %v, want 401", err)
+	}
+	if _, err := client.AbortDurableRollover(ctx, "2"); err == nil || !strings.Contains(err.Error(), "409") {
+		t.Fatalf("AbortDurableRollover(stale generation) error = %v, want 409", err)
+	}
+	if status, err := client.DurableDrainStatus(ctx); err != nil || !status.AdmissionClosed || !status.Completed {
+		t.Fatalf("DurableDrainStatus(after stale abort) = %#v, %v, want completed close", status, err)
+	}
+
+	aborted, err := client.AbortDurableRollover(ctx, "1")
+	if err != nil {
+		t.Fatalf("AbortDurableRollover: %v", err)
+	}
+	if !aborted.AdmissionReopened || aborted.CurrentGeneration != "1" {
+		t.Fatalf("rollover abort = %#v", aborted)
+	}
+	if _, err := client.AbortDurableRollover(ctx, "1"); err != nil {
+		t.Fatalf("AbortDurableRollover(idempotent): %v", err)
+	}
+	if status, err := client.DurableDrainStatus(ctx); err != nil || status.AdmissionClosed || status.Completed {
+		t.Fatalf("DurableDrainStatus(after abort) = %#v, %v, want open", status, err)
+	}
+
+	request := validWrapperStartTurnRequest()
+	request.TurnID = "turn-after-aborted-rollover"
+	request.CorrelationID = "correlation-after-aborted-rollover"
+	request = sealDurableWrapperRequest(request)
+	if _, err := client.StartTurn(ctx, request); err != nil {
+		t.Fatalf("StartTurn(after abort): %v", err)
+	}
+	_ = collectWrapperFrames(t, client, request.TurnID, 0)
+}
+
+func TestDurableAdmissionRejectsRequestDigestMismatch(t *testing.T) {
+	cfg := DefaultConfig()
+	cfg.AuthValue = durableAdmissionControllerToken
+	cfg.AdmissionLedgerPath = t.TempDir() + "/admission-ledger.db"
+	cfg.Generic.Command = testEchoCommand
+	baseURL, stop := startWrapperServerWithConfig(t, cfg, NewFakeAdapter(FakeBehaviorSuccess))
+	defer stop()
+	client, err := harness.NewClient(baseURL, harness.WithBearerToken(cfg.AuthValue))
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := validWrapperStartTurnRequest()
+	request.Input.Prompt = "mutated after request digest"
+	if _, err := client.StartTurn(context.Background(), request); err == nil || !strings.Contains(err.Error(), "400") {
+		t.Fatalf("StartTurn(mutated) error = %v, want digest rejection", err)
+	}
+}
+
+//nolint:gocyclo // One end-to-end test keeps the authenticated close/drain lifecycle in protocol order.
+func TestDurableAdmissionCloseAndDrain(t *testing.T) {
+	cfg := DefaultConfig()
+	cfg.AuthValue = durableAdmissionControllerToken
+	cfg.AdmissionLedgerPath = t.TempDir() + "/admission-ledger.db"
+	cfg.Generic.Command = testEchoCommand
+	baseURL, stop := startWrapperServerWithConfig(t, cfg, NewFakeAdapter(FakeBehaviorCancellation))
+	defer stop()
+
+	unauthenticated, err := harness.NewClient(baseURL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := unauthenticated.DurableTurnStatus(context.Background(), "unauthenticated-turn"); err == nil ||
+		!strings.Contains(err.Error(), "401") {
+		t.Fatalf("unauthenticated DurableTurnStatus error = %v, want 401", err)
+	}
+	if _, err := unauthenticated.CloseDurableAdmission(context.Background()); err == nil ||
+		!strings.Contains(err.Error(), "401") {
+		t.Fatalf("unauthenticated CloseDurableAdmission error = %v, want 401", err)
+	}
+	if _, err := unauthenticated.DurableDrainStatus(context.Background()); err == nil ||
+		!strings.Contains(err.Error(), "401") {
+		t.Fatalf("unauthenticated DurableDrainStatus error = %v, want 401", err)
+	}
+
+	client, err := harness.NewClient(baseURL, harness.WithBearerToken(cfg.AuthValue))
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := validWrapperStartTurnRequest()
+	if _, err := client.StartTurn(context.Background(), request); err != nil {
+		t.Fatalf("StartTurn: %v", err)
+	}
+	openDrain, err := client.DurableDrainStatus(context.Background())
+	if err != nil {
+		t.Fatalf("DurableDrainStatus(before close): %v", err)
+	}
+	if openDrain.AdmissionClosed || openDrain.Completed || len(openDrain.Unsettled) != 1 ||
+		openDrain.Unsettled[0].TurnID != string(request.TurnID) ||
+		openDrain.Unsettled[0].State != harness.DurableTurnAccepted {
+		t.Fatalf("drain before close = %#v, want one accepted turn with admission open", openDrain)
+	}
+	if _, err := client.CloseDurableAdmission(context.Background()); err != nil {
+		t.Fatalf("CloseDurableAdmission: %v", err)
+	}
+	if _, err := client.CloseDurableAdmission(context.Background()); err != nil {
+		t.Fatalf("CloseDurableAdmission(idempotent replay): %v", err)
+	}
+	late := validWrapperStartTurnRequest()
+	late.TurnID = "turn-after-close"
+	late.CorrelationID = "corr-after-close"
+	late = sealDurableWrapperRequest(late)
+	if _, err := client.StartTurn(context.Background(), late); err == nil || !strings.Contains(err.Error(), "409") {
+		t.Fatalf("StartTurn(after close) error = %v, want admission closed", err)
+	}
+	drain, err := client.DurableDrainStatus(context.Background())
+	if err != nil {
+		t.Fatalf("DurableDrainStatus: %v", err)
+	}
+	if !drain.AdmissionClosed || drain.AdmissionClosedAt.IsZero() || drain.Completed ||
+		len(drain.Unsettled) != 1 || drain.Unsettled[0].TurnID != string(request.TurnID) {
+		t.Fatalf("drain = %#v, want closed with one unsettled accepted turn", drain)
+	}
+
+	cancelDurableAdmissionTurn(t, client, request)
+	_ = collectWrapperFrames(t, client, request.TurnID, 0)
+	eventually(t, 2*time.Second, func() bool {
+		settled, statusErr := client.DurableDrainStatus(context.Background())
+		return statusErr == nil && settled.AdmissionClosed && settled.Completed && len(settled.Unsettled) == 0
+	})
+	settled, err := client.DurableDrainStatus(context.Background())
+	if err != nil {
+		t.Fatalf("DurableDrainStatus(after settlement): %v", err)
+	}
+	if !settled.AdmissionClosed || !settled.Completed || len(settled.Unsettled) != 0 {
+		t.Fatalf("settled drain = %#v, want closed and complete", settled)
+	}
+}
+
+func TestDurableAdmissionPersistsCapacityRejection(t *testing.T) {
+	cfg := DefaultConfig()
+	cfg.AuthValue = durableAdmissionControllerToken
+	cfg.AdmissionLedgerPath = filepath.Join(t.TempDir(), "admission-ledger.db")
+	cfg.Generic.Command = testEchoCommand
+	baseURL, stop := startWrapperServerWithConfig(t, cfg, NewFakeAdapter(FakeBehaviorCancellation))
+	defer stop()
+	client, err := harness.NewClient(baseURL, harness.WithBearerToken(cfg.AuthValue))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	first := validWrapperStartTurnRequest()
+	if _, err := client.StartTurn(context.Background(), first); err != nil {
+		t.Fatalf("StartTurn(first): %v", err)
+	}
+	second := validWrapperStartTurnRequest()
+	second.TurnID = "turn-capacity-rejected"
+	second.CorrelationID = "corr-capacity-rejected"
+	second = sealDurableWrapperRequest(second)
+	if _, err := client.StartTurn(context.Background(), second); err == nil || !strings.Contains(err.Error(), "409") {
+		t.Fatalf("StartTurn(second) error = %v, want capacity conflict", err)
+	}
+	status, err := client.DurableTurnStatus(context.Background(), second.TurnID)
+	if err != nil {
+		t.Fatalf("DurableTurnStatus(rejected): %v", err)
+	}
+	if status.State != harness.DurableTurnRejected ||
+		status.TaskUID != second.Metadata[harness.MetadataTaskUID] || status.Attempt != 1 ||
+		status.RequestDigest != second.Metadata[harness.MetadataRequestDigest] ||
+		status.TerminalReceipt != nil || status.TerminalReceiptDigest != "" {
+		t.Fatalf("durable rejected status = %#v, want sealed non-acceptance proof", status)
+	}
+
+	cancelDurableAdmissionTurn(t, client, first)
+	_ = collectWrapperFrames(t, client, first.TurnID, 0)
+}
+
+func TestDurableAdmissionAdminEndpointsFailWithoutLedger(t *testing.T) {
+	cfg := DefaultConfig()
+	cfg.AllowUnauthenticated = true
+	cfg.Generic.Command = testEchoCommand
+	baseURL, stop := startWrapperServerWithConfig(t, cfg, NewFakeAdapter(FakeBehaviorSuccess))
+	defer stop()
+	client, err := harness.NewClient(baseURL)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err := client.DurableTurnStatus(context.Background(), "missing-ledger-turn"); err == nil ||
+		!strings.Contains(err.Error(), "503") {
+		t.Fatalf("DurableTurnStatus without ledger error = %v, want 503", err)
+	}
+	if _, err := client.CloseDurableAdmission(context.Background()); err == nil ||
+		!strings.Contains(err.Error(), "503") {
+		t.Fatalf("CloseDurableAdmission without ledger error = %v, want 503", err)
+	}
+	if _, err := client.DurableDrainStatus(context.Background()); err == nil ||
+		!strings.Contains(err.Error(), "503") {
+		t.Fatalf("DurableDrainStatus without ledger error = %v, want 503", err)
+	}
+}
+
+func TestDurableAdmissionRejectsUnopenableLedgerPath(t *testing.T) {
+	blockedParent := filepath.Join(t.TempDir(), "not-a-directory")
+	if err := os.WriteFile(blockedParent, []byte("blocked"), 0o600); err != nil {
+		t.Fatalf("create blocking ledger parent: %v", err)
+	}
+	cfg := DefaultConfig()
+	cfg.AuthValue = durableAdmissionControllerToken
+	cfg.AdmissionLedgerPath = filepath.Join(blockedParent, "admission-ledger.db")
+	cfg.Generic.Command = testEchoCommand
+	server, err := NewServer(cfg, NewFakeAdapter(FakeBehaviorSuccess))
+	if err == nil {
+		_ = server.Close()
+		t.Fatal("NewServer with unopenable admission ledger path succeeded")
+	}
+}
+
+func TestDurableAdmissionPreservesIdentityAcrossAcceptedAndTerminalStatus(t *testing.T) {
+	cfg := DefaultConfig()
+	cfg.AuthValue = durableAdmissionControllerToken
+	cfg.AdmissionLedgerPath = filepath.Join(t.TempDir(), "admission-ledger.db")
+	cfg.Generic.Command = testEchoCommand
+	baseURL, stop := startWrapperServerWithConfig(t, cfg, NewFakeAdapter(FakeBehaviorCancellation))
+	defer stop()
+	client, err := harness.NewClient(baseURL, harness.WithBearerToken(cfg.AuthValue))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	request := validWrapperStartTurnRequest()
+	request.Metadata[harness.MetadataAttempt] = "3"
+	request = sealDurableWrapperRequest(request)
+	if _, err := client.StartTurn(context.Background(), request); err != nil {
+		t.Fatalf("StartTurn: %v", err)
+	}
+	accepted, err := client.DurableTurnStatus(context.Background(), request.TurnID)
+	if err != nil {
+		t.Fatalf("DurableTurnStatus(accepted): %v", err)
+	}
+	assertDurableAdmissionIdentity(t, accepted, request, harness.DurableTurnAccepted)
+	if accepted.TerminalReceipt != nil || accepted.TerminalReceiptDigest != "" {
+		t.Fatalf("accepted status contains terminal receipt: %#v", accepted)
+	}
+
+	cancelDurableAdmissionTurn(t, client, request)
+	_ = collectWrapperFrames(t, client, request.TurnID, 0)
+	terminal, err := client.DurableTurnStatus(context.Background(), request.TurnID)
+	if err != nil {
+		t.Fatalf("DurableTurnStatus(terminal): %v", err)
+	}
+	assertDurableAdmissionIdentity(t, terminal, request, harness.DurableTurnTerminal)
+	if terminal.TerminalReceipt == nil || terminal.TerminalReceiptDigest == "" ||
+		terminal.TerminalReceipt.TurnID != request.TurnID ||
+		terminal.TerminalReceipt.Kind != harness.DurableTurnTerminalCancelled {
+		t.Fatalf("terminal status = %#v, want canonical cancellation receipt", terminal)
+	}
+	wrong := harness.TurnSettlementAcknowledgementRequest{
+		Version: harness.ProtocolVersion, TurnID: request.TurnID,
+		RequestDigest:         "sha256:" + strings.Repeat("f", 64),
+		TerminalReceiptDigest: terminal.TerminalReceiptDigest,
+	}
+	if err := client.AcknowledgeTurnSettlement(context.Background(), wrong); err == nil ||
+		!strings.Contains(err.Error(), "409") {
+		t.Fatalf("AcknowledgeTurnSettlement(wrong fence) error = %v, want 409", err)
+	}
+	acknowledgement := harness.TurnSettlementAcknowledgementRequest{
+		Version: harness.ProtocolVersion, TurnID: request.TurnID,
+		RequestDigest:         request.Metadata[harness.MetadataRequestDigest],
+		TerminalReceiptDigest: terminal.TerminalReceiptDigest,
+	}
+	if err := client.AcknowledgeTurnSettlement(context.Background(), acknowledgement); err != nil {
+		t.Fatalf("AcknowledgeTurnSettlement: %v", err)
+	}
+	if err := client.AcknowledgeTurnSettlement(context.Background(), acknowledgement); err != nil {
+		t.Fatalf("AcknowledgeTurnSettlement(idempotent): %v", err)
+	}
+}
+
+func cancelDurableAdmissionTurn(t *testing.T, client *harness.Client, request harness.StartTurnRequest) {
+	t.Helper()
+	if _, err := client.CancelTurn(context.Background(), harness.CancelTurnRequest{
+		Version:          harness.ProtocolVersion,
+		Namespace:        request.Namespace,
+		TaskName:         request.TaskName,
+		SessionName:      request.SessionName,
+		RuntimeSessionID: request.RuntimeSessionID,
+		TurnID:           request.TurnID,
+		CorrelationID:    request.CorrelationID,
+		Reason:           "test cleanup",
+	}); err != nil {
+		t.Fatalf("CancelTurn: %v", err)
+	}
+}
+
+func assertDurableAdmissionIdentity(
+	t *testing.T,
+	status *harness.DurableTurnStatus,
+	request harness.StartTurnRequest,
+	wantState harness.DurableTurnAdmissionState,
+) {
+	t.Helper()
+	if status.State != wantState || status.TurnID != string(request.TurnID) ||
+		status.TaskUID != request.Metadata[harness.MetadataTaskUID] || status.Attempt != 3 ||
+		status.RequestDigest != request.Metadata[harness.MetadataRequestDigest] || status.UpdatedAt.IsZero() {
+		t.Fatalf("durable status = %#v, want state %s and sealed request identity", status, wantState)
+	}
+}
diff --git a/workers/harness/cliwrapper/generic_adapter.go b/workers/harness/cliwrapper/generic_adapter.go
index b3d705343..f20264b8d 100644
--- a/workers/harness/cliwrapper/generic_adapter.go
+++ b/workers/harness/cliwrapper/generic_adapter.go
@@ -176,9 +176,6 @@ func resultFileUnwritten(info os.FileInfo) bool {
 
 func readBoundedResultFile(path string, workDirs ...string) (boundedResultFile, error) {
 	workDir := firstNonEmpty(workDirs...)
-	if err := validateResultFileRegularBeforeOpen(path, workDir); err != nil {
-		return boundedResultFile{}, err
-	}
 	var file *os.File
 	var err error
 	if workDir != "" {
@@ -204,28 +201,6 @@ func readBoundedResultFile(path string, workDirs ...string) (boundedResultFile,
 	return boundedResultFile{contents: string(data), info: info}, nil
 }
 
-func validateResultFileRegularBeforeOpen(path, workDir string) error {
-	target := strings.TrimSpace(path)
-	if strings.TrimSpace(workDir) != "" {
-		root, rel, err := workspaceRelativePath(workDir, path, "result file")
-		if err != nil {
-			return err
-		}
-		target = filepath.Join(root, filepath.Clean(rel))
-	}
-	info, err := os.Lstat(target)
-	if err != nil {
-		return fmt.Errorf("stat result file: %w", err)
-	}
-	if info.Mode()&os.ModeSymlink != 0 {
-		return fmt.Errorf("result file %q must not be a symlink", path)
-	}
-	if !info.Mode().IsRegular() {
-		return fmt.Errorf("result file %q must be a regular file", path)
-	}
-	return nil
-}
-
 func validateOpenResultFile(file *os.File, path string) (os.FileInfo, error) {
 	info, err := file.Stat()
 	if err != nil {
@@ -403,6 +378,24 @@ func firstNonEmpty(values ...string) string {
 	return ""
 }
 
+// resolveAdapterWorkDir resolves the working directory for an adapter command:
+// the turn workdir, then the adapter-configured workdir, then the wrapper
+// default. A missing directory falls back to the current working directory;
+// any other stat failure is returned as a "stat <provider> workspace
+// directory" error.
+func resolveAdapterWorkDir(provider, turnWorkDir, configWorkDir string) (string, error) {
+	dir := firstNonEmpty(turnWorkDir, configWorkDir, DefaultWrapperWorkDir)
+	if stat, err := os.Stat(dir); err != nil || !stat.IsDir() {
+		if err != nil && !os.IsNotExist(err) {
+			return "", fmt.Errorf("stat %s workspace directory: %w", provider, err)
+		}
+		if wd, wdErr := os.Getwd(); wdErr == nil {
+			dir = wd
+		}
+	}
+	return dir, nil
+}
+
 func setEnv(env []string, key, value string) []string {
 	key = strings.TrimSpace(key)
 	if key == "" {
diff --git a/workers/harness/cliwrapper/opencode_adapter.go b/workers/harness/cliwrapper/opencode_adapter.go
index da4d58b7e..1f10c5a2f 100644
--- a/workers/harness/cliwrapper/opencode_adapter.go
+++ b/workers/harness/cliwrapper/opencode_adapter.go
@@ -118,14 +118,9 @@ func (a *OpencodeAdapter) BuildCommand(_ context.Context, turn TurnContext) (*Co
 	if model == "" {
 		return nil, fmt.Errorf("%s is required for opencode runtime", workerenv.Model)
 	}
-	dir := firstNonEmpty(turn.WorkDir, a.config.WorkDir, DefaultWrapperWorkDir)
-	if stat, err := os.Stat(dir); err != nil || !stat.IsDir() {
-		if err != nil && !os.IsNotExist(err) {
-			return nil, fmt.Errorf("stat opencode workspace directory: %w", err)
-		}
-		if wd, wdErr := os.Getwd(); wdErr == nil {
-			dir = wd
-		}
+	dir, err := resolveAdapterWorkDir("opencode", turn.WorkDir, a.config.WorkDir)
+	if err != nil {
+		return nil, err
 	}
 
 	baseURL := opencodeBaseURL(envEntryValue(turn.Env, workerenv.OpenAIBaseURL))
diff --git a/workers/harness/cliwrapper/process_unix.go b/workers/harness/cliwrapper/process_unix.go
index 4232e4739..a02ed5150 100644
--- a/workers/harness/cliwrapper/process_unix.go
+++ b/workers/harness/cliwrapper/process_unix.go
@@ -3,6 +3,8 @@
 package cliwrapper
 
 import (
+	"errors"
+	"fmt"
 	"os"
 	"strconv"
 	"strings"
@@ -10,6 +12,16 @@ import (
 	"time"
 )
 
+const (
+	childCredentialDrainMaxScans           = 32
+	childCredentialDrainRequiredEmptyScans = 2
+	childCredentialDrainRetryDelay         = 10 * time.Millisecond
+)
+
+type childCredentialProcessScanFunc func() ([]int, error)
+type childCredentialProcessSignalFunc func(int, syscall.Signal) error
+type childCredentialProcessSleepFunc func(time.Duration)
+
 func commandSysProcAttr() *syscall.SysProcAttr {
 	attr := &syscall.SysProcAttr{Setpgid: true}
 	childIdentityMu.Lock()
@@ -43,33 +55,106 @@ func terminateProcessGroup(process *os.Process, grace time.Duration) {
 // terminateChildCredentialProcesses reaps processes still running as the
 // wrapper's dedicated child UID before the server frees its single active turn
 // slot. The wrapper pod runs as root and only turn subprocesses use this UID.
-func terminateChildCredentialProcesses(grace time.Duration) {
-	pids := childCredentialPIDs()
-	if len(pids) == 0 {
-		return
+func terminateChildCredentialProcesses(grace time.Duration) error {
+	if _, _, ok := childCredentialIDs(); !ok {
+		return nil
 	}
-	for _, pid := range pids {
-		_ = syscall.Kill(pid, syscall.SIGTERM)
+	return drainChildCredentialProcesses(
+		grace,
+		childCredentialDrainMaxScans,
+		childCredentialPIDs,
+		syscall.Kill,
+		time.Sleep,
+	)
+}
+
+// drainChildCredentialProcesses requires two consecutive complete empty scans.
+// An incomplete scan never counts as proof, and each later non-empty scan is
+// killed again so a process forked after an earlier snapshot cannot survive.
+func drainChildCredentialProcesses(
+	grace time.Duration,
+	maxScans int,
+	scan childCredentialProcessScanFunc,
+	signal childCredentialProcessSignalFunc,
+	sleep childCredentialProcessSleepFunc,
+) error {
+	if maxScans < childCredentialDrainRequiredEmptyScans {
+		return fmt.Errorf("child credential process drain requires at least %d scans", childCredentialDrainRequiredEmptyScans)
 	}
-	if grace > 0 {
-		time.Sleep(grace)
+	if scan == nil || signal == nil || sleep == nil {
+		return errors.New("child credential process drain operations are required")
+	}
+
+	termSent := false
+	emptyScans := 0
+	lastPIDs := []int(nil)
+	var lastScanErr error
+	for scanNumber := range maxScans {
+		pids, scanErr := scan()
+		lastPIDs = append(lastPIDs[:0], pids...)
+		if scanErr != nil {
+			lastScanErr = scanErr
+			emptyScans = 0
+		} else {
+			lastScanErr = nil
+			if len(pids) == 0 {
+				emptyScans++
+				if emptyScans >= childCredentialDrainRequiredEmptyScans {
+					return nil
+				}
+			} else {
+				emptyScans = 0
+			}
+		}
+
+		wait := childCredentialDrainRetryDelay
+		if len(pids) > 0 {
+			sig := syscall.SIGKILL
+			if !termSent {
+				sig = syscall.SIGTERM
+				termSent = true
+				wait = grace
+			}
+			for _, pid := range pids {
+				if err := signal(pid, sig); err != nil && !errors.Is(err, syscall.ESRCH) {
+					return fmt.Errorf("signal child credential process %d with %s: %w", pid, sig, err)
+				}
+			}
+		}
+		if scanNumber+1 < maxScans && wait > 0 {
+			sleep(wait)
+		}
+	}
+
+	if lastScanErr != nil {
+		return fmt.Errorf(
+			"child credential process drain could not complete a process scan after %d attempts: %w",
+			maxScans,
+			lastScanErr,
+		)
 	}
-	for _, pid := range childCredentialPIDs() {
-		_ = syscall.Kill(pid, syscall.SIGKILL)
+	if len(lastPIDs) > 0 {
+		return fmt.Errorf(
+			"child credential process drain still found %d live processes after %d scans",
+			len(lastPIDs),
+			maxScans,
+		)
 	}
+	return fmt.Errorf("child credential process drain could not confirm an empty UID after %d scans", maxScans)
 }
 
-func childCredentialPIDs() []int {
+func childCredentialPIDs() ([]int, error) {
 	uid, _, ok := childCredentialIDs()
 	if !ok {
-		return nil
+		return nil, nil
 	}
 	entries, err := os.ReadDir("/proc")
 	if err != nil {
-		return nil
+		return nil, fmt.Errorf("read /proc for child credential process drain: %w", err)
 	}
 	self := os.Getpid()
 	pids := []int(nil)
+	var scanErr error
 	for _, entry := range entries {
 		if !entry.IsDir() {
 			continue
@@ -80,24 +165,49 @@ func childCredentialPIDs() []int {
 		}
 		status, err := os.ReadFile("/proc/" + entry.Name() + "/status")
 		if err != nil {
-			continue
+			if errors.Is(err, os.ErrNotExist) {
+				scanErr = errors.Join(scanErr, fmt.Errorf("process %d changed during child credential scan: %w", pid, err))
+				continue
+			}
+			return pids, fmt.Errorf("read status for process %d during child credential scan: %w", pid, err)
+		}
+		statusUID, zombie, err := processStatusUIDAndZombie(status)
+		if err != nil {
+			return pids, fmt.Errorf("parse status for process %d during child credential scan: %w", pid, err)
 		}
-		if statusUID(status) == uid {
+		if statusUID == uid && !zombie {
 			pids = append(pids, pid)
 		}
 	}
-	return pids
+	return pids, scanErr
 }
 
-func statusUID(status []byte) int {
+func processStatusUIDAndZombie(status []byte) (int, bool, error) {
+	uid := -1
+	zombie := false
+	foundState := false
 	for line := range strings.SplitSeq(string(status), "\n") {
 		fields := strings.Fields(line)
-		if len(fields) >= 2 && fields[0] == "Uid:" {
-			uid, err := strconv.Atoi(fields[1])
-			if err == nil {
-				return uid
+		if len(fields) < 2 {
+			continue
+		}
+		switch fields[0] {
+		case "Uid:":
+			parsedUID, err := strconv.Atoi(fields[1])
+			if err != nil {
+				return -1, false, fmt.Errorf("parse process UID: %w", err)
 			}
+			uid = parsedUID
+		case "State:":
+			foundState = true
+			zombie = fields[1] == "Z"
 		}
 	}
-	return -1
+	if uid < 0 {
+		return -1, false, errors.New("process status is missing Uid")
+	}
+	if !foundState {
+		return -1, false, errors.New("process status is missing State")
+	}
+	return uid, zombie, nil
 }
diff --git a/workers/harness/cliwrapper/process_unix_test.go b/workers/harness/cliwrapper/process_unix_test.go
new file mode 100644
index 000000000..21d95d24e
--- /dev/null
+++ b/workers/harness/cliwrapper/process_unix_test.go
@@ -0,0 +1,111 @@
+//go:build !windows
+
+package cliwrapper
+
+import (
+	"errors"
+	"syscall"
+	"testing"
+	"time"
+)
+
+func TestDrainChildCredentialProcessesKillsLateForksAndRequiresStableEmptyScans(t *testing.T) {
+	type scanResult struct {
+		pids []int
+		err  error
+	}
+	scans := []scanResult{
+		{pids: []int{101}},
+		{pids: []int{101, 202}},
+		{pids: []int{202}},
+		{},
+		{},
+	}
+	scanIndex := 0
+	scan := func() ([]int, error) {
+		if scanIndex >= len(scans) {
+			t.Fatal("unexpected extra child credential process scan")
+		}
+		result := scans[scanIndex]
+		scanIndex++
+		return result.pids, result.err
+	}
+	type sentSignal struct {
+		pid    int
+		signal syscall.Signal
+	}
+	signals := []sentSignal{}
+	signal := func(pid int, value syscall.Signal) error {
+		signals = append(signals, sentSignal{pid: pid, signal: value})
+		return nil
+	}
+	sleeps := []time.Duration{}
+
+	err := drainChildCredentialProcesses(
+		25*time.Millisecond,
+		len(scans),
+		scan,
+		signal,
+		func(duration time.Duration) { sleeps = append(sleeps, duration) },
+	)
+	if err != nil {
+		t.Fatalf("drainChildCredentialProcesses: %v", err)
+	}
+	wantSignals := []sentSignal{
+		{pid: 101, signal: syscall.SIGTERM},
+		{pid: 101, signal: syscall.SIGKILL},
+		{pid: 202, signal: syscall.SIGKILL},
+		{pid: 202, signal: syscall.SIGKILL},
+	}
+	if len(signals) != len(wantSignals) {
+		t.Fatalf("signals = %#v, want %#v", signals, wantSignals)
+	}
+	for i := range wantSignals {
+		if signals[i] != wantSignals[i] {
+			t.Fatalf("signal[%d] = %#v, want %#v", i, signals[i], wantSignals[i])
+		}
+	}
+	if scanIndex != len(scans) {
+		t.Fatalf("process scans = %d, want %d", scanIndex, len(scans))
+	}
+	if len(sleeps) == 0 || sleeps[0] != 25*time.Millisecond {
+		t.Fatalf("first cleanup sleep = %v, want grace period", sleeps)
+	}
+}
+
+func TestDrainChildCredentialProcessesFailsClosedWhenScansRemainIncomplete(t *testing.T) {
+	scanErr := errors.New("proc scan unavailable")
+	err := drainChildCredentialProcesses(
+		0,
+		3,
+		func() ([]int, error) { return nil, scanErr },
+		func(int, syscall.Signal) error { return nil },
+		func(time.Duration) {},
+	)
+	if err == nil || !errors.Is(err, scanErr) {
+		t.Fatalf("drainChildCredentialProcesses error = %v, want scan failure", err)
+	}
+}
+
+func TestDrainChildCredentialProcessesFailsClosedWhenSignalFails(t *testing.T) {
+	signalErr := errors.New("signal denied")
+	err := drainChildCredentialProcesses(
+		0,
+		childCredentialDrainRequiredEmptyScans,
+		func() ([]int, error) { return []int{101}, nil },
+		func(int, syscall.Signal) error { return signalErr },
+		func(time.Duration) {},
+	)
+	if err == nil || !errors.Is(err, signalErr) {
+		t.Fatalf("drainChildCredentialProcesses error = %v, want signal failure", err)
+	}
+}
+
+func TestProcessStatusUIDAndZombie(t *testing.T) {
+	uid, zombie, err := processStatusUIDAndZombie([]byte(
+		"State:\tZ (zombie)\nUid:\t1000\t1000\t1000\t1000\n",
+	))
+	if err != nil || uid != 1000 || !zombie {
+		t.Fatalf("processStatusUIDAndZombie() = (%d, %t, %v), want (1000, true, nil)", uid, zombie, err)
+	}
+}
diff --git a/workers/harness/cliwrapper/process_windows.go b/workers/harness/cliwrapper/process_windows.go
index e56d9603a..09dc36c91 100644
--- a/workers/harness/cliwrapper/process_windows.go
+++ b/workers/harness/cliwrapper/process_windows.go
@@ -21,4 +21,4 @@ func terminateProcessGroup(process *os.Process, grace time.Duration) {
 	_ = process.Kill()
 }
 
-func terminateChildCredentialProcesses(time.Duration) {}
+func terminateChildCredentialProcesses(time.Duration) error { return nil }
diff --git a/workers/harness/cliwrapper/result.go b/workers/harness/cliwrapper/result.go
index 6bc4d59f4..56972dc0c 100644
--- a/workers/harness/cliwrapper/result.go
+++ b/workers/harness/cliwrapper/result.go
@@ -5,12 +5,14 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"strconv"
 	"strings"
+	"time"
 
 	"github.com/orka-agents/orka/internal/workerenv"
 	"github.com/orka-agents/orka/workers/common"
@@ -20,6 +22,13 @@ const wrapperSafeCommandPath = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bi
 
 const turnMetadataSkillsFiles = "skillsFiles"
 
+// wrapperGitPostTurnTimeout bounds each post-turn git finalization phase
+// (ShouldFinalizeWorkDir, FinalizeTurnResult, CleanFinalizedWorkDir) so a hung
+// git process cannot wedge the turn. It is applied per phase, never shared
+// across phases, and must stay generous enough for `git add -A` plus a cached
+// binary diff on multi-gigabyte working trees.
+const wrapperGitPostTurnTimeout = 5 * time.Minute
+
 var wrapperGitBinary = resolveSafeExecutable("git")
 
 func resolveSafeExecutable(name string) string {
@@ -37,11 +46,66 @@ func resolveSafeExecutable(name string) string {
 	return name
 }
 
-// FinalizeTurnResult reuses the existing worker structured-result and workspace
-// diff finalization behavior. A non-git or empty workDir falls back to the raw
-// agent output, matching workers/common.FinalizeResult semantics.
-func FinalizeTurnResult(workDir, output string) ([]byte, error) {
-	return common.FinalizeResult(workDir, output)
+// FinalizeTurnResult builds the bounded structured workspace result inside the
+// dedicated child identity boundary. Harness v1 workspaces never carry
+// publication authority, so finalization records a diff without committing or
+// pushing it. A non-git or empty workDir falls back to the raw agent output.
+func FinalizeTurnResult(ctx context.Context, workDir, output string) ([]byte, error) {
+	workDir = strings.TrimSpace(workDir)
+	if workDir == "" {
+		return []byte(output), nil
+	}
+	if strings.TrimSpace(os.Getenv(workerenv.PushBranch)) != "" {
+		return nil, errors.New("harness v1 wrapper finalization does not permit branch publication")
+	}
+	ctx, cancel := context.WithTimeout(ctx, wrapperGitPostTurnTimeout)
+	defer cancel()
+	baseSHA, err := wrapperGitOutput(ctx, workDir, "rev-parse", "HEAD")
+	if err != nil {
+		if ctxErr := ctx.Err(); ctxErr != nil {
+			return nil, ctxErr
+		}
+		return []byte(output), nil
+	}
+	baseSHA = strings.TrimSpace(baseSHA)
+	if err := neutralizeWrapperRepoExecutableConfig(ctx, workDir); err != nil {
+		return nil, fmt.Errorf("neutralize child-owned repository executable Git configuration: %w", err)
+	}
+	if staged, err := wrapperGitOutput(ctx, workDir, "add", "-A"); err != nil {
+		return nil, fmt.Errorf("stage harness v1 workspace result: %w: %s", err, strings.TrimSpace(staged))
+	}
+	_, _ = wrapperGitOutput(ctx, workDir, "reset", "-q", "--", ".orka-artifacts", ":(glob)**/.orka-artifacts")
+	diff, err := wrapperGitOutput(
+		ctx, workDir, "diff", "--cached", "--binary", "--full-index", "--no-ext-diff", "--no-textconv",
+	)
+	if err != nil {
+		return nil, fmt.Errorf("render harness v1 workspace diff: %w", err)
+	}
+	files := make([]string, 0)
+	for _, args := range [][]string{
+		{"diff", "--cached", "--name-status", "-z", "--no-ext-diff", "--no-textconv"},
+		{"diff", "--name-status", "-z", "--no-ext-diff", "--no-textconv"},
+	} {
+		names, namesErr := wrapperGitOutput(ctx, workDir, args...)
+		if namesErr != nil {
+			if ctxErr := ctx.Err(); ctxErr != nil {
+				return nil, ctxErr
+			}
+			continue
+		}
+		files = append(files, parseWrapperDiffNameStatusPaths(names)...)
+	}
+	files = uniqueWrapperPaths(files)
+	result := &common.StructuredResult{
+		Summary: common.TruncateStructuredSummary(output),
+		BaseSHA: baseSHA,
+		HeadSHA: baseSHA,
+	}
+	if diff != "" {
+		result.Diff = diff
+		result.Files = files
+	}
+	return common.FormatStructuredResult(result)
 }
 
 // UploadTurnArtifacts reuses the existing worker artifact uploader. It is a
@@ -337,36 +401,153 @@ func setTemporaryEnv(key, value string) func() {
 	}
 }
 
-func wrapperGitCommand(dir string, args ...string) *exec.Cmd {
+func wrapperGitOutput(ctx context.Context, dir string, args ...string) (string, error) {
+	out, err := wrapperGitCommand(ctx, dir, args...).CombinedOutput()
+	if ctxErr := ctx.Err(); ctxErr != nil {
+		return string(out), ctxErr
+	}
+	return string(out), err
+}
+
+func neutralizeWrapperRepoExecutableConfig(ctx context.Context, dir string) error {
+	raw, err := wrapperGitOutput(ctx, dir, "config", "--local", "--no-includes", "--name-only", "-z", "--list")
+	if err != nil {
+		return fmt.Errorf("list local Git configuration: %w", err)
+	}
+	for key := range strings.SplitSeq(raw, "\x00") {
+		key = strings.TrimSpace(key)
+		if key == "" || !wrapperExecutableGitConfigKey(key) {
+			continue
+		}
+		if out, err := wrapperGitOutput(
+			ctx, dir, "config", "--local", "--no-includes", "--unset-all", key,
+		); err != nil {
+			return fmt.Errorf("remove executable Git configuration %q: %w: %s", key, err, strings.TrimSpace(out))
+		}
+	}
+	return nil
+}
+
+func wrapperExecutableGitConfigKey(key string) bool {
+	key = strings.ToLower(strings.TrimSpace(key))
+	for _, prefix := range []string{"alias.", "credential.", "filter.", "include.", "includeif."} {
+		if strings.HasPrefix(key, prefix) {
+			return true
+		}
+	}
+	switch key {
+	case "core.editor", "core.fsmonitor", "core.fsmonitorhookversion", "core.hookspath",
+		"core.pager", "core.sshcommand", "diff.external", "gpg.program", "sequence.editor":
+		return true
+	}
+	return strings.HasPrefix(key, "diff.") &&
+		(strings.HasSuffix(key, ".command") || strings.HasSuffix(key, ".textconv")) ||
+		strings.HasPrefix(key, "merge.") && strings.HasSuffix(key, ".driver")
+}
+
+func parseWrapperDiffNameStatusPaths(raw string) []string {
+	parts := strings.Split(raw, "\x00")
+	paths := make([]string, 0, len(parts))
+	for index := 0; index < len(parts); {
+		status := strings.TrimSpace(parts[index])
+		index++
+		if status == "" {
+			continue
+		}
+		pathCount := 1
+		if status[0] == 'R' || status[0] == 'C' {
+			pathCount = 2
+		}
+		for range pathCount {
+			if index >= len(parts) {
+				return uniqueWrapperPaths(paths)
+			}
+			if parts[index] != "" {
+				paths = append(paths, parts[index])
+			}
+			index++
+		}
+	}
+	return uniqueWrapperPaths(paths)
+}
+
+func uniqueWrapperPaths(paths []string) []string {
+	seen := make(map[string]struct{}, len(paths))
+	unique := make([]string, 0, len(paths))
+	for _, path := range paths {
+		if _, exists := seen[path]; exists {
+			continue
+		}
+		seen[path] = struct{}{}
+		unique = append(unique, path)
+	}
+	return unique
+}
+
+func wrapperGitCommand(ctx context.Context, dir string, args ...string) *exec.Cmd {
 	safeDir := strings.TrimSpace(dir)
 	if abs, err := filepath.Abs(safeDir); err == nil {
 		safeDir = abs
 	}
-	gitArgs := append([]string{"-c", "safe.directory=" + safeDir, "-C", dir}, args...)
-	cmd := exec.Command(wrapperGitBinary, gitArgs...)
-	cmd.Env = setEnv(os.Environ(), "PATH", wrapperSafeCommandPath)
+	gitArgs := append([]string{
+		"-c", "safe.directory=" + safeDir,
+		"-c", "core.hooksPath=/dev/null",
+		"-c", "core.fsmonitor=false",
+		"-c", "credential.helper=",
+		"-c", "core.askPass=",
+		"-c", "diff.external=",
+		"-c", "core.pager=cat",
+		"-C", dir,
+	}, args...)
+	cmd := exec.CommandContext(ctx, wrapperGitBinary, gitArgs...)
+	cmd.Env = []string{
+		"GIT_ASKPASS=/bin/false",
+		"GIT_CONFIG_GLOBAL=/dev/null",
+		"GIT_CONFIG_NOSYSTEM=1",
+		"GIT_CONFIG_SYSTEM=/dev/null",
+		"GIT_TERMINAL_PROMPT=0",
+		"HOME=/tmp/orka-empty-git-home",
+		"LC_ALL=C",
+		"PATH=" + wrapperSafeCommandPath,
+		"SSH_ASKPASS=/bin/false",
+		"XDG_CONFIG_HOME=/tmp/orka-empty-git-config",
+	}
 	cmd.SysProcAttr = commandSysProcAttr()
 	return cmd
 }
 
-func ShouldFinalizeWorkDir(workDir string) bool {
+func ShouldFinalizeWorkDir(ctx context.Context, workDir string) (bool, error) {
 	workDir = strings.TrimSpace(workDir)
 	if workDir == "" {
-		return false
+		return false, nil
 	}
-	return wrapperGitCommand(workDir, "rev-parse", "--show-toplevel").Run() == nil
+	ctx, cancel := context.WithTimeout(ctx, wrapperGitPostTurnTimeout)
+	defer cancel()
+	_, err := wrapperGitOutput(ctx, workDir, "rev-parse", "--show-toplevel")
+	if err != nil {
+		if ctxErr := ctx.Err(); ctxErr != nil {
+			return false, ctxErr
+		}
+		return false, nil
+	}
+	return true, nil
 }
 
-func CleanFinalizedWorkDir(workDir string) error {
+func CleanFinalizedWorkDir(ctx context.Context, workDir string) error {
 	workDir = strings.TrimSpace(workDir)
 	if workDir == "" {
 		return nil
 	}
-	rootOut, err := wrapperGitCommand(workDir, "rev-parse", "--show-toplevel").Output()
+	ctx, cancel := context.WithTimeout(ctx, wrapperGitPostTurnTimeout)
+	defer cancel()
+	rootOut, err := wrapperGitOutput(ctx, workDir, "rev-parse", "--show-toplevel")
 	if err != nil {
+		if ctxErr := ctx.Err(); ctxErr != nil {
+			return ctxErr
+		}
 		return nil
 	}
-	repoRoot := strings.TrimSpace(string(rootOut))
+	repoRoot := strings.TrimSpace(rootOut)
 	if repoRoot == "" {
 		return nil
 	}
@@ -383,22 +564,22 @@ func CleanFinalizedWorkDir(workDir string) error {
 		return fmt.Errorf("clean finalized workdir %q is outside repository root %q", cleanPath, repoRoot)
 	}
 	if relPath == "." {
-		if out, err := wrapperGitCommand(repoRoot, "reset", "--hard", "HEAD").CombinedOutput(); err != nil {
-			return fmt.Errorf("clean finalized workdir reset: %w: %s", err, strings.TrimSpace(string(out)))
+		if out, err := wrapperGitOutput(ctx, repoRoot, "reset", "--hard", "HEAD"); err != nil {
+			return fmt.Errorf("clean finalized workdir reset: %w: %s", err, strings.TrimSpace(out))
 		}
-		if out, err := wrapperGitCommand(repoRoot, "clean", "-fd").CombinedOutput(); err != nil {
-			return fmt.Errorf("clean finalized workdir clean: %w: %s", err, strings.TrimSpace(string(out)))
+		if out, err := wrapperGitOutput(ctx, repoRoot, "clean", "-fd"); err != nil {
+			return fmt.Errorf("clean finalized workdir clean: %w: %s", err, strings.TrimSpace(out))
 		}
 		return nil
 	}
-	if out, err := wrapperGitCommand(repoRoot, "reset", "HEAD", "--", relPath).CombinedOutput(); err != nil {
-		return fmt.Errorf("clean finalized workdir unstage: %w: %s", err, strings.TrimSpace(string(out)))
+	if out, err := wrapperGitOutput(ctx, repoRoot, "reset", "HEAD", "--", relPath); err != nil {
+		return fmt.Errorf("clean finalized workdir unstage: %w: %s", err, strings.TrimSpace(out))
 	}
-	if out, err := wrapperGitCommand(repoRoot, "checkout", "--", relPath).CombinedOutput(); err != nil {
-		return fmt.Errorf("clean finalized workdir checkout: %w: %s", err, strings.TrimSpace(string(out)))
+	if out, err := wrapperGitOutput(ctx, repoRoot, "checkout", "--", relPath); err != nil {
+		return fmt.Errorf("clean finalized workdir checkout: %w: %s", err, strings.TrimSpace(out))
 	}
-	if out, err := wrapperGitCommand(repoRoot, "clean", "-fd", "--", relPath).CombinedOutput(); err != nil {
-		return fmt.Errorf("clean finalized workdir clean: %w: %s", err, strings.TrimSpace(string(out)))
+	if out, err := wrapperGitOutput(ctx, repoRoot, "clean", "-fd", "--", relPath); err != nil {
+		return fmt.Errorf("clean finalized workdir clean: %w: %s", err, strings.TrimSpace(out))
 	}
 	return nil
 }
diff --git a/workers/harness/cliwrapper/result_file_unix.go b/workers/harness/cliwrapper/result_file_unix.go
index 4766aac07..92e71c580 100644
--- a/workers/harness/cliwrapper/result_file_unix.go
+++ b/workers/harness/cliwrapper/result_file_unix.go
@@ -3,6 +3,7 @@
 package cliwrapper
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -36,6 +37,9 @@ func openResultFileNoFollow(path string, flags ...int) (*os.File, error) {
 	}
 	fd, err := unix.Open(path, openFlags|unix.O_CLOEXEC|unix.O_NOFOLLOW, mode)
 	if err != nil {
+		if errors.Is(err, unix.ELOOP) {
+			return nil, fmt.Errorf("result file %q must not be a symlink", path)
+		}
 		return nil, err
 	}
 	file := os.NewFile(uintptr(fd), path)
@@ -90,9 +94,12 @@ func openRelativeResultFileNoFollow(root, rel string, flags int, mode uint32, cr
 			}
 			fd, err := unix.Openat(dirFD, part, flags|unix.O_CLOEXEC|unix.O_NOFOLLOW, mode)
 			if err != nil {
+				if errors.Is(err, unix.ELOOP) {
+					return nil, fmt.Errorf("result file %q must not be a symlink", rel)
+				}
 				return nil, err
 			}
-			file := os.NewFile(uintptr(fd), filepath.Join(root, cleaned))
+			file := os.NewFile(uintptr(fd), "orka-result-file")
 			if file == nil {
 				_ = unix.Close(fd)
 				return nil, fmt.Errorf("wrap result file descriptor")
@@ -107,6 +114,9 @@ func openRelativeResultFileNoFollow(root, rel string, flags int, mode uint32, cr
 			nextFD, err = unix.Openat(dirFD, part, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC|unix.O_NOFOLLOW, 0)
 		}
 		if err != nil {
+			if errors.Is(err, unix.ELOOP) {
+				return nil, fmt.Errorf("result file %q must not contain symlinked directories", rel)
+			}
 			return nil, err
 		}
 		_ = unix.Close(dirFD)
diff --git a/workers/harness/cliwrapper/result_test.go b/workers/harness/cliwrapper/result_test.go
new file mode 100644
index 000000000..eda257577
--- /dev/null
+++ b/workers/harness/cliwrapper/result_test.go
@@ -0,0 +1,96 @@
+package cliwrapper
+
+import (
+	"context"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/orka-agents/orka/internal/workerenv"
+	"github.com/orka-agents/orka/workers/common"
+)
+
+func TestFinalizeTurnResultNeutralizesExecutableRepositoryConfig(t *testing.T) {
+	repo := t.TempDir()
+	runResultTestGit(t, repo, "init")
+	runResultTestGit(t, repo, "config", "user.email", "test@example.invalid")
+	runResultTestGit(t, repo, "config", "user.name", "Test User")
+	tracked := filepath.Join(repo, "tracked.txt")
+	if err := os.WriteFile(tracked, []byte("before\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	runResultTestGit(t, repo, "add", "tracked.txt")
+	runResultTestGit(t, repo, "commit", "-m", "initial")
+
+	marker := filepath.Join(repo, "filter-ran")
+	filterCommand := "sh -c 'touch " + marker + "; cat'"
+	runResultTestGit(t, repo, "config", "filter.hostile.clean", filterCommand)
+	runResultTestGit(t, repo, "config", "filter.hostile.smudge", filterCommand)
+	runResultTestGit(t, repo, "config", "filter.hostile.required", "true")
+	runResultTestGit(t, repo, "config", "core.fsmonitor", filterCommand)
+	if err := os.WriteFile(filepath.Join(repo, ".gitattributes"), []byte("*.txt filter=hostile\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(tracked, []byte("after\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv(workerenv.PushBranch, "")
+
+	raw, err := FinalizeTurnResult(context.Background(), repo, "finished safely")
+	if err != nil {
+		t.Fatalf("FinalizeTurnResult: %v", err)
+	}
+	if _, err := os.Stat(marker); !os.IsNotExist(err) {
+		t.Fatalf("repository-controlled Git command executed, marker stat error = %v", err)
+	}
+	result := common.ParseStructuredResult(string(raw))
+	if result.Summary != "finished safely" || result.BaseSHA == "" ||
+		!strings.Contains(result.Diff, "after") || !slices.Contains(result.Files, "tracked.txt") {
+		t.Fatalf("structured result = %+v", result)
+	}
+	config := runResultTestGitOutput(t, repo, "config", "--local", "--name-only", "--list")
+	removedKeys := []string{
+		"filter.hostile.clean", "filter.hostile.smudge", "filter.hostile.required", "core.fsmonitor",
+	}
+	for _, removed := range removedKeys {
+		if strings.Contains(config, removed) {
+			t.Fatalf("executable repository config %q survived sanitization:\n%s", removed, config)
+		}
+	}
+}
+
+func TestFinalizeTurnResultRejectsPublication(t *testing.T) {
+	t.Setenv(workerenv.PushBranch, "agent-branch")
+	if _, err := FinalizeTurnResult(context.Background(), t.TempDir(), "result"); err == nil ||
+		!strings.Contains(err.Error(), "does not permit branch publication") {
+		t.Fatalf("publication error = %v, want refusal", err)
+	}
+}
+
+func TestParseWrapperDiffNameStatusPathsIncludesRenameEndpoints(t *testing.T) {
+	got := parseWrapperDiffNameStatusPaths("M\x00changed.txt\x00R100\x00old.txt\x00new.txt\x00")
+	for _, want := range []string{"changed.txt", "old.txt", "new.txt"} {
+		if !slices.Contains(got, want) {
+			t.Fatalf("parsed paths = %v, missing %q", got, want)
+		}
+	}
+}
+
+func runResultTestGit(t *testing.T, dir string, args ...string) {
+	t.Helper()
+	if out, err := exec.Command("git", append([]string{"-C", dir}, args...)...).CombinedOutput(); err != nil {
+		t.Fatalf("git %s: %v\n%s", strings.Join(args, " "), err, out)
+	}
+}
+
+func runResultTestGitOutput(t *testing.T, dir string, args ...string) string {
+	t.Helper()
+	out, err := exec.Command("git", append([]string{"-C", dir}, args...)...).CombinedOutput()
+	if err != nil {
+		t.Fatalf("git %s: %v\n%s", strings.Join(args, " "), err, out)
+	}
+	return string(out)
+}
diff --git a/workers/harness/cliwrapper/result_unix_test.go b/workers/harness/cliwrapper/result_unix_test.go
new file mode 100644
index 000000000..2c2f9be17
--- /dev/null
+++ b/workers/harness/cliwrapper/result_unix_test.go
@@ -0,0 +1,70 @@
+//go:build !windows
+
+package cliwrapper
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"golang.org/x/sys/unix"
+)
+
+func TestFinalizeTurnResultHonorsContextWhenGitIndexBlocks(t *testing.T) {
+	repo := resultTestRepoWithFIFOIndex(t)
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	started := time.Now()
+	_, err := FinalizeTurnResult(ctx, repo, "result")
+	if !errors.Is(err, context.DeadlineExceeded) {
+		t.Fatalf("FinalizeTurnResult error = %v, want context deadline exceeded", err)
+	}
+	if elapsed := time.Since(started); elapsed > 3*time.Second {
+		t.Fatalf("FinalizeTurnResult blocked for %v after context deadline", elapsed)
+	}
+}
+
+func TestCleanFinalizedWorkDirHonorsContextWhenGitIndexBlocks(t *testing.T) {
+	repo := resultTestRepoWithFIFOIndex(t)
+	canonicalRepo, err := filepath.EvalSymlinks(repo)
+	if err != nil {
+		t.Fatalf("canonicalize repository path: %v", err)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	started := time.Now()
+	err = CleanFinalizedWorkDir(ctx, canonicalRepo)
+	if !errors.Is(err, context.DeadlineExceeded) {
+		t.Fatalf("CleanFinalizedWorkDir error = %v, want context deadline exceeded", err)
+	}
+	if elapsed := time.Since(started); elapsed > 3*time.Second {
+		t.Fatalf("CleanFinalizedWorkDir blocked for %v after context deadline", elapsed)
+	}
+}
+
+func resultTestRepoWithFIFOIndex(t *testing.T) string {
+	t.Helper()
+	repo := t.TempDir()
+	runResultTestGit(t, repo, "init")
+	runResultTestGit(t, repo, "config", "user.email", "test@example.invalid")
+	runResultTestGit(t, repo, "config", "user.name", "Test User")
+	if err := os.WriteFile(filepath.Join(repo, "tracked.txt"), []byte("before\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	runResultTestGit(t, repo, "add", "tracked.txt")
+	runResultTestGit(t, repo, "commit", "-m", "initial")
+
+	indexPath := filepath.Join(repo, ".git", "index")
+	if err := os.Remove(indexPath); err != nil {
+		t.Fatalf("remove Git index: %v", err)
+	}
+	if err := unix.Mkfifo(indexPath, 0o600); err != nil {
+		t.Fatalf("replace Git index with FIFO: %v", err)
+	}
+	return repo
+}
diff --git a/workers/harness/cliwrapper/runner.go b/workers/harness/cliwrapper/runner.go
index e08dab306..764da61d3 100644
--- a/workers/harness/cliwrapper/runner.go
+++ b/workers/harness/cliwrapper/runner.go
@@ -19,6 +19,8 @@ type CommandRunner struct {
 	CancelGrace      time.Duration
 }
 
+var errChildCredentialProcessCleanupUnproven = errors.New("child credential process cleanup was not proven")
+
 func NewCommandRunner(cfg Config) CommandRunner {
 	stdoutLimit := cfg.StdoutLimitBytes
 	if stdoutLimit == 0 {
@@ -45,7 +47,10 @@ func (r CommandRunner) Run(ctx context.Context, spec *CommandSpec) (CommandResul
 
 	cmd := exec.Command(spec.Path, spec.Args...)
 	cmd.Dir = spec.Dir
-	baseEnv := sanitizedProcessEnv(os.Environ())
+	// The wrapper Pod can carry controller-only credentials through envFrom or
+	// secretKeyRef. Agent-controlled children receive only a fixed process
+	// baseline plus the environment explicitly frozen for this turn.
+	baseEnv := baselineChildProcessEnv()
 	if spec.ClearEnv {
 		baseEnv = nil
 	}
@@ -59,17 +64,31 @@ func (r CommandRunner) Run(ctx context.Context, spec *CommandSpec) (CommandResul
 	stdout := newLimitedBuffer(r.StdoutLimitBytes)
 	stdoutFull := newLimitedBuffer(maxStoredResultBytes)
 	stderr := newLimitedBuffer(r.StderrLimitBytes)
-	stdoutPipe, err := cmd.StdoutPipe()
+	// Parent-owned pipes instead of cmd.StdoutPipe/StderrPipe: Wait closes the
+	// pipes it created as soon as the process exits, racing the copy goroutines
+	// and silently truncating child output. With os.Pipe the read ends stay
+	// open until the copies drain to EOF or waitForPipeCopies times out.
+	stdoutRead, stdoutWrite, err := os.Pipe()
 	if err != nil {
 		return CommandResult{}, fmt.Errorf("open stdout pipe: %w", err)
 	}
-	stderrPipe, err := cmd.StderrPipe()
+	stderrRead, stderrWrite, err := os.Pipe()
 	if err != nil {
+		_ = stdoutRead.Close()
+		_ = stdoutWrite.Close()
 		return CommandResult{}, fmt.Errorf("open stderr pipe: %w", err)
 	}
+	closePipes := func(pipes ...*os.File) {
+		for _, pipe := range pipes {
+			_ = pipe.Close()
+		}
+	}
+	cmd.Stdout = stdoutWrite
+	cmd.Stderr = stderrWrite
 
 	started := time.Now().UTC()
 	if err := ctx.Err(); err != nil {
+		closePipes(stdoutRead, stdoutWrite, stderrRead, stderrWrite)
 		return CommandResult{
 			StartedAt:  started,
 			FinishedAt: time.Now().UTC(),
@@ -80,18 +99,22 @@ func (r CommandRunner) Run(ctx context.Context, spec *CommandSpec) (CommandResul
 		}, err
 	}
 	if err := cmd.Start(); err != nil {
+		closePipes(stdoutRead, stdoutWrite, stderrRead, stderrWrite)
 		return CommandResult{StartedAt: started, FinishedAt: time.Now().UTC(), ExitCode: -1, ResultFile: spec.ResultFile}, err
 	}
+	// The child holds duplicated write ends; the parent's copies must close so
+	// the readers reach EOF once the process (group) exits.
+	closePipes(stdoutWrite, stderrWrite)
 
 	var copyWG sync.WaitGroup
 	copyWG.Add(2)
 	go func() {
 		defer copyWG.Done()
-		_, _ = io.Copy(io.MultiWriter(stdout, stdoutFull), stdoutPipe)
+		_, _ = io.Copy(io.MultiWriter(stdout, stdoutFull), stdoutRead)
 	}()
 	go func() {
 		defer copyWG.Done()
-		_, _ = io.Copy(stderr, stderrPipe)
+		_, _ = io.Copy(stderr, stderrRead)
 	}()
 
 	waitCh := make(chan error, 1)
@@ -111,7 +134,7 @@ func (r CommandRunner) Run(ctx context.Context, spec *CommandSpec) (CommandResul
 	if !cancelled {
 		terminateProcessGroup(cmd.Process, 0)
 	}
-	terminateChildCredentialProcesses(r.CancelGrace)
+	cleanupErr := terminateChildCredentialProcesses(r.CancelGrace)
 	if waitErr == nil {
 		if err := ctx.Err(); err != nil {
 			cancelled = true
@@ -119,7 +142,17 @@ func (r CommandRunner) Run(ctx context.Context, spec *CommandSpec) (CommandResul
 			waitErr = err
 		}
 	}
-	waitForPipeCopies(&copyWG, stdoutPipe, stderrPipe, 5*time.Second)
+	if cleanupErr != nil {
+		waitErr = errors.Join(
+			waitErr,
+			fmt.Errorf("%w: %w", errChildCredentialProcessCleanupUnproven, cleanupErr),
+		)
+	}
+	waitForPipeCopies(&copyWG, stdoutRead, stderrRead, 5*time.Second)
+	// waitForPipeCopies closes the readers only on its timeout path; close
+	// them on every path so successful commands do not leak two descriptors
+	// per turn (Close after close is a harmless ErrClosed).
+	closePipes(stdoutRead, stderrRead)
 
 	finished := time.Now().UTC()
 	exitCode := exitCodeFromError(waitErr)
@@ -197,6 +230,13 @@ func sanitizedProcessEnv(env []string) []string {
 	return out
 }
 
+func baselineChildProcessEnv() []string {
+	return []string{
+		"PATH=" + wrapperSafeCommandPath,
+		"TMPDIR=/tmp",
+	}
+}
+
 func mergeCommandEnv(base, overrides []string) []string {
 	out := append([]string(nil), base...)
 	for _, entry := range overrides {
diff --git a/workers/harness/cliwrapper/runtime_auth_proxy.go b/workers/harness/cliwrapper/runtime_auth_proxy.go
index 8ae475f0b..149676fa7 100644
--- a/workers/harness/cliwrapper/runtime_auth_proxy.go
+++ b/workers/harness/cliwrapper/runtime_auth_proxy.go
@@ -39,7 +39,7 @@ const (
 	runtimeAuthProxyAnthropic runtimeAuthProxyMode = "anthropic"
 )
 
-func protectRuntimeAuthTurn(turn TurnContext) (TurnContext, func(), error) {
+func protectRuntimeAuthTurn(turn TurnContext) (TurnContext, string, func(), error) {
 	runtimeName := strings.ToLower(strings.TrimSpace(turn.RuntimeName))
 	if runtimeName == RuntimeMulti {
 		runtimeName = strings.ToLower(strings.TrimSpace(turn.Metadata["runtime"]))
@@ -47,7 +47,7 @@ func protectRuntimeAuthTurn(turn TurnContext) (TurnContext, func(), error) {
 	runtimeAuthOnly := strings.EqualFold(strings.TrimSpace(turn.Metadata["runtimeAuthOnly"]), "true")
 	readOnlyCodex := runtimeName == RuntimeCodex && strings.EqualFold(strings.TrimSpace(turn.Metadata["readOnly"]), "true")
 	if !runtimeAuthOnly && !readOnlyCodex {
-		return turn, func() {}, nil
+		return turn, "", func() {}, nil
 	}
 	var mode runtimeAuthProxyMode
 	var upstreamValue, endpoint string
@@ -62,22 +62,22 @@ func protectRuntimeAuthTurn(turn TurnContext) (TurnContext, func(), error) {
 	case RuntimeClaude:
 		foundryValue := strings.TrimSpace(envEntryValue(turn.Env, "ANTHROPIC_FOUNDRY_API_KEY"))
 		if foundryValue != "" || runtimeAuthProxyEnvFlagEnabled(turn.Env, "CLAUDE_CODE_USE_FOUNDRY") {
-			return turn, nil, fmt.Errorf("runtime-auth-only Claude implementation does not support Azure AI Foundry")
+			return turn, "", nil, fmt.Errorf("runtime-auth-only Claude implementation does not support Azure AI Foundry")
 		}
 		mode = runtimeAuthProxyAnthropic
 		upstreamValue = envEntryValue(turn.Env, workerenv.AnthropicAPIKey)
 		endpoint = firstNonEmpty(envEntryValue(turn.Env, workerenv.AnthropicBaseURL), defaultAnthropicEndpoint)
 	default:
-		return turn, nil, fmt.Errorf("runtime-auth-only credential proxy does not support runtime %q", runtimeName)
+		return turn, "", nil, fmt.Errorf("runtime-auth-only credential proxy does not support runtime %q", runtimeName)
 	}
 	// The wrapper retains the upstream value as root. The CLI and all tool
 	// subprocesses must run under the configured non-root child identity so
 	// they cannot inspect the wrapper process environment or memory.
 	if !runtimeAuthChildBoundaryAvailable() {
-		return turn, nil, fmt.Errorf("runtime-auth-only credential proxy requires a dedicated non-root child UID/GID")
+		return turn, "", nil, fmt.Errorf("runtime-auth-only credential proxy requires a dedicated non-root child UID/GID")
 	}
 	if strings.TrimSpace(upstreamValue) == "" {
-		return turn, nil, fmt.Errorf(
+		return turn, "", nil, fmt.Errorf(
 			"runtime-auth-only credential proxy has no upstream credential for runtime %q",
 			runtimeName,
 		)
@@ -85,15 +85,21 @@ func protectRuntimeAuthTurn(turn TurnContext) (TurnContext, func(), error) {
 	upstream, err := url.Parse(endpoint)
 	validScheme := upstream != nil && (upstream.Scheme == runtimeAuthProxyHTTP || upstream.Scheme == runtimeAuthProxyHTTPS)
 	if err != nil || upstream == nil || !validScheme || upstream.Host == "" || upstream.User != nil {
-		return turn, nil, fmt.Errorf("runtime-auth-only credential proxy endpoint is invalid for runtime %q", runtimeName)
+		return turn, "", nil, fmt.Errorf("runtime-auth-only credential proxy endpoint is invalid for runtime %q", runtimeName)
+	}
+	if !runtimeAuthProxyUpstreamTransportAllowed(upstream) {
+		return turn, "", nil, fmt.Errorf(
+			"runtime-auth-only credential proxy endpoint must use HTTPS or literal loopback HTTP for runtime %q",
+			runtimeName,
+		)
 	}
 	token, err := newRuntimeAuthProxyToken()
 	if err != nil {
-		return turn, nil, err
+		return turn, "", nil, err
 	}
 	listener, err := net.Listen("tcp", runtimeAuthProxyLoopback+":0")
 	if err != nil {
-		return turn, nil, fmt.Errorf("listen for runtime-auth-only credential proxy: %w", err)
+		return turn, "", nil, fmt.Errorf("listen for runtime-auth-only credential proxy: %w", err)
 	}
 	proxy := newRuntimeAuthReverseProxy(upstream, mode, upstreamValue, token)
 	server := &http.Server{Handler: proxy, ReadHeaderTimeout: 10 * time.Second}
@@ -115,19 +121,38 @@ func protectRuntimeAuthTurn(turn TurnContext) (TurnContext, func(), error) {
 		})
 	}
 	localEndpoint := (&url.URL{Scheme: runtimeAuthProxyHTTP, Host: listener.Addr().String(), Path: upstream.Path}).String()
+	// Runtime-auth-only turns promise the child sees no raw provider
+	// credential, so scrub every known provider credential — not only the
+	// proxied provider's — before injecting the per-turn loopback values.
+	turn.Env = removeTurnEnv(turn.Env,
+		workerenv.OpenAIBaseURL, workerenv.OpenAIAPIKey, workerenv.CodexAPIKey,
+		workerenv.AnthropicBaseURL, workerenv.AnthropicAPIKey, "ANTHROPIC_FOUNDRY_API_KEY",
+	)
 	switch mode {
 	case runtimeAuthProxyOpenAI:
-		turn.Env = removeTurnEnv(turn.Env, workerenv.OpenAIBaseURL, workerenv.OpenAIAPIKey, workerenv.CodexAPIKey)
 		turn.Env = setEnv(turn.Env, workerenv.OpenAIBaseURL, localEndpoint)
 		turn.Env = setEnv(turn.Env, workerenv.OpenAIAPIKey, token)
 		turn.Env = setEnv(turn.Env, workerenv.CodexAPIKey, token)
 	case runtimeAuthProxyAnthropic:
-		turn.Env = removeTurnEnv(turn.Env, workerenv.AnthropicBaseURL, workerenv.AnthropicAPIKey)
 		turn.Env = setEnv(turn.Env, workerenv.AnthropicBaseURL, localEndpoint)
 		turn.Env = setEnv(turn.Env, workerenv.AnthropicAPIKey, token)
 	}
 	turn.Env = runtimeAuthProxyAddNoProxyHosts(turn.Env, runtimeAuthProxyLoopback, "localhost")
-	return turn, closeProxy, nil
+	return turn, token, closeProxy, nil
+}
+
+func runtimeAuthProxyUpstreamTransportAllowed(upstream *url.URL) bool {
+	if upstream == nil {
+		return false
+	}
+	if upstream.Scheme == runtimeAuthProxyHTTPS {
+		return true
+	}
+	if upstream.Scheme != runtimeAuthProxyHTTP {
+		return false
+	}
+	ip := net.ParseIP(upstream.Hostname())
+	return ip != nil && ip.IsLoopback()
 }
 
 func runtimeAuthProxyAddNoProxyHosts(env []string, hosts ...string) []string {
diff --git a/workers/harness/cliwrapper/runtime_auth_proxy_test.go b/workers/harness/cliwrapper/runtime_auth_proxy_test.go
index 40a6c1866..891427a04 100644
--- a/workers/harness/cliwrapper/runtime_auth_proxy_test.go
+++ b/workers/harness/cliwrapper/runtime_auth_proxy_test.go
@@ -2,6 +2,7 @@ package cliwrapper
 
 import (
 	"io"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -21,17 +22,20 @@ func TestProtectRuntimeAuthTurnUsesLoopbackProxy(t *testing.T) {
 		runtimeName   string
 		baseField     string
 		authField     string
+		crossField    string
 		requestHeader string
 		upstreamPath  string
 	}{
 		{
 			name: "codex", runtimeName: RuntimeCodex,
 			baseField: workerenv.OpenAIBaseURL, authField: workerenv.OpenAIAPIKey,
+			crossField:    workerenv.AnthropicAPIKey,
 			requestHeader: "Authorization", upstreamPath: "/v1/responses",
 		},
 		{
 			name: "claude", runtimeName: RuntimeClaude,
 			baseField: workerenv.AnthropicBaseURL, authField: workerenv.AnthropicAPIKey,
+			crossField:    workerenv.OpenAIAPIKey,
 			requestHeader: "x-api-key", upstreamPath: "/v1/messages",
 		},
 	}
@@ -44,7 +48,7 @@ func TestProtectRuntimeAuthTurnUsesLoopbackProxy(t *testing.T) {
 				anthropicHeader string
 			}
 			observed := make(chan observedRequest, 1)
-			upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			upstream := newRuntimeAuthLoopbackServer(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 				observed <- observedRequest{
 					path: r.URL.Path, authorization: r.Header.Get("Authorization"),
 					anthropicHeader: r.Header.Get("x-api-key"),
@@ -52,25 +56,31 @@ func TestProtectRuntimeAuthTurnUsesLoopbackProxy(t *testing.T) {
 				w.Header().Set("Content-Type", "application/json")
 				_, _ = io.WriteString(w, `{"ok":true}`)
 			}))
-			t.Cleanup(upstream.Close)
 			basePath := strings.TrimSuffix(tt.upstreamPath, strings.TrimPrefix(tt.upstreamPath, "/v1"))
+			crossProviderValue := "other-provider-credential"
 			turn := TurnContext{
 				RuntimeName: tt.runtimeName,
 				Metadata:    map[string]string{"runtimeAuthOnly": "true"},
 				Env: []string{
 					tt.baseField + "=" + upstream.URL + basePath,
 					tt.authField + "=" + upstreamValue,
+					tt.crossField + "=" + crossProviderValue,
 					"NO_PROXY=existing.internal",
 					"no_proxy=lower.internal",
 				},
 			}
-			protected, closeProxy, err := protectRuntimeAuthTurn(turn)
+			protected, redactionValue, closeProxy, err := protectRuntimeAuthTurn(turn)
 			if err != nil {
 				t.Fatalf("protectRuntimeAuthTurn() error = %v", err)
 			}
 			defer closeProxy()
 			if strings.Contains(strings.Join(protected.Env, "\n"), upstreamValue) {
-				t.Fatalf("protected child environment retained upstream value: %#v", protected.Env)
+				t.Fatal("protected child environment retained the upstream credential")
+			}
+			// Runtime-auth-only turns must scrub other providers' credentials
+			// too, not only the proxied provider's.
+			if strings.Contains(strings.Join(protected.Env, "\n"), crossProviderValue) {
+				t.Fatal("protected child environment retained another provider's credential")
 			}
 			for _, name := range []string{"NO_PROXY", "no_proxy"} {
 				value := envEntryValue(protected.Env, name)
@@ -99,6 +109,15 @@ func TestProtectRuntimeAuthTurnUsesLoopbackProxy(t *testing.T) {
 				t.Fatalf("NewRequest() error = %v", err)
 			}
 			proxyValue := envEntryValue(protected.Env, tt.authField)
+			if redactionValue == "" {
+				t.Fatal("generated redaction value is empty")
+			}
+			if redactionValue == upstreamValue {
+				t.Fatal("generated redaction value reused the upstream credential")
+			}
+			if redactionValue != proxyValue {
+				t.Fatal("generated redaction value does not match the child-facing proxy credential")
+			}
 			if tt.requestHeader == "Authorization" {
 				request.Header.Set(tt.requestHeader, "Bearer "+proxyValue)
 			} else {
@@ -197,10 +216,9 @@ func TestProtectRuntimeAuthTurnProtectsReadOnlyCodexCredentials(t *testing.T) {
 	previousBoundary := runtimeAuthChildBoundaryAvailable
 	runtimeAuthChildBoundaryAvailable = func() bool { return true }
 	t.Cleanup(func() { runtimeAuthChildBoundaryAvailable = previousBoundary })
-	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+	upstream := newRuntimeAuthLoopbackServer(t, http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusNoContent)
 	}))
-	t.Cleanup(upstream.Close)
 	turn := TurnContext{
 		RuntimeName: RuntimeCodex,
 		Metadata:    map[string]string{"readOnly": "true"},
@@ -209,7 +227,7 @@ func TestProtectRuntimeAuthTurnProtectsReadOnlyCodexCredentials(t *testing.T) {
 			workerenv.OpenAIAPIKey + "=upstream-value",
 		},
 	}
-	protected, closeProxy, err := protectRuntimeAuthTurn(turn)
+	protected, _, closeProxy, err := protectRuntimeAuthTurn(turn)
 	if err != nil {
 		t.Fatalf("protectRuntimeAuthTurn() error = %v", err)
 	}
@@ -227,10 +245,9 @@ func TestProtectRuntimeAuthTurnCollapsesDuplicateCredentialEntries(t *testing.T)
 	previousBoundary := runtimeAuthChildBoundaryAvailable
 	runtimeAuthChildBoundaryAvailable = func() bool { return true }
 	t.Cleanup(func() { runtimeAuthChildBoundaryAvailable = previousBoundary })
-	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+	upstream := newRuntimeAuthLoopbackServer(t, http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusNoContent)
 	}))
-	t.Cleanup(upstream.Close)
 	turn := TurnContext{
 		RuntimeName: RuntimeCodex,
 		Metadata:    map[string]string{"runtimeAuthOnly": "true"},
@@ -243,7 +260,7 @@ func TestProtectRuntimeAuthTurnCollapsesDuplicateCredentialEntries(t *testing.T)
 			workerenv.CodexAPIKey + "=upstream-codex",
 		},
 	}
-	protected, closeProxy, err := protectRuntimeAuthTurn(turn)
+	protected, _, closeProxy, err := protectRuntimeAuthTurn(turn)
 	if err != nil {
 		t.Fatalf("protectRuntimeAuthTurn() error = %v", err)
 	}
@@ -253,7 +270,7 @@ func TestProtectRuntimeAuthTurnCollapsesDuplicateCredentialEntries(t *testing.T)
 		"leaked-openai-first", "upstream-openai", "leaked-codex-first", "upstream-codex", "bypass.invalid",
 	} {
 		if strings.Contains(joined, secret) {
-			t.Fatalf("protected environment retained %q: %#v", secret, protected.Env)
+			t.Fatal("protected environment retained an upstream credential or endpoint")
 		}
 	}
 	for _, name := range []string{workerenv.OpenAIBaseURL, workerenv.OpenAIAPIKey, workerenv.CodexAPIKey} {
@@ -280,12 +297,86 @@ func TestRuntimeAuthProxyTransportDisablesEnvironmentProxy(t *testing.T) {
 	}
 }
 
+func TestProtectRuntimeAuthTurnRejectsNonLoopbackHTTPUpstream(t *testing.T) {
+	previousBoundary := runtimeAuthChildBoundaryAvailable
+	runtimeAuthChildBoundaryAvailable = func() bool { return true }
+	t.Cleanup(func() { runtimeAuthChildBoundaryAvailable = previousBoundary })
+	for _, endpoint := range []string{
+		"http://api.openai.com/v1",
+		"http://10.0.0.1/v1",
+	} {
+		t.Run(endpoint, func(t *testing.T) {
+			turn := TurnContext{
+				RuntimeName: RuntimeCodex,
+				Metadata:    map[string]string{"runtimeAuthOnly": "true"},
+				Env: []string{
+					workerenv.OpenAIBaseURL + "=" + endpoint,
+					workerenv.OpenAIAPIKey + "=upstream-value",
+				},
+			}
+			_, _, _, err := protectRuntimeAuthTurn(turn)
+			if err == nil || !strings.Contains(err.Error(), "must use HTTPS or literal loopback HTTP") {
+				t.Fatalf("protectRuntimeAuthTurn() error = %v, want cleartext upstream rejection", err)
+			}
+		})
+	}
+}
+
+func TestProtectRuntimeAuthTurnAllowsTLSUpstream(t *testing.T) {
+	previousBoundary := runtimeAuthChildBoundaryAvailable
+	runtimeAuthChildBoundaryAvailable = func() bool { return true }
+	t.Cleanup(func() { runtimeAuthChildBoundaryAvailable = previousBoundary })
+	upstreamValue := "upstream-model-value"
+	observed := make(chan string, 1)
+	upstream := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		observed <- r.Header.Get("Authorization")
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	t.Cleanup(upstream.Close)
+	previousTransport := http.DefaultTransport
+	http.DefaultTransport = upstream.Client().Transport
+	t.Cleanup(func() { http.DefaultTransport = previousTransport })
+	turn := TurnContext{
+		RuntimeName: RuntimeCodex,
+		Metadata:    map[string]string{"runtimeAuthOnly": "true"},
+		Env: []string{
+			workerenv.OpenAIBaseURL + "=" + upstream.URL + "/v1",
+			workerenv.OpenAIAPIKey + "=" + upstreamValue,
+		},
+	}
+	protected, _, closeProxy, err := protectRuntimeAuthTurn(turn)
+	if err != nil {
+		t.Fatalf("protectRuntimeAuthTurn() error = %v", err)
+	}
+	defer closeProxy()
+	request, err := http.NewRequest(
+		http.MethodPost,
+		envEntryValue(protected.Env, workerenv.OpenAIBaseURL)+"/responses",
+		strings.NewReader(`{}`),
+	)
+	if err != nil {
+		t.Fatalf("NewRequest() error = %v", err)
+	}
+	request.Header.Set("Authorization", "Bearer "+envEntryValue(protected.Env, workerenv.OpenAIAPIKey))
+	response, err := http.DefaultClient.Do(request)
+	if err != nil {
+		t.Fatalf("TLS proxy request error = %v", err)
+	}
+	_ = response.Body.Close()
+	if response.StatusCode != http.StatusNoContent {
+		t.Fatalf("TLS proxy status = %d, want %d", response.StatusCode, http.StatusNoContent)
+	}
+	if got := <-observed; got != "Bearer "+upstreamValue {
+		t.Fatalf("TLS upstream authorization was not injected")
+	}
+}
+
 func TestProtectRuntimeAuthTurnRejectsClaudeFoundry(t *testing.T) {
 	turn := TurnContext{RuntimeName: RuntimeClaude, Metadata: map[string]string{"runtimeAuthOnly": "true"}, Env: []string{
 		"CLAUDE_CODE_USE_FOUNDRY=1",
 		workerenv.AnthropicAPIKey + "=upstream-value",
 	}}
-	_, _, err := protectRuntimeAuthTurn(turn)
+	_, _, _, err := protectRuntimeAuthTurn(turn)
 	if err == nil || !strings.Contains(err.Error(), "does not support Azure AI Foundry") {
 		t.Fatalf("protectRuntimeAuthTurn() error = %v, want Foundry rejection", err)
 	}
@@ -296,11 +387,10 @@ func TestRuntimeAuthProxyRestrictsBasePathAndFixedQuery(t *testing.T) {
 	runtimeAuthChildBoundaryAvailable = func() bool { return true }
 	t.Cleanup(func() { runtimeAuthChildBoundaryAvailable = previousBoundary })
 	observed := make(chan *http.Request, 1)
-	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	upstream := newRuntimeAuthLoopbackServer(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		observed <- r.Clone(r.Context())
 		w.WriteHeader(http.StatusNoContent)
 	}))
-	t.Cleanup(upstream.Close)
 	turn := TurnContext{
 		RuntimeName: RuntimeCodex,
 		Metadata:    map[string]string{"runtimeAuthOnly": "true"},
@@ -309,7 +399,7 @@ func TestRuntimeAuthProxyRestrictsBasePathAndFixedQuery(t *testing.T) {
 			workerenv.OpenAIAPIKey + "=upstream-value",
 		},
 	}
-	protected, closeProxy, err := protectRuntimeAuthTurn(turn)
+	protected, _, closeProxy, err := protectRuntimeAuthTurn(turn)
 	if err != nil {
 		t.Fatalf("protectRuntimeAuthTurn() error = %v", err)
 	}
@@ -368,7 +458,7 @@ func TestProtectRuntimeAuthTurnRequiresChildIdentityBoundary(t *testing.T) {
 	turn := TurnContext{RuntimeName: RuntimeCodex, Metadata: map[string]string{"runtimeAuthOnly": "true"}, Env: []string{
 		workerenv.OpenAIAPIKey + "=upstream-value",
 	}}
-	_, _, err := protectRuntimeAuthTurn(turn)
+	_, _, _, err := protectRuntimeAuthTurn(turn)
 	if err == nil || !strings.Contains(err.Error(), "dedicated non-root child UID/GID") {
 		t.Fatalf("protectRuntimeAuthTurn() error = %v, want child identity boundary rejection", err)
 	}
@@ -376,8 +466,20 @@ func TestProtectRuntimeAuthTurnRequiresChildIdentityBoundary(t *testing.T) {
 
 func TestProtectRuntimeAuthTurnRejectsUnsupportedRuntime(t *testing.T) {
 	turn := TurnContext{RuntimeName: RuntimeGeneric, Metadata: map[string]string{"runtimeAuthOnly": "true"}}
-	_, _, err := protectRuntimeAuthTurn(turn)
+	_, _, _, err := protectRuntimeAuthTurn(turn)
 	if err == nil || !strings.Contains(err.Error(), "does not support runtime") {
 		t.Fatalf("protectRuntimeAuthTurn() error = %v, want unsupported runtime rejection", err)
 	}
 }
+
+func newRuntimeAuthLoopbackServer(t *testing.T, handler http.Handler) *httptest.Server {
+	t.Helper()
+	listener, err := net.Listen("tcp4", runtimeAuthProxyLoopback+":0")
+	if err != nil {
+		t.Fatalf("listen on runtime-auth loopback: %v", err)
+	}
+	server := &httptest.Server{Listener: listener, Config: &http.Server{Handler: handler}}
+	server.Start()
+	t.Cleanup(server.Close)
+	return server
+}
diff --git a/workers/harness/cliwrapper/server.go b/workers/harness/cliwrapper/server.go
index c2d42663b..3a269f981 100644
--- a/workers/harness/cliwrapper/server.go
+++ b/workers/harness/cliwrapper/server.go
@@ -2,15 +2,20 @@ package cliwrapper
 
 import (
 	"context"
+	"crypto/sha256"
 	"crypto/subtle"
+	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"os"
 	"path"
 	"path/filepath"
+	"slices"
+	"sort"
 	"strconv"
 	"strings"
 	"sync"
@@ -19,6 +24,7 @@ import (
 
 	"github.com/orka-agents/orka/internal/events"
 	"github.com/orka-agents/orka/internal/harness"
+	"github.com/orka-agents/orka/internal/harness/ledger"
 	"github.com/orka-agents/orka/internal/tracing"
 	"github.com/orka-agents/orka/internal/workerenv"
 	"github.com/orka-agents/orka/workers/common"
@@ -28,38 +34,50 @@ import (
 )
 
 const (
-	maxTerminalResultBytes = 512 * 1024
-	localOutputRef         = "cliwrapper-result-v1"
+	maxTerminalResultBytes           = 512 * 1024
+	localOutputRef                   = "cliwrapper-result-v1"
+	terminalLedgerPersistFailed      = "persist-failed"
+	admissionLedgerReconcileFailed   = "reconcile-failed"
+	childCredentialCleanupFailed     = "cleanup-failed"
+	durableAdmissionReconcileTimeout = 5 * time.Second
+	durableLedgerReclaimTimeout      = 5 * time.Second
+	durableLedgerReclaimBatch        = 128
+	durableAcceptanceRejectionReason = "wrapper-durable-acceptance-failed"
+	durableLocalRejectionReason      = "wrapper-local-admission-rejected"
+	failedArtifactRetentionPrefix    = "orka-harness-artifact-upload-failed-"
+	maxFailedArtifactRetentions      = 8
 )
 
+var failedArtifactRetentionMu sync.Mutex
+
 type Server struct {
-	config  Config
-	adapter RuntimeAdapter
-	runner  CommandRunner
-	now     func() time.Time
+	config                         Config
+	adapter                        RuntimeAdapter
+	runner                         commandRunner
+	now                            func() time.Time
+	configuredExactRedactionValues []string
 
 	turnRegistry *turnRegistry
+	ledger       *ledger.Ledger
+
+	healthMu           sync.RWMutex
+	terminalLedgerErr  error
+	admissionLedgerErr error
+	// admissionLedgerErrRetryable is true only for bounded ledger reclamation
+	// failures. Ambiguous admission reconciliation failures remain fail-closed.
+	admissionLedgerErrRetryable bool
+	childCredentialProcessErr   error
 }
 
-type RuntimeSupportProvider interface {
-	SupportedRuntimes() []string
-}
-
-type ServerOption func(*Server)
-
-func WithClock(now func() time.Time) ServerOption {
-	return func(s *Server) {
-		if now != nil {
-			s.now = now
-		}
-	}
+type commandRunner interface {
+	Run(context.Context, *CommandSpec) (CommandResult, error)
 }
 
-func WithCommandRunner(runner CommandRunner) ServerOption {
-	return func(s *Server) { s.runner = runner }
+type RuntimeSupportProvider interface {
+	SupportedRuntimes() []string
 }
 
-func NewServer(cfg Config, adapter RuntimeAdapter, opts ...ServerOption) (*Server, error) {
+func NewServer(cfg Config, adapter RuntimeAdapter) (*Server, error) {
 	if err := cfg.Validate(); err != nil {
 		return nil, err
 	}
@@ -71,26 +89,119 @@ func NewServer(cfg Config, adapter RuntimeAdapter, opts ...ServerOption) (*Serve
 		}
 	}
 	s := &Server{
-		config:       cfg,
-		adapter:      adapter,
-		runner:       NewCommandRunner(cfg),
-		now:          time.Now,
-		turnRegistry: newTurnRegistry(),
-	}
-	for _, opt := range opts {
-		if opt != nil {
-			opt(s)
+		config:                         cfg,
+		adapter:                        adapter,
+		runner:                         NewCommandRunner(cfg),
+		now:                            time.Now,
+		configuredExactRedactionValues: exactConfiguredEnvValues(cfg.CommandEnv),
+		turnRegistry:                   newTurnRegistry(),
+	}
+	if ledgerPath := strings.TrimSpace(cfg.AdmissionLedgerPath); ledgerPath != "" {
+		admissionLedger, err := ledger.OpenWithGeneration(ledgerPath, cfg.LedgerGeneration)
+		if err != nil {
+			return nil, err
+		}
+		s.ledger = admissionLedger
+		if err := s.reconcileOrphanedDurableTurns(context.Background()); err != nil {
+			_ = admissionLedger.Close()
+			s.ledger = nil
+			return nil, err
+		}
+		if err := admissionLedger.ActivateGeneration(context.Background(), cfg.LedgerGeneration); err != nil {
+			_ = admissionLedger.Close()
+			s.ledger = nil
+			return nil, fmt.Errorf("activate wrapper ledger generation: %w", err)
+		}
+		if err := s.reclaimSettledTurns(context.Background()); err != nil {
+			_ = admissionLedger.Close()
+			s.ledger = nil
+			return nil, err
 		}
 	}
 	return s, nil
 }
 
+func (s *Server) reconcileOrphanedDurableTurns(ctx context.Context) error {
+	records, err := s.ledger.ListUnsettledTurns(ctx)
+	if err != nil {
+		return fmt.Errorf("list orphaned durable turns: %w", err)
+	}
+	for i := range records {
+		record := &records[i]
+		switch record.State {
+		case ledger.TurnAdmitted:
+			if err := s.ledger.MarkTurnRejected(ctx, record.TurnID, "wrapper-restarted-before-acceptance"); err != nil {
+				return fmt.Errorf("reject orphaned admitted turn: %w", err)
+			}
+		case ledger.TurnAccepted:
+			runtimeSessionID := strings.TrimSpace(record.RuntimeSessionID)
+			if runtimeSessionID == "" {
+				runtimeSessionID = "unknown-after-wrapper-restart"
+			}
+			correlationID := strings.TrimSpace(record.CorrelationID)
+			if correlationID == "" {
+				correlationID = "unknown-after-wrapper-restart"
+			}
+			receipt, marshalErr := harness.MarshalDurableTurnTerminalReceipt(harness.DurableTurnTerminalReceipt{
+				Version:          harness.ProtocolVersion,
+				Kind:             harness.DurableTurnTerminalOutcomeUnknown,
+				RuntimeSessionID: harness.RuntimeSessionID(runtimeSessionID),
+				TurnID:           harness.HarnessTurnID(record.TurnID),
+				CorrelationID:    correlationID,
+				OutcomeUnknown: &harness.DurableTurnOutcomeUnknownReceipt{
+					Reason: "wrapper-restarted-after-acceptance",
+				},
+			})
+			if marshalErr != nil {
+				return fmt.Errorf("encode orphaned accepted turn receipt: %w", marshalErr)
+			}
+			if err := s.ledger.RecordTurnTerminal(ctx, record.TurnID, receipt, true); err != nil {
+				return fmt.Errorf("settle orphaned accepted turn: %w", err)
+			}
+		}
+	}
+	return nil
+}
+
+func (s *Server) reclaimSettledTurns(ctx context.Context) error {
+	if s == nil || s.ledger == nil {
+		return nil
+	}
+	reclaimCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), durableLedgerReclaimTimeout)
+	defer cancel()
+	cutoff := s.now().UTC().Add(-s.config.LedgerRetention)
+	if _, err := s.ledger.ReclaimSettledTurnsBefore(reclaimCtx, cutoff, durableLedgerReclaimBatch); err != nil {
+		reclaimErr := fmt.Errorf("reclaim settled wrapper ledger turns: %w", err)
+		s.setRetryableAdmissionLedgerError(reclaimErr)
+		return reclaimErr
+	}
+	s.clearRetryableAdmissionLedgerError()
+	return nil
+}
+
+// Close releases the durable wrapper admission ledger. The HTTP server must be
+// stopped before calling Close.
+func (s *Server) Close() error {
+	if s == nil || s.ledger == nil {
+		return nil
+	}
+	err := s.ledger.Close()
+	s.ledger = nil
+	return err
+}
+
 func (s *Server) Handler() http.Handler {
 	mux := http.NewServeMux()
 	mux.HandleFunc(harness.HealthPath, s.handleHealth)
+	mux.HandleFunc(harness.ReadinessPath, s.handleReadiness)
 	mux.HandleFunc(harness.CapabilitiesPath, s.handleCapabilities)
 	mux.HandleFunc(harness.TurnsPath, s.handleStartTurn)
 	mux.HandleFunc(harness.TurnsPath+"/", s.handleTurn)
+	mux.HandleFunc(harness.AdminTurnsPath+"/", s.handleAdminTurn)
+	mux.HandleFunc(harness.AdminDrainPath, s.handleAdminDrain)
+	mux.HandleFunc(harness.AdminClosePath, s.handleAdminClose)
+	mux.HandleFunc(harness.AdminRolloverPath, s.handleAdminRollover)
+	mux.HandleFunc(harness.AdminAbortRolloverPath, s.handleAdminAbortRollover)
 	return mux
 }
 
@@ -116,11 +227,154 @@ func (s *Server) authorized(w http.ResponseWriter, r *http.Request) bool {
 }
 
 func (s *Server) finishTurn(turn *turnState) {
+	defer turn.clearExactRedactionValues()
+	if !s.childCredentialProcessesHealthy() {
+		return
+	}
+	if s.ledger != nil {
+		receipt, outcomeUnknown := s.durableTerminalReceipt(turn)
+		var durableOutput *ledger.TurnOutput
+		if !outcomeUnknown && turn.terminalOutputRef() == localOutputRef {
+			data, ok, err := turn.output()
+			if err != nil || !ok {
+				if err == nil {
+					err = errors.New("terminal output payload is missing")
+				}
+				s.setTerminalLedgerError(err)
+				return
+			}
+			durableOutput = &ledger.TurnOutput{Ref: localOutputRef, Data: data}
+		}
+		if err := s.ledger.RecordTurnTerminalWithOutput(
+			context.Background(), string(turn.id()), receipt, outcomeUnknown, durableOutput,
+		); err != nil {
+			// Do not expose stream completion, release capacity, or schedule
+			// eviction until the authoritative terminal receipt is durable. The
+			// unhealthy readiness response surfaces the failure without leaking
+			// ledger details; an operator can restart into conservative recovery.
+			s.setTerminalLedgerError(err)
+			return
+		}
+		s.setTerminalLedgerError(nil)
+	}
 	turn.close()
 	s.turnRegistry.finishActive()
 	s.scheduleTurnEviction(turn)
 }
 
+func (s *Server) markDurableTurnAccepted(ctx context.Context, turn *turnState) error {
+	acceptErr := s.ledger.MarkTurnAccepted(ctx, string(turn.id()))
+	if acceptErr == nil {
+		return nil
+	}
+
+	// AdmitTurn has already committed. Reconcile that durable admission before
+	// releasing the wrapper-local reservation, even if the request was canceled.
+	cleanupCtx, cancel := context.WithTimeout(
+		context.WithoutCancel(ctx),
+		durableAdmissionReconcileTimeout,
+	)
+	rejectErr := s.ledger.MarkTurnRejected(
+		cleanupCtx,
+		string(turn.id()),
+		durableAcceptanceRejectionReason,
+	)
+	cancel()
+	if rejectErr != nil {
+		combinedErr := errors.Join(acceptErr, fmt.Errorf("reconcile durable turn admission: %w", rejectErr))
+		s.setAdmissionLedgerError(combinedErr)
+		return combinedErr
+	}
+
+	s.turnRegistry.reject(turn)
+	return acceptErr
+}
+
+func (s *Server) markDurableLocalAdmissionRejected(ctx context.Context, turnID harness.HarnessTurnID) error {
+	cleanupCtx, cancel := context.WithTimeout(
+		context.WithoutCancel(ctx),
+		durableAdmissionReconcileTimeout,
+	)
+	defer cancel()
+	if err := s.ledger.MarkTurnRejected(cleanupCtx, string(turnID), durableLocalRejectionReason); err != nil {
+		reconcileErr := fmt.Errorf("reconcile durable local turn rejection: %w", err)
+		s.setAdmissionLedgerError(reconcileErr)
+		return reconcileErr
+	}
+	return nil
+}
+
+func (s *Server) setTerminalLedgerError(err error) {
+	s.healthMu.Lock()
+	s.terminalLedgerErr = err
+	s.healthMu.Unlock()
+}
+
+func (s *Server) terminalLedgerHealthy() bool {
+	s.healthMu.RLock()
+	defer s.healthMu.RUnlock()
+	return s.terminalLedgerErr == nil
+}
+
+func (s *Server) setAdmissionLedgerError(err error) {
+	s.healthMu.Lock()
+	s.admissionLedgerErr = err
+	s.admissionLedgerErrRetryable = false
+	s.healthMu.Unlock()
+}
+
+func (s *Server) setRetryableAdmissionLedgerError(err error) {
+	s.healthMu.Lock()
+	defer s.healthMu.Unlock()
+	if s.admissionLedgerErr != nil && !s.admissionLedgerErrRetryable {
+		return
+	}
+	s.admissionLedgerErr = err
+	s.admissionLedgerErrRetryable = err != nil
+}
+
+func (s *Server) clearRetryableAdmissionLedgerError() {
+	s.healthMu.Lock()
+	defer s.healthMu.Unlock()
+	if !s.admissionLedgerErrRetryable {
+		return
+	}
+	s.admissionLedgerErr = nil
+	s.admissionLedgerErrRetryable = false
+}
+
+func (s *Server) admissionLedgerReclaimRetryable() bool {
+	s.healthMu.RLock()
+	defer s.healthMu.RUnlock()
+	return s.admissionLedgerErr == nil || s.admissionLedgerErrRetryable
+}
+
+func (s *Server) admissionLedgerHealthy() bool {
+	s.healthMu.RLock()
+	defer s.healthMu.RUnlock()
+	return s.admissionLedgerErr == nil
+}
+
+func (s *Server) setChildCredentialProcessError(err error) {
+	s.healthMu.Lock()
+	s.childCredentialProcessErr = err
+	s.healthMu.Unlock()
+}
+
+func (s *Server) latchChildCredentialProcessCleanupFailure(err error) bool {
+	if !errors.Is(err, errChildCredentialProcessCleanupUnproven) {
+		return false
+	}
+	s.setChildCredentialProcessError(err)
+	return true
+}
+
+func (s *Server) childCredentialProcessesHealthy() bool {
+	s.healthMu.RLock()
+	defer s.healthMu.RUnlock()
+	return s.childCredentialProcessErr == nil
+}
+
 func (s *Server) scheduleTurnEviction(turn *turnState) {
 	retention := s.config.TurnRetention
 	if retention <= 0 {
@@ -147,27 +401,72 @@ func (s *Server) handleHealth(w http.ResponseWriter, r *http.Request) {
 		writeSafeError(w, http.StatusMethodNotAllowed, "method not allowed")
 		return
 	}
-	harness.WriteJSON(w, http.StatusOK, harness.HealthResponse{
+	harness.WriteJSON(w, http.StatusOK, s.healthResponse())
+}
+
+func (s *Server) handleReadiness(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		writeSafeError(w, http.StatusMethodNotAllowed, "method not allowed")
+		return
+	}
+	response := s.healthResponse()
+	statusCode := http.StatusOK
+	if !response.Ready {
+		statusCode = http.StatusServiceUnavailable
+	}
+	harness.WriteJSON(w, statusCode, response)
+}
+
+func (s *Server) healthResponse() harness.HealthResponse {
+	status := harness.HealthStatusOK
+	ready := true
+	metadata := map[string]string{
+		"runtime": s.adapter.Name(),
+		"mode":    "observed",
+	}
+	if !s.terminalLedgerHealthy() {
+		status = harness.HealthStatusUnhealthy
+		ready = false
+		metadata["terminalLedger"] = terminalLedgerPersistFailed
+	}
+	if !s.admissionLedgerHealthy() {
+		status = harness.HealthStatusUnhealthy
+		ready = false
+		metadata["admissionLedger"] = admissionLedgerReconcileFailed
+	}
+	if !s.childCredentialProcessesHealthy() {
+		status = harness.HealthStatusUnhealthy
+		ready = false
+		metadata["childCredentialProcesses"] = childCredentialCleanupFailed
+	}
+	return harness.HealthResponse{
 		Version:   harness.ProtocolVersion,
-		Status:    harness.HealthStatusOK,
-		Ready:     true,
+		Status:    status,
+		Ready:     ready,
 		CheckedAt: s.now().UTC(),
-		Metadata: map[string]string{
-			"runtime": s.adapter.Name(),
-			"mode":    "observed",
-		},
-	})
+		Metadata:  metadata,
+	}
 }
 
 func (s *Server) currentAuthValue() (string, error) {
+	if s.config.AllowUnauthenticated {
+		return "", nil
+	}
+	var value string
 	if file := strings.TrimSpace(s.config.AuthValueFile); file != "" {
 		data, err := os.ReadFile(file)
 		if err != nil {
 			return "", err
 		}
-		return strings.TrimSpace(string(data)), nil
+		value = string(data)
+	} else {
+		value = s.config.AuthValue
+	}
+	value = strings.TrimSpace(value)
+	if err := validateAuthValue(value); err != nil {
+		return "", err
 	}
-	return strings.TrimSpace(s.config.AuthValue), nil
+	return value, nil
 }
 
 func (s *Server) handleCapabilities(w http.ResponseWriter, r *http.Request) {
@@ -202,6 +501,220 @@ func (s *Server) capabilitiesMetadata() map[string]string {
 	return metadata
 }
 
+type durableTurnAdmission struct {
+	taskUID       string
+	attempt       int32
+	requestDigest string
+}
+
+func validateDurableTurnAdmission(request harness.StartTurnRequest) (*durableTurnAdmission, error) {
+	metadata := request.Metadata
+	taskUID := strings.TrimSpace(metadata[harness.MetadataTaskUID])
+	if taskUID == "" {
+		return nil, fmt.Errorf("durable turn admission requires task UID metadata")
+	}
+	attemptValue := strings.TrimSpace(metadata[harness.MetadataAttempt])
+	attempt, err := strconv.ParseInt(attemptValue, 10, 32)
+	if err != nil || attempt < 1 {
+		return nil, fmt.Errorf("durable turn admission requires a positive attempt")
+	}
+	for label, value := range map[string]string{
+		"binding":  metadata[harness.MetadataBindingDigest],
+		"snapshot": metadata[harness.MetadataSnapshotDigest],
+	} {
+		if !validSHA256Digest(value) {
+			return nil, fmt.Errorf("durable turn admission requires a canonical %s digest", label)
+		}
+	}
+	requestDigest := strings.TrimSpace(metadata[harness.MetadataRequestDigest])
+	if !validSHA256Digest(requestDigest) {
+		return nil, fmt.Errorf("durable turn admission requires a canonical request digest")
+	}
+	computed, err := harness.CanonicalStartTurnRequestDigest(request)
+	if err != nil {
+		return nil, err
+	}
+	if subtle.ConstantTimeCompare([]byte(requestDigest), []byte(computed)) != 1 {
+		return nil, fmt.Errorf("durable turn request digest does not match the submitted request")
+	}
+	return &durableTurnAdmission{taskUID: taskUID, attempt: int32(attempt), requestDigest: requestDigest}, nil
+}
+
+func validSHA256Digest(value string) bool {
+	value = strings.TrimSpace(value)
+	if len(value) != len("sha256:")+sha256.Size*2 || !strings.HasPrefix(value, "sha256:") {
+		return false
+	}
+	decoded, err := hex.DecodeString(strings.TrimPrefix(value, "sha256:"))
+	return err == nil && len(decoded) == sha256.Size
+}
+
+func safeAdminTurnStatus(record *ledger.TurnRecord) (harness.DurableTurnStatus, error) {
+	if record == nil {
+		return harness.DurableTurnStatus{}, fmt.Errorf("durable turn record is required")
+	}
+	status := harness.DurableTurnStatus{
+		TurnID: record.TurnID, TaskUID: record.TaskUID, Attempt: record.Attempt,
+		RequestDigest: record.RequestDigest, State: harness.DurableTurnAdmissionState(record.State),
+		TerminalReceiptDigest: record.TerminalReceiptDigest, UpdatedAt: record.UpdatedAt,
+	}
+	switch record.State {
+	case ledger.TurnTerminal, ledger.TurnOutcomeUnknown:
+		var receipt harness.DurableTurnTerminalReceipt
+		if err := json.Unmarshal(record.TerminalReceipt, &receipt); err != nil {
+			return harness.DurableTurnStatus{}, fmt.Errorf("decode durable terminal receipt: %w", err)
+		}
+		if err := receipt.Validate(); err != nil {
+			return harness.DurableTurnStatus{}, err
+		}
+		digest, err := harness.DurableTurnTerminalReceiptDigest(receipt)
+		if err != nil {
+			return harness.DurableTurnStatus{}, err
+		}
+		if digest != record.TerminalReceiptDigest {
+			return harness.DurableTurnStatus{}, fmt.Errorf("durable terminal receipt digest mismatch")
+		}
+		if record.State == ledger.TurnTerminal && receipt.Kind == harness.DurableTurnTerminalOutcomeUnknown {
+			return harness.DurableTurnStatus{}, fmt.Errorf("terminal ledger state contains outcome-unknown receipt")
+		}
+		if record.State == ledger.TurnOutcomeUnknown && receipt.Kind != harness.DurableTurnTerminalOutcomeUnknown {
+			return harness.DurableTurnStatus{}, fmt.Errorf("outcome-unknown ledger state contains terminal receipt")
+		}
+		status.TerminalReceipt = &receipt
+	default:
+		if len(record.TerminalReceipt) != 0 || record.TerminalReceiptDigest != "" {
+			return harness.DurableTurnStatus{}, fmt.Errorf("nonterminal ledger state contains terminal receipt")
+		}
+	}
+	return status, nil
+}
+
+// requireAdmin applies the shared admin-endpoint guard ladder: authorization,
+// method check, then durable-ledger availability. It writes the error response
+// and returns false when the request must not proceed.
+func (s *Server) requireAdmin(w http.ResponseWriter, r *http.Request, method string) bool {
+	if !s.authorized(w, r) {
+		return false
+	}
+	if r.Method != method {
+		writeSafeError(w, http.StatusMethodNotAllowed, "method not allowed")
+		return false
+	}
+	if s.ledger == nil {
+		writeSafeError(w, http.StatusServiceUnavailable, "durable admission ledger is not configured")
+		return false
+	}
+	return true
+}
+
+func (s *Server) handleAdminTurn(w http.ResponseWriter, r *http.Request) {
+	if !s.requireAdmin(w, r, http.MethodGet) {
+		return
+	}
+	turnID := strings.TrimSpace(strings.TrimPrefix(r.URL.Path, harness.AdminTurnsPath+"/"))
+	if turnID == "" || strings.Contains(turnID, "/") {
+		writeSafeError(w, http.StatusBadRequest, "turn ID is required")
+		return
+	}
+	record, err := s.ledger.GetTurn(r.Context(), turnID)
+	if err != nil {
+		if errors.Is(err, ledger.ErrNotFound) {
+			writeSafeError(w, http.StatusNotFound, "turn not found")
+			return
+		}
+		writeSafeError(w, http.StatusServiceUnavailable, "read durable turn status failed")
+		return
+	}
+	status, err := safeAdminTurnStatus(record)
+	if err != nil {
+		writeSafeError(w, http.StatusServiceUnavailable, "durable turn receipt validation failed")
+		return
+	}
+	harness.WriteJSON(w, http.StatusOK, status)
+}
+
+func (s *Server) handleAdminClose(w http.ResponseWriter, r *http.Request) {
+	if !s.requireAdmin(w, r, http.MethodPost) {
+		return
+	}
+	if err := s.ledger.CloseAdmission(r.Context()); err != nil {
+		writeSafeError(w, http.StatusServiceUnavailable, "close durable admission failed")
+		return
+	}
+	harness.WriteJSON(w, http.StatusOK, harness.DurableAdmissionCloseResponse{AdmissionClosed: true})
+}
+
+func (s *Server) handleAdminDrain(w http.ResponseWriter, r *http.Request) {
+	if !s.requireAdmin(w, r, http.MethodGet) {
+		return
+	}
+	closed, closedAt, err := s.ledger.AdmissionClosed(r.Context())
+	if err != nil {
+		writeSafeError(w, http.StatusServiceUnavailable, "read durable admission state failed")
+		return
+	}
+	records, err := s.ledger.ListUnsettledTurns(r.Context())
+	if err != nil {
+		writeSafeError(w, http.StatusServiceUnavailable, "read durable drain inventory failed")
+		return
+	}
+	statuses := make([]harness.DurableTurnStatus, 0, len(records))
+	for i := range records {
+		status, statusErr := safeAdminTurnStatus(&records[i])
+		if statusErr != nil {
+			writeSafeError(w, http.StatusServiceUnavailable, "durable drain receipt validation failed")
+			return
+		}
+		statuses = append(statuses, status)
+	}
+	harness.WriteJSON(w, http.StatusOK, harness.DurableDrainStatus{
+		AdmissionClosed: closed, AdmissionClosedAt: closedAt,
+		Completed: closed && len(statuses) == 0, Unsettled: statuses,
+	})
+}
+
+func (s *Server) handleAdminRollover(w http.ResponseWriter, r *http.Request) {
+	if !s.requireAdmin(w, r, http.MethodPost) {
+		return
+	}
+	var request harness.DurableRolloverPrepareRequest
+	if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+		writeSafeError(w, http.StatusBadRequest, "invalid JSON request")
+		return
+	}
+	nextGeneration := strings.TrimSpace(request.NextGeneration)
+	currentGeneration, err := s.ledger.PrepareRollover(r.Context(), nextGeneration)
+	if err != nil {
+		writeSafeError(w, http.StatusConflict, "durable rollover preparation failed")
+		return
+	}
+	harness.WriteJSON(w, http.StatusOK, harness.DurableRolloverPrepareResponse{
+		CurrentGeneration: currentGeneration,
+		NextGeneration:    nextGeneration,
+		Prepared:          true,
+	})
+}
+
+func (s *Server) handleAdminAbortRollover(w http.ResponseWriter, r *http.Request) {
+	if !s.requireAdmin(w, r, http.MethodPost) {
+		return
+	}
+	var request harness.DurableRolloverAbortRequest
+	if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+		writeSafeError(w, http.StatusBadRequest, "invalid JSON request")
+		return
+	}
+	expectedGeneration := strings.TrimSpace(request.ExpectedGeneration)
+	if err := s.ledger.AbortRollover(r.Context(), expectedGeneration); err != nil {
+		writeSafeError(w, http.StatusConflict, "durable rollover abort failed")
+		return
+	}
+	harness.WriteJSON(w, http.StatusOK, harness.DurableRolloverAbortResponse{
+		CurrentGeneration: expectedGeneration,
+		AdmissionReopened: true,
+	})
+}
+
 func (s *Server) handleStartTurn(w http.ResponseWriter, r *http.Request) {
 	if !s.authorized(w, r) {
 		return
@@ -210,6 +723,22 @@ func (s *Server) handleStartTurn(w http.ResponseWriter, r *http.Request) {
 		writeSafeError(w, http.StatusMethodNotAllowed, "method not allowed")
 		return
 	}
+	if !s.childCredentialProcessesHealthy() {
+		writeSafeError(w, http.StatusServiceUnavailable, "turn process isolation is unavailable")
+		return
+	}
+	if !s.admissionLedgerReclaimRetryable() {
+		writeSafeError(w, http.StatusServiceUnavailable, "durable turn admission is unavailable")
+		return
+	}
+	if err := s.reclaimSettledTurns(r.Context()); err != nil {
+		writeSafeError(w, http.StatusServiceUnavailable, "durable turn admission is unavailable")
+		return
+	}
+	if !s.admissionLedgerHealthy() {
+		writeSafeError(w, http.StatusServiceUnavailable, "durable turn admission is unavailable")
+		return
+	}
 	var request harness.StartTurnRequest
 	if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
 		writeSafeError(w, http.StatusBadRequest, "invalid JSON request")
@@ -225,8 +754,52 @@ func (s *Server) handleStartTurn(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	var durable *durableTurnAdmission
+	if s.ledger != nil {
+		durable, err = validateDurableTurnAdmission(request)
+		if err != nil {
+			writeSafeError(w, http.StatusBadRequest, err.Error())
+			return
+		}
+		outcome, existing, admitErr := s.ledger.AdmitTurn(
+			r.Context(), string(request.TurnID), durable.taskUID, durable.attempt, durable.requestDigest,
+			string(request.RuntimeSessionID), request.CorrelationID,
+		)
+		if admitErr != nil {
+			switch {
+			case errors.Is(admitErr, ledger.ErrAdmissionClosed):
+				writeSafeError(w, http.StatusConflict, "wrapper admission is closed")
+			case errors.Is(admitErr, ledger.ErrDigestMismatch):
+				writeSafeError(w, http.StatusConflict, "turn identity was already admitted with a different request")
+			default:
+				writeSafeError(w, http.StatusServiceUnavailable, "durable turn admission failed")
+			}
+			return
+		}
+		if outcome == ledger.AdmitOutcomeDuplicate {
+			if existing != nil &&
+				(existing.State == ledger.TurnAdmitted || existing.State == ledger.TurnAccepted) &&
+				s.turnRegistry.active(request.TurnID) {
+				writeAcceptedTurn(w, request, eventStreamPath)
+				return
+			}
+			writeSafeError(
+				w,
+				http.StatusConflict,
+				"turn was already durably admitted; inspect authenticated turn status before reconciliation",
+			)
+			return
+		}
+	}
+
 	state, err := s.turnRegistry.admit(request, s.now)
 	if err != nil {
+		if s.ledger != nil && durable != nil {
+			if rejectErr := s.markDurableLocalAdmissionRejected(r.Context(), request.TurnID); rejectErr != nil {
+				writeSafeError(w, http.StatusServiceUnavailable, "durable turn rejection failed")
+				return
+			}
+		}
 		switch {
 		case errors.Is(err, errTurnAlreadyExists):
 			writeSafeError(w, http.StatusConflict, "turn already exists")
@@ -242,8 +815,21 @@ func (s *Server) handleStartTurn(w http.ResponseWriter, r *http.Request) {
 		}
 		return
 	}
+	for _, value := range s.configuredExactRedactionValues {
+		state.addExactRedactionValue(value)
+	}
+	if s.ledger != nil {
+		if err := s.markDurableTurnAccepted(r.Context(), state); err != nil {
+			writeSafeError(w, http.StatusServiceUnavailable, "durable turn acceptance failed")
+			return
+		}
+	}
 
 	go s.runTurn(state)
+	writeAcceptedTurn(w, request, eventStreamPath)
+}
+
+func writeAcceptedTurn(w http.ResponseWriter, request harness.StartTurnRequest, eventStreamPath string) {
 	harness.WriteJSON(w, http.StatusAccepted, harness.StartTurnResponse{
 		Version:          harness.ProtocolVersion,
 		Accepted:         true,
@@ -267,25 +853,53 @@ func (s *Server) handleTurn(w http.ResponseWriter, r *http.Request) {
 		}
 		return
 	}
+	if resource == harness.TurnResourceOutputAcknowledgement {
+		if r.Method != http.MethodPost {
+			writeSafeError(w, http.StatusMethodNotAllowed, "method not allowed")
+			return
+		}
+		if s.ledger == nil {
+			writeSafeError(w, http.StatusServiceUnavailable, "durable turn output acknowledgement is unavailable")
+			return
+		}
+		s.handleOutputAcknowledgement(w, r, turnID)
+		return
+	}
+	if resource == harness.TurnResourceSettlementAcknowledgement {
+		if r.Method != http.MethodPost {
+			writeSafeError(w, http.StatusMethodNotAllowed, "method not allowed")
+			return
+		}
+		if s.ledger == nil {
+			writeSafeError(w, http.StatusServiceUnavailable, "durable turn settlement acknowledgement is unavailable")
+			return
+		}
+		s.handleSettlementAcknowledgement(w, r, turnID)
+		return
+	}
 	turn := s.turnRegistry.lookup(turnID)
+	if turn == nil && resource == harness.TurnResourceOutput && r.Method == http.MethodGet && s.ledger != nil {
+		s.handleDurableOutput(w, r, turnID)
+		return
+	}
 	if turn == nil {
 		writeSafeError(w, http.StatusNotFound, "turn not found")
 		return
 	}
 	switch resource {
-	case "events":
+	case harness.TurnResourceEvents:
 		if r.Method != http.MethodGet {
 			writeSafeError(w, http.StatusMethodNotAllowed, "method not allowed")
 			return
 		}
 		s.handleEvents(w, r, turn)
-	case "cancel":
+	case harness.TurnResourceCancel:
 		if r.Method != http.MethodPost {
 			writeSafeError(w, http.StatusMethodNotAllowed, "method not allowed")
 			return
 		}
 		s.handleCancel(w, r, turn)
-	case "output":
+	case harness.TurnResourceOutput:
 		if r.Method != http.MethodGet {
 			writeSafeError(w, http.StatusMethodNotAllowed, "method not allowed")
 			return
@@ -296,49 +910,136 @@ func (s *Server) handleTurn(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-func (s *Server) handleCancel(w http.ResponseWriter, r *http.Request, turn *turnState) {
-	var request harness.CancelTurnRequest
+func (s *Server) handleCancel(w http.ResponseWriter, r *http.Request, turn *turnState) {
+	var request harness.CancelTurnRequest
+	if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+		writeSafeError(w, http.StatusBadRequest, "invalid JSON request")
+		return
+	}
+	if err := request.Validate(); err != nil {
+		writeSafeError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	if err := turn.matchesCancel(request); err != nil {
+		writeSafeError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	turn.cancel()
+	harness.WriteJSON(w, http.StatusAccepted, harness.CancelTurnResponse{
+		Version:          harness.ProtocolVersion,
+		Accepted:         true,
+		RuntimeSessionID: request.RuntimeSessionID,
+		TurnID:           request.TurnID,
+		CorrelationID:    request.CorrelationID,
+		Message:          "cancel accepted",
+	})
+}
+
+func (s *Server) handleOutput(w http.ResponseWriter, r *http.Request, turn *turnState) {
+	if ref := strings.TrimSpace(r.URL.Query().Get("ref")); ref != localOutputRef {
+		writeSafeError(w, http.StatusNotFound, "output not found")
+		return
+	}
+	data, ok, err := turn.output()
+	if err != nil {
+		writeSafeError(w, http.StatusInternalServerError, "failed to read turn output")
+		return
+	}
+	if !ok {
+		writeSafeError(w, http.StatusNotFound, "output not found")
+		return
+	}
+	w.Header().Set("Content-Type", "application/octet-stream")
+	if _, err := w.Write(data); err == nil {
+		turn.markOutputFetched()
+	}
+}
+
+func (s *Server) handleDurableOutput(w http.ResponseWriter, r *http.Request, turnID harness.HarnessTurnID) {
+	ref := strings.TrimSpace(r.URL.Query().Get("ref"))
+	if ref != localOutputRef {
+		writeSafeError(w, http.StatusNotFound, "output not found")
+		return
+	}
+	data, err := s.ledger.GetTurnOutput(r.Context(), string(turnID), ref)
+	if err != nil {
+		if errors.Is(err, ledger.ErrNotFound) {
+			writeSafeError(w, http.StatusNotFound, "output not found")
+			return
+		}
+		writeSafeError(w, http.StatusServiceUnavailable, "failed to read durable turn output")
+		return
+	}
+	w.Header().Set("Content-Type", "application/octet-stream")
+	_, _ = w.Write(data)
+}
+
+func (s *Server) handleOutputAcknowledgement(w http.ResponseWriter, r *http.Request, turnID harness.HarnessTurnID) {
+	var request harness.TurnOutputAcknowledgementRequest
 	if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
 		writeSafeError(w, http.StatusBadRequest, "invalid JSON request")
 		return
 	}
-	if err := request.Validate(); err != nil {
+	if err := request.ValidateFor(turnID); err != nil {
 		writeSafeError(w, http.StatusBadRequest, err.Error())
 		return
 	}
-	if err := turn.matchesCancel(request); err != nil {
-		writeSafeError(w, http.StatusBadRequest, err.Error())
+	if err := s.ledger.AcknowledgeTurnOutput(
+		r.Context(), string(turnID), request.OutputRef, request.TerminalReceiptDigest,
+	); err != nil {
+		switch {
+		case errors.Is(err, ledger.ErrNotFound):
+			writeSafeError(w, http.StatusNotFound, "output not found")
+		case errors.Is(err, ledger.ErrOutputAcknowledgementMismatch):
+			writeSafeError(w, http.StatusConflict, "output acknowledgement does not match durable receipt")
+		default:
+			writeSafeError(w, http.StatusServiceUnavailable, "failed to acknowledge durable turn output")
+		}
 		return
 	}
-	turn.cancel()
-	harness.WriteJSON(w, http.StatusAccepted, harness.CancelTurnResponse{
-		Version:          harness.ProtocolVersion,
-		Accepted:         true,
-		RuntimeSessionID: request.RuntimeSessionID,
-		TurnID:           request.TurnID,
-		CorrelationID:    request.CorrelationID,
-		Message:          "cancel accepted",
+	harness.WriteJSON(w, http.StatusOK, harness.TurnOutputAcknowledgementResponse{
+		Version:               harness.ProtocolVersion,
+		TurnID:                request.TurnID,
+		OutputRef:             request.OutputRef,
+		TerminalReceiptDigest: request.TerminalReceiptDigest,
+		Acknowledged:          true,
 	})
 }
 
-func (s *Server) handleOutput(w http.ResponseWriter, r *http.Request, turn *turnState) {
-	if ref := strings.TrimSpace(r.URL.Query().Get("ref")); ref != localOutputRef {
-		writeSafeError(w, http.StatusNotFound, "output not found")
+func (s *Server) handleSettlementAcknowledgement(w http.ResponseWriter, r *http.Request, turnID harness.HarnessTurnID) {
+	var request harness.TurnSettlementAcknowledgementRequest
+	if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+		writeSafeError(w, http.StatusBadRequest, "invalid JSON request")
 		return
 	}
-	data, ok, err := turn.output()
-	if err != nil {
-		writeSafeError(w, http.StatusInternalServerError, "failed to read turn output")
+	if err := request.ValidateFor(turnID); err != nil {
+		writeSafeError(w, http.StatusBadRequest, err.Error())
 		return
 	}
-	if !ok {
-		writeSafeError(w, http.StatusNotFound, "output not found")
+	if err := s.ledger.AcknowledgeTurnSettlement(
+		r.Context(), string(turnID), request.RequestDigest, request.TerminalReceiptDigest,
+	); err != nil {
+		switch {
+		case errors.Is(err, ledger.ErrNotFound):
+			writeSafeError(w, http.StatusNotFound, "turn not found")
+		case errors.Is(err, ledger.ErrSettlementAcknowledgementMismatch):
+			writeSafeError(w, http.StatusConflict, "settlement acknowledgement does not match durable evidence")
+		default:
+			writeSafeError(w, http.StatusServiceUnavailable, "failed to acknowledge durable turn settlement")
+		}
 		return
 	}
-	w.Header().Set("Content-Type", "application/octet-stream")
-	if _, err := w.Write(data); err == nil {
-		turn.markOutputFetched()
+	if err := s.reclaimSettledTurns(r.Context()); err != nil {
+		writeSafeError(w, http.StatusServiceUnavailable, "failed to reclaim settled wrapper turns")
+		return
 	}
+	harness.WriteJSON(w, http.StatusOK, harness.TurnSettlementAcknowledgementResponse{
+		Version:               harness.ProtocolVersion,
+		TurnID:                request.TurnID,
+		RequestDigest:         request.RequestDigest,
+		TerminalReceiptDigest: request.TerminalReceiptDigest,
+		Acknowledged:          true,
+	})
 }
 
 func (s *Server) handleEvents(w http.ResponseWriter, r *http.Request, turn *turnState) {
@@ -415,11 +1116,21 @@ func (s *Server) runTurn(turn *turnState) { //nolint:gocyclo
 		turn.appendFrame(s.failedFrame(turn, "workspace_prepare_failed", err.Error(), false))
 		return
 	}
-	defer preparedWorkspace.cleanup()
+	cleanupWorkspace := true
+	defer func() {
+		if cleanupWorkspace {
+			preparedWorkspace.cleanup()
+		}
+	}()
 	turnCtx.WorkDir = preparedWorkspace.workDir
 	turnCtx.RootDir = preparedWorkspace.rootDir
 	turnArtifactsDir := turnArtifactDir(preparedWorkspace)
-	defer ClearTurnArtifacts(turnArtifactsDir)
+	cleanupArtifacts := true
+	defer func() {
+		if cleanupArtifacts {
+			ClearTurnArtifacts(turnArtifactsDir)
+		}
+	}()
 	if err := prepareTurnArtifactsDirForWrapper(turnArtifactsDir); err != nil {
 		turn.appendFrame(s.failedFrame(turn, "workspace_prepare_failed", err.Error(), false))
 		return
@@ -476,11 +1187,12 @@ func (s *Server) runTurn(turn *turnState) { //nolint:gocyclo
 			workerenv.GitUsername,
 		)
 	}
-	turnCtx, closeRuntimeAuthProxy, err := protectRuntimeAuthTurn(turnCtx)
+	turnCtx, runtimeAuthProxyToken, closeRuntimeAuthProxy, err := protectRuntimeAuthTurn(turnCtx)
 	if err != nil {
 		turn.appendFrame(s.failedFrame(turn, "runtime_auth_proxy_failed", err.Error(), false))
 		return
 	}
+	turn.addExactRedactionValue(runtimeAuthProxyToken)
 	defer closeRuntimeAuthProxy()
 	spec, err := s.adapter.BuildCommand(ctx, turnCtx)
 	if err != nil {
@@ -519,6 +1231,9 @@ func (s *Server) runTurn(turn *turnState) { //nolint:gocyclo
 		"command": path.Base(spec.Path),
 	}))
 	run, runErr := s.runner.Run(ctx, spec)
+	if s.latchChildCredentialProcessCleanupFailure(runErr) {
+		return
+	}
 	if run.FullStdoutTruncated && strings.TrimSpace(spec.ResultFile) == "" {
 		turn.appendFrame(s.failedFrame(turn, "result_too_large", "runtime stdout exceeded harness storage limit", false))
 		return
@@ -550,9 +1265,19 @@ func (s *Server) runTurn(turn *turnState) { //nolint:gocyclo
 		if preparedWorkspace.rootDir != "" {
 			finalizeWorkDir = preparedWorkspace.rootDir
 		}
-		if !envEntryIsTrue(turnCtx.Env, workerenv.ResultStdout) && ShouldFinalizeWorkDir(finalizeWorkDir) {
+		shouldFinalize := false
+		if !envEntryIsTrue(turnCtx.Env, workerenv.ResultStdout) {
+			var shouldFinalizeErr error
+			shouldFinalize, shouldFinalizeErr = ShouldFinalizeWorkDir(ctx, finalizeWorkDir)
+			if shouldFinalizeErr != nil {
+				turn.appendFrame(s.runtimeLogTextFrame(turn, "result-finalize", shouldFinalizeErr.Error()))
+			}
+		}
+		if shouldFinalize {
 			restoreTurnEnv := setTemporaryEnvEntries(turnCtx.Env)
-			if finalized, finalizeErr := FinalizeTurnResult(finalizeWorkDir, partial); finalizeErr == nil {
+			if finalized, finalizeErr := FinalizeTurnResult(ctx, finalizeWorkDir, partial); finalizeErr != nil {
+				turn.appendFrame(s.runtimeLogTextFrame(turn, "result-finalize", finalizeErr.Error()))
+			} else {
 				partial = string(finalized)
 				finalizedWorkDir = finalizeWorkDir
 			}
@@ -566,7 +1291,7 @@ func (s *Server) runTurn(turn *turnState) { //nolint:gocyclo
 			))
 		}
 		if finalizedWorkDir != "" {
-			if cleanErr := CleanFinalizedWorkDir(finalizedWorkDir); cleanErr != nil {
+			if cleanErr := CleanFinalizedWorkDir(ctx, finalizedWorkDir); cleanErr != nil {
 				turn.appendFrame(s.runtimeLogTextFrame(turn, "workdir-cleanup", cleanErr.Error()))
 			}
 		}
@@ -594,6 +1319,9 @@ func (s *Server) runTurn(turn *turnState) { //nolint:gocyclo
 			s.securityArtifactFollowUp(turn, turnCtx),
 			turnArtifactsDir,
 		); artifactErr != nil {
+			if errors.Is(artifactErr, errChildCredentialProcessCleanupUnproven) {
+				return
+			}
 			turn.appendFrame(s.failedFrame(turn, "required_security_artifacts_missing", artifactErr.Error(), false))
 			return
 		} else {
@@ -604,8 +1332,17 @@ func (s *Server) runTurn(turn *turnState) { //nolint:gocyclo
 		if preparedWorkspace.rootDir != "" {
 			finalizeWorkDir = preparedWorkspace.rootDir
 		}
-		if !envEntryIsTrue(turnCtx.Env, workerenv.ResultStdout) && ShouldFinalizeWorkDir(finalizeWorkDir) {
-			finalized, finalizeErr := FinalizeTurnResult(finalizeWorkDir, parsed.Result)
+		shouldFinalize := false
+		if !envEntryIsTrue(turnCtx.Env, workerenv.ResultStdout) {
+			var shouldFinalizeErr error
+			shouldFinalize, shouldFinalizeErr = ShouldFinalizeWorkDir(ctx, finalizeWorkDir)
+			if shouldFinalizeErr != nil {
+				turn.appendFrame(s.failedFrame(turn, "result_finalize_failed", shouldFinalizeErr.Error(), false))
+				return
+			}
+		}
+		if shouldFinalize {
+			finalized, finalizeErr := FinalizeTurnResult(ctx, finalizeWorkDir, parsed.Result)
 			if finalizeErr != nil {
 				turn.appendFrame(s.failedFrame(turn, "result_finalize_failed", finalizeErr.Error(), false))
 				return
@@ -623,14 +1360,29 @@ func (s *Server) runTurn(turn *turnState) { //nolint:gocyclo
 			return
 		}
 		if artifactErr := UploadTurnArtifacts(turnCtx, turnArtifactsDir); artifactErr != nil {
-			turn.appendFrame(s.runtimeLogTextFrame(
-				turn,
-				"artifact-upload",
-				artifactErr.Error(),
-			))
+			retainedArtifactsDir, retainErr := retainFailedTurnArtifacts(turnArtifactsDir)
+			if retainErr != nil {
+				// If the isolated move fails, retain the original workspace rather
+				// than deleting the only copy of the failed-upload evidence.
+				cleanupArtifacts = false
+				cleanupWorkspace = false
+				retainedArtifactsDir = turnArtifactsDir
+			}
+			message := fmt.Sprintf(
+				"artifact upload failed: %v; artifacts retained at %s",
+				artifactErr,
+				retainedArtifactsDir,
+			)
+			if retainErr != nil {
+				message = fmt.Sprintf("%s (isolated retention failed: %v)", message, retainErr)
+			}
+			failed := s.failedFrame(turn, "artifact_upload_failed", message, true)
+			failed.Metadata["retainedArtifactsPath"] = retainedArtifactsDir
+			turn.appendFrame(failed)
+			return
 		}
 		if finalizedWorkDir != "" {
-			if cleanErr := CleanFinalizedWorkDir(finalizedWorkDir); cleanErr != nil {
+			if cleanErr := CleanFinalizedWorkDir(ctx, finalizedWorkDir); cleanErr != nil {
 				turn.appendFrame(s.runtimeLogTextFrame(
 					turn,
 					"workdir-cleanup",
@@ -710,6 +1462,9 @@ func (s *Server) securityArtifactFollowUp(turn *turnState, base TurnContext) com
 			"command": path.Base(spec.Path),
 		}))
 		run, runErr := s.runner.Run(ctx, spec)
+		if s.latchChildCredentialProcessCleanupFailure(runErr) {
+			return "", runErr
+		}
 		if strings.TrimSpace(run.Stdout) != "" {
 			turn.appendFrame(s.outputFrame(turn, "stdout", run.Stdout))
 		}
@@ -737,6 +1492,97 @@ func turnArtifactDir(workspace preparedWorkspace) string {
 	return filepath.Join(os.TempDir(), "orka-runtime-artifacts")
 }
 
+func retainFailedTurnArtifacts(artifactDir string) (string, error) {
+	return retainFailedTurnArtifactsIn(artifactDir, os.TempDir())
+}
+
+func retainFailedTurnArtifactsIn(artifactDir, retentionParent string) (string, error) {
+	failedArtifactRetentionMu.Lock()
+	defer failedArtifactRetentionMu.Unlock()
+
+	artifactDir = strings.TrimSpace(artifactDir)
+	if artifactDir == "" {
+		return "", errors.New("artifact directory is empty")
+	}
+	artifactDir = filepath.Clean(artifactDir)
+	info, err := os.Lstat(artifactDir)
+	if err != nil {
+		return "", fmt.Errorf("inspect artifact directory: %w", err)
+	}
+	if info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
+		return "", fmt.Errorf("artifact path is not a regular directory")
+	}
+	retentionParent = strings.TrimSpace(retentionParent)
+	if retentionParent == "" {
+		return "", errors.New("artifact retention parent is empty")
+	}
+	retentionParent = filepath.Clean(retentionParent)
+	// Prune before moving the current artifacts so a successful retention never
+	// takes the cross-turn on-disk set above the configured bound. Scanning the
+	// parent also reclaims directories left by an earlier wrapper process.
+	if err := pruneFailedTurnArtifactRetentionsLocked(
+		retentionParent,
+		maxFailedArtifactRetentions-1,
+	); err != nil {
+		return "", err
+	}
+	retentionRoot, err := os.MkdirTemp(retentionParent, failedArtifactRetentionPrefix+"*")
+	if err != nil {
+		return "", fmt.Errorf("create artifact retention directory: %w", err)
+	}
+	retainedArtifactsDir := filepath.Join(retentionRoot, "artifacts")
+	if err := os.Rename(artifactDir, retainedArtifactsDir); err != nil {
+		_ = os.Remove(retentionRoot)
+		return "", fmt.Errorf("move artifacts to retention directory: %w", err)
+	}
+	return retainedArtifactsDir, nil
+}
+
+func pruneFailedTurnArtifactRetentionsLocked(retentionParent string, keep int) error {
+	entries, err := os.ReadDir(retentionParent)
+	if err != nil {
+		return fmt.Errorf("list artifact retention directories: %w", err)
+	}
+	type retainedEntry struct {
+		name    string
+		path    string
+		modTime time.Time
+	}
+	retained := make([]retainedEntry, 0, len(entries))
+	for _, entry := range entries {
+		if !strings.HasPrefix(entry.Name(), failedArtifactRetentionPrefix) {
+			continue
+		}
+		entryPath := filepath.Join(retentionParent, entry.Name())
+		info, infoErr := os.Lstat(entryPath)
+		if errors.Is(infoErr, os.ErrNotExist) {
+			continue
+		}
+		if infoErr != nil {
+			return fmt.Errorf("inspect artifact retention directory: %w", infoErr)
+		}
+		if info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
+			continue
+		}
+		retained = append(retained, retainedEntry{
+			name: entry.Name(), path: entryPath, modTime: info.ModTime(),
+		})
+	}
+	sort.Slice(retained, func(i, j int) bool {
+		if retained[i].modTime.Equal(retained[j].modTime) {
+			return retained[i].name < retained[j].name
+		}
+		return retained[i].modTime.Before(retained[j].modTime)
+	})
+	removeCount := len(retained) - max(keep, 0)
+	for i := range removeCount {
+		if err := os.RemoveAll(retained[i].path); err != nil {
+			return fmt.Errorf("remove old artifact retention directory: %w", err)
+		}
+	}
+	return nil
+}
+
 // prepareTurnArtifactsDirForWrapper creates the per-turn artifact directory for
 // root-side workspace prep. Child ownership is applied later after the workspace
 // tree has been chowned for the child.
@@ -795,7 +1641,7 @@ func (s *Server) frame(turn *turnState, typ harness.FrameType, summary string, t
 		frame.Failed = value
 		frame.Severity = events.ExecutionEventSeverityError
 	}
-	return frame
+	return s.sanitizeTerminalFrame(frame)
 }
 
 func (s *Server) normalizeFrame(turn *turnState, frame harness.HarnessEventFrame) harness.HarnessEventFrame {
@@ -853,6 +1699,34 @@ func (s *Server) normalizeFrame(turn *turnState, frame harness.HarnessEventFrame
 			frame.Content = nil
 		}
 	}
+	frame = s.sanitizeTerminalFrame(frame)
+	return redactHarnessFrameExactValues(frame, turn.exactRedactionValuesSnapshot())
+}
+
+func (s *Server) sanitizeTerminalFrame(frame harness.HarnessEventFrame) harness.HarnessEventFrame {
+	authValue, authErr := s.currentAuthValue()
+	sanitize := func(value string, maxBytes int) string {
+		if authErr != nil {
+			return ""
+		}
+		value = events.RedactExecutionEventText(value)
+		value = harness.RedactExactBearerValue(value, authValue)
+		return truncateBytes(value, maxBytes)
+	}
+	if frame.Completed != nil {
+		completed := *frame.Completed
+		completed.Result = sanitize(completed.Result, maxTerminalResultBytes)
+		completed.OutputRef = sanitize(completed.OutputRef, 4096)
+		frame.Completed = &completed
+	}
+	if frame.Failed != nil {
+		failed := *frame.Failed
+		failed.Reason = sanitize(failed.Reason, 64<<10)
+		failed.Message = sanitize(failed.Message, 64<<10)
+		failed.Result = sanitize(failed.Result, 64<<10)
+		failed.OutputRef = sanitize(failed.OutputRef, 4096)
+		frame.Failed = &failed
+	}
 	return frame
 }
 
@@ -907,8 +1781,12 @@ func (s *Server) completedFrame(turn *turnState, result TurnResult) (harness.Har
 		RetainSession: false,
 	})
 	if len(result.Metadata) > 0 {
+		exactValues := turn.exactRedactionValuesSnapshot()
 		for k, v := range result.Metadata {
-			frame.Metadata[k] = events.RedactExecutionEventText(v)
+			frame.Metadata[redactExactValues(k, exactValues)] = redactExactValues(
+				events.RedactExecutionEventText(v),
+				exactValues,
+			)
 		}
 	}
 	return frame, nil
@@ -929,7 +1807,12 @@ func (s *Server) failedFrameWithResult(
 	result string,
 	retryable bool,
 ) harness.HarnessEventFrame {
-	frame := s.failedFrame(turn, reason, message, retryable)
+	frame := s.failedFrame(
+		turn,
+		reason,
+		redactExactValues(message, turn.exactRedactionValuesSnapshot()),
+		retryable,
+	)
 	if strings.TrimSpace(result) == "" || frame.Failed == nil {
 		return frame
 	}
@@ -940,7 +1823,7 @@ func (s *Server) failedFrameWithResult(
 	}
 	frame.Failed.Result = redactAndTruncateBytes(result, 64<<10)
 	frame.Failed.OutputRef = events.RedactExecutionEventText(outputRef)
-	return frame
+	return s.sanitizeTerminalFrame(frame)
 }
 
 func redactAndTruncate(value string, maxChars int) string {
@@ -1048,23 +1931,109 @@ type turnState struct {
 	cancel   context.CancelFunc
 	now      func() time.Time
 
-	mu              sync.Mutex
-	frames          []harness.HarnessEventFrame
-	terminal        bool
-	closed          bool
-	resultPath      string
-	resultRead      bool
-	resultKeepUntil time.Time
+	mu                   sync.Mutex
+	frames               []harness.HarnessEventFrame
+	terminal             bool
+	closed               bool
+	resultPath           string
+	resultRead           bool
+	resultKeepUntil      time.Time
+	exactRedactionValues []string
 }
 
 func newTurnState(request harness.StartTurnRequest, now func() time.Time) *turnState {
 	ctx, cancel := context.WithCancel(context.Background())
 	return &turnState{
-		request:  request,
-		identity: identityFromStartTurnRequest(request),
-		ctx:      ctx,
-		cancel:   cancel,
-		now:      now,
+		request:              request,
+		identity:             identityFromStartTurnRequest(request),
+		ctx:                  ctx,
+		cancel:               cancel,
+		now:                  now,
+		exactRedactionValues: exactTurnInputValues(request.Input.Env),
+	}
+}
+
+func exactTurnInputValues(env []harness.TurnEnvVar) []string {
+	seen := make(map[string]struct{}, len(env))
+	values := make([]string, 0, len(env))
+	for _, item := range env {
+		if item.Value == "" || (isKnownNonCredentialTurnEnv(item.Name) && !hasCredentialURLUserinfo(item.Value)) {
+			continue
+		}
+		if _, ok := seen[item.Value]; ok {
+			continue
+		}
+		seen[item.Value] = struct{}{}
+		values = append(values, item.Value)
+	}
+	sort.Slice(values, func(i, j int) bool { return len(values[i]) > len(values[j]) })
+	return values
+}
+
+func exactConfiguredEnvValues(env []string) []string {
+	configured := make([]harness.TurnEnvVar, 0, len(env))
+	for _, entry := range env {
+		name, value, ok := strings.Cut(entry, "=")
+		if !ok || (!isCredentialTurnEnvName(name) && !hasCredentialURLUserinfo(value)) {
+			continue
+		}
+		configured = append(configured, harness.TurnEnvVar{Name: name, Value: value})
+	}
+	return exactTurnInputValues(configured)
+}
+
+func isCredentialTurnEnvName(name string) bool {
+	normalized := strings.NewReplacer("-", "_", ".", "_").Replace(strings.ToUpper(strings.TrimSpace(name)))
+	padded := "_" + normalized + "_"
+	for _, marker := range []string{
+		"_API_KEY_",
+		"_APIKEY_",
+		"_ACCESS_KEY_",
+		"_PAT_",
+		"_BASIC_AUTH_",
+		"_TOKEN_",
+		"_SECRET_",
+		"_PASSWORD_",
+		"_PASSWD_",
+		"_CREDENTIAL_",
+		"_PRIVATE_KEY_",
+		"_DSN_",
+		"_CONNECTION_STRING_",
+		"_CONNECTIONSTRING_",
+		"_CONN_STRING_",
+	} {
+		if strings.Contains(padded, marker) {
+			return true
+		}
+	}
+	return false
+}
+
+func hasCredentialURLUserinfo(value string) bool {
+	parsed, err := url.Parse(strings.TrimSpace(value))
+	if err != nil || parsed.Scheme == "" || parsed.Host == "" || parsed.User == nil {
+		return false
+	}
+	if parsed.User.Username() != "" {
+		return true
+	}
+	_, hasPassword := parsed.User.Password()
+	return hasPassword
+}
+
+func isKnownNonCredentialTurnEnv(name string) bool {
+	switch strings.TrimSpace(name) {
+	case workerenv.OpenAIBaseURL,
+		workerenv.AnthropicBaseURL,
+		"CLAUDE_CODE_USE_FOUNDRY",
+		workerenv.AnthropicFoundryBaseURL,
+		"ANTHROPIC_FOUNDRY_RESOURCE",
+		"ANTHROPIC_DEFAULT_SONNET_MODEL",
+		"ANTHROPIC_DEFAULT_HAIKU_MODEL",
+		"ANTHROPIC_DEFAULT_OPUS_MODEL":
+		return true
+	default:
+		return false
 	}
 }
 
@@ -1105,6 +2074,7 @@ func (t *turnState) materializeContext(runtimeName string, cfg Config) TurnConte
 }
 
 func (t *turnState) storeOutput(result string) (string, error) {
+	result = redactExactValues(result, t.exactRedactionValuesSnapshot())
 	file, err := os.CreateTemp("", "harness-turn-output-*")
 	if err != nil {
 		return "", fmt.Errorf("create turn output file: %w", err)
@@ -1184,6 +2154,7 @@ func (t *turnState) cleanupOutput() {
 func (t *turnState) appendFrame(frame harness.HarnessEventFrame) {
 	t.mu.Lock()
 	defer t.mu.Unlock()
+	frame = redactHarnessFrameOutputValues(frame, t.exactRedactionValues)
 	if frame.Seq <= 0 {
 		frame.Seq = int64(len(t.frames) + 1)
 	}
@@ -1197,6 +2168,204 @@ func (t *turnState) appendFrame(frame harness.HarnessEventFrame) {
 	}
 }
 
+func (t *turnState) exactRedactionValuesSnapshot() []string {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	return append([]string(nil), t.exactRedactionValues...)
+}
+
+func (t *turnState) addExactRedactionValue(value string) {
+	if value == "" {
+		return
+	}
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	if slices.Contains(t.exactRedactionValues, value) {
+		return
+	}
+	t.exactRedactionValues = append(t.exactRedactionValues, value)
+	sort.Slice(t.exactRedactionValues, func(i, j int) bool {
+		return len(t.exactRedactionValues[i]) > len(t.exactRedactionValues[j])
+	})
+}
+
+func (t *turnState) clearExactRedactionValues() {
+	t.mu.Lock()
+	for i := range t.exactRedactionValues {
+		t.exactRedactionValues[i] = ""
+	}
+	t.exactRedactionValues = nil
+	t.mu.Unlock()
+}
+
+func redactExactValues(value string, exactValues []string) string {
+	for _, exact := range exactValues {
+		value = harness.RedactExactBearerValue(value, exact)
+	}
+	return value
+}
+
+func redactHarnessFrameExactValues(
+	frame harness.HarnessEventFrame,
+	exactValues []string,
+) harness.HarnessEventFrame {
+	if len(exactValues) == 0 {
+		return frame
+	}
+	frame = redactHarnessFrameOutputValues(frame, exactValues)
+	frame.Summary = redactExactValues(frame.Summary, exactValues)
+	frame.ToolName = redactExactValues(frame.ToolName, exactValues)
+	frame.ToolCallID = redactExactValues(frame.ToolCallID, exactValues)
+	frame.ApprovalID = redactExactValues(frame.ApprovalID, exactValues)
+	if len(frame.Metadata) > 0 {
+		metadata := make(map[string]string, len(frame.Metadata))
+		for key, value := range frame.Metadata {
+			metadata[redactExactValues(key, exactValues)] = redactExactValues(value, exactValues)
+		}
+		frame.Metadata = metadata
+	}
+	if frame.Completed != nil {
+		completed := *frame.Completed
+		completed.OutputRef = redactExactValues(completed.OutputRef, exactValues)
+		frame.Completed = &completed
+	}
+	if frame.Failed != nil {
+		failed := *frame.Failed
+		failed.Reason = redactExactValues(failed.Reason, exactValues)
+		failed.Message = redactExactValues(failed.Message, exactValues)
+		failed.OutputRef = redactExactValues(failed.OutputRef, exactValues)
+		frame.Failed = &failed
+	}
+	if frame.Error != nil {
+		errorInfo := *frame.Error
+		errorInfo.Code = redactExactValues(errorInfo.Code, exactValues)
+		errorInfo.Message = redactExactValues(errorInfo.Message, exactValues)
+		frame.Error = &errorInfo
+	}
+	return frame
+}
+
+// redactHarnessFrameOutputValues scrubs unambiguously child-controlled text and
+// result bodies while preserving wrapper-owned protocol text and structural
+// fields. Eventing-adapter frames pass through the stricter helper above before
+// this sink, because all of their fields are runtime-controlled.
+func redactHarnessFrameOutputValues(
+	frame harness.HarnessEventFrame,
+	exactValues []string,
+) harness.HarnessEventFrame {
+	if len(exactValues) == 0 {
+		return frame
+	}
+	frame.ContentText = redactExactValues(frame.ContentText, exactValues)
+	frame.Content = redactExactJSON(frame.Content, exactValues)
+	if frame.Completed != nil {
+		completed := *frame.Completed
+		completed.Result = redactExactValues(completed.Result, exactValues)
+		completed.Data = redactExactData(completed.Data, exactValues)
+		completed.Artifacts = redactExactArtifacts(completed.Artifacts, exactValues)
+		frame.Completed = &completed
+	}
+	if frame.Failed != nil {
+		failed := *frame.Failed
+		failed.Result = redactExactValues(failed.Result, exactValues)
+		failed.Data = redactExactData(failed.Data, exactValues)
+		failed.Artifacts = redactExactArtifacts(failed.Artifacts, exactValues)
+		frame.Failed = &failed
+	}
+	return frame
+}
+
+func redactExactJSON(value json.RawMessage, exactValues []string) json.RawMessage {
+	if len(value) == 0 {
+		return nil
+	}
+	var decoded any
+	decoder := json.NewDecoder(strings.NewReader(string(value)))
+	decoder.UseNumber()
+	if err := decoder.Decode(&decoded); err != nil {
+		return nil
+	}
+	var extra any
+	if err := decoder.Decode(&extra); err != io.EOF {
+		return nil
+	}
+	redacted := redactExactJSONValue(decoded, exactValues)
+	encoded, err := json.Marshal(redacted)
+	if err != nil {
+		return nil
+	}
+	return encoded
+}
+
+func redactExactJSONValue(value any, exactValues []string) any {
+	switch typed := value.(type) {
+	case string:
+		return redactExactValues(typed, exactValues)
+	case []any:
+		for i := range typed {
+			typed[i] = redactExactJSONValue(typed[i], exactValues)
+		}
+		return typed
+	case map[string]any:
+		redacted := make(map[string]any, len(typed))
+		for key, item := range typed {
+			redacted[redactExactValues(key, exactValues)] = redactExactJSONValue(item, exactValues)
+		}
+		return redacted
+	case json.Number:
+		text := typed.String()
+		if redacted := redactExactValues(text, exactValues); redacted != text {
+			return redacted
+		}
+		return typed
+	case bool:
+		text := strconv.FormatBool(typed)
+		if redacted := redactExactValues(text, exactValues); redacted != text {
+			return redacted
+		}
+		return typed
+	case nil:
+		if redacted := redactExactValues("null", exactValues); redacted != "null" {
+			return redacted
+		}
+		return nil
+	default:
+		return value
+	}
+}
+
+func redactExactData(value map[string]any, exactValues []string) map[string]any {
+	if len(value) == 0 {
+		return nil
+	}
+	encoded, err := json.Marshal(value)
+	if err != nil {
+		return nil
+	}
+	redacted := redactExactJSON(encoded, exactValues)
+	var out map[string]any
+	if len(redacted) == 0 || json.Unmarshal(redacted, &out) != nil {
+		return nil
+	}
+	return out
+}
+
+func redactExactArtifacts(
+	artifacts []harness.ArtifactRef,
+	exactValues []string,
+) []harness.ArtifactRef {
+	if len(artifacts) == 0 {
+		return nil
+	}
+	out := append([]harness.ArtifactRef(nil), artifacts...)
+	for i := range out {
+		out[i].Filename = redactExactValues(out[i].Filename, exactValues)
+		out[i].ContentType = redactExactValues(out[i].ContentType, exactValues)
+		out[i].Description = redactExactValues(out[i].Description, exactValues)
+	}
+	return out
+}
+
 func (t *turnState) framesFrom(seq int64) ([]harness.HarnessEventFrame, bool) {
 	t.mu.Lock()
 	defer t.mu.Unlock()
@@ -1212,6 +2381,10 @@ func (t *turnState) framesFrom(seq int64) ([]harness.HarnessEventFrame, bool) {
 func (t *turnState) close() {
 	t.mu.Lock()
 	t.closed = true
+	for i := range t.exactRedactionValues {
+		t.exactRedactionValues[i] = ""
+	}
+	t.exactRedactionValues = nil
 	t.mu.Unlock()
 }
 
@@ -1221,6 +2394,68 @@ func (t *turnState) hasTerminal() bool {
 	return t.terminal
 }
 
+func (t *turnState) terminalFrame() (harness.HarnessEventFrame, bool) {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	for i := len(t.frames) - 1; i >= 0; i-- {
+		switch t.frames[i].Type {
+		case harness.FrameTurnCompleted, harness.FrameTurnFailed, harness.FrameTurnCancelled:
+			return t.frames[i], true
+		}
+	}
+	return harness.HarnessEventFrame{}, false
+}
+
+func (t *turnState) terminalOutputRef() string {
+	frame, found := t.terminalFrame()
+	if !found {
+		return ""
+	}
+	if frame.Completed != nil {
+		return strings.TrimSpace(frame.Completed.OutputRef)
+	}
+	if frame.Failed != nil {
+		return strings.TrimSpace(frame.Failed.OutputRef)
+	}
+	return ""
+}
+
+func (s *Server) durableTerminalReceipt(turn *turnState) ([]byte, bool) {
+	frame, found := turn.terminalFrame()
+	receipt := harness.DurableTurnTerminalReceipt{
+		Version: harness.ProtocolVersion, RuntimeSessionID: turn.runtimeSessionID(),
+		TurnID: turn.id(), CorrelationID: turn.correlationID(),
+	}
+	outcomeUnknown := true
+	if found {
+		receipt.Seq = frame.Seq
+		if canonical, err := harness.DurableTurnTerminalReceiptFromFrame(frame); err == nil {
+			if encoded, err := harness.MarshalDurableTurnTerminalReceipt(canonical); err == nil {
+				return encoded, false
+			}
+		}
+	}
+	reason := "turn-closed-without-terminal-frame"
+	if found {
+		reason = "invalid-terminal-frame"
+	}
+	receipt.Kind = harness.DurableTurnTerminalOutcomeUnknown
+	receipt.OutcomeUnknown = &harness.DurableTurnOutcomeUnknownReceipt{Reason: reason}
+	encoded, err := harness.MarshalDurableTurnTerminalReceipt(receipt)
+	if err == nil {
+		return encoded, outcomeUnknown
+	}
+	// StartTurn validation guarantees the receipt identities. Keep the fallback
+	// fail-closed and free of runtime-controlled terminal content.
+	receipt.Kind = harness.DurableTurnTerminalOutcomeUnknown
+	receipt.Completed = nil
+	receipt.Failed = nil
+	receipt.Cancelled = nil
+	receipt.OutcomeUnknown = &harness.DurableTurnOutcomeUnknownReceipt{Reason: "terminal-receipt-encoding-failed"}
+	encoded, _ = harness.MarshalDurableTurnTerminalReceipt(receipt)
+	return encoded, true
+}
+
 func (t *turnState) matchesCancel(request harness.CancelTurnRequest) error {
 	if request.RuntimeSessionID != t.identity.runtimeSessionID {
 		return fmt.Errorf("cancel runtime session %q does not match turn runtime session", request.RuntimeSessionID)
diff --git a/workers/harness/cliwrapper/server_test.go b/workers/harness/cliwrapper/server_test.go
index ac02658f5..5238f6430 100644
--- a/workers/harness/cliwrapper/server_test.go
+++ b/workers/harness/cliwrapper/server_test.go
@@ -4,16 +4,22 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"os"
 	"path/filepath"
+	"slices"
+	"strconv"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
 	"github.com/orka-agents/orka/internal/harness"
+	"github.com/orka-agents/orka/internal/harness/ledger"
 	"github.com/orka-agents/orka/internal/tracing"
 	"github.com/orka-agents/orka/internal/tracing/testutil"
 	"github.com/orka-agents/orka/internal/workerenv"
@@ -21,6 +27,12 @@ import (
 
 const wrapperTestShellPath = "/bin/sh"
 
+type commandRunnerFunc func(context.Context, *CommandSpec) (CommandResult, error)
+
+func (run commandRunnerFunc) Run(ctx context.Context, spec *CommandSpec) (CommandResult, error) {
+	return run(ctx, spec)
+}
+
 func TestServerHealthCapabilitiesAndAfterSeq(t *testing.T) {
 	baseURL, cleanup := startWrapperServer(t, NewFakeAdapter(FakeBehaviorSuccess))
 	defer cleanup()
@@ -51,9 +63,685 @@ func TestServerHealthCapabilitiesAndAfterSeq(t *testing.T) {
 	}
 }
 
+func TestServerReceiptPersistenceFailureRetainsTurnAndClosesReadiness(t *testing.T) {
+	cfg := DefaultConfig()
+	cfg.AllowUnauthenticated = true
+	cfg.AdmissionLedgerPath = filepath.Join(t.TempDir(), "admission-ledger.db")
+	cfg.TurnRetention = 5 * time.Millisecond
+	server, err := NewServer(cfg, NewFakeAdapter(FakeBehaviorSuccess))
+	if err != nil {
+		t.Fatalf("NewServer: %v", err)
+	}
+	request := validWrapperStartTurnRequest()
+	durable, err := validateDurableTurnAdmission(request)
+	if err != nil {
+		t.Fatalf("validate durable admission: %v", err)
+	}
+	if _, _, err := server.ledger.AdmitTurn(
+		context.Background(), string(request.TurnID), durable.taskUID, durable.attempt, durable.requestDigest,
+		string(request.RuntimeSessionID), request.CorrelationID,
+	); err != nil {
+		t.Fatalf("admit durable turn: %v", err)
+	}
+	if err := server.ledger.MarkTurnAccepted(context.Background(), string(request.TurnID)); err != nil {
+		t.Fatalf("mark durable turn accepted: %v", err)
+	}
+	turn, err := server.turnRegistry.admit(request, server.now)
+	if err != nil {
+		t.Fatalf("admit active turn: %v", err)
+	}
+	turn.appendFrame(server.frame(
+		turn, harness.FrameTurnCompleted, "turn completed", &harness.TurnCompleted{Result: "ok"},
+	))
+	if err := server.ledger.Close(); err != nil {
+		t.Fatalf("close ledger before terminal receipt: %v", err)
+	}
+
+	server.finishTurn(turn)
+
+	if !server.turnRegistry.active(request.TurnID) {
+		t.Fatal("receipt persistence failure released the active turn")
+	}
+	if _, closed := turn.framesFrom(1); closed {
+		t.Fatal("receipt persistence failure exposed stream completion")
+	}
+	time.Sleep(3 * cfg.TurnRetention)
+	if !server.turnRegistry.active(request.TurnID) {
+		t.Fatal("receipt persistence failure scheduled turn eviction")
+	}
+	healthRecorder := httptest.NewRecorder()
+	healthRequest := httptest.NewRequest(http.MethodGet, harness.HealthPath, nil)
+	server.Handler().ServeHTTP(healthRecorder, healthRequest)
+	if healthRecorder.Code != http.StatusOK {
+		t.Fatalf("health status code = %d, want 200", healthRecorder.Code)
+	}
+	var health harness.HealthResponse
+	if err := json.Unmarshal(healthRecorder.Body.Bytes(), &health); err != nil {
+		t.Fatalf("decode health response: %v", err)
+	}
+	if health.Ready || health.Status != harness.HealthStatusUnhealthy ||
+		health.Metadata["terminalLedger"] != terminalLedgerPersistFailed {
+		t.Fatalf("health after receipt persistence failure = %#v", health)
+	}
+	readinessRecorder := httptest.NewRecorder()
+	readinessRequest := httptest.NewRequest(http.MethodGet, harness.ReadinessPath, nil)
+	server.Handler().ServeHTTP(readinessRecorder, readinessRequest)
+	if readinessRecorder.Code != http.StatusServiceUnavailable {
+		t.Fatalf("readiness status code = %d, want 503", readinessRecorder.Code)
+	}
+	var readiness harness.HealthResponse
+	if err := json.Unmarshal(readinessRecorder.Body.Bytes(), &readiness); err != nil {
+		t.Fatalf("decode readiness response: %v", err)
+	}
+	if readiness.Ready || readiness.Status != harness.HealthStatusUnhealthy ||
+		readiness.Metadata["terminalLedger"] != terminalLedgerPersistFailed {
+		t.Fatalf("readiness after receipt persistence failure = %#v", readiness)
+	}
+}
+
+func TestServerAcceptanceFailureReconcilesAdmissionWithIndependentContext(t *testing.T) {
+	cfg := DefaultConfig()
+	cfg.AllowUnauthenticated = true
+	cfg.AdmissionLedgerPath = filepath.Join(t.TempDir(), "admission-ledger.db")
+	server, err := NewServer(cfg, NewFakeAdapter(FakeBehaviorSuccess))
+	if err != nil {
+		t.Fatalf("NewServer: %v", err)
+	}
+	defer func() {
+		if err := server.Close(); err != nil {
+			t.Errorf("Close: %v", err)
+		}
+	}()
+
+	request := validWrapperStartTurnRequest()
+	durable, err := validateDurableTurnAdmission(request)
+	if err != nil {
+		t.Fatalf("validate durable admission: %v", err)
+	}
+	if _, _, err := server.ledger.AdmitTurn(
+		context.Background(), string(request.TurnID), durable.taskUID, durable.attempt, durable.requestDigest,
+		string(request.RuntimeSessionID), request.CorrelationID,
+	); err != nil {
+		t.Fatalf("admit durable turn: %v", err)
+	}
+	turn, err := server.turnRegistry.admit(request, server.now)
+	if err != nil {
+		t.Fatalf("admit active turn: %v", err)
+	}
+
+	canceledCtx, cancel := context.WithCancel(context.Background())
+	cancel()
+	if err := server.markDurableTurnAccepted(canceledCtx, turn); err == nil {
+		t.Fatal("markDurableTurnAccepted() error = nil, want canceled acceptance failure")
+	}
+
+	record, err := server.ledger.GetTurn(context.Background(), string(request.TurnID))
+	if err != nil {
+		t.Fatalf("GetTurn: %v", err)
+	}
+	if record.State != ledger.TurnRejected || record.RejectReason != durableAcceptanceRejectionReason {
+		t.Fatalf("durable record = %#v, want reconciled rejection", record)
+	}
+	if server.turnRegistry.active(request.TurnID) {
+		t.Fatal("reconciled acceptance failure retained the local turn")
+	}
+	if !server.admissionLedgerHealthy() {
+		t.Fatal("successful admission reconciliation closed readiness")
+	}
+}
+
+func TestServerCanceledStartTurnReclaimDoesNotPoisonAdmissionLedger(t *testing.T) {
+	cfg := DefaultConfig()
+	cfg.AllowUnauthenticated = true
+	cfg.AdmissionLedgerPath = filepath.Join(t.TempDir(), "admission-ledger.db")
+	server, err := NewServer(cfg, NewFakeAdapter(FakeBehaviorSuccess))
+	if err != nil {
+		t.Fatalf("NewServer: %v", err)
+	}
+	defer func() {
+		if err := server.Close(); err != nil {
+			t.Errorf("Close: %v", err)
+		}
+	}()
+
+	canceledCtx, cancel := context.WithCancel(context.Background())
+	cancel()
+	request := httptest.NewRequest(http.MethodPost, harness.TurnsPath, strings.NewReader("{"))
+	request = request.WithContext(canceledCtx)
+	recorder := httptest.NewRecorder()
+	server.Handler().ServeHTTP(recorder, request)
+	if recorder.Code != http.StatusBadRequest {
+		t.Fatalf("canceled StartTurn status = %d, want 400 after independent reclamation", recorder.Code)
+	}
+	if !server.admissionLedgerHealthy() {
+		t.Fatal("canceled reclamation caller poisoned durable admission")
+	}
+
+	retryRecorder := httptest.NewRecorder()
+	retryRequest := httptest.NewRequest(http.MethodPost, harness.TurnsPath, strings.NewReader("{"))
+	server.Handler().ServeHTTP(retryRecorder, retryRequest)
+	if retryRecorder.Code != http.StatusBadRequest {
+		t.Fatalf("StartTurn after canceled caller = %d, want 400", retryRecorder.Code)
+	}
+}
+
+func TestServerChildProcessCleanupFailureRetainsTurnAndClosesAdmission(t *testing.T) {
+	cfg := DefaultConfig()
+	cfg.AllowUnauthenticated = true
+	server, err := NewServer(cfg, NewFakeAdapter(FakeBehaviorSuccess))
+	if err != nil {
+		t.Fatalf("NewServer: %v", err)
+	}
+	request := validWrapperStartTurnRequest()
+	turn, err := server.turnRegistry.admit(request, server.now)
+	if err != nil {
+		t.Fatalf("admit active turn: %v", err)
+	}
+	server.setChildCredentialProcessError(errChildCredentialProcessCleanupUnproven)
+	server.finishTurn(turn)
+
+	if !server.turnRegistry.active(request.TurnID) {
+		t.Fatal("child process cleanup failure released the active turn")
+	}
+	if _, closed := turn.framesFrom(1); closed {
+		t.Fatal("child process cleanup failure closed the active turn stream")
+	}
+	readinessRecorder := httptest.NewRecorder()
+	readinessRequest := httptest.NewRequest(http.MethodGet, harness.ReadinessPath, nil)
+	server.Handler().ServeHTTP(readinessRecorder, readinessRequest)
+	if readinessRecorder.Code != http.StatusServiceUnavailable {
+		t.Fatalf("readiness status = %d, want 503", readinessRecorder.Code)
+	}
+	var readiness harness.HealthResponse
+	if err := json.Unmarshal(readinessRecorder.Body.Bytes(), &readiness); err != nil {
+		t.Fatalf("decode readiness: %v", err)
+	}
+	if readiness.Metadata["childCredentialProcesses"] != childCredentialCleanupFailed {
+		t.Fatalf("readiness after child cleanup failure = %#v", readiness)
+	}
+
+	next := validWrapperStartTurnRequest()
+	next.TurnID = "turn-after-child-cleanup-failure"
+	next.CorrelationID = "corr-after-child-cleanup-failure"
+	nextBody, err := json.Marshal(next)
+	if err != nil {
+		t.Fatalf("marshal next StartTurn: %v", err)
+	}
+	startRecorder := httptest.NewRecorder()
+	startRequest := httptest.NewRequest(http.MethodPost, harness.TurnsPath, bytes.NewReader(nextBody))
+	server.Handler().ServeHTTP(startRecorder, startRequest)
+	if startRecorder.Code != http.StatusServiceUnavailable {
+		t.Fatalf("StartTurn after child cleanup failure = %d, want 503", startRecorder.Code)
+	}
+}
+
+func TestServerSecurityArtifactFollowUpChildCleanupFailureFailsClosed(t *testing.T) {
+	t.Setenv(EnvChildUID, "")
+	t.Setenv(EnvChildGID, "")
+	t.Setenv("ORKA_ARTIFACTS_DIR", filepath.Join(t.TempDir(), "artifacts"))
+
+	cfg := DefaultConfig()
+	cfg.AllowUnauthenticated = true
+	cfg.Generic = GenericAdapterConfig{
+		Command:    wrapperTestShellPath,
+		PromptMode: PromptModeStdin,
+		ResultMode: ResultModeStdout,
+	}
+	server, err := NewServer(cfg, NewGenericAdapter(cfg.Generic))
+	if err != nil {
+		t.Fatalf("NewServer: %v", err)
+	}
+	defer func() {
+		if err := server.Close(); err != nil {
+			t.Errorf("Close: %v", err)
+		}
+	}()
+
+	runnerCalls := 0
+	server.runner = commandRunnerFunc(func(_ context.Context, spec *CommandSpec) (CommandResult, error) {
+		if spec == nil {
+			t.Fatal("command spec is nil")
+		}
+		runnerCalls++
+		switch runnerCalls {
+		case 1:
+			return CommandResult{Stdout: "initial result", FullStdout: "initial result"}, nil
+		case 2:
+			return CommandResult{Stdout: "follow-up output must not be exposed"}, fmt.Errorf(
+				"%w: test child process drain failure",
+				errChildCredentialProcessCleanupUnproven,
+			)
+		default:
+			t.Fatalf("runner calls = %d, want at most 2", runnerCalls)
+			return CommandResult{}, nil
+		}
+	})
+
+	request := validWrapperStartTurnRequest()
+	request.Input.Prompt = "REQUIRED_SECURITY_ARTIFACTS: security-findings.v2.json\nreview the repository"
+	request = sealDurableWrapperRequest(request)
+	turn, err := server.turnRegistry.admit(request, server.now)
+	if err != nil {
+		t.Fatalf("admit active turn: %v", err)
+	}
+
+	server.runTurn(turn)
+
+	if runnerCalls != 2 {
+		t.Fatalf("runner calls = %d, want initial run plus security follow-up", runnerCalls)
+	}
+	if server.childCredentialProcessesHealthy() {
+		t.Fatal("follow-up child process cleanup failure did not close readiness")
+	}
+	if !server.turnRegistry.active(request.TurnID) {
+		t.Fatal("follow-up child process cleanup failure released the active turn")
+	}
+	frames, closed := turn.framesFrom(1)
+	if closed {
+		t.Fatal("follow-up child process cleanup failure closed the active turn stream")
+	}
+	for _, frame := range frames {
+		switch frame.Type {
+		case harness.FrameTurnCompleted, harness.FrameTurnFailed, harness.FrameTurnCancelled:
+			t.Fatalf("follow-up child process cleanup failure exposed terminal frame %#v", frame)
+		}
+		if strings.Contains(frame.ContentText, "follow-up output must not be exposed") {
+			t.Fatalf("follow-up child process cleanup failure exposed subprocess output %#v", frame)
+		}
+	}
+
+	readiness := server.healthResponse()
+	if readiness.Ready || readiness.Metadata["childCredentialProcesses"] != childCredentialCleanupFailed {
+		t.Fatalf("readiness after follow-up child cleanup failure = %#v", readiness)
+	}
+
+	next := validWrapperStartTurnRequest()
+	next.TurnID = "turn-after-follow-up-child-cleanup-failure"
+	next.CorrelationID = "corr-after-follow-up-child-cleanup-failure"
+	next = sealDurableWrapperRequest(next)
+	nextBody, err := json.Marshal(next)
+	if err != nil {
+		t.Fatalf("marshal next StartTurn: %v", err)
+	}
+	startRecorder := httptest.NewRecorder()
+	startRequest := httptest.NewRequest(http.MethodPost, harness.TurnsPath, bytes.NewReader(nextBody))
+	server.Handler().ServeHTTP(startRecorder, startRequest)
+	if startRecorder.Code != http.StatusServiceUnavailable {
+		t.Fatalf("StartTurn after follow-up child cleanup failure = %d, want 503", startRecorder.Code)
+	}
+}
+
+func TestServerArtifactUploadFailureFailsTurnAndRetainsEvidence(t *testing.T) {
+	t.Setenv(EnvChildUID, "")
+	t.Setenv(EnvChildGID, "")
+	t.Setenv(workerenv.ControllerURL, "")
+
+	cfg := DefaultConfig()
+	cfg.AllowUnauthenticated = true
+	cfg.Generic = GenericAdapterConfig{
+		Command:    wrapperTestShellPath,
+		PromptMode: PromptModeStdin,
+		ResultMode: ResultModeStdout,
+	}
+	server, err := NewServer(cfg, NewGenericAdapter(cfg.Generic))
+	if err != nil {
+		t.Fatalf("NewServer: %v", err)
+	}
+	defer func() {
+		if err := server.Close(); err != nil {
+			t.Errorf("Close: %v", err)
+		}
+	}()
+
+	const (
+		artifactName = "security-findings.v2.json"
+		artifactBody = `{"findings":[{"severity":"high"}]}`
+	)
+	server.runner = commandRunnerFunc(func(_ context.Context, spec *CommandSpec) (CommandResult, error) {
+		if spec == nil {
+			t.Fatal("command spec is nil")
+		}
+		artifactDir := ""
+		for _, entry := range spec.Env {
+			key, value, ok := strings.Cut(entry, "=")
+			if ok && key == "ORKA_ARTIFACTS_DIR" {
+				artifactDir = value
+				break
+			}
+		}
+		if artifactDir == "" {
+			t.Fatal("command env is missing ORKA_ARTIFACTS_DIR")
+		}
+		if err := os.WriteFile(filepath.Join(artifactDir, artifactName), []byte(artifactBody), 0o640); err != nil {
+			t.Fatalf("write test artifact: %v", err)
+		}
+		return CommandResult{Stdout: "runtime succeeded", FullStdout: "runtime succeeded"}, nil
+	})
+
+	request := validWrapperStartTurnRequest()
+	turn, err := server.turnRegistry.admit(request, server.now)
+	if err != nil {
+		t.Fatalf("admit active turn: %v", err)
+	}
+	server.runTurn(turn)
+
+	frames, closed := turn.framesFrom(1)
+	if !closed {
+		t.Fatal("artifact upload failure did not close the turn")
+	}
+	var terminal harness.HarnessEventFrame
+	for _, frame := range frames {
+		if frame.Type == harness.FrameTurnCompleted {
+			t.Fatalf("artifact upload failure emitted TurnCompleted: %#v", frame)
+		}
+		if frame.Type == harness.FrameTurnFailed {
+			terminal = frame
+		}
+	}
+	if terminal.Failed == nil || terminal.Failed.Reason != "artifact_upload_failed" {
+		t.Fatalf("terminal frame = %#v, want artifact_upload_failed", terminal)
+	}
+	retainedArtifactsDir := terminal.Metadata["retainedArtifactsPath"]
+	if retainedArtifactsDir == "" {
+		t.Fatalf("terminal metadata = %#v, want retained artifact path", terminal.Metadata)
+	}
+	t.Cleanup(func() { _ = os.RemoveAll(filepath.Dir(retainedArtifactsDir)) })
+	retained, err := os.ReadFile(filepath.Join(retainedArtifactsDir, artifactName))
+	if err != nil {
+		t.Fatalf("read retained artifact: %v", err)
+	}
+	if string(retained) != artifactBody {
+		t.Fatalf("retained artifact = %q, want %q", retained, artifactBody)
+	}
+}
+
+func TestRetainFailedTurnArtifactsBoundsConcurrentRetentions(t *testing.T) {
+	retentionParent := t.TempDir()
+	sourceParent := t.TempDir()
+	if err := os.Mkdir(filepath.Join(retentionParent, "unrelated"), 0o700); err != nil {
+		t.Fatalf("create unrelated directory: %v", err)
+	}
+
+	const extraRetentions = 5
+	total := maxFailedArtifactRetentions + extraRetentions
+	errorsCh := make(chan error, total)
+	var wg sync.WaitGroup
+	for i := range total {
+		artifactDir := filepath.Join(sourceParent, fmt.Sprintf("turn-%02d", i), "artifacts")
+		if err := os.MkdirAll(artifactDir, 0o700); err != nil {
+			t.Fatalf("create source artifact directory: %v", err)
+		}
+		if err := os.WriteFile(
+			filepath.Join(artifactDir, "evidence.txt"),
+			[]byte(strconv.Itoa(i)),
+			0o600,
+		); err != nil {
+			t.Fatalf("write source artifact: %v", err)
+		}
+		wg.Go(func() {
+			_, err := retainFailedTurnArtifactsIn(artifactDir, retentionParent)
+			errorsCh <- err
+		})
+	}
+	wg.Wait()
+	close(errorsCh)
+	for err := range errorsCh {
+		if err != nil {
+			t.Fatalf("retain failed turn artifacts: %v", err)
+		}
+	}
+
+	entries, err := os.ReadDir(retentionParent)
+	if err != nil {
+		t.Fatalf("list retained artifacts: %v", err)
+	}
+	retained := 0
+	for _, entry := range entries {
+		if !strings.HasPrefix(entry.Name(), failedArtifactRetentionPrefix) {
+			continue
+		}
+		retained++
+		artifactPath := filepath.Join(retentionParent, entry.Name(), "artifacts", "evidence.txt")
+		if _, err := os.ReadFile(artifactPath); err != nil {
+			t.Fatalf("read retained evidence %q: %v", artifactPath, err)
+		}
+	}
+	if retained != maxFailedArtifactRetentions {
+		t.Fatalf("retained failure directories = %d, want %d", retained, maxFailedArtifactRetentions)
+	}
+	if _, err := os.Stat(filepath.Join(retentionParent, "unrelated")); err != nil {
+		t.Fatalf("unrelated directory was removed: %v", err)
+	}
+}
+
+func TestServerRetriesTransientAdmissionLedgerReclaimError(t *testing.T) {
+	cfg := DefaultConfig()
+	cfg.AllowUnauthenticated = true
+	cfg.AdmissionLedgerPath = filepath.Join(t.TempDir(), "admission-ledger.db")
+	server, err := NewServer(cfg, NewFakeAdapter(FakeBehaviorSuccess))
+	if err != nil {
+		t.Fatalf("NewServer: %v", err)
+	}
+	defer func() {
+		if err := server.Close(); err != nil {
+			t.Errorf("Close: %v", err)
+		}
+	}()
+
+	server.setRetryableAdmissionLedgerError(errors.New("temporary reclamation failure"))
+	if server.admissionLedgerHealthy() {
+		t.Fatal("transient reclamation failure did not close readiness")
+	}
+
+	recorder := httptest.NewRecorder()
+	request := httptest.NewRequest(http.MethodPost, harness.TurnsPath, strings.NewReader("{"))
+	server.Handler().ServeHTTP(recorder, request)
+	if recorder.Code != http.StatusBadRequest {
+		t.Fatalf("StartTurn reclaim retry status = %d, want 400", recorder.Code)
+	}
+	if !server.admissionLedgerHealthy() {
+		t.Fatal("successful reclamation retry did not restore readiness")
+	}
+}
+
+func TestServerAcceptanceReconcileFailureRetainsTurnAndClosesReadiness(t *testing.T) {
+	cfg := DefaultConfig()
+	cfg.AllowUnauthenticated = true
+	cfg.AdmissionLedgerPath = filepath.Join(t.TempDir(), "admission-ledger.db")
+	server, err := NewServer(cfg, NewFakeAdapter(FakeBehaviorSuccess))
+	if err != nil {
+		t.Fatalf("NewServer: %v", err)
+	}
+	defer func() {
+		if err := server.Close(); err != nil {
+			t.Errorf("Close: %v", err)
+		}
+	}()
+
+	request := validWrapperStartTurnRequest()
+	durable, err := validateDurableTurnAdmission(request)
+	if err != nil {
+		t.Fatalf("validate durable admission: %v", err)
+	}
+	if _, _, err := server.ledger.AdmitTurn(
+		context.Background(), string(request.TurnID), durable.taskUID, durable.attempt, durable.requestDigest,
+		string(request.RuntimeSessionID), request.CorrelationID,
+	); err != nil {
+		t.Fatalf("admit durable turn: %v", err)
+	}
+	if err := server.ledger.MarkTurnAccepted(context.Background(), string(request.TurnID)); err != nil {
+		t.Fatalf("seed accepted turn: %v", err)
+	}
+	turn, err := server.turnRegistry.admit(request, server.now)
+	if err != nil {
+		t.Fatalf("admit active turn: %v", err)
+	}
+	defer server.turnRegistry.reject(turn)
+
+	canceledCtx, cancel := context.WithCancel(context.Background())
+	cancel()
+	if err := server.markDurableTurnAccepted(canceledCtx, turn); err == nil {
+		t.Fatal("markDurableTurnAccepted() error = nil, want ambiguous acceptance failure")
+	}
+
+	if !server.turnRegistry.active(request.TurnID) {
+		t.Fatal("unreconciled acceptance failure released the local turn")
+	}
+	readinessRecorder := httptest.NewRecorder()
+	readinessRequest := httptest.NewRequest(http.MethodGet, harness.ReadinessPath, nil)
+	server.Handler().ServeHTTP(readinessRecorder, readinessRequest)
+	if readinessRecorder.Code != http.StatusServiceUnavailable {
+		t.Fatalf("readiness status code = %d, want 503", readinessRecorder.Code)
+	}
+	var readiness harness.HealthResponse
+	if err := json.Unmarshal(readinessRecorder.Body.Bytes(), &readiness); err != nil {
+		t.Fatalf("decode readiness response: %v", err)
+	}
+	if readiness.Ready || readiness.Status != harness.HealthStatusUnhealthy ||
+		readiness.Metadata["admissionLedger"] != admissionLedgerReconcileFailed {
+		t.Fatalf("readiness after admission reconciliation failure = %#v", readiness)
+	}
+
+	next := validWrapperStartTurnRequest()
+	next.TurnID = "turn-after-admission-reconcile-failure"
+	next.CorrelationID = "corr-after-admission-reconcile-failure"
+	next = sealDurableWrapperRequest(next)
+	body, err := json.Marshal(next)
+	if err != nil {
+		t.Fatalf("marshal next request: %v", err)
+	}
+	startRecorder := httptest.NewRecorder()
+	startRequest := httptest.NewRequest(http.MethodPost, harness.TurnsPath, bytes.NewReader(body))
+	server.Handler().ServeHTTP(startRecorder, startRequest)
+	if startRecorder.Code != http.StatusServiceUnavailable {
+		t.Fatalf("StartTurn while admission ledger is unhealthy = %d, want 503", startRecorder.Code)
+	}
+}
+
+func TestServerLocalAdmissionRejectionReconcilesWithIndependentContext(t *testing.T) {
+	cfg := DefaultConfig()
+	cfg.AllowUnauthenticated = true
+	cfg.AdmissionLedgerPath = filepath.Join(t.TempDir(), "admission-ledger.db")
+	server, err := NewServer(cfg, NewFakeAdapter(FakeBehaviorSuccess))
+	if err != nil {
+		t.Fatalf("NewServer: %v", err)
+	}
+	defer func() {
+		if err := server.Close(); err != nil {
+			t.Errorf("Close: %v", err)
+		}
+	}()
+
+	request := validWrapperStartTurnRequest()
+	durable, err := validateDurableTurnAdmission(request)
+	if err != nil {
+		t.Fatalf("validate durable admission: %v", err)
+	}
+	if _, _, err := server.ledger.AdmitTurn(
+		context.Background(), string(request.TurnID), durable.taskUID, durable.attempt, durable.requestDigest,
+		string(request.RuntimeSessionID), request.CorrelationID,
+	); err != nil {
+		t.Fatalf("admit durable turn: %v", err)
+	}
+
+	canceledCtx, cancel := context.WithCancel(context.Background())
+	cancel()
+	if err := server.markDurableLocalAdmissionRejected(canceledCtx, request.TurnID); err != nil {
+		t.Fatalf("markDurableLocalAdmissionRejected(): %v", err)
+	}
+
+	record, err := server.ledger.GetTurn(context.Background(), string(request.TurnID))
+	if err != nil {
+		t.Fatalf("GetTurn: %v", err)
+	}
+	if record.State != ledger.TurnRejected || record.RejectReason != durableLocalRejectionReason {
+		t.Fatalf("durable record = %#v, want local admission rejection", record)
+	}
+	if !server.admissionLedgerHealthy() {
+		t.Fatal("successful local admission reconciliation closed readiness")
+	}
+}
+
+func TestServerLocalAdmissionReconcileFailureReturnsUnavailable(t *testing.T) {
+	cfg := DefaultConfig()
+	cfg.AllowUnauthenticated = true
+	cfg.AdmissionLedgerPath = filepath.Join(t.TempDir(), "admission-ledger.db")
+	server, err := NewServer(cfg, NewFakeAdapter(FakeBehaviorSuccess))
+	if err != nil {
+		t.Fatalf("NewServer: %v", err)
+	}
+	defer func() {
+		if err := server.Close(); err != nil {
+			t.Errorf("Close: %v", err)
+		}
+	}()
+
+	request := validWrapperStartTurnRequest()
+	body, err := json.Marshal(request)
+	if err != nil {
+		t.Fatalf("marshal StartTurn request: %v", err)
+	}
+
+	// Hold local admission after the durable AdmitTurn commit, then make the
+	// rejection write fail. This deterministically exercises the handler's
+	// post-commit reconciliation failure instead of only calling the helper.
+	server.turnRegistry.mu.Lock()
+	registryLocked := true
+	defer func() {
+		if registryLocked {
+			server.turnRegistry.mu.Unlock()
+		}
+	}()
+	server.turnRegistry.activeTurns = 1
+
+	startRecorder := httptest.NewRecorder()
+	startRequest := httptest.NewRequest(http.MethodPost, harness.TurnsPath, bytes.NewReader(body))
+	startDone := make(chan struct{})
+	go func() {
+		defer close(startDone)
+		server.Handler().ServeHTTP(startRecorder, startRequest)
+	}()
+
+	eventually(t, 2*time.Second, func() bool {
+		record, getErr := server.ledger.GetTurn(context.Background(), string(request.TurnID))
+		return getErr == nil && record.State == ledger.TurnAdmitted
+	})
+	if err := server.ledger.Close(); err != nil {
+		t.Fatalf("close admission ledger: %v", err)
+	}
+	server.turnRegistry.mu.Unlock()
+	registryLocked = false
+
+	select {
+	case <-startDone:
+	case <-time.After(2 * time.Second):
+		t.Fatal("StartTurn did not finish after local admission was released")
+	}
+	server.ledger = nil
+
+	if startRecorder.Code != http.StatusServiceUnavailable {
+		t.Fatalf("StartTurn after durable rejection failure = %d, want 503", startRecorder.Code)
+	}
+	readinessRecorder := httptest.NewRecorder()
+	readinessRequest := httptest.NewRequest(http.MethodGet, harness.ReadinessPath, nil)
+	server.Handler().ServeHTTP(readinessRecorder, readinessRequest)
+	if readinessRecorder.Code != http.StatusServiceUnavailable {
+		t.Fatalf("readiness status code = %d, want 503", readinessRecorder.Code)
+	}
+	var readiness harness.HealthResponse
+	if err := json.Unmarshal(readinessRecorder.Body.Bytes(), &readiness); err != nil {
+		t.Fatalf("decode readiness response: %v", err)
+	}
+	if readiness.Ready || readiness.Status != harness.HealthStatusUnhealthy ||
+		readiness.Metadata["admissionLedger"] != admissionLedgerReconcileFailed {
+		t.Fatalf("readiness after local admission reconciliation failure = %#v", readiness)
+	}
+}
+
 func TestServerRequiresBearerTokenForTurnEndpoints(t *testing.T) {
 	cfg := DefaultConfig()
-	cfg.AuthValue = "auth-value-123"
+	const authValue = "auth-value-0123456789abcdef012345"
+	cfg.AuthValue = authValue
 	cfg.Generic.Command = testEchoCommand
 	baseURL, cleanup := startWrapperServerWithConfig(t, cfg, NewFakeAdapter(FakeBehaviorSuccess))
 	defer cleanup()
@@ -67,7 +755,7 @@ func TestServerRequiresBearerTokenForTurnEndpoints(t *testing.T) {
 		t.Fatalf("unauthenticated StartTurn error = %v, want 401", err)
 	}
 
-	authed, err := harness.NewClient(baseURL, harness.WithBearerToken("auth-value-123"))
+	authed, err := harness.NewClient(baseURL, harness.WithBearerToken(authValue))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -81,19 +769,23 @@ func TestServerRequiresBearerTokenForTurnEndpoints(t *testing.T) {
 }
 
 func TestServerReloadsBearerTokenFile(t *testing.T) {
+	const (
+		oldToken = "old-token-0123456789abcdef01234567"
+		newToken = "new-token-0123456789abcdef01234567"
+	)
 	tokenFile := filepath.Join(t.TempDir(), "token")
-	if err := os.WriteFile(tokenFile, []byte("old-token"), 0o600); err != nil {
+	if err := os.WriteFile(tokenFile, []byte(oldToken), 0o600); err != nil {
 		t.Fatal(err)
 	}
 	cfg := DefaultConfig()
 	cfg.AuthValueFile = tokenFile
-	cfg.AuthValue = "old-token"
+	cfg.AuthValue = oldToken
 	cfg.Generic.Command = testEchoCommand
 	baseURL, cleanup := startWrapperServerWithConfig(t, cfg, NewFakeAdapter(FakeBehaviorSuccess))
 	defer cleanup()
 
 	request := validWrapperStartTurnRequest()
-	oldClient, err := harness.NewClient(baseURL, harness.WithBearerToken("old-token"))
+	oldClient, err := harness.NewClient(baseURL, harness.WithBearerToken(oldToken))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -102,15 +794,27 @@ func TestServerReloadsBearerTokenFile(t *testing.T) {
 	}
 	collectWrapperFrames(t, oldClient, request.TurnID, 0)
 
-	if err := os.WriteFile(tokenFile, []byte("new-token"), 0o600); err != nil {
+	if err := os.WriteFile(tokenFile, []byte("short-token"), 0o600); err != nil {
 		t.Fatal(err)
 	}
 	stale := validWrapperStartTurnRequest()
 	stale.TurnID = harness.HarnessTurnID(string(stale.TurnID) + "-rotated")
+	stale = sealDurableWrapperRequest(stale)
+	shortClient, err := harness.NewClient(baseURL, harness.WithBearerToken("short-token"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := shortClient.StartTurn(context.Background(), stale); err == nil || !strings.Contains(err.Error(), "503") {
+		t.Fatalf("weak rotated token StartTurn error = %v, want 503", err)
+	}
+
+	if err := os.WriteFile(tokenFile, []byte(newToken), 0o600); err != nil {
+		t.Fatal(err)
+	}
 	if _, err := oldClient.StartTurn(context.Background(), stale); err == nil || !strings.Contains(err.Error(), "401") {
 		t.Fatalf("stale token StartTurn error = %v, want 401", err)
 	}
-	newClient, err := harness.NewClient(baseURL, harness.WithBearerToken("new-token"))
+	newClient, err := harness.NewClient(baseURL, harness.WithBearerToken(newToken))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -425,6 +1129,202 @@ func TestServerRedactsCommandOutputFrames(t *testing.T) {
 	assertCommandFramesRedacted(t, "printf '"+testBearerHeaderValue()+"'", "frames")
 }
 
+func TestServerRedactsConfiguredCommandEnvironment(t *testing.T) {
+	const (
+		privateName  = "WRAPPER_PRIVATE_SECRET"
+		privateValue = "wrapper-config-value-4f739d28b61c"
+		publicValue  = "https://public-provider.example.test/v1"
+	)
+	configuredEnv := []string{
+		privateName + "=" + privateValue,
+		workerenv.OpenAIBaseURL + "=" + publicValue,
+		"FEATURE=true",
+		"RETRY_COUNT=1",
+	}
+	cfg := DefaultConfig()
+	cfg.AllowUnauthenticated = true
+	cfg.CommandEnv = append([]string(nil), configuredEnv...)
+	cfg.Generic = GenericAdapterConfig{
+		Command: wrapperTestShellPath,
+		Args: []string{"-c", fmt.Sprintf(
+			"printf '%%s %%s %%s %%s' \"$%s\" \"$%s\" \"$FEATURE\" \"$RETRY_COUNT\"; printf '%%s' \"$%s\" >&2; exit 7",
+			privateName,
+			workerenv.OpenAIBaseURL,
+			privateName,
+		)},
+		Env:        append([]string(nil), configuredEnv...),
+		PromptMode: PromptModeStdin,
+		ResultMode: ResultModeStdout,
+	}
+	baseURL, cleanup := startWrapperServerWithConfig(t, cfg, NewGenericAdapter(cfg.Generic))
+	defer cleanup()
+	client, err := harness.NewClient(baseURL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := validWrapperStartTurnRequest()
+	if _, err := client.StartTurn(context.Background(), request); err != nil {
+		t.Fatalf("StartTurn: %v", err)
+	}
+	frames := collectWrapperFrames(t, client, request.TurnID, 0)
+	encoded, err := json.Marshal(frames)
+	if err != nil {
+		t.Fatalf("marshal frames: %v", err)
+	}
+	if strings.Contains(string(encoded), privateValue) || !strings.Contains(string(encoded), "[REDACTED]") {
+		t.Fatalf("configured private environment leaked or was not redacted: %s", encoded)
+	}
+	if !strings.Contains(string(encoded), publicValue) {
+		t.Fatalf("known public configuration was redacted: %s", encoded)
+	}
+	if !strings.Contains(string(encoded), "true 1") {
+		t.Fatalf("ordinary short configuration values were corrupted: %s", encoded)
+	}
+}
+
+func TestServerRedactsConfiguredConnectionStringsFromFramesAndOutput(t *testing.T) {
+	postgresURL, redisURL, reportingDSN, _ := configuredConnectionStringFixtures()
+	const publicURL = "https://public-provider.example.test/v1"
+	configuredEnv := []string{
+		"DATABASE_URL=" + postgresURL,
+		"REDIS_URL=" + redisURL,
+		"REPORTING_DSN=" + reportingDSN,
+		workerenv.OpenAIBaseURL + "=" + publicURL,
+	}
+	cfg := DefaultConfig()
+	cfg.AllowUnauthenticated = true
+	cfg.CommandEnv = append([]string(nil), configuredEnv...)
+	cfg.Generic = GenericAdapterConfig{
+		Command: wrapperTestShellPath,
+		Args: []string{
+			"-c",
+			`printf '%s\n%s\n%s\n%s\n' "$DATABASE_URL" "$REDIS_URL" "$REPORTING_DSN" "$OPENAI_BASE_URL"`,
+		},
+		Env:        append([]string(nil), configuredEnv...),
+		PromptMode: PromptModeStdin,
+		ResultMode: ResultModeStdout,
+	}
+	baseURL, cleanup := startWrapperServerWithConfig(t, cfg, NewGenericAdapter(cfg.Generic))
+	defer cleanup()
+	client, err := harness.NewClient(baseURL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := validWrapperStartTurnRequest()
+	if _, err := client.StartTurn(context.Background(), request); err != nil {
+		t.Fatalf("StartTurn: %v", err)
+	}
+	frames := collectWrapperFrames(t, client, request.TurnID, 0)
+	encoded, err := json.Marshal(frames)
+	if err != nil {
+		t.Fatalf("marshal frames: %v", err)
+	}
+	for label, sensitive := range map[string]string{
+		"Postgres URL":  postgresURL,
+		"Redis URL":     redisURL,
+		"reporting DSN": reportingDSN,
+	} {
+		if strings.Contains(string(encoded), sensitive) {
+			t.Fatalf("frames leaked configured %s: %s", label, encoded)
+		}
+	}
+	if !strings.Contains(string(encoded), "[REDACTED]") || !strings.Contains(string(encoded), publicURL) {
+		t.Fatalf("frames missed redaction or corrupted public configuration: %s", encoded)
+	}
+
+	last := frames[len(frames)-1]
+	if last.Type != harness.FrameTurnCompleted || last.Completed == nil || last.Completed.OutputRef == "" {
+		t.Fatalf("last frame = %#v, want completed output reference", last)
+	}
+	output, err := client.FetchTurnOutput(context.Background(), request.TurnID, last.Completed.OutputRef)
+	if err != nil {
+		t.Fatalf("FetchTurnOutput: %v", err)
+	}
+	for label, sensitive := range map[string]string{
+		"Postgres URL":  postgresURL,
+		"Redis URL":     redisURL,
+		"reporting DSN": reportingDSN,
+	} {
+		if bytes.Contains(output, []byte(sensitive)) {
+			t.Fatalf("stored output leaked configured %s: %q", label, output)
+		}
+	}
+	if !bytes.Contains(output, []byte("[REDACTED]")) || !bytes.Contains(output, []byte(publicURL)) {
+		t.Fatalf("stored output missed redaction or corrupted public configuration: %q", output)
+	}
+}
+
+func TestExactConfiguredEnvValuesSelectsOnlyCredentialNames(t *testing.T) {
+	postgresURL, redisURL, reportingDSN, legacyConnectionString := configuredConnectionStringFixtures()
+	values := exactConfiguredEnvValues([]string{
+		"FEATURE=true",
+		"RETRY_COUNT=1",
+		"TOKENIZER_MODEL=tokenizer-v1",
+		"AUTH_URL=https://auth.example.test",
+		workerenv.OpenAIBaseURL + "=https://public-provider.example.test/v1",
+		"PATTERN=not-a-credential",
+		"DATABASE_URL=" + postgresURL,
+		"REDIS_URL=" + redisURL,
+		"REPORTING_DSN=" + reportingDSN,
+		"LEGACY_CONNECTION_STRING=" + legacyConnectionString,
+		"OPENAI_API_KEY=openai-secret",
+		"WRAPPER_PRIVATE_SECRET=private-secret",
+		"DB_PASSWORD=password-secret",
+		"AWS_ACCESS_KEY_ID=aws-access-key-id-secret",
+		"GITHUB_PAT=github-pat-secret",
+		"UPSTREAM_BASIC_AUTH=basic-auth-secret-value",
+	})
+	want := []string{
+		"aws-access-key-id-secret",
+		"basic-auth-secret-value",
+		"github-pat-secret",
+		"password-secret",
+		"private-secret",
+		"openai-secret",
+		postgresURL,
+		redisURL,
+		reportingDSN,
+		legacyConnectionString,
+	}
+	if len(values) != len(want) {
+		t.Fatalf("configured exact redaction values = %v, want %v", values, want)
+	}
+	for _, value := range want {
+		if !slices.Contains(values, value) {
+			t.Fatalf("configured exact redaction values = %v, missing %q", values, value)
+		}
+	}
+}
+
+func configuredConnectionStringFixtures() (string, string, string, string) {
+	fixtureValue := func(name string) string {
+		return "synthetic-" + name + "-fixture"
+	}
+	postgresURL := (&url.URL{
+		Scheme: "postgres",
+		User:   url.UserPassword("orka", fixtureValue("postgres")),
+		Host:   "postgres.example.test",
+		Path:   "/orka",
+	}).String()
+	redisURL := (&url.URL{
+		Scheme: "redis",
+		User:   url.UserPassword("", fixtureValue("redis")),
+		Host:   "redis.example.test",
+		Path:   "/0",
+	}).String()
+	reportingDSN := strings.Join([]string{
+		"host=reporting.example.test",
+		"user=orka",
+		"password=" + fixtureValue("reporting"),
+	}, " ")
+	legacyConnectionString := strings.Join([]string{
+		"Server=legacy.example.test",
+		"User=orka",
+		"Password=" + fixtureValue("legacy"),
+	}, ";")
+	return postgresURL, redisURL, reportingDSN, legacyConnectionString
+}
+
 func assertCommandFramesRedacted(t *testing.T, script, label string) {
 	t.Helper()
 	cfg := DefaultConfig()
@@ -459,14 +1359,31 @@ func startWrapperServer(t *testing.T, adapter RuntimeAdapter) (string, func()) {
 	return startWrapperServerWithConfig(t, cfg, adapter)
 }
 
+func configureSuccessfulArtifactUpload(t *testing.T) {
+	t.Helper()
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusCreated)
+	}))
+	t.Cleanup(server.Close)
+	t.Setenv(workerenv.ControllerURL, server.URL)
+}
+
 func startWrapperServerWithConfig(t *testing.T, cfg Config, adapter RuntimeAdapter) (string, func()) {
 	t.Helper()
+	if !cfg.AllowUnauthenticated && strings.TrimSpace(cfg.AdmissionLedgerPath) == "" {
+		cfg.AdmissionLedgerPath = filepath.Join(t.TempDir(), "admission-ledger.db")
+	}
 	server, err := NewServer(cfg, adapter)
 	if err != nil {
 		t.Fatalf("NewServer: %v", err)
 	}
 	srv := httptest.NewServer(server.Handler())
-	return srv.URL, srv.Close
+	return srv.URL, func() {
+		srv.Close()
+		if err := server.Close(); err != nil {
+			t.Errorf("close wrapper server: %v", err)
+		}
+	}
 }
 
 func eventually(t *testing.T, timeout time.Duration, ok func() bool) {
@@ -556,6 +1473,92 @@ func (eventingSecretAdapter) RunTurn(
 	})
 }
 
+type runtimeAuthTokenEchoAdapter struct{}
+
+func (runtimeAuthTokenEchoAdapter) Name() string { return RuntimeCodex }
+func (runtimeAuthTokenEchoAdapter) BuildCommand(_ context.Context, turn TurnContext) (*CommandSpec, error) {
+	return &CommandSpec{Path: "test-runtime", Env: append([]string(nil), turn.Env...)}, nil
+}
+func (runtimeAuthTokenEchoAdapter) ParseResult(
+	_ context.Context,
+	_ TurnContext,
+	run CommandResult,
+) (TurnResult, error) {
+	return TurnResult{Result: run.ExactStdout()}, nil
+}
+
+func TestServerRedactsGeneratedRuntimeAuthProxyTokenAtOutputSinks(t *testing.T) {
+	previousBoundary := runtimeAuthChildBoundaryAvailable
+	runtimeAuthChildBoundaryAvailable = func() bool { return true }
+	t.Cleanup(func() { runtimeAuthChildBoundaryAvailable = previousBoundary })
+
+	cfg := DefaultConfig()
+	cfg.AllowUnauthenticated = true
+	server, err := NewServer(cfg, runtimeAuthTokenEchoAdapter{})
+	if err != nil {
+		t.Fatalf("NewServer: %v", err)
+	}
+	generatedToken := make(chan string, 1)
+	server.runner = commandRunnerFunc(func(_ context.Context, spec *CommandSpec) (CommandResult, error) {
+		token := envEntryValue(spec.Env, workerenv.OpenAIAPIKey)
+		if token == "" {
+			return CommandResult{}, errors.New("child command is missing the runtime-auth proxy credential")
+		}
+		generatedToken <- token
+		output := "generated runtime-auth proxy credential: " + token
+		return CommandResult{Stdout: output, FullStdout: output, Stderr: output}, nil
+	})
+	srv := httptest.NewServer(server.Handler())
+	defer func() {
+		srv.Close()
+		if err := server.Close(); err != nil {
+			t.Errorf("close wrapper server: %v", err)
+		}
+	}()
+	client, err := harness.NewClient(srv.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := validWrapperStartTurnRequest()
+	request.Metadata["runtimeAuthOnly"] = "true"
+	request.Input.Env = []harness.TurnEnvVar{{Name: workerenv.OpenAIAPIKey, Value: "upstream-runtime-credential"}}
+	request = sealDurableWrapperRequest(request)
+	if _, err := client.StartTurn(context.Background(), request); err != nil {
+		t.Fatalf("StartTurn: %v", err)
+	}
+	frames := collectWrapperFrames(t, client, request.TurnID, 0)
+	var token string
+	select {
+	case token = <-generatedToken:
+	default:
+		t.Fatal("runner did not receive the generated runtime-auth proxy credential")
+	}
+	encoded, err := json.Marshal(frames)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if bytes.Contains(encoded, []byte(token)) {
+		t.Fatal("frames leaked the generated runtime-auth proxy credential")
+	}
+	if !bytes.Contains(encoded, []byte("[REDACTED]")) {
+		t.Fatal("frames did not redact the generated runtime-auth proxy credential")
+	}
+	last := frames[len(frames)-1]
+	if last.Type != harness.FrameTurnCompleted || last.Completed == nil || last.Completed.OutputRef == "" {
+		t.Fatal("turn did not complete with an output reference")
+	}
+	output, err := client.FetchTurnOutput(context.Background(), request.TurnID, last.Completed.OutputRef)
+	if err != nil {
+		t.Fatalf("FetchTurnOutput: %v", err)
+	}
+	if bytes.Contains(output, []byte(token)) {
+		t.Fatal("stored output leaked the generated runtime-auth proxy credential")
+	}
+	if !bytes.Contains(output, []byte("[REDACTED]")) {
+		t.Fatal("stored output did not redact the generated runtime-auth proxy credential")
+	}
+}
+
 func TestServerRedactsEventingAdapterTerminalPayloads(t *testing.T) {
 	baseURL, cleanup := startWrapperServer(t, eventingSecretAdapter{})
 	defer cleanup()
@@ -574,6 +1577,122 @@ func TestServerRedactsEventingAdapterTerminalPayloads(t *testing.T) {
 	}
 }
 
+func TestTurnStateExactRedactsProviderValuesAtFrameAndOutputSinks(t *testing.T) {
+	exactValue := "q7Zp4vN8m2L6s0D3f5H9j1K7w4X8c2V6"
+	request := validWrapperStartTurnRequest()
+	request.Input.Env = []harness.TurnEnvVar{
+		{Name: "OPENAI_API_KEY", Value: exactValue},
+		{Name: "OPENAI_API_KEY_DUPLICATE", Value: exactValue},
+		{Name: "CLAUDE_CODE_USE_FOUNDRY", Value: "1"},
+		{Name: "EMPTY_VALUE", Value: ""},
+	}
+	turn := newTurnState(request, time.Now)
+	t.Cleanup(turn.cleanupOutput)
+
+	frame := harness.HarnessEventFrame{
+		Type:        harness.FrameRuntimeLog,
+		Summary:     "summary " + exactValue,
+		ContentText: "stdout 1 " + exactValue,
+		Content:     json.RawMessage(`{"ordinary":1,"nested":{"value":"` + exactValue + `"},"items":["` + exactValue + `"]}`),
+		ToolName:    "tool-" + exactValue,
+		ToolCallID:  "call-" + exactValue,
+		ApprovalID:  "approval-" + exactValue,
+		Metadata:    map[string]string{"note": "metadata " + exactValue},
+		Error:       &harness.ErrorInfo{Code: "error-" + exactValue, Message: "message " + exactValue},
+	}
+	turn.appendFrame(redactHarnessFrameExactValues(frame, turn.exactRedactionValuesSnapshot()))
+	turn.appendFrame(harness.HarnessEventFrame{
+		Type: harness.FrameTurnCompleted,
+		Completed: &harness.TurnCompleted{
+			Result: "result " + exactValue,
+			Data: map[string]any{
+				"nested": map[string]any{"value": exactValue},
+			},
+			Artifacts: []harness.ArtifactRef{{
+				Filename: "artifact-" + exactValue, ContentType: "type/" + exactValue,
+				Description: "description " + exactValue,
+			}},
+		},
+	})
+	failedTurn := newTurnState(request, time.Now)
+	failedFrame := harness.HarnessEventFrame{
+		Type: harness.FrameTurnFailed,
+		Failed: &harness.TurnFailed{
+			Reason: "reason-" + exactValue, Message: "failed " + exactValue,
+			Result: "partial " + exactValue,
+			Data:   map[string]any{"value": exactValue},
+			Artifacts: []harness.ArtifactRef{{
+				Filename: "failed-" + exactValue, Description: "failed description " + exactValue,
+			}},
+		},
+	}
+	failedTurn.appendFrame(redactHarnessFrameExactValues(
+		failedFrame,
+		failedTurn.exactRedactionValuesSnapshot(),
+	))
+
+	frames, _ := turn.framesFrom(1)
+	failedFrames, _ := failedTurn.framesFrom(1)
+	encoded, err := json.Marshal(append(frames, failedFrames...))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(string(encoded), exactValue) || !strings.Contains(string(encoded), "[REDACTED]") {
+		t.Fatalf("exact-redacted frames = %s", encoded)
+	}
+	if !strings.Contains(string(encoded), `stdout 1 [REDACTED]`) || !strings.Contains(string(encoded), `"ordinary":1`) {
+		t.Fatalf("exact redaction corrupted non-credential configuration value: %s", encoded)
+	}
+
+	if _, err := turn.storeOutput("durable output 1 " + exactValue); err != nil {
+		t.Fatal(err)
+	}
+	output, ok, err := turn.output()
+	if err != nil || !ok {
+		t.Fatalf("stored output = %q, ok=%v, err=%v", output, ok, err)
+	}
+	if strings.Contains(string(output), exactValue) || !strings.Contains(string(output), "[REDACTED]") {
+		t.Fatalf("exact-redacted durable output = %q", output)
+	}
+	if string(output) != "durable output 1 [REDACTED]" {
+		t.Fatalf("exact redaction corrupted non-credential configuration value: %q", output)
+	}
+
+	turn.clearExactRedactionValues()
+	if values := turn.exactRedactionValuesSnapshot(); len(values) != 0 {
+		t.Fatalf("exact redaction values retained after clear: %v", values)
+	}
+}
+
+func TestExactTurnInputValuesExcludesOnlyKnownProviderConfiguration(t *testing.T) {
+	values := exactTurnInputValues([]harness.TurnEnvVar{
+		{Name: workerenv.OpenAIAPIKey, Value: "openai-secret"},
+		{Name: "ANTHROPIC_FOUNDRY_API_KEY", Value: "foundry-secret"},
+		{Name: "FAKE_SECRET", Value: "opaque-secret"},
+		{Name: workerenv.OpenAIBaseURL, Value: "https://openai.example.test"},
+		{Name: workerenv.AnthropicBaseURL, Value: "https://anthropic.example.test"},
+		{Name: "CLAUDE_CODE_USE_FOUNDRY", Value: "1"},
+		{Name: workerenv.AnthropicFoundryBaseURL, Value: "https://foundry.example.test"},
+		{Name: "ANTHROPIC_FOUNDRY_RESOURCE", Value: "resource"},
+		{Name: "ANTHROPIC_DEFAULT_SONNET_MODEL", Value: "sonnet"},
+		{Name: "ANTHROPIC_DEFAULT_HAIKU_MODEL", Value: "haiku"},
+		{Name: "ANTHROPIC_DEFAULT_OPUS_MODEL", Value: "opus"},
+	})
+	want := map[string]bool{
+		"openai-secret":  true,
+		"foundry-secret": true,
+		"opaque-secret":  true,
+	}
+	if len(values) != len(want) {
+		t.Fatalf("exact turn input values = %v, want credential values only", values)
+	}
+	for _, value := range values {
+		if !want[value] {
+			t.Fatalf("exact turn input values unexpectedly include %q: %v", value, values)
+		}
+	}
+}
+
 func TestServerStoresOversizedCompletedResultOutOfBand(t *testing.T) {
 	cfg := DefaultConfig()
 	cfg.AllowUnauthenticated = true
@@ -690,6 +1809,7 @@ func TestServerClassifiesCancelBeforeResultFileParsing(t *testing.T) {
 }
 
 func TestServerPassesSecurityStageEnvToCodexAdapter(t *testing.T) {
+	configureSuccessfulArtifactUpload(t)
 	artifactDir := "/tmp/artifacts"
 	_ = os.RemoveAll(artifactDir)
 	t.Cleanup(func() { _ = os.RemoveAll(artifactDir) })
@@ -738,6 +1858,7 @@ printf 'done'
 }
 
 func TestServerCreatesWorkspaceArtifactLinkAndEnforcesRequiredArtifacts(t *testing.T) {
+	configureSuccessfulArtifactUpload(t)
 	cfg := DefaultConfig()
 	cfg.AllowUnauthenticated = true
 	cfg.Generic = GenericAdapterConfig{
@@ -891,6 +2012,10 @@ func TestServerRejectsUnsupportedRuntimeAuthOnlyCommand(t *testing.T) {
 	frames := collectWrapperFrames(t, client, request.TurnID, 0)
 	last := frames[len(frames)-1]
 	if last.Type != harness.FrameTurnFailed || last.Failed == nil || last.Failed.Reason != "runtime_auth_proxy_failed" {
-		t.Fatalf("last frame = %#v, want runtime auth proxy failure", last)
+		t.Fatalf("last frame = %#v failed = %#v, want runtime auth proxy failure", last, last.Failed)
+	}
+	wantMessage := `runtime-auth-only credential proxy does not support runtime "generic"`
+	if got, want := last.Failed.Message, wantMessage; got != want {
+		t.Fatalf("failed message = %q, want %q", got, want)
 	}
 }
diff --git a/workers/harness/cliwrapper/turn_registry.go b/workers/harness/cliwrapper/turn_registry.go
index e1397059e..b70ae3534 100644
--- a/workers/harness/cliwrapper/turn_registry.go
+++ b/workers/harness/cliwrapper/turn_registry.go
@@ -80,6 +80,25 @@ func (r *turnRegistry) finishActive() {
 	}
 }
 
+// reject removes a turn that was reserved in memory but could not be durably
+// accepted. It deliberately does not create a consumed-turn tombstone because
+// the durable ledger proves that no executor accepted this attempt.
+func (r *turnRegistry) reject(turn *turnState) {
+	if turn == nil {
+		return
+	}
+	r.mu.Lock()
+	if current := r.turns[turn.id()]; current == turn {
+		delete(r.turns, turn.id())
+		if r.activeTurns > 0 {
+			r.activeTurns--
+		}
+	}
+	r.mu.Unlock()
+	turn.cancel()
+	turn.close()
+}
+
 func (r *turnRegistry) evict(turn *turnState) {
 	if turn == nil {
 		return
diff --git a/workers/harness/cliwrapper/workspace.go b/workers/harness/cliwrapper/workspace.go
index 995d8b3da..6d01cfd66 100644
--- a/workers/harness/cliwrapper/workspace.go
+++ b/workers/harness/cliwrapper/workspace.go
@@ -8,10 +8,10 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"slices"
 	"strings"
 	"time"
 
+	"github.com/orka-agents/orka/internal/harness"
 	"github.com/orka-agents/orka/internal/workerenv"
 )
 
@@ -20,7 +20,7 @@ var lookupWorkspaceHostIPs = func(ctx context.Context, host string) ([]net.IPAdd
 }
 
 const (
-	envAllowedGitHosts       = "ORKA_HARNESS_WRAPPER_ALLOWED_GIT_HOSTS"
+	envAllowedGitHosts       = harness.WrapperAllowedGitHostsEnv
 	controllerGitAskpassPath = "/bin/echo-token"
 	workspaceRefFetchDepth   = "1000"
 )
@@ -167,16 +167,7 @@ func relaxWorkspaceTreePermissions(root string) error {
 }
 
 func workspaceGitHostAllowed(host string) bool {
-	host = strings.ToLower(strings.TrimSpace(host))
-	if slices.Contains([]string{"github.com", "gitlab.com", "bitbucket.org"}, host) {
-		return true
-	}
-	for item := range strings.SplitSeq(os.Getenv(envAllowedGitHosts), ",") {
-		if host == strings.ToLower(strings.TrimSpace(item)) {
-			return true
-		}
-	}
-	return false
+	return harness.WrapperGitHostAllowed(host, os.Getenv(envAllowedGitHosts))
 }
 
 func workspaceIPBlocked(ip net.IP) bool {
diff --git a/workers/harness/cliwrapper/workspace_test.go b/workers/harness/cliwrapper/workspace_test.go
index 8a9c4dddd..d282ca026 100644
--- a/workers/harness/cliwrapper/workspace_test.go
+++ b/workers/harness/cliwrapper/workspace_test.go
@@ -107,16 +107,20 @@ func TestFetchAndCheckoutWorkspaceRefRejectsPathspecFallback(t *testing.T) {
 
 func TestFetchWorkspaceRemoteBranchRedactsRawRepoURL(t *testing.T) {
 	cloneDir, _ := newWorkspaceGitFixture(t)
-	rawRepo := "https://user:token@example.invalid/private/repo.git?secret=value#frag"
-	err := fetchWorkspaceRemoteBranch(context.Background(), cloneDir, "missing", rawRepo)
+	const (
+		testUser     = "test-user"
+		testPassword = "test-passphrase"
+	)
+	rawRepo := "https://" + testUser + ":" + testPassword + "@example.invalid/org/repo.git"
+	err := fetchWorkspaceRemoteBranch(context.Background(), cloneDir, "missing-remote", rawRepo)
 	if err == nil {
-		t.Fatal("fetchWorkspaceRemoteBranch error = nil, want fetch failure")
+		t.Fatal("expected fetch failure")
 	}
 	message := err.Error()
-	if strings.Contains(message, "user:token") ||
-		strings.Contains(message, "secret=value") ||
-		strings.Contains(message, "#frag") {
-		t.Fatalf("fetchWorkspaceRemoteBranch error leaked raw repo URL: %v", err)
+	if strings.Contains(message, rawRepo) ||
+		strings.Contains(message, testUser) ||
+		strings.Contains(message, testPassword) {
+		t.Fatalf("fetch error leaked credential-bearing repository URL: %v", err)
 	}
 }
 
diff --git a/workers/harness/dockerfile_test.go b/workers/harness/dockerfile_test.go
new file mode 100644
index 000000000..c0a667817
--- /dev/null
+++ b/workers/harness/dockerfile_test.go
@@ -0,0 +1,38 @@
+package harness
+
+import (
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/orka-agents/orka/internal/acp"
+)
+
+func TestDockerfilePinsAgentCLIs(t *testing.T) {
+	t.Parallel()
+	data, err := os.ReadFile("Dockerfile")
+	if err != nil {
+		t.Fatal(err)
+	}
+	content := string(data)
+	for _, required := range []string{
+		"@openai/codex@" + acp.CodexCLIVersion,
+		"@anthropic-ai/claude-code@" + acp.ClaudeCodeVersion,
+		"opencode-ai@1.18.2",
+		"command -v codex",
+		"command -v claude",
+		"command -v opencode",
+	} {
+		if !strings.Contains(content, required) {
+			t.Errorf("Dockerfile is missing %q", required)
+		}
+	}
+	for _, unpinned := range []string{
+		"@openai/codex ",
+		"@anthropic-ai/claude-code ",
+	} {
+		if strings.Contains(content, unpinned) {
+			t.Errorf("Dockerfile contains unpinned CLI package %q", strings.TrimSpace(unpinned))
+		}
+	}
+}
diff --git a/workers/publisher/Dockerfile b/workers/publisher/Dockerfile
new file mode 100644
index 000000000..196f95cb8
--- /dev/null
+++ b/workers/publisher/Dockerfile
@@ -0,0 +1,82 @@
+# syntax=docker/dockerfile:1.7.1@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
+
+ARG GIT_VERSION=2.55.0
+ARG GIT_SOURCE_SHA256=457fdb04dc8728e007d4688695e6912e6f680727920f2a40bf11eacc17505357
+
+FROM --platform=$TARGETPLATFORM docker.io/library/debian:bookworm-slim@sha256:7b140f374b289a7c2befc338f42ebe6441b7ea838a042bbd5acbfca6ec875818 AS git-builder
+ARG GIT_VERSION
+ARG GIT_SOURCE_SHA256
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      build-essential=12.9 ca-certificates=20230311+deb12u1 \
+      libcurl4-openssl-dev=7.88.1-10+deb12u15 libexpat1-dev=2.5.0-1+deb12u2 \
+      libssl-dev=3.0.20-1~deb12u2 perl=5.36.0-7+deb12u3 pkg-config=1.8.1-1 \
+      xz-utils=5.4.1-1+deb12u1 zlib1g-dev=1:1.2.13.dfsg-1 \
+    && rm -rf /var/lib/apt/lists/*
+ADD --checksum=sha256:457fdb04dc8728e007d4688695e6912e6f680727920f2a40bf11eacc17505357 \
+    https://www.kernel.org/pub/software/scm/git/git-2.55.0.tar.xz /tmp/git.tar.xz
+RUN set -eux; \
+    test "$GIT_VERSION" = "2.55.0"; \
+    test "$GIT_SOURCE_SHA256" = "457fdb04dc8728e007d4688695e6912e6f680727920f2a40bf11eacc17505357"; \
+    mkdir /src; \
+    tar -xJf /tmp/git.tar.xz --strip-components=1 -C /src; \
+    make -C /src -j"$(nproc)" prefix=/usr/local \
+      NO_GETTEXT=YesPlease NO_TCLTK=YesPlease NO_PERL=YesPlease NO_PYTHON=YesPlease NO_RUST=YesPlease \
+      NO_INSTALL_HARDLINKS=YesPlease all; \
+    make -C /src prefix=/usr/local \
+      NO_GETTEXT=YesPlease NO_TCLTK=YesPlease NO_PERL=YesPlease NO_PYTHON=YesPlease NO_RUST=YesPlease \
+      NO_INSTALL_HARDLINKS=YesPlease install; \
+    test "$(/usr/local/bin/git version)" = "git version 2.55.0"; \
+    rm -rf /usr/local/share/man /usr/local/share/doc /usr/local/share/git-gui /usr/local/share/gitk
+
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26.2-bookworm@sha256:47ce5636e9936b2c5cbf708925578ef386b4f8872aec74a67bd13a627d242b19 AS service-builder
+ARG TARGETOS
+ARG TARGETARCH
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked go mod download
+COPY . .
+RUN set -eu; \
+    test "$TARGETOS" = linux; \
+    case "$TARGETARCH" in amd64|arm64) ;; *) echo "unsupported TARGETARCH: $TARGETARCH" >&2; exit 1 ;; esac; \
+    CGO_ENABLED=0 GOOS="$TARGETOS" GOARCH="$TARGETARCH" \
+      go build -buildvcs=false -trimpath -ldflags='-s -w' \
+      -o /out/orka-workspace-publisher ./cmd/orka-workspace-publisher
+
+FROM docker.io/library/debian:bookworm-slim@sha256:7b140f374b289a7c2befc338f42ebe6441b7ea838a042bbd5acbfca6ec875818
+LABEL org.opencontainers.image.title="Orka workspace publisher" \
+      org.opencontainers.image.description="Clean-room source workspace and exact Git publication service" \
+      org.opencontainers.image.source="https://github.com/orka-agents/orka" \
+      org.opencontainers.image.licenses="MIT AND GPL-2.0-only" \
+      io.orka.network.identity="workspace-publisher" \
+      io.orka.scm-egress="authenticated-proxy-only" \
+      io.orka.provider-access="false" \
+      io.orka.mcp-access="false" \
+      io.orka.git.version="2.55.0" \
+      io.orka.git.revision="e9019fcafe0040228b8631c30f97ae1adb61bcdc" \
+      io.orka.git.source.digest="sha256:457fdb04dc8728e007d4688695e6912e6f680727920f2a40bf11eacc17505357"
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      ca-certificates=20230311+deb12u1 \
+      libcurl4=7.88.1-10+deb12u15 \
+      libexpat1=2.5.0-1+deb12u2 \
+      zlib1g=1:1.2.13.dfsg-1 \
+    && rm -rf /var/lib/apt/lists/* \
+    && install -d -m 0700 -o 65532 -g 65532 \
+      /data/publications /data/service /tmp/orka-workspace-publisher/home \
+      /var/run/secrets/orka-publisher/credentials /usr/share/licenses/git
+COPY --from=git-builder /usr/local/ /usr/local/
+COPY --from=git-builder /src/COPYING /usr/share/licenses/git/COPYING
+COPY --from=service-builder /out/orka-workspace-publisher /usr/local/bin/orka-workspace-publisher
+ENV HOME=/tmp/orka-workspace-publisher/home \
+    GIT_CONFIG_GLOBAL=/dev/null \
+    GIT_CONFIG_NOSYSTEM=1 \
+    ORKA_PUBLISHER_ARTIFACT_ROOT=/data/publications \
+    ORKA_PUBLISHER_JOURNAL_ROOT=/data/service \
+    ORKA_PUBLISHER_TEMP_ROOT=/tmp/orka-workspace-publisher \
+    ORKA_PUBLISHER_GIT_BINARY=/usr/local/bin/git \
+    ORKA_PUBLISHER_REQUIRED_GIT_VERSION=2.55.0 \
+    PATH=/usr/local/bin:/usr/bin:/bin
+WORKDIR /tmp/orka-workspace-publisher
+USER 65532:65532
+EXPOSE 8080
+STOPSIGNAL SIGTERM
+ENTRYPOINT ["/usr/local/bin/orka-workspace-publisher"]
diff --git a/workers/publisher/README.md b/workers/publisher/README.md
new file mode 100644
index 000000000..e2c2804c2
--- /dev/null
+++ b/workers/publisher/README.md
@@ -0,0 +1,50 @@
+# Orka clean-room Workspace/Publisher image
+
+This image is intentionally separate from provider runtime images. It has Git and
+SCM egress, but no provider or MCP clients, credentials, configuration, or
+endpoints. Deploy it with its own ServiceAccount and network identity.
+
+Required mounted files and configuration:
+
+- controller bearer token file
+- publisher operation-capability HMAC secret file
+- controller artifact-authorization broker URL; the Publisher never receives the artifact signing key
+- controller credential-broker URL; Task Secret values are delivered only for the exact active operation
+- a bounded writable volume at `/data` for prepared bundles and operation journals
+- a bounded writable `emptyDir` at `/tmp/orka-workspace-publisher`
+- `ORKA_PUBLISHER_ARTIFACT_API_URL`
+- `ORKA_PUBLISHER_ARTIFACT_AUTHORIZATION_BROKER_URL`
+- `ORKA_PUBLISHER_CREDENTIAL_BROKER_URL`
+- an exact `ORKA_PUBLISHER_ALLOWED_SCM_HOSTS` allowlist in production
+
+The Git credential API accepts references only. A Git credential file contains a
+single `Authorization:` extra header and is copied into an operation-private Git
+configuration. A PR backend receives only an operation-private copy of a
+`forge-token` file. Neither credential value is accepted in JSON, returned, or
+logged.
+
+Recommended network policy:
+
+- allow controller-to-publisher traffic
+- allow publisher-to-controller artifact API traffic
+- allow DNS and reviewed SCM/forge destinations
+- deny provider proxies, MCP servers, Kubernetes API, metadata services, and all
+  other egress
+
+Build and inspect:
+
+```bash
+docker buildx build --builder remote-vm \
+  --platform linux/amd64,linux/arm64 \
+  --file workers/publisher/Dockerfile \
+  --provenance=mode=max --sbom=true \
+  --tag docker.io/sozercan/orka-workspace-publisher:<tag> \
+  --push .
+
+docker buildx build --check --file workers/publisher/Dockerfile .
+trivy config workers/publisher/Dockerfile
+```
+
+Git is built from the official `git-2.55.0.tar.xz` archive with a frozen SHA-256
+and source commit. The Dockerfile pins the multi-architecture Debian and Go base
+manifest digests.
diff --git a/workers/publisher/dockerfile_test.go b/workers/publisher/dockerfile_test.go
new file mode 100644
index 000000000..08d867e60
--- /dev/null
+++ b/workers/publisher/dockerfile_test.go
@@ -0,0 +1,55 @@
+package publisher
+
+import (
+	"os"
+	"strings"
+	"testing"
+)
+
+func TestDockerfilePinsCleanRoomProfile(t *testing.T) {
+	t.Parallel()
+	data, err := os.ReadFile("Dockerfile")
+	if err != nil {
+		t.Fatal(err)
+	}
+	contents := string(data)
+	required := []string{
+		"docker.io/library/debian:bookworm-slim@sha256:7b140f374b289a7c2befc338f42ebe6441b7ea838a042bbd5acbfca6ec875818",
+		"docker.io/library/golang:1.26.2-bookworm@sha256:47ce5636e9936b2c5cbf708925578ef386b4f8872aec74a67bd13a627d242b19",
+		"GIT_VERSION=2.55.0",
+		"FROM --platform=$TARGETPLATFORM docker.io/library/debian:bookworm-slim@sha256:" +
+			"7b140f374b289a7c2befc338f42ebe6441b7ea838a042bbd5acbfca6ec875818 AS git-builder",
+		"457fdb04dc8728e007d4688695e6912e6f680727920f2a40bf11eacc17505357",
+		"e9019fcafe0040228b8631c30f97ae1adb61bcdc",
+		"ADD --checksum=sha256:",
+		"NO_RUST=YesPlease",
+		"USER 65532:65532",
+		"io.orka.network.identity=\"workspace-publisher\"",
+		"io.orka.provider-access=\"false\"",
+		"io.orka.mcp-access=\"false\"",
+		"COPY --from=git-builder /src/COPYING /usr/share/licenses/git/COPYING",
+		"ENTRYPOINT [\"/usr/local/bin/orka-workspace-publisher\"]",
+	}
+	for _, value := range required {
+		if !strings.Contains(contents, value) {
+			t.Errorf("Dockerfile is missing %q", value)
+		}
+	}
+	forbidden := []string{
+		"apt-get install -y git", "OPENAI_API_KEY", "ANTHROPIC_API_KEY", "CODEX_API_KEY",
+		"MCP_SERVER", "npx ", "npm install", "curl ", "wget ",
+		"FROM --platform=$BUILDPLATFORM docker.io/library/debian:bookworm-slim@sha256:" +
+			"7b140f374b289a7c2befc338f42ebe6441b7ea838a042bbd5acbfca6ec875818 AS git-builder",
+	}
+	for _, value := range forbidden {
+		if strings.Contains(contents, value) {
+			t.Errorf("Dockerfile contains forbidden mutable/provider surface %q", value)
+		}
+	}
+	for line := range strings.SplitSeq(contents, "\n") {
+		trimmed := strings.TrimSpace(line)
+		if strings.HasPrefix(trimmed, "FROM ") && !strings.Contains(trimmed, "@sha256:") {
+			t.Errorf("un-pinned base image: %s", line)
+		}
+	}
+}